)]}' { "log": [ { "commit": "bba53a117a4a5c29da892962332ff1605990e17a", "tree": "ea67330bc83543211f23586233ca73a2fe314d9a", "parents": [ "9da8d6df2051478f0ba16d73c65995955c19cb3a" ], "author": { "name": "Phil Elwell", "email": "phil@raspberrypi.com", "time": "Wed Mar 26 11:28:28 2025" }, "committer": { "name": "Phil Elwell", "email": "phil@raspberrypi.com", "time": "Wed Mar 26 17:05:40 2025" }, "message": "dts: rp1: Don\u0027t use DMA with UARTs\n\nDMA has been enabled on RP1\u0027s UART0, but with mixed success. Transmits\nseem to work, but the DMA interface is not well suited to receiving\narbitrary amounts of data. In particular, the PL011 driver is slow to\npass on the received data, batching it into large blocks.\n\nOn balance, it\u0027s better to just disable the DMA support. As with the\nother UARTs, the required runes are left in the DTS as comments.\n\nSigned-off-by: Phil Elwell \u003cphil@raspberrypi.com\u003e\n" }, { "commit": "9da8d6df2051478f0ba16d73c65995955c19cb3a", "tree": "88d5d761ffaa985f89f9cf2fa0da50a8e2589a27", "parents": [ "0553897d77e849a86e836ddf1e0c0dbbd8e64f83" ], "author": { "name": "Phil Elwell", "email": "phil@raspberrypi.com", "time": "Tue Mar 18 13:09:11 2025" }, "committer": { "name": "Phil Elwell", "email": "phil@raspberrypi.com", "time": "Tue Mar 18 17:35:56 2025" }, "message": "overlays: Fix some unusable fragments\n\nA forthcoming overlaycheck update looks for dormant fragments with no\nparameters to enable them. The test discovered some real errors, which\nthis patch fixes, and one case where some fragments aren\u0027t yet being\nused, which this comments out until they are.\n\nSigned-off-by: Phil Elwell \u003cphil@raspberrypi.com\u003e\n" }, { "commit": "0553897d77e849a86e836ddf1e0c0dbbd8e64f83", "tree": "10285d7cbe39639146372f951a10a8dc74244a96", "parents": [ "08d4e8f52256bd422d8a1f876411603f627d0a82" ], "author": { "name": "Dave Stevenson", "email": "dave.stevenson@raspberrypi.com", "time": "Mon Jan 20 10:40:09 2025" }, "committer": { "name": "naushir", "email": "naushir@users.noreply.github.com", "time": "Mon Mar 17 08:59:30 2025" }, "message": "media: i2c: imx477: Add further link frequency options\n\nhttps://github.com/raspberrypi/linux/issues/6004 reports further\nissues with GPS interference.\n\nUntested, but adds further link frequency options.\n\nSigned-off-by: Dave Stevenson \u003cdave.stevenson@raspberrypi.com\u003e\n" }, { "commit": "08d4e8f52256bd422d8a1f876411603f627d0a82", "tree": "cc90247d5808c396ffc5a5a54cb51cc5544915e4", "parents": [ "3c21211667e35029054b0dfebdf292e4e7d5754b" ], "author": { "name": "Phil Elwell", "email": "phil@raspberrypi.com", "time": "Tue Mar 11 08:58:52 2025" }, "committer": { "name": "Phil Elwell", "email": "phil@raspberrypi.com", "time": "Tue Mar 11 10:02:35 2025" }, "message": "dts: Remove the power key debounce on Pi 500\n\nSigned-off-by: Phil Elwell \u003cphil@raspberrypi.com\u003e\n" }, { "commit": "3c21211667e35029054b0dfebdf292e4e7d5754b", "tree": "07bbf20b2275e03c439cff2de129c3266ef0840f", "parents": [ "85e1a7592aa192d760159f9bc6e83d56fdf433f3" ], "author": { "name": "Maíra Canal", "email": "mcanal@igalia.com", "time": "Fri Feb 28 00:00:42 2025" }, "committer": { "name": "Phil Elwell", "email": "8911409+pelwell@users.noreply.github.com", "time": "Fri Mar 07 16:42:29 2025" }, "message": "dts: bcm2712: Add V3D_SMS register\n\nSigned-off-by: Maíra Canal \u003cmcanal@igalia.com\u003e\n" }, { "commit": "85e1a7592aa192d760159f9bc6e83d56fdf433f3", "tree": "a09f8b7a98e3f9e241571fac0cbe64e9c6f281a3", "parents": [ "08e99bc475ad907f3087e4f14c2ddb6560514da1" ], "author": { "name": "Maíra Canal", "email": "mcanal@igalia.com", "time": "Sat Feb 22 18:49:49 2025" }, "committer": { "name": "Phil Elwell", "email": "8911409+pelwell@users.noreply.github.com", "time": "Fri Mar 07 16:42:29 2025" }, "message": "drm/v3d: Use V3D_SMS registers for power on/off and reset on V3D 7.x\n\nIn addition to the standard reset controller, V3D 7.x requires configuring\nthe V3D_SMS registers for proper power on/off and reset. Add the new\nregisters to `v3d_regs.h` and ensure they are properly configured during\ndevice probing, removal, and reset.\n\nThis change fixes GPU reset issues on the Raspberry Pi 5 (BCM2712).\nWithout exposing these registers, a GPU reset causes the GPU to hang,\nstopping any further job execution and freezing the desktop GUI. The same\nissue occurs when unloading and loading the v3d driver.\n\nLink: https://github.com/raspberrypi/linux/issues/6660\nSigned-off-by: Maíra Canal \u003cmcanal@igalia.com\u003e\n" }, { "commit": "08e99bc475ad907f3087e4f14c2ddb6560514da1", "tree": "7ab77fc60a14055021247e9ad0dd14dc05d926e9", "parents": [ "97988373018e7fa7ff33b7774f88d30e48f71509" ], "author": { "name": "Maíra Canal", "email": "mcanal@igalia.com", "time": "Sat Feb 22 18:26:39 2025" }, "committer": { "name": "Phil Elwell", "email": "8911409+pelwell@users.noreply.github.com", "time": "Fri Mar 07 16:42:29 2025" }, "message": "dt-bindings: gpu: v3d: Add SMS to the registers\u0027 list\n\nV3D 7.1 exposes a new register block, called V3D_SMS. As BCM2712 has a\nV3D 7.1 core, add a new register item to the list. Similar to the GCA\nand bridge register, SMS is optional and should only be added for V3D\n7.1 variants.\n\nCc: Krzysztof Kozlowski \u003ckrzk+dt@kernel.org\u003e\nCc: Conor Dooley \u003cconor+dt@kernel.org\u003e\nCc: Nicolas Saenz Julienne \u003cnsaenz@kernel.org\u003e\nCc: devicetree@vger.kernel.org\nSigned-off-by: Maíra Canal \u003cmcanal@igalia.com\u003e\n" }, { "commit": "97988373018e7fa7ff33b7774f88d30e48f71509", "tree": "264a4ef289b1a285895b8eeaa92f89d97c9ae05d", "parents": [ "131564261399a36a5cf2ac2731ed1ceffba93d10" ], "author": { "name": "Maíra Canal", "email": "mcanal@igalia.com", "time": "Tue Feb 25 23:44:59 2025" }, "committer": { "name": "Phil Elwell", "email": "8911409+pelwell@users.noreply.github.com", "time": "Fri Mar 07 16:42:29 2025" }, "message": "drm/v3d: Associate a V3D tech revision to all supported devices\n\nThe V3D driver currently determines the GPU tech version (33, 41...)\nby reading a register. This approach has worked so far since this\ninformation wasn’t needed before powering on the GPU.\n\nV3D 7.1 introduces new registers that must be written to power on the\nGPU, requiring us to know the V3D version beforehand. To address this,\nassociate each supported SoC with the corresponding VideoCore GPU version\nas part of the device data.\n\nTo prevent possible mistakes, add an assertion to verify that the version\nspecified in the device data matches the one reported by the hardware.\nIf there is a mismatch, the kernel will trigger a warning.\n\nSigned-off-by: Maíra Canal \u003cmcanal@igalia.com\u003e\n" }, { "commit": "131564261399a36a5cf2ac2731ed1ceffba93d10", "tree": "adc98f4242d092e489d2b6e1c5598b4b9d43982a", "parents": [ "5258ca4ad089548a72657522443b9c3e46fd125b" ], "author": { "name": "Maíra Canal", "email": "mcanal@igalia.com", "time": "Sat Feb 22 17:56:46 2025" }, "committer": { "name": "Phil Elwell", "email": "8911409+pelwell@users.noreply.github.com", "time": "Fri Mar 07 16:42:29 2025" }, "message": "drm/v3d: Set job pointer to NULL when the job\u0027s fence has an error\n\nSimilar to commit e4b5ccd392b9 (\"drm/v3d: Ensure job pointer is set to\nNULL after job completion\"), ensure the job pointer is set to `NULL` when\na job\u0027s fence has an error. Failing to do so can trigger kernel warnings\nin specific scenarios, such as:\n\n1. v3d_csd_job_run() assigns `v3d-\u003ecsd_job \u003d job`\n2. CSD job exceeds hang limit, causing a timeout → v3d_gpu_reset_for_timeout()\n3. GPU reset\n4. drm_sched_resubmit_jobs() sets the job\u0027s fence to `-ECANCELED`.\n5. v3d_csd_job_run() detects the fence error and returns NULL, not\n submitting the job to the GPU\n6. User-space runs `modprobe -r v3d`\n7. v3d_gem_destroy()\n\nv3d_gem_destroy() triggers a warning indicating that the CSD job never\nended, as we didn\u0027t set `v3d-\u003ecsd_job` to NULL after the timeout. The same\ncan also happen to BIN, RENDER, and TFU jobs.\n\nSigned-off-by: Maíra Canal \u003cmcanal@igalia.com\u003e\n" }, { "commit": "5258ca4ad089548a72657522443b9c3e46fd125b", "tree": "139568a9f2bf59da77ff0804f0cc53a9c0e66db0", "parents": [ "32c319ba2f2fd662a3b7bd042515cd650807dbff" ], "author": { "name": "Maíra Canal", "email": "mcanal@igalia.com", "time": "Sat Feb 22 17:40:21 2025" }, "committer": { "name": "Phil Elwell", "email": "8911409+pelwell@users.noreply.github.com", "time": "Fri Mar 07 16:42:29 2025" }, "message": "drm/v3d: Don\u0027t run jobs that have errors flagged in its fence\n\nThe V3D driver still relies on `drm_sched_increase_karma()` and\n`drm_sched_resubmit_jobs()` for resubmissions when a timeout occurs.\nThe function `drm_sched_increase_karma()` marks the job as guilty, while\n`drm_sched_resubmit_jobs()` sets an error (-ECANCELED) in the DMA fence of\nthat guilty job.\n\nBecause of this, we must check whether the job’s DMA fence has been\nflagged with an error before executing the job. Otherwise, the same guilty\njob may be resubmitted indefinitely, causing repeated GPU resets.\n\nThis patch adds a check for an error on the job\u0027s fence to prevent running\na guilty job that was previously flagged when the GPU timed out.\n\nNote that the CPU and CACHE_CLEAN queues do not require this check, as\ntheir jobs are executed synchronously once the DRM scheduler starts them.\n\nCc: stable@vger.kernel.org\nFixes: d223f98f0209 (\"drm/v3d: Add support for compute shader dispatch.\")\nFixes: 1584f16ca96e (\"drm/v3d: Add support for submitting jobs to the TFU.\")\nSigned-off-by: Maíra Canal \u003cmcanal@igalia.com\u003e\n" }, { "commit": "32c319ba2f2fd662a3b7bd042515cd650807dbff", "tree": "54cef4985b511fe63aa3ae5a7a9149819b5c6b43", "parents": [ "ac56a225e0889e60e912ecd3a51333a5aee901fc" ], "author": { "name": "Stefan Wahren", "email": "wahrenst@gmx.net", "time": "Sat Feb 01 12:50:46 2025" }, "committer": { "name": "Phil Elwell", "email": "8911409+pelwell@users.noreply.github.com", "time": "Fri Mar 07 16:42:29 2025" }, "message": "drm/v3d: Add clock handling\n\n[ Upstream commit 4dd40b5f9c3d89b67af0dbe059cf4a51aac6bf06 ]\n\nSince the initial commit 57692c94dcbe (\"drm/v3d: Introduce a new DRM driver\nfor Broadcom V3D V3.x+\") the struct v3d_dev reserved a pointer for\nan optional V3D clock. But there wasn\u0027t any code, which fetched it.\nSo add the missing clock handling before accessing any V3D registers.\n\nSigned-off-by: Stefan Wahren \u003cwahrenst@gmx.net\u003e\nReviewed-by: Maíra Canal \u003cmcanal@igalia.com\u003e\nSigned-off-by: Maíra Canal \u003cmcanal@igalia.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/20250201125046.33030-1-wahrenst@gmx.net\n[ Maíra: Backported to the downstream repository ]\nSigned-off-by: Maíra Canal \u003cmcanal@igalia.com\u003e\n" }, { "commit": "ac56a225e0889e60e912ecd3a51333a5aee901fc", "tree": "1d7036036248d4c408b1bf2e23332b961edf2b2a", "parents": [ "f1076a9d7a269d72b6707283560d0d38203cb07a" ], "author": { "name": "Dave Stevenson", "email": "dave.stevenson@raspberrypi.com", "time": "Tue Mar 04 15:28:53 2025" }, "committer": { "name": "Phil Elwell", "email": "8911409+pelwell@users.noreply.github.com", "time": "Tue Mar 04 15:52:46 2025" }, "message": "dtoverlays: ov9281: Add continuous clock option as an override\n\nThe previous change to make ov9281 always run in continuous clock\nmode causes problems on Pi3 for reasons that aren\u0027t fully\nunderstood. Pi4 is quite happy with it.\n\nChange the default back to being non-continuous clock, and add\nan override to select continuous clock mode and its slightly\ngreater max frame rate.\n\nhttps://forums.raspberrypi.com/viewtopic.php?p\u003d2300215\n\nSigned-off-by: Dave Stevenson \u003cdave.stevenson@raspberrypi.com\u003e\n" }, { "commit": "f1076a9d7a269d72b6707283560d0d38203cb07a", "tree": "f3af6f310ce3c3f41273f6efcb0423048605d871", "parents": [ "1337c39626c14ca5e61b4cddbc097d87212a0b13" ], "author": { "name": "KubaTaba1uga", "email": "luna7337anul@proton.me", "time": "Tue Mar 04 08:50:30 2025" }, "committer": { "name": "Phil Elwell", "email": "8911409+pelwell@users.noreply.github.com", "time": "Tue Mar 04 08:56:20 2025" }, "message": "delete the comment\n" }, { "commit": "1337c39626c14ca5e61b4cddbc097d87212a0b13", "tree": "581c9bf735a4efa57447680f38facfb476932dfd", "parents": [ "2e071057fded90e789c0101498e45a1778be93fe" ], "author": { "name": "KubaTaba1uga", "email": "luna7337anul@proton.me", "time": "Mon Mar 03 16:25:29 2025" }, "committer": { "name": "Phil Elwell", "email": "8911409+pelwell@users.noreply.github.com", "time": "Tue Mar 04 08:56:20 2025" }, "message": "fix clang compilation error\n" }, { "commit": "2e071057fded90e789c0101498e45a1778be93fe", "tree": "3f978c2e435071fbcdc1634674061673f7ecd242", "parents": [ "f8f3e202fb083906fbc98ef6ea445e424779c076" ], "author": { "name": "Richard Oliver", "email": "richard.oliver@raspberrypi.com", "time": "Tue Feb 25 15:27:59 2025" }, "committer": { "name": "Phil Elwell", "email": "8911409+pelwell@users.noreply.github.com", "time": "Tue Feb 25 17:15:00 2025" }, "message": "spi: rp2040-gpio-bridge: probe: Cfg fast_xfer clk\n\nFast transfer mode requires that the first bit of data is clocked with a\nrising edge. This can cause extra bits of data to be clocked on hardware\nwhere the clock signal uses a pull-up. This change ensures that clk is\ndriven low before fast data transfer mode is entered.\n\nSigned-off-by: Richard Oliver \u003crichard.oliver@raspberrypi.com\u003e\n" }, { "commit": "f8f3e202fb083906fbc98ef6ea445e424779c076", "tree": "11c105093592c7aff58c3f8b9392ae64d6b13484", "parents": [ "a4e7897eef1ad4628572a6abfd30291209a0bf43" ], "author": { "name": "Richard Oliver", "email": "richard.oliver@raspberrypi.com", "time": "Tue Feb 25 15:22:46 2025" }, "committer": { "name": "Phil Elwell", "email": "8911409+pelwell@users.noreply.github.com", "time": "Tue Feb 25 17:15:00 2025" }, "message": "spi: rp2040-gpio-bridge: fix gpiod error handling\n\nIn some circumstances, devm_gpiod_get_array_optional() can return\nPTR_ERR rather than NULL to indicate failure. Handle these cases.\n\nSigned-off-by: Richard Oliver \u003crichard.oliver@raspberrypi.com\u003e\n" }, { "commit": "a4e7897eef1ad4628572a6abfd30291209a0bf43", "tree": "1c0407e5d71588f92e1ad02886a69b89089a0ea1", "parents": [ "af9965a855a8c6c7140bbcccfa89eec7e90a993d" ], "author": { "name": "Richard Oliver", "email": "richard.oliver@raspberrypi.com", "time": "Tue Feb 25 15:06:23 2025" }, "committer": { "name": "Phil Elwell", "email": "8911409+pelwell@users.noreply.github.com", "time": "Tue Feb 25 17:15:00 2025" }, "message": "dts: Add hogs for RP1 GPIO 46/48 on CM5\n\nOn Pi5 5, GPIOs 46/48 are made available on the \u0027CAM/DISP 1\u0027 connector as\n\u0027CD1_IO0_MICCLK\u0027/\u0027CD1_IO1_MICDAT1\u0027. These GPIOs are not connected on\nCM5.\n\nAdd hogs for GPIO 46/48 on CM5 to prevent camera drivers from\ninadvertently using them when connected to \u0027CAM/DISP 1\u0027\n\nSigned-off-by: Richard Oliver \u003crichard.oliver@raspberrypi.com\u003e\n" }, { "commit": "af9965a855a8c6c7140bbcccfa89eec7e90a993d", "tree": "0423c145dfcd726b18c806c2f37104d850d4c34b", "parents": [ "011cbf22d7583687ae18690185169e5da0be000a" ], "author": { "name": "Phil Elwell", "email": "phil@raspberrypi.com", "time": "Tue Feb 25 12:16:33 2025" }, "committer": { "name": "Phil Elwell", "email": "8911409+pelwell@users.noreply.github.com", "time": "Tue Feb 25 13:06:33 2025" }, "message": "misc: rp1-pio: Demote fw probe error to warning\n\nSupport for the RP1 firmware mailbox API is rolling out to Pi 5 EEPROM\nimages. For most users, the fact that the PIO is not available is no\ncause for alarm. Change the message to a warning, so that it does not\nappear with \"quiet\" in cmdline.txt.\n\nLink: https://github.com/raspberrypi/linux/issues/6642\n\nSigned-off-by: Phil Elwell \u003cphil@raspberrypi.com\u003e\n" }, { "commit": "011cbf22d7583687ae18690185169e5da0be000a", "tree": "3e42c94063d0e13877dcb344ba1e7f9777305ac3", "parents": [ "9afba138031d6ee69824935b507cc9339427ddaf" ], "author": { "name": "Yuriy Pasichnyk", "email": "yurijpasichnyk11@gmail.com", "time": "Tue Feb 18 14:20:31 2025" }, "committer": { "name": "popcornmix", "email": "popcornmix@gmail.com", "time": "Wed Feb 19 16:06:07 2025" }, "message": "media: i2c: arducam-pivariety: Fix mutex init and NULL pointer\n\nThe mutex used in arducam-pivariety was not properly initialized,\nwhich could lead to undefined behavior. This also caused a NULL\npointer dereference under certain conditions.\n\nThis patch ensures the mutex is correctly initialized during probe\nand prevents NULL pointer dereferences.\n\nSigned-off-by: Yuriy Pasichnyk \u003cyurijpasichnyk11@gmail.com\u003e\n" }, { "commit": "9afba138031d6ee69824935b507cc9339427ddaf", "tree": "8a0942f6e9e1a9da92dac848df93c310746fa422", "parents": [ "081eebdeccfd12e0aaba4b64c9f87b608777913b", "4407146cf3fcfe8883f6123b89f861a11cc4e4df" ], "author": { "name": "Dom Cobley", "email": "popcornmix@gmail.com", "time": "Mon Feb 17 15:42:28 2025" }, "committer": { "name": "Dom Cobley", "email": "popcornmix@gmail.com", "time": "Mon Feb 17 15:42:28 2025" }, "message": "Merge remote-tracking branch \u0027stable/linux-6.6.y\u0027 into rpi-6.6.y\n" }, { "commit": "4407146cf3fcfe8883f6123b89f861a11cc4e4df", "tree": "5c2b361c8e6ca9107e7ada68c8d65341262f2750", "parents": [ "e8ad068c6ab84e92359686e841451149bbc3d220" ], "author": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:43 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:43 2025" }, "message": "Linux 6.6.78\n\nLink: https://lore.kernel.org/r/20250213142407.354217048@linuxfoundation.org\nTested-by: SeongJae Park \u003csj@kernel.org\u003e\nTested-by: Florian Fainelli \u003cflorian.fainelli@broadcom.com\u003e\nTested-by: Mark Brown \u003cbroonie@kernel.org\u003e\nTested-by: Hardik Garg \u003chargar@linux.microsoft.com\u003e\nTested-by: Peter Schneider \u003cpschneider1968@googlemail.com\u003e\nTested-by: Ron Economos \u003cre@w6rz.net\u003e\nTested-by: Jon Hunter \u003cjonathanh@nvidia.com\u003e\nTested-by: Harshit Mogalapalli \u003charshit.m.mogalapalli@oracle.com\u003e\nTested-By: Achill Gilgenast \u003cfossdd@pwned.life\u003e\nTested-by: Linux Kernel Functional Testing \u003clkft@linaro.org\u003e\nTested-by: Miguel Ojeda \u003cojeda@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "e8ad068c6ab84e92359686e841451149bbc3d220", "tree": "f41e2849ae368faf607130700abe26020c4445b5", "parents": [ "4fc0f9eadda8ee5ca4eabdcc87d9f59fc25001cd" ], "author": { "name": "Sean Christopherson", "email": "seanjc@google.com", "time": "Fri Jul 19 23:51:00 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:43 2025" }, "message": "KVM: x86: Re-split x2APIC ICR into ICR+ICR2 for AMD (x2AVIC)\n\ncommit 73b42dc69be8564d4951a14d00f827929fe5ef79 upstream.\n\nRe-introduce the \"split\" x2APIC ICR storage that KVM used prior to Intel\u0027s\nIPI virtualization support, but only for AMD. While not stated anywhere\nin the APM, despite stating the ICR is a single 64-bit register, AMD CPUs\nstore the 64-bit ICR as two separate 32-bit values in ICR and ICR2. When\nIPI virtualization (IPIv on Intel, all AVIC flavors on AMD) is enabled,\nKVM needs to match CPU behavior as some ICR ICR writes will be handled by\nthe CPU, not by KVM.\n\nAdd a kvm_x86_ops knob to control the underlying format used by the CPU to\nstore the x2APIC ICR, and tune it to AMD vs. Intel regardless of whether\nor not x2AVIC is enabled. If KVM is handling all ICR writes, the storage\nformat for x2APIC mode doesn\u0027t matter, and having the behavior follow AMD\nversus Intel will provide better test coverage and ease debugging.\n\nFixes: 4d1d7942e36a (\"KVM: SVM: Introduce logic to (de)activate x2AVIC mode\")\nCc: stable@vger.kernel.org\nCc: Maxim Levitsky \u003cmlevitsk@redhat.com\u003e\nCc: Suravee Suthikulpanit \u003csuravee.suthikulpanit@amd.com\u003e\nLink: https://lore.kernel.org/r/20240719235107.3023592-4-seanjc@google.com\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\n[JH: fixed conflict with vmx_x86_ops reshuffle due to missing commit 5f18c642ff7e2]\nSigned-off-by: James Houghton \u003cjthoughton@google.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "4fc0f9eadda8ee5ca4eabdcc87d9f59fc25001cd", "tree": "04969f78f223d0d39838cd6a5953d9929bd58b73", "parents": [ "8ea0e7b3d7b8f2f0fc9db491ff22a0abe120801c" ], "author": { "name": "Sean Christopherson", "email": "seanjc@google.com", "time": "Fri Aug 02 20:29:40 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:43 2025" }, "message": "KVM: x86: Make x2APIC ID 100% readonly\n\ncommit 4b7c3f6d04bd53f2e5b228b6821fb8f5d1ba3071 upstream.\n\nIgnore the userspace provided x2APIC ID when fixing up APIC state for\nKVM_SET_LAPIC, i.e. make the x2APIC fully readonly in KVM. Commit\na92e2543d6a8 (\"KVM: x86: use hardware-compatible format for APIC ID\nregister\"), which added the fixup, didn\u0027t intend to allow userspace to\nmodify the x2APIC ID. In fact, that commit is when KVM first started\ntreating the x2APIC ID as readonly, apparently to fix some race:\n\n static inline u32 kvm_apic_id(struct kvm_lapic *apic)\n {\n- return (kvm_lapic_get_reg(apic, APIC_ID) \u003e\u003e 24) \u0026 0xff;\n+ /* To avoid a race between apic_base and following APIC_ID update when\n+ * switching to x2apic_mode, the x2apic mode returns initial x2apic id.\n+ */\n+ if (apic_x2apic_mode(apic))\n+ return apic-\u003evcpu-\u003evcpu_id;\n+\n+ return kvm_lapic_get_reg(apic, APIC_ID) \u003e\u003e 24;\n }\n\nFurthermore, KVM doesn\u0027t support delivering interrupts to vCPUs with a\nmodified x2APIC ID, but KVM *does* return the modified value on a guest\nRDMSR and for KVM_GET_LAPIC. I.e. no remotely sane setup can actually\nwork with a modified x2APIC ID.\n\nMaking the x2APIC ID fully readonly fixes a WARN in KVM\u0027s optimized map\ncalculation, which expects the LDR to align with the x2APIC ID.\n\n WARNING: CPU: 2 PID: 958 at arch/x86/kvm/lapic.c:331 kvm_recalculate_apic_map+0x609/0xa00 [kvm]\n CPU: 2 PID: 958 Comm: recalc_apic_map Not tainted 6.4.0-rc3-vanilla+ #35\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.2-1-1 04/01/2014\n RIP: 0010:kvm_recalculate_apic_map+0x609/0xa00 [kvm]\n Call Trace:\n \u003cTASK\u003e\n kvm_apic_set_state+0x1cf/0x5b0 [kvm]\n kvm_arch_vcpu_ioctl+0x1806/0x2100 [kvm]\n kvm_vcpu_ioctl+0x663/0x8a0 [kvm]\n __x64_sys_ioctl+0xb8/0xf0\n do_syscall_64+0x56/0x80\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\n RIP: 0033:0x7fade8b9dd6f\n\nUnfortunately, the WARN can still trigger for other CPUs than the current\none by racing against KVM_SET_LAPIC, so remove it completely.\n\nReported-by: Michal Luczaj \u003cmhal@rbox.co\u003e\nCloses: https://lore.kernel.org/all/814baa0c-1eaa-4503-129f-059917365e80@rbox.co\nReported-by: Haoyu Wu \u003chaoyuwu254@gmail.com\u003e\nCloses: https://lore.kernel.org/all/20240126161633.62529-1-haoyuwu254@gmail.com\nReported-by: syzbot+545f1326f405db4e1c3e@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/all/000000000000c2a6b9061cbca3c3@google.com\nSigned-off-by: Sean Christopherson \u003cseanjc@google.com\u003e\nMessage-ID: \u003c20240802202941.344889-2-seanjc@google.com\u003e\nSigned-off-by: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\nSigned-off-by: James Houghton \u003cjthoughton@google.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "8ea0e7b3d7b8f2f0fc9db491ff22a0abe120801c", "tree": "97f544c9ee8a80ed438be6557a42c538f16b30c2", "parents": [ "d113f9723f2bfd9c6feeb899b8ddbee6b8a6e01f" ], "author": { "name": "Sean Anderson", "email": "sean.anderson@linux.dev", "time": "Fri Jan 10 21:38:22 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:43 2025" }, "message": "tty: xilinx_uartps: split sysrq handling\n\ncommit b06f388994500297bb91be60ffaf6825ecfd2afe upstream.\n\nlockdep detects the following circular locking dependency:\n\nCPU 0 CPU 1\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\ncdns_uart_isr() printk()\n uart_port_lock(port) console_lock()\n\t\t\t cdns_uart_console_write()\n if (!port-\u003esysrq)\n uart_port_lock(port)\n uart_handle_break()\n port-\u003esysrq \u003d ...\n uart_handle_sysrq_char()\n printk()\n console_lock()\n\nThe fixed commit attempts to avoid this situation by only taking the\nport lock in cdns_uart_console_write if port-\u003esysrq unset. However, if\n(as shown above) cdns_uart_console_write runs before port-\u003esysrq is set,\nthen it will try to take the port lock anyway. This may result in a\ndeadlock.\n\nFix this by splitting sysrq handling into two parts. We use the prepare\nhelper under the port lock and defer handling until we release the lock.\n\nFixes: 74ea66d4ca06 (\"tty: xuartps: Improve sysrq handling\")\nSigned-off-by: Sean Anderson \u003csean.anderson@linux.dev\u003e\nCc: stable@vger.kernel.org # c980248179d: serial: xilinx_uartps: Use port lock wrappers\nAcked-by: John Ogness \u003cjohn.ogness@linutronix.de\u003e\nLink: https://lore.kernel.org/r/20250110213822.2107462-1-sean.anderson@linux.dev\nSigned-off-by: Sean Anderson \u003csean.anderson@linux.dev\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d113f9723f2bfd9c6feeb899b8ddbee6b8a6e01f", "tree": "c024910cce44a8134fb60b9489a828dee1783e8c", "parents": [ "690c7fa03ebb167916b280a02f4bce3784a78580" ], "author": { "name": "Steve Wahl", "email": "steve.wahl@hpe.com", "time": "Wed Jul 17 21:31:21 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:43 2025" }, "message": "x86/mm/ident_map: Use gbpages only where full GB page should be mapped.\n\ncommit cc31744a294584a36bf764a0ffa3255a8e69f036 upstream.\n\nWhen ident_pud_init() uses only GB pages to create identity maps, large\nranges of addresses not actually requested can be included in the resulting\ntable; a 4K request will map a full GB. This can include a lot of extra\naddress space past that requested, including areas marked reserved by the\nBIOS. That allows processor speculation into reserved regions, that on UV\nsystems can cause system halts.\n\nOnly use GB pages when map creation requests include the full GB page of\nspace. Fall back to using smaller 2M pages when only portions of a GB page\nare included in the request.\n\nNo attempt is made to coalesce mapping requests. If a request requires a\nmap entry at the 2M (pmd) level, subsequent mapping requests within the\nsame 1G region will also be at the pmd level, even if adjacent or\noverlapping such requests could have been combined to map a full GB page.\nExisting usage starts with larger regions and then adds smaller regions, so\nthis should not have any great consequence.\n\nSigned-off-by: Steve Wahl \u003csteve.wahl@hpe.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nTested-by: Pavin Joseph \u003cme@pavinjoseph.com\u003e\nTested-by: Sarah Brofeldt \u003csrhb@dbc.dk\u003e\nTested-by: Eric Hagberg \u003cehagberg@gmail.com\u003e\nLink: https://lore.kernel.org/all/20240717213121.3064030-3-steve.wahl@hpe.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "690c7fa03ebb167916b280a02f4bce3784a78580", "tree": "f99ee72effa539e036cc15c0b8c9cd43891b8890", "parents": [ "a772014594644de89f309a65c1a4308ff1fde6f4" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Sun Feb 09 17:41:57 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:42 2025" }, "message": "selftests: mptcp: join: fix AF_INET6 variable\n\nThe Fixes commit is a backport renaming a variable, from AF_INET6 to\nMPTCP_LIB_AF_INET6.\n\nThe commit has been applied without conflicts, except that it missed one\nextra variable that was in v6.6, but not in the version linked to the\nFixes commit.\n\nThis variable has then been renamed too to avoid these errors:\n\n LISTENER_CREATED 10.0.2.1:10100 ./mptcp_join.sh: line 2944: [: 2: unary operator expected\n LISTENER_CLOSED 10.0.2.1:10100 ./mptcp_join.sh: line 2944: [: 2: unary operator expected\n\nFixes: a17d1419126b (\"selftests: mptcp: declare event macros in mptcp_lib\")\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "a772014594644de89f309a65c1a4308ff1fde6f4", "tree": "f6e93b609a0e234309c81a5bf1d7515b1ec24681", "parents": [ "de3b8d41d2547452c4cafb146d003fa4689fbaf2" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Sun Feb 09 17:41:56 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:42 2025" }, "message": "mptcp: prevent excessive coalescing on receive\n\ncommit 56b824eb49d6258aa0bad09a406ceac3f643cdae upstream.\n\nCurrently the skb size after coalescing is only limited by the skb\nlayout (the skb must not carry frag_list). A single coalesced skb\ncovering several MSS can potentially fill completely the receive\nbuffer. In such a case, the snd win will zero until the receive buffer\nwill be empty again, affecting tput badly.\n\nFixes: 8268ed4c9d19 (\"mptcp: introduce and use mptcp_try_coalesce()\")\nCc: stable@vger.kernel.org # please delay 2 weeks after 6.13-final release\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20241230-net-mptcp-rbuf-fixes-v1-3-8608af434ceb@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "de3b8d41d2547452c4cafb146d003fa4689fbaf2", "tree": "5a4008a64f9a78caa8a34d6d55bd09f8be53631e", "parents": [ "785408bbafcfa24c9fc5b251f03fd0780ce182bd" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Sun Feb 09 17:41:55 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:42 2025" }, "message": "mptcp: pm: only set fullmesh for subflow endp\n\ncommit 1bb0d1348546ad059f55c93def34e67cb2a034a6 upstream.\n\nWith the in-kernel path-manager, it is possible to change the \u0027fullmesh\u0027\nflag. The code in mptcp_pm_nl_fullmesh() expects to change it only on\n\u0027subflow\u0027 endpoints, to recreate more or less subflows using the linked\naddress.\n\nUnfortunately, the set_flags() hook was a bit more permissive, and\nallowed \u0027implicit\u0027 endpoints to get the \u0027fullmesh\u0027 flag while it is not\nallowed before.\n\nThat\u0027s what syzbot found, triggering the following warning:\n\n WARNING: CPU: 0 PID: 6499 at net/mptcp/pm_netlink.c:1496 __mark_subflow_endp_available net/mptcp/pm_netlink.c:1496 [inline]\n WARNING: CPU: 0 PID: 6499 at net/mptcp/pm_netlink.c:1496 mptcp_pm_nl_fullmesh net/mptcp/pm_netlink.c:1980 [inline]\n WARNING: CPU: 0 PID: 6499 at net/mptcp/pm_netlink.c:1496 mptcp_nl_set_flags net/mptcp/pm_netlink.c:2003 [inline]\n WARNING: CPU: 0 PID: 6499 at net/mptcp/pm_netlink.c:1496 mptcp_pm_nl_set_flags+0x974/0xdc0 net/mptcp/pm_netlink.c:2064\n Modules linked in:\n CPU: 0 UID: 0 PID: 6499 Comm: syz.1.413 Not tainted 6.13.0-rc5-syzkaller-00172-gd1bf27c4e176 #0\n Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\n RIP: 0010:__mark_subflow_endp_available net/mptcp/pm_netlink.c:1496 [inline]\n RIP: 0010:mptcp_pm_nl_fullmesh net/mptcp/pm_netlink.c:1980 [inline]\n RIP: 0010:mptcp_nl_set_flags net/mptcp/pm_netlink.c:2003 [inline]\n RIP: 0010:mptcp_pm_nl_set_flags+0x974/0xdc0 net/mptcp/pm_netlink.c:2064\n Code: 01 00 00 49 89 c5 e8 fb 45 e8 f5 e9 b8 fc ff ff e8 f1 45 e8 f5 4c 89 f7 be 03 00 00 00 e8 44 1d 0b f9 eb a0 e8 dd 45 e8 f5 90 \u003c0f\u003e 0b 90 e9 17 ff ff ff 89 d9 80 e1 07 38 c1 0f 8c c9 fc ff ff 48\n RSP: 0018:ffffc9000d307240 EFLAGS: 00010293\n RAX: ffffffff8bb72e03 RBX: 0000000000000000 RCX: ffff88807da88000\n RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\n RBP: ffffc9000d307430 R08: ffffffff8bb72cf0 R09: 1ffff1100b842a5e\n R10: dffffc0000000000 R11: ffffed100b842a5f R12: ffff88801e2e5ac0\n R13: ffff88805c214800 R14: ffff88805c2152e8 R15: 1ffff1100b842a5d\n FS: 00005555619f6500(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 0000000020002840 CR3: 00000000247e6000 CR4: 00000000003526f0\n DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n Call Trace:\n \u003cTASK\u003e\n genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline]\n genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]\n genl_rcv_msg+0xb14/0xec0 net/netlink/genetlink.c:1210\n netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2542\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219\n netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline]\n netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1347\n netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1891\n sock_sendmsg_nosec net/socket.c:711 [inline]\n __sock_sendmsg+0x221/0x270 net/socket.c:726\n ____sys_sendmsg+0x52a/0x7e0 net/socket.c:2583\n ___sys_sendmsg net/socket.c:2637 [inline]\n __sys_sendmsg+0x269/0x350 net/socket.c:2669\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n RIP: 0033:0x7f5fe8785d29\n Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48\n RSP: 002b:00007fff571f5558 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\n RAX: ffffffffffffffda RBX: 00007f5fe8975fa0 RCX: 00007f5fe8785d29\n RDX: 0000000000000000 RSI: 0000000020000480 RDI: 0000000000000007\n RBP: 00007f5fe8801b08 R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\n R13: 00007f5fe8975fa0 R14: 00007f5fe8975fa0 R15: 00000000000011f4\n \u003c/TASK\u003e\n\nHere, syzbot managed to set the \u0027fullmesh\u0027 flag on an \u0027implicit\u0027 and\nused -- according to \u0027id_avail_bitmap\u0027 -- endpoint, causing the PM to\ntry decrement the local_addr_used counter which is only incremented for\nthe \u0027subflow\u0027 endpoint.\n\nNote that \u0027no type\u0027 endpoints -- not \u0027subflow\u0027, \u0027signal\u0027, \u0027implicit\u0027 --\nare fine, because their ID will not be marked as used in the \u0027id_avail\u0027\nbitmap, and setting \u0027fullmesh\u0027 can help forcing the creation of subflow\nwhen receiving an ADD_ADDR.\n\nFixes: 73c762c1f07d (\"mptcp: set fullmesh flag in pm_netlink\")\nCc: stable@vger.kernel.org\nReported-by: syzbot+cd16e79c1e45f3fe0377@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/6786ac51.050a0220.216c54.00a6.GAE@google.com\nCloses: https://github.com/multipath-tcp/mptcp_net-next/issues/540\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20250123-net-mptcp-syzbot-issues-v1-2-af73258a726f@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n[ Conflicts in pm_netlink.c, because the code has been moved around in\n commit 6a42477fe449 (\"mptcp: update set_flags interfaces\"), but the\n same fix can still be applied at the original place. ]\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "785408bbafcfa24c9fc5b251f03fd0780ce182bd", "tree": "9aca211750003b2a419fb7373dc8ae109d785f1f", "parents": [ "893b28374aba25f78a34befb184624eebb468ab6" ], "author": { "name": "Zizhi Wo", "email": "wozizhi@huawei.com", "time": "Thu Nov 07 11:06:48 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:42 2025" }, "message": "cachefiles: Fix NULL pointer dereference in object-\u003efile\n\ncommit 31ad74b20227ce6b40910ff78b1c604e42975cf1 upstream.\n\nAt present, the object-\u003efile has the NULL pointer dereference problem in\nondemand-mode. The root cause is that the allocated fd and object-\u003efile\nlifetime are inconsistent, and the user-space invocation to anon_fd uses\nobject-\u003efile. Following is the process that triggers the issue:\n\n\t [write fd]\t\t\t\t[umount]\ncachefiles_ondemand_fd_write_iter\n\t\t\t\t fscache_cookie_state_machine\n\t\t\t\t\t cachefiles_withdraw_cookie\n if (!file) return -ENOBUFS\n\t\t\t\t\t cachefiles_clean_up_object\n\t\t\t\t\t cachefiles_unmark_inode_in_use\n\t\t\t\t\t fput(object-\u003efile)\n\t\t\t\t\t object-\u003efile \u003d NULL\n // file NULL pointer dereference!\n __cachefiles_write(..., file, ...)\n\nFix this issue by add an additional reference count to the object-\u003efile\nbefore write/llseek, and decrement after it finished.\n\nFixes: c8383054506c (\"cachefiles: notify the user daemon when looking up cookie\")\nSigned-off-by: Zizhi Wo \u003cwozizhi@huawei.com\u003e\nLink: https://lore.kernel.org/r/20241107110649.3980193-5-wozizhi@huawei.com\nReviewed-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Christian Brauner \u003cbrauner@kernel.org\u003e\nSigned-off-by: Bin Lan \u003clanbincn@qq.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "893b28374aba25f78a34befb184624eebb468ab6", "tree": "6a82bec86cec3016d4d73a7842409e32e9df5020", "parents": [ "b4e355e70e12aac855950323eb9f45f1586a5e5e" ], "author": { "name": "Filipe Manana", "email": "fdmanana@suse.com", "time": "Thu Feb 06 16:21:31 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:42 2025" }, "message": "btrfs: avoid monopolizing a core when activating a swap file\n\ncommit 2c8507c63f5498d4ee4af404a8e44ceae4345056 upstream.\n\nThis commit re-attempts the backport of the change to the linux-6.6.y\nbranch. Commit 6e1a82259307 (\"btrfs: avoid monopolizing a core when\nactivating a swap file\") on this branch was reverted.\n\nDuring swap activation we iterate over the extents of a file and we can\nhave many thousands of them, so we can end up in a busy loop monopolizing\na core. Avoid this by doing a voluntary reschedule after processing each\nextent.\n\nCC: stable@vger.kernel.org # 5.4+\nReviewed-by: Qu Wenruo \u003cwqu@suse.com\u003e\nSigned-off-by: Filipe Manana \u003cfdmanana@suse.com\u003e\nSigned-off-by: David Sterba \u003cdsterba@suse.com\u003e\nSigned-off-by: Koichiro Den \u003ckoichiro.den@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b4e355e70e12aac855950323eb9f45f1586a5e5e", "tree": "4727db2ac3c3ebc2f6c12e63021b5106b7ab36d9", "parents": [ "94459962b862d81891376ca883abaf19eecca943" ], "author": { "name": "Koichiro Den", "email": "koichiro.den@canonical.com", "time": "Thu Feb 06 16:21:30 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:42 2025" }, "message": "Revert \"btrfs: avoid monopolizing a core when activating a swap file\"\n\nThis reverts commit 6e1a8225930719a9f352d56320214e33e2dde0a6.\n\nThe backport for linux-6.6.y, commit 6e1a82259307 (\"btrfs: avoid\nmonopolizing a core when activating a swap file\"), inserted\ncond_resched() in the wrong location.\n\nRevert it now; a subsequent commit will re-backport the original patch.\n\nFixes: 6e1a82259307 (\"btrfs: avoid monopolizing a core when activating a swap file\") # linux-6.6.y\nSigned-off-by: Koichiro Den \u003ckoichiro.den@canonical.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "94459962b862d81891376ca883abaf19eecca943", "tree": "34bad149ea37cae0c2c99b37c32e862d5e93bcb5", "parents": [ "2cc0f0e1b976a05ce6a1395a0f55f07e9fc64791" ], "author": { "name": "Su Yue", "email": "glass.su@suse.com", "time": "Mon Jan 06 14:06:40 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:42 2025" }, "message": "ocfs2: check dir i_size in ocfs2_find_entry\n\ncommit b0fce54b8c0d8e5f2b4c243c803c5996e73baee8 upstream.\n\nsyz reports an out of bounds read:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nBUG: KASAN: slab-out-of-bounds in ocfs2_match fs/ocfs2/dir.c:334\n[inline]\nBUG: KASAN: slab-out-of-bounds in ocfs2_search_dirblock+0x283/0x6e0\nfs/ocfs2/dir.c:367\nRead of size 1 at addr ffff88804d8b9982 by task syz-executor.2/14802\n\nCPU: 0 UID: 0 PID: 14802 Comm: syz-executor.2 Not tainted 6.13.0-rc4 #2\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1\n04/01/2014\nSched_ext: serialise (enabled+all), task: runnable_at\u003d-10ms\nCall Trace:\n\u003cTASK\u003e\n__dump_stack lib/dump_stack.c:94 [inline]\ndump_stack_lvl+0x229/0x350 lib/dump_stack.c:120\nprint_address_description mm/kasan/report.c:378 [inline]\nprint_report+0x164/0x530 mm/kasan/report.c:489\nkasan_report+0x147/0x180 mm/kasan/report.c:602\nocfs2_match fs/ocfs2/dir.c:334 [inline]\nocfs2_search_dirblock+0x283/0x6e0 fs/ocfs2/dir.c:367\nocfs2_find_entry_id fs/ocfs2/dir.c:414 [inline]\nocfs2_find_entry+0x1143/0x2db0 fs/ocfs2/dir.c:1078\nocfs2_find_files_on_disk+0x18e/0x530 fs/ocfs2/dir.c:1981\nocfs2_lookup_ino_from_name+0xb6/0x110 fs/ocfs2/dir.c:2003\nocfs2_lookup+0x30a/0xd40 fs/ocfs2/namei.c:122\nlookup_open fs/namei.c:3627 [inline]\nopen_last_lookups fs/namei.c:3748 [inline]\npath_openat+0x145a/0x3870 fs/namei.c:3984\ndo_filp_open+0xe9/0x1c0 fs/namei.c:4014\ndo_sys_openat2+0x135/0x1d0 fs/open.c:1402\ndo_sys_open fs/open.c:1417 [inline]\n__do_sys_openat fs/open.c:1433 [inline]\n__se_sys_openat fs/open.c:1428 [inline]\n__x64_sys_openat+0x15d/0x1c0 fs/open.c:1428\ndo_syscall_x64 arch/x86/entry/common.c:52 [inline]\ndo_syscall_64+0xf6/0x210 arch/x86/entry/common.c:83\nentry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f01076903ad\nCode: c3 e8 a7 2b 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89\nf7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01\nf0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f01084acfc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101\nRAX: ffffffffffffffda RBX: 00007f01077cbf80 RCX: 00007f01076903ad\nRDX: 0000000000105042 RSI: 0000000020000080 RDI: ffffffffffffff9c\nRBP: 00007f01077cbf80 R08: 0000000000000000 R09: 0000000000000000\nR10: 00000000000001ff R11: 0000000000000246 R12: 0000000000000000\nR13: 00007f01077cbf80 R14: 00007f010764fc90 R15: 00007f010848d000\n\u003c/TASK\u003e\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nAnd a general protection fault in ocfs2_prepare_dir_for_insert:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nloop0: detected capacity change from 0 to 32768\nJBD2: Ignoring recovery information on journal\nocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data\nmode.\nOops: general protection fault, probably for non-canonical address\n0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\nCPU: 0 UID: 0 PID: 5096 Comm: syz-executor792 Not tainted\n6.11.0-rc4-syzkaller-00002-gb0da640826ba #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS\n1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\nRIP: 0010:ocfs2_find_dir_space_id fs/ocfs2/dir.c:3406 [inline]\nRIP: 0010:ocfs2_prepare_dir_for_insert+0x3309/0x5c70 fs/ocfs2/dir.c:4280\nCode: 00 00 e8 2a 25 13 fe e9 ba 06 00 00 e8 20 25 13 fe e9 4f 01 00 00\ne8 16 25 13 fe 49 8d 7f 08 49 8d 5f 09 48 89 f8 48 c1 e8 03 \u003c42\u003e 0f b6\n04 20 84 c0 0f 85 bd 23 00 00 48 89 d8 48 c1 e8 03 42 0f\nRSP: 0018:ffffc9000af9f020 EFLAGS: 00010202\nRAX: 0000000000000001 RBX: 0000000000000009 RCX: ffff88801e27a440\nRDX: 0000000000000000 RSI: 0000000000000400 RDI: 0000000000000008\nRBP: ffffc9000af9f830 R08: ffffffff8380395b R09: ffffffff838090a7\nR10: 0000000000000002 R11: ffff88801e27a440 R12: dffffc0000000000\nR13: ffff88803c660878 R14: f700000000000088 R15: 0000000000000000\nFS: 000055555a677380(0000) GS:ffff888020800000(0000)\nknlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000560bce569178 CR3: 000000001de5a000 CR4: 0000000000350ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n\u003cTASK\u003e\nocfs2_mknod+0xcaf/0x2b40 fs/ocfs2/namei.c:292\nvfs_mknod+0x36d/0x3b0 fs/namei.c:4088\ndo_mknodat+0x3ec/0x5b0\n__do_sys_mknodat fs/namei.c:4166 [inline]\n__se_sys_mknodat fs/namei.c:4163 [inline]\n__x64_sys_mknodat+0xa7/0xc0 fs/namei.c:4163\ndo_syscall_x64 arch/x86/entry/common.c:52 [inline]\ndo_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\nentry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f2dafda3a99\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 17 00 00 90 48 89\nf8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08\n0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8\n64 89 01 48\nRSP: 002b:00007ffe336a6658 EFLAGS: 00000246 ORIG_RAX:\n0000000000000103\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX:\n00007f2dafda3a99\nRDX: 00000000000021c0 RSI: 0000000020000040 RDI:\n00000000ffffff9c\nRBP: 00007f2dafe1b5f0 R08: 0000000000004480 R09:\n000055555a6784c0\nR10: 0000000000000103 R11: 0000000000000246 R12:\n00007ffe336a6680\nR13: 00007ffe336a68a8 R14: 431bde82d7b634db R15:\n00007f2dafdec03b\n\u003c/TASK\u003e\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nThe two reports are all caused invalid negative i_size of dir inode. For\nocfs2, dir_inode can\u0027t be negative or zero.\n\nHere add a check in which is called by ocfs2_check_dir_for_entry(). It\nfixes the second report as ocfs2_check_dir_for_entry() must be called\nbefore ocfs2_prepare_dir_for_insert(). Also set a up limit for dir with\nOCFS2_INLINE_DATA_FL. The i_size can\u0027t be great than blocksize.\n\nLink: https://lkml.kernel.org/r/20250106140640.92260-1-glass.su@suse.com\nReported-by: Jiacheng Xu \u003cstitch@zju.edu.cn\u003e\nLink: https://lore.kernel.org/ocfs2-devel/17a04f01.1ae74.19436d003fc.Coremail.stitch@zju.edu.cn/T/#u\nReported-by: syzbot+5a64828fcc4c2ad9b04f@syzkaller.appspotmail.com\nLink: https://lore.kernel.org/all/0000000000005894f3062018caf1@google.com/T/\nSigned-off-by: Su Yue \u003cglass.su@suse.com\u003e\nReviewed-by: Heming Zhao \u003cheming.zhao@suse.com\u003e\nReviewed-by: Joseph Qi \u003cjoseph.qi@linux.alibaba.com\u003e\nCc: Mark Fasheh \u003cmark@fasheh.com\u003e\nCc: Joel Becker \u003cjlbec@evilplan.org\u003e\nCc: Junxiao Bi \u003cjunxiao.bi@oracle.com\u003e\nCc: Changwei Ge \u003cgechangwei@live.cn\u003e\nCc: Jun Piao \u003cpiaojun@huawei.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "2cc0f0e1b976a05ce6a1395a0f55f07e9fc64791", "tree": "29521077f839e090765e5efce767b4d94201b509", "parents": [ "b85a1561989973339eb221b2a1434fd7bf082127" ], "author": { "name": "Paul Fertser", "email": "fercerpav@gmail.com", "time": "Mon Jan 20 13:35:36 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:41 2025" }, "message": "net/ncsi: use dev_set_mac_address() for Get MC MAC Address handling\n\ncommit 05d91cdb1f9108426b14975ef4eeddf15875ca05 upstream.\n\nCopy of the rationale from 790071347a0a1a89e618eedcd51c687ea783aeb3:\n\nChange ndo_set_mac_address to dev_set_mac_address because\ndev_set_mac_address provides a way to notify network layer about MAC\nchange. In other case, services may not aware about MAC change and keep\nusing old one which set from network adapter driver.\n\nAs example, DHCP client from systemd do not update MAC address without\nnotification from net subsystem which leads to the problem with acquiring\nthe right address from DHCP server.\n\nSince dev_set_mac_address requires RTNL lock the operation can not be\nperformed directly in the response handler, see\n9e2bbab94b88295dcc57c7580393c9ee08d7314d.\n\nThe way of selecting the first suitable MAC address from the list is\nchanged, instead of having the driver check it this patch just assumes\nany valid MAC should be good.\n\nFixes: b8291cf3d118 (\"net/ncsi: Add NC-SI 1.2 Get MC MAC Address command\")\nSigned-off-by: Paul Fertser \u003cfercerpav@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b85a1561989973339eb221b2a1434fd7bf082127", "tree": "0d3a0d587b09398e15377c705866587cbdbc2168", "parents": [ "34e7a2360c1ca99e9cada7266016159a3e0da3f0" ], "author": { "name": "Bence Csókás", "email": "csokas.bence@prolan.hu", "time": "Thu Dec 19 09:12:58 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:41 2025" }, "message": "spi: atmel-qspi: Memory barriers after memory-mapped I/O\n\ncommit be92ab2de0ee1a13291c3b47b2d7eb24d80c0a2c upstream.\n\nThe QSPI peripheral control and status registers are\naccessible via the SoC\u0027s APB bus, whereas MMIO transactions\u0027\ndata travels on the AHB bus.\n\nMicrochip documentation and even sample code from Atmel\nemphasises the need for a memory barrier before the first\nMMIO transaction to the AHB-connected QSPI, and before the\nlast write to its registers via APB. This is achieved by\nthe following lines in `atmel_qspi_transfer()`:\n\n\t/* Dummy read of QSPI_IFR to synchronize APB and AHB accesses */\n\t(void)atmel_qspi_read(aq, QSPI_IFR);\n\nHowever, the current documentation makes no mention to\nsynchronization requirements in the other direction, i.e.\nafter the last data written via AHB, and before the first\nregister access on APB.\n\nIn our case, we were facing an issue where the QSPI peripheral\nwould cease to send any new CSR (nCS Rise) interrupts,\nleading to a timeout in `atmel_qspi_wait_for_completion()`\nand ultimately this panic in higher levels:\n\n\tubi0 error: ubi_io_write: error -110 while writing 63108 bytes\n to PEB 491:128, written 63104 bytes\n\nAfter months of extensive research of the codebase, fiddling\naround the debugger with kgdb, and back-and-forth with\nMicrochip, we came to the conclusion that the issue is\nprobably that the peripheral is still busy receiving on AHB\nwhen the LASTXFER bit is written to its Control Register\non APB, therefore this write gets lost, and the peripheral\nstill thinks there is more data to come in the MMIO transfer.\nThis was first formulated when we noticed that doubling the\nwrite() of QSPI_CR_LASTXFER seemed to solve the problem.\n\nUltimately, the solution is to introduce memory barriers\nafter the AHB-mapped MMIO transfers, to ensure ordering.\n\nFixes: d5433def3153 (\"mtd: spi-nor: atmel-quadspi: Add spi-mem support to atmel-quadspi\")\nCc: Hari.PrasathGE@microchip.com\nCc: Mahesh.Abotula@microchip.com\nCc: Marco.Cardellini@microchip.com\nCc: stable@vger.kernel.org # c0a0203cf579: (\"spi: atmel-quadspi: Create `atmel_qspi_ops`\"...)\nCc: stable@vger.kernel.org # 6.x.y\nSigned-off-by: Bence Csókás \u003ccsokas.bence@prolan.hu\u003e\nLink: https://patch.msgid.link/20241219091258.395187-1-csokas.bence@prolan.hu\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "34e7a2360c1ca99e9cada7266016159a3e0da3f0", "tree": "230e53ce0a54586cd4a650baf2ce57b3b6cb56e2", "parents": [ "96c40135d8a8e226fbedf4f6f86b8b2c3c785242" ], "author": { "name": "Csókás, Bence", "email": "csokas.bence@prolan.hu", "time": "Thu Nov 28 17:43:14 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:41 2025" }, "message": "spi: atmel-quadspi: Create `atmel_qspi_ops` to support newer SoC families\n\ncommit c0a0203cf57963792d59b3e4317a1d07b73df42a upstream.\n\nRefactor the code to introduce an ops struct, to prepare for merging\nsupport for later SoCs, such as SAMA7G5. This code was based on the\nvendor\u0027s kernel (linux4microchip). Cc\u0027ing original contributors.\n\nSigned-off-by: Csókás, Bence \u003ccsokas.bence@prolan.hu\u003e\nLink: https://patch.msgid.link/20241128174316.3209354-2-csokas.bence@prolan.hu\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "96c40135d8a8e226fbedf4f6f86b8b2c3c785242", "tree": "82e3f9ad2786187d5da0b4894804bca3c9f71144", "parents": [ "ec8aa93c30f487b29781627a825cb660faed6e56" ], "author": { "name": "WangYuli", "email": "wangyuli@uniontech.com", "time": "Sat Jan 04 14:47:08 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:41 2025" }, "message": "MIPS: ftrace: Declare ftrace_get_parent_ra_addr() as static\n\ncommit ddd068d81445b17ac0bed084dfeb9e58b4df3ddd upstream.\n\nDeclare ftrace_get_parent_ra_addr() as static to suppress clang\ncompiler warning that \u0027no previous prototype\u0027. This function is\nnot intended to be called from other parts.\n\nFix follow error with clang-19:\n\narch/mips/kernel/ftrace.c:251:15: error: no previous prototype for function \u0027ftrace_get_parent_ra_addr\u0027 [-Werror,-Wmissing-prototypes]\n 251 | unsigned long ftrace_get_parent_ra_addr(unsigned long self_ra, unsigned long\n | ^\narch/mips/kernel/ftrace.c:251:1: note: declare \u0027static\u0027 if the function is not intended to be used outside of this translation unit\n 251 | unsigned long ftrace_get_parent_ra_addr(unsigned long self_ra, unsigned long\n | ^\n | static\n1 error generated.\n\nSigned-off-by: WangYuli \u003cwangyuli@uniontech.com\u003e\nAcked-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nReviewed-by: Philippe Mathieu-Daudé \u003cphilmd@linaro.org\u003e\nSigned-off-by: Thomas Bogendoerfer \u003ctsbogend@alpha.franken.de\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ec8aa93c30f487b29781627a825cb660faed6e56", "tree": "7955cfd67e61b9d5b74d66d824eb094fcde12278", "parents": [ "81846070cba17125a866e8023c01d3465b153339" ], "author": { "name": "Michal Simek", "email": "michal.simek@amd.com", "time": "Wed Nov 27 16:01:22 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:41 2025" }, "message": "rtc: zynqmp: Fix optional clock name property\n\ncommit 2a388ff22d2cbfc5cbd628ef085bdcd3b7dc64f5 upstream.\n\nClock description in DT binding introduced by commit f69060c14431\n(\"dt-bindings: rtc: zynqmp: Add clock information\") is talking about \"rtc\"\nclock name but driver is checking \"rtc_clk\" name instead.\nBecause clock is optional property likely in was never handled properly by\nthe driver.\n\nFixes: 07dcc6f9c762 (\"rtc: zynqmp: Add calibration set and get support\")\nSigned-off-by: Michal Simek \u003cmichal.simek@amd.com\u003e\nCc: stable@kernel.org\nReviewed-by: Peter Korsgaard \u003cpeter@korsgaard.com\u003e\nLink: https://lore.kernel.org/r/cd5f0c9d01ec1f5a240e37a7e0d85b8dacb3a869.1732723280.git.michal.simek@amd.com\nSigned-off-by: Alexandre Belloni \u003calexandre.belloni@bootlin.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "81846070cba17125a866e8023c01d3465b153339", "tree": "8e48bdf962c1cd42152c92e3cac7b8b5ce0e8f07", "parents": [ "0228e5a6672dcf1f29ec1caf396466c28432dfa0" ], "author": { "name": "Thomas Weißschuh", "email": "linux@weissschuh.net", "time": "Thu Jan 23 07:22:40 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:41 2025" }, "message": "ptp: Ensure info-\u003eenable callback is always set\n\ncommit fd53aa40e65f518453115b6f56183b0c201db26b upstream.\n\nThe ioctl and sysfs handlers unconditionally call the -\u003eenable callback.\nNot all drivers implement that callback, leading to NULL dereferences.\nExample of affected drivers: ptp_s390.c, ptp_vclock.c and ptp_mock.c.\n\nInstead use a dummy callback if no better was specified by the driver.\n\nFixes: d94ba80ebbea (\"ptp: Added a brand new class driver for ptp clocks.\")\nCc: stable@vger.kernel.org\nSigned-off-by: Thomas Weißschuh \u003clinux@weissschuh.net\u003e\nAcked-by: Richard Cochran \u003crichardcochran@gmail.com\u003e\nReviewed-by: Michal Swiatkowski \u003cmichal.swiatkowski@linux.intel.com\u003e\nLink: https://patch.msgid.link/20250123-ptp-enable-v1-1-b015834d3a47@weissschuh.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "0228e5a6672dcf1f29ec1caf396466c28432dfa0", "tree": "79b202feadd23eb778b652c73a06ebffed34d6e8", "parents": [ "52ad6195bdb9b453d6d96f3284d284df9c435bf4" ], "author": { "name": "Javier Carrasco", "email": "javier.carrasco.cruz@gmail.com", "time": "Wed Nov 06 22:04:39 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:40 2025" }, "message": "pinctrl: samsung: fix fwnode refcount cleanup if platform_get_irq_optional() fails\n\ncommit 459915f55509f4bfd6076daa1428e28490ddee3b upstream.\n\nCommit 50ebd19e3585 (\"pinctrl: samsung: drop pin banks references on\nerror paths\") fixed the pin bank references on the error paths of the\nprobe function, but there is still an error path where this is not done.\n\nIf samsung_pinctrl_get_soc_data() does not fail, the child references\nwill have acquired, and they will need to be released in the error path\nof platform_get_irq_optional(), as it is done in the following error\npaths within the probe function.\n\nReplace the direct return in the error path with a goto instruction to\nthe cleanup function.\n\nCc: stable@vger.kernel.org\nFixes: a382d568f144 (\"pinctrl: samsung: Use platform_get_irq_optional() to get the interrupt\")\nSigned-off-by: Javier Carrasco \u003cjavier.carrasco.cruz@gmail.com\u003e\nLink: https://lore.kernel.org/r/20241106-samsung-pinctrl-put-v1-1-de854e26dd03@gmail.com\n[krzysztof: change Fixes SHA to point to commit introducing the return\n leading to OF node leak]\nSigned-off-by: Krzysztof Kozlowski \u003ckrzysztof.kozlowski@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "52ad6195bdb9b453d6d96f3284d284df9c435bf4", "tree": "40a5bcbf05b7aa3b979e0d445dbd1eb69b522dbe", "parents": [ "094809f6aff488f9f3f3dd821724ff3e210f7661" ], "author": { "name": "Tomas Glozar", "email": "tglozar@redhat.com", "time": "Thu Jan 16 14:49:29 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:40 2025" }, "message": "rtla/timerlat_top: Stop timerlat tracer on signal\n\ncommit a4dfce7559d75430c464294ddee554be2a413c4a upstream.\n\nCurrently, when either SIGINT from the user or SIGALRM from the duration\ntimer is caught by rtla-timerlat, stop_tracing is set to break out of\nthe main loop. This is not sufficient for cases where the timerlat\ntracer is producing more data than rtla can consume, since in that case,\nrtla is looping indefinitely inside tracefs_iterate_raw_events, never\nreaches the check of stop_tracing and hangs.\n\nIn addition to setting stop_tracing, also stop the timerlat tracer on\nreceived signal (SIGINT or SIGALRM). This will stop new samples so that\nthe existing samples may be processed and tracefs_iterate_raw_events\neventually exits.\n\nCc: stable@vger.kernel.org\nCc: John Kacur \u003cjkacur@redhat.com\u003e\nCc: Luis Goncalves \u003clgoncalv@redhat.com\u003e\nCc: Gabriele Monaco \u003cgmonaco@redhat.com\u003e\nLink: https://lore.kernel.org/20250116144931.649593-4-tglozar@redhat.com\nFixes: a828cd18bc4a (\"rtla: Add timerlat tool and timelart top mode\")\nSigned-off-by: Tomas Glozar \u003ctglozar@redhat.com\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "094809f6aff488f9f3f3dd821724ff3e210f7661", "tree": "e36b1046b5433ea706e580ef3977737924c22c90", "parents": [ "5a9eb34972cb60b64b61a2d4a6fa05b6b342ac58" ], "author": { "name": "Tomas Glozar", "email": "tglozar@redhat.com", "time": "Thu Jan 16 14:49:28 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:40 2025" }, "message": "rtla/timerlat_hist: Stop timerlat tracer on signal\n\ncommit c73cab9dbed04d8f65ca69177b4b21ed3e09dfa7 upstream.\n\nCurrently, when either SIGINT from the user or SIGALRM from the duration\ntimer is caught by rtla-timerlat, stop_tracing is set to break out of\nthe main loop. This is not sufficient for cases where the timerlat\ntracer is producing more data than rtla can consume, since in that case,\nrtla is looping indefinitely inside tracefs_iterate_raw_events, never\nreaches the check of stop_tracing and hangs.\n\nIn addition to setting stop_tracing, also stop the timerlat tracer on\nreceived signal (SIGINT or SIGALRM). This will stop new samples so that\nthe existing samples may be processed and tracefs_iterate_raw_events\neventually exits.\n\nCc: stable@vger.kernel.org\nCc: John Kacur \u003cjkacur@redhat.com\u003e\nCc: Luis Goncalves \u003clgoncalv@redhat.com\u003e\nCc: Gabriele Monaco \u003cgmonaco@redhat.com\u003e\nLink: https://lore.kernel.org/20250116144931.649593-3-tglozar@redhat.com\nFixes: 1eeb6328e8b3 (\"rtla/timerlat: Add timerlat hist mode\")\nSigned-off-by: Tomas Glozar \u003ctglozar@redhat.com\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "5a9eb34972cb60b64b61a2d4a6fa05b6b342ac58", "tree": "549e8005c17869f7e2dcbb02aae6119265804cd9", "parents": [ "41955b6c268154f81e34f9b61cf8156eec0730c0" ], "author": { "name": "Tomas Glozar", "email": "tglozar@redhat.com", "time": "Thu Jan 16 14:49:27 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:40 2025" }, "message": "rtla: Add trace_instance_stop\n\ncommit e879b5dcf8d044f3865a32d95cc5b213f314c54f upstream.\n\nSupport not only turning trace on for the timerlat tracer, but also\nturning it off.\n\nThis will be used in subsequent patches to stop the timerlat tracer\nwithout also wiping the trace buffer.\n\nCc: stable@vger.kernel.org\nCc: John Kacur \u003cjkacur@redhat.com\u003e\nCc: Luis Goncalves \u003clgoncalv@redhat.com\u003e\nCc: Gabriele Monaco \u003cgmonaco@redhat.com\u003e\nLink: https://lore.kernel.org/20250116144931.649593-2-tglozar@redhat.com\nSigned-off-by: Tomas Glozar \u003ctglozar@redhat.com\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "41955b6c268154f81e34f9b61cf8156eec0730c0", "tree": "f2d4e19217afe4542a819bcc5857fdfd8f43cffc", "parents": [ "83b74901bdc9b58739193b8ee6989254391b6ba7" ], "author": { "name": "Tomas Glozar", "email": "tglozar@redhat.com", "time": "Tue Jan 07 14:48:23 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:40 2025" }, "message": "rtla/timerlat_top: Set OSNOISE_WORKLOAD for kernel threads\n\ncommit 217f0b1e990e30a1f06f6d531fdb4530f4788d48 upstream.\n\nWhen using rtla timerlat with userspace threads (-u or -U), rtla\ndisables the OSNOISE_WORKLOAD option in\n/sys/kernel/tracing/osnoise/options. This option is not re-enabled in a\nsubsequent run with kernel-space threads, leading to rtla collecting no\nresults if the previous run exited abnormally:\n\n$ rtla timerlat top -u\n^\\Quit (core dumped)\n$ rtla timerlat top -k -d 1s\n Timer Latency\n 0 00:00:01 | IRQ Timer Latency (us) | Thread Timer Latency (us)\nCPU COUNT | cur min avg max | cur min avg max\n\nThe issue persists until OSNOISE_WORKLOAD is set manually by running:\n$ echo OSNOISE_WORKLOAD \u003e /sys/kernel/tracing/osnoise/options\n\nSet OSNOISE_WORKLOAD when running rtla with kernel-space threads if\navailable to fix the issue.\n\nCc: stable@vger.kernel.org\nCc: John Kacur \u003cjkacur@redhat.com\u003e\nCc: Luis Goncalves \u003clgoncalv@redhat.com\u003e\nLink: https://lore.kernel.org/20250107144823.239782-4-tglozar@redhat.com\nFixes: cdca4f4e5e8e (\"rtla/timerlat_top: Add timerlat user-space support\")\nSigned-off-by: Tomas Glozar \u003ctglozar@redhat.com\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "83b74901bdc9b58739193b8ee6989254391b6ba7", "tree": "55b46557ccbc5a870dbb3df668f674161943de45", "parents": [ "d5eae440f718284c9633316aab7fbd516943d265" ], "author": { "name": "Tomas Glozar", "email": "tglozar@redhat.com", "time": "Tue Jan 07 14:48:22 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:40 2025" }, "message": "rtla/timerlat_hist: Set OSNOISE_WORKLOAD for kernel threads\n\ncommit d8d866171a414ed88bd0d720864095fd75461134 upstream.\n\nWhen using rtla timerlat with userspace threads (-u or -U), rtla\ndisables the OSNOISE_WORKLOAD option in\n/sys/kernel/tracing/osnoise/options. This option is not re-enabled in a\nsubsequent run with kernel-space threads, leading to rtla collecting no\nresults if the previous run exited abnormally:\n\n$ rtla timerlat hist -u\n^\\Quit (core dumped)\n$ rtla timerlat hist -k -d 1s\nIndex\nover:\ncount:\nmin:\navg:\nmax:\nALL: IRQ Thr Usr\ncount: 0 0 0\nmin: - - -\navg: - - -\nmax: - - -\n\nThe issue persists until OSNOISE_WORKLOAD is set manually by running:\n$ echo OSNOISE_WORKLOAD \u003e /sys/kernel/tracing/osnoise/options\n\nSet OSNOISE_WORKLOAD when running rtla with kernel-space threads if\navailable to fix the issue.\n\nCc: stable@vger.kernel.org\nCc: John Kacur \u003cjkacur@redhat.com\u003e\nCc: Luis Goncalves \u003clgoncalv@redhat.com\u003e\nLink: https://lore.kernel.org/20250107144823.239782-3-tglozar@redhat.com\nFixes: ed774f7481fa (\"rtla/timerlat_hist: Add timerlat user-space support\")\nSigned-off-by: Tomas Glozar \u003ctglozar@redhat.com\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d5eae440f718284c9633316aab7fbd516943d265", "tree": "2360dda5bb87dc62608145dd654c2f41b3eeb1ce", "parents": [ "ee8c4c39a8f97467d63adfe03bcd45139d8c8b53" ], "author": { "name": "Tomas Glozar", "email": "tglozar@redhat.com", "time": "Tue Jan 07 14:48:21 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:40 2025" }, "message": "rtla/osnoise: Distinguish missing workload option\n\ncommit 80d3ba1cf51bfbbb3b098434f2b2c95cd7c0ae5c upstream.\n\nosnoise_set_workload returns -1 for both missing OSNOISE_WORKLOAD option\nand failure in setting the option.\n\nReturn -1 for missing and -2 for failure to distinguish them.\n\nCc: stable@vger.kernel.org\nCc: John Kacur \u003cjkacur@redhat.com\u003e\nCc: Luis Goncalves \u003clgoncalv@redhat.com\u003e\nLink: https://lore.kernel.org/20250107144823.239782-2-tglozar@redhat.com\nSigned-off-by: Tomas Glozar \u003ctglozar@redhat.com\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ee8c4c39a8f97467d63adfe03bcd45139d8c8b53", "tree": "18b842f0db1814f4d36b10b62ba1b6527af81c99", "parents": [ "d86c6f80972e1ecefe5ba4060236fb9a86089f5c" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Jan 24 01:41:59 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:39 2025" }, "message": "tracing/osnoise: Fix resetting of tracepoints\n\ncommit e3ff4245928f948f3eb2e852aa350b870421c358 upstream.\n\nIf a timerlat tracer is started with the osnoise option OSNOISE_WORKLOAD\ndisabled, but then that option is enabled and timerlat is removed, the\ntracepoints that were enabled on timerlat registration do not get\ndisabled. If the option is disabled again and timelat is started, then it\ntriggers a warning in the tracepoint code due to registering the\ntracepoint again without ever disabling it.\n\nDo not use the same user space defined options to know to disable the\ntracepoints when timerlat is removed. Instead, set a global flag when it\nis enabled and use that flag to know to disable the events.\n\n ~# echo NO_OSNOISE_WORKLOAD \u003e /sys/kernel/tracing/osnoise/options\n ~# echo timerlat \u003e /sys/kernel/tracing/current_tracer\n ~# echo OSNOISE_WORKLOAD \u003e /sys/kernel/tracing/osnoise/options\n ~# echo nop \u003e /sys/kernel/tracing/current_tracer\n ~# echo NO_OSNOISE_WORKLOAD \u003e /sys/kernel/tracing/osnoise/options\n ~# echo timerlat \u003e /sys/kernel/tracing/current_tracer\n\nTriggers:\n\n ------------[ cut here ]------------\n WARNING: CPU: 6 PID: 1337 at kernel/tracepoint.c:294 tracepoint_add_func+0x3b6/0x3f0\n Modules linked in:\n CPU: 6 UID: 0 PID: 1337 Comm: rtla Not tainted 6.13.0-rc4-test-00018-ga867c441128e-dirty #73\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n RIP: 0010:tracepoint_add_func+0x3b6/0x3f0\n Code: 48 8b 53 28 48 8b 73 20 4c 89 04 24 e8 23 59 11 00 4c 8b 04 24 e9 36 fe ff ff 0f 0b b8 ea ff ff ff 45 84 e4 0f 84 68 fe ff ff \u003c0f\u003e 0b e9 61 fe ff ff 48 8b 7b 18 48 85 ff 0f 84 4f ff ff ff 49 8b\n RSP: 0018:ffffb9b003a87ca0 EFLAGS: 00010202\n RAX: 00000000ffffffef RBX: ffffffff92f30860 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: ffff9bf59e91ccd0 RDI: ffffffff913b6410\n RBP: 000000000000000a R08: 00000000000005c7 R09: 0000000000000002\n R10: ffffb9b003a87ce0 R11: 0000000000000002 R12: 0000000000000001\n R13: ffffb9b003a87ce0 R14: ffffffffffffffef R15: 0000000000000008\n FS: 00007fce81209240(0000) GS:ffff9bf6fdd00000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 000055e99b728000 CR3: 00000001277c0002 CR4: 0000000000172ef0\n Call Trace:\n \u003cTASK\u003e\n ? __warn.cold+0xb7/0x14d\n ? tracepoint_add_func+0x3b6/0x3f0\n ? report_bug+0xea/0x170\n ? handle_bug+0x58/0x90\n ? exc_invalid_op+0x17/0x70\n ? asm_exc_invalid_op+0x1a/0x20\n ? __pfx_trace_sched_migrate_callback+0x10/0x10\n ? tracepoint_add_func+0x3b6/0x3f0\n ? __pfx_trace_sched_migrate_callback+0x10/0x10\n ? __pfx_trace_sched_migrate_callback+0x10/0x10\n tracepoint_probe_register+0x78/0xb0\n ? __pfx_trace_sched_migrate_callback+0x10/0x10\n osnoise_workload_start+0x2b5/0x370\n timerlat_tracer_init+0x76/0x1b0\n tracing_set_tracer+0x244/0x400\n tracing_set_trace_write+0xa0/0xe0\n vfs_write+0xfc/0x570\n ? do_sys_openat2+0x9c/0xe0\n ksys_write+0x72/0xf0\n do_syscall_64+0x79/0x1c0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nCc: stable@vger.kernel.org\nCc: Masami Hiramatsu \u003cmhiramat@kernel.org\u003e\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nCc: Tomas Glozar \u003ctglozar@redhat.com\u003e\nCc: Gabriele Monaco \u003cgmonaco@redhat.com\u003e\nCc: Luis Goncalves \u003clgoncalv@redhat.com\u003e\nCc: John Kacur \u003cjkacur@redhat.com\u003e\nLink: https://lore.kernel.org/20250123204159.4450c88e@gandalf.local.home\nFixes: e88ed227f639e (\"tracing/timerlat: Add user-space interface\")\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d86c6f80972e1ecefe5ba4060236fb9a86089f5c", "tree": "883a5fd9c4c0645b2e0ec6103cd02960c9575fc6", "parents": [ "82aa8d362a2ae310e1d764359f7c392d4ff2b43c" ], "author": { "name": "Jan Kiszka", "email": "jan.kiszka@siemens.com", "time": "Fri Jan 10 10:36:33 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:39 2025" }, "message": "scripts/gdb: fix aarch64 userspace detection in get_current_task\n\ncommit 4ebc417ef9cb34010a71270421fe320ec5d88aa2 upstream.\n\nAt least recent gdb releases (seen with 14.2) return SP_EL0 as signed long\nwhich lets the right-shift always return 0.\n\nLink: https://lkml.kernel.org/r/dcd2fabc-9131-4b48-8419-6444e2d67454@siemens.com\nSigned-off-by: Jan Kiszka \u003cjan.kiszka@siemens.com\u003e\nCc: Barry Song \u003cbaohua@kernel.org\u003e\nCc: Kieran Bingham \u003ckbingham@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "82aa8d362a2ae310e1d764359f7c392d4ff2b43c", "tree": "d0d2bf5ebf0af77049da13ca9529262d7df449b9", "parents": [ "78a73c6fe0d85aa075470d69efbe123dd2614956" ], "author": { "name": "Wei Yang", "email": "richard.weiyang@gmail.com", "time": "Wed Nov 13 03:16:14 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:39 2025" }, "message": "maple_tree: simplify split calculation\n\ncommit 4f6a6bed0bfef4b966f076f33eb4f5547226056a upstream.\n\nPatch series \"simplify split calculation\", v3.\n\n\nThis patch (of 3):\n\nThe current calculation for splitting nodes tries to enforce a minimum\nspan on the leaf nodes. This code is complex and never worked correctly\nto begin with, due to the min value being passed as 0 for all leaves.\n\nThe calculation should just split the data as equally as possible\nbetween the new nodes. Note that b_end will be one more than the data,\nso the left side is still favoured in the calculation.\n\nThe current code may also lead to a deficient node by not leaving enough\ndata for the right side of the split. This issue is also addressed with\nthe split calculation change.\n\n[Liam.Howlett@Oracle.com: rephrase the change log]\nLink: https://lkml.kernel.org/r/20241113031616.10530-1-richard.weiyang@gmail.com\nLink: https://lkml.kernel.org/r/20241113031616.10530-2-richard.weiyang@gmail.com\nFixes: 54a611b60590 (\"Maple Tree: add new data structure\")\nSigned-off-by: Wei Yang \u003crichard.weiyang@gmail.com\u003e\nReviewed-by: Liam R. Howlett \u003cLiam.Howlett@Oracle.com\u003e\nCc: Sidhartha Kumar \u003csidhartha.kumar@oracle.com\u003e\nCc: Lorenzo Stoakes \u003clorenzo.stoakes@oracle.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "78a73c6fe0d85aa075470d69efbe123dd2614956", "tree": "c648c3fbde3d7964cd1477d524050c3c28f2bde2", "parents": [ "ab9f2ec09f1740d9bc837ee4d1e2d4425e87a598" ], "author": { "name": "Milos Reljin", "email": "milos_reljin@outlook.com", "time": "Fri Jan 24 10:41:02 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:39 2025" }, "message": "net: phy: c45-tjaxx: add delay between MDIO write and read in soft_reset\n\ncommit bd1bbab717608757cccbbe08b0d46e6c3ed0ced5 upstream.\n\nIn application note (AN13663) for TJA1120, on page 30, there\u0027s a figure\nwith average PHY startup timing values following software reset.\nThe time it takes for SMI to become operational after software reset\nranges roughly from 500 us to 1500 us.\n\nThis commit adds 2000 us delay after MDIO write which triggers software\nreset. Without this delay, soft_reset function returns an error and\nprevents successful PHY init.\n\nCc: stable@vger.kernel.org\nFixes: b050f2f15e04 (\"phy: nxp-c45: add driver for tja1103\")\nSigned-off-by: Milos Reljin \u003cmilos_reljin@outlook.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/AM8P250MB0124D258E5A71041AF2CC322E1E32@AM8P250MB0124.EURP250.PROD.OUTLOOK.COM\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ab9f2ec09f1740d9bc837ee4d1e2d4425e87a598", "tree": "4494b2b3cfc063a2e077c4ecd3749e844a1cd260", "parents": [ "c0464bad0e85fcd5d47e4297d1e410097c979e55" ], "author": { "name": "Paul Fertser", "email": "fercerpav@gmail.com", "time": "Thu Jan 16 15:29:00 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:39 2025" }, "message": "net/ncsi: wait for the last response to Deselect Package before configuring channel\n\ncommit 6bb194d036c6e1b329dcdff459338cdd9a54802a upstream.\n\nThe NCSI state machine as it\u0027s currently implemented assumes that\ntransition to the next logical state is performed either explicitly by\ncalling `schedule_work(\u0026ndp-\u003ework)` to re-queue itself or implicitly\nafter processing the predefined (ndp-\u003epending_req_num) number of\nreplies. Thus to avoid the configuration FSM from advancing prematurely\nand getting out of sync with the process it\u0027s essential to not skip\nwaiting for a reply.\n\nThis patch makes the code wait for reception of the Deselect Package\nresponse for the last package probed before proceeding to channel\nconfiguration.\n\nThanks go to Potin Lai and Cosmo Chou for the initial investigation and\ntesting.\n\nFixes: 8e13f70be05e (\"net/ncsi: Probe single packages to avoid conflict\")\nCc: stable@vger.kernel.org\nSigned-off-by: Paul Fertser \u003cfercerpav@gmail.com\u003e\nLink: https://patch.msgid.link/20250116152900.8656-1-fercerpav@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "c0464bad0e85fcd5d47e4297d1e410097c979e55", "tree": "99966f96ccf84b3d6a404c5c5a51e2790e342636", "parents": [ "e563ccd6be3c921db76a0868ddf021f2ae486c84" ], "author": { "name": "Ekansh Gupta", "email": "quic_ekangupt@quicinc.com", "time": "Fri Jan 10 13:42:39 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:39 2025" }, "message": "misc: fastrpc: Fix copy buffer page size\n\ncommit e966eae72762ecfdbdb82627e2cda48845b9dd66 upstream.\n\nFor non-registered buffer, fastrpc driver copies the buffer and\npass it to the remote subsystem. There is a problem with current\nimplementation of page size calculation which is not considering\nthe offset in the calculation. This might lead to passing of\nimproper and out-of-bounds page size which could result in\nmemory issue. Calculate page start and page end using the offset\nadjusted address instead of absolute address.\n\nFixes: 02b45b47fbe8 (\"misc: fastrpc: fix remote page size calculation\")\nCc: stable@kernel.org\nSigned-off-by: Ekansh Gupta \u003cquic_ekangupt@quicinc.com\u003e\nSigned-off-by: Srinivas Kandagatla \u003csrinivas.kandagatla@linaro.org\u003e\nLink: https://lore.kernel.org/r/20250110134239.123603-4-srinivas.kandagatla@linaro.org\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "e563ccd6be3c921db76a0868ddf021f2ae486c84", "tree": "482c60204597b0f4b007c1736a780697b0982e30", "parents": [ "24bcf8f6f9c03f8a2315b8a5229f8cda22a4b019" ], "author": { "name": "Ekansh Gupta", "email": "quic_ekangupt@quicinc.com", "time": "Fri Jan 10 13:42:38 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:39 2025" }, "message": "misc: fastrpc: Fix registered buffer page address\n\ncommit 6ca4ea1f88a06a04ed7b2c9c6bf9f00833b68214 upstream.\n\nFor registered buffers, fastrpc driver sends the buffer information\nto remote subsystem. There is a problem with current implementation\nwhere the page address is being sent with an offset leading to\nimproper buffer address on DSP. This is leads to functional failures\nas DSP expects base address in page information and extracts offset\ninformation from remote arguments. Mask the offset and pass the base\npage address to DSP.\n\nThis issue is observed is a corner case when some buffer which is registered\nwith fastrpc framework is passed with some offset by user and then the DSP\nimplementation tried to read the data. As DSP expects base address and takes\ncare of offsetting with remote arguments, passing an offsetted address will\nresult in some unexpected data read in DSP.\n\nAll generic usecases usually pass the buffer as it is hence is problem is\nnot usually observed. If someone tries to pass offsetted buffer and then\ntries to compare data at HLOS and DSP end, then the ambiguity will be observed.\n\nFixes: 80f3afd72bd4 (\"misc: fastrpc: consider address offset before sending to DSP\")\nCc: stable@kernel.org\nSigned-off-by: Ekansh Gupta \u003cquic_ekangupt@quicinc.com\u003e\nSigned-off-by: Srinivas Kandagatla \u003csrinivas.kandagatla@linaro.org\u003e\nLink: https://lore.kernel.org/r/20250110134239.123603-3-srinivas.kandagatla@linaro.org\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "24bcf8f6f9c03f8a2315b8a5229f8cda22a4b019", "tree": "87d76f5cc215dfd4860fee860aee255fe20f8888", "parents": [ "3df72111c39f7e4c5029c9ff720b56ec2e05b764" ], "author": { "name": "Anandu Krishnan E", "email": "quic_anane@quicinc.com", "time": "Fri Jan 10 13:42:37 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:38 2025" }, "message": "misc: fastrpc: Deregister device nodes properly in error scenarios\n\ncommit 637c20002dc8c347001292664055bfbf56544ec6 upstream.\n\nDuring fastrpc_rpmsg_probe, if secure device node registration\nsucceeds but non-secure device node registration fails, the secure\ndevice node deregister is not called during error cleanup. Add proper\nexit paths to ensure proper cleanup in case of error.\n\nFixes: 3abe3ab3cdab (\"misc: fastrpc: add secure domain support\")\nCc: stable@kernel.org\nSigned-off-by: Anandu Krishnan E \u003cquic_anane@quicinc.com\u003e\nSigned-off-by: Srinivas Kandagatla \u003csrinivas.kandagatla@linaro.org\u003e\nLink: https://lore.kernel.org/r/20250110134239.123603-2-srinivas.kandagatla@linaro.org\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "3df72111c39f7e4c5029c9ff720b56ec2e05b764", "tree": "3ccbae9d35035457241fbf5425cea80b5338a9ef", "parents": [ "5d19ca5d259114b5b1230761b980e6e59d458df9" ], "author": { "name": "Vimal Agrawal", "email": "vimal.agrawal@sophos.com", "time": "Mon Oct 21 13:38:12 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:38 2025" }, "message": "misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors\n\ncommit 6d04d2b554b14ae6c428a9c60b6c85f1e5c89f68 upstream.\n\nmisc_minor_alloc was allocating id using ida for minor only in case of\nMISC_DYNAMIC_MINOR but misc_minor_free was always freeing ids\nusing ida_free causing a mismatch and following warn:\n\u003e \u003e WARNING: CPU: 0 PID: 159 at lib/idr.c:525 ida_free+0x3e0/0x41f\n\u003e \u003e ida_free called for id\u003d127 which is not allocated.\n\u003e \u003e \u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\u003c\n...\n\u003e \u003e [\u003c60941eb4\u003e] ida_free+0x3e0/0x41f\n\u003e \u003e [\u003c605ac993\u003e] misc_minor_free+0x3e/0xbc\n\u003e \u003e [\u003c605acb82\u003e] misc_deregister+0x171/0x1b3\n\nmisc_minor_alloc is changed to allocate id from ida for all minors\nfalling in the range of dynamic/ misc dynamic minors\n\nFixes: ab760791c0cf (\"char: misc: Increase the maximum number of dynamic misc devices to 1048448\")\nSigned-off-by: Vimal Agrawal \u003cvimal.agrawal@sophos.com\u003e\nReviewed-by: Dirk VanDerMerwe \u003cdirk.vandermerwe@sophos.com\u003e\nCc: stable@vger.kernel.org\nLink: https://lore.kernel.org/r/20241021133812.23703-1-vimal.agrawal@sophos.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "5d19ca5d259114b5b1230761b980e6e59d458df9", "tree": "59492e533760007a4c70caf1419212f4767c9e3f", "parents": [ "221e874ea5bf3ed4625a97069efbc09fc66fd004" ], "author": { "name": "Ivan Stepchenko", "email": "sid@itb.spb.ru", "time": "Thu Nov 14 13:29:51 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:38 2025" }, "message": "mtd: onenand: Fix uninitialized retlen in do_otp_read()\n\ncommit 70a71f8151b9879b0950668ce3ad76263261fee0 upstream.\n\nThe function do_otp_read() does not set the output parameter *retlen,\nwhich is expected to contain the number of bytes actually read.\nAs a result, in onenand_otp_walk(), the tmp_retlen variable remains\nuninitialized after calling do_otp_walk() and used to change\nthe values of the buf, len and retlen variables.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\n\nFixes: 49dc08eeda70 (\"[MTD] [OneNAND] fix numerous races\")\nCc: stable@vger.kernel.org\nSigned-off-by: Ivan Stepchenko \u003csid@itb.spb.ru\u003e\nSigned-off-by: Miquel Raynal \u003cmiquel.raynal@bootlin.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "221e874ea5bf3ed4625a97069efbc09fc66fd004", "tree": "7b857677d60a1c0e063d5ccf0591e3f95a2bb577", "parents": [ "069a8680af14512e5fbe030c497c4403cec18392" ], "author": { "name": "Nick Chan", "email": "towinchenmi@gmail.com", "time": "Sat Jan 18 16:31:42 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:38 2025" }, "message": "irqchip/apple-aic: Only handle PMC interrupt as FIQ when configured so\n\ncommit 698244bbb3bfd32ddf9a0b70a12b1c7d69056497 upstream.\n\nThe CPU PMU in Apple SoCs can be configured to fire its interrupt in one of\nseveral ways, and since Apple A11 one of the methods is FIQ, but the check\nof the configuration register fails to test explicitely for FIQ mode. It\ntests whether the IMODE bitfield is zero or not and the PMCRO_IACT bit is\nset. That results in false positives when the IMODE bitfield is not zero,\nbut does not have the mode PMCR0_IMODE_FIQ.\n\nOnly handle the PMC interrupt as a FIQ when the CPU PMU has been configured\nto fire FIQs, i.e. the IMODE bitfield value is PMCR0_IMODE_FIQ and\nPMCR0_IACT is set.\n\nFixes: c7708816c944 (\"irqchip/apple-aic: Wire PMU interrupts\")\nSigned-off-by: Nick Chan \u003ctowinchenmi@gmail.com\u003e\nSigned-off-by: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: stable@vger.kernel.org\nLink: https://lore.kernel.org/all/20250118163554.16733-1-towinchenmi@gmail.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "069a8680af14512e5fbe030c497c4403cec18392", "tree": "1169abe4444930be18194c9eb62101d6f341ef16", "parents": [ "172cdfc3a5ea20289c58fb73dadc6fd4a8784a4e" ], "author": { "name": "Frank Li", "email": "Frank.Li@nxp.com", "time": "Wed Jan 08 22:55:33 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:38 2025" }, "message": "i3c: master: Fix missing \u0027ret\u0027 assignment in set_speed()\n\ncommit b266e0d4dac00eecdfaf50ec3f708fd0c3b39637 upstream.\n\nFix a probe failure in the i3c master driver that occurs when no i3c\ndevices are connected to the bus.\n\nThe issue arises in `i3c_master_bus_init()` where the `ret` value is not\nupdated after calling `master-\u003eops-\u003eset_speed()`. If no devices are\npresent, `ret` remains set to `I3C_ERROR_M2`, causing the code to\nincorrectly proceed to `err_bus_cleanup`.\n\nCc: stable@vger.kernel.org\nFixes: aef79e189ba2 (\"i3c: master: support to adjust first broadcast address speed\")\nSigned-off-by: Frank Li \u003cFrank.Li@nxp.com\u003e\nReviewed-by: Wolfram Sang \u003cwsa+renesas@sang-engineering.com\u003e\nTested-by: Wolfram Sang \u003cwsa+renesas@sang-engineering.com\u003e\nAcked-by: Mukesh Kumar Savaliya \u003cquic_msavaliy@quicinc.com\u003e\nReviewed-by: Miquel Raynal \u003cmiquel.raynal@bootlin.com\u003e\nLink: https://lore.kernel.org/r/20250108225533.915334-1-Frank.Li@nxp.com\nSigned-off-by: Alexandre Belloni \u003calexandre.belloni@bootlin.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "172cdfc3a5ea20289c58fb73dadc6fd4a8784a4e", "tree": "fd406773a42d298a05a783847d19f0f351785ff5", "parents": [ "88f4311d1d5ee759bf1354f537b6be93336dc53c" ], "author": { "name": "Dan Carpenter", "email": "dan.carpenter@linaro.org", "time": "Fri Jan 17 09:38:41 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:38 2025" }, "message": "NFC: nci: Add bounds checking in nci_hci_create_pipe()\n\ncommit 110b43ef05342d5a11284cc8b21582b698b4ef1c upstream.\n\nThe \"pipe\" variable is a u8 which comes from the network. If it\u0027s more\nthan 127, then it results in memory corruption in the caller,\nnci_hci_connect_gate().\n\nCc: stable@vger.kernel.org\nFixes: a1b0b9415817 (\"NFC: nci: Create pipe on specific gate in nci_hci_connect_gate\")\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@linaro.org\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Krzysztof Kozlowski \u003ckrzysztof.kozlowski@linaro.org\u003e\nLink: https://patch.msgid.link/bcf5453b-7204-4297-9c20-4d8c7dacf586@stanley.mountain\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "88f4311d1d5ee759bf1354f537b6be93336dc53c", "tree": "1d17a1db6a1c0658bf3399f8ea5f2e85b87a99e7", "parents": [ "f2bd0f1ab47822fe5bd699c8458b896c4b2edea1" ], "author": { "name": "Pekka Pessi", "email": "ppessi@nvidia.com", "time": "Mon Dec 02 10:05:59 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:38 2025" }, "message": "mailbox: tegra-hsp: Clear mailbox before using message\n\ncommit 0b7f8328f988178b55ee11d772a6e1238c04d29d upstream.\n\nThe Tegra RCE (Camera) driver expects the mailbox to be empty before\nprocessing the IVC messages. On RT kernel, the threads processing the\nIVC messages (which are invoked after `mbox_chan_received_data()` is\ncalled) may be on a different CPU or running with a higher priority\nthan the HSP interrupt handler thread. This can cause it to act on the\nmessage before the mailbox gets cleared in the HSP interrupt handler\nresulting in a loss of IVC notification.\n\nFix this by clearing the mailbox data register before calling\n`mbox_chan_received_data()`.\n\nFixes: 8f585d14030d (\"mailbox: tegra-hsp: Add tegra_hsp_sm_ops\")\nFixes: 74c20dd0f892 (\"mailbox: tegra-hsp: Add 128-bit shared mailbox support\")\nCc: stable@vger.kernel.org\nSigned-off-by: Pekka Pessi \u003cppessi@nvidia.com\u003e\nSigned-off-by: Kartik Rajput \u003ckkartik@nvidia.com\u003e\nAcked-by: Thierry Reding \u003ctreding@nvidia.com\u003e\nSigned-off-by: Jassi Brar \u003cjassisinghbrar@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "f2bd0f1ab47822fe5bd699c8458b896c4b2edea1", "tree": "2dbbd1473e6b154c59e985d689080525910f19fb", "parents": [ "b6833b38984d1e9f20dd80f9ec9050c10d687f30" ], "author": { "name": "Nikita Zhandarovich", "email": "n.zhandarovich@fintech.ru", "time": "Fri Jan 24 22:20:53 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:37 2025" }, "message": "nilfs2: fix possible int overflows in nilfs_fiemap()\n\ncommit 6438ef381c183444f7f9d1de18f22661cba1e946 upstream.\n\nSince nilfs_bmap_lookup_contig() in nilfs_fiemap() calculates its result\nby being prepared to go through potentially maxblocks \u003d\u003d INT_MAX blocks,\nthe value in n may experience an overflow caused by left shift of blkbits.\n\nWhile it is extremely unlikely to occur, play it safe and cast right hand\nexpression to wider type to mitigate the issue.\n\nFound by Linux Verification Center (linuxtesting.org) with static analysis\ntool SVACE.\n\nLink: https://lkml.kernel.org/r/20250124222133.5323-1-konishi.ryusuke@gmail.com\nFixes: 622daaff0a89 (\"nilfs2: fiemap support\")\nSigned-off-by: Nikita Zhandarovich \u003cn.zhandarovich@fintech.ru\u003e\nSigned-off-by: Ryusuke Konishi \u003ckonishi.ryusuke@gmail.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b6833b38984d1e9f20dd80f9ec9050c10d687f30", "tree": "5f183e5c91b0a6f6df79a1fb5c77f3f66c10946e", "parents": [ "e763392da6b1107526c974925ae9263778a76709" ], "author": { "name": "Matthew Wilcox (Oracle)", "email": "willy@infradead.org", "time": "Thu Dec 05 17:16:29 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:37 2025" }, "message": "ocfs2: handle a symlink read error correctly\n\ncommit 2b4c2094da6d84e69b843dd3317902e977bf64bd upstream.\n\nPatch series \"Convert ocfs2 to use folios\".\n\nMark did a conversion of ocfs2 to use folios and sent it to me as a\ngiant patch for review ;-)\n\nSo I\u0027ve redone it as individual patches, and credited Mark for the patches\nwhere his code is substantially the same. It\u0027s not a bad way to do it;\nhis patch had some bugs and my patches had some bugs. Hopefully all our\nbugs were different from each other. And hopefully Mark likes all the\nchanges I made to his code!\n\n\nThis patch (of 23):\n\nIf we can\u0027t read the buffer, be sure to unlock the page before returning.\n\nLink: https://lkml.kernel.org/r/20241205171653.3179945-1-willy@infradead.org\nLink: https://lkml.kernel.org/r/20241205171653.3179945-2-willy@infradead.org\nSigned-off-by: Matthew Wilcox (Oracle) \u003cwilly@infradead.org\u003e\nReviewed-by: Joseph Qi \u003cjoseph.qi@linux.alibaba.com\u003e\nCc: Mark Fasheh \u003cmark@fasheh.com\u003e\nCc: Joel Becker \u003cjlbec@evilplan.org\u003e\nCc: Junxiao Bi \u003cjunxiao.bi@oracle.com\u003e\nCc: Changwei Ge \u003cgechangwei@live.cn\u003e\nCc: Jun Piao \u003cpiaojun@huawei.com\u003e\nCc: Mark Tinguely \u003cmark.tinguely@oracle.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "e763392da6b1107526c974925ae9263778a76709", "tree": "65951d71c9ccc51430768d4700ac65de547bdfee", "parents": [ "e5d289c972ebb336a303204f5b400aa48420fc9b" ], "author": { "name": "Heming Zhao", "email": "heming.zhao@suse.com", "time": "Tue Jan 21 11:22:03 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:37 2025" }, "message": "ocfs2: fix incorrect CPU endianness conversion causing mount failure\n\ncommit f921da2c34692dfec5f72b5ae347b1bea22bb369 upstream.\n\nCommit 23aab037106d (\"ocfs2: fix UBSAN warning in ocfs2_verify_volume()\")\nintroduced a regression bug. The blksz_bits value is already converted to\nCPU endian in the previous code; therefore, the code shouldn\u0027t use\nle32_to_cpu() anymore.\n\nLink: https://lkml.kernel.org/r/20250121112204.12834-1-heming.zhao@suse.com\nFixes: 23aab037106d (\"ocfs2: fix UBSAN warning in ocfs2_verify_volume()\")\nSigned-off-by: Heming Zhao \u003cheming.zhao@suse.com\u003e\nReviewed-by: Joseph Qi \u003cjoseph.qi@linux.alibaba.com\u003e\nCc: Mark Fasheh \u003cmark@fasheh.com\u003e\nCc: Joel Becker \u003cjlbec@evilplan.org\u003e\nCc: Junxiao Bi \u003cjunxiao.bi@oracle.com\u003e\nCc: Changwei Ge \u003cgechangwei@live.cn\u003e\nCc: Jun Piao \u003cpiaojun@huawei.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "e5d289c972ebb336a303204f5b400aa48420fc9b", "tree": "c7b7991450db957a23bda2aea4fdd15d5e9450c4", "parents": [ "7a9b86bd22610a3d8497f615a8d2d9f7ea975eca" ], "author": { "name": "Mike Snitzer", "email": "snitzer@kernel.org", "time": "Fri Jan 17 01:05:39 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:37 2025" }, "message": "pnfs/flexfiles: retry getting layout segment for reads\n\ncommit eb3fabde15bccdf34f1c9b35a83aa4c0dacbb4ca upstream.\n\nIf ff_layout_pg_get_read()\u0027s attempt to get a layout segment results\nin -EAGAIN have ff_layout_pg_init_read() retry it after sleeping.\n\nIf \"softerr\" mount is used, use \u0027io_maxretrans\u0027 to limit the number of\nattempts to get a layout segment.\n\nThis fixes a long-standing issue of O_DIRECT reads failing with\n-EAGAIN (11) when using flexfiles Client Side Mirroring (CSM).\n\nCc: stable@vger.kernel.org\nSigned-off-by: Mike Snitzer \u003csnitzer@kernel.org\u003e\nSigned-off-by: Anna Schumaker \u003canna.schumaker@oracle.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "7a9b86bd22610a3d8497f615a8d2d9f7ea975eca", "tree": "c4b1d8723c16f50af30701b3d7a7b5dccc784bee", "parents": [ "03844b1908114680ca35fa0a0aba3d906a6d78af" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue Feb 04 22:19:53 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:37 2025" }, "message": "selftests: mptcp: connect: -f: no reconnect\n\ncommit 5368a67307b3b2c347dc8965ac55b888be665934 upstream.\n\nThe \u0027-f\u0027 parameter is there to force the kernel to emit MPTCP FASTCLOSE\nby closing the connection with unread bytes in the receive queue.\n\nThe xdisconnect() helper was used to stop the connection, but it does\nmore than that: it will shut it down, then wait before reconnecting to\nthe same address. This causes the mptcp_join\u0027s \"fastclose test\" to fail\nall the time.\n\nThis failure is due to a recent change, with commit 218cc166321f\n(\"selftests: mptcp: avoid spurious errors on disconnect\"), but that went\nunnoticed because the test is currently ignored. The recent modification\nonly shown an existing issue: xdisconnect() doesn\u0027t need to be used\nhere, only the shutdown() part is needed.\n\nFixes: 6bf41020b72b (\"selftests: mptcp: update and extend fastclose test-cases\")\nCc: stable@vger.kernel.org\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20250204-net-mptcp-sft-conn-f-v1-1-6b470c72fffa@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "03844b1908114680ca35fa0a0aba3d906a6d78af", "tree": "c5558a1afbd614645a22eefef0a56456fa86c5e3", "parents": [ "644636ee7eb2a75975ded30ebf794bc4c229ae33" ], "author": { "name": "Alex Williamson", "email": "alex.williamson@redhat.com", "time": "Wed Jan 22 17:38:30 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:37 2025" }, "message": "vfio/platform: check the bounds of read/write syscalls\n\ncommit ce9ff21ea89d191e477a02ad7eabf4f996b80a69 upstream.\n\ncount and offset are passed from user space and not checked, only\noffset is capped to 40 bits, which can be used to read/write out of\nbounds of the device.\n\nFixes: 6e3f26456009 (“vfio/platform: read and write support for the device fd”)\nCc: stable@vger.kernel.org\nReported-by: Mostafa Saleh \u003csmostafa@google.com\u003e\nReviewed-by: Eric Auger \u003ceric.auger@redhat.com\u003e\nReviewed-by: Mostafa Saleh \u003csmostafa@google.com\u003e\nTested-by: Mostafa Saleh \u003csmostafa@google.com\u003e\nSigned-off-by: Alex Williamson \u003calex.williamson@redhat.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "644636ee7eb2a75975ded30ebf794bc4c229ae33", "tree": "8499667aee928ccde57a78541fd48a6d8ec2ba35", "parents": [ "a94592ec30ff67dc36c424327f1e0a9ceeeb9bd3" ], "author": { "name": "Pavel Begunkov", "email": "asml.silence@gmail.com", "time": "Mon Feb 10 15:21:38 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:37 2025" }, "message": "io_uring/rw: commit provided buffer state on async\n\nWhen we get -EIOCBQUEUED, we need to ensure that the buffer is consumed\nfrom the provided buffer ring, which can be done with io_kbuf_recycle()\n+ REQ_F_PARTIAL_IO.\n\nReported-by: Muhammad Ramdhan \u003cramdhan@starlabs.sg\u003e\nReported-by: Bing-Jhong Billy Jheng \u003cbilly@starlabs.sg\u003e\nReported-by: Jacob Soo \u003cjacob.soo@starlabs.sg\u003e\nFixes: c7fb19428d67d (\"io_uring: add support for ring mapped supplied buffers\")\nSigned-off-by: Pavel Begunkov \u003casml.silence@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "a94592ec30ff67dc36c424327f1e0a9ceeeb9bd3", "tree": "051d117065815def047115d648ce6862e47498a5", "parents": [ "130675a21942d60cb53bfc9e39ca4833e16b1182" ], "author": { "name": "Pavel Begunkov", "email": "asml.silence@gmail.com", "time": "Mon Feb 10 15:21:37 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:36 2025" }, "message": "io_uring: fix io_req_prep_async with provided buffers\n\nio_req_prep_async() can import provided buffers, commit the ring state\nby giving up on that before, it\u0027ll be reimported later if needed.\n\nReported-by: Muhammad Ramdhan \u003cramdhan@starlabs.sg\u003e\nReported-by: Bing-Jhong Billy Jheng \u003cbilly@starlabs.sg\u003e\nReported-by: Jacob Soo \u003cjacob.soo@starlabs.sg\u003e\nFixes: c7fb19428d67d (\"io_uring: add support for ring mapped supplied buffers\")\nSigned-off-by: Pavel Begunkov \u003casml.silence@gmail.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "130675a21942d60cb53bfc9e39ca4833e16b1182", "tree": "6c402ecdd03e0a707ec76932bc66ac32a62aaf36", "parents": [ "b86f1d51731e621e83305dc9564ae14c9ef752bf" ], "author": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu Jan 30 15:40:29 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:36 2025" }, "message": "io_uring/net: don\u0027t retry connect operation on EPOLLERR\n\ncommit 8c8492ca64e79c6e0f433e8c9d2bcbd039ef83d0 upstream.\n\nIf a socket is shutdown before the connection completes, POLLERR is set\nin the poll mask. However, connect ignores this as it doesn\u0027t know, and\nattempts the connection again. This may lead to a bogus -ETIMEDOUT\nresult, where it should have noticed the POLLERR and just returned\n-ECONNRESET instead.\n\nHave the poll logic check for whether or not POLLERR is set in the mask,\nand if so, mark the request as failed. Then connect can appropriately\nfail the request rather than retry it.\n\nReported-by: Sergey Galas \u003cssgalas@cloud.ru\u003e\nCc: stable@vger.kernel.org\nLink: https://github.com/axboe/liburing/discussions/1335\nFixes: 3fb1bd688172 (\"io_uring/net: handle -EINPROGRESS correct for IORING_OP_CONNECT\")\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "b86f1d51731e621e83305dc9564ae14c9ef752bf", "tree": "104a406fc9f2a81f523a739272bbc15a31d6c5a7", "parents": [ "a9206d8a512ef9458d92dff05ab14855824af0d9" ], "author": { "name": "Pavel Begunkov", "email": "asml.silence@gmail.com", "time": "Tue Jan 28 00:55:24 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:36 2025" }, "message": "io_uring: fix multishots with selected buffers\n\ncommit d63b0e8a628e62ca85a0f7915230186bb92f8bb4 upstream.\n\nWe do io_kbuf_recycle() when arming a poll but every iteration of a\nmultishot can grab more buffers, which is why we need to flush the kbuf\nring state before continuing with waiting.\n\nCc: stable@vger.kernel.org\nFixes: b3fdea6ecb55c (\"io_uring: multishot recv\")\nReported-by: Muhammad Ramdhan \u003cramdhan@starlabs.sg\u003e\nReported-by: Bing-Jhong Billy Jheng \u003cbilly@starlabs.sg\u003e\nReported-by: Jacob Soo \u003cjacob.soo@starlabs.sg\u003e\nSigned-off-by: Pavel Begunkov \u003casml.silence@gmail.com\u003e\nLink: https://lore.kernel.org/r/1bfc9990fe435f1fc6152ca9efeba5eb3e68339c.1738025570.git.asml.silence@gmail.com\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "a9206d8a512ef9458d92dff05ab14855824af0d9", "tree": "3c97607dd51a78d18c0011e5af694128d39280d6", "parents": [ "bb2b7ba5faaa74193e9d8aeaaba8e0128d3aa54a" ], "author": { "name": "Sascha Hauer", "email": "s.hauer@pengutronix.de", "time": "Mon Dec 30 14:18:59 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:36 2025" }, "message": "nvmem: imx-ocotp-ele: set word length to 1\n\ncommit 1b2cb4d0b5b6a9d9fe78470704309ec75f8a1c3a upstream.\n\nThe ELE hardware internally has a word length of 4. However, among other\nthings we store MAC addresses in the ELE OCOTP. With a length of 6 bytes\nthese are naturally unaligned to the word length. Therefore we must\nsupport unaligned reads in reg_read() and indeed it works properly when\nreg_read() is called via nvmem_reg_read(). Setting the word size to 4\nhas the only visible effect that doing unaligned reads from userspace\nvia bin_attr_nvmem_read() do not work because they are rejected by that\nfunction.\n\nGiven that we have to abstract from word accesses to byte accesses in\nthe driver, set the word size to 1. This allows bytewise accesses from\nuserspace to be able to test what the driver has to support anyway.\n\nFixes: 22e9e6fcfb50 (\"nvmem: imx: support i.MX93 OCOTP\")\nSigned-off-by: Sascha Hauer \u003cs.hauer@pengutronix.de\u003e\nCc: stable \u003cstable@kernel.org\u003e\nReviewed-by: Peng Fan \u003cpeng.fan@nxp.com\u003e\nSigned-off-by: Srinivas Kandagatla \u003csrinivas.kandagatla@linaro.org\u003e\nLink: https://lore.kernel.org/r/20241230141901.263976-5-srinivas.kandagatla@linaro.org\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "bb2b7ba5faaa74193e9d8aeaaba8e0128d3aa54a", "tree": "25a82413fd68992cd1ce7ab8c0d0eb145f8af0d1", "parents": [ "cb091f37cc1c8407d765e4c1bf06537edd2f1a87" ], "author": { "name": "Sascha Hauer", "email": "s.hauer@pengutronix.de", "time": "Mon Dec 30 14:18:57 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:36 2025" }, "message": "nvmem: imx-ocotp-ele: fix reading from non zero offset\n\ncommit 3c9e2cb6cecf65f7501004038c5d1ed85fb7db84 upstream.\n\nIn imx_ocotp_reg_read() the offset comes in as bytes and not as words.\nThis means we have to divide offset by 4 to get to the correct word\noffset.\n\nAlso the incoming offset might not be word aligned. In order to read\nfrom the OCOTP the driver aligns down the previous word boundary and\nreads from there. This means we have to skip this alignment offset from\nthe temporary buffer when copying the data to the output buffer.\n\nFixes: 22e9e6fcfb50 (\"nvmem: imx: support i.MX93 OCOTP\")\nSigned-off-by: Sascha Hauer \u003cs.hauer@pengutronix.de\u003e\nCc: stable \u003cstable@kernel.org\u003e\nReviewed-by: Peng Fan \u003cpeng.fan@nxp.com\u003e\nSigned-off-by: Srinivas Kandagatla \u003csrinivas.kandagatla@linaro.org\u003e\nLink: https://lore.kernel.org/r/20241230141901.263976-3-srinivas.kandagatla@linaro.org\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "cb091f37cc1c8407d765e4c1bf06537edd2f1a87", "tree": "bddb4f50e39eaae57035736b2e92f34211ac2434", "parents": [ "0ba8ea28918b7658ff9fc2590f4da3223e715180" ], "author": { "name": "Sascha Hauer", "email": "s.hauer@pengutronix.de", "time": "Mon Dec 30 14:18:56 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:36 2025" }, "message": "nvmem: imx-ocotp-ele: simplify read beyond device check\n\ncommit 343aa1e289e8e3dba5e3d054c4eb27da7b4e1ecc upstream.\n\nDo the read beyond device check on function entry in bytes instead of\n32bit words which is easier to follow.\n\nFixes: 22e9e6fcfb50 (\"nvmem: imx: support i.MX93 OCOTP\")\nSigned-off-by: Sascha Hauer \u003cs.hauer@pengutronix.de\u003e\nCc: stable \u003cstable@kernel.org\u003e\nReviewed-by: Peng Fan \u003cpeng.fan@nxp.com\u003e\nSigned-off-by: Srinivas Kandagatla \u003csrinivas.kandagatla@linaro.org\u003e\nLink: https://lore.kernel.org/r/20241230141901.263976-2-srinivas.kandagatla@linaro.org\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "0ba8ea28918b7658ff9fc2590f4da3223e715180", "tree": "16d2d0d5f8adfb66e44ffc5296f81e0130dc9436", "parents": [ "12f428f5974865c4171a5e088aea7221d5e020c5" ], "author": { "name": "Jennifer Berringer", "email": "jberring@redhat.com", "time": "Mon Dec 30 14:19:01 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:36 2025" }, "message": "nvmem: core: improve range check for nvmem_cell_write()\n\ncommit 31507fc2ad36e0071751a710449db19c85d82a7f upstream.\n\nWhen __nvmem_cell_entry_write() is called for an nvmem cell that does\nnot need bit shifting, it requires that the len parameter exactly\nmatches the nvmem cell size. However, when the nvmem cell has a nonzero\nbit_offset, it was skipping this check.\n\nAccepting values of len larger than the cell size results in\nnvmem_cell_prepare_write_buffer() trying to write past the end of a heap\nbuffer that it allocates. Add a check to avoid that problem and instead\nreturn -EINVAL when len doesn\u0027t match the number of bits expected by the\nnvmem cell when bit_offset is nonzero.\n\nThis check uses cell-\u003enbits in order to allow providing the smaller size\nto cells that are shifted into another byte by bit_offset. For example,\na cell with nbits\u003d8 and nonzero bit_offset would have bytes\u003d2 but should\naccept a 1-byte write here, although no current callers depend on this.\n\nFixes: 69aba7948cbe (\"nvmem: Add a simple NVMEM framework for consumers\")\nCc: stable@vger.kernel.org\nSigned-off-by: Jennifer Berringer \u003cjberring@redhat.com\u003e\nSigned-off-by: Srinivas Kandagatla \u003csrinivas.kandagatla@linaro.org\u003e\nLink: https://lore.kernel.org/r/20241230141901.263976-7-srinivas.kandagatla@linaro.org\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "12f428f5974865c4171a5e088aea7221d5e020c5", "tree": "4842ae4b9ac02ca306d1f77aff06c03e2be02b52", "parents": [ "e914b2f795b6995bb0e7db45caa4a912dca09e65" ], "author": { "name": "Luca Weiss", "email": "luca.weiss@fairphone.com", "time": "Mon Dec 30 14:19:00 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:35 2025" }, "message": "nvmem: qcom-spmi-sdam: Set size in struct nvmem_config\n\ncommit e88f516ea417c71bb3702603ac6af9e95338cfa6 upstream.\n\nLet the nvmem core know what size the SDAM is, most notably this fixes\nthe size of /sys/bus/nvmem/devices/spmi_sdam*/nvmem being \u00270\u0027 and makes\nuser space work with that file.\n\n ~ # hexdump -C -s 64 /sys/bus/nvmem/devices/spmi_sdam2/nvmem\n 00000040 02 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 |................|\n 00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|\n *\n 00000080\n\nFixes: 40ce9798794f (\"nvmem: add QTI SDAM driver\")\nCc: stable@vger.kernel.org\nSigned-off-by: Luca Weiss \u003cluca.weiss@fairphone.com\u003e\nReviewed-by: Vladimir Zapolskiy \u003cvladimir.zapolskiy@linaro.org\u003e\nSigned-off-by: Srinivas Kandagatla \u003csrinivas.kandagatla@linaro.org\u003e\nLink: https://lore.kernel.org/r/20241230141901.263976-6-srinivas.kandagatla@linaro.org\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "e914b2f795b6995bb0e7db45caa4a912dca09e65", "tree": "8e67185bf04292a4def39178643119255316472b", "parents": [ "37b71cec0bda7cb304585728d5dce2dc9fceb80e" ], "author": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@linaro.org", "time": "Tue Dec 03 09:19:30 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:35 2025" }, "message": "crypto: qce - unregister previously registered algos in error path\n\ncommit e80cf84b608725303113d6fe98bb727bf7b7a40d upstream.\n\nIf we encounter an error when registering alorithms with the crypto\nframework, we just bail out and don\u0027t unregister the ones we\nsuccessfully registered in prior iterations of the loop.\n\nAdd code that goes back over the algos and unregisters them before\nreturning an error from qce_register_algs().\n\nCc: stable@vger.kernel.org\nFixes: ec8f5d8f6f76 (\"crypto: qce - Qualcomm crypto engine driver\")\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@linaro.org\u003e\nReviewed-by: Neil Armstrong \u003cneil.armstrong@linaro.org\u003e\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "37b71cec0bda7cb304585728d5dce2dc9fceb80e", "tree": "33af4fb865d43e0f90e99316c9f30007ea7d466d", "parents": [ "d5e6e3000309359eae2a17117aa6e3c44897bf6c" ], "author": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@linaro.org", "time": "Tue Dec 03 09:19:29 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:35 2025" }, "message": "crypto: qce - fix goto jump in error path\n\ncommit 5278275c1758a38199b43530adfc50098f4b41c7 upstream.\n\nIf qce_check_version() fails, we should jump to err_dma as we already\ncalled qce_dma_request() a couple lines before.\n\nCc: stable@vger.kernel.org\nFixes: ec8f5d8f6f76 (\"crypto: qce - Qualcomm crypto engine driver\")\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@linaro.org\u003e\nReviewed-by: Neil Armstrong \u003cneil.armstrong@linaro.org\u003e\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "d5e6e3000309359eae2a17117aa6e3c44897bf6c", "tree": "06ab30ca26e2d704015e425b9b3ffa99a9febf68", "parents": [ "19b22dadd487b58ae4c7b737dd73a9b69629cf91" ], "author": { "name": "Niklas Cassel", "email": "cassel@kernel.org", "time": "Mon Jan 27 15:43:04 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:35 2025" }, "message": "ata: libata-sff: Ensure that we cannot write outside the allocated buffer\n\ncommit 6e74e53b34b6dec5a50e1404e2680852ec6768d2 upstream.\n\nreveliofuzzing reported that a SCSI_IOCTL_SEND_COMMAND ioctl with out_len\nset to 0xd42, SCSI command set to ATA_16 PASS-THROUGH, ATA command set to\nATA_NOP, and protocol set to ATA_PROT_PIO, can cause ata_pio_sector() to\nwrite outside the allocated buffer, overwriting random memory.\n\nWhile a ATA device is supposed to abort a ATA_NOP command, there does seem\nto be a bug either in libata-sff or QEMU, where either this status is not\nset, or the status is cleared before read by ata_sff_hsm_move().\nAnyway, that is most likely a separate bug.\n\nLooking at __atapi_pio_bytes(), it already has a safety check to ensure\nthat __atapi_pio_bytes() cannot write outside the allocated buffer.\n\nAdd a similar check to ata_pio_sector(), such that also ata_pio_sector()\ncannot write outside the allocated buffer.\n\nCc: stable@vger.kernel.org\nReported-by: reveliofuzzing \u003creveliofuzzing@gmail.com\u003e\nCloses: https://lore.kernel.org/linux-ide/CA+-ZZ_jTgxh3bS7m+KX07_EWckSnW3N2adX3KV63y4g7M4CZ2A@mail.gmail.com/\nLink: https://lore.kernel.org/r/20250127154303.15567-2-cassel@kernel.org\nSigned-off-by: Niklas Cassel \u003ccassel@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "19b22dadd487b58ae4c7b737dd73a9b69629cf91", "tree": "2b2a7c9bf010f06a8907c20575c92be61cccd929", "parents": [ "aed5248fe9e1e8ee41e303efd3b4261e3a98a471" ], "author": { "name": "Catalin Marinas", "email": "catalin.marinas@arm.com", "time": "Mon Jan 27 18:42:33 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:35 2025" }, "message": "mm: kmemleak: fix upper boundary check for physical address objects\n\ncommit 488b5b9eca68497b533ced059be5eff19578bbca upstream.\n\nMemblock allocations are registered by kmemleak separately, based on their\nphysical address. During the scanning stage, it checks whether an object\nis within the min_low_pfn and max_low_pfn boundaries and ignores it\notherwise.\n\nWith the recent addition of __percpu pointer leak detection (commit\n6c99d4eb7c5e (\"kmemleak: enable tracking for percpu pointers\")), kmemleak\nstarted reporting leaks in setup_zone_pageset() and\nsetup_per_cpu_pageset(). These were caused by the node_data[0] object\n(initialised in alloc_node_data()) ending on the PFN_PHYS(max_low_pfn)\nboundary. The non-strict upper boundary check introduced by commit\n84c326299191 (\"mm: kmemleak: check physical address when scan\") causes the\npg_data_t object to be ignored (not scanned) and the __percpu pointers it\ncontains to be reported as leaks.\n\nMake the max_low_pfn upper boundary check strict when deciding whether to\nignore a physical address object and not scan it.\n\nLink: https://lkml.kernel.org/r/20250127184233.2974311-1-catalin.marinas@arm.com\nFixes: 84c326299191 (\"mm: kmemleak: check physical address when scan\")\nSigned-off-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nReported-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nTested-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nCc: Patrick Wang \u003cpatrick.wang.shcn@gmail.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[6.0.x]\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "aed5248fe9e1e8ee41e303efd3b4261e3a98a471", "tree": "b1817a3a1c665680bcc734bd9f19c986fdebaf94", "parents": [ "5448ac02e9c05127929d1a416ca6b627691b8b84" ], "author": { "name": "Ricardo Ribalda", "email": "ribalda@chromium.org", "time": "Tue Dec 03 21:20:09 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:35 2025" }, "message": "media: uvcvideo: Remove redundant NULL assignment\n\ncommit 04d3398f66d2d31c4b8caea88f051a4257b7a161 upstream.\n\nctrl-\u003ehandle will only be different than NULL for controls that have\nmappings. This is because that assignment is only done inside\nuvc_ctrl_set() for mapped controls.\n\nCc: stable@vger.kernel.org\nFixes: e5225c820c05 (\"media: uvcvideo: Send a control event when a Control Change interrupt arrives\")\nReviewed-by: Laurent Pinchart \u003claurent.pinchart@ideasonboard.com\u003e\nReviewed-by: Hans de Goede \u003chdegoede@redhat.com\u003e\nSigned-off-by: Ricardo Ribalda \u003cribalda@chromium.org\u003e\nLink: https://lore.kernel.org/r/20241203-uvc-fix-async-v6-2-26c867231118@chromium.org\nSigned-off-by: Laurent Pinchart \u003claurent.pinchart@ideasonboard.com\u003e\nSigned-off-by: Mauro Carvalho Chehab \u003cmchehab+huawei@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "5448ac02e9c05127929d1a416ca6b627691b8b84", "tree": "8a0a5a89d0878856f345767b43795864aa3e810f", "parents": [ "53107a8f17df9208674ade29c957d863c0fddebf" ], "author": { "name": "Ricardo Ribalda", "email": "ribalda@chromium.org", "time": "Thu Nov 28 20:53:41 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:34 2025" }, "message": "media: uvcvideo: Support partial control reads\n\ncommit f00ee2ca8da25ebccb8e19956d853c9055e2c8d0 upstream.\n\nSome cameras, like the ELMO MX-P3, do not return all the bytes\nrequested from a control if it can fit in less bytes.\nEg: Returning 0xab instead of 0x00ab.\nusb 3-9: Failed to query (GET_DEF) UVC control 3 on unit 2: 1 (exp. 2).\n\nExtend the returned value from the camera and return it.\n\nCc: stable@vger.kernel.org\nFixes: a763b9fb58be (\"media: uvcvideo: Do not return positive errors in uvc_query_ctrl()\")\nReviewed-by: Hans de Goede \u003chdegoede@redhat.com\u003e\nSigned-off-by: Ricardo Ribalda \u003cribalda@chromium.org\u003e\nLink: https://lore.kernel.org/r/20241128-uvc-readless-v5-1-cf16ed282af8@chromium.org\nSigned-off-by: Hans de Goede \u003chdegoede@redhat.com\u003e\nReviewed-by: Laurent Pinchart \u003claurent.pinchart@ideasonboard.com\u003e\nSigned-off-by: Laurent Pinchart \u003claurent.pinchart@ideasonboard.com\u003e\nSigned-off-by: Mauro Carvalho Chehab \u003cmchehab+huawei@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "53107a8f17df9208674ade29c957d863c0fddebf", "tree": "f752477f850d7e7a021f063563bef69fb19329e2", "parents": [ "0b5e0445bc8384c18bd35cb9fe87f6258c6271d9" ], "author": { "name": "Ricardo Ribalda", "email": "ribalda@chromium.org", "time": "Thu Nov 14 19:10:30 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:34 2025" }, "message": "media: uvcvideo: Fix event flags in uvc_ctrl_send_events\n\ncommit c31cffd5ae2c3d7ef21d9008977a9d117ce7a64e upstream.\n\nIf there is an event that needs the V4L2_EVENT_CTRL_CH_FLAGS flag, all\nthe following events will have that flag, regardless if they need it or\nnot.\n\nThis is because we keep using the same variable all the time and we do\nnot reset its original value.\n\nCc: stable@vger.kernel.org\nFixes: 805e9b4a06bf (\"[media] uvcvideo: Send control change events for slave ctrls when the master changes\")\nSigned-off-by: Ricardo Ribalda \u003cribalda@chromium.org\u003e\nReviewed-by: Laurent Pinchart \u003claurent.pinchart@ideasonboard.com\u003e\nLink: https://lore.kernel.org/r/20241114-uvc-roi-v15-1-64cfeb56b6f8@chromium.org\nSigned-off-by: Laurent Pinchart \u003claurent.pinchart@ideasonboard.com\u003e\nSigned-off-by: Mauro Carvalho Chehab \u003cmchehab+huawei@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "0b5e0445bc8384c18bd35cb9fe87f6258c6271d9", "tree": "19007dbfd2c1a37cfb3b62cf54d7a077ba4eb21f", "parents": [ "1eb8e73eb4a3ec5eea279bd89ba0c36025d43187" ], "author": { "name": "Ricardo Ribalda", "email": "ribalda@chromium.org", "time": "Wed Nov 06 20:36:07 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:34 2025" }, "message": "media: uvcvideo: Fix crash during unbind if gpio unit is in use\n\ncommit a9ea1a3d88b7947ce8cadb2afceee7a54872bbc5 upstream.\n\nWe used the wrong device for the device managed functions. We used the\nusb device, when we should be using the interface device.\n\nIf we unbind the driver from the usb interface, the cleanup functions\nare never called. In our case, the IRQ is never disabled.\n\nIf an IRQ is triggered, it will try to access memory sections that are\nalready free, causing an OOPS.\n\nWe cannot use the function devm_request_threaded_irq here. The devm_*\nclean functions may be called after the main structure is released by\nuvc_delete.\n\nLuckily this bug has small impact, as it is only affected by devices\nwith gpio units and the user has to unbind the device, a disconnect will\nnot trigger this error.\n\nCc: stable@vger.kernel.org\nFixes: 2886477ff987 (\"media: uvcvideo: Implement UVC_EXT_GPIO_UNIT\")\nReviewed-by: Sergey Senozhatsky \u003csenozhatsky@chromium.org\u003e\nSigned-off-by: Ricardo Ribalda \u003cribalda@chromium.org\u003e\nReviewed-by: Laurent Pinchart \u003claurent.pinchart@ideasonboard.com\u003e\nLink: https://lore.kernel.org/r/20241106-uvc-crashrmmod-v6-1-fbf9781c6e83@chromium.org\nSigned-off-by: Laurent Pinchart \u003claurent.pinchart@ideasonboard.com\u003e\nSigned-off-by: Mauro Carvalho Chehab \u003cmchehab+huawei@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "1eb8e73eb4a3ec5eea279bd89ba0c36025d43187", "tree": "0666c61aa061939c0f082518bcdd7ffd3fc09b69", "parents": [ "c3c9300062b623eac3642aeb6abe15063d0ce073" ], "author": { "name": "Tomi Valkeinen", "email": "tomi.valkeinen@ideasonboard.com", "time": "Fri Dec 06 08:26:40 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:34 2025" }, "message": "media: i2c: ds90ub960: Fix logging SP \u0026 EQ status only for UB9702\n\ncommit 42d0ec194aa12e9b97f09a94fe565ba2e5f631a2 upstream.\n\nUB9702 does not have SP and EQ registers, but the driver uses them in\nlog_status(). Fix this by separating the SP and EQ related log_status()\nwork into a separate function (for clarity) and calling that function\nonly for UB960.\n\nCc: stable@vger.kernel.org\nFixes: afe267f2d368 (\"media: i2c: add DS90UB960 driver\")\nReviewed-by: Jai Luthra \u003cjai.luthra@ideasonboard.com\u003e\nSigned-off-by: Tomi Valkeinen \u003ctomi.valkeinen@ideasonboard.com\u003e\nSigned-off-by: Sakari Ailus \u003csakari.ailus@linux.intel.com\u003e\nSigned-off-by: Mauro Carvalho Chehab \u003cmchehab+huawei@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "c3c9300062b623eac3642aeb6abe15063d0ce073", "tree": "f697477ad2a8d56ba47b949044d936cad0e8c14e", "parents": [ "45e2ad4e1253e45389fb114d664ed9cf955fa4f9" ], "author": { "name": "Tomi Valkeinen", "email": "tomi.valkeinen@ideasonboard.com", "time": "Fri Dec 06 08:26:41 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:34 2025" }, "message": "media: i2c: ds90ub960: Fix UB9702 VC map\n\ncommit 5dbbd0609b83f6eb72c005e2e5979d0cd25243c8 upstream.\n\nThe driver uses a static CSI-2 virtual channel mapping where all virtual\nchannels from an RX port are mapped to a virtual channel number matching\nthe RX port number.\n\nThe UB960 and UB9702 have different registers for the purpose, and the\nUB9702 version is not correct. Each of the VC_ID_MAP registers do not\ncontain a single mapping, as the driver currently thinks, but two.\n\nThis can cause received VCs other than 0 to be mapped in a wrong way.\n\nFix this by writing both mappings to each register.\n\nCc: stable@vger.kernel.org\nFixes: afe267f2d368 (\"media: i2c: add DS90UB960 driver\")\nReviewed-by: Jai Luthra \u003cjai.luthra@ideasonboard.com\u003e\nSigned-off-by: Tomi Valkeinen \u003ctomi.valkeinen@ideasonboard.com\u003e\nSigned-off-by: Sakari Ailus \u003csakari.ailus@linux.intel.com\u003e\nSigned-off-by: Mauro Carvalho Chehab \u003cmchehab+huawei@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "45e2ad4e1253e45389fb114d664ed9cf955fa4f9", "tree": "7727ffe4264464c4b4442279a78f85d8bb3e3ee7", "parents": [ "474d7baf91d37bc411fa60de5bbf03c9dd82e18a" ], "author": { "name": "Tomi Valkeinen", "email": "tomi.valkeinen@ideasonboard.com", "time": "Fri Dec 06 08:26:39 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:34 2025" }, "message": "media: i2c: ds90ub960: Fix use of non-existing registers on UB9702\n\ncommit 698cf6df87ffa83f259703e7443c15a4c5ceae86 upstream.\n\nUB9702 doesn\u0027t have the registers for SP and EQ. Adjust the code in\nub960_rxport_wait_locks() to not use those registers for UB9702. As\nthese values are only used for a debug print here, there\u0027s no functional\nchange.\n\nCc: stable@vger.kernel.org\nFixes: afe267f2d368 (\"media: i2c: add DS90UB960 driver\")\nReviewed-by: Jai Luthra \u003cjai.luthra@ideasonboard.com\u003e\nSigned-off-by: Tomi Valkeinen \u003ctomi.valkeinen@ideasonboard.com\u003e\nSigned-off-by: Sakari Ailus \u003csakari.ailus@linux.intel.com\u003e\nSigned-off-by: Mauro Carvalho Chehab \u003cmchehab+huawei@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "474d7baf91d37bc411fa60de5bbf03c9dd82e18a", "tree": "01c36ab0263f0338ca61ba2a6457d28b24582124", "parents": [ "68b645edc412d0bc22053ef1e2e66fb5062dfc03" ], "author": { "name": "Tomi Valkeinen", "email": "tomi.valkeinen@ideasonboard.com", "time": "Fri Dec 06 08:26:37 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:34 2025" }, "message": "media: i2c: ds90ub9x3: Fix extra fwnode_handle_put()\n\ncommit 60b45ece41c5632a3a3274115a401cb244180646 upstream.\n\nThe ub913 and ub953 drivers call fwnode_handle_put(priv-\u003esd.fwnode) as\npart of their remove process, and if the driver is removed multiple\ntimes, eventually leads to put \"overflow\", possibly causing memory\ncorruption or crash.\n\nThe fwnode_handle_put() is a leftover from commit 905f88ccebb1 (\"media:\ni2c: ds90ub9x3: Fix sub-device matching\"), which changed the code\nrelated to the sd.fwnode, but missed removing these fwnode_handle_put()\ncalls.\n\nCc: stable@vger.kernel.org\nFixes: 905f88ccebb1 (\"media: i2c: ds90ub9x3: Fix sub-device matching\")\nReviewed-by: Jai Luthra \u003cjai.luthra@ideasonboard.com\u003e\nSigned-off-by: Tomi Valkeinen \u003ctomi.valkeinen@ideasonboard.com\u003e\nSigned-off-by: Sakari Ailus \u003csakari.ailus@linux.intel.com\u003e\nSigned-off-by: Mauro Carvalho Chehab \u003cmchehab+huawei@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "68b645edc412d0bc22053ef1e2e66fb5062dfc03", "tree": "f13332b78a76f7b84b48898f5bc9063ed88fb9dd", "parents": [ "08cb112ca61b953b0cedbd837c35f259ab522d9e" ], "author": { "name": "Mehdi Djait", "email": "mehdi.djait@linux.intel.com", "time": "Wed Dec 11 13:30:45 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:33 2025" }, "message": "media: ccs: Fix cleanup order in ccs_probe()\n\ncommit 6fdbff0f54786e94f0f630ff200ec1d666b1633e upstream.\n\nccs_limits is allocated in ccs_read_all_limits() after the allocation of\nmdata.backing. Ensure that resources are freed in the reverse order of\ntheir allocation by moving out_free_ccs_limits up.\n\nFixes: a11d3d6891f0 (\"media: ccs: Read CCS static data from firmware binaries\")\nCc: stable@vger.kernel.org\nSigned-off-by: Mehdi Djait \u003cmehdi.djait@linux.intel.com\u003e\nSigned-off-by: Sakari Ailus \u003csakari.ailus@linux.intel.com\u003e\nSigned-off-by: Mauro Carvalho Chehab \u003cmchehab+huawei@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "08cb112ca61b953b0cedbd837c35f259ab522d9e", "tree": "2ee0a668009dbeea741bd7160ec355045bfef217", "parents": [ "747c04b1aac96449cf72f0f38c2dac1d9883c218" ], "author": { "name": "Sakari Ailus", "email": "sakari.ailus@linux.intel.com", "time": "Tue Dec 03 08:10:23 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:33 2025" }, "message": "media: ccs: Fix CCS static data parsing for large block sizes\n\ncommit 82b696750f0b60e7513082a10ad42786854f59f8 upstream.\n\nThe length field of the CCS static data blocks was mishandled, leading to\nwrong interpretation of the length header for blocks that are 16 kiB in\nsize. Such large blocks are very, very rare and so this wasn\u0027t found\nearlier.\n\nAs the length is used as part of input validation, the issue has no\nsecurity implications.\n\nFixes: a6b396f410b1 (\"media: ccs: Add CCS static data parser library\")\nCc: stable@vger.kernel.org\nSigned-off-by: Sakari Ailus \u003csakari.ailus@linux.intel.com\u003e\nSigned-off-by: Mauro Carvalho Chehab \u003cmchehab+huawei@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "747c04b1aac96449cf72f0f38c2dac1d9883c218", "tree": "8196ce490a786471d9165857efc0d9284f9e13d0", "parents": [ "25abffee5ceb6691ecd4f089be2bb28842e2d2fd" ], "author": { "name": "Sam Bobrowicz", "email": "sam@elite-embedded.com", "time": "Fri Nov 22 08:28:01 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:33 2025" }, "message": "media: ov5640: fix get_light_freq on auto\n\ncommit 001d3753538d26ddcbef011f5643cfff58a7f672 upstream.\n\nLight frequency was not properly returned when in auto\nmode and the detected frequency was 60Hz.\n\nFixes: 19a81c1426c1 (\"[media] add Omnivision OV5640 sensor driver\")\nCc: stable@vger.kernel.org\nSigned-off-by: Sam Bobrowicz \u003csam@elite-embedded.com\u003e\nSigned-off-by: Michal Simek \u003cmichal.simek@amd.com\u003e\nSigned-off-by: Sakari Ailus \u003csakari.ailus@linux.intel.com\u003e\nSigned-off-by: Mauro Carvalho Chehab \u003cmchehab+huawei@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "25abffee5ceb6691ecd4f089be2bb28842e2d2fd", "tree": "a11b127eb01583bb3bbc8965a7e71ae0506dab7f", "parents": [ "3e4a43a965a8cc6634ec3187e6e5a3ebbfee92f2" ], "author": { "name": "Naushir Patuck", "email": "naush@raspberrypi.com", "time": "Fri Nov 15 18:07:17 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:33 2025" }, "message": "media: imx296: Add standby delay during probe\n\ncommit 57d10bcac67707caaa542e09dee86e13ea85defc upstream.\n\nAdd a 2-5ms delay when coming out of standby and before reading the\nsensor info register durning probe, as instructed by the datasheet. This\nstandby delay is already present when the sensor starts streaming.\n\nDuring a cold-boot, reading the IMX296_SENSOR_INFO register would often\nreturn a value of 0x0000, if this delay is not present before.\n\nFixes: cb33db2b6ccf (\"media: i2c: IMX296 camera sensor driver\")\nCc: stable@vger.kernel.org\nTested-by: Alexandru Ardelean \u003caardelean@baylibre.com\u003e\nSigned-off-by: Naushir Patuck \u003cnaush@raspberrypi.com\u003e\nReviewed-by: Kieran Bingham \u003ckieran.bingham@ideasonboard.com\u003e\nReviewed-by: Laurent Pinchart \u003claurent.pinchart@ideasonboard.com\u003e\nSigned-off-by: Sakari Ailus \u003csakari.ailus@linux.intel.com\u003e\nSigned-off-by: Mauro Carvalho Chehab \u003cmchehab+huawei@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "3e4a43a965a8cc6634ec3187e6e5a3ebbfee92f2", "tree": "90c4095136a6fe70e8b76ddaa8857fcdb71e6462", "parents": [ "4ab7185ad5a6b8d1fb48b8700abe12e37c05b3a5" ], "author": { "name": "Cosmin Tanislav", "email": "demonsingur@gmail.com", "time": "Fri Nov 22 14:55:24 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:33 2025" }, "message": "media: mc: fix endpoint iteration\n\ncommit fb2bd86270cd0ad004f4c614ba4f8c63a5720e25 upstream.\n\nWhen creating links from a subdev to a sink, the current logic tries to\niterate over the endpoints of dev\u0027s fwnode.\n\nThis might not be correct when the subdev uses a different fwnode\ncompared to the dev\u0027s fwnode.\n\nIf, when registering, the subdev\u0027s fwnode is not set, the code inside\nv4l2_async_register_subdev will set it to the dev\u0027s fwnode.\n\nTo fix this, just use the subdev\u0027s fwnode.\n\nSigned-off-by: Cosmin Tanislav \u003cdemonsingur@gmail.com\u003e\nFixes: 0d3c81e82da9 (\"media: v4l2-mc: add v4l2_create_fwnode_links helpers\")\nCc: stable@vger.kernel.org\nReviewed-by: Laurent Pinchart \u003claurent.pinchart+renesas@ideasonboard.com\u003e\nSigned-off-by: Sakari Ailus \u003csakari.ailus@linux.intel.com\u003e\nSigned-off-by: Mauro Carvalho Chehab \u003cmchehab+huawei@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "4ab7185ad5a6b8d1fb48b8700abe12e37c05b3a5", "tree": "a0d5160d425273ec449a02cbc27ce973ff6419b6", "parents": [ "88792f3992cb90163fd56c1b1275746da74ce256" ], "author": { "name": "Lubomir Rintel", "email": "lkundrak@v3.sk", "time": "Tue Dec 31 19:04:34 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:33 2025" }, "message": "media: mmp: Bring back registration of the device\n\ncommit fbb5298bf1a7b71723cd2bb193642429ceb0fb84 upstream.\n\nIn commit 4af65141e38e (\"media: marvell: cafe: Register V4L2 device\nearlier\"), a call to v4l2_device_register() was moved away from\nmccic_register() into its caller, marvell/cafe\u0027s cafe_pci_probe().\nThis is not the only caller though -- there\u0027s also marvell/mmp.\n\nAdd v4l2_device_register() into mmpcam_probe() to unbreak the MMP camera\ndriver, in a fashion analogous to what\u0027s been done to the Cafe driver.\nSame for the teardown path.\n\nFixes: 4af65141e38e (\"media: marvell: cafe: Register V4L2 device earlier\")\nSigned-off-by: Lubomir Rintel \u003clkundrak@v3.sk\u003e\nCc: stable@vger.kernel.org # v6.6+\nSigned-off-by: Hans Verkuil \u003chverkuil@xs4all.nl\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "88792f3992cb90163fd56c1b1275746da74ce256", "tree": "318588b5bd2ac6ce8434b85d3e55343536882aa4", "parents": [ "56eefe1f2fb799d8288d124bbf80050f7a40f5a9" ], "author": { "name": "Krzysztof Kozlowski", "email": "krzysztof.kozlowski@linaro.org", "time": "Thu Aug 22 16:48:51 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:32 2025" }, "message": "soc: qcom: smem_state: fix missing of_node_put in error path\n\ncommit 70096b4990848229d0784c5e51dc3c7c072f1111 upstream.\n\nIf of_parse_phandle_with_args() succeeds, the OF node reference should\nbe dropped, regardless of number of phandle arguments.\n\nCc: stable@vger.kernel.org\nFixes: 9460ae2ff308 (\"soc: qcom: Introduce common SMEM state machine code\")\nSigned-off-by: Krzysztof Kozlowski \u003ckrzysztof.kozlowski@linaro.org\u003e\nReviewed-by: Dmitry Baryshkov \u003cdmitry.baryshkov@linaro.org\u003e\nLink: https://lore.kernel.org/r/20240822164853.231087-2-krzysztof.kozlowski@linaro.org\nSigned-off-by: Bjorn Andersson \u003candersson@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "56eefe1f2fb799d8288d124bbf80050f7a40f5a9", "tree": "a531954e8fa9f3fb726f3c2ba0da2f82eef7fc50", "parents": [ "8eb80b9c9bdf3e20c1253d202afa2a01c4331645" ], "author": { "name": "Krzysztof Kozlowski", "email": "krzysztof.kozlowski@linaro.org", "time": "Sat Jan 04 14:20:11 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:32 2025" }, "message": "soc: mediatek: mtk-devapc: Fix leaking IO map on error paths\n\ncommit c0eb059a4575ed57f265d9883a5203799c19982c upstream.\n\nError paths of mtk_devapc_probe() should unmap the memory. Reported by\nSmatch:\n\n drivers/soc/mediatek/mtk-devapc.c:292 mtk_devapc_probe() warn: \u0027ctx-\u003einfra_base\u0027 from of_iomap() not released on lines: 277,281,286.\n\nFixes: 0890beb22618 (\"soc: mediatek: add mt6779 devapc driver\")\nCc: stable@vger.kernel.org\nSigned-off-by: Krzysztof Kozlowski \u003ckrzysztof.kozlowski@linaro.org\u003e\nLink: https://lore.kernel.org/r/20250104142012.115974-1-krzysztof.kozlowski@linaro.org\nSigned-off-by: AngeloGioacchino Del Regno \u003cangelogioacchino.delregno@collabora.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "8eb80b9c9bdf3e20c1253d202afa2a01c4331645", "tree": "89c277b7b5d2771c9dd279356eec5fa8c098bf93", "parents": [ "1d447317022e6ed739a7aa3800b20d26e1b9adda" ], "author": { "name": "Javier Carrasco", "email": "javier.carrasco.cruz@gmail.com", "time": "Sat Dec 14 22:55:50 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:32 2025" }, "message": "iio: light: as73211: fix channel handling in only-color triggered buffer\n\ncommit ab09c6cfe01b317f515bcd944668697241a54b9d upstream.\n\nThe channel index is off by one unit if AS73211_SCAN_MASK_ALL is not\nset (optimized path for color channel readings), and it must be shifted\ninstead of leaving an empty channel for the temperature when it is off.\n\nOnce the channel index is fixed, the uninitialized channel must be set\nto zero to avoid pushing uninitialized data.\n\nAdd available_scan_masks for all channels and only-color channels to let\nthe IIO core demux and repack the enabled channels.\n\nCc: stable@vger.kernel.org\nFixes: 403e5586b52e (\"iio: light: as73211: New driver\")\nTested-by: Christian Eggers \u003cceggers@arri.de\u003e\nSigned-off-by: Javier Carrasco \u003cjavier.carrasco.cruz@gmail.com\u003e\nLink: https://patch.msgid.link/20241214-iio_memset_scan_holes-v4-1-260b395b8ed5@gmail.com\nSigned-off-by: Jonathan Cameron \u003cJonathan.Cameron@huawei.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "1d447317022e6ed739a7aa3800b20d26e1b9adda", "tree": "b20581c6ce523b0f4fb020c33ceb6c5ebad5451a", "parents": [ "7753ef5ba2a60033f6cc5bf19196d8d17b0fd120" ], "author": { "name": "Sakari Ailus", "email": "sakari.ailus@linux.intel.com", "time": "Tue Dec 03 10:23:01 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:32 2025" }, "message": "media: ccs: Clean up parsed CCS static data on parse failure\n\ncommit da73efa8e675a2b58f1c7ae61201acfe57714bf7 upstream.\n\nccs_data_parse() releases the allocated in-memory data structure when the\nparser fails, but it does not clean up parsed metadata that is there to\nhelp access the actual data. Do that, in order to return the data\nstructure in a sane state.\n\nFixes: a6b396f410b1 (\"media: ccs: Add CCS static data parser library\")\nCc: stable@vger.kernel.org\nSigned-off-by: Sakari Ailus \u003csakari.ailus@linux.intel.com\u003e\nReviewed-by: Mehdi Djait \u003cmehdi.djait@linux.intel.com\u003e\nSigned-off-by: Mauro Carvalho Chehab \u003cmchehab+huawei@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "7753ef5ba2a60033f6cc5bf19196d8d17b0fd120", "tree": "6a96decdaea674e5872dfe29ed6f5cdcf4bc542d", "parents": [ "0796fa13788c860eca4164857f07d41932e39ba6" ], "author": { "name": "Marco Elver", "email": "elver@google.com", "time": "Fri Jan 24 12:01:38 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:32 2025" }, "message": "kfence: skip __GFP_THISNODE allocations on NUMA systems\n\ncommit e64f81946adf68cd75e2207dd9a51668348a4af8 upstream.\n\nOn NUMA systems, __GFP_THISNODE indicates that an allocation _must_ be on\na particular node, and failure to allocate on the desired node will result\nin a failed allocation.\n\nSkip __GFP_THISNODE allocations if we are running on a NUMA system, since\nKFENCE can\u0027t guarantee which node its pool pages are allocated on.\n\nLink: https://lkml.kernel.org/r/20250124120145.410066-1-elver@google.com\nFixes: 236e9f153852 (\"kfence: skip all GFP_ZONEMASK allocations\")\nSigned-off-by: Marco Elver \u003celver@google.com\u003e\nReported-by: Vlastimil Babka \u003cvbabka@suse.cz\u003e\nAcked-by: Vlastimil Babka \u003cvbabka@suse.cz\u003e\nCc: Christoph Lameter \u003ccl@linux.com\u003e\nCc: Alexander Potapenko \u003cglider@google.com\u003e\nCc: Chistoph Lameter \u003ccl@linux.com\u003e\nCc: Dmitriy Vyukov \u003cdvyukov@google.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "0796fa13788c860eca4164857f07d41932e39ba6", "tree": "00b5f088cd6ca50df7c64ee6f9fea6e9417f5b22", "parents": [ "50365a6304a57266e8f4d3078060743c3b7a1e0d" ], "author": { "name": "Gabriele Monaco", "email": "gmonaco@redhat.com", "time": "Wed Jan 15 15:15:48 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:32 2025" }, "message": "rv: Reset per-task monitors also for idle tasks\n\ncommit 8259cb14a70680553d5e82d65d1302fe589e9b39 upstream.\n\nRV per-task monitors are implemented through a monitor structure\navailable for each task_struct. This structure is reset every time the\nmonitor is (re-)started, to avoid inconsistencies if the monitor was\nactivated previously.\nTo do so, we reset the monitor on all threads using the macro\nfor_each_process_thread. However, this macro excludes the idle tasks on\neach CPU. Idle tasks could be considered tasks on their own right and it\nshould be up to the model whether to ignore them or not.\n\nReset monitors also on the idle tasks for each present CPU whenever we\nreset all per-task monitors.\n\nCc: stable@vger.kernel.org\nCc: Juri Lelli \u003cjuri.lelli@redhat.com\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: John Kacur \u003cjkacur@redhat.com\u003e\nLink: https://lore.kernel.org/20250115151547.605750-2-gmonaco@redhat.com\nFixes: 792575348ff7 (\"rv/include: Add deterministic automata monitor definition via C macros\")\nSigned-off-by: Gabriele Monaco \u003cgmonaco@redhat.com\u003e\nSigned-off-by: Steven Rostedt (Google) \u003crostedt@goodmis.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "50365a6304a57266e8f4d3078060743c3b7a1e0d", "tree": "c7e59003d28b5940e8671632992d35a4ede2a3c6", "parents": [ "df6c8203f2cb61e6228c7d4c3ccf0b35cf13ac88" ], "author": { "name": "Jarkko Sakkinen", "email": "jarkko@kernel.org", "time": "Fri Dec 27 15:39:09 2024" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:32 2025" }, "message": "tpm: Change to kvalloc() in eventlog/acpi.c\n\ncommit a3a860bc0fd6c07332e4911cf9a238d20de90173 upstream.\n\nThe following failure was reported on HPE ProLiant D320:\n\n[ 10.693310][ T1] tpm_tis STM0925:00: 2.0 TPM (device-id 0x3, rev-id 0)\n[ 10.848132][ T1] ------------[ cut here ]------------\n[ 10.853559][ T1] WARNING: CPU: 59 PID: 1 at mm/page_alloc.c:4727 __alloc_pages_noprof+0x2ca/0x330\n[ 10.862827][ T1] Modules linked in:\n[ 10.866671][ T1] CPU: 59 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.0-lp155.2.g52785e2-default #1 openSUSE Tumbleweed (unreleased) 588cd98293a7c9eba9013378d807364c088c9375\n[ 10.882741][ T1] Hardware name: HPE ProLiant DL320 Gen12/ProLiant DL320 Gen12, BIOS 1.20 10/28/2024\n[ 10.892170][ T1] RIP: 0010:__alloc_pages_noprof+0x2ca/0x330\n[ 10.898103][ T1] Code: 24 08 e9 4a fe ff ff e8 34 36 fa ff e9 88 fe ff ff 83 fe 0a 0f 86 b3 fd ff ff 80 3d 01 e7 ce 01 00 75 09 c6 05 f8 e6 ce 01 01 \u003c0f\u003e 0b 45 31 ff e9 e5 fe ff ff f7 c2 00 00 08 00 75 42 89 d9 80 e1\n[ 10.917750][ T1] RSP: 0000:ffffb7cf40077980 EFLAGS: 00010246\n[ 10.923777][ T1] RAX: 0000000000000000 RBX: 0000000000040cc0 RCX: 0000000000000000\n[ 10.931727][ T1] RDX: 0000000000000000 RSI: 000000000000000c RDI: 0000000000040cc0\n\nThe above transcript shows that ACPI pointed a 16 MiB buffer for the log\nevents because RSI maps to the \u0027order\u0027 parameter of __alloc_pages_noprof().\nAddress the bug by moving from devm_kmalloc() to devm_add_action() and\nkvmalloc() and devm_add_action().\n\nSuggested-by: Ard Biesheuvel \u003cardb@kernel.org\u003e\nCc: stable@vger.kernel.org # v2.6.16+\nFixes: 55a82ab3181b (\"[PATCH] tpm: add bios measurement log\")\nReported-by: Andy Liang \u003candy.liang@hpe.com\u003e\nCloses: https://bugzilla.kernel.org/show_bug.cgi?id\u003d219495\nReviewed-by: Ard Biesheuvel \u003cardb@kernel.org\u003e\nReviewed-by: Stefan Berger \u003cstefanb@linux.ibm.com\u003e\nReviewed-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nTested-by: Andy Liang \u003candy.liang@hpe.com\u003e\nSigned-off-by: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "df6c8203f2cb61e6228c7d4c3ccf0b35cf13ac88", "tree": "fc0c6030b69bdbd526d307e3af2f602c11dd814e", "parents": [ "970e92cac159b9ab81a38010e14e2330f6797522" ], "author": { "name": "Aubrey Li", "email": "aubrey.li@linux.intel.com", "time": "Sun Jan 26 02:22:50 2025" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Mon Feb 17 08:40:31 2025" }, "message": "ACPI: PRM: Remove unnecessary strict handler address checks\n\ncommit 7f5704b6a143b8eca640cba820968e798d065e91 upstream.\n\nCommit 088984c8d54c (\"ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM\nhandler and context\") added unnecessary strict handler address checks,\ncausing the PRM module to fail in translating memory error addresses.\n\nBoth static data buffer address and ACPI parameter buffer address may\nbe NULL if they are not needed, as described in section 4.1.2 PRM Handler\nInformation Structure of Platform Runtime Mechanism specification [1].\n\nHere are two examples from real hardware:\n\n----PRMT.dsl----\n\n- staic data address is not used\n[10Ch 0268 2] Revision : 0000\n[10Eh 0270 2] Length : 002C\n[110h 0272 16] Handler GUID : F6A58D47-E04F-4F5A-86B8-2A50D4AA109B\n[120h 0288 8] Handler address : 0000000065CE51F4\n[128h 0296 8] Satic Data Address : 0000000000000000\n[130h 0304 8] ACPI Parameter Address : 000000006522A718\n\n- ACPI parameter address is not used\n[1B0h 0432 2] Revision : 0000\n[1B2h 0434 2] Length : 002C\n[1B4h 0436 16] Handler GUID : 657E8AE6-A8FC-4877-BB28-42E7DE1899A5\n[1C4h 0452 8] Handler address : 0000000065C567C8\n[1CCh 0460 8] Satic Data Address : 000000006113FB98\n[1D4h 0468 8] ACPI Parameter Address : 0000000000000000\n\nFixes: 088984c8d54c (\"ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context\")\nReported-and-tested-by: Shi Liu \u003caurelianliu@tencent.com\u003e\nCc: All applicable \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Aubrey Li \u003caubrey.li@linux.intel.com\u003e\nLink: https://uefi.org/sites/default/files/resources/Platform%20Runtime%20Mechanism%20-%20with%20legal%20notice.pdf # [1]\nReviewed-by: Koba Ko \u003ckobak@nvidia.com\u003e\nAcked-by: Ard Biesheuvel \u003cardb@kernel.org\u003e\nLink: https://patch.msgid.link/20250126022250.3014210-1-aubrey.li@linux.intel.com\n[ rjw: Minor changelog edits ]\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" } ], "next": "970e92cac159b9ab81a38010e14e2330f6797522" }