Commit Graph

1309888 Commits

Author SHA1 Message Date
Linus Torvalds
531643fcd9 SCSI fixes on 20241019
Fixes all in drivers. The largest is the mpi3mr which corrects a phy
 count limit that should only apply to the controller but was being
 incorrectly applied to expander phys.
 
 Signed-off-by: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
 -----BEGIN PGP SIGNATURE-----
 
 iJwEABMIAEQWIQTnYEDbdso9F2cI+arnQslM7pishQUCZxQINSYcamFtZXMuYm90
 dG9tbGV5QGhhbnNlbnBhcnRuZXJzaGlwLmNvbQAKCRDnQslM7pishfuiAP9+gxzU
 MYpyNFYmS8iwbma+wagKMr2ZxpiIAnQIukBtugD7Baqw7YjNbAPtCcQMgC96y8ac
 X7zeMkLTyMqkaIjOQFk=
 =eHKZ
 -----END PGP SIGNATURE-----

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "Fixes all in drivers. The largest is the mpi3mr which corrects a phy
  count limit that should only apply to the controller but was being
  incorrectly applied to expander phys"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: target: core: Fix null-ptr-deref in target_alloc_device()
  scsi: mpi3mr: Validate SAS port assignments
  scsi: ufs: core: Set SDEV_OFFLINE when UFS is shut down
  scsi: ufs: core: Requeue aborted request
  scsi: ufs: core: Fix the issue of ICU failure
2024-10-19 12:52:19 -07:00
Linus Torvalds
06526daaff ftrace: A couple of fixes to function graph infrastructure
- Fix allocation of idle shadow stack allocation during hotplug
 
   If function graph tracing is started when a CPU is offline, if it were
   come online during the trace then the idle task that represents the CPU
   will not get a shadow stack allocated for it. This means all function
   graph hooks that happen while that idle task is running (including in
   interrupt mode) will have all its events dropped.
 
   Switch over to the CPU hotplug mechanism that will have any newly
   brought on line CPU get a callback that can allocate the shadow stack
   for its idle task.
 
 - Fix allocation size of the ret_stack_list array
 
   When function graph tracing converted over to allowing more than one
   user at a time, it had to convert its shadow stack from an array of
   ret_stack structures to an array of unsigned longs. The shadow stacks
   are allocated in batches of 32 at a time and assigned to every running
   task. The batch is held by the ret_stack_list array. But when the
   conversion happened, instead of allocating an array of 32 pointers, it
   was allocated as a ret_stack itself (PAGE_SIZE). This ret_stack_list
   gets passed to a function that iterates over what it believes is its
   size defined by the FTRACE_RETSTACK_ALLOC_SIZE macro (which is 32).
 
   Luckily (PAGE_SIZE) is greater than 32 * sizeof(long), otherwise this
   would have been an array overflow. This still should be fixed and the
   ret_stack_list should be allocated to the size it is expected to be as
   someday it may end up being bigger than SHADOW_STACK_SIZE.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYIADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCZxP8RhQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qmW3AP4qCOvU/g9g6u32gIZmS1oUWqe3q+Rq
 9OKCk0JP6GGc8AD/cF816lbs5vpDiZFdbBvaz5gLHqhfAt35NVU8T5tbJA4=
 =Lh3A
 -----END PGP SIGNATURE-----

Merge tag 'ftrace-v6.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull ftrace fixes from Steven Rostedt:
 "A couple of fixes to function graph infrastructure:

   - Fix allocation of idle shadow stack allocation during hotplug

     If function graph tracing is started when a CPU is offline, if it
     were come online during the trace then the idle task that
     represents the CPU will not get a shadow stack allocated for it.
     This means all function graph hooks that happen while that idle
     task is running (including in interrupt mode) will have all its
     events dropped.

     Switch over to the CPU hotplug mechanism that will have any newly
     brought on line CPU get a callback that can allocate the shadow
     stack for its idle task.

   - Fix allocation size of the ret_stack_list array

     When function graph tracing converted over to allowing more than
     one user at a time, it had to convert its shadow stack from an
     array of ret_stack structures to an array of unsigned longs. The
     shadow stacks are allocated in batches of 32 at a time and assigned
     to every running task. The batch is held by the ret_stack_list
     array.

     But when the conversion happened, instead of allocating an array of
     32 pointers, it was allocated as a ret_stack itself (PAGE_SIZE).
     This ret_stack_list gets passed to a function that iterates over
     what it believes is its size defined by the
     FTRACE_RETSTACK_ALLOC_SIZE macro (which is 32).

     Luckily (PAGE_SIZE) is greater than 32 * sizeof(long), otherwise
     this would have been an array overflow. This still should be fixed
     and the ret_stack_list should be allocated to the size it is
     expected to be as someday it may end up being bigger than
     SHADOW_STACK_SIZE"

* tag 'ftrace-v6.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  fgraph: Allocate ret_stack_list with proper size
  fgraph: Use CPU hotplug mechanism to initialize idle shadow stacks
2024-10-19 12:42:14 -07:00
Linus Torvalds
8203ca3809 ipe/stable-6.12 PR 20241018
-----BEGIN PGP SIGNATURE-----
 
 iIcEABYIAC8WIQQzmBmZPBN6m/hUJmnyomI6a/yO7QUCZxK0IhEcd3VmYW5Aa2Vy
 bmVsLm9yZwAKCRDyomI6a/yO7bYaAP9RInzgnGtws5coddMT8vlsMsCGb+4EZegC
 Uhw/gqWO3gD/Ua/x97apb4SZesyto8fm3rP4Aw0CvtBL5FuyKGnBBAU=
 =CRIh
 -----END PGP SIGNATURE-----

Merge tag 'ipe-pr-20241018' of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe

Pull ipe fixes from Fan Wu:
 "This addresses several issues identified by Luca when attempting to
  enable IPE on Debian and systemd:

   - address issues with IPE policy update errors and policy update
     version check, improving the clarity of error messages for better
     understanding by userspace programs.

   - enable IPE policies to be signed by secondary and platform
     keyrings, facilitating broader use across general Linux
     distributions like Debian.

   - updates the IPE entry in the MAINTAINERS file to reflect the new
     tree URL and my updated email from kernel.org"

* tag 'ipe-pr-20241018' of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe:
  MAINTAINERS: update IPE tree url and Fan Wu's email
  ipe: fallback to platform keyring also if key in trusted keyring is rejected
  ipe: allow secondary and platform keyrings to install/update policies
  ipe: also reject policy updates with the same version
  ipe: return -ESTALE instead of -EINVAL on update when new policy has a lower version
2024-10-19 11:48:14 -07:00
Linus Torvalds
f9e4825524 Input updates for v6.12-rc3
- a fix for Zinitix driver to not fail probing if property enabling
   touch keys functionality is not defined. Support for touch keys was
   added in 6.12 merge window so this issue does not affect users of
   released kernels
 
 - a couple new vendor/device IDs in xpad driver to enable support
   for more hardware.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCZxMk3gAKCRBAj56VGEWX
 nHcXAP99ROP6m6hoGUEvCKVtWQuuKPxJTMByLpdpHdTcX15HdQD9GB9HBVnBdIV5
 hckmsRPttRfhUIlMyWWR54anNidx4ww=
 =yn7x
 -----END PGP SIGNATURE-----

Merge tag 'input-for-v6.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

Pull input fixes from Dmitry Torokhov:

 - a fix for Zinitix driver to not fail probing if the property enabling
   touch keys functionality is not defined. Support for touch keys was
   added in 6.12 merge window so this issue does not affect users of
   released kernels

 - a couple new vendor/device IDs in xpad driver to enable support for
   more hardware

* tag 'input-for-v6.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: zinitix - don't fail if linux,keycodes prop is absent
  Input: xpad - add support for MSI Claw A1M
  Input: xpad - add support for 8BitDo Ultimate 2C Wireless Controller
2024-10-19 10:18:03 -07:00
Linus Torvalds
9197b73fd7 Mashed-up update that I sat on too long:
- fix for multiple slabs created with the same name
 - enable multipage folios
 - theorical fix to also look for opened fids by inode if none
 was found by dentry
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE/IPbcYBuWt0zoYhOq06b7GqY5nAFAmcS81AACgkQq06b7GqY
 5nACpBAAtXOGRjg+dushCwUVKBlnI3oTwE2G+ywnphNZg2A0emlMOxos7x1OTiM3
 Fu0b10MCUWHIXo4jD6ALVPWITJTfjiXR8s90Q/ozypcIXXhkDDShhV31b2h6Iplr
 YyKyjEehDFRiS7rqWC2a9mce99sOpwdQRmnssnWbjYvpJ4imFbl+50Z1I5Nc/Omu
 j2y02eMuikiWF/shKj0Dx1mmpZ4InSv3kvlM+V2D2YdWKNonGZe/xFZhid95LXmr
 Upt55R8k9qR2pn4VU22eKP6c34DIZGDlrcQdPUCNP5QuaAdGZov3TjNQdjE1bJmF
 E2QdxvUNfvvHqlvaRrlWa27uMgXMcy7QV3LEKwmo3tmaYVw2PDMRbFXc9zQdxy91
 zqXjjGasnwzE8ca36y79vZjFTHAyY5VK/3cHCL3ai+ysu4UL3k2QgmVegREG/xKk
 G8Nz4UO/R6s8Wc2VqxKJdZS5NMLlADS+Aes0PG+9AxQz7iR9Ktgwrw39KDxMi+Lm
 PeH3Gz2rP9+EPoa3usoBQtvvvmJKM/Wb9qdPW9vTtRbRJ7bVclJoizFoLMA/TiW1
 Jru+HYGBO75s8RynwEDLMiJhkjZWHfVgDjPsY6YsGVH8W2gOcJ7egQ2J2EsuurN3
 tzKz4uQilV+VeDuWs8pWKrX/c3Y3KpSYV+oayg7Je7LoTlQBmU8=
 =VG4t
 -----END PGP SIGNATURE-----

Merge tag '9p-for-6.12-rc4' of https://github.com/martinetd/linux

Pull 9p fixes from Dominique Martinet:
 "Mashed-up update that I sat on too long:

   - fix for multiple slabs created with the same name

   - enable multipage folios

   - theorical fix to also look for opened fids by inode if none was
     found by dentry"

[ Enabling multi-page folios should have been done during the merge
  window, but it's a one-liner, and the actual meat of the enablement
  is in netfs and already in use for other filesystems...  - Linus ]

* tag '9p-for-6.12-rc4' of https://github.com/martinetd/linux:
  9p: Avoid creating multiple slab caches with the same name
  9p: Enable multipage folios
  9p: v9fs_fid_find: also lookup by inode if not found dentry
2024-10-19 08:44:10 -07:00
Linus Torvalds
4e6bd4a33a Rust fixes for v6.12 (2nd)
Toolchain and infrastructure:
 
  - Fix several issues with the 'rustc-option' macro. It includes a
    refactor from Masahiro of three '{cc,rust}-*' macros, which is not
    a fix but avoids repeating the same commands (which would be several
    lines in the case of 'rustc-option').
 
  - Fix conditions for 'CONFIG_HAVE_CFI_ICALL_NORMALIZE_INTEGERS'. It
    includes the addition of 'CONFIG_RUSTC_LLVM_VERSION', which is not a
    fix but is needed for the actual fix.
 
 And a trivial grammar fix.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEPjU5OPd5QIZ9jqqOGXyLc2htIW0FAmcS5LkACgkQGXyLc2ht
 IW07ghAAxP94zqWzf8bQ4IIgTYrV9WSqR9vMpd31VAPknRJjGUq5dehFxiQxDJ5X
 ibMcpyja8V1CGeOh4qthLJAD/OGw+ANafjLfHM/l9cQRx1uwLEac3h4/YR1x52Ep
 al3ISewhbs3cjko2aa6Gnym3hdYizqkKY9Bca6kvo7k4ZRRmWT3sKAsle6rV93Hw
 q9AjC40XC8iy2VYv/JPvP1zcr3T7ZzCrs3ELG8sLSeR0gZZEmI3e3FOWWHcRlVRa
 uig4SSPvhHVssG8k64CHmzUtVQCApuJuzQGG72Ozs4V5Xxk86ZRE0XzyMXaw15nu
 Mm8s+hDxsFXfESQg0GMCVQ7wnGFSuvRwK3sWALltXmqtGQxkYgcJ3mYtu0sP8p51
 VIzDIomdUfGLxk+sDn7Lnl5PrSLaetUd94nr5qCMmfb2/7/kSaB4aHmML+8ZHCn5
 I4TQONL/pVmmRm97HFaAFOzCaGRWfVoIzQ/cRaQhqK+qrTfRjyFcsMzN+Flp5A58
 c3AgnTVlm4pPqtlLQ1z9BiGYT50dI0fHBOQiisogGsZwwMUqzEMOnbZjbhS/HKSp
 FG8hu/OyzIsNnNqOfQZN4DSTyf4qfIuyTmFM1OAel8zllCwlxy5F2hVp/opwH3/y
 On6CW0lunUBzCXZZ+byWudo7Vg8YpMVHATLqp9FHZpJb8JK688w=
 =Y7fL
 -----END PGP SIGNATURE-----

Merge tag 'rust-fixes-6.12-2' of https://github.com/Rust-for-Linux/linux

Pull rust fixes from Miguel Ojeda:
 "Toolchain and infrastructure:

   - Fix several issues with the 'rustc-option' macro. It includes a
     refactor from Masahiro of three '{cc,rust}-*' macros, which is not
     a fix but avoids repeating the same commands (which would be
     several lines in the case of 'rustc-option').

   - Fix conditions for 'CONFIG_HAVE_CFI_ICALL_NORMALIZE_INTEGERS'. It
     includes the addition of 'CONFIG_RUSTC_LLVM_VERSION', which is not
     a fix but is needed for the actual fix.

  And a trivial grammar fix"

* tag 'rust-fixes-6.12-2' of https://github.com/Rust-for-Linux/linux:
  cfi: fix conditions for HAVE_CFI_ICALL_NORMALIZE_INTEGERS
  kbuild: rust: add `CONFIG_RUSTC_LLVM_VERSION`
  kbuild: fix issues with rustc-option
  kbuild: refactor cc-option-yn, cc-disable-warning, rust-option-yn macros
  lib/Kconfig.debug: fix grammar in RUST_BUILD_ASSERT_ALLOW
2024-10-19 08:32:47 -07:00
Steven Rostedt
fae4078c28 fgraph: Allocate ret_stack_list with proper size
The ret_stack_list is an array of ret_stack shadow stacks for the function
graph usage. When the first function graph is enabled, all tasks in the
system get a shadow stack. The ret_stack_list is a 32 element array of
pointers to these shadow stacks. It allocates the shadow stack in batches
(32 stacks at a time), assigns them to running tasks, and continues until
all tasks are covered.

When the function graph shadow stack changed from an array of
ftrace_ret_stack structures to an array of longs, the allocation of
ret_stack_list went from allocating an array of 32 elements to just a
block defined by SHADOW_STACK_SIZE. Luckily, that's defined as PAGE_SIZE
and is much more than enough to hold 32 pointers. But it is way overkill
for the amount needed to allocate.

Change the allocation of ret_stack_list back to a kcalloc() of
FTRACE_RETSTACK_ALLOC_SIZE pointers.

Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Link: https://lore.kernel.org/20241018215212.23f13f40@rorschach
Fixes: 42675b723b ("function_graph: Convert ret_stack to a series of longs")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2024-10-18 21:57:20 -04:00
Steven Rostedt
2c02f7375e fgraph: Use CPU hotplug mechanism to initialize idle shadow stacks
The function graph infrastructure allocates a shadow stack for every task
when enabled. This includes the idle tasks. The first time the function
graph is invoked, the shadow stacks are created and never freed until the
task exits. This includes the idle tasks.

Only the idle tasks that were for online CPUs had their shadow stacks
created when function graph tracing started. If function graph tracing is
enabled and a CPU comes online, the idle task representing that CPU will
not have its shadow stack created, and all function graph tracing for that
idle task will be silently dropped.

Instead, use the CPU hotplug mechanism to allocate the idle shadow stacks.
This will include idle tasks for CPUs that come online during tracing.

This issue can be reproduced by:

 # cd /sys/kernel/tracing
 # echo 0 > /sys/devices/system/cpu/cpu1/online
 # echo 0 > set_ftrace_pid
 # echo function_graph > current_tracer
 # echo 1 > options/funcgraph-proc
 # echo 1 > /sys/devices/system/cpu/cpu1
 # grep '<idle>' per_cpu/cpu1/trace | head

Before, nothing would show up.

After:
 1)    <idle>-0    |   0.811 us    |                        __enqueue_entity();
 1)    <idle>-0    |   5.626 us    |                      } /* enqueue_entity */
 1)    <idle>-0    |               |                      dl_server_update_idle_time() {
 1)    <idle>-0    |               |                        dl_scaled_delta_exec() {
 1)    <idle>-0    |   0.450 us    |                          arch_scale_cpu_capacity();
 1)    <idle>-0    |   1.242 us    |                        }
 1)    <idle>-0    |   1.908 us    |                      }
 1)    <idle>-0    |               |                      dl_server_start() {
 1)    <idle>-0    |               |                        enqueue_dl_entity() {
 1)    <idle>-0    |               |                          task_contending() {

Note, if tracing stops and restarts, the old way would then initialize
the onlined CPUs.

Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/20241018214300.6df82178@rorschach
Fixes: 868baf07b1 ("ftrace: Fix memory leak with function graph and cpu hotplug")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
2024-10-18 21:56:56 -04:00
Linus Torvalds
3d5ad2d4ec BPF fixes:
- Fix BPF verifier to not affect subreg_def marks in its range
   propagation, from Eduard Zingerman.
 
 - Fix a truncation bug in the BPF verifier's handling of
   coerce_reg_to_size_sx, from Dimitar Kanaliev.
 
 - Fix the BPF verifier's delta propagation between linked
   registers under 32-bit addition, from Daniel Borkmann.
 
 - Fix a NULL pointer dereference in BPF devmap due to missing
   rxq information, from Florian Kauer.
 
 - Fix a memory leak in bpf_core_apply, from Jiri Olsa.
 
 - Fix an UBSAN-reported array-index-out-of-bounds in BTF
   parsing for arrays of nested structs, from Hou Tao.
 
 - Fix build ID fetching where memory areas backing the file
   were created with memfd_secret, from Andrii Nakryiko.
 
 - Fix BPF task iterator tid filtering which was incorrectly
   using pid instead of tid, from Jordan Rome.
 
 - Several fixes for BPF sockmap and BPF sockhash redirection
   in combination with vsocks, from Michal Luczaj.
 
 - Fix riscv BPF JIT and make BPF_CMPXCHG fully ordered,
   from Andrea Parri.
 
 - Fix riscv BPF JIT under CONFIG_CFI_CLANG to prevent the
   possibility of an infinite BPF tailcall, from Pu Lehui.
 
 - Fix a build warning from resolve_btfids that bpf_lsm_key_free
   cannot be resolved, from Thomas Weißschuh.
 
 - Fix a bug in kfunc BTF caching for modules where the wrong
   BTF object was returned, from Toke Høiland-Jørgensen.
 
 - Fix a BPF selftest compilation error in cgroup-related tests
   with musl libc, from Tony Ambardar.
 
 - Several fixes to BPF link info dumps to fill missing fields,
   from Tyrone Wu.
 
 - Add BPF selftests for kfuncs from multiple modules, checking
   that the correct kfuncs are called, from Simon Sundberg.
 
 - Ensure that internal and user-facing bpf_redirect flags
   don't overlap, also from Toke Høiland-Jørgensen.
 
 - Switch to use kvzmalloc to allocate BPF verifier environment,
   from Rik van Riel.
 
 - Use raw_spinlock_t in BPF ringbuf to fix a sleep in atomic
   splat under RT, from Wander Lairson Costa.
 
 Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
 -----BEGIN PGP SIGNATURE-----
 
 iIsEABYIADMWIQTFp0I1jqZrAX+hPRXbK58LschIgwUCZxK4OhUcZGFuaWVsQGlv
 Z2VhcmJveC5uZXQACgkQ2yufC7HISIOCrwEAib2kC5EEQn5+wKVE/bnZryVX2leT
 YXdfItDCBU6zCYUA+wTU5hGGn9lcDUcZx72l/KZPDyPw7HdzNJ+6iR1zQqoM
 =f9kv
 -----END PGP SIGNATURE-----

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Pull bpf fixes from Daniel Borkmann:

 - Fix BPF verifier to not affect subreg_def marks in its range
   propagation (Eduard Zingerman)

 - Fix a truncation bug in the BPF verifier's handling of
   coerce_reg_to_size_sx (Dimitar Kanaliev)

 - Fix the BPF verifier's delta propagation between linked registers
   under 32-bit addition (Daniel Borkmann)

 - Fix a NULL pointer dereference in BPF devmap due to missing rxq
   information (Florian Kauer)

 - Fix a memory leak in bpf_core_apply (Jiri Olsa)

 - Fix an UBSAN-reported array-index-out-of-bounds in BTF parsing for
   arrays of nested structs (Hou Tao)

 - Fix build ID fetching where memory areas backing the file were
   created with memfd_secret (Andrii Nakryiko)

 - Fix BPF task iterator tid filtering which was incorrectly using pid
   instead of tid (Jordan Rome)

 - Several fixes for BPF sockmap and BPF sockhash redirection in
   combination with vsocks (Michal Luczaj)

 - Fix riscv BPF JIT and make BPF_CMPXCHG fully ordered (Andrea Parri)

 - Fix riscv BPF JIT under CONFIG_CFI_CLANG to prevent the possibility
   of an infinite BPF tailcall (Pu Lehui)

 - Fix a build warning from resolve_btfids that bpf_lsm_key_free cannot
   be resolved (Thomas Weißschuh)

 - Fix a bug in kfunc BTF caching for modules where the wrong BTF object
   was returned (Toke Høiland-Jørgensen)

 - Fix a BPF selftest compilation error in cgroup-related tests with
   musl libc (Tony Ambardar)

 - Several fixes to BPF link info dumps to fill missing fields (Tyrone
   Wu)

 - Add BPF selftests for kfuncs from multiple modules, checking that the
   correct kfuncs are called (Simon Sundberg)

 - Ensure that internal and user-facing bpf_redirect flags don't overlap
   (Toke Høiland-Jørgensen)

 - Switch to use kvzmalloc to allocate BPF verifier environment (Rik van
   Riel)

 - Use raw_spinlock_t in BPF ringbuf to fix a sleep in atomic splat
   under RT (Wander Lairson Costa)

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (38 commits)
  lib/buildid: Handle memfd_secret() files in build_id_parse()
  selftests/bpf: Add test case for delta propagation
  bpf: Fix print_reg_state's constant scalar dump
  bpf: Fix incorrect delta propagation between linked registers
  bpf: Properly test iter/task tid filtering
  bpf: Fix iter/task tid filtering
  riscv, bpf: Make BPF_CMPXCHG fully ordered
  bpf, vsock: Drop static vsock_bpf_prot initialization
  vsock: Update msg_count on read_skb()
  vsock: Update rx_bytes on read_skb()
  bpf, sockmap: SK_DROP on attempted redirects of unsupported af_vsock
  selftests/bpf: Add asserts for netfilter link info
  bpf: Fix link info netfilter flags to populate defrag flag
  selftests/bpf: Add test for sign extension in coerce_subreg_to_size_sx()
  selftests/bpf: Add test for truncation after sign extension in coerce_reg_to_size_sx()
  bpf: Fix truncation bug in coerce_reg_to_size_sx()
  selftests/bpf: Assert link info uprobe_multi count & path_size if unset
  bpf: Fix unpopulated path_size when uprobe_multi fields unset
  selftests/bpf: Fix cross-compiling urandom_read
  selftests/bpf: Add test for kfunc module order
  ...
2024-10-18 16:27:14 -07:00
Linus Torvalds
dbafeddb95 linux_kselftest-fixes-6.12-rc4
kselftest fixes for Linux 6.12-rc4
 
 -- fixes test makefile to install tests directory without which
    the test fails with errors.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEPZKym/RZuOCGeA/kCwJExA0NQxwFAmcSupQACgkQCwJExA0N
 QxwIThAAmrmJg68T6u3LM0Fg5X6AeiIifgM12l2uFJ7l3A7i0neVeKdd/hyu5LdU
 pBaoazZajDUNBLmTQ8JOyJj1GisF1bxL/tlXy5xuyesf5pRcsBDU8u8R9xB8MT1c
 gGFKDlsT+jLwaAMNws7IRGkN2nmwuDYyhJQsuBTElN0cMViCCOTAxS0el3+9ymqK
 oJMHRawEGr9w8lD9wtwayK9D05YdSY3H/k6Yoco/BPSvXB0g+6dHv/h3zjkmxgmi
 VxAFWSDri2o4otxhPL/wNdJbzNjLrorFZ6PtYnNopZds2Qx9bqLulRcwEM0pPDtq
 8qqQUOgsUyC9dMLAwp2l5zVUDfZCjSr21NS59nfjW4ZD8YZzgzmwwYJ2xQIuDunP
 gVX7zWcG3/6DK55BTe6LZpiqlXRrbSZ5EOvq2eZIA/cMOlddYsY9tEdr1/OB99fh
 TUuAQSEUpzb4p9YRfHQBAucJmWCVLJepoTzmt8PSLVnQQDGwg84OE/seX6SEt0uv
 kyQXM0JX1Fq9eVtijc/2hiKQzDoBK/OzopCn3undDhB/p1fpNaUfPPiyy05AMlHJ
 o3HMK02ooG7Mk/oOBOEDParaAQFMqJWY2DI7XY7EM2Utk/u13SZmnWKL5jVxAjob
 1UC+87HiDvE+yXLS2d8nvn/NI23hfa186fCugvUl9k7XsG+6EuM=
 =0Kn+
 -----END PGP SIGNATURE-----

Merge tag 'linux_kselftest-fixes-6.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest

Pull kselftest fix from Shuah Khan:

 - fix test makefile to install tests directory without which the test
   fails with errors

* tag 'linux_kselftest-fixes-6.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
  selftest: hid: add the missing tests directory
2024-10-18 16:11:17 -07:00
Nikita Travkin
2de01e0e57 Input: zinitix - don't fail if linux,keycodes prop is absent
When initially adding the touchkey support, a mistake was made in the
property parsing code. The possible negative errno from
device_property_count_u32() was never checked, which was an oversight
left from converting to it from the of_property as part of the review
fixes.

Re-add the correct handling of the absent property, in which case zero
touchkeys should be assumed, which would disable the feature.

Reported-by: Jakob Hauser <jahau@rocketmail.com>
Tested-by: Jakob Hauser <jahau@rocketmail.com>
Fixes: 075d9b22c8 ("Input: zinitix - add touchkey support")
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Nikita Travkin <nikita@trvn.ru>
Tested-by: Yassine Oudjana <y.oudjana@protonmail.com>
Link: https://lore.kernel.org/r/20241004-zinitix-no-keycodes-v2-1-876dc9fea4b6@trvn.ru
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2024-10-18 16:03:04 -07:00
Linus Torvalds
f8eacd8ad7 block-6.12-20241018
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmcSk4AQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpuuXD/0UERdP+djJNoXBW5Mv7U5a4rJ7ZgfPL7ku
 z3ZfdnNYGitZhYkVjNQ60TLzXRQyUaIIxMVBWzkb59I6ixmuQbzm/lC55B6s/FIR
 bfT3afe1WRgLCaFbStu91qRs/44Mq4yK6wXcIU7LwutRT/5cqZwelqRZLK7DMFln
 zlGX4zNrCMRUDTr6PLa6CvyY4dmQSL17Ib1ypcKXjGs5YjDntzSrIsKVT1Wayans
 WroGGPG6W7r2c2kn8pe4uPIjZVfMUF2vrdIs0KEYaAQOC7ppEucCgDZMEWRs7kdH
 63hheudJjVSwLF/qYnXNHe/Bz12QCZohPp6UsqRpC8o96Ralgo6Q+FxkXsVelMXW
 JKhtDqYGBDHOQrjrEWN1rnYw/DauEQAgvOtdVfEx2IBzPsG07cB8yv8MNA90H9QH
 KStI7h9qnBEMMNcXX8prOymCHNWAeuF4mbitVrRfSfEVm/0BbQ19qoyGrvwNFgEf
 6T+4Xj/P+FsiLVe8vsgBZDaxEEU5Ifd/rki/QFVk/2z72BBZxmdf2nm51SOM28V7
 HGMHwJI3H8rdmPXvt5Q/ve6GWNOYLO5PSAJgSSe96UStvtsAHGB4eM+LykdnE7cI
 SoytU5KfAM8DD6wnyHIgYuvJyZWrmLoVDrRjym8emc2KrJOe7qg+Ah4ERcNTCnhl
 nw50f27G4w==
 =waNY
 -----END PGP SIGNATURE-----

Merge tag 'block-6.12-20241018' of git://git.kernel.dk/linux

Pull block fixes from Jens Axboe:

 - NVMe pull request via Keith:
     - Fix target passthrough identifier (Nilay)
     - Fix tcp locking (Hannes)
     - Replace list with sbitmap for tracking RDMA rsp tags (Guixen)
     - Remove unnecessary fallthrough statements (Tokunori)
     - Remove ready-without-media support (Greg)
     - Fix multipath partition scan deadlock (Keith)
     - Fix concurrent PCI reset and remove queue mapping (Maurizio)
     - Fabrics shutdown fixes (Nilay)

 - Fix for a kerneldoc warning (Keith)

 - Fix a race with blk-rq-qos and wakeups (Omar)

 - Cleanup of checking for always-set tag_set (SurajSonawane2415)

 - Fix for a crash with CPU hotplug notifiers (Ming)

 - Don't allow zero-copy ublk on unprivileged device (Ming)

 - Use array_index_nospec() for CDROM (Josh)

 - Remove dead code in drbd (David)

 - Tweaks to elevator loading (Breno)

* tag 'block-6.12-20241018' of git://git.kernel.dk/linux:
  cdrom: Avoid barrier_nospec() in cdrom_ioctl_media_changed()
  nvme: use helper nvme_ctrl_state in nvme_keep_alive_finish function
  nvme: make keep-alive synchronous operation
  nvme-loop: flush off pending I/O while shutting down loop controller
  nvme-pci: fix race condition between reset and nvme_dev_disable()
  ublk: don't allow user copy for unprivileged device
  blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race
  nvme-multipath: defer partition scanning
  blk-mq: setup queue ->tag_set before initializing hctx
  elevator: Remove argument from elevator_find_get
  elevator: do not request_module if elevator exists
  drbd: Remove unused conn_lowest_minor
  nvme: disable CC.CRIME (NVME_CC_CRIME)
  nvme: delete unnecessary fallthru comment
  nvmet-rdma: use sbitmap to replace rsp free list
  block: Fix elevator_get_default() checking for NULL q->tag_set
  nvme: tcp: avoid race between queue_lock lock and destroy
  nvmet-passthru: clear EUID/NGUID/UUID while using loop target
  block: fix blk_rq_map_integrity_sg kernel-doc
2024-10-18 15:53:00 -07:00
Linus Torvalds
a041f47898 io_uring-6.12-20241018
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmcSk5EQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpix8EACerYNC/5U1MjZvJ9sFtH3i4WtGIx3AOpxk
 UZyzvrmZh8+LIT2Xfvs50/SfC4LAOLuJBWr5bjkJxtNWFc02R3n/1spOIV7PV5xc
 FL2mBfnViW9OxCiOOdG7hRNvhCGZ9Rb5HIo1c8OoXslXCEPFDLMNJ/PTrzm1mjHz
 VbxLfNOXPCHprRwi70UK4mdAE6VJkMXRgh5ysjDtL3Ux4mA0fQ4x/hifGIBTbJri
 BPVFQlRmWHuo9DKuimn3h6asYlygD15CJS/XIfXWyans6E/3vgVy918XlvH/4kMT
 zN0nl2HQgaEl+4b31pxzrELWkYgMo1MM3ENWiqfClDk5k0YCf1MH5DzrMAhrg6I/
 GFQF1XPOYMld/vwsM1xE+75/xKkKCOrV2EZfBfPTb11v6zePEl1F6dHST7sZ5hd2
 iNSuohL2MdAODlG+itqNZpuNUgc6gqdNOCUFwli+XgBzkaiZScS5lkssq1EKhoVi
 1MjkIsQNx9eXfVLa/aiDZveu3YJNeLD2XVwqjtIXSxgaCZBNa4oa4rLvOCr+xnst
 wM0kI7EBIDQMzaupfs0hQ07iatkw/n2ILRjrs8bM2K0hSxMEuAlj+cJkWbVI7nCR
 /VeHeloS6f8OwSvRF1S1zHGNmA9UR7m2nbL5HfuurrMITUg4L4sNXexnfeYEKpA9
 yaCaw41USA==
 =gi8g
 -----END PGP SIGNATURE-----

Merge tag 'io_uring-6.12-20241018' of git://git.kernel.dk/linux

Pull io_uring fixes from Jens Axboe:

 - Fix a regression this merge window where cloning of registered
   buffers didn't take into account the dummy_ubuf

 - Fix a race with reading how many SQRING entries are available,
   causing userspace to need to loop around io_uring_sqring_wait()
   rather than being able to rely on SQEs being available when it
   returned

 - Ensure that the SQPOLL thread is TASK_RUNNING before running
   task_work off the cancelation exit path

* tag 'io_uring-6.12-20241018' of git://git.kernel.dk/linux:
  io_uring/sqpoll: ensure task state is TASK_RUNNING when running task_work
  io_uring/rsrc: ignore dummy_ubuf for buffer cloning
  io_uring/sqpoll: close race on waiting for sqring entries
2024-10-18 15:38:37 -07:00
John Edwards
22a18935d7 Input: xpad - add support for MSI Claw A1M
Add MSI Claw A1M controller to xpad_device match table when in xinput mode.
Add MSI VID as XPAD_XBOX360_VENDOR.

Signed-off-by: John Edwards <uejji@uejji.net>
Reviewed-by: Derek J. Clark <derekjohn.clark@gmail.com>
Reviewed-by: Christopher Snowhill <kode54@gmail.com>
Link: https://lore.kernel.org/r/20241010232020.3292284-4-uejji@uejji.net
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2024-10-18 14:34:57 -07:00
Fan Wu
917a15c37d MAINTAINERS: update IPE tree url and Fan Wu's email
Update Integrity Policy Enforcement (IPE) LSM tree url and
maintainer's email to the newly issued kernel.org tree/email.

Signed-off-by: Fan Wu <wufan@kernel.org>
2024-10-18 12:15:37 -07:00
Luca Boccassi
f40998a8e6 ipe: fallback to platform keyring also if key in trusted keyring is rejected
If enabled, we fallback to the platform keyring if the trusted keyring
doesn't have the key used to sign the ipe policy. But if pkcs7_verify()
rejects the key for other reasons, such as usage restrictions, we do not
fallback. Do so, following the same change in dm-verity.

Signed-off-by: Luca Boccassi <bluca@debian.org>
Suggested-by: Serge Hallyn <serge@hallyn.com>
[FW: fixed some line length issues and a typo in the commit message]
Signed-off-by: Fan Wu <wufan@kernel.org>
2024-10-18 12:14:53 -07:00
Linus Torvalds
b04ae0f451 two fixes for stable, and two small cleanup fixes
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmcSdmYACgkQiiy9cAdy
 T1EnnAwAoNbY+odLB9atHIuaBftpyINrhzRrzpwTfYNtPKUPGxxGk2fiP29YqMLb
 OF4jnC87E3P/xhydoZHXXe3kKBQFVMAkJZKHiZBvJd+brk/EadfQnNmIio1pwOGh
 zFNxSujFtsM/1HU/ZoI2kaHzrqj5KxWKWFytZ6umd8C3NyKK9Lo/lcqUBKv8MpJy
 XXkMBh+7HGKRfDQlU+n6NQ5+dqFL5xDjTXlm9dM8LXuInKy5oKTGnRhLA7OA8lt7
 EenFo8joy0IpXUByHt+ksQ8P88NCnU2h9kGp1UrGrBPh90+MokRr9GAcH8twK8jt
 /bpL4yzAwuk1TAg+L9mSLT2OtWYsDpsQZmsBMbxBZGr2qmtjwgbxSgjf6DNiJZgn
 jz15nFsuEsU5AbX4EAE67fwRWAo9AmQFyOOcYgkiIWOFHaRU6D/2NzCxCDZ+mfpy
 Z5f7dF/sA158iY4wmB5BrQpFamxzpLADz6Qy4NA9hXjEKsbyFAuf22EjE64ruxZ4
 8nMB3buh
 =peum
 -----END PGP SIGNATURE-----

Merge tag 'v6.12-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6

Pull smb client fixes from Steve French:

 - Fix possible double free setting xattrs

 - Fix slab out of bounds with large ioctl payload

 - Remove three unused functions, and an unused variable that could be
   confusing

* tag 'v6.12-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  cifs: Remove unused functions
  smb/client: Fix logically dead code
  smb: client: fix OOBs when building SMB2_IOCTL request
  smb: client: fix possible double free in smb2_set_ea()
2024-10-18 11:37:12 -07:00
Linus Torvalds
568570fdf2 XFS Bug fixes for 6.12-rc4
* Fix integer overflow in xrep_bmap
 * Fix stale dealloc punching for COW IO
 
 Signed-off-by: Carlos Maiolino <cem@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iJUEABMJAB0WIQQMHYkcUKcy4GgPe2RGdaER5QtfpgUCZw5LIwAKCRBGdaER5Qtf
 puRlAYDezbvs1dDSkKIGOt3inGdLptNAu4qniXBUkbYI9BzmtIVDueWP4Wo0dV3d
 gu3xrWQBfjFXdmEuBlwLuAFrp07AN18BVMj+DWCiEShsPHSoSPcF/IrDiz4BHvGv
 MKYq9CywFw==
 =Gj9b
 -----END PGP SIGNATURE-----

Merge tag 'xfs-6.12-fixes-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux

Pull xfs fixes from Carlos Maiolino:

 - Fix integer overflow in xrep_bmap

 - Fix stale dealloc punching for COW IO

* tag 'xfs-6.12-fixes-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
  xfs: punch delalloc extents from the COW fork for COW writes
  xfs: set IOMAP_F_SHARED for all COW fork allocations
  xfs: share more code in xfs_buffered_write_iomap_begin
  xfs: support the COW fork in xfs_bmap_punch_delalloc_range
  xfs: IOMAP_ZERO and IOMAP_UNSHARE already hold invalidate_lock
  xfs: take XFS_MMAPLOCK_EXCL xfs_file_write_zero_eof
  xfs: factor out a xfs_file_write_zero_eof helper
  iomap: move locking out of iomap_write_delalloc_release
  iomap: remove iomap_file_buffered_write_punch_delalloc
  iomap: factor out a iomap_last_written_block helper
  xfs: fix integer overflow in xrep_bmap
2024-10-18 11:28:39 -07:00
Linus Torvalds
5e9ab267be Power management updates for 6.12-rc4
- Enable ACPI CPPC in amd_pstate_register_driver() after disabling it
    in amd_pstate_unregister_driver() when switching driver operation
    modes (Dhananjay Ugwekar).
 
  - Make amd-pstate use nominal performance as the maximum performance
    level when boost is disabled (Mario Limonciello).
 
  - Add ArrowLake-H to the list of processors where PL4 is supported
    in the MSR part of the intel_rapl power capping driver (Srinivas
    Pandruvada).
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCAAwFiEE4fcc61cGeeHD/fCwgsRv/nhiVHEFAmcSi7kSHHJqd0Byand5
 c29ja2kubmV0AAoJEILEb/54YlRxODYP/08cpRT/dgzXP1xVdouCd4CXrbCUzVDm
 QP2P+oNLvPkBo7Jc3S+jTbSAsmSidYUqNbYvEGMggsm9zhStW21n1Olz2z+P4k2c
 pzzU70Vmu42MxHJkbM+aMaluu/O9C3S3LGJAYWo3vPFSatRRUN6U/h9SWjwOslKd
 0uj9DhyTb0iL7kdrYsa974M9ZTL5xszYpoSsdIZWMUq2LqGqsrVNeK+o7zETw86i
 gSVv7l96Y3O3nXNTgG362ACNMOaCz7zL1hgQ3Kjp/6Y+SeK2JEMESDinJeCQDRAg
 CCaRJEpcRDKesBUADT+McRuWGt8KVtNObIk+IJeJzrQIZCztTOaLF7/ePjd2IkT7
 jkIwoc1Zw5LnPADUhn4+6w+gNmF/U9K2Mp5g3Y01OudEN1WDAWu+p+jr2PTD1w3A
 MUPC6Eo1BFeN0HZf//H52TI8fuZwCohQpbuCV2p814KnOKKWm6nZPi2OKPgC/I+r
 ljVp/8TB06KwZdmIcgmgqBX6jbghgMpKy6w1LCLrXPN/DWgeUWDBzO+NqpKZVFAP
 T8Di0RVv+QZJoIrilpKK2SnI1Rwfv6TOCB+lKPmsRxm+/OYgIhVsQFl+7fWI46DN
 a6+4v3yMZcc0Y1C18PKPxGpzcif6SOkJ6fChjZ7ddf4qsijaurS/kmDIkTPcOdXj
 SymbawvS/1dT
 =a0Z8
 -----END PGP SIGNATURE-----

Merge tag 'pm-6.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull power management fixes from Rafael Wysocki:
 "These fix two issues in the amd-pstate cpufreq driver and update the
  intel_rapl power capping driver with a new processor ID.

  Specifics:

   - Enable ACPI CPPC in amd_pstate_register_driver() after disabling it
     in amd_pstate_unregister_driver() when switching driver operation
     modes (Dhananjay Ugwekar)

   - Make amd-pstate use nominal performance as the maximum performance
     level when boost is disabled (Mario Limonciello)

   - Add ArrowLake-H to the list of processors where PL4 is supported in
     the MSR part of the intel_rapl power capping driver (Srinivas
     Pandruvada)"

* tag 'pm-6.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  powercap: intel_rapl_msr: Add PL4 support for ArrowLake-H
  cpufreq/amd-pstate: Use nominal perf for limits when boost is disabled
  cpufreq/amd-pstate: Fix amd_pstate mode switch on shared memory systems
2024-10-18 11:16:01 -07:00
Linus Torvalds
3b3a0ef6ae hwmon fixes for v6.12-rc4
Fix auto-detect regression in jc42 driver.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEiHPvMQj9QTOCiqgVyx8mb86fmYEFAmcSeQkACgkQyx8mb86f
 mYE2ghAAkdLehxmIDIvz5Nvw89w4VzJY1kA8Xt/IPLDEK1B3IVM2lLPYRe8jxbvU
 X4Hz7huuclolN+gff53fttEm0VTecRY8Qq9uwiyx6DVpJC2HZ9nWAiSJgmF/u3hp
 vou+lemy1HYsOdCHyNlYrBvJtv1gyeNZTSd5bMGuUx3CTeY9qbK/BoCU7j+wtaLC
 f2k6sTvS73J5DmbCbLBH8e9XULmeAtjJUw7QRJQPUulA9DPZdJrzKMPc+I8WNdhN
 rFfYvezUYf5uBkFN5veBU4xJylIXcMLLvO8fQnJl09phlg46ZPMHmLrVcdQ0Vz77
 2h+hyQetgrjMklgQN7TOKV23Ktaw09dcax9EN0VoHJKBl3/+CcTdf1MD7fhZkUP6
 dQTIfnMA7hsuI5uWc9z0e28d2azmfNslYy9pptAorS9aM6AJ1pRmV+gBcMwKpwT0
 EFtjsz/WgpadC9/sIbOMQz8FEAKY2lMwF23gKKXtWUhXfy1i/Rl5GZljtEOCrrKY
 pPjRdQUfmO/OG5CME1v/kFufN0q0pALiEkSZTZtqz8NBzxphYFk6b62oKztp8Juh
 C1lprXYJE7lDczj15O47+5qo4EyxZ/tiLS8jeeKGbh3B+EUeqxxjNxRGKIcExh6p
 X8T+BW2Yi7gumlXtIi9f2uPjZnnZi3wu+N+0fSjLxVcmhWTNe5Q=
 =1ykc
 -----END PGP SIGNATURE-----

Merge tag 'hwmon-for-v6.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull hwmon fix from Guenter Roeck:
 "Fix auto-detect regression in jc42 driver"

* tag 'hwmon-for-v6.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  [PATCH} hwmon: (jc42) Properly detect TSE2004-compliant devices again
2024-10-18 11:13:53 -07:00
Linus Torvalds
5d97dde4d5 drm fixes for 6.12-rc4
msm:
 - Display:
 - move CRTC resource assignment to atomic_check otherwise to make
   consecutive calls to atomic_check() consistent
 - fix rounding / sign-extension issues with pclk calculation in
   case of DSC
 - cleanups to drop incorrect null checks in dpu snapshots
 - fix to use kvzalloc in dpu snapshot to avoid allocation issues
   in heavily loaded system cases
 - Fix to not program merge_3d block if dual LM is not being used
 - Fix to not flush merge_3d block if its not enabled otherwise
   this leads to false timeouts
 - GPU:
 - a7xx: add a fence wait before SMMU table update
 
 xe:
 - New workaround to Xe2 (Aradhya)
 - Fix unbalanced rpm put (Matthew Auld)
 - Remove fragile lock optimization (Matthew Brost)
 - Fix job release, delegating it to the drm scheduler (Matthew Brost)
 - Fix timestamp bit width for Xe2 (Lucas)
 - Fix external BO's dma-resv usag (Matthew Brost)
 - Fix returning success for timeout in wait_token (Nirmoy)
 - Initialize fence to avoid it being detected as signaled (Matthew Auld)
 - Improve cache flush for BMG (Matthew Auld)
 - Don't allow hflip for tile4 framebuffer on Xe2 (Juha-Pekka)
 
 amdgpu:
 - SR-IOV fix
 - CS chunk handling fix
 - MES fixes
 - SMU13 fixes
 
 amdkfd:
 - VRAM usage reporting fix
 
 radeon:
 - Fix possible_clones handling
 
 i915:
 - Two DP bandwidth related MST fixes
 
 ast:
 - Clear EDID on unplugged connectors
 
 host1x:
 - Fix boot on Tegra186
 - Set DMA parameters
 
 mgag200:
 - Revert VBLANK support
 
 panel:
 - himax-hx83192: Adjust power and gamma
 
 qaic:
 - Sgtable loop fixes
 
 vmwgfx:
 - Limit display layout allocatino size
 - Handle allocation errors in connector checks
 - Clean up KMS code for 2d-only setup
 - Report surface-check errors correctly
 - Remove NULL test around kvfree()
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmcR9xwACgkQDHTzWXnE
 hr5auQ/7B5TSpaPdG48RY27Hhze2AeEGdxArW0fCl5IL+qUhe7s6MRrDRv5ZqAyW
 r6tfXjHAnhnVdjEHPMZi8dVLQ/Ge+pBh1g3vnBR/Ugj0/PbrnnLdk4NrnDc9FOok
 N0v3SfAI+9wqBc/US7+jXxn0RnkrC2HvQgUPiSmgEl8QFizbyQw+BLl3vmz6hEKv
 xuKtnI8Kc7CyxVvHEHcsd/KRYZW+0srBbpfeNnIYFPr2XiXToc/jwlT08j4kRx5g
 Hpa6RJfuR3QQ9haxZQPBG3LnV71nL4USwAVX22MHPGqb9XAKGFl/oMffDsouLjHy
 jlqrx4vrp/gfu/AcGC9l2XLCZ0yg6dBs1Od9nrwQEioJupGpRqm+dj81Mjd2MaeE
 44fMWa7HF7FZ4u27sb4+9oDjouBf2j6hoMfsHLWazbLa+nXVnExcSj6zCY0osfFN
 8+Ur+8Hzmj9b/Ugej0D4gVArzeb5WgRApc98PYAD+KFWt5HyGZmZTHjzPGyr6XuU
 NRdg1ziQJs1NRwUGbTN7+oAZLKi5lvtrquKKLVKr0MfKpxeb8rUX83Hdk8IYFY/l
 ULLMov+kBq9OCwntrTw3MyviNmUFmy0w1N8ArlvPmu3XmdY/IHQfMx8w7p3lV/0f
 txKiOgh5tLLD2Dxxjgla0J3XJsVjz7cnBvCKP+PR2kp2oWq/cMo=
 =MOo3
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2024-10-18' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Weekly fixes, msm and xe are the two main ones, with a bunch of
  scattered fixes including a largish revert in mgag200, then amdgpu,
  vmwgfx and scattering of other minor ones.

  All seems pretty regular.

  msm:
   - Display:
      - move CRTC resource assignment to atomic_check otherwise to make
        consecutive calls to atomic_check() consistent
      - fix rounding / sign-extension issues with pclk calculation in
        case of DSC
      - cleanups to drop incorrect null checks in dpu snapshots
      - fix to use kvzalloc in dpu snapshot to avoid allocation issues
        in heavily loaded system cases
      - Fix to not program merge_3d block if dual LM is not being used
      - Fix to not flush merge_3d block if its not enabled otherwise
        this leads to false timeouts
   - GPU:
      - a7xx: add a fence wait before SMMU table update

  xe:
   - New workaround to Xe2 (Aradhya)
   - Fix unbalanced rpm put (Matthew Auld)
   - Remove fragile lock optimization (Matthew Brost)
   - Fix job release, delegating it to the drm scheduler (Matthew Brost)
   - Fix timestamp bit width for Xe2 (Lucas)
   - Fix external BO's dma-resv usag (Matthew Brost)
   - Fix returning success for timeout in wait_token (Nirmoy)
   - Initialize fence to avoid it being detected as signaled (Matthew
     Auld)
   - Improve cache flush for BMG (Matthew Auld)
   - Don't allow hflip for tile4 framebuffer on Xe2 (Juha-Pekka)

  amdgpu:
   - SR-IOV fix
   - CS chunk handling fix
   - MES fixes
   - SMU13 fixes

  amdkfd:
   - VRAM usage reporting fix

  radeon:
   - Fix possible_clones handling

  i915:
   - Two DP bandwidth related MST fixes

  ast:
   - Clear EDID on unplugged connectors

  host1x:
   - Fix boot on Tegra186
   - Set DMA parameters

  mgag200:
   - Revert VBLANK support

  panel:
   - himax-hx83192: Adjust power and gamma

  qaic:
   - Sgtable loop fixes

  vmwgfx:
   - Limit display layout allocatino size
   - Handle allocation errors in connector checks
   - Clean up KMS code for 2d-only setup
   - Report surface-check errors correctly
   - Remove NULL test around kvfree()"

* tag 'drm-fixes-2024-10-18' of https://gitlab.freedesktop.org/drm/kernel: (45 commits)
  drm/ast: vga: Clear EDID if no display is connected
  drm/ast: sil164: Clear EDID if no display is connected
  Revert "drm/mgag200: Add vblank support"
  drm/amdgpu/swsmu: default to fullscreen 3D profile for dGPUs
  drm/i915/display: Don't allow tile4 framebuffer to do hflip on display20 or greater
  drm/xe/bmg: improve cache flushing behaviour
  drm/xe/xe_sync: initialise ufence.signalled
  drm/xe/ufence: ufence can be signaled right after wait_woken
  drm/xe: Use bookkeep slots for external BO's in exec IOCTL
  drm/xe/query: Increase timestamp width
  drm/xe: Don't free job in TDR
  drm/xe: Take job list lock in xe_sched_add_pending_job
  drm/xe: fix unbalanced rpm put() with declare_wedged()
  drm/xe: fix unbalanced rpm put() with fence_fini()
  drm/xe/xe2lpg: Extend Wa_15016589081 for xe2lpg
  drm/i915/dp_mst: Don't require DSC hblank quirk for a non-DSC compatible mode
  drm/i915/dp_mst: Handle error during DSC BW overhead/slice calculation
  drm/msm/a6xx+: Insert a fence wait before SMMU table update
  drm/msm/dpu: don't always program merge_3d block
  drm/msm/dpu: Don't always set merge_3d pending flush
  ...
2024-10-18 11:03:21 -07:00
Linus Torvalds
b1b4675167 mm: fix follow_pfnmap API lockdep assert
The lockdep asserts for the new follow_pfnmap() API "knows" that a
pfnmap always has a vma->vm_file, since that's the only way to create
such a mapping.

And that's actually true for all the normal cases.  But not for the mmap
failure case, where the incomplete mapping is torn down and we have
cleared vma->vm_file because the failure occured before the file was
linked to the vma.

So this codepath does actually need to check for vm_file being NULL.

Reported-by: Jann Horn <jannh@google.com>
Fixes: 6da8e9634b ("mm: new follow_pfnmap API")
Cc: Peter Xu <peterx@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2024-10-18 09:50:05 -07:00
Rafael J. Wysocki
cf8679bb77 Merge branch 'pm-cpufreq'
Merge amd-pstate driver fixes for 6.12-rc4:

 - Enable ACPI CPPC in amd_pstate_register_driver() after disabling
   it in amd_pstate_unregister_driver() during driver operation mode
   switch (Dhananjay Ugwekar).

 - Make amd-pstate use nominal performance as the maximum performance
   level when boost is disabled (Mario Limonciello).

* pm-cpufreq:
  cpufreq/amd-pstate: Use nominal perf for limits when boost is disabled
  cpufreq/amd-pstate: Fix amd_pstate mode switch on shared memory systems
2024-10-18 18:22:43 +02:00
Linus Torvalds
75aa74d52f IOMMU Fixes for Linux v6.12-rc3
Including:
 
 	- ARM-SMMU fixes from Will Deacon:
 	  - Clarify warning message when failing to disable the MMU-500
 	    prefetcher
 	  - Fix undefined behaviour in calculation of L1 stream-table index
 	    when 32-bit StreamIDs are implemented
 	  - Replace a rogue comma with a semicolon
 
 	- Intel VT-d fix from Lu Baolu:
 	  - Fix incorrect pci_for_each_dma_alias() for non-PCI devices
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEr9jSbILcajRFYWYyK/BELZcBGuMFAmcSIjEACgkQK/BELZcB
 GuPeJg/5AT4AuqnEG9NMecJAN4zvVd+2OO144XrqWsIMELqIzpYgLwkjoo8+dDE9
 EerRRs+HLddF1oV1WiC0UOyvIOdq4sIlAsdjLFQVd39qjmNQI5KM+ELCAlKuUkMj
 GFrk64PvXuWG6AeP+iAiVLnOmbkl6JAQAQ7qg7p9JxmSRUlUhMZywLUBi7CjR/FN
 uhgPsVzFfS13iQ4FXw5z6R+mG728chvc3DImGjmRlv0gIHdKif1MCZBp4zLo75Y5
 vTdP6Cf1uzIkTpr+OwtbE2u/zsXzS3oi9WJieHBbGs5VPtys/Uvl5wEdsNyBsLVv
 fUbNNhHaFinFoRGrctWDtsQ1CqdqIfQz7o9ob93lAVfQYSvN87qqmibvHUZllWhE
 WyxUvjerpvKOcKtVGHmIEbDSydAlVCXhoRG3uJ9c4KUucluVFnwy3IGSV52xIvl9
 WpEP95o0VUu+szkrsL0ACRMXjs4PXJQCX+LNBt8+Qkwf9K9ILk4NdoJ0MTxGTTPa
 b/ZJ4/6jxizBK4FGW1keZ0JodPu2Do1knYZ7gEwsb3UoBklAgtfM2EPzgjqzAodG
 9146w0XPJKED9k7m8fQuX67ZhihXs41RgUD1XqkrAhV9VifWBPfaS0pIXSC1l0ev
 OnvdQ/+5pt5pzSG7ErT2zpUBTBS8Vyruis68gIrKJJECnhMh3gM=
 =YT8V
 -----END PGP SIGNATURE-----

Merge tag 'iommu-fixes-v6.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux

Pull iommu fixes from Joerg Roedel:
 "ARM-SMMU fixes from Will Deacon:

   - Clarify warning message when failing to disable the MMU-500
     prefetcher

   - Fix undefined behaviour in calculation of L1 stream-table index
     when 32-bit StreamIDs are implemented

   - Replace a rogue comma with a semicolon

  Intel VT-d fix from Lu Baolu:

   - Fix incorrect pci_for_each_dma_alias() for non-PCI devices"

* tag 'iommu-fixes-v6.12-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:
  iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI devices
  iommu/arm-smmu-v3: Convert comma to semicolon
  iommu/arm-smmu-v3: Fix last_sid_idx calculation for sid_bits==32
  iommu/arm-smmu: Clarify MMU-500 CPRE workaround
2024-10-18 07:13:24 -07:00
Linus Torvalds
ef444a0aba powerpc fixes for 6.12 #5
- To prevent possible memory leak, free "name" on error in opal_event_init()
 
 Thanks to: Michael Ellerman, 2639161967.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEqX2DNAOgU8sBX3pRpnEsdPSHZJQFAmcR+7QACgkQpnEsdPSH
 ZJQxjhAAgxgANS4GJ3i5kB0a6T7kOBynafDNmTsj1iEI9f9IgclH6zzUkmzdjWJ3
 FHXavhqvI/xIvzDSyVV68De/lSgNwjEr13Igq/DlpnQuNDavdJytQRZVCOTXFyon
 bI7gNdA367vR44sQtDWYnIeCqWKLA535G9ahFicXBMNfAIzT2hhW4h2zu3K7dcu/
 jq/nY6iuI2TWtH1givntR3fHdfqKYXLd/eIt/J+7hXA4UrJHYDPmH3+hjz8gRG1p
 dI7bP5sf0OPjlUgtrJ+P/QeYzrVABECqcONcMQuqyZjtmbt/8dSw2JLgzPrhP8Cc
 jIJTlbwTawPUJuIifMZpLFnbSgkHadrCNfpWmk1m9NHB0RCjI9DOqgETaIxR+Dkz
 utmoOXWFCCZF59/8vVF94Pi9dG7HrZBBvvWnGNh4BFocMPnNb62ZHBdmWAbG/G2m
 XajtUXrpNDqXLxOJLYA6NQxh8hE109tnU35/X87gKcRI6BiF56ytN8bAdTdW7qan
 5C1r0RrXtmySkb5siFVzsfvEl9sI3BslkDV4V9BEby4XYyqqYjwKh+oaeYcnGkdG
 hY1k9Xbw7racsnUzqjbb1Z86NwK23FQ/MWNmi/nrSB6w2/pobE1WVMta7vej0VqV
 +NpvZBUSIsGM0YiySzar8xZGaA09KjRP2283VdkK3Uwh0K6g/jo=
 =6YWt
 -----END PGP SIGNATURE-----

Merge tag 'powerpc-6.12-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux

Pull powerpc fix from Madhavan Srinivasan:

 - To prevent possible memory leak, free "name" on error in
   opal_event_init()

Thanks to Michael Ellerman and 2639161967.

* tag 'powerpc-6.12-5' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
  powerpc/powernv: Free name on error in opal_event_init()
2024-10-18 07:07:13 -07:00
Linus Torvalds
c91c14618f s390 fixes for 6.12-rc4
- Fix PCI error recovery by handling error events correctly
 
 - Fix CCA crypto card behavior within protected execution environment
 
 - Two KVM commits which fix virtual vs physical address handling bugs
   in KVM pfault handling
 
 - Fix return code handling in pckmo_key2protkey()
 
 - Deactivate sclp console as late as possible so that outstanding
   messages appear on the console instead of being dropped on reboot
 
 - Convert newlines to CRLF instead of LFCR for the sclp vt220 driver,
   as required by the vt220 specification
 
 - Initialize also psw mask in perf_arch_fetch_caller_regs() to make
   sure that user_mode(regs) will return false
 
 - Update defconfigs
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEECMNfWEw3SLnmiLkZIg7DeRspbsIFAmcSND8ACgkQIg7DeRsp
 bsK4YA//St56dSqntwp8Lc/t6fcMvUU4kN7DFdLdn2weuNF/WqgraB0eBJuQSjvP
 L8gJutE/clV3+bWvU5OG978snXLS6i1PDRGU4Jaox0HiDonRuYodOMI9q57FDebD
 fVh3iLJNwgW507PXxjSdkdMNpwptzylYBKTykJcaU55MiWnNYZa/Yj+5UxzT5U8C
 UYgX4RWUjNdLq9A9nMpfcsRGKa0YF+DNk7egPLaxmbI1JJu1i+rt6esAf2peOU3f
 dEzL0fTb6j6l0N+Bz6Wx3WEwn3cRdDBkRDKF+IkMtPJ30lIJ6ULh3nRVhFBuDU2m
 KmLpRMg1dkHil89r5JV9SAfrZfXCz4//9ssP5otsltSPVrV6E230LXuYwD0o1q8H
 XQQ5Zag9dodY10VQp1VUzMvz5uehDM16tapzu8sUgItQ9PnmST/7XnFSe6/jotlZ
 A6ALDEMmBG/F/s3N3x6cSoBJdCjJWKJQS5ft04s7AZ2rlmefdLSoqbgGVJcZXTaP
 eiPhhRoKI+dT/4dc10I0923NXpKHE6a2ID6GhhJ+f0wjrNarlGnwQVqPeC68dUdv
 8ayD70K4BSRIAhkbEIqhKiueAAMgmW0LYKBqkbs9AgdoordbqNO9QtxEOlvI7+/g
 A4sffCRrjbESE8sZoA8ItnX1Cf9yiP8KzzkNzMpGiI/zC8tPq8c=
 =3IRa
 -----END PGP SIGNATURE-----

Merge tag 's390-6.12-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

Pull s390 fixes from Heiko Carstens:

 - Fix PCI error recovery by handling error events correctly

 - Fix CCA crypto card behavior within protected execution environment

 - Two KVM commits which fix virtual vs physical address handling bugs
   in KVM pfault handling

 - Fix return code handling in pckmo_key2protkey()

 - Deactivate sclp console as late as possible so that outstanding
   messages appear on the console instead of being dropped on reboot

 - Convert newlines to CRLF instead of LFCR for the sclp vt220 driver,
   as required by the vt220 specification

 - Initialize also psw mask in perf_arch_fetch_caller_regs() to make
   sure that user_mode(regs) will return false

 - Update defconfigs

* tag 's390-6.12-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390: Update defconfigs
  s390: Initialize psw mask in perf_arch_fetch_caller_regs()
  s390/sclp_vt220: Convert newlines to CRLF instead of LFCR
  s390/sclp: Deactivate sclp after all its users
  s390/pkey_pckmo: Return with success for valid protected key types
  KVM: s390: Change virtual to physical address access in diag 0x258 handler
  KVM: s390: gaccess: Check if guest address is in memslot
  s390/ap: Fix CCA crypto card behavior within protected execution environment
  s390/pci: Handle PCI error codes other than 0x3a
2024-10-18 07:01:59 -07:00
Dave Airlie
83f0007848 Driver Changes:
- New workaround to Xe2 (Aradhya)
 - Fix unbalanced rpm put (Matthew Auld)
 - Remove fragile lock optimization (Matthew Brost)
 - Fix job release, delegating it to the drm scheduler (Matthew Brost)
 - Fix timestamp bit width for Xe2 (Lucas)
 - Fix external BO's dma-resv usag (Matthew Brost)
 - Fix returning success for timeout in wait_token (Nirmoy)
 - Initialize fence to avoid it being detected as signaled (Matthew Auld)
 - Improve cache flush for BMG (Matthew Auld)
 - Don't allow hflip for tile4 framebuffer on Xe2 (Juha-Pekka)
 -----BEGIN PGP SIGNATURE-----
 
 iQJNBAABCAA3FiEE6rM8lpABPHM5FqyDm6KlpjDL6lMFAmcR1fQZHGx1Y2FzLmRl
 bWFyY2hpQGludGVsLmNvbQAKCRCboqWmMMvqUzaaEACgE9KemgkMawJkpuk85O7M
 oKCCgDTKnJwv431dOaL17DBiruR9hcacir7t18NV8yxIMHw80fiK4tdG86B+fPqe
 KEXMiRQl8N9Uobn4KkhPMXx/W1+5n5om7mCrRRKRBHqqe0PUd54t3ICWTtzBq8Za
 Bkp5GuznuaSXEvt84O6tgkoatcQ9iR6thXRFoLhGICn+lJz0bXrN925fmFC6t7Rj
 Z4GUQDMLtCPEeiWpenqThTy04J73dAKhPQIC70GN6MkJMxcc9l+fSHUtYaZ2hIx3
 dF45CjnBzehVh2dSt3ZcoVeRL27Qpt2BvnvhJJoJ+XEiQmBx3wuhNTQZqQpevCL3
 sONKH8Iq4h27jbuQC7so0JS99CHdPxjQxLBNskVhcTbzODS5aParS0z8RdQOdn7H
 8AjZoS9Tk59z4DSVLA6J5Tqp4jQAjAH28X4AltuVcJDtxcfvgmKbQ4KKUWR06gWy
 /NP/x3BvaGx7gE7gX1H4K/jDaERytVVkAec7CR+JlB8dtzdNv81dL5eynVOkGMEf
 PTlDJX4/wRn4lavCXLlsLw/5Q+AGVfJUacSDlMyBdSbmhFvAGf7eKUesFBhXV4FF
 MztBQMEgtd+4kWnrooOWoG0DY9JXUgJ71+WZl6iR5oZVWepBCDGk+jgBPVQD6vy3
 /xNNjgMC59vzVPNvb2kPkQ==
 =vnSz
 -----END PGP SIGNATURE-----

Merge tag 'drm-xe-fixes-2024-10-17' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes

Driver Changes:
- New workaround to Xe2 (Aradhya)
- Fix unbalanced rpm put (Matthew Auld)
- Remove fragile lock optimization (Matthew Brost)
- Fix job release, delegating it to the drm scheduler (Matthew Brost)
- Fix timestamp bit width for Xe2 (Lucas)
- Fix external BO's dma-resv usag (Matthew Brost)
- Fix returning success for timeout in wait_token (Nirmoy)
- Initialize fence to avoid it being detected as signaled (Matthew Auld)
- Improve cache flush for BMG (Matthew Auld)
- Don't allow hflip for tile4 framebuffer on Xe2 (Juha-Pekka)

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Lucas De Marchi <lucas.demarchi@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/jkldrex5733ldxrla75b4ayvhujjhw2kccmasl5rotoufoacj4@pkvlrrv4orc7
2024-10-18 13:53:41 +10:00
Linus Torvalds
ade8ff3b6a - AMD Zen CPUs before gen 4 do not flush the RAS (Return Address Stack)
as part of IBPB. Make sure that happens by doing the flushing in
   software on those generations
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmcI+6UACgkQEsHwGGHe
 VUrYVw/+JmJHckfzI1jqc+FIGkG124X5l5ml3nUwExyL5anZk3KY6QEhvEjk8xgt
 5pLYaHd76W21DWsP5AOXwsLAOBptsN8E7zwmG4Wg4H9EOkcQYDujlm0a8ne+zmqk
 NQh/y7NzACruYJoDzo0S89Gcz2IUZ3C5HTKp9GUor4cUOw1wZsEm5RHAkl+SlK9j
 amGq4ABO6xE6UjnrZMDW1uo253nCTZjH9DZvwzzLXULaAQjTvn6lowSPCJWZezNh
 ue2Tdl/GYo6qbHyd7OYK4N4IxWNJujHLlcIXJ/mU3EPVKBh98f3SZakvoXMuWkBL
 KS5xxHf86Un+8UM59ZYIK8263O8CmlgmOosk+wPV2DZfnomG/dxoYvaZ7x41X2I+
 xdGMiHBP3SaQmqIxdvVCbtBIoLLd5MQ/JtAcDuLM4pbXBgLTxSfF7fDb4OtpuCwe
 QybeQ33QNCAn63DT+3bbWKxQpzC9vpu2+t48XV9a/rgQpsnMBodFP6RSxXxBsH4I
 zRDMoeyfn1mTiGRbbuhwNq52M01L1G8bkJ5sX0m/PB5XGhkg46998i93W8yAKKHY
 5sF1sP53idK94CNcA0fs/Z8ZoKmkszoh8GDAn3Pb+eP+m9f7EDL9AVanBzerJhfJ
 i69EfM9r0ESIkmmmjaycn2EVzwQ5Vtv1r/LgDI4up2bQzbPS6So=
 =ovJa
 -----END PGP SIGNATURE-----

Merge tag 'x86_bugs_post_ibpb' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 IBPB fixes from Borislav Petkov:
 "This fixes the IBPB implementation of older AMDs (< gen4) that do not
  flush the RSB (Return Address Stack) so you can still do some leaking
  when using a "=ibpb" mitigation for Retbleed or SRSO. Fix it by doing
  the flushing in software on those generations.

  IBPB is not the default setting so this is not likely to affect
  anybody in practice"

* tag 'x86_bugs_post_ibpb' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/bugs: Do not use UNTRAIN_RET with IBPB on entry
  x86/bugs: Skip RSB fill at VMEXIT
  x86/entry: Have entry_ibpb() invalidate return predictions
  x86/cpufeatures: Add a IBPB_NO_RET BUG flag
  x86/cpufeatures: Define X86_FEATURE_AMD_IBPB_RET
2024-10-17 19:12:38 -07:00
Josh Poimboeuf
b0bf1afde7 cdrom: Avoid barrier_nospec() in cdrom_ioctl_media_changed()
The barrier_nospec() after the array bounds check is overkill and
painfully slow for arches which implement it.

Furthermore, most arches don't implement it, so they remain exposed to
Spectre v1 (which can affect pretty much any CPU with branch
prediction).

Instead, clamp the user pointer to a valid range so it's guaranteed to
be a valid array index even when the bounds check mispredicts.

Fixes: 8270cb10c0 ("cdrom: Fix spectre-v1 gadget")
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
Link: https://lore.kernel.org/r/1d86f4d9d8fba68e5ca64cdeac2451b95a8bf872.1729202937.git.jpoimboe@kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2024-10-17 19:47:15 -06:00
Linus Torvalds
4d939780b7 28 hotfixes. 13 are cc:stable. 23 are MM.
It is the usual shower of unrelated singletons - please see the individual
 changelogs for details.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCZxGY5wAKCRDdBJ7gKXxA
 js6RAQC16zQ7WRV091i79cEi1C5648NbZjMCU626hZjuyfbzKgEA2v8PYtjj9w2e
 UGLxMY+PYZki2XNEh75Sikdkiyl9Vgg=
 =xcWT
 -----END PGP SIGNATURE-----

Merge tag 'mm-hotfixes-stable-2024-10-17-16-08' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull misc fixes from Andrew Morton:
 "28 hotfixes. 13 are cc:stable. 23 are MM.

  It is the usual shower of unrelated singletons - please see the
  individual changelogs for details"

* tag 'mm-hotfixes-stable-2024-10-17-16-08' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (28 commits)
  maple_tree: add regression test for spanning store bug
  maple_tree: correct tree corruption on spanning store
  mm/mglru: only clear kswapd_failures if reclaimable
  mm/swapfile: skip HugeTLB pages for unuse_vma
  selftests: mm: fix the incorrect usage() info of khugepaged
  MAINTAINERS: add Jann as memory mapping/VMA reviewer
  mm: swap: prevent possible data-race in __try_to_reclaim_swap
  mm: khugepaged: fix the incorrect statistics when collapsing large file folios
  MAINTAINERS: kasan, kcov: add bugzilla links
  mm: don't install PMD mappings when THPs are disabled by the hw/process/vma
  mm: huge_memory: add vma_thp_disabled() and thp_disabled_by_hw()
  Docs/damon/maintainer-profile: update deprecated awslabs GitHub URLs
  Docs/damon/maintainer-profile: add missing '_' suffixes for external web links
  maple_tree: check for MA_STATE_BULK on setting wr_rebalance
  mm: khugepaged: fix the arguments order in khugepaged_collapse_file trace point
  mm/damon/tests/sysfs-kunit.h: fix memory leak in damon_sysfs_test_add_targets()
  mm: remove unused stub for can_swapin_thp()
  mailmap: add an entry for Andy Chiu
  MAINTAINERS: add memory mapping/VMA co-maintainers
  fs/proc: fix build with GCC 15 due to -Werror=unterminated-string-initialization
  ...
2024-10-17 16:33:06 -07:00
Linus Torvalds
d4b82e5808 Two clk driver fixes and a unit test fix:
- Terminate the of_device_id table in the Samsung exynosautov920 clk
    driver so that device matching logic doesn't run off the end of the
    array into other memory and break matching for any kernel with this
    driver loaded
 
  - Properly limit the max clk ID in the Rockchip clk driver
 
  - Use clk kunit helpers in the clk tests so that memory isn't leaked
    after the test concludes
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCAAvFiEE9L57QeeUxqYDyoaDrQKIl8bklSUFAmcRk/8RHHNib3lkQGtl
 cm5lbC5vcmcACgkQrQKIl8bklSVu4RAA2qKoXfSdElkgzpv5fW2Ydr0LbN5pS90B
 4ey6QfVxco6imyvry/MVREIQVG0832otv1WMJ2D6kErCxvzo5bNf1vsXcg7h5Gci
 VJELgtgKUPkVC2S3UgXXJe7cTobZhDUoin/mfCXgHh1yk6rg5t0gElP+qrxto1qH
 Tan7cGpqW8CcK33M2BnYwS0LX1gSXQ3EN9R5opyIQGX6OFvBRXYk8GH8g3WTPBRt
 OtJoR3u7PZ95U3FfHuSGgTddD2r9ZlI0lCY95+RpDkF0cL2yIkVMU8GZHZH5DDpH
 iMGEFZ/QxC11BLjlleSPQsQJjPFJQ/lz7ZlJ8/c7zMFhmBusBu2Tk5aC8w7Dxa4o
 B1rErFxg63sFVTY1iC1gyaPYnNtIkIZe287YyIeO+Sr6aW6hEsLbDXtvfydAYJL1
 w4wLwrOSgv9ncoEzaEnKoz62pgZbg/o3wB3fLLVrtBtdCaTZMSWRettHV1DdSLOZ
 gPQQtp6F0VgzW+ip7mPYYy+DKO5jErg1OtBmCszFgDvmKKDloHzaE9lP7j3YNFbm
 GaAaD/dM8muOJ+gvdVja/K2WEyFsec9vnABOGlb5LTmZtfHajrJl9jyaJ+9ILPi1
 1xcWK5FH6m4NJygC7TcEUq5KZBZeEoe+9Z2hgIflX5XmL9aLeZOuGPvz6r2moICw
 ztsggsLsIYU=
 =EKY/
 -----END PGP SIGNATURE-----

Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux

Pull clk fixes from Stephen Boyd:
 "Two clk driver fixes and a unit test fix:

   - Terminate the of_device_id table in the Samsung exynosautov920 clk
     driver so that device matching logic doesn't run off the end of the
     array into other memory and break matching for any kernel with this
     driver loaded

   - Properly limit the max clk ID in the Rockchip clk driver

   - Use clk kunit helpers in the clk tests so that memory isn't leaked
     after the test concludes"

* tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
  clk: test: Fix some memory leaks
  clk: rockchip: fix finding of maximum clock ID
  clk: samsung: Fix out-of-bound access of of_match_node()
2024-10-17 16:24:42 -07:00
Dave Airlie
49ff3e79a7 Short summary of fixes pull:
ast:
 - Clear EDID on unplugged connectors
 
 host1x:
 - Fix boot on Tegra186
 - Set DMA parameters
 
 mgag200:
 - Revert VBLANK support
 
 panel:
 - himax-hx83192: Adjust power and gamma
 
 qaic:
 - Sgtable loop fixes
 
 vmwgfx:
 - Limit display layout allocatino size
 - Handle allocation errors in connector checks
 - Clean up KMS code for 2d-only setup
 - Report surface-check errors correctly
 - Remove NULL test around kvfree()
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEchf7rIzpz2NEoWjlaA3BHVMLeiMFAmcQ+u4ACgkQaA3BHVML
 eiNUcwgApsZST7UK0hrWZT+Z4hPz5k/n1KgokQc+j5PaAEGPcRSIFv3AiAR+EBfz
 mpU+pMmyA+kdI2NWDjAMX+8lqOlMNH2clThGFPEkoyzH+PCvCIooCCjlcdsoVFLH
 leZdDo8RD1dVLhxQ3Vjq1Z5g+tClWe9zKA8Yb+o1wXq0wzGKZEvckOswEAqlNpQm
 U1xmCh16Zelv5coidRVIKE13V4wp2ZMdTAExfG8W+HP1jTqGwsdQ7+22DEllXHZY
 NwJJ11qCdexuT3OrIRCjkdxtWKEmRArdiGe5oHYHa3iUBH8ufo83VzfSl22rcE/2
 x5wmYEgixKnDxflu80ITpwgLik7+Jw==
 =Sc+z
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-fixes-2024-10-17' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes

Short summary of fixes pull:

ast:
- Clear EDID on unplugged connectors

host1x:
- Fix boot on Tegra186
- Set DMA parameters

mgag200:
- Revert VBLANK support

panel:
- himax-hx83192: Adjust power and gamma

qaic:
- Sgtable loop fixes

vmwgfx:
- Limit display layout allocatino size
- Handle allocation errors in connector checks
- Clean up KMS code for 2d-only setup
- Report surface-check errors correctly
- Remove NULL test around kvfree()

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20241017115516.GA196624@linux.fritz.box
2024-10-18 06:43:17 +10:00
Dave Airlie
7626b4e96b Merge tag 'drm-intel-fixes-2024-10-17' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes
- Two DP bandwidth related MST fixes

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/ZxDLdML9Dwqkb1AW@jlahtine-mobl.ger.corp.intel.com
2024-10-18 06:41:13 +10:00
Dave Airlie
01541a8706 amd-drm-fixes-6.12-2024-10-16:
amdgpu:
 - SR-IOV fix
 - CS chunk handling fix
 - MES fixes
 - SMU13 fixes
 
 amdkfd:
 - VRAM usage reporting fix
 
 radeon:
 - Fix possible_clones handling
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCZxAbGAAKCRC93/aFa7yZ
 2IdvAQC6gZgsMRzqiNekOovaobDxPzoaAH3ea5H1XaUsQx6NQQEAn+3AdMc62IYx
 Ttb0q88F2MlTAUJiDvnaVnme0iYligU=
 =E/O4
 -----END PGP SIGNATURE-----

Merge tag 'amd-drm-fixes-6.12-2024-10-16' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes

amd-drm-fixes-6.12-2024-10-16:

amdgpu:
- SR-IOV fix
- CS chunk handling fix
- MES fixes
- SMU13 fixes

amdkfd:
- VRAM usage reporting fix

radeon:
- Fix possible_clones handling

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Alex Deucher <alexander.deucher@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241016200514.3520286-1-alexander.deucher@amd.com
2024-10-18 06:13:19 +10:00
Andrii Nakryiko
5ac9b4e935 lib/buildid: Handle memfd_secret() files in build_id_parse()
>From memfd_secret(2) manpage:

  The memory areas backing the file created with memfd_secret(2) are
  visible only to the processes that have access to the file descriptor.
  The memory region is removed from the kernel page tables and only the
  page tables of the processes holding the file descriptor map the
  corresponding physical memory. (Thus, the pages in the region can't be
  accessed by the kernel itself, so that, for example, pointers to the
  region can't be passed to system calls.)

We need to handle this special case gracefully in build ID fetching
code. Return -EFAULT whenever secretmem file is passed to build_id_parse()
family of APIs. Original report and repro can be found in [0].

  [0] https://lore.kernel.org/bpf/ZwyG8Uro%2FSyTXAni@ly-workstation/

Fixes: de3ec364c3 ("lib/buildid: add single folio-based file reader abstraction")
Reported-by: Yi Lai <yi1.lai@intel.com>
Suggested-by: Shakeel Butt <shakeel.butt@linux.dev>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Link: https://lore.kernel.org/bpf/20241017175431.6183-A-hca@linux.ibm.com
Link: https://lore.kernel.org/bpf/20241017174713.2157873-1-andrii@kernel.org
2024-10-17 21:30:32 +02:00
Jens Axboe
de7007e9e6 nvme fixes for Linux 6.12
- Fix target passthrough identifier (Nilay)
  - Fix tcp locking (Hannes)
  - Replace list with sbitmap for tracking RDMA rsp tags (Guixen)
  - Remove unnecessary fallthrough statements (Tokunori)
  - Remove ready-without-media support (Greg)
  - Fix multipath partition scan deadlock (Keith)
  - Fix concurrent PCI reset and remove queue mapping (Maurizio)
  - Fabrics shutdown fixes (Nilay)
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE3Fbyvv+648XNRdHTPe3zGtjzRgkFAmcRW5IACgkQPe3zGtjz
 RgmbFA//R9XlpwXC8oRQSw4BgKGTjaCpWdErv+44bynlIjz2PfkCb6ZdlyZPiEiz
 voFvLyaPB0CC6scFEwMsgl+vQobBIZzclcwCIfhYYTLofz7XNlrpL2BNm83Du5dt
 9JSUMa6aOiLd7o7bcZLSkXtRdycIjrZSnedNAfN+wX3zVXkHx7yYPL/WKp22XCCG
 VXyfANUPTHWRnfUu+E4F24+VkYAeSy0ByNF7Pcbp2aH2q12ZDVYRa5RarE/FdoxA
 /f9SMti+Hvf+6h6HFmxeFQKJeqW02CrDeG7CJY+UPfgKHtYtnWcLGjz7fkq2SZk/
 TWjRf8w6hmpF2JM+/QV0/xfO2vlfuo7fERDXbj6+duB/7DRubs3sC2+NEJ96s83j
 lp+FySXcrNML54QC0LPw13iX+x1oDdM5MU5dmmrH4cJMPmRY3nnRBlgMOH1fOsm6
 Khhj7ftKPXBRVdcBmfdKO+2o3NzDufBxySXr9smmOqhUJc3no1mvmj7znInBTeOj
 bevy7bHOWXazr9/6GbFzv6kgmKRzdpg0L/RfJxKGGkkuJ5Qll1dMv9Ax4mppuCKG
 750WB/8jy8onfq6NxyufGZE9fOgbngWfSwzEs2yrhYdJA0lmXNgJBknZHmaWmRkv
 vJOOE7h2xrJyfvqv9nO1Uk1VDj+9R2cAlORyV4xXG4owBTbWie4=
 =UJyU
 -----END PGP SIGNATURE-----

Merge tag 'nvme-6.12-2024-10-18' of git://git.infradead.org/nvme into block-6.12

Pull NVMe fixes from Keith:

"nvme fixes for Linux 6.12

 - Fix target passthrough identifier (Nilay)
 - Fix tcp locking (Hannes)
 - Replace list with sbitmap for tracking RDMA rsp tags (Guixen)
 - Remove unnecessary fallthrough statements (Tokunori)
 - Remove ready-without-media support (Greg)
 - Fix multipath partition scan deadlock (Keith)
 - Fix concurrent PCI reset and remove queue mapping (Maurizio)
 - Fabrics shutdown fixes (Nilay)"

* tag 'nvme-6.12-2024-10-18' of git://git.infradead.org/nvme:
  nvme: use helper nvme_ctrl_state in nvme_keep_alive_finish function
  nvme: make keep-alive synchronous operation
  nvme-loop: flush off pending I/O while shutting down loop controller
  nvme-pci: fix race condition between reset and nvme_dev_disable()
  nvme-multipath: defer partition scanning
  nvme: disable CC.CRIME (NVME_CC_CRIME)
  nvme: delete unnecessary fallthru comment
  nvmet-rdma: use sbitmap to replace rsp free list
  nvme: tcp: avoid race between queue_lock lock and destroy
  nvmet-passthru: clear EUID/NGUID/UUID while using loop target
  block: fix blk_rq_map_integrity_sg kernel-doc
2024-10-17 12:49:27 -06:00
Luca Boccassi
02e2f9aa33 ipe: allow secondary and platform keyrings to install/update policies
The current policy management makes it impossible to use IPE
in a general purpose distribution. In such cases the users are not
building the kernel, the distribution is, and access to the private
key included in the trusted keyring is, for obvious reason, not
available.
This means that users have no way to enable IPE, since there will
be no built-in generic policy, and no access to the key to sign
updates validated by the trusted keyring.

Just as we do for dm-verity, kernel modules and more, allow the
secondary and platform keyrings to also validate policies. This
allows users enrolling their own keys in UEFI db or MOK to also
sign policies, and enroll them. This makes it sensible to enable
IPE in general purpose distributions, as it becomes usable by
any user wishing to do so. Keys in these keyrings can already
load kernels and kernel modules, so there is no security
downgrade.

Add a kconfig each, like dm-verity does, but default to enabled if
the dependencies are available.

Signed-off-by: Luca Boccassi <bluca@debian.org>
Reviewed-by: Serge Hallyn <serge@hallyn.com>
[FW: fixed some style issues]
Signed-off-by: Fan Wu <wufan@kernel.org>
2024-10-17 11:46:10 -07:00
Luca Boccassi
5ceecb301e ipe: also reject policy updates with the same version
Currently IPE accepts an update that has the same version as the policy
being updated, but it doesn't make it a no-op nor it checks that the
old and new policyes are the same. So it is possible to change the
content of a policy, without changing its version. This is very
confusing from userspace when managing policies.
Instead change the update logic to reject updates that have the same
version with ESTALE, as that is much clearer and intuitive behaviour.

Signed-off-by: Luca Boccassi <bluca@debian.org>
Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Fan Wu <wufan@kernel.org>
2024-10-17 11:38:15 -07:00
Luca Boccassi
579941899d ipe: return -ESTALE instead of -EINVAL on update when new policy has a lower version
When loading policies in userspace we want a recognizable error when an
update attempts to use an old policy, as that is an error that needs
to be treated differently from an invalid policy. Use -ESTALE as it is
clear enough for an update mechanism.

Signed-off-by: Luca Boccassi <bluca@debian.org>
Reviewed-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: Fan Wu <wufan@kernel.org>
2024-10-17 11:37:13 -07:00
Nilay Shroff
599d9f3a10 nvme: use helper nvme_ctrl_state in nvme_keep_alive_finish function
We no more need acquiring ctrl->lock before accessing the
NVMe controller state and instead we can now use the helper
nvme_ctrl_state. So replace the use of ctrl->lock from
nvme_keep_alive_finish function with nvme_ctrl_state call.

Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Nilay Shroff <nilay@linux.ibm.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
2024-10-17 11:07:37 -07:00
Nilay Shroff
d06923670b nvme: make keep-alive synchronous operation
The nvme keep-alive operation, which executes at a periodic interval,
could potentially sneak in while shutting down a fabric controller.
This may lead to a race between the fabric controller admin queue
destroy code path (invoked while shutting down controller) and hw/hctx
queue dispatcher called from the nvme keep-alive async request queuing
operation. This race could lead to the kernel crash shown below:

Call Trace:
    autoremove_wake_function+0x0/0xbc (unreliable)
    __blk_mq_sched_dispatch_requests+0x114/0x24c
    blk_mq_sched_dispatch_requests+0x44/0x84
    blk_mq_run_hw_queue+0x140/0x220
    nvme_keep_alive_work+0xc8/0x19c [nvme_core]
    process_one_work+0x200/0x4e0
    worker_thread+0x340/0x504
    kthread+0x138/0x140
    start_kernel_thread+0x14/0x18

While shutting down fabric controller, if nvme keep-alive request sneaks
in then it would be flushed off. The nvme_keep_alive_end_io function is
then invoked to handle the end of the keep-alive operation which
decrements the admin->q_usage_counter and assuming this is the last/only
request in the admin queue then the admin->q_usage_counter becomes zero.
If that happens then blk-mq destroy queue operation (blk_mq_destroy_
queue()) which could be potentially running simultaneously on another
cpu (as this is the controller shutdown code path) would forward
progress and deletes the admin queue. So, now from this point onward
we are not supposed to access the admin queue resources. However the
issue here's that the nvme keep-alive thread running hw/hctx queue
dispatch operation hasn't yet finished its work and so it could still
potentially access the admin queue resource while the admin queue had
been already deleted and that causes the above crash.

This fix helps avoid the observed crash by implementing keep-alive as a
synchronous operation so that we decrement admin->q_usage_counter only
after keep-alive command finished its execution and returns the command
status back up to its caller (blk_execute_rq()). This would ensure that
fabric shutdown code path doesn't destroy the fabric admin queue until
keep-alive request finished execution and also keep-alive thread is not
running hw/hctx queue dispatch operation.

Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Nilay Shroff <nilay@linux.ibm.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
2024-10-17 11:07:37 -07:00
Nilay Shroff
c199fac88f nvme-loop: flush off pending I/O while shutting down loop controller
While shutting down loop controller, we first quiesce the admin/IO queue,
delete the admin/IO tag-set and then at last destroy the admin/IO queue.
However it's quite possible that during the window between quiescing and
destroying of the admin/IO queue, some admin/IO request might sneak in
and if that happens then we could potentially encounter a hung task
because shutdown operation can't forward progress until any pending I/O
is flushed off.

This commit helps ensure that before destroying the admin/IO queue, we
unquiesce the admin/IO queue so that any outstanding requests, which are
added after the admin/IO queue is quiesced, are now flushed to its
completion.

Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Nilay Shroff <nilay@linux.ibm.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
2024-10-17 11:07:37 -07:00
Daniel Borkmann
db123e4230 selftests/bpf: Add test case for delta propagation
Add a small BPF verifier test case to ensure that alu32 additions to
registers are not subject to linked scalar delta tracking.

  # ./vmtest.sh -- ./test_progs -t verifier_linked_scalars
  [...]
  ./test_progs -t verifier_linked_scalars
  [    1.413138] tsc: Refined TSC clocksource calibration: 3407.993 MHz
  [    1.413524] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x311fcd52370, max_idle_ns: 440795242006 ns
  [    1.414223] clocksource: Switched to clocksource tsc
  [    1.419640] bpf_testmod: loading out-of-tree module taints kernel.
  [    1.420025] bpf_testmod: module verification failed: signature and/or required key missing - tainting kernel
  #500/1   verifier_linked_scalars/scalars: find linked scalars:OK
  #500     verifier_linked_scalars:OK
  Summary: 1/1 PASSED, 0 SKIPPED, 0 FAILED
  [    1.590858] ACPI: PM: Preparing to enter system sleep state S5
  [    1.591402] reboot: Power down
  [...]

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20241016134913.32249-3-daniel@iogearbox.net
2024-10-17 11:06:34 -07:00
Daniel Borkmann
3e9e708757 bpf: Fix print_reg_state's constant scalar dump
print_reg_state() should not consider adding reg->off to reg->var_off.value
when dumping scalars. Scalars can be produced with reg->off != 0 through
BPF_ADD_CONST, and thus as-is this can skew the register log dump.

Fixes: 98d7ca374b ("bpf: Track delta between "linked" registers.")
Reported-by: Nathaniel Theis <nathaniel.theis@nccgroup.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20241016134913.32249-2-daniel@iogearbox.net
2024-10-17 11:06:34 -07:00
Daniel Borkmann
3878ae04e9 bpf: Fix incorrect delta propagation between linked registers
Nathaniel reported a bug in the linked scalar delta tracking, which can lead
to accepting a program with OOB access. The specific code is related to the
sync_linked_regs() function and the BPF_ADD_CONST flag, which signifies a
constant offset between two scalar registers tracked by the same register id.

The verifier attempts to track "similar" scalars in order to propagate bounds
information learned about one scalar to others. For instance, if r1 and r2
are known to contain the same value, then upon encountering 'if (r1 != 0x1234)
goto xyz', not only does it know that r1 is equal to 0x1234 on the path where
that conditional jump is not taken, it also knows that r2 is.

Additionally, with env->bpf_capable set, the verifier will track scalars
which should be a constant delta apart (if r1 is known to be one greater than
r2, then if r1 is known to be equal to 0x1234, r2 must be equal to 0x1233.)
The code path for the latter in adjust_reg_min_max_vals() is reached when
processing both 32 and 64-bit addition operations. While adjust_reg_min_max_vals()
knows whether dst_reg was produced by a 32 or a 64-bit addition (based on the
alu32 bool), the only information saved in dst_reg is the id of the source
register (reg->id, or'ed by BPF_ADD_CONST) and the value of the constant
offset (reg->off).

Later, the function sync_linked_regs() will attempt to use this information
to propagate bounds information from one register (known_reg) to others,
meaning, for all R in linked_regs, it copies known_reg range (and possibly
adjusting delta) into R for the case of R->id == known_reg->id.

For the delta adjustment, meaning, matching reg->id with BPF_ADD_CONST, the
verifier adjusts the register as reg = known_reg; reg += delta where delta
is computed as (s32)reg->off - (s32)known_reg->off and placed as a scalar
into a fake_reg to then simulate the addition of reg += fake_reg. This is
only correct, however, if the value in reg was created by a 64-bit addition.
When reg contains the result of a 32-bit addition operation, its upper 32
bits will always be zero. sync_linked_regs() on the other hand, may cause
the verifier to believe that the addition between fake_reg and reg overflows
into those upper bits. For example, if reg was generated by adding the
constant 1 to known_reg using a 32-bit alu operation, then reg->off is 1
and known_reg->off is 0. If known_reg is known to be the constant 0xFFFFFFFF,
sync_linked_regs() will tell the verifier that reg is equal to the constant
0x100000000. This is incorrect as the actual value of reg will be 0, as the
32-bit addition will wrap around.

Example:

  0: (b7) r0 = 0;             R0_w=0
  1: (18) r1 = 0x80000001;    R1_w=0x80000001
  3: (37) r1 /= 1;            R1_w=scalar()
  4: (bf) r2 = r1;            R1_w=scalar(id=1) R2_w=scalar(id=1)
  5: (bf) r4 = r1;            R1_w=scalar(id=1) R4_w=scalar(id=1)
  6: (04) w2 += 2147483647;   R2_w=scalar(id=1+2147483647,smin=0,smax=umax=0xffffffff,var_off=(0x0; 0xffffffff))
  7: (04) w4 += 0 ;           R4_w=scalar(id=1+0,smin=0,smax=umax=0xffffffff,var_off=(0x0; 0xffffffff))
  8: (15) if r2 == 0x0 goto pc+1
 10: R0=0 R1=0xffffffff80000001 R2=0x7fffffff R4=0xffffffff80000001 R10=fp0

What can be seen here is that r1 is copied to r2 and r4, such that {r1,r2,r4}.id
are all the same which later lets sync_linked_regs() to be invoked. Then, in
a next step constants are added with alu32 to r2 and r4, setting their ->off,
as well as id |= BPF_ADD_CONST. Next, the conditional will bind r2 and
propagate ranges to its linked registers. The verifier now believes the upper
32 bits of r4 are r4=0xffffffff80000001, while actually r4=r1=0x80000001.

One approach for a simple fix suitable also for stable is to limit the constant
delta tracking to only 64-bit alu addition. If necessary at some later point,
BPF_ADD_CONST could be split into BPF_ADD_CONST64 and BPF_ADD_CONST32 to avoid
mixing the two under the tradeoff to further complicate sync_linked_regs().
However, none of the added tests from dedf56d775 ("selftests/bpf: Add tests
for add_const") make this necessary at this point, meaning, BPF CI also passes
with just limiting tracking to 64-bit alu addition.

Fixes: 98d7ca374b ("bpf: Track delta between "linked" registers.")
Reported-by: Nathaniel Theis <nathaniel.theis@nccgroup.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20241016134913.32249-1-daniel@iogearbox.net
2024-10-17 11:06:34 -07:00
Jordan Rome
ee8c7c6c3f bpf: Properly test iter/task tid filtering
Previously test_task_tid was setting `linfo.task.tid`
to `getpid()` which is the same as `gettid()` for the
parent process. Instead create a new child thread
and set `linfo.task.tid` to `gettid()` to make sure
the tid filtering logic is working as expected.

Signed-off-by: Jordan Rome <linux@jordanrome.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20241016210048.1213935-2-linux@jordanrome.com
2024-10-17 10:52:18 -07:00
Jordan Rome
9495a5b731 bpf: Fix iter/task tid filtering
In userspace, you can add a tid filter by setting
the "task.tid" field for "bpf_iter_link_info".
However, `get_pid_task` when called for the
`BPF_TASK_ITER_TID` type should have been using
`PIDTYPE_PID` (tid) instead of `PIDTYPE_TGID` (pid).

Fixes: f0d74c4da1 ("bpf: Parameterize task iterators.")
Signed-off-by: Jordan Rome <linux@jordanrome.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20241016210048.1213935-1-linux@jordanrome.com
2024-10-17 10:52:18 -07:00
Maurizio Lombardi
26bc0a81f6 nvme-pci: fix race condition between reset and nvme_dev_disable()
nvme_dev_disable() modifies the dev->online_queues field, therefore
nvme_pci_update_nr_queues() should avoid racing against it, otherwise
we could end up passing invalid values to blk_mq_update_nr_hw_queues().

 WARNING: CPU: 39 PID: 61303 at drivers/pci/msi/api.c:347
          pci_irq_get_affinity+0x187/0x210
 Workqueue: nvme-reset-wq nvme_reset_work [nvme]
 RIP: 0010:pci_irq_get_affinity+0x187/0x210
 Call Trace:
  <TASK>
  ? blk_mq_pci_map_queues+0x87/0x3c0
  ? pci_irq_get_affinity+0x187/0x210
  blk_mq_pci_map_queues+0x87/0x3c0
  nvme_pci_map_queues+0x189/0x460 [nvme]
  blk_mq_update_nr_hw_queues+0x2a/0x40
  nvme_reset_work+0x1be/0x2a0 [nvme]

Fix the bug by locking the shutdown_lock mutex before using
dev->online_queues. Give up if nvme_dev_disable() is running or if
it has been executed already.

Fixes: 949928c1c7 ("NVMe: Fix possible queue use after freed")
Tested-by: Yi Zhang <yi.zhang@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
2024-10-17 09:55:22 -07:00
Linus Torvalds
6efbea77b3 arm64 fixes for -rc4
- Disable software tag-based KASAN when compiling with GCC, as functions
   are incorrectly instrumented leading to a crash early during boot.
 
 - Fix pkey configuration for kernel threads when POE is enabled.
 
 - Fix invalid memory accesses in uprobes when targetting load-literal
   instructions.
 -----BEGIN PGP SIGNATURE-----
 
 iQFEBAABCgAuFiEEPxTL6PPUbjXGY88ct6xw3ITBYzQFAmcPrzQQHHdpbGxAa2Vy
 bmVsLm9yZwAKCRC3rHDchMFjNIr6B/wN+o1xI7Fv/QdlaTuKYLvOOg/XTl6sbUDj
 YssxtjhpKuaFVG4zJHNsWvgUqO+YCM7m3F1L8LVPMF7l2xoKtRTIB1Ye315hTjYm
 dW5Te6xBMVKF8SVxE8sBbZobdokIW1JNPBrvGvHO3d5ujmofzwHU8RNMXuTUItRw
 z85Qy75FkEDTEbsWhS3VL5HOgEr+k0TYDRa8SXwKWVj7/rYna3tO39kIdS5dt9VX
 wDJbnxtWJMhiHmDnevFFhBkSZrips12P1Rb6HUSmhpUJh0Rk4TAZntSl2f/lr+jA
 PuboBbSG68UOCwAHoNmTcLdFhkiNaiyw4w2F7hk2A6aNRtme+bT0
 =M/ug
 -----END PGP SIGNATURE-----

Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

Pull arm64 fixes from Will Deacon:

 - Disable software tag-based KASAN when compiling with GCC, as
   functions are incorrectly instrumented leading to a crash early
   during boot

 - Fix pkey configuration for kernel threads when POE is enabled

 - Fix invalid memory accesses in uprobes when targetting load-literal
   instructions

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  kasan: Disable Software Tag-Based KASAN with GCC
  Documentation/protection-keys: add AArch64 to documentation
  arm64: set POR_EL0 for kernel threads
  arm64: probes: Fix uprobes for big-endian kernels
  arm64: probes: Fix simulate_ldr*_literal()
  arm64: probes: Remove broken LDR (literal) uprobe support
2024-10-17 09:51:03 -07:00
Linus Torvalds
c16e5c94c8 soc: fixes for 6.12
Most of the fixes this time are for platform specific drivers, addressing
 issues found through build testing on freescale, ep93xx, starfive,
 and npcm platforms, as as well as the ffa firmware.
 
 The fixes for the scmi firmware driver address compatibility problems
 found on broadcom machines.
 
 There are only two devicetree fixes, addressing incorrect in configuration
 on broadcom and marvell machines.
 
 The changes to the Documentation and MAINTAINERS files are for
 clarification only.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEiK/NIGsWEZVxh/FrYKtH/8kJUicFAmcRMFQACgkQYKtH/8kJ
 Uiflnw//QtSzQtwZpe9LQBq+1jS/q2y1dAsgNqP+CYB0nNsO6MSIEUDpjh8TRYpP
 uuRg9oN3xdtT6xlFGGEMdsOc+DCcbOakW+CFoxgvvxi2AiFpvdtiZpHgse5DtVfl
 HQYSSLQvttwtjDlNjPmw58F1GR+3FzXh0mJS8N03bP+k8yJxVrSff4TJTFEHBLrG
 mrorC+qfBaB7djvmjBolPNt3qMB5pXVYio3ZyflHFdxxUHjnrBVkWpmLE2BQksJt
 I5nbl8vFqfLhLFCsqyCm4gC0gDSdxsWhHuRpOzXYQJKHxWpg/uYu4TOsKxVAc/Nc
 nZNOdeQ0C7pU6yiyDD1jqWW0l98itHVQOvz6dxE2wZpL1duOqQ7yx1DJfJw4V3PP
 Cn66mcp9Vrh0nYpZxhGfOs3wibhbJ0NQYhC4jaddVrxfcGuJc3jTR+bnkK+K+b8b
 nt7FlLe/vHFvaahGclgeg63wpTqmPAc0eSMF8YJDo1bTP8uF6Km6oXo/kaQQywBm
 C3mAXJn2rtn+4sPx2N3tjGAhnpK3cZZj/9QA82WjN/Cm7vzXwRgrt0j4S3weGxGI
 rPo2tNC8wJT+gXAPDWvRwyjqhOoCYbWgQ/9xkF5kQNe+cktvdU7gzGiejYhWl9Oz
 3eLb6IfZbuMTsVWhQuNSJe4LAp+/18M0T0rpzbL3VIJ5XuP3n64=
 =h897
 -----END PGP SIGNATURE-----

Merge tag 'arm-fixes-6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

Pull SoC fixes from Arnd Bergmann:
 "Most of the fixes this time are for platform specific drivers,
  addressing issues found through build testing on freescale, ep93xx,
  starfive, and npcm platforms, as as well as the ffa firmware.

  The fixes for the scmi firmware driver address compatibility problems
  found on broadcom machines.

  There are only two devicetree fixes, addressing incorrect in
  configuration on broadcom and marvell machines.

  The changes to the Documentation and MAINTAINERS files are for
  clarification only"

* tag 'arm-fixes-6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
  firmware: arm_ffa: Avoid string-fortify warning caused by memcpy()
  firmware: arm_scmi: Queue in scmi layer for mailbox implementation
  firmware: arm_ffa: Avoid string-fortify warning in export_uuid()
  firmware: arm_scmi: Give SMC transport precedence over mailbox
  firmware: arm_scmi: Fix the double free in scmi_debugfs_common_setup()
  Documentation/process: maintainer-soc: clarify submitting patches
  dmaengine: cirrus: check that output may be truncated
  dmaengine: cirrus: ERR_CAST() ioremap error
  MAINTAINERS: use the canonical soc mailing list address and mark it as L:
  ARM: dts: bcm2837-rpi-cm3-io3: Fix HDMI hpd-gpio pin
  arm64: dts: marvell: cn9130-sr-som: fix cp0 mdio pin numbers
  soc: fsl: cpm1: qmc: Fix unused data compilation warning
  soc: fsl: cpm1: qmc: Do not use IS_ERR_VALUE() on error pointers
  reset: starfive: jh71x0: Fix accessing the empty member on JH7110 SoC
  reset: npcm: convert comma to semicolon
2024-10-17 09:43:36 -07:00