Update 5.4-2.3.x-imx up to v5.4.147 #444
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
[ Upstream commit 048661a ] Yanfei reported that setting HANDOFF should not depend on recomputing @FIRST, only on @FIRST state. Which would then give: if (ww_ctx || !first) first = __mutex_waiter_is_first(lock, &waiter); if (first) __mutex_set_flag(lock, MUTEX_FLAG_HANDOFF); But because 'ww_ctx || !first' is basically 'always' and the test for first is relatively cheap, omit that first branch entirely. Reported-by: Yanfei Xu <[email protected]> Signed-off-by: Peter Zijlstra (Intel) <[email protected]> Reviewed-by: Waiman Long <[email protected]> Reviewed-by: Yanfei Xu <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Sasha Levin <[email protected]>
[ Upstream commit 1852f5e ] This patch fixes the offset of register error log by using regmap_get_offset(). Signed-off-by: Jeongtae Park <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Mark Brown <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
[ Upstream commit df6313d ] After calling dma_map_single(), we must also call dma_mapping_error(). This fixes the following warning when compiling with CONFIG_DMA_API_DEBUG: [ 311.241478] WARNING: CPU: 0 PID: 428 at kernel/dma/debug.c:1027 check_unmap+0x79c/0x96c [ 311.249547] DMA-API: mxs-dcp 2280000.crypto: device driver failed to check map error[device address=0x00000000860cb080] [size=32 bytes] [mapped as single] Signed-off-by: Sean Anderson <[email protected]> Reviewed-by: Richard Weinberger <[email protected]> Signed-off-by: Herbert Xu <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
[ Upstream commit f950915 ] It is possible for sched_getattr() to incorrectly report the state of the reset_on_fork flag when called on a deadline task. Indeed, if the flag was set on a deadline task using sched_setattr() with flags (SCHED_FLAG_RESET_ON_FORK | SCHED_FLAG_KEEP_PARAMS), then p->sched_reset_on_fork will be set, but __setscheduler() will bail out early, which means that the dl_se->flags will not get updated by __setscheduler_params()->__setparam_dl(). Consequently, if sched_getattr() is then called on the task, __getparam_dl() will override kattr.sched_flags with the now out-of-date copy in dl_se->flags and report the stale value to userspace. To fix this, make sure to only copy the flags that are relevant to sched_deadline to and from the dl_se->flags field. Signed-off-by: Quentin Perret <[email protected]> Signed-off-by: Peter Zijlstra (Intel) <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Sasha Levin <[email protected]>
…writeb errors [ Upstream commit caa534c ] When fuel_gauge_reg_readb()/_writeb() fails, report which register we were trying to read / write when the error happened. Also reword the message a bit: - Drop the axp288 prefix, dev_err() already prints this - Switch from telegram / abbreviated style to a normal sentence, aligning the message with those from fuel_gauge_read_*bit_word() Signed-off-by: Hans de Goede <[email protected]> Signed-off-by: Sebastian Reichel <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
…top() [ Upstream commit fe28140 ] We should not clear FLAGS_DMA_ACTIVE before omap_sham_update_dma_stop() is done calling dma_unmap_sg(). We already clear FLAGS_DMA_ACTIVE at the end of omap_sham_update_dma_stop(). The early clearing of FLAGS_DMA_ACTIVE is not causing issues as we do not need to defer anything based on FLAGS_DMA_ACTIVE currently. So this can be applied as clean-up. Cc: Lokesh Vutla <[email protected]> Cc: Tero Kristo <[email protected]> Signed-off-by: Tony Lindgren <[email protected]> Signed-off-by: Herbert Xu <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
[ Upstream commit b4da13a ] A missing clock update is causing the following warning: rq->clock_update_flags < RQCF_ACT_SKIP WARNING: CPU: 112 PID: 2041 at kernel/sched/sched.h:1453 sub_running_bw.isra.0+0x190/0x1a0 ... CPU: 112 PID: 2041 Comm: sugov:112 Tainted: G W 5.14.0-rc1 Freescale#1 Hardware name: WIWYNN Mt.Jade Server System B81.030Z1.0007/Mt.Jade Motherboard, BIOS 1.6.20210526 (SCP: 1.06.20210526) 2021/05/26 ... Call trace: sub_running_bw.isra.0+0x190/0x1a0 migrate_task_rq_dl+0xf8/0x1e0 set_task_cpu+0xa8/0x1f0 try_to_wake_up+0x150/0x3d4 wake_up_q+0x64/0xc0 __up_write+0xd0/0x1c0 up_write+0x4c/0x2b0 cppc_set_perf+0x120/0x2d0 cppc_cpufreq_set_target+0xe0/0x1a4 [cppc_cpufreq] __cpufreq_driver_target+0x74/0x140 sugov_work+0x64/0x80 kthread_worker_fn+0xe0/0x230 kthread+0x138/0x140 ret_from_fork+0x10/0x18 The task causing this is the `cppc_fie` DL task introduced by commit 1eb5dde ("cpufreq: CPPC: Add support for frequency invariance"). With CONFIG_ACPI_CPPC_CPUFREQ_FIE=y and schedutil cpufreq governor on slow-switching system (like on this Ampere Altra WIWYNN Mt. Jade Arm Server): DL task `curr=sugov:112` lets `p=cppc_fie` migrate and since the latter is in `non_contending` state, migrate_task_rq_dl() calls sub_running_bw()->__sub_running_bw()->cpufreq_update_util()-> rq_clock()->assert_clock_updated() on p. Fix this by updating the clock for a non_contending task in migrate_task_rq_dl() before calling sub_running_bw(). Reported-by: Bruno Goncalves <[email protected]> Signed-off-by: Dietmar Eggemann <[email protected]> Signed-off-by: Peter Zijlstra (Intel) <[email protected]> Reviewed-by: Daniel Bristot de Oliveira <[email protected]> Acked-by: Juri Lelli <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Sasha Levin <[email protected]>
[ Upstream commit ccfc9dd ] The soft watchdog timer function checks if a virtual machine was suspended and hence what looks like a lockup in fact is a false positive. This is what kvm_check_and_clear_guest_paused() does: it tests guest PVCLOCK_GUEST_STOPPED (which is set by the host) and if it's set then we need to touch all watchdogs and bail out. Watchdog timer function runs from IRQ, so PVCLOCK_GUEST_STOPPED check works fine. There is, however, one more watchdog that runs from IRQ, so watchdog timer fn races with it, and that watchdog is not aware of PVCLOCK_GUEST_STOPPED - RCU stall detector. apic_timer_interrupt() smp_apic_timer_interrupt() hrtimer_interrupt() __hrtimer_run_queues() tick_sched_timer() tick_sched_handle() update_process_times() rcu_sched_clock_irq() This triggers RCU stalls on our devices during VM resume. If tick_sched_handle()->rcu_sched_clock_irq() runs on a VCPU before watchdog_timer_fn()->kvm_check_and_clear_guest_paused() then there is nothing on this VCPU that touches watchdogs and RCU reads stale gp stall timestamp and new jiffies value, which makes it think that RCU has stalled. Make RCU stall watchdog aware of PVCLOCK_GUEST_STOPPED and don't report RCU stalls when we resume the VM. Signed-off-by: Sergey Senozhatsky <[email protected]> Signed-off-by: Signed-off-by: Paul E. McKenney <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
[ Upstream commit 406dd42 ] When an itimer deactivates a previously armed expiration, it simply doesn't do anything. As a result the process wide cputime counter keeps running and the tick dependency stays set until it reaches the old ghost expiration value. This can be reproduced with the following snippet: void trigger_process_counter(void) { struct itimerval n = {}; n.it_value.tv_sec = 100; setitimer(ITIMER_VIRTUAL, &n, NULL); n.it_value.tv_sec = 0; setitimer(ITIMER_VIRTUAL, &n, NULL); } Fix this with resetting the relevant base expiration. This is similar to disarming a timer. Signed-off-by: Frederic Weisbecker <[email protected]> Signed-off-by: Thomas Gleixner <[email protected]> Acked-by: Peter Zijlstra (Intel) <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Sasha Levin <[email protected]>
[ Upstream commit 627ef5a ] If __hrtimer_start_range_ns() is invoked with an already armed hrtimer then the timer has to be canceled first and then added back. If the timer is the first expiring timer then on removal the clockevent device is reprogrammed to the next expiring timer to avoid that the pending expiry fires needlessly. If the new expiry time ends up to be the first expiry again then the clock event device has to reprogrammed again. Avoid this by checking whether the timer is the first to expire and in that case, keep the timer on the current CPU and delay the reprogramming up to the point where the timer has been enqueued again. Reported-by: Lorenzo Colitti <[email protected]> Signed-off-by: Thomas Gleixner <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Sasha Levin <[email protected]>
[ Upstream commit 8c3b5e6 ] If high resolution timers are disabled the timerfd notification about a clock was set event is not happening for all cases which use clock_was_set_delayed() because that's a NOP for HIGHRES=n, which is wrong. Make clock_was_set_delayed() unconditially available to fix that. Signed-off-by: Thomas Gleixner <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Sasha Levin <[email protected]>
[ Upstream commit 781d2a9 ] We were checking validity of LVID entries only when getting implementation use information from LVID in udf_sb_lvidiu(). However if the LVID is suitably corrupted, it can cause problems also to code such as udf_count_free() which doesn't use udf_sb_lvidiu(). So check validity of LVID already when loading it from the disk and just disable LVID altogether when it is not valid. Reported-by: [email protected] Signed-off-by: Jan Kara <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
[ Upstream commit b645333 ] Currently iocharset=utf8 mount option is broken. To use UTF-8 as iocharset, it is required to use utf8 mount option. Fix iocharset=utf8 mount option to use be equivalent to the utf8 mount option. If UTF-8 as iocharset is used then s_nls_map is set to NULL. So simplify code around, remove UDF_FLAG_NLS_MAP and UDF_FLAG_UTF8 flags as to distinguish between UTF-8 and non-UTF-8 it is needed just to check if s_nls_map set to NULL or not. Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Pali Rohár <[email protected]> Signed-off-by: Jan Kara <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
[ Upstream commit 28ce50f ] Currently iocharset=utf8 mount option is broken. To use UTF-8 as iocharset, it is required to use utf8 mount option. Fix iocharset=utf8 mount option to use be equivalent to the utf8 mount option. If UTF-8 as iocharset is used then s_nls_iocharset is set to NULL. So simplify code around, remove s_utf8 field as to distinguish between UTF-8 and non-UTF-8 it is needed just to check if s_nls_iocharset is set to NULL or not. Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Pali Rohár <[email protected]> Signed-off-by: Jan Kara <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
[ Upstream commit 224b068 ] Except for the IDA none of the allocations in bcache_device_init is unwound on error, fix that. Signed-off-by: Christoph Hellwig <[email protected]> Acked-by: Coly Li <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Jens Axboe <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
[ Upstream commit 664227f ] We update ctrl->queue_count and schedule another reconnect when io queue count is zero.But we will never try to create any io queue in next reco- nnection, because ctrl->queue_count already set to zero.We will end up having an admin-only session in Live state, which is exactly what we try to avoid in the original patch. Update ctrl->queue_count after queue_count zero checking to fix it. Signed-off-by: Ruozhu Li <[email protected]> Signed-off-by: Christoph Hellwig <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
[ Upstream commit 8503287 ] We update ctrl->queue_count and schedule another reconnect when io queue count is zero.But we will never try to create any io queue in next reco- nnection, because ctrl->queue_count already set to zero.We will end up having an admin-only session in Live state, which is exactly what we try to avoid in the original patch. Update ctrl->queue_count after queue_count zero checking to fix it. Signed-off-by: Ruozhu Li <[email protected]> Reviewed-by: Sagi Grimberg <[email protected]> Signed-off-by: Christoph Hellwig <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
[ Upstream commit e804d5a ] According to the NVMe specification, the response dword 0 value of the Connect command is based on status code: return cntlid for successful compeltion return IPO and IATTR for connect invalid parameters. Fix a missing error information for a zero sized queue, and return the cntlid also for I/O queue Connect commands. Signed-off-by: Amit Engel <[email protected]> Signed-off-by: Christoph Hellwig <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
[ Upstream commit ed0d0a0 ] Signed-off-by: Sebastian Krzyszkowiak <[email protected]> Signed-off-by: Sebastian Reichel <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
[ Upstream commit d3683c0 ] Introduce dev_busid, which exports the device-id associated with the io-subchannel (and message-subchannel). The dev_busid indicates that of the device which may be physically installed on the corrosponding subchannel. The dev_busid value "none" indicates that the subchannel is not valid, there is no I/O device currently associated with the subchannel. The dev_busid information would be helpful to write device-specific udev-rules associated with the subchannel. The dev_busid interface would be available even when the sch is not bound to any driver or if there is no operational device connected on it. Hence this attribute can be used to write udev-rules which are specific to the device associated with the subchannel. Signed-off-by: Vineeth Vijayan <[email protected]> Reviewed-by: Peter Oberparleiter <[email protected]> Signed-off-by: Vasily Gorbik <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
[ Upstream commit 355a803 ] The loop on entry of ata_host_start() may not initialize host->ops to a non NULL value. The test on the host_stop field of host->ops must then be preceded by a check that host->ops is not NULL. Reported-by: kernel test robot <[email protected]> Signed-off-by: Damien Le Moal <[email protected]> Reviewed-by: Hannes Reinecke <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Jens Axboe <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
[ Upstream commit 5147f09 ] The function adf_dev_init() ignores the error code reported by enable_vf2pf_comms(). If the latter fails, e.g. the VF is not compatible with the pf, then the load of the VF driver progresses. This patch changes adf_dev_init() so that the error code from enable_vf2pf_comms() is returned to the caller. Signed-off-by: Giovanni Cabiddu <[email protected]> Reviewed-by: Marco Chiappero <[email protected]> Reviewed-by: Fiona Trahe <[email protected]> Signed-off-by: Herbert Xu <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
[ Upstream commit 0a73c76 ] The top half of the VF drivers handled only a source at the time. If an interrupt for PF2VF and bundle occurred at the same time, the ISR scheduled only the bottom half for PF2VF. This patch fixes the VF top half so that if both sources of interrupt trigger at the same time, both bottom halves are scheduled. This patch is based on earlier work done by Conor McLoughlin. Signed-off-by: Giovanni Cabiddu <[email protected]> Reviewed-by: Marco Chiappero <[email protected]> Reviewed-by: Fiona Trahe <[email protected]> Signed-off-by: Herbert Xu <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
[ Upstream commit 3d65573 ] Use reinit_completion() to set to a clean state a completion variable, used to coordinate the VF to PF request-response flow, before every new VF request. Signed-off-by: Marco Chiappero <[email protected]> Co-developed-by: Giovanni Cabiddu <[email protected]> Signed-off-by: Giovanni Cabiddu <[email protected]> Reviewed-by: Fiona Trahe <[email protected]> Signed-off-by: Herbert Xu <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
[ Upstream commit b90c1c4 ] At start and shutdown, VFs notify the PF about their state. These notifications are carried out through a message exchange using the PFVF protocol. Function names lead to believe they do perform init or shutdown logic. This is to fix the naming to better reflect their purpose. Signed-off-by: Marco Chiappero <[email protected]> Co-developed-by: Giovanni Cabiddu <[email protected]> Signed-off-by: Giovanni Cabiddu <[email protected]> Reviewed-by: Fiona Trahe <[email protected]> Signed-off-by: Herbert Xu <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
[ Upstream commit 645ae0a ] The function adf_iov_putmsg() is only used inside the intel_qat module therefore should not be exported. Remove EXPORT_SYMBOL for the function adf_iov_putmsg(). Signed-off-by: Giovanni Cabiddu <[email protected]> Reviewed-by: Fiona Trahe <[email protected]> Signed-off-by: Herbert Xu <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
[ Upstream commit 2f488f6 ] There is an existing lock hierarchy of &dev->event_lock --> &fasync_struct.fa_lock --> &f->f_owner.lock from the following call chain: input_inject_event(): spin_lock_irqsave(&dev->event_lock,...); input_handle_event(): input_pass_values(): input_to_handler(): evdev_events(): evdev_pass_values(): spin_lock(&client->buffer_lock); __pass_event(): kill_fasync(): kill_fasync_rcu(): read_lock(&fa->fa_lock); send_sigio(): read_lock_irqsave(&fown->lock,...); &dev->event_lock is HARDIRQ-safe, so interrupts have to be disabled while grabbing &fasync_struct.fa_lock, otherwise we invert the lock hierarchy. However, since kill_fasync which calls kill_fasync_rcu is an exported symbol, it may not necessarily be called with interrupts disabled. As kill_fasync_rcu may be called with interrupts disabled (for example, in the call chain above), we replace calls to read_lock/read_unlock on &fasync_struct.fa_lock in kill_fasync_rcu with read_lock_irqsave/read_unlock_irqrestore. Signed-off-by: Desmond Cheong Zhi Xi <[email protected]> Signed-off-by: Jeff Layton <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
[ Upstream commit 58bc6d1 ] When parsing the ExtendedAttr data, malicous or corrupt attribute length could cause kernel hangs and buffer overruns in some special cases. Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Stian Skjelstad <[email protected]> Signed-off-by: Jan Kara <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
[ Upstream commit ddd63c8 ] It is currently possible to initialize a large PMD page when the address is not aligned on page boundary. Signed-off-by: Alexander Gordeev <[email protected]> Reviewed-by: Vasily Gorbik <[email protected]> Signed-off-by: Vasily Gorbik <[email protected]> Signed-off-by: Heiko Carstens <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
[ Upstream commit 9372a82 ] Currently allocation and registration of s390dbf debug areas are tied together. As a result, a debug area cannot be unregistered and re-registered while any process has an associated debugfs file open. Fix this by splitting alloc/release from register/unregister. Signed-off-by: Peter Oberparleiter <[email protected]> Signed-off-by: Heiko Carstens <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
commit 2039f26 upstream. Spectre v4 gadgets make use of memory disambiguation, which is a set of techniques that execute memory access instructions, that is, loads and stores, out of program order; Intel's optimization manual, section 2.4.4.5: A load instruction micro-op may depend on a preceding store. Many microarchitectures block loads until all preceding store addresses are known. The memory disambiguator predicts which loads will not depend on any previous stores. When the disambiguator predicts that a load does not have such a dependency, the load takes its data from the L1 data cache. Eventually, the prediction is verified. If an actual conflict is detected, the load and all succeeding instructions are re-executed. af86ca4 ("bpf: Prevent memory disambiguation attack") tried to mitigate this attack by sanitizing the memory locations through preemptive "fast" (low latency) stores of zero prior to the actual "slow" (high latency) store of a pointer value such that upon dependency misprediction the CPU then speculatively executes the load of the pointer value and retrieves the zero value instead of the attacker controlled scalar value previously stored at that location, meaning, subsequent access in the speculative domain is then redirected to the "zero page". The sanitized preemptive store of zero prior to the actual "slow" store is done through a simple ST instruction based on r10 (frame pointer) with relative offset to the stack location that the verifier has been tracking on the original used register for STX, which does not have to be r10. Thus, there are no memory dependencies for this store, since it's only using r10 and immediate constant of zero; hence af86ca4 /assumed/ a low latency operation. However, a recent attack demonstrated that this mitigation is not sufficient since the preemptive store of zero could also be turned into a "slow" store and is thus bypassed as well: [...] // r2 = oob address (e.g. scalar) // r7 = pointer to map value 31: (7b) *(u64 *)(r10 -16) = r2 // r9 will remain "fast" register, r10 will become "slow" register below 32: (bf) r9 = r10 // JIT maps BPF reg to x86 reg: // r9 -> r15 (callee saved) // r10 -> rbp // train store forward prediction to break dependency link between both r9 // and r10 by evicting them from the predictor's LRU table. 33: (61) r0 = *(u32 *)(r7 +24576) 34: (63) *(u32 *)(r7 +29696) = r0 35: (61) r0 = *(u32 *)(r7 +24580) 36: (63) *(u32 *)(r7 +29700) = r0 37: (61) r0 = *(u32 *)(r7 +24584) 38: (63) *(u32 *)(r7 +29704) = r0 39: (61) r0 = *(u32 *)(r7 +24588) 40: (63) *(u32 *)(r7 +29708) = r0 [...] 543: (61) r0 = *(u32 *)(r7 +25596) 544: (63) *(u32 *)(r7 +30716) = r0 // prepare call to bpf_ringbuf_output() helper. the latter will cause rbp // to spill to stack memory while r13/r14/r15 (all callee saved regs) remain // in hardware registers. rbp becomes slow due to push/pop latency. below is // disasm of bpf_ringbuf_output() helper for better visual context: // // ffffffff8117ee20: 41 54 push r12 // ffffffff8117ee22: 55 push rbp // ffffffff8117ee23: 53 push rbx // ffffffff8117ee24: 48 f7 c1 fc ff ff ff test rcx,0xfffffffffffffffc // ffffffff8117ee2b: 0f 85 af 00 00 00 jne ffffffff8117eee0 <-- jump taken // [...] // ffffffff8117eee0: 49 c7 c4 ea ff ff ff mov r12,0xffffffffffffffea // ffffffff8117eee7: 5b pop rbx // ffffffff8117eee8: 5d pop rbp // ffffffff8117eee9: 4c 89 e0 mov rax,r12 // ffffffff8117eeec: 41 5c pop r12 // ffffffff8117eeee: c3 ret 545: (18) r1 = map[id:4] 547: (bf) r2 = r7 548: (b7) r3 = 0 549: (b7) r4 = 4 550: (85) call bpf_ringbuf_output#194288 // instruction 551 inserted by verifier \ 551: (7a) *(u64 *)(r10 -16) = 0 | /both/ are now slow stores here // storing map value pointer r7 at fp-16 | since value of r10 is "slow". 552: (7b) *(u64 *)(r10 -16) = r7 / // following "fast" read to the same memory location, but due to dependency // misprediction it will speculatively execute before insn 551/552 completes. 553: (79) r2 = *(u64 *)(r9 -16) // in speculative domain contains attacker controlled r2. in non-speculative // domain this contains r7, and thus accesses r7 +0 below. 554: (71) r3 = *(u8 *)(r2 +0) // leak r3 As can be seen, the current speculative store bypass mitigation which the verifier inserts at line 551 is insufficient since /both/, the write of the zero sanitation as well as the map value pointer are a high latency instruction due to prior memory access via push/pop of r10 (rbp) in contrast to the low latency read in line 553 as r9 (r15) which stays in hardware registers. Thus, architecturally, fp-16 is r7, however, microarchitecturally, fp-16 can still be r2. Initial thoughts to address this issue was to track spilled pointer loads from stack and enforce their load via LDX through r10 as well so that /both/ the preemptive store of zero /as well as/ the load use the /same/ register such that a dependency is created between the store and load. However, this option is not sufficient either since it can be bypassed as well under speculation. An updated attack with pointer spill/fills now _all_ based on r10 would look as follows: [...] // r2 = oob address (e.g. scalar) // r7 = pointer to map value [...] // longer store forward prediction training sequence than before. 2062: (61) r0 = *(u32 *)(r7 +25588) 2063: (63) *(u32 *)(r7 +30708) = r0 2064: (61) r0 = *(u32 *)(r7 +25592) 2065: (63) *(u32 *)(r7 +30712) = r0 2066: (61) r0 = *(u32 *)(r7 +25596) 2067: (63) *(u32 *)(r7 +30716) = r0 // store the speculative load address (scalar) this time after the store // forward prediction training. 2068: (7b) *(u64 *)(r10 -16) = r2 // preoccupy the CPU store port by running sequence of dummy stores. 2069: (63) *(u32 *)(r7 +29696) = r0 2070: (63) *(u32 *)(r7 +29700) = r0 2071: (63) *(u32 *)(r7 +29704) = r0 2072: (63) *(u32 *)(r7 +29708) = r0 2073: (63) *(u32 *)(r7 +29712) = r0 2074: (63) *(u32 *)(r7 +29716) = r0 2075: (63) *(u32 *)(r7 +29720) = r0 2076: (63) *(u32 *)(r7 +29724) = r0 2077: (63) *(u32 *)(r7 +29728) = r0 2078: (63) *(u32 *)(r7 +29732) = r0 2079: (63) *(u32 *)(r7 +29736) = r0 2080: (63) *(u32 *)(r7 +29740) = r0 2081: (63) *(u32 *)(r7 +29744) = r0 2082: (63) *(u32 *)(r7 +29748) = r0 2083: (63) *(u32 *)(r7 +29752) = r0 2084: (63) *(u32 *)(r7 +29756) = r0 2085: (63) *(u32 *)(r7 +29760) = r0 2086: (63) *(u32 *)(r7 +29764) = r0 2087: (63) *(u32 *)(r7 +29768) = r0 2088: (63) *(u32 *)(r7 +29772) = r0 2089: (63) *(u32 *)(r7 +29776) = r0 2090: (63) *(u32 *)(r7 +29780) = r0 2091: (63) *(u32 *)(r7 +29784) = r0 2092: (63) *(u32 *)(r7 +29788) = r0 2093: (63) *(u32 *)(r7 +29792) = r0 2094: (63) *(u32 *)(r7 +29796) = r0 2095: (63) *(u32 *)(r7 +29800) = r0 2096: (63) *(u32 *)(r7 +29804) = r0 2097: (63) *(u32 *)(r7 +29808) = r0 2098: (63) *(u32 *)(r7 +29812) = r0 // overwrite scalar with dummy pointer; same as before, also including the // sanitation store with 0 from the current mitigation by the verifier. 2099: (7a) *(u64 *)(r10 -16) = 0 | /both/ are now slow stores here 2100: (7b) *(u64 *)(r10 -16) = r7 | since store unit is still busy. // load from stack intended to bypass stores. 2101: (79) r2 = *(u64 *)(r10 -16) 2102: (71) r3 = *(u8 *)(r2 +0) // leak r3 [...] Looking at the CPU microarchitecture, the scheduler might issue loads (such as seen in line 2101) before stores (line 2099,2100) because the load execution units become available while the store execution unit is still busy with the sequence of dummy stores (line 2069-2098). And so the load may use the prior stored scalar from r2 at address r10 -16 for speculation. The updated attack may work less reliable on CPU microarchitectures where loads and stores share execution resources. This concludes that the sanitizing with zero stores from af86ca4 ("bpf: Prevent memory disambiguation attack") is insufficient. Moreover, the detection of stack reuse from af86ca4 where previously data (STACK_MISC) has been written to a given stack slot where a pointer value is now to be stored does not have sufficient coverage as precondition for the mitigation either; for several reasons outlined as follows: 1) Stack content from prior program runs could still be preserved and is therefore not "random", best example is to split a speculative store bypass attack between tail calls, program A would prepare and store the oob address at a given stack slot and then tail call into program B which does the "slow" store of a pointer to the stack with subsequent "fast" read. From program B PoV such stack slot type is STACK_INVALID, and therefore also must be subject to mitigation. 2) The STACK_SPILL must not be coupled to register_is_const(&stack->spilled_ptr) condition, for example, the previous content of that memory location could also be a pointer to map or map value. Without the fix, a speculative store bypass is not mitigated in such precondition and can then lead to a type confusion in the speculative domain leaking kernel memory near these pointer types. While brainstorming on various alternative mitigation possibilities, we also stumbled upon a retrospective from Chrome developers [0]: [...] For variant 4, we implemented a mitigation to zero the unused memory of the heap prior to allocation, which cost about 1% when done concurrently and 4% for scavenging. Variant 4 defeats everything we could think of. We explored more mitigations for variant 4 but the threat proved to be more pervasive and dangerous than we anticipated. For example, stack slots used by the register allocator in the optimizing compiler could be subject to type confusion, leading to pointer crafting. Mitigating type confusion for stack slots alone would have required a complete redesign of the backend of the optimizing compiler, perhaps man years of work, without a guarantee of completeness. [...] >From BPF side, the problem space is reduced, however, options are rather limited. One idea that has been explored was to xor-obfuscate pointer spills to the BPF stack: [...] // preoccupy the CPU store port by running sequence of dummy stores. [...] 2106: (63) *(u32 *)(r7 +29796) = r0 2107: (63) *(u32 *)(r7 +29800) = r0 2108: (63) *(u32 *)(r7 +29804) = r0 2109: (63) *(u32 *)(r7 +29808) = r0 2110: (63) *(u32 *)(r7 +29812) = r0 // overwrite scalar with dummy pointer; xored with random 'secret' value // of 943576462 before store ... 2111: (b4) w11 = 943576462 2112: (af) r11 ^= r7 2113: (7b) *(u64 *)(r10 -16) = r11 2114: (79) r11 = *(u64 *)(r10 -16) 2115: (b4) w2 = 943576462 2116: (af) r2 ^= r11 // ... and restored with the same 'secret' value with the help of AX reg. 2117: (71) r3 = *(u8 *)(r2 +0) [...] While the above would not prevent speculation, it would make data leakage infeasible by directing it to random locations. In order to be effective and prevent type confusion under speculation, such random secret would have to be regenerated for each store. The additional complexity involved for a tracking mechanism that prevents jumps such that restoring spilled pointers would not get corrupted is not worth the gain for unprivileged. Hence, the fix in here eventually opted for emitting a non-public BPF_ST | BPF_NOSPEC instruction which the x86 JIT translates into a lfence opcode. Inserting the latter in between the store and load instruction is one of the mitigations options [1]. The x86 instruction manual notes: [...] An LFENCE that follows an instruction that stores to memory might complete before the data being stored have become globally visible. [...] The latter meaning that the preceding store instruction finished execution and the store is at minimum guaranteed to be in the CPU's store queue, but it's not guaranteed to be in that CPU's L1 cache at that point (globally visible). The latter would only be guaranteed via sfence. So the load which is guaranteed to execute after the lfence for that local CPU would have to rely on store-to-load forwarding. [2], in section 2.3 on store buffers says: [...] For every store operation that is added to the ROB, an entry is allocated in the store buffer. This entry requires both the virtual and physical address of the target. Only if there is no free entry in the store buffer, the frontend stalls until there is an empty slot available in the store buffer again. Otherwise, the CPU can immediately continue adding subsequent instructions to the ROB and execute them out of order. On Intel CPUs, the store buffer has up to 56 entries. [...] One small upside on the fix is that it lifts constraints from af86ca4 where the sanitize_stack_off relative to r10 must be the same when coming from different paths. The BPF_ST | BPF_NOSPEC gets emitted after a BPF_STX or BPF_ST instruction. This happens either when we store a pointer or data value to the BPF stack for the first time, or upon later pointer spills. The former needs to be enforced since otherwise stale stack data could be leaked under speculation as outlined earlier. For non-x86 JITs the BPF_ST | BPF_NOSPEC mapping is currently optimized away, but others could emit a speculation barrier as well if necessary. For real-world unprivileged programs e.g. generated by LLVM, pointer spill/fill is only generated upon register pressure and LLVM only tries to do that for pointers which are not used often. The program main impact will be the initial BPF_ST | BPF_NOSPEC sanitation for the STACK_INVALID case when the first write to a stack slot occurs e.g. upon map lookup. In future we might refine ways to mitigate the latter cost. [0] https://arxiv.org/pdf/1902.05178.pdf [1] https://msrc-blog.microsoft.com/2018/05/21/analysis-and-mitigation-of-speculative-store-bypass-cve-2018-3639/ [2] https://arxiv.org/pdf/1905.05725.pdf Fixes: af86ca4 ("bpf: Prevent memory disambiguation attack") Fixes: f7cf25b ("bpf: track spill/fill of constants") Co-developed-by: Piotr Krysiuk <[email protected]> Co-developed-by: Benedict Schlueter <[email protected]> Signed-off-by: Daniel Borkmann <[email protected]> Signed-off-by: Piotr Krysiuk <[email protected]> Signed-off-by: Benedict Schlueter <[email protected]> Acked-by: Alexei Starovoitov <[email protected]> Signed-off-by: Sasha Levin <[email protected]> [OP: - apply check_stack_write_fixed_off() changes in check_stack_write() - replace env->bypass_spec_v4 -> env->allow_ptr_leaks] Signed-off-by: Ovidiu Panait <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
commit c9e73e3 upstream. func_states_equal makes a very short lived allocation for idmap, probably because it's too large to fit on the stack. However the function is called quite often, leading to a lot of alloc / free churn. Replace the temporary allocation with dedicated scratch space in struct bpf_verifier_env. Signed-off-by: Lorenz Bauer <[email protected]> Signed-off-by: Alexei Starovoitov <[email protected]> Acked-by: Edward Cree <[email protected]> Link: https://lore.kernel.org/bpf/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]> [OP: adjusted context for 5.4] Signed-off-by: Ovidiu Panait <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
commit e042aa5 upstream. In 7fedb63 ("bpf: Tighten speculative pointer arithmetic mask") we narrowed the offset mask for unprivileged pointer arithmetic in order to mitigate a corner case where in the speculative domain it is possible to advance, for example, the map value pointer by up to value_size-1 out-of- bounds in order to leak kernel memory via side-channel to user space. The verifier's state pruning for scalars leaves one corner case open where in the first verification path R_x holds an unknown scalar with an aux->alu_limit of e.g. 7, and in a second verification path that same register R_x, here denoted as R_x', holds an unknown scalar which has tighter bounds and would thus satisfy range_within(R_x, R_x') as well as tnum_in(R_x, R_x') for state pruning, yielding an aux->alu_limit of 3: Given the second path fits the register constraints for pruning, the final generated mask from aux->alu_limit will remain at 7. While technically not wrong for the non-speculative domain, it would however be possible to craft similar cases where the mask would be too wide as in 7fedb63. One way to fix it is to detect the presence of unknown scalar map pointer arithmetic and force a deeper search on unknown scalars to ensure that we do not run into a masking mismatch. Signed-off-by: Daniel Borkmann <[email protected]> Acked-by: Alexei Starovoitov <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> [OP: adjusted context in include/linux/bpf_verifier.h for 5.4] Signed-off-by: Ovidiu Panait <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
commit 39ff83f upstream. timespec64_ns() prevents multiplication overflows by comparing the seconds value of the timespec to KTIME_SEC_MAX. If the value is greater or equal it returns KTIME_MAX. But that check casts the signed seconds value to unsigned which makes the comparision true for all negative values and therefore return wrongly KTIME_MAX. Negative second values are perfectly valid and required in some places, e.g. ptp_clock_adjtime(). Remove the cast and add a check for the negative boundary which is required to prevent undefined behaviour due to multiplication underflow. Fixes: cb47755 ("time: Prevent undefined behaviour in timespec64_to_ns()")' Signed-off-by: Lukas Hannen <[email protected]> Signed-off-by: Thomas Gleixner <[email protected]> Cc: [email protected] Link: https://lore.kernel.org/r/AM6PR01MB541637BD6F336B8FFB72AF80EEC69@AM6PR01MB5416.eurprd01.prod.exchangelabs.com Signed-off-by: Greg Kroah-Hartman <[email protected]>
commit bb2853a upstream. The ops->receive_buf() may be accessed concurrently from these two functions. If the driver flushes data to the line discipline receive_buf() method while tiocsti() is waiting for the ops->receive_buf() to finish its work, the data race will happen. For example: tty_ioctl |tty_ldisc_receive_buf ->tioctsi | ->tty_port_default_receive_buf | ->tty_ldisc_receive_buf ->hci_uart_tty_receive | ->hci_uart_tty_receive ->h4_recv | ->h4_recv In this case, the h4 receive buffer will be overwritten by the latecomer, and we will lost the data. Hence, change tioctsi() function to use the exclusive lock interface from tty_buffer to avoid the data race. Reported-by: [email protected] Reviewed-by: Jiri Slaby <[email protected]> Signed-off-by: Nguyen Dinh Phi <[email protected]> Link: https://lore.kernel.org/r/[email protected] Cc: stable <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
commit f11dd0d upstream. Commit: 2ff4025 ("perf/core, arch/x86: Use PERF_PMU_CAP_NO_EXCLUDE for exclusion incapable PMUs") neglected to do so. Fixes: 2ff4025 ("perf/core, arch/x86: Use PERF_PMU_CAP_NO_EXCLUDE for exclusion incapable PMUs") Signed-off-by: Kim Phillips <[email protected]> Signed-off-by: Peter Zijlstra (Intel) <[email protected]> Signed-off-by: Ingo Molnar <[email protected]> Cc: [email protected] Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
commit 527f721 upstream. The recent commit 064855a ("x86/resctrl: Fix default monitoring groups reporting") caused a RHEL build failure with an uninitialized variable warning treated as an error because it removed the default case snippet. The RHEL Makefile uses '-Werror=maybe-uninitialized' to force possibly uninitialized variable warnings to be treated as errors. This is also reported by smatch via the 0day robot. The error from the RHEL build is: arch/x86/kernel/cpu/resctrl/monitor.c: In function ‘__mon_event_count’: arch/x86/kernel/cpu/resctrl/monitor.c:261:12: error: ‘m’ may be used uninitialized in this function [-Werror=maybe-uninitialized] m->chunks += chunks; ^~ The upstream Makefile does not build using '-Werror=maybe-uninitialized'. So, the problem is not seen there. Fix the problem by putting back the default case snippet. [ bp: note that there's nothing wrong with the code and other compilers do not trigger this warning - this is being done just so the RHEL compiler is happy. ] Fixes: 064855a ("x86/resctrl: Fix default monitoring groups reporting") Reported-by: Terry Bowman <[email protected]> Reported-by: kernel test robot <[email protected]> Signed-off-by: Babu Moger <[email protected]> Signed-off-by: Borislav Petkov <[email protected]> Reviewed-by: Reinette Chatre <[email protected]> Cc: [email protected] Link: https://lkml.kernel.org/r/162949631908.23903.17090272726012848523.stgit@bmoger-ubuntu Signed-off-by: Greg Kroah-Hartman <[email protected]>
commit a3e03bc upstream. While in practice vcpu->vcpu_idx == vcpu->vcp_id is often true, it may not always be, and we must not rely on this. Reason is that KVM decides the vcpu_idx, userspace decides the vcpu_id, thus the two might not match. Currently kvm->arch.idle_mask is indexed by vcpu_id, which implies that code like for_each_set_bit(vcpu_id, kvm->arch.idle_mask, online_vcpus) { vcpu = kvm_get_vcpu(kvm, vcpu_id); do_stuff(vcpu); } is not legit. Reason is that kvm_get_vcpu expects an vcpu_idx, not an vcpu_id. The trouble is, we do actually use kvm->arch.idle_mask like this. To fix this problem we have two options. Either use kvm_get_vcpu_by_id(vcpu_id), which would loop to find the right vcpu_id, or switch to indexing via vcpu_idx. The latter is preferable for obvious reasons. Let us make switch from indexing kvm->arch.idle_mask by vcpu_id to indexing it by vcpu_idx. To keep gisa_int.kicked_mask indexed by the same index as idle_mask lets make the same change for it as well. Fixes: 1ee0bc5 ("KVM: s390: get rid of local_int array") Signed-off-by: Halil Pasic <[email protected]> Reviewed-by: Christian Bornträger <[email protected]> Reviewed-by: Claudio Imbrenda <[email protected]> Cc: <[email protected]> # 3.15+ Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Christian Borntraeger <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
… is adjusted commit d9130a2 upstream. When MSR_IA32_TSC_ADJUST is written by guest due to TSC ADJUST feature especially there's a big tsc warp (like a new vCPU is hot-added into VM which has been up for a long time), tsc_offset is added by a large value then go back to guest. This causes system time jump as tsc_timestamp is not adjusted in the meantime and pvclock monotonic character. To fix this, just notify kvm to update vCPU's guest time before back to guest. Cc: [email protected] Signed-off-by: Zelin Deng <[email protected]> Signed-off-by: Paolo Bonzini <[email protected]> Message-Id: <[email protected]> Signed-off-by: Paolo Bonzini <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
commit f7782bb upstream. Clear nested.pi_pending on nested VM-Enter even if L2 will run without posted interrupts enabled. If nested.pi_pending is left set from a previous L2, vmx_complete_nested_posted_interrupt() will pick up the stale flag and exit to userspace with an "internal emulation error" due the new L2 not having a valid nested.pi_desc. Arguably, vmx_complete_nested_posted_interrupt() should first check for posted interrupts being enabled, but it's also completely reasonable that KVM wouldn't screw up a fundamental flag. Not to mention that the mere existence of nested.pi_pending is a long-standing bug as KVM shouldn't move the posted interrupt out of the IRR until it's actually processed, e.g. KVM effectively drops an interrupt when it performs a nested VM-Exit with a "pending" posted interrupt. Fixing the mess is a future problem. Prior to vmx_complete_nested_posted_interrupt() interpreting a null PI descriptor as an error, this was a benign bug as the null PI descriptor effectively served as a check on PI not being enabled. Even then, the new flow did not become problematic until KVM started checking the result of kvm_check_nested_events(). Fixes: 705699a ("KVM: nVMX: Enable nested posted interrupt processing") Fixes: 966eefb ("KVM: nVMX: Disable vmcs02 posted interrupts if vmcs12 PID isn't mappable") Fixes: 47d3530 ("KVM: x86: Exit to userspace when kvm_check_nested_events fails") Cc: [email protected] Cc: Jim Mattson <[email protected]> Signed-off-by: Sean Christopherson <[email protected]> Message-Id: <[email protected]> Signed-off-by: Paolo Bonzini <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
commit 7622435 upstream. fuse_finish_open() will be called with FUSE_NOWRITE in case of atomic O_TRUNC. This can deadlock with fuse_wait_on_page_writeback() in fuse_launder_page() triggered by invalidate_inode_pages2(). Fix by replacing invalidate_inode_pages2() in fuse_finish_open() with a truncate_pagecache() call. This makes sense regardless of FOPEN_KEEP_CACHE or fc->writeback cache, so do it unconditionally. Reported-by: Xie Yongji <[email protected]> Reported-and-tested-by: [email protected] Fixes: e464830 ("fuse: truncate pending writes on O_TRUNC") Cc: <[email protected]> Signed-off-by: Miklos Szeredi <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
commit 59bda8e upstream. Callers of fuse_writeback_range() assume that the file is ready for modification by the server in the supplied byte range after the call returns. If there's a write that extends the file beyond the end of the supplied range, then the file needs to be extended to at least the end of the range, but currently that's not done. There are at least two cases where this can cause problems: - copy_file_range() will return short count if the file is not extended up to end of the source range. - FALLOC_FL_ZERO_RANGE | FALLOC_FL_KEEP_SIZE will not extend the file, hence the region may not be fully allocated. Fix by flushing writes from the start of the range up to the end of the file. This could be optimized if the writes are non-extending, etc, but it's probably not worth the trouble. Fixes: a2bc923 ("fuse: fix copy_file_range() in the writeback case") Fixes: 6b1bdb5 ("fuse: allow fallocate(FALLOC_FL_ZERO_RANGE)") Cc: <[email protected]> # v5.2 Signed-off-by: Miklos Szeredi <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
commit a32ad90 upstream. With W=1 build, the compiler throws warning message as below: security/integrity/ima/ima_mok.c:24:12: warning: no previous prototype for ‘ima_mok_init’ [-Wmissing-prototypes] __init int ima_mok_init(void) Silence the warning by adding static keyword to ima_mok_init(). Signed-off-by: Austin Kim <[email protected]> Fixes: 41c89b6 ("IMA: create machine owner and blacklist keyrings") Cc: [email protected] Signed-off-by: Mimi Zohar <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
commit 8510505 upstream. MD5 is a weak digest algorithm that shouldn't be used for cryptographic operation. It hinders the efficiency of a patch set that aims to limit the digests allowed for the extended file attribute namely security.ima. MD5 is no longer a requirement for IMA, nor should it be used there. The sole place where we still use the MD5 algorithm inside IMA is setting the ima_hash algorithm to MD5, if the user supplies 'ima_hash=md5' parameter on the command line. With commit ab60368 ("ima: Fallback to the builtin hash algorithm"), setting "ima_hash=md5" fails gracefully when CRYPTO_MD5 is not set: ima: Can not allocate md5 (reason: -2) ima: Allocating md5 failed, going to use default hash algorithm sha256 Remove the CRYPTO_MD5 dependency for IMA. Signed-off-by: THOBY Simon <[email protected]> Reviewed-by: Lakshmi Ramasubramanian <[email protected]> [[email protected]: include commit number in patch description for stable.] Cc: [email protected] # 4.17 Signed-off-by: Mimi Zohar <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
commit 8c28051 upstream. syzbot is reporting page fault at vga16fb_fillrect() [1], for vga16fb_check_var() is failing to detect multiplication overflow. if (vxres * vyres > maxmem) { vyres = maxmem / vxres; if (vyres < yres) return -ENOMEM; } Since no module would accept too huge resolutions where multiplication overflow happens, let's reject in the common path. Link: https://syzkaller.appspot.com/bug?extid=04168c8063cfdde1db5e [1] Reported-by: syzbot <[email protected]> Debugged-by: Randy Dunlap <[email protected]> Signed-off-by: Tetsuo Handa <[email protected]> Reviewed-by: Geert Uytterhoeven <[email protected]> Cc: [email protected] Signed-off-by: Daniel Vetter <[email protected]> Link: https://patchwork.freedesktop.org/patch/msgid/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
commit 79fad92 upstream. Currently there are (at least) two problems in the way pwm_bl starts managing the enable_gpio pin. Both occur when the backlight is initially off and the driver finds the pin not already in output mode and, as a result, unconditionally switches it to output-mode and asserts the signal. Problem 1: This could cause the backlight to flicker since, at this stage in driver initialisation, we have no idea what the PWM and regulator are doing (an unconfigured PWM could easily "rest" at 100% duty cycle). Problem 2: This will cause us not to correctly honour the post_pwm_on_delay (which also risks flickers). Fix this by moving the code to configure the GPIO output mode until after we have examines the handover state. That allows us to initialize enable_gpio to off if the backlight is currently off and on if the backlight is on. Cc: [email protected] Reported-by: Marek Vasut <[email protected]> Signed-off-by: Daniel Thompson <[email protected]> Acked-by: Marek Vasut <[email protected]> Tested-by: Marek Vasut <[email protected]> Signed-off-by: Lee Jones <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
commit aaedb9e upstream. Since a few kernel releases the Pogoplug 4 has crashed like this during boot: Unable to handle kernel NULL pointer dereference at virtual address 00000002 (...) [<c04116ec>] (strlen) from [<c00ead80>] (kstrdup+0x1c/0x4c) [<c00ead80>] (kstrdup) from [<c04591d8>] (__clk_register+0x44/0x37c) [<c04591d8>] (__clk_register) from [<c04595ec>] (clk_hw_register+0x20/0x44) [<c04595ec>] (clk_hw_register) from [<c045bfa8>] (__clk_hw_register_mux+0x198/0x1e4) [<c045bfa8>] (__clk_hw_register_mux) from [<c045c050>] (clk_register_mux_table+0x5c/0x6c) [<c045c050>] (clk_register_mux_table) from [<c0acf3e0>] (kirkwood_clk_muxing_setup.constprop.0+0x13c/0x1ac) [<c0acf3e0>] (kirkwood_clk_muxing_setup.constprop.0) from [<c0aceae0>] (of_clk_init+0x12c/0x214) [<c0aceae0>] (of_clk_init) from [<c0ab576c>] (time_init+0x20/0x2c) [<c0ab576c>] (time_init) from [<c0ab3d18>] (start_kernel+0x3dc/0x56c) [<c0ab3d18>] (start_kernel) from [<00000000>] (0x0) Code: e3130020 1afffffb e12fff1e c08a1078 (e5d03000) This is because the "powersave" mux clock 0 was provided in an unterminated array, which is required by the loop in the driver: /* Count, allocate, and register clock muxes */ for (n = 0; desc[n].name;) n++; Here n will go out of bounds and then call clk_register_mux() on random memory contents after the mux clock. Fix this by terminating the array with a blank entry. Fixes: 1052993 ("cpufreq: kirkwood: use the powersave multiplexer") Cc: [email protected] Cc: Andrew Lunn <[email protected]> Cc: Chris Packham <[email protected]> Cc: Gregory CLEMENT <[email protected]> Cc: Sebastian Hesselbarth <[email protected]> Signed-off-by: Linus Walleij <[email protected]> Link: https://lore.kernel.org/r/[email protected] Reviewed-by: Andrew Lunn <[email protected]> Signed-off-by: Stephen Boyd <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
Link: https://lore.kernel.org/r/[email protected] Tested-by: Florian Fainelli <[email protected]> Tested-by: Shuah Khan <[email protected]> Tested-by: Jon Hunter <[email protected]> Tested-by: Linux Kernel Functional Testing <[email protected]> Tested-by: Guenter Roeck <[email protected]> Tested-by: Sudip Mukherjee <[email protected]> Tested-by: Hulk Robot <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
…ueue" This reverts commit abbcd61. Botched backport, dropping to reword for next release. Reported-by: Guenter Roeck <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
This reverts commit b3fa499 which is commit b1a8116 upstream. The backport of this is reported to be causing some problems, so revert this for now until they are worked out. Link: https://lore.kernel.org/r/CACPK8XfUWoOHr-0RwRoYoskia4fbAbZ7DYf5wWBnv6qUnGq18w@mail.gmail.com Reported-by: Joel Stanley <[email protected]> Cc: Christoph Hellwig <[email protected]> Cc: Pavel Skripkin <[email protected]> Cc: Jens Axboe <[email protected]> Cc: Sasha Levin <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
…eset" This reverts commit c322a96 which is commit 406dd42 upstream. It is reported to cause regressions. A proposed fix has been posted, but it is not in a released kernel yet. So just revert this from the stable release so that the bug is fixed. If it's really needed we can add it back in in a future release. Link: https://lore.kernel.org/r/[email protected] Reported-by: "Alan J. Wylie" <[email protected]> Cc: Linus Torvalds <[email protected]> Cc: Frederic Weisbecker <[email protected]> Cc: Thomas Gleixner <[email protected]> Cc: Peter Zijlstra (Intel) <[email protected]> Cc: Sasha Levin <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
This reverts commit 7a25a0a which is commit 39ff83f upstream. Arnd reports that this needs more review before being merged into all of the trees. Link: https://lore.kernel.org/r/CAK8P3a0z5jE=Z3Ps5bFTCFT7CHZR1JQ8VhdntDJAfsUxSPCcEw@mail.gmail.com Reported-by: Arnd Bergmann <[email protected]> Cc: Lukas Hannen <[email protected]> Cc: Thomas Gleixner <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
This is the 5.4.147 stable release Signed-off-by: Andrey Zhizhikin <[email protected]>
zandrey
added a commit
to zandrey/meta-freescale
that referenced
this pull request
Sep 20, 2021
Kernel repository has been upgraded up to v5.4.147 from stable korg.
Following upstream commits are included in this version:
----
48a24510c328 Linux 5.4.147
1f8ee024498d Revert "time: Handle negative seconds correctly in timespec64_to_ns()"
dc15f641c6cc Revert "posix-cpu-timers: Force next expiration recalc after itimer reset"
541e757944aa Revert "block: nbd: add sanity check for first_minor"
5f3ecbf4d586 Revert "Bluetooth: Move shutdown callback before flushing tx and rx queue"
245f15a48cdc Linux 5.4.146
b40facee46db clk: kirkwood: Fix a clocking boot regression
8810c51077b0 backlight: pwm_bl: Improve bootloader/kernel device handover
5de2ee621bc4 fbmem: don't allow too huge resolutions
4a95b04afab5 IMA: remove the dependency on CRYPTO_MD5
c69935f0b0aa IMA: remove -Wmissing-prototypes warning
85b0726d5bd7 fuse: flush extending writes
8a98ced6e1c8 fuse: truncate pagecache on atomic_o_trunc
06dad664d4ea KVM: nVMX: Unconditionally clear nested.pi_pending on nested VM-Enter
1735cec1e83c KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted
20fff3ef33b2 KVM: s390: index kvm->arch.idle_mask by vcpu_idx
0323ab5b254e x86/resctrl: Fix a maybe-uninitialized build warning treated as error
51f4575ca182 perf/x86/amd/ibs: Extend PERF_PMU_CAP_NO_EXCLUDE to IBS Op
03c3e977eeac tty: Fix data race between tiocsti() and flush_to_ldisc()
7a25a0a94c8b time: Handle negative seconds correctly in timespec64_to_ns()
ae968e270f2e bpf: Fix pointer arithmetic mask tightening under state pruning
a0a4778feae1 bpf: verifier: Allocate idmap scratch in verifier env
f5893af2704e bpf: Fix leakage due to insufficient speculative store bypass mitigation
e80c3533c354 bpf: Introduce BPF nospec instruction for mitigating Spectre v4
1c9424a765af ipv4: fix endianness issue in inet_rtm_getroute_build_skb()
b3fe6d192126 octeontx2-af: Fix loop in free and unmap counter
8216d7157bcf net: qualcomm: fix QCA7000 checksum handling
4648917e499c net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed
e46e23c289f6 ipv4: make exception cache less predictible
f73cbdd1b8e7 ipv6: make exception cache less predictible
aa167dcde4c7 brcmfmac: pcie: fix oops on failure to resume and reprobe
5debec63a28f bcma: Fix memory leak for internally-handled cores
574e563649ec ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point()
d946e685d6b7 ASoC: wcd9335: Disable irq on slave ports in the remove function
f3ec07f832bb ASoC: wcd9335: Fix a memory leak in the error handling path of the probe function
a6088f4ed3fc ASoC: wcd9335: Fix a double irq free in the remove function
7bfa680f3b47 tty: serial: fsl_lpuart: fix the wrong mapbase value
0f1375fa693b usb: bdc: Fix an error handling path in 'bdc_probe()' when no suitable DMA config is available
06203abb7275 usb: ehci-orion: Handle errors of clk_prepare_enable() in probe
a0a9ecca2dc4 i2c: mt65xx: fix IRQ check
b444064a0e0e CIFS: Fix a potencially linear read overflow
e37eeaf9506c bpf: Fix possible out of bound write in narrow load handling
fb8e695e9cfa mmc: moxart: Fix issue with uninitialized dma_slave_config
48b1f117e8d0 mmc: dw_mmc: Fix issue with uninitialized dma_slave_config
57314d8414d1 ASoC: Intel: Skylake: Fix module resource and format selection
92397571c243 ASoC: Intel: Skylake: Leave data as is when invoking TLV IPCs
b58cf18e384d rsi: fix an error code in rsi_probe()
d82fe3dd0b0f rsi: fix error code in rsi_load_9116_firmware()
4be8deab6f0d i2c: s3c2410: fix IRQ check
da3e5f32049a i2c: iop3xx: fix deferred probing
2da3272ae0ea Bluetooth: add timeout sanity check to hci_inquiry
70d71611eb83 mm/swap: consider max pages in iomap_swapfile_add_extent
8f5e26053c46 usb: gadget: mv_u3d: request_irq() after initializing UDC
eb3c6a25012f nfsd4: Fix forced-expiry locking
81e69d3fdd9e lockd: Fix invalid lockowner cast after vfs_test_lock
e1c02e2e6a7a mac80211: Fix insufficient headroom issue for AMSDU
606668e24a0d usb: phy: tahvo: add IRQ check
ecf18ac8ff76 usb: host: ohci-tmio: add IRQ check
abbcd61d091f Bluetooth: Move shutdown callback before flushing tx and rx queue
93ec1fd04f0f usb: gadget: udc: renesas_usb3: Fix soc_device_match() abuse
30d9607bcd73 usb: phy: twl6030: add IRQ checks
e1473ac28563 usb: phy: fsl-usb: add IRQ check
9535f55d0cba usb: gadget: udc: at91: add IRQ check
05e5b16b79dc drm/msm/dsi: Fix some reference counted resource leaks
5ccb04c6e1fb Bluetooth: fix repeated calls to sco_sock_kill
c2451d5439d0 counter: 104-quad-8: Return error when invalid mode during ceiling_write
a1194b805c90 arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7
1b6fcd10375a drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary LMs
156eaacba3d2 PM: EM: Increase energy calculation precision
5537dc810b2a Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow
c0faa638f016 debugfs: Return error during {full/open}_proxy_open() on rmmod
f44714b4eb2a soc: qcom: smsm: Fix missed interrupts if state changes while masked
e7997fe3e9ca PCI: PM: Enable PME if it can be signaled from D3cold
9e570f3d4777 PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently
f865b316ccc6 media: venus: venc: Fix potential null pointer dereference on pointer fmt
d2ea2f0725cc media: em28xx-input: fix refcount bug in em28xx_usb_disconnect
ebf570042b5f leds: trigger: audio: Add an activate callback to ensure the initial brightness is set
0a01dc77662c leds: lt3593: Put fwnode in any case during ->probe()
e39c73563a38 i2c: highlander: add IRQ check
fba783ddd945 net: cipso: fix warnings in netlbl_cipsov4_add_std
9fdac650c413 cgroup/cpuset: Fix a partition bug with hotplug
ffde05819953 net/mlx5e: Prohibit inner indir TIRs in IPoIB
87f817c560e6 ARM: dts: meson8b: ec100: Fix the pwm regulator supply properties
e55d7cbe1fe2 ARM: dts: meson8b: mxq: Fix the pwm regulator supply properties
4b0bbc412b51 ARM: dts: meson8b: odroidc1: Fix the pwm regulator supply properties
f7058060c01b ARM: dts: meson8: Use a higher default GPU clock frequency
37ed461b52e9 tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos
952136275367 drm/amdgpu/acp: Make PM domain really work
252fad3d0234 netns: protect netns ID lookups with RCU
bd1cd32caa67 6lowpan: iphc: Fix an off-by-one check of array index
c4895cf45fd5 Bluetooth: sco: prevent information leak in sco_conn_defer_accept()
a96eb96ce4c1 media: coda: fix frame_mem_ctrl for YUV420 and YVU420 formats
7163014d7d29 media: go7007: remove redundant initialization
810149287981 media: dvb-usb: Fix error handling in dvb_usb_i2c_init
fa8aaa769092 media: dvb-usb: fix uninit-value in vp702x_read_mac_addr
88933f9c93a0 media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init
f81c89614ee8 soc: qcom: rpmhpd: Use corner in power_off
5b3987f58325 arm64: dts: renesas: r8a77995: draak: Remove bogus adv7511w properties
6c106c73208a ARM: dts: aspeed-g6: Fix HVI3C function-group in pinctrl dtsi
004778bf390a bpf: Fix potential memleak and UAF in the verifier.
fa4802c54e69 bpf: Fix a typo of reuseport map in bpf.h.
9a193caf9d79 media: cxd2880-spi: Fix an error handling path
34106f526015 soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally
b92893053003 media: TDA1997x: enable EDID support
43282ca83ace drm/panfrost: Fix missing clk_disable_unprepare() on error in panfrost_clk_init()
fc9cf2229087 EDAC/i10nm: Fix NVDIMM detection
32d8a3684bba spi: spi-zynq-qspi: use wait_for_completion_timeout to make zynq_qspi_exec_mem_op not interruptible
4206dbc9857b spi: sprd: Fix the wrong WDG_LOAD_VAL
1f70517eac57 regulator: vctrl: Avoid lockdep warning in enable/disable ops
d255d6a6457f regulator: vctrl: Use locked regulator_get_voltage in probe path
013177ccc4c5 certs: Trigger creation of RSA module signing key if it's not an RSA key
cc74533a47c9 crypto: qat - use proper type for vf_mask
b3fa499d72a0 block: nbd: add sanity check for first_minor
c60a31db3990 clocksource/drivers/sh_cmt: Fix wrong setting if don't request IRQ for clock source channel
6b10d3d3a9ff lib/mpi: use kcalloc in mpi_resize
57c8e2ea47bc genirq/timings: Fix error return code in irq_timings_test_irqs()
2d00b22c8b81 spi: spi-pic32: Fix issue with uninitialized dma_slave_config
b29593d0696d spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config
449884aeb358 sched: Fix UCLAMP_FLAG_IDLE setting
67da2d9c9e99 m68k: emu: Fix invalid free in nfeth_cleanup()
c68ba4a708fb s390/debug: fix debug area life cycle
7a67a00ea8a7 s390/kasan: fix large PMD pages address alignment check
98296eb3deca udf_get_extendedattr() had no boundary checks.
ae4240d1f4bf fcntl: fix potential deadlock for &fasync_struct.fa_lock
a6273c8c2aca crypto: qat - do not export adf_iov_putmsg()
7dfa7bb69e13 crypto: qat - fix naming for init/shutdown VF to PF notifications
843b4e713a80 crypto: qat - fix reuse of completion variable
4a988264556c crypto: qat - handle both source of interrupt in VF ISR
c2b3f81125a6 crypto: qat - do not ignore errors from enable_vf2pf_comms()
1c189ccef0cf libata: fix ata_host_start()
e55b627d6e1f s390/cio: add dev_busid sysfs entry for each subchannel
0423517520d3 power: supply: max17042_battery: fix typo in MAx17042_TOFF
eb45ae88bf10 nvmet: pass back cntlid on successful completion
6cb5d6ae687d nvme-rdma: don't update queue count when failing to set io queues
3073ec7f0642 nvme-tcp: don't update queue count when failing to set io queues
93cf19b4d9b3 bcache: add proper error unwinding in bcache_device_init
e55f20798f53 isofs: joliet: Fix iocharset=utf8 mount option
0f5cd92e5eb5 udf: Fix iocharset=utf8 mount option
86987cf0fbd2 udf: Check LVID earlier
cc608af36e00 hrtimer: Ensure timerfd notification for HIGHRES=n
a8457878307f hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns()
c322a963d522 posix-cpu-timers: Force next expiration recalc after itimer reset
28996dbb8a74 rcu/tree: Handle VM stoppage in stall detection
b7c560ae51c6 sched/deadline: Fix missing clock update in migrate_task_rq_dl()
40db13e3efce crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop()
ebf0f71ae3bd power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors
bba2b82d1b48 sched/deadline: Fix reset_on_fork reporting of DL tasks
53a6ef40c6bc crypto: mxs-dcp - Check for DMA mapping errors
344a38789ab2 regmap: fix the offset of register error log
a5e42516a61e locking/mutex: Fix HANDOFF condition
----
Link: https://lore.kernel.org/r/[email protected] # v5.4.145
Link: https://lore.kernel.org/r/[email protected] # v5.4.146
Link: Freescale/linux-fslc#444
Signed-off-by: Andrey Zhizhikin <[email protected]>
zandrey
added a commit
to zandrey/meta-freescale
that referenced
this pull request
Sep 20, 2021
Kernel repository has been upgraded up to v5.4.147 from stable korg.
Following upstream commits are included in this version:
----
48a24510c328 Linux 5.4.147
1f8ee024498d Revert "time: Handle negative seconds correctly in timespec64_to_ns()"
dc15f641c6cc Revert "posix-cpu-timers: Force next expiration recalc after itimer reset"
541e757944aa Revert "block: nbd: add sanity check for first_minor"
5f3ecbf4d586 Revert "Bluetooth: Move shutdown callback before flushing tx and rx queue"
245f15a48cdc Linux 5.4.146
b40facee46db clk: kirkwood: Fix a clocking boot regression
8810c51077b0 backlight: pwm_bl: Improve bootloader/kernel device handover
5de2ee621bc4 fbmem: don't allow too huge resolutions
4a95b04afab5 IMA: remove the dependency on CRYPTO_MD5
c69935f0b0aa IMA: remove -Wmissing-prototypes warning
85b0726d5bd7 fuse: flush extending writes
8a98ced6e1c8 fuse: truncate pagecache on atomic_o_trunc
06dad664d4ea KVM: nVMX: Unconditionally clear nested.pi_pending on nested VM-Enter
1735cec1e83c KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted
20fff3ef33b2 KVM: s390: index kvm->arch.idle_mask by vcpu_idx
0323ab5b254e x86/resctrl: Fix a maybe-uninitialized build warning treated as error
51f4575ca182 perf/x86/amd/ibs: Extend PERF_PMU_CAP_NO_EXCLUDE to IBS Op
03c3e977eeac tty: Fix data race between tiocsti() and flush_to_ldisc()
7a25a0a94c8b time: Handle negative seconds correctly in timespec64_to_ns()
ae968e270f2e bpf: Fix pointer arithmetic mask tightening under state pruning
a0a4778feae1 bpf: verifier: Allocate idmap scratch in verifier env
f5893af2704e bpf: Fix leakage due to insufficient speculative store bypass mitigation
e80c3533c354 bpf: Introduce BPF nospec instruction for mitigating Spectre v4
1c9424a765af ipv4: fix endianness issue in inet_rtm_getroute_build_skb()
b3fe6d192126 octeontx2-af: Fix loop in free and unmap counter
8216d7157bcf net: qualcomm: fix QCA7000 checksum handling
4648917e499c net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed
e46e23c289f6 ipv4: make exception cache less predictible
f73cbdd1b8e7 ipv6: make exception cache less predictible
aa167dcde4c7 brcmfmac: pcie: fix oops on failure to resume and reprobe
5debec63a28f bcma: Fix memory leak for internally-handled cores
574e563649ec ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point()
d946e685d6b7 ASoC: wcd9335: Disable irq on slave ports in the remove function
f3ec07f832bb ASoC: wcd9335: Fix a memory leak in the error handling path of the probe function
a6088f4ed3fc ASoC: wcd9335: Fix a double irq free in the remove function
7bfa680f3b47 tty: serial: fsl_lpuart: fix the wrong mapbase value
0f1375fa693b usb: bdc: Fix an error handling path in 'bdc_probe()' when no suitable DMA config is available
06203abb7275 usb: ehci-orion: Handle errors of clk_prepare_enable() in probe
a0a9ecca2dc4 i2c: mt65xx: fix IRQ check
b444064a0e0e CIFS: Fix a potencially linear read overflow
e37eeaf9506c bpf: Fix possible out of bound write in narrow load handling
fb8e695e9cfa mmc: moxart: Fix issue with uninitialized dma_slave_config
48b1f117e8d0 mmc: dw_mmc: Fix issue with uninitialized dma_slave_config
57314d8414d1 ASoC: Intel: Skylake: Fix module resource and format selection
92397571c243 ASoC: Intel: Skylake: Leave data as is when invoking TLV IPCs
b58cf18e384d rsi: fix an error code in rsi_probe()
d82fe3dd0b0f rsi: fix error code in rsi_load_9116_firmware()
4be8deab6f0d i2c: s3c2410: fix IRQ check
da3e5f32049a i2c: iop3xx: fix deferred probing
2da3272ae0ea Bluetooth: add timeout sanity check to hci_inquiry
70d71611eb83 mm/swap: consider max pages in iomap_swapfile_add_extent
8f5e26053c46 usb: gadget: mv_u3d: request_irq() after initializing UDC
eb3c6a25012f nfsd4: Fix forced-expiry locking
81e69d3fdd9e lockd: Fix invalid lockowner cast after vfs_test_lock
e1c02e2e6a7a mac80211: Fix insufficient headroom issue for AMSDU
606668e24a0d usb: phy: tahvo: add IRQ check
ecf18ac8ff76 usb: host: ohci-tmio: add IRQ check
abbcd61d091f Bluetooth: Move shutdown callback before flushing tx and rx queue
93ec1fd04f0f usb: gadget: udc: renesas_usb3: Fix soc_device_match() abuse
30d9607bcd73 usb: phy: twl6030: add IRQ checks
e1473ac28563 usb: phy: fsl-usb: add IRQ check
9535f55d0cba usb: gadget: udc: at91: add IRQ check
05e5b16b79dc drm/msm/dsi: Fix some reference counted resource leaks
5ccb04c6e1fb Bluetooth: fix repeated calls to sco_sock_kill
c2451d5439d0 counter: 104-quad-8: Return error when invalid mode during ceiling_write
a1194b805c90 arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7
1b6fcd10375a drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary LMs
156eaacba3d2 PM: EM: Increase energy calculation precision
5537dc810b2a Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow
c0faa638f016 debugfs: Return error during {full/open}_proxy_open() on rmmod
f44714b4eb2a soc: qcom: smsm: Fix missed interrupts if state changes while masked
e7997fe3e9ca PCI: PM: Enable PME if it can be signaled from D3cold
9e570f3d4777 PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently
f865b316ccc6 media: venus: venc: Fix potential null pointer dereference on pointer fmt
d2ea2f0725cc media: em28xx-input: fix refcount bug in em28xx_usb_disconnect
ebf570042b5f leds: trigger: audio: Add an activate callback to ensure the initial brightness is set
0a01dc77662c leds: lt3593: Put fwnode in any case during ->probe()
e39c73563a38 i2c: highlander: add IRQ check
fba783ddd945 net: cipso: fix warnings in netlbl_cipsov4_add_std
9fdac650c413 cgroup/cpuset: Fix a partition bug with hotplug
ffde05819953 net/mlx5e: Prohibit inner indir TIRs in IPoIB
87f817c560e6 ARM: dts: meson8b: ec100: Fix the pwm regulator supply properties
e55d7cbe1fe2 ARM: dts: meson8b: mxq: Fix the pwm regulator supply properties
4b0bbc412b51 ARM: dts: meson8b: odroidc1: Fix the pwm regulator supply properties
f7058060c01b ARM: dts: meson8: Use a higher default GPU clock frequency
37ed461b52e9 tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos
952136275367 drm/amdgpu/acp: Make PM domain really work
252fad3d0234 netns: protect netns ID lookups with RCU
bd1cd32caa67 6lowpan: iphc: Fix an off-by-one check of array index
c4895cf45fd5 Bluetooth: sco: prevent information leak in sco_conn_defer_accept()
a96eb96ce4c1 media: coda: fix frame_mem_ctrl for YUV420 and YVU420 formats
7163014d7d29 media: go7007: remove redundant initialization
810149287981 media: dvb-usb: Fix error handling in dvb_usb_i2c_init
fa8aaa769092 media: dvb-usb: fix uninit-value in vp702x_read_mac_addr
88933f9c93a0 media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init
f81c89614ee8 soc: qcom: rpmhpd: Use corner in power_off
5b3987f58325 arm64: dts: renesas: r8a77995: draak: Remove bogus adv7511w properties
6c106c73208a ARM: dts: aspeed-g6: Fix HVI3C function-group in pinctrl dtsi
004778bf390a bpf: Fix potential memleak and UAF in the verifier.
fa4802c54e69 bpf: Fix a typo of reuseport map in bpf.h.
9a193caf9d79 media: cxd2880-spi: Fix an error handling path
34106f526015 soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally
b92893053003 media: TDA1997x: enable EDID support
43282ca83ace drm/panfrost: Fix missing clk_disable_unprepare() on error in panfrost_clk_init()
fc9cf2229087 EDAC/i10nm: Fix NVDIMM detection
32d8a3684bba spi: spi-zynq-qspi: use wait_for_completion_timeout to make zynq_qspi_exec_mem_op not interruptible
4206dbc9857b spi: sprd: Fix the wrong WDG_LOAD_VAL
1f70517eac57 regulator: vctrl: Avoid lockdep warning in enable/disable ops
d255d6a6457f regulator: vctrl: Use locked regulator_get_voltage in probe path
013177ccc4c5 certs: Trigger creation of RSA module signing key if it's not an RSA key
cc74533a47c9 crypto: qat - use proper type for vf_mask
b3fa499d72a0 block: nbd: add sanity check for first_minor
c60a31db3990 clocksource/drivers/sh_cmt: Fix wrong setting if don't request IRQ for clock source channel
6b10d3d3a9ff lib/mpi: use kcalloc in mpi_resize
57c8e2ea47bc genirq/timings: Fix error return code in irq_timings_test_irqs()
2d00b22c8b81 spi: spi-pic32: Fix issue with uninitialized dma_slave_config
b29593d0696d spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config
449884aeb358 sched: Fix UCLAMP_FLAG_IDLE setting
67da2d9c9e99 m68k: emu: Fix invalid free in nfeth_cleanup()
c68ba4a708fb s390/debug: fix debug area life cycle
7a67a00ea8a7 s390/kasan: fix large PMD pages address alignment check
98296eb3deca udf_get_extendedattr() had no boundary checks.
ae4240d1f4bf fcntl: fix potential deadlock for &fasync_struct.fa_lock
a6273c8c2aca crypto: qat - do not export adf_iov_putmsg()
7dfa7bb69e13 crypto: qat - fix naming for init/shutdown VF to PF notifications
843b4e713a80 crypto: qat - fix reuse of completion variable
4a988264556c crypto: qat - handle both source of interrupt in VF ISR
c2b3f81125a6 crypto: qat - do not ignore errors from enable_vf2pf_comms()
1c189ccef0cf libata: fix ata_host_start()
e55b627d6e1f s390/cio: add dev_busid sysfs entry for each subchannel
0423517520d3 power: supply: max17042_battery: fix typo in MAx17042_TOFF
eb45ae88bf10 nvmet: pass back cntlid on successful completion
6cb5d6ae687d nvme-rdma: don't update queue count when failing to set io queues
3073ec7f0642 nvme-tcp: don't update queue count when failing to set io queues
93cf19b4d9b3 bcache: add proper error unwinding in bcache_device_init
e55f20798f53 isofs: joliet: Fix iocharset=utf8 mount option
0f5cd92e5eb5 udf: Fix iocharset=utf8 mount option
86987cf0fbd2 udf: Check LVID earlier
cc608af36e00 hrtimer: Ensure timerfd notification for HIGHRES=n
a8457878307f hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns()
c322a963d522 posix-cpu-timers: Force next expiration recalc after itimer reset
28996dbb8a74 rcu/tree: Handle VM stoppage in stall detection
b7c560ae51c6 sched/deadline: Fix missing clock update in migrate_task_rq_dl()
40db13e3efce crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop()
ebf0f71ae3bd power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors
bba2b82d1b48 sched/deadline: Fix reset_on_fork reporting of DL tasks
53a6ef40c6bc crypto: mxs-dcp - Check for DMA mapping errors
344a38789ab2 regmap: fix the offset of register error log
a5e42516a61e locking/mutex: Fix HANDOFF condition
----
Link: https://lore.kernel.org/r/[email protected] # v5.4.145
Link: https://lore.kernel.org/r/[email protected] # v5.4.146
Link: Freescale/linux-fslc#444
Signed-off-by: Andrey Zhizhikin <[email protected]>
zandrey
added a commit
to zandrey/meta-freescale
that referenced
this pull request
Sep 20, 2021
Kernel repository has been upgraded up to v5.4.147 from stable korg.
Following upstream commits are included in this version:
----
48a24510c328 Linux 5.4.147
1f8ee024498d Revert "time: Handle negative seconds correctly in timespec64_to_ns()"
dc15f641c6cc Revert "posix-cpu-timers: Force next expiration recalc after itimer reset"
541e757944aa Revert "block: nbd: add sanity check for first_minor"
5f3ecbf4d586 Revert "Bluetooth: Move shutdown callback before flushing tx and rx queue"
245f15a48cdc Linux 5.4.146
b40facee46db clk: kirkwood: Fix a clocking boot regression
8810c51077b0 backlight: pwm_bl: Improve bootloader/kernel device handover
5de2ee621bc4 fbmem: don't allow too huge resolutions
4a95b04afab5 IMA: remove the dependency on CRYPTO_MD5
c69935f0b0aa IMA: remove -Wmissing-prototypes warning
85b0726d5bd7 fuse: flush extending writes
8a98ced6e1c8 fuse: truncate pagecache on atomic_o_trunc
06dad664d4ea KVM: nVMX: Unconditionally clear nested.pi_pending on nested VM-Enter
1735cec1e83c KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted
20fff3ef33b2 KVM: s390: index kvm->arch.idle_mask by vcpu_idx
0323ab5b254e x86/resctrl: Fix a maybe-uninitialized build warning treated as error
51f4575ca182 perf/x86/amd/ibs: Extend PERF_PMU_CAP_NO_EXCLUDE to IBS Op
03c3e977eeac tty: Fix data race between tiocsti() and flush_to_ldisc()
7a25a0a94c8b time: Handle negative seconds correctly in timespec64_to_ns()
ae968e270f2e bpf: Fix pointer arithmetic mask tightening under state pruning
a0a4778feae1 bpf: verifier: Allocate idmap scratch in verifier env
f5893af2704e bpf: Fix leakage due to insufficient speculative store bypass mitigation
e80c3533c354 bpf: Introduce BPF nospec instruction for mitigating Spectre v4
1c9424a765af ipv4: fix endianness issue in inet_rtm_getroute_build_skb()
b3fe6d192126 octeontx2-af: Fix loop in free and unmap counter
8216d7157bcf net: qualcomm: fix QCA7000 checksum handling
4648917e499c net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed
e46e23c289f6 ipv4: make exception cache less predictible
f73cbdd1b8e7 ipv6: make exception cache less predictible
aa167dcde4c7 brcmfmac: pcie: fix oops on failure to resume and reprobe
5debec63a28f bcma: Fix memory leak for internally-handled cores
574e563649ec ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point()
d946e685d6b7 ASoC: wcd9335: Disable irq on slave ports in the remove function
f3ec07f832bb ASoC: wcd9335: Fix a memory leak in the error handling path of the probe function
a6088f4ed3fc ASoC: wcd9335: Fix a double irq free in the remove function
7bfa680f3b47 tty: serial: fsl_lpuart: fix the wrong mapbase value
0f1375fa693b usb: bdc: Fix an error handling path in 'bdc_probe()' when no suitable DMA config is available
06203abb7275 usb: ehci-orion: Handle errors of clk_prepare_enable() in probe
a0a9ecca2dc4 i2c: mt65xx: fix IRQ check
b444064a0e0e CIFS: Fix a potencially linear read overflow
e37eeaf9506c bpf: Fix possible out of bound write in narrow load handling
fb8e695e9cfa mmc: moxart: Fix issue with uninitialized dma_slave_config
48b1f117e8d0 mmc: dw_mmc: Fix issue with uninitialized dma_slave_config
57314d8414d1 ASoC: Intel: Skylake: Fix module resource and format selection
92397571c243 ASoC: Intel: Skylake: Leave data as is when invoking TLV IPCs
b58cf18e384d rsi: fix an error code in rsi_probe()
d82fe3dd0b0f rsi: fix error code in rsi_load_9116_firmware()
4be8deab6f0d i2c: s3c2410: fix IRQ check
da3e5f32049a i2c: iop3xx: fix deferred probing
2da3272ae0ea Bluetooth: add timeout sanity check to hci_inquiry
70d71611eb83 mm/swap: consider max pages in iomap_swapfile_add_extent
8f5e26053c46 usb: gadget: mv_u3d: request_irq() after initializing UDC
eb3c6a25012f nfsd4: Fix forced-expiry locking
81e69d3fdd9e lockd: Fix invalid lockowner cast after vfs_test_lock
e1c02e2e6a7a mac80211: Fix insufficient headroom issue for AMSDU
606668e24a0d usb: phy: tahvo: add IRQ check
ecf18ac8ff76 usb: host: ohci-tmio: add IRQ check
abbcd61d091f Bluetooth: Move shutdown callback before flushing tx and rx queue
93ec1fd04f0f usb: gadget: udc: renesas_usb3: Fix soc_device_match() abuse
30d9607bcd73 usb: phy: twl6030: add IRQ checks
e1473ac28563 usb: phy: fsl-usb: add IRQ check
9535f55d0cba usb: gadget: udc: at91: add IRQ check
05e5b16b79dc drm/msm/dsi: Fix some reference counted resource leaks
5ccb04c6e1fb Bluetooth: fix repeated calls to sco_sock_kill
c2451d5439d0 counter: 104-quad-8: Return error when invalid mode during ceiling_write
a1194b805c90 arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7
1b6fcd10375a drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary LMs
156eaacba3d2 PM: EM: Increase energy calculation precision
5537dc810b2a Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow
c0faa638f016 debugfs: Return error during {full/open}_proxy_open() on rmmod
f44714b4eb2a soc: qcom: smsm: Fix missed interrupts if state changes while masked
e7997fe3e9ca PCI: PM: Enable PME if it can be signaled from D3cold
9e570f3d4777 PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently
f865b316ccc6 media: venus: venc: Fix potential null pointer dereference on pointer fmt
d2ea2f0725cc media: em28xx-input: fix refcount bug in em28xx_usb_disconnect
ebf570042b5f leds: trigger: audio: Add an activate callback to ensure the initial brightness is set
0a01dc77662c leds: lt3593: Put fwnode in any case during ->probe()
e39c73563a38 i2c: highlander: add IRQ check
fba783ddd945 net: cipso: fix warnings in netlbl_cipsov4_add_std
9fdac650c413 cgroup/cpuset: Fix a partition bug with hotplug
ffde05819953 net/mlx5e: Prohibit inner indir TIRs in IPoIB
87f817c560e6 ARM: dts: meson8b: ec100: Fix the pwm regulator supply properties
e55d7cbe1fe2 ARM: dts: meson8b: mxq: Fix the pwm regulator supply properties
4b0bbc412b51 ARM: dts: meson8b: odroidc1: Fix the pwm regulator supply properties
f7058060c01b ARM: dts: meson8: Use a higher default GPU clock frequency
37ed461b52e9 tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos
952136275367 drm/amdgpu/acp: Make PM domain really work
252fad3d0234 netns: protect netns ID lookups with RCU
bd1cd32caa67 6lowpan: iphc: Fix an off-by-one check of array index
c4895cf45fd5 Bluetooth: sco: prevent information leak in sco_conn_defer_accept()
a96eb96ce4c1 media: coda: fix frame_mem_ctrl for YUV420 and YVU420 formats
7163014d7d29 media: go7007: remove redundant initialization
810149287981 media: dvb-usb: Fix error handling in dvb_usb_i2c_init
fa8aaa769092 media: dvb-usb: fix uninit-value in vp702x_read_mac_addr
88933f9c93a0 media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init
f81c89614ee8 soc: qcom: rpmhpd: Use corner in power_off
5b3987f58325 arm64: dts: renesas: r8a77995: draak: Remove bogus adv7511w properties
6c106c73208a ARM: dts: aspeed-g6: Fix HVI3C function-group in pinctrl dtsi
004778bf390a bpf: Fix potential memleak and UAF in the verifier.
fa4802c54e69 bpf: Fix a typo of reuseport map in bpf.h.
9a193caf9d79 media: cxd2880-spi: Fix an error handling path
34106f526015 soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally
b92893053003 media: TDA1997x: enable EDID support
43282ca83ace drm/panfrost: Fix missing clk_disable_unprepare() on error in panfrost_clk_init()
fc9cf2229087 EDAC/i10nm: Fix NVDIMM detection
32d8a3684bba spi: spi-zynq-qspi: use wait_for_completion_timeout to make zynq_qspi_exec_mem_op not interruptible
4206dbc9857b spi: sprd: Fix the wrong WDG_LOAD_VAL
1f70517eac57 regulator: vctrl: Avoid lockdep warning in enable/disable ops
d255d6a6457f regulator: vctrl: Use locked regulator_get_voltage in probe path
013177ccc4c5 certs: Trigger creation of RSA module signing key if it's not an RSA key
cc74533a47c9 crypto: qat - use proper type for vf_mask
b3fa499d72a0 block: nbd: add sanity check for first_minor
c60a31db3990 clocksource/drivers/sh_cmt: Fix wrong setting if don't request IRQ for clock source channel
6b10d3d3a9ff lib/mpi: use kcalloc in mpi_resize
57c8e2ea47bc genirq/timings: Fix error return code in irq_timings_test_irqs()
2d00b22c8b81 spi: spi-pic32: Fix issue with uninitialized dma_slave_config
b29593d0696d spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config
449884aeb358 sched: Fix UCLAMP_FLAG_IDLE setting
67da2d9c9e99 m68k: emu: Fix invalid free in nfeth_cleanup()
c68ba4a708fb s390/debug: fix debug area life cycle
7a67a00ea8a7 s390/kasan: fix large PMD pages address alignment check
98296eb3deca udf_get_extendedattr() had no boundary checks.
ae4240d1f4bf fcntl: fix potential deadlock for &fasync_struct.fa_lock
a6273c8c2aca crypto: qat - do not export adf_iov_putmsg()
7dfa7bb69e13 crypto: qat - fix naming for init/shutdown VF to PF notifications
843b4e713a80 crypto: qat - fix reuse of completion variable
4a988264556c crypto: qat - handle both source of interrupt in VF ISR
c2b3f81125a6 crypto: qat - do not ignore errors from enable_vf2pf_comms()
1c189ccef0cf libata: fix ata_host_start()
e55b627d6e1f s390/cio: add dev_busid sysfs entry for each subchannel
0423517520d3 power: supply: max17042_battery: fix typo in MAx17042_TOFF
eb45ae88bf10 nvmet: pass back cntlid on successful completion
6cb5d6ae687d nvme-rdma: don't update queue count when failing to set io queues
3073ec7f0642 nvme-tcp: don't update queue count when failing to set io queues
93cf19b4d9b3 bcache: add proper error unwinding in bcache_device_init
e55f20798f53 isofs: joliet: Fix iocharset=utf8 mount option
0f5cd92e5eb5 udf: Fix iocharset=utf8 mount option
86987cf0fbd2 udf: Check LVID earlier
cc608af36e00 hrtimer: Ensure timerfd notification for HIGHRES=n
a8457878307f hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns()
c322a963d522 posix-cpu-timers: Force next expiration recalc after itimer reset
28996dbb8a74 rcu/tree: Handle VM stoppage in stall detection
b7c560ae51c6 sched/deadline: Fix missing clock update in migrate_task_rq_dl()
40db13e3efce crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop()
ebf0f71ae3bd power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors
bba2b82d1b48 sched/deadline: Fix reset_on_fork reporting of DL tasks
53a6ef40c6bc crypto: mxs-dcp - Check for DMA mapping errors
344a38789ab2 regmap: fix the offset of register error log
a5e42516a61e locking/mutex: Fix HANDOFF condition
----
Link: https://lore.kernel.org/r/[email protected] # v5.4.145
Link: https://lore.kernel.org/r/[email protected] # v5.4.146
Link: Freescale/linux-fslc#444
Signed-off-by: Andrey Zhizhikin <[email protected]>
angolini
pushed a commit
to angolini/meta-freescale
that referenced
this pull request
Sep 27, 2021
Kernel repository has been upgraded up to v5.4.147 from stable korg.
Following upstream commits are included in this version:
----
48a24510c328 Linux 5.4.147
1f8ee024498d Revert "time: Handle negative seconds correctly in timespec64_to_ns()"
dc15f641c6cc Revert "posix-cpu-timers: Force next expiration recalc after itimer reset"
541e757944aa Revert "block: nbd: add sanity check for first_minor"
5f3ecbf4d586 Revert "Bluetooth: Move shutdown callback before flushing tx and rx queue"
245f15a48cdc Linux 5.4.146
b40facee46db clk: kirkwood: Fix a clocking boot regression
8810c51077b0 backlight: pwm_bl: Improve bootloader/kernel device handover
5de2ee621bc4 fbmem: don't allow too huge resolutions
4a95b04afab5 IMA: remove the dependency on CRYPTO_MD5
c69935f0b0aa IMA: remove -Wmissing-prototypes warning
85b0726d5bd7 fuse: flush extending writes
8a98ced6e1c8 fuse: truncate pagecache on atomic_o_trunc
06dad664d4ea KVM: nVMX: Unconditionally clear nested.pi_pending on nested VM-Enter
1735cec1e83c KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted
20fff3ef33b2 KVM: s390: index kvm->arch.idle_mask by vcpu_idx
0323ab5b254e x86/resctrl: Fix a maybe-uninitialized build warning treated as error
51f4575ca182 perf/x86/amd/ibs: Extend PERF_PMU_CAP_NO_EXCLUDE to IBS Op
03c3e977eeac tty: Fix data race between tiocsti() and flush_to_ldisc()
7a25a0a94c8b time: Handle negative seconds correctly in timespec64_to_ns()
ae968e270f2e bpf: Fix pointer arithmetic mask tightening under state pruning
a0a4778feae1 bpf: verifier: Allocate idmap scratch in verifier env
f5893af2704e bpf: Fix leakage due to insufficient speculative store bypass mitigation
e80c3533c354 bpf: Introduce BPF nospec instruction for mitigating Spectre v4
1c9424a765af ipv4: fix endianness issue in inet_rtm_getroute_build_skb()
b3fe6d192126 octeontx2-af: Fix loop in free and unmap counter
8216d7157bcf net: qualcomm: fix QCA7000 checksum handling
4648917e499c net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed
e46e23c289f6 ipv4: make exception cache less predictible
f73cbdd1b8e7 ipv6: make exception cache less predictible
aa167dcde4c7 brcmfmac: pcie: fix oops on failure to resume and reprobe
5debec63a28f bcma: Fix memory leak for internally-handled cores
574e563649ec ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point()
d946e685d6b7 ASoC: wcd9335: Disable irq on slave ports in the remove function
f3ec07f832bb ASoC: wcd9335: Fix a memory leak in the error handling path of the probe function
a6088f4ed3fc ASoC: wcd9335: Fix a double irq free in the remove function
7bfa680f3b47 tty: serial: fsl_lpuart: fix the wrong mapbase value
0f1375fa693b usb: bdc: Fix an error handling path in 'bdc_probe()' when no suitable DMA config is available
06203abb7275 usb: ehci-orion: Handle errors of clk_prepare_enable() in probe
a0a9ecca2dc4 i2c: mt65xx: fix IRQ check
b444064a0e0e CIFS: Fix a potencially linear read overflow
e37eeaf9506c bpf: Fix possible out of bound write in narrow load handling
fb8e695e9cfa mmc: moxart: Fix issue with uninitialized dma_slave_config
48b1f117e8d0 mmc: dw_mmc: Fix issue with uninitialized dma_slave_config
57314d8414d1 ASoC: Intel: Skylake: Fix module resource and format selection
92397571c243 ASoC: Intel: Skylake: Leave data as is when invoking TLV IPCs
b58cf18e384d rsi: fix an error code in rsi_probe()
d82fe3dd0b0f rsi: fix error code in rsi_load_9116_firmware()
4be8deab6f0d i2c: s3c2410: fix IRQ check
da3e5f32049a i2c: iop3xx: fix deferred probing
2da3272ae0ea Bluetooth: add timeout sanity check to hci_inquiry
70d71611eb83 mm/swap: consider max pages in iomap_swapfile_add_extent
8f5e26053c46 usb: gadget: mv_u3d: request_irq() after initializing UDC
eb3c6a25012f nfsd4: Fix forced-expiry locking
81e69d3fdd9e lockd: Fix invalid lockowner cast after vfs_test_lock
e1c02e2e6a7a mac80211: Fix insufficient headroom issue for AMSDU
606668e24a0d usb: phy: tahvo: add IRQ check
ecf18ac8ff76 usb: host: ohci-tmio: add IRQ check
abbcd61d091f Bluetooth: Move shutdown callback before flushing tx and rx queue
93ec1fd04f0f usb: gadget: udc: renesas_usb3: Fix soc_device_match() abuse
30d9607bcd73 usb: phy: twl6030: add IRQ checks
e1473ac28563 usb: phy: fsl-usb: add IRQ check
9535f55d0cba usb: gadget: udc: at91: add IRQ check
05e5b16b79dc drm/msm/dsi: Fix some reference counted resource leaks
5ccb04c6e1fb Bluetooth: fix repeated calls to sco_sock_kill
c2451d5439d0 counter: 104-quad-8: Return error when invalid mode during ceiling_write
a1194b805c90 arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7
1b6fcd10375a drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary LMs
156eaacba3d2 PM: EM: Increase energy calculation precision
5537dc810b2a Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow
c0faa638f016 debugfs: Return error during {full/open}_proxy_open() on rmmod
f44714b4eb2a soc: qcom: smsm: Fix missed interrupts if state changes while masked
e7997fe3e9ca PCI: PM: Enable PME if it can be signaled from D3cold
9e570f3d4777 PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently
f865b316ccc6 media: venus: venc: Fix potential null pointer dereference on pointer fmt
d2ea2f0725cc media: em28xx-input: fix refcount bug in em28xx_usb_disconnect
ebf570042b5f leds: trigger: audio: Add an activate callback to ensure the initial brightness is set
0a01dc77662c leds: lt3593: Put fwnode in any case during ->probe()
e39c73563a38 i2c: highlander: add IRQ check
fba783ddd945 net: cipso: fix warnings in netlbl_cipsov4_add_std
9fdac650c413 cgroup/cpuset: Fix a partition bug with hotplug
ffde05819953 net/mlx5e: Prohibit inner indir TIRs in IPoIB
87f817c560e6 ARM: dts: meson8b: ec100: Fix the pwm regulator supply properties
e55d7cbe1fe2 ARM: dts: meson8b: mxq: Fix the pwm regulator supply properties
4b0bbc412b51 ARM: dts: meson8b: odroidc1: Fix the pwm regulator supply properties
f7058060c01b ARM: dts: meson8: Use a higher default GPU clock frequency
37ed461b52e9 tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos
952136275367 drm/amdgpu/acp: Make PM domain really work
252fad3d0234 netns: protect netns ID lookups with RCU
bd1cd32caa67 6lowpan: iphc: Fix an off-by-one check of array index
c4895cf45fd5 Bluetooth: sco: prevent information leak in sco_conn_defer_accept()
a96eb96ce4c1 media: coda: fix frame_mem_ctrl for YUV420 and YVU420 formats
7163014d7d29 media: go7007: remove redundant initialization
810149287981 media: dvb-usb: Fix error handling in dvb_usb_i2c_init
fa8aaa769092 media: dvb-usb: fix uninit-value in vp702x_read_mac_addr
88933f9c93a0 media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init
f81c89614ee8 soc: qcom: rpmhpd: Use corner in power_off
5b3987f58325 arm64: dts: renesas: r8a77995: draak: Remove bogus adv7511w properties
6c106c73208a ARM: dts: aspeed-g6: Fix HVI3C function-group in pinctrl dtsi
004778bf390a bpf: Fix potential memleak and UAF in the verifier.
fa4802c54e69 bpf: Fix a typo of reuseport map in bpf.h.
9a193caf9d79 media: cxd2880-spi: Fix an error handling path
34106f526015 soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally
b92893053003 media: TDA1997x: enable EDID support
43282ca83ace drm/panfrost: Fix missing clk_disable_unprepare() on error in panfrost_clk_init()
fc9cf2229087 EDAC/i10nm: Fix NVDIMM detection
32d8a3684bba spi: spi-zynq-qspi: use wait_for_completion_timeout to make zynq_qspi_exec_mem_op not interruptible
4206dbc9857b spi: sprd: Fix the wrong WDG_LOAD_VAL
1f70517eac57 regulator: vctrl: Avoid lockdep warning in enable/disable ops
d255d6a6457f regulator: vctrl: Use locked regulator_get_voltage in probe path
013177ccc4c5 certs: Trigger creation of RSA module signing key if it's not an RSA key
cc74533a47c9 crypto: qat - use proper type for vf_mask
b3fa499d72a0 block: nbd: add sanity check for first_minor
c60a31db3990 clocksource/drivers/sh_cmt: Fix wrong setting if don't request IRQ for clock source channel
6b10d3d3a9ff lib/mpi: use kcalloc in mpi_resize
57c8e2ea47bc genirq/timings: Fix error return code in irq_timings_test_irqs()
2d00b22c8b81 spi: spi-pic32: Fix issue with uninitialized dma_slave_config
b29593d0696d spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config
449884aeb358 sched: Fix UCLAMP_FLAG_IDLE setting
67da2d9c9e99 m68k: emu: Fix invalid free in nfeth_cleanup()
c68ba4a708fb s390/debug: fix debug area life cycle
7a67a00ea8a7 s390/kasan: fix large PMD pages address alignment check
98296eb3deca udf_get_extendedattr() had no boundary checks.
ae4240d1f4bf fcntl: fix potential deadlock for &fasync_struct.fa_lock
a6273c8c2aca crypto: qat - do not export adf_iov_putmsg()
7dfa7bb69e13 crypto: qat - fix naming for init/shutdown VF to PF notifications
843b4e713a80 crypto: qat - fix reuse of completion variable
4a988264556c crypto: qat - handle both source of interrupt in VF ISR
c2b3f81125a6 crypto: qat - do not ignore errors from enable_vf2pf_comms()
1c189ccef0cf libata: fix ata_host_start()
e55b627d6e1f s390/cio: add dev_busid sysfs entry for each subchannel
0423517520d3 power: supply: max17042_battery: fix typo in MAx17042_TOFF
eb45ae88bf10 nvmet: pass back cntlid on successful completion
6cb5d6ae687d nvme-rdma: don't update queue count when failing to set io queues
3073ec7f0642 nvme-tcp: don't update queue count when failing to set io queues
93cf19b4d9b3 bcache: add proper error unwinding in bcache_device_init
e55f20798f53 isofs: joliet: Fix iocharset=utf8 mount option
0f5cd92e5eb5 udf: Fix iocharset=utf8 mount option
86987cf0fbd2 udf: Check LVID earlier
cc608af36e00 hrtimer: Ensure timerfd notification for HIGHRES=n
a8457878307f hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns()
c322a963d522 posix-cpu-timers: Force next expiration recalc after itimer reset
28996dbb8a74 rcu/tree: Handle VM stoppage in stall detection
b7c560ae51c6 sched/deadline: Fix missing clock update in migrate_task_rq_dl()
40db13e3efce crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop()
ebf0f71ae3bd power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors
bba2b82d1b48 sched/deadline: Fix reset_on_fork reporting of DL tasks
53a6ef40c6bc crypto: mxs-dcp - Check for DMA mapping errors
344a38789ab2 regmap: fix the offset of register error log
a5e42516a61e locking/mutex: Fix HANDOFF condition
----
Link: https://lore.kernel.org/r/[email protected] # v5.4.145
Link: https://lore.kernel.org/r/[email protected] # v5.4.146
Link: Freescale/linux-fslc#444
Signed-off-by: Andrey Zhizhikin <[email protected]>
puhitaku
pushed a commit
to brain-hackers/linux-brain
that referenced
this pull request
Sep 30, 2021
[ Upstream commit 17109e9 ] When connecting without first doing a scan, the BSS list is empty and __cfg80211_connect_result() generates this warning: $ iw dev wlan0 connect -w VirtWifi [ 15.371989] ------------[ cut here ]------------ [ 15.372179] WARNING: CPU: 0 PID: 92 at net/wireless/sme.c:756 __cfg80211_connect_result+0x402/0x440 [ 15.372383] CPU: 0 PID: 92 Comm: kworker/u2:2 Not tainted 5.13.0-kvm Freescale#444 [ 15.372512] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-3.fc34 04/01/2014 [ 15.372597] Workqueue: cfg80211 cfg80211_event_work [ 15.372756] RIP: 0010:__cfg80211_connect_result+0x402/0x440 [ 15.372818] Code: 48 2b 04 25 28 00 00 00 75 59 48 8b 3b 48 8b 76 10 48 8d 65 e0 5b 41 5c 41 5d 41 5e 5d 49 8d 65 f0 41 5d e9 d0 d4 fd ff 0f 0b <0f> 0b e9 f6 fd ff ff e8 f2 4a b4 ff e9 ec fd ff ff 0f 0b e9 19 fd [ 15.372966] RSP: 0018:ffffc900005cbdc0 EFLAGS: 00010246 [ 15.373022] RAX: 0000000000000000 RBX: ffff8880028e2400 RCX: ffff8880028e2472 [ 15.373088] RDX: 0000000000000002 RSI: 00000000fffffe01 RDI: ffffffff815335ba [ 15.373149] RBP: ffffc900005cbe00 R08: 0000000000000008 R09: ffff888002bdf8b8 [ 15.373209] R10: ffff88803ec208f0 R11: ffffffffffffe9ae R12: ffff88801d687d98 [ 15.373280] R13: ffff88801b5fe000 R14: ffffc900005cbdc0 R15: dead000000000100 [ 15.373330] FS: 0000000000000000(0000) GS:ffff88803ec00000(0000) knlGS:0000000000000000 [ 15.373382] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 15.373425] CR2: 000056421c468958 CR3: 000000001b458001 CR4: 0000000000170eb0 [ 15.373478] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 15.373529] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 15.373580] Call Trace: [ 15.373611] ? cfg80211_process_wdev_events+0x10e/0x170 [ 15.373743] cfg80211_process_wdev_events+0x10e/0x170 [ 15.373783] cfg80211_process_rdev_events+0x21/0x40 [ 15.373846] cfg80211_event_work+0x20/0x30 [ 15.373892] process_one_work+0x1e9/0x340 [ 15.373956] worker_thread+0x4b/0x3f0 [ 15.374017] ? process_one_work+0x340/0x340 [ 15.374053] kthread+0x11f/0x140 [ 15.374089] ? set_kthread_struct+0x30/0x30 [ 15.374153] ret_from_fork+0x1f/0x30 [ 15.374187] ---[ end trace 321ef0cb7e9c0be1 ]--- wlan0 (phy #0): connected to 00:00:00:00:00:00 Add the fake bss just before the connect so that cfg80211_get_bss() finds the virtual network. As some code was duplicated, move it in a common function. Signed-off-by: Matteo Croce <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Johannes Berg <[email protected]> Signed-off-by: Sasha Levin <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Automatic merge performed, no conflicts reported.
Kernel has been built for both aarch64 (
imx_v8_defconfig) and arm32 (imx_v7_defconfig).-- andrey