1. 21 Apr, 2023 1 commit
    • Paolo Bonzini's avatar
      Merge tag 'kvmarm-fixes-6.3-4' of... · 265b97cb
      Paolo Bonzini authored
      Merge tag 'kvmarm-fixes-6.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD
      
      KVM/arm64 fixes for 6.3, part #4
      
       - Plug a buffer overflow due to the use of the user-provided register
         width for firmware regs. Outright reject accesses where the
         user register width does not match the kernel representation.
      
       - Protect non-atomic RMW operations on vCPU flags against preemption,
         as an update to the flags by an intervening preemption could be lost.
      265b97cb
  2. 19 Apr, 2023 1 commit
  3. 18 Apr, 2023 1 commit
    • Marc Zyngier's avatar
      KVM: arm64: Make vcpu flag updates non-preemptible · 35dcb3ac
      Marc Zyngier authored
      Per-vcpu flags are updated using a non-atomic RMW operation.
      Which means it is possible to get preempted between the read and
      write operations.
      
      Another interesting thing to note is that preemption also updates
      flags, as we have some flag manipulation in both the load and put
      operations.
      
      It is thus possible to lose information communicated by either
      load or put, as the preempted flag update will overwrite the flags
      when the thread is resumed. This is specially critical if either
      load or put has stored information which depends on the physical
      CPU the vcpu runs on.
      
      This results in really elusive bugs, and kudos must be given to
      Mostafa for the long hours of debugging, and finally spotting
      the problem.
      
      Fix it by disabling preemption during the RMW operation, which
      ensures that the state stays consistent. Also upgrade vcpu_get_flag
      path to use READ_ONCE() to make sure the field is always atomically
      accessed.
      
      Fixes: e87abb73 ("KVM: arm64: Add helpers to manipulate vcpu flags among a set")
      Reported-by: default avatarMostafa Saleh <smostafa@google.com>
      Signed-off-by: default avatarMarc Zyngier <maz@kernel.org>
      Cc: stable@vger.kernel.org
      Link: https://lore.kernel.org/r/20230418125737.2327972-1-maz@kernel.orgSigned-off-by: default avatarOliver Upton <oliver.upton@linux.dev>
      35dcb3ac
  4. 06 Apr, 2023 1 commit
  5. 04 Apr, 2023 2 commits
  6. 31 Mar, 2023 2 commits
  7. 30 Mar, 2023 1 commit
    • Reiji Watanabe's avatar
      KVM: arm64: PMU: Restore the guest's EL0 event counting after migration · f9ea835e
      Reiji Watanabe authored
      Currently, with VHE, KVM enables the EL0 event counting for the
      guest on vcpu_load() or KVM enables it as a part of the PMU
      register emulation process, when needed.  However, in the migration
      case (with VHE), the same handling is lacking, as vPMU register
      values that were restored by userspace haven't been propagated yet
      (the PMU events haven't been created) at the vcpu load-time on the
      first KVM_RUN (kvm_vcpu_pmu_restore_guest() called from vcpu_load()
      on the first KVM_RUN won't do anything as events_{guest,host} of
      kvm_pmu_events are still zero).
      
      So, with VHE, enable the guest's EL0 event counting on the first
      KVM_RUN (after the migration) when needed.  More specifically,
      have kvm_pmu_handle_pmcr() call kvm_vcpu_pmu_restore_guest()
      so that kvm_pmu_handle_pmcr() on the first KVM_RUN can take
      care of it.
      
      Fixes: d0c94c49 ("KVM: arm64: Restore PMU configuration on first run")
      Cc: stable@vger.kernel.org
      Reviewed-by: default avatarMarc Zyngier <maz@kernel.org>
      Signed-off-by: default avatarReiji Watanabe <reijiw@google.com>
      Link: https://lore.kernel.org/r/20230329023944.2488484-1-reijiw@google.comSigned-off-by: default avatarOliver Upton <oliver.upton@linux.dev>
      f9ea835e
  8. 28 Mar, 2023 1 commit
  9. 27 Mar, 2023 8 commits
    • Sean Christopherson's avatar
      KVM: nVMX: Do not report error code when synthesizing VM-Exit from Real Mode · 80962ec9
      Sean Christopherson authored
      Don't report an error code to L1 when synthesizing a nested VM-Exit and
      L2 is in Real Mode.  Per Intel's SDM, regarding the error code valid bit:
      
        This bit is always 0 if the VM exit occurred while the logical processor
        was in real-address mode (CR0.PE=0).
      
      The bug was introduced by a recent fix for AMD's Paged Real Mode, which
      moved the error code suppression from the common "queue exception" path
      to the "inject exception" path, but missed VMX's "synthesize VM-Exit"
      path.
      
      Fixes: b97f0745 ("KVM: x86: determine if an exception has an error code only when injecting it.")
      Cc: stable@vger.kernel.org
      Cc: Maxim Levitsky <mlevitsk@redhat.com>
      Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
      Message-Id: <20230322143300.2209476-3-seanjc@google.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      80962ec9
    • Sean Christopherson's avatar
      KVM: x86: Clear "has_error_code", not "error_code", for RM exception injection · 6c41468c
      Sean Christopherson authored
      When injecting an exception into a vCPU in Real Mode, suppress the error
      code by clearing the flag that tracks whether the error code is valid, not
      by clearing the error code itself.  The "typo" was introduced by recent
      fix for SVM's funky Paged Real Mode.
      
      Opportunistically hoist the logic above the tracepoint so that the trace
      is coherent with respect to what is actually injected (this was also the
      behavior prior to the buggy commit).
      
      Fixes: b97f0745 ("KVM: x86: determine if an exception has an error code only when injecting it.")
      Cc: stable@vger.kernel.org
      Cc: Maxim Levitsky <mlevitsk@redhat.com>
      Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
      Message-Id: <20230322143300.2209476-2-seanjc@google.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      6c41468c
    • Sean Christopherson's avatar
      KVM: x86: Suppress pending MMIO write exits if emulator detects exception · 0dc90226
      Sean Christopherson authored
      Clear vcpu->mmio_needed when injecting an exception from the emulator to
      squash a (legitimate) warning about vcpu->mmio_needed being true at the
      start of KVM_RUN without a callback being registered to complete the
      userspace MMIO exit.  Suppressing the MMIO write exit is inarguably wrong
      from an architectural perspective, but it is the least awful hack-a-fix
      due to shortcomings in KVM's uAPI, not to mention that KVM already
      suppresses MMIO writes in this scenario.
      
      Outside of REP string instructions, KVM doesn't provide a way to resume
      an instruction at the exact point where it was "interrupted" if said
      instruction partially completed before encountering an MMIO access.  For
      MMIO reads, KVM immediately exits to userspace upon detecting MMIO as
      userspace provides the to-be-read value in a buffer, and so KVM can safely
      (more or less) restart the instruction from the beginning.  When the
      emulator re-encounters the MMIO read, KVM will service the MMIO by getting
      the value from the buffer instead of exiting to userspace, i.e. KVM won't
      put the vCPU into an infinite loop.
      
      On an emulated MMIO write, KVM finishes the instruction before exiting to
      userspace, as exiting immediately would ultimately hang the vCPU due to
      the aforementioned shortcoming of KVM not being able to resume emulation
      in the middle of an instruction.
      
      For the vast majority of _emulated_ instructions, deferring the userspace
      exit doesn't cause problems as very few x86 instructions (again ignoring
      string operations) generate multiple writes.  But for instructions that
      generate multiple writes, e.g. PUSHA (multiple pushes onto the stack),
      deferring the exit effectively results in only the final write triggering
      an exit to userspace.  KVM does support multiple MMIO "fragments", but
      only for page splits; if an instruction performs multiple distinct MMIO
      writes, the number of fragments gets reset when the next MMIO write comes
      along and any previous MMIO writes are dropped.
      
      Circling back to the warning, if a deferred MMIO write coincides with an
      exception, e.g. in this case a #SS due to PUSHA underflowing the stack
      after queueing a write to an MMIO page on a previous push, KVM injects
      the exceptions and leaves the deferred MMIO pending without registering a
      callback, thus triggering the splat.
      
      Sweep the problem under the proverbial rug as dropping MMIO writes is not
      unique to the exception scenario (see above), i.e. instructions like PUSHA
      are fundamentally broken with respect to MMIO, and have been since KVM's
      inception.
      Reported-by: default avatarzhangjianguo <zhangjianguo18@huawei.com>
      Reported-by: syzbot+760a73552f47a8cd0fd9@syzkaller.appspotmail.com
      Reported-by: syzbot+8accb43ddc6bd1f5713a@syzkaller.appspotmail.com
      Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
      Message-Id: <20230322141220.2206241-1-seanjc@google.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      0dc90226
    • Dmytro Maluka's avatar
      KVM: x86/ioapic: Resample the pending state of an IRQ when unmasking · fef8f2b9
      Dmytro Maluka authored
      KVM irqfd based emulation of level-triggered interrupts doesn't work
      quite correctly in some cases, particularly in the case of interrupts
      that are handled in a Linux guest as oneshot interrupts (IRQF_ONESHOT).
      Such an interrupt is acked to the device in its threaded irq handler,
      i.e. later than it is acked to the interrupt controller (EOI at the end
      of hardirq), not earlier.
      
      Linux keeps such interrupt masked until its threaded handler finishes,
      to prevent the EOI from re-asserting an unacknowledged interrupt.
      However, with KVM + vfio (or whatever is listening on the resamplefd)
      we always notify resamplefd at the EOI, so vfio prematurely unmasks the
      host physical IRQ, thus a new physical interrupt is fired in the host.
      This extra interrupt in the host is not a problem per se. The problem is
      that it is unconditionally queued for injection into the guest, so the
      guest sees an extra bogus interrupt. [*]
      
      There are observed at least 2 user-visible issues caused by those
      extra erroneous interrupts for a oneshot irq in the guest:
      
      1. System suspend aborted due to a pending wakeup interrupt from
         ChromeOS EC (drivers/platform/chrome/cros_ec.c).
      2. Annoying "invalid report id data" errors from ELAN0000 touchpad
         (drivers/input/mouse/elan_i2c_core.c), flooding the guest dmesg
         every time the touchpad is touched.
      
      The core issue here is that by the time when the guest unmasks the IRQ,
      the physical IRQ line is no longer asserted (since the guest has
      acked the interrupt to the device in the meantime), yet we
      unconditionally inject the interrupt queued into the guest by the
      previous resampling. So to fix the issue, we need a way to detect that
      the IRQ is no longer pending, and cancel the queued interrupt in this
      case.
      
      With IOAPIC we are not able to probe the physical IRQ line state
      directly (at least not if the underlying physical interrupt controller
      is an IOAPIC too), so in this patch we use irqfd resampler for that.
      Namely, instead of injecting the queued interrupt, we just notify the
      resampler that this interrupt is done. If the IRQ line is actually
      already deasserted, we are done. If it is still asserted, a new
      interrupt will be shortly triggered through irqfd and injected into the
      guest.
      
      In the case if there is no irqfd resampler registered for this IRQ, we
      cannot fix the issue, so we keep the existing behavior: immediately
      unconditionally inject the queued interrupt.
      
      This patch fixes the issue for x86 IOAPIC only. In the long run, we can
      fix it for other irqchips and other architectures too, possibly taking
      advantage of reading the physical state of the IRQ line, which is
      possible with some other irqchips (e.g. with arm64 GIC, maybe even with
      the legacy x86 PIC).
      
      [*] In this description we assume that the interrupt is a physical host
          interrupt forwarded to the guest e.g. by vfio. Potentially the same
          issue may occur also with a purely virtual interrupt from an
          emulated device, e.g. if the guest handles this interrupt, again, as
          a oneshot interrupt.
      Signed-off-by: default avatarDmytro Maluka <dmy@semihalf.com>
      Link: https://lore.kernel.org/kvm/31420943-8c5f-125c-a5ee-d2fde2700083@semihalf.com/
      Link: https://lore.kernel.org/lkml/87o7wrug0w.wl-maz@kernel.org/
      Message-Id: <20230322204344.50138-3-dmy@semihalf.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      fef8f2b9
    • Dmytro Maluka's avatar
      KVM: irqfd: Make resampler_list an RCU list · d583fbd7
      Dmytro Maluka authored
      It is useful to be able to do read-only traversal of the list of all the
      registered irqfd resamplers without locking the resampler_lock mutex.
      In particular, we are going to traverse it to search for a resampler
      registered for the given irq of an irqchip, and that will be done with
      an irqchip spinlock (ioapic->lock) held, so it is undesirable to lock a
      mutex in this context. So turn this list into an RCU list.
      
      For protecting the read side, reuse kvm->irq_srcu which is already used
      for protecting a number of irq related things (kvm->irq_routing,
      irqfd->resampler->list, kvm->irq_ack_notifier_list,
      kvm->arch.mask_notifier_list).
      Signed-off-by: default avatarDmytro Maluka <dmy@semihalf.com>
      Message-Id: <20230322204344.50138-2-dmy@semihalf.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      d583fbd7
    • Jeremi Piotrowski's avatar
      KVM: SVM: Flush Hyper-V TLB when required · e5c972c1
      Jeremi Piotrowski authored
      The Hyper-V "EnlightenedNptTlb" enlightenment is always enabled when KVM
      is running on top of Hyper-V and Hyper-V exposes support for it (which
      is always). On AMD CPUs this enlightenment results in ASID invalidations
      not flushing TLB entries derived from the NPT. To force the underlying
      (L0) hypervisor to rebuild its shadow page tables, an explicit hypercall
      is needed.
      
      The original KVM implementation of Hyper-V's "EnlightenedNptTlb" on SVM
      only added remote TLB flush hooks. This worked out fine for a while, as
      sufficient remote TLB flushes where being issued in KVM to mask the
      problem. Since v5.17, changes in the TDP code reduced the number of
      flushes and the out-of-sync TLB prevents guests from booting
      successfully.
      
      Split svm_flush_tlb_current() into separate callbacks for the 3 cases
      (guest/all/current), and issue the required Hyper-V hypercall when a
      Hyper-V TLB flush is needed. The most important case where the TLB flush
      was missing is when loading a new PGD, which is followed by what is now
      svm_flush_tlb_current().
      
      Cc: stable@vger.kernel.org # v5.17+
      Fixes: 1e0c7d40 ("KVM: SVM: hyper-v: Remote TLB flush for SVM")
      Link: https://lore.kernel.org/lkml/43980946-7bbf-dcef-7e40-af904c456250@linux.microsoft.com/Suggested-by: default avatarSean Christopherson <seanjc@google.com>
      Signed-off-by: default avatarJeremi Piotrowski <jpiotrowski@linux.microsoft.com>
      Reviewed-by: default avatarVitaly Kuznetsov <vkuznets@redhat.com>
      Message-Id: <20230324145233.4585-1-jpiotrowski@linux.microsoft.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      e5c972c1
    • Paolo Bonzini's avatar
      Merge tag 'kvm-riscv-fixes-6.3-1' of https://github.com/kvm-riscv/linux into HEAD · 9e347ba0
      Paolo Bonzini authored
      KVM/riscv fixes for 6.3, take #1
      
      - Fix VM hang in case of timer delta being zero
      9e347ba0
    • Paolo Bonzini's avatar
      Merge tag 'kvmarm-fixes-6.3-2' of... · 8607daa2
      Paolo Bonzini authored
      Merge tag 'kvmarm-fixes-6.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD
      
      KVM/arm64 fixes for 6.3, part #2
      
      Fixes for a rather interesting set of bugs relating to the MMU:
      
       - Read the MMU notifier seq before dropping the mmap lock to guard
         against reading a potentially stale VMA
      
       - Disable interrupts when walking user page tables to protect against
         the page table being freed
      
       - Read the MTE permissions for the VMA within the mmap lock critical
         section, avoiding the use of a potentally stale VMA pointer
      
      Additionally, some fixes targeting the vPMU:
      
       - Return the sum of the current perf event value and PMC snapshot for
         reads from userspace
      
       - Don't save the value of guest writes to PMCR_EL0.{C,P}, which could
         otherwise lead to userspace erroneously resetting the vPMU during VM
         save/restore
      8607daa2
  10. 26 Mar, 2023 7 commits
    • Linus Torvalds's avatar
      Linux 6.3-rc4 · 197b6b60
      Linus Torvalds authored
      197b6b60
    • Linus Torvalds's avatar
      Merge tag 'usb-6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 0ec57cfa
      Linus Torvalds authored
      Pull USB / Thunderbolt driver fixes from Greg KH:
       "Here are a small set of USB and Thunderbolt driver fixes for reported
        problems and a documentation update, for 6.3-rc4.
      
        Included in here are:
      
         - documentation update for uvc gadget driver
      
         - small thunderbolt driver fixes
      
         - cdns3 driver fixes
      
         - dwc3 driver fixes
      
         - dwc2 driver fixes
      
         - chipidea driver fixes
      
         - typec driver fixes
      
         - onboard_usb_hub device id updates
      
         - quirk updates
      
        All of these have been in linux-next with no reported problems"
      
      * tag 'usb-6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (30 commits)
        usb: dwc2: fix a race, don't power off/on phy for dual-role mode
        usb: dwc2: fix a devres leak in hw_enable upon suspend resume
        usb: chipidea: core: fix possible concurrent when switch role
        usb: chipdea: core: fix return -EINVAL if request role is the same with current role
        thunderbolt: Rename shadowed variables bit to interrupt_bit and auto_clear_bit
        thunderbolt: Disable interrupt auto clear for rings
        thunderbolt: Use const qualifier for `ring_interrupt_index`
        usb: gadget: Use correct endianness of the wLength field for WebUSB
        uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2
        usb: cdnsp: changes PCI Device ID to fix conflict with CNDS3 driver
        usb: cdns3: Fix issue with using incorrect PCI device function
        usb: cdnsp: Fixes issue with redundant Status Stage
        MAINTAINERS: make me a reviewer of USB/IP
        thunderbolt: Use scale field when allocating USB3 bandwidth
        thunderbolt: Limit USB3 bandwidth of certain Intel USB4 host routers
        thunderbolt: Call tb_check_quirks() after initializing adapters
        thunderbolt: Add missing UNSET_INBOUND_SBTX for retimer access
        thunderbolt: Fix memory leak in margining
        usb: dwc2: drd: fix inconsistent mode if role-switch-default-mode="host"
        docs: usb: Add documentation for the UVC Gadget
        ...
      0ec57cfa
    • Linus Torvalds's avatar
      Merge tag 'sched_urgent_for_v6.3_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 18940c88
      Linus Torvalds authored
      Pull scheduler fix from Borislav Petkov:
      
       - Fix a corner case where vruntime of a task is not being sanitized
      
      * tag 'sched_urgent_for_v6.3_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        sched/fair: Sanitize vruntime of entity being migrated
      18940c88
    • Linus Torvalds's avatar
      Merge tag 'perf_urgent_for_v6.3_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 974fc943
      Linus Torvalds authored
      Pull perf fix from Borislav Petkov:
      
       - Properly clear perf event status tracking in the AMD perf event
         overflow handler
      
      * tag 'perf_urgent_for_v6.3_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        perf/x86/amd/core: Always clear status for idx
      974fc943
    • Linus Torvalds's avatar
      Merge tag 'core_urgent_for_v6.3_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · f6cdaeb0
      Linus Torvalds authored
      Pull core fixes from Borislav Petkov:
      
       - Do the delayed RCU wakeup for kthreads in the proper order so that
         former doesn't get ignored
      
       - A noinstr warning fix
      
      * tag 'core_urgent_for_v6.3_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        entry/rcu: Check TIF_RESCHED _after_ delayed RCU wake-up
        entry: Fix noinstr warning in __enter_from_user_mode()
      f6cdaeb0
    • Linus Torvalds's avatar
      Merge tag 'x86_urgent_for_v6.3_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 986c6374
      Linus Torvalds authored
      Pull x86 fixes from Borislav Petkov:
      
       - Add a AMX ptrace self test
      
       - Prevent a false-positive warning when retrieving the (invalid)
         address of dynamic FPU features in their init state which are not
         saved in init_fpstate at all
      
       - Randomize per-CPU entry areas only when KASLR is enabled
      
      * tag 'x86_urgent_for_v6.3_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        selftests/x86/amx: Add a ptrace test
        x86/fpu/xstate: Prevent false-positive warning in __copy_xstate_uabi_buf()
        x86/mm: Do not shuffle CPU entry areas without KASLR
      986c6374
    • Linus Torvalds's avatar
      Merge tag 'smb3-client-fixes-6.3-rc3' of git://git.samba.org/sfrench/cifs-2.6 · 6485ac65
      Linus Torvalds authored
      Pull cifs client fixes from Steve French:
       "Twelve cifs/smb3 client fixes (most also for stable)
      
         - forced umount fix
      
         - fix for two perf regressions
      
         - reconnect fixes
      
         - small debugging improvements
      
         - multichannel fixes"
      
      * tag 'smb3-client-fixes-6.3-rc3' of git://git.samba.org/sfrench/cifs-2.6:
        smb3: fix unusable share after force unmount failure
        cifs: fix dentry lookups in directory handle cache
        smb3: lower default deferred close timeout to address perf regression
        cifs: fix missing unload_nls() in smb2_reconnect()
        cifs: avoid race conditions with parallel reconnects
        cifs: append path to open_enter trace event
        cifs: print session id while listing open files
        cifs: dump pending mids for all channels in DebugData
        cifs: empty interface list when server doesn't support query interfaces
        cifs: do not poll server interfaces too regularly
        cifs: lock chan_lock outside match_session
        cifs: check only tcon status on tcon related functions
      6485ac65
  11. 25 Mar, 2023 7 commits
    • Linus Torvalds's avatar
      Merge tag 'nfsd-6.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux · da8e7da1
      Linus Torvalds authored
      Pull nfsd fix from Chuck Lever:
      
       - Fix a crash when using NFS with krb5p
      
      * tag 'nfsd-6.3-4' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux:
        SUNRPC: Fix a crash in gss_krb5_checksum()
      da8e7da1
    • Linus Torvalds's avatar
      Merge tag 'xfs-6.3-fixes-7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux · 5b9ff397
      Linus Torvalds authored
      Pull yet more xfs bug fixes from Darrick Wong:
       "The first bugfix addresses a longstanding problem where we use the
        wrong file mapping cursors when trying to compute the speculative
        preallocation quantity. This has been causing sporadic crashes when
        alwayscow mode is engaged.
      
        The other two fixes correct minor problems in more recent changes.
      
         - Fix the new allocator tracepoints because git am mismerged the
           changes such that the trace_XXX got rebased to be in function YYY
           instead of XXX
      
         - Ensure that the perag AGFL_RESET state is consistent with whatever
           we've just read off the disk
      
         - Fix a bug where we used the wrong iext cursor during a write begin"
      
      * tag 'xfs-6.3-fixes-7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
        xfs: fix mismerged tracepoints
        xfs: clear incore AGFL_RESET state if it's not needed
        xfs: pass the correct cursor to xfs_iomap_prealloc_size
      5b9ff397
    • Linus Torvalds's avatar
      Merge tag 'xfs-6.3-fixes-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux · f768b35a
      Linus Torvalds authored
      Pull xfs percpu counter fixes from Darrick Wong:
       "We discovered a filesystem summary counter corruption problem that was
        traced to cpu hot-remove racing with the call to percpu_counter_sum
        that sets the free block count in the superblock when writing it to
        disk. The root cause is that percpu_counter_sum doesn't cull from
        dying cpus and hence misses those counter values if the cpu shutdown
        hooks have not yet run to merge the values.
      
        I'm hoping this is a fairly painless fix to the problem, since the
        dying cpu mask should generally be empty. It's been in for-next for a
        week without any complaints from the bots.
      
         - Fix a race in the percpu counters summation code where the
           summation failed to add in the values for any CPUs that were dying
           but not yet dead. This fixes some minor discrepancies and incorrect
           assertions when running generic/650"
      
      * tag 'xfs-6.3-fixes-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
        pcpcntr: remove percpu_counter_sum_all()
        fork: remove use of percpu_counter_sum_all
        pcpcntrs: fix dying cpu summation race
        cpumask: introduce for_each_cpu_or
      f768b35a
    • Linus Torvalds's avatar
      Merge tag 'xfs-6.3-fixes-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux · d7044263
      Linus Torvalds authored
      Pull xfs fixes from Darrick Wong:
       "This batch started with some debugging enhancements to the new
        allocator refactoring that we put in 6.3-rc1 to assist developers in
        rebasing their dev branches.
      
        As for more serious code changes -- there's a bug fix to make the
        lockless allocator scan the whole filesystem before resorting to the
        locking allocator. We're also adding a selftest for the venerable
        directory/xattr hash function to make sure that it produces consistent
        results so that we can address any fallout as soon as possible.
      
         - Add a few debugging assertions so that people (me) trying to port
           code to the new allocator functions don't mess up the caller
           requirements
      
         - Relax some overly cautious lock ordering enforcement in the new
           allocator code, which means that file allocations will locklessly
           scan for the best space they can get before backing off to the
           traditional lock-and-really-get-it behavior
      
         - Add tracepoints to make it easier to trace the xfs allocator
           behavior
      
         - Actually test the dir/xattr hash algorithm to make sure it produces
           consistent results across all the platforms XFS supports"
      
      * tag 'xfs-6.3-fixes-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
        xfs: test dir/attr hash when loading module
        xfs: add tracepoints for each of the externally visible allocators
        xfs: walk all AGs if TRYLOCK passed to xfs_alloc_vextent_iterate_ags
        xfs: try to idiot-proof the allocators
      d7044263
    • Linus Torvalds's avatar
      Merge tag 'hwmon-for-v6.3-rc4' of... · 4bdec23f
      Linus Torvalds authored
      Merge tag 'hwmon-for-v6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
      
      Pull hwmon fixes from Guenter Roeck:
      
       - it87: Fix voltage scaling for chips with 10.9mV ADCs
      
       - xgene: Fix ioremap and memremap leak
      
       - peci/cputemp: Fix miscalculated DTS temperature for SKX
      
       - hwmon core: fix potential sensor registration failure with thermal
         subsystem if of_node is missing
      
      * tag 'hwmon-for-v6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
        hwmon (it87): Fix voltage scaling for chips with 10.9mV  ADCs
        hwmon: (xgene) Fix ioremap and memremap leak
        hwmon: fix potential sensor registration fail if of_node is missing
        hwmon: (peci/cputemp) Fix miscalculated DTS for SKX
      4bdec23f
    • Linus Torvalds's avatar
      Merge tag 'mm-hotfixes-stable-2023-03-24-17-09' of... · 65aca32e
      Linus Torvalds authored
      Merge tag 'mm-hotfixes-stable-2023-03-24-17-09' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
      
      Pull misc fixes from Andrew Morton:
       "21 hotfixes, 8 of which are cc:stable. 11 are for MM, the remainder
        are for other subsystems"
      
      * tag 'mm-hotfixes-stable-2023-03-24-17-09' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (21 commits)
        mm: mmap: remove newline at the end of the trace
        mailmap: add entries for Richard Leitner
        kcsan: avoid passing -g for test
        kfence: avoid passing -g for test
        mm: kfence: fix using kfence_metadata without initialization in show_object()
        lib: dhry: fix unstable smp_processor_id(_) usage
        mailmap: add entry for Enric Balletbo i Serra
        mailmap: map Sai Prakash Ranjan's old address to his current one
        mailmap: map Rajendra Nayak's old address to his current one
        Revert "kasan: drop skip_kasan_poison variable in free_pages_prepare"
        mailmap: add entry for Tobias Klauser
        kasan, powerpc: don't rename memintrinsics if compiler adds prefixes
        mm/ksm: fix race with VMA iteration and mm_struct teardown
        kselftest: vm: fix unused variable warning
        mm: fix error handling for map_deny_write_exec
        mm: deduplicate error handling for map_deny_write_exec
        checksyscalls: ignore fstat to silence build warning on LoongArch
        nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
        test_maple_tree: add more testing for mas_empty_area()
        maple_tree: fix mas_skip_node() end slot detection
        ...
      65aca32e
    • Linus Torvalds's avatar
      Merge tag '6.3-rc3-ksmbd-smb3-server-fixes' of git://git.samba.org/ksmbd · 90c8ce31
      Linus Torvalds authored
      Pull ksmbd server fixes from Steve French:
      
       - return less confusing messages on unsupported dialects
         (STATUS_NOT_SUPPORTED instead of I/O error)
      
       - fix for overly frequent inactive session termination
      
       - fix refcount leak
      
       - fix bounds check problems found by static checkers
      
       - fix to advertise named stream support correctly
      
       - Fix AES256 signing bug when connected to from MacOS
      
      * tag '6.3-rc3-ksmbd-smb3-server-fixes' of git://git.samba.org/ksmbd:
        ksmbd: return unsupported error on smb1 mount
        ksmbd: return STATUS_NOT_SUPPORTED on unsupported smb2.0 dialect
        ksmbd: don't terminate inactive sessions after a few seconds
        ksmbd: fix possible refcount leak in smb2_open()
        ksmbd: add low bound validation to FSCTL_QUERY_ALLOCATED_RANGES
        ksmbd: add low bound validation to FSCTL_SET_ZERO_DATA
        ksmbd: set FILE_NAMED_STREAMS attribute in FS_ATTRIBUTE_INFORMATION
        ksmbd: fix wrong signingkey creation when encryption is AES256
      90c8ce31
  12. 24 Mar, 2023 8 commits
    • Linus Torvalds's avatar
      Merge tag 'arm-fixes-6.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc · e76db6e5
      Linus Torvalds authored
      Pull ARM SoC fixes from Arnd Bergmann:
       "As usual, most of the bug fixes address issues in the devicetree
        files, and out of these, most are for the Qualcomm and NXP platforms,
        including:
      
         - A missing 'reserved-memory' property on LG G Watch R that is needed
           to prevent clashing with firmware
      
         - Annotations for cache coherency on multiple machines
      
         - Corrections for pinctrl, regulator, clock, iommu and power domain
           properties for i.MX and Qualcomm to correctly reflect the hardware
           settings
      
         - Firmware file names on multiple machines SA8540P Ride board
      
         - An incompatible change to the qcom vadc driver requires adding
           individual labels
      
         - Fix EQoS PHY reset GPIO by dropping the deprecated/wrong property
           and switch to the new bindings.
      
         - A fix for PCI bus address translation Tegra194 and Tegra234.
      
        There are also a couple of device driver fixes, addressing:
      
         - A race condition in the amdtee driver
      
         - A performance regression in the Qualcomm 'llcc' driver
      
         - An unitialized variable use NXP i.MX 'weim' driver
      
         - Error handling issues in Qualcomm 'rmtfs', and 'scm' drivers and
           the Arm scmi firmware driver"
      
      * tag 'arm-fixes-6.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (48 commits)
        arm64: dts: qcom: sc8280xp-x13s: mark bob regulator as always-on
        arm64: dts: qcom: sc8280xp-x13s: mark s12b regulator as always-on
        arm64: dts: qcom: sc8280xp-x13s: mark s10b regulator as always-on
        arm64: dts: qcom: sc8280xp-x13s: mark s11b regulator as always-on
        arm64: dts: imx93: add missing #address-cells and #size-cells to i2c nodes
        bus: imx-weim: fix branch condition evaluates to a garbage value
        arm64: dts: imx8mn: specify #sound-dai-cells for SAI nodes
        ARM: dts: imx6sl: tolino-shine2hd: fix usbotg1 pinctrl
        ARM: dts: imx6sll: e60k02: fix usbotg1 pinctrl
        ARM: dts: imx6sll: e70k02: fix usbotg1 pinctrl
        arm64: dts: imx93: Fix eqos properties
        arm64: dts: imx8mp: Fix LCDIF2 node clock order
        arm64: dts: imx8mm-nitrogen-r2: fix WM8960 clock name
        arm64: dts: imx8dxl-evk: Fix eqos phy reset gpio
        firmware: qcom: scm: fix bogus irq error at probe
        arm64: dts: qcom: sm8550: Mark UFS controller as cache coherent
        arm64: dts: qcom: sa8540p-ride: correct name of remoteproc_nsp0 firmware
        arm64: dts: qcom: sm8450: Mark UFS controller as cache coherent
        arm64: dts: qcom: sm8350: Mark UFS controller as cache coherent
        arm64: dts: qcom: sm8550: fix LPASS pinctrl slew base address
        ...
      e76db6e5
    • Linus Torvalds's avatar
      Merge tag 'for-v6.3-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply · d7b5c942
      Linus Torvalds authored
      Pull power supply fixes from Sebastian Reichel:
      
       - rk817: Fix compiler warning
      
       - cros_usbpd-charger: Fix excessive error printing
      
       - axp288_fuel_gauge: handle platform_get_irq error
      
       - bq24190 and da9150: Fix race condition in remove path
      
      * tag 'for-v6.3-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply:
        power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition
        power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition
        power: supply: axp288_fuel_gauge: Added check for negative values
        power: supply: cros_usbpd: reclassify "default case!" as debug
        power: supply: rk817: Fix unsigned comparison with less than zero
      d7b5c942
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2023-03-24' of git://anongit.freedesktop.org/drm/drm · 37154c19
      Linus Torvalds authored
      Pull drm fixes from Daniel Vetter:
      
       - usual pile of fixes for amdgpu & i915
      
       - probe error handling fixes for meson, lt8912b bridge
      
       - the host1x patch from Arnd
      
       - panel-orientation fix for Lenovo Book X90F
      
      * tag 'drm-fixes-2023-03-24' of git://anongit.freedesktop.org/drm/drm: (23 commits)
        gpu: host1x: fix uninitialized variable use
        drm/amd/display: Set dcn32 caps.seamless_odm
        drm/amd/display: fix wrong index used in dccg32_set_dpstreamclk
        drm/amdgpu/nv: Apply ASPM quirk on Intel ADL + AMD Navi
        drm/amd/display: remove outdated 8bpc comments
        drm/amdgpu/gfx: set cg flags to enter/exit safe mode
        drm/amdgpu: Force signal hw_fences that are embedded in non-sched jobs
        drm/amdgpu: add mes resume when do gfx post soft reset
        drm/amdgpu: skip ASIC reset for APUs when go to S4
        drm/amdgpu: reposition the gpu reset checking for reuse
        drm/bridge: lt8912b: return EPROBE_DEFER if bridge is not found
        drm/meson: fix missing component unbind on bind errors
        drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Book X90F
        Revert "drm/i915/hwmon: Enable PL1 power limit"
        drm/i915: Update vblank timestamping stuff on seamless M/N change
        drm/i915: Fix format for perf_limit_reasons
        drm/i915/gt: perform uc late init after probe error injection
        drm/i915/active: Fix missing debug object activation
        drm/i915/guc: Fix missing ecodes
        drm/i915/mtl: Disable MC6 for MTL A step
        ...
      37154c19
    • Linus Torvalds's avatar
      Merge tag 'for-6.3/dm-fixes' of... · 5ad4fe96
      Linus Torvalds authored
      Merge tag 'for-6.3/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm
      
      Pull device mapper fixes from Mike Snitzer:
      
       - Fix DM thin to work as a swap device by using 'limit_swap_bios' DM
         target flag (initially added to allow swap to dm-crypt) to throttle
         the amount of outstanding swap bios.
      
       - Fix DM crypt soft lockup warnings by calling cond_resched() from the
         cpu intensive loop in dmcrypt_write().
      
       - Fix DM crypt to not access an uninitialized tasklet. This fix allows
         for consistent handling of IO completion, by _not_ needlessly punting
         to a workqueue when tasklets are not needed.
      
       - Fix DM core's alloc_dev() initialization for DM stats to check for
         and propagate alloc_percpu() failure.
      
      * tag 'for-6.3/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
        dm stats: check for and propagate alloc_percpu failure
        dm crypt: avoid accessing uninitialized tasklet
        dm crypt: add cond_resched() to dmcrypt_write()
        dm thin: fix deadlock when swapping to thin device
      5ad4fe96
    • Linus Torvalds's avatar
      Merge tag 'block-6.3-2023-03-24' of git://git.kernel.dk/linux · 83511470
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
      
       - NVMe pull request via Christoph:
           - Send Identify with CNS 06h only to I/O controllers (Martin
             George)
           - Fix nvme_tcp_term_pdu to match spec (Caleb Sander)
      
       - Pass in issue_flags for uring_cmd, so the end_io handlers don't need
         to assume what the right context is (me)
      
       - Fix for ublk, marking it as LIVE before adding it to avoid races on
         the initial IO (Ming)
      
      * tag 'block-6.3-2023-03-24' of git://git.kernel.dk/linux:
        nvme-tcp: fix nvme_tcp_term_pdu to match spec
        nvme: send Identify with CNS 06h only to I/O controllers
        block/io_uring: pass in issue_flags for uring_cmd task_work handling
        block: ublk_drv: mark device as LIVE before adding disk
      83511470
    • Linus Torvalds's avatar
      Merge tag 'io_uring-6.3-2023-03-24' of git://git.kernel.dk/linux · e344eb7b
      Linus Torvalds authored
      Pull io_uring fixes from Jens Axboe:
      
       - Fix an issue with repeated -ECONNREFUSED on a socket (me)
      
       - Fix a NULL pointer deference due to a stale lookup cache for
         allocating direct descriptors (Savino)
      
      * tag 'io_uring-6.3-2023-03-24' of git://git.kernel.dk/linux:
        io_uring/rsrc: fix null-ptr-deref in io_file_bitmap_get()
        io_uring/net: avoid sending -ECONNABORTED on repeated connection requests
      e344eb7b
    • Linus Torvalds's avatar
      Merge tag 'thermal-6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · fd3d06ff
      Linus Torvalds authored
      Pull thermal control fixes from Rafael Wysocki:
       "These address two recent regressions related to thermal control.
      
        Specifics:
      
         - Restore the thermal core behavior regarding zero-temperature trip
           points to avoid a driver regression (Ido Schimmel)
      
         - Fix a recent regression in the ACPI processor driver preventing it
           from changing the number of CPU cooling device states exposed via
           sysfs after the given CPU cooling device has been registered
           (Rafael Wysocki)"
      
      * tag 'thermal-6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        thermal: core: Restore behavior regarding invalid trip points
        ACPI: processor: thermal: Update CPU cooling devices on cpufreq policy changes
        thermal: core: Introduce thermal_cooling_device_update()
        thermal: core: Introduce thermal_cooling_device_present()
        ACPI: processor: Reorder acpi_processor_driver_init()
      fd3d06ff
    • Linus Torvalds's avatar
      Merge tag 'acpi-6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 1868d192
      Linus Torvalds authored
      Pull ACPI fixes from Rafael Wysocki:
       "These add new ACPI IRQ override and backlight detection quirks.
      
        Specifics:
      
         - Add backlight=native DMI quirk for Acer Aspire 3830TG to the ACPI
           backlight driver (Hans de Goede)
      
         - Add an ACPI IRQ override quirk for Medion S17413 (Aymeric Wibo)"
      
      * tag 'acpi-6.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        ACPI: resource: Add Medion S17413 to IRQ override quirk
        ACPI: video: Add backlight=native DMI quirk for Acer Aspire 3830TG
      1868d192