1. 08 Mar, 2023 7 commits
    • Jan Kara's avatar
      ext4: Fix deadlock during directory rename · 3c92792d
      Jan Kara authored
      As lockdep properly warns, we should not be locking i_rwsem while having
      transactions started as the proper lock ordering used by all directory
      handling operations is i_rwsem -> transaction start. Fix the lock
      ordering by moving the locking of the directory earlier in
      ext4_rename().
      
      Reported-by: syzbot+9d16c39efb5fade84574@syzkaller.appspotmail.com
      Fixes: 0813299c ("ext4: Fix possible corruption when moving a directory")
      Link: https://syzkaller.appspot.com/bug?extid=9d16c39efb5fade84574Signed-off-by: default avatarJan Kara <jack@suse.cz>
      Link: https://lore.kernel.org/r/20230301141004.15087-1-jack@suse.czSigned-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      3c92792d
    • Tudor Ambarus's avatar
      ext4: Fix comment about the 64BIT feature · 7fc1f5c2
      Tudor Ambarus authored
      64BIT is part of the incompatible feature set, update the comment
      accordingly.
      Signed-off-by: default avatarTudor Ambarus <tudor.ambarus@linaro.org>
      Reviewed-by: default avatarDarrick J. Wong <djwong@kernel.org>
      Link: https://lore.kernel.org/r/20230301133842.671821-1-tudor.ambarus@linaro.orgSigned-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      7fc1f5c2
    • Wu Bo's avatar
      docs: ext4: modify the group desc size to 64 · b7eef407
      Wu Bo authored
      Since the default ext4 group desc size is 64 now (assuming that the
      64-bit feature is enbled). And the size mentioned in this doc is 64 too.
      Change it to 64.
      Signed-off-by: default avatarWu Bo <bo.wu@vivo.com>
      Acked-by: default avatarDarrick J. Wong <djwong@kernel.org>
      Link: https://lore.kernel.org/r/20230222013525.14748-1-bo.wu@vivo.comSigned-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      b7eef407
    • Darrick J. Wong's avatar
      ext4: fix another off-by-one fsmap error on 1k block filesystems · c993799b
      Darrick J. Wong authored
      Apparently syzbot figured out that issuing this FSMAP call:
      
      struct fsmap_head cmd = {
      	.fmh_count	= ...;
      	.fmh_keys	= {
      		{ .fmr_device = /* ext4 dev */, .fmr_physical = 0, },
      		{ .fmr_device = /* ext4 dev */, .fmr_physical = 0, },
      	},
      ...
      };
      ret = ioctl(fd, FS_IOC_GETFSMAP, &cmd);
      
      Produces this crash if the underlying filesystem is a 1k-block ext4
      filesystem:
      
      kernel BUG at fs/ext4/ext4.h:3331!
      invalid opcode: 0000 [#1] PREEMPT SMP
      CPU: 3 PID: 3227965 Comm: xfs_io Tainted: G        W  O       6.2.0-rc8-achx
      Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
      RIP: 0010:ext4_mb_load_buddy_gfp+0x47c/0x570 [ext4]
      RSP: 0018:ffffc90007c03998 EFLAGS: 00010246
      RAX: ffff888004978000 RBX: ffffc90007c03a20 RCX: ffff888041618000
      RDX: 0000000000000000 RSI: 00000000000005a4 RDI: ffffffffa0c99b11
      RBP: ffff888012330000 R08: ffffffffa0c2b7d0 R09: 0000000000000400
      R10: ffffc90007c03950 R11: 0000000000000000 R12: 0000000000000001
      R13: 00000000ffffffff R14: 0000000000000c40 R15: ffff88802678c398
      FS:  00007fdf2020c880(0000) GS:ffff88807e100000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00007ffd318a5fe8 CR3: 000000007f80f001 CR4: 00000000001706e0
      Call Trace:
       <TASK>
       ext4_mballoc_query_range+0x4b/0x210 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]
       ext4_getfsmap_datadev+0x713/0x890 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]
       ext4_getfsmap+0x2b7/0x330 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]
       ext4_ioc_getfsmap+0x153/0x2b0 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]
       __ext4_ioctl+0x2a7/0x17e0 [ext4 dfa189daddffe8fecd3cdfd00564e0f265a8ab80]
       __x64_sys_ioctl+0x82/0xa0
       do_syscall_64+0x2b/0x80
       entry_SYSCALL_64_after_hwframe+0x46/0xb0
      RIP: 0033:0x7fdf20558aff
      RSP: 002b:00007ffd318a9e30 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
      RAX: ffffffffffffffda RBX: 00000000000200c0 RCX: 00007fdf20558aff
      RDX: 00007fdf1feb2010 RSI: 00000000c0c0583b RDI: 0000000000000003
      RBP: 00005625c0634be0 R08: 00005625c0634c40 R09: 0000000000000001
      R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdf1feb2010
      R13: 00005625be70d994 R14: 0000000000000800 R15: 0000000000000000
      
      For GETFSMAP calls, the caller selects a physical block device by
      writing its block number into fsmap_head.fmh_keys[01].fmr_device.
      To query mappings for a subrange of the device, the starting byte of the
      range is written to fsmap_head.fmh_keys[0].fmr_physical and the last
      byte of the range goes in fsmap_head.fmh_keys[1].fmr_physical.
      
      IOWs, to query what mappings overlap with bytes 3-14 of /dev/sda, you'd
      set the inputs as follows:
      
      	fmh_keys[0] = { .fmr_device = major(8, 0), .fmr_physical = 3},
      	fmh_keys[1] = { .fmr_device = major(8, 0), .fmr_physical = 14},
      
      Which would return you whatever is mapped in the 12 bytes starting at
      physical offset 3.
      
      The crash is due to insufficient range validation of keys[1] in
      ext4_getfsmap_datadev.  On 1k-block filesystems, block 0 is not part of
      the filesystem, which means that s_first_data_block is nonzero.
      ext4_get_group_no_and_offset subtracts this quantity from the blocknr
      argument before cracking it into a group number and a block number
      within a group.  IOWs, block group 0 spans blocks 1-8192 (1-based)
      instead of 0-8191 (0-based) like what happens with larger blocksizes.
      
      The net result of this encoding is that blocknr < s_first_data_block is
      not a valid input to this function.  The end_fsb variable is set from
      the keys that are copied from userspace, which means that in the above
      example, its value is zero.  That leads to an underflow here:
      
      	blocknr = blocknr - le32_to_cpu(es->s_first_data_block);
      
      The division then operates on -1:
      
      	offset = do_div(blocknr, EXT4_BLOCKS_PER_GROUP(sb)) >>
      		EXT4_SB(sb)->s_cluster_bits;
      
      Leaving an impossibly large group number (2^32-1) in blocknr.
      ext4_getfsmap_check_keys checked that keys[0].fmr_physical and
      keys[1].fmr_physical are in increasing order, but
      ext4_getfsmap_datadev adjusts keys[0].fmr_physical to be at least
      s_first_data_block.  This implies that we have to check it again after
      the adjustment, which is the piece that I forgot.
      
      Reported-by: syzbot+6be2b977c89f79b6b153@syzkaller.appspotmail.com
      Fixes: 4a495624 ("ext4: fix off-by-one fsmap error on 1k block filesystems")
      Link: https://syzkaller.appspot.com/bug?id=79d5768e9bfe362911ac1a5057a36fc6b5c30002
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarDarrick J. Wong <djwong@kernel.org>
      Link: https://lore.kernel.org/r/Y+58NPTH7VNGgzdd@magnoliaSigned-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      c993799b
    • Eric Whitney's avatar
      ext4: fix RENAME_WHITEOUT handling for inline directories · c9f62c8b
      Eric Whitney authored
      A significant number of xfstests can cause ext4 to log one or more
      warning messages when they are run on a test file system where the
      inline_data feature has been enabled.  An example:
      
      "EXT4-fs warning (device vdc): ext4_dirblock_csum_set:425: inode
       #16385: comm fsstress: No space for directory leaf checksum. Please
      run e2fsck -D."
      
      The xfstests include: ext4/057, 058, and 307; generic/013, 051, 068,
      070, 076, 078, 083, 232, 269, 270, 390, 461, 475, 476, 482, 579, 585,
      589, 626, 631, and 650.
      
      In this situation, the warning message indicates a bug in the code that
      performs the RENAME_WHITEOUT operation on a directory entry that has
      been stored inline.  It doesn't detect that the directory is stored
      inline, and incorrectly attempts to compute a dirent block checksum on
      the whiteout inode when creating it.  This attempt fails as a result
      of the integrity checking in get_dirent_tail (usually due to a failure
      to match the EXT4_FT_DIR_CSUM magic cookie), and the warning message
      is then emitted.
      
      Fix this by simply collecting the inlined data state at the time the
      search for the source directory entry is performed.  Existing code
      handles the rest, and this is sufficient to eliminate all spurious
      warning messages produced by the tests above.  Go one step further
      and do the same in the code that resets the source directory entry in
      the event of failure.  The inlined state should be present in the
      "old" struct, but given the possibility of a race there's no harm
      in taking a conservative approach and getting that information again
      since the directory entry is being reread anyway.
      
      Fixes: b7ff91fd ("ext4: find old entry again if failed to rename whiteout")
      Cc: stable@kernel.org
      Signed-off-by: default avatarEric Whitney <enwlinux@gmail.com>
      Reviewed-by: default avatarJan Kara <jack@suse.cz>
      Link: https://lore.kernel.org/r/20230210173244.679890-1-enwlinux@gmail.comSigned-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      c9f62c8b
    • Thomas Weißschuh's avatar
      ext4: make kobj_type structures constant · 60db00e0
      Thomas Weißschuh authored
      Since commit ee6d3dd4 ("driver core: make kobj_type constant.")
      the driver core allows the usage of const struct kobj_type.
      
      Take advantage of this to constify the structure definitions to prevent
      modification at runtime.
      Signed-off-by: default avatarThomas Weißschuh <linux@weissschuh.net>
      Reviewed-by: default avatarJan Kara <jack@suse.cz>
      Link: https://lore.kernel.org/r/20230209-kobj_type-ext4-v1-1-6865fb05c1f8@weissschuh.netSigned-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      60db00e0
    • Eric Biggers's avatar
      ext4: fix cgroup writeback accounting with fs-layer encryption · ffec85d5
      Eric Biggers authored
      When writing a page from an encrypted file that is using
      filesystem-layer encryption (not inline encryption), ext4 encrypts the
      pagecache page into a bounce page, then writes the bounce page.
      
      It also passes the bounce page to wbc_account_cgroup_owner().  That's
      incorrect, because the bounce page is a newly allocated temporary page
      that doesn't have the memory cgroup of the original pagecache page.
      This makes wbc_account_cgroup_owner() not account the I/O to the owner
      of the pagecache page as it should.
      
      Fix this by always passing the pagecache page to
      wbc_account_cgroup_owner().
      
      Fixes: 001e4a87 ("ext4: implement cgroup writeback support")
      Cc: stable@vger.kernel.org
      Reported-by: default avatarMatthew Wilcox (Oracle) <willy@infradead.org>
      Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
      Acked-by: default avatarTejun Heo <tj@kernel.org>
      Link: https://lore.kernel.org/r/20230203005503.141557-1-ebiggers@kernel.orgSigned-off-by: default avatarTheodore Ts'o <tytso@mit.edu>
      ffec85d5
  2. 25 Feb, 2023 3 commits
  3. 19 Feb, 2023 10 commits
  4. 15 Feb, 2023 1 commit
  5. 09 Feb, 2023 3 commits
  6. 22 Jan, 2023 2 commits
    • Linus Torvalds's avatar
      Linux 6.2-rc5 · 2241ab53
      Linus Torvalds authored
      2241ab53
    • Linus Torvalds's avatar
      Merge tag 'io_uring-6.2-2023-01-21' of git://git.kernel.dk/linux · 95f184d0
      Linus Torvalds authored
      Pull another io_uring fix from Jens Axboe:
       "Just a single fix for a regression that happened in this release due
        to a poll change. Normally I would've just deferred it to next week,
        but since the original fix got picked up by stable, I think it's
        better to just send this one off separately.
      
        The issue is around the poll race fix, and how it mistakenly also got
        applied to multishot polling. Those don't need the race fix, and we
        should not be doing any reissues for that case. Exhaustive test cases
        were written and committed to the liburing regression suite for the
        reported issue, and additions for similar issues"
      
      * tag 'io_uring-6.2-2023-01-21' of git://git.kernel.dk/linux:
        io_uring/poll: don't reissue in case of poll race on multishot request
      95f184d0
  7. 21 Jan, 2023 9 commits
    • Linus Torvalds's avatar
      Merge tag 'char-misc-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · f6714402
      Linus Torvalds authored
      Pull char/misc driver fixes from Greg KH:
       "Here are some small char/misc and other subsystem driver fixes for
        6.2-rc5 to resolve a few reported issues. They include:
      
         - long time pending fastrpc fixes (should have gone into 6.1, my
           fault)
      
         - mei driver/bus fixes and new device ids
      
         - interconnect driver fixes for reported problems
      
         - vmci bugfix
      
         - w1 driver bugfixes for reported problems
      
        Almost all of these have been in linux-next with no reported problems,
        the rest have all passed 0-day bot testing in my tree and on the
        mailing lists where they have sat too long due to me taking a long
        time to catch up on my pending patch queue"
      
      * tag 'char-misc-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
        VMCI: Use threaded irqs instead of tasklets
        misc: fastrpc: Pass bitfield into qcom_scm_assign_mem
        gsmi: fix null-deref in gsmi_get_variable
        misc: fastrpc: Fix use-after-free race condition for maps
        misc: fastrpc: Don't remove map on creater_process and device_release
        misc: fastrpc: Fix use-after-free and race in fastrpc_map_find
        misc: fastrpc: fix error code in fastrpc_req_mmap()
        mei: me: add meteor lake point M DID
        mei: bus: fix unlink on bus in error path
        w1: fix WARNING after calling w1_process()
        w1: fix deadloop in __w1_remove_master_device()
        comedi: adv_pci1760: Fix PWM instruction handling
        interconnect: qcom: rpm: Use _optional func for provider clocks
        interconnect: qcom: msm8996: Fix regmap max_register values
        interconnect: qcom: msm8996: Provide UFS clocks to A2NoC
        dt-bindings: interconnect: Add UFS clocks to MSM8996 A2NoC
      f6714402
    • Linus Torvalds's avatar
      Merge tag 'driver-core-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core · c88a3114
      Linus Torvalds authored
      Pull driver core fixes from Greg KH:
       "Here are three small driver and kernel core fixes for 6.2-rc5. They
        include:
      
         - potential gadget fixup in do_prlimit
      
         - device property refcount leak fix
      
         - test_async_probe bugfix for reported problem"
      
      * tag 'driver-core-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
        prlimit: do_prlimit needs to have a speculation check
        driver core: Fix test_async_probe_init saves device in wrong array
        device property: fix of node refcount leak in fwnode_graph_get_next_endpoint()
      c88a3114
    • Linus Torvalds's avatar
      Merge tag 'staging-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · bb86d657
      Linus Torvalds authored
      Pull staging driver fix from Greg KH:
       "Here is a single staging driver fix for 6.2-rc5. It resolves a build
        issue reported and Fixed by Arnd in the vc04_services driver. It's
        been in linux-next this week with no reported problems"
      
      * tag 'staging-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        staging: vchiq_arm: fix enum vchiq_status return types
      bb86d657
    • Linus Torvalds's avatar
      Merge tag 'tty-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · bd5cc6ee
      Linus Torvalds authored
      Pull tty/serial driver fixes from Greg KH:
       "Here are some small tty and serial driver fixes for 6.2-rc5 that
        resolve a number of tiny reported issues and some new device ids. They
        include:
      
         - new device id for the exar serial driver
      
         - speakup tty driver bugfix
      
         - atmel serial driver baudrate fixup
      
         - stm32 serial driver bugfix and then revert as the bugfix broke the
           build. That will come back in a later pull request once it is all
           worked out properly.
      
         - amba-pl011 serial driver rs486 mode bugfix
      
         - qcom_geni serial driver bugfix
      
        Most of these have been in linux-next with no reported problems (well,
        other than the build breakage which generated the revert), the new
        device id passed 0-day testing"
      
      * tag 'tty-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        serial: exar: Add support for Sealevel 7xxxC serial cards
        Revert "serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler"
        tty: serial: qcom_geni: avoid duplicate struct member init
        serial: atmel: fix incorrect baudrate setup
        tty: fix possible null-ptr-defer in spk_ttyio_release
        serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler
        serial: amba-pl011: fix high priority character transmission in rs486 mode
        serial: pch_uart: Pass correct sg to dma_unmap_sg()
        tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer
      bd5cc6ee
    • Linus Torvalds's avatar
      Merge tag 'usb-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · e67da288
      Linus Torvalds authored
      Pull USB / Thunderbolt fixes from Greg KH:
       "Here are a number of small USB and Thunderbolt driver fixes and new
        device id changes for 6.2-rc5. Included in here are:
      
         - thunderbolt bugfixes for reported problems
      
         - new usb-serial driver ids added
      
         - onboard_hub usb driver fixes for much-reported problems
      
         - xhci bugfixes
      
         - typec bugfixes
      
         - ehci-fsl driver module alias fix
      
         - iowarrior header size fix
      
         - usb gadget driver fixes
      
        All of these, except for the iowarrior fix, have been in linux-next
        with no reported issues. The iowarrior fix passed the 0-day testing
        and is a one digit change based on a reported problem in the driver
        (which was written to a spec, not the real device that is now
        available)"
      
      * tag 'usb-6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (40 commits)
        USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100
        usb: host: ehci-fsl: Fix module alias
        usb: dwc3: fix extcon dependency
        usb: core: hub: disable autosuspend for TI TUSB8041
        USB: fix misleading usb_set_intfdata() kernel doc
        usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
        USB: gadget: Add ID numbers to configfs-gadget driver names
        usb: typec: tcpm: Fix altmode re-registration causes sysfs create fail
        usb: gadget: g_webcam: Send color matching descriptor per frame
        usb: typec: altmodes/displayport: Use proper macro for pin assignment check
        usb: typec: altmodes/displayport: Fix pin assignment calculation
        usb: typec: altmodes/displayport: Add pin assignment helper
        usb: gadget: f_fs: Ensure ep0req is dequeued before free_request
        usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
        usb: misc: onboard_hub: Move 'attach' work to the driver
        usb: misc: onboard_hub: Invert driver registration order
        usb: ucsi: Ensure connector delayed work items are flushed
        usb: musb: fix error return code in omap2430_probe()
        usb: chipidea: core: fix possible constant 0 if use IS_ERR(ci->role_switch)
        xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables
        ...
      e67da288
    • Linus Torvalds's avatar
      Merge tag 'kbuild-fixes-v6.2-3' of... · 83cd5fd0
      Linus Torvalds authored
      Merge tag 'kbuild-fixes-v6.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild
      
      Pull Kbuild fixes from Masahiro Yamada:
      
       - Hide LDFLAGS_vmlinux from decompressor Makefiles to fix error
         messages when GNU Make 4.4 is used.
      
       - Fix 'make modules' build error when CONFIG_DEBUG_INFO_BTF_MODULES=y.
      
       - Fix warnings emitted by GNU Make 4.4 in scripts/kconfig/Makefile.
      
       - Support GNU Make 4.4 for scripts/jobserver-exec.
      
       - Show clearer error message when kernel/gen_kheaders.sh fails due to
         missing cpio.
      
      * tag 'kbuild-fixes-v6.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:
        kheaders: explicitly validate existence of cpio command
        scripts: support GNU make 4.4 in jobserver-exec
        kconfig: Update all declared targets
        scripts: rpm: make clear that mkspec script contains 4.13 feature
        init/Kconfig: fix LOCALVERSION_AUTO help text
        kbuild: fix 'make modules' error when CONFIG_DEBUG_INFO_BTF_MODULES=y
        kbuild: export top-level LDFLAGS_vmlinux only to scripts/Makefile.vmlinux
        init/version-timestamp.c: remove unneeded #include <linux/version.h>
        docs: kbuild: remove mention to dropped $(objtree) feature
      83cd5fd0
    • Linus Torvalds's avatar
      ext4: deal with legacy signed xattr name hash values · f3bbac32
      Linus Torvalds authored
      We potentially have old hashes of the xattr names generated on systems
      with signed 'char' types.  Now that everybody uses '-funsigned-char',
      those hashes will no longer match.
      
      This only happens if you use xattrs names that have the high bit set,
      which probably doesn't happen in practice, but the xfstest generic/454
      shows it.
      
      Instead of adding a new "signed xattr hash filesystem" bit and having to
      deal with all the possible combinations, just calculate the hash both
      ways if the first one fails, and always generate new hashes with the
      proper unsigned char version.
      Reported-by: default avatarkernel test robot <oliver.sang@intel.com>
      Link: https://lore.kernel.org/oe-lkp/202212291509.704a11c9-oliver.sang@intel.com
      Link: https://lore.kernel.org/all/CAHk-=whUNjwqZXa-MH9KMmc_CpQpoFKFjAB9ZKHuu=TbsouT4A@mail.gmail.com/
      Exposed-by: 3bc753c0 ("kbuild: treat char as always unsigned")
      Cc: Eric Biggers <ebiggers@kernel.org>
      Cc: Andreas Dilger <adilger@dilger.ca>
      Cc: Theodore Ts'o <tytso@mit.edu>,
      Cc: Jason Donenfeld <Jason@zx2c4.com>
      Cc: Masahiro Yamada <masahiroy@kernel.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      f3bbac32
    • Greg Kroah-Hartman's avatar
      prlimit: do_prlimit needs to have a speculation check · 73979060
      Greg Kroah-Hartman authored
      do_prlimit() adds the user-controlled resource value to a pointer that
      will subsequently be dereferenced.  In order to help prevent this
      codepath from being used as a spectre "gadget" a barrier needs to be
      added after checking the range.
      Reported-by: default avatarJordy Zomer <jordyzomer@google.com>
      Tested-by: default avatarJordy Zomer <jordyzomer@google.com>
      Suggested-by: default avatarLinus Torvalds <torvalds@linuxfoundation.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      73979060
    • Linus Torvalds's avatar
      Merge tag 'gpio-fixes-for-v6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux · f883675b
      Linus Torvalds authored
      Pull gpio fixes from Bartosz Golaszewski:
      
       - fix a potential race condition and always set GPIOs used as interrupt
         source to input in gpio-mxc
      
       - fix a GPIO ACPI-related issue with system suspend on Clevo NL5xRU
      
      * tag 'gpio-fixes-for-v6.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
        gpiolib: acpi: Add a ignore wakeup quirk for Clevo NL5xRU
        gpiolib: acpi: Allow ignoring wake capability on pins that aren't in _AEI
        gpio: mxc: Always set GPIOs used as interrupt source to INPUT mode
        gpio: mxc: Protect GPIO irqchip RMW with bgpio spinlock
      f883675b
  8. 20 Jan, 2023 5 commits
    • Linus Torvalds's avatar
      Merge tag '6.2-rc4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 · 4e31bada
      Linus Torvalds authored
      Pull cifs fixes from Steve French:
      
       - important fix for packet signature calculation error
      
       - three fixes to correct DFS deadlock, and DFS refresh problem
      
       - remove an unused DFS function, and duplicate tcon refresh code
      
       - DFS cache lookup fix
      
       - uninitialized rc fix
      
      * tag '6.2-rc4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
        cifs: remove unused function
        cifs: do not include page data when checking signature
        cifs: fix return of uninitialized rc in dfs_cache_update_tgthint()
        cifs: handle cache lookup errors different than -ENOENT
        cifs: remove duplicate code in __refresh_tcon()
        cifs: don't take exclusive lock for updating target hints
        cifs: avoid re-lookups in dfs_cache_find()
        cifs: fix potential deadlock in cache_refresh_path()
      4e31bada
    • Linus Torvalds's avatar
      Merge tag 'pinctrl-v6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl · 8440ffcd
      Linus Torvalds authored
      Pull pin control fixes from Linus Walleij:
      
       - Compilation fix for Sunplus sp7021
      
       - Add some missing headers after a cleanup to the Nomadik driver
      
       - Fix pull type and mux routes on Rockchip RK3568
      
      * tag 'pinctrl-v6.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
        pinctrl: rockchip: fix mux route data for rk3568
        pinctrl: rockchip: fix reading pull type on rk3568
        pinctrl: nomadik: Add missing header(s)
        pinctrl: sp7021: fix unused function warning
      8440ffcd
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma · 8974efaa
      Linus Torvalds authored
      Pull rdma fixes from Jason Gunthorpe:
      
       - Several hfi1 patches fixing some long standing driver bugs
      
       - Overflow when working with sg lists with elements greater than 4G
      
       - An rxe regression with object numbering after the mrs reach their
         limit
      
       - A theoretical problem with the scatterlist merging code
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
        lib/scatterlist: Fix to calculate the last_pg properly
        IB/hfi1: Remove user expected buffer invalidate race
        IB/hfi1: Immediately remove invalid memory from hardware
        IB/hfi1: Fix expected receive setup error exit issues
        IB/hfi1: Reserve user expected TIDs
        IB/hfi1: Reject a zero-length user expected buffer
        RDMA/core: Fix ib block iterator counter overflow
        RDMA/rxe: Prevent faulty rkey generation
        RDMA/rxe: Fix inaccurate constants in rxe_type_info
      8974efaa
    • Jens Axboe's avatar
      io_uring/poll: don't reissue in case of poll race on multishot request · 8caa03f1
      Jens Axboe authored
      A previous commit fixed a poll race that can occur, but it's only
      applicable for multishot requests. For a multishot request, we can safely
      ignore a spurious wakeup, as we never leave the waitqueue to begin with.
      
      A blunt reissue of a multishot armed request can cause us to leak a
      buffer, if they are ring provided. While this seems like a bug in itself,
      it's not really defined behavior to reissue a multishot request directly.
      It's less efficient to do so as well, and not required to rearm anything
      like it is for singleshot poll requests.
      
      Cc: stable@vger.kernel.org
      Fixes: 6e5aedb9 ("io_uring/poll: attempt request issue after racy poll wakeup")
      Reported-and-tested-by: default avatarOlivier Langlois <olivier@trillion01.com>
      Link: https://github.com/axboe/liburing/issues/778Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      8caa03f1
    • Linus Torvalds's avatar
      Merge tag 'block-6.2-2023-01-20' of git://git.kernel.dk/linux · edc00350
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "Various little tweaks all over the place:
      
         - NVMe pull request via Christoph:
             - fix controller shutdown regression in nvme-apple (Janne Grunau)
             - fix a polling on timeout regression in nvme-pci (Keith Busch)
      
         - Fix a bug in the read request side request allocation caching
           (Pavel)
      
         - pktcdvd was brought back after we configured a NULL return on bio
           splits, make it consistent with the others (me)
      
         - BFQ refcount fix (Yu)
      
         - Block cgroup policy activation fix (Yu)
      
         - Fix for an md regression introduced in the 6.2 cycle (Adrian)"
      
      * tag 'block-6.2-2023-01-20' of git://git.kernel.dk/linux:
        nvme-pci: fix timeout request state check
        nvme-apple: only reset the controller when RTKit is running
        nvme-apple: reset controller during shutdown
        block: fix hctx checks for batch allocation
        block/rnbd-clt: fix wrong max ID in ida_alloc_max
        blk-cgroup: fix missing pd_online_fn() while activating policy
        pktcdvd: check for NULL returna fter calling bio_split_to_limits()
        block, bfq: switch 'bfqg->ref' to use atomic refcount apis
        md: fix incorrect declaration about claim_rdev in md_import_device
      edc00350