1. 06 Mar, 2024 2 commits
    • Andy Shevchenko's avatar
      ieee802154: at86rf230: Replace of_gpio.h by proper one · defa2cb4
      Andy Shevchenko authored
      of_gpio.h is deprecated and subject to remove.
      The driver doesn't use it directly, replace it
      with what is really being used.
      Signed-off-by: default avatarAndy Shevchenko <andriy.shevchenko@linux.intel.com>
      Acked-by: default avatarMiquel Raynal <miquel.raynal@bootlin.com>
      Message-ID: <20240304174218.1198411-1-andriy.shevchenko@linux.intel.com>
      Signed-off-by: default avatarStefan Schmidt <stefan@datenfreihafen.org>
      defa2cb4
    • Fedor Pchelkin's avatar
      mac802154: fix llsec key resources release in mac802154_llsec_key_del · e8a1e583
      Fedor Pchelkin authored
      mac802154_llsec_key_del() can free resources of a key directly without
      following the RCU rules for waiting before the end of a grace period. This
      may lead to use-after-free in case llsec_lookup_key() is traversing the
      list of keys in parallel with a key deletion:
      
      refcount_t: addition on 0; use-after-free.
      WARNING: CPU: 4 PID: 16000 at lib/refcount.c:25 refcount_warn_saturate+0x162/0x2a0
      Modules linked in:
      CPU: 4 PID: 16000 Comm: wpan-ping Not tainted 6.7.0 #19
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
      RIP: 0010:refcount_warn_saturate+0x162/0x2a0
      Call Trace:
       <TASK>
       llsec_lookup_key.isra.0+0x890/0x9e0
       mac802154_llsec_encrypt+0x30c/0x9c0
       ieee802154_subif_start_xmit+0x24/0x1e0
       dev_hard_start_xmit+0x13e/0x690
       sch_direct_xmit+0x2ae/0xbc0
       __dev_queue_xmit+0x11dd/0x3c20
       dgram_sendmsg+0x90b/0xd60
       __sys_sendto+0x466/0x4c0
       __x64_sys_sendto+0xe0/0x1c0
       do_syscall_64+0x45/0xf0
       entry_SYSCALL_64_after_hwframe+0x6e/0x76
      
      Also, ieee802154_llsec_key_entry structures are not freed by
      mac802154_llsec_key_del():
      
      unreferenced object 0xffff8880613b6980 (size 64):
        comm "iwpan", pid 2176, jiffies 4294761134 (age 60.475s)
        hex dump (first 32 bytes):
          78 0d 8f 18 80 88 ff ff 22 01 00 00 00 00 ad de  x.......".......
          00 00 00 00 00 00 00 00 03 00 cd ab 00 00 00 00  ................
        backtrace:
          [<ffffffff81dcfa62>] __kmem_cache_alloc_node+0x1e2/0x2d0
          [<ffffffff81c43865>] kmalloc_trace+0x25/0xc0
          [<ffffffff88968b09>] mac802154_llsec_key_add+0xac9/0xcf0
          [<ffffffff8896e41a>] ieee802154_add_llsec_key+0x5a/0x80
          [<ffffffff8892adc6>] nl802154_add_llsec_key+0x426/0x5b0
          [<ffffffff86ff293e>] genl_family_rcv_msg_doit+0x1fe/0x2f0
          [<ffffffff86ff46d1>] genl_rcv_msg+0x531/0x7d0
          [<ffffffff86fee7a9>] netlink_rcv_skb+0x169/0x440
          [<ffffffff86ff1d88>] genl_rcv+0x28/0x40
          [<ffffffff86fec15c>] netlink_unicast+0x53c/0x820
          [<ffffffff86fecd8b>] netlink_sendmsg+0x93b/0xe60
          [<ffffffff86b91b35>] ____sys_sendmsg+0xac5/0xca0
          [<ffffffff86b9c3dd>] ___sys_sendmsg+0x11d/0x1c0
          [<ffffffff86b9c65a>] __sys_sendmsg+0xfa/0x1d0
          [<ffffffff88eadbf5>] do_syscall_64+0x45/0xf0
          [<ffffffff890000ea>] entry_SYSCALL_64_after_hwframe+0x6e/0x76
      
      Handle the proper resource release in the RCU callback function
      mac802154_llsec_key_del_rcu().
      
      Note that if llsec_lookup_key() finds a key, it gets a refcount via
      llsec_key_get() and locally copies key id from key_entry (which is a
      list element). So it's safe to call llsec_key_put() and free the list
      entry after the RCU grace period elapses.
      
      Found by Linux Verification Center (linuxtesting.org).
      
      Fixes: 5d637d5a ("mac802154: add llsec structures and mutators")
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarFedor Pchelkin <pchelkin@ispras.ru>
      Acked-by: default avatarAlexander Aring <aahringo@redhat.com>
      Message-ID: <20240228163840.6667-1-pchelkin@ispras.ru>
      Signed-off-by: default avatarStefan Schmidt <stefan@datenfreihafen.org>
      e8a1e583
  2. 26 Feb, 2024 4 commits
  3. 15 Dec, 2023 5 commits
  4. 20 Nov, 2023 13 commits
  5. 13 Nov, 2023 1 commit
  6. 12 Nov, 2023 5 commits
  7. 11 Nov, 2023 1 commit
    • Linus Torvalds's avatar
      Merge tag 'probes-fixes-v6.7-rc1' of... · 3ca112b7
      Linus Torvalds authored
      Merge tag 'probes-fixes-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
      
      Pull probes fixes from Masami Hiramatsu:
      
       - Documentation update: Add a note about argument and return value
         fetching is the best effort because it depends on the type.
      
       - objpool: Fix to make internal global variables static in
         test_objpool.c.
      
       - kprobes: Unify kprobes_exceptions_nofify() prototypes. There are the
         same prototypes in asm/kprobes.h for some architectures, but some of
         them are missing the prototype and it causes a warning. So move the
         prototype into linux/kprobes.h.
      
       - tracing: Fix to check the tracepoint event and return event at
         parsing stage. The tracepoint event doesn't support %return but if
         $retval exists, it will be converted to %return silently. This finds
         that case and rejects it.
      
       - tracing: Fix the order of the descriptions about the parameters of
         __kprobe_event_gen_cmd_start() to be consistent with the argument
         list of the function.
      
      * tag 'probes-fixes-v6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
        tracing/kprobes: Fix the order of argument descriptions
        tracing: fprobe-event: Fix to check tracepoint event and return
        kprobes: unify kprobes_exceptions_nofify() prototypes
        lib: test_objpool: make global variables static
        Documentation: tracing: Add a note about argument and retval access
      3ca112b7
  8. 10 Nov, 2023 9 commits
    • Linus Torvalds's avatar
      Merge tag 'fbdev-for-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev · 18553507
      Linus Torvalds authored
      Pull fbdev fixes and cleanups from Helge Deller:
      
       - fix double free and resource leaks in imsttfb
      
       - lots of remove callback cleanups and section mismatch fixes in
         omapfb, amifb and atmel_lcdfb
      
       - error code fix and memparse simplification in omapfb
      
      * tag 'fbdev-for-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: (31 commits)
        fbdev: fsl-diu-fb: mark wr_reg_wa() static
        fbdev: amifb: Convert to platform remove callback returning void
        fbdev: amifb: Mark driver struct with __refdata to prevent section mismatch warning
        fbdev: hyperv_fb: fix uninitialized local variable use
        fbdev: omapfb/tpd12s015: Convert to platform remove callback returning void
        fbdev: omapfb/tfp410: Convert to platform remove callback returning void
        fbdev: omapfb/sharp-ls037v7dw01: Convert to platform remove callback returning void
        fbdev: omapfb/opa362: Convert to platform remove callback returning void
        fbdev: omapfb/hdmi: Convert to platform remove callback returning void
        fbdev: omapfb/dvi: Convert to platform remove callback returning void
        fbdev: omapfb/dsi-cm: Convert to platform remove callback returning void
        fbdev: omapfb/dpi: Convert to platform remove callback returning void
        fbdev: omapfb/analog-tv: Convert to platform remove callback returning void
        fbdev: atmel_lcdfb: Convert to platform remove callback returning void
        fbdev: omapfb/tpd12s015: Don't put .remove() in .exit.text and drop suppress_bind_attrs
        fbdev: omapfb/tfp410: Don't put .remove() in .exit.text and drop suppress_bind_attrs
        fbdev: omapfb/sharp-ls037v7dw01: Don't put .remove() in .exit.text and drop suppress_bind_attrs
        fbdev: omapfb/opa362: Don't put .remove() in .exit.text and drop suppress_bind_attrs
        fbdev: omapfb/hdmi: Don't put .remove() in .exit.text and drop suppress_bind_attrs
        fbdev: omapfb/dvi: Don't put .remove() in .exit.text and drop suppress_bind_attrs
        ...
      18553507
    • Yujie Liu's avatar
      tracing/kprobes: Fix the order of argument descriptions · f032c53b
      Yujie Liu authored
      The order of descriptions should be consistent with the argument list of
      the function, so "kretprobe" should be the second one.
      
      int __kprobe_event_gen_cmd_start(struct dynevent_cmd *cmd, bool kretprobe,
                                       const char *name, const char *loc, ...)
      
      Link: https://lore.kernel.org/all/20231031041305.3363712-1-yujie.liu@intel.com/
      
      Fixes: 2a588dd1 ("tracing: Add kprobe event command generation functions")
      Suggested-by: default avatarMukesh Ojha <quic_mojha@quicinc.com>
      Signed-off-by: default avatarYujie Liu <yujie.liu@intel.com>
      Reviewed-by: default avatarMukesh Ojha <quic_mojha@quicinc.com>
      Signed-off-by: default avatarMasami Hiramatsu (Google) <mhiramat@kernel.org>
      f032c53b
    • Linus Torvalds's avatar
      Merge tag 'drm-next-2023-11-10' of git://anongit.freedesktop.org/drm/drm · c0d12d76
      Linus Torvalds authored
      Pull drm fixes from Daniel Vetter:
       "Dave's VPN to the big machine died, so it's on me to do fixes pr this
        and next week while everyone else is at plumbers.
      
         - big pile of amd fixes, but mostly for hw support newly added in 6.7
      
         - i915 fixes, mostly minor things
      
         - qxl memory leak fix
      
         - vc4 uaf fix in mock helpers
      
         - syncobj fix for DRM_SYNCOBJ_WAIT_FLAGS_WAIT_AVAILABLE"
      
      * tag 'drm-next-2023-11-10' of git://anongit.freedesktop.org/drm/drm: (78 commits)
        drm/amdgpu: fix error handling in amdgpu_vm_init
        drm/amdgpu: Fix possible null pointer dereference
        drm/amdgpu: move UVD and VCE sched entity init after sched init
        drm/amdgpu: move kfd_resume before the ip late init
        drm/amd: Explicitly check for GFXOFF to be enabled for s0ix
        drm/amdgpu: Change WREG32_RLC to WREG32_SOC15_RLC where inst != 0 (v2)
        drm/amdgpu: Use correct KIQ MEC engine for gfx9.4.3 (v5)
        drm/amdgpu: add smu v13.0.6 pcs xgmi ras error query support
        drm/amdgpu: fix software pci_unplug on some chips
        drm/amd/display: remove duplicated argument
        drm/amdgpu: correct mca debugfs dump reg list
        drm/amdgpu: correct acclerator check architecutre dump
        drm/amdgpu: add pcs xgmi v6.4.0 ras support
        drm/amdgpu: Change extended-scope MTYPE on GC 9.4.3
        drm/amdgpu: disable smu v13.0.6 mca debug mode by default
        drm/amdgpu: Support multiple error query modes
        drm/amdgpu: refine smu v13.0.6 mca dump driver
        drm/amdgpu: Do not program PF-only regs in hdp_v4_0.c under SRIOV (v2)
        drm/amdgpu: Skip PCTL0_MMHUB_DEEPSLEEP_IB write in jpegv4.0.3 under SRIOV
        drm: amd: Resolve Sphinx unexpected indentation warning
        ...
      c0d12d76
    • Linus Torvalds's avatar
      Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux · ac347a06
      Linus Torvalds authored
      Pull arm64 fixes from Catalin Marinas:
       "Mostly PMU fixes and a reworking of the pseudo-NMI disabling on broken
        MediaTek firmware:
      
         - Move the MediaTek GIC quirk handling from irqchip to core. Before
           the merging window commit 44bd78dd ("irqchip/gic-v3: Disable
           pseudo NMIs on MediaTek devices w/ firmware issues") temporarily
           addressed this issue. Fixed now at a deeper level in the arch code
      
         - Reject events meant for other PMUs in the CoreSight PMU driver,
           otherwise some of the core PMU events would disappear
      
         - Fix the Armv8 PMUv3 driver driver to not truncate 64-bit registers,
           causing some events to be invisible
      
         - Remove duplicate declaration of __arm64_sys##name following the
           patch to avoid prototype warning for syscalls
      
         - Typos in the elf_hwcap documentation"
      
      * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
        arm64/syscall: Remove duplicate declaration
        Revert "arm64: smp: avoid NMI IPIs with broken MediaTek FW"
        arm64: Move MediaTek GIC quirk handling from irqchip to core
        arm64/arm: arm_pmuv3: perf: Don't truncate 64-bit registers
        perf: arm_cspmu: Reject events meant for other PMUs
        Documentation/arm64: Fix typos in elf_hwcaps
      ac347a06
    • Linus Torvalds's avatar
      Merge tag 'sound-fix-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · e1d809b3
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "A collection of fixes for rc1.
      
        The majority of changes are various ASoC driver-specific small fixes
        and usual HD-audio quirks, while there are a couple of core changes: a
        fix in ALSA core procfs code to avoid deadlocks at disconnection and
        an ASoC core fix for DAPM clock widgets"
      
      * tag 'sound-fix-6.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        OSS: dmasound/paula: Convert to platform remove callback returning void
        ALSA: hda: ASUS UM5302LA: Added quirks for cs35L41/10431A83 on i2c bus
        ALSA: info: Fix potential deadlock at disconnection
        ASoC: nau8540: Add self recovery to improve capture quility
        ALSA: hda/realtek: Add support dual speaker for Dell
        ALSA: hda: Add ASRock X670E Taichi to denylist
        ALSA: hda/realtek: Add quirk for ASUS UX7602ZM
        ASoC: SOF: sof-client: trivial: fix comment typo
        ASoC: dapm: fix clock get name
        ASoC: hdmi-codec: register hpd callback on component probe
        ASoC: mediatek: mt8186_mt6366_rt1019_rt5682s: trivial: fix error messages
        ASoC: da7219: Improve system suspend and resume handling
        ASoC: codecs: Modify macro value error
        ASoC: codecs: Modify the wrong judgment of re value
        ASoC: codecs: Modify the maximum value of calib
        ASoC: amd: acp: fix for i2s mode register field update
        ASoC: codecs: aw88399: Fix -Wuninitialized in aw_dev_set_vcalb()
        ASoC: rt712-sdca: fix speaker route missing issue
        ASoC: rockchip: Fix unused rockchip_i2s_tdm_match warning for !CONFIG_OF
        ASoC: ti: omap-mcbsp: Fix runtime PM underflow warnings
      e1d809b3
    • Daniel Vetter's avatar
      Merge tag 'amd-drm-next-6.7-2023-11-10' of https://gitlab.freedesktop.org/agd5f/linux into drm-next · 03df0fc0
      Daniel Vetter authored
      amd-drm-next-6.7-2023-11-10:
      
      amdgpu:
      - SR-IOV fixes
      - DMCUB fixes
      - DCN3.5 fixes
      - DP2 fixes
      - SubVP fixes
      - SMU14 fixes
      - SDMA4.x fixes
      - Suspend/resume fixes
      - AGP regression fix
      - UAF fixes for some error cases
      - SMU 13.0.6 fixes
      - Documentation fixes
      - RAS fixes
      - Hotplug fixes
      - Scheduling entity ordering fix
      - GPUVM fixes
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      From: Alex Deucher <alexander.deucher@amd.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20231110190703.4741-1-alexander.deucher@amd.com
      03df0fc0
    • Linus Torvalds's avatar
      Merge tag 'spi-fix-v6.7-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi · ae4f52a7
      Linus Torvalds authored
      Pull spi fixes from Mark Brown:
       "A couple of fixes that came in during the merge window: one Kconfig
        dependency fix and another fix for a long standing issue where a sync
        transfer races with system suspend"
      
      * tag 'spi-fix-v6.7-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
        spi: Fix null dereference on suspend
        spi: spi-zynq-qspi: add spi-mem to driver kconfig dependencies
      ae4f52a7
    • Linus Torvalds's avatar
      Merge tag 'mmc-v6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc · b456259e
      Linus Torvalds authored
      Pull MMC fixes from Ulf Hansson:
       "MMC core:
         - Fix broken cache-flush support for Micron eMMCs
         - Revert 'mmc: core: Capture correct oemid-bits for eMMC cards'
      
        MMC host:
         - sdhci_am654: Fix TAP value parsing for legacy speed mode
         - sdhci-pci-gli: Fix support for ASPM mode for GL9755/GL9750
         - vub300: Fix an error path in probe"
      
      * tag 'mmc-v6.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
        mmc: sdhci-pci-gli: GL9750: Mask the replay timer timeout of AER
        mmc: sdhci-pci-gli: GL9755: Mask the replay timer timeout of AER
        Revert "mmc: core: Capture correct oemid-bits for eMMC cards"
        mmc: vub300: fix an error code
        mmc: Add quirk MMC_QUIRK_BROKEN_CACHE_FLUSH for Micron eMMC Q2J54A
        mmc: sdhci_am654: fix start loop index for TAP value parsing
      b456259e
    • Linus Torvalds's avatar
      Merge tag 'pwm/for-6.7-rc1-fixes' of... · b077b7ee
      Linus Torvalds authored
      Merge tag 'pwm/for-6.7-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm
      
      Pull pwm fixes from Thierry Reding:
       "This contains two very small fixes that I failed to include in the
        main pull request"
      
      * tag 'pwm/for-6.7-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/thierry.reding/linux-pwm:
        pwm: Fix double shift bug
        pwm: samsung: Fix a bit test in pwm_samsung_resume()
      b077b7ee