1. 10 Jun, 2022 21 commits
  2. 09 Jun, 2022 19 commits
    • David Howells's avatar
      netfs: Fix gcc-12 warning by embedding vfs inode in netfs_i_context · 874c8ca1
      David Howells authored
      While randstruct was satisfied with using an open-coded "void *" offset
      cast for the netfs_i_context <-> inode casting, __builtin_object_size() as
      used by FORTIFY_SOURCE was not as easily fooled.  This was causing the
      following complaint[1] from gcc v12:
      
        In file included from include/linux/string.h:253,
                         from include/linux/ceph/ceph_debug.h:7,
                         from fs/ceph/inode.c:2:
        In function 'fortify_memset_chk',
            inlined from 'netfs_i_context_init' at include/linux/netfs.h:326:2,
            inlined from 'ceph_alloc_inode' at fs/ceph/inode.c:463:2:
        include/linux/fortify-string.h:242:25: warning: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Wattribute-warning]
          242 |                         __write_overflow_field(p_size_field, size);
              |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      Fix this by embedding a struct inode into struct netfs_i_context (which
      should perhaps be renamed to struct netfs_inode).  The struct inode
      vfs_inode fields are then removed from the 9p, afs, ceph and cifs inode
      structs and vfs_inode is then simply changed to "netfs.inode" in those
      filesystems.
      
      Further, rename netfs_i_context to netfs_inode, get rid of the
      netfs_inode() function that converted a netfs_i_context pointer to an
      inode pointer (that can now be done with &ctx->inode) and rename the
      netfs_i_context() function to netfs_inode() (which is now a wrapper
      around container_of()).
      
      Most of the changes were done with:
      
        perl -p -i -e 's/vfs_inode/netfs.inode/'g \
              `git grep -l 'vfs_inode' -- fs/{9p,afs,ceph,cifs}/*.[ch]`
      
      Kees suggested doing it with a pair structure[2] and a special
      declarator to insert that into the network filesystem's inode
      wrapper[3], but I think it's cleaner to embed it - and then it doesn't
      matter if struct randomisation reorders things.
      
      Dave Chinner suggested using a filesystem-specific VFS_I() function in
      each filesystem to convert that filesystem's own inode wrapper struct
      into the VFS inode struct[4].
      
      Version #2:
       - Fix a couple of missed name changes due to a disabled cifs option.
       - Rename nfs_i_context to nfs_inode
       - Use "netfs" instead of "nic" as the member name in per-fs inode wrapper
         structs.
      
      [ This also undoes commit 507160f4 ("netfs: gcc-12: temporarily
        disable '-Wattribute-warning' for now") that is no longer needed ]
      
      Fixes: bc899ee1 ("netfs: Add a netfs inode context")
      Reported-by: default avatarJeff Layton <jlayton@kernel.org>
      Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
      Reviewed-by: default avatarJeff Layton <jlayton@kernel.org>
      Reviewed-by: default avatarKees Cook <keescook@chromium.org>
      Reviewed-by: default avatarXiubo Li <xiubli@redhat.com>
      cc: Jonathan Corbet <corbet@lwn.net>
      cc: Eric Van Hensbergen <ericvh@gmail.com>
      cc: Latchesar Ionkov <lucho@ionkov.net>
      cc: Dominique Martinet <asmadeus@codewreck.org>
      cc: Christian Schoenebeck <linux_oss@crudebyte.com>
      cc: Marc Dionne <marc.dionne@auristor.com>
      cc: Ilya Dryomov <idryomov@gmail.com>
      cc: Steve French <smfrench@gmail.com>
      cc: William Kucharski <william.kucharski@oracle.com>
      cc: "Matthew Wilcox (Oracle)" <willy@infradead.org>
      cc: Dave Chinner <david@fromorbit.com>
      cc: linux-doc@vger.kernel.org
      cc: v9fs-developer@lists.sourceforge.net
      cc: linux-afs@lists.infradead.org
      cc: ceph-devel@vger.kernel.org
      cc: linux-cifs@vger.kernel.org
      cc: samba-technical@lists.samba.org
      cc: linux-fsdevel@vger.kernel.org
      cc: linux-hardening@vger.kernel.org
      Link: https://lore.kernel.org/r/d2ad3a3d7bdd794c6efb562d2f2b655fb67756b9.camel@kernel.org/ [1]
      Link: https://lore.kernel.org/r/20220517210230.864239-1-keescook@chromium.org/ [2]
      Link: https://lore.kernel.org/r/20220518202212.2322058-1-keescook@chromium.org/ [3]
      Link: https://lore.kernel.org/r/20220524101205.GI2306852@dread.disaster.area/ [4]
      Link: https://lore.kernel.org/r/165296786831.3591209.12111293034669289733.stgit@warthog.procyon.org.uk/ # v1
      Link: https://lore.kernel.org/r/165305805651.4094995.7763502506786714216.stgit@warthog.procyon.org.uk # v2
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      874c8ca1
    • Yupeng Li's avatar
      MIPS: Loongson-3: fix compile mips cpu_hwmon as module build error. · 41e45640
      Yupeng Li authored
        set cpu_hwmon as a module build with loongson_sysconf, loongson_chiptemp
        undefined error,fix cpu_hwmon compile options to be bool.Some kernel
        compilation error information is as follows:
      
        Checking missing-syscalls for N32
        CALL    scripts/checksyscalls.sh
        Checking missing-syscalls for O32
        CALL    scripts/checksyscalls.sh
        CALL    scripts/checksyscalls.sh
        CHK     include/generated/compile.h
        CC [M]  drivers/platform/mips/cpu_hwmon.o
        Building modules, stage 2.
        MODPOST 200 modules
      ERROR: "loongson_sysconf" [drivers/platform/mips/cpu_hwmon.ko] undefined!
      ERROR: "loongson_chiptemp" [drivers/platform/mips/cpu_hwmon.ko] undefined!
      make[1]: *** [scripts/Makefile.modpost:92:__modpost] 错误 1
      make: *** [Makefile:1261:modules] 错误 2
      Signed-off-by: default avatarYupeng Li <liyupeng@zbhlos.com>
      Reviewed-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Reviewed-by: default avatarHuacai Chen <chenhuacai@kernel.org>
      Signed-off-by: default avatarThomas Bogendoerfer <tsbogend@alpha.franken.de>
      41e45640
    • Linus Torvalds's avatar
      Merge tag 'fs_for_v5.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs · 3d9f55c5
      Linus Torvalds authored
      Pull ext2, writeback, and quota fixes and cleanups from Jan Kara:
       "A fix for race in writeback code and two cleanups in quota and ext2"
      
      * tag 'fs_for_v5.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
        quota: Prevent memory allocation recursion while holding dq_lock
        writeback: Fix inode->i_io_list not be protected by inode->i_lock error
        fs: Fix syntax errors in comments
      3d9f55c5
    • Linus Torvalds's avatar
      Merge tag 'powerpc-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · 95fc76c8
      Linus Torvalds authored
      Pull powerpc fixes from Michael Ellerman:
      
       - On 32-bit fix overread/overwrite of thread_struct via ptrace
         PEEK/POKE.
      
       - Fix softirqs not switching to the softirq stack since we moved
         irq_exit().
      
       - Force thread size increase when KASAN is enabled to avoid stack
         overflows.
      
       - On Book3s 64 mark more code as not to be instrumented by KASAN to
         avoid crashes.
      
       - Exempt __get_wchan() from KASAN checking, as it's inherently racy.
      
       - Fix a recently introduced crash in the papr_scm driver in some
         configurations.
      
       - Remove include of <generated/compile.h> which is forbidden.
      
      Thanks to Ariel Miculas, Chen Jingwen, Christophe Leroy, Erhard Furtner,
      He Ying, Kees Cook, Masahiro Yamada, Nageswara R Sastry, Paul Mackerras,
      Sachin Sant, Vaibhav Jain, and Wanming Hu.
      
      * tag 'powerpc-5.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        powerpc/32: Fix overread/overwrite of thread_struct via ptrace
        powerpc/book3e: get rid of #include <generated/compile.h>
        powerpc/kasan: Force thread size increase with KASAN
        powerpc/papr_scm: don't requests stats with '0' sized stats buffer
        powerpc: Don't select HAVE_IRQ_EXIT_ON_IRQ_STACK
        powerpc/kasan: Silence KASAN warnings in __get_wchan()
        powerpc/kasan: Mark more real-mode code as not to be instrumented
      95fc76c8
    • Linus Torvalds's avatar
      Merge tag 'net-5.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · 825464e7
      Linus Torvalds authored
      Pull networking fixes from Paolo Abeni:
       "Including fixes from bpf and netfilter.
      
        Current release - regressions:
      
         - eth: amt: fix possible null-ptr-deref in amt_rcv()
      
        Previous releases - regressions:
      
         - tcp: use alloc_large_system_hash() to allocate table_perturb
      
         - af_unix: fix a data-race in unix_dgram_peer_wake_me()
      
         - nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling
      
         - eth: ixgbe: fix unexpected VLAN rx in promisc mode on VF
      
        Previous releases - always broken:
      
         - ipv6: fix signed integer overflow in __ip6_append_data
      
         - netfilter:
             - nat: really support inet nat without l3 address
             - nf_tables: memleak flow rule from commit path
      
         - bpf: fix calling global functions from BPF_PROG_TYPE_EXT programs
      
         - openvswitch: fix misuse of the cached connection on tuple changes
      
         - nfc: nfcmrvl: fix memory leak in nfcmrvl_play_deferred
      
         - eth: altera: fix refcount leak in altera_tse_mdio_create
      
        Misc:
      
         - add Quentin Monnet to bpftool maintainers"
      
      * tag 'net-5.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (45 commits)
        net: amd-xgbe: fix clang -Wformat warning
        tcp: use alloc_large_system_hash() to allocate table_perturb
        net: dsa: realtek: rtl8365mb: fix GMII caps for ports with internal PHY
        net: dsa: mv88e6xxx: correctly report serdes link failure
        net: dsa: mv88e6xxx: fix BMSR error to be consistent with others
        net: dsa: mv88e6xxx: use BMSR_ANEGCOMPLETE bit for filling an_complete
        net: altera: Fix refcount leak in altera_tse_mdio_create
        net: openvswitch: fix misuse of the cached connection on tuple changes
        net: ethernet: mtk_eth_soc: fix misuse of mem alloc interface netdev[napi]_alloc_frag
        ip_gre: test csum_start instead of transport header
        au1000_eth: stop using virt_to_bus()
        ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg
        ipv6: Fix signed integer overflow in __ip6_append_data
        nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred
        nfc: st21nfca: fix incorrect sizing calculations in EVT_TRANSACTION
        nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling
        nfc: st21nfca: fix incorrect validating logic in EVT_TRANSACTION
        net: ipv6: unexport __init-annotated seg6_hmac_init()
        net: xfrm: unexport __init-annotated xfrm4_protocol_init()
        net: mdio: unexport __init-annotated mdio_bus_init()
        ...
      825464e7
    • Simon Horman's avatar
      docs: arm: tcm: Fix typo in description of TCM and MMU usage · 387c67af
      Simon Horman authored
      Correct a typo in the description of interaction between
      the TCM and MMU.
      
      Found by inspection.
      Signed-off-by: default avatarSimon Horman <simon.horman@corigine.com>
      Link: https://lore.kernel.org/r/20220609184230.627958-1-simon.horman@corigine.comSigned-off-by: default avatarJonathan Corbet <corbet@lwn.net>
      387c67af
    • Linus Torvalds's avatar
      netfs: gcc-12: temporarily disable '-Wattribute-warning' for now · 507160f4
      Linus Torvalds authored
      This is a pure band-aid so that I can continue merging stuff from people
      while some of the gcc-12 fallout gets sorted out.
      
      In particular, gcc-12 is very unhappy about the kinds of pointer
      arithmetic tricks that netfs does, and that makes the fortify checks
      trigger in afs and ceph:
      
        In function ‘fortify_memset_chk’,
            inlined from ‘netfs_i_context_init’ at include/linux/netfs.h:327:2,
            inlined from ‘afs_set_netfs_context’ at fs/afs/inode.c:61:2,
            inlined from ‘afs_root_iget’ at fs/afs/inode.c:543:2:
        include/linux/fortify-string.h:258:25: warning: call to ‘__write_overflow_field’ declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Wattribute-warning]
          258 |                         __write_overflow_field(p_size_field, size);
              |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      
      and the reason is that netfs_i_context_init() is passed a 'struct inode'
      pointer, and then it does
      
              struct netfs_i_context *ctx = netfs_i_context(inode);
      
              memset(ctx, 0, sizeof(*ctx));
      
      where that netfs_i_context() function just does pointer arithmetic on
      the inode pointer, knowing that the netfs_i_context is laid out
      immediately after it in memory.
      
      This is all truly disgusting, since the whole "netfs_i_context is laid
      out immediately after it in memory" is not actually remotely true in
      general, but is just made to be that way for afs and ceph.
      
      See for example fs/cifs/cifsglob.h:
      
        struct cifsInodeInfo {
              struct {
                      /* These must be contiguous */
                      struct inode    vfs_inode;      /* the VFS's inode record */
                      struct netfs_i_context netfs_ctx; /* Netfslib context */
              };
      	[...]
      
      and realize that this is all entirely wrong, and the pointer arithmetic
      that netfs_i_context() is doing is also very very wrong and wouldn't
      give the right answer if netfs_ctx had different alignment rules from a
      'struct inode', for example).
      
      Anyway, that's just a long-winded way to say "the gcc-12 warning is
      actually quite reasonable, and our code happens to work but is pretty
      disgusting".
      
      This is getting fixed properly, but for now I made the mistake of
      thinking "the week right after the merge window tends to be calm for me
      as people take a breather" and I did a sustem upgrade.  And I got gcc-12
      as a result, so to continue merging fixes from people and not have the
      end result drown in warnings, I am fixing all these gcc-12 issues I hit.
      
      Including with these kinds of temporary fixes.
      
      Cc: Kees Cook <keescook@chromium.org>
      Cc: David Howells <dhowells@redhat.com>
      Link: https://lore.kernel.org/all/AEEBCF5D-8402-441D-940B-105AA718C71F@chromium.org/Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      507160f4
    • Linus Torvalds's avatar
      gcc-12: disable '-Warray-bounds' universally for now · f0be87c4
      Linus Torvalds authored
      In commit 8b202ee2 ("s390: disable -Warray-bounds") the s390 people
      disabled the '-Warray-bounds' warning for gcc-12, because the new logic
      in gcc would cause warnings for their use of the S390_lowcore macro,
      which accesses absolute pointers.
      
      It turns out gcc-12 has many other issues in this area, so this takes
      that s390 warning disable logic, and turns it into a kernel build config
      entry instead.
      
      Part of the intent is that we can make this all much more targeted, and
      use this conflig flag to disable it in only particular configurations
      that cause problems, with the s390 case as an example:
      
              select GCC12_NO_ARRAY_BOUNDS
      
      and we could do that for other configuration cases that cause issues.
      
      Or we could possibly use the CONFIG_CC_NO_ARRAY_BOUNDS thing in a more
      targeted way, and disable the warning only for particular uses: again
      the s390 case as an example:
      
        KBUILD_CFLAGS_DECOMPRESSOR += $(if $(CONFIG_CC_NO_ARRAY_BOUNDS),-Wno-array-bounds)
      
      but this ends up just doing it globally in the top-level Makefile, since
      the current issues are spread fairly widely all over:
      
        KBUILD_CFLAGS-$(CONFIG_CC_NO_ARRAY_BOUNDS) += -Wno-array-bounds
      
      We'll try to limit this later, since the gcc-12 problems are rare enough
      that *much* of the kernel can be built with it without disabling this
      warning.
      
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Nathan Chancellor <nathan@kernel.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      f0be87c4
    • Linus Torvalds's avatar
      mellanox: mlx5: avoid uninitialized variable warning with gcc-12 · 842c3b3d
      Linus Torvalds authored
      gcc-12 started warning about 'tracker' being used uninitialized:
      
        drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c: In function ‘mlx5_do_bond’:
        drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c:786:28: warning: ‘tracker’ is used uninitialized [-Wuninitialized]
          786 |         struct lag_tracker tracker;
              |                            ^~~~~~~
      
      which seems to be because it doesn't track how the use (and
      initialization) is bound by the 'do_bond' flag.
      
      But admittedly that 'do_bond' usage is fairly complicated, and involves
      passing it around as an argument to helper functions, so it's somewhat
      understandable that gcc doesn't see how that all works.
      
      This function could be rewritten to make the use of that tracker
      variable more obviously safe, but for now I'm just adding the forced
      initialization of it.
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      842c3b3d
    • Linus Torvalds's avatar
      gcc-12: disable '-Wdangling-pointer' warning for now · 49beadbd
      Linus Torvalds authored
      While the concept of checking for dangling pointers to local variables
      at function exit is really interesting, the gcc-12 implementation is not
      compatible with reality, and results in false positives.
      
      For example, gcc sees us putting things on a local list head allocated
      on the stack, which involves exactly those kinds of pointers to the
      local stack entry:
      
        In function ‘__list_add’,
            inlined from ‘list_add_tail’ at include/linux/list.h:102:2,
            inlined from ‘rebuild_snap_realms’ at fs/ceph/snap.c:434:2:
        include/linux/list.h:74:19: warning: storing the address of local variable ‘realm_queue’ in ‘*&realm_27(D)->rebuild_item.prev’ [-Wdangling-pointer=]
           74 |         new->prev = prev;
              |         ~~~~~~~~~~^~~~~~
      
      But then gcc - understandably - doesn't really understand the big
      picture how the doubly linked list works, so doesn't see how we then end
      up emptying said list head in a loop and the pointer we added has been
      removed.
      
      Gcc also complains about us (intentionally) using this as a way to store
      a kind of fake stack trace, eg
      
        drivers/acpi/acpica/utdebug.c:40:38: warning: storing the address of local variable ‘current_sp’ in ‘acpi_gbl_entry_stack_pointer’ [-Wdangling-pointer=]
           40 |         acpi_gbl_entry_stack_pointer = &current_sp;
              |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~
      
      which is entirely reasonable from a compiler standpoint, and we may want
      to change those kinds of patterns, but not not.
      
      So this is one of those "it would be lovely if the compiler were to
      complain about us leaving dangling pointers to the stack", but not this
      way.
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      49beadbd
    • Linus Torvalds's avatar
      drm: imx: fix compiler warning with gcc-12 · 7aefd8b5
      Linus Torvalds authored
      Gcc-12 correctly warned about this code using a non-NULL pointer as a
      truth value:
      
        drivers/gpu/drm/imx/ipuv3-crtc.c: In function ‘ipu_crtc_disable_planes’:
        drivers/gpu/drm/imx/ipuv3-crtc.c:72:21: error: the comparison will always evaluate as ‘true’ for the address of ‘plane’ will never be NULL [-Werror=address]
           72 |                 if (&ipu_crtc->plane[1] && plane == &ipu_crtc->plane[1]->base)
              |                     ^
      
      due to the extraneous '&' address-of operator.
      
      Philipp Zabel points out that The mistake had no adverse effect since
      the following condition doesn't actually dereference the NULL pointer,
      but the intent of the code was obviously to check for it, not to take
      the address of the member.
      
      Fixes: eb8c8880 ("drm/imx: add deferred plane disabling")
      Acked-by: default avatarPhilipp Zabel <p.zabel@pengutronix.de>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      7aefd8b5
    • Jonathan Corbet's avatar
      docs: Move the HTE documentation to driver-api/ · 9c73e1e0
      Jonathan Corbet authored
      The hardware timestamp engine documentation is driver API material, and
      really belongs in the driver-API book; move it there.
      
      Cc: Thierry Reding <treding@nvidia.com>
      Acked-by: default avatarDipen Patel <dipenp@nvidia.com>
      Signed-off-by: default avatarJonathan Corbet <corbet@lwn.net>
      9c73e1e0
    • Justin Swartz's avatar
      docs: usb: fix literal block marker in usbmon verification example · 788183a6
      Justin Swartz authored
      The "Verify that bus sockets are present" example was not properly
      formatted due to a typo in the literal block marker.
      Signed-off-by: default avatarJustin Swartz <justin.swartz@risingedge.co.za>
      Link: https://lore.kernel.org/r/20220604155431.23246-1-justin.swartz@risingedge.co.zaSigned-off-by: default avatarJonathan Corbet <corbet@lwn.net>
      788183a6
    • Zheng Zengkai's avatar
      Documentation/features: Update the arch support status files · 5860800e
      Zheng Zengkai authored
      The arch support status files don't match reality as of v5.19-rc1,
      use the features-refresh.sh to refresh all the arch-support.txt files
      in place.  The main effect is to add entries for the new loong
      architecture.
      Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
      Link: https://lore.kernel.org/r/20220609025656.143460-1-zhengzengkai@huawei.comSigned-off-by: default avatarJonathan Corbet <corbet@lwn.net>
      5860800e
    • Michael Ellerman's avatar
      powerpc/32: Fix overread/overwrite of thread_struct via ptrace · 8e127844
      Michael Ellerman authored
      The ptrace PEEKUSR/POKEUSR (aka PEEKUSER/POKEUSER) API allows a process
      to read/write registers of another process.
      
      To get/set a register, the API takes an index into an imaginary address
      space called the "USER area", where the registers of the process are
      laid out in some fashion.
      
      The kernel then maps that index to a particular register in its own data
      structures and gets/sets the value.
      
      The API only allows a single machine-word to be read/written at a time.
      So 4 bytes on 32-bit kernels and 8 bytes on 64-bit kernels.
      
      The way floating point registers (FPRs) are addressed is somewhat
      complicated, because double precision float values are 64-bit even on
      32-bit CPUs. That means on 32-bit kernels each FPR occupies two
      word-sized locations in the USER area. On 64-bit kernels each FPR
      occupies one word-sized location in the USER area.
      
      Internally the kernel stores the FPRs in an array of u64s, or if VSX is
      enabled, an array of pairs of u64s where one half of each pair stores
      the FPR. Which half of the pair stores the FPR depends on the kernel's
      endianness.
      
      To handle the different layouts of the FPRs depending on VSX/no-VSX and
      big/little endian, the TS_FPR() macro was introduced.
      
      Unfortunately the TS_FPR() macro does not take into account the fact
      that the addressing of each FPR differs between 32-bit and 64-bit
      kernels. It just takes the index into the "USER area" passed from
      userspace and indexes into the fp_state.fpr array.
      
      On 32-bit there are 64 indexes that address FPRs, but only 32 entries in
      the fp_state.fpr array, meaning the user can read/write 256 bytes past
      the end of the array. Because the fp_state sits in the middle of the
      thread_struct there are various fields than can be overwritten,
      including some pointers. As such it may be exploitable.
      
      It has also been observed to cause systems to hang or otherwise
      misbehave when using gdbserver, and is probably the root cause of this
      report which could not be easily reproduced:
        https://lore.kernel.org/linuxppc-dev/dc38afe9-6b78-f3f5-666b-986939e40fc6@keymile.com/
      
      Rather than trying to make the TS_FPR() macro even more complicated to
      fix the bug, or add more macros, instead add a special-case for 32-bit
      kernels. This is more obvious and hopefully avoids a similar bug
      happening again in future.
      
      Note that because 32-bit kernels never have VSX enabled the code doesn't
      need to consider TS_FPRWIDTH/OFFSET at all. Add a BUILD_BUG_ON() to
      ensure that 32-bit && VSX is never enabled.
      
      Fixes: 87fec051 ("powerpc: PTRACE_PEEKUSR/PTRACE_POKEUSER of FPR registers in little endian builds")
      Cc: stable@vger.kernel.org # v3.13+
      Reported-by: default avatarAriel Miculas <ariel.miculas@belden.com>
      Tested-by: default avatarChristophe Leroy <christophe.leroy@csgroup.eu>
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      Link: https://lore.kernel.org/r/20220609133245.573565-1-mpe@ellerman.id.au
      8e127844
    • Thomas Zimmermann's avatar
      drm/ast: Support multiple outputs · 477277c7
      Thomas Zimmermann authored
      Systems with AST graphics can have multiple output; typically VGA
      plus some other port. Record detected output chips in a bitmask and
      initialize each output on its own.
      
      Assume a VGA output by default and use SIL164 and DP501 if available.
      For ASTDP assume that it can run in parallel with VGA.
      
      Tested on AST2100.
      
      v3:
      	* define a macro for each BIT(ast_tx_chip) (Patrik)
      v2:
      	* make VGA/SIL164/DP501 mutually exclusive
      Signed-off-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
      Reviewed-by: default avatarPatrik Jakobsson <patrik.r.jakobsson@gmail.com>
      Fixes: a59b0264 ("drm/ast: Initialize encoder and connector for VGA in helper function")
      Cc: Thomas Zimmermann <tzimmermann@suse.de>
      Cc: Javier Martinez Canillas <javierm@redhat.com>
      Cc: Dave Airlie <airlied@redhat.com>
      Cc: dri-devel@lists.freedesktop.org
      Link: https://patchwork.freedesktop.org/patch/msgid/20220607092008.22123-2-tzimmermann@suse.de
      (cherry picked from commit 7f35680a)
      Signed-off-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
      477277c7
    • Dave Airlie's avatar
      Merge tag 'amd-drm-fixes-5.19-2022-06-08' of... · 0a178750
      Dave Airlie authored
      Merge tag 'amd-drm-fixes-5.19-2022-06-08' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes
      
      amd-drm-fixes-5.19-2022-06-08:
      
      amdgpu:
      - DCN 3.1 golden settings fix
      - eDP fixes
      - DMCUB fixes
      - GFX11 fixes and cleanups
      - VCN fix for yellow carp
      - GMC11 fixes
      - RAS fixes
      - GPUVM TLB flush fixes
      - SMU13 fixes
      - VCN3 AV1 regression fix
      - VCN2 JPEG fix
      - Other misc fixes
      
      amdkfd:
      - MMU notifier fix
      - Support for more GC 10.3.x families
      - Pinned BO handling fix
      - Partial migration bug fix
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Alex Deucher <alexander.deucher@amd.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20220608203008.6187-1-alexander.deucher@amd.com
      0a178750
    • Justin Stitt's avatar
      net: amd-xgbe: fix clang -Wformat warning · 647df0d4
      Justin Stitt authored
      see warning:
      | drivers/net/ethernet/amd/xgbe/xgbe-drv.c:2787:43: warning: format specifies
      | type 'unsigned short' but the argument has type 'int' [-Wformat]
      |        netdev_dbg(netdev, "Protocol: %#06hx\n", ntohs(eth->h_proto));
      |                                      ~~~~~~     ^~~~~~~~~~~~~~~~~~~
      
      Variadic functions (printf-like) undergo default argument promotion.
      Documentation/core-api/printk-formats.rst specifically recommends
      using the promoted-to-type's format flag.
      
      Also, as per C11 6.3.1.1:
      (https://www.open-std.org/jtc1/sc22/wg14/www/docs/n1548.pdf)
      `If an int can represent all values of the original type ..., the
      value is converted to an int; otherwise, it is converted to an
      unsigned int. These are called the integer promotions.`
      
      Since the argument is a u16 it will get promoted to an int and thus it is
      most accurate to use the %x format specifier here. It should be noted that the
      `#06` formatting sugar does not alter the promotion rules.
      
      Link: https://github.com/ClangBuiltLinux/linux/issues/378Signed-off-by: default avatarJustin Stitt <jstitt007@gmail.com>
      Reviewed-by: default avatarNick Desaulniers <ndesaulniers@google.com>
      Link: https://lore.kernel.org/r/20220607191119.20686-1-jstitt007@gmail.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      647df0d4
    • Muchun Song's avatar
      tcp: use alloc_large_system_hash() to allocate table_perturb · e67b72b9
      Muchun Song authored
      In our server, there may be no high order (>= 6) memory since we reserve
      lots of HugeTLB pages when booting.  Then the system panic.  So use
      alloc_large_system_hash() to allocate table_perturb.
      
      Fixes: e9261476 ("tcp: dynamically allocate the perturb table used by source ports")
      Signed-off-by: default avatarMuchun Song <songmuchun@bytedance.com>
      Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
      Link: https://lore.kernel.org/r/20220607070214.94443-1-songmuchun@bytedance.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      e67b72b9