2268 Commits

Author	SHA1	Message	Date
Greg Kroah-Hartman	f5ea8b2710	Merge 5.15.80 into android14-5.15 ... Changes in 5.15.80 mm: hwpoison: refactor refcount check handling mm: hwpoison: handle non-anonymous THP correctly mm: shmem: don't truncate page if memory failure happens ASoC: wm5102: Revert "ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe" ASoC: wm5110: Revert "ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe" ASoC: wm8997: Revert "ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe" ASoC: mt6660: Keep the pm_runtime enables before component stuff in mt6660_i2c_probe ASoC: rt1019: Fix the TDM settings ASoC: wm8962: Add an event handler for TEMP_HP and TEMP_SPK spi: intel: Fix the offset to get the 64K erase opcode ASoC: codecs: jz4725b: add missed Line In power control bit ASoC: codecs: jz4725b: fix reported volume for Master ctl ASoC: codecs: jz4725b: use right control for Capture Volume ASoC: codecs: jz4725b: fix capture selector naming ASoC: Intel: sof_sdw: add quirk variant for LAPBC710 NUC15 selftests/futex: fix build for clang selftests/intel_pstate: fix build for ARCH=x86_64 ASoC: rt1308-sdw: add the default value of some registers drm/amd/display: Remove wrong pipe control lock ACPI: scan: Add LATT2021 to acpi_ignore_dep_ids[] RDMA/efa: Add EFA 0xefa2 PCI ID btrfs: raid56: properly handle the error when unable to find the missing stripe NFSv4: Retry LOCK on OLD_STATEID during delegation return ACPI: x86: Add another system to quirk list for forcing StorageD3Enable firmware: arm_scmi: Cleanup the core driver removal callback i2c: tegra: Allocate DMA memory for DMA engine i2c: i801: add lis3lv02d's I2C address for Vostro 5568 drm/imx: imx-tve: Fix return type of imx_tve_connector_mode_valid btrfs: remove pointless and double ulist frees in error paths of qgroup tests Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm x86/cpu: Add several Intel server CPU model numbers ASoC: codecs: jz4725b: Fix spelling mistake "Sourc" -> "Source", "Routee" -> "Route" mtd: spi-nor: intel-spi: Disable write protection only if asked spi: intel: Use correct mask for flash and protected regions KVM: x86/pmu: Do not speculatively query Intel GP PMCs that don't exist yet hugetlbfs: don't delete error page from pagecache arm64: dts: qcom: sa8155p-adp: Specify which LDO modes are allowed arm64: dts: qcom: sm8150-xperia-kumano: Specify which LDO modes are allowed arm64: dts: qcom: sm8250-xperia-edo: Specify which LDO modes are allowed arm64: dts: qcom: sm8350-hdk: Specify which LDO modes are allowed spi: stm32: Print summary 'callbacks suppressed' message ARM: dts: at91: sama7g5: fix signal name of pin PB2 ASoC: core: Fix use-after-free in snd_soc_exit() ASoC: tas2770: Fix set_tdm_slot in case of single slot ASoC: tas2764: Fix set_tdm_slot in case of single slot ARM: at91: pm: avoid soft resetting AC DLL serial: 8250: omap: Fix missing PM runtime calls for omap8250_set_mctrl() serial: 8250_omap: remove wait loop from Errata i202 workaround serial: 8250: omap: Fix unpaired pm_runtime_put_sync() in omap8250_remove() serial: 8250: omap: Flush PM QOS work on remove serial: imx: Add missing .thaw_noirq hook tty: n_gsm: fix sleep-in-atomic-context bug in gsm_control_send bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() ASoC: soc-utils: Remove __exit for snd_soc_util_exit() pinctrl: rockchip: list all pins in a possible mux route for PX30 scsi: scsi_transport_sas: Fix error handling in sas_phy_add() block: sed-opal: kmalloc the cmd/resp buffers bpf: Fix memory leaks in __check_func_call arm64: Fix bit-shifting UB in the MIDR_CPU_MODEL() macro siox: fix possible memory leak in siox_device_add() parport_pc: Avoid FIFO port location truncation pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map drm/vc4: kms: Fix IS_ERR() vs NULL check for vc4_kms drm/panel: simple: set bpc field for logic technologies displays drm/drv: Fix potential memory leak in drm_dev_init() drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker() ARM: dts: imx7: Fix NAND controller size-cells arm64: dts: imx8mm: Fix NAND controller size-cells arm64: dts: imx8mn: Fix NAND controller size-cells ata: libata-transport: fix double ata_host_put() in ata_tport_add() ata: libata-transport: fix error handling in ata_tport_add() ata: libata-transport: fix error handling in ata_tlink_add() ata: libata-transport: fix error handling in ata_tdev_add() nfp: change eeprom length to max length enumerators MIPS: fix duplicate definitions for exported symbols MIPS: Loongson64: Add WARN_ON on kexec related kmalloc failed bpf: Initialize same number of free nodes for each pcpu_freelist net: bgmac: Drop free_netdev() from bgmac_enet_remove() mISDN: fix possible memory leak in mISDN_dsp_element_register() net: hinic: Fix error handling in hinic_module_init() net: stmmac: ensure tx function is not running in stmmac_xdp_release() soc: imx8m: Enable OCOTP clock before reading the register net: liquidio: release resources when liquidio driver open failed mISDN: fix misuse of put_device() in mISDN_register_device() net: macvlan: Use built-in RCU list checking net: caif: fix double disconnect client in chnl_net_open() bnxt_en: Remove debugfs when pci_register_driver failed net: mhi: Fix memory leak in mhi_net_dellink() net: dsa: make dsa_master_ioctl() see through port_hwtstamp_get() shims xen/pcpu: fix possible memory leak in register_pcpu() net: ionic: Fix error handling in ionic_init_module() net: ena: Fix error handling in ena_init() net: hns3: fix setting incorrect phy link ksettings for firmware in resetting process bridge: switchdev: Fix memory leaks when changing VLAN protocol drbd: use after free in drbd_create_device() platform/x86/intel: pmc: Don't unconditionally attach Intel PMC when virtualized platform/surface: aggregator: Do not check for repeated unsequenced packets cifs: add check for returning value of SMB2_close_init net: ag71xx: call phylink_disconnect_phy if ag71xx_hw_enable() fail in ag71xx_open() net/x25: Fix skb leak in x25_lapb_receive_frame() cifs: Fix wrong return value checking when GETFLAGS net: microchip: sparx5: Fix potential null-ptr-deref in sparx_stats_init() and sparx5_start() net: thunderbolt: Fix error handling in tbnet_init() cifs: add check for returning value of SMB2_set_info_init ftrace: Fix the possible incorrect kernel message ftrace: Optimize the allocation for mcount entries ftrace: Fix null pointer dereference in ftrace_add_mod() ring_buffer: Do not deactivate non-existant pages tracing: Fix memory leak in tracing_read_pipe() tracing/ring-buffer: Have polling block on watermark tracing: Fix memory leak in test_gen_synth_cmd() and test_empty_synth_event() tracing: Fix wild-memory-access in register_synth_event() tracing: Fix race where eprobes can be called before the event tracing: kprobe: Fix potential null-ptr-deref on trace_event_file in kprobe_event_gen_test_exit() tracing: kprobe: Fix potential null-ptr-deref on trace_array in kprobe_event_gen_test_exit() drm/amd/display: Add HUBP surface flip interrupt handler ALSA: usb-audio: Drop snd_BUG_ON() from snd_usbmidi_output_open() ALSA: hda/realtek: fix speakers for Samsung Galaxy Book Pro ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book Pro 360 Revert "usb: dwc3: disable USB core PHY management" slimbus: qcom-ngd: Fix build error when CONFIG_SLIM_QCOM_NGD_CTRL=y && CONFIG_QCOM_RPROC_COMMON=m slimbus: stream: correct presence rate frequencies speakup: fix a segfault caused by switching consoles USB: bcma: Make GPIO explicitly optional USB: serial: option: add Sierra Wireless EM9191 USB: serial: option: remove old LARA-R6 PID USB: serial: option: add u-blox LARA-R6 00B modem USB: serial: option: add u-blox LARA-L6 modem USB: serial: option: add Fibocom FM160 0x0111 composition usb: add NO_LPM quirk for Realforce 87U Keyboard usb: chipidea: fix deadlock in ci_otg_del_timer usb: cdns3: host: fix endless superspeed hub port reset usb: typec: mux: Enter safe mode only when pins need to be reconfigured iio: adc: at91_adc: fix possible memory leak in at91_adc_allocate_trigger() iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init() iio: adc: mp2629: fix wrong comparison of channel iio: adc: mp2629: fix potential array out of bound access iio: pressure: ms5611: changed hardcoded SPI speed to value limited dm ioctl: fix misbehavior if list_versions races with module loading serial: 8250: Fall back to non-DMA Rx if IIR_RDI occurs serial: 8250: Flush DMA Rx on RLSI serial: 8250_lpss: Configure DMA also w/o DMA filter Input: iforce - invert valid length check when fetching device IDs maccess: Fix writing offset in case of fault in strncpy_from_kernel_nofault() net: phy: marvell: add sleep time after enabling the loopback bit scsi: zfcp: Fix double free of FSF request when qdio send fails iommu/vt-d: Preset Access bit for IOVA in FL non-leaf paging entries iommu/vt-d: Set SRE bit only when hardware has SRS cap firmware: coreboot: Register bus in module init mmc: core: properly select voltage range without power cycle mmc: sdhci-pci-o2micro: fix card detect fail issue caused by CD# debounce timeout mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() docs: update mediator contact information in CoC doc misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() perf/x86/intel/pt: Fix sampling using single range output nvme: restrict management ioctls to admin nvme: ensure subsystem reset is single threaded serial: 8250_lpss: Use 16B DMA burst with Elkhart Lake perf: Improve missing SIGTRAP checking ring-buffer: Include dropped pages in counting dirty patches tracing: Fix warning on variable 'struct trace_array' net: use struct_group to copy ip/ipv6 header addresses scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() scsi: scsi_debug: Fix possible UAF in sdebug_add_host_helper() kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case Input: i8042 - fix leaking of platform device on module removal macvlan: enforce a consistent minimal mtu tcp: cdg: allow tcp_cdg_release() to be called multiple times kcm: avoid potential race in kcm_tx_work kcm: close race conditions on sk_receive_queue 9p: trans_fd/p9_conn_cancel: drop client lock earlier gfs2: Check sb_bsize_shift after reading superblock gfs2: Switch from strlcpy to strscpy 9p/trans_fd: always use O_NONBLOCK read/write wifi: wext: use flex array destination for memcpy() mm: fs: initialize fsdata passed to write_begin/write_end interface net/9p: use a dedicated spinlock for trans_fd ntfs: fix use-after-free in ntfs_attr_find() ntfs: fix out-of-bounds read in ntfs_attr_find() ntfs: check overflow when iterating ATTR_RECORDs Linux 5.15.80 Change-Id: Idc9aa4c30c528dd194bc813201cbb2c5df8c1d62 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>	2022-11-28 16:08:50 +00:00
Yang Yingliang	a636772988	scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() ... [ Upstream commit bc68e428d4963af0201e92159629ab96948f0893 ] If device_register() fails in tcm_loop_setup_hba_bus(), the name allocated by dev_set_name() need be freed. As comment of device_register() says, it should use put_device() to give up the reference in the error path. So fix this by calling put_device(), then the name can be freed in kobject_cleanup(). The 'tl_hba' will be freed in tcm_loop_release_adapter(), so it don't need goto error label in this case. Fixes: 3703b2c5d0 ("[SCSI] tcm_loop: Add multi-fabric Linux/SCSI LLD fabric module") Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Link: https://lore.kernel.org/r/20221115015042.3652261-1-yangyingliang@huawei.com Reviewed-by: Mike Christie <michael.chritie@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-11-26 09:24:49 +01:00
Greg Kroah-Hartman	3d8ac88867	Merge 5.15.46 into android14-5.15 ... Changes in 5.15.46 binfmt_flat: do not stop relocating GOT entries prematurely on riscv parisc/stifb: Implement fb_is_primary_device() parisc/stifb: Keep track of hardware path of graphics card RISC-V: Mark IORESOURCE_EXCLUSIVE for reserved mem instead of IORESOURCE_BUSY riscv: Initialize thread pointer before calling C functions riscv: Fix irq_work when SMP is disabled riscv: Wire up memfd_secret in UAPI header riscv: Move alternative length validation into subsection ALSA: hda/realtek - Add new type for ALC245 ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS ALSA: usb-audio: Cancel pending work at closing a MIDI substream USB: serial: pl2303: fix type detection for odd device USB: serial: option: add Quectel BG95 modem USB: new quirk for Dell Gen 2 devices usb: isp1760: Fix out-of-bounds array access usb: dwc3: gadget: Move null pinter check to proper place usb: core: hcd: Add support for deferring roothub registration fs/ntfs3: Update valid size if -EIOCBQUEUED fs/ntfs3: Fix fiemap + fix shrink file size (to remove preallocated space) fs/ntfs3: Keep preallocated only if option prealloc enabled fs/ntfs3: Check new size for limits fs/ntfs3: In function ntfs_set_acl_ex do not change inode->i_mode if called from function ntfs_init_acl fs/ntfs3: Fix some memory leaks in an error handling path of 'log_replay()' fs/ntfs3: Update i_ctime when xattr is added fs/ntfs3: Restore ntfs_xattr_get_acl and ntfs_xattr_set_acl functions cifs: fix potential double free during failed mount cifs: when extending a file with falloc we should make files not-sparse xhci: Allow host runtime PM as default for Intel Alder Lake N xHCI platform/x86: intel-hid: fix _DSM function index handling x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails perf/x86/intel: Fix event constraints for ICL x86/kexec: fix memory leak of elf header buffer x86/sgx: Set active memcg prior to shmem allocation ptrace/um: Replace PT_DTRACE with TIF_SINGLESTEP ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP ptrace: Reimplement PTRACE_KILL by always sending SIGKILL btrfs: add "0x" prefix for unsupported optional features btrfs: return correct error number for __extent_writepage_io() btrfs: repair super block num_devices automatically btrfs: fix the error handling for submit_extent_page() for btrfs_do_readpage() iommu/vt-d: Add RPLS to quirk list to skip TE disabling drm/vmwgfx: validate the screen formats drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes selftests/bpf: Fix vfs_link kprobe definition selftests/bpf: Fix parsing of prog types in UAPI hdr for bpftool sync mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue b43legacy: Fix assigning negative value to unsigned variable b43: Fix assigning negative value to unsigned variable ipw2x00: Fix potential NULL dereference in libipw_xmit() ipv6: fix locking issues with loops over idev->addr_list fbcon: Consistently protect deferred_takeover with console_lock() x86/platform/uv: Update TSC sync state for UV5 ACPICA: Avoid cache flush inside virtual machines mac80211: minstrel_ht: fix where rate stats are stored (fixes debugfs output) drm/komeda: return early if drm_universal_plane_init() fails. drm/amd/display: Disabling Z10 on DCN31 rcu-tasks: Fix race in schedule and flush work rcu: Make TASKS_RUDE_RCU select IRQ_WORK sfc: ef10: Fix assigning negative value to unsigned variable ALSA: jack: Access input_dev under mutex rtw88: 8821c: fix debugfs rssi value spi: spi-rspi: Remove setting {src,dst}_{addr,addr_width} based on DMA direction tools/power turbostat: fix ICX DRAM power numbers scsi: lpfc: Move cfg_log_verbose check before calling lpfc_dmp_dbg() scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock scsi: lpfc: Fix call trace observed during I/O with CMF enabled cpuidle: PSCI: Improve support for suspend-to-RAM for PSCI OSI mode drm/amd/pm: fix double free in si_parse_power_table() ASoC: rsnd: care default case on rsnd_ssiu_busif_err_status_clear() ASoC: rsnd: care return value from rsnd_node_fixed_index() ath9k: fix QCA9561 PA bias level media: venus: hfi: avoid null dereference in deinit media: pci: cx23885: Fix the error handling in cx23885_initdev() media: cx25821: Fix the warning when removing the module md/bitmap: don't set sb values if can't pass sanity check mmc: jz4740: Apply DMA engine limits to maximum segment size drivers: mmc: sdhci_am654: Add the quirk to set TESTCD bit scsi: megaraid: Fix error check return value of register_chrdev() drm/amdgpu/sdma: Fix incorrect calculations of the wptr of the doorbells scsi: ufs: Use pm_runtime_resume_and_get() instead of pm_runtime_get_sync() scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp() ath11k: disable spectral scan during spectral deinit ASoC: Intel: bytcr_rt5640: Add quirk for the HP Pro Tablet 408 drm/plane: Move range check for format_count earlier drm/amd/pm: fix the compile warning ath10k: skip ath10k_halt during suspend for driver state RESTARTING arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall drm: msm: fix error check return value of irq_of_parse_and_map() scsi: target: tcmu: Fix possible data corruption ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL net/mlx5: fs, delete the FTE when there are no rules attached to it ASoC: dapm: Don't fold register value changes into notifications mlxsw: spectrum_dcb: Do not warn about priority changes mlxsw: Treat LLDP packets as control drm/amdgpu/psp: move PSP memory alloc from hw_init to sw_init drm/amdgpu/ucode: Remove firmware load type check in amdgpu_ucode_free_bo regulator: mt6315: Enforce regulator-compatible, not name HID: bigben: fix slab-out-of-bounds Write in bigben_probe of: Support more than one crash kernel regions for kexec -s ASoC: tscs454: Add endianness flag in snd_soc_component_driver scsi: lpfc: Alter FPIN stat accounting logic net: remove two BUG() from skb_checksum_help() s390/preempt: disable __preempt_count_add() optimization for PROFILE_ALL_BRANCHES perf/amd/ibs: Cascade pmu init functions' return value sched/core: Avoid obvious double update_rq_clock warning spi: stm32-qspi: Fix wait_cmd timeout in APM mode dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default ipmi:ssif: Check for NULL msg when handling events and messages ipmi: Fix pr_fmt to avoid compilation issues rtlwifi: Use pr_warn instead of WARN_ONCE mt76: mt7921: accept rx frames with non-standard VHT MCS10-11 mt76: fix encap offload ethernet type check media: rga: fix possible memory leak in rga_probe media: coda: limit frame interval enumeration to supported encoder frame sizes media: hantro: HEVC: unconditionnaly set pps_{cb/cr}_qp_offset values media: ccs-core.c: fix failure to call clk_disable_unprepare media: imon: reorganize serialization media: cec-adap.c: fix is_configuring state usbnet: Run unregister_netdev() before unbind() again openrisc: start CPU timer early in boot nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags ASoC: rt5645: Fix errorenous cleanup order nbd: Fix hung on disconnect request if socket is closed before drm/amd/pm: update smartshift powerboost calc for smu12 drm/amd/pm: update smartshift powerboost calc for smu13 net: phy: micrel: Allow probing without .driver_data media: exynos4-is: Fix compile warning media: hantro: Stop using H.264 parameter pic_num ASoC: max98357a: remove dependency on GPIOLIB ASoC: rt1015p: remove dependency on GPIOLIB ACPI: CPPC: Assume no transition latency if no PCCT nvme: set non-mdts limits in nvme_scan_work can: mcp251xfd: silence clang's -Wunaligned-access warning x86/microcode: Add explicit CPU vendor dependency net: ipa: ignore endianness if there is no header m68k: atari: Make Atari ROM port I/O write macros return void rxrpc: Return an error to sendmsg if call failed rxrpc, afs: Fix selection of abort codes afs: Adjust ACK interpretation to try and cope with NAT eth: tg3: silence the GCC 12 array-bounds warning char: tpm: cr50_i2c: Suppress duplicated error message in .remove() selftests/bpf: fix btf_dump/btf_dump due to recent clang change gfs2: use i_lock spin_lock for inode qadata scsi: target: tcmu: Avoid holding XArray lock when calling lock_page IB/rdmavt: add missing locks in rvt_ruc_loopback ARM: dts: ox820: align interrupt controller node name with dtschema ARM: dts: socfpga: align interrupt controller node name with dtschema ARM: dts: s5pv210: align DMA channels with dtschema arm64: dts: qcom: msm8994: Fix the cont_splash_mem address arm64: dts: qcom: msm8994: Fix BLSP[12]_DMA channels count PM / devfreq: rk3399_dmc: Disable edev on remove() crypto: ccree - use fine grained DMA mapping dir soc: ti: ti_sci_pm_domains: Check for null return of devm_kcalloc fs: jfs: fix possible NULL pointer dereference in dbFree() arm64: dts: qcom: sdm845-xiaomi-beryllium: fix typo in panel's vddio-supply property ALSA: usb-audio: Add quirk bits for enabling/disabling generic implicit fb ALSA: usb-audio: Move generic implicit fb quirk entries into quirks.c ARM: OMAP1: clock: Fix UART rate reporting algorithm powerpc/fadump: Fix fadump to work with a different endian capture kernel fat: add ratelimit to fat*_ent_bread() pinctrl: renesas: rzn1: Fix possible null-ptr-deref in sh_pfc_map_resources() ARM: versatile: Add missing of_node_put in dcscb_init ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM ARM: hisi: Add missing of_node_put after of_find_compatible_node cpufreq: Avoid unnecessary frequency updates due to mismatch powerpc/rtas: Keep MSR[RI] set when calling RTAS PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() KVM: PPC: Book3S HV Nested: L2 LPCR should inherit L1 LPES setting alpha: fix alloc_zeroed_user_highpage_movable() tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate powerpc/powernv/vas: Assign real address to rx_fifo in vas_rx_win_attr powerpc/xics: fix refcount leak in icp_opal_init() powerpc/powernv: fix missing of_node_put in uv_init() macintosh/via-pmu: Fix build failure when CONFIG_INPUT is disabled powerpc/iommu: Add missing of_node_put in iommu_init_early_dart smb3: check for null tcon RDMA/hfi1: Prevent panic when SDMA is disabled Input: gpio-keys - cancel delayed work only in case of GPIO drm: fix EDID struct for old ARM OABI format drm/bridge_connector: enable HPD by default if supported dt-bindings: display: sitronix, st7735r: Fix backlight in example drm/vmwgfx: Fix an invalid read ath11k: acquire ab->base_lock in unassign when finding the peer by addr drm: bridge: it66121: Fix the register page length ath9k: fix ar9003_get_eepmisc drm/edid: fix invalid EDID extension block filtering drm/bridge: adv7511: clean up CEC adapter when probe fails drm: bridge: icn6211: Fix register layout drm: bridge: icn6211: Fix HFP_HSW_HBP_HI and HFP_MIN handling mtd: spinand: gigadevice: fix Quad IO for GD5F1GQ5UExxG spi: qcom-qspi: Add minItems to interconnect-names ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe x86/delay: Fix the wrong asm constraint in delay_loop() drm/vc4: hvs: Fix frame count register readout drm/mediatek: Fix mtk_cec_mask() drm/vc4: hvs: Reset muxes at probe time drm/vc4: txp: Don't set TXP_VSTART_AT_EOF drm/vc4: txp: Force alpha to be 0xff if it's disabled libbpf: Don't error out on CO-RE relos for overriden weak subprogs x86/PCI: Fix ALi M1487 (IBC) PIRQ router link value interpretation mptcp: reset the packet scheduler on PRIO change nl80211: show SSID for P2P_GO interfaces drm/komeda: Fix an undefined behavior bug in komeda_plane_add() drm: mali-dp: potential dereference of null pointer spi: spi-ti-qspi: Fix return value handling of wait_for_completion_timeout scftorture: Fix distribution of short handler delays net: dsa: mt7530: 1G can also support 1000BASE-X link mode ixp4xx_eth: fix error check return value of platform_get_irq() NFC: NULL out the dev->rfkill to prevent UAF efi: Add missing prototype for efi_capsule_setup_info device property: Check fwnode->secondary when finding properties device property: Allow error pointer to be passed to fwnode APIs target: remove an incorrect unmap zeroes data deduction drbd: fix duplicate array initializer EDAC/dmc520: Don't print an error for each unconfigured interrupt line mtd: rawnand: denali: Use managed device resources HID: hid-led: fix maximum brightness for Dream Cheeky HID: elan: Fix potential double free in elan_input_configured drm/bridge: Fix error handling in analogix_dp_probe regulator: da9121: Fix uninit-value in da9121_assign_chip_model() drm/mediatek: dpi: Use mt8183 output formats for mt8192 signal: Deliver SIGTRAP on perf event asynchronously if blocked sched/fair: Fix cfs_rq_clock_pelt() for throttled cfs_rq sched/psi: report zeroes for CPU full at the system level spi: img-spfi: Fix pm_runtime_get_sync() error checking cpufreq: Fix possible race in cpufreq online error path printk: use atomic updates for klogd work printk: add missing memory barrier to wake_up_klogd() printk: wake waiters for safe and NMI contexts ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix media: i2c: max9286: Use dev_err_probe() helper media: i2c: max9286: Use "maxim,gpio-poc" property media: i2c: max9286: fix kernel oops when removing module media: hantro: Empty encoder capture buffers by default drm/panel: simple: Add missing bus flags for Innolux G070Y2-L01 ALSA: pcm: Check for null pointer of pointer substream before dereferencing it mtdblock: warn if opened on NAND inotify: show inotify mask flags in proc fdinfo fsnotify: fix wrong lockdep annotations spi: rockchip: Stop spi slave dma receiver when cs inactive spi: rockchip: Preset cs-high and clk polarity in setup progress spi: rockchip: fix missing error on unsupported SPI_CS_HIGH of: overlay: do not break notify on NOTIFY_{OK|STOP} selftests/damon: add damon to selftests root Makefile drm/msm/dp: Modify prototype of encoder based API drm/msm/hdmi: switch to drm_bridge_connector drm/msm/dpu: adjust display_v_end for eDP and DP scsi: iscsi: Fix harmless double shift bug scsi: ufs: qcom: Fix ufs_qcom_resume() scsi: ufs: core: Exclude UECxx from SFR dump list drm/v3d: Fix null pointer dereference of pointer perfmon selftests/resctrl: Fix null pointer dereference on open failed libbpf: Fix logic for finding matching program for CO-RE relocation mtd: spi-nor: core: Check written SR value in spi_nor_write_16bit_sr_and_check() x86/pm: Fix false positive kmemleak report in msr_build_context() mtd: rawnand: cadence: fix possible null-ptr-deref in cadence_nand_dt_probe() mtd: rawnand: intel: fix possible null-ptr-deref in ebu_nand_probe() x86/speculation: Add missing prototype for unpriv_ebpf_notify() ASoC: rk3328: fix disabling mclk on pclk probe failure perf tools: Add missing headers needed by util/data.h drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume drm/msm/dp: stop event kernel thread when DP unbind drm/msm/dp: fix error check return value of irq_of_parse_and_map() drm/msm/dp: reset DP controller before transmit phy test pattern drm/msm/dp: do not stop transmitting phy test pattern during DP phy compliance test drm/msm/dsi: fix error checks and return values for DSI xmit functions drm/msm/hdmi: check return value after calling platform_get_resource_byname() drm/msm/hdmi: fix error check return value of irq_of_parse_and_map() drm/msm: add missing include to msm_drv.c drm/panel: panel-simple: Fix proper bpc for AM-1280800N3TZQW-T00H kunit: fix debugfs code to use enum kunit_status, not bool drm/rockchip: vop: fix possible null-ptr-deref in vop_bind() spi: cadence-quadspi: fix Direct Access Mode disable for SoCFPGA perf tools: Use Python devtools for version autodetection rather than runtime virtio_blk: fix the discard_granularity and discard_alignment queue limits nl80211: don't hold RTNL in color change request x86: Fix return value of __setup handlers irqchip/exiu: Fix acknowledgment of edge triggered interrupts irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value irqchip/aspeed-scu-ic: Fix irq_of_parse_and_map() return value x86/mm: Cleanup the control_va_addr_alignment() __setup handler arm64: fix types in copy_highpage() regulator: core: Fix enable_count imbalance with EXCLUSIVE_GET drm/msm/dsi: fix address for second DSI PHY on SDM660 drm/msm/dp: fix event thread stuck in wait_event after kthread_stop() drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected drm/msm: return an error pointer in msm_gem_prime_get_sg_table() media: uvcvideo: Fix missing check to determine if element is found in list arm64: stackleak: fix current_top_of_stack() iomap: iomap_write_failed fix spi: spi-fsl-qspi: check return value after calling platform_get_resource_byname() Revert "cpufreq: Fix possible race in cpufreq online error path" regulator: qcom_smd: Fix up PM8950 regulator configuration samples: bpf: Don't fail for a missing VMLINUX_BTF when VMLINUX_H is provided perf/amd/ibs: Use interrupt regs ip for stack unwinding ath11k: Don't check arvif->is_started before sending management frames wilc1000: fix crash observed in AP mode with cfg80211_register_netdevice() HID: amd_sfh: Modify the bus name HID: amd_sfh: Modify the hid name ASoC: fsl: Use dev_err_probe() helper ASoC: fsl: Fix refcount leak in imx_sgtl5000_probe ASoC: imx-hdmi: Fix refcount leak in imx_hdmi_probe ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt dma-direct: factor out a helper for DMA_ATTR_NO_KERNEL_MAPPING allocations dma-direct: don't fail on highmem CMA pages in dma_direct_alloc_pages ASoC: samsung: Use dev_err_probe() helper ASoC: samsung: Fix refcount leak in aries_audio_probe block: Fix the bio.bi_opf comment kselftest/cgroup: fix test_stress.sh to use OUTPUT dir scripts/faddr2line: Fix overlapping text section failures media: aspeed: Fix an error handling path in aspeed_video_probe() media: exynos4-is: Fix PM disable depth imbalance in fimc_is_probe mt76: mt7921: Fix the error handling path of mt7921_pci_probe() mt76: do not attempt to reorder received 802.3 packets without agg session media: st-delta: Fix PM disable depth imbalance in delta_probe media: atmel: atmel-isc: Fix PM disable depth imbalance in atmel_isc_probe media: i2c: rdacm2x: properly set subdev entity function media: exynos4-is: Change clk_disable to clk_disable_unprepare media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init media: vsp1: Fix offset calculation for plane cropping media: atmel: atmel-sama5d2-isc: fix wrong mask in YUYV format check media: hantro: HEVC: Fix tile info buffer value computation Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout Bluetooth: use hdev lock in activate_scan for hci_is_adv_monitoring Bluetooth: use hdev lock for accept_list and reject_list in conn req nvme: set dma alignment to dword m68k: math-emu: Fix dependencies of math emulation support sctp: read sk->sk_bound_dev_if once in sctp_rcv() net: hinic: add missing destroy_workqueue in hinic_pf_to_mgmt_init ASoC: ti: j721e-evm: Fix refcount leak in j721e_soc_probe_* kselftest/arm64: bti: force static linking media: ov7670: remove ov7670_power_off from ov7670_remove media: i2c: ov5648: fix wrong pointer passed to IS_ERR() and PTR_ERR() media: staging: media: rkvdec: Make use of the helper function devm_platform_ioremap_resource() media: rkvdec: h264: Fix dpb_valid implementation media: rkvdec: h264: Fix bit depth wrap in pps packet regulator: scmi: Fix refcount leak in scmi_regulator_probe ext4: reject the 'commit' option on ext2 filesystems drm/msm/a6xx: Fix refcount leak in a6xx_gpu_init drm: msm: fix possible memory leak in mdp5_crtc_cursor_set() x86/sev: Annotate stack change in the #VC handler drm/msm: don't free the IRQ if it was not requested selftests/bpf: Add missed ima_setup.sh in Makefile drm/msm/dpu: handle pm_runtime_get_sync() errors in bind path drm/i915: Fix CFI violation with show_dynamic_id() thermal/drivers/bcm2711: Don't clamp temperature at zero thermal/drivers/broadcom: Fix potential NULL dereference in sr_thermal_probe thermal/core: Fix memory leak in __thermal_cooling_device_register() thermal/drivers/imx_sc_thermal: Fix refcount leak in imx_sc_thermal_probe bfq: Relax waker detection for shared queues bfq: Allow current waker to defend against a tentative one ASoC: wm2000: fix missing clk_disable_unprepare() on error in wm2000_anc_transition() PM: domains: Fix initialization of genpd's next_wakeup net: macb: Fix PTP one step sync support NFC: hci: fix sleep in atomic context bugs in nfc_hci_hcp_message_tx ASoC: max98090: Move check for invalid values before casting in max98090_put_enab_tlv() net: stmmac: selftests: Use kcalloc() instead of kzalloc() net: stmmac: fix out-of-bounds access in a selftest hv_netvsc: Fix potential dereference of NULL pointer hwmon: (pmbus) Check PEC support before reading other registers rxrpc: Fix listen() setting the bar too high for the prealloc rings rxrpc: Don't try to resend the request if we're receiving the reply rxrpc: Fix overlapping ACK accounting rxrpc: Don't let ack.previousPacket regress rxrpc: Fix decision on when to generate an IDLE ACK net: huawei: hinic: Use devm_kcalloc() instead of devm_kzalloc() hinic: Avoid some over memory allocation net: dsa: restrict SMSC_LAN9303_I2C kconfig net/smc: postpone sk_refcnt increment in connect() dma-direct: factor out dma_set_{de,en}crypted helpers dma-direct: don't call dma_set_decrypted for remapped allocations dma-direct: always leak memory that can't be re-encrypted dma-direct: don't over-decrypt memory arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399 arm64: dts: mt8192: Fix nor_flash status disable typo PCI/ACPI: Allow D3 only if Root Port can signal and wake from D3 memory: samsung: exynos5422-dmc: Avoid some over memory allocation ARM: dts: BCM5301X: update CRU block description ARM: dts: BCM5301X: Update pin controller node name ARM: dts: suniv: F1C100: fix watchdog compatible soc: qcom: smp2p: Fix missing of_node_put() in smp2p_parse_ipc soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc PCI: cadence: Fix find_first_zero_bit() limit PCI: rockchip: Fix find_first_zero_bit() limit PCI: mediatek: Fix refcount leak in mtk_pcie_subsys_powerup() PCI: dwc: Fix setting error return on MSI DMA mapping failure ARM: dts: ci4x10: Adapt to changes in imx6qdl.dtsi regarding fec clocks soc: qcom: llcc: Add MODULE_DEVICE_TABLE() KVM: nVMX: Leave most VM-Exit info fields unmodified on failed VM-Entry KVM: nVMX: Clear IDT vectoring on nested VM-Exit for double/triple fault crypto: qat - set CIPHER capability for QAT GEN2 crypto: qat - set COMPRESSION capability for QAT GEN2 crypto: qat - set CIPHER capability for DH895XCC crypto: qat - set COMPRESSION capability for DH895XCC platform/chrome: cros_ec: fix error handling in cros_ec_register() ARM: dts: imx6dl-colibri: Fix I2C pinmuxing platform/chrome: Re-introduce cros_ec_cmd_xfer and use it for ioctls can: xilinx_can: mark bit timing constants as const ARM: dts: stm32: Fix PHY post-reset delay on Avenger96 ARM: dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT ARM: dts: bcm2837-rpi-cm3-io3: Fix GPIO line names for SMPS I2C ARM: dts: bcm2837-rpi-3-b-plus: Fix GPIO line name of power LED ARM: dts: bcm2835-rpi-b: Fix GPIO line names misc: ocxl: fix possible double free in ocxl_file_register_afu crypto: marvell/cesa - ECB does not IV gpiolib: of: Introduce hook for missing gpio-ranges pinctrl: bcm2835: implement hook for missing gpio-ranges arm: mediatek: select arch timer for mt7629 pinctrl/rockchip: support deferring other gpio params pinctrl: mediatek: mt8195: enable driver on mtk platforms arm64: dts: qcom: qrb5165-rb5: Fix can-clock node name Drivers: hv: vmbus: Fix handling of messages with transaction ID of zero powerpc/fadump: fix PT_LOAD segment for boot memory area mfd: ipaq-micro: Fix error check return value of platform_get_irq() scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac() soc: bcm: Check for NULL return of devm_kzalloc() arm64: dts: ti: k3-am64-mcu: remove incorrect UART base clock rates ASoC: sh: rz-ssi: Check return value of pm_runtime_resume_and_get() ASoC: sh: rz-ssi: Propagate error codes returned from platform_get_irq_byname() ASoC: sh: rz-ssi: Release the DMA channels in rz_ssi_probe() error path firmware: arm_scmi: Fix list protocols enumeration in the base protocol nvdimm: Fix firmware activation deadlock scenarios nvdimm: Allow overwrite in the presence of disabled dimms pinctrl: mvebu: Fix irq_of_parse_and_map() return value drivers/base/node.c: fix compaction sysfs file leak dax: fix cache flush on PMD-mapped pages drivers/base/memory: fix an unlikely reference counting issue in __add_memory_block() firmware: arm_ffa: Fix uuid parameter to ffa_partition_probe firmware: arm_ffa: Remove incorrect assignment of driver_data list: introduce list_is_head() helper and re-use it in list.h list: fix a data-race around ep->rdllist drm/msm/dpu: fix error check return value of irq_of_parse_and_map() powerpc/8xx: export 'cpm_setbrg' for modules pinctrl: renesas: r8a779a0: Fix GPIO function on I2C-capable pins pinctrl: renesas: core: Fix possible null-ptr-deref in sh_pfc_map_resources() powerpc/idle: Fix return value of __setup() handler powerpc/4xx/cpm: Fix return value of __setup() handler RDMA/hns: Add the detection for CMDQ status in the device initialization process arm64: dts: marvell: espressobin-ultra: fix SPI-NOR config arm64: dts: marvell: espressobin-ultra: enable front USB3 port ASoC: atmel-pdmic: Remove endianness flag on pdmic component ASoC: atmel-classd: Remove endianness flag on class d component proc: fix dentry/inode overinstantiating under /proc/${pid}/net ipc/mqueue: use get_tree_nodev() in mqueue_get_tree() PCI: imx6: Fix PERST# start-up sequence tty: fix deadlock caused by calling printk() under tty_port->lock crypto: sun8i-ss - rework handling of IV crypto: sun8i-ss - handle zero sized sg crypto: cryptd - Protect per-CPU resource by disabling BH. ARM: dts: at91: sama7g5: remove interrupt-parent from gic node hugetlbfs: fix hugetlbfs_statfs() locking Input: sparcspkr - fix refcount leak in bbc_beep_probe PCI/AER: Clear MULTI_ERR_COR/UNCOR_RCV bits PCI: microchip: Fix potential race in interrupt handling hwrng: omap3-rom - fix using wrong clk_disable() in omap_rom_rng_runtime_resume() powerpc/64: Only WARN if __pa()/__va() called with bad addresses powerpc/perf: Fix the threshold compare group constraint for power10 powerpc/perf: Fix the threshold compare group constraint for power9 macintosh: via-pmu and via-cuda need RTC_LIB powerpc/xive: Add some error handling code to 'xive_spapr_init()' powerpc/xive: Fix refcount leak in xive_spapr_init powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup mfd: davinci_voicecodec: Fix possible null-ptr-deref davinci_vc_probe() nfsd: destroy percpu stats counters after reply cache shutdown mailbox: forward the hrtimer if not queued and under a lock RDMA/hfi1: Prevent use of lock before it is initialized KVM: LAPIC: Drop pending LAPIC timer injection when canceling the timer Input: stmfts - do not leave device disabled in stmfts_input_open OPP: call of_node_put() on error path in _bandwidth_supported() f2fs: support fault injection for dquot_initialize() f2fs: fix to do sanity check on inline_dots inode f2fs: fix dereference of stale list iterator after loop body iommu/amd: Enable swiotlb in all cases iommu/mediatek: Fix 2 HW sharing pgtable issue iommu/mediatek: Add list_del in mtk_iommu_remove iommu/mediatek: Remove clk_disable in mtk_iommu_remove iommu/mediatek: Add mutex for m4u_group and m4u_dom in data i2c: at91: use dma safe buffers cpufreq: mediatek: Use module_init and add module_exit cpufreq: mediatek: Unregister platform device on exit iommu/arm-smmu-v3-sva: Fix mm use-after-free MIPS: Loongson: Use hwmon_device_register_with_groups() to register hwmon iommu/mediatek: Fix NULL pointer dereference when printing dev_name i2c: at91: Initialize dma_buf in at91_twi_xfer() dmaengine: idxd: Fix the error handling path in idxd_cdev_register() NFS: Do not report EINTR/ERESTARTSYS as mapping errors NFS: fsync() should report filesystem errors over EINTR/ERESTARTSYS NFS: Don't report ENOSPC write errors twice NFS: Do not report flush errors in nfs_write_end() NFS: Don't report errors from nfs_pageio_complete() more than once NFSv4/pNFS: Do not fail I/O when we fail to allocate the pNFS layout NFS: Further fixes to the writeback error handling video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup dmaengine: stm32-mdma: remove GISR1 register dmaengine: stm32-mdma: fix chan initialization in stm32_mdma_irq_handler() iommu/amd: Increase timeout waiting for GA log enablement i2c: npcm: Fix timeout calculation i2c: npcm: Correct register access width i2c: npcm: Handle spurious interrupts i2c: rcar: fix PM ref counts in probe error paths perf build: Fix btf__load_from_kernel_by_id() feature check perf c2c: Use stdio interface if slang is not supported perf jevents: Fix event syntax error caused by ExtSel video: fbdev: vesafb: Fix a use-after-free due early fb_info cleanup NFS: Always initialise fattr->label in nfs_fattr_alloc() NFS: Create a new nfs_alloc_fattr_with_label() function NFS: Convert GFP_NOFS to GFP_KERNEL NFSv4.1 mark qualified async operations as MOVEABLE tasks f2fs: fix to avoid f2fs_bug_on() in dec_valid_node_count() f2fs: fix to do sanity check on block address in f2fs_do_zero_range() f2fs: fix to clear dirty inode in f2fs_evict_inode() f2fs: fix deadloop in foreground GC f2fs: don't need inode lock for system hidden quota f2fs: fix to do sanity check on total_data_blocks f2fs: don't use casefolded comparison for "." and ".." f2fs: fix fallocate to use file_modified to update permissions consistently f2fs: fix to do sanity check for inline inode objtool: Fix objtool regression on x32 systems objtool: Fix symbol creation wifi: mac80211: fix use-after-free in chanctx code iwlwifi: mvm: fix assert 1F04 upon reconfig fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages efi: Do not import certificates from UEFI Secure Boot for T2 Macs bfq: Avoid false marking of bic as stably merged bfq: Avoid merging queues with different parents bfq: Split shared queues on move between cgroups bfq: Update cgroup information before merging bio bfq: Drop pointless unlock-lock pair bfq: Remove pointless bfq_init_rq() calls bfq: Track whether bfq_group is still online bfq: Get rid of __bio_blkcg() usage bfq: Make sure bfqg for which we are queueing requests is online ext4: mark group as trimmed only if it was fully scanned ext4: fix use-after-free in ext4_rename_dir_prepare ext4: fix race condition between ext4_write and ext4_convert_inline_data ext4: fix warning in ext4_handle_inode_extension ext4: fix bug_on in ext4_writepages ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state ext4: fix bug_on in __es_tree_search ext4: verify dir block before splitting it ext4: avoid cycles in directory h-tree ACPI: property: Release subnode properties with data nodes tty: goldfish: Introduce gf_ioread32()/gf_iowrite32() tracing: Fix potential double free in create_var_ref() tracing: Initialize integer variable to prevent garbage return value drm/amdgpu: add beige goby PCI ID PCI/PM: Fix bridge_d3_blacklist[] Elo i2 overwrite of Gigabyte X299 PCI: qcom: Fix runtime PM imbalance on probe errors PCI: qcom: Fix unbalanced PHY init on probe errors staging: r8188eu: prevent ->Ssid overflow in rtw_wx_set_scan() mm, compaction: fast_find_migrateblock() should return pfn in the target zone s390/perf: obtain sie_block from the right address s390/stp: clock_delta should be signed dlm: fix plock invalid read dlm: uninitialized variable on error in dlm_listen_for_all() dlm: fix missing lkb refcount handling ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock scsi: dc395x: Fix a missing check on list iterator scsi: ufs: qcom: Add a readl() to make sure ref_clk gets enabled landlock: Add clang-format exceptions landlock: Format with clang-format selftests/landlock: Add clang-format exceptions selftests/landlock: Normalize array assignment selftests/landlock: Format with clang-format samples/landlock: Add clang-format exceptions samples/landlock: Format with clang-format landlock: Fix landlock_add_rule(2) documentation selftests/landlock: Make tests build with old libc selftests/landlock: Extend tests for minimal valid attribute size selftests/landlock: Add tests for unknown access rights selftests/landlock: Extend access right tests to directories selftests/landlock: Fully test file rename with "remove" access selftests/landlock: Add tests for O_PATH landlock: Change landlock_add_rule(2) argument check ordering landlock: Change landlock_restrict_self(2) check ordering selftests/landlock: Test landlock_create_ruleset(2) argument check ordering landlock: Define access_mask_t to enforce a consistent access mask size landlock: Reduce the maximum number of layers to 16 landlock: Create find_rule() from unmask_layers() landlock: Fix same-layer rule unions drm/amdgpu/cs: make commands with 0 chunks illegal behaviour. drm/nouveau/subdev/bus: Ratelimit logging for fault errors drm/etnaviv: check for reaped mapping in etnaviv_iommu_unmap_gem drm/nouveau/clk: Fix an incorrect NULL check on list iterator drm/nouveau/kms/nv50-: atom: fix an incorrect NULL check on list iterator drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX drm/i915/dsi: fix VBT send packet port selection for ICL+ md: fix an incorrect NULL check in does_sb_need_changing md: fix an incorrect NULL check in md_reload_sb mtd: cfi_cmdset_0002: Move and rename chip_check/chip_ready/chip_good_for_write mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N media: coda: Fix reported H264 profile media: coda: Add more H264 levels for CODA960 ima: remove the IMA_TEMPLATE Kconfig option Kconfig: Add option for asm goto w/ tied outputs to workaround clang-13 bug RDMA/hfi1: Fix potential integer multiplication overflow errors mmc: core: Allows to override the timeout value for ioctl() path csky: patch_text: Fixup last cpu should be master irqchip/armada-370-xp: Do not touch Performance Counter Overflow on A375, A38x, A39x irqchip: irq-xtensa-mx: fix initial IRQ affinity thermal: devfreq_cooling: use local ops instead of global ops cfg80211: declare MODULE_FIRMWARE for regulatory.db mac80211: upgrade passive scan to active scan on DFS channels after beacon rx um: Use asm-generic/dma-mapping.h um: chan_user: Fix winch_tramp() return value um: Fix out-of-bounds read in LDT setup kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add] ftrace: Clean up hash direct_functions on register failures ksmbd: fix outstanding credits related bugs iommu/msm: Fix an incorrect NULL check on list iterator iommu/dma: Fix iova map result check bug Revert "mm/cma.c: remove redundant cma_mutex lock" mm/page_alloc: always attempt to allocate at least one page during bulk allocation nodemask.h: fix compilation error with GCC12 hugetlb: fix huge_pmd_unshare address update mm/memremap: fix missing call to untrack_pfn() in pagemap_range() xtensa/simdisk: fix proc_read_simdisk() rtl818x: Prevent using not initialized queues ASoC: rt5514: Fix event generation for "DSP Voice Wake Up" control carl9170: tx: fix an incorrect use of list iterator stm: ltdc: fix two incorrect NULL checks on list iterator bcache: improve multithreaded bch_btree_check() bcache: improve multithreaded bch_sectors_dirty_init() bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() bcache: avoid journal no-space deadlock by reserving 1 journal bucket serial: pch: don't overwrite xmit->buf[0] by x_char tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator gma500: fix an incorrect NULL check on list iterator arm64: dts: qcom: ipq8074: fix the sleep clock frequency arm64: tegra: Add missing DFLL reset on Tegra210 clk: tegra: Add missing reset deassertion phy: qcom-qmp: fix struct clk leak on probe errors ARM: dts: s5pv210: Remove spi-cs-high on panel in Aries ARM: pxa: maybe fix gpio lookup tables SMB3: EBADF/EIO errors in rename/open caused by race condition in smb2_compound_op docs/conf.py: Cope with removal of language=None in Sphinx 5.0.0 dt-bindings: gpio: altera: correct interrupt-cells vdpasim: allow to enable a vq repeatedly blk-iolatency: Fix inflight count imbalances and IO hangs on offline coresight: core: Fix coresight device probe failure issue phy: qcom-qmp: fix reset-controller leak on probe errors net: ipa: fix page free in ipa_endpoint_trans_release() net: ipa: fix page free in ipa_endpoint_replenish_one() kseltest/cgroup: Make test_stress.sh work if run interactively list: test: Add a test for list_is_head() Revert "random: use static branch for crng_ready()" staging: r8188eu: delete rtw_wx_read/write32() RDMA/hns: Remove the num_cqc_timer variable RDMA/rxe: Generate a completion for unsupported/invalid opcode MIPS: IP27: Remove incorrect `cpu_has_fpu' override MIPS: IP30: Remove incorrect `cpu_has_fpu' override ext4: only allow test_dummy_encryption when supported interconnect: qcom: sc7180: Drop IP0 interconnects interconnect: qcom: icc-rpmh: Add BCMs to commit list in pre_aggregate fs: add two trivial lookup helpers exportfs: support idmapped mounts fs/ntfs3: Fix invalid free in log_replay md: Don't set mddev private to NULL in raid0 pers->free md: fix double free of io_acct_set bioset md: bcache: check the return value of kzalloc() in detached_dev_do_request() pinctrl/rockchip: support setting input-enable param block: fix bio_clone_blkg_association() to associate with proper blkcg_gq Linux 5.15.46 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I7b65df29c22a01b81a94cd844867a18e73098a15	2022-07-13 11:40:42 +02:00
Christoph Hellwig	ae42074b40	target: remove an incorrect unmap zeroes data deduction ... [ Upstream commit 179d8609d8424529e95021df939ed7b0b82b37f1 ] For block devices, the SCSI target drivers implements UNMAP as calls to blkdev_issue_discard, which does not guarantee zeroing just because Write Zeroes is supported. Note that this does not affect the file backed path which uses fallocate to punch holes. Fixes: 2237498f0b ("target/iblock: Convert WRITE_SAME to blkdev_issue_zeroout") Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com> Link: https://lore.kernel.org/r/20220415045258.199825-2-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-06-09 10:22:47 +02:00
Bodo Stroesser	ff876b6cf5	scsi: target: tcmu: Avoid holding XArray lock when calling lock_page ... [ Upstream commit 325d5c5fb216674296f3902a8902b942da3adc5b ] In tcmu_blocks_release(), lock_page() is called to prevent a race causing possible data corruption. Since lock_page() might sleep, calling it while holding XArray lock is a bug. To fix this, replace the xas_for_each() call with xa_for_each_range(). Since the latter does its own handling of XArray locking, the xas_lock() and xas_unlock() calls around the original loop are no longer necessary. The switch to xa_for_each_range() slows down the loop slightly. This is acceptable since tcmu_blocks_release() is not relevant for performance. Link: https://lore.kernel.org/r/20220517192913.21405-1-bostroesser@gmail.com Fixes: bb9b9eb0ae2e ("scsi: target: tcmu: Fix possible data corruption") Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Bodo Stroesser <bostroesser@gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-06-09 10:22:40 +02:00
Xiaoguang Wang	04be468ec1	scsi: target: tcmu: Fix possible data corruption ... [ Upstream commit bb9b9eb0ae2e9d3f6036f0ad907c3a83dcd43485 ] When tcmu_vma_fault() gets a page successfully, before the current context completes page fault procedure, find_free_blocks() may run and call unmap_mapping_range() to unmap the page. Assume that when find_free_blocks() initially completes and the previous page fault procedure starts to run again and completes, then one truncated page has been mapped to userspace. But note that tcmu_vma_fault() has gotten a refcount for the page so any other subsystem won't be able to use the page unless the userspace address is unmapped later. If another command subsequently runs and needs to extend dbi_thresh it may reuse the corresponding slot for the previous page in data_bitmap. Then though we'll allocate new page for this slot in data_area, no page fault will happen because we have a valid map and the real request's data will be lost. Filesystem implementations will also run into this issue but they usually lock the page when vm_operations_struct->fault gets a page and unlock the page after finish_fault() completes. For truncate filesystems lock pages in truncate_inode_pages() to protect against racing wrt. page faults. To fix this possible data corruption scenario we can apply a method similar to the filesystems. For pages that are to be freed, tcmu_blocks_release() locks and unlocks. Make tcmu_vma_fault() also lock found page under cmdr_lock. At the same time, since tcmu_vma_fault() gets an extra page refcount, tcmu_blocks_release() won't free pages if pages are in page fault procedure, which means it is safe to call tcmu_blocks_release() before unmap_mapping_range(). With these changes tcmu_blocks_release() will wait for all page faults to be completed before calling unmap_mapping_range(). And later, if unmap_mapping_range() is called, it will ensure stale mappings are removed. Link: https://lore.kernel.org/r/20220421023735.9018-1-xiaoguang.wang@linux.alibaba.com Reviewed-by: Bodo Stroesser <bostroesser@gmail.com> Signed-off-by: Xiaoguang Wang <xiaoguang.wang@linux.alibaba.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-06-09 10:22:35 +02:00
Greg Kroah-Hartman	ec1a28c7c0	Merge 5.15.35 into android13-5.15 ... Changes in 5.15.35 drm/amd/display: Add pstate verification and recovery for DCN31 drm/amd/display: Fix p-state allow debug index on dcn31 hamradio: defer 6pack kfree after unregister_netdev hamradio: remove needs_free_netdev to avoid UAF cpuidle: PSCI: Move the `has_lpi` check to the beginning of the function ACPI: processor idle: Check for architectural support for LPI ACPI: processor idle: Allow playing dead in C3 state ACPI: processor: idle: fix lockup regression on 32-bit ThinkPad T40 btrfs: remove unused parameter nr_pages in add_ra_bio_pages() btrfs: remove no longer used counter when reading data page btrfs: remove unused variable in btrfs_{start,write}_dirty_block_groups() soc: qcom: aoss: Expose send for generic usecase dt-bindings: net: qcom,ipa: add optional qcom,qmp property net: ipa: request IPA register values be retained btrfs: release correct delalloc amount in direct IO write path ALSA: core: Add snd_card_free_on_error() helper ALSA: sis7019: Fix the missing error handling ALSA: ali5451: Fix the missing snd_card_free() call at probe error ALSA: als300: Fix the missing snd_card_free() call at probe error ALSA: als4000: Fix the missing snd_card_free() call at probe error ALSA: atiixp: Fix the missing snd_card_free() call at probe error ALSA: au88x0: Fix the missing snd_card_free() call at probe error ALSA: aw2: Fix the missing snd_card_free() call at probe error ALSA: azt3328: Fix the missing snd_card_free() call at probe error ALSA: bt87x: Fix the missing snd_card_free() call at probe error ALSA: ca0106: Fix the missing snd_card_free() call at probe error ALSA: cmipci: Fix the missing snd_card_free() call at probe error ALSA: cs4281: Fix the missing snd_card_free() call at probe error ALSA: cs5535audio: Fix the missing snd_card_free() call at probe error ALSA: echoaudio: Fix the missing snd_card_free() call at probe error ALSA: emu10k1x: Fix the missing snd_card_free() call at probe error ALSA: ens137x: Fix the missing snd_card_free() call at probe error ALSA: es1938: Fix the missing snd_card_free() call at probe error ALSA: es1968: Fix the missing snd_card_free() call at probe error ALSA: fm801: Fix the missing snd_card_free() call at probe error ALSA: galaxy: Fix the missing snd_card_free() call at probe error ALSA: hdsp: Fix the missing snd_card_free() call at probe error ALSA: hdspm: Fix the missing snd_card_free() call at probe error ALSA: ice1724: Fix the missing snd_card_free() call at probe error ALSA: intel8x0: Fix the missing snd_card_free() call at probe error ALSA: intel_hdmi: Fix the missing snd_card_free() call at probe error ALSA: korg1212: Fix the missing snd_card_free() call at probe error ALSA: lola: Fix the missing snd_card_free() call at probe error ALSA: lx6464es: Fix the missing snd_card_free() call at probe error ALSA: maestro3: Fix the missing snd_card_free() call at probe error ALSA: oxygen: Fix the missing snd_card_free() call at probe error ALSA: riptide: Fix the missing snd_card_free() call at probe error ALSA: rme32: Fix the missing snd_card_free() call at probe error ALSA: rme9652: Fix the missing snd_card_free() call at probe error ALSA: rme96: Fix the missing snd_card_free() call at probe error ALSA: sc6000: Fix the missing snd_card_free() call at probe error ALSA: sonicvibes: Fix the missing snd_card_free() call at probe error ALSA: via82xx: Fix the missing snd_card_free() call at probe error ALSA: usb-audio: Cap upper limits of buffer/period bytes for implicit fb ALSA: nm256: Don't call card private_free at probe error path drm/msm: Add missing put_task_struct() in debugfs path firmware: arm_scmi: Remove clear channel call on the TX channel memory: atmel-ebi: Fix missing of_node_put in atmel_ebi_probe Revert "ath11k: mesh: add support for 256 bitmap in blockack frames in 11ax" firmware: arm_scmi: Fix sorting of retrieved clock rates media: rockchip/rga: do proper error checking in probe SUNRPC: Fix the svc_deferred_event trace class net/sched: flower: fix parsing of ethertype following VLAN header veth: Ensure eth header is in skb's linear part gpiolib: acpi: use correct format characters cifs: release cached dentries only if mount is complete net: mdio: don't defer probe forever if PHY IRQ provider is missing mlxsw: i2c: Fix initialization error flow net/sched: fix initialization order when updating chain 0 head net: dsa: felix: suppress -EPROBE_DEFER errors net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link net/sched: taprio: Check if socket flags are valid cfg80211: hold bss_lock while updating nontrans_list netfilter: nft_socket: make cgroup match work in input too drm/msm: Fix range size vs end confusion drm/msm/dsi: Use connector directly in msm_dsi_manager_connector_init() drm/msm/dp: add fail safe mode outside of event_mutex context net/smc: Fix NULL pointer dereference in smc_pnet_find_ib() scsi: pm80xx: Mask and unmask upper interrupt vectors 32-63 scsi: pm80xx: Enable upper inbound, outbound queues scsi: iscsi: Move iscsi_ep_disconnect() scsi: iscsi: Fix offload conn cleanup when iscsid restarts scsi: iscsi: Fix endpoint reuse regression scsi: iscsi: Fix conn cleanup and stop race during iscsid restart scsi: iscsi: Fix unbound endpoint error handling sctp: Initialize daddr on peeled off socket netfilter: nf_tables: nft_parse_register can return a negative value ALSA: ad1889: Fix the missing snd_card_free() call at probe error ALSA: mtpav: Don't call card private_free at probe error path io_uring: move io_uring_rsrc_update2 validation io_uring: verify that resv2 is 0 in io_uring_rsrc_update2 io_uring: verify pad field is 0 in io_get_ext_arg testing/selftests/mqueue: Fix mq_perf_tests to free the allocated cpu set ALSA: usb-audio: Increase max buffer size ALSA: usb-audio: Limit max buffer and period sizes per time perf tools: Fix misleading add event PMU debug message macvlan: Fix leaking skb in source mode with nodst option net: ftgmac100: access hardware register after clock ready nfc: nci: add flush_workqueue to prevent uaf cifs: potential buffer overflow in handling symlinks dm mpath: only use ktime_get_ns() in historical selector vfio/pci: Fix vf_token mechanism when device-specific VF drivers are used net: bcmgenet: Revert "Use stronger register read/writes to assure ordering" block: fix offset/size check in bio_trim() drm/amd: Add USBC connector ID btrfs: fix fallocate to use file_modified to update permissions consistently btrfs: do not warn for free space inode in cow_file_range drm/amdgpu: conduct a proper cleanup of PDB bo drm/amdgpu/gmc: use PCI BARs for APUs in passthrough drm/amd/display: fix audio format not updated after edid updated drm/amd/display: FEC check in timing validation drm/amd/display: Update VTEM Infopacket definition drm/amdkfd: Fix Incorrect VMIDs passed to HWS drm/amdgpu/vcn: improve vcn dpg stop procedure drm/amdkfd: Check for potential null return of kmalloc_array() Drivers: hv: vmbus: Deactivate sysctl_record_panic_msg by default in isolated guests PCI: hv: Propagate coherence from VMbus device to PCI device Drivers: hv: vmbus: Prevent load re-ordering when reading ring buffer scsi: target: tcmu: Fix possible page UAF scsi: lpfc: Fix queue failures when recovering from PCI parity error scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024 net: micrel: fix KS8851_MLL Kconfig ata: libata-core: Disable READ LOG DMA EXT for Samsung 840 EVOs gpu: ipu-v3: Fix dev_dbg frequency output regulator: wm8994: Add an off-on delay for WM8994 variant arm64: alternatives: mark patch_alternative() as `noinstr` tlb: hugetlb: Add more sizes to tlb_remove_huge_tlb_entry net: axienet: setup mdio unconditionally Drivers: hv: balloon: Disable balloon and hot-add accordingly net: usb: aqc111: Fix out-of-bounds accesses in RX fixup myri10ge: fix an incorrect free for skb in myri10ge_sw_tso spi: cadence-quadspi: fix protocol setup for non-1-1-X operations drm/amd/display: Enable power gating before init_pipes drm/amd/display: Revert FEC check in validation drm/amd/display: Fix allocate_mst_payload assert on resume drbd: set QUEUE_FLAG_STABLE_WRITES scsi: mpt3sas: Fail reset operation if config request timed out scsi: mvsas: Add PCI ID of RocketRaid 2640 scsi: megaraid_sas: Target with invalid LUN ID is deleted during scan drivers: net: slip: fix NPD bug in sl_tx_timeout() io_uring: zero tag on rsrc removal io_uring: use nospec annotation for more indexes perf/imx_ddr: Fix undefined behavior due to shift overflowing the constant mm/secretmem: fix panic when growing a memfd_secret mm, page_alloc: fix build_zonerefs_node() mm: fix unexpected zeroed page mapping with zram swap mm: kmemleak: take a full lowmem check in kmemleak_*_phys() KVM: x86/mmu: Resolve nx_huge_pages when kvm.ko is loaded SUNRPC: Fix NFSD's request deferral on RDMA transports memory: renesas-rpc-if: fix platform-device leak in error path gcc-plugins: latent_entropy: use /dev/urandom cifs: verify that tcon is valid before dereference in cifs_kill_sb ath9k: Properly clear TX status area before reporting to mac80211 ath9k: Fix usage of driver-private space in tx_info btrfs: fix root ref counts in error handling in btrfs_get_root_ref btrfs: mark resumed async balance as writing ALSA: hda/realtek: Add quirk for Clevo PD50PNT ALSA: hda/realtek: add quirk for Lenovo Thinkpad X12 speakers ALSA: pcm: Test for "silence" field in struct "pcm_format_data" nl80211: correctly check NL80211_ATTR_REG_ALPHA2 size ipv6: fix panic when forwarding a pkt with no in6 dev drm/amd/display: don't ignore alpha property on pre-multiplied mode drm/amdgpu: Enable gfxoff quirk on MacBook Pro x86/tsx: Use MSR_TSX_CTRL to clear CPUID bits x86/tsx: Disable TSX development mode at boot genirq/affinity: Consider that CPUs on nodes can be unbalanced tick/nohz: Use WARN_ON_ONCE() to prevent console saturation ARM: davinci: da850-evm: Avoid NULL pointer dereference dm integrity: fix memory corruption when tag_size is less than digest size i2c: dev: check return value when calling dev_set_name() smp: Fix offline cpu check in flush_smp_call_function_queue() i2c: pasemi: Wait for write xfers to finish dt-bindings: net: snps: remove duplicate name timers: Fix warning condition in __run_timers() dma-direct: avoid redundant memory sync for swiotlb drm/i915: Sunset igpu legacy mmap support based on GRAPHICS_VER_FULL cpu/hotplug: Remove the 'cpu' member of cpuhp_cpu_state soc: qcom: aoss: Fix missing put_device call in qmp_get net: ipa: fix a build dependency cpufreq: intel_pstate: ITMT support for overclocked system ax25: add refcount in ax25_dev to avoid UAF bugs ax25: fix reference count leaks of ax25_dev ax25: fix UAF bugs of net_device caused by rebinding operation ax25: Fix refcount leaks caused by ax25_cb_del() ax25: fix UAF bug in ax25_send_control() ax25: fix NPD bug in ax25_disconnect ax25: Fix NULL pointer dereferences in ax25 timers ax25: Fix UAF bugs in ax25 timers Linux 5.15.35 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I0dd9eaea7f977df42b0a5b9cb9043c879f62718b	2022-04-24 16:58:59 +02:00
Xiaoguang Wang	b7f3b5d70c	scsi: target: tcmu: Fix possible page UAF ... [ Upstream commit a6968f7a367f128d120447360734344d5a3d5336 ] tcmu_try_get_data_page() looks up pages under cmdr_lock, but it does not take refcount properly and just returns page pointer. When tcmu_try_get_data_page() returns, the returned page may have been freed by tcmu_blocks_release(). We need to get_page() under cmdr_lock to avoid concurrent tcmu_blocks_release(). Link: https://lore.kernel.org/r/20220311132206.24515-1-xiaoguang.wang@linux.alibaba.com Reviewed-by: Bodo Stroesser <bostroesser@gmail.com> Signed-off-by: Xiaoguang Wang <xiaoguang.wang@linux.alibaba.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-04-20 09:34:15 +02:00
Greg Kroah-Hartman	0a77fca3aa	ANDROID: GKI: set vfs-only exports into their own namespace ... We have namespaces, so use them for all vfs-exported namespaces so that filesystems can use them, but not anything else. Some in-kernel drivers that do direct filesystem accesses (because they serve up files) are also allowed access to these symbols to keep 'make allmodconfig' builds working properly, but it is not needed for Android kernel images. Bug: 157965270 Bug: 210074446 Cc: Matthias Maennich <maennich@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Iaf6140baf3a18a516ab2d5c3966235c42f3f70de	2022-04-07 15:14:24 +02:00
ZouMingzhe	4f786e8f18	scsi: target: iscsi: Make sure the np under each tpg is unique ... [ Upstream commit a861790afaa8b6369eee8a88c5d5d73f5799c0c6 ] iscsit_tpg_check_network_portal() has nested for_each loops and is supposed to return true when a match is found. However, the tpg loop will still continue after existing the tpg_np loop. If this tpg_np is not the last the match value will be changed. Break the outer loop after finding a match and make sure the np under each tpg is unique. Link: https://lore.kernel.org/r/20220111054742.19582-1-mingzhe.zou@easystack.cn Signed-off-by: ZouMingzhe <mingzhe.zou@easystack.cn> Reviewed-by: Mike Christie <michael.christie@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2022-02-16 12:56:12 +01:00
Mike Christie	26af3ab932	scsi: target: Fix alua_tg_pt_gps_count tracking ... [ Upstream commit 1283c0d1a32bb924324481586b5d6e8e76f676ba ] We can't free the tg_pt_gp in core_alua_set_tg_pt_gp_id() because it's still accessed via configfs. Its release must go through the normal configfs/refcount process. The max alua_tg_pt_gps_count check should probably have been done in core_alua_allocate_tg_pt_gp(), but with the current code userspace could have created 0x0000ffff + 1 groups, but only set the id for 0x0000ffff. Then it could have deleted a group with an ID set, and then set the ID for that extra group and it would work ok. It's unlikely, but just in case this patch continues to allow that type of behavior, and just fixes the kfree() while in use bug. Link: https://lore.kernel.org/r/20210930020422.92578-4-michael.christie@oracle.com Signed-off-by: Mike Christie <michael.christie@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-11-25 09:48:29 +01:00
Mike Christie	a248988035	scsi: target: Fix ordered tag handling ... [ Upstream commit ed1227e080990ffec5bf39006ec8a57358e6689a ] This patch fixes the following bugs: 1. If there are multiple ordered cmds queued and multiple simple cmds completing, target_restart_delayed_cmds() could be called on different CPUs and each instance could start a ordered cmd. They could then run in different orders than they were queued. 2. target_restart_delayed_cmds() and target_handle_task_attr() can race where: 1. target_handle_task_attr() has passed the simple_cmds == 0 check. 2. transport_complete_task_attr() then decrements simple_cmds to 0. 3. transport_complete_task_attr() runs target_restart_delayed_cmds() and it does not see any cmds on the delayed_cmd_list. 4. target_handle_task_attr() adds the cmd to the delayed_cmd_list. The cmd will then end up timing out. 3. If we are sent > 1 ordered cmds and simple_cmds == 0, we can execute them out of order, because target_handle_task_attr() will hit that simple_cmds check first and return false for all ordered cmds sent. 4. We run target_restart_delayed_cmds() after every cmd completion, so if there is more than 1 simple cmd running, we start executing ordered cmds after that first cmd instead of waiting for all of them to complete. 5. Ordered cmds are not supposed to start until HEAD OF QUEUE and all older cmds have completed, and not just simple. 6. It's not a bug but it doesn't make sense to take the delayed_cmd_lock for every cmd completion when ordered cmds are almost never used. Just replacing that lock with an atomic increases IOPs by up to 10% when completions are spread over multiple CPUs and there are multiple sessions/ mqs/thread accessing the same device. This patch moves the queued delayed handling to a per device work to serialze the cmd executions for each device and adds a new counter to track HEAD_OF_QUEUE and SIMPLE cmds. We can then check the new counter to determine when to run the work on the completion path. Link: https://lore.kernel.org/r/20210930020422.92578-3-michael.christie@oracle.com Signed-off-by: Mike Christie <michael.christie@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-11-25 09:48:29 +01:00
Dmitry Bogdanov	b65e9044be	scsi: target: core: Remove from tmr_list during LUN unlink ... [ Upstream commit 12b6fcd0ea7f3cb7c3b34668fc678779924123ae ] Currently TMF commands are removed from de_device.dev_tmf_list at the very end of se_cmd lifecycle. However, se_lun unlinks from se_cmd upon a command status (response) being queued in transport layer. This means that LUN and backend device can be deleted in the meantime and a panic will occur: target_tmr_work() cmd->se_tfo->queue_tm_rsp(cmd); // send abort_rsp to a wire transport_lun_remove_cmd(cmd) // unlink se_cmd from se_lun - // - // - // - <<<--- lun remove <<<--- core backend device remove - // - // - // - qlt_handle_abts_completion() tfo->free_mcmd() transport_generic_free_cmd() target_put_sess_cmd() core_tmr_release_req() { if (dev) { // backend device, can not be null spin_lock_irqsave(&dev->se_tmr_lock, flags); //<<<--- CRASH Call Trace: NIP [c000000000e1683c] _raw_spin_lock_irqsave+0x2c/0xc0 LR [c00800000e433338] core_tmr_release_req+0x40/0xa0 [target_core_mod] Call Trace: (unreliable) 0x0 target_put_sess_cmd+0x2a0/0x370 [target_core_mod] transport_generic_free_cmd+0x6c/0x1b0 [target_core_mod] tcm_qla2xxx_complete_mcmd+0x28/0x50 [tcm_qla2xxx] process_one_work+0x2c4/0x5c0 worker_thread+0x88/0x690 For the iSCSI protocol this is easily reproduced: - Send some SCSI sommand - Send Abort of that command over iSCSI - Remove LUN on target - Send next iSCSI command to acknowledge the Abort_Response - Target panics There is no need to keep the command in tmr_list until response completion, so move the removal from tmr_list from the response completion to the response queueing when the LUN is unlinked. Move the removal from state list too as it is a subject to the same race condition. Link: https://lore.kernel.org/r/20211018135753.15297-1-d.bogdanov@yadro.com Fixes: c66ac9db8d ("[SCSI] target: Add LIO target core v4.0.0-rc6") Reviewed-by: Roman Bolshakov <r.bolshakov@yadro.com> Reviewed-by: Mike Christie <michael.christie@oracle.com> Signed-off-by: Dmitry Bogdanov <d.bogdanov@yadro.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org>	2021-11-18 19:17:03 +01:00
Colin Ian King	9a8ef2c73c	scsi: target: Fix spelling mistake "CONFLIFT" -> "CONFLICT" ... There is a spelling mistake in a dev_err message. Fix it. Link: https://lore.kernel.org/r/20210920183206.17477-1-colin.king@canonical.com Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2021-09-22 00:17:29 -04:00
Maurizio Lombardi	ef7ae7f746	scsi: target: Fix the pgr/alua_support_store functions ... Commit 356ba2a8bc ("scsi: target: tcmu: Make pgr_support and alua_support attributes writable") introduced support for changeable alua_support and pgr_support target attributes. These can only be changed if the backstore is user-backed, otherwise the kernel returns -EINVAL. This triggers a warning in the targetcli/rtslib code when performing a target restore that includes non-userbacked backstores: # targetctl restore Storage Object block/storage1: Cannot set attribute alua_support: [Errno 22] Invalid argument, skipped Storage Object block/storage1: Cannot set attribute pgr_support: [Errno 22] Invalid argument, skipped Fix this warning by returning an error code only if we are really going to flip the PGR/ALUA bit in the transport_flags field, otherwise we will do nothing and return success. Return ENOSYS instead of EINVAL if the pgr/alua attributes can not be changed, this way it will be possible for userspace to understand if the operation failed because an invalid value has been passed to strtobool() or because the attributes are fixed. Fixes: 356ba2a8bc ("scsi: target: tcmu: Make pgr_support and alua_support attributes writable") Link: https://lore.kernel.org/r/20210906151809.52811-1-mlombard@redhat.com Reviewed-by: Bodo Stroesser <bostroesser@gmail.com> Signed-off-by: Maurizio Lombardi <mlombard@redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2021-09-13 22:15:46 -04:00
Linus Torvalds	a9c9a6f741	Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi ... Pull SCSI updates from James Bottomley: "This series consists of the usual driver updates (ufs, qla2xxx, target, smartpqi, lpfc, mpt3sas). The core change causing the most churn was replacing the command request field request with a macro, allowing us to offset map to it and remove the redundant field; the same was also done for the tag field. The most impactful change is the final removal of scsi_ioctl, which has been deprecated for over a decade" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (293 commits) scsi: ufs: Fix ufshcd_request_sense_async() for Samsung KLUFG8RHDA-B2D1 scsi: ufs: ufs-exynos: Fix static checker warning scsi: mpt3sas: Use the proper SCSI midlayer interfaces for PI scsi: lpfc: Use the proper SCSI midlayer interfaces for PI scsi: lpfc: Copyright updates for 14.0.0.1 patches scsi: lpfc: Update lpfc version to 14.0.0.1 scsi: lpfc: Add bsg support for retrieving adapter cmf data scsi: lpfc: Add cmf_info sysfs entry scsi: lpfc: Add debugfs support for cm framework buffers scsi: lpfc: Add support for maintaining the cm statistics buffer scsi: lpfc: Add rx monitoring statistics scsi: lpfc: Add support for the CM framework scsi: lpfc: Add cmfsync WQE support scsi: lpfc: Add support for cm enablement buffer scsi: lpfc: Add cm statistics buffer support scsi: lpfc: Add EDC ELS support scsi: lpfc: Expand FPIN and RDF receive logging scsi: lpfc: Add MIB feature enablement support scsi: lpfc: Add SET_HOST_DATA mbox cmd to pass date/time info to firmware scsi: fc: Add EDC ELS definition ...	2021-09-02 15:09:46 -07:00
Sergey Samoylenko	0394b5048e	scsi: target: Fix sense key for invalid EXTENDED COPY request ... TCM fails to pass the following tests in libiscsi: SCSI.ExtendedCopy.DescrType SCSI.ExtendedCopy.DescrLimits SCSI.ExtendedCopy.ParamHdr SCSI.ExtendedCopy.ValidSegDescr SCSI.ExtendedCopy.ValidTgtDescr The xcopy code always returns the same NOT READY sense key for all detected errors. Change the sense key for invalid requests to ILLEGAL REQUEST, and for aborted transfers to COPY ABORTED. Link: https://lore.kernel.org/r/20210803145410.80147-3-s.samoylenko@yadro.com Fixes: d877d7275b ("target: Fix a deadlock between the XCOPY code and iSCSI session shutdown") Reviewed-by: David Disseldorp <ddiss@suse.de> Reviewed-by: Roman Bolshakov <r.bolshakov@yadro.com> Reviewed-by: Konstantin Shelekhin <k.shelekhin@yadro.com> Signed-off-by: Sergey Samoylenko <s.samoylenko@yadro.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2021-08-17 22:28:40 -04:00
Sergey Samoylenko	44678553ad	scsi: target: Allows backend drivers to fail with specific sense codes ... Currently, backend drivers can fail I/O with SAM_STAT_CHECK_CONDITION which gets us TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE. Add a new helper that allows backend drivers to fail with specific sense codes. This is based on a patch from Mike Christie <michael.christie@oracle.com>. Cc: Mike Christie <michael.christie@oracle.com> Link: https://lore.kernel.org/r/20210803145410.80147-2-s.samoylenko@yadro.com Reviewed-by: David Disseldorp <ddiss@suse.de> Signed-off-by: Sergey Samoylenko <s.samoylenko@yadro.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2021-08-17 22:28:40 -04:00
Tuo Li	0f99792c01	scsi: target: pscsi: Fix possible null-pointer dereference in pscsi_complete_cmd() ... The return value of transport_kmap_data_sg() is assigned to the variable buf: buf = transport_kmap_data_sg(cmd); And then it is checked: if (!buf) { This indicates that buf can be NULL. However, it is dereferenced in the following statements: if (!(buf[3] & 0x80)) buf[3] |= 0x80; if (!(buf[2] & 0x80)) buf[2] |= 0x80; To fix these possible null-pointer dereferences, dereference buf and call transport_kunmap_data_sg() only when buf is not NULL. Link: https://lore.kernel.org/r/20210810040414.248167-1-islituo@gmail.com Reported-by: TOTE Robot <oslab@tsinghua.edu.cn> Reviewed-by: Bodo Stroesser <bostroesser@gmail.com> Signed-off-by: Tuo Li <islituo@gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2021-08-17 22:28:39 -04:00
Martin K. Petersen	315480209b	Merge branch '5.14/scsi-fixes' into 5.15/scsi-staging ... Resolve mpt3sas conflict between 5.14/scsi-fixes and 5.15/scsi-staging reported by sfr. Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2021-08-11 22:37:22 -04:00
Bart Van Assche	cb22f89e7a	scsi: tcm_loop: Use scsi_cmd_to_rq() instead of scsi_cmnd.request ... Prepare for removal of the request pointer by using scsi_cmd_to_rq() instead. This patch does not change any functionality. Link: https://lore.kernel.org/r/20210809230355.8186-51-bvanassche@acm.org Signed-off-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2021-08-11 22:25:42 -04:00
David Disseldorp	40fd8845c0	scsi: target: core: Drop unnecessary se_cmd ASC/ASCQ members ... These members are only used for ALUA sense detail propagation, which can just as easily be done via sense_reason_t. Link: https://lore.kernel.org/r/20210728115353.2396-4-ddiss@suse.de Reviewed-by: Mike Christie <michael.christie@oracle.com> Signed-off-by: David Disseldorp <ddiss@suse.de> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2021-08-03 07:27:43 -04:00
David Disseldorp	35410f8624	scsi: target: sbp: Drop incorrect ASC/ASCQ usage ... The se_cmd scsi_asc and scsi_ascq members are only used for tracking ALUA SCSI sense detail between target_core_alua and translate_sense_reason(), so they're effectively always zero here. Link: https://lore.kernel.org/r/20210728115353.2396-3-ddiss@suse.de Cc: Chris Boot <bootc@bootc.net> Reviewed-by: Mike Christie <michael.christie@oracle.com> Signed-off-by: David Disseldorp <ddiss@suse.de> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2021-08-03 07:27:43 -04:00
David Disseldorp	7e457e5efc	scsi: target: core: Avoid using lun_tg_pt_gp after unlock ... core_alua_state_lba_dependent() currently uses lun->lun_tg_pt_gp without holding the lun_tg_pt_gp_lock. The lock is taken in the caller, so obtain the needed tg_pt_gp_id there instead. Link: https://lore.kernel.org/r/20210728115353.2396-2-ddiss@suse.de Cc: Hannes Reinecke <hare@suse.de> Reviewed-by: Mike Christie <michael.christie@oracle.com> Signed-off-by: David Disseldorp <ddiss@suse.de> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2021-08-03 07:27:42 -04:00
Bodo Stroesser	018c14911d	scsi: target: tcmu: Add new feature KEEP_BUF ... When running command pipelining for WRITE direction commands (e.g. tape device write), userspace sends cmd completion to cmd ring before processing write data. In that case userspace has to copy data before sending completion, because cmd completion also implicitly releases the data buffer in data area. The new feature KEEP_BUF allows userspace to optionally keep the buffer after completion by setting new bit TCMU_UFLAG_KEEP_BUF in tcmu_cmd_entry_hdr->uflags. In that case buffer has to be released explicitly by writing the cmd_id to new action item free_kept_buf. All kept buffers are released during reset_ring and if userspace closes uio device (tcmu_release). Link: https://lore.kernel.org/r/20210713175021.20103-1-bostroesser@gmail.com Reviewed-by: Mike Christie <michael.christie@oracle.com> Signed-off-by: Bodo Stroesser <bostroesser@gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2021-08-03 07:27:42 -04:00
Christoph Hellwig	33ff4ce45b	scsi: core: Rename CONFIG_BLK_SCSI_REQUEST to CONFIG_SCSI_COMMON ... CONFIG_BLK_SCSI_REQUEST is rather misnamed as it enables building a small amount of code shared by the SCSI initiator, target, and consumers of the scsi_request passthrough API. Rename it and also allow building it as a module. [mkp: add module license] Link: https://lore.kernel.org/r/20210724072033.1284840-20-hch@lst.de Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2021-07-28 22:24:27 -04:00
Greg Kroah-Hartman	bdac4d8abb	Merge 5.14-rc3 into driver-core-next ... We need the driver-core fixes in here as well. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-07-27 09:22:08 +02:00
Colin Ian King	8f13142ac2	scsi: target: Remove redundant assignment to variable ret ... The variable ret is being initialized with a value that is never read, the assignment is redundant and can be removed. Link: https://lore.kernel.org/r/20210721101519.42299-1-colin.king@canonical.com Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Addresses-Coverity: ("Unused value")	2021-07-27 00:06:42 -04:00
Uwe Kleine-König	fc7a6209d5	bus: Make remove callback return void ... The driver core ignores the return value of this callback because there is only little it can do when a device disappears. This is the final bit of a long lasting cleanup quest where several buses were converted to also return void from their remove callback. Additionally some resource leaks were fixed that were caused by drivers returning an error code in the expectation that the driver won't go away. With struct bus_type::remove returning void it's prevented that newly implemented buses return an ignored error code and so don't anticipate wrong expectations for driver authors. Reviewed-by: Tom Rix <trix@redhat.com> (For fpga) Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org> Reviewed-by: Cornelia Huck <cohuck@redhat.com> (For drivers/s390 and drivers/vfio) Acked-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> (For ARM, Amba and related parts) Acked-by: Mark Brown <broonie@kernel.org> Acked-by: Chen-Yu Tsai <wens@csie.org> (for sunxi-rsb) Acked-by: Pali Rohár <pali@kernel.org> Acked-by: Mauro Carvalho Chehab <mchehab@kernel.org> (for media) Acked-by: Hans de Goede <hdegoede@redhat.com> (For drivers/platform) Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Acked-By: Vinod Koul <vkoul@kernel.org> Acked-by: Juergen Gross <jgross@suse.com> (For xen) Acked-by: Lee Jones <lee.jones@linaro.org> (For mfd) Acked-by: Johannes Thumshirn <jth@kernel.org> (For mcb) Acked-by: Johan Hovold <johan@kernel.org> Acked-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> (For slimbus) Acked-by: Kirti Wankhede <kwankhede@nvidia.com> (For vfio) Acked-by: Maximilian Luz <luzmaximilian@gmail.com> Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> (For ulpi and typec) Acked-by: Samuel Iglesias Gonsálvez <siglesias@igalia.com> (For ipack) Acked-by: Geoff Levand <geoff@infradead.org> (For ps3) Acked-by: Yehezkel Bernat <YehezkelShB@gmail.com> (For thunderbolt) Acked-by: Alexander Shishkin <alexander.shishkin@linux.intel.com> (For intel_th) Acked-by: Dominik Brodowski <linux@dominikbrodowski.net> (For pcmcia) Acked-by: Rafael J. Wysocki <rafael@kernel.org> (For ACPI) Acked-by: Bjorn Andersson <bjorn.andersson@linaro.org> (rpmsg and apr) Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> (For intel-ish-hid) Acked-by: Dan Williams <dan.j.williams@intel.com> (For CXL, DAX, and NVDIMM) Acked-by: William Breathitt Gray <vilhelm.gray@gmail.com> (For isa) Acked-by: Stefan Richter <stefanr@s5r6.in-berlin.de> (For firewire) Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> (For hid) Acked-by: Thorsten Scherer <t.scherer@eckelmann.de> (For siox) Acked-by: Sven Van Asbroeck <TheSven73@gmail.com> (For anybuss) Acked-by: Ulf Hansson <ulf.hansson@linaro.org> (For MMC) Acked-by: Wolfram Sang <wsa@kernel.org> # for I2C Acked-by: Sudeep Holla <sudeep.holla@arm.com> Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Acked-by: Finn Thain <fthain@linux-m68k.org> Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Link: https://lore.kernel.org/r/20210713193522.1770306-6-u.kleine-koenig@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>	2021-07-21 11:53:42 +02:00
David Disseldorp	a47fa41381	scsi: target: Fix NULL dereference on XCOPY completion ... CPU affinity control added with commit 39ae3edda3 ("scsi: target: core: Make completion affinity configurable") makes target_complete_cmd() queue work on a CPU based on se_tpg->se_tpg_wwn->cmd_compl_affinity state. LIO's EXTENDED COPY worker is a special case in that read/write cmds are dispatched using the global xcopy_pt_tpg, which carries a NULL se_tpg_wwn pointer following initialization in target_xcopy_setup_pt(). The NULL xcopy_pt_tpg->se_tpg_wwn pointer is dereferenced on completion of any EXTENDED COPY initiated read/write cmds. E.g using the libiscsi SCSI.ExtendedCopy.Simple test: BUG: kernel NULL pointer dereference, address: 00000000000001a8 RIP: 0010:target_complete_cmd+0x9d/0x130 [target_core_mod] Call Trace: fd_execute_rw+0x148/0x42a [target_core_file] ? __dynamic_pr_debug+0xa7/0xe0 ? target_check_reservation+0x5b/0x940 [target_core_mod] __target_execute_cmd+0x1e/0x90 [target_core_mod] transport_generic_new_cmd+0x17c/0x330 [target_core_mod] target_xcopy_issue_pt_cmd+0x9/0x60 [target_core_mod] target_xcopy_read_source.isra.7+0x10b/0x1b0 [target_core_mod] ? target_check_fua+0x40/0x40 [target_core_mod] ? transport_complete_task_attr+0x130/0x130 [target_core_mod] target_xcopy_do_work+0x61f/0xc00 [target_core_mod] This fix makes target_complete_cmd() queue work on se_cmd->cpuid if se_tpg_wwn is NULL. Link: https://lore.kernel.org/r/20210720225522.26291-1-ddiss@suse.de Fixes: 39ae3edda3 ("scsi: target: core: Make completion affinity configurable") Cc: Lee Duncan <lduncan@suse.com> Cc: Mike Christie <michael.christie@oracle.com> Reviewed-by: Mike Christie <michael.christie@oracle.com> Signed-off-by: David Disseldorp <ddiss@suse.de> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2021-07-20 23:18:22 -04:00
Dmitry Bogdanov	6d8e7e7c93	scsi: target: Fix protect handling in WRITE SAME(32) ... WRITE SAME(32) command handling reads WRPROTECT at the wrong offset in 1st byte instead of 10th byte. Link: https://lore.kernel.org/r/20210702091655.22818-1-d.bogdanov@yadro.com Fixes: afd73f1b60 ("target: Perform PROTECT sanity checks for WRITE_SAME") Signed-off-by: Dmitry Bogdanov <d.bogdanov@yadro.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2021-07-18 21:27:42 -04:00
Linus Torvalds	a022f7d575	Merge tag 'block-5.14-2021-07-08' of git://git.kernel.dk/linux-block ... Pull more block updates from Jens Axboe: "A combination of changes that ended up depending on both the driver and core branch (and/or the IDE removal), and a few late arriving fixes. In detail: - Fix io ticks wrap-around issue (Chunguang) - nvme-tcp sock locking fix (Maurizio) - s390-dasd fixes (Kees, Christoph) - blk_execute_rq polling support (Keith) - blk-cgroup RCU iteration fix (Yu) - nbd backend ID addition (Prasanna) - Partition deletion fix (Yufen) - Use blk_mq_alloc_disk for mmc, mtip32xx, ubd (Christoph) - Removal of now dead block request types due to IDE removal (Christoph) - Loop probing and control device cleanups (Christoph) - Device uevent fix (Christoph) - Misc cleanups/fixes (Tetsuo, Christoph)" * tag 'block-5.14-2021-07-08' of git://git.kernel.dk/linux-block: (34 commits) blk-cgroup: prevent rcu_sched detected stalls warnings while iterating blkgs block: fix the problem of io_ticks becoming smaller nvme-tcp: can't set sk_user_data without write_lock loop: remove unused variable in loop_set_status() block: remove the bdgrab in blk_drop_partitions block: grab a device refcount in disk_uevent s390/dasd: Avoid field over-reading memcpy() dasd: unexport dasd_set_target_state block: check disk exist before trying to add partition ubd: remove dead code in ubd_setup_common nvme: use return value from blk_execute_rq() block: return errors from blk_execute_rq() nvme: use blk_execute_rq() for passthrough commands block: support polling through blk_execute_rq block: remove REQ_OP_SCSI_{IN,OUT} block: mark blk_mq_init_queue_data static loop: rewrite loop_exit using idr_for_each_entry loop: split loop_lookup loop: don't allow deleting an unspecified loop device loop: move loop_ctl_mutex locking into loop_add ...	2021-07-09 12:05:33 -07:00
Linus Torvalds	bd31b9efbf	Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi ... Pull SCSI updates from James Bottomley: "This series consists of the usual driver updates (ufs, ibmvfc, megaraid_sas, lpfc, elx, mpi3mr, qedi, iscsi, storvsc, mpt3sas) with elx and mpi3mr being new drivers. The major core change is a rework to drop the status byte handling macros and the old bit shifted definitions and the rest of the updates are minor fixes" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (287 commits) scsi: aha1740: Avoid over-read of sense buffer scsi: arcmsr: Avoid over-read of sense buffer scsi: ips: Avoid over-read of sense buffer scsi: ufs: ufs-mediatek: Add missing of_node_put() in ufs_mtk_probe() scsi: elx: libefc: Fix IRQ restore in efc_domain_dispatch_frame() scsi: elx: libefc: Fix less than zero comparison of a unsigned int scsi: elx: efct: Fix pointer error checking in debugfs init scsi: elx: efct: Fix is_originator return code type scsi: elx: efct: Fix link error for _bad_cmpxchg scsi: elx: efct: Eliminate unnecessary boolean check in efct_hw_command_cancel() scsi: elx: efct: Do not use id uninitialized in efct_lio_setup_session() scsi: elx: efct: Fix error handling in efct_hw_init() scsi: elx: efct: Remove redundant initialization of variable lun scsi: elx: efct: Fix spelling mistake "Unexected" -> "Unexpected" scsi: lpfc: Fix build error in lpfc_scsi.c scsi: target: iscsi: Remove redundant continue statement scsi: qla4xxx: Remove redundant continue statement scsi: ppa: Switch to use module_parport_driver() scsi: imm: Switch to use module_parport_driver() scsi: mpt3sas: Fix error return value in _scsih_expander_add() ...	2021-07-02 15:14:36 -07:00
Christoph Hellwig	da6269da4c	block: remove REQ_OP_SCSI_{IN,OUT} ... With the legacy IDE driver gone drivers now use either REQ_OP_DRV_* or REQ_OP_SCSI_*, so unify the two concepts of passthrough requests into a single one. Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com> Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Jens Axboe <axboe@kernel.dk>	2021-06-30 15:34:19 -06:00
Colin Ian King	79366f0a8d	scsi: target: iscsi: Remove redundant continue statement ... The continue statement at the end of a loop has no effect, remove it. Link: https://lore.kernel.org/r/20210617114347.10247-1-colin.king@canonical.com Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Addresses-Coverity: ("Continue has no effect")	2021-06-18 23:01:03 -04:00
Bart Van Assche	149d0e489e	scsi: core: Introduce enums for the SAM and host status codes ... Make it possible for the compiler to verify whether SAM and host status codes are used correctly. [mkp: resolve conflicts with Hannes' SCSI result series] Link: https://lore.kernel.org/r/20210524025457.11299-3-bvanassche@acm.org Cc: Hannes Reinecke <hare@suse.com> Reviewed-by: John Garry <john.garry@huawei.com> Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2021-06-02 23:09:39 -04:00
Maurizio Lombardi	515da6f429	scsi: target: core: Fix warning on realtime kernels ... On realtime kernels, spin_lock_irq*(spinlock_t) do not disable the interrupts, a call to irqs_disabled() will return false thus firing a warning in __transport_wait_for_tasks(). Remove the warning and also replace assert_spin_locked() with lockdep_assert_held() Link: https://lore.kernel.org/r/20210531121326.3649-1-mlombard@redhat.com Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Maurizio Lombardi <mlombard@redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2021-05-31 22:59:13 -04:00
Hannes Reinecke	14b40c1e7c	scsi: target: Use standard SAM status types ... target_complete_cmd() and friends requires a SAM status type, so passing GOOD here is actually wrong. Link: https://lore.kernel.org/r/20210427083046.31620-40-hare@suse.de Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2021-05-31 22:48:24 -04:00
Hannes Reinecke	464a00c9e0	scsi: core: Kill DRIVER_SENSE ... Replace the check for DRIVER_SENSE with a check for scsi_status_is_check_condition(). Audit all callsites to ensure the SAM status is set correctly. For backwards compability move the DRIVER_SENSE definition to sg.h, and update sg, bsg, and scsi_ioctl to set the DRIVER_SENSE driver_status whenever SAM_STAT_CHECK_CONDITION is present. [mkp: fix zeroday srp warning] Link: https://lore.kernel.org/r/20210427083046.31620-10-hare@suse.de Signed-off-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> fix	2021-05-31 22:48:21 -04:00
kernel test robot	824731258b	scsi: target: tcmu: Fix boolreturn.cocci warnings ... drivers/target/target_core_user.c:1424:9-10: WARNING: return of 0/1 in function 'tcmu_handle_completions' with return type bool Return statements in functions returning bool should use true/false instead of 1/0. Generated by: scripts/coccinelle/misc/boolreturn.cocci Link: https://lore.kernel.org/r/20210515230358.GA97544@60d1edce16e0 Fixes: 9814b55cde ("scsi: target: tcmu: Return from tcmu_handle_completions() if cmd_id not found") CC: Bodo Stroesser <bostroesser@gmail.com> Reported-by: kernel test robot <lkp@intel.com> Acked-by: Bodo Stroesser <bostroesser@gmail.com> Signed-off-by: kernel test robot <lkp@intel.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2021-05-21 17:14:21 -04:00
Mike Christie	5aaeca258f	scsi: target: iblock: Fix smp_processor_id() BUG messages ... This has us use raw_smp_processor_id() in iblock's plug_device callout. smp_processor_id() is not needed here, because we are running from a per CPU work item that is also queued to run on a worker thread that is normally bound to a specific CPU. If the worker thread did end up switching CPUs then it's handled the same way we handle when the work got moved to a different CPU's worker thread, where we will just end up sending I/O from the new CPU. Link: https://lore.kernel.org/r/20210519222640.5153-1-michael.christie@oracle.com Fixes: 415ccd9811 ("scsi: target: iblock: Add backend plug/unplug callouts") Signed-off-by: Mike Christie <michael.christie@oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2021-05-21 16:40:00 -04:00
Bodo Stroesser	b4150b6881	scsi: target: tcmu: Fix xarray RCU warning ... Commit f5ce815f34 ("scsi: target: tcmu: Support DATA_BLOCK_SIZE = N * PAGE_SIZE") introduced xas_next() calls to iterate xarray elements. These calls triggered the WARNING "suspicious RCU usage" at tcmu device set up [1]. In the call stack of xas_next(), xas_load() was called. According to its comment, this function requires "the xa_lock or the RCU lock". To avoid the warning: - Guard the small loop calling xas_next() in tcmu_get_empty_block with RCU lock. - In the large loop in tcmu_copy_data using RCU lock would possibly disable preemtion for a long time (copy multi MBs). Therefore replace XA_STATE, xas_set and xas_next with a single xa_load. [1] [ 1899.867091] ============================= [ 1899.871199] WARNING: suspicious RCU usage [ 1899.875310] 5.13.0-rc1+ #41 Not tainted [ 1899.879222] ----------------------------- [ 1899.883299] include/linux/xarray.h:1182 suspicious rcu_dereference_check() usage! [ 1899.890940] other info that might help us debug this: [ 1899.899082] rcu_scheduler_active = 2, debug_locks = 1 [ 1899.905719] 3 locks held by kworker/0:1/1368: [ 1899.910161] #0: ffffa1f8c8b98738 ((wq_completion)target_submission){+.+.}-{0:0}, at: process_one_work+0x1ee/0x580 [ 1899.920732] #1: ffffbd7040cd7e78 ((work_completion)(&q->sq.work)){+.+.}-{0:0}, at: process_one_work+0x1ee/0x580 [ 1899.931146] #2: ffffa1f8d1c99768 (&udev->cmdr_lock){+.+.}-{3:3}, at: tcmu_queue_cmd+0xea/0x160 [target_core_user] [ 1899.941678] stack backtrace: [ 1899.946093] CPU: 0 PID: 1368 Comm: kworker/0:1 Not tainted 5.13.0-rc1+ #41 [ 1899.953070] Hardware name: System manufacturer System Product Name/PRIME Z270-A, BIOS 1302 03/15/2018 [ 1899.962459] Workqueue: target_submission target_queued_submit_work [target_core_mod] [ 1899.970337] Call Trace: [ 1899.972839] dump_stack+0x6d/0x89 [ 1899.976222] xas_descend+0x10e/0x120 [ 1899.979875] xas_load+0x39/0x50 [ 1899.983077] tcmu_get_empty_blocks+0x115/0x1c0 [target_core_user] [ 1899.989318] queue_cmd_ring+0x1da/0x630 [target_core_user] [ 1899.994897] ? rcu_read_lock_sched_held+0x3f/0x70 [ 1899.999695] ? trace_kmalloc+0xa6/0xd0 [ 1900.003501] ? __kmalloc+0x205/0x380 [ 1900.007167] tcmu_queue_cmd+0x12f/0x160 [target_core_user] [ 1900.012746] __target_execute_cmd+0x23/0xa0 [target_core_mod] [ 1900.018589] transport_generic_new_cmd+0x1f3/0x370 [target_core_mod] [ 1900.025046] transport_handle_cdb_direct+0x34/0x50 [target_core_mod] [ 1900.031517] target_queued_submit_work+0x43/0xe0 [target_core_mod] [ 1900.037837] process_one_work+0x268/0x580 [ 1900.041952] ? process_one_work+0x580/0x580 [ 1900.046195] worker_thread+0x55/0x3b0 [ 1900.049921] ? process_one_work+0x580/0x580 [ 1900.054192] kthread+0x143/0x160 [ 1900.057499] ? kthread_create_worker_on_cpu+0x40/0x40 [ 1900.062661] ret_from_fork+0x1f/0x30 Link: https://lore.kernel.org/r/20210519135440.26773-1-bostroesser@gmail.com Fixes: f5ce815f34 ("scsi: target: tcmu: Support DATA_BLOCK_SIZE = N * PAGE_SIZE") Reported-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com> Tested-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com> Signed-off-by: Bodo Stroesser <bostroesser@gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2021-05-21 16:15:48 -04:00
Shin'ichiro Kawasaki	70ca3c57ff	scsi: target: core: Avoid smp_processor_id() in preemptible code ... The BUG message "BUG: using smp_processor_id() in preemptible [00000000] code" was observed for TCMU devices with kernel config DEBUG_PREEMPT. The message was observed when blktests block/005 was run on TCMU devices with fileio backend or user:zbc backend [1]. The commit 1130b499b4 ("scsi: target: tcm_loop: Use LIO wq cmd submission helper") triggered the symptom. The commit modified work queue to handle commands and changed 'current->nr_cpu_allowed' at smp_processor_id() call. The message was also observed at system shutdown when TCMU devices were not cleaned up [2]. The function smp_processor_id() was called in SCSI host work queue for abort handling, and triggered the BUG message. This symptom was observed regardless of the commit 1130b499b4 ("scsi: target: tcm_loop: Use LIO wq cmd submission helper"). To avoid the preemptible code check at smp_processor_id(), get CPU ID with raw_smp_processor_id() instead. The CPU ID is used for performance improvement then thread move to other CPU will not affect the code. [1] [ 56.468103] run blktests block/005 at 2021-05-12 14:16:38 [ 57.369473] check_preemption_disabled: 85 callbacks suppressed [ 57.369480] BUG: using smp_processor_id() in preemptible [00000000] code: fio/1511 [ 57.369506] BUG: using smp_processor_id() in preemptible [00000000] code: fio/1510 [ 57.369512] BUG: using smp_processor_id() in preemptible [00000000] code: fio/1506 [ 57.369552] caller is __target_init_cmd+0x157/0x170 [target_core_mod] [ 57.369606] CPU: 4 PID: 1506 Comm: fio Not tainted 5.13.0-rc1+ #34 [ 57.369613] Hardware name: System manufacturer System Product Name/PRIME Z270-A, BIOS 1302 03/15/2018 [ 57.369617] Call Trace: [ 57.369621] BUG: using smp_processor_id() in preemptible [00000000] code: fio/1507 [ 57.369628] dump_stack+0x6d/0x89 [ 57.369642] check_preemption_disabled+0xc8/0xd0 [ 57.369628] caller is __target_init_cmd+0x157/0x170 [target_core_mod] [ 57.369655] __target_init_cmd+0x157/0x170 [target_core_mod] [ 57.369695] target_init_cmd+0x76/0x90 [target_core_mod] [ 57.369732] tcm_loop_queuecommand+0x109/0x210 [tcm_loop] [ 57.369744] scsi_queue_rq+0x38e/0xc40 [ 57.369761] __blk_mq_try_issue_directly+0x109/0x1c0 [ 57.369779] blk_mq_try_issue_directly+0x43/0x90 [ 57.369790] blk_mq_submit_bio+0x4e5/0x5d0 [ 57.369812] submit_bio_noacct+0x46e/0x4e0 [ 57.369830] __blkdev_direct_IO_simple+0x1a3/0x2d0 [ 57.369859] ? set_init_blocksize.isra.0+0x60/0x60 [ 57.369880] generic_file_read_iter+0x89/0x160 [ 57.369898] blkdev_read_iter+0x44/0x60 [ 57.369906] new_sync_read+0x102/0x170 [ 57.369929] vfs_read+0xd4/0x160 [ 57.369941] __x64_sys_pread64+0x6e/0xa0 [ 57.369946] ? lockdep_hardirqs_on+0x79/0x100 [ 57.369958] do_syscall_64+0x3a/0x70 [ 57.369965] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 57.369973] RIP: 0033:0x7f7ed4c1399f [ 57.369979] Code: 08 89 3c 24 48 89 4c 24 18 e8 7d f3 ff ff 4c 8b 54 24 18 48 8b 54 24 10 41 89 c0 48 8b 74 24 08 8b 3c 24 b8 11 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 04 24 e8 cd f3 ff ff 48 8b [ 57.369983] RSP: 002b:00007ffd7918c580 EFLAGS: 00000293 ORIG_RAX: 0000000000000011 [ 57.369990] RAX: ffffffffffffffda RBX: 00000000015b4540 RCX: 00007f7ed4c1399f [ 57.369993] RDX: 0000000000001000 RSI: 00000000015de000 RDI: 0000000000000009 [ 57.369996] RBP: 00000000015b4540 R08: 0000000000000000 R09: 0000000000000001 [ 57.369999] R10: 0000000000e5c000 R11: 0000000000000293 R12: 00007f7eb5269a70 [ 57.370002] R13: 0000000000000000 R14: 0000000000001000 R15: 00000000015b4568 [ 57.370031] CPU: 7 PID: 1507 Comm: fio Not tainted 5.13.0-rc1+ #34 [ 57.370036] Hardware name: System manufacturer System Product Name/PRIME Z270-A, BIOS 1302 03/15/2018 [ 57.370039] Call Trace: [ 57.370045] dump_stack+0x6d/0x89 [ 57.370056] check_preemption_disabled+0xc8/0xd0 [ 57.370068] __target_init_cmd+0x157/0x170 [target_core_mod] [ 57.370121] target_init_cmd+0x76/0x90 [target_core_mod] [ 57.370178] tcm_loop_queuecommand+0x109/0x210 [tcm_loop] [ 57.370197] scsi_queue_rq+0x38e/0xc40 [ 57.370224] __blk_mq_try_issue_directly+0x109/0x1c0 ... [2] [ 117.458597] BUG: using smp_processor_id() in preemptible [00000000] code: kworker/u16:8 [ 117.467279] caller is __target_init_cmd+0x157/0x170 [target_core_mod] [ 117.473893] CPU: 1 PID: 418 Comm: kworker/u16:6 Not tainted 5.13.0-rc1+ #34 [ 117.481150] Hardware name: System manufacturer System Product Name/PRIME Z270-A, BIOS 8 [ 117.481153] Workqueue: scsi_tmf_7 scmd_eh_abort_handler [ 117.481156] Call Trace: [ 117.481158] dump_stack+0x6d/0x89 [ 117.481162] check_preemption_disabled+0xc8/0xd0 [ 117.512575] target_submit_tmr+0x41/0x150 [target_core_mod] [ 117.519705] tcm_loop_issue_tmr+0xa7/0x100 [tcm_loop] [ 117.524913] tcm_loop_abort_task+0x43/0x60 [tcm_loop] [ 117.530137] scmd_eh_abort_handler+0x7b/0x230 [ 117.534681] process_one_work+0x268/0x580 [ 117.538862] worker_thread+0x55/0x3b0 [ 117.542652] ? process_one_work+0x580/0x580 [ 117.548351] kthread+0x143/0x160 [ 117.551675] ? kthread_create_worker_on_cpu+0x40/0x40 [ 117.556873] ret_from_fork+0x1f/0x30 Link: https://lore.kernel.org/r/20210515070315.215801-1-shinichiro.kawasaki@wdc.com Fixes: 1526d9f10c ("scsi: target: Make state_list per CPU") Cc: stable@vger.kernel.org # v5.11+ Reviewed-by: Mike Christie <michael.christie@oracle.com> Signed-off-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2021-05-21 16:14:02 -04:00
Konstantin Shelekhin	b790a56d66	scsi: target: core: Add the VERSION DESCRIPTOR fields to the INQUIRY data ... Extend the standard INQUIRY data to 96 bytes and fill in the VERSION DESCRIPTOR fields. The layout follows SPC-4: - SCSI architecture standard - SCSI transport protocol standard - SCSI primary command set standard - SCSI device type command set standard All version descriptor values are defined as "no version claimed" because some initiators fail to recognize anything else. [mkp: whitespace] Link: https://lore.kernel.org/r/20210513192804.1252142-3-k.shelekhin@yadro.com Reviewed-by: Roman Bolshakov <r.bolshakov@yadro.com> Signed-off-by: Konstantin Shelekhin <k.shelekhin@yadro.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2021-05-15 14:34:26 -04:00
Konstantin Shelekhin	64ae33ef74	scsi: target: core: Bump INQUIRY VERSION to SPC-4 ... Bump the SCSI primary command set standard to SPC-4. The upcoming version descriptors will report newer SCSI standards (like SBC-3) that are not defined in SPC-3. Link: https://lore.kernel.org/r/20210513192804.1252142-2-k.shelekhin@yadro.com Reviewed-by: Roman Bolshakov <r.bolshakov@yadro.com> Signed-off-by: Konstantin Shelekhin <k.shelekhin@yadro.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2021-05-15 14:34:26 -04:00
Sergey Samoylenko	2469f1e041	scsi: target: core: Add configurable IEEE Company ID attribute ... Implement an attribute which provides a way to set a company specific WWN in configfs via: target/core/$backstore/$name/wwn/company_id The Open Fabrics Alliance ID 001405h remains the default. Link: https://lore.kernel.org/r/20210420185920.42431-3-s.samoylenko@yadro.com Signed-off-by: Sergey Samoylenko <s.samoylenko@yadro.com> Signed-off-by: Roman Bolshakov <r.bolshakov@yadro.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2021-05-15 14:14:28 -04:00
Sergey Samoylenko	17f947b8b0	scsi: target: core: Unify NAA identifier generation ... Both the INQUIRY handling and the XCOPY implementation provide functions to generate an NAA designator. In addition, these functions are poorly named: - spc_parse_naa_6h_vendor_specific() - target_xcopy_gen_naa_ieee() Introduce a common NAA 6 designator generation function, spc_gen_naa_6h_vendor_specific(). Link: https://lore.kernel.org/r/20210420185920.42431-2-s.samoylenko@yadro.com Signed-off-by: Sergey Samoylenko <s.samoylenko@yadro.com> Signed-off-by: Roman Bolshakov <r.bolshakov@yadro.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2021-05-15 14:14:28 -04:00
Jiapeng Chong	f8a78e9118	scsi: target: sbp_target: Remove redundant assignment to pg_size ... Variable pg_size is set to '0x100 << pg_size', but this value is never read and it is not used later on. Hence it is a redundant assignment and can be removed. Clean up the following clang-analyzer warning: drivers/target/sbp/sbp_target.c:1264:3: warning: Value stored to 'pg_size' is never read [clang-analyzer-deadcode.DeadStores]. Link: https://lore.kernel.org/r/1620902977-57076-1-git-send-email-jiapeng.chong@linux.alibaba.com Reported-by: Abaci Robot <abaci@linux.alibaba.com> Signed-off-by: Jiapeng Chong <jiapeng.chong@linux.alibaba.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2021-05-14 23:09:24 -04:00
Bodo Stroesser	3ac0fcb4b1	scsi: target: tcmu: Rename TCM_DEV_BIT_PLUGGED to TCMU_DEV_BIT_PLUGGED ... The bit definition TCM_DEV_BIT_PLUGGED should correctly be named TCMU_DEV_BIT_PLUGGED, since all other bits in the same bitfield have prefix TCMU_. Link: https://lore.kernel.org/r/20210512140654.31249-1-bostroesser@gmail.com Signed-off-by: Bodo Stroesser <bostroesser@gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2021-05-14 22:58:27 -04:00
Guenter Roeck	998da772fd	scsi: target: iscsi: Drop unnecessary container_of() ... The structure pointer passed to container_of() is never NULL; that was already checked. That means that the result of container_of() operations on it is also never NULL, even though se_node_acl is the first element of the structure embedding it. On top of that, it is misleading to perform a NULL check on the result of container_of() because the position of the contained element could change, which would make the test invalid. Remove the unnecessary NULL check. As it turns out, the container_of operation was only made for the purpose of the NULL check. If the container_of is actually needed, it is repeated later. Remove the container_of operation as well. The NULL check was identified and removed with the following Coccinelle script. @@ type t; identifier v; statement s; @@ <+... ( t v = container_of(...); | v = container_of(...); ) ... when != v - if (\( !v \| v == NULL \) ) s ...+> Link: https://lore.kernel.org/r/20210510040817.2050266-1-linux@roeck-us.net Cc: "Martin K. Petersen" <martin.petersen@oracle.com> Cc: Hou Pu <houpu@bytedance.com> Cc: Mike Christie <michael.christie@oracle.com> Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>	2021-05-14 22:40:45 -04:00