Commit Graph

614 Commits

Author SHA1 Message Date
Greg Kroah-Hartman 2dcf843019 Merge fd7bf900c3 ("i2c: cadence: cdns_i2c_master_xfer(): Fix runtime PM leak on error path") into android12-5.10-lts
Steps on the way to 5.10.180

Change-Id: I3438288cccc8a544306afc5aa178fde55e7e34fb
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-25 11:42:29 +00:00
Ming Lei 21f2503d37 nvme-fcloop: fix "inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage"
[ Upstream commit 4f86a6ff6f ]

fcloop_fcp_op() could be called from flush request's ->end_io(flush_end_io) in
which the spinlock of fq->mq_flush_lock is grabbed with irq saved/disabled.

So fcloop_fcp_op() can't call spin_unlock_irq(&tfcp_req->reqlock) simply
which enables irq unconditionally.

Fixes the warning by switching to spin_lock_irqsave()/spin_unlock_irqrestore()

Fixes: c38dbbfab1 ("nvme-fcloop: fix inconsistent lock state warnings")
Reported-by: Yi Zhang <yi.zhang@redhat.com>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Ewan D. Milne <emilne@redhat.com>
Tested-by: Yi Zhang <yi.zhang@redhat.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-05-17 11:47:51 +02:00
Greg Kroah-Hartman df23049a96 Merge 5.10.176 into android12-5.10-lts
Changes in 5.10.176
	xfrm: Allow transport-mode states with AF_UNSPEC selector
	drm/panfrost: Don't sync rpm suspension after mmu flushing
	cifs: Move the in_send statistic to __smb_send_rqst()
	drm/meson: fix 1px pink line on GXM when scaling video overlay
	clk: HI655X: select REGMAP instead of depending on it
	docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate
	scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
	ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU()
	netfilter: nft_nat: correct length for loading protocol registers
	netfilter: nft_masq: correct length for loading protocol registers
	netfilter: nft_redir: correct length for loading protocol registers
	netfilter: nft_redir: correct value of inet type `.maxattrs`
	scsi: core: Fix a comment in function scsi_host_dev_release()
	scsi: core: Fix a procfs host directory removal regression
	tcp: tcp_make_synack() can be called from process context
	nfc: pn533: initialize struct pn533_out_arg properly
	ipvlan: Make skb->skb_iif track skb->dev for l3s mode
	i40e: Fix kernel crash during reboot when adapter is in recovery mode
	net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()
	qed/qed_dev: guard against a possible division by zero
	net: tunnels: annotate lockless accesses to dev->needed_headroom
	net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
	nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
	net/smc: fix deadlock triggered by cancel_delayed_work_syn()
	net: usb: smsc75xx: Limit packet length to skb->len
	drm/bridge: Fix returned array size name for atomic_get_input_bus_fmts kdoc
	null_blk: Move driver into its own directory
	block: null_blk: Fix handling of fake timeout request
	nvme: fix handling single range discard request
	nvmet: avoid potential UAF in nvmet_req_complete()
	block: sunvdc: add check for mdesc_grab() returning NULL
	ice: xsk: disable txq irq before flushing hw
	net: dsa: mv88e6xxx: fix max_mtu of 1492 on 6165, 6191, 6220, 6250, 6290
	ipv4: Fix incorrect table ID in IOCTL path
	net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
	net/iucv: Fix size of interrupt data
	selftests: net: devlink_port_split.py: skip test if no suitable device available
	qed/qed_mng_tlv: correctly zero out ->min instead of ->hour
	ethernet: sun: add check for the mdesc_grab()
	hwmon: (adt7475) Display smoothing attributes in correct order
	hwmon: (adt7475) Fix masking of hysteresis registers
	hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
	hwmon: (ina3221) return prober error code
	hwmon: (ucd90320) Add minimum delay between bus accesses
	hwmon: tmp512: drop of_match_ptr for ID table
	hwmon: (adm1266) Set `can_sleep` flag for GPIO chip
	media: m5mols: fix off-by-one loop termination error
	mmc: atmel-mci: fix race between stop command and start of next command
	jffs2: correct logic when creating a hole in jffs2_write_begin
	ext4: fail ext4_iget if special inode unallocated
	ext4: fix task hung in ext4_xattr_delete_inode
	drm/amdkfd: Fix an illegal memory access
	sh: intc: Avoid spurious sizeof-pointer-div warning
	drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes
	ext4: fix possible double unlock when moving a directory
	tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted
	serial: 8250_em: Fix UART port type
	firmware: xilinx: don't make a sleepable memory allocation from an atomic context
	interconnect: fix mem leak when freeing nodes
	tracing: Make splice_read available again
	tracing: Check field value in hist_field_name()
	tracing: Make tracepoint lockdep check actually test something
	cifs: Fix smb2_set_path_size()
	KVM: nVMX: add missing consistency checks for CR0 and CR4
	ALSA: hda: intel-dsp-config: add MTL PCI id
	ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro
	drm/shmem-helper: Remove another errant put in error path
	mptcp: avoid setting TCP_CLOSE state twice
	ftrace: Fix invalid address access in lookup_rec() when index is 0
	mm/userfaultfd: propagate uffd-wp bit when PTE-mapping the huge zeropage
	mmc: sdhci_am654: lower power-on failed message severity
	fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
	cpuidle: psci: Iterate backwards over list in psci_pd_remove()
	x86/mce: Make sure logged MCEs are processed after sysfs update
	x86/mm: Fix use of uninitialized buffer in sme_enable()
	drm/i915: Don't use stolen memory for ring buffers with LLC
	drm/i915/active: Fix misuse of non-idle barriers as fence trackers
	io_uring: avoid null-ptr-deref in io_arm_poll_handler
	s390/ipl: add missing intersection check to ipl_report handling
	PCI: Unify delay handling for reset and resume
	PCI/DPC: Await readiness of secondary bus after reset
	xfs: don't assert fail on perag references on teardown
	xfs: purge dquots after inode walk fails during quotacheck
	xfs: don't leak btree cursor when insrec fails after a split
	xfs: remove XFS_PREALLOC_SYNC
	xfs: fallocate() should call file_modified()
	xfs: set prealloc flag in xfs_alloc_file_space()
	xfs: use setattr_copy to set vfs inode attributes
	fs: add mode_strip_sgid() helper
	fs: move S_ISGID stripping into the vfs_*() helpers
	attr: add in_group_or_capable()
	fs: move should_remove_suid()
	attr: add setattr_should_drop_sgid()
	attr: use consistent sgid stripping checks
	fs: use consistent setgid checks in is_sxid()
	xfs: remove xfs_setattr_time() declaration
	HID: core: Provide new max_buffer_size attribute to over-ride the default
	HID: uhid: Over-ride the default maximum data buffer value with our own
	Linux 5.10.176

Change-Id: Icd45189f4182c749d1758c13e18705abb4ea9c5a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-03-24 16:03:04 +00:00
Damien Le Moal a6317235da nvmet: avoid potential UAF in nvmet_req_complete()
[ Upstream commit 6173a77b7e ]

An nvme target ->queue_response() operation implementation may free the
request passed as argument. Such implementation potentially could result
in a use after free of the request pointer when percpu_ref_put() is
called in nvmet_req_complete().

Avoid such problem by using a local variable to save the sq pointer
before calling __nvmet_req_complete(), thus avoiding dereferencing the
req pointer after that function call.

Fixes: a07b4970f4 ("nvmet: add a generic NVMe target")
Signed-off-by: Damien Le Moal <damien.lemoal@opensource.wdc.com>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-22 13:29:59 +01:00
Greg Kroah-Hartman 0caf8151c2 Merge 5.10.169 into android12-5.10-lts
Changes in 5.10.169
	ASoC: Intel: sof_rt5682: always set dpcm_capture for amplifiers
	selftests/bpf: Verify copy_register_state() preserves parent/live fields
	ALSA: hda: Do not unset preset when cleaning up codec
	ASoC: cs42l56: fix DT probe
	tools/virtio: fix the vringh test for virtio ring changes
	net/rose: Fix to not accept on connected socket
	net: stmmac: do not stop RX_CLK in Rx LPI state for qcs404 SoC
	net: sched: sch: Bounds check priority
	s390/decompressor: specify __decompress() buf len to avoid overflow
	nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association
	platform/x86: touchscreen_dmi: Add Chuwi Vi8 (CWI501) DMI match
	nvmem: core: add error handling for dev_set_name
	nvmem: core: remove nvmem_config wp_gpio
	nvmem: core: fix cleanup after dev_set_name()
	nvmem: core: fix registration vs use race
	aio: fix mremap after fork null-deref
	s390/signal: fix endless loop in do_signal
	ovl: remove privs in ovl_copyfile()
	ovl: remove privs in ovl_fallocate()
	netfilter: nft_tproxy: restrict to prerouting hook
	mmc: jz4740: Work around bug on JZ4760(B)
	mmc: sdio: fix possible resource leaks in some error paths
	mmc: mmc_spi: fix error handling in mmc_spi_probe()
	ALSA: hda/conexant: add a new hda codec SN6180
	ALSA: hda/realtek - fixed wrong gpio assigned
	sched/psi: Fix use-after-free in ep_remove_wait_queue()
	hugetlb: check for undefined shift on 32 bit architectures
	Revert "mm: Always release pages to the buddy allocator in memblock_free_late()."
	net: Fix unwanted sign extension in netdev_stats_to_stats64()
	revert "squashfs: harden sanity check in squashfs_read_xattr_id_table"
	ixgbe: allow to increase MTU to 3K with XDP enabled
	i40e: add double of VLAN header when computing the max MTU
	net: bgmac: fix BCM5358 support by setting correct flags
	sctp: sctp_sock_filter(): avoid list_entry() on possibly empty list
	net/sched: tcindex: update imperfect hash filters respecting rcu
	dccp/tcp: Avoid negative sk_forward_alloc by ipv6_pinfo.pktoptions.
	net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path
	net: openvswitch: fix possible memory leak in ovs_meter_cmd_set()
	net: stmmac: fix order of dwmac5 FlexPPS parametrization sequence
	bnxt_en: Fix mqprio and XDP ring checking logic
	net: stmmac: Restrict warning on disabling DMA store and fwd mode
	net: mpls: fix stale pointer if allocation fails during device rename
	ixgbe: add double of VLAN header when computing the max MTU
	ipv6: Fix datagram socket connection with DSCP.
	ipv6: Fix tcp socket connection with DSCP.
	nilfs2: fix underflow in second superblock position calculations
	drm/i915/gen11: Moving WAs to icl_gt_workarounds_init()
	drm/i915/gen11: Wa_1408615072/Wa_1407596294 should be on GT list
	flow_offload: fill flags to action structure
	net/sched: act_ctinfo: use percpu stats
	i40e: Add checking for null for nlmsg_find_attr()
	net/sched: tcindex: search key must be 16 bits
	kvm: initialize all of the kvm_debugregs structure before sending it to userspace
	alarmtimer: Prevent starvation by small intervals and SIG_IGN
	ASoC: SOF: Intel: hda-dai: fix possible stream_tag leak
	net: sched: sch: Fix off by one in htb_activate_prios()
	nvmem: core: fix return value
	Linux 5.10.169

Change-Id: Id846e3a42e381eb9bc554ffb5ab1390343b72287
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-02-25 15:32:12 +00:00
Amit Engel ecf5b49df3 nvme-fc: fix a missing queue put in nvmet_fc_ls_create_association
[ Upstream commit 0cab440487 ]

As part of nvmet_fc_ls_create_association there is a case where
nvmet_fc_alloc_target_queue fails right after a new association with an
admin queue is created. In this case, no one releases the get taken in
nvmet_fc_alloc_target_assoc.  This fix is adding the missing put.

Signed-off-by: Amit Engel <Amit.Engel@dell.com>
Reviewed-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-02-22 12:55:53 +01:00
Greg Kroah-Hartman 4922049993 Merge 5.10.163 into android12-5.10-lts
Changes in 5.10.163
	usb: musb: remove extra check in musb_gadget_vbus_draw
	arm64: dts: qcom: ipq6018-cp01-c1: use BLSPI1 pins
	arm64: dts: qcom: msm8996: fix GPU OPP table
	ARM: dts: qcom: apq8064: fix coresight compatible
	arm64: dts: qcom: sdm630: fix UART1 pin bias
	arm64: dts: qcom: sdm845-cheza: fix AP suspend pin bias
	arm64: dts: qcom: msm8916: Drop MSS fallback compatible
	objtool, kcsan: Add volatile read/write instrumentation to whitelist
	ARM: dts: stm32: Drop stm32mp15xc.dtsi from Avenger96
	ARM: dts: stm32: Fix AV96 WLAN regulator gpio property
	drivers: soc: ti: knav_qmss_queue: Mark knav_acc_firmwares as static
	soc: qcom: llcc: make irq truly optional
	soc: qcom: apr: make code more reuseable
	soc: qcom: apr: Add check for idr_alloc and of_property_read_string_index
	arm: dts: spear600: Fix clcd interrupt
	soc: ti: knav_qmss_queue: Use pm_runtime_resume_and_get instead of pm_runtime_get_sync
	soc: ti: knav_qmss_queue: Fix PM disable depth imbalance in knav_queue_probe
	soc: ti: smartreflex: Fix PM disable depth imbalance in omap_sr_probe
	perf: arm_dsu: Fix hotplug callback leak in dsu_pmu_init()
	perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init()
	arm64: dts: ti: k3-am65-main: Drop dma-coherent in crypto node
	arm64: dts: ti: k3-j721e-main: Drop dma-coherent in crypto node
	arm64: dts: mt2712e: Fix unit_address_vs_reg warning for oscillators
	arm64: dts: mt2712e: Fix unit address for pinctrl node
	arm64: dts: mt2712-evb: Fix vproc fixed regulators unit names
	arm64: dts: mt2712-evb: Fix usb vbus regulators unit names
	arm64: dts: mediatek: pumpkin-common: Fix devicetree warnings
	arm64: dts: mediatek: mt6797: Fix 26M oscillator unit name
	ARM: dts: dove: Fix assigned-addresses for every PCIe Root Port
	ARM: dts: armada-370: Fix assigned-addresses for every PCIe Root Port
	ARM: dts: armada-xp: Fix assigned-addresses for every PCIe Root Port
	ARM: dts: armada-375: Fix assigned-addresses for every PCIe Root Port
	ARM: dts: armada-38x: Fix assigned-addresses for every PCIe Root Port
	ARM: dts: armada-39x: Fix assigned-addresses for every PCIe Root Port
	ARM: dts: turris-omnia: Add ethernet aliases
	ARM: dts: turris-omnia: Add switch port 6 node
	arm64: dts: armada-3720-turris-mox: Add missing interrupt for RTC
	pstore/ram: Fix error return code in ramoops_probe()
	ARM: mmp: fix timer_read delay
	pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP
	tpm/tpm_ftpm_tee: Fix error handling in ftpm_mod_init()
	tpm/tpm_crb: Fix error message in __crb_relinquish_locality()
	sched/fair: Cleanup task_util and capacity type
	sched/uclamp: Fix relationship between uclamp and migration margin
	cpuidle: dt: Return the correct numbers of parsed idle states
	alpha: fix syscall entry in !AUDUT_SYSCALL case
	PM: hibernate: Fix mistake in kerneldoc comment
	fs: don't audit the capability check in simple_xattr_list()
	cpufreq: qcom-hw: Fix memory leak in qcom_cpufreq_hw_read_lut()
	selftests/ftrace: event_triggers: wait longer for test_event_enable
	perf: Fix possible memleak in pmu_dev_alloc()
	lib/debugobjects: fix stat count and optimize debug_objects_mem_init
	platform/x86: huawei-wmi: fix return value calculation
	timerqueue: Use rb_entry_safe() in timerqueue_getnext()
	proc: fixup uptime selftest
	lib/fonts: fix undefined behavior in bit shift for get_default_font
	ocfs2: fix memory leak in ocfs2_stack_glue_init()
	MIPS: vpe-mt: fix possible memory leak while module exiting
	MIPS: vpe-cmp: fix possible memory leak while module exiting
	selftests/efivarfs: Add checking of the test return value
	PNP: fix name memory leak in pnp_alloc_dev()
	perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox()
	perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map()
	perf/x86/intel/uncore: Fix reference count leak in __uncore_imc_init_box()
	platform/chrome: cros_usbpd_notify: Fix error handling in cros_usbpd_notify_init()
	irqchip: gic-pm: Use pm_runtime_resume_and_get() in gic_probe()
	EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper()
	nfsd: don't call nfsd_file_put from client states seqfile display
	genirq/irqdesc: Don't try to remove non-existing sysfs files
	cpufreq: amd_freq_sensitivity: Add missing pci_dev_put()
	libfs: add DEFINE_SIMPLE_ATTRIBUTE_SIGNED for signed value
	lib/notifier-error-inject: fix error when writing -errno to debugfs file
	docs: fault-injection: fix non-working usage of negative values
	debugfs: fix error when writing negative value to atomic_t debugfs file
	ocfs2: ocfs2_mount_volume does cleanup job before return error
	ocfs2: rewrite error handling of ocfs2_fill_super
	ocfs2: fix memory leak in ocfs2_mount_volume()
	rapidio: fix possible name leaks when rio_add_device() fails
	rapidio: rio: fix possible name leak in rio_register_mport()
	clocksource/drivers/sh_cmt: Make sure channel clock supply is enabled
	clocksource/drivers/sh_cmt: Access registers according to spec
	futex: Move to kernel/futex/
	futex: Resend potentially swallowed owner death notification
	cpu/hotplug: Make target_store() a nop when target == state
	clocksource/drivers/timer-ti-dm: Fix missing clk_disable_unprepare in dmtimer_systimer_init_clock()
	ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()
	uprobes/x86: Allow to probe a NOP instruction with 0x66 prefix
	x86/xen: Fix memory leak in xen_smp_intr_init{_pv}()
	x86/xen: Fix memory leak in xen_init_lock_cpu()
	xen/privcmd: Fix a possible warning in privcmd_ioctl_mmap_resource()
	PM: runtime: Improve path in rpm_idle() when no callback
	PM: runtime: Do not call __rpm_callback() from rpm_idle()
	platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]()
	platform/x86: intel_scu_ipc: fix possible name leak in __intel_scu_ipc_register()
	MIPS: BCM63xx: Add check for NULL for clk in clk_enable
	MIPS: OCTEON: warn only once if deprecated link status is being used
	fs: sysv: Fix sysv_nblocks() returns wrong value
	rapidio: fix possible UAF when kfifo_alloc() fails
	eventfd: change int to __u64 in eventfd_signal() ifndef CONFIG_EVENTFD
	relay: fix type mismatch when allocating memory in relay_create_buf()
	hfs: Fix OOB Write in hfs_asc2mac
	rapidio: devices: fix missing put_device in mport_cdev_open
	wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs()
	wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
	wifi: rtl8xxxu: Fix reading the vendor of combo chips
	drm/bridge: adv7533: remove dynamic lane switching from adv7533 bridge
	libbpf: Fix use-after-free in btf_dump_name_dups
	libbpf: Fix null-pointer dereference in find_prog_by_sec_insn()
	pata_ipx4xx_cf: Fix unsigned comparison with less than zero
	media: coda: jpeg: Add check for kmalloc
	media: i2c: ad5820: Fix error path
	venus: pm_helpers: Fix error check in vcodec_domains_get()
	media: exynos4-is: Use v4l2_async_notifier_add_fwnode_remote_subdev
	media: exynos4-is: don't rely on the v4l2_async_subdev internals
	can: kvaser_usb: do not increase tx statistics when sending error message frames
	can: kvaser_usb: kvaser_usb_leaf: Get capabilities from device
	can: kvaser_usb: kvaser_usb_leaf: Rename {leaf,usbcan}_cmd_error_event to {leaf,usbcan}_cmd_can_error_event
	can: kvaser_usb: kvaser_usb_leaf: Handle CMD_ERROR_EVENT
	can: kvaser_usb_leaf: Set Warning state even without bus errors
	can: kvaser_usb_leaf: Fix improved state not being reported
	can: kvaser_usb_leaf: Fix wrong CAN state after stopping
	can: kvaser_usb_leaf: Fix bogus restart events
	can: kvaser_usb: Add struct kvaser_usb_busparams
	can: kvaser_usb: Compare requested bittiming parameters with actual parameters in do_set_{,data}_bittiming
	drm/rockchip: lvds: fix PM usage counter unbalance in poweron
	clk: renesas: r9a06g032: Repair grave increment error
	spi: Update reference to struct spi_controller
	drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure
	ima: Fix fall-through warnings for Clang
	ima: Handle -ESTALE returned by ima_filter_rule_match()
	drm/msm/hdmi: switch to drm_bridge_connector
	drm/msm/hdmi: drop unused GPIO support
	bpf: Fix slot type check in check_stack_write_var_off
	media: vivid: fix compose size exceed boundary
	media: platform: exynos4-is: fix return value check in fimc_md_probe()
	bpf: propagate precision in ALU/ALU64 operations
	bpf: Check the other end of slot_type for STACK_SPILL
	bpf: propagate precision across all frames, not just the last one
	clk: qcom: gcc-sm8250: Use retention mode for USB GDSCs
	mtd: Fix device name leak when register device failed in add_mtd_device()
	Input: joystick - fix Kconfig warning for JOYSTICK_ADC
	wifi: rsi: Fix handling of 802.3 EAPOL frames sent via control port
	media: camss: Clean up received buffers on failed start of streaming
	net, proc: Provide PROC_FS=n fallback for proc_create_net_single_write()
	rxrpc: Fix ack.bufferSize to be 0 when generating an ack
	drm/radeon: Add the missed acpi_put_table() to fix memory leak
	drm/mediatek: Modify dpi power on/off sequence.
	ASoC: pxa: fix null-pointer dereference in filter()
	regulator: core: fix unbalanced of node refcount in regulator_dev_lookup()
	amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table()
	drm/fourcc: Add packed 10bit YUV 4:2:0 format
	drm/fourcc: Fix vsub/hsub for Q410 and Q401
	integrity: Fix memory leakage in keyring allocation error path
	ima: Fix misuse of dereference of pointer in template_desc_init_fields()
	wifi: ath10k: Fix return value in ath10k_pci_init()
	mtd: lpddr2_nvm: Fix possible null-ptr-deref
	Input: elants_i2c - properly handle the reset GPIO when power is off
	media: vidtv: Fix use-after-free in vidtv_bridge_dvb_init()
	media: solo6x10: fix possible memory leak in solo_sysfs_init()
	media: platform: exynos4-is: Fix error handling in fimc_md_init()
	media: videobuf-dma-contig: use dma_mmap_coherent
	inet: add READ_ONCE(sk->sk_bound_dev_if) in inet_csk_bind_conflict()
	bpf: Move skb->len == 0 checks into __bpf_redirect
	HID: hid-sensor-custom: set fixed size for custom attributes
	ALSA: pcm: fix undefined behavior in bit shift for SNDRV_PCM_RATE_KNOT
	ALSA: seq: fix undefined behavior in bit shift for SNDRV_SEQ_FILTER_USE_EVENT
	regulator: core: use kfree_const() to free space conditionally
	clk: rockchip: Fix memory leak in rockchip_clk_register_pll()
	drm/amdgpu: fix pci device refcount leak
	bonding: fix link recovery in mode 2 when updelay is nonzero
	mtd: maps: pxa2xx-flash: fix memory leak in probe
	drbd: fix an invalid memory access caused by incorrect use of list iterator
	ASoC: qcom: Add checks for devm_kcalloc
	media: vimc: Fix wrong function called when vimc_init() fails
	media: imon: fix a race condition in send_packet()
	clk: imx: replace osc_hdmi with dummy
	pinctrl: pinconf-generic: add missing of_node_put()
	media: dvb-core: Fix ignored return value in dvb_register_frontend()
	media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()
	media: s5p-mfc: Add variant data for MFC v7 hardware for Exynos 3250 SoC
	drm/tegra: Add missing clk_disable_unprepare() in tegra_dc_probe()
	ASoC: dt-bindings: wcd9335: fix reset line polarity in example
	ASoC: mediatek: mtk-btcvsd: Add checks for write and read of mtk_btcvsd_snd
	NFSv4.2: Clear FATTR4_WORD2_SECURITY_LABEL when done decoding
	NFSv4.2: Fix a memory stomp in decode_attr_security_label
	NFSv4.2: Fix initialisation of struct nfs4_label
	NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn
	NFS: Fix an Oops in nfs_d_automount()
	ALSA: asihpi: fix missing pci_disable_device()
	wifi: iwlwifi: mvm: fix double free on tx path.
	ASoC: mediatek: mt8173: Fix debugfs registration for components
	ASoC: mediatek: mt8173: Enable IRQ when pdata is ready
	drm/amd/pm/smu11: BACO is supported when it's in BACO state
	drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios()
	drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios()
	ASoC: pcm512x: Fix PM disable depth imbalance in pcm512x_probe
	netfilter: conntrack: set icmpv6 redirects as RELATED
	bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data
	bpf, sockmap: Fix data loss caused by using apply_bytes on ingress redirect
	bonding: uninitialized variable in bond_miimon_inspect()
	spi: spidev: mask SPI_CS_HIGH in SPI_IOC_RD_MODE
	wifi: mac80211: fix memory leak in ieee80211_if_add()
	wifi: cfg80211: Fix not unregister reg_pdev when load_builtin_regdb_keys() fails
	wifi: mt76: fix coverity overrun-call in mt76_get_txpower()
	regulator: core: fix module refcount leak in set_supply()
	clk: qcom: clk-krait: fix wrong div2 functions
	hsr: Add a rcu-read lock to hsr_forward_skb().
	net: hsr: generate supervision frame without HSR/PRP tag
	hsr: Disable netpoll.
	hsr: Synchronize sending frames to have always incremented outgoing seq nr.
	hsr: Synchronize sequence number updates.
	configfs: fix possible memory leak in configfs_create_dir()
	regulator: core: fix resource leak in regulator_register()
	hwmon: (jc42) Convert register access and caching to regmap/regcache
	hwmon: (jc42) Restore the min/max/critical temperatures on resume
	bpf, sockmap: fix race in sock_map_free()
	ALSA: pcm: Set missing stop_operating flag at undoing trigger start
	media: saa7164: fix missing pci_disable_device()
	ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt
	xprtrdma: Fix regbuf data not freed in rpcrdma_req_create()
	SUNRPC: Fix missing release socket in rpc_sockname()
	NFSv4.x: Fail client initialisation if state manager thread can't run
	mmc: alcor: fix return value check of mmc_add_host()
	mmc: moxart: fix return value check of mmc_add_host()
	mmc: mxcmmc: fix return value check of mmc_add_host()
	mmc: pxamci: fix return value check of mmc_add_host()
	mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host()
	mmc: toshsd: fix return value check of mmc_add_host()
	mmc: vub300: fix return value check of mmc_add_host()
	mmc: wmt-sdmmc: fix return value check of mmc_add_host()
	mmc: atmel-mci: fix return value check of mmc_add_host()
	mmc: omap_hsmmc: fix return value check of mmc_add_host()
	mmc: meson-gx: fix return value check of mmc_add_host()
	mmc: via-sdmmc: fix return value check of mmc_add_host()
	mmc: wbsd: fix return value check of mmc_add_host()
	mmc: mmci: fix return value check of mmc_add_host()
	media: c8sectpfe: Add of_node_put() when breaking out of loop
	media: coda: Add check for dcoda_iram_alloc
	media: coda: Add check for kmalloc
	clk: samsung: Fix memory leak in _samsung_clk_register_pll()
	spi: spi-gpio: Don't set MOSI as an input if not 3WIRE mode
	wifi: rtl8xxxu: Add __packed to struct rtl8723bu_c2h
	wifi: rtl8xxxu: Fix the channel width reporting
	wifi: brcmfmac: Fix error return code in brcmf_sdio_download_firmware()
	blktrace: Fix output non-blktrace event when blk_classic option enabled
	clk: socfpga: clk-pll: Remove unused variable 'rc'
	clk: socfpga: use clk_hw_register for a5/c5
	clk: socfpga: Fix memory leak in socfpga_gate_init()
	net: vmw_vsock: vmci: Check memcpy_from_msg()
	net: defxx: Fix missing err handling in dfx_init()
	net: stmmac: selftests: fix potential memleak in stmmac_test_arpoffload()
	drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init()
	of: overlay: fix null pointer dereferencing in find_dup_cset_node_entry() and find_dup_cset_prop()
	ethernet: s2io: don't call dev_kfree_skb() under spin_lock_irqsave()
	net: farsync: Fix kmemleak when rmmods farsync
	net/tunnel: wait until all sk_user_data reader finish before releasing the sock
	net: apple: mace: don't call dev_kfree_skb() under spin_lock_irqsave()
	net: apple: bmac: don't call dev_kfree_skb() under spin_lock_irqsave()
	net: emaclite: don't call dev_kfree_skb() under spin_lock_irqsave()
	net: ethernet: dnet: don't call dev_kfree_skb() under spin_lock_irqsave()
	hamradio: don't call dev_kfree_skb() under spin_lock_irqsave()
	net: amd: lance: don't call dev_kfree_skb() under spin_lock_irqsave()
	net: amd-xgbe: Fix logic around active and passive cables
	net: amd-xgbe: Check only the minimum speed for active/passive cables
	can: tcan4x5x: Remove invalid write in clear_interrupts
	net: lan9303: Fix read error execution path
	ntb_netdev: Use dev_kfree_skb_any() in interrupt context
	sctp: sysctl: make extra pointers netns aware
	Bluetooth: btusb: don't call kfree_skb() under spin_lock_irqsave()
	Bluetooth: hci_qca: don't call kfree_skb() under spin_lock_irqsave()
	Bluetooth: hci_ll: don't call kfree_skb() under spin_lock_irqsave()
	Bluetooth: hci_h5: don't call kfree_skb() under spin_lock_irqsave()
	Bluetooth: hci_bcsp: don't call kfree_skb() under spin_lock_irqsave()
	Bluetooth: hci_core: don't call kfree_skb() under spin_lock_irqsave()
	Bluetooth: RFCOMM: don't call kfree_skb() under spin_lock_irqsave()
	stmmac: fix potential division by 0
	apparmor: fix a memleak in multi_transaction_new()
	apparmor: fix lockdep warning when removing a namespace
	apparmor: Fix abi check to include v8 abi
	crypto: sun8i-ss - use dma_addr instead u32
	crypto: nitrox - avoid double free on error path in nitrox_sriov_init()
	scsi: core: Fix a race between scsi_done() and scsi_timeout()
	apparmor: Use pointer to struct aa_label for lbs_cred
	PCI: dwc: Fix n_fts[] array overrun
	RDMA/core: Fix order of nldev_exit call
	PCI: pci-epf-test: Register notifier if only core_init_notifier is enabled
	f2fs: Fix the race condition of resize flag between resizefs
	crypto: rockchip - do not do custom power management
	crypto: rockchip - do not store mode globally
	crypto: rockchip - add fallback for cipher
	crypto: rockchip - add fallback for ahash
	crypto: rockchip - better handle cipher key
	crypto: rockchip - remove non-aligned handling
	crypto: rockchip - delete unneeded variable initialization
	crypto: rockchip - rework by using crypto_engine
	apparmor: Fix memleak in alloc_ns()
	f2fs: fix normal discard process
	RDMA/siw: Fix immediate work request flush to completion queue
	RDMA/nldev: Return "-EAGAIN" if the cm_id isn't from expected port
	RDMA/siw: Set defined status for work completion with undefined status
	scsi: scsi_debug: Fix a warning in resp_write_scat()
	crypto: ccree - Remove debugfs when platform_driver_register failed
	crypto: cryptd - Use request context instead of stack for sub-request
	crypto: hisilicon/qm - add missing pci_dev_put() in q_num_set()
	RDMA/hns: Repacing 'dseg_len' by macros in fill_ext_sge_inl_data()
	RDMA/hns: Fix ext_sge num error when post send
	PCI: Check for alloc failure in pci_request_irq()
	RDMA/hfi: Decrease PCI device reference count in error path
	crypto: ccree - Make cc_debugfs_global_fini() available for module init function
	RDMA/hns: fix memory leak in hns_roce_alloc_mr()
	RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed
	scsi: hpsa: Fix possible memory leak in hpsa_init_one()
	crypto: tcrypt - Fix multibuffer skcipher speed test mem leak
	padata: Always leave BHs disabled when running ->parallel()
	padata: Fix list iterator in padata_do_serial()
	scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()
	scsi: hpsa: Fix error handling in hpsa_add_sas_host()
	scsi: hpsa: Fix possible memory leak in hpsa_add_sas_device()
	scsi: scsi_debug: Fix a warning in resp_verify()
	scsi: scsi_debug: Fix a warning in resp_report_zones()
	scsi: fcoe: Fix possible name leak when device_register() fails
	scsi: scsi_debug: Fix possible name leak in sdebug_add_host_helper()
	scsi: ipr: Fix WARNING in ipr_init()
	scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails
	scsi: snic: Fix possible UAF in snic_tgt_create()
	RDMA/nldev: Add checks for nla_nest_start() in fill_stat_counter_qps()
	f2fs: avoid victim selection from previous victim section
	RDMA/nldev: Fix failure to send large messages
	crypto: amlogic - Remove kcalloc without check
	crypto: omap-sham - Use pm_runtime_resume_and_get() in omap_sham_probe()
	riscv/mm: add arch hook arch_clear_hugepage_flags
	RDMA/hfi1: Fix error return code in parse_platform_config()
	RDMA/srp: Fix error return code in srp_parse_options()
	orangefs: Fix sysfs not cleanup when dev init failed
	RDMA/hns: Fix PBL page MTR find
	RDMA/hns: Fix page size cap from firmware
	crypto: img-hash - Fix variable dereferenced before check 'hdev->req'
	hwrng: amd - Fix PCI device refcount leak
	hwrng: geode - Fix PCI device refcount leak
	IB/IPoIB: Fix queue count inconsistency for PKEY child interfaces
	drivers: dio: fix possible memory leak in dio_init()
	serial: tegra: Read DMA status before terminating
	class: fix possible memory leak in __class_register()
	vfio: platform: Do not pass return buffer to ACPI _RST method
	uio: uio_dmem_genirq: Fix missing unlock in irq configuration
	uio: uio_dmem_genirq: Fix deadlock between irq config and handling
	usb: fotg210-udc: Fix ages old endianness issues
	staging: vme_user: Fix possible UAF in tsi148_dma_list_add
	usb: typec: Check for ops->exit instead of ops->enter in altmode_exit
	usb: typec: tcpci: fix of node refcount leak in tcpci_register_port()
	usb: typec: tipd: Fix spurious fwnode_handle_put in error path
	serial: amba-pl011: avoid SBSA UART accessing DMACR register
	serial: pl011: Do not clear RX FIFO & RX interrupt in unthrottle.
	serial: pch: Fix PCI device refcount leak in pch_request_dma()
	tty: serial: clean up stop-tx part in altera_uart_tx_chars()
	tty: serial: altera_uart_{r,t}x_chars() need only uart_port
	serial: altera_uart: fix locking in polling mode
	serial: sunsab: Fix error handling in sunsab_init()
	test_firmware: fix memory leak in test_firmware_init()
	misc: ocxl: fix possible name leak in ocxl_file_register_afu()
	ocxl: fix pci device refcount leak when calling get_function_0()
	misc: tifm: fix possible memory leak in tifm_7xx1_switch_media()
	misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os
	firmware: raspberrypi: fix possible memory leak in rpi_firmware_probe()
	cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter()
	cxl: fix possible null-ptr-deref in cxl_pci_init_afu|adapter()
	iio: temperature: ltc2983: make bulk write buffer DMA-safe
	genirq: Add IRQF_NO_AUTOEN for request_irq/nmi()
	iio:imu:adis: Use IRQF_NO_AUTOEN instead of irq request then disable
	iio: adis: handle devices that cannot unmask the drdy pin
	iio: adis: stylistic changes
	iio:imu:adis: Move exports into IIO_ADISLIB namespace
	iio: adis: add '__adis_enable_irq()' implementation
	counter: stm32-lptimer-cnt: fix the check on arr and cmp registers update
	usb: roles: fix of node refcount leak in usb_role_switch_is_parent()
	usb: gadget: f_hid: optional SETUP/SET_REPORT mode
	usb: gadget: f_hid: fix f_hidg lifetime vs cdev
	usb: gadget: f_hid: fix refcount leak on error path
	drivers: mcb: fix resource leak in mcb_probe()
	mcb: mcb-parse: fix error handing in chameleon_parse_gdd()
	chardev: fix error handling in cdev_device_add()
	i2c: pxa-pci: fix missing pci_disable_device() on error in ce4100_i2c_probe
	staging: rtl8192u: Fix use after free in ieee80211_rx()
	staging: rtl8192e: Fix potential use-after-free in rtllib_rx_Monitor()
	vme: Fix error not catched in fake_init()
	gpiolib: Get rid of redundant 'else'
	gpiolib: cdev: fix NULL-pointer dereferences
	i2c: mux: reg: check return value after calling platform_get_resource()
	i2c: ismt: Fix an out-of-bounds bug in ismt_access()
	usb: storage: Add check for kcalloc
	tracing/hist: Fix issue of losting command info in error_log
	samples: vfio-mdev: Fix missing pci_disable_device() in mdpy_fb_probe()
	thermal/drivers/imx8mm_thermal: Validate temperature range
	fbdev: ssd1307fb: Drop optional dependency
	fbdev: pm2fb: fix missing pci_disable_device()
	fbdev: via: Fix error in via_core_init()
	fbdev: vermilion: decrease reference count in error path
	fbdev: uvesafb: Fixes an error handling path in uvesafb_probe()
	HSI: omap_ssi_core: fix unbalanced pm_runtime_disable()
	HSI: omap_ssi_core: fix possible memory leak in ssi_probe()
	power: supply: fix residue sysfs file in error handle route of __power_supply_register()
	perf trace: Return error if a system call doesn't exist
	perf trace: Use macro RAW_SYSCALL_ARGS_NUM to replace number
	perf trace: Handle failure when trace point folder is missed
	perf symbol: correction while adjusting symbol
	HSI: omap_ssi_core: Fix error handling in ssi_init()
	power: supply: fix null pointer dereferencing in power_supply_get_battery_info
	RDMA/siw: Fix pointer cast warning
	iommu/sun50i: Fix reset release
	iommu/sun50i: Consider all fault sources for reset
	iommu/sun50i: Fix R/W permission check
	iommu/sun50i: Fix flush size
	phy: usb: s2 WoL wakeup_count not incremented for USB->Eth devices
	include/uapi/linux/swab: Fix potentially missing __always_inline
	pwm: tegra: Improve required rate calculation
	dmaengine: idxd: Fix crc_val field for completion record
	rtc: rtc-cmos: Do not check ACPI_FADT_LOW_POWER_S0
	rtc: cmos: Fix event handler registration ordering issue
	rtc: cmos: Fix wake alarm breakage
	rtc: cmos: fix build on non-ACPI platforms
	rtc: cmos: Call cmos_wake_setup() from cmos_do_probe()
	rtc: cmos: Call rtc_wake_setup() from cmos_do_probe()
	rtc: cmos: Eliminate forward declarations of some functions
	rtc: cmos: Rename ACPI-related functions
	rtc: cmos: Disable ACPI RTC event on removal
	rtc: snvs: Allow a time difference on clock register read
	rtc: pcf85063: Fix reading alarm
	iommu/amd: Fix pci device refcount leak in ppr_notifier()
	iommu/fsl_pamu: Fix resource leak in fsl_pamu_probe()
	macintosh: fix possible memory leak in macio_add_one_device()
	macintosh/macio-adb: check the return value of ioremap()
	powerpc/52xx: Fix a resource leak in an error handling path
	cxl: Fix refcount leak in cxl_calc_capp_routing
	powerpc/xmon: Enable breakpoints on 8xx
	powerpc/xmon: Fix -Wswitch-unreachable warning in bpt_cmds
	powerpc/xive: add missing iounmap() in error path in xive_spapr_populate_irq_data()
	kbuild: remove unneeded mkdir for external modules_install
	kbuild: unify modules(_install) for in-tree and external modules
	kbuild: refactor single builds of *.ko
	powerpc/perf: callchain validate kernel stack pointer bounds
	powerpc/83xx/mpc832x_rdb: call platform_device_put() in error case in of_fsl_spi_probe()
	powerpc/hv-gpci: Fix hv_gpci event list
	selftests/powerpc: Fix resource leaks
	iommu/sun50i: Remove IOMMU_DOMAIN_IDENTITY
	pwm: sifive: Call pwm_sifive_update_clock() while mutex is held
	remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev()
	remoteproc: qcom_q6v5_pas: disable wakeup on probe fail or remove
	remoteproc: qcom_q6v5_pas: detach power domains on remove
	remoteproc: qcom_q6v5_pas: Fix missing of_node_put() in adsp_alloc_memory_region()
	powerpc/eeh: Drop redundant spinlock initialization
	powerpc/pseries/eeh: use correct API for error log size
	netfilter: flowtable: really fix NAT IPv6 offload
	rtc: st-lpc: Add missing clk_disable_unprepare in st_rtc_probe()
	rtc: pic32: Move devm_rtc_allocate_device earlier in pic32_rtc_probe()
	rtc: pcf85063: fix pcf85063_clkout_control
	NFSD: Remove spurious cb_setup_err tracepoint
	nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure
	net: macsec: fix net device access prior to holding a lock
	mISDN: hfcsusb: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
	mISDN: hfcpci: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
	mISDN: hfcmulti: don't call dev_kfree_skb/kfree_skb() under spin_lock_irqsave()
	nfc: pn533: Clear nfc_target before being used
	r6040: Fix kmemleak in probe and remove
	net: switch to storing KCOV handle directly in sk_buff
	net: add inline function skb_csum_is_sctp
	net: igc: use skb_csum_is_sctp instead of protocol check
	net: add a helper to avoid issues with HW TX timestamping and SO_TXTIME
	igc: Enhance Qbv scheduling by using first flag bit
	igc: Use strict cycles for Qbv scheduling
	igc: Add checking for basetime less than zero
	igc: recalculate Qbv end_time by considering cycle time
	igc: Lift TAPRIO schedule restriction
	igc: Set Qbv start_time and end_time to end_time if not being configured in GCL
	rtc: mxc_v2: Add missing clk_disable_unprepare()
	selftests: devlink: fix the fd redirect in dummy_reporter_test
	openvswitch: Fix flow lookup to use unmasked key
	skbuff: Account for tail adjustment during pull operations
	mailbox: zynq-ipi: fix error handling while device_register() fails
	net_sched: reject TCF_EM_SIMPLE case for complex ematch module
	rxrpc: Fix missing unlock in rxrpc_do_sendmsg()
	myri10ge: Fix an error handling path in myri10ge_probe()
	net: stream: purge sk_error_queue in sk_stream_kill_queues()
	rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state()
	arm64: make is_ttbrX_addr() noinstr-safe
	video: hyperv_fb: Avoid taking busy spinlock on panic path
	x86/hyperv: Remove unregister syscore call from Hyper-V cleanup
	binfmt_misc: fix shift-out-of-bounds in check_special_flags
	fs: jfs: fix shift-out-of-bounds in dbAllocAG
	udf: Avoid double brelse() in udf_rename()
	fs: jfs: fix shift-out-of-bounds in dbDiscardAG
	ACPICA: Fix error code path in acpi_ds_call_control_method()
	nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset()
	nilfs2: fix shift-out-of-bounds due to too large exponent of block size
	acct: fix potential integer overflow in encode_comp_t()
	hfs: fix OOB Read in __hfs_brec_find
	drm/etnaviv: add missing quirks for GC300
	brcmfmac: return error when getting invalid max_flowrings from dongle
	wifi: ath9k: verify the expected usb_endpoints are present
	wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out
	ASoC: codecs: rt298: Add quirk for KBL-R RVP platform
	ipmi: fix memleak when unload ipmi driver
	drm/amd/display: prevent memory leak
	qed (gcc13): use u16 for fid to be big enough
	bpf: make sure skb->len != 0 when redirecting to a tunneling device
	net: ethernet: ti: Fix return type of netcp_ndo_start_xmit()
	hamradio: baycom_epp: Fix return type of baycom_send_packet()
	wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request()
	igb: Do not free q_vector unless new one was allocated
	drm/amdgpu: Fix type of second parameter in trans_msg() callback
	drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback
	s390/ctcm: Fix return type of ctc{mp,}m_tx()
	s390/netiucv: Fix return type of netiucv_tx()
	s390/lcs: Fix return type of lcs_start_xmit()
	drm/msm: Use drm_mode_copy()
	drm/rockchip: Use drm_mode_copy()
	drm/sti: Use drm_mode_copy()
	drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()
	md/raid1: stop mdx_raid1 thread when raid1 array run failed
	drm/amd/display: fix array index out of bound error in bios parser
	net: add atomic_long_t to net_device_stats fields
	mrp: introduce active flags to prevent UAF when applicant uninit
	ppp: associate skb with a device at tx
	bpf: Prevent decl_tag from being referenced in func_proto arg
	ethtool: avoiding integer overflow in ethtool_phys_id()
	media: dvb-frontends: fix leak of memory fw
	media: dvbdev: adopts refcnt to avoid UAF
	media: dvb-usb: fix memory leak in dvb_usb_adapter_init()
	blk-mq: fix possible memleak when register 'hctx' failed
	libbpf: Avoid enum forward-declarations in public API in C++ mode
	regulator: core: fix use_count leakage when handling boot-on
	mmc: f-sdh30: Add quirks for broken timeout clock capability
	mmc: renesas_sdhi: better reset from HS400 mode
	media: si470x: Fix use-after-free in si470x_int_in_callback()
	clk: st: Fix memory leak in st_of_quadfs_setup()
	hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param()
	drm/fsl-dcu: Fix return type of fsl_dcu_drm_connector_mode_valid()
	drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid()
	orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string()
	orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init()
	hwmon: (jc42) Fix missing unlock on error in jc42_write()
	ALSA/ASoC: hda: move/rename snd_hdac_ext_stop_streams to hdac_stream.c
	ALSA: hda: add snd_hdac_stop_streams() helper
	ASoC: Intel: Skylake: Fix driver hang during shutdown
	ASoC: mediatek: mt8173-rt5650-rt5514: fix refcount leak in mt8173_rt5650_rt5514_dev_probe()
	ASoC: audio-graph-card: fix refcount leak of cpu_ep in __graph_for_each_link()
	ASoC: rockchip: pdm: Add missing clk_disable_unprepare() in rockchip_pdm_runtime_resume()
	ASoC: wm8994: Fix potential deadlock
	ASoC: rockchip: spdif: Add missing clk_disable_unprepare() in rk_spdif_runtime_resume()
	ASoC: rt5670: Remove unbalanced pm_runtime_put()
	LoadPin: Ignore the "contents" argument of the LSM hooks
	pstore: Switch pmsg_lock to an rt_mutex to avoid priority inversion
	perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option()
	afs: Fix lost servers_outstanding count
	pstore: Make sure CONFIG_PSTORE_PMSG selects CONFIG_RT_MUTEXES
	ima: Simplify ima_lsm_copy_rule
	ALSA: usb-audio: add the quirk for KT0206 device
	ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB
	ALSA: hda/hdmi: Add HP Device 0x8711 to force connect list
	usb: dwc3: Fix race between dwc3_set_mode and __dwc3_set_mode
	usb: dwc3: core: defer probe on ulpi_read_id timeout
	HID: wacom: Ensure bootloader PID is usable in hidraw mode
	HID: mcp2221: don't connect hidraw
	reiserfs: Add missing calls to reiserfs_security_free()
	iio: adc: ad_sigma_delta: do not use internal iio_dev lock
	iio: adc128s052: add proper .data members in adc128_of_match table
	regulator: core: fix deadlock on regulator enable
	gcov: add support for checksum field
	ovl: fix use inode directly in rcu-walk mode
	media: dvbdev: fix build warning due to comments
	media: dvbdev: fix refcnt bug
	pwm: tegra: Fix 32 bit build
	usb: dwc3: qcom: Fix memory leak in dwc3_qcom_interconnect_init
	cifs: fix oops during encryption
	nvme-pci: fix doorbell buffer value endianness
	nvme-pci: fix mempool alloc size
	nvme-pci: fix page size checks
	ata: ahci: Fix PCS quirk application for suspend
	nvme: fix the NVME_CMD_EFFECTS_CSE_MASK definition
	nvmet: don't defer passthrough commands with trivial effects to the workqueue
	objtool: Fix SEGFAULT
	powerpc/rtas: avoid device tree lookups in rtas_os_term()
	powerpc/rtas: avoid scheduling in rtas_os_term()
	HID: multitouch: fix Asus ExpertBook P2 P2451FA trackpoint
	HID: plantronics: Additional PIDs for double volume key presses quirk
	pstore/zone: Use GFP_ATOMIC to allocate zone buffer
	hfsplus: fix bug causing custom uid and gid being unable to be assigned with mount
	binfmt: Fix error return code in load_elf_fdpic_binary()
	ovl: Use ovl mounter's fsuid and fsgid in ovl_link()
	ALSA: line6: correct midi status byte when receiving data from podxt
	ALSA: line6: fix stack overflow in line6_midi_transmit
	pnode: terminate at peers of source
	md: fix a crash in mempool_free
	mm, compaction: fix fast_isolate_around() to stay within boundaries
	f2fs: should put a page when checking the summary info
	mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING
	tpm: acpi: Call acpi_put_table() to fix memory leak
	tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak
	tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak
	SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails
	kcsan: Instrument memcpy/memset/memmove with newer Clang
	ASoC: Intel/SOF: use set_stream() instead of set_tdm_slots() for HDAudio
	ASoC/SoundWire: dai: expand 'stream' concept beyond SoundWire
	net/mlx5e: Fix nullptr in mlx5e_tc_add_fdb_flow()
	wifi: rtlwifi: remove always-true condition pointed out by GCC 12
	wifi: rtlwifi: 8192de: correct checking of IQK reload
	torture: Exclude "NOHZ tick-stop error" from fatal errors
	rcu: Prevent lockdep-RCU splats on lock acquisition/release
	net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO
	net/af_packet: make sure to pull mac header
	media: stv0288: use explicitly signed char
	soc: qcom: Select REMAP_MMIO for LLCC driver
	kest.pl: Fix grub2 menu handling for rebooting
	ktest.pl minconfig: Unset configs instead of just removing them
	jbd2: use the correct print format
	arm64: dts: qcom: sdm845-db845c: correct SPI2 pins drive strength
	mmc: sdhci-sprd: Disable CLK_AUTO when the clock is less than 400K
	btrfs: fix resolving backrefs for inline extent followed by prealloc
	ARM: ux500: do not directly dereference __iomem
	arm64: dts: qcom: sdm850-lenovo-yoga-c630: correct I2C12 pins drive strength
	selftests: Use optional USERCFLAGS and USERLDFLAGS
	PM/devfreq: governor: Add a private governor_data for governor
	cpufreq: Init completion before kobject_init_and_add()
	ALSA: patch_realtek: Fix Dell Inspiron Plus 16
	ALSA: hda/realtek: Apply dual codec fixup for Dell Latitude laptops
	dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort
	dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata
	dm thin: Use last transaction's pmd->root when commit failed
	dm thin: resume even if in FAIL mode
	dm thin: Fix UAF in run_timer_softirq()
	dm integrity: Fix UAF in dm_integrity_dtr()
	dm clone: Fix UAF in clone_dtr()
	dm cache: Fix UAF in destroy()
	dm cache: set needs_check flag after aborting metadata
	tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx'
	perf/core: Call LSM hook after copying perf_event_attr
	KVM: nVMX: Inject #GP, not #UD, if "generic" VMXON CR0/CR4 check fails
	x86/microcode/intel: Do not retry microcode reloading on the APs
	ftrace/x86: Add back ftrace_expected for ftrace bug reports
	x86/kprobes: Fix kprobes instruction boudary check with CONFIG_RETHUNK
	tracing/hist: Fix wrong return value in parse_action_params()
	tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line
	staging: media: tegra-video: fix chan->mipi value on error
	ARM: 9256/1: NWFPE: avoid compiler-generated __aeabi_uldivmod
	media: dvb-core: Fix double free in dvb_register_device()
	media: dvb-core: Fix UAF due to refcount races at releasing
	cifs: fix confusing debug message
	cifs: fix missing display of three mount options
	rtc: ds1347: fix value written to century register
	md/bitmap: Fix bitmap chunk size overflow issues
	efi: Add iMac Pro 2017 to uefi skip cert quirk
	wifi: wilc1000: sdio: fix module autoloading
	ASoC: jz4740-i2s: Handle independent FIFO flush bits
	ipmi: fix long wait in unload when IPMI disconnect
	mtd: spi-nor: Check for zero erase size in spi_nor_find_best_erase_type()
	ima: Fix a potential NULL pointer access in ima_restore_measurement_list
	ipmi: fix use after free in _ipmi_destroy_user()
	PCI: Fix pci_device_is_present() for VFs by checking PF
	PCI/sysfs: Fix double free in error path
	crypto: n2 - add missing hash statesize
	driver core: Fix bus_type.match() error handling in __driver_attach()
	iommu/amd: Fix ivrs_acpihid cmdline parsing code
	remoteproc: core: Do pm_relax when in RPROC_OFFLINE state
	parisc: led: Fix potential null-ptr-deref in start_task()
	device_cgroup: Roll back to original exceptions after copy failure
	drm/connector: send hotplug uevent on connector cleanup
	drm/vmwgfx: Validate the box size for the snooped cursor
	drm/i915/dsi: fix VBT send packet port selection for dual link DSI
	drm/ingenic: Fix missing platform_driver_unregister() call in ingenic_drm_init()
	ext4: silence the warning when evicting inode with dioread_nolock
	ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop
	ext4: fix use-after-free in ext4_orphan_cleanup
	ext4: fix undefined behavior in bit shift for ext4_check_flag_values
	ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode
	ext4: add helper to check quota inums
	ext4: fix bug_on in __es_tree_search caused by bad quota inode
	ext4: fix reserved cluster accounting in __es_remove_extent()
	ext4: check and assert if marking an no_delete evicting inode dirty
	ext4: fix bug_on in __es_tree_search caused by bad boot loader inode
	ext4: init quota for 'old.inode' in 'ext4_rename'
	ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline
	ext4: fix corruption when online resizing a 1K bigalloc fs
	ext4: fix error code return to user-space in ext4_get_branch()
	ext4: avoid BUG_ON when creating xattrs
	ext4: fix inode leak in ext4_xattr_inode_create() on an error path
	ext4: initialize quota before expanding inode in setproject ioctl
	ext4: avoid unaccounted block allocation when expanding inode
	ext4: allocate extended attribute value in vmalloc area
	drm/amdgpu: handle polaris10/11 overlap asics (v2)
	drm/amdgpu: make display pinning more flexible (v2)
	ARM: renumber bits related to _TIF_WORK_MASK
	perf/x86/intel/uncore: Generalize I/O stacks to PMON mapping procedure
	perf/x86/intel/uncore: Clear attr_update properly
	btrfs: replace strncpy() with strscpy()
	x86/mce: Get rid of msr_ops
	x86/MCE/AMD: Clear DFR errors found in THR handler
	media: s5p-mfc: Fix to handle reference queue during finishing
	media: s5p-mfc: Clear workbit to handle error condition
	media: s5p-mfc: Fix in register read and write for H264
	perf probe: Use dwarf_attr_integrate as generic DWARF attr accessor
	perf probe: Fix to get the DW_AT_decl_file and DW_AT_call_file as unsinged data
	x86/kprobes: Convert to insn_decode()
	x86/kprobes: Fix optprobe optimization check with CONFIG_RETHUNK
	staging: media: tegra-video: fix device_node use after free
	ravb: Fix "failed to switch device to config mode" message during unbind
	riscv/stacktrace: Fix stack output without ra on the stack top
	riscv: stacktrace: Fixup ftrace_graph_ret_addr retp argument
	ext4: goto right label 'failed_mount3a'
	ext4: correct inconsistent error msg in nojournal mode
	mm/highmem: Lift memcpy_[to|from]_page to core
	ext4: use memcpy_to_page() in pagecache_write()
	fs: ext4: initialize fsdata in pagecache_write()
	ext4: move functions in super.c
	ext4: simplify ext4 error translation
	ext4: fix various seppling typos
	ext4: fix leaking uninitialized memory in fast-commit journal
	ext4: use kmemdup() to replace kmalloc + memcpy
	mbcache: don't reclaim used entries
	mbcache: add functions to delete entry if unused
	ext4: remove EA inode entry from mbcache on inode eviction
	ext4: unindent codeblock in ext4_xattr_block_set()
	ext4: fix race when reusing xattr blocks
	mbcache: automatically delete entries from cache on freeing
	ext4: fix deadlock due to mbcache entry corruption
	SUNRPC: ensure the matching upcall is in-flight upon downcall
	bpf: pull before calling skb_postpull_rcsum()
	drm/panfrost: Fix GEM handle creation ref-counting
	vmxnet3: correctly report csum_level for encapsulated packet
	veth: Fix race with AF_XDP exposing old or uninitialized descriptors
	nfsd: shut down the NFSv4 state objects before the filecache
	net: hns3: add interrupts re-initialization while doing VF FLR
	net: sched: fix memory leak in tcindex_set_parms
	qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure
	nfc: Fix potential resource leaks
	vhost/vsock: Fix error handling in vhost_vsock_init()
	vringh: fix range used in iotlb_translate()
	vhost: fix range used in translate_desc()
	net/mlx5: Add forgotten cleanup calls into mlx5_init_once() error path
	net/mlx5: Avoid recovery in probe flows
	net/mlx5e: IPoIB, Don't allow CQE compression to be turned on by default
	net/mlx5e: Fix hw mtu initializing at XDP SQ allocation
	net: amd-xgbe: add missed tasklet_kill
	net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe
	RDMA/mlx5: Fix validation of max_rd_atomic caps for DC
	drm/meson: Reduce the FIFO lines held when AFBC is not used
	filelock: new helper: vfs_inode_has_locks
	ceph: switch to vfs_inode_has_locks() to fix file lock bug
	gpio: sifive: Fix refcount leak in sifive_gpio_probe
	net: sched: atm: dont intepret cls results when asked to drop
	net: sched: cbq: dont intepret cls results when asked to drop
	netfilter: ipset: fix hash:net,port,net hang with /0 subnet
	netfilter: ipset: Rework long task execution when adding/deleting entries
	perf tools: Fix resources leak in perf_data__open_dir()
	drivers/net/bonding/bond_3ad: return when there's no aggregator
	usb: rndis_host: Secure rndis_query check against int overflow
	drm/i915: unpin on error in intel_vgpu_shadow_mm_pin()
	caif: fix memory leak in cfctrl_linkup_request()
	udf: Fix extension of the last extent in the file
	ASoC: Intel: bytcr_rt5640: Add quirk for the Advantech MICA-071 tablet
	nvme: fix multipath crash caused by flush request when blktrace is enabled
	x86/bugs: Flush IBP in ib_prctl_set()
	nfsd: fix handling of readdir in v4root vs. mount upcall timeout
	fbdev: matroxfb: G200eW: Increase max memory from 1 MB to 16 MB
	riscv: uaccess: fix type of 0 variable on error in get_user()
	drm/i915/gvt: fix gvt debugfs destroy
	drm/i915/gvt: fix vgpu debugfs clean in remove
	ext4: don't allow journal inode to have encrypt flag
	selftests: set the BUILD variable to absolute path
	hfs/hfsplus: use WARN_ON for sanity check
	hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling
	mbcache: Avoid nesting of cache->c_list_lock under bit locks
	efi: random: combine bootloader provided RNG seed with RNG protocol output
	io_uring: Fix unsigned 'res' comparison with zero in io_fixup_rw_res()
	parisc: Align parisc MADV_XXX constants with all other architectures
	ext4: disable fast-commit of encrypted dir operations
	ext4: don't set up encryption key during jbd2 transaction
	fsl_lpuart: Don't enable interrupts too early
	serial: fixup backport of "serial: Deassert Transmit Enable on probe in driver-specific way"
	mptcp: mark ops structures as ro_after_init
	mptcp: remove MPTCP 'ifdef' in TCP SYN cookies
	mptcp: dedicated request sock for subflow in v6
	mptcp: use proper req destructor for IPv6
	net: sched: disallow noqueue for qdisc classes
	net/ulp: prevent ULP without clone op from entering the LISTEN status
	ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
	ALSA: hda/hdmi: Add a HP device 0x8715 to force connect list
	ALSA: hda - Enable headset mic on another Dell laptop with ALC3254
	Linux 5.10.163

Change-Id: I9026971760be8484f1e1fa607f9f91243cc87785
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-02-06 12:30:05 +00:00
Christoph Hellwig 57ae492f62 nvmet: don't defer passthrough commands with trivial effects to the workqueue
[ Upstream commit 2a459f6933 ]

Mask out the "Command Supported" and "Logical Block Content Change" bits
and only defer execution of commands that have non-trivial effects to
the workqueue for synchronous execution.  This allows to execute admin
commands asynchronously on controllers that provide a Command Supported
and Effects log page, and will keep allowing to execute Write commands
asynchronously once command effects on I/O commands are taken into
account.

Fixes: c1fef73f79 ("nvmet: add passthru code to process commands")
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Keith Busch <kbusch@kernel.org>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Kanchan Joshi <joshi.k@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-01-14 10:16:25 +01:00
Greg Kroah-Hartman 0b500f5b16 Merge 5.10.150 into android12-5.10-lts
Changes in 5.10.150
	ALSA: oss: Fix potential deadlock at unregistration
	ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free()
	ALSA: usb-audio: Fix potential memory leaks
	ALSA: usb-audio: Fix NULL dererence at error path
	ALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530
	ALSA: hda/realtek: Correct pin configs for ASUS G533Z
	ALSA: hda/realtek: Add quirk for ASUS GV601R laptop
	ALSA: hda/realtek: Add Intel Reference SSID to support headset keys
	mtd: rawnand: atmel: Unmap streaming DMA mappings
	cifs: destage dirty pages before re-reading them for cache=none
	cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message
	iio: dac: ad5593r: Fix i2c read protocol requirements
	iio: ltc2497: Fix reading conversion results
	iio: adc: ad7923: fix channel readings for some variants
	iio: pressure: dps310: Refactor startup procedure
	iio: pressure: dps310: Reset chip after timeout
	usb: add quirks for Lenovo OneLink+ Dock
	can: kvaser_usb: Fix use of uninitialized completion
	can: kvaser_usb_leaf: Fix overread with an invalid command
	can: kvaser_usb_leaf: Fix TX queue out of sync after restart
	can: kvaser_usb_leaf: Fix CAN state after restart
	mmc: sdhci-sprd: Fix minimum clock limit
	fs: dlm: fix race between test_bit() and queue_work()
	fs: dlm: handle -EBUSY first in lock arg validation
	HID: multitouch: Add memory barriers
	quota: Check next/prev free block number after reading from quota file
	platform/chrome: cros_ec_proto: Update version on GET_NEXT_EVENT failure
	ASoC: wcd9335: fix order of Slimbus unprepare/disable
	ASoC: wcd934x: fix order of Slimbus unprepare/disable
	hwmon: (gsc-hwmon) Call of_node_get() before of_find_xxx API
	regulator: qcom_rpm: Fix circular deferral regression
	RISC-V: Make port I/O string accessors actually work
	parisc: fbdev/stifb: Align graphics memory size to 4MB
	riscv: Allow PROT_WRITE-only mmap()
	riscv: Make VM_WRITE imply VM_READ
	riscv: Pass -mno-relax only on lld < 15.0.0
	UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
	nvme-pci: set min_align_mask before calculating max_hw_sectors
	drm/virtio: Check whether transferred 2D BO is shmem
	drm/udl: Restore display mode on resume
	block: fix inflight statistics of part0
	mm/mmap: undo ->mmap() when arch_validate_flags() fails
	PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge
	powercap: intel_rapl: Use standard Energy Unit for SPR Dram RAPL domain
	powerpc/boot: Explicitly disable usage of SPE instructions
	scsi: qedf: Populate sysfs attributes for vport
	fbdev: smscufx: Fix use-after-free in ufx_ops_open()
	btrfs: fix race between quota enable and quota rescan ioctl
	f2fs: increase the limit for reserve_root
	f2fs: fix to do sanity check on destination blkaddr during recovery
	f2fs: fix to do sanity check on summary info
	hardening: Clarify Kconfig text for auto-var-init
	hardening: Avoid harmless Clang option under CONFIG_INIT_STACK_ALL_ZERO
	hardening: Remove Clang's enable flag for -ftrivial-auto-var-init=zero
	jbd2: wake up journal waiters in FIFO order, not LIFO
	jbd2: fix potential buffer head reference count leak
	jbd2: fix potential use-after-free in jbd2_fc_wait_bufs
	jbd2: add miss release buffer head in fc_do_one_pass()
	ext4: avoid crash when inline data creation follows DIO write
	ext4: fix null-ptr-deref in ext4_write_info
	ext4: make ext4_lazyinit_thread freezable
	ext4: fix check for block being out of directory size
	ext4: don't increase iversion counter for ea_inodes
	ext4: ext4_read_bh_lock() should submit IO if the buffer isn't uptodate
	ext4: place buffer head allocation before handle start
	ext4: fix miss release buffer head in ext4_fc_write_inode
	ext4: fix potential memory leak in ext4_fc_record_modified_inode()
	ext4: fix potential memory leak in ext4_fc_record_regions()
	ext4: update 'state->fc_regions_size' after successful memory allocation
	livepatch: fix race between fork and KLP transition
	ftrace: Properly unset FTRACE_HASH_FL_MOD
	ring-buffer: Allow splice to read previous partially read pages
	ring-buffer: Have the shortest_full queue be the shortest not longest
	ring-buffer: Check pending waiters when doing wake ups as well
	ring-buffer: Add ring_buffer_wake_waiters()
	ring-buffer: Fix race between reset page and reading page
	tracing: Disable interrupt or preemption before acquiring arch_spinlock_t
	thunderbolt: Explicitly enable lane adapter hotplug events at startup
	efi: libstub: drop pointless get_memory_map() call
	media: cedrus: Set the platform driver data earlier
	KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility
	KVM: nVMX: Unconditionally purge queued/injected events on nested "exit"
	KVM: VMX: Drop bits 31:16 when shoving exception error code into VMCS
	staging: greybus: audio_helper: remove unused and wrong debugfs usage
	drm/nouveau/kms/nv140-: Disable interlacing
	drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()
	drm/i915: Fix watermark calculations for gen12+ RC CCS modifier
	drm/i915: Fix watermark calculations for gen12+ MC CCS modifier
	smb3: must initialize two ACL struct fields to zero
	selinux: use "grep -E" instead of "egrep"
	userfaultfd: open userfaultfds with O_RDONLY
	sh: machvec: Use char[] for section boundaries
	MIPS: SGI-IP27: Free some unused memory
	MIPS: SGI-IP27: Fix platform-device leak in bridge_platform_create()
	ARM: 9244/1: dump: Fix wrong pg_level in walk_pmd()
	ARM: 9247/1: mm: set readonly for MT_MEMORY_RO with ARM_LPAE
	objtool: Preserve special st_shndx indexes in elf_update_symbol
	nfsd: Fix a memory leak in an error handling path
	wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
	leds: lm3601x: Don't use mutex after it was destroyed
	wifi: mac80211: allow bw change during channel switch in mesh
	bpftool: Fix a wrong type cast in btf_dumper_int
	spi: mt7621: Fix an error message in mt7621_spi_probe()
	x86/resctrl: Fix to restore to original value when re-enabling hardware prefetch register
	Bluetooth: btusb: Fine-tune mt7663 mechanism.
	Bluetooth: btusb: fix excessive stack usage
	Bluetooth: btusb: mediatek: fix WMT failure during runtime suspend
	wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse()
	selftests/xsk: Avoid use-after-free on ctx
	spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume()
	spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime()
	wifi: rtl8xxxu: Fix skb misuse in TX queue selection
	spi: meson-spicc: do not rely on busy flag in pow2 clk ops
	bpf: btf: fix truncated last_member_type_id in btf_struct_resolve
	wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration
	wifi: rtl8xxxu: Remove copy-paste leftover in gen2_update_rate_mask
	net: fs_enet: Fix wrong check in do_pd_setup
	bpf: Ensure correct locking around vulnerable function find_vpid()
	Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure
	wifi: ath11k: fix number of VHT beamformee spatial streams
	x86/microcode/AMD: Track patch allocation size explicitly
	x86/cpu: Include the header of init_ia32_feat_ctl()'s prototype
	spi: dw: Fix PM disable depth imbalance in dw_spi_bt1_probe
	spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe
	i2c: mlxbf: support lock mechanism
	Bluetooth: hci_core: Fix not handling link timeouts propertly
	netfilter: nft_fib: Fix for rpath check with VRF devices
	spi: s3c64xx: Fix large transfers with DMA
	wifi: rtl8xxxu: Fix AIFS written to REG_EDCA_*_PARAM
	vhost/vsock: Use kvmalloc/kvfree for larger packets.
	mISDN: fix use-after-free bugs in l1oip timer handlers
	sctp: handle the error returned from sctp_auth_asoc_init_active_key
	tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited
	spi: Ensure that sg_table won't be used after being freed
	net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()
	bnx2x: fix potential memory leak in bnx2x_tpa_stop()
	net/ieee802154: reject zero-sized raw_sendmsg()
	once: add DO_ONCE_SLOW() for sleepable contexts
	net: mvpp2: fix mvpp2 debugfs leak
	drm: bridge: adv7511: fix CEC power down control register offset
	drm/bridge: Avoid uninitialized variable warning
	drm/mipi-dsi: Detach devices when removing the host
	drm/bridge: parade-ps8640: Fix regulator supply order
	drm/dp_mst: fix drm_dp_dpcd_read return value checks
	drm:pl111: Add of_node_put() when breaking out of for_each_available_child_of_node()
	platform/chrome: fix double-free in chromeos_laptop_prepare()
	platform/chrome: fix memory corruption in ioctl
	ASoC: tas2764: Allow mono streams
	ASoC: tas2764: Drop conflicting set_bias_level power setting
	ASoC: tas2764: Fix mute/unmute
	platform/x86: msi-laptop: Fix old-ec check for backlight registering
	platform/x86: msi-laptop: Fix resource cleanup
	drm: fix drm_mipi_dbi build errors
	drm/bridge: megachips: Fix a null pointer dereference bug
	ASoC: rsnd: Add check for rsnd_mod_power_on
	ALSA: hda: beep: Simplify keep-power-at-enable behavior
	drm/omap: dss: Fix refcount leak bugs
	mmc: au1xmmc: Fix an error handling path in au1xmmc_probe()
	ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API
	drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idx
	drm/msm/dp: correct 1.62G link rate at dp_catalog_ctrl_config_msa()
	ASoC: da7219: Fix an error handling path in da7219_register_dai_clks()
	ALSA: dmaengine: increment buffer pointer atomically
	mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe()
	ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe
	ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe
	ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe
	ASoC: mt6660: Fix PM disable depth imbalance in mt6660_i2c_probe
	ALSA: hda/hdmi: Don't skip notification handling during PM operation
	memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe()
	memory: of: Fix refcount leak bug in of_get_ddr_timings()
	memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings()
	soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe()
	soc: qcom: smem_state: Add refcounting for the 'state->of_node'
	ARM: dts: turris-omnia: Fix mpp26 pin name and comment
	ARM: dts: kirkwood: lsxl: fix serial line
	ARM: dts: kirkwood: lsxl: remove first ethernet port
	ia64: export memory_add_physaddr_to_nid to fix cxl build error
	soc/tegra: fuse: Drop Kconfig dependency on TEGRA20_APB_DMA
	ARM: dts: exynos: correct s5k6a3 reset polarity on Midas family
	ARM: Drop CMDLINE_* dependency on ATAGS
	arm64: ftrace: fix module PLTs with mcount
	ARM: dts: exynos: fix polarity of VBUS GPIO of Origen
	iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX
	iio: adc: at91-sama5d2_adc: check return status for pressure and touch
	iio: adc: at91-sama5d2_adc: lock around oversampling and sample freq
	iio: adc: at91-sama5d2_adc: disable/prepare buffer on suspend/resume
	iio: inkern: only release the device node when done with it
	iio: ABI: Fix wrong format of differential capacitance channel ABI.
	usb: ch9: Add USB 3.2 SSP attributes
	usb: common: Parse for USB SSP genXxY
	usb: common: add function to get interval expressed in us unit
	usb: common: move function's kerneldoc next to its definition
	usb: common: debug: Check non-standard control requests
	clk: meson: Hold reference returned by of_get_parent()
	clk: oxnas: Hold reference returned by of_get_parent()
	clk: qoriq: Hold reference returned by of_get_parent()
	clk: berlin: Add of_node_put() for of_get_parent()
	clk: sprd: Hold reference returned by of_get_parent()
	clk: tegra: Fix refcount leak in tegra210_clock_init
	clk: tegra: Fix refcount leak in tegra114_clock_init
	clk: tegra20: Fix refcount leak in tegra20_clock_init
	HSI: omap_ssi: Fix refcount leak in ssi_probe
	HSI: omap_ssi_port: Fix dma_map_sg error check
	media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop
	tty: xilinx_uartps: Fix the ignore_status
	media: meson: vdec: add missing clk_disable_unprepare on error in vdec_hevc_start()
	media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init
	RDMA/rxe: Fix "kernel NULL pointer dereference" error
	RDMA/rxe: Fix the error caused by qp->sk
	misc: ocxl: fix possible refcount leak in afu_ioctl()
	fpga: prevent integer overflow in dfl_feature_ioctl_set_irq()
	dmaengine: hisilicon: Disable channels when unregister hisi_dma
	dmaengine: hisilicon: Fix CQ head update
	dmaengine: hisilicon: Add multi-thread support for a DMA channel
	dyndbg: fix static_branch manipulation
	dyndbg: fix module.dyndbg handling
	dyndbg: let query-modname override actual module name
	dyndbg: drop EXPORTed dynamic_debug_exec_queries
	mtd: devices: docg3: check the return value of devm_ioremap() in the probe
	mtd: rawnand: fsl_elbc: Fix none ECC mode
	RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall.
	ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting()
	ata: fix ata_id_has_devslp()
	ata: fix ata_id_has_ncq_autosense()
	ata: fix ata_id_has_dipm()
	mtd: rawnand: meson: fix bit map use in meson_nfc_ecc_correct()
	md: Replace snprintf with scnprintf
	md/raid5: Ensure stripe_fill happens on non-read IO with journal
	RDMA/cm: Use SLID in the work completion as the DLID in responder side
	IB: Set IOVA/LENGTH on IB_MR in core/uverbs layers
	xhci: Don't show warning for reinit on known broken suspend
	usb: gadget: function: fix dangling pnp_string in f_printer.c
	drivers: serial: jsm: fix some leaks in probe
	serial: 8250: Add an empty line and remove some useless {}
	serial: 8250: Toggle IER bits on only after irq has been set up
	tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown
	phy: qualcomm: call clk_disable_unprepare in the error handling
	staging: vt6655: fix some erroneous memory clean-up loops
	firmware: google: Test spinlock on panic path to avoid lockups
	serial: 8250: Fix restoring termios speed after suspend
	scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()
	scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()
	clk: qcom: apss-ipq6018: mark apcs_alias0_core_clk as critical
	fsi: core: Check error number after calling ida_simple_get
	mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe()
	mfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq()
	mfd: lp8788: Fix an error handling path in lp8788_probe()
	mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init()
	mfd: fsl-imx25: Fix check for platform_get_irq() errors
	mfd: sm501: Add check for platform_driver_register()
	clk: mediatek: mt8183: mfgcfg: Propagate rate changes to parent
	dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup()
	spmi: pmic-arb: correct duplicate APID to PPID mapping logic
	clk: vc5: Fix 5P49V6901 outputs disabling when enabling FOD
	clk: baikal-t1: Fix invalid xGMAC PTP clock divider
	clk: baikal-t1: Add shared xGMAC ref/ptp clocks internal parent
	clk: baikal-t1: Add SATA internal ref clock buffer
	clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration
	clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe
	clk: ast2600: BCLK comes from EPLL
	mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg
	powerpc/math_emu/efp: Include module.h
	powerpc/sysdev/fsl_msi: Add missing of_node_put()
	powerpc/pci_dn: Add missing of_node_put()
	powerpc/powernv: add missing of_node_put() in opal_export_attrs()
	x86/hyperv: Fix 'struct hv_enlightened_vmcs' definition
	powerpc/64s: Fix GENERIC_CPU build flags for PPC970 / G5
	powerpc: Fix SPE Power ISA properties for e500v1 platforms
	crypto: sahara - don't sleep when in softirq
	crypto: hisilicon/zip - fix mismatch in get/set sgl_sge_nr
	hwrng: imx-rngc - Moving IRQ handler registering after imx_rngc_irq_mask_clear()
	cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset
	iommu/omap: Fix buffer overflow in debugfs
	crypto: akcipher - default implementation for setting a private key
	crypto: ccp - Release dma channels before dmaengine unrgister
	crypto: inside-secure - Change swab to swab32
	crypto: qat - fix use of 'dma_map_single'
	crypto: qat - use pre-allocated buffers in datapath
	crypto: qat - fix DMA transfer direction
	iommu/iova: Fix module config properly
	tracing: kprobe: Fix kprobe event gen test module on exit
	tracing: kprobe: Make gen test module work in arm and riscv
	kbuild: remove the target in signal traps when interrupted
	kbuild: rpm-pkg: fix breakage when V=1 is used
	crypto: marvell/octeontx - prevent integer overflows
	crypto: cavium - prevent integer overflow loading firmware
	thermal/drivers/qcom/tsens-v0_1: Fix MSM8939 fourth sensor hw_id
	ACPI: APEI: do not add task_work to kernel thread to avoid memory leak
	f2fs: fix race condition on setting FI_NO_EXTENT flag
	f2fs: fix to avoid REQ_TIME and CP_TIME collision
	f2fs: fix to account FS_CP_DATA_IO correctly
	selftest: tpm2: Add Client.__del__() to close /dev/tpm* handle
	rcu: Back off upon fill_page_cache_func() allocation failure
	rcu-tasks: Convert RCU_LOCKDEP_WARN() to WARN_ONCE()
	ACPI: video: Add Toshiba Satellite/Portege Z830 quirk
	MIPS: BCM47XX: Cast memcmp() of function to (void *)
	powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
	thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash
	x86/entry: Work around Clang __bdos() bug
	NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data
	NFSD: fix use-after-free on source server when doing inter-server copy
	wifi: brcmfmac: fix invalid address access when enabling SCAN log level
	bpftool: Clear errno after libcap's checks
	openvswitch: Fix double reporting of drops in dropwatch
	openvswitch: Fix overreporting of drops in dropwatch
	tcp: annotate data-race around tcp_md5sig_pool_populated
	wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()
	xfrm: Update ipcomp_scratches with NULL when freed
	wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()
	regulator: core: Prevent integer underflow
	Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create()
	Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
	can: bcm: check the result of can_send() in bcm_can_tx()
	wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620
	wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620
	wifi: rt2x00: set VGC gain for both chains of MT7620
	wifi: rt2x00: set SoC wmac clock register
	wifi: rt2x00: correctly set BBP register 86 for MT7620
	net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory
	Bluetooth: L2CAP: Fix user-after-free
	r8152: Rate limit overflow messages
	drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc()
	drm: Use size_t type for len variable in drm_copy_field()
	drm: Prevent drm_copy_field() to attempt copying a NULL pointer
	gpu: lontium-lt9611: Fix NULL pointer dereference in lt9611_connector_init()
	drm/amd/display: fix overflow on MIN_I64 definition
	udmabuf: Set ubuf->sg = NULL if the creation of sg table fails
	drm: bridge: dw_hdmi: only trigger hotplug event on link change
	drm/vc4: vec: Fix timings for VEC modes
	drm: panel-orientation-quirks: Add quirk for Anbernic Win600
	platform/chrome: cros_ec: Notify the PM of wake events during resume
	platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading
	ASoC: SOF: pci: Change DMI match info to support all Chrome platforms
	drm/amdgpu: fix initial connector audio value
	drm/meson: explicitly remove aggregate driver at module unload time
	mmc: sdhci-msm: add compatible string check for sdm670
	drm/dp: Don't rewrite link config when setting phy test pattern
	drm/amd/display: Remove interface for periodic interrupt 1
	ARM: dts: imx7d-sdb: config the max pressure for tsc2046
	ARM: dts: imx6q: add missing properties for sram
	ARM: dts: imx6dl: add missing properties for sram
	ARM: dts: imx6qp: add missing properties for sram
	ARM: dts: imx6sl: add missing properties for sram
	ARM: dts: imx6sll: add missing properties for sram
	ARM: dts: imx6sx: add missing properties for sram
	kselftest/arm64: Fix validatation termination record after EXTRA_CONTEXT
	arm64: dts: imx8mq-librem5: Add bq25895 as max17055's power supply
	btrfs: scrub: try to fix super block errors
	clk: zynqmp: Fix stack-out-of-bounds in strncpy`
	media: cx88: Fix a null-ptr-deref bug in buffer_prepare()
	clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate
	usb: host: xhci-plat: suspend and resume clocks
	usb: host: xhci-plat: suspend/resume clks for brcm
	scsi: 3w-9xxx: Avoid disabling device if failing to enable it
	nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
	power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()
	staging: vt6655: fix potential memory leak
	blk-throttle: prevent overflow while calculating wait time
	ata: libahci_platform: Sanity check the DT child nodes number
	bcache: fix set_at_max_writeback_rate() for multiple attached devices
	soundwire: cadence: Don't overwrite msg->buf during write commands
	soundwire: intel: fix error handling on dai registration issues
	HID: roccat: Fix use-after-free in roccat_read()
	md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d
	usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()
	usb: musb: Fix musb_gadget.c rxstate overflow bug
	Revert "usb: storage: Add quirk for Samsung Fit flash"
	staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv()
	nvme: copy firmware_rev on each init
	nvmet-tcp: add bounds check on Transfer Tag
	usb: idmouse: fix an uninit-value in idmouse_open
	clk: bcm2835: Make peripheral PLLC critical
	perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc
	arm64: topology: fix possible overflow in amu_fie_setup()
	io_uring: correct pinned_vm accounting
	io_uring/af_unix: defer registered files gc to io_uring release
	mm: hugetlb: fix UAF in hugetlb_handle_userfault
	net: ieee802154: return -EINVAL for unknown addr type
	Revert "net/ieee802154: reject zero-sized raw_sendmsg()"
	net/ieee802154: don't warn zero-sized raw_sendmsg()
	Revert "drm/amdgpu: move nbio sdma_doorbell_range() into sdma code for vega"
	Revert "drm/amdgpu: use dirty framebuffer helper"
	ext4: continue to expand file system when the target size doesn't reach
	inet: fully convert sk->sk_rx_dst to RCU rules
	thermal: intel_powerclamp: Use first online CPU as control_cpu
	f2fs: fix wrong condition to trigger background checkpoint correctly
	gcov: support GCC 12.1 and newer compilers
	Revert "drm/amdgpu: make sure to init common IP before gmc"
	Linux 5.10.150

Change-Id: I54f32f1f0149ec614c8bc7944e15adb5d80cd51a
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2022-11-15 19:14:08 +00:00
Varun Prakash d5bb45f47b nvmet-tcp: add bounds check on Transfer Tag
[ Upstream commit b6a545ffa2 ]

ttag is used as an index to get cmd in nvmet_tcp_handle_h2c_data_pdu(),
add a bounds check to avoid out-of-bounds access.

Signed-off-by: Varun Prakash <varun@chelsio.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-10-26 13:25:54 +02:00
Greg Kroah-Hartman 7474313da8 Merge 5.10.144 into android12-5.10-lts
Changes in 5.10.144
	ARM: dts: imx: align SPI NOR node name with dtschema
	ARM: dts: imx6qdl-kontron-samx6i: fix spi-flash compatible
	iommu/vt-d: Correctly calculate sagaw value of IOMMU
	tracefs: Only clobber mode/uid/gid on remount if asked
	Input: goodix - add support for GT1158
	drm/msm/rd: Fix FIFO-full deadlock
	HID: ishtp-hid-clientHID: ishtp-hid-client: Fix comment typo
	hid: intel-ish-hid: ishtp: Fix ishtp client sending disordered message
	tg3: Disable tg3 device on system reboot to avoid triggering AER
	gpio: mockup: remove gpio debugfs when remove device
	ieee802154: cc2520: add rc code in cc2520_tx()
	Input: iforce - add support for Boeder Force Feedback Wheel
	nvmet-tcp: fix unhandled tcp states in nvmet_tcp_state_change()
	drm/amd/amdgpu: skip ucode loading if ucode_size == 0
	perf/arm_pmu_platform: fix tests for platform_get_irq() failure
	platform/x86: acer-wmi: Acer Aspire One AOD270/Packard Bell Dot keymap fixes
	usb: storage: Add ASUS <0x0b05:0x1932> to IGNORE_UAS
	mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region()
	Revert "x86/ftrace: Use alternative RET encoding"
	x86/ibt,ftrace: Make function-graph play nice
	x86/ftrace: Use alternative RET encoding
	soc: fsl: select FSL_GUTS driver for DPIO
	Input: goodix - add compatible string for GT1158
	Linux 5.10.144

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ie5222afc95240a8f4b6b4b42d249a8d00eaf661f
2022-09-22 14:50:45 +02:00
Greg Kroah-Hartman 3dbfa90b61 Merge 5.10.143 into android12-5.10-lts
Changes in 5.10.143
	NFSD: Fix verifier returned in stable WRITEs
	xen-blkfront: Cache feature_persistent value before advertisement
	tty: n_gsm: initialize more members at gsm_alloc_mux()
	tty: n_gsm: avoid call of sleeping functions from atomic context
	efi: libstub: Disable struct randomization
	efi: capsule-loader: Fix use-after-free in efi_capsule_write
	wifi: iwlegacy: 4965: corrected fix for potential off-by-one overflow in il4965_rs_fill_link_cmd()
	fs: only do a memory barrier for the first set_buffer_uptodate()
	Revert "mm: kmemleak: take a full lowmem check in kmemleak_*_phys()"
	scsi: qla2xxx: Disable ATIO interrupt coalesce for quad port ISP27XX
	scsi: megaraid_sas: Fix double kfree()
	drm/gem: Fix GEM handle release errors
	drm/amdgpu: Move psp_xgmi_terminate call from amdgpu_xgmi_remove_device to psp_hw_fini
	drm/amdgpu: Check num_gfx_rings for gfx v9_0 rb setup.
	drm/radeon: add a force flush to delay work when radeon
	parisc: ccio-dma: Handle kmalloc failure in ccio_init_resources()
	parisc: Add runtime check to prevent PA2.0 kernels on PA1.x machines
	arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level
	net/core/skbuff: Check the return value of skb_copy_bits()
	fbdev: chipsfb: Add missing pci_disable_device() in chipsfb_pci_init()
	drm/amdgpu: mmVM_L2_CNTL3 register not initialized correctly
	ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc()
	ALSA: aloop: Fix random zeros in capture data when using jiffies timer
	ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface()
	kprobes: Prohibit probes in gate area
	debugfs: add debugfs_lookup_and_remove()
	nvmet: fix a use-after-free
	drm/i915: Implement WaEdpLinkRateDataReload
	scsi: mpt3sas: Fix use-after-free warning
	scsi: lpfc: Add missing destroy_workqueue() in error path
	cgroup: Elide write-locking threadgroup_rwsem when updating csses on an empty subtree
	cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock
	cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl()
	smb3: missing inode locks in punch hole
	ARM: dts: imx6qdl-kontron-samx6i: remove duplicated node
	regulator: core: Clean up on enable failure
	tee: fix compiler warning in tee_shm_register()
	RDMA/cma: Fix arguments order in net device validation
	soc: brcmstb: pm-arm: Fix refcount leak and __iomem leak bugs
	RDMA/hns: Fix supported page size
	RDMA/hns: Fix wrong fixed value of qp->rq.wqe_shift
	ARM: dts: at91: sama5d27_wlsom1: specify proper regulator output ranges
	ARM: dts: at91: sama5d2_icp: specify proper regulator output ranges
	ARM: dts: at91: sama5d27_wlsom1: don't keep ldo2 enabled all the time
	ARM: dts: at91: sama5d2_icp: don't keep vdd_other enabled all the time
	netfilter: br_netfilter: Drop dst references before setting.
	netfilter: nf_tables: clean up hook list when offload flags check fails
	netfilter: nf_conntrack_irc: Fix forged IP logic
	ALSA: usb-audio: Inform the delayed registration more properly
	ALSA: usb-audio: Register card again for iface over delayed_register option
	rxrpc: Fix an insufficiently large sglist in rxkad_verify_packet_2()
	afs: Use the operation issue time instead of the reply time for callbacks
	sch_sfb: Don't assume the skb is still around after enqueueing to child
	tipc: fix shift wrapping bug in map_get()
	ice: use bitmap_free instead of devm_kfree
	i40e: Fix kernel crash during module removal
	xen-netback: only remove 'hotplug-status' when the vif is actually destroyed
	RDMA/siw: Pass a pointer to virt_to_page()
	ipv6: sr: fix out-of-bounds read when setting HMAC data.
	IB/core: Fix a nested dead lock as part of ODP flow
	RDMA/mlx5: Set local port to one when accessing counters
	nvme-tcp: fix UAF when detecting digest errors
	nvme-tcp: fix regression that causes sporadic requests to time out
	tcp: fix early ETIMEDOUT after spurious non-SACK RTO
	sch_sfb: Also store skb len before calling child enqueue
	ASoC: mchp-spdiftx: remove references to mchp_i2s_caps
	ASoC: mchp-spdiftx: Fix clang -Wbitfield-constant-conversion
	MIPS: loongson32: ls1c: Fix hang during startup
	swiotlb: avoid potential left shift overflow
	iommu/amd: use full 64-bit value in build_completion_wait()
	hwmon: (mr75203) fix VM sensor allocation when "intel,vm-map" not defined
	hwmon: (mr75203) update pvt->v_num and vm_num to the actual number of used sensors
	hwmon: (mr75203) fix voltage equation for negative source input
	hwmon: (mr75203) fix multi-channel voltage reading
	hwmon: (mr75203) enable polling for all VM channels
	arm64: errata: add detection for AMEVCNTR01 incrementing incorrectly
	Linux 5.10.143

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ia1bc1b76bcad0e2cb3b27d1a37278b1d24c6b90d
2022-09-22 14:38:08 +02:00
Maurizio Lombardi c598e2704c nvmet-tcp: fix unhandled tcp states in nvmet_tcp_state_change()
[ Upstream commit 478814a558 ]

TCP_FIN_WAIT2 and TCP_LAST_ACK were not handled, the connection is closing
so we can ignore them and avoid printing the "unhandled state"
warning message.

[ 1298.852386] nvmet_tcp: queue 2 unhandled state 5
[ 1298.879112] nvmet_tcp: queue 7 unhandled state 5
[ 1298.884253] nvmet_tcp: queue 8 unhandled state 5
[ 1298.889475] nvmet_tcp: queue 9 unhandled state 5

v2: Do not call nvmet_tcp_schedule_release_queue(), just ignore
the fin_wait2 and last_ack states.

Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-09-20 12:38:32 +02:00
Bart Van Assche be01f1c988 nvmet: fix a use-after-free
commit 6a02a61e81 upstream.

Fix the following use-after-free complaint triggered by blktests nvme/004:

BUG: KASAN: user-memory-access in blk_mq_complete_request_remote+0xac/0x350
Read of size 4 at addr 0000607bd1835943 by task kworker/13:1/460
Workqueue: nvmet-wq nvme_loop_execute_work [nvme_loop]
Call Trace:
 show_stack+0x52/0x58
 dump_stack_lvl+0x49/0x5e
 print_report.cold+0x36/0x1e2
 kasan_report+0xb9/0xf0
 __asan_load4+0x6b/0x80
 blk_mq_complete_request_remote+0xac/0x350
 nvme_loop_queue_response+0x1df/0x275 [nvme_loop]
 __nvmet_req_complete+0x132/0x4f0 [nvmet]
 nvmet_req_complete+0x15/0x40 [nvmet]
 nvmet_execute_io_connect+0x18a/0x1f0 [nvmet]
 nvme_loop_execute_work+0x20/0x30 [nvme_loop]
 process_one_work+0x56e/0xa70
 worker_thread+0x2d1/0x640
 kthread+0x183/0x1c0
 ret_from_fork+0x1f/0x30

Cc: stable@vger.kernel.org
Fixes: a07b4970f4 ("nvmet: add a generic NVMe target")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-09-15 11:32:03 +02:00
Greg Kroah-Hartman 5597d5439f Merge 5.10.138 into android12-5.10-lts
Changes in 5.10.138
	ALSA: info: Fix llseek return value when using callback
	ALSA: hda/realtek: Add quirk for Clevo NS50PU, NS70PU
	x86/mm: Use proper mask when setting PUD mapping
	rds: add missing barrier to release_refill
	ata: libata-eh: Add missing command name
	mmc: pxamci: Fix another error handling path in pxamci_probe()
	mmc: pxamci: Fix an error handling path in pxamci_probe()
	mmc: meson-gx: Fix an error handling path in meson_mmc_probe()
	btrfs: fix lost error handling when looking up extended ref on log replay
	tracing: Have filter accept "common_cpu" to be consistent
	ALSA: usb-audio: More comprehensive mixer map for ASUS ROG Zenith II
	can: ems_usb: fix clang's -Wunaligned-access warning
	apparmor: fix quiet_denied for file rules
	apparmor: fix absroot causing audited secids to begin with =
	apparmor: Fix failed mount permission check error message
	apparmor: fix aa_label_asxprint return check
	apparmor: fix setting unconfined mode on a loaded profile
	apparmor: fix overlapping attachment computation
	apparmor: fix reference count leak in aa_pivotroot()
	apparmor: Fix memleak in aa_simple_write_to_buffer()
	Documentation: ACPI: EINJ: Fix obsolete example
	NFSv4.1: Don't decrease the value of seq_nr_highest_sent
	NFSv4.1: Handle NFS4ERR_DELAY replies to OP_SEQUENCE correctly
	NFSv4: Fix races in the legacy idmapper upcall
	NFSv4.1: RECLAIM_COMPLETE must handle EACCES
	NFSv4/pnfs: Fix a use-after-free bug in open
	bpf: Acquire map uref in .init_seq_private for array map iterator
	bpf: Acquire map uref in .init_seq_private for hash map iterator
	bpf: Acquire map uref in .init_seq_private for sock local storage map iterator
	bpf: Acquire map uref in .init_seq_private for sock{map,hash} iterator
	bpf: Check the validity of max_rdwr_access for sock local storage map iterator
	can: mcp251x: Fix race condition on receive interrupt
	net: atlantic: fix aq_vec index out of range error
	sunrpc: fix expiry of auth creds
	SUNRPC: Reinitialise the backchannel request buffers before reuse
	virtio_net: fix memory leak inside XPD_TX with mergeable
	devlink: Fix use-after-free after a failed reload
	net: bgmac: Fix a BUG triggered by wrong bytes_compl
	pinctrl: nomadik: Fix refcount leak in nmk_pinctrl_dt_subnode_to_map
	pinctrl: qcom: msm8916: Allow CAMSS GP clocks to be muxed
	pinctrl: sunxi: Add I/O bias setting for H6 R-PIO
	pinctrl: qcom: sm8250: Fix PDC map
	ACPI: property: Return type of acpi_add_nondev_subnodes() should be bool
	geneve: do not use RT_TOS for IPv6 flowlabel
	ipv6: do not use RT_TOS for IPv6 flowlabel
	plip: avoid rcu debug splat
	vsock: Fix memory leak in vsock_connect()
	vsock: Set socket state back to SS_UNCONNECTED in vsock_connect_timeout()
	dt-bindings: arm: qcom: fix MSM8916 MTP compatibles
	dt-bindings: clock: qcom,gcc-msm8996: add more GCC clock sources
	ceph: use correct index when encoding client supported features
	tools/vm/slabinfo: use alphabetic order when two values are equal
	ceph: don't leak snap_rwsem in handle_cap_grant
	kbuild: dummy-tools: avoid tmpdir leak in dummy gcc
	tools build: Switch to new openssl API for test-libcrypto
	NTB: ntb_tool: uninitialized heap data in tool_fn_write()
	nfp: ethtool: fix the display error of `ethtool -m DEVNAME`
	xen/xenbus: fix return type in xenbus_file_read()
	atm: idt77252: fix use-after-free bugs caused by tst_timer
	geneve: fix TOS inheriting for ipv4
	perf probe: Fix an error handling path in 'parse_perf_probe_command()'
	dpaa2-eth: trace the allocated address instead of page struct
	nios2: page fault et.al. are *not* restartable syscalls...
	nios2: don't leave NULLs in sys_call_table[]
	nios2: traced syscall does need to check the syscall number
	nios2: fix syscall restart checks
	nios2: restarts apply only to the first sigframe we build...
	nios2: add force_successful_syscall_return()
	iavf: Fix adminq error handling
	ASoC: tas2770: Set correct FSYNC polarity
	ASoC: tas2770: Allow mono streams
	ASoC: tas2770: Drop conflicting set_bias_level power setting
	ASoC: tas2770: Fix handling of mute/unmute
	netfilter: nf_tables: really skip inactive sets when allocating name
	netfilter: nf_tables: validate NFTA_SET_ELEM_OBJREF based on NFT_SET_OBJECT flag
	netfilter: nf_tables: check NFT_SET_CONCAT flag if field_count is specified
	powerpc/pci: Fix get_phb_number() locking
	spi: meson-spicc: add local pow2 clock ops to preserve rate between messages
	net: dsa: mv88e6060: prevent crash on an unused port
	net: moxa: pass pdev instead of ndev to DMA functions
	net: dsa: microchip: ksz9477: fix fdb_dump last invalid entry
	net: dsa: felix: fix ethtool 256-511 and 512-1023 TX packet counters
	net: genl: fix error path memory leak in policy dumping
	net: dsa: sja1105: fix buffer overflow in sja1105_setup_devlink_regions()
	ice: Ignore EEXIST when setting promisc mode
	i2c: imx: Make sure to unregister adapter on remove()
	regulator: pca9450: Remove restrictions for regulator-name
	i40e: Fix to stop tx_timeout recovery if GLOBR fails
	fec: Fix timer capture timing in `fec_ptp_enable_pps()`
	stmmac: intel: Add a missing clk_disable_unprepare() call in intel_eth_pci_remove()
	igb: Add lock to avoid data race
	kbuild: fix the modules order between drivers and libs
	gcc-plugins: Undefine LATENT_ENTROPY_PLUGIN when plugin disabled for a file
	locking/atomic: Make test_and_*_bit() ordered on failure
	ASoC: SOF: intel: move sof_intel_dsp_desc() forward
	drm/meson: Fix refcount bugs in meson_vpu_has_available_connectors()
	audit: log nftables configuration change events once per table
	netfilter: nftables: add helper function to set the base sequence number
	netfilter: add helper function to set up the nfnetlink header and use it
	drm/sun4i: dsi: Prevent underflow when computing packet sizes
	PCI: Add ACS quirk for Broadcom BCM5750x NICs
	platform/chrome: cros_ec_proto: don't show MKBP version if unsupported
	usb: cdns3 fix use-after-free at workaround 2
	usb: gadget: uvc: call uvc uvcg_warn on completed status instead of uvcg_info
	irqchip/tegra: Fix overflow implicit truncation warnings
	drm/meson: Fix overflow implicit truncation warnings
	clk: ti: Stop using legacy clkctrl names for omap4 and 5
	usb: host: ohci-ppc-of: Fix refcount leak bug
	usb: renesas: Fix refcount leak bug
	usb: dwc2: gadget: remove D+ pull-up while no vbus with usb-role-switch
	vboxguest: Do not use devm for irq
	clk: qcom: ipq8074: dont disable gcc_sleep_clk_src
	uacce: Handle parent device removal or parent driver module rmmod
	zram: do not lookup algorithm in backends table
	clk: qcom: clk-alpha-pll: fix clk_trion_pll_configure description
	scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input
	gadgetfs: ep_io - wait until IRQ finishes
	pinctrl: intel: Check against matching data instead of ACPI companion
	cxl: Fix a memory leak in an error handling path
	PCI/ACPI: Guard ARM64-specific mcfg_quirks
	um: add "noreboot" command line option for PANIC_TIMEOUT=-1 setups
	RDMA/rxe: Limit the number of calls to each tasklet
	csky/kprobe: reclaim insn_slot on kprobe unregistration
	selftests/kprobe: Do not test for GRP/ without event failures
	dmaengine: sprd: Cleanup in .remove() after pm_runtime_get_sync() failed
	md: Notify sysfs sync_completed in md_reap_sync_thread()
	nvmet-tcp: fix lockdep complaint on nvmet_tcp_wq flush during queue teardown
	drivers:md:fix a potential use-after-free bug
	ext4: avoid remove directory when directory is corrupted
	ext4: avoid resizing to a partial cluster size
	lib/list_debug.c: Detect uninitialized lists
	tty: serial: Fix refcount leak bug in ucc_uart.c
	vfio: Clear the caps->buf to NULL after free
	mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start
	modules: Ensure natural alignment for .altinstructions and __bug_table sections
	riscv: mmap with PROT_WRITE but no PROT_READ is invalid
	RISC-V: Add fast call path of crash_kexec()
	watchdog: export lockup_detector_reconfigure
	powerpc/32: Don't always pass -mcpu=powerpc to the compiler
	ALSA: core: Add async signal helpers
	ALSA: timer: Use deferred fasync helper
	ALSA: control: Use deferred fasync helper
	f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page()
	f2fs: fix to do sanity check on segment type in build_sit_entries()
	smb3: check xattr value length earlier
	powerpc/64: Init jump labels before parse_early_param()
	video: fbdev: i740fb: Check the argument of i740_calc_vclk()
	MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0
	netfilter: nftables: fix a warning message in nf_tables_commit_audit_collect()
	netfilter: nf_tables: fix audit memory leak in nf_tables_commit
	tracing/probes: Have kprobes and uprobes use $COMM too
	can: j1939: j1939_sk_queue_activate_next_locked(): replace WARN_ON_ONCE with netdev_warn_once()
	can: j1939: j1939_session_destroy(): fix memory leak of skbs
	PCI/ERR: Retain status from error notification
	qrtr: Convert qrtr_ports from IDR to XArray
	bpf: Fix KASAN use-after-free Read in compute_effective_progs
	tee: fix memory leak in tee_shm_register()
	Linux 5.10.138

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5983f3534b158edccd87bc7a7fe41ca07836d3eb
2022-08-30 12:59:52 +02:00
Sagi Grimberg 534e96302a nvmet-tcp: fix lockdep complaint on nvmet_tcp_wq flush during queue teardown
[ Upstream commit 533d2e8b4d ]

We probably need nvmet_tcp_wq to have MEM_RECLAIM as we are
sending/receiving for the socket from works on this workqueue.
Also this eliminates lockdep complaints:
--
[ 6174.010200] workqueue: WQ_MEM_RECLAIM
nvmet-wq:nvmet_tcp_release_queue_work [nvmet_tcp] is flushing
!WQ_MEM_RECLAIM nvmet_tcp_wq:nvmet_tcp_io_work [nvmet_tcp]
[ 6174.010216] WARNING: CPU: 20 PID: 14456 at kernel/workqueue.c:2628
check_flush_dependency+0x110/0x14c

Reported-by: Yi Zhang <yi.zhang@redhat.com>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-08-25 11:38:17 +02:00
Greg Kroah-Hartman 195692d0ab Merge 5.10.127 into android12-5.10-lts
Changes in 5.10.127
	vt: drop old FONT ioctls
	random: schedule mix_interrupt_randomness() less often
	random: quiet urandom warning ratelimit suppression message
	ALSA: hda/via: Fix missing beep setup
	ALSA: hda/conexant: Fix missing beep setup
	ALSA: hda/realtek: Add mute LED quirk for HP Omen laptop
	ALSA: hda/realtek - ALC897 headset MIC no sound
	ALSA: hda/realtek: Apply fixup for Lenovo Yoga Duet 7 properly
	ALSA: hda/realtek: Add quirk for Clevo PD70PNT
	ALSA: hda/realtek: Add quirk for Clevo NS50PU
	net: openvswitch: fix parsing of nw_proto for IPv6 fragments
	btrfs: add error messages to all unrecognized mount options
	mmc: sdhci-pci-o2micro: Fix card detect by dealing with debouncing
	mtd: rawnand: gpmi: Fix setting busy timeout setting
	ata: libata: add qc->flags in ata_qc_complete_template tracepoint
	dm era: commit metadata in postsuspend after worker stops
	dm mirror log: clear log bits up to BITS_PER_LONG boundary
	USB: serial: option: add Telit LE910Cx 0x1250 composition
	USB: serial: option: add Quectel EM05-G modem
	USB: serial: option: add Quectel RM500K module support
	drm/msm: Fix double pm_runtime_disable() call
	netfilter: nftables: add nft_parse_register_load() and use it
	netfilter: nftables: add nft_parse_register_store() and use it
	netfilter: use get_random_u32 instead of prandom
	scsi: scsi_debug: Fix zone transition to full condition
	drm/msm: use for_each_sgtable_sg to iterate over scatterlist
	bpf: Fix request_sock leak in sk lookup helpers
	drm/sun4i: Fix crash during suspend after component bind failure
	bpf, x86: Fix tail call count offset calculation on bpf2bpf call
	phy: aquantia: Fix AN when higher speeds than 1G are not advertised
	tipc: simplify the finalize work queue
	tipc: fix use-after-free Read in tipc_named_reinit
	igb: fix a use-after-free issue in igb_clean_tx_ring
	bonding: ARP monitor spams NETDEV_NOTIFY_PEERS notifiers
	net/sched: sch_netem: Fix arithmetic in netem_dump() for 32-bit platforms
	drm/msm/mdp4: Fix refcount leak in mdp4_modeset_init_intf
	drm/msm/dp: check core_initialized before disable interrupts at dp_display_unbind()
	drm/msm/dp: fixes wrong connection state caused by failure of link train
	drm/msm/dp: deinitialize mainlink if link training failed
	drm/msm/dp: promote irq_hpd handle to handle link training correctly
	drm/msm/dp: fix connect/disconnect handled at irq_hpd
	erspan: do not assume transport header is always set
	net/tls: fix tls_sk_proto_close executed repeatedly
	udmabuf: add back sanity check
	selftests: netfilter: correct PKTGEN_SCRIPT_PATHS in nft_concat_range.sh
	x86/xen: Remove undefined behavior in setup_features()
	MIPS: Remove repetitive increase irq_err_count
	afs: Fix dynamic root getattr
	ice: ethtool: advertise 1000M speeds properly
	regmap-irq: Fix a bug in regmap_irq_enable() for type_in_mask chips
	igb: Make DMA faster when CPU is active on the PCIe link
	virtio_net: fix xdp_rxq_info bug after suspend/resume
	Revert "net/tls: fix tls_sk_proto_close executed repeatedly"
	nvme: centralize setting the timeout in nvme_alloc_request
	nvme: split nvme_alloc_request()
	nvme: mark nvme_setup_passsthru() inline
	nvme: don't check nvme_req flags for new req
	nvme-pci: allocate nvme_command within driver pdu
	nvme-pci: add NO APST quirk for Kioxia device
	nvme: move the Samsung X5 quirk entry to the core quirks
	gpio: winbond: Fix error code in winbond_gpio_get()
	s390/cpumf: Handle events cycles and instructions identical
	iio: mma8452: fix probe fail when device tree compatible is used.
	iio: adc: vf610: fix conversion mode sysfs node name
	usb: typec: wcove: Drop wrong dependency to INTEL_SOC_PMIC
	xhci: turn off port power in shutdown
	xhci-pci: Allow host runtime PM as default for Intel Raptor Lake xHCI
	xhci-pci: Allow host runtime PM as default for Intel Meteor Lake xHCI
	usb: gadget: Fix non-unique driver names in raw-gadget driver
	USB: gadget: Fix double-free bug in raw_gadget driver
	usb: chipidea: udc: check request status before setting device address
	f2fs: attach inline_data after setting compression
	iio:chemical:ccs811: rearrange iio trigger get and register
	iio:accel:bma180: rearrange iio trigger get and register
	iio:accel:mxc4005: rearrange iio trigger get and register
	iio: accel: mma8452: ignore the return value of reset operation
	iio: gyro: mpu3050: Fix the error handling in mpu3050_power_up()
	iio: trigger: sysfs: fix use-after-free on remove
	iio: adc: stm32: fix maximum clock rate for stm32mp15x
	iio: imu: inv_icm42600: Fix broken icm42600 (chip id 0 value)
	iio: adc: stm32: Fix ADCs iteration in irq handler
	iio: adc: stm32: Fix IRQs on STM32F4 by removing custom spurious IRQs message
	iio: adc: axp288: Override TS pin bias current for some models
	iio: adc: adi-axi-adc: Fix refcount leak in adi_axi_adc_attach_client
	xtensa: xtfpga: Fix refcount leak bug in setup
	xtensa: Fix refcount leak bug in time.c
	parisc/stifb: Fix fb_is_primary_device() only available with CONFIG_FB_STI
	parisc: Enable ARCH_HAS_STRICT_MODULE_RWX
	powerpc: Enable execve syscall exit tracepoint
	powerpc/rtas: Allow ibm,platform-dump RTAS call with null buffer address
	powerpc/powernv: wire up rng during setup_arch
	ARM: dts: imx7: Move hsic_phy power domain to HSIC PHY node
	ARM: dts: imx6qdl: correct PU regulator ramp delay
	ARM: exynos: Fix refcount leak in exynos_map_pmu
	soc: bcm: brcmstb: pm: pm-arm: Fix refcount leak in brcmstb_pm_probe
	ARM: Fix refcount leak in axxia_boot_secondary
	memory: samsung: exynos5422-dmc: Fix refcount leak in of_get_dram_timings
	ARM: cns3xxx: Fix refcount leak in cns3xxx_init
	modpost: fix section mismatch check for exported init/exit sections
	random: update comment from copy_to_user() -> copy_to_iter()
	kbuild: link vmlinux only once for CONFIG_TRIM_UNUSED_KSYMS (2nd attempt)
	powerpc/pseries: wire up rng during setup_arch()
	Linux 5.10.127

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I1a36d81c8c44a8bf1c20cf9e1060394e4927eedb
2022-07-28 16:08:09 +02:00
Chaitanya Kulkarni 3ee62a1f07 nvme: split nvme_alloc_request()
[ Upstream commit 39dfe84451 ]

Right now nvme_alloc_request() allocates a request from block layer
based on the value of the qid. When qid set to NVME_QID_ANY it used
blk_mq_alloc_request() else blk_mq_alloc_request_hctx().

The function nvme_alloc_request() is called from different context, The
only place where it uses non NVME_QID_ANY value is for fabrics connect
commands :-

nvme_submit_sync_cmd()		NVME_QID_ANY
nvme_features()			NVME_QID_ANY
nvme_sec_submit()		NVME_QID_ANY
nvmf_reg_read32()		NVME_QID_ANY
nvmf_reg_read64()		NVME_QID_ANY
nvmf_reg_write32()		NVME_QID_ANY
nvmf_connect_admin_queue()	NVME_QID_ANY
nvme_submit_user_cmd()		NVME_QID_ANY
	nvme_alloc_request()
nvme_keep_alive()		NVME_QID_ANY
	nvme_alloc_request()
nvme_timeout()			NVME_QID_ANY
	nvme_alloc_request()
nvme_delete_queue()		NVME_QID_ANY
	nvme_alloc_request()
nvmet_passthru_execute_cmd()	NVME_QID_ANY
	nvme_alloc_request()
nvmf_connect_io_queue() 	QID
	__nvme_submit_sync_cmd()
		nvme_alloc_request()

With passthru nvme_alloc_request() now falls into the I/O fast path such
that blk_mq_alloc_request_hctx() is never gets called and that adds
additional branch check in fast path.

Split the nvme_alloc_request() into nvme_alloc_request() and
nvme_alloc_request_qid().

Replace each call of the nvme_alloc_request() with NVME_QID_ANY param
with a call to newly added nvme_alloc_request() without NVME_QID_ANY.

Replace a call to nvme_alloc_request() with QID param with a call to
newly added nvme_alloc_request() and nvme_alloc_request_qid()
based on the qid value set in the __nvme_submit_sync_cmd().

Signed-off-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-06-29 08:59:49 +02:00
Greg Kroah-Hartman f45f895af5 Merge branch 'android12-5.10' into android12-5.10-lts
Sync up with android12-5.10 for the following commits:

2c152aa329 UPSTREAM: f2fs: reduce the scope of setting fsck tag when de->name_len is zero
c29dd368ef ANDROID: GKI: Update symbols to abi_gki_aarch64_oplus
428d0bb762 ANDROID: Add initial ASUS symbol list
87a74496ed ANDROID: configfs: add proper module namespace marking
b7a6c15a6f ANDROID: Configure out the macros in android_kabi and android_vendor
bdc772adbd ANDROID: kernel: fix debug_kinfo set twice crash issue
d483eed85f ANDROID: GKI: set vfs-only exports into their own namespace
27fc5a7c69 UPSTREAM: net/packet: rx_owner_map depends on pg_vec
f70ea63f3b ANDROID: GKI: Update symbols to symbol list
a593acdae8 FROMLIST: module.h: allow #define strings to work with MODULE_IMPORT_NS
eb171b4cbe FROMLIST: export: fix string handling of namespace in EXPORT_SYMBOL_NS
05c23b7a50 ANDROID: vendor_hooks: Add hooks for binder
e99926fdfa ANDROID: mm/oom_kill: allow process_mrelease reclaim memory in parallel with exit_mmap
f4f2c619d5 FROMLIST: mm/oom_kill: allow process_mrelease to run under mmap_lock protection
2452622293 FROMLIST: mm: protect free_pgtables with mmap_lock write lock in exit_mmap
fd7af95538 UPSTREAM: mm/oom_kill.c: prevent a race between process_mrelease and exit_mmap
fe50dcab7a UPSTREAM: mm: wire up syscall process_mrelease
7fc3ac4968 UPSTREAM: mm: introduce process_mrelease system call
ac44888155 Revert "FROMGIT: mm: improve mprotect(R|W) efficiency on pages referenced once"
3a624c9ccd ANDROID: fips140: add show_invalid_inputs command to fips140_lab_util
a481d43521 ANDROID: fips140: refactor and rename fips140_lab_test
d4b5ca56b5 ANDROID: GKI: add lenovo symbol list
47874cc690 ANDROID: abi_gki_aarch64_qcom: Add rproc_set_firmware
c41767a8ec UPSTREAM: remoteproc: Add a rproc_set_firmware() API
28d62c68d1 FROMGIT: iommu/io-pgtable-arm-v7s: Add error handle for page table allocation failure
99ad261273 UPSTREAM: sctp: add param size validation for SCTP_PARAM_SET_PRIMARY
282a4de8f0 UPSTREAM: sctp: validate chunk size in __rcv_asconf_lookup
fef7dba3a7 UPSTREAM: bpf: Fix integer overflow in prealloc_elems_and_freelist()
893425f545 ANDROID: GKI: Update symbol list
cef0df2218 ANDROID: ABI: update allowed list for galaxy
a7ab784f60 ANDROID: vendor_hooks: Add hooks for futex
84fc3abca0 ANDROID: dma-contiguous: Add tracehook to allow subpage allocations in dma_alloc_contiguous
d94655c43e ANDROID: Update the ABI xml and symbol list
414c32d38e UPSTREAM: ALSA: memalloc: Align buffer allocations in page size
75617df5b3 ANDROID: Fix mmu_notifier_trylock definition for !CONFIG_MMU_NOTIFIER config
7531e63661 FROMGIT: USB: gadget: bRequestType is a bitfield, not a enum
70c9301d9c ANDROID: qcom: Add flush_delayed_fput to ABI
5d8520b557 ANDROID: fix ABI breakage caused by mm_struct->mmu_notifier_lock addition
a4d26b9a4b ANDROID: fix ABI breakage caused by percpu_rw_semaphore changes
6971350406 ANDROID: fix mmu_notifier race caused by not taking mmap_lock during SPF
2fc2c66b9c ANDROID: percpu-rwsem: enable percpu_sem destruction in atomic context
f3f87608d8 FROMLIST: virtio_mmio: pm: Add notification handlers for restore and freeze
9180348b91 FROMLIST: virtio: do not reset stateful devices on resume
392cb940f6 FROMGIT: f2fs: avoid EINVAL by SBI_NEED_FSCK when pinning a file
ddd9e01504 UPSTREAM: mm, slub: fix incorrect memcg slab count for bulk free
82ac5b0b1d UPSTREAM: mm, slub: fix potential use-after-free in slab_debugfs_fops
e07a663f5d UPSTREAM: mm, slub: fix potential memoryleak in kmem_cache_open()
cd02f347ab UPSTREAM: mm, slub: fix mismatch between reconstructed freelist depth and cnt
6b6725f77d UPSTREAM: mm, slub: fix two bugs in slab_debug_trace_open()
791f85d16d UPSTREAM: mm, slub: allocate private object map for debugfs listings
1260b47d4f FROMGIT: dma-buf: remove restriction of IOCTL:DMA_BUF_SET_NAME
e80be54e4b UPSTREAM: usb: dwc3: core: balance phy init and exit
89137e0047 UPSTREAM: xhci: Fix failure to give back some cached cancelled URBs.
f37b6d79f8 ANDROID: mm/memory_hotplug: Don't special case memory_block_size_bytes
8b7ffd60a5 UPSTREAM: usb: gadget: uvc: fix multiple opens
ae22ebebbb UPSTREAM: aio: fix use-after-free due to missing POLLFREE handling
b9c8788830 UPSTREAM: aio: keep poll requests on waitqueue until completed
f965176884 UPSTREAM: signalfd: use wake_up_pollfree()
49744a390d UPSTREAM: binder: use wake_up_pollfree()
e50fe1de2f UPSTREAM: wait: add wake_up_pollfree()
53afb231f5 UPSTREAM: USB: gadget: zero allocate endpoint 0 buffers
593309a377 BACKPORT: scsi: ufs: Improve SCSI abort handling further
21949c429a FROMGIT: scsi: ufs: Introduce ufshcd_release_scsi_cmd()
d600bdedac FROMGIT: scsi: ufs: Remove the 'update_scaling' local variable
5f9614157c UPSTREAM: scsi: ufs: core: Fix another task management completion race
76760a995c BACKPORT: scsi: ufs: core: Fix task management completion timeout race
dab2a8a288 ANDROID: qcom: Add android_rvh_do_ptrauth_fault to ABI
b4604acd52 UPSTREAM: USB: gadget: detect too-big endpoint 0 requests
2d6a43c036 ANDROID: ABI: Add symbols used by frame buffer driver
183905923f UPSTREAM: xhci: Add bus number to some debug messages
5b15c955a6 UPSTREAM: xhci: Add additional dynamic debug to follow URBs in cancel and error cases.
f4cbe34956 UPSTREAM: Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set"
c23b0e7c47 UPSTREAM: xhci: Fix failure to give back some cached cancelled URBs.
7320fb1abd UPSTREAM: HID: check for valid USB device for many HID drivers
e98c96b8b8 UPSTREAM: HID: wacom: fix problems when device is not a valid USB device
5a72ef56c8 UPSTREAM: HID: bigbenff: prevent null pointer dereference
7b8a19b917 UPSTREAM: HID: add USB_HID dependancy on some USB HID drivers
8219b106a3 UPSTREAM: HID: add USB_HID dependancy to hid-chicony
a4909c90b7 UPSTREAM: HID: add USB_HID dependancy to hid-prodikeys
ddea17081f UPSTREAM: HID: add hid_is_usb() function to make it simpler for USB detection
81b6ea435e FROMGIT: clk: Don't parent clks until the parent is fully registered
78ea29e570 UPSTREAM: mm/gup: remove the vma allocation from gup_longterm_locked()
709fde7c61 BACKPORT: usb: typec: tcpm: Wait in SNK_DEBOUNCED until disconnect
ea4a92c6af ANDROID: ABI: Add iio_write_channel_raw symbol
f803f248dd ANDROID: GKI: Update symbols to symbol list
672d51b2a7 UPSTREAM: ASoC: dapm: use component prefix when checking widget names
686cd3b2d8 ANDROID: ABI: Add symbols used by clocksource driver
80c1cef2d1 ANDROID: GKI: Export clocksource_mmio_init
84881c68b1 ANDROID: GKI: Export sched_clock_register
9e5446d7de FROMGIT: f2fs: show number of pending discard commands
28de741861 ANDROID: workqueue: export symbol of the function wq_worker_comm()
71f00d64c1 ANDROID: GKI: Update symbols to symbol list
05aa93d251 ANDROID: vendor_hooks: Add hooks for binder proc transaction

Also update the .xml file for the following new symbols that are now
being tracked:

Leaf changes summary: 165 artifacts changed
Changed leaf types summary: 0 leaf type changed
Removed/Changed/Added functions summary: 0 Removed, 0 Changed, 154 Added functions
Removed/Changed/Added variables summary: 0 Removed, 0 Changed, 11 Added variables

154 Added functions:

  [A] 'function void __bforget(buffer_head*)'
  [A] 'function ssize_t __blockdev_direct_IO(kiocb*, inode*, block_device*, iov_iter*, get_block_t*, dio_iodone_t*, dio_submit_t*, int)'
  [A] 'function buffer_head* __bread_gfp(block_device*, sector_t, unsigned int, gfp_t)'
  [A] 'function void __breadahead(block_device*, sector_t, unsigned int)'
  [A] 'function void __brelse(buffer_head*)'
  [A] 'function void __cancel_dirty_page(page*)'
  [A] 'function void __cleancache_invalidate_inode(address_space*)'
  [A] 'function void __filemap_set_wb_err(address_space*, int)'
  [A] 'function void __insert_inode_hash(inode*, unsigned long int)'
  [A] 'function void __mark_inode_dirty(inode*, int)'
  [A] 'function void __pagevec_release(pagevec*)'
  [A] 'function void __remove_inode_hash(inode*)'
  [A] 'function int __set_page_dirty_buffers(page*)'
  [A] 'function int __set_page_dirty_nobuffers(page*)'
  [A] 'function int __test_set_page_writeback(page*, bool)'
  [A] 'function int __traceiter_android_vh_binder_free_proc(void*, binder_proc*)'
  [A] 'function int __traceiter_android_vh_binder_has_work_ilocked(void*, binder_thread*, bool, int*)'
  [A] 'function int __traceiter_android_vh_binder_looper_state_registered(void*, binder_thread*, binder_proc*)'
  [A] 'function int __traceiter_android_vh_binder_proc_transaction_end(void*, task_struct*, task_struct*, task_struct*, unsigned int, bool, bool)'
  [A] 'function int __traceiter_android_vh_binder_read_done(void*, binder_proc*, binder_thread*)'
  [A] 'function int __traceiter_android_vh_binder_thread_read(void*, list_head**, binder_proc*, binder_thread*)'
  [A] 'function int __traceiter_android_vh_binder_thread_release(void*, binder_proc*, binder_thread*)'
  [A] 'function int __traceiter_android_vh_futex_sleep_start(void*, task_struct*)'
  [A] 'function int __traceiter_block_bio_remap(void*, request_queue*, bio*, dev_t, sector_t)'
  [A] 'function int add_to_page_cache_locked(page*, address_space*, unsigned long int, gfp_t)'
  [A] 'function bio* bio_split(bio*, int, gfp_t, bio_set*)'
  [A] 'function wait_queue_head* bit_waitqueue(void*, int)'
  [A] 'function blk_plug_cb* blk_check_plugged(blk_plug_cb_fn, void*, int)'
  [A] 'function void blk_queue_max_write_same_sectors(request_queue*, unsigned int)'
  [A] 'function int blkdev_issue_discard(block_device*, sector_t, sector_t, gfp_t, unsigned long int)'
  [A] 'function void block_invalidatepage(page*, unsigned int, unsigned int)'
  [A] 'function int block_is_partially_uptodate(page*, unsigned long int, unsigned long int)'
  [A] 'function int buffer_migrate_page(address_space*, page*, page*, migrate_mode)'
  [A] 'function bool capable_wrt_inode_uidgid(const inode*, int)'
  [A] 'function void clean_bdev_aliases(block_device*, sector_t, sector_t)'
  [A] 'function void clear_inode(inode*)'
  [A] 'function int clear_page_dirty_for_io(page*)'
  [A] 'function int clk_set_duty_cycle(clk*, unsigned int, unsigned int)'
  [A] 'function int clocksource_mmio_init(void*, const char*, unsigned long int, int, unsigned int, typedef u64 (clocksource*)*)'
  [A] 'function u64 clocksource_mmio_readl_up(clocksource*)'
  [A] 'function void create_empty_buffers(page*, unsigned long int, unsigned long int)'
  [A] 'function int current_umask()'
  [A] 'function dentry* d_add_ci(dentry*, inode*, qstr*)'
  [A] 'function void d_instantiate(dentry*, inode*)'
  [A] 'function dentry* d_obtain_alias(inode*)'
  [A] 'function dentry* d_splice_alias(inode*, dentry*)'
  [A] 'function void delete_from_page_cache(page*)'
  [A] 'function void disk_stack_limits(gendisk*, block_device*, sector_t)'
  [A] 'function void drop_nlink(inode*)'
  [A] 'function void end_buffer_write_sync(buffer_head*, int)'
  [A] 'function void end_page_writeback(page*)'
  [A] 'function errseq_t errseq_set(errseq_t*, int)'
  [A] 'function int fb_get_options(const char*, char**)'
  [A] 'function int fiemap_fill_next_extent(fiemap_extent_info*, u64, u64, u64, u32)'
  [A] 'function int fiemap_prep(inode*, fiemap_extent_info*, u64, u64*, u32)'
  [A] 'function int file_remove_privs(file*)'
  [A] 'function int file_update_time(file*)'
  [A] 'function int file_write_and_wait_range(file*, loff_t, loff_t)'
  [A] 'function vm_fault_t filemap_fault(vm_fault*)'
  [A] 'function int filemap_fdatawait_range(address_space*, loff_t, loff_t)'
  [A] 'function int filemap_fdatawrite(address_space*)'
  [A] 'function int filemap_flush(address_space*)'
  [A] 'function int filemap_write_and_wait_range(address_space*, loff_t, loff_t)'
  [A] 'function file* filp_open(const char*, int, umode_t)'
  [A] 'function void flush_delayed_fput()'
  [A] 'function int freq_qos_remove_notifier(freq_constraints*, freq_qos_req_type, notifier_block*)'
  [A] 'function int generic_error_remove_page(address_space*, page*)'
  [A] 'function ssize_t generic_file_direct_write(kiocb*, iov_iter*)'
  [A] 'function int generic_file_mmap(file*, vm_area_struct*)'
  [A] 'function int generic_file_open(inode*, file*)'
  [A] 'function ssize_t generic_file_splice_read(file*, loff_t*, pipe_inode_info*, size_t, unsigned int)'
  [A] 'function void generic_fillattr(inode*, kstat*)'
  [A] 'function ssize_t generic_read_dir(file*, char*, size_t, loff_t*)'
  [A] 'function page* grab_cache_page_write_begin(address_space*, unsigned long int, unsigned int)'
  [A] 'function inode* iget5_locked(super_block*, unsigned long int, int (inode*, void*)*, int (inode*, void*)*, void*)'
  [A] 'function inode* igrab(inode*)'
  [A] 'function void ihold(inode*)'
  [A] 'function int iio_write_channel_raw(iio_channel*, int)'
  [A] 'function inode* ilookup5(super_block*, unsigned long int, int (inode*, void*)*, void*)'
  [A] 'function int in_group_p(kgid_t)'
  [A] 'function void inc_nlink(inode*)'
  [A] 'function void init_special_inode(inode*, umode_t, dev_t)'
  [A] 'function void inode_dio_wait(inode*)'
  [A] 'function void inode_init_once(inode*)'
  [A] 'function void inode_init_owner(inode*, const inode*, umode_t)'
  [A] 'function int inode_newsize_ok(const inode*, loff_t)'
  [A] 'function void inode_set_flags(inode*, unsigned int, unsigned int)'
  [A] 'function void io_schedule()'
  [A] 'function void iov_iter_advance(iov_iter*, size_t)'
  [A] 'function unsigned long int iov_iter_alignment(const iov_iter*)'
  [A] 'function size_t iov_iter_copy_from_user_atomic(page*, iov_iter*, unsigned long int, size_t)'
  [A] 'function int iov_iter_fault_in_readable(iov_iter*, size_t)'
  [A] 'function ssize_t iov_iter_get_pages(iov_iter*, page**, size_t, unsigned int, size_t*)'
  [A] 'function size_t iov_iter_single_seg_count(const iov_iter*)'
  [A] 'function bool is_bad_inode(inode*)'
  [A] 'function ssize_t iter_file_splice_write(pipe_inode_info*, file*, loff_t*, size_t, unsigned int)'
  [A] 'function ino_t iunique(super_block*, ino_t)'
  [A] 'function void kill_block_super(super_block*)'
  [A] 'function void ll_rw_block(int, int, int, buffer_head**)'
  [A] 'function nls_table* load_nls(char*)'
  [A] 'function nls_table* load_nls_default()'
  [A] 'function void lru_cache_add(page*)'
  [A] 'function void make_bad_inode(inode*)'
  [A] 'function void mark_buffer_async_write(buffer_head*)'
  [A] 'function void mark_buffer_dirty(buffer_head*)'
  [A] 'function void mark_buffer_write_io_error(buffer_head*)'
  [A] 'function void mark_page_accessed(page*)'
  [A] 'function void mnt_drop_write_file(file*)'
  [A] 'function int mnt_want_write_file(file*)'
  [A] 'function dentry* mount_bdev(file_system_type*, int, const char*, void*, int (super_block*, void*, int)*)'
  [A] 'function void mpage_readahead(readahead_control*, get_block_t*)'
  [A] 'function int mpage_readpage(page*, get_block_t*)'
  [A] 'function int notify_change(dentry*, iattr*, inode**)'
  [A] 'function unsigned long int page_cache_next_miss(address_space*, unsigned long int, unsigned long int)'
  [A] 'function unsigned long int page_cache_prev_miss(address_space*, unsigned long int, unsigned long int)'
  [A] 'function bool page_mapped(page*)'
  [A] 'function int page_mkclean(page*)'
  [A] 'function void page_zero_new_buffers(page*, unsigned int, unsigned int)'
  [A] 'function page* pagecache_get_page(address_space*, unsigned long int, int, gfp_t)'
  [A] 'function unsigned int pagevec_lookup_range(pagevec*, address_space*, unsigned long int*, unsigned long int)'
  [A] 'function unsigned int pagevec_lookup_range_tag(pagevec*, address_space*, unsigned long int*, unsigned long int, xa_mark_t)'
  [A] 'function void put_pages_list(list_head*)'
  [A] 'function gfp_t readahead_gfp_mask(address_space*)'
  [A] 'function int redirty_page_for_writepage(writeback_control*, page*)'
  [A] 'function int rproc_set_firmware(rproc*, const char*)'
  [A] 'function int sb_min_blocksize(super_block*, int)'
  [A] 'function int sb_set_blocksize(super_block*, int)'
  [A] 'function void sched_clock_register(typedef u64 ()*, int, unsigned long int)'
  [A] 'function int security_inode_init_security(inode*, inode*, const qstr*, const initxattrs, void*)'
  [A] 'function void set_nlink(inode*, unsigned int)'
  [A] 'function int setattr_prepare(dentry*, iattr*)'
  [A] 'function blk_qc_t submit_bio_noacct(bio*)'
  [A] 'function int sync_dirty_buffer(buffer_head*)'
  [A] 'function int sync_filesystem(super_block*)'
  [A] 'function int sync_inode_metadata(inode*, int)'
  [A] 'function void tag_pages_for_writeback(address_space*, unsigned long int, unsigned long int)'
  [A] 'function timespec64 timestamp_truncate(timespec64, inode*)'
  [A] 'function void touch_atime(const path*)'
  [A] 'function void truncate_inode_pages(address_space*, loff_t)'
  [A] 'function void truncate_inode_pages_final(address_space*)'
  [A] 'function void truncate_pagecache(inode*, loff_t)'
  [A] 'function void truncate_setsize(inode*, loff_t)'
  [A] 'function int try_to_release_page(page*, gfp_t)'
  [A] 'function void try_to_writeback_inodes_sb(super_block*, wb_reason)'
  [A] 'function void unload_nls(nls_table*)'
  [A] 'function void unlock_buffer(buffer_head*)'
  [A] 'function void unlock_new_inode(inode*)'
  [A] 'function void usbnet_cdc_unbind(usbnet*, usb_interface*)'
  [A] 'function int usbnet_generic_cdc_bind(usbnet*, usb_interface*)'
  [A] 'function void wait_on_page_bit(page*, int)'
  [A] 'function int wake_bit_function(wait_queue_entry*, unsigned int, int, void*)'
  [A] 'function void wq_worker_comm(char*, size_t, task_struct*)'
  [A] 'function int write_inode_now(inode*, int)'
  [A] 'function int write_one_page(page*)'

11 Added variables:

  [A] 'tracepoint __tracepoint_android_rvh_do_ptrauth_fault'
  [A] 'tracepoint __tracepoint_android_vh_binder_free_proc'
  [A] 'tracepoint __tracepoint_android_vh_binder_has_work_ilocked'
  [A] 'tracepoint __tracepoint_android_vh_binder_looper_state_registered'
  [A] 'tracepoint __tracepoint_android_vh_binder_proc_transaction_end'
  [A] 'tracepoint __tracepoint_android_vh_binder_read_done'
  [A] 'tracepoint __tracepoint_android_vh_binder_thread_read'
  [A] 'tracepoint __tracepoint_android_vh_binder_thread_release'
  [A] 'tracepoint __tracepoint_android_vh_futex_sleep_start'
  [A] 'tracepoint __tracepoint_android_vh_subpage_dma_contig_alloc'
  [A] 'tracepoint __tracepoint_block_bio_remap'

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I064b6ff0420cee2d64e17814f43fbff8e2d9b019

Change-Id: Ia880c70c912f2b801a770feb1fdc4f4eb390d34d
2022-01-17 18:47:02 +01:00
Greg Kroah-Hartman d483eed85f ANDROID: GKI: set vfs-only exports into their own namespace
We have namespaces, so use them for all vfs-exported namespaces so that
filesystems can use them, but not anything else.

Some in-kernel drivers that do direct filesystem accesses (because they
serve up files) are also allowed access to these symbols to keep 'make
allmodconfig' builds working properly, but it is not needed for Android
kernel images.

Bug: 157965270
Bug: 210074446
Cc: Matthias Maennich <maennich@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Iaf6140baf3a18a516ab2d5c3966235c42f3f70de
2022-01-11 09:30:47 +01:00
Maurizio Lombardi f2a58ff3e3 nvmet: use IOCB_NOWAIT only if the filesystem supports it
[ Upstream commit c024b226a4 ]

Submit I/O requests with the IOCB_NOWAIT flag set only if
the underlying filesystem supports it.

Fixes: 50a909db36 ("nvmet: use IOCB_NOWAIT for file-ns buffered I/O")
Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-12-01 09:19:07 +01:00
Varun Prakash ac88cb3c44 nvmet-tcp: fix incomplete data digest send
[ Upstream commit 102110efdf ]

Current nvmet_try_send_ddgst() code does not check whether
all data digest bytes are transmitted, fix this by returning
-EAGAIN if all data digest bytes are not transmitted.

Fixes: 872d26a391 ("nvmet-tcp: add NVMe over TCP target driver")
Signed-off-by: Varun Prakash <varun@chelsio.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-12-01 09:19:06 +01:00
Israel Rukshin 82327823f3 nvmet-tcp: fix use-after-free when a port is removed
[ Upstream commit 2351ead99c ]

When removing a port, all its controllers are being removed, but there
are queues on the port that doesn't belong to any controller (during
connection time). This causes a use-after-free bug for any command
that dereferences req->port (like in nvmet_alloc_ctrl). Those queues
should be destroyed before freeing the port via configfs. Destroy
the remaining queues after the accept_work was cancelled guarantees
that no new queue will be created.

Signed-off-by: Israel Rukshin <israelr@nvidia.com>
Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-11-18 14:03:59 +01:00
Israel Rukshin 2659d8213d nvmet-rdma: fix use-after-free when a port is removed
[ Upstream commit fcf73a804c ]

When removing a port, all its controllers are being removed, but there
are queues on the port that doesn't belong to any controller (during
connection time). This causes a use-after-free bug for any command
that dereferences req->port (like in nvmet_alloc_ctrl). Those queues
should be destroyed before freeing the port via configfs. Destroy the
remaining queues after the RDMA-CM was destroyed guarantees that no
new queue will be created.

Signed-off-by: Israel Rukshin <israelr@nvidia.com>
Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-11-18 14:03:59 +01:00
Israel Rukshin e73574f7bc nvmet: fix use-after-free when a port is removed
[ Upstream commit e3e19dcc4c ]

When a port is removed through configfs, any connected controllers
are starting teardown flow asynchronously and can still send commands.
This causes a use-after-free bug for any command that dereferences
req->port (like in nvmet_parse_io_cmd).

To fix this, wait for all the teardown scheduled works to complete
(like release_work at rdma/tcp drivers). This ensures there are no
active controllers when the port is eventually removed.

Signed-off-by: Israel Rukshin <israelr@nvidia.com>
Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-11-18 14:03:58 +01:00
Amit Engel ad6a2a1e56 nvmet-tcp: fix header digest verification
[ Upstream commit 86aeda32b8 ]

Pass the correct length to nvmet_tcp_verify_hdgst, which is the pdu
header length.  This fixes a wrong behaviour where header digest
verification passes although the digest is wrong.

Signed-off-by: Amit Engel <amit.engel@dell.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-11-18 14:03:43 +01:00
Maurizio Lombardi db1d9d102e nvmet-tcp: fix a memory leak when releasing a queue
[ Upstream commit 926245c7d2 ]

page_frag_free() won't completely release the memory
allocated for the commands, the cache page must be explicitly
freed by calling __page_frag_cache_drain().

This bug can be easily reproduced by repeatedly
executing the following command on the initiator:

$echo 1 > /sys/devices/virtual/nvme-fabrics/ctl/nvme0/reset_controller

Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: John Meneghini <jmeneghi@redhat.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-11-18 14:03:43 +01:00
Varun Prakash 4286c72c53 nvmet-tcp: fix data digest pointer calculation
commit e790de54e9 upstream.

exp_ddgst is of type __le32, &cmd->exp_ddgst + cmd->offset increases
&cmd->exp_ddgst by 4 * cmd->offset, fix this by type casting
&cmd->exp_ddgst to u8 *.

Fixes: 872d26a391 ("nvmet-tcp: add NVMe over TCP target driver")
Signed-off-by: Varun Prakash <varun@chelsio.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-02 19:48:21 +01:00
Sagi Grimberg 240a7025a6 nvme: code command_id with a genctr for use-after-free validation
[ Upstream commit e7006de6c2 ]

We cannot detect a (perhaps buggy) controller that is sending us
a completion for a request that was already completed (for example
sending a completion twice), this phenomenon was seen in the wild
a few times.

So to protect against this, we use the upper 4 msbits of the nvme sqe
command_id to use as a 4-bit generation counter and verify it matches
the existing request generation that is incrementing on every execution.

The 16-bit command_id structure now is constructed by:
| xxxx | xxxxxxxxxxxx |
  gen    request tag

This means that we are giving up some possible queue depth as 12 bits
allow for a maximum queue depth of 4095 instead of 65536, however we
never create such long queues anyways so no real harm done.

Suggested-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Acked-by: Keith Busch <kbusch@kernel.org>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Daniel Wagner <dwagner@suse.de>
Tested-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-18 13:40:29 +02:00
Amit Engel 10e759e350 nvmet: pass back cntlid on successful completion
[ Upstream commit e804d5abe2 ]

According to the NVMe specification, the response dword 0 value of the
Connect command is based on status code: return cntlid for successful
compeltion return IPO and IATTR for connect invalid parameters.  Fix
a missing error information for a zero sized queue, and return the
cntlid also for I/O queue Connect commands.

Signed-off-by: Amit Engel <amit.engel@dell.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-15 09:50:25 +02:00
Maurizio Lombardi 89047f0089 nvme-tcp: can't set sk_user_data without write_lock
[ Upstream commit 0755d3be2d ]

The sk_user_data pointer is supposed to be modified only while
holding the write_lock "sk_callback_lock", otherwise
we could race with other threads and crash the kernel.

we can't take the write_lock in nvmet_tcp_state_change()
because it would cause a deadlock, but the release_work queue
will set the pointer to NULL later so we can simply remove
the assignment.

Fixes: b5332a9f3f ("nvmet-tcp: fix incorrect locking in state_change sk callback")

Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-20 16:05:53 +02:00
Hannes Reinecke 950a739905 nvmet-fc: do not check for invalid target port in nvmet_fc_handle_fcp_rqst()
[ Upstream commit 2a4a910aa4 ]

When parsing a request in nvmet_fc_handle_fcp_rqst() we should not
check for invalid target ports; if we do the command is aborted
from the fcp layer, causing the host to assume a transport error.
Rather we should still forward this request to the nvmet layer, which
will then correctly fail the command with an appropriate error status.

Signed-off-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-14 16:56:00 +02:00
Hannes Reinecke 511a010291 nvme-loop: do not warn for deleted controllers during reset
[ Upstream commit 6622f9acd2 ]

During concurrent reset and delete calls the reset workqueue is
flushed, causing nvme_loop_reset_ctrl_work() to be executed when
the controller is in state DELETING or DELETING_NOIO.
But this is expected, so we shouldn't issue a WARN_ON here.

Signed-off-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-06-18 10:00:05 +02:00
Hannes Reinecke 155c2fea4b nvme-loop: check for NVME_LOOP_Q_LIVE in nvme_loop_destroy_admin_queue()
[ Upstream commit 4237de2f73 ]

We need to check the NVME_LOOP_Q_LIVE flag in
nvme_loop_destroy_admin_queue() to protect against duplicate
invocations eg during concurrent reset and remove calls.

Signed-off-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-06-18 10:00:05 +02:00
Hannes Reinecke 620424df29 nvme-loop: clear NVME_LOOP_Q_LIVE when nvme_loop_configure_admin_queue() fails
[ Upstream commit 1c5f8e882a ]

When the call to nvme_enable_ctrl() in nvme_loop_configure_admin_queue()
fails the NVME_LOOP_Q_LIVE flag is not cleared.

Signed-off-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-06-18 10:00:05 +02:00
Hannes Reinecke 1c80ca596c nvme-loop: reset queue count to 1 in nvme_loop_destroy_io_queues()
[ Upstream commit a6c144f3d2 ]

The queue count is increased in nvme_loop_init_io_queues(), so we
need to reset it to 1 at the end of nvme_loop_destroy_io_queues().
Otherwise the function is not re-entrant safe, and crash will happen
during concurrent reset and remove calls.

Signed-off-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-06-18 10:00:05 +02:00
Sagi Grimberg 590f718a64 nvmet: fix false keep-alive timeout when a controller is torn down
[ Upstream commit aaeadd7075 ]

Controller teardown flow may take some time in case it has many I/O
queues, and the host may not send us keep-alive during this period.
Hence reset the traffic based keep-alive timer so we don't trigger
a controller teardown as a result of a keep-alive expiration.

Reported-by: Yi Zhang <yi.zhang@redhat.com>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Tested-by: Yi Zhang <yi.zhang@redhat.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-06-16 12:01:38 +02:00
Max Gurtovoy c440cd0807 nvmet: fix freeing unallocated p2pmem
[ Upstream commit bcd9a0797d ]

In case p2p device was found but the p2p pool is empty, the nvme target
is still trying to free the sgl from the p2p pool instead of the
regular sgl pool and causing a crash (BUG() is called). Instead, assign
the p2p_dev for the request only if it was allocated from p2p pool.

This is the crash that was caused:

[Sun May 30 19:13:53 2021] ------------[ cut here ]------------
[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!
[Sun May 30 19:13:53 2021] invalid opcode: 0000 [#1] SMP PTI
...
[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!
...
[Sun May 30 19:13:53 2021] RIP: 0010:gen_pool_free_owner+0xa8/0xb0
...
[Sun May 30 19:13:53 2021] Call Trace:
[Sun May 30 19:13:53 2021] ------------[ cut here ]------------
[Sun May 30 19:13:53 2021]  pci_free_p2pmem+0x2b/0x70
[Sun May 30 19:13:53 2021]  pci_p2pmem_free_sgl+0x4f/0x80
[Sun May 30 19:13:53 2021]  nvmet_req_free_sgls+0x1e/0x80 [nvmet]
[Sun May 30 19:13:53 2021] kernel BUG at lib/genalloc.c:518!
[Sun May 30 19:13:53 2021]  nvmet_rdma_release_rsp+0x4e/0x1f0 [nvmet_rdma]
[Sun May 30 19:13:53 2021]  nvmet_rdma_send_done+0x1c/0x60 [nvmet_rdma]

Fixes: c6e3f13398 ("nvmet: add metadata support for block devices")
Reviewed-by: Israel Rukshin <israelr@nvidia.com>
Signed-off-by: Max Gurtovoy <mgurtovoy@nvidia.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-06-10 13:39:18 +02:00
Hou Pu cb554bbf36 nvmet-tcp: fix inline data size comparison in nvmet_tcp_queue_response
commit 25df1acd2d upstream.

Using "<=" instead "<" to compare inline data size.

Fixes: bdaf132791 ("nvmet-tcp: fix a segmentation fault during io parsing error")
Signed-off-by: Hou Pu <houpu.main@gmail.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-06-03 09:00:39 +02:00
Daniel Wagner e207bbf555 nvmet: seset ns->file when open fails
[ Upstream commit 85428beac8 ]

Reset the ns->file value to NULL also in the error case in
nvmet_file_ns_enable().

The ns->file variable points either to file object or contains the
error code after the filp_open() call. This can lead to following
problem:

When the user first setups an invalid file backend and tries to enable
the ns, it will fail. Then the user switches over to a bdev backend
and enables successfully the ns. The first received I/O will crash the
system because the IO backend is chosen based on the ns->file value:

static u16 nvmet_parse_io_cmd(struct nvmet_req *req)
{
	[...]

	if (req->ns->file)
		return nvmet_file_parse_io_cmd(req);

	return nvmet_bdev_parse_io_cmd(req);
}

Reported-by: Enzo Matsumiya <ematsumiya@suse.com>
Signed-off-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-26 12:06:50 +02:00
Wu Bo 9c980795cc nvme-loop: fix memory leak in nvme_loop_create_ctrl()
[ Upstream commit 03504e3b54 ]

When creating loop ctrl in nvme_loop_create_ctrl(), if nvme_init_ctrl()
fails, the loop ctrl should be freed before jumping to the "out" label.

Fixes: 3a85a5de29 ("nvme-loop: add a NVMe loopback host driver")
Signed-off-by: Wu Bo <wubo40@huawei.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-26 12:06:48 +02:00
Wu Bo 4720f29acb nvmet: fix memory leak in nvmet_alloc_ctrl()
[ Upstream commit fec356a61a ]

When creating ctrl in nvmet_alloc_ctrl(), if the cntlid_min is larger
than cntlid_max of the subsystem, and jumps to the
"out_free_changed_ns_list" label, but the ctrl->sqs lack of be freed.
Fix this by jumping to the "out_free_sqs" label.

Fixes: 94a39d61f8 ("nvmet: make ctrl-id configurable")
Signed-off-by: Wu Bo <wubo40@huawei.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-26 12:06:48 +02:00
Amit 737ccd2134 nvmet: remove unused ctrl->cqs
[ Upstream commit 6d65aeab7b ]

remove unused cqs from nvmet_ctrl struct
this will reduce the allocated memory.

Signed-off-by: Amit <amit.engel@dell.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-26 12:06:48 +02:00
Keith Busch 3851a86c3d nvmet: remove unsupported command noise
[ Upstream commit 4a20342572 ]

Nothing can stop a host from submitting invalid commands. The target
just needs to respond with an appropriate status, but that's not a
target error. Demote invalid command messages to the debug level so
these events don't spam the kernel logs.

Reported-by: Yi Zhang <yi.zhang@redhat.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-22 11:40:54 +02:00
Michal Kalderon 64f3410c7b nvmet-rdma: Fix NULL deref when SEND is completed with error
[ Upstream commit 8cc365f955 ]

When running some traffic and taking down the link on peer, a
retry counter exceeded error is received. This leads to
nvmet_rdma_error_comp which tried accessing the cq_context to
obtain the queue. The cq_context is no longer valid after the
fix to use shared CQ mechanism and should be obtained similar
to how it is obtained in other functions from the wc->qp.

[ 905.786331] nvmet_rdma: SEND for CQE 0x00000000e3337f90 failed with status transport retry counter exceeded (12).
[ 905.832048] BUG: unable to handle kernel NULL pointer dereference at 0000000000000048
[ 905.839919] PGD 0 P4D 0
[ 905.842464] Oops: 0000 1 SMP NOPTI
[ 905.846144] CPU: 13 PID: 1557 Comm: kworker/13:1H Kdump: loaded Tainted: G OE --------- - - 4.18.0-304.el8.x86_64 #1
[ 905.872135] RIP: 0010:nvmet_rdma_error_comp+0x5/0x1b [nvmet_rdma]
[ 905.878259] Code: 19 4f c0 e8 89 b3 a5 f6 e9 5b e0 ff ff 0f b7 75 14 4c 89 ea 48 c7 c7 08 1a 4f c0 e8 71 b3 a5 f6 e9 4b e0 ff ff 0f 1f 44 00 00 <48> 8b 47 48 48 85 c0 74 08 48 89 c7 e9 98 bf 49 00 e9 c3 e3 ff ff
[ 905.897135] RSP: 0018:ffffab601c45fe28 EFLAGS: 00010246
[ 905.902387] RAX: 0000000000000065 RBX: ffff9e729ea2f800 RCX: 0000000000000000
[ 905.909558] RDX: 0000000000000000 RSI: ffff9e72df9567c8 RDI: 0000000000000000
[ 905.916731] RBP: ffff9e729ea2b400 R08: 000000000000074d R09: 0000000000000074
[ 905.923903] R10: 0000000000000000 R11: ffffab601c45fcc0 R12: 0000000000000010
[ 905.931074] R13: 0000000000000000 R14: 0000000000000010 R15: ffff9e729ea2f400
[ 905.938247] FS: 0000000000000000(0000) GS:ffff9e72df940000(0000) knlGS:0000000000000000
[ 905.938249] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 905.950067] nvmet_rdma: SEND for CQE 0x00000000c7356cca failed with status transport retry counter exceeded (12).
[ 905.961855] CR2: 0000000000000048 CR3: 000000678d010004 CR4: 00000000007706e0
[ 905.961855] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 905.961856] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 905.961857] PKRU: 55555554
[ 906.010315] Call Trace:
[ 906.012778] __ib_process_cq+0x89/0x170 [ib_core]
[ 906.017509] ib_cq_poll_work+0x26/0x80 [ib_core]
[ 906.022152] process_one_work+0x1a7/0x360
[ 906.026182] ? create_worker+0x1a0/0x1a0
[ 906.030123] worker_thread+0x30/0x390
[ 906.033802] ? create_worker+0x1a0/0x1a0
[ 906.037744] kthread+0x116/0x130
[ 906.040988] ? kthread_flush_work_fn+0x10/0x10
[ 906.045456] ret_from_fork+0x1f/0x40

Fixes: ca0f1a8055 ("nvmet-rdma: use new shared CQ mechanism")
Signed-off-by: Shai Malin <smalin@marvell.com>
Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-19 10:13:14 +02:00
Chaitanya Kulkarni c98ecfb182 nvmet: fix inline bio check for bdev-ns
[ Upstream commit 608a969046 ]

When handling rw commands, for inline bio case we only consider
transfer size. This works well when req->sg_cnt fits into the
req->inline_bvec, but it will result in the warning in
__bio_add_page() when req->sg_cnt > NVMET_MAX_INLINE_BVEC.

Consider an I/O size 32768 and first page is not aligned to the page
boundary, then I/O is split in following manner :-

[ 2206.256140] nvmet: sg->length 3440 sg->offset 656
[ 2206.256144] nvmet: sg->length 4096 sg->offset 0
[ 2206.256148] nvmet: sg->length 4096 sg->offset 0
[ 2206.256152] nvmet: sg->length 4096 sg->offset 0
[ 2206.256155] nvmet: sg->length 4096 sg->offset 0
[ 2206.256159] nvmet: sg->length 4096 sg->offset 0
[ 2206.256163] nvmet: sg->length 4096 sg->offset 0
[ 2206.256166] nvmet: sg->length 4096 sg->offset 0
[ 2206.256170] nvmet: sg->length 656 sg->offset 0

Now the req->transfer_size == NVMET_MAX_INLINE_DATA_LEN i.e. 32768, but
the req->sg_cnt is (9) > NVMET_MAX_INLINE_BIOVEC which is (8).
This will result in the following warning message :-

nvmet_bdev_execute_rw()
	bio_add_page()
		__bio_add_page()
			WARN_ON_ONCE(bio_full(bio, len));

This scenario is very hard to reproduce on the nvme-loop transport only
with rw commands issued with the passthru IOCTL interface from the host
application and the data buffer is allocated with the malloc() and not
the posix_memalign().

Fixes: 73383adfad ("nvmet: don't split large I/Os unconditionally")
Signed-off-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-19 10:13:14 +02:00
Chaitanya Kulkarni f8ae879b77 nvmet: add lba to sect conversion helpers
[ Upstream commit 193fcf371f ]

In this preparation patch, we add helpers to convert lbas to sectors &
sectors to lba. This is needed to eliminate code duplication in the ZBD
backend.

Use these helpers in the block device backend.

Signed-off-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Reviewed-by: Damien Le Moal <damien.lemoal@wdc.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-19 10:13:14 +02:00
Elad Grupi b2c55f81c1 nvmet-tcp: fix a segmentation fault during io parsing error
[ Upstream commit bdaf132791 ]

In case there is an io that contains inline data and it goes to
parsing error flow, command response will free command and iov
before clearing the data on the socket buffer.
This will delay the command response until receive flow is completed.

Fixes: 872d26a391 ("nvmet-tcp: add NVMe over TCP target driver")
Signed-off-by: Elad Grupi <elad.grupi@dell.com>
Signed-off-by: Hou Pu <houpu.main@gmail.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-14 09:50:27 +02:00
Sagi Grimberg 60ade0d56b nvmet-tcp: fix incorrect locking in state_change sk callback
[ Upstream commit b5332a9f3f ]

We are not changing anything in the TCP connection state so
we should not take a write_lock but rather a read lock.

This caused a deadlock when running nvmet-tcp and nvme-tcp
on the same system, where state_change callbacks on the
host and on the controller side have causal relationship
and made lockdep report on this with blktests:

================================
WARNING: inconsistent lock state
5.12.0-rc3 #1 Tainted: G          I
--------------------------------
inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-R} usage.
nvme/1324 [HC0[0]:SC0[0]:HE1:SE1] takes:
ffff888363151000 (clock-AF_INET){++-?}-{2:2}, at: nvme_tcp_state_change+0x21/0x150 [nvme_tcp]
{IN-SOFTIRQ-W} state was registered at:
  __lock_acquire+0x79b/0x18d0
  lock_acquire+0x1ca/0x480
  _raw_write_lock_bh+0x39/0x80
  nvmet_tcp_state_change+0x21/0x170 [nvmet_tcp]
  tcp_fin+0x2a8/0x780
  tcp_data_queue+0xf94/0x1f20
  tcp_rcv_established+0x6ba/0x1f00
  tcp_v4_do_rcv+0x502/0x760
  tcp_v4_rcv+0x257e/0x3430
  ip_protocol_deliver_rcu+0x69/0x6a0
  ip_local_deliver_finish+0x1e2/0x2f0
  ip_local_deliver+0x1a2/0x420
  ip_rcv+0x4fb/0x6b0
  __netif_receive_skb_one_core+0x162/0x1b0
  process_backlog+0x1ff/0x770
  __napi_poll.constprop.0+0xa9/0x5c0
  net_rx_action+0x7b3/0xb30
  __do_softirq+0x1f0/0x940
  do_softirq+0xa1/0xd0
  __local_bh_enable_ip+0xd8/0x100
  ip_finish_output2+0x6b7/0x18a0
  __ip_queue_xmit+0x706/0x1aa0
  __tcp_transmit_skb+0x2068/0x2e20
  tcp_write_xmit+0xc9e/0x2bb0
  __tcp_push_pending_frames+0x92/0x310
  inet_shutdown+0x158/0x300
  __nvme_tcp_stop_queue+0x36/0x270 [nvme_tcp]
  nvme_tcp_stop_queue+0x87/0xb0 [nvme_tcp]
  nvme_tcp_teardown_admin_queue+0x69/0xe0 [nvme_tcp]
  nvme_do_delete_ctrl+0x100/0x10c [nvme_core]
  nvme_sysfs_delete.cold+0x8/0xd [nvme_core]
  kernfs_fop_write_iter+0x2c7/0x460
  new_sync_write+0x36c/0x610
  vfs_write+0x5c0/0x870
  ksys_write+0xf9/0x1d0
  do_syscall_64+0x33/0x40
  entry_SYSCALL_64_after_hwframe+0x44/0xae
irq event stamp: 10687
hardirqs last  enabled at (10687): [<ffffffff9ec376bd>] _raw_spin_unlock_irqrestore+0x2d/0x40
hardirqs last disabled at (10686): [<ffffffff9ec374d8>] _raw_spin_lock_irqsave+0x68/0x90
softirqs last  enabled at (10684): [<ffffffff9f000608>] __do_softirq+0x608/0x940
softirqs last disabled at (10649): [<ffffffff9cdedd31>] do_softirq+0xa1/0xd0

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(clock-AF_INET);
  <Interrupt>
    lock(clock-AF_INET);

 *** DEADLOCK ***

5 locks held by nvme/1324:
 #0: ffff8884a01fe470 (sb_writers#4){.+.+}-{0:0}, at: ksys_write+0xf9/0x1d0
 #1: ffff8886e435c090 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x216/0x460
 #2: ffff888104d90c38 (kn->active#255){++++}-{0:0}, at: kernfs_remove_self+0x22d/0x330
 #3: ffff8884634538d0 (&queue->queue_lock){+.+.}-{3:3}, at: nvme_tcp_stop_queue+0x52/0xb0 [nvme_tcp]
 #4: ffff888363150d30 (sk_lock-AF_INET){+.+.}-{0:0}, at: inet_shutdown+0x59/0x300

stack backtrace:
CPU: 26 PID: 1324 Comm: nvme Tainted: G          I       5.12.0-rc3 #1
Hardware name: Dell Inc. PowerEdge R640/06NR82, BIOS 2.10.0 11/12/2020
Call Trace:
 dump_stack+0x93/0xc2
 mark_lock_irq.cold+0x2c/0xb3
 ? verify_lock_unused+0x390/0x390
 ? stack_trace_consume_entry+0x160/0x160
 ? lock_downgrade+0x100/0x100
 ? save_trace+0x88/0x5e0
 ? _raw_spin_unlock_irqrestore+0x2d/0x40
 mark_lock+0x530/0x1470
 ? mark_lock_irq+0x1d10/0x1d10
 ? enqueue_timer+0x660/0x660
 mark_usage+0x215/0x2a0
 __lock_acquire+0x79b/0x18d0
 ? tcp_schedule_loss_probe.part.0+0x38c/0x520
 lock_acquire+0x1ca/0x480
 ? nvme_tcp_state_change+0x21/0x150 [nvme_tcp]
 ? rcu_read_unlock+0x40/0x40
 ? tcp_mtu_probe+0x1ae0/0x1ae0
 ? kmalloc_reserve+0xa0/0xa0
 ? sysfs_file_ops+0x170/0x170
 _raw_read_lock+0x3d/0xa0
 ? nvme_tcp_state_change+0x21/0x150 [nvme_tcp]
 nvme_tcp_state_change+0x21/0x150 [nvme_tcp]
 ? sysfs_file_ops+0x170/0x170
 inet_shutdown+0x189/0x300
 __nvme_tcp_stop_queue+0x36/0x270 [nvme_tcp]
 nvme_tcp_stop_queue+0x87/0xb0 [nvme_tcp]
 nvme_tcp_teardown_admin_queue+0x69/0xe0 [nvme_tcp]
 nvme_do_delete_ctrl+0x100/0x10c [nvme_core]
 nvme_sysfs_delete.cold+0x8/0xd [nvme_core]
 kernfs_fop_write_iter+0x2c7/0x460
 new_sync_write+0x36c/0x610
 ? new_sync_read+0x600/0x600
 ? lock_acquire+0x1ca/0x480
 ? rcu_read_unlock+0x40/0x40
 ? lock_is_held_type+0x9a/0x110
 vfs_write+0x5c0/0x870
 ksys_write+0xf9/0x1d0
 ? __ia32_sys_read+0xa0/0xa0
 ? lockdep_hardirqs_on_prepare.part.0+0x198/0x340
 ? syscall_enter_from_user_mode+0x27/0x70
 do_syscall_64+0x33/0x40
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Fixes: 872d26a391 ("nvmet-tcp: add NVMe over TCP target driver")
Reported-by: Yi Zhang <yi.zhang@redhat.com>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-14 09:50:25 +02:00
Hou Pu 9ec74da2ac nvmet: return proper error code from discovery ctrl
[ Upstream commit 79695dcd9a ]

Return NVME_SC_INVALID_FIELD from discovery controller like normal
controller when executing identify or get log page command.

Signed-off-by: Hou Pu <houpu.main@gmail.com>
Reviewed-by: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-11 14:47:26 +02:00