commit 9fbc6bfb7e30d27a0f44229b462b8d1167a0f95f Author: Greg Kroah-Hartman Date: Wed Oct 26 12:22:58 2022 +0200 Linux 6.0.4 Link: https://lore.kernel.org/r/20221024112934.415391158@linuxfoundation.org Tested-by: Ronald Warsow Tested-by: Luna Jernberg Tested-by: Rudi Heitbaum Tested-by: Jon Hunter Tested-by: Florian Fainelli Tested-by: Shuah Khan Tested-by: Ron Economos Tested-by: Ronald Warsow Tested-by: Slade Watkins Tested-by: Fenil Jain Tested-by: Bagas Sanjaya Tested-by: Linux Kernel Functional Testing Tested-by: Guenter Roeck Tested-by: Justin M. Forbes Signed-off-by: Greg Kroah-Hartman commit 02356311982bbb117310a27985fa8938e82c0b6e Author: Takashi Iwai Date: Mon Oct 24 16:39:31 2022 +0200 Revert "ALSA: hda: Fix page fault in snd_hda_codec_shutdown()" This reverts commit 7494e2e6c55ed192f2b91c821fd6832744ba8741. Which was upstream commit f2bd1c5ae2cb0cf9525c9bffc0038c12dd7e1338. The patch caused a regression leading to the missing HD-audio device with ASoC SOF driver. It was a part of large series and backporting it alone breaks things while backporting the whole is too intrusive as stable changes. And, the issue the patch tries to address is a corner case, hence it's better to revert. BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=216613 Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman commit af9ac541e88390d97b01d5e8c77309d2637c1d4c Author: Thomas Zimmermann Date: Mon Jul 18 09:23:15 2022 +0200 fbdev/core: Remove remove_conflicting_pci_framebuffers() commit 9d69ef1838150c7d87afc1a87aa658c637217585 upstream. Remove remove_conflicting_pci_framebuffers() and implement similar functionality in aperture_remove_conflicting_pci_device(), which was the only caller. Removes an otherwise unused interface and streamlines the aperture helper. No functional changes. Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Link: https://patchwork.freedesktop.org/patch/msgid/20220718072322.8927-5-tzimmermann@suse.de Signed-off-by: Greg Kroah-Hartman commit ed981911a7c90a604f4a2bee908ab07e3b786aca Author: Rafael Mendonca Date: Wed Oct 19 22:47:09 2022 -0300 io-wq: Fix memory leak in worker creation commit 996d3efeb091c503afd3ee6b5e20eabf446fd955 upstream. If the CPU mask allocation for a node fails, then the memory allocated for the 'io_wqe' struct of the current node doesn't get freed on the error handling path, since it has not yet been added to the 'wqes' array. This was spotted when fuzzing v6.1-rc1 with Syzkaller: BUG: memory leak unreferenced object 0xffff8880093d5000 (size 1024): comm "syz-executor.2", pid 7701, jiffies 4295048595 (age 13.900s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000cb463369>] __kmem_cache_alloc_node+0x18e/0x720 [<00000000147a3f9c>] kmalloc_node_trace+0x2a/0x130 [<000000004e107011>] io_wq_create+0x7b9/0xdc0 [<00000000c38b2018>] io_uring_alloc_task_context+0x31e/0x59d [<00000000867399da>] __io_uring_add_tctx_node.cold+0x19/0x1ba [<000000007e0e7a79>] io_uring_setup.cold+0x1b80/0x1dce [<00000000b545e9f6>] __x64_sys_io_uring_setup+0x5d/0x80 [<000000008a8a7508>] do_syscall_64+0x5d/0x90 [<000000004ac08bec>] entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: 0e03496d1967 ("io-wq: use private CPU mask") Cc: stable@vger.kernel.org Signed-off-by: Rafael Mendonca Link: https://lore.kernel.org/r/20221020014710.902201-1-rafaelmendsr@gmail.com Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman commit 1ee61fc4f69b223f6bbb8748b220410f121adb26 Author: Martin Liska Date: Thu Oct 13 09:40:59 2022 +0200 gcov: support GCC 12.1 and newer compilers commit 977ef30a7d888eeb52fb6908f99080f33e5309a8 upstream. Starting with GCC 12.1, the created .gcda format can't be read by gcov tool. There are 2 significant changes to the .gcda file format that need to be supported: a) [gcov: Use system IO buffering] (23eb66d1d46a34cb28c4acbdf8a1deb80a7c5a05) changed that all sizes in the format are in bytes and not in words (4B) b) [gcov: make profile merging smarter] (72e0c742bd01f8e7e6dcca64042b9ad7e75979de) add a new checksum to the file header. Tested with GCC 7.5, 10.4, 12.2 and the current master. Link: https://lkml.kernel.org/r/624bda92-f307-30e9-9aaa-8cc678b2dfb2@suse.cz Signed-off-by: Martin Liska Tested-by: Peter Oberparleiter Reviewed-by: Peter Oberparleiter Cc: Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit 11497fd69cd2282538ec6eb4cda1d16fc061233d Author: Ard Biesheuvel Date: Fri Oct 14 12:25:52 2022 +0200 efi: ssdt: Don't free memory if ACPI table was loaded successfully commit 4b017e59f01097f19b938f6dc4dc2c4720701610 upstream. Amadeusz reports KASAN use-after-free errors introduced by commit 3881ee0b1edc ("efi: avoid efivars layer when loading SSDTs from variables"). The problem appears to be that the memory that holds the new ACPI table is now freed unconditionally, instead of only when the ACPI core reported a failure to load the table. So let's fix this, by omitting the kfree() on success. Cc: # v6.0 Link: https://lore.kernel.org/all/a101a10a-4fbb-5fae-2e3c-76cf96ed8fbd@linux.intel.com/ Fixes: 3881ee0b1edc ("efi: avoid efivars layer when loading SSDTs from variables") Reported-by: Amadeusz Sławiński Signed-off-by: Ard Biesheuvel Signed-off-by: Greg Kroah-Hartman commit c2a000ad03bb3a0d0f389adcfc9f8c61622da363 Author: Ard Biesheuvel Date: Wed Oct 19 23:29:58 2022 +0200 efi: efivars: Fix variable writes without query_variable_store() commit 8a254d90a77580244ec57e82bca7eb65656cc167 upstream. Commit bbc6d2c6ef22 ("efi: vars: Switch to new wrapper layer") refactored the efivars layer so that the 'business logic' related to which UEFI variables affect the boot flow in which way could be moved out of it, and into the efivarfs driver. This inadvertently broke setting variables on firmware implementations that lack the QueryVariableInfo() boot service, because we no longer tolerate a EFI_UNSUPPORTED result from check_var_size() when calling efivar_entry_set_get_size(), which now ends up calling check_var_size() a second time inadvertently. If QueryVariableInfo() is missing, we support writes of up to 64k - let's move that logic into check_var_size(), and drop the redundant call. Cc: # v6.0 Fixes: bbc6d2c6ef22 ("efi: vars: Switch to new wrapper layer") Signed-off-by: Ard Biesheuvel Signed-off-by: Greg Kroah-Hartman commit 450cc7d23654bdedb81a439cba6eef19ce3e01a6 Author: Nikos Tsironis Date: Thu Sep 29 17:11:48 2022 +0300 dm clone: Fix typo in block_device format specifier commit 5434ee8d28575b2e784bd5b4dbfc912e5da90759 upstream. Use %pg for printing the block device name, instead of %pd. Fixes: 385411ffba0c ("dm: stop using bdevname") Cc: stable@vger.kernel.org # v5.18+ Signed-off-by: Nikos Tsironis Signed-off-by: Mike Snitzer Signed-off-by: Greg Kroah-Hartman commit 0fe229d9eedb7fae9779bdb86d39c2c80310dba5 Author: Tim Huang Date: Thu Sep 29 14:39:21 2022 +0800 drm/amd/pm: update SMU IP v13.0.4 driver interface version commit 853fdb49160e9c30674fd8e4a2eabc06bf70b13a upstream. Update the SMU driver interface version to V7. Signed-off-by: Tim Huang Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.0.x Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit d6a79ae75b891b755fba356f1c1621fadfe76727 Author: Evan Quan Date: Thu Sep 29 10:24:51 2022 +0800 drm/amd/pm: fulfill SMU13.0.0 cstate control interface commit 528c0e66e0c01a8c078d2d94431db80f9c75d2a0 upstream. Fulfill the functionality for cstate control. Signed-off-by: Evan Quan Reviewed-by: Hawking Zhang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.0.x Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit 0c858ae2f1d5a459f742677be76d40e7afa45fa7 Author: Evan Quan Date: Thu Sep 29 10:50:44 2022 +0800 drm/amd/pm: disable cstate feature for gpu reset scenario commit 3059cd8c5f797ad83d2b194ae66339f5c007ca43 upstream. Suggested by PMFW team and same as what did for gfxoff feature. This can address some Mode1Reset failures observed on SMU13.0.0. Signed-off-by: Evan Quan Reviewed-by: Hawking Zhang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.0.x Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit 7391798e244c6fed273166fc8724098c12617b80 Author: Tim Huang Date: Thu Sep 29 15:06:47 2022 +0800 drm/amd/pm: add SMU IP v13.0.4 IF version define to V7 commit 31c261a7ffb8d5bba8144e2d43db304f2bc7e81a upstream. The pmfw has changed the driver interface version, so keep same with the fw. Signed-off-by: Tim Huang Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.0.x Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit 6d5e13098443196991e161e9d6c40c4d5e6aa79c Author: Evan Quan Date: Thu Sep 29 10:30:01 2022 +0800 drm/amd/pm: fulfill SMU13.0.7 cstate control interface commit ba2f09960e75accf757ed12b4ef61409dcc97df8 upstream. Fulfill the functionality for cstate control. Signed-off-by: Evan Quan Reviewed-by: Hawking Zhang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.0.x Signed-off-by: Alex Deucher Signed-off-by: Greg Kroah-Hartman commit f9467c175d6b45bc2ae6fdf7f2a4896b70a4fd46 Author: Pavel Begunkov Date: Fri Oct 21 11:16:39 2022 +0100 net: flag sockets supporting msghdr originated zerocopy commit e993ffe3da4bcddea0536b03be1031bf35cd8d85 upstream. We need an efficient way in io_uring to check whether a socket supports zerocopy with msghdr provided ubuf_info. Add a new flag into the struct socket flags fields. Cc: # 6.0 Signed-off-by: Pavel Begunkov Acked-by: Jakub Kicinski Link: https://lore.kernel.org/r/3dafafab822b1c66308bb58a0ac738b1e3f53f74.1666346426.git.asml.silence@gmail.com Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman commit 68e300808f22fac4aaa4f5f0874fec1e9cb23e99 Author: Roderick Colenbrander Date: Mon Oct 10 14:23:12 2022 -0700 HID: playstation: add initial DualSense Edge controller support commit b8a968efab301743fd659b5649c5d7d3e30e63a6 upstream. Provide initial support for the DualSense Edge controller. The brings support up to the level of the original DualSense, but won't yet provide support for new features (e.g. reprogrammable buttons). Signed-off-by: Roderick Colenbrander CC: stable@vger.kernel.org Signed-off-by: Benjamin Tissoires Link: https://lore.kernel.org/r/20221010212313.78275-3-roderick.colenbrander@sony.com Signed-off-by: Greg Kroah-Hartman commit 5cf8df4e2d08f29810bc9639de3e1fc04f38e97f Author: Roderick Colenbrander Date: Mon Oct 10 14:23:11 2022 -0700 HID: playstation: stop DualSense output work on remove. commit 182934a1e93b17f4edf71f4fcc8d19b19a6fe67a upstream. Ensure we don't schedule any new output work on removal and wait for any existing work to complete. If we don't do this e.g. rumble work can get queued during deletion and we trigger a kernel crash. Signed-off-by: Roderick Colenbrander CC: stable@vger.kernel.org Signed-off-by: Benjamin Tissoires Link: https://lore.kernel.org/r/20221010212313.78275-2-roderick.colenbrander@sony.com Signed-off-by: Greg Kroah-Hartman commit aa0df600bf0cc9a5630cbf83e22533b6f0418269 Author: Pavel Begunkov Date: Fri Oct 21 11:16:40 2022 +0100 io_uring/net: fail zc send when unsupported by socket commit edf81438799ccead7122948446d7e44b083e788d upstream. If a protocol doesn't support zerocopy it will silently fall back to copying. This type of behaviour has always been a source of troubles so it's better to fail such requests instead. Cc: # 6.0 Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/2db3c7f16bb6efab4b04569cd16e6242b40c5cb3.1666346426.git.asml.silence@gmail.com Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman commit df6071bd602803b66b475adc109f4ea43bf65dd7 Author: Rafael J. Wysocki Date: Thu Oct 13 14:50:28 2022 +0200 thermal: intel_powerclamp: Use first online CPU as control_cpu commit 4bb7f6c2781e46fc5bd00475a66df2ea30ef330d upstream. Commit 68b99e94a4a2 ("thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash") fixed an issue related to using smp_processor_id() in preemptible context by replacing it with a pair of get_cpu()/put_cpu(), but what is needed there really is any online CPU and not necessarily the one currently running the code. Arguably, getting the one that's running the code in there is confusing. For this reason, simply give the control CPU role to the first online one which automatically will be CPU0 if it is online, so one check can be dropped from the code for an added benefit. Link: https://lore.kernel.org/linux-pm/20221011113646.GA12080@duo.ucw.cz/ Fixes: 68b99e94a4a2 ("thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash") Signed-off-by: Rafael J. Wysocki Reviewed-by: Chen Yu Signed-off-by: Greg Kroah-Hartman commit 44bb0a489c31ba66d86f8045f5af0ff25edc68bf Author: Basavaraj Natikar Date: Tue Aug 30 16:35:25 2022 +0530 pinctrl: amd: change dev_warn to dev_dbg for additional feature support commit 3160b37e5cb695e866e06c3fdbc385846b569294 upstream. Use dev_dbg instead of dev_warn for additional support of pinmux feature. Signed-off-by: Basavaraj Natikar Link: https://lore.kernel.org/r/20220830110525.1933198-1-Basavaraj.Natikar@amd.com Signed-off-by: Linus Walleij Cc: Mario Limonciello Signed-off-by: Greg Kroah-Hartman commit b47e51c5f47a1d393c3c35a4ad3c009b83595b67 Author: Ville Syrjälä Date: Thu Aug 18 22:22:23 2022 +0300 drm/i915/bios: Use hardcoded fp_timing size for generating LFP data pointers commit d3a7051841f0a4bcb1ee26a1b721c6150cc4c2b1 upstream. The current scheme for generating the LFP data table pointers (when the block including them is missing from the VBT) expects the 0xffff sequence to only appear in the fp_timing terminator entries. However some VBTs also have extra 0xffff sequences elsewhere in the LFP data. When looking for the terminators we may end up finding those extra sequeneces insted, which means we deduce the wrong size for the fp_timing table. The code then notices the inconsistent looking values and gives up on the generated data table pointers, preventing us from parsing the LFP data table entirely. Let's give up on the "search for the terminators" approach and instead just hardcode the expected size for the fp_timing table. We have enough sanity checks in place to make sure we shouldn't end up parsing total garbage even if that size should change in the future (although that seems unlikely as the fp_timing and dvo_timing tables have been declared obsolete as of VBT version 229). Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6592 Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20220818192223.29881-3-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman commit 955a83d4403e6c43f88cdf2b57252e4d8b10da54 Author: Ville Syrjälä Date: Thu Aug 18 22:22:22 2022 +0300 drm/i915/bios: Validate fp_timing terminator presence commit 4e78d6023c15c6acce8fbe42e13027c460395522 upstream. Validate the LFP data block a bit hardwer by making sure the fp_timing terminators (0xffff) are where we expect them to be. Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20220818192223.29881-2-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman