linux-stable.git, branch v6.0.4

Linux 6.0.4

2022-10-26T10:22:58+00:00

Link: https://lore.kernel.org/r/20221024112934.415391158@linuxfoundation.org
Tested-by: Ronald Warsow 
Tested-by: Luna Jernberg 
Tested-by: Rudi Heitbaum 
Tested-by: Jon Hunter 
Tested-by: Florian Fainelli 
Tested-by: Shuah Khan 
Tested-by: Ron Economos 
Tested-by: Ronald Warsow 
Tested-by: Slade Watkins 
Tested-by: Fenil Jain 
Tested-by: Bagas Sanjaya 
Tested-by: Linux Kernel Functional Testing 
Tested-by: Guenter Roeck 
Tested-by: Justin M. Forbes 
Signed-off-by: Greg Kroah-Hartman

Revert "ALSA: hda: Fix page fault in snd_hda_codec_shutdown()"

2022-10-26T10:22:57+00:00

This reverts commit 7494e2e6c55ed192f2b91c821fd6832744ba8741.

Which was upstream commit f2bd1c5ae2cb0cf9525c9bffc0038c12dd7e1338.

The patch caused a regression leading to the missing HD-audio device
with ASoC SOF driver.  It was a part of large series and backporting
it alone breaks things while backporting the whole is too intrusive
as stable changes.  And, the issue the patch tries to address is a
corner case, hence it's better to revert.

BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=216613
Signed-off-by: Takashi Iwai 
Signed-off-by: Greg Kroah-Hartman

fbdev/core: Remove remove_conflicting_pci_framebuffers()

2022-10-26T10:22:57+00:00

commit 9d69ef1838150c7d87afc1a87aa658c637217585 upstream.

Remove remove_conflicting_pci_framebuffers() and implement similar
functionality in aperture_remove_conflicting_pci_device(), which was
the only caller. Removes an otherwise unused interface and streamlines
the aperture helper. No functional changes.

Signed-off-by: Thomas Zimmermann 
Reviewed-by: Javier Martinez Canillas 
Link: https://patchwork.freedesktop.org/patch/msgid/20220718072322.8927-5-tzimmermann@suse.de
Signed-off-by: Greg Kroah-Hartman

io-wq: Fix memory leak in worker creation

2022-10-26T10:22:57+00:00

commit 996d3efeb091c503afd3ee6b5e20eabf446fd955 upstream.

If the CPU mask allocation for a node fails, then the memory allocated for
the 'io_wqe' struct of the current node doesn't get freed on the error
handling path, since it has not yet been added to the 'wqes' array.

This was spotted when fuzzing v6.1-rc1 with Syzkaller:
BUG: memory leak
unreferenced object 0xffff8880093d5000 (size 1024):
  comm "syz-executor.2", pid 7701, jiffies 4295048595 (age 13.900s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000cb463369>] __kmem_cache_alloc_node+0x18e/0x720
    [<00000000147a3f9c>] kmalloc_node_trace+0x2a/0x130
    [<000000004e107011>] io_wq_create+0x7b9/0xdc0
    [<00000000c38b2018>] io_uring_alloc_task_context+0x31e/0x59d
    [<00000000867399da>] __io_uring_add_tctx_node.cold+0x19/0x1ba
    [<000000007e0e7a79>] io_uring_setup.cold+0x1b80/0x1dce
    [<00000000b545e9f6>] __x64_sys_io_uring_setup+0x5d/0x80
    [<000000008a8a7508>] do_syscall_64+0x5d/0x90
    [<000000004ac08bec>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

Fixes: 0e03496d1967 ("io-wq: use private CPU mask")
Cc: stable@vger.kernel.org
Signed-off-by: Rafael Mendonca 
Link: https://lore.kernel.org/r/20221020014710.902201-1-rafaelmendsr@gmail.com
Signed-off-by: Jens Axboe 
Signed-off-by: Greg Kroah-Hartman

gcov: support GCC 12.1 and newer compilers

2022-10-26T10:22:57+00:00

commit 977ef30a7d888eeb52fb6908f99080f33e5309a8 upstream.

Starting with GCC 12.1, the created .gcda format can't be read by gcov
tool.  There are 2 significant changes to the .gcda file format that
need to be supported:

a) [gcov: Use system IO buffering]
   (23eb66d1d46a34cb28c4acbdf8a1deb80a7c5a05) changed that all sizes in
   the format are in bytes and not in words (4B)

b) [gcov: make profile merging smarter]
   (72e0c742bd01f8e7e6dcca64042b9ad7e75979de) add a new checksum to the
   file header.

Tested with GCC 7.5, 10.4, 12.2 and the current master.

Link: https://lkml.kernel.org/r/624bda92-f307-30e9-9aaa-8cc678b2dfb2@suse.cz
Signed-off-by: Martin Liska 
Tested-by: Peter Oberparleiter 
Reviewed-by: Peter Oberparleiter 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Greg Kroah-Hartman

efi: ssdt: Don't free memory if ACPI table was loaded successfully

2022-10-26T10:22:57+00:00

commit 4b017e59f01097f19b938f6dc4dc2c4720701610 upstream.

Amadeusz reports KASAN use-after-free errors introduced by commit
3881ee0b1edc ("efi: avoid efivars layer when loading SSDTs from
variables"). The problem appears to be that the memory that holds the
new ACPI table is now freed unconditionally, instead of only when the
ACPI core reported a failure to load the table.

So let's fix this, by omitting the kfree() on success.

Cc:  # v6.0
Link: https://lore.kernel.org/all/a101a10a-4fbb-5fae-2e3c-76cf96ed8fbd@linux.intel.com/
Fixes: 3881ee0b1edc ("efi: avoid efivars layer when loading SSDTs from variables")
Reported-by: Amadeusz Sławiński 
Signed-off-by: Ard Biesheuvel 
Signed-off-by: Greg Kroah-Hartman

efi: efivars: Fix variable writes without query_variable_store()

2022-10-26T10:22:57+00:00

commit 8a254d90a77580244ec57e82bca7eb65656cc167 upstream.

Commit bbc6d2c6ef22 ("efi: vars: Switch to new wrapper layer")
refactored the efivars layer so that the 'business logic' related to
which UEFI variables affect the boot flow in which way could be moved
out of it, and into the efivarfs driver.

This inadvertently broke setting variables on firmware implementations
that lack the QueryVariableInfo() boot service, because we no longer
tolerate a EFI_UNSUPPORTED result from check_var_size() when calling
efivar_entry_set_get_size(), which now ends up calling check_var_size()
a second time inadvertently.

If QueryVariableInfo() is missing, we support writes of up to 64k -
let's move that logic into check_var_size(), and drop the redundant
call.

Cc:  # v6.0
Fixes: bbc6d2c6ef22 ("efi: vars: Switch to new wrapper layer")
Signed-off-by: Ard Biesheuvel 
Signed-off-by: Greg Kroah-Hartman

dm clone: Fix typo in block_device format specifier

2022-10-26T10:22:57+00:00

commit 5434ee8d28575b2e784bd5b4dbfc912e5da90759 upstream.

Use %pg for printing the block device name, instead of %pd.

Fixes: 385411ffba0c ("dm: stop using bdevname")
Cc: stable@vger.kernel.org # v5.18+
Signed-off-by: Nikos Tsironis 
Signed-off-by: Mike Snitzer 
Signed-off-by: Greg Kroah-Hartman

drm/amd/pm: update SMU IP v13.0.4 driver interface version

2022-10-26T10:22:56+00:00

commit 853fdb49160e9c30674fd8e4a2eabc06bf70b13a upstream.

Update the SMU driver interface version to V7.

Signed-off-by: Tim Huang 
Reviewed-by: Mario Limonciello 
Signed-off-by: Alex Deucher 
Cc: stable@vger.kernel.org # 6.0.x
Signed-off-by: Alex Deucher 
Signed-off-by: Greg Kroah-Hartman

drm/amd/pm: fulfill SMU13.0.0 cstate control interface

2022-10-26T10:22:56+00:00

commit 528c0e66e0c01a8c078d2d94431db80f9c75d2a0 upstream.

Fulfill the functionality for cstate control.

Signed-off-by: Evan Quan 
Reviewed-by: Hawking Zhang 
Reviewed-by: Lijo Lazar 
Signed-off-by: Alex Deucher 
Cc: stable@vger.kernel.org # 6.0.x
Signed-off-by: Alex Deucher 
Signed-off-by: Greg Kroah-Hartman