linux-stable.git/Documentation, branch v6.6.34

mm: fix race between __split_huge_pmd_locked() and GUP-fast

2024-06-16T11:47:40+00:00

commit 3a5a8d343e1cf96eb9971b17cbd4b832ab19b8e7 upstream.

__split_huge_pmd_locked() can be called for a present THP, devmap or
(non-present) migration entry.  It calls pmdp_invalidate() unconditionally
on the pmdp and only determines if it is present or not based on the
returned old pmd.  This is a problem for the migration entry case because
pmd_mkinvalid(), called by pmdp_invalidate() must only be called for a
present pmd.

On arm64 at least, pmd_mkinvalid() will mark the pmd such that any future
call to pmd_present() will return true.  And therefore any lockless
pgtable walker could see the migration entry pmd in this state and start
interpretting the fields as if it were present, leading to BadThings (TM).
GUP-fast appears to be one such lockless pgtable walker.

x86 does not suffer the above problem, but instead pmd_mkinvalid() will
corrupt the offset field of the swap entry within the swap pte.  See link
below for discussion of that problem.

Fix all of this by only calling pmdp_invalidate() for a present pmd.  And
for good measure let's add a warning to all implementations of
pmdp_invalidate[_ad]().  I've manually reviewed all other
pmdp_invalidate[_ad]() call sites and believe all others to be conformant.

This is a theoretical bug found during code review.  I don't have any test
case to trigger it in practice.

Link: https://lkml.kernel.org/r/20240501143310.1381675-1-ryan.roberts@arm.com
Link: https://lore.kernel.org/all/0dd7827a-6334-439a-8fd0-43c98e6af22b@arm.com/
Fixes: 84c3fc4e9c56 ("mm: thp: check pmd migration entry in common path")
Signed-off-by: Ryan Roberts 
Reviewed-by: Zi Yan 
Reviewed-by: Anshuman Khandual 
Acked-by: David Hildenbrand 
Cc: Andreas Larsson 
Cc: Andy Lutomirski 
Cc: Aneesh Kumar K.V 
Cc: Borislav Petkov (AMD) 
Cc: Catalin Marinas 
Cc: Christian Borntraeger 
Cc: Christophe Leroy 
Cc: Dave Hansen 
Cc: "David S. Miller" 
Cc: Ingo Molnar 
Cc: Jonathan Corbet 
Cc: Mark Rutland 
Cc: Naveen N. Rao 
Cc: Nicholas Piggin 
Cc: Peter Zijlstra 
Cc: Sven Schnelle 
Cc: Thomas Gleixner 
Cc: Will Deacon 
Cc: 
Signed-off-by: Andrew Morton 
Signed-off-by: Greg Kroah-Hartman

dt-bindings: adc: axi-adc: add clocks property

2024-06-12T09:12:36+00:00

[ Upstream commit 19fb11d7220b8abc016aa254dc7e6d9f2d49b178 ]

Add a required clock property as we can't access the device registers if
the AXI bus clock is not properly enabled.

Note this clock is a very fundamental one that is typically enabled
pretty early during boot. Independently of that, we should really rely on
it to be enabled.

Reviewed-by: Krzysztof Kozlowski 
Fixes: 96553a44e96d ("dt-bindings: iio: adc: add bindings doc for AXI ADC driver")
Signed-off-by: Nuno Sa 
Link: https://lore.kernel.org/r/20240426-ad9467-new-features-v2-3-6361fc3ba1cc@analog.com
Cc: 
Signed-off-by: Jonathan Cameron 
Signed-off-by: Sasha Levin

dt-bindings: adc: axi-adc: update bindings for backend framework

2024-06-12T09:12:36+00:00

[ Upstream commit a032b921bdeba2274866daafc8e791edd609eb13 ]

'adi,adc-dev' is now deprecated and must not be used anymore. Hence,
also remove it from being required.

The reason why it's being deprecated is because the axi-adc CORE is now
an IIO service provider hardware (IIO backends) for consumers to make use
of. Before, the logic with 'adi,adc-dev' was the opposite (it was kind
of consumer referencing other nodes/devices) and that proved to be wrong
and to not scale.

Now, IIO consumers of this hardware are expected to reference it using the
io-backends property. Hence, the new '#io-backend-cells' is being added
so the device is easily identified as a provider.

Reviewed-by: Rob Herring 
Signed-off-by: Nuno Sa 
Link: https://lore.kernel.org/r/20240210-iio-backend-v11-2-f5242a5fb42a@analog.com
Signed-off-by: Jonathan Cameron 
Stable-dep-of: 19fb11d7220b ("dt-bindings: adc: axi-adc: add clocks property")
Signed-off-by: Sasha Levin

dt-bindings: PCI: rockchip,rk3399-pcie: Add missing maxItems to ep-gpios

2024-06-12T09:12:33+00:00

[ Upstream commit 52d06636a4ae4db24ebfe23fae7a525f7e983604 ]

Properties with GPIOs should define number of actual GPIOs, so add
missing maxItems to ep-gpios.  Otherwise multiple GPIOs could be
provided which is not a true hardware description.

Fixes: aa222f9311e1 ("dt-bindings: PCI: Convert Rockchip RK3399 PCIe to DT schema")
Link: https://lore.kernel.org/linux-pci/20240401100058.15749-1-krzysztof.kozlowski@linaro.org
Signed-off-by: Krzysztof Kozlowski 
Signed-off-by: Krzysztof Wilczyński 
Acked-by: Conor Dooley 
Signed-off-by: Sasha Levin

f2fs: deprecate io_bits

2024-06-12T09:12:29+00:00

[ Upstream commit 87161a2b0aed9e9b614bbf6fe8697ad560ceb0cb ]

Let's deprecate an unused io_bits feature to save CPU cycles and memory.

Reviewed-by: Daeho Jeong 
Reviewed-by: Chao Yu 
Signed-off-by: Jaegeuk Kim 
Stable-dep-of: 043c832371cd ("f2fs: compress: fix error path of inc_valid_block_count()")
Signed-off-by: Sasha Levin

f2fs: kill heap-based allocation

2024-06-12T09:12:28+00:00

[ Upstream commit 4e0197f9932f70cc7be8744aa0ed4dd9b5d97d85 ]

No one uses this feature. Let's kill it.

Reviewed-by: Daeho Jeong 
Reviewed-by: Chao Yu 
Signed-off-by: Jaegeuk Kim 
Stable-dep-of: aa4074e8fec4 ("f2fs: fix block migration when section is not aligned to pow2")
Signed-off-by: Sasha Levin

dt-bindings: spmi: hisilicon,hisi-spmi-controller: fix binding references

2024-06-12T09:12:27+00:00

[ Upstream commit c6c1b27f9a9a20ad2db663628fccaed72c6a0f1f ]

Fix up the free text binding references which were not updated when
moving the bindings out of staging and which had a leading current
directory component, respectively.

Fixes: 9bd9e0de1cf5 ("mfd: hi6421-spmi-pmic: move driver from staging")
Signed-off-by: Johan Hovold 
Link: https://lore.kernel.org/r/20231130173757.13011-2-johan+linaro@kernel.org
Acked-by: Krzysztof Kozlowski 
Signed-off-by: Stephen Boyd 
Link: https://lore.kernel.org/r/20240507210809.3479953-3-sboyd@kernel.org
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

dt-bindings: phy: qcom,usb-snps-femto-v2: use correct fallback for sc8180x

2024-06-12T09:12:25+00:00

[ Upstream commit 960b3f023d3bda0efd6e573a0647227d1115d266 ]

The qcom,sc8180x-usb-hs-phy device uses qcom,usb-snps-hs-7nm-phy
fallback. Correct the schema for this platform.

Fixes: 9160fb7c39a1 ("dt-bindings: phy: qcom,usb-snps-femto-v2: use fallback compatibles")
Signed-off-by: Dmitry Baryshkov 
Acked-by: Krzysztof Kozlowski 
Link: https://lore.kernel.org/r/20240501-qcom-phy-fixes-v1-3-f1fd15c33fb3@linaro.org
Signed-off-by: Vinod Koul 
Signed-off-by: Sasha Levin

dt-bindings: phy: qcom,sc8280xp-qmp-ufs-phy: fix msm899[68] power-domains

2024-06-12T09:12:25+00:00

[ Upstream commit 59e377a124dc9039d9554d823b1cb4942bcee9a0 ]

The Qualcomm MSM8996 and MSM8998 platforms don't have separate power
domain for the UFS PHY. Replace required:power-domains with the
conditional schema.

Fixes: dc5cb63592bd ("dt-bindings: phy: migrate QMP UFS PHY bindings to qcom,sc8280xp-qmp-ufs-phy.yaml")
Signed-off-by: Dmitry Baryshkov 
Reviewed-by: Krzysztof Kozlowski 
Link: https://lore.kernel.org/r/20240501-qcom-phy-fixes-v1-2-f1fd15c33fb3@linaro.org
Signed-off-by: Vinod Koul 
Signed-off-by: Sasha Levin

dt-bindings: pinctrl: mediatek: mt7622: fix array properties

2024-06-12T09:12:24+00:00

[ Upstream commit 61fcbbf3ca038c048c942ce31bb3d3c846c87581 ]

Some properties (function groups & pins) are meant to be arrays and
should allow multiple entries out of enum sets. Use "items" for those.

Mistake was noticed during validation of in-kernel DTS files.

Fixes: b9ffc18c6388 ("dt-bindings: mediatek: convert pinctrl to yaml")
Signed-off-by: Rafał Miłecki 
Acked-by: Rob Herring 
Message-ID: <20240423045502.7778-1-zajec5@gmail.com>
Signed-off-by: Linus Walleij 
Signed-off-by: Sasha Levin