1. Mar 01, 2024
  2. Feb 29, 2024
  3. Feb 28, 2024
  4. Feb 26, 2024
    • Jiri Slaby (SUSE)'s avatar
      fbcon: always restore the old font data in fbcon_do_set_font() · 00d6a284
      Jiri Slaby (SUSE) authored
      Commit a5a92303 (fbdev: fbcon: Properly revert changes when
      vc_resize() failed) started restoring old font data upon failure (of
      vc_resize()). But it performs so only for user fonts. It means that the
      "system"/internal fonts are not restored at all. So in result, the very
      first call to fbcon_do_set_font() performs no restore at all upon
      failing vc_resize().
      
      This can be reproduced by Syzkaller to crash the system on the next
      invocation of font_get(). It's rather hard to hit the allocation failure
      in vc_resize() on the first font_set(), but not impossible. Esp. if
      fault injection is used to aid the execution/failure. It was
      demonstrated by Sirius:
        BUG: unable to handle page fault for address: fffffffffffffff8
        #PF: supervisor read access in kernel mode
        #PF: error_code(0x0000) - not-present page
        PGD cb7b067 P4D cb7b067 PUD cb7d067 PMD 0
        Oops: 0000 [#1] PREEMPT SMP KASAN
        CPU: 1 PID: 8007 Comm: poc Not tainted 6.7.0-g9d1694dc
      
       #20
        Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
        RIP: 0010:fbcon_get_font+0x229/0x800 drivers/video/fbdev/core/fbcon.c:2286
        Call Trace:
         <TASK>
         con_font_get drivers/tty/vt/vt.c:4558 [inline]
         con_font_op+0x1fc/0xf20 drivers/tty/vt/vt.c:4673
         vt_k_ioctl drivers/tty/vt/vt_ioctl.c:474 [inline]
         vt_ioctl+0x632/0x2ec0 drivers/tty/vt/vt_ioctl.c:752
         tty_ioctl+0x6f8/0x1570 drivers/tty/tty_io.c:2803
         vfs_ioctl fs/ioctl.c:51 [inline]
        ...
      
      So restore the font data in any case, not only for user fonts. Note the
      later 'if' is now protected by 'old_userfont' and not 'old_data' as the
      latter is always set now. (And it is supposed to be non-NULL. Otherwise
      we would see the bug above again.)
      
      Signed-off-by: default avatarJiri Slaby (SUSE) <jirislaby@kernel.org>
      Fixes: a5a92303
      
       ("fbdev: fbcon: Properly revert changes when vc_resize() failed")
      Reported-and-tested-by: default avatarUbisectech Sirius <bugreport@ubisectech.com>
      Cc: Ubisectech Sirius <bugreport@ubisectech.com>
      Cc: Daniel Vetter <daniel@ffwll.ch>
      Cc: Helge Deller <deller@gmx.de>
      Cc: linux-fbdev@vger.kernel.org
      Cc: dri-devel@lists.freedesktop.org
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Link: https://patchwork.freedesktop.org/patch/msgid/20240208114411.14604-1-jirislaby@kernel.org
      00d6a284
    • Christian König's avatar
      drm/ttm/tests: depend on UML || COMPILE_TEST · 9d3f8a72
      Christian König authored
      
      
      At least the device test requires that no other driver using TTM is
      loaded. So make those unit tests depend on UML || COMPILE_TEST to
      prevent people from trying them on bare metal.
      
      Signed-off-by: default avatarChristian König <christian.koenig@amd.com>
      Acked-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      Link: https://lore.kernel.org/all/20240219230116.77b8ad68@yea/
      9d3f8a72
    • Maxime Ripard's avatar
      Merge drm/drm-fixes into drm-misc-fixes · 2f910859
      Maxime Ripard authored
      
      
      Sima needs a more recent release to apply a patch.
      
      Signed-off-by: default avatarMaxime Ripard <mripard@kernel.org>
      2f910859
    • Thierry Reding's avatar
      drm/tegra: Remove existing framebuffer only if we support display · 86bf8cfd
      Thierry Reding authored
      Tegra DRM doesn't support display on Tegra234 and later, so make sure
      not to remove any existing framebuffers in that case.
      
      v2: - add comments explaining how this situation can come about
          - clear DRIVER_MODESET and DRIVER_ATOMIC feature bits
      
      Fixes: 6848c291
      
       ("drm/aperture: Convert drivers to aperture interfaces")
      Signed-off-by: default avatarThierry Reding <treding@nvidia.com>
      Reviewed-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
      Reviewed-by: default avatarJavier Martinez Canillas <javierm@redhat.com>
      Signed-off-by: default avatarRobert Foss <rfoss@kernel.org>
      Link: https://patchwork.freedesktop.org/patch/msgid/20240223150333.1401582-1-thierry.reding@gmail.com
      86bf8cfd
    • Linus Torvalds's avatar
      Linux 6.8-rc6 · d206a76d
      Linus Torvalds authored
      d206a76d
    • Linus Torvalds's avatar
      Merge tag 'bcachefs-2024-02-25' of https://evilpiepirate.org/git/bcachefs · e231dbd4
      Linus Torvalds authored
      Pull bcachefs fixes from Kent Overstreet:
       "Some more mostly boring fixes, but some not
      
        User reported ones:
      
         - the BTREE_ITER_FILTER_SNAPSHOTS one fixes a really nasty
           performance bug; user reported an untar initially taking two
           seconds and then ~2 minutes
      
         - kill a __GFP_NOFAIL in the buffered read path; this was a leftover
           from the trickier fix to kill __GFP_NOFAIL in readahead, where we
           can't return errors (and have to silently truncate the read
           ourselves).
      
           bcachefs can't use GFP_NOFAIL for folio state unlike iomap based
           filesystems because our folio state is just barely too big, 2MB
           hugepages cause us to exceed the 2 page threshhold for GFP_NOFAIL.
      
           additionally, the flags argument was just buggy, we weren't
           supplying GFP_KERNEL previously (!)"
      
      * tag 'bcachefs-2024-02-25' of https://evilpiepirate.org/git/bcachefs:
        bcachefs: fix bch2_save_backtrace()
        bcachefs: Fix check_snapshot() memcpy
        bcachefs: Fix bch2_journal_flush_device_pins()
        bcachefs: fix iov_iter count underflow on sub-block dio read
        bcachefs: Fix BTREE_ITER_FILTER_SNAPSHOTS on inodes btree
        bcachefs: Kill __GFP_NOFAIL in buffered read path
        bcachefs: fix backpointer_to_text() when dev does not exist
      e231dbd4
    • Kent Overstreet's avatar
      bcachefs: fix bch2_save_backtrace() · 5197728f
      Kent Overstreet authored
      
      
      Missed a call in the previous fix.
      
      Signed-off-by: default avatarKent Overstreet <kent.overstreet@linux.dev>
      5197728f
    • Linus Torvalds's avatar
      Merge tag 'docs-6.8-fixes3' of git://git.lwn.net/linux · 70ff1fe6
      Linus Torvalds authored
      Pull two documentation build fixes from Jonathan Corbet:
      
       - The XFS online fsck documentation uses incredibly deeply nested
         subsection and list nesting; that broke the PDF docs build. Tweak a
         parameter to tell LaTeX to allow the deeper nesting.
      
       - Fix a 6.8 PDF-build regression
      
      * tag 'docs-6.8-fixes3' of git://git.lwn.net/linux:
        docs: translations: use attribute to store current language
        docs: Instruct LaTeX to cope with deeper nesting
      70ff1fe6
    • Linus Torvalds's avatar
      Merge tag 'usb-6.8-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · c46ac50e
      Linus Torvalds authored
      Pull USB fixes from Greg KH:
       "Here are some small USB fixes for 6.8-rc6 to resolve some reported
        problems. These include:
      
         - regression fixes with typec tpcm code as reported by many
      
         - cdnsp and cdns3 driver fixes
      
         - usb role setting code bugfixes
      
         - build fix for uhci driver
      
         - ncm gadget driver bugfix
      
         - MAINTAINERS entry update
      
        All of these have been in linux-next all week with no reported issues
        and there is at least one fix in here that is in Thorsten's regression
        list that is being tracked"
      
      * tag 'usb-6.8-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
        usb: typec: tpcm: Fix issues with power being removed during reset
        MAINTAINERS: Drop myself as maintainer of TYPEC port controller drivers
        usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
        Revert "usb: typec: tcpm: reset counter when enter into unattached state after try role"
        usb: gadget: omap_udc: fix USB gadget regression on Palm TE
        usb: dwc3: gadget: Don't disconnect if not started
        usb: cdns3: fix memory double free when handle zero packet
        usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()
        usb: roles: don't get/set_role() when usb_role_switch is unregistered
        usb: roles: fix NULL pointer issue when put module's reference
        usb: cdnsp: fixed issue with incorrect detecting CDNSP family controllers
        usb: cdnsp: blocked some cdns3 specific code
        usb: uhci-grlib: Explicitly include linux/platform_device.h
      c46ac50e
    • Linus Torvalds's avatar
      Merge tag 'tty-6.8-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · 1e592e95
      Linus Torvalds authored
      Pull tty/serial driver fixes from Greg KH:
       "Here are three small serial/tty driver fixes for 6.8-rc6 that resolve
        the following reported errors:
      
         - riscv hvc console driver fix that was reported by many
      
         - amba-pl011 serial driver fix for RS485 mode
      
         - stm32 serial driver fix for RS485 mode
      
        All of these have been in linux-next all week with no reported
        problems"
      
      * tag 'tty-6.8-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        serial: amba-pl011: Fix DMA transmission in RS485 mode
        serial: stm32: do not always set SER_RS485_RX_DURING_TX if RS485 is enabled
        tty: hvc: Don't enable the RISC-V SBI console by default
      1e592e95
    • Linus Torvalds's avatar
      Merge tag 'x86_urgent_for_v6.8_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 1eee4ef3
      Linus Torvalds authored
      Pull x86 fixes from Borislav Petkov:
      
       - Make sure clearing CPU buffers using VERW happens at the latest
         possible point in the return-to-userspace path, otherwise memory
         accesses after the VERW execution could cause data to land in CPU
         buffers again
      
      * tag 'x86_urgent_for_v6.8_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        KVM/VMX: Move VERW closer to VMentry for MDS mitigation
        KVM/VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH
        x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key
        x86/entry_32: Add VERW just before userspace transition
        x86/entry_64: Add VERW just before userspace transition
        x86/bugs: Add asm helpers for executing VERW
      1eee4ef3
    • Linus Torvalds's avatar
      Merge tag 'irq_urgent_for_v6.8_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 8c46ed37
      Linus Torvalds authored
      Pull irq fixes from Borislav Petkov:
      
       - Make sure GICv4 always gets initialized to prevent a kexec-ed kernel
         from silently failing to set it up
      
       - Do not call bus_get_dev_root() for the mbigen irqchip as it always
         returns NULL - use NULL directly
      
       - Fix hardware interrupt number truncation when assigning MSI
         interrupts
      
       - Correct sending end-of-interrupt messages to disabled interrupts
         lines on RISC-V PLIC
      
      * tag 'irq_urgent_for_v6.8_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        irqchip/gic-v3-its: Do not assume vPE tables are preallocated
        irqchip/mbigen: Don't use bus_get_dev_root() to find the parent
        PCI/MSI: Prevent MSI hardware interrupt number truncation
        irqchip/sifive-plic: Enable interrupt if needed before EOI
      8c46ed37