5.14.10-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 5.14.10-rc1 review
This is the start of the stable review cycle for the 5.14.10 release. There are 172 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 06 Oct 2021 12:50:17 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.14.10-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.14.10-rc1
Daniele Palmas <[email protected]>
drivers: net: mhi: fix error path in mhi_net_newlink
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: Fix oversized kvmalloc() calls
Eric Dumazet <[email protected]>
netfilter: conntrack: serialize hash resizes and cleanups
Haimin Zhang <[email protected]>
KVM: x86: Handle SRCU initialization failure during page track init
Yanfei Xu <[email protected]>
net: mdiobus: Fix memory leak in __mdiobus_register
Shreyansh Chouhan <[email protected]>
crypto: aesni - xts_crypt() return if walk.nbytes is 0
Anirudh Rayabharam <[email protected]>
HID: usbhid: free raw_report buffers in usbhid_stop
Linus Torvalds <[email protected]>
mm: don't allow oversized kvmalloc() calls
Jozsef Kadlecsik <[email protected]>
netfilter: ipset: Fix oversized kvmalloc() calls
F.A.Sulaiman <[email protected]>
HID: betop: fix slab-out-of-bounds Write in betop_probe
Dongliang Mu <[email protected]>
usb: hso: remove the bailout parameter
Randy Dunlap <[email protected]>
NIOS2: setup.c: drop unused variable 'dram_start'
Eric Dumazet <[email protected]>
net: udp: annotate data race around udp_sk(sk)->corkflag
Andrej Shadura <[email protected]>
HID: u2fzero: ignore incomplete packets without data
yangerkun <[email protected]>
ext4: flush s_error_work before journal destroy in ext4_fill_super
yangerkun <[email protected]>
ext4: fix potential infinite loop in ext4_dx_readdir()
Theodore Ts'o <[email protected]>
ext4: add error checking to ext4_ext_replay_set_iblocks()
Jeffle Xu <[email protected]>
ext4: fix reserved space counter leakage
Hou Tao <[email protected]>
ext4: limit the number of blocks in one ADD_RANGE TLV
Ritesh Harjani <[email protected]>
ext4: fix loff_t overflow in ext4_max_bitmap_size()
Johan Hovold <[email protected]>
ipack: ipoctal: fix module reference leak
Johan Hovold <[email protected]>
ipack: ipoctal: fix missing allocation-failure check
Johan Hovold <[email protected]>
ipack: ipoctal: fix tty-registration error handling
Johan Hovold <[email protected]>
ipack: ipoctal: fix tty registration race
Johan Hovold <[email protected]>
ipack: ipoctal: fix stack information leak
Nirmoy Das <[email protected]>
debugfs: debugfs_create_file_size(): use IS_ERR to check for error
Saravana Kannan <[email protected]>
driver core: fw_devlink: Improve handling of cyclic dependencies
Chen Jingwen <[email protected]>
elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings
Keith Busch <[email protected]>
nvme: add command id quirk for apple controllers
Linus Torvalds <[email protected]>
kvm: fix objtool relocation warning
Vadim Pasternak <[email protected]>
hwmon: (pmbus/mp2975) Add missed POUT attribute for page 1 mp2975 controller
Eddie James <[email protected]>
hwmon: (occ) Fix P10 VRM temp sensors
Mel Gorman <[email protected]>
sched/fair: Null terminate buffer when updating tunable_scaling
Michal Koutný <[email protected]>
sched/fair: Add ancestors of unthrottled undecayed cfs_rq
Kan Liang <[email protected]>
perf/x86/intel: Update event constraints for ICX
Peter Zijlstra <[email protected]>
objtool: Teach get_alt_entry() about more relocation types
Eric Dumazet <[email protected]>
af_unix: fix races in sk_peer_pid and sk_peer_cred accesses
Wong Vee Khee <[email protected]>
net: stmmac: fix EEE init issue when paired with EEE capable PHYs
Vlad Buslov <[email protected]>
net: sched: flower: protect fl_walk() with rcu
Paolo Abeni <[email protected]>
net: introduce and use lock_sock_fast_nested()
Florian Fainelli <[email protected]>
net: phy: bcm7xxx: Fixed indirect MMD operations
Guangbin Huang <[email protected]>
net: hns3: disable firmware compatible features when uninstall PF
Guangbin Huang <[email protected]>
net: hns3: fix always enable rx vlan filter problem after selftest
Peng Li <[email protected]>
net: hns3: reconstruct function hns3_self_test
Jian Shen <[email protected]>
net: hns3: fix show wrong state when add existing uc mac address
Jian Shen <[email protected]>
net: hns3: fix mixed flag HCLGE_FLAG_MQPRIO_ENABLE and HCLGE_FLAG_DCB_ENABLE
Jian Shen <[email protected]>
net: hns3: don't rollback when destroy mqprio fail
Jian Shen <[email protected]>
net: hns3: remove tc enable checking
Jian Shen <[email protected]>
net: hns3: do not allow call hns3_nic_net_open repeatedly
Feng Zhou <[email protected]>
ixgbe: Fix NULL pointer dereference in ixgbe_xdp_setup
Rahul Lakkireddy <[email protected]>
scsi: csiostor: Add module softdep on cxgb4
Jens Axboe <[email protected]>
Revert "block, bfq: honor already-setup queue merges"
Shannon Nelson <[email protected]>
ionic: fix gathering of debug stats
Arnd Bergmann <[email protected]>
net: ks8851: fix link error
Johan Almbladh <[email protected]>
bpf, x86: Fix bpf mapping of atomic fetch implementation
Jiri Benc <[email protected]>
selftests, bpf: test_lwt_ip_encap: Really disable rp_filter
Jiri Benc <[email protected]>
selftests, bpf: Fix makefile dependencies on libbpf
Kumar Kartikeya Dwivedi <[email protected]>
libbpf: Fix segfault in static linker for objects without BTF
Lorenz Bauer <[email protected]>
bpf: Exempt CAP_BPF from checks against bpf_jit_limit
Wenpeng Liang <[email protected]>
RDMA/hns: Add the check of the CQE size of the user space
Wenpeng Liang <[email protected]>
RDMA/hns: Fix the size setting error when copying CQE in clean_cq()
Guo Zhi <[email protected]>
RDMA/hfi1: Fix kernel pointer leak
Jacob Keller <[email protected]>
e100: fix buffer overrun in e100_get_regs
Jacob Keller <[email protected]>
e100: fix length calculation in e100_get_regs_len
Andrew Lunn <[email protected]>
dsa: mv88e6xxx: Include tagger overhead when setting MTU for DSA and CPU ports
Andrew Lunn <[email protected]>
dsa: mv88e6xxx: Fix MTU definition
Andrew Lunn <[email protected]>
dsa: mv88e6xxx: 6161: Use chip wide MAX MTU
Tejas Upadhyay <[email protected]>
drm/i915: Remove warning from the rps worker
Matthew Auld <[email protected]>
drm/i915/request: fix early tracepoints
Aaro Koskinen <[email protected]>
smsc95xx: fix stalled rx after link change
Xiao Liang <[email protected]>
net: ipv4: Fix rtnexthop len when RTA_FLOW is present
Vladimir Oltean <[email protected]>
net: enetc: fix the incorrect clearing of IF_MODE bits
Paul Fertser <[email protected]>
hwmon: (tmp421) fix rounding for negative values
Paul Fertser <[email protected]>
hwmon: (tmp421) report /PVLD condition as fault
Jason Gunthorpe <[email protected]>
RDMA/hns: Work around broken constant propagation in gcc 8
Davide Caratti <[email protected]>
mptcp: allow changing the 'backup' bit when no sockets are open
Florian Westphal <[email protected]>
mptcp: don't return sockets in foreign netns
Xin Long <[email protected]>
sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb
Saravana Kannan <[email protected]>
net: mdiobus: Set FWNODE_FLAG_NEEDS_CHILD_BOUND_ON_ADD for mdiobus parents
Saravana Kannan <[email protected]>
driver core: fw_devlink: Add support for FWNODE_FLAG_NEEDS_CHILD_BOUND_ON_ADD
Johannes Berg <[email protected]>
mac80211-hwsim: fix late beacon hrtimer handling
Johannes Berg <[email protected]>
mac80211: mesh: fix potentially unaligned access
Lorenzo Bianconi <[email protected]>
mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap
Chih-Kang Chang <[email protected]>
mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
Felix Fietkau <[email protected]>
Revert "mac80211: do not use low data rates for data frames with no ack flag"
Florian Westphal <[email protected]>
netfilter: log: work around missing softdep backend module
Florian Westphal <[email protected]>
netfilter: nf_tables: unlink table before deleting it
Sindhu Devale <[email protected]>
RDMA/irdma: Report correct WC error when there are MW bind errors
Sindhu Devale <[email protected]>
RDMA/irdma: Report correct WC error when transport retry counter is exceeded
Sindhu Devale <[email protected]>
RDMA/irdma: Validate number of CQ entries on create CQ
Sindhu Devale <[email protected]>
RDMA/irdma: Skip CQP ring during a reset
Vadim Pasternak <[email protected]>
hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs
Piotr Krysiuk <[email protected]>
bpf, mips: Validate conditional branch offsets
Tao Liu <[email protected]>
RDMA/cma: Fix listener leak in rdma_cma_listen_on_all() failure
Christoph Lameter <[email protected]>
IB/cma: Do not send IGMP leaves for sendonly Multicast groups
Hou Tao <[email protected]>
bpf: Handle return value of BPF_PROG_TYPE_STRUCT_OPS prog
Andrea Claudi <[email protected]>
ipvs: check that ip_vs_conn_tab_bits is between 8 and 20
Zhi A Wang <[email protected]>
drm/i915/gvt: fix the usage of ww lock in gvt scheduler.
Shawn Guo <[email protected]>
interconnect: qcom: sdm660: Correct NOC_QOS_PRIORITY shift and mask
Shawn Guo <[email protected]>
interconnect: qcom: sdm660: Fix id of slv_cnoc_mnoc_cfg
Hawking Zhang <[email protected]>
drm/amdgpu: correct initial cp_hqd_quantum for gfx9
Simon Ser <[email protected]>
drm/amdgpu: check tiling flags when creating FB on GFX8-
Prike Liang <[email protected]>
drm/amdgpu: force exit gfxoff on sdma resume for rmb s0ix
Praful Swarnakar <[email protected]>
drm/amd/display: Fix Display Flicker on embedded panels
Charlene Liu <[email protected]>
drm/amd/display: Pass PCI deviceid into DC
Josip Pavic <[email protected]>
drm/amd/display: initialize backlight_ramping_override to false
Nick Desaulniers <[email protected]>
nbd: use shifts rather than multiplies
Jason Gunthorpe <[email protected]>
RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests
Jason Gunthorpe <[email protected]>
RDMA/cma: Do not change route.addr.src_addr.ss_family
Sean Young <[email protected]>
media: ir_toy: prevent device from hanging during transmit
Wolfram Sang <[email protected]>
mmc: renesas_sdhi: fix regression with hard reset on old SDHIs
Zhenzhong Duan <[email protected]>
KVM: VMX: Fix a TSX_CTRL_CPUID_CLEAR field mask issue
Chenyi Qiang <[email protected]>
KVM: nVMX: Fix nested bus lock VM exit
Mingwei Zhang <[email protected]>
KVM: SVM: fix missing sev_decommission in sev_receive_start
Peter Gonda <[email protected]>
KVM: SEV: Allow some commands for mirror VM
Peter Gonda <[email protected]>
KVM: SEV: Acquire vcpu mutex when updating VMSA
Sean Christopherson <[email protected]>
KVM: SEV: Pin guest memory for write for RECEIVE_UPDATE_DATA
Peter Gonda <[email protected]>
KVM: SEV: Update svm_vm_copy_asid_from for SEV-ES
Vitaly Kuznetsov <[email protected]>
KVM: nVMX: Filter out all unsupported controls when eVMCS was activated
Sean Christopherson <[email protected]>
KVM: x86: Swap order of CPUID entry "index" vs. "significant flag" checks
Sean Christopherson <[email protected]>
KVM: x86: Clear KVM's cached guest CR3 at RESET/INIT
Maxim Levitsky <[email protected]>
KVM: x86: nSVM: don't copy virt_ext from vmcb12
Vitaly Kuznetsov <[email protected]>
KVM: x86: Fix stack-out-of-bounds memory access from ioapic_write_indirect()
Zelin Deng <[email protected]>
ptp: Fix ptp_kvm_getcrosststamp issue for x86 ptp_kvm
Zelin Deng <[email protected]>
x86/kvmclock: Move this_cpu_pvti into kvmclock.h
José Expósito <[email protected]>
platform/x86/intel: hid: Add DMI switches allow list
Johannes Berg <[email protected]>
mac80211: fix use-after-free in CCMP/GCMP RX
Jonathan Hsu <[email protected]>
scsi: ufs: Fix illegal offset in UPIU event trace
Andrey Gusakov <[email protected]>
gpio: pca953x: do not ignore i2c errors
Nadezda Lutovinova <[email protected]>
hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field
Nadezda Lutovinova <[email protected]>
hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field
Nadezda Lutovinova <[email protected]>
hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field
Paul Fertser <[email protected]>
hwmon: (tmp421) handle I2C errors
Eric Biggers <[email protected]>
fs-verity: fix signed integer overflow with i_size near S64_MAX
Jia He <[email protected]>
ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect
Cameron Berkenpas <[email protected]>
ALSA: hda/realtek: Quirks to enable speaker output for Lenovo Legion 7i 15IMHG05, Yoga 7i 14ITL5/15ITL5, and 13s Gen2 laptops.
Takashi Sakamoto <[email protected]>
ALSA: firewire-motu: fix truncated bytes in message tracepoints
Jaroslav Kysela <[email protected]>
ALSA: rawmidi: introduce SNDRV_RAWMIDI_IOCTL_USER_PVERSION
Adrian Hunter <[email protected]>
scsi: ufs: ufs-pci: Fix Intel LKF link stability
James Morse <[email protected]>
cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory
Guchun Chen <[email protected]>
drm/amdgpu: stop scheduler when calling hw_fini (v2)
Guchun Chen <[email protected]>
drm/amdgpu: avoid over-handle of fence driver fini in s3 test (v2)
Likun Gao <[email protected]>
drm/amdgpu: adjust fence driver enable sequence
Saurav Kashyap <[email protected]>
scsi: qla2xxx: Changes to support kdump kernel for NVMe BFS
Kevin Hao <[email protected]>
cpufreq: schedutil: Use kobject release() method to free sugov_tunables
Igor Matheus Andrade Torrente <[email protected]>
tty: Fix out-of-bound vmalloc access in imageblit
Jackie Liu <[email protected]>
watchdog/sb_watchdog: fix compilation problem due to COMPILE_TEST
Like Xu <[email protected]>
perf iostat: Fix Segmentation fault from NULL 'struct perf_counts_values *'
Like Xu <[email protected]>
perf iostat: Use system-wide mode if the target cpu_list is unspecified
Ian Rogers <[email protected]>
perf test: Fix DWARF unwind for optimized builds.
Evgeny Novikov <[email protected]>
HID: amd_sfh: Fix potential NULL pointer dereference
Marco Elver <[email protected]>
kasan: fix Kconfig check of CC_HAS_WORKING_NOSANITIZE_ADDRESS
Randy Dunlap <[email protected]>
NIOS2: fix kconfig unmet dependency warning for SERIAL_CORE_CONSOLE
Al Viro <[email protected]>
m68k: Update ->thread.esp0 before calling syscall_trace() in ret_from_signal
Dan Carpenter <[email protected]>
crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd()
Alexandra Winter <[email protected]>
s390/qeth: fix deadlock during failing recovery
Alexandra Winter <[email protected]>
s390/qeth: Fix deadlock in remove_discipline
Lama Kayal <[email protected]>
net/mlx4_en: Resolve bad operstate value
David Collins <[email protected]>
pinctrl: qcom: spmi-gpio: correct parent irqspec translation
Peter Ujfalusi <[email protected]>
ASoC: SOF: imx: imx8m: Bar index is only valid for IRAM and SRAM types
Peter Ujfalusi <[email protected]>
ASoC: SOF: imx: imx8: Bar index is only valid for IRAM and SRAM types
Yong Zhi <[email protected]>
ASoC: SOF: Fix DSP oops stack dump output contents
James Smart <[email protected]>
scsi: elx: efct: Fix void-pointer-to-enum-cast warning for efc_nport_topology
Trevor Wu <[email protected]>
ASoC: mediatek: common: handle NULL case in suspend/resume function
Shengjiu Wang <[email protected]>
ASoC: fsl_xcvr: register platform component before registering cpu dai
Shengjiu Wang <[email protected]>
ASoC: fsl_spdif: register platform component before registering cpu dai
Shengjiu Wang <[email protected]>
ASoC: fsl_micfil: register platform component before registering cpu dai
Shengjiu Wang <[email protected]>
ASoC: fsl_esai: register platform component before registering cpu dai
Shengjiu Wang <[email protected]>
ASoC: fsl_sai: register platform component before registering cpu dai
Randy Dunlap <[email protected]>
media: s5p-jpeg: rename JPEG marker constants to prevent build warnings
Nicolas Dufresne <[email protected]>
media: cedrus: Fix SUNXI tile size calculation
Jernej Skrabec <[email protected]>
media: hantro: Fix check for single irq
-------------
Diffstat:
Makefile | 4 +- arch/m68k/kernel/entry.S | 2 + arch/mips/net/bpf_jit.c | 57 ++++++--- arch/nios2/Kconfig.debug | 3 +- arch/nios2/kernel/setup.c | 2 - arch/s390/include/asm/ccwgroup.h | 2 +- arch/x86/crypto/aesni-intel_glue.c | 2 +- arch/x86/events/intel/core.c | 1 + arch/x86/include/asm/kvm_page_track.h | 2 +- arch/x86/include/asm/kvmclock.h | 14 +++ arch/x86/kernel/kvmclock.c | 13 +-- arch/x86/kvm/cpuid.c | 4 +- arch/x86/kvm/emulate.c | 1 - arch/x86/kvm/ioapic.c | 10 +- arch/x86/kvm/mmu/page_track.c | 4 +- arch/x86/kvm/svm/nested.c | 1 - arch/x86/kvm/svm/sev.c | 92 ++++++++++----- arch/x86/kvm/vmx/evmcs.c | 12 +- arch/x86/kvm/vmx/nested.c | 6 + arch/x86/kvm/vmx/vmx.c | 11 +- arch/x86/kvm/x86.c | 10 +- arch/x86/net/bpf_jit_comp.c | 66 ++++++++--- block/bfq-iosched.c | 16 +-- drivers/acpi/nfit/core.c | 12 ++ drivers/base/core.c | 36 +++++- drivers/block/nbd.c | 29 +++-- drivers/cpufreq/cpufreq_governor_attr_set.c | 2 +- drivers/crypto/ccp/ccp-ops.c | 14 ++- drivers/gpio/gpio-pca953x.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 15 +-- drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 31 +++++ drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 62 +++------- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 9 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 8 ++ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 + drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 15 ++- drivers/gpu/drm/i915/gt/intel_rps.c | 2 - drivers/gpu/drm/i915/gvt/scheduler.c | 4 +- drivers/gpu/drm/i915/i915_request.c | 11 +- drivers/hid/amd-sfh-hid/amd_sfh_pcie.c | 6 +- drivers/hid/hid-betopff.c | 13 ++- drivers/hid/hid-u2fzero.c | 4 +- drivers/hid/usbhid/hid-core.c | 13 ++- drivers/hwmon/mlxreg-fan.c | 12 +- drivers/hwmon/occ/common.c | 17 +-- drivers/hwmon/pmbus/mp2975.c | 2 +- drivers/hwmon/tmp421.c | 71 +++++++----- drivers/hwmon/w83791d.c | 29 ++--- drivers/hwmon/w83792d.c | 28 ++--- drivers/hwmon/w83793.c | 26 ++--- drivers/infiniband/core/cma.c | 51 +++++++- drivers/infiniband/core/cma_priv.h | 1 + drivers/infiniband/hw/hfi1/ipoib_tx.c | 8 +- drivers/infiniband/hw/hns/hns_roce_cq.c | 31 +++-- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 13 ++- drivers/infiniband/hw/irdma/cm.c | 4 +- drivers/infiniband/hw/irdma/hw.c | 14 ++- drivers/infiniband/hw/irdma/i40iw_if.c | 2 +- drivers/infiniband/hw/irdma/main.h | 1 - drivers/infiniband/hw/irdma/user.h | 2 + drivers/infiniband/hw/irdma/utils.c | 2 +- drivers/infiniband/hw/irdma/verbs.c | 9 +- drivers/interconnect/qcom/sdm660.c | 11 +- drivers/ipack/devices/ipoctal.c | 63 +++++++--- drivers/media/platform/s5p-jpeg/jpeg-core.c | 18 +-- drivers/media/platform/s5p-jpeg/jpeg-core.h | 28 ++--- drivers/media/rc/ir_toy.c | 21 +++- drivers/mmc/host/renesas_sdhi_core.c | 2 + drivers/net/dsa/mv88e6xxx/chip.c | 17 +-- drivers/net/dsa/mv88e6xxx/chip.h | 1 + drivers/net/dsa/mv88e6xxx/global1.c | 2 + drivers/net/dsa/mv88e6xxx/port.c | 2 + drivers/net/ethernet/freescale/enetc/enetc_pf.c | 3 +- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 1 - drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 16 ++- drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 105 +++++++++++------ .../net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c | 21 ++-- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c | 29 ++--- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 19 ++- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 33 +----- drivers/net/ethernet/intel/e100.c | 22 ++-- drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 8 +- drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 47 +++++--- drivers/net/ethernet/mellanox/mlx4/mlx4_en.h | 1 - drivers/net/ethernet/micrel/Makefile | 6 +- drivers/net/ethernet/micrel/ks8851_common.c | 8 ++ drivers/net/ethernet/pensando/ionic/ionic_stats.c | 9 -- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 4 + drivers/net/mhi/net.c | 6 +- drivers/net/phy/bcm7xxx.c | 114 +++++++++++++++++- drivers/net/phy/mdio_bus.c | 5 + drivers/net/usb/hso.c | 6 +- drivers/net/usb/smsc95xx.c | 3 + drivers/net/wireless/mac80211_hwsim.c | 4 +- drivers/nvme/host/core.c | 4 +- drivers/nvme/host/nvme.h | 6 + drivers/nvme/host/pci.c | 3 +- drivers/pinctrl/qcom/pinctrl-spmi-gpio.c | 37 +++++- drivers/platform/x86/intel-hid.c | 27 ++++- drivers/ptp/ptp_kvm_x86.c | 9 +- drivers/s390/cio/ccwgroup.c | 10 +- drivers/s390/net/qeth_core.h | 1 - drivers/s390/net/qeth_core_main.c | 19 +-- drivers/s390/net/qeth_l2_main.c | 1 - drivers/s390/net/qeth_l3_main.c | 1 - drivers/scsi/csiostor/csio_init.c | 1 + drivers/scsi/elx/libefc/efc_device.c | 7 +- drivers/scsi/elx/libefc/efc_fabric.c | 3 +- drivers/scsi/qla2xxx/qla_def.h | 1 - drivers/scsi/qla2xxx/qla_isr.c | 2 + drivers/scsi/qla2xxx/qla_nvme.c | 40 +++---- drivers/scsi/ufs/ufshcd-pci.c | 78 +++++++++++++ drivers/scsi/ufs/ufshcd.c | 6 +- drivers/scsi/ufs/ufshcd.h | 1 + drivers/staging/media/hantro/hantro_drv.c | 2 +- drivers/staging/media/sunxi/cedrus/cedrus_video.c | 2 +- drivers/tty/vt/vt.c | 21 +++- drivers/watchdog/Kconfig | 2 +- fs/binfmt_elf.c | 2 +- fs/debugfs/inode.c | 2 +- fs/ext4/dir.c | 6 +- fs/ext4/extents.c | 19 ++- fs/ext4/fast_commit.c | 6 + fs/ext4/inode.c | 5 + fs/ext4/super.c | 21 +++- fs/verity/enable.c | 2 +- fs/verity/open.c | 2 +- include/linux/bpf.h | 2 + include/linux/fwnode.h | 11 +- include/net/ip_fib.h | 2 +- include/net/nexthop.h | 2 +- include/net/sock.h | 33 +++++- include/sound/rawmidi.h | 1 + include/uapi/sound/asound.h | 1 + kernel/bpf/bpf_struct_ops.c | 7 +- kernel/bpf/core.c | 2 +- kernel/sched/cpufreq_schedutil.c | 16 ++- kernel/sched/debug.c | 8 +- kernel/sched/fair.c | 6 +- lib/Kconfig.kasan | 2 + mm/util.c | 4 + net/core/sock.c | 49 ++++---- net/ipv4/fib_semantics.c | 16 +-- net/ipv4/udp.c | 10 +- net/ipv6/route.c | 5 +- net/ipv6/udp.c | 2 +- net/mac80211/mesh_ps.c | 3 +- net/mac80211/rate.c | 4 - net/mac80211/tx.c | 12 ++ net/mac80211/wpa.c | 6 + net/mptcp/mptcp_diag.c | 2 +- net/mptcp/pm_netlink.c | 4 +- net/mptcp/protocol.c | 2 +- net/mptcp/protocol.h | 2 +- net/mptcp/subflow.c | 2 +- net/mptcp/syncookies.c | 13 +-- net/mptcp/token.c | 11 +- net/mptcp/token_test.c | 14 ++- net/netfilter/ipset/ip_set_hash_gen.h | 4 +- net/netfilter/ipvs/ip_vs_conn.c | 4 + net/netfilter/nf_conntrack_core.c | 70 +++++------ net/netfilter/nf_tables_api.c | 30 +++-- net/netfilter/nft_compat.c | 17 ++- net/netfilter/xt_LOG.c | 10 +- net/netfilter/xt_NFLOG.c | 10 +- net/sched/cls_flower.c | 6 + net/sctp/input.c | 2 +- net/unix/af_unix.c | 34 +++++- sound/core/rawmidi.c | 9 ++ sound/firewire/motu/amdtp-motu.c | 7 +- sound/pci/hda/patch_realtek.c | 129 +++++++++++++++++++++ sound/soc/fsl/fsl_esai.c | 16 ++- sound/soc/fsl/fsl_micfil.c | 15 ++- sound/soc/fsl/fsl_sai.c | 14 ++- sound/soc/fsl/fsl_spdif.c | 14 ++- sound/soc/fsl/fsl_xcvr.c | 15 ++- sound/soc/mediatek/common/mtk-afe-fe-dai.c | 19 +-- sound/soc/sof/imx/imx8.c | 9 +- sound/soc/sof/imx/imx8m.c | 9 +- sound/soc/sof/xtensa/core.c | 4 +- tools/lib/bpf/linker.c | 8 +- tools/objtool/special.c | 32 +++-- tools/perf/arch/x86/util/iostat.c | 2 +- tools/perf/builtin-stat.c | 2 + tools/perf/tests/dwarf-unwind.c | 39 +++++-- tools/testing/selftests/bpf/Makefile | 3 +- tools/testing/selftests/bpf/test_lwt_ip_encap.sh | 13 ++- 189 files changed, 1870 insertions(+), 875 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/172 media: hantro: Fix check for single irq
From: Jernej Skrabec <[email protected]>
[ Upstream commit 31692ab9a9ef0119959f66838de74eeb37490c8d ]
Some cores use only one interrupt and in such case interrupt name in DT is not needed. Driver supposedly accounted that, but due to the wrong field check it never worked. Fix that.
--- drivers/staging/media/hantro/hantro_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/media/hantro/hantro_drv.c +1 -1
@@ -918,7 +918,7 @@ static int hantro_probe(struct platform_device *pdev)if (!vpu->variant->irqs[i].handler)continue ; -if (vpu->variant->num_clocks >1 ) { +if (vpu->variant->num_irqs >1 ) { irq_name = vpu->variant->irqs[i].name; irq =platform_get_irq_byname (vpu->pdev, irq_name); }else {
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 2/172 media: cedrus: Fix SUNXI tile size calculation
In reply to Greg Kroah-HartmanFrom: Nicolas Dufresne <[email protected]>
[ Upstream commit 132c88614f2b3548cd3c8979a434609019db4151 ]
Tiled formats requires full rows being allocated (even for Chroma planes). When the number of Luma tiles is odd, we need to round up to twice the tile width in order to roundup the number of Chroma tiles.
This was notice with a crash running BA1_FT_C compliance test using sunxi tiles using GStreamer. Cedrus driver would allocate 9 rows for Luma, but only 4.5 rows for Chroma, causing userspace to crash.
--- drivers/staging/media/sunxi/cedrus/cedrus_video.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/media/sunxi/cedrus/cedrus_video.c +1 -1
@@ -135,7 +135,7 @@ void cedrus_prepare_format(struct v4l2_pix_format *pix_fmt) sizeimage = bytesperline * height;/* Chroma plane size. */ - sizeimage += bytesperline * height /2 ; + sizeimage += bytesperline *ALIGN (height,64 ) /2 ;break ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 3/172 media: s5p-jpeg: rename JPEG marker constants to prevent build warnings
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 3ad02c27d89d72b3b49ac51899144b7d0942f05f ]
The use of a macro named 'RST' conflicts with one of the same name in arch/mips/include/asm/mach-rc32434/rb.h. This causes build warnings on some MIPS builds.
Change the names of the JPEG marker constants to be in their own namespace to fix these build warnings and to prevent other similar problems in the future.
Fixes these build warnings:
In file included from ../drivers/media/platform/s5p-jpeg/jpeg-hw-exynos3250.c:14:../drivers/media/platform/s5p-jpeg/jpeg-core.h:43: warning: "RST" redefined
43 | #define RST 0xd0
|
../arch/mips/include/asm/mach-rc32434/rb.h:13: note: this is the location of the previous definition
13 | #define RST (1 << 15)
In file included from ../drivers/media/platform/s5p-jpeg/jpeg-hw-s5p.c:13:../drivers/media/platform/s5p-jpeg/jpeg-core.h:43: warning: "RST" redefined
43 | #define RST 0xd0../arch/mips/include/asm/mach-rc32434/rb.h:13: note: this is the location of the previous definition
13 | #define RST (1 << 15)
In file included from ../drivers/media/platform/s5p-jpeg/jpeg-hw-exynos4.c:12:../drivers/media/platform/s5p-jpeg/jpeg-core.h:43: warning: "RST" redefined
43 | #define RST 0xd0../arch/mips/include/asm/mach-rc32434/rb.h:13: note: this is the location of the previous definition
13 | #define RST (1 << 15)
In file included from ../drivers/media/platform/s5p-jpeg/jpeg-core.c:31:../drivers/media/platform/s5p-jpeg/jpeg-core.h:43: warning: "RST" redefined
43 | #define RST 0xd0../arch/mips/include/asm/mach-rc32434/rb.h:13: note: this is the location of the previous definition
13 | #define RST (1 << 15)
Also update the kernel-doc so that the word "marker" is not repeated.
--- drivers/media/platform/s5p-jpeg/jpeg-core.c | 18 ++++++------- drivers/media/platform/s5p-jpeg/jpeg-core.h | 28 ++++++++++----------- 2 files changed, 23 insertions(+), 23 deletions(-)
drivers/media/platform/s5p-jpeg/jpeg-core.c +9 -9
@@ -1140,8 +1140,8 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result,continue ; length =0 ;switch (c) { -/* SOF0: baseline JPEG */ -case SOF0 : +/* JPEG_MARKER_SOF0: baseline JPEG */ +case JPEG_MARKER_SOF0 :if (get_word_be (&jpeg_buffer, &word))break ; length = (long )word -2 ;
@@ -1172,7 +1172,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, notfound =0 ;break ; -case DQT : +case JPEG_MARKER_DQT :if (get_word_be (&jpeg_buffer, &word))break ; length = (long )word -2 ;
@@ -1185,7 +1185,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result,skip (&jpeg_buffer, length);break ; -case DHT : +case JPEG_MARKER_DHT :if (get_word_be (&jpeg_buffer, &word))break ; length = (long )word -2 ;
@@ -1198,15 +1198,15 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result,skip (&jpeg_buffer, length);break ; -case SOS : +case JPEG_MARKER_SOS : sos = jpeg_buffer.curr -2 ;/* 0xffda */ break ;/* skip payload-less markers */ - case RST ... RST + 7: -case SOI : -case EOI : -case TEM : + case JPEG_MARKER_RST ... JPEG_MARKER_RST + 7: +case JPEG_MARKER_SOI : +case JPEG_MARKER_EOI : +case JPEG_MARKER_TEM :break ;/* skip uninteresting payload markers */
drivers/media/platform/s5p-jpeg/jpeg-core.h +14 -14
@@ -37,15 +37,15 @@#define EXYNOS3250_IRQ_TIMEOUT 0x10000000/* a selection of JPEG markers */ -#define TEM 0x01 -#define SOF0 0xc0 -#define DHT 0xc4 -#define RST 0xd0 -#define SOI 0xd8 -#define EOI 0xd9 -#define SOS 0xda -#define DQT 0xdb -#define DHP 0xde +#define JPEG_MARKER_TEM 0x01 +#define JPEG_MARKER_SOF0 0xc0 +#define JPEG_MARKER_DHT 0xc4 +#define JPEG_MARKER_RST 0xd0 +#define JPEG_MARKER_SOI 0xd8 +#define JPEG_MARKER_EOI 0xd9 +#define JPEG_MARKER_SOS 0xda +#define JPEG_MARKER_DQT 0xdb +#define JPEG_MARKER_DHP 0xde/* Flags that indicate a format can be used for capture/output */ #define SJPEG_FMT_FLAG_ENC_CAPTURE (1 << 0)
@@ -187,11 +187,11 @@ struct s5p_jpeg_marker {* @fmt: driver-specific format of this queue * @w: image width * @h: image height -* @sos: SOS marker's position relative to the buffer beginning -* @dht: DHT markers' positions relative to the buffer beginning -* @dqt: DQT markers' positions relative to the buffer beginning -* @sof: SOF0 marker's position relative to the buffer beginning -* @sof_len: SOF0 marker's payload length (without length field itself) +* @sos: JPEG_MARKER_SOS's position relative to the buffer beginning +* @dht: JPEG_MARKER_DHT' positions relative to the buffer beginning +* @dqt: JPEG_MARKER_DQT' positions relative to the buffer beginning +* @sof: JPEG_MARKER_SOF0's position relative to the buffer beginning +* @sof_len: JPEG_MARKER_SOF0's payload length (without length field itself) * @size: image buffer size in bytes */ struct s5p_jpeg_q_data {
Signature · 9 lines
2.33.0 _______________________________________________ linux-arm-kernel mailing list [email protected] http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
Greg Kroah-Hartman
maintainerPATCH 4/172 ASoC: fsl_sai: register platform component before registering cpu dai
In reply to Greg Kroah-HartmanFrom: Shengjiu Wang <[email protected]>
[ Upstream commit 9c3ad33b5a412d8bc0a377e7cd9baa53ed52f22d ]
There is no defer probe when adding platform component to snd_soc_pcm_runtime(rtd), the code is in snd_soc_add_pcm_runtime()
snd_soc_register_card()
-> snd_soc_bind_card()
-> snd_soc_add_pcm_runtime()
-> adding cpu dai
-> adding codec dai
-> adding platform component.So if the platform component is not ready at that time, then the sound card still registered successfully, but platform component is empty, the sound card can't be used.
As there is defer probe checking for cpu dai component, then register platform component before cpu dai to avoid such issue.
--- sound/soc/fsl/fsl_sai.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
sound/soc/fsl/fsl_sai.c +9 -5
@@ -1152,11 +1152,10 @@ static int fsl_sai_probe(struct platform_device *pdev)if (ret <0 ) goto err_pm_get_sync; - ret =devm_snd_soc_register_component (&pdev->dev, &fsl_component, - &sai->cpu_dai_drv,1 ); -if (ret) - goto err_pm_get_sync; - +/* +* Register platform component before registering cpu dai for there +* is not defer probe for platform component in snd_soc_add_pcm_runtime(). +*/ if (sai->soc_data->use_imx_pcm) { ret =imx_pcm_dma_init (pdev,IMX_SAI_DMABUF_SIZE );if (ret)
@@ -1167,6 +1166,11 @@ static int fsl_sai_probe(struct platform_device *pdev) goto err_pm_get_sync; } + ret =devm_snd_soc_register_component (&pdev->dev, &fsl_component, + &sai->cpu_dai_drv,1 ); +if (ret) + goto err_pm_get_sync; +return ret; err_pm_get_sync:
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 5/172 ASoC: fsl_esai: register platform component before registering cpu dai
In reply to Greg Kroah-HartmanFrom: Shengjiu Wang <[email protected]>
[ Upstream commit f12ce92e98b21c1fc669cd74e12c54a0fe3bc2eb ]
There is no defer probe when adding platform component to snd_soc_pcm_runtime(rtd), the code is in snd_soc_add_pcm_runtime()
snd_soc_register_card()
-> snd_soc_bind_card()
-> snd_soc_add_pcm_runtime()
-> adding cpu dai
-> adding codec dai
-> adding platform component.So if the platform component is not ready at that time, then the sound card still registered successfully, but platform component is empty, the sound card can't be used.
As there is defer probe checking for cpu dai component, then register platform component before cpu dai to avoid such issue.
--- sound/soc/fsl/fsl_esai.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
sound/soc/fsl/fsl_esai.c +10 -6
@@ -1073,6 +1073,16 @@ static int fsl_esai_probe(struct platform_device *pdev)if (ret <0 ) goto err_pm_get_sync; +/* +* Register platform component before registering cpu dai for there +* is not defer probe for platform component in snd_soc_add_pcm_runtime(). +*/ + ret =imx_pcm_dma_init (pdev,IMX_ESAI_DMABUF_SIZE ); +if (ret) { +dev_err (&pdev->dev,"failed to init imx pcm dma: %d\n" , ret); + goto err_pm_get_sync; + } + ret =devm_snd_soc_register_component (&pdev->dev, &fsl_esai_component, &fsl_esai_dai,1 );if (ret) {
@@ -1082,12 +1092,6 @@ static int fsl_esai_probe(struct platform_device *pdev)INIT_WORK (&esai_priv->work, fsl_esai_hw_reset); - ret =imx_pcm_dma_init (pdev,IMX_ESAI_DMABUF_SIZE ); -if (ret) { -dev_err (&pdev->dev,"failed to init imx pcm dma: %d\n" , ret); - goto err_pm_get_sync; - } -return ret; err_pm_get_sync:
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 6/172 ASoC: fsl_micfil: register platform component before registering cpu dai
In reply to Greg Kroah-HartmanFrom: Shengjiu Wang <[email protected]>
[ Upstream commit 0adf292069dcca8bab76a603251fcaabf77468ca ]
There is no defer probe when adding platform component to snd_soc_pcm_runtime(rtd), the code is in snd_soc_add_pcm_runtime()
snd_soc_register_card()
-> snd_soc_bind_card()
-> snd_soc_add_pcm_runtime()
-> adding cpu dai
-> adding codec dai
-> adding platform component.So if the platform component is not ready at that time, then the sound card still registered successfully, but platform component is empty, the sound card can't be used.
As there is defer probe checking for cpu dai component, then register platform component before cpu dai to avoid such issue.
--- sound/soc/fsl/fsl_micfil.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
sound/soc/fsl/fsl_micfil.c +10 -5
@@ -737,18 +737,23 @@ static int fsl_micfil_probe(struct platform_device *pdev)pm_runtime_enable (&pdev->dev);regcache_cache_only (micfil->regmap, true); +/* +* Register platform component before registering cpu dai for there +* is not defer probe for platform component in snd_soc_add_pcm_runtime(). +*/ + ret =devm_snd_dmaengine_pcm_register (&pdev->dev,NULL ,0 ); +if (ret) { +dev_err (&pdev->dev,"failed to pcm register\n" ); +return ret; + } + ret =devm_snd_soc_register_component (&pdev->dev, &fsl_micfil_component, &fsl_micfil_dai,1 );if (ret) {dev_err (&pdev->dev,"failed to register component %s\n" , fsl_micfil_component.name); -return ret; } - ret =devm_snd_dmaengine_pcm_register (&pdev->dev,NULL ,0 ); -if (ret) -dev_err (&pdev->dev,"failed to pcm register\n" ); -return ret; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 7/172 ASoC: fsl_spdif: register platform component before registering cpu dai
In reply to Greg Kroah-HartmanFrom: Shengjiu Wang <[email protected]>
[ Upstream commit ee8ccc2eb5840e34fce088bdb174fd5329153ef0 ]
There is no defer probe when adding platform component to snd_soc_pcm_runtime(rtd), the code is in snd_soc_add_pcm_runtime()
snd_soc_register_card()
-> snd_soc_bind_card()
-> snd_soc_add_pcm_runtime()
-> adding cpu dai
-> adding codec dai
-> adding platform component.So if the platform component is not ready at that time, then the sound card still registered successfully, but platform component is empty, the sound card can't be used.
As there is defer probe checking for cpu dai component, then register platform component before cpu dai to avoid such issue.
--- sound/soc/fsl/fsl_spdif.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
sound/soc/fsl/fsl_spdif.c +9 -5
@@ -1434,16 +1434,20 @@ static int fsl_spdif_probe(struct platform_device *pdev)pm_runtime_enable (&pdev->dev);regcache_cache_only (spdif_priv->regmap, true); - ret =devm_snd_soc_register_component (&pdev->dev, &fsl_spdif_component, - &spdif_priv->cpu_dai_drv,1 ); +/* +* Register platform component before registering cpu dai for there +* is not defer probe for platform component in snd_soc_add_pcm_runtime(). +*/ + ret =imx_pcm_dma_init (pdev,IMX_SPDIF_DMABUF_SIZE );if (ret) { -dev_err (&pdev->dev,"failed to register DAI: %d\n" , ret); +dev_err_probe (&pdev->dev, ret,"imx_pcm_dma_init failed\n" ); goto err_pm_disable; } - ret =imx_pcm_dma_init (pdev,IMX_SPDIF_DMABUF_SIZE ); + ret =devm_snd_soc_register_component (&pdev->dev, &fsl_spdif_component, + &spdif_priv->cpu_dai_drv,1 );if (ret) { -dev_err_probe (&pdev->dev, ret,"imx_pcm_dma_init failed\n" ); +dev_err (&pdev->dev,"failed to register DAI: %d\n" , ret); goto err_pm_disable; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 8/172 ASoC: fsl_xcvr: register platform component before registering cpu dai
In reply to Greg Kroah-HartmanFrom: Shengjiu Wang <[email protected]>
[ Upstream commit c590fa80b39287a91abeb487829f3190e7ae775f ]
There is no defer probe when adding platform component to snd_soc_pcm_runtime(rtd), the code is in snd_soc_add_pcm_runtime()
snd_soc_register_card()
-> snd_soc_bind_card()
-> snd_soc_add_pcm_runtime()
-> adding cpu dai
-> adding codec dai
-> adding platform component.So if the platform component is not ready at that time, then the sound card still registered successfully, but platform component is empty, the sound card can't be used.
As there is defer probe checking for cpu dai component, then register platform component before cpu dai to avoid such issue.
--- sound/soc/fsl/fsl_xcvr.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
sound/soc/fsl/fsl_xcvr.c +10 -5
@@ -1217,18 +1217,23 @@ static int fsl_xcvr_probe(struct platform_device *pdev)pm_runtime_enable (dev);regcache_cache_only (xcvr->regmap, true); +/* +* Register platform component before registering cpu dai for there +* is not defer probe for platform component in snd_soc_add_pcm_runtime(). +*/ + ret =devm_snd_dmaengine_pcm_register (dev,NULL ,0 ); +if (ret) { +dev_err (dev,"failed to pcm register\n" ); +return ret; + } + ret =devm_snd_soc_register_component (dev, &fsl_xcvr_comp, &fsl_xcvr_dai,1 );if (ret) {dev_err (dev,"failed to register component %s\n" , fsl_xcvr_comp.name); -return ret; } - ret =devm_snd_dmaengine_pcm_register (dev,NULL ,0 ); -if (ret) -dev_err (dev,"failed to pcm register\n" ); -return ret; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 9/172 ASoC: mediatek: common: handle NULL case in suspend/resume function
In reply to Greg Kroah-HartmanFrom: Trevor Wu <[email protected]>
[ Upstream commit 1dd038522615b70f5f8945c5631e9e2fa5bd58b1 ]
When memory allocation for afe->reg_back_up fails, reg_back_up can't be used.
Keep the suspend/resume flow but skip register backup when afe->reg_back_up is NULL, in case illegal memory access happens.
--- sound/soc/mediatek/common/mtk-afe-fe-dai.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-)
sound/soc/mediatek/common/mtk-afe-fe-dai.c +11 -8
@@ -334,9 +334,11 @@ int mtk_afe_suspend(struct snd_soc_component *component)devm_kcalloc (dev, afe->reg_back_up_list_num,sizeof (unsigned int ),GFP_KERNEL ); -for (i =0 ; i < afe->reg_back_up_list_num; i++) -regmap_read (regmap, afe->reg_back_up_list[i], - &afe->reg_back_up[i]); +if (afe->reg_back_up) { +for (i =0 ; i < afe->reg_back_up_list_num; i++) +regmap_read (regmap, afe->reg_back_up_list[i], + &afe->reg_back_up[i]); + } afe->suspended = true; afe->runtime_suspend (dev);
@@ -356,12 +358,13 @@ int mtk_afe_resume(struct snd_soc_component *component) afe->runtime_resume (dev); -if (!afe->reg_back_up) +if (!afe->reg_back_up) {dev_dbg (dev,"%s no reg_backup\n" , __func__); - -for (i =0 ; i < afe->reg_back_up_list_num; i++) -mtk_regmap_write (regmap, afe->reg_back_up_list[i], - afe->reg_back_up[i]); + }else { +for (i =0 ; i < afe->reg_back_up_list_num; i++) +mtk_regmap_write (regmap, afe->reg_back_up_list[i], + afe->reg_back_up[i]); + } afe->suspended = false;return 0 ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 10/172 scsi: elx: efct: Fix void-pointer-to-enum-cast warning for efc_nport_topology
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
[ Upstream commit 96fafe7c6523886308605d30ec92c7936abe7c2c ]
The kernel test robot flagged an warning for ".../efc_device.c:932:6:
warning: cast to smaller integer type 'enum efc_nport_topology' from 'void *'"
For the topology events, the "arg" field is generically defined as a void * and is used to pass different arguments. Most of the arguments are pointers to data structures. But for the EFC_EVT_NPORT_TOPOLOGY_NOTIFY event, the argument is an enum value, and the code is typecasting the void * to an enum generating the warning.
Fix by converting the EFC_EVT_NPORT_TOPOLOGY_NOTIFY event to pass a pointer to the enum, thus it's a straight-forward pointer dereference in the event handler.
--- drivers/scsi/elx/libefc/efc_device.c | 7 +++---- drivers/scsi/elx/libefc/efc_fabric.c | 3 +-- 2 files changed, 4 insertions(+), 6 deletions(-)
drivers/scsi/elx/libefc/efc_device.c +3 -4
@@ -928,22 +928,21 @@ __efc_d_wait_topology_notify(struct efc_sm_ctx *ctx,break ;case EFC_EVT_NPORT_TOPOLOGY_NOTIFY : { -enum efc_nport_topology topology = - (enum efc_nport_topology )arg; +enum efc_nport_topology *topology = arg;WARN_ON (node->nport->domain->attached);WARN_ON (node->send_ls_acc !=EFC_NODE_SEND_LS_ACC_PLOGI );node_printf (node,"topology notification, topology=%d\n" , - topology); + *topology);/* At the time the PLOGI was received, the topology was unknown, * so we didn't know which node would perform the domain attach: * 1. The node from which the PLOGI was sent (p2p) or * 2. The node to which the FLOGI was sent (fabric). */ -if (topology ==EFC_NPORT_TOPO_P2P ) { +if (*topology ==EFC_NPORT_TOPO_P2P ) {/* if this is p2p, need to attach to the domain using * the d_id from the PLOGI received */
drivers/scsi/elx/libefc/efc_fabric.c +1 -2
@@ -107,7 +107,6 @@ void efc_fabric_notify_topology(struct efc_node *node) {struct efc_node *tmp_node; -enum efc_nport_topology topology = node->nport->topology;unsigned long index;/*
@@ -118,7 +117,7 @@ efc_fabric_notify_topology(struct efc_node *node)if (tmp_node != node) {efc_node_post_event (tmp_node,EFC_EVT_NPORT_TOPOLOGY_NOTIFY , - (void *)topology); + &node->nport->topology); } } }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 11/172 ASoC: SOF: Fix DSP oops stack dump output contents
In reply to Greg Kroah-HartmanFrom: Yong Zhi <[email protected]>
[ Upstream commit ac4dfccb96571ca03af7cac64b7a0b2952c97f3a ]
Fix @buf arg given to hex_dump_to_buffer() and stack address used in dump error output.
--- sound/soc/sof/xtensa/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/sof/xtensa/core.c +2 -2
@@ -122,9 +122,9 @@ static void xtensa_stack(struct snd_sof_dev *sdev, void *oops, u32 *stack,* 0x0049fbb0: 8000f2d0 0049fc00 6f6c6c61 00632e63 */ for (i =0 ; i < stack_words; i +=4 ) { -hex_dump_to_buffer (stack + i *4 ,16 ,16 ,4 , +hex_dump_to_buffer (stack + i,16 ,16 ,4 , buf,sizeof (buf), false); -dev_err (sdev->dev,"0x%08x: %s\n" , stack_ptr + i, buf); +dev_err (sdev->dev,"0x%08x: %s\n" , stack_ptr + i *4 , buf); } }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 12/172 ASoC: SOF: imx: imx8: Bar index is only valid for IRAM and SRAM types
In reply to Greg Kroah-HartmanFrom: Peter Ujfalusi <[email protected]>
[ Upstream commit 10d93a98190aec2c3ff98d9472ab1bf0543aa02c ]
i.MX8 only uses SOF_FW_BLK_TYPE_IRAM (1) and SOF_FW_BLK_TYPE_SRAM (3) bars, everything else is left as 0 in sdev->bar[] array.
If a broken or purposefully crafted firmware image is loaded with other types of FW_BLK_TYPE then a kernel crash can be triggered.
Make sure that only IRAM/SRAM type is converted to bar index.
--- sound/soc/sof/imx/imx8.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
sound/soc/sof/imx/imx8.c +8 -1
@@ -365,7 +365,14 @@ static int imx8_remove(struct snd_sof_dev *sdev)/* on i.MX8 there is 1 to 1 match between type and BAR idx */ static int imx8_get_bar_index (struct snd_sof_dev *sdev,u32 type) { -return type; +/* Only IRAM and SRAM bars are valid */ +switch (type) { +case SOF_FW_BLK_TYPE_IRAM : +case SOF_FW_BLK_TYPE_SRAM : +return type; +default : +return -EINVAL ; + } } static void imx8_ipc_msg_data(struct snd_sof_dev *sdev,
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 13/172 ASoC: SOF: imx: imx8m: Bar index is only valid for IRAM and SRAM types
In reply to Greg Kroah-HartmanFrom: Peter Ujfalusi <[email protected]>
[ Upstream commit d9be4a88c3627c270bbe032b623dc43f3b764565 ]
i.MX8 only uses SOF_FW_BLK_TYPE_IRAM (1) and SOF_FW_BLK_TYPE_SRAM (3) bars, everything else is left as 0 in sdev->bar[] array.
If a broken or purposefully crafted firmware image is loaded with other types of FW_BLK_TYPE then a kernel crash can be triggered.
Make sure that only IRAM/SRAM type is converted to bar index.
--- sound/soc/sof/imx/imx8m.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
sound/soc/sof/imx/imx8m.c +8 -1
@@ -228,7 +228,14 @@ static int imx8m_remove(struct snd_sof_dev *sdev)/* on i.MX8 there is 1 to 1 match between type and BAR idx */ static int imx8m_get_bar_index (struct snd_sof_dev *sdev,u32 type) { -return type; +/* Only IRAM and SRAM bars are valid */ +switch (type) { +case SOF_FW_BLK_TYPE_IRAM : +case SOF_FW_BLK_TYPE_SRAM : +return type; +default : +return -EINVAL ; + } } static void imx8m_ipc_msg_data(struct snd_sof_dev *sdev,
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 14/172 pinctrl: qcom: spmi-gpio: correct parent irqspec translation
In reply to Greg Kroah-HartmanFrom: David Collins <[email protected]>
[ Upstream commit d36a97736b2cc9b13db0dfdf6f32b115ec193614 ]
pmic_gpio_child_to_parent_hwirq() and gpiochip_populate_parent_fwspec_fourcell() translate a pinctrl- spmi-gpio irqspec to an SPMI controller irqspec. When they do this, they use a fixed SPMI slave ID of 0 and a fixed GPIO peripheral offset of 0xC0 (corresponding to SPMI address 0xC000). This translation results in an incorrect irqspec for secondary PMICs that don't have a slave ID of 0 as well as for PMIC chips which have GPIO peripherals located at a base address other than 0xC000.
Correct this issue by passing the slave ID of the pinctrl-spmi- gpio device's parent in the SPMI controller irqspec and by calculating the peripheral ID base from the device tree 'reg' property of the pinctrl-spmi-gpio device.
--- drivers/pinctrl/qcom/pinctrl-spmi-gpio.c | 37 ++++++++++++++++++++++-- 1 file changed, 34 insertions(+), 3 deletions(-)
drivers/pinctrl/qcom/pinctrl-spmi-gpio.c +34 -3
@@ -1,6 +1,6 @@// SPDX-License-Identifier: GPL-2.0-only /* -* Copyright (c) 2012-2014, The Linux Foundation. All rights reserved. +* Copyright (c) 2012-2014, 2016-2021 The Linux Foundation. All rights reserved. */ #include <linux/gpio/driver.h>
@@ -14,6 +14,7 @@#include <linux/platform_device.h> #include <linux/regmap.h> #include <linux/slab.h> +#include <linux/spmi.h> #include <linux/types.h> #include <dt-bindings/pinctrl/qcom,pmic-gpio.h>
@@ -171,6 +172,8 @@ struct pmic_gpio_state {struct pinctrl_dev *ctrl;struct gpio_chip chip;struct irq_chip irq; +u8 usid; +u8 pid_base; };static const struct pinconf_generic_params pmic_gpio_bindings[] = {
@@ -949,12 +952,36 @@ static int pmic_gpio_child_to_parent_hwirq(struct gpio_chip *chip,unsigned int *parent_hwirq, unsigned int *parent_type) { - *parent_hwirq = child_hwirq +0xc0 ; + struct pmic_gpio_state *state = gpiochip_get_data(chip); + + *parent_hwirq = child_hwirq + state->pid_base; *parent_type = child_type;return 0 ; } +static void *pmic_gpio_populate_parent_fwspec (struct gpio_chip *chip, +unsigned int parent_hwirq, +unsigned int parent_type) +{ +struct pmic_gpio_state *state =gpiochip_get_data (chip); +struct irq_fwspec *fwspec; + + fwspec =kzalloc (sizeof (*fwspec),GFP_KERNEL ); +if (!fwspec) +return NULL ; + + fwspec->fwnode = chip->irq.parent_domain->fwnode; + + fwspec->param_count =4 ; + fwspec->param[0 ] = state->usid; + fwspec->param[1 ] = parent_hwirq; +/* param[2] must be left as 0 */ + fwspec->param[3 ] = parent_type; + +return fwspec; +} +static int pmic_gpio_probe (struct platform_device *pdev) {struct irq_domain *parent_domain;
@@ -965,6 +992,7 @@ static int pmic_gpio_probe(struct platform_device *pdev)struct pmic_gpio_pad *pad, *pads;struct pmic_gpio_state *state;struct gpio_irq_chip *girq; +const struct spmi_device *parent_spmi_dev;int ret, npins, i;u32 reg;
@@ -984,6 +1012,9 @@ static int pmic_gpio_probe(struct platform_device *pdev) state->dev = &pdev->dev; state->map =dev_get_regmap (dev->parent,NULL ); + parent_spmi_dev =to_spmi_device (dev->parent); + state->usid = parent_spmi_dev->usid; + state->pid_base = reg >>8 ; pindesc =devm_kcalloc (dev, npins,sizeof (*pindesc),GFP_KERNEL );if (!pindesc)
@@ -1059,7 +1090,7 @@ static int pmic_gpio_probe(struct platform_device *pdev) girq->fwnode =of_node_to_fwnode (state->dev->of_node); girq->parent_domain = parent_domain; girq->child_to_parent_hwirq = pmic_gpio_child_to_parent_hwirq; - girq->populate_parent_alloc_arg = gpiochip_populate_parent_fwspec_fourcell; + girq->populate_parent_alloc_arg = pmic_gpio_populate_parent_fwspec; girq->child_offset_to_irq = pmic_gpio_child_offset_to_irq; girq->child_irq_domain_ops.translate = pmic_gpio_domain_translate;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 15/172 net/mlx4_en: Resolve bad operstate value
In reply to Greg Kroah-HartmanFrom: Lama Kayal <[email protected]>
[ Upstream commit 72a3c58d18fd780eecd80178bb2132ce741a0a74 ]
Any link state change that's done prior to net device registration isn't reflected on the state, thus the operational state is left obsolete, with 'UNKNOWN' status.
To resolve the issue, query link state from FW upon open operations to ensure operational state is updated.
--- .../net/ethernet/mellanox/mlx4/en_netdev.c | 47 ++++++++++++------- drivers/net/ethernet/mellanox/mlx4/mlx4_en.h | 1 - 2 files changed, 29 insertions(+), 19 deletions(-)
drivers/net/ethernet/mellanox/mlx4/en_netdev.c +29 -18
@@ -1272,7 +1272,6 @@ static void mlx4_en_do_set_rx_mode(struct work_struct *work)if (!netif_carrier_ok (dev)) {if (!mlx4_en_QUERY_PORT (mdev, priv->port)) {if (priv->port_state.link_state) { - priv->last_link_state =MLX4_DEV_EVENT_PORT_UP ;netif_carrier_on (dev);en_dbg (LINK , priv,"Link Up\n" ); }
@@ -1560,26 +1559,36 @@ static void mlx4_en_service_task(struct work_struct *work)mutex_unlock (&mdev->state_lock); } -static void mlx4_en_linkstate (struct work_struct *work) +static void mlx4_en_linkstate (struct mlx4_en_priv *priv) +{ +struct mlx4_en_port_state *port_state = &priv->port_state; +struct mlx4_en_dev *mdev = priv->mdev; +struct net_device *dev = priv->dev; +bool up; + +if (mlx4_en_QUERY_PORT (mdev, priv->port)) + port_state->link_state =MLX4_PORT_STATE_DEV_EVENT_PORT_DOWN ; + + up = port_state->link_state ==MLX4_PORT_STATE_DEV_EVENT_PORT_UP ; +if (up ==netif_carrier_ok (dev)) +netif_carrier_event (dev); +if (!up) { +en_info (priv,"Link Down\n" ); +netif_carrier_off (dev); + }else { +en_info (priv,"Link Up\n" ); +netif_carrier_on (dev); + } +} + +static void mlx4_en_linkstate_work (struct work_struct *work) { struct mlx4_en_priv *priv = container_of(work, struct mlx4_en_priv, linkstate_task);struct mlx4_en_dev *mdev = priv->mdev; -int linkstate = priv->link_state;mutex_lock (&mdev->state_lock); -/* If observable port state changed set carrier state and -* report to system log */ -if (priv->last_link_state != linkstate) { -if (linkstate ==MLX4_DEV_EVENT_PORT_DOWN ) { -en_info (priv,"Link Down\n" ); -netif_carrier_off (priv->dev); - }else { -en_info (priv,"Link Up\n" ); -netif_carrier_on (priv->dev); - } - } - priv->last_link_state = linkstate; +mlx4_en_linkstate (priv);mutex_unlock (&mdev->state_lock); }
@@ -2082,9 +2091,11 @@ static int mlx4_en_open(struct net_device *dev)mlx4_en_clear_stats (dev); err =mlx4_en_start_port (dev); -if (err) +if (err) {en_err (priv,"Failed starting port:%d\n" , priv->port); - + goto out; + } +mlx4_en_linkstate (priv); out:mutex_unlock (&mdev->state_lock);return err;
@@ -3171,7 +3182,7 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,spin_lock_init (&priv->stats_lock);INIT_WORK (&priv->rx_mode_task, mlx4_en_do_set_rx_mode);INIT_WORK (&priv->restart_task, mlx4_en_restart); -INIT_WORK (&priv->linkstate_task, mlx4_en_linkstate); +INIT_WORK (&priv->linkstate_task, mlx4_en_linkstate_work);INIT_DELAYED_WORK (&priv->stats_task, mlx4_en_do_get_stats);INIT_DELAYED_WORK (&priv->service_task, mlx4_en_service_task);#ifdef CONFIG_RFS_ACCEL
drivers/net/ethernet/mellanox/mlx4/mlx4_en.h +0 -1
@@ -552,7 +552,6 @@ struct mlx4_en_priv {struct mlx4_hwq_resources res;int link_state; -int last_link_state;bool port_up;int port;int registered;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 16/172 s390/qeth: Fix deadlock in remove_discipline
In reply to Greg Kroah-HartmanFrom: Alexandra Winter <[email protected]>
[ Upstream commit ee909d0b1dac8632eeb78cbf17661d6c7674bbd0 ]
Problem: qeth_close_dev_handler is a worker that tries to acquire card->discipline_mutex via drv->set_offline() in ccwgroup_set_offline(). Since commit b41b554c1ee7
("s390/qeth: fix locking for discipline setup / removal") qeth_remove_discipline() is called under card->discipline_mutex and cancels the work and waits for it to finish.
STOPLAN reception with reason code IPA_RC_VEPA_TO_VEB_TRANSITION is the only situation that schedules close_dev_work. In that situation scheduling qeth recovery will also result in an offline interface, when resetting the isolation mode fails, if the external switch is still set to VEB. And since commit 0b9902c1fcc5 ("s390/qeth: fix deadlock during recovery") qeth recovery does not aquire card->discipline_mutex anymore.
So we accept the longer pathlength of qeth_schedule_recovery in this error situation and re-use the existing function.
As a side-benefit this changes the hwtrap to behave like during recovery instead of like during a user-triggered set_offline.
--- drivers/s390/net/qeth_core.h | 1 - drivers/s390/net/qeth_core_main.c | 16 ++++------------ drivers/s390/net/qeth_l2_main.c | 1 - drivers/s390/net/qeth_l3_main.c | 1 - 4 files changed, 4 insertions(+), 15 deletions(-)
drivers/s390/net/qeth_core.h +0 -1
@@ -877,7 +877,6 @@ struct qeth_card {struct napi_struct napi;struct qeth_rx rx;struct delayed_work buffer_reclaim_work; -struct work_struct close_dev_work; };static inline bool qeth_card_hw_is_reachable (struct qeth_card *card)
drivers/s390/net/qeth_core_main.c +4 -12
@@ -71,15 +71,6 @@ static void qeth_issue_next_read_cb(struct qeth_card *card,static int qeth_qdio_establish (struct qeth_card *);static void qeth_free_qdio_queues (struct qeth_card *card); -static void qeth_close_dev_handler (struct work_struct *work) -{ -struct qeth_card *card; - - card = container_of(work, struct qeth_card, close_dev_work); -QETH_CARD_TEXT (card,2 ,"cldevhdl" ); -ccwgroup_set_offline (card->gdev); -} -static const char *qeth_get_cardname (struct qeth_card *card) {if (IS_VM_NIC (card)) {
@@ -797,10 +788,12 @@ static struct qeth_ipa_cmd *qeth_check_ipa_data(struct qeth_card *card,case IPA_CMD_STOPLAN :if (cmd->hdr.return_code ==IPA_RC_VEPA_TO_VEB_TRANSITION ) {dev_err (&card->gdev->dev, -"Interface %s is down because the adjacent port is no longer in reflective relay mode\n" , +"Adjacent port of interface %s is no longer in reflective relay mode, trigger recovery\n" ,netdev_name (card->dev)); -schedule_work (&card->close_dev_work); +/* Set offline, then probably fail to set online: */ +qeth_schedule_recovery (card); }else { +/* stay online for subsequent STARTLAN */ dev_warn (&card->gdev->dev,"The link for interface %s on CHPID 0x%X failed\n" ,netdev_name (card->dev), card->info.chpid);
@@ -1559,7 +1552,6 @@ static void qeth_setup_card(struct qeth_card *card)INIT_LIST_HEAD (&card->ipato.entries);qeth_init_qdio_info (card);INIT_DELAYED_WORK (&card->buffer_reclaim_work, qeth_buffer_reclaim_work); -INIT_WORK (&card->close_dev_work, qeth_close_dev_handler);hash_init (card->rx_mode_addrs);hash_init (card->local_addrs4);hash_init (card->local_addrs6);
drivers/s390/net/qeth_l2_main.c +0 -1
@@ -2218,7 +2218,6 @@ static void qeth_l2_remove_device(struct ccwgroup_device *gdev)if (gdev->state ==CCWGROUP_ONLINE )qeth_set_offline (card, card->discipline, false); -cancel_work_sync (&card->close_dev_work);if (card->dev->reg_state ==NETREG_REGISTERED )unregister_netdev (card->dev); }
drivers/s390/net/qeth_l3_main.c +0 -1
@@ -1965,7 +1965,6 @@ static void qeth_l3_remove_device(struct ccwgroup_device *cgdev)if (cgdev->state ==CCWGROUP_ONLINE )qeth_set_offline (card, card->discipline, false); -cancel_work_sync (&card->close_dev_work);if (card->dev->reg_state ==NETREG_REGISTERED )unregister_netdev (card->dev);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 17/172 s390/qeth: fix deadlock during failing recovery
In reply to Greg Kroah-HartmanFrom: Alexandra Winter <[email protected]>
[ Upstream commit d2b59bd4b06d84a4eadb520b0f71c62fe8ec0a62 ]
Commit 0b9902c1fcc5 ("s390/qeth: fix deadlock during recovery") removed taking discipline_mutex inside qeth_do_reset(), fixing potential deadlocks. An error path was missed though, that still takes discipline_mutex and thus has the original deadlock potential.
Intermittent deadlocks were seen when a qeth channel path is configured offline, causing a race between qeth_do_reset and ccwgroup_remove. Call qeth_set_offline() directly in the qeth_do_reset() error case and then a new variant of ccwgroup_set_offline(), without taking discipline_mutex.
--- arch/s390/include/asm/ccwgroup.h | 2 +- drivers/s390/cio/ccwgroup.c | 10 ++++++++-- drivers/s390/net/qeth_core_main.c | 3 ++- 3 files changed, 11 insertions(+), 4 deletions(-)
arch/s390/include/asm/ccwgroup.h +1 -1
@@ -57,7 +57,7 @@ struct ccwgroup_device *get_ccwgroupdev_by_busid(struct ccwgroup_driver *gdrv, char *bus_id);extern int ccwgroup_set_online (struct ccwgroup_device *gdev); -extern int ccwgroup_set_offline (struct ccwgroup_device *gdev); +int ccwgroup_set_offline (struct ccwgroup_device *gdev,bool call_gdrv);extern int ccwgroup_probe_ccwdev (struct ccw_device *cdev);extern void ccwgroup_remove_ccwdev (struct ccw_device *cdev);
drivers/s390/cio/ccwgroup.c +8 -2
@@ -77,12 +77,13 @@ EXPORT_SYMBOL(ccwgroup_set_online);/** * ccwgroup_set_offline() - disable a ccwgroup device * @gdev: target ccwgroup device +* @call_gdrv: Call the registered gdrv set_offline function * * This function attempts to put the ccwgroup device into the offline state. * Returns: * %0 on success and a negative error value on failure. */ -int ccwgroup_set_offline (struct ccwgroup_device *gdev) +int ccwgroup_set_offline (struct ccwgroup_device *gdev,bool call_gdrv) {struct ccwgroup_driver *gdrv =to_ccwgroupdrv (gdev->dev.driver);int ret = -EINVAL ;
@@ -91,11 +92,16 @@ int ccwgroup_set_offline(struct ccwgroup_device *gdev)return -EAGAIN ;if (gdev->state ==CCWGROUP_OFFLINE ) goto out; +if (!call_gdrv) { + ret =0 ; + goto offline; + }if (gdrv->set_offline) ret = gdrv->set_offline (gdev);if (ret) goto out; +offline: gdev->state =CCWGROUP_OFFLINE ; out:atomic_set (&gdev->onoff,0 );
@@ -124,7 +130,7 @@ static ssize_t ccwgroup_online_store(struct device *dev,if (value ==1 ) ret =ccwgroup_set_online (gdev);else if (value ==0 ) - ret =ccwgroup_set_offline (gdev); + ret =ccwgroup_set_offline (gdev, true);else ret = -EINVAL ; out:
drivers/s390/net/qeth_core_main.c +2 -1
@@ -5548,7 +5548,8 @@ static int qeth_do_reset(void *data)dev_info (&card->gdev->dev,"Device successfully recovered!\n" ); }else { -ccwgroup_set_offline (card->gdev); +qeth_set_offline (card, disc, true); +ccwgroup_set_offline (card->gdev, false);dev_warn (&card->gdev->dev,"The qeth device driver failed to recover an error on the device\n" ); }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 18/172 crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 505d9dcb0f7ddf9d075e729523a33d38642ae680 ]
There are three bugs in this code:
1) If we ccp_init_data() fails for &src then we need to free aad. Use goto e_aad instead of goto e_ctx.
2) The label to free the &final_wa was named incorrectly as "e_tag" but it should have been "e_final_wa". One error path leaked &final_wa.
3) The &tag was leaked on one error path. In that case, I added a free before the goto because the resource was local to that block.
--- drivers/crypto/ccp/ccp-ops.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/crypto/ccp/ccp-ops.c +8 -6
@@ -778,7 +778,7 @@ ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) in_place ?DMA_BIDIRECTIONAL : DMA_TO_DEVICE);if (ret) - goto e_ctx; + goto e_aad;if (in_place) { dst = src;
@@ -863,7 +863,7 @@ ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) op.u.aes.size =0 ; ret = cmd_q->ccp->vdata->perform->aes (&op);if (ret) - goto e_dst; + goto e_final_wa;if (aes->action ==CCP_AES_ACTION_ENCRYPT ) {/* Put the ciphered tag after the ciphertext. */
@@ -873,17 +873,19 @@ ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) ret =ccp_init_dm_workarea (&tag, cmd_q, authsize,DMA_BIDIRECTIONAL );if (ret) - goto e_tag; + goto e_final_wa; ret =ccp_set_dm_area (&tag,0 , p_tag,0 , authsize); -if (ret) - goto e_tag; +if (ret) { +ccp_dm_free (&tag); + goto e_final_wa; + } ret =crypto_memneq (tag.address, final_wa.address, authsize) ? -EBADMSG :0 ;ccp_dm_free (&tag); } -e_tag: +e_final_wa:ccp_dm_free (&final_wa); e_dst:
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 19/172 m68k: Update ->thread.esp0 before calling syscall_trace() in ret_from_signal
In reply to Greg Kroah-HartmanFrom: Al Viro <[email protected]>
[ Upstream commit 50e43a57334400668952f8e551c9d87d3ed2dfef ]
We get there when sigreturn has performed obscene acts on kernel stack; in particular, the location of pt_regs has shifted. We are about to call syscall_trace(), which might stop for tracer. If that happens, we'd better have task_pt_regs() returning correct result...
--- arch/m68k/kernel/entry.S | 2 ++ 1 file changed, 2 insertions(+)
arch/m68k/kernel/entry.S +2 -0
@@ -186,6 +186,8 @@ ENTRY(ret_from_signal) movel %curptr@(TASK_STACK),%a1 tstb %a1@(TINFO_FLAGS+2) jge 1f + lea %sp@(SWITCH_STACK_SIZE),%a1 + movel %a1,%curptr@(TASK_THREAD+THREAD_ESP0) jbsr syscall_trace 1: RESTORE_SWITCH_STACK addql #4,%sp
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 20/172 NIOS2: fix kconfig unmet dependency warning for SERIAL_CORE_CONSOLE
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit adfc8f9d2f9fefd880abc82cfbf62cbfe6539c97 ]
SERIAL_CORE_CONSOLE depends on TTY so EARLY_PRINTK should also depend on TTY so that it does not select SERIAL_CORE_CONSOLE inadvertently.
WARNING: unmet direct dependencies detected for SERIAL_CORE_CONSOLE
Depends on [n]: TTY [=n] && HAS_IOMEM [=y]
Selected by [y]:
- EARLY_PRINTK [=y]
--- arch/nios2/Kconfig.debug | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/nios2/Kconfig.debug +2 -1
@@ -3,9 +3,10 @@ config EARLY_PRINTK bool "Activate early kernel debugging" default y + depends on TTY select SERIAL_CORE_CONSOLE help - Enable early printk on console + Enable early printk on console. This is useful for kernel debugging when your machine crashes very early before the console code is initialized. You should normally say N here, unless you want to debug such a crash.
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 21/172 kasan: fix Kconfig check of CC_HAS_WORKING_NOSANITIZE_ADDRESS
In reply to Greg Kroah-HartmanFrom: Marco Elver <[email protected]>
[ Upstream commit fa360beac4b62d54879a88b182afef4b369c9700 ]
In the main KASAN config option CC_HAS_WORKING_NOSANITIZE_ADDRESS is checked for instrumentation-based modes. However, if HAVE_ARCH_KASAN_HW_TAGS is true all modes may still be selected.
To fix, also make the software modes depend onCC_HAS_WORKING_NOSANITIZE_ADDRESS.
--- lib/Kconfig.kasan | 2 ++ 1 file changed, 2 insertions(+)
lib/Kconfig.kasan +2 -0
@@ -66,6 +66,7 @@ choice config KASAN_GENERIC bool "Generic mode" depends on HAVE_ARCH_KASAN && CC_HAS_KASAN_GENERIC + depends on CC_HAS_WORKING_NOSANITIZE_ADDRESS select SLUB_DEBUG if SLUB select CONSTRUCTORS help
@@ -86,6 +87,7 @@ config KASAN_GENERIC config KASAN_SW_TAGS bool "Software tag-based mode" depends on HAVE_ARCH_KASAN_SW_TAGS && CC_HAS_KASAN_SW_TAGS + depends on CC_HAS_WORKING_NOSANITIZE_ADDRESS select SLUB_DEBUG if SLUB select CONSTRUCTORS help
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 22/172 HID: amd_sfh: Fix potential NULL pointer dereference
In reply to Greg Kroah-HartmanFrom: Evgeny Novikov <[email protected]>
[ Upstream commit d46ef750ed58cbeeba2d9a55c99231c30a172764 ]
devm_add_action_or_reset() can suddenly invoke amd_mp2_pci_remove() at registration that will cause NULL pointer dereference since corresponding data is not initialized yet. The patch moves initialization of data before devm_add_action_or_reset().
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/hid/amd-sfh-hid/amd_sfh_pcie.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/hid/amd-sfh-hid/amd_sfh_pcie.c +5 -1
@@ -235,6 +235,10 @@ static int amd_mp2_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ireturn rc; } + rc =amd_sfh_hid_client_init (privdata); +if (rc) +return rc; + privdata->cl_data =devm_kzalloc (&pdev->dev,sizeof (struct amdtp_cl_data ),GFP_KERNEL );if (!privdata->cl_data)return -ENOMEM ;
@@ -245,7 +249,7 @@ static int amd_mp2_pci_probe(struct pci_dev *pdev, const struct pci_device_id *imp2_select_ops (privdata); -return amd_sfh_hid_client_init (privdata); +return 0 ; }static const struct pci_device_id amd_mp2_pci_tbl[] = {
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 23/172 perf test: Fix DWARF unwind for optimized builds.
In reply to Greg Kroah-HartmanFrom: Ian Rogers <[email protected]>
[ Upstream commit 5c34aea341b16e29fde6e6c8d4b18866cd99754d ]
To ensure the stack frames are on the stack tail calls optimizations need to be inhibited. If your compiler supports an attribute use it, otherwise use an asm volatile barrier.
The barrier fix was suggested here:
https://lore.kernel.org/lkml/[email protected]/
Tested with an optimized clang build and by forcing the asm barrier route with an optimized clang build.
A GCC bug tracking a proper disable_tail_calls is:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97831
attribute")
v2. is a rebase. The original fix patch generated quite a lot of
discussion over the right place for the fix:
https://lore.kernel.org/lkml/[email protected]/
The patch reflects my preference of it being near the use, so that future code cleanups don't break this somewhat special usage.
--- tools/perf/tests/dwarf-unwind.c | 39 +++++++++++++++++++++++++++------ 1 file changed, 32 insertions(+), 7 deletions(-)
tools/perf/tests/dwarf-unwind.c +32 -7
@@ -20,6 +20,23 @@/* For bsearch. We try to unwind functions in shared object. */ #include <stdlib.h> +/* +* The test will assert frames are on the stack but tail call optimizations lose +* the frame of the caller. Clang can disable this optimization on a called +* function but GCC currently (11/2020) lacks this attribute. The barrier is +* used to inhibit tail calls in these cases. +*/ +#ifdef __has_attribute +#if __has_attribute (disable_tail_calls) +#define NO_TAIL_CALL_ATTRIBUTE __attribute__((disable_tail_calls)) +#define NO_TAIL_CALL_BARRIER +#endif +#endif +#ifndef NO_TAIL_CALL_ATTRIBUTE +#define NO_TAIL_CALL_ATTRIBUTE +#define NO_TAIL_CALL_BARRIER __asm__ __volatile__("" : : : "memory"); +#endif + static int mmap_handler(struct perf_tool *tool __maybe_unused, union perf_event *event, struct perf_sample *sample,
@@ -91,7 +108,7 @@ static int unwind_entry(struct unwind_entry *entry, void *arg)return strcmp ((const char *) symbol, funcs[idx]); } -noinline int test_dwarf_unwind__thread(struct thread *thread) +NO_TAIL_CALL_ATTRIBUTE noinline int test_dwarf_unwind__thread(struct thread *thread) {struct perf_sample sample;unsigned long cnt =0 ;
@@ -122,7 +139,7 @@ noinline int test_dwarf_unwind__thread(struct thread *thread)static int global_unwind_retval = -INT_MAX ; -noinline int test_dwarf_unwind__compare(void *p1, void *p2) +NO_TAIL_CALL_ATTRIBUTE noinline int test_dwarf_unwind__compare(void *p1, void *p2) {/* Any possible value should be 'thread' */ struct thread *thread = *(struct thread **)p1;
@@ -141,7 +158,7 @@ noinline int test_dwarf_unwind__compare(void *p1, void *p2)return p1 - p2; } -noinline int test_dwarf_unwind__krava_3(struct thread *thread) +NO_TAIL_CALL_ATTRIBUTE noinline int test_dwarf_unwind__krava_3(struct thread *thread) {struct thread *array[2 ] = {thread, thread};void *fp = &bsearch;
@@ -160,14 +177,22 @@ noinline int test_dwarf_unwind__krava_3(struct thread *thread)return global_unwind_retval; } -noinline int test_dwarf_unwind__krava_2(struct thread *thread) +NO_TAIL_CALL_ATTRIBUTE noinline int test_dwarf_unwind__krava_2(struct thread *thread) { -return test_dwarf_unwind__krava_3 (thread); +int ret; + + ret =test_dwarf_unwind__krava_3 (thread); +NO_TAIL_CALL_BARRIER ; +return ret; } -noinline int test_dwarf_unwind__krava_1(struct thread *thread) +NO_TAIL_CALL_ATTRIBUTE noinline int test_dwarf_unwind__krava_1(struct thread *thread) { -return test_dwarf_unwind__krava_2 (thread); +int ret; + + ret =test_dwarf_unwind__krava_2 (thread); +NO_TAIL_CALL_BARRIER ; +return ret; }int test__dwarf_unwind (struct test *test__maybe_unused ,int subtest__maybe_unused )
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 24/172 perf iostat: Use system-wide mode if the target cpu_list is unspecified
In reply to Greg Kroah-HartmanFrom: Like Xu <[email protected]>
[ Upstream commit e4fe5d7349e0b1c0d3da5b6b3e1efce591e85bd2 ]
An iostate use case like "perf iostat 0000:16,0000:97 -- ls" should be implemented to work in system-wide mode to ensure that the output from print_header() is consistent with the user documentation perf-iostat.txt, rather than incorrectly assuming that the kernel does not support it:
Error:
The sys_perf_event_open() syscall returned with 22 (Invalid argument) \
for event (uncore_iio_0/event=0x83,umask=0x04,ch_mask=0xF,fc_mask=0x07/). /bin/dmesg | grep -i perf may provide additional information.
This error is easily fixed by assigning system-wide mode by default for IOSTAT_RUN only when the target cpu_list is unspecified.
--- tools/perf/builtin-stat.c | 2 ++ 1 file changed, 2 insertions(+)
tools/perf/builtin-stat.c +2 -0
@@ -2406,6 +2406,8 @@ int cmd_stat(int argc, const char **argv) goto out; }else if (verbose)iostat_list (evsel_list, &stat_config); +if (iostat_mode ==IOSTAT_RUN && !target__has_cpu (&target)) + target.system_wide = true; }if (add_default_attributes ())
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 25/172 perf iostat: Fix Segmentation fault from NULL struct perf_counts_values *
In reply to Greg Kroah-HartmanFrom: Like Xu <[email protected]>
[ Upstream commit 4da8b121884d84476f3d50d46a471471af1aa9df ]
If the 'perf iostat' user specifies two or more iio_root_ports and also specifies the cpu(s) by -C which is not *connected to all* the above iio ports, the iostat_print_metric() will run into trouble:
For example:
$ perf iostat list S0-uncore_iio_0<0000:16> S1-uncore_iio_0<0000:97> # <--- CPU 1 is located in the socket S0
$ perf iostat 0000:16,0000:97 -C 1 -- ls port Inbound Read(MB) Inbound Write(MB) Outbound Read(MB) Outbound Write(MB) ../perf-iostat: line 12: 104418 Segmentation fault (core dumped) perf stat --iostat$DELIMITER$*
The core-dump stack says, in the above corner case, the returned (struct perf_counts_values *) count will be NULL, and the caller iostat_print_metric() apparently doesn't not handle this case.
433 struct perf_counts_values *count = perf_counts(evsel->counts, die, 0);
434
435 if (count->run && count->ena) {
(gdb) p count
$1 = (struct perf_counts_values *) 0x0The deeper reason is that there are actually no statistics from the user specified pair "iostat 0000:X, -C (disconnected) Y ", but let's fix it with minimum cost by adding a NULL check in the user space.
--- tools/perf/arch/x86/util/iostat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/arch/x86/util/iostat.c +1 -1
@@ -432,7 +432,7 @@ void iostat_print_metric(struct perf_stat_config *config, struct evsel *evsel,u8 die = ((struct iio_root_port *)evsel->priv)->die;struct perf_counts_values *count =perf_counts (evsel->counts, die,0 ); -if (count->run && count->ena) { +if (count && count->run && count->ena) {if (evsel->prev_raw_counts && !out->force_header) {struct perf_counts_values *prev_count =perf_counts (evsel->prev_raw_counts, die,0 );
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 26/172 watchdog/sb_watchdog: fix compilation problem due to COMPILE_TEST
In reply to Greg Kroah-HartmanFrom: Jackie Liu <[email protected]>
[ Upstream commit c388a18957efdf31db8e97ec4d2d4b7dc1ca9a44 ]
Compiling sb_watchdog needs to clearly define SIBYTE_HDR_FEATURES. In arch/mips/sibyte/Platform like:
cflags-$(CONFIG_SIBYTE_BCM112X) += \
-I$(srctree)/arch/mips/include/asm/mach-sibyte \
-DSIBYTE_HDR_FEATURES=SIBYTE_HDR_FMASK_1250_112x_ALLOtherwise, SIBYTE_HDR_FEATURES is SIBYTE_HDR_FMASK_ALL. SIBYTE_HDR_FMASK_ALL is mean:
#define SIBYTE_HDR_FMASK_ALL SIBYTE_HDR_FMASK_1250_ALL | SIBYTE_HDR_FMASK_112x_ALL \ | SIBYTE_HDR_FMASK_1480_ALL)
So, If not limited to CPU_SB1, we will get such an error:
arch/mips/include/asm/sibyte/bcm1480_scd.h:261: error: "M_SPC_CFG_CLEAR" redefined [-Werror] arch/mips/include/asm/sibyte/bcm1480_scd.h:262: error: "M_SPC_CFG_ENABLE" redefined [-Werror]
--- drivers/watchdog/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/watchdog/Kconfig +1 -1
@@ -1677,7 +1677,7 @@ config WDT_MTX1 config SIBYTE_WDOG tristate "Sibyte SoC hardware watchdog" - depends on CPU_SB1 || (MIPS && COMPILE_TEST) + depends on CPU_SB1 help Watchdog driver for the built in watchdog hardware in Sibyte SoC processors. There are apparently two watchdog timers
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 27/172 tty: Fix out-of-bound vmalloc access in imageblit
In reply to Greg Kroah-HartmanFrom: Igor Matheus Andrade Torrente <[email protected]>
[ Upstream commit 3b0c406124719b625b1aba431659f5cdc24a982c ]
This issue happens when a userspace program does an ioctl FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct containing only the fields xres, yres, and bits_per_pixel with values.
If this struct is the same as the previous ioctl, the vc_resize() detects it and doesn't call the resize_screen(), leaving the fb_var_screeninfo incomplete. And this leads to the updatescrollmode() calculates a wrong value to fbcon_display->vrows, which makes the real_y() return a wrong value of y, and that value, eventually, causes the imageblit to access an out-of-bound address value.
To solve this issue I made the resize_screen() be called even if the screen does not need any resizing, so it will "fix and fill" the fb_var_screeninfo independently.
--- drivers/tty/vt/vt.c | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-)
drivers/tty/vt/vt.c +19 -2
@@ -1219,8 +1219,25 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, new_row_size = new_cols <<1 ; new_screen_size = new_row_size * new_rows; -if (new_cols == vc->vc_cols && new_rows == vc->vc_rows) -return 0 ; +if (new_cols == vc->vc_cols && new_rows == vc->vc_rows) { +/* +* This function is being called here to cover the case +* where the userspace calls the FBIOPUT_VSCREENINFO twice, +* passing the same fb_var_screeninfo containing the fields +* yres/xres equal to a number non-multiple of vc_font.height +* and yres_virtual/xres_virtual equal to number lesser than the +* vc_font.height and yres/xres. +* In the second call, the struct fb_var_screeninfo isn't +* being modified by the underlying driver because of the +* if above, and this causes the fbcon_display->vrows to become +* negative and it eventually leads to out-of-bound +* access by the imageblit function. +* To give the correct values to the struct and to not have +* to deal with possible errors from the code below, we call +* the resize_screen here as well. +*/ +return resize_screen (vc, new_cols, new_rows, user); + }if (new_screen_size >KMALLOC_MAX_SIZE || !new_screen_size)return -EINVAL ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 28/172 cpufreq: schedutil: Use kobject release() method to free sugov_tunables
In reply to Greg Kroah-HartmanFrom: Kevin Hao <[email protected]>
[ Upstream commit e5c6b312ce3cc97e90ea159446e6bfa06645364d ]
The struct sugov_tunables is protected by the kobject, so we can't free
it directly. Otherwise we would get a call trace like this:
ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x30
WARNING: CPU: 3 PID: 720 at lib/debugobjects.c:505 debug_print_object+0xb8/0x100 Modules linked in: CPU: 3 PID: 720 Comm: a.sh Tainted: G W 5.14.0-rc1-next-20210715-yocto-standard+ #507 Hardware name: Marvell OcteonTX CN96XX board (DT) pstate: 40400009 (nZcv daif +PAN -UAO -TCO BTYPE=--) pc : debug_print_object+0xb8/0x100 lr : debug_print_object+0xb8/0x100 sp : ffff80001ecaf910 x29: ffff80001ecaf910 x28: ffff00011b10b8d0 x27: ffff800011043d80 x26: ffff00011a8f0000 x25: ffff800013cb3ff0 x24: 0000000000000000 x23: ffff80001142aa68 x22: ffff800011043d80 x21: ffff00010de46f20 x20: ffff800013c0c520 x19: ffff800011d8f5b0 x18: 0000000000000010 x17: 6e6968207473696c x16: 5f72656d6974203a x15: 6570797420746365 x14: 6a626f2029302065 x13: 303378302f307830 x12: 2b6e665f72656d69 x11: ffff8000124b1560 x10: ffff800012331520 x9 : ffff8000100ca6b0 x8 : 000000000017ffe8 x7 : c0000000fffeffff x6 : 0000000000000001 x5 : ffff800011d8c000 x4 : ffff800011d8c740 x3 : 0000000000000000 x2 : ffff0001108301c0 x1 : ab3c90eedf9c0f00 x0 : 0000000000000000 Call trace: debug_print_object+0xb8/0x100 __debug_check_no_obj_freed+0x1c0/0x230 debug_check_no_obj_freed+0x20/0x88 slab_free_freelist_hook+0x154/0x1c8 kfree+0x114/0x5d0 sugov_exit+0xbc/0xc0 cpufreq_exit_governor+0x44/0x90 cpufreq_set_policy+0x268/0x4a8 store_scaling_governor+0xe0/0x128 store+0xc0/0xf0 sysfs_kf_write+0x54/0x80 kernfs_fop_write_iter+0x128/0x1c0 new_sync_write+0xf0/0x190 vfs_write+0x2d4/0x478 ksys_write+0x74/0x100 __arm64_sys_write+0x24/0x30 invoke_syscall.constprop.0+0x54/0xe0 do_el0_svc+0x64/0x158 el0_svc+0x2c/0xb0 el0t_64_sync_handler+0xb0/0xb8 el0t_64_sync+0x198/0x19c irq event stamp: 5518 hardirqs last enabled at (5517): [<ffff8000100cbd7c>] console_unlock+0x554/0x6c8 hardirqs last disabled at (5518): [<ffff800010fc0638>] el1_dbg+0x28/0xa0 softirqs last enabled at (5504): [<ffff8000100106e0>] __do_softirq+0x4d0/0x6c0 softirqs last disabled at (5483): [<ffff800010049548>] irq_exit+0x1b0/0x1b8
So split the original sugov_tunables_free() into two functions, sugov_clear_global_tunables() is just used to clear the global_tunables and the new sugov_tunables_free() is used as kobj_type::release to release the sugov_tunables safely.
--- kernel/sched/cpufreq_schedutil.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
kernel/sched/cpufreq_schedutil.c +11 -5
@@ -537,9 +537,17 @@ static struct attribute *sugov_attrs[] = { };ATTRIBUTE_GROUPS (sugov); +static void sugov_tunables_free (struct kobject *kobj) +{ + struct gov_attr_set *attr_set = container_of(kobj, struct gov_attr_set, kobj); + +kfree (to_sugov_tunables (attr_set)); +} +static struct kobj_type sugov_tunables_ktype = { .default_groups = sugov_groups, .sysfs_ops = &governor_sysfs_ops, + .release = &sugov_tunables_free, };/********************** cpufreq governor interface *********************/
@@ -639,12 +647,10 @@ static struct sugov_tunables *sugov_tunables_alloc(struct sugov_policy *sg_policreturn tunables; } -static void sugov_tunables_free (struct sugov_tunables *tunables) +static void sugov_clear_global_tunables (void ) {if (!have_governor_per_policy ()) global_tunables =NULL ; - -kfree (tunables); }static int sugov_init (struct cpufreq_policy *policy)
@@ -707,7 +713,7 @@ out: fail:kobject_put (&tunables->attr_set.kobj); policy->governor_data =NULL ; -sugov_tunables_free (tunables); +sugov_clear_global_tunables (); stop_kthread:sugov_kthread_stop (sg_policy);
@@ -734,7 +740,7 @@ static void sugov_exit(struct cpufreq_policy *policy) count =gov_attr_set_put (&tunables->attr_set, &sg_policy->tunables_hook); policy->governor_data =NULL ;if (!count) -sugov_tunables_free (tunables); +sugov_clear_global_tunables ();mutex_unlock (&global_tunables_lock);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 29/172 scsi: qla2xxx: Changes to support kdump kernel for NVMe BFS
In reply to Greg Kroah-HartmanFrom: Saurav Kashyap <[email protected]>
[ Upstream commit 4a0a542fe5e4273baf9228459ef3f75c29490cba ]
The MSI-X and MSI calls fails in kdump kernel. Because of this qla2xxx_create_qpair() fails leading to .create_queue callback failure. The fix is to return existing qpair instead of allocating new one and allocate a single hw queue.
[ 19.975838] qla2xxx [0000:d8:00.1]-00c7:11: MSI-X: Failed to enable support, giving up -- 16/-28. [ 19.984885] qla2xxx [0000:d8:00.1]-0037:11: Falling back-to MSI mode -- ret=-28. [ 19.992278] qla2xxx [0000:d8:00.1]-0039:11: Falling back-to INTa mode --
ret=-28.
..
..
..
[ 21.141518] qla2xxx [0000:d8:00.0]-2104:2: qla_nvme_alloc_queue: handle
00000000e7ee499d, idx =1, qsize 32
[ 21.151166] qla2xxx [0000:d8:00.0]-0181:2: FW/Driver is not multi-queue capable.
[ 21.158558] qla2xxx [0000:d8:00.0]-2122:2: Failed to allocate qpair
[ 21.164824] nvme nvme0: NVME-FC{0}: reset: Reconnect attempt failed (-22)
[ 21.171612] nvme nvme0: NVME-FC{0}: Reconnect attempt in 2 seconds--- drivers/scsi/qla2xxx/qla_def.h | 1 - drivers/scsi/qla2xxx/qla_isr.c | 2 ++ drivers/scsi/qla2xxx/qla_nvme.c | 40 +++++++++++++++------------------ 3 files changed, 20 insertions(+), 23 deletions(-)
drivers/scsi/qla2xxx/qla_def.h +0 -1
@@ -3935,7 +3935,6 @@ struct qla_hw_data { uint32_t scm_supported_f:1;/* Enabled in Driver */ uint32_t scm_enabled:1; - uint32_t max_req_queue_warned:1; uint32_t plogi_template_valid:1; uint32_t port_isolated:1; } flags;
drivers/scsi/qla2xxx/qla_isr.c +2 -0
@@ -4201,6 +4201,8 @@ skip_msi:ql_dbg (ql_dbg_init, vha,0x0125 ,"INTa mode: Enabled.\n" ); ha->flags.mr_intr_valid =1 ; +/* Set max_qpair to 0, as MSI-X and MSI in not enabled */ + ha->max_qpairs =0 ; } clear_risc_ints:
drivers/scsi/qla2xxx/qla_nvme.c +18 -22
@@ -109,19 +109,24 @@ static int qla_nvme_alloc_queue(struct nvme_fc_local_port *lport,return -EINVAL ; } -if (ha->queue_pair_map[qidx]) { - *handle = ha->queue_pair_map[qidx]; -ql_log (ql_log_info, vha,0x2121 , -"Returning existing qpair of %p for idx=%x\n" , - *handle, qidx); -return 0 ; - } +/* Use base qpair if max_qpairs is 0 */ +if (!ha->max_qpairs) { + qpair = ha->base_qpair; + }else { +if (ha->queue_pair_map[qidx]) { + *handle = ha->queue_pair_map[qidx]; +ql_log (ql_log_info, vha,0x2121 , +"Returning existing qpair of %p for idx=%x\n" , + *handle, qidx); +return 0 ; + } - qpair =qla2xxx_create_qpair (vha,5 , vha->vp_idx, true); -if (qpair ==NULL ) { -ql_log (ql_log_warn, vha,0x2122 , -"Failed to allocate qpair\n" ); -return -EINVAL ; + qpair =qla2xxx_create_qpair (vha,5 , vha->vp_idx, true); +if (!qpair) { +ql_log (ql_log_warn, vha,0x2122 , +"Failed to allocate qpair\n" ); +return -EINVAL ; + } } *handle = qpair;
@@ -728,18 +733,9 @@ int qla_nvme_register_hba(struct scsi_qla_host *vha)WARN_ON (vha->nvme_local_port); -if (ha->max_req_queues <3 ) { -if (!ha->flags.max_req_queue_warned) -ql_log (ql_log_info, vha,0x2120 , -"%s: Disabling FC-NVME due to lack of free queue pairs (%d).\n" , - __func__, ha->max_req_queues); - ha->flags.max_req_queue_warned =1 ; -return ret; - } - qla_nvme_fc_transport.max_hw_queues =min ((uint8_t )(qla_nvme_fc_transport.max_hw_queues), - (uint8_t )(ha->max_req_queues -2 )); + (uint8_t )(ha->max_qpairs ? ha->max_qpairs :1 )); pinfo.node_name =wwn_to_u64 (vha->node_name); pinfo.port_name =wwn_to_u64 (vha->port_name);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 30/172 drm/amdgpu: adjust fence driver enable sequence
In reply to Greg Kroah-HartmanFrom: Likun Gao <[email protected]>
[ Upstream commit 8d35a2596164c1c9d34d4656fd42b445cd1e247f ]
Fence driver was enabled per ring when sw init on per IP block before. Change to enable all the fence driver at the same time after amdgpu_device_ip_init finished.
Rename some function related to fence to make it reasonable for read.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 10 +++-- drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 44 +++------------------- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 7 ++-- 3 files changed, 14 insertions(+), 47 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +6 -4
@@ -3631,6 +3631,8 @@ fence_driver_init: goto release_ras_con; } +amdgpu_fence_driver_hw_init (adev); + dev_info(adev->dev, "SE %d, SH per SE %d, CU per SH %d, active_cu_number %d\n", adev->gfx.config.max_shader_engines,
@@ -3798,7 +3800,7 @@ void amdgpu_device_fini_hw(struct amdgpu_device *adev)else drm_atomic_helper_shutdown (adev_to_drm (adev)); } -amdgpu_fence_driver_fini_hw (adev); +amdgpu_fence_driver_hw_fini (adev);if (adev->pm_sysfs_en)amdgpu_pm_sysfs_fini (adev);
@@ -3820,7 +3822,7 @@ void amdgpu_device_fini_hw(struct amdgpu_device *adev)void amdgpu_device_fini_sw (struct amdgpu_device *adev) {amdgpu_device_ip_fini (adev); -amdgpu_fence_driver_fini_sw (adev); +amdgpu_fence_driver_sw_fini (adev);release_firmware (adev->firmware.gpu_info_fw); adev->firmware.gpu_info_fw =NULL ; adev->accel_working = false;
@@ -3895,7 +3897,7 @@ int amdgpu_device_suspend(struct drm_device *dev, bool fbcon)/* evict vram memory */ amdgpu_bo_evict_vram (adev); -amdgpu_fence_driver_suspend (adev); +amdgpu_fence_driver_hw_fini (adev);amdgpu_device_ip_suspend_phase2 (adev);/* evict remaining vram memory
@@ -3940,7 +3942,7 @@ int amdgpu_device_resume(struct drm_device *dev, bool fbcon)dev_err (adev->dev,"amdgpu_device_ip_resume failed (%d).\n" , r);return r; } -amdgpu_fence_driver_resume (adev); +amdgpu_fence_driver_hw_init (adev); r =amdgpu_device_ip_late_init (adev);
drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c +5 -39
77 lines not on this page · raw message
drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h +3 -4
@@ -107,8 +107,6 @@ struct amdgpu_fence_driver { };int amdgpu_fence_driver_init (struct amdgpu_device *adev); -void amdgpu_fence_driver_fini_hw (struct amdgpu_device *adev); -void amdgpu_fence_driver_fini_sw (struct amdgpu_device *adev);void amdgpu_fence_driver_force_completion (struct amdgpu_ring *ring); int amdgpu_fence_driver_init_ring(struct amdgpu_ring *ring,
@@ -117,8 +115,9 @@ int amdgpu_fence_driver_init_ring(struct amdgpu_ring *ring,int amdgpu_fence_driver_start_ring (struct amdgpu_ring *ring,struct amdgpu_irq_src *irq_src,unsigned irq_type); -void amdgpu_fence_driver_suspend (struct amdgpu_device *adev); -void amdgpu_fence_driver_resume (struct amdgpu_device *adev); +void amdgpu_fence_driver_hw_fini (struct amdgpu_device *adev); +void amdgpu_fence_driver_sw_fini (struct amdgpu_device *adev); +void amdgpu_fence_driver_hw_init (struct amdgpu_device *adev);int amdgpu_fence_emit (struct amdgpu_ring *ring,struct dma_fence **fence,unsigned flags); int amdgpu_fence_emit_polling(struct amdgpu_ring *ring, uint32_t *s,
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 31/172 drm/amdgpu: avoid over-handle of fence driver fini in s3 test (v2)
In reply to Greg Kroah-HartmanFrom: Guchun Chen <[email protected]>
[ Upstream commit 067f44c8b4590c3f24d21a037578a478590f2175 ]
In amdgpu_fence_driver_hw_fini, no need to call drm_sched_fini to stop scheduler in s3 test, otherwise, fence related failure will arrive after resume. To fix this and for a better clean up, move drm_sched_fini from fence_hw_fini to fence_sw_fini, as it's part of driver shutdown, and should never be called in hw_fini.
v2: rename amdgpu_fence_driver_init to amdgpu_fence_driver_sw_init, to keep sw_init and sw_fini paired.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 5 ++--- drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 12 +++++++----- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 4 ++-- 3 files changed, 11 insertions(+), 10 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +2 -3
@@ -3602,9 +3602,9 @@ int amdgpu_device_init(struct amdgpu_device *adev, fence_driver_init:/* Fence driver */ - r =amdgpu_fence_driver_init (adev); + r =amdgpu_fence_driver_sw_init (adev);if (r) { -dev_err (adev->dev,"amdgpu_fence_driver_init failed\n" ); +dev_err (adev->dev,"amdgpu_fence_driver_sw_init failed\n" );amdgpu_vf_error_put (adev,AMDGIM_ERROR_VF_FENCE_INIT_FAIL ,0 ,0 ); goto failed; }
@@ -3944,7 +3944,6 @@ int amdgpu_device_resume(struct drm_device *dev, bool fbcon) }amdgpu_fence_driver_hw_init (adev); - r =amdgpu_device_ip_late_init (adev);if (r)return r;
drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c +7 -5
@@ -498,7 +498,7 @@ int amdgpu_fence_driver_init_ring(struct amdgpu_ring *ring, }/** -* amdgpu_fence_driver_init - init the fence driver +* amdgpu_fence_driver_sw_init - init the fence driver * for all possible rings. * * @adev: amdgpu device pointer
@@ -509,13 +509,13 @@ int amdgpu_fence_driver_init_ring(struct amdgpu_ring *ring,* amdgpu_fence_driver_start_ring(). * Returns 0 for success. */ -int amdgpu_fence_driver_init (struct amdgpu_device *adev) +int amdgpu_fence_driver_sw_init (struct amdgpu_device *adev) {return 0 ; }/** -* amdgpu_fence_driver_fini - tear down the fence driver +* amdgpu_fence_driver_hw_fini - tear down the fence driver * for all possible rings. * * @adev: amdgpu device pointer
@@ -531,8 +531,7 @@ void amdgpu_fence_driver_hw_fini(struct amdgpu_device *adev)if (!ring || !ring->fence_drv.initialized)continue ; -if (!ring->no_scheduler) -drm_sched_fini (&ring->sched); +/* You can't wait for HW to signal if it's gone */ if (!drm_dev_is_unplugged (&adev->ddev)) r =amdgpu_fence_wait_empty (ring);
@@ -560,6 +559,9 @@ void amdgpu_fence_driver_sw_fini(struct amdgpu_device *adev)if (!ring || !ring->fence_drv.initialized)continue ; +if (!ring->no_scheduler) +drm_sched_fini (&ring->sched); +for (j =0 ; j <= ring->fence_drv.num_fences_mask; ++j)dma_fence_put (ring->fence_drv.fences[j]);kfree (ring->fence_drv.fences);
drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h +2 -2
@@ -106,7 +106,6 @@ struct amdgpu_fence_driver {struct dma_fence **fences; }; -int amdgpu_fence_driver_init (struct amdgpu_device *adev);void amdgpu_fence_driver_force_completion (struct amdgpu_ring *ring); int amdgpu_fence_driver_init_ring(struct amdgpu_ring *ring,
@@ -115,9 +114,10 @@ int amdgpu_fence_driver_init_ring(struct amdgpu_ring *ring,int amdgpu_fence_driver_start_ring (struct amdgpu_ring *ring,struct amdgpu_irq_src *irq_src,unsigned irq_type); +void amdgpu_fence_driver_hw_init (struct amdgpu_device *adev);void amdgpu_fence_driver_hw_fini (struct amdgpu_device *adev); +int amdgpu_fence_driver_sw_init (struct amdgpu_device *adev);void amdgpu_fence_driver_sw_fini (struct amdgpu_device *adev); -void amdgpu_fence_driver_hw_init (struct amdgpu_device *adev);int amdgpu_fence_emit (struct amdgpu_ring *ring,struct dma_fence **fence,unsigned flags); int amdgpu_fence_emit_polling(struct amdgpu_ring *ring, uint32_t *s,
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 32/172 drm/amdgpu: stop scheduler when calling hw_fini (v2)
In reply to Greg Kroah-HartmanFrom: Guchun Chen <[email protected]>
[ Upstream commit f7d6779df642720e22bffd449e683bb8690bd3bf ]
This gurantees no more work on the ring can be submitted to hardware in suspend/resume case, otherwise a potential race will occur and the ring will get no chance to stay empty before suspend.
v2: Call drm_sched_resubmit_job before drm_sched_start to restart jobs from the pending list.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c +8 -0
@@ -532,6 +532,9 @@ void amdgpu_fence_driver_hw_fini(struct amdgpu_device *adev)if (!ring || !ring->fence_drv.initialized)continue ; +if (!ring->no_scheduler) +drm_sched_stop (&ring->sched,NULL ); +/* You can't wait for HW to signal if it's gone */ if (!drm_dev_is_unplugged (&adev->ddev)) r =amdgpu_fence_wait_empty (ring);
@@ -591,6 +594,11 @@ void amdgpu_fence_driver_hw_init(struct amdgpu_device *adev)if (!ring || !ring->fence_drv.initialized)continue ; +if (!ring->no_scheduler) { +drm_sched_resubmit_jobs (&ring->sched); +drm_sched_start (&ring->sched, true); + } +/* enable the interrupt */ if (ring->fence_drv.irq_src) amdgpu_irq_get(adev, ring->fence_drv.irq_src,
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 33/172 cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory
In reply to Greg Kroah-HartmanFrom: James Morse <[email protected]>
[ Upstream commit cdef1196608892b9a46caa5f2b64095a7f0be60c ]
Since commit e5c6b312ce3c ("cpufreq: schedutil: Use kobject release() method to free sugov_tunables") kobject_put() has kfree()d the attr_set before gov_attr_set_put() returns.
kobject_put() isn't the last user of attr_set in gov_attr_set_put(), the subsequent mutex_destroy() triggers a use-after-free:
| BUG: KASAN: use-after-free in mutex_is_locked+0x20/0x60 | Read of size 8 at addr ffff000800ca4250 by task cpuhp/2/20 | | CPU: 2 PID: 20 Comm: cpuhp/2 Not tainted 5.15.0-rc1 #12369 | Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development | Platform, BIOS EDK II Jul 30 2018 | Call trace: | dump_backtrace+0x0/0x380 | show_stack+0x1c/0x30 | dump_stack_lvl+0x8c/0xb8 | print_address_description.constprop.0+0x74/0x2b8 | kasan_report+0x1f4/0x210 | kasan_check_range+0xfc/0x1a4 | __kasan_check_read+0x38/0x60 | mutex_is_locked+0x20/0x60 | mutex_destroy+0x80/0x100 | gov_attr_set_put+0xfc/0x150 | sugov_exit+0x78/0x190 | cpufreq_offline.isra.0+0x2c0/0x660 | cpuhp_cpufreq_offline+0x14/0x24 | cpuhp_invoke_callback+0x430/0x6d0 | cpuhp_thread_fun+0x1b0/0x624 | smpboot_thread_fn+0x5e0/0xa6c | kthread+0x3a0/0x450 | ret_from_fork+0x10/0x20
Swap the order of the calls.
--- drivers/cpufreq/cpufreq_governor_attr_set.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cpufreq/cpufreq_governor_attr_set.c +1 -1
@@ -74,8 +74,8 @@ unsigned int gov_attr_set_put(struct gov_attr_set *attr_set, struct list_head *lif (count)return count; -kobject_put (&attr_set->kobj);mutex_destroy (&attr_set->update_lock); +kobject_put (&attr_set->kobj);return 0 ; }EXPORT_SYMBOL_GPL (gov_attr_set_put);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 34/172 scsi: ufs: ufs-pci: Fix Intel LKF link stability
In reply to Greg Kroah-HartmanFrom: Adrian Hunter <[email protected]>
commit 1cbc9ad3eecd492be33b727b4606ae75bc880676 upstream.
Intel LKF can experience link errors. Make fixes to increase link stability, especially when switching to high speed modes.
--- drivers/scsi/ufs/ufshcd-pci.c | 78 +++++++++++++++++++++++++++++++++++ drivers/scsi/ufs/ufshcd.c | 3 +- drivers/scsi/ufs/ufshcd.h | 1 + 3 files changed, 81 insertions(+), 1 deletion(-)
drivers/scsi/ufs/ufshcd-pci.c +78 -0
@@ -128,6 +128,81 @@ static int ufs_intel_link_startup_notify(struct ufs_hba *hba,return err; } +static int ufs_intel_set_lanes (struct ufs_hba *hba,u32 lanes) +{ +struct ufs_pa_layer_attr pwr_info = hba->pwr_info; +int ret; + + pwr_info.lane_rx = lanes; + pwr_info.lane_tx = lanes; + ret =ufshcd_config_pwr_mode (hba, &pwr_info); +if (ret) +dev_err (hba->dev,"%s: Setting %u lanes, err = %d\n" , + __func__, lanes, ret); +return ret; +} + +static int ufs_intel_lkf_pwr_change_notify (struct ufs_hba *hba, +enum ufs_notify_change_status status, +struct ufs_pa_layer_attr *dev_max_params, +struct ufs_pa_layer_attr *dev_req_params) +{ +int err =0 ; + +switch (status) { +case PRE_CHANGE : +if (ufshcd_is_hs_mode (dev_max_params) && + (hba->pwr_info.lane_rx !=2 || hba->pwr_info.lane_tx !=2 )) +ufs_intel_set_lanes (hba,2 ); +memcpy (dev_req_params, dev_max_params,sizeof (*dev_req_params)); +break ; +case POST_CHANGE : +if (ufshcd_is_hs_mode (dev_req_params)) { +u32 peer_granularity; + +usleep_range (1000 ,1250 ); + err =ufshcd_dme_peer_get (hba,UIC_ARG_MIB (PA_GRANULARITY ), + &peer_granularity); + } +break ; +default : +break ; + } + +return err; +} + +static int ufs_intel_lkf_apply_dev_quirks (struct ufs_hba *hba) +{ +u32 granularity, peer_granularity; +u32 pa_tactivate, peer_pa_tactivate; +int ret; + + ret =ufshcd_dme_get (hba,UIC_ARG_MIB (PA_GRANULARITY ), &granularity); +if (ret) + goto out; + + ret =ufshcd_dme_peer_get (hba,UIC_ARG_MIB (PA_GRANULARITY ), &peer_granularity); +if (ret) + goto out; + + ret =ufshcd_dme_get (hba,UIC_ARG_MIB (PA_TACTIVATE ), &pa_tactivate); +if (ret) + goto out; + + ret =ufshcd_dme_peer_get (hba,UIC_ARG_MIB (PA_TACTIVATE ), &peer_pa_tactivate); +if (ret) + goto out; + +if (granularity == peer_granularity) { +u32 new_peer_pa_tactivate = pa_tactivate +2 ; + + ret =ufshcd_dme_peer_set (hba,UIC_ARG_MIB (PA_TACTIVATE ), new_peer_pa_tactivate); + } +out: +return ret; +} +#define INTEL_ACTIVELTR 0x804#define INTEL_IDLELTR 0x808
@@ -351,6 +426,7 @@ static int ufs_intel_lkf_init(struct ufs_hba *hba)struct ufs_host *ufs_host;int err; + hba->nop_out_timeout =200 ; hba->quirks |=UFSHCD_QUIRK_BROKEN_AUTO_HIBERN8 ; hba->caps |=UFSHCD_CAP_CRYPTO ; err =ufs_intel_common_init (hba);
@@ -381,6 +457,8 @@ static struct ufs_hba_variant_ops ufs_intel_lkf_hba_vops = { .exit = ufs_intel_common_exit, .hce_enable_notify = ufs_intel_hce_enable_notify, .link_startup_notify = ufs_intel_link_startup_notify, + .pwr_change_notify = ufs_intel_lkf_pwr_change_notify, + .apply_dev_quirks = ufs_intel_lkf_apply_dev_quirks, .resume = ufs_intel_resume, .device_reset = ufs_intel_device_reset, };
drivers/scsi/ufs/ufshcd.c +2 -1
@@ -4767,7 +4767,7 @@ static int ufshcd_verify_dev_init(struct ufs_hba *hba)mutex_lock (&hba->dev_cmd.lock);for (retries =NOP_OUT_RETRIES ; retries >0 ; retries--) { err =ufshcd_exec_dev_cmd (hba,DEV_CMD_TYPE_NOP , -NOP_OUT_TIMEOUT ); + hba->nop_out_timeout);if (!err || err == -ETIMEDOUT )break ;
@@ -9403,6 +9403,7 @@ int ufshcd_alloc_host(struct device *dev, struct ufs_hba **hba_handle) hba->dev = dev; *hba_handle = hba; hba->dev_ref_clk_freq =REF_CLK_FREQ_INVAL ; + hba->nop_out_timeout =NOP_OUT_TIMEOUT ;INIT_LIST_HEAD (&hba->clk_list_head);
drivers/scsi/ufs/ufshcd.h +1 -0
@@ -814,6 +814,7 @@ struct ufs_hba {/* Device management request data */ struct ufs_dev_cmd dev_cmd;ktime_t last_dme_cmd_tstamp; +int nop_out_timeout;/* Keeps information of the UFS device connected to this host */ struct ufs_dev_info dev_info;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 35/172 ALSA: rawmidi: introduce SNDRV_RAWMIDI_IOCTL_USER_PVERSION
In reply to Greg Kroah-HartmanFrom: Jaroslav Kysela <[email protected]>
commit 09d23174402da0f10e98da2c61bb5ac8e7d79fdd upstream.
The new framing mode causes the user space regression, because the alsa-lib code does not initialize the reserved space in the params structure when the device is opened.
This change adds SNDRV_RAWMIDI_IOCTL_USER_PVERSION like we do for the PCM interface for the protocol acknowledgment.
--- include/sound/rawmidi.h | 1 + include/uapi/sound/asound.h | 1 + sound/core/rawmidi.c | 9 +++++++++ 3 files changed, 11 insertions(+)
include/sound/rawmidi.h +1 -0
@@ -98,6 +98,7 @@ struct snd_rawmidi_file {struct snd_rawmidi *rmidi;struct snd_rawmidi_substream *input;struct snd_rawmidi_substream *output; +unsigned int user_pversion;/* supported protocol version */ };struct snd_rawmidi_str {
include/uapi/sound/asound.h +1 -0
@@ -783,6 +783,7 @@ struct snd_rawmidi_status {#define SNDRV_RAWMIDI_IOCTL_PVERSION _IOR('W', 0x00, int)#define SNDRV_RAWMIDI_IOCTL_INFO _IOR('W', 0x01, struct snd_rawmidi_info) +#define SNDRV_RAWMIDI_IOCTL_USER_PVERSION _IOW('W', 0x02, int)#define SNDRV_RAWMIDI_IOCTL_PARAMS _IOWR('W', 0x10, struct snd_rawmidi_params)#define SNDRV_RAWMIDI_IOCTL_STATUS _IOWR('W', 0x20, struct snd_rawmidi_status)#define SNDRV_RAWMIDI_IOCTL_DROP _IOW('W', 0x30, int)
sound/core/rawmidi.c +9 -0
@@ -873,12 +873,21 @@ static long snd_rawmidi_ioctl(struct filreturn -EINVAL ; } } +case SNDRV_RAWMIDI_IOCTL_USER_PVERSION : +if (get_user (rfile->user_pversion, (unsigned int __user *)arg)) +return -EFAULT ; +return 0 ; +case SNDRV_RAWMIDI_IOCTL_PARAMS : {struct snd_rawmidi_params params;if (copy_from_user (¶ms, argp,sizeof (struct snd_rawmidi_params )))return -EFAULT ; +if (rfile->user_pversion <SNDRV_PROTOCOL_VERSION (2 ,0 ,2 )) { + params.mode =0 ; +memset (params.reserved,0 ,sizeof (params.reserved)); + }switch (params.stream) {case SNDRV_RAWMIDI_STREAM_OUTPUT :if (rfile->output ==NULL )
Greg Kroah-Hartman
maintainerPATCH 36/172 ALSA: firewire-motu: fix truncated bytes in message tracepoints
In reply to Greg Kroah-HartmanFrom: Takashi Sakamoto <[email protected]>
commit cb1bcf5ed536747013fe2b3f9bd56ce3242c295a upstream.
In MOTU protocol v2/v3, first two data chunks across 2nd and 3rd data channels includes message bytes from device. The total size of message is 48 bits per data block.
The 'data_block_message' tracepoints event produced by ALSA firewire-motu driver exposes the sequence of messages to userspace in 64 bit storage, however lower 32 bits are actually available since current implementation truncates 16 bits in upper of the message as a result of bit shift operation within 32 bit storage.
This commit fixes the bug by perform the bit shift in 64 bit storage.
--- sound/firewire/motu/amdtp-motu.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
sound/firewire/motu/amdtp-motu.c +4 -3
@@ -276,10 +276,11 @@ static void __maybe_unused copy_message(/* This is just for v2/v3 protocol. */ for (i =0 ; i < data_blocks; ++i) { - *frames = (be32_to_cpu (buffer[1 ]) <<16 ) | - (be32_to_cpu (buffer[2 ]) >>16 ); + *frames =be32_to_cpu (buffer[1 ]); + *frames <<=16 ; + *frames |=be32_to_cpu (buffer[2 ]) >>16 ; + ++frames; buffer += data_block_quadlets; - frames++; } }
Greg Kroah-Hartman
maintainerPATCH 37/172 ALSA: hda/realtek: Quirks to enable speaker output for Lenovo Legion 7i 15IMHG05, Yoga 7i 14ITL5/15ITL5, and 13s Gen2 laptops.
In reply to Greg Kroah-HartmanFrom: Cameron Berkenpas <[email protected]>
commit ad7cc2d41b7a8d0c5c5ecff37c3de7a4e137b3a6 upstream.
This patch initializes and enables speaker output on the Lenovo Legion 7i 15IMHG05, Yoga 7i 14ITL5/15ITL5, and 13s Gen2 series of laptops using the HDA verb sequence specific to each model.
Speaker automute is suppressed for the Lenovo Legion 7i 15IMHG05 to avoid breaking speaker output on resume and when devices are unplugged from its headphone jack.
Thanks to: Andreas Holzer, Vincent Morel, sycxyc, Max Christian Pohle and all others that helped.
[ minor coding style fixes by tiwai ]
--- sound/pci/hda/patch_realtek.c | 129 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 129 insertions(+)
sound/pci/hda/patch_realtek.c +129 -0
@@ -6442,6 +6442,20 @@ static void alc_fixup_thinkpad_acpi(struhda_fixup_thinkpad_acpi (codec, fix, action); } +/* Fixup for Lenovo Legion 15IMHg05 speaker output on headset removal. */ +static void alc287_fixup_legion_15imhg05_speakers (struct hda_codec *codec, +const struct hda_fixup *fix, +int action) +{ +struct alc_spec *spec = codec->spec; + +switch (action) { +case HDA_FIXUP_ACT_PRE_PROBE : + spec->gen.suppress_auto_mute =1 ; +break ; + } +} +/* for alc295_fixup_hp_top_speakers */ #include "hp_x360_helper.c"
@@ -6659,6 +6673,10 @@ enum {ALC623_FIXUP_LENOVO_THINKSTATION_P340 ,ALC255_FIXUP_ACER_HEADPHONE_AND_MIC ,ALC236_FIXUP_HP_LIMIT_INT_MIC_BOOST , +ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS , +ALC287_FIXUP_LEGION_15IMHG05_AUTOMUTE , +ALC287_FIXUP_YOGA7_14ITL_SPEAKERS , +ALC287_FIXUP_13S_GEN2_SPEAKERS }; static const struct hda_fixup alc269_fixups[] = {
@@ -8249,6 +8267,113 @@ static const struct hda_fixup alc269_fix .chained = true, .chain_id = ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF, }, + [ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS] = { + .type = HDA_FIXUP_VERBS, +//.v.verbs = legion_15imhg05_coefs, + .v.verbs = (const struct hda_verb []) { +// set left speaker Legion 7i. + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x24 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x41 }, + + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xc }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x1a }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, + + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x2 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, + +// set right speaker Legion 7i. + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x24 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x42 }, + + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xc }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x2a }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, + + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x2 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, + {} + }, + .chained = true, + .chain_id = ALC287_FIXUP_LEGION_15IMHG05_AUTOMUTE, + }, + [ALC287_FIXUP_LEGION_15IMHG05_AUTOMUTE] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc287_fixup_legion_15imhg05_speakers, + .chained = true, + .chain_id = ALC269_FIXUP_HEADSET_MODE, + }, + [ALC287_FIXUP_YOGA7_14ITL_SPEAKERS] = { + .type = HDA_FIXUP_VERBS, + .v.verbs = (const struct hda_verb []) { +// set left speaker Yoga 7i. + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x24 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x41 }, + + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xc }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x1a }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, + + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x2 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, + +// set right speaker Yoga 7i. + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x24 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x46 }, + + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xc }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x2a }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, + + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x2 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, + {} + }, + .chained = true, + .chain_id = ALC269_FIXUP_HEADSET_MODE, + }, + [ALC287_FIXUP_13S_GEN2_SPEAKERS] = { + .type = HDA_FIXUP_VERBS, + .v.verbs = (const struct hda_verb []) { + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x24 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x41 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x2 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x24 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x42 }, + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x2 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, + {} + }, + .chained = true, + .chain_id = ALC269_FIXUP_HEADSET_MODE, + }, };static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -8643,6 +8768,10 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x17aa ,0x3818 ,"Lenovo C940" ,ALC298_FIXUP_LENOVO_SPK_VOLUME ),SND_PCI_QUIRK (0x17aa ,0x3827 ,"Ideapad S740" ,ALC285_FIXUP_IDEAPAD_S740_COEF ),SND_PCI_QUIRK (0x17aa ,0x3843 ,"Yoga 9i" ,ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP ), +SND_PCI_QUIRK (0x17aa ,0x3813 ,"Legion 7i 15IMHG05" ,ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS ), +SND_PCI_QUIRK (0x17aa ,0x3852 ,"Lenovo Yoga 7 14ITL5" ,ALC287_FIXUP_YOGA7_14ITL_SPEAKERS ), +SND_PCI_QUIRK (0x17aa ,0x3853 ,"Lenovo Yoga 7 15ITL5" ,ALC287_FIXUP_YOGA7_14ITL_SPEAKERS ), +SND_PCI_QUIRK (0x17aa ,0x3819 ,"Lenovo 13s Gen2 ITL" ,ALC287_FIXUP_13S_GEN2_SPEAKERS ),SND_PCI_QUIRK (0x17aa ,0x3902 ,"Lenovo E50-80" ,ALC269_FIXUP_DMIC_THINKPAD_ACPI ),SND_PCI_QUIRK (0x17aa ,0x3977 ,"IdeaPad S210" ,ALC283_FIXUP_INT_MIC ), SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
Greg Kroah-Hartman
maintainerPATCH 38/172 ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect
In reply to Greg Kroah-HartmanFrom: Jia He <[email protected]>
commit f060db99374e80e853ac4916b49f0a903f65e9dc upstream.
When ACPI NFIT table is failing to populate correct numa information on arm64, dax_kmem will get NUMA_NO_NODE from the NFIT driver.
Without this patch, pmem can't be probed as RAM devices on arm64 guest:
$ndctl create-namespace -fe namespace0.0 --mode=devdax --map=dev -s 1g -a 128M kmem dax0.0: rejecting DAX region [mem 0x240400000-0x2bfffffff] with invalid node: -1
kmem: probe of dax0.0 failed with error -22
--- drivers/acpi/nfit/core.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/acpi/nfit/core.c +12 -0
@@ -3007,6 +3007,18 @@ static int acpi_nfit_register_region(str ndr_desc->target_node =NUMA_NO_NODE ; } +/* Fallback to address based numa information if node lookup failed */ +if (ndr_desc->numa_node ==NUMA_NO_NODE ) { + ndr_desc->numa_node =memory_add_physaddr_to_nid (spa->address); +dev_info (acpi_desc->dev,"changing numa node from %d to %d for nfit region [%pa-%pa]" , +NUMA_NO_NODE , ndr_desc->numa_node, &res.start, &res.end); + } +if (ndr_desc->target_node ==NUMA_NO_NODE ) { + ndr_desc->target_node =phys_to_target_node (spa->address); +dev_info (acpi_desc->dev,"changing target node from %d to %d for nfit region [%pa-%pa]" , +NUMA_NO_NODE , ndr_desc->numa_node, &res.start, &res.end); + } +/* * Persistence domain bits are hierarchical, if * ACPI_NFIT_CAPABILITY_CACHE_FLUSH is set then
Greg Kroah-Hartman
maintainerPATCH 39/172 fs-verity: fix signed integer overflow with i_size near S64_MAX
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
commit 80f6e3080bfcf865062a926817b3ca6c4a137a57 upstream.
If the file size is almost S64_MAX, the calculated number of Merkle tree levels exceeds FS_VERITY_MAX_LEVELS, causing FS_IOC_ENABLE_VERITY to fail. This is unintentional, since as the comment above the definition of FS_VERITY_MAX_LEVELS states, it is enough for over U64_MAX bytes of data using SHA-256 and 4K blocks. (Specifically, 4096*128**8 >= 2**64.)
The bug is actually that when the number of blocks in the first level is calculated from i_size, there is a signed integer overflow due to i_size being signed. Fix this by treating i_size as unsigned.
This was found by the new test "generic: test fs-verity EFBIG scenarios"
(https://lkml.kernel.org/r/b1d116cd4d0ea74b9cd86f349c672021e005a75c.1631558495.git.boris@bur.io).
This didn't affect ext4 or f2fs since those have a smaller maximum file size, but it did affect btrfs which allows files up to S64_MAX bytes.
--- fs/verity/enable.c | 2 +- fs/verity/open.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
fs/verity/enable.c +1 -1
@@ -177,7 +177,7 @@ static int build_merkle_tree(struct file* (level 0) and ascending to the root node (level 'num_levels - 1'). * Then at the end (level 'num_levels'), calculate the root hash. */ - blocks = (inode->i_size + params->block_size -1 ) >> + blocks = ((u64 )inode->i_size + params->block_size -1 ) >> params->log_blocksize;for (level =0 ; level <= params->num_levels; level++) { err = build_merkle_tree_level(filp, level, blocks, params,
fs/verity/open.c +1 -1
@@ -89,7 +89,7 @@ int fsverity_init_merkle_tree_params(str*/ /* Compute number of levels and the number of blocks in each level */ - blocks = (inode->i_size + params->block_size -1 ) >> log_blocksize; + blocks = ((u64 )inode->i_size + params->block_size -1 ) >> log_blocksize;pr_debug ("Data is %lld bytes (%llu blocks)\n" , inode->i_size, blocks);while (blocks >1 ) {if (params->num_levels >=FS_VERITY_MAX_LEVELS ) {
Greg Kroah-Hartman
maintainerPATCH 40/172 hwmon: (tmp421) handle I2C errors
In reply to Greg Kroah-HartmanFrom: Paul Fertser <[email protected]>
commit 2938b2978a70d4cc10777ee71c9e512ffe4e0f4b upstream.
Function i2c_smbus_read_byte_data() can return a negative error number instead of the data read if I2C transaction failed for whatever reason.
Lack of error checking can lead to serious issues on production hardware, e.g. errors treated as temperatures produce spurious critical temperature-crossed-threshold errors in BMC logs for OCP server hardware. The patch was tested with Mellanox OCP Mezzanine card emulating TMP421 protocol for temperature sensing which sometimes leads to I2C protocol error during early boot up stage.
--- drivers/hwmon/tmp421.c | 38 ++++++++++++++++++++++++++++---------- 1 file changed, 28 insertions(+), 10 deletions(-)
drivers/hwmon/tmp421.c +28 -10
@@ -119,38 +119,56 @@ static int temp_from_u16(u16 reg)return (temp *1000 +128 ) /256 ; } -static struct tmp421_data *tmp421_update_device (struct device *dev) +static int tmp421_update_device (struct tmp421_data *data) { -struct tmp421_data *data =dev_get_drvdata (dev);struct i2c_client *client = data->client; +int ret =0 ;int i;mutex_lock (&data->update_lock);if (time_after (jiffies, data->last_updated + (HZ /2 )) || !data->valid) { - data->config =i2c_smbus_read_byte_data (client, -TMP421_CONFIG_REG_1 ); + ret =i2c_smbus_read_byte_data (client,TMP421_CONFIG_REG_1 ); +if (ret <0 ) + goto exit; + data->config = ret;for (i =0 ; i < data->channels; i++) { - data->temp[i] =i2c_smbus_read_byte_data (client, -TMP421_TEMP_MSB [i]) <<8 ; - data->temp[i] |=i2c_smbus_read_byte_data (client, -TMP421_TEMP_LSB [i]); + ret =i2c_smbus_read_byte_data (client,TMP421_TEMP_MSB [i]); +if (ret <0 ) + goto exit; + data->temp[i] = ret <<8 ; + + ret =i2c_smbus_read_byte_data (client,TMP421_TEMP_LSB [i]); +if (ret <0 ) + goto exit; + data->temp[i] |= ret; } data->last_updated = jiffies; data->valid =1 ; } +exit:mutex_unlock (&data->update_lock); -return data; +if (ret <0 ) { + data->valid =0 ; +return ret; + } + +return 0 ; }static int tmp421_read (struct device *dev,enum hwmon_sensor_types type,u32 attr,int channel,long *val) { -struct tmp421_data *tmp421 =tmp421_update_device (dev); +struct tmp421_data *tmp421 =dev_get_drvdata (dev); +int ret =0 ; + + ret =tmp421_update_device (tmp421); +if (ret) +return ret;switch (attr) {case hwmon_temp_input:
Greg Kroah-Hartman
maintainerPATCH 41/172 hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field
In reply to Greg Kroah-HartmanFrom: Nadezda Lutovinova <[email protected]>
commit dd4d747ef05addab887dc8ff0d6ab9860bbcd783 upstream.
If driver read tmp value sufficient for
(tmp & 0x08) && (!(tmp & 0x80)) && ((tmp & 0x7) == ((tmp >> 4) & 0x7)) from device then Null pointer dereference occurs.
(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers) Also lm75[] does not serve a purpose anymore after switching to devm_i2c_new_dummy_device() in w83791d_detect_subclients().
The patch fixes possible NULL pointer dereference by removing lm75[].
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/hwmon/w83793.c | 26 +++++++++++--------------- 1 file changed, 11 insertions(+), 15 deletions(-)
drivers/hwmon/w83793.c +11 -15
@@ -202,7 +202,6 @@ static inline s8 TEMP_TO_REG(long val, s }struct w83793_data { -struct i2c_client *lm75[2 ];struct device *hwmon_dev;struct mutex update_lock;char valid;/* !=0 if following fields are valid */
@@ -1566,7 +1565,6 @@ w83793_detect_subclients(struct i2c_clieint address = client->addr;u8 tmp;struct i2c_adapter *adapter = client->adapter; -struct w83793_data *data =i2c_get_clientdata (client); id =i2c_adapter_id (adapter);if (force_subclients[0 ] == id && force_subclients[1 ] == address) {
@@ -1586,21 +1584,19 @@ w83793_detect_subclients(struct i2c_clie } tmp =w83793_read_value (client,W83793_REG_I2C_SUBADDR ); -if (!(tmp &0x08 )) - data->lm75[0 ] =devm_i2c_new_dummy_device (&client->dev, adapter, -0x48 + (tmp &0x7 )); -if (!(tmp &0x80 )) { -if (!IS_ERR (data->lm75[0 ]) - && ((tmp &0x7 ) == ((tmp >>4 ) &0x7 ))) { -dev_err (&client->dev, -"duplicate addresses 0x%x, " -"use force_subclients\n" , data->lm75[0 ]->addr); -return -ENODEV ; - } - data->lm75[1 ] =devm_i2c_new_dummy_device (&client->dev, adapter, -0x48 + ((tmp >>4 ) &0x7 )); + +if (!(tmp &0x88 ) && (tmp &0x7 ) == ((tmp >>4 ) &0x7 )) { +dev_err (&client->dev, +"duplicate addresses 0x%x, use force_subclient\n" ,0x48 + (tmp &0x7 )); +return -ENODEV ; } +if (!(tmp &0x08 )) +devm_i2c_new_dummy_device (&client->dev, adapter,0x48 + (tmp &0x7 )); + +if (!(tmp &0x80 )) +devm_i2c_new_dummy_device (&client->dev, adapter,0x48 + ((tmp >>4 ) &0x7 )); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 42/172 hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field
In reply to Greg Kroah-HartmanFrom: Nadezda Lutovinova <[email protected]>
commit 0f36b88173f028e372668ae040ab1a496834d278 upstream.
If driver read val value sufficient for
(val & 0x08) && (!(val & 0x80)) && ((val & 0x7) == ((val >> 4) & 0x7)) from device then Null pointer dereference occurs.
(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers) Also lm75[] does not serve a purpose anymore after switching to devm_i2c_new_dummy_device() in w83791d_detect_subclients().
The patch fixes possible NULL pointer dereference by removing lm75[].
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/hwmon/w83792d.c | 28 +++++++++++----------------- 1 file changed, 11 insertions(+), 17 deletions(-)
drivers/hwmon/w83792d.c +11 -17
@@ -264,9 +264,6 @@ struct w83792d_data {char valid;/* !=0 if following fields are valid */ unsigned long last_updated;/* In jiffies */ -/* array of 2 pointers to subclients */ -struct i2c_client *lm75[2 ]; -u8 in[9 ];/* Register value */ u8 in_max[9 ];/* Register value */ u8 in_min[9 ];/* Register value */
@@ -927,7 +924,6 @@ w83792d_detect_subclients(struct i2c_cliint address = new_client->addr;u8 val;struct i2c_adapter *adapter = new_client->adapter; -struct w83792d_data *data =i2c_get_clientdata (new_client); id =i2c_adapter_id (adapter);if (force_subclients[0 ] == id && force_subclients[1 ] == address) {
@@ -946,21 +942,19 @@ w83792d_detect_subclients(struct i2c_cli } val =w83792d_read_value (new_client,W83792D_REG_I2C_SUBADDR ); -if (!(val &0x08 )) - data->lm75[0 ] =devm_i2c_new_dummy_device (&new_client->dev, adapter, -0x48 + (val &0x7 )); -if (!(val &0x80 )) { -if (!IS_ERR (data->lm75[0 ]) && - ((val &0x7 ) == ((val >>4 ) &0x7 ))) { -dev_err (&new_client->dev, -"duplicate addresses 0x%x, use force_subclient\n" , - data->lm75[0 ]->addr); -return -ENODEV ; - } - data->lm75[1 ] =devm_i2c_new_dummy_device (&new_client->dev, adapter, -0x48 + ((val >>4 ) &0x7 )); + +if (!(val &0x88 ) && (val &0x7 ) == ((val >>4 ) &0x7 )) { +dev_err (&new_client->dev, +"duplicate addresses 0x%x, use force_subclient\n" ,0x48 + (val &0x7 )); +return -ENODEV ; } +if (!(val &0x08 )) +devm_i2c_new_dummy_device (&new_client->dev, adapter,0x48 + (val &0x7 )); + +if (!(val &0x80 )) +devm_i2c_new_dummy_device (&new_client->dev, adapter,0x48 + ((val >>4 ) &0x7 )); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 43/172 hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field
In reply to Greg Kroah-HartmanFrom: Nadezda Lutovinova <[email protected]>
commit 943c15ac1b84d378da26bba41c83c67e16499ac4 upstream.
If driver read val value sufficient for
(val & 0x08) && (!(val & 0x80)) && ((val & 0x7) == ((val >> 4) & 0x7)) from device then Null pointer dereference occurs.
(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers) Also lm75[] does not serve a purpose anymore after switching to devm_i2c_new_dummy_device() in w83791d_detect_subclients().
The patch fixes possible NULL pointer dereference by removing lm75[].
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/hwmon/w83791d.c | 29 +++++++++++------------------ 1 file changed, 11 insertions(+), 18 deletions(-)
drivers/hwmon/w83791d.c +11 -18
@@ -273,9 +273,6 @@ struct w83791d_data {char valid;/* !=0 if following fields are valid */ unsigned long last_updated;/* In jiffies */ -/* array of 2 pointers to subclients */ -struct i2c_client *lm75[2 ]; -/* volts */ u8 in[NUMBER_OF_VIN ];/* Register value */ u8 in_max[NUMBER_OF_VIN ];/* Register value */
@@ -1257,7 +1254,6 @@ static const struct attribute_group w837static int w83791d_detect_subclients (struct i2c_client *client) {struct i2c_adapter *adapter = client->adapter; -struct w83791d_data *data =i2c_get_clientdata (client);int address = client->addr;int i, id;u8 val;
@@ -1280,22 +1276,19 @@ static int w83791d_detect_subclients(str } val =w83791d_read (client,W83791D_REG_I2C_SUBADDR ); -if (!(val &0x08 )) - data->lm75[0 ] =devm_i2c_new_dummy_device (&client->dev, adapter, -0x48 + (val &0x7 )); -if (!(val &0x80 )) { -if (!IS_ERR (data->lm75[0 ]) && - ((val &0x7 ) == ((val >>4 ) &0x7 ))) { -dev_err (&client->dev, -"duplicate addresses 0x%x, " -"use force_subclient\n" , - data->lm75[0 ]->addr); -return -ENODEV ; - } - data->lm75[1 ] =devm_i2c_new_dummy_device (&client->dev, adapter, -0x48 + ((val >>4 ) &0x7 )); + +if (!(val &0x88 ) && (val &0x7 ) == ((val >>4 ) &0x7 )) { +dev_err (&client->dev, +"duplicate addresses 0x%x, use force_subclient\n" ,0x48 + (val &0x7 )); +return -ENODEV ; } +if (!(val &0x08 )) +devm_i2c_new_dummy_device (&client->dev, adapter,0x48 + (val &0x7 )); + +if (!(val &0x80 )) +devm_i2c_new_dummy_device (&client->dev, adapter,0x48 + ((val >>4 ) &0x7 )); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 44/172 gpio: pca953x: do not ignore i2c errors
In reply to Greg Kroah-HartmanFrom: Andrey Gusakov <[email protected]>
commit 540cffbab8b8e6c52a4121666ca18d6e94586ed2 upstream.
Per gpio_chip interface, error shall be proparated to the caller.
Attempt to silent diagnostics by returning zero (as written in the comment) is plain wrong, because the zero return can be interpreted by the caller as the gpio value.
--- drivers/gpio/gpio-pca953x.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-)
drivers/gpio/gpio-pca953x.c +2 -9
@@ -468,15 +468,8 @@ static int pca953x_gpio_get_value(structmutex_lock (&chip->i2c_lock); ret =regmap_read (chip->regmap, inreg, ®_val);mutex_unlock (&chip->i2c_lock); -if (ret <0 ) { -/* -* NOTE: -* diagnostic already emitted; that's all we should -* do unless gpio_*_value_cansleep() calls become different -* from their nonsleeping siblings (and report faults). -*/ -return 0 ; - } +if (ret <0 ) +return ret;return !!(reg_val & bit); }
Greg Kroah-Hartman
maintainerPATCH 45/172 scsi: ufs: Fix illegal offset in UPIU event trace
In reply to Greg Kroah-HartmanFrom: Jonathan Hsu <[email protected]>
commit e8c2da7e329ce004fee748b921e4c765dc2fa338 upstream.
Fix incorrect index for UTMRD reference in ufshcd_add_tm_upiu_trace().
--- drivers/scsi/ufs/ufshcd.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/scsi/ufs/ufshcd.c +1 -2
@@ -330,8 +330,7 @@ static void ufshcd_add_query_upiu_trace(static void ufshcd_add_tm_upiu_trace (struct ufs_hba *hba,unsigned int tag,enum ufs_trace_str_t str_t) { -int off = (int )tag - hba->nutrs; -struct utp_task_req_desc *descp = &hba->utmrdl_base_addr[off]; +struct utp_task_req_desc *descp = &hba->utmrdl_base_addr[tag];if (!trace_ufshcd_upiu_enabled ())return ;
Greg Kroah-Hartman
maintainerPATCH 46/172 mac80211: fix use-after-free in CCMP/GCMP RX
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
commit 94513069eb549737bcfc3d988d6ed4da948a2de8 upstream.
When PN checking is done in mac80211, for fragmentation we need to copy the PN to the RX struct so we can later use it to do a comparison, since commit bf30ca922a0c ("mac80211: check defrag PN against current frame").
Unfortunately, in that commit I used the 'hdr' variable without it being necessarily valid, so use-after-free could occur if it was necessary to reallocate (parts of) the frame.
Fix this by reloading the variable after the code that results in the reallocations, if any.
This fixes https://bugzilla.kernel.org/show_bug.cgi?id=214401.
--- net/mac80211/wpa.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/mac80211/wpa.c +6 -0
@@ -520,6 +520,9 @@ ieee80211_crypto_ccmp_decrypt(struct ieereturn RX_DROP_UNUSABLE ; } +/* reload hdr - skb might have been reallocated */ + hdr = (void *)rx->skb->data; + data_len = skb->len - hdrlen -IEEE80211_CCMP_HDR_LEN - mic_len;if (!rx->sta || data_len <0 )return RX_DROP_UNUSABLE ;
@@ -749,6 +752,9 @@ ieee80211_crypto_gcmp_decrypt(struct ieereturn RX_DROP_UNUSABLE ; } +/* reload hdr - skb might have been reallocated */ + hdr = (void *)rx->skb->data; + data_len = skb->len - hdrlen -IEEE80211_GCMP_HDR_LEN - mic_len;if (!rx->sta || data_len <0 )return RX_DROP_UNUSABLE ;
Greg Kroah-Hartman
maintainerPATCH 47/172 platform/x86/intel: hid: Add DMI switches allow list
In reply to Greg Kroah-HartmanFrom: José Expósito <[email protected]>
commit b201cb0ebe87b209e252d85668e517ac1929e250 upstream.
Some devices, even non convertible ones, can send incorrect SW_TABLET_MODE reports.
Add an allow list and accept such reports only from devices in it.
Bug reported for Dell XPS 17 9710 on:
https://gitlab.freedesktop.org/libinput/libinput/-/issues/662
--- drivers/platform/x86/intel-hid.c | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-)
drivers/platform/x86/intel-hid.c +22 -5
@@ -118,12 +118,30 @@ static const struct dmi_system_id dmi_vg { } }; +/* +* Some devices, even non convertible ones, can send incorrect SW_TABLET_MODE +* reports. Accept such reports only from devices in this list. +*/ +static const struct dmi_system_id dmi_auto_add_switch[] = { + { + .matches = { +DMI_EXACT_MATCH (DMI_CHASSIS_TYPE ,"31" /* Convertible */ ), + }, + }, + { + .matches = { +DMI_EXACT_MATCH (DMI_CHASSIS_TYPE ,"32" /* Detachable */ ), + }, + }, + {}/* Array terminator */ +}; +struct intel_hid_priv {struct input_dev *input_dev;struct input_dev *array;struct input_dev *switches;bool wakeup_mode; -bool dual_accel; +bool auto_add_switch; };#define HID_EVENT_FILTER_UUID "eeec56b3-4442-408f-a792-4edd4d758054"
@@ -452,10 +470,8 @@ static void notify_handler(acpi_handle h* Some convertible have unreliable VGBS return which could cause incorrect * SW_TABLET_MODE report, in these cases we enable support when receiving * the first event instead of during driver setup. -* -* See dual_accel_detect.h for more info on the dual_accel check. */ -if (!priv->switches && !priv->dual_accel && (event ==0xcc || event ==0xcd )) { +if (!priv->switches && priv->auto_add_switch && (event ==0xcc || event ==0xcd )) {dev_info (&device->dev,"switch event received, enable switches supports\n" ); err =intel_hid_switches_setup (device);if (err)
@@ -596,7 +612,8 @@ static int intel_hid_probe(struct platforeturn -ENOMEM ;dev_set_drvdata (&device->dev, priv); - priv->dual_accel =dual_accel_detect (); +/* See dual_accel_detect.h for more info on the dual_accel check. */ + priv->auto_add_switch =dmi_check_system (dmi_auto_add_switch) && !dual_accel_detect (); err =intel_hid_input_setup (device);if (err) {
Greg Kroah-Hartman
maintainerPATCH 48/172 x86/kvmclock: Move this_cpu_pvti into kvmclock.h
In reply to Greg Kroah-HartmanFrom: Zelin Deng <[email protected]>
commit ad9af930680bb396c87582edc172b3a7cf2a3fbf upstream.
There're other modules might use hv_clock_per_cpu variable like ptp_kvm, so move it into kvmclock.h and export the symbol to make it visiable to other modules.
Message-Id: <[email protected]>
--- arch/x86/include/asm/kvmclock.h | 14 ++++++++++++++ arch/x86/kernel/kvmclock.c | 13 ++----------- 2 files changed, 16 insertions(+), 11 deletions(-)
arch/x86/include/asm/kvmclock.h +14 -0
@@ -2,6 +2,20 @@#ifndef _ASM_X86_KVM_CLOCK_H#define _ASM_X86_KVM_CLOCK_H +#include <linux/percpu.h> +extern struct clocksource kvm_clock; +DECLARE_PER_CPU(struct pvclock_vsyscall_time_info *, hv_clock_per_cpu); + +static inline struct pvclock_vcpu_time_info *this_cpu_pvti (void ) +{ +return &this_cpu_read (hv_clock_per_cpu)->pvti; +} + +static inline struct pvclock_vsyscall_time_info *this_cpu_hvclock (void ) +{ +return this_cpu_read (hv_clock_per_cpu); +} +#endif /* _ASM_X86_KVM_CLOCK_H */
arch/x86/kernel/kvmclock.c +2 -11
@@ -49,18 +49,9 @@ early_param("no-kvmclock-vsyscall", parsstatic struct pvclock_vsyscall_time_info hv_clock_boot[HVC_BOOT_ARRAY_SIZE] __bss_decrypted __aligned(PAGE_SIZE); static struct pvclock_wall_clock wall_clock __bss_decrypted; -static DEFINE_PER_CPU(struct pvclock_vsyscall_time_info *, hv_clock_per_cpu);static struct pvclock_vsyscall_time_info *hvclock_mem; - -static inline struct pvclock_vcpu_time_info *this_cpu_pvti (void ) -{ -return &this_cpu_read (hv_clock_per_cpu)->pvti; -} - -static inline struct pvclock_vsyscall_time_info *this_cpu_hvclock (void ) -{ -return this_cpu_read (hv_clock_per_cpu); -} +DEFINE_PER_CPU(struct pvclock_vsyscall_time_info *, hv_clock_per_cpu); +EXPORT_PER_CPU_SYMBOL_GPL (hv_clock_per_cpu);/* * The wallclock is the time of day when we booted. Since then, some time may
Greg Kroah-Hartman
maintainerPATCH 49/172 ptp: Fix ptp_kvm_getcrosststamp issue for x86 ptp_kvm
In reply to Greg Kroah-HartmanFrom: Zelin Deng <[email protected]>
commit 773e89ab0056aaa2baa1ffd9f044551654410104 upstream.
hv_clock is preallocated to have only HVC_BOOT_ARRAY_SIZE (64) elements; if the PTP_SYS_OFFSET_PRECISE ioctl is executed on vCPUs whose index is 64 of higher, retrieving the struct pvclock_vcpu_time_info pointer with "src = &hv_clock[cpu].pvti" will result in an out-of-bounds access and a wild pointer. Change it to "this_cpu_pvti()" which is guaranteed to be valid.
Message-Id: <[email protected]>
--- drivers/ptp/ptp_kvm_x86.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-)
drivers/ptp/ptp_kvm_x86.c +2 -7
@@ -15,8 +15,6 @@#include <linux/ptp_clock_kernel.h> #include <linux/ptp_kvm.h> -struct pvclock_vsyscall_time_info *hv_clock; -static phys_addr_t clock_pair_gpa;static struct kvm_clock_pairing clock_pair;
@@ -28,8 +26,7 @@ int kvm_arch_ptp_init(void)return -ENODEV ; clock_pair_gpa =slow_virt_to_phys (&clock_pair); - hv_clock =pvclock_get_pvti_cpu0_va (); -if (!hv_clock) +if (!pvclock_get_pvti_cpu0_va ())return -ENODEV ; ret = kvm_hypercall2(KVM_HC_CLOCK_PAIRING, clock_pair_gpa,
@@ -64,10 +61,8 @@ int kvm_arch_ptp_get_crosststamp(u64 *cystruct pvclock_vcpu_time_info *src;unsigned int version;long ret; -int cpu; - cpu =smp_processor_id (); - src = &hv_clock[cpu].pvti; + src =this_cpu_pvti (); do { /*
Greg Kroah-Hartman
maintainerPATCH 50/172 KVM: x86: Fix stack-out-of-bounds memory access from ioapic_write_indirect()
In reply to Greg Kroah-HartmanFrom: Vitaly Kuznetsov <[email protected]>
commit 2f9b68f57c6278c322793a06063181deded0ad69 upstream.
KASAN reports the following issue:
BUG: KASAN: stack-out-of-bounds in kvm_make_vcpus_request_mask+0x174/0x440 [kvm] Read of size 8 at addr ffffc9001364f638 by task qemu-kvm/4798 CPU: 0 PID: 4798 Comm: qemu-kvm Tainted: G X --------- --- Hardware name: AMD Corporation DAYTONA_X/DAYTONA_X, BIOS RYM0081C 07/13/2020 Call Trace: dump_stack+0xa5/0xe6 print_address_description.constprop.0+0x18/0x130 ? kvm_make_vcpus_request_mask+0x174/0x440 [kvm] __kasan_report.cold+0x7f/0x114 ? kvm_make_vcpus_request_mask+0x174/0x440 [kvm] kasan_report+0x38/0x50 kasan_check_range+0xf5/0x1d0 kvm_make_vcpus_request_mask+0x174/0x440 [kvm] kvm_make_scan_ioapic_request_mask+0x84/0xc0 [kvm] ? kvm_arch_exit+0x110/0x110 [kvm] ? sched_clock+0x5/0x10 ioapic_write_indirect+0x59f/0x9e0 [kvm] ? static_obj+0xc0/0xc0 ? __lock_acquired+0x1d2/0x8c0 ? kvm_ioapic_eoi_inject_work+0x120/0x120 [kvm]
The problem appears to be that 'vcpu_bitmap' is allocated as a single long on stack and it should really be KVM_MAX_VCPUS long. We also seem to clear the lower 16 bits of it with bitmap_zero() for no particular reason (my guess would be that 'bitmap' and 'vcpu_bitmap' variables in kvm_bitmap_or_dest_vcpus() caused the confusion: while the later is indeed 16-bit long, the later should accommodate all possible vCPUs).
Message-Id: <[email protected]>
--- arch/x86/kvm/ioapic.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
arch/x86/kvm/ioapic.c +5 -5
@@ -319,8 +319,8 @@ static void ioapic_write_indirect(structunsigned index;bool mask_before, mask_after;union kvm_ioapic_redirect_entry *e; -unsigned long vcpu_bitmap;int old_remote_irr, old_delivery_status, old_dest_id, old_dest_mode; +DECLARE_BITMAP (vcpu_bitmap,KVM_MAX_VCPUS );switch (ioapic->ioregsel) {case IOAPIC_REG_VERSION :
@@ -384,9 +384,9 @@ static void ioapic_write_indirect(struct irq.shorthand =APIC_DEST_NOSHORT ; irq.dest_id = e->fields.dest_id; irq.msi_redir_hint = false; -bitmap_zero (&vcpu_bitmap,16 ); +bitmap_zero (vcpu_bitmap,KVM_MAX_VCPUS );kvm_bitmap_or_dest_vcpus (ioapic->kvm, &irq, - &vcpu_bitmap); + vcpu_bitmap);if (old_dest_mode != e->fields.dest_mode || old_dest_id != e->fields.dest_id) {/*
@@ -399,10 +399,10 @@ static void ioapic_write_indirect(structkvm_lapic_irq_dest_mode ( !!e->fields.dest_mode);kvm_bitmap_or_dest_vcpus (ioapic->kvm, &irq, - &vcpu_bitmap); + vcpu_bitmap); }kvm_make_scan_ioapic_request_mask (ioapic->kvm, - &vcpu_bitmap); + vcpu_bitmap); }else {kvm_make_scan_ioapic_request (ioapic->kvm); }
Greg Kroah-Hartman
maintainerPATCH 51/172 KVM: x86: nSVM: dont copy virt_ext from vmcb12
In reply to Greg Kroah-HartmanFrom: Maxim Levitsky <[email protected]>
commit faf6b755629627f19feafa75b32e81cd7738f12d upstream.
These field correspond to features that we don't expose yet to L2
While currently there are no CVE worthy features in this field, if AMD adds more features to this field, that could allow guest escapes similar to CVE-2021-3653 and CVE-2021-3656.
Message-Id: <[email protected]>
--- arch/x86/kvm/svm/nested.c | 1 - 1 file changed, 1 deletion(-)
arch/x86/kvm/svm/nested.c +0 -1
@@ -545,7 +545,6 @@ static void nested_vmcb02_prepare_contro (svm->nested.ctl.int_ctl & int_ctl_vmcb12_bits) | (svm->vmcb01.ptr->control.int_ctl & int_ctl_vmcb01_bits); - svm->vmcb->control.virt_ext = svm->nested.ctl.virt_ext; svm->vmcb->control.int_vector = svm->nested.ctl.int_vector; svm->vmcb->control.int_state = svm->nested.ctl.int_state; svm->vmcb->control.event_inj = svm->nested.ctl.event_inj;
Greg Kroah-Hartman
maintainerPATCH 52/172 KVM: x86: Clear KVMs cached guest CR3 at RESET/INIT
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 03a6e84069d1870f5b3d360e64cb330b66f76dee upstream.
Explicitly zero the guest's CR3 and mark it available+dirty at RESET/INIT. Per Intel's SDM and AMD's APM, CR3 is zeroed at both RESET and INIT. For RESET, this is a nop as vcpu is zero-allocated. For INIT, the bug has likely escaped notice because no firmware/kernel puts its page tables root at PA=0, let alone relies on INIT to get the desired CR3 for such page tables.
Message-Id: <[email protected]>
--- arch/x86/kvm/x86.c | 3 +++ 1 file changed, 3 insertions(+)
arch/x86/kvm/x86.c +3 -0
@@ -10873,6 +10873,9 @@ void kvm_vcpu_reset(struct kvm_vcpu *vcpstatic_call (kvm_x86_vcpu_reset)(vcpu, init_event); + vcpu->arch.cr3 =0 ; +kvm_register_mark_dirty (vcpu,VCPU_EXREG_CR3 ); +/* * Reset the MMU context if paging was enabled prior to INIT (which is * implied if CR0.PG=1 as CR0 will be '0' prior to RESET). Unlike the
Greg Kroah-Hartman
maintainerPATCH 53/172 KVM: x86: Swap order of CPUID entry "index" vs. "significant flag" checks
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit e8a747d0884e554a8c1872da6c8f680a4f893c6d upstream.
Check whether a CPUID entry's index is significant before checking for a matching index to hack-a-fix an undefined behavior bug due to consuming uninitialized data. RESET/INIT emulation uses kvm_cpuid() to retrieve CPUID.0x1, which does _not_ have a significant index, and fails to initialize the dummy variable that doubles as EBX/ECX/EDX output _and_ ECX, a.k.a. index, input.
Practically speaking, it's _extremely_ unlikely any compiler will yield code that causes problems, as the compiler would need to inline the kvm_cpuid() call to detect the uninitialized data, and intentionally hose the kernel, e.g. insert ud2, instead of simply ignoring the result of the index comparison.
Although the sketchy "dummy" pattern was introduced in SVM by commit 66f7b72e1171 ("KVM: x86: Make register state after reset conform to specification"), it wasn't actually broken until commit 7ff6c0350315 ("KVM: x86: Remove stateful CPUID handling") arbitrarily swapped the order of operations such that "index" was checked before the significant flag.
Avoid consuming uninitialized data by reverting to checking the flag before the index purely so that the fix can be easily backported; the offending RESET/INIT code has been refactored, moved, and consolidated from vendor code to common x86 since the bug was introduced. A future patch will directly address the bad RESET/INIT behavior.
The undefined behavior was detected by syzbot + KernelMemorySanitizer.
BUG: KMSAN: uninit-value in cpuid_entry2_find arch/x86/kvm/cpuid.c:68 BUG: KMSAN: uninit-value in kvm_find_cpuid_entry arch/x86/kvm/cpuid.c:1103 BUG: KMSAN: uninit-value in kvm_cpuid+0x456/0x28f0 arch/x86/kvm/cpuid.c:1183 cpuid_entry2_find arch/x86/kvm/cpuid.c:68 [inline] kvm_find_cpuid_entry arch/x86/kvm/cpuid.c:1103 [inline] kvm_cpuid+0x456/0x28f0 arch/x86/kvm/cpuid.c:1183 kvm_vcpu_reset+0x13fb/0x1c20 arch/x86/kvm/x86.c:10885 kvm_apic_accept_events+0x58f/0x8c0 arch/x86/kvm/lapic.c:2923 vcpu_enter_guest+0xfd2/0x6d80 arch/x86/kvm/x86.c:9534 vcpu_run+0x7f5/0x18d0 arch/x86/kvm/x86.c:9788 kvm_arch_vcpu_ioctl_run+0x245b/0x2d10 arch/x86/kvm/x86.c:10020
Local variable ----dummy@kvm_vcpu_reset created at:
kvm_vcpu_reset+0x1fb/0x1c20 arch/x86/kvm/x86.c:10812 kvm_apic_accept_events+0x58f/0x8c0 arch/x86/kvm/lapic.c:2923
Message-Id: <[email protected]>
--- arch/x86/kvm/cpuid.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/kvm/cpuid.c +2 -2
@@ -65,8 +65,8 @@ static inline struct kvm_cpuid_entry2 *cfor (i =0 ; i < nent; i++) { e = &entries[i]; -if (e->function == function && (e->index == index || - !(e->flags &KVM_CPUID_FLAG_SIGNIFCANT_INDEX ))) +if (e->function == function && + (!(e->flags &KVM_CPUID_FLAG_SIGNIFCANT_INDEX ) || e->index == index))return e; }
Greg Kroah-Hartman
maintainerPATCH 54/172 KVM: nVMX: Filter out all unsupported controls when eVMCS was activated
In reply to Greg Kroah-HartmanFrom: Vitaly Kuznetsov <[email protected]>
commit 8d68bad6d869fae8f4d50ab6423538dec7da72d1 upstream.
Windows Server 2022 with Hyper-V role enabled failed to boot on KVM when enlightened VMCS is advertised. Debugging revealed there are two exposed secondary controls it is not happy with: SECONDARY_EXEC_ENABLE_VMFUNC and SECONDARY_EXEC_SHADOW_VMCS. These controls are known to be unsupported, as there are no corresponding fields in eVMCSv1 (see the comment above EVMCS1_UNSUPPORTED_2NDEXEC definition).
Previously, commit 31de3d2500e4 ("x86/kvm/hyper-v: move VMX controls sanitization out of nested_enable_evmcs()") introduced the required filtering mechanism for VMX MSRs but for some reason put only known to be problematic (and not full EVMCS1_UNSUPPORTED_* lists) controls there.
Note, Windows Server 2022 seems to have gained some sanity check for VMX
MSRs: it doesn't even try to launch a guest when there's something it doesn't like, nested_evmcs_check_controls() mechanism can't catch the problem.
Let's be bold this time and instead of playing whack-a-mole just filter out all unsupported controls from VMX MSRs.
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/evmcs.c | 12 +++++++++--- arch/x86/kvm/vmx/vmx.c | 9 +++++---- 2 files changed, 14 insertions(+), 7 deletions(-)
arch/x86/kvm/vmx/evmcs.c +9 -3
@@ -354,14 +354,20 @@ void nested_evmcs_filter_control_msr(u32switch (msr_index) {case MSR_IA32_VMX_EXIT_CTLS :case MSR_IA32_VMX_TRUE_EXIT_CTLS : - ctl_high &= ~VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL ; + ctl_high &= ~EVMCS1_UNSUPPORTED_VMEXIT_CTRL ;break ;case MSR_IA32_VMX_ENTRY_CTLS :case MSR_IA32_VMX_TRUE_ENTRY_CTLS : - ctl_high &= ~VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL ; + ctl_high &= ~EVMCS1_UNSUPPORTED_VMENTRY_CTRL ;break ;case MSR_IA32_VMX_PROCBASED_CTLS2 : - ctl_high &= ~SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES ; + ctl_high &= ~EVMCS1_UNSUPPORTED_2NDEXEC ; +break ; +case MSR_IA32_VMX_PINBASED_CTLS : + ctl_high &= ~EVMCS1_UNSUPPORTED_PINCTRL ; +break ; +case MSR_IA32_VMX_VMFUNC : + ctl_low &= ~EVMCS1_UNSUPPORTED_VMFUNC ;break ; }
arch/x86/kvm/vmx/vmx.c +5 -4
@@ -1840,10 +1840,11 @@ static int vmx_get_msr(struct kvm_vcpu * &msr_info->data))return 1 ;/* -* Enlightened VMCS v1 doesn't have certain fields, but buggy -* Hyper-V versions are still trying to use corresponding -* features when they are exposed. Filter out the essential -* minimum. +* Enlightened VMCS v1 doesn't have certain VMCS fields but +* instead of just ignoring the features, different Hyper-V +* versions are either trying to use them and fail or do some +* sanity checking and refuse to boot. Filter all unsupported +* features out. */ if (!msr_info->host_initiated && vmx->nested.enlightened_vmcs_enabled)
Greg Kroah-Hartman
maintainerPATCH 55/172 KVM: SEV: Update svm_vm_copy_asid_from for SEV-ES
In reply to Greg Kroah-HartmanFrom: Peter Gonda <[email protected]>
commit f43c887cb7cb5b66c4167d40a4209027f5fdb5ce upstream.
For mirroring SEV-ES the mirror VM will need more then just the ASID. The FD and the handle are required to all the mirror to call psp commands. The mirror VM will need to call KVM_SEV_LAUNCH_UPDATE_VMSA to setup its vCPUs' VMSAs for SEV-ES.
Message-Id: <[email protected]>
--- arch/x86/kvm/svm/sev.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
arch/x86/kvm/svm/sev.c +12 -4
@@ -1716,8 +1716,7 @@ int svm_vm_copy_asid_from(struct kvm *kv {struct file *source_kvm_file;struct kvm *source_kvm; -struct kvm_sev_info *mirror_sev; -unsigned int asid; +struct kvm_sev_info source_sev, *mirror_sev;int ret; source_kvm_file =fget (source_fd);
@@ -1740,7 +1739,8 @@ int svm_vm_copy_asid_from(struct kvm *kv goto e_source_unlock; } - asid =to_kvm_svm (source_kvm)->sev_info.asid; +memcpy (&source_sev, &to_kvm_svm (source_kvm)->sev_info, +sizeof (source_sev));/* * The mirror kvm holds an enc_context_owner ref so its asid can't
@@ -1760,8 +1760,16 @@ int svm_vm_copy_asid_from(struct kvm *kv/* Set enc_context_owner and copy its encryption context over */ mirror_sev = &to_kvm_svm (kvm)->sev_info; mirror_sev->enc_context_owner = source_kvm; - mirror_sev->asid = asid; mirror_sev->active = true; + mirror_sev->asid = source_sev.asid; + mirror_sev->fd = source_sev.fd; + mirror_sev->es_active = source_sev.es_active; + mirror_sev->handle = source_sev.handle; +/* +* Do not copy ap_jump_table. Since the mirror does not share the same +* KVM contexts as the original, and they may have different +* memory-views. +*/ mutex_unlock (&kvm->lock);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 56/172 KVM: SEV: Pin guest memory for write for RECEIVE_UPDATE_DATA
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 50c038018d6be20361e8a2890262746a4ac5b11f upstream.
Require the target guest page to be writable when pinning memory for RECEIVE_UPDATE_DATA. Per the SEV API, the PSP writes to guest memory:
The result is then encrypted with GCTX.VEK and written to the memory pointed to by GUEST_PADDR field.
Message-Id: <[email protected]>
--- arch/x86/kvm/svm/sev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kvm/svm/sev.c +1 -1
@@ -1465,7 +1465,7 @@ static int sev_receive_update_data(struc/* Pin guest memory */ guest_page =sev_pin_memory (kvm, params.guest_uaddr &PAGE_MASK , -PAGE_SIZE , &n,0 ); +PAGE_SIZE , &n,1 );if (IS_ERR (guest_page)) { ret =PTR_ERR (guest_page); goto e_free_trans;
Greg Kroah-Hartman
maintainerPATCH 57/172 KVM: SEV: Acquire vcpu mutex when updating VMSA
In reply to Greg Kroah-HartmanFrom: Peter Gonda <[email protected]>
commit bb18a677746543e7f5eeb478129c92cedb0f9658 upstream.
The update-VMSA ioctl touches data stored in struct kvm_vcpu, and therefore should not be performed concurrently with any VCPU ioctl that might cause KVM or the processor to use the same data.
Adds vcpu mutex guard to the VMSA updating code. Refactors out __sev_launch_update_vmsa() function to deal with per vCPU parts of sev_launch_update_vmsa().
Message-Id: <[email protected]>
--- arch/x86/kvm/svm/sev.c | 53 +++++++++++++++++++++++++++---------------------- 1 file changed, 30 insertions(+), 23 deletions(-)
arch/x86/kvm/svm/sev.c +30 -23
@@ -596,43 +596,50 @@ static int sev_es_sync_vmsa(struct vcpu_return 0 ; } -static int sev_launch_update_vmsa (struct kvm *kvm,struct kvm_sev_cmd *argp) +static int __sev_launch_update_vmsa (struct kvm *kvm,struct kvm_vcpu *vcpu, +int *error) { -struct kvm_sev_info *sev = &to_kvm_svm (kvm)->sev_info;struct sev_data_launch_update_vmsa vmsa; +struct vcpu_svm *svm =to_svm (vcpu); +int ret; + +/* Perform some pre-encryption checks against the VMSA */ + ret =sev_es_sync_vmsa (svm); +if (ret) +return ret; + +/* +* The LAUNCH_UPDATE_VMSA command will perform in-place encryption of +* the VMSA memory content (i.e it will write the same memory region +* with the guest's key), so invalidate it first. +*/ +clflush_cache_range (svm->vmsa,PAGE_SIZE ); + + vmsa.reserved =0 ; + vmsa.handle =to_kvm_svm (kvm)->sev_info.handle; + vmsa.address =__sme_pa (svm->vmsa); + vmsa.len =PAGE_SIZE ; +return sev_issue_cmd (kvm,SEV_CMD_LAUNCH_UPDATE_VMSA , &vmsa, error); +} + +static int sev_launch_update_vmsa (struct kvm *kvm,struct kvm_sev_cmd *argp) +{struct kvm_vcpu *vcpu;int i, ret;if (!sev_es_guest (kvm))return -ENOTTY ; - vmsa.reserved =0 ; -kvm_for_each_vcpu (i, vcpu, kvm) { -struct vcpu_svm *svm =to_svm (vcpu); - -/* Perform some pre-encryption checks against the VMSA */ - ret =sev_es_sync_vmsa (svm); + ret =mutex_lock_killable (&vcpu->mutex);if (ret)return ret; -/* -* The LAUNCH_UPDATE_VMSA command will perform in-place -* encryption of the VMSA memory content (i.e it will write -* the same memory region with the guest's key), so invalidate -* it first. -*/ -clflush_cache_range (svm->vmsa,PAGE_SIZE ); - - vmsa.handle = sev->handle; - vmsa.address =__sme_pa (svm->vmsa); - vmsa.len =PAGE_SIZE ; - ret =sev_issue_cmd (kvm,SEV_CMD_LAUNCH_UPDATE_VMSA , &vmsa, - &argp->error); + ret =__sev_launch_update_vmsa (kvm, vcpu, &argp->error); + +mutex_unlock (&vcpu->mutex);if (ret)return ret; - - svm->vcpu.arch.guest_state_protected = true; }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 58/172 KVM: SEV: Allow some commands for mirror VM
In reply to Greg Kroah-HartmanFrom: Peter Gonda <[email protected]>
commit 5b92b6ca92b65bef811048c481e4446f4828500a upstream.
A mirrored SEV-ES VM will need to call KVM_SEV_LAUNCH_UPDATE_VMSA to setup its vCPUs and have them measured, and their VMSAs encrypted. Without this change, it is impossible to have mirror VMs as part of SEV-ES VMs.
Also allow the guest status check and debugging commands since they do not change any guest state.
Message-Id: <[email protected]>
--- arch/x86/kvm/svm/sev.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
arch/x86/kvm/svm/sev.c +17 -2
@@ -1509,6 +1509,20 @@ static int sev_receive_finish(struct kvmreturn sev_issue_cmd (kvm,SEV_CMD_RECEIVE_FINISH , &data, &argp->error); } +static bool cmd_allowed_from_miror (u32 cmd_id) +{ +/* +* Allow mirrors VM to call KVM_SEV_LAUNCH_UPDATE_VMSA to enable SEV-ES +* active mirror VMs. Also allow the debugging and status commands. +*/ +if (cmd_id ==KVM_SEV_LAUNCH_UPDATE_VMSA || + cmd_id ==KVM_SEV_GUEST_STATUS || cmd_id ==KVM_SEV_DBG_DECRYPT || + cmd_id ==KVM_SEV_DBG_ENCRYPT ) +return true; + +return false; +} +int svm_mem_enc_op (struct kvm *kvm,void __user *argp) {struct kvm_sev_cmd sev_cmd;
@@ -1525,8 +1539,9 @@ int svm_mem_enc_op(struct kvm *kvm, voidmutex_lock (&kvm->lock); -/* enc_context_owner handles all memory enc operations */ -if (is_mirroring_enc_context (kvm)) { +/* Only the enc_context_owner handles some memory enc operations. */ +if (is_mirroring_enc_context (kvm) && + !cmd_allowed_from_miror (sev_cmd.id)) { r = -EINVAL ; goto out; }
Greg Kroah-Hartman
maintainerPATCH 59/172 KVM: SVM: fix missing sev_decommission in sev_receive_start
In reply to Greg Kroah-HartmanFrom: Mingwei Zhang <[email protected]>
commit f1815e0aa770f2127c5df31eb5c2f0e37b60fa77 upstream.
DECOMMISSION the current SEV context if binding an ASID fails after RECEIVE_START. Per AMD's SEV API, RECEIVE_START generates a new guest context and thus needs to be paired with DECOMMISSION:
The RECEIVE_START command is the only command other than the LAUNCH_START command that generates a new guest context and guest handle.
The missing DECOMMISSION can result in subsequent SEV launch failures, as the firmware leaks memory and might not able to allocate more SEV guest contexts in the future.
Note, LAUNCH_START suffered the same bug, but was previously fixed by commit 934002cd660b ("KVM: SVM: Call SEV Guest Decommission if ASID binding fails").
Message-Id: <[email protected]>
--- arch/x86/kvm/svm/sev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/x86/kvm/svm/sev.c +3 -1
@@ -1405,8 +1405,10 @@ static int sev_receive_start(struct kvm/* Bind ASID to this guest */ ret =sev_bind_asid (kvm, start.handle, error); -if (ret) +if (ret) { +sev_decommission (start.handle); goto e_free_session; + } params.handle = start.handle; if (copy_to_user((void __user *)(uintptr_t)argp->data,
Greg Kroah-Hartman
maintainerPATCH 60/172 KVM: nVMX: Fix nested bus lock VM exit
In reply to Greg Kroah-HartmanFrom: Chenyi Qiang <[email protected]>
commit 24a996ade34d00deef5dee2c33aacd8fda91ec31 upstream.
Nested bus lock VM exits are not supported yet. If L2 triggers bus lock VM exit, it will be directed to L1 VMM, which would cause unexpected behavior. Therefore, handle L2's bus lock VM exits in L0 directly.
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/nested.c | 6 ++++++ 1 file changed, 6 insertions(+)
arch/x86/kvm/vmx/nested.c +6 -0
@@ -5898,6 +5898,12 @@ static bool nested_vmx_l0_wants_exit(strcase EXIT_REASON_VMFUNC :/* VM functions are emulated through L2->L0 vmexits. */ return true; +case EXIT_REASON_BUS_LOCK : +/* +* At present, bus lock VM exit is never exposed to L1. +* Handle L2's bus locks in L0 directly. +*/ +return true;default :break ; }
Greg Kroah-Hartman
maintainerPATCH 61/172 KVM: VMX: Fix a TSX_CTRL_CPUID_CLEAR field mask issue
In reply to Greg Kroah-HartmanFrom: Zhenzhong Duan <[email protected]>
commit 5c49d1850ddd3240d20dc40b01f593e35a184f38 upstream.
When updating the host's mask for its MSR_IA32_TSX_CTRL user return entry, clear the mask in the found uret MSR instead of vmx->guest_uret_msrs[i]. Modifying guest_uret_msrs directly is completely broken as 'i' does not point at the MSR_IA32_TSX_CTRL entry. In fact, it's guaranteed to be an out-of-bounds accesses as is always set to kvm_nr_uret_msrs in a prior loop. By sheer dumb luck, the fallout is limited to "only" failing to preserve the host's TSX_CTRL_CPUID_CLEAR. The out-of-bounds access is benign as it's guaranteed to clear a bit in a guest MSR value, which are always zero at vCPU creation on both x86-64 and i386.
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/vmx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kvm/vmx/vmx.c +1 -1
@@ -6816,7 +6816,7 @@ static int vmx_create_vcpu(struct kvm_vc*/ tsx_ctrl =vmx_find_uret_msr (vmx,MSR_IA32_TSX_CTRL );if (tsx_ctrl) - vmx->guest_uret_msrs[i].mask = ~(u64 )TSX_CTRL_CPUID_CLEAR ; + tsx_ctrl->mask = ~(u64 )TSX_CTRL_CPUID_CLEAR ; } err =alloc_loaded_vmcs (&vmx->vmcs01);
Greg Kroah-Hartman
maintainerPATCH 62/172 mmc: renesas_sdhi: fix regression with hard reset on old SDHIs
In reply to Greg Kroah-HartmanFrom: Wolfram Sang <[email protected]>
commit b81bede4d138ce62f7342e27bf55ac93c8071818 upstream.
Old SDHI instances have a default value for the reset register which keeps it in reset state by default. So, when applying a hard reset we need to manually leave the soft reset state as well. Later SDHI instances have a different default value, the one we write manually now.
--- drivers/mmc/host/renesas_sdhi_core.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/mmc/host/renesas_sdhi_core.c +2 -0
@@ -582,6 +582,8 @@ static void renesas_sdhi_reset(struct tm/* Unknown why but without polling reset status, it will hang */ read_poll_timeout (reset_control_status, ret, ret ==0 ,1 ,100 , false, priv->rstc); +/* At least SDHI_VER_GEN2_SDR50 needs manual release of reset */ +sd_ctrl_write16 (host,CTL_RESET_SD ,0x0001 ); priv->needs_adjust_hs400 = false;renesas_sdhi_set_clock (host, host->clk_cache); }else if (priv->scc_ctl) {
Greg Kroah-Hartman
maintainerPATCH 63/172 media: ir_toy: prevent device from hanging during transmit
In reply to Greg Kroah-HartmanFrom: Sean Young <[email protected]>
commit f0c15b360fb65ee39849afe987c16eb3d0175d0d upstream.
If the IR Toy is receiving IR while a transmit is done, it may end up hanging. We can prevent this from happening by re-entering sample mode just before issuing the transmit command.
--- drivers/media/rc/ir_toy.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-)
drivers/media/rc/ir_toy.c +20 -1
@@ -24,6 +24,7 @@ static const u8 COMMAND_VERSION[] = { 'v// End transmit and repeat reset command so we exit sump mode static const u8 COMMAND_RESET [] = {0xff ,0xff ,0 ,0 ,0 ,0 ,0 };static const u8 COMMAND_SMODE_ENTER [] = {'s' }; +static const u8 COMMAND_SMODE_EXIT [] = {0 };static const u8 COMMAND_TXSTART [] = {0x26 ,0x24 ,0x25 ,0x03 };#define REPLY_XMITCOUNT 't'
@@ -309,12 +310,30 @@ static int irtoy_tx(struct rc_dev *rc, u buf[i] =cpu_to_be16 (v); } - buf[count] =cpu_to_be16 (0xffff ); + buf[count] =0xffff ; irtoy->tx_buf = buf; irtoy->tx_len = size; irtoy->emitted =0 ; +// There is an issue where if the unit is receiving IR while the +// first TXSTART command is sent, the device might end up hanging +// with its led on. It does not respond to any command when this +// happens. To work around this, re-enter sample mode. + err =irtoy_command (irtoy,COMMAND_SMODE_EXIT , +sizeof (COMMAND_SMODE_EXIT ),STATE_RESET ); +if (err) { +dev_err (irtoy->dev,"exit sample mode: %d\n" , err); +return err; + } + + err =irtoy_command (irtoy,COMMAND_SMODE_ENTER , +sizeof (COMMAND_SMODE_ENTER ),STATE_COMMAND ); +if (err) { +dev_err (irtoy->dev,"enter sample mode: %d\n" , err); +return err; + } + err =irtoy_command (irtoy,COMMAND_TXSTART ,sizeof (COMMAND_TXSTART ),STATE_TX );kfree (buf);
Greg Kroah-Hartman
maintainerPATCH 64/172 RDMA/cma: Do not change route.addr.src_addr.ss_family
In reply to Greg Kroah-HartmanFrom: Jason Gunthorpe <[email protected]>
commit bc0bdc5afaa740d782fbf936aaeebd65e5c2921d upstream.
If the state is not idle then rdma_bind_addr() will immediately fail and no change to global state should happen.
For instance if the state is already RDMA_CM_LISTEN then this will corrupt the src_addr and would cause the test in cma_cancel_operation():
if (cma_any_addr(cma_src_addr(id_priv)) && !id_priv->cma_dev)
To view a mangled src_addr, eg with a IPv6 loopback address but an IPv4 family, failing the test.
This would manifest as this trace from syzkaller:
BUG: KASAN: use-after-free in __list_add_valid+0x93/0xa0 lib/list_debug.c:26 Read of size 8 at addr ffff8881546491e0 by task syz-executor.1/32204 CPU: 1 PID: 32204 Comm: syz-executor.1 Not tainted 5.12.0-rc8-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x141/0x1d7 lib/dump_stack.c:120 print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:232 __kasan_report mm/kasan/report.c:399 [inline] kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:416 __list_add_valid+0x93/0xa0 lib/list_debug.c:26 __list_add include/linux/list.h:67 [inline] list_add_tail include/linux/list.h:100 [inline] cma_listen_on_all drivers/infiniband/core/cma.c:2557 [inline] rdma_listen+0x787/0xe00 drivers/infiniband/core/cma.c:3751 ucma_listen+0x16a/0x210 drivers/infiniband/core/ucma.c:1102 ucma_write+0x259/0x350 drivers/infiniband/core/ucma.c:1732 vfs_write+0x28e/0xa30 fs/read_write.c:603 ksys_write+0x1ee/0x250 fs/read_write.c:658 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xae
Which is indicating that an rdma_id_private was destroyed without doing cma_cancel_listens().
Instead of trying to re-use the src_addr memory to indirectly create an any address build one explicitly on the stack and bind to that as any other normal flow would do.
--- drivers/infiniband/core/cma.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/infiniband/core/cma.c +6 -2
@@ -3768,9 +3768,13 @@ int rdma_listen(struct rdma_cm_id *id, iint ret; if (!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND, RDMA_CM_LISTEN)) { + struct sockaddr_in any_in = { + .sin_family = AF_INET, + .sin_addr.s_addr = htonl(INADDR_ANY), + }; + /* For a well behaved ULP state will be RDMA_CM_IDLE */ - id->route.addr.src_addr.ss_family = AF_INET; - ret = rdma_bind_addr(id, cma_src_addr(id_priv)); + ret = rdma_bind_addr(id, (struct sockaddr *)&any_in); if (ret) return ret; if (WARN_ON(!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND,
Greg Kroah-Hartman
maintainerPATCH 65/172 RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests
In reply to Greg Kroah-HartmanFrom: Jason Gunthorpe <[email protected]>
commit 305d568b72f17f674155a2a8275f865f207b3808 upstream.
The FSM can run in a circle allowing rdma_resolve_ip() to be called twice on the same id_priv. While this cannot happen without going through the work, it violates the invariant that the same address resolution background request cannot be active twice.
CPU 1 CPU 2
rdma_resolve_addr():
RDMA_CM_IDLE -> RDMA_CM_ADDR_QUERY
rdma_resolve_ip(addr_handler) #1
process_one_req(): for #1
addr_handler():
RDMA_CM_ADDR_QUERY -> RDMA_CM_ADDR_BOUND
mutex_unlock(&id_priv->handler_mutex);
[.. handler still running ..]rdma_resolve_addr():
RDMA_CM_ADDR_BOUND -> RDMA_CM_ADDR_QUERY
rdma_resolve_ip(addr_handler)
!! two requests are now on the req_list
rdma_destroy_id():
destroy_id_handler_unlock():
_destroy_id():
cma_cancel_operation():
rdma_addr_cancel()
// process_one_req() self removes it
spin_lock_bh(&lock);
cancel_delayed_work(&req->work);
if (!list_empty(&req->list)) == true
! rdma_addr_cancel() returns after process_on_req #1 is done kfree(id_priv)
process_one_req(): for #2
addr_handler():
mutex_lock(&id_priv->handler_mutex);
!! Use after free on id_privrdma_addr_cancel() expects there to be one req on the list and only cancels the first one. The self-removal behavior of the work only happens after the handler has returned. This yields a situations where the req_list can have two reqs for the same "handle" but rdma_addr_cancel() only cancels the first one.
The second req remains active beyond rdma_destroy_id() and will use-after-free id_priv once it inevitably triggers.
Fix this by remembering if the id_priv has called rdma_resolve_ip() and always cancel before calling it again. This ensures the req_list never gets more than one item in it and doesn't cost anything in the normal flow that never uses this strange error path.
--- drivers/infiniband/core/cma.c | 23 +++++++++++++++++++++++ drivers/infiniband/core/cma_priv.h | 1 + 2 files changed, 24 insertions(+)
drivers/infiniband/core/cma.c +23 -0
@@ -1776,6 +1776,14 @@ static void cma_cancel_operation(struct {switch (state) {case RDMA_CM_ADDR_QUERY : +/* +* We can avoid doing the rdma_addr_cancel() based on state, +* only RDMA_CM_ADDR_QUERY has a work that could still execute. +* Notice that the addr_handler work could still be exiting +* outside this state, however due to the interaction with the +* handler_mutex the work is guaranteed not to touch id_priv +* during exit. +*/ rdma_addr_cancel (&id_priv->id.route.addr.dev_addr);break ;case RDMA_CM_ROUTE_QUERY :
@@ -3410,6 +3418,21 @@ int rdma_resolve_addr(struct rdma_cm_idif (dst_addr->sa_family ==AF_IB ) { ret =cma_resolve_ib_addr (id_priv); }else { +/* +* The FSM can return back to RDMA_CM_ADDR_BOUND after +* rdma_resolve_ip() is called, eg through the error +* path in addr_handler(). If this happens the existing +* request must be canceled before issuing a new one. +* Since canceling a request is a bit slow and this +* oddball path is rare, keep track once a request has +* been issued. The track turns out to be a permanent +* state since this is the only cancel as it is +* immediately before rdma_resolve_ip(). +*/ +if (id_priv->used_resolve_ip) +rdma_addr_cancel (&id->route.addr.dev_addr); +else + id_priv->used_resolve_ip =1 ; ret = rdma_resolve_ip(cma_src_addr(id_priv), dst_addr, &id->route.addr.dev_addr, timeout_ms, addr_handler,
drivers/infiniband/core/cma_priv.h +1 -0
@@ -91,6 +91,7 @@ struct rdma_id_private {u8 afonly;u8 timeout;u8 min_rnr_timer; +u8 used_resolve_ip;enum ib_gid_type gid_type;/*
Greg Kroah-Hartman
maintainerPATCH 66/172 nbd: use shifts rather than multiplies
In reply to Greg Kroah-HartmanFrom: Nick Desaulniers <[email protected]>
commit 41e76c6a3c83c85e849f10754b8632ea763d9be4 upstream.
commit fad7cd3310db ("nbd: add the check to prevent overflow in __nbd_ioctl()") raised an issue from the fallback helpers added in commit f0907827a8a9 ("compiler.h: enable builtin overflow checkers and add fallback code")
ERROR: modpost: "__divdi3" [drivers/block/nbd.ko] undefined!
As Stephen Rothwell notes:
The added check_mul_overflow() call is being passed 64 bit values. COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW is not set for this build (see include/linux/overflow.h).
Specifically, the helpers for checking whether the results of a multiplication overflowed (__unsigned_mul_overflow, __signed_add_overflow) use the division operator when !COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW. This is problematic for 64b operands on 32b hosts.
This was fixed upstream by
commit 76ae847497bc ("Documentation: raise minimum supported version of GCC to 5.1")
which is not suitable to be backported to stable.
Further, __builtin_mul_overflow() would emit a libcall to a compiler-rt-only symbol when compiling with clang < 14 for 32b targets.
ld.lld: error: undefined symbol: __mulodi4
In order to keep stable buildable with GCC 4.9 and clang < 14, modify struct nbd_config to instead track the number of bits of the block size; reconstructing the block size using runtime checked shifts that are not problematic for those compilers and in a ways that can be backported to stable.
In nbd_set_size, we do validate that the value of blksize must be a power of two (POT) and is in the range of [512, PAGE_SIZE] (both inclusive).
This does modify the debugfs interface.
--- drivers/block/nbd.c | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-)
drivers/block/nbd.c +17 -12
@@ -97,13 +97,18 @@ struct nbd_config {atomic_t recv_threads;wait_queue_head_t recv_wq; -loff_t blksize; +unsigned int blksize_bits;loff_t bytesize;#if IS_ENABLED (CONFIG_DEBUG_FS )struct dentry *dbg_dir;#endif }; +static inline unsigned int nbd_blksize (struct nbd_config *config) +{ +return 1u << config->blksize_bits; +} +struct nbd_device {struct blk_mq_tag_set tag_set;
@@ -147,7 +152,7 @@ static struct dentry *nbd_dbg_dir;#define NBD_MAGIC 0x68797548 -#define NBD_DEF_BLKSIZE 1024 +#define NBD_DEF_BLKSIZE_BITS 10static unsigned int nbds_max =16 ;static int max_part =16 ;
@@ -350,12 +355,12 @@ static int nbd_set_size(struct nbd_devic loff_t blksize) {if (!blksize) - blksize =NBD_DEF_BLKSIZE ; + blksize =1u <<NBD_DEF_BLKSIZE_BITS ;if (blksize <512 || blksize >PAGE_SIZE || !is_power_of_2 (blksize))return -EINVAL ; nbd->config->bytesize = bytesize; - nbd->config->blksize = blksize; + nbd->config->blksize_bits =__ffs (blksize);if (!nbd->task_recv)return 0 ;
@@ -1370,7 +1375,7 @@ static int nbd_start_device(struct nbd_d args->index = i;queue_work (nbd->recv_workq, &args->work); } -return nbd_set_size (nbd, config->bytesize, config->blksize); +return nbd_set_size (nbd, config->bytesize,nbd_blksize (config)); }static int nbd_start_device_ioctl (struct nbd_device *nbd,struct block_device *bdev)
@@ -1439,11 +1444,11 @@ static int __nbd_ioctl(struct block_devicase NBD_SET_BLKSIZE :return nbd_set_size (nbd, config->bytesize, arg);case NBD_SET_SIZE : -return nbd_set_size (nbd, arg, config->blksize); +return nbd_set_size (nbd, arg,nbd_blksize (config));case NBD_SET_SIZE_BLOCKS : -if (check_mul_overflow ((loff_t )arg, config->blksize, &bytesize)) +if (check_shl_overflow (arg, config->blksize_bits, &bytesize))return -EINVAL ; -return nbd_set_size (nbd, bytesize, config->blksize); +return nbd_set_size (nbd, bytesize,nbd_blksize (config));case NBD_SET_TIMEOUT :nbd_set_cmd_timeout (nbd, arg);return 0 ;
@@ -1509,7 +1514,7 @@ static struct nbd_config *nbd_alloc_confatomic_set (&config->recv_threads,0 );init_waitqueue_head (&config->recv_wq);init_waitqueue_head (&config->conn_wait); - config->blksize =NBD_DEF_BLKSIZE ; + config->blksize_bits =NBD_DEF_BLKSIZE_BITS ;atomic_set (&config->live_connections,0 );try_module_get (THIS_MODULE );return config;
@@ -1637,7 +1642,7 @@ static int nbd_dev_dbg_init(struct nbd_ddebugfs_create_file ("tasks" ,0444 , dir, nbd, &nbd_dbg_tasks_fops);debugfs_create_u64 ("size_bytes" ,0444 , dir, &config->bytesize);debugfs_create_u32 ("timeout" ,0444 , dir, &nbd->tag_set.timeout); -debugfs_create_u64 ("blocksize" ,0444 , dir, &config->blksize); +debugfs_create_u32 ("blocksize_bits" ,0444 , dir, &config->blksize_bits);debugfs_create_file ("flags" ,0444 , dir, nbd, &nbd_dbg_flags_fops);return 0 ;
@@ -1841,7 +1846,7 @@ nbd_device_policy[NBD_DEVICE_ATTR_MAX +static int nbd_genl_size_set (struct genl_info *info,struct nbd_device *nbd) {struct nbd_config *config = nbd->config; -u64 bsize = config->blksize; +u64 bsize =nbd_blksize (config);u64 bytes = config->bytesize;if (info->attrs[NBD_ATTR_SIZE_BYTES ])
@@ -1850,7 +1855,7 @@ static int nbd_genl_size_set(struct genlif (info->attrs[NBD_ATTR_BLOCK_SIZE_BYTES ]) bsize =nla_get_u64 (info->attrs[NBD_ATTR_BLOCK_SIZE_BYTES ]); -if (bytes != config->bytesize || bsize != config->blksize) +if (bytes != config->bytesize || bsize !=nbd_blksize (config))return nbd_set_size (nbd, bytes, bsize);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 67/172 drm/amd/display: initialize backlight_ramping_override to false
In reply to Greg Kroah-HartmanFrom: Josip Pavic <[email protected]>
commit 467a51b69d0828887fb1b6719159a6b16da688f8 upstream.
[Why]
Stack variable params.backlight_ramping_override is uninitialized, so it contains junk data
[How]
Initialize the variable to false
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +1 -0
@@ -1724,6 +1724,7 @@ static int dm_late_init(void *handle) linear_lut[i] =0xFFFF * i /15 ; params.set =0 ; + params.backlight_ramping_override = false; params.backlight_ramping_start =0xCCCC ; params.backlight_ramping_reduction =0xCCCCCCCC ; params.backlight_lut_array_size =16 ;
Greg Kroah-Hartman
maintainerPATCH 68/172 drm/amd/display: Pass PCI deviceid into DC
In reply to Greg Kroah-HartmanFrom: Charlene Liu <[email protected]>
commit d942856865c733ff60450de9691af796ad71d7bc upstream.
[why]
pci deviceid not passed to dal dc, without proper break, dcn2.x falls into dcn3.x code path
[how]
pass in pci deviceid, and break once dal_version initialized.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +1 -0
@@ -1117,6 +1117,7 @@ static int amdgpu_dm_init(struct amdgpu_ init_data.asic_id.pci_revision_id = adev->pdev->revision; init_data.asic_id.hw_internal_rev = adev->external_rev_id; + init_data.asic_id.chip_id = adev->pdev->device; init_data.asic_id.vram_width = adev->gmc.vram_width;/* TODO: initialize init_data.asic_id.vram_type here!!!! */
Greg Kroah-Hartman
maintainerPATCH 69/172 drm/amd/display: Fix Display Flicker on embedded panels
In reply to Greg Kroah-HartmanFrom: Praful Swarnakar <[email protected]>
commit 083fa05bbaf65a01866b5440031c822e32ad7510 upstream.
[Why]
ASSR is dependent on Signed PSP Verstage to enable Content Protection for eDP panels. Unsigned PSP verstage is used during development phase causing ASSR to FAIL.
As a result, link training is performed with DP_PANEL_MODE_DEFAULT instead of DP_PANEL_MODE_EDP for eDP panels that causes display flicker on some panels.
[How]
- Do not change panel mode, if ASSR is disabled
- Just report and continue to perform eDP link training with right settings further.
--- drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +7 -8
@@ -1813,14 +1813,13 @@ bool perform_link_training_with_retries(if (panel_mode ==DP_PANEL_MODE_EDP ) {struct cp_psp *cp_psp = &stream->ctx->cp_psp; -if (cp_psp && cp_psp->funcs.enable_assr) { -if (!cp_psp->funcs.enable_assr (cp_psp->handle, link)) { -/* since eDP implies ASSR on, change panel -* mode to disable ASSR -*/ - panel_mode =DP_PANEL_MODE_DEFAULT ; - } - } +if (cp_psp && cp_psp->funcs.enable_assr) +/* ASSR is bound to fail with unsigned PSP +* verstage used during devlopment phase. +* Report and continue with eDP panel mode to +* perform eDP link training with right settings +*/ + cp_psp->funcs.enable_assr (cp_psp->handle, link); }#endif
Greg Kroah-Hartman
maintainerPATCH 70/172 drm/amdgpu: force exit gfxoff on sdma resume for rmb s0ix
In reply to Greg Kroah-HartmanFrom: Prike Liang <[email protected]>
commit 26db706a6d77b9e184feb11725e97e53b7a89519 upstream.
In the s2idle stress test sdma resume fail occasionally,in the failed case GPU is in the gfxoff state.This issue may introduce by firmware miss handle doorbell S/R and now temporary fix the issue by forcing exit gfxoff for sdma resume.
--- drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c +8 -0
@@ -883,6 +883,12 @@ static int sdma_v5_2_start(struct amdgpumsleep (1000 ); } +/* TODO: check whether can submit a doorbell request to raise +* a doorbell fence to exit gfxoff. +*/ +if (adev->in_s0ix) +amdgpu_gfx_off_ctrl (adev, false); +sdma_v5_2_soft_reset (adev);/* unhalt the MEs */ sdma_v5_2_enable (adev, true);
@@ -891,6 +897,8 @@ static int sdma_v5_2_start(struct amdgpu/* start the gfx rings and rlc compute queues */ r =sdma_v5_2_gfx_resume (adev); +if (adev->in_s0ix) +amdgpu_gfx_off_ctrl (adev, true);if (r)return r; r =sdma_v5_2_rlc_resume (adev);
Greg Kroah-Hartman
maintainerPATCH 71/172 drm/amdgpu: check tiling flags when creating FB on GFX8-
In reply to Greg Kroah-HartmanFrom: Simon Ser <[email protected]>
commit 98122e63a7ecc08c4172a17d97a06ef5536eb268 upstream.
On GFX9+, format modifiers are always enabled and ensure the frame-buffers can be scanned out at ADDFB2 time.
On GFX8-, format modifiers are not supported and no other check is performed. This means ADDFB2 IOCTLs will succeed even if the tiling isn't supported for scan-out, and will result in garbage displayed on screen [1].
Fix this by adding a check for tiling flags for GFX8 and older. The check is taken from radeonsi in Mesa (see how is_displayable is populated in gfx6_compute_surface).
Changes in v2: use drm_WARN_ONCE instead of drm_WARN (Michel)
[1]: https://github.com/swaywm/wlroots/issues/3185
--- drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 31 ++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_display.c +31 -0
@@ -837,6 +837,28 @@ static int convert_tiling_flags_to_modifreturn 0 ; } +/* Mirrors the is_displayable check in radeonsi's gfx6_compute_surface */ +static int check_tiling_flags_gfx6 (struct amdgpu_framebuffer *afb) +{ +u64 micro_tile_mode; + +/* Zero swizzle mode means linear */ +if (AMDGPU_TILING_GET (afb->tiling_flags,SWIZZLE_MODE ) ==0 ) +return 0 ; + + micro_tile_mode =AMDGPU_TILING_GET (afb->tiling_flags,MICRO_TILE_MODE ); +switch (micro_tile_mode) { +case 0 :/* DISPLAY */ +case 3 :/* RENDER */ +return 0 ; +default : +drm_dbg_kms (afb->base.dev, +"Micro tile mode %llu not supported for scanout\n" , + micro_tile_mode); +return -EINVAL ; + } +} +static void get_block_dimensions (unsigned int block_log2,unsigned int cpp,unsigned int *width,unsigned int *height) {
@@ -1103,6 +1125,7 @@ int amdgpu_display_framebuffer_init(struconst struct drm_mode_fb_cmd2 *mode_cmd, struct drm_gem_object *obj) { + struct amdgpu_device *adev = drm_to_adev(dev);int ret, i;/*
@@ -1122,6 +1145,14 @@ int amdgpu_display_framebuffer_init(struif (ret)return ret; +if (!dev->mode_config.allow_fb_modifiers) { +drm_WARN_ONCE (dev, adev->family >=AMDGPU_FAMILY_AI , +"GFX9+ requires FB check based on format modifier\n" ); + ret =check_tiling_flags_gfx6 (rfb); +if (ret) +return ret; + } +if (dev->mode_config.allow_fb_modifiers && !(rfb->base.flags &DRM_MODE_FB_MODIFIERS )) { ret =convert_tiling_flags_to_modifier (rfb);
Greg Kroah-Hartman
maintainerPATCH 72/172 drm/amdgpu: correct initial cp_hqd_quantum for gfx9
In reply to Greg Kroah-HartmanFrom: Hawking Zhang <[email protected]>
commit 9f52c25f59b504a29dda42d83ac1e24d2af535d4 upstream.
didn't read the value of mmCP_HQD_QUANTUM from correct register offset
--- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +1 -1
@@ -3598,7 +3598,7 @@ static int gfx_v9_0_mqd_init(struct amdg/* set static priority for a queue/ring */ gfx_v9_0_mqd_set_priority (ring, mqd); - mqd->cp_hqd_quantum =RREG32 (mmCP_HQD_QUANTUM); + mqd->cp_hqd_quantum =RREG32_SOC15 (GC ,0 , mmCP_HQD_QUANTUM);/* map_queues packet doesn't need activate the queue, * so only kiq need set this field.
Greg Kroah-Hartman
maintainerPATCH 73/172 interconnect: qcom: sdm660: Fix id of slv_cnoc_mnoc_cfg
In reply to Greg Kroah-HartmanFrom: Shawn Guo <[email protected]>
[ Upstream commit a06c2e5c048e5e07fac9daf3073bd0b6582913c7 ]
The id of slv_cnoc_mnoc_cfg node is mistakenly coded as id of slv_blsp_1. It causes the following warning on slv_blsp_1 node adding. Correct the id of slv_cnoc_mnoc_cfg node.
[ 1.948180] ------------[ cut here ]------------ [ 1.954122] WARNING: CPU: 2 PID: 7 at drivers/interconnect/core.c:962 icc_node_add+0xe4/0xf8 [ 1.958994] Modules linked in: [ 1.967399] CPU: 2 PID: 7 Comm: kworker/u16:0 Not tainted 5.14.0-rc6-next-20210818 #21 [ 1.970275] Hardware name: Xiaomi Redmi Note 7 (DT) [ 1.978169] Workqueue: events_unbound deferred_probe_work_func [ 1.982945] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 1.988849] pc : icc_node_add+0xe4/0xf8 [ 1.995699] lr : qnoc_probe+0x350/0x438 [ 1.999519] sp : ffff80001008bb10 [ 2.003337] x29: ffff80001008bb10 x28: 000000000000001a x27: ffffb83ddc61ee28 [ 2.006818] x26: ffff2fe341d44080 x25: ffff2fe340f3aa80 x24: ffffb83ddc98f0e8 [ 2.013938] x23: 0000000000000024 x22: ffff2fe3408b7400 x21: 0000000000000000 [ 2.021054] x20: ffff2fe3408b7410 x19: ffff2fe341d44080 x18: 0000000000000010 [ 2.028173] x17: ffff2fe3bdd0aac0 x16: 0000000000000281 x15: ffff2fe3400f5528 [ 2.035290] x14: 000000000000013f x13: ffff2fe3400f5528 x12: 00000000ffffffea [ 2.042410] x11: ffffb83ddc9109d0 x10: ffffb83ddc8f8990 x9 : ffffb83ddc8f89e8 [ 2.049527] x8 : 0000000000017fe8 x7 : c0000000ffffefff x6 : 0000000000000001 [ 2.056645] x5 : 0000000000057fa8 x4 : 0000000000000000 x3 : ffffb83ddc9903b0 [ 2.063764] x2 : 1a1f6fde34d45500 x1 : ffff2fe340f3a880 x0 : ffff2fe340f3a880 [ 2.070882] Call trace: [ 2.077989] icc_node_add+0xe4/0xf8 [ 2.080247] qnoc_probe+0x350/0x438 [ 2.083718] platform_probe+0x68/0xd8 [ 2.087191] really_probe+0xb8/0x300 [ 2.091011] __driver_probe_device+0x78/0xe0 [ 2.094659] driver_probe_device+0x80/0x110 [ 2.098911] __device_attach_driver+0x90/0xe0 [ 2.102818] bus_for_each_drv+0x78/0xc8 [ 2.107331] __device_attach+0xf0/0x150 [ 2.110977] device_initial_probe+0x14/0x20 [ 2.114796] bus_probe_device+0x9c/0xa8 [ 2.118963] deferred_probe_work_func+0x88/0xc0 [ 2.122784] process_one_work+0x1a4/0x338 [ 2.127296] worker_thread+0x1f8/0x420 [ 2.131464] kthread+0x150/0x160 [ 2.135107] ret_from_fork+0x10/0x20 [ 2.138495] ---[ end trace 5eea8768cb620e87 ]---
--- drivers/interconnect/qcom/sdm660.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/interconnect/qcom/sdm660.c +1 -1
@@ -307,7 +307,7 @@ DEFINE_QNODE(slv_bimc_cfg, SDM660_SLAVE_BIMC_CFG, 4, -1, 56, true, -1, 0, -1, 0)DEFINE_QNODE (slv_prng,SDM660_SLAVE_PRNG ,4 ,-1 ,44 , true,-1 ,0 ,-1 ,0 );DEFINE_QNODE (slv_spdm,SDM660_SLAVE_SPDM ,4 ,-1 ,60 , true,-1 ,0 ,-1 ,0 );DEFINE_QNODE (slv_qdss_cfg,SDM660_SLAVE_QDSS_CFG ,4 ,-1 ,63 , true,-1 ,0 ,-1 ,0 ); -DEFINE_QNODE (slv_cnoc_mnoc_cfg,SDM660_SLAVE_BLSP_1 ,4 ,-1 ,66 , true,-1 ,0 ,-1 ,SDM660_MASTER_CNOC_MNOC_CFG ); +DEFINE_QNODE (slv_cnoc_mnoc_cfg,SDM660_SLAVE_CNOC_MNOC_CFG ,4 ,-1 ,66 , true,-1 ,0 ,-1 ,SDM660_MASTER_CNOC_MNOC_CFG );DEFINE_QNODE (slv_snoc_cfg,SDM660_SLAVE_SNOC_CFG ,4 ,-1 ,70 , true,-1 ,0 ,-1 ,0 );DEFINE_QNODE (slv_qm_cfg,SDM660_SLAVE_QM_CFG ,4 ,-1 ,212 , true,-1 ,0 ,-1 ,0 );DEFINE_QNODE (slv_clk_ctl,SDM660_SLAVE_CLK_CTL ,4 ,-1 ,47 , true,-1 ,0 ,-1 ,0 );
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 74/172 interconnect: qcom: sdm660: Correct NOC_QOS_PRIORITY shift and mask
In reply to Greg Kroah-HartmanFrom: Shawn Guo <[email protected]>
[ Upstream commit 5833c9b8766298e73c11766f9585d4ea4fa785ff ]
The NOC_QOS_PRIORITY shift and mask do not match what vendor kernel defines [1]. Correct them per vendor kernel. As the result of NOC_QOS_PRIORITY_P0_SHIFT being 0, the definition can be dropped and regmap_update_bits() call on P0 can be simplified a bit.
--- drivers/interconnect/qcom/sdm660.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/interconnect/qcom/sdm660.c +4 -5
@@ -44,9 +44,9 @@#define NOC_PERM_MODE_BYPASS (1 << NOC_QOS_MODE_BYPASS)#define NOC_QOS_PRIORITYn_ADDR (n) (0x8 + (n * 0x1000)) -#define NOC_QOS_PRIORITY_MASK 0xf +#define NOC_QOS_PRIORITY_P1_MASK 0xc +#define NOC_QOS_PRIORITY_P0_MASK 0x3#define NOC_QOS_PRIORITY_P1_SHIFT 0x2 -#define NOC_QOS_PRIORITY_P0_SHIFT 0x3#define NOC_QOS_MODEn_ADDR (n) (0xc + (n * 0x1000))#define NOC_QOS_MODEn_MASK 0x3
@@ -624,13 +624,12 @@ static int qcom_icc_noc_set_qos_priority(struct regmap *rmap,/* Must be updated one at a time, P1 first, P0 last */ val = qos->areq_prio <<NOC_QOS_PRIORITY_P1_SHIFT ; rc =regmap_update_bits (rmap,NOC_QOS_PRIORITYn_ADDR (qos->qos_port), -NOC_QOS_PRIORITY_MASK , val); +NOC_QOS_PRIORITY_P1_MASK , val);if (rc)return rc; - val = qos->prio_level <<NOC_QOS_PRIORITY_P0_SHIFT ;return regmap_update_bits (rmap,NOC_QOS_PRIORITYn_ADDR (qos->qos_port), -NOC_QOS_PRIORITY_MASK , val); +NOC_QOS_PRIORITY_P0_MASK , qos->prio_level); }static int qcom_icc_set_noc_qos (struct icc_node *src,u64 max_bw)
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 75/172 drm/i915/gvt: fix the usage of ww lock in gvt scheduler.
In reply to Greg Kroah-HartmanFrom: Zhi A Wang <[email protected]>
[ Upstream commit d168cd797982db9db617113644c87b8f5f3cf27e ]
As the APIs related to ww lock in i915 was changed recently, the usage of ww lock in GVT-g scheduler needs to be changed accrodingly. We noticed a deadlock when GVT-g scheduler submits the workload to i915. After some investigation, it seems the way of how to use ww lock APIs has been changed. Releasing a ww now requires a explicit i915_gem_ww_ctx_fini().
--- drivers/gpu/drm/i915/gvt/scheduler.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/i915/gvt/scheduler.c +2 -2
@@ -576,7 +576,7 @@ static int prepare_shadow_batch_buffer(struct intel_vgpu_workload *workload)/* No one is going to touch shadow bb from now on. */ i915_gem_object_flush_map (bb->obj); -i915_gem_object_unlock (bb->obj); +i915_gem_ww_ctx_fini (&ww); } }return 0 ;
@@ -630,7 +630,7 @@ static int prepare_shadow_wa_ctx(struct intel_shadow_wa_ctx *wa_ctx)return ret; } -i915_gem_object_unlock (wa_ctx->indirect_ctx.obj); +i915_gem_ww_ctx_fini (&ww);/* FIXME: we are not tracking our pinned VMA leaving it * up to the core to fix up the stray pin_count upon
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 76/172 ipvs: check that ip_vs_conn_tab_bits is between 8 and 20
In reply to Greg Kroah-HartmanFrom: Andrea Claudi <[email protected]>
[ Upstream commit 69e73dbfda14fbfe748d3812da1244cce2928dcb ]
ip_vs_conn_tab_bits may be provided by the user through the conn_tab_bits module parameter. If this value is greater than 31, or less than 0, the shift operator used to derive tab_size causes undefined behaviour.
Fix this checking ip_vs_conn_tab_bits value to be in the range specified in ipvs Kconfig. If not, simply use default value.
--- net/netfilter/ipvs/ip_vs_conn.c | 4 ++++ 1 file changed, 4 insertions(+)
net/netfilter/ipvs/ip_vs_conn.c +4 -0
@@ -1468,6 +1468,10 @@ int __init ip_vs_conn_init(void)int idx;/* Compute size and mask */ +if (ip_vs_conn_tab_bits <8 || ip_vs_conn_tab_bits >20 ) { +pr_info ("conn_tab_bits not in [8, 20]. Using default value\n" ); + ip_vs_conn_tab_bits =CONFIG_IP_VS_TAB_BITS ; + } ip_vs_conn_tab_size =1 << ip_vs_conn_tab_bits; ip_vs_conn_tab_mask = ip_vs_conn_tab_size -1 ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 77/172 bpf: Handle return value of BPF_PROG_TYPE_STRUCT_OPS prog
In reply to Greg Kroah-HartmanFrom: Hou Tao <[email protected]>
[ Upstream commit 356ed64991c6847a0c4f2e8fa3b1133f7a14f1fc ]
Currently if a function ptr in struct_ops has a return value, its caller will get a random return value from it, because the return value of related BPF_PROG_TYPE_STRUCT_OPS prog is just dropped.
So adding a new flag BPF_TRAMP_F_RET_FENTRY_RET to tell bpf trampoline to save and return the return value of struct_ops prog if ret_size of the function ptr is greater than 0. Also restricting the flag to be used alone.
--- arch/x86/net/bpf_jit_comp.c | 53 ++++++++++++++++++++++++++++--------- include/linux/bpf.h | 2 ++ kernel/bpf/bpf_struct_ops.c | 7 +++-- 3 files changed, 47 insertions(+), 15 deletions(-)
arch/x86/net/bpf_jit_comp.c +40 -13
@@ -1744,7 +1744,7 @@ static void restore_regs(const struct btf_func_model *m, u8 **prog, int nr_args, }static int invoke_bpf_prog (const struct btf_func_model *m,u8 **pprog, -struct bpf_prog *p,int stack_size,bool mod_ret) +struct bpf_prog *p,int stack_size,bool save_ret) {u8 *prog = *pprog;u8 *jmp_insn;
@@ -1777,11 +1777,15 @@ static int invoke_bpf_prog(const struct btf_func_model *m, u8 **pprog,if (emit_call (&prog, p->bpf_func, prog))return -EINVAL ; -/* BPF_TRAMP_MODIFY_RETURN trampolines can modify the return +/* +* BPF_TRAMP_MODIFY_RETURN trampolines can modify the return * of the previous call which is then passed on the stack to * the next BPF program. +* +* BPF_TRAMP_FENTRY trampoline may need to return the return +* value of BPF_PROG_TYPE_STRUCT_OPS prog. */ -if (mod_ret) +if (save_ret)emit_stx (&prog,BPF_DW ,BPF_REG_FP ,BPF_REG_0 ,-8 );/* replace 2 nops with JE insn, since jmp target is known */
@@ -1828,13 +1832,15 @@ static int emit_cond_near_jump(u8 **pprog, void *func, void *ip, u8 jmp_cond) }static int invoke_bpf (const struct btf_func_model *m,u8 **pprog, -struct bpf_tramp_progs *tp,int stack_size) +struct bpf_tramp_progs *tp,int stack_size, +bool save_ret) {int i;u8 *prog = *pprog;for (i =0 ; i < tp->nr_progs; i++) { -if (invoke_bpf_prog (m, &prog, tp->progs[i], stack_size, false)) +if (invoke_bpf_prog (m, &prog, tp->progs[i], stack_size, + save_ret))return -EINVAL ; } *pprog = prog;
@@ -1877,6 +1883,23 @@ static int invoke_bpf_mod_ret(const struct btf_func_model *m, u8 **pprog,return 0 ; } +static bool is_valid_bpf_tramp_flags (unsigned int flags) +{ +if ((flags &BPF_TRAMP_F_RESTORE_REGS ) && + (flags &BPF_TRAMP_F_SKIP_FRAME )) +return false; + +/* +* BPF_TRAMP_F_RET_FENTRY_RET is only used by bpf_struct_ops, +* and it must be used alone. +*/ +if ((flags &BPF_TRAMP_F_RET_FENTRY_RET ) && + (flags & ~BPF_TRAMP_F_RET_FENTRY_RET )) +return false; + +return true; +} +/* Example: * __be16 eth_type_trans(struct sk_buff *skb, struct net_device *dev); * its 'struct btf_func_model' will be nr_args=2
@@ -1949,17 +1972,19 @@ int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, void *istruct bpf_tramp_progs *fmod_ret = &tprogs[BPF_TRAMP_MODIFY_RETURN ];u8 **branches =NULL ;u8 *prog; +bool save_ret;/* x86-64 supports up to 6 arguments. 7+ can be added in the future */ if (nr_args >6 )return -ENOTSUPP ; -if ((flags &BPF_TRAMP_F_RESTORE_REGS ) && - (flags &BPF_TRAMP_F_SKIP_FRAME )) +if (!is_valid_bpf_tramp_flags (flags))return -EINVAL ; -if (flags &BPF_TRAMP_F_CALL_ORIG ) - stack_size +=8 ;/* room for return value of orig_call */ +/* room for return value of orig_call or fentry prog */ + save_ret = flags & (BPF_TRAMP_F_CALL_ORIG |BPF_TRAMP_F_RET_FENTRY_RET ); +if (save_ret) + stack_size +=8 ;if (flags &BPF_TRAMP_F_SKIP_FRAME )/* skip patched call instruction and point orig_call to actual
@@ -1986,7 +2011,8 @@ int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, void *i }if (fentry->nr_progs) -if (invoke_bpf (m, &prog, fentry, stack_size)) +if (invoke_bpf (m, &prog, fentry, stack_size, + flags &BPF_TRAMP_F_RET_FENTRY_RET ))return -EINVAL ;if (fmod_ret->nr_progs) {
@@ -2033,7 +2059,7 @@ int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, void *i }if (fexit->nr_progs) -if (invoke_bpf (m, &prog, fexit, stack_size)) { +if (invoke_bpf (m, &prog, fexit, stack_size, false)) { ret = -EINVAL ; goto cleanup; }
@@ -2053,9 +2079,10 @@ int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, void *i ret = -EINVAL ; goto cleanup; } -/* restore original return value back into RAX */ -emit_ldx (&prog,BPF_DW ,BPF_REG_0 ,BPF_REG_FP ,-8 ); } +/* restore return value of orig_call or fentry prog back into RAX */ +if (save_ret) +emit_ldx (&prog,BPF_DW ,BPF_REG_0 ,BPF_REG_FP ,-8 );EMIT1 (0x5B );/* pop rbx */ EMIT1 (0xC9 );/* leave */
include/linux/bpf.h +2 -0
@@ -553,6 +553,8 @@ struct btf_func_model {* programs only. Should not be used with normal calls and indirect calls. */ #define BPF_TRAMP_F_SKIP_FRAME BIT(2) +/* Return the return value of fentry prog. Only used by bpf_struct_ops. */ +#define BPF_TRAMP_F_RET_FENTRY_RET BIT(4)/* Each call __bpf_prog_enter + call bpf_func + call __bpf_prog_exit is ~50 * bytes on x86. Pick a number to fit into BPF_IMAGE_SIZE / 2
kernel/bpf/bpf_struct_ops.c +5 -2
@@ -367,6 +367,7 @@ static int bpf_struct_ops_map_update_elem(struct bpf_map *map, void *key,const struct btf_type *mtype, *ptype;struct bpf_prog *prog;u32 moff; +u32 flags; moff =btf_member_bit_offset (t, member) /8 ; ptype =btf_type_resolve_ptr (btf_vmlinux, member->type,NULL );
@@ -430,10 +431,12 @@ static int bpf_struct_ops_map_update_elem(struct bpf_map *map, void *key, tprogs[BPF_TRAMP_FENTRY ].progs[0 ] = prog; tprogs[BPF_TRAMP_FENTRY ].nr_progs =1 ; + flags = st_ops->func_models[i].ret_size >0 ? +BPF_TRAMP_F_RET_FENTRY_RET :0 ; err =arch_prepare_bpf_trampoline (NULL , image, st_map->image +PAGE_SIZE , - &st_ops->func_models[i],0 , - tprogs,NULL ); + &st_ops->func_models[i], + flags, tprogs,NULL );if (err <0 ) goto reset_unlock;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 78/172 IB/cma: Do not send IGMP leaves for sendonly Multicast groups
In reply to Greg Kroah-HartmanFrom: Christoph Lameter <[email protected]>
[ Upstream commit 2cc74e1ee31d00393b6698ec80b322fd26523da4 ]
ROCE uses IGMP for Multicast instead of the native Infiniband system where joins are required in order to post messages on the Multicast group. On Ethernet one can send Multicast messages to arbitrary addresses without the need to subscribe to a group.
So ROCE correctly does not send IGMP joins during rdma_join_multicast().
F.e. in cma_iboe_join_multicast() we see:
if (addr->sa_family == AF_INET) {
if (gid_type == IB_GID_TYPE_ROCE_UDP_ENCAP) {
ib.rec.hop_limit = IPV6_DEFAULT_HOPLIMIT;
if (!send_only) {
err = cma_igmp_send(ndev, &ib.rec.mgid,
true);
}
}
} else {So the IGMP join is suppressed as it is unnecessary.
However no such check is done in destroy_mc(). And therefore leaving a sendonly multicast group will send an IGMP leave.
This means that the following scenario can lead to a multicast receiver unexpectedly being unsubscribed from a MC group:
1. Sender thread does a sendonly join on MC group X. No IGMP join is sent.
2. Receiver thread does a regular join on the same MC Group x. IGMP join is sent and the receiver begins to get messages.
3. Sender thread terminates and destroys MC group X. IGMP leave is sent and the receiver no longer receives data.
This patch adds the same logic for sendonly joins to destroy_mc() that is also used in cma_iboe_join_multicast().
--- drivers/infiniband/core/cma.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/infiniband/core/cma.c +6 -1
@@ -1818,6 +1818,8 @@ static void cma_release_port(struct rdma_id_private *id_priv)static void destroy_mc (struct rdma_id_private *id_priv,struct cma_multicast *mc) { +bool send_only = mc->join_state ==BIT (SENDONLY_FULLMEMBER_JOIN ); +if (rdma_cap_ib_mcast (id_priv->id.device, id_priv->id.port_num))ib_sa_free_multicast (mc->sa_mc);
@@ -1834,7 +1836,10 @@ static void destroy_mc(struct rdma_id_private *id_priv,cma_set_mgid (id_priv, (struct sockaddr *)&mc->addr, &mgid); -cma_igmp_send (ndev, &mgid, false); + +if (!send_only) +cma_igmp_send (ndev, &mgid, false); +dev_put (ndev); }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 79/172 RDMA/cma: Fix listener leak in rdma_cma_listen_on_all() failure
In reply to Greg Kroah-HartmanFrom: Tao Liu <[email protected]>
[ Upstream commit ca465e1f1f9b38fe916a36f7d80c5d25f2337c81 ]
If cma_listen_on_all() fails it leaves the per-device ID still on the listen_list but the state is not set to RDMA_CM_ADDR_BOUND.
When the cmid is eventually destroyed cma_cancel_listens() is not called due to the wrong state, however the per-device IDs are still holding the refcount preventing the ID from being destroyed, thus deadlocking:
task:rping state:D stack: 0 pid:19605 ppid: 47036 flags:0x00000084
Call Trace: __schedule+0x29a/0x780 ? free_unref_page_commit+0x9b/0x110 schedule+0x3c/0xa0 schedule_timeout+0x215/0x2b0 ? __flush_work+0x19e/0x1e0 wait_for_completion+0x8d/0xf0 _destroy_id+0x144/0x210 [rdma_cm] ucma_close_id+0x2b/0x40 [rdma_ucm] __destroy_id+0x93/0x2c0 [rdma_ucm] ? __xa_erase+0x4a/0xa0 ucma_destroy_id+0x9a/0x120 [rdma_ucm] ucma_write+0xb8/0x130 [rdma_ucm] vfs_write+0xb4/0x250 ksys_write+0xb5/0xd0 ? syscall_trace_enter.isra.19+0x123/0x190 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9
Ensure that cma_listen_on_all() atomically unwinds its action under the lock during error.
--- drivers/infiniband/core/cma.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
drivers/infiniband/core/cma.c +10 -3
@@ -1746,15 +1746,16 @@ static void cma_cancel_route(struct rdma_id_private *id_priv) } } -static void cma_cancel_listens (struct rdma_id_private *id_priv) +static void _cma_cancel_listens (struct rdma_id_private *id_priv) {struct rdma_id_private *dev_id_priv; +lockdep_assert_held (&lock); +/* * Remove from listen_any_list to prevent added devices from spawning * additional listen requests. */ -mutex_lock (&lock);list_del (&id_priv->list);while (!list_empty (&id_priv->listen_list)) {
@@ -1768,6 +1769,12 @@ static void cma_cancel_listens(struct rdma_id_private *id_priv)rdma_destroy_id (&dev_id_priv->id);mutex_lock (&lock); } +} + +static void cma_cancel_listens (struct rdma_id_private *id_priv) +{ +mutex_lock (&lock); +_cma_cancel_listens (id_priv);mutex_unlock (&lock); }
@@ -2587,7 +2594,7 @@ static int cma_listen_on_all(struct rdma_id_private *id_priv)return 0 ; err_listen: -list_del (&id_priv->list); +_cma_cancel_listens (id_priv);mutex_unlock (&lock);if (to_destroy)rdma_destroy_id (&to_destroy->id);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 80/172 bpf, mips: Validate conditional branch offsets
In reply to Greg Kroah-HartmanFrom: Piotr Krysiuk <[email protected]>
[ Upstream commit 37cb28ec7d3a36a5bace7063a3dba633ab110f8b ]
The conditional branch instructions on MIPS use 18-bit signed offsets allowing for a branch range of 128 KBytes (backward and forward). However, this limit is not observed by the cBPF JIT compiler, and so the JIT compiler emits out-of-range branches when translating certain cBPF programs. A specific example of such a cBPF program is included in the "BPF_MAXINSNS: exec all MSH" test from lib/test_bpf.c that executes anomalous machine code containing incorrect branch offsets under JIT.
Furthermore, this issue can be abused to craft undesirable machine code, where the control flow is hijacked to execute arbitrary Kernel code.
The following steps can be used to reproduce the issue:
# echo 1 > /proc/sys/net/core/bpf_jit_enable # modprobe test_bpf test_name="BPF_MAXINSNS: exec all MSH"
This should produce multiple warnings from build_bimm() similar to:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 209 at arch/mips/mm/uasm-mips.c:210 build_insn+0x558/0x590
Micro-assembler field overflow
Modules linked in: test_bpf(+)
CPU: 0 PID: 209 Comm: modprobe Not tainted 5.14.3 #1
Stack : 00000000 807bb824 82b33c9c 801843c0 00000000 00000004 00000000 63c9b5ee
82b33af4 80999898 80910000 80900000 82fd6030 00000001 82b33a98 82087180
00000000 00000000 80873b28 00000000 000000fc 82b3394c 00000000 2e34312e
6d6d6f43 809a180f 809a1836 6f6d203a 80900000 00000001 82b33bac 80900000
00027f80 00000000 00000000 807bb824 00000000 804ed790 001cc317 00000001
[...]
Call Trace:
[<80108f44>] show_stack+0x38/0x118
[<807a7aac>] dump_stack_lvl+0x5c/0x7c
[<807a4b3c>] __warn+0xcc/0x140
[<807a4c3c>] warn_slowpath_fmt+0x8c/0xb8
[<8011e198>] build_insn+0x558/0x590
[<8011e358>] uasm_i_bne+0x20/0x2c
[<80127b48>] build_body+0xa58/0x2a94
[<80129c98>] bpf_jit_compile+0x114/0x1e4
[<80613fc4>] bpf_prepare_filter+0x2ec/0x4e4
[<8061423c>] bpf_prog_create+0x80/0xc4
[<c0a006e4>] test_bpf_init+0x300/0xba8 [test_bpf]
[<8010051c>] do_one_initcall+0x50/0x1d4
[<801c5e54>] do_init_module+0x60/0x220
[<801c8b20>] sys_finit_module+0xc4/0xfc
[<801144d0>] syscall_common+0x34/0x58
[...]
---[ end trace a287d9742503c645 ]---Then the anomalous machine code executes:
=> 0xc0a18000: addiu sp,sp,-16 0xc0a18004: sw s3,0(sp) 0xc0a18008: sw s4,4(sp) 0xc0a1800c: sw s5,8(sp) 0xc0a18010: sw ra,12(sp) 0xc0a18014: move s5,a0 0xc0a18018: move s4,zero 0xc0a1801c: move s3,zero
# __BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, 0) 0xc0a18020: lui t6,0x8012 0xc0a18024: ori t4,t6,0x9e14 0xc0a18028: li a1,0 0xc0a1802c: jalr t4 0xc0a18030: move a0,s5 0xc0a18034: bnez v0,0xc0a1ffb8 # incorrect branch offset 0xc0a18038: move v0,zero 0xc0a1803c: andi s4,s3,0xf 0xc0a18040: b 0xc0a18048 0xc0a18044: sll s4,s4,0x2
[...]
# __BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, 0) 0xc0a1ffa0: lui t6,0x8012 0xc0a1ffa4: ori t4,t6,0x9e14 0xc0a1ffa8: li a1,0 0xc0a1ffac: jalr t4 0xc0a1ffb0: move a0,s5 0xc0a1ffb4: bnez v0,0xc0a1ffb8 # incorrect branch offset 0xc0a1ffb8: move v0,zero 0xc0a1ffbc: andi s4,s3,0xf 0xc0a1ffc0: b 0xc0a1ffc8 0xc0a1ffc4: sll s4,s4,0x2
# __BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, 0) 0xc0a1ffc8: lui t6,0x8012 0xc0a1ffcc: ori t4,t6,0x9e14 0xc0a1ffd0: li a1,0 0xc0a1ffd4: jalr t4 0xc0a1ffd8: move a0,s5 0xc0a1ffdc: bnez v0,0xc0a3ffb8 # correct branch offset 0xc0a1ffe0: move v0,zero 0xc0a1ffe4: andi s4,s3,0xf 0xc0a1ffe8: b 0xc0a1fff0 0xc0a1ffec: sll s4,s4,0x2
[...]
# epilogue 0xc0a3ffb8: lw s3,0(sp) 0xc0a3ffbc: lw s4,4(sp) 0xc0a3ffc0: lw s5,8(sp) 0xc0a3ffc4: lw ra,12(sp) 0xc0a3ffc8: addiu sp,sp,16 0xc0a3ffcc: jr ra 0xc0a3ffd0: nop
To mitigate this issue, we assert the branch ranges for each emit call that could generate an out-of-range branch.
--- arch/mips/net/bpf_jit.c | 57 +++++++++++++++++++++++++++++++---------- 1 file changed, 43 insertions(+), 14 deletions(-)
arch/mips/net/bpf_jit.c +43 -14
@@ -662,6 +662,11 @@ static void build_epilogue(struct jit_ctx *ctx) ((int)K < 0 ? ((int)K >= SKF_LL_OFF ? func##_negative : func) : \ func##_positive) +static bool is_bad_offset (int b_off) +{ +return b_off >0x1ffff || b_off <-0x20000 ; +} +static int build_body (struct jit_ctx *ctx) {const struct bpf_prog *prog = ctx->skf;
@@ -728,7 +733,10 @@ static int build_body(struct jit_ctx *ctx)/* Load return register on DS for failures */ emit_reg_move (r_ret, r_zero, ctx);/* Return with error */ -emit_b (b_imm (prog->len, ctx), ctx); + b_off =b_imm (prog->len, ctx); +if (is_bad_offset (b_off)) +return -E2BIG ; +emit_b (b_off, ctx);emit_nop (ctx);break ;case BPF_LD |BPF_W |BPF_IND :
@@ -775,8 +783,10 @@ static int build_body(struct jit_ctx *ctx)emit_jalr (MIPS_R_RA , r_s0, ctx);emit_reg_move (MIPS_R_A0 , r_skb, ctx);/* delay slot */ /* Check the error value */ -emit_bcond (MIPS_COND_NE , r_ret,0 , -b_imm (prog->len, ctx), ctx); + b_off =b_imm (prog->len, ctx); +if (is_bad_offset (b_off)) +return -E2BIG ; +emit_bcond (MIPS_COND_NE , r_ret,0 , b_off, ctx);emit_reg_move (r_ret, r_zero, ctx);/* We are good */ /* X <- P[1:K] & 0xf */
@@ -855,8 +865,10 @@ static int build_body(struct jit_ctx *ctx)/* A /= X */ ctx->flags |=SEEN_X |SEEN_A ;/* Check if r_X is zero */ -emit_bcond (MIPS_COND_EQ , r_X, r_zero, -b_imm (prog->len, ctx), ctx); + b_off =b_imm (prog->len, ctx); +if (is_bad_offset (b_off)) +return -E2BIG ; +emit_bcond (MIPS_COND_EQ , r_X, r_zero, b_off, ctx);emit_load_imm (r_ret,0 , ctx);/* delay slot */ emit_div (r_A, r_X, ctx);break ;
@@ -864,8 +876,10 @@ static int build_body(struct jit_ctx *ctx)/* A %= X */ ctx->flags |=SEEN_X |SEEN_A ;/* Check if r_X is zero */ -emit_bcond (MIPS_COND_EQ , r_X, r_zero, -b_imm (prog->len, ctx), ctx); + b_off =b_imm (prog->len, ctx); +if (is_bad_offset (b_off)) +return -E2BIG ; +emit_bcond (MIPS_COND_EQ , r_X, r_zero, b_off, ctx);emit_load_imm (r_ret,0 , ctx);/* delay slot */ emit_mod (r_A, r_X, ctx);break ;
@@ -926,7 +940,10 @@ static int build_body(struct jit_ctx *ctx)break ;case BPF_JMP |BPF_JA :/* pc += K */ -emit_b (b_imm (i + k +1 , ctx), ctx); + b_off =b_imm (i + k +1 , ctx); +if (is_bad_offset (b_off)) +return -E2BIG ; +emit_b (b_off, ctx);emit_nop (ctx);break ;case BPF_JMP |BPF_JEQ |BPF_K :
@@ -1056,12 +1073,16 @@ static int build_body(struct jit_ctx *ctx)break ;case BPF_RET |BPF_A : ctx->flags |=SEEN_A ; -if (i != prog->len -1 ) +if (i != prog->len -1 ) {/* * If this is not the last instruction * then jump to the epilogue */ -emit_b (b_imm (prog->len, ctx), ctx); + b_off =b_imm (prog->len, ctx); +if (is_bad_offset (b_off)) +return -E2BIG ; +emit_b (b_off, ctx); + }emit_reg_move (r_ret, r_A, ctx);/* delay slot */ break ;case BPF_RET |BPF_K :
@@ -1075,7 +1096,10 @@ static int build_body(struct jit_ctx *ctx)* If this is not the last instruction * then jump to the epilogue */ -emit_b (b_imm (prog->len, ctx), ctx); + b_off =b_imm (prog->len, ctx); +if (is_bad_offset (b_off)) +return -E2BIG ; +emit_b (b_off, ctx);emit_nop (ctx); }break ;
@@ -1133,8 +1157,10 @@ static int build_body(struct jit_ctx *ctx)/* Load *dev pointer */ emit_load_ptr (r_s0, r_skb, off, ctx);/* error (0) in the delay slot */ -emit_bcond (MIPS_COND_EQ , r_s0, r_zero, -b_imm (prog->len, ctx), ctx); + b_off =b_imm (prog->len, ctx); +if (is_bad_offset (b_off)) +return -E2BIG ; +emit_bcond (MIPS_COND_EQ , r_s0, r_zero, b_off, ctx);emit_reg_move (r_ret, r_zero, ctx);if (code == (BPF_ANC |SKF_AD_IFINDEX )) { BUILD_BUG_ON(sizeof_field(struct net_device, ifindex) != 4);
@@ -1244,7 +1270,10 @@ void bpf_jit_compile(struct bpf_prog *fp)/* Generate the actual JIT code */ build_prologue (&ctx); -build_body (&ctx); +if (build_body (&ctx)) { +module_memfree (ctx.target); + goto out; + }build_epilogue (&ctx);/* Update the icache */
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 81/172 hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs
In reply to Greg Kroah-HartmanFrom: Vadim Pasternak <[email protected]>
[ Upstream commit e6fab7af6ba1bc77c78713a83876f60ca7a4a064 ]
Fan speed minimum can be enforced from sysfs. For example, setting current fan speed to 20 is used to enforce fan speed to be at 100% speed, 19 - to be not below 90% speed, etcetera. This feature provides ability to limit fan speed according to some system wise considerations, like absence of some replaceable units or high system ambient temperature.
Request for changing fan minimum speed is configuration request and can be set only through 'sysfs' write procedure. In this situation value of argument 'state' is above nominal fan speed maximum.
Return non-zero code in this case to avoid thermal_cooling_device_stats_update() call, because in this case statistics update violates thermal statistics table range. The issues is observed in case kernel is configured with option CONFIG_THERMAL_STATISTICS.
Here is the trace from KASAN:
[ 159.506659] BUG: KASAN: slab-out-of-bounds in thermal_cooling_device_stats_update+0x7d/0xb0 [ 159.516016] Read of size 4 at addr ffff888116163840 by task hw-management.s/7444 [ 159.545625] Call Trace: [ 159.548366] dump_stack+0x92/0xc1 [ 159.552084] ? thermal_cooling_device_stats_update+0x7d/0xb0 [ 159.635869] thermal_zone_device_update+0x345/0x780 [ 159.688711] thermal_zone_device_set_mode+0x7d/0xc0 [ 159.694174] mlxsw_thermal_modules_init+0x48f/0x590 [mlxsw_core] [ 159.700972] ? mlxsw_thermal_set_cur_state+0x5a0/0x5a0 [mlxsw_core] [ 159.731827] mlxsw_thermal_init+0x763/0x880 [mlxsw_core] [ 160.070233] RIP: 0033:0x7fd995909970 [ 160.074239] Code: 73 01 c3 48 8b 0d 28 d5 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 99 2d 2c 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff .. [ 160.095242] RSP: 002b:00007fff54f5d938 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 160.103722] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 00007fd995909970 [ 160.111710] RDX: 0000000000000013 RSI: 0000000001906008 RDI: 0000000000000001 [ 160.119699] RBP: 0000000001906008 R08: 00007fd995bc9760 R09: 00007fd996210700 [ 160.127687] R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000013 [ 160.135673] R13: 0000000000000001 R14: 00007fd995bc8600 R15: 0000000000000013 [ 160.143671] [ 160.145338] Allocated by task 2924: [ 160.149242] kasan_save_stack+0x19/0x40 [ 160.153541] __kasan_kmalloc+0x7f/0xa0 [ 160.157743] __kmalloc+0x1a2/0x2b0 [ 160.161552] thermal_cooling_device_setup_sysfs+0xf9/0x1a0 [ 160.167687] __thermal_cooling_device_register+0x1b5/0x500 [ 160.173833] devm_thermal_of_cooling_device_register+0x60/0xa0 [ 160.180356] mlxreg_fan_probe+0x474/0x5e0 [mlxreg_fan] [ 160.248140] [ 160.249807] The buggy address belongs to the object at ffff888116163400 [ 160.249807] which belongs to the cache kmalloc-1k of size 1024 [ 160.263814] The buggy address is located 64 bytes to the right of [ 160.263814] 1024-byte region [ffff888116163400, ffff888116163800) [ 160.277536] The buggy address belongs to the page: [ 160.282898] page:0000000012275840 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888116167000 pfn:0x116160 [ 160.294872] head:0000000012275840 order:3 compound_mapcount:0 compound_pincount:0 [ 160.303251] flags: 0x200000000010200(slab|head|node=0|zone=2) [ 160.309694] raw: 0200000000010200 ffffea00046f7208 ffffea0004928208 ffff88810004dbc0 [ 160.318367] raw: ffff888116167000 00000000000a0006 00000001ffffffff 0000000000000000 [ 160.327033] page dumped because: kasan: bad access detected [ 160.333270] [ 160.334937] Memory state around the buggy address: [ 160.356469] >ffff888116163800: fc ..
--- drivers/hwmon/mlxreg-fan.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/hwmon/mlxreg-fan.c +9 -3
@@ -315,8 +315,8 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, {struct mlxreg_fan *fan = cdev->devdata;unsigned long cur_state; +int i, config =0 ;u32 regval; -int i;int err;/*
@@ -329,6 +329,12 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,* overwritten. */ if (state >=MLXREG_FAN_SPEED_MIN && state <=MLXREG_FAN_SPEED_MAX ) { +/* +* This is configuration change, which is only supported through sysfs. +* For configuration non-zero value is to be returned to avoid thermal +* statistics update. +*/ + config =1 ; state -=MLXREG_FAN_MAX_STATE ;for (i =0 ; i < state; i++) fan->cooling_levels[i] = state;
@@ -343,7 +349,7 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, cur_state =MLXREG_FAN_PWM_DUTY2STATE (regval);if (state < cur_state) -return 0 ; +return config; state = cur_state; }
@@ -359,7 +365,7 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,dev_err (fan->dev,"Failed to write PWM duty\n" );return err; } -return 0 ; +return config; }static const struct thermal_cooling_device_ops mlxreg_fan_cooling_ops = {
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 82/172 RDMA/irdma: Skip CQP ring during a reset
In reply to Greg Kroah-HartmanFrom: Sindhu Devale <[email protected]>
[ Upstream commit 5b1e985f7626307c451f98883f5e2665ee208e1c ]
Due to duplicate reset flags, CQP commands are processed during reset.
This leads CQP failures such as below:
irdma0: [Delete Local MAC Entry Cmd Error][op_code=49] status=-27 waiting=1 completion_err=0 maj=0x0 min=0x0
Remove the redundant flag and set the correct reset flag so CPQ is paused during reset
--- drivers/infiniband/hw/irdma/cm.c | 4 ++-- drivers/infiniband/hw/irdma/hw.c | 6 +++--- drivers/infiniband/hw/irdma/i40iw_if.c | 2 +- drivers/infiniband/hw/irdma/main.h | 1 - drivers/infiniband/hw/irdma/utils.c | 2 +- drivers/infiniband/hw/irdma/verbs.c | 3 +-- 6 files changed, 8 insertions(+), 10 deletions(-)
drivers/infiniband/hw/irdma/cm.c +2 -2
@@ -3496,7 +3496,7 @@ static void irdma_cm_disconn_true(struct irdma_qp *iwqp) original_hw_tcp_state == IRDMA_TCP_STATE_TIME_WAIT || last_ae == IRDMA_AE_RDMAP_ROE_BAD_LLP_CLOSE || last_ae == IRDMA_AE_BAD_CLOSE || - last_ae == IRDMA_AE_LLP_CONNECTION_RESET || iwdev->reset)) { + last_ae == IRDMA_AE_LLP_CONNECTION_RESET || iwdev->rf->reset)) { issue_close =1 ; iwqp->cm_id =NULL ; qp->term_flags =0 ;
@@ -4250,7 +4250,7 @@ void irdma_cm_teardown_connections(struct irdma_device *iwdev, u32 *ipaddr, teardown_entry); attr.qp_state =IB_QPS_ERR ;irdma_modify_qp (&cm_node->iwqp->ibqp, &attr,IB_QP_STATE ,NULL ); -if (iwdev->reset) +if (iwdev->rf->reset)irdma_cm_disconn (cm_node->iwqp);irdma_rem_ref_cm_node (cm_node); }
drivers/infiniband/hw/irdma/hw.c +3 -3
@@ -1489,7 +1489,7 @@ void irdma_reinitialize_ieq(struct irdma_sc_vsi *vsi)irdma_puda_dele_rsrc (vsi,IRDMA_PUDA_RSRC_TYPE_IEQ , false);if (irdma_initialize_ieq (iwdev)) { - iwdev->reset = true; + iwdev->rf->reset = true; rf->gen_ops.request_reset (rf); } }
@@ -1632,13 +1632,13 @@ void irdma_rt_deinit_hw(struct irdma_device *iwdev)case IEQ_CREATED :if (!iwdev->roce_mode)irdma_puda_dele_rsrc (&iwdev->vsi,IRDMA_PUDA_RSRC_TYPE_IEQ , - iwdev->reset); + iwdev->rf->reset); fallthrough;case ILQ_CREATED :if (!iwdev->roce_mode)irdma_puda_dele_rsrc (&iwdev->vsi,IRDMA_PUDA_RSRC_TYPE_ILQ , - iwdev->reset); + iwdev->rf->reset);break ;default :ibdev_warn (&iwdev->ibdev,"bad init_state = %d\n" , iwdev->init_state);
drivers/infiniband/hw/irdma/i40iw_if.c +1 -1
@@ -55,7 +55,7 @@ static void i40iw_close(struct i40e_info *cdev_info, struct i40e_client *client, iwdev =to_iwdev (ibdev);if (reset) - iwdev->reset = true; + iwdev->rf->reset = true; iwdev->iw_status =0 ;irdma_port_ibevent (iwdev);
drivers/infiniband/hw/irdma/main.h +0 -1
@@ -346,7 +346,6 @@ struct irdma_device { bool roce_mode:1; bool roce_dcqcn_en:1; bool dcb:1; - bool reset:1; bool iw_ooo:1;enum init_completion_state init_state;
drivers/infiniband/hw/irdma/utils.c +1 -1
@@ -2510,7 +2510,7 @@ void irdma_modify_qp_to_err(struct irdma_sc_qp *sc_qp)struct irdma_qp *qp = sc_qp->qp_uk.back_qp;struct ib_qp_attr attr; -if (qp->iwdev->reset) +if (qp->iwdev->rf->reset)return ; attr.qp_state =IB_QPS_ERR ;
drivers/infiniband/hw/irdma/verbs.c +1 -2
@@ -535,8 +535,7 @@ static int irdma_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)irdma_qp_rem_ref (&iwqp->ibqp);wait_for_completion (&iwqp->free_qp);irdma_free_lsmm_rsrc (iwqp); -if (!iwdev->reset) -irdma_cqp_qp_destroy_cmd (&iwdev->rf->sc_dev, &iwqp->sc_qp); +irdma_cqp_qp_destroy_cmd (&iwdev->rf->sc_dev, &iwqp->sc_qp);if (!iwqp->user_mode) {if (iwqp->iwscq) {
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 83/172 RDMA/irdma: Validate number of CQ entries on create CQ
In reply to Greg Kroah-HartmanFrom: Sindhu Devale <[email protected]>
[ Upstream commit f4475f249445b3c1fb99919b0514a075b6d6b3d4 ]
Add lower bound check for CQ entries at creation time.
--- drivers/infiniband/hw/irdma/verbs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/irdma/verbs.c +1 -1
@@ -2040,7 +2040,7 @@ static int irdma_create_cq(struct ib_cq *ibcq,/* Kmode allocations */ int rsize; -if (entries > rf->max_cqe) { +if (entries <1 || entries > rf->max_cqe) { err_code = -EINVAL ; goto cq_free_rsrc; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 84/172 RDMA/irdma: Report correct WC error when transport retry counter is exceeded
In reply to Greg Kroah-HartmanFrom: Sindhu Devale <[email protected]>
[ Upstream commit d3bdcd59633907ee306057b6bb70f06dce47dddc ]
When the retry counter exceeds, as the remote QP didn't send any Ack or Nack an asynchronous event (AE) for too many retries is generated. Add code to handle the AE and set the correct IB WC error code IB_WC_RETRY_EXC_ERR.
--- drivers/infiniband/hw/irdma/hw.c | 3 +++ drivers/infiniband/hw/irdma/user.h | 1 + drivers/infiniband/hw/irdma/verbs.c | 2 ++ 3 files changed, 6 insertions(+)
drivers/infiniband/hw/irdma/hw.c +3 -0
@@ -176,6 +176,9 @@ static void irdma_set_flush_fields(struct irdma_sc_qp *qp,case IRDMA_AE_LLP_RECEIVED_MPA_CRC_ERROR : qp->flush_code =FLUSH_GENERAL_ERR ;break ; +case IRDMA_AE_LLP_TOO_MANY_RETRIES : + qp->flush_code =FLUSH_RETRY_EXC_ERR ; +break ;default : qp->flush_code =FLUSH_FATAL_ERR ;break ;
drivers/infiniband/hw/irdma/user.h +1 -0
@@ -102,6 +102,7 @@ enum irdma_flush_opcode {FLUSH_REM_OP_ERR ,FLUSH_LOC_LEN_ERR ,FLUSH_FATAL_ERR , + FLUSH_RETRY_EXC_ERR, }; enum irdma_cmpl_status {
drivers/infiniband/hw/irdma/verbs.c +2 -0
@@ -3358,6 +3358,8 @@ static enum ib_wc_status irdma_flush_err_to_ib_wc_status(enum irdma_flush_opcodereturn IB_WC_LOC_LEN_ERR ;case FLUSH_GENERAL_ERR :return IB_WC_WR_FLUSH_ERR ; +case FLUSH_RETRY_EXC_ERR : +return IB_WC_RETRY_EXC_ERR ;case FLUSH_FATAL_ERR :default :return IB_WC_FATAL_ERR ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 85/172 RDMA/irdma: Report correct WC error when there are MW bind errors
In reply to Greg Kroah-HartmanFrom: Sindhu Devale <[email protected]>
[ Upstream commit 9f7fa37a6bd90f2749c67f8524334c387d972eb9 ]
Report the correct WC error when MW bind error related asynchronous events are generated by HW.
--- drivers/infiniband/hw/irdma/hw.c | 5 +++++ drivers/infiniband/hw/irdma/user.h | 1 + drivers/infiniband/hw/irdma/verbs.c | 2 ++ 3 files changed, 8 insertions(+)
drivers/infiniband/hw/irdma/hw.c +5 -0
@@ -179,6 +179,11 @@ static void irdma_set_flush_fields(struct irdma_sc_qp *qp,case IRDMA_AE_LLP_TOO_MANY_RETRIES : qp->flush_code =FLUSH_RETRY_EXC_ERR ;break ; +case IRDMA_AE_AMP_MWBIND_INVALID_RIGHTS : +case IRDMA_AE_AMP_MWBIND_BIND_DISABLED : +case IRDMA_AE_AMP_MWBIND_INVALID_BOUNDS : + qp->flush_code =FLUSH_MW_BIND_ERR ; +break ;default : qp->flush_code =FLUSH_FATAL_ERR ;break ;
drivers/infiniband/hw/irdma/user.h +1 -0
@@ -103,6 +103,7 @@ enum irdma_flush_opcode {FLUSH_LOC_LEN_ERR ,FLUSH_FATAL_ERR ,FLUSH_RETRY_EXC_ERR , + FLUSH_MW_BIND_ERR, }; enum irdma_cmpl_status {
drivers/infiniband/hw/irdma/verbs.c +2 -0
@@ -3360,6 +3360,8 @@ static enum ib_wc_status irdma_flush_err_to_ib_wc_status(enum irdma_flush_opcodereturn IB_WC_WR_FLUSH_ERR ;case FLUSH_RETRY_EXC_ERR :return IB_WC_RETRY_EXC_ERR ; +case FLUSH_MW_BIND_ERR : +return IB_WC_MW_BIND_ERR ;case FLUSH_FATAL_ERR :default :return IB_WC_FATAL_ERR ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 86/172 netfilter: nf_tables: unlink table before deleting it
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ Upstream commit a499b03bf36b0c2e3b958a381d828678ab0ffc5e ]
syzbot reports following UAF:
BUG: KASAN: use-after-free in memcmp+0x18f/0x1c0 lib/string.c:955 nla_strcmp+0xf2/0x130 lib/nlattr.c:836 nft_table_lookup.part.0+0x1a2/0x460 net/netfilter/nf_tables_api.c:570 nft_table_lookup net/netfilter/nf_tables_api.c:4064 [inline] nf_tables_getset+0x1b3/0x860 net/netfilter/nf_tables_api.c:4064 nfnetlink_rcv_msg+0x659/0x13f0 net/netfilter/nfnetlink.c:285 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504
Problem is that all get operations are lockless, so the commit_mutex held by nft_rcv_nl_event() isn't enough to stop a parallel GET request from doing read-accesses to the table object even after synchronize_rcu().
To avoid this, unlink the table first and store the table objects in on-stack scratch space.
--- net/netfilter/nf_tables_api.c | 28 ++++++++++++++++++---------- 1 file changed, 18 insertions(+), 10 deletions(-)
net/netfilter/nf_tables_api.c +18 -10
@@ -9599,7 +9599,6 @@ static void __nft_release_table(struct net *net, struct nft_table *table) table->use--;nf_tables_chain_destroy (&ctx); } -list_del (&table->list);nf_tables_table_destroy (&ctx); }
@@ -9612,6 +9611,8 @@ static void __nft_release_tables(struct net *net)if (nft_table_has_owner (table))continue ; +list_del (&table->list); +__nft_release_table (net, table); } }
@@ -9619,31 +9620,38 @@ static void __nft_release_tables(struct net *net)static int nft_rcv_nl_event (struct notifier_block *this,unsigned long event,void *ptr) { +struct nft_table *table, *to_delete[8 ];struct nftables_pernet *nft_net;struct netlink_notify *n = ptr; -struct nft_table *table, *nt;struct net *net = n->net; -bool release = false; +unsigned int deleted; +bool restart = false;if (event !=NETLINK_URELEASE || n->protocol !=NETLINK_NETFILTER )return NOTIFY_DONE ; nft_net =nft_pernet (net); + deleted =0 ;mutex_lock (&nft_net->commit_mutex); +again:list_for_each_entry (table, &nft_net->tables, list) {if (nft_table_has_owner (table) && n->portid == table->nlpid) {__nft_release_hook (net, table); - release = true; +list_del_rcu (&table->list); + to_delete[deleted++] = table; +if (deleted >=ARRAY_SIZE (to_delete)) +break ; } } -if (release) { +if (deleted) { + restart = deleted >=ARRAY_SIZE (to_delete);synchronize_rcu (); -list_for_each_entry_safe (table, nt, &nft_net->tables, list) { -if (nft_table_has_owner (table) && - n->portid == table->nlpid) -__nft_release_table (net, table); - } +while (deleted) +__nft_release_table (net, to_delete[--deleted]); + +if (restart) + goto again; }mutex_unlock (&nft_net->commit_mutex);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 87/172 netfilter: log: work around missing softdep backend module
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ Upstream commit b53deef054e58fe4f37c66211b8ece9f8fc1aa13 ]
iptables/nftables has two types of log modules:
1. backend, e.g. nf_log_syslog, which implement the functionality
2. frontend, e.g. xt_LOG or nft_log, which call the functionality provided by backend based on nf_tables or xtables rule set.
Problem is that the request_module() call to load the backed in nf_logger_find_get() might happen with nftables transaction mutex held in case the call path is via nf_tables/nft_compat.
This can cause deadlocks (see 'Fixes' tags for details).
The chosen solution as to let modprobe deal with this by adding 'pre: ' soft dep tag to xt_LOG (to load the syslog backend) and xt_NFLOG (to load nflog backend).
Eric reports that this breaks on systems with older modprobe that doesn't support softdeps.
Another, similar issue occurs when someone either insmods xt_(NF)LOG directly or unloads the backend module (possible if no log frontend is in use): because the frontend module is already loaded, modprobe is not invoked again so the softdep isn't evaluated.
Add a workaround: If nf_logger_find_get() returns -ENOENT and call is not via nft_compat, load the backend explicitly and try again.
Else, let nft_compat ask for deferred request_module via nf_tables infra.
Softdeps are kept in-place, so with newer modprobe the dependencies are resolved from userspace.
--- net/netfilter/nft_compat.c | 17 ++++++++++++++++- net/netfilter/xt_LOG.c | 10 +++++++++- net/netfilter/xt_NFLOG.c | 10 +++++++++- 3 files changed, 34 insertions(+), 3 deletions(-)
net/netfilter/nft_compat.c +16 -1
@@ -19,6 +19,7 @@#include <linux/netfilter_bridge/ebtables.h> #include <linux/netfilter_arp/arp_tables.h> #include <net/netfilter/nf_tables.h> +#include <net/netfilter/nf_log.h> /* Used for matches where *info is larger than X byte */ #define NFT_MATCH_LARGE_THRESH 192
@@ -257,8 +258,22 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr,nft_compat_wait_for_destructors (); ret =xt_check_target (&par, size, proto, inv); -if (ret <0 ) +if (ret <0 ) { +if (ret == -ENOENT ) { +const char *modname =NULL ; + +if (strcmp (target->name,"LOG" ) ==0 ) + modname ="nf_log_syslog" ; +else if (strcmp (target->name,"NFLOG" ) ==0 ) + modname ="nfnetlink_log" ; + +if (modname && +nft_request_module (ctx->net,"%s" , modname) == -EAGAIN ) +return -EAGAIN ; + } +return ret; + }/* The standard target cannot be used */ if (!target->target)
net/netfilter/xt_LOG.c +9 -1
@@ -44,6 +44,7 @@ log_tg(struct sk_buff *skb, const struct xt_action_param *par)static int log_tg_check (const struct xt_tgchk_param *par) {const struct xt_log_info *loginfo = par->targinfo; +int ret;if (par->family !=NFPROTO_IPV4 && par->family !=NFPROTO_IPV6 )return -EINVAL ;
@@ -58,7 +59,14 @@ static int log_tg_check(const struct xt_tgchk_param *par)return -EINVAL ; } -return nf_logger_find_get (par->family,NF_LOG_TYPE_LOG ); + ret =nf_logger_find_get (par->family,NF_LOG_TYPE_LOG ); +if (ret !=0 && !par->nft_compat) { +request_module ("%s" ,"nf_log_syslog" ); + + ret =nf_logger_find_get (par->family,NF_LOG_TYPE_LOG ); + } + +return ret; }static void log_tg_destroy (const struct xt_tgdtor_param *par)
net/netfilter/xt_NFLOG.c +9 -1
@@ -42,13 +42,21 @@ nflog_tg(struct sk_buff *skb, const struct xt_action_param *par)static int nflog_tg_check (const struct xt_tgchk_param *par) {const struct xt_nflog_info *info = par->targinfo; +int ret;if (info->flags & ~XT_NFLOG_MASK )return -EINVAL ;if (info->prefix[sizeof (info->prefix) -1 ] !='\0' )return -EINVAL ; -return nf_logger_find_get (par->family,NF_LOG_TYPE_ULOG ); + ret =nf_logger_find_get (par->family,NF_LOG_TYPE_ULOG ); +if (ret !=0 && !par->nft_compat) { +request_module ("%s" ,"nfnetlink_log" ); + + ret =nf_logger_find_get (par->family,NF_LOG_TYPE_ULOG ); + } + +return ret; }static void nflog_tg_destroy (const struct xt_tgdtor_param *par)
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 88/172 Revert "mac80211: do not use low data rates for data frames with no ack flag"
In reply to Greg Kroah-HartmanFrom: Felix Fietkau <[email protected]>
[ Upstream commit 98d46b021f6ee246c7a73f9d490d4cddb4511a3b ]
This reverts commit d333322361e7 ("mac80211: do not use low data rates for data frames with no ack flag").
Returning false early in rate_control_send_low breaks sending broadcast packets, since rate control will not select a rate for it.
Before re-introducing a fixed version of this patch, we should probably also make some changes to rate control to be more conservative in selecting rates for no-ack packets and also prevent using probing rates on them, since we won't get any feedback.
--- net/mac80211/rate.c | 4 ---- 1 file changed, 4 deletions(-)
net/mac80211/rate.c +0 -4
@@ -392,10 +392,6 @@ static bool rate_control_send_low(struct ieee80211_sta *pubsta,int mcast_rate;bool use_basicrate = false; -if (ieee80211_is_tx_data (txrc->skb) && - info->flags &IEEE80211_TX_CTL_NO_ACK ) -return false; -if (!pubsta ||rc_no_data_or_no_ack_use_min (txrc)) {__rate_control_send_low (txrc->hw, sband, pubsta, info, txrc->rate_idx_mask);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 89/172 mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
In reply to Greg Kroah-HartmanFrom: Chih-Kang Chang <[email protected]>
[ Upstream commit fe94bac626d9c1c5bc98ab32707be8a9d7f8adba ]
In ieee80211_amsdu_aggregate() set a pointer frag_tail point to the end of skb_shinfo(head)->frag_list, and use it to bind other skb in the end of this function. But when execute ieee80211_amsdu_aggregate() ->ieee80211_amsdu_realloc_pad()->pskb_expand_head(), the address of skb_shinfo(head)->frag_list will be changed. However, the ieee80211_amsdu_aggregate() not update frag_tail after call pskb_expand_head(). That will cause the second skb can't bind to the head skb appropriately.So we update the address of frag_tail to fix it.
--- net/mac80211/tx.c | 8 ++++++++ 1 file changed, 8 insertions(+)
net/mac80211/tx.c +8 -0
@@ -3380,6 +3380,14 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,if (!ieee80211_amsdu_prepare_head (sdata, fast_tx, head)) goto out; +/* If n == 2, the "while (*frag_tail)" loop above didn't execute +* and frag_tail should be &skb_shinfo(head)->frag_list. +* However, ieee80211_amsdu_prepare_head() can reallocate it. +* Reload frag_tail to have it pointing to the correct place. +*/ +if (n ==2 ) + frag_tail = &skb_shinfo (head)->frag_list; +/* * Pad out the previous subframe to a multiple of 4 by adding the * padding to the next one, that's being added. Note that head->len
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 90/172 mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap
In reply to Greg Kroah-HartmanFrom: Lorenzo Bianconi <[email protected]>
[ Upstream commit 13cb6d826e0ac0d144b0d48191ff1a111d32f0c6 ]
Limit max values for vht mcs and nss in ieee80211_parse_tx_radiotap routine in order to fix the following warning reported by syzbot:
WARNING: CPU: 0 PID: 10717 at include/net/mac80211.h:989 ieee80211_rate_set_vht include/net/mac80211.h:989 [inline] WARNING: CPU: 0 PID: 10717 at include/net/mac80211.h:989 ieee80211_parse_tx_radiotap+0x101e/0x12d0 net/mac80211/tx.c:2244 Modules linked in: CPU: 0 PID: 10717 Comm: syz-executor.5 Not tainted 5.14.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:ieee80211_rate_set_vht include/net/mac80211.h:989 [inline] RIP: 0010:ieee80211_parse_tx_radiotap+0x101e/0x12d0 net/mac80211/tx.c:2244 RSP: 0018:ffffc9000186f3e8 EFLAGS: 00010216 RAX: 0000000000000618 RBX: ffff88804ef76500 RCX: ffffc900143a5000 RDX: 0000000000040000 RSI: ffffffff888f478e RDI: 0000000000000003 RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000100 R10: ffffffff888f46f9 R11: 0000000000000000 R12: 00000000fffffff8 R13: ffff88804ef7653c R14: 0000000000000001 R15: 0000000000000004 FS: 00007fbf5718f700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2de23000 CR3: 000000006a671000 CR4: 00000000001506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Call Trace: ieee80211_monitor_select_queue+0xa6/0x250 net/mac80211/iface.c:740 netdev_core_pick_tx+0x169/0x2e0 net/core/dev.c:4089 __dev_queue_xmit+0x6f9/0x3710 net/core/dev.c:4165 __bpf_tx_skb net/core/filter.c:2114 [inline] __bpf_redirect_no_mac net/core/filter.c:2139 [inline] __bpf_redirect+0x5ba/0xd20 net/core/filter.c:2162 ____bpf_clone_redirect net/core/filter.c:2429 [inline] bpf_clone_redirect+0x2ae/0x420 net/core/filter.c:2401 bpf_prog_eeb6f53a69e5c6a2+0x59/0x234 bpf_dispatcher_nop_func include/linux/bpf.h:717 [inline] __bpf_prog_run include/linux/filter.h:624 [inline] bpf_prog_run include/linux/filter.h:631 [inline] bpf_test_run+0x381/0xa30 net/bpf/test_run.c:119 bpf_prog_test_run_skb+0xb84/0x1ee0 net/bpf/test_run.c:663 bpf_prog_test_run kernel/bpf/syscall.c:3307 [inline] __sys_bpf+0x2137/0x5df0 kernel/bpf/syscall.c:4605 __do_sys_bpf kernel/bpf/syscall.c:4691 [inline] __se_sys_bpf kernel/bpf/syscall.c:4689 [inline] __x64_sys_bpf+0x75/0xb0 kernel/bpf/syscall.c:4689 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x4665f9
--- net/mac80211/tx.c | 4 ++++ 1 file changed, 4 insertions(+)
net/mac80211/tx.c +4 -0
@@ -2209,7 +2209,11 @@ bool ieee80211_parse_tx_radiotap(struct sk_buff *skb, } vht_mcs = iterator.this_arg[4 ] >>4 ; +if (vht_mcs >11 ) + vht_mcs =0 ; vht_nss = iterator.this_arg[4 ] &0xF ; +if (!vht_nss || vht_nss >8 ) + vht_nss =1 ;break ;/*
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 91/172 mac80211: mesh: fix potentially unaligned access
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit b9731062ce8afd35cf723bf3a8ad55d208f915a5 ]
The pointer here points directly into the frame, so the access is potentially unaligned. Use get_unaligned_le16 to avoid that.
--- net/mac80211/mesh_ps.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/mac80211/mesh_ps.c +2 -1
@@ -2,6 +2,7 @@/* * Copyright 2012-2013, Marco Porsch <[email protected]> * Copyright 2012-2013, cozybit Inc. +* Copyright (C) 2021 Intel Corporation */ #include "mesh.h"
@@ -588,7 +589,7 @@ void ieee80211_mps_frame_release(struct sta_info *sta,/* only transmit to PS STA with announced, non-zero awake window */ if (test_sta_flag (sta,WLAN_STA_PS_STA ) && - (!elems->awake_window || !le16_to_cpu (*elems->awake_window))) + (!elems->awake_window || !get_unaligned_le16 (elems->awake_window)))return ;if (!test_sta_flag (sta,WLAN_STA_MPSP_OWNER ))
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 92/172 mac80211-hwsim: fix late beacon hrtimer handling
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit 313bbd1990b6ddfdaa7da098d0c56b098a833572 ]
Thomas explained in https://lore.kernel.org/r/87mtoeb4hb.ffs@tglx
that our handling of the hrtimer here is wrong: If the timer fires late (e.g. due to vCPU scheduling, as reported by Dmitry/syzbot) then it tries to actually rearm the timer at the next deadline, which might be in the past already:
1 2 3 N N+1 | | | ... | |
^ intended to fire here (1)
^ next deadline here (2)
^ actually fired here
The next time it fires, it's later, but will still try to schedule for the next deadline (now 3), etc. until it catches up with N, but that might take a long time, causing stalls etc.
Now, all of this is simulation, so we just have to fix it, but note that the behaviour is wrong even per spec, since there's no value then in sending all those beacons unaligned - they should be aligned to the TBTT (1, 2, 3, ... in the picture), and if we're a bit (or a lot) late, then just resume at that point.
Therefore, change the code to use hrtimer_forward_now() which will ensure that the next firing of the timer would be at N+1 (in the picture), i.e. the next interval point after the current time.
--- drivers/net/wireless/mac80211_hwsim.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/mac80211_hwsim.c +2 -2
@@ -1867,8 +1867,8 @@ mac80211_hwsim_beacon(struct hrtimer *timer) bcn_int -= data->bcn_delta; data->bcn_delta =0 ; } -hrtimer_forward (&data->beacon_timer,hrtimer_get_expires (timer), -ns_to_ktime (bcn_int *NSEC_PER_USEC )); +hrtimer_forward_now (&data->beacon_timer, +ns_to_ktime (bcn_int *NSEC_PER_USEC ));return HRTIMER_RESTART ; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 93/172 driver core: fw_devlink: Add support for FWNODE_FLAG_NEEDS_CHILD_BOUND_ON_ADD
In reply to Greg Kroah-HartmanFrom: Saravana Kannan <[email protected]>
[ Upstream commit 5501765a02a6c324f78581e6bb8209d054fe13ae ]
If a parent device is also a supplier to a child device, fw_devlink=on by design delays the probe() of the child device until the probe() of the parent finishes successfully.
However, some drivers of such parent devices (where parent is also a supplier) expect the child device to finish probing successfully as soon as they are added using device_add() and before the probe() of the parent device has completed successfully. One example of such a case is discussed in the link mentioned below.
Add a flag to make fw_devlink=on not enforce these supplier-consumer relationships, so these drivers can continue working.
--- drivers/base/core.c | 19 +++++++++++++++++++ include/linux/fwnode.h | 11 ++++++++--- 2 files changed, 27 insertions(+), 3 deletions(-)
drivers/base/core.c +19 -0
@@ -1721,6 +1721,25 @@ static int fw_devlink_create_devlink(struct device *con,struct device *sup_dev;int ret =0 ; +/* +* In some cases, a device P might also be a supplier to its child node +* C. However, this would defer the probe of C until the probe of P +* completes successfully. This is perfectly fine in the device driver +* model. device_add() doesn't guarantee probe completion of the device +* by the time it returns. +* +* However, there are a few drivers that assume C will finish probing +* as soon as it's added and before P finishes probing. So, we provide +* a flag to let fw_devlink know not to delay the probe of C until the +* probe of P completes successfully. +* +* When such a flag is set, we can't create device links where P is the +* supplier of C as that would delay the probe of C. +*/ +if (sup_handle->flags &FWNODE_FLAG_NEEDS_CHILD_BOUND_ON_ADD && +fwnode_is_ancestor_of (sup_handle, con->fwnode)) +return -EINVAL ; + sup_dev =get_dev_from_fwnode (sup_handle);if (sup_dev) {/*
include/linux/fwnode.h +8 -3
@@ -22,10 +22,15 @@ struct device;* LINKS_ADDED: The fwnode has already be parsed to add fwnode links. * NOT_DEVICE: The fwnode will never be populated as a struct device. * INITIALIZED: The hardware corresponding to fwnode has been initialized. +* NEEDS_CHILD_BOUND_ON_ADD: For this fwnode/device to probe successfully, its +* driver needs its child devices to be bound with +* their respective drivers as soon as they are +* added. */ -#define FWNODE_FLAG_LINKS_ADDED BIT(0) -#define FWNODE_FLAG_NOT_DEVICE BIT(1) -#define FWNODE_FLAG_INITIALIZED BIT(2) +#define FWNODE_FLAG_LINKS_ADDED BIT(0) +#define FWNODE_FLAG_NOT_DEVICE BIT(1) +#define FWNODE_FLAG_INITIALIZED BIT(2) +#define FWNODE_FLAG_NEEDS_CHILD_BOUND_ON_ADD BIT(3)struct fwnode_handle {struct fwnode_handle *secondary;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 94/172 net: mdiobus: Set FWNODE_FLAG_NEEDS_CHILD_BOUND_ON_ADD for mdiobus parents
In reply to Greg Kroah-HartmanFrom: Saravana Kannan <[email protected]>
[ Upstream commit 04f41c68f18886aea5afc68be945e7195ea1d598 ]
There are many instances of PHYs that depend on a switch to supply a resource (Eg: interrupts). Switches also expects the PHYs to be probed by their specific drivers as soon as they are added. If that doesn't happen, then the switch would force the use of generic PHY drivers for the PHY even if the PHY might have specific driver available.
fw_devlink=on by design can cause delayed probes of PHY. To avoid, this we need to set the FWNODE_FLAG_NEEDS_CHILD_BOUND_ON_ADD for the switch's fwnode before the PHYs are added. The most generic way to do this is to set this flag for the parent of MDIO busses which is typically the switch.
For more context:
https://lore.kernel.org/lkml/[email protected]/#t
--- drivers/net/phy/mdio_bus.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/phy/mdio_bus.c +4 -0
@@ -525,6 +525,10 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner) NULL == bus->read || NULL == bus->write)return -EINVAL ; +if (bus->parent && bus->parent->of_node) + bus->parent->of_node->fwnode.flags |= +FWNODE_FLAG_NEEDS_CHILD_BOUND_ON_ADD ; +BUG_ON (bus->state !=MDIOBUS_ALLOCATED && bus->state !=MDIOBUS_UNREGISTERED );
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 95/172 sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
[ Upstream commit f7e745f8e94492a8ac0b0a26e25f2b19d342918f ]
We should always check if skb_header_pointer's return is NULL before using it, otherwise it may cause null-ptr-deref, as syzbot reported:
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:sctp_rcv_ootb net/sctp/input.c:705 [inline] RIP: 0010:sctp_rcv+0x1d84/0x3220 net/sctp/input.c:196 Call Trace: <IRQ> sctp6_rcv+0x38/0x60 net/sctp/ipv6.c:1109 ip6_protocol_deliver_rcu+0x2e9/0x1ca0 net/ipv6/ip6_input.c:422 ip6_input_finish+0x62/0x170 net/ipv6/ip6_input.c:463 NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip6_input+0x9c/0xd0 net/ipv6/ip6_input.c:472 dst_input include/net/dst.h:460 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ipv6_rcv+0x28c/0x3c0 net/ipv6/ip6_input.c:297
--- net/sctp/input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sctp/input.c +1 -1
@@ -702,7 +702,7 @@ static int sctp_rcv_ootb(struct sk_buff *skb) ch =skb_header_pointer (skb, offset,sizeof (*ch), &_ch);/* Break out if chunk length is less then minimal. */ -if (ntohs (ch->length) <sizeof (_ch)) +if (!ch ||ntohs (ch->length) <sizeof (_ch))break ; ch_end = offset +SCTP_PAD4 (ntohs (ch->length));
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 96/172 mptcp: dont return sockets in foreign netns
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ Upstream commit ea1300b9df7c8e8b65695a08b8f6aaf4b25fec9c ]
mptcp_token_get_sock() may return a mptcp socket that is in a different net namespace than the socket that received the token value.
The mptcp syncookie code path had an explicit check for this, this moves the test into mptcp_token_get_sock() function.
Eventually token.c should be converted to pernet storage, but such change is not suitable for net tree.
--- net/mptcp/mptcp_diag.c | 2 +- net/mptcp/protocol.h | 2 +- net/mptcp/subflow.c | 2 +- net/mptcp/syncookies.c | 13 +------------ net/mptcp/token.c | 11 ++++++++--- net/mptcp/token_test.c | 14 ++++++++------ 6 files changed, 20 insertions(+), 24 deletions(-)
net/mptcp/mptcp_diag.c +1 -1
@@ -36,7 +36,7 @@ static int mptcp_diag_dump_one(struct netlink_callback *cb,struct sock *sk; net =sock_net (in_skb->sk); - msk =mptcp_token_get_sock (req->id.idiag_cookie[0 ]); + msk =mptcp_token_get_sock (net, req->id.idiag_cookie[0 ]);if (!msk) goto out_nosk;
net/mptcp/protocol.h +1 -1
@@ -680,7 +680,7 @@ int mptcp_token_new_connect(struct sock *sk);void mptcp_token_accept (struct mptcp_subflow_request_sock *r,struct mptcp_sock *msk);bool mptcp_token_exists (u32 token); -struct mptcp_sock *mptcp_token_get_sock (u32 token); +struct mptcp_sock *mptcp_token_get_sock (struct net *net,u32 token);struct mptcp_sock *mptcp_token_iter_next (const struct net *net,long *s_slot,long *s_num);void mptcp_token_destroy (struct mptcp_sock *msk);
net/mptcp/subflow.c +1 -1
@@ -86,7 +86,7 @@ static struct mptcp_sock *subflow_token_join_request(struct request_sock *req)struct mptcp_sock *msk;int local_id; - msk =mptcp_token_get_sock (subflow_req->token); + msk =mptcp_token_get_sock (sock_net (req_to_sk (req)), subflow_req->token);if (!msk) {SUBFLOW_REQ_INC_STATS (req,MPTCP_MIB_JOINNOTOKEN );return NULL ;
net/mptcp/syncookies.c +1 -12
@@ -108,18 +108,12 @@ bool mptcp_token_join_cookie_init_state(struct mptcp_subflow_request_sock *subfl e->valid =0 ; - msk =mptcp_token_get_sock (e->token); + msk =mptcp_token_get_sock (net, e->token);if (!msk) {spin_unlock_bh (&join_entry_locks[i]);return false; } -/* If this fails, the token got re-used in the mean time by another -* mptcp socket in a different netns, i.e. entry is outdated. -*/ -if (!net_eq (sock_net ((struct sock *)msk), net)) - goto err_put; - subflow_req->remote_nonce = e->remote_nonce; subflow_req->local_nonce = e->local_nonce; subflow_req->backup = e->backup;
@@ -128,11 +122,6 @@ bool mptcp_token_join_cookie_init_state(struct mptcp_subflow_request_sock *subfl subflow_req->msk = msk;spin_unlock_bh (&join_entry_locks[i]);return true; - -err_put: -spin_unlock_bh (&join_entry_locks[i]); -sock_put ((struct sock *)msk); -return false; }void __init mptcp_join_cookie_init (void )
net/mptcp/token.c +8 -3
@@ -231,6 +231,7 @@ bool mptcp_token_exists(u32 token)/** * mptcp_token_get_sock - retrieve mptcp connection sock using its token +* @net: restrict to this namespace * @token: token of the mptcp connection to retrieve * * This function returns the mptcp connection structure with the given token.
@@ -238,7 +239,7 @@ bool mptcp_token_exists(u32 token)* * returns NULL if no connection with the given token value exists. */ -struct mptcp_sock *mptcp_token_get_sock (u32 token) +struct mptcp_sock *mptcp_token_get_sock (struct net *net,u32 token) {struct hlist_nulls_node *pos;struct token_bucket *bucket;
@@ -251,11 +252,15 @@ struct mptcp_sock *mptcp_token_get_sock(u32 token) again:sk_nulls_for_each_rcu (sk, pos, &bucket->msk_chain) { msk =mptcp_sk (sk); -if (READ_ONCE (msk->token) != token) +if (READ_ONCE (msk->token) != token || + !net_eq (sock_net (sk), net))continue ; +if (!refcount_inc_not_zero (&sk->sk_refcnt)) goto not_found; -if (READ_ONCE (msk->token) != token) { + +if (READ_ONCE (msk->token) != token || + !net_eq (sock_net (sk), net)) {sock_put (sk); goto again; }
net/mptcp/token_test.c +8 -6
@@ -11,6 +11,7 @@ static struct mptcp_subflow_request_sock *build_req_sock(struct kunit *test) GFP_USER);KUNIT_EXPECT_NOT_ERR_OR_NULL (test, req);mptcp_token_init_request ((struct request_sock *)req); +sock_net_set ((struct sock *)req, &init_net);return req; }
@@ -22,7 +23,7 @@ static void mptcp_token_test_req_basic(struct kunit *test)KUNIT_ASSERT_EQ (test,0 ,mptcp_token_new_request ((struct request_sock *)req));KUNIT_EXPECT_NE (test,0 , (int )req->token); -KUNIT_EXPECT_PTR_EQ (test, null_msk,mptcp_token_get_sock (req->token)); +KUNIT_EXPECT_PTR_EQ (test, null_msk,mptcp_token_get_sock (&init_net, req->token));/* cleanup */ mptcp_token_destroy_request ((struct request_sock *)req);
@@ -55,6 +56,7 @@ static struct mptcp_sock *build_msk(struct kunit *test) msk =kunit_kzalloc (test,sizeof (struct mptcp_sock ),GFP_USER );KUNIT_EXPECT_NOT_ERR_OR_NULL (test, msk);refcount_set (&((struct sock *)msk)->sk_refcnt,1 ); +sock_net_set ((struct sock *)msk, &init_net);return msk; }
@@ -74,11 +76,11 @@ static void mptcp_token_test_msk_basic(struct kunit *test) mptcp_token_new_connect((struct sock *)icsk));KUNIT_EXPECT_NE (test,0 , (int )ctx->token);KUNIT_EXPECT_EQ (test, ctx->token, msk->token); -KUNIT_EXPECT_PTR_EQ (test, msk,mptcp_token_get_sock (ctx->token)); +KUNIT_EXPECT_PTR_EQ (test, msk,mptcp_token_get_sock (&init_net, ctx->token));KUNIT_EXPECT_EQ (test,2 , (int )refcount_read (&sk->sk_refcnt));mptcp_token_destroy (msk); -KUNIT_EXPECT_PTR_EQ (test, null_msk,mptcp_token_get_sock (ctx->token)); +KUNIT_EXPECT_PTR_EQ (test, null_msk,mptcp_token_get_sock (&init_net, ctx->token)); }static void mptcp_token_test_accept (struct kunit *test)
@@ -90,11 +92,11 @@ static void mptcp_token_test_accept(struct kunit *test) mptcp_token_new_request((struct request_sock *)req)); msk->token = req->token;mptcp_token_accept (req, msk); -KUNIT_EXPECT_PTR_EQ (test, msk,mptcp_token_get_sock (msk->token)); +KUNIT_EXPECT_PTR_EQ (test, msk,mptcp_token_get_sock (&init_net, msk->token));/* this is now a no-op */ mptcp_token_destroy_request ((struct request_sock *)req); -KUNIT_EXPECT_PTR_EQ (test, msk,mptcp_token_get_sock (msk->token)); +KUNIT_EXPECT_PTR_EQ (test, msk,mptcp_token_get_sock (&init_net, msk->token));/* cleanup */ mptcp_token_destroy (msk);
@@ -116,7 +118,7 @@ static void mptcp_token_test_destroyed(struct kunit *test)/* simulate race on removal */ refcount_set (&sk->sk_refcnt,0 ); -KUNIT_EXPECT_PTR_EQ (test, null_msk,mptcp_token_get_sock (msk->token)); +KUNIT_EXPECT_PTR_EQ (test, null_msk,mptcp_token_get_sock (&init_net, msk->token));/* cleanup */ mptcp_token_destroy (msk);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 97/172 mptcp: allow changing the backup bit when no sockets are open
In reply to Greg Kroah-HartmanFrom: Davide Caratti <[email protected]>
[ Upstream commit 3f4a08909e2c740f8045efc74c4cf82eeaae3e36 ]
current Linux refuses to change the 'backup' bit of MPTCP endpoints, i.e. using MPTCP_PM_CMD_SET_FLAGS, unless it finds (at least) one subflow that matches the endpoint address. There is no reason for that, so we can just ignore the return value of mptcp_nl_addr_backup(). In this way, endpoints can reconfigure their 'backup' flag even if no MPTCP sockets are open (or more generally, in case the MP_PRIO message is not sent out).
--- net/mptcp/pm_netlink.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
net/mptcp/pm_netlink.c +1 -3
@@ -1558,9 +1558,7 @@ static int mptcp_nl_cmd_set_flags(struct sk_buff *skb, struct genl_info *info)list_for_each_entry (entry, &pernet->local_addr_list, list) {if (addresses_equal (&entry->addr, &addr.addr, true)) { - ret =mptcp_nl_addr_backup (net, &entry->addr, bkup); -if (ret) -return ret; +mptcp_nl_addr_backup (net, &entry->addr, bkup);if (bkup) entry->flags |=MPTCP_PM_ADDR_FLAG_BACKUP ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 98/172 RDMA/hns: Work around broken constant propagation in gcc 8
In reply to Greg Kroah-HartmanFrom: Jason Gunthorpe <[email protected]>
[ Upstream commit 14351f08ed5c8b888cdd95651152db7e096ee27f ]
gcc 8.3 and 5.4 throw this:
In function 'modify_qp_init_to_rtr',././include/linux/compiler_types.h:322:38: error: call to '__compiletime_assert_1859' declared with attribute error: FIELD_PREP: value too large for the field
_compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
[..]drivers/infiniband/hw/hns/hns_roce_common.h:91:52: note: in expansion of macro 'FIELD_PREP'
*((__le32 *)ptr + (field_h) / 32) |= cpu_to_le32(FIELD_PREP( \
^~~~~~~~~~
drivers/infiniband/hw/hns/hns_roce_common.h:95:39: note: in expansion of macro '_hr_reg_write'
#define hr_reg_write(ptr, field, val) _hr_reg_write(ptr, field, val)
^~~~~~~~~~~~~drivers/infiniband/hw/hns/hns_roce_hw_v2.c:4412:2: note: in expansion of macro 'hr_reg_write'
hr_reg_write(context, QPC_LP_PKTN_INI, lp_pktn_ini);
Because gcc has miscalculated the constantness of lp_pktn_ini:
mtu = ib_mtu_enum_to_int(ib_mtu); if (WARN_ON(mtu < 0)) [..] lp_pktn_ini = ilog2(MAX_LP_MSG_LEN / mtu);
Since mtu is limited to {256,512,1024,2048,4096} lp_pktn_ini is between 4 and 8 which is compatible with the 4 bit field in the FIELD_PREP.
Work around this broken compiler by adding a 'can never be true' constraint on lp_pktn_ini's value which clears out the problem.
--- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/infiniband/hw/hns/hns_roce_hw_v2.c +6 -5
@@ -4411,7 +4411,12 @@ static int modify_qp_init_to_rtr(struct ib_qp *ibqp, hr_qp->path_mtu = ib_mtu; mtu =ib_mtu_enum_to_int (ib_mtu); -if (WARN_ON (mtu <0 )) +if (WARN_ON (mtu <=0 )) +return -EINVAL ; +#define MAX_LP_MSG_LEN 65536 +/* MTU * (2 ^ LP_PKTN_INI) shouldn't be bigger than 64KB */ + lp_pktn_ini =ilog2 (MAX_LP_MSG_LEN / mtu); +if (WARN_ON (lp_pktn_ini >=0xF ))return -EINVAL ;if (attr_mask &IB_QP_PATH_MTU ) {
@@ -4419,10 +4424,6 @@ static int modify_qp_init_to_rtr(struct ib_qp *ibqp,hr_reg_clear (qpc_mask,QPC_MTU ); } -#define MAX_LP_MSG_LEN 65536 -/* MTU * (2 ^ LP_PKTN_INI) shouldn't be bigger than 64KB */ - lp_pktn_ini =ilog2 (MAX_LP_MSG_LEN / mtu); -hr_reg_write (context,QPC_LP_PKTN_INI , lp_pktn_ini);hr_reg_clear (qpc_mask,QPC_LP_PKTN_INI );
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 99/172 hwmon: (tmp421) report /PVLD condition as fault
In reply to Greg Kroah-HartmanFrom: Paul Fertser <[email protected]>
[ Upstream commit 540effa7f283d25bcc13c0940d808002fee340b8 ]
For both local and remote sensors all the supported ICs can report an "undervoltage lockout" condition which means the conversion wasn't properly performed due to insufficient power supply voltage and so the measurement results can't be trusted.
--- drivers/hwmon/tmp421.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
drivers/hwmon/tmp421.c +3 -6
@@ -179,10 +179,10 @@ static int tmp421_read(struct device *dev, enum hwmon_sensor_types type,return 0 ;case hwmon_temp_fault:/* -* The OPEN bit signals a fault. This is bit 0 of the temperature -* register (low byte). +* Any of OPEN or /PVLD bits indicate a hardware mulfunction +* and the conversion result may be incorrect */ - *val = tmp421->temp[channel] &0x01 ; + *val = !!(tmp421->temp[channel] &0x03 );return 0 ;default :return -EOPNOTSUPP ;
@@ -195,9 +195,6 @@ static umode_t tmp421_is_visible(const void *data, enum hwmon_sensor_types type, {switch (attr) {case hwmon_temp_fault: -if (channel ==0 ) -return 0 ; -return 0444 ;case hwmon_temp_input:return 0444 ;default :
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 100/172 hwmon: (tmp421) fix rounding for negative values
In reply to Greg Kroah-HartmanFrom: Paul Fertser <[email protected]>
[ Upstream commit 724e8af85854c4d3401313b6dd7d79cf792d8990 ]
Old code produces -24999 for 0b1110011100000000 input in standard format due to always rounding up rather than "away from zero".
Use the common macro for division, unify and simplify the conversion code along the way.
--- drivers/hwmon/tmp421.c | 24 ++++++++---------------- 1 file changed, 8 insertions(+), 16 deletions(-)
drivers/hwmon/tmp421.c +8 -16
@@ -100,23 +100,17 @@ struct tmp421_data {s16 temp[4 ]; }; -static int temp_from_s16 (s16 reg) +static int temp_from_raw (u16 reg,bool extended) {/* Mask out status bits */ int temp = reg & ~0xf ; -return (temp *1000 +128 ) /256 ; -} - -static int temp_from_u16 (u16 reg) -{ -/* Mask out status bits */ -int temp = reg & ~0xf ; - -/* Add offset for extended temperature range. */ - temp -=64 *256 ; +if (extended) + temp = temp -64 *256 ; +else + temp = (s16 )temp; -return (temp *1000 +128 ) /256 ; +return DIV_ROUND_CLOSEST (temp *1000 ,256 ); }static int tmp421_update_device (struct tmp421_data *data)
@@ -172,10 +166,8 @@ static int tmp421_read(struct device *dev, enum hwmon_sensor_types type,switch (attr) {case hwmon_temp_input: -if (tmp421->config &TMP421_CONFIG_RANGE ) - *val =temp_from_u16 (tmp421->temp[channel]); -else - *val =temp_from_s16 (tmp421->temp[channel]); + *val =temp_from_raw (tmp421->temp[channel], + tmp421->config &TMP421_CONFIG_RANGE );return 0 ;case hwmon_temp_fault:/*
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 101/172 net: enetc: fix the incorrect clearing of IF_MODE bits
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 325fd36ae76a6d089983b2d2eccb41237d35b221 ]
The enetc phylink .mac_config handler intends to clear the IFMODE field (bits 1:0) of the PM0_IF_MODE register, but incorrectly clears all the other fields instead.
For normal operation, the bug was inconsequential, due to the fact that we write the PM0_IF_MODE register in two stages, first in phylink .mac_config (which incorrectly cleared out a bunch of stuff), then we update the speed and duplex to the correct values in phylink .mac_link_up.
Judging by the code (not tested), it looks like maybe loopback mode was broken, since this is one of the settings in PM0_IF_MODE which is incorrectly cleared.
--- drivers/net/ethernet/freescale/enetc/enetc_pf.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/ethernet/freescale/enetc/enetc_pf.c +1 -2
@@ -541,8 +541,7 @@ static void enetc_mac_config(struct enetc_hw *hw, phy_interface_t phy_mode)if (phy_interface_mode_is_rgmii (phy_mode)) { val =enetc_port_rd (hw,ENETC_PM0_IF_MODE ); - val &= ~ENETC_PM0_IFM_EN_AUTO ; - val &=ENETC_PM0_IFM_IFMODE_MASK ; + val &= ~(ENETC_PM0_IFM_EN_AUTO |ENETC_PM0_IFM_IFMODE_MASK ); val |=ENETC_PM0_IFM_IFMODE_GMII |ENETC_PM0_IFM_RG ;enetc_port_wr (hw,ENETC_PM0_IF_MODE , val); }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 102/172 net: ipv4: Fix rtnexthop len when RTA_FLOW is present
In reply to Greg Kroah-HartmanFrom: Xiao Liang <[email protected]>
[ Upstream commit 597aa16c782496bf74c5dc3b45ff472ade6cee64 ]
Multipath RTA_FLOW is embedded in nexthop. Dump it in fib_add_nexthop() to get the length of rtnexthop correct.
--- include/net/ip_fib.h | 2 +- include/net/nexthop.h | 2 +- net/ipv4/fib_semantics.c | 16 +++++++++------- net/ipv6/route.c | 5 +++-- 4 files changed, 14 insertions(+), 11 deletions(-)
include/net/ip_fib.h +1 -1
@@ -597,5 +597,5 @@ int ip_valid_fib_dump_req(struct net *net, const struct nlmsghdr *nlh,int fib_nexthop_info (struct sk_buff *skb,const struct fib_nh_common *nh,u8 rt_family,unsigned char *flags,bool skip_oif);int fib_add_nexthop (struct sk_buff *skb,const struct fib_nh_common *nh, -int nh_weight,u8 rt_family); +int nh_weight,u8 rt_family,u32 nh_tclassid);#endif /* _NET_FIB_H */
include/net/nexthop.h +1 -1
@@ -325,7 +325,7 @@ int nexthop_mpath_fill_node(struct sk_buff *skb, struct nexthop *nh,struct fib_nh_common *nhc = &nhi->fib_nhc;int weight = nhg->nh_entries[i].weight; -if (fib_add_nexthop (skb, nhc, weight, rt_family) <0 ) +if (fib_add_nexthop (skb, nhc, weight, rt_family,0 ) <0 )return -EMSGSIZE ; }
net/ipv4/fib_semantics.c +9 -7
@@ -1663,7 +1663,7 @@ EXPORT_SYMBOL_GPL(fib_nexthop_info);#if IS_ENABLED (CONFIG_IP_ROUTE_MULTIPATH ) ||IS_ENABLED (CONFIG_IPV6 )int fib_add_nexthop (struct sk_buff *skb,const struct fib_nh_common *nhc, -int nh_weight,u8 rt_family) +int nh_weight,u8 rt_family,u32 nh_tclassid) {const struct net_device *dev = nhc->nhc_dev;struct rtnexthop *rtnh;
@@ -1681,6 +1681,9 @@ int fib_add_nexthop(struct sk_buff *skb, const struct fib_nh_common *nhc, rtnh->rtnh_flags = flags; +if (nh_tclassid &&nla_put_u32 (skb,RTA_FLOW , nh_tclassid)) + goto nla_put_failure; +/* length of rtnetlink header + attributes */ rtnh->rtnh_len =nlmsg_get_pos (skb) - (void *)rtnh;
@@ -1708,14 +1711,13 @@ static int fib_add_multipath(struct sk_buff *skb, struct fib_info *fi) }for_nexthops (fi) { -if (fib_add_nexthop (skb, &nh->nh_common, nh->fib_nh_weight, -AF_INET ) <0 ) - goto nla_put_failure; +u32 nh_tclassid =0 ;#ifdef CONFIG_IP_ROUTE_CLASSID -if (nh->nh_tclassid && -nla_put_u32 (skb,RTA_FLOW , nh->nh_tclassid)) - goto nla_put_failure; + nh_tclassid = nh->nh_tclassid;#endif +if (fib_add_nexthop (skb, &nh->nh_common, nh->fib_nh_weight, +AF_INET , nh_tclassid) <0 ) + goto nla_put_failure; }endfor_nexthops (fi); mp_end:
net/ipv6/route.c +3 -2
@@ -5700,14 +5700,15 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb, goto nla_put_failure;if (fib_add_nexthop (skb, &rt->fib6_nh->nh_common, - rt->fib6_nh->fib_nh_weight,AF_INET6 ) <0 ) + rt->fib6_nh->fib_nh_weight,AF_INET6 , +0 ) <0 ) goto nla_put_failure;list_for_each_entry_safe (sibling, next_sibling, &rt->fib6_siblings, fib6_siblings) {if (fib_add_nexthop (skb, &sibling->fib6_nh->nh_common, sibling->fib6_nh->fib_nh_weight, -AF_INET6 ) <0 ) +AF_INET6 ,0 ) <0 ) goto nla_put_failure; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 103/172 smsc95xx: fix stalled rx after link change
In reply to Greg Kroah-HartmanFrom: Aaro Koskinen <[email protected]>
[ Upstream commit 5ab8a447bcfee1ded709e7ff5dc7608ca9f66ae2 ]
After commit 05b35e7eb9a1 ("smsc95xx: add phylib support"), link changes are no longer propagated to usbnet. As a result, rx URB allocation won't happen until there is a packet sent out first (this might never happen, e.g. running just ssh server with a static IP). Fix by triggering usbnet EVENT_LINK_CHANGE.
--- drivers/net/usb/smsc95xx.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/usb/smsc95xx.c +3 -0
@@ -1178,7 +1178,10 @@ static void smsc95xx_unbind(struct usbnet *dev, struct usb_interface *intf)static void smsc95xx_handle_link_change (struct net_device *net) { +struct usbnet *dev =netdev_priv (net); +phy_print_status (net->phydev); +usbnet_defer_kevent (dev,EVENT_LINK_CHANGE ); }static int smsc95xx_start_phy (struct usbnet *dev)
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 104/172 drm/i915/request: fix early tracepoints
In reply to Greg Kroah-HartmanFrom: Matthew Auld <[email protected]>
[ Upstream commit c83ff0186401169eb27ce5057d820b7a863455c3 ]
Currently we blow up in trace_dma_fence_init, when calling into get_driver_name or get_timeline_name, since both the engine and context might be NULL(or contain some garbage address) in the case of newly allocated slab objects via the request ctor. Note that we also use SLAB_TYPESAFE_BY_RCU here, which allows requests to be immediately freed, but delay freeing the underlying page by an RCU grace period. With this scheme requests can be re-allocated, at the same time as they are also being read by some lockless RCU lookup mechanism.
In the ctor case, which is only called for new slab objects(i.e allocate new page and call the ctor for each object) it's safe to reset the context/engine prior to calling into dma_fence_init, since we can be certain that no one is doing an RCU lookup which might depend on peeking at the engine/context, like in active_engine(), since the object can't yet be externally visible.
In the recycled case(which might also be externally visible) the request refcount always transitions from 0->1 after we set the context/engine etc, which should ensure it's valid to dereference the engine for example, when doing an RCU list-walk, so long as we can also increment the refcount first. If the refcount is already zero, then the request is considered complete/released. If it's non-zero, then the request might be in the process of being re-allocated, or potentially still in flight, however after successfully incrementing the refcount, it's possible to carefully inspect the request state, to determine if the request is still what we were looking for. Note that all externally visible requests returned to the cache must have zero refcount.
One possible fix then is to move dma_fence_init out from the request ctor. Originally this was how it was done, but it was moved in:
commit 855e39e65cfc33a73724f1cc644ffc5754864a20
Author: Chris Wilson <[email protected]> Date: Mon Feb 3 09:41:48 2020 +0000
drm/i915: Initialise basic fence before acquiring seqno
where it looks like intel_timeline_get_seqno() relied on some of the rq->fence state, but that is no longer the case since:
commit 12ca695d2c1ed26b2dcbb528b42813bd0f216cfc
Author: Maarten Lankhorst <[email protected]> Date: Tue Mar 23 16:49:50 2021 +0100
drm/i915: Do not share hwsp across contexts any more, v8.
intel_timeline_get_seqno() could also be cleaned up slightly by dropping the request argument.
Moving dma_fence_init back out of the ctor, should ensure we have enough of the request initialised in case of trace_dma_fence_init. Functionally this should be the same, and is effectively what we were already open coding before, except now we also assign the fence->lock and fence->ops, but since these are invariant for recycled requests(which might be externally visible), and will therefore already hold the same value, it shouldn't matter.
An alternative fix, since we don't yet have a fully initialised request when in the ctor, is just setting the context/engine as NULL, but this does require adding some extra handling in get_driver_name etc.
v2(Daniel):
- Try to make the commit message less confusing
--- drivers/gpu/drm/i915/i915_request.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-)
drivers/gpu/drm/i915/i915_request.c +2 -9
@@ -914,8 +914,6 @@ static void __i915_request_ctor(void *arg)i915_sw_fence_init (&rq->submit, submit_notify);i915_sw_fence_init (&rq->semaphore, semaphore_notify); -dma_fence_init (&rq->fence, &i915_fence_ops, &rq->lock,0 ,0 ); - rq->capture_list =NULL ;init_llist_head (&rq->execute_cb);
@@ -978,17 +976,12 @@ __i915_request_create(struct intel_context *ce, gfp_t gfp) rq->ring = ce->ring; rq->execution_mask = ce->engine->mask; -kref_init (&rq->fence.refcount); - rq->fence.flags =0 ; - rq->fence.error =0 ; -INIT_LIST_HEAD (&rq->fence.cb_list); - ret =intel_timeline_get_seqno (tl, rq, &seqno);if (ret) goto err_free; - rq->fence.context = tl->fence_context; - rq->fence.seqno = seqno; +dma_fence_init (&rq->fence, &i915_fence_ops, &rq->lock, + tl->fence_context, seqno);RCU_INIT_POINTER (rq->timeline, tl); rq->hwsp_seqno = tl->hwsp_seqno;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 105/172 drm/i915: Remove warning from the rps worker
In reply to Greg Kroah-HartmanFrom: Tejas Upadhyay <[email protected]>
[ Upstream commit 4b8bcaf8a6d6ab5db51e30865def5cb694eb2966 ]
In commit 4e5c8a99e1cb ("drm/i915: Drop i915_request.lock requirement for intel_rps_boost()"), we decoupled the rps worker from the pm so that we could avoid the synchronization penalty which makes the assertion liable to run too early. Which makes warning invalid hence removed.
--- drivers/gpu/drm/i915/gt/intel_rps.c | 2 -- 1 file changed, 2 deletions(-)
drivers/gpu/drm/i915/gt/intel_rps.c +0 -2
@@ -861,8 +861,6 @@ void intel_rps_park(struct intel_rps *rps) {int adj; -GEM_BUG_ON (atomic_read (&rps->num_waiters)); -if (!intel_rps_clear_active (rps))return ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 106/172 dsa: mv88e6xxx: 6161: Use chip wide MAX MTU
In reply to Greg Kroah-HartmanFrom: Andrew Lunn <[email protected]>
[ Upstream commit fe23036192c95b66e60d019d2ec1814d0d561ffd ]
The datasheets suggests the 6161 uses a per port setting for jumbo frames. Testing has however shown this is not correct, it uses the old style chip wide MTU control. Change the ops in the 6161 structure to reflect this.
Reported by: 曹煜 <[email protected]>
--- drivers/net/dsa/mv88e6xxx/chip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/mv88e6xxx/chip.c +1 -1
@@ -3657,7 +3657,6 @@ static const struct mv88e6xxx_ops mv88e6161_ops = { .port_set_ucast_flood = mv88e6352_port_set_ucast_flood, .port_set_mcast_flood = mv88e6352_port_set_mcast_flood, .port_set_ether_type = mv88e6351_port_set_ether_type, - .port_set_jumbo_size = mv88e6165_port_set_jumbo_size, .port_egress_rate_limiting = mv88e6097_port_egress_rate_limiting, .port_pause_limit = mv88e6097_port_pause_limit, .port_disable_learn_limit = mv88e6xxx_port_disable_learn_limit,
@@ -3682,6 +3681,7 @@ static const struct mv88e6xxx_ops mv88e6161_ops = { .avb_ops = &mv88e6165_avb_ops, .ptp_ops = &mv88e6165_ptp_ops, .phylink_validate = mv88e6185_phylink_validate, + .set_max_frame_size = mv88e6185_g1_set_max_frame_size, };static const struct mv88e6xxx_ops mv88e6165_ops = {
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 107/172 dsa: mv88e6xxx: Fix MTU definition
In reply to Greg Kroah-HartmanFrom: Andrew Lunn <[email protected]>
[ Upstream commit b92ce2f54c0f0ff781e914ec189c25f7bf1b1ec2 ]
The MTU passed to the DSA driver is the payload size, typically 1500. However, the switch uses the frame size when applying restrictions. Adjust the MTU with the size of the Ethernet header and the frame checksum. The VLAN header also needs to be included when the frame size it per port, but not when it is global.
Reported by: 曹煜 <[email protected]>
--- drivers/net/dsa/mv88e6xxx/chip.c | 12 ++++++------ drivers/net/dsa/mv88e6xxx/global1.c | 2 ++ drivers/net/dsa/mv88e6xxx/port.c | 2 ++ 3 files changed, 10 insertions(+), 6 deletions(-)
drivers/net/dsa/mv88e6xxx/chip.c +6 -6
@@ -2775,8 +2775,8 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)if (err)return err; -/* Port Control 2: don't force a good FCS, set the maximum frame size to -* 10240 bytes, disable 802.1q tags checking, don't discard tagged or +/* Port Control 2: don't force a good FCS, set the MTU size to +* 10222 bytes, disable 802.1q tags checking, don't discard tagged or * untagged frames on this port, do a destination address lookup on all * received packets as usual, disable ARP mirroring and don't send a * copy of all transmitted/received frames on this port to the CPU.
@@ -2795,7 +2795,7 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)return err;if (chip->info->ops->port_set_jumbo_size) { - err = chip->info->ops->port_set_jumbo_size (chip, port,10240 ); + err = chip->info->ops->port_set_jumbo_size (chip, port,10218 );if (err)return err; }
@@ -2885,10 +2885,10 @@ static int mv88e6xxx_get_max_mtu(struct dsa_switch *ds, int port)struct mv88e6xxx_chip *chip = ds->priv;if (chip->info->ops->port_set_jumbo_size) -return 10240 ; +return 10240 -VLAN_ETH_HLEN -ETH_FCS_LEN ;else if (chip->info->ops->set_max_frame_size) -return 1632 ; -return 1522 ; +return 1632 -VLAN_ETH_HLEN -ETH_FCS_LEN ; +return 1522 -VLAN_ETH_HLEN -ETH_FCS_LEN ; }static int mv88e6xxx_change_mtu (struct dsa_switch *ds,int port,int new_mtu)
drivers/net/dsa/mv88e6xxx/global1.c +2 -0
@@ -232,6 +232,8 @@ int mv88e6185_g1_set_max_frame_size(struct mv88e6xxx_chip *chip, int mtu)u16 val;int err; + mtu +=ETH_HLEN +ETH_FCS_LEN ; + err =mv88e6xxx_g1_read (chip,MV88E6XXX_G1_CTL1 , &val);if (err)return err;
drivers/net/dsa/mv88e6xxx/port.c +2 -0
@@ -1277,6 +1277,8 @@ int mv88e6165_port_set_jumbo_size(struct mv88e6xxx_chip *chip, int port,u16 reg;int err; + size +=VLAN_ETH_HLEN +ETH_FCS_LEN ; + err =mv88e6xxx_port_read (chip, port,MV88E6XXX_PORT_CTL2 , ®);if (err)return err;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 108/172 dsa: mv88e6xxx: Include tagger overhead when setting MTU for DSA and CPU ports
In reply to Greg Kroah-HartmanFrom: Andrew Lunn <[email protected]>
[ Upstream commit b9c587fed61cf88bd45822c3159644445f6d5aa6 ]
Same members of the Marvell Ethernet switches impose MTU restrictions on ports used for connecting to the CPU or another switch for DSA. If the MTU is set too low, tagged frames will be discarded. Ensure the worst case tagger overhead is included in setting the MTU for DSA and CPU ports.
Reported by: 曹煜 <[email protected]>
--- drivers/net/dsa/mv88e6xxx/chip.c | 9 ++++++--- drivers/net/dsa/mv88e6xxx/chip.h | 1 + 2 files changed, 7 insertions(+), 3 deletions(-)
drivers/net/dsa/mv88e6xxx/chip.c +6 -3
@@ -2885,10 +2885,10 @@ static int mv88e6xxx_get_max_mtu(struct dsa_switch *ds, int port)struct mv88e6xxx_chip *chip = ds->priv;if (chip->info->ops->port_set_jumbo_size) -return 10240 -VLAN_ETH_HLEN -ETH_FCS_LEN ; +return 10240 -VLAN_ETH_HLEN -EDSA_HLEN -ETH_FCS_LEN ;else if (chip->info->ops->set_max_frame_size) -return 1632 -VLAN_ETH_HLEN -ETH_FCS_LEN ; -return 1522 -VLAN_ETH_HLEN -ETH_FCS_LEN ; +return 1632 -VLAN_ETH_HLEN -EDSA_HLEN -ETH_FCS_LEN ; +return 1522 -VLAN_ETH_HLEN -EDSA_HLEN -ETH_FCS_LEN ; }static int mv88e6xxx_change_mtu (struct dsa_switch *ds,int port,int new_mtu)
@@ -2896,6 +2896,9 @@ static int mv88e6xxx_change_mtu(struct dsa_switch *ds, int port, int new_mtu)struct mv88e6xxx_chip *chip = ds->priv;int ret =0 ; +if (dsa_is_dsa_port (ds, port) ||dsa_is_cpu_port (ds, port)) + new_mtu +=EDSA_HLEN ; +mv88e6xxx_reg_lock (chip);if (chip->info->ops->port_set_jumbo_size) ret = chip->info->ops->port_set_jumbo_size (chip, port, new_mtu);
drivers/net/dsa/mv88e6xxx/chip.h +1 -0
@@ -18,6 +18,7 @@#include <linux/timecounter.h> #include <net/dsa.h> +#define EDSA_HLEN 8#define MV88E6XXX_N_FID 4096/* PVT limits for 4-bit port and 5-bit switch */
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 109/172 e100: fix length calculation in e100_get_regs_len
In reply to Greg Kroah-HartmanFrom: Jacob Keller <[email protected]>
[ Upstream commit 4329c8dc110b25d5f04ed20c6821bb60deff279f ]
commit abf9b902059f ("e100: cleanup unneeded math") tried to simplify e100_get_regs_len and remove a double 'divide and then multiply' calculation that the e100_reg_regs_len function did.
This change broke the size calculation entirely as it failed to account for the fact that the numbered registers are actually 4 bytes wide and not 1 byte. This resulted in a significant under allocation of the register buffer used by e100_get_regs.
Fix this by properly multiplying the register count by u32 first before adding the size of the dump buffer.
--- drivers/net/ethernet/intel/e100.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/e100.c +5 -1
@@ -2441,7 +2441,11 @@ static void e100_get_drvinfo(struct net_device *netdev,static int e100_get_regs_len (struct net_device *netdev) {struct nic *nic =netdev_priv (netdev); -return 1 +E100_PHY_REGS +sizeof (nic->mem->dump_buf); + +/* We know the number of registers, and the size of the dump buffer. +* Calculate the total size in bytes. +*/ +return (1 +E100_PHY_REGS ) *sizeof (u32) +sizeof (nic->mem->dump_buf); } static void e100_get_regs(struct net_device *netdev,
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 110/172 e100: fix buffer overrun in e100_get_regs
In reply to Greg Kroah-HartmanFrom: Jacob Keller <[email protected]>
[ Upstream commit 51032e6f17ce990d06123ad7307f258c50d25aa7 ]
The e100_get_regs function is used to implement a simple register dump for the e100 device. The data is broken into a couple of MAC control registers, and then a series of PHY registers, followed by a memory dump buffer.
The total length of the register dump is defined as (1 + E100_PHY_REGS)
* sizeof(u32) + sizeof(nic->mem->dump_buf).
The logic for filling in the PHY registers uses a convoluted inverted count for loop which counts from E100_PHY_REGS (0x1C) down to 0, and assigns the slots 1 + E100_PHY_REGS - i. The first loop iteration will fill in [1] and the final loop iteration will fill in [1 + 0x1C]. This is actually one more than the supposed number of PHY registers.
The memory dump buffer is then filled into the space at
[2 + E100_PHY_REGS] which will cause that memcpy to assign 4 bytes past the total size.
The end result is that we overrun the total buffer size allocated by the kernel, which could lead to a panic or other issues due to memory corruption.
It is difficult to determine the actual total number of registers here. The only 8255x datasheet I could find indicates there are 28 total MDI registers. However, we're reading 29 here, and reading them in reverse!
In addition, the ethtool e100 register dump interface appears to read the first PHY register to determine if the device is in MDI or MDIx mode. This doesn't appear to be documented anywhere within the 8255x datasheet. I can only assume it must be in register 28 (the extra register we're reading here).
Lets not change any of the intended meaning of what we copy here. Just extend the space by 4 bytes to account for the extra register and continue copying the data out in the same order.
Change the E100_PHY_REGS value to be the correct total (29) so that the total register dump size is calculated properly. Fix the offset for where we copy the dump buffer so that it doesn't overrun the total size.
Re-write the for loop to use counting up instead of the convoluted down-counting. Correct the mdio_read offset to use the 0-based register offsets, but maintain the bizarre reverse ordering so that we have the ABI expected by applications like ethtool. This requires and additional subtraction of 1. It seems a bit odd but it makes the flow of assignment into the register buffer easier to follow.
--- drivers/net/ethernet/intel/e100.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
drivers/net/ethernet/intel/e100.c +10 -6
@@ -2437,7 +2437,7 @@ static void e100_get_drvinfo(struct net_device *netdev, sizeof(info->bus_info)); } -#define E100_PHY_REGS 0x1C +#define E100_PHY_REGS 0x1Dstatic int e100_get_regs_len (struct net_device *netdev) {struct nic *nic =netdev_priv (netdev);
@@ -2459,14 +2459,18 @@ static void e100_get_regs(struct net_device *netdev, buff[0 ] =ioread8 (&nic->csr->scb.cmd_hi) <<24 |ioread8 (&nic->csr->scb.cmd_lo) <<16 |ioread16 (&nic->csr->scb.status); -for (i =E100_PHY_REGS ; i >=0 ; i--) - buff[1 +E100_PHY_REGS - i] = -mdio_read (netdev, nic->mii.phy_id, i); +for (i =0 ; i <E100_PHY_REGS ; i++) +/* Note that we read the registers in reverse order. This +* ordering is the ABI apparently used by ethtool and other +* applications. +*/ + buff[1 + i] =mdio_read (netdev, nic->mii.phy_id, +E100_PHY_REGS -1 - i);memset (nic->mem->dump_buf,0 ,sizeof (nic->mem->dump_buf));e100_exec_cb (nic,NULL , e100_dump);msleep (10 ); -memcpy (&buff[2 +E100_PHY_REGS ], nic->mem->dump_buf, -sizeof (nic->mem->dump_buf)); +memcpy (&buff[1 +E100_PHY_REGS ], nic->mem->dump_buf, +sizeof (nic->mem->dump_buf)); }static void e100_get_wol (struct net_device *netdev,struct ethtool_wolinfo *wol)
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 111/172 RDMA/hfi1: Fix kernel pointer leak
In reply to Greg Kroah-HartmanFrom: Guo Zhi <[email protected]>
[ Upstream commit 7d5cfafe8b4006a75b55c2f1fdfdb363f9a5cc98 ]
Pointers should be printed with %p or %px rather than cast to 'unsigned long long' and printed with %llx. Change %llx to %p to print the secured pointer.
--- drivers/infiniband/hw/hfi1/ipoib_tx.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/infiniband/hw/hfi1/ipoib_tx.c +4 -4
@@ -873,14 +873,14 @@ void hfi1_ipoib_tx_timeout(struct net_device *dev, unsigned int q)struct hfi1_ipoib_txq *txq = &priv->txqs[q];u64 completed =atomic64_read (&txq->complete_txreqs); -dd_dev_info (priv->dd,"timeout txq %llx q %u stopped %u stops %d no_desc %d ring_full %d\n" , - (unsigned long long )txq, q, +dd_dev_info (priv->dd,"timeout txq %p q %u stopped %u stops %d no_desc %d ring_full %d\n" , + txq, q,__netif_subqueue_stopped (dev, txq->q_idx),atomic_read (&txq->stops),atomic_read (&txq->no_desc),atomic_read (&txq->ring_full)); -dd_dev_info (priv->dd,"sde %llx engine %u\n" , - (unsigned long long )txq->sde, +dd_dev_info (priv->dd,"sde %p engine %u\n" , + txq->sde, txq->sde ? txq->sde->this_idx :0 );dd_dev_info (priv->dd,"flow %x\n" , txq->flow.as_int); dd_dev_info(priv->dd, "sent %llu completed %llu used %llu\n",
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 112/172 RDMA/hns: Fix the size setting error when copying CQE in clean_cq()
In reply to Greg Kroah-HartmanFrom: Wenpeng Liang <[email protected]>
[ Upstream commit cc26aee100588a3f293921342a307b6309ace193 ]
The size of CQE is different for different versions of hardware, so the driver needs to specify the size of CQE explicitly.
--- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/hns/hns_roce_hw_v2.c +1 -1
@@ -3306,7 +3306,7 @@ static void __hns_roce_v2_cq_clean(struct hns_roce_cq *hr_cq, u32 qpn, dest =get_cqe_v2 (hr_cq, (prod_index + nfreed) & hr_cq->ib_cq.cqe); owner_bit =hr_reg_read (dest,CQE_OWNER ); -memcpy (dest, cqe,sizeof (*cqe)); +memcpy (dest, cqe, hr_cq->cqe_size);hr_reg_write (dest,CQE_OWNER , owner_bit); } }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 113/172 RDMA/hns: Add the check of the CQE size of the user space
In reply to Greg Kroah-HartmanFrom: Wenpeng Liang <[email protected]>
[ Upstream commit e671f0ecfece14940a9bb81981098910ea278cf7 ]
If the CQE size of the user space is not the size supported by the hardware, the creation of CQ should be stopped.
--- drivers/infiniband/hw/hns/hns_roce_cq.c | 31 ++++++++++++++++++------- 1 file changed, 22 insertions(+), 9 deletions(-)
drivers/infiniband/hw/hns/hns_roce_cq.c +22 -9
@@ -326,19 +326,30 @@ static void set_cq_param(struct hns_roce_cq *hr_cq, u32 cq_entries, int vector,INIT_LIST_HEAD (&hr_cq->rq_list); } -static void set_cqe_size (struct hns_roce_cq *hr_cq,struct ib_udata *udata, -struct hns_roce_ib_create_cq *ucmd) +static int set_cqe_size (struct hns_roce_cq *hr_cq,struct ib_udata *udata, +struct hns_roce_ib_create_cq *ucmd) {struct hns_roce_dev *hr_dev =to_hr_dev (hr_cq->ib_cq.device); -if (udata) { -if (udata->inlen >=offsetofend (typeof (*ucmd), cqe_size)) - hr_cq->cqe_size = ucmd->cqe_size; -else - hr_cq->cqe_size =HNS_ROCE_V2_CQE_SIZE ; - }else { +if (!udata) { hr_cq->cqe_size = hr_dev->caps.cqe_sz; +return 0 ; + } + +if (udata->inlen >=offsetofend (typeof (*ucmd), cqe_size)) { +if (ucmd->cqe_size !=HNS_ROCE_V2_CQE_SIZE && + ucmd->cqe_size !=HNS_ROCE_V3_CQE_SIZE ) { +ibdev_err (&hr_dev->ib_dev, +"invalid cqe size %u.\n" , ucmd->cqe_size); +return -EINVAL ; + } + + hr_cq->cqe_size = ucmd->cqe_size; + }else { + hr_cq->cqe_size =HNS_ROCE_V2_CQE_SIZE ; } + +return 0 ; } int hns_roce_create_cq(struct ib_cq *ib_cq, const struct ib_cq_init_attr *attr,
@@ -366,7 +377,9 @@ int hns_roce_create_cq(struct ib_cq *ib_cq, const struct ib_cq_init_attr *attr,set_cq_param (hr_cq, attr->cqe, attr->comp_vector, &ucmd); -set_cqe_size (hr_cq, udata, &ucmd); + ret =set_cqe_size (hr_cq, udata, &ucmd); +if (ret) +return ret; ret =alloc_cq_buf (hr_dev, hr_cq, udata, ucmd.buf_addr);if (ret) {
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 114/172 bpf: Exempt CAP_BPF from checks against bpf_jit_limit
In reply to Greg Kroah-HartmanFrom: Lorenz Bauer <[email protected]>
[ Upstream commit 8a98ae12fbefdb583a7696de719a1d57e5e940a2 ]
When introducing CAP_BPF, bpf_jit_charge_modmem() was not changed to treat programs with CAP_BPF as privileged for the purpose of JIT memory allocation. This means that a program without CAP_BPF can block a program with CAP_BPF from loading a program.
Fix this by checking bpf_capable() in bpf_jit_charge_modmem().
--- kernel/bpf/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/bpf/core.c +1 -1
@@ -827,7 +827,7 @@ int bpf_jit_charge_modmem(u32 pages) {if (atomic_long_add_return (pages, &bpf_jit_current) > (bpf_jit_limit >>PAGE_SHIFT )) { -if (!capable (CAP_SYS_ADMIN )) { +if (!bpf_capable ()) {atomic_long_sub (pages, &bpf_jit_current);return -EPERM ; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 115/172 libbpf: Fix segfault in static linker for objects without BTF
In reply to Greg Kroah-HartmanFrom: Kumar Kartikeya Dwivedi <[email protected]>
[ Upstream commit bcfd367c2839f2126c048fe59700ec1b538e2b06 ]
When a BPF object is compiled without BTF info (without -g), trying to link such objects using bpftool causes a SIGSEGV due to btf__get_nr_types accessing obj->btf which is NULL. Fix this by checking for the NULL pointer, and return error.
Reproducer:
$ cat a.bpf.c
extern int foo(void);
int bar(void) { return foo(); }
$ cat b.bpf.c
int foo(void) { return 0; }
$ clang -O2 -target bpf -c a.bpf.c
$ clang -O2 -target bpf -c b.bpf.c
$ bpftool gen obj out a.bpf.o b.bpf.o
Segmentation fault (core dumped)After fix:
$ bpftool gen obj out a.bpf.o b.bpf.o libbpf: failed to find BTF info for object 'a.bpf.o' Error: failed to link 'a.bpf.o': Unknown error -22 (-22)
--- tools/lib/bpf/linker.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
tools/lib/bpf/linker.c +7 -1
@@ -1649,11 +1649,17 @@ static bool btf_is_non_static(const struct btf_type *t)static int find_glob_sym_btf (struct src_obj *obj,Elf64_Sym *sym,const char *sym_name,int *out_btf_sec_id,int *out_btf_id) { -int i, j, n =btf__get_nr_types (obj->btf), m, btf_id =0 ; +int i, j, n, m, btf_id =0 ;const struct btf_type *t;const struct btf_var_secinfo *vi;const char *name; +if (!obj->btf) { +pr_warn ("failed to find BTF info for object '%s'\n" , obj->filename); +return -EINVAL ; + } + + n =btf__get_nr_types (obj->btf);for (i =1 ; i <= n; i++) { t =btf__type_by_id (obj->btf, i);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 116/172 selftests, bpf: Fix makefile dependencies on libbpf
In reply to Greg Kroah-HartmanFrom: Jiri Benc <[email protected]>
[ Upstream commit d888eaac4fb1df30320bb1305a8f78efe86524c6 ]
When building bpf selftest with make -j, I'm randomly getting build failures such as this one:
In file included from progs/bpf_flow.c:19:
[...]/tools/testing/selftests/bpf/tools/include/bpf/bpf_helpers.h:11:10: fatal error: 'bpf_helper_defs.h' file not found
#include "bpf_helper_defs.h"
^~~~~~~~~~~~~~~~~~~The file that fails the build varies between runs but it's always in the progs/ subdir.
The reason is a missing make dependency on libbpf for the .o files in progs/. There was a dependency before commit 3ac2e20fba07e but that commit removed it to prevent unneeded rebuilds. However, that only works if libbpf has been built already; the 'wildcard' prerequisite does not trigger when there's no bpf_helper_defs.h generated yet.
Keep the libbpf as an order-only prerequisite to satisfy both goals. It is always built before the progs/ objects but it does not trigger unnecessary rebuilds by itself.
--- tools/testing/selftests/bpf/Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/testing/selftests/bpf/Makefile +2 -1
@@ -374,7 +374,8 @@ $(TRUNNER_BPF_OBJS): $(TRUNNER_OUTPUT)/%.o: \ $(TRUNNER_BPF_PROGS_DIR)/%.c \ $(TRUNNER_BPF_PROGS_DIR)/*.h \ $$(INCLUDE_DIR)/vmlinux.h \ - $(wildcard $(BPFDIR)/bpf_*.h) | $(TRUNNER_OUTPUT) + $(wildcard $(BPFDIR)/bpf_*.h) \ + | $(TRUNNER_OUTPUT) $$(BPFOBJ) $$(call $(TRUNNER_BPF_BUILD_RULE),$$<,$$@, \ $(TRUNNER_BPF_CFLAGS))
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 117/172 selftests, bpf: test_lwt_ip_encap: Really disable rp_filter
In reply to Greg Kroah-HartmanFrom: Jiri Benc <[email protected]>
[ Upstream commit 79e2c306667542b8ee2d9a9d947eadc7039f0a3c ]
It's not enough to set net.ipv4.conf.all.rp_filter=0, that does not override a greater rp_filter value on the individual interfaces. We also need to set net.ipv4.conf.default.rp_filter=0 before creating the interfaces. That way, they'll also get their own rp_filter value of zero.
--- tools/testing/selftests/bpf/test_lwt_ip_encap.sh | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
tools/testing/selftests/bpf/test_lwt_ip_encap.sh +8 -5
@@ -112,6 +112,14 @@ setup() ip netns add "${NS2}" ip netns add "${NS3}" + # rp_filter gets confused by what these tests are doing, so disable it + ip netns exec ${NS1} sysctl -wq net.ipv4.conf.all.rp_filter=0 + ip netns exec ${NS2} sysctl -wq net.ipv4.conf.all.rp_filter=0 + ip netns exec ${NS3} sysctl -wq net.ipv4.conf.all.rp_filter=0 + ip netns exec ${NS1} sysctl -wq net.ipv4.conf.default.rp_filter=0 + ip netns exec ${NS2} sysctl -wq net.ipv4.conf.default.rp_filter=0 + ip netns exec ${NS3} sysctl -wq net.ipv4.conf.default.rp_filter=0 + ip link add veth1 type veth peer name veth2 ip link add veth3 type veth peer name veth4 ip link add veth5 type veth peer name veth6
@@ -236,11 +244,6 @@ setup() ip -netns ${NS1} -6 route add ${IPv6_GRE}/128 dev veth5 via ${IPv6_6} ${VRF} ip -netns ${NS2} -6 route add ${IPv6_GRE}/128 dev veth7 via ${IPv6_8} ${VRF} - # rp_filter gets confused by what these tests are doing, so disable it - ip netns exec ${NS1} sysctl -wq net.ipv4.conf.all.rp_filter=0 - ip netns exec ${NS2} sysctl -wq net.ipv4.conf.all.rp_filter=0 - ip netns exec ${NS3} sysctl -wq net.ipv4.conf.all.rp_filter=0 - TMPFILE=$(mktemp /tmp/test_lwt_ip_encap.XXXXXX) sleep 1 # reduce flakiness
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 118/172 bpf, x86: Fix bpf mapping of atomic fetch implementation
In reply to Greg Kroah-HartmanFrom: Johan Almbladh <[email protected]>
[ Upstream commit ced185824c89b60e65b5a2606954c098320cdfb8 ]
Fix the case where the dst register maps to %rax as otherwise this produces an incorrect mapping with the implementation in 981f94c3e921 ("bpf: Add bitwise atomic instructions") as %rax is clobbered given it's part of the cmpxchg as operand.
The issue is similar to b29dd96b905f ("bpf, x86: Fix BPF_FETCH atomic and/or/ xor with r0 as src") just that the case of dst register was missed.
Before, dst=r0 (%rax) src=r2 (%rsi):
[...]
c5: mov %rax,%r10
c8: mov 0x0(%rax),%rax <---+ (broken)
cc: mov %rax,%r11 |
cf: and %rsi,%r11 |
d2: lock cmpxchg %r11,0x0(%rax) <---+
d8: jne 0x00000000000000c8 |
da: mov %rax,%rsi |
dd: mov %r10,%rax |
[...] |
|
After, dst=r0 (%rax) src=r2 (%rsi): |
|
[...] |
da: mov %rax,%r10 |
dd: mov 0x0(%r10),%rax <---+ (fixed)
e1: mov %rax,%r11 |
e4: and %rsi,%r11 |
e7: lock cmpxchg %r11,0x0(%r10) <---+
ed: jne 0x00000000000000dd
ef: mov %rax,%rsi
f2: mov %r10,%rax[...]
The remaining combinations were fine as-is though:
After, dst=r9 (%r15) src=r0 (%rax):
[...]
dc: mov %rax,%r10 df: mov 0x0(%r15),%rax e3: mov %rax,%r11 e6: and %r10,%r11 e9: lock cmpxchg %r11,0x0(%r15) ef: jne 0x00000000000000df _ f1: mov %rax,%r10 | (unneeded, but f4: mov %r10,%rax _| not a problem)
[...]
After, dst=r9 (%r15) src=r4 (%rcx):
[...]
de: mov %rax,%r10 e1: mov 0x0(%r15),%rax e5: mov %rax,%r11 e8: and %rcx,%r11 eb: lock cmpxchg %r11,0x0(%r15) f1: jne 0x00000000000000e1 f3: mov %rax,%rcx f6: mov %r10,%rax
[...]
The case of dst == src register is rejected by the verifier and therefore not supported, but x86 JIT also handles this case just fine.
After, dst=r0 (%rax) src=r0 (%rax):
[...]
eb: mov %rax,%r10 ee: mov 0x0(%r10),%rax f2: mov %rax,%r11 f5: and %r10,%r11 f8: lock cmpxchg %r11,0x0(%r10) fe: jne 0x00000000000000ee 100: mov %rax,%r10 103: mov %r10,%rax
[...]
--- arch/x86/net/bpf_jit_comp.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
arch/x86/net/bpf_jit_comp.c +8 -5
@@ -1341,9 +1341,10 @@ st: if (is_imm8(insn->off))if (insn->imm == (BPF_AND |BPF_FETCH ) || insn->imm == (BPF_OR |BPF_FETCH ) || insn->imm == (BPF_XOR |BPF_FETCH )) { -u8 *branch_target;bool is64 =BPF_SIZE (insn->code) ==BPF_DW ;u32 real_src_reg = src_reg; +u32 real_dst_reg = dst_reg; +u8 *branch_target;/* * Can't be implemented with a single x86 insn.
@@ -1354,11 +1355,13 @@ st: if (is_imm8(insn->off))emit_mov_reg (&prog, true,BPF_REG_AX ,BPF_REG_0 );if (src_reg ==BPF_REG_0 ) real_src_reg =BPF_REG_AX ; +if (dst_reg ==BPF_REG_0 ) + real_dst_reg =BPF_REG_AX ; branch_target = prog;/* Load old value */ emit_ldx (&prog,BPF_SIZE (insn->code), -BPF_REG_0 , dst_reg, insn->off); +BPF_REG_0 , real_dst_reg, insn->off);/* * Perform the (commutative) operation locally, * put the result in the AUX_REG.
@@ -1369,7 +1372,8 @@ st: if (is_imm8(insn->off)) add_2reg(0xC0, AUX_REG, real_src_reg));/* Attempt to swap in new value */ err =emit_atomic (&prog,BPF_CMPXCHG , - dst_reg,AUX_REG , insn->off, + real_dst_reg,AUX_REG , + insn->off,BPF_SIZE (insn->code));if (WARN_ON (err))return err;
@@ -1383,11 +1387,10 @@ st: if (is_imm8(insn->off))/* Restore R0 after clobbering RAX */ emit_mov_reg (&prog, true,BPF_REG_0 ,BPF_REG_AX );break ; - } err =emit_atomic (&prog, insn->imm, dst_reg, src_reg, - insn->off,BPF_SIZE (insn->code)); + insn->off,BPF_SIZE (insn->code));if (err)return err;break ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 119/172 net: ks8851: fix link error
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 51bb08dd04a05035a64504faa47651d36b0f3125 ]
An object file cannot be built for both loadable module and built-in use at the same time:
arm-linux-gnueabi-ld: drivers/net/ethernet/micrel/ks8851_common.o: in function `ks8851_probe_common':
ks8851_common.c:(.text+0xf80): undefined reference to `__this_module'
Change the ks8851_common code to be a standalone module instead, and use Makefile logic to ensure this is built-in if at least one of its two users is.
--- drivers/net/ethernet/micrel/Makefile | 6 ++---- drivers/net/ethernet/micrel/ks8851_common.c | 8 ++++++++ 2 files changed, 10 insertions(+), 4 deletions(-)
drivers/net/ethernet/micrel/Makefile +2 -4
@@ -4,8 +4,6 @@ # obj-$(CONFIG_KS8842) += ks8842.o -obj-$(CONFIG_KS8851) += ks8851.o -ks8851-objs = ks8851_common.o ks8851_spi.o -obj-$(CONFIG_KS8851_MLL) += ks8851_mll.o -ks8851_mll-objs = ks8851_common.o ks8851_par.o +obj-$(CONFIG_KS8851) += ks8851_common.o ks8851_spi.o +obj-$(CONFIG_KS8851_MLL) += ks8851_common.o ks8851_par.o obj-$(CONFIG_KSZ884X_PCI) += ksz884x.o
drivers/net/ethernet/micrel/ks8851_common.c +8 -0
@@ -1057,6 +1057,7 @@ int ks8851_suspend(struct device *dev)return 0 ; } +EXPORT_SYMBOL_GPL (ks8851_suspend);int ks8851_resume (struct device *dev) {
@@ -1070,6 +1071,7 @@ int ks8851_resume(struct device *dev) return 0; } +EXPORT_SYMBOL_GPL (ks8851_resume);#endif static int ks8851_register_mdiobus (struct ks8851_net *ks,struct device *dev)
@@ -1243,6 +1245,7 @@ int ks8851_probe_common(struct net_device *netdev, struct device *dev, err_reg_io:return ret; } +EXPORT_SYMBOL_GPL (ks8851_probe_common);int ks8851_remove_common (struct device *dev) {
@@ -1261,3 +1264,8 @@ int ks8851_remove_common(struct device *dev)return 0 ; } +EXPORT_SYMBOL_GPL (ks8851_remove_common); + +MODULE_DESCRIPTION ("KS8851 Network driver" ); +MODULE_AUTHOR ("Ben Dooks <[email protected]>" ); +MODULE_LICENSE ("GPL" );
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 120/172 ionic: fix gathering of debug stats
In reply to Greg Kroah-HartmanFrom: Shannon Nelson <[email protected]>
[ Upstream commit c23bb54f28d61a48008428e8cd320c947993919b ]
Don't print stats for which we haven't reserved space as it can cause nasty memory bashing and related bad behaviors.
--- drivers/net/ethernet/pensando/ionic/ionic_stats.c | 9 --------- 1 file changed, 9 deletions(-)
drivers/net/ethernet/pensando/ionic/ionic_stats.c +0 -9
@@ -380,15 +380,6 @@ static void ionic_sw_stats_get_txq_values(struct ionic_lif *lif, u64 **buf, &ionic_dbg_intr_stats_desc[i]); (*buf)++; } -for (i =0 ; i <IONIC_NUM_DBG_NAPI_STATS ; i++) { - **buf =IONIC_READ_STAT64 (&txqcq->napi_stats, - &ionic_dbg_napi_stats_desc[i]); - (*buf)++; - } -for (i =0 ; i <IONIC_MAX_NUM_NAPI_CNTR ; i++) { - **buf = txqcq->napi_stats.work_done_cntr[i]; - (*buf)++; - }for (i =0 ; i <IONIC_MAX_NUM_SG_CNTR ; i++) { **buf = txstats->sg_cntr[i]; (*buf)++;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 121/172 Revert "block, bfq: honor already-setup queue merges"
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
[ Upstream commit ebc69e897e17373fbe1daaff1debaa77583a5284 ]
This reverts commit 2d52c58b9c9bdae0ca3df6a1eab5745ab3f7d80b.
We have had several folks complain that this causes hangs for them, which is especially problematic as the commit has also hit stable already.
As no resolution seems to be forthcoming right now, revert the patch.
--- block/bfq-iosched.c | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-)
block/bfq-iosched.c +3 -13
@@ -2662,15 +2662,6 @@ bfq_setup_merge(struct bfq_queue *bfqq, struct bfq_queue *new_bfqq)* are likely to increase the throughput. */ bfqq->new_bfqq = new_bfqq; -/* -* The above assignment schedules the following redirections: -* each time some I/O for bfqq arrives, the process that -* generated that I/O is disassociated from bfqq and -* associated with new_bfqq. Here we increases new_bfqq->ref -* in advance, adding the number of processes that are -* expected to be associated with new_bfqq as they happen to -* issue I/O. -*/ new_bfqq->ref += process_refs;return new_bfqq; }
@@ -2733,10 +2724,6 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq, {struct bfq_queue *in_service_bfqq, *new_bfqq; -/* if a merge has already been setup, then proceed with that first */ -if (bfqq->new_bfqq) -return bfqq->new_bfqq; -/* * Check delayed stable merge for rotational or non-queueing * devs. For this branch to be executed, bfqq must not be
@@ -2838,6 +2825,9 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,if (bfq_too_late_for_merging (bfqq))return NULL ; +if (bfqq->new_bfqq) +return bfqq->new_bfqq; +if (!io_struct ||unlikely (bfqq == &bfqd->oom_bfqq))return NULL ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 122/172 scsi: csiostor: Add module softdep on cxgb4
In reply to Greg Kroah-HartmanFrom: Rahul Lakkireddy <[email protected]>
[ Upstream commit 79a7482249a7353bc86aff8127954d5febf02472 ]
Both cxgb4 and csiostor drivers run on their own independent Physical Function. But when cxgb4 and csiostor are both being loaded in parallel via modprobe, there is a race when firmware upgrade is attempted by both the drivers.
When the cxgb4 driver initiates the firmware upgrade, it halts the firmware and the chip until upgrade is complete. When the csiostor driver is coming up in parallel, the firmware mailbox communication fails with timeouts and the csiostor driver probe fails.
Add a module soft dependency on cxgb4 driver to ensure loading csiostor triggers cxgb4 to load first when available to avoid the firmware upgrade race.
--- drivers/scsi/csiostor/csio_init.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/csiostor/csio_init.c +1 -0
@@ -1254,3 +1254,4 @@ MODULE_DEVICE_TABLE(pci, csio_pci_tbl);MODULE_VERSION (CSIO_DRV_VERSION );MODULE_FIRMWARE (FW_FNAME_T5 );MODULE_FIRMWARE (FW_FNAME_T6 ); +MODULE_SOFTDEP ("pre: cxgb4" );
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 123/172 ixgbe: Fix NULL pointer dereference in ixgbe_xdp_setup
In reply to Greg Kroah-HartmanFrom: Feng Zhou <[email protected]>
[ Upstream commit 513e605d7a9ce136886cb42ebb2c40e9a6eb6333 ]
The ixgbe driver currently generates a NULL pointer dereference with some machine (online cpus < 63). This is due to the fact that the maximum value of num_xdp_queues is nr_cpu_ids. Code is in "ixgbe_set_rss_queues"".
Here's how the problem repeats itself:
Some machine (online cpus < 63), And user set num_queues to 63 through ethtool. Code is in the "ixgbe_set_channels",
adapter->ring_feature[RING_F_FDIR].limit = count;
It becomes 63.
When user use xdp, "ixgbe_set_rss_queues" will set queues num.
adapter->num_rx_queues = rss_i; adapter->num_tx_queues = rss_i; adapter->num_xdp_queues = ixgbe_xdp_queues(adapter);
And rss_i's value is from
f = &adapter->ring_feature[RING_F_FDIR]; rss_i = f->indices = f->limit;
So "num_rx_queues" > "num_xdp_queues", when run to "ixgbe_xdp_setup",
for (i = 0; i < adapter->num_rx_queues; i++) if (adapter->xdp_ring[i]->xsk_umem)
It leads to panic.
Call trace: [exception RIP: ixgbe_xdp+368] RIP: ffffffffc02a76a0 RSP: ffff9fe16202f8d0 RFLAGS: 00010297 RAX: 0000000000000000 RBX: 0000000000000020 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 000000000000001c RDI: ffffffffa94ead90 RBP: ffff92f8f24c0c18 R8: 0000000000000000 R9: 0000000000000000 R10: ffff9fe16202f830 R11: 0000000000000000 R12: ffff92f8f24c0000 R13: ffff9fe16202fc01 R14: 000000000000000a R15: ffffffffc02a7530 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 7 [ffff9fe16202f8f0] dev_xdp_install at ffffffffa89fbbcc 8 [ffff9fe16202f920] dev_change_xdp_fd at ffffffffa8a08808 9 [ffff9fe16202f960] do_setlink at ffffffffa8a20235
10 [ffff9fe16202fa88] rtnl_setlink at ffffffffa8a20384
11 [ffff9fe16202fc78] rtnetlink_rcv_msg at ffffffffa8a1a8dd 12 [ffff9fe16202fcf0] netlink_rcv_skb at ffffffffa8a717eb
13 [ffff9fe16202fd40] netlink_unicast at ffffffffa8a70f88
14 [ffff9fe16202fd80] netlink_sendmsg at ffffffffa8a71319
15 [ffff9fe16202fdf0] sock_sendmsg at ffffffffa89df290
16 [ffff9fe16202fe08] __sys_sendto at ffffffffa89e19c8
17 [ffff9fe16202ff30] __x64_sys_sendto at ffffffffa89e1a64 18 [ffff9fe16202ff38] do_syscall_64 at ffffffffa84042b9
19 [ffff9fe16202ff50] entry_SYSCALL_64_after_hwframe at ffffffffa8c0008c
So I fix ixgbe_max_channels so that it will not allow a setting of queues to be higher than the num_online_cpus(). And when run to ixgbe_xdp_setup, take the smaller value of num_rx_queues and num_xdp_queues.
--- drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 8 ++++++-- 2 files changed, 7 insertions(+), 3 deletions(-)
drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c +1 -1
@@ -3204,7 +3204,7 @@ static unsigned int ixgbe_max_channels(struct ixgbe_adapter *adapter) max_combined =ixgbe_max_rss_indices (adapter); } -return max_combined; +return min_t (int, max_combined,num_online_cpus ()); } static void ixgbe_get_channels(struct net_device *dev,
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +6 -2
@@ -10112,6 +10112,7 @@ static int ixgbe_xdp_setup(struct net_device *dev, struct bpf_prog *prog)struct ixgbe_adapter *adapter =netdev_priv (dev);struct bpf_prog *old_prog;bool need_reset; +int num_queues;if (adapter->flags &IXGBE_FLAG_SRIOV_ENABLED )return -EINVAL ;
@@ -10161,11 +10162,14 @@ static int ixgbe_xdp_setup(struct net_device *dev, struct bpf_prog *prog)/* Kick start the NAPI context if there is an AF_XDP socket open * on that queue id. This so that receiving will start. */ -if (need_reset && prog) -for (i =0 ; i < adapter->num_rx_queues; i++) +if (need_reset && prog) { + num_queues =min_t (int, adapter->num_rx_queues, + adapter->num_xdp_queues); +for (i =0 ; i < num_queues; i++)if (adapter->xdp_ring[i]->xsk_pool) (void )ixgbe_xsk_wakeup (adapter->netdev, i,XDP_WAKEUP_RX ); + }return 0 ; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 124/172 net: hns3: do not allow call hns3_nic_net_open repeatedly
In reply to Greg Kroah-HartmanFrom: Jian Shen <[email protected]>
[ Upstream commit 5b09e88e1bf7fe86540fab4b5f3eece8abead39e ]
hns3_nic_net_open() is not allowed to called repeatly, but there is no checking for this. When doing device reset and setup tc concurrently, there is a small oppotunity to call hns3_nic_net_open repeatedly, and cause kernel bug by calling napi_enable twice.
The calltrace information is like below:
[ 3078.222780] ------------[ cut here ]------------ [ 3078.230255] kernel BUG at net/core/dev.c:6991! [ 3078.236224] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [ 3078.243431] Modules linked in: hns3 hclgevf hclge hnae3 vfio_iommu_type1 vfio_pci vfio_virqfd vfio pv680_mii(O) [ 3078.258880] CPU: 0 PID: 295 Comm: kworker/u8:5 Tainted: G O 5.14.0-rc4+ #1 [ 3078.269102] Hardware name: , BIOS KpxxxFPGA 1P B600 V181 08/12/2021 [ 3078.276801] Workqueue: hclge hclge_service_task [hclge] [ 3078.288774] pstate: 60400009 (nZCv daif +PAN -UAO -TCO BTYPE=--) [ 3078.296168] pc : napi_enable+0x80/0x84
tc qdisc sho[w 3d0e7v8 .e3t0h218 79] lr : hns3_nic_net_open+0x138/0x510 [hns3]
[ 3078.314771] sp : ffff8000108abb20 [ 3078.319099] x29: ffff8000108abb20 x28: 0000000000000000 x27: ffff0820a8490300 [ 3078.329121] x26: 0000000000000001 x25: ffff08209cfc6200 x24: 0000000000000000 [ 3078.339044] x23: ffff0820a8490300 x22: ffff08209cd76000 x21: ffff0820abfe3880 [ 3078.349018] x20: 0000000000000000 x19: ffff08209cd76900 x18: 0000000000000000 [ 3078.358620] x17: 0000000000000000 x16: ffffc816e1727a50 x15: 0000ffff8f4ff930 [ 3078.368895] x14: 0000000000000000 x13: 0000000000000000 x12: 0000259e9dbeb6b4 [ 3078.377987] x11: 0096a8f7e764eb40 x10: 634615ad28d3eab5 x9 : ffffc816ad8885b8 [ 3078.387091] x8 : ffff08209cfc6fb8 x7 : ffff0820ac0da058 x6 : ffff0820a8490344 [ 3078.396356] x5 : 0000000000000140 x4 : 0000000000000003 x3 : ffff08209cd76938 [ 3078.405365] x2 : 0000000000000000 x1 : 0000000000000010 x0 : ffff0820abfe38a0 [ 3078.414657] Call trace: [ 3078.418517] napi_enable+0x80/0x84 [ 3078.424626] hns3_reset_notify_up_enet+0x78/0xd0 [hns3] [ 3078.433469] hns3_reset_notify+0x64/0x80 [hns3] [ 3078.441430] hclge_notify_client+0x68/0xb0 [hclge] [ 3078.450511] hclge_reset_rebuild+0x524/0x884 [hclge] [ 3078.458879] hclge_reset_service_task+0x3c4/0x680 [hclge] [ 3078.467470] hclge_service_task+0xb0/0xb54 [hclge] [ 3078.475675] process_one_work+0x1dc/0x48c [ 3078.481888] worker_thread+0x15c/0x464 [ 3078.487104] kthread+0x160/0x170 [ 3078.492479] ret_from_fork+0x10/0x18 [ 3078.498785] Code: c8027c81 35ffffa2 d50323bf d65f03c0 (d4210000) [ 3078.506889] ---[ end trace 8ebe0340a1b0fb44 ]---
Once hns3_nic_net_open() is excute success, the flag HNS3_NIC_STATE_DOWN will be cleared. So add checking for this flag, directly return when HNS3_NIC_STATE_DOWN is no set.
--- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +5 -0
@@ -776,6 +776,11 @@ static int hns3_nic_net_open(struct net_device *netdev)if (hns3_nic_resetting (netdev))return -EBUSY ; +if (!test_bit (HNS3_NIC_STATE_DOWN , &priv->state)) { +netdev_warn (netdev,"net open repeatedly!\n" ); +return 0 ; + } +netif_carrier_off (netdev); ret =hns3_nic_set_real_num_queue (netdev);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 125/172 net: hns3: remove tc enable checking
In reply to Greg Kroah-HartmanFrom: Jian Shen <[email protected]>
[ Upstream commit a8e76fefe3de9b8e609cf192af75e7878d21fa3a ]
Currently, in function hns3_nic_set_real_num_queue(), the driver doesn't report the queue count and offset for disabled tc. If user enables multiple TCs, but only maps user priorities to partial of them, it may cause the queue range of the unmapped TC being displayed abnormally.
Fix it by removing the tc enable checking, ensure the queue count is not zero.
With this change, the tc_en is useless now, so remove it.
--- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 1 - drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 11 ++--------- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c | 5 ----- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 2 -- 4 files changed, 2 insertions(+), 17 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hnae3.h +0 -1
@@ -750,7 +750,6 @@ struct hnae3_tc_info {u8 prio_tc[HNAE3_MAX_USER_PRIO ];/* TC indexed by prio */ u16 tqp_count[HNAE3_MAX_TC ];u16 tqp_offset[HNAE3_MAX_TC ]; -unsigned long tc_en;/* bitmap of TC enabled */ u8 num_tc;/* Total number of enabled TCs */ bool mqprio_active; };
drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +2 -9
@@ -620,13 +620,9 @@ static int hns3_nic_set_real_num_queue(struct net_device *netdev)return ret; } -for (i =0 ; i <HNAE3_MAX_TC ; i++) { -if (!test_bit (i, &tc_info->tc_en)) -continue ; - +for (i =0 ; i < tc_info->num_tc; i++)netdev_set_tc_queue (netdev, i, tc_info->tqp_count[i], tc_info->tqp_offset[i]); - } } ret =netif_set_real_num_tx_queues (netdev, queue_size);
@@ -4830,12 +4826,9 @@ static void hns3_init_tx_ring_tc(struct hns3_nic_priv *priv)struct hnae3_tc_info *tc_info = &kinfo->tc_info;int i; -for (i =0 ; i <HNAE3_MAX_TC ; i++) { +for (i =0 ; i < tc_info->num_tc; i++) {int j; -if (!test_bit (i, &tc_info->tc_en)) -continue ; -for (j =0 ; j < tc_info->tqp_count[i]; j++) {struct hnae3_queue *q;
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c +0 -5
@@ -420,8 +420,6 @@ static int hclge_mqprio_qopt_check(struct hclge_dev *hdev,static void hclge_sync_mqprio_qopt (struct hnae3_tc_info *tc_info,struct tc_mqprio_qopt_offload *mqprio_qopt) { -int i; -memset (tc_info,0 ,sizeof (*tc_info)); tc_info->num_tc = mqprio_qopt->qopt.num_tc; memcpy(tc_info->prio_tc, mqprio_qopt->qopt.prio_tc_map,
@@ -430,9 +428,6 @@ static void hclge_sync_mqprio_qopt(struct hnae3_tc_info *tc_info, sizeof_field(struct hnae3_tc_info, tqp_count));memcpy (tc_info->tqp_offset, mqprio_qopt->qopt.offset, sizeof_field(struct hnae3_tc_info, tqp_offset)); - -for (i =0 ; i <HNAE3_MAX_USER_PRIO ; i++) -set_bit (tc_info->prio_tc[i], &tc_info->tc_en); } static int hclge_config_tc(struct hclge_dev *hdev,
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +0 -2
@@ -687,12 +687,10 @@ static void hclge_tm_vport_tc_info_update(struct hclge_vport *vport)for (i =0 ; i <HNAE3_MAX_TC ; i++) {if (hdev->hw_tc_map &BIT (i) && i < kinfo->tc_info.num_tc) { -set_bit (i, &kinfo->tc_info.tc_en); kinfo->tc_info.tqp_offset[i] = i * kinfo->rss_size; kinfo->tc_info.tqp_count[i] = kinfo->rss_size; }else {/* Set to default queue if TC is disable */ -clear_bit (i, &kinfo->tc_info.tc_en); kinfo->tc_info.tqp_offset[i] =0 ; kinfo->tc_info.tqp_count[i] =1 ; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 126/172 net: hns3: dont rollback when destroy mqprio fail
In reply to Greg Kroah-HartmanFrom: Jian Shen <[email protected]>
[ Upstream commit d82650be60ee92e7486f755f5387023278aa933f ]
For destroy mqprio is irreversible in stack, so it's unnecessary to rollback the tc configuration when destroy mqprio failed. Otherwise, it may cause the configuration being inconsistent between driver and netstack.
As the failure is usually caused by reset, and the driver will restore the configuration after reset, so it can keep the configuration being consistent between driver and hardware.
--- .../ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c +11 -6
@@ -493,12 +493,17 @@ static int hclge_setup_tc(struct hnae3_handle *h,return hclge_notify_init_up (hdev); err_out: -/* roll-back */ -memcpy (&kinfo->tc_info, &old_tc_info,sizeof (old_tc_info)); -if (hclge_config_tc (hdev, &kinfo->tc_info)) -dev_err (&hdev->pdev->dev, -"failed to roll back tc configuration\n" ); - +if (!tc) { +dev_warn (&hdev->pdev->dev, +"failed to destroy mqprio, will active after reset, ret = %d\n" , + ret); + }else { +/* roll-back */ +memcpy (&kinfo->tc_info, &old_tc_info,sizeof (old_tc_info)); +if (hclge_config_tc (hdev, &kinfo->tc_info)) +dev_err (&hdev->pdev->dev, +"failed to roll back tc configuration\n" ); + }hclge_notify_init_up (hdev);return ret;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 127/172 net: hns3: fix mixed flag HCLGE_FLAG_MQPRIO_ENABLE and HCLGE_FLAG_DCB_ENABLE
In reply to Greg Kroah-HartmanFrom: Jian Shen <[email protected]>
[ Upstream commit 0472e95ffeac8e61259eec17ab61608c6b35599d ]
HCLGE_FLAG_MQPRIO_ENABLE is supposed to set when enable multiple TCs with tc mqprio, and HCLGE_FLAG_DCB_ENABLE is supposed to set when enable multiple TCs with ets. But the driver mixed the flags when updating the tm configuration.
Furtherly, PFC should be available when HCLGE_FLAG_MQPRIO_ENABLE too, so remove the unnecessary limitation.
--- .../hisilicon/hns3/hns3pf/hclge_dcb.c | 7 +++-- .../ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 31 +++---------------- 2 files changed, 10 insertions(+), 28 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c +5 -2
@@ -224,6 +224,10 @@ static int hclge_ieee_setets(struct hnae3_handle *h, struct ieee_ets *ets) }hclge_tm_schd_info_update (hdev, num_tc); +if (num_tc >1 ) + hdev->flag |=HCLGE_FLAG_DCB_ENABLE ; +else + hdev->flag &= ~HCLGE_FLAG_DCB_ENABLE ; ret =hclge_ieee_ets_to_tm_info (hdev, ets);if (ret)
@@ -285,8 +289,7 @@ static int hclge_ieee_setpfc(struct hnae3_handle *h, struct ieee_pfc *pfc)u8 i, j, pfc_map, *prio_tc;int ret; -if (!(hdev->dcbx_cap &DCB_CAP_DCBX_VER_IEEE ) || - hdev->flag &HCLGE_FLAG_MQPRIO_ENABLE ) +if (!(hdev->dcbx_cap &DCB_CAP_DCBX_VER_IEEE ))return -EINVAL ;if (pfc->pfc_en == hdev->tm_info.pfc_en)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +5 -26
@@ -727,14 +727,6 @@ static void hclge_tm_tc_info_init(struct hclge_dev *hdev)for (i =0 ; i <HNAE3_MAX_USER_PRIO ; i++) hdev->tm_info.prio_tc[i] = (i >= hdev->tm_info.num_tc) ?0 : i; - -/* DCB is enabled if we have more than 1 TC or pfc_en is -* non-zero. -*/ -if (hdev->tm_info.num_tc >1 || hdev->tm_info.pfc_en) - hdev->flag |=HCLGE_FLAG_DCB_ENABLE ; -else - hdev->flag &= ~HCLGE_FLAG_DCB_ENABLE ; }static void hclge_tm_pg_info_init (struct hclge_dev *hdev)
@@ -765,10 +757,10 @@ static void hclge_tm_pg_info_init(struct hclge_dev *hdev)static void hclge_update_fc_mode_by_dcb_flag (struct hclge_dev *hdev) { -if (!(hdev->flag &HCLGE_FLAG_DCB_ENABLE )) { +if (hdev->tm_info.num_tc ==1 && !hdev->tm_info.pfc_en) {if (hdev->fc_mode_last_time ==HCLGE_FC_PFC )dev_warn (&hdev->pdev->dev, -"DCB is disable, but last mode is FC_PFC\n" ); +"Only 1 tc used, but last mode is FC_PFC\n" ); hdev->tm_info.fc_mode = hdev->fc_mode_last_time; }else if (hdev->tm_info.fc_mode !=HCLGE_FC_PFC ) {
@@ -794,7 +786,7 @@ static void hclge_update_fc_mode(struct hclge_dev *hdev) } } -static void hclge_pfc_info_init (struct hclge_dev *hdev) +void hclge_tm_pfc_info_update (struct hclge_dev *hdev) {if (hdev->ae_dev->dev_version >=HNAE3_DEVICE_VERSION_V3 )hclge_update_fc_mode (hdev);
@@ -810,7 +802,7 @@ static void hclge_tm_schd_info_init(struct hclge_dev *hdev)hclge_tm_vport_info_update (hdev); -hclge_pfc_info_init (hdev); +hclge_tm_pfc_info_update (hdev); }static int hclge_tm_pg_to_pri_map (struct hclge_dev *hdev)
@@ -1556,19 +1548,6 @@ void hclge_tm_schd_info_update(struct hclge_dev *hdev, u8 num_tc)hclge_tm_schd_info_init (hdev); } -void hclge_tm_pfc_info_update (struct hclge_dev *hdev) -{ -/* DCB is enabled if we have more than 1 TC or pfc_en is -* non-zero. -*/ -if (hdev->tm_info.num_tc >1 || hdev->tm_info.pfc_en) - hdev->flag |=HCLGE_FLAG_DCB_ENABLE ; -else - hdev->flag &= ~HCLGE_FLAG_DCB_ENABLE ; - -hclge_pfc_info_init (hdev); -} -int hclge_tm_init_hw (struct hclge_dev *hdev,bool init) {int ret;
@@ -1614,7 +1593,7 @@ int hclge_tm_vport_map_update(struct hclge_dev *hdev)if (ret)return ret; -if (!(hdev->flag &HCLGE_FLAG_DCB_ENABLE )) +if (hdev->tm_info.num_tc ==1 && !hdev->tm_info.pfc_en)return 0 ;return hclge_tm_bp_setup (hdev);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 128/172 net: hns3: fix show wrong state when add existing uc mac address
In reply to Greg Kroah-HartmanFrom: Jian Shen <[email protected]>
[ Upstream commit 108b3c7810e14892c4a1819b1d268a2c785c087c ]
Currently, if function adds an existing unicast mac address, eventhough driver will not add this address into hardware, but it will return 0 in function hclge_add_uc_addr_common(). It will cause the state of this unicast mac address is ACTIVE in driver, but it should be in TO-ADD state.
To fix this problem, function hclge_add_uc_addr_common() returns -EEXIST if mac address is existing, and delete two error log to avoid printing them all the time after this modification.
--- .../hisilicon/hns3/hns3pf/hclge_main.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +9 -10
@@ -8701,15 +8701,8 @@ int hclge_add_uc_addr_common(struct hclge_vport *vport, }/* check if we just hit the duplicate */ -if (!ret) { -dev_warn (&hdev->pdev->dev,"VF %u mac(%pM) exists\n" , - vport->vport_id, addr); -return 0 ; - } - -dev_err (&hdev->pdev->dev, -"PF failed to add unicast entry(%pM) in the MAC table\n" , - addr); +if (!ret) +return -EEXIST ;return ret; }
@@ -8861,7 +8854,13 @@ static void hclge_sync_vport_mac_list(struct hclge_vport *vport, }else {set_bit (HCLGE_VPORT_STATE_MAC_TBL_CHANGE , &vport->state); -break ; + +/* If one unicast mac address is existing in hardware, +* we need to try whether other unicast mac addresses +* are new addresses that can be added. +*/ +if (ret != -EEXIST ) +break ; } } }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 129/172 net: hns3: reconstruct function hns3_self_test
In reply to Greg Kroah-HartmanFrom: Peng Li <[email protected]>
[ Upstream commit 4c8dab1c709c5a715bce14efdb8f4e889d86aa04 ]
This patch reconstructs function hns3_self_test to reduce the code cycle complexity and make code more concise.
--- .../ethernet/hisilicon/hns3/hns3_ethtool.c | 101 +++++++++++------- 1 file changed, 64 insertions(+), 37 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c +64 -37
@@ -312,33 +312,8 @@ static int hns3_lp_run_test(struct net_device *ndev, enum hnae3_loop mode)return ret_val; } -/** -* hns3_self_test - self test -* @ndev: net device -* @eth_test: test cmd -* @data: test result -*/ -static void hns3_self_test (struct net_device *ndev, -struct ethtool_test *eth_test,u64 *data) +static void hns3_set_selftest_param (struct hnae3_handle *h,int (*st_param)[2 ]) { -struct hns3_nic_priv *priv =netdev_priv (ndev); -struct hnae3_handle *h = priv->ae_handle; -int st_param[HNS3_SELF_TEST_TYPE_NUM ][2 ]; -bool if_running =netif_running (ndev); -int test_index =0 ; -u32 i; - -if (hns3_nic_resetting (ndev)) { -netdev_err (ndev,"dev resetting!" ); -return ; - } - -/* Only do offline selftest, or pass by default */ -if (eth_test->flags !=ETH_TEST_FL_OFFLINE ) -return ; - -netif_dbg (h, drv, ndev,"self test start" ); - st_param[HNAE3_LOOP_APP ][0 ] =HNAE3_LOOP_APP ; st_param[HNAE3_LOOP_APP ][1 ] = h->flags &HNAE3_SUPPORT_APP_LOOPBACK ;
@@ -355,6 +330,18 @@ static void hns3_self_test(struct net_device *ndev, st_param[HNAE3_LOOP_PHY ][0 ] =HNAE3_LOOP_PHY ; st_param[HNAE3_LOOP_PHY ][1 ] = h->flags &HNAE3_SUPPORT_PHY_LOOPBACK ; +} + +static void hns3_selftest_prepare (struct net_device *ndev, +bool if_running,int (*st_param)[2 ]) +{ +struct hns3_nic_priv *priv =netdev_priv (ndev); +struct hnae3_handle *h = priv->ae_handle; + +if (netif_msg_ifdown (h)) +netdev_info (ndev,"self test start\n" ); + +hns3_set_selftest_param (h, st_param);if (if_running) ndev->netdev_ops->ndo_stop (ndev);
@@ -373,6 +360,35 @@ static void hns3_self_test(struct net_device *ndev, h->ae_algo->ops->halt_autoneg (h, true);set_bit (HNS3_NIC_STATE_TESTING , &priv->state); +} + +static void hns3_selftest_restore (struct net_device *ndev,bool if_running) +{ +struct hns3_nic_priv *priv =netdev_priv (ndev); +struct hnae3_handle *h = priv->ae_handle; + +clear_bit (HNS3_NIC_STATE_TESTING , &priv->state); + +if (h->ae_algo->ops->halt_autoneg) + h->ae_algo->ops->halt_autoneg (h, false); + +#if IS_ENABLED (CONFIG_VLAN_8021Q ) +if (h->ae_algo->ops->enable_vlan_filter) + h->ae_algo->ops->enable_vlan_filter (h, true); +#endif + +if (if_running) + ndev->netdev_ops->ndo_open (ndev); + +if (netif_msg_ifdown (h)) +netdev_info (ndev,"self test end\n" ); +} + +static void hns3_do_selftest (struct net_device *ndev,int (*st_param)[2 ], +struct ethtool_test *eth_test,u64 *data) +{ +int test_index =0 ; +u32 i;for (i =0 ; i <HNS3_SELF_TEST_TYPE_NUM ; i++) {enum hnae3_loop loop_type = (enum hnae3_loop )st_param[i][0 ];
@@ -391,21 +407,32 @@ static void hns3_self_test(struct net_device *ndev, test_index++; } +} -clear_bit (HNS3_NIC_STATE_TESTING , &priv->state); - -if (h->ae_algo->ops->halt_autoneg) - h->ae_algo->ops->halt_autoneg (h, false); +/** +* hns3_nic_self_test - self test +* @ndev: net device +* @eth_test: test cmd +* @data: test result +*/ +static void hns3_self_test (struct net_device *ndev, +struct ethtool_test *eth_test,u64 *data) +{ +int st_param[HNS3_SELF_TEST_TYPE_NUM ][2 ]; +bool if_running =netif_running (ndev); -#if IS_ENABLED (CONFIG_VLAN_8021Q ) -if (h->ae_algo->ops->enable_vlan_filter) - h->ae_algo->ops->enable_vlan_filter (h, true); -#endif +if (hns3_nic_resetting (ndev)) { +netdev_err (ndev,"dev resetting!" ); +return ; + } -if (if_running) - ndev->netdev_ops->ndo_open (ndev); +/* Only do offline selftest, or pass by default */ +if (eth_test->flags !=ETH_TEST_FL_OFFLINE ) +return ; -netif_dbg (h, drv, ndev,"self test end\n" ); +hns3_selftest_prepare (ndev, if_running, st_param); +hns3_do_selftest (ndev, st_param, eth_test, data); +hns3_selftest_restore (ndev, if_running); } static void hns3_update_limit_promisc_mode(struct net_device *netdev,
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 130/172 net: hns3: fix always enable rx vlan filter problem after selftest
In reply to Greg Kroah-HartmanFrom: Guangbin Huang <[email protected]>
[ Upstream commit 27bf4af69fcb9845fb2f0076db5d562ec072e70f ]
Currently, the rx vlan filter will always be disabled before selftest and be enabled after selftest as the rx vlan filter feature is fixed on in old device earlier than V3.
However, this feature is not fixed in some new devices and it can be disabled by user. In this case, it is wrong if rx vlan filter is enabled after selftest. So fix it.
--- drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c +4 -2
@@ -348,7 +348,8 @@ static void hns3_selftest_prepare(struct net_device *ndev,#if IS_ENABLED (CONFIG_VLAN_8021Q )/* Disable the vlan filter for selftest does not support it */ -if (h->ae_algo->ops->enable_vlan_filter) +if (h->ae_algo->ops->enable_vlan_filter && + ndev->features &NETIF_F_HW_VLAN_CTAG_FILTER ) h->ae_algo->ops->enable_vlan_filter (h, false);#endif
@@ -373,7 +374,8 @@ static void hns3_selftest_restore(struct net_device *ndev, bool if_running) h->ae_algo->ops->halt_autoneg (h, false);#if IS_ENABLED (CONFIG_VLAN_8021Q ) -if (h->ae_algo->ops->enable_vlan_filter) +if (h->ae_algo->ops->enable_vlan_filter && + ndev->features &NETIF_F_HW_VLAN_CTAG_FILTER ) h->ae_algo->ops->enable_vlan_filter (h, true);#endif
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 131/172 net: hns3: disable firmware compatible features when uninstall PF
In reply to Greg Kroah-HartmanFrom: Guangbin Huang <[email protected]>
[ Upstream commit 0178839ccca36dee238a57e7f4c3c252f5dbbba6 ]
Currently, the firmware compatible features are enabled in PF driver initialization process, but they are not disabled in PF driver deinitialization process and firmware keeps these features in enabled status.
In this case, if load an old PF driver (for example, in VM) which not support the firmware compatible features, firmware will still send mailbox message to PF when link status changed and PF will print "un-supported mailbox message, code = 201".
To fix this problem, disable these firmware compatible features in PF driver deinitialization process.
--- .../hisilicon/hns3/hns3pf/hclge_cmd.c | 21 ++++++++++++------- 1 file changed, 13 insertions(+), 8 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c +13 -8
@@ -472,7 +472,7 @@ int hclge_cmd_queue_init(struct hclge_dev *hdev)return ret; } -static int hclge_firmware_compat_config (struct hclge_dev *hdev) +static int hclge_firmware_compat_config (struct hclge_dev *hdev,bool en) {struct hclge_firmware_compat_cmd *req;struct hclge_desc desc;
@@ -480,13 +480,16 @@ static int hclge_firmware_compat_config(struct hclge_dev *hdev)hclge_cmd_setup_basic_desc (&desc,HCLGE_OPC_IMP_COMPAT_CFG , false); - req = (struct hclge_firmware_compat_cmd *)desc.data; +if (en) { + req = (struct hclge_firmware_compat_cmd *)desc.data; -hnae3_set_bit (compat,HCLGE_LINK_EVENT_REPORT_EN_B ,1 ); -hnae3_set_bit (compat,HCLGE_NCSI_ERROR_REPORT_EN_B ,1 ); -if (hnae3_dev_phy_imp_supported (hdev)) -hnae3_set_bit (compat,HCLGE_PHY_IMP_EN_B ,1 ); - req->compat =cpu_to_le32 (compat); +hnae3_set_bit (compat,HCLGE_LINK_EVENT_REPORT_EN_B ,1 ); +hnae3_set_bit (compat,HCLGE_NCSI_ERROR_REPORT_EN_B ,1 ); +if (hnae3_dev_phy_imp_supported (hdev)) +hnae3_set_bit (compat,HCLGE_PHY_IMP_EN_B ,1 ); + + req->compat =cpu_to_le32 (compat); + }return hclge_cmd_send (&hdev->hw, &desc,1 ); }
@@ -543,7 +546,7 @@ int hclge_cmd_init(struct hclge_dev *hdev)/* ask the firmware to enable some features, driver can work without * it. */ - ret =hclge_firmware_compat_config (hdev); + ret =hclge_firmware_compat_config (hdev, true);if (ret) dev_warn(&hdev->pdev->dev, "Firmware compatible features not enabled(%d).\n",
@@ -573,6 +576,8 @@ static void hclge_cmd_uninit_regs(struct hclge_hw *hw)void hclge_cmd_uninit (struct hclge_dev *hdev) { +hclge_firmware_compat_config (hdev, false); +set_bit (HCLGE_STATE_CMD_DISABLE , &hdev->state);/* wait to ensure that the firmware completes the possible left * over commands.
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 132/172 net: phy: bcm7xxx: Fixed indirect MMD operations
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit d88fd1b546ff19c8040cfaea76bf16aed1c5a0bb ]
When EEE support was added to the 28nm EPHY it was assumed that it would be able to support the standard clause 45 over clause 22 register access method. It turns out that the PHY does not support that, which is the very reason for using the indirect shadow mode 2 bank 3 access method.
Implement {read,write}_mmd to allow the standard PHY library routines pertaining to EEE querying and configuration to work correctly on these PHYs. This forces us to implement a __phy_set_clr_bits() function that does not grab the MDIO bus lock since the PHY driver's {read,write}_mmd functions are always called with that lock held.
--- drivers/net/phy/bcm7xxx.c | 114 ++++++++++++++++++++++++++++++++++++-- 1 file changed, 110 insertions(+), 4 deletions(-)
drivers/net/phy/bcm7xxx.c +110 -4
@@ -27,7 +27,12 @@#define MII_BCM7XXX_SHD_2_ADDR_CTRL 0xe#define MII_BCM7XXX_SHD_2_CTRL_STAT 0xf#define MII_BCM7XXX_SHD_2_BIAS_TRIM 0x1a +#define MII_BCM7XXX_SHD_3_PCS_CTRL 0x0 +#define MII_BCM7XXX_SHD_3_PCS_STATUS 0x1 +#define MII_BCM7XXX_SHD_3_EEE_CAP 0x2#define MII_BCM7XXX_SHD_3_AN_EEE_ADV 0x3 +#define MII_BCM7XXX_SHD_3_EEE_LP 0x4 +#define MII_BCM7XXX_SHD_3_EEE_WK_ERR 0x5#define MII_BCM7XXX_SHD_3_PCS_CTRL_2 0x6#define MII_BCM7XXX_PCS_CTRL_2_DEF 0x4400#define MII_BCM7XXX_SHD_3_AN_STAT 0xb
@@ -216,25 +221,37 @@ static int bcm7xxx_28nm_resume(struct phy_device *phydev)return genphy_config_aneg (phydev); } -static int phy_set_clr_bits (struct phy_device *dev,int location, -int set_mask,int clr_mask) +static int __phy_set_clr_bits (struct phy_device *dev,int location, +int set_mask,int clr_mask) {int v, ret; - v =phy_read (dev, location); + v =__phy_read (dev, location);if (v <0 )return v; v &= ~clr_mask; v |= set_mask; - ret =phy_write (dev, location, v); + ret =__phy_write (dev, location, v);if (ret <0 )return ret;return v; } +static int phy_set_clr_bits (struct phy_device *dev,int location, +int set_mask,int clr_mask) +{ +int ret; + +mutex_lock (&dev->mdio.bus->mdio_lock); + ret =__phy_set_clr_bits (dev, location, set_mask, clr_mask); +mutex_unlock (&dev->mdio.bus->mdio_lock); + +return ret; +} +static int bcm7xxx_28nm_ephy_01_afe_config_init (struct phy_device *phydev) {int ret;
@@ -398,6 +415,93 @@ static int bcm7xxx_28nm_ephy_config_init(struct phy_device *phydev)return bcm7xxx_28nm_ephy_apd_enable (phydev); } +#define MII_BCM7XXX_REG_INVALID 0xff + +static u8 bcm7xxx_28nm_ephy_regnum_to_shd (u16 regnum) +{ +switch (regnum) { +case MDIO_CTRL1 : +return MII_BCM7XXX_SHD_3_PCS_CTRL ; +case MDIO_STAT1 : +return MII_BCM7XXX_SHD_3_PCS_STATUS ; +case MDIO_PCS_EEE_ABLE : +return MII_BCM7XXX_SHD_3_EEE_CAP ; +case MDIO_AN_EEE_ADV : +return MII_BCM7XXX_SHD_3_AN_EEE_ADV ; +case MDIO_AN_EEE_LPABLE : +return MII_BCM7XXX_SHD_3_EEE_LP ; +case MDIO_PCS_EEE_WK_ERR : +return MII_BCM7XXX_SHD_3_EEE_WK_ERR ; +default : +return MII_BCM7XXX_REG_INVALID ; + } +} + +static bool bcm7xxx_28nm_ephy_dev_valid (int devnum) +{ +return devnum ==MDIO_MMD_AN || devnum ==MDIO_MMD_PCS ; +} + +static int bcm7xxx_28nm_ephy_read_mmd (struct phy_device *phydev, +int devnum,u16 regnum) +{ +u8 shd =bcm7xxx_28nm_ephy_regnum_to_shd (regnum); +int ret; + +if (!bcm7xxx_28nm_ephy_dev_valid (devnum) || + shd ==MII_BCM7XXX_REG_INVALID ) +return -EOPNOTSUPP ; + +/* set shadow mode 2 */ + ret =__phy_set_clr_bits (phydev,MII_BCM7XXX_TEST , +MII_BCM7XXX_SHD_MODE_2 ,0 ); +if (ret <0 ) +return ret; + +/* Access the desired shadow register address */ + ret =__phy_write (phydev,MII_BCM7XXX_SHD_2_ADDR_CTRL , shd); +if (ret <0 ) + goto reset_shadow_mode; + + ret =__phy_read (phydev,MII_BCM7XXX_SHD_2_CTRL_STAT ); + +reset_shadow_mode: +/* reset shadow mode 2 */ +__phy_set_clr_bits (phydev,MII_BCM7XXX_TEST ,0 , +MII_BCM7XXX_SHD_MODE_2 ); +return ret; +} + +static int bcm7xxx_28nm_ephy_write_mmd (struct phy_device *phydev, +int devnum,u16 regnum,u16 val) +{ +u8 shd =bcm7xxx_28nm_ephy_regnum_to_shd (regnum); +int ret; + +if (!bcm7xxx_28nm_ephy_dev_valid (devnum) || + shd ==MII_BCM7XXX_REG_INVALID ) +return -EOPNOTSUPP ; + +/* set shadow mode 2 */ + ret =__phy_set_clr_bits (phydev,MII_BCM7XXX_TEST , +MII_BCM7XXX_SHD_MODE_2 ,0 ); +if (ret <0 ) +return ret; + +/* Access the desired shadow register address */ + ret =__phy_write (phydev,MII_BCM7XXX_SHD_2_ADDR_CTRL , shd); +if (ret <0 ) + goto reset_shadow_mode; + +/* Write the desired value in the shadow register */ +__phy_write (phydev,MII_BCM7XXX_SHD_2_CTRL_STAT , val); + +reset_shadow_mode: +/* reset shadow mode 2 */ +return __phy_set_clr_bits (phydev,MII_BCM7XXX_TEST ,0 , +MII_BCM7XXX_SHD_MODE_2 ); +} +static int bcm7xxx_28nm_ephy_resume (struct phy_device *phydev) {int ret;
@@ -595,6 +699,8 @@ static void bcm7xxx_28nm_remove(struct phy_device *phydev) .get_stats = bcm7xxx_28nm_get_phy_stats, \ .probe = bcm7xxx_28nm_probe, \ .remove = bcm7xxx_28nm_remove, \ + .read_mmd = bcm7xxx_28nm_ephy_read_mmd, \ + .write_mmd = bcm7xxx_28nm_ephy_write_mmd, \ }#define BCM7XXX_40NM_EPHY (_oui, _name) \
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 133/172 net: introduce and use lock_sock_fast_nested()
In reply to Greg Kroah-HartmanFrom: Paolo Abeni <[email protected]>
[ Upstream commit 49054556289e8787501630b7c7a9d407da02e296 ]
Syzkaller reported a false positive deadlock involving the nl socket lock and the subflow socket lock:
MPTCP: kernel_bind error, err=-98
============================================
WARNING: possible recursive locking detected
5.15.0-rc1-syzkaller #0 Not tainted
--------------------------------------------
syz-executor998/6520 is trying to acquire lock:ffff8880795718a0 (k-sk_lock-AF_INET){+.+.}-{0:0}, at: mptcp_close+0x267/0x7b0 net/mptcp/protocol.c:2738
but task is already holding lock:ffff8880787c8c60 (k-sk_lock-AF_INET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1612 [inline] ffff8880787c8c60 (k-sk_lock-AF_INET){+.+.}-{0:0}, at: mptcp_close+0x23/0x7b0 net/mptcp/protocol.c:2720
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
---- lock(k-sk_lock-AF_INET);
lock(k-sk_lock-AF_INET);
*** DEADLOCK ***
May be due to missing lock nesting notation
3 locks held by syz-executor998/6520:
#0: ffffffff8d176c50 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 net/netlink/genetlink.c:802 #1: ffffffff8d176d08 (genl_mutex){+.+.}-{3:3}, at: genl_lock net/netlink/genetlink.c:33 [inline] #1: ffffffff8d176d08 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0x3e0/0x580 net/netlink/genetlink.c:790 #2: ffff8880787c8c60 (k-sk_lock-AF_INET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1612 [inline] #2: ffff8880787c8c60 (k-sk_lock-AF_INET){+.+.}-{0:0}, at: mptcp_close+0x23/0x7b0 net/mptcp/protocol.c:2720
stack backtrace: CPU: 1 PID: 6520 Comm: syz-executor998 Not tainted 5.15.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_deadlock_bug kernel/locking/lockdep.c:2944 [inline] check_deadlock kernel/locking/lockdep.c:2987 [inline] validate_chain kernel/locking/lockdep.c:3776 [inline] __lock_acquire.cold+0x149/0x3ab kernel/locking/lockdep.c:5015 lock_acquire kernel/locking/lockdep.c:5625 [inline] lock_acquire+0x1ab/0x510 kernel/locking/lockdep.c:5590 lock_sock_fast+0x36/0x100 net/core/sock.c:3229 mptcp_close+0x267/0x7b0 net/mptcp/protocol.c:2738 inet_release+0x12e/0x280 net/ipv4/af_inet.c:431 __sock_release net/socket.c:649 [inline] sock_release+0x87/0x1b0 net/socket.c:677 mptcp_pm_nl_create_listen_socket+0x238/0x2c0 net/mptcp/pm_netlink.c:900 mptcp_nl_cmd_add_addr+0x359/0x930 net/mptcp/pm_netlink.c:1170 genl_family_rcv_msg_doit+0x228/0x320 net/netlink/genetlink.c:731 genl_family_rcv_msg net/netlink/genetlink.c:775 [inline] genl_rcv_msg+0x328/0x580 net/netlink/genetlink.c:792 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504 genl_rcv+0x24/0x40 net/netlink/genetlink.c:803 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340 netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929 sock_sendmsg_nosec net/socket.c:704 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:724 sock_no_sendpage+0x101/0x150 net/core/sock.c:2980 kernel_sendpage.part.0+0x1a0/0x340 net/socket.c:3504 kernel_sendpage net/socket.c:3501 [inline] sock_sendpage+0xe5/0x140 net/socket.c:1003 pipe_to_sendpage+0x2ad/0x380 fs/splice.c:364 splice_from_pipe_feed fs/splice.c:418 [inline] __splice_from_pipe+0x43e/0x8a0 fs/splice.c:562 splice_from_pipe fs/splice.c:597 [inline] generic_splice_sendpage+0xd4/0x140 fs/splice.c:746 do_splice_from fs/splice.c:767 [inline] direct_splice_actor+0x110/0x180 fs/splice.c:936 splice_direct_to_actor+0x34b/0x8c0 fs/splice.c:891 do_splice_direct+0x1b3/0x280 fs/splice.c:979 do_sendfile+0xae9/0x1240 fs/read_write.c:1249 __do_sys_sendfile64 fs/read_write.c:1314 [inline] __se_sys_sendfile64 fs/read_write.c:1300 [inline] __x64_sys_sendfile64+0x1cc/0x210 fs/read_write.c:1300 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f215cb69969 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc96bb3868 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 RAX: ffffffffffffffda RBX: 00007f215cbad072 RCX: 00007f215cb69969 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000005 RBP: 0000000000000000 R08: 00007ffc96bb3a08 R09: 00007ffc96bb3a08 R10: 0000000100000002 R11: 0000000000000246 R12: 00007ffc96bb387c R13: 431bde82d7b634db R14: 0000000000000000 R15: 0000000000000000
the problem originates from uncorrect lock annotation in the mptcp code and is only visible since commit 2dcb96bacce3 ("net: core: Correct the sock::sk_lock.owned lockdep annotations"), but is present since the port-based endpoint support initial implementation.
This patch addresses the issue introducing a nested variant of lock_sock_fast() and using it in the relevant code path.
--- include/net/sock.h | 31 ++++++++++++++++++++++++++++++- net/core/sock.c | 17 ++--------------- net/mptcp/protocol.c | 2 +- 3 files changed, 33 insertions(+), 17 deletions(-)
include/net/sock.h +30 -1
@@ -1624,7 +1624,36 @@ void release_sock(struct sock *sk); SINGLE_DEPTH_NESTING)#define bh_unlock_sock (__sk) spin_unlock(&((__sk)->sk_lock.slock)) -bool lock_sock_fast(struct sock *sk) __acquires(&sk->sk_lock.slock); +bool __lock_sock_fast(struct sock *sk) __acquires(&sk->sk_lock.slock); + +/** +* lock_sock_fast - fast version of lock_sock +* @sk: socket +* +* This version should be used for very small section, where process wont block +* return false if fast path is taken: +* +* sk_lock.slock locked, owned = 0, BH disabled +* +* return true if slow path is taken: +* +* sk_lock.slock unlocked, owned = 1, BH enabled +*/ +static inline bool lock_sock_fast (struct sock *sk) +{ +/* The sk_lock has mutex_lock() semantics here. */ +mutex_acquire (&sk->sk_lock.dep_map,0 ,0 , _RET_IP_); + +return __lock_sock_fast (sk); +} + +/* fast socket lock variant for caller already holding a [different] socket lock */ +static inline bool lock_sock_fast_nested (struct sock *sk) +{ +mutex_acquire (&sk->sk_lock.dep_map,SINGLE_DEPTH_NESTING ,0 , _RET_IP_); + +return __lock_sock_fast (sk); +}/** * unlock_sock_fast - complement of lock_sock_fast
net/core/sock.c +2 -15
@@ -3191,20 +3191,7 @@ void release_sock(struct sock *sk) }EXPORT_SYMBOL (release_sock); -/** -* lock_sock_fast - fast version of lock_sock -* @sk: socket -* -* This version should be used for very small section, where process wont block -* return false if fast path is taken: -* -* sk_lock.slock locked, owned = 0, BH disabled -* -* return true if slow path is taken: -* -* sk_lock.slock unlocked, owned = 1, BH enabled -*/ -bool lock_sock_fast(struct sock *sk) __acquires(&sk->sk_lock.slock) +bool __lock_sock_fast(struct sock *sk) __acquires(&sk->sk_lock.slock) {might_sleep ();spin_lock_bh (&sk->sk_lock.slock);
@@ -3226,7 +3213,7 @@ bool lock_sock_fast(struct sock *sk) __acquires(&sk->sk_lock.slock)local_bh_enable ();return true; } -EXPORT_SYMBOL (lock_sock_fast); +EXPORT_SYMBOL (__lock_sock_fast);int sock_gettstamp (struct socket *sock,void __user *userstamp,bool timeval,bool time32)
net/mptcp/protocol.c +1 -1
@@ -2622,7 +2622,7 @@ static void mptcp_close(struct sock *sk, long timeout)inet_csk (sk)->icsk_mtup.probe_timestamp = tcp_jiffies32;mptcp_for_each_subflow (mptcp_sk (sk), subflow) {struct sock *ssk =mptcp_subflow_tcp_sock (subflow); -bool slow =lock_sock_fast (ssk); +bool slow =lock_sock_fast_nested (ssk);sock_orphan (ssk);unlock_sock_fast (ssk, slow);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 134/172 net: sched: flower: protect fl_walk() with rcu
In reply to Greg Kroah-HartmanFrom: Vlad Buslov <[email protected]>
[ Upstream commit d5ef190693a7d76c5c192d108e8dec48307b46ee ]
Patch that refactored fl_walk() to use idr_for_each_entry_continue_ul() also removed rcu protection of individual filters which causes following use-after-free when filter is deleted concurrently. Fix fl_walk() to obtain rcu read lock while iterating and taking the filter reference and temporary release the lock while calling arg->fn() callback that can sleep.
KASAN trace:
[ 352.773640] ================================================================== [ 352.775041] BUG: KASAN: use-after-free in fl_walk+0x159/0x240 [cls_flower] [ 352.776304] Read of size 4 at addr ffff8881c8251480 by task tc/2987
[ 352.777862] CPU: 3 PID: 2987 Comm: tc Not tainted 5.15.0-rc2+ #2 [ 352.778980] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 352.781022] Call Trace: [ 352.781573] dump_stack_lvl+0x46/0x5a [ 352.782332] print_address_description.constprop.0+0x1f/0x140 [ 352.783400] ? fl_walk+0x159/0x240 [cls_flower] [ 352.784292] ? fl_walk+0x159/0x240 [cls_flower] [ 352.785138] kasan_report.cold+0x83/0xdf [ 352.785851] ? fl_walk+0x159/0x240 [cls_flower] [ 352.786587] kasan_check_range+0x145/0x1a0 [ 352.787337] fl_walk+0x159/0x240 [cls_flower] [ 352.788163] ? fl_put+0x10/0x10 [cls_flower] [ 352.789007] ? __mutex_unlock_slowpath.constprop.0+0x220/0x220 [ 352.790102] tcf_chain_dump+0x231/0x450 [ 352.790878] ? tcf_chain_tp_delete_empty+0x170/0x170 [ 352.791833] ? __might_sleep+0x2e/0xc0 [ 352.792594] ? tfilter_notify+0x170/0x170 [ 352.793400] ? __mutex_unlock_slowpath.constprop.0+0x220/0x220 [ 352.794477] tc_dump_tfilter+0x385/0x4b0 [ 352.795262] ? tc_new_tfilter+0x1180/0x1180 [ 352.796103] ? __mod_node_page_state+0x1f/0xc0 [ 352.796974] ? __build_skb_around+0x10e/0x130 [ 352.797826] netlink_dump+0x2c0/0x560 [ 352.798563] ? netlink_getsockopt+0x430/0x430 [ 352.799433] ? __mutex_unlock_slowpath.constprop.0+0x220/0x220 [ 352.800542] __netlink_dump_start+0x356/0x440 [ 352.801397] rtnetlink_rcv_msg+0x3ff/0x550 [ 352.802190] ? tc_new_tfilter+0x1180/0x1180 [ 352.802872] ? rtnl_calcit.isra.0+0x1f0/0x1f0 [ 352.803668] ? tc_new_tfilter+0x1180/0x1180 [ 352.804344] ? _copy_from_iter_nocache+0x800/0x800 [ 352.805202] ? kasan_set_track+0x1c/0x30 [ 352.805900] netlink_rcv_skb+0xc6/0x1f0 [ 352.806587] ? rht_deferred_worker+0x6b0/0x6b0 [ 352.807455] ? rtnl_calcit.isra.0+0x1f0/0x1f0 [ 352.808324] ? netlink_ack+0x4d0/0x4d0 [ 352.809086] ? netlink_deliver_tap+0x62/0x3d0 [ 352.809951] netlink_unicast+0x353/0x480 [ 352.810744] ? netlink_attachskb+0x430/0x430 [ 352.811586] ? __alloc_skb+0xd7/0x200 [ 352.812349] netlink_sendmsg+0x396/0x680 [ 352.813132] ? netlink_unicast+0x480/0x480 [ 352.813952] ? __import_iovec+0x192/0x210 [ 352.814759] ? netlink_unicast+0x480/0x480 [ 352.815580] sock_sendmsg+0x6c/0x80 [ 352.816299] ____sys_sendmsg+0x3a5/0x3c0 [ 352.817096] ? kernel_sendmsg+0x30/0x30 [ 352.817873] ? __ia32_sys_recvmmsg+0x150/0x150 [ 352.818753] ___sys_sendmsg+0xd8/0x140 [ 352.819518] ? sendmsg_copy_msghdr+0x110/0x110 [ 352.820402] ? ___sys_recvmsg+0xf4/0x1a0 [ 352.821110] ? __copy_msghdr_from_user+0x260/0x260 [ 352.821934] ? _raw_spin_lock+0x81/0xd0 [ 352.822680] ? __handle_mm_fault+0xef3/0x1b20 [ 352.823549] ? rb_insert_color+0x2a/0x270 [ 352.824373] ? copy_page_range+0x16b0/0x16b0 [ 352.825209] ? perf_event_update_userpage+0x2d0/0x2d0 [ 352.826190] ? __fget_light+0xd9/0xf0 [ 352.826941] __sys_sendmsg+0xb3/0x130 [ 352.827613] ? __sys_sendmsg_sock+0x20/0x20 [ 352.828377] ? do_user_addr_fault+0x2c5/0x8a0 [ 352.829184] ? fpregs_assert_state_consistent+0x52/0x60 [ 352.830001] ? exit_to_user_mode_prepare+0x32/0x160 [ 352.830845] do_syscall_64+0x35/0x80 [ 352.831445] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 352.832331] RIP: 0033:0x7f7bee973c17 [ 352.833078] Code: 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 [ 352.836202] RSP: 002b:00007ffcbb368e28 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 352.837524] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7bee973c17 [ 352.838715] RDX: 0000000000000000 RSI: 00007ffcbb368e50 RDI: 0000000000000003 [ 352.839838] RBP: 00007ffcbb36d090 R08: 00000000cea96d79 R09: 00007f7beea34a40 [ 352.841021] R10: 00000000004059bb R11: 0000000000000246 R12: 000000000046563f [ 352.842208] R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffcbb36d088
[ 352.843784] Allocated by task 2960: [ 352.844451] kasan_save_stack+0x1b/0x40 [ 352.845173] __kasan_kmalloc+0x7c/0x90 [ 352.845873] fl_change+0x282/0x22db [cls_flower] [ 352.846696] tc_new_tfilter+0x6cf/0x1180 [ 352.847493] rtnetlink_rcv_msg+0x471/0x550 [ 352.848323] netlink_rcv_skb+0xc6/0x1f0 [ 352.849097] netlink_unicast+0x353/0x480 [ 352.849886] netlink_sendmsg+0x396/0x680 [ 352.850678] sock_sendmsg+0x6c/0x80 [ 352.851398] ____sys_sendmsg+0x3a5/0x3c0 [ 352.852202] ___sys_sendmsg+0xd8/0x140 [ 352.852967] __sys_sendmsg+0xb3/0x130 [ 352.853718] do_syscall_64+0x35/0x80 [ 352.854457] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 352.855830] Freed by task 7: [ 352.856421] kasan_save_stack+0x1b/0x40 [ 352.857139] kasan_set_track+0x1c/0x30 [ 352.857854] kasan_set_free_info+0x20/0x30 [ 352.858609] __kasan_slab_free+0xed/0x130 [ 352.859348] kfree+0xa7/0x3c0 [ 352.859951] process_one_work+0x44d/0x780 [ 352.860685] worker_thread+0x2e2/0x7e0 [ 352.861390] kthread+0x1f4/0x220 [ 352.862022] ret_from_fork+0x1f/0x30
[ 352.862955] Last potentially related work creation: [ 352.863758] kasan_save_stack+0x1b/0x40 [ 352.864378] kasan_record_aux_stack+0xab/0xc0 [ 352.865028] insert_work+0x30/0x160 [ 352.865617] __queue_work+0x351/0x670 [ 352.866261] rcu_work_rcufn+0x30/0x40 [ 352.866917] rcu_core+0x3b2/0xdb0 [ 352.867561] __do_softirq+0xf6/0x386
[ 352.868708] Second to last potentially related work creation: [ 352.869779] kasan_save_stack+0x1b/0x40 [ 352.870560] kasan_record_aux_stack+0xab/0xc0 [ 352.871426] call_rcu+0x5f/0x5c0 [ 352.872108] queue_rcu_work+0x44/0x50 [ 352.872855] __fl_put+0x17c/0x240 [cls_flower] [ 352.873733] fl_delete+0xc7/0x100 [cls_flower] [ 352.874607] tc_del_tfilter+0x510/0xb30 [ 352.886085] rtnetlink_rcv_msg+0x471/0x550 [ 352.886875] netlink_rcv_skb+0xc6/0x1f0 [ 352.887636] netlink_unicast+0x353/0x480 [ 352.888285] netlink_sendmsg+0x396/0x680 [ 352.888942] sock_sendmsg+0x6c/0x80 [ 352.889583] ____sys_sendmsg+0x3a5/0x3c0 [ 352.890311] ___sys_sendmsg+0xd8/0x140 [ 352.891019] __sys_sendmsg+0xb3/0x130 [ 352.891716] do_syscall_64+0x35/0x80 [ 352.892395] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 352.893666] The buggy address belongs to the object at ffff8881c8251000
which belongs to the cache kmalloc-2k of size 2048
[ 352.895696] The buggy address is located 1152 bytes inside of
2048-byte region [ffff8881c8251000, ffff8881c8251800)
[ 352.897640] The buggy address belongs to the page:
[ 352.898492] page:00000000213bac35 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1c8250
[ 352.900110] head:00000000213bac35 order:3 compound_mapcount:0 compound_pincount:0
[ 352.901541] flags: 0x2ffff800010200(slab|head|node=0|zone=2|lastcpupid=0x1ffff)
[ 352.902908] raw: 002ffff800010200 0000000000000000 dead000000000122 ffff888100042f00
[ 352.904391] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
[ 352.905861] page dumped because: kasan: bad access detected[ 352.907323] Memory state around the buggy address: [ 352.908218] ffff8881c8251380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 352.909471] ffff8881c8251400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 352.910735] >ffff8881c8251480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 352.912012] ^ [ 352.912642] ffff8881c8251500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 352.913919] ffff8881c8251580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 352.915185] ==================================================================
--- net/sched/cls_flower.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/sched/cls_flower.c +6 -0
@@ -2188,18 +2188,24 @@ static void fl_walk(struct tcf_proto *tp, struct tcf_walker *arg, arg->count = arg->skip; +rcu_read_lock ();idr_for_each_entry_continue_ul (&head->handle_idr, f, tmp, id) {/* don't return filters that are being deleted */ if (!refcount_inc_not_zero (&f->refcnt))continue ; +rcu_read_unlock (); +if (arg->fn (tp, f, arg) <0 ) {__fl_put (f); arg->stop =1 ; +rcu_read_lock ();break ; }__fl_put (f); arg->count++; +rcu_read_lock (); } +rcu_read_unlock (); arg->cookie = id; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 135/172 net: stmmac: fix EEE init issue when paired with EEE capable PHYs
In reply to Greg Kroah-HartmanFrom: Wong Vee Khee <[email protected]>
[ Upstream commit 656ed8b015f19bf3f6e6b3ddd9a4bb4aa5ca73e1 ]
When STMMAC is paired with Energy-Efficient Ethernet(EEE) capable PHY, and the PHY is advertising EEE by default, we need to enable EEE on the xPCS side too, instead of having user to manually trigger the enabling config via ethtool.
Fixed this by adding xpcs_config_eee() call in stmmac_eee_init().
--- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +4 -0
@@ -486,6 +486,10 @@ bool stmmac_eee_init(struct stmmac_priv *priv)timer_setup (&priv->eee_ctrl_timer, stmmac_eee_ctrl_timer,0 );stmmac_set_eee_timer (priv, priv->hw,STMMAC_DEFAULT_LIT_LS , eee_tw_timer); +if (priv->hw->xpcs) +xpcs_config_eee (priv->hw->xpcs, + priv->plat->mult_fact_100ns, + true); }if (priv->plat->has_gmac4 && priv->tx_lpi_timer <=STMMAC_ET_MAX ) {
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 136/172 af_unix: fix races in sk_peer_pid and sk_peer_cred accesses
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 35306eb23814444bd4021f8a1c3047d3cb0c8b2b ]
Jann Horn reported that SO_PEERCRED and SO_PEERGROUPS implementations are racy, as af_unix can concurrently change sk_peer_pid and sk_peer_cred.
In order to fix this issue, this patch adds a new spinlock that needs to be used whenever these fields are read or written.
Jann also pointed out that l2cap_sock_get_peer_pid_cb() is currently reading sk->sk_peer_pid which makes no sense, as this field
is only possibly set by AF_UNIX sockets.
We will have to clean this in a separate patch.
This could be done by reverting b48596d1dc25 "Bluetooth: L2CAP: Add get_peer_pid callback" or implementing what was truly expected.
--- include/net/sock.h | 2 ++ net/core/sock.c | 32 ++++++++++++++++++++++++++------ net/unix/af_unix.c | 34 ++++++++++++++++++++++++++++------ 3 files changed, 56 insertions(+), 12 deletions(-)
include/net/sock.h +2 -0
@@ -487,8 +487,10 @@ struct sock {u8 sk_prefer_busy_poll;u16 sk_busy_poll_budget;#endif +spinlock_t sk_peer_lock;struct pid *sk_peer_pid;const struct cred *sk_peer_cred; +long sk_rcvtimeo;ktime_t sk_stamp;#if BITS_PER_LONG ==32
net/core/sock.c +26 -6
@@ -1366,6 +1366,16 @@ int sock_setsockopt(struct socket *sock, int level, int optname, }EXPORT_SYMBOL (sock_setsockopt); +static const struct cred *sk_get_peer_cred (struct sock *sk) +{ +const struct cred *cred; + +spin_lock (&sk->sk_peer_lock); + cred =get_cred (sk->sk_peer_cred); +spin_unlock (&sk->sk_peer_lock); + +return cred; +}static void cred_to_ucred (struct pid *pid,const struct cred *cred,struct ucred *ucred)
@@ -1542,7 +1552,11 @@ int sock_getsockopt(struct socket *sock, int level, int optname,struct ucred peercred;if (len >sizeof (peercred)) len =sizeof (peercred); + +spin_lock (&sk->sk_peer_lock);cred_to_ucred (sk->sk_peer_pid, sk->sk_peer_cred, &peercred); +spin_unlock (&sk->sk_peer_lock); +if (copy_to_user (optval, &peercred, len))return -EFAULT ; goto lenout;
@@ -1550,20 +1564,23 @@ int sock_getsockopt(struct socket *sock, int level, int optname,case SO_PEERGROUPS : { +const struct cred *cred;int ret, n; -if (!sk->sk_peer_cred) + cred =sk_get_peer_cred (sk); +if (!cred)return -ENODATA ; - n = sk->sk_peer_cred->group_info->ngroups; + n = cred->group_info->ngroups;if (len < n *sizeof (gid_t)) { len = n *sizeof (gid_t); +put_cred (cred);return put_user (len, optlen) ? -EFAULT : -ERANGE ; } len = n *sizeof (gid_t); - ret =groups_to_user ((gid_t __user *)optval, - sk->sk_peer_cred->group_info); + ret =groups_to_user ((gid_t __user *)optval, cred->group_info); +put_cred (cred);if (ret)return ret; goto lenout;
@@ -1921,9 +1938,10 @@ static void __sk_destruct(struct rcu_head *head) sk->sk_frag.page =NULL ; } -if (sk->sk_peer_cred) -put_cred (sk->sk_peer_cred); +/* We do not need to acquire sk->sk_peer_lock, we are the last user. */ +put_cred (sk->sk_peer_cred);put_pid (sk->sk_peer_pid); +if (likely (sk->sk_net_refcnt))put_net (sock_net (sk));sk_prot_free (sk->sk_prot_creator, sk);
@@ -3124,6 +3142,8 @@ void sock_init_data(struct socket *sock, struct sock *sk) sk->sk_peer_pid =NULL ; sk->sk_peer_cred =NULL ; +spin_lock_init (&sk->sk_peer_lock); + sk->sk_write_pending =0 ; sk->sk_rcvlowat =1 ; sk->sk_rcvtimeo =MAX_SCHEDULE_TIMEOUT ;
net/unix/af_unix.c +28 -6
@@ -600,20 +600,42 @@ static void unix_release_sock(struct sock *sk, int embrion)static void init_peercred (struct sock *sk) { -put_pid (sk->sk_peer_pid); -if (sk->sk_peer_cred) -put_cred (sk->sk_peer_cred); +const struct cred *old_cred; +struct pid *old_pid; + +spin_lock (&sk->sk_peer_lock); + old_pid = sk->sk_peer_pid; + old_cred = sk->sk_peer_cred; sk->sk_peer_pid =get_pid (task_tgid (current)); sk->sk_peer_cred =get_current_cred (); +spin_unlock (&sk->sk_peer_lock); + +put_pid (old_pid); +put_cred (old_cred); }static void copy_peercred (struct sock *sk,struct sock *peersk) { -put_pid (sk->sk_peer_pid); -if (sk->sk_peer_cred) -put_cred (sk->sk_peer_cred); +const struct cred *old_cred; +struct pid *old_pid; + +if (sk < peersk) { +spin_lock (&sk->sk_peer_lock); +spin_lock_nested (&peersk->sk_peer_lock,SINGLE_DEPTH_NESTING ); + }else { +spin_lock (&peersk->sk_peer_lock); +spin_lock_nested (&sk->sk_peer_lock,SINGLE_DEPTH_NESTING ); + } + old_pid = sk->sk_peer_pid; + old_cred = sk->sk_peer_cred; sk->sk_peer_pid =get_pid (peersk->sk_peer_pid); sk->sk_peer_cred =get_cred (peersk->sk_peer_cred); + +spin_unlock (&sk->sk_peer_lock); +spin_unlock (&peersk->sk_peer_lock); + +put_pid (old_pid); +put_cred (old_cred); }static int unix_listen (struct socket *sock,int backlog)
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 137/172 objtool: Teach get_alt_entry() about more relocation types
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
[ Upstream commit 24ff652573754fe4c03213ebd26b17e86842feb3 ]
Occasionally objtool encounters symbol (as opposed to section) relocations in .altinstructions. Typically they are the alternatives written by elf_add_alternative() as encountered on a noinstr validation run on vmlinux after having already ran objtool on the individual .o files.
Basically this is the counterpart of commit 44f6a7c0755d ("objtool:
Fix seg fault with Clang non-section symbols"), because when these new assemblers (binutils now also does this) strip the section symbols, elf_add_reloc_to_insn() is forced to emit symbol based relocations.
As such, teach get_alt_entry() about different relocation types.
--- tools/objtool/special.c | 32 +++++++++++++++++++++++++------- 1 file changed, 25 insertions(+), 7 deletions(-)
tools/objtool/special.c +25 -7
@@ -58,6 +58,24 @@ void __weak arch_handle_alternative(unsigned short feature, struct special_alt * { } +static bool reloc2sec_off (struct reloc *reloc,struct section **sec,unsigned long *off) +{ +switch (reloc->sym->type) { +case STT_FUNC : + *sec = reloc->sym->sec; + *off = reloc->sym->offset + reloc->addend; +return true; + +case STT_SECTION : + *sec = reloc->sym->sec; + *off = reloc->addend; +return true; + +default : +return false; + } +} +static int get_alt_entry (struct elf *elf,struct special_entry *entry,struct section *sec,int idx,struct special_alt *alt)
@@ -91,15 +109,12 @@ static int get_alt_entry(struct elf *elf, struct special_entry *entry,WARN_FUNC ("can't find orig reloc" , sec, offset + entry->orig);return -1 ; } -if (orig_reloc->sym->type !=STT_SECTION ) { -WARN_FUNC ("don't know how to handle non-section reloc symbol %s" , +if (!reloc2sec_off (orig_reloc, &alt->orig_sec, &alt->orig_off)) { +WARN_FUNC ("don't know how to handle reloc symbol type: %s" , sec, offset + entry->orig, orig_reloc->sym->name);return -1 ; } - alt->orig_sec = orig_reloc->sym->sec; - alt->orig_off = orig_reloc->addend; -if (!entry->group || alt->new_len) { new_reloc =find_reloc_by_dest (elf, sec, offset + entry->new);if (!new_reloc) {
@@ -116,8 +131,11 @@ static int get_alt_entry(struct elf *elf, struct special_entry *entry,if (arch_is_retpoline (new_reloc->sym))return 1 ; - alt->new_sec = new_reloc->sym->sec; - alt->new_off = (unsigned int )new_reloc->addend; +if (!reloc2sec_off (new_reloc, &alt->new_sec, &alt->new_off)) { +WARN_FUNC ("don't know how to handle reloc symbol type: %s" , + sec, offset + entry->new, new_reloc->sym->name); +return -1 ; + }/* _ASM_EXTABLE_EX hack */ if (alt->new_off >=0x7ffffff0 )
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 138/172 perf/x86/intel: Update event constraints for ICX
In reply to Greg Kroah-HartmanFrom: Kan Liang <[email protected]>
[ Upstream commit ecc2123e09f9e71ddc6c53d71e283b8ada685fe2 ]
According to the latest event list, the event encoding 0xEF is only available on the first 4 counters. Add it into the event constraints table.
--- arch/x86/events/intel/core.c | 1 + 1 file changed, 1 insertion(+)
arch/x86/events/intel/core.c +1 -0
@@ -263,6 +263,7 @@ static struct event_constraint intel_icl_event_constraints[] = {INTEL_EVENT_CONSTRAINT_RANGE (0xa8 ,0xb0 ,0xf ),INTEL_EVENT_CONSTRAINT_RANGE (0xb7 ,0xbd ,0xf ),INTEL_EVENT_CONSTRAINT_RANGE (0xd0 ,0xe6 ,0xf ), +INTEL_EVENT_CONSTRAINT (0xef ,0xf ),INTEL_EVENT_CONSTRAINT_RANGE (0xf0 ,0xf4 ,0xf ), EVENT_CONSTRAINT_END };
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 139/172 sched/fair: Add ancestors of unthrottled undecayed cfs_rq
In reply to Greg Kroah-HartmanFrom: Michal Koutný <[email protected]>
[ Upstream commit 2630cde26711dab0d0b56a8be1616475be646d13 ]
Since commit a7b359fc6a37 ("sched/fair: Correctly insert cfs_rq's to list on unthrottle") we add cfs_rqs with no runnable tasks but not fully decayed into the load (leaf) list. We may ignore adding some ancestors and therefore breaking tmp_alone_branch invariant. This broke LTP test cfs_bandwidth01 and it was partially fixed in commit fdaba61ef8a2 ("sched/fair: Ensure that the CFS parent is added after unthrottling").
I noticed the named test still fails even with the fix (but with low probability, 1 in ~1000 executions of the test). The reason is when bailing out of unthrottle_cfs_rq early, we may miss adding ancestors of the unthrottled cfs_rq, thus, not joining tmp_alone_branch properly.
Fix this by adding ancestors if we notice the unthrottled cfs_rq was added to the load list.
--- kernel/sched/fair.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
kernel/sched/fair.c +5 -1
@@ -4898,8 +4898,12 @@ void unthrottle_cfs_rq(struct cfs_rq *cfs_rq)/* update hierarchical throttle state */ walk_tg_tree_from (cfs_rq->tg, tg_nop, tg_unthrottle_up, (void *)rq); -if (!cfs_rq->load.weight) +/* Nothing to run but something to decay (on_list)? Complete the branch */ +if (!cfs_rq->load.weight) { +if (cfs_rq->on_list) + goto unthrottle_throttle;return ; + } task_delta = cfs_rq->h_nr_running; idle_task_delta = cfs_rq->idle_h_nr_running;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 140/172 sched/fair: Null terminate buffer when updating tunable_scaling
In reply to Greg Kroah-HartmanFrom: Mel Gorman <[email protected]>
[ Upstream commit 703066188f63d66cc6b9d678e5b5ef1213c5938e ]
This patch null-terminates the temporary buffer in sched_scaling_write() so kstrtouint() does not return failure and checks the value is valid.
Before:
$ cat /sys/kernel/debug/sched/tunable_scaling 1 $ echo 0 > /sys/kernel/debug/sched/tunable_scaling -bash: echo: write error: Invalid argument $ cat /sys/kernel/debug/sched/tunable_scaling 1
After:
$ cat /sys/kernel/debug/sched/tunable_scaling 1 $ echo 0 > /sys/kernel/debug/sched/tunable_scaling $ cat /sys/kernel/debug/sched/tunable_scaling 0 $ echo 3 > /sys/kernel/debug/sched/tunable_scaling -bash: echo: write error: Invalid argument
--- kernel/sched/debug.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
kernel/sched/debug.c +7 -1
@@ -173,16 +173,22 @@ static ssize_t sched_scaling_write(struct file *filp, const char __user *ubuf, size_t cnt, loff_t *ppos) { char buf[16]; +unsigned int scaling;if (cnt >15 ) cnt =15 ;if (copy_from_user (&buf, ubuf, cnt))return -EFAULT ; + buf[cnt] ='\0' ; -if (kstrtouint (buf,10 , &sysctl_sched_tunable_scaling)) +if (kstrtouint (buf,10 , &scaling))return -EINVAL ; +if (scaling >=SCHED_TUNABLESCALING_END ) +return -EINVAL ; + + sysctl_sched_tunable_scaling = scaling;if (sched_update_scaling ())return -EINVAL ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 141/172 hwmon: (occ) Fix P10 VRM temp sensors
In reply to Greg Kroah-HartmanFrom: Eddie James <[email protected]>
[ Upstream commit ffa2600044979aff4bd6238edb9af815a47d7c32 ]
The P10 (temp sensor version 0x10) doesn't do the same VRM status reporting that was used on P9. It just reports the temperature, so drop the check for VRM fru type in the sysfs show function, and don't set the name to "alarm".
--- drivers/hwmon/occ/common.c | 17 +++++------------ 1 file changed, 5 insertions(+), 12 deletions(-)
drivers/hwmon/occ/common.c +5 -12
@@ -340,18 +340,11 @@ static ssize_t occ_show_temp_10(struct device *dev,if (val ==OCC_TEMP_SENSOR_FAULT )return -EREMOTEIO ; -/* -* VRM doesn't return temperature, only alarm bit. This -* attribute maps to tempX_alarm instead of tempX_input for -* VRM -*/ -if (temp->fru_type !=OCC_FRU_TYPE_VRM ) { -/* sensor not ready */ -if (val ==0 ) -return -EAGAIN ; +/* sensor not ready */ +if (val ==0 ) +return -EAGAIN ; - val *=1000 ; - } + val *=1000 ;break ;case 2 : val = temp->fru_type;
@@ -886,7 +879,7 @@ static int occ_setup_sensor_attrs(struct occ *occ) 0, i); attr++; -if (sensors->temp.version >1 && +if (sensors->temp.version ==2 && temp->fru_type ==OCC_FRU_TYPE_VRM ) {snprintf (attr->name,sizeof (attr->name),"temp%d_alarm" , s);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 142/172 hwmon: (pmbus/mp2975) Add missed POUT attribute for page 1 mp2975 controller
In reply to Greg Kroah-HartmanFrom: Vadim Pasternak <[email protected]>
[ Upstream commit 2292e2f685cd5c65e3f47bbcf9f469513acc3195 ]
Add missed attribute for reading POUT from page 1.
It is supported by device, but has been missed in initial commit.
--- drivers/hwmon/pmbus/mp2975.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/pmbus/mp2975.c +1 -1
@@ -54,7 +54,7 @@#define MP2975_RAIL2_FUNC (PMBUS_HAVE_VOUT | PMBUS_HAVE_STATUS_VOUT | \ PMBUS_HAVE_IOUT | PMBUS_HAVE_STATUS_IOUT | \ - PMBUS_PHASE_VIRTUAL) + PMBUS_HAVE_POUT | PMBUS_PHASE_VIRTUAL)struct mp2975_data {struct pmbus_driver_info info;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 143/172 kvm: fix objtool relocation warning
In reply to Greg Kroah-HartmanFrom: Linus Torvalds <[email protected]>
[ Upstream commit 291073a566b2094c7192872cc0f17ce73d83cb76 ]
The recent change to make objtool aware of more symbol relocation types (commit 24ff65257375: "objtool: Teach get_alt_entry() about more relocation types") also added another check, and resulted in this objtool warning when building kvm on x86:
arch/x86/kvm/emulate.o: warning: objtool: __ex_table+0x4: don't know how to handle reloc symbol type: kvm_fastop_exception
The reason seems to be that kvm_fastop_exception() is marked as a global symbol, which causes the relocation to ke kept around for objtool. And at the same time, the kvm_fastop_exception definition (which is done as an inline asm statement) doesn't actually set the type of the global, which then makes objtool unhappy.
The minimal fix is to just not mark kvm_fastop_exception as being a global symbol. It's only used in that one compilation unit anyway, so it was always pointless. That's how all the other local exception table labels are done.
I'm not entirely happy about the kinds of games that the kvm code plays with doing its own exception handling, and the fact that it confused objtool is most definitely a symptom of the code being a bit too subtle and ad-hoc. But at least this trivial one-liner makes objtool no longer upset about what is going on.
--- arch/x86/kvm/emulate.c | 1 - 1 file changed, 1 deletion(-)
arch/x86/kvm/emulate.c +0 -1
@@ -435,7 +435,6 @@ static int fastop(struct x86_emulate_ctxt *ctxt, fastop_t fop); __FOP_RET(#op) asm(".pushsection .fixup, \"ax\"\n" -".global kvm_fastop_exception \n" "kvm_fastop_exception: xor %esi, %esi; ret\n" ".popsection" );
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 144/172 nvme: add command id quirk for apple controllers
In reply to Greg Kroah-HartmanFrom: Keith Busch <[email protected]>
commit a2941f6aa71a72be2c82c0a168523a492d093530 upstream.
Some apple controllers use the command id as an index to implementation specific data structures and will fail if the value is out of bounds. The nvme driver's recently introduced command sequence number breaks this controller.
Provide a quirk so these spec incompliant controllers can function as before. The driver will not have the ability to detect bad completions when this quirk is used, but we weren't previously checking this anyway.
The quirk bit was selected so that it can readily apply to stable.
--- drivers/nvme/host/core.c | 4 +++- drivers/nvme/host/nvme.h | 6 ++++++ drivers/nvme/host/pci.c | 3 ++- 3 files changed, 11 insertions(+), 2 deletions(-)
drivers/nvme/host/core.c +3 -1
@@ -980,6 +980,7 @@ EXPORT_SYMBOL_GPL(nvme_cleanup_cmd);blk_status_t nvme_setup_cmd (struct nvme_ns *ns,struct request *req) {struct nvme_command *cmd =nvme_req (req)->cmd; +struct nvme_ctrl *ctrl =nvme_req (req)->ctrl;blk_status_t ret =BLK_STS_OK ;if (!(req->rq_flags &RQF_DONTPREP )) {
@@ -1028,7 +1029,8 @@ blk_status_t nvme_setup_cmd(struct nvme_return BLK_STS_IOERR ; } -nvme_req (req)->genctr++; +if (!(ctrl->quirks &NVME_QUIRK_SKIP_CID_GEN )) +nvme_req (req)->genctr++; cmd->common.command_id =nvme_cid (req);trace_nvme_setup_cmd (req, cmd);return ret;
drivers/nvme/host/nvme.h +6 -0
@@ -149,6 +149,12 @@ enum nvme_quirks {* 48 bits. */ NVME_QUIRK_DMA_ADDRESS_BITS_48 = (1 <<16 ), + +/* +* The controller requires the command_id value be be limited, so skip +* encoding the generation sequence number. +*/ + NVME_QUIRK_SKIP_CID_GEN = (1 << 17), };/*
drivers/nvme/host/pci.c +2 -1
@@ -3282,7 +3282,8 @@ static const struct pci_device_id nvme_i { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2005), .driver_data =NVME_QUIRK_SINGLE_VECTOR |NVME_QUIRK_128_BYTES_SQES | - NVME_QUIRK_SHARED_TAGS }, +NVME_QUIRK_SHARED_TAGS | + NVME_QUIRK_SKIP_CID_GEN }, { PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_EXPRESS, 0xffffff) }, { 0, }