5.4.156-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 5.4.156-rc1 review
This is the start of the stable review cycle for the 5.4.156 release. There are 58 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 27 Oct 2021 19:07:44 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.156-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.4.156-rc1
Fabien Dessenne <[email protected]>
pinctrl: stm32: use valid pin identifier in stm32_pinctrl_resume()
Nick Desaulniers <[email protected]>
ARM: 9122/1: select HAVE_FUTEX_CMPXCHG
Steven Rostedt (VMware) <[email protected]>
tracing: Have all levels of checks prevent recursion
Yanfei Xu <[email protected]>
net: mdiobus: Fix memory leak in __mdiobus_register
Oliver Neukum <[email protected]>
usbnet: sanity check for maxpacket
Dexuan Cui <[email protected]>
scsi: core: Fix shost->cmd_per_lun calculation in scsi_add_host_with_dma()
Uwe Kleine-König <[email protected]>
Input: snvs_pwrkey - add clk handling
Kai Vehmanen <[email protected]>
ALSA: hda: avoid write to STATESTS if controller is in reset
Prashant Malani <[email protected]>
platform/x86: intel_scu_ipc: Update timeout value in comment
Zheyu Ma <[email protected]>
isdn: mISDN: Fix sleeping function called from invalid context
Herve Codina <[email protected]>
ARM: dts: spear3xx: Fix gmac node
Herve Codina <[email protected]>
net: stmmac: add support for dwmac 3.40a
Filipe Manana <[email protected]>
btrfs: deal with errors when checking if a dir entry exists during log replay
Brendan Higgins <[email protected]>
gcc-plugins/structleak: add makefile var for disabling structleak
Florian Westphal <[email protected]>
selftests: netfilter: remove stray bash debug line
Vegard Nossum <[email protected]>
netfilter: Kconfig: use 'default y' instead of 'm' for bool config option
Xiaolong Huang <[email protected]>
isdn: cpai: check ctr->cnr to avoid array index out of bound
Lin Ma <[email protected]>
nfc: nci: fix the UAF of rf_conn_info object
Miaohe Lin <[email protected]>
mm, slub: fix potential memoryleak in kmem_cache_open()
Miaohe Lin <[email protected]>
mm, slub: fix mismatch between reconstructed freelist depth and cnt
Michael Ellerman <[email protected]>
powerpc/idle: Don't corrupt back chain when going idle
Michael Ellerman <[email protected]>
KVM: PPC: Book3S HV: Make idle_kvm_start_guest() return 0 if it went to guest
Michael Ellerman <[email protected]>
KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()
Christopher M. Riedl <[email protected]>
powerpc64/idle: Fix SP offsets when saving GPRs
Gaosheng Cui <[email protected]>
audit: fix possible null-pointer dereference in audit_filter_rules
Takashi Iwai <[email protected]>
ASoC: DAPM: Fix missing kctl change notifications
Steven Clarkson <[email protected]>
ALSA: hda/realtek: Add quirk for Clevo PC50HS
Brendan Grieve <[email protected]>
ALSA: usb-audio: Provide quirk for Sennheiser GSP670 Headset
Matthew Wilcox (Oracle) <[email protected]>
vfs: check fd has read access in kernel_read_file_from_fd()
Lukas Bulwahn <[email protected]>
elfcore: correct reference to CONFIG_UML
Valentin Vidic <[email protected]>
ocfs2: mount fails with buffer overflow in strlen
Jan Kara <[email protected]>
ocfs2: fix data corruption after conversion from inline format
Jeff Layton <[email protected]>
ceph: fix handling of "meta" errors
Zhang Changzhong <[email protected]>
can: j1939: j1939_xtp_rx_rts_session_new(): abort TP less than 9 bytes
Zhang Changzhong <[email protected]>
can: j1939: j1939_xtp_rx_dat_one(): cancel session if receive TP.DT with error length
Ziyang Xuan <[email protected]>
can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv
Ziyang Xuan <[email protected]>
can: j1939: j1939_tp_rxtimer(): fix errant alert in j1939_tp_rxtimer
Zheyu Ma <[email protected]>
can: peak_pci: peak_pci_remove(): fix UAF
Stephane Grosjean <[email protected]>
can: peak_usb: pcan_usb_fd_decode_status(): fix back to ERROR_ACTIVE state notification
Yoshihiro Shimoda <[email protected]>
can: rcar_can: fix suspend/resume
Vladimir Oltean <[email protected]>
net: enetc: fix ethtool counter name for PM0_TERR
Kurt Kanzenbach <[email protected]>
net: stmmac: Fix E2E delay mechanism
Peng Li <[email protected]>
net: hns3: disable sriov before unload hclge layer
Guangbin Huang <[email protected]>
net: hns3: add limit ets dwrr bandwidth cannot be 0
Guangbin Huang <[email protected]>
net: hns3: reset DWRR of unused tc to zero
Randy Dunlap <[email protected]>
NIOS2: irqflags: rename a redefined register name
Aleksander Jan Bajkowski <[email protected]>
net: dsa: lantiq_gswip: fix register definition
Vegard Nossum <[email protected]>
lan78xx: select CRC32
Antoine Tenart <[email protected]>
netfilter: ipvs: make global sysctl readonly in non-init netns
Shengjiu Wang <[email protected]>
ASoC: wm8960: Fix clock configuration on slave mode
Gerald Schaefer <[email protected]>
dma-debug: fix sg checks in debug_dma_map_sg()
Benjamin Coddington <[email protected]>
NFSD: Keep existing listeners on portlist error
Guenter Roeck <[email protected]>
xtensa: xtfpga: Try software restart before simulating CPU reset
Max Filippov <[email protected]>
xtensa: xtfpga: use CONFIG_USE_OF instead of CONFIG_OF
Eugen Hristev <[email protected]>
ARM: dts: at91: sama5d2_som1_ek: disable ISC node by default
Sumit Garg <[email protected]>
tee: optee: Fix missing devices unregister during optee_remove
Russell King <[email protected]>
net: switchdev: do not propagate bridge updates across bridges
Helge Deller <[email protected]>
parisc: math-emu: Fix fall-through warnings
-------------
Diffstat:
Makefile | 4 +- arch/arm/Kconfig | 1 + arch/arm/boot/dts/at91-sama5d27_som1_ek.dts | 1 - arch/arm/boot/dts/spear3xx.dtsi | 2 +- arch/nios2/include/asm/irqflags.h | 4 +- arch/nios2/include/asm/registers.h | 2 +- arch/parisc/math-emu/fpudispatch.c | 56 +++++++- arch/powerpc/kernel/idle_book3s.S | 148 +++++++++++---------- arch/powerpc/kvm/book3s_hv_rmhandlers.S | 28 ++-- arch/xtensa/platforms/xtfpga/setup.c | 12 +- drivers/input/keyboard/snvs_pwrkey.c | 29 ++++ drivers/isdn/capi/kcapi.c | 5 + drivers/isdn/hardware/mISDN/netjet.c | 2 +- drivers/net/can/rcar/rcar_can.c | 20 +-- drivers/net/can/sja1000/peak_pci.c | 9 +- drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 5 +- drivers/net/dsa/lantiq_gswip.c | 2 +- .../net/ethernet/freescale/enetc/enetc_ethtool.c | 2 +- drivers/net/ethernet/hisilicon/hns3/hnae3.c | 21 +++ drivers/net/ethernet/hisilicon/hns3/hnae3.h | 1 + .../net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c | 9 ++ .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 1 + .../net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 2 + .../net/ethernet/stmicro/stmmac/dwmac-generic.c | 1 + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- .../net/ethernet/stmicro/stmmac/stmmac_platform.c | 8 ++ drivers/net/phy/mdio_bus.c | 1 + drivers/net/usb/Kconfig | 1 + drivers/net/usb/usbnet.c | 4 + drivers/pinctrl/stm32/pinctrl-stm32.c | 4 +- drivers/platform/x86/intel_scu_ipc.c | 2 +- drivers/scsi/hosts.c | 3 +- drivers/tee/optee/core.c | 3 + drivers/tee/optee/device.c | 22 +++ drivers/tee/optee/optee_private.h | 1 + fs/btrfs/tree-log.c | 47 ++++--- fs/ceph/caps.c | 12 +- fs/ceph/file.c | 1 - fs/ceph/inode.c | 2 - fs/ceph/mds_client.c | 17 +-- fs/ceph/super.h | 3 - fs/exec.c | 2 +- fs/nfsd/nfsctl.c | 5 +- fs/ocfs2/alloc.c | 46 ++----- fs/ocfs2/super.c | 14 +- include/linux/elfcore.h | 2 +- kernel/auditsc.c | 2 +- kernel/dma/debug.c | 12 +- kernel/trace/ftrace.c | 4 +- kernel/trace/trace.h | 64 +++------ kernel/trace/trace_functions.c | 2 +- mm/slub.c | 13 +- net/can/j1939/j1939-priv.h | 1 + net/can/j1939/main.c | 7 +- net/can/j1939/transport.c | 14 +- net/netfilter/Kconfig | 2 +- net/netfilter/ipvs/ip_vs_ctl.c | 5 + net/nfc/nci/rsp.c | 2 + net/switchdev/switchdev.c | 9 ++ scripts/Makefile.gcc-plugins | 4 + sound/hda/hdac_controller.c | 5 +- sound/pci/hda/patch_realtek.c | 1 + sound/soc/codecs/wm8960.c | 13 +- sound/soc/soc-dapm.c | 13 +- sound/usb/quirks-table.h | 32 +++++ tools/testing/selftests/netfilter/nft_flowtable.sh | 1 - 66 files changed, 495 insertions(+), 280 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/58 parisc: math-emu: Fix fall-through warnings
From: Helge Deller <[email protected]>
commit 6f1fce595b78b775d7fb585c15c2dc3a6994f96e upstream.
Fix lots of fallthrough warnings, e.g.:arch/parisc/math-emu/fpudispatch.c:323:33: warning: this statement may fall through [-Wimplicit-fallthrough=]
--- arch/parisc/math-emu/fpudispatch.c | 56 +++++++++++++++++++++++++++++++++++-- 1 file changed, 53 insertions(+), 3 deletions(-)
arch/parisc/math-emu/fpudispatch.c +53 -3
@@ -310,12 +310,15 @@ decode_0c(u_int ir, u_int class, u_int s r1 &= ~3 ; fpregs[t+3 ] = fpregs[r1+3 ]; fpregs[t+2 ] = fpregs[r1+2 ]; + fallthrough;case 1 :/* double */ fpregs[t+1 ] = fpregs[r1+1 ]; + fallthrough;case 0 :/* single */ fpregs[t] = fpregs[r1];return (NOEXCEPTION ); } +BUG ();case 3 :/* FABS */ switch (fmt) {case 2 :/* illegal */
@@ -325,13 +328,16 @@ decode_0c(u_int ir, u_int class, u_int s r1 &= ~3 ; fpregs[t+3 ] = fpregs[r1+3 ]; fpregs[t+2 ] = fpregs[r1+2 ]; + fallthrough;case 1 :/* double */ fpregs[t+1 ] = fpregs[r1+1 ]; + fallthrough;case 0 :/* single */ /* copy and clear sign bit */ fpregs[t] = fpregs[r1] &0x7fffffff ;return (NOEXCEPTION ); } +BUG ();case 6 :/* FNEG */ switch (fmt) {case 2 :/* illegal */
@@ -341,13 +347,16 @@ decode_0c(u_int ir, u_int class, u_int s r1 &= ~3 ; fpregs[t+3 ] = fpregs[r1+3 ]; fpregs[t+2 ] = fpregs[r1+2 ]; + fallthrough;case 1 :/* double */ fpregs[t+1 ] = fpregs[r1+1 ]; + fallthrough;case 0 :/* single */ /* copy and invert sign bit */ fpregs[t] = fpregs[r1] ^0x80000000 ;return (NOEXCEPTION ); } +BUG ();case 7 :/* FNEGABS */ switch (fmt) {case 2 :/* illegal */
@@ -357,13 +366,16 @@ decode_0c(u_int ir, u_int class, u_int s r1 &= ~3 ; fpregs[t+3 ] = fpregs[r1+3 ]; fpregs[t+2 ] = fpregs[r1+2 ]; + fallthrough;case 1 :/* double */ fpregs[t+1 ] = fpregs[r1+1 ]; + fallthrough;case 0 :/* single */ /* copy and set sign bit */ fpregs[t] = fpregs[r1] |0x80000000 ;return (NOEXCEPTION ); } +BUG ();case 4 :/* FSQRT */ switch (fmt) {case 0 :
@@ -376,6 +388,7 @@ decode_0c(u_int ir, u_int class, u_int scase 3 :/* quad not implemented */ return (MAJOR_0C_EXCP ); } +BUG ();case 5 :/* FRND */ switch (fmt) {case 0 :
@@ -389,7 +402,7 @@ decode_0c(u_int ir, u_int class, u_int sreturn (MAJOR_0C_EXCP ); } }/* end of switch (subop) */ - +BUG ();case 1 :/* class 1 */ df =extru (ir,fpdfpos,2 );/* get dest format */ if ((df &2 ) || (fmt &2 )) {
@@ -419,6 +432,7 @@ decode_0c(u_int ir, u_int class, u_int scase 3 :/* dbl/dbl */ return (MAJOR_0C_EXCP ); } +BUG ();case 1 :/* FCNVXF */ switch (fmt) {case 0 :/* sgl/sgl */
@@ -434,6 +448,7 @@ decode_0c(u_int ir, u_int class, u_int sreturn (dbl_to_dbl_fcnvxf (&fpregs[r1],0 , &fpregs[t],status)); } +BUG ();case 2 :/* FCNVFX */ switch (fmt) {case 0 :/* sgl/sgl */
@@ -449,6 +464,7 @@ decode_0c(u_int ir, u_int class, u_int sreturn (dbl_to_dbl_fcnvfx (&fpregs[r1],0 , &fpregs[t],status)); } +BUG ();case 3 :/* FCNVFXT */ switch (fmt) {case 0 :/* sgl/sgl */
@@ -464,6 +480,7 @@ decode_0c(u_int ir, u_int class, u_int sreturn (dbl_to_dbl_fcnvfxt (&fpregs[r1],0 , &fpregs[t],status)); } +BUG ();case 5 :/* FCNVUF (PA2.0 only) */ switch (fmt) {case 0 :/* sgl/sgl */
@@ -479,6 +496,7 @@ decode_0c(u_int ir, u_int class, u_int sreturn (dbl_to_dbl_fcnvuf (&fpregs[r1],0 , &fpregs[t],status)); } +BUG ();case 6 :/* FCNVFU (PA2.0 only) */ switch (fmt) {case 0 :/* sgl/sgl */
@@ -494,6 +512,7 @@ decode_0c(u_int ir, u_int class, u_int sreturn (dbl_to_dbl_fcnvfu (&fpregs[r1],0 , &fpregs[t],status)); } +BUG ();case 7 :/* FCNVFUT (PA2.0 only) */ switch (fmt) {case 0 :/* sgl/sgl */
@@ -509,10 +528,11 @@ decode_0c(u_int ir, u_int class, u_int sreturn (dbl_to_dbl_fcnvfut (&fpregs[r1],0 , &fpregs[t],status)); } +BUG ();case 4 :/* undefined */ return (MAJOR_0C_EXCP ); }/* end of switch subop */ - +BUG ();case 2 :/* class 2 */ fpu_type_flags=fpregs[FPU_TYPE_FLAG_POS ]; r2 =extru (ir, fpr2pos,5 ) *sizeof (double )/sizeof (u_int);
@@ -590,6 +610,7 @@ decode_0c(u_int ir, u_int class, u_int scase 3 :/* quad not implemented */ return (MAJOR_0C_EXCP ); } +BUG ();case 1 :/* FTEST */ switch (fmt) {case 0 :
@@ -609,8 +630,10 @@ decode_0c(u_int ir, u_int class, u_int scase 3 :return (MAJOR_0C_EXCP ); } +BUG (); }/* end of switch subop */ }/* end of else for PA1.0 & PA1.1 */ +BUG ();case 3 :/* class 3 */ r2 =extru (ir,fpr2pos,5 ) *sizeof (double )/sizeof (u_int);if (r2 ==0 )
@@ -633,6 +656,7 @@ decode_0c(u_int ir, u_int class, u_int scase 3 :/* quad not implemented */ return (MAJOR_0C_EXCP ); } +BUG ();case 1 :/* FSUB */ switch (fmt) {case 0 :
@@ -645,6 +669,7 @@ decode_0c(u_int ir, u_int class, u_int scase 3 :/* quad not implemented */ return (MAJOR_0C_EXCP ); } +BUG ();case 2 :/* FMPY */ switch (fmt) {case 0 :
@@ -657,6 +682,7 @@ decode_0c(u_int ir, u_int class, u_int scase 3 :/* quad not implemented */ return (MAJOR_0C_EXCP ); } +BUG ();case 3 :/* FDIV */ switch (fmt) {case 0 :
@@ -669,6 +695,7 @@ decode_0c(u_int ir, u_int class, u_int scase 3 :/* quad not implemented */ return (MAJOR_0C_EXCP ); } +BUG ();case 4 :/* FREM */ switch (fmt) {case 0 :
@@ -681,6 +708,7 @@ decode_0c(u_int ir, u_int class, u_int scase 3 :/* quad not implemented */ return (MAJOR_0C_EXCP ); } +BUG (); }/* end of class 3 switch */ }/* end of switch(class) */
@@ -736,10 +764,12 @@ u_int fpregs[];return (MAJOR_0E_EXCP );case 1 :/* double */ fpregs[t+1 ] = fpregs[r1+1 ]; + fallthrough;case 0 :/* single */ fpregs[t] = fpregs[r1];return (NOEXCEPTION ); } +BUG ();case 3 :/* FABS */ switch (fmt) {case 2 :
@@ -747,10 +777,12 @@ u_int fpregs[];return (MAJOR_0E_EXCP );case 1 :/* double */ fpregs[t+1 ] = fpregs[r1+1 ]; + fallthrough;case 0 :/* single */ fpregs[t] = fpregs[r1] &0x7fffffff ;return (NOEXCEPTION ); } +BUG ();case 6 :/* FNEG */ switch (fmt) {case 2 :
@@ -758,10 +790,12 @@ u_int fpregs[];return (MAJOR_0E_EXCP );case 1 :/* double */ fpregs[t+1 ] = fpregs[r1+1 ]; + fallthrough;case 0 :/* single */ fpregs[t] = fpregs[r1] ^0x80000000 ;return (NOEXCEPTION ); } +BUG ();case 7 :/* FNEGABS */ switch (fmt) {case 2 :
@@ -769,10 +803,12 @@ u_int fpregs[];return (MAJOR_0E_EXCP );case 1 :/* double */ fpregs[t+1 ] = fpregs[r1+1 ]; + fallthrough;case 0 :/* single */ fpregs[t] = fpregs[r1] |0x80000000 ;return (NOEXCEPTION ); } +BUG ();case 4 :/* FSQRT */ switch (fmt) {case 0 :
@@ -785,6 +821,7 @@ u_int fpregs[];case 3 :return (MAJOR_0E_EXCP ); } +BUG ();case 5 :/* FRMD */ switch (fmt) {case 0 :
@@ -798,7 +835,7 @@ u_int fpregs[];return (MAJOR_0E_EXCP ); } }/* end of switch (subop */ - +BUG ();case 1 :/* class 1 */ df =extru (ir,fpdfpos,2 );/* get dest format */ /*
@@ -826,6 +863,7 @@ u_int fpregs[];case 3 :/* dbl/dbl */ return (MAJOR_0E_EXCP ); } +BUG ();case 1 :/* FCNVXF */ switch (fmt) {case 0 :/* sgl/sgl */
@@ -841,6 +879,7 @@ u_int fpregs[];return (dbl_to_dbl_fcnvxf (&fpregs[r1],0 , &fpregs[t],status)); } +BUG ();case 2 :/* FCNVFX */ switch (fmt) {case 0 :/* sgl/sgl */
@@ -856,6 +895,7 @@ u_int fpregs[];return (dbl_to_dbl_fcnvfx (&fpregs[r1],0 , &fpregs[t],status)); } +BUG ();case 3 :/* FCNVFXT */ switch (fmt) {case 0 :/* sgl/sgl */
@@ -871,6 +911,7 @@ u_int fpregs[];return (dbl_to_dbl_fcnvfxt (&fpregs[r1],0 , &fpregs[t],status)); } +BUG ();case 5 :/* FCNVUF (PA2.0 only) */ switch (fmt) {case 0 :/* sgl/sgl */
@@ -886,6 +927,7 @@ u_int fpregs[];return (dbl_to_dbl_fcnvuf (&fpregs[r1],0 , &fpregs[t],status)); } +BUG ();case 6 :/* FCNVFU (PA2.0 only) */ switch (fmt) {case 0 :/* sgl/sgl */
@@ -901,6 +943,7 @@ u_int fpregs[];return (dbl_to_dbl_fcnvfu (&fpregs[r1],0 , &fpregs[t],status)); } +BUG ();case 7 :/* FCNVFUT (PA2.0 only) */ switch (fmt) {case 0 :/* sgl/sgl */
@@ -916,9 +959,11 @@ u_int fpregs[];return (dbl_to_dbl_fcnvfut (&fpregs[r1],0 , &fpregs[t],status)); } +BUG ();case 4 :/* undefined */ return (MAJOR_0C_EXCP ); }/* end of switch subop */ +BUG ();case 2 :/* class 2 */ /* * Be careful out there.
@@ -994,6 +1039,7 @@ u_int fpregs[]; } }/* end of switch subop */ }/* end of else for PA1.0 & PA1.1 */ +BUG ();case 3 :/* class 3 */ /* * Be careful out there.
@@ -1026,6 +1072,7 @@ u_int fpregs[];return (dbl_fadd (&fpregs[r1],&fpregs[r2], &fpregs[t],status)); } +BUG ();case 1 :/* FSUB */ switch (fmt) {case 0 :
@@ -1035,6 +1082,7 @@ u_int fpregs[];return (dbl_fsub (&fpregs[r1],&fpregs[r2], &fpregs[t],status)); } +BUG ();case 2 :/* FMPY or XMPYU */ /* * check for integer multiply (x bit set)
@@ -1071,6 +1119,7 @@ u_int fpregs[]; &fpregs[r2],&fpregs[t],status)); } } +BUG ();case 3 :/* FDIV */ switch (fmt) {case 0 :
@@ -1080,6 +1129,7 @@ u_int fpregs[];return (dbl_fdiv (&fpregs[r1],&fpregs[r2], &fpregs[t],status)); } +BUG ();case 4 :/* FREM */ switch (fmt) {case 0 :
Greg Kroah-Hartman
maintainerPATCH 2/58 net: switchdev: do not propagate bridge updates across bridges
In reply to Greg Kroah-HartmanFrom: Russell King <[email protected]>
commit 07c6f9805f12f1bb538ef165a092b300350384aa upstream.
When configuring a tree of independent bridges, propagating changes from the upper bridge across a bridge master to the lower bridge ports brings surprises.
For example, a lower bridge may have vlan filtering enabled. It may have a vlan interface attached to the bridge master, which may then be incorporated into another bridge. As soon as the lower bridge vlan interface is attached to the upper bridge, the lower bridge has vlan filtering disabled.
This occurs because switchdev recursively applies its changes to all lower devices no matter what.
--- net/switchdev/switchdev.c | 9 +++++++++ 1 file changed, 9 insertions(+)
net/switchdev/switchdev.c +9 -0
@@ -476,6 +476,9 @@ static int __switchdev_handle_port_obj_a* necessary to go through this helper. */ netdev_for_each_lower_dev (dev, lower_dev, iter) { +if (netif_is_bridge_master (lower_dev)) +continue ; + err =__switchdev_handle_port_obj_add (lower_dev, port_obj_info, check_cb, add_cb);if (err && err != -EOPNOTSUPP )
@@ -528,6 +531,9 @@ static int __switchdev_handle_port_obj_d* necessary to go through this helper. */ netdev_for_each_lower_dev (dev, lower_dev, iter) { +if (netif_is_bridge_master (lower_dev)) +continue ; + err =__switchdev_handle_port_obj_del (lower_dev, port_obj_info, check_cb, del_cb);if (err && err != -EOPNOTSUPP )
@@ -579,6 +585,9 @@ static int __switchdev_handle_port_attr_* necessary to go through this helper. */ netdev_for_each_lower_dev (dev, lower_dev, iter) { +if (netif_is_bridge_master (lower_dev)) +continue ; + err =__switchdev_handle_port_attr_set (lower_dev, port_attr_info, check_cb, set_cb);if (err && err != -EOPNOTSUPP )
Greg Kroah-Hartman
maintainerPATCH 3/58 tee: optee: Fix missing devices unregister during optee_remove
In reply to Greg Kroah-HartmanFrom: Sumit Garg <[email protected]>
commit 7f565d0ead264329749c0da488de9c8dfa2f18ce upstream.
When OP-TEE driver is built as a module, OP-TEE client devices registered on TEE bus during probe should be unregistered during optee_remove. So implement optee_unregister_devices() accordingly.
--- drivers/tee/optee/core.c | 3 +++ drivers/tee/optee/device.c | 22 ++++++++++++++++++++++ drivers/tee/optee/optee_private.h | 1 + 3 files changed, 26 insertions(+)
drivers/tee/optee/core.c +3 -0
@@ -582,6 +582,9 @@ static struct optee *optee_probe(structif (sec_caps &OPTEE_SMC_SEC_CAP_DYNAMIC_SHM ) pool =optee_config_dyn_shm (); +/* Unregister OP-TEE specific client devices on TEE bus */ +optee_unregister_devices (); +/* * If dynamic shared memory is not available or failed - try static one */
drivers/tee/optee/device.c +22 -0
@@ -65,6 +65,13 @@ static int get_devices(struct tee_contexreturn 0 ; } +static void optee_release_device (struct device *dev) +{ +struct tee_client_device *optee_device =to_tee_client_device (dev); + +kfree (optee_device); +} +static int optee_register_device (const uuid_t *device_uuid,u32 device_id) {struct tee_client_device *optee_device =NULL ;
@@ -75,6 +82,7 @@ static int optee_register_device(const ureturn -ENOMEM ; optee_device->dev.bus = &tee_bus_type; + optee_device->dev.release = optee_release_device;dev_set_name (&optee_device->dev,"optee-clnt%u" , device_id);uuid_copy (&optee_device->id.uuid, device_uuid);
@@ -158,3 +166,17 @@ out_ctx:return rc; } + +static int __optee_unregister_device (struct device *dev,void *data) +{ +if (!strncmp (dev_name (dev),"optee-clnt" ,strlen ("optee-clnt" ))) +device_unregister (dev); + +return 0 ; +} + +void optee_unregister_devices (void ) +{ +bus_for_each_dev (&tee_bus_type,NULL ,NULL , + __optee_unregister_device); +}
drivers/tee/optee/optee_private.h +1 -0
@@ -175,6 +175,7 @@ void optee_fill_pages_list(u64 *dst, str size_t page_offset);int optee_enumerate_devices (void ); +void optee_unregister_devices (void );/* * Small helpers
Greg Kroah-Hartman
maintainerPATCH 4/58 ARM: dts: at91: sama5d2_som1_ek: disable ISC node by default
In reply to Greg Kroah-HartmanFrom: Eugen Hristev <[email protected]>
[ Upstream commit 4348cc10da6377a86940beb20ad357933b8f91bb ]
Without a sensor node, the ISC will simply fail to probe, as the corresponding port node is missing.
It is then logical to disable the node in the devicetree.
If we add a port with a connection to a sensor endpoint, ISC can be enabled.
--- arch/arm/boot/dts/at91-sama5d27_som1_ek.dts | 1 - 1 file changed, 1 deletion(-)
arch/arm/boot/dts/at91-sama5d27_som1_ek.dts +0 -1
@@ -69,7 +69,6 @@ isc: isc@f0008000 { pinctrl-names = "default"; pinctrl-0 = <&pinctrl_isc_base &pinctrl_isc_data_8bit &pinctrl_isc_data_9_10 &pinctrl_isc_data_11_12>; - status = "okay"; }; qspi1: spi@f0024000 {
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 5/58 xtensa: xtfpga: use CONFIG_USE_OF instead of CONFIG_OF
In reply to Greg Kroah-HartmanFrom: Max Filippov <[email protected]>
[ Upstream commit f3d7c2cdf6dc0d5402ec29c3673893b3542c5ad1 ]
Use platform data to initialize xtfpga device drivers when CONFIG_USE_OF is not selected. This fixes xtfpga networking when CONFIG_USE_OF is not selected but CONFIG_OF is.
--- arch/xtensa/platforms/xtfpga/setup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/xtensa/platforms/xtfpga/setup.c +2 -2
@@ -81,7 +81,7 @@ void __init platform_calibrate_ccount(void)#endif -#ifdef CONFIG_OF +#ifdef CONFIG_USE_OF static void __init xtfpga_clk_setup (struct device_node *np) {
@@ -299,4 +299,4 @@ static int __init xtavnet_init(void)*/ arch_initcall (xtavnet_init); -#endif /* CONFIG_OF */ +#endif /* CONFIG_USE_OF */
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 6/58 xtensa: xtfpga: Try software restart before simulating CPU reset
In reply to Greg Kroah-HartmanFrom: Guenter Roeck <[email protected]>
[ Upstream commit 012e974501a270d8dfd4ee2039e1fdf7579c907e ]
Rebooting xtensa images loaded with the '-kernel' option in qemu does not work. When executing a reboot command, the qemu session either hangs or experiences an endless sequence of error messages.
Kernel panic - not syncing: Unrecoverable error in exception handler
Reset code jumps to the CPU restart address, but Linux can not recover from there because code and data in the kernel init sections have been discarded and overwritten at this point.
XTFPGA platforms have a means to reset the CPU by writing 0xdead into a specific FPGA IO address. When used in QEMU the kernel image loaded with the '-kernel' option gets restored to its original state allowing the machine to boot successfully.
Use that mechanism to attempt a platform reset. If it does not work, fall back to the existing mechanism.
--- arch/xtensa/platforms/xtfpga/setup.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
arch/xtensa/platforms/xtfpga/setup.c +6 -2
@@ -50,8 +50,12 @@ void platform_power_off(void)void platform_restart (void ) { -/* Flush and reset the mmu, simulate a processor reset, and -* jump to the reset vector. */ +/* Try software reset first. */ +WRITE_ONCE (*(u32 *)XTFPGA_SWRST_VADDR ,0xdead ); + +/* If software reset did not work, flush and reset the mmu, +* simulate a processor reset, and jump to the reset vector. +*/ cpu_reset ();/* control never gets here */ }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 7/58 NFSD: Keep existing listeners on portlist error
In reply to Greg Kroah-HartmanFrom: Benjamin Coddington <[email protected]>
[ Upstream commit c20106944eb679fa3ab7e686fe5f6ba30fbc51e5 ]
If nfsd has existing listening sockets without any processes, then an error returned from svc_create_xprt() for an additional transport will remove those existing listeners. We're seeing this in practice when userspace attempts to create rpcrdma transports without having the rpcrdma modules present before creating nfsd kernel processes. Fix this by checking for existing sockets before calling nfsd_destroy().
--- fs/nfsd/nfsctl.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/nfsd/nfsctl.c +4 -1
@@ -792,7 +792,10 @@ out_close:svc_xprt_put (xprt); } out_err: -nfsd_destroy (net); +if (!list_empty (&nn->nfsd_serv->sv_permsocks)) + nn->nfsd_serv->sv_nrthreads--; +else +nfsd_destroy (net);return err; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 8/58 dma-debug: fix sg checks in debug_dma_map_sg()
In reply to Greg Kroah-HartmanFrom: Gerald Schaefer <[email protected]>
[ Upstream commit 293d92cbbd2418ca2ba43fed07f1b92e884d1c77 ]
The following warning occurred sporadically on s390:
DMA-API: nvme 0006:00:00.0: device driver maps memory from kernel text or rodata [addr=0000000048cc5e2f] [len=131072]
WARNING: CPU: 4 PID: 825 at kernel/dma/debug.c:1083 check_for_illegal_area+0xa8/0x138
It is a false-positive warning, due to broken logic in debug_dma_map_sg(). check_for_illegal_area() checks for overlay of sg elements with kernel text or rodata. It is called with sg_dma_len(s) instead of s->length as parameter. After the call to ->map_sg(), sg_dma_len() will contain the length of possibly combined sg elements in the DMA address space, and not the individual sg element length, which would be s->length.
The check will then use the physical start address of an sg element, and add the DMA length for the overlap check, which could result in the false warning, because the DMA length can be larger than the actual single sg element length.
In addition, the call to check_for_illegal_area() happens in the iteration over mapped_ents, which will not include all individual sg elements if any of them were combined in ->map_sg().
Fix this by using s->length instead of sg_dma_len(s). Also put the call to check_for_illegal_area() in a separate loop, iterating over all the individual sg elements ("nents" instead of "mapped_ents").
While at it, as suggested by Robin Murphy, also move check_for_stack() inside the new loop, as it is similarly concerned with validating the individual sg elements.
--- kernel/dma/debug.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
kernel/dma/debug.c +6 -6
@@ -1354,6 +1354,12 @@ void debug_dma_map_sg(struct device *dev, struct scatterlist *sg,if (unlikely (dma_debug_disabled ()))return ; +for_each_sg (sg, s, nents, i) { +check_for_stack (dev,sg_page (s), s->offset); +if (!PageHighMem (sg_page (s))) +check_for_illegal_area (dev,sg_virt (s), s->length); + } +for_each_sg (sg, s, mapped_ents, i) { entry =dma_entry_alloc ();if (!entry)
@@ -1369,12 +1375,6 @@ void debug_dma_map_sg(struct device *dev, struct scatterlist *sg, entry->sg_call_ents = nents; entry->sg_mapped_ents = mapped_ents; -check_for_stack (dev,sg_page (s), s->offset); - -if (!PageHighMem (sg_page (s))) { -check_for_illegal_area (dev,sg_virt (s),sg_dma_len (s)); - } -check_sg_segment (dev, s);add_dma_entry (entry);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 9/58 ASoC: wm8960: Fix clock configuration on slave mode
In reply to Greg Kroah-HartmanFrom: Shengjiu Wang <[email protected]>
[ Upstream commit 6b9b546dc00797c74bef491668ce5431ff54e1e2 ]
There is a noise issue for 8kHz sample rate on slave mode. Compared with master mode, the difference is the DACDIV setting, after correcting the DACDIV, the noise is gone.
There is no noise issue for 48kHz sample rate, because the default value of DACDIV is correct for 48kHz.
So wm8960_configure_clocking() should be functional for ADC and DAC function even if it is slave mode.
In order to be compatible for old use case, just add condition for checking that sysclk is zero with slave mode.
--- sound/soc/codecs/wm8960.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
sound/soc/codecs/wm8960.c +10 -3
@@ -752,9 +752,16 @@ static int wm8960_configure_clocking(struct snd_soc_component *component)int i, j, k;int ret; -if (!(iface1 & (1 <<6 ))) { -dev_dbg (component->dev, -"Codec is slave mode, no need to configure clock\n" ); +/* +* For Slave mode clocking should still be configured, +* so this if statement should be removed, but some platform +* may not work if the sysclk is not configured, to avoid such +* compatible issue, just add '!wm8960->sysclk' condition in +* this if statement. +*/ +if (!(iface1 & (1 <<6 )) && !wm8960->sysclk) { +dev_warn (component->dev, +"slave mode, but proceeding with no clock configuration\n" );return 0 ; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 10/58 netfilter: ipvs: make global sysctl readonly in non-init netns
In reply to Greg Kroah-HartmanFrom: Antoine Tenart <[email protected]>
[ Upstream commit 174c376278949c44aad89c514a6b5db6cee8db59 ]
Because the data pointer of net/ipv4/vs/debug_level is not updated per netns, it must be marked as read-only in non-init netns.
--- net/netfilter/ipvs/ip_vs_ctl.c | 5 +++++ 1 file changed, 5 insertions(+)
net/netfilter/ipvs/ip_vs_ctl.c +5 -0
@@ -4047,6 +4047,11 @@ static int __net_init ip_vs_control_net_init_sysctl(struct netns_ipvs *ipvs) tbl[idx++].data = &ipvs->sysctl_conn_reuse_mode; tbl[idx++].data = &ipvs->sysctl_schedule_icmp; tbl[idx++].data = &ipvs->sysctl_ignore_tunneled; +#ifdef CONFIG_IP_VS_DEBUG +/* Global sysctls must be ro in non-init netns */ +if (!net_eq (net, &init_net)) + tbl[idx++].mode =0444 ; +#endif ipvs->sysctl_hdr =register_net_sysctl (net,"net/ipv4/vs" , tbl);if (ipvs->sysctl_hdr ==NULL ) {
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 11/58 lan78xx: select CRC32
In reply to Greg Kroah-HartmanFrom: Vegard Nossum <[email protected]>
[ Upstream commit 46393d61a328d7c4e3264252dae891921126c674 ]
Fix the following build/link error by adding a dependency on the CRC32 routines:
ld: drivers/net/usb/lan78xx.o: in function `lan78xx_set_multicast':
lan78xx.c:(.text+0x48cf): undefined reference to `crc32_le'
The actual use of crc32_le() comes indirectly through ether_crc().
--- drivers/net/usb/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/Kconfig +1 -0
@@ -117,6 +117,7 @@ config USB_LAN78XX select PHYLIB select MICROCHIP_PHY select FIXED_PHY + select CRC32 help This option adds support for Microchip LAN78XX based USB 2 & USB 3 10/100/1000 Ethernet adapters.
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 12/58 net: dsa: lantiq_gswip: fix register definition
In reply to Greg Kroah-HartmanFrom: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit 66d262804a2276721eac86cf18fcd61046149193 ]
I compared the register definitions with the D-Link DWR-966 GPL sources and found that the PUAFD field definition was incorrect. This definition is unused and causes no issues.
--- drivers/net/dsa/lantiq_gswip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/lantiq_gswip.c +1 -1
@@ -229,7 +229,7 @@#define GSWIP_SDMA_PCTRLp (p) (0xBC0 + ((p) * 0x6))#define GSWIP_SDMA_PCTRL_EN BIT(0)/* SDMA Port Enable */ #define GSWIP_SDMA_PCTRL_FCEN BIT(1)/* Flow Control Enable */ -#define GSWIP_SDMA_PCTRL_PAUFWD BIT(1)/* Pause Frame Forwarding */ +#define GSWIP_SDMA_PCTRL_PAUFWD BIT(3)/* Pause Frame Forwarding */ #define GSWIP_TABLE_ACTIVE_VLAN 0x01#define GSWIP_TABLE_VLAN_MAPPING 0x02
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 13/58 NIOS2: irqflags: rename a redefined register name
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 4cce60f15c04d69eff6ffc539ab09137dbe15070 ]
Both arch/nios2/ and drivers/mmc/host/tmio_mmc.c define a macro with the name "CTL_STATUS". Change the one in arch/nios2/ to be "CTL_FSTATUS" (flags status) to eliminate the build warning.
In file included from ../drivers/mmc/host/tmio_mmc.c:22:drivers/mmc/host/tmio_mmc.h:31: warning: "CTL_STATUS" redefined
31 | #define CTL_STATUS 0x1carch/nios2/include/asm/registers.h:14: note: this is the location of the previous definition
14 | #define CTL_STATUS 0
--- arch/nios2/include/asm/irqflags.h | 4 ++-- arch/nios2/include/asm/registers.h | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
arch/nios2/include/asm/irqflags.h +2 -2
@@ -9,7 +9,7 @@static inline unsigned long arch_local_save_flags (void ) { -return RDCTL (CTL_STATUS ); +return RDCTL (CTL_FSTATUS ); }/*
@@ -18,7 +18,7 @@ static inline unsigned long arch_local_save_flags(void)*/ static inline void arch_local_irq_restore (unsigned long flags) { -WRCTL (CTL_STATUS , flags); +WRCTL (CTL_FSTATUS , flags); }static inline void arch_local_irq_disable (void )
arch/nios2/include/asm/registers.h +1 -1
@@ -11,7 +11,7 @@#endif /* control register numbers */ -#define CTL_STATUS 0 +#define CTL_FSTATUS 0#define CTL_ESTATUS 1#define CTL_BSTATUS 2#define CTL_IENABLE 3
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 14/58 net: hns3: reset DWRR of unused tc to zero
In reply to Greg Kroah-HartmanFrom: Guangbin Huang <[email protected]>
[ Upstream commit b63fcaab959807282e9822e659034edf95fc8bd1 ]
Currently, DWRR of tc will be initialized to a fixed value when this tc is enabled, but it is not been reset to 0 when this tc is disabled. It cause a problem that the DWRR of unused tc is not 0 after using tc tool to add and delete multi-tc parameters.
For examples, after enabling 4 TCs and restoring to 1 TC by follow tc commands:
$ tc qdisc add dev eth0 root mqprio num_tc 4 map 0 1 2 3 0 1 2 3 queues \ 8@0 8@8 8@16 8@24 hw 1 mode channel $ tc qdisc del dev eth0 root
Now there is just one TC is enabled for eth0, but the tc info querying by debugfs is shown as follow:
$ cat /mnt/hns3/0000:7d:00.0/tm/tc_sch_info enabled tc number: 1 weight_offset: 14 TC MODE WEIGHT 0 dwrr 100 1 dwrr 100 2 dwrr 100 3 dwrr 100 4 dwrr 0 5 dwrr 0 6 dwrr 0 7 dwrr 0
This patch fixes it by resetting DWRR of tc to 0 when tc is disabled.
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +2 -0
@@ -633,6 +633,8 @@ static void hclge_tm_pg_info_init(struct hclge_dev *hdev) hdev->tm_info.pg_info[i].tc_bit_map = hdev->hw_tc_map;for (k =0 ; k < hdev->tm_info.num_tc; k++) hdev->tm_info.pg_info[i].tc_dwrr[k] =BW_PERCENT ; +for (; k <HNAE3_MAX_TC ; k++) + hdev->tm_info.pg_info[i].tc_dwrr[k] =0 ; } }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 15/58 net: hns3: add limit ets dwrr bandwidth cannot be 0
In reply to Greg Kroah-HartmanFrom: Guangbin Huang <[email protected]>
[ Upstream commit 731797fdffa3d083db536e2fdd07ceb050bb40b1 ]
If ets dwrr bandwidth of tc is set to 0, the hardware will switch to SP mode. In this case, this tc may occupy all the tx bandwidth if it has huge traffic, so it violates the purpose of the user setting.
To fix this problem, limit the ets dwrr bandwidth must greater than 0.
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c +9 -0
@@ -132,6 +132,15 @@ static int hclge_ets_validate(struct hclge_dev *hdev, struct ieee_ets *ets, *changed = true;break ;case IEEE_8021QAZ_TSA_ETS : +/* The hardware will switch to sp mode if bandwidth is +* 0, so limit ets bandwidth must be greater than 0. +*/ +if (!ets->tc_tx_bw[i]) { +dev_err (&hdev->pdev->dev, +"tc%u ets bw cannot be 0\n" , i); +return -EINVAL ; + } +if (hdev->tm_info.tc_info[i].tc_sch_mode !=HCLGE_SCH_MODE_DWRR ) *changed = true;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 16/58 net: hns3: disable sriov before unload hclge layer
In reply to Greg Kroah-HartmanFrom: Peng Li <[email protected]>
[ Upstream commit 0dd8a25f355b4df2d41c08df1716340854c7d4c5 ]
HNS3 driver includes hns3.ko, hnae3.ko and hclge.ko. hns3.ko includes network stack and pci_driver, hclge.ko includes HW device action, algo_ops and timer task, hnae3.ko includes some register function.
When SRIOV is enable and hclge.ko is removed, HW device is unloaded but VF still exists, PF will not reply VF mbx messages, and cause errors.
This patch fix it by disable SRIOV before remove hclge.ko.
--- drivers/net/ethernet/hisilicon/hns3/hnae3.c | 21 +++++++++++++++++++ drivers/net/ethernet/hisilicon/hns3/hnae3.h | 1 + .../hisilicon/hns3/hns3pf/hclge_main.c | 1 + 3 files changed, 23 insertions(+)
drivers/net/ethernet/hisilicon/hns3/hnae3.c +21 -0
@@ -10,6 +10,27 @@ static LIST_HEAD(hnae3_ae_algo_list);static LIST_HEAD (hnae3_client_list);static LIST_HEAD (hnae3_ae_dev_list); +void hnae3_unregister_ae_algo_prepare (struct hnae3_ae_algo *ae_algo) +{ +const struct pci_device_id *pci_id; +struct hnae3_ae_dev *ae_dev; + +if (!ae_algo) +return ; + +list_for_each_entry (ae_dev, &hnae3_ae_dev_list, node) { +if (!hnae3_get_bit (ae_dev->flag,HNAE3_DEV_INITED_B )) +continue ; + + pci_id =pci_match_id (ae_algo->pdev_id_table, ae_dev->pdev); +if (!pci_id) +continue ; +if (IS_ENABLED (CONFIG_PCI_IOV )) +pci_disable_sriov (ae_dev->pdev); + } +} +EXPORT_SYMBOL (hnae3_unregister_ae_algo_prepare); +/* we are keeping things simple and using single lock for all the * list. This is a non-critical code so other updations, if happen * in parallel, can wait.
drivers/net/ethernet/hisilicon/hns3/hnae3.h +1 -0
@@ -666,6 +666,7 @@ struct hnae3_handle {int hnae3_register_ae_dev (struct hnae3_ae_dev *ae_dev);void hnae3_unregister_ae_dev (struct hnae3_ae_dev *ae_dev); +void hnae3_unregister_ae_algo_prepare (struct hnae3_ae_algo *ae_algo);void hnae3_unregister_ae_algo (struct hnae3_ae_algo *ae_algo);void hnae3_register_ae_algo (struct hnae3_ae_algo *ae_algo);
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +1 -0
@@ -10274,6 +10274,7 @@ static int hclge_init(void)static void hclge_exit (void ) { +hnae3_unregister_ae_algo_prepare (&ae_algo);hnae3_unregister_ae_algo (&ae_algo); }module_init (hclge_init);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 17/58 net: stmmac: Fix E2E delay mechanism
In reply to Greg Kroah-HartmanFrom: Kurt Kanzenbach <[email protected]>
[ Upstream commit 3cb958027cb8b78d3ee639ce9af54c2ef1bf964f ]
When utilizing End to End delay mechanism, the following error messages show up:
|root@ehl1:~# ptp4l --tx_timestamp_timeout=50 -H -i eno2 -E -m |ptp4l[950.573]: selected /dev/ptp3 as PTP clock |ptp4l[950.586]: port 1: INITIALIZING to LISTENING on INIT_COMPLETE |ptp4l[950.586]: port 0: INITIALIZING to LISTENING on INIT_COMPLETE |ptp4l[952.879]: port 1: new foreign master 001395.fffe.4897b4-1 |ptp4l[956.879]: selected best master clock 001395.fffe.4897b4 |ptp4l[956.879]: port 1: assuming the grand master role |ptp4l[956.879]: port 1: LISTENING to GRAND_MASTER on RS_GRAND_MASTER |ptp4l[962.017]: port 1: received DELAY_REQ without timestamp |ptp4l[962.273]: port 1: received DELAY_REQ without timestamp |ptp4l[963.090]: port 1: received DELAY_REQ without timestamp
Commit f2fb6b6275eb ("net: stmmac: enable timestamp snapshot for required PTP packets in dwmac v5.10a") already addresses this problem for the dwmac v5.10. However, same holds true for all dwmacs above version v4.10. Correct the check accordingly. Afterwards everything works as expected.
Tested on Intel Atom(R) x6414RE Processor.
--- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +1 -1
@@ -604,7 +604,7 @@ static int stmmac_hwtstamp_set(struct net_device *dev, struct ifreq *ifr) config.rx_filter =HWTSTAMP_FILTER_PTP_V2_EVENT ; ptp_v2 =PTP_TCR_TSVER2ENA ; snap_type_sel =PTP_TCR_SNAPTYPSEL_1 ; -if (priv->synopsys_id !=DWMAC_CORE_5_10 ) +if (priv->synopsys_id <DWMAC_CORE_4_10 ) ts_event_en =PTP_TCR_TSEVNTENA ; ptp_over_ipv4_udp =PTP_TCR_TSIPV4ENA ; ptp_over_ipv6_udp =PTP_TCR_TSIPV6ENA ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 18/58 net: enetc: fix ethtool counter name for PM0_TERR
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit fb8dc5fc8cbdfd62ecd16493848aee2f42ed84d9 ]
There are two counters named "MAC tx frames", one of them is actually incorrect. The correct name for that counter should be "MAC tx error frames", which is symmetric to the existing "MAC rx error frames".
--- drivers/net/ethernet/freescale/enetc/enetc_ethtool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/freescale/enetc/enetc_ethtool.c +1 -1
@@ -155,7 +155,7 @@ static const struct { { ENETC_PM0_TFRM, "MAC tx frames" }, { ENETC_PM0_TFCS, "MAC tx fcs errors" }, { ENETC_PM0_TVLAN, "MAC tx VLAN frames" }, - { ENETC_PM0_TERR, "MAC tx frames" }, + { ENETC_PM0_TERR, "MAC tx frame errors" }, { ENETC_PM0_TUCA, "MAC tx unicast frames" }, { ENETC_PM0_TMCA, "MAC tx multicast frames" }, { ENETC_PM0_TBCA, "MAC tx broadcast frames" },
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 19/58 can: rcar_can: fix suspend/resume
In reply to Greg Kroah-HartmanFrom: Yoshihiro Shimoda <[email protected]>
commit f7c05c3987dcfde9a4e8c2d533db013fabebca0d upstream.
If the driver was not opened, rcar_can_suspend() should not call clk_disable() because the clock was not enabled.
--- drivers/net/can/rcar/rcar_can.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-)
drivers/net/can/rcar/rcar_can.c +12 -8
@@ -848,10 +848,12 @@ static int __maybe_unused rcar_can_suspestruct rcar_can_priv *priv =netdev_priv (ndev);u16 ctlr; -if (netif_running (ndev)) { -netif_stop_queue (ndev); -netif_device_detach (ndev); - } +if (!netif_running (ndev)) +return 0 ; + +netif_stop_queue (ndev); +netif_device_detach (ndev); + ctlr =readw (&priv->regs->ctlr); ctlr |=RCAR_CAN_CTLR_CANM_HALT ;writew (ctlr, &priv->regs->ctlr);
@@ -870,6 +872,9 @@ static int __maybe_unused rcar_can_resumu16 ctlr;int err; +if (!netif_running (ndev)) +return 0 ; + err =clk_enable (priv->clk);if (err) {netdev_err (ndev,"clk_enable() failed, error %d\n" , err);
@@ -883,10 +888,9 @@ static int __maybe_unused rcar_can_resumwritew (ctlr, &priv->regs->ctlr); priv->can.state =CAN_STATE_ERROR_ACTIVE ; -if (netif_running (ndev)) { -netif_device_attach (ndev); -netif_start_queue (ndev); - } +netif_device_attach (ndev); +netif_start_queue (ndev); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 20/58 can: peak_usb: pcan_usb_fd_decode_status(): fix back to ERROR_ACTIVE state notification
In reply to Greg Kroah-HartmanFrom: Stephane Grosjean <[email protected]>
commit 3d031abc7e7249573148871180c28ecedb5e27df upstream.
This corrects the lack of notification of a return to ERROR_ACTIVE state for USB - CANFD devices from PEAK-System.
--- drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/can/usb/peak_usb/pcan_usb_fd.c +2 -3
@@ -551,11 +551,10 @@ static int pcan_usb_fd_decode_status(str }else if (sm->channel_p_w_b &PUCAN_BUS_WARNING ) { new_state =CAN_STATE_ERROR_WARNING ; }else { -/* no error bit (so, no error skb, back to active state) */ - dev->can.state =CAN_STATE_ERROR_ACTIVE ; +/* back to (or still in) ERROR_ACTIVE state */ + new_state =CAN_STATE_ERROR_ACTIVE ; pdev->bec.txerr =0 ; pdev->bec.rxerr =0 ; -return 0 ; }/* state hasn't changed */
Greg Kroah-Hartman
maintainerPATCH 21/58 can: peak_pci: peak_pci_remove(): fix UAF
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
commit 949fe9b35570361bc6ee2652f89a0561b26eec98 upstream.
When remove the module peek_pci, referencing 'chan' again after releasing 'dev' will cause UAF.
Fix this by releasing 'dev' later.
The following log reveals it:
[ 35.961814 ] BUG: KASAN: use-after-free in peak_pci_remove+0x16f/0x270 [peak_pci] [ 35.963414 ] Read of size 8 at addr ffff888136998ee8 by task modprobe/5537 [ 35.965513 ] Call Trace: [ 35.965718 ] dump_stack_lvl+0xa8/0xd1 [ 35.966028 ] print_address_description+0x87/0x3b0 [ 35.966420 ] kasan_report+0x172/0x1c0 [ 35.966725 ] ? peak_pci_remove+0x16f/0x270 [peak_pci] [ 35.967137 ] ? trace_irq_enable_rcuidle+0x10/0x170 [ 35.967529 ] ? peak_pci_remove+0x16f/0x270 [peak_pci] [ 35.967945 ] __asan_report_load8_noabort+0x14/0x20 [ 35.968346 ] peak_pci_remove+0x16f/0x270 [peak_pci] [ 35.968752 ] pci_device_remove+0xa9/0x250
--- drivers/net/can/sja1000/peak_pci.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/net/can/sja1000/peak_pci.c +4 -5
@@ -731,16 +731,15 @@ static void peak_pci_remove(struct pci_dstruct net_device *prev_dev = chan->prev_dev;dev_info (&pdev->dev,"removing device %s\n" , dev->name); +/* do that only for first channel */ +if (!prev_dev && chan->pciec_card) +peak_pciec_remove (chan->pciec_card);unregister_sja1000dev (dev);free_sja1000dev (dev); dev = prev_dev; -if (!dev) { -/* do that only for first channel */ -if (chan->pciec_card) -peak_pciec_remove (chan->pciec_card); +if (!dev)break ; - } priv =netdev_priv (dev); chan = priv->priv; }
Greg Kroah-Hartman
maintainerPATCH 22/58 can: j1939: j1939_tp_rxtimer(): fix errant alert in j1939_tp_rxtimer
In reply to Greg Kroah-HartmanFrom: Ziyang Xuan <[email protected]>
commit b504a884f6b5a77dac7d580ffa08e482f70d1a30 upstream.
When the session state is J1939_SESSION_DONE, j1939_tp_rxtimer() will give an alert "rx timeout, send abort", but do nothing actually. Move the alert into session active judgment condition, it is more reasonable.
One of the scenarios is that j1939_tp_rxtimer() execute followed by j1939_xtp_rx_abort_one(). After j1939_xtp_rx_abort_one(), the session state is J1939_SESSION_DONE, then j1939_tp_rxtimer() give an alert.
--- net/can/j1939/transport.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
net/can/j1939/transport.c +2 -3
@@ -1230,12 +1230,11 @@ static enum hrtimer_restart j1939_tp_rxt session->err = -ETIME ;j1939_session_deactivate (session); }else { -netdev_alert (priv->ndev,"%s: 0x%p: rx timeout, send abort\n" , - __func__, session); -j1939_session_list_lock (session->priv);if (session->state >=J1939_SESSION_ACTIVE && session->state <J1939_SESSION_ACTIVE_MAX ) { +netdev_alert (priv->ndev,"%s: 0x%p: rx timeout, send abort\n" , + __func__, session);j1939_session_get (session); hrtimer_start(&session->rxtimer, ms_to_ktime(J1939_XTP_ABORT_TIMEOUT_MS),
Greg Kroah-Hartman
maintainerPATCH 23/58 can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv
In reply to Greg Kroah-HartmanFrom: Ziyang Xuan <[email protected]>
commit d9d52a3ebd284882f5562c88e55991add5d01586 upstream.
It will trigger UAF for rx_kref of j1939_priv as following.
cpu0 cpu1j1939_sk_bind(socket0, ndev0, ...)j1939_netdev_start
j1939_sk_bind(socket1, ndev0, ...)
j1939_netdev_start
j1939_priv_set
j1939_priv_get_by_ndev_lockedj1939_jsk_add
.....j1939_netdev_stopkref_put_lock(&priv->rx_kref, ...)
kref_get(&priv->rx_kref, ...)
REFCOUNT_WARN("addition on 0;...")====================================================refcount_t: addition on 0; use-after-free.
WARNING: CPU: 1 PID: 20874 at lib/refcount.c:25 refcount_warn_saturate+0x169/0x1e0 RIP: 0010:refcount_warn_saturate+0x169/0x1e0 Call Trace: j1939_netdev_start+0x68b/0x920 j1939_sk_bind+0x426/0xeb0 ? security_socket_bind+0x83/0xb0
The rx_kref's kref_get() and kref_put() should use j1939_netdev_lock to protect.
--- net/can/j1939/main.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
net/can/j1939/main.c +5 -2
@@ -249,11 +249,14 @@ struct j1939_priv *j1939_netdev_start(ststruct j1939_priv *priv, *priv_new;int ret; - priv =j1939_priv_get_by_ndev (ndev); +spin_lock (&j1939_netdev_lock); + priv =j1939_priv_get_by_ndev_locked (ndev);if (priv) {kref_get (&priv->rx_kref); +spin_unlock (&j1939_netdev_lock);return priv; } +spin_unlock (&j1939_netdev_lock); priv =j1939_priv_create (ndev);if (!priv)
@@ -269,10 +272,10 @@ struct j1939_priv *j1939_netdev_start(st/* Someone was faster than us, use their priv and roll * back our's. */ +kref_get (&priv_new->rx_kref);spin_unlock (&j1939_netdev_lock);dev_put (ndev);kfree (priv); -kref_get (&priv_new->rx_kref);return priv_new; }j1939_priv_set (ndev, priv);
Greg Kroah-Hartman
maintainerPATCH 24/58 can: j1939: j1939_xtp_rx_dat_one(): cancel session if receive TP.DT with error length
In reply to Greg Kroah-HartmanFrom: Zhang Changzhong <[email protected]>
commit 379743985ab6cfe2cbd32067cf4ed497baca6d06 upstream.
According to SAE-J1939-21, the data length of TP.DT must be 8 bytes, so cancel session when receive unexpected TP.DT message.
--- net/can/j1939/transport.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
net/can/j1939/transport.c +5 -2
@@ -1770,6 +1770,7 @@ static void j1939_xtp_rx_dpo(struct j193static void j1939_xtp_rx_dat_one (struct j1939_session *session,struct sk_buff *skb) { +enum j1939_xtp_abort abort =J1939_XTP_ABORT_FAULT ;struct j1939_priv *priv = session->priv;struct j1939_sk_buff_cb *skcb;struct sk_buff *se_skb =NULL ;
@@ -1784,9 +1785,11 @@ static void j1939_xtp_rx_dat_one(struct skcb =j1939_skb_to_cb (skb); dat = skb->data; -if (skb->len <=1 ) +if (skb->len !=8 ) {/* makes no sense */ + abort =J1939_XTP_ABORT_UNEXPECTED_DATA ; goto out_session_cancel; + }switch (session->last_cmd) {case 0xff :
@@ -1884,7 +1887,7 @@ static void j1939_xtp_rx_dat_one(struct out_session_cancel:kfree_skb (se_skb);j1939_session_timers_cancel (session); -j1939_session_cancel (session,J1939_XTP_ABORT_FAULT ); +j1939_session_cancel (session, abort);j1939_session_put (session); }
Greg Kroah-Hartman
maintainerPATCH 25/58 can: j1939: j1939_xtp_rx_rts_session_new(): abort TP less than 9 bytes
In reply to Greg Kroah-HartmanFrom: Zhang Changzhong <[email protected]>
commit a4fbe70c5cb746441d56b28cf88161d9e0e25378 upstream.
The receiver should abort TP if 'total message size' in TP.CM_RTS and TP.CM_BAM is less than 9 or greater than 1785 [1], but currently the j1939 stack only checks the upper bound and the receiver will accept the following broadcast message:
vcan1 18ECFF00 [8] 20 08 00 02 FF 00 23 01 vcan1 18EBFF00 [8] 01 00 00 00 00 00 00 00 vcan1 18EBFF00 [8] 02 00 FF FF FF FF FF FF
This patch adds check for the lower bound and abort illegal TP.
[1] SAE-J1939-82 A.3.4 Row 2 and A.3.6 Row 6.
--- net/can/j1939/j1939-priv.h | 1 + net/can/j1939/transport.c | 2 ++ 2 files changed, 3 insertions(+)
net/can/j1939/j1939-priv.h +1 -0
@@ -326,6 +326,7 @@ int j1939_session_activate(struct j1939_void j1939_tp_schedule_txtimer (struct j1939_session *session,int msec);void j1939_session_timers_cancel (struct j1939_session *session); +#define J1939_MIN_TP_PACKET_SIZE 9#define J1939_MAX_TP_PACKET_SIZE (7 * 0xff)#define J1939_MAX_ETP_PACKET_SIZE (7 * 0x00ffffff)
net/can/j1939/transport.c +2 -0
@@ -1596,6 +1596,8 @@ j1939_session *j1939_xtp_rx_rts_session_ abort =J1939_XTP_ABORT_FAULT ; else if (len > priv->tp_max_packet_size) abort =J1939_XTP_ABORT_RESOURCE ; + else if (len < J1939_MIN_TP_PACKET_SIZE) + abort =J1939_XTP_ABORT_FAULT ; }if (abort !=J1939_XTP_NO_ABORT ) {
Greg Kroah-Hartman
maintainerPATCH 26/58 ceph: fix handling of "meta" errors
In reply to Greg Kroah-HartmanFrom: Jeff Layton <[email protected]>
commit 1bd85aa65d0e7b5e4d09240f492f37c569fdd431 upstream.
Currently, we check the wb_err too early for directories, before all of the unsafe child requests have been waited on. In order to fix that we need to check the mapping->wb_err later nearer to the end of ceph_fsync.
We also have an overly-complex method for tracking errors after blocklisting. The errors recorded in cleanup_session_requests go to a completely separate field in the inode, but we end up reporting them the same way we would for any other error (in fsync).
There's no real benefit to tracking these errors in two different places, since the only reporting mechanism for them is in fsync, and we'd need to advance them both every time.
Given that, we can just remove i_meta_err, and convert the places that used it to instead just use mapping->wb_err instead. That also fixes the original problem by ensuring that we do a check_and_advance of the wb_err at the end of the fsync op.
Cc: [email protected]
URL: https://tracker.ceph.com/issues/52864
--- fs/ceph/caps.c | 12 +++--------- fs/ceph/file.c | 1 - fs/ceph/inode.c | 2 -- fs/ceph/mds_client.c | 17 +++++------------ fs/ceph/super.h | 3 --- 5 files changed, 8 insertions(+), 27 deletions(-)
fs/ceph/caps.c +3 -9
@@ -2249,7 +2249,6 @@ static int unsafe_request_wait(struct inint ceph_fsync (struct file *file,loff_t start,loff_t end,int datasync) { -struct ceph_file_info *fi = file->private_data;struct inode *inode = file->f_mapping->host;struct ceph_inode_info *ci =ceph_inode (inode);u64 flush_tid;
@@ -2280,14 +2279,9 @@ int ceph_fsync(struct file *file, loff_tif (err <0 ) ret = err; -if (errseq_check (&ci->i_meta_err,READ_ONCE (fi->meta_err))) { -spin_lock (&file->f_lock); - err =errseq_check_and_advance (&ci->i_meta_err, - &fi->meta_err); -spin_unlock (&file->f_lock); -if (err <0 ) - ret = err; - } + err =file_check_and_advance_wb_err (file); +if (err <0 ) + ret = err; out:dout ("fsync %p%s result=%d\n" , inode, datasync ?" datasync" :"" , ret);return ret;
fs/ceph/file.c +0 -1
@@ -234,7 +234,6 @@ static int ceph_init_file_info(struct in fi->fmode = fmode;spin_lock_init (&fi->rw_contexts_lock);INIT_LIST_HEAD (&fi->rw_contexts); - fi->meta_err =errseq_sample (&ci->i_meta_err); fi->filp_gen =READ_ONCE (ceph_inode_to_client (inode)->filp_gen);return 0 ;
fs/ceph/inode.c +0 -2
@@ -515,8 +515,6 @@ struct inode *ceph_alloc_inode(struct suceph_fscache_inode_init (ci); - ci->i_meta_err =0 ; -return &ci->vfs_inode; }
fs/ceph/mds_client.c +5 -12
@@ -1272,7 +1272,6 @@ static void cleanup_session_requests(str {struct ceph_mds_request *req;struct rb_node *p; -struct ceph_inode_info *ci;dout ("cleanup_session_requests mds%d\n" , session->s_mds);mutex_lock (&mdsc->mutex);
@@ -1281,16 +1280,10 @@ static void cleanup_session_requests(str struct ceph_mds_request, r_unsafe_item);pr_warn_ratelimited (" dropping unsafe request %llu\n" , req->r_tid); -if (req->r_target_inode) { -/* dropping unsafe change of inode's attributes */ - ci =ceph_inode (req->r_target_inode); -errseq_set (&ci->i_meta_err, -EIO ); - } -if (req->r_unsafe_dir) { -/* dropping unsafe directory operation */ - ci =ceph_inode (req->r_unsafe_dir); -errseq_set (&ci->i_meta_err, -EIO ); - } +if (req->r_target_inode) +mapping_set_error (req->r_target_inode->i_mapping, -EIO ); +if (req->r_unsafe_dir) +mapping_set_error (req->r_unsafe_dir->i_mapping, -EIO );__unregister_request (mdsc, req); }/* zero r_attempts, so kick_requests() will re-send requests */
@@ -1436,7 +1429,7 @@ static int remove_session_caps_cb(structspin_unlock (&mdsc->cap_dirty_lock);if (dirty_dropped) { -errseq_set (&ci->i_meta_err, -EIO ); +mapping_set_error (inode->i_mapping, -EIO ); if (ci->i_wrbuffer_ref_head == 0 && ci->i_wr_ref == 0 &&
fs/ceph/super.h +0 -3
@@ -402,8 +402,6 @@ struct ceph_inode_info {struct fscache_cookie *fscache;u32 i_fscache_gen;#endif -errseq_t i_meta_err; -struct inode vfs_inode;/* at end */ };
@@ -712,7 +710,6 @@ struct ceph_file_info {spinlock_t rw_contexts_lock;struct list_head rw_contexts; -errseq_t meta_err;u32 filp_gen;atomic_t num_locks; };
Greg Kroah-Hartman
maintainerPATCH 27/58 ocfs2: fix data corruption after conversion from inline format
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
commit 5314454ea3ff6fc746eaf71b9a7ceebed52888fa upstream.
Commit 6dbf7bb55598 ("fs: Don't invalidate page buffers in block_write_full_page()") uncovered a latent bug in ocfs2 conversion from inline inode format to a normal inode format.
The code in ocfs2_convert_inline_data_to_extents() attempts to zero out the whole cluster allocated for file data by grabbing, zeroing, and dirtying all pages covering this cluster. However these pages are beyond i_size, thus writeback code generally ignores these dirty pages and no blocks were ever actually zeroed on the disk.
This oversight was fixed by commit 693c241a5f6a ("ocfs2: No need to zero pages past i_size.") for standard ocfs2 write path, inline conversion path was apparently forgotten; the commit log also has a reasoning why the zeroing actually is not needed.
After commit 6dbf7bb55598, things became worse as writeback code stopped invalidating buffers on pages beyond i_size and thus these pages end up with clean PageDirty bit but with buffers attached to these pages being still dirty. So when a file is converted from inline format, then writeback triggers, and then the file is grown so that these pages become valid, the invalid dirtiness state is preserved, mark_buffer_dirty() does nothing on these pages (buffers are already dirty) but page is never written back because it is clean. So data written to these pages is lost once pages are reclaimed.
Simple reproducer for the problem is:
xfs_io -f -c "pwrite 0 2000" -c "pwrite 2000 2000" -c "fsync" \
-c "pwrite 4000 2000" ocfs2_fileAfter unmounting and mounting the fs again, you can observe that end of 'ocfs2_file' has lost its contents.
Fix the problem by not doing the pointless zeroing during conversion from inline format similarly as in the standard write path.
[[email protected]: fix whitespace, per Joseph]
--- fs/ocfs2/alloc.c | 46 ++++++++++++---------------------------------- 1 file changed, 12 insertions(+), 34 deletions(-)
fs/ocfs2/alloc.c +12 -34
@@ -7048,7 +7048,7 @@ void ocfs2_set_inode_data_inline(structint ocfs2_convert_inline_data_to_extents (struct inode *inode,struct buffer_head *di_bh) { -int ret, i, has_data, num_pages =0 ; +int ret, has_data, num_pages =0 ;int need_free =0 ;u32 bit_off, num;handle_t *handle;
@@ -7057,26 +7057,17 @@ int ocfs2_convert_inline_data_to_extentsstruct ocfs2_super *osb =OCFS2_SB (inode->i_sb);struct ocfs2_dinode *di = (struct ocfs2_dinode *)di_bh->b_data;struct ocfs2_alloc_context *data_ac =NULL ; -struct page **pages =NULL ; -loff_t end = osb->s_clustersize; +struct page *page =NULL ;struct ocfs2_extent_tree et;int did_quota =0 ; has_data =i_size_read (inode) ?1 :0 ;if (has_data) { - pages =kcalloc (ocfs2_pages_per_cluster (osb->sb), -sizeof (struct page *),GFP_NOFS ); -if (pages ==NULL ) { - ret = -ENOMEM ; -mlog_errno (ret); -return ret; - } - ret =ocfs2_reserve_clusters (osb,1 , &data_ac);if (ret) {mlog_errno (ret); - goto free_pages; + goto out; } }
@@ -7096,7 +7087,8 @@ int ocfs2_convert_inline_data_to_extents }if (has_data) { -unsigned int page_end; +unsigned int page_end =min_t (unsigned,PAGE_SIZE , + osb->s_clustersize);u64 phys; ret = dquot_alloc_space_nodirty(inode,
@@ -7120,15 +7112,8 @@ int ocfs2_convert_inline_data_to_extents*/ block = phys =ocfs2_clusters_to_blocks (inode->i_sb, bit_off); -/* -* Non sparse file systems zero on extend, so no need -* to do that now. -*/ -if (!ocfs2_sparse_alloc (osb) && -PAGE_SIZE < osb->s_clustersize) - end =PAGE_SIZE ; - - ret =ocfs2_grab_eof_pages (inode,0 , end, pages, &num_pages); + ret =ocfs2_grab_eof_pages (inode,0 , page_end, &page, + &num_pages);if (ret) {mlog_errno (ret); need_free =1 ;
@@ -7139,20 +7124,15 @@ int ocfs2_convert_inline_data_to_extents* This should populate the 1st page for us and mark * it up to date. */ - ret =ocfs2_read_inline_data (inode, pages[0 ], di_bh); + ret =ocfs2_read_inline_data (inode, page, di_bh);if (ret) {mlog_errno (ret); need_free =1 ; goto out_unlock; } - page_end =PAGE_SIZE ; -if (PAGE_SIZE > osb->s_clustersize) - page_end = osb->s_clustersize; - -for (i =0 ; i < num_pages; i++) -ocfs2_map_and_dirty_page (inode, handle,0 , page_end, - pages[i], i >0 , &phys); +ocfs2_map_and_dirty_page (inode, handle,0 , page_end, page,0 , + &phys); }spin_lock (&oi->ip_lock);
@@ -7183,8 +7163,8 @@ int ocfs2_convert_inline_data_to_extents } out_unlock: -if (pages) -ocfs2_unlock_and_free_pages (pages, num_pages); +if (page) +ocfs2_unlock_and_free_pages (&page, num_pages); out_commit:if (ret <0 && did_quota)
@@ -7208,8 +7188,6 @@ out_commit: out:if (data_ac)ocfs2_free_alloc_context (data_ac); -free_pages: -kfree (pages);return ret; }
Greg Kroah-Hartman
maintainerPATCH 28/58 ocfs2: mount fails with buffer overflow in strlen
In reply to Greg Kroah-HartmanFrom: Valentin Vidic <[email protected]>
commit b15fa9224e6e1239414525d8d556d824701849fc upstream.
Starting with kernel 5.11 built with CONFIG_FORTIFY_SOURCE mouting an ocfs2 filesystem with either o2cb or pcmk cluster stack fails with the trace below. Problem seems to be that strings for cluster stack and cluster name are not guaranteed to be null terminated in the disk representation, while strlcpy assumes that the source string is always null terminated. This causes a read outside of the source string triggering the buffer overflow detection.
detected buffer overflow in strlen
------------[ cut here ]------------
kernel BUG at lib/string.c:1149!
invalid opcode: 0000 [#1] SMP PTI
CPU: 1 PID: 910 Comm: mount.ocfs2 Not tainted 5.14.0-1-amd64 #1
Debian 5.14.6-2
RIP: 0010:fortify_panic+0xf/0x11
...
Call Trace:
ocfs2_initialize_super.isra.0.cold+0xc/0x18 [ocfs2]
ocfs2_fill_super+0x359/0x19b0 [ocfs2]
mount_bdev+0x185/0x1b0
legacy_get_tree+0x27/0x40
vfs_get_tree+0x25/0xb0
path_mount+0x454/0xa20
__x64_sys_mount+0x103/0x140
do_syscall_64+0x3b/0xc0
entry_SYSCALL_64_after_hwframe+0x44/0xae--- fs/ocfs2/super.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
fs/ocfs2/super.c +10 -4
@@ -2150,11 +2150,17 @@ static int ocfs2_initialize_super(struct }if (ocfs2_clusterinfo_valid (osb)) { +/* +* ci_stack and ci_cluster in ocfs2_cluster_info may not be null +* terminated, so make sure no overflow happens here by using +* memcpy. Destination strings will always be null terminated +* because osb is allocated using kzalloc. +*/ osb->osb_stackflags =OCFS2_RAW_SB (di)->s_cluster_info.ci_stackflags; -strlcpy (osb->osb_cluster_stack, +memcpy (osb->osb_cluster_stack,OCFS2_RAW_SB (di)->s_cluster_info.ci_stack, -OCFS2_STACK_LABEL_LEN +1 ); +OCFS2_STACK_LABEL_LEN );if (strlen (osb->osb_cluster_stack) !=OCFS2_STACK_LABEL_LEN ) {mlog (ML_ERROR , "couldn't mount because of an invalid "
@@ -2163,9 +2169,9 @@ static int ocfs2_initialize_super(struct status = -EINVAL ; goto bail; } -strlcpy (osb->osb_cluster_name, +memcpy (osb->osb_cluster_name,OCFS2_RAW_SB (di)->s_cluster_info.ci_cluster, -OCFS2_CLUSTER_NAME_LEN +1 ); +OCFS2_CLUSTER_NAME_LEN ); }else {/* The empty string is identical with classic tools that * don't know about s_cluster_info. */
Greg Kroah-Hartman
maintainerPATCH 29/58 elfcore: correct reference to CONFIG_UML
In reply to Greg Kroah-HartmanFrom: Lukas Bulwahn <[email protected]>
commit b0e901280d9860a0a35055f220e8e457f300f40a upstream.
Commit 6e7b64b9dd6d ("elfcore: fix building with clang") introduces special handling for two architectures, ia64 and User Mode Linux. However, the wrong name, i.e., CONFIG_UM, for the intended Kconfig symbol for User-Mode Linux was used.
Although the directory for User Mode Linux is ./arch/um; the Kconfig symbol for this architecture is called CONFIG_UML.
Luckily, ./scripts/checkkconfigsymbols.py warns on non-existing configs:
UM
Referencing files: include/linux/elfcore.h
Similar symbols: UML, NUMA
Correct the name of the config to the intended one.
--- include/linux/elfcore.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/elfcore.h +1 -1
@@ -58,7 +58,7 @@ static inline int elf_core_copy_task_xfp }#endif -#if defined(CONFIG_UM ) || defined(CONFIG_IA64 ) +#if (defined(CONFIG_UML ) && defined(CONFIG_X86_32 )) || defined(CONFIG_IA64 )/* * These functions parameterize elf_core_dump in fs/binfmt_elf.c to write out * extra segments containing the gate DSO contents. Dumping its
Greg Kroah-Hartman
maintainerPATCH 30/58 vfs: check fd has read access in kernel_read_file_from_fd()
In reply to Greg Kroah-HartmanFrom: Matthew Wilcox (Oracle) <[email protected]>
commit 032146cda85566abcd1c4884d9d23e4e30a07e9a upstream.
If we open a file without read access and then pass the fd to a syscall whose implementation calls kernel_read_file_from_fd(), we get a warning from __kernel_read():
if (WARN_ON_ONCE(!(file->f_mode & FMODE_READ)))
This currently affects both finit_module() and kexec_file_load(), but it could affect other syscalls in the future.
--- fs/exec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/exec.c +1 -1
@@ -988,7 +988,7 @@ int kernel_read_file_from_fd(int fd, voistruct fd f =fdget (fd);int ret = -EBADF ; -if (!f.file) +if (!f.file || !(f.file->f_mode &FMODE_READ )) goto out; ret =kernel_read_file (f.file, buf, size, max_size, id);
Greg Kroah-Hartman
maintainerPATCH 31/58 ALSA: usb-audio: Provide quirk for Sennheiser GSP670 Headset
In reply to Greg Kroah-HartmanFrom: Brendan Grieve <[email protected]>
commit 3c414eb65c294719a91a746260085363413f91c1 upstream.
As per discussion at: https://github.com/szszoke/sennheiser-gsp670-pulseaudio-profile/issues/13
The GSP670 has 2 playback and 1 recording device that by default are detected in an incompatible order for alsa. This may have been done to make it compatible for the console by the manufacturer and only affects the latest firmware which uses its own ID.
This quirk will resolve this by reordering the channels.
--- sound/usb/quirks-table.h | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+)
sound/usb/quirks-table.h +32 -0
@@ -3806,5 +3806,37 @@ ALC1220_VB_DESKTOP(0x26ce, 0x0a01), /* A } } }, +{ +/* +* Sennheiser GSP670 +* Change order of interfaces loaded +*/ + USB_DEVICE(0x1395, 0x0300), + .bInterfaceClass = USB_CLASS_PER_INTERFACE, + .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + .ifnum =QUIRK_ANY_INTERFACE , + .type =QUIRK_COMPOSITE , + .data = &(const struct snd_usb_audio_quirk []) { +// Communication + { + .ifnum =3 , + .type =QUIRK_AUDIO_STANDARD_INTERFACE + }, +// Recording + { + .ifnum =4 , + .type =QUIRK_AUDIO_STANDARD_INTERFACE + }, +// Main + { + .ifnum =1 , + .type =QUIRK_AUDIO_STANDARD_INTERFACE + }, + { + .ifnum =-1 + } + } + } +}, #undef USB_DEVICE_VENDOR_SPEC
Greg Kroah-Hartman
maintainerPATCH 32/58 ALSA: hda/realtek: Add quirk for Clevo PC50HS
In reply to Greg Kroah-HartmanFrom: Steven Clarkson <[email protected]>
commit aef454b40288158b850aab13e3d2a8c406779401 upstream.
Apply existing PCI quirk to the Clevo PC50HS and related models to fix audio output on the built in speakers.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -2537,6 +2537,7 @@ static const struct snd_pci_quirk alc882SND_PCI_QUIRK (0x1558 ,0x65d2 ,"Clevo PB51R[CDF]" ,ALC1220_FIXUP_CLEVO_PB51ED_PINS ),SND_PCI_QUIRK (0x1558 ,0x65e1 ,"Clevo PB51[ED][DF]" ,ALC1220_FIXUP_CLEVO_PB51ED_PINS ),SND_PCI_QUIRK (0x1558 ,0x65e5 ,"Clevo PC50D[PRS](?:-D|-G)?" ,ALC1220_FIXUP_CLEVO_PB51ED_PINS ), +SND_PCI_QUIRK (0x1558 ,0x65f1 ,"Clevo PC50HS" ,ALC1220_FIXUP_CLEVO_PB51ED_PINS ),SND_PCI_QUIRK (0x1558 ,0x67d1 ,"Clevo PB71[ER][CDF]" ,ALC1220_FIXUP_CLEVO_PB51ED_PINS ),SND_PCI_QUIRK (0x1558 ,0x67e1 ,"Clevo PB71[DE][CDF]" ,ALC1220_FIXUP_CLEVO_PB51ED_PINS ), SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP_CLEVO_PB51ED_PINS),
Greg Kroah-Hartman
maintainerPATCH 33/58 ASoC: DAPM: Fix missing kctl change notifications
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 5af82c81b2c49cfb1cad84d9eb6eab0e3d1c4842 upstream.
The put callback of a kcontrol is supposed to return 1 when the value is changed, and this will be notified to user-space. However, some DAPM kcontrols always return 0 (except for errors), hence the user-space misses the update of a control value.
This patch corrects the behavior by properly returning 1 when the value gets updated.
--- sound/soc/soc-dapm.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
sound/soc/soc-dapm.c +8 -5
@@ -2546,6 +2546,7 @@ static int snd_soc_dapm_set_pin(struct s const char *pin, int status) {struct snd_soc_dapm_widget *w =dapm_find_widget (dapm, pin, true); +int ret =0 ;dapm_assert_locked (dapm);
@@ -2558,13 +2559,14 @@ static int snd_soc_dapm_set_pin(struct sdapm_mark_dirty (w,"pin configuration" );dapm_widget_invalidate_input_paths (w);dapm_widget_invalidate_output_paths (w); + ret =1 ; } w->connected = status;if (status ==0 ) w->force =0 ; -return 0 ; +return ret; }/**
@@ -3580,14 +3582,15 @@ int snd_soc_dapm_put_pin_switch(struct s {struct snd_soc_card *card =snd_kcontrol_chip (kcontrol);const char *pin = (const char *)kcontrol->private_value; +int ret;if (ucontrol->value.integer.value[0 ]) -snd_soc_dapm_enable_pin (&card->dapm, pin); + ret =snd_soc_dapm_enable_pin (&card->dapm, pin);else -snd_soc_dapm_disable_pin (&card->dapm, pin); + ret =snd_soc_dapm_disable_pin (&card->dapm, pin);snd_soc_dapm_sync (&card->dapm); -return 0 ; +return ret; }EXPORT_SYMBOL_GPL (snd_soc_dapm_put_pin_switch);
@@ -4029,7 +4032,7 @@ static int snd_soc_dapm_dai_link_put(str rtd->params_select = ucontrol->value.enumerated.item[0 ]; -return 0 ; +return 1 ; } static void
Greg Kroah-Hartman
maintainerPATCH 34/58 audit: fix possible null-pointer dereference in audit_filter_rules
In reply to Greg Kroah-HartmanFrom: Gaosheng Cui <[email protected]>
commit 6e3ee990c90494561921c756481d0e2125d8b895 upstream.
Fix possible null-pointer dereference in audit_filter_rules.
audit_filter_rules() error: we previously assumed 'ctx' could be null
--- kernel/auditsc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/auditsc.c +1 -1
@@ -624,7 +624,7 @@ static int audit_filter_rules(struct tas result =audit_comparator (audit_loginuid_set (tsk), f->op, f->val);break ;case AUDIT_SADDR_FAM : -if (ctx->sockaddr) +if (ctx && ctx->sockaddr) result =audit_comparator (ctx->sockaddr->ss_family, f->op, f->val);break ;
Greg Kroah-Hartman
maintainerPATCH 35/58 powerpc64/idle: Fix SP offsets when saving GPRs
In reply to Greg Kroah-HartmanFrom: Christopher M. Riedl <[email protected]>
commit 73287caa9210ded6066833195f4335f7f688a46b upstream.
The idle entry/exit code saves/restores GPRs in the stack "red zone" (Protected Zone according to PowerPC64 ELF ABI v2). However, the offset used for the first GPR is incorrect and overwrites the back chain - the Protected Zone actually starts below the current SP. In practice this is probably not an issue, but it's still incorrect so fix it.
Also expand the comments to explain why using the stack "red zone" instead of creating a new stackframe is appropriate here.
--- arch/powerpc/kernel/idle_book3s.S | 138 ++++++++++++++++++++------------------ 1 file changed, 73 insertions(+), 65 deletions(-)
arch/powerpc/kernel/idle_book3s.S +73 -65
@@ -50,28 +50,32 @@ _GLOBAL(isa300_idle_stop_mayloss) std r1,PACAR1(r13) mflr r4 mfcr r5 - /* use stack red zone rather than a new frame for saving regs */ - std r2,-8*0(r1) - std r14,-8*1(r1) - std r15,-8*2(r1) - std r16,-8*3(r1) - std r17,-8*4(r1) - std r18,-8*5(r1) - std r19,-8*6(r1) - std r20,-8*7(r1) - std r21,-8*8(r1) - std r22,-8*9(r1) - std r23,-8*10(r1) - std r24,-8*11(r1) - std r25,-8*12(r1) - std r26,-8*13(r1) - std r27,-8*14(r1) - std r28,-8*15(r1) - std r29,-8*16(r1) - std r30,-8*17(r1) - std r31,-8*18(r1) - std r4,-8*19(r1) - std r5,-8*20(r1) + /* + * Use the stack red zone rather than a new frame for saving regs since + * in the case of no GPR loss the wakeup code branches directly back to + * the caller without deallocating the stack frame first. + */ + std r2,-8*1(r1) + std r14,-8*2(r1) + std r15,-8*3(r1) + std r16,-8*4(r1) + std r17,-8*5(r1) + std r18,-8*6(r1) + std r19,-8*7(r1) + std r20,-8*8(r1) + std r21,-8*9(r1) + std r22,-8*10(r1) + std r23,-8*11(r1) + std r24,-8*12(r1) + std r25,-8*13(r1) + std r26,-8*14(r1) + std r27,-8*15(r1) + std r28,-8*16(r1) + std r29,-8*17(r1) + std r30,-8*18(r1) + std r31,-8*19(r1) + std r4,-8*20(r1) + std r5,-8*21(r1) /* 168 bytes */ PPC_STOP b . /* catch bugs */
@@ -87,8 +91,8 @@ _GLOBAL(isa300_idle_stop_mayloss) */ _GLOBAL(idle_return_gpr_loss) ld r1,PACAR1(r13) - ld r4,-8*19(r1) - ld r5,-8*20(r1) + ld r4,-8*20(r1) + ld r5,-8*21(r1) mtlr r4 mtcr r5 /*
@@ -96,25 +100,25 @@ _GLOBAL(idle_return_gpr_loss) * from PACATOC. This could be avoided for that less common case * if KVM saved its r2. */ - ld r2,-8*0(r1) - ld r14,-8*1(r1) - ld r15,-8*2(r1) - ld r16,-8*3(r1) - ld r17,-8*4(r1) - ld r18,-8*5(r1) - ld r19,-8*6(r1) - ld r20,-8*7(r1) - ld r21,-8*8(r1) - ld r22,-8*9(r1) - ld r23,-8*10(r1) - ld r24,-8*11(r1) - ld r25,-8*12(r1) - ld r26,-8*13(r1) - ld r27,-8*14(r1) - ld r28,-8*15(r1) - ld r29,-8*16(r1) - ld r30,-8*17(r1) - ld r31,-8*18(r1) + ld r2,-8*1(r1) + ld r14,-8*2(r1) + ld r15,-8*3(r1) + ld r16,-8*4(r1) + ld r17,-8*5(r1) + ld r18,-8*6(r1) + ld r19,-8*7(r1) + ld r20,-8*8(r1) + ld r21,-8*9(r1) + ld r22,-8*10(r1) + ld r23,-8*11(r1) + ld r24,-8*12(r1) + ld r25,-8*13(r1) + ld r26,-8*14(r1) + ld r27,-8*15(r1) + ld r28,-8*16(r1) + ld r29,-8*17(r1) + ld r30,-8*18(r1) + ld r31,-8*19(r1) blr /*
@@ -152,28 +156,32 @@ _GLOBAL(isa206_idle_insn_mayloss) std r1,PACAR1(r13) mflr r4 mfcr r5 - /* use stack red zone rather than a new frame for saving regs */ - std r2,-8*0(r1) - std r14,-8*1(r1) - std r15,-8*2(r1) - std r16,-8*3(r1) - std r17,-8*4(r1) - std r18,-8*5(r1) - std r19,-8*6(r1) - std r20,-8*7(r1) - std r21,-8*8(r1) - std r22,-8*9(r1) - std r23,-8*10(r1) - std r24,-8*11(r1) - std r25,-8*12(r1) - std r26,-8*13(r1) - std r27,-8*14(r1) - std r28,-8*15(r1) - std r29,-8*16(r1) - std r30,-8*17(r1) - std r31,-8*18(r1) - std r4,-8*19(r1) - std r5,-8*20(r1) + /* + * Use the stack red zone rather than a new frame for saving regs since + * in the case of no GPR loss the wakeup code branches directly back to + * the caller without deallocating the stack frame first. + */ + std r2,-8*1(r1) + std r14,-8*2(r1) + std r15,-8*3(r1) + std r16,-8*4(r1) + std r17,-8*5(r1) + std r18,-8*6(r1) + std r19,-8*7(r1) + std r20,-8*8(r1) + std r21,-8*9(r1) + std r22,-8*10(r1) + std r23,-8*11(r1) + std r24,-8*12(r1) + std r25,-8*13(r1) + std r26,-8*14(r1) + std r27,-8*15(r1) + std r28,-8*16(r1) + std r29,-8*17(r1) + std r30,-8*18(r1) + std r31,-8*19(r1) + std r4,-8*20(r1) + std r5,-8*21(r1) cmpwi r3,PNV_THREAD_NAP bne 1f IDLE_STATE_ENTER_SEQ_NORET(PPC_NAP)
Greg Kroah-Hartman
maintainerPATCH 36/58 KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
commit 9b4416c5095c20e110c82ae602c254099b83b72f upstream.
In commit 10d91611f426 ("powerpc/64s: Reimplement book3s idle code in C") kvm_start_guest() became idle_kvm_start_guest(). The old code allocated a stack frame on the emergency stack, but didn't use the frame to store anything, and also didn't store anything in its caller's frame.
idle_kvm_start_guest() on the other hand is written more like a normal C function, it creates a frame on entry, and also stores CR/LR into its callers frame (per the ABI). The problem is that there is no caller frame on the emergency stack.
The emergency stack for a given CPU is allocated with:
paca_ptrs[i]->emergency_sp = alloc_stack(limit, i) + THREAD_SIZE;
So emergency_sp actually points to the first address above the emergency stack allocation for a given CPU, we must not store above it without first decrementing it to create a frame. This is different to the regular kernel stack, paca->kstack, which is initialised to point at an initial frame that is ready to use.
idle_kvm_start_guest() stores the backchain, CR and LR all of which write outside the allocation for the emergency stack. It then creates a stack frame and saves the non-volatile registers. Unfortunately the frame it creates is not large enough to fit the non-volatiles, and so the saving of the non-volatile registers also writes outside the emergency stack allocation.
The end result is that we corrupt whatever is at 0-24 bytes, and 112-248 bytes above the emergency stack allocation.
In practice this has gone unnoticed because the memory immediately above the emergency stack happens to be used for other stack allocations, either another CPUs mc_emergency_sp or an IRQ stack. See the order of calls to irqstack_early_init() and emergency_stack_init().
The low addresses of another stack are the top of that stack, and so are only used if that stack is under extreme pressue, which essentially never happens in practice - and if it did there's a high likelyhood we'd crash due to that stack overflowing.
Still, we shouldn't be corrupting someone else's stack, and it is purely luck that we aren't corrupting something else.
To fix it we save CR/LR into the caller's frame using the existing r1 on entry, we then create a SWITCH_FRAME_SIZE frame (which has space for pt_regs) on the emergency stack with the backchain pointing to the existing stack, and then finally we switch to the new frame on the emergency stack.
--- arch/powerpc/kvm/book3s_hv_rmhandlers.S | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
arch/powerpc/kvm/book3s_hv_rmhandlers.S +10 -9
@@ -292,13 +292,15 @@ kvm_novcpu_exit: * r3 contains the SRR1 wakeup value, SRR1 is trashed. */ _GLOBAL(idle_kvm_start_guest) - ld r4,PACAEMERGSP(r13) mfcr r5 mflr r0 - std r1,0(r4) - std r5,8(r4) - std r0,16(r4) - subi r1,r4,STACK_FRAME_OVERHEAD + std r5, 8(r1) // Save CR in caller's frame + std r0, 16(r1) // Save LR in caller's frame + // Create frame on emergency stack + ld r4, PACAEMERGSP(r13) + stdu r1, -SWITCH_FRAME_SIZE(r4) + // Switch to new frame on emergency stack + mr r1, r4 SAVE_NVGPRS(r1) /*
@@ -444,10 +446,9 @@ kvm_no_guest: /* set up r3 for return */ mfspr r3,SPRN_SRR1 REST_NVGPRS(r1) - addi r1, r1, STACK_FRAME_OVERHEAD - ld r0, 16(r1) - ld r5, 8(r1) - ld r1, 0(r1) + ld r1, 0(r1) // Switch back to caller stack + ld r0, 16(r1) // Reload LR + ld r5, 8(r1) // Reload CR mtlr r0 mtcr r5 blr
Greg Kroah-Hartman
maintainerPATCH 37/58 KVM: PPC: Book3S HV: Make idle_kvm_start_guest() return 0 if it went to guest
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
commit cdeb5d7d890e14f3b70e8087e745c4a6a7d9f337 upstream.
We call idle_kvm_start_guest() from power7_offline() if the thread has been requested to enter KVM. We pass it the SRR1 value that was returned from power7_idle_insn() which tells us what sort of wakeup we're processing.
Depending on the SRR1 value we pass in, the KVM code might enter the guest, or it might return to us to do some host action if the wakeup requires it.
If idle_kvm_start_guest() is able to handle the wakeup, and enter the guest it is supposed to indicate that by returning a zero SRR1 value to us.
That was the behaviour prior to commit 10d91611f426 ("powerpc/64s:
Reimplement book3s idle code in C"), however in that commit the handling of SRR1 was reworked, and the zeroing behaviour was lost.
Returning from idle_kvm_start_guest() without zeroing the SRR1 value can confuse the host offline code, causing the guest to crash and other weirdness.
--- arch/powerpc/kvm/book3s_hv_rmhandlers.S | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
arch/powerpc/kvm/book3s_hv_rmhandlers.S +7 -2
@@ -301,6 +301,7 @@ _GLOBAL(idle_kvm_start_guest) stdu r1, -SWITCH_FRAME_SIZE(r4) // Switch to new frame on emergency stack mr r1, r4 + std r3, 32(r1) // Save SRR1 wakeup value SAVE_NVGPRS(r1) /*
@@ -352,6 +353,10 @@ kvm_unsplit_wakeup: kvm_secondary_got_guest: + // About to go to guest, clear saved SRR1 + li r0, 0 + std r0, 32(r1) + /* Set HSTATE_DSCR(r13) to something sensible */ ld r6, PACA_DSCR_DEFAULT(r13) std r6, HSTATE_DSCR(r13)
@@ -443,8 +448,8 @@ kvm_no_guest: mfspr r4, SPRN_LPCR rlwimi r4, r3, 0, LPCR_PECE0 | LPCR_PECE1 mtspr SPRN_LPCR, r4 - /* set up r3 for return */ - mfspr r3,SPRN_SRR1 + // Return SRR1 wakeup value, or 0 if we went into the guest + ld r3, 32(r1) REST_NVGPRS(r1) ld r1, 0(r1) // Switch back to caller stack ld r0, 16(r1) // Reload LR
Greg Kroah-Hartman
maintainerPATCH 38/58 powerpc/idle: Dont corrupt back chain when going idle
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
commit 496c5fe25c377ddb7815c4ce8ecfb676f051e9b6 upstream.
In isa206_idle_insn_mayloss() we store various registers into the stack red zone, which is allowed.
However inside the IDLE_STATE_ENTER_SEQ_NORET macro we save r2 again, to 0(r1), which corrupts the stack back chain.
We used to do the same in isa206_idle_insn_mayloss() itself, but we fixed that in 73287caa9210 ("powerpc64/idle: Fix SP offsets when saving GPRs"), however we missed that the macro also corrupts the back chain.
Corrupting the back chain is bad for debuggability but doesn't necessarily cause a bug.
However we recently changed the stack handling in some KVM code, and it now relies on the stack back chain being valid when it returns. The corruption causes that code to return with r1 pointing somewhere in kernel data, at some point LR is restored from the stack and we branch to NULL or somewhere else invalid.
Only affects Power8 hosts running KVM guests, with dynamic_mt_modes enabled (which it is by default).
The fixes tag below points to the commit that changed the KVM stack handling, exposing this bug. The actual corruption of the back chain has always existed since 948cf67c4726 ("powerpc: Add NAP mode support on Power7 in HV mode").
--- arch/powerpc/kernel/idle_book3s.S | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
arch/powerpc/kernel/idle_book3s.S +6 -4
@@ -124,14 +124,16 @@ _GLOBAL(idle_return_gpr_loss) /* * This is the sequence required to execute idle instructions, as * specified in ISA v2.07 (and earlier). MSR[IR] and MSR[DR] must be 0. - * - * The 0(r1) slot is used to save r2 in isa206, so use that here. + * We have to store a GPR somewhere, ptesync, then reload it, and create + * a false dependency on the result of the load. It doesn't matter which + * GPR we store, or where we store it. We have already stored r2 to the + * stack at -8(r1) in isa206_idle_insn_mayloss, so use that. */ #define IDLE_STATE_ENTER_SEQ_NORET(IDLE_INST) \ /* Magic NAP/SLEEP/WINKLE mode enter sequence */ \ - std r2,0(r1); \ + std r2,-8(r1); \ ptesync; \ - ld r2,0(r1); \ + ld r2,-8(r1); \ 236: cmpd cr0,r2,r2; \ bne 236b; \ IDLE_INST; \
Greg Kroah-Hartman
maintainerPATCH 39/58 mm, slub: fix mismatch between reconstructed freelist depth and cnt
In reply to Greg Kroah-HartmanFrom: Miaohe Lin <[email protected]>
commit 899447f669da76cc3605665e1a95ee877bc464cc upstream.
If object's reuse is delayed, it will be excluded from the reconstructed freelist. But we forgot to adjust the cnt accordingly. So there will be a mismatch between reconstructed freelist depth and cnt. This will lead to free_debug_processing() complaining about freelist count or a incorrect slub inuse count.
--- mm/slub.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
mm/slub.c +9 -2
@@ -1455,7 +1455,8 @@ static __always_inline bool slab_free_ho }static inline bool slab_free_freelist_hook (struct kmem_cache *s, -void **head,void **tail) +void **head,void **tail, +int *cnt) {void *object;
@@ -1490,6 +1491,12 @@ static inline bool slab_free_freelist_ho *head = object;if (!*tail) *tail = object; + }else { +/* +* Adjust the reconstructed freelist depth +* accordingly if object's reuse is delayed. +*/ + --(*cnt); } }while (object != old_tail);
@@ -3049,7 +3056,7 @@ static __always_inline void slab_free(st* With KASAN enabled slab_free_freelist_hook modifies the freelist * to remove objects, whose reuse must be delayed. */ -if (slab_free_freelist_hook (s, &head, &tail)) +if (slab_free_freelist_hook (s, &head, &tail, &cnt))do_slab_free (s, page, head, tail, cnt, addr); }
Greg Kroah-Hartman
maintainerPATCH 40/58 mm, slub: fix potential memoryleak in kmem_cache_open()
In reply to Greg Kroah-HartmanFrom: Miaohe Lin <[email protected]>
commit 9037c57681d25e4dcc442d940d6dbe24dd31f461 upstream.
In error path, the random_seq of slub cache might be leaked. Fix this by using __kmem_cache_release() to release all the relevant resources.
--- mm/slub.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/slub.c +1 -1
@@ -3734,8 +3734,8 @@ static int kmem_cache_open(struct kmem_cif (alloc_kmem_cache_cpus (s))return 0 ; -free_kmem_cache_nodes (s); error: +__kmem_cache_release (s);return -EINVAL ; }
Greg Kroah-Hartman
maintainerPATCH 41/58 nfc: nci: fix the UAF of rf_conn_info object
In reply to Greg Kroah-HartmanFrom: Lin Ma <[email protected]>
commit 1b1499a817c90fd1ce9453a2c98d2a01cca0e775 upstream.
The nci_core_conn_close_rsp_packet() function will release the conn_info with given conn_id. However, it needs to set the rf_conn_info to NULL to prevent other routines like nci_rf_intf_activated_ntf_packet() to trigger the UAF.
--- net/nfc/nci/rsp.c | 2 ++ 1 file changed, 2 insertions(+)
net/nfc/nci/rsp.c +2 -0
@@ -277,6 +277,8 @@ static void nci_core_conn_close_rsp_pack ndev->cur_conn_id);if (conn_info) {list_del (&conn_info->list); +if (conn_info == ndev->rf_conn_info) + ndev->rf_conn_info =NULL ;devm_kfree (&ndev->nfc_dev->dev, conn_info); } }
Greg Kroah-Hartman
maintainerPATCH 42/58 isdn: cpai: check ctr->cnr to avoid array index out of bound
In reply to Greg Kroah-HartmanFrom: Xiaolong Huang <[email protected]>
commit 1f3e2e97c003f80c4b087092b225c8787ff91e4d upstream.
The cmtp_add_connection() would add a cmtp session to a controller and run a kernel thread to process cmtp.
__module_get(THIS_MODULE); session->task = kthread_run(cmtp_session, session, "kcmtpd_ctr_%d", session->num);
During this process, the kernel thread would call detach_capi_ctr() to detach a register controller. if the controller
was not attached yet, detach_capi_ctr() would
trigger an array-index-out-bounds bug.
[ 46.866069][ T6479] UBSAN: array-index-out-of-bounds in drivers/isdn/capi/kcapi.c:483:21 [ 46.867196][ T6479] index -1 is out of range for type 'capi_ctr *[32]' [ 46.867982][ T6479] CPU: 1 PID: 6479 Comm: kcmtpd_ctr_0 Not tainted 5.15.0-rc2+ #8 [ 46.869002][ T6479] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 [ 46.870107][ T6479] Call Trace: [ 46.870473][ T6479] dump_stack_lvl+0x57/0x7d [ 46.870974][ T6479] ubsan_epilogue+0x5/0x40 [ 46.871458][ T6479] __ubsan_handle_out_of_bounds.cold+0x43/0x48 [ 46.872135][ T6479] detach_capi_ctr+0x64/0xc0 [ 46.872639][ T6479] cmtp_session+0x5c8/0x5d0 [ 46.873131][ T6479] ? __init_waitqueue_head+0x60/0x60 [ 46.873712][ T6479] ? cmtp_add_msgpart+0x120/0x120 [ 46.874256][ T6479] kthread+0x147/0x170 [ 46.874709][ T6479] ? set_kthread_struct+0x40/0x40 [ 46.875248][ T6479] ret_from_fork+0x1f/0x30 [ 46.875773][ T6479]
--- drivers/isdn/capi/kcapi.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/isdn/capi/kcapi.c +5 -0
@@ -565,6 +565,11 @@ int detach_capi_ctr(struct capi_ctr *ctrctr_down (ctr,CAPI_CTR_DETACHED ); +if (ctr->cnr <1 || ctr->cnr -1 >=CAPI_MAXCONTR ) { + err = -EINVAL ; + goto unlock_out; + } +if (capi_controller[ctr->cnr -1 ] != ctr) { err = -EINVAL ; goto unlock_out;
Greg Kroah-Hartman
maintainerPATCH 43/58 netfilter: Kconfig: use default y instead of m for bool config option
In reply to Greg Kroah-HartmanFrom: Vegard Nossum <[email protected]>
commit 77076934afdcd46516caf18ed88b2f88025c9ddb upstream.
This option, NF_CONNTRACK_SECMARK, is a bool, so it can never be 'm'.
--- net/netfilter/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/Kconfig +1 -1
@@ -94,7 +94,7 @@ config NF_CONNTRACK_MARK config NF_CONNTRACK_SECMARK bool 'Connection tracking security mark support' depends on NETWORK_SECMARK - default m if NETFILTER_ADVANCED=n + default y if NETFILTER_ADVANCED=n help This option enables security markings to be applied to connections. Typically they are copied to connections from
Greg Kroah-Hartman
maintainerPATCH 44/58 selftests: netfilter: remove stray bash debug line
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
commit 3e6ed7703dae6838c104d73d3e76e9b79f5c0528 upstream.
This should not be there.
--- tools/testing/selftests/netfilter/nft_flowtable.sh | 1 - 1 file changed, 1 deletion(-)
tools/testing/selftests/netfilter/nft_flowtable.sh +0 -1
@@ -174,7 +174,6 @@ fi ip netns exec ns1 ping -c 1 -q 10.0.2.99 > /dev/null if [ $? -ne 0 ];then echo "ERROR: ns1 cannot reach ns2" 1>&2 - bash exit 1 fi
Greg Kroah-Hartman
maintainerPATCH 45/58 gcc-plugins/structleak: add makefile var for disabling structleak
In reply to Greg Kroah-HartmanFrom: Brendan Higgins <[email protected]>
[ Upstream commit 554afc3b9797511e3245864e32aebeb6abbab1e3 ]
KUnit and structleak don't play nice, so add a makefile variable for enabling structleak when it complains.
--- scripts/Makefile.gcc-plugins | 4 ++++ 1 file changed, 4 insertions(+)
scripts/Makefile.gcc-plugins +4 -0
@@ -19,6 +19,10 @@ gcc-plugin-cflags-$(CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF) \ += -fplugin-arg-structleak_plugin-byref gcc-plugin-cflags-$(CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL) \ += -fplugin-arg-structleak_plugin-byref-all +ifdef CONFIG_GCC_PLUGIN_STRUCTLEAK + DISABLE_STRUCTLEAK_PLUGIN += -fplugin-arg-structleak_plugin-disable +endif +export DISABLE_STRUCTLEAK_PLUGIN gcc-plugin-cflags-$(CONFIG_GCC_PLUGIN_STRUCTLEAK) \ += -DSTRUCTLEAK_PLUGIN
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 46/58 btrfs: deal with errors when checking if a dir entry exists during log replay
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
[ Upstream commit 77a5b9e3d14cbce49ceed2766b2003c034c066dc ]
Currently inode_in_dir() ignores errors returned from btrfs_lookup_dir_index_item() and from btrfs_lookup_dir_item(), treating any errors as if the directory entry does not exists in the fs/subvolume tree, which is obviously not correct, as we can get errors such as -EIO when reading extent buffers while searching the fs/subvolume's tree.
Fix that by making inode_in_dir() return the errors and making its only caller, add_inode_ref(), deal with returned errors as well.
--- fs/btrfs/tree-log.c | 47 ++++++++++++++++++++++++++++----------------- 1 file changed, 29 insertions(+), 18 deletions(-)
fs/btrfs/tree-log.c +29 -18
@@ -900,9 +900,11 @@ out: }/* -* helper function to see if a given name and sequence number found -* in an inode back reference are already in a directory and correctly -* point to this inode +* See if a given name and sequence number found in an inode back reference are +* already in a directory and correctly point to this inode. +* +* Returns: < 0 on error, 0 if the directory entry does not exists and 1 if it +* exists. */ static noinline int inode_in_dir(struct btrfs_root *root, struct btrfs_path *path,
@@ -911,29 +913,35 @@ static noinline int inode_in_dir(struct btrfs_root *root, {struct btrfs_dir_item *di;struct btrfs_key location; -int match =0 ; +int ret =0 ; di =btrfs_lookup_dir_index_item (NULL , root, path, dirid, index, name, name_len,0 ); -if (di && !IS_ERR (di)) { +if (IS_ERR (di)) { +if (PTR_ERR (di) != -ENOENT ) + ret =PTR_ERR (di); + goto out; + }else if (di) {btrfs_dir_item_key_to_cpu (path->nodes[0 ], di, &location);if (location.objectid != objectid) goto out; - }else + }else { goto out; -btrfs_release_path (path); + } +btrfs_release_path (path); di =btrfs_lookup_dir_item (NULL , root, path, dirid, name, name_len,0 ); -if (di && !IS_ERR (di)) { -btrfs_dir_item_key_to_cpu (path->nodes[0 ], di, &location); -if (location.objectid != objectid) - goto out; - }else +if (IS_ERR (di)) { + ret =PTR_ERR (di); goto out; - match =1 ; + }else if (di) { +btrfs_dir_item_key_to_cpu (path->nodes[0 ], di, &location); +if (location.objectid == objectid) + ret =1 ; + } out:btrfs_release_path (path); -return match; +return ret; }/*
@@ -1500,10 +1508,12 @@ static noinline int add_inode_ref(struct btrfs_trans_handle *trans,if (ret) goto out; -/* if we already have a perfect match, we're done */ -if (!inode_in_dir (root, path,btrfs_ino (BTRFS_I (dir)), -btrfs_ino (BTRFS_I (inode)), ref_index, - name, namelen)) { + ret =inode_in_dir (root, path,btrfs_ino (BTRFS_I (dir)), +btrfs_ino (BTRFS_I (inode)), ref_index, + name, namelen); +if (ret <0 ) { + goto out; + }else if (ret ==0 ) {/* * look for a conflicting back reference in the * metadata. if we find one we have to unlink that name
@@ -1561,6 +1571,7 @@ static noinline int add_inode_ref(struct btrfs_trans_handle *trans,btrfs_update_inode (trans, root, inode); } +/* Else, ret == 1, we already have a perfect match, we're done. */ ref_ptr = (unsigned long )(ref_ptr + ref_struct_size) + namelen;kfree (name);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 47/58 net: stmmac: add support for dwmac 3.40a
In reply to Greg Kroah-HartmanFrom: Herve Codina <[email protected]>
[ Upstream commit 9cb1d19f47fafad7dcf7c8564e633440c946cfd7 ]
dwmac 3.40a is an old ip version that can be found on SPEAr3xx soc.
--- drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c | 1 + drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 8 ++++++++ 2 files changed, 9 insertions(+)
drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c +1 -0
@@ -71,6 +71,7 @@ err_remove_config_dt:static const struct of_device_id dwmac_generic_match[] = { { .compatible ="st,spear600-gmac" }, + { .compatible ="snps,dwmac-3.40a" }, { .compatible ="snps,dwmac-3.50a" }, { .compatible ="snps,dwmac-3.610" }, { .compatible ="snps,dwmac-3.70a" },
drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +8 -0
@@ -505,6 +505,14 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac) plat->pmt =1 ; } +if (of_device_is_compatible (np,"snps,dwmac-3.40a" )) { + plat->has_gmac =1 ; + plat->enh_desc =1 ; + plat->tx_coe =1 ; + plat->bugged_jumbo =1 ; + plat->pmt =1 ; + } +if (of_device_is_compatible (np,"snps,dwmac-4.00" ) ||of_device_is_compatible (np,"snps,dwmac-4.10a" ) ||of_device_is_compatible (np,"snps,dwmac-4.20a" )) {
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 48/58 ARM: dts: spear3xx: Fix gmac node
In reply to Greg Kroah-HartmanFrom: Herve Codina <[email protected]>
[ Upstream commit 6636fec29cdf6665bd219564609e8651f6ddc142 ]
On SPEAr3xx, ethernet driver is not compatible with the SPEAr600 one.
Indeed, SPEAr3xx uses an earlier version of this IP (v3.40) and needs some driver tuning compare to SPEAr600.
The v3.40 IP support was added to stmmac driver and this patch fixes this issue and use the correct compatible string for SPEAr3xx
--- arch/arm/boot/dts/spear3xx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/spear3xx.dtsi +1 -1
@@ -47,7 +47,7 @@ }; gmac: eth@e0800000 { - compatible = "st,spear600-gmac"; + compatible = "snps,dwmac-3.40a"; reg = <0xe0800000 0x8000>; interrupts = <23 22>; interrupt-names = "macirq", "eth_wake_irq";
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 49/58 isdn: mISDN: Fix sleeping function called from invalid context
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
[ Upstream commit 6510e80a0b81b5d814e3aea6297ba42f5e76f73c ]
The driver can call card->isac.release() function from an atomic context.
Fix this by calling this function after releasing the lock.
The following log reveals it:
[ 44.168226 ] BUG: sleeping function called from invalid context at kernel/workqueue.c:3018 [ 44.168941 ] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 5475, name: modprobe [ 44.169574 ] INFO: lockdep is turned off. [ 44.169899 ] irq event stamp: 0 [ 44.170160 ] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 44.170627 ] hardirqs last disabled at (0): [<ffffffff814209ed>] copy_process+0x132d/0x3e00 [ 44.171240 ] softirqs last enabled at (0): [<ffffffff81420a1a>] copy_process+0x135a/0x3e00 [ 44.171852 ] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 44.172318 ] Preemption disabled at: [ 44.172320 ] [<ffffffffa009b0a9>] nj_release+0x69/0x500 [netjet] [ 44.174441 ] Call Trace: [ 44.174630 ] dump_stack_lvl+0xa8/0xd1 [ 44.174912 ] dump_stack+0x15/0x17 [ 44.175166 ] ___might_sleep+0x3a2/0x510 [ 44.175459 ] ? nj_release+0x69/0x500 [netjet] [ 44.175791 ] __might_sleep+0x82/0xe0 [ 44.176063 ] ? start_flush_work+0x20/0x7b0 [ 44.176375 ] start_flush_work+0x33/0x7b0 [ 44.176672 ] ? trace_irq_enable_rcuidle+0x85/0x170 [ 44.177034 ] ? kasan_quarantine_put+0xaa/0x1f0 [ 44.177372 ] ? kasan_quarantine_put+0xaa/0x1f0 [ 44.177711 ] __flush_work+0x11a/0x1a0 [ 44.177991 ] ? flush_work+0x20/0x20 [ 44.178257 ] ? lock_release+0x13c/0x8f0 [ 44.178550 ] ? __kasan_check_write+0x14/0x20 [ 44.178872 ] ? do_raw_spin_lock+0x148/0x360 [ 44.179187 ] ? read_lock_is_recursive+0x20/0x20 [ 44.179530 ] ? __kasan_check_read+0x11/0x20 [ 44.179846 ] ? do_raw_spin_unlock+0x55/0x900 [ 44.180168 ] ? ____kasan_slab_free+0x116/0x140 [ 44.180505 ] ? _raw_spin_unlock_irqrestore+0x41/0x60 [ 44.180878 ] ? skb_queue_purge+0x1a3/0x1c0 [ 44.181189 ] ? kfree+0x13e/0x290 [ 44.181438 ] flush_work+0x17/0x20 [ 44.181695 ] mISDN_freedchannel+0xe8/0x100 [ 44.182006 ] isac_release+0x210/0x260 [mISDNipac] [ 44.182366 ] nj_release+0xf6/0x500 [netjet] [ 44.182685 ] nj_remove+0x48/0x70 [netjet] [ 44.182989 ] pci_device_remove+0xa9/0x250
--- drivers/isdn/hardware/mISDN/netjet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/isdn/hardware/mISDN/netjet.c +1 -1
@@ -949,8 +949,8 @@ nj_release(struct tiger_hw *card)nj_disable_hwirq (card);mode_tiger (&card->bc[0 ],ISDN_P_NONE );mode_tiger (&card->bc[1 ],ISDN_P_NONE ); - card->isac.release (&card->isac);spin_unlock_irqrestore (&card->lock, flags); + card->isac.release (&card->isac);release_region (card->base, card->base_s); card->base_s =0 ; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 50/58 platform/x86: intel_scu_ipc: Update timeout value in comment
In reply to Greg Kroah-HartmanFrom: Prashant Malani <[email protected]>
[ Upstream commit a0c5814b9933f25ecb6de169483c5b88cf632bca ]
The comment decribing the IPC timeout hadn't been updated when the actual timeout was changed from 3 to 5 seconds in
commit a7d53dbbc70a ("platform/x86: intel_scu_ipc: Increase virtual timeout from 3 to 5 seconds") .
Since the value is anyway updated to 10s now, take this opportunity to update the value in the comment too.
--- drivers/platform/x86/intel_scu_ipc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/x86/intel_scu_ipc.c +1 -1
@@ -181,7 +181,7 @@ static inline int busy_loop(struct intel_scu_ipc_dev *scu)return 0 ; } -/* Wait till ipc ioc interrupt is received or timeout in 3 HZ */ +/* Wait till ipc ioc interrupt is received or timeout in 10 HZ */ static inline int ipc_wait_for_interrupt (struct intel_scu_ipc_dev *scu) {int status;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 51/58 ALSA: hda: avoid write to STATESTS if controller is in reset
In reply to Greg Kroah-HartmanFrom: Kai Vehmanen <[email protected]>
[ Upstream commit b37a15188eae9d4c49c5bb035e0c8d4058e4d9b3 ]
The snd_hdac_bus_reset_link() contains logic to clear STATESTS register before performing controller reset. This code dates back to an old bugfix in commit e8a7f136f5ed ("[ALSA] hda-intel - Improve HD-audio codec probing robustness"). Originally the code was added to azx_reset().
The code was moved around in commit a41d122449be ("ALSA: hda - Embed bus into controller object") and ended up to snd_hdac_bus_reset_link() and called primarily via snd_hdac_bus_init_chip().
The logic to clear STATESTS is correct when snd_hdac_bus_init_chip() is called when controller is not in reset. In this case, STATESTS can be cleared. This can be useful e.g. when forcing a controller reset to retry codec probe. A normal non-power-on reset will not clear the bits.
However, this old logic is problematic when controller is already in reset. The HDA specification states that controller must be taken out of reset before writing to registers other than GCTL.CRST (1.0a spec, 3.3.7). The write to STATESTS in snd_hdac_bus_reset_link() will be lost if the controller is already in reset per the HDA specification mentioned.
This has been harmless on older hardware. On newer generation of Intel PCIe based HDA controllers, if configured to report issues, this write will emit an unsupported request error. If ACPI Platform Error Interface (APEI) is enabled in kernel, this will end up to kernel log.
Fix the code in snd_hdac_bus_reset_link() to only clear the STATESTS if the function is called when controller is not in reset. Otherwise clearing the bits is not possible and should be skipped.
--- sound/hda/hdac_controller.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
sound/hda/hdac_controller.c +3 -2
@@ -395,8 +395,9 @@ int snd_hdac_bus_reset_link(struct hdac_bus *bus, bool full_reset)if (!full_reset) goto skip_reset; -/* clear STATESTS */ -snd_hdac_chip_writew (bus,STATESTS ,STATESTS_INT_MASK ); +/* clear STATESTS if not in reset */ +if (snd_hdac_chip_readb (bus,GCTL ) &AZX_GCTL_RESET ) +snd_hdac_chip_writew (bus,STATESTS ,STATESTS_INT_MASK );/* reset controller */ snd_hdac_bus_enter_link_reset (bus);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 52/58 Input: snvs_pwrkey - add clk handling
In reply to Greg Kroah-HartmanFrom: Uwe Kleine-König <[email protected]>
[ Upstream commit d997cc1715df7b6c3df798881fb9941acf0079f8 ]
On i.MX7S and i.MX8M* (but not i.MX6*) the pwrkey device has an associated clock. Accessing the registers requires that this clock is enabled. Binding the driver on at least i.MX7S and i.MX8MP while not having the clock enabled results in a complete hang of the machine. (This usually only happens if snvs_pwrkey is built as a module and the rtc-snvs driver isn't already bound because at bootup the required clk is on and only gets disabled when the clk framework disables unused clks late during boot.)
This completes the fix in commit 135be16d3505 ("ARM: dts: imx7s: add snvs clock to pwrkey").
--- drivers/input/keyboard/snvs_pwrkey.c | 29 ++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+)
drivers/input/keyboard/snvs_pwrkey.c +29 -0
@@ -3,6 +3,7 @@// Driver for the IMX SNVS ON/OFF Power Key // Copyright (C) 2015 Freescale Semiconductor, Inc. All Rights Reserved. +#include <linux/clk.h> #include <linux/device.h> #include <linux/err.h> #include <linux/init.h>
@@ -81,6 +82,11 @@ static irqreturn_t imx_snvs_pwrkey_interrupt(int irq, void *dev_id)return IRQ_HANDLED ; } +static void imx_snvs_pwrkey_disable_clk (void *data) +{ +clk_disable_unprepare (data); +} +static void imx_snvs_pwrkey_act (void *pdata) {struct pwrkey_drv_data *pd = pdata;
@@ -93,6 +99,7 @@ static int imx_snvs_pwrkey_probe(struct platform_device *pdev)struct pwrkey_drv_data *pdata =NULL ;struct input_dev *input =NULL ;struct device_node *np; +struct clk *clk;int error;/* Get SNVS register Page */
@@ -115,6 +122,28 @@ static int imx_snvs_pwrkey_probe(struct platform_device *pdev)dev_warn (&pdev->dev,"KEY_POWER without setting in dts\n" ); } + clk =devm_clk_get_optional (&pdev->dev,NULL ); +if (IS_ERR (clk)) { +dev_err (&pdev->dev,"Failed to get snvs clock (%pe)\n" , clk); +return PTR_ERR (clk); + } + + error =clk_prepare_enable (clk); +if (error) { +dev_err (&pdev->dev,"Failed to enable snvs clock (%pe)\n" , +ERR_PTR (error)); +return error; + } + + error =devm_add_action_or_reset (&pdev->dev, + imx_snvs_pwrkey_disable_clk, clk); +if (error) { +dev_err (&pdev->dev, +"Failed to register clock cleanup handler (%pe)\n" , +ERR_PTR (error)); +return error; + } + pdata->wakeup =of_property_read_bool (np,"wakeup-source" ); pdata->irq =platform_get_irq (pdev,0 );
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 53/58 scsi: core: Fix shost->cmd_per_lun calculation in scsi_add_host_with_dma()
In reply to Greg Kroah-HartmanFrom: Dexuan Cui <[email protected]>
commit 50b6cb3516365cb69753b006be2b61c966b70588 upstream.
After commit ea2f0f77538c ("scsi: core: Cap scsi_host cmd_per_lun at can_queue"), a 416-CPU VM running on Hyper-V hangs during boot because the hv_storvsc driver sets scsi_driver.can_queue to an integer value that exceeds SHRT_MAX, and hence scsi_add_host_with_dma() sets shost->cmd_per_lun to a negative "short" value.
Use min_t(int, ...) to work around the issue.
--- drivers/scsi/hosts.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/scsi/hosts.c +2 -1
@@ -219,7 +219,8 @@ int scsi_add_host_with_dma(struct Scsi_H goto fail; } - shost->cmd_per_lun =min_t (short, shost->cmd_per_lun, +/* Use min_t(int, ...) in case shost->can_queue exceeds SHRT_MAX */ + shost->cmd_per_lun =min_t (int, shost->cmd_per_lun, shost->can_queue); error =scsi_init_sense_cache (shost);
Greg Kroah-Hartman
maintainerPATCH 54/58 usbnet: sanity check for maxpacket
In reply to Greg Kroah-HartmanFrom: Oliver Neukum <[email protected]>
commit 397430b50a363d8b7bdda00522123f82df6adc5e upstream.
maxpacket of 0 makes no sense and oopses as we need to divide by it. Give up.
V2: fixed typo in log and stylistic issues
--- drivers/net/usb/usbnet.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/usb/usbnet.c +4 -0
@@ -1773,6 +1773,10 @@ usbnet_probe (struct usb_interface *udevif (!dev->rx_urb_size) dev->rx_urb_size = dev->hard_mtu; dev->maxpacket =usb_maxpacket (dev->udev, dev->out,1 ); +if (dev->maxpacket ==0 ) { +/* that is a broken device */ + goto out4; + }/* let userspace know we have a random address */ if (ether_addr_equal (net->dev_addr, node_id))
Greg Kroah-Hartman
maintainerPATCH 55/58 net: mdiobus: Fix memory leak in __mdiobus_register
In reply to Greg Kroah-HartmanFrom: Yanfei Xu <[email protected]>
commit ab609f25d19858513919369ff3d9a63c02cd9e2e upstream.
Once device_register() failed, we should call put_device() to decrement reference count for cleanup. Or it will cause memory leak.
BUG: memory leak
unreferenced object 0xffff888114032e00 (size 256):
comm "kworker/1:3", pid 2960, jiffies 4294943572 (age 15.920s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 08 2e 03 14 81 88 ff ff ................
08 2e 03 14 81 88 ff ff 90 76 65 82 ff ff ff ff .........ve.....
backtrace:
[<ffffffff8265cfab>] kmalloc include/linux/slab.h:591 [inline]
[<ffffffff8265cfab>] kzalloc include/linux/slab.h:721 [inline]
[<ffffffff8265cfab>] device_private_init drivers/base/core.c:3203 [inline]
[<ffffffff8265cfab>] device_add+0x89b/0xdf0 drivers/base/core.c:3253
[<ffffffff828dd643>] __mdiobus_register+0xc3/0x450 drivers/net/phy/mdio_bus.c:537
[<ffffffff828cb835>] __devm_mdiobus_register+0x75/0xf0 drivers/net/phy/mdio_devres.c:87
[<ffffffff82b92a00>] ax88772_init_mdio drivers/net/usb/asix_devices.c:676 [inline]
[<ffffffff82b92a00>] ax88772_bind+0x330/0x480 drivers/net/usb/asix_devices.c:786
[<ffffffff82baa33f>] usbnet_probe+0x3ff/0xdf0 drivers/net/usb/usbnet.c:1745
[<ffffffff82c36e17>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
[<ffffffff82661d17>] call_driver_probe drivers/base/dd.c:517 [inline]
[<ffffffff82661d17>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
[<ffffffff826620bc>] really_probe drivers/base/dd.c:558 [inline]
[<ffffffff826620bc>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
[<ffffffff826621ba>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
[<ffffffff82662a26>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
[<ffffffff8265eca7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
[<ffffffff826625a2>] __device_attach+0x122/0x260 drivers/base/dd.c:969
[<ffffffff82660916>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487
[<ffffffff8265cd0b>] device_add+0x5fb/0xdf0 drivers/base/core.c:3359
[<ffffffff82c343b9>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2170
[<ffffffff82c4473c>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
BUG: memory leak
unreferenced object 0xffff888116f06900 (size 32):
comm "kworker/0:2", pid 2670, jiffies 4294944448 (age 7.160s)
hex dump (first 32 bytes):
75 73 62 2d 30 30 31 3a 30 30 33 00 00 00 00 00 usb-001:003.....
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff81484516>] kstrdup+0x36/0x70 mm/util.c:60
[<ffffffff814845a3>] kstrdup_const+0x53/0x80 mm/util.c:83
[<ffffffff82296ba2>] kvasprintf_const+0xc2/0x110 lib/kasprintf.c:48
[<ffffffff82358d4b>] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:289
[<ffffffff826575f3>] dev_set_name+0x63/0x90 drivers/base/core.c:3147
[<ffffffff828dd63b>] __mdiobus_register+0xbb/0x450 drivers/net/phy/mdio_bus.c:535
[<ffffffff828cb835>] __devm_mdiobus_register+0x75/0xf0 drivers/net/phy/mdio_devres.c:87
[<ffffffff82b92a00>] ax88772_init_mdio drivers/net/usb/asix_devices.c:676 [inline]
[<ffffffff82b92a00>] ax88772_bind+0x330/0x480 drivers/net/usb/asix_devices.c:786
[<ffffffff82baa33f>] usbnet_probe+0x3ff/0xdf0 drivers/net/usb/usbnet.c:1745
[<ffffffff82c36e17>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
[<ffffffff82661d17>] call_driver_probe drivers/base/dd.c:517 [inline]
[<ffffffff82661d17>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
[<ffffffff826620bc>] really_probe drivers/base/dd.c:558 [inline]
[<ffffffff826620bc>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
[<ffffffff826621ba>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
[<ffffffff82662a26>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
[<ffffffff8265eca7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
[<ffffffff826625a2>] __device_attach+0x122/0x260 drivers/base/dd.c:969--- drivers/net/phy/mdio_bus.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/phy/mdio_bus.c +1 -0
@@ -395,6 +395,7 @@ int __mdiobus_register(struct mii_bus *b err =device_register (&bus->dev);if (err) {pr_err ("mii_bus %s failed to register\n" , bus->id); +put_device (&bus->dev);return -EINVAL ; }
Greg Kroah-Hartman
maintainerPATCH 56/58 tracing: Have all levels of checks prevent recursion
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (VMware) <[email protected]>
commit ed65df63a39a3f6ed04f7258de8b6789e5021c18 upstream.
While writing an email explaining the "bit = 0" logic for a discussion on making ftrace_test_recursion_trylock() disable preemption, I discovered a path that makes the "not do the logic if bit is zero" unsafe.
The recursion logic is done in hot paths like the function tracer. Thus, any code executed causes noticeable overhead. Thus, tricks are done to try to limit the amount of code executed. This included the recursion testing logic.
Having recursion testing is important, as there are many paths that can end up in an infinite recursion cycle when tracing every function in the kernel. Thus protection is needed to prevent that from happening.
Because it is OK to recurse due to different running context levels (e.g. an interrupt preempts a trace, and then a trace occurs in the interrupt handler), a set of bits are used to know which context one is in (normal, softirq, irq and NMI). If a recursion occurs in the same level, it is prevented*.
Then there are infrastructure levels of recursion as well. When more than one callback is attached to the same function to trace, it calls a loop function to iterate over all the callbacks. Both the callbacks and the loop function have recursion protection. The callbacks use the "ftrace_test_recursion_trylock()" which has a "function" set of context bits to test, and the loop function calls the internal trace_test_and_set_recursion() directly, with an "internal" set of bits.
If an architecture does not implement all the features supported by ftrace then the callbacks are never called directly, and the loop function is called instead, which will implement the features of ftrace.
Since both the loop function and the callbacks do recursion protection, it was seemed unnecessary to do it in both locations. Thus, a trick was made to have the internal set of recursion bits at a more significant bit location than the function bits. Then, if any of the higher bits were set, the logic of the function bits could be skipped, as any new recursion would first have to go through the loop function.
This is true for architectures that do not support all the ftrace features, because all functions being traced must first go through the loop function before going to the callbacks. But this is not true for architectures that support all the ftrace features. That's because the loop function could be called due to two callbacks attached to the same function, but then a recursion function inside the callback could be called that does not share any other callback, and it will be called directly.
i.e.
traced_function_1: [ more than one callback tracing it ]
call loop_func
loop_func:
trace_recursion set internal bit
call callback
callback:
trace_recursion [ skipped because internal bit is set, return 0 ] call traced_function_2
traced_function_2: [ only traced by above callback ]
call callback
callback:
trace_recursion [ skipped because internal bit is set, return 0 ] call traced_function_2
[ wash, rinse, repeat, BOOM! out of shampoo! ]
Thus, the "bit == 0 skip" trick is not safe, unless the loop function is call for all functions.
Since we want to encourage architectures to implement all ftrace features, having them slow down due to this extra logic may encourage the maintainers to update to the latest ftrace features. And because this logic is only safe for them, remove it completely.
[*] There is on layer of recursion that is allowed, and that is to allow
for the transition between interrupt context (normal -> softirq ->
irq -> NMI), because a trace may occur before the context update is
visible to the trace recursion logic.--- kernel/trace/ftrace.c | 4 +- kernel/trace/trace.h | 64 ++++++++++++----------------------------- kernel/trace/trace_functions.c | 2 - 3 files changed, 23 insertions(+), 47 deletions(-)
kernel/trace/ftrace.c +2 -2
@@ -6336,7 +6336,7 @@ __ftrace_ops_list_func(unsigned long ip,struct ftrace_ops *op;int bit; - bit =trace_test_and_set_recursion (TRACE_LIST_START ,TRACE_LIST_MAX ); + bit =trace_test_and_set_recursion (TRACE_LIST_START );if (bit <0 )return ;
@@ -6411,7 +6411,7 @@ static void ftrace_ops_assist_func(unsig {int bit; - bit =trace_test_and_set_recursion (TRACE_LIST_START ,TRACE_LIST_MAX ); + bit =trace_test_and_set_recursion (TRACE_LIST_START );if (bit <0 )return ;
kernel/trace/trace.h +20 -44
138 lines not on this page · raw message
kernel/trace/trace_functions.c +1 -1
@@ -138,7 +138,7 @@ function_trace_call(unsigned long ip, un pc =preempt_count ();preempt_disable_notrace (); - bit =trace_test_and_set_recursion (TRACE_FTRACE_START ,TRACE_FTRACE_MAX ); + bit =trace_test_and_set_recursion (TRACE_FTRACE_START );if (bit <0 ) goto out;
Greg Kroah-Hartman
maintainerPATCH 57/58 ARM: 9122/1: select HAVE_FUTEX_CMPXCHG
In reply to Greg Kroah-HartmanFrom: Nick Desaulniers <[email protected]>
commit 9d417cbe36eee7afdd85c2e871685f8dab7c2dba upstream.
tglx notes:
This function [futex_detect_cmpxchg] is only needed when an architecture has to runtime discover whether the CPU supports it or not. ARM has unconditional support for this, so the obvious thing to do is the below.
Fixes linkage failure from Clang randconfigs:
kernel/futex.o:(.text.fixup+0x5c): relocation truncated to fit: R_ARM_JUMP24 against `.init.text' and boot failures for CONFIG_THUMB2_KERNEL.
Comments from Nick Desaulniers:
See-also: 03b8c7b623c8 ("futex: Allow architectures to skip futex_atomic_cmpxchg_inatomic() test")
--- arch/arm/Kconfig | 1 + 1 file changed, 1 insertion(+)
arch/arm/Kconfig +1 -0
@@ -85,6 +85,7 @@ config ARM select HAVE_FTRACE_MCOUNT_RECORD if !XIP_KERNEL select HAVE_FUNCTION_GRAPH_TRACER if !THUMB2_KERNEL && !CC_IS_CLANG select HAVE_FUNCTION_TRACER if !XIP_KERNEL && (CC_IS_GCC || CLANG_VERSION >= 100000) + select HAVE_FUTEX_CMPXCHG if FUTEX select HAVE_GCC_PLUGINS select HAVE_HW_BREAKPOINT if PERF_EVENTS && (CPU_V6 || CPU_V6K || CPU_V7) select HAVE_IDE if PCI || ISA || PCMCIA
Greg Kroah-Hartman
maintainerPATCH 58/58 pinctrl: stm32: use valid pin identifier in stm32_pinctrl_resume()
In reply to Greg Kroah-HartmanFrom: Fabien Dessenne <[email protected]>
commit c370bb474016ab9edfdabd7c08a88dd13a71ddbd upstream.
When resuming from low power, the driver attempts to restore the configuration of some pins. This is done by a call to:
stm32_pinctrl_restore_gpio_regs(struct stm32_pinctrl *pctl, u32 pin)
where 'pin' must be a valid pin value (i.e. matching some 'groups->pin'). Fix the current implementation which uses some wrong 'pin' value.
--- drivers/pinctrl/stm32/pinctrl-stm32.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pinctrl/stm32/pinctrl-stm32.c +2 -2
@@ -1554,8 +1554,8 @@ int __maybe_unused stm32_pinctrl_resume(struct stm32_pinctrl_group *g = pctl->groups;int i; -for (i = g->pin; i < g->pin + pctl->ngroups; i++) -stm32_pinctrl_restore_gpio_regs (pctl, i); +for (i =0 ; i < pctl->ngroups; i++, g++) +stm32_pinctrl_restore_gpio_regs (pctl, g->pin);return 0 ; }
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.156 release. There are 58 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 27 Oct 2021 19:07:44 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.156-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels:
Signature · 1 line
Florian
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.156 release. There are 58 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 27 Oct 2021 19:07:44 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.156-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 5.4.156-rc1
* git: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
* git branch: linux-5.4.y
* git commit: 392d7d5e7dd0d7102d4ca92158bdf3ffaaf19292
* git describe: v5.4.155-59-g392d7d5e7dd0
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.4.y/build/v5.4.155-59-g392d7d5e7dd0
## No regressions (compared to v5.4.155)
## No fixes (compared to v5.4.155)
## Test result summary
total: 85949, pass: 70713, fail: 820, skip: 13198, xfail: 1218
## Build Summary
* arc: 10 total, 10 passed, 0 failed
* arm: 288 total, 288 passed, 0 failed
* arm64: 38 total, 38 passed, 0 failed
* dragonboard-410c: 1 total, 1 passed, 0 failed
* hi6220-hikey: 1 total, 1 passed, 0 failed
* i386: 19 total, 19 passed, 0 failed
* juno-r2: 1 total, 1 passed, 0 failed
* mips: 37 total, 37 passed, 0 failed
* parisc: 12 total, 12 passed, 0 failed
* powerpc: 36 total, 36 passed, 0 failed
* riscv: 24 total, 24 passed, 0 failed
* s390: 12 total, 12 passed, 0 failed
* sh: 24 total, 24 passed, 0 failed
* sparc: 12 total, 12 passed, 0 failed
* x15: 1 total, 1 passed, 0 failed
* x86: 1 total, 1 passed, 0 failed
* x86_64: 38 total, 38 passed, 0 failed
## Test suites summary
* fwts
* igt-gpu-tools
* kselftest-android
* kselftest-arm64
* kselftest-arm64/arm64.btitest.bti_c_func
* kselftest-arm64/arm64.btitest.bti_j_func
* kselftest-arm64/arm64.btitest.bti_jc_func
* kselftest-arm64/arm64.btitest.bti_none_func
* kselftest-arm64/arm64.btitest.nohint_func
* kselftest-arm64/arm64.btitest.paciasp_func
* kselftest-arm64/arm64.nobtitest.bti_c_func
* kselftest-arm64/arm64.nobtitest.bti_j_func
* kselftest-arm64/arm64.nobtitest.bti_jc_func
* kselftest-arm64/arm64.nobtitest.bti_none_func
* kselftest-arm64/arm64.nobtitest.nohint_func
* kselftest-arm64/arm64.nobtitest.paciasp_func
* kselftest-bpf
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-firmware
* kselftest-fpu
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-tc-testing
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-vm
* kselftest-x86
* kselftest-zram
* kvm-unit-tests
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-open-posix-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-tracing-tests
* network-basic-tests
* packetdrill
* perf
* rcutorture
* ssuite
* v4l2-compliance
--
Linaro LKFT
https://lkft.linaro.org
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.156 release. There are 58 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 27 Oct 2021 19:07:44 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.156-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v5.4:
10 builds: 10 pass, 0 fail
26 boots: 26 pass, 0 fail
59 tests: 59 pass, 0 failLinux version: 5.4.156-rc1-g392d7d5e7dd0
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04Jon
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.156 release. There are 58 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 27 Oct 2021 19:07:44 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.156-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
Upgrading to Ubuntu 21.10 caused issues with the boot related to zstd compression which is the default initramfs.conf for 21.10
If others run into this:
Change the default to lz4. I ended up enabling CONFIG_DECOMPRESS_ZSTD=y for 5.4 since it has support for ZSTD
On another note CONFIG_ZSTD_DECOMPRESS and CONFIG_DECOMPRESS_ZSTD naming rather confusing.
thanks,
-- Shuah
Hi Greg,
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.156 release. There are 58 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 27 Oct 2021 19:07:44 +0000. Anything received after that time might be too late.
Build test:
mips (gcc version 11.2.1 20211012): 65 configs -> no new failure arm (gcc version 11.2.1 20211012): 107 configs -> no new failure arm64 (gcc version 11.2.1 20211012): 2 configs -> no failure x86_64 (gcc version 10.2.1 20210110): 4 configs -> no failure
Boot test:x86_64: Booted on my test laptop. No regression.x86_64: Booted on qemu. No regression. [1]
[1]. https://openqa.qa.codethink.co.uk/tests/309
--
Regards
Sudip
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.156 release. There are 58 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 27 Oct 2021 19:07:44 +0000. Anything received after that time might be too late.
Build results:
total: 157 pass: 157 fail: 0 Qemu test results: total: 444 pass: 444 fail: 0
Guenter