5.10.102-rc1 review
Greg Kroah-Hartman
maintainercover 5.10.102-rc1 review
This is the start of the stable review cycle for the 5.10.102 release. There are 121 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 23 Feb 2022 08:48:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.102-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.10.102-rc1
Cheng Jui Wang <[email protected]>
lockdep: Correct lock_classes index mapping
Rafał Miłecki <[email protected]>
i2c: brcmstb: fix support for DSL and CM variants
Waiman Long <[email protected]>
copy_process(): Move fd_install() out of sighand->siglock critical section
Vladimir Zapolskiy <[email protected]>
i2c: qcom-cci: don't put a device tree node before i2c_add_adapter()
Vladimir Zapolskiy <[email protected]>
i2c: qcom-cci: don't delete an unregistered adapter
Jiasheng Jiang <[email protected]>
dmaengine: sh: rcar-dmac: Check for error num after dma_set_max_seg_size
Miaoqian Lin <[email protected]>
dmaengine: stm32-dmamux: Fix PM disable depth imbalance in stm32_dmamux_probe
Jiasheng Jiang <[email protected]>
dmaengine: sh: rcar-dmac: Check for error num after setting mask
Eric Dumazet <[email protected]>
net: sched: limit TC_ACT_REPEAT loops
Eliav Farber <[email protected]>
EDAC: Fix calculation of returned address and next offset in edac_align_ptr()
James Smart <[email protected]>
scsi: lpfc: Fix pt2pt NVMe PRLI reject LOGO loop
Jing Leng <[email protected]>
kconfig: fix failing to generate auto.conf
Marc St-Amand <[email protected]>
net: macb: Align the dma and coherent dma masks
Slark Xiao <[email protected]>
net: usb: qmi_wwan: Add support for Dell DW5829e
JaeSang Yoo <[email protected]>
tracing: Fix tp_printk option related with tp_printk_stop_on_boot
Sascha Hauer <[email protected]>
drm/rockchip: dw_hdmi: Do not leave clock enabled in error case
Dan Aloni <[email protected]>
xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create
Jae Hyun Yoo <[email protected]>
soc: aspeed: lpc-ctrl: Block error printing on probe defer cases
Zoltán Böszörményi <[email protected]>
ata: libata-core: Disable TRIM on M88V29
Brenda Streiff <[email protected]>
kconfig: let 'shell' return enough output for deep path names
Axel Rasmussen <[email protected]>
selftests: fixup build warnings in pidfd / clone3 tests
Axel Rasmussen <[email protected]>
pidfd: fix test failure due to stack overflow on some arches
Christian Hewitt <[email protected]>
arm64: dts: meson-g12: drop BL32 region from SEI510/SEI610
Christian Hewitt <[email protected]>
arm64: dts: meson-g12: add ATF BL32 reserved-memory region
Christian Hewitt <[email protected]>
arm64: dts: meson-gx: add ATF BL32 reserved-memory region
Florian Westphal <[email protected]>
netfilter: conntrack: don't refresh sctp entries in closed state
Guo Ren <[email protected]>
irqchip/sifive-plic: Add missing thead,c900-plic match string
Al Cooper <[email protected]>
phy: usb: Leave some clocks running during suspend
Ye Guojin <[email protected]>
ARM: OMAP2+: adjust the location of put_device() call in omapdss_init_of
Wan Jiabing <[email protected]>
ARM: OMAP2+: hwmod: Add of_node_put() before break
Trond Myklebust <[email protected]>
NFS: Don't set NFS_INO_INVALID_XATTR if there is no xattr cache
Jim Mattson <[email protected]>
KVM: x86/pmu: Use AMD64_RAW_EVENT_MASK for PERF_TYPE_RAW
Jim Mattson <[email protected]>
KVM: x86/pmu: Don't truncate the PerfEvtSeln MSR when creating a perf event
Like Xu <[email protected]>
KVM: x86/pmu: Refactoring find_arch_event() to pmc_perf_hw_id()
Miaoqian Lin <[email protected]>
Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj
david regan <[email protected]>
mtd: rawnand: brcmnand: Fixed incorrect sub-page ECC status
Bryan O'Donoghue <[email protected]>
mtd: rawnand: qcom: Fix clock sequencing in qcom_nandc_probe()
Linus Torvalds <[email protected]>
tty: n_tty: do not look ahead for EOL character past the end of the buffer
Trond Myklebust <[email protected]>
NFS: Do not report writeback errors in nfs_getattr()
Trond Myklebust <[email protected]>
NFS: LOOKUP_DIRECTORY is also ok with symlinks
Laibin Qiu <[email protected]>
block/wbt: fix negative inflight counter when remove scsi device
Martin Povišer <[email protected]>
ASoC: tas2770: Insert post reset delay
Jens Wiklander <[email protected]>
optee: use driver internal tee_context for some rpc
Jens Wiklander <[email protected]>
tee: export teedev_open() and teedev_close_context()
Sean Christopherson <[email protected]>
KVM: SVM: Never reject emulation due to SMAP errata for !SEV guests
Christian Eggers <[email protected]>
mtd: rawnand: gpmi: don't leak PM reference in error path
Anders Roxell <[email protected]>
powerpc/lib/sstep: fix 'ptesync' build error
Mark Brown <[email protected]>
ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range()
Mark Brown <[email protected]>
ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw()
Takashi Iwai <[email protected]>
ALSA: hda: Fix missing codec probe on Shenker Dock 15
Takashi Iwai <[email protected]>
ALSA: hda: Fix regression on forced probe mask option
Takashi Iwai <[email protected]>
ALSA: hda/realtek: Fix deadlock by COEF mutex
Yu Huang <[email protected]>
ALSA: hda/realtek: Add quirk for Legion Y9000X 2019
Muhammad Usama Anjum <[email protected]>
selftests/exec: Add non-regular to TEST_GEN_PROGS
Arnaldo Carvalho de Melo <[email protected]>
perf bpf: Defer freeing string after possible strlen() on it
Radu Bulie <[email protected]>
dpaa2-eth: Initialize mutex used in one step timestamping path
Kees Cook <[email protected]>
libsubcmd: Fix use-after-free for realloc(..., 0)
Eric Dumazet <[email protected]>
bonding: fix data-races around agg_select_timer
Eric Dumazet <[email protected]>
net_sched: add __rcu annotation to netdev->qdisc
Eric Dumazet <[email protected]>
drop_monitor: fix data-race in dropmon_net_event / trace_napi_poll_hit
Zhang Changzhong <[email protected]>
bonding: force carrier update when releasing slave
Xin Long <[email protected]>
ping: fix the dif and sdif check in ping_lookup
Miquel Raynal <[email protected]>
net: ieee802154: ca8210: Fix lifs/sifs periods
Alexey Khoroshilov <[email protected]>
net: dsa: lantiq_gswip: fix use after free in gswip_remove()
Mans Rullgard <[email protected]>
net: dsa: lan9303: fix reset on probe
Willem de Bruijn <[email protected]>
ipv6: per-netns exclusive flowlabel checks
Pablo Neira Ayuso <[email protected]>
netfilter: nft_synproxy: unregister hooks on init error path
Hangbin Liu <[email protected]>
selftests: netfilter: fix exit value for nft_concat_range
Johannes Berg <[email protected]>
iwlwifi: pcie: gen2: fix locking when "HW not ready"
Johannes Berg <[email protected]>
iwlwifi: pcie: fix locking when "HW not ready"
Siva Mullati <[email protected]>
drm/i915/gvt: Make DRM_I915_GVT depend on X86
Seth Forshee <[email protected]>
vsock: remove vsock from connected table when connect is interrupted by a signal
Jani Nikula <[email protected]>
drm/i915/opregion: check port number bounds for SWSCI display power state
Nicholas Bishop <[email protected]>
drm/radeon: Fix backlight control on iMac 12,1
Johannes Berg <[email protected]>
iwlwifi: fix use-after-free
Sean Christopherson <[email protected]>
kbuild: lto: Merge module sections if and only if CONFIG_LTO_CLANG is enabled
Sami Tolvanen <[email protected]>
kbuild: lto: merge module sections
Jason A. Donenfeld <[email protected]>
random: wake up /dev/random writers after zap
Kees Cook <[email protected]>
gcc-plugins/stackleak: Use noinstr in favor of notrace
Igor Pylypiv <[email protected]>
Revert "module, async: async_synchronize_full() on module init iff async is used"
Jan Beulich <[email protected]>
x86/Xen: streamline (and fix) PV CPU enumeration
Christian König <[email protected]>
drm/amdgpu: fix logic inversion in check
Sagi Grimberg <[email protected]>
nvme-rdma: fix possible use-after-free in transport error_recovery work
Sagi Grimberg <[email protected]>
nvme-tcp: fix possible use-after-free in transport error_recovery work
Sagi Grimberg <[email protected]>
nvme: fix a possible use-after-free in controller reset during load
John Garry <[email protected]>
scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task
John Garry <[email protected]>
scsi: pm8001: Fix use-after-free for aborted TMF sas_task
Darrick J. Wong <[email protected]>
quota: make dquot_quota_sync return errors from ->sync_fs
Darrick J. Wong <[email protected]>
vfs: make freeze_super abort when sync_filesystem returns error
Duoming Zhou <[email protected]>
ax25: improve the incomplete fix to avoid UAF and NPD bugs
Cristian Marussi <[email protected]>
selftests: skip mincore.check_file_mmap when fs lacks needed support
Cristian Marussi <[email protected]>
selftests: openat2: Skip testcases that fail with EOPNOTSUPP
Cristian Marussi <[email protected]>
selftests: openat2: Add missing dependency in Makefile
Cristian Marussi <[email protected]>
selftests: openat2: Print also errno in failure messages
Yang Xu <[email protected]>
selftests/zram: Adapt the situation that /dev/zram0 is being used
Yang Xu <[email protected]>
selftests/zram01.sh: Fix compression ratio calculation
Yang Xu <[email protected]>
selftests/zram: Skip max_comp_streams interface on newer kernel
Miquel Raynal <[email protected]>
net: ieee802154: at86rf230: Stop leaking skb's
Li Zhijian <[email protected]>
kselftest: signal all child processes
Nícolas F. R. A. Prado <[email protected]>
selftests: rtc: Increase test timeout so that all tests run
Srinivas Pandruvada <[email protected]>
platform/x86: ISST: Fix possible circular locking dependency detected
Yuka Kawajiri <[email protected]>
platform/x86: touchscreen_dmi: Add info for the RWC NANOTE P8 AY07J 2-in-1
Dāvis Mosāns <[email protected]>
btrfs: send: in case of IO error log it
Andy Shevchenko <[email protected]>
parisc: Add ioread64_lo_hi() and iowrite64_lo_hi()
Long Li <[email protected]>
PCI: hv: Fix NUMA node assignment when kernel boots with custom NUMA topology
Linus Torvalds <[email protected]>
mm: don't try to NUMA-migrate COW pages that have other uses
Christian Löhle <[email protected]>
mmc: block: fix read single on recovery logic
John David Anglin <[email protected]>
parisc: Fix sglist access in ccio-dma.c
John David Anglin <[email protected]>
parisc: Fix data TLB miss in sba_unmap_sg
John David Anglin <[email protected]>
parisc: Drop __init from map_pages declaration
Randy Dunlap <[email protected]>
serial: parisc: GSC: fix build when IOSAPIC is not set
Sean Christopherson <[email protected]>
Revert "svm: Add warning message for AVIC IPI invalid target"
Sergio Costas <[email protected]>
HID:Add support for UGTABLET WP5540
James Smart <[email protected]>
scsi: lpfc: Fix mailbox command failure during driver initialization
Oliver Hartkopp <[email protected]>
can: isotp: add SF_BROADCAST support for functional addressing
Norbert Slusarek <[email protected]>
can: isotp: prevent race between isotp_bind() and isotp_setsockopt()
Yang Shi <[email protected]>
fs/proc: task_mmu.c: don't read mapcount for migration entry
Linus Torvalds <[email protected]>
fget: clarify and improve __fget_files() implementation
Paul E. McKenney <[email protected]>
rcu: Do not report strict GPs for outgoing CPUs
Roman Gushchin <[email protected]>
mm: memcg: synchronize objcg lists with a dedicated spinlock
Ben Skeggs <[email protected]>
drm/nouveau/pmu/gm200-: use alternate falcon reset sequence
-------------
Diffstat:
Makefile | 4 +- arch/arm/mach-omap2/display.c | 2 +- arch/arm/mach-omap2/omap_hwmod.c | 4 +- arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 6 + arch/arm64/boot/dts/amlogic/meson-g12a-sei510.dts | 8 -- arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 6 + arch/arm64/boot/dts/amlogic/meson-sm1-sei610.dts | 8 -- arch/parisc/lib/iomap.c | 18 +++ arch/parisc/mm/init.c | 9 +- arch/powerpc/lib/sstep.c | 2 + arch/x86/kvm/pmu.c | 15 +-- arch/x86/kvm/pmu.h | 3 +- arch/x86/kvm/svm/avic.c | 2 - arch/x86/kvm/svm/pmu.c | 8 +- arch/x86/kvm/svm/svm.c | 7 +- arch/x86/kvm/vmx/pmu_intel.c | 9 +- arch/x86/xen/enlighten_pv.c | 4 - arch/x86/xen/smp_pv.c | 26 +--- block/bfq-iosched.c | 2 + block/elevator.c | 2 - drivers/ata/libata-core.c | 1 + drivers/char/random.c | 5 +- drivers/dma/sh/rcar-dmac.c | 9 +- drivers/dma/stm32-dmamux.c | 4 +- drivers/edac/edac_mc.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 2 +- drivers/gpu/drm/i915/Kconfig | 1 + drivers/gpu/drm/i915/display/intel_opregion.c | 15 +++ drivers/gpu/drm/nouveau/nvkm/falcon/base.c | 8 +- drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gm200.c | 31 ++++- drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gm20b.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp102.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp10b.c | 2 +- drivers/gpu/drm/nouveau/nvkm/subdev/pmu/priv.h | 2 + drivers/gpu/drm/radeon/atombios_encoders.c | 3 +- drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c | 14 +-- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-quirks.c | 1 + drivers/hv/vmbus_drv.c | 5 +- drivers/i2c/busses/i2c-brcmstb.c | 2 +- drivers/i2c/busses/i2c-qcom-cci.c | 16 ++- drivers/irqchip/irq-sifive-plic.c | 1 + drivers/mmc/core/block.c | 28 ++--- drivers/mtd/nand/raw/brcmnand/brcmnand.c | 2 +- drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 3 +- drivers/mtd/nand/raw/qcom_nandc.c | 14 +-- drivers/net/bonding/bond_3ad.c | 30 ++++- drivers/net/bonding/bond_main.c | 5 +- drivers/net/dsa/lan9303-core.c | 2 +- drivers/net/dsa/lantiq_gswip.c | 2 +- drivers/net/ethernet/cadence/macb_main.c | 2 +- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 2 +- drivers/net/ieee802154/at86rf230.c | 13 +- drivers/net/ieee802154/ca8210.c | 4 +- drivers/net/usb/qmi_wwan.c | 2 + drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 2 + .../net/wireless/intel/iwlwifi/pcie/trans-gen2.c | 3 +- drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 3 +- drivers/nvme/host/core.c | 9 +- drivers/nvme/host/rdma.c | 1 + drivers/nvme/host/tcp.c | 1 + drivers/parisc/ccio-dma.c | 3 +- drivers/parisc/sba_iommu.c | 3 +- drivers/pci/controller/pci-hyperv.c | 13 +- drivers/phy/broadcom/phy-brcm-usb.c | 38 ++++++ .../x86/intel_speed_select_if/isst_if_common.c | 97 +++++++++------ drivers/platform/x86/touchscreen_dmi.c | 24 ++++ drivers/scsi/lpfc/lpfc.h | 1 + drivers/scsi/lpfc/lpfc_attr.c | 3 + drivers/scsi/lpfc/lpfc_els.c | 20 ++- drivers/scsi/lpfc/lpfc_nportdisc.c | 5 +- drivers/scsi/lpfc/lpfc_sli.c | 15 ++- drivers/scsi/pm8001/pm8001_sas.c | 5 + drivers/scsi/pm8001/pm80xx_hwi.c | 4 +- drivers/soc/aspeed/aspeed-lpc-ctrl.c | 7 +- drivers/tee/optee/core.c | 8 ++ drivers/tee/optee/optee_private.h | 2 + drivers/tee/optee/rpc.c | 8 +- drivers/tee/tee_core.c | 6 +- drivers/tty/n_tty.c | 6 +- drivers/tty/serial/8250/8250_gsc.c | 2 +- fs/btrfs/send.c | 4 + fs/file.c | 72 ++++++++--- fs/nfs/dir.c | 4 +- fs/nfs/inode.c | 23 +++- fs/proc/task_mmu.c | 43 +++++-- fs/quota/dquot.c | 11 +- fs/super.c | 19 +-- include/linux/memcontrol.h | 5 +- include/linux/netdevice.h | 2 +- include/linux/sched.h | 1 - include/linux/tee_drv.h | 14 +++ include/net/bond_3ad.h | 2 +- include/net/ipv6.h | 5 +- include/net/netns/ipv6.h | 3 +- include/uapi/linux/can/isotp.h | 2 +- kernel/async.c | 3 - kernel/fork.c | 7 +- kernel/locking/lockdep.c | 4 +- kernel/module.c | 25 +--- kernel/rcu/tree_plugin.h | 2 +- kernel/stackleak.c | 5 +- kernel/trace/trace.c | 4 + mm/memcontrol.c | 10 +- mm/mprotect.c | 2 +- net/ax25/af_ax25.c | 9 +- net/can/isotp.c | 71 ++++++++--- net/core/drop_monitor.c | 11 +- net/core/rtnetlink.c | 6 +- net/ipv4/ping.c | 11 +- net/ipv6/ip6_flowlabel.c | 4 +- net/netfilter/nf_conntrack_proto_sctp.c | 9 ++ net/netfilter/nft_synproxy.c | 4 +- net/sched/act_api.c | 13 +- net/sched/cls_api.c | 6 +- net/sched/sch_api.c | 22 ++-- net/sched/sch_generic.c | 29 +++-- net/sunrpc/xprtrdma/verbs.c | 3 + net/vmw_vsock/af_vsock.c | 1 + scripts/kconfig/confdata.c | 13 +- scripts/kconfig/preprocess.c | 2 +- scripts/module.lds.S | 26 ++++ sound/pci/hda/hda_intel.c | 5 +- sound/pci/hda/patch_realtek.c | 40 +++--- sound/soc/codecs/tas2770.c | 7 +- sound/soc/soc-ops.c | 29 +++-- tools/lib/subcmd/subcmd-util.h | 11 +- tools/perf/util/bpf-loader.c | 3 +- tools/testing/selftests/clone3/clone3.c | 2 - tools/testing/selftests/exec/Makefile | 4 +- tools/testing/selftests/kselftest_harness.h | 4 +- tools/testing/selftests/mincore/mincore_selftest.c | 20 ++- .../selftests/netfilter/nft_concat_range.sh | 2 +- tools/testing/selftests/openat2/Makefile | 2 +- tools/testing/selftests/openat2/helpers.h | 12 +- tools/testing/selftests/openat2/openat2_test.c | 12 +- tools/testing/selftests/pidfd/pidfd.h | 13 +- tools/testing/selftests/pidfd/pidfd_fdinfo_test.c | 22 +++- tools/testing/selftests/pidfd/pidfd_test.c | 6 +- tools/testing/selftests/pidfd/pidfd_wait.c | 5 +- tools/testing/selftests/rtc/settings | 2 +- tools/testing/selftests/zram/zram.sh | 15 +-- tools/testing/selftests/zram/zram01.sh | 33 ++--- tools/testing/selftests/zram/zram02.sh | 1 - tools/testing/selftests/zram/zram_lib.sh | 134 ++++++++++++++------- 145 files changed, 1052 insertions(+), 516 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/121 drm/nouveau/pmu/gm200-: use alternate falcon reset sequence
From: Ben Skeggs <[email protected]>
commit 4cdd2450bf739bada353e82d27b00db9af8c3001 upstream.
--- drivers/gpu/drm/nouveau/nvkm/falcon/base.c | 8 ++++-- drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gm200.c | 31 +++++++++++++++++++++++- drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gm20b.c | 2 - drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp102.c | 2 - drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp10b.c | 2 - drivers/gpu/drm/nouveau/nvkm/subdev/pmu/priv.h | 2 + 6 files changed, 41 insertions(+), 6 deletions(-)
drivers/gpu/drm/nouveau/nvkm/falcon/base.c +6 -2
@@ -119,8 +119,12 @@ nvkm_falcon_disable(struct nvkm_falcon *int nvkm_falcon_reset (struct nvkm_falcon *falcon) { -nvkm_falcon_disable (falcon); -return nvkm_falcon_enable (falcon); +if (!falcon->func->reset) { +nvkm_falcon_disable (falcon); +return nvkm_falcon_enable (falcon); + } + +return falcon->func->reset (falcon); }int
drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gm200.c +30 -1
@@ -23,9 +23,38 @@*/ #include "priv.h" +static int +gm200_pmu_flcn_reset (struct nvkm_falcon *falcon) +{ +struct nvkm_pmu *pmu =container_of (falcon,typeof (*pmu), falcon); + +nvkm_falcon_wr32 (falcon,0x014 ,0x0000ffff ); + pmu->func->reset (pmu); +return nvkm_falcon_enable (falcon); +} + +const struct nvkm_falcon_func +gm200_pmu_flcn = { + .debug =0xc08 , + .fbif =0xe00 , + .load_imem = nvkm_falcon_v1_load_imem, + .load_dmem = nvkm_falcon_v1_load_dmem, + .read_dmem = nvkm_falcon_v1_read_dmem, + .bind_context = nvkm_falcon_v1_bind_context, + .wait_for_halt = nvkm_falcon_v1_wait_for_halt, + .clear_interrupt = nvkm_falcon_v1_clear_interrupt, + .set_start_addr = nvkm_falcon_v1_set_start_addr, + .start = nvkm_falcon_v1_start, + .enable = nvkm_falcon_v1_enable, + .disable = nvkm_falcon_v1_disable, + .reset = gm200_pmu_flcn_reset, + .cmdq = {0x4a0 ,0x4b0 ,4 }, + .msgq = {0x4c8 ,0x4cc ,0 }, +}; +static const struct nvkm_pmu_func gm200_pmu = { - .flcn = >215_pmu_flcn, + .flcn = &gm200_pmu_flcn, .enabled = gf100_pmu_enabled, .reset = gf100_pmu_reset, };
drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gm20b.c +1 -1
@@ -211,7 +211,7 @@ gm20b_pmu_recv(struct nvkm_pmu *pmu)static const struct nvkm_pmu_func gm20b_pmu = { - .flcn = >215_pmu_flcn, + .flcn = &gm200_pmu_flcn, .enabled = gf100_pmu_enabled, .intr = gt215_pmu_intr, .recv = gm20b_pmu_recv,
drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp102.c +1 -1
@@ -39,7 +39,7 @@ gp102_pmu_enabled(struct nvkm_pmu *pmu)static const struct nvkm_pmu_func gp102_pmu = { - .flcn = >215_pmu_flcn, + .flcn = &gm200_pmu_flcn, .enabled = gp102_pmu_enabled, .reset = gp102_pmu_reset, };
drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp10b.c +1 -1
@@ -78,7 +78,7 @@ gp10b_pmu_acr = {static const struct nvkm_pmu_func gp10b_pmu = { - .flcn = >215_pmu_flcn, + .flcn = &gm200_pmu_flcn, .enabled = gf100_pmu_enabled, .intr = gt215_pmu_intr, .recv = gm20b_pmu_recv,
drivers/gpu/drm/nouveau/nvkm/subdev/pmu/priv.h +2 -0
@@ -44,6 +44,8 @@ void gf100_pmu_reset(struct nvkm_pmu *);void gk110_pmu_pgob (struct nvkm_pmu *,bool ); +extern const struct nvkm_falcon_func gm200_pmu_flcn; +void gm20b_pmu_acr_bld_patch (struct nvkm_acr *,u32 ,s64 );void gm20b_pmu_acr_bld_write (struct nvkm_acr *,u32 ,struct nvkm_acr_lsfw *);int gm20b_pmu_acr_boot (struct nvkm_falcon *);
Greg Kroah-Hartman
maintainerPATCH 2/121 mm: memcg: synchronize objcg lists with a dedicated spinlock
In reply to Greg Kroah-HartmanFrom: Roman Gushchin <[email protected]>
commit 0764db9b49c932b89ee4d9e3236dff4bb07b4a66 upstream.
Alexander reported a circular lock dependency revealed by the mmap1 ltp test:
LOCKDEP_CIRCULAR (suite: ltp, case: mtest06 (mmap1))
WARNING: possible circular locking dependency detected
5.17.0-20220113.rc0.git0.f2211f194038.300.fc35.s390x+debug #1 Not tainted
------------------------------------------------------
mmap1/202299 is trying to acquire lock:
00000001892c0188 (css_set_lock){..-.}-{2:2}, at: obj_cgroup_release+0x4a/0xe0
but task is already holding lock:
00000000ca3b3818 (&sighand->siglock){-.-.}-{2:2}, at: force_sig_info_to_task+0x38/0x180
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #1 (&sighand->siglock){-.-.}-{2:2}:
__lock_acquire+0x604/0xbd8
lock_acquire.part.0+0xe2/0x238
lock_acquire+0xb0/0x200
_raw_spin_lock_irqsave+0x6a/0xd8
__lock_task_sighand+0x90/0x190
cgroup_freeze_task+0x2e/0x90
cgroup_migrate_execute+0x11c/0x608
cgroup_update_dfl_csses+0x246/0x270
cgroup_subtree_control_write+0x238/0x518
kernfs_fop_write_iter+0x13e/0x1e0
new_sync_write+0x100/0x190
vfs_write+0x22c/0x2d8
ksys_write+0x6c/0xf8
__do_syscall+0x1da/0x208
system_call+0x82/0xb0
-> #0 (css_set_lock){..-.}-{2:2}:
check_prev_add+0xe0/0xed8
validate_chain+0x736/0xb20
__lock_acquire+0x604/0xbd8
lock_acquire.part.0+0xe2/0x238
lock_acquire+0xb0/0x200
_raw_spin_lock_irqsave+0x6a/0xd8
obj_cgroup_release+0x4a/0xe0
percpu_ref_put_many.constprop.0+0x150/0x168
drain_obj_stock+0x94/0xe8
refill_obj_stock+0x94/0x278
obj_cgroup_charge+0x164/0x1d8
kmem_cache_alloc+0xac/0x528
__sigqueue_alloc+0x150/0x308
__send_signal+0x260/0x550
send_signal+0x7e/0x348
force_sig_info_to_task+0x104/0x180
force_sig_fault+0x48/0x58
__do_pgm_check+0x120/0x1f0
pgm_check_handler+0x11e/0x180
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&sighand->siglock);
lock(css_set_lock);
lock(&sighand->siglock);
lock(css_set_lock);
*** DEADLOCK ***
2 locks held by mmap1/202299:
#0: 00000000ca3b3818 (&sighand->siglock){-.-.}-{2:2}, at: force_sig_info_to_task+0x38/0x180
#1: 00000001892ad560 (rcu_read_lock){....}-{1:2}, at: percpu_ref_put_many.constprop.0+0x0/0x168
stack backtrace:
CPU: 15 PID: 202299 Comm: mmap1 Not tainted 5.17.0-20220113.rc0.git0.f2211f194038.300.fc35.s390x+debug #1
Hardware name: IBM 3906 M04 704 (LPAR)
Call Trace:
dump_stack_lvl+0x76/0x98
check_noncircular+0x136/0x158
check_prev_add+0xe0/0xed8
validate_chain+0x736/0xb20
__lock_acquire+0x604/0xbd8
lock_acquire.part.0+0xe2/0x238
lock_acquire+0xb0/0x200
_raw_spin_lock_irqsave+0x6a/0xd8
obj_cgroup_release+0x4a/0xe0
percpu_ref_put_many.constprop.0+0x150/0x168
drain_obj_stock+0x94/0xe8
refill_obj_stock+0x94/0x278
obj_cgroup_charge+0x164/0x1d8
kmem_cache_alloc+0xac/0x528
__sigqueue_alloc+0x150/0x308
__send_signal+0x260/0x550
send_signal+0x7e/0x348
force_sig_info_to_task+0x104/0x180
force_sig_fault+0x48/0x58
__do_pgm_check+0x120/0x1f0
pgm_check_handler+0x11e/0x180
INFO: lockdep is turned off.In this example a slab allocation from __send_signal() caused a refilling and draining of a percpu objcg stock, resulted in a releasing of another non-related objcg. Objcg release path requires taking the css_set_lock, which is used to synchronize objcg lists.
This can create a circular dependency with the sighandler lock, which is taken with the locked css_set_lock by the freezer code (to freeze a task).
In general it seems that using css_set_lock to synchronize objcg lists makes any slab allocations and deallocation with the locked css_set_lock and any intervened locks risky.
To fix the problem and make the code more robust let's stop using css_set_lock to synchronize objcg lists and use a new dedicated spinlock instead.
--- include/linux/memcontrol.h | 5 +++-- mm/memcontrol.c | 10 +++++----- 2 files changed, 8 insertions(+), 7 deletions(-)
include/linux/memcontrol.h +3 -2
@@ -197,7 +197,7 @@ struct obj_cgroup {struct mem_cgroup *memcg;atomic_t nr_charged_bytes;union { -struct list_head list; +struct list_head list;/* protected by objcg_lock */ struct rcu_head rcu; }; };
@@ -300,7 +300,8 @@ struct mem_cgroup {int kmemcg_id;enum memcg_kmem_state kmem_state;struct obj_cgroup __rcu *objcg; -struct list_head objcg_list;/* list of inherited objcgs */ +/* list of inherited objcgs, protected by objcg_lock */ +struct list_head objcg_list;#endif MEMCG_PADDING (_pad2_);
mm/memcontrol.c +5 -5
@@ -250,7 +250,7 @@ struct cgroup_subsys_state *vmpressure_t }#ifdef CONFIG_MEMCG_KMEM -extern spinlock_t css_set_lock; +static DEFINE_SPINLOCK (objcg_lock);static void obj_cgroup_release (struct percpu_ref *ref) {
@@ -284,13 +284,13 @@ static void obj_cgroup_release(struct peWARN_ON_ONCE (nr_bytes & (PAGE_SIZE -1 )); nr_pages = nr_bytes >>PAGE_SHIFT ; -spin_lock_irqsave (&css_set_lock, flags); +spin_lock_irqsave (&objcg_lock, flags); memcg =obj_cgroup_memcg (objcg);if (nr_pages)__memcg_kmem_uncharge (memcg, nr_pages);list_del (&objcg->list);mem_cgroup_put (memcg); -spin_unlock_irqrestore (&css_set_lock, flags); +spin_unlock_irqrestore (&objcg_lock, flags);percpu_ref_exit (ref);kfree_rcu (objcg, rcu);
@@ -322,7 +322,7 @@ static void memcg_reparent_objcgs(struct objcg =rcu_replace_pointer (memcg->objcg,NULL , true); -spin_lock_irq (&css_set_lock); +spin_lock_irq (&objcg_lock);/* Move active objcg to the parent's list */ xchg (&objcg->memcg, parent);
@@ -337,7 +337,7 @@ static void memcg_reparent_objcgs(struct }list_splice (&memcg->objcg_list, &parent->objcg_list); -spin_unlock_irq (&css_set_lock); +spin_unlock_irq (&objcg_lock);percpu_ref_kill (&objcg->refcnt); }
Greg Kroah-Hartman
maintainerPATCH 3/121 rcu: Do not report strict GPs for outgoing CPUs
In reply to Greg Kroah-HartmanFrom: Paul E. McKenney <[email protected]>
commit bfb3aa735f82c8d98b32a669934ee7d6b346264d upstream.
An outgoing CPU is marked offline in a stop-machine handler and most of that CPU's services stop at that point, including IRQ work queues. However, that CPU must take another pass through the scheduler and through a number of CPU-hotplug notifiers, many of which contain RCU readers. In the past, these readers were not a problem because the outgoing CPU has interrupts disabled, so that rcu_read_unlock_special() would not be invoked, and thus RCU would never attempt to queue IRQ work on the outgoing CPU.
This changed with the advent of the CONFIG_RCU_STRICT_GRACE_PERIOD Kconfig option, in which rcu_read_unlock_special() is invoked upon exit from almost all RCU read-side critical sections. Worse yet, because interrupts are disabled, rcu_read_unlock_special() cannot immediately report a quiescent state and will therefore attempt to defer this reporting, for example, by queueing IRQ work. Which fails with a splat because the CPU is already marked as being offline.
But it turns out that there is no need to report this quiescent state because rcu_report_dead() will do this job shortly after the outgoing CPU makes its final dive into the idle loop. This commit therefore makes rcu_read_unlock_special() refrain from queuing IRQ work onto outgoing CPUs.
--- kernel/rcu/tree_plugin.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/rcu/tree_plugin.h +1 -1
@@ -628,7 +628,7 @@ static void rcu_read_unlock_special(struset_tsk_need_resched (current);set_preempt_need_resched ();if (IS_ENABLED (CONFIG_IRQ_WORK ) && irqs_were_disabled && - !rdp->defer_qs_iw_pending && exp) { + !rdp->defer_qs_iw_pending && exp &&cpu_online (rdp->cpu)) {// Get scheduler to re-evaluate and call hooks. // If !IRQ_WORK, FQS scan will eventually IPI. init_irq_work(&rdp->defer_qs_iw,
Greg Kroah-Hartman
maintainerPATCH 4/121 fget: clarify and improve __fget_files() implementation
In reply to Greg Kroah-HartmanFrom: Linus Torvalds <[email protected]>
commit e386dfc56f837da66d00a078e5314bc8382fab83 upstream.
Commit 054aa8d439b9 ("fget: check that the fd still exists after getting a ref to it") fixed a race with getting a reference to a file just as it was being closed. It was a fairly minimal patch, and I didn't think re-checking the file pointer lookup would be a measurable overhead, since it was all right there and cached.
But I was wrong, as pointed out by the kernel test robot.
The 'poll2' case of the will-it-scale.per_thread_ops benchmark regressed quite noticeably. Admittedly it seems to be a very artificial test:
doing "poll()" system calls on regular files in a very tight loop in multiple threads.
That means that basically all the time is spent just looking up file descriptors without ever doing anything useful with them (not that doing 'poll()' on a regular file is useful to begin with). And as a result it shows the extra "re-check fd" cost as a sore thumb.
Happily, the regression is fixable by just writing the code to loook up the fd to be better and clearer. There's still a cost to verify the file pointer, but now it's basically in the noise even for that benchmark that does nothing else - and the code is more understandable and has better comments too.
[ Side note: this patch is also a classic case of one that looks very
messy with the default greedy Myers diff - it's much more legible with either the patience of histogram diff algorithm ]
--- fs/file.c | 72 ++++++++++++++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 56 insertions(+), 16 deletions(-)
fs/file.c +56 -16
@@ -817,28 +817,68 @@ void do_close_on_exec(struct files_strucspin_unlock (&files->file_lock); } -static struct file *__fget_files (struct files_struct *files,unsigned int fd, -fmode_t mask,unsigned int refs) +static inline struct file *__fget_files_rcu (struct files_struct *files, +unsigned int fd,fmode_t mask,unsigned int refs) { -struct file *file; +for (;;) { +struct file *file; +struct fdtable *fdt =rcu_dereference_raw (files->fdt); +struct file __rcu **fdentry; -rcu_read_lock (); -loop: - file =fcheck_files (files, fd); -if (file) { -/* File object ref couldn't be taken. -* dup2() atomicity guarantee is the reason -* we loop to catch the new file (or NULL pointer) +if (unlikely (fd >= fdt->max_fds)) +return NULL ; + + fdentry = fdt->fd +array_index_nospec (fd, fdt->max_fds); + file =rcu_dereference_raw (*fdentry); +if (unlikely (!file)) +return NULL ; + +if (unlikely (file->f_mode & mask)) +return NULL ; + +/* +* Ok, we have a file pointer. However, because we do +* this all locklessly under RCU, we may be racing with +* that file being closed. +* +* Such a race can take two forms: +* +* (a) the file ref already went down to zero, +* and get_file_rcu_many() fails. Just try +* again: */ -if (file->f_mode & mask) - file =NULL ; -else if (!get_file_rcu_many (file, refs)) - goto loop; -else if (__fcheck_files (files, fd) != file) { +if (unlikely (!get_file_rcu_many (file, refs))) +continue ; + +/* +* (b) the file table entry has changed under us. +* Note that we don't need to re-check the 'fdt->fd' +* pointer having changed, because it always goes +* hand-in-hand with 'fdt'. +* +* If so, we need to put our refs and try again. +*/ +if (unlikely (rcu_dereference_raw (files->fdt) != fdt) || +unlikely (rcu_dereference_raw (*fdentry) != file)) {fput_many (file, refs); - goto loop; +continue ; } + +/* +* Ok, we have a ref to the file, and checked that it +* still exists. +*/ +return file; } +} + +static struct file *__fget_files (struct files_struct *files,unsigned int fd, +fmode_t mask,unsigned int refs) +{ +struct file *file; + +rcu_read_lock (); + file =__fget_files_rcu (files, fd, mask, refs);rcu_read_unlock ();return file;
Greg Kroah-Hartman
maintainerPATCH 5/121 fs/proc: task_mmu.c: dont read mapcount for migration entry
In reply to Greg Kroah-HartmanFrom: Yang Shi <[email protected]>
commit 24d7275ce2791829953ed4e72f68277ceb2571c6 upstream.
The syzbot reported the below BUG:
kernel BUG at include/linux/page-flags.h:785!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4392 Comm: syz-executor560 Not tainted 5.16.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:PageDoubleMap include/linux/page-flags.h:785 [inline]
RIP: 0010:__page_mapcount+0x2d2/0x350 mm/util.c:744
Call Trace:
page_mapcount include/linux/mm.h:837 [inline]
smaps_account+0x470/0xb10 fs/proc/task_mmu.c:466
smaps_pte_entry fs/proc/task_mmu.c:538 [inline]
smaps_pte_range+0x611/0x1250 fs/proc/task_mmu.c:601
walk_pmd_range mm/pagewalk.c:128 [inline]
walk_pud_range mm/pagewalk.c:205 [inline]
walk_p4d_range mm/pagewalk.c:240 [inline]
walk_pgd_range mm/pagewalk.c:277 [inline]
__walk_page_range+0xe23/0x1ea0 mm/pagewalk.c:379
walk_page_vma+0x277/0x350 mm/pagewalk.c:530
smap_gather_stats.part.0+0x148/0x260 fs/proc/task_mmu.c:768
smap_gather_stats fs/proc/task_mmu.c:741 [inline]
show_smap+0xc6/0x440 fs/proc/task_mmu.c:822
seq_read_iter+0xbb0/0x1240 fs/seq_file.c:272
seq_read+0x3e0/0x5b0 fs/seq_file.c:162
vfs_read+0x1b5/0x600 fs/read_write.c:479
ksys_read+0x12d/0x250 fs/read_write.c:619
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xaeThe reproducer was trying to read /proc/$PID/smaps when calling MADV_FREE at the mean time. MADV_FREE may split THPs if it is called for partial THP. It may trigger the below race:
CPU A CPU B
----- -----
smaps walk: MADV_FREE:
page_mapcount()
PageCompound()
split_huge_page()
page = compound_head(page) PageDoubleMap(page)
When calling PageDoubleMap() this page is not a tail page of THP anymore so the BUG is triggered.
This could be fixed by elevated refcount of the page before calling mapcount, but that would prevent it from counting migration entries, and it seems overkilling because the race just could happen when PMD is split so all PTE entries of tail pages are actually migration entries, and smaps_account() does treat migration entries as mapcount == 1 as Kirill pointed out.
Add a new parameter for smaps_account() to tell this entry is migration entry then skip calling page_mapcount(). Don't skip getting mapcount for device private entries since they do track references with mapcount.
Pagemap also has the similar issue although it was not reported. Fixed it as well.
--- fs/proc/task_mmu.c | 43 ++++++++++++++++++++++++++++++++----------- 1 file changed, 32 insertions(+), 11 deletions(-)
fs/proc/task_mmu.c +32 -11
@@ -430,7 +430,8 @@ static void smaps_page_accumulate(struct }static void smaps_account (struct mem_size_stats *mss,struct page *page, -bool compound,bool young,bool dirty,bool locked) +bool compound,bool young,bool dirty,bool locked, +bool migration) {int i, nr = compound ?compound_nr (page) :1 ;unsigned long size = nr *PAGE_SIZE ;
@@ -457,8 +458,15 @@ static void smaps_account(struct mem_siz* page_count(page) == 1 guarantees the page is mapped exactly once. * If any subpage of the compound page mapped with PTE it would elevate * page_count(). +* +* The page_mapcount() is called to get a snapshot of the mapcount. +* Without holding the page lock this snapshot can be slightly wrong as +* we cannot always read the mapcount atomically. It is not safe to +* call page_mapcount() even with PTL held if the page is not mapped, +* especially for migration entries. Treat regular migration entries +* as mapcount == 1. */ -if (page_count (page) ==1 ) { +if ((page_count (page) ==1 ) || migration) {smaps_page_accumulate (mss, page, size, size <<PSS_SHIFT , dirty, locked, true);return ;
@@ -495,6 +503,7 @@ static void smaps_pte_entry(pte_t *pte,struct vm_area_struct *vma = walk->vma;bool locked = !!(vma->vm_flags &VM_LOCKED );struct page *page =NULL ; +bool migration = false;if (pte_present (*pte)) { page =vm_normal_page (vma, addr, *pte);
@@ -514,9 +523,10 @@ static void smaps_pte_entry(pte_t *pte, }else { mss->swap_pss += (u64 )PAGE_SIZE <<PSS_SHIFT ; } - }else if (is_migration_entry (swpent)) + }else if (is_migration_entry (swpent)) { + migration = true; page =migration_entry_to_page (swpent); -else if (is_device_private_entry (swpent)) + }else if (is_device_private_entry (swpent)) page =device_private_entry_to_page (swpent); }else if (unlikely (IS_ENABLED (CONFIG_SHMEM ) && mss->check_shmem_swap &&pte_none (*pte))) {
@@ -530,7 +540,8 @@ static void smaps_pte_entry(pte_t *pte,if (!page)return ; -smaps_account (mss, page, false,pte_young (*pte),pte_dirty (*pte), locked); +smaps_account (mss, page, false,pte_young (*pte),pte_dirty (*pte), + locked, migration); }#ifdef CONFIG_TRANSPARENT_HUGEPAGE
@@ -541,6 +552,7 @@ static void smaps_pmd_entry(pmd_t *pmd,struct vm_area_struct *vma = walk->vma;bool locked = !!(vma->vm_flags &VM_LOCKED );struct page *page =NULL ; +bool migration = false;if (pmd_present (*pmd)) {/* FOLL_DUMP will return -EFAULT on huge zero page */
@@ -548,8 +560,10 @@ static void smaps_pmd_entry(pmd_t *pmd, }else if (unlikely (thp_migration_supported () &&is_swap_pmd (*pmd))) {swp_entry_t entry =pmd_to_swp_entry (*pmd); -if (is_migration_entry (entry)) +if (is_migration_entry (entry)) { + migration = true; page =migration_entry_to_page (entry); + } }if (IS_ERR_OR_NULL (page))return ;
@@ -561,7 +575,9 @@ static void smaps_pmd_entry(pmd_t *pmd,/* pass */ ; else mss->file_thp += HPAGE_PMD_SIZE; -smaps_account (mss, page, true,pmd_young (*pmd),pmd_dirty (*pmd), locked); + +smaps_account (mss, page, true,pmd_young (*pmd),pmd_dirty (*pmd), + locked, migration); }#else static void smaps_pmd_entry(pmd_t *pmd, unsigned long addr,
@@ -1366,6 +1382,7 @@ static pagemap_entry_t pte_to_pagemap_en {u64 frame =0 , flags =0 ;struct page *page =NULL ; +bool migration = false;if (pte_present (pte)) {if (pm->show_pfn)
@@ -1383,8 +1400,10 @@ static pagemap_entry_t pte_to_pagemap_en frame =swp_type (entry) | (swp_offset (entry) <<MAX_SWAPFILES_SHIFT ); flags |=PM_SWAP ; -if (is_migration_entry (entry)) +if (is_migration_entry (entry)) { + migration = true; page =migration_entry_to_page (entry); + }if (is_device_private_entry (entry)) page =device_private_entry_to_page (entry);
@@ -1392,7 +1411,7 @@ static pagemap_entry_t pte_to_pagemap_enif (page && !PageAnon (page)) flags |=PM_FILE ; -if (page &&page_mapcount (page) ==1 ) +if (page && !migration &&page_mapcount (page) ==1 ) flags |=PM_MMAP_EXCLUSIVE ;if (vma->vm_flags &VM_SOFTDIRTY ) flags |=PM_SOFT_DIRTY ;
@@ -1408,8 +1427,9 @@ static int pagemap_pmd_range(pmd_t *pmdpspinlock_t *ptl;pte_t *pte, *orig_pte;int err =0 ; -#ifdef CONFIG_TRANSPARENT_HUGEPAGE +bool migration = false; + ptl =pmd_trans_huge_lock (pmdp, vma);if (ptl) {u64 flags =0 , frame =0 ;
@@ -1444,11 +1464,12 @@ static int pagemap_pmd_range(pmd_t *pmdpif (pmd_swp_soft_dirty (pmd)) flags |=PM_SOFT_DIRTY ;VM_BUG_ON (!is_pmd_migration_entry (pmd)); + migration =is_migration_entry (entry); page = migration_entry_to_page(entry); }#endif -if (page &&page_mapcount (page) ==1 ) +if (page && !migration &&page_mapcount (page) ==1 ) flags |=PM_MMAP_EXCLUSIVE ;for (; addr != end; addr +=PAGE_SIZE ) {
Greg Kroah-Hartman
maintainerPATCH 6/121 can: isotp: prevent race between isotp_bind() and isotp_setsockopt()
In reply to Greg Kroah-HartmanFrom: Norbert Slusarek <[email protected]>
commit 2b17c400aeb44daf041627722581ade527bb3c1d upstream.
A race condition was found in isotp_setsockopt() which allows to change socket options after the socket was bound.
For the specific case of SF_BROADCAST support, this might lead to possible use-after-free because can_rx_unregister() is not called.
Checking for the flag under the socket lock in isotp_bind() and taking the lock in isotp_setsockopt() fixes the issue.
--- net/can/isotp.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-)
net/can/isotp.c +17 -4
@@ -1193,16 +1193,13 @@ static int isotp_getname(struct socket *return ISOTP_MIN_NAMELEN ; } -static int isotp_setsockopt (struct socket *sock,int level,int optname, +static int isotp_setsockopt_locked (struct socket *sock,int level,int optname,sockptr_t optval,unsigned int optlen) {struct sock *sk = sock->sk;struct isotp_sock *so =isotp_sk (sk);int ret =0 ; -if (level !=SOL_CAN_ISOTP ) -return -EINVAL ; -if (so->bound)return -EISCONN ;
@@ -1277,6 +1274,22 @@ static int isotp_setsockopt(struct sockereturn ret; } +static int isotp_setsockopt (struct socket *sock,int level,int optname, +sockptr_t optval,unsigned int optlen) + +{ +struct sock *sk = sock->sk; +int ret; + +if (level !=SOL_CAN_ISOTP ) +return -EINVAL ; + +lock_sock (sk); + ret =isotp_setsockopt_locked (sock, level, optname, optval, optlen); +release_sock (sk); +return ret; +} +static int isotp_getsockopt (struct socket *sock,int level,int optname,char __user *optval,int __user *optlen) {
Greg Kroah-Hartman
maintainerPATCH 7/121 can: isotp: add SF_BROADCAST support for functional addressing
In reply to Greg Kroah-HartmanFrom: Oliver Hartkopp <[email protected]>
commit 921ca574cd382142add8b12d0a7117f495510de5 upstream.
When CAN_ISOTP_SF_BROADCAST is set in the CAN_ISOTP_OPTS flags the CAN_ISOTP socket is switched into functional addressing mode, where only single frame (SF) protocol data units can be send on the specified CAN interface and the given tp.tx_id after bind().
In opposite to normal and extended addressing this socket does not register a CAN-ID for reception which would be needed for a 1-to-1 ISOTP connection with a segmented bi-directional data transfer.
Sending SFs on this socket is therefore a TX-only 'broadcast' operation.
--- include/uapi/linux/can/isotp.h | 2 - net/can/isotp.c | 50 +++++++++++++++++++++++++++++------------ 2 files changed, 37 insertions(+), 15 deletions(-)
include/uapi/linux/can/isotp.h +1 -1
@@ -135,7 +135,7 @@ struct can_isotp_ll_options {#define CAN_ISOTP_FORCE_RXSTMIN 0x100/* ignore CFs depending on rx stmin */ #define CAN_ISOTP_RX_EXT_ADDR 0x200/* different rx extended addressing */ #define CAN_ISOTP_WAIT_TX_DONE 0x400/* wait for tx completion */ - +#define CAN_ISOTP_SF_BROADCAST 0x800/* 1-to-N functional addressing */ /* default values */
net/can/isotp.c +36 -14
99 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 8/121 scsi: lpfc: Fix mailbox command failure during driver initialization
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
commit efe1dc571a5b808baa26682eef16561be2e356fd upstream.
Contention for the mailbox interface may occur during driver initialization (immediately after a function reset), between mailbox commands initiated via ioctl (bsg) and those driver requested by the driver.
After setting SLI_ACTIVE flag for a port, there is a window in which the driver will allow an ioctl to be initiated while the adapter is initializing and issuing mailbox commands via polling. The polling logic then gets confused.
Correct by having thread setting SLI_ACTIVE spot an active mailbox command and allow it complete before proceeding.
--- drivers/scsi/lpfc/lpfc_sli.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
drivers/scsi/lpfc/lpfc_sli.c +13 -2
@@ -7372,6 +7372,7 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phbstruct lpfc_vport *vport = phba->pport;struct lpfc_dmabuf *mp;struct lpfc_rqb *rqbp; +u32 flg;/* Perform a PCI function reset to start from clean */ rc =lpfc_pci_function_reset (phba);
@@ -7385,7 +7386,17 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phbelse {spin_lock_irq (&phba->hbalock); phba->sli.sli_flag |=LPFC_SLI_ACTIVE ; + flg = phba->sli.sli_flag;spin_unlock_irq (&phba->hbalock); +/* Allow a little time after setting SLI_ACTIVE for any polled +* MBX commands to complete via BSG. +*/ +for (i =0 ; i <50 && (flg &LPFC_SLI_MBOX_ACTIVE ); i++) { +msleep (20 ); +spin_lock_irq (&phba->hbalock); + flg = phba->sli.sli_flag; +spin_unlock_irq (&phba->hbalock); + } }lpfc_sli4_dip (phba);
@@ -8922,7 +8933,7 @@ lpfc_sli_issue_mbox_s4(struct lpfc_hba *"(%d):2541 Mailbox command x%x " "(x%x/x%x) failure: " "mqe_sta: x%x mcqe_sta: x%x/x%x " -"Data: x%x x%x\n," , +"Data: x%x x%x\n" , mboxq->vport ? mboxq->vport->vpi :0 , mboxq->u.mb.mbxCommand, lpfc_sli_config_mbox_subsys_get(phba,
@@ -8956,7 +8967,7 @@ lpfc_sli_issue_mbox_s4(struct lpfc_hba *"(%d):2597 Sync Mailbox command " "x%x (x%x/x%x) failure: " "mqe_sta: x%x mcqe_sta: x%x/x%x " -"Data: x%x x%x\n," , +"Data: x%x x%x\n" , mboxq->vport ? mboxq->vport->vpi :0 , mboxq->u.mb.mbxCommand, lpfc_sli_config_mbox_subsys_get(phba,
Greg Kroah-Hartman
maintainerPATCH 9/121 HID:Add support for UGTABLET WP5540
In reply to Greg Kroah-HartmanFrom: Sergio Costas <[email protected]>
commit fd5dd6acd8f823ea804f76d3af64fa1be9d5fb78 upstream.
This patch adds support for the UGTABLET WP5540 digitizer tablet devices. Without it, the pen moves the cursor, but neither the buttons nor the tap sensor in the tip do work.
--- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-quirks.c | 1 + 2 files changed, 2 insertions(+)
drivers/hid/hid-ids.h +1 -0
@@ -1318,6 +1318,7 @@#define USB_VENDOR_ID_UGTIZER 0x2179#define USB_DEVICE_ID_UGTIZER_TABLET_GP0610 0x0053#define USB_DEVICE_ID_UGTIZER_TABLET_GT5040 0x0077 +#define USB_DEVICE_ID_UGTIZER_TABLET_WP5540 0x0004#define USB_VENDOR_ID_VIEWSONIC 0x0543#define USB_DEVICE_ID_VIEWSONIC_PD1011 0xe621
drivers/hid/hid-quirks.c +1 -0
@@ -187,6 +187,7 @@ static const struct hid_device_id hid_qu { HID_USB_DEVICE(USB_VENDOR_ID_TURBOX, USB_DEVICE_ID_TURBOX_KEYBOARD), HID_QUIRK_NOGET }, { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_KNA5), HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_TWA60), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER, USB_DEVICE_ID_UGTIZER_TABLET_WP5540), HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_10_6_INCH), HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_14_1_INCH), HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SIRIUS_BATTERY_FREE_TABLET), HID_QUIRK_MULTI_INPUT },
Greg Kroah-Hartman
maintainerPATCH 10/121 Revert "svm: Add warning message for AVIC IPI invalid target"
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit dd4589eee99db8f61f7b8f7df1531cad3f74a64d upstream.
Remove a WARN on an "AVIC IPI invalid target" exit, the WARN is trivial to trigger from guest as it will fail on any destination APIC ID that doesn't exist from the guest's perspective.
Don't bother recording anything in the kernel log, the common tracepoint for kvm_avic_incomplete_ipi() is sufficient for debugging.
This reverts commit 37ef0c4414c9743ba7f1af4392f0a27a99649f2a.
Message-Id: <[email protected]>
--- arch/x86/kvm/svm/avic.c | 2 -- 1 file changed, 2 deletions(-)
arch/x86/kvm/svm/avic.c +0 -2
@@ -344,8 +344,6 @@ int avic_incomplete_ipi_interception(strbreak ; }case AVIC_IPI_FAILURE_INVALID_TARGET : -WARN_ONCE (1 ,"Invalid IPI target: index=%u, vcpu=%d, icr=%#0x:%#0x\n" , - index, svm->vcpu.vcpu_id, icrh, icrl);break ;case AVIC_IPI_FAILURE_INVALID_BACKING_PAGE :WARN_ONCE (1 ,"Invalid backing page\n" );
Greg Kroah-Hartman
maintainerPATCH 11/121 serial: parisc: GSC: fix build when IOSAPIC is not set
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
commit 6e8793674bb0d1135ca0e5c9f7e16fecbf815926 upstream.
There is a build error when using a kernel .config file from 'kernel test robot' for a different build problem:
hppa64-linux-ld: drivers/tty/serial/8250/8250_gsc.o: in function `.LC3':
(.data.rel.ro+0x18): undefined reference to `iosapic_serial_irq'
when:
CONFIG_GSC=y
CONFIG_SERIO_GSCPS2=y
CONFIG_SERIAL_8250_GSC=y
CONFIG_PCI is not set
and hence PCI_LBA is not set.
IOSAPIC depends on PCI_LBA, so IOSAPIC is not set/enabled.
Make the use of iosapic_serial_irq() conditional to fix the build error.
--- drivers/tty/serial/8250/8250_gsc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/8250/8250_gsc.c +1 -1
@@ -26,7 +26,7 @@ static int __init serial_init_chip(strucunsigned long address;int err; -#ifdef CONFIG_64BIT +#if defined(CONFIG_64BIT ) && defined(CONFIG_IOSAPIC )if (!dev->irq && (dev->id.sversion ==0xad )) dev->irq =iosapic_serial_irq (dev);#endif
Greg Kroah-Hartman
maintainerPATCH 12/121 parisc: Drop __init from map_pages declaration
In reply to Greg Kroah-HartmanFrom: John David Anglin <[email protected]>
commit 9129886b88185962538180625ca8051362b01327 upstream.
With huge kernel pages, we randomly eat a SPARC in map_pages(). This is fixed by dropping __init from the declaration.
However, map_pages references the __init routine memblock_alloc_try_nid via memblock_alloc. Thus, it needs to be marked with __ref.
memblock_alloc is only called before the kernel text is set to readonly.
The __ref on free_initmem is no longer needed.
Comment regarding map_pages being in the init section is removed.
--- arch/parisc/mm/init.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
arch/parisc/mm/init.c +4 -5
@@ -346,9 +346,9 @@ static void __init setup_bootmem(void)static bool kernel_set_to_readonly; -static void __init map_pages (unsigned long start_vaddr, -unsigned long start_paddr,unsigned long size, -pgprot_t pgprot,int force) +static void __ref map_pages (unsigned long start_vaddr, +unsigned long start_paddr,unsigned long size, +pgprot_t pgprot,int force) {pmd_t *pmd;pte_t *pg_table;
@@ -458,7 +458,7 @@ void __init set_kernel_text_rw(int enablflush_tlb_all (); } -void __ref free_initmem (void ) +void free_initmem (void ) {unsigned long init_begin = (unsigned long )__init_begin;unsigned long init_end = (unsigned long )__init_end;
@@ -472,7 +472,6 @@ void __ref free_initmem(void)/* The init text pages are marked R-X. We have to * flush the icache and mark them RW- * -* This is tricky, because map_pages is in the init section. * Do a dummy remap of the data section first (the data * section is already PAGE_KERNEL) to pull in the TLB entries * for map_kernel */
Greg Kroah-Hartman
maintainerPATCH 13/121 parisc: Fix data TLB miss in sba_unmap_sg
In reply to Greg Kroah-HartmanFrom: John David Anglin <[email protected]>
commit b7d6f44a0fa716a82969725516dc0b16bc7cd514 upstream.
Rolf Eike Beer reported the following bug:
[1274934.746891] Bad Address (null pointer deref?): Code=15 (Data TLB miss fault) at addr 0000004140000018 [1274934.746891] CPU: 3 PID: 5549 Comm: cmake Not tainted 5.15.4-gentoo-parisc64 #4 [1274934.746891] Hardware name: 9000/785/C8000 [1274934.746891] [1274934.746891] YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI [1274934.746891] PSW: 00001000000001001111111000001110 Not tainted [1274934.746891] r00-03 000000ff0804fe0e 0000000040bc9bc0 00000000406760e4 0000004140000000 [1274934.746891] r04-07 0000000040b693c0 0000004140000000 000000004a2b08b0 0000000000000001 [1274934.746891] r08-11 0000000041f98810 0000000000000000 000000004a0a7000 0000000000000001 [1274934.746891] r12-15 0000000040bddbc0 0000000040c0cbc0 0000000040bddbc0 0000000040bddbc0 [1274934.746891] r16-19 0000000040bde3c0 0000000040bddbc0 0000000040bde3c0 0000000000000007 [1274934.746891] r20-23 0000000000000006 000000004a368950 0000000000000000 0000000000000001 [1274934.746891] r24-27 0000000000001fff 000000000800000e 000000004a1710f0 0000000040b693c0 [1274934.746891] r28-31 0000000000000001 0000000041f988b0 0000000041f98840 000000004a171118 [1274934.746891] sr00-03 00000000066e5800 0000000000000000 0000000000000000 00000000066e5800 [1274934.746891] sr04-07 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [1274934.746891] [1274934.746891] IASQ: 0000000000000000 0000000000000000 IAOQ: 00000000406760e8 00000000406760ec [1274934.746891] IIR: 48780030 ISR: 0000000000000000 IOR: 0000004140000018 [1274934.746891] CPU: 3 CR30: 00000040e3a9c000 CR31: ffffffffffffffff [1274934.746891] ORIG_R28: 0000000040acdd58 [1274934.746891] IAOQ[0]: sba_unmap_sg+0xb0/0x118 [1274934.746891] IAOQ[1]: sba_unmap_sg+0xb4/0x118 [1274934.746891] RP(r2): sba_unmap_sg+0xac/0x118 [1274934.746891] Backtrace: [1274934.746891] [<00000000402740cc>] dma_unmap_sg_attrs+0x6c/0x70 [1274934.746891] [<000000004074d6bc>] scsi_dma_unmap+0x54/0x60 [1274934.746891] [<00000000407a3488>] mptscsih_io_done+0x150/0xd70 [1274934.746891] [<0000000040798600>] mpt_interrupt+0x168/0xa68 [1274934.746891] [<0000000040255a48>] __handle_irq_event_percpu+0xc8/0x278 [1274934.746891] [<0000000040255c34>] handle_irq_event_percpu+0x3c/0xd8 [1274934.746891] [<000000004025ecb4>] handle_percpu_irq+0xb4/0xf0 [1274934.746891] [<00000000402548e0>] generic_handle_irq+0x50/0x70 [1274934.746891] [<000000004019a254>] call_on_stack+0x18/0x24 [1274934.746891] [1274934.746891] Kernel panic - not syncing: Bad Address (null pointer deref?)
The bug is caused by overrunning the sglist and incorrectly testing sg_dma_len(sglist) before nents. Normally this doesn't cause a crash, but in this case sglist crossed a page boundary. This occurs in the following code:
while (sg_dma_len(sglist) && nents--) {The fix is simply to test nents first and move the decrement of nents into the loop.
--- drivers/parisc/sba_iommu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/parisc/sba_iommu.c +2 -1
@@ -1047,7 +1047,7 @@ sba_unmap_sg(struct device *dev, structspin_unlock_irqrestore (&ioc->res_lock, flags);#endif -while (sg_dma_len (sglist) && nents--) { +while (nents &&sg_dma_len (sglist)) {sba_unmap_page (dev,sg_dma_address (sglist),sg_dma_len (sglist), direction,0 );
@@ -1056,6 +1056,7 @@ sba_unmap_sg(struct device *dev, struct ioc->usingle_calls--;/* kluge since call is unmap_sg() */ #endif ++sglist; + nents--; }DBG_RUN_SG ("%s() DONE (nents %d)\n" , __func__, nents);
Greg Kroah-Hartman
maintainerPATCH 14/121 parisc: Fix sglist access in ccio-dma.c
In reply to Greg Kroah-HartmanFrom: John David Anglin <[email protected]>
commit d7da660cab47183cded65e11b64497d0f56c6edf upstream.
This patch implements the same bug fix to ccio-dma.c as to sba_iommu.c. It ensures that only the allocated entries of the sglist are accessed.
--- drivers/parisc/ccio-dma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/parisc/ccio-dma.c +2 -1
@@ -1003,7 +1003,7 @@ ccio_unmap_sg(struct device *dev, struct ioc->usg_calls++;#endif -while (sg_dma_len (sglist) && nents--) { +while (nents &&sg_dma_len (sglist)) {#ifdef CCIO_COLLECT_STATS ioc->usg_pages +=sg_dma_len (sglist) >>PAGE_SHIFT ;
@@ -1011,6 +1011,7 @@ ccio_unmap_sg(struct device *dev, structccio_unmap_page (dev,sg_dma_address (sglist),sg_dma_len (sglist), direction,0 ); ++sglist; + nents--; }DBG_RUN_SG ("%s() DONE (nents %d)\n" , __func__, nents);
Greg Kroah-Hartman
maintainerPATCH 15/121 mmc: block: fix read single on recovery logic
In reply to Greg Kroah-HartmanFrom: Christian Löhle <[email protected]>
commit 54309fde1a352ad2674ebba004a79f7d20b9f037 upstream.
On reads with MMC_READ_MULTIPLE_BLOCK that fail,
the recovery handler will use MMC_READ_SINGLE_BLOCK for each of the blocks, up to MMC_READ_SINGLE_RETRIES times each. The logic for this is fixed to never report unsuccessful reads as success to the block layer.
On command error with retries remaining, blk_update_request was called with whatever value error was set last to.
In case it was last set to BLK_STS_OK (default), the read will be reported as success, even though there was no data read from the device. This could happen on a CRC mismatch for the response,
a card rejecting the command (e.g. again due to a CRC mismatch). In case it was last set to BLK_STS_IOERR, the error is reported correctly, but no retries will be attempted.
--- drivers/mmc/core/block.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-)
drivers/mmc/core/block.c +14 -14
@@ -1642,31 +1642,31 @@ static void mmc_blk_read_single(struct mstruct mmc_card *card = mq->card;struct mmc_host *host = card->host;blk_status_t error =BLK_STS_OK ; -int retries =0 ; do { u32 status; int err; + int retries = 0; - mmc_blk_rw_rq_prep(mqrq, card, 1, mq); + while (retries++ <= MMC_READ_SINGLE_RETRIES) { + mmc_blk_rw_rq_prep(mqrq, card, 1, mq); - mmc_wait_for_req(host, mrq); + mmc_wait_for_req(host, mrq); - err = mmc_send_status(card, &status); - if (err) - goto error_exit; - - if (!mmc_host_is_spi(host) && - !mmc_ready_for_data(status)) { - err = mmc_blk_fix_state(card, req); + err = mmc_send_status(card, &status); if (err) goto error_exit; - } - if (mrq->cmd->error && retries++ < MMC_READ_SINGLE_RETRIES) - continue; + if (!mmc_host_is_spi(host) && + !mmc_ready_for_data(status)) { + err = mmc_blk_fix_state(card, req); + if (err) + goto error_exit; + } - retries = 0; + if (!mrq->cmd->error) + break; + } if (mrq->cmd->error || mrq->data->error ||
Greg Kroah-Hartman
maintainerPATCH 16/121 mm: dont try to NUMA-migrate COW pages that have other uses
In reply to Greg Kroah-HartmanFrom: Linus Torvalds <[email protected]>
commit 80d47f5de5e311cbc0d01ebb6ee684e8f4c196c6 upstream.
Oded Gabbay reports that enabling NUMA balancing causes corruption with his Gaudi accelerator test load:
"All the details are in the bug, but the bottom line is that somehow,
this patch causes corruption when the numa balancing feature is enabled AND we don't use process affinity AND we use GUP to pin pages so our accelerator can DMA to/from system memory.
Either disabling numa balancing, using process affinity to bind to specific numa-node or reverting this patch causes the bug to disappear"
and Oded bisected the issue to commit 09854ba94c6a ("mm: do_wp_page() simplification").
Now, the NUMA balancing shouldn't actually be changing the writability of a page, and as such shouldn't matter for COW. But it appears it does. Suspicious.
However, regardless of that, the condition for enabling NUMA faults in change_pte_range() is nonsensical. It uses "page_mapcount(page)" to decide if a COW page should be NUMA-protected or not, and that makes absolutely no sense.
The number of mappings a page has is irrelevant: not only does GUP get a reference to a page as in Oded's case, but the other mappings migth be paged out and the only reference to them would be in the page count.
Since we should never try to NUMA-balance a page that we can't move anyway due to other references, just fix the code to use 'page_count()'. Oded confirms that that fixes his issue.
Now, this does imply that something in NUMA balancing ends up changing page protections (other than the obvious one of making the page inaccessible to get the NUMA faulting information). Otherwise the COW simplification wouldn't matter - since doing the GUP on the page would make sure it's writable.
The cause of that permission change would be good to figure out too, since it clearly results in spurious COW events - but fixing the nonsensical test that just happened to work before is obviously the CorrectThing(tm) to do regardless.
--- mm/mprotect.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/mprotect.c +1 -1
@@ -94,7 +94,7 @@ static unsigned long change_pte_range(st/* Also skip shared copy-on-write pages */ if (is_cow_mapping (vma->vm_flags) && -page_mapcount (page) !=1 ) +page_count (page) !=1 )continue ;/*
Greg Kroah-Hartman
maintainerPATCH 17/121 PCI: hv: Fix NUMA node assignment when kernel boots with custom NUMA topology
In reply to Greg Kroah-HartmanFrom: Long Li <[email protected]>
commit 3149efcdf2c6314420c418dfc94de53bfd076b1f upstream.
When kernel boots with a NUMA topology with some NUMA nodes offline, the PCI driver should only set an online NUMA node on the device. This can happen during KDUMP where some NUMA nodes are not made online by the KDUMP kernel.
This patch also fixes the case where kernel is booting with "numa=off".
--- drivers/pci/controller/pci-hyperv.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/pci/controller/pci-hyperv.c +11 -2
@@ -1841,8 +1841,17 @@ static void hv_pci_assign_numa_node(struif (!hv_dev)continue ; -if (hv_dev->desc.flags &HV_PCI_DEVICE_FLAG_NUMA_AFFINITY ) -set_dev_node (&dev->dev, hv_dev->desc.virtual_numa_node); +if (hv_dev->desc.flags &HV_PCI_DEVICE_FLAG_NUMA_AFFINITY && + hv_dev->desc.virtual_numa_node <num_possible_nodes ()) +/* +* The kernel may boot with some NUMA nodes offline +* (e.g. in a KDUMP kernel) or with NUMA disabled via +* "numa=off". In those cases, adjust the host provided +* NUMA node to a valid NUMA node used by the kernel. +*/ +set_dev_node (&dev->dev, +numa_map_to_online_node ( + hv_dev->desc.virtual_numa_node));put_pcichild (hv_dev); }
Greg Kroah-Hartman
maintainerPATCH 18/121 parisc: Add ioread64_lo_hi() and iowrite64_lo_hi()
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
commit 18a1d5e1945385d9b5adc3fe11427ce4a9d2826e upstream.
It's a followup to the previous commit f15309d7ad5d ("parisc: Add ioread64_hi_lo() and iowrite64_hi_lo()") which does only half of the job. Add the rest, so we won't get a new kernel test robot reports.
--- arch/parisc/lib/iomap.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
arch/parisc/lib/iomap.c +18 -0
@@ -346,6 +346,16 @@ u64 ioread64be(const void __iomem *addr)return *((u64 *)addr); } +u64 ioread64_lo_hi (const void __iomem *addr) +{ +u32 low, high; + + low =ioread32 (addr); + high =ioread32 (addr +sizeof (u32)); + +return low + ((u64 )high <<32 ); +} +u64 ioread64_hi_lo (const void __iomem *addr) {u32 low, high;
@@ -419,6 +429,12 @@ void iowrite64be(u64 datum, void __iomem } } +void iowrite64_lo_hi (u64 val,void __iomem *addr) +{ +iowrite32 (val, addr); +iowrite32 (val >>32 , addr +sizeof (u32)); +} +void iowrite64_hi_lo (u64 val,void __iomem *addr) {iowrite32 (val >>32 , addr +sizeof (u32));
@@ -527,6 +543,7 @@ EXPORT_SYMBOL(ioread32);EXPORT_SYMBOL (ioread32be);EXPORT_SYMBOL (ioread64);EXPORT_SYMBOL (ioread64be); +EXPORT_SYMBOL (ioread64_lo_hi);EXPORT_SYMBOL (ioread64_hi_lo);EXPORT_SYMBOL (iowrite8);EXPORT_SYMBOL (iowrite16);
@@ -535,6 +552,7 @@ EXPORT_SYMBOL(iowrite32);EXPORT_SYMBOL (iowrite32be);EXPORT_SYMBOL (iowrite64);EXPORT_SYMBOL (iowrite64be); +EXPORT_SYMBOL (iowrite64_lo_hi);EXPORT_SYMBOL (iowrite64_hi_lo);EXPORT_SYMBOL (ioread8_rep);EXPORT_SYMBOL (ioread16_rep);
Greg Kroah-Hartman
maintainerPATCH 19/121 btrfs: send: in case of IO error log it
In reply to Greg Kroah-HartmanFrom: Dāvis Mosāns <[email protected]>
commit 2e7be9db125a0bf940c5d65eb5c40d8700f738b5 upstream.
Currently if we get IO error while doing send then we abort without logging information about which file caused issue. So log it to help with debugging.
--- fs/btrfs/send.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/btrfs/send.c +4 -0
@@ -5006,6 +5006,10 @@ static int put_file_data(struct send_ctxlock_page (page);if (!PageUptodate (page)) {unlock_page (page); +btrfs_err (fs_info, +"send: IO error at offset %llu for inode %llu root %llu" , +page_offset (page), sctx->cur_ino, + sctx->send_root->root_key.objectid);put_page (page); ret = -EIO ;break ;
Greg Kroah-Hartman
maintainerPATCH 20/121 platform/x86: touchscreen_dmi: Add info for the RWC NANOTE P8 AY07J 2-in-1
In reply to Greg Kroah-HartmanFrom: Yuka Kawajiri <[email protected]>
[ Upstream commit 512eb73cfd1208898cf10cb06094e0ee0bb53b58 ]
Add touchscreen info for RWC NANOTE P8 (AY07J) 2-in-1.
--- drivers/platform/x86/touchscreen_dmi.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
drivers/platform/x86/touchscreen_dmi.c +24 -0
@@ -756,6 +756,21 @@ static const struct ts_dmi_data predia_basic_data = { .properties = predia_basic_props, }; +static const struct property_entry rwc_nanote_p8_props[] = { +PROPERTY_ENTRY_U32 ("touchscreen-min-y" ,46 ), +PROPERTY_ENTRY_U32 ("touchscreen-size-x" ,1728 ), +PROPERTY_ENTRY_U32 ("touchscreen-size-y" ,1140 ), +PROPERTY_ENTRY_BOOL ("touchscreen-inverted-y" ), +PROPERTY_ENTRY_STRING ("firmware-name" ,"gsl1680-rwc-nanote-p8.fw" ), +PROPERTY_ENTRY_U32 ("silead,max-fingers" ,10 ), + { } +}; + +static const struct ts_dmi_data rwc_nanote_p8_data = { + .acpi_name ="MSSL1680:00" , + .properties = rwc_nanote_p8_props, +}; +static const struct property_entry schneider_sct101ctm_props[] = {PROPERTY_ENTRY_U32 ("touchscreen-size-x" ,1715 ),PROPERTY_ENTRY_U32 ("touchscreen-size-y" ,1140 ),
@@ -1326,6 +1341,15 @@ const struct dmi_system_id touchscreen_dmi_table[] = { DMI_EXACT_MATCH(DMI_BOARD_NAME, "0E57"), }, }, + { +/* RWC NANOTE P8 */ + .driver_data = (void *)&rwc_nanote_p8_data, + .matches = { +DMI_MATCH (DMI_BOARD_VENDOR ,"Default string" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"AY07J" ), +DMI_MATCH (DMI_PRODUCT_SKU ,"0001" ) + }, + }, {/* Schneider SCT101CTM */ .driver_data = (void *)&schneider_sct101ctm_data,
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 21/121 platform/x86: ISST: Fix possible circular locking dependency detected
In reply to Greg Kroah-HartmanFrom: Srinivas Pandruvada <[email protected]>
[ Upstream commit 17da2d5f93692086dd096a975225ffd5622d0bf8 ]
As reported:
[ 256.104522] ======================================================
[ 256.113783] WARNING: possible circular locking dependency detected
[ 256.120093] 5.16.0-rc6-yocto-standard+ #99 Not tainted
[ 256.125362] ------------------------------------------------------
[ 256.131673] intel-speed-sel/844 is trying to acquire lock:
[ 256.137290] ffffffffc036f0d0 (punit_misc_dev_lock){+.+.}-{3:3}, at: isst_if_open+0x18/0x90 [isst_if_common]
[ 256.147171]
[ 256.147171] but task is already holding lock:
[ 256.153135] ffffffff8ee7cb50 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x2a/0x170
[ 256.160407]
[ 256.160407] which lock already depends on the new lock.
[ 256.160407]
[ 256.168712]
[ 256.168712] the existing dependency chain (in reverse order) is:
[ 256.176327]
[ 256.176327] -> #1 (misc_mtx){+.+.}-{3:3}:
[ 256.181946] lock_acquire+0x1e6/0x330
[ 256.186265] __mutex_lock+0x9b/0x9b0
[ 256.190497] mutex_lock_nested+0x1b/0x20
[ 256.195075] misc_register+0x32/0x1a0
[ 256.199390] isst_if_cdev_register+0x65/0x180 [isst_if_common]
[ 256.205878] isst_if_probe+0x144/0x16e [isst_if_mmio]
...
[ 256.241976]
[ 256.241976] -> #0 (punit_misc_dev_lock){+.+.}-{3:3}:
[ 256.248552] validate_chain+0xbc6/0x1750
[ 256.253131] __lock_acquire+0x88c/0xc10
[ 256.257618] lock_acquire+0x1e6/0x330
[ 256.261933] __mutex_lock+0x9b/0x9b0
[ 256.266165] mutex_lock_nested+0x1b/0x20
[ 256.270739] isst_if_open+0x18/0x90 [isst_if_common]
[ 256.276356] misc_open+0x100/0x170
[ 256.280409] chrdev_open+0xa5/0x1e0...
The call sequence suggested that misc_device /dev file can be opened before misc device is yet to be registered, which is done only once.
Here punit_misc_dev_lock was used as common lock, to protect the registration by multiple ISST HW drivers, one time setup, prevent duplicate registry of misc device and prevent load/unload when device is open.
We can split into locks:
- One which just prevent duplicate call to misc_register() and one time setup. Also never call again if the misc_register() failed or required one time setup is failed. This lock is not shared with any misc device callbacks.
- The other lock protects registry, load and unload of HW drivers.
Sequence in isst_if_cdev_register()
- Register callbacks under punit_misc_dev_open_lock
- Call isst_misc_reg() which registers misc_device on the first registry which is under punit_misc_dev_reg_lock, which is not shared with callbacks.
Sequence in isst_if_cdev_unregister
Just opposite of isst_if_cdev_register
--- .../intel_speed_select_if/isst_if_common.c | 97 ++++++++++++------- 1 file changed, 63 insertions(+), 34 deletions(-)
drivers/platform/x86/intel_speed_select_if/isst_if_common.c +63 -34
@@ -532,7 +532,10 @@ static long isst_if_def_ioctl(struct file *file, unsigned int cmd,return ret; } -static DEFINE_MUTEX (punit_misc_dev_lock); +/* Lock to prevent module registration when already opened by user space */ +static DEFINE_MUTEX (punit_misc_dev_open_lock); +/* Lock to allow one share misc device for all ISST interace */ +static DEFINE_MUTEX (punit_misc_dev_reg_lock);static int misc_usage_count;static int misc_device_ret;static int misc_device_open;
@@ -542,7 +545,7 @@ static int isst_if_open(struct inode *inode, struct file *file)int i, ret =0 ;/* Fail open, if a module is going away */ -mutex_lock (&punit_misc_dev_lock); +mutex_lock (&punit_misc_dev_open_lock);for (i =0 ; i <ISST_IF_DEV_MAX ; ++i) {struct isst_if_cmd_cb *cb = &punit_callbacks[i];
@@ -564,7 +567,7 @@ static int isst_if_open(struct inode *inode, struct file *file) }else { misc_device_open++; } -mutex_unlock (&punit_misc_dev_lock); +mutex_unlock (&punit_misc_dev_open_lock);return ret; }
@@ -573,7 +576,7 @@ static int isst_if_relase(struct inode *inode, struct file *f) {int i; -mutex_lock (&punit_misc_dev_lock); +mutex_lock (&punit_misc_dev_open_lock); misc_device_open--;for (i =0 ; i <ISST_IF_DEV_MAX ; ++i) {struct isst_if_cmd_cb *cb = &punit_callbacks[i];
@@ -581,7 +584,7 @@ static int isst_if_relase(struct inode *inode, struct file *f)if (cb->registered)module_put (cb->owner); } -mutex_unlock (&punit_misc_dev_lock); +mutex_unlock (&punit_misc_dev_open_lock);return 0 ; }
@@ -598,6 +601,43 @@ static struct miscdevice isst_if_char_driver = { .fops = &isst_if_char_driver_ops, }; +static int isst_misc_reg (void ) +{ +mutex_lock (&punit_misc_dev_reg_lock); +if (misc_device_ret) + goto unlock_exit; + +if (!misc_usage_count) { + misc_device_ret =isst_if_cpu_info_init (); +if (misc_device_ret) + goto unlock_exit; + + misc_device_ret =misc_register (&isst_if_char_driver); +if (misc_device_ret) { +isst_if_cpu_info_exit (); + goto unlock_exit; + } + } + misc_usage_count++; + +unlock_exit: +mutex_unlock (&punit_misc_dev_reg_lock); + +return misc_device_ret; +} + +static void isst_misc_unreg (void ) +{ +mutex_lock (&punit_misc_dev_reg_lock); +if (misc_usage_count) + misc_usage_count--; +if (!misc_usage_count && !misc_device_ret) { +misc_deregister (&isst_if_char_driver); +isst_if_cpu_info_exit (); + } +mutex_unlock (&punit_misc_dev_reg_lock); +} +/** * isst_if_cdev_register() - Register callback for IOCTL * @device_type: The device type this callback handling.
@@ -615,38 +655,31 @@ static struct miscdevice isst_if_char_driver = {*/ int isst_if_cdev_register (int device_type,struct isst_if_cmd_cb *cb) { -if (misc_device_ret) -return misc_device_ret; +int ret;if (device_type >=ISST_IF_DEV_MAX )return -EINVAL ; -mutex_lock (&punit_misc_dev_lock); +mutex_lock (&punit_misc_dev_open_lock); +/* Device is already open, we don't want to add new callbacks */ if (misc_device_open) { -mutex_unlock (&punit_misc_dev_lock); +mutex_unlock (&punit_misc_dev_open_lock);return -EAGAIN ; } -if (!misc_usage_count) { -int ret; - - misc_device_ret =misc_register (&isst_if_char_driver); -if (misc_device_ret) - goto unlock_exit; - - ret =isst_if_cpu_info_init (); -if (ret) { -misc_deregister (&isst_if_char_driver); - misc_device_ret = ret; - goto unlock_exit; - } - }memcpy (&punit_callbacks[device_type], cb,sizeof (*cb)); punit_callbacks[device_type].registered =1 ; - misc_usage_count++; -unlock_exit: -mutex_unlock (&punit_misc_dev_lock); +mutex_unlock (&punit_misc_dev_open_lock); -return misc_device_ret; + ret =isst_misc_reg (); +if (ret) { +/* +* No need of mutex as the misc device register failed +* as no one can open device yet. Hence no contention. +*/ + punit_callbacks[device_type].registered =0 ; +return ret; + } +return 0 ; }EXPORT_SYMBOL_GPL (isst_if_cdev_register);
@@ -661,16 +694,12 @@ EXPORT_SYMBOL_GPL(isst_if_cdev_register);*/ void isst_if_cdev_unregister (int device_type) { -mutex_lock (&punit_misc_dev_lock); - misc_usage_count--; +isst_misc_unreg (); +mutex_lock (&punit_misc_dev_open_lock); punit_callbacks[device_type].registered =0 ;if (device_type ==ISST_IF_DEV_MBOX )isst_delete_hash (); -if (!misc_usage_count && !misc_device_ret) { -misc_deregister (&isst_if_char_driver); -isst_if_cpu_info_exit (); - } -mutex_unlock (&punit_misc_dev_lock); +mutex_unlock (&punit_misc_dev_open_lock); }EXPORT_SYMBOL_GPL (isst_if_cdev_unregister);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 22/121 selftests: rtc: Increase test timeout so that all tests run
In reply to Greg Kroah-HartmanFrom: Nícolas F. R. A. Prado <[email protected]>
[ Upstream commit f034cc1301e7d83d4ec428dd6b8ffb57ca446efb ]
The timeout setting for the rtc kselftest is currently 90 seconds. This setting is used by the kselftest runner to stop running a test if it takes longer than the assigned value.
However, two of the test cases inside rtc set alarms. These alarms are set to the next beginning of the minute, so each of these test cases may take up to, in the worst case, 60 seconds.
In order to allow for all test cases in rtc to run, even in the worst case, when using the kselftest runner, the timeout value should be increased to at least 120. Set it to 180, so there's some additional slack.
Correct operation can be tested by running the following command right after the start of a minute (low second count), and checking that all test cases run:
./run_kselftest.sh -c rtc
--- tools/testing/selftests/rtc/settings | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/rtc/settings +1 -1
@@ -1 +1 @@ -timeout=90 +timeout=180
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 23/121 kselftest: signal all child processes
In reply to Greg Kroah-HartmanFrom: Li Zhijian <[email protected]>
[ Upstream commit 92d25637a3a45904292c93f1863c6bbda4e3e38f ]
We have some many cases that will create child process as well, such as pidfd_wait. Previously, we will signal/kill the parent process when it is time out, but this signal will not be sent to its child process. In such case, if child process doesn't terminate itself, ksefltest framework will hang forever.
Here we group all its child processes so that kill() can signal all of them in timeout.
Fixed change log: Shuah Khan <[email protected]>
--- tools/testing/selftests/kselftest_harness.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
tools/testing/selftests/kselftest_harness.h +3 -1
@@ -871,7 +871,8 @@ static void __timeout_handler(int sig, siginfo_t *info, void *ucontext) } t->timed_out = true; -kill (t->pid,SIGKILL ); +// signal process group +kill (-(t->pid),SIGKILL ); }void __wait_for_test (struct __test_metadata *t)
@@ -981,6 +982,7 @@ void __run_test(struct __fixture_metadata *f,ksft_print_msg ("ERROR SPAWNING TEST CHILD\n" ); t->passed =0 ; }else if (t->pid ==0 ) { +setpgrp (); t->fn (t, variant);if (t->skip)_exit (255 );
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 24/121 net: ieee802154: at86rf230: Stop leaking skbs
In reply to Greg Kroah-HartmanFrom: Miquel Raynal <[email protected]>
[ Upstream commit e5ce576d45bf72fd0e3dc37eff897bfcc488f6a9 ]
Upon error the ieee802154_xmit_complete() helper is not called. Only ieee802154_wake_queue() is called manually. In the Tx case we then leak the skb structure.
Free the skb structure upon error before returning when appropriate.
As the 'is_tx = 0' cannot be moved in the complete handler because of a possible race between the delay in switching to STATE_RX_AACK_ON and a new interrupt, we introduce an intermediate 'was_tx' boolean just for this purpose.
There is no Fixes tag applying here, many changes have been made on this area and the issue kind of always existed.
--- drivers/net/ieee802154/at86rf230.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/net/ieee802154/at86rf230.c +11 -2
@@ -100,6 +100,7 @@ struct at86rf230_local {unsigned long cal_timeout;bool is_tx;bool is_tx_from_off; +bool was_tx;u8 tx_retry;struct sk_buff *tx_skb;struct at86rf230_state_change tx;
@@ -343,7 +344,11 @@ at86rf230_async_error_recover_complete(void *context)if (ctx->free)kfree (ctx); -ieee802154_wake_queue (lp->hw); +if (lp->was_tx) { + lp->was_tx =0 ; +dev_kfree_skb_any (lp->tx_skb); +ieee802154_wake_queue (lp->hw); + } } static void
@@ -352,7 +357,11 @@ at86rf230_async_error_recover(void *context)struct at86rf230_state_change *ctx = context;struct at86rf230_local *lp = ctx->lp; - lp->is_tx =0 ; +if (lp->is_tx) { + lp->was_tx =1 ; + lp->is_tx =0 ; + } +at86rf230_async_state_change (lp, ctx,STATE_RX_AACK_ON , at86rf230_async_error_recover_complete); }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 25/121 selftests/zram: Skip max_comp_streams interface on newer kernel
In reply to Greg Kroah-HartmanFrom: Yang Xu <[email protected]>
[ Upstream commit fc4eb486a59d70bd35cf1209f0e68c2d8b979193 ]
Since commit 43209ea2d17a ("zram: remove max_comp_streams internals"), zram has switched to per-cpu streams. Even kernel still keep this interface for some reasons, but writing to max_comp_stream doesn't take any effect. So skip it on newer kernel ie 4.7.
The code that comparing kernel version is from xfstests testsuite ext4/053.
--- tools/testing/selftests/zram/zram_lib.sh | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
tools/testing/selftests/zram/zram_lib.sh +24 -0
@@ -11,6 +11,9 @@ dev_mounted=-1 # Kselftest framework requirement - SKIP code is 4. ksft_skip=4 +kernel_version=`uname -r | cut -d'.' -f1,2` +kernel_major=${kernel_version%.*} +kernel_minor=${kernel_version#*.} trap INT
@@ -25,6 +28,20 @@ check_prereqs() fi } +kernel_gte() +{ + major=${1%.*} + minor=${1#*.} + + if [ $kernel_major -gt $major ]; then + return 0 + elif [[ $kernel_major -eq $major && $kernel_minor -ge $minor ]]; then + return 0 + fi + + return 1 +} + zram_cleanup() { echo "zram cleanup"
@@ -86,6 +103,13 @@ zram_max_streams() { echo "set max_comp_streams to zram device(s)" + kernel_gte 4.7 + if [ $? -eq 0 ]; then + echo "The device attribute max_comp_streams was"\ + "deprecated in 4.7" + return 0 + fi + local i=0 for max_s in $zram_max_streams; do local sys_path="/sys/block/zram${i}/max_comp_streams"
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 26/121 selftests/zram01.sh: Fix compression ratio calculation
In reply to Greg Kroah-HartmanFrom: Yang Xu <[email protected]>
[ Upstream commit d18da7ec3719559d6e74937266d0416e6c7e0b31 ]
zram01 uses free -m to measure zram memory usage. The results are no sense because they are polluted by all running processes on the system.
We Should only calculate the free memory delta for the current process. So use the third field of /sys/block/zram<id>/mm_stat to measure memory usage instead. The file is available since kernel 4.1.
orig_data_size(first): uncompressed size of data stored in this disk. compr_data_size(second): compressed size of data stored in this disk mem_used_total(third): the amount of memory allocated for this disk
Also remove useless zram cleanup call in zram_fill_fs and so we don't need to cleanup zram twice if fails.
--- tools/testing/selftests/zram/zram01.sh | 30 +++++++------------------- 1 file changed, 8 insertions(+), 22 deletions(-)
tools/testing/selftests/zram/zram01.sh +8 -22
@@ -33,8 +33,6 @@ zram_algs="lzo" zram_fill_fs() { - local mem_free0=$(free -m | awk 'NR==2 {print $4}') - for i in $(seq 0 $(($dev_num - 1))); do echo "fill zram$i..." local b=0
@@ -45,29 +43,17 @@ zram_fill_fs() b=$(($b + 1)) done echo "zram$i can be filled with '$b' KB" - done - local mem_free1=$(free -m | awk 'NR==2 {print $4}') - local used_mem=$(($mem_free0 - $mem_free1)) + local mem_used_total=`awk '{print $3}' "/sys/block/zram$i/mm_stat"` + local v=$((100 * 1024 * $b / $mem_used_total)) + if [ "$v" -lt 100 ]; then + echo "FAIL compression ratio: 0.$v:1" + ERR_CODE=-1 + return + fi - local total_size=0 - for sm in $zram_sizes; do - local s=$(echo $sm | sed 's/M//') - total_size=$(($total_size + $s)) + echo "zram compression ratio: $(echo "scale=2; $v / 100 " | bc):1: OK" done - - echo "zram used ${used_mem}M, zram disk sizes ${total_size}M" - - local v=$((100 * $total_size / $used_mem)) - - if [ "$v" -lt 100 ]; then - echo "FAIL compression ratio: 0.$v:1" - ERR_CODE=-1 - zram_cleanup - return - fi - - echo "zram compression ratio: $(echo "scale=2; $v / 100 " | bc):1: OK" } check_prereqs
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 27/121 selftests/zram: Adapt the situation that /dev/zram0 is being used
In reply to Greg Kroah-HartmanFrom: Yang Xu <[email protected]>
[ Upstream commit 01dabed20573804750af5c7bf8d1598a6bf7bf6e ]
If zram-generator package is installed and works, then we can not remove zram module because zram swap is being used. This case needs a clean zram environment, change this test by using hot_add/hot_remove interface. So even zram device is being used, we still can add zram device and remove them in cleanup.
The two interface was introduced since kernel commit 6566d1a32bf7("zram:
add dynamic device add/remove functionality") in v4.2-rc1. If kernel supports these two interface, we use hot_add/hot_remove to slove this problem, if not, just check whether zram is being used or built in, then skip it on old kernel.
--- tools/testing/selftests/zram/zram.sh | 15 +--- tools/testing/selftests/zram/zram01.sh | 3 +- tools/testing/selftests/zram/zram02.sh | 1 - tools/testing/selftests/zram/zram_lib.sh | 110 +++++++++++++---------- 4 files changed, 66 insertions(+), 63 deletions(-)
tools/testing/selftests/zram/zram.sh +1 -14
@@ -2,9 +2,6 @@ # SPDX-License-Identifier: GPL-2.0 TCID="zram.sh" -# Kselftest framework requirement - SKIP code is 4. -ksft_skip=4 - . ./zram_lib.sh run_zram () {
@@ -18,14 +15,4 @@ echo "" check_prereqs -# check zram module exists -MODULE_PATH=/lib/modules/`uname -r`/kernel/drivers/block/zram/zram.ko -if [ -f $MODULE_PATH ]; then - run_zram -elif [ -b /dev/zram0 ]; then - run_zram -else - echo "$TCID : No zram.ko module or /dev/zram0 device file not found" - echo "$TCID : CONFIG_ZRAM is not set" - exit $ksft_skip -fi +run_zram
tools/testing/selftests/zram/zram01.sh +1 -2
@@ -33,7 +33,7 @@ zram_algs="lzo" zram_fill_fs() { - for i in $(seq 0 $(($dev_num - 1))); do + for i in $(seq $dev_start $dev_end); do echo "fill zram$i..." local b=0 while [ true ]; do
@@ -67,7 +67,6 @@ zram_mount zram_fill_fs zram_cleanup -zram_unload if [ $ERR_CODE -ne 0 ]; then echo "$TCID : [FAIL]"
tools/testing/selftests/zram/zram02.sh +0 -1
@@ -36,7 +36,6 @@ zram_set_memlimit zram_makeswap zram_swapoff zram_cleanup -zram_unload if [ $ERR_CODE -ne 0 ]; then echo "$TCID : [FAIL]"
tools/testing/selftests/zram/zram_lib.sh +64 -46
217 lines not on this page · raw message
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 28/121 selftests: openat2: Print also errno in failure messages
In reply to Greg Kroah-HartmanFrom: Cristian Marussi <[email protected]>
[ Upstream commit e051cdf655fa016692008a446a060eff06222bb5 ]
In E_func() macro, on error, print also errno in order to aid debugging.
--- tools/testing/selftests/openat2/helpers.h | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
tools/testing/selftests/openat2/helpers.h +6 -5
@@ -62,11 +62,12 @@ bool needs_openat2(const struct open_how *how);(similar to chroot(2)). */ #endif /* RESOLVE_IN_ROOT */ -#define E_func (func, ...) \ - do { \ - if (func(__VA_ARGS__) < 0) \ - ksft_exit_fail_msg("%s:%d %s failed\n", \ - __FILE__, __LINE__, #func);\ +#define E_func (func, ...) \ + do { \ + errno = 0; \ + if (func(__VA_ARGS__) < 0) \ + ksft_exit_fail_msg("%s:%d %s failed - errno:%d\n", \ + __FILE__, __LINE__, #func, errno); \ } while (0)#define E_asprintf (...) E_func(asprintf, __VA_ARGS__)
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 29/121 selftests: openat2: Add missing dependency in Makefile
In reply to Greg Kroah-HartmanFrom: Cristian Marussi <[email protected]>
[ Upstream commit ea3396725aa143dd42fe388cb67e44c90d2fb719 ]
Add a dependency on header helpers.h to the main target; while at that add to helpers.h also a missing include for bool types.
--- tools/testing/selftests/openat2/Makefile | 2 +- tools/testing/selftests/openat2/helpers.h | 1 + 2 files changed, 2 insertions(+), 1 deletion(-)
tools/testing/selftests/openat2/Makefile +1 -1
@@ -5,4 +5,4 @@ TEST_GEN_PROGS := openat2_test resolve_test rename_attack_test include ../lib.mk -$(TEST_GEN_PROGS): helpers.c +$(TEST_GEN_PROGS): helpers.c helpers.h
tools/testing/selftests/openat2/helpers.h +1 -0
@@ -9,6 +9,7 @@#define _GNU_SOURCE#include <stdint.h> +#include <stdbool.h> #include <errno.h> #include <linux/types.h> #include "../kselftest.h"
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 30/121 selftests: openat2: Skip testcases that fail with EOPNOTSUPP
In reply to Greg Kroah-HartmanFrom: Cristian Marussi <[email protected]>
[ Upstream commit ac9e0a250bb155078601a5b999aab05f2a04d1ab ]
Skip testcases that fail since the requested valid flags combination is not supported by the underlying filesystem.
--- tools/testing/selftests/openat2/openat2_test.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
tools/testing/selftests/openat2/openat2_test.c +11 -1
@@ -244,6 +244,16 @@ void test_openat2_flags(void)unlink (path); fd =sys_openat2 (AT_FDCWD , path, &test->how); +if (fd <0 && fd == -EOPNOTSUPP ) { +/* +* Skip the testcase if it failed because not supported +* by FS. (e.g. a valid O_TMPFILE combination on NFS) +*/ +ksft_test_result_skip ("openat2 with %s fails with %d (%s)\n" , + test->name, fd,strerror (-fd)); + goto next; + } +if (test->err >=0 ) failed = (fd <0 );else
@@ -288,7 +298,7 @@ void test_openat2_flags(void)else resultfn ("openat2 with %s fails with %d (%s)\n" , test->name, test->err,strerror (-test->err)); - +next:free (fdpath);fflush (stdout); }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 31/121 selftests: skip mincore.check_file_mmap when fs lacks needed support
In reply to Greg Kroah-HartmanFrom: Cristian Marussi <[email protected]>
[ Upstream commit dae1d8ac31896988e7313384c0370176a75e9b45 ]
Report mincore.check_file_mmap as SKIP instead of FAIL if the underlying filesystem lacks support of O_TMPFILE or fallocate since such failures are not really related to mincore functionality.
--- .../selftests/mincore/mincore_selftest.c | 20 +++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)
tools/testing/selftests/mincore/mincore_selftest.c +14 -6
@@ -208,15 +208,21 @@ TEST(check_file_mmap) errno =0 ; fd =open ("." ,O_TMPFILE |O_RDWR ,0600 ); - ASSERT_NE(-1, fd) { -TH_LOG ("Can't create temporary file: %s" , -strerror (errno)); +if (fd <0 ) { + ASSERT_EQ(errno, EOPNOTSUPP) { +TH_LOG ("Can't create temporary file: %s" , +strerror (errno)); + } + SKIP(goto out_free, "O_TMPFILE not supported by filesystem."); } errno =0 ; retval =fallocate (fd,0 ,0 ,FILE_SIZE ); - ASSERT_EQ(0, retval) { -TH_LOG ("Error allocating space for the temporary file: %s" , -strerror (errno)); +if (retval) { + ASSERT_EQ(errno, EOPNOTSUPP) { +TH_LOG ("Error allocating space for the temporary file: %s" , +strerror (errno)); + } + SKIP(goto out_close, "fallocate not supported by filesystem."); }/*
@@ -272,7 +278,9 @@ TEST(check_file_mmap) }munmap (addr,FILE_SIZE ); +out_close:close (fd); +out_free:free (vec); }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 32/121 ax25: improve the incomplete fix to avoid UAF and NPD bugs
In reply to Greg Kroah-HartmanFrom: Duoming Zhou <[email protected]>
[ Upstream commit 4e0f718daf97d47cf7dec122da1be970f145c809 ]
The previous commit 1ade48d0c27d ("ax25: NPD bug when detaching AX25 device") introduce lock_sock() into ax25_kill_by_device to prevent NPD bug. But the concurrency NPD or UAF bug will occur, when lock_sock() or release_sock() dereferences the ax25_cb->sock.
The NULL pointer dereference bug can be shown as below:
ax25_kill_by_device() | ax25_release()
| ax25_destroy_socket()
| ax25_cb_del()
... | ...
| ax25->sk=NULL;
lock_sock(s->sk); //(1) |
s->ax25_dev = NULL; | ...
release_sock(s->sk); //(2) |
... |The root cause is that the sock is set to null before dereference site (1) or (2). Therefore, this patch extracts the ax25_cb->sock in advance, and uses ax25_list_lock to protect it, which can synchronize with ax25_cb_del() and ensure the value of sock is not null before dereference sites.
The concurrency UAF bug can be shown as below:
ax25_kill_by_device() | ax25_release()
| ax25_destroy_socket()
... | ...
| sock_put(sk); //FREE
lock_sock(s->sk); //(1) |
s->ax25_dev = NULL; | ...
release_sock(s->sk); //(2) |
... |The root cause is that the sock is released before dereference site (1) or (2). Therefore, this patch uses sock_hold() to increase the refcount of sock and uses ax25_list_lock to protect it, which can synchronize with ax25_cb_del() in ax25_destroy_socket() and ensure the sock wil not be released before dereference sites.
--- net/ax25/af_ax25.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
net/ax25/af_ax25.c +6 -3
@@ -77,6 +77,7 @@ static void ax25_kill_by_device(struct net_device *dev) {ax25_dev *ax25_dev;ax25_cb *s; +struct sock *sk;if ((ax25_dev =ax25_dev_ax25dev (dev)) ==NULL )return ;
@@ -85,13 +86,15 @@ static void ax25_kill_by_device(struct net_device *dev) again:ax25_for_each (s, &ax25_list) {if (s->ax25_dev == ax25_dev) { + sk = s->sk; +sock_hold (sk);spin_unlock_bh (&ax25_list_lock); -lock_sock (s->sk); +lock_sock (sk); s->ax25_dev =NULL ; -release_sock (s->sk); +release_sock (sk);ax25_disconnect (s,ENETUNREACH );spin_lock_bh (&ax25_list_lock); - +sock_put (sk);/* The entry could have been deleted from the * list meanwhile and thus the next pointer is * no longer valid. Play it safe and restart
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 33/121 vfs: make freeze_super abort when sync_filesystem returns error
In reply to Greg Kroah-HartmanFrom: Darrick J. Wong <[email protected]>
[ Upstream commit 2719c7160dcfaae1f73a1c0c210ad3281c19022e ]
If we fail to synchronize the filesystem while preparing to freeze the fs, abort the freeze.
--- fs/super.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
fs/super.c +12 -7
@@ -1667,11 +1667,9 @@ static void lockdep_sb_freeze_acquire(struct super_block *sb)percpu_rwsem_acquire (sb->s_writers.rw_sem + level,0 , _THIS_IP_); } -static void sb_freeze_unlock (struct super_block *sb) +static void sb_freeze_unlock (struct super_block *sb,int level) { -int level; - -for (level =SB_FREEZE_LEVELS -1 ; level >=0 ; level--) +for (level--; level >=0 ; level--)percpu_up_write (sb->s_writers.rw_sem + level); }
@@ -1742,7 +1740,14 @@ int freeze_super(struct super_block *sb)sb_wait_write (sb,SB_FREEZE_PAGEFAULT );/* All writers are done so after syncing there won't be dirty data */ -sync_filesystem (sb); + ret =sync_filesystem (sb); +if (ret) { + sb->s_writers.frozen =SB_UNFROZEN ; +sb_freeze_unlock (sb,SB_FREEZE_PAGEFAULT ); +wake_up (&sb->s_writers.wait_unfrozen); +deactivate_locked_super (sb); +return ret; + }/* Now wait for internal filesystem counter */ sb->s_writers.frozen =SB_FREEZE_FS ;
@@ -1754,7 +1759,7 @@ int freeze_super(struct super_block *sb)printk (KERN_ERR "VFS:Filesystem freeze failed\n" ); sb->s_writers.frozen =SB_UNFROZEN ; -sb_freeze_unlock (sb); +sb_freeze_unlock (sb,SB_FREEZE_FS );wake_up (&sb->s_writers.wait_unfrozen);deactivate_locked_super (sb);return ret;
@@ -1805,7 +1810,7 @@ static int thaw_super_locked(struct super_block *sb) } sb->s_writers.frozen =SB_UNFROZEN ; -sb_freeze_unlock (sb); +sb_freeze_unlock (sb,SB_FREEZE_FS ); out:wake_up (&sb->s_writers.wait_unfrozen);deactivate_locked_super (sb);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 34/121 quota: make dquot_quota_sync return errors from ->sync_fs
In reply to Greg Kroah-HartmanFrom: Darrick J. Wong <[email protected]>
[ Upstream commit dd5532a4994bfda0386eb2286ec00758cee08444 ]
Strangely, dquot_quota_sync ignores the return code from the ->sync_fs call, which means that quotacalls like Q_SYNC never see the error. This doesn't seem right, so fix that.
--- fs/quota/dquot.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
fs/quota/dquot.c +8 -3
@@ -692,9 +692,14 @@ int dquot_quota_sync(struct super_block *sb, int type)/* This is not very clever (and fast) but currently I don't know about * any other simple way of getting quota data to disk and we must get * them there for userspace to be visible... */ -if (sb->s_op->sync_fs) - sb->s_op->sync_fs (sb,1 ); -sync_blockdev (sb->s_bdev); +if (sb->s_op->sync_fs) { + ret = sb->s_op->sync_fs (sb,1 ); +if (ret) +return ret; + } + ret =sync_blockdev (sb->s_bdev); +if (ret) +return ret;/* * Now when everything is written we can discard the pagecache so
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 35/121 scsi: pm8001: Fix use-after-free for aborted TMF sas_task
In reply to Greg Kroah-HartmanFrom: John Garry <[email protected]>
[ Upstream commit 61f162aa4381845acbdc7f2be4dfb694d027c018 ]
Currently a use-after-free may occur if a TMF sas_task is aborted before we handle the IO completion in mpi_ssp_completion(). The abort occurs due to timeout.
When the timeout occurs, the SAS_TASK_STATE_ABORTED flag is set and the sas_task is freed in pm8001_exec_internal_tmf_task().
However, if the I/O completion occurs later, the I/O completion still thinks that the sas_task is available. Fix this by clearing the ccb->task if the TMF times out - the I/O completion handler does nothing if this pointer is cleared.
--- drivers/scsi/pm8001/pm8001_sas.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/scsi/pm8001/pm8001_sas.c +5 -0
@@ -753,8 +753,13 @@ static int pm8001_exec_internal_tmf_task(struct domain_device *dev, res = -TMF_RESP_FUNC_FAILED ;/* Even TMF timed out, return direct. */ if (task->task_state_flags &SAS_TASK_STATE_ABORTED ) { +struct pm8001_ccb_info *ccb = task->lldd_task; +pm8001_dbg (pm8001_ha,FAIL ,"TMF task[%x]timeout.\n" , tmf->tmf); + +if (ccb) + ccb->task =NULL ; goto ex_err; }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 36/121 scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task
In reply to Greg Kroah-HartmanFrom: John Garry <[email protected]>
[ Upstream commit df7abcaa1246e2537ab4016077b5443bb3c09378 ]
Currently a use-after-free may occur if a sas_task is aborted by the upper layer before we handle the I/O completion in mpi_ssp_completion() or mpi_sata_completion().
In this case, the following are the two steps in handling those I/O completions:
- Call complete() to inform the upper layer handler of completion of the I/O.
- Release driver resources associated with the sas_task in pm8001_ccb_task_free() call.
When complete() is called, the upper layer may free the sas_task. As such, we should not touch the associated sas_task afterwards, but we do so in the pm8001_ccb_task_free() call.
Fix by swapping the complete() and pm8001_ccb_task_free() calls ordering.
--- drivers/scsi/pm8001/pm80xx_hwi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/pm8001/pm80xx_hwi.c +2 -2
@@ -2133,9 +2133,9 @@ mpi_ssp_completion(struct pm8001_hba_info *pm8001_ha , void *piomb)pm8001_dbg (pm8001_ha,FAIL ,"task 0x%p done with io_status 0x%x resp 0x%x stat 0x%x but aborted by upper layer!\n" , t, status, ts->resp, ts->stat); +pm8001_ccb_task_free (pm8001_ha, t, ccb, tag);if (t->slow_task)complete (&t->slow_task->completion); -pm8001_ccb_task_free (pm8001_ha, t, ccb, tag); }else {spin_unlock_irqrestore (&t->task_state_lock, flags);pm8001_ccb_task_free (pm8001_ha, t, ccb, tag);
@@ -2726,9 +2726,9 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)pm8001_dbg (pm8001_ha,FAIL ,"task 0x%p done with io_status 0x%x resp 0x%x stat 0x%x but aborted by upper layer!\n" , t, status, ts->resp, ts->stat); +pm8001_ccb_task_free (pm8001_ha, t, ccb, tag);if (t->slow_task)complete (&t->slow_task->completion); -pm8001_ccb_task_free (pm8001_ha, t, ccb, tag); }else {spin_unlock_irqrestore (&t->task_state_lock, flags);pm8001_ccb_task_free_done (pm8001_ha, t, ccb, tag);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 37/121 nvme: fix a possible use-after-free in controller reset during load
In reply to Greg Kroah-HartmanFrom: Sagi Grimberg <[email protected]>
[ Upstream commit 0fa0f99fc84e41057cbdd2efbfe91c6b2f47dd9d ]
Unlike .queue_rq, in .submit_async_event drivers may not check the ctrl readiness for AER submission. This may lead to a use-after-free condition that was observed with nvme-tcp.
The race condition may happen in the following scenario:
1. driver executes its reset_ctrl_work
2. -> nvme_stop_ctrl - flushes ctrl async_event_work
3. ctrl sends AEN which is received by the host, which in turn schedules AEN handling
4. teardown admin queue (which releases the queue socket)
5. AEN processed, submits another AER, calling the driver to submit
6. driver attempts to send the cmd
==> use-after-free
In order to fix that, add ctrl state check to validate the ctrl is actually able to accept the AER submission.
This addresses the above race in controller resets because the driver during teardown should:
1. change ctrl state to RESETTING
2. flush async_event_work (as well as other async work elements)
So after 1,2, any other AER command will find the
ctrl state to be RESETTING and bail out without submitting the AER.
--- drivers/nvme/host/core.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/nvme/host/core.c +8 -1
@@ -4259,7 +4259,14 @@ static void nvme_async_event_work(struct work_struct *work) container_of(work, struct nvme_ctrl, async_event_work);nvme_aen_uevent (ctrl); - ctrl->ops->submit_async_event (ctrl); + +/* +* The transport drivers must guarantee AER submission here is safe by +* flushing ctrl async_event_work after changing the controller state +* from LIVE and before freeing the admin queue. +*/ +if (ctrl->state ==NVME_CTRL_LIVE ) + ctrl->ops->submit_async_event (ctrl); }static bool nvme_ctrl_pp_status (struct nvme_ctrl *ctrl)
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 38/121 nvme-tcp: fix possible use-after-free in transport error_recovery work
In reply to Greg Kroah-HartmanFrom: Sagi Grimberg <[email protected]>
[ Upstream commit ff9fc7ebf5c06de1ef72a69f9b1ab40af8b07f9e ]
While nvme_tcp_submit_async_event_work is checking the ctrl and queue state before preparing the AER command and scheduling io_work, in order to fully prevent a race where this check is not reliable the error recovery work must flush async_event_work before continuing to destroy the admin queue after setting the ctrl state to RESETTING such that there is no race .submit_async_event and the error recovery handler itself changing the ctrl state.
--- drivers/nvme/host/tcp.c | 1 + 1 file changed, 1 insertion(+)
drivers/nvme/host/tcp.c +1 -0
@@ -2077,6 +2077,7 @@ static void nvme_tcp_error_recovery_work(struct work_struct *work)struct nvme_ctrl *ctrl = &tcp_ctrl->ctrl;nvme_stop_keep_alive (ctrl); +flush_work (&ctrl->async_event_work);nvme_tcp_teardown_io_queues (ctrl, false);/* unquiesce to fail fast pending requests */ nvme_start_queues (ctrl);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 39/121 nvme-rdma: fix possible use-after-free in transport error_recovery work
In reply to Greg Kroah-HartmanFrom: Sagi Grimberg <[email protected]>
[ Upstream commit b6bb1722f34bbdbabed27acdceaf585d300c5fd2 ]
While nvme_rdma_submit_async_event_work is checking the ctrl and queue state before preparing the AER command and scheduling io_work, in order to fully prevent a race where this check is not reliable the error recovery work must flush async_event_work before continuing to destroy the admin queue after setting the ctrl state to RESETTING such that there is no race .submit_async_event and the error recovery handler itself changing the ctrl state.
--- drivers/nvme/host/rdma.c | 1 + 1 file changed, 1 insertion(+)
drivers/nvme/host/rdma.c +1 -0
@@ -1200,6 +1200,7 @@ static void nvme_rdma_error_recovery_work(struct work_struct *work) struct nvme_rdma_ctrl, err_work);nvme_stop_keep_alive (&ctrl->ctrl); +flush_work (&ctrl->ctrl.async_event_work);nvme_rdma_teardown_io_queues (ctrl, false);nvme_start_queues (&ctrl->ctrl);nvme_rdma_teardown_admin_queue (ctrl, false);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 40/121 drm/amdgpu: fix logic inversion in check
In reply to Greg Kroah-HartmanFrom: Christian König <[email protected]>
[ Upstream commit e8ae38720e1a685fd98cfa5ae118c9d07b45ca79 ]
We probably never trigger this, but the logic inside the check is inverted.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +1 -1
@@ -2120,7 +2120,7 @@ int amdgpu_copy_buffer(struct amdgpu_ring *ring, uint64_t src_offset,unsigned i;int r; -if (direct_submit && !ring->sched.ready) { +if (!direct_submit && !ring->sched.ready) {DRM_ERROR ("Trying to move memory with ring turned off.\n" );return -EINVAL ; }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 41/121 x86/Xen: streamline (and fix) PV CPU enumeration
In reply to Greg Kroah-HartmanFrom: Jan Beulich <[email protected]>
[ Upstream commit e25a8d959992f61b64a58fc62fb7951dc6f31d1f ]
This started out with me noticing that "dom0_max_vcpus=<N>" with <N> larger than the number of physical CPUs reported through ACPI tables would not bring up the "excess" vCPU-s. Addressing this is the primary purpose of the change; CPU maps handling is being tidied only as far as is necessary for the change here (with the effect of also avoiding the setting up of too much per-CPU infrastructure, i.e. for CPUs which can never come online).
Noticing that xen_fill_possible_map() is called way too early, whereas xen_filter_cpu_maps() is called too late (after per-CPU areas were already set up), and further observing that each of the functions serves only one of Dom0 or DomU, it looked like it was better to simplify this. Use the .get_smp_config hook instead, uniformly for Dom0 and DomU. xen_fill_possible_map() can be dropped altogether, while xen_filter_cpu_maps() is re-purposed but not otherwise changed.
--- arch/x86/xen/enlighten_pv.c | 4 ---- arch/x86/xen/smp_pv.c | 26 ++++++-------------------- 2 files changed, 6 insertions(+), 24 deletions(-)
arch/x86/xen/enlighten_pv.c +0 -4
@@ -1387,10 +1387,6 @@ asmlinkage __visible void __init xen_start_kernel(void)xen_acpi_sleep_register (); -/* Avoid searching for BIOS MP tables */ - x86_init.mpparse.find_smp_config = x86_init_noop; - x86_init.mpparse.get_smp_config = x86_init_uint_noop; -xen_boot_params_init_edd ();#ifdef CONFIG_ACPI
arch/x86/xen/smp_pv.c +6 -20
@@ -149,28 +149,12 @@ int xen_smp_intr_init_pv(unsigned int cpu)return rc; } -static void __init xen_fill_possible_map (void ) -{ -int i, rc; - -if (xen_initial_domain ()) -return ; - -for (i =0 ; i < nr_cpu_ids; i++) { - rc =HYPERVISOR_vcpu_op (VCPUOP_is_up, i,NULL ); -if (rc >=0 ) { - num_processors++; -set_cpu_possible (i, true); - } - } -} - -static void __init xen_filter_cpu_maps (void ) +static void __init _get_smp_config (unsigned int early) {int i, rc;unsigned int subtract =0 ; -if (!xen_initial_domain ()) +if (early)return ; num_processors =0 ;
@@ -211,7 +195,6 @@ static void __init xen_pv_smp_prepare_boot_cpu(void)* sure the old memory can be recycled. */ make_lowmem_page_readwrite (xen_initial_gdt); -xen_filter_cpu_maps ();xen_setup_vcpu_info_placement ();/*
@@ -491,5 +474,8 @@ static const struct smp_ops xen_smp_ops __initconst = {void __init xen_smp_init (void ) { smp_ops = xen_smp_ops; -xen_fill_possible_map (); + +/* Avoid searching for BIOS MP tables */ + x86_init.mpparse.find_smp_config = x86_init_noop; + x86_init.mpparse.get_smp_config = _get_smp_config; }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 42/121 Revert "module, async: async_synchronize_full() on module init iff async is used"
In reply to Greg Kroah-HartmanFrom: Igor Pylypiv <[email protected]>
[ Upstream commit 67d6212afda218d564890d1674bab28e8612170f ]
This reverts commit 774a1221e862b343388347bac9b318767336b20b.
We need to finish all async code before the module init sequence is done. In the reverted commit the PF_USED_ASYNC flag was added to mark a thread that called async_schedule(). Then the PF_USED_ASYNC flag was used to determine whether or not async_synchronize_full() needs to be invoked. This works when modprobe thread is calling async_schedule(), but it does not work if module dispatches init code to a worker thread which then calls async_schedule().
For example, PCI driver probing is invoked from a worker thread based on a node where device is attached:
if (cpu < nr_cpu_ids) error = work_on_cpu(cpu, local_pci_probe, &ddi); else error = local_pci_probe(&ddi);
We end up in a situation where a worker thread gets the PF_USED_ASYNC flag set instead of the modprobe thread. As a result, async_synchronize_full() is not invoked and modprobe completes without waiting for the async code to finish.
The issue was discovered while loading the pm80xx driver:
(scsi_mod.scan=async)
modprobe pm80xx worker
...
do_init_module()
...
pci_call_probe()
work_on_cpu(local_pci_probe)
local_pci_probe()
pm8001_pci_probe()
scsi_scan_host()
async_schedule()
worker->flags |= PF_USED_ASYNC;
...
< return from worker > ...
if (current->flags & PF_USED_ASYNC) <--- false
async_synchronize_full();
Commit 21c3c5d28007 ("block: don't request module during elevator init") fixed the deadlock issue which the reverted commit 774a1221e862 ("module, async: async_synchronize_full() on module init iff async is used") tried to fix.
Since commit 0fdff3ec6d87 ("async, kmod: warn on synchronous request_module() from async workers") synchronous module loading from async is not allowed.
Given that the original deadlock issue is fixed and it is no longer allowed to call synchronous request_module() from async we can remove PF_USED_ASYNC flag to make module init consistently invoke async_synchronize_full() unless async module probe is requested.
--- include/linux/sched.h | 1 - kernel/async.c | 3 --- kernel/module.c | 25 +++++-------------------- 3 files changed, 5 insertions(+), 24 deletions(-)
include/linux/sched.h +0 -1
@@ -1544,7 +1544,6 @@ extern struct pid *cad_pid;#define PF_MEMALLOC 0x00000800/* Allocating memory */ #define PF_NPROC_EXCEEDED 0x00001000/* set_user() noticed that RLIMIT_NPROC was exceeded */ #define PF_USED_MATH 0x00002000/* If unset the fpu must be initialized before use */ -#define PF_USED_ASYNC 0x00004000/* Used async_schedule*(), used by module init */ #define PF_NOFREEZE 0x00008000/* This thread should not be frozen */ #define PF_FROZEN 0x00010000/* Frozen for system suspend */ #define PF_KSWAPD 0x00020000/* I am kswapd */
kernel/async.c +0 -3
@@ -205,9 +205,6 @@ async_cookie_t async_schedule_node_domain(async_func_t func, void *data,atomic_inc (&entry_count);spin_unlock_irqrestore (&async_lock, flags); -/* mark that this task has queued an async job, used by module init */ - current->flags |=PF_USED_ASYNC ; -/* schedule for execution */ queue_work_node (node, system_unbound_wq, &entry->work);
kernel/module.c +5 -20
@@ -3714,12 +3714,6 @@ static noinline int do_init_module(struct module *mod) } freeinit->module_init = mod->init_layout.base; -/* -* We want to find out whether @mod uses async during init. Clear -* PF_USED_ASYNC. async_schedule*() will set it. -*/ - current->flags &= ~PF_USED_ASYNC ; -do_mod_ctors (mod);/* Start the module */ if (mod->init !=NULL )
@@ -3745,22 +3739,13 @@ static noinline int do_init_module(struct module *mod)/* * We need to finish all async code before the module init sequence -* is done. This has potential to deadlock. For example, a newly -* detected block device can trigger request_module() of the -* default iosched from async probing task. Once userland helper -* reaches here, async_synchronize_full() will wait on the async -* task waiting on request_module() and deadlock. -* -* This deadlock is avoided by perfomring async_synchronize_full() -* iff module init queued any async jobs. This isn't a full -* solution as it will deadlock the same if module loading from -* async jobs nests more than once; however, due to the various -* constraints, this hack seems to be the best option for now. -* Please refer to the following thread for details. +* is done. This has potential to deadlock if synchronous module +* loading is requested from async (which is not allowed!). * -* http://thread.gmane.org/gmane.linux.kernel/1420814 +* See commit 0fdff3ec6d87 ("async, kmod: warn on synchronous +* request_module() from async workers") for more details. */ -if (!mod->async_probe_requested && (current->flags &PF_USED_ASYNC )) +if (!mod->async_probe_requested)async_synchronize_full (); ftrace_free_mem(mod, mod->init_layout.base, mod->init_layout.base +
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 43/121 gcc-plugins/stackleak: Use noinstr in favor of notrace
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
[ Upstream commit dcb85f85fa6f142aae1fe86f399d4503d49f2b60 ]
While the stackleak plugin was already using notrace, objtool is now a bit more picky. Update the notrace uses to noinstr. Silences the following objtool warnings when building with:
CONFIG_DEBUG_ENTRY=yCONFIG_STACK_VALIDATION=yCONFIG_VMLINUX_VALIDATION=yCONFIG_GCC_PLUGIN_STACKLEAK=y
vmlinux.o: warning: objtool: do_syscall_64()+0x9: call to stackleak_track_stack() leaves .noinstr.text section vmlinux.o: warning: objtool: do_int80_syscall_32()+0x9: call to stackleak_track_stack() leaves .noinstr.text section vmlinux.o: warning: objtool: exc_general_protection()+0x22: call to stackleak_track_stack() leaves .noinstr.text section vmlinux.o: warning: objtool: fixup_bad_iret()+0x20: call to stackleak_track_stack() leaves .noinstr.text section vmlinux.o: warning: objtool: do_machine_check()+0x27: call to stackleak_track_stack() leaves .noinstr.text section vmlinux.o: warning: objtool: .text+0x5346e: call to stackleak_erase() leaves .noinstr.text section vmlinux.o: warning: objtool: .entry.text+0x143: call to stackleak_erase() leaves .noinstr.text section vmlinux.o: warning: objtool: .entry.text+0x10eb: call to stackleak_erase() leaves .noinstr.text section vmlinux.o: warning: objtool: .entry.text+0x17f9: call to stackleak_erase() leaves .noinstr.text section
Note that the plugin's addition of calls to stackleak_track_stack() from noinstr functions is expected to be safe, as it isn't runtime instrumentation and is self-contained.
--- kernel/stackleak.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
kernel/stackleak.c +2 -3
@@ -48,7 +48,7 @@ int stack_erasing_sysctl(struct ctl_table *table, int write,#define skip_erasing () false#endif /* CONFIG_STACKLEAK_RUNTIME_DISABLE */ -asmlinkage void notrace stackleak_erase(void) +asmlinkage void noinstr stackleak_erase(void) {/* It would be nice not to have 'kstack_ptr' and 'boundary' on stack */ unsigned long kstack_ptr = current->lowest_stack;
@@ -102,9 +102,8 @@ asmlinkage void notrace stackleak_erase(void)/* Reset the 'lowest_stack' value for the next syscall */ current->lowest_stack =current_top_of_stack () -THREAD_SIZE /64 ; } -NOKPROBE_SYMBOL (stackleak_erase); -void __used __no_caller_saved_registers notrace stackleak_track_stack(void) +void __used __no_caller_saved_registers noinstr stackleak_track_stack(void) {unsigned long sp = current_stack_pointer;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 44/121 random: wake up /dev/random writers after zap
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
[ Upstream commit 042e293e16e3aa9794ce60c29f5b7b0c8170f933 ]
When account() is called, and the amount of entropy dips below random_write_wakeup_bits, we wake up the random writers, so that they can write some more in. However, the RNDZAPENTCNT/RNDCLEARPOOL ioctl sets the entropy count to zero -- a potential reduction just like account() -- but does not unblock writers. This commit adds the missing logic to that ioctl to unblock waiting writers.
--- drivers/char/random.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/char/random.c +4 -1
@@ -1987,7 +1987,10 @@ static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg)*/ if (!capable (CAP_SYS_ADMIN ))return -EPERM ; - input_pool.entropy_count =0 ; +if (xchg (&input_pool.entropy_count,0 ) && random_write_wakeup_bits) { +wake_up_interruptible (&random_write_wait); +kill_fasync (&fasync,SIGIO ,POLL_OUT ); + }return 0 ;case RNDRESEEDCRNG :if (!capable (CAP_SYS_ADMIN ))
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 45/121 kbuild: lto: merge module sections
In reply to Greg Kroah-HartmanFrom: Sami Tolvanen <[email protected]>
commit dd2776222abb9893e5b5c237a2c8c880d8854cee upstream.
LLD always splits sections with LTO, which increases module sizes. This change adds linker script rules to merge the split sections in the final module.
--- scripts/module.lds.S | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
scripts/module.lds.S +24 -0
@@ -23,6 +23,30 @@ SECTIONS { .init_array 0 : ALIGN(8) { *(SORT(.init_array.*)) *(.init_array) } __jump_table 0 : ALIGN(8) { KEEP(*(__jump_table)) } + + __patchable_function_entries : { *(__patchable_function_entries) } + + /* + * With CONFIG_LTO_CLANG, LLD always enables -fdata-sections and + * -ffunction-sections, which increases the size of the final module. + * Merge the split sections in the final binary. + */ + .bss : { + *(.bss .bss.[0-9a-zA-Z_]*) + *(.bss..L*) + } + + .data : { + *(.data .data.[0-9a-zA-Z_]*) + *(.data..L*) + } + + .rodata : { + *(.rodata .rodata.[0-9a-zA-Z_]*) + *(.rodata..L*) + } + + .text : { *(.text .text.[0-9a-zA-Z_]*) } } /* bring in arch-specific sections */
Greg Kroah-Hartman
maintainerPATCH 46/121 kbuild: lto: Merge module sections if and only if CONFIG_LTO_CLANG is enabled
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 6a3193cdd5e5b96ac65f04ee42555c216da332af upstream.
Merge module sections only when using Clang LTO. With ld.bfd, merging sections does not appear to update the symbol tables for the module, e.g. 'readelf -s' shows the value that a symbol would have had, if sections were not merged. ld.lld does not show this problem.
The stale symbol table breaks gdb's function disassembler, and presumably other things, e.g.
gdb -batch -ex "file arch/x86/kvm/kvm.ko" -ex "disassemble kvm_init"
reads the wrong bytes and dumps garbage.
--- scripts/module.lds.S | 2 ++ 1 file changed, 2 insertions(+)
scripts/module.lds.S +2 -0
@@ -26,6 +26,7 @@ SECTIONS { __patchable_function_entries : { *(__patchable_function_entries) } +#ifdef CONFIG_LTO_CLANG /* * With CONFIG_LTO_CLANG, LLD always enables -fdata-sections and * -ffunction-sections, which increases the size of the final module.
@@ -47,6 +48,7 @@ SECTIONS { } .text : { *(.text .text.[0-9a-zA-Z_]*) } +#endif } /* bring in arch-specific sections */
Greg Kroah-Hartman
maintainerPATCH 47/121 iwlwifi: fix use-after-free
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
commit bea2662e7818e15d7607d17d57912ac984275d94 upstream.
If no firmware was present at all (or, presumably, all of the firmware files failed to parse), we end up unbinding by calling device_release_driver(), which calls remove(), which then in iwlwifi calls iwl_drv_stop(), freeing the 'drv' struct. However the new code I added will still erroneously access it after it was freed.
Set 'failure=false' in this case to avoid the access, all data was already freed anyway.
--- drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/intel/iwlwifi/iwl-drv.c +2 -0
@@ -1646,6 +1646,8 @@ static void iwl_req_fw_callback(const st out_unbind:complete (&drv->request_firmware_complete);device_release_driver (drv->trans->dev); +/* drv has just been freed by the release */ + failure = false; free:if (failure)iwl_dealloc_ucode (drv);
Greg Kroah-Hartman
maintainerPATCH 48/121 drm/radeon: Fix backlight control on iMac 12,1
In reply to Greg Kroah-HartmanFrom: Nicholas Bishop <[email protected]>
commit 364438fd629f7611a84c8e6d7de91659300f1502 upstream.
The iMac 12,1 does not use the gmux driver for backlight, so the radeon backlight device is needed to set the brightness.
--- drivers/gpu/drm/radeon/atombios_encoders.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/radeon/atombios_encoders.c +2 -1
@@ -197,7 +197,8 @@ void radeon_atom_backlight_init(struct r* so don't register a backlight device */ if ((rdev->pdev->subsystem_vendor ==PCI_VENDOR_ID_APPLE ) && - (rdev->pdev->device ==0x6741 )) + (rdev->pdev->device ==0x6741 ) && + !dmi_match (DMI_PRODUCT_NAME ,"iMac12,1" ))return ;if (!radeon_encoder->enc_priv)
Greg Kroah-Hartman
maintainerPATCH 49/121 drm/i915/opregion: check port number bounds for SWSCI display power state
In reply to Greg Kroah-HartmanFrom: Jani Nikula <[email protected]>
commit ea958422291de248b9e2eaaeea36004e84b64043 upstream.
The mapping from enum port to whatever port numbering scheme is used by the SWSCI Display Power State Notification is odd, and the memory of it has faded. In any case, the parameter only has space for ports numbered [0..4], and UBSAN reports bit shift beyond it when the platform has port F or more.
Since the SWSCI functionality is supposed to be obsolete for new platforms (i.e. ones that might have port F or more), just bail out early if the mapped and mangled port number is beyond what the Display Power State Notification can support.
--- drivers/gpu/drm/i915/display/intel_opregion.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/gpu/drm/i915/display/intel_opregion.c +15 -0
@@ -361,6 +361,21 @@ int intel_opregion_notify_encoder(struct port++; } +/* +* The port numbering and mapping here is bizarre. The now-obsolete +* swsci spec supports ports numbered [0..4]. Port E is handled as a +* special case, but port F and beyond are not. The functionality is +* supposed to be obsolete for new platforms. Just bail out if the port +* number is out of bounds after mapping. +*/ +if (port >4 ) { +drm_dbg_kms (&dev_priv->drm, +"[ENCODER:%d:%s] port %c (index %u) out of bounds for display power state notification\n" , + intel_encoder->base.base.id, intel_encoder->base.name, +port_name (intel_encoder->port), port); +return -EINVAL ; + } +if (!enable) parm |=4 <<8 ;
Greg Kroah-Hartman
maintainerPATCH 50/121 vsock: remove vsock from connected table when connect is interrupted by a signal
In reply to Greg Kroah-HartmanFrom: Seth Forshee <[email protected]>
commit b9208492fcaecff8f43915529ae34b3bcb03877c upstream.
vsock_connect() expects that the socket could already be in the TCP_ESTABLISHED state when the connecting task wakes up with a signal pending. If this happens the socket will be in the connected table, and it is not removed when the socket state is reset. In this situation it's common for the process to retry connect(), and if the connection is successful the socket will be added to the connected table a second time, corrupting the list.
Prevent this by calling vsock_remove_connected() if a signal is received while waiting for a connection. This is harmless if the socket is not in the connected table, and if it is in the table then removing it will prevent list corruption from a double add.
Note for backporting: this patch requires d5afa82c977e ("vsock: correct removal of socket from the list"), which is in all current stable trees except 4.9.y.
--- net/vmw_vsock/af_vsock.c | 1 + 1 file changed, 1 insertion(+)
net/vmw_vsock/af_vsock.c +1 -0
@@ -1357,6 +1357,7 @@ static int vsock_stream_connect(struct s sk->sk_state = sk->sk_state ==TCP_ESTABLISHED ?TCP_CLOSING :TCP_CLOSE ; sock->state =SS_UNCONNECTED ;vsock_transport_cancel_pkt (vsk); +vsock_remove_connected (vsk); goto out_wait; }else if (timeout ==0 ) { err = -ETIMEDOUT ;
Greg Kroah-Hartman
maintainerPATCH 51/121 drm/i915/gvt: Make DRM_I915_GVT depend on X86
In reply to Greg Kroah-HartmanFrom: Siva Mullati <[email protected]>
commit d72d69abfdb6e0375981cfdda8eb45143f12c77d upstream.
GVT is not supported on non-x86 platforms, So add dependency of X86 on config parameter DRM_I915_GVT.
--- drivers/gpu/drm/i915/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/i915/Kconfig +1 -0
@@ -100,6 +100,7 @@ config DRM_I915_USERPTR config DRM_I915_GVT bool "Enable Intel GVT-g graphics virtualization host support" depends on DRM_I915 + depends on X86 depends on 64BIT default n help
Greg Kroah-Hartman
maintainerPATCH 52/121 iwlwifi: pcie: fix locking when "HW not ready"
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
commit e9848aed147708a06193b40d78493b0ef6abccf2 upstream.
If we run into this error path, we shouldn't unlock the mutex since it's not locked since. Fix this.
--- drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/wireless/intel/iwlwifi/pcie/trans.c +1 -2
@@ -1313,8 +1313,7 @@ static int iwl_trans_pcie_start_fw(struc/* This may fail if AMT took ownership of the device */ if (iwl_pcie_prepare_card_hw (trans)) {IWL_WARN (trans,"Exit HW not ready\n" ); - ret = -EIO ; - goto out; +return -EIO ; }iwl_enable_rfkill_int (trans);
Greg Kroah-Hartman
maintainerPATCH 53/121 iwlwifi: pcie: gen2: fix locking when "HW not ready"
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
commit 4c29c1e27a1e178a219b3877d055e6dd643bdfda upstream.
If we run into this error path, we shouldn't unlock the mutex since it's not locked since. Fix this in the gen2 code as well.
--- drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/wireless/intel/iwlwifi/pcie/trans-gen2.c +1 -2
@@ -320,8 +320,7 @@ int iwl_trans_pcie_gen2_start_fw(struct/* This may fail if AMT took ownership of the device */ if (iwl_pcie_prepare_card_hw (trans)) {IWL_WARN (trans,"Exit HW not ready\n" ); - ret = -EIO ; - goto out; +return -EIO ; }iwl_enable_rfkill_int (trans);
Greg Kroah-Hartman
maintainerPATCH 54/121 selftests: netfilter: fix exit value for nft_concat_range
In reply to Greg Kroah-HartmanFrom: Hangbin Liu <[email protected]>
commit 2e71ec1a725a794a16e3862791ed43fe5ba6a06b upstream.
When the nft_concat_range test failed, it exit 1 in the code specifically.
But when part of, or all of the test passed, it will failed the [ ${passed} -eq 0 ] check and thus exit with 1, which is the same exit value with failure result. Fix it by exit 0 when passed is not 0.
--- tools/testing/selftests/netfilter/nft_concat_range.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/netfilter/nft_concat_range.sh +1 -1
@@ -1583,4 +1583,4 @@ for name in ${TESTS}; do done done -[ ${passed} -eq 0 ] && exit ${KSELFTEST_SKIP} +[ ${passed} -eq 0 ] && exit ${KSELFTEST_SKIP} || exit 0
Greg Kroah-Hartman
maintainerPATCH 55/121 netfilter: nft_synproxy: unregister hooks on init error path
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
commit 2b4e5fb4d3776c391e40fb33673ba946dd96012d upstream.
Disable the IPv4 hooks if the IPv6 hooks fail to be registered.
--- net/netfilter/nft_synproxy.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/netfilter/nft_synproxy.c +3 -1
@@ -191,8 +191,10 @@ static int nft_synproxy_do_init(const stif (err) goto nf_ct_failure; err =nf_synproxy_ipv6_init (snet, ctx->net); -if (err) +if (err) { +nf_synproxy_ipv4_fini (snet, ctx->net); goto nf_ct_failure; + }break ; }
Greg Kroah-Hartman
maintainerPATCH 56/121 ipv6: per-netns exclusive flowlabel checks
In reply to Greg Kroah-HartmanFrom: Willem de Bruijn <[email protected]>
commit 0b0dff5b3b98c5c7ce848151df9da0b3cdf0cc8b upstream.
Ipv6 flowlabels historically require a reservation before use. Optionally in exclusive mode (e.g., user-private).
Commit 59c820b2317f ("ipv6: elide flowlabel check if no exclusive leases exist") introduced a fastpath that avoids this check when no exclusive leases exist in the system, and thus any flowlabel use will be granted.
That allows skipping the control operation to reserve a flowlabel entirely. Though with a warning if the fast path fails:
This is an optimization. Robust applications still have to revert to requesting leases if the fast path fails due to an exclusive lease.
Still, this is subtle. Better isolate network namespaces from each other. Flowlabels are per-netns. Also record per-netns whether exclusive leases are in use. Then behavior does not change based on activity in other netns.
Changes
v2
- wrap in IS_ENABLED(CONFIG_IPV6) to avoid breakage if disabled
--- include/net/ipv6.h | 5 ++++- include/net/netns/ipv6.h | 3 ++- net/ipv6/ip6_flowlabel.c | 4 +++- 3 files changed, 9 insertions(+), 3 deletions(-)
include/net/ipv6.h +4 -1
@@ -390,17 +390,20 @@ static inline void txopt_put(struct ipv6kfree_rcu (opt, rcu); } +#if IS_ENABLED (CONFIG_IPV6 )struct ip6_flowlabel *__fl6_sock_lookup (struct sock *sk,__be32 label);extern struct static_key_false_deferred ipv6_flowlabel_exclusive;static inline struct ip6_flowlabel *fl6_sock_lookup (struct sock *sk,__be32 label) { -if (static_branch_unlikely (&ipv6_flowlabel_exclusive.key)) +if (static_branch_unlikely (&ipv6_flowlabel_exclusive.key) && +READ_ONCE (sock_net (sk)->ipv6.flowlabel_has_excl))return __fl6_sock_lookup (sk, label) ? :ERR_PTR (-ENOENT );return NULL ; } +#endif struct ipv6_txoptions *fl6_merge_options(struct ipv6_txoptions *opt_space, struct ip6_flowlabel *fl,
include/net/netns/ipv6.h +2 -1
@@ -80,9 +80,10 @@ struct netns_ipv6 {spinlock_t fib6_gc_lock;unsigned int ip6_rt_gc_expire;unsigned long ip6_rt_last_gc; +unsigned char flowlabel_has_excl;#ifdef CONFIG_IPV6_MULTIPLE_TABLES -unsigned int fib6_rules_require_fldissect;bool fib6_has_custom_rules; +unsigned int fib6_rules_require_fldissect;#ifdef CONFIG_IPV6_SUBTREES unsigned int fib6_routes_require_src;#endif
net/ipv6/ip6_flowlabel.c +3 -1
@@ -450,8 +450,10 @@ fl_create(struct net *net, struct sock * err = -EINVAL ; goto done; } -if (fl_shared_exclusive (fl) || fl->opt) +if (fl_shared_exclusive (fl) || fl->opt) { +WRITE_ONCE (sock_net (sk)->ipv6.flowlabel_has_excl,1 );static_branch_deferred_inc (&ipv6_flowlabel_exclusive); + }return fl; done:
Greg Kroah-Hartman
maintainerPATCH 57/121 net: dsa: lan9303: fix reset on probe
In reply to Greg Kroah-HartmanFrom: Mans Rullgard <[email protected]>
commit 6bb9681a43f34f2cab4aad6e2a02da4ce54d13c5 upstream.
The reset input to the LAN9303 chip is active low, and devicetree gpio handles reflect this. Therefore, the gpio should be requested with an initial state of high in order for the reset signal to be asserted. Other uses of the gpio already use the correct polarity.
--- drivers/net/dsa/lan9303-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/lan9303-core.c +1 -1
@@ -1305,7 +1305,7 @@ static int lan9303_probe_reset_gpio(stru struct device_node *np) { chip->reset_gpio =devm_gpiod_get_optional (chip->dev,"reset" , -GPIOD_OUT_LOW ); +GPIOD_OUT_HIGH );if (IS_ERR (chip->reset_gpio))return PTR_ERR (chip->reset_gpio);
Greg Kroah-Hartman
maintainerPATCH 58/121 net: dsa: lantiq_gswip: fix use after free in gswip_remove()
In reply to Greg Kroah-HartmanFrom: Alexey Khoroshilov <[email protected]>
commit 8c6ae46150a453f8ae9a6cd49b45f354f478587d upstream.
of_node_put(priv->ds->slave_mii_bus->dev.of_node) should be done before mdiobus_free(priv->ds->slave_mii_bus).
--- drivers/net/dsa/lantiq_gswip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/lantiq_gswip.c +1 -1
@@ -2114,8 +2114,8 @@ static int gswip_remove(struct platform_if (priv->ds->slave_mii_bus) {mdiobus_unregister (priv->ds->slave_mii_bus); -mdiobus_free (priv->ds->slave_mii_bus);of_node_put (priv->ds->slave_mii_bus->dev.of_node); +mdiobus_free (priv->ds->slave_mii_bus); }for (i =0 ; i < priv->num_gphy_fw; i++)
Greg Kroah-Hartman
maintainerPATCH 59/121 net: ieee802154: ca8210: Fix lifs/sifs periods
In reply to Greg Kroah-HartmanFrom: Miquel Raynal <[email protected]>
commit bdc120a2bcd834e571ce4115aaddf71ab34495de upstream.
These periods are expressed in time units (microseconds) while 40 and 12 are the number of symbol durations these periods will last. We need to multiply them both with the symbol_duration in order to get these values in microseconds.
--- drivers/net/ieee802154/ca8210.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ieee802154/ca8210.c +2 -2
@@ -2977,8 +2977,8 @@ static void ca8210_hw_setup(struct ieee8 ca8210_hw->phy->cca.opt =NL802154_CCA_OPT_ENERGY_CARRIER_AND ; ca8210_hw->phy->cca_ed_level =-9800 ; ca8210_hw->phy->symbol_duration =16 ; - ca8210_hw->phy->lifs_period =40 ; - ca8210_hw->phy->sifs_period =12 ; + ca8210_hw->phy->lifs_period =40 * ca8210_hw->phy->symbol_duration; + ca8210_hw->phy->sifs_period =12 * ca8210_hw->phy->symbol_duration; ca8210_hw->flags =IEEE802154_HW_AFILT | IEEE802154_HW_OMIT_CKSUM |
Greg Kroah-Hartman
maintainerPATCH 60/121 ping: fix the dif and sdif check in ping_lookup
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
commit 35a79e64de29e8d57a5989aac57611c0cd29e13e upstream.
When 'ping' changes to use PING socket instead of RAW socket by:
# sysctl -w net.ipv4.ping_group_range="0 100"
There is another regression caused when matching sk_bound_dev_if and dif, RAW socket is using inet_iif() while PING socket lookup is using skb->dev->ifindex, the cmd below fails due to this:
# ip link add dummy0 type dummy # ip link set dummy0 up # ip addr add 192.168.111.1/24 dev dummy0 # ping -I dummy0 192.168.111.1 -c1
The issue was also reported on:
https://github.com/iputils/iputils/issues/104
But fixed in iputils in a wrong way by not binding to device when destination IP is on device, and it will cause some of kselftests to fail, as Jianlin noticed.
This patch is to use inet(6)_iif and inet(6)_sdif to get dif and sdif for PING socket, and keep consistent with RAW socket.
--- net/ipv4/ping.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
net/ipv4/ping.c +9 -2
@@ -172,16 +172,23 @@ static struct sock *ping_lookup(struct nstruct sock *sk =NULL ;struct inet_sock *isk;struct hlist_nulls_node *hnode; -int dif = skb->dev->ifindex; +int dif, sdif;if (skb->protocol ==htons (ETH_P_IP )) { + dif =inet_iif (skb); + sdif =inet_sdif (skb);pr_debug ("try to find: num = %d, daddr = %pI4, dif = %d\n" , (int )ident, &ip_hdr (skb)->daddr, dif);#if IS_ENABLED (CONFIG_IPV6 ) } else if (skb->protocol == htons(ETH_P_IPV6)) { + dif =inet6_iif (skb); + sdif =inet6_sdif (skb);pr_debug ("try to find: num = %d, daddr = %pI6c, dif = %d\n" , (int )ident, &ipv6_hdr (skb)->daddr, dif);#endif + }else { +pr_err ("ping: protocol(%x) is not supported\n" ,ntohs (skb->protocol)); +return NULL ; }read_lock_bh (&ping_table.lock);
@@ -221,7 +228,7 @@ static struct sock *ping_lookup(struct n }if (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif && - sk->sk_bound_dev_if !=inet_sdif (skb)) + sk->sk_bound_dev_if != sdif)continue ;sock_hold (sk);
Greg Kroah-Hartman
maintainerPATCH 61/121 bonding: force carrier update when releasing slave
In reply to Greg Kroah-HartmanFrom: Zhang Changzhong <[email protected]>
commit a6ab75cec1e461f8a35559054c146c21428430b8 upstream.
In __bond_release_one(), bond_set_carrier() is only called when bond device has no slave. Therefore, if we remove the up slave from a master with two slaves and keep the down slave, the master will remain up.
Fix this by moving bond_set_carrier() out of if (!bond_has_slaves(bond)) statement.
Reproducer:
$ insmod bonding.ko mode=0 miimon=100 max_bonds=2 $ ifconfig bond0 up $ ifenslave bond0 eth0 eth1 $ ifconfig eth0 down $ ifenslave -d bond0 eth1 $ cat /proc/net/bonding/bond0
--- drivers/net/bonding/bond_main.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/bonding/bond_main.c +2 -3
@@ -2272,10 +2272,9 @@ static int __bond_release_one(struct netbond_select_active_slave (bond); } -if (!bond_has_slaves (bond)) { -bond_set_carrier (bond); +bond_set_carrier (bond); +if (!bond_has_slaves (bond))eth_hw_addr_random (bond_dev); - }unblock_netpoll_tx ();synchronize_rcu ();
Greg Kroah-Hartman
maintainerPATCH 62/121 drop_monitor: fix data-race in dropmon_net_event / trace_napi_poll_hit
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit dcd54265c8bc14bd023815e36e2d5f9d66ee1fee upstream.
trace_napi_poll_hit() is reading stat->dev while another thread can write on it from dropmon_net_event()
Use READ_ONCE()/WRITE_ONCE() here, RCU rules are properly enforced already, we only have to take care of load/store tearing.
BUG: KCSAN: data-race in dropmon_net_event / trace_napi_poll_hit
write to 0xffff88816f3ab9c0 of 8 bytes by task 20260 on cpu 1:
dropmon_net_event+0xb8/0x2b0 net/core/drop_monitor.c:1579 notifier_call_chain kernel/notifier.c:84 [inline] raw_notifier_call_chain+0x53/0xb0 kernel/notifier.c:392 call_netdevice_notifiers_info net/core/dev.c:1919 [inline] call_netdevice_notifiers_extack net/core/dev.c:1931 [inline] call_netdevice_notifiers net/core/dev.c:1945 [inline] unregister_netdevice_many+0x867/0xfb0 net/core/dev.c:10415 ip_tunnel_delete_nets+0x24a/0x280 net/ipv4/ip_tunnel.c:1123 vti_exit_batch_net+0x2a/0x30 net/ipv4/ip_vti.c:515 ops_exit_list net/core/net_namespace.c:173 [inline] cleanup_net+0x4dc/0x8d0 net/core/net_namespace.c:597 process_one_work+0x3f6/0x960 kernel/workqueue.c:2307 worker_thread+0x616/0xa70 kernel/workqueue.c:2454 kthread+0x1bf/0x1e0 kernel/kthread.c:377 ret_from_fork+0x1f/0x30
read to 0xffff88816f3ab9c0 of 8 bytes by interrupt on cpu 0:
trace_napi_poll_hit+0x89/0x1c0 net/core/drop_monitor.c:292 trace_napi_poll include/trace/events/napi.h:14 [inline] __napi_poll+0x36b/0x3f0 net/core/dev.c:6366 napi_poll net/core/dev.c:6432 [inline] net_rx_action+0x29e/0x650 net/core/dev.c:6519 __do_softirq+0x158/0x2de kernel/softirq.c:558 do_softirq+0xb1/0xf0 kernel/softirq.c:459 __local_bh_enable_ip+0x68/0x70 kernel/softirq.c:383 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x33/0x40 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:394 [inline] ptr_ring_consume_bh include/linux/ptr_ring.h:367 [inline] wg_packet_decrypt_worker+0x73c/0x780 drivers/net/wireguard/receive.c:506 process_one_work+0x3f6/0x960 kernel/workqueue.c:2307 worker_thread+0x616/0xa70 kernel/workqueue.c:2454 kthread+0x1bf/0x1e0 kernel/kthread.c:377 ret_from_fork+0x1f/0x30
value changed: 0xffff88815883e000 -> 0x0000000000000000
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 26435 Comm: kworker/0:1 Not tainted 5.17.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: wg-crypt-wg2 wg_packet_decrypt_worker
--- net/core/drop_monitor.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
net/core/drop_monitor.c +9 -2
@@ -280,13 +280,17 @@ static void trace_napi_poll_hit(void *igrcu_read_lock ();list_for_each_entry_rcu (new_stat, &hw_stats_list, list) { +struct net_device *dev; +/* * only add a note to our monitor buffer if: * 1) this is the dev we received on * 2) its after the last_rx delta * 3) our rx_dropped count has gone up */ -if ((new_stat->dev == napi->dev) && +/* Paired with WRITE_ONCE() in dropmon_net_event() */ + dev =READ_ONCE (new_stat->dev); +if ((dev == napi->dev) && (time_after (jiffies, new_stat->last_rx + dm_hw_check_delta)) && (napi->dev->stats.rx_dropped != new_stat->last_drop_val)) {trace_drop_common (NULL ,NULL );
@@ -1574,7 +1578,10 @@ static int dropmon_net_event(struct notimutex_lock (&net_dm_mutex);list_for_each_entry_safe (new_stat, tmp, &hw_stats_list, list) {if (new_stat->dev == dev) { - new_stat->dev =NULL ; + +/* Paired with READ_ONCE() in trace_napi_poll_hit() */ +WRITE_ONCE (new_stat->dev,NULL ); +if (trace_state ==TRACE_OFF ) {list_del_rcu (&new_stat->list);kfree_rcu (new_stat, rcu);
Greg Kroah-Hartman
maintainerPATCH 63/121 net_sched: add __rcu annotation to netdev->qdisc
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit 5891cd5ec46c2c2eb6427cb54d214b149635dd0e upstream.
syzbot found a data-race [1] which lead me to add __rcu annotations to netdev->qdisc, and proper accessors to get LOCKDEP support.
[1]
BUG: KCSAN: data-race in dev_activate / qdisc_lookup_rcu
write to 0xffff888168ad6410 of 8 bytes by task 13559 on cpu 1:
attach_default_qdiscs net/sched/sch_generic.c:1167 [inline] dev_activate+0x2ed/0x8f0 net/sched/sch_generic.c:1221 __dev_open+0x2e9/0x3a0 net/core/dev.c:1416 __dev_change_flags+0x167/0x3f0 net/core/dev.c:8139 rtnl_configure_link+0xc2/0x150 net/core/rtnetlink.c:3150 __rtnl_newlink net/core/rtnetlink.c:3489 [inline] rtnl_newlink+0xf4d/0x13e0 net/core/rtnetlink.c:3529 rtnetlink_rcv_msg+0x745/0x7e0 net/core/rtnetlink.c:5594 netlink_rcv_skb+0x14e/0x250 net/netlink/af_netlink.c:2494 rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:5612 netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline] netlink_unicast+0x602/0x6d0 net/netlink/af_netlink.c:1343 netlink_sendmsg+0x728/0x850 net/netlink/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:705 [inline] sock_sendmsg net/socket.c:725 [inline] ____sys_sendmsg+0x39a/0x510 net/socket.c:2413 ___sys_sendmsg net/socket.c:2467 [inline] __sys_sendmsg+0x195/0x230 net/socket.c:2496 __do_sys_sendmsg net/socket.c:2505 [inline] __se_sys_sendmsg net/socket.c:2503 [inline] __x64_sys_sendmsg+0x42/0x50 net/socket.c:2503 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae
read to 0xffff888168ad6410 of 8 bytes by task 13560 on cpu 0:
qdisc_lookup_rcu+0x30/0x2e0 net/sched/sch_api.c:323 __tcf_qdisc_find+0x74/0x3a0 net/sched/cls_api.c:1050 tc_del_tfilter+0x1c7/0x1350 net/sched/cls_api.c:2211 rtnetlink_rcv_msg+0x5ba/0x7e0 net/core/rtnetlink.c:5585 netlink_rcv_skb+0x14e/0x250 net/netlink/af_netlink.c:2494 rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:5612 netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline] netlink_unicast+0x602/0x6d0 net/netlink/af_netlink.c:1343 netlink_sendmsg+0x728/0x850 net/netlink/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:705 [inline] sock_sendmsg net/socket.c:725 [inline] ____sys_sendmsg+0x39a/0x510 net/socket.c:2413 ___sys_sendmsg net/socket.c:2467 [inline] __sys_sendmsg+0x195/0x230 net/socket.c:2496 __do_sys_sendmsg net/socket.c:2505 [inline] __se_sys_sendmsg net/socket.c:2503 [inline] __x64_sys_sendmsg+0x42/0x50 net/socket.c:2503 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae
value changed: 0xffffffff85dee080 -> 0xffff88815d96ec00
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 13560 Comm: syz-executor.2 Not tainted 5.17.0-rc3-syzkaller-00116-gf1baf68e1383-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
--- include/linux/netdevice.h | 2 +- net/core/rtnetlink.c | 6 ++++-- net/sched/cls_api.c | 6 +++--- net/sched/sch_api.c | 22 ++++++++++++---------- net/sched/sch_generic.c | 29 ++++++++++++++++------------- 5 files changed, 36 insertions(+), 29 deletions(-)
include/linux/netdevice.h +1 -1
@@ -2061,7 +2061,7 @@ struct net_device {struct netdev_queue *_tx____cacheline_aligned_in_smp ;unsigned int num_tx_queues;unsigned int real_num_tx_queues; -struct Qdisc *qdisc; +struct Qdisc __rcu *qdisc;unsigned int tx_queue_len;spinlock_t tx_global_lock;
net/core/rtnetlink.c +4 -2
@@ -1705,6 +1705,7 @@ static int rtnl_fill_ifinfo(struct sk_bu {struct ifinfomsg *ifm;struct nlmsghdr *nlh; +struct Qdisc *qdisc;ASSERT_RTNL (); nlh =nlmsg_put (skb, pid, seq, type,sizeof (*ifm), flags);
@@ -1722,6 +1723,7 @@ static int rtnl_fill_ifinfo(struct sk_buif (tgt_netnsid >=0 &&nla_put_s32 (skb,IFLA_TARGET_NETNSID , tgt_netnsid)) goto nla_put_failure; + qdisc =rtnl_dereference (dev->qdisc);if (nla_put_string (skb,IFLA_IFNAME , dev->name) ||nla_put_u32 (skb,IFLA_TXQLEN , dev->tx_queue_len) || nla_put_u8(skb, IFLA_OPERSTATE,
@@ -1740,8 +1742,8 @@ static int rtnl_fill_ifinfo(struct sk_bu#endif put_master_ifindex (skb, dev) ||nla_put_u8 (skb,IFLA_CARRIER ,netif_carrier_ok (dev)) || - (dev->qdisc && -nla_put_string (skb,IFLA_QDISC , dev->qdisc->ops->id)) || + (qdisc && +nla_put_string (skb,IFLA_QDISC , qdisc->ops->id)) ||nla_put_ifalias (skb, dev) || nla_put_u32(skb, IFLA_CARRIER_CHANGES, atomic_read(&dev->carrier_up_count) +
net/sched/cls_api.c +3 -3
@@ -1045,7 +1045,7 @@ static int __tcf_qdisc_find(struct net */* Find qdisc */ if (!*parent) { - *q = dev->qdisc; + *q =rcu_dereference (dev->qdisc); *parent = (*q)->handle; }else { *q =qdisc_lookup_rcu (dev,TC_H_MAJ (*parent));
@@ -2591,7 +2591,7 @@ static int tc_dump_tfilter(struct sk_buf parent = tcm->tcm_parent;if (!parent) - q = dev->qdisc; + q =rtnl_dereference (dev->qdisc);else q =qdisc_lookup (dev,TC_H_MAJ (tcm->tcm_parent));if (!q)
@@ -2977,7 +2977,7 @@ static int tc_dump_chain(struct sk_buff parent = tcm->tcm_parent;if (!parent) { - q = dev->qdisc; + q =rtnl_dereference (dev->qdisc); parent = q->handle; }else { q =qdisc_lookup (dev,TC_H_MAJ (tcm->tcm_parent));
net/sched/sch_api.c +12 -10
@@ -301,7 +301,7 @@ struct Qdisc *qdisc_lookup(struct net_deif (!handle)return NULL ; - q =qdisc_match_from_root (dev->qdisc, handle); + q =qdisc_match_from_root (rtnl_dereference (dev->qdisc), handle);if (q) goto out;
@@ -320,7 +320,7 @@ struct Qdisc *qdisc_lookup_rcu(struct neif (!handle)return NULL ; - q =qdisc_match_from_root (dev->qdisc, handle); + q =qdisc_match_from_root (rcu_dereference (dev->qdisc), handle);if (q) goto out;
@@ -1082,10 +1082,10 @@ static int qdisc_graft(struct net_device skip:if (!ingress) {notify_and_destroy (net, skb, n, classid, - dev->qdisc, new); +rtnl_dereference (dev->qdisc), new);if (new && !new->ops->attach)qdisc_refcount_inc (new); - dev->qdisc = new ? : &noop_qdisc; +rcu_assign_pointer (dev->qdisc, new ? : &noop_qdisc);if (new && new->ops->attach) new->ops->attach (new);
@@ -1460,7 +1460,7 @@ static int tc_get_qdisc(struct sk_buff * q =dev_ingress_queue (dev)->qdisc_sleeping; } }else { - q = dev->qdisc; + q =rtnl_dereference (dev->qdisc); }if (!q) {NL_SET_ERR_MSG (extack,"Cannot find specified qdisc on specified device" );
@@ -1549,7 +1549,7 @@ replay: q =dev_ingress_queue (dev)->qdisc_sleeping; } }else { - q = dev->qdisc; + q =rtnl_dereference (dev->qdisc); }/* It may be default qdisc, ignore it */
@@ -1771,7 +1771,8 @@ static int tc_dump_qdisc(struct sk_buff s_q_idx =0 ; q_idx =0 ; -if (tc_dump_qdisc_root (dev->qdisc, skb, cb, &q_idx, s_q_idx, +if (tc_dump_qdisc_root (rtnl_dereference (dev->qdisc), + skb, cb, &q_idx, s_q_idx, true, tca[TCA_DUMP_INVISIBLE ]) <0 ) goto done;
@@ -2047,7 +2048,7 @@ static int tc_ctl_tclass(struct sk_buff }else if (qid1) { qid = qid1; }else if (qid ==0 ) - qid = dev->qdisc->handle; + qid =rtnl_dereference (dev->qdisc)->handle;/* Now qid is genuine qdisc handle consistent * both with parent and child.
@@ -2058,7 +2059,7 @@ static int tc_ctl_tclass(struct sk_buff portid =TC_H_MAKE (qid, portid); }else {if (qid ==0 ) - qid = dev->qdisc->handle; + qid =rtnl_dereference (dev->qdisc)->handle; }/* OK. Locate qdisc */
@@ -2219,7 +2220,8 @@ static int tc_dump_tclass(struct sk_buff s_t = cb->args[0 ]; t =0 ; -if (tc_dump_tclass_root (dev->qdisc, skb, tcm, cb, &t, s_t, true) <0 ) +if (tc_dump_tclass_root (rtnl_dereference (dev->qdisc), + skb, tcm, cb, &t, s_t, true) <0 ) goto done; dev_queue =dev_ingress_queue (dev);
net/sched/sch_generic.c +16 -13
@@ -1088,30 +1088,33 @@ static void attach_default_qdiscs(structif (!netif_is_multiqueue (dev) || dev->priv_flags &IFF_NO_QUEUE ) {netdev_for_each_tx_queue (dev, attach_one_default_qdisc,NULL ); - dev->qdisc = txq->qdisc_sleeping; -qdisc_refcount_inc (dev->qdisc); + qdisc = txq->qdisc_sleeping; +rcu_assign_pointer (dev->qdisc, qdisc); +qdisc_refcount_inc (qdisc); }else { qdisc =qdisc_create_dflt (txq, &mq_qdisc_ops,TC_H_ROOT ,NULL );if (qdisc) { - dev->qdisc = qdisc; +rcu_assign_pointer (dev->qdisc, qdisc); qdisc->ops->attach (qdisc); } } + qdisc =rtnl_dereference (dev->qdisc);/* Detect default qdisc setup/init failed and fallback to "noqueue" */ -if (dev->qdisc == &noop_qdisc) { +if (qdisc == &noop_qdisc) {netdev_warn (dev,"default qdisc (%s) fail, fallback to %s\n" , default_qdisc_ops->id, noqueue_qdisc_ops.id); dev->priv_flags |=IFF_NO_QUEUE ;netdev_for_each_tx_queue (dev, attach_one_default_qdisc,NULL ); - dev->qdisc = txq->qdisc_sleeping; -qdisc_refcount_inc (dev->qdisc); + qdisc = txq->qdisc_sleeping; +rcu_assign_pointer (dev->qdisc, qdisc); +qdisc_refcount_inc (qdisc); dev->priv_flags ^=IFF_NO_QUEUE ; }#ifdef CONFIG_NET_SCHED -if (dev->qdisc != &noop_qdisc) -qdisc_hash_add (dev->qdisc, false); +if (qdisc != &noop_qdisc) +qdisc_hash_add (qdisc, false);#endif }
@@ -1141,7 +1144,7 @@ void dev_activate(struct net_device *dev* and noqueue_qdisc for virtual interfaces */ -if (dev->qdisc == &noop_qdisc) +if (rtnl_dereference (dev->qdisc) == &noop_qdisc)attach_default_qdiscs (dev);if (!netif_carrier_ok (dev))
@@ -1306,7 +1309,7 @@ static int qdisc_change_tx_queue_len(strvoid dev_qdisc_change_real_num_tx (struct net_device *dev,unsigned int new_real_tx) { -struct Qdisc *qdisc = dev->qdisc; +struct Qdisc *qdisc =rtnl_dereference (dev->qdisc);if (qdisc->ops->change_real_num_tx) qdisc->ops->change_real_num_tx (qdisc, new_real_tx);
@@ -1346,7 +1349,7 @@ static void dev_init_scheduler_queue(strvoid dev_init_scheduler (struct net_device *dev) { - dev->qdisc = &noop_qdisc; +rcu_assign_pointer (dev->qdisc, &noop_qdisc);netdev_for_each_tx_queue (dev, dev_init_scheduler_queue, &noop_qdisc);if (dev_ingress_queue (dev))dev_init_scheduler_queue (dev,dev_ingress_queue (dev), &noop_qdisc);
@@ -1374,8 +1377,8 @@ void dev_shutdown(struct net_device *devnetdev_for_each_tx_queue (dev, shutdown_scheduler_queue, &noop_qdisc);if (dev_ingress_queue (dev))shutdown_scheduler_queue (dev,dev_ingress_queue (dev), &noop_qdisc); -qdisc_put (dev->qdisc); - dev->qdisc = &noop_qdisc; +qdisc_put (rtnl_dereference (dev->qdisc)); +rcu_assign_pointer (dev->qdisc, &noop_qdisc);WARN_ON (timer_pending (&dev->watchdog_timer)); }
Greg Kroah-Hartman
maintainerPATCH 64/121 bonding: fix data-races around agg_select_timer
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit 9ceaf6f76b203682bb6100e14b3d7da4c0bedde8 upstream.
syzbot reported that two threads might write over agg_select_timer at the same time. Make agg_select_timer atomic to fix the races.
BUG: KCSAN: data-race in bond_3ad_initiate_agg_selection / bond_3ad_state_machine_handler
read to 0xffff8881242aea90 of 4 bytes by task 1846 on cpu 1:
bond_3ad_state_machine_handler+0x99/0x2810 drivers/net/bonding/bond_3ad.c:2317 process_one_work+0x3f6/0x960 kernel/workqueue.c:2307 worker_thread+0x616/0xa70 kernel/workqueue.c:2454 kthread+0x1bf/0x1e0 kernel/kthread.c:377 ret_from_fork+0x1f/0x30
write to 0xffff8881242aea90 of 4 bytes by task 25910 on cpu 0:
bond_3ad_initiate_agg_selection+0x18/0x30 drivers/net/bonding/bond_3ad.c:1998 bond_open+0x658/0x6f0 drivers/net/bonding/bond_main.c:3967 __dev_open+0x274/0x3a0 net/core/dev.c:1407 dev_open+0x54/0x190 net/core/dev.c:1443 bond_enslave+0xcef/0x3000 drivers/net/bonding/bond_main.c:1937 do_set_master net/core/rtnetlink.c:2532 [inline] do_setlink+0x94f/0x2500 net/core/rtnetlink.c:2736 __rtnl_newlink net/core/rtnetlink.c:3414 [inline] rtnl_newlink+0xfeb/0x13e0 net/core/rtnetlink.c:3529 rtnetlink_rcv_msg+0x745/0x7e0 net/core/rtnetlink.c:5594 netlink_rcv_skb+0x14e/0x250 net/netlink/af_netlink.c:2494 rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:5612 netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline] netlink_unicast+0x602/0x6d0 net/netlink/af_netlink.c:1343 netlink_sendmsg+0x728/0x850 net/netlink/af_netlink.c:1919 sock_sendmsg_nosec net/socket.c:705 [inline] sock_sendmsg net/socket.c:725 [inline] ____sys_sendmsg+0x39a/0x510 net/socket.c:2413 ___sys_sendmsg net/socket.c:2467 [inline] __sys_sendmsg+0x195/0x230 net/socket.c:2496 __do_sys_sendmsg net/socket.c:2505 [inline] __se_sys_sendmsg net/socket.c:2503 [inline] __x64_sys_sendmsg+0x42/0x50 net/socket.c:2503 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae
value changed: 0x00000050 -> 0x0000004f
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 25910 Comm: syz-executor.1 Tainted: G W 5.17.0-rc4-syzkaller-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
--- drivers/net/bonding/bond_3ad.c | 30 +++++++++++++++++++++++++----- include/net/bond_3ad.h | 2 +- 2 files changed, 26 insertions(+), 6 deletions(-)
drivers/net/bonding/bond_3ad.c +25 -5
@@ -223,7 +223,7 @@ static inline int __check_agg_selection_if (bond ==NULL )return 0 ; -return BOND_AD_INFO (bond).agg_select_timer ?1 :0 ; +return atomic_read (&BOND_AD_INFO (bond).agg_select_timer) ?1 :0 ; }/**
@@ -1976,7 +1976,7 @@ static void ad_marker_response_received(*/ void bond_3ad_initiate_agg_selection (struct bonding *bond,int timeout) { -BOND_AD_INFO (bond).agg_select_timer = timeout; +atomic_set (&BOND_AD_INFO (bond).agg_select_timer, timeout); }/**
@@ -2260,6 +2260,28 @@ void bond_3ad_update_ad_actor_settings(s }/** +* bond_agg_timer_advance - advance agg_select_timer +* @bond: bonding structure +* +* Return true when agg_select_timer reaches 0. +*/ +static bool bond_agg_timer_advance (struct bonding *bond) +{ +int val, nval; + +while (1 ) { + val =atomic_read (&BOND_AD_INFO (bond).agg_select_timer); +if (!val) +return false; + nval = val -1 ; +if (atomic_cmpxchg (&BOND_AD_INFO (bond).agg_select_timer, + val, nval) == val) +break ; + } +return nval ==0 ; +} + +/** * bond_3ad_state_machine_handler - handle state machines timeout * @work: work context to fetch bonding struct to work on from *
@@ -2294,9 +2316,7 @@ void bond_3ad_state_machine_handler(struif (!bond_has_slaves (bond)) goto re_arm; -/* check if agg_select_timer timer after initialize is timed out */ -if (BOND_AD_INFO (bond).agg_select_timer && - !(--BOND_AD_INFO (bond).agg_select_timer)) { +if (bond_agg_timer_advance (bond)) { slave =bond_first_slave_rcu (bond); port = slave ? &(SLAVE_AD_INFO (slave)->port) :NULL ;
include/net/bond_3ad.h +1 -1
@@ -262,7 +262,7 @@ struct ad_system {struct ad_bond_info {struct ad_system system;/* 802.3ad system structure */ struct bond_3ad_stats stats; -u32 agg_select_timer;/* Timer to select aggregator after all adapter's hand shakes */ +atomic_t agg_select_timer;/* Timer to select aggregator after all adapter's hand shakes */ u16 aggregator_identifier; };
Greg Kroah-Hartman
maintainerPATCH 65/121 libsubcmd: Fix use-after-free for realloc(..., 0)
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
commit 52a9dab6d892763b2a8334a568bd4e2c1a6fde66 upstream.
GCC 12 correctly reports a potential use-after-free condition in the xrealloc helper. Fix the warning by avoiding an implicit "free(ptr)" when size == 0:
In file included from help.c:12:
In function 'xrealloc',
inlined from 'add_cmdname' at help.c:24:2: subcmd-util.h:56:23: error: pointer may be used after 'realloc' [-Werror=use-after-free]
56 | ret = realloc(ptr, size);
| ^~~~~~~~~~~~~~~~~~
subcmd-util.h:52:21: note: call to 'realloc' here
52 | void *ret = realloc(ptr, size);
| ^~~~~~~~~~~~~~~~~~
subcmd-util.h:58:31: error: pointer may be used after 'realloc' [-Werror=use-after-free]
58 | ret = realloc(ptr, 1);
| ^~~~~~~~~~~~~~~
subcmd-util.h:52:21: note: call to 'realloc' here
52 | void *ret = realloc(ptr, size);
| ^~~~~~~~~~~~~~~~~~--- tools/lib/subcmd/subcmd-util.h | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-)
tools/lib/subcmd/subcmd-util.h +2 -9
@@ -50,15 +50,8 @@ static NORETURN inline void die(const chstatic inline void *xrealloc (void *ptr,size_t size) {void *ret =realloc (ptr, size); -if (!ret && !size) - ret =realloc (ptr,1 ); -if (!ret) { - ret =realloc (ptr, size); -if (!ret && !size) - ret =realloc (ptr,1 ); -if (!ret) -die ("Out of memory, realloc failed" ); - } +if (!ret) +die ("Out of memory, realloc failed" );return ret; }
Greg Kroah-Hartman
maintainerPATCH 66/121 dpaa2-eth: Initialize mutex used in one step timestamping path
In reply to Greg Kroah-HartmanFrom: Radu Bulie <[email protected]>
commit 07dd44852be89386ab12210df90a2d78779f3bff upstream.
1588 Single Step Timestamping code path uses a mutex to enforce atomicity for two events:
- update of ptp single step register
- transmit ptp event packet
Before this patch the mutex was not initialized. This caused unexpected crashes in the Tx function.
--- drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +1 -1
@@ -4225,7 +4225,7 @@ static int dpaa2_eth_probe(struct fsl_mc }INIT_WORK (&priv->tx_onestep_tstamp, dpaa2_eth_tx_onestep_tstamp); - +mutex_init (&priv->onestep_tstamp_lock);skb_queue_head_init (&priv->tx_skbs);/* Obtain a MC portal */
Greg Kroah-Hartman
maintainerPATCH 67/121 perf bpf: Defer freeing string after possible strlen() on it
In reply to Greg Kroah-HartmanFrom: Arnaldo Carvalho de Melo <[email protected]>
commit 31ded1535e3182778a1d0e5c32711f55da3bc512 upstream.
This was detected by the gcc in Fedora Rawhide's gcc:
50 11.01 fedora:rawhide : FAIL gcc version 12.0.1 20220205 (Red Hat 12.0.1-0) (GCC)
inlined from 'bpf__config_obj' at util/bpf-loader.c:1242:9:
util/bpf-loader.c:1225:34: error: pointer 'map_opt' may be used after 'free' [-Werror=use-after-free]
1225 | *key_scan_pos += strlen(map_opt);
| ^~~~~~~~~~~~~~~
util/bpf-loader.c:1223:9: note: call to 'free' here
1223 | free(map_name);
| ^~~~~~~~~~~~~~
cc1: all warnings being treated as errorsSo do the calculations on the pointer before freeing it.
--- tools/perf/util/bpf-loader.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/perf/util/bpf-loader.c +2 -1
@@ -1215,9 +1215,10 @@ bpf__obj_config_map(struct bpf_object *opr_debug ("ERROR: Invalid map config option '%s'\n" , map_opt); err = -BPF_LOADER_ERRNO__OBJCONF_MAP_OPT ; out: -free (map_name);if (!err) *key_scan_pos +=strlen (map_opt); + +free (map_name);return err; }
Greg Kroah-Hartman
maintainerPATCH 68/121 selftests/exec: Add non-regular to TEST_GEN_PROGS
In reply to Greg Kroah-HartmanFrom: Muhammad Usama Anjum <[email protected]>
commit a7e793a867ae312cecdeb6f06cceff98263e75dd upstream.
non-regular file needs to be compiled and then copied to the output directory. Remove it from TEST_PROGS and add it to TEST_GEN_PROGS. This removes error thrown by rsync when non-regular object isn't found:
rsync: [sender] link_stat "/linux/tools/testing/selftests/exec/non-regular" failed: No such file or directory (2) rsync error: some files/attrs were not transferred (see previous errors) (code 23) at main.c(1333) [sender=3.2.3]
--- tools/testing/selftests/exec/Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/exec/Makefile +2 -2
@@ -3,8 +3,8 @@ CFLAGS = -Wall CFLAGS += -Wno-nonnull CFLAGS += -D_GNU_SOURCE -TEST_PROGS := binfmt_script non-regular -TEST_GEN_PROGS := execveat load_address_4096 load_address_2097152 load_address_16777216 +TEST_PROGS := binfmt_script +TEST_GEN_PROGS := execveat load_address_4096 load_address_2097152 load_address_16777216 non-regular TEST_GEN_FILES := execveat.symlink execveat.denatured script subdir # Makefile is a run-time dependency, since it's accessed by the execveat test TEST_FILES := Makefile
Greg Kroah-Hartman
maintainerPATCH 69/121 ALSA: hda/realtek: Add quirk for Legion Y9000X 2019
In reply to Greg Kroah-HartmanFrom: Yu Huang <[email protected]>
commit c07f2c7b45413a9e50ba78630fda04ecfa17b4f2 upstream.
Legion Y9000X 2019 has the same speaker with Y9000X 2020, but with a different quirk address. Add one quirk entry to make the speaker work on Y9000X 2019 too.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -8948,6 +8948,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x17aa ,0x3824 ,"Legion Y9000X 2020" ,ALC285_FIXUP_LEGION_Y9000X_SPEAKERS ),SND_PCI_QUIRK (0x17aa ,0x3827 ,"Ideapad S740" ,ALC285_FIXUP_IDEAPAD_S740_COEF ),SND_PCI_QUIRK (0x17aa ,0x3834 ,"Lenovo IdeaPad Slim 9i 14ITL5" ,ALC287_FIXUP_YOGA7_14ITL_SPEAKERS ), +SND_PCI_QUIRK (0x17aa ,0x383d ,"Legion Y9000X 2019" ,ALC285_FIXUP_LEGION_Y9000X_SPEAKERS ),SND_PCI_QUIRK (0x17aa ,0x3843 ,"Yoga 9i" ,ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP ),SND_PCI_QUIRK (0x17aa ,0x384a ,"Lenovo Yoga 7 15ITL5" ,ALC287_FIXUP_YOGA7_14ITL_SPEAKERS ), SND_PCI_QUIRK(0x17aa, 0x3852, "Lenovo Yoga 7 14ITL5", ALC287_FIXUP_YOGA7_14ITL_SPEAKERS),
Greg Kroah-Hartman
maintainerPATCH 70/121 ALSA: hda/realtek: Fix deadlock by COEF mutex
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 2a845837e3d0ddaed493b4c5c4643d7f0542804d upstream.
The recently introduced coef_mutex for Realtek codec seems causing a deadlock when the relevant code is invoked from the power-off state; then the HD-audio core tries to power-up internally, and this kicks off the codec runtime PM code that tries to take the same coef_mutex.
In order to avoid the deadlock, do the temporary power up/down around the coef_mutex acquisition and release. This assures that the power-up sequence runs before the mutex, hence no re-entrance will happen.
--- sound/pci/hda/patch_realtek.c | 39 ++++++++++++++++++++++++--------------- 1 file changed, 24 insertions(+), 15 deletions(-)
sound/pci/hda/patch_realtek.c +24 -15
@@ -134,6 +134,22 @@ struct alc_spec {* COEF access helper functions */ +static void coef_mutex_lock (struct hda_codec *codec) +{ +struct alc_spec *spec = codec->spec; + +snd_hda_power_up_pm (codec); +mutex_lock (&spec->coef_mutex); +} + +static void coef_mutex_unlock (struct hda_codec *codec) +{ +struct alc_spec *spec = codec->spec; + +mutex_unlock (&spec->coef_mutex); +snd_hda_power_down_pm (codec); +} +static int __alc_read_coefex_idx (struct hda_codec *codec,hda_nid_t nid,unsigned int coef_idx) {
@@ -147,12 +163,11 @@ static int __alc_read_coefex_idx(structstatic int alc_read_coefex_idx (struct hda_codec *codec,hda_nid_t nid,unsigned int coef_idx) { -struct alc_spec *spec = codec->spec;unsigned int val; -mutex_lock (&spec->coef_mutex); +coef_mutex_lock (codec); val =__alc_read_coefex_idx (codec, nid, coef_idx); -mutex_unlock (&spec->coef_mutex); +coef_mutex_unlock (codec);return val; }
@@ -169,11 +184,9 @@ static void __alc_write_coefex_idx(strucstatic void alc_write_coefex_idx (struct hda_codec *codec,hda_nid_t nid,unsigned int coef_idx,unsigned int coef_val) { -struct alc_spec *spec = codec->spec; - -mutex_lock (&spec->coef_mutex); +coef_mutex_lock (codec);__alc_write_coefex_idx (codec, nid, coef_idx, coef_val); -mutex_unlock (&spec->coef_mutex); +coef_mutex_unlock (codec); }#define alc_write_coef_idx (codec, coef_idx, coef_val) \
@@ -194,11 +207,9 @@ static void alc_update_coefex_idx(struct unsigned int coef_idx, unsigned int mask, unsigned int bits_set) { - struct alc_spec *spec = codec->spec; - -mutex_lock (&spec->coef_mutex); +coef_mutex_lock (codec );__alc_update_coefex_idx (codec, nid, coef_idx, mask, bits_set); -mutex_unlock (&spec->coef_mutex); +coef_mutex_unlock (codec); }#define alc_update_coef_idx (codec, coef_idx, mask, bits_set) \
@@ -231,9 +242,7 @@ struct coef_fw {static void alc_process_coef_fw (struct hda_codec *codec,const struct coef_fw *fw) { -struct alc_spec *spec = codec->spec; - -mutex_lock (&spec->coef_mutex); +coef_mutex_lock (codec);for (; fw->nid; fw++) {if (fw->mask == (unsigned short )-1 )__alc_write_coefex_idx (codec, fw->nid, fw->idx, fw->val);
@@ -241,7 +250,7 @@ static void alc_process_coef_fw(struct h__alc_update_coefex_idx (codec, fw->nid, fw->idx, fw->mask, fw->val); } -mutex_unlock (&spec->coef_mutex); +coef_mutex_unlock (codec); }/*
Greg Kroah-Hartman
maintainerPATCH 71/121 ALSA: hda: Fix regression on forced probe mask option
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 6317f7449348a897483a2b4841f7a9190745c81b upstream.
The forced probe mask via probe_mask 0x100 bit doesn't work any longer as expected since the bus init code was moved and it's clearing the codec_mask value that was set beforehand. This patch fixes the long-time regression by moving the check_probe_mask() call.
--- sound/pci/hda/hda_intel.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/hda/hda_intel.c +2 -2
@@ -1837,8 +1837,6 @@ static int azx_create(struct snd_card *cassign_position_fix (chip,check_position_fix (chip, position_fix[dev])); -check_probe_mask (chip, dev); -if (single_cmd <0 )/* allow fallback to single_cmd at errors */ chip->fallback_to_single_cmd =1 ;else /* explicitly set to single_cmd or not */
@@ -1866,6 +1864,8 @@ static int azx_create(struct snd_card *c chip->bus.core.needs_damn_long_delay =1 ; } +check_probe_mask (chip, dev); + err =snd_device_new (card,SNDRV_DEV_LOWLEVEL , chip, &ops);if (err <0 ) {dev_err (card->dev,"Error creating device [card]!\n" );
Greg Kroah-Hartman
maintainerPATCH 72/121 ALSA: hda: Fix missing codec probe on Shenker Dock 15
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit dd8e5b161d7fb9cefa1f1d6e35a39b9e1563c8d3 upstream.
By some unknown reason, BIOS on Shenker Dock 15 doesn't set up the codec mask properly for the onboard audio. Let's set the forced codec mask to enable the codec discovery.
--- sound/pci/hda/hda_intel.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/hda_intel.c +1 -0
@@ -1652,6 +1652,7 @@ static const struct snd_pci_quirk probe_/* forced codec slots */ SND_PCI_QUIRK (0x1043 ,0x1262 ,"ASUS W5Fm" ,0x103 ),SND_PCI_QUIRK (0x1046 ,0x1262 ,"ASUS W5F" ,0x103 ), +SND_PCI_QUIRK (0x1558 ,0x0351 ,"Schenker Dock 15" ,0x105 ),/* WinFast VP200 H (Teradici) user reported broken communication */ SND_PCI_QUIRK(0x3a21, 0x040d, "WinFast VP200 H", 0x101), {}
Greg Kroah-Hartman
maintainerPATCH 73/121 ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw()
In reply to Greg Kroah-HartmanFrom: Mark Brown <[email protected]>
commit 564778d7b1ea465f9487eedeece7527a033549c5 upstream.
When writing out a stereo control we discard the change notification from the first channel, meaning that events are only generated based on changes to the second channel. Ensure that we report a change if either channel has changed.
--- sound/soc/soc-ops.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
sound/soc/soc-ops.c +10 -4
@@ -308,7 +308,7 @@ int snd_soc_put_volsw(struct snd_kcontrounsigned int sign_bit = mc->sign_bit;unsigned int mask = (1 <<fls (max)) -1 ;unsigned int invert = mc->invert; -int err; +int err, ret;bool type_2r = false;unsigned int val2 =0 ;unsigned int val, val_mask;
@@ -350,12 +350,18 @@ int snd_soc_put_volsw(struct snd_kcontro err =snd_soc_component_update_bits (component, reg, val_mask, val);if (err <0 )return err; + ret = err; -if (type_2r) +if (type_2r) { err =snd_soc_component_update_bits (component, reg2, val_mask, - val2); + val2); +/* Don't discard any error code or drop change flag */ +if (ret ==0 || err <0 ) { + ret = err; + } + } -return err; +return ret; }EXPORT_SYMBOL_GPL (snd_soc_put_volsw);
Greg Kroah-Hartman
maintainerPATCH 74/121 ASoC: ops: Fix stereo change notifications in snd_soc_put_volsw_range()
In reply to Greg Kroah-HartmanFrom: Mark Brown <[email protected]>
commit 650204ded3703b5817bd4b6a77fa47d333c4f902 upstream.
When writing out a stereo control we discard the change notification from the first channel, meaning that events are only generated based on changes to the second channel. Ensure that we report a change if either channel has changed.
--- sound/soc/soc-ops.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
sound/soc/soc-ops.c +10 -5
@@ -510,7 +510,7 @@ int snd_soc_put_volsw_range(struct snd_kunsigned int mask = (1 <<fls (max)) -1 ;unsigned int invert = mc->invert;unsigned int val, val_mask; -int ret; +int err, ret;if (invert) val = (max - ucontrol->value.integer.value[0 ]) & mask;
@@ -519,9 +519,10 @@ int snd_soc_put_volsw_range(struct snd_k val_mask = mask << shift; val = val << shift; - ret =snd_soc_component_update_bits (component, reg, val_mask, val); -if (ret <0 ) -return ret; + err =snd_soc_component_update_bits (component, reg, val_mask, val); +if (err <0 ) +return err; + ret = err;if (snd_soc_volsw_is_stereo (mc)) {if (invert)
@@ -531,8 +532,12 @@ int snd_soc_put_volsw_range(struct snd_k val_mask = mask << shift; val = val << shift; - ret =snd_soc_component_update_bits (component, rreg, val_mask, + err =snd_soc_component_update_bits (component, rreg, val_mask, val); +/* Don't discard any error code or drop change flag */ +if (ret ==0 || err <0 ) { + ret = err; + } }return ret;
Greg Kroah-Hartman
maintainerPATCH 75/121 powerpc/lib/sstep: fix ptesync build error
In reply to Greg Kroah-HartmanFrom: Anders Roxell <[email protected]>
commit fe663df7825811358531dc2e8a52d9eaa5e3515e upstream.
Building tinyconfig with gcc (Debian 11.2.0-16) and assembler (Debian 2.37.90.20220207) the following build error shows up:
{standard input}: Assembler messages:
{standard input}:2088: Error: unrecognized opcode: `ptesync'
make[3]: *** [/builds/linux/scripts/Makefile.build:287: arch/powerpc/lib/sstep.o] Error 1
Add the 'ifdef CONFIG_PPC64' around the 'ptesync' in function 'emulate_update_regs()' to like it is in 'analyse_instr()'. Since it looks like it got dropped inadvertently by commit 3cdfcbfd32b9 ("powerpc: Change analyse_instr so it doesn't modify *regs").
A key detail is that analyse_instr() will never recognise lwsync or ptesync on 32-bit (because of the existing ifdef), and as a result emulate_update_regs() should never be called with an op specifying either of those on 32-bit. So removing them from emulate_update_regs() should be a nop in terms of runtime behaviour.
--- arch/powerpc/lib/sstep.c | 2 ++ 1 file changed, 2 insertions(+)
arch/powerpc/lib/sstep.c +2 -0
@@ -3062,12 +3062,14 @@ void emulate_update_regs(struct pt_regscase BARRIER_EIEIO :eieio ();break ; +#ifdef CONFIG_PPC64 case BARRIER_LWSYNC : asmvolatile ("lwsync" : : :"memory" );break ;case BARRIER_PTESYNC : asmvolatile ("ptesync" : : :"memory" );break ; +#endif }break ;
Greg Kroah-Hartman
maintainerPATCH 76/121 mtd: rawnand: gpmi: dont leak PM reference in error path
In reply to Greg Kroah-HartmanFrom: Christian Eggers <[email protected]>
commit 9161f365c91614e5a3f5c6dcc44c3b1b33bc59c0 upstream.
If gpmi_nfc_apply_timings() fails, the PM runtime usage counter must be dropped.
--- drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +2 -1
@@ -2291,7 +2291,7 @@ static int gpmi_nfc_exec_op(struct nand_ this->hw.must_apply_timings = false; ret =gpmi_nfc_apply_timings (this);if (ret) -return ret; + goto out_pm; }dev_dbg (this->dev,"%s: %d instructions\n" , __func__, op->ninstrs);
@@ -2420,6 +2420,7 @@ unmap: this->bch = false; +out_pm:pm_runtime_mark_last_busy (this->dev);pm_runtime_put_autosuspend (this->dev);
Greg Kroah-Hartman
maintainerPATCH 77/121 KVM: SVM: Never reject emulation due to SMAP errata for !SEV guests
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 55467fcd55b89c622e62b4afe60ac0eb2fae91f2 upstream.
Always signal that emulation is possible for !SEV guests regardless of whether or not the CPU provided a valid instruction byte stream. KVM can read all guest state (memory and registers) for !SEV guests, i.e. can fetch the code stream from memory even if the CPU failed to do so because of the SMAP errata.
Message-Id: <[email protected]>
--- arch/x86/kvm/svm/svm.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
arch/x86/kvm/svm/svm.c +4 -3
@@ -4103,6 +4103,10 @@ static bool svm_can_emulate_instruction(bool smep, smap, is_user;unsigned long cr4; +/* Emulation is always possible when KVM has access to all guest state. */ +if (!sev_guest (vcpu->kvm)) +return true; +/* * Detect and workaround Errata 1096 Fam_17h_00_0Fh. *
@@ -4151,9 +4155,6 @@ static bool svm_can_emulate_instruction( smap = cr4 &X86_CR4_SMAP ; is_user =svm_get_cpl (vcpu) ==3 ;if (smap && (!smep || is_user)) { -if (!sev_guest (vcpu->kvm)) -return true; -pr_err_ratelimited ("KVM: SEV Guest triggered AMD Erratum 1096\n" );/*
Greg Kroah-Hartman
maintainerPATCH 78/121 tee: export teedev_open() and teedev_close_context()
In reply to Greg Kroah-HartmanFrom: Jens Wiklander <[email protected]>
commit 1e2c3ef0496e72ba9001da5fd1b7ed56ccb30597 upstream.
Exports the two functions teedev_open() and teedev_close_context() in order to make it easier to create a driver internal struct tee_context.
--- drivers/tee/tee_core.c | 6 ++++-- include/linux/tee_drv.h | 14 ++++++++++++++ 2 files changed, 18 insertions(+), 2 deletions(-)
drivers/tee/tee_core.c +4 -2
@@ -43,7 +43,7 @@ static DEFINE_SPINLOCK(driver_lock);static struct class *tee_class;static dev_t tee_devt; -static struct tee_context *teedev_open (struct tee_device *teedev) +struct tee_context *teedev_open (struct tee_device *teedev) {int rc;struct tee_context *ctx;
@@ -70,6 +70,7 @@ err:return ERR_PTR (rc); } +EXPORT_SYMBOL_GPL (teedev_open);void teedev_ctx_get (struct tee_context *ctx) {
@@ -96,13 +97,14 @@ void teedev_ctx_put(struct tee_context *kref_put (&ctx->refcount, teedev_ctx_release); } -static void teedev_close_context (struct tee_context *ctx) +void teedev_close_context (struct tee_context *ctx) {struct tee_device *teedev = ctx->teedev;teedev_ctx_put (ctx);tee_device_put (teedev); } +EXPORT_SYMBOL_GPL (teedev_close_context);static int tee_open (struct inode *inode,struct file *filp) {
include/linux/tee_drv.h +14 -0
@@ -582,4 +582,18 @@ struct tee_client_driver {#define to_tee_client_driver (d) \ container_of(d, struct tee_client_driver, driver) +/** +* teedev_open() - Open a struct tee_device +* @teedev: Device to open +* +* @return a pointer to struct tee_context on success or an ERR_PTR on failure. +*/ +struct tee_context *teedev_open (struct tee_device *teedev); + +/** +* teedev_close_context() - closes a struct tee_context +* @ctx: The struct tee_context to close +*/ +void teedev_close_context (struct tee_context *ctx); +#endif /*__TEE_DRV_H*/
Greg Kroah-Hartman
maintainerPATCH 79/121 optee: use driver internal tee_context for some rpc
In reply to Greg Kroah-HartmanFrom: Jens Wiklander <[email protected]>
commit aceeafefff736057e8f93f19bbfbef26abd94604 upstream.
Adds a driver private tee_context by moving the tee_context in struct optee_notif to struct optee. This tee_context was previously used when doing internal calls to secure world to deliver notification.
The new driver internal tee_context is now also when allocating driver private shared memory. This decouples the shared memory object from its original tee_context. This is needed when the life time of such a memory allocation outlives the client tee_context.
This patch fixes the problem described below:
The addition of a shutdown hook by commit f25889f93184 ("optee: fix tee out of memory failure seen during kexec reboot") introduced a kernel shutdown regression that can be triggered after running the OP-TEE xtest suites.
Once the shutdown hook is called it is not possible to communicate any more with the supplicant process because the system is not scheduling task any longer. Thus if the optee driver shutdown path receives a supplicant RPC request from the OP-TEE we will deadlock the kernel's shutdown.
--- drivers/tee/optee/core.c | 8 ++++++++ drivers/tee/optee/optee_private.h | 2 ++ drivers/tee/optee/rpc.c | 8 +++++--- 3 files changed, 15 insertions(+), 3 deletions(-)
drivers/tee/optee/core.c +8 -0
@@ -588,6 +588,7 @@ static int optee_remove(struct platform_/* Unregister OP-TEE specific client devices on TEE bus */ optee_unregister_devices (); +teedev_close_context (optee->ctx);/* * Ask OP-TEE to free all cached shared memory objects to decrease * reference counters and also avoid wild pointers in secure world
@@ -633,6 +634,7 @@ static int optee_probe(struct platform_dstruct optee *optee =NULL ;void *memremaped_shm =NULL ;struct tee_device *teedev; +struct tee_context *ctx;u32 sec_caps;int rc;
@@ -719,6 +721,12 @@ static int optee_probe(struct platform_doptee_supp_init (&optee->supp); optee->memremaped_shm = memremaped_shm; optee->pool = pool; + ctx =teedev_open (optee->teedev); +if (IS_ERR (ctx)) { + rc = rc =PTR_ERR (ctx); + goto err; + } + optee->ctx = ctx;/* * Ensure that there are no pre-existing shm objects before enabling
drivers/tee/optee/optee_private.h +2 -0
@@ -70,6 +70,7 @@ struct optee_supp {* struct optee - main service struct * @supp_teedev: supplicant device * @teedev: client device +* @ctx: driver internal TEE context * @invoke_fn: function to issue smc or hvc * @call_queue: queue of threads waiting to call @invoke_fn * @wait_queue: queue of threads from secure world waiting for a
@@ -87,6 +88,7 @@ struct optee {struct tee_device *supp_teedev;struct tee_device *teedev;optee_invoke_fn *invoke_fn; +struct tee_context *ctx;struct optee_call_queue call_queue;struct optee_wait_queue wait_queue;struct optee_supp supp;
drivers/tee/optee/rpc.c +5 -3
@@ -284,6 +284,7 @@ static struct tee_shm *cmd_alloc_suppl(s }static void handle_rpc_func_cmd_shm_alloc (struct tee_context *ctx, +struct optee *optee,struct optee_msg_arg *arg,struct optee_call_ctx *call_ctx) {
@@ -313,7 +314,8 @@ static void handle_rpc_func_cmd_shm_allo shm =cmd_alloc_suppl (ctx, sz);break ;case OPTEE_MSG_RPC_SHM_TYPE_KERNEL : - shm =tee_shm_alloc (ctx, sz,TEE_SHM_MAPPED |TEE_SHM_PRIV ); + shm =tee_shm_alloc (optee->ctx, sz, +TEE_SHM_MAPPED |TEE_SHM_PRIV );break ;default : arg->ret =TEEC_ERROR_BAD_PARAMETERS ;
@@ -470,7 +472,7 @@ static void handle_rpc_func_cmd(struct tbreak ;case OPTEE_MSG_RPC_CMD_SHM_ALLOC :free_pages_list (call_ctx); -handle_rpc_func_cmd_shm_alloc (ctx, arg, call_ctx); +handle_rpc_func_cmd_shm_alloc (ctx, optee, arg, call_ctx);break ;case OPTEE_MSG_RPC_CMD_SHM_FREE :handle_rpc_func_cmd_shm_free (ctx, arg);
@@ -501,7 +503,7 @@ void optee_handle_rpc(struct tee_contextswitch (OPTEE_SMC_RETURN_GET_RPC_FUNC (param->a0)) {case OPTEE_SMC_RPC_FUNC_ALLOC : - shm =tee_shm_alloc (ctx, param->a1, + shm =tee_shm_alloc (optee->ctx, param->a1,TEE_SHM_MAPPED |TEE_SHM_PRIV );if (!IS_ERR (shm) && !tee_shm_get_pa (shm,0 , &pa)) {reg_pair_from_64 (¶m->a1, ¶m->a2, pa);
Greg Kroah-Hartman
maintainerPATCH 80/121 ASoC: tas2770: Insert post reset delay
In reply to Greg Kroah-HartmanFrom: Martin Povišer <[email protected]>
commit 307f31452078792aab94a729fce33200c6e42dc4 upstream.
Per TAS2770 datasheet there must be a 1 ms delay from reset to first command. So insert delays into the driver where appropriate.
--- sound/soc/codecs/tas2770.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
sound/soc/codecs/tas2770.c +6 -1
@@ -38,10 +38,12 @@ static void tas2770_reset(struct tas2770gpiod_set_value_cansleep (tas2770->reset_gpio,0 );msleep (20 );gpiod_set_value_cansleep (tas2770->reset_gpio,1 ); +usleep_range (1000 ,2000 ); }snd_soc_component_write (tas2770->component,TAS2770_SW_RST ,TAS2770_RST ); +usleep_range (1000 ,2000 ); } static int tas2770_set_bias_level(struct snd_soc_component *component,
@@ -110,6 +112,7 @@ static int tas2770_codec_resume(struct sif (tas2770->sdz_gpio) {gpiod_set_value_cansleep (tas2770->sdz_gpio,1 ); +usleep_range (1000 ,2000 ); }else { ret = snd_soc_component_update_bits(component, TAS2770_PWR_CTRL, TAS2770_PWR_CTRL_MASK,
@@ -510,8 +513,10 @@ static int tas2770_codec_probe(struct sn tas2770->component = component; -if (tas2770->sdz_gpio) +if (tas2770->sdz_gpio) {gpiod_set_value_cansleep (tas2770->sdz_gpio,1 ); +usleep_range (1000 ,2000 ); + }tas2770_reset (tas2770);
Greg Kroah-Hartman
maintainerPATCH 81/121 block/wbt: fix negative inflight counter when remove scsi device
In reply to Greg Kroah-HartmanFrom: Laibin Qiu <[email protected]>
commit e92bc4cd34de2ce454bdea8cd198b8067ee4e123 upstream.
Now that we disable wbt by set WBT_STATE_OFF_DEFAULT in wbt_disable_default() when switch elevator to bfq. And when we remove scsi device, wbt will be enabled by wbt_enable_default. If it become false positive between wbt_wait() and wbt_track() when submit write request.
The following is the scenario that triggered the problem.
T1 T2 T3
elevator_switch_mq bfq_init_queue wbt_disable_default <= Set rwb->enable_state (OFF)Submit_bioblk_mq_make_requestrq_qos_throttle
<= rwb->enable_state (OFF)
scsi_remove_device
sd_remove
del_gendisk
blk_unregister_queue
elv_unregister_queue
wbt_enable_default
<= Set rwb->enable_state (ON)q_qos_track
<= rwb->enable_state (ON)
^^^^^^ this request will mark WBT_TRACKED without inflight add and will lead to drop rqw->inflight to -1 in wbt_done() which will trigger IO hung.
Fix this by move wbt_enable_default() from elv_unregister to bfq_exit_queue(). Only re-enable wbt when bfq exit.
Remove oneline stale comment, and kill one oneshot local variable.
--- block/bfq-iosched.c | 2 ++ block/elevator.c | 2 -- 2 files changed, 2 insertions(+), 2 deletions(-)
block/bfq-iosched.c +2 -0
@@ -6404,6 +6404,8 @@ static void bfq_exit_queue(struct elevatspin_unlock_irq (&bfqd->lock);#endif +wbt_enable_default (bfqd->queue); +kfree (bfqd); }
block/elevator.c +0 -2
@@ -518,8 +518,6 @@ void elv_unregister_queue(struct requestkobject_del (&e->kobj); e->registered =0 ; -/* Re-enable throttling in case elevator disabled it */ -wbt_enable_default (q); } }
Greg Kroah-Hartman
maintainerPATCH 82/121 NFS: LOOKUP_DIRECTORY is also ok with symlinks
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
commit e0caaf75d443e02e55e146fd75fe2efc8aed5540 upstream.
Commit ac795161c936 (NFSv4: Handle case where the lookup of a directory fails) [1], part of Linux since 5.17-rc2, introduced a regression, where a symbolic link on an NFS mount to a directory on another NFS does not resolve(?) the first time it is accessed:
--- fs/nfs/dir.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/nfs/dir.c +2 -2
@@ -1780,14 +1780,14 @@ no_open:if (!res) { inode =d_inode (dentry);if ((lookup_flags &LOOKUP_DIRECTORY ) && inode && - !S_ISDIR (inode->i_mode)) + !(S_ISDIR (inode->i_mode) ||S_ISLNK (inode->i_mode))) res =ERR_PTR (-ENOTDIR );else if (inode &&S_ISREG (inode->i_mode)) res =ERR_PTR (-EOPENSTALE ); }else if (!IS_ERR (res)) { inode =d_inode (res);if ((lookup_flags &LOOKUP_DIRECTORY ) && inode && - !S_ISDIR (inode->i_mode)) { + !(S_ISDIR (inode->i_mode) ||S_ISLNK (inode->i_mode))) {dput (res); res =ERR_PTR (-ENOTDIR ); }else if (inode &&S_ISREG (inode->i_mode)) {
Greg Kroah-Hartman
maintainerPATCH 83/121 NFS: Do not report writeback errors in nfs_getattr()
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
commit d19e0183a88306acda07f4a01fedeeffe2a2a06b upstream.
The result of the writeback, whether it is an ENOSPC or an EIO, or anything else, does not inhibit the NFS client from reporting the correct file timestamps.
--- fs/nfs/inode.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
fs/nfs/inode.c +3 -6
@@ -807,12 +807,9 @@ int nfs_getattr(const struct path *path, }/* Flush out writes to the server in order to update c/mtime. */ -if ((request_mask & (STATX_CTIME |STATX_MTIME )) && -S_ISREG (inode->i_mode)) { - err =filemap_write_and_wait (inode->i_mapping); -if (err) - goto out; - } +if ((request_mask & (STATX_CTIME |STATX_MTIME )) && +S_ISREG (inode->i_mode)) +filemap_write_and_wait (inode->i_mapping);/* * We may force a getattr if the user cares about atime.
Greg Kroah-Hartman
maintainerPATCH 84/121 tty: n_tty: do not look ahead for EOL character past the end of the buffer
In reply to Greg Kroah-HartmanFrom: Linus Torvalds <[email protected]>
commit 3593030761630e09200072a4bd06468892c27be3 upstream.
Daniel Gibson reports that the n_tty code gets line termination wrong in very specific cases:
"If you feed a line with exactly 64 chars + terminating newline, and
directly afterwards (without reading) another line into a pseudo terminal, the the first read() on the other side will return the 64 char line *without* terminating newline, and the next read() will return the missing terminating newline AND the complete next line (if it fits in the buffer)"
and bisected the behavior to commit 3b830a9c34d5 ("tty: convert tty_ldisc_ops 'read()' function to take a kernel pointer").
Now, digging deeper, it turns out that the behavior isn't exactly new:
what changed in commit 3b830a9c34d5 was that the tty line discipline .read() function is now passed an intermediate kernel buffer rather than the final user space buffer.
And that intermediate kernel buffer is 64 bytes in size - thus that special case with exactly 64 bytes plus terminating newline.
The same problem did exist before, but historically the boundary was not the 64-byte chunk, but the user-supplied buffer size, which is obviously generally bigger (and potentially bigger than N_TTY_BUF_SIZE, which would hide the issue entirely).
The reason is that the n_tty canon_copy_from_read_buf() code would look ahead for the EOL character one byte further than it would actually copy. It would then decide that it had found the terminator, and unmark it as an EOL character - which in turn explains why the next read wouldn't then be terminated by it.
Now, the reason it did all this in the first place is related to some historical and pretty obscure EOF behavior, see commit ac8f3bf8832a ("n_tty: Fix poll() after buffer-limited eof push read") and commit 40d5e0905a03 ("n_tty: Fix EOF push handling").
And the reason for the EOL confusion is that we treat EOF as a special EOL condition, with the EOL character being NUL (aka "__DISABLED_CHAR" in the kernel sources).
So that EOF look-ahead also affects the normal EOL handling.
This patch just removes the look-ahead that causes problems, because EOL is much more critical than the historical "EOF in the middle of a line that coincides with the end of the buffer" handling ever was.
Now, it is possible that we should indeed re-introduce the "look at next character to see if it's a EOF" behavior, but if so, that should be done not at the kernel buffer chunk boundary in canon_copy_from_read_buf(), but at a higher level, when we run out of the user buffer.
In particular, the place to do that would be at the top of 'n_tty_read()', where we check if it's a continuation of a previously started read, and there is no more buffer space left, we could decide to just eat the __DISABLED_CHAR at that point.
But that would be a separate patch, because I suspect nobody actually cares, and I'd like to get a report about it before bothering.
--- drivers/tty/n_tty.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/tty/n_tty.c +2 -4
@@ -2024,7 +2024,7 @@ static bool canon_copy_from_read_buf(strreturn false; canon_head =smp_load_acquire (&ldata->canon_head); - n =min (*nr +1 , canon_head - ldata->read_tail); + n =min (*nr, canon_head - ldata->read_tail); tail = ldata->read_tail & (N_TTY_BUF_SIZE -1 ); size =min_t (size_t, tail + n,N_TTY_BUF_SIZE );
@@ -2046,10 +2046,8 @@ static bool canon_copy_from_read_buf(str n +=N_TTY_BUF_SIZE ; c = n + found; -if (!found ||read_buf (ldata, eol) != __DISABLED_CHAR) { - c =min (*nr, c); +if (!found ||read_buf (ldata, eol) != __DISABLED_CHAR) n = c; - }n_tty_trace ("%s: eol:%zu found:%d n:%zu c:%zu tail:%zu more:%zu\n" , __func__, eol, found, n, c, tail, more);
Greg Kroah-Hartman
maintainerPATCH 85/121 mtd: rawnand: qcom: Fix clock sequencing in qcom_nandc_probe()
In reply to Greg Kroah-HartmanFrom: Bryan O'Donoghue <[email protected]>
commit 5c23b3f965bc9ee696bf2ed4bdc54d339dd9a455 upstream.
Interacting with a NAND chip on an IPQ6018 I found that the qcomsmem NAND partition parser was returning -EPROBE_DEFER waiting for the main smem driver to load.
This caused the board to reset. Playing about with the probe() function shows that the problem lies in the core clock being switched off before the nandc_unalloc() routine has completed.
If we look at how qcom_nandc_remove() tears down allocated resources we see the expected order is
qcom_nandc_unalloc(nandc);
clk_disable_unprepare(nandc->aon_clk);clk_disable_unprepare(nandc->core_clk);
dma_unmap_resource(&pdev->dev, nandc->base_dma, resource_size(res),
DMA_BIDIRECTIONAL, 0);
Tweaking probe() to both bring up and tear-down in that order removes the reset if we end up deferring elsewhere.
--- drivers/mtd/nand/raw/qcom_nandc.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
drivers/mtd/nand/raw/qcom_nandc.c +6 -8
@@ -2,7 +2,6 @@/* * Copyright (c) 2016, The Linux Foundation. All rights reserved. */ -#include <linux/clk.h> #include <linux/slab.h> #include <linux/bitops.h>
@@ -2968,10 +2967,6 @@ static int qcom_nandc_probe(struct platfif (!nandc->base_dma)return -ENXIO ; - ret =qcom_nandc_alloc (nandc); -if (ret) - goto err_nandc_alloc; - ret =clk_prepare_enable (nandc->core_clk);if (ret) goto err_core_clk;
@@ -2980,6 +2975,10 @@ static int qcom_nandc_probe(struct platfif (ret) goto err_aon_clk; + ret =qcom_nandc_alloc (nandc); +if (ret) + goto err_nandc_alloc; + ret =qcom_nandc_setup (nandc);if (ret) goto err_setup;
@@ -2991,15 +2990,14 @@ static int qcom_nandc_probe(struct platfreturn 0 ; err_setup: +qcom_nandc_unalloc (nandc); +err_nandc_alloc:clk_disable_unprepare (nandc->aon_clk); err_aon_clk:clk_disable_unprepare (nandc->core_clk); err_core_clk: -qcom_nandc_unalloc (nandc); -err_nandc_alloc:dma_unmap_resource (dev, res->start,resource_size (res),DMA_BIDIRECTIONAL ,0 ); -return ret; }
Greg Kroah-Hartman
maintainerPATCH 86/121 mtd: rawnand: brcmnand: Fixed incorrect sub-page ECC status
In reply to Greg Kroah-HartmanFrom: david regan <[email protected]>
commit 36415a7964711822e63695ea67fede63979054d9 upstream.
The brcmnand driver contains a bug in which if a page (example 2k byte) is read from the parallel/ONFI NAND and within that page a subpage (512 byte) has correctable errors which is followed by a subpage with uncorrectable errors, the page read will return the wrong status of correctable (as opposed to the actual status of uncorrectable.)
The bug is in function brcmnand_read_by_pio where there is a check for uncorrectable bits which will be preempted if a previous status for correctable bits is detected.
The fix is to stop checking for bad bits only if we already have a bad bits status.
--- drivers/mtd/nand/raw/brcmnand/brcmnand.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/nand/raw/brcmnand/brcmnand.c +1 -1
@@ -2062,7 +2062,7 @@ static int brcmnand_read_by_pio(struct m mtd->oobsize / trans, host->hwcfg.sector_size_1k); -if (!ret) { +if (ret != -EBADMSG ) { *err_addr =brcmnand_get_uncorrecc_addr (ctrl);if (*err_addr)
Greg Kroah-Hartman
maintainerPATCH 87/121 Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 8bc69f86328e87a0ffa79438430cc82f3aa6a194 ]
kobject_init_and_add() takes reference even when it fails. According to the doc of kobject_init_and_add()：
If this function returns an error, kobject_put() must be called to properly clean up the memory associated with the object.
Fix memory leak by calling kobject_put().
--- drivers/hv/vmbus_drv.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/hv/vmbus_drv.c +4 -1
@@ -1944,8 +1944,10 @@ int vmbus_add_channel_kobj(struct hv_device *dev, struct vmbus_channel *channel) kobj->kset = dev->channels_kset; ret =kobject_init_and_add (kobj, &vmbus_chan_ktype,NULL ,"%u" , relid); -if (ret) +if (ret) { +kobject_put (kobj);return ret; + } ret =sysfs_create_group (kobj, &vmbus_chan_group);
@@ -1954,6 +1956,7 @@ int vmbus_add_channel_kobj(struct hv_device *dev, struct vmbus_channel *channel)* The calling functions' error handling paths will cleanup the * empty channel directory. */ +kobject_put (kobj);dev_err (device,"Unable to set up channel sysfs files\n" );return ret; }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 88/121 KVM: x86/pmu: Refactoring find_arch_event() to pmc_perf_hw_id()
In reply to Greg Kroah-HartmanFrom: Like Xu <[email protected]>
[ Upstream commit 7c174f305cbee6bdba5018aae02b84369e7ab995 ]
The find_arch_event() returns a "unsigned int" value, which is used by the pmc_reprogram_counter() to program a PERF_TYPE_HARDWARE type perf_event.
The returned value is actually the kernel defined generic perf_hw_id, let's rename it to pmc_perf_hw_id() with simpler incoming parameters for better self-explanation.
Message-Id: <[email protected]>
--- arch/x86/kvm/pmu.c | 8 +------- arch/x86/kvm/pmu.h | 3 +-- arch/x86/kvm/svm/pmu.c | 8 ++++---- arch/x86/kvm/vmx/pmu_intel.c | 9 +++++---- 4 files changed, 11 insertions(+), 17 deletions(-)
arch/x86/kvm/pmu.c +1 -7
@@ -171,7 +171,6 @@ static bool pmc_resume_counter(struct kvm_pmc *pmc)void reprogram_gp_counter (struct kvm_pmc *pmc,u64 eventsel) {unsigned config, type =PERF_TYPE_RAW ; -u8 event_select, unit_mask;struct kvm *kvm = pmc->vcpu->kvm;struct kvm_pmu_event_filter *filter;int i;
@@ -203,17 +202,12 @@ void reprogram_gp_counter(struct kvm_pmc *pmc, u64 eventsel)if (!allow_event)return ; - event_select = eventsel &ARCH_PERFMON_EVENTSEL_EVENT ; - unit_mask = (eventsel &ARCH_PERFMON_EVENTSEL_UMASK ) >>8 ; -if (!(eventsel & (ARCH_PERFMON_EVENTSEL_EDGE |ARCH_PERFMON_EVENTSEL_INV |ARCH_PERFMON_EVENTSEL_CMASK |HSW_IN_TX |HSW_IN_TX_CHECKPOINTED ))) { - config = kvm_x86_ops.pmu_ops->find_arch_event (pmc_to_pmu (pmc), - event_select, - unit_mask); + config = kvm_x86_ops.pmu_ops->pmc_perf_hw_id (pmc);if (config !=PERF_COUNT_HW_MAX ) type =PERF_TYPE_HARDWARE ; }
arch/x86/kvm/pmu.h +1 -2
@@ -24,8 +24,7 @@ struct kvm_event_hw_type_mapping { };struct kvm_pmu_ops { -unsigned (*find_arch_event)(struct kvm_pmu *pmu,u8 event_select, -u8 unit_mask); +unsigned int (*pmc_perf_hw_id)(struct kvm_pmc *pmc);unsigned (*find_fixed_event)(int idx);bool (*pmc_is_enabled)(struct kvm_pmc *pmc);struct kvm_pmc *(*pmc_idx_to_pmc)(struct kvm_pmu *pmu,int pmc_idx);
arch/x86/kvm/svm/pmu.c +4 -4
@@ -126,10 +126,10 @@ static inline struct kvm_pmc *get_gp_pmc_amd(struct kvm_pmu *pmu, u32 msr,return &pmu->gp_counters[msr_to_index (msr)]; } -static unsigned amd_find_arch_event (struct kvm_pmu *pmu, -u8 event_select, -u8 unit_mask) +static unsigned int amd_pmc_perf_hw_id (struct kvm_pmc *pmc) { +u8 event_select = pmc->eventsel &ARCH_PERFMON_EVENTSEL_EVENT ; +u8 unit_mask = (pmc->eventsel &ARCH_PERFMON_EVENTSEL_UMASK ) >>8 ;int i;for (i =0 ; i <ARRAY_SIZE (amd_event_mapping); i++)
@@ -312,7 +312,7 @@ static void amd_pmu_reset(struct kvm_vcpu *vcpu) }struct kvm_pmu_ops amd_pmu_ops = { - .find_arch_event = amd_find_arch_event, + .pmc_perf_hw_id = amd_pmc_perf_hw_id, .find_fixed_event = amd_find_fixed_event, .pmc_is_enabled = amd_pmc_is_enabled, .pmc_idx_to_pmc = amd_pmc_idx_to_pmc,
arch/x86/kvm/vmx/pmu_intel.c +5 -4
@@ -68,10 +68,11 @@ static void global_ctrl_changed(struct kvm_pmu *pmu, u64 data)reprogram_counter (pmu, bit); } -static unsigned intel_find_arch_event (struct kvm_pmu *pmu, -u8 event_select, -u8 unit_mask) +static unsigned int intel_pmc_perf_hw_id (struct kvm_pmc *pmc) { +struct kvm_pmu *pmu =pmc_to_pmu (pmc); +u8 event_select = pmc->eventsel &ARCH_PERFMON_EVENTSEL_EVENT ; +u8 unit_mask = (pmc->eventsel &ARCH_PERFMON_EVENTSEL_UMASK ) >>8 ;int i;for (i =0 ; i <ARRAY_SIZE (intel_arch_events); i++)
@@ -432,7 +433,7 @@ static void intel_pmu_reset(struct kvm_vcpu *vcpu) }struct kvm_pmu_ops intel_pmu_ops = { - .find_arch_event = intel_find_arch_event, + .pmc_perf_hw_id = intel_pmc_perf_hw_id, .find_fixed_event = intel_find_fixed_event, .pmc_is_enabled = intel_pmc_is_enabled, .pmc_idx_to_pmc = intel_pmc_idx_to_pmc,
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 89/121 KVM: x86/pmu: Dont truncate the PerfEvtSeln MSR when creating a perf event
In reply to Greg Kroah-HartmanFrom: Jim Mattson <[email protected]>
[ Upstream commit b8bfee85f1307426e0242d654f3a14c06ef639c5 ]
AMD's event select is 3 nybbles, with the high nybble in bits 35:32 of a PerfEvtSeln MSR. Don't drop the high nybble when setting up the config field of a perf_event_attr structure for a call to perf_event_create_kernel_counter().
Message-Id: <[email protected]>
--- arch/x86/kvm/pmu.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/x86/kvm/pmu.c +3 -2
@@ -95,7 +95,7 @@ static void kvm_perf_overflow_intr(struct perf_event *perf_event, }static void pmc_reprogram_counter (struct kvm_pmc *pmc,u32 type, -unsigned config,bool exclude_user, +u64 config,bool exclude_user,bool exclude_kernel,bool intr,bool in_tx,bool in_tx_cp) {
@@ -170,7 +170,8 @@ static bool pmc_resume_counter(struct kvm_pmc *pmc)void reprogram_gp_counter (struct kvm_pmc *pmc,u64 eventsel) { -unsigned config, type =PERF_TYPE_RAW ; +u64 config; +u32 type =PERF_TYPE_RAW ;struct kvm *kvm = pmc->vcpu->kvm;struct kvm_pmu_event_filter *filter;int i;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 90/121 KVM: x86/pmu: Use AMD64_RAW_EVENT_MASK for PERF_TYPE_RAW
In reply to Greg Kroah-HartmanFrom: Jim Mattson <[email protected]>
[ Upstream commit 710c476514313c74045c41c0571bb5178fd16e3d ]
AMD's event select is 3 nybbles, with the high nybble in bits 35:32 of a PerfEvtSeln MSR. Don't mask off the high nybble when configuring a RAW perf event.
Message-Id: <[email protected]>
--- arch/x86/kvm/pmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kvm/pmu.c +1 -1
@@ -214,7 +214,7 @@ void reprogram_gp_counter(struct kvm_pmc *pmc, u64 eventsel) }if (type ==PERF_TYPE_RAW ) - config = eventsel &X86_RAW_EVENT_MASK ; + config = eventsel &AMD64_RAW_EVENT_MASK ;if (pmc->current_config == eventsel &&pmc_resume_counter (pmc))return ;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 91/121 NFS: Dont set NFS_INO_INVALID_XATTR if there is no xattr cache
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
[ Upstream commit 848fdd62399c638e65a1512616acaa5de7d5c5e8 ]
--- fs/nfs/inode.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
fs/nfs/inode.c +14 -0
@@ -195,6 +195,18 @@ bool nfs_check_cache_invalid(struct inode *inode, unsigned long flags) }EXPORT_SYMBOL_GPL (nfs_check_cache_invalid); +#ifdef CONFIG_NFS_V4_2 +static bool nfs_has_xattr_cache (const struct nfs_inode *nfsi) +{ +return nfsi->xattr_cache !=NULL ; +} +#else +static bool nfs_has_xattr_cache (const struct nfs_inode *nfsi) +{ +return false; +} +#endif +static void nfs_set_cache_invalid (struct inode *inode,unsigned long flags) {struct nfs_inode *nfsi =NFS_I (inode);
@@ -210,6 +222,8 @@ static void nfs_set_cache_invalid(struct inode *inode, unsigned long flags) }else if (flags &NFS_INO_REVAL_PAGECACHE ) flags |=NFS_INO_INVALID_CHANGE |NFS_INO_INVALID_SIZE ; +if (!nfs_has_xattr_cache (nfsi)) + flags &= ~NFS_INO_INVALID_XATTR ;if (inode->i_mapping->nrpages ==0 ) flags &= ~(NFS_INO_INVALID_DATA |NFS_INO_DATA_INVAL_DEFER ); nfsi->cache_validity |= flags;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 92/121 ARM: OMAP2+: hwmod: Add of_node_put() before break
In reply to Greg Kroah-HartmanFrom: Wan Jiabing <[email protected]>
[ Upstream commit 80c469a0a03763f814715f3d12b6f3964c7423e8 ]
Fix following coccicheck warning:
./arch/arm/mach-omap2/omap_hwmod.c:753:1-23: WARNING: Function for_each_matching_node should have of_node_put() before break
Early exits from for_each_matching_node should decrement the node reference counter.
--- arch/arm/mach-omap2/omap_hwmod.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/arm/mach-omap2/omap_hwmod.c +3 -1
@@ -749,8 +749,10 @@ static int __init _init_clkctrl_providers(void)for_each_matching_node (np, ti_clkctrl_match_table) { ret =_setup_clkctrl_provider (np); -if (ret) +if (ret) { +of_node_put (np);break ; + } }return ret;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 93/121 ARM: OMAP2+: adjust the location of put_device() call in omapdss_init_of
In reply to Greg Kroah-HartmanFrom: Ye Guojin <[email protected]>
[ Upstream commit 34596ba380b03d181e24efd50e2f21045bde3696 ]
This was found by coccicheck:./arch/arm/mach-omap2/display.c, 272, 1-7, ERROR missing put_device; call of_find_device_by_node on line 258, but without a corresponding object release within this function.
Move the put_device() call before the if judgment.
--- arch/arm/mach-omap2/display.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/mach-omap2/display.c +1 -1
@@ -263,9 +263,9 @@ static int __init omapdss_init_of(void) } r =of_platform_populate (node,NULL ,NULL , &pdev->dev); +put_device (&pdev->dev);if (r) {pr_err ("Unable to populate DSS submodule devices\n" ); -put_device (&pdev->dev);return r; }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 94/121 phy: usb: Leave some clocks running during suspend
In reply to Greg Kroah-HartmanFrom: Al Cooper <[email protected]>
[ Upstream commit 42fed57046fc74586d7058bd51a1c10ac9c690cb ]
The PHY client driver does a phy_exit() call on suspend or rmmod and the PHY driver needs to know the difference because some clocks need to be kept running for suspend but can be shutdown on unbind/rmmod (or if there are no PHY clients at all).
The fix is to use a PM notifier so the driver can tell if a PHY client is calling exit() because of a system suspend or a driver unbind/rmmod.
--- drivers/phy/broadcom/phy-brcm-usb.c | 38 +++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+)
drivers/phy/broadcom/phy-brcm-usb.c +38 -0
@@ -17,6 +17,7 @@#include <linux/soc/brcmstb/brcmstb.h> #include <dt-bindings/phy/phy.h> #include <linux/mfd/syscon.h> +#include <linux/suspend.h> #include "phy-brcm-usb-init.h"
@@ -69,12 +70,35 @@ struct brcm_usb_phy_data {int init_count;int wake_irq;struct brcm_usb_phy phys[BRCM_USB_PHY_ID_MAX ]; +struct notifier_block pm_notifier; +bool pm_active; };static s8 *node_reg_names[BRCM_REGS_MAX ] = {"crtl" ,"xhci_ec" ,"xhci_gbl" ,"usb_phy" ,"usb_mdio" ,"bdc_ec" }; +static int brcm_pm_notifier (struct notifier_block *notifier, +unsigned long pm_event, +void *unused) +{ +struct brcm_usb_phy_data *priv = + container_of(notifier, struct brcm_usb_phy_data, pm_notifier); + +switch (pm_event) { +case PM_HIBERNATION_PREPARE : +case PM_SUSPEND_PREPARE : + priv->pm_active = true; +break ; +case PM_POST_RESTORE : +case PM_POST_HIBERNATION : +case PM_POST_SUSPEND : + priv->pm_active = false; +break ; + } +return NOTIFY_DONE ; +} +static irqreturn_t brcm_usb_phy_wake_isr (int irq,void *dev_id) {struct phy *gphy = dev_id;
@@ -90,6 +114,9 @@ static int brcm_usb_phy_init(struct phy *gphy)struct brcm_usb_phy_data *priv = container_of(phy, struct brcm_usb_phy_data, phys[phy->id]); +if (priv->pm_active) +return 0 ; +/* * Use a lock to make sure a second caller waits until * the base phy is inited before using it.
@@ -119,6 +146,9 @@ static int brcm_usb_phy_exit(struct phy *gphy)struct brcm_usb_phy_data *priv = container_of(phy, struct brcm_usb_phy_data, phys[phy->id]); +if (priv->pm_active) +return 0 ; +dev_dbg (&gphy->dev,"EXIT\n" );if (phy->id ==BRCM_USB_PHY_2_0 )brcm_usb_uninit_eohci (&priv->ini);
@@ -484,6 +514,9 @@ static int brcm_usb_phy_probe(struct platform_device *pdev)if (err)return err; + priv->pm_notifier.notifier_call = brcm_pm_notifier; +register_pm_notifier (&priv->pm_notifier); +mutex_init (&priv->mutex);/* make sure invert settings are correct */
@@ -524,7 +557,10 @@ static int brcm_usb_phy_probe(struct platform_device *pdev)static int brcm_usb_phy_remove (struct platform_device *pdev) { +struct brcm_usb_phy_data *priv =dev_get_drvdata (&pdev->dev); +sysfs_remove_group (&pdev->dev.kobj, &brcm_usb_phy_group); +unregister_pm_notifier (&priv->pm_notifier);return 0 ; }
@@ -535,6 +571,7 @@ static int brcm_usb_phy_suspend(struct device *dev)struct brcm_usb_phy_data *priv =dev_get_drvdata (dev);if (priv->init_count) { +dev_dbg (dev,"SUSPEND\n" ); priv->ini.wake_enabled =device_may_wakeup (dev);if (priv->phys[BRCM_USB_PHY_3_0 ].inited)brcm_usb_uninit_xhci (&priv->ini);
@@ -574,6 +611,7 @@ static int brcm_usb_phy_resume(struct device *dev)* Uninitialize anything that wasn't previously initialized. */ if (priv->init_count) { +dev_dbg (dev,"RESUME\n" );if (priv->wake_irq >=0 )disable_irq_wake (priv->wake_irq);brcm_usb_init_common (&priv->ini);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 95/121 irqchip/sifive-plic: Add missing thead,c900-plic match string
In reply to Greg Kroah-HartmanFrom: Guo Ren <[email protected]>
[ Upstream commit 1d4df649cbb4b26d19bea38ecff4b65b10a1bbca ]
The thead,c900-plic has been used in opensbi to distinguish PLIC [1]. Although PLICs have the same behaviors in Linux, they are different hardware with some custom initializing in firmware(opensbi).
Qute opensbi patch commit-msg by Samuel:
The T-HEAD PLIC implementation requires setting a delegation bit to allow access from S-mode. Now that the T-HEAD PLIC has its own compatible string, set this bit automatically from the PLIC driver, instead of reaching into the PLIC's MMIO space from another driver.
[1]: https://github.com/riscv-software-src/opensbi/commit/78c2b19218bd62653b9fb31623a42ced45f38ea6
--- drivers/irqchip/irq-sifive-plic.c | 1 + 1 file changed, 1 insertion(+)
drivers/irqchip/irq-sifive-plic.c +1 -0
@@ -400,3 +400,4 @@ static int __init plic_init(struct device_node *node,IRQCHIP_DECLARE (sifive_plic,"sifive,plic-1.0.0" , plic_init);IRQCHIP_DECLARE (riscv_plic0,"riscv,plic0" , plic_init);/* for legacy systems */ +IRQCHIP_DECLARE (thead_c900_plic,"thead,c900-plic" , plic_init);/* for firmware driver */
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 96/121 netfilter: conntrack: dont refresh sctp entries in closed state
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ Upstream commit 77b337196a9d87f3d6bb9b07c0436ecafbffda1e ]
Vivek Thrivikraman reported:
An SCTP server application which is accessed continuously by client application.
When the session disconnects the client retries to establish a connection. After restart of SCTP server application the session is not established because of stale conntrack entry with connection state CLOSED as below.
(removing this entry manually established new connection):
sctp 9 CLOSED src=10.141.189.233 [..] [ASSURED]
Just skip timeout update of closed entries, we don't want them to stay around forever.
--- net/netfilter/nf_conntrack_proto_sctp.c | 9 +++++++++ 1 file changed, 9 insertions(+)
net/netfilter/nf_conntrack_proto_sctp.c +9 -0
@@ -489,6 +489,15 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct,pr_debug ("Setting vtag %x for dir %d\n" , ih->init_tag, !dir); ct->proto.sctp.vtag[!dir] = ih->init_tag; + +/* don't renew timeout on init retransmit so +* port reuse by client or NAT middlebox cannot +* keep entry alive indefinitely (incl. nat info). +*/ +if (new_state ==SCTP_CONNTRACK_CLOSED && + old_state ==SCTP_CONNTRACK_CLOSED && +nf_ct_is_confirmed (ct)) + ignore = true; } ct->proto.sctp.state = new_state;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 97/121 arm64: dts: meson-gx: add ATF BL32 reserved-memory region
In reply to Greg Kroah-HartmanFrom: Christian Hewitt <[email protected]>
[ Upstream commit 76577c9137456febb05b0e17d244113196a98968 ]
Add an additional reserved memory region for the BL32 trusted firmware present in many devices that boot from Amlogic vendor u-boot.
--- arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 6 ++++++ 1 file changed, 6 insertions(+)
arch/arm64/boot/dts/amlogic/meson-gx.dtsi +6 -0
@@ -43,6 +43,12 @@ no-map; }; + /* 32 MiB reserved for ARM Trusted Firmware (BL32) */ + secmon_reserved_bl32: secmon@5300000 { + reg = <0x0 0x05300000 0x0 0x2000000>; + no-map; + }; + linux,cma { compatible = "shared-dma-pool"; reusable;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 98/121 arm64: dts: meson-g12: add ATF BL32 reserved-memory region
In reply to Greg Kroah-HartmanFrom: Christian Hewitt <[email protected]>
[ Upstream commit 08982a1b3aa2611c9c711d24825c9002d28536f4 ]
Add an additional reserved memory region for the BL32 trusted firmware present in many devices that boot from Amlogic vendor u-boot.
--- arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 6 ++++++ 1 file changed, 6 insertions(+)
arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi +6 -0
@@ -101,6 +101,12 @@ no-map; }; + /* 32 MiB reserved for ARM Trusted Firmware (BL32) */ + secmon_reserved_bl32: secmon@5300000 { + reg = <0x0 0x05300000 0x0 0x2000000>; + no-map; + }; + linux,cma { compatible = "shared-dma-pool"; reusable;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 99/121 arm64: dts: meson-g12: drop BL32 region from SEI510/SEI610
In reply to Greg Kroah-HartmanFrom: Christian Hewitt <[email protected]>
[ Upstream commit f26573e2bc9dfd551a0d5c6971f18cc546543312 ]
The BL32/TEE reserved-memory region is now inherited from the common family dtsi (meson-g12-common) so we can drop it from board files.
--- arch/arm64/boot/dts/amlogic/meson-g12a-sei510.dts | 8 -------- arch/arm64/boot/dts/amlogic/meson-sm1-sei610.dts | 8 -------- 2 files changed, 16 deletions(-)
arch/arm64/boot/dts/amlogic/meson-g12a-sei510.dts +0 -8
@@ -157,14 +157,6 @@ regulator-always-on; }; - reserved-memory { - /* TEE Reserved Memory */ - bl32_reserved: bl32@5000000 { - reg = <0x0 0x05300000 0x0 0x2000000>; - no-map; - }; - }; - sdio_pwrseq: sdio-pwrseq { compatible = "mmc-pwrseq-simple"; reset-gpios = <&gpio GPIOX_6 GPIO_ACTIVE_LOW>;
arch/arm64/boot/dts/amlogic/meson-sm1-sei610.dts +0 -8
@@ -203,14 +203,6 @@ regulator-always-on; }; - reserved-memory { - /* TEE Reserved Memory */ - bl32_reserved: bl32@5000000 { - reg = <0x0 0x05300000 0x0 0x2000000>; - no-map; - }; - }; - sdio_pwrseq: sdio-pwrseq { compatible = "mmc-pwrseq-simple"; reset-gpios = <&gpio GPIOX_6 GPIO_ACTIVE_LOW>;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 100/121 pidfd: fix test failure due to stack overflow on some arches
In reply to Greg Kroah-HartmanFrom: Axel Rasmussen <[email protected]>
[ Upstream commit 4cbd93c3c110447adc66cb67c08af21f939ae2d7 ]
When running the pidfd_fdinfo_test on arm64, it fails for me. After some digging, the reason is that the child exits due to SIGBUS, because it overflows the 1024 byte stack we've reserved for it.
To fix the issue, increase the stack size to 8192 bytes (this number is somewhat arbitrary, and was arrived at through experimentation -- I kept doubling until the failure no longer occurred).
Also, let's make the issue easier to debug. wait_for_pid() returns an ambiguous value: it may return -1 in all of these cases:
1. waitpid() itself returned -1
2. waitpid() returned success, but we found !WIFEXITED(status).
3. The child process exited, but it did so with a -1 exit code.
There's no way for the caller to tell the difference. So, at least log which occurred, so the test runner can debug things.
While debugging this, I found that we had !WIFEXITED(), because the child exited due to a signal. This seems like a reasonably common case, so also print out whether or not we have WIFSIGNALED(), and the associated WTERMSIG() (if any). This lets us see the SIGBUS I'm fixing clearly when it occurs.
Finally, I'm suspicious of allocating the child's stack on our stack. man clone(2) suggests that the correct way to do this is with mmap(), and in particular by setting MAP_STACK. So, switch to doing it that way instead.
--- tools/testing/selftests/pidfd/pidfd.h | 13 ++++++++--- .../selftests/pidfd/pidfd_fdinfo_test.c | 22 +++++++++++++++---- 2 files changed, 28 insertions(+), 7 deletions(-)
tools/testing/selftests/pidfd/pidfd.h +10 -3
@@ -68,7 +68,7 @@#define PIDFD_SKIP 3#define PIDFD_XFAIL 4 -int wait_for_pid (pid_t pid) +static inline int wait_for_pid (pid_t pid) {int status, ret;
@@ -78,13 +78,20 @@ int wait_for_pid(pid_t pid)if (errno ==EINTR ) goto again; +ksft_print_msg ("waitpid returned -1, errno=%d\n" , errno);return -1 ; } -if (!WIFEXITED (status)) +if (!WIFEXITED (status)) { +ksft_print_msg ( +"waitpid !WIFEXITED, WIFSIGNALED=%d, WTERMSIG=%d\n" , +WIFSIGNALED (status),WTERMSIG (status));return -1 ; + } -return WEXITSTATUS (status); + ret =WEXITSTATUS (status); +ksft_print_msg ("waitpid WEXITSTATUS=%d\n" , ret); +return ret; }static inline int sys_pidfd_open (pid_t pid,unsigned int flags)
tools/testing/selftests/pidfd/pidfd_fdinfo_test.c +18 -4
@@ -12,6 +12,7 @@#include <string.h> #include <syscall.h> #include <sys/wait.h> +#include <sys/mman.h> #include "pidfd.h" #include "../kselftest.h"
@@ -80,7 +81,10 @@ static inline int error_check(struct error *err, const char *test_name)return err->code; } +#define CHILD_STACK_SIZE 8192 +struct child { +char *stack;pid_t pid;int fd; };
@@ -89,17 +93,22 @@ static struct child clone_newns(int (*fn)(void *), void *args, struct error *err) {static int flags =CLONE_PIDFD |CLONE_NEWPID |CLONE_NEWNS |SIGCHLD ; -size_t stack_size =1024 ; -char *stack[1024 ] = {0 };struct child ret;if (!(flags &CLONE_NEWUSER ) &&geteuid () !=0 ) flags |=CLONE_NEWUSER ; + ret.stack =mmap (NULL ,CHILD_STACK_SIZE ,PROT_READ |PROT_WRITE , +MAP_PRIVATE |MAP_ANONYMOUS |MAP_STACK ,-1 ,0 ); +if (ret.stack ==MAP_FAILED ) { +error_set (err,-1 ,"mmap of stack failed (errno %d)" , errno); +return ret; + } +#ifdef __ia64__ - ret.pid =__clone2 (fn, stack, stack_size, flags, args, &ret.fd); + ret.pid =__clone2 (fn, ret.stack,CHILD_STACK_SIZE , flags, args, &ret.fd);#else - ret.pid =clone (fn, stack + stack_size, flags, args, &ret.fd); + ret.pid =clone (fn, ret.stack +CHILD_STACK_SIZE , flags, args, &ret.fd);#endif if (ret.pid <0 ) {
@@ -129,6 +138,11 @@ static inline int child_join(struct child *child, struct error *err)else if (r >0 )error_set (err, r,"child %d reported: %d" , child->pid, r); +if (munmap (child->stack,CHILD_STACK_SIZE )) { +error_set (err,-1 ,"munmap of child stack failed (errno %d)" , errno); + r =-1 ; + } +return r; }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 101/121 selftests: fixup build warnings in pidfd / clone3 tests
In reply to Greg Kroah-HartmanFrom: Axel Rasmussen <[email protected]>
[ Upstream commit e2aa5e650b07693477dff554053605976789fd68 ]
These are some trivial fixups, which were needed to build the tests with clang and -Werror. The following issues are fixed:
- Remove various unused variables.
- In child_poll_leader_exit_test, clang isn't smart enough to realize syscall(SYS_exit, 0) won't return, so it complains we never return from a non-void function. Add an extra exit(0) to appease it.
- In test_pidfd_poll_leader_exit, ret may be branched on despite being uninitialized, if we have !use_waitpid. Initialize it to zero to get the right behavior in that case.
--- tools/testing/selftests/clone3/clone3.c | 2 -- tools/testing/selftests/pidfd/pidfd_test.c | 6 +++--- tools/testing/selftests/pidfd/pidfd_wait.c | 5 ++--- 3 files changed, 5 insertions(+), 8 deletions(-)
tools/testing/selftests/clone3/clone3.c +0 -2
@@ -126,8 +126,6 @@ static void test_clone3(uint64_t flags, size_t size, int expected,int main (int argc,char *argv[]) { -pid_t pid; -uid_t uid =getuid ();ksft_print_header ();
tools/testing/selftests/pidfd/pidfd_test.c +3 -3
@@ -441,7 +441,6 @@ static void test_pidfd_poll_exec(int use_waitpid) {int pid, pidfd =0 ;int status, ret; -pthread_t t1;time_t prog_start =time (NULL );const char *test_name ="pidfd_poll check for premature notification on child thread exec" ;
@@ -500,13 +499,14 @@ static int child_poll_leader_exit_test(void *args)*/ *child_exit_secs =time (NULL );syscall (SYS_exit,0 ); +/* Never reached, but appeases compiler thinking we should return. */ +exit (0 ); }static void test_pidfd_poll_leader_exit (int use_waitpid) {int pid, pidfd =0 ; -int status, ret; -time_t prog_start =time (NULL ); +int status, ret =0 ;const char *test_name ="pidfd_poll check for premature notification on non-empty" "group leader exit" ;
tools/testing/selftests/pidfd/pidfd_wait.c +2 -3
@@ -39,7 +39,7 @@ static int sys_waitid(int which, pid_t pid, siginfo_t *info, int options,TEST (wait_simple) { -int pidfd =-1 , status =0 ; +int pidfd =-1 ;pid_t parent_tid =-1 ;struct clone_args args = { .parent_tid =ptr_to_u64 (&parent_tid),
@@ -47,7 +47,6 @@ TEST(wait_simple) .flags = CLONE_PIDFD | CLONE_PARENT_SETTID, .exit_signal = SIGCHLD, }; -int ret;pid_t pid;siginfo_t info = { .si_signo =0 ,
@@ -88,7 +87,7 @@ TEST(wait_simple)TEST (wait_states) { -int pidfd =-1 , status =0 ; +int pidfd =-1 ;pid_t parent_tid =-1 ;struct clone_args args = { .parent_tid =ptr_to_u64 (&parent_tid),
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 102/121 kconfig: let shell return enough output for deep path names
In reply to Greg Kroah-HartmanFrom: Brenda Streiff <[email protected]>
[ Upstream commit 8a4c5b2a6d8ea079fa36034e8167de87ab6f8880 ]
The 'shell' built-in only returns the first 256 bytes of the command's output. In some cases, 'shell' is used to return a path; by bumping up the buffer size to 4096 this lets us capture up to PATH_MAX.
The specific case where I ran into this was due to commit 1e860048c53e ("gcc-plugins: simplify GCC plugin-dev capability test"). After this change, we now use $(shell,$(CC) -print-file-name=plugin) to return a path; if the gcc path is particularly long, then the path ends up truncated at the 256 byte mark, which makes the HAVE_GCC_PLUGINS depends test always fail.
--- scripts/kconfig/preprocess.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/kconfig/preprocess.c +1 -1
@@ -141,7 +141,7 @@ static char *do_lineno(int argc, char *argv[])static char *do_shell (int argc,char *argv[]) {FILE *p; -char buf[256 ]; +char buf[4096 ];char *cmd;size_t nread;int i;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 103/121 ata: libata-core: Disable TRIM on M88V29
In reply to Greg Kroah-HartmanFrom: Zoltán Böszörményi <[email protected]>
[ Upstream commit c8ea23d5fa59f28302d4e3370c75d9c308e64410 ]
This device is a CF card, or possibly an SSD in CF form factor. It supports NCQ and high speed DMA.
While it also advertises TRIM support, I/O errors are reported when the discard mount option fstrim is used. TRIM also fails when disabling NCQ and not just as an NCQ command.
TRIM must be disabled for this device.
--- drivers/ata/libata-core.c | 1 + 1 file changed, 1 insertion(+)
drivers/ata/libata-core.c +1 -0
@@ -3989,6 +3989,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {/* devices that don't properly handle TRIM commands */ { "SuperSSpeed S238*", NULL, ATA_HORKAGE_NOTRIM, }, + { "M88V29*", NULL, ATA_HORKAGE_NOTRIM, },/* * As defined, the DRAT (Deterministic Read After Trim) and RZAT
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 104/121 soc: aspeed: lpc-ctrl: Block error printing on probe defer cases
In reply to Greg Kroah-HartmanFrom: Jae Hyun Yoo <[email protected]>
[ Upstream commit 301a5d3ad2432d7829f59432ca0a93a6defbb9a1 ]
Add a checking code when it gets -EPROBE_DEFER while getting a clock resource. In this case, it doesn't need to print out an error message because the probing will be re-visited.
--- drivers/soc/aspeed/aspeed-lpc-ctrl.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/soc/aspeed/aspeed-lpc-ctrl.c +3 -4
@@ -251,10 +251,9 @@ static int aspeed_lpc_ctrl_probe(struct platform_device *pdev) } lpc_ctrl->clk =devm_clk_get (dev,NULL ); -if (IS_ERR (lpc_ctrl->clk)) { -dev_err (dev,"couldn't get clock\n" ); -return PTR_ERR (lpc_ctrl->clk); - } +if (IS_ERR (lpc_ctrl->clk)) +return dev_err_probe (dev,PTR_ERR (lpc_ctrl->clk), +"couldn't get clock\n" ); rc =clk_prepare_enable (lpc_ctrl->clk);if (rc) {dev_err (dev,"couldn't enable clock\n" );
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 105/121 xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create
In reply to Greg Kroah-HartmanFrom: Dan Aloni <[email protected]>
[ Upstream commit a9c10b5b3b67b3750a10c8b089b2e05f5e176e33 ]
If there are failures then we must not leave the non-NULL pointers with the error value, otherwise rpcrdma_ep_destroy gets confused and tries free them, resulting in an Oops.
--- net/sunrpc/xprtrdma/verbs.c | 3 +++ 1 file changed, 3 insertions(+)
net/sunrpc/xprtrdma/verbs.c +3 -0
@@ -449,6 +449,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt) IB_POLL_WORKQUEUE);if (IS_ERR (ep->re_attr.send_cq)) { rc =PTR_ERR (ep->re_attr.send_cq); + ep->re_attr.send_cq =NULL ; goto out_destroy; }
@@ -457,6 +458,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt) IB_POLL_WORKQUEUE);if (IS_ERR (ep->re_attr.recv_cq)) { rc =PTR_ERR (ep->re_attr.recv_cq); + ep->re_attr.recv_cq =NULL ; goto out_destroy; } ep->re_receive_count =0 ;
@@ -495,6 +497,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt) ep->re_pd =ib_alloc_pd (device,0 );if (IS_ERR (ep->re_pd)) { rc =PTR_ERR (ep->re_pd); + ep->re_pd =NULL ; goto out_destroy; }
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 106/121 drm/rockchip: dw_hdmi: Do not leave clock enabled in error case
In reply to Greg Kroah-HartmanFrom: Sascha Hauer <[email protected]>
[ Upstream commit c0cfbb122275da1b726481de5a8cffeb24e6322b ]
The driver returns an error when devm_phy_optional_get() fails leaving the previously enabled clock turned on. Change order and enable the clock only after the phy has been acquired.
--- drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/gpu/drm/rockchip/dw_hdmi-rockchip.c +7 -7
@@ -529,13 +529,6 @@ static int dw_hdmi_rockchip_bind(struct device *dev, struct device *master,return ret; } - ret =clk_prepare_enable (hdmi->vpll_clk); -if (ret) { -DRM_DEV_ERROR (hdmi->dev,"Failed to enable HDMI vpll: %d\n" , - ret); -return ret; - } - hdmi->phy =devm_phy_optional_get (dev,"hdmi" );if (IS_ERR (hdmi->phy)) { ret =PTR_ERR (hdmi->phy);
@@ -544,6 +537,13 @@ static int dw_hdmi_rockchip_bind(struct device *dev, struct device *master,return ret; } + ret =clk_prepare_enable (hdmi->vpll_clk); +if (ret) { +DRM_DEV_ERROR (hdmi->dev,"Failed to enable HDMI vpll: %d\n" , + ret); +return ret; + } +drm_encoder_helper_add (encoder, &dw_hdmi_rockchip_encoder_helper_funcs);drm_simple_encoder_init (drm, encoder,DRM_MODE_ENCODER_TMDS );
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 107/121 tracing: Fix tp_printk option related with tp_printk_stop_on_boot
In reply to Greg Kroah-HartmanFrom: JaeSang Yoo <[email protected]>
[ Upstream commit 3203ce39ac0b2a57a84382ec184c7d4a0bede175 ]
The kernel parameter "tp_printk_stop_on_boot" starts with "tp_printk" which is the same as another kernel parameter "tp_printk". If "tp_printk" setup is called before the "tp_printk_stop_on_boot", it will override the latter and keep it from being set.
This is similar to other kernel parameter issues, such as:
Commit 745a600cf1a6 ("um: console: Ignore console= option")
or init/do_mounts.c:45 (setup function of "ro" kernel param)
Fix it by checking for a "_" right after the "tp_printk" and if that exists do not process the parameter.
--- kernel/trace/trace.c | 4 ++++ 1 file changed, 4 insertions(+)
kernel/trace/trace.c +4 -0
@@ -250,6 +250,10 @@ __setup("trace_clock=", set_trace_boot_clock);static int __init set_tracepoint_printk (char *str) { +/* Ignore the "tp_printk_stop_on_boot" param */ +if (*str =='_' ) +return 0 ; +if ((strcmp (str,"=0" ) !=0 &&strcmp (str,"=off" ) !=0 )) tracepoint_printk =1 ;return 1 ;
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 108/121 net: usb: qmi_wwan: Add support for Dell DW5829e
In reply to Greg Kroah-HartmanFrom: Slark Xiao <[email protected]>
[ Upstream commit 8ecbb179286cbc91810c16caeb3396e06305cd0c ]
Dell DW5829e same as DW5821e except the CAT level. DW5821e supports CAT16 but DW5829e supports CAT9. Also, DW5829e includes normal and eSIM type. Please see below test evidence:
T: Bus=04 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 5 Spd=5000 MxCh= 0 D: Ver= 3.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1 P: Vendor=413c ProdID=81e6 Rev=03.18 S: Manufacturer=Dell Inc. S: Product=DW5829e Snapdragon X20 LTE S: SerialNumber=0123456789ABCDEF C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA I: If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan I: If#=0x1 Alt= 0 #EPs= 1 Cls=03(HID ) Sub=00 Prot=00 Driver=usbhid I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
T: Bus=04 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 7 Spd=5000 MxCh= 0 D: Ver= 3.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 1 P: Vendor=413c ProdID=81e4 Rev=03.18 S: Manufacturer=Dell Inc. S: Product=DW5829e-eSIM Snapdragon X20 LTE S: SerialNumber=0123456789ABCDEF C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA I: If#=0x0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan I: If#=0x1 Alt= 0 #EPs= 1 Cls=03(HID ) Sub=00 Prot=00 Driver=usbhid I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
--- drivers/net/usb/qmi_wwan.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/usb/qmi_wwan.c +2 -0
@@ -1333,6 +1333,8 @@ static const struct usb_device_id products[] = { {QMI_FIXED_INTF(0x413c, 0x81d7, 0)}, /* Dell Wireless 5821e */ {QMI_FIXED_INTF(0x413c, 0x81d7, 1)}, /* Dell Wireless 5821e preproduction config */ {QMI_FIXED_INTF(0x413c, 0x81e0, 0)}, /* Dell Wireless 5821e with eSIM support*/ + {QMI_FIXED_INTF(0x413c, 0x81e4, 0)}, /* Dell Wireless 5829e with eSIM support*/ + {QMI_FIXED_INTF(0x413c, 0x81e6, 0)}, /* Dell Wireless 5829e */ {QMI_FIXED_INTF(0x03f0, 0x4e1d, 8)}, /* HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module */ {QMI_FIXED_INTF(0x03f0, 0x9d1d, 1)}, /* HP lt4120 Snapdragon X5 LTE */ {QMI_FIXED_INTF(0x22de, 0x9061, 3)}, /* WeTelecom WPD-600N */
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 109/121 net: macb: Align the dma and coherent dma masks
In reply to Greg Kroah-HartmanFrom: Marc St-Amand <[email protected]>
[ Upstream commit 37f7860602b5b2d99fc7465f6407f403f5941988 ]
Single page and coherent memory blocks can use different DMA masks when the macb accesses physical memory directly. The kernel is clever enough to allocate pages that fit into the requested address width.
When using the ARM SMMU, the DMA mask must be the same for single pages and big coherent memory blocks. Otherwise the translation tables turn into one big mess.
[ 74.959909] macb ff0e0000.ethernet eth0: DMA bus error: HRESP not OK [ 74.959989] arm-smmu fd800000.smmu: Unhandled context fault: fsr=0x402, iova=0x3165687460, fsynr=0x20001, cbfrsynra=0x877, cb=1 [ 75.173939] macb ff0e0000.ethernet eth0: DMA bus error: HRESP not OK [ 75.173955] arm-smmu fd800000.smmu: Unhandled context fault: fsr=0x402, iova=0x3165687460, fsynr=0x20001, cbfrsynra=0x877, cb=1
Since using the same DMA mask does not hurt direct 1:1 physical memory mappings, this commit always aligns DMA and coherent masks.
--- drivers/net/ethernet/cadence/macb_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/cadence/macb_main.c +1 -1
@@ -4534,7 +4534,7 @@ static int macb_probe(struct platform_device *pdev)#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT if (GEM_BFEXT (DAW64 ,gem_readl (bp,DCFG6 ))) { -dma_set_mask (&pdev->dev,DMA_BIT_MASK (44 )); +dma_set_mask_and_coherent (&pdev->dev,DMA_BIT_MASK (44 )); bp->hw_dma_cap |=HW_DMA_CAP_64B ; }#endif
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 110/121 kconfig: fix failing to generate auto.conf
In reply to Greg Kroah-HartmanFrom: Jing Leng <[email protected]>
[ Upstream commit 1b9e740a81f91ae338b29ed70455719804957b80 ]
When the KCONFIG_AUTOCONFIG is specified (e.g. export \
KCONFIG_AUTOCONFIG=output/config/auto.conf), the directory of include/config/ will not be created, so kconfig can't create deps files in it and auto.conf can't be generated.
--- scripts/kconfig/confdata.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
scripts/kconfig/confdata.c +9 -4
@@ -968,14 +968,19 @@ static int conf_write_dep(const char *name)static int conf_touch_deps (void ) { -const char *name; +const char *name, *tmp;struct symbol *sym;int res, i; -strcpy (depfile_path,"include/config/" ); - depfile_prefix_len =strlen (depfile_path); - name =conf_get_autoconfig_name (); + tmp =strrchr (name,'/' ); + depfile_prefix_len = tmp ? tmp - name +1 :0 ; +if (depfile_prefix_len +1 >sizeof (depfile_path)) +return -1 ; + +strncpy (depfile_path, name, depfile_prefix_len); + depfile_path[depfile_prefix_len] =0 ; +conf_read_simple (name,S_DEF_AUTO );sym_calc_value (modules_sym);
Signature · 1 line
2.34.1
Greg Kroah-Hartman
maintainerPATCH 111/121 scsi: lpfc: Fix pt2pt NVMe PRLI reject LOGO loop
In reply to Greg Kroah-HartmanFrom: James Smart <[email protected]>
commit 7f4c5a26f735dea4bbc0eb8eb9da99cda95a8563 upstream.
When connected point to point, the driver does not know the FC4's supported by the other end. In Fabrics, it can query the nameserver. Thus the driver must send PRLIs for the FC4s it supports and enable support based on the acc(ept) or rej(ect) of the respective FC4 PRLI. Currently the driver supports SCSI and NVMe PRLIs.
Unfortunately, although the behavior is per standard, many devices have come to expect only SCSI PRLIs. In this particular example, the NVMe PRLI is properly RJT'd but the target decided that it must LOGO after seeing the unexpected NVMe PRLI. The LOGO causes the sequence to restart and login is now in an infinite failure loop.
Fix the problem by having the driver, on a pt2pt link, remember NVMe PRLI accept or reject status across logout as long as the link stays "up". When retrying login, if the prior NVMe PRLI was rejected, it will not be sent on the next login.
--- drivers/scsi/lpfc/lpfc.h | 1 + drivers/scsi/lpfc/lpfc_attr.c | 3 +++ drivers/scsi/lpfc/lpfc_els.c | 20 +++++++++++++++++++- drivers/scsi/lpfc/lpfc_nportdisc.c | 5 +++-- 4 files changed, 26 insertions(+), 3 deletions(-)
drivers/scsi/lpfc/lpfc.h +1 -0
@@ -374,6 +374,7 @@ struct lpfc_vport {#define FC_VPORT_LOGO_RCVD 0x200/* LOGO received on vport */ #define FC_RSCN_DISCOVERY 0x400/* Auth all devices after RSCN */ #define FC_LOGO_RCVD_DID_CHNG 0x800/* FDISC on phys port detect DID chng*/ +#define FC_PT2PT_NO_NVME 0x1000/* Don't send NVME PRLI */ #define FC_SCSI_SCAN_TMO 0x4000/* scsi scan timer running */ #define FC_ABORT_DISCOVERY 0x8000/* we want to abort discovery */ #define FC_NDISC_ACTIVE 0x10000/* NPort discovery active */
drivers/scsi/lpfc/lpfc_attr.c +3 -0
@@ -1142,6 +1142,9 @@ lpfc_issue_lip(struct Scsi_Host *shost) pmboxq->u.mb.mbxCommand =MBX_DOWN_LINK ; pmboxq->u.mb.mbxOwner =OWN_HOST ; +if ((vport->fc_flag &FC_PT2PT ) && (vport->fc_flag &FC_PT2PT_NO_NVME )) + vport->fc_flag &= ~FC_PT2PT_NO_NVME ; + mbxstatus =lpfc_sli_issue_mbox_wait (phba, pmboxq,LPFC_MBOX_TMO *2 ); if ((mbxstatus == MBX_SUCCESS) &&
drivers/scsi/lpfc/lpfc_els.c +19 -1
@@ -1067,7 +1067,8 @@ stop_rr_fcf_flogi:/* FLOGI failed, so there is no fabric */ spin_lock_irq (shost->host_lock); - vport->fc_flag &= ~(FC_FABRIC |FC_PUBLIC_LOOP ); + vport->fc_flag &= ~(FC_FABRIC |FC_PUBLIC_LOOP | +FC_PT2PT_NO_NVME );spin_unlock_irq (shost->host_lock);/* If private loop, then allow max outstanding els to be
@@ -3945,6 +3946,23 @@ lpfc_els_retry(struct lpfc_hba *phba, st/* Added for Vendor specifc support * Just keep retrying for these Rsn / Exp codes */ +if ((vport->fc_flag &FC_PT2PT ) && + cmd ==ELS_CMD_NVMEPRLI ) { +switch (stat.un.b.lsRjtRsnCode) { +case LSRJT_UNABLE_TPC : +case LSRJT_INVALID_CMD : +case LSRJT_LOGICAL_ERR : +case LSRJT_CMD_UNSUPPORTED : +lpfc_printf_vlog (vport,KERN_WARNING ,LOG_ELS , +"0168 NVME PRLI LS_RJT " +"reason %x port doesn't " +"support NVME, disabling NVME\n" , + stat.un.b.lsRjtRsnCode); + retry =0 ; + vport->fc_flag |=FC_PT2PT_NO_NVME ; + goto out_retry; + } + }switch (stat.un.b.lsRjtRsnCode) {case LSRJT_UNABLE_TPC :/* The driver has a VALID PLOGI but the rport has
drivers/scsi/lpfc/lpfc_nportdisc.c +3 -2
@@ -2010,8 +2010,9 @@ lpfc_cmpl_reglogin_reglogin_issue(struct* is configured try it. */ ndlp->nlp_fc4_type |=NLP_FC4_FCP ; -if ((vport->cfg_enable_fc4_type ==LPFC_ENABLE_BOTH ) || - (vport->cfg_enable_fc4_type ==LPFC_ENABLE_NVME )) { +if ((!(vport->fc_flag &FC_PT2PT_NO_NVME )) && + (vport->cfg_enable_fc4_type ==LPFC_ENABLE_BOTH || + vport->cfg_enable_fc4_type ==LPFC_ENABLE_NVME )) { ndlp->nlp_fc4_type |=NLP_FC4_NVME ;/* We need to update the localport also */ lpfc_nvme_update_localport (vport);
Greg Kroah-Hartman
maintainerPATCH 112/121 EDAC: Fix calculation of returned address and next offset in edac_align_ptr()
In reply to Greg Kroah-HartmanFrom: Eliav Farber <[email protected]>
commit f8efca92ae509c25e0a4bd5d0a86decea4f0c41e upstream.
Do alignment logic properly and use the "ptr" local variable for calculating the remainder of the alignment.
This became an issue because struct edac_mc_layer has a size that is not zero modulo eight, and the next offset that was prepared for the private data was unaligned, causing an alignment exception.
The patch in Fixes: which broke this actually wanted to "what we actually care about is the alignment of the actual pointer that's about to be returned." But it didn't check that alignment.
Use the correct variable "ptr" for that.
[ bp: Massage commit message. ]
--- drivers/edac/edac_mc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/edac/edac_mc.c +1 -1
@@ -210,7 +210,7 @@ void *edac_align_ptr(void **p, unsignedelse return (char *)ptr; - r = (unsigned long )p % align; + r = (unsigned long )ptr % align;if (r ==0 )return (char *)ptr;
Greg Kroah-Hartman
maintainerPATCH 113/121 net: sched: limit TC_ACT_REPEAT loops
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit 5740d068909676d4bdb5c9c00c37a83df7728909 upstream.
We have been living dangerously, at the mercy of malicious users, abusing TC_ACT_REPEAT, as shown by this syzpot report [1].
Add an arbitrary limit (32) to the number of times an action can return TC_ACT_REPEAT.
v2: switch the limit to 32 instead of 10.
Use net_warn_ratelimited() instead of pr_err_once().
[1] (C repro available on demand)
rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 1-...!: (10500 ticks this GP) idle=021/1/0x4000000000000000 softirq=5592/5592 fqs=0
(t=10502 jiffies g=5305 q=190)
rcu: rcu_preempt kthread timer wakeup didn't happen for 10502 jiffies! g5305 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402
rcu: Possible timer handling issue on cpu=0 timer-softirq=3527
rcu: rcu_preempt kthread starved for 10505 jiffies! g5305 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:I stack:29344 pid: 14 ppid: 2 flags:0x00004000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:4986 [inline]
__schedule+0xab2/0x4db0 kernel/sched/core.c:6295
schedule+0xd2/0x260 kernel/sched/core.c:6368
schedule_timeout+0x14a/0x2a0 kernel/time/timer.c:1881
rcu_gp_fqs_loop+0x186/0x810 kernel/rcu/tree.c:1963
rcu_gp_kthread+0x1de/0x320 kernel/rcu/tree.c:2136
kthread+0x2e9/0x3a0 kernel/kthread.c:377
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 3646 Comm: syz-executor358 Not tainted 5.17.0-rc3-syzkaller-00149-gbf8e59fd315f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:rep_nop arch/x86/include/asm/vdso/processor.h:13 [inline]
RIP: 0010:cpu_relax arch/x86/include/asm/vdso/processor.h:18 [inline]
RIP: 0010:pv_wait_head_or_lock kernel/locking/qspinlock_paravirt.h:437 [inline]
RIP: 0010:__pv_queued_spin_lock_slowpath+0x3b8/0xb40 kernel/locking/qspinlock.c:508
Code: 48 89 eb c6 45 01 01 41 bc 00 80 00 00 48 c1 e9 03 83 e3 07 41 be 01 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8d 2c 01 eb 0c <f3> 90 41 83 ec 01 0f 84 72 04 00 00 41 0f b6 45 00 38 d8 7f 08 84
RSP: 0018:ffffc9000283f1b0 EFLAGS: 00000206
RAX: 0000000000000003 RBX: 0000000000000000 RCX: 1ffff1100fc0071e
RDX: 0000000000000001 RSI: 0000000000000201 RDI: 0000000000000000
RBP: ffff88807e0038f0 R08: 0000000000000001 R09: ffffffff8ffbf9ff
R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000004c1e
R13: ffffed100fc0071e R14: 0000000000000001 R15: ffff8880b9c3aa80
FS: 00005555562bf300(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffdbfef12b8 CR3: 00000000723c2000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:591 [inline]
queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:51 [inline]
queued_spin_lock include/asm-generic/qspinlock.h:85 [inline]
do_raw_spin_lock+0x200/0x2b0 kernel/locking/spinlock_debug.c:115
spin_lock_bh include/linux/spinlock.h:354 [inline]
sch_tree_lock include/net/sch_generic.h:610 [inline]
sch_tree_lock include/net/sch_generic.h:605 [inline]
prio_tune+0x3b9/0xb50 net/sched/sch_prio.c:211
prio_init+0x5c/0x80 net/sched/sch_prio.c:244
qdisc_create.constprop.0+0x44a/0x10f0 net/sched/sch_api.c:1253
tc_modify_qdisc+0x4c5/0x1980 net/sched/sch_api.c:1660
rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5594
netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494
netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
netlink_unicast+0x539/0x7e0 net/netlink/af_netlink.c:1343
netlink_sendmsg+0x904/0xe00 net/netlink/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:705 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:725
____sys_sendmsg+0x6e8/0x810 net/socket.c:2413
___sys_sendmsg+0xf3/0x170 net/socket.c:2467
__sys_sendmsg+0xe5/0x1b0 net/socket.c:2496
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f7ee98aae99
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffdbfef12d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007ffdbfef1300 RCX: 00007f7ee98aae99
RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000003
RBP: 0000000000000000 R08: 000000000000000d R09: 000000000000000d
R10: 000000000000000d R11: 0000000000000246 R12: 00007ffdbfef12f0
R13: 00000000000f4240 R14: 000000000004ca47 R15: 00007ffdbfef12e4
</TASK>
INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 2.293 msecs
NMI backtrace for cpu 1
CPU: 1 PID: 3260 Comm: kworker/1:3 Not tainted 5.17.0-rc3-syzkaller-00149-gbf8e59fd315f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: mld mld_ifc_work
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x1b3/0x230 lib/nmi_backtrace.c:62
trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
rcu_dump_cpu_stacks+0x25e/0x3f0 kernel/rcu/tree_stall.h:343
print_cpu_stall kernel/rcu/tree_stall.h:604 [inline]
check_cpu_stall kernel/rcu/tree_stall.h:688 [inline]
rcu_pending kernel/rcu/tree.c:3919 [inline]
rcu_sched_clock_irq.cold+0x5c/0x759 kernel/rcu/tree.c:2617
update_process_times+0x16d/0x200 kernel/time/timer.c:1785
tick_sched_handle+0x9b/0x180 kernel/time/tick-sched.c:226
tick_sched_timer+0x1b0/0x2d0 kernel/time/tick-sched.c:1428
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x1c0/0xe50 kernel/time/hrtimer.c:1749
hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline]
__sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1103
sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1097
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:__sanitizer_cov_trace_const_cmp4+0xc/0x70 kernel/kcov.c:286
Code: 00 00 00 48 89 7c 30 e8 48 89 4c 30 f0 4c 89 54 d8 20 48 89 10 5b c3 0f 1f 80 00 00 00 00 41 89 f8 bf 03 00 00 00 4c 8b 14 24 <89> f1 65 48 8b 34 25 00 70 02 00 e8 14 f9 ff ff 84 c0 74 4b 48 8b
RSP: 0018:ffffc90002c5eea8 EFLAGS: 00000246
RAX: 0000000000000007 RBX: ffff88801c625800 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: ffff8880137d3100 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff874fcd88 R11: 0000000000000000 R12: ffff88801d692dc0
R13: ffff8880137d3104 R14: 0000000000000000 R15: ffff88801d692de8
tcf_police_act+0x358/0x11d0 net/sched/act_police.c:256
tcf_action_exec net/sched/act_api.c:1049 [inline]
tcf_action_exec+0x1a6/0x530 net/sched/act_api.c:1026
tcf_exts_exec include/net/pkt_cls.h:326 [inline]
route4_classify+0xef0/0x1400 net/sched/cls_route.c:179
__tcf_classify net/sched/cls_api.c:1549 [inline]
tcf_classify+0x3e8/0x9d0 net/sched/cls_api.c:1615
prio_classify net/sched/sch_prio.c:42 [inline]
prio_enqueue+0x3a7/0x790 net/sched/sch_prio.c:75
dev_qdisc_enqueue+0x40/0x300 net/core/dev.c:3668
__dev_xmit_skb net/core/dev.c:3756 [inline]
__dev_queue_xmit+0x1f61/0x3660 net/core/dev.c:4081
neigh_hh_output include/net/neighbour.h:533 [inline]
neigh_output include/net/neighbour.h:547 [inline]
ip_finish_output2+0x14dc/0x2170 net/ipv4/ip_output.c:228
__ip_finish_output net/ipv4/ip_output.c:306 [inline]
__ip_finish_output+0x396/0x650 net/ipv4/ip_output.c:288
ip_finish_output+0x32/0x200 net/ipv4/ip_output.c:316
NF_HOOK_COND include/linux/netfilter.h:296 [inline]
ip_output+0x196/0x310 net/ipv4/ip_output.c:430
dst_output include/net/dst.h:451 [inline]
ip_local_out+0xaf/0x1a0 net/ipv4/ip_output.c:126
iptunnel_xmit+0x628/0xa50 net/ipv4/ip_tunnel_core.c:82
geneve_xmit_skb drivers/net/geneve.c:966 [inline]
geneve_xmit+0x10c8/0x3530 drivers/net/geneve.c:1077
__netdev_start_xmit include/linux/netdevice.h:4683 [inline]
netdev_start_xmit include/linux/netdevice.h:4697 [inline]
xmit_one net/core/dev.c:3473 [inline]
dev_hard_start_xmit+0x1eb/0x920 net/core/dev.c:3489
__dev_queue_xmit+0x2985/0x3660 net/core/dev.c:4116
neigh_hh_output include/net/neighbour.h:533 [inline]
neigh_output include/net/neighbour.h:547 [inline]
ip6_finish_output2+0xf7a/0x14f0 net/ipv6/ip6_output.c:126
__ip6_finish_output net/ipv6/ip6_output.c:191 [inline]
__ip6_finish_output+0x61e/0xe90 net/ipv6/ip6_output.c:170
ip6_finish_output+0x32/0x200 net/ipv6/ip6_output.c:201
NF_HOOK_COND include/linux/netfilter.h:296 [inline]
ip6_output+0x1e4/0x530 net/ipv6/ip6_output.c:224
dst_output include/net/dst.h:451 [inline]
NF_HOOK include/linux/netfilter.h:307 [inline]
NF_HOOK include/linux/netfilter.h:301 [inline]
mld_sendpack+0x9a3/0xe40 net/ipv6/mcast.c:1826
mld_send_cr net/ipv6/mcast.c:2127 [inline]
mld_ifc_work+0x71c/0xdc0 net/ipv6/mcast.c:2659
process_one_work+0x9ac/0x1650 kernel/workqueue.c:2307
worker_thread+0x657/0x1110 kernel/workqueue.c:2454
kthread+0x2e9/0x3a0 kernel/kthread.c:377
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
----------------
Code disassembly (best guess):
0: 48 89 eb mov %rbp,%rbx
3: c6 45 01 01 movb $0x1,0x1(%rbp)
7: 41 bc 00 80 00 00 mov $0x8000,%r12d
d: 48 c1 e9 03 shr $0x3,%rcx
11: 83 e3 07 and $0x7,%ebx
14: 41 be 01 00 00 00 mov $0x1,%r14d
1a: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
21: fc ff df
24: 4c 8d 2c 01 lea (%rcx,%rax,1),%r13
28: eb 0c jmp 0x36
* 2a: f3 90 pause <-- trapping instruction
2c: 41 83 ec 01 sub $0x1,%r12d
30: 0f 84 72 04 00 00 je 0x4a8
36: 41 0f b6 45 00 movzbl 0x0(%r13),%eax
3b: 38 d8 cmp %bl,%al
3d: 7f 08 jg 0x47
3f: 84 .byte 0x84--- net/sched/act_api.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
net/sched/act_api.c +11 -2
@@ -680,15 +680,24 @@ int tcf_action_exec(struct sk_buff *skb, restart_act_graph:for (i =0 ; i < nr_actions; i++) {const struct tc_action *a = actions[i]; +int repeat_ttl;if (jmp_prgcnt >0 ) { jmp_prgcnt -=1 ;continue ; } + + repeat_ttl =32 ; repeat: ret = a->ops->act (skb, a, res); -if (ret ==TC_ACT_REPEAT ) - goto repeat;/* we need a ttl - JHS */ + +if (unlikely (ret ==TC_ACT_REPEAT )) { +if (--repeat_ttl !=0 ) + goto repeat; +/* suspicious opcode, stop pipeline */ +net_warn_ratelimited ("TC_ACT_REPEAT abuse ?\n" ); +return TC_ACT_OK ; + }if (TC_ACT_EXT_CMP (ret,TC_ACT_JUMP )) { jmp_prgcnt = ret &TCA_ACT_MAX_PRIO_MASK ;
Greg Kroah-Hartman
maintainerPATCH 114/121 dmaengine: sh: rcar-dmac: Check for error num after setting mask
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
commit 2d21543efe332cd8c8f212fb7d365bc8b0690bfa upstream.
Because of the possible failure of the dma_supported(), the dma_set_mask_and_coherent() may return error num. Therefore, it should be better to check it and return the error if fails.
--- drivers/dma/sh/rcar-dmac.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/dma/sh/rcar-dmac.c +3 -1
@@ -1845,7 +1845,9 @@ static int rcar_dmac_probe(struct platfo dmac->dev = &pdev->dev;platform_set_drvdata (pdev, dmac);dma_set_max_seg_size (dmac->dev,RCAR_DMATCR_MASK ); -dma_set_mask_and_coherent (dmac->dev,DMA_BIT_MASK (40 )); + ret =dma_set_mask_and_coherent (dmac->dev,DMA_BIT_MASK (40 )); +if (ret) +return ret; ret =rcar_dmac_parse_of (&pdev->dev, dmac);if (ret <0 )
Greg Kroah-Hartman
maintainerPATCH 115/121 dmaengine: stm32-dmamux: Fix PM disable depth imbalance in stm32_dmamux_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
commit e831c7aba950f3ae94002b10321279654525e5ec upstream.
The pm_runtime_enable will increase power disable depth. If the probe fails, we should use pm_runtime_disable() to balance pm_runtime_enable().
--- drivers/dma/stm32-dmamux.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/dma/stm32-dmamux.c +3 -1
@@ -292,10 +292,12 @@ static int stm32_dmamux_probe(struct pla ret =of_dma_router_register (node, stm32_dmamux_route_allocate, &stm32_dmamux->dmarouter);if (ret) - goto err_clk; + goto pm_disable;return 0 ; +pm_disable: +pm_runtime_disable (&pdev->dev); err_clk:clk_disable_unprepare (stm32_dmamux->clk);
Greg Kroah-Hartman
maintainerPATCH 116/121 dmaengine: sh: rcar-dmac: Check for error num after dma_set_max_seg_size
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
commit da2ad87fba0891576aadda9161b8505fde81a84d upstream.
As the possible failure of the dma_set_max_seg_size(), it should be better to check the return value of the dma_set_max_seg_size().
--- drivers/dma/sh/rcar-dmac.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/dma/sh/rcar-dmac.c +4 -1
@@ -1844,7 +1844,10 @@ static int rcar_dmac_probe(struct platfo dmac->dev = &pdev->dev;platform_set_drvdata (pdev, dmac); -dma_set_max_seg_size (dmac->dev,RCAR_DMATCR_MASK ); + ret =dma_set_max_seg_size (dmac->dev,RCAR_DMATCR_MASK ); +if (ret) +return ret; + ret =dma_set_mask_and_coherent (dmac->dev,DMA_BIT_MASK (40 ));if (ret)return ret;
Greg Kroah-Hartman
maintainerPATCH 117/121 i2c: qcom-cci: dont delete an unregistered adapter
In reply to Greg Kroah-HartmanFrom: Vladimir Zapolskiy <[email protected]>
commit a0d48505a1d68e27220369e2dd1e3573a2f362d2 upstream.
If i2c_add_adapter() fails to add an I2C adapter found on QCOM CCI controller, on error path i2c_del_adapter() is still called.
Fortunately there is a sanity check in the I2C core, so the only visible implication is a printed debug level message:
i2c-core: attempting to delete unregistered adapter [Qualcomm-CCI]
Nevertheless it would be reasonable to correct the probe error path.
--- drivers/i2c/busses/i2c-qcom-cci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-qcom-cci.c +1 -1
@@ -655,7 +655,7 @@ static int cci_probe(struct platform_devreturn 0 ; error_i2c: -for (; i >=0 ; i--) { +for (--i ; i >=0 ; i--) {if (cci->master[i].cci)i2c_del_adapter (&cci->master[i].adap); }
Greg Kroah-Hartman
maintainerPATCH 118/121 i2c: qcom-cci: dont put a device tree node before i2c_add_adapter()
In reply to Greg Kroah-HartmanFrom: Vladimir Zapolskiy <[email protected]>
commit 02a4a69667a2ad32f3b52ca906f19628fbdd8a01 upstream.
There is a minor chance for a race, if a pointer to an i2c-bus subnode is stored and then reused after releasing its reference, and it would be sufficient to get one more reference under a loop over children subnodes.
--- drivers/i2c/busses/i2c-qcom-cci.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/i2c/busses/i2c-qcom-cci.c +10 -4
@@ -558,7 +558,7 @@ static int cci_probe(struct platform_dev cci->master[idx].adap.quirks = &cci->data->quirks; cci->master[idx].adap.algo = &cci_algo; cci->master[idx].adap.dev.parent = dev; - cci->master[idx].adap.dev.of_node = child; + cci->master[idx].adap.dev.of_node =of_node_get (child); cci->master[idx].master = idx; cci->master[idx].cci = cci;
@@ -643,8 +643,10 @@ static int cci_probe(struct platform_devcontinue ; ret =i2c_add_adapter (&cci->master[i].adap); -if (ret <0 ) +if (ret <0 ) { +of_node_put (cci->master[i].adap.dev.of_node); goto error_i2c; + } }pm_runtime_set_autosuspend_delay (dev,MSEC_PER_SEC );
@@ -656,8 +658,10 @@ static int cci_probe(struct platform_dev error_i2c:for (--i ; i >=0 ; i--) { -if (cci->master[i].cci) +if (cci->master[i].cci) {i2c_del_adapter (&cci->master[i].adap); +of_node_put (cci->master[i].adap.dev.of_node); + } } error:disable_irq (cci->irq);
@@ -673,8 +677,10 @@ static int cci_remove(struct platform_deint i;for (i =0 ; i < cci->data->num_masters; i++) { -if (cci->master[i].cci) +if (cci->master[i].cci) {i2c_del_adapter (&cci->master[i].adap); +of_node_put (cci->master[i].adap.dev.of_node); + }cci_halt (cci, i); }
Greg Kroah-Hartman
maintainerPATCH 119/121 copy_process(): Move fd_install() out of sighand->siglock critical section
In reply to Greg Kroah-HartmanFrom: Waiman Long <[email protected]>
commit ddc204b517e60ae64db34f9832dc41dafa77c751 upstream.
I was made aware of the following lockdep splat:
[ 2516.308763] =====================================================
[ 2516.309085] WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected
[ 2516.309433] 5.14.0-51.el9.aarch64+debug #1 Not tainted
[ 2516.309703] -----------------------------------------------------
[ 2516.310149] stress-ng/153663 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire:
[ 2516.310512] ffff0000e422b198 (&newf->file_lock){+.+.}-{2:2}, at: fd_install+0x368/0x4f0
[ 2516.310944]
and this task is already holding:
[ 2516.311248] ffff0000c08140d8 (&sighand->siglock){-.-.}-{2:2}, at: copy_process+0x1e2c/0x3e80
[ 2516.311804] which would create a new lock dependency:
[ 2516.312066] (&sighand->siglock){-.-.}-{2:2} -> (&newf->file_lock){+.+.}-{2:2}
[ 2516.312446]
but this new dependency connects a HARDIRQ-irq-safe lock:
[ 2516.312983] (&sighand->siglock){-.-.}-{2:2}
:
[ 2516.330700] Possible interrupt unsafe locking scenario:[ 2516.331075] CPU0 CPU1
[ 2516.331328] ---- ----
[ 2516.331580] lock(&newf->file_lock);
[ 2516.331790] local_irq_disable();
[ 2516.332231] lock(&sighand->siglock);
[ 2516.332579] lock(&newf->file_lock);
[ 2516.332922] <Interrupt>
[ 2516.333069] lock(&sighand->siglock);
[ 2516.333291]
*** DEADLOCK ***
[ 2516.389845]
stack backtrace:
[ 2516.390101] CPU: 3 PID: 153663 Comm: stress-ng Kdump: loaded Not tainted 5.14.0-51.el9.aarch64+debug #1
[ 2516.390756] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
[ 2516.391155] Call trace:
[ 2516.391302] dump_backtrace+0x0/0x3e0
[ 2516.391518] show_stack+0x24/0x30
[ 2516.391717] dump_stack_lvl+0x9c/0xd8
[ 2516.391938] dump_stack+0x1c/0x38
[ 2516.392247] print_bad_irq_dependency+0x620/0x710
[ 2516.392525] check_irq_usage+0x4fc/0x86c
[ 2516.392756] check_prev_add+0x180/0x1d90
[ 2516.392988] validate_chain+0x8e0/0xee0
[ 2516.393215] __lock_acquire+0x97c/0x1e40
[ 2516.393449] lock_acquire.part.0+0x240/0x570
[ 2516.393814] lock_acquire+0x90/0xb4
[ 2516.394021] _raw_spin_lock+0xe8/0x154
[ 2516.394244] fd_install+0x368/0x4f0
[ 2516.394451] copy_process+0x1f5c/0x3e80
[ 2516.394678] kernel_clone+0x134/0x660
[ 2516.394895] __do_sys_clone3+0x130/0x1f4
[ 2516.395128] __arm64_sys_clone3+0x5c/0x7c
[ 2516.395478] invoke_syscall.constprop.0+0x78/0x1f0
[ 2516.395762] el0_svc_common.constprop.0+0x22c/0x2c4
[ 2516.396050] do_el0_svc+0xb0/0x10c
[ 2516.396252] el0_svc+0x24/0x34
[ 2516.396436] el0t_64_sync_handler+0xa4/0x12c
[ 2516.396688] el0t_64_sync+0x198/0x19c
[ 2517.491197] NET: Registered PF_ATMPVC protocol family
[ 2517.491524] NET: Registered PF_ATMSVC protocol family
[ 2591.991877] sched: RT throttling activatedOne way to solve this problem is to move the fd_install() call out of the sighand->siglock critical section.
Before commit 6fd2fe494b17 ("copy_process(): don't use ksys_close() on cleanups"), the pidfd installation was done without holding both the task_list lock and the sighand->siglock. Obviously, holding these two locks are not really needed to protect the fd_install() call. So move the fd_install() call down to after the releases of both locks.
--- kernel/fork.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
kernel/fork.c +3 -4
@@ -2258,10 +2258,6 @@ static __latent_entropy struct task_stru goto bad_fork_cancel_cgroup; } -/* past the last point of failure */ -if (pidfile) -fd_install (pidfd, pidfile); -init_task_pid_links (p);if (likely (p->pid)) {ptrace_init_task (p, (clone_flags &CLONE_PTRACE ) || trace);
@@ -2310,6 +2306,9 @@ static __latent_entropy struct task_strusyscall_tracepoint_update (p);write_unlock_irq (&tasklist_lock); +if (pidfile) +fd_install (pidfd, pidfile); +proc_fork_connector (p);sched_post_fork (p, args);cgroup_post_fork (p, args);
Greg Kroah-Hartman
maintainerPATCH 120/121 i2c: brcmstb: fix support for DSL and CM variants
In reply to Greg Kroah-HartmanFrom: Rafał Miłecki <[email protected]>
commit 834cea3a252ed4847db076a769ad9efe06afe2d5 upstream.
DSL and CM (Cable Modem) support 8 B max transfer size and have a custom DT binding for that reason. This driver was checking for a wrong "compatible" however which resulted in an incorrect setup.
--- drivers/i2c/busses/i2c-brcmstb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-brcmstb.c +1 -1
@@ -674,7 +674,7 @@ static int brcmstb_i2c_probe(struct plat/* set the data in/out register size for compatible SoCs */ if (of_device_is_compatible (dev->device->of_node, -"brcmstb,brcmper-i2c" )) +"brcm,brcmper-i2c" )) dev->data_regsz =sizeof (u8);else dev->data_regsz =sizeof (u32);
Greg Kroah-Hartman
maintainerPATCH 121/121 lockdep: Correct lock_classes index mapping
In reply to Greg Kroah-HartmanFrom: Cheng Jui Wang <[email protected]>
commit 28df029d53a2fd80c1b8674d47895648ad26dcfb upstream.
A kernel exception was hit when trying to dump /proc/lockdep_chains after lockdep report "BUG: MAX_LOCKDEP_CHAIN_HLOCKS too low!":
Unable to handle kernel paging request at virtual address 00054005450e05c3 ... 00054005450e05c3] address between user and kernel address ranges ... pc : [0xffffffece769b3a8] string+0x50/0x10c lr : [0xffffffece769ac88] vsnprintf+0x468/0x69c ... Call trace: string+0x50/0x10c vsnprintf+0x468/0x69c seq_printf+0x8c/0xd8 print_name+0x64/0xf4 lc_show+0xb8/0x128 seq_read_iter+0x3cc/0x5fc proc_reg_read_iter+0xdc/0x1d4
The cause of the problem is the function lock_chain_get_class() will shift lock_classes index by 1, but the index don't need to be shifted anymore since commit 01bb6f0af992 ("locking/lockdep: Change the range of class_idx in held_lock struct") already change the index to start from 0.
The lock_classes[-1] located at chain_hlocks array. When printing lock_classes[-1] after the chain_hlocks entries are modified, the exception happened.
The output of lockdep_chains are incorrect due to this problem too.
--- kernel/locking/lockdep.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/locking/lockdep.c +2 -2
@@ -3387,7 +3387,7 @@ struct lock_class *lock_chain_get_class(u16 chain_hlock = chain_hlocks[chain->base + i];unsigned int class_idx =chain_hlock_class_idx (chain_hlock); -return lock_classes + class_idx -1 ; +return lock_classes + class_idx; }/*
@@ -3455,7 +3455,7 @@ static void print_chain_keys_chain(struc hlock_id = chain_hlocks[chain->base + i]; chain_key =print_chain_key_iteration (hlock_id, chain_key); -print_lock_name (lock_classes +chain_hlock_class_idx (hlock_id) -1 ); +print_lock_name (lock_classes +chain_hlock_class_idx (hlock_id));printk ("\n" ); } }
Hi!
Quoted 4 lines
This is the start of the stable review cycle for the 5.10.102 release. There are 121 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
CIP testing did not find any problems here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-5.10.y
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.102 release. There are 121 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 23 Feb 2022 08:48:58 +0000. Anything received after that time might be too late.
Build results:
total: 161 pass: 161 fail: 0 Qemu test results: total: 477 pass: 477 fail: 0
Guenter
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.102 release. There are 121 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 23 Feb 2022 08:48:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.102-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.102 release. There are 121 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 23 Feb 2022 08:48:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.102-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
Tested on arm64 and x86 for 5.10.102-rc1,
Kernel repo:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Branch: linux-5.10.y
Version: 5.10.102-rc1
Commit: 1f48487c6f051818b603f32cb79d56ff72607b2f
Compiler: gcc version 7.3.0 (GCC)
arm64:
--------------------------------------------------------------------
Testcase Result Summary:
total: 9013
passed: 9013
failed: 0
timeout: 0
--------------------------------------------------------------------
x86:
--------------------------------------------------------------------
Testcase Result Summary:
total: 9013
passed: 9013
failed: 0
timeout: 0
--------------------------------------------------------------------
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.102 release. There are 121 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 23 Feb 2022 08:48:58 +0000. Anything received after that time might be too late.
5.10.102-rc1 compiled and booted with no errors or regressions on my x86_64 test system.
Cheers,
Slade
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.102 release. There are 121 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 23 Feb 2022 08:48:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.102-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels:
Signature · 1 line
Florian
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.102 release. There are 121 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Successfully cross-compiled for arm64 (bcm2711_defconfig, gcc 10.2.0) and powerpc (ps3_defconfig, gcc 11.2.0).
Signature · 1 line
An old man doll... just what I always wanted! - Clara
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.102 release. There are 121 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 23 Feb 2022 08:48:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.102-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
NOTE:
Build warning noticed on arm and arm64. drivers/tee/optee/core.c: In function 'optee_probe':drivers/tee/optee/core.c:726:20: warning: operation on 'rc' may be undefined [-Wsequence-point]
726 | rc = rc = PTR_ERR(ctx);
| ~~~^~~~~~~~~~~~~~~~~~~## Build
* kernel: 5.10.102-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git branch: linux-5.10.y
* git commit: 6c935cea31db8d0fa9dc4f765383345cc2ecafef
* git describe: v5.10.101-122-g6c935cea31db
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.10.y/build/v5.10.101-122-g6c935cea31db
## Test Regressions (compared to v5.10.101)
No test regressions found.
## Metric Regressions (compared to v5.10.101)
* arm, build warnings
* arm64, build warnings
drivers/tee/optee/core.c: In function 'optee_probe':drivers/tee/optee/core.c:726:20: warning: operation on 'rc' may be undefined [-Wsequence-point]
726 | rc = rc = PTR_ERR(ctx);
| ~~~^~~~~~~~~~~~~~~~~~~## Test Fixes (compared to v5.10.101)
No test fixes found.
## Metric Fixes (compared to v5.10.101)
No metric fixes found.
## Test result summary
total: 96836, pass: 83846, fail: 529, skip: 11518, xfail: 943
## Build Summary
* arc: 10 total, 10 passed, 0 failed
* arm: 291 total, 291 passed, 0 failed
* arm64: 41 total, 39 passed, 2 failed
* dragonboard-410c: 1 total, 1 passed, 0 failed
* hi6220-hikey: 1 total, 1 passed, 0 failed
* i386: 40 total, 40 passed, 0 failed
* juno-r2: 1 total, 1 passed, 0 failed
* mips: 37 total, 37 passed, 0 failed
* parisc: 12 total, 12 passed, 0 failed
* powerpc: 60 total, 46 passed, 14 failed
* riscv: 27 total, 27 passed, 0 failed
* s390: 21 total, 21 passed, 0 failed
* sh: 24 total, 24 passed, 0 failed
* sparc: 12 total, 12 passed, 0 failed
* x15: 1 total, 1 passed, 0 failed
* x86: 1 total, 1 passed, 0 failed
* x86_64: 41 total, 41 passed, 0 failed
## Test suites summary
* fwts
* igt-gpu-tools
* kselftest-android
* kselftest-bpf
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-firmware
* kselftest-fpu
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-tc-testing
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-vm
* kselftest-x86
* kselftest-zram
* kunit
* kvm-unit-tests
* libgpiod
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-open-posix-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-tracing-tests
* network-basic-tests
* packetdrill
* perf
* perf/Zstd-perf.data-compression
* rcutorture
* ssuite
* v4l2-compliance
--
Linaro LKFT
https://lkft.linaro.org
Hi Greg,
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.102 release. There are 121 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 23 Feb 2022 08:48:58 +0000. Anything received after that time might be too late.
Build test:
mips (gcc version 11.2.1 20220213): 63 configs -> no failure arm (gcc version 11.2.1 20220213): 105 configs -> no new failure arm64 (gcc version 11.2.1 20220213): 3 configs -> no failure x86_64 (gcc version 11.2.1 20220213): 4 configs -> no failure
Boot test:x86_64: Booted on my test laptop. No regression.x86_64: Booted on qemu. No regression. [1]
arm64: Booted on rpi4b (4GB model). No regression. [2]
[1]. https://openqa.qa.codethink.co.uk/tests/797
[2]. https://openqa.qa.codethink.co.uk/tests/799
--
Regards
Sudip
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.102 release. There are 121 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 23 Feb 2022 08:48:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.102-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v5.10:
10 builds: 10 pass, 0 fail
28 boots: 28 pass, 0 fail
75 tests: 75 pass, 0 failLinux version: 5.10.102-rc1-g6c935cea31db
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04Jon