5.15.41-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 5.15.41-rc1 review
This is the start of the stable review cycle for the 5.15.41 release. There are 102 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 18 May 2022 19:36:02 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.41-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.15.41-rc1
Dan Vacura <[email protected]>
usb: gadget: uvc: allow for application to cleanly shutdown
Michael Tretter <[email protected]>
usb: gadget: uvc: rename function to be more consistent
Nicolas Dichtel <[email protected]>
ping: fix address binding wrt vrf
Trond Myklebust <[email protected]>
SUNRPC: Ensure we flush any closed sockets before xs_xprt_free()
Naoya Horiguchi <[email protected]>
mm/hwpoison: use pr_err() instead of dump_page() in get_any_page()
Charan Teja Reddy <[email protected]>
dma-buf: call dma_buf_stats_setup after dmabuf is in valid list
Alex Deucher <[email protected]>
Revert "drm/amd/pm: keep the BACO feature enabled for suspend"
Zack Rusin <[email protected]>
drm/vmwgfx: Initialize drm_mode_fb_cmd2
Trond Myklebust <[email protected]>
SUNRPC: Ensure that the gssproxy client can start in a connected state
Fabio Estevam <[email protected]>
net: phy: micrel: Pass .probe for KS8737
Fabio Estevam <[email protected]>
net: phy: micrel: Do not use kszphy_suspend/resume for KSZ8061
Mike Rapoport <[email protected]>
arm[64]/memremap: don't abuse pfn_valid() to ensure presence of linear map
Waiman Long <[email protected]>
cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp()
Jing Xia <[email protected]>
writeback: Avoid skipping inode writeback
Francesco Dolcini <[email protected]>
net: phy: Fix race condition on link status change
Manuel Ullmann <[email protected]>
net: atlantic: always deep reset on pm op, fixing up my null deref regression
Xiaomeng Tong <[email protected]>
i40e: i40e_main: fix a missing check on list iterator
Robin Murphy <[email protected]>
drm/nouveau/tegra: Stop using iommu_present()
Zack Rusin <[email protected]>
drm/vmwgfx: Disable command buffers on svga3 without gbobjects
Xu Yu <[email protected]>
mm/huge_memory: do not overkill when splitting huge_zero_page
Xu Yu <[email protected]>
Revert "mm/memory-failure.c: skip huge_zero_page in memory_failure()"
Jeff Layton <[email protected]>
ceph: fix setting of xattrs on async created inodes
AngeloGioacchino Del Regno <[email protected]>
serial: 8250_mtk: Fix register address for XON/XOFF character
AngeloGioacchino Del Regno <[email protected]>
serial: 8250_mtk: Fix UART_EFR register address
Indan Zupancic <[email protected]>
fsl_lpuart: Don't enable interrupts too early
Miaoqian Lin <[email protected]>
slimbus: qcom: Fix IRQ check in qcom_slim_probe
Sven Schwermer <[email protected]>
USB: serial: option: add Fibocom MA510 modem
Sven Schwermer <[email protected]>
USB: serial: option: add Fibocom L610 modem
Ethan Yang <[email protected]>
USB: serial: qcserial: add support for Sierra Wireless EM7590
Scott Chen <[email protected]>
USB: serial: pl2303: add device id for HP LM930 Display
ChiYuan Huang <[email protected]>
usb: typec: tcpci_mt6360: Update for BMC PHY setting
Uwe Kleine-König <[email protected]>
usb: typec: tcpci: Don't skip cleanup in .remove() on error
Sergey Ryazanov <[email protected]>
usb: cdc-wdm: fix reading stuck on device close
Daniel Starke <[email protected]>
tty: n_gsm: fix mux activation issues in gsm_config()
Daniel Starke <[email protected]>
tty: n_gsm: fix buffer over-read in gsm_dlci_data()
Yang Yingliang <[email protected]>
tty/serial: digicolor: fix possible null-ptr-deref in digicolor_uart_probe()
Adrian-Ken Rueegsegger <[email protected]>
x86/mm: Fix marking of unused sub-pmd ranges
Chunfeng Yun <[email protected]>
usb: xhci-mtk: fix fs isoc's transfer error
Alexander Graf <[email protected]>
KVM: PPC: Book3S PR: Enable MSR_DR for switch_mmu_context()
Thiébaud Weksteen <[email protected]>
firmware_loader: use kernel credentials when reading firmware
Stephen Boyd <[email protected]>
interconnect: Restore sync state by ignoring ipa-virt in provider count
Willy Tarreau <[email protected]>
tcp: drop the hash_32() part from the index calculation
Willy Tarreau <[email protected]>
tcp: increase source port perturb table to 2^16
Willy Tarreau <[email protected]>
tcp: dynamically allocate the perturb table used by source ports
Willy Tarreau <[email protected]>
tcp: add small random increments to the source port
Eric Dumazet <[email protected]>
tcp: resalt the secret every 10 seconds
Willy Tarreau <[email protected]>
tcp: use different parts of the port_offset for index and offset
Willy Tarreau <[email protected]>
secure_seq: use the 64 bits of the siphash for port offset calculation
Matthew Hagan <[email protected]>
net: sfp: Add tx-fault workaround for Huawei MA5671A SFP ONT
Shravya Kumbham <[email protected]>
net: emaclite: Don't advertise 1000BASE-T and do auto negotiation
Ajit Kumar Pandey <[email protected]>
ASoC: SOF: Fix NULL pointer exception in sof_pci_probe callback
Sven Schnelle <[email protected]>
s390: disable -Warray-bounds
Mark Brown <[email protected]>
ASoC: ops: Validate input values in snd_soc_put_volsw_range()
Mark Brown <[email protected]>
ASoC: max98090: Generate notifications on changes for custom control
Mark Brown <[email protected]>
ASoC: max98090: Reject invalid values in custom control put()
Ashish Mhetre <[email protected]>
iommu: arm-smmu: disable large page mappings for Nvidia arm-smmu
Duoming Zhou <[email protected]>
RDMA/irdma: Fix deadlock in irdma_cleanup_cm_core()
Ji-Ze Hong (Peter Hong) <[email protected]>
hwmon: (f71882fg) Fix negative temperature
Andreas Gruenbacher <[email protected]>
gfs2: Fix filesystem block deallocation for short writes
Zack Rusin <[email protected]>
drm/vmwgfx: Fix fencing on SVGAv3
Maxim Mikityanskiy <[email protected]>
tls: Fix context leak on tls_device_down
Taehee Yoo <[email protected]>
net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe()
Guangguan Wang <[email protected]>
net/smc: non blocking recvmsg() return -EAGAIN when no data and signal_pending
Florian Fainelli <[email protected]>
net: dsa: bcm_sf2: Fix Wake-on-LAN with mac_link_down()
Hui Tang <[email protected]>
drm/vc4: hdmi: Fix build error for implicit function declaration
Florian Fainelli <[email protected]>
net: bcmgenet: Check for Wake-on-LAN interrupt probe deferral
Yang Yingliang <[email protected]>
net: ethernet: mediatek: ppe: fix wrong size passed to memset()
Paolo Abeni <[email protected]>
net/sched: act_pedit: really ensure the skb is writable
Alexandra Winter <[email protected]>
s390/lcs: fix variable dereferenced before check
Alexandra Winter <[email protected]>
s390/ctcm: fix potential memory leak
Alexandra Winter <[email protected]>
s390/ctcm: fix variable dereferenced before check
Shunsuke Mie <[email protected]>
virtio: fix virtio transitional ids
Joey Gouly <[email protected]>
arm64: vdso: fix makefile dependency on vdso.so
Joel Savitz <[email protected]>
selftests: vm: Makefile: rename TARGETS to VMTARGETS
Kalesh Singh <[email protected]>
procfs: prevent unprivileged processes accessing fdinfo dir
Randy Dunlap <[email protected]>
hwmon: (ltq-cputemp) restrict it to SOC_XWAY
Jesse Brandeburg <[email protected]>
dim: initialize all struct fields
Yang Yingliang <[email protected]>
ionic: fix missing pci_release_regions() on error in ionic_probe()
Dan Aloni <[email protected]>
nfs: fix broken handling of the softreval mount option
Johannes Berg <[email protected]>
mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection
Taehee Yoo <[email protected]>
net: sfc: fix memory leak due to ptp channel
Jiapeng Chong <[email protected]>
sfc: Use swap() instead of open coding it
Javier Martinez Canillas <[email protected]>
fbdev: efifb: Fix a use-after-free due early fb_info cleanup
Kees Cook <[email protected]>
net: chelsio: cxgb4: Avoid potential negative array offset
Eric Dumazet <[email protected]>
netlink: do not reset transport header in netlink_recvmsg()
Christophe JAILLET <[email protected]>
drm/nouveau: Fix a potential theorical leak in nouveau_get_backlight_name()
Lokesh Dhoundiyal <[email protected]>
ipv4: drop dst in multicast routing path
Michal Michalik <[email protected]>
ice: fix PTP stale Tx timestamps cleanup
Ivan Vecera <[email protected]>
ice: Fix race during aux device (un)plugging
Maximilian Luz <[email protected]>
platform/surface: aggregator: Fix initialization order when compiling as builtin module
Javier Martinez Canillas <[email protected]>
fbdev: vesafb: Cleanup fb_info in .fb_destroy rather than .remove
Javier Martinez Canillas <[email protected]>
fbdev: efifb: Cleanup fb_info in .fb_destroy rather than .remove
Javier Martinez Canillas <[email protected]>
fbdev: simplefb: Cleanup fb_info in .fb_destroy rather than .remove
Vladimir Oltean <[email protected]>
net: mscc: ocelot: avoid corrupting hardware counters when moving VCAP filters
Vladimir Oltean <[email protected]>
net: mscc: ocelot: restrict tc-trap actions to VCAP IS2 lookup 0
Vladimir Oltean <[email protected]>
net: mscc: ocelot: fix VCAP IS2 filters matching on both lookups
Vladimir Oltean <[email protected]>
net: mscc: ocelot: fix last VCAP IS1/IS2 filter persisting in hardware when deleted
Tariq Toukan <[email protected]>
net: Fix features skip in for_each_netdev_feature()
Manikanta Pubbisetty <[email protected]>
mac80211: Reset MBSSID parameters upon connection
Camel Guo <[email protected]>
hwmon: (tmp401) Add OF device ID table
Guenter Roeck <[email protected]>
iwlwifi: iwl-dbg: Use del_timer_sync() before freeing
Sven Eckelmann <[email protected]>
batman-adv: Don't skb_split skbuffs with frag_list
-------------
Diffstat:
Makefile | 4 +- arch/arm/include/asm/io.h | 3 ++ arch/arm/mm/ioremap.c | 8 ++++ arch/arm64/include/asm/io.h | 4 ++ arch/arm64/kernel/Makefile | 4 ++ arch/arm64/kernel/vdso/Makefile | 3 -- arch/arm64/kernel/vdso32/Makefile | 3 -- arch/arm64/mm/ioremap.c | 8 ++++ arch/powerpc/kvm/book3s_32_sr.S | 26 ++++++++++--- arch/s390/Makefile | 10 +++++ arch/x86/mm/init_64.c | 5 ++- drivers/base/firmware_loader/main.c | 17 +++++++++ drivers/dma-buf/dma-buf.c | 8 ++-- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 8 +--- drivers/gpu/drm/nouveau/nouveau_backlight.c | 9 +++-- drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c | 2 +- drivers/gpu/drm/vc4/vc4_hdmi.c | 1 + drivers/gpu/drm/vmwgfx/vmwgfx_cmd.c | 13 ++++--- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 8 ++++ drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 28 ++++++++++---- drivers/gpu/drm/vmwgfx/vmwgfx_irq.c | 26 +++++++++---- drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 8 ++-- drivers/hwmon/Kconfig | 2 +- drivers/hwmon/f71882fg.c | 5 ++- drivers/hwmon/tmp401.c | 11 ++++++ drivers/infiniband/hw/irdma/cm.c | 7 +--- drivers/interconnect/core.c | 8 +++- drivers/iommu/arm/arm-smmu/arm-smmu-nvidia.c | 30 +++++++++++++++ drivers/net/dsa/bcm_sf2.c | 3 ++ .../net/ethernet/aquantia/atlantic/aq_pci_func.c | 4 +- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 4 ++ drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 10 ++--- drivers/net/ethernet/intel/i40e/i40e_main.c | 27 ++++++------- drivers/net/ethernet/intel/ice/ice.h | 1 + drivers/net/ethernet/intel/ice/ice_idc.c | 25 ++++++++---- drivers/net/ethernet/intel/ice/ice_main.c | 2 + drivers/net/ethernet/intel/ice/ice_ptp.c | 10 ++++- drivers/net/ethernet/mediatek/mtk_ppe.c | 2 +- drivers/net/ethernet/mscc/ocelot_flower.c | 5 ++- drivers/net/ethernet/mscc/ocelot_vcap.c | 9 ++++- .../net/ethernet/pensando/ionic/ionic_bus_pci.c | 3 +- drivers/net/ethernet/sfc/ef10.c | 5 +++ drivers/net/ethernet/sfc/efx_channels.c | 21 +++++------ drivers/net/ethernet/sfc/ptp.c | 14 ++++++- drivers/net/ethernet/sfc/ptp.h | 1 + drivers/net/ethernet/xilinx/xilinx_emaclite.c | 15 -------- drivers/net/phy/micrel.c | 5 ++- drivers/net/phy/phy.c | 7 +++- drivers/net/phy/sfp.c | 12 +++++- drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 2 +- drivers/net/wireless/mac80211_hwsim.c | 3 ++ drivers/platform/surface/aggregator/core.c | 2 +- drivers/s390/net/ctcm_mpc.c | 6 +-- drivers/s390/net/ctcm_sysfs.c | 5 ++- drivers/s390/net/lcs.c | 7 ++-- drivers/slimbus/qcom-ctrl.c | 4 +- drivers/tty/n_gsm.c | 13 +++++-- drivers/tty/serial/8250/8250_mtk.c | 22 ++++++----- drivers/tty/serial/digicolor-usart.c | 5 +-- drivers/tty/serial/fsl_lpuart.c | 18 ++++----- drivers/usb/class/cdc-wdm.c | 1 + drivers/usb/gadget/function/f_uvc.c | 32 ++++++++++++++-- drivers/usb/gadget/function/uvc.h | 2 + drivers/usb/gadget/function/uvc_v4l2.c | 3 +- drivers/usb/host/xhci-mtk-sch.c | 16 ++++---- drivers/usb/serial/option.c | 4 ++ drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 1 + drivers/usb/serial/qcserial.c | 2 + drivers/usb/typec/tcpm/tcpci.c | 2 +- drivers/usb/typec/tcpm/tcpci_mt6360.c | 26 +++++++++++++ drivers/video/fbdev/efifb.c | 9 ++++- drivers/video/fbdev/simplefb.c | 8 +++- drivers/video/fbdev/vesafb.c | 8 +++- fs/ceph/file.c | 16 ++++++-- fs/file_table.c | 1 + fs/fs-writeback.c | 4 ++ fs/gfs2/bmap.c | 11 +++--- fs/nfs/fs_context.c | 2 +- fs/proc/fd.c | 23 ++++++++++- include/linux/netdev_features.h | 4 +- include/linux/sunrpc/clnt.h | 1 + include/net/inet_hashtables.h | 2 +- include/net/secure_seq.h | 4 +- include/net/tc_act/tc_pedit.h | 1 + include/trace/events/sunrpc.h | 1 - include/uapi/linux/virtio_ids.h | 14 +++---- kernel/cgroup/cpuset.c | 7 +++- lib/dim/net_dim.c | 44 +++++++++++----------- mm/huge_memory.c | 7 +++- mm/memory-failure.c | 15 +------- net/batman-adv/fragmentation.c | 11 ++++++ net/core/secure_seq.c | 16 +++++--- net/ipv4/inet_hashtables.c | 42 +++++++++++++-------- net/ipv4/ping.c | 15 +++++++- net/ipv4/route.c | 1 + net/ipv6/inet6_hashtables.c | 4 +- net/mac80211/mlme.c | 6 +++ net/netlink/af_netlink.c | 1 - net/sched/act_pedit.c | 26 +++++++++++-- net/smc/smc_rx.c | 4 +- net/sunrpc/auth_gss/gss_rpc_upcall.c | 1 + net/sunrpc/clnt.c | 33 ++++++++++++++++ net/sunrpc/xprt.c | 7 +--- net/sunrpc/xprtsock.c | 16 ++++++-- net/tls/tls_device.c | 3 ++ sound/soc/codecs/max98090.c | 5 ++- sound/soc/soc-ops.c | 18 ++++++++- sound/soc/sof/sof-pci-dev.c | 5 +++ tools/testing/selftests/vm/Makefile | 10 ++--- 111 files changed, 742 insertions(+), 297 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/102 batman-adv: Dont skb_split skbuffs with frag_list
From: Sven Eckelmann <[email protected]>
[ Upstream commit a063f2fba3fa633a599253b62561051ac185fa99 ]
The receiving interface might have used GRO to receive more fragments than MAX_SKB_FRAGS fragments. In this case, these will not be stored in skb_shinfo(skb)->frags but merged into the frag list.
batman-adv relies on the function skb_split to split packets up into multiple smaller packets which are not larger than the MTU on the outgoing interface. But this function cannot handle frag_list entries and is only operating on skb_shinfo(skb)->frags. If it is still trying to split such an skb and xmit'ing it on an interface without support for NETIF_F_FRAGLIST, then validate_xmit_skb() will try to linearize it. But this fails due to inconsistent information. And __pskb_pull_tail will trigger a BUG_ON after skb_copy_bits() returns an error.
In case of entries in frag_list, just linearize the skb before operating on it with skb_split().
--- net/batman-adv/fragmentation.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
net/batman-adv/fragmentation.c +11 -0
@@ -475,6 +475,17 @@ int batadv_frag_send_packet(struct sk_buff *skb, goto free_skb; } +/* GRO might have added fragments to the fragment list instead of +* frags[]. But this is not handled by skb_split and must be +* linearized to avoid incorrect length information after all +* batman-adv fragments were created and submitted to the +* hard-interface +*/ +if (skb_has_frag_list (skb) &&__skb_linearize (skb)) { + ret = -ENOMEM ; + goto free_skb; + } +/* Create one header to be copied to all fragments */ frag_header.packet_type =BATADV_UNICAST_FRAG ; frag_header.version =BATADV_COMPAT_VERSION ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 2/102 iwlwifi: iwl-dbg: Use del_timer_sync() before freeing
In reply to Greg Kroah-HartmanFrom: Guenter Roeck <[email protected]>
[ Upstream commit 7635a1ad8d92dcc8247b53f949e37795154b5b6f ]
In Chrome OS, a large number of crashes is observed due to corrupted timer lists. Steven Rostedt pointed out that this usually happens when a timer is freed while still active, and that the problem is often triggered by code calling del_timer() instead of del_timer_sync() just before freeing.
Steven also identified the iwlwifi driver as one of the possible culprits since it does exactly that.
--- drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c +1 -1
@@ -322,7 +322,7 @@ void iwl_dbg_tlv_del_timers(struct iwl_trans *trans)struct iwl_dbg_tlv_timer_node *node, *tmp;list_for_each_entry_safe (node, tmp, timer_list, list) { -del_timer (&node->timer); +del_timer_sync (&node->timer);list_del (&node->list);kfree (node); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 3/102 hwmon: (tmp401) Add OF device ID table
In reply to Greg Kroah-HartmanFrom: Camel Guo <[email protected]>
[ Upstream commit 3481551f035725fdc46885425eac3ef9b58ae7b7 ]
This driver doesn't have of_match_table. This makes the kernel module tmp401.ko lack alias patterns (e.g: of:N*T*Cti,tmp411) to match DT node of the supported devices hence this kernel module will not be automatically loaded.
After adding of_match_table to this driver, the folllowing alias will be added into tmp401.ko.
$ modinfo drivers/hwmon/tmp401.ko filename: drivers/hwmon/tmp401.ko ...... author: Hans de Goede <[email protected]> alias: of:N*T*Cti,tmp435C* alias: of:N*T*Cti,tmp435 alias: of:N*T*Cti,tmp432C* alias: of:N*T*Cti,tmp432 alias: of:N*T*Cti,tmp431C* alias: of:N*T*Cti,tmp431 alias: of:N*T*Cti,tmp411C* alias: of:N*T*Cti,tmp411 alias: of:N*T*Cti,tmp401C* alias: of:N*T*Cti,tmp401 ......
--- drivers/hwmon/tmp401.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/hwmon/tmp401.c +11 -0
@@ -730,10 +730,21 @@ static int tmp401_probe(struct i2c_client *client)return 0 ; } +static const struct of_device_id __maybe_unused tmp4xx_of_match[] = { + { .compatible ="ti,tmp401" , }, + { .compatible ="ti,tmp411" , }, + { .compatible ="ti,tmp431" , }, + { .compatible ="ti,tmp432" , }, + { .compatible ="ti,tmp435" , }, + { }, +}; +MODULE_DEVICE_TABLE (of, tmp4xx_of_match); +static struct i2c_driver tmp401_driver = { .class =I2C_CLASS_HWMON , .driver = { .name ="tmp401" , + .of_match_table =of_match_ptr (tmp4xx_of_match), }, .probe_new = tmp401_probe, .id_table = tmp401_id,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 4/102 mac80211: Reset MBSSID parameters upon connection
In reply to Greg Kroah-HartmanFrom: Manikanta Pubbisetty <[email protected]>
[ Upstream commit 86af062f40a73bf63321694e6bf637144f0383fe ]
Currently MBSSID parameters in struct ieee80211_bss_conf are not reset upon connection. This could be problematic with some drivers in a scenario where the device first connects to a non-transmit BSS and then connects to a transmit BSS of a Multi BSS AP. The MBSSID parameters which are set after connecting to a non-transmit BSS will not be reset and the same parameters will be passed on to the driver during the subsequent connection to a transmit BSS of a Multi BSS AP.
For example, firmware running on the ath11k device uses the Multi BSS data for tracking the beacon of a non-transmit BSS and reports the driver when there is a beacon miss. If we do not reset the MBSSID parameters during the subsequent connection to a transmit BSS, then the driver would have wrong MBSSID data and FW would be looking for an incorrect BSSID in the MBSSID beacon of a Multi BSS AP and reports beacon loss leading to an unstable connection.
Reset the MBSSID parameters upon every connection to solve this problem.
--- net/mac80211/mlme.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/mac80211/mlme.c +6 -0
@@ -3541,6 +3541,12 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata, cbss->transmitted_bss->bssid); bss_conf->bssid_indicator = cbss->max_bssid_indicator; bss_conf->bssid_index = cbss->bssid_index; + }else { + bss_conf->nontransmitted = false; +memset (bss_conf->transmitter_bssid,0 , +sizeof (bss_conf->transmitter_bssid)); + bss_conf->bssid_indicator =0 ; + bss_conf->bssid_index =0 ; }/*
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 5/102 net: Fix features skip in for_each_netdev_feature()
In reply to Greg Kroah-HartmanFrom: Tariq Toukan <[email protected]>
[ Upstream commit 85db6352fc8a158a893151baa1716463d34a20d0 ]
The find_next_netdev_feature() macro gets the "remaining length", not bit index.
Passing "bit - 1" for the following iteration is wrong as it skips the adjacent bit. Pass "bit" instead.
--- include/linux/netdev_features.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/netdev_features.h +2 -2
@@ -169,7 +169,7 @@ enum {#define NETIF_F_HW_HSR_FWD __NETIF_F(HW_HSR_FWD)#define NETIF_F_HW_HSR_DUP __NETIF_F(HW_HSR_DUP) -/* Finds the next feature with the highest number of the range of start till 0. +/* Finds the next feature with the highest number of the range of start-1 till 0. */ static inline int find_next_netdev_feature (u64 feature,unsigned long start) {
@@ -188,7 +188,7 @@ static inline int find_next_netdev_feature(u64 feature, unsigned long start)for ((bit) =find_next_netdev_feature ((mask_addr), \NETDEV_FEATURE_COUNT ); \ (bit) >=0 ; \ - (bit) =find_next_netdev_feature ((mask_addr), (bit) -1 )) + (bit) =find_next_netdev_feature ((mask_addr), (bit)))/* Features valid for ethtool to change */ /* = all defined minus driver/device-class-related */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 6/102 net: mscc: ocelot: fix last VCAP IS1/IS2 filter persisting in hardware when deleted
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 16bbebd35629c93a8c68c6d8d28557e100bcee73 ]
ocelot_vcap_filter_del() works by moving the next filters over the current one, and then deleting the last filter by calling vcap_entry_set() with a del_filter which was specially created by memsetting its memory to zeroes. vcap_entry_set() then programs this to the TCAM and action RAM via the cache registers.
The problem is that vcap_entry_set() is a dispatch function which looks at del_filter->block_id. But since del_filter is zeroized memory, the block_id is 0, or otherwise said, VCAP_ES0. So practically, what we do is delete the entry at the same TCAM index from VCAP ES0 instead of IS1 or IS2.
The code was not always like this. vcap_entry_set() used to simply be is2_entry_set(), and then, the logic used to work.
Restore the functionality by populating the block_id of the del_filter based on the VCAP block of the filter that we're deleting. This makes vcap_entry_set() know what to do.
--- drivers/net/ethernet/mscc/ocelot_vcap.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/mscc/ocelot_vcap.c +4 -0
@@ -1192,7 +1192,11 @@ int ocelot_vcap_filter_del(struct ocelot *ocelot,struct ocelot_vcap_filter del_filter;int i, index; +/* Need to inherit the block_id so that vcap_entry_set() +* does not get confused and knows where to install it. +*/ memset (&del_filter,0 ,sizeof (del_filter)); + del_filter.block_id = filter->block_id;/* Gets index of the filter */ index =ocelot_vcap_block_get_filter_index (block, filter);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 7/102 net: mscc: ocelot: fix VCAP IS2 filters matching on both lookups
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 6741e11880003e35802d78cc58035057934f4dab ]
The VCAP IS2 TCAM is looked up twice per packet, and each filter can be configured to only match during the first, second lookup, or both, or none.
The blamed commit wrote the code for making VCAP IS2 filters match only on the given lookup. But right below that code, there was another line that explicitly made the lookup a "don't care", and this is overwriting the lookup we've selected. So the code had no effect.
Some of the more noticeable effects of having filters match on both lookups:
- in "tc -s filter show dev swp0 ingress", we see each packet matching a VCAP IS2 filter counted twice. This throws off scripts such as tools/testing/selftests/net/forwarding/tc_actions.sh and makes them fail.
- a "tc-drop" action offloaded to VCAP IS2 needs a policer as well, because once the CPU port becomes a member of the destination port mask of a packet, nothing removes it, not even a PERMIT/DENY mask mode with a port mask of 0. But VCAP IS2 rules with the POLICE_ENA bit in the action vector can only appear in the first lookup. What happens when a filter matches both lookups is that the action vector is combined, and this makes the POLICE_ENA bit ineffective, since the last lookup in which it has appeared is the second one. In other words, "tc-drop" actions do not drop packets for the CPU port, dropped packets are still seen by software unless there was an FDB entry that directed those packets to some other place different from the CPU.
The last bit used to work, because in the initial commit b596229448dd ("net: mscc: ocelot: Add support for tcam"), we were writing the FIRST field of the VCAP IS2 half key with a 1, not with a "don't care". The change to "don't care" was made inadvertently by me in commit c1c3993edb7c ("net: mscc: ocelot: generalize existing code for VCAP"), which I just realized, and which needs a separate fix from this one, for "stable" kernels that lack the commit blamed below.
--- drivers/net/ethernet/mscc/ocelot_vcap.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/ethernet/mscc/ocelot_vcap.c +0 -1
@@ -373,7 +373,6 @@ static void is2_entry_set(struct ocelot *ocelot, int ix, OCELOT_VCAP_BIT_0);vcap_key_set (vcap, &data,VCAP_IS2_HK_IGR_PORT_MASK ,0 , ~filter->ingress_port_mask); -vcap_key_bit_set (vcap, &data,VCAP_IS2_HK_FIRST ,OCELOT_VCAP_BIT_ANY );vcap_key_bit_set (vcap, &data,VCAP_IS2_HK_HOST_MATCH ,OCELOT_VCAP_BIT_ANY );vcap_key_bit_set (vcap, &data,VCAP_IS2_HK_L2_MC , filter->dmac_mc);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 8/102 net: mscc: ocelot: restrict tc-trap actions to VCAP IS2 lookup 0
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 477d2b91623e682e9a8126ea92acb8f684969cc7 ]
Once the CPU port was added to the destination port mask of a packet, it can never be cleared, so even packets marked as dropped by the MASK_MODE of a VCAP IS2 filter will still reach it. This is why we need the OCELOT_POLICER_DISCARD to "kill dropped packets dead" and make software stop seeing them.
We disallow policer rules from being put on any other chain than the one for the first lookup, but we don't do this for "drop" rules, although we should. This change is merely ascertaining that the rules dont't (completely) work and letting the user know.
The blamed commit is the one that introduced the multi-chain architecture in ocelot. Prior to that, we should have always offloaded the filters to VCAP IS2 lookup 0, where they did work.
--- drivers/net/ethernet/mscc/ocelot_flower.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/ethernet/mscc/ocelot_flower.c +3 -2
@@ -206,9 +206,10 @@ static int ocelot_flower_parse_action(struct ocelot *ocelot, int port, filter->type =OCELOT_VCAP_FILTER_OFFLOAD ;break ;case FLOW_ACTION_TRAP : -if (filter->block_id !=VCAP_IS2 ) { +if (filter->block_id !=VCAP_IS2 || + filter->lookup !=0 ) {NL_SET_ERR_MSG_MOD (extack, -"Trap action can only be offloaded to VCAP IS2" ); +"Trap action can only be offloaded to VCAP IS2 lookup 0" );return -EOPNOTSUPP ; }if (filter->goto_target !=-1 ) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 9/102 net: mscc: ocelot: avoid corrupting hardware counters when moving VCAP filters
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 93a8417088ea570b5721d2b526337a2d3aed9fa3 ]
Given the following order of operations:
(1) we add filter A using tc-flower
(2) we send a packet that matches it
(3) we read the filter's statistics to find a hit count of 1
(4) we add a second filter B with a higher preference than A, and A moves one position to the right to make room in the TCAM for it
(5) we send another packet, and this matches the second filter B
(6) we read the filter statistics again.
When this happens, the hit count of filter A is 2 and of filter B is 1, despite a single packet having matched each filter.
Furthermore, in an alternate history, reading the filter stats a second time between steps (3) and (4) makes the hit count of filter A remain at 1 after step (6), as expected.
The reason why this happens has to do with the filter->stats.pkts field, which is written to hardware through the call path below:
vcap_entry_set
/ | \
/ | \
/ | \
/ | \
es0_entry_set is1_entry_set is2_entry_set
\ | /
\ | /
\ | /
vcap_data_set(data.counter, ...)The primary role of filter->stats.pkts is to transport the filter hit counters from the last readout all the way from vcap_entry_get() -> ocelot_vcap_filter_stats_update() -> ocelot_cls_flower_stats(). The reason why vcap_entry_set() writes it to hardware is so that the counters (saturating and having a limited bit width) are cleared after each user space readout.
The writing of filter->stats.pkts to hardware during the TCAM entry movement procedure is an unintentional consequence of the code design, because the hit count isn't up to date at this point.
So at step (4), when filter A is moved by ocelot_vcap_filter_add() to make room for filter B, the hardware hit count is 0 (no packet matched on it in the meantime), but filter->stats.pkts is 1, because the last readout saw the earlier packet. The movement procedure programs the old hit count back to hardware, so this creates the impression to user space that more packets have been matched than they really were.
The bug can be seen when running the gact_drop_and_ok_test() from the tc_actions.sh selftest.
Fix the issue by reading back the hit count to tmp->stats.pkts before migrating the VCAP filter. Sure, this is a best-effort technique, since the packets that hit the rule between vcap_entry_get() and vcap_entry_set() won't be counted, but at least it allows the counters to be reliably used for selftests where the traffic is under control.
The vcap_entry_get() name is a bit unintuitive, but it only reads back the counter portion of the TCAM entry, not the entire entry.
The index from which we retrieve the counter is also a bit unintuitive (i - 1 during add, i + 1 during del), but this is the way in which TCAM entry movement works. The "entry index" isn't a stored integer for a TCAM filter, instead it is dynamically computed by ocelot_vcap_block_get_filter_index() based on the entry's position in the &block->rules list. That position (as well as block->count) is automatically updated by ocelot_vcap_filter_add_to_block() on add, and by ocelot_vcap_block_remove_filter() on del. So "i" is the new filter index, and "i - 1" or "i + 1" respectively are the old addresses of that TCAM entry (we only support installing/deleting one filter at a time).
--- drivers/net/ethernet/mscc/ocelot_vcap.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/mscc/ocelot_vcap.c +4 -0
@@ -1152,6 +1152,8 @@ int ocelot_vcap_filter_add(struct ocelot *ocelot,struct ocelot_vcap_filter *tmp; tmp =ocelot_vcap_block_find_filter_by_index (block, i); +/* Read back the filter's counters before moving it */ +vcap_entry_get (ocelot, i -1 , tmp);vcap_entry_set (ocelot, i, tmp); }
@@ -1210,6 +1212,8 @@ int ocelot_vcap_filter_del(struct ocelot *ocelot,struct ocelot_vcap_filter *tmp; tmp =ocelot_vcap_block_find_filter_by_index (block, i); +/* Read back the filter's counters before moving it */ +vcap_entry_get (ocelot, i +1 , tmp);vcap_entry_set (ocelot, i, tmp); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 10/102 fbdev: simplefb: Cleanup fb_info in .fb_destroy rather than .remove
In reply to Greg Kroah-HartmanFrom: Javier Martinez Canillas <[email protected]>
[ Upstream commit 666b90b3ce9e4aac1e1deba266c3a230fb3913b0 ]
The driver is calling framebuffer_release() in its .remove callback, but this will cause the struct fb_info to be freed too early. Since it could be that a reference is still hold to it if user-space opened the fbdev.
This would lead to a use-after-free error if the framebuffer device was unregistered but later a user-space process tries to close the fbdev fd.
To prevent this, move the framebuffer_release() call to fb_ops.fb_destroy instead of doing it in the driver's .remove callback.
Strictly speaking, the code flow in the driver is still wrong because all the hardware cleanupd (i.e: iounmap) should be done in .remove while the software cleanup (i.e: releasing the framebuffer) should be done in the .fb_destroy handler. But this at least makes to match the behavior before commit 27599aacbaef ("fbdev: Hot-unplug firmware fb devices on forced removal").
--- drivers/video/fbdev/simplefb.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/video/fbdev/simplefb.c +7 -1
@@ -70,12 +70,18 @@ struct simplefb_par;static void simplefb_clocks_destroy (struct simplefb_par *par);static void simplefb_regulators_destroy (struct simplefb_par *par); +/* +* fb_ops.fb_destroy is called by the last put_fb_info() call at the end +* of unregister_framebuffer() or fb_release(). Do any cleanup here. +*/ static void simplefb_destroy (struct fb_info *info) {simplefb_regulators_destroy (info->par);simplefb_clocks_destroy (info->par);if (info->screen_base)iounmap (info->screen_base); + +framebuffer_release (info); }static const struct fb_ops simplefb_ops = {
@@ -520,8 +526,8 @@ static int simplefb_remove(struct platform_device *pdev) {struct fb_info *info =platform_get_drvdata (pdev); +/* simplefb_destroy takes care of info cleanup */ unregister_framebuffer (info); -framebuffer_release (info);return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 11/102 fbdev: efifb: Cleanup fb_info in .fb_destroy rather than .remove
In reply to Greg Kroah-HartmanFrom: Javier Martinez Canillas <[email protected]>
[ Upstream commit d258d00fb9c7c0cdf9d10c1ded84f10339d2d349 ]
The driver is calling framebuffer_release() in its .remove callback, but this will cause the struct fb_info to be freed too early. Since it could be that a reference is still hold to it if user-space opened the fbdev.
This would lead to a use-after-free error if the framebuffer device was unregistered but later a user-space process tries to close the fbdev fd.
To prevent this, move the framebuffer_release() call to fb_ops.fb_destroy instead of doing it in the driver's .remove callback.
Strictly speaking, the code flow in the driver is still wrong because all the hardware cleanupd (i.e: iounmap) should be done in .remove while the software cleanup (i.e: releasing the framebuffer) should be done in the .fb_destroy handler. But this at least makes to match the behavior before commit 27599aacbaef ("fbdev: Hot-unplug firmware fb devices on forced removal").
--- drivers/video/fbdev/efifb.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/video/fbdev/efifb.c +8 -1
@@ -243,6 +243,10 @@ static void efifb_show_boot_graphics(struct fb_info *info)static inline void efifb_show_boot_graphics (struct fb_info *info) {}#endif +/* +* fb_ops.fb_destroy is called by the last put_fb_info() call at the end +* of unregister_framebuffer() or fb_release(). Do any cleanup here. +*/ static void efifb_destroy (struct fb_info *info) {if (efifb_pci_dev)
@@ -254,6 +258,9 @@ static void efifb_destroy(struct fb_info *info)else memunmap (info->screen_base); } + +framebuffer_release (info); +if (request_mem_succeeded)release_mem_region (info->apertures->ranges[0 ].base, info->apertures->ranges[0 ].size);
@@ -620,9 +627,9 @@ static int efifb_remove(struct platform_device *pdev) {struct fb_info *info =platform_get_drvdata (pdev); +/* efifb_destroy takes care of info cleanup */ unregister_framebuffer (info);sysfs_remove_groups (&pdev->dev.kobj, efifb_groups); -framebuffer_release (info);return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 12/102 fbdev: vesafb: Cleanup fb_info in .fb_destroy rather than .remove
In reply to Greg Kroah-HartmanFrom: Javier Martinez Canillas <[email protected]>
[ Upstream commit b3c9a924aab61adbc29df110006aa03afe1a78ba ]
The driver is calling framebuffer_release() in its .remove callback, but this will cause the struct fb_info to be freed too early. Since it could be that a reference is still hold to it if user-space opened the fbdev.
This would lead to a use-after-free error if the framebuffer device was unregistered but later a user-space process tries to close the fbdev fd.
To prevent this, move the framebuffer_release() call to fb_ops.fb_destroy instead of doing it in the driver's .remove callback.
Strictly speaking, the code flow in the driver is still wrong because all the hardware cleanupd (i.e: iounmap) should be done in .remove while the software cleanup (i.e: releasing the framebuffer) should be done in the .fb_destroy handler. But this at least makes to match the behavior before commit 27599aacbaef ("fbdev: Hot-unplug firmware fb devices on forced removal").
--- drivers/video/fbdev/vesafb.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/video/fbdev/vesafb.c +7 -1
@@ -179,6 +179,10 @@ static int vesafb_setcolreg(unsigned regno, unsigned red, unsigned green,return err; } +/* +* fb_ops.fb_destroy is called by the last put_fb_info() call at the end +* of unregister_framebuffer() or fb_release(). Do any cleanup here. +*/ static void vesafb_destroy (struct fb_info *info) {struct vesafb_par *par = info->par;
@@ -188,6 +192,8 @@ static void vesafb_destroy(struct fb_info *info)if (info->screen_base)iounmap (info->screen_base);release_mem_region (info->apertures->ranges[0 ].base, info->apertures->ranges[0 ].size); + +framebuffer_release (info); }static struct fb_ops vesafb_ops = {
@@ -484,10 +490,10 @@ static int vesafb_remove(struct platform_device *pdev) {struct fb_info *info =platform_get_drvdata (pdev); +/* vesafb_destroy takes care of info cleanup */ unregister_framebuffer (info);if (((struct vesafb_par *)(info->par))->region)release_region (0x3c0 ,32 ); -framebuffer_release (info);return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 13/102 platform/surface: aggregator: Fix initialization order when compiling as builtin module
In reply to Greg Kroah-HartmanFrom: Maximilian Luz <[email protected]>
[ Upstream commit 44acfc22c7d055d9c4f8f0974ee28422405b971a ]
When building the Surface Aggregator Module (SAM) core, registry, and other SAM client drivers as builtin modules (=y), proper initialization order is not guaranteed. Due to this, client driver registration (triggered by device registration in the registry) races against bus initialization in the core.
If any attempt is made at registering the device driver before the bus has been initialized (i.e. if bus initialization fails this race) driver registration will fail with a message similar to:
Driver surface_battery was unable to register with bus_type surface_aggregator because the bus was not initialized
Switch from module_init() to subsys_initcall() to resolve this issue. Note that the serdev subsystem uses postcore_initcall() so we are still able to safely register the serdev device driver for the core.
--- drivers/platform/surface/aggregator/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/surface/aggregator/core.c +1 -1
@@ -816,7 +816,7 @@ static int __init ssam_core_init(void) err_bus:return status; } -module_init (ssam_core_init); +subsys_initcall (ssam_core_init); static void __exit ssam_core_exit(void) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 14/102 ice: Fix race during aux device (un)plugging
In reply to Greg Kroah-HartmanFrom: Ivan Vecera <[email protected]>
[ Upstream commit 486b9eee57ddca5c9a2d59fc41153f36002e0a00 ]
Function ice_plug_aux_dev() assigns pf->adev field too early prior aux device initialization and on other side ice_unplug_aux_dev() starts aux device deinit and at the end assigns NULL to pf->adev. This is wrong because pf->adev should always be non-NULL only when aux device is fully initialized and ready. This wrong order causes a crash when ice_send_event_to_aux() call occurs because that function depends on non-NULL value of pf->adev and does not assume that aux device is half-initialized or half-destroyed.
After order correction the race window is tiny but it is still there, as Leon mentioned and manipulation with pf->adev needs to be protected by mutex.
Fix (un-)plugging functions so pf->adev field is set after aux device init and prior aux device destroy and protect pf->adev assignment by new mutex. This mutex is also held during ice_send_event_to_aux() call to ensure that aux device is valid during that call. Note that device lock used ice_send_event_to_aux() needs to be kept to avoid race with aux drv unload.
Reproducer:
cycle=1
while :;do
echo "#### Cycle: $cycle"
ip link set ens7f0 mtu 9000
ip link add bond0 type bond mode 1 miimon 100 ip link set bond0 up
ifenslave bond0 ens7f0
ip link set bond0 mtu 9000
ethtool -L ens7f0 combined 1
ip link del bond0
ip link set ens7f0 mtu 1500
sleep 1
let cycle++
done
In short when the device is added/removed to/from bond the aux device is unplugged/plugged. When MTU of the device is changed an event is sent to aux device asynchronously. This can race with (un)plugging operation and because pf->adev is set too early (plug) or too late (unplug) the function ice_send_event_to_aux() can touch uninitialized or destroyed fields. In the case of crash below pf->adev->dev.mutex.
Crash:
[ 53.372066] bond0: (slave ens7f0): making interface the new active one
[ 53.378622] bond0: (slave ens7f0): Enslaving as an active interface with an u
p link
[ 53.386294] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 53.549104] bond0: (slave ens7f1): Enslaving as a backup interface with an up
link
[ 54.118906] ice 0000:ca:00.0 ens7f0: Number of in use tx queues changed inval
idating tc mappings. Priority traffic classification disabled!
[ 54.233374] ice 0000:ca:00.1 ens7f1: Number of in use tx queues changed inval
idating tc mappings. Priority traffic classification disabled!
[ 54.248204] bond0: (slave ens7f0): Releasing backup interface
[ 54.253955] bond0: (slave ens7f1): making interface the new active one
[ 54.274875] bond0: (slave ens7f1): Releasing backup interface
[ 54.289153] bond0 (unregistering): Released all slaves
[ 55.383179] MII link monitoring set to 100 ms
[ 55.398696] bond0: (slave ens7f0): making interface the new active one
[ 55.405241] BUG: kernel NULL pointer dereference, address: 0000000000000080
[ 55.405289] bond0: (slave ens7f0): Enslaving as an active interface with an u
p link
[ 55.412198] #PF: supervisor write access in kernel mode
[ 55.412200] #PF: error_code(0x0002) - not-present page
[ 55.412201] PGD 25d2ad067 P4D 0
[ 55.412204] Oops: 0002 [#1] PREEMPT SMP NOPTI
[ 55.412207] CPU: 0 PID: 403 Comm: kworker/0:2 Kdump: loaded Tainted: G S
5.17.0-13579-g57f2d6540f03 #1
[ 55.429094] bond0: (slave ens7f1): Enslaving as a backup interface with an up
link
[ 55.430224] Hardware name: Dell Inc. PowerEdge R750/06V45N, BIOS 1.4.4 10/07/
2021
[ 55.430226] Workqueue: ice ice_service_task [ice]
[ 55.468169] RIP: 0010:mutex_unlock+0x10/0x20
[ 55.472439] Code: 0f b1 13 74 96 eb e0 4c 89 ee eb d8 e8 79 54 ff ff 66 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 65 48 8b 04 25 40 ef 01 00 31 d2 <f0> 48 0f b1 17 75 01 c3 e9 e3 fe ff ff 0f 1f 00 0f 1f 44 00 00 48
[ 55.491186] RSP: 0018:ff4454230d7d7e28 EFLAGS: 00010246
[ 55.496413] RAX: ff1a79b208b08000 RBX: ff1a79b2182e8880 RCX: 0000000000000001
[ 55.503545] RDX: 0000000000000000 RSI: ff4454230d7d7db0 RDI: 0000000000000080
[ 55.510678] RBP: ff1a79d1c7e48b68 R08: ff4454230d7d7db0 R09: 0000000000000041
[ 55.517812] R10: 00000000000000a5 R11: 00000000000006e6 R12: ff1a79d1c7e48bc0
[ 55.524945] R13: 0000000000000000 R14: ff1a79d0ffc305c0 R15: 0000000000000000
[ 55.532076] FS: 0000000000000000(0000) GS:ff1a79d0ffc00000(0000) knlGS:0000000000000000
[ 55.540163] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 55.545908] CR2: 0000000000000080 CR3: 00000003487ae003 CR4: 0000000000771ef0
[ 55.553041] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 55.560173] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 55.567305] PKRU: 55555554
[ 55.570018] Call Trace:
[ 55.572474] <TASK>
[ 55.574579] ice_service_task+0xaab/0xef0 [ice]
[ 55.579130] process_one_work+0x1c5/0x390
[ 55.583141] ? process_one_work+0x390/0x390
[ 55.587326] worker_thread+0x30/0x360
[ 55.590994] ? process_one_work+0x390/0x390
[ 55.595180] kthread+0xe6/0x110
[ 55.598325] ? kthread_complete_and_exit+0x20/0x20
[ 55.603116] ret_from_fork+0x1f/0x30
[ 55.606698] </TASK>--- drivers/net/ethernet/intel/ice/ice.h | 1 + drivers/net/ethernet/intel/ice/ice_idc.c | 25 +++++++++++++++-------- drivers/net/ethernet/intel/ice/ice_main.c | 2 ++ 3 files changed, 20 insertions(+), 8 deletions(-)
drivers/net/ethernet/intel/ice/ice.h +1 -0
@@ -452,6 +452,7 @@ struct ice_pf {struct mutex avail_q_mutex;/* protects access to avail_[rx|tx]qs */ struct mutex sw_mutex;/* lock for protecting VSI alloc flow */ struct mutex tc_mutex;/* lock to protect TC changes */ +struct mutex adev_mutex;/* lock to protect aux device access */ u32 msg_enable;struct ice_ptp ptp;u16 num_rdma_msix;/* Total MSIX vectors for RDMA driver */
drivers/net/ethernet/intel/ice/ice_idc.c +17 -8
@@ -37,14 +37,17 @@ void ice_send_event_to_aux(struct ice_pf *pf, struct iidc_event *event)if (WARN_ON_ONCE (!in_task ()))return ; +mutex_lock (&pf->adev_mutex);if (!pf->adev) -return ; + goto finish;device_lock (&pf->adev->dev); iadrv =ice_get_auxiliary_drv (pf);if (iadrv && iadrv->event_handler) iadrv->event_handler (pf, event);device_unlock (&pf->adev->dev); +finish: +mutex_unlock (&pf->adev_mutex); }/**
@@ -285,7 +288,6 @@ int ice_plug_aux_dev(struct ice_pf *pf)return -ENOMEM ; adev = &iadev->adev; - pf->adev = adev; iadev->pf = pf; adev->id = pf->aux_idx;
@@ -295,18 +297,20 @@ int ice_plug_aux_dev(struct ice_pf *pf) ret =auxiliary_device_init (adev);if (ret) { - pf->adev =NULL ;kfree (iadev);return ret; } ret =auxiliary_device_add (adev);if (ret) { - pf->adev =NULL ;auxiliary_device_uninit (adev);return ret; } +mutex_lock (&pf->adev_mutex); + pf->adev = adev; +mutex_unlock (&pf->adev_mutex); +return 0 ; }
@@ -315,12 +319,17 @@ int ice_plug_aux_dev(struct ice_pf *pf)*/ void ice_unplug_aux_dev (struct ice_pf *pf) { -if (!pf->adev) -return ; +struct auxiliary_device *adev; -auxiliary_device_delete (pf->adev); -auxiliary_device_uninit (pf->adev); +mutex_lock (&pf->adev_mutex); + adev = pf->adev; pf->adev =NULL ; +mutex_unlock (&pf->adev_mutex); + +if (adev) { +auxiliary_device_delete (adev); +auxiliary_device_uninit (adev); + } }/**
drivers/net/ethernet/intel/ice/ice_main.c +2 -0
@@ -3447,6 +3447,7 @@ u16 ice_get_avail_rxq_count(struct ice_pf *pf)static void ice_deinit_pf (struct ice_pf *pf) {ice_service_task_stop (pf); +mutex_destroy (&pf->adev_mutex);mutex_destroy (&pf->sw_mutex);mutex_destroy (&pf->tc_mutex);mutex_destroy (&pf->avail_q_mutex);
@@ -3527,6 +3528,7 @@ static int ice_init_pf(struct ice_pf *pf)mutex_init (&pf->sw_mutex);mutex_init (&pf->tc_mutex); +mutex_init (&pf->adev_mutex);INIT_HLIST_HEAD (&pf->aq_wait_list);spin_lock_init (&pf->aq_wait_lock);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 15/102 ice: fix PTP stale Tx timestamps cleanup
In reply to Greg Kroah-HartmanFrom: Michal Michalik <[email protected]>
[ Upstream commit a11b6c1a383ff092f432e040c20e032503785d47 ]
Read stale PTP Tx timestamps from PHY on cleanup.
After running out of Tx timestamps request handlers, hardware (HW) stops reporting finished requests. Function ice_ptp_tx_tstamp_cleanup() used to only clean up stale handlers in driver and was leaving the hardware registers not read. Not reading stale PTP Tx timestamps prevents next interrupts from arriving and makes timestamping unusable.
--- drivers/net/ethernet/intel/ice/ice_ptp.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/ice/ice_ptp.c +8 -2
@@ -1375,6 +1375,7 @@ ice_ptp_init_tx_e810(struct ice_pf *pf, struct ice_ptp_tx *tx)/** * ice_ptp_tx_tstamp_cleanup - Cleanup old timestamp requests that got dropped +* @hw: pointer to the hw struct * @tx: PTP Tx tracker to clean up * * Loop through the Tx timestamp requests and see if any of them have been
@@ -1383,7 +1384,7 @@ ice_ptp_init_tx_e810(struct ice_pf *pf, struct ice_ptp_tx *tx)* timestamp will never be captured. This might happen if the packet gets * discarded before it reaches the PHY timestamping block. */ -static void ice_ptp_tx_tstamp_cleanup (struct ice_ptp_tx *tx) +static void ice_ptp_tx_tstamp_cleanup (struct ice_hw *hw,struct ice_ptp_tx *tx) {u8 idx;
@@ -1392,11 +1393,16 @@ static void ice_ptp_tx_tstamp_cleanup(struct ice_ptp_tx *tx)for_each_set_bit (idx, tx->in_use, tx->len) {struct sk_buff *skb; +u64 raw_tstamp;/* Check if this SKB has been waiting for too long */ if (time_is_after_jiffies (tx->tstamps[idx].start +2 *HZ ))continue ; +/* Read tstamp to be able to use this register again */ +ice_read_phy_tstamp (hw, tx->quad, idx + tx->quad_offset, + &raw_tstamp); +spin_lock (&tx->lock); skb = tx->tstamps[idx].skb; tx->tstamps[idx].skb =NULL ;
@@ -1418,7 +1424,7 @@ static void ice_ptp_periodic_work(struct kthread_work *work)ice_ptp_update_cached_phctime (pf); -ice_ptp_tx_tstamp_cleanup (&pf->ptp.port.tx); +ice_ptp_tx_tstamp_cleanup (&pf->hw, &pf->ptp.port.tx);/* Run twice a second */ kthread_queue_delayed_work(ptp->kworker, &ptp->work,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 16/102 ipv4: drop dst in multicast routing path
In reply to Greg Kroah-HartmanFrom: Lokesh Dhoundiyal <[email protected]>
[ Upstream commit 9e6c6d17d1d6a3f1515ce399f9a011629ec79aa0 ]
kmemleak reports the following when routing multicast traffic over an ipsec tunnel.
Kmemleak output:
unreferenced object 0x8000000044bebb00 (size 256):
comm "softirq", pid 0, jiffies 4294985356 (age 126.810s) hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 00 00 00 05 13 74 80 ..............t.
80 00 00 00 04 9b bf f9 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000f83947e0>] __kmalloc+0x1e8/0x300
[<00000000b7ed8dca>] metadata_dst_alloc+0x24/0x58
[<0000000081d32c20>] __ipgre_rcv+0x100/0x2b8
[<00000000824f6cf1>] gre_rcv+0x178/0x540
[<00000000ccd4e162>] gre_rcv+0x7c/0xd8
[<00000000c024b148>] ip_protocol_deliver_rcu+0x124/0x350
[<000000006a483377>] ip_local_deliver_finish+0x54/0x68
[<00000000d9271b3a>] ip_local_deliver+0x128/0x168
[<00000000bd4968ae>] xfrm_trans_reinject+0xb8/0xf8
[<0000000071672a19>] tasklet_action_common.isra.16+0xc4/0x1b0
[<0000000062e9c336>] __do_softirq+0x1fc/0x3e0
[<00000000013d7914>] irq_exit+0xc4/0xe0
[<00000000a4d73e90>] plat_irq_dispatch+0x7c/0x108
[<000000000751eb8e>] handle_int+0x16c/0x178
[<000000001668023b>] _raw_spin_unlock_irqrestore+0x1c/0x28The metadata dst is leaked when ip_route_input_mc() updates the dst for the skb. Commit f38a9eb1f77b ("dst: Metadata destinations") correctly handled dropping the dst in ip_route_input_slow() but missed the multicast case which is handled by ip_route_input_mc(). Drop the dst in ip_route_input_mc() avoiding the leak.
--- net/ipv4/route.c | 1 + 1 file changed, 1 insertion(+)
net/ipv4/route.c +1 -0
@@ -1754,6 +1754,7 @@ static int ip_route_input_mc(struct sk_buff *skb, __be32 daddr, __be32 saddr,#endif RT_CACHE_STAT_INC (in_slow_mc); +skb_dst_drop (skb);skb_dst_set (skb, &rth->dst);return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 17/102 drm/nouveau: Fix a potential theorical leak in nouveau_get_backlight_name()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit ab244be47a8f111bc82496a8a20c907236e37f95 ]
If successful ida_simple_get() calls are not undone when needed, some additional memory may be allocated and wasted.
Here, an ID between 0 and MAX_INT is required. If this ID is >=100, it is not taken into account and is wasted. It should be released.
Instead of calling ida_simple_remove(), take advantage of the 'max' parameter to require the ID not to be too big. Should it be too big, it is not allocated and don't need to be freed.
While at it, use ida_alloc_xxx()/ida_free() instead to ida_simple_get()/ida_simple_remove().
The latter is deprecated and more verbose.
--- drivers/gpu/drm/nouveau/nouveau_backlight.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/gpu/drm/nouveau/nouveau_backlight.c +5 -4
@@ -46,8 +46,9 @@ static bool nouveau_get_backlight_name(char backlight_name[BL_NAME_SIZE], struct nouveau_backlight *bl) { - const int nb = ida_simple_get(&bl_ida, 0, 0, GFP_KERNEL); -if (nb <0 || nb >=100 ) + const int nb = ida_alloc_max(&bl_ida, 99, GFP_KERNEL); + +if (nb <0 )return false;if (nb >0 )snprintf (backlight_name,BL_NAME_SIZE ,"nv_backlight%d" , nb);
@@ -411,7 +412,7 @@ nouveau_backlight_init(struct drm_connector *connector) nv_encoder, ops, &props);if (IS_ERR (bl->dev)) {if (bl->id >=0 ) -ida_simple_remove (&bl_ida, bl->id); +ida_free (&bl_ida, bl->id); ret =PTR_ERR (bl->dev); goto fail_alloc; }
@@ -439,7 +440,7 @@ nouveau_backlight_fini(struct drm_connector *connector)return ;if (bl->id >=0 ) -ida_simple_remove (&bl_ida, bl->id); +ida_free (&bl_ida, bl->id);backlight_device_unregister (bl->dev); nv_conn->backlight =NULL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 18/102 netlink: do not reset transport header in netlink_recvmsg()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit d5076fe4049cadef1f040eda4aaa001bb5424225 ]
netlink_recvmsg() does not need to change transport header.
If transport header was needed, it should have been reset by the producer (netlink_dump()), not the consumer(s).
The following trace probably happened when multiple threads were using MSG_PEEK.
BUG: KCSAN: data-race in netlink_recvmsg / netlink_recvmsg
write to 0xffff88811e9f15b2 of 2 bytes by task 32012 on cpu 1:
skb_reset_transport_header include/linux/skbuff.h:2760 [inline] netlink_recvmsg+0x1de/0x790 net/netlink/af_netlink.c:1978 sock_recvmsg_nosec net/socket.c:948 [inline] sock_recvmsg net/socket.c:966 [inline] __sys_recvfrom+0x204/0x2c0 net/socket.c:2097 __do_sys_recvfrom net/socket.c:2115 [inline] __se_sys_recvfrom net/socket.c:2111 [inline] __x64_sys_recvfrom+0x74/0x90 net/socket.c:2111 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae
write to 0xffff88811e9f15b2 of 2 bytes by task 32005 on cpu 0:
skb_reset_transport_header include/linux/skbuff.h:2760 [inline] netlink_recvmsg+0x1de/0x790 net/netlink/af_netlink.c:1978 ____sys_recvmsg+0x162/0x2f0 ___sys_recvmsg net/socket.c:2674 [inline] __sys_recvmsg+0x209/0x3f0 net/socket.c:2704 __do_sys_recvmsg net/socket.c:2714 [inline] __se_sys_recvmsg net/socket.c:2711 [inline] __x64_sys_recvmsg+0x42/0x50 net/socket.c:2711 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae
value changed: 0xffff -> 0x0000
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 32005 Comm: syz-executor.4 Not tainted 5.18.0-rc1-syzkaller-00328-ge1f700ebd6be-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
--- net/netlink/af_netlink.c | 1 - 1 file changed, 1 deletion(-)
net/netlink/af_netlink.c +0 -1
@@ -1996,7 +1996,6 @@ static int netlink_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, copied = len; } -skb_reset_transport_header (data_skb); err =skb_copy_datagram_msg (data_skb,0 , msg, copied);if (msg->msg_name) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 19/102 net: chelsio: cxgb4: Avoid potential negative array offset
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
[ Upstream commit 1c7ab9cd98b78bef1657a5db7204d8d437e24c94 ]
Using min_t(int, ...) as a potential array index implies to the compiler that negative offsets should be allowed. This is not the case, though. Replace "int" with "unsigned int". Fixes the following warning exposed under future CONFIG_FORTIFY_SOURCE improvements:
In file included from include/linux/string.h:253,
from include/linux/bitmap.h:11,
from include/linux/cpumask.h:12,
from include/linux/smp.h:13,
from include/linux/lockdep.h:14,
from include/linux/rcupdate.h:29,
from include/linux/rculist.h:11,
from include/linux/pid.h:5,
from include/linux/sched.h:14,
from include/linux/delay.h:23,
from drivers/net/ethernet/chelsio/cxgb4/t4_hw.c:35:
drivers/net/ethernet/chelsio/cxgb4/t4_hw.c: In function 't4_get_raw_vpd_params':
include/linux/fortify-string.h:46:33: warning: '__builtin_memcpy' pointer overflow between offset 29 and size [2147483648, 4294967295] [-Warray-bounds]
46 | #define __underlying_memcpy __builtin_memcpy
| ^
include/linux/fortify-string.h:388:9: note: in expansion of macro '__underlying_memcpy'
388 | __underlying_##op(p, q, __fortify_size); \
| ^~~~~~~~~~~~~
include/linux/fortify-string.h:433:26: note: in expansion of macro '__fortify_memcpy_chk'
433 | #define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \
| ^~~~~~~~~~~~~~~~~~~~
drivers/net/ethernet/chelsio/cxgb4/t4_hw.c:2796:9: note: in expansion of macro 'memcpy'
2796 | memcpy(p->id, vpd + id, min_t(int, id_len, ID_LEN));
| ^~~~~~
include/linux/fortify-string.h:46:33: warning: '__builtin_memcpy' pointer overflow between offset 0 and size [2147483648, 4294967295] [-Warray-bounds]
46 | #define __underlying_memcpy __builtin_memcpy
| ^
include/linux/fortify-string.h:388:9: note: in expansion of macro '__underlying_memcpy'
388 | __underlying_##op(p, q, __fortify_size); \
| ^~~~~~~~~~~~~
include/linux/fortify-string.h:433:26: note: in expansion of macro '__fortify_memcpy_chk'
433 | #define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \
| ^~~~~~~~~~~~~~~~~~~~
drivers/net/ethernet/chelsio/cxgb4/t4_hw.c:2798:9: note: in expansion of macro 'memcpy'
2798 | memcpy(p->sn, vpd + sn, min_t(int, sn_len, SERNUM_LEN));
| ^~~~~~Additionally remove needless cast from u8[] to char * in last strim() call.
--- drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +5 -5
@@ -2793,14 +2793,14 @@ int t4_get_raw_vpd_params(struct adapter *adapter, struct vpd_params *p) goto out; na = ret; -memcpy (p->id, vpd + id,min_t (int, id_len,ID_LEN )); + memcpy(p->id, vpd + id, min_t(unsigned int, id_len, ID_LEN));strim (p->id); -memcpy (p->sn, vpd + sn,min_t (int, sn_len,SERNUM_LEN )); + memcpy(p->sn, vpd + sn, min_t(unsigned int, sn_len, SERNUM_LEN));strim (p->sn); -memcpy (p->pn, vpd + pn,min_t (int, pn_len,PN_LEN )); + memcpy(p->pn, vpd + pn, min_t(unsigned int, pn_len, PN_LEN));strim (p->pn); -memcpy (p->na, vpd + na,min_t (int, na_len,MACADDR_LEN )); -strim ((char *)p->na); + memcpy(p->na, vpd + na, min_t(unsigned int, na_len, MACADDR_LEN)); +strim (p->na); out:vfree (vpd);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 20/102 fbdev: efifb: Fix a use-after-free due early fb_info cleanup
In reply to Greg Kroah-HartmanFrom: Javier Martinez Canillas <[email protected]>
[ Upstream commit 1b5853dfab7fdde450f00f145327342238135c8a ]
Commit d258d00fb9c7 ("fbdev: efifb: Cleanup fb_info in .fb_destroy rather than .remove") attempted to fix a use-after-free error due driver freeing the fb_info in the .remove handler instead of doing it in .fb_destroy.
But ironically that change introduced yet another use-after-free since the fb_info was still used after the free.
This should fix for good by freeing the fb_info at the end of the handler.
--- drivers/video/fbdev/efifb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/video/fbdev/efifb.c +2 -2
@@ -259,12 +259,12 @@ static void efifb_destroy(struct fb_info *info)memunmap (info->screen_base); } -framebuffer_release (info); -if (request_mem_succeeded)release_mem_region (info->apertures->ranges[0 ].base, info->apertures->ranges[0 ].size);fb_dealloc_cmap (&info->cmap); + +framebuffer_release (info); }static const struct fb_ops efifb_ops = {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 21/102 sfc: Use swap() instead of open coding it
In reply to Greg Kroah-HartmanFrom: Jiapeng Chong <[email protected]>
[ Upstream commit 0cf765fb00ce083c017f2571ac449cf7912cdb06 ]
Clean the following coccicheck warning:
./drivers/net/ethernet/sfc/efx_channels.c:870:36-37: WARNING opportunity for swap().
./drivers/net/ethernet/sfc/efx_channels.c:824:36-37: WARNING opportunity for swap().
--- drivers/net/ethernet/sfc/efx_channels.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-)
drivers/net/ethernet/sfc/efx_channels.c +4 -10
@@ -897,11 +897,8 @@ int efx_realloc_channels(struct efx_nic *efx, u32 rxq_entries, u32 txq_entries) old_txq_entries = efx->txq_entries; efx->rxq_entries = rxq_entries; efx->txq_entries = txq_entries; -for (i =0 ; i < efx->n_channels; i++) { - channel = efx->channel[i]; - efx->channel[i] = other_channel[i]; - other_channel[i] = channel; - } +for (i =0 ; i < efx->n_channels; i++) +swap (efx->channel[i], other_channel[i]);/* Restart buffer table allocation */ efx->next_buffer_table = next_buffer_table;
@@ -944,11 +941,8 @@ int efx_realloc_channels(struct efx_nic *efx, u32 rxq_entries, u32 txq_entries)/* Swap back */ efx->rxq_entries = old_rxq_entries; efx->txq_entries = old_txq_entries; -for (i =0 ; i < efx->n_channels; i++) { - channel = efx->channel[i]; - efx->channel[i] = other_channel[i]; - other_channel[i] = channel; - } +for (i =0 ; i < efx->n_channels; i++) +swap (efx->channel[i], other_channel[i]); goto out; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 22/102 net: sfc: fix memory leak due to ptp channel
In reply to Greg Kroah-HartmanFrom: Taehee Yoo <[email protected]>
[ Upstream commit 49e6123c65dac6393b04f39ceabf79c44f66b8be ]
It fixes memory leak in ring buffer change logic.
When ring buffer size is changed(ethtool -G eth0 rx 4096), sfc driver works like below.
1. stop all channels and remove ring buffers.
2. allocates new buffer array.
3. allocates rx buffers.
4. start channels.
While the above steps are working, it skips some steps if the channel doesn't have a ->copy callback function.
Due to ptp channel doesn't have ->copy callback, these above steps are skipped for ptp channel.
It eventually makes some problems.
a. ptp channel's ring buffer size is not changed, it works only
1024(default).
b. memory leak.
The reason for memory leak is to use the wrong ring buffer values. There are some values, which is related to ring buffer size. a. efx->rxq_entries
- This is global value of rx queue size.
b. rx_queue->ptr_mask
- used for access ring buffer as circular ring.
- roundup_pow_of_two(efx->rxq_entries) - 1
c. rx_queue->max_fill
- efx->rxq_entries - EFX_RXD_HEAD_ROOM
These all values should be based on ring buffer size consistently. But ptp channel's values are not.
a. efx->rxq_entries
- This is global(for sfc) value, always new ring buffer size.
b. rx_queue->ptr_mask
- This is always 1023(default).
c. rx_queue->max_fill
- This is new ring buffer size - EFX_RXD_HEAD_ROOM.
Let's assume we set 4096 for rx ring buffer,
normal channel ptp channel efx->rxq_entries 4096 4096 rx_queue->ptr_mask 4095 1023 rx_queue->max_fill 4086 4086
sfc driver allocates rx ring buffers based on these values. When it allocates ptp channel's ring buffer, 4086 ring buffers are allocated then, these buffers are attached to the allocated array. But ptp channel's ring buffer array size is still 1024(default) and ptr_mask is still 1023 too.
So, 3062 ring buffers will be overwritten to the array. This is the reason for memory leak.
Test commands:
ethtool -G <interface name> rx 4096
while :
do
ip link set <interface name> up
ip link set <interface name> down
done
In order to avoid this problem, it adds ->copy callback to ptp channel type.
So that rx_queue->ptr_mask value will be updated correctly.
--- drivers/net/ethernet/sfc/efx_channels.c | 7 ++++++- drivers/net/ethernet/sfc/ptp.c | 14 +++++++++++++- drivers/net/ethernet/sfc/ptp.h | 1 + 3 files changed, 20 insertions(+), 2 deletions(-)
drivers/net/ethernet/sfc/efx_channels.c +6 -1
@@ -844,7 +844,9 @@ static void efx_set_xdp_channels(struct efx_nic *efx)int efx_realloc_channels (struct efx_nic *efx,u32 rxq_entries,u32 txq_entries) { -struct efx_channel *other_channel[EFX_MAX_CHANNELS ], *channel; +struct efx_channel *other_channel[EFX_MAX_CHANNELS ], *channel, + *ptp_channel =efx_ptp_channel (efx); +struct efx_ptp_data *ptp_data = efx->ptp_data;unsigned int i, next_buffer_table =0 ;u32 old_rxq_entries, old_txq_entries;int rc, rc2;
@@ -915,6 +917,7 @@ int efx_realloc_channels(struct efx_nic *efx, u32 rxq_entries, u32 txq_entries)efx_set_xdp_channels (efx); out: + efx->ptp_data =NULL ;/* Destroy unused channel structures */ for (i =0 ; i < efx->n_channels; i++) { channel = other_channel[i];
@@ -925,6 +928,7 @@ int efx_realloc_channels(struct efx_nic *efx, u32 rxq_entries, u32 txq_entries) } } + efx->ptp_data = ptp_data; rc2 =efx_soft_enable_interrupts (efx);if (rc2) { rc = rc ? rc : rc2;
@@ -943,6 +947,7 @@ int efx_realloc_channels(struct efx_nic *efx, u32 rxq_entries, u32 txq_entries) efx->txq_entries = old_txq_entries;for (i =0 ; i < efx->n_channels; i++)swap (efx->channel[i], other_channel[i]); +efx_ptp_update_channel (efx, ptp_channel); goto out; }
drivers/net/ethernet/sfc/ptp.c +13 -1
@@ -45,6 +45,7 @@#include "farch_regs.h" #include "tx.h" #include "nic.h" /* indirectly includes ptp.h */ +#include "efx_channels.h" /* Maximum number of events expected to make up a PTP event */ #define MAX_EVENT_FRAGS 3
@@ -541,6 +542,12 @@ struct efx_channel *efx_ptp_channel(struct efx_nic *efx)return efx->ptp_data ? efx->ptp_data->channel :NULL ; } +void efx_ptp_update_channel (struct efx_nic *efx,struct efx_channel *channel) +{ +if (efx->ptp_data) + efx->ptp_data->channel = channel; +} +static u32 last_sync_timestamp_major (struct efx_nic *efx) {struct efx_channel *channel =efx_ptp_channel (efx);
@@ -1443,6 +1450,11 @@ int efx_ptp_probe(struct efx_nic *efx, struct efx_channel *channel)int rc =0 ;unsigned int pos; +if (efx->ptp_data) { + efx->ptp_data->channel = channel; +return 0 ; + } + ptp =kzalloc (sizeof (struct efx_ptp_data ),GFP_KERNEL ); efx->ptp_data = ptp;if (!efx->ptp_data)
@@ -2179,7 +2191,7 @@ static const struct efx_channel_type efx_ptp_channel_type = { .pre_probe = efx_ptp_probe_channel, .post_remove = efx_ptp_remove_channel, .get_name = efx_ptp_get_channel_name, -/* no copy operation; there is no need to reallocate this channel */ + .copy = efx_copy_channel, .receive_skb = efx_ptp_rx, .want_txqs = efx_ptp_want_txqs, .keep_eventq = false,
drivers/net/ethernet/sfc/ptp.h +1 -0
@@ -16,6 +16,7 @@ struct ethtool_ts_info;int efx_ptp_probe (struct efx_nic *efx,struct efx_channel *channel);void efx_ptp_defer_probe_with_channel (struct efx_nic *efx);struct efx_channel *efx_ptp_channel (struct efx_nic *efx); +void efx_ptp_update_channel (struct efx_nic *efx,struct efx_channel *channel);void efx_ptp_remove (struct efx_nic *efx);int efx_ptp_set_ts_config (struct efx_nic *efx,struct ifreq *ifr);int efx_ptp_get_ts_config (struct efx_nic *efx,struct ifreq *ifr);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 23/102 mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit 9e2db50f1ef2238fc2f71c5de1c0418b7a5b0ea2 ]
This is needed since it might use (and pass out) pointers to e.g. keys protected by RCU. Can't really happen here as the frames aren't encrypted, but we need to still adhere to the rules.
--- drivers/net/wireless/mac80211_hwsim.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/mac80211_hwsim.c +3 -0
@@ -2336,11 +2336,13 @@ static void hw_scan_work(struct work_struct *work)if (req->ie_len)skb_put_data (probe, req->ie, req->ie_len); +rcu_read_lock ();if (!ieee80211_tx_prepare_skb (hwsim->hw, hwsim->hw_scan_vif, probe, hwsim->tmp_chan->band,NULL )) { +rcu_read_unlock ();kfree_skb (probe);continue ; }
@@ -2348,6 +2350,7 @@ static void hw_scan_work(struct work_struct *work)local_bh_disable ();mac80211_hwsim_tx_frame (hwsim->hw, probe, hwsim->tmp_chan); +rcu_read_unlock ();local_bh_enable (); } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 24/102 nfs: fix broken handling of the softreval mount option
In reply to Greg Kroah-HartmanFrom: Dan Aloni <[email protected]>
[ Upstream commit 085d16d5f949b64713d5e960d6c9bbf51bc1d511 ]
Turns out that ever since this mount option was added, passing softreval in NFS mount options cancelled all other flags while not affecting the underlying flag NFS_MOUNT_SOFTREVAL.
--- fs/nfs/fs_context.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/fs_context.c +1 -1
@@ -514,7 +514,7 @@ static int nfs_fs_context_parse_param(struct fs_context *fc,if (result.negated) ctx->flags &= ~NFS_MOUNT_SOFTREVAL ;else - ctx->flags &=NFS_MOUNT_SOFTREVAL ; + ctx->flags |=NFS_MOUNT_SOFTREVAL ;break ;case Opt_posix:if (result.negated)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 25/102 ionic: fix missing pci_release_regions() on error in ionic_probe()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit e4b1045bf9cfec6f70ac6d3783be06c3a88dcb25 ]
If ionic_map_bars() fails, pci_release_regions() need be called.
--- drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c +2 -1
@@ -255,7 +255,7 @@ static int ionic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) err =ionic_map_bars (ionic);if (err) - goto err_out_pci_disable_device; + goto err_out_pci_release_regions;/* Configure the device */ err =ionic_setup (ionic);
@@ -359,6 +359,7 @@ static int ionic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) err_out_unmap_bars:ionic_unmap_bars (ionic); +err_out_pci_release_regions:pci_release_regions (pdev); err_out_pci_disable_device:pci_disable_device (pdev);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 26/102 dim: initialize all struct fields
In reply to Greg Kroah-HartmanFrom: Jesse Brandeburg <[email protected]>
[ Upstream commit ee1444b5e1df4155b591d0d9b1e72853a99ea861 ]
The W=2 build pointed out that the code wasn't initializing all the variables in the dim_cq_moder declarations with the struct initializers. The net change here is zero since these structs were already static const globals and were initialized with zeros by the compiler, but removing compiler warnings has value in and of itself.
lib/dim/net_dim.c: At top level:lib/dim/net_dim.c:54:9: warning: missing initializer for field ‘comps’ of ‘const struct dim_cq_moder’ [-Wmissing-field-initializers]
54 | NET_DIM_RX_EQE_PROFILES,
| ^~~~~~~~~~~~~~~~~~~~~~~
In file included from lib/dim/net_dim.c:6:
./include/linux/dim.h:45:13: note: ‘comps’ declared here
45 | u16 comps;
| ^~~~~and repeats for the tx struct, and once you fix the comps entry then the cq_period_mode field needs the same treatment.
Use the commonly accepted style to indicate to the compiler that we know what we're doing, and add a comma at the end of each struct initializer to clean up the issue, and use explicit initializers for the fields we are initializing which makes the compiler happy.
While here and fixing these lines, clean up the code slightly with a fix for the super long lines by removing the word "_MODERATION" from a couple defines only used in this file.
--- lib/dim/net_dim.c | 44 ++++++++++++++++++++++---------------------- 1 file changed, 22 insertions(+), 22 deletions(-)
lib/dim/net_dim.c +22 -22
@@ -12,41 +12,41 @@* Each profile size must be of NET_DIM_PARAMS_NUM_PROFILES */ #define NET_DIM_PARAMS_NUM_PROFILES 5 -#define NET_DIM_DEFAULT_RX_CQ_MODERATION_PKTS_FROM_EQE 256 -#define NET_DIM_DEFAULT_TX_CQ_MODERATION_PKTS_FROM_EQE 128 +#define NET_DIM_DEFAULT_RX_CQ_PKTS_FROM_EQE 256 +#define NET_DIM_DEFAULT_TX_CQ_PKTS_FROM_EQE 128#define NET_DIM_DEF_PROFILE_CQE 1#define NET_DIM_DEF_PROFILE_EQE 1#define NET_DIM_RX_EQE_PROFILES { \ - {1, NET_DIM_DEFAULT_RX_CQ_MODERATION_PKTS_FROM_EQE}, \ - {8, NET_DIM_DEFAULT_RX_CQ_MODERATION_PKTS_FROM_EQE}, \ - {64, NET_DIM_DEFAULT_RX_CQ_MODERATION_PKTS_FROM_EQE}, \ - {128, NET_DIM_DEFAULT_RX_CQ_MODERATION_PKTS_FROM_EQE}, \ - {256, NET_DIM_DEFAULT_RX_CQ_MODERATION_PKTS_FROM_EQE}, \ + {.usec = 1, .pkts = NET_DIM_DEFAULT_RX_CQ_PKTS_FROM_EQE,}, \ + {.usec = 8, .pkts = NET_DIM_DEFAULT_RX_CQ_PKTS_FROM_EQE,}, \ + {.usec = 64, .pkts = NET_DIM_DEFAULT_RX_CQ_PKTS_FROM_EQE,}, \ + {.usec = 128, .pkts = NET_DIM_DEFAULT_RX_CQ_PKTS_FROM_EQE,}, \ + {.usec = 256, .pkts = NET_DIM_DEFAULT_RX_CQ_PKTS_FROM_EQE,} \ }#define NET_DIM_RX_CQE_PROFILES { \ - {2, 256}, \ - {8, 128}, \ - {16, 64}, \ - {32, 64}, \ - {64, 64} \ + {.usec = 2, .pkts = 256,}, \ + {.usec = 8, .pkts = 128,}, \ + {.usec = 16, .pkts = 64,}, \ + {.usec = 32, .pkts = 64,}, \ + {.usec = 64, .pkts = 64,} \ }#define NET_DIM_TX_EQE_PROFILES { \ - {1, NET_DIM_DEFAULT_TX_CQ_MODERATION_PKTS_FROM_EQE}, \ - {8, NET_DIM_DEFAULT_TX_CQ_MODERATION_PKTS_FROM_EQE}, \ - {32, NET_DIM_DEFAULT_TX_CQ_MODERATION_PKTS_FROM_EQE}, \ - {64, NET_DIM_DEFAULT_TX_CQ_MODERATION_PKTS_FROM_EQE}, \ - {128, NET_DIM_DEFAULT_TX_CQ_MODERATION_PKTS_FROM_EQE} \ + {.usec = 1, .pkts = NET_DIM_DEFAULT_TX_CQ_PKTS_FROM_EQE,}, \ + {.usec = 8, .pkts = NET_DIM_DEFAULT_TX_CQ_PKTS_FROM_EQE,}, \ + {.usec = 32, .pkts = NET_DIM_DEFAULT_TX_CQ_PKTS_FROM_EQE,}, \ + {.usec = 64, .pkts = NET_DIM_DEFAULT_TX_CQ_PKTS_FROM_EQE,}, \ + {.usec = 128, .pkts = NET_DIM_DEFAULT_TX_CQ_PKTS_FROM_EQE,} \ }#define NET_DIM_TX_CQE_PROFILES { \ - {5, 128}, \ - {8, 64}, \ - {16, 32}, \ - {32, 32}, \ - {64, 32} \ + {.usec = 5, .pkts = 128,}, \ + {.usec = 8, .pkts = 64,}, \ + {.usec = 16, .pkts = 32,}, \ + {.usec = 32, .pkts = 32,}, \ + {.usec = 64, .pkts = 32,} \ } static const struct dim_cq_moder
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 27/102 hwmon: (ltq-cputemp) restrict it to SOC_XWAY
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 151d6dcbed836270c6c240932da66f147950cbdb ]
Building with SENSORS_LTQ_CPUTEMP=y with SOC_FALCON=y causes build errors since FALCON does not support the same features as XWAY.
Change this symbol to depend on SOC_XWAY since that provides the necessary interfaces.
Repairs these build errors:
../drivers/hwmon/ltq-cputemp.c: In function 'ltq_cputemp_enable':../drivers/hwmon/ltq-cputemp.c:23:9: error: implicit declaration of function 'ltq_cgu_w32'; did you mean 'ltq_ebu_w32'? [-Werror=implicit-function-declaration]
23 | ltq_cgu_w32(ltq_cgu_r32(CGU_GPHY1_CR) | CGU_TEMP_PD, CGU_GPHY1_CR);../drivers/hwmon/ltq-cputemp.c:23:21: error: implicit declaration of function 'ltq_cgu_r32'; did you mean 'ltq_ebu_r32'? [-Werror=implicit-function-declaration]
23 | ltq_cgu_w32(ltq_cgu_r32(CGU_GPHY1_CR) | CGU_TEMP_PD, CGU_GPHY1_CR);../drivers/hwmon/ltq-cputemp.c: In function 'ltq_cputemp_probe':../drivers/hwmon/ltq-cputemp.c:92:31: error: 'SOC_TYPE_VR9_2' undeclared (first use in this function)
92 | if (ltq_soc_type() != SOC_TYPE_VR9_2)
--- drivers/hwmon/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/Kconfig +1 -1
@@ -944,7 +944,7 @@ config SENSORS_LTC4261 config SENSORS_LTQ_CPUTEMP bool "Lantiq cpu temperature sensor driver" - depends on LANTIQ + depends on SOC_XWAY help If you say yes here you get support for the temperature sensor inside your CPU.
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 28/102 procfs: prevent unprivileged processes accessing fdinfo dir
In reply to Greg Kroah-HartmanFrom: Kalesh Singh <[email protected]>
[ Upstream commit 1927e498aee1757b3df755a194cbfc5cc0f2b663 ]
The file permissions on the fdinfo dir from were changed from S_IRUSR|S_IXUSR to S_IRUGO|S_IXUGO, and a PTRACE_MODE_READ check was added for opening the fdinfo files [1]. However, the ptrace permission check was not added to the directory, allowing anyone to get the open FD numbers by reading the fdinfo directory.
Add the missing ptrace permission check for opening the fdinfo directory.
[1] https://lkml.kernel.org/r/[email protected]
--- fs/proc/fd.c | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-)
fs/proc/fd.c +22 -1
@@ -72,7 +72,7 @@ static int seq_show(struct seq_file *m, void *v)return 0 ; } -static int seq_fdinfo_open (struct inode *inode,struct file *file) +static int proc_fdinfo_access_allowed (struct inode *inode) {bool allowed = false;struct task_struct *task =get_proc_task (inode);
@@ -86,6 +86,16 @@ static int seq_fdinfo_open(struct inode *inode, struct file *file)if (!allowed)return -EACCES ; +return 0 ; +} + +static int seq_fdinfo_open (struct inode *inode,struct file *file) +{ +int ret =proc_fdinfo_access_allowed (inode); + +if (ret) +return ret; +return single_open (file, seq_show, inode); }
@@ -348,12 +358,23 @@ static int proc_readfdinfo(struct file *file, struct dir_context *ctx) proc_fdinfo_instantiate); } +static int proc_open_fdinfo (struct inode *inode,struct file *file) +{ +int ret =proc_fdinfo_access_allowed (inode); + +if (ret) +return ret; + +return 0 ; +} +const struct inode_operations proc_fdinfo_inode_operations = { .lookup = proc_lookupfdinfo, .setattr = proc_setattr, };const struct file_operations proc_fdinfo_operations = { + .open = proc_open_fdinfo, .read = generic_read_dir, .iterate_shared = proc_readfdinfo, .llseek = generic_file_llseek,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 29/102 selftests: vm: Makefile: rename TARGETS to VMTARGETS
In reply to Greg Kroah-HartmanFrom: Joel Savitz <[email protected]>
[ Upstream commit 41c240099fe09377b6b9f8272e45d2267c843d3e ]
The tools/testing/selftests/vm/Makefile uses the variable TARGETS internally to generate a list of platform-specific binary build targets suffixed with _{32,64}. When building the selftests using its own Makefile directly, such as via the following command run in a kernel tree:
One receives an error such as the following:
make: Entering directory '/root/linux/tools/testing/selftests'
make --no-builtin-rules ARCH=x86 -C ../../.. headers_install
make[1]: Entering directory '/root/linux'
INSTALL ./usr/include
make[1]: Leaving directory '/root/linux'
make[1]: Entering directory '/root/linux/tools/testing/selftests/vm'
make[1]: *** No rule to make target 'vm.c', needed by '/root/linux/tools/testing/selftests/vm/vm_64'. Stop. make[1]: Leaving directory '/root/linux/tools/testing/selftests/vm'
make: *** [Makefile:175: all] Error 2
make: Leaving directory '/root/linux/tools/testing/selftests'
The TARGETS variable passed to tools/testing/selftests/Makefile collides with the TARGETS used in tools/testing/selftests/vm/Makefile, so rename the latter to VMTARGETS, eliminating the collision with no functional change.
--- tools/testing/selftests/vm/Makefile | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
tools/testing/selftests/vm/Makefile +5 -5
@@ -54,9 +54,9 @@ CAN_BUILD_I386 := $(shell ./../x86/check_cc.sh "$(CC)" ../x86/trivial_32bit_prog CAN_BUILD_X86_64 := $(shell ./../x86/check_cc.sh "$(CC)" ../x86/trivial_64bit_program.c) CAN_BUILD_WITH_NOPIE := $(shell ./../x86/check_cc.sh "$(CC)" ../x86/trivial_program.c -no-pie) -TARGETS := protection_keys -BINARIES_32 := $(TARGETS:%=%_32) -BINARIES_64 := $(TARGETS:%=%_64) +VMTARGETS := protection_keys +BINARIES_32 := $(VMTARGETS:%=%_32) +BINARIES_64 := $(VMTARGETS:%=%_64) ifeq ($(CAN_BUILD_WITH_NOPIE),1) CFLAGS += -no-pie
@@ -109,7 +109,7 @@ $(BINARIES_32): CFLAGS += -m32 -mxsave $(BINARIES_32): LDLIBS += -lrt -ldl -lm $(BINARIES_32): $(OUTPUT)/%_32: %.c $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(notdir $^) $(LDLIBS) -o $@ -$(foreach t,$(TARGETS),$(eval $(call gen-target-rule-32,$(t)))) +$(foreach t,$(VMTARGETS),$(eval $(call gen-target-rule-32,$(t)))) endif ifeq ($(CAN_BUILD_X86_64),1)
@@ -117,7 +117,7 @@ $(BINARIES_64): CFLAGS += -m64 -mxsave $(BINARIES_64): LDLIBS += -lrt -ldl $(BINARIES_64): $(OUTPUT)/%_64: %.c $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(notdir $^) $(LDLIBS) -o $@ -$(foreach t,$(TARGETS),$(eval $(call gen-target-rule-64,$(t)))) +$(foreach t,$(VMTARGETS),$(eval $(call gen-target-rule-64,$(t)))) endif # x86_64 users should be encouraged to install 32-bit libraries
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 30/102 arm64: vdso: fix makefile dependency on vdso.so
In reply to Greg Kroah-HartmanFrom: Joey Gouly <[email protected]>
[ Upstream commit 205f3991a273cac6008ef4db3d1c0dc54d14fb56 ]
There is currently no dependency for vdso*-wrap.S on vdso*.so, which means that you can get a build that uses a stale vdso*-wrap.o.
In commit a5b8ca97fbf8, the file that includes the vdso.so was moved and renamed from arch/arm64/kernel/vdso/vdso.S to arch/arm64/kernel/vdso-wrap.S, when this happened the Makefile was not updated to force the dependcy on vdso.so.
--- arch/arm64/kernel/Makefile | 4 ++++ arch/arm64/kernel/vdso/Makefile | 3 --- arch/arm64/kernel/vdso32/Makefile | 3 --- 3 files changed, 4 insertions(+), 6 deletions(-)
arch/arm64/kernel/Makefile +4 -0
@@ -74,6 +74,10 @@ obj-$(CONFIG_ARM64_MTE) += mte.o obj-y += vdso-wrap.o obj-$(CONFIG_COMPAT_VDSO) += vdso32-wrap.o +# Force dependency (vdso*-wrap.S includes vdso.so through incbin) +$(obj)/vdso-wrap.o: $(obj)/vdso/vdso.so +$(obj)/vdso32-wrap.o: $(obj)/vdso32/vdso.so + obj-y += probes/ head-y := head.o extra-y += $(head-y) vmlinux.lds
arch/arm64/kernel/vdso/Makefile +0 -3
@@ -48,9 +48,6 @@ GCOV_PROFILE := n targets += vdso.lds CPPFLAGS_vdso.lds += -P -C -U$(ARCH) -# Force dependency (incbin is bad) -$(obj)/vdso.o : $(obj)/vdso.so - # Link rule for the .so file, .lds has to be first $(obj)/vdso.so.dbg: $(obj)/vdso.lds $(obj-vdso) FORCE $(call if_changed,vdsold_and_vdso_check)
arch/arm64/kernel/vdso32/Makefile +0 -3
@@ -144,9 +144,6 @@ obj-vdso := $(c-obj-vdso) $(c-obj-vdso-gettimeofday) $(asm-obj-vdso) targets += vdso.lds CPPFLAGS_vdso.lds += -P -C -U$(ARCH) -# Force dependency (vdso.s includes vdso.so through incbin) -$(obj)/vdso.o: $(obj)/vdso.so - include/generated/vdso32-offsets.h: $(obj)/vdso.so.dbg FORCE $(call if_changed,vdsosym)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 31/102 virtio: fix virtio transitional ids
In reply to Greg Kroah-HartmanFrom: Shunsuke Mie <[email protected]>
[ Upstream commit 7ff960a6fe399fdcbca6159063684671ae57eee9 ]
This commit fixes the transitional PCI device ID.
--- include/uapi/linux/virtio_ids.h | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
include/uapi/linux/virtio_ids.h +7 -7
@@ -73,12 +73,12 @@* Virtio Transitional IDs */ -#define VIRTIO_TRANS_ID_NET 1000/* transitional virtio net */ -#define VIRTIO_TRANS_ID_BLOCK 1001/* transitional virtio block */ -#define VIRTIO_TRANS_ID_BALLOON 1002/* transitional virtio balloon */ -#define VIRTIO_TRANS_ID_CONSOLE 1003/* transitional virtio console */ -#define VIRTIO_TRANS_ID_SCSI 1004/* transitional virtio SCSI */ -#define VIRTIO_TRANS_ID_RNG 1005/* transitional virtio rng */ -#define VIRTIO_TRANS_ID_9P 1009/* transitional virtio 9p console */ +#define VIRTIO_TRANS_ID_NET 0x1000/* transitional virtio net */ +#define VIRTIO_TRANS_ID_BLOCK 0x1001/* transitional virtio block */ +#define VIRTIO_TRANS_ID_BALLOON 0x1002/* transitional virtio balloon */ +#define VIRTIO_TRANS_ID_CONSOLE 0x1003/* transitional virtio console */ +#define VIRTIO_TRANS_ID_SCSI 0x1004/* transitional virtio SCSI */ +#define VIRTIO_TRANS_ID_RNG 0x1005/* transitional virtio rng */ +#define VIRTIO_TRANS_ID_9P 0x1009/* transitional virtio 9p console */ #endif /* _LINUX_VIRTIO_IDS_H */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 32/102 s390/ctcm: fix variable dereferenced before check
In reply to Greg Kroah-HartmanFrom: Alexandra Winter <[email protected]>
[ Upstream commit 2c50c6867c85afee6f2b3bcbc50fc9d0083d1343 ]
Found by cppcheck and smatch.
smatch complains aboutdrivers/s390/net/ctcm_sysfs.c:43 ctcm_buffer_write() warn: variable dereferenced before check 'priv' (see line 42)
--- drivers/s390/net/ctcm_sysfs.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/s390/net/ctcm_sysfs.c +3 -2
@@ -39,11 +39,12 @@ static ssize_t ctcm_buffer_write(struct device *dev,struct ctcm_priv *priv =dev_get_drvdata (dev);int rc; - ndev = priv->channel[CTCM_READ ]->netdev; -if (!(priv && priv->channel[CTCM_READ ] && ndev)) { +if (!(priv && priv->channel[CTCM_READ ] && + priv->channel[CTCM_READ ]->netdev)) {CTCM_DBF_TEXT (SETUP ,CTC_DBF_ERROR ,"bfnondev" );return -ENODEV ; } + ndev = priv->channel[CTCM_READ ]->netdev; rc =kstrtouint (buf,0 , &bs1);if (rc)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 33/102 s390/ctcm: fix potential memory leak
In reply to Greg Kroah-HartmanFrom: Alexandra Winter <[email protected]>
[ Upstream commit 0c0b20587b9f25a2ad14db7f80ebe49bdf29920a ]
smatch complains aboutdrivers/s390/net/ctcm_mpc.c:1210 ctcmpc_unpack_skb() warn: possible memory leak of 'mpcginfo'
mpc_action_discontact() did not free mpcginfo. Consolidate the freeing in ctcmpc_unpack_skb().
--- drivers/s390/net/ctcm_mpc.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/s390/net/ctcm_mpc.c +1 -5
@@ -626,8 +626,6 @@ static void mpc_rcvd_sweep_resp(struct mpcg_info *mpcginfo)ctcm_clear_busy_do (dev); } -kfree (mpcginfo); -return ; }
@@ -1192,10 +1190,10 @@ static void ctcmpc_unpack_skb(struct channel *ch, struct sk_buff *pskb) CTCM_FUNTAIL, dev->name); priv->stats.rx_dropped++;/* mpcginfo only used for non-data transfers */ -kfree (mpcginfo);if (do_debug_data)ctcmpc_dump_skb (pskb,-8 ); } +kfree (mpcginfo); } done:
@@ -1977,7 +1975,6 @@ static void mpc_action_rcvd_xid0(fsm_instance *fsm, int event, void *arg) }break ; } -kfree (mpcginfo); CTCM_PR_DEBUG("ctcmpc:%s() %s xid2:%i xid7:%i xidt_p2:%i \n", __func__, ch->id, grp->outstanding_xid2,
@@ -2038,7 +2035,6 @@ static void mpc_action_rcvd_xid7(fsm_instance *fsm, int event, void *arg)mpc_validate_xid (mpcginfo);break ; } -kfree (mpcginfo);return ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 34/102 s390/lcs: fix variable dereferenced before check
In reply to Greg Kroah-HartmanFrom: Alexandra Winter <[email protected]>
[ Upstream commit 671bb35c8e746439f0ed70815968f9a4f20a8deb ]
smatch complains aboutdrivers/s390/net/lcs.c:1741 lcs_get_control() warn: variable dereferenced before check 'card->dev' (see line 1739)
--- drivers/s390/net/lcs.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/s390/net/lcs.c +4 -3
@@ -1735,10 +1735,11 @@ lcs_get_control(struct lcs_card *card, struct lcs_cmd *cmd)lcs_schedule_recovery (card);break ;case LCS_CMD_STOPLAN : -pr_warn ("Stoplan for %s initiated by LGW\n" , - card->dev->name); -if (card->dev) +if (card->dev) { +pr_warn ("Stoplan for %s initiated by LGW\n" , + card->dev->name);netif_carrier_off (card->dev); + }break ;default :LCS_DBF_TEXT (5 , trace,"noLGWcmd" );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 35/102 net/sched: act_pedit: really ensure the skb is writable
In reply to Greg Kroah-HartmanFrom: Paolo Abeni <[email protected]>
[ Upstream commit 8b796475fd7882663a870456466a4fb315cc1bd6 ]
Currently pedit tries to ensure that the accessed skb offset is writable via skb_unclone(). The action potentially allows touching any skb bytes, so it may end-up modifying shared data.
The above causes some sporadic MPTCP self-test failures, due to this code:
tc -n $ns2 filter add dev ns2eth$i egress \ protocol ip prio 1000 \ handle 42 fw \ action pedit munge offset 148 u8 invert \ pipe csum tcp \ index 100
The above modifies a data byte outside the skb head and the skb is a cloned one, carrying a TCP output packet.
This change addresses the issue by keeping track of a rough over-estimate highest skb offset accessed by the action and ensuring such offset is really writable.
Note that this may cause performance regressions in some scenarios, but hopefully pedit is not in the critical path.
--- include/net/tc_act/tc_pedit.h | 1 + net/sched/act_pedit.c | 26 ++++++++++++++++++++++---- 2 files changed, 23 insertions(+), 4 deletions(-)
include/net/tc_act/tc_pedit.h +1 -0
@@ -14,6 +14,7 @@ struct tcf_pedit {struct tc_action common;unsigned char tcfp_nkeys;unsigned char tcfp_flags; +u32 tcfp_off_max_hint;struct tc_pedit_key *tcfp_keys;struct tcf_pedit_key_ex *tcfp_keys_ex; };
net/sched/act_pedit.c +22 -4
@@ -149,7 +149,7 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,struct nlattr *pattr;struct tcf_pedit *p;int ret =0 , err; -int ksize; +int i, ksize;u32 index;if (!nla) {
@@ -228,6 +228,18 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla, p->tcfp_nkeys = parm->nkeys; }memcpy (p->tcfp_keys, parm->keys, ksize); + p->tcfp_off_max_hint =0 ; +for (i =0 ; i < p->tcfp_nkeys; ++i) { +u32 cur = p->tcfp_keys[i].off; + +/* The AT option can read a single byte, we can bound the actual +* value with uchar max. +*/ + cur += (0xff & p->tcfp_keys[i].offmask) >> p->tcfp_keys[i].shift; + +/* Each key touches 4 bytes starting from the computed offset */ + p->tcfp_off_max_hint =max (p->tcfp_off_max_hint, cur +4 ); + } p->tcfp_flags = parm->flags; goto_ch =tcf_action_set_ctrlact (*a, parm->action, goto_ch);
@@ -308,13 +320,18 @@ static int tcf_pedit_act(struct sk_buff *skb, const struct tc_action *a, struct tcf_result *res) {struct tcf_pedit *p =to_pedit (a); +u32 max_offset;int i; -if (skb_unclone (skb,GFP_ATOMIC )) -return p->tcf_action; -spin_lock (&p->tcf_lock); + max_offset = (skb_transport_header_was_set (skb) ? +skb_transport_offset (skb) : +skb_network_offset (skb)) + + p->tcfp_off_max_hint; +if (skb_ensure_writable (skb,min (skb->len, max_offset))) + goto unlock; +tcf_lastuse_update (&p->tcf_tm);if (p->tcfp_nkeys >0 ) {
@@ -403,6 +420,7 @@ static int tcf_pedit_act(struct sk_buff *skb, const struct tc_action *a, p->tcf_qstats.overlimits++; done:bstats_update (&p->tcf_bstats, skb); +unlock:spin_unlock (&p->tcf_lock);return p->tcf_action; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 36/102 net: ethernet: mediatek: ppe: fix wrong size passed to memset()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 00832b1d1a393dfb1b9491d085e5b27e8c25d103 ]
'foe_table' is a pointer, the real size of struct mtk_foe_entry should be pass to memset().
--- drivers/net/ethernet/mediatek/mtk_ppe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mediatek/mtk_ppe.c +1 -1
@@ -395,7 +395,7 @@ static void mtk_ppe_init_foe_table(struct mtk_ppe *ppe)static const u8 skip[] = {12 ,25 ,38 ,51 ,76 ,89 ,102 };int i, k; -memset (ppe->foe_table,0 ,MTK_PPE_ENTRIES *sizeof (ppe->foe_table)); +memset (ppe->foe_table,0 ,MTK_PPE_ENTRIES *sizeof (*ppe->foe_table));if (!IS_ENABLED (CONFIG_SOC_MT7621 ))return ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 37/102 net: bcmgenet: Check for Wake-on-LAN interrupt probe deferral
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit 6b77c06655b8a749c1a3d9ebc51e9717003f7e5a ]
The interrupt controller supplying the Wake-on-LAN interrupt line maybe modular on some platforms (irq-bcm7038-l1.c) and might be probed at a later time than the GENET driver. We need to specifically check for -EPROBE_DEFER and propagate that error to ensure that we eventually fetch the interrupt descriptor.
--- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/broadcom/genet/bcmgenet.c +4 -0
@@ -3950,6 +3950,10 @@ static int bcmgenet_probe(struct platform_device *pdev) goto err; } priv->wol_irq =platform_get_irq_optional (pdev,2 ); +if (priv->wol_irq == -EPROBE_DEFER ) { + err = priv->wol_irq; + goto err; + } priv->base =devm_platform_ioremap_resource (pdev,0 );if (IS_ERR (priv->base)) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 38/102 drm/vc4: hdmi: Fix build error for implicit function declaration
In reply to Greg Kroah-HartmanFrom: Hui Tang <[email protected]>
[ Upstream commit 6fed53de560768bde6d701a7c79c253b45b259e3 ]
drivers/gpu/drm/vc4/vc4_hdmi.c: In function ‘vc4_hdmi_connector_detect’:drivers/gpu/drm/vc4/vc4_hdmi.c:228:7: error: implicit declaration of function ‘gpiod_get_value_cansleep’; did you mean ‘gpio_get_value_cansleep’? [-Werror=implicit-function-declaration]
if (gpiod_get_value_cansleep(vc4_hdmi->hpd_gpio))
^~~~~~~~~~~~~~~~~~~~~~~~
gpio_get_value_cansleep
CC [M] drivers/gpu/drm/vc4/vc4_validate.o
CC [M] drivers/gpu/drm/vc4/vc4_v3d.o
CC [M] drivers/gpu/drm/vc4/vc4_validate_shaders.o
CC [M] drivers/gpu/drm/vc4/vc4_debugfs.o
drivers/gpu/drm/vc4/vc4_hdmi.c: In function ‘vc4_hdmi_bind’:
drivers/gpu/drm/vc4/vc4_hdmi.c:2883:23: error: implicit declaration of function ‘devm_gpiod_get_optional’; did you mean ‘devm_clk_get_optional’? [-Werror=implicit-function-declaration]
vc4_hdmi->hpd_gpio = devm_gpiod_get_optional(dev, "hpd", GPIOD_IN);
^~~~~~~~~~~~~~~~~~~~~~~
devm_clk_get_optional
drivers/gpu/drm/vc4/vc4_hdmi.c:2883:59: error: ‘GPIOD_IN’ undeclared (first use in this function); did you mean ‘GPIOF_IN’?
vc4_hdmi->hpd_gpio = devm_gpiod_get_optional(dev, "hpd", GPIOD_IN);
^~~~~~~~
GPIOF_INdrivers/gpu/drm/vc4/vc4_hdmi.c:2883:59: note: each undeclared identifier is reported only once for each function it appears in
cc1: all warnings being treated as errors
--- drivers/gpu/drm/vc4/vc4_hdmi.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/vc4/vc4_hdmi.c +1 -0
@@ -38,6 +38,7 @@#include <drm/drm_scdc_helper.h> #include <linux/clk.h> #include <linux/component.h> +#include <linux/gpio/consumer.h> #include <linux/i2c.h> #include <linux/of_address.h> #include <linux/of_gpio.h>
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 39/102 net: dsa: bcm_sf2: Fix Wake-on-LAN with mac_link_down()
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit b7be130c5d52e5224ac7d89568737b37b4c4b785 ]
After commit 2d1f90f9ba83 ("net: dsa/bcm_sf2: fix incorrect usage of state->link") the interface suspend path would call our mac_link_down() call back which would forcibly set the link down, thus preventing Wake-on-LAN packets from reaching our management port.
Fix this by looking at whether the port is enabled for Wake-on-LAN and not clearing the link status in that case to let packets go through.
--- drivers/net/dsa/bcm_sf2.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/dsa/bcm_sf2.c +3 -0
@@ -796,6 +796,9 @@ static void bcm_sf2_sw_mac_link_down(struct dsa_switch *ds, int port,struct bcm_sf2_priv *priv =bcm_sf2_to_priv (ds);u32 reg, offset; +if (priv->wol_ports_mask &BIT (port)) +return ; +if (port !=core_readl (priv,CORE_IMP0_PRT_ID )) {if (priv->type ==BCM4908_DEVICE_ID || priv->type ==BCM7445_DEVICE_ID )
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 40/102 net/smc: non blocking recvmsg() return -EAGAIN when no data and signal_pending
In reply to Greg Kroah-HartmanFrom: Guangguan Wang <[email protected]>
[ Upstream commit f3c46e41b32b6266cf60b0985c61748f53bf1c61 ]
Non blocking sendmsg will return -EAGAIN when any signal pending and no send space left, while non blocking recvmsg return -EINTR when signal pending and no data received. This may makes confused. As TCP returns -EAGAIN in the conditions described above. Align the behavior of smc with TCP.
--- net/smc/smc_rx.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/smc/smc_rx.c +2 -2
@@ -354,12 +354,12 @@ int smc_rx_recvmsg(struct smc_sock *smc, struct msghdr *msg, }break ; } +if (!timeo) +return -EAGAIN ;if (signal_pending (current)) { read_done =sock_intr_errno (timeo);break ; } -if (!timeo) -return -EAGAIN ; }if (!smc_rx_data_available (conn)) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 41/102 net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe()
In reply to Greg Kroah-HartmanFrom: Taehee Yoo <[email protected]>
[ Upstream commit 1fa89ffbc04545b7582518e57f4b63e2a062870f ]
In the NIC ->probe() callback, ->mtd_probe() callback is called. If NIC has 2 ports, ->probe() is called twice and ->mtd_probe() too. In the ->mtd_probe(), which is efx_ef10_mtd_probe() it allocates and initializes mtd partiion.
But mtd partition for sfc is shared data.
So that allocated mtd partition data from last called efx_ef10_mtd_probe() will not be used.
Therefore it must be freed.
But it doesn't free a not used mtd partition data in efx_ef10_mtd_probe().
kmemleak reports:
unreferenced object 0xffff88811ddb0000 (size 63168):
comm "systemd-udevd", pid 265, jiffies 4294681048 (age 348.586s) hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffffa3767749>] kmalloc_order_trace+0x19/0x120
[<ffffffffa3873f0e>] __kmalloc+0x20e/0x250
[<ffffffffc041389f>] efx_ef10_mtd_probe+0x11f/0x270 [sfc]
[<ffffffffc0484c8a>] efx_pci_probe.cold.17+0x3df/0x53d [sfc]
[<ffffffffa414192c>] local_pci_probe+0xdc/0x170
[<ffffffffa4145df5>] pci_device_probe+0x235/0x680
[<ffffffffa443dd52>] really_probe+0x1c2/0x8f0
[<ffffffffa443e72b>] __driver_probe_device+0x2ab/0x460
[<ffffffffa443e92a>] driver_probe_device+0x4a/0x120
[<ffffffffa443f2ae>] __driver_attach+0x16e/0x320
[<ffffffffa4437a90>] bus_for_each_dev+0x110/0x190
[<ffffffffa443b75e>] bus_add_driver+0x39e/0x560
[<ffffffffa4440b1e>] driver_register+0x18e/0x310
[<ffffffffc02e2055>] 0xffffffffc02e2055
[<ffffffffa3001af3>] do_one_initcall+0xc3/0x450
[<ffffffffa33ca574>] do_init_module+0x1b4/0x700--- drivers/net/ethernet/sfc/ef10.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/sfc/ef10.c +5 -0
@@ -3579,6 +3579,11 @@ static int efx_ef10_mtd_probe(struct efx_nic *efx) n_parts++; } +if (!n_parts) { +kfree (parts); +return 0 ; + } + rc =efx_mtd_add (efx, &parts[0 ].common, n_parts,sizeof (*parts)); fail:if (rc)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 42/102 tls: Fix context leak on tls_device_down
In reply to Greg Kroah-HartmanFrom: Maxim Mikityanskiy <[email protected]>
[ Upstream commit 3740651bf7e200109dd42d5b2fb22226b26f960a ]
The commit cited below claims to fix a use-after-free condition after tls_device_down. Apparently, the description wasn't fully accurate. The context stayed alive, but ctx->netdev became NULL, and the offload was torn down without a proper fallback, so a bug was present, but a different kind of bug.
Due to misunderstanding of the issue, the original patch dropped the refcount_dec_and_test line for the context to avoid the alleged premature deallocation. That line has to be restored, because it matches the refcount_inc_not_zero from the same function, otherwise the contexts that survived tls_device_down are leaked.
This patch fixes the described issue by restoring refcount_dec_and_test. After this change, there is no leak anymore, and the fallback to software kTLS still works.
--- net/tls/tls_device.c | 3 +++ 1 file changed, 3 insertions(+)
net/tls/tls_device.c +3 -0
@@ -1347,7 +1347,10 @@ static int tls_device_down(struct net_device *netdev)/* Device contexts for RX and TX will be freed in on sk_destruct * by tls_device_free_ctx. rx_conf and tx_conf stay in TLS_HW. +* Now release the ref taken above. */ +if (refcount_dec_and_test (&ctx->refcount)) +tls_device_free_ctx (ctx); }up_write (&device_offload_lock);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 43/102 drm/vmwgfx: Fix fencing on SVGAv3
In reply to Greg Kroah-HartmanFrom: Zack Rusin <[email protected]>
[ Upstream commit 1d6595b4cd47acfd824550f48f10b54a6f0e93ee ]
Port of the vmwgfx to SVGAv3 lacked support for fencing. SVGAv3 removed FIFO's and replaced them with command buffers and extra registers. The initial version of SVGAv3 lacked support for most advanced features (e.g. 3D) which made fences unnecessary. That is no longer the case, especially as 3D support is being turned on.
Switch from FIFO commands and capabilities to command buffers and extra registers to enable fences on SVGAv3.
--- drivers/gpu/drm/vmwgfx/vmwgfx_cmd.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_drv.h | 8 ++++++++ drivers/gpu/drm/vmwgfx/vmwgfx_fence.c | 28 ++++++++++++++++++++------- drivers/gpu/drm/vmwgfx/vmwgfx_irq.c | 26 +++++++++++++++++-------- drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 8 +++++--- 5 files changed, 53 insertions(+), 19 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_cmd.c +1 -1
@@ -528,7 +528,7 @@ int vmw_cmd_send_fence(struct vmw_private *dev_priv, uint32_t *seqno) *seqno =atomic_add_return (1 , &dev_priv->marker_seq); }while (*seqno ==0 ); -if (!(vmw_fifo_caps (dev_priv) &SVGA_FIFO_CAP_FENCE )) { +if (!vmw_has_fences (dev_priv)) {/* * Don't request hardware to send a fence. The
drivers/gpu/drm/vmwgfx/vmwgfx_drv.h +8 -0
@@ -1677,4 +1677,12 @@ static inline void vmw_irq_status_write(struct vmw_private *vmw, outl(status, vmw->io_start + SVGA_IRQSTATUS_PORT); } +static inline bool vmw_has_fences (struct vmw_private *vmw) +{ +if ((vmw->capabilities & (SVGA_CAP_COMMAND_BUFFERS | +SVGA_CAP_CMD_BUFFERS_2 )) !=0 ) +return true; +return (vmw_fifo_caps (vmw) &SVGA_FIFO_CAP_FENCE ) !=0 ; +} +#endif
drivers/gpu/drm/vmwgfx/vmwgfx_fence.c +21 -7
@@ -85,6 +85,22 @@ fman_from_fence(struct vmw_fence_obj *fence) return container_of(fence->base.lock, struct vmw_fence_manager, lock); } +static u32 vmw_fence_goal_read (struct vmw_private *vmw) +{ +if ((vmw->capabilities2 &SVGA_CAP2_EXTRA_REGS ) !=0 ) +return vmw_read (vmw,SVGA_REG_FENCE_GOAL ); +else +return vmw_fifo_mem_read (vmw,SVGA_FIFO_FENCE_GOAL ); +} + +static void vmw_fence_goal_write (struct vmw_private *vmw,u32 value) +{ +if ((vmw->capabilities2 &SVGA_CAP2_EXTRA_REGS ) !=0 ) +vmw_write (vmw,SVGA_REG_FENCE_GOAL , value); +else +vmw_fifo_mem_write (vmw,SVGA_FIFO_FENCE_GOAL , value); +} +/* * Note on fencing subsystem usage of irqs: * Typically the vmw_fences_update function is called
@@ -400,7 +416,7 @@ static bool vmw_fence_goal_new_locked(struct vmw_fence_manager *fman,if (likely (!fman->seqno_valid))return false; - goal_seqno =vmw_fifo_mem_read (fman->dev_priv,SVGA_FIFO_FENCE_GOAL ); + goal_seqno =vmw_fence_goal_read (fman->dev_priv);if (likely (passed_seqno - goal_seqno >=VMW_FENCE_WRAP ))return false;
@@ -408,9 +424,8 @@ static bool vmw_fence_goal_new_locked(struct vmw_fence_manager *fman,list_for_each_entry (fence, &fman->fence_list, head) {if (!list_empty (&fence->seq_passed_actions)) { fman->seqno_valid = true; -vmw_fifo_mem_write (fman->dev_priv, -SVGA_FIFO_FENCE_GOAL , - fence->base.seqno); +vmw_fence_goal_write (fman->dev_priv, + fence->base.seqno);break ; } }
@@ -442,13 +457,12 @@ static bool vmw_fence_goal_check_locked(struct vmw_fence_obj *fence)if (dma_fence_is_signaled_locked (&fence->base))return false; - goal_seqno =vmw_fifo_mem_read (fman->dev_priv,SVGA_FIFO_FENCE_GOAL ); + goal_seqno =vmw_fence_goal_read (fman->dev_priv);if (likely (fman->seqno_valid && goal_seqno - fence->base.seqno <VMW_FENCE_WRAP ))return false; -vmw_fifo_mem_write (fman->dev_priv,SVGA_FIFO_FENCE_GOAL , - fence->base.seqno); +vmw_fence_goal_write (fman->dev_priv, fence->base.seqno); fman->seqno_valid = true;return true;
drivers/gpu/drm/vmwgfx/vmwgfx_irq.c +18 -8
@@ -32,6 +32,14 @@#define VMW_FENCE_WRAP (1 << 24) +static u32 vmw_irqflag_fence_goal (struct vmw_private *vmw) +{ +if ((vmw->capabilities2 &SVGA_CAP2_EXTRA_REGS ) !=0 ) +return SVGA_IRQFLAG_REG_FENCE_GOAL ; +else +return SVGA_IRQFLAG_FENCE_GOAL ; +} +/** * vmw_thread_fn - Deferred (process context) irq handler *
@@ -96,7 +104,7 @@ static irqreturn_t vmw_irq_handler(int irq, void *arg)wake_up_all (&dev_priv->fifo_queue);if ((masked_status & (SVGA_IRQFLAG_ANY_FENCE | -SVGA_IRQFLAG_FENCE_GOAL )) && +vmw_irqflag_fence_goal (dev_priv))) && !test_and_set_bit (VMW_IRQTHREAD_FENCE , dev_priv->irqthread_pending)) ret =IRQ_WAKE_THREAD ;
@@ -137,8 +145,7 @@ bool vmw_seqno_passed(struct vmw_private *dev_priv,if (likely (dev_priv->last_read_seqno - seqno <VMW_FENCE_WRAP ))return true; -if (!(vmw_fifo_caps (dev_priv) &SVGA_FIFO_CAP_FENCE ) && -vmw_fifo_idle (dev_priv, seqno)) +if (!vmw_has_fences (dev_priv) &&vmw_fifo_idle (dev_priv, seqno))return true;/**
@@ -160,6 +167,7 @@ int vmw_fallback_wait(struct vmw_private *dev_priv, unsigned long timeout) {struct vmw_fifo_state *fifo_state = dev_priv->fifo; +bool fifo_down = false;uint32_t count =0 ;uint32_t signal_seq;
@@ -176,12 +184,14 @@ int vmw_fallback_wait(struct vmw_private *dev_priv,*/ if (fifo_idle) { -down_read (&fifo_state->rwsem);if (dev_priv->cman) { ret =vmw_cmdbuf_idle (dev_priv->cman, interruptible,10 *HZ );if (ret) goto out_err; + }else if (fifo_state) { +down_read (&fifo_state->rwsem); + fifo_down = true; } }
@@ -218,12 +228,12 @@ int vmw_fallback_wait(struct vmw_private *dev_priv, } }finish_wait (&dev_priv->fence_queue, &__wait); -if (ret ==0 && fifo_idle) +if (ret ==0 && fifo_idle && fifo_state)vmw_fence_write (dev_priv, signal_seq);wake_up_all (&dev_priv->fence_queue); out_err: -if (fifo_idle) +if (fifo_down)up_read (&fifo_state->rwsem);return ret;
@@ -266,13 +276,13 @@ void vmw_seqno_waiter_remove(struct vmw_private *dev_priv)void vmw_goal_waiter_add (struct vmw_private *dev_priv) { -vmw_generic_waiter_add (dev_priv,SVGA_IRQFLAG_FENCE_GOAL , +vmw_generic_waiter_add (dev_priv,vmw_irqflag_fence_goal (dev_priv), &dev_priv->goal_queue_waiters); }void vmw_goal_waiter_remove (struct vmw_private *dev_priv) { -vmw_generic_waiter_remove (dev_priv,SVGA_IRQFLAG_FENCE_GOAL , +vmw_generic_waiter_remove (dev_priv,vmw_irqflag_fence_goal (dev_priv), &dev_priv->goal_queue_waiters); }
drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +5 -3
@@ -1336,7 +1336,6 @@ vmw_kms_new_framebuffer(struct vmw_private *dev_priv, ret =vmw_kms_new_framebuffer_surface (dev_priv, surface, &vfb, mode_cmd, is_bo_proxy); -/* * vmw_create_bo_proxy() adds a reference that is no longer * needed
@@ -1398,13 +1397,16 @@ static struct drm_framebuffer *vmw_kms_fb_create(struct drm_device *dev, ret =vmw_user_lookup_handle (dev_priv, tfile, mode_cmd->handles[0 ], &surface, &bo); -if (ret) +if (ret) { +DRM_ERROR ("Invalid buffer object handle %u (0x%x).\n" , + mode_cmd->handles[0 ], mode_cmd->handles[0 ]); goto err_out; + }if (!bo && !vmw_kms_srf_ok (dev_priv, mode_cmd->width, mode_cmd->height)) { -DRM_ERROR ("Surface size cannot exceed %dx%d" , +DRM_ERROR ("Surface size cannot exceed %dx%d\n" , dev_priv->texture_max_width, dev_priv->texture_max_height); goto err_out;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 44/102 gfs2: Fix filesystem block deallocation for short writes
In reply to Greg Kroah-HartmanFrom: Andreas Gruenbacher <[email protected]>
[ Upstream commit d031a8866e709c9d1ee5537a321b6192b4d2dc5b ]
When a write cannot be carried out in full, gfs2_iomap_end() releases blocks that have been allocated for this write but haven't been used.
To compute the end of the allocation, gfs2_iomap_end() incorrectly rounded the end of the attempted write down to the next block boundary to arrive at the end of the allocation. It would have to round up, but the end of the allocation is also available as iomap->offset + iomap->length, so just use that instead.
In addition, use round_up() for computing the start of the unused range.
--- fs/gfs2/bmap.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
fs/gfs2/bmap.c +5 -6
@@ -1154,13 +1154,12 @@ static int gfs2_iomap_end(struct inode *inode, loff_t pos, loff_t length,if (length != written && (iomap->flags &IOMAP_F_NEW )) {/* Deallocate blocks that were just allocated. */ -loff_t blockmask =i_blocksize (inode) -1 ; -loff_t end = (pos + length) & ~blockmask; +loff_t hstart =round_up (pos + written,i_blocksize (inode)); +loff_t hend = iomap->offset + iomap->length; - pos = (pos + written + blockmask) & ~blockmask; -if (pos < end) { -truncate_pagecache_range (inode, pos, end -1 ); -punch_hole (ip, pos, end - pos); +if (hstart < hend) { +truncate_pagecache_range (inode, hstart, hend -1 ); +punch_hole (ip, hstart, hend - hstart); } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 45/102 hwmon: (f71882fg) Fix negative temperature
In reply to Greg Kroah-HartmanFrom: Ji-Ze Hong (Peter Hong) <[email protected]>
[ Upstream commit 4aaaaf0f279836f06d3b9d0ffeec7a1e1a04ceef ]
All temperature of Fintek superio hwmonitor that using 1-byte reg will use 2's complement.
In show_temp()
temp = data->temp[nr] * 1000;
When data->temp[nr] read as 255, it indicate -1C, but this code will report 255C to userspace. It'll be ok when change to:
temp = ((s8)data->temp[nr]) * 1000;
--- drivers/hwmon/f71882fg.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/hwmon/f71882fg.c +3 -2
@@ -1577,8 +1577,9 @@ static ssize_t show_temp(struct device *dev, struct device_attribute *devattr, temp *=125 ;if (sign) temp -=128000 ; - }else - temp = data->temp[nr] *1000 ; + }else { + temp = ((s8 )data->temp[nr]) *1000 ; + }return sprintf (buf,"%d\n" , temp); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 46/102 RDMA/irdma: Fix deadlock in irdma_cleanup_cm_core()
In reply to Greg Kroah-HartmanFrom: Duoming Zhou <[email protected]>
[ Upstream commit 679ab61bf5f5f519377d812afb4fb93634782c74 ]
There is a deadlock in irdma_cleanup_cm_core(), which is shown below:
(Thread 1) | (Thread 2)
| irdma_schedule_cm_timer()
irdma_cleanup_cm_core() | add_timer()
spin_lock_irqsave() //(1) | (wait a time)
... | irdma_cm_timer_tick()
del_timer_sync() | spin_lock_irqsave() //(2)
(wait timer to stop) | ...We hold cm_core->ht_lock in position (1) of thread 1 and use del_timer_sync() to wait timer to stop, but timer handler also need cm_core->ht_lock in position (2) of thread 2. As a result, irdma_cleanup_cm_core() will block forever.
This patch removes the check of timer_pending() in irdma_cleanup_cm_core(), because the del_timer_sync() function will just return directly if there isn't a pending timer. As a result, the lock is redundant, because there is no resource it could protect.
--- drivers/infiniband/hw/irdma/cm.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
drivers/infiniband/hw/irdma/cm.c +1 -6
@@ -3242,15 +3242,10 @@ enum irdma_status_code irdma_setup_cm_core(struct irdma_device *iwdev,*/ void irdma_cleanup_cm_core (struct irdma_cm_core *cm_core) { -unsigned long flags; -if (!cm_core)return ; -spin_lock_irqsave (&cm_core->ht_lock, flags); -if (timer_pending (&cm_core->tcp_timer)) -del_timer_sync (&cm_core->tcp_timer); -spin_unlock_irqrestore (&cm_core->ht_lock, flags); +del_timer_sync (&cm_core->tcp_timer);destroy_workqueue (cm_core->event_wq); cm_core->dev->ws_reset (&cm_core->iwdev->vsi);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 47/102 iommu: arm-smmu: disable large page mappings for Nvidia arm-smmu
In reply to Greg Kroah-HartmanFrom: Ashish Mhetre <[email protected]>
[ Upstream commit 4a25f2ea0e030b2fc852c4059a50181bfc5b2f57 ]
Tegra194 and Tegra234 SoCs have the erratum that causes walk cache entries to not be invalidated correctly. The problem is that the walk cache index generated for IOVA is not same across translation and invalidation requests. This is leading to page faults when PMD entry is released during unmap and populated with new PTE table during subsequent map request. Disabling large page mappings avoids the release of PMD entry and avoid translations seeing stale PMD entry in walk cache. Fix this by limiting the page mappings to PAGE_SIZE for Tegra194 and Tegra234 devices. This is recommended fix from Tegra hardware design team.
--- drivers/iommu/arm/arm-smmu/arm-smmu-nvidia.c | 30 ++++++++++++++++++++ 1 file changed, 30 insertions(+)
drivers/iommu/arm/arm-smmu/arm-smmu-nvidia.c +30 -0
@@ -258,6 +258,34 @@ static void nvidia_smmu_probe_finalize(struct arm_smmu_device *smmu, struct devi dev_name(dev), err); } +static int nvidia_smmu_init_context (struct arm_smmu_domain *smmu_domain, +struct io_pgtable_cfg *pgtbl_cfg, +struct device *dev) +{ +struct arm_smmu_device *smmu = smmu_domain->smmu; +const struct device_node *np = smmu->dev->of_node; + +/* +* Tegra194 and Tegra234 SoCs have the erratum that causes walk cache +* entries to not be invalidated correctly. The problem is that the walk +* cache index generated for IOVA is not same across translation and +* invalidation requests. This is leading to page faults when PMD entry +* is released during unmap and populated with new PTE table during +* subsequent map request. Disabling large page mappings avoids the +* release of PMD entry and avoid translations seeing stale PMD entry in +* walk cache. +* Fix this by limiting the page mappings to PAGE_SIZE on Tegra194 and +* Tegra234. +*/ +if (of_device_is_compatible (np,"nvidia,tegra234-smmu" ) || +of_device_is_compatible (np,"nvidia,tegra194-smmu" )) { + smmu->pgsize_bitmap =PAGE_SIZE ; + pgtbl_cfg->pgsize_bitmap = smmu->pgsize_bitmap; + } + +return 0 ; +} +static const struct arm_smmu_impl nvidia_smmu_impl = { .read_reg = nvidia_smmu_read_reg, .write_reg = nvidia_smmu_write_reg,
@@ -268,10 +296,12 @@ static const struct arm_smmu_impl nvidia_smmu_impl = { .global_fault = nvidia_smmu_global_fault, .context_fault = nvidia_smmu_context_fault, .probe_finalize = nvidia_smmu_probe_finalize, + .init_context = nvidia_smmu_init_context, };static const struct arm_smmu_impl nvidia_smmu_single_impl = { .probe_finalize = nvidia_smmu_probe_finalize, + .init_context = nvidia_smmu_init_context, };struct arm_smmu_device *nvidia_smmu_impl_init (struct arm_smmu_device *smmu)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 48/102 ASoC: max98090: Reject invalid values in custom control put()
In reply to Greg Kroah-HartmanFrom: Mark Brown <[email protected]>
[ Upstream commit 2fbe467bcbfc760a08f08475eea6bbd4c2874319 ]
The max98090 driver has a custom put function for some controls which can only be updated in certain circumstances which makes no effort to validate that input is suitable for the control, allowing out of spec values to be written to the hardware and presented to userspace. Fix this by returning an error when invalid values are written.
--- sound/soc/codecs/max98090.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/codecs/max98090.c +3 -0
@@ -413,6 +413,9 @@ static int max98090_put_enab_tlv(struct snd_kcontrol *kcontrol, val = (val >> mc->shift) & mask; +if (sel <0 || sel > mc->max) +return -EINVAL ; + *select = sel;/* Setting a volume is only valid if it is already On */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 49/102 ASoC: max98090: Generate notifications on changes for custom control
In reply to Greg Kroah-HartmanFrom: Mark Brown <[email protected]>
[ Upstream commit 13fcf676d9e102594effc686d98521ff5c90b925 ]
The max98090 driver has some custom controls which share a put() function which returns 0 unconditionally, meaning that events are not generated when the value changes. Fix that.
--- sound/soc/codecs/max98090.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/max98090.c +1 -1
@@ -430,7 +430,7 @@ static int max98090_put_enab_tlv(struct snd_kcontrol *kcontrol, mask << mc->shift, sel << mc->shift); -return 0 ; +return *select != val; } static const char *max98090_perf_pwr_text[] =
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 50/102 ASoC: ops: Validate input values in snd_soc_put_volsw_range()
In reply to Greg Kroah-HartmanFrom: Mark Brown <[email protected]>
[ Upstream commit aa22125c57f9e577f0a667e4fa07fc3fa8ca1e60 ]
Check that values written via snd_soc_put_volsw_range() are within the range advertised by the control, ensuring that we don't write out of spec values to the hardware.
--- sound/soc/soc-ops.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
sound/soc/soc-ops.c +17 -1
@@ -519,7 +519,15 @@ int snd_soc_put_volsw_range(struct snd_kcontrol *kcontrol,unsigned int mask = (1 <<fls (max)) -1 ;unsigned int invert = mc->invert;unsigned int val, val_mask; -int err, ret; +int err, ret, tmp; + + tmp = ucontrol->value.integer.value[0 ]; +if (tmp <0 ) +return -EINVAL ; +if (mc->platform_max && tmp > mc->platform_max) +return -EINVAL ; +if (tmp > mc->max - mc->min +1 ) +return -EINVAL ;if (invert) val = (max - ucontrol->value.integer.value[0 ]) & mask;
@@ -534,6 +542,14 @@ int snd_soc_put_volsw_range(struct snd_kcontrol *kcontrol, ret = err;if (snd_soc_volsw_is_stereo (mc)) { + tmp = ucontrol->value.integer.value[1 ]; +if (tmp <0 ) +return -EINVAL ; +if (mc->platform_max && tmp > mc->platform_max) +return -EINVAL ; +if (tmp > mc->max - mc->min +1 ) +return -EINVAL ; +if (invert) val = (max - ucontrol->value.integer.value[1 ]) & mask;else
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 51/102 s390: disable -Warray-bounds
In reply to Greg Kroah-HartmanFrom: Sven Schnelle <[email protected]>
[ Upstream commit 8b202ee218395319aec1ef44f72043e1fbaccdd6 ]
gcc-12 shows a lot of array bound warnings on s390. This is caused by the S390_lowcore macro which uses a hardcoded address of 0.
Wrapping that with absolute_pointer() works, but gcc no longer knows that a 12 bit displacement is sufficient to access lowcore. So it emits instructions like 'lghi %r1,0; l %rx,xxx(%r1)' instead of a single load/store instruction. As s390 stores variables often read/written in lowcore, this is considered problematic. Therefore disable -Warray-bounds on s390 for gcc-12 for the time being, until there is a better solution.
--- arch/s390/Makefile | 10 ++++++++++ 1 file changed, 10 insertions(+)
arch/s390/Makefile +10 -0
@@ -32,6 +32,16 @@ KBUILD_CFLAGS_DECOMPRESSOR += -fno-stack-protector KBUILD_CFLAGS_DECOMPRESSOR += $(call cc-disable-warning, address-of-packed-member) KBUILD_CFLAGS_DECOMPRESSOR += $(if $(CONFIG_DEBUG_INFO),-g) KBUILD_CFLAGS_DECOMPRESSOR += $(if $(CONFIG_DEBUG_INFO_DWARF4), $(call cc-option, -gdwarf-4,)) + +ifdef CONFIG_CC_IS_GCC + ifeq ($(call cc-ifversion, -ge, 1200, y), y) + ifeq ($(call cc-ifversion, -lt, 1300, y), y) + KBUILD_CFLAGS += $(call cc-disable-warning, array-bounds) + KBUILD_CFLAGS_DECOMPRESSOR += $(call cc-disable-warning, array-bounds) + endif + endif +endif + UTS_MACHINE := s390x STACK_SIZE := $(if $(CONFIG_KASAN),65536,16384) CHECKFLAGS += -D__s390__ -D__s390x__
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 52/102 ASoC: SOF: Fix NULL pointer exception in sof_pci_probe callback
In reply to Greg Kroah-HartmanFrom: Ajit Kumar Pandey <[email protected]>
[ Upstream commit c61711c1c95791850be48dd65a1d72eb34ba719f ]
We are accessing "desc->ops" in sof_pci_probe without checking "desc" pointer. This results in NULL pointer exception if pci_id->driver_data i.e desc pointer isn't defined in sof device probe:
BUG: kernel NULL pointer dereference, address: 0000000000000060 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:sof_pci_probe+0x1e/0x17f [snd_sof_pci] Code: Unable to access opcode bytes at RIP 0xffffffffc043dff4. RSP: 0018:ffffac4b03b9b8d8 EFLAGS: 00010246
Add NULL pointer check for sof_dev_desc pointer to avoid such exception.
--- sound/soc/sof/sof-pci-dev.c | 5 +++++ 1 file changed, 5 insertions(+)
sound/soc/sof/sof-pci-dev.c +5 -0
@@ -129,6 +129,11 @@ int sof_pci_probe(struct pci_dev *pci, const struct pci_device_id *pci_id)dev_dbg (&pci->dev,"PCI DSP detected" ); +if (!desc) { +dev_err (dev,"error: no matching PCI descriptor\n" ); +return -ENODEV ; + } +if (!desc->ops) {dev_err (dev,"error: no matching PCI descriptor ops\n" );return -ENODEV ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 53/102 net: emaclite: Dont advertise 1000BASE-T and do auto negotiation
In reply to Greg Kroah-HartmanFrom: Shravya Kumbham <[email protected]>
[ Upstream commit b800528b97d0adc3a5ba42d78a8b0d3f07a31f44 ]
In xemaclite_open() function we are setting the max speed of emaclite to 100Mb using phy_set_max_speed() function so, there is no need to write the advertising registers to stop giga-bit speed and the phy_start() function starts the auto-negotiation so, there is no need to handle it separately using advertising registers. Remove the phy_read and phy_write of advertising registers in xemaclite_open() function.
--- drivers/net/ethernet/xilinx/xilinx_emaclite.c | 15 --------------- 1 file changed, 15 deletions(-)
drivers/net/ethernet/xilinx/xilinx_emaclite.c +0 -15
@@ -934,8 +934,6 @@ static int xemaclite_open(struct net_device *dev)xemaclite_disable_interrupts (lp);if (lp->phy_node) { -u32 bmcr; - lp->phy_dev =of_phy_connect (lp->ndev, lp->phy_node, xemaclite_adjust_link,0 ,PHY_INTERFACE_MODE_MII );
@@ -946,19 +944,6 @@ static int xemaclite_open(struct net_device *dev)/* EmacLite doesn't support giga-bit speeds */ phy_set_max_speed (lp->phy_dev,SPEED_100 ); - -/* Don't advertise 1000BASE-T Full/Half duplex speeds */ -phy_write (lp->phy_dev,MII_CTRL1000 ,0 ); - -/* Advertise only 10 and 100mbps full/half duplex speeds */ -phy_write (lp->phy_dev,MII_ADVERTISE ,ADVERTISE_ALL | -ADVERTISE_CSMA ); - -/* Restart auto negotiation */ - bmcr =phy_read (lp->phy_dev,MII_BMCR ); - bmcr |= (BMCR_ANENABLE |BMCR_ANRESTART ); -phy_write (lp->phy_dev,MII_BMCR , bmcr); -phy_start (lp->phy_dev); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 54/102 net: sfp: Add tx-fault workaround for Huawei MA5671A SFP ONT
In reply to Greg Kroah-HartmanFrom: Matthew Hagan <[email protected]>
[ Upstream commit 2069624dac19d62c558bb6468fe03678553ab01d ]
As noted elsewhere, various GPON SFP modules exhibit non-standard TX-fault behaviour. In the tested case, the Huawei MA5671A, when used in combination with a Marvell mv88e6085 switch, was found to persistently assert TX-fault, resulting in the module being disabled.
This patch adds a quirk to ignore the SFP_F_TX_FAULT state, allowing the module to function.
Change from v1: removal of erroneous return statment (Andrew Lunn)
--- drivers/net/phy/sfp.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/net/phy/sfp.c +11 -1
@@ -250,6 +250,7 @@ struct sfp {struct sfp_eeprom_id id;unsigned int module_power_mW;unsigned int module_t_start_up; +bool tx_fault_ignore;#if IS_ENABLED (CONFIG_HWMON )struct sfp_diag diag;
@@ -1945,6 +1946,12 @@ static int sfp_sm_mod_probe(struct sfp *sfp, bool report)else sfp->module_t_start_up =T_START_UP ; +if (!memcmp (id.base.vendor_name,"HUAWEI " ,16 ) && + !memcmp (id.base.vendor_pn,"MA5671A " ,16 )) + sfp->tx_fault_ignore = true; +else + sfp->tx_fault_ignore = false; +return 0 ; }
@@ -2397,7 +2404,10 @@ static void sfp_check_state(struct sfp *sfp)mutex_lock (&sfp->st_mutex); state =sfp_get_state (sfp); changed = state ^ sfp->state; - changed &=SFP_F_PRESENT |SFP_F_LOS |SFP_F_TX_FAULT ; +if (sfp->tx_fault_ignore) + changed &=SFP_F_PRESENT |SFP_F_LOS ; +else + changed &=SFP_F_PRESENT |SFP_F_LOS |SFP_F_TX_FAULT ;for (i =0 ; i <GPIO_MAX ; i++)if (changed &BIT (i))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 55/102 secure_seq: use the 64 bits of the siphash for port offset calculation
In reply to Greg Kroah-HartmanFrom: Willy Tarreau <[email protected]>
[ Upstream commit b2d057560b8107c633b39aabe517ff9d93f285e3 ]
SipHash replaced MD5 in secure_ipv{4,6}_port_ephemeral() via commit 7cd23e5300c1 ("secure_seq: use SipHash in place of MD5"), but the output remained truncated to 32-bit only. In order to exploit more bits from the hash, let's make the functions return the full 64-bit of siphash_3u32(). We also make sure the port offset calculation in __inet_hash_connect() remains done on 32-bit to avoid the need for div_u64_rem() and an extra cost on 32-bit systems.
--- include/net/inet_hashtables.h | 2 +- include/net/secure_seq.h | 4 ++-- net/core/secure_seq.c | 4 ++-- net/ipv4/inet_hashtables.c | 10 ++++++---- net/ipv6/inet6_hashtables.c | 4 ++-- 5 files changed, 13 insertions(+), 11 deletions(-)
include/net/inet_hashtables.h +1 -1
@@ -425,7 +425,7 @@ static inline void sk_rcv_saddr_set(struct sock *sk, __be32 addr) }int __inet_hash_connect (struct inet_timewait_death_row *death_row, -struct sock *sk,u32 port_offset, +struct sock *sk,u64 port_offset,int (*check_established)(struct inet_timewait_death_row *,struct sock *,__u16 ,struct inet_timewait_sock **));
include/net/secure_seq.h +2 -2
@@ -4,8 +4,8 @@#include <linux/types.h> -u32 secure_ipv4_port_ephemeral (__be32 saddr,__be32 daddr,__be16 dport); -u32 secure_ipv6_port_ephemeral (const __be32 *saddr,const __be32 *daddr, +u64 secure_ipv4_port_ephemeral (__be32 saddr,__be32 daddr,__be16 dport); +u64 secure_ipv6_port_ephemeral (const __be32 *saddr,const __be32 *daddr,__be16 dport);u32 secure_tcp_seq (__be32 saddr,__be32 daddr,__be16 sport,__be16 dport);
net/core/secure_seq.c +2 -2
@@ -94,7 +94,7 @@ u32 secure_tcpv6_seq(const __be32 *saddr, const __be32 *daddr, }EXPORT_SYMBOL (secure_tcpv6_seq); -u32 secure_ipv6_port_ephemeral (const __be32 *saddr,const __be32 *daddr, +u64 secure_ipv6_port_ephemeral (const __be32 *saddr,const __be32 *daddr,__be16 dport) { const struct {
@@ -142,7 +142,7 @@ u32 secure_tcp_seq(__be32 saddr, __be32 daddr, }EXPORT_SYMBOL_GPL (secure_tcp_seq); -u32 secure_ipv4_port_ephemeral (__be32 saddr,__be32 daddr,__be16 dport) +u64 secure_ipv4_port_ephemeral (__be32 saddr,__be32 daddr,__be16 dport) {net_secret_init (); return siphash_3u32((__force u32)saddr, (__force u32)daddr,
net/ipv4/inet_hashtables.c +6 -4
@@ -504,7 +504,7 @@ static int __inet_check_established(struct inet_timewait_death_row *death_row,return -EADDRNOTAVAIL ; } -static u32 inet_sk_port_offset (const struct sock *sk) +static u64 inet_sk_port_offset (const struct sock *sk) {const struct inet_sock *inet =inet_sk (sk);
@@ -734,7 +734,7 @@ EXPORT_SYMBOL_GPL(inet_unhash);static u32 table_perturb[1 <<INET_TABLE_PERTURB_SHIFT ];int __inet_hash_connect (struct inet_timewait_death_row *death_row, -struct sock *sk,u32 port_offset, +struct sock *sk,u64 port_offset,int (*check_established)(struct inet_timewait_death_row *,struct sock *,__u16 ,struct inet_timewait_sock **)) {
@@ -777,7 +777,9 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,net_get_random_once (table_perturb,sizeof (table_perturb)); index =hash_32 (port_offset,INET_TABLE_PERTURB_SHIFT ); - offset = (READ_ONCE (table_perturb[index]) + port_offset) % remaining; + offset =READ_ONCE (table_perturb[index]) + port_offset; + offset %= remaining; +/* In first pass we try ports of @low parity. * inet_csk_get_port() does the opposite choice. */
@@ -859,7 +861,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,int inet_hash_connect (struct inet_timewait_death_row *death_row,struct sock *sk) { -u32 port_offset =0 ; +u64 port_offset =0 ;if (!inet_sk (sk)->inet_num) port_offset =inet_sk_port_offset (sk);
net/ipv6/inet6_hashtables.c +2 -2
@@ -308,7 +308,7 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,return -EADDRNOTAVAIL ; } -static u32 inet6_sk_port_offset (const struct sock *sk) +static u64 inet6_sk_port_offset (const struct sock *sk) {const struct inet_sock *inet =inet_sk (sk);
@@ -320,7 +320,7 @@ static u32 inet6_sk_port_offset(const struct sock *sk)int inet6_hash_connect (struct inet_timewait_death_row *death_row,struct sock *sk) { -u32 port_offset =0 ; +u64 port_offset =0 ;if (!inet_sk (sk)->inet_num) port_offset =inet6_sk_port_offset (sk);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 56/102 tcp: use different parts of the port_offset for index and offset
In reply to Greg Kroah-HartmanFrom: Willy Tarreau <[email protected]>
[ Upstream commit 9e9b70ae923baf2b5e8a0ea4fd0c8451801ac526 ]
Amit Klein suggests that we use different parts of port_offset for the table's index and the port offset so that there is no direct relation between them.
--- net/ipv4/inet_hashtables.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/inet_hashtables.c +1 -1
@@ -777,7 +777,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,net_get_random_once (table_perturb,sizeof (table_perturb)); index =hash_32 (port_offset,INET_TABLE_PERTURB_SHIFT ); - offset =READ_ONCE (table_perturb[index]) + port_offset; + offset =READ_ONCE (table_perturb[index]) + (port_offset >>32 ); offset %= remaining;/* In first pass we try ports of @low parity.
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 57/102 tcp: resalt the secret every 10 seconds
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 4dfa9b438ee34caca4e6a4e5e961641807367f6f ]
In order to limit the ability for an observer to recognize the source ports sequence used to contact a set of destinations, we should periodically shuffle the secret. 10 seconds looks effective enough without causing particular issues.
--- net/core/secure_seq.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
net/core/secure_seq.c +9 -3
@@ -22,6 +22,8 @@static siphash_key_t net_secret__read_mostly ;static siphash_key_t ts_secret__read_mostly ; +#define EPHEMERAL_PORT_SHUFFLE_PERIOD (10 * HZ) + static __always_inline void net_secret_init(void) {net_get_random_once (&net_secret,sizeof (net_secret));
@@ -100,11 +102,13 @@ u64 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,const struct {struct in6_addr saddr;struct in6_addr daddr; +unsigned int timeseed;__be16 dport; }__aligned(SIPHASH_ALIGNMENT) combined = { .saddr = *(struct in6_addr *)saddr, .daddr = *(struct in6_addr *)daddr, - .dport = dport + .timeseed = jiffies /EPHEMERAL_PORT_SHUFFLE_PERIOD , + .dport = dport, };net_secret_init (); return siphash(&combined, offsetofend(typeof(combined), dport),
@@ -145,8 +149,10 @@ EXPORT_SYMBOL_GPL(secure_tcp_seq);u64 secure_ipv4_port_ephemeral (__be32 saddr,__be32 daddr,__be16 dport) {net_secret_init (); -return siphash_3u32 ((__force u32 )saddr, (__force u32 )daddr, - (__force u16 )dport, &net_secret); +return siphash_4u32 ((__force u32 )saddr, (__force u32 )daddr, + (__force u16 )dport, + jiffies /EPHEMERAL_PORT_SHUFFLE_PERIOD , + &net_secret); }EXPORT_SYMBOL_GPL (secure_ipv4_port_ephemeral);#endif
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 58/102 tcp: add small random increments to the source port
In reply to Greg Kroah-HartmanFrom: Willy Tarreau <[email protected]>
[ Upstream commit ca7af0402550f9a0b3316d5f1c30904e42ed257d ]
Here we're randomly adding between 0 and 7 random increments to the selected source port in order to add some noise in the source port selection that will make the next port less predictable.
With the default port range of 32768-60999 this means a worst case reuse scenario of 14116/8=1764 connections between two consecutive uses of the same port, with an average of 14116/4.5=3137. This code was stressed at more than 800000 connections per second to a fixed target with all connections closed by the client using RSTs (worst condition) and only 2 connections failed among 13 billion, despite the hash being reseeded every 10 seconds, indicating a perfectly safe situation.
--- net/ipv4/inet_hashtables.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
net/ipv4/inet_hashtables.c +5 -4
@@ -833,11 +833,12 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,return -EADDRNOTAVAIL ; ok: -/* If our first attempt found a candidate, skip next candidate -* in 1/16 of cases to add some noise. +/* Here we want to add a little bit of randomness to the next source +* port that will be chosen. We use a max() with a random here so that +* on low contention the randomness is maximal and on high contention +* it may be inexistent. */ -if (!i && !(prandom_u32 () %16 )) - i =2 ; + i =max_t (int, i, (prandom_u32 () &7 ) *2 );WRITE_ONCE (table_perturb[index],READ_ONCE (table_perturb[index]) + i +2 );/* Head lock still held and bh's disabled */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 59/102 tcp: dynamically allocate the perturb table used by source ports
In reply to Greg Kroah-HartmanFrom: Willy Tarreau <[email protected]>
[ Upstream commit e9261476184be1abd486c9434164b2acbe0ed6c2 ]
We'll need to further increase the size of this table and it's likely that at some point its size will not be suitable anymore for a static table. Let's allocate it on boot from inet_hashinfo2_init(), which is called from tcp_init().
--- net/ipv4/inet_hashtables.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
net/ipv4/inet_hashtables.c +10 -2
@@ -731,7 +731,8 @@ EXPORT_SYMBOL_GPL(inet_unhash);* privacy, this only consumes 1 KB of kernel memory. */ #define INET_TABLE_PERTURB_SHIFT 8 -static u32 table_perturb[1 <<INET_TABLE_PERTURB_SHIFT ]; +#define INET_TABLE_PERTURB_SIZE (1 << INET_TABLE_PERTURB_SHIFT) +static u32 *table_perturb; int __inet_hash_connect(struct inet_timewait_death_row *death_row, struct sock *sk, u64 port_offset,
@@ -774,7 +775,8 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,if (likely (remaining >1 )) remaining &= ~1U ; -net_get_random_once (table_perturb,sizeof (table_perturb)); +net_get_random_once (table_perturb, +INET_TABLE_PERTURB_SIZE *sizeof (*table_perturb)); index =hash_32 (port_offset,INET_TABLE_PERTURB_SHIFT ); offset =READ_ONCE (table_perturb[index]) + (port_offset >>32 );
@@ -912,6 +914,12 @@ void __init inet_hashinfo2_init(struct inet_hashinfo *h, const char *name, low_limit, high_limit);init_hashinfo_lhash2 (h); + +/* this one is used for source ports of outgoing connections */ + table_perturb =kmalloc_array (INET_TABLE_PERTURB_SIZE , +sizeof (*table_perturb),GFP_KERNEL ); +if (!table_perturb) +panic ("TCP: failed to alloc table_perturb" ); }int inet_hashinfo2_init_mod (struct inet_hashinfo *h)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 60/102 tcp: increase source port perturb table to 2^16
In reply to Greg Kroah-HartmanFrom: Willy Tarreau <[email protected]>
[ Upstream commit 4c2c8f03a5ab7cb04ec64724d7d176d00bcc91e5 ]
Moshe Kol, Amit Klein, and Yossi Gilad reported being able to accurately identify a client by forcing it to emit only 40 times more connections than there are entries in the table_perturb[] table. The previous two improvements consisting in resalting the secret every 10s and adding randomness to each port selection only slightly improved the situation, and the current value of 2^8 was too small as it's not very difficult to make a client emit 10k connections in less than 10 seconds.
Thus we're increasing the perturb table from 2^8 to 2^16 so that the same precision now requires 2.6M connections, which is more difficult in this time frame and harder to hide as a background activity. The impact is that the table now uses 256 kB instead of 1 kB, which could mostly affect devices making frequent outgoing connections. However such components usually target a small set of destinations (load balancers, database clients, perf assessment tools), and in practice only a few entries will be visited, like before.
A live test at 1 million connections per second showed no performance difference from the previous value.
--- net/ipv4/inet_hashtables.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
net/ipv4/inet_hashtables.c +5 -4
@@ -726,11 +726,12 @@ EXPORT_SYMBOL_GPL(inet_unhash);* Note that we use 32bit integers (vs RFC 'short integers') * because 2^16 is not a multiple of num_ephemeral and this * property might be used by clever attacker. -* RFC claims using TABLE_LENGTH=10 buckets gives an improvement, -* we use 256 instead to really give more isolation and -* privacy, this only consumes 1 KB of kernel memory. +* RFC claims using TABLE_LENGTH=10 buckets gives an improvement, though +* attacks were since demonstrated, thus we use 65536 instead to really +* give more isolation and privacy, at the expense of 256kB of kernel +* memory. */ -#define INET_TABLE_PERTURB_SHIFT 8 +#define INET_TABLE_PERTURB_SHIFT 16#define INET_TABLE_PERTURB_SIZE (1 << INET_TABLE_PERTURB_SHIFT)static u32 *table_perturb;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 61/102 tcp: drop the hash_32() part from the index calculation
In reply to Greg Kroah-HartmanFrom: Willy Tarreau <[email protected]>
[ Upstream commit e8161345ddbb66e449abde10d2fdce93f867eba9 ]
In commit 190cc82489f4 ("tcp: change source port randomizarion at connect() time"), the table_perturb[] array was introduced and an index was taken from the port_offset via hash_32(). But it turns out that hash_32() performs a multiplication while the input here comes from the output of SipHash in secure_seq, that is well distributed enough to avoid the need for yet another hash.
--- net/ipv4/inet_hashtables.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/inet_hashtables.c +1 -1
@@ -778,7 +778,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,net_get_random_once (table_perturb,INET_TABLE_PERTURB_SIZE *sizeof (*table_perturb)); - index =hash_32 (port_offset,INET_TABLE_PERTURB_SHIFT ); + index = port_offset & (INET_TABLE_PERTURB_SIZE -1 ); offset =READ_ONCE (table_perturb[index]) + (port_offset >>32 ); offset %= remaining;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 62/102 interconnect: Restore sync state by ignoring ipa-virt in provider count
In reply to Greg Kroah-HartmanFrom: Stephen Boyd <[email protected]>
[ Upstream commit 20ce30fb4750f2ffc130cdcb26232b1dd87cd0a5 ]
Ignore compatible strings for the IPA virt drivers that were removed in commits 2fb251c26560 ("interconnect: qcom: sdx55: Drop IP0 interconnects") and 2f3724930eb4 ("interconnect: qcom: sc7180: Drop IP0 interconnects") so that the sync state logic can kick in again. Otherwise all the interconnects in the system will stay pegged at max speeds because 'providers_count' is always going to be one larger than the number of drivers that will ever probe on sc7180 or sdx55. This fixes suspend on sc7180 and sdx55 devices when you don't have a devicetree patch to remove the ipa-virt compatible node.
--- drivers/interconnect/core.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/interconnect/core.c +7 -1
@@ -1087,9 +1087,15 @@ static int of_count_icc_providers(struct device_node *np) {struct device_node *child;int count =0 ; +const struct of_device_id __maybe_unused ignore_list[] = { + { .compatible ="qcom,sc7180-ipa-virt" }, + { .compatible ="qcom,sdx55-ipa-virt" }, + {} + };for_each_available_child_of_node (np, child) { -if (of_property_read_bool (child,"#interconnect-cells" )) +if (of_property_read_bool (child,"#interconnect-cells" ) && +likely (!of_match_node (ignore_list, child))) count++; count +=of_count_icc_providers (child); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 63/102 firmware_loader: use kernel credentials when reading firmware
In reply to Greg Kroah-HartmanFrom: Thiébaud Weksteen <[email protected]>
commit 581dd69830341d299b0c097fc366097ab497d679 upstream.
Device drivers may decide to not load firmware when probed to avoid slowing down the boot process should the firmware filesystem not be available yet. In this case, the firmware loading request may be done when a device file associated with the driver is first accessed. The credentials of the userspace process accessing the device file may be used to validate access to the firmware files requested by the driver. Ensure that the kernel assumes the responsibility of reading the firmware.
This was observed on Android for a graphic driver loading their firmware when the device file (e.g. /dev/mali0) was first opened by userspace (i.e. surfaceflinger). The security context of surfaceflinger was used to validate the access to the firmware file (e.g. /vendor/firmware/mali.bin).
Previously, Android configurations were not setting up the firmware_class.path command line argument and were relying on the userspace fallback mechanism. In this case, the security context of the userspace daemon (i.e. ueventd) was consistently used to read firmware files. More Android devices are now found to set firmware_class.path which gives the kernel the opportunity to read the firmware directly (via kernel_read_file_from_path_initns). In this scenario, the current process credentials were used, even if unrelated to the loading of the firmware file.
--- drivers/base/firmware_loader/main.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
drivers/base/firmware_loader/main.c +17 -0
@@ -795,6 +795,8 @@ _request_firmware(const struct firmware size_t offset, u32 opt_flags) {struct firmware *fw =NULL ; +struct cred *kern_cred =NULL ; +const struct cred *old_cred;bool nondirect = false;int ret;
@@ -811,6 +813,18 @@ _request_firmware(const struct firmwareif (ret <=0 )/* error or already assigned */ goto out; +/* +* We are about to try to access the firmware file. Because we may have been +* called by a driver when serving an unrelated request from userland, we use +* the kernel credentials to read the file. +*/ + kern_cred =prepare_kernel_cred (NULL ); +if (!kern_cred) { + ret = -ENOMEM ; + goto out; + } + old_cred =override_creds (kern_cred); + ret =fw_get_filesystem_firmware (device, fw->priv,"" ,NULL );/* Only full reads can support decompression, platform, and sysfs. */
@@ -836,6 +850,9 @@ _request_firmware(const struct firmware }else ret =assign_fw (fw, device); +revert_creds (old_cred); +put_cred (kern_cred); + out:if (ret <0 ) {fw_abort_batch_reqs (fw);
Greg Kroah-Hartman
maintainerPATCH 64/102 KVM: PPC: Book3S PR: Enable MSR_DR for switch_mmu_context()
In reply to Greg Kroah-HartmanFrom: Alexander Graf <[email protected]>
commit ee8348496c77e3737d0a6cda307a521f2cff954f upstream.
Commit 863771a28e27 ("powerpc/32s: Convert switch_mmu_context() to C") moved the switch_mmu_context() to C. While in principle a good idea, it meant that the function now uses the stack. The stack is not accessible from real mode though.
So to keep calling the function, let's turn on MSR_DR while we call it. That way, all pointer references to the stack are handled virtually.
In addition, make sure to save/restore r12 on the stack, as it may get clobbered by the C function.
--- arch/powerpc/kvm/book3s_32_sr.S | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-)
arch/powerpc/kvm/book3s_32_sr.S +21 -5
@@ -122,11 +122,27 @@ /* 0x0 - 0xb */ - /* 'current->mm' needs to be in r4 */ - tophys(r4, r2) - lwz r4, MM(r4) - tophys(r4, r4) - /* This only clobbers r0, r3, r4 and r5 */ + /* switch_mmu_context() needs paging, let's enable it */ + mfmsr r9 + ori r11, r9, MSR_DR + mtmsr r11 + sync + + /* switch_mmu_context() clobbers r12, rescue it */ + SAVE_GPR(12, r1) + + /* Calling switch_mmu_context(<inv>, current->mm, <inv>); */ + lwz r4, MM(r2) bl switch_mmu_context + /* restore r12 */ + REST_GPR(12, r1) + + /* Disable paging again */ + mfmsr r9 + li r6, MSR_DR + andc r9, r9, r6 + mtmsr r9 + sync + .endm
Signature · 1 line
2.36.1
Greg Kroah-Hartman
maintainerPATCH 65/102 usb: xhci-mtk: fix fs isocs transfer error
In reply to Greg Kroah-HartmanFrom: Chunfeng Yun <[email protected]>
commit c237566b78ad8c72bc0431c5d6171db8d12e6f94 upstream.
Due to the scheduler allocates the optimal bandwidth for FS ISOC endpoints, this may be not enough actually and causes data transfer error, so come up with an estimate that is no less than the worst case bandwidth used for any one mframe, but may be an over-estimate.
--- drivers/usb/host/xhci-mtk-sch.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-)
drivers/usb/host/xhci-mtk-sch.c +7 -9
@@ -465,7 +465,7 @@ static int check_fs_bus_bw(struct mu3h_s*/ for (j =0 ; j < sch_ep->num_budget_microframes; j++) { k =XHCI_MTK_BW_INDEX (base + j); - tmp = tt->fs_bus_bw[k] + sch_ep->bw_budget_table[j]; + tmp = tt->fs_bus_bw[k] + sch_ep->bw_cost_per_microframe;if (tmp >FS_PAYLOAD_MAX )return -ESCH_BW_OVERFLOW ; }
@@ -539,19 +539,17 @@ static int check_sch_tt(struct mu3h_sch_static void update_sch_tt (struct mu3h_sch_ep_info *sch_ep,bool used) {struct mu3h_sch_tt *tt = sch_ep->sch_tt; +int bw_updated;u32 base; -int i, j, k; +int i, j; + + bw_updated = sch_ep->bw_cost_per_microframe * (used ?1 :-1 );for (i =0 ; i < sch_ep->num_esit; i++) { base = sch_ep->offset + i * sch_ep->esit; -for (j =0 ; j < sch_ep->num_budget_microframes; j++) { - k =XHCI_MTK_BW_INDEX (base + j); -if (used) - tt->fs_bus_bw[k] += sch_ep->bw_budget_table[j]; -else - tt->fs_bus_bw[k] -= sch_ep->bw_budget_table[j]; - } +for (j =0 ; j < sch_ep->num_budget_microframes; j++) + tt->fs_bus_bw[XHCI_MTK_BW_INDEX (base + j)] += bw_updated; }if (used)
Greg Kroah-Hartman
maintainerPATCH 66/102 x86/mm: Fix marking of unused sub-pmd ranges
In reply to Greg Kroah-HartmanFrom: Adrian-Ken Rueegsegger <[email protected]>
commit 280abe14b6e0a38de9cc86fe6a019523aadd8f70 upstream.
The unused part precedes the new range spanned by the start, end parameters of vmemmap_use_new_sub_pmd(). This means it actually goes from ALIGN_DOWN(start, PMD_SIZE) up to start.
Use the correct address when applying the mark using memset.
--- arch/x86/mm/init_64.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/x86/mm/init_64.c +3 -2
@@ -902,6 +902,8 @@ static void __meminit vmemmap_use_sub_pmstatic void __meminit vmemmap_use_new_sub_pmd (unsigned long start,unsigned long end) { +const unsigned long page =ALIGN_DOWN (start,PMD_SIZE ); +vmemmap_flush_unused_pmd ();/*
@@ -914,8 +916,7 @@ static void __meminit vmemmap_use_new_su* Mark with PAGE_UNUSED the unused parts of the new memmap range */ if (!IS_ALIGNED (start,PMD_SIZE )) -memset ((void *)start,PAGE_UNUSED , - start -ALIGN_DOWN (start,PMD_SIZE )); +memset ((void *)page,PAGE_UNUSED , start - page);/* * We want to avoid memset(PAGE_UNUSED) when populating the vmemmap of
Greg Kroah-Hartman
maintainerPATCH 67/102 tty/serial: digicolor: fix possible null-ptr-deref in digicolor_uart_probe()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
commit 447ee1516f19f534a228dda237eddb202f23e163 upstream.
It will cause null-ptr-deref when using 'res', if platform_get_resource() returns NULL, so move using 'res' after devm_ioremap_resource() that will check it to avoid null-ptr-deref.
And use devm_platform_get_and_ioremap_resource() to simplify code.
--- drivers/tty/serial/digicolor-usart.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/tty/serial/digicolor-usart.c +2 -3
@@ -471,11 +471,10 @@ static int digicolor_uart_probe(struct pif (IS_ERR (uart_clk))return PTR_ERR (uart_clk); - res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); - dp->port.mapbase = res->start; - dp->port.membase =devm_ioremap_resource (&pdev->dev, res); + dp->port.membase =devm_platform_get_and_ioremap_resource (pdev,0 , &res);if (IS_ERR (dp->port.membase))return PTR_ERR (dp->port.membase); + dp->port.mapbase = res->start; irq =platform_get_irq (pdev,0 );if (irq <0 )
Greg Kroah-Hartman
maintainerPATCH 68/102 tty: n_gsm: fix buffer over-read in gsm_dlci_data()
In reply to Greg Kroah-HartmanFrom: Daniel Starke <[email protected]>
commit fd442e5ba30aaa75ea47b32149e7a3110dc20a46 upstream.
'len' is decreased after each octet that has its EA bit set to 0, which means that the value is encoded with additional octets. However, the final octet does not decreases 'len' which results in 'len' being one byte too long. A buffer over-read may occur in tty_insert_flip_string() as it tries to read one byte more than the passed content size of 'data'. Decrease 'len' also for the final octet which has the EA bit set to 1 to write the correct number of bytes from the internal receive buffer to the virtual tty.
--- drivers/tty/n_gsm.c | 1 + 1 file changed, 1 insertion(+)
drivers/tty/n_gsm.c +1 -0
@@ -1587,6 +1587,7 @@ static void gsm_dlci_data(struct gsm_dlcif (len ==0 )return ; } + len--; slen++; tty =tty_port_tty_get (port);if (tty) {
Greg Kroah-Hartman
maintainerPATCH 69/102 tty: n_gsm: fix mux activation issues in gsm_config()
In reply to Greg Kroah-HartmanFrom: Daniel Starke <[email protected]>
commit edd5f60c340086891fab094ad61270d6c80f9ca4 upstream.
The current implementation activates the mux if it was restarted and opens the control channel if the mux was previously closed and we are now acting as initiator instead of responder, which is the default setting. This has two issues.
1) No mux is activated if we keep all default values and only switch to initiator. The control channel is not allocated but will be opened next which results in a NULL pointer dereference.
2) Switching the configuration after it was once configured while keeping the initiator value the same will not reopen the control channel if it was closed due to parameter incompatibilities. The mux remains dead.
Fix 1) by always activating the mux if it is dead after configuration. Fix 2) by always opening the control channel after mux activation.
--- drivers/tty/n_gsm.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/tty/n_gsm.c +8 -4
@@ -2276,6 +2276,7 @@ static void gsm_copy_config_values(strucstatic int gsm_config (struct gsm_mux *gsm,struct gsm_config *c) { +int ret =0 ;int need_close =0 ;int need_restart =0 ;
@@ -2343,10 +2344,13 @@ static int gsm_config(struct gsm_mux *gs* FIXME: We need to separate activation/deactivation from adding * and removing from the mux array */ -if (need_restart) -gsm_activate_mux (gsm); -if (gsm->initiator && need_close) -gsm_dlci_begin_open (gsm->dlci[0 ]); +if (gsm->dead) { + ret =gsm_activate_mux (gsm); +if (ret) +return ret; +if (gsm->initiator) +gsm_dlci_begin_open (gsm->dlci[0 ]); + }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 70/102 usb: cdc-wdm: fix reading stuck on device close
In reply to Greg Kroah-HartmanFrom: Sergey Ryazanov <[email protected]>
commit 01e01f5c89773c600a9f0b32c888de0146066c3a upstream.
cdc-wdm tracks whether a response reading request is in-progress and blocks the next request from being sent until the previous request is completed. As soon as last user closes the cdc-wdm device file, the driver cancels any ongoing requests, resets the pending response counter, but leaves the response reading in-progress flag (WDM_RESPONDING) untouched.
So if the user closes the device file during the response receive request is being performed, no more data will be obtained from the modem. The request will be cancelled, effectively preventing the WDM_RESPONDING flag from being reseted. Keeping the flag set will prevent a new response receive request from being sent, permanently blocking the read path. The read path will staying blocked until the module will be reloaded or till the modem will be re-attached.
This stuck has been observed with a Huawei E3372 modem attached to an OpenWrt router and using the comgt utility to set up a network connection.
Fix this issue by clearing the WDM_RESPONDING flag on the device file close.
Without this fix, the device reading stuck can be easily reproduced in a few connection establishing attempts. With this fix, a load test for modem connection re-establishing worked for several hours without any issues.
--- drivers/usb/class/cdc-wdm.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/class/cdc-wdm.c +1 -0
@@ -774,6 +774,7 @@ static int wdm_release(struct inode *inopoison_urbs (desc);spin_lock_irq (&desc->iuspin); desc->resp_count =0 ; +clear_bit (WDM_RESPONDING , &desc->flags);spin_unlock_irq (&desc->iuspin); desc->manage_power (desc->intf,0 );unpoison_urbs (desc);
Greg Kroah-Hartman
maintainerPATCH 71/102 usb: typec: tcpci: Dont skip cleanup in .remove() on error
In reply to Greg Kroah-HartmanFrom: Uwe Kleine-König <[email protected]>
commit bbc126ae381cf0a27822c1f822d0aeed74cc40d9 upstream.
Returning an error value in an i2c remove callback results in an error message being emitted by the i2c core, but otherwise it doesn't make a difference. The device goes away anyhow and the devm cleanups are called.
In this case the remove callback even returns early without stopping the tcpm worker thread and various timers. A work scheduled on the work queue, or a firing timer after tcpci_remove() returned probably results in a use-after-free situation because the regmap and driver data were freed. So better make sure that tcpci_unregister_port() is called even if disabling the irq failed.
Also emit a more specific error message instead of the i2c core's "remove failed (EIO), will be ignored" and return 0 to suppress the core's warning.
This patch is (also) a preparation for making i2c remove callbacks return void.
--- drivers/usb/typec/tcpm/tcpci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/typec/tcpm/tcpci.c +1 -1
@@ -877,7 +877,7 @@ static int tcpci_remove(struct i2c_clien/* Disable chip interrupts before unregistering port */ err =tcpci_write16 (chip->tcpci,TCPC_ALERT_MASK ,0 );if (err <0 ) -return err; +dev_warn (&client->dev,"Failed to disable irqs (%pe)\n" ,ERR_PTR (err));tcpci_unregister_port (chip->tcpci);
Greg Kroah-Hartman
maintainerPATCH 72/102 usb: typec: tcpci_mt6360: Update for BMC PHY setting
In reply to Greg Kroah-HartmanFrom: ChiYuan Huang <[email protected]>
commit 4031cd95cba70c72e4cadc2d46624bcd31e5a6c0 upstream.
Update MT6360 BMC PHY Tx/Rx setting for the compatibility.
Macpaul reported this CtoDP cable attention message cannot be received from MT6360 TCPC. But actually, attention message really sent from UFP_D device.
After RD's comment, there may be BMC PHY Tx/Rx setting causes this issue.
Below's the detailed TCPM log and DP attention message didn't received from 6360 TCPCI.
[ 1206.367775] Identity: 0000:0000.0000 [ 1206.416570] Alternate mode 0: SVID 0xff01, VDO 1: 0x00000405 [ 1206.447378] AMS DFP_TO_UFP_ENTER_MODE start [ 1206.447383] PD TX, header: 0x1d6f [ 1206.449393] PD TX complete, status: 0 [ 1206.454110] PD RX, header: 0x184f [1] [ 1206.456867] Rx VDM cmd 0xff018144 type 1 cmd 4 len 1 [ 1206.456872] AMS DFP_TO_UFP_ENTER_MODE finished [ 1206.456873] cc:=4 [ 1206.473100] AMS STRUCTURED_VDMS start [ 1206.473103] PD TX, header: 0x2f6f [ 1206.475397] PD TX complete, status: 0 [ 1206.480442] PD RX, header: 0x2a4f [1] [ 1206.483145] Rx VDM cmd 0xff018150 type 1 cmd 16 len 2 [ 1206.483150] AMS STRUCTURED_VDMS finished [ 1206.483151] cc:=4 [ 1206.505643] AMS STRUCTURED_VDMS start [ 1206.505646] PD TX, header: 0x216f [ 1206.507933] PD TX complete, status: 0 [ 1206.512664] PD RX, header: 0x1c4f [1] [ 1206.515456] Rx VDM cmd 0xff018151 type 1 cmd 17 len 1 [ 1206.515460] AMS STRUCTURED_VDMS finished [ 1206.515461] cc:=4
--- drivers/usb/typec/tcpm/tcpci_mt6360.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+)
drivers/usb/typec/tcpm/tcpci_mt6360.c +26 -0
@@ -15,6 +15,9 @@#include "tcpci.h" +#define MT6360_REG_PHYCTRL1 0x80 +#define MT6360_REG_PHYCTRL3 0x82 +#define MT6360_REG_PHYCTRL7 0x86#define MT6360_REG_VCONNCTRL1 0x8C#define MT6360_REG_MODECTRL2 0x8F#define MT6360_REG_SWRESET 0xA0
@@ -22,6 +25,8 @@#define MT6360_REG_DRPCTRL1 0xA2#define MT6360_REG_DRPCTRL2 0xA3#define MT6360_REG_I2CTORST 0xBF +#define MT6360_REG_PHYCTRL11 0xCA +#define MT6360_REG_RXCTRL1 0xCE#define MT6360_REG_RXCTRL2 0xCF#define MT6360_REG_CTDCTRL2 0xEC
@@ -106,6 +111,27 @@ static int mt6360_tcpc_init(struct tcpciif (ret)return ret; +/* BMC PHY */ + ret =mt6360_tcpc_write16 (regmap,MT6360_REG_PHYCTRL1 ,0x3A70 ); +if (ret) +return ret; + + ret =regmap_write (regmap,MT6360_REG_PHYCTRL3 ,0x82 ); +if (ret) +return ret; + + ret =regmap_write (regmap,MT6360_REG_PHYCTRL7 ,0x36 ); +if (ret) +return ret; + + ret =mt6360_tcpc_write16 (regmap,MT6360_REG_PHYCTRL11 ,0x3C60 ); +if (ret) +return ret; + + ret =regmap_write (regmap,MT6360_REG_RXCTRL1 ,0xE8 ); +if (ret) +return ret; +/* Set shipping mode off, AUTOIDLE on */ return regmap_write (regmap,MT6360_REG_MODECTRL2 ,0x7A ); }
Greg Kroah-Hartman
maintainerPATCH 73/102 USB: serial: pl2303: add device id for HP LM930 Display
In reply to Greg Kroah-HartmanFrom: Scott Chen <[email protected]>
commit 26a08f8bad3e1f98d3153f939fb8cd330da4cb26 upstream.
Add the device id for the HPLM930Display which is a PL2303GC based device.
--- drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 1 + 2 files changed, 2 insertions(+)
drivers/usb/serial/pl2303.c +1 -0
@@ -106,6 +106,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) }, { USB_DEVICE(HP_VENDOR_ID, HP_LCM960_PRODUCT_ID) }, { USB_DEVICE(HP_VENDOR_ID, HP_LM920_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_LM930_PRODUCT_ID) }, { USB_DEVICE(HP_VENDOR_ID, HP_LM940_PRODUCT_ID) }, { USB_DEVICE(HP_VENDOR_ID, HP_TD620_PRODUCT_ID) }, { USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) },
drivers/usb/serial/pl2303.h +1 -0
@@ -135,6 +135,7 @@#define HP_TD620_PRODUCT_ID 0x0956#define HP_LD960_PRODUCT_ID 0x0b39#define HP_LD381_PRODUCT_ID 0x0f7f +#define HP_LM930_PRODUCT_ID 0x0f9b#define HP_LCM220_PRODUCT_ID 0x3139#define HP_LCM960_PRODUCT_ID 0x3239#define HP_LD220_PRODUCT_ID 0x3524
Greg Kroah-Hartman
maintainerPATCH 74/102 USB: serial: qcserial: add support for Sierra Wireless EM7590
In reply to Greg Kroah-HartmanFrom: Ethan Yang <[email protected]>
commit 870b1eee2d844727b06e238c121d260bc5645580 upstream.
Add support for Sierra Wireless EM7590 0xc080/0xc081 compositions.
--- drivers/usb/serial/qcserial.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/qcserial.c +2 -0
@@ -166,6 +166,8 @@ static const struct usb_device_id id_tab {DEVICE_SWI(0x1199, 0x9090)}, /* Sierra Wireless EM7565 QDL */ {DEVICE_SWI(0x1199, 0x9091)}, /* Sierra Wireless EM7565 */ {DEVICE_SWI(0x1199, 0x90d2)}, /* Sierra Wireless EM9191 QDL */ + {DEVICE_SWI(0x1199, 0xc080)}, /* Sierra Wireless EM7590 QDL */ + {DEVICE_SWI(0x1199, 0xc081)}, /* Sierra Wireless EM7590 */ {DEVICE_SWI(0x413c, 0x81a2)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */ {DEVICE_SWI(0x413c, 0x81a3)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */ {DEVICE_SWI(0x413c, 0x81a4)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
Greg Kroah-Hartman
maintainerPATCH 75/102 USB: serial: option: add Fibocom L610 modem
In reply to Greg Kroah-HartmanFrom: Sven Schwermer <[email protected]>
commit 714adff9a6271b5f1664b04c944b598141ebfe73 upstream.
The L610 modem has 3 USB configurations that are configurable via the AT command AT+GTUSBMODE={31,32,33} which make the modem enumerate with the following interfaces, respectively:
31: Modem + NV + MOS + Diag + LOG + AT + AT 32: ECM + Modem + NV + MOS + Diag + LOG + AT + AT 33: RNDIS + Modem + NV + MOS + Diag + LOG + AT + AT
A detailed description of the USB configuration for each mode follows:
+GTUSBMODE: 31
--------------
T: Bus=03 Lev=01 Prnt=01 Port=06 Cnt=04 Dev#=124 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1782 ProdID=4d10 Rev= 0.00 S: Manufacturer=FIBOCOM S: Product=L610 C:* #Ifs= 7 Cfg#= 1 Atr=e0 MxPwr=400mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+GTUSBMODE: 32
--------------
T: Bus=03 Lev=01 Prnt=01 Port=06 Cnt=04 Dev#=122 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1782 ProdID=4d11 Rev= 0.00 S: Manufacturer=FIBOCOM S: Product=L610 C:* #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=400mA A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=06 Prot=00 I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+GTUSBMODE: 33
--------------
T: Bus=03 Lev=01 Prnt=01 Port=06 Cnt=04 Dev#=126 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1782 ProdID=4d11 Rev= 0.00 S: Manufacturer=FIBOCOM S: Product=L610
C:* #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=400mA
A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=03
I:* If#= 0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host
E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=4096ms
I:* If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -2123,6 +2123,8 @@ static const struct usb_device_id option .driver_info = RSVD(3) }, { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */ .driver_info = RSVD(4) | RSVD(5) | RSVD(6) }, + { USB_DEVICE(0x1782, 0x4d10) }, /* Fibocom L610 (AT mode) */ + { USB_DEVICE_INTERFACE_CLASS(0x1782, 0x4d11, 0xff) }, /* Fibocom L610 (ECM/RNDIS mode) */ { USB_DEVICE(0x2cb7, 0x0104), /* Fibocom NL678 series */ .driver_info = RSVD(4) | RSVD(5) }, { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */
Greg Kroah-Hartman
maintainerPATCH 76/102 USB: serial: option: add Fibocom MA510 modem
In reply to Greg Kroah-HartmanFrom: Sven Schwermer <[email protected]>
commit 07989eb981d862f7f2be68d233d753f2e7ccc119 upstream.
The MA510 modem has 3 USB configurations that are configurable via the AT command AT+GTUSBMODE={30,31,32} which make the modem enumerate with the following interfaces, respectively:
30: Diag + QDSS + Modem + RMNET
31: Diag + Modem + AT + ECM
32: Modem + AT + ECM
The first configuration (30) reuses u-blox R410M's VID/PID with identical interface configuration.
A detailed description of the USB configuration for each mode follows:
+GTUSBMODE: 30
--------------
T: Bus=03 Lev=01 Prnt=01 Port=06 Cnt=04 Dev#= 19 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=05c6 ProdID=90b2 Rev= 0.00 S: Manufacturer=Fibocom MA510 Modem S: Product=Fibocom MA510 Modem S: SerialNumber=55e2695b C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+GTUSBMODE: 31
--------------
T: Bus=03 Lev=01 Prnt=01 Port=06 Cnt=04 Dev#= 99 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2cb7 ProdID=0106 Rev= 0.00 S: Manufacturer=Fibocom MA510 Modem S: Product=Fibocom MA510 Modem S: SerialNumber=55e2695b C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA A: FirstIf#= 3 IfCount= 2 Cls=02(comm.) Sub=00 Prot=00 I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether E: Ad=86(I) Atr=03(Int.) MxPS= 64 Ivl=2ms I: If#= 4 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether I:* If#= 4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+GTUSBMODE: 32
--------------
T: Bus=03 Lev=01 Prnt=01 Port=06 Cnt=04 Dev#=100 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2cb7 ProdID=010a Rev= 0.00 S: Manufacturer=Fibocom MA510 Modem S: Product=Fibocom MA510 Modem S: SerialNumber=55e2695b C:* #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA A: FirstIf#= 2 IfCount= 2 Cls=02(comm.) Sub=00 Prot=00 I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms I: If#= 3 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether I:* If#= 3 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -2129,6 +2129,8 @@ static const struct usb_device_id option .driver_info = RSVD(4) | RSVD(5) }, { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */ .driver_info = RSVD(6) }, + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0106, 0xff) }, /* Fibocom MA510 (ECM mode w/ diag intf.) */ + { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x010a, 0xff) }, /* Fibocom MA510 (ECM mode) */ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) }, /* Fibocom FG150 Diag */ { USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) }, /* Fibocom FG150 AT */ { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) }, /* Fibocom NL668-AM/NL652-EU (laptop MBIM) */
Greg Kroah-Hartman
maintainerPATCH 77/102 slimbus: qcom: Fix IRQ check in qcom_slim_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
commit fe503887eed6ea528e144ec8dacfa1d47aa701ac upstream.
platform_get_irq() returns non-zero IRQ number on success, negative error number on failure.
And the doc of platform_get_irq() provides a usage example:
int irq = platform_get_irq(pdev, 0);
if (irq < 0)
return irq;Fix the check of return value to catch errors correctly.
--- drivers/slimbus/qcom-ctrl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/slimbus/qcom-ctrl.c +2 -2
@@ -510,9 +510,9 @@ static int qcom_slim_probe(struct platfo } ctrl->irq =platform_get_irq (pdev,0 ); -if (!ctrl->irq) { +if (ctrl->irq <0 ) {dev_err (&pdev->dev,"no slimbus IRQ\n" ); -return -ENODEV ; +return ctrl->irq; } sctrl = &ctrl->ctrl;
Greg Kroah-Hartman
maintainerPATCH 78/102 fsl_lpuart: Dont enable interrupts too early
In reply to Greg Kroah-HartmanFrom: Indan Zupancic <[email protected]>
commit 401fb66a355eb0f22096cf26864324f8e63c7d78 upstream.
If an irq is pending when devm_request_irq() is called, the irq handler will cause a NULL pointer access because initialisation is not done yet.
--- drivers/tty/serial/fsl_lpuart.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/tty/serial/fsl_lpuart.c +9 -9
@@ -2650,6 +2650,7 @@ static int lpuart_probe(struct platform_struct device_node *np = pdev->dev.of_node;struct lpuart_port *sport;struct resource *res; +irq_handler_t handler;int ret; sport =devm_kzalloc (&pdev->dev,sizeof (*sport),GFP_KERNEL );
@@ -2727,17 +2728,11 @@ static int lpuart_probe(struct platform_if (lpuart_is_32 (sport)) { lpuart_reg.cons =LPUART32_CONSOLE ; - ret =devm_request_irq (&pdev->dev, sport->port.irq, lpuart32_int,0 , -DRIVER_NAME , sport); + handler = lpuart32_int; }else { lpuart_reg.cons =LPUART_CONSOLE ; - ret =devm_request_irq (&pdev->dev, sport->port.irq, lpuart_int,0 , -DRIVER_NAME , sport); + handler = lpuart_int; } - -if (ret) - goto failed_irq_request; - ret =uart_add_one_port (&lpuart_reg, &sport->port);if (ret) goto failed_attach_port;
@@ -2759,13 +2754,18 @@ static int lpuart_probe(struct platform_ sport->port.rs485_config (&sport->port, &sport->port.rs485); + ret =devm_request_irq (&pdev->dev, sport->port.irq, handler,0 , +DRIVER_NAME , sport); +if (ret) + goto failed_irq_request; +return 0 ; +failed_irq_request: failed_get_rs485: failed_reset:uart_remove_one_port (&lpuart_reg, &sport->port); failed_attach_port: -failed_irq_request:lpuart_disable_clks (sport); failed_clock_enable: failed_out_of_range:
Greg Kroah-Hartman
maintainerPATCH 79/102 serial: 8250_mtk: Fix UART_EFR register address
In reply to Greg Kroah-HartmanFrom: AngeloGioacchino Del Regno <[email protected]>
commit bb0b197aadd928f52ce6f01f0ee977f0a08cf1be upstream.
On MediaTek SoCs, the UART IP is 16550A compatible, but there are some specific quirks: we are declaring a register shift of 2, but this is only valid for the majority of the registers, as there are some that are out of the standard layout.
Specifically, this driver is using definitions from serial_reg.h, where we have a UART_EFR register defined as 2: this results in a 0x8 offset, but there we have the FCR register instead.
The right offset for the EFR register on MediaTek UART is at 0x98, so, following the decimal definition convention in serial_reg.h and accounting for the register left shift of two, add and use the correct register address for this IP, defined as decimal 38, so that the final calculation results in (0x26 << 2) = 0x98.
--- drivers/tty/serial/8250/8250_mtk.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
drivers/tty/serial/8250/8250_mtk.c +8 -7
@@ -37,6 +37,7 @@#define MTK_UART_IER_RTSI 0x40/* Enable RTS Modem status interrupt */ #define MTK_UART_IER_CTSI 0x80/* Enable CTS Modem status interrupt */ +#define MTK_UART_EFR 38/* I/O: Extended Features Register */ #define MTK_UART_EFR_EN 0x10/* Enable enhancement feature */ #define MTK_UART_EFR_RTS 0x40/* Enable hardware rx flow control */ #define MTK_UART_EFR_CTS 0x80/* Enable hardware tx flow control */
@@ -169,7 +170,7 @@ static void mtk8250_dma_enable(struct ua MTK_UART_DMA_EN_RX | MTK_UART_DMA_EN_TX);serial_out (up,UART_LCR ,UART_LCR_CONF_MODE_B ); -serial_out (up,UART_EFR ,UART_EFR_ECB ); +serial_out (up,MTK_UART_EFR ,UART_EFR_ECB );serial_out (up,UART_LCR , lcr);if (dmaengine_slave_config (dma->rxchan, &dma->rxconf) !=0 )
@@ -232,7 +233,7 @@ static void mtk8250_set_flow_ctrl(structint lcr =serial_in (up,UART_LCR );serial_out (up,UART_LCR ,UART_LCR_CONF_MODE_B ); -serial_out (up,UART_EFR ,UART_EFR_ECB ); +serial_out (up,MTK_UART_EFR ,UART_EFR_ECB );serial_out (up,UART_LCR , lcr); lcr =serial_in (up,UART_LCR );
@@ -241,7 +242,7 @@ static void mtk8250_set_flow_ctrl(structserial_out (up,MTK_UART_ESCAPE_DAT ,MTK_UART_ESCAPE_CHAR );serial_out (up,MTK_UART_ESCAPE_EN ,0x00 );serial_out (up,UART_LCR ,UART_LCR_CONF_MODE_B ); -serial_out (up,UART_EFR ,serial_in (up,UART_EFR ) & +serial_out (up,MTK_UART_EFR ,serial_in (up,MTK_UART_EFR ) & (~(MTK_UART_EFR_HW_FC |MTK_UART_EFR_SW_FC_MASK )));serial_out (up,UART_LCR , lcr); mtk8250_disable_intrs(up, MTK_UART_IER_XOFFI |
@@ -255,8 +256,8 @@ static void mtk8250_set_flow_ctrl(structserial_out (up,UART_LCR ,UART_LCR_CONF_MODE_B );/*enable hw flow control*/ -serial_out (up,UART_EFR ,MTK_UART_EFR_HW_FC | - (serial_in (up,UART_EFR ) & +serial_out (up,MTK_UART_EFR ,MTK_UART_EFR_HW_FC | + (serial_in (up,MTK_UART_EFR ) & (~(MTK_UART_EFR_HW_FC |MTK_UART_EFR_SW_FC_MASK ))));serial_out (up,UART_LCR , lcr);
@@ -270,8 +271,8 @@ static void mtk8250_set_flow_ctrl(structserial_out (up,UART_LCR ,UART_LCR_CONF_MODE_B );/*enable sw flow control */ -serial_out (up,UART_EFR ,MTK_UART_EFR_XON1_XOFF1 | - (serial_in (up,UART_EFR ) & +serial_out (up,MTK_UART_EFR ,MTK_UART_EFR_XON1_XOFF1 | + (serial_in (up,MTK_UART_EFR ) & (~(MTK_UART_EFR_HW_FC |MTK_UART_EFR_SW_FC_MASK ))));serial_out (up,UART_XON1 ,START_CHAR (port->state->port.tty));
Greg Kroah-Hartman
maintainerPATCH 80/102 serial: 8250_mtk: Fix register address for XON/XOFF character
In reply to Greg Kroah-HartmanFrom: AngeloGioacchino Del Regno <[email protected]>
commit e1bfdbc7daca171c74a577b3dd0b36d76bb0ffcc upstream.
The XON1/XOFF1 character registers are at offset 0xa0 and 0xa8 respectively, so we cannot use the definition in serial_port.h.
--- drivers/tty/serial/8250/8250_mtk.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/tty/serial/8250/8250_mtk.c +5 -2
@@ -54,6 +54,9 @@#define MTK_UART_TX_TRIGGER 1#define MTK_UART_RX_TRIGGER MTK_UART_RX_SIZE +#define MTK_UART_XON1 40/* I/O: Xon character 1 */ +#define MTK_UART_XOFF1 42/* I/O: Xoff character 1 */ +#ifdef CONFIG_SERIAL_8250_DMA enum dma_rx_status { DMA_RX_START = 0,
@@ -275,8 +278,8 @@ static void mtk8250_set_flow_ctrl(struct (serial_in (up,MTK_UART_EFR ) & (~(MTK_UART_EFR_HW_FC | MTK_UART_EFR_SW_FC_MASK)))); -serial_out (up,UART_XON1 ,START_CHAR (port->state->port.tty)); -serial_out (up,UART_XOFF1 ,STOP_CHAR (port->state->port.tty)); +serial_out (up,MTK_UART_XON1 ,START_CHAR (port->state->port.tty)); +serial_out (up,MTK_UART_XOFF1 ,STOP_CHAR (port->state->port.tty));serial_out (up,UART_LCR , lcr);mtk8250_disable_intrs (up,MTK_UART_IER_CTSI |MTK_UART_IER_RTSI );mtk8250_enable_intrs (up,MTK_UART_IER_XOFFI );
Greg Kroah-Hartman
maintainerPATCH 81/102 ceph: fix setting of xattrs on async created inodes
In reply to Greg Kroah-HartmanFrom: Jeff Layton <[email protected]>
commit 620239d9a32e9fe27c9204ec11e40058671aeeb6 upstream.
Currently when we create a file, we spin up an xattr buffer to send along with the create request. If we end up doing an async create however, then we currently pass down a zero-length xattr buffer.
Fix the code to send down the xattr buffer in req->r_pagelist. If the xattrs span more than a page, however give up and don't try to do an async create.
Cc: [email protected]
URL: https://bugzilla.redhat.com/show_bug.cgi?id=2063929
--- fs/ceph/file.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
fs/ceph/file.c +13 -3
@@ -592,9 +592,15 @@ static int ceph_finish_async_create(stru iinfo.change_attr =1 ;ceph_encode_timespec64 (&iinfo.btime, &now); - iinfo.xattr_len =ARRAY_SIZE (xattr_buf); - iinfo.xattr_data = xattr_buf; -memset (iinfo.xattr_data,0 , iinfo.xattr_len); +if (req->r_pagelist) { + iinfo.xattr_len = req->r_pagelist->length; + iinfo.xattr_data = req->r_pagelist->mapped_tail; + }else { +/* fake it */ + iinfo.xattr_len =ARRAY_SIZE (xattr_buf); + iinfo.xattr_data = xattr_buf; +memset (iinfo.xattr_data,0 , iinfo.xattr_len); + } in.ino =cpu_to_le64 (vino.ino); in.snapid =cpu_to_le64 (CEPH_NOSNAP );
@@ -706,6 +712,10 @@ int ceph_atomic_open(struct inode *dir, err =ceph_security_init_secctx (dentry, mode, &as_ctx);if (err <0 ) goto out_ctx; +/* Async create can't handle more than a page of xattrs */ +if (as_ctx.pagelist && + !list_is_singular (&as_ctx.pagelist->head)) + try_async = false; }else if (!d_in_lookup (dentry)) {/* If it's not being looked up, it's negative */ return -ENOENT ;
Greg Kroah-Hartman
maintainerPATCH 82/102 Revert "mm/memory-failure.c: skip huge_zero_page in memory_failure()"
In reply to Greg Kroah-HartmanFrom: Xu Yu <[email protected]>
commit b4e61fc031b11dd807dffc46cebbf0e25966d3d1 upstream.
Patch series "mm/memory-failure: rework fix on huge_zero_page splitting".
This patch (of 2):
This reverts commit d173d5417fb67411e623d394aab986d847e47dad.
The commit d173d5417fb6 ("mm/memory-failure.c: skip huge_zero_page in memory_failure()") explicitly skips huge_zero_page in memory_failure(), in order to avoid triggering VM_BUG_ON_PAGE on huge_zero_page in split_huge_page_to_list().
This works, but Yang Shi thinks that,
Raising BUG is overkilling for splitting huge_zero_page. The huge_zero_page can't be met from normal paths other than memory failure, but memory failure is a valid caller. So I tend to replace the BUG to WARN + returning -EBUSY. If we don't care about the reason code in memory failure, we don't have to touch memory failure.
And for the issue that huge_zero_page will be set PG_has_hwpoisoned, Yang Shi comments that,
The anonymous page fault doesn't check if the page is poisoned or not since it typically gets a fresh allocated page and assumes the poisoned page (isolated successfully) can't be reallocated again. But huge zero page and base zero page are reused every time. So no matter what fix we pick, the issue is always there.
Finally, Yang, David, Anshuman and Naoya all agree to fix the bug, i.e., to split huge_zero_page, in split_huge_page_to_list().
This reverts the commit d173d5417fb6 ("mm/memory-failure.c: skip huge_zero_page in memory_failure()"), and the original bug will be fixed by the next patch.
--- mm/memory-failure.c | 13 ------------- 1 file changed, 13 deletions(-)
mm/memory-failure.c +0 -13
@@ -1692,19 +1692,6 @@ try_again:if (PageTransHuge (hpage)) {/* -* Bail out before SetPageHasHWPoisoned() if hpage is -* huge_zero_page, although PG_has_hwpoisoned is not -* checked in set_huge_zero_page(). -* -* TODO: Handle memory failure of huge_zero_page thoroughly. -*/ -if (is_huge_zero_page (hpage)) { -action_result (pfn,MF_MSG_UNSPLIT_THP ,MF_IGNORED ); - res = -EBUSY ; - goto unlock_mutex; - } - -/* * The flag must be set after the refcount is bumped * otherwise it may race with THP split. * And the flag can't be set in get_hwpoison_page() since
Greg Kroah-Hartman
maintainerPATCH 83/102 mm/huge_memory: do not overkill when splitting huge_zero_page
In reply to Greg Kroah-HartmanFrom: Xu Yu <[email protected]>
commit 478d134e9506c7e9bfe2830ed03dd85e97966313 upstream.
Kernel panic when injecting memory_failure for the global huge_zero_page,
when CONFIG_DEBUG_VM is enabled, as follows.
Injecting memory failure for pfn 0x109ff9 at process virtual address 0x20ff9000 page:00000000fb053fc3 refcount:2 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109e00 head:00000000fb053fc3 order:9 compound_mapcount:0 compound_pincount:0
flags: 0x17fffc000010001(locked|head|node=0|zone=2|lastcpupid=0x1ffff)
raw: 017fffc000010001 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000002ffffffff 0000000000000000 page dumped because: VM_BUG_ON_PAGE(is_huge_zero_page(head)) ------------[ cut here ]------------ kernel BUG at mm/huge_memory.c:2499! invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 6 PID: 553 Comm: split_bug Not tainted 5.18.0-rc1+ #11 Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 3288b3c 04/01/2014 RIP: 0010:split_huge_page_to_list+0x66a/0x880 Code: 84 9b fb ff ff 48 8b 7c 24 08 31 f6 e8 9f 5d 2a 00 b8 b8 02 00 00 e9 e8 fb ff ff 48 c7 c6 e8 47 3c 82 4c b RSP: 0018:ffffc90000dcbdf8 EFLAGS: 00010246 RAX: 000000000000003c RBX: 0000000000000001 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff823e4c4f RDI: 00000000ffffffff RBP: ffff88843fffdb40 R08: 0000000000000000 R09: 00000000fffeffff R10: ffffc90000dcbc48 R11: ffffffff82d68448 R12: ffffea0004278000 R13: ffffffff823c6203 R14: 0000000000109ff9 R15: ffffea000427fe40 FS: 00007fc375a26740(0000) GS:ffff88842fd80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc3757c9290 CR3: 0000000102174006 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: try_to_split_thp_page+0x3a/0x130 memory_failure+0x128/0x800 madvise_inject_error.cold+0x8b/0xa1 __x64_sys_madvise+0x54/0x60 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fc3754f8bf9 Code: 01 00 48 81 c4 80 00 00 00 e9 f1 fe ff ff 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 8 RSP: 002b:00007ffeda93a1d8 EFLAGS: 00000217 ORIG_RAX: 000000000000001c RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc3754f8bf9 RDX: 0000000000000064 RSI: 0000000000003000 RDI: 0000000020ff9000 RBP: 00007ffeda93a200 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000217 R12: 0000000000400490 R13: 00007ffeda93a2e0 R14: 0000000000000000 R15: 0000000000000000
We think that raising BUG is overkilling for splitting huge_zero_page, the huge_zero_page can't be met from normal paths other than memory failure, but memory failure is a valid caller. So we tend to replace the BUG to WARN + returning -EBUSY, and thus the panic above won't happen again.
--- mm/huge_memory.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
mm/huge_memory.c +6 -1
@@ -2617,11 +2617,16 @@ int split_huge_page_to_list(struct pagestruct address_space *mapping =NULL ;int extra_pins, ret;pgoff_t end; +bool is_hzp; -VM_BUG_ON_PAGE (is_huge_zero_page (head), head);VM_BUG_ON_PAGE (!PageLocked (head), head);VM_BUG_ON_PAGE (!PageCompound (head), head); + is_hzp =is_huge_zero_page (head); +VM_WARN_ON_ONCE_PAGE (is_hzp, head); +if (is_hzp) +return -EBUSY ; +if (PageWriteback (head))return -EBUSY ;
Greg Kroah-Hartman
maintainerPATCH 84/102 drm/vmwgfx: Disable command buffers on svga3 without gbobjects
In reply to Greg Kroah-HartmanFrom: Zack Rusin <[email protected]>
commit 21d1d192890ced87f2f04f8f4dea92406e0b162a upstream.
With very limited vram on svga3 it's difficult to handle all the surface migrations. Without gbobjects, i.e. the ability to store surfaces in guest mobs, there's no reason to support intermediate svga2 features, especially because we can fall back to fb traces and svga3 will never support those in-between features.
On svga3 we wither want to use fb traces or screen targets (i.e. gbobjects), nothing in between. This fixes presentation on a lot of fusion/esxi tech previews where the exposed svga3 caps haven't been finalized yet.
--- drivers/gpu/drm/vmwgfx/vmwgfx_cmd.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_cmd.c +7 -4
@@ -675,11 +675,14 @@ int vmw_cmd_emit_dummy_query(struct vmw_*/ bool vmw_cmd_supported (struct vmw_private *vmw) { -if ((vmw->capabilities & (SVGA_CAP_COMMAND_BUFFERS | -SVGA_CAP_CMD_BUFFERS_2 )) !=0 ) -return true; +bool has_cmdbufs = + (vmw->capabilities & (SVGA_CAP_COMMAND_BUFFERS | +SVGA_CAP_CMD_BUFFERS_2 )) !=0 ; +if (vmw_is_svga_v3 (vmw)) +return (has_cmdbufs && + (vmw->capabilities &SVGA_CAP_GBOBJECTS ) !=0 );/* * We have FIFO cmd's */ -return vmw->fifo_mem !=NULL ; +return has_cmdbufs || vmw->fifo_mem !=NULL ; }
Greg Kroah-Hartman
maintainerPATCH 85/102 drm/nouveau/tegra: Stop using iommu_present()
In reply to Greg Kroah-HartmanFrom: Robin Murphy <[email protected]>
commit 87fd2b091fb33871a7f812658a0971e8e26f903f upstream.
Even if some IOMMU has registered itself on the platform "bus", that doesn't necessarily mean it provides translation for the device we care about. Replace iommu_present() with a more appropriate check.
--- drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c +1 -1
@@ -123,7 +123,7 @@ nvkm_device_tegra_probe_iommu(struct nvkmutex_init (&tdev->iommu.mutex); -if (iommu_present (&platform_bus_type)) { +if (device_iommu_mapped (dev)) { tdev->iommu.domain =iommu_domain_alloc (&platform_bus_type);if (!tdev->iommu.domain) goto error;
Greg Kroah-Hartman
maintainerPATCH 86/102 i40e: i40e_main: fix a missing check on list iterator
In reply to Greg Kroah-HartmanFrom: Xiaomeng Tong <[email protected]>
commit 3f95a7472d14abef284d8968734fe2ae7ff4845f upstream.
The bug is here:
ret = i40e_add_macvlan_filter(hw, ch->seid, vdev->dev_addr, &aq_err);
The list iterator 'ch' will point to a bogus position containing HEAD if the list is empty or no element is found. This case must be checked before any use of the iterator, otherwise it will lead to a invalid memory access.
To fix this bug, use a new variable 'iter' as the list iterator, while use the origin variable 'ch' as a dedicated pointer to point to the found element.
--- drivers/net/ethernet/intel/i40e/i40e_main.c | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-)
drivers/net/ethernet/intel/i40e/i40e_main.c +14 -13
@@ -7535,42 +7535,43 @@ static void i40e_free_macvlan_channels(sstatic int i40e_fwd_ring_up (struct i40e_vsi *vsi,struct net_device *vdev,struct i40e_fwd_adapter *fwd) { +struct i40e_channel *ch =NULL , *ch_tmp, *iter;int ret =0 , num_tc =1 , i, aq_err; -struct i40e_channel *ch, *ch_tmp;struct i40e_pf *pf = vsi->back;struct i40e_hw *hw = &pf->hw; -if (list_empty (&vsi->macvlan_list)) -return -EINVAL ; -/* Go through the list and find an available channel */ -list_for_each_entry_safe (ch, ch_tmp, &vsi->macvlan_list, list) { -if (!i40e_is_channel_macvlan (ch)) { - ch->fwd = fwd; +list_for_each_entry_safe (iter, ch_tmp, &vsi->macvlan_list, list) { +if (!i40e_is_channel_macvlan (iter)) { + iter->fwd = fwd;/* record configuration for macvlan interface in vdev */ for (i =0 ; i < num_tc; i++)netdev_bind_sb_channel_queue (vsi->netdev, vdev, i, - ch->num_queue_pairs, - ch->base_queue); -for (i =0 ; i < ch->num_queue_pairs; i++) { + iter->num_queue_pairs, + iter->base_queue); +for (i =0 ; i < iter->num_queue_pairs; i++) {struct i40e_ring *tx_ring, *rx_ring;u16 pf_q; - pf_q = ch->base_queue + i; + pf_q = iter->base_queue + i;/* Get to TX ring ptr */ tx_ring = vsi->tx_rings[pf_q]; - tx_ring->ch = ch; + tx_ring->ch = iter;/* Get the RX ring ptr */ rx_ring = vsi->rx_rings[pf_q]; - rx_ring->ch = ch; + rx_ring->ch = iter; } + ch = iter;break ; } } +if (!ch) +return -EINVAL ; +/* Guarantee all rings are updated before we update the * MAC address filter. */
Greg Kroah-Hartman
maintainerPATCH 87/102 net: atlantic: always deep reset on pm op, fixing up my null deref regression
In reply to Greg Kroah-HartmanFrom: Manuel Ullmann <[email protected]>
commit 1809c30b6e5a83a1de1435fe01aaa4de4d626a7c upstream.
The impact of this regression is the same for resume that I saw on
thaw: the kernel hangs and nothing except SysRq rebooting can be done.
Fixes regression in commit cbe6c3a8f8f4 ("net: atlantic: invert deep par in pm functions, preventing null derefs"), where I disabled deep pm resets in suspend and resume, trying to make sense of the atl_resume_common() deep parameter in the first place.
It turns out, that atlantic always has to deep reset on pm operations. Even though I expected that and tested resume, I screwed up by kexec-rebooting into an unpatched kernel, thus missing the breakage.
This fixup obsoletes the deep parameter of atl_resume_common, but I leave the cleanup for the maintainers to post to mainline.
Suspend and hibernation were successfully tested by the reporters.
--- drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c +2 -2
@@ -449,7 +449,7 @@ static int aq_pm_freeze(struct device *dstatic int aq_pm_suspend_poweroff (struct device *dev) { -return aq_suspend_common (dev, false); +return aq_suspend_common (dev, true); }static int aq_pm_thaw (struct device *dev)
@@ -459,7 +459,7 @@ static int aq_pm_thaw(struct device *devstatic int aq_pm_resume_restore (struct device *dev) { -return atl_resume_common (dev, false); +return atl_resume_common (dev, true); }static const struct dev_pm_ops aq_pm_ops = {
Greg Kroah-Hartman
maintainerPATCH 88/102 net: phy: Fix race condition on link status change
In reply to Greg Kroah-HartmanFrom: Francesco Dolcini <[email protected]>
commit 91a7cda1f4b8bdf770000a3b60640576dafe0cec upstream.
This fixes the following error caused by a race condition between phydev->adjust_link() and a MDIO transaction in the phy interrupt handler. The issue was reproduced with the ethernet FEC driver and a micrel KSZ9031 phy.
[ 146.195696] fec 2188000.ethernet eth0: MDIO read timeout [ 146.201779] ------------[ cut here ]------------ [ 146.206671] WARNING: CPU: 0 PID: 571 at drivers/net/phy/phy.c:942 phy_error+0x24/0x6c [ 146.214744] Modules linked in: bnep imx_vdoa imx_sdma evbug [ 146.220640] CPU: 0 PID: 571 Comm: irq/128-2188000 Not tainted 5.18.0-rc3-00080-gd569e86915b7 #9 [ 146.229563] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) [ 146.236257] unwind_backtrace from show_stack+0x10/0x14 [ 146.241640] show_stack from dump_stack_lvl+0x58/0x70 [ 146.246841] dump_stack_lvl from __warn+0xb4/0x24c [ 146.251772] __warn from warn_slowpath_fmt+0x5c/0xd4 [ 146.256873] warn_slowpath_fmt from phy_error+0x24/0x6c [ 146.262249] phy_error from kszphy_handle_interrupt+0x40/0x48 [ 146.268159] kszphy_handle_interrupt from irq_thread_fn+0x1c/0x78 [ 146.274417] irq_thread_fn from irq_thread+0xf0/0x1dc [ 146.279605] irq_thread from kthread+0xe4/0x104 [ 146.284267] kthread from ret_from_fork+0x14/0x28 [ 146.289164] Exception stack(0xe6fa1fb0 to 0xe6fa1ff8) [ 146.294448] 1fa0: 00000000 00000000 00000000 00000000 [ 146.302842] 1fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 146.311281] 1fe0: 00000000 00000000 00000000 00000000 00000013 00000000 [ 146.318262] irq event stamp: 12325 [ 146.321780] hardirqs last enabled at (12333): [<c01984c4>] __up_console_sem+0x50/0x60 [ 146.330013] hardirqs last disabled at (12342): [<c01984b0>] __up_console_sem+0x3c/0x60 [ 146.338259] softirqs last enabled at (12324): [<c01017f0>] __do_softirq+0x2c0/0x624 [ 146.346311] softirqs last disabled at (12319): [<c01300ac>] __irq_exit_rcu+0x138/0x178 [ 146.354447] ---[ end trace 0000000000000000 ]---
With the FEC driver phydev->adjust_link() calls fec_enet_adjust_link() calls fec_stop()/fec_restart() and both these function reset and temporary disable the FEC disrupting any MII transaction that could be happening at the same time.
fec_enet_adjust_link() and phy_read() can be running at the same time when we have one additional interrupt before the phy_state_machine() is able to terminate.
Thread 1 (phylib WQ) | Thread 2 (phy interrupt)
|
| phy_interrupt() <-- PHY IRQ
| handle_interrupt()
| phy_read()
| phy_trigger_machine()
| --> schedule phylib WQ
|
|
phy_state_machine() |
phy_check_link_status() |
phy_link_change() |
phydev->adjust_link() |
fec_enet_adjust_link() |
--> FEC reset | phy_interrupt() <-- PHY IRQ
| phy_read()
|Fix this by acquiring the phydev lock in phy_interrupt().
--- drivers/net/phy/phy.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/phy/phy.c +6 -1
@@ -970,8 +970,13 @@ static irqreturn_t phy_interrupt(int irq {struct phy_device *phydev = phy_dat;struct phy_driver *drv = phydev->drv; +irqreturn_t ret; -return drv->handle_interrupt (phydev); +mutex_lock (&phydev->lock); + ret = drv->handle_interrupt (phydev); +mutex_unlock (&phydev->lock); + +return ret; }/**
Greg Kroah-Hartman
maintainerPATCH 89/102 writeback: Avoid skipping inode writeback
In reply to Greg Kroah-HartmanFrom: Jing Xia <[email protected]>
commit 846a3351ddfe4a86eede4bb26a205c3f38ef84d3 upstream.
We have run into an issue that a task gets stuck in balance_dirty_pages_ratelimited() when perform I/O stress testing. The reason we observed is that an I_DIRTY_PAGES inode with lots of dirty pages is in b_dirty_time list and standard background writeback cannot writeback the inode.
After studing the relevant code, the following scenario may lead to the issue:
task1 task2
----- -----fuse_flush
write_inode_now //in b_dirty_time
writeback_single_inode
__writeback_single_inode
fuse_write_end
filemap_dirty_folio
__xa_set_mark:PAGECACHE_TAG_DIRTY
lock inode->i_lock
if mapping tagged PAGECACHE_TAG_DIRTY
inode->i_state |= I_DIRTY_PAGES
unlock inode->i_lock
__mark_inode_dirty:I_DIRTY_PAGES
lock inode->i_lock
-was dirty,inode stays in
-b_dirty_time
unlock inode->i_lock if(!(inode->i_state & I_DIRTY_All))
-not true,so nothing done
This patch moves the dirty inode to b_dirty list when the inode currently is not queued in b_io or b_more_io list at the end of writeback_single_inode.
--- fs/fs-writeback.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/fs-writeback.c +4 -0
@@ -1739,6 +1739,10 @@ static int writeback_single_inode(struct*/ if (!(inode->i_state &I_DIRTY_ALL ))inode_cgwb_move_to_attached (inode, wb); +else if (!(inode->i_state &I_SYNC_QUEUED ) && + (inode->i_state &I_DIRTY )) +redirty_tail_locked (inode, wb); +spin_unlock (&wb->list_lock);inode_sync_complete (inode); out:
Greg Kroah-Hartman
maintainerPATCH 90/102 cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp()
In reply to Greg Kroah-HartmanFrom: Waiman Long <[email protected]>
commit 2685027fca387b602ae565bff17895188b803988 upstream.
There are 3 places where the cpu and node masks of the top cpuset can be initialized in the order they are executed:
1) start_kernel -> cpuset_init()
2) start_kernel -> cgroup_init() -> cpuset_bind()
3) kernel_init_freeable() -> do_basic_setup() -> cpuset_init_smp()
The first cpuset_init() call just sets all the bits in the masks. The second cpuset_bind() call sets cpus_allowed and mems_allowed to the default v2 values. The third cpuset_init_smp() call sets them back to v1 values.
For systems with cgroup v2 setup, cpuset_bind() is called once. As a result, cpu and memory node hot add may fail to update the cpu and node masks of the top cpuset to include the newly added cpu or node in a cgroup v2 environment.
For systems with cgroup v1 setup, cpuset_bind() is called again by rebind_subsystem() when the v1 cpuset filesystem is mounted as shown in the dmesg log below with an instrumented kernel.
[ 2.609781] cpuset_bind() called - v2 = 1 [ 3.079473] cpuset_init_smp() called [ 7.103710] cpuset_bind() called - v2 = 0
smp_init() is called after the first two init functions. So we don't have a complete list of active cpus and memory nodes until later in cpuset_init_smp() which is the right time to set up effective_cpus and effective_mems.
To fix this cgroup v2 mask setup problem, the potentially incorrect cpus_allowed & mems_allowed setting in cpuset_init_smp() are removed. For cgroup v2 systems, the initial cpuset_bind() call will set the masks correctly. For cgroup v1 systems, the second call to cpuset_bind() will do the right setup.
--- kernel/cgroup/cpuset.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
kernel/cgroup/cpuset.c +5 -2
@@ -3347,8 +3347,11 @@ static struct notifier_block cpuset_trac*/ void __init cpuset_init_smp (void ) { -cpumask_copy (top_cpuset.cpus_allowed, cpu_active_mask); - top_cpuset.mems_allowed = node_states[N_MEMORY ]; +/* +* cpus_allowd/mems_allowed set to v2 values in the initial +* cpuset_bind() call will be reset to v1 values in another +* cpuset_bind() call when v1 cpuset is mounted. +*/ top_cpuset.old_mems_allowed = top_cpuset.mems_allowed;cpumask_copy (top_cpuset.effective_cpus, cpu_active_mask);
Greg Kroah-Hartman
maintainerPATCH 91/102 arm[64]/memremap: dont abuse pfn_valid() to ensure presence of linear map
In reply to Greg Kroah-HartmanFrom: Mike Rapoport <[email protected]>
commit 260364d112bc822005224667c0c9b1b17a53eafd upstream.
The semantics of pfn_valid() is to check presence of the memory map for a PFN and not whether a PFN is covered by the linear map. The memory map may be present for NOMAP memory regions, but they won't be mapped in the linear mapping. Accessing such regions via __va() when they are memremap()'ed will cause a crash.
On v5.4.y the crash happens on qemu-arm with UEFI [1]:
<1>[ 0.084476] 8<--- cut here --- <1>[ 0.084595] Unable to handle kernel paging request at virtual address dfb76000 <1>[ 0.084938] pgd = (ptrval) <1>[ 0.085038] [dfb76000] *pgd=5f7fe801, *pte=00000000, *ppte=00000000
...
<4>[ 0.093923] [<c0ed6ce8>] (memcpy) from [<c16a06f8>] (dmi_setup+0x60/0x418) <4>[ 0.094204] [<c16a06f8>] (dmi_setup) from [<c16a38d4>] (arm_dmi_init+0x8/0x10) <4>[ 0.094408] [<c16a38d4>] (arm_dmi_init) from [<c0302e9c>] (do_one_initcall+0x50/0x228) <4>[ 0.094619] [<c0302e9c>] (do_one_initcall) from [<c16011e4>] (kernel_init_freeable+0x15c/0x1f8) <4>[ 0.094841] [<c16011e4>] (kernel_init_freeable) from [<c0f028cc>] (kernel_init+0x8/0x10c) <4>[ 0.095057] [<c0f028cc>] (kernel_init) from [<c03010e8>] (ret_from_fork+0x14/0x2c)
On kernels v5.10.y and newer the same crash won't reproduce on ARM because commit b10d6bca8720 ("arch, drivers: replace for_each_membock() with for_each_mem_range()") changed the way memory regions are registered in the resource tree, but that merely covers up the problem.
On ARM64 memory resources registered in yet another way and there the issue of wrong usage of pfn_valid() to ensure availability of the linear map is also covered.
Implement arch_memremap_can_ram_remap() on ARM and ARM64 to prevent access to NOMAP regions via the linear mapping in memremap().
--- arch/arm/include/asm/io.h | 3 +++ arch/arm/mm/ioremap.c | 8 ++++++++ arch/arm64/include/asm/io.h | 4 ++++ arch/arm64/mm/ioremap.c | 8 ++++++++ 4 files changed, 23 insertions(+)
arch/arm/include/asm/io.h +3 -0
@@ -436,6 +436,9 @@ extern void pci_iounmap(struct pci_dev *#define ARCH_HAS_VALID_PHYS_ADDR_RANGE extern int valid_phys_addr_range (phys_addr_t addr,size_t size);extern int valid_mmap_phys_addr_range (unsigned long pfn,size_t size); +extern bool arch_memremap_can_ram_remap (resource_size_t offset,size_t size, +unsigned long flags); +#define arch_memremap_can_ram_remap arch_memremap_can_ram_remap#endif /*
arch/arm/mm/ioremap.c +8 -0
@@ -479,3 +479,11 @@ void __init early_ioremap_init(void) {early_ioremap_setup (); } + +bool arch_memremap_can_ram_remap (resource_size_t offset,size_t size, +unsigned long flags) +{ +unsigned long pfn =PHYS_PFN (offset); + +return memblock_is_map_memory (pfn); +}
arch/arm64/include/asm/io.h +4 -0
@@ -192,4 +192,8 @@ extern void __iomem *ioremap_cache(phys_extern int valid_phys_addr_range (phys_addr_t addr,size_t size);extern int valid_mmap_phys_addr_range (unsigned long pfn,size_t size); +extern bool arch_memremap_can_ram_remap (resource_size_t offset,size_t size, +unsigned long flags); +#define arch_memremap_can_ram_remap arch_memremap_can_ram_remap +#endif /* __ASM_IO_H */
arch/arm64/mm/ioremap.c +8 -0
@@ -99,3 +99,11 @@ void __init early_ioremap_init(void) {early_ioremap_setup (); } + +bool arch_memremap_can_ram_remap (resource_size_t offset,size_t size, +unsigned long flags) +{ +unsigned long pfn =PHYS_PFN (offset); + +return pfn_is_map_memory (pfn); +}
Greg Kroah-Hartman
maintainerPATCH 92/102 net: phy: micrel: Do not use kszphy_suspend/resume for KSZ8061
In reply to Greg Kroah-HartmanFrom: Fabio Estevam <[email protected]>
commit e333eed63a091a09bd0db191b7710c594c6e995b upstream.
Since commit f1131b9c23fb ("net: phy: micrel: use kszphy_suspend()/kszphy_resume for irq aware devices") the following NULL pointer dereference is observed on a board with KSZ8061:
# udhcpc -i eth0 udhcpc: started, v1.35.0 8<--- cut here --- Unable to handle kernel NULL pointer dereference at virtual address 00000008 pgd = f73cef4e [00000008] *pgd=00000000 Internal error: Oops: 5 [#1] SMP ARM Modules linked in: CPU: 0 PID: 196 Comm: ifconfig Not tainted 5.15.37-dirty #94 Hardware name: Freescale i.MX6 SoloX (Device Tree) PC is at kszphy_config_reset+0x10/0x114 LR is at kszphy_resume+0x24/0x64 ...
The KSZ8061 phy_driver structure does not have the .probe/..driver_data fields, which means that priv is not allocated.
This causes the NULL pointer dereference inside kszphy_config_reset().
Fix the problem by using the generic suspend/resume functions as before.
Another alternative would be to provide the .probe and .driver_data information into the structure, but to be on the safe side, let's just restore Ethernet functionality by using the generic suspend/resume.
--- drivers/net/phy/micrel.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/phy/micrel.c +2 -2
@@ -1669,8 +1669,8 @@ static struct phy_driver ksphy_driver[] .config_init = ksz8061_config_init, .config_intr = kszphy_config_intr, .handle_interrupt = kszphy_handle_interrupt, - .suspend = kszphy_suspend, - .resume = kszphy_resume, + .suspend = genphy_suspend, + .resume = genphy_resume, }, { .phy_id = PHY_ID_KSZ9021, .phy_id_mask = 0x000ffffe,
Greg Kroah-Hartman
maintainerPATCH 93/102 net: phy: micrel: Pass .probe for KS8737
In reply to Greg Kroah-HartmanFrom: Fabio Estevam <[email protected]>
commit 15f03ffe4bb951e982457f44b6cf6b06ef4cbb93 upstream.
Since commit f1131b9c23fb ("net: phy: micrel: use kszphy_suspend()/kszphy_resume for irq aware devices") the kszphy_suspend/ resume hooks are used.
These functions require the probe function to be called so that priv can be allocated.
Otherwise, a NULL pointer dereference happens inside kszphy_config_reset().
--- drivers/net/phy/micrel.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/phy/micrel.c +1 -0
@@ -1544,6 +1544,7 @@ static struct phy_driver ksphy_driver[] .name = "Micrel KS8737",/* PHY_BASIC_FEATURES */ .driver_data = &ks8737_type, + .probe = kszphy_probe, .config_init = kszphy_config_init, .config_intr = kszphy_config_intr, .handle_interrupt = kszphy_handle_interrupt,
Greg Kroah-Hartman
maintainerPATCH 94/102 SUNRPC: Ensure that the gssproxy client can start in a connected state
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
commit fd13359f54ee854f00134abc6be32da94ec53dbf upstream.
Ensure that the gssproxy client connects to the server from the gssproxy daemon process context so that the AF_LOCAL socket connection is done using the correct path and namespaces.
--- include/linux/sunrpc/clnt.h | 1 + net/sunrpc/auth_gss/gss_rpc_upcall.c | 1 + net/sunrpc/clnt.c | 33 +++++++++++++++++++++++++++++++++ 3 files changed, 35 insertions(+)
include/linux/sunrpc/clnt.h +1 -0
@@ -159,6 +159,7 @@ struct rpc_add_xprt_test {#define RPC_CLNT_CREATE_NO_RETRANS_TIMEOUT (1UL << 9)#define RPC_CLNT_CREATE_SOFTERR (1UL << 10)#define RPC_CLNT_CREATE_REUSEPORT (1UL << 11) +#define RPC_CLNT_CREATE_CONNECTED (1UL << 12)struct rpc_clnt *rpc_create (struct rpc_create_args *args); struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *,
net/sunrpc/auth_gss/gss_rpc_upcall.c +1 -0
@@ -98,6 +98,7 @@ static int gssp_rpc_create(struct net *n* done without the correct namespace: */ .flags = RPC_CLNT_CREATE_NOPING | +RPC_CLNT_CREATE_CONNECTED |RPC_CLNT_CREATE_NO_IDLE_TIMEOUT };struct rpc_clnt *clnt;
net/sunrpc/clnt.c +33 -0
@@ -76,6 +76,7 @@ static int rpc_encode_header(struct rpc_static int rpc_decode_header (struct rpc_task *task,struct xdr_stream *xdr);static int rpc_ping (struct rpc_clnt *clnt); +static int rpc_ping_noreply (struct rpc_clnt *clnt);static void rpc_check_timeout (struct rpc_task *task);static void rpc_register_client (struct rpc_clnt *clnt)
@@ -483,6 +484,12 @@ static struct rpc_clnt *rpc_create_xprt(rpc_shutdown_client (clnt);return ERR_PTR (err); } + }else if (args->flags &RPC_CLNT_CREATE_CONNECTED ) { +int err =rpc_ping_noreply (clnt); +if (err !=0 ) { +rpc_shutdown_client (clnt); +return ERR_PTR (err); + } } clnt->cl_softrtry =1 ;
@@ -2704,6 +2711,10 @@ static const struct rpc_procinfo rpcproc .p_decode = rpcproc_decode_null, }; +static const struct rpc_procinfo rpcproc_null_noreply = { + .p_encode = rpcproc_encode_null, +}; +static void rpc_null_call_prepare (struct rpc_task *task,void *data) {
@@ -2753,6 +2764,28 @@ static int rpc_ping(struct rpc_clnt *clnif (IS_ERR (task))return PTR_ERR (task); status = task->tk_status; +rpc_put_task (task); +return status; +} + +static int rpc_ping_noreply (struct rpc_clnt *clnt) +{ +struct rpc_message msg = { + .rpc_proc = &rpcproc_null_noreply, + }; +struct rpc_task_setup task_setup_data = { + .rpc_client = clnt, + .rpc_message = &msg, + .callback_ops = &rpc_null_ops, + .flags =RPC_TASK_SOFT |RPC_TASK_SOFTCONN |RPC_TASK_NULLCREDS , + }; +struct rpc_task *task; +int status; + + task =rpc_run_task (&task_setup_data); +if (IS_ERR (task)) +return PTR_ERR (task); + status = task->tk_status;rpc_put_task (task);return status; }
Greg Kroah-Hartman
maintainerPATCH 95/102 drm/vmwgfx: Initialize drm_mode_fb_cmd2
In reply to Greg Kroah-HartmanFrom: Zack Rusin <[email protected]>
commit 3059d9b9f6aa433a55b9d0d21b566396d5497c33 upstream.
Transition to drm_mode_fb_cmd2 from drm_mode_fb_cmd left the structure unitialized. drm_mode_fb_cmd2 adds a few additional members, e.g. flags and modifiers which were never initialized. Garbage in those members can cause random failures during the bringup of the fbcon.
Initializing the structure fixes random blank screens after bootup due to flags/modifiers mismatches during the fbcon bring up.
--- drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +1 -1
@@ -490,7 +490,7 @@ static int vmw_fb_kms_detach(struct vmw_static int vmw_fb_kms_framebuffer (struct fb_info *info) { -struct drm_mode_fb_cmd2 mode_cmd; +struct drm_mode_fb_cmd2 mode_cmd = {0 };struct vmw_fb_par *par = info->par;struct fb_var_screeninfo *var = &info->var;struct drm_framebuffer *cur_fb;
Greg Kroah-Hartman
maintainerPATCH 96/102 Revert "drm/amd/pm: keep the BACO feature enabled for suspend"
In reply to Greg Kroah-HartmanFrom: Alex Deucher <[email protected]>
commit a56f445f807b0276fc0660c330bf93a9ea78e8ea upstream.
This reverts commit eaa090538e8d21801c6d5f94590c3799e6a528b5.
Commit ebc002e3ee78 ("drm/amdgpu: don't use BACO for reset in S3") stops using BACO for reset during suspend, so it's no longer necessary to leave BACO enabled during suspend. This fixes resume from suspend on the navy flounder dGPU in the ASUS ROG Strix G513QY.
--- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +1 -7
@@ -1386,14 +1386,8 @@ static int smu_disable_dpms(struct smu_c {struct amdgpu_device *adev = smu->adev;int ret =0 ; -/* -* TODO: (adev->in_suspend && !adev->in_s0ix) is added to pair -* the workaround which always reset the asic in suspend. -* It's likely that workaround will be dropped in the future. -* Then the change here should be dropped together. -*/ bool use_baco = !smu->is_apu && - (((amdgpu_in_reset (adev) || (adev->in_suspend && !adev->in_s0ix)) && + ((amdgpu_in_reset (adev) && (amdgpu_asic_reset_method (adev) ==AMD_RESET_METHOD_BACO )) || ((adev->in_runpm || adev->in_s4) &&amdgpu_asic_supports_baco (adev)));
Greg Kroah-Hartman
maintainerPATCH 97/102 dma-buf: call dma_buf_stats_setup after dmabuf is in valid list
In reply to Greg Kroah-HartmanFrom: Charan Teja Reddy <[email protected]>
commit ef3a6b70507a2add2cd2e01f5eb9b54d561bacb9 upstream.
When dma_buf_stats_setup() fails, it closes the dmabuf file which results into the calling of dma_buf_file_release() where it does list_del(&dmabuf->list_node) with out first adding it to the proper list. This is resulting into panic in the below path:
__list_del_entry_valid+0x38/0xac dma_buf_file_release+0x74/0x158 __fput+0xf4/0x428 ____fput+0x14/0x24 task_work_run+0x178/0x24c do_notify_resume+0x194/0x264 work_pending+0xc/0x5f0
Fix it by moving the dma_buf_stats_setup() after dmabuf is added to the list.
--- drivers/dma-buf/dma-buf.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/dma-buf/dma-buf.c +4 -4
@@ -572,10 +572,6 @@ struct dma_buf *dma_buf_export(const str file->f_mode |=FMODE_LSEEK ; dmabuf->file = file; - ret =dma_buf_stats_setup (dmabuf); -if (ret) - goto err_sysfs; -mutex_init (&dmabuf->lock);INIT_LIST_HEAD (&dmabuf->attachments);
@@ -583,6 +579,10 @@ struct dma_buf *dma_buf_export(const strlist_add (&dmabuf->list_node, &db_list.head);mutex_unlock (&db_list.lock); + ret =dma_buf_stats_setup (dmabuf); +if (ret) + goto err_sysfs; +return dmabuf; err_sysfs:
Greg Kroah-Hartman
maintainerPATCH 98/102 mm/hwpoison: use pr_err() instead of dump_page() in get_any_page()
In reply to Greg Kroah-HartmanFrom: Naoya Horiguchi <[email protected]>
commit 1825b93b626e99eb9a0f9f50342c7b2fa201b387 upstream.
The following VM_BUG_ON_FOLIO() is triggered when memory error event happens on the (thp/folio) pages which are about to be freed:
[ 1160.232771] page:00000000b36a8a0f refcount:1 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x16a000 [ 1160.236916] page:00000000b36a8a0f refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x16a000 [ 1160.240684] flags: 0x57ffffc0800000(hwpoison|node=1|zone=2|lastcpupid=0x1fffff) [ 1160.243458] raw: 0057ffffc0800000 dead000000000100 dead000000000122 0000000000000000 [ 1160.246268] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 1160.249197] page dumped because: VM_BUG_ON_FOLIO(!folio_test_large(folio)) [ 1160.251815] ------------[ cut here ]------------ [ 1160.253438] kernel BUG at include/linux/mm.h:788! [ 1160.256162] invalid opcode: 0000 [#1] PREEMPT SMP PTI [ 1160.258172] CPU: 2 PID: 115368 Comm: mceinj.sh Tainted: G E 5.18.0-rc1-v5.18-rc1-220404-2353-005-g83111+ #3 [ 1160.262049] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1.fc35 04/01/2014 [ 1160.265103] RIP: 0010:dump_page.cold+0x27e/0x2bd [ 1160.266757] Code: fe ff ff 48 c7 c6 81 f1 5a 98 e9 4c fe ff ff 48 c7 c6 a1 95 59 98 e9 40 fe ff ff 48 c7 c6 50 bf 5a 98 48 89 ef e8 9d 04 6d ff <0f> 0b 41 f7 c4 ff 0f 00 00 0f 85 9f fd ff ff 49 8b 04 24 a9 00 00 [ 1160.273180] RSP: 0018:ffffaa2c4d59fd18 EFLAGS: 00010292 [ 1160.274969] RAX: 000000000000003e RBX: 0000000000000001 RCX: 0000000000000000 [ 1160.277263] RDX: 0000000000000001 RSI: ffffffff985995a1 RDI: 00000000ffffffff [ 1160.279571] RBP: ffffdc9c45a80000 R08: 0000000000000000 R09: 00000000ffffdfff [ 1160.281794] R10: ffffaa2c4d59fb08 R11: ffffffff98940d08 R12: ffffdc9c45a80000 [ 1160.283920] R13: ffffffff985b6f94 R14: 0000000000000000 R15: ffffdc9c45a80000 [ 1160.286641] FS: 00007eff54ce1740(0000) GS:ffff99c67bd00000(0000) knlGS:0000000000000000 [ 1160.289498] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1160.291106] CR2: 00005628381a5f68 CR3: 0000000104712003 CR4: 0000000000170ee0 [ 1160.293031] Call Trace: [ 1160.293724] <TASK> [ 1160.294334] get_hwpoison_page+0x47d/0x570 [ 1160.295474] memory_failure+0x106/0xaa0 [ 1160.296474] ? security_capable+0x36/0x50 [ 1160.297524] hard_offline_page_store+0x43/0x80 [ 1160.298684] kernfs_fop_write_iter+0x11c/0x1b0 [ 1160.299829] new_sync_write+0xf9/0x160 [ 1160.300810] vfs_write+0x209/0x290 [ 1160.301835] ksys_write+0x4f/0xc0 [ 1160.302718] do_syscall_64+0x3b/0x90 [ 1160.303664] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1160.304981] RIP: 0033:0x7eff54b018b7
As shown in the RIP address, this VM_BUG_ON in folio_entire_mapcount() is called from dump_page("hwpoison: unhandlable page") in get_any_page(). The below explains the mechanism of the race:
CPU 0 CPU 1
memory_failure
get_hwpoison_page
get_any_page
dump_page
compound = PageCompound
free_pages_prepare
page->flags &= ~PAGE_FLAGS_CHECK_AT_PREP
folio_entire_mapcount
VM_BUG_ON_FOLIO(!folio_test_large(folio))
So replace dump_page() with safer one, pr_err().
--- mm/memory-failure.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/memory-failure.c +1 -1
@@ -1217,7 +1217,7 @@ try_again: } out:if (ret == -EIO ) -dump_page (p,"hwpoison: unhandlable page" ); +pr_err ("Memory failure: %#lx: unhandlable page.\n" ,page_to_pfn (p));return ret; }
Greg Kroah-Hartman
maintainerPATCH 99/102 SUNRPC: Ensure we flush any closed sockets before xs_xprt_free()
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
commit f00432063db1a0db484e85193eccc6845435b80e upstream.
We must ensure that all sockets are closed before we call xprt_free() and release the reference to the net namespace. The problem is that calling fput() will defer closing the socket until delayed_fput() gets called.
Let's fix the situation by allowing rpciod and the transport teardown code (which runs on the system wq) to call __fput_sync(), and directly close the socket.
--- fs/file_table.c | 1 + include/trace/events/sunrpc.h | 1 - net/sunrpc/xprt.c | 7 +------ net/sunrpc/xprtsock.c | 16 +++++++++++++--- 4 files changed, 15 insertions(+), 10 deletions(-)
fs/file_table.c +1 -0
@@ -375,6 +375,7 @@ void __fput_sync(struct file *file) }EXPORT_SYMBOL (fput); +EXPORT_SYMBOL (__fput_sync);void __init files_init (void ) {
include/trace/events/sunrpc.h +0 -1
@@ -976,7 +976,6 @@ DEFINE_RPC_XPRT_LIFETIME_EVENT(connect);DEFINE_RPC_XPRT_LIFETIME_EVENT (disconnect_auto);DEFINE_RPC_XPRT_LIFETIME_EVENT (disconnect_done);DEFINE_RPC_XPRT_LIFETIME_EVENT (disconnect_force); -DEFINE_RPC_XPRT_LIFETIME_EVENT (disconnect_cleanup);DEFINE_RPC_XPRT_LIFETIME_EVENT (destroy); DECLARE_EVENT_CLASS(rpc_xprt_event,
net/sunrpc/xprt.c +1 -6
@@ -929,12 +929,7 @@ void xprt_connect(struct rpc_task *task)if (!xprt_lock_write (xprt, task))return ; -if (test_and_clear_bit (XPRT_CLOSE_WAIT , &xprt->state)) { -trace_xprt_disconnect_cleanup (xprt); - xprt->ops->close (xprt); - } - -if (!xprt_connected (xprt)) { +if (!xprt_connected (xprt) && !test_bit (XPRT_CLOSE_WAIT , &xprt->state)) { task->tk_rqstp->rq_connect_cookie = xprt->connect_cookie;rpc_sleep_on_timeout (&xprt->pending, task,NULL ,xprt_request_timeout (task->tk_rqstp));
net/sunrpc/xprtsock.c +13 -3
@@ -880,7 +880,7 @@ static int xs_local_send_request(struct/* Close the stream if the previous transmission was incomplete */ if (xs_send_request_was_aborted (transport, req)) { -xs_close (xprt); +xprt_force_disconnect (xprt);return -ENOTCONN ; }
@@ -918,7 +918,7 @@ static int xs_local_send_request(struct -status); fallthrough;case -EPIPE : -xs_close (xprt); +xprt_force_disconnect (xprt); status = -ENOTCONN ; }
@@ -1205,6 +1205,16 @@ static void xs_reset_transport(struct soif (sk ==NULL )return ; +/* +* Make sure we're calling this in a context from which it is safe +* to call __fput_sync(). In practice that means rpciod and the +* system workqueue. +*/ +if (!(current->flags &PF_WQ_WORKER )) { +WARN_ON_ONCE (1 ); +set_bit (XPRT_CLOSE_WAIT , &xprt->state); +return ; + }if (atomic_read (&transport->xprt.swapper))sk_clear_memalloc (sk);
@@ -1228,7 +1238,7 @@ static void xs_reset_transport(struct somutex_unlock (&transport->recv_mutex);trace_rpc_socket_close (xprt, sock); -fput (filp); +__fput_sync (filp);xprt_disconnect_done (xprt); }
Greg Kroah-Hartman
maintainerPATCH 100/102 ping: fix address binding wrt vrf
In reply to Greg Kroah-HartmanFrom: Nicolas Dichtel <[email protected]>
commit e1a7ac6f3ba6e157adcd0ca94d92a401f1943f56 upstream.
When ping_group_range is updated, 'ping' uses the DGRAM ICMP socket, instead of an IP raw socket. In this case, 'ping' is unable to bind its socket to a local address owned by a vrflite.
Before the patch:
$ sysctl -w net.ipv4.ping_group_range='0 2147483647' $ ip link add blue type vrf table 10 $ ip link add foo type dummy $ ip link set foo master blue $ ip link set foo up $ ip addr add 192.168.1.1/24 dev foo $ ip addr add 2001::1/64 dev foo $ ip vrf exec blue ping -c1 -I 192.168.1.1 192.168.1.2 ping: bind: Cannot assign requested address $ ip vrf exec blue ping6 -c1 -I 2001::1 2001::2 ping6: bind icmp socket: Cannot assign requested address
--- net/ipv4/ping.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
net/ipv4/ping.c +13 -2
@@ -305,6 +305,7 @@ static int ping_check_bind_addr(struct sstruct net *net =sock_net (sk);if (sk->sk_family ==AF_INET ) {struct sockaddr_in *addr = (struct sockaddr_in *) uaddr; +u32 tb_id =RT_TABLE_LOCAL ;int chk_addr_ret;if (addr_len <sizeof (*addr))
@@ -320,8 +321,10 @@ static int ping_check_bind_addr(struct sif (addr->sin_addr.s_addr ==htonl (INADDR_ANY )) chk_addr_ret =RTN_LOCAL ; -else - chk_addr_ret =inet_addr_type (net, addr->sin_addr.s_addr); +else { + tb_id =l3mdev_fib_table_by_index (net, sk->sk_bound_dev_if) ? : tb_id; + chk_addr_ret =inet_addr_type_table (net, addr->sin_addr.s_addr, tb_id); + } if ((!inet_can_nonlocal_bind(net, isk) && chk_addr_ret != RTN_LOCAL) ||
@@ -357,6 +360,14 @@ static int ping_check_bind_addr(struct sif (!dev) {rcu_read_unlock ();return -ENODEV ; + } + } + +if (!dev && sk->sk_bound_dev_if) { + dev =dev_get_by_index_rcu (net, sk->sk_bound_dev_if); +if (!dev) { +rcu_read_unlock (); +return -ENODEV ; } } has_addr = pingv6_ops.ipv6_chk_addr(net, &addr->sin6_addr, dev,
Greg Kroah-Hartman
maintainerPATCH 101/102 usb: gadget: uvc: rename function to be more consistent
In reply to Greg Kroah-HartmanFrom: Michael Tretter <[email protected]>
commit e6bab2b66329b40462fb1bed6f98bc3fcf543a1c upstream.
When enabling info debugging for the uvc gadget, the bind and unbind infos use different formats. Change the unbind to visually match the bind.
--- drivers/usb/gadget/function/f_uvc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/usb/gadget/function/f_uvc.c +4 -3
@@ -884,12 +884,13 @@ static void uvc_free(struct usb_functionkfree (uvc); } -static void uvc_unbind (struct usb_configuration *c,struct usb_function *f) +static void uvc_function_unbind (struct usb_configuration *c, +struct usb_function *f) {struct usb_composite_dev *cdev = c->cdev;struct uvc_device *uvc =to_uvc (f); -uvcg_info (f,"%s\n" , __func__); +uvcg_info (f,"%s()\n" , __func__);device_remove_file (&uvc->vdev.dev, &dev_attr_function_name);video_unregister_device (&uvc->vdev);
@@ -943,7 +944,7 @@ static struct usb_function *uvc_alloc(st/* Register the function. */ uvc->func.name ="uvc" ; uvc->func.bind = uvc_function_bind; - uvc->func.unbind = uvc_unbind; + uvc->func.unbind = uvc_function_unbind; uvc->func.get_alt = uvc_function_get_alt; uvc->func.set_alt = uvc_function_set_alt; uvc->func.disable = uvc_function_disable;
Greg Kroah-Hartman
maintainerPATCH 102/102 usb: gadget: uvc: allow for application to cleanly shutdown
In reply to Greg Kroah-HartmanFrom: Dan Vacura <[email protected]>
commit b81ac4395bbeaf36e078dea1a48c02dd97b76235 upstream.
Several types of kernel panics can occur due to timing during the uvc gadget removal. This appears to be a problem with gadget resources being managed by both the client application's v4l2 open/close and the UDC gadget bind/unbind. Since the concept of USB_GADGET_DELAYED_STATUS doesn't exist for unbind, add a wait to allow for the application to close out.
Some examples of the panics that can occur are:
<1>[ 1147.652313] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000028 <4>[ 1147.652510] Call trace: <4>[ 1147.652514] usb_gadget_disconnect+0x74/0x1f0 <4>[ 1147.652516] usb_gadget_deactivate+0x38/0x168 <4>[ 1147.652520] usb_function_deactivate+0x54/0x90 <4>[ 1147.652524] uvc_function_disconnect+0x14/0x38 <4>[ 1147.652527] uvc_v4l2_release+0x34/0xa0 <4>[ 1147.652537] __fput+0xdc/0x2c0 <4>[ 1147.652540] ____fput+0x10/0x1c <4>[ 1147.652545] task_work_run+0xe4/0x12c <4>[ 1147.652549] do_notify_resume+0x108/0x168
<1>[ 282.950561][ T1472] Unable to handle kernel NULL pointer dereference at virtual address 00000000000005b8 <6>[ 282.953111][ T1472] Call trace: <6>[ 282.953121][ T1472] usb_function_deactivate+0x54/0xd4 <6>[ 282.953134][ T1472] uvc_v4l2_release+0xac/0x1e4 <6>[ 282.953145][ T1472] v4l2_release+0x134/0x1f0 <6>[ 282.953167][ T1472] __fput+0xf4/0x428 <6>[ 282.953178][ T1472] ____fput+0x14/0x24 <6>[ 282.953193][ T1472] task_work_run+0xac/0x130
<3>[ 213.410077][ T29] configfs-gadget gadget: uvc: Failed to queue request (-108). <1>[ 213.410116][ T29] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000003 <6>[ 213.413460][ T29] Call trace: <6>[ 213.413474][ T29] uvcg_video_pump+0x1f0/0x384 <6>[ 213.413489][ T29] process_one_work+0x2a4/0x544 <6>[ 213.413502][ T29] worker_thread+0x350/0x784 <6>[ 213.413515][ T29] kthread+0x2ac/0x320 <6>[ 213.413528][ T29] ret_from_fork+0x10/0x30
--- drivers/usb/gadget/function/f_uvc.c | 25 +++++++++++++++++++++++++ drivers/usb/gadget/function/uvc.h | 2 ++ drivers/usb/gadget/function/uvc_v4l2.c | 3 ++- 3 files changed, 29 insertions(+), 1 deletion(-)
drivers/usb/gadget/function/f_uvc.c +25 -0
@@ -889,13 +889,37 @@ static void uvc_function_unbind(struct u {struct usb_composite_dev *cdev = c->cdev;struct uvc_device *uvc =to_uvc (f); +long wait_ret =1 ;uvcg_info (f,"%s()\n" , __func__); +/* If we know we're connected via v4l2, then there should be a cleanup +* of the device from userspace either via UVC_EVENT_DISCONNECT or +* though the video device removal uevent. Allow some time for the +* application to close out before things get deleted. +*/ +if (uvc->func_connected) { +uvcg_dbg (f,"waiting for clean disconnect\n" ); + wait_ret =wait_event_interruptible_timeout (uvc->func_connected_queue, + uvc->func_connected == false,msecs_to_jiffies (500 )); +uvcg_dbg (f,"done waiting with ret: %ld\n" , wait_ret); + } +device_remove_file (&uvc->vdev.dev, &dev_attr_function_name);video_unregister_device (&uvc->vdev);v4l2_device_unregister (&uvc->v4l2_dev); +if (uvc->func_connected) { +/* Wait for the release to occur to ensure there are no longer any +* pending operations that may cause panics when resources are cleaned +* up. +*/ +uvcg_warn (f,"%s no clean disconnect, wait for release\n" , __func__); + wait_ret =wait_event_interruptible_timeout (uvc->func_connected_queue, + uvc->func_connected == false,msecs_to_jiffies (1000 )); +uvcg_dbg (f,"done waiting for release with ret: %ld\n" , wait_ret); + } +usb_ep_free_request (cdev->gadget->ep0, uvc->control_req);kfree (uvc->control_buf);
@@ -914,6 +938,7 @@ static struct usb_function *uvc_alloc(stmutex_init (&uvc->video.mutex); uvc->state =UVC_STATE_DISCONNECTED ; +init_waitqueue_head (&uvc->func_connected_queue); opts =fi_to_f_uvc_opts (fi);mutex_lock (&opts->lock);
drivers/usb/gadget/function/uvc.h +2 -0
@@ -14,6 +14,7 @@#include <linux/spinlock.h> #include <linux/usb/composite.h> #include <linux/videodev2.h> +#include <linux/wait.h> #include <media/v4l2-device.h> #include <media/v4l2-dev.h>
@@ -127,6 +128,7 @@ struct uvc_device {struct usb_function func;struct uvc_video video;bool func_connected; +wait_queue_head_t func_connected_queue;/* Descriptors */ struct {
drivers/usb/gadget/function/uvc_v4l2.c +2 -1
@@ -252,10 +252,11 @@ uvc_v4l2_subscribe_event(struct v4l2_fhstatic void uvc_v4l2_disable (struct uvc_device *uvc) { - uvc->func_connected = false;uvc_function_disconnect (uvc);uvcg_video_enable (&uvc->video,0 );uvcg_free_buffers (&uvc->video.queue); + uvc->func_connected = false; +wake_up_interruptible (&uvc->func_connected_queue); } static int
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.41 release. There are 102 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 18 May 2022 19:36:02 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.41-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.41 release. There are 102 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 18 May 2022 19:36:02 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.41-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v5.15:
10 builds: 10 pass, 0 fail
28 boots: 28 pass, 0 fail
114 tests: 114 pass, 0 failLinux version: 5.15.41-rc1-g4aa8770e7dfc
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04Jon
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.41 release. There are 102 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 18 May 2022 19:36:02 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.41-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
5.15.41-rc1 Successfully Compiled and booted on my Raspberry PI 4b (8g) (bcm2711)
Hi Greg,
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.41 release. There are 102 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 18 May 2022 19:36:02 +0000. Anything received after that time might be too late.
Build test:
mips (gcc version 11.2.1 20220408): 62 configs -> no failure arm (gcc version 11.2.1 20220408): 100 configs -> no new failure arm64 (gcc version 11.2.1 20220408): 3 configs -> no failure x86_64 (gcc version 11.2.1 20220408): 4 configs -> no failure
Boot test:x86_64: Booted on my test laptop. No regression.x86_64: Booted on qemu. No regression. [1]
arm64: Booted on rpi4b (4GB model). No regression. [2]
mips: Booted on ci20 board. No regression. [3]
[1]. https://openqa.qa.codethink.co.uk/tests/1157
[2]. https://openqa.qa.codethink.co.uk/tests/1162
[3]. https://openqa.qa.codethink.co.uk/tests/1163
--
Regards
Sudip
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.41 release. There are 102 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 18 May 2022 19:36:02 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.41-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 5.15.41-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git branch: linux-5.15.y
* git commit: 4aa8770e7dfca33d694a86ec8fc85900ada99c26
* git describe: v5.15.40-103-g4aa8770e7dfc
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.15.y/build/v5.15.40-103-g4aa8770e7dfc
## Test Regressions (compared to v5.15.39-22-g13b089c28632) No test regressions found.
## Metric Regressions (compared to v5.15.39-22-g13b089c28632) No metric regressions found.
## Test Fixes (compared to v5.15.39-22-g13b089c28632) No test fixes found.
## Metric Fixes (compared to v5.15.39-22-g13b089c28632) No metric fixes found.
## Test result summary
total: 105033, pass: 88286, fail: 1128, skip: 14403, xfail: 1216
## Build Summary
* arc: 10 total, 10 passed, 0 failed
* arm: 296 total, 293 passed, 3 failed
* arm64: 47 total, 47 passed, 0 failed
* dragonboard-410c: 1 total, 1 passed, 0 failed
* hi6220-hikey: 1 total, 1 passed, 0 failed
* i386: 45 total, 41 passed, 4 failed
* juno-r2: 1 total, 1 passed, 0 failed
* mips: 41 total, 38 passed, 3 failed
* parisc: 14 total, 14 passed, 0 failed
* powerpc: 59 total, 56 passed, 3 failed
* riscv: 27 total, 27 passed, 0 failed
* s390: 26 total, 23 passed, 3 failed
* sh: 26 total, 24 passed, 2 failed
* sparc: 14 total, 14 passed, 0 failed
* x15: 1 total, 1 passed, 0 failed
* x86: 1 total, 1 passed, 0 failed
* x86_64: 47 total, 47 passed, 0 failed
## Test suites summary
* fwts
* igt-gpu-tools
* kselftest-
* kselftest-android
* kselftest-arm64
* kselftest-bpf
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-firmware
* kselftest-fpu
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-tc-testing
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-vm
* kselftest-x86
* kselftest-zram
* kunit
* kvm-unit-tests
* libgpiod
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-open-posix-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-tracing-tests
* network-basic
* network-basic-tests
* packetdrill
* perf
* perf/Zstd-perf.data-compression
* rcutorture
* ssuite
* v4l2-compliance
* vdso
--
Linaro LKFT
https://lkft.linaro.org
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.41 release. There are 102 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 18 May 2022 19:36:02 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.41-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.41 release. There are 102 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 18 May 2022 19:36:02 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.41-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels:
Signature · 1 line
Florian
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.41 release. There are 102 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 18 May 2022 19:36:02 +0000. Anything received after that time might be too late.
Build results:
total: 156 pass: 156 fail: 0 Qemu test results: total: 488 pass: 488 fail: 0
Guenter