5.18.4-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 5.18.4-rc1 review
This is the start of the stable review cycle for the 5.18.4 release. There are 339 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 15 Jun 2022 09:47:08 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.18.4-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.18.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.18.4-rc1
Damien Le Moal <[email protected]>
zonefs: fix handling of explicit_open option on mount
Pascal Hambourg <[email protected]>
md/raid0: Ignore RAID0 layout if the second zone has only one device
Jason A. Donenfeld <[email protected]>
random: account for arch randomness in bits
Jason A. Donenfeld <[email protected]>
random: mark bootloader randomness code as __init
Jason A. Donenfeld <[email protected]>
random: avoid checking crng_ready() twice in random_init()
Michael Ellerman <[email protected]>
powerpc/32: Fix overread/overwrite of thread_struct via ptrace
Jason Wang <[email protected]>
virtio-rng: make device ready before making request
Alex Deucher <[email protected]>
drm/amdgpu: update VCN codec support for Yellow Carp
Aurabindo Pillai <[email protected]>
drm/amd/display: remove stale config guards
Mohammad Zafar Ziya <[email protected]>
drm/amdgpu/jpeg2: Add jpeg vmid update under IB submit
Brian Norris <[email protected]>
drm/atomic: Force bridge self-refresh-exit on CRTC switch
Brian Norris <[email protected]>
drm/bridge: analogix_dp: Support PSR-exit to disable transition
Jesse Zhang <[email protected]>
drm/amdkfd:Fix fw version for 10.3.6
Michael Ellerman <[email protected]>
powerpc: Don't select HAVE_IRQ_EXIT_ON_IRQ_STACK
Matthew Wilcox (Oracle) <[email protected]>
mm/huge_memory: Fix xarray node memory leak
Peter Zijlstra <[email protected]>
cpuidle,intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE
Xie Yongji <[email protected]>
vduse: Fix NULL pointer dereference on sysfs access
Mathias Nyman <[email protected]>
Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag
Olivier Matz <[email protected]>
ixgbe: fix unexpected VLAN Rx in promisc mode on VF
Olivier Matz <[email protected]>
ixgbe: fix bcast packets Rx on VF after promisc removal
Martin Faltesek <[email protected]>
nfc: st21nfca: fix incorrect sizing calculations in EVT_TRANSACTION
Martin Faltesek <[email protected]>
nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling
Martin Faltesek <[email protected]>
nfc: st21nfca: fix incorrect validating logic in EVT_TRANSACTION
Jchao Sun <[email protected]>
writeback: Fix inode->i_io_list not be protected by inode->i_lock error
Ilya Maximets <[email protected]>
net: openvswitch: fix misuse of the cached connection on tuple changes
Tan Tee Min <[email protected]>
net: phy: dp83867: retrigger SGMII AN when link change
Adrian Hunter <[email protected]>
mmc: block: Fix CQE recovery reset success
Ben Chuang <[email protected]>
mmc: sdhci-pci-gli: Fix GL9763E runtime PM when the system resumes from suspend
Sergey Shtylyov <[email protected]>
ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files
Tyler Erickson <[email protected]>
libata: fix translation of concurrent positioning ranges
Tyler Erickson <[email protected]>
libata: fix reading concurrent positioning ranges log
David Safford <[email protected]>
KEYS: trusted: tpm2: Fix migratable logic
Matthew Wilcox (Oracle) <[email protected]>
filemap: Cache the value of vm_flags
Maxim Levitsky <[email protected]>
KVM: SVM: fix tsc scaling cache logic
Shaoqin Huang <[email protected]>
KVM: x86/mmu: Check every prev_roots in __kvm_mmu_free_obsolete_roots()
James Smart <[email protected]>
scsi: lpfc: Address NULL pointer dereference after starget_to_rport()
James Smart <[email protected]>
scsi: lpfc: Resolve some cleanup issues following SLI path refactoring
James Smart <[email protected]>
scsi: lpfc: Resolve some cleanup issues following abort path refactoring
Tyler Erickson <[email protected]>
scsi: sd: Fix interpretation of VPD B9h length
Shyam Prasad N <[email protected]>
cifs: populate empty hostnames for extra channels
Paulo Alcantara <[email protected]>
cifs: fix reconnect on smb3 mount types
Shyam Prasad N <[email protected]>
cifs: return errors during session setup during reconnects
Jeremy Soller <[email protected]>
ALSA: hda/realtek: Add quirk for HP Dev One
Cameron Berkenpas <[email protected]>
ALSA: hda/realtek: Fix for quirk to enable speaker output on the Lenovo Yoga DuetITL 2021
huangwenhui <[email protected]>
ALSA: hda/conexant - Fix loopback issue with CX20632
Takashi Iwai <[email protected]>
ALSA: usb-audio: Set up (implicit) sync for Saffire 6
Takashi Iwai <[email protected]>
ALSA: usb-audio: Skip generic sync EP parse for secondary EP
Bedant Patnaik <[email protected]>
platform/x86: hp-wmi: Use zero insize parameter only when supported
Jorge Lopez <[email protected]>
platform/x86: hp-wmi: Resolve WMI query failures on some devices
Kuan-Ying Lee <[email protected]>
scripts/gdb: change kernel config dumping method
Jiasheng Jiang <[email protected]>
platform/x86: barco-p50-gpio: Add check for platform_driver_register
Xie Yongji <[email protected]>
vringh: Fix loop descriptors check in the indirect cases
James Smart <[email protected]>
scsi: lpfc: Correct BDE type for XMIT_SEQ64_WQE in lpfc_ct_reject_event()
Kees Cook <[email protected]>
nodemask: Fix return values to be unsigned
Yury Norov <[email protected]>
drm/amd/pm: use bitmap_{from,to}_arr32 where appropriate
Steve French <[email protected]>
cifs: version operations for smb20 unneeded when legacy support disabled
Christian Borntraeger <[email protected]>
s390/gmap: voluntarily schedule during key setting
Vincent Whitchurch <[email protected]>
cifs: fix potential deadlock in direct reclaim
Bjorn Helgaas <[email protected]>
Revert "PCI: brcmstb: Split brcm_pcie_setup() into two funcs"
Bjorn Helgaas <[email protected]>
Revert "PCI: brcmstb: Add mechanism to turn on subdev regulators"
Bjorn Helgaas <[email protected]>
Revert "PCI: brcmstb: Add control of subdevice voltage regulators"
Bjorn Helgaas <[email protected]>
Revert "PCI: brcmstb: Do not turn off WOL regulators on suspend"
Yu Kuai <[email protected]>
nbd: fix io hung while disconnecting device
Yu Kuai <[email protected]>
nbd: fix race between nbd_alloc_config() and module removal
Yu Kuai <[email protected]>
nbd: call genl_unregister_family() first in nbd_cleanup()
Peter Zijlstra <[email protected]>
jump_label,noinstr: Avoid instrumentation for JUMP_LABEL=n builds
Peter Zijlstra <[email protected]>
x86/cpu: Elide KCSAN for cpu_has() and friends
Peter Zijlstra <[email protected]>
objtool: Mark __ubsan_handle_builtin_unreachable() as noreturn
Masahiro Yamada <[email protected]>
modpost: fix undefined behavior of is_arm_mapping_symbol()
Johannes Berg <[email protected]>
um: line: Use separate IRQs per line
Evan Quan <[email protected]>
drm/amd/pm: correct the metrics version for SMU 11.0.11/12/13
Lijo Lazar <[email protected]>
drm/amd/pm: Fix missing thermal throttler status
Gong Yuanjun <[email protected]>
drm/amd/pm: fix a potential gpu_metrics_table memory leak
Gong Yuanjun <[email protected]>
drm/radeon: fix a possible null pointer dereference
Nicholas Kazlauskas <[email protected]>
drm/amd/display: Check zero planes for OTG disable W/A on clock change
David Galiffi <[email protected]>
drm/amd/display: Check if modulo is 0 before dividing.
Daniel Borkmann <[email protected]>
net, neigh: Set lower cap for neigh_managed_work rearming
Xiubo Li <[email protected]>
ceph: fix possible deadlock when holding Fwb to get inline_data
Xiubo Li <[email protected]>
ceph: flush the mdlog for filesystem sync
Venky Shankar <[email protected]>
ceph: allow ceph.dir.rctime xattr to be updatable
Michal Kubecek <[email protected]>
Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process"
Oder Chiou <[email protected]>
ASoC: rt5640: Do not manipulate pin "Platform Clock" if the "Platform Clock" is not in the DAPM
Hannes Reinecke <[email protected]>
scsi: myrb: Fix up null pointer access on myrb_cleanup()
Syed Saba kareem <[email protected]>
ASoC: SOF: amd: Fixed Build error
Guoqing Jiang <[email protected]>
md: protect md_unregister_thread from reentrancy
Hyunchul Lee <[email protected]>
ksmbd: smbd: fix connection dropped issue
Liu Xinpeng <[email protected]>
watchdog: wdat_wdt: Stop watchdog when rebooting the system
Hao Luo <[email protected]>
kernfs: Separate kernfs_pr_cont_buf and rename_lock.
John Ogness <[email protected]>
serial: msm_serial: disable interrupts in __msm_console_write()
Wang Cheng <[email protected]>
staging: rtl8712: fix uninit-value in r871xu_drv_init()
Wang Cheng <[email protected]>
staging: rtl8712: fix uninit-value in usb_read8() and friends
Andre Przywara <[email protected]>
clocksource/drivers/sp804: Avoid error on multiple instances
bumwoo lee <[email protected]>
extcon: Modify extcon device to be created after driver data is set
Dan Carpenter <[email protected]>
extcon: Fix extcon_get_extcon_dev() error handling
Shuah Khan <[email protected]>
misc: rtsx: set NULL intfdata when probe fails
Srinivas Kandagatla <[email protected]>
soundwire: qcom: adjust autoenumeration timeout
Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Only End Transfer for ep0 data phase
Heikki Krogerus <[email protected]>
usb: dwc3: host: Stop setting the ACPI companion
Marek Szyprowski <[email protected]>
usb: dwc2: gadget: don't reset gadget's driver->bus
Changbin Du <[email protected]>
sysrq: do not omit current cpu when showing backtrace of all active CPUs
Hangyu Hua <[email protected]>
char: xillybus: fix a refcount leak in cleanup_dev()
Evan Green <[email protected]>
USB: hcd-pci: Fully suspend across freeze/thaw cycle
Duoming Zhou <[email protected]>
drivers: usb: host: Fix deadlock in oxu_bus_suspend()
Duoming Zhou <[email protected]>
drivers: tty: serial: Fix deadlock in sa1100_set_termios()
Zhen Ni <[email protected]>
USB: host: isp116x: check return value after calling platform_get_resource()
Duoming Zhou <[email protected]>
drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop()
Duoming Zhou <[email protected]>
drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop()
Mika Westerberg <[email protected]>
thunderbolt: Use different lane for second DisplayPort tunnel
Huang Guobin <[email protected]>
tty: Fix a possible resource leak in icom_probe
Zheyu Ma <[email protected]>
tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
Duoming Zhou <[email protected]>
drivers: staging: rtl8192eu: Fix deadlock in rtw_joinbss_event_prehandle
Duoming Zhou <[email protected]>
drivers: staging: rtl8192bs: Fix deadlock in rtw_joinbss_event_prehandle()
Duoming Zhou <[email protected]>
drivers: staging: rtl8723bs: Fix deadlock in rtw_surveydone_event_callback()
Kees Cook <[email protected]>
lkdtm/usercopy: Expand size of "out of frame" object
Miquel Raynal <[email protected]>
iio: st_sensors: Add a local lock for protecting odr
Xiaoke Wang <[email protected]>
staging: rtl8712: fix a potential memory leak in r871xu_drv_init()
Xiaoke Wang <[email protected]>
iio: dummy: iio_simple_dummy: check the return value of kstrdup()
David Howells <[email protected]>
iov_iter: Fix iter_xarray_get_pages{,_alloc}()
Andrea Mayer <[email protected]>
net: seg6: fix seg6_lookup_any_nexthop() to handle VRFs using flowi_l3mdev
Etienne van der Linde <[email protected]>
nfp: flower: restructure flow-key for gre+vlan combination
Linus Torvalds <[email protected]>
drm: imx: fix compiler warning with gcc-12
Muchun Song <[email protected]>
tcp: use alloc_large_system_hash() to allocate table_perturb
Alvin Šipraga <[email protected]>
net: dsa: realtek: rtl8365mb: fix GMII caps for ports with internal PHY
Marek Behún <[email protected]>
net: dsa: mv88e6xxx: use BMSR_ANEGCOMPLETE bit for filling an_complete
Miaoqian Lin <[email protected]>
net: altera: Fix refcount leak in altera_tse_mdio_create
Willem de Bruijn <[email protected]>
ip_gre: test csum_start instead of transport header
Mark Bloch <[email protected]>
net/mlx5: fs, fail conflicting actions
Feras Daoud <[email protected]>
net/mlx5: Rearm the FW tracer after each tracer event
Saeed Mahameed <[email protected]>
net/mlx5: Fix mlx5_get_next_dev() peer device matching
Mark Bloch <[email protected]>
net/mlx5: Lag, filter non compatible devices
Paul Blakey <[email protected]>
net/mlx5e: CT: Fix cleanup of CT before cleanup of TC ct rules
Masahiro Yamada <[email protected]>
net: ipv6: unexport __init-annotated seg6_hmac_init()
Masahiro Yamada <[email protected]>
net: xfrm: unexport __init-annotated xfrm4_protocol_init()
Masahiro Yamada <[email protected]>
net: mdio: unexport __init-annotated mdio_bus_init()
Chuck Lever <[email protected]>
SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer()
Christian König <[email protected]>
drm/amdgpu: fix limiting AV1 to the first instance on VCN3
Maciej Fijalkowski <[email protected]>
xsk: Fix handling of invalid descriptors in XSK TX batching API
Gal Pressman <[email protected]>
net/mlx4_en: Fix wrong return value on ioctl EEPROM query failure
Miaoqian Lin <[email protected]>
net: dsa: lantiq_gswip: Fix refcount leak in gswip_gphy_fw_list
Eric Dumazet <[email protected]>
bpf, arm64: Clear prog->jited_len along prog->jited
Jan Beulich <[email protected]>
x86: drop bogus "cc" clobber from __try_cmpxchg_user_asm()
Lina Wang <[email protected]>
selftests net: fix bpf build error
Kuniyuki Iwashima <[email protected]>
af_unix: Fix a data-race in unix_dgram_peer_wake_me().
Christophe JAILLET <[email protected]>
stmmac: intel: Fix an error handling path in intel_eth_pci_probe()
Masahiro Yamada <[email protected]>
xen: unexport __init-annotated xen_xlate_map_ballooned_pages()
Miaoqian Lin <[email protected]>
net: ethernet: bgmac: Fix refcount leak in bcma_mdio_mii_register
Taehee Yoo <[email protected]>
amt: fix wrong type string definition
Taehee Yoo <[email protected]>
amt: fix possible null-ptr-deref in amt_rcv()
Taehee Yoo <[email protected]>
amt: fix wrong usage of pskb_may_pull()
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: bail out early if hardware offload is not supported
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: memleak flow rule from commit path
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: release new hooks on unsupported flowtable flags
Miaoqian Lin <[email protected]>
ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: always initialize flowtable hook list in transaction
Chuck Lever <[email protected]>
SUNRPC: Trap RDMA segment overflows
Chuck Lever <[email protected]>
NFSD: Fix potential use-after-free in nfsd_file_put()
Michael Ellerman <[email protected]>
powerpc/kasan: Force thread size increase with KASAN
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: delete flowtable hooks via transaction list
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: use kfree_rcu(ptr, rcu) to release hooks in clean_net path
Florian Westphal <[email protected]>
netfilter: nat: really support inet nat without l3 address
Vaibhav Jain <[email protected]>
powerpc/papr_scm: don't requests stats with '0' sized stats buffer
Steven Price <[email protected]>
drm/panfrost: Job should reference MMU not file_priv
Marek Vasut <[email protected]>
drm/bridge: ti-sn65dsi83: Handle dsi_lanes == 0 as invalid
Kinglong Mee <[email protected]>
xprtrdma: treat all calls not a bcall when bc_serv is NULL
Chao Yu <[email protected]>
f2fs: fix to tag gcing flag on page during file defragment
Daniel Bristot de Oliveira <[email protected]>
rtla/Makefile: Properly handle dependencies
Greg Ungerer <[email protected]>
m68knommu: fix undefined reference to `mach_get_rtc_pll'
Liao Chang <[email protected]>
RISC-V: use memcpy for kexec_file mode
Yang Yingliang <[email protected]>
video: fbdev: pxa3xx-gcu: release the resources correctly in pxa3xx_gcu_probe/remove()
Saurabh Sengar <[email protected]>
video: fbdev: hyperv_fb: Allow resolutions with size > 64 MB for Gen1
Trond Myklebust <[email protected]>
NFSv4: Don't hold the layoutget locks across multiple RPC calls
Radhey Shyam Pandey <[email protected]>
dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type
Greg Ungerer <[email protected]>
m68knommu: fix undefined reference to `_init_sp'
Greg Ungerer <[email protected]>
m68knommu: set ZERO_PAGE() to the allocated zeroed page
Lucas Tanure <[email protected]>
i2c: cadence: Increase timeout per message if necessary
Jaegeuk Kim <[email protected]>
f2fs: avoid infinite loop to flush node pages
Dongliang Mu <[email protected]>
f2fs: remove WARN_ON in f2fs_is_valid_blkaddr
Yang Yingliang <[email protected]>
iommu/arm-smmu-v3: check return value after calling platform_get_resource()
Yang Yingliang <[email protected]>
iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe()
AngeloGioacchino Del Regno <[email protected]>
i2c: mediatek: Optimize master_xfer() and avoid circular locking
Mark-PK Tsai <[email protected]>
tracing: Avoid adding tracer option before update_tracer_options
Jun Miao <[email protected]>
tracing: Fix sleeping function called from invalid context on RT kernel
Jeff Xie <[email protected]>
tracing: Make tp_printk work on syscall tracepoints
Masami Hiramatsu <[email protected]>
bootconfig: Make the bootconfig.o as a normal object file
Gong Yuanjun <[email protected]>
mips: cpc: Fix refcount leak in mips_cpc_default_phys_base
Dave Jiang <[email protected]>
dmaengine: idxd: set DMA_INTERRUPT cap bit
Linus Torvalds <[email protected]>
bluetooth: don't use bitmaps for random flag accesses
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_sync: Fix attempting to suspend with unfiltered passive scan
Luiz Augusto von Dentz <[email protected]>
Bluetooth: MGMT: Add conditions for setting HCI_CONN_FLAG_REMOTE_WAKEUP
Leo Yan <[email protected]>
perf c2c: Fix sorting in percent_rmt_hitm_cmp()
Zhengjun Xing <[email protected]>
perf record: Support sample-read topdown metric group for hybrid platforms
Kan Liang <[email protected]>
perf parse-events: Move slots event for the hybrid platform too
Kan Liang <[email protected]>
perf evsel: Fixes topdown events in a weak group for the hybrid platform
Saravana Kannan <[email protected]>
driver core: Fix wait_for_device_probe() & deferred_probe_timeout interaction
Hoang Le <[email protected]>
tipc: check attribute length for bearer name
Fei Qin <[email protected]>
nfp: remove padding in nfp_nfdk_tx_desc
Duoming Zhou <[email protected]>
ax25: Fix ax25 session cleanup problems
Damien Le Moal <[email protected]>
scsi: sd: Fix potential NULL pointer dereference
Kuogee Hsieh <[email protected]>
drm/msm/dp: Always clear mask bits to disable interrupts at dp_ctrl_reset_irq_ctrl()
David Howells <[email protected]>
afs: Fix infinite loop found by xfstest generic/676
Haibo Chen <[email protected]>
gpio: pca953x: use the correct register address to do regcache sync
Dan Carpenter <[email protected]>
net/sched: act_api: fix error code in tcf_ct_flow_table_fill_tuple_ipv6()
Aya Levin <[email protected]>
net: ping6: Fix ping -6 with interface name
Fabien Parent <[email protected]>
regulator: mt6315-regulator: fix invalid allowed mode
Alexander Gordeev <[email protected]>
s390/mcck: isolate SIE instruction when setting CIF_MCCK_GUEST flag
Dan Carpenter <[email protected]>
octeontx2-af: fix error code in is_valid_offset()
Hangbin Liu <[email protected]>
bonding: guard ns_targets by CONFIG_IPV6
Jason Wang <[email protected]>
vdpa: ifcvf: set pci driver data in probe
Eric Dumazet <[email protected]>
tcp: tcp_rtx_synack() can be called from process context
Guoju Fang <[email protected]>
net: sched: add barrier to fix packet stuck problem for lockless qdisc
Maxim Mikityanskiy <[email protected]>
net/mlx5e: Update netdev features after changing XDP state
Changcheng Liu <[email protected]>
net/mlx5: correct ECE offset in query qp output
Maxim Mikityanskiy <[email protected]>
net/mlx5e: Disable softirq in mlx5e_activate_rq to avoid race condition
Paul Blakey <[email protected]>
net/mlx5: CT: Fix header-rewrite re-use for tupels
Maor Dickman <[email protected]>
net/mlx5e: TC NIC mode, fix tc chains miss table
Leon Romanovsky <[email protected]>
net/mlx5: Don't use already freed action pointer
Christophe JAILLET <[email protected]>
virtio: pci: Fix an error handling path in vp_modern_probe()
Eli Cohen <[email protected]>
vdpa: Fix error logic in vdpa_nl_cmd_dev_get_doit
Weizhao Ouyang <[email protected]>
erofs: fix 'backmost' member of z_erofs_decompress_frontend
Hangbin Liu <[email protected]>
bonding: show NS IPv6 targets in proc master info
Viorel Suman <[email protected]>
net: phy: at803x: disable WOL at probe
Haisu Wang <[email protected]>
blk-mq: do not update io_ticks with passthrough requests
Peter Zijlstra <[email protected]>
sched/autogroup: Fix sysctl move
Jens Axboe <[email protected]>
block: make bioset_exit() fully resilient against being called twice
Íñigo Huguet <[email protected]>
sfc: fix wrong tx channel offset with efx_separate_tx_channels
Martin Habets <[email protected]>
sfc: fix considering that all channels have TX queues
Hangbin Liu <[email protected]>
bonding: NS target should accept link local address
Christoph Hellwig <[email protected]>
block: use bio_queue_enter instead of blk_queue_enter in bio_poll
Yu Xiao <[email protected]>
nfp: only report pause frame configuration for physical device
Eric Dumazet <[email protected]>
tcp: add accessors to read/set tp->snd_cwnd
Guangguan Wang <[email protected]>
net/smc: fixes for converting from "struct smc_cdc_tx_pend **" to "struct smc_wr_tx_pend_priv *"
Heinrich Schuchardt <[email protected]>
riscv: read-only pages should not be writable
Zhang Wensheng <[email protected]>
nbd: fix possible overflow on 'first_minor' in nbd_dev_add()
Yu Kuai <[email protected]>
nbd: don't clear 'NBD_CMD_INFLIGHT' flag if request is not completed
Christoph Hellwig <[email protected]>
block: take destination bvec offsets into account in bio_copy_data_iter
Menglong Dong <[email protected]>
bpf: Fix probe read error in ___bpf_prog_run()
Song Liu <[email protected]>
selftests/bpf: fix stacktrace_build_id with missing kprobe/urandom_read
Zhihao Cheng <[email protected]>
ubi: ubi_create_volume: Fix use-after-free when volume creation failed
Zhihao Cheng <[email protected]>
ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty
Baokun Li <[email protected]>
jffs2: fix memory leak in jffs2_do_fill_super
Genjian Zhang <[email protected]>
ep93xx: clock: Do not return the address of the freed memory
Christoph Hellwig <[email protected]>
block, loop: support partitions without scanning
Alexander Lobakin <[email protected]>
modpost: fix removing numeric suffixes
Miaoqian Lin <[email protected]>
net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
Miaoqian Lin <[email protected]>
net: ethernet: ti: am65-cpsw-nuss: Fix some refcount leaks
Dan Carpenter <[email protected]>
net: ethernet: mtk_eth_soc: out of bounds read in mtk_hwlro_get_fdir_entry()
Vincent Ray <[email protected]>
net: sched: fixed barrier to prevent skbuff sticking in qdisc backlog
Michael Walle <[email protected]>
net: lan966x: check devm_of_phy_get() for -EDEFER_PROBE
Dan Carpenter <[email protected]>
drm/amdgpu: Off by one in dm_dmub_outbox1_low_irq()
Eddie James <[email protected]>
spi: fsi: Fix spurious timeout
liuyacan <[email protected]>
net/smc: set ini->smcrv2.ib_dev_v2 to NULL if SMC-Rv2 is unavailable
Siddharth Vadapalli <[email protected]>
net: ethernet: ti: am65-cpsw: Fix fwnode passed to phylink_create()
Taehee Yoo <[email protected]>
amt: fix possible memory leak in amt_rcv()
Taehee Yoo <[email protected]>
amt: fix return value of amt_update_handler()
Jann Horn <[email protected]>
s390/crypto: fix scatterwalk_unmap() callers in AES-GCM
Krzysztof Kozlowski <[email protected]>
clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value
Christoph Hellwig <[email protected]>
scsi: sd: Don't call blk_cleanup_disk() in sd_probe()
Shengjiu Wang <[email protected]>
ASoC: fsl_sai: Fix FSL_SAI_xDR/xFR definition
Ming Lei <[email protected]>
blk-mq: don't touch ->tagset in blk_mq_get_sq_hctx
Miaoqian Lin <[email protected]>
watchdog: ts4800_wdt: Fix refcount leak in ts4800_wdt_probe
Miaoqian Lin <[email protected]>
watchdog: rti-wdt: Fix pm_runtime_get_sync() error checking
Zhang Wensheng <[email protected]>
driver core: fix deadlock in __device_attach
Schspa Shi <[email protected]>
driver: base: fix UAF when driver_attach failed
Tony Lindgren <[email protected]>
bus: ti-sysc: Fix warnings for unbind for serial
Miaoqian Lin <[email protected]>
firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
Ilpo Järvinen <[email protected]>
serial: stm32-usart: Correct CSIZE, bits, and parity
Ilpo Järvinen <[email protected]>
serial: st-asc: Sanitize CSIZE and correct PARENB for CS7
Ilpo Järvinen <[email protected]>
serial: sifive: Sanitize CSIZE and c_iflag
Ilpo Järvinen <[email protected]>
serial: sh-sci: Don't allow CS5-6
Ilpo Järvinen <[email protected]>
serial: txx9: Don't allow CS5-6
Ilpo Järvinen <[email protected]>
serial: rda-uart: Don't allow CS5-6
Ilpo Järvinen <[email protected]>
serial: digicolor-usart: Don't allow CS5-6
Ilpo Järvinen <[email protected]>
serial: uartlite: Fix BRKINT clearing
YueHaibing <[email protected]>
serial: cpm_uart: Fix build error without CONFIG_SERIAL_CPM_CONSOLE
Ilpo Järvinen <[email protected]>
serial: 8250_fintek: Check SER_RS485_RTS_* only with RS485
AngeloGioacchino Del Regno <[email protected]>
Revert "serial: 8250_mtk: Make sure to select the right FEATURE_SEL"
John Ogness <[email protected]>
serial: meson: acquire port->lock in startup()
Jiasheng Jiang <[email protected]>
staging: r8188eu: add check for kzalloc
Miaoqian Lin <[email protected]>
rtc: ftrtc010: Fix error handling in ftrtc010_rtc_probe
Yang Yingliang <[email protected]>
rtc: mt6397: check return value after calling platform_get_resource()
Howard Chiu <[email protected]>
ARM: dts: aspeed: ast2600-evb: Enable RX delay for MAC0/MAC1
Samuel Holland <[email protected]>
clocksource/drivers/riscv: Events are stopped during CPU suspend
Miaoqian Lin <[email protected]>
soc: rockchip: Fix refcount leak in rockchip_grf_init
Nícolas F. R. A. Prado <[email protected]>
dt-bindings: remoteproc: mediatek: Make l1tcm reg exclusive to mt819x
Li Jun <[email protected]>
extcon: ptn5150: Add queue work sync before driver release
Xin Xiong <[email protected]>
ksmbd: fix reference count leak in smb_check_perm_dacl()
Guilherme G. Piccoli <[email protected]>
coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier
Pierre-Louis Bossart <[email protected]>
soundwire: qcom: return error when pm_runtime_get_sync fails
Pierre-Louis Bossart <[email protected]>
soundwire: intel: prevent pm_runtime resume prior to system suspend
Biju Das <[email protected]>
watchdog: rzg2l_wdt: Fix reset control imbalance
Biju Das <[email protected]>
watchdog: rzg2l_wdt: Fix 'BUG: Invalid wait context'
Biju Das <[email protected]>
watchdog: rzg2l_wdt: Fix Runtime PM usage
Biju Das <[email protected]>
watchdog: rzg2l_wdt: Fix 32bit overflow issue
Greg Kroah-Hartman <[email protected]>
export: fix string handling of namespace in EXPORT_SYMBOL_NS
Maciej W. Rozycki <[email protected]>
serial: sifive: Report actual baud base rather than fixed 115200
Linus Walleij <[email protected]>
power: supply: ab8500_fg: Allocate wq in probe
Hans de Goede <[email protected]>
power: supply: axp288_fuel_gauge: Drop BIOS version check from "T3 MRD" DMI quirk
Hans de Goede <[email protected]>
power: supply: axp288_fuel_gauge: Fix battery reporting on the One Mix 1
Linus Walleij <[email protected]>
power: supply: core: Initialize struct to zero
Johan Hovold <[email protected]>
phy: qcom-qmp: fix pipe-clock imbalance on power-on failure
Guilherme G. Piccoli <[email protected]>
misc/pvpanic: Convert regular spinlock into trylock on panic path
Krzysztof Kozlowski <[email protected]>
rpmsg: qcom_smd: Fix returning 0 if irq_of_parse_and_map() fails
Cixi Geng <[email protected]>
iio: adc: sc27xx: Fine tune the scale calibration values
Cixi Geng <[email protected]>
iio: adc: sc27xx: fix read big scale voltage not right
Miaoqian Lin <[email protected]>
iio: proximity: vl53l0x: Fix return value check of wait_for_completion_timeout
Miaoqian Lin <[email protected]>
iio: adc: stmpe-adc: Fix wait_for_completion_timeout return value check
Arnaud Pouliquen <[email protected]>
rpmsg: virtio: Fix the unregistration of the device rpmsg_ctrl
Hangyu Hua <[email protected]>
rpmsg: virtio: Fix possible double free in rpmsg_virtio_add_ctrl_dev()
Hangyu Hua <[email protected]>
rpmsg: virtio: Fix possible double free in rpmsg_probe()
Bjorn Andersson <[email protected]>
usb: typec: mux: Check dev_set_name() return value
Xiaomeng Tong <[email protected]>
firmware: stratix10-svc: fix a missing check on list iterator
Xiaomeng Tong <[email protected]>
misc: fastrpc: fix an incorrect NULL check on list iterator
SeongJae Park <[email protected]>
scripts/get_abi: Fix wrong script file name in the help message
Zheng Yongjun <[email protected]>
usb: dwc3: pci: Fix pm_runtime_get_sync() error checking
Wesley Cheng <[email protected]>
usb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback
Krzysztof Kozlowski <[email protected]>
rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value
Uwe Kleine-König <[email protected]>
pwm: raspberrypi-poe: Fix endianness in firmware struct
Uwe Kleine-König <[email protected]>
pwm: lp3943: Fix duty calculation in case period was clamped
Christophe JAILLET <[email protected]>
staging: fieldbus: Fix the error handling path in anybuss_host_common_probe()
Miaoqian Lin <[email protected]>
usb: musb: Fix missing of_node_put() in omap2430_probe
Lin Ma <[email protected]>
USB: storage: karma: fix rio_karma_init return
Niels Dossche <[email protected]>
usb: usbip: add missing device lock on tweak configuration cmd
Hangyu Hua <[email protected]>
usb: usbip: fix a refcount leak in stub_probe()
Michael Straube <[email protected]>
staging: r8188eu: fix struct rt_firmware_hdr
Samuel Holland <[email protected]>
phy: rockchip-inno-usb2: Fix muxed interrupt support
Peng Fan <[email protected]>
remoteproc: imx_rproc: Ignore create mem entry for resource table
Sherry Sun <[email protected]>
tty: serial: fsl_lpuart: fix potential bug when using both of_alias_get_id and ida_simple_get
Miaoqian Lin <[email protected]>
serial: 8250_aspeed_vuart: Fix potential NULL dereference in aspeed_vuart_probe
Daniel Gibson <[email protected]>
tty: n_tty: Restore EOF push handling behavior
Miaoqian Lin <[email protected]>
tty: serial: owl: Fix missing clk_disable_unprepare() in owl_uart_probe
Wang Weiyang <[email protected]>
tty: goldfish: Use tty_port_destroy() to destroy port
Christophe Leroy <[email protected]>
lkdtm/bugs: Don't expect thread termination without CONFIG_UBSAN_TRAP
Jiasheng Jiang <[email protected]>
lkdtm/bugs: Check for the NULL pointer after calling kmalloc
Christophe JAILLET <[email protected]>
remoteproc: mtk_scp: Fix a potential double free
Tinghan Shen <[email protected]>
remoteproc: mediatek: Fix side effect of mt8195 sram power on
Dan Carpenter <[email protected]>
soundwire: qcom: fix an error message in swrm_wait_for_frame_gen_enabled()
Alexandru Tachici <[email protected]>
iio: adc: ad7124: Remove shift from scan_type
Jakob Koschel <[email protected]>
staging: greybus: codecs: fix type confusion of list iterator variable
Randy Dunlap <[email protected]>
pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards
-------------
Diffstat:
Documentation/ABI/testing/sysfs-ata | 11 +- .../bindings/regulator/mt6315-regulator.yaml | 4 +- .../devicetree/bindings/remoteproc/mtk,scp.yaml | 44 ++-- Documentation/tools/rtla/Makefile | 14 +- Makefile | 4 +- arch/arm/boot/dts/aspeed-ast2600-evb.dts | 4 +- arch/arm/mach-ep93xx/clock.c | 10 +- arch/arm64/net/bpf_jit_comp.c | 1 + arch/m68k/Kconfig.machine | 1 + arch/m68k/include/asm/pgtable_no.h | 3 +- arch/m68k/kernel/setup_mm.c | 7 - arch/m68k/kernel/setup_no.c | 1 - arch/m68k/kernel/time.c | 9 + arch/mips/kernel/mips-cpc.c | 1 + arch/powerpc/Kconfig | 2 - arch/powerpc/include/asm/thread_info.h | 10 +- arch/powerpc/kernel/ptrace/ptrace-fpu.c | 20 +- arch/powerpc/kernel/ptrace/ptrace.c | 3 + arch/powerpc/platforms/pseries/papr_scm.c | 3 + arch/riscv/kernel/efi.c | 2 +- arch/riscv/kernel/machine_kexec.c | 4 +- arch/s390/crypto/aes_s390.c | 4 +- arch/s390/kernel/entry.S | 6 +- arch/s390/mm/gmap.c | 14 ++ arch/um/drivers/chan_kern.c | 10 +- arch/um/drivers/line.c | 22 +- arch/um/drivers/line.h | 4 +- arch/um/drivers/ssl.c | 2 - arch/um/drivers/stdio_console.c | 2 - arch/um/include/asm/irq.h | 22 +- arch/x86/include/asm/cpufeature.h | 2 +- arch/x86/include/asm/uaccess.h | 2 +- arch/x86/kvm/mmu/mmu.c | 2 +- arch/x86/kvm/svm/nested.c | 4 +- arch/x86/kvm/svm/svm.c | 32 ++- arch/x86/kvm/svm/svm.h | 2 +- block/bio.c | 9 +- block/blk-core.c | 2 +- block/blk-mq.c | 10 +- block/genhd.c | 2 + drivers/ata/libata-core.c | 21 +- drivers/ata/libata-scsi.c | 2 +- drivers/ata/libata-transport.c | 2 +- drivers/ata/pata_octeon_cf.c | 3 + drivers/base/bus.c | 4 +- drivers/base/dd.c | 10 +- drivers/block/loop.c | 8 +- drivers/block/nbd.c | 78 ++++--- drivers/bus/ti-sysc.c | 4 +- drivers/char/hw_random/virtio-rng.c | 2 + drivers/char/random.c | 15 +- drivers/char/xillybus/xillyusb.c | 1 + drivers/clocksource/timer-oxnas-rps.c | 2 +- drivers/clocksource/timer-riscv.c | 2 +- drivers/clocksource/timer-sp804.c | 10 +- drivers/dma/idxd/dma.c | 1 + drivers/dma/xilinx/zynqmp_dma.c | 5 +- drivers/extcon/extcon-axp288.c | 4 +- drivers/extcon/extcon-ptn5150.c | 11 + drivers/extcon/extcon.c | 33 +-- drivers/firmware/dmi-sysfs.c | 2 +- drivers/firmware/stratix10-svc.c | 12 +- drivers/gpio/gpio-pca953x.c | 19 +- drivers/gpu/drm/amd/amdgpu/jpeg_v2_0.c | 6 +- drivers/gpu/drm/amd/amdgpu/jpeg_v2_0.h | 1 + drivers/gpu/drm/amd/amdgpu/nv.c | 1 + drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 17 +- drivers/gpu/drm/amd/amdkfd/kfd_device.c | 4 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- .../amd/display/dc/clk_mgr/dcn315/dcn315_clk_mgr.c | 5 +- .../amd/display/dc/clk_mgr/dcn316/dcn316_clk_mgr.c | 3 +- .../gpu/drm/amd/display/dc/dce/dce_clock_source.c | 9 +- drivers/gpu/drm/amd/display/dc/dml/dml_wrapper.c | 2 - .../drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 57 +++-- drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | 2 +- drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 1 + drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 2 +- .../gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c | 3 + drivers/gpu/drm/bridge/analogix/analogix_dp_core.c | 42 +++- drivers/gpu/drm/bridge/ti-sn65dsi83.c | 2 +- drivers/gpu/drm/drm_atomic_helper.c | 16 +- drivers/gpu/drm/imx/ipuv3-crtc.c | 2 +- drivers/gpu/drm/msm/dp/dp_ctrl.c | 9 +- drivers/gpu/drm/panfrost/panfrost_drv.c | 5 +- drivers/gpu/drm/panfrost/panfrost_job.c | 6 +- drivers/gpu/drm/panfrost/panfrost_job.h | 2 +- drivers/gpu/drm/radeon/radeon_connectors.c | 4 + drivers/hwtracing/coresight/coresight-cpu-debug.c | 7 +- drivers/i2c/busses/i2c-cadence.c | 12 +- drivers/i2c/busses/i2c-mt65xx.c | 11 +- drivers/idle/intel_idle.c | 32 ++- drivers/iio/adc/ad7124.c | 1 - drivers/iio/adc/sc27xx_adc.c | 20 +- drivers/iio/adc/stmpe-adc.c | 8 +- drivers/iio/common/st_sensors/st_sensors_core.c | 24 +- drivers/iio/dummy/iio_simple_dummy.c | 20 +- drivers/iio/proximity/vl53l0x-i2c.c | 7 +- drivers/input/mouse/bcm5974.c | 7 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 + drivers/iommu/arm/arm-smmu/arm-smmu.c | 5 +- drivers/md/md.c | 15 +- drivers/md/raid0.c | 31 +-- drivers/misc/cardreader/rtsx_usb.c | 1 + drivers/misc/fastrpc.c | 9 +- drivers/misc/lkdtm/bugs.c | 10 +- drivers/misc/lkdtm/lkdtm.h | 8 +- drivers/misc/lkdtm/usercopy.c | 17 +- drivers/misc/pvpanic/pvpanic.c | 10 +- drivers/mmc/core/block.c | 3 +- drivers/mmc/host/sdhci-pci-gli.c | 3 + drivers/mtd/ubi/fastmap-wl.c | 69 ++++-- drivers/mtd/ubi/fastmap.c | 11 - drivers/mtd/ubi/ubi.h | 4 +- drivers/mtd/ubi/vmt.c | 1 - drivers/mtd/ubi/wl.c | 19 +- drivers/net/amt.c | 59 +++-- drivers/net/bonding/bond_main.c | 2 + drivers/net/bonding/bond_netlink.c | 5 - drivers/net/bonding/bond_options.c | 10 +- drivers/net/bonding/bond_procfs.c | 15 ++ drivers/net/dsa/lantiq_gswip.c | 4 +- drivers/net/dsa/mv88e6xxx/chip.c | 1 + drivers/net/dsa/mv88e6xxx/serdes.c | 27 +-- drivers/net/dsa/realtek/rtl8365mb.c | 38 +-- drivers/net/ethernet/altera/altera_tse_main.c | 6 +- drivers/net/ethernet/broadcom/bgmac-bcma-mdio.c | 1 + drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 8 +- .../net/ethernet/marvell/octeontx2/af/rvu_cpt.c | 2 +- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 3 + drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/dev.c | 72 ++++-- .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 7 +- drivers/net/ethernet/mellanox/mlx5/core/en.h | 4 + drivers/net/ethernet/mellanox/mlx5/core/en/fs.h | 2 + drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c | 1 + .../ethernet/mellanox/mlx5/core/en/reporter_rx.c | 6 + drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c | 19 +- drivers/net/ethernet/mellanox/mlx5/core/en/trap.c | 1 + .../net/ethernet/mellanox/mlx5/core/en/xsk/pool.c | 1 + .../net/ethernet/mellanox/mlx5/core/en/xsk/setup.c | 5 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 29 ++- drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 31 +-- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 38 ++- drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 37 ++- drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 12 +- .../net/ethernet/mellanox/mlx5/core/mlx5_core.h | 1 + .../ethernet/mellanox/mlx5/core/steering/fs_dr.c | 9 +- .../net/ethernet/microchip/lan966x/lan966x_main.c | 9 +- .../net/ethernet/netronome/nfp/flower/conntrack.c | 32 +-- drivers/net/ethernet/netronome/nfp/flower/match.c | 16 +- drivers/net/ethernet/netronome/nfp/nfdk/dp.c | 12 +- drivers/net/ethernet/netronome/nfp/nfdk/nfdk.h | 3 +- drivers/net/ethernet/netronome/nfp/nfp_net.h | 11 +- .../net/ethernet/netronome/nfp/nfp_net_ethtool.c | 4 +- drivers/net/ethernet/sfc/efx_channels.c | 6 +- drivers/net/ethernet/sfc/net_driver.h | 2 +- drivers/net/ethernet/stmicro/stmmac/dwmac-intel.c | 4 +- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 8 +- drivers/net/phy/at803x.c | 33 ++- drivers/net/phy/dp83867.c | 29 +++ drivers/net/phy/mdio_bus.c | 1 - drivers/nfc/st21nfca/se.c | 53 +++-- drivers/pci/controller/pcie-brcmstb.c | 257 +++------------------ drivers/pcmcia/Kconfig | 2 +- drivers/phy/qualcomm/phy-qcom-qmp.c | 2 +- drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 10 +- drivers/platform/x86/barco-p50-gpio.c | 5 +- drivers/platform/x86/hp-wmi.c | 29 ++- drivers/power/supply/ab8500_fg.c | 19 +- drivers/power/supply/axp288_charger.c | 17 +- drivers/power/supply/axp288_fuel_gauge.c | 41 +++- drivers/power/supply/charger-manager.c | 7 +- drivers/power/supply/max8997_charger.c | 8 +- drivers/power/supply/power_supply_core.c | 2 +- drivers/pwm/pwm-lp3943.c | 1 + drivers/pwm/pwm-raspberrypi-poe.c | 2 +- drivers/remoteproc/imx_rproc.c | 3 + drivers/remoteproc/mtk_common.h | 2 + drivers/remoteproc/mtk_scp.c | 70 ++++-- drivers/rpmsg/qcom_smd.c | 4 +- drivers/rpmsg/virtio_rpmsg_bus.c | 9 +- drivers/rtc/rtc-ftrtc010.c | 34 ++- drivers/rtc/rtc-mt6397.c | 2 + drivers/scsi/lpfc/lpfc_crtn.h | 4 +- drivers/scsi/lpfc/lpfc_ct.c | 2 +- drivers/scsi/lpfc/lpfc_init.c | 2 +- drivers/scsi/lpfc/lpfc_nvme.c | 6 +- drivers/scsi/lpfc/lpfc_scsi.c | 6 + drivers/scsi/lpfc/lpfc_sli.c | 25 +- drivers/scsi/myrb.c | 11 +- drivers/scsi/sd.c | 5 +- drivers/soc/rockchip/grf.c | 2 + drivers/soundwire/intel.c | 3 + drivers/soundwire/qcom.c | 6 +- drivers/spi/spi-fsi.c | 12 +- drivers/staging/fieldbus/anybuss/host.c | 2 +- drivers/staging/greybus/audio_codec.c | 4 +- drivers/staging/r8188eu/core/rtw_fw.c | 2 +- drivers/staging/r8188eu/core/rtw_mlme.c | 6 +- drivers/staging/r8188eu/core/rtw_xmit.c | 13 +- drivers/staging/r8188eu/include/rtw_xmit.h | 2 +- drivers/staging/rtl8192e/rtllib_softmac.c | 2 +- .../staging/rtl8192u/ieee80211/ieee80211_softmac.c | 2 +- drivers/staging/rtl8712/os_intfs.c | 1 - drivers/staging/rtl8712/usb_intf.c | 12 +- drivers/staging/rtl8712/usb_ops.c | 27 ++- drivers/staging/rtl8723bs/core/rtw_mlme.c | 12 +- drivers/thunderbolt/tb.c | 19 +- drivers/thunderbolt/test.c | 16 +- drivers/thunderbolt/tunnel.c | 11 +- drivers/thunderbolt/tunnel.h | 4 +- drivers/tty/goldfish.c | 2 + drivers/tty/n_tty.c | 38 ++- drivers/tty/serial/8250/8250_aspeed_vuart.c | 2 + drivers/tty/serial/8250/8250_fintek.c | 8 +- drivers/tty/serial/8250/8250_mtk.c | 7 - drivers/tty/serial/cpm_uart/cpm_uart_core.c | 2 +- drivers/tty/serial/digicolor-usart.c | 2 + drivers/tty/serial/fsl_lpuart.c | 24 +- drivers/tty/serial/icom.c | 2 +- drivers/tty/serial/meson_uart.c | 13 ++ drivers/tty/serial/msm_serial.c | 5 + drivers/tty/serial/owl-uart.c | 1 + drivers/tty/serial/rda-uart.c | 2 + drivers/tty/serial/sa1100.c | 4 +- drivers/tty/serial/serial_txx9.c | 2 + drivers/tty/serial/sh-sci.c | 6 +- drivers/tty/serial/sifive.c | 8 +- drivers/tty/serial/st-asc.c | 4 + drivers/tty/serial/stm32-usart.c | 15 +- drivers/tty/serial/uartlite.c | 3 +- drivers/tty/synclink_gt.c | 2 + drivers/tty/sysrq.c | 13 +- drivers/usb/core/hcd-pci.c | 4 +- drivers/usb/dwc2/gadget.c | 1 - drivers/usb/dwc3/drd.c | 9 +- drivers/usb/dwc3/dwc3-pci.c | 2 +- drivers/usb/dwc3/gadget.c | 31 ++- drivers/usb/dwc3/host.c | 2 - drivers/usb/host/isp116x-hcd.c | 6 +- drivers/usb/host/oxu210hp-hcd.c | 2 + drivers/usb/musb/omap2430.c | 1 + drivers/usb/phy/phy-omap-otg.c | 4 +- drivers/usb/storage/karma.c | 15 +- drivers/usb/typec/mux.c | 14 +- drivers/usb/typec/tcpm/fusb302.c | 4 +- drivers/usb/usbip/stub_dev.c | 2 +- drivers/usb/usbip/stub_rx.c | 2 + drivers/vdpa/ifcvf/ifcvf_main.c | 3 +- drivers/vdpa/vdpa.c | 13 +- drivers/vdpa/vdpa_user/vduse_dev.c | 7 +- drivers/vhost/vringh.c | 10 +- drivers/video/fbdev/hyperv_fb.c | 19 +- drivers/video/fbdev/pxa3xx-gcu.c | 12 +- drivers/virtio/virtio_pci_modern_dev.c | 1 + drivers/watchdog/rti_wdt.c | 2 +- drivers/watchdog/rzg2l_wdt.c | 46 ++-- drivers/watchdog/ts4800_wdt.c | 5 +- drivers/watchdog/wdat_wdt.c | 1 + drivers/xen/xlate_mmu.c | 1 - fs/afs/dir.c | 5 +- fs/ceph/addr.c | 33 +-- fs/ceph/mds_client.c | 33 ++- fs/ceph/xattr.c | 10 +- fs/cifs/cifs_swn.c | 4 +- fs/cifs/cifsencrypt.c | 8 +- fs/cifs/cifsfs.c | 2 +- fs/cifs/cifsfs.h | 2 +- fs/cifs/cifsglob.h | 24 +- fs/cifs/connect.c | 30 +-- fs/cifs/dfs_cache.c | 4 +- fs/cifs/misc.c | 27 ++- fs/cifs/sess.c | 11 +- fs/cifs/smb1ops.c | 6 +- fs/cifs/smb2ops.c | 7 +- fs/cifs/smb2pdu.c | 9 +- fs/cifs/smbdirect.c | 4 +- fs/cifs/transport.c | 40 ++-- fs/erofs/zdata.c | 2 +- fs/f2fs/checkpoint.c | 12 +- fs/f2fs/f2fs.h | 23 +- fs/f2fs/file.c | 1 + fs/f2fs/node.c | 23 +- fs/fs-writeback.c | 37 ++- fs/inode.c | 2 +- fs/jffs2/fs.c | 1 + fs/kernfs/dir.c | 31 ++- fs/ksmbd/smbacl.c | 1 + fs/ksmbd/transport_rdma.c | 1 + fs/nfs/nfs4proc.c | 4 + fs/nfsd/filecache.c | 9 +- fs/zonefs/super.c | 11 +- include/linux/blkdev.h | 1 + include/linux/export.h | 7 +- include/linux/extcon.h | 2 +- include/linux/iio/common/st_sensors.h | 3 + include/linux/jump_label.h | 4 +- include/linux/mlx5/mlx5_ifc.h | 5 +- include/linux/nodemask.h | 38 +-- include/linux/random.h | 2 +- include/linux/xarray.h | 1 + include/net/ax25.h | 1 + include/net/bluetooth/hci_core.h | 17 +- include/net/bonding.h | 6 + include/net/flow_offload.h | 1 + include/net/netfilter/nf_tables.h | 1 - include/net/netfilter/nf_tables_offload.h | 2 +- include/net/sch_generic.h | 42 ++-- include/net/tcp.h | 19 +- include/trace/events/tcp.h | 2 +- kernel/bpf/core.c | 14 +- kernel/sched/autogroup.c | 2 +- kernel/trace/trace.c | 13 +- kernel/trace/trace_syscalls.c | 35 +-- lib/Makefile | 2 +- lib/iov_iter.c | 20 +- lib/nodemask.c | 4 +- lib/xarray.c | 5 +- mm/filemap.c | 9 +- mm/huge_memory.c | 3 +- net/ax25/af_ax25.c | 27 ++- net/ax25/ax25_dev.c | 1 + net/ax25/ax25_subr.c | 2 +- net/bluetooth/hci_core.c | 4 +- net/bluetooth/hci_request.c | 2 +- net/bluetooth/hci_sync.c | 62 +++-- net/bluetooth/mgmt.c | 45 ++-- net/core/filter.c | 2 +- net/core/flow_offload.c | 6 + net/core/neighbour.c | 2 +- net/ipv4/inet_hashtables.c | 10 +- net/ipv4/ip_gre.c | 11 +- net/ipv4/tcp.c | 8 +- net/ipv4/tcp_bbr.c | 20 +- net/ipv4/tcp_bic.c | 14 +- net/ipv4/tcp_cdg.c | 30 +-- net/ipv4/tcp_cong.c | 18 +- net/ipv4/tcp_cubic.c | 22 +- net/ipv4/tcp_dctcp.c | 11 +- net/ipv4/tcp_highspeed.c | 18 +- net/ipv4/tcp_htcp.c | 10 +- net/ipv4/tcp_hybla.c | 18 +- net/ipv4/tcp_illinois.c | 12 +- net/ipv4/tcp_input.c | 36 +-- net/ipv4/tcp_ipv4.c | 2 +- net/ipv4/tcp_lp.c | 6 +- net/ipv4/tcp_metrics.c | 12 +- net/ipv4/tcp_nv.c | 24 +- net/ipv4/tcp_output.c | 34 +-- net/ipv4/tcp_rate.c | 2 +- net/ipv4/tcp_scalable.c | 4 +- net/ipv4/tcp_vegas.c | 21 +- net/ipv4/tcp_veno.c | 24 +- net/ipv4/tcp_westwood.c | 3 +- net/ipv4/tcp_yeah.c | 30 +-- net/ipv4/xfrm4_protocol.c | 1 - net/ipv6/ping.c | 8 +- net/ipv6/seg6_hmac.c | 1 - net/ipv6/seg6_local.c | 1 + net/ipv6/tcp_ipv6.c | 2 +- net/key/af_key.c | 10 +- net/netfilter/nf_tables_api.c | 54 ++--- net/netfilter/nf_tables_offload.c | 23 +- net/netfilter/nft_nat.c | 3 +- net/openvswitch/actions.c | 6 + net/openvswitch/conntrack.c | 4 +- net/sched/act_ct.c | 2 +- net/smc/af_smc.c | 1 + net/smc/smc_cdc.c | 2 +- net/sunrpc/xdr.c | 6 +- net/sunrpc/xprtrdma/rpc_rdma.c | 5 + net/sunrpc/xprtrdma/svc_rdma_rw.c | 4 +- net/tipc/bearer.c | 3 +- net/unix/af_unix.c | 2 +- net/xdp/xsk.c | 5 +- net/xdp/xsk_queue.h | 8 - scripts/gdb/linux/config.py | 6 +- scripts/get_abi.pl | 4 +- scripts/mod/modpost.c | 5 +- security/keys/trusted-keys/trusted_tpm2.c | 4 +- sound/pci/hda/patch_conexant.c | 7 + sound/pci/hda/patch_realtek.c | 2 + sound/soc/amd/acp/acp-pci.c | 1 + sound/soc/codecs/rt5640.c | 11 +- sound/soc/codecs/rt5640.h | 2 + sound/soc/fsl/fsl_sai.h | 4 +- sound/soc/intel/boards/bytcr_rt5640.c | 2 + sound/usb/pcm.c | 5 +- sound/usb/quirks-table.h | 7 +- tools/objtool/check.c | 3 +- tools/perf/arch/x86/util/evlist.c | 5 +- tools/perf/arch/x86/util/evsel.c | 24 +- tools/perf/arch/x86/util/evsel.h | 7 + tools/perf/arch/x86/util/topdown.c | 46 ++-- tools/perf/arch/x86/util/topdown.h | 7 + tools/perf/builtin-c2c.c | 4 +- .../selftests/bpf/progs/test_stacktrace_build_id.c | 2 +- tools/testing/selftests/net/bpf/Makefile | 4 +- tools/testing/selftests/netfilter/nft_nat.sh | 43 ++++ tools/tracing/rtla/Makefile | 35 +++ 400 files changed, 2758 insertions(+), 1806 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/339 pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards
From: Randy Dunlap <[email protected]>
[ Upstream commit 3928cf08334ed895a31458cbebd8d4ec6d84c080 ]
When the MIPS_ALCHEMY board selection is MIPS_XXS1500 instead of MIPS_DB1XXX, the PCMCIA driver 'db1xxx_ss' has build errors due to missing DB1XXX symbols. The PCMCIA driver should be restricted to MIPS_DB1XXX instead of MIPS_ALCHEMY to fix this build error.
ERROR: modpost: "bcsr_read" [drivers/pcmcia/db1xxx_ss.ko] undefined!
ERROR: modpost: "bcsr_mod" [drivers/pcmcia/db1xxx_ss.ko] undefined!
--- drivers/pcmcia/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pcmcia/Kconfig +1 -1
@@ -151,7 +151,7 @@ config TCIC config PCMCIA_ALCHEMY_DEVBOARD tristate "Alchemy Db/Pb1xxx PCMCIA socket services" - depends on MIPS_ALCHEMY && PCMCIA + depends on MIPS_DB1XXX && PCMCIA help Enable this driver of you want PCMCIA support on your Alchemy Db1000, Db/Pb1100, Db/Pb1500, Db/Pb1550, Db/Pb1200, DB1300
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 2/339 staging: greybus: codecs: fix type confusion of list iterator variable
In reply to Greg Kroah-HartmanFrom: Jakob Koschel <[email protected]>
[ Upstream commit 84ef256550196bc06e6849a34224c998b45bd557 ]
If the list does not exit early then data == NULL and 'module' does not point to a valid list element.
Using 'module' in such a case is not valid and was therefore removed.
--- drivers/staging/greybus/audio_codec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/staging/greybus/audio_codec.c +2 -2
@@ -599,8 +599,8 @@ static int gbcodec_mute_stream(struct snd_soc_dai *dai, int mute, int stream)break ; }if (!data) { -dev_err (dai->dev,"%s:%s DATA connection missing\n" , - dai->name, module->name); +dev_err (dai->dev,"%s DATA connection missing\n" , + dai->name);mutex_unlock (&codec->lock);return -ENODEV ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 3/339 iio: adc: ad7124: Remove shift from scan_type
In reply to Greg Kroah-HartmanFrom: Alexandru Tachici <[email protected]>
[ Upstream commit fe78ccf79b0e29fd6d8dc2e2c3b0dbeda4ce3ad8 ]
The 24 bits data is stored in 32 bits in BE. There is no need to shift it. This confuses user-space apps.
--- drivers/iio/adc/ad7124.c | 1 - 1 file changed, 1 deletion(-)
drivers/iio/adc/ad7124.c +0 -1
@@ -188,7 +188,6 @@ static const struct iio_chan_spec ad7124_channel_template = { .sign = 'u', .realbits = 24, .storagebits = 32, - .shift = 8, .endianness = IIO_BE, }, };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 4/339 soundwire: qcom: fix an error message in swrm_wait_for_frame_gen_enabled()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit d146de3430d2b21054f6dc8a890f84062515f4d2 ]
The logical AND && is supposed to be bitwise AND & so it will sometimes print "connected" instead of "disconnected".
--- drivers/soundwire/qcom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soundwire/qcom.c +1 -1
@@ -1452,7 +1452,7 @@ static bool swrm_wait_for_frame_gen_enabled(struct qcom_swrm_ctrl *swrm) }while (retry--);dev_err (swrm->dev,"%s: link status not %s\n" , __func__, - comp_sts &&SWRM_FRM_GEN_ENABLED ?"connected" :"disconnected" ); + comp_sts &SWRM_FRM_GEN_ENABLED ?"connected" :"disconnected" );return false; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 5/339 remoteproc: mediatek: Fix side effect of mt8195 sram power on
In reply to Greg Kroah-HartmanFrom: Tinghan Shen <[email protected]>
[ Upstream commit f20e232d74ee0ace386be0b7db1ff993ea69b4c4 ]
The definition of L1TCM_SRAM_PDN bits on mt8195 is different to mt8192.
L1TCM_SRAM_PDN bits[3:0] control the power of mt8195 L1TCM SRAM.
L1TCM_SRAM_PDN bits[7:4] control the access path to EMI for SCP. These bits have to be powered on to allow EMI access for SCP.
Bits[7:4] also affect audio DSP because audio DSP and SCP are placed on the same hardware bus. If SCP cannot access EMI, audio DSP is blocked too.
L1TCM_SRAM_PDN bits[31:8] are not used.
This fix removes modification of bits[7:4] when power on/off mt8195 SCP L1TCM. It's because the modification introduces a short period of time blocking audio DSP to access EMI. This was not a problem until we have to load both SCP module and audio DSP module. audio DSP needs to access EMI because it has source/data on DRAM. Audio DSP will have unexpected behavior when it accesses EMI and the SCP driver blocks the EMI path at the same time.
--- drivers/remoteproc/mtk_common.h | 2 + drivers/remoteproc/mtk_scp.c | 69 +++++++++++++++++++++++++-------- 2 files changed, 54 insertions(+), 17 deletions(-)
drivers/remoteproc/mtk_common.h +2 -0
@@ -54,6 +54,8 @@#define MT8192_CORE0_WDT_IRQ 0x10030#define MT8192_CORE0_WDT_CFG 0x10034 +#define MT8195_L1TCM_SRAM_PDN_RESERVED_RSI_BITS GENMASK(7, 4) +#define SCP_FW_VER_LEN 32#define SCP_SHARE_BUFFER_SIZE 288
drivers/remoteproc/mtk_scp.c +52 -17
114 lines not on this page · raw message
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 6/339 remoteproc: mtk_scp: Fix a potential double free
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit eac3e5b1c12f85732e60f5f8b985444d273866bb ]
'scp->rproc' is allocated using devm_rproc_alloc(), so there is no need to free it explicitly in the remove function.
--- drivers/remoteproc/mtk_scp.c | 1 - 1 file changed, 1 deletion(-)
drivers/remoteproc/mtk_scp.c +0 -1
@@ -912,7 +912,6 @@ static int scp_remove(struct platform_device *pdev)for (i =0 ; i <SCP_IPI_MAX ; i++)mutex_destroy (&scp->ipi_desc[i].lock);mutex_destroy (&scp->send_lock); -rproc_free (scp->rproc);return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 7/339 lkdtm/bugs: Check for the NULL pointer after calling kmalloc
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 4a9800c81d2f34afb66b4b42e0330ae8298019a2 ]
As the possible failure of the kmalloc(), the not_checked and checked could be NULL pointer.
Therefore, it should be better to check it in order to avoid the dereference of the NULL pointer.
Also, we need to kfree the 'not_checked' and 'checked' to avoid the memory leak if fails.
And since it is just a test, it may directly return without error number.
--- drivers/misc/lkdtm/bugs.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/misc/lkdtm/bugs.c +5 -0
@@ -327,6 +327,11 @@ void lkdtm_ARRAY_BOUNDS(void) not_checked =kmalloc (sizeof (*not_checked) *2 ,GFP_KERNEL ); checked =kmalloc (sizeof (*checked) *2 ,GFP_KERNEL ); +if (!not_checked || !checked) { +kfree (not_checked); +kfree (checked); +return ; + }pr_info ("Array access within bounds ...\n" );/* For both, touch all bytes in the actual member size. */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 8/339 lkdtm/bugs: Dont expect thread termination without CONFIG_UBSAN_TRAP
In reply to Greg Kroah-HartmanFrom: Christophe Leroy <[email protected]>
[ Upstream commit 8bfdbddd68249e0d8598777cca8249619ee51df0 ]
When you don't select CONFIG_UBSAN_TRAP, you get:
# echo ARRAY_BOUNDS > /sys/kernel/debug/provoke-crash/DIRECT [ 102.265827] ================================================================================ [ 102.278433] UBSAN: array-index-out-of-bounds in drivers/misc/lkdtm/bugs.c:342:16 [ 102.287207] index 8 is out of range for type 'char [8]' [ 102.298722] ================================================================================ [ 102.313712] lkdtm: FAIL: survived array bounds overflow! [ 102.318770] lkdtm: Unexpected! This kernel (5.16.0-rc1-s3k-dev-01884-g720dcf79314a ppc) was built with CONFIG_UBSAN_BOUNDS=y
It is not correct because when CONFIG_UBSAN_TRAP is not selected you can't expect array bounds overflow to kill the thread.
Modify the logic so that when the kernel is built with CONFIG_UBSAN_BOUNDS but without CONFIG_UBSAN_TRAP, you get a warning about CONFIG_UBSAN_TRAP not been selected instead.
This also require a fix of pr_expected_config(), otherwise the following error is encountered.
CC drivers/misc/lkdtm/bugs.odrivers/misc/lkdtm/bugs.c: In function 'lkdtm_ARRAY_BOUNDS':drivers/misc/lkdtm/bugs.c:351:2: error: 'else' without a previous 'if'
351 | else
| ^~~~--- drivers/misc/lkdtm/bugs.c | 5 ++++- drivers/misc/lkdtm/lkdtm.h | 8 ++++---- 2 files changed, 8 insertions(+), 5 deletions(-)
drivers/misc/lkdtm/bugs.c +4 -1
@@ -351,7 +351,10 @@ void lkdtm_ARRAY_BOUNDS(void)kfree (not_checked);kfree (checked);pr_err ("FAIL: survived array bounds overflow!\n" ); -pr_expected_config (CONFIG_UBSAN_BOUNDS ); +if (IS_ENABLED (CONFIG_UBSAN_BOUNDS )) +pr_expected_config (CONFIG_UBSAN_TRAP ); +else +pr_expected_config (CONFIG_UBSAN_BOUNDS ); }void lkdtm_CORRUPT_LIST_ADD (void )
drivers/misc/lkdtm/lkdtm.h +4 -4
@@ -9,19 +9,19 @@extern char *lkdtm_kernel_info;#define pr_expected_config (kconfig) \ -{ \ +do { \ if (IS_ENABLED(kconfig)) \ pr_err("Unexpected! This %s was built with " #kconfig "=y\n", \ lkdtm_kernel_info); \ else \ pr_warn("This is probably expected, since this %s was built *without* " #kconfig "=y\n", \ lkdtm_kernel_info); \ -} +} while (0)#ifndef MODULE int lkdtm_check_bool_cmdline (const char *param);#define pr_expected_config_param (kconfig, param) \ -{ \ +do { \ if (IS_ENABLED(kconfig)) { \ switch (lkdtm_check_bool_cmdline(param)) { \ case 0: \
@@ -52,7 +52,7 @@ int lkdtm_check_bool_cmdline(const char *param); break; \ } \ } \ -} +} while (0)#else #define pr_expected_config_param (kconfig, param) pr_expected_config(kconfig)#endif
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 9/339 tty: goldfish: Use tty_port_destroy() to destroy port
In reply to Greg Kroah-HartmanFrom: Wang Weiyang <[email protected]>
[ Upstream commit 507b05063d1b7a1fcb9f7d7c47586fc4f3508f98 ]
In goldfish_tty_probe(), the port initialized through tty_port_init() should be destroyed in error paths.In goldfish_tty_remove(), qtty->port also should be destroyed or else might leak resources.
Fix the above by calling tty_port_destroy().
--- drivers/tty/goldfish.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/tty/goldfish.c +2 -0
@@ -405,6 +405,7 @@ static int goldfish_tty_probe(struct platform_device *pdev) err_tty_register_device_failed:free_irq (irq, qtty); err_dec_line_count: +tty_port_destroy (&qtty->port); goldfish_tty_current_line_count--;if (goldfish_tty_current_line_count ==0 )goldfish_tty_delete_driver ();
@@ -426,6 +427,7 @@ static int goldfish_tty_remove(struct platform_device *pdev)iounmap (qtty->base); qtty->base =NULL ;free_irq (qtty->irq, pdev); +tty_port_destroy (&qtty->port); goldfish_tty_current_line_count--;if (goldfish_tty_current_line_count ==0 )goldfish_tty_delete_driver ();
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 10/339 tty: serial: owl: Fix missing clk_disable_unprepare() in owl_uart_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit bcea0f547ec1a2ee44d429aaf0334633e386e67c ]
Fix the missing clk_disable_unprepare() before return from owl_uart_probe() in the error handling case.
--- drivers/tty/serial/owl-uart.c | 1 + 1 file changed, 1 insertion(+)
drivers/tty/serial/owl-uart.c +1 -0
@@ -731,6 +731,7 @@ static int owl_uart_probe(struct platform_device *pdev) owl_port->port.uartclk =clk_get_rate (owl_port->clk);if (owl_port->port.uartclk ==0 ) {dev_err (&pdev->dev,"clock rate is zero\n" ); +clk_disable_unprepare (owl_port->clk);return -EINVAL ; } owl_port->port.flags =UPF_BOOT_AUTOCONF |UPF_IOREMAP |UPF_LOW_LATENCY ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 11/339 tty: n_tty: Restore EOF push handling behavior
In reply to Greg Kroah-HartmanFrom: Daniel Gibson <[email protected]>
[ Upstream commit 65a8b287023da68c4550deab5c764e6891cf1caf ]
TTYs in ICANON mode have a special case that allows "pushing" a line without a regular EOL character (like newline), by using EOF (the EOT character - ASCII 0x4) as a pseudo-EOL. It is silently discarded, so the reader of the PTS will receive the line *without* EOF or any other terminating character.
This special case has an edge case: What happens if the readers buffer is the same size as the line (without EOF)? Will they be able to tell if the whole line is received, i.e. if the next read() will return more of the same line or the next line?
There are two possibilities, that both have (dis)advantages:
1. The next read() returns 0. FreeBSD (13.0) and OSX (10.11) do this.
Advantage: The reader can interpret this as "the line is over".
Disadvantage: read() returning 0 means EOF, the reader could also interpret it as "there's no more data" and stop reading or even close the PT.
2. The next read() returns the next line, the EOF is silently discarded. Solaris (or at least OpenIndiana 2021.10) does this, Linux has done do this since commit 40d5e0905a03 ("n_tty: Fix EOF push handling"); this behavior was recently broken by commit 359303076163 ("tty:
n_tty: do not look ahead for EOL character past the end of the buffer").
Advantage: read() won't return 0 (EOF), reader less likely to be confused (and things like while(read(..)>0) don't break)
Disadvantage: The reader can't really know if the read() continues the last line (that filled the whole read buffer) or starts a new line.
As both options are defensible (and are used by other Unix-likes), it's best to stick to the "old" behavior since "n_tty: Fix EOF push handling" of 2013, i.e. silently discard that EOF.
This patch - that I actually got from Linus for testing and only modified slightly - restores that behavior by skipping an EOF character if it's the next character after reading is done.
Based on a patch from Linus Torvalds.
--- drivers/tty/n_tty.c | 38 +++++++++++++++++++++++++++++++++++++- 1 file changed, 37 insertions(+), 1 deletion(-)
drivers/tty/n_tty.c +37 -1
@@ -1975,6 +1975,35 @@ static bool canon_copy_from_read_buf(struct tty_struct *tty,return ldata->read_tail != canon_head; } +/* +* If we finished a read at the exact location of an +* EOF (special EOL character that's a __DISABLED_CHAR) +* in the stream, silently eat the EOF. +*/ +static void canon_skip_eof (struct tty_struct *tty) +{ +struct n_tty_data *ldata = tty->disc_data; +size_t tail, canon_head; + + canon_head =smp_load_acquire (&ldata->canon_head); + tail = ldata->read_tail; + +// No data? +if (tail == canon_head) +return ; + +// See if the tail position is EOF in the circular buffer + tail &= (N_TTY_BUF_SIZE -1 ); +if (!test_bit (tail, ldata->read_flags)) +return ; +if (read_buf (ldata, tail) != __DISABLED_CHAR) +return ; + +// Clear the EOL bit, skip the EOF char. +clear_bit (tail, ldata->read_flags); +smp_store_release (&ldata->read_tail, ldata->read_tail +1 ); +} +/** * job_control - check job control * @tty: tty
@@ -2045,7 +2074,14 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,*/ if (*cookie) {if (ldata->icanon && !L_EXTPROC (tty)) { -if (canon_copy_from_read_buf (tty, &kb, &nr)) +/* +* If we have filled the user buffer, see +* if we should skip an EOF character before +* releasing the lock and returning done. +*/ +if (!nr) +canon_skip_eof (tty); +else if (canon_copy_from_read_buf (tty, &kb, &nr))return kb - kbuf; }else {if (copy_from_read_buf (tty, &kb, &nr))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 12/339 serial: 8250_aspeed_vuart: Fix potential NULL dereference in aspeed_vuart_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 0e0fd55719fa081de6f9e5d9e6cef48efb04d34a ]
platform_get_resource() may fail and return NULL, so we should better check it's return value to avoid a NULL pointer dereference.
--- drivers/tty/serial/8250/8250_aspeed_vuart.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/tty/serial/8250/8250_aspeed_vuart.c +2 -0
@@ -429,6 +429,8 @@ static int aspeed_vuart_probe(struct platform_device *pdev)timer_setup (&vuart->unthrottle_timer, aspeed_vuart_unthrottle_exp,0 ); res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); +if (!res) +return -EINVAL ;memset (&port,0 ,sizeof (port)); port.port.private_data = vuart;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 13/339 tty: serial: fsl_lpuart: fix potential bug when using both of_alias_get_id and ida_simple_get
In reply to Greg Kroah-HartmanFrom: Sherry Sun <[email protected]>
[ Upstream commit f398e0aa325c61fa20903833a5b534ecb8e6e418 ]
Now fsl_lpuart driver use both of_alias_get_id() and ida_simple_get() in .probe(), which has the potential bug. For example, when remove the lpuart7 alias in dts, of_alias_get_id() will return error, then call ida_simple_get() to allocate the id 0 for lpuart7, this may confilct with the lpuart4 which has alias 0.
aliases {
...
serial0 = &lpuart4;
serial1 = &lpuart5;
serial2 = &lpuart6;
serial3 = &lpuart7;
}So remove the ida_simple_get() in .probe(), return an error directly when calling of_alias_get_id() fails, which is consistent with other uart drivers behavior.
--- drivers/tty/serial/fsl_lpuart.c | 24 ++++-------------------- 1 file changed, 4 insertions(+), 20 deletions(-)
drivers/tty/serial/fsl_lpuart.c +4 -20
@@ -239,8 +239,6 @@/* IMX lpuart has four extra unused regs located at the beginning */ #define IMX_REG_OFF 0x10 -static DEFINE_IDA (fsl_lpuart_ida); -enum lpuart_type {VF610_LPUART ,LS1021A_LPUART ,
@@ -276,7 +274,6 @@ struct lpuart_port {int rx_dma_rng_buf_len;unsigned int dma_tx_nents;wait_queue_head_t dma_wait; -bool id_allocated; };struct lpuart_soc_data {
@@ -2717,23 +2714,18 @@ static int lpuart_probe(struct platform_device *pdev) ret =of_alias_get_id (np,"serial" );if (ret <0 ) { - ret =ida_simple_get (&fsl_lpuart_ida,0 ,UART_NR ,GFP_KERNEL ); -if (ret <0 ) { -dev_err (&pdev->dev,"port line is full, add device failed\n" ); -return ret; - } - sport->id_allocated = true; +dev_err (&pdev->dev,"failed to get alias id, errno %d\n" , ret); +return ret; }if (ret >=ARRAY_SIZE (lpuart_ports)) {dev_err (&pdev->dev,"serial%d out of range\n" , ret); - ret = -EINVAL ; - goto failed_out_of_range; +return -EINVAL ; } sport->port.line = ret; ret =lpuart_enable_clks (sport);if (ret) - goto failed_clock_enable; +return ret; sport->port.uartclk =lpuart_get_baud_clk_rate (sport); lpuart_ports[sport->port.line] = sport;
@@ -2781,10 +2773,6 @@ static int lpuart_probe(struct platform_device *pdev)uart_remove_one_port (&lpuart_reg, &sport->port); failed_attach_port:lpuart_disable_clks (sport); -failed_clock_enable: -failed_out_of_range: -if (sport->id_allocated) -ida_simple_remove (&fsl_lpuart_ida, sport->port.line);return ret; }
@@ -2794,9 +2782,6 @@ static int lpuart_remove(struct platform_device *pdev)uart_remove_one_port (&lpuart_reg, &sport->port); -if (sport->id_allocated) -ida_simple_remove (&fsl_lpuart_ida, sport->port.line); -lpuart_disable_clks (sport);if (sport->dma_tx_chan)
@@ -2926,7 +2911,6 @@ static int __init lpuart_serial_init(void) static void __exit lpuart_serial_exit(void) { -ida_destroy (&fsl_lpuart_ida);platform_driver_unregister (&lpuart_driver);uart_unregister_driver (&lpuart_reg); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 14/339 remoteproc: imx_rproc: Ignore create mem entry for resource table
In reply to Greg Kroah-HartmanFrom: Peng Fan <[email protected]>
[ Upstream commit 58b7c856519fe946620ee68dd0c37bd3c695484a ]
Resource table is used by Linux to get information published by remote processor. It should be not be used for memory allocation, so not create rproc mem entry.
--- drivers/remoteproc/imx_rproc.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/remoteproc/imx_rproc.c +3 -0
@@ -423,6 +423,9 @@ static int imx_rproc_prepare(struct rproc *rproc)if (!strcmp (it.node->name,"vdev0buffer" ))continue ; +if (!strcmp (it.node->name,"rsc-table" )) +continue ; + rmem =of_reserved_mem_lookup (it.node);if (!rmem) {dev_err (priv->dev,"unable to acquire memory-region\n" );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 15/339 phy: rockchip-inno-usb2: Fix muxed interrupt support
In reply to Greg Kroah-HartmanFrom: Samuel Holland <[email protected]>
[ Upstream commit 6a98df08ccd55e87947d253b19925691763e755c ]
This commit fixes two issues with the muxed interrupt handler. First, the OTG port has the "bvalid" interrupt enabled, not "linestate". Since only the linestate interrupt was handled, and not the bvalid interrupt, plugging in a cable to the OTG port caused an interrupt storm.
Second, the return values from the individual port IRQ handlers need to be OR-ed together. Otherwise, the lack of an interrupt from the last port would cause the handler to erroneously return IRQ_NONE.
--- drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/phy/rockchip/phy-rockchip-inno-usb2.c +8 -2
@@ -940,8 +940,14 @@ static irqreturn_t rockchip_usb2phy_irq(int irq, void *data)if (!rport->phy)continue ; -/* Handle linestate irq for both otg port and host port */ - ret =rockchip_usb2phy_linestate_irq (irq, rport); +switch (rport->port_id) { +case USB2PHY_PORT_OTG : + ret |=rockchip_usb2phy_otg_mux_irq (irq, rport); +break ; +case USB2PHY_PORT_HOST : + ret |=rockchip_usb2phy_linestate_irq (irq, rport); +break ; + } }return ret;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 16/339 staging: r8188eu: fix struct rt_firmware_hdr
In reply to Greg Kroah-HartmanFrom: Michael Straube <[email protected]>
[ Upstream commit fbfdc1b6f80abc40cb1f7bac68248b899754d8be ]
The size of struct rt_firmware_hdr is 36 bytes.
$ pahole -C rt_firmware_hdr drivers/staging/r8188eu/r8188eu.o
struct rt_firmware_hdr {
__le16 Signature; /* 0 2 */
u8 Category; /* 2 1 */
u8 Function; /* 3 1 */
__le16 Version; /* 4 2 */
u8 Subversion; /* 6 1 *//* XXX 1 byte hole, try to pack */
u16 Rsvd1; /* 8 2 */
u8 Month; /* 10 1 */
u8 Date; /* 11 1 */
u8 Hour; /* 12 1 */
u8 Minute; /* 13 1 */
__le16 RamCodeSize; /* 14 2 */
u8 Foundry; /* 16 1 */
u8 Rsvd2; /* 17 1 */
/* XXX 2 bytes hole, try to pack */
__le32 SvnIdx; /* 20 4 */
u32 Rsvd3; /* 24 4 */
u32 Rsvd4; /* 28 4 */
u32 Rsvd5; /* 32 4 */
/* size: 36, cachelines: 1, members: 17 */ /* sum members: 33, holes: 2, sum holes: 3 */ /* last cacheline: 36 bytes */
};
But the header in the firmware file is only 32 bytes long.
The hexdump of rtl8188eufw.bin shows that the field Rsvd1 should be u8 instead of __le16.
OFFSET rtl8188eufw.bin
-----------------------------------------------------------0x00000000 E1 88 10 00 0B 00 01 00 01 21 11 27 30 36 00 00 0x00000010 2D 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x00000000 E1 88 10 00 0B 00 01 00 01 21 11 27 30 36 00 00
^ ^ ^ ^ ^ ^
Subversion Rsvd1 Month Date Hour MinuteWith the change of field Rsvd1 from __le16 to u8 the structure has the correct size 32.
$ pahole -C rt_firmware_hdr drivers/staging/r8188eu/r8188eu.o
struct rt_firmware_hdr {
__le16 Signature; /* 0 2 */
u8 Category; /* 2 1 */
u8 Function; /* 3 1 */
__le16 Version; /* 4 2 */
u8 Subversion; /* 6 1 */
u8 Rsvd1; /* 7 1 */
u8 Month; /* 8 1 */
u8 Date; /* 9 1 */
u8 Hour; /* 10 1 */
u8 Minute; /* 11 1 */
__le16 RamCodeSize; /* 12 2 */
u8 Foundry; /* 14 1 */
u8 Rsvd2; /* 15 1 */
__le32 SvnIdx; /* 16 4 */
u32 Rsvd3; /* 20 4 */
u32 Rsvd4; /* 24 4 */
u32 Rsvd5; /* 28 4 */ /* size: 32, cachelines: 1, members: 17 */
/* last cacheline: 32 bytes */The wrong size had no effect because the header size is hardcoded to 32 where it is used in the code and the fields after Subversion are not used.
--- drivers/staging/r8188eu/core/rtw_fw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/r8188eu/core/rtw_fw.c +1 -1
@@ -29,7 +29,7 @@ struct rt_firmware_hdr {* FW for different conditions */ __le16 Version;/* FW Version */ u8 Subversion;/* FW Subversion, default 0x00 */ -u16 Rsvd1; +u8 Rsvd1;/* LONG WORD 1 ---- */ u8 Month;/* Release time Month field */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 17/339 usb: usbip: fix a refcount leak in stub_probe()
In reply to Greg Kroah-HartmanFrom: Hangyu Hua <[email protected]>
[ Upstream commit 9ec4cbf1cc55d126759051acfe328d489c5d6e60 ]
usb_get_dev() is called in stub_device_alloc(). When stub_probe() fails after that, usb_put_dev() needs to be called to release the reference.
Fix this by moving usb_put_dev() to sdev_free error path handling.
Find this by code review.
--- drivers/usb/usbip/stub_dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/usbip/stub_dev.c +1 -1
@@ -393,7 +393,6 @@ static int stub_probe(struct usb_device *udev) err_port:dev_set_drvdata (&udev->dev,NULL ); -usb_put_dev (udev);/* we already have busid_priv, just lock busid_lock */ spin_lock (&busid_priv->busid_lock);
@@ -408,6 +407,7 @@ static int stub_probe(struct usb_device *udev)put_busid_priv (busid_priv); sdev_free: +usb_put_dev (udev);stub_device_free (sdev);return rc;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 18/339 usb: usbip: add missing device lock on tweak configuration cmd
In reply to Greg Kroah-HartmanFrom: Niels Dossche <[email protected]>
[ Upstream commit d088fabace2ca337b275d1d4b36db4fe7771e44f ]
The function documentation of usb_set_configuration says that its callers should hold the device lock. This lock is held for all callsites except tweak_set_configuration_cmd. The code path can be executed for example when attaching a remote USB device. The solution is to surround the call by the device lock.
This bug was found using my experimental own-developed static analysis tool, which reported the missing lock on v5.17.2. I manually verified this bug report by doing code review as well. I runtime checked that the required lock is not held. I compiled and runtime tested this on x86_64 with a USB mouse. After applying this patch, my analyser no longer reports this potential bug.
--- drivers/usb/usbip/stub_rx.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/usbip/stub_rx.c +2 -0
@@ -138,7 +138,9 @@ static int tweak_set_configuration_cmd(struct urb *urb) req = (struct usb_ctrlrequest *) urb->setup_packet; config =le16_to_cpu (req->wValue); +usb_lock_device (sdev->udev); err =usb_set_configuration (sdev->udev, config); +usb_unlock_device (sdev->udev);if (err && err != -ENODEV )dev_err (&sdev->udev->dev,"can't set config #%d, error %d\n" , config, err);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 19/339 USB: storage: karma: fix rio_karma_init return
In reply to Greg Kroah-HartmanFrom: Lin Ma <[email protected]>
[ Upstream commit b92ffb1eddd9a66a90defc556dcbf65a43c196c7 ]
The function rio_karam_init() should return -ENOMEM instead of value 0 (USB_STOR_TRANSPORT_GOOD) when allocation fails.
Similarly, it should return -EIO when rio_karma_send_command() fails.
--- drivers/usb/storage/karma.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
drivers/usb/storage/karma.c +8 -7
@@ -174,24 +174,25 @@ static void rio_karma_destructor(void *extra)static int rio_karma_init (struct us_data *us) { -int ret =0 ;struct karma_data *data =kzalloc (sizeof (struct karma_data ),GFP_NOIO );if (!data) - goto out; +return -ENOMEM ; data->recv =kmalloc (RIO_RECV_LEN ,GFP_NOIO );if (!data->recv) {kfree (data); - goto out; +return -ENOMEM ; } us->extra = data; us->extra_destructor = rio_karma_destructor; - ret =rio_karma_send_command (RIO_ENTER_STORAGE , us); - data->in_storage = (ret ==0 ); -out: -return ret; +if (rio_karma_send_command (RIO_ENTER_STORAGE , us)) +return -EIO ; + + data->in_storage =1 ; + +return 0 ; }static struct scsi_host_template karma_host_template;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 20/339 usb: musb: Fix missing of_node_put() in omap2430_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 424bef51fa530389b0b9008c9e144e40c10e8458 ]
The device_node pointer is returned by of_parse_phandle() with refcount incremented. We should use of_node_put() on it when done.
--- drivers/usb/musb/omap2430.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/musb/omap2430.c +1 -0
@@ -362,6 +362,7 @@ static int omap2430_probe(struct platform_device *pdev) control_node =of_parse_phandle (np,"ctrl-module" ,0 );if (control_node) { control_pdev =of_find_device_by_node (control_node); +of_node_put (control_node);if (!control_pdev) {dev_err (&pdev->dev,"Failed to get control device\n" ); ret = -EINVAL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 21/339 staging: fieldbus: Fix the error handling path in anybuss_host_common_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 7079b3483a17be2cfba64cbd4feb1b7ae07f1ea7 ]
If device_register() fails, device_unregister() should not be called because it will free some resources that are not allocated. put_device() should be used instead.
--- drivers/staging/fieldbus/anybuss/host.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/fieldbus/anybuss/host.c +1 -1
@@ -1384,7 +1384,7 @@ anybuss_host_common_probe(struct device *dev, goto err_device;return cd; err_device: -device_unregister (&cd->client->dev); +put_device (&cd->client->dev); err_kthread:kthread_stop (cd->qthread); err_reset:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 22/339 pwm: lp3943: Fix duty calculation in case period was clamped
In reply to Greg Kroah-HartmanFrom: Uwe Kleine-König <[email protected]>
[ Upstream commit 5e3b07ca5cc78cd4a987e78446849e41288d87cb ]
The hardware only supports periods <= 1.6 ms and if a bigger period is requested it is clamped to 1.6 ms. In this case duty_cycle might be bigger than 1.6 ms and then the duty cycle register is written with a value bigger than LP3943_MAX_DUTY. So clamp duty_cycle accordingly.
--- drivers/pwm/pwm-lp3943.c | 1 + 1 file changed, 1 insertion(+)
drivers/pwm/pwm-lp3943.c +1 -0
@@ -125,6 +125,7 @@ static int lp3943_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,if (err)return err; + duty_ns =min (duty_ns, period_ns); val = (u8)(duty_ns *LP3943_MAX_DUTY / period_ns);return lp3943_write_byte (lp3943, reg_duty, val);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 23/339 pwm: raspberrypi-poe: Fix endianness in firmware struct
In reply to Greg Kroah-HartmanFrom: Uwe Kleine-König <[email protected]>
[ Upstream commit 09f688f0718f57f9cf68ee1aa94490f641e759ba ]
The reg member of struct raspberrypi_pwm_prop is a little endian 32 bit quantity. Explicitly convert the (native endian) value to little endian on assignment as is already done in raspberrypi_pwm_set_property().
This fixes the following sparse warning:
drivers/pwm/pwm-raspberrypi-poe.c:69:24: warning: incorrect type in initializer (different base types)
drivers/pwm/pwm-raspberrypi-poe.c:69:24: expected restricted __le32 [usertype] reg
drivers/pwm/pwm-raspberrypi-poe.c:69:24: got unsigned int [usertype] reg
--- drivers/pwm/pwm-raspberrypi-poe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pwm/pwm-raspberrypi-poe.c +1 -1
@@ -66,7 +66,7 @@ static int raspberrypi_pwm_get_property(struct rpi_firmware *firmware, u32 reg, u32 *val) { struct raspberrypi_pwm_prop msg = { - .reg = reg + .reg =cpu_to_le32 (reg), };int ret;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 24/339 rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 1a358d35066487d228a68303d808bc4721c6b1b9 ]
The irq_of_parse_and_map() returns 0 on failure, not a negative ERRNO.
--- drivers/rpmsg/qcom_smd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/rpmsg/qcom_smd.c +1 -1
@@ -1407,7 +1407,7 @@ static int qcom_smd_parse_edge(struct device *dev, edge->name = node->name; irq =irq_of_parse_and_map (node,0 ); -if (irq <0 ) { +if (!irq) {dev_err (dev,"required smd interrupt missing\n" ); ret = irq; goto put_node;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 25/339 usb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback
In reply to Greg Kroah-HartmanFrom: Wesley Cheng <[email protected]>
[ Upstream commit bf594d1d0c1d7b895954018043536ffd327844f9 ]
The list_for_each_entry_safe() macro saves the current item (n) and the item after (n+1), so that n can be safely removed without corrupting the list. However, when traversing the list and removing items using gadget giveback, the DWC3 lock is briefly released, allowing other routines to execute. There is a situation where, while items are being removed from the cancelled_list using dwc3_gadget_ep_cleanup_cancelled_requests(), the pullup disable routine is running in parallel (due to UDC unbind). As the cleanup routine removes n, and the pullup disable removes n+1, once the cleanup retakes the DWC3 lock, it references a request who was already removed/handled. With list debug enabled, this leads to a panic. Ensure all instances of the macro are replaced where gadget giveback is used.
Example call stack:
Thread#1:__dwc3_gadget_ep_set_halt() - CLEAR HALT
-> dwc3_gadget_ep_cleanup_cancelled_requests()
->list_for_each_entry_safe()
->dwc3_gadget_giveback(n)
->dwc3_gadget_del_and_unmap_request()- n deleted[cancelled_list]
->spin_unlock
->Thread#2 executes
...
->dwc3_gadget_giveback(n+1)
->Already removed!Thread#2:dwc3_gadget_pullup()
->waiting for dwc3 spin_lock
...
->Thread#1 released lock
->dwc3_stop_active_transfers()
->dwc3_remove_requests()
->fetches n+1 item from cancelled_list (n removed by Thread#1)
->dwc3_gadget_giveback()
->dwc3_gadget_del_and_unmap_request()- n+1 deleted[cancelled_list]
->spin_unlock--- drivers/usb/dwc3/gadget.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
drivers/usb/dwc3/gadget.c +16 -4
@@ -2001,10 +2001,10 @@ static void dwc3_gadget_ep_skip_trbs(struct dwc3_ep *dep, struct dwc3_request *rstatic void dwc3_gadget_ep_cleanup_cancelled_requests (struct dwc3_ep *dep) {struct dwc3_request *req; -struct dwc3_request *tmp;struct dwc3 *dwc = dep->dwc; -list_for_each_entry_safe (req, tmp, &dep->cancelled_list, list) { +while (!list_empty (&dep->cancelled_list)) { + req =next_request (&dep->cancelled_list);dwc3_gadget_ep_skip_trbs (dep, req);switch (req->status) {case DWC3_REQUEST_STATUS_DISCONNECTED :
@@ -2021,6 +2021,12 @@ static void dwc3_gadget_ep_cleanup_cancelled_requests(struct dwc3_ep *dep)dwc3_gadget_giveback (dep, req, -ECONNRESET );break ; } +/* +* The endpoint is disabled, let the dwc3_remove_requests() +* handle the cleanup. +*/ +if (!dep->endpoint.desc) +break ; } }
@@ -3333,15 +3339,21 @@ static void dwc3_gadget_ep_cleanup_completed_requests(struct dwc3_ep *dep, const struct dwc3_event_depevt *event, int status) {struct dwc3_request *req; -struct dwc3_request *tmp; -list_for_each_entry_safe (req, tmp, &dep->started_list, list) { +while (!list_empty (&dep->started_list)) {int ret; + req =next_request (&dep->started_list); ret =dwc3_gadget_ep_cleanup_completed_request (dep, event, req, status);if (ret)break ; +/* +* The endpoint is disabled, let the dwc3_remove_requests() +* handle the cleanup. +*/ +if (!dep->endpoint.desc) +break ; } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 26/339 usb: dwc3: pci: Fix pm_runtime_get_sync() error checking
In reply to Greg Kroah-HartmanFrom: Zheng Yongjun <[email protected]>
[ Upstream commit a03e2ddab8e735e2cc315609b297b300e9cc60d2 ]
If the device is already in a runtime PM enabled state pm_runtime_get_sync() will return 1, so a test for negative value should be used to check for errors.
--- drivers/usb/dwc3/dwc3-pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/dwc3/dwc3-pci.c +1 -1
@@ -288,7 +288,7 @@ static void dwc3_pci_resume_work(struct work_struct *work)int ret; ret =pm_runtime_get_sync (&dwc3->dev); -if (ret) { +if (ret <0 ) {pm_runtime_put_sync_autosuspend (&dwc3->dev);return ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 27/339 scripts/get_abi: Fix wrong script file name in the help message
In reply to Greg Kroah-HartmanFrom: SeongJae Park <[email protected]>
[ Upstream commit 5b5bfecaa333fb6a0cce1bfc4852a622dacfed1d ]
The help message of 'get_abi.pl' is mistakenly saying it's 'abi_book.pl'. This commit fixes the wrong name in the help message.
--- scripts/get_abi.pl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
scripts/get_abi.pl +2 -2
@@ -981,11 +981,11 @@ __END__ =head1 NAME -abi_book.pl - parse the Linux ABI files and produce a ReST book. +get_abi.pl - parse the Linux ABI files and produce a ReST book. =head1 SYNOPSIS -B<abi_book.pl> [--debug <level>] [--enable-lineno] [--man] [--help] +B<get_abi.pl> [--debug <level>] [--enable-lineno] [--man] [--help] [--(no-)rst-source] [--dir=<dir>] [--show-hints] [--search-string <regex>] <COMMAND> [<ARGUMENT>]
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 28/339 misc: fastrpc: fix an incorrect NULL check on list iterator
In reply to Greg Kroah-HartmanFrom: Xiaomeng Tong <[email protected]>
[ Upstream commit 5ac11fe03a0a83042d1a040dbce4fa2fb5521e23 ]
The bug is here:
if (!buf) {The list iterator value 'buf' will *always* be set and non-NULL by list_for_each_entry(), so it is incorrect to assume that the iterator value will be NULL if the list is empty (in this case, the check 'if (!buf) {' will always be false and never exit expectly).
To fix the bug, use a new variable 'iter' as the list iterator, while use the original variable 'buf' as a dedicated pointer to point to the found element.
--- drivers/misc/fastrpc.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/misc/fastrpc.c +5 -4
@@ -1606,17 +1606,18 @@ static int fastrpc_req_munmap_impl(struct fastrpc_user *fl, struct fastrpc_req_munmap *req) {struct fastrpc_invoke_args args[1 ] = { [0 ] = {0 } }; -struct fastrpc_buf *buf, *b; +struct fastrpc_buf *buf =NULL , *iter, *b;struct fastrpc_munmap_req_msg req_msg;struct device *dev = fl->sctx->dev;int err;u32 sc;spin_lock (&fl->lock); -list_for_each_entry_safe (buf, b, &fl->mmaps, node) { -if ((buf->raddr == req->vaddrout) && (buf->size == req->size)) +list_for_each_entry_safe (iter, b, &fl->mmaps, node) { +if ((iter->raddr == req->vaddrout) && (iter->size == req->size)) { + buf = iter;break ; - buf =NULL ; + } }spin_unlock (&fl->lock);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 29/339 firmware: stratix10-svc: fix a missing check on list iterator
In reply to Greg Kroah-HartmanFrom: Xiaomeng Tong <[email protected]>
[ Upstream commit 5a0793ac66ac0e254d292f129a4d6c526f9f2aff ]
The bug is here:
pmem->vaddr = NULL;
The list iterator 'pmem' will point to a bogus position containing HEAD if the list is empty or no element is found. This case must be checked before any use of the iterator, otherwise it will lead to a invalid memory access.
To fix this bug, just gen_pool_free/set NULL/list_del() and return when found, otherwise list_del HEAD and return;
--- drivers/firmware/stratix10-svc.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/firmware/stratix10-svc.c +6 -6
@@ -948,17 +948,17 @@ EXPORT_SYMBOL_GPL(stratix10_svc_allocate_memory);void stratix10_svc_free_memory (struct stratix10_svc_chan *chan,void *kaddr) {struct stratix10_svc_data_mem *pmem; -size_t size =0 ;list_for_each_entry (pmem, &svc_data_mem, node)if (pmem->vaddr == kaddr) { - size = pmem->size; -break ; +gen_pool_free (chan->ctrl->genpool, + (unsigned long )kaddr, pmem->size); + pmem->vaddr =NULL ; +list_del (&pmem->node); +return ; } -gen_pool_free (chan->ctrl->genpool, (unsigned long )kaddr, size); - pmem->vaddr =NULL ; -list_del (&pmem->node); +list_del (&svc_data_mem); }EXPORT_SYMBOL_GPL (stratix10_svc_free_memory);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 30/339 usb: typec: mux: Check dev_set_name() return value
In reply to Greg Kroah-HartmanFrom: Bjorn Andersson <[email protected]>
[ Upstream commit b9fa0292490db39d6542f514117333d366ec0011 ]
It's possible that dev_set_name() returns -ENOMEM, catch and handle this.
--- drivers/usb/typec/mux.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/usb/typec/mux.c +10 -4
@@ -131,8 +131,11 @@ typec_switch_register(struct device *parent, sw->dev.class = &typec_mux_class; sw->dev.type = &typec_switch_dev_type; sw->dev.driver_data = desc->drvdata; -dev_set_name (&sw->dev,"%s-switch" , - desc->name ? desc->name :dev_name (parent)); + ret =dev_set_name (&sw->dev,"%s-switch" , desc->name ? desc->name :dev_name (parent)); +if (ret) { +put_device (&sw->dev); +return ERR_PTR (ret); + } ret =device_add (&sw->dev);if (ret) {
@@ -338,8 +341,11 @@ typec_mux_register(struct device *parent, const struct typec_mux_desc *desc) mux->dev.class = &typec_mux_class; mux->dev.type = &typec_mux_dev_type; mux->dev.driver_data = desc->drvdata; -dev_set_name (&mux->dev,"%s-mux" , - desc->name ? desc->name :dev_name (parent)); + ret =dev_set_name (&mux->dev,"%s-mux" , desc->name ? desc->name :dev_name (parent)); +if (ret) { +put_device (&mux->dev); +return ERR_PTR (ret); + } ret =device_add (&mux->dev);if (ret) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 31/339 rpmsg: virtio: Fix possible double free in rpmsg_probe()
In reply to Greg Kroah-HartmanFrom: Hangyu Hua <[email protected]>
[ Upstream commit c2eecefec5df1306eafce28ccdf1ca159a552ecc ]
vch will be free in virtio_rpmsg_release_device() when rpmsg_ns_register_device() fails. There is no need to call kfree() again.
Fix this by changing error path from free_vch to free_ctrldev.
--- drivers/rpmsg/virtio_rpmsg_bus.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/rpmsg/virtio_rpmsg_bus.c +2 -3
@@ -973,7 +973,8 @@ static int rpmsg_probe(struct virtio_device *vdev) err =rpmsg_ns_register_device (rpdev_ns);if (err) - goto free_vch; +/* vch will be free in virtio_rpmsg_release_device() */ + goto free_ctrldev; }/*
@@ -997,8 +998,6 @@ static int rpmsg_probe(struct virtio_device *vdev)return 0 ; -free_vch: -kfree (vch); free_ctrldev:rpmsg_virtio_del_ctrl_dev (rpdev_ctrl); free_coherent:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 32/339 rpmsg: virtio: Fix possible double free in rpmsg_virtio_add_ctrl_dev()
In reply to Greg Kroah-HartmanFrom: Hangyu Hua <[email protected]>
[ Upstream commit 1680939e9ecf7764fba8689cfb3429c2fe2bb23c ]
vch will be free in virtio_rpmsg_release_device() when rpmsg_ctrldev_register_device() fails. There is no need to call kfree() again.
--- drivers/rpmsg/virtio_rpmsg_bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/rpmsg/virtio_rpmsg_bus.c +1 -1
@@ -851,7 +851,7 @@ static struct rpmsg_device *rpmsg_virtio_add_ctrl_dev(struct virtio_device *vdev err =rpmsg_ctrldev_register_device (rpdev_ctrl);if (err) { -kfree (vch); +/* vch will be free in virtio_rpmsg_release_device() */ return ERR_PTR (err); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 33/339 rpmsg: virtio: Fix the unregistration of the device rpmsg_ctrl
In reply to Greg Kroah-HartmanFrom: Arnaud Pouliquen <[email protected]>
[ Upstream commit df191796985922488e4e6b64f7bd79c3934412f2 ]
Unregister the rpmsg_ctrl device instead of just freeing the the virtio_rpmsg_channel structure.
This will properly unregister the device and call virtio_rpmsg_release_device() that frees the structure.
--- drivers/rpmsg/virtio_rpmsg_bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/rpmsg/virtio_rpmsg_bus.c +1 -1
@@ -862,7 +862,7 @@ static void rpmsg_virtio_del_ctrl_dev(struct rpmsg_device *rpdev_ctrl) {if (!rpdev_ctrl)return ; -kfree (to_virtio_rpmsg_channel (rpdev_ctrl)); +device_unregister (&rpdev_ctrl->dev); }static int rpmsg_probe (struct virtio_device *vdev)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 34/339 iio: adc: stmpe-adc: Fix wait_for_completion_timeout return value check
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit d345b23200bcdbd2bd3582213d738c258b77718f ]
wait_for_completion_timeout() returns unsigned long not long. it returns 0 if timed out, and positive if completed. The check for <= 0 is ambiguous and should be == 0 here indicating timeout which is the only error case
--- drivers/iio/adc/stmpe-adc.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/iio/adc/stmpe-adc.c +4 -4
@@ -61,7 +61,7 @@ struct stmpe_adc {static int stmpe_read_voltage (struct stmpe_adc *info,struct iio_chan_spec const *chan,int *val) { -long ret; +unsigned long ret;mutex_lock (&info->lock);
@@ -79,7 +79,7 @@ static int stmpe_read_voltage(struct stmpe_adc *info, ret =wait_for_completion_timeout (&info->completion,STMPE_ADC_TIMEOUT ); -if (ret <=0 ) { +if (ret ==0 ) {stmpe_reg_write (info->stmpe,STMPE_REG_ADC_INT_STA ,STMPE_ADC_CH (info->channel));mutex_unlock (&info->lock);
@@ -96,7 +96,7 @@ static int stmpe_read_voltage(struct stmpe_adc *info,static int stmpe_read_temp (struct stmpe_adc *info,struct iio_chan_spec const *chan,int *val) { -long ret; +unsigned long ret;mutex_lock (&info->lock);
@@ -114,7 +114,7 @@ static int stmpe_read_temp(struct stmpe_adc *info, ret =wait_for_completion_timeout (&info->completion,STMPE_ADC_TIMEOUT ); -if (ret <=0 ) { +if (ret ==0 ) {mutex_unlock (&info->lock);return -ETIMEDOUT ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 35/339 iio: proximity: vl53l0x: Fix return value check of wait_for_completion_timeout
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 50f2959113cb6756ffd73c4fedc712cf2661f711 ]
wait_for_completion_timeout() returns unsigned long not int. It returns 0 if timed out, and positive if completed. The check for <= 0 is ambiguous and should be == 0 here indicating timeout which is the only error case.
--- drivers/iio/proximity/vl53l0x-i2c.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/iio/proximity/vl53l0x-i2c.c +3 -4
@@ -104,6 +104,7 @@ static int vl53l0x_read_proximity(struct vl53l0x_data *data,u16 tries =20 ;u8 buffer[12 ];int ret; +unsigned long time_left; ret =i2c_smbus_write_byte_data (client,VL_REG_SYSRANGE_START ,1 );if (ret <0 )
@@ -112,10 +113,8 @@ static int vl53l0x_read_proximity(struct vl53l0x_data *data,if (data->client->irq) {reinit_completion (&data->completion); - ret =wait_for_completion_timeout (&data->completion,HZ /10 ); -if (ret <0 ) -return ret; -else if (ret ==0 ) + time_left =wait_for_completion_timeout (&data->completion,HZ /10 ); +if (time_left ==0 )return -ETIMEDOUT ;vl53l0x_clear_irq (data);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 36/339 iio: adc: sc27xx: fix read big scale voltage not right
In reply to Greg Kroah-HartmanFrom: Cixi Geng <[email protected]>
[ Upstream commit ad930a75613282400179361e220e58b87386b8c7 ]
Fix wrong configuration value of SC27XX_ADC_SCALE_MASK and SC27XX_ADC_SCALE_SHIFT by spec documetation.
--- drivers/iio/adc/sc27xx_adc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iio/adc/sc27xx_adc.c +2 -2
@@ -36,8 +36,8 @@/* Bits and mask definition for SC27XX_ADC_CH_CFG register */ #define SC27XX_ADC_CHN_ID_MASK GENMASK(4, 0) -#define SC27XX_ADC_SCALE_MASK GENMASK(10, 8) -#define SC27XX_ADC_SCALE_SHIFT 8 +#define SC27XX_ADC_SCALE_MASK GENMASK(10, 9) +#define SC27XX_ADC_SCALE_SHIFT 9/* Bits definitions for SC27XX_ADC_INT_EN registers */ #define SC27XX_ADC_IRQ_EN BIT(0)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 37/339 iio: adc: sc27xx: Fine tune the scale calibration values
In reply to Greg Kroah-HartmanFrom: Cixi Geng <[email protected]>
[ Upstream commit 5a7a184b11c6910f47600ff5cbbee34168f701a8 ]
Small adjustment the scale calibration value for the sc2731, use new name sc2731_[big|small]_scale_graph_calib, and remove the origin [big|small]_scale_graph_calib struct for unused.
--- drivers/iio/adc/sc27xx_adc.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/iio/adc/sc27xx_adc.c +8 -8
@@ -103,14 +103,14 @@ static struct sc27xx_adc_linear_graph small_scale_graph = { 100, 341, }; -static const struct sc27xx_adc_linear_graph big_scale_graph_calib = { -4200 ,856 , -3600 ,733 , +static const struct sc27xx_adc_linear_graph sc2731_big_scale_graph_calib = { +4200 ,850 , +3600 ,728 , }; -static const struct sc27xx_adc_linear_graph small_scale_graph_calib = { -1000 ,833 , -100 ,80 , +static const struct sc27xx_adc_linear_graph sc2731_small_scale_graph_calib = { +1000 ,838 , +100 ,84 , };static int sc27xx_adc_get_calib_data (u32 calib_data,int calib_adc)
@@ -130,11 +130,11 @@ static int sc27xx_adc_scale_calibration(struct sc27xx_adc_data *data,size_t len;if (big_scale) { - calib_graph = &big_scale_graph_calib; + calib_graph = &sc2731_big_scale_graph_calib; graph = &big_scale_graph; cell_name ="big_scale_calib" ; }else { - calib_graph = &small_scale_graph_calib; + calib_graph = &sc2731_small_scale_graph_calib; graph = &small_scale_graph; cell_name ="small_scale_calib" ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 38/339 rpmsg: qcom_smd: Fix returning 0 if irq_of_parse_and_map() fails
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 59d6f72f6f9c92fec8757d9e29527da828e9281f ]
irq_of_parse_and_map() returns 0 on failure, so this should not be passed further as error return code.
--- drivers/rpmsg/qcom_smd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/rpmsg/qcom_smd.c +1 -1
@@ -1409,7 +1409,7 @@ static int qcom_smd_parse_edge(struct device *dev, irq =irq_of_parse_and_map (node,0 );if (!irq) {dev_err (dev,"required smd interrupt missing\n" ); - ret = irq; + ret = -EINVAL ; goto put_node; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 39/339 misc/pvpanic: Convert regular spinlock into trylock on panic path
In reply to Greg Kroah-HartmanFrom: Guilherme G. Piccoli <[email protected]>
[ Upstream commit e918c10265ef2bc82ce8a6fed6d8123d09ec1db3 ]
The pvpanic driver relies on panic notifiers to execute a callback on panic event. Such function is executed in atomic context - the panic function disables local IRQs, preemption and all other CPUs that aren't running the panic code.
With that said, it's dangerous to use regular spinlocks in such path, as introduced by commit b3c0f8774668 ("misc/pvpanic: probe multiple instances"). This patch fixes that by replacing regular spinlocks with the trylock safer approach.
It also fixes an old comment (about a long gone framebuffer code) and the notifier priority - we should execute hypervisor notifiers early, deferring this way the panic action to the hypervisor, as expected by the users that are setting up pvpanic.
--- drivers/misc/pvpanic/pvpanic.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/misc/pvpanic/pvpanic.c +8 -2
@@ -34,7 +34,9 @@ pvpanic_send_event(unsigned int event) {struct pvpanic_instance *pi_cur; -spin_lock (&pvpanic_lock); +if (!spin_trylock (&pvpanic_lock)) +return ; +list_for_each_entry (pi_cur, &pvpanic_list, list) {if (event & pi_cur->capability & pi_cur->events)iowrite8 (event, pi_cur->base);
@@ -55,9 +57,13 @@ pvpanic_panic_notify(struct notifier_block *nb, unsigned long code, void *unusedreturn NOTIFY_DONE ; } +/* +* Call our notifier very early on panic, deferring the +* action taken to the hypervisor. +*/ static struct notifier_block pvpanic_panic_nb = { .notifier_call = pvpanic_panic_notify, - .priority =1 ,/* let this called before broken drm_fb_helper() */ + .priority =INT_MAX , };static void pvpanic_remove (void *param)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 40/339 phy: qcom-qmp: fix pipe-clock imbalance on power-on failure
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
[ Upstream commit 5e73b2d9867998278479ccc065a8a8227a5513ef ]
Make sure to disable the pipe clock also if ufs-reset deassertion fails during power on.
Note that the ufs-reset is asserted in qcom_qmp_phy_com_exit().
--- drivers/phy/qualcomm/phy-qcom-qmp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/phy/qualcomm/phy-qcom-qmp.c +1 -1
@@ -5246,7 +5246,7 @@ static int qcom_qmp_phy_power_on(struct phy *phy) ret =reset_control_deassert (qmp->ufs_reset);if (ret) - goto err_lane_rst; + goto err_pcs_ready;qcom_qmp_phy_configure (pcs_misc, cfg->regs, cfg->pcs_misc_tbl, cfg->pcs_misc_tbl_num);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 41/339 power: supply: core: Initialize struct to zero
In reply to Greg Kroah-HartmanFrom: Linus Walleij <[email protected]>
[ Upstream commit e56a4be2843c95c08cf8421dc1f8e880cafbaf91 ]
As we rely on pointers in the battery info to be zero-initialized such as in the helper function power_supply_supports_vbat2ri() we certainly need to allocate the struct power_supply_battery_info with kzalloc() as well. Else this happens:
Unable to handle kernel paging request at virtual address 00280000
(...)
PC is at power_supply_vbat2ri+0x50/0x12c
LR is at ab8500_fg_battery_resistance+0x34/0x108
--- drivers/power/supply/power_supply_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/power/supply/power_supply_core.c +1 -1
@@ -616,7 +616,7 @@ int power_supply_get_battery_info(struct power_supply *psy, goto out_put_node; } - info =devm_kmalloc (&psy->dev,sizeof (*info),GFP_KERNEL ); + info =devm_kzalloc (&psy->dev,sizeof (*info),GFP_KERNEL );if (!info) { err = -ENOMEM ; goto out_put_node;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 42/339 power: supply: axp288_fuel_gauge: Fix battery reporting on the One Mix 1
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 34f243e9fb5ace1ca760c72e366247eaeff430c0 ]
Commit 3a06b912a5ce ("power: supply: axp288_fuel_gauge: Make "T3 MRD" no_battery_list DMI entry more generic") added a generic no-battery DMI match for many mini-PCs / HDMI-sticks which use "T3 MRD" as their DMI board-name.
It turns out that the One Mix 1 mini laptop also uses "T3 MRD" for its DMI boardname and it also has its chassis-type wrongly set to a value of "3" (desktop). This was causing the axp288_fuel_gauge driver to disable battery reporting because this matches the no-battery DMI list entry for generic "T3 MRD" mini-PCs.
Change the no-battery DMI list into a quirks DMI list and add a specific match for the One Mix 1 mini laptop before the generic "T3 MRD" no-battery quirk entry to fix this.
--- drivers/power/supply/axp288_fuel_gauge.c | 40 +++++++++++++++++++++--- 1 file changed, 36 insertions(+), 4 deletions(-)
drivers/power/supply/axp288_fuel_gauge.c +36 -4
@@ -90,6 +90,8 @@#define AXP288_REG_UPDATE_INTERVAL (60 * HZ)#define AXP288_FG_INTR_NUM 6 +#define AXP288_QUIRK_NO_BATTERY BIT(0) +static bool no_current_sense_res;module_param (no_current_sense_res, bool,0444 );MODULE_PARM_DESC (no_current_sense_res,"No (or broken) current sense resistor" );
@@ -524,7 +526,7 @@ static struct power_supply_desc fuel_gauge_desc = {* detection reports one despite it not being there. * Please keep this listed sorted alphabetically. */ -static const struct dmi_system_id axp288_no_battery_list[] = { +static const struct dmi_system_id axp288_quirks[] = { {/* ACEPC T8 Cherry Trail Z8350 mini PC */ .matches = {
@@ -534,6 +536,7 @@ static const struct dmi_system_id axp288_no_battery_list[] = {/* also match on somewhat unique bios-version */ DMI_EXACT_MATCH(DMI_BIOS_VERSION, "1.000"), }, + .driver_data = (void *)AXP288_QUIRK_NO_BATTERY, }, {/* ACEPC T11 Cherry Trail Z8350 mini PC */
@@ -544,6 +547,7 @@ static const struct dmi_system_id axp288_no_battery_list[] = {/* also match on somewhat unique bios-version */ DMI_EXACT_MATCH(DMI_BIOS_VERSION, "1.000"), }, + .driver_data = (void *)AXP288_QUIRK_NO_BATTERY, }, {/* Intel Cherry Trail Compute Stick, Windows version */
@@ -551,6 +555,7 @@ static const struct dmi_system_id axp288_no_battery_list[] = {DMI_MATCH (DMI_SYS_VENDOR ,"Intel" ), DMI_MATCH(DMI_PRODUCT_NAME, "STK1AW32SC"), }, + .driver_data = (void *)AXP288_QUIRK_NO_BATTERY, }, {/* Intel Cherry Trail Compute Stick, version without an OS */
@@ -558,34 +563,55 @@ static const struct dmi_system_id axp288_no_battery_list[] = { DMI_MATCH(DMI_SYS_VENDOR, "Intel"), DMI_MATCH(DMI_PRODUCT_NAME, "STK1A32SC"), }, + .driver_data = (void *)AXP288_QUIRK_NO_BATTERY, }, { /* Meegopad T02 */ .matches = { DMI_MATCH(DMI_PRODUCT_NAME, "MEEGOPAD T02"), }, + .driver_data = (void *)AXP288_QUIRK_NO_BATTERY, }, { /* Mele PCG03 Mini PC */ .matches = { DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Mini PC"), DMI_EXACT_MATCH(DMI_BOARD_NAME, "Mini PC"), }, + .driver_data = (void *)AXP288_QUIRK_NO_BATTERY, }, { /* Minix Neo Z83-4 mini PC */ .matches = { DMI_MATCH(DMI_SYS_VENDOR, "MINIX"), DMI_MATCH(DMI_PRODUCT_NAME, "Z83-4"), - } + }, + .driver_data = (void *)AXP288_QUIRK_NO_BATTERY, }, { - /* Various Ace PC/Meegopad/MinisForum/Wintel Mini-PCs/HDMI-sticks */ + /* + * One Mix 1, this uses the "T3 MRD" boardname used by + * generic mini PCs, but it is a mini laptop so it does + * actually have a battery! + */ + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "T3 MRD"), + DMI_MATCH(DMI_BIOS_DATE, "06/14/2018"), + }, + .driver_data = NULL, + }, + { + /* + * Various Ace PC/Meegopad/MinisForum/Wintel Mini-PCs/HDMI-sticks + * This entry must be last because it is generic, this allows + * adding more specifuc quirks overriding this generic entry. + */ .matches = { DMI_MATCH(DMI_BOARD_NAME, "T3 MRD"), DMI_MATCH(DMI_CHASSIS_TYPE, "3"), DMI_MATCH(DMI_BIOS_VENDOR, "American Megatrends Inc."), DMI_MATCH(DMI_BIOS_VERSION, "5.11"), }, + .driver_data = (void *)AXP288_QUIRK_NO_BATTERY, }, {} };
@@ -665,7 +691,9 @@ static int axp288_fuel_gauge_probe(struct platform_device *pdev) [BAT_D_CURR] = "axp288-chrg-d-curr", [BAT_VOLT] = "axp288-batt-volt", }; +const struct dmi_system_id *dmi_id;struct device *dev = &pdev->dev; +unsigned long quirks =0 ;int i, pirq, ret;/*
@@ -675,7 +703,11 @@ static int axp288_fuel_gauge_probe(struct platform_device *pdev)if (!acpi_quirk_skip_acpi_ac_and_battery ())return -ENODEV ; -if (dmi_check_system (axp288_no_battery_list)) + dmi_id =dmi_first_match (axp288_quirks); +if (dmi_id) + quirks = (unsigned long )dmi_id->driver_data; + +if (quirks &AXP288_QUIRK_NO_BATTERY )return -ENODEV ; info =devm_kzalloc (dev,sizeof (*info),GFP_KERNEL );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 43/339 power: supply: axp288_fuel_gauge: Drop BIOS version check from "T3 MRD" DMI quirk
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit f61509a6f0b70f5bedea34efaf8065621689bd7a ]
Some "T3 MRD" mini-PCs / HDMI-sticks without a battery use a different value then "5.11" for their DMI BIOS version field.
Drop the BIOS version check so that the no-battery "T3 MRD" DMI quirk applies to these too.
--- drivers/power/supply/axp288_fuel_gauge.c | 1 - 1 file changed, 1 deletion(-)
drivers/power/supply/axp288_fuel_gauge.c +0 -1
@@ -609,7 +609,6 @@ static const struct dmi_system_id axp288_quirks[] = { DMI_MATCH(DMI_BOARD_NAME, "T3 MRD"), DMI_MATCH(DMI_CHASSIS_TYPE, "3"), DMI_MATCH(DMI_BIOS_VENDOR, "American Megatrends Inc."), - DMI_MATCH(DMI_BIOS_VERSION, "5.11"), }, .driver_data = (void *)AXP288_QUIRK_NO_BATTERY, },
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 44/339 power: supply: ab8500_fg: Allocate wq in probe
In reply to Greg Kroah-HartmanFrom: Linus Walleij <[email protected]>
[ Upstream commit 010ddb813f3554cbbf8bd13b731452236a2c8017 ]
The workqueue is allocated in bind() but all interrupts are registered in probe().
Some interrupts put work on the workqueue, which can have bad side effects.
Allocate the workqueue in probe() instead, destroy it in .remove() and make unbind() simply flush the workqueue.
--- drivers/power/supply/ab8500_fg.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
drivers/power/supply/ab8500_fg.c +10 -9
@@ -3037,13 +3037,6 @@ static int ab8500_fg_bind(struct device *dev, struct device *master, {struct ab8500_fg *di =dev_get_drvdata (dev); -/* Create a work queue for running the FG algorithm */ - di->fg_wq =alloc_ordered_workqueue ("ab8500_fg_wq" ,WQ_MEM_RECLAIM ); -if (di->fg_wq ==NULL ) { -dev_err (dev,"failed to create work queue\n" ); -return -ENOMEM ; - } - di->bat_cap.max_mah_design = di->bm->bi->charge_full_design_uah; di->bat_cap.max_mah = di->bat_cap.max_mah_design; di->vbat_nom_uv = di->bm->bi->voltage_max_design_uv;
@@ -3067,8 +3060,7 @@ static void ab8500_fg_unbind(struct device *dev, struct device *master,if (ret)dev_err (dev,"failed to disable coulomb counter\n" ); -destroy_workqueue (di->fg_wq); -flush_scheduled_work (); +flush_workqueue (di->fg_wq); }static const struct component_ops ab8500_fg_component_ops = {
@@ -3117,6 +3109,13 @@ static int ab8500_fg_probe(struct platform_device *pdev)ab8500_fg_charge_state_to (di,AB8500_FG_CHARGE_INIT );ab8500_fg_discharge_state_to (di,AB8500_FG_DISCHARGE_INIT ); +/* Create a work queue for running the FG algorithm */ + di->fg_wq =alloc_ordered_workqueue ("ab8500_fg_wq" ,WQ_MEM_RECLAIM ); +if (di->fg_wq ==NULL ) { +dev_err (dev,"failed to create work queue\n" ); +return -ENOMEM ; + } +/* Init work for running the fg algorithm instantly */ INIT_WORK (&di->fg_work, ab8500_fg_instant_work);
@@ -3227,6 +3226,8 @@ static int ab8500_fg_remove(struct platform_device *pdev) {struct ab8500_fg *di =platform_get_drvdata (pdev); +destroy_workqueue (di->fg_wq); +flush_scheduled_work ();component_del (&pdev->dev, &ab8500_fg_component_ops);list_del (&di->node);ab8500_fg_sysfs_exit (di);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 45/339 serial: sifive: Report actual baud base rather than fixed 115200
In reply to Greg Kroah-HartmanFrom: Maciej W. Rozycki <[email protected]>
[ Upstream commit 0a7ff843d507ce2cca2c3b7e169ee56e28133530 ]
The base baud value reported is supposed to be the highest baud rate that can be set for a serial port. The SiFive FU740-C000 SOC's on-chip UART supports baud rates of up to 1/16 of the input clock rate, which is the bus clock `tlclk'[1], often at 130MHz in the case of the HiFive Unmatched board.
However the sifive UART driver reports a fixed value of 115200 instead:
10010000.serial: ttySIF0 at MMIO 0x10010000 (irq = 1, base_baud = 115200) is a SiFive UART v0 10011000.serial: ttySIF1 at MMIO 0x10011000 (irq = 2, base_baud = 115200) is a SiFive UART v0
even though we already support setting higher baud rates, e.g.:
$ tty /dev/ttySIF1 $ stty speed 230400
The baud base value is computed by the serial core by dividing the UART clock recorded in `struct uart_port' by 16, which is also the minimum value of the clock divider supported, so correct the baud base value reported by setting the UART clock recorded to the input clock rate rather than 115200:
10010000.serial: ttySIF0 at MMIO 0x10010000 (irq = 1, base_baud = 8125000) is a SiFive UART v0 10011000.serial: ttySIF1 at MMIO 0x10011000 (irq = 2, base_baud = 8125000) is a SiFive UART v0
[1] "SiFive FU740-C000 Manual", v1p3, SiFive, Inc., August 13, 2021,
Section 16.9 "Baud Rate Divisor Register (div)", pp.143-144
--- drivers/tty/serial/sifive.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/sifive.c +1 -1
@@ -998,7 +998,7 @@ static int sifive_serial_probe(struct platform_device *pdev)/* Set up clock divider */ ssp->clkin_rate =clk_get_rate (ssp->clk); ssp->baud_rate =SIFIVE_DEFAULT_BAUD_RATE ; - ssp->port.uartclk = ssp->baud_rate *16 ; + ssp->port.uartclk = ssp->clkin_rate;__ssp_update_div (ssp);platform_set_drvdata (pdev, ssp);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 46/339 export: fix string handling of namespace in EXPORT_SYMBOL_NS
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
[ Upstream commit d143b9db8069f0e2a0fa34484e806a55a0dd4855 ]
Commit c3a6cf19e695 ("export: avoid code duplication in include/linux/export.h") broke the ability for a defined string to be used as a namespace value. Fix this up by using stringify to properly encode the namespace name.
--- include/linux/export.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
include/linux/export.h +4 -3
@@ -2,6 +2,8 @@#ifndef _LINUX_EXPORT_H#define _LINUX_EXPORT_H +#include <linux/stringify.h> +/* * Export symbols from the kernel to modules. Forked from module.h * to reduce the amount of pointless cruft we feed to gcc when only
@@ -154,7 +156,6 @@ struct kernel_symbol {#endif /* CONFIG_MODULES */ #ifdef DEFAULT_SYMBOL_NAMESPACE -#include <linux/stringify.h> #define _EXPORT_SYMBOL (sym, sec) __EXPORT_SYMBOL(sym, sec, __stringify(DEFAULT_SYMBOL_NAMESPACE))#else #define _EXPORT_SYMBOL (sym, sec) __EXPORT_SYMBOL(sym, sec, "")
@@ -162,8 +163,8 @@ struct kernel_symbol {#define EXPORT_SYMBOL (sym) _EXPORT_SYMBOL(sym, "")#define EXPORT_SYMBOL_GPL (sym) _EXPORT_SYMBOL(sym, "_gpl") -#define EXPORT_SYMBOL_NS (sym, ns) __EXPORT_SYMBOL(sym, "", #ns) -#define EXPORT_SYMBOL_NS_GPL (sym, ns) __EXPORT_SYMBOL(sym, "_gpl", #ns) +#define EXPORT_SYMBOL_NS (sym, ns) __EXPORT_SYMBOL(sym, "", __stringify(ns)) +#define EXPORT_SYMBOL_NS_GPL (sym, ns) __EXPORT_SYMBOL(sym, "_gpl", __stringify(ns))#endif /* !__ASSEMBLY__ */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 47/339 watchdog: rzg2l_wdt: Fix 32bit overflow issue
In reply to Greg Kroah-HartmanFrom: Biju Das <[email protected]>
[ Upstream commit ea2949df22a533cdf75e4583c00b1ce94cd5a83b ]
The value of timer_cycle_us can be 0 due to 32bit overflow. For eg:- If we assign the counter value "0xfff" for computing maxval.
This patch fixes this issue by appending ULL to 1024, so that it is promoted to 64bit.
This patch also fixes the warning message, 'watchdog: Invalid min and max timeout values, resetting to 0!'.
--- drivers/watchdog/rzg2l_wdt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/watchdog/rzg2l_wdt.c +1 -1
@@ -53,7 +53,7 @@ static void rzg2l_wdt_wait_delay(struct rzg2l_wdt_priv *priv)static u32 rzg2l_wdt_get_cycle_usec (unsigned long cycle,u32 wdttime) { -u64 timer_cycle_us =1024 *1024 * (wdttime +1 ) *MICRO ; +u64 timer_cycle_us =1024 *1024ULL * (wdttime +1 ) *MICRO ;return div64_ul (timer_cycle_us, cycle); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 48/339 watchdog: rzg2l_wdt: Fix Runtime PM usage
In reply to Greg Kroah-HartmanFrom: Biju Das <[email protected]>
[ Upstream commit 95abafe76297fa057de6c3486ef844bd446bdf18 ]
Both rzg2l_wdt_probe() and rzg2l_wdt_start() calls pm_runtime_get() which results in a usage counter imbalance. This patch fixes this issue by removing pm_runtime_get() call from probe.
--- drivers/watchdog/rzg2l_wdt.c | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-)
drivers/watchdog/rzg2l_wdt.c +2 -14
@@ -151,12 +151,11 @@ static const struct watchdog_ops rzg2l_wdt_ops = { .restart = rzg2l_wdt_restart, }; -static void rzg2l_wdt_reset_assert_pm_disable_put (void *data) +static void rzg2l_wdt_reset_assert_pm_disable (void *data) {struct watchdog_device *wdev = data;struct rzg2l_wdt_priv *priv =watchdog_get_drvdata (wdev); -pm_runtime_put (wdev->parent);pm_runtime_disable (wdev->parent);reset_control_assert (priv->rstc); }
@@ -206,11 +205,6 @@ static int rzg2l_wdt_probe(struct platform_device *pdev)reset_control_deassert (priv->rstc);pm_runtime_enable (&pdev->dev); - ret =pm_runtime_resume_and_get (&pdev->dev); -if (ret <0 ) { -dev_err (dev,"pm_runtime_resume_and_get failed ret=%pe" ,ERR_PTR (ret)); - goto out_pm_get; - } priv->wdev.info = &rzg2l_wdt_ident; priv->wdev.ops = &rzg2l_wdt_ops;
@@ -222,7 +216,7 @@ static int rzg2l_wdt_probe(struct platform_device *pdev)watchdog_set_drvdata (&priv->wdev, priv); ret =devm_add_action_or_reset (&pdev->dev, - rzg2l_wdt_reset_assert_pm_disable_put, + rzg2l_wdt_reset_assert_pm_disable, &priv->wdev);if (ret <0 )return ret;
@@ -235,12 +229,6 @@ static int rzg2l_wdt_probe(struct platform_device *pdev)dev_warn (dev,"Specified timeout invalid, using default" );return devm_watchdog_register_device (&pdev->dev, &priv->wdev); - -out_pm_get: -pm_runtime_disable (dev); -reset_control_assert (priv->rstc); - -return ret; }static const struct of_device_id rzg2l_wdt_ids[] = {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 49/339 watchdog: rzg2l_wdt: Fix BUG: Invalid wait context
In reply to Greg Kroah-HartmanFrom: Biju Das <[email protected]>
[ Upstream commit e4cf89596c1f1e33309556699f910ced4abbaf44 ]
This patch fixes the issue 'BUG: Invalid wait context' during restart() callback by using clk_prepare_enable() instead of pm_runtime_get_sync() for turning on the clocks during restart.
This issue is noticed when testing with renesas_defconfig.
[ 42.213802] reboot: Restarting system
[ 42.217860]
[ 42.219364] =============================
[ 42.223368] [ BUG: Invalid wait context ]
[ 42.227372] 5.17.0-rc5-arm64-renesas-00002-g10393723e35e #522 Not tainted
[ 42.234153] -----------------------------
[ 42.238155] systemd-shutdow/1 is trying to lock:
[ 42.242766] ffff00000a650828 (&genpd->mlock){+.+.}-{3:3}, at: genpd_lock_mtx+0x14/0x20
[ 42.250709] other info that might help us debug this:
[ 42.255753] context-{4:4}
[ 42.258368] 2 locks held by systemd-shutdow/1:
[ 42.262806] #0: ffff80000944e1c8 (system_transition_mutex#2){+.+.}-{3:3}, at: __do_sys_reboot+0xd0/0x250
[ 42.272388] #1: ffff8000094c4e40 (rcu_read_lock){....}-{1:2}, at: atomic_notifier_call_chain+0x0/0x150
[ 42.281795] stack backtrace:
[ 42.284672] CPU: 0 PID: 1 Comm: systemd-shutdow Not tainted 5.17.0-rc5-arm64-renesas-00002-g10393723e35e #522
[ 42.294577] Hardware name: Renesas SMARC EVK based on r9a07g044c2 (DT)
[ 42.301096] Call trace:
[ 42.303538] dump_backtrace+0xcc/0xd8
[ 42.307203] show_stack+0x14/0x30
[ 42.310517] dump_stack_lvl+0x88/0xb0
[ 42.314180] dump_stack+0x14/0x2c
[ 42.317492] __lock_acquire+0x1b24/0x1b50
[ 42.321502] lock_acquire+0x120/0x3a8
[ 42.325162] __mutex_lock+0x84/0x8f8
[ 42.328737] mutex_lock_nested+0x30/0x58
[ 42.332658] genpd_lock_mtx+0x14/0x20
[ 42.336319] genpd_runtime_resume+0xc4/0x228
[ 42.340587] __rpm_callback+0x44/0x170
[ 42.344337] rpm_callback+0x64/0x70
[ 42.347824] rpm_resume+0x4e0/0x6b8
[ 42.351310] __pm_runtime_resume+0x50/0x78
[ 42.355404] rzg2l_wdt_restart+0x28/0x68
[ 42.359329] watchdog_restart_notifier+0x1c/0x30
[ 42.363943] atomic_notifier_call_chain+0x94/0x150
[ 42.368732] do_kernel_restart+0x24/0x30
[ 42.372652] machine_restart+0x44/0x70
[ 42.376399] kernel_restart+0x3c/0x60
[ 42.380058] __do_sys_reboot+0x228/0x250
[ 42.383977] __arm64_sys_reboot+0x20/0x28
[ 42.387983] invoke_syscall+0x40/0xf8--- drivers/watchdog/rzg2l_wdt.c | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-)
drivers/watchdog/rzg2l_wdt.c +13 -12
@@ -43,6 +43,8 @@ struct rzg2l_wdt_priv {struct reset_control *rstc;unsigned long osc_clk_rate;unsigned long delay; +struct clk *pclk; +struct clk *osc_clk; };static void rzg2l_wdt_wait_delay (struct rzg2l_wdt_priv *priv)
@@ -118,7 +120,9 @@ static int rzg2l_wdt_restart(struct watchdog_device *wdev,/* Reset the module before we modify any register */ reset_control_reset (priv->rstc); -pm_runtime_get_sync (wdev->parent); + +clk_prepare_enable (priv->pclk); +clk_prepare_enable (priv->osc_clk);/* smallest counter value to reboot soon */ rzg2l_wdt_write (priv,WDTSET_COUNTER_VAL (1 ),WDTSET );
@@ -165,7 +169,6 @@ static int rzg2l_wdt_probe(struct platform_device *pdev)struct device *dev = &pdev->dev;struct rzg2l_wdt_priv *priv;unsigned long pclk_rate; -struct clk *wdt_clk;int ret; priv =devm_kzalloc (dev,sizeof (*priv),GFP_KERNEL );
@@ -177,22 +180,20 @@ static int rzg2l_wdt_probe(struct platform_device *pdev)return PTR_ERR (priv->base);/* Get watchdog main clock */ - wdt_clk =clk_get (&pdev->dev,"oscclk" ); -if (IS_ERR (wdt_clk)) -return dev_err_probe (&pdev->dev,PTR_ERR (wdt_clk),"no oscclk" ); + priv->osc_clk =devm_clk_get (&pdev->dev,"oscclk" ); +if (IS_ERR (priv->osc_clk)) +return dev_err_probe (&pdev->dev,PTR_ERR (priv->osc_clk),"no oscclk" ); - priv->osc_clk_rate =clk_get_rate (wdt_clk); -clk_put (wdt_clk); + priv->osc_clk_rate =clk_get_rate (priv->osc_clk);if (!priv->osc_clk_rate)return dev_err_probe (&pdev->dev, -EINVAL ,"oscclk rate is 0" );/* Get Peripheral clock */ - wdt_clk =clk_get (&pdev->dev,"pclk" ); -if (IS_ERR (wdt_clk)) -return dev_err_probe (&pdev->dev,PTR_ERR (wdt_clk),"no pclk" ); + priv->pclk =devm_clk_get (&pdev->dev,"pclk" ); +if (IS_ERR (priv->pclk)) +return dev_err_probe (&pdev->dev,PTR_ERR (priv->pclk),"no pclk" ); - pclk_rate =clk_get_rate (wdt_clk); -clk_put (wdt_clk); + pclk_rate =clk_get_rate (priv->pclk);if (!pclk_rate)return dev_err_probe (&pdev->dev, -EINVAL ,"pclk rate is 0" );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 50/339 watchdog: rzg2l_wdt: Fix reset control imbalance
In reply to Greg Kroah-HartmanFrom: Biju Das <[email protected]>
[ Upstream commit 33d04d0fdba9fae18c7d58364643d2c606a43dba ]
Both rzg2l_wdt_probe() and rzg2l_wdt_start() calls reset_control_ deassert() which results in a reset control imbalance.
This patch fixes reset control imbalance by removing reset_control_ deassert() from rzg2l_wdt_start() and replaces reset_control_assert with reset_control_reset in rzg2l_wdt_stop() as watchdog module can be stopped only by a module reset. This change will allow us to restart WDT after stop() by configuring WDT timeout and enable registers.
--- drivers/watchdog/rzg2l_wdt.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/watchdog/rzg2l_wdt.c +1 -2
@@ -88,7 +88,6 @@ static int rzg2l_wdt_start(struct watchdog_device *wdev) {struct rzg2l_wdt_priv *priv =watchdog_get_drvdata (wdev); -reset_control_deassert (priv->rstc);pm_runtime_get_sync (wdev->parent);/* Initialize time out */
@@ -108,7 +107,7 @@ static int rzg2l_wdt_stop(struct watchdog_device *wdev)struct rzg2l_wdt_priv *priv =watchdog_get_drvdata (wdev);pm_runtime_put (wdev->parent); -reset_control_assert (priv->rstc); +reset_control_reset (priv->rstc);return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 51/339 soundwire: intel: prevent pm_runtime resume prior to system suspend
In reply to Greg Kroah-HartmanFrom: Pierre-Louis Bossart <[email protected]>
[ Upstream commit 6d9f2dadba698114fed97b224578c5338a36b0d9 ]
commit e38f9ff63e6d ("ACPI: scan: Do not add device IDs from _CID if _HID is not valid") exposes a race condition on a TGL RVP device leading to a timeout.
The detailed analysis shows the RT711 codec driver scheduling a jack detection workqueue while attaching during a spurious pm_runtime resume, and the work function happens to be scheduled after the manager device is suspended.
The direct link between this ACPI patch and a spurious pm_runtime resume is not obvious; the most likely explanation is that a change in the ACPI device linked list management modifies the order in which the pm_runtime device status is checked and exposes a race condition that was probably present for a very long time, but was not identified.
We already have a check in the .prepare stage, where we will resume to full power from specific clock-stop modes. In all other cases, we don't need to resume to full power by default. Adding the SMART_SUSPEND flag prevents the spurious resume from happening.
--- drivers/soundwire/intel.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/soundwire/intel.c +3 -0
@@ -1293,6 +1293,9 @@ static int intel_link_probe(struct auxiliary_device *auxdev,/* use generic bandwidth allocation algorithm */ sdw->cdns.bus.compute_params = sdw_compute_params; +/* avoid resuming from pm_runtime suspend if it's not required */ +dev_pm_set_driver_flags (dev,DPM_FLAG_SMART_SUSPEND ); + ret =sdw_bus_master_add (bus, dev, dev->fwnode);if (ret) {dev_err (dev,"sdw_bus_master_add fail: %d\n" , ret);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 52/339 soundwire: qcom: return error when pm_runtime_get_sync fails
In reply to Greg Kroah-HartmanFrom: Pierre-Louis Bossart <[email protected]>
[ Upstream commit f6ee6c8499226eb158ca30457d346511f5e329ce ]
For some reason there's a missing error return in two places.
--- drivers/soundwire/qcom.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/soundwire/qcom.c +2 -0
@@ -516,6 +516,7 @@ static irqreturn_t qcom_swrm_wake_irq_handler(int irq, void *dev_id)"pm_runtime_get_sync failed in %s, ret %d\n" , __func__, ret);pm_runtime_put_noidle (swrm->dev); +return ret; }if (swrm->wake_irq >0 ) {
@@ -1258,6 +1259,7 @@ static int swrm_reg_show(struct seq_file *s_file, void *data)"pm_runtime_get_sync failed in %s, ret %d\n" , __func__, ret);pm_runtime_put_noidle (swrm->dev); +return ret; }for (reg =0 ; reg <=SWR_MSTR_MAX_REG_ADDR ; reg +=4 ) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 53/339 coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier
In reply to Greg Kroah-HartmanFrom: Guilherme G. Piccoli <[email protected]>
[ Upstream commit 1adff542d67a2ed1120955cb219bfff8a9c53f59 ]
The panic notifier infrastructure executes registered callbacks when a panic event happens - such callbacks are executed in atomic context, with interrupts and preemption disabled in the running CPU and all other CPUs disabled. That said, mutexes in such context are not a good idea.
This patch replaces a regular mutex with a mutex_trylock safer approach; given the nature of the mutex used in the driver, it should be pretty uncommon being unable to acquire such mutex in the panic path, hence no functional change should be observed (and if it is, that would be likely a deadlock with the regular mutex).
--- drivers/hwtracing/coresight/coresight-cpu-debug.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/hwtracing/coresight/coresight-cpu-debug.c +4 -3
@@ -380,9 +380,10 @@ static int debug_notifier_call(struct notifier_block *self,int cpu;struct debug_drvdata *drvdata; -mutex_lock (&debug_lock); +/* Bail out if we can't acquire the mutex or the functionality is off */ +if (!mutex_trylock (&debug_lock)) +return NOTIFY_DONE ; -/* Bail out if the functionality is disabled */ if (!debug_enable) goto skip_dump;
@@ -401,7 +402,7 @@ static int debug_notifier_call(struct notifier_block *self, skip_dump:mutex_unlock (&debug_lock); -return 0 ; +return NOTIFY_DONE ; }static struct notifier_block debug_notifier = {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 54/339 ksmbd: fix reference count leak in smb_check_perm_dacl()
In reply to Greg Kroah-HartmanFrom: Xin Xiong <[email protected]>
[ Upstream commit d21a580dafc69aa04f46e6099616146a536b0724 ]
The issue happens in a specific path in smb_check_perm_dacl(). When "id" and "uid" have the same value, the function simply jumps out of the loop without decrementing the reference count of the object "posix_acls", which is increased by get_acl() earlier. This may result in memory leaks.
Fix it by decreasing the reference count of "posix_acls" before jumping to label "check_access_bits".
--- fs/ksmbd/smbacl.c | 1 + 1 file changed, 1 insertion(+)
fs/ksmbd/smbacl.c +1 -0
@@ -1261,6 +1261,7 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, struct path *path,if (!access_bits) access_bits =SET_MINIMUM_RIGHTS ; +posix_acl_release (posix_acls); goto check_access_bits; } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 55/339 extcon: ptn5150: Add queue work sync before driver release
In reply to Greg Kroah-HartmanFrom: Li Jun <[email protected]>
[ Upstream commit 782cd939cbe0f569197cd1c9b0477ee213167f04 ]
Add device managed action to sync pending queue work, otherwise the queued work may run after the work is destroyed.
--- drivers/extcon/extcon-ptn5150.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/extcon/extcon-ptn5150.c +11 -0
@@ -194,6 +194,13 @@ static int ptn5150_init_dev_type(struct ptn5150_info *info)return 0 ; } +static void ptn5150_work_sync_and_put (void *data) +{ +struct ptn5150_info *info = data; + +cancel_work_sync (&info->irq_work); +} +static int ptn5150_i2c_probe (struct i2c_client *i2c) {struct device *dev = &i2c->dev;
@@ -284,6 +291,10 @@ static int ptn5150_i2c_probe(struct i2c_client *i2c)if (ret)return -EINVAL ; + ret =devm_add_action_or_reset (dev, ptn5150_work_sync_and_put, info); +if (ret) +return ret; +/* * Update current extcon state if for example OTG connection was there * before the probe
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 56/339 dt-bindings: remoteproc: mediatek: Make l1tcm reg exclusive to mt819x
In reply to Greg Kroah-HartmanFrom: Nícolas F. R. A. Prado <[email protected]>
[ Upstream commit 6bbe1065121b8cd3b3e734ef8cd99f142bdab241 ]
Commit ca23ecfdbd44 ("remoteproc/mediatek: support L1TCM") added support for the l1tcm memory region on the MT8192 SCP, adding a new da_to_va callback that handles l1tcm while keeping the old one for back-compatibility with MT8183. However, since the mt8192 compatible was missing from the dt-binding, the accompanying dt-binding commit 503c64cc42f1 ("dt-bindings: remoteproc: mediatek: add L1TCM memory region") mistakenly added this reg as if it were for mt8183. And later it became common to all platforms as their compatibles were added.
Fix the dt-binding so that the l1tcm reg can be present only on the supported platforms: mt8192 and mt8195.
--- .../bindings/remoteproc/mtk,scp.yaml | 44 +++++++++++++------ 1 file changed, 30 insertions(+), 14 deletions(-)
Documentation/devicetree/bindings/remoteproc/mtk,scp.yaml +30 -14
@@ -23,11 +23,13 @@ properties: reg: description: - Should contain the address ranges for memory regions SRAM, CFG, and - L1TCM. + Should contain the address ranges for memory regions SRAM, CFG, and, + on some platforms, L1TCM. + minItems: 2 maxItems: 3 reg-names: + minItems: 2 items: - const: sram - const: cfg
@@ -47,16 +49,30 @@ required: - reg - reg-names -if: - properties: - compatible: - enum: - - mediatek,mt8183-scp - - mediatek,mt8192-scp -then: - required: - - clocks - - clock-names +allOf: + - if: + properties: + compatible: + enum: + - mediatek,mt8183-scp + - mediatek,mt8192-scp + then: + required: + - clocks + - clock-names + + - if: + properties: + compatible: + enum: + - mediatek,mt8183-scp + - mediatek,mt8186-scp + then: + properties: + reg: + maxItems: 2 + reg-names: + maxItems: 2 additionalProperties: type: object
@@ -76,10 +92,10 @@ additionalProperties: examples: - | - #include <dt-bindings/clock/mt8183-clk.h> + #include <dt-bindings/clock/mt8192-clk.h> scp@10500000 { - compatible = "mediatek,mt8183-scp"; + compatible = "mediatek,mt8192-scp"; reg = <0x10500000 0x80000>, <0x10700000 0x8000>, <0x10720000 0xe0000>;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 57/339 soc: rockchip: Fix refcount leak in rockchip_grf_init
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 9b59588d8be91c96bfb0371e912ceb4f16315dbf ]
of_find_matching_node_and_match returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak.
--- drivers/soc/rockchip/grf.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/soc/rockchip/grf.c +2 -0
@@ -148,12 +148,14 @@ static int __init rockchip_grf_init(void)return -ENODEV ;if (!match || !match->data) {pr_err ("%s: missing grf data\n" , __func__); +of_node_put (np);return -EINVAL ; } grf_info = match->data; grf =syscon_node_to_regmap (np); +of_node_put (np);if (IS_ERR (grf)) {pr_err ("%s: could not get grf syscon\n" , __func__);return PTR_ERR (grf);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 58/339 clocksource/drivers/riscv: Events are stopped during CPU suspend
In reply to Greg Kroah-HartmanFrom: Samuel Holland <[email protected]>
[ Upstream commit 232ccac1bd9b5bfe73895f527c08623e7fa0752d ]
Some implementations of the SBI time extension depend on hart-local state (for example, CSRs) that are lost or hardware that is powered down when a CPU is suspended. To be safe, the clockevents driver cannot assume that timer IRQs will be received during CPU suspend.
--- drivers/clocksource/timer-riscv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clocksource/timer-riscv.c +1 -1
@@ -34,7 +34,7 @@ static int riscv_clock_next_event(unsigned long delta,static unsigned int riscv_clock_event_irq; static DEFINE_PER_CPU(struct clock_event_device, riscv_clock_event) = { .name ="riscv_timer_clockevent" , - .features =CLOCK_EVT_FEAT_ONESHOT , + .features =CLOCK_EVT_FEAT_ONESHOT |CLOCK_EVT_FEAT_C3STOP , .rating =100 , .set_next_event = riscv_clock_next_event, };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 59/339 ARM: dts: aspeed: ast2600-evb: Enable RX delay for MAC0/MAC1
In reply to Greg Kroah-HartmanFrom: Howard Chiu <[email protected]>
[ Upstream commit 4d338ee40ba89e508c5d3e1b4af956af7cb5e12e ]
Since mac0/1 and mac2/3 are physically located on different die, they have different properties by nature, which is mac0/1 has smaller delay step.
The property 'phy-mode' on ast2600 mac0 and mac1 is recommended to set to 'rgmii-rxid' which enables the RX interface delay from the PHY chip.
Refer page 45 of SDK User Guide v08.00
https://github.com/AspeedTech-BMC/openbmc/releases/download/v08.00/SDK_User_Guide_v08.00.pdf
--- arch/arm/boot/dts/aspeed-ast2600-evb.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/aspeed-ast2600-evb.dts +2 -2
@@ -103,7 +103,7 @@ &mac0 { status = "okay"; - phy-mode = "rgmii"; + phy-mode = "rgmii-rxid"; phy-handle = <ðphy0>; pinctrl-names = "default";
@@ -114,7 +114,7 @@ &mac1 { status = "okay"; - phy-mode = "rgmii"; + phy-mode = "rgmii-rxid"; phy-handle = <ðphy1>; pinctrl-names = "default";
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 60/339 rtc: mt6397: check return value after calling platform_get_resource()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit d3b43eb505bffb8e4cdf6800c15660c001553fe6 ]
It will cause null-ptr-deref if platform_get_resource() returns NULL, we need check the return value.
--- drivers/rtc/rtc-mt6397.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/rtc/rtc-mt6397.c +2 -0
@@ -269,6 +269,8 @@ static int mtk_rtc_probe(struct platform_device *pdev)return -ENOMEM ; res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); +if (!res) +return -EINVAL ; rtc->addr_base = res->start; rtc->data =of_device_get_match_data (&pdev->dev);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 61/339 rtc: ftrtc010: Fix error handling in ftrtc010_rtc_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit b520cbe5be37b1b9b401c0b6ecbdae32575273db ]
In the error handling path, the clk_prepare_enable() function call should be balanced by a corresponding 'clk_disable_unprepare()' call , as already done in the remove function.
clk_disable_unprepare calls clk_disable() and clk_unprepare(). They will use IS_ERR_OR_NULL to check the argument.
--- drivers/rtc/rtc-ftrtc010.c | 34 ++++++++++++++++++++++++---------- 1 file changed, 24 insertions(+), 10 deletions(-)
drivers/rtc/rtc-ftrtc010.c +24 -10
@@ -137,26 +137,34 @@ static int ftrtc010_rtc_probe(struct platform_device *pdev) ret =clk_prepare_enable (rtc->extclk);if (ret) {dev_err (dev,"failed to enable EXTCLK\n" ); -return ret; + goto err_disable_pclk; } } rtc->rtc_irq =platform_get_irq (pdev,0 ); -if (rtc->rtc_irq <0 ) -return rtc->rtc_irq; +if (rtc->rtc_irq <0 ) { + ret = rtc->rtc_irq; + goto err_disable_extclk; + } res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); -if (!res) -return -ENODEV ; +if (!res) { + ret = -ENODEV ; + goto err_disable_extclk; + } rtc->rtc_base =devm_ioremap (dev, res->start,resource_size (res)); -if (!rtc->rtc_base) -return -ENOMEM ; +if (!rtc->rtc_base) { + ret = -ENOMEM ; + goto err_disable_extclk; + } rtc->rtc_dev =devm_rtc_allocate_device (dev); -if (IS_ERR (rtc->rtc_dev)) -return PTR_ERR (rtc->rtc_dev); +if (IS_ERR (rtc->rtc_dev)) { + ret =PTR_ERR (rtc->rtc_dev); + goto err_disable_extclk; + } rtc->rtc_dev->ops = &ftrtc010_rtc_ops;
@@ -172,9 +180,15 @@ static int ftrtc010_rtc_probe(struct platform_device *pdev) ret =devm_request_irq (dev, rtc->rtc_irq, ftrtc010_rtc_interrupt,IRQF_SHARED , pdev->name, dev);if (unlikely (ret)) -return ret; + goto err_disable_extclk;return devm_rtc_register_device (rtc->rtc_dev); + +err_disable_extclk: +clk_disable_unprepare (rtc->extclk); +err_disable_pclk: +clk_disable_unprepare (rtc->pclk); +return ret; }static int ftrtc010_rtc_remove (struct platform_device *pdev)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 62/339 staging: r8188eu: add check for kzalloc
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit f94b47c6bde624d6c07f43054087607c52054a95 ]
As kzalloc() may return null pointer, it should be better to check the return value and return error if fails in order to avoid dereference of null pointer.
Moreover, the return value of rtw_alloc_hwxmits() should also be dealt with.
--- drivers/staging/r8188eu/core/rtw_xmit.c | 13 +++++++++++-- drivers/staging/r8188eu/include/rtw_xmit.h | 2 +- 2 files changed, 12 insertions(+), 3 deletions(-)
drivers/staging/r8188eu/core/rtw_xmit.c +11 -2
@@ -178,7 +178,12 @@ s32 _rtw_init_xmit_priv(struct xmit_priv *pxmitpriv, struct adapter *padapter) pxmitpriv->free_xmit_extbuf_cnt = num_xmit_extbuf; -rtw_alloc_hwxmits (padapter); + res =rtw_alloc_hwxmits (padapter); +if (res) { + res = _FAIL; + goto exit; + } +rtw_init_hwxmits (pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry);for (i =0 ; i <4 ; i++)
@@ -1474,7 +1479,7 @@ s32 rtw_xmit_classifier(struct adapter *padapter, struct xmit_frame *pxmitframe)return res; } -void rtw_alloc_hwxmits (struct adapter *padapter) +int rtw_alloc_hwxmits (struct adapter *padapter) {struct hw_xmit *hwxmits;struct xmit_priv *pxmitpriv = &padapter->xmitpriv;
@@ -1482,6 +1487,8 @@ void rtw_alloc_hwxmits(struct adapter *padapter) pxmitpriv->hwxmit_entry =HWXMIT_ENTRY ; pxmitpriv->hwxmits =kzalloc (sizeof (struct hw_xmit ) * pxmitpriv->hwxmit_entry,GFP_KERNEL ); +if (!pxmitpriv->hwxmits) +return -ENOMEM ; hwxmits = pxmitpriv->hwxmits;
@@ -1498,6 +1505,8 @@ void rtw_alloc_hwxmits(struct adapter *padapter) hwxmits[3 ] .sta_queue = &pxmitpriv->bk_pending; }else { } + +return 0 ; }void rtw_free_hwxmits (struct adapter *padapter)
drivers/staging/r8188eu/include/rtw_xmit.h +1 -1
@@ -341,7 +341,7 @@ s32 rtw_txframes_sta_ac_pending(struct adapter *padapter,void rtw_init_hwxmits (struct hw_xmit *phwxmit,int entry);s32 _rtw_init_xmit_priv (struct xmit_priv *pxmitpriv,struct adapter *padapter);void _rtw_free_xmit_priv (struct xmit_priv *pxmitpriv); -void rtw_alloc_hwxmits (struct adapter *padapter); +int rtw_alloc_hwxmits (struct adapter *padapter);void rtw_free_hwxmits (struct adapter *padapter);s32 rtw_xmit (struct adapter *padapter,struct sk_buff **pkt);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 63/339 serial: meson: acquire port->lock in startup()
In reply to Greg Kroah-HartmanFrom: John Ogness <[email protected]>
[ Upstream commit 589f892ac8ef244e47c5a00ffd8605daa1eaef8e ]
The uart_ops startup() callback is called without interrupts disabled and without port->lock locked, relatively late during the boot process (from the call path of console_on_rootfs()). If the device is a console, it was already previously registered and could be actively printing messages.
Since the startup() callback is reading/writing registers used by the console write() callback (AML_UART_CONTROL), its access must be synchronized using the port->lock. Currently it is not.
The startup() callback is the only function that explicitly enables interrupts. Without the synchronization, it is possible that interrupts become accidentally permanently disabled.
CPU0 CPU1 meson_serial_console_write meson_uart_startup -------------------------- ------------------
spin_lock(port->lock)
val = readl(AML_UART_CONTROL)uart_console_write()
writel(INT_EN, AML_UART_CONTROL)writel(val, AML_UART_CONTROL)spin_unlock(port->lock)
Add port->lock synchronization to meson_uart_startup() to avoid racing with meson_serial_console_write().
Also add detailed comments to meson_uart_reset() explaining why it is *not* using port->lock synchronization.
--- drivers/tty/serial/meson_uart.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/tty/serial/meson_uart.c +13 -0
@@ -253,6 +253,14 @@ static const char *meson_uart_type(struct uart_port *port)return (port->type ==PORT_MESON ) ?"meson_uart" :NULL ; } +/* +* This function is called only from probe() using a temporary io mapping +* in order to perform a reset before setting up the device. Since the +* temporarily mapped region was successfully requested, there can be no +* console on this port at this time. Hence it is not necessary for this +* function to acquire the port->lock. (Since there is no console on this +* port at this time, the port->lock is not initialized yet.) +*/ static void meson_uart_reset (struct uart_port *port) {u32 val;
@@ -267,9 +275,12 @@ static void meson_uart_reset(struct uart_port *port)static int meson_uart_startup (struct uart_port *port) { +unsigned long flags;u32 val;int ret =0 ; +spin_lock_irqsave (&port->lock, flags); + val =readl (port->membase +AML_UART_CONTROL ); val |=AML_UART_CLEAR_ERR ;writel (val, port->membase +AML_UART_CONTROL );
@@ -285,6 +296,8 @@ static int meson_uart_startup(struct uart_port *port) val = (AML_UART_RECV_IRQ (1 ) |AML_UART_XMIT_IRQ (port->fifosize /2 ));writel (val, port->membase +AML_UART_MISC ); +spin_unlock_irqrestore (&port->lock, flags); + ret =request_irq (port->irq, meson_uart_interrupt,0 , port->name, port);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 64/339 Revert "serial: 8250_mtk: Make sure to select the right FEATURE_SEL"
In reply to Greg Kroah-HartmanFrom: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit f0136f65285bcfb7e8f90d1013723076a35acd51 ]
It was found that some MediaTek SoCs are incompatible with this change. Also, this register was mistakenly understood as it was related to the 16550A register layout selection but, at least on some IPs, if not all, it's related to something else unknown.
This reverts commit 6f81fdded0d024c7d4084d434764f30bca1cd6b1.
--- drivers/tty/serial/8250/8250_mtk.c | 7 ------- 1 file changed, 7 deletions(-)
drivers/tty/serial/8250/8250_mtk.c +0 -7
@@ -54,9 +54,6 @@#define MTK_UART_TX_TRIGGER 1#define MTK_UART_RX_TRIGGER MTK_UART_RX_SIZE -#define MTK_UART_FEATURE_SEL 39/* Feature Selection register */ -#define MTK_UART_FEAT_NEWRMAP BIT(0)/* Use new register map */ -#define MTK_UART_XON1 40/* I/O: Xon character 1 */ #define MTK_UART_XOFF1 42/* I/O: Xoff character 1 */
@@ -575,10 +572,6 @@ static int mtk8250_probe(struct platform_device *pdev) uart.dma = data->dma;#endif -/* Set AP UART new register map */ -writel (MTK_UART_FEAT_NEWRMAP , uart.port.membase + - (MTK_UART_FEATURE_SEL << uart.port.regshift)); -/* Disable Rate Fix function */ writel (0x0 , uart.port.membase + (MTK_UART_RATE_FIX << uart.port.regshift));
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 65/339 serial: 8250_fintek: Check SER_RS485_RTS_* only with RS485
In reply to Greg Kroah-HartmanFrom: Ilpo Järvinen <[email protected]>
[ Upstream commit af0179270977508df6986b51242825d7edd59caf ]
SER_RS485_RTS_ON_SEND and SER_RS485_RTS_AFTER_SEND relate to behavior within RS485 operation. The driver checks if they have the same value which is not possible to realize with the hardware. The check is taken regardless of SER_RS485_ENABLED flag and -EINVAL is returned when the check fails, which creates problems.
This check makes it unnecessarily complicated to turn RS485 mode off as simple zeroed serial_rs485 struct will trigger that equal values check. In addition, the driver itself memsets its rs485 structure to zero when RS485 is disabled but if userspace would try to make an TIOCSRS485 ioctl() call with the very same struct, it would end up failing with -EINVAL which doesn't make much sense.
Resolve the problem by moving the check inside SER_RS485_ENABLED block.
--- drivers/tty/serial/8250/8250_fintek.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/tty/serial/8250/8250_fintek.c +4 -4
@@ -200,12 +200,12 @@ static int fintek_8250_rs485_config(struct uart_port *port,if (!pdata)return -EINVAL ; -/* Hardware do not support same RTS level on send and receive */ -if (!(rs485->flags &SER_RS485_RTS_ON_SEND ) == - !(rs485->flags &SER_RS485_RTS_AFTER_SEND )) -return -EINVAL ;if (rs485->flags &SER_RS485_ENABLED ) { +/* Hardware do not support same RTS level on send and receive */ +if (!(rs485->flags &SER_RS485_RTS_ON_SEND ) == + !(rs485->flags &SER_RS485_RTS_AFTER_SEND )) +return -EINVAL ;memset (rs485->padding,0 ,sizeof (rs485->padding)); config |=RS485_URA ; }else {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 66/339 serial: cpm_uart: Fix build error without CONFIG_SERIAL_CPM_CONSOLE
In reply to Greg Kroah-HartmanFrom: YueHaibing <[email protected]>
[ Upstream commit 0258502f11a4f6036b5f8b34b09027c8a92def3a ]
drivers/tty/serial/cpm_uart/cpm_uart_core.c: In function ‘cpm_uart_init_port’:drivers/tty/serial/cpm_uart/cpm_uart_core.c:1251:7: error: ‘udbg_port’ undeclared (first use in this function); did you mean ‘uart_port’?
if (!udbg_port)
^~~~~~~~~
uart_portcommit d142585bceb3 leave this corner, wrap it with #ifdef block
--- drivers/tty/serial/cpm_uart/cpm_uart_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/cpm_uart/cpm_uart_core.c +1 -1
@@ -1247,7 +1247,7 @@ static int cpm_uart_init_port(struct device_node *np, }#ifdef CONFIG_PPC_EARLY_DEBUG_CPM -#ifdef CONFIG_CONSOLE_POLL +#if defined(CONFIG_CONSOLE_POLL ) && defined(CONFIG_SERIAL_CPM_CONSOLE ) if (!udbg_port)#endif udbg_putc =NULL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 67/339 serial: uartlite: Fix BRKINT clearing
In reply to Greg Kroah-HartmanFrom: Ilpo Järvinen <[email protected]>
[ Upstream commit 3f7fed405c118607d4d42255f2572072db728399 ]
BRKINT is within c_iflag rather than c_cflag.
--- drivers/tty/serial/uartlite.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/tty/serial/uartlite.c +2 -1
@@ -321,7 +321,8 @@ static void ulite_set_termios(struct uart_port *port, struct ktermios *termios,struct uartlite_data *pdata = port->private_data;/* Set termios to what the hardware supports */ - termios->c_cflag &= ~(BRKINT |CSTOPB |PARENB |PARODD |CSIZE ); + termios->c_iflag &= ~BRKINT ; + termios->c_cflag &= ~(CSTOPB |PARENB |PARODD |CSIZE ); termios->c_cflag |= pdata->cflags & (PARENB |PARODD |CSIZE );tty_termios_encode_baud_rate (termios, pdata->baud, pdata->baud);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 68/339 serial: digicolor-usart: Dont allow CS5-6
In reply to Greg Kroah-HartmanFrom: Ilpo Järvinen <[email protected]>
[ Upstream commit fd63031b8c0763addcecdefe0e0c59d49646204e ]
Only CS7 and CS8 seem supported but CSIZE is not sanitized to CS8 in the default: block.
Set CSIZE correctly so that userspace knows the effective value. Incorrect CSIZE also results in miscalculation of the frame bits in tty_get_char_size() or in its predecessor where the roughly the same code is directly within uart_update_timeout().
--- drivers/tty/serial/digicolor-usart.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/tty/serial/digicolor-usart.c +2 -0
@@ -309,6 +309,8 @@ static void digicolor_uart_set_termios(struct uart_port *port,case CS8 :default : config |=UA_CONFIG_CHAR_LEN ; + termios->c_cflag &= ~CSIZE ; + termios->c_cflag |=CS8 ;break ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 69/339 serial: rda-uart: Dont allow CS5-6
In reply to Greg Kroah-HartmanFrom: Ilpo Järvinen <[email protected]>
[ Upstream commit 098333a9c7d12bb3ce44c82f08b4d810c44d31b0 ]
Only CS7 and CS8 are supported but CSIZE is not sanitized after fallthrough from CS5 or CS6 to CS7.
Set CSIZE correctly so that userspace knows the effective value. Incorrect CSIZE also results in miscalculation of the frame bits in tty_get_char_size() or in its predecessor where the roughly the same code is directly within uart_update_timeout().
--- drivers/tty/serial/rda-uart.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/tty/serial/rda-uart.c +2 -0
@@ -262,6 +262,8 @@ static void rda_uart_set_termios(struct uart_port *port, fallthrough;case CS7 : ctrl &= ~RDA_UART_DBITS_8 ; + termios->c_cflag &= ~CSIZE ; + termios->c_cflag |=CS7 ;break ;default : ctrl |=RDA_UART_DBITS_8 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 70/339 serial: txx9: Dont allow CS5-6
In reply to Greg Kroah-HartmanFrom: Ilpo Järvinen <[email protected]>
[ Upstream commit 79ac88655dc0551e3571ad16bdabdbe65d61553e ]
Only CS7 and CS8 are supported but CSIZE is not sanitized with CS5 or CS6 to CS8.
Set CSIZE correctly so that userspace knows the effective value. Incorrect CSIZE also results in miscalculation of the frame bits in tty_get_char_size() or in its predecessor where the roughly the same code is directly within uart_update_timeout().
--- drivers/tty/serial/serial_txx9.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/tty/serial/serial_txx9.c +2 -0
@@ -618,6 +618,8 @@ serial_txx9_set_termios(struct uart_port *up, struct ktermios *termios,case CS6 :/* not supported */ case CS8 : cval |=TXX9_SILCR_UMODE_8BIT ; + termios->c_cflag &= ~CSIZE ; + termios->c_cflag |=CS8 ;break ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 71/339 serial: sh-sci: Dont allow CS5-6
In reply to Greg Kroah-HartmanFrom: Ilpo Järvinen <[email protected]>
[ Upstream commit 9b87162de8be26bf3156460b37deee6399fd0fcb ]
Only CS7 and CS8 seem supported but CSIZE is not sanitized from CS5 or CS6 to CS8.
Set CSIZE correctly so that userspace knows the effective value. Incorrect CSIZE also results in miscalculation of the frame bits in tty_get_char_size() or in its predecessor where the roughly the same code is directly within uart_update_timeout().
--- drivers/tty/serial/sh-sci.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/tty/serial/sh-sci.c +5 -1
@@ -2379,8 +2379,12 @@ static void sci_set_termios(struct uart_port *port, struct ktermios *termios,int best_clk =-1 ;unsigned long flags; -if ((termios->c_cflag &CSIZE ) ==CS7 ) +if ((termios->c_cflag &CSIZE ) ==CS7 ) { smr_val |=SCSMR_CHR ; + }else { + termios->c_cflag &= ~CSIZE ; + termios->c_cflag |=CS8 ; + }if (termios->c_cflag &PARENB ) smr_val |=SCSMR_PE ;if (termios->c_cflag &PARODD )
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 72/339 serial: sifive: Sanitize CSIZE and c_iflag
In reply to Greg Kroah-HartmanFrom: Ilpo Järvinen <[email protected]>
[ Upstream commit c069d2756c01ed36121fae6a42c14fdf1325c71d ]
Only CS8 is supported but CSIZE was not sanitized to CS8.
Set CSIZE correctly so that userspace knows the effective value. Incorrect CSIZE also results in miscalculation of the frame bits in tty_get_char_size() or in its predecessor where the roughly the same code is directly within uart_update_timeout().
Similarly, INPCK, PARMRK, and BRKINT are reported textually unsupported but were not cleared in termios c_iflag which is the machine-readable format.
--- drivers/tty/serial/sifive.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/tty/serial/sifive.c +5 -1
@@ -666,12 +666,16 @@ static void sifive_serial_set_termios(struct uart_port *port,int rate;char nstop; -if ((termios->c_cflag &CSIZE ) !=CS8 ) +if ((termios->c_cflag &CSIZE ) !=CS8 ) {dev_err_once (ssp->port.dev,"only 8-bit words supported\n" ); + termios->c_cflag &= ~CSIZE ; + termios->c_cflag |=CS8 ; + }if (termios->c_iflag & (INPCK |PARMRK ))dev_err_once (ssp->port.dev,"parity checking not supported\n" );if (termios->c_iflag &BRKINT )dev_err_once (ssp->port.dev,"BREAK detection not supported\n" ); + termios->c_iflag &= ~(INPCK |PARMRK |BRKINT );/* Set number of stop bits */ nstop = (termios->c_cflag &CSTOPB ) ?2 :1 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 73/339 serial: st-asc: Sanitize CSIZE and correct PARENB for CS7
In reply to Greg Kroah-HartmanFrom: Ilpo Järvinen <[email protected]>
[ Upstream commit 52bb1cb7118564166b04d52387bd8403632f5190 ]
Only CS7 and CS8 seem supported but CSIZE is not sanitized from CS5 or CS6 to CS8. In addition, ASC_CTL_MODE_7BIT_PAR suggests that CS7 has to have parity, thus add PARENB.
Incorrect CSIZE results in miscalculation of the frame bits in tty_get_char_size() or in its predecessor where the roughly the same code is directly within uart_update_timeout().
--- drivers/tty/serial/st-asc.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/tty/serial/st-asc.c +4 -0
@@ -535,10 +535,14 @@ static void asc_set_termios(struct uart_port *port, struct ktermios *termios,/* set character length */ if ((cflag &CSIZE ) ==CS7 ) { ctrl_val |=ASC_CTL_MODE_7BIT_PAR ; + cflag |=PARENB ; }else { ctrl_val |= (cflag &PARENB ) ?ASC_CTL_MODE_8BIT_PAR :ASC_CTL_MODE_8BIT ; + cflag &= ~CSIZE ; + cflag |=CS8 ; } + termios->c_cflag = cflag;/* set stop bit */ ctrl_val |= (cflag &CSTOPB ) ?ASC_CTL_STOP_2BIT :ASC_CTL_STOP_1BIT ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 74/339 serial: stm32-usart: Correct CSIZE, bits, and parity
In reply to Greg Kroah-HartmanFrom: Ilpo Järvinen <[email protected]>
[ Upstream commit 1deeda8d2877c18bc2b9eeee10dd6d2628852848 ]
Add CSIZE sanitization for unsupported CSIZE configurations. In addition, if parity is asked for but CSx was unsupported, the sensible result is CS8+parity which requires setting USART_CR1_M0 like with 9 bits.
Incorrect CSIZE results in miscalculation of the frame bits in tty_get_char_size() or in its predecessor where the roughly the same code is directly within uart_update_timeout().
--- drivers/tty/serial/stm32-usart.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
drivers/tty/serial/stm32-usart.c +12 -3
@@ -1037,13 +1037,22 @@ static void stm32_usart_set_termios(struct uart_port *port,* CS8 or (CS7 + parity), 8 bits word aka [M1:M0] = 0b00 * M0 and M1 already cleared by cr1 initialization. */ -if (bits ==9 ) +if (bits ==9 ) { cr1 |=USART_CR1_M0 ; -else if ((bits ==7 ) && cfg->has_7bits_data) + }else if ((bits ==7 ) && cfg->has_7bits_data) { cr1 |=USART_CR1_M1 ; -else if (bits !=8 ) + }else if (bits !=8 ) {dev_dbg (port->dev,"Unsupported data bits config: %u bits\n" , bits); + cflag &= ~CSIZE ; + cflag |=CS8 ; + termios->c_cflag = cflag; + bits =8 ; +if (cflag &PARENB ) { + bits++; + cr1 |=USART_CR1_M0 ; + } + } if (ofs->rtor != UNDEF_REG && (stm32_port->rx_ch || (stm32_port->fifoen &&
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 75/339 firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 660ba678f9998aca6db74f2dd912fa5124f0fa31 ]
kobject_init_and_add() takes reference even when it fails. According to the doc of kobject_init_and_add()
If this function returns an error, kobject_put() must be called to properly clean up the memory associated with the object.
Fix this issue by calling kobject_put().
--- drivers/firmware/dmi-sysfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/dmi-sysfs.c +1 -1
@@ -604,7 +604,7 @@ static void __init dmi_sysfs_register_handle(const struct dmi_header *dh, "%d-%d", dh->type, entry->instance);if (*ret) { -kfree (entry); +kobject_put (&entry->kobj);return ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 76/339 bus: ti-sysc: Fix warnings for unbind for serial
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
[ Upstream commit c337125b8834f9719dfda0e40b25eaa266f1b8cf ]
We can get "failed to disable" clock_unprepare warnings on unbind at least for the serial console device if the unbind is done before the device has been idled.
As some devices are using deferred idle, we must check the status for pending idle work to idle the device.
--- drivers/bus/ti-sysc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/bus/ti-sysc.c +3 -1
@@ -3395,7 +3395,9 @@ static int sysc_remove(struct platform_device *pdev)struct sysc *ddata =platform_get_drvdata (pdev);int error; -cancel_delayed_work_sync (&ddata->idle_work); +/* Device can still be enabled, see deferred idle quirk in probe */ +if (cancel_delayed_work_sync (&ddata->idle_work)) +ti_sysc_idle (&ddata->idle_work.work); error =pm_runtime_resume_and_get (ddata->dev);if (error <0 ) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 77/339 driver: base: fix UAF when driver_attach failed
In reply to Greg Kroah-HartmanFrom: Schspa Shi <[email protected]>
[ Upstream commit 310862e574001a97ad02272bac0fd13f75f42a27 ]
When driver_attach(drv); failed, the driver_private will be freed. But it has been added to the bus, which caused a UAF.
To fix it, we need to delete it from the bus when failed.
--- drivers/base/bus.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/base/bus.c +3 -1
@@ -617,7 +617,7 @@ int bus_add_driver(struct device_driver *drv)if (drv->bus->p->drivers_autoprobe) { error =driver_attach (drv);if (error) - goto out_unregister; + goto out_del_list; }module_add_driver (drv->owner, drv);
@@ -644,6 +644,8 @@ int bus_add_driver(struct device_driver *drv)return 0 ; +out_del_list: +klist_del (&priv->knode_bus); out_unregister:kobject_put (&priv->kobj);/* drv->p is freed in driver_release() */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 78/339 driver core: fix deadlock in __device_attach
In reply to Greg Kroah-HartmanFrom: Zhang Wensheng <[email protected]>
[ Upstream commit b232b02bf3c205b13a26dcec08e53baddd8e59ed ]
In __device_attach function, The lock holding logic is as follows:
...__device_attachdevice_lock(dev) // get lock dev
async_schedule_dev(__device_attach_async_helper, dev); // func
async_schedule_node
async_schedule_node_domain(func)
entry = kzalloc(sizeof(struct async_entry), GFP_ATOMIC);
/* when fail or work limit, sync to execute func, but
__device_attach_async_helper will get lock dev as
well, which will lead to A-A deadlock. */
if (!entry || atomic_read(&entry_count) > MAX_WORK) {
func;
else
queue_work_node(node, system_unbound_wq, &entry->work) device_unlock(dev)
As shown above, when it is allowed to do async probes, because of out of memory or work limit, async work is not allowed, to do sync execute instead. it will lead to A-A deadlock because of __device_attach_async_helper getting lock dev.
To fix the deadlock, move the async_schedule_dev outside device_lock, as we can see, in async_schedule_node_domain, the parameter of queue_work_node is system_unbound_wq, so it can accept concurrent operations. which will also not change the code logic, and will not lead to deadlock.
--- drivers/base/dd.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/base/dd.c +4 -1
@@ -941,6 +941,7 @@ static void __device_attach_async_helper(void *_dev, async_cookie_t cookie)static int __device_attach (struct device *dev,bool allow_async) {int ret =0 ; +bool async = false;device_lock (dev);if (dev->p->dead) {
@@ -979,7 +980,7 @@ static int __device_attach(struct device *dev, bool allow_async)*/ dev_dbg (dev,"scheduling asynchronous probe\n" );get_device (dev); -async_schedule_dev (__device_attach_async_helper, dev); + async = true; }else {pm_request_idle (dev); }
@@ -989,6 +990,8 @@ static int __device_attach(struct device *dev, bool allow_async) } out_unlock:device_unlock (dev); +if (async) +async_schedule_dev (__device_attach_async_helper, dev);return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 79/339 watchdog: rti-wdt: Fix pm_runtime_get_sync() error checking
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit b3ac0c58fa8934926360268f3d89ec7680644d7b ]
If the device is already in a runtime PM enabled state pm_runtime_get_sync() will return 1, so a test for negative value should be used to check for errors.
--- drivers/watchdog/rti_wdt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/watchdog/rti_wdt.c +1 -1
@@ -226,7 +226,7 @@ static int rti_wdt_probe(struct platform_device *pdev)pm_runtime_enable (dev); ret =pm_runtime_get_sync (dev); -if (ret) { +if (ret <0 ) {pm_runtime_put_noidle (dev);pm_runtime_disable (&pdev->dev);return dev_err_probe (dev, ret,"runtime pm failed\n" );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 80/339 watchdog: ts4800_wdt: Fix refcount leak in ts4800_wdt_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 5d24df3d690809952528e7a19a43d84bc5b99d44 ]
of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() in some error paths.
--- drivers/watchdog/ts4800_wdt.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/watchdog/ts4800_wdt.c +4 -1
@@ -125,13 +125,16 @@ static int ts4800_wdt_probe(struct platform_device *pdev) ret =of_property_read_u32_index (np,"syscon" ,1 , ®);if (ret <0 ) {dev_err (dev,"no offset in syscon\n" ); +of_node_put (syscon_np);return ret; }/* allocate memory for watchdog struct */ wdt =devm_kzalloc (dev,sizeof (*wdt),GFP_KERNEL ); -if (!wdt) +if (!wdt) { +of_node_put (syscon_np);return -ENOMEM ; + }/* set regmap and offset to know where to write */ wdt->feed_offset = reg;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 81/339 blk-mq: dont touch ->tagset in blk_mq_get_sq_hctx
In reply to Greg Kroah-HartmanFrom: Ming Lei <[email protected]>
[ Upstream commit 5d05426e2d5fd7df8afc866b78c36b37b00188b7 ]
blk_mq_run_hw_queues() could be run when there isn't queued request and after queue is cleaned up, at that time tagset is freed, because tagset lifetime is covered by driver, and often freed after blk_cleanup_queue() returns.
So don't touch ->tagset for figuring out current default hctx by the mapping built in request queue, so use-after-free on tagset can be avoided. Meantime this way should be fast than retrieving mapping from tagset.
--- block/blk-mq.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
block/blk-mq.c +3 -4
@@ -2123,8 +2123,7 @@ static bool blk_mq_has_sqsched(struct request_queue *q)*/ static struct blk_mq_hw_ctx *blk_mq_get_sq_hctx (struct request_queue *q) { -struct blk_mq_hw_ctx *hctx; - +struct blk_mq_ctx *ctx =blk_mq_get_ctx (q);/* * If the IO scheduler does not respect hardware queues when * dispatching, we just don't bother with multiple HW queues and
@@ -2132,8 +2131,8 @@ static struct blk_mq_hw_ctx *blk_mq_get_sq_hctx(struct request_queue *q)* just causes lock contention inside the scheduler and pointless cache * bouncing. */ - hctx =blk_mq_map_queue_type (q,HCTX_TYPE_DEFAULT , -raw_smp_processor_id ()); +struct blk_mq_hw_ctx *hctx =blk_mq_map_queue (q,0 , ctx); +if (!blk_mq_hctx_stopped (hctx))return hctx;return NULL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 82/339 ASoC: fsl_sai: Fix FSL_SAI_xDR/xFR definition
In reply to Greg Kroah-HartmanFrom: Shengjiu Wang <[email protected]>
[ Upstream commit e4dd748dc87cf431af7b3954963be0d9f6150217 ]
There are multiple xDR and xFR registers, the index is from 0 to 7. FSL_SAI_xDR and FSL_SAI_xFR is abandoned, replace them with FSL_SAI_xDR0 and FSL_SAI_xFR0.
--- sound/soc/fsl/fsl_sai.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/fsl/fsl_sai.h +2 -2
@@ -80,8 +80,8 @@#define FSL_SAI_xCR3 (tx, ofs) (tx ? FSL_SAI_TCR3(ofs) : FSL_SAI_RCR3(ofs))#define FSL_SAI_xCR4 (tx, ofs) (tx ? FSL_SAI_TCR4(ofs) : FSL_SAI_RCR4(ofs))#define FSL_SAI_xCR5 (tx, ofs) (tx ? FSL_SAI_TCR5(ofs) : FSL_SAI_RCR5(ofs)) -#define FSL_SAI_xDR (tx, ofs) (tx ? FSL_SAI_TDR(ofs) : FSL_SAI_RDR(ofs)) -#define FSL_SAI_xFR (tx, ofs) (tx ? FSL_SAI_TFR(ofs) : FSL_SAI_RFR(ofs)) +#define FSL_SAI_xDR0 (tx) (tx ? FSL_SAI_TDR0 : FSL_SAI_RDR0) +#define FSL_SAI_xFR0 (tx) (tx ? FSL_SAI_TFR0 : FSL_SAI_RFR0)#define FSL_SAI_xMR (tx) (tx ? FSL_SAI_TMR : FSL_SAI_RMR)/* SAI Transmit/Receive Control Register */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 83/339 scsi: sd: Dont call blk_cleanup_disk() in sd_probe()
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 7274ce0558adb4b9b1f5c5b613fb4fe331c18911 ]
In SCSI the midlayer has ownership of the request_queue, so on probe failure we must only put the gendisk, but leave the request_queue alone.
--- drivers/scsi/sd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/sd.c +1 -1
@@ -3475,7 +3475,7 @@ static int sd_probe(struct device *dev) error =device_add_disk (dev, gd,NULL );if (error) {put_device (&sdkp->disk_dev); -blk_cleanup_disk (gd); +put_disk (gd); goto out; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 84/339 clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 9c04a8ff03def4df3f81219ffbe1ec9b44ff5348 ]
The irq_of_parse_and_map() returns 0 on failure, not a negative ERRNO.
--- drivers/clocksource/timer-oxnas-rps.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clocksource/timer-oxnas-rps.c +1 -1
@@ -236,7 +236,7 @@ static int __init oxnas_rps_timer_init(struct device_node *np) } rps->irq =irq_of_parse_and_map (np,0 ); -if (rps->irq <0 ) { +if (!rps->irq) { ret = -EINVAL ; goto err_iomap; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 85/339 s390/crypto: fix scatterwalk_unmap() callers in AES-GCM
In reply to Greg Kroah-HartmanFrom: Jann Horn <[email protected]>
[ Upstream commit bd52cd5e23f134019b23f0c389db0f9a436e4576 ]
The argument of scatterwalk_unmap() is supposed to be the void* that was returned by the previous scatterwalk_map() call.
The s390 AES-GCM implementation was instead passing the pointer to the struct scatter_walk.
This doesn't actually break anything because scatterwalk_unmap() only uses its argument under CONFIG_HIGHMEM and ARCH_HAS_FLUSH_ON_KUNMAP.
--- arch/s390/crypto/aes_s390.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/s390/crypto/aes_s390.c +2 -2
@@ -701,7 +701,7 @@ static inline void _gcm_sg_unmap_and_advance(struct gcm_sg_walk *gw, unsigned int nbytes) { gw->walk_bytes_remain -= nbytes; -scatterwalk_unmap (&gw->walk); +scatterwalk_unmap (gw->walk_ptr);scatterwalk_advance (&gw->walk, nbytes);scatterwalk_done (&gw->walk,0 , gw->walk_bytes_remain); gw->walk_ptr =NULL ;
@@ -776,7 +776,7 @@ static int gcm_out_walk_go(struct gcm_sg_walk *gw, unsigned int minbytesneeded) goto out; } -scatterwalk_unmap (&gw->walk); +scatterwalk_unmap (gw->walk_ptr); gw->walk_ptr =NULL ; gw->ptr = gw->buf;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 86/339 amt: fix return value of amt_update_handler()
In reply to Greg Kroah-HartmanFrom: Taehee Yoo <[email protected]>
[ Upstream commit ac1dbf55981b88d64312858ea06e3e63001f085d ]
If a relay receives an update message, it lookup a tunnel. and if there is no tunnel for that message, it should be treated as an error, not a success.
But amt_update_handler() returns false, which means success.
--- drivers/net/amt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/amt.c +1 -1
@@ -2423,7 +2423,7 @@ static bool amt_update_handler(struct amt_dev *amt, struct sk_buff *skb) } } -return false; +return true; report: iph =ip_hdr (skb);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 87/339 amt: fix possible memory leak in amt_rcv()
In reply to Greg Kroah-HartmanFrom: Taehee Yoo <[email protected]>
[ Upstream commit 1a1a0e80e005cbdc2c250fc858e1d8570f4e4acb ]
If an amt receives packets and it finds socket. If it can't find a socket, it should free a received skb. But it doesn't.
So, a memory leak would possibly occur.
--- drivers/net/amt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/amt.c +1 -1
@@ -2679,7 +2679,7 @@ static int amt_rcv(struct sock *sk, struct sk_buff *skb) amt =rcu_dereference_sk_user_data (sk);if (!amt) { err = true; - goto out; + goto drop; } skb->dev = amt->dev;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 88/339 net: ethernet: ti: am65-cpsw: Fix fwnode passed to phylink_create()
In reply to Greg Kroah-HartmanFrom: Siddharth Vadapalli <[email protected]>
[ Upstream commit 0b7180072a9df5e18af5b58410fec38230848a8d ]
am65-cpsw-nuss driver incorrectly uses fwnode member of common ethernet device's "struct device_node" instead of using fwnode member of the port's "struct device_node" in phylink_create(). This results in all ports having the same phy data when there are multiple ports with their phy properties populated in their respective nodes rather than the common ethernet device node.
Fix it here by using fwnode member of the port's node.
--- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/ti/am65-cpsw-nuss.c +4 -1
@@ -9,6 +9,7 @@#include <linux/etherdevice.h> #include <linux/if_vlan.h> #include <linux/interrupt.h> +#include <linux/irqdomain.h> #include <linux/kernel.h> #include <linux/kmemleak.h> #include <linux/module.h>
@@ -1989,7 +1990,9 @@ am65_cpsw_nuss_init_port_ndev(struct am65_cpsw_common *common, u32 port_idx)phy_interface_set_rgmii (port->slave.phylink_config.supported_interfaces); - phylink =phylink_create (&port->slave.phylink_config, dev->fwnode, port->slave.phy_if, + phylink =phylink_create (&port->slave.phylink_config, +of_node_to_fwnode (port->slave.phy_node), + port->slave.phy_if, &am65_cpsw_phylink_mac_ops);if (IS_ERR (phylink))return PTR_ERR (phylink);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 89/339 net/smc: set ini->smcrv2.ib_dev_v2 to NULL if SMC-Rv2 is unavailable
In reply to Greg Kroah-HartmanFrom: liuyacan <[email protected]>
[ Upstream commit b3b1a17538d3ef6a9667b2271216fd16d7678ab5 ]
In the process of checking whether RDMAv2 is available, the current implementation first sets ini->smcrv2.ib_dev_v2, and then allocates smc buf desc and register rmb, but the latter may fail. In this case, the pointer should be reset.
--- net/smc/af_smc.c | 1 + 1 file changed, 1 insertion(+)
net/smc/af_smc.c +1 -0
@@ -2136,6 +2136,7 @@ static void smc_find_rdma_v2_device_serv(struct smc_sock *new_smc, not_found: ini->smcr_version &= ~SMC_V2 ; + ini->smcrv2.ib_dev_v2 =NULL ; ini->check_smcrv2 = false; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 90/339 spi: fsi: Fix spurious timeout
In reply to Greg Kroah-HartmanFrom: Eddie James <[email protected]>
[ Upstream commit 61bf40ef51aa73f6216b33563271b6acf7ea8d70 ]
The driver may return a timeout error even if the status register indicates that the transfer may proceed. Fix this by restructuring the polling loop.
--- drivers/spi/spi-fsi.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/spi/spi-fsi.c +6 -6
@@ -319,12 +319,12 @@ static int fsi_spi_transfer_data(struct fsi_spi *ctx, end = jiffies +msecs_to_jiffies (SPI_FSI_STATUS_TIMEOUT_MS );do { +if (time_after (jiffies, end)) +return -ETIMEDOUT ; + rc =fsi_spi_status (ctx, &status,"TX" );if (rc)return rc; - -if (time_after (jiffies, end)) -return -ETIMEDOUT ; }while (status &SPI_FSI_STATUS_TDR_FULL ); sent += nb;
@@ -337,12 +337,12 @@ static int fsi_spi_transfer_data(struct fsi_spi *ctx,while (transfer->len > recv) { end = jiffies +msecs_to_jiffies (SPI_FSI_STATUS_TIMEOUT_MS );do { +if (time_after (jiffies, end)) +return -ETIMEDOUT ; + rc =fsi_spi_status (ctx, &status,"RX" );if (rc)return rc; - -if (time_after (jiffies, end)) -return -ETIMEDOUT ; }while (!(status &SPI_FSI_STATUS_RDR_FULL )); rc =fsi_spi_read_reg (ctx,SPI_FSI_DATA_RX , &in);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 91/339 drm/amdgpu: Off by one in dm_dmub_outbox1_low_irq()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit a35faec3db0e13aac8ea720bc1a3503081dd5a3d ]
The > ARRAY_SIZE() should be >= ARRAY_SIZE() to prevent an out of bounds access.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +1 -1
@@ -771,7 +771,7 @@ static void dm_dmub_outbox1_low_irq(void *interrupt_params) do { dc_stat_get_dmub_notification(adev->dm.dc, ¬ify); - if (notify.type > ARRAY_SIZE(dm->dmub_thread_offload)) { + if (notify.type >= ARRAY_SIZE(dm->dmub_thread_offload)) { DRM_ERROR("DM: notify type %d invalid!", notify.type); continue; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 92/339 net: lan966x: check devm_of_phy_get() for -EDEFER_PROBE
In reply to Greg Kroah-HartmanFrom: Michael Walle <[email protected]>
[ Upstream commit b58cdd4388b1d8f5bee9f5a3897a7e780d1eaa48 ]
At the moment, if devm_of_phy_get() returns an error the serdes simply isn't set. While it is bad to ignore an error in general, there is a particular bug that network isn't working if the serdes driver is compiled as a module. In that case, devm_of_phy_get() returns -EDEFER_PROBE and the error is silently ignored.
The serdes is optional, it is not there if the port is using RGMII, in which case devm_of_phy_get() returns -ENODEV. Rearrange the error handling so that -ENODEV will be handled but other error codes will abort the probing.
--- drivers/net/ethernet/microchip/lan966x/lan966x_main.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/net/ethernet/microchip/lan966x/lan966x_main.c +7 -2
@@ -1080,8 +1080,13 @@ static int lan966x_probe(struct platform_device *pdev) lan966x->ports[p]->fwnode =fwnode_handle_get (portnp); serdes =devm_of_phy_get (lan966x->dev,to_of_node (portnp),NULL ); -if (!IS_ERR (serdes)) - lan966x->ports[p]->serdes = serdes; +if (PTR_ERR (serdes) == -ENODEV ) + serdes =NULL ; +if (IS_ERR (serdes)) { + err =PTR_ERR (serdes); + goto cleanup_ports; + } + lan966x->ports[p]->serdes = serdes;lan966x_port_init (lan966x->ports[p]); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 93/339 net: sched: fixed barrier to prevent skbuff sticking in qdisc backlog
In reply to Greg Kroah-HartmanFrom: Vincent Ray <[email protected]>
[ Upstream commit a54ce3703613e41fe1d98060b62ec09a3984dc28 ]
In qdisc_run_begin(), smp_mb__before_atomic() used before test_bit() does not provide any ordering guarantee as test_bit() is not an atomic operation. This, added to the fact that the spin_trylock() call at the beginning of qdisc_run_begin() does not guarantee acquire semantics if it does not grab the lock, makes it possible for the following statement :
if (test_bit(__QDISC_STATE_MISSED, &qdisc->state))
to be executed before an enqueue operation called before qdisc_run_begin().
As a result the following race can happen :
CPU 1 CPU 2
qdisc_run_begin() qdisc_run_begin() /* true */
set(MISSED) .
/* returns false */ .
. /* sees MISSED = 1 */
. /* so qdisc not empty */
. __qdisc_run()
. .
. pfifo_fast_dequeue()
----> /* may be done here */ .
| . clear(MISSED) | . . | . smp_mb __after_atomic(); | . . | . /* recheck the queue */ | . /* nothing => exit */ | enqueue(skb1) | . | qdisc_run_begin() | . | spin_trylock() /* fail */ | . | smp_mb__before_atomic() /* not enough */ | .
---- if (test_bit(MISSED))
return false; /* exit */
In the above scenario, CPU 1 and CPU 2 both try to grab the qdisc->seqlock at the same time. Only CPU 2 succeeds and enters the bypass code path, where it emits its skb then calls __qdisc_run().
CPU1 fails, sets MISSED and goes down the traditionnal enqueue() + dequeue() code path. But when executing qdisc_run_begin() for the second time, after enqueuing its skbuff, it sees the MISSED bit still set (by itself) and consequently chooses to exit early without setting it again nor trying to grab the spinlock again.
Meanwhile CPU2 has seen MISSED = 1, cleared it, checked the queue and found it empty, so it returned.
At the end of the sequence, we end up with skb1 enqueued in the backlog, both CPUs out of __dev_xmit_skb(), the MISSED bit not set, and no __netif_schedule() called made. skb1 will now linger in the qdisc until somebody later performs a full __qdisc_run(). Associated to the bypass capacity of the qdisc, and the ability of the TCP layer to avoid resending packets which it knows are still in the qdisc, this can lead to serious traffic "holes" in a TCP connection.
We fix this by replacing the smp_mb__before_atomic() / test_bit() / set_bit() / smp_mb__after_atomic() sequence inside qdisc_run_begin() by a single test_and_set_bit() call, which is more concise and enforces the needed memory barriers.
--- include/net/sch_generic.h | 36 ++++++++---------------------------- 1 file changed, 8 insertions(+), 28 deletions(-)
include/net/sch_generic.h +8 -28
@@ -187,37 +187,17 @@ static inline bool qdisc_run_begin(struct Qdisc *qdisc)if (spin_trylock (&qdisc->seqlock))return true; -/* Paired with smp_mb__after_atomic() to make sure -* STATE_MISSED checking is synchronized with clearing -* in pfifo_fast_dequeue(). +/* No need to insist if the MISSED flag was already set. +* Note that test_and_set_bit() also gives us memory ordering +* guarantees wrt potential earlier enqueue() and below +* spin_trylock(), both of which are necessary to prevent races */ -smp_mb__before_atomic (); - -/* If the MISSED flag is set, it means other thread has -* set the MISSED flag before second spin_trylock(), so -* we can return false here to avoid multi cpus doing -* the set_bit() and second spin_trylock() concurrently. -*/ -if (test_bit (__QDISC_STATE_MISSED, &qdisc->state)) +if (test_and_set_bit (__QDISC_STATE_MISSED, &qdisc->state))return false; -/* Set the MISSED flag before the second spin_trylock(), -* if the second spin_trylock() return false, it means -* other cpu holding the lock will do dequeuing for us -* or it will see the MISSED flag set after releasing -* lock and reschedule the net_tx_action() to do the -* dequeuing. -*/ -set_bit (__QDISC_STATE_MISSED, &qdisc->state); - -/* spin_trylock() only has load-acquire semantic, so use -* smp_mb__after_atomic() to ensure STATE_MISSED is set -* before doing the second spin_trylock(). -*/ -smp_mb__after_atomic (); - -/* Retry again in case other CPU may not see the new flag -* after it releases the lock at the end of qdisc_run_end(). +/* Try to take the lock again to make sure that we will either +* grab it or the CPU that still has it will see MISSED set +* when testing it in qdisc_run_end() */ return spin_trylock (&qdisc->seqlock); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 94/339 net: ethernet: mtk_eth_soc: out of bounds read in mtk_hwlro_get_fdir_entry()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit e7e7104e2d5ddf3806a28695670f21bef471f1e1 ]
The "fsp->location" variable comes from user via ethtool_get_rxnfc(). Check that it is valid to prevent an out of bounds read.
--- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/mediatek/mtk_eth_soc.c +3 -0
@@ -1949,6 +1949,9 @@ static int mtk_hwlro_get_fdir_entry(struct net_device *dev,struct ethtool_rx_flow_spec *fsp = (struct ethtool_rx_flow_spec *)&cmd->fs; +if (fsp->location >=ARRAY_SIZE (mac->hwlro_ip)) +return -EINVAL ; +/* only tcp dst ipv4 is meaningful, others are meaningless */ fsp->flow_type =TCP_V4_FLOW ; fsp->h_u.tcp_ip4_spec.ip4dst =ntohl (mac->hwlro_ip[fsp->location]);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 95/339 net: ethernet: ti: am65-cpsw-nuss: Fix some refcount leaks
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 5dd89d2fc438457811cbbec07999ce0d80051ff5 ]
of_get_child_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. am65_cpsw_init_cpts() and am65_cpsw_nuss_probe() don't release the refcount in error case.
Add missing of_node_put() to avoid refcount leak.
--- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/ti/am65-cpsw-nuss.c +2 -1
@@ -1797,6 +1797,7 @@ static int am65_cpsw_init_cpts(struct am65_cpsw_common *common)if (IS_ERR (cpts)) {int ret =PTR_ERR (cpts); +of_node_put (node);if (ret == -EOPNOTSUPP ) {dev_info (dev,"cpts disabled\n" );return 0 ;
@@ -2673,9 +2674,9 @@ static int am65_cpsw_nuss_probe(struct platform_device *pdev)if (!node)return -ENOENT ; common->port_num =of_get_child_count (node); +of_node_put (node);if (common->port_num <1 || common->port_num >AM65_CPSW_MAX_PORTS )return -ENOENT ; -of_node_put (node); common->rx_flow_id_base =-1 ;init_completion (&common->tdown_complete);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 96/339 net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 02ded5a173619b11728b8bf75a3fd995a2c1ff28 ]
of_get_child_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when done.
mv88e6xxx_mdio_register() pass the device node to of_mdiobus_register(). We don't need the device node after it.
Add missing of_node_put() to avoid refcount leak.
--- drivers/net/dsa/mv88e6xxx/chip.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/dsa/mv88e6xxx/chip.c +1 -0
@@ -3960,6 +3960,7 @@ static int mv88e6xxx_mdios_register(struct mv88e6xxx_chip *chip,*/ child =of_get_child_by_name (np,"mdio" ); err =mv88e6xxx_mdio_register (chip, child, false); +of_node_put (child);if (err)return err;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 97/339 modpost: fix removing numeric suffixes
In reply to Greg Kroah-HartmanFrom: Alexander Lobakin <[email protected]>
[ Upstream commit b5beffa20d83c4e15306c991ffd00de0d8628338 ]
With the -z unique-symbol linker flag or any similar mechanism, it is possible to trigger the following:
ERROR: modpost: "param_set_uint.0" [vmlinux] is a static EXPORT_SYMBOL
The reason is that for now the condition from remove_dot():
if (m && (s[n + m] == '.' || s[n + m] == 0))
which was designed to test if it's a dot or a '\0' after the suffix is never satisfied.
This is due to that s[n + m] always points to the last digit of a numeric suffix, not on the symbol next to it (from a custom debug print added to modpost):
param_set_uint.0, s[n + m] is '0', s[n + m + 1] is '\0'
So it's off-by-one and was like that since 2014.
Fix this for the sake of any potential upcoming features, but don't bother stable-backporting, as it's well hidden -- apart from that LD flag, it can be triggered only with GCC LTO which never landed upstream.
--- scripts/mod/modpost.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/mod/modpost.c +1 -1
@@ -1993,7 +1993,7 @@ static char *remove_dot(char *s)if (n && s[n]) {size_t m =strspn (s + n +1 ,"0123456789" ); -if (m && (s[n + m] =='.' || s[n + m] ==0 )) +if (m && (s[n + m +1 ] =='.' || s[n + m +1 ] ==0 )) s[n] =0 ;/* strip trailing .prelink */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 98/339 block, loop: support partitions without scanning
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit b9684a71fca793213378dd410cd11675d973eaa1 ]
Historically we did distinguish between a flag that surpressed partition scanning, and a combinations of the minors variable and another flag if any partitions were supported. This was generally confusing and doesn't make much sense, but some corner case uses of the loop driver actually do want to support manually added partitions on a device that does not actively scan for partitions. To make things worsee the loop driver also wants to dynamically toggle the scanning for partitions on a live gendisk, which makes the disk->flags updates non-atomic.
Introduce a new GD_SUPPRESS_PART_SCAN bit in disk->state that disables just scanning for partitions, and toggle that instead of GENHD_FL_NO_PART in the loop driver.
--- block/genhd.c | 2 ++ drivers/block/loop.c | 8 ++++---- include/linux/blkdev.h | 1 + 3 files changed, 7 insertions(+), 4 deletions(-)
block/genhd.c +2 -0
@@ -385,6 +385,8 @@ int disk_scan_partitions(struct gendisk *disk, fmode_t mode)if (disk->flags & (GENHD_FL_NO_PART |GENHD_FL_HIDDEN ))return -EINVAL ; +if (test_bit (GD_SUPPRESS_PART_SCAN , &disk->state)) +return -EINVAL ;if (disk->open_partitions)return -EBUSY ;
drivers/block/loop.c +4 -4
@@ -1066,7 +1066,7 @@ static int loop_configure(struct loop_device *lo, fmode_t mode, lo->lo_flags |=LO_FLAGS_PARTSCAN ; partscan = lo->lo_flags &LO_FLAGS_PARTSCAN ;if (partscan) - lo->lo_disk->flags &= ~GENHD_FL_NO_PART ; +clear_bit (GD_SUPPRESS_PART_SCAN , &lo->lo_disk->state);loop_global_unlock (lo, is_loop);if (partscan)
@@ -1185,7 +1185,7 @@ static void __loop_clr_fd(struct loop_device *lo, bool release)*/ lo->lo_flags =0 ;if (!part_shift) - lo->lo_disk->flags |=GENHD_FL_NO_PART ; +set_bit (GD_SUPPRESS_PART_SCAN , &lo->lo_disk->state);mutex_lock (&lo->lo_mutex); lo->lo_state = Lo_unbound;mutex_unlock (&lo->lo_mutex);
@@ -1295,7 +1295,7 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info)if (!err && (lo->lo_flags &LO_FLAGS_PARTSCAN ) && !(prev_lo_flags &LO_FLAGS_PARTSCAN )) { - lo->lo_disk->flags &= ~GENHD_FL_NO_PART ; +clear_bit (GD_SUPPRESS_PART_SCAN , &lo->lo_disk->state); partscan = true; } out_unlock:
@@ -2054,7 +2054,7 @@ static int loop_add(int i)* userspace tools. Parameters like this in general should be avoided. */ if (!part_shift) - disk->flags |=GENHD_FL_NO_PART ; +set_bit (GD_SUPPRESS_PART_SCAN , &disk->state);atomic_set (&lo->lo_refcnt,0 );mutex_init (&lo->lo_mutex); lo->lo_number = i;
include/linux/blkdev.h +1 -0
@@ -147,6 +147,7 @@ struct gendisk {#define GD_DEAD 2#define GD_NATIVE_CAPACITY 3#define GD_ADDED 4 +#define GD_SUPPRESS_PART_SCAN 5struct mutex open_mutex;/* open/close mutex */ unsigned open_partitions;/* number of open partitions */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 99/339 ep93xx: clock: Do not return the address of the freed memory
In reply to Greg Kroah-HartmanFrom: Genjian Zhang <[email protected]>
[ Upstream commit 8a7322a3a05f75e8a4902bdf8129aecd37d54fe9 ]
Avoid return freed memory addresses,Modified to the actual error return value of clk_register().
--- arch/arm/mach-ep93xx/clock.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
arch/arm/mach-ep93xx/clock.c +6 -4
@@ -345,9 +345,10 @@ static struct clk_hw *clk_hw_register_ddiv(const char *name, psc->hw.init = &init; clk =clk_register (NULL , &psc->hw); -if (IS_ERR (clk)) +if (IS_ERR (clk)) {kfree (psc); - +return ERR_CAST (clk); + }return &psc->hw; }
@@ -452,9 +453,10 @@ static struct clk_hw *clk_hw_register_div(const char *name, psc->hw.init = &init; clk =clk_register (NULL , &psc->hw); -if (IS_ERR (clk)) +if (IS_ERR (clk)) {kfree (psc); - +return ERR_CAST (clk); + }return &psc->hw; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 100/339 jffs2: fix memory leak in jffs2_do_fill_super
In reply to Greg Kroah-HartmanFrom: Baokun Li <[email protected]>
[ Upstream commit c14adb1cf70a984ed081c67e9d27bc3caad9537c ]
If jffs2_iget() or d_make_root() in jffs2_do_fill_super() returns an error, we can observe the following kmemleak report:
--------------------------------------------
unreferenced object 0xffff888105a65340 (size 64):
comm "mount", pid 710, jiffies 4302851558 (age 58.239s) hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff859c45e5>] kmem_cache_alloc_trace+0x475/0x8a0
[<ffffffff86160146>] jffs2_sum_init+0x96/0x1a0
[<ffffffff86140e25>] jffs2_do_mount_fs+0x745/0x2120
[<ffffffff86149fec>] jffs2_do_fill_super+0x35c/0x810
[<ffffffff8614aae9>] jffs2_fill_super+0x2b9/0x3b0
[...]unreferenced object 0xffff8881bd7f0000 (size 65536):
comm "mount", pid 710, jiffies 4302851558 (age 58.239s) hex dump (first 32 bytes):
bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb ................ bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb ................
backtrace:
[<ffffffff858579ba>] kmalloc_order+0xda/0x110
[<ffffffff85857a11>] kmalloc_order_trace+0x21/0x130
[<ffffffff859c2ed1>] __kmalloc+0x711/0x8a0
[<ffffffff86160189>] jffs2_sum_init+0xd9/0x1a0
[<ffffffff86140e25>] jffs2_do_mount_fs+0x745/0x2120
[<ffffffff86149fec>] jffs2_do_fill_super+0x35c/0x810
[<ffffffff8614aae9>] jffs2_fill_super+0x2b9/0x3b0
[...]
--------------------------------------------This is because the resources allocated in jffs2_sum_init() are not released. Call jffs2_sum_exit() to release these resources to solve the problem.
--- fs/jffs2/fs.c | 1 + 1 file changed, 1 insertion(+)
fs/jffs2/fs.c +1 -0
@@ -604,6 +604,7 @@ int jffs2_do_fill_super(struct super_block *sb, struct fs_context *fc)jffs2_free_raw_node_refs (c);kvfree (c->blocks);jffs2_clear_xattr_subsystem (c); +jffs2_sum_exit (c); out_inohash:kfree (c->inocache_list); out_wbuf:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 101/339 ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty
In reply to Greg Kroah-HartmanFrom: Zhihao Cheng <[email protected]>
[ Upstream commit d09e9a2bddba6c48e0fddb16c4383172ac593251 ]
There at least 6 PEBs reserved on UBI device:
1. EBA_RESERVED_PEBS[1]
2. WL_RESERVED_PEBS[1]
3. UBI_LAYOUT_VOLUME_EBS[2]
4. MIN_FASTMAP_RESERVED_PEBS[2]
When all ubi volumes take all their PEBs, there are 3 (EBA_RESERVED_PEBS + WL_RESERVED_PEBS + MIN_FASTMAP_RESERVED_PEBS - MIN_FASTMAP_TAKEN_PEBS[1]) free PEBs. Since commit f9c34bb529975fe ("ubi: Fix producing anchor PEBs") and commit 4b68bf9a69d22dd ("ubi: Select fastmap anchor PEBs considering wear level rules") applied, there is only 1 (3 - FASTMAP_ANCHOR_PEBS[1] - FASTMAP_NEXT_ANCHOR_PEBS[1]) free PEB to fill pool and wl_pool, after filling pool, wl_pool is always empty. So, UBI could be stuck in an infinite loop:
ubi_thread system_wqwear_leveling_worker <--------------------------------------------------
get_peb_for_wl |
// fm_wl_pool, used = size = 0 |
schedule_work(&ubi->fm_work) |
|
update_fastmap_work_fn |
ubi_update_fastmap |
ubi_refill_pools |
// ubi->free_count - ubi->beb_rsvd_pebs < 5 |
// wl_pool is not filled with any PEBs |
schedule_erase(old_fm_anchor) |
ubi_ensure_anchor_pebs |
__schedule_ubi_work(wear_leveling_worker) |
|
__erase_worker |
ensure_wear_leveling |
__schedule_ubi_work(wear_leveling_worker) --------------------------, which cause high cpu usage of ubi_bgt:
top - 12:10:42 up 5 min, 2 users, load average: 1.76, 0.68, 0.27
Tasks: 123 total, 3 running, 54 sleeping, 0 stopped, 0 zombie
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 1589 root 20 0 0 0 0 R 45.0 0.0 0:38.86 ubi_bgt0d 319 root 20 0 0 0 0 I 15.2 0.0 0:15.29 kworker/0:3-eve 371 root 20 0 0 0 0 I 14.9 0.0 0:12.85 kworker/3:3-eve 20 root 20 0 0 0 0 I 11.3 0.0 0:05.33 kworker/1:0-eve 202 root 20 0 0 0 0 I 11.3 0.0 0:04.93 kworker/2:3-eve
In commit 4b68bf9a69d22dd ("ubi: Select fastmap anchor PEBs considering wear level rules"), there are three key changes:
1) Choose the fastmap anchor when the most free PEBs are available.
2) Enable anchor move within the anchor area again as it is useful for distributing wear.
3) Import a candidate fm anchor and check this PEB's erase count during wear leveling. If the wear leveling limit is exceeded, use the used anchor area PEB with the lowest erase count to replace it.
The anchor candidate can be removed, we can check fm_anchor PEB's erase count during wear leveling. Fix it by:
1) Removing 'fm_next_anchor' and check 'fm_anchor' during wear leveling.
2) Preferentially filling one free peb into fm_wl_pool in condition of ubi->free_count > ubi->beb_rsvd_pebs, then try to reserve enough free count for fastmap non anchor pebs after the above prerequisites are met.
Then, there are at least 1 PEB in pool and 1 PEB in wl_pool after calling ubi_refill_pools() with all erase works done.
Fetch a reproducer in [Link].
--- drivers/mtd/ubi/fastmap-wl.c | 69 ++++++++++++++++++++++++------------ drivers/mtd/ubi/fastmap.c | 11 ------ drivers/mtd/ubi/ubi.h | 4 +-- drivers/mtd/ubi/wl.c | 19 +++++----- 4 files changed, 57 insertions(+), 46 deletions(-)
drivers/mtd/ubi/fastmap-wl.c +46 -23
@@ -97,6 +97,33 @@ struct ubi_wl_entry *ubi_wl_get_fm_peb(struct ubi_device *ubi, int anchor)return e; } +/* +* has_enough_free_count - whether ubi has enough free pebs to fill fm pools +* @ubi: UBI device description object +* @is_wl_pool: whether UBI is filling wear leveling pool +* +* This helper function checks whether there are enough free pebs (deducted +* by fastmap pebs) to fill fm_pool and fm_wl_pool, above rule works after +* there is at least one of free pebs is filled into fm_wl_pool. +* For wear leveling pool, UBI should also reserve free pebs for bad pebs +* handling, because there maybe no enough free pebs for user volumes after +* producing new bad pebs. +*/ +static bool has_enough_free_count (struct ubi_device *ubi,bool is_wl_pool) +{ +int fm_used =0 ;// fastmap non anchor pebs. +int beb_rsvd_pebs; + +if (!ubi->free.rb_node) +return false; + + beb_rsvd_pebs = is_wl_pool ? ubi->beb_rsvd_pebs :0 ; +if (ubi->fm_wl_pool.size >0 && !(ubi->ro_mode || ubi->fm_disabled)) + fm_used = ubi->fm_size / ubi->leb_size -1 ; + +return ubi->free_count - beb_rsvd_pebs > fm_used; +} +/** * ubi_refill_pools - refills all fastmap PEB pools. * @ubi: UBI device description object
@@ -120,21 +147,17 @@ void ubi_refill_pools(struct ubi_device *ubi)wl_tree_add (ubi->fm_anchor, &ubi->free); ubi->free_count++; } -if (ubi->fm_next_anchor) { -wl_tree_add (ubi->fm_next_anchor, &ubi->free); - ubi->free_count++; - } -/* All available PEBs are in ubi->free, now is the time to get +/* +* All available PEBs are in ubi->free, now is the time to get * the best anchor PEBs. */ ubi->fm_anchor =ubi_wl_get_fm_peb (ubi,1 ); - ubi->fm_next_anchor =ubi_wl_get_fm_peb (ubi,1 );for (;;) { enough =0 ;if (pool->size < pool->max_size) { -if (!ubi->free.rb_node) +if (!has_enough_free_count (ubi, false))break ; e =wl_get_wle (ubi);
@@ -147,8 +170,7 @@ void ubi_refill_pools(struct ubi_device *ubi) enough++;if (wl_pool->size < wl_pool->max_size) { -if (!ubi->free.rb_node || - (ubi->free_count - ubi->beb_rsvd_pebs <5 )) +if (!has_enough_free_count (ubi, true))break ; e =find_wl_entry (ubi, &ubi->free,WL_FREE_MAX_DIFF );
@@ -286,20 +308,26 @@ static struct ubi_wl_entry *get_peb_for_wl(struct ubi_device *ubi)int ubi_ensure_anchor_pebs (struct ubi_device *ubi) {struct ubi_work *wrk; +struct ubi_wl_entry *anchor;spin_lock (&ubi->wl_lock); -/* Do we have a next anchor? */ -if (!ubi->fm_next_anchor) { - ubi->fm_next_anchor =ubi_wl_get_fm_peb (ubi,1 ); -if (!ubi->fm_next_anchor) -/* Tell wear leveling to produce a new anchor PEB */ - ubi->fm_do_produce_anchor =1 ; +/* Do we already have an anchor? */ +if (ubi->fm_anchor) { +spin_unlock (&ubi->wl_lock); +return 0 ; } -/* Do wear leveling to get a new anchor PEB or check the -* existing next anchor candidate. -*/ +/* See if we can find an anchor PEB on the list of free PEBs */ + anchor =ubi_wl_get_fm_peb (ubi,1 ); +if (anchor) { + ubi->fm_anchor = anchor; +spin_unlock (&ubi->wl_lock); +return 0 ; + } + + ubi->fm_do_produce_anchor =1 ; +/* No luck, trigger wear leveling to produce a new anchor PEB. */ if (ubi->wl_scheduled) {spin_unlock (&ubi->wl_lock);return 0 ;
@@ -381,11 +409,6 @@ static void ubi_fastmap_close(struct ubi_device *ubi) ubi->fm_anchor =NULL ; } -if (ubi->fm_next_anchor) { -return_unused_peb (ubi, ubi->fm_next_anchor); - ubi->fm_next_anchor =NULL ; - } -if (ubi->fm) {for (i =0 ; i < ubi->fm->used_blocks; i++)kfree (ubi->fm->e[i]);
drivers/mtd/ubi/fastmap.c +0 -11
@@ -1230,17 +1230,6 @@ static int ubi_write_fastmap(struct ubi_device *ubi, fm_pos +=sizeof (*fec);ubi_assert (fm_pos <= ubi->fm_size); } -if (ubi->fm_next_anchor) { - fec = (struct ubi_fm_ec *)(fm_raw + fm_pos); - - fec->pnum =cpu_to_be32 (ubi->fm_next_anchor->pnum); -set_seen (ubi, ubi->fm_next_anchor->pnum, seen_pebs); - fec->ec =cpu_to_be32 (ubi->fm_next_anchor->ec); - - free_peb_count++; - fm_pos +=sizeof (*fec); -ubi_assert (fm_pos <= ubi->fm_size); - } fmh->free_peb_count =cpu_to_be32 (free_peb_count);ubi_for_each_used_peb (ubi, wl_e, tmp_rb) {
drivers/mtd/ubi/ubi.h +1 -3
@@ -489,8 +489,7 @@ struct ubi_debug_info {* @fm_work: fastmap work queue * @fm_work_scheduled: non-zero if fastmap work was scheduled * @fast_attach: non-zero if UBI was attached by fastmap -* @fm_anchor: The new anchor PEB used during fastmap update -* @fm_next_anchor: An anchor PEB candidate for the next time fastmap is updated +* @fm_anchor: The next anchor PEB to use for fastmap * @fm_do_produce_anchor: If true produce an anchor PEB in wl * * @used: RB-tree of used physical eraseblocks
@@ -601,7 +600,6 @@ struct ubi_device {int fm_work_scheduled;int fast_attach;struct ubi_wl_entry *fm_anchor; -struct ubi_wl_entry *fm_next_anchor;int fm_do_produce_anchor;/* Wear-leveling sub-system's stuff */
drivers/mtd/ubi/wl.c +10 -9
@@ -689,16 +689,16 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,#ifdef CONFIG_MTD_UBI_FASTMAP e1 =find_anchor_wl_entry (&ubi->used); -if (e1 && ubi->fm_next_anchor && - (ubi->fm_next_anchor->ec - e1->ec >=UBI_WL_THRESHOLD )) { +if (e1 && ubi->fm_anchor && + (ubi->fm_anchor->ec - e1->ec >=UBI_WL_THRESHOLD )) { ubi->fm_do_produce_anchor =1 ; -/* fm_next_anchor is no longer considered a good anchor -* candidate. +/* +* fm_anchor is no longer considered a good anchor. * NULL assignment also prevents multiple wear level checks * of this PEB. */ -wl_tree_add (ubi->fm_next_anchor, &ubi->free); - ubi->fm_next_anchor =NULL ; +wl_tree_add (ubi->fm_anchor, &ubi->free); + ubi->fm_anchor =NULL ; ubi->free_count++; }
@@ -1085,12 +1085,13 @@ static int __erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk)if (!err) {spin_lock (&ubi->wl_lock); -if (!ubi->fm_disabled && !ubi->fm_next_anchor && +if (!ubi->fm_disabled && !ubi->fm_anchor && e->pnum <UBI_FM_MAX_START ) { -/* Abort anchor production, if needed it will be +/* +* Abort anchor production, if needed it will be * enabled again in the wear leveling started below. */ - ubi->fm_next_anchor = e; + ubi->fm_anchor = e; ubi->fm_do_produce_anchor =0 ; }else {wl_tree_add (e, &ubi->free);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 102/339 ubi: ubi_create_volume: Fix use-after-free when volume creation failed
In reply to Greg Kroah-HartmanFrom: Zhihao Cheng <[email protected]>
[ Upstream commit 8c03a1c21d72210f81cb369cc528e3fde4b45411 ]
There is an use-after-free problem for 'eba_tbl' in ubi_create_volume()'s error handling path:
ubi_eba_replace_table(vol, eba_tbl)
vol->eba_tbl = tbl
out_mapping:
ubi_eba_destroy_table(eba_tbl) // Free 'eba_tbl'out_unlock:
put_device(&vol->dev)
vol_release
kfree(tbl->entries) // UAFFix it by removing redundant 'eba_tbl' releasing. Fetch a reproducer in [Link].
--- drivers/mtd/ubi/vmt.c | 1 - 1 file changed, 1 deletion(-)
drivers/mtd/ubi/vmt.c +0 -1
@@ -309,7 +309,6 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req) ubi->volumes[vol_id] =NULL ; ubi->vol_count -=1 ;spin_unlock (&ubi->volumes_lock); -ubi_eba_destroy_table (eba_tbl); out_acc:spin_lock (&ubi->volumes_lock); ubi->rsvd_pebs -= vol->reserved_pebs;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 103/339 selftests/bpf: fix stacktrace_build_id with missing kprobe/urandom_read
In reply to Greg Kroah-HartmanFrom: Song Liu <[email protected]>
[ Upstream commit 59ed76fe2f981bccde37bdddb465f260a96a2404 ]
Kernel function urandom_read is replaced with urandom_read_iter. Therefore, kprobe on urandom_read is not working any more:
[root@eth50-1 bpf]# ./test_progs -n 161 test_stacktrace_build_id:PASS:skel_open_and_load 0 nsec
libbpf: kprobe perf_event_open() failed: No such file or directory
libbpf: prog 'oncpu': failed to create kprobe 'urandom_read+0x0' \
perf event: No such file or directory
libbpf: prog 'oncpu': failed to auto-attach: -2 test_stacktrace_build_id:FAIL:attach_tp err -2
161 stacktrace_build_id:FAIL
Fix this by replacing urandom_read with urandom_read_iter in the test.
--- tools/testing/selftests/bpf/progs/test_stacktrace_build_id.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/bpf/progs/test_stacktrace_build_id.c +1 -1
@@ -39,7 +39,7 @@ struct {__type (value, stack_trace_t); } stack_amap SEC(".maps"); -SEC("kprobe/urandom_read") +SEC("kprobe/urandom_read_iter")int oncpu (struct pt_regs *args) {__u32 max_len =sizeof (struct bpf_stack_build_id )
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 104/339 bpf: Fix probe read error in ___bpf_prog_run()
In reply to Greg Kroah-HartmanFrom: Menglong Dong <[email protected]>
[ Upstream commit caff1fa4118cec4dfd4336521ebd22a6408a1e3e ]
I think there is something wrong with BPF_PROBE_MEM in ___bpf_prog_run() in big-endian machine. Let's make a test and see what will happen if we want to load a 'u16' with BPF_PROBE_MEM.
Let's make the src value '0x0001', the value of dest register will become 0x0001000000000000, as the value will be loaded to the first 2 byte of DST with following code:
bpf_probe_read_kernel(&DST, SIZE, (const void *)(long) (SRC + insn->off));
Obviously, the value in DST is not correct. In fact, we can compare BPF_PROBE_MEM with LDX_MEM_H:
DST = *(SIZE *)(unsigned long) (SRC + insn->off);
If the memory load is done by LDX_MEM_H, the value in DST will be 0x1 now.
And I think this error results in the test case 'test_bpf_sk_storage_map' failing:
test_bpf_sk_storage_map:PASS:bpf_iter_bpf_sk_storage_map__open_and_load 0 nsec test_bpf_sk_storage_map:PASS:socket 0 nsec test_bpf_sk_storage_map:PASS:map_update 0 nsec test_bpf_sk_storage_map:PASS:socket 0 nsec test_bpf_sk_storage_map:PASS:map_update 0 nsec test_bpf_sk_storage_map:PASS:socket 0 nsec test_bpf_sk_storage_map:PASS:map_update 0 nsec test_bpf_sk_storage_map:PASS:attach_iter 0 nsec test_bpf_sk_storage_map:PASS:create_iter 0 nsec test_bpf_sk_storage_map:PASS:read 0 nsec test_bpf_sk_storage_map:FAIL:ipv6_sk_count got 0 expected 3 $10/26 bpf_iter/bpf_sk_storage_map:FAIL
The code of the test case is simply, it will load sk->sk_family to the register with BPF_PROBE_MEM and check if it is AF_INET6. With this patch, now the test case 'bpf_iter' can pass:
$10 bpf_iter:OK
--- kernel/bpf/core.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-)
kernel/bpf/core.c +5 -9
@@ -1950,6 +1950,11 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn)CONT ; \ LDX_MEM_##SIZEOP: \ DST = *(SIZE *)(unsigned long) (SRC + insn->off); \ + CONT; \ + LDX_PROBE_MEM_##SIZEOP: \ + bpf_probe_read_kernel(&DST, sizeof(SIZE), \ + (const void *)(long) (SRC + insn->off)); \ + DST = *((SIZE *)&DST); \ CONT;LDST (B , u8)
@@ -1957,15 +1962,6 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn) LDST(W, u32) LDST(DW, u64)#undef LDST -#define LDX_PROBE (SIZEOP ,SIZE ) \ - LDX_PROBE_MEM_##SIZEOP: \ - bpf_probe_read_kernel(&DST, SIZE, (const void *)(long) (SRC + insn->off)); \ - CONT; - LDX_PROBE(B, 1) - LDX_PROBE(H, 2) - LDX_PROBE(W, 4) - LDX_PROBE(DW, 8) -#undef LDX_PROBE#define ATOMIC_ALU_OP (BOP ,KOP ) \ case BOP: \
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 105/339 block: take destination bvec offsets into account in bio_copy_data_iter
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 403d50341cce6b5481a92eb481e6df60b1f49b55 ]
Appartly bcache can copy into bios that do not just contain fresh pages but can have offsets into the bio_vecs. Restore support for tht in bio_copy_data_iter.
--- block/bio.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
block/bio.c +5 -3
@@ -1336,10 +1336,12 @@ void bio_copy_data_iter(struct bio *dst, struct bvec_iter *dst_iter,struct bio_vec src_bv =bio_iter_iovec (src, *src_iter);struct bio_vec dst_bv =bio_iter_iovec (dst, *dst_iter);unsigned int bytes =min (src_bv.bv_len, dst_bv.bv_len); -void *src_buf; +void *src_buf =bvec_kmap_local (&src_bv); +void *dst_buf =bvec_kmap_local (&dst_bv); - src_buf =bvec_kmap_local (&src_bv); -memcpy_to_bvec (&dst_bv, src_buf); +memcpy (dst_buf, src_buf, bytes); + +kunmap_local (dst_buf);kunmap_local (src_buf);bio_advance_iter_single (src, src_iter, bytes);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 106/339 nbd: dont clear NBD_CMD_INFLIGHT flag if request is not completed
In reply to Greg Kroah-HartmanFrom: Yu Kuai <[email protected]>
[ Upstream commit 2895f1831e911ca87d4efdf43e35eb72a0c7e66e ]
Otherwise io will hung because request will only be completed if the cmd has the flag 'NBD_CMD_INFLIGHT'.
--- drivers/block/nbd.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
drivers/block/nbd.c +14 -4
@@ -404,13 +404,14 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req,if (!mutex_trylock (&cmd->lock))return BLK_EH_RESET_TIMER ; -if (!__test_and_clear_bit (NBD_CMD_INFLIGHT , &cmd->flags)) { +if (!test_bit (NBD_CMD_INFLIGHT , &cmd->flags)) {mutex_unlock (&cmd->lock);return BLK_EH_DONE ; }if (!refcount_inc_not_zero (&nbd->config_refs)) { cmd->status =BLK_STS_TIMEOUT ; +__clear_bit (NBD_CMD_INFLIGHT , &cmd->flags);mutex_unlock (&cmd->lock); goto done; }
@@ -479,6 +480,7 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req,dev_err_ratelimited (nbd_to_dev (nbd),"Connection timed out\n" );set_bit (NBD_RT_TIMEDOUT , &config->runtime_flags); cmd->status =BLK_STS_IOERR ; +__clear_bit (NBD_CMD_INFLIGHT , &cmd->flags);mutex_unlock (&cmd->lock);sock_shutdown (nbd);nbd_config_put (nbd);
@@ -746,7 +748,7 @@ static struct nbd_cmd *nbd_handle_reply(struct nbd_device *nbd, int index, cmd =blk_mq_rq_to_pdu (req);mutex_lock (&cmd->lock); -if (!__test_and_clear_bit (NBD_CMD_INFLIGHT , &cmd->flags)) { +if (!test_bit (NBD_CMD_INFLIGHT , &cmd->flags)) {dev_err (disk_to_dev (nbd->disk),"Suspicious reply %d (status %u flags %lu)" , tag, cmd->status, cmd->flags); ret = -ENOENT ;
@@ -855,8 +857,16 @@ static void recv_work(struct work_struct *work) } rq =blk_mq_rq_from_pdu (cmd); -if (likely (!blk_should_fake_timeout (rq->q))) -blk_mq_complete_request (rq); +if (likely (!blk_should_fake_timeout (rq->q))) { +bool complete; + +mutex_lock (&cmd->lock); + complete =__test_and_clear_bit (NBD_CMD_INFLIGHT , + &cmd->flags); +mutex_unlock (&cmd->lock); +if (complete) +blk_mq_complete_request (rq); + }percpu_ref_put (&q->q_usage_counter); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 107/339 nbd: fix possible overflow on first_minor in nbd_dev_add()
In reply to Greg Kroah-HartmanFrom: Zhang Wensheng <[email protected]>
[ Upstream commit 858f1bf65d3d9c00b5e2d8ca87dc79ed88267c98 ]
When 'index' is a big numbers, it may become negative which forced to 'int'. then 'index << part_shift' might overflow to a positive value that is not greater than '0xfffff', then sysfs might complains about duplicate creation. Because of this, move the 'index' judgment to the front will fix it and be better.
--- drivers/block/nbd.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-)
drivers/block/nbd.c +12 -11
@@ -1814,17 +1814,7 @@ static struct nbd_device *nbd_dev_add(int index, unsigned int refs)refcount_set (&nbd->refs,0 );INIT_LIST_HEAD (&nbd->list); disk->major =NBD_MAJOR ; - -/* Too big first_minor can cause duplicate creation of -* sysfs files/links, since index << part_shift might overflow, or -* MKDEV() expect that the max bits of first_minor is 20. -*/ disk->first_minor = index << part_shift; -if (disk->first_minor < index || disk->first_minor >MINORMASK ) { - err = -EINVAL ; - goto out_free_work; - } - disk->minors =1 << part_shift; disk->fops = &nbd_fops; disk->private_data = nbd;
@@ -1929,8 +1919,19 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info)if (!netlink_capable (skb,CAP_SYS_ADMIN ))return -EPERM ; -if (info->attrs[NBD_ATTR_INDEX ]) +if (info->attrs[NBD_ATTR_INDEX ]) { index =nla_get_u32 (info->attrs[NBD_ATTR_INDEX ]); + +/* +* Too big first_minor can cause duplicate creation of +* sysfs files/links, since index << part_shift might overflow, or +* MKDEV() expect that the max bits of first_minor is 20. +*/ +if (index <0 || index >MINORMASK >> part_shift) { +printk (KERN_ERR "nbd: illegal input index %d\n" , index); +return -EINVAL ; + } + }if (!info->attrs[NBD_ATTR_SOCKETS ]) {printk (KERN_ERR "nbd: must specify at least one socket\n" );return -EINVAL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 108/339 riscv: read-only pages should not be writable
In reply to Greg Kroah-HartmanFrom: Heinrich Schuchardt <[email protected]>
[ Upstream commit 630f972d76d6460235e84e1aa034ee06f9c8c3a9 ]
If EFI pages are marked as read-only,
we should remove the _PAGE_WRITE flag.
The current code overwrites an unused value.
--- arch/riscv/kernel/efi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/kernel/efi.c +1 -1
@@ -65,7 +65,7 @@ static int __init set_permissions(pte_t *ptep, unsigned long addr, void *data)if (md->attribute &EFI_MEMORY_RO ) { val =pte_val (pte) & ~_PAGE_WRITE; - val =pte_val (pte) | _PAGE_READ; + val |= _PAGE_READ; pte =__pte (val); }if (md->attribute &EFI_MEMORY_XP ) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 109/339 net/smc: fixes for converting from "struct smc_cdc_tx_pend **" to "struct smc_wr_tx_pend_priv *"
In reply to Greg Kroah-HartmanFrom: Guangguan Wang <[email protected]>
[ Upstream commit e225c9a5a74b12e9ef8516f30a3db2c7eb866ee1 ]
"struct smc_cdc_tx_pend **" can not directly convert to "struct smc_wr_tx_pend_priv *".
--- net/smc/smc_cdc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/smc/smc_cdc.c +1 -1
@@ -82,7 +82,7 @@ int smc_cdc_get_free_slot(struct smc_connection *conn,/* abnormal termination */ if (!rc)smc_wr_tx_put_slot (link, - (struct smc_wr_tx_pend_priv *)pend); + (struct smc_wr_tx_pend_priv *)(*pend)); rc = -EPIPE ; }return rc;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 110/339 tcp: add accessors to read/set tp->snd_cwnd
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 40570375356c874b1578e05c1dcc3ff7c1322dbe ]
We had various bugs over the years with code breaking the assumption that tp->snd_cwnd is greater than zero.
Lately, syzbot reported the WARN_ON_ONCE(!tp->prior_cwnd) added in commit 8b8a321ff72c ("tcp: fix zero cwnd in tcp_cwnd_reduction") can trigger, and without a repro we would have to spend considerable time finding the bug.
Instead of complaining too late, we want to catch where and when tp->snd_cwnd is set to an illegal value.
--- include/net/tcp.h | 19 +++++++++++++++---- include/trace/events/tcp.h | 2 +- net/core/filter.c | 2 +- net/ipv4/tcp.c | 8 ++++---- net/ipv4/tcp_bbr.c | 20 ++++++++++---------- net/ipv4/tcp_bic.c | 14 +++++++------- net/ipv4/tcp_cdg.c | 30 +++++++++++++++--------------- net/ipv4/tcp_cong.c | 18 +++++++++--------- net/ipv4/tcp_cubic.c | 22 +++++++++++----------- net/ipv4/tcp_dctcp.c | 11 ++++++----- net/ipv4/tcp_highspeed.c | 18 +++++++++--------- net/ipv4/tcp_htcp.c | 10 +++++----- net/ipv4/tcp_hybla.c | 18 +++++++++--------- net/ipv4/tcp_illinois.c | 12 +++++++----- net/ipv4/tcp_input.c | 36 ++++++++++++++++++------------------ net/ipv4/tcp_ipv4.c | 2 +- net/ipv4/tcp_lp.c | 6 +++--- net/ipv4/tcp_metrics.c | 12 ++++++------ net/ipv4/tcp_nv.c | 24 ++++++++++++------------ net/ipv4/tcp_output.c | 30 +++++++++++++++--------------- net/ipv4/tcp_rate.c | 2 +- net/ipv4/tcp_scalable.c | 4 ++-- net/ipv4/tcp_vegas.c | 21 +++++++++++---------- net/ipv4/tcp_veno.c | 24 ++++++++++++------------ net/ipv4/tcp_westwood.c | 3 ++- net/ipv4/tcp_yeah.c | 30 +++++++++++++++--------------- net/ipv6/tcp_ipv6.c | 2 +- 27 files changed, 208 insertions(+), 192 deletions(-)
include/net/tcp.h +15 -4
@@ -1215,9 +1215,20 @@ static inline unsigned int tcp_packets_in_flight(const struct tcp_sock *tp)#define TCP_INFINITE_SSTHRESH 0x7fffffff +static inline u32 tcp_snd_cwnd (const struct tcp_sock *tp) +{ +return tp->snd_cwnd; +} + +static inline void tcp_snd_cwnd_set (struct tcp_sock *tp,u32 val) +{ +WARN_ON_ONCE ((int )val <=0 ); + tp->snd_cwnd = val; +} +static inline bool tcp_in_slow_start (const struct tcp_sock *tp) { -return tp->snd_cwnd < tp->snd_ssthresh; +return tcp_snd_cwnd (tp) < tp->snd_ssthresh; }static inline bool tcp_in_initial_slowstart (const struct tcp_sock *tp)
@@ -1243,8 +1254,8 @@ static inline __u32 tcp_current_ssthresh(const struct sock *sk)return tp->snd_ssthresh; else return max(tp->snd_ssthresh, - ((tp->snd_cwnd >>1 ) + - (tp->snd_cwnd >>2 ))); + ((tcp_snd_cwnd (tp) >>1 ) + + (tcp_snd_cwnd (tp) >>2 ))); }/* Use define here intentionally to get WARN_ON location shown at the caller */
@@ -1286,7 +1297,7 @@ static inline bool tcp_is_cwnd_limited(const struct sock *sk)/* If in slow start, ensure cwnd grows to twice what was ACKed. */ if (tcp_in_slow_start (tp)) -return tp->snd_cwnd <2 * tp->max_packets_out; +return tcp_snd_cwnd (tp) <2 * tp->max_packets_out;return tp->is_cwnd_limited; }
include/trace/events/tcp.h +1 -1
@@ -279,7 +279,7 @@ TRACE_EVENT(tcp_probe, __entry->data_len = skb->len -__tcp_hdrlen (th); __entry->snd_nxt = tp->snd_nxt; __entry->snd_una = tp->snd_una; - __entry->snd_cwnd = tp->snd_cwnd; + __entry->snd_cwnd =tcp_snd_cwnd (tp); __entry->snd_wnd = tp->snd_wnd; __entry->rcv_wnd = tp->rcv_wnd; __entry->ssthresh =tcp_current_ssthresh (sk);
net/core/filter.c +1 -1
@@ -5173,7 +5173,7 @@ static int _bpf_setsockopt(struct sock *sk, int level, int optname,if (val <=0 || tp->data_segs_out > tp->syn_data) ret = -EINVAL ;else - tp->snd_cwnd = val; +tcp_snd_cwnd_set (tp, val);break ;case TCP_BPF_SNDCWND_CLAMP :if (val <=0 ) {
net/ipv4/tcp.c +4 -4
@@ -429,7 +429,7 @@ void tcp_init_sock(struct sock *sk)* algorithms that we must have the following bandaid to talk * efficiently to them. -DaveM */ - tp->snd_cwnd =TCP_INIT_CWND ; +tcp_snd_cwnd_set (tp,TCP_INIT_CWND );/* There's a bubble in the pipe until at least the first ACK. */ tp->app_limited = ~0U ;
@@ -3033,7 +3033,7 @@ int tcp_disconnect(struct sock *sk, int flags) icsk->icsk_rto_min =TCP_RTO_MIN ; icsk->icsk_delack_max =TCP_DELACK_MAX ; tp->snd_ssthresh =TCP_INFINITE_SSTHRESH ; - tp->snd_cwnd =TCP_INIT_CWND ; +tcp_snd_cwnd_set (tp,TCP_INIT_CWND ); tp->snd_cwnd_cnt =0 ; tp->window_clamp =0 ; tp->delivered =0 ;
@@ -3744,7 +3744,7 @@ void tcp_get_info(struct sock *sk, struct tcp_info *info) info->tcpi_max_pacing_rate = rate64; info->tcpi_reordering = tp->reordering; - info->tcpi_snd_cwnd = tp->snd_cwnd; + info->tcpi_snd_cwnd =tcp_snd_cwnd (tp);if (info->tcpi_state ==TCP_LISTEN ) {/* listeners aliased fields :
@@ -3915,7 +3915,7 @@ struct sk_buff *tcp_get_timestamping_opt_stats(const struct sock *sk, rate64 =tcp_compute_delivery_rate (tp);nla_put_u64_64bit (stats,TCP_NLA_DELIVERY_RATE , rate64,TCP_NLA_PAD ); -nla_put_u32 (stats,TCP_NLA_SND_CWND , tp->snd_cwnd); +nla_put_u32 (stats,TCP_NLA_SND_CWND ,tcp_snd_cwnd (tp));nla_put_u32 (stats,TCP_NLA_REORDERING , tp->reordering);nla_put_u32 (stats,TCP_NLA_MIN_RTT ,tcp_min_rtt (tp));
net/ipv4/tcp_bbr.c +10 -10
@@ -276,7 +276,7 @@ static void bbr_init_pacing_rate_from_rtt(struct sock *sk) }else {/* no RTT sample yet */ rtt_us =USEC_PER_MSEC ;/* use nominal default RTT */ } - bw = (u64 )tp->snd_cwnd *BW_UNIT ; + bw = (u64 )tcp_snd_cwnd (tp) *BW_UNIT ;do_div (bw, rtt_us); sk->sk_pacing_rate =bbr_bw_to_pacing_rate (sk, bw, bbr_high_gain); }
@@ -323,9 +323,9 @@ static void bbr_save_cwnd(struct sock *sk)struct bbr *bbr =inet_csk_ca (sk);if (bbr->prev_ca_state < TCP_CA_Recovery && bbr->mode !=BBR_PROBE_RTT ) - bbr->prior_cwnd = tp->snd_cwnd;/* this cwnd is good enough */ + bbr->prior_cwnd =tcp_snd_cwnd (tp);/* this cwnd is good enough */ else /* loss recovery or BBR_PROBE_RTT have temporarily cut cwnd */ - bbr->prior_cwnd =max (bbr->prior_cwnd, tp->snd_cwnd); + bbr->prior_cwnd =max (bbr->prior_cwnd,tcp_snd_cwnd (tp)); }static void bbr_cwnd_event (struct sock *sk,enum tcp_ca_event event)
@@ -482,7 +482,7 @@ static bool bbr_set_cwnd_to_recover_or_restore(struct tcp_sock *tp =tcp_sk (sk);struct bbr *bbr =inet_csk_ca (sk);u8 prev_state = bbr->prev_ca_state, state =inet_csk (sk)->icsk_ca_state; -u32 cwnd = tp->snd_cwnd; +u32 cwnd =tcp_snd_cwnd (tp);/* An ACK for P pkts should release at most 2*P packets. We do this * in two steps. First, here we deduct the number of lost packets.
@@ -520,7 +520,7 @@ static void bbr_set_cwnd(struct sock *sk, const struct rate_sample *rs, {struct tcp_sock *tp =tcp_sk (sk);struct bbr *bbr =inet_csk_ca (sk); -u32 cwnd = tp->snd_cwnd, target_cwnd =0 ; +u32 cwnd =tcp_snd_cwnd (tp), target_cwnd =0 ;if (!acked) goto done;/* no packet fully ACKed; just apply caps */
@@ -544,9 +544,9 @@ static void bbr_set_cwnd(struct sock *sk, const struct rate_sample *rs, cwnd =max (cwnd, bbr_cwnd_min_target); done: - tp->snd_cwnd =min (cwnd, tp->snd_cwnd_clamp);/* apply global cap */ +tcp_snd_cwnd_set (tp,min (cwnd, tp->snd_cwnd_clamp));/* apply global cap */ if (bbr->mode ==BBR_PROBE_RTT )/* drain queue, refresh min_rtt */ - tp->snd_cwnd =min (tp->snd_cwnd, bbr_cwnd_min_target); +tcp_snd_cwnd_set (tp,min (tcp_snd_cwnd (tp), bbr_cwnd_min_target)); }/* End cycle phase if it's time and/or we hit the phase's in-flight target. */
@@ -856,7 +856,7 @@ static void bbr_update_ack_aggregation(struct sock *sk, bbr->ack_epoch_acked =min_t (u32,0xFFFFF , bbr->ack_epoch_acked + rs->acked_sacked); extra_acked = bbr->ack_epoch_acked - expected_acked; - extra_acked =min (extra_acked, tp->snd_cwnd); + extra_acked =min (extra_acked,tcp_snd_cwnd (tp));if (extra_acked > bbr->extra_acked[bbr->extra_acked_win_idx]) bbr->extra_acked[bbr->extra_acked_win_idx] = extra_acked; }
@@ -914,7 +914,7 @@ static void bbr_check_probe_rtt_done(struct sock *sk)return ; bbr->min_rtt_stamp = tcp_jiffies32;/* wait a while until PROBE_RTT */ - tp->snd_cwnd =max (tp->snd_cwnd, bbr->prior_cwnd); +tcp_snd_cwnd_set (tp,max (tcp_snd_cwnd (tp), bbr->prior_cwnd));bbr_reset_mode (sk); }
@@ -1093,7 +1093,7 @@ static u32 bbr_undo_cwnd(struct sock *sk) bbr->full_bw =0 ;/* spurious slow-down; reset full pipe detection */ bbr->full_bw_cnt =0 ;bbr_reset_lt_bw_sampling (sk); -return tcp_sk (sk)->snd_cwnd; +return tcp_snd_cwnd (tcp_sk (sk)); }/* Entering loss recovery, so save cwnd for when we exit or undo recovery. */
net/ipv4/tcp_bic.c +7 -7
@@ -150,7 +150,7 @@ static void bictcp_cong_avoid(struct sock *sk, u32 ack, u32 acked)if (!acked)return ; } -bictcp_update (ca, tp->snd_cwnd); +bictcp_update (ca,tcp_snd_cwnd (tp));tcp_cong_avoid_ai (tp, ca->cnt, acked); }
@@ -166,16 +166,16 @@ static u32 bictcp_recalc_ssthresh(struct sock *sk) ca->epoch_start =0 ;/* end of epoch */ /* Wmax and fast convergence */ -if (tp->snd_cwnd < ca->last_max_cwnd && fast_convergence) - ca->last_max_cwnd = (tp->snd_cwnd * (BICTCP_BETA_SCALE + beta)) +if (tcp_snd_cwnd (tp) < ca->last_max_cwnd && fast_convergence) + ca->last_max_cwnd = (tcp_snd_cwnd (tp) * (BICTCP_BETA_SCALE + beta)) / (2 *BICTCP_BETA_SCALE );else - ca->last_max_cwnd = tp->snd_cwnd; + ca->last_max_cwnd =tcp_snd_cwnd (tp); -if (tp->snd_cwnd <= low_window) -return max (tp->snd_cwnd >>1U ,2U ); +if (tcp_snd_cwnd (tp) <= low_window) +return max (tcp_snd_cwnd (tp) >>1U ,2U );else -return max ((tp->snd_cwnd * beta) /BICTCP_BETA_SCALE ,2U ); +return max ((tcp_snd_cwnd (tp) * beta) /BICTCP_BETA_SCALE ,2U ); }static void bictcp_state (struct sock *sk,u8 new_state)
net/ipv4/tcp_cdg.c +15 -15
@@ -161,8 +161,8 @@ static void tcp_cdg_hystart_update(struct sock *sk) LINUX_MIB_TCPHYSTARTTRAINDETECT);NET_ADD_STATS (sock_net (sk),LINUX_MIB_TCPHYSTARTTRAINCWND , - tp->snd_cwnd); - tp->snd_ssthresh = tp->snd_cwnd; +tcp_snd_cwnd (tp)); + tp->snd_ssthresh =tcp_snd_cwnd (tp);return ; } }
@@ -180,8 +180,8 @@ static void tcp_cdg_hystart_update(struct sock *sk) LINUX_MIB_TCPHYSTARTDELAYDETECT);NET_ADD_STATS (sock_net (sk),LINUX_MIB_TCPHYSTARTDELAYCWND , - tp->snd_cwnd); - tp->snd_ssthresh = tp->snd_cwnd; +tcp_snd_cwnd (tp)); + tp->snd_ssthresh =tcp_snd_cwnd (tp); } } }
@@ -252,7 +252,7 @@ static bool tcp_cdg_backoff(struct sock *sk, u32 grad)return false; } - ca->shadow_wnd =max (ca->shadow_wnd, tp->snd_cwnd); + ca->shadow_wnd =max (ca->shadow_wnd,tcp_snd_cwnd (tp)); ca->state =CDG_BACKOFF ;tcp_enter_cwr (sk);return true;
@@ -285,14 +285,14 @@ static void tcp_cdg_cong_avoid(struct sock *sk, u32 ack, u32 acked) }if (!tcp_is_cwnd_limited (sk)) { - ca->shadow_wnd =min (ca->shadow_wnd, tp->snd_cwnd); + ca->shadow_wnd =min (ca->shadow_wnd,tcp_snd_cwnd (tp));return ; } - prior_snd_cwnd = tp->snd_cwnd; + prior_snd_cwnd =tcp_snd_cwnd (tp);tcp_reno_cong_avoid (sk, ack, acked); - incr = tp->snd_cwnd - prior_snd_cwnd; + incr =tcp_snd_cwnd (tp) - prior_snd_cwnd; ca->shadow_wnd =max (ca->shadow_wnd, ca->shadow_wnd + incr); }
@@ -331,15 +331,15 @@ static u32 tcp_cdg_ssthresh(struct sock *sk)struct tcp_sock *tp =tcp_sk (sk);if (ca->state ==CDG_BACKOFF ) -return max (2U , (tp->snd_cwnd *min (1024U , backoff_beta)) >>10 ); +return max (2U , (tcp_snd_cwnd (tp) *min (1024U , backoff_beta)) >>10 );if (ca->state ==CDG_NONFULL && use_tolerance) -return tp->snd_cwnd; +return tcp_snd_cwnd (tp); - ca->shadow_wnd =min (ca->shadow_wnd >>1 , tp->snd_cwnd); + ca->shadow_wnd =min (ca->shadow_wnd >>1 ,tcp_snd_cwnd (tp));if (use_shadow) -return max3 (2U , ca->shadow_wnd, tp->snd_cwnd >>1 ); -return max (2U , tp->snd_cwnd >>1 ); +return max3 (2U , ca->shadow_wnd,tcp_snd_cwnd (tp) >>1 ); +return max (2U ,tcp_snd_cwnd (tp) >>1 ); }static void tcp_cdg_cwnd_event (struct sock *sk,const enum tcp_ca_event ev)
@@ -357,7 +357,7 @@ static void tcp_cdg_cwnd_event(struct sock *sk, const enum tcp_ca_event ev) ca->gradients = gradients; ca->rtt_seq = tp->snd_nxt; - ca->shadow_wnd = tp->snd_cwnd; + ca->shadow_wnd =tcp_snd_cwnd (tp);break ;case CA_EVENT_COMPLETE_CWR : ca->state =CDG_UNKNOWN ;
@@ -380,7 +380,7 @@ static void tcp_cdg_init(struct sock *sk) ca->gradients =kcalloc (window,sizeof (ca->gradients[0 ]),GFP_NOWAIT | __GFP_NOWARN); ca->rtt_seq = tp->snd_nxt; - ca->shadow_wnd = tp->snd_cwnd; + ca->shadow_wnd =tcp_snd_cwnd (tp); }static void tcp_cdg_release (struct sock *sk)
net/ipv4/tcp_cong.c +9 -9
@@ -393,10 +393,10 @@ int tcp_set_congestion_control(struct sock *sk, const char *name, bool load,*/ u32 tcp_slow_start (struct tcp_sock *tp,u32 acked) { -u32 cwnd =min (tp->snd_cwnd + acked, tp->snd_ssthresh); +u32 cwnd =min (tcp_snd_cwnd (tp) + acked, tp->snd_ssthresh); - acked -= cwnd - tp->snd_cwnd; - tp->snd_cwnd =min (cwnd, tp->snd_cwnd_clamp); + acked -= cwnd -tcp_snd_cwnd (tp); +tcp_snd_cwnd_set (tp,min (cwnd, tp->snd_cwnd_clamp));return acked; }
@@ -410,7 +410,7 @@ void tcp_cong_avoid_ai(struct tcp_sock *tp, u32 w, u32 acked)/* If credits accumulated at a higher w, apply them gently now. */ if (tp->snd_cwnd_cnt >= w) { tp->snd_cwnd_cnt =0 ; - tp->snd_cwnd++; +tcp_snd_cwnd_set (tp,tcp_snd_cwnd (tp) +1 ); } tp->snd_cwnd_cnt += acked;
@@ -418,9 +418,9 @@ void tcp_cong_avoid_ai(struct tcp_sock *tp, u32 w, u32 acked)u32 delta = tp->snd_cwnd_cnt / w; tp->snd_cwnd_cnt -= delta * w; - tp->snd_cwnd += delta; +tcp_snd_cwnd_set (tp,tcp_snd_cwnd (tp) + delta); } - tp->snd_cwnd =min (tp->snd_cwnd, tp->snd_cwnd_clamp); +tcp_snd_cwnd_set (tp,min (tcp_snd_cwnd (tp), tp->snd_cwnd_clamp)); }EXPORT_SYMBOL_GPL (tcp_cong_avoid_ai);
@@ -445,7 +445,7 @@ void tcp_reno_cong_avoid(struct sock *sk, u32 ack, u32 acked)return ; }/* In dangerous area, increase slowly. */ -tcp_cong_avoid_ai (tp, tp->snd_cwnd, acked); +tcp_cong_avoid_ai (tp,tcp_snd_cwnd (tp), acked); }EXPORT_SYMBOL_GPL (tcp_reno_cong_avoid);
@@ -454,7 +454,7 @@ u32 tcp_reno_ssthresh(struct sock *sk) {const struct tcp_sock *tp =tcp_sk (sk); -return max (tp->snd_cwnd >>1U ,2U ); +return max (tcp_snd_cwnd (tp) >>1U ,2U ); }EXPORT_SYMBOL_GPL (tcp_reno_ssthresh);
@@ -462,7 +462,7 @@ u32 tcp_reno_undo_cwnd(struct sock *sk) {const struct tcp_sock *tp =tcp_sk (sk); -return max (tp->snd_cwnd, tp->prior_cwnd); +return max (tcp_snd_cwnd (tp), tp->prior_cwnd); }EXPORT_SYMBOL_GPL (tcp_reno_undo_cwnd);
net/ipv4/tcp_cubic.c +11 -11
@@ -334,7 +334,7 @@ static void cubictcp_cong_avoid(struct sock *sk, u32 ack, u32 acked)if (!acked)return ; } -bictcp_update (ca, tp->snd_cwnd, acked); +bictcp_update (ca,tcp_snd_cwnd (tp), acked);tcp_cong_avoid_ai (tp, ca->cnt, acked); }
@@ -346,13 +346,13 @@ static u32 cubictcp_recalc_ssthresh(struct sock *sk) ca->epoch_start =0 ;/* end of epoch */ /* Wmax and fast convergence */ -if (tp->snd_cwnd < ca->last_max_cwnd && fast_convergence) - ca->last_max_cwnd = (tp->snd_cwnd * (BICTCP_BETA_SCALE + beta)) +if (tcp_snd_cwnd (tp) < ca->last_max_cwnd && fast_convergence) + ca->last_max_cwnd = (tcp_snd_cwnd (tp) * (BICTCP_BETA_SCALE + beta)) / (2 *BICTCP_BETA_SCALE );else - ca->last_max_cwnd = tp->snd_cwnd; + ca->last_max_cwnd =tcp_snd_cwnd (tp); -return max ((tp->snd_cwnd * beta) /BICTCP_BETA_SCALE ,2U ); +return max ((tcp_snd_cwnd (tp) * beta) /BICTCP_BETA_SCALE ,2U ); }static void cubictcp_state (struct sock *sk,u8 new_state)
@@ -413,13 +413,13 @@ static void hystart_update(struct sock *sk, u32 delay) ca->found =1 ;pr_debug ("hystart_ack_train (%u > %u) delay_min %u (+ ack_delay %u) cwnd %u\n" , now - ca->round_start, threshold, - ca->delay_min,hystart_ack_delay (sk), tp->snd_cwnd); + ca->delay_min,hystart_ack_delay (sk),tcp_snd_cwnd (tp));NET_INC_STATS (sock_net (sk),LINUX_MIB_TCPHYSTARTTRAINDETECT );NET_ADD_STATS (sock_net (sk),LINUX_MIB_TCPHYSTARTTRAINCWND , - tp->snd_cwnd); - tp->snd_ssthresh = tp->snd_cwnd; +tcp_snd_cwnd (tp)); + tp->snd_ssthresh =tcp_snd_cwnd (tp); } } }
@@ -438,8 +438,8 @@ static void hystart_update(struct sock *sk, u32 delay) LINUX_MIB_TCPHYSTARTDELAYDETECT);NET_ADD_STATS (sock_net (sk),LINUX_MIB_TCPHYSTARTDELAYCWND , - tp->snd_cwnd); - tp->snd_ssthresh = tp->snd_cwnd; +tcp_snd_cwnd (tp)); + tp->snd_ssthresh =tcp_snd_cwnd (tp); } } }
@@ -469,7 +469,7 @@ static void cubictcp_acked(struct sock *sk, const struct ack_sample *sample)/* hystart triggers when cwnd is larger than some threshold */ if (!ca->found &&tcp_in_slow_start (tp) && hystart && - tp->snd_cwnd >= hystart_low_window) +tcp_snd_cwnd (tp) >= hystart_low_window)hystart_update (sk, delay); }
net/ipv4/tcp_dctcp.c +6 -5
@@ -106,8 +106,8 @@ static u32 dctcp_ssthresh(struct sock *sk)struct dctcp *ca =inet_csk_ca (sk);struct tcp_sock *tp =tcp_sk (sk); - ca->loss_cwnd = tp->snd_cwnd; -return max (tp->snd_cwnd - ((tp->snd_cwnd * ca->dctcp_alpha) >>11U ),2U ); + ca->loss_cwnd =tcp_snd_cwnd (tp); +return max (tcp_snd_cwnd (tp) - ((tcp_snd_cwnd (tp) * ca->dctcp_alpha) >>11U ),2U ); }static void dctcp_update_alpha (struct sock *sk,u32 flags)
@@ -148,8 +148,8 @@ static void dctcp_react_to_loss(struct sock *sk)struct dctcp *ca =inet_csk_ca (sk);struct tcp_sock *tp =tcp_sk (sk); - ca->loss_cwnd = tp->snd_cwnd; - tp->snd_ssthresh =max (tp->snd_cwnd >>1U ,2U ); + ca->loss_cwnd =tcp_snd_cwnd (tp); + tp->snd_ssthresh =max (tcp_snd_cwnd (tp) >>1U ,2U ); }static void dctcp_state (struct sock *sk,u8 new_state)
@@ -211,8 +211,9 @@ static size_t dctcp_get_info(struct sock *sk, u32 ext, int *attr,static u32 dctcp_cwnd_undo (struct sock *sk) {const struct dctcp *ca =inet_csk_ca (sk); +struct tcp_sock *tp =tcp_sk (sk); -return max (tcp_sk (sk)->snd_cwnd, ca->loss_cwnd); +return max (tcp_snd_cwnd (tp), ca->loss_cwnd); }static struct tcp_congestion_ops dctcp__read_mostly = {
net/ipv4/tcp_highspeed.c +9 -9
@@ -127,22 +127,22 @@ static void hstcp_cong_avoid(struct sock *sk, u32 ack, u32 acked)* snd_cwnd <= * hstcp_aimd_vals[ca->ai].cwnd */ -if (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd) { -while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd && +if (tcp_snd_cwnd (tp) > hstcp_aimd_vals[ca->ai].cwnd) { +while (tcp_snd_cwnd (tp) > hstcp_aimd_vals[ca->ai].cwnd && ca->ai <HSTCP_AIMD_MAX -1 ) ca->ai++; - }else if (ca->ai && tp->snd_cwnd <= hstcp_aimd_vals[ca->ai-1 ].cwnd) { -while (ca->ai && tp->snd_cwnd <= hstcp_aimd_vals[ca->ai-1 ].cwnd) + }else if (ca->ai &&tcp_snd_cwnd (tp) <= hstcp_aimd_vals[ca->ai-1 ].cwnd) { +while (ca->ai &&tcp_snd_cwnd (tp) <= hstcp_aimd_vals[ca->ai-1 ].cwnd) ca->ai--; }/* Do additive increase */ -if (tp->snd_cwnd < tp->snd_cwnd_clamp) { +if (tcp_snd_cwnd (tp) < tp->snd_cwnd_clamp) {/* cwnd = cwnd + a(w) / cwnd */ tp->snd_cwnd_cnt += ca->ai +1 ; -if (tp->snd_cwnd_cnt >= tp->snd_cwnd) { - tp->snd_cwnd_cnt -= tp->snd_cwnd; - tp->snd_cwnd++; +if (tp->snd_cwnd_cnt >=tcp_snd_cwnd (tp)) { + tp->snd_cwnd_cnt -=tcp_snd_cwnd (tp); +tcp_snd_cwnd_set (tp,tcp_snd_cwnd (tp) +1 ); } } }
@@ -154,7 +154,7 @@ static u32 hstcp_ssthresh(struct sock *sk)struct hstcp *ca =inet_csk_ca (sk);/* Do multiplicative decrease */ -return max (tp->snd_cwnd - ((tp->snd_cwnd * hstcp_aimd_vals[ca->ai].md) >>8 ),2U ); +return max (tcp_snd_cwnd (tp) - ((tcp_snd_cwnd (tp) * hstcp_aimd_vals[ca->ai].md) >>8 ),2U ); }static struct tcp_congestion_ops tcp_highspeed__read_mostly = {
net/ipv4/tcp_htcp.c +5 -5
@@ -124,7 +124,7 @@ static void measure_achieved_throughput(struct sock *sk, ca->packetcount += sample->pkts_acked; -if (ca->packetcount >= tp->snd_cwnd - (ca->alpha >>7 ? :1 ) && +if (ca->packetcount >=tcp_snd_cwnd (tp) - (ca->alpha >>7 ? :1 ) && now - ca->lasttime >= ca->minRTT && ca->minRTT >0 ) {__u32 cur_Bi = ca->packetcount *HZ / (now - ca->lasttime);
@@ -225,7 +225,7 @@ static u32 htcp_recalc_ssthresh(struct sock *sk)const struct htcp *ca =inet_csk_ca (sk);htcp_param_update (sk); -return max ((tp->snd_cwnd * ca->beta) >>7 ,2U ); +return max ((tcp_snd_cwnd (tp) * ca->beta) >>7 ,2U ); }static void htcp_cong_avoid (struct sock *sk,u32 ack,u32 acked)
@@ -242,9 +242,9 @@ static void htcp_cong_avoid(struct sock *sk, u32 ack, u32 acked)/* In dangerous area, increase slowly. * In theory this is tp->snd_cwnd += alpha / tp->snd_cwnd */ -if ((tp->snd_cwnd_cnt * ca->alpha)>>7 >= tp->snd_cwnd) { -if (tp->snd_cwnd < tp->snd_cwnd_clamp) - tp->snd_cwnd++; +if ((tp->snd_cwnd_cnt * ca->alpha)>>7 >=tcp_snd_cwnd (tp)) { +if (tcp_snd_cwnd (tp) < tp->snd_cwnd_clamp) +tcp_snd_cwnd_set (tp,tcp_snd_cwnd (tp) +1 ); tp->snd_cwnd_cnt =0 ;htcp_alpha_update (ca); }else
net/ipv4/tcp_hybla.c +9 -9
@@ -54,7 +54,7 @@ static void hybla_init(struct sock *sk) ca->rho2_7ls =0 ; ca->snd_cwnd_cents =0 ; ca->hybla_en = true; - tp->snd_cwnd =2 ; +tcp_snd_cwnd_set (tp,2 ); tp->snd_cwnd_clamp =65535 ;/* 1st Rho measurement based on initial srtt */
@@ -62,7 +62,7 @@ static void hybla_init(struct sock *sk)/* set minimum rtt as this is the 1st ever seen */ ca->minrtt_us = tp->srtt_us; - tp->snd_cwnd = ca->rho; +tcp_snd_cwnd_set (tp, ca->rho); }static void hybla_state (struct sock *sk,u8 ca_state)
@@ -137,31 +137,31 @@ static void hybla_cong_avoid(struct sock *sk, u32 ack, u32 acked)* as long as increment is estimated as (rho<<7)/window * it already is <<7 and we can easily count its fractions. */ - increment = ca->rho2_7ls / tp->snd_cwnd; + increment = ca->rho2_7ls /tcp_snd_cwnd (tp);if (increment <128 ) tp->snd_cwnd_cnt++; } odd = increment %128 ; - tp->snd_cwnd += increment >>7 ; +tcp_snd_cwnd_set (tp,tcp_snd_cwnd (tp) + (increment >>7 )); ca->snd_cwnd_cents += odd;/* check when fractions goes >=128 and increase cwnd by 1. */ while (ca->snd_cwnd_cents >=128 ) { - tp->snd_cwnd++; +tcp_snd_cwnd_set (tp,tcp_snd_cwnd (tp) +1 ); ca->snd_cwnd_cents -=128 ; tp->snd_cwnd_cnt =0 ; }/* check when cwnd has not been incremented for a while */ -if (increment ==0 && odd ==0 && tp->snd_cwnd_cnt >= tp->snd_cwnd) { - tp->snd_cwnd++; +if (increment ==0 && odd ==0 && tp->snd_cwnd_cnt >=tcp_snd_cwnd (tp)) { +tcp_snd_cwnd_set (tp,tcp_snd_cwnd (tp) +1 ); tp->snd_cwnd_cnt =0 ; }/* clamp down slowstart cwnd to ssthresh value. */ if (is_slowstart) - tp->snd_cwnd =min (tp->snd_cwnd, tp->snd_ssthresh); +tcp_snd_cwnd_set (tp,min (tcp_snd_cwnd (tp), tp->snd_ssthresh)); - tp->snd_cwnd =min_t (u32, tp->snd_cwnd, tp->snd_cwnd_clamp); +tcp_snd_cwnd_set (tp,min (tcp_snd_cwnd (tp), tp->snd_cwnd_clamp)); }static struct tcp_congestion_ops tcp_hybla__read_mostly = {
net/ipv4/tcp_illinois.c +7 -5
@@ -224,7 +224,7 @@ static void update_params(struct sock *sk)struct tcp_sock *tp =tcp_sk (sk);struct illinois *ca =inet_csk_ca (sk); -if (tp->snd_cwnd < win_thresh) { +if (tcp_snd_cwnd (tp) < win_thresh) { ca->alpha =ALPHA_BASE ; ca->beta =BETA_BASE ; }else if (ca->cnt_rtt >0 ) {
@@ -284,9 +284,9 @@ static void tcp_illinois_cong_avoid(struct sock *sk, u32 ack, u32 acked)* tp->snd_cwnd += alpha/tp->snd_cwnd */ delta = (tp->snd_cwnd_cnt * ca->alpha) >>ALPHA_SHIFT ; -if (delta >= tp->snd_cwnd) { - tp->snd_cwnd =min (tp->snd_cwnd + delta / tp->snd_cwnd, - (u32 )tp->snd_cwnd_clamp); +if (delta >=tcp_snd_cwnd (tp)) { +tcp_snd_cwnd_set (tp,min (tcp_snd_cwnd (tp) + delta /tcp_snd_cwnd (tp), + (u32 )tp->snd_cwnd_clamp)); tp->snd_cwnd_cnt =0 ; } }
@@ -296,9 +296,11 @@ static u32 tcp_illinois_ssthresh(struct sock *sk) {struct tcp_sock *tp =tcp_sk (sk);struct illinois *ca =inet_csk_ca (sk); +u32 decr;/* Multiplicative decrease */ -return max (tp->snd_cwnd - ((tp->snd_cwnd * ca->beta) >>BETA_SHIFT ),2U ); + decr = (tcp_snd_cwnd (tp) * ca->beta) >>BETA_SHIFT ; +return max (tcp_snd_cwnd (tp) - decr,2U ); }/* Extract info for Tcp socket info provided via netlink. */
net/ipv4/tcp_input.c +18 -18
@@ -414,7 +414,7 @@ static void tcp_sndbuf_expand(struct sock *sk) per_mss =roundup_pow_of_two (per_mss) +SKB_DATA_ALIGN (sizeof (struct sk_buff )); - nr_segs =max_t (u32,TCP_INIT_CWND , tp->snd_cwnd); + nr_segs =max_t (u32,TCP_INIT_CWND ,tcp_snd_cwnd (tp)); nr_segs =max_t (u32, nr_segs, tp->reordering +1 );/* Fast Recovery (RFC 5681 3.2) :
@@ -909,12 +909,12 @@ static void tcp_update_pacing_rate(struct sock *sk)* If snd_cwnd >= (tp->snd_ssthresh / 2), we are approaching * end of slow start and should slow down. */ -if (tp->snd_cwnd < tp->snd_ssthresh /2 ) +if (tcp_snd_cwnd (tp) < tp->snd_ssthresh /2 ) rate *=sock_net (sk)->ipv4.sysctl_tcp_pacing_ss_ratio;else rate *=sock_net (sk)->ipv4.sysctl_tcp_pacing_ca_ratio; - rate *=max (tp->snd_cwnd, tp->packets_out); + rate *=max (tcp_snd_cwnd (tp), tp->packets_out);if (likely (tp->srtt_us))do_div (rate, tp->srtt_us);
@@ -2147,12 +2147,12 @@ void tcp_enter_loss(struct sock *sk) !after(tp->high_seq, tp->snd_una) || (icsk->icsk_ca_state == TCP_CA_Loss && !icsk->icsk_retransmits)) { tp->prior_ssthresh =tcp_current_ssthresh (sk); - tp->prior_cwnd = tp->snd_cwnd; + tp->prior_cwnd =tcp_snd_cwnd (tp); tp->snd_ssthresh = icsk->icsk_ca_ops->ssthresh (sk);tcp_ca_event (sk,CA_EVENT_LOSS );tcp_init_undo (tp); } - tp->snd_cwnd =tcp_packets_in_flight (tp) +1 ; +tcp_snd_cwnd_set (tp,tcp_packets_in_flight (tp) +1 ); tp->snd_cwnd_cnt =0 ; tp->snd_cwnd_stamp = tcp_jiffies32;
@@ -2458,7 +2458,7 @@ static void DBGUNDO(struct sock *sk, const char *msg)pr_debug ("Undo %s %pI4/%u c%u l%u ss%u/%u p%u\n" , msg, &inet->inet_daddr,ntohs (inet->inet_dport), - tp->snd_cwnd,tcp_left_out (tp), +tcp_snd_cwnd (tp),tcp_left_out (tp), tp->snd_ssthresh, tp->prior_ssthresh, tp->packets_out); }
@@ -2467,7 +2467,7 @@ static void DBGUNDO(struct sock *sk, const char *msg)pr_debug ("Undo %s %pI6/%u c%u l%u ss%u/%u p%u\n" , msg, &sk->sk_v6_daddr,ntohs (inet->inet_dport), - tp->snd_cwnd,tcp_left_out (tp), +tcp_snd_cwnd (tp),tcp_left_out (tp), tp->snd_ssthresh, tp->prior_ssthresh, tp->packets_out); }
@@ -2492,7 +2492,7 @@ static void tcp_undo_cwnd_reduction(struct sock *sk, bool unmark_loss)if (tp->prior_ssthresh) {const struct inet_connection_sock *icsk =inet_csk (sk); - tp->snd_cwnd = icsk->icsk_ca_ops->undo_cwnd (sk); +tcp_snd_cwnd_set (tp, icsk->icsk_ca_ops->undo_cwnd (sk));if (tp->prior_ssthresh > tp->snd_ssthresh) { tp->snd_ssthresh = tp->prior_ssthresh;
@@ -2599,7 +2599,7 @@ static void tcp_init_cwnd_reduction(struct sock *sk) tp->high_seq = tp->snd_nxt; tp->tlp_high_seq =0 ; tp->snd_cwnd_cnt =0 ; - tp->prior_cwnd = tp->snd_cwnd; + tp->prior_cwnd =tcp_snd_cwnd (tp); tp->prr_delivered =0 ; tp->prr_out =0 ; tp->snd_ssthresh =inet_csk (sk)->icsk_ca_ops->ssthresh (sk);
@@ -2629,7 +2629,7 @@ void tcp_cwnd_reduction(struct sock *sk, int newly_acked_sacked, int newly_lost, }/* Force a fast retransmit upon entering fast recovery */ sndcnt =max (sndcnt, (tp->prr_out ?0 :1 )); - tp->snd_cwnd =tcp_packets_in_flight (tp) + sndcnt; +tcp_snd_cwnd_set (tp,tcp_packets_in_flight (tp) + sndcnt); }static inline void tcp_end_cwnd_reduction (struct sock *sk)
@@ -2642,7 +2642,7 @@ static inline void tcp_end_cwnd_reduction(struct sock *sk)/* Reset cwnd to ssthresh in CWR or Recovery (unless it's undone) */ if (tp->snd_ssthresh <TCP_INFINITE_SSTHRESH && (inet_csk (sk)->icsk_ca_state ==TCP_CA_CWR || tp->undo_marker)) { - tp->snd_cwnd = tp->snd_ssthresh; +tcp_snd_cwnd_set (tp, tp->snd_ssthresh); tp->snd_cwnd_stamp = tcp_jiffies32; }tcp_ca_event (sk,CA_EVENT_COMPLETE_CWR );
@@ -2709,9 +2709,9 @@ static void tcp_mtup_probe_success(struct sock *sk)/* FIXME: breaks with very large cwnd */ tp->prior_ssthresh =tcp_current_ssthresh (sk); - tp->snd_cwnd = tp->snd_cwnd * -tcp_mss_to_mtu (sk, tp->mss_cache) / - icsk->icsk_mtup.probe_size; +tcp_snd_cwnd_set (tp,tcp_snd_cwnd (tp) * +tcp_mss_to_mtu (sk, tp->mss_cache) / + icsk->icsk_mtup.probe_size); tp->snd_cwnd_cnt =0 ; tp->snd_cwnd_stamp = tcp_jiffies32; tp->snd_ssthresh =tcp_current_ssthresh (sk);
@@ -3034,7 +3034,7 @@ static void tcp_fastretrans_alert(struct sock *sk, const u32 prior_snd_una, tp->snd_una == tp->mtu_probe.probe_seq_start) {tcp_mtup_probe_failed (sk);/* Restores the reduction we did in tcp_mtup_probe() */ - tp->snd_cwnd++; +tcp_snd_cwnd_set (tp,tcp_snd_cwnd (tp) +1 );tcp_simple_retransmit (sk);return ; }
@@ -5437,7 +5437,7 @@ static bool tcp_should_expand_sndbuf(struct sock *sk)return false;/* If we filled the congestion window, do not expand. */ -if (tcp_packets_in_flight (tp) >= tp->snd_cwnd) +if (tcp_packets_in_flight (tp) >=tcp_snd_cwnd (tp))return false;return true;
@@ -6013,9 +6013,9 @@ void tcp_init_transfer(struct sock *sk, int bpf_op, struct sk_buff *skb)* retransmission has occurred. */ if (tp->total_retrans >1 && tp->undo_marker) - tp->snd_cwnd =1 ; +tcp_snd_cwnd_set (tp,1 );else - tp->snd_cwnd =tcp_init_cwnd (tp,__sk_dst_get (sk)); +tcp_snd_cwnd_set (tp,tcp_init_cwnd (tp,__sk_dst_get (sk))); tp->snd_cwnd_stamp = tcp_jiffies32;bpf_skops_established (sk, bpf_op, skb);
net/ipv4/tcp_ipv4.c +1 -1
@@ -2621,7 +2621,7 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i)jiffies_to_clock_t (icsk->icsk_rto),jiffies_to_clock_t (icsk->icsk_ack.ato), (icsk->icsk_ack.quick <<1 ) |inet_csk_in_pingpong_mode (sk), - tp->snd_cwnd, +tcp_snd_cwnd (tp), state ==TCP_LISTEN ? fastopenq->max_qlen : (tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh));
net/ipv4/tcp_lp.c +3 -3
@@ -297,7 +297,7 @@ static void tcp_lp_pkts_acked(struct sock *sk, const struct ack_sample *sample) lp->flag &= ~LP_WITHIN_THR ;pr_debug ("TCP-LP: %05o|%5u|%5u|%15u|%15u|%15u\n" , lp->flag, - tp->snd_cwnd, lp->remote_hz, lp->owd_min, lp->owd_max, +tcp_snd_cwnd (tp), lp->remote_hz, lp->owd_min, lp->owd_max, lp->sowd >>3 );if (lp->flag &LP_WITHIN_THR )
@@ -313,12 +313,12 @@ static void tcp_lp_pkts_acked(struct sock *sk, const struct ack_sample *sample)/* happened within inference * drop snd_cwnd into 1 */ if (lp->flag &LP_WITHIN_INF ) - tp->snd_cwnd =1U ; +tcp_snd_cwnd_set (tp,1U );/* happened after inference * cut snd_cwnd into half */ else - tp->snd_cwnd =max (tp->snd_cwnd >>1U ,1U ); +tcp_snd_cwnd_set (tp,max (tcp_snd_cwnd (tp) >>1U ,1U ));/* record this drop time */ lp->last_drop = now;
net/ipv4/tcp_metrics.c +6 -6
@@ -388,15 +388,15 @@ void tcp_update_metrics(struct sock *sk)if (!net->ipv4.sysctl_tcp_no_ssthresh_metrics_save && !tcp_metric_locked (tm,TCP_METRIC_SSTHRESH )) { val =tcp_metric_get (tm,TCP_METRIC_SSTHRESH ); -if (val && (tp->snd_cwnd >>1 ) > val) +if (val && (tcp_snd_cwnd (tp) >>1 ) > val)tcp_metric_set (tm,TCP_METRIC_SSTHRESH , - tp->snd_cwnd >>1 ); +tcp_snd_cwnd (tp) >>1 ); }if (!tcp_metric_locked (tm,TCP_METRIC_CWND )) { val =tcp_metric_get (tm,TCP_METRIC_CWND ); -if (tp->snd_cwnd > val) +if (tcp_snd_cwnd (tp) > val)tcp_metric_set (tm,TCP_METRIC_CWND , - tp->snd_cwnd); +tcp_snd_cwnd (tp)); } }else if (!tcp_in_slow_start (tp) && icsk->icsk_ca_state == TCP_CA_Open) {
@@ -404,10 +404,10 @@ void tcp_update_metrics(struct sock *sk)if (!net->ipv4.sysctl_tcp_no_ssthresh_metrics_save && !tcp_metric_locked (tm,TCP_METRIC_SSTHRESH ))tcp_metric_set (tm,TCP_METRIC_SSTHRESH , -max (tp->snd_cwnd >>1 , tp->snd_ssthresh)); +max (tcp_snd_cwnd (tp) >>1 , tp->snd_ssthresh));if (!tcp_metric_locked (tm,TCP_METRIC_CWND )) { val =tcp_metric_get (tm,TCP_METRIC_CWND ); -tcp_metric_set (tm,TCP_METRIC_CWND , (val + tp->snd_cwnd) >>1 ); +tcp_metric_set (tm,TCP_METRIC_CWND , (val +tcp_snd_cwnd (tp)) >>1 ); } }else {/* Else slow start did not finish, cwnd is non-sense,
net/ipv4/tcp_nv.c +12 -12
@@ -197,10 +197,10 @@ static void tcpnv_cong_avoid(struct sock *sk, u32 ack, u32 acked) }if (ca->cwnd_growth_factor <0 ) { - cnt = tp->snd_cwnd << -ca->cwnd_growth_factor; + cnt =tcp_snd_cwnd (tp) << -ca->cwnd_growth_factor;tcp_cong_avoid_ai (tp, cnt, acked); }else { - cnt =max (4U , tp->snd_cwnd >> ca->cwnd_growth_factor); + cnt =max (4U ,tcp_snd_cwnd (tp) >> ca->cwnd_growth_factor);tcp_cong_avoid_ai (tp, cnt, acked); } }
@@ -209,7 +209,7 @@ static u32 tcpnv_recalc_ssthresh(struct sock *sk) {const struct tcp_sock *tp =tcp_sk (sk); -return max ((tp->snd_cwnd * nv_loss_dec_factor) >>10 ,2U ); +return max ((tcp_snd_cwnd (tp) * nv_loss_dec_factor) >>10 ,2U ); }static void tcpnv_state (struct sock *sk,u8 new_state)
@@ -257,7 +257,7 @@ static void tcpnv_acked(struct sock *sk, const struct ack_sample *sample)return ;/* Stop cwnd growth if we were in catch up mode */ -if (ca->nv_catchup && tp->snd_cwnd >= nv_min_cwnd) { +if (ca->nv_catchup &&tcp_snd_cwnd (tp) >= nv_min_cwnd) { ca->nv_catchup =0 ; ca->nv_allow_cwnd_growth =0 ; }
@@ -371,7 +371,7 @@ static void tcpnv_acked(struct sock *sk, const struct ack_sample *sample)* if cwnd < max_win, grow cwnd * else leave the same */ -if (tp->snd_cwnd > max_win) { +if (tcp_snd_cwnd (tp) > max_win) {/* there is congestion, check that it is ok * to make a CA decision * 1. We should have at least nv_dec_eval_min_calls
@@ -398,20 +398,20 @@ static void tcpnv_acked(struct sock *sk, const struct ack_sample *sample) ca->nv_allow_cwnd_growth =0 ; tp->snd_ssthresh = (nv_ssthresh_factor * max_win) >>3 ; -if (tp->snd_cwnd - max_win >2 ) { +if (tcp_snd_cwnd (tp) - max_win >2 ) {/* gap > 2, we do exponential cwnd decrease */ int dec; - dec =max (2U , ((tp->snd_cwnd - max_win) * + dec =max (2U , ((tcp_snd_cwnd (tp) - max_win) * nv_cong_dec_mult) >>7 ); - tp->snd_cwnd -= dec; +tcp_snd_cwnd_set (tp,tcp_snd_cwnd (tp) - dec); }else if (nv_cong_dec_mult >0 ) { - tp->snd_cwnd = max_win; +tcp_snd_cwnd_set (tp, max_win); }if (ca->cwnd_growth_factor >0 ) ca->cwnd_growth_factor =0 ; ca->nv_no_cong_cnt =0 ; - }else if (tp->snd_cwnd <= max_win - nv_pad_buffer) { + }else if (tcp_snd_cwnd (tp) <= max_win - nv_pad_buffer) {/* There is no congestion, grow cwnd if allowed*/ if (ca->nv_eval_call_cnt < nv_inc_eval_min_calls)return ;
@@ -444,8 +444,8 @@ static void tcpnv_acked(struct sock *sk, const struct ack_sample *sample)* (it wasn't before, if it is now is because nv * decreased it). */ -if (tp->snd_cwnd < nv_min_cwnd) - tp->snd_cwnd = nv_min_cwnd; +if (tcp_snd_cwnd (tp) < nv_min_cwnd) +tcp_snd_cwnd_set (tp, nv_min_cwnd); } }
net/ipv4/tcp_output.c +15 -15
@@ -143,7 +143,7 @@ void tcp_cwnd_restart(struct sock *sk, s32 delta) {struct tcp_sock *tp =tcp_sk (sk);u32 restart_cwnd =tcp_init_cwnd (tp,__sk_dst_get (sk)); -u32 cwnd = tp->snd_cwnd; +u32 cwnd =tcp_snd_cwnd (tp);tcp_ca_event (sk,CA_EVENT_CWND_RESTART );
@@ -152,7 +152,7 @@ void tcp_cwnd_restart(struct sock *sk, s32 delta)while ((delta -=inet_csk (sk)->icsk_rto) >0 && cwnd > restart_cwnd) cwnd >>=1 ; - tp->snd_cwnd =max (cwnd, restart_cwnd); +tcp_snd_cwnd_set (tp,max (cwnd, restart_cwnd)); tp->snd_cwnd_stamp = tcp_jiffies32; tp->snd_cwnd_used =0 ; }
@@ -1014,7 +1014,7 @@ static void tcp_tsq_write(struct sock *sk)struct tcp_sock *tp =tcp_sk (sk);if (tp->lost_out > tp->retrans_out && - tp->snd_cwnd >tcp_packets_in_flight (tp)) { +tcp_snd_cwnd (tp) >tcp_packets_in_flight (tp)) {tcp_mstamp_refresh (tp);tcp_xmit_retransmit_queue (sk); }
@@ -1861,9 +1861,9 @@ static void tcp_cwnd_application_limited(struct sock *sk)/* Limited by application or receiver window. */ u32 init_win =tcp_init_cwnd (tp,__sk_dst_get (sk));u32 win_used =max (tp->snd_cwnd_used, init_win); -if (win_used < tp->snd_cwnd) { +if (win_used <tcp_snd_cwnd (tp)) { tp->snd_ssthresh =tcp_current_ssthresh (sk); - tp->snd_cwnd = (tp->snd_cwnd + win_used) >>1 ; +tcp_snd_cwnd_set (tp, (tcp_snd_cwnd (tp) + win_used) >>1 ); } tp->snd_cwnd_used =0 ; }
@@ -2044,7 +2044,7 @@ static inline unsigned int tcp_cwnd_test(const struct tcp_sock *tp,return 1 ; in_flight =tcp_packets_in_flight (tp); - cwnd = tp->snd_cwnd; + cwnd =tcp_snd_cwnd (tp);if (in_flight >= cwnd)return 0 ;
@@ -2197,12 +2197,12 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb, in_flight =tcp_packets_in_flight (tp);BUG_ON (tcp_skb_pcount (skb) <=1 ); -BUG_ON (tp->snd_cwnd <= in_flight); +BUG_ON (tcp_snd_cwnd (tp) <= in_flight); send_win =tcp_wnd_end (tp) -TCP_SKB_CB (skb)->seq;/* From in_flight test above, we know that cwnd > in_flight. */ - cong_win = (tp->snd_cwnd - in_flight) * tp->mss_cache; + cong_win = (tcp_snd_cwnd (tp) - in_flight) * tp->mss_cache; limit =min (send_win, cong_win);
@@ -2216,7 +2216,7 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb, win_divisor =READ_ONCE (sock_net (sk)->ipv4.sysctl_tcp_tso_win_divisor);if (win_divisor) { -u32 chunk =min (tp->snd_wnd, tp->snd_cwnd * tp->mss_cache); +u32 chunk =min (tp->snd_wnd,tcp_snd_cwnd (tp) * tp->mss_cache);/* If at least some fraction of a window is available, * just use it.
@@ -2346,7 +2346,7 @@ static int tcp_mtu_probe(struct sock *sk)if (likely (!icsk->icsk_mtup.enabled || icsk->icsk_mtup.probe_size ||inet_csk (sk)->icsk_ca_state != TCP_CA_Open || - tp->snd_cwnd <11 || +tcp_snd_cwnd (tp) <11 || tp->rx_opt.num_sacks || tp->rx_opt.dsack))return -1 ;
@@ -2382,7 +2382,7 @@ static int tcp_mtu_probe(struct sock *sk)return 0 ;/* Do we need to wait to drain cwnd? With none in flight, don't stall */ -if (tcp_packets_in_flight (tp) +2 > tp->snd_cwnd) { +if (tcp_packets_in_flight (tp) +2 >tcp_snd_cwnd (tp)) {if (!tcp_packets_in_flight (tp))return -1 ;else
@@ -2451,7 +2451,7 @@ static int tcp_mtu_probe(struct sock *sk)if (!tcp_transmit_skb (sk, nskb,1 ,GFP_ATOMIC )) {/* Decrement cwnd here because we are sending * effectively two packets. */ - tp->snd_cwnd--; +tcp_snd_cwnd_set (tp,tcp_snd_cwnd (tp) -1 );tcp_event_new_data_sent (sk, nskb); icsk->icsk_mtup.probe_size =tcp_mss_to_mtu (sk, nskb->len);
@@ -2709,7 +2709,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,else tcp_chrono_stop (sk,TCP_CHRONO_RWND_LIMITED ); - is_cwnd_limited |= (tcp_packets_in_flight (tp) >= tp->snd_cwnd); + is_cwnd_limited |= (tcp_packets_in_flight (tp) >=tcp_snd_cwnd (tp));if (likely (sent_pkts || is_cwnd_limited))tcp_cwnd_validate (sk, is_cwnd_limited);
@@ -2819,7 +2819,7 @@ void tcp_send_loss_probe(struct sock *sk)if (unlikely (!skb)) {WARN_ONCE (tp->packets_out,"invalid inflight: %u state %u cwnd %u mss %d\n" , - tp->packets_out, sk->sk_state, tp->snd_cwnd, mss); + tp->packets_out, sk->sk_state,tcp_snd_cwnd (tp), mss);inet_csk (sk)->icsk_pending =0 ;return ; }
@@ -3303,7 +3303,7 @@ void tcp_xmit_retransmit_queue(struct sock *sk)if (!hole) tp->retransmit_skb_hint = skb; - segs = tp->snd_cwnd -tcp_packets_in_flight (tp); + segs =tcp_snd_cwnd (tp) -tcp_packets_in_flight (tp);if (segs <=0 )break ; sacked =TCP_SKB_CB (skb)->sacked;
net/ipv4/tcp_rate.c +1 -1
@@ -200,7 +200,7 @@ void tcp_rate_check_app_limited(struct sock *sk)/* Nothing in sending host's qdisc queues or NIC tx queue. */ sk_wmem_alloc_get (sk) <SKB_TRUESIZE (1 ) &&/* We are not limited by CWND. */ -tcp_packets_in_flight (tp) < tp->snd_cwnd && +tcp_packets_in_flight (tp) <tcp_snd_cwnd (tp) &&/* All lost packets have been retransmitted. */ tp->lost_out <= tp->retrans_out) tp->app_limited =
net/ipv4/tcp_scalable.c +2 -2
@@ -27,7 +27,7 @@ static void tcp_scalable_cong_avoid(struct sock *sk, u32 ack, u32 acked)if (!acked)return ; } -tcp_cong_avoid_ai (tp,min (tp->snd_cwnd,TCP_SCALABLE_AI_CNT ), +tcp_cong_avoid_ai (tp,min (tcp_snd_cwnd (tp),TCP_SCALABLE_AI_CNT ), acked); }
@@ -35,7 +35,7 @@ static u32 tcp_scalable_ssthresh(struct sock *sk) {const struct tcp_sock *tp =tcp_sk (sk); -return max (tp->snd_cwnd - (tp->snd_cwnd>>TCP_SCALABLE_MD_SCALE ),2U ); +return max (tcp_snd_cwnd (tp) - (tcp_snd_cwnd (tp)>>TCP_SCALABLE_MD_SCALE ),2U ); }static struct tcp_congestion_ops tcp_scalable__read_mostly = {
net/ipv4/tcp_vegas.c +11 -10
@@ -159,7 +159,7 @@ EXPORT_SYMBOL_GPL(tcp_vegas_cwnd_event);static inline u32 tcp_vegas_ssthresh (struct tcp_sock *tp) { -return min (tp->snd_ssthresh, tp->snd_cwnd); +return min (tp->snd_ssthresh,tcp_snd_cwnd (tp)); }static void tcp_vegas_cong_avoid (struct sock *sk,u32 ack,u32 acked)
@@ -217,14 +217,14 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 acked)* This is: * (actual rate in segments) * baseRTT */ - target_cwnd = (u64 )tp->snd_cwnd * vegas->baseRTT; + target_cwnd = (u64 )tcp_snd_cwnd (tp) * vegas->baseRTT;do_div (target_cwnd, rtt);/* Calculate the difference between the window we had, * and the window we would like to have. This quantity * is the "Diff" from the Arizona Vegas papers. */ - diff = tp->snd_cwnd * (rtt-vegas->baseRTT) / vegas->baseRTT; + diff =tcp_snd_cwnd (tp) * (rtt-vegas->baseRTT) / vegas->baseRTT;if (diff > gamma &&tcp_in_slow_start (tp)) {/* Going too fast. Time to slow down
@@ -238,7 +238,8 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 acked)* truncation robs us of full link * utilization. */ - tp->snd_cwnd =min (tp->snd_cwnd, (u32 )target_cwnd+1 ); +tcp_snd_cwnd_set (tp,min (tcp_snd_cwnd (tp), + (u32 )target_cwnd +1 )); tp->snd_ssthresh =tcp_vegas_ssthresh (tp); }else if (tcp_in_slow_start (tp)) {
@@ -254,14 +255,14 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 acked)/* The old window was too fast, so * we slow down. */ - tp->snd_cwnd--; +tcp_snd_cwnd_set (tp,tcp_snd_cwnd (tp) -1 ); tp->snd_ssthresh =tcp_vegas_ssthresh (tp); }else if (diff < alpha) {/* We don't have enough extra packets * in the network, so speed up. */ - tp->snd_cwnd++; +tcp_snd_cwnd_set (tp,tcp_snd_cwnd (tp) +1 ); }else {/* Sending just as fast as we * should be.
@@ -269,10 +270,10 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 acked) } } -if (tp->snd_cwnd <2 ) - tp->snd_cwnd =2 ; -else if (tp->snd_cwnd > tp->snd_cwnd_clamp) - tp->snd_cwnd = tp->snd_cwnd_clamp; +if (tcp_snd_cwnd (tp) <2 ) +tcp_snd_cwnd_set (tp,2 ); +else if (tcp_snd_cwnd (tp) > tp->snd_cwnd_clamp) +tcp_snd_cwnd_set (tp, tp->snd_cwnd_clamp); tp->snd_ssthresh =tcp_current_ssthresh (sk); }
net/ipv4/tcp_veno.c +12 -12
@@ -146,11 +146,11 @@ static void tcp_veno_cong_avoid(struct sock *sk, u32 ack, u32 acked) rtt = veno->minrtt; - target_cwnd = (u64 )tp->snd_cwnd * veno->basertt; + target_cwnd = (u64 )tcp_snd_cwnd (tp) * veno->basertt; target_cwnd <<=V_PARAM_SHIFT ;do_div (target_cwnd, rtt); - veno->diff = (tp->snd_cwnd <<V_PARAM_SHIFT ) - target_cwnd; + veno->diff = (tcp_snd_cwnd (tp) <<V_PARAM_SHIFT ) - target_cwnd;if (tcp_in_slow_start (tp)) {/* Slow start. */
@@ -164,15 +164,15 @@ static void tcp_veno_cong_avoid(struct sock *sk, u32 ack, u32 acked)/* In the "non-congestive state", increase cwnd * every rtt. */ -tcp_cong_avoid_ai (tp, tp->snd_cwnd, acked); +tcp_cong_avoid_ai (tp,tcp_snd_cwnd (tp), acked); }else {/* In the "congestive state", increase cwnd * every other rtt. */ -if (tp->snd_cwnd_cnt >= tp->snd_cwnd) { +if (tp->snd_cwnd_cnt >=tcp_snd_cwnd (tp)) {if (veno->inc && - tp->snd_cwnd < tp->snd_cwnd_clamp) { - tp->snd_cwnd++; +tcp_snd_cwnd (tp) < tp->snd_cwnd_clamp) { +tcp_snd_cwnd_set (tp,tcp_snd_cwnd (tp) +1 ); veno->inc =0 ; }else veno->inc =1 ;
@@ -181,10 +181,10 @@ static void tcp_veno_cong_avoid(struct sock *sk, u32 ack, u32 acked) tp->snd_cwnd_cnt += acked; } done: -if (tp->snd_cwnd <2 ) - tp->snd_cwnd =2 ; -else if (tp->snd_cwnd > tp->snd_cwnd_clamp) - tp->snd_cwnd = tp->snd_cwnd_clamp; +if (tcp_snd_cwnd (tp) <2 ) +tcp_snd_cwnd_set (tp,2 ); +else if (tcp_snd_cwnd (tp) > tp->snd_cwnd_clamp) +tcp_snd_cwnd_set (tp, tp->snd_cwnd_clamp); }/* Wipe the slate clean for the next rtt. */ /* veno->cntrtt = 0; */
@@ -199,10 +199,10 @@ static u32 tcp_veno_ssthresh(struct sock *sk)if (veno->diff < beta)/* in "non-congestive state", cut cwnd by 1/5 */ -return max (tp->snd_cwnd *4 /5 ,2U ); +return max (tcp_snd_cwnd (tp) *4 /5 ,2U );else /* in "congestive state", cut cwnd by 1/2 */ -return max (tp->snd_cwnd >>1U ,2U ); +return max (tcp_snd_cwnd (tp) >>1U ,2U ); }static struct tcp_congestion_ops tcp_veno__read_mostly = {
net/ipv4/tcp_westwood.c +2 -1
@@ -244,7 +244,8 @@ static void tcp_westwood_event(struct sock *sk, enum tcp_ca_event event)switch (event) {case CA_EVENT_COMPLETE_CWR : - tp->snd_cwnd = tp->snd_ssthresh =tcp_westwood_bw_rttmin (sk); + tp->snd_ssthresh =tcp_westwood_bw_rttmin (sk); +tcp_snd_cwnd_set (tp, tp->snd_ssthresh);break ;case CA_EVENT_LOSS : tp->snd_ssthresh =tcp_westwood_bw_rttmin (sk);
net/ipv4/tcp_yeah.c +15 -15
@@ -71,11 +71,11 @@ static void tcp_yeah_cong_avoid(struct sock *sk, u32 ack, u32 acked)if (!yeah->doing_reno_now) {/* Scalable */ -tcp_cong_avoid_ai (tp,min (tp->snd_cwnd,TCP_SCALABLE_AI_CNT ), +tcp_cong_avoid_ai (tp,min (tcp_snd_cwnd (tp),TCP_SCALABLE_AI_CNT ), acked); }else {/* Reno */ -tcp_cong_avoid_ai (tp, tp->snd_cwnd, acked); +tcp_cong_avoid_ai (tp,tcp_snd_cwnd (tp), acked); }/* The key players are v_vegas.beg_snd_una and v_beg_snd_nxt.
@@ -130,7 +130,7 @@ static void tcp_yeah_cong_avoid(struct sock *sk, u32 ack, u32 acked)/* Compute excess number of packets above bandwidth * Avoid doing full 64 bit divide. */ - bw = tp->snd_cwnd; + bw =tcp_snd_cwnd (tp); bw *= rtt - yeah->vegas.baseRTT;do_div (bw, rtt); queue = bw;
@@ -138,20 +138,20 @@ static void tcp_yeah_cong_avoid(struct sock *sk, u32 ack, u32 acked)if (queue >TCP_YEAH_ALPHA || rtt - yeah->vegas.baseRTT > (yeah->vegas.baseRTT /TCP_YEAH_PHY )) {if (queue >TCP_YEAH_ALPHA && - tp->snd_cwnd > yeah->reno_count) { +tcp_snd_cwnd (tp) > yeah->reno_count) {u32 reduction =min (queue /TCP_YEAH_GAMMA , - tp->snd_cwnd >>TCP_YEAH_EPSILON ); +tcp_snd_cwnd (tp) >>TCP_YEAH_EPSILON ); - tp->snd_cwnd -= reduction; +tcp_snd_cwnd_set (tp,tcp_snd_cwnd (tp) - reduction); - tp->snd_cwnd =max (tp->snd_cwnd, - yeah->reno_count); +tcp_snd_cwnd_set (tp,max (tcp_snd_cwnd (tp), + yeah->reno_count)); - tp->snd_ssthresh = tp->snd_cwnd; + tp->snd_ssthresh =tcp_snd_cwnd (tp); }if (yeah->reno_count <=2 ) - yeah->reno_count =max (tp->snd_cwnd>>1 ,2U ); + yeah->reno_count =max (tcp_snd_cwnd (tp)>>1 ,2U );else yeah->reno_count++;
@@ -176,7 +176,7 @@ static void tcp_yeah_cong_avoid(struct sock *sk, u32 ack, u32 acked)*/ yeah->vegas.beg_snd_una = yeah->vegas.beg_snd_nxt; yeah->vegas.beg_snd_nxt = tp->snd_nxt; - yeah->vegas.beg_snd_cwnd = tp->snd_cwnd; + yeah->vegas.beg_snd_cwnd =tcp_snd_cwnd (tp);/* Wipe the slate clean for the next RTT. */ yeah->vegas.cntRTT =0 ;
@@ -193,16 +193,16 @@ static u32 tcp_yeah_ssthresh(struct sock *sk)if (yeah->doing_reno_now <TCP_YEAH_RHO ) { reduction = yeah->lastQ; - reduction =min (reduction,max (tp->snd_cwnd>>1 ,2U )); + reduction =min (reduction,max (tcp_snd_cwnd (tp)>>1 ,2U )); - reduction =max (reduction, tp->snd_cwnd >>TCP_YEAH_DELTA ); + reduction =max (reduction,tcp_snd_cwnd (tp) >>TCP_YEAH_DELTA ); }else - reduction =max (tp->snd_cwnd>>1 ,2U ); + reduction =max (tcp_snd_cwnd (tp)>>1 ,2U ); yeah->fast_count =0 ; yeah->reno_count =max (yeah->reno_count>>1 ,2U ); -return max_t (int, tp->snd_cwnd - reduction,2 ); +return max_t (int,tcp_snd_cwnd (tp) - reduction,2 ); }static struct tcp_congestion_ops tcp_yeah__read_mostly = {
net/ipv6/tcp_ipv6.c +1 -1
@@ -2044,7 +2044,7 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)jiffies_to_clock_t (icsk->icsk_rto),jiffies_to_clock_t (icsk->icsk_ack.ato), (icsk->icsk_ack.quick <<1 ) |inet_csk_in_pingpong_mode (sp), - tp->snd_cwnd, +tcp_snd_cwnd (tp), state ==TCP_LISTEN ? fastopenq->max_qlen : (tcp_in_initial_slowstart (tp) ?-1 : tp->snd_ssthresh)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 111/339 nfp: only report pause frame configuration for physical device
In reply to Greg Kroah-HartmanFrom: Yu Xiao <[email protected]>
[ Upstream commit 0649e4d63420ebc8cbebef3e9d39e12ffc5eb9fa ]
Only report pause frame configuration for physical device. Logical port of both PCI PF and PCI VF do not support it.
--- drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +2 -2
@@ -289,8 +289,6 @@ nfp_net_get_link_ksettings(struct net_device *netdev,/* Init to unknowns */ ethtool_link_ksettings_add_link_mode (cmd, supported,FIBRE ); -ethtool_link_ksettings_add_link_mode (cmd, supported, Pause); -ethtool_link_ksettings_add_link_mode (cmd, advertising, Pause); cmd->base.port =PORT_OTHER ; cmd->base.speed =SPEED_UNKNOWN ; cmd->base.duplex =DUPLEX_UNKNOWN ;
@@ -298,6 +296,8 @@ nfp_net_get_link_ksettings(struct net_device *netdev, port =nfp_port_from_netdev (netdev); eth_port =nfp_port_get_eth_port (port);if (eth_port) { +ethtool_link_ksettings_add_link_mode (cmd, supported, Pause); +ethtool_link_ksettings_add_link_mode (cmd, advertising, Pause); cmd->base.autoneg = eth_port->aneg !=NFP_ANEG_DISABLED ?AUTONEG_ENABLE :AUTONEG_DISABLE ;nfp_net_set_fec_link_mode (eth_port, cmd);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 112/339 block: use bio_queue_enter instead of blk_queue_enter in bio_poll
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit ebd076bf7d5deef488ec7ebc3fdbf781eafae269 ]
We want to have a valid live gendisk to call ->poll and not just a request_queue, so call the right helper.
--- block/blk-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
block/blk-core.c +1 -1
@@ -948,7 +948,7 @@ int bio_poll(struct bio *bio, struct io_comp_batch *iob, unsigned int flags)blk_flush_plug (current->plug, false); -if (blk_queue_enter (q,BLK_MQ_REQ_NOWAIT )) +if (bio_queue_enter (bio))return 0 ;if (queue_is_mq (q)) { ret =blk_mq_poll (q, cookie, iob, flags);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 113/339 bonding: NS target should accept link local address
In reply to Greg Kroah-HartmanFrom: Hangbin Liu <[email protected]>
[ Upstream commit 5e1eeef69c0fef6249b794bda5d68f95a65d062f ]
When setting bond NS target, we use bond_is_ip6_target_ok() to check if the address valid. The link local address was wrongly rejected in bond_changelink(), as most time the user just set the ARP/NS target to gateway, while the IPv6 gateway is always a link local address when user set up interface via SLAAC.
So remove the link local addr check when setting bond NS target.
--- drivers/net/bonding/bond_netlink.c | 5 ----- 1 file changed, 5 deletions(-)
drivers/net/bonding/bond_netlink.c +0 -5
@@ -290,11 +290,6 @@ static int bond_changelink(struct net_device *bond_dev, struct nlattr *tb[], addr6 =nla_get_in6_addr (attr); -if (ipv6_addr_type (&addr6) &IPV6_ADDR_LINKLOCAL ) { -NL_SET_ERR_MSG (extack,"Invalid IPv6 addr6" ); -return -EINVAL ; - } -bond_opt_initextra (&newval, &addr6,sizeof (addr6)); err =__bond_opt_set (bond,BOND_OPT_NS_TARGETS , &newval);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 114/339 sfc: fix considering that all channels have TX queues
In reply to Greg Kroah-HartmanFrom: Martin Habets <[email protected]>
[ Upstream commit 2e102b53f8a778f872dc137f4c7ac548705817aa ]
Normally, all channels have RX and TX queues, but this is not true if modparam efx_separate_tx_channels=1 is used. In that cases, some channels only have RX queues and others only TX queues (or more preciselly, they have them allocated, but not initialized).
Fix efx_channel_has_tx_queues to return the correct value for this case too.
Messages shown at probe time before the fix:
sfc 0000:03:00.0 ens6f0np0: MC command 0x82 inlen 544 failed rc=-22 (raw=0) arg=0
------------[ cut here ]------------ netdevice: ens6f0np0: failed to initialise TXQ -1 WARNING: CPU: 1 PID: 626 at drivers/net/ethernet/sfc/ef10.c:2393 efx_ef10_tx_init+0x201/0x300 [sfc] [...] stripped RIP: 0010:efx_ef10_tx_init+0x201/0x300 [sfc] [...] stripped Call Trace: efx_init_tx_queue+0xaa/0xf0 [sfc] efx_start_channels+0x49/0x120 [sfc] efx_start_all+0x1f8/0x430 [sfc] efx_net_open+0x5a/0xe0 [sfc] __dev_open+0xd0/0x190 __dev_change_flags+0x1b3/0x220 dev_change_flags+0x21/0x60 [...] stripped
Messages shown at remove time before the fix:
sfc 0000:03:00.0 ens6f0np0: failed to flush 10 queues sfc 0000:03:00.0 ens6f0np0: failed to flush queues
--- drivers/net/ethernet/sfc/net_driver.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/sfc/net_driver.h +1 -1
@@ -1535,7 +1535,7 @@ static inline bool efx_channel_is_xdp_tx(struct efx_channel *channel)static inline bool efx_channel_has_tx_queues (struct efx_channel *channel) { -return true; +return channel && channel->channel >= channel->efx->tx_channel_offset; }static inline unsigned int efx_channel_num_tx_queues (struct efx_channel *channel)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 115/339 sfc: fix wrong tx channel offset with efx_separate_tx_channels
In reply to Greg Kroah-HartmanFrom: Íñigo Huguet <[email protected]>
[ Upstream commit c308dfd1b43ef0d4c3e57b741bb3462eb7a7f4a2 ]
tx_channel_offset is calculated in efx_allocate_msix_channels, but it is also calculated again in efx_set_channels because it was originally done there, and when efx_allocate_msix_channels was introduced it was forgotten to be removed from efx_set_channels.
Moreover, the old calculation is wrong when using efx_separate_tx_channels because now we can have XDP channels after the TX channels, so n_channels - n_tx_channels doesn't point to the first TX channel.
Remove the old calculation from efx_set_channels, and add the initialization of this variable if MSI or legacy interrupts are used, next to the initialization of the rest of the related variables, where it was missing.
--- drivers/net/ethernet/sfc/efx_channels.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/ethernet/sfc/efx_channels.c +2 -4
@@ -324,6 +324,7 @@ int efx_probe_interrupts(struct efx_nic *efx) efx->n_channels =1 ; efx->n_rx_channels =1 ; efx->n_tx_channels =1 ; + efx->tx_channel_offset =0 ; efx->n_xdp_channels =0 ; efx->xdp_channel_offset = efx->n_channels; rc =pci_enable_msi (efx->pci_dev);
@@ -344,6 +345,7 @@ int efx_probe_interrupts(struct efx_nic *efx) efx->n_channels =1 + (efx_separate_tx_channels ?1 :0 ); efx->n_rx_channels =1 ; efx->n_tx_channels =1 ; + efx->tx_channel_offset =1 ; efx->n_xdp_channels =0 ; efx->xdp_channel_offset = efx->n_channels; efx->legacy_irq = efx->pci_dev->irq;
@@ -979,10 +981,6 @@ int efx_set_channels(struct efx_nic *efx)struct efx_channel *channel;int rc; - efx->tx_channel_offset = - efx_separate_tx_channels ? - efx->n_channels - efx->n_tx_channels :0 ; -if (efx->xdp_tx_queue_count) {EFX_WARN_ON_PARANOID (efx->xdp_tx_queues);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 116/339 block: make bioset_exit() fully resilient against being called twice
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
[ Upstream commit 605f7415ecfb426610195dd6c7577b30592b3369 ]
Most of bioset_exit() is fine being called twice, as it clears the various allocations etc when they are freed. The exception is bio_alloc_cache_destroy(), which does not clear ->cache when it has freed it.
This isn't necessarily a bug, but can be if buggy users does call the exit path more then once, or with just a memset() bioset which has never been initialized. dm appears to be one such user.
--- block/bio.c | 1 + 1 file changed, 1 insertion(+)
block/bio.c +1 -0
@@ -693,6 +693,7 @@ static void bio_alloc_cache_destroy(struct bio_set *bs)bio_alloc_cache_prune (cache,-1U ); }free_percpu (bs->cache); + bs->cache =NULL ; }/**
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 117/339 sched/autogroup: Fix sysctl move
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
[ Upstream commit 82f586f923e3ac6062bc7867717a7f8afc09e0ff ]
Ivan reported /proc/sys/kernel/sched_autogroup_enabled went walk-about and using the noautogroup command line parameter would result in a boot error message.
Turns out the sysctl move placed the init function wrong.
--- kernel/sched/autogroup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/sched/autogroup.c +1 -1
@@ -36,6 +36,7 @@ void __init autogroup_init(struct task_struct *init_task)kref_init (&autogroup_default.kref);init_rwsem (&autogroup_default.lock); init_task->signal->autogroup = &autogroup_default; +sched_autogroup_sysctl_init (); }void autogroup_free (struct task_group *tg)
@@ -219,7 +220,6 @@ void sched_autogroup_exit(struct signal_struct *sig)static int __init setup_autogroup (char *str) { sysctl_sched_autogroup_enabled =0 ; -sched_autogroup_sysctl_init ();return 1 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 118/339 blk-mq: do not update io_ticks with passthrough requests
In reply to Greg Kroah-HartmanFrom: Haisu Wang <[email protected]>
[ Upstream commit b81c14ca14b631aa1abae32fb5ae75b5e9251012 ]
Flush or passthrough requests are not accounted as normal IO in completion. To reflect iostat for slow IO, io_ticks is updated when stat show called based on inflight numbers.
It may cause inconsistent io_ticks calculation result.
So do not account non-passthrough request when check inflight.
--- block/blk-mq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
block/blk-mq.c +2 -1
@@ -133,7 +133,8 @@ static bool blk_mq_check_inflight(struct request *rq, void *priv, {struct mq_inflight *mi = priv; -if ((!mi->part->bd_partno || rq->part == mi->part) && +if (rq->part &&blk_do_io_stat (rq) && + (!mi->part->bd_partno || rq->part == mi->part) &&blk_mq_rq_state (rq) ==MQ_RQ_IN_FLIGHT ) mi->inflight[rq_data_dir (rq)]++;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 119/339 net: phy: at803x: disable WOL at probe
In reply to Greg Kroah-HartmanFrom: Viorel Suman <[email protected]>
[ Upstream commit d7cd5e06c9dd70a82f1461c7b5f676bc03f5cd61 ]
Before 7beecaf7d507b ("net: phy: at803x: improve the WOL feature") patch "at803x_get_wol" implementation used AT803X_INTR_ENABLE_WOL value to set WAKE_MAGIC flag, and now AT803X_WOL_EN value is used for the same purpose. The problem here is that the values of these two bits are different after hardware reset: AT803X_INTR_ENABLE_WOL=0 after hardware reset, but AT803X_WOL_EN=1. So now, if called right after boot, "at803x_get_wol" will set WAKE_MAGIC flag, even if WOL function is not enabled by calling "at803x_set_wol" function. The patch disables WOL function on probe thus the behavior is consistent.
--- drivers/net/phy/at803x.c | 33 ++++++++++++++++++++++----------- 1 file changed, 22 insertions(+), 11 deletions(-)
drivers/net/phy/at803x.c +22 -11
@@ -433,20 +433,21 @@ static void at803x_context_restore(struct phy_device *phydev,static int at803x_set_wol (struct phy_device *phydev,struct ethtool_wolinfo *wol) { -struct net_device *ndev = phydev->attached_dev; -const u8 *mac;int ret, irq_enabled; -unsigned int i; -static const unsigned int offsets[] = { -AT803X_LOC_MAC_ADDR_32_47_OFFSET , -AT803X_LOC_MAC_ADDR_16_31_OFFSET , -AT803X_LOC_MAC_ADDR_0_15_OFFSET , - }; - -if (!ndev) -return -ENODEV ;if (wol->wolopts &WAKE_MAGIC ) { +struct net_device *ndev = phydev->attached_dev; +const u8 *mac; +unsigned int i; +static const unsigned int offsets[] = { +AT803X_LOC_MAC_ADDR_32_47_OFFSET , +AT803X_LOC_MAC_ADDR_16_31_OFFSET , +AT803X_LOC_MAC_ADDR_0_15_OFFSET , + }; + +if (!ndev) +return -ENODEV ; + mac = (const u8 *) ndev->dev_addr;if (!is_valid_ether_addr (mac))
@@ -857,6 +858,9 @@ static int at803x_probe(struct phy_device *phydev)if (phydev->drv->phy_id ==ATH8031_PHY_ID ) {int ccr =phy_read (phydev,AT803X_REG_CHIP_CONFIG );int mode_cfg; +struct ethtool_wolinfo wol = { + .wolopts =0 , + };if (ccr <0 ) goto err;
@@ -872,6 +876,13 @@ static int at803x_probe(struct phy_device *phydev) priv->is_fiber = true;break ; } + +/* Disable WOL by default */ + ret =at803x_set_wol (phydev, &wol); +if (ret <0 ) { +phydev_err (phydev,"failed to disable WOL on probe: %d\n" , ret); + goto err; + } }return 0 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 120/339 bonding: show NS IPv6 targets in proc master info
In reply to Greg Kroah-HartmanFrom: Hangbin Liu <[email protected]>
[ Upstream commit 4a1f14df55d1e9ecdfa797a87a80131207cbd66f ]
When adding bond new parameter ns_targets. I forgot to print this in bond master proc info. After updating, the bond master info will look like:
ARP IP target/s (n.n.n.n form): 192.168.1.254
NS IPv6 target/s (XX::XX form): 2022::1, 2022::2
--- drivers/net/bonding/bond_procfs.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/net/bonding/bond_procfs.c +15 -0
@@ -129,6 +129,21 @@ static void bond_info_show_master(struct seq_file *seq) printed =1 ; }seq_printf (seq,"\n" ); + +#if IS_ENABLED (CONFIG_IPV6 ) + printed =0 ; +seq_printf (seq,"NS IPv6 target/s (xx::xx form):" ); + +for (i =0 ; (i <BOND_MAX_NS_TARGETS ); i++) { +if (ipv6_addr_any (&bond->params.ns_targets[i])) +break ; +if (printed) +seq_printf (seq,"," ); +seq_printf (seq," %pI6c" , &bond->params.ns_targets[i]); + printed =1 ; + } +seq_printf (seq,"\n" ); +#endif }if (BOND_MODE (bond) ==BOND_MODE_8023AD ) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 121/339 erofs: fix backmost member of z_erofs_decompress_frontend
In reply to Greg Kroah-HartmanFrom: Weizhao Ouyang <[email protected]>
[ Upstream commit 4398d3c31b582db0d640b23434bf344a6c8df57c ]
Initialize 'backmost' to true in DECOMPRESS_FRONTEND_INIT.
--- fs/erofs/zdata.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/erofs/zdata.c +1 -1
@@ -214,7 +214,7 @@ struct z_erofs_decompress_frontend {#define DECOMPRESS_FRONTEND_INIT (__i) { \ .inode = __i, .owned_head = Z_EROFS_PCLUSTER_TAIL, \ - .mode = COLLECT_PRIMARY_FOLLOWED } + .mode = COLLECT_PRIMARY_FOLLOWED, .backmost = true }static struct page *z_pagemap_global[Z_EROFS_VMAP_GLOBAL_PAGES ];static DEFINE_MUTEX (z_pagemap_global_lock);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 122/339 vdpa: Fix error logic in vdpa_nl_cmd_dev_get_doit
In reply to Greg Kroah-HartmanFrom: Eli Cohen <[email protected]>
[ Upstream commit 7a6691f1f89784f775fa0c54be57533445726068 ]
In vdpa_nl_cmd_dev_get_doit(), if the call to genlmsg_reply() fails we must not call nlmsg_free() since this is done inside genlmsg_reply().
Fix it.
Message-Id: <[email protected]>
--- drivers/vdpa/vdpa.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/vdpa/vdpa.c +9 -4
@@ -756,14 +756,19 @@ static int vdpa_nl_cmd_dev_get_doit(struct sk_buff *skb, struct genl_info *info) goto mdev_err; } err =vdpa_dev_fill (vdev, msg, info->snd_portid, info->snd_seq,0 , info->extack); -if (!err) - err =genlmsg_reply (msg, info); +if (err) + goto mdev_err; + + err =genlmsg_reply (msg, info); +put_device (dev); +mutex_unlock (&vdpa_dev_mutex); +return err; + mdev_err:put_device (dev); err:mutex_unlock (&vdpa_dev_mutex); -if (err) -nlmsg_free (msg); +nlmsg_free (msg);return err; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 123/339 virtio: pci: Fix an error handling path in vp_modern_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 7a836a2aba09479c8e71fa43249eecc4af945f61 ]
If an error occurs after a successful pci_request_selected_regions() call, it should be undone by a corresponding pci_release_selected_regions() call, as already done in vp_modern_remove().
Message-Id: <237109725aad2c3c03d14549f777b1927c84b045.1648977064.git.christophe.jaillet@wanadoo.fr>
--- drivers/virtio/virtio_pci_modern_dev.c | 1 + 1 file changed, 1 insertion(+)
drivers/virtio/virtio_pci_modern_dev.c +1 -0
@@ -347,6 +347,7 @@ int vp_modern_probe(struct virtio_pci_modern_device *mdev) err_map_isr:pci_iounmap (pci_dev, mdev->common); err_map_common: +pci_release_selected_regions (pci_dev, mdev->modern_bars);return err; }EXPORT_SYMBOL_GPL (vp_modern_probe);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 124/339 net/mlx5: Dont use already freed action pointer
In reply to Greg Kroah-HartmanFrom: Leon Romanovsky <[email protected]>
[ Upstream commit 80b2bd737d0e833e6a2b77e482e5a714a79c86a4 ]
The call to mlx5dr_action_destroy() releases "action" memory. That pointer is set to miss_action later and generates the following smatch error:
drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c:53 set_miss_action()
warn: 'action' was already freed.
Make sure that the pointer is always valid by setting NULL after destroy.
--- drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c +4 -5
@@ -44,11 +44,10 @@ static int set_miss_action(struct mlx5_flow_root_namespace *ns, err =mlx5dr_table_set_miss_action (ft->fs_dr_table.dr_table, action);if (err && action) { err =mlx5dr_action_destroy (action); -if (err) { - action =NULL ; -mlx5_core_err (ns->dev,"Failed to destroy action (%d)\n" , - err); - } +if (err) +mlx5_core_err (ns->dev, +"Failed to destroy action (%d)\n" , err); + action =NULL ; } ft->fs_dr_table.miss_action = action;if (old_miss_action) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 125/339 net/mlx5e: TC NIC mode, fix tc chains miss table
In reply to Greg Kroah-HartmanFrom: Maor Dickman <[email protected]>
[ Upstream commit 66cb64e292d21588bdb831f08a7ec0ff04d6380d ]
The cited commit changed promisc table to be created on demand with the highest priority in the NIC table replacing the vlan table, this caused tc NIC tables miss flow to skip the prmoisc table because it use vlan table as miss table.
OVS offload in NIC mode use promisc by default so any unicast packet which will be handled by tc NIC tables miss flow will skip the promisc rule and will be dropped.
Fix this by adding new empty table in new tc level with low priority and point the nic tc chain miss to it, the new table is managed so it will point to vlan table if promisc is disabled and to promisc table if enabled.
--- .../net/ethernet/mellanox/mlx5/core/en/fs.h | 2 + .../net/ethernet/mellanox/mlx5/core/en_tc.c | 38 ++++++++++++++++++- .../net/ethernet/mellanox/mlx5/core/fs_core.c | 2 +- 3 files changed, 39 insertions(+), 3 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en/fs.h +2 -0
@@ -12,6 +12,7 @@ struct mlx5e_post_act;enum {MLX5E_TC_FT_LEVEL =0 ,MLX5E_TC_TTC_FT_LEVEL , +MLX5E_TC_MISS_LEVEL , };struct mlx5e_tc_table {
@@ -20,6 +21,7 @@ struct mlx5e_tc_table {*/ struct mutex t_lock;struct mlx5_flow_table *t; +struct mlx5_flow_table *miss_t;struct mlx5_fs_chains *chains;struct mlx5e_post_act *post_act;
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +36 -2
@@ -4688,6 +4688,33 @@ static int mlx5e_tc_nic_get_ft_size(struct mlx5_core_dev *dev)return tc_tbl_size; } +static int mlx5e_tc_nic_create_miss_table (struct mlx5e_priv *priv) +{ +struct mlx5_flow_table **ft = &priv->fs.tc.miss_t; +struct mlx5_flow_table_attr ft_attr = {}; +struct mlx5_flow_namespace *ns; +int err =0 ; + + ft_attr.max_fte =1 ; + ft_attr.autogroup.max_num_groups =1 ; + ft_attr.level =MLX5E_TC_MISS_LEVEL ; + ft_attr.prio =0 ; + ns =mlx5_get_flow_namespace (priv->mdev,MLX5_FLOW_NAMESPACE_KERNEL ); + + *ft =mlx5_create_auto_grouped_flow_table (ns, &ft_attr); +if (IS_ERR (*ft)) { + err =PTR_ERR (*ft); +netdev_err (priv->netdev,"failed to create tc nic miss table err=%d\n" , err); + } + +return err; +} + +static void mlx5e_tc_nic_destroy_miss_table (struct mlx5e_priv *priv) +{ +mlx5_destroy_flow_table (priv->fs.tc.miss_t); +} +int mlx5e_tc_nic_init (struct mlx5e_priv *priv) {struct mlx5e_tc_table *tc = &priv->fs.tc;
@@ -4720,19 +4747,23 @@ int mlx5e_tc_nic_init(struct mlx5e_priv *priv) } tc->mapping = chains_mapping; + err =mlx5e_tc_nic_create_miss_table (priv); +if (err) + goto err_chains; +if (MLX5_CAP_FLOWTABLE_NIC_RX (priv->mdev, ignore_flow_level)) attr.flags =MLX5_CHAINS_AND_PRIOS_SUPPORTED |MLX5_CHAINS_IGNORE_FLOW_LEVEL_SUPPORTED ; attr.ns =MLX5_FLOW_NAMESPACE_KERNEL ; attr.max_ft_sz =mlx5e_tc_nic_get_ft_size (dev); attr.max_grp_num =MLX5E_TC_TABLE_NUM_GROUPS ; - attr.default_ft =mlx5e_vlan_get_flowtable (priv->fs.vlan); + attr.default_ft = priv->fs.tc.miss_t; attr.mapping = chains_mapping; tc->chains =mlx5_chains_create (dev, &attr);if (IS_ERR (tc->chains)) { err =PTR_ERR (tc->chains); - goto err_chains; + goto err_miss; } tc->post_act =mlx5e_tc_post_act_init (priv, tc->chains,MLX5_FLOW_NAMESPACE_KERNEL );
@@ -4755,6 +4786,8 @@ int mlx5e_tc_nic_init(struct mlx5e_priv *priv)mlx5_tc_ct_clean (tc->ct);mlx5e_tc_post_act_destroy (tc->post_act);mlx5_chains_destroy (tc->chains); +err_miss: +mlx5e_tc_nic_destroy_miss_table (priv); err_chains:mapping_destroy (chains_mapping); err_mapping:
@@ -4795,6 +4828,7 @@ void mlx5e_tc_nic_cleanup(struct mlx5e_priv *priv)mlx5e_tc_post_act_destroy (tc->post_act);mapping_destroy (tc->mapping);mlx5_chains_destroy (tc->chains); +mlx5e_tc_nic_destroy_miss_table (priv); }int mlx5e_tc_ht_init (struct rhashtable *tc_ht)
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +1 -1
@@ -116,7 +116,7 @@#define KERNEL_MIN_LEVEL (KERNEL_NIC_PRIO_NUM_LEVELS + 1)#define KERNEL_NIC_TC_NUM_PRIOS 1 -#define KERNEL_NIC_TC_NUM_LEVELS 2 +#define KERNEL_NIC_TC_NUM_LEVELS 3#define ANCHOR_NUM_LEVELS 1#define ANCHOR_NUM_PRIOS 1
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 126/339 net/mlx5: CT: Fix header-rewrite re-use for tupels
In reply to Greg Kroah-HartmanFrom: Paul Blakey <[email protected]>
[ Upstream commit 1f2856cde64baa78475e6d3c601fb7b7f693a161 ]
Tuple entries that don't have nat configured for them which are added to the ct nat table will always create a new modify header, as we don't check for possible re-use on them. The same for tuples that have nat configured for them but are added to ct table.
Fix the above by only avoiding wasteful re-use lookup for actually natted entries in ct nat table.
--- .../ethernet/mellanox/mlx5/core/en/tc_ct.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c +11 -8
@@ -701,7 +701,7 @@ mlx5_tc_ct_entry_create_mod_hdr(struct mlx5_tc_ct_priv *ct_priv,struct mlx5_flow_attr *attr, struct flow_rule *flow_rule, struct mlx5e_mod_hdr_handle **mh, - u8 zone_restore_id, bool nat) + u8 zone_restore_id, bool nat_table, bool has_nat) {DECLARE_MOD_HDR_ACTS_ACTIONS (actions_arr ,MLX5_CT_MIN_MOD_ACTS );DECLARE_MOD_HDR_ACTS (mod_acts, actions_arr);
@@ -717,11 +717,12 @@ mlx5_tc_ct_entry_create_mod_hdr(struct mlx5_tc_ct_priv *ct_priv, &attr->ct_attr.ct_labels_id);if (err)return -EOPNOTSUPP ; -if (nat) { - err =mlx5_tc_ct_entry_create_nat (ct_priv, flow_rule, - &mod_acts); -if (err) - goto err_mapping; +if (nat_table) { +if (has_nat) { + err =mlx5_tc_ct_entry_create_nat (ct_priv, flow_rule, &mod_acts); +if (err) + goto err_mapping; + } ct_state |=MLX5_CT_STATE_NAT_BIT ; }
@@ -736,7 +737,7 @@ mlx5_tc_ct_entry_create_mod_hdr(struct mlx5_tc_ct_priv *ct_priv,if (err) goto err_mapping; -if (nat) { +if (nat_table && has_nat) { attr->modify_hdr =mlx5_modify_header_alloc (ct_priv->dev, ct_priv->ns_type, mod_acts.num_actions, mod_acts.actions);
@@ -804,7 +805,9 @@ mlx5_tc_ct_entry_add_rule(struct mlx5_tc_ct_priv *ct_priv, err =mlx5_tc_ct_entry_create_mod_hdr (ct_priv, attr, flow_rule, &zone_rule->mh, - zone_restore_id, nat); + zone_restore_id, + nat, +mlx5_tc_ct_entry_has_nat (entry));if (err) {ct_dbg ("Failed to create ct entry mod hdr" ); goto err_mod_hdr;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 127/339 net/mlx5e: Disable softirq in mlx5e_activate_rq to avoid race condition
In reply to Greg Kroah-HartmanFrom: Maxim Mikityanskiy <[email protected]>
[ Upstream commit 2e642afb61b24401a7ec819d27ddcd69c7c29784 ]
When the driver activates the channels, it assumes NAPI isn't running yet. mlx5e_activate_rq posts a NOP WQE to ICOSQ to trigger a hardware interrupt and start NAPI, which will run mlx5e_alloc_rx_mpwqe and post UMR WQEs to ICOSQ to be able to receive packets with striding RQ.
Unfortunately, a race condition is possible if NAPI is triggered by something else (for example, TX) at a bad timing, before mlx5e_activate_rq finishes. In this case, mlx5e_alloc_rx_mpwqe may post UMR WQEs to ICOSQ, and with the bad timing, the wqe_info of the first UMR may be overwritten by the wqe_info of the NOP posted by mlx5e_activate_rq.
The consequence is that icosq->db.wqe_info[0].num_wqebbs will be changed from MLX5E_UMR_WQEBBS to 1, disrupting the integrity of the array-based linked list in wqe_info[]. mlx5e_poll_ico_cq will hang in an infinite loop after processing wqe_info[0], because after the corruption, the next item to be processed will be wqe_info[1], which is filled with zeros, and sqcc += wi->num_wqebbs will never move further.
This commit fixes this race condition by using async_icosq to post the NOP and trigger the interrupt. async_icosq is always protected with a spinlock, eliminating the race condition.
--- drivers/net/ethernet/mellanox/mlx5/core/en.h | 4 ++++ .../net/ethernet/mellanox/mlx5/core/en/ptp.c | 1 + .../mellanox/mlx5/core/en/reporter_rx.c | 6 +++++ .../net/ethernet/mellanox/mlx5/core/en/trap.c | 1 + .../ethernet/mellanox/mlx5/core/en/xsk/pool.c | 1 + .../mellanox/mlx5/core/en/xsk/setup.c | 5 +--- .../net/ethernet/mellanox/mlx5/core/en_main.c | 24 +++++++++++++------ 7 files changed, 31 insertions(+), 11 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en.h +4 -0
@@ -765,6 +765,7 @@ struct mlx5e_rq {u8 wq_type;u32 rqn;struct mlx5_core_dev *mdev; +struct mlx5e_channel *channel;u32 umr_mkey;struct mlx5e_dma_info wqe_overflow;
@@ -1077,6 +1078,9 @@ void mlx5e_close_cq(struct mlx5e_cq *cq);int mlx5e_open_locked (struct net_device *netdev);int mlx5e_close_locked (struct net_device *netdev); +void mlx5e_trigger_napi_icosq (struct mlx5e_channel *c); +void mlx5e_trigger_napi_sched (struct napi_struct *napi); +int mlx5e_open_channels (struct mlx5e_priv *priv,struct mlx5e_channels *chs);void mlx5e_close_channels (struct mlx5e_channels *chs);
drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c +1 -0
@@ -736,6 +736,7 @@ void mlx5e_ptp_activate_channel(struct mlx5e_ptp *c)if (test_bit (MLX5E_PTP_STATE_RX , c->state)) {mlx5e_ptp_rx_set_fs (c->priv);mlx5e_activate_rq (&c->rq); +mlx5e_trigger_napi_sched (&c->napi); } }
drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c +6 -0
@@ -123,6 +123,8 @@ static int mlx5e_rx_reporter_err_icosq_cqe_recover(void *ctx) xskrq->stats->recover++; } +mlx5e_trigger_napi_icosq (icosq->channel); +mutex_unlock (&icosq->channel->icosq_recovery_lock);return 0 ;
@@ -166,6 +168,10 @@ static int mlx5e_rx_reporter_err_rq_cqe_recover(void *ctx)clear_bit (MLX5E_RQ_STATE_RECOVERING , &rq->state);mlx5e_activate_rq (rq); rq->stats->recover++; +if (rq->channel) +mlx5e_trigger_napi_icosq (rq->channel); +else +mlx5e_trigger_napi_sched (rq->cq.napi);return 0 ; out:clear_bit (MLX5E_RQ_STATE_RECOVERING , &rq->state);
drivers/net/ethernet/mellanox/mlx5/core/en/trap.c +1 -0
@@ -179,6 +179,7 @@ static void mlx5e_activate_trap(struct mlx5e_trap *trap) {napi_enable (&trap->napi);mlx5e_activate_rq (&trap->rq); +mlx5e_trigger_napi_sched (&trap->napi); }void mlx5e_deactivate_trap (struct mlx5e_priv *priv)
drivers/net/ethernet/mellanox/mlx5/core/en/xsk/pool.c +1 -0
@@ -117,6 +117,7 @@ static int mlx5e_xsk_enable_locked(struct mlx5e_priv *priv, goto err_remove_pool;mlx5e_activate_xsk (c); +mlx5e_trigger_napi_icosq (c);/* Don't wait for WQEs, because the newer xdpsock sample doesn't provide * any Fill Ring entries at the setup stage.
drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c +1 -4
@@ -64,6 +64,7 @@ static int mlx5e_init_xsk_rq(struct mlx5e_channel *c, rq->clock = &mdev->clock; rq->icosq = &c->icosq; rq->ix = c->ix; + rq->channel = c; rq->mdev = mdev; rq->hw_mtu =MLX5E_SW2HW_MTU (params, params->sw_mtu); rq->xdpsq = &c->rq_xdpsq;
@@ -179,10 +180,6 @@ void mlx5e_activate_xsk(struct mlx5e_channel *c)mlx5e_reporter_icosq_resume_recovery (c);/* TX queue is created active. */ - -spin_lock_bh (&c->async_icosq_lock); -mlx5e_trigger_irq (&c->async_icosq); -spin_unlock_bh (&c->async_icosq_lock); }void mlx5e_deactivate_xsk (struct mlx5e_channel *c)
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +17 -7
@@ -478,6 +478,7 @@ static int mlx5e_init_rxq_rq(struct mlx5e_channel *c, struct mlx5e_params *param rq->clock = &mdev->clock; rq->icosq = &c->icosq; rq->ix = c->ix; + rq->channel = c; rq->mdev = mdev; rq->hw_mtu =MLX5E_SW2HW_MTU (params, params->sw_mtu); rq->xdpsq = &c->rq_xdpsq;
@@ -1072,13 +1073,6 @@ int mlx5e_open_rq(struct mlx5e_params *params, struct mlx5e_rq_param *param,void mlx5e_activate_rq (struct mlx5e_rq *rq) {set_bit (MLX5E_RQ_STATE_ENABLED , &rq->state); -if (rq->icosq) { -mlx5e_trigger_irq (rq->icosq); - }else { -local_bh_disable (); -napi_schedule (rq->cq.napi); -local_bh_enable (); - } }void mlx5e_deactivate_rq (struct mlx5e_rq *rq)
@@ -2233,6 +2227,20 @@ static int mlx5e_channel_stats_alloc(struct mlx5e_priv *priv, int ix, int cpu)return 0 ; } +void mlx5e_trigger_napi_icosq (struct mlx5e_channel *c) +{ +spin_lock_bh (&c->async_icosq_lock); +mlx5e_trigger_irq (&c->async_icosq); +spin_unlock_bh (&c->async_icosq_lock); +} + +void mlx5e_trigger_napi_sched (struct napi_struct *napi) +{ +local_bh_disable (); +napi_schedule (napi); +local_bh_enable (); +} + static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix, struct mlx5e_params *params, struct mlx5e_channel_param *cparam,
@@ -2314,6 +2322,8 @@ static void mlx5e_activate_channel(struct mlx5e_channel *c)if (test_bit (MLX5E_CHANNEL_STATE_XSK , c->state))mlx5e_activate_xsk (c); + +mlx5e_trigger_napi_icosq (c); }static void mlx5e_deactivate_channel (struct mlx5e_channel *c)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 128/339 net/mlx5: correct ECE offset in query qp output
In reply to Greg Kroah-HartmanFrom: Changcheng Liu <[email protected]>
[ Upstream commit 3fc2a9e89b3508a5cc0c324f26d7b4740ba8c456 ]
ECE field should be after opt_param_mask in query qp output.
--- include/linux/mlx5/mlx5_ifc.h | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
include/linux/mlx5/mlx5_ifc.h +2 -3
@@ -5180,12 +5180,11 @@ struct mlx5_ifc_query_qp_out_bits {u8 syndrome[0x20 ]; -u8 reserved_at_40[0x20 ]; -u8 ece[0x20 ]; +u8 reserved_at_40[0x40 ];u8 opt_param_mask[0x20 ]; -u8 reserved_at_a0[0x20 ]; +u8 ece[0x20 ];struct mlx5_ifc_qpc_bits qpc;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 129/339 net/mlx5e: Update netdev features after changing XDP state
In reply to Greg Kroah-HartmanFrom: Maxim Mikityanskiy <[email protected]>
[ Upstream commit f6279f113ad593971999c877eb69dc3d36a75894 ]
Some features (LRO, HW GRO) conflict with XDP. If there is an attempt to enable such features while XDP is active, they will be set to off [requested on]. In order to activate these features after XDP is turned off, the driver needs to call netdev_update_features(). This commit adds this missing call after XDP state changes.
--- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +5 -0
@@ -4581,6 +4581,11 @@ static int mlx5e_xdp_set(struct net_device *netdev, struct bpf_prog *prog) unlock:mutex_unlock (&priv->state_lock); + +/* Need to fix some features. */ +if (!err) +netdev_update_features (netdev); +return err; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 130/339 net: sched: add barrier to fix packet stuck problem for lockless qdisc
In reply to Greg Kroah-HartmanFrom: Guoju Fang <[email protected]>
[ Upstream commit 2e8728c955ce0624b958eee6e030a37aca3a5d86 ]
In qdisc_run_end(), the spin_unlock() only has store-release semantic, which guarantees all earlier memory access are visible before it. But the subsequent test_bit() has no barrier semantics so may be reordered ahead of the spin_unlock(). The store-load reordering may cause a packet stuck problem.
The concurrent operations can be described as below,
CPU 0 | CPU 1
qdisc_run_end() | qdisc_run_begin()
. | .
----> /* may be reorderd here */ | .
| . | .
| spin_unlock() | set_bit()
| . | smp_mb__after_atomic()
---- test_bit() | spin_trylock()
. | .Consider the following sequence of events:
CPU 0 reorder test_bit() ahead and see MISSED = 0 CPU 1 calls set_bit()
CPU 1 calls spin_trylock() and return fail CPU 0 executes spin_unlock()
At the end of the sequence, CPU 0 calls spin_unlock() and does nothing because it see MISSED = 0. The skb on CPU 1 has beed enqueued but no one take it, until the next cpu pushing to the qdisc (if ever ...) will notice and dequeue it.
This patch fix this by adding one explicit barrier. As spin_unlock() and test_bit() ordering is a store-load ordering, a full memory barrier smp_mb() is needed here.
--- include/net/sch_generic.h | 6 ++++++ 1 file changed, 6 insertions(+)
include/net/sch_generic.h +6 -0
@@ -209,6 +209,12 @@ static inline void qdisc_run_end(struct Qdisc *qdisc)if (qdisc->flags &TCQ_F_NOLOCK ) {spin_unlock (&qdisc->seqlock); +/* spin_unlock() only has store-release semantic. The unlock +* and test_bit() ordering is a store-load ordering, so a full +* memory barrier is needed here. +*/ +smp_mb (); +if (unlikely (test_bit (__QDISC_STATE_MISSED, &qdisc->state)))__netif_schedule (qdisc);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 131/339 tcp: tcp_rtx_synack() can be called from process context
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 0a375c822497ed6ad6b5da0792a12a6f1af10c0b ]
Laurent reported the enclosed report [1]
This bug triggers with following coditions:
0) Kernel built with CONFIG_DEBUG_PREEMPT=y
1) A new passive FastOpen TCP socket is created.
This FO socket waits for an ACK coming from client to be a complete ESTABLISHED one.
2) A socket operation on this socket goes through lock_sock() release_sock() dance.
3) While the socket is owned by the user in step 2),
a retransmit of the SYN is received and stored in socket backlog.
4) At release_sock() time, the socket backlog is processed while in process context.
5) A SYNACK packet is cooked in response of the SYN retransmit.
6) -> tcp_rtx_synack() is called in process context.
Before blamed commit, tcp_rtx_synack() was always called from BH handler, from a timer handler.
Fix this by using TCP_INC_STATS() & NET_INC_STATS() which do not assume caller is in non preemptible context.
[1]
BUG: using __this_cpu_add() in preemptible [00000000] code: epollpep/2180 caller is tcp_rtx_synack.part.0+0x36/0xc0 CPU: 10 PID: 2180 Comm: epollpep Tainted: G OE 5.16.0-0.bpo.4-amd64 #1 Debian 5.16.12-1~bpo11+1 Hardware name: Supermicro SYS-5039MC-H8TRF/X11SCD-F, BIOS 1.7 11/23/2021 Call Trace: <TASK> dump_stack_lvl+0x48/0x5e check_preemption_disabled+0xde/0xe0 tcp_rtx_synack.part.0+0x36/0xc0 tcp_rtx_synack+0x8d/0xa0 ? kmem_cache_alloc+0x2e0/0x3e0 ? apparmor_file_alloc_security+0x3b/0x1f0 inet_rtx_syn_ack+0x16/0x30 tcp_check_req+0x367/0x610 tcp_rcv_state_process+0x91/0xf60 ? get_nohz_timer_target+0x18/0x1a0 ? lock_timer_base+0x61/0x80 ? preempt_count_add+0x68/0xa0 tcp_v4_do_rcv+0xbd/0x270 __release_sock+0x6d/0xb0 release_sock+0x2b/0x90 sock_setsockopt+0x138/0x1140 ? __sys_getsockname+0x7e/0xc0 ? aa_sk_perm+0x3e/0x1a0 __sys_setsockopt+0x198/0x1e0 __x64_sys_setsockopt+0x21/0x30 do_syscall_64+0x38/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae
--- net/ipv4/tcp_output.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/ipv4/tcp_output.c +2 -2
@@ -4113,8 +4113,8 @@ int tcp_rtx_synack(const struct sock *sk, struct request_sock *req) res = af_ops->send_synack (sk,NULL , &fl, req,NULL ,TCP_SYNACK_NORMAL ,NULL );if (!res) { -__TCP_INC_STATS (sock_net (sk),TCP_MIB_RETRANSSEGS ); -__NET_INC_STATS (sock_net (sk),LINUX_MIB_TCPSYNRETRANS ); +TCP_INC_STATS (sock_net (sk),TCP_MIB_RETRANSSEGS ); +NET_INC_STATS (sock_net (sk),LINUX_MIB_TCPSYNRETRANS );if (unlikely (tcp_passive_fastopen (sk)))tcp_sk (sk)->total_retrans++;trace_tcp_retransmit_synack (sk, req);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 132/339 vdpa: ifcvf: set pci driver data in probe
In reply to Greg Kroah-HartmanFrom: Jason Wang <[email protected]>
[ Upstream commit bd8bb9aed56b1814784a975e2dfea12a9adcee92 ]
We should set the pci driver data in probe instead of the vdpa device adding callback. Otherwise if no vDPA device is created we will lose the pointer to the management device.
Message-Id: <[email protected]>
--- drivers/vdpa/ifcvf/ifcvf_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/vdpa/ifcvf/ifcvf_main.c +2 -1
@@ -765,7 +765,6 @@ static int ifcvf_vdpa_dev_add(struct vdpa_mgmt_dev *mdev, const char *name, } ifcvf_mgmt_dev->adapter = adapter; -pci_set_drvdata (pdev, ifcvf_mgmt_dev); vf = &adapter->vf; vf->dev_type =get_dev_type (pdev);
@@ -880,6 +879,8 @@ static int ifcvf_probe(struct pci_dev *pdev, const struct pci_device_id *id) goto err; } +pci_set_drvdata (pdev, ifcvf_mgmt_dev); +return 0 ; err:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 133/339 bonding: guard ns_targets by CONFIG_IPV6
In reply to Greg Kroah-HartmanFrom: Hangbin Liu <[email protected]>
[ Upstream commit c4caa500ffebf64795d1c0f6f9d6f179b502c6b7 ]
Guard ns_targets in struct bond_params by CONFIG_IPV6, which could save 256 bytes if IPv6 not configed. Also add this protection for function bond_is_ip6_target_ok() and bond_get_targets_ip6().
Remove the IS_ENABLED() check for bond_opts[] as this will make BOND_OPT_NS_TARGETS uninitialized if CONFIG_IPV6 not enabled. Add a dummy bond_option_ns_ip6_targets_set() for this situation.
--- drivers/net/bonding/bond_main.c | 2 ++ drivers/net/bonding/bond_options.c | 10 ++++++---- include/net/bonding.h | 6 ++++++ 3 files changed, 14 insertions(+), 4 deletions(-)
drivers/net/bonding/bond_main.c +2 -0
@@ -6159,7 +6159,9 @@ static int bond_check_params(struct bond_params *params)strscpy_pad (params->primary, primary,sizeof (params->primary));memcpy (params->arp_targets, arp_target,sizeof (arp_target)); +#if IS_ENABLED (CONFIG_IPV6 )memset (params->ns_targets,0 ,sizeof (struct in6_addr ) *BOND_MAX_NS_TARGETS ); +#endif return 0 ; }
drivers/net/bonding/bond_options.c +6 -4
@@ -34,10 +34,8 @@ static int bond_option_arp_ip_target_add(struct bonding *bond, __be32 target);static int bond_option_arp_ip_target_rem (struct bonding *bond,__be32 target);static int bond_option_arp_ip_targets_set (struct bonding *bond,const struct bond_opt_value *newval); -#if IS_ENABLED (CONFIG_IPV6 )static int bond_option_ns_ip6_targets_set (struct bonding *bond,const struct bond_opt_value *newval); -#endif static int bond_option_arp_validate_set (struct bonding *bond,const struct bond_opt_value *newval); static int bond_option_arp_all_targets_set(struct bonding *bond,
@@ -299,7 +297,6 @@ static const struct bond_option bond_opts[BOND_OPT_LAST] = { .flags = BOND_OPTFLAG_RAWVAL, .set = bond_option_arp_ip_targets_set }, -#if IS_ENABLED (CONFIG_IPV6 ) [BOND_OPT_NS_TARGETS] = { .id = BOND_OPT_NS_TARGETS, .name = "ns_ip6_target",
@@ -307,7 +304,6 @@ static const struct bond_option bond_opts[BOND_OPT_LAST] = { .flags = BOND_OPTFLAG_RAWVAL, .set = bond_option_ns_ip6_targets_set }, -#endif [BOND_OPT_DOWNDELAY] = { .id = BOND_OPT_DOWNDELAY, .name = "downdelay",
@@ -1254,6 +1250,12 @@ static int bond_option_ns_ip6_targets_set(struct bonding *bond,return 0 ; } +#else +static int bond_option_ns_ip6_targets_set (struct bonding *bond, +const struct bond_opt_value *newval) +{ +return -EPERM ; +}#endif static int bond_option_arp_validate_set(struct bonding *bond,
include/net/bonding.h +6 -0
@@ -149,7 +149,9 @@ struct bond_params {struct reciprocal_value reciprocal_packets_per_slave;u16 ad_actor_sys_prio;u16 ad_user_port_key; +#if IS_ENABLED (CONFIG_IPV6 )struct in6_addr ns_targets[BOND_MAX_NS_TARGETS ]; +#endif /* 2 bytes of padding : see ether_addr_equal_64bits() */ u8 ad_actor_system[ETH_ALEN +2 ];
@@ -503,12 +505,14 @@ static inline int bond_is_ip_target_ok(__be32 addr)return !ipv4_is_lbcast (addr) && !ipv4_is_zeronet (addr); } +#if IS_ENABLED (CONFIG_IPV6 )static inline int bond_is_ip6_target_ok (struct in6_addr *addr) {return !ipv6_addr_any (addr) && !ipv6_addr_loopback (addr) && !ipv6_addr_is_multicast (addr); } +#endif /* Get the oldest arp which we've received on this slave for bond's * arp_targets.
@@ -746,6 +750,7 @@ static inline int bond_get_targets_ip(__be32 *targets, __be32 ip)return -1 ; } +#if IS_ENABLED (CONFIG_IPV6 )static inline int bond_get_targets_ip6 (struct in6_addr *targets,struct in6_addr *ip) {int i;
@@ -758,6 +763,7 @@ static inline int bond_get_targets_ip6(struct in6_addr *targets, struct in6_addr return -1; } +#endif /* exported from bond_main.c */ extern unsigned int bond_net_id;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 134/339 octeontx2-af: fix error code in is_valid_offset()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit f3d671c711097a133bc36bd2bde52f1fcca783a6 ]
The is_valid_offset() function returns success/true if the call to validate_and_get_cpt_blkaddr() fails.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_cpt.c +1 -1
@@ -579,7 +579,7 @@ static bool is_valid_offset(struct rvu *rvu, struct cpt_rd_wr_reg_msg *req) blkaddr =validate_and_get_cpt_blkaddr (req->blkaddr);if (blkaddr <0 ) -return blkaddr; +return false;/* Registers that can be accessed from PF/VF */ if ((offset & 0xFF000) == CPT_AF_LFX_CTL(0) ||
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 135/339 s390/mcck: isolate SIE instruction when setting CIF_MCCK_GUEST flag
In reply to Greg Kroah-HartmanFrom: Alexander Gordeev <[email protected]>
[ Upstream commit 29ccaa4b35ea874ddd50518e5c2c746b9238a792 ]
Commit d768bd892fc8 ("s390: add options to change branch prediction behaviour for the kernel") introduced .Lsie_exit label - supposedly to fence off SIE instruction. However, the corresponding address range length .Lsie_crit_mcck_length was not updated, which led to BPON code potentionally marked with CIF_MCCK_GUEST flag.
Both .Lsie_exit and .Lsie_crit_mcck_length were removed with commit 0b0ed657fe00 ("s390: remove critical section cleanup from entry.S"), but the issue persisted - currently BPOFF and BPENTER macros might get wrongly considered by the machine check handler as a guest.
--- arch/s390/kernel/entry.S | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/s390/kernel/entry.S +5 -1
@@ -258,6 +258,10 @@ ENTRY(sie64a) BPEXIT __SF_SIE_FLAGS(%r15),(_TIF_ISOLATE_BP|_TIF_ISOLATE_BP_GUEST) .Lsie_entry: sie 0(%r14) +# Let the next instruction be NOP to avoid triggering a machine check +# and handling it in a guest as result of the instruction execution. + nopr 7 +.Lsie_leave: BPOFF BPENTER __SF_SIE_FLAGS(%r15),(_TIF_ISOLATE_BP|_TIF_ISOLATE_BP_GUEST) .Lsie_skip:
@@ -557,7 +561,7 @@ ENTRY(mcck_int_handler) jno .Lmcck_panic #if IS_ENABLED(CONFIG_KVM) OUTSIDE %r9,.Lsie_gmap,.Lsie_done,6f - OUTSIDE %r9,.Lsie_entry,.Lsie_skip,4f + OUTSIDE %r9,.Lsie_entry,.Lsie_leave,4f oi __LC_CPU_FLAGS+7, _CIF_MCCK_GUEST j 5f 4: CHKSTG .Lmcck_panic
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 136/339 regulator: mt6315-regulator: fix invalid allowed mode
In reply to Greg Kroah-HartmanFrom: Fabien Parent <[email protected]>
[ Upstream commit 28cbc2d4c54c09a427b18a1604740efb6b2cc2d6 ]
In the binding example, the regulator mode 4 is shown as a valid mode, but the driver actually only support mode 0 to 2:
This generates an error in dmesg when copy/pasting the binding example:
[ 0.306080] vbuck1: invalid regulator-allowed-modes element 4 [ 0.307290] vbuck2: invalid regulator-allowed-modes element 4
This commit fixes this error by removing the invalid mode from the examples.
--- .../devicetree/bindings/regulator/mt6315-regulator.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
Documentation/devicetree/bindings/regulator/mt6315-regulator.yaml +2 -2
@@ -55,7 +55,7 @@ examples: regulator-min-microvolt = <300000>; regulator-max-microvolt = <1193750>; regulator-enable-ramp-delay = <256>; - regulator-allowed-modes = <0 1 2 4>; + regulator-allowed-modes = <0 1 2>; }; vbuck3 {
@@ -63,7 +63,7 @@ examples: regulator-min-microvolt = <300000>; regulator-max-microvolt = <1193750>; regulator-enable-ramp-delay = <256>; - regulator-allowed-modes = <0 1 2 4>; + regulator-allowed-modes = <0 1 2>; }; }; };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 137/339 net: ping6: Fix ping -6 with interface name
In reply to Greg Kroah-HartmanFrom: Aya Levin <[email protected]>
[ Upstream commit e6652a8ef3e64d953168a95878fe29b934ad78ac ]
When passing interface parameter to ping -6:
$ ping -6 ::11:141:84:9 -I eth2 Results in: PING ::11:141:84:10(::11:141:84:10) from ::11:141:84:9 eth2: 56 data bytes ping: sendmsg: Invalid argument ping: sendmsg: Invalid argument
Initialize the fl6's outgoing interface (OIF) before triggering ip6_datagram_send_ctl. Don't wipe fl6 after ip6_datagram_send_ctl() as changes in fl6 that may happen in the function are overwritten explicitly. Update comment accordingly.
--- net/ipv6/ping.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/ipv6/ping.c +4 -4
@@ -101,6 +101,9 @@ static int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) ipc6.sockc.tsflags = sk->sk_tsflags; ipc6.sockc.mark = sk->sk_mark; +memset (&fl6,0 ,sizeof (fl6)); + fl6.flowi6_oif = oif; +if (msg->msg_controllen) {struct ipv6_txoptions opt = {};
@@ -112,17 +115,14 @@ static int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)return err;/* Changes to txoptions and flow info are not implemented, yet. -* Drop the options, fl6 is wiped below. +* Drop the options. */ ipc6.opt =NULL ; } -memset (&fl6,0 ,sizeof (fl6)); - fl6.flowi6_proto =IPPROTO_ICMPV6 ; fl6.saddr = np->saddr; fl6.daddr = *daddr; - fl6.flowi6_oif = oif; fl6.flowi6_mark = ipc6.sockc.mark; fl6.flowi6_uid = sk->sk_uid; fl6.fl6_icmp_type = user_icmph.icmp6_type;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 138/339 net/sched: act_api: fix error code in tcf_ct_flow_table_fill_tuple_ipv6()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 86360030cc5117596626bef1d937277cd2bebe05 ]
The tcf_ct_flow_table_fill_tuple_ipv6() function is supposed to return false on failure. It should not return negatives because that means succes/true.
--- net/sched/act_ct.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sched/act_ct.c +1 -1
@@ -548,7 +548,7 @@ tcf_ct_flow_table_fill_tuple_ipv6(struct sk_buff *skb,break ;#endif default : -return -1 ; +return false; }if (ip6h->hop_limit <=1 )
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 139/339 gpio: pca953x: use the correct register address to do regcache sync
In reply to Greg Kroah-HartmanFrom: Haibo Chen <[email protected]>
[ Upstream commit 43624eda86c98b0de726d0b6f2516ccc3ef7313f ]
For regcache_sync_region, need to use pca953x_recalc_addr() to get the real register address.
--- drivers/gpio/gpio-pca953x.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-)
drivers/gpio/gpio-pca953x.c +11 -8
@@ -1108,20 +1108,21 @@ static int pca953x_regcache_sync(struct device *dev) {struct pca953x_chip *chip =dev_get_drvdata (dev);int ret; +u8 regaddr;/* * The ordering between direction and output is important, * sync these registers first and only then sync the rest. */ - ret =regcache_sync_region (chip->regmap, chip->regs->direction, - chip->regs->direction +NBANK (chip)); + regaddr =pca953x_recalc_addr (chip, chip->regs->direction,0 ); + ret =regcache_sync_region (chip->regmap, regaddr, regaddr +NBANK (chip));if (ret) {dev_err (dev,"Failed to sync GPIO dir registers: %d\n" , ret);return ret; } - ret =regcache_sync_region (chip->regmap, chip->regs->output, - chip->regs->output +NBANK (chip)); + regaddr =pca953x_recalc_addr (chip, chip->regs->output,0 ); + ret =regcache_sync_region (chip->regmap, regaddr, regaddr +NBANK (chip));if (ret) {dev_err (dev,"Failed to sync GPIO out registers: %d\n" , ret);return ret;
@@ -1129,16 +1130,18 @@ static int pca953x_regcache_sync(struct device *dev)#ifdef CONFIG_GPIO_PCA953X_IRQ if (chip->driver_data &PCA_PCAL ) { - ret =regcache_sync_region (chip->regmap,PCAL953X_IN_LATCH , -PCAL953X_IN_LATCH +NBANK (chip)); + regaddr =pca953x_recalc_addr (chip,PCAL953X_IN_LATCH ,0 ); + ret =regcache_sync_region (chip->regmap, regaddr, + regaddr +NBANK (chip));if (ret) {dev_err (dev,"Failed to sync INT latch registers: %d\n" , ret);return ret; } - ret =regcache_sync_region (chip->regmap,PCAL953X_INT_MASK , -PCAL953X_INT_MASK +NBANK (chip)); + regaddr =pca953x_recalc_addr (chip,PCAL953X_INT_MASK ,0 ); + ret =regcache_sync_region (chip->regmap, regaddr, + regaddr +NBANK (chip));if (ret) {dev_err (dev,"Failed to sync INT mask registers: %d\n" , ret);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 140/339 afs: Fix infinite loop found by xfstest generic/676
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 17eabd42560f4636648ad65ba5b20228071e2363 ]
In AFS, a directory is handled as a file that the client downloads and parses locally for the purposes of performing lookup and getdents operations. The in-kernel afs filesystem has a number of functions that do this.
A directory file is arranged as a series of 2K blocks divided into 32-byte slots, where a directory entry occupies one or more slots, plus each block starts with one or more metadata blocks.
When parsing a block, if the last slots are occupied by a dirent that occupies more than a single slot and the file position points at a slot that's not the initial one, the logic in afs_dir_iterate_block() that skips over it won't advance the file pointer to the end of it. This will cause an infinite loop in getdents() as it will keep retrying that block and failing to advance beyond the final entry.
Fix this by advancing the file pointer if the next entry will be beyond it when we skip a block.
This was found by the generic/676 xfstest but can also be triggered with something like:
~/xfstests-dev/src/t_readdir_3 /xfstest.test/z 4000 1
--- fs/afs/dir.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/afs/dir.c +4 -1
@@ -463,8 +463,11 @@ static int afs_dir_iterate_block(struct afs_vnode *dvnode, }/* skip if starts before the current position */ -if (offset < curr) +if (offset < curr) { +if (next > curr) + ctx->pos = blkoff + next *sizeof (union afs_xdr_dirent );continue ; + }/* found the next entry */ if (!dir_emit(ctx, dire->u.name, nlen,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 141/339 drm/msm/dp: Always clear mask bits to disable interrupts at dp_ctrl_reset_irq_ctrl()
In reply to Greg Kroah-HartmanFrom: Kuogee Hsieh <[email protected]>
[ Upstream commit 993a2adc6e2e94a0a7b5bfc054eda90ac95f62c3 ]
dp_catalog_ctrl_reset() will software reset DP controller. But it will not reset programmable registers to default value. DP driver still have to clear mask bits to interrupt status registers to disable interrupts after software reset of controller.
At current implementation, dp_ctrl_reset_irq_ctrl() will software reset dp controller but did not call dp_catalog_ctrl_enable_irq(false) to clear hpd related interrupt mask bits to disable hpd related interrupts due to it mistakenly think hpd related interrupt mask bits will be cleared by software reset of dp controller automatically. This mistake may cause system to crash during suspending procedure due to unexpected irq fired and trigger event thread to access dp controller registers with controller clocks are disabled.
This patch fixes system crash during suspending problem by removing "enable" flag condition checking at dp_ctrl_reset_irq_ctrl() so that hpd related interrupt mask bits are cleared to prevent unexpected from happening.
Changes in v2:
-- add more details commit text
Changes in v3:
-- add synchrons_irq()
-- add atomic_t suspended
Changes in v4:
-- correct Fixes's commit ID
-- remove synchrons_irq()
Changes in v5:
-- revise commit text
Changes in v6:
-- add event_lock to protect "suspended"
Changes in v7:
-- delete "suspended" flag
Patchwork: https://patchwork.freedesktop.org/patch/486591/
--- drivers/gpu/drm/msm/dp/dp_ctrl.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/gpu/drm/msm/dp/dp_ctrl.c +7 -2
@@ -1380,8 +1380,13 @@ void dp_ctrl_reset_irq_ctrl(struct dp_ctrl *dp_ctrl, bool enable)dp_catalog_ctrl_reset (ctrl->catalog); -if (enable) -dp_catalog_ctrl_enable_irq (ctrl->catalog, enable); +/* +* all dp controller programmable registers will not +* be reset to default value after DP_SW_RESET +* therefore interrupt mask bits have to be updated +* to enable/disable interrupts +*/ +dp_catalog_ctrl_enable_irq (ctrl->catalog, enable); }void dp_ctrl_phy_init (struct dp_ctrl *dp_ctrl)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 142/339 scsi: sd: Fix potential NULL pointer dereference
In reply to Greg Kroah-HartmanFrom: Damien Le Moal <[email protected]>
[ Upstream commit 05fbde3a77a4f1d62e4c4428f384288c1f1a0be5 ]
If sd_probe() sees an early error before sdkp->device is initialized, sd_zbc_release_disk() is called. This causes a NULL pointer dereference when sd_is_zoned() is called inside that function. Avoid this by removing the call to sd_zbc_release_disk() in sd_probe() error path.
This change is safe and does not result in zone information memory leakage because the zone information for a zoned disk is allocated only when sd_revalidate_disk() is called, at which point sdkp->disk_dev is fully set, resulting in sd_disk_release() being called when needed to cleanup a disk zone information using sd_zbc_release_disk().
--- drivers/scsi/sd.c | 1 - 1 file changed, 1 deletion(-)
drivers/scsi/sd.c +0 -1
@@ -3501,7 +3501,6 @@ static int sd_probe(struct device *dev) out_put:put_disk (gd); out_free: -sd_zbc_release_disk (sdkp);kfree (sdkp); out:scsi_autopm_put_device (sdp);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 143/339 ax25: Fix ax25 session cleanup problems
In reply to Greg Kroah-HartmanFrom: Duoming Zhou <[email protected]>
[ Upstream commit 7d8a3a477b3e25ada8dc71d22048c2ea417209a0 ]
There are session cleanup problems in ax25_release() and ax25_disconnect(). If we setup a session and then disconnect, the disconnected session is still in "LISTENING" state that is shown below.
Active AX.25 sockets
Dest Source Device State Vr/Vs Send-Q Recv-Q DL9SAU-4 DL9SAU-3 ??? LISTENING 000/000 0 0 DL9SAU-3 DL9SAU-4 ??? LISTENING 000/000 0 0
The first reason is caused by del_timer_sync() in ax25_release(). The timers of ax25 are used for correct session cleanup. If we use ax25_release() to close ax25 sessions and ax25_dev is not null, the del_timer_sync() functions in ax25_release() will execute. As a result, the sessions could not be cleaned up correctly, because the timers have stopped.
In order to solve this problem, this patch adds a device_up flag in ax25_dev in order to judge whether the device is up. If there are sessions to be cleaned up, the del_timer_sync() in ax25_release() will not execute. What's more, we add ax25_cb_del() in ax25_kill_by_device(), because the timers have been stopped and there are no functions that could delete ax25_cb if we do not call ax25_release(). Finally, we reorder the position of ax25_list_lock in ax25_cb_del() in order to synchronize among different functions that call ax25_cb_del().
The second reason is caused by improper check in ax25_disconnect(). The incoming ax25 sessions which ax25->sk is null will close heartbeat timer, because the check "if(!ax25->sk || ..)" is satisfied. As a result, the session could not be cleaned up properly.
In order to solve this problem, this patch changes the improper check to "if(ax25->sk && ..)" in ax25_disconnect().
What`s more, the ax25_disconnect() may be called twice, which is not necessary. For example, ax25_kill_by_device() calls ax25_disconnect() and sets ax25->state to AX25_STATE_0, but ax25_release() calls ax25_disconnect() again.
In order to solve this problem, this patch add a check in ax25_release(). If the flag of ax25->sk equals to SOCK_DEAD, the ax25_disconnect() in ax25_release() should not be executed.
--- include/net/ax25.h | 1 + net/ax25/af_ax25.c | 27 +++++++++++++++++---------- net/ax25/ax25_dev.c | 1 + net/ax25/ax25_subr.c | 2 +- 4 files changed, 20 insertions(+), 11 deletions(-)
include/net/ax25.h +1 -0
@@ -228,6 +228,7 @@ typedef struct ax25_dev {ax25_dama_info dama;#endif refcount_t refcount; +bool device_up; } ax25_dev; typedef struct ax25_cb {
net/ax25/af_ax25.c +17 -10
@@ -62,12 +62,12 @@ static void ax25_free_sock(struct sock *sk)*/ static void ax25_cb_del (ax25_cb *ax25) { +spin_lock_bh (&ax25_list_lock);if (!hlist_unhashed (&ax25->ax25_node)) { -spin_lock_bh (&ax25_list_lock);hlist_del_init (&ax25->ax25_node); -spin_unlock_bh (&ax25_list_lock);ax25_cb_put (ax25); } +spin_unlock_bh (&ax25_list_lock); }/*
@@ -81,6 +81,7 @@ static void ax25_kill_by_device(struct net_device *dev)if ((ax25_dev =ax25_dev_ax25dev (dev)) ==NULL )return ; + ax25_dev->device_up = false;spin_lock_bh (&ax25_list_lock); again:
@@ -91,6 +92,7 @@ static void ax25_kill_by_device(struct net_device *dev)spin_unlock_bh (&ax25_list_lock);ax25_disconnect (s,ENETUNREACH ); s->ax25_dev =NULL ; +ax25_cb_del (s);spin_lock_bh (&ax25_list_lock); goto again; }
@@ -103,6 +105,7 @@ static void ax25_kill_by_device(struct net_device *dev)dev_put_track (ax25_dev->dev, &ax25_dev->dev_tracker);ax25_dev_put (ax25_dev); } +ax25_cb_del (s);release_sock (sk);spin_lock_bh (&ax25_list_lock);sock_put (sk);
@@ -995,9 +998,11 @@ static int ax25_release(struct socket *sock)if (sk->sk_type ==SOCK_SEQPACKET ) {switch (ax25->state) {case AX25_STATE_0 : -release_sock (sk); -ax25_disconnect (ax25,0 ); -lock_sock (sk); +if (!sock_flag (ax25->sk,SOCK_DEAD )) { +release_sock (sk); +ax25_disconnect (ax25,0 ); +lock_sock (sk); + }ax25_destroy_socket (ax25);break ;
@@ -1053,11 +1058,13 @@ static int ax25_release(struct socket *sock)ax25_destroy_socket (ax25); }if (ax25_dev) { -del_timer_sync (&ax25->timer); -del_timer_sync (&ax25->t1timer); -del_timer_sync (&ax25->t2timer); -del_timer_sync (&ax25->t3timer); -del_timer_sync (&ax25->idletimer); +if (!ax25_dev->device_up) { +del_timer_sync (&ax25->timer); +del_timer_sync (&ax25->t1timer); +del_timer_sync (&ax25->t2timer); +del_timer_sync (&ax25->t3timer); +del_timer_sync (&ax25->idletimer); + }dev_put_track (ax25_dev->dev, &ax25_dev->dev_tracker);ax25_dev_put (ax25_dev); }
net/ax25/ax25_dev.c +1 -0
@@ -62,6 +62,7 @@ void ax25_dev_device_up(struct net_device *dev) ax25_dev->dev = dev;dev_hold_track (dev, &ax25_dev->dev_tracker,GFP_ATOMIC ); ax25_dev->forward =NULL ; + ax25_dev->device_up = true; ax25_dev->values[AX25_VALUES_IPDEFMODE ] =AX25_DEF_IPDEFMODE ; ax25_dev->values[AX25_VALUES_AXDEFMODE ] =AX25_DEF_AXDEFMODE ;
net/ax25/ax25_subr.c +1 -1
@@ -268,7 +268,7 @@ void ax25_disconnect(ax25_cb *ax25, int reason)del_timer_sync (&ax25->t3timer);del_timer_sync (&ax25->idletimer); }else { -if (!ax25->sk || !sock_flag (ax25->sk,SOCK_DESTROY )) +if (ax25->sk && !sock_flag (ax25->sk,SOCK_DESTROY ))ax25_stop_heartbeat (ax25);ax25_stop_t1timer (ax25);ax25_stop_t2timer (ax25);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 144/339 nfp: remove padding in nfp_nfdk_tx_desc
In reply to Greg Kroah-HartmanFrom: Fei Qin <[email protected]>
[ Upstream commit c6fbbf1eae8f35e10966826960e154c9596c86dc ]
NFDK firmware supports 48-bit dma addressing and parses 16 high bits of dma addresses.
In nfp_nfdk_tx_desc, dma related structure and tso related structure are union. When "mss" be filled with nonzero value due to enable tso, the memory used by "padding" may be also filled. Then, firmware may parse wrong dma addresses which causes TX watchdog timeout problem.
This patch removes padding and unifies the dma_addr_hi bits with the one in firmware. nfp_nfdk_tx_desc_set_dma_addr is also added to match this change.
--- drivers/net/ethernet/netronome/nfp/nfdk/dp.c | 12 ++++++------ drivers/net/ethernet/netronome/nfp/nfdk/nfdk.h | 3 +-- drivers/net/ethernet/netronome/nfp/nfp_net.h | 11 ++++++++++- 3 files changed, 17 insertions(+), 9 deletions(-)
drivers/net/ethernet/netronome/nfp/nfdk/dp.c +6 -6
@@ -314,7 +314,7 @@ netdev_tx_t nfp_nfdk_tx(struct sk_buff *skb, struct net_device *netdev)FIELD_PREP (NFDK_DESC_TX_TYPE_HEAD , type); txd->dma_len_type =cpu_to_le16 (dlen_type); -nfp_desc_set_dma_addr (txd, dma_addr); +nfp_nfdk_tx_desc_set_dma_addr (txd, dma_addr);/* starts at bit 0 */ BUILD_BUG_ON (!(NFDK_DESC_TX_DMA_LEN_HEAD &1 ));
@@ -339,7 +339,7 @@ netdev_tx_t nfp_nfdk_tx(struct sk_buff *skb, struct net_device *netdev) dlen_type =FIELD_PREP (NFDK_DESC_TX_DMA_LEN , dma_len); txd->dma_len_type =cpu_to_le16 (dlen_type); -nfp_desc_set_dma_addr (txd, dma_addr); +nfp_nfdk_tx_desc_set_dma_addr (txd, dma_addr); dma_len -= dlen_type; dma_addr += dlen_type +1 ;
@@ -929,7 +929,7 @@ nfp_nfdk_tx_xdp_buf(struct nfp_net_dp *dp, struct nfp_net_rx_ring *rx_ring,FIELD_PREP (NFDK_DESC_TX_TYPE_HEAD , type); txd->dma_len_type =cpu_to_le16 (dlen_type); -nfp_desc_set_dma_addr (txd, dma_addr); +nfp_nfdk_tx_desc_set_dma_addr (txd, dma_addr); tmp_dlen = dlen_type &NFDK_DESC_TX_DMA_LEN_HEAD ; dma_len -= tmp_dlen;
@@ -940,7 +940,7 @@ nfp_nfdk_tx_xdp_buf(struct nfp_net_dp *dp, struct nfp_net_rx_ring *rx_ring, dma_len -=1 ; dlen_type =FIELD_PREP (NFDK_DESC_TX_DMA_LEN , dma_len); txd->dma_len_type =cpu_to_le16 (dlen_type); -nfp_desc_set_dma_addr (txd, dma_addr); +nfp_nfdk_tx_desc_set_dma_addr (txd, dma_addr); dlen_type &=NFDK_DESC_TX_DMA_LEN ; dma_len -= dlen_type;
@@ -1332,7 +1332,7 @@ nfp_nfdk_ctrl_tx_one(struct nfp_net *nn, struct nfp_net_r_vector *r_vec,FIELD_PREP (NFDK_DESC_TX_TYPE_HEAD , type); txd->dma_len_type =cpu_to_le16 (dlen_type); -nfp_desc_set_dma_addr (txd, dma_addr); +nfp_nfdk_tx_desc_set_dma_addr (txd, dma_addr); tmp_dlen = dlen_type &NFDK_DESC_TX_DMA_LEN_HEAD ; dma_len -= tmp_dlen;
@@ -1343,7 +1343,7 @@ nfp_nfdk_ctrl_tx_one(struct nfp_net *nn, struct nfp_net_r_vector *r_vec, dma_len -=1 ; dlen_type =FIELD_PREP (NFDK_DESC_TX_DMA_LEN , dma_len); txd->dma_len_type =cpu_to_le16 (dlen_type); -nfp_desc_set_dma_addr (txd, dma_addr); +nfp_nfdk_tx_desc_set_dma_addr (txd, dma_addr); dlen_type &=NFDK_DESC_TX_DMA_LEN ; dma_len -= dlen_type;
drivers/net/ethernet/netronome/nfp/nfdk/nfdk.h +1 -2
@@ -46,8 +46,7 @@struct nfp_nfdk_tx_desc {union {struct { -u8 dma_addr_hi;/* High bits of host buf address */ -u8 padding;/* Must be zero */ +__le16 dma_addr_hi;/* High bits of host buf address */ __le16 dma_len_type;/* Length to DMA for this desc */ __le32 dma_addr_lo;/* Low 32bit of host buf addr */ };
drivers/net/ethernet/netronome/nfp/nfp_net.h +10 -1
@@ -117,13 +117,22 @@ struct nfp_nfdk_tx_buf;/* Convenience macro for writing dma address into RX/TX descriptors */ #define nfp_desc_set_dma_addr (desc, dma_addr) \ do { \ - __typeof(desc) __d = (desc); \ + __typeof__(desc) __d = (desc); \ dma_addr_t __addr = (dma_addr); \ \ __d->dma_addr_lo = cpu_to_le32(lower_32_bits(__addr)); \ __d->dma_addr_hi = upper_32_bits(__addr) & 0xff; \ } while (0) +#define nfp_nfdk_tx_desc_set_dma_addr (desc, dma_addr) \ + do { \ + __typeof__(desc) __d = (desc); \ + dma_addr_t __addr = (dma_addr); \ + \ + __d->dma_addr_hi = cpu_to_le16(upper_32_bits(__addr) & 0xff); \ + __d->dma_addr_lo = cpu_to_le32(lower_32_bits(__addr)); \ + } while (0) +/** * struct nfp_net_tx_ring - TX ring structure * @r_vec: Back pointer to ring vector structure
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 145/339 tipc: check attribute length for bearer name
In reply to Greg Kroah-HartmanFrom: Hoang Le <[email protected]>
[ Upstream commit 7f36f798f89bf32c0164049cb0e3fd1af613d0bb ]
syzbot reported uninit-value:
=====================================================
BUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:644 [inline] BUG: KMSAN: uninit-value in string+0x4f9/0x6f0 lib/vsprintf.c:725 string_nocheck lib/vsprintf.c:644 [inline] string+0x4f9/0x6f0 lib/vsprintf.c:725 vsnprintf+0x2222/0x3650 lib/vsprintf.c:2806 vprintk_store+0x537/0x2150 kernel/printk/printk.c:2158 vprintk_emit+0x28b/0xab0 kernel/printk/printk.c:2256 vprintk_default+0x86/0xa0 kernel/printk/printk.c:2283 vprintk+0x15f/0x180 kernel/printk/printk_safe.c:50 _printk+0x18d/0x1cf kernel/printk/printk.c:2293 tipc_enable_bearer net/tipc/bearer.c:371 [inline] __tipc_nl_bearer_enable+0x2022/0x22a0 net/tipc/bearer.c:1033 tipc_nl_bearer_enable+0x6c/0xb0 net/tipc/bearer.c:1042 genl_family_rcv_msg_doit net/netlink/genetlink.c:731 [inline]
- Do sanity check the attribute length for TIPC_NLA_BEARER_NAME.
- Do not use 'illegal name' in printing message.
--- net/tipc/bearer.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/tipc/bearer.c +1 -2
@@ -259,9 +259,8 @@ static int tipc_enable_bearer(struct net *net, const char *name,u32 i;if (!bearer_name_validate (name, &b_names)) { - errstr ="illegal name" ;NL_SET_ERR_MSG (extack,"Illegal name" ); - goto rejected; +return res; }if (prio >TIPC_MAX_LINK_PRI && prio !=TIPC_MEDIA_LINK_PRI ) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 146/339 driver core: Fix wait_for_device_probe() & deferred_probe_timeout interaction
In reply to Greg Kroah-HartmanFrom: Saravana Kannan <[email protected]>
[ Upstream commit 5ee76c256e928455212ab759c51d198fedbe7523 ]
Mounting NFS rootfs was timing out when deferred_probe_timeout was non-zero [1]. This was because ip_auto_config() initcall times out waiting for the network interfaces to show up when deferred_probe_timeout was non-zero. While ip_auto_config() calls wait_for_device_probe() to make sure any currently running deferred probe work or asynchronous probe finishes, that wasn't sufficient to account for devices being deferred until deferred_probe_timeout.
Commit 35a672363ab3 ("driver core: Ensure wait_for_device_probe() waits until the deferred_probe_timeout fires") tried to fix that by making sure wait_for_device_probe() waits for deferred_probe_timeout to expire before returning.
However, if wait_for_device_probe() is called from the kernel_init() context:
- Before deferred_probe_initcall() [2], it causes the boot process to hang due to a deadlock.
- After deferred_probe_initcall() [3], it blocks kernel_init() from continuing till deferred_probe_timeout expires and beats the point of deferred_probe_timeout that's trying to wait for userspace to load modules.
Neither of this is good. So revert the changes towait_for_device_probe().
[1] - https://lore.kernel.org/lkml/TYAPR01MB45443DF63B9EF29054F7C41FD8C60@TYAPR01MB4544.jpnprd01.prod.outlook.com/
[2] - https://lore.kernel.org/lkml/[email protected]/
[3] - https://lore.kernel.org/lkml/[email protected]/
--- drivers/base/dd.c | 5 ----- 1 file changed, 5 deletions(-)
drivers/base/dd.c +0 -5
@@ -257,7 +257,6 @@ DEFINE_SHOW_ATTRIBUTE(deferred_devs);int driver_deferred_probe_timeout;EXPORT_SYMBOL_GPL (driver_deferred_probe_timeout); -static DECLARE_WAIT_QUEUE_HEAD (probe_timeout_waitqueue);static int __init deferred_probe_timeout_setup (char *str) {
@@ -312,7 +311,6 @@ static void deferred_probe_timeout_work_func(struct work_struct *work)list_for_each_entry (p, &deferred_probe_pending_list, deferred_probe)dev_info (p->device,"deferred probe pending\n" );mutex_unlock (&deferred_probe_mutex); -wake_up_all (&probe_timeout_waitqueue); } static DECLARE_DELAYED_WORK(deferred_probe_timeout_work, deferred_probe_timeout_work_func);
@@ -716,9 +714,6 @@ int driver_probe_done(void)*/ void wait_for_device_probe (void ) { -/* wait for probe timeout */ -wait_event (probe_timeout_waitqueue, !driver_deferred_probe_timeout); -/* wait for the deferred probe workqueue to finish */ flush_work (&deferred_probe_work);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 147/339 perf evsel: Fixes topdown events in a weak group for the hybrid platform
In reply to Greg Kroah-HartmanFrom: Kan Liang <[email protected]>
[ Upstream commit 39d5f412da84784bcc7f39ed49e55376be526fc7 ]
The patch ("perf evlist: Keep topdown counters in weak group") fixes the perf metrics topdown event issue when the topdown events are in a weak group on a non-hybrid platform. However, it doesn't work for the hybrid platform.
$./perf stat -e '{cpu_core/slots/,cpu_core/topdown-bad-spec/, cpu_core/topdown-be-bound/,cpu_core/topdown-fe-bound/, cpu_core/topdown-retiring/,cpu_core/branch-instructions/, cpu_core/branch-misses/,cpu_core/bus-cycles/,cpu_core/cache-misses/, cpu_core/cache-references/,cpu_core/cpu-cycles/,cpu_core/instructions/, cpu_core/mem-loads/,cpu_core/mem-stores/,cpu_core/ref-cycles/, cpu_core/cache-misses/,cpu_core/cache-references/}:W' -a sleep 1
Performance counter stats for 'system wide':
751,765,068 cpu_core/slots/ (84.07%)
<not supported> cpu_core/topdown-bad-spec/
<not supported> cpu_core/topdown-be-bound/
<not supported> cpu_core/topdown-fe-bound/
<not supported> cpu_core/topdown-retiring/
12,398,197 cpu_core/branch-instructions/ (84.07%)
1,054,218 cpu_core/branch-misses/ (84.24%)
539,764,637 cpu_core/bus-cycles/ (84.64%)
14,683 cpu_core/cache-misses/ (84.87%)
7,277,809 cpu_core/cache-references/ (77.30%)
222,299,439 cpu_core/cpu-cycles/ (77.28%)
63,661,714 cpu_core/instructions/ (84.85%)
0 cpu_core/mem-loads/ (77.29%)
12,271,725 cpu_core/mem-stores/ (77.30%)
542,241,102 cpu_core/ref-cycles/ (84.85%)
8,854 cpu_core/cache-misses/ (76.71%)
7,179,013 cpu_core/cache-references/ (76.31%)1.003245250 seconds time elapsed
A hybrid platform has a different PMU name for the core PMUs, while the current perf hard code the PMU name "cpu".
The evsel->pmu_name can be used to replace the "cpu" to fix the issue. For a hybrid platform, the pmu_name must be non-NULL. Because there are at least two core PMUs. The PMU has to be specified.
For a non-hybrid platform, the pmu_name may be NULL. Because there is only one core PMU, "cpu". For a NULL pmu_name, we can safely assume that it is a "cpu" PMU.
In case other PMUs also define the "slots" event, checking the PMU type as well.
With the patch,
$ perf stat -e '{cpu_core/slots/,cpu_core/topdown-bad-spec/,
cpu_core/topdown-be-bound/,cpu_core/topdown-fe-bound/,
cpu_core/topdown-retiring/,cpu_core/branch-instructions/,
cpu_core/branch-misses/,cpu_core/bus-cycles/,cpu_core/cache-misses/,
cpu_core/cache-references/,cpu_core/cpu-cycles/,cpu_core/instructions/,
cpu_core/mem-loads/,cpu_core/mem-stores/,cpu_core/ref-cycles/,
cpu_core/cache-misses/,cpu_core/cache-references/}:W' -a sleep 1Performance counter stats for 'system wide':
766,620,266 cpu_core/slots/ (84.06%)
73,172,129 cpu_core/topdown-bad-spec/ # 9.5% bad speculation (84.06%)
193,443,341 cpu_core/topdown-be-bound/ # 25.0% backend bound (84.06%)
403,940,929 cpu_core/topdown-fe-bound/ # 52.3% frontend bound (84.06%)
102,070,237 cpu_core/topdown-retiring/ # 13.2% retiring (84.06%)
12,364,429 cpu_core/branch-instructions/ (84.03%)
1,080,124 cpu_core/branch-misses/ (84.24%)
564,120,383 cpu_core/bus-cycles/ (84.65%)
36,979 cpu_core/cache-misses/ (84.86%)
7,298,094 cpu_core/cache-references/ (77.30%)
227,174,372 cpu_core/cpu-cycles/ (77.31%)
63,886,523 cpu_core/instructions/ (84.87%)
0 cpu_core/mem-loads/ (77.31%)
12,208,782 cpu_core/mem-stores/ (77.31%)
566,409,738 cpu_core/ref-cycles/ (84.87%)
23,118 cpu_core/cache-misses/ (76.71%)
7,212,602 cpu_core/cache-references/ (76.29%)1.003228667 seconds time elapsed
--- tools/perf/arch/x86/util/evsel.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-)
tools/perf/arch/x86/util/evsel.c +21 -2
@@ -31,10 +31,29 @@ void arch_evsel__fixup_new_cycles(struct perf_event_attr *attr)free (env.cpuid); } +/* Check whether the evsel's PMU supports the perf metrics */ +static bool evsel__sys_has_perf_metrics (const struct evsel *evsel) +{ +const char *pmu_name = evsel->pmu_name ? evsel->pmu_name :"cpu" ; + +/* +* The PERF_TYPE_RAW type is the core PMU type, e.g., "cpu" PMU +* on a non-hybrid machine, "cpu_core" PMU on a hybrid machine. +* The slots event is only available for the core PMU, which +* supports the perf metrics feature. +* Checking both the PERF_TYPE_RAW type and the slots event +* should be good enough to detect the perf metrics feature. +*/ +if ((evsel->core.attr.type ==PERF_TYPE_RAW ) && +pmu_have_event (pmu_name,"slots" )) +return true; + +return false; +} +bool arch_evsel__must_be_in_group (const struct evsel *evsel) { -if ((evsel->pmu_name &&strcmp (evsel->pmu_name,"cpu" )) || - !pmu_have_event ("cpu" ,"slots" )) +if (!evsel__sys_has_perf_metrics (evsel))return false; return evsel->name &&
Signature · 1 line
2.35.1