5.15.73-rc1 review
Greg Kroah-Hartman
maintainercover 5.15.73-rc1 review
This is the start of the stable review cycle for the 5.15.73 release. There are 37 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Oct 2022 07:03:19 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.73-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.15.73-rc1
Krzysztof Kozlowski <[email protected]>
rpmsg: qcom: glink: replace strncpy() with strscpy_pad()
Johan Hovold <[email protected]>
USB: serial: ftdi_sio: fix 300 bps rate for SIO
Tadeusz Struk <[email protected]>
usb: mon: make mmapped memory read only
Vlad Buslov <[email protected]>
net/mlx5: Disable irq when locking lag_lock
Tamizh Chelvam Raja <[email protected]>
wifi: cfg80211: fix MCS divisor value
Naoya Horiguchi <[email protected]>
mm/huge_memory: use pfn_to_online_page() in split_huge_pages_all()
Miaohe Lin <[email protected]>
mm/huge_memory: minor cleanup for split_huge_pages_all
Ian Rogers <[email protected]>
perf parse-events: Identify broken modifiers
Brian Norris <[email protected]>
mmc: core: Terminate infinite loop in SD-UHS voltage switch
ChanWoo Lee <[email protected]>
mmc: core: Replace with already defined values for readability
zhikzhai <[email protected]>
drm/amd/display: skip audio setup when audio stream is enabled
Hugo Hu <[email protected]>
drm/amd/display: update gamut remap if plane has changed
Michael Strauss <[email protected]>
drm/amd/display: Assume an LTTPR is always present on fixed_vs links
Leo Li <[email protected]>
drm/amd/display: Fix double cursor on non-video RGB MPO
Jianglei Nie <[email protected]>
net: atlantic: fix potential memory leak in aq_ndev_close()
David Gow <[email protected]>
arch: um: Mark the stack non-executable to fix a binutils warning
Lukas Straub <[email protected]>
um: Cleanup compiler warning in arch/x86/um/tls_32.c
Lukas Straub <[email protected]>
um: Cleanup syscall_handler_t cast in syscalls_32.h
Jaroslav Kysela <[email protected]>
ALSA: hda/hdmi: Fix the converter reuse for the silent stream
Oleksandr Mazur <[email protected]>
net: marvell: prestera: add support for for Aldrin2
Haimin Zhang <[email protected]>
net/ieee802154: fix uninit value bug in dgram_sendmsg
Letu Ren <[email protected]>
scsi: qedf: Fix a UAF bug in __qedf_probe()
Sergei Antonov <[email protected]>
ARM: dts: fix Moxa SDIO 'compatible', remove 'sdhci' misnomer
Swati Agarwal <[email protected]>
dmaengine: xilinx_dma: Report error in case of dma_set_mask_and_coherent API failure
Swati Agarwal <[email protected]>
dmaengine: xilinx_dma: cleanup for fetching xlnx,num-fstores property
Swati Agarwal <[email protected]>
dmaengine: xilinx_dma: Fix devm_platform_ioremap_resource error handling
Cristian Marussi <[email protected]>
firmware: arm_scmi: Add SCMI PM driver remove routine
Cristian Marussi <[email protected]>
firmware: arm_scmi: Harden accesses to the sensor domains
Cristian Marussi <[email protected]>
firmware: arm_scmi: Improve checks in the info_get operations
Dongliang Mu <[email protected]>
fs: fix UAF/GPF bug in nilfs_mdt_destroy
Mikulas Patocka <[email protected]>
provide arch_test_bit_acquire for architectures that define test_bit
Mikulas Patocka <[email protected]>
wait_on_bit: add an acquire memory barrier
Yang Shi <[email protected]>
powerpc/64s/radix: don't need to broadcast IPI for radix pmd collapse flush
Yang Shi <[email protected]>
mm: gup: fix the fast GUP race against THP collapse
Jalal Mostafa <[email protected]>
xsk: Inherit need_wakeup flag for shared sockets
Shuah Khan <[email protected]>
docs: update mediator information in CoC docs
Sami Tolvanen <[email protected]>
Makefile.extrawarn: Move -Wcast-function-type-strict to W=1
-------------
Diffstat:
.../devicetree/bindings/dma/moxa,moxart-dma.txt | 4 +- .../process/code-of-conduct-interpretation.rst | 2 +- Makefile | 4 +- arch/alpha/include/asm/bitops.h | 7 +++ arch/arm/boot/dts/moxart-uc7112lx.dts | 2 +- arch/arm/boot/dts/moxart.dtsi | 4 +- arch/hexagon/include/asm/bitops.h | 15 ++++++ arch/ia64/include/asm/bitops.h | 7 +++ arch/m68k/include/asm/bitops.h | 6 +++ arch/powerpc/mm/book3s64/radix_pgtable.c | 9 ---- arch/s390/include/asm/bitops.h | 7 +++ arch/sh/include/asm/bitops-op32.h | 7 +++ arch/um/Makefile | 8 ++++ arch/x86/include/asm/bitops.h | 21 +++++++++ arch/x86/um/shared/sysdep/syscalls_32.h | 5 +- arch/x86/um/tls_32.c | 6 --- arch/x86/um/vdso/Makefile | 2 +- drivers/dma/xilinx/xilinx_dma.c | 21 +++++---- drivers/firmware/arm_scmi/clock.c | 6 ++- drivers/firmware/arm_scmi/scmi_pm_domain.c | 20 ++++++++ drivers/firmware/arm_scmi/sensors.c | 25 ++++++++-- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 12 ++++- drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 8 ++++ .../amd/display/dc/dce110/dce110_hw_sequencer.c | 6 ++- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 1 + drivers/mmc/core/sd.c | 3 +- drivers/net/ethernet/aquantia/atlantic/aq_main.c | 3 -- .../net/ethernet/marvell/prestera/prestera_pci.c | 1 + drivers/net/ethernet/mellanox/mlx5/core/lag.c | 55 +++++++++++++--------- drivers/rpmsg/qcom_glink_native.c | 2 +- drivers/rpmsg/qcom_smd.c | 4 +- drivers/scsi/qedf/qedf_main.c | 5 -- drivers/usb/mon/mon_bin.c | 5 ++ drivers/usb/serial/ftdi_sio.c | 3 +- fs/inode.c | 7 ++- .../asm-generic/bitops/instrumented-non-atomic.h | 12 +++++ include/asm-generic/bitops/non-atomic.h | 14 ++++++ include/linux/buffer_head.h | 2 +- include/linux/scmi_protocol.h | 4 +- include/linux/wait_bit.h | 8 ++-- include/net/ieee802154_netdev.h | 37 +++++++++++++++ include/net/xsk_buff_pool.h | 2 +- kernel/sched/wait_bit.c | 2 +- mm/gup.c | 34 ++++++++++--- mm/huge_memory.c | 13 +++-- mm/khugepaged.c | 10 ++-- net/ieee802154/socket.c | 42 +++++++++-------- net/wireless/util.c | 2 +- net/xdp/xsk.c | 4 +- net/xdp/xsk_buff_pool.c | 5 +- scripts/Makefile.extrawarn | 1 + sound/pci/hda/patch_hdmi.c | 1 + tools/perf/util/parse-events.y | 10 ++++ 53 files changed, 374 insertions(+), 132 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/37 Makefile.extrawarn: Move -Wcast-function-type-strict to W=1
From: Sami Tolvanen <[email protected]>
commit 2120635108b35ecad9c59c8b44f6cbdf4f98214e upstream.
We enable -Wcast-function-type globally in the kernel to warn about mismatching types in function pointer casts. Compilers currently warn only about ABI incompability with this flag, but Clang 16 will enable a stricter version of the check by default that checks for an exact type match. This will be very noisy in the kernel, so disable -Wcast-function-type-strict without W=1 until the new warnings have been addressed.
--- scripts/Makefile.extrawarn | 1 + 1 file changed, 1 insertion(+)
scripts/Makefile.extrawarn +1 -0
@@ -52,6 +52,7 @@ KBUILD_CFLAGS += -Wno-format-zero-length KBUILD_CFLAGS += $(call cc-disable-warning, pointer-to-enum-cast) KBUILD_CFLAGS += -Wno-tautological-constant-out-of-range-compare KBUILD_CFLAGS += $(call cc-disable-warning, unaligned-access) +KBUILD_CFLAGS += $(call cc-disable-warning, cast-function-type-strict) endif endif
Greg Kroah-Hartman
maintainerPATCH 2/37 docs: update mediator information in CoC docs
In reply to Greg Kroah-HartmanFrom: Shuah Khan <[email protected]>
commit 8bfdfa0d6b929ede7b6189e0e546ceb6a124d05d upstream.
Update mediator information in the CoC interpretation document.
--- Documentation/process/code-of-conduct-interpretation.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/process/code-of-conduct-interpretation.rst +1 -1
@@ -51,7 +51,7 @@ the Technical Advisory Board (TAB) or ot uncertain how to handle situations that come up. It will not be considered a violation report unless you want it to be. If you are uncertain about approaching the TAB or any other maintainers, please -reach out to our conflict mediator, Mishi Choudhary <[email protected]>. +reach out to our conflict mediator, Joanna Lee <[email protected]>. In the end, "be kind to each other" is really what the end goal is for everybody. We know everyone is human and we all fail at times, but the
Greg Kroah-Hartman
maintainerPATCH 3/37 xsk: Inherit need_wakeup flag for shared sockets
In reply to Greg Kroah-HartmanFrom: Jalal Mostafa <[email protected]>
commit 60240bc26114543fcbfcd8a28466e67e77b20388 upstream.
The flag for need_wakeup is not set for xsks with XDP_SHARED_UMEM flag and of different queue ids and/or devices. They should inherit the flag from the first socket buffer pool since no flags can be specified once XDP_SHARED_UMEM is specified.
--- include/net/xsk_buff_pool.h | 2 +- net/xdp/xsk.c | 4 ++-- net/xdp/xsk_buff_pool.c | 5 +++-- 3 files changed, 6 insertions(+), 5 deletions(-)
include/net/xsk_buff_pool.h +1 -1
@@ -87,7 +87,7 @@ struct xsk_buff_pool *xp_create_and_assi struct xdp_umem *umem);int xp_assign_dev (struct xsk_buff_pool *pool,struct net_device *dev,u16 queue_id,u16 flags); -int xp_assign_dev_shared (struct xsk_buff_pool *pool,struct xdp_umem *umem, +int xp_assign_dev_shared (struct xsk_buff_pool *pool,struct xdp_sock *umem_xs,struct net_device *dev,u16 queue_id);int xp_alloc_tx_descs (struct xsk_buff_pool *pool,struct xdp_sock *xs);void xp_destroy (struct xsk_buff_pool *pool);
net/xdp/xsk.c +2 -2
@@ -968,8 +968,8 @@ static int xsk_bind(struct socket *sock, goto out_unlock; } - err =xp_assign_dev_shared (xs->pool, umem_xs->umem, - dev, qid); + err =xp_assign_dev_shared (xs->pool, umem_xs, dev, + qid);if (err) {xp_destroy (xs->pool); xs->pool =NULL ;
net/xdp/xsk_buff_pool.c +3 -2
@@ -206,17 +206,18 @@ err_unreg_pool:return err; } -int xp_assign_dev_shared (struct xsk_buff_pool *pool,struct xdp_umem *umem, +int xp_assign_dev_shared (struct xsk_buff_pool *pool,struct xdp_sock *umem_xs,struct net_device *dev,u16 queue_id) {u16 flags; +struct xdp_umem *umem = umem_xs->umem;/* One fill and completion ring required for each queue id. */ if (!pool->fq || !pool->cq)return -EINVAL ; flags = umem->zc ?XDP_ZEROCOPY :XDP_COPY ; -if (pool->uses_need_wakeup) +if (umem_xs->pool->uses_need_wakeup) flags |=XDP_USE_NEED_WAKEUP ;return xp_assign_dev (pool, dev, queue_id, flags);
Greg Kroah-Hartman
maintainerPATCH 4/37 mm: gup: fix the fast GUP race against THP collapse
In reply to Greg Kroah-HartmanFrom: Yang Shi <[email protected]>
commit 70cbc3cc78a997d8247b50389d37c4e1736019da upstream.
Since general RCU GUP fast was introduced in commit 2667f50e8b81 ("mm:
introduce a general RCU get_user_pages_fast()"), a TLB flush is no longer sufficient to handle concurrent GUP-fast in all cases, it only handles traditional IPI-based GUP-fast correctly. On architectures that send an IPI broadcast on TLB flush, it works as expected. But on the architectures that do not use IPI to broadcast TLB flush, it may have the below race:
CPU A CPU B
THP collapse fast GUP
gup_pmd_range() <-- see valid pmd
gup_pte_range() <-- work on ptepmdp_collapse_flush() <-- clear pmd and flush __collapse_huge_page_isolate()
check page pinned <-- before GUP bump refcount
pin the page check PTE <-- no change__collapse_huge_page_copy()
copy data to huge page
ptep_clear()
install huge pmd for the huge page
return the stale page
discard the stale page
The race can be fixed by checking whether PMD is changed or not after taking the page pin in fast GUP, just like what it does for PTE. If the PMD is changed it means there may be parallel THP collapse, so GUP should back off.
Also update the stale comment about serializing against fast GUP in khugepaged.
--- mm/gup.c | 34 ++++++++++++++++++++++++++++------ mm/khugepaged.c | 10 ++++++---- 2 files changed, 34 insertions(+), 10 deletions(-)
mm/gup.c +28 -6
@@ -2266,8 +2266,28 @@ static void __maybe_unused undo_dev_page }#ifdef CONFIG_ARCH_HAS_PTE_SPECIAL -static int gup_pte_range (pmd_t pmd,unsigned long addr,unsigned long end, -unsigned int flags,struct page **pages,int *nr) +/* +* Fast-gup relies on pte change detection to avoid concurrent pgtable +* operations. +* +* To pin the page, fast-gup needs to do below in order: +* (1) pin the page (by prefetching pte), then (2) check pte not changed. +* +* For the rest of pgtable operations where pgtable updates can be racy +* with fast-gup, we need to do (1) clear pte, then (2) check whether page +* is pinned. +* +* Above will work for all pte-level operations, including THP split. +* +* For THP collapse, it's a bit more complicated because fast-gup may be +* walking a pgtable page that is being freed (pte is still valid but pmd +* can be cleared already). To avoid race in such condition, we need to +* also check pmd here to make sure pmd doesn't change (corresponds to +* pmdp_collapse_flush() in the THP collapse code path). +*/ +static int gup_pte_range (pmd_t pmd,pmd_t *pmdp,unsigned long addr, +unsigned long end,unsigned int flags, +struct page **pages,int *nr) {struct dev_pagemap *pgmap =NULL ;int nr_start = *nr, ret =0 ;
@@ -2312,7 +2332,8 @@ static int gup_pte_range(pmd_t pmd, unsi goto pte_unmap; } -if (unlikely (pte_val (pte) !=pte_val (*ptep))) { +if (unlikely (pmd_val (pmd) !=pmd_val (*pmdp)) || +unlikely (pte_val (pte) !=pte_val (*ptep))) {put_compound_head (head,1 , flags); goto pte_unmap; }
@@ -2357,8 +2378,9 @@ pte_unmap:* get_user_pages_fast_only implementation that can pin pages. Thus it's still * useful to have gup_huge_pmd even if we can't operate on ptes. */ -static int gup_pte_range (pmd_t pmd,unsigned long addr,unsigned long end, -unsigned int flags,struct page **pages,int *nr) +static int gup_pte_range (pmd_t pmd,pmd_t *pmdp,unsigned long addr, +unsigned long end,unsigned int flags, +struct page **pages,int *nr) {return 0 ; }
@@ -2667,7 +2689,7 @@ static int gup_pmd_range(pud_t *pudp, puif (!gup_huge_pd (__hugepd (pmd_val (pmd)), addr,PMD_SHIFT , next, flags, pages, nr))return 0 ; - }else if (!gup_pte_range (pmd, addr, next, flags, pages, nr)) + }else if (!gup_pte_range (pmd, pmdp, addr, next, flags, pages, nr))return 0 ; }while (pmdp++, addr = next, addr != end);
mm/khugepaged.c +6 -4
@@ -1146,10 +1146,12 @@ static void collapse_huge_page(struct mm pmd_ptl =pmd_lock (mm, pmd);/* probably unnecessary */ /* -* After this gup_fast can't run anymore. This also removes -* any huge TLB entry from the CPU so we won't allow -* huge and small TLB entries for the same virtual address -* to avoid the risk of CPU bugs in that area. +* This removes any huge TLB entry from the CPU so we won't allow +* huge and small TLB entries for the same virtual address to +* avoid the risk of CPU bugs in that area. +* +* Parallel fast GUP is fine since fast GUP will back off when +* it detects PMD is changed. */ _pmd =pmdp_collapse_flush (vma, address, pmd);spin_unlock (pmd_ptl);
Greg Kroah-Hartman
maintainerPATCH 5/37 powerpc/64s/radix: dont need to broadcast IPI for radix pmd collapse flush
In reply to Greg Kroah-HartmanFrom: Yang Shi <[email protected]>
commit bedf03416913d88c796288f9dca109a53608c745 upstream.
The IPI broadcast is used to serialize against fast-GUP, but fast-GUP will move to use RCU instead of disabling local interrupts in fast-GUP. Using an IPI is the old-styled way of serializing against fast-GUP although it still works as expected now.
And fast-GUP now fixed the potential race with THP collapse by checking whether PMD is changed or not. So IPI broadcast in radix pmd collapse flush is not necessary anymore. But it is still needed for hash TLB.
--- arch/powerpc/mm/book3s64/radix_pgtable.c | 9 --------- 1 file changed, 9 deletions(-)
arch/powerpc/mm/book3s64/radix_pgtable.c +0 -9
@@ -954,15 +954,6 @@ pmd_t radix__pmdp_collapse_flush(struct pmd = *pmdp;pmd_clear (pmdp); -/* -* pmdp collapse_flush need to ensure that there are no parallel gup -* walk after this call. This is needed so that we can have stable -* page ref count when collapsing a page. We don't allow a collapse page -* if we have gup taken on the page. We can ensure that by sending IPI -* because gup walk happens with IRQ disabled. -*/ -serialize_against_pte_lookup (vma->vm_mm); -radix__flush_tlb_collapsed_pmd (vma->vm_mm, address);return pmd;
Greg Kroah-Hartman
maintainerPATCH 6/37 wait_on_bit: add an acquire memory barrier
In reply to Greg Kroah-HartmanFrom: Mikulas Patocka <[email protected]>
commit 8238b4579866b7c1bb99883cfe102a43db5506ff upstream.
There are several places in the kernel where wait_on_bit is not followed by a memory barrier (for example, in drivers/md/dm-bufio.c:new_read).
On architectures with weak memory ordering, it may happen that memory accesses that follow wait_on_bit are reordered before wait_on_bit and they may return invalid data.
Fix this class of bugs by introducing a new function "test_bit_acquire" that works like test_bit, but has acquire memory ordering semantics.
--- arch/x86/include/asm/bitops.h | 21 +++++++++++++++++++ include/asm-generic/bitops/instrumented-non-atomic.h | 12 ++++++++++ include/asm-generic/bitops/non-atomic.h | 14 ++++++++++++ include/linux/buffer_head.h | 2 - include/linux/wait_bit.h | 8 +++---- kernel/sched/wait_bit.c | 2 - 6 files changed, 53 insertions(+), 6 deletions(-)
arch/x86/include/asm/bitops.h +21 -0
@@ -207,6 +207,20 @@ static __always_inline bool constant_tes (addr[nr >> _BITOPS_LONG_SHIFT])) != 0; } +static __always_inline bool constant_test_bit_acquire(long nr, const volatile unsigned long *addr) +{ +bool oldbit; + + asm volatile("testb %2,%1" + CC_SET(nz) + : CC_OUT(nz) (oldbit) + : "m" (((unsigned char *)addr)[nr >> 3]), + "i" (1 << (nr & 7)) + :"memory"); + +return oldbit; +} + static __always_inline bool variable_test_bit(long nr, volatile const unsigned long *addr) {bool oldbit;
@@ -224,6 +238,13 @@ static __always_inline bool variable_tes ? constant_test_bit((nr), (addr)) \ : variable_test_bit((nr), (addr))) +static __always_inline bool +arch_test_bit_acquire (unsigned long nr,const volatile unsigned long *addr) +{ +return __builtin_constant_p (nr) ?constant_test_bit_acquire (nr, addr) : +variable_test_bit (nr, addr); +} +/** * __ffs - find first set bit in word * @word: The word to search
include/asm-generic/bitops/instrumented-non-atomic.h +12 -0
@@ -135,4 +135,16 @@ static inline bool test_bit(long nr, con return arch_test_bit(nr, addr); } +/** +* _test_bit_acquire - Determine, with acquire semantics, whether a bit is set +* @nr: bit number to test +* @addr: Address to start counting from +*/ +static __always_inline bool +test_bit_acquire (unsigned long nr,const volatile unsigned long *addr) +{ +instrument_atomic_read (addr +BIT_WORD (nr),sizeof (long )); +return arch_test_bit_acquire (nr, addr); +} +#endif /* _ASM_GENERIC_BITOPS_INSTRUMENTED_NON_ATOMIC_H */
include/asm-generic/bitops/non-atomic.h +14 -0
@@ -3,6 +3,7 @@#define _ASM_GENERIC_BITOPS_NON_ATOMIC_H_#include <asm/types.h> +#include <asm/barrier.h> /** * arch___set_bit - Set a bit in memory
@@ -119,4 +120,17 @@ arch_test_bit(unsigned int nr, const vol }#define test_bit arch_test_bit +/** +* arch_test_bit_acquire - Determine, with acquire semantics, whether a bit is set +* @nr: bit number to test +* @addr: Address to start counting from +*/ +static __always_inline bool +arch_test_bit_acquire (unsigned long nr,const volatile unsigned long *addr) +{ +unsigned long *p = ((unsigned long *)addr) +BIT_WORD (nr); +return 1UL & (smp_load_acquire (p) >> (nr & (BITS_PER_LONG -1 ))); +} +#define test_bit_acquire arch_test_bit_acquire +#endif /* _ASM_GENERIC_BITOPS_NON_ATOMIC_H_ */
include/linux/buffer_head.h +1 -1
@@ -166,7 +166,7 @@ static __always_inline int buffer_uptoda* make it consistent with folio_test_uptodate * pairs with smp_mb__before_atomic in set_buffer_uptodate */ -return (smp_load_acquire (&bh->b_state) & (1UL << BH_Uptodate)) !=0 ; +return test_bit_acquire (BH_Uptodate, &bh->b_state); }#define bh_offset (bh) ((unsigned long)(bh)->b_data & ~PAGE_MASK)
include/linux/wait_bit.h +4 -4
@@ -71,7 +71,7 @@ static inline int wait_on_bit(unsigned long *word, int bit, unsigned mode) {might_sleep (); -if (!test_bit (bit, word)) +if (!test_bit_acquire (bit, word))return 0 ; return out_of_line_wait_on_bit(word, bit, bit_wait,
@@ -96,7 +96,7 @@ static inline int wait_on_bit_io(unsigned long *word, int bit, unsigned mode) {might_sleep (); -if (!test_bit (bit, word)) +if (!test_bit_acquire (bit, word))return 0 ; return out_of_line_wait_on_bit(word, bit, bit_wait_io,
@@ -123,7 +123,7 @@ wait_on_bit_timeout(unsigned long *word, unsigned long timeout) {might_sleep (); -if (!test_bit (bit, word)) +if (!test_bit_acquire (bit, word))return 0 ; return out_of_line_wait_on_bit_timeout(word, bit, bit_wait_timeout,
@@ -151,7 +151,7 @@ wait_on_bit_action(unsigned long *word, unsigned mode) {might_sleep (); -if (!test_bit (bit, word)) +if (!test_bit_acquire (bit, word))return 0 ;return out_of_line_wait_on_bit (word, bit, action, mode); }
kernel/sched/wait_bit.c +1 -1
@@ -47,7 +47,7 @@ __wait_on_bit(struct wait_queue_head *wqprepare_to_wait (wq_head, &wbq_entry->wq_entry, mode);if (test_bit (wbq_entry->key.bit_nr, wbq_entry->key.flags)) ret = (*action)(&wbq_entry->key, mode); - }while (test_bit (wbq_entry->key.bit_nr, wbq_entry->key.flags) && !ret); + }while (test_bit_acquire (wbq_entry->key.bit_nr, wbq_entry->key.flags) && !ret);finish_wait (wq_head, &wbq_entry->wq_entry);
Greg Kroah-Hartman
maintainerPATCH 7/37 provide arch_test_bit_acquire for architectures that define test_bit
In reply to Greg Kroah-HartmanFrom: Mikulas Patocka <[email protected]>
commit d6ffe6067a54972564552ea45d320fb98db1ac5e upstream.
Some architectures define their own arch_test_bit and they also need arch_test_bit_acquire, otherwise they won't compile. We also clean up the code by using the generic test_bit if that is equivalent to the arch-specific version.
--- arch/alpha/include/asm/bitops.h | 7 +++++++ arch/hexagon/include/asm/bitops.h | 15 +++++++++++++++ arch/ia64/include/asm/bitops.h | 7 +++++++ arch/m68k/include/asm/bitops.h | 6 ++++++ arch/s390/include/asm/bitops.h | 7 +++++++ arch/sh/include/asm/bitops-op32.h | 7 +++++++ 6 files changed, 49 insertions(+)
arch/alpha/include/asm/bitops.h +7 -0
@@ -289,6 +289,13 @@ test_bit(int nr, const volatile void * areturn (1UL & (((const int *) addr)[nr >>5 ] >> (nr &31 ))) !=0UL ; } +static __always_inline bool +test_bit_acquire (unsigned long nr,const volatile unsigned long *addr) +{ +unsigned long *p = ((unsigned long *)addr) +BIT_WORD (nr); +return 1UL & (smp_load_acquire (p) >> (nr & (BITS_PER_LONG -1 ))); +} +/* * ffz = Find First Zero in word. Undefined if no zero exists, * so code should check against ~0UL first..
arch/hexagon/include/asm/bitops.h +15 -0
@@ -172,7 +172,22 @@ static inline int __test_bit(int nr, conreturn retval; } +static inline int __test_bit_acquire (int nr,const volatile unsigned long *addr) +{ +int retval; + + asmvolatile ( +"{P0 = tstbit(%1,%2); if (P0.new) %0 = #1; if (!P0.new) %0 = #0;}\n" + :"=&r" (retval) + :"r" (addr[BIT_WORD (nr)]),"r" (nr %BITS_PER_LONG ) + :"p0" ,"memory" + ); + +return retval; +} +#define test_bit (nr, addr) __test_bit(nr, addr) +#define test_bit_acquire (nr, addr) __test_bit_acquire(nr, addr)/* * ffz - find first zero in word.
arch/ia64/include/asm/bitops.h +7 -0
@@ -337,6 +337,13 @@ test_bit (int nr, const volatile void *areturn 1 & (((const volatile __u32 *) addr)[nr >>5 ] >> (nr &31 )); } +static __always_inline bool +test_bit_acquire (unsigned long nr,const volatile unsigned long *addr) +{ +unsigned long *p = ((unsigned long *)addr) +BIT_WORD (nr); +return 1UL & (smp_load_acquire (p) >> (nr & (BITS_PER_LONG -1 ))); +} +/** * ffz - find the first zero bit in a long word * @x: The long word to find the bit in
arch/m68k/include/asm/bitops.h +6 -0
@@ -153,6 +153,12 @@ static inline int test_bit(int nr, constreturn (vaddr[nr >>5 ] & (1UL << (nr &31 ))) !=0 ; } +static __always_inline bool +test_bit_acquire (unsigned long nr,const volatile unsigned long *addr) +{ +unsigned long *p = ((unsigned long *)addr) +BIT_WORD (nr); +return 1UL & (smp_load_acquire (p) >> (nr & (BITS_PER_LONG -1 ))); +}static inline int bset_reg_test_and_set_bit (int nr,volatile unsigned long *vaddr)
arch/s390/include/asm/bitops.h +7 -0
@@ -184,6 +184,13 @@ static inline bool arch_test_bit(unsignereturn *addr & mask; } +static __always_inline bool +arch_test_bit_acquire (unsigned long nr,const volatile unsigned long *addr) +{ +unsigned long *p = ((unsigned long *)addr) +BIT_WORD (nr); +return 1UL & (smp_load_acquire (p) >> (nr & (BITS_PER_LONG -1 ))); +} +static inline bool arch_test_and_set_bit_lock (unsigned long nr,volatile unsigned long *ptr) {
arch/sh/include/asm/bitops-op32.h +7 -0
@@ -138,4 +138,11 @@ static inline int test_bit(int nr, constreturn 1UL & (addr[BIT_WORD (nr)] >> (nr & (BITS_PER_LONG -1 ))); } +static __always_inline bool +test_bit_acquire (unsigned long nr,const volatile unsigned long *addr) +{ +unsigned long *p = ((unsigned long *)addr) +BIT_WORD (nr); +return 1UL & (smp_load_acquire (p) >> (nr & (BITS_PER_LONG -1 ))); +} +#endif /* __ASM_SH_BITOPS_OP32_H */
Greg Kroah-Hartman
maintainerPATCH 8/37 fs: fix UAF/GPF bug in nilfs_mdt_destroy
In reply to Greg Kroah-HartmanFrom: Dongliang Mu <[email protected]>
commit 2e488f13755ffbb60f307e991b27024716a33b29 upstream.
In alloc_inode, inode_init_always() could return -ENOMEM if security_inode_alloc() fails, which causes inode->i_private uninitialized. Then nilfs_is_metadata_file_inode() returns true and nilfs_free_inode() wrongly calls nilfs_mdt_destroy(), which frees the uninitialized inode->i_private
and leads to crashes(e.g., UAF/GPF).
Fix this by moving security_inode_alloc just prior to this_cpu_inc(nr_inodes)
--- fs/inode.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
fs/inode.c +3 -4
@@ -167,8 +167,6 @@ int inode_init_always(struct super_block inode->i_wb_frn_history =0 ;#endif -if (security_inode_alloc (inode)) - goto out;spin_lock_init (&inode->i_lock);lockdep_set_class (&inode->i_lock, &sb->s_type->i_lock_key);
@@ -205,11 +203,12 @@ int inode_init_always(struct super_block inode->i_fsnotify_mask =0 ;#endif inode->i_flctx =NULL ; + +if (unlikely (security_inode_alloc (inode))) +return -ENOMEM ;this_cpu_inc (nr_inodes);return 0 ; -out: -return -ENOMEM ; }EXPORT_SYMBOL (inode_init_always);
Greg Kroah-Hartman
maintainerPATCH 9/37 firmware: arm_scmi: Improve checks in the info_get operations
In reply to Greg Kroah-HartmanFrom: Cristian Marussi <[email protected]>
[ Upstream commit 1ecb7d27b1af6705e9a4e94415b4d8cc8cf2fbfb ]
SCMI protocols abstract and expose a number of protocol specific resources like clocks, sensors and so on. Information about such specific domain resources are generally exposed via an info_get protocol operation.
Improve the sanity check on these operations where needed.
--- drivers/firmware/arm_scmi/clock.c | 6 +++++- drivers/firmware/arm_scmi/sensors.c | 3 +++ include/linux/scmi_protocol.h | 4 ++-- 3 files changed, 10 insertions(+), 3 deletions(-)
drivers/firmware/arm_scmi/clock.c +5 -1
@@ -315,9 +315,13 @@ static int scmi_clock_count_get(const struct scmi_protocol_handle *ph)static const struct scmi_clock_info *scmi_clock_info_get (const struct scmi_protocol_handle *ph,u32 clk_id) { +struct scmi_clock_info *clk;struct clock_info *ci = ph->get_priv (ph); -struct scmi_clock_info *clk = ci->clk + clk_id; +if (clk_id >= ci->num_clocks) +return NULL ; + + clk = ci->clk + clk_id;if (!clk->name[0 ])return NULL ;
drivers/firmware/arm_scmi/sensors.c +3 -0
@@ -817,6 +817,9 @@ scmi_sensor_info_get(const struct scmi_protocol_handle *ph, u32 sensor_id) {struct sensors_info *si = ph->get_priv (ph); +if (sensor_id >= si->num_sensors) +return NULL ; +return si->sensors + sensor_id; }
include/linux/scmi_protocol.h +2 -2
@@ -74,7 +74,7 @@ struct scmi_protocol_handle;struct scmi_clk_proto_ops {int (*count_get)(const struct scmi_protocol_handle *ph); -const struct scmi_clock_info *(*info_get) +const struct scmi_clock_info __must_check *(*info_get) (const struct scmi_protocol_handle *ph,u32 clk_id);int (*rate_get)(const struct scmi_protocol_handle *ph,u32 clk_id,u64 *rate);
@@ -452,7 +452,7 @@ enum scmi_sensor_class {*/ struct scmi_sensor_proto_ops {int (*count_get)(const struct scmi_protocol_handle *ph); -const struct scmi_sensor_info *(*info_get) +const struct scmi_sensor_info __must_check *(*info_get) (const struct scmi_protocol_handle *ph,u32 sensor_id);int (*trip_point_config)(const struct scmi_protocol_handle *ph,u32 sensor_id,u8 trip_id,u64 trip_value);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 10/37 firmware: arm_scmi: Harden accesses to the sensor domains
In reply to Greg Kroah-HartmanFrom: Cristian Marussi <[email protected]>
[ Upstream commit 76f89c954788763db575fb512a40bd483864f1e9 ]
Accessing sensor domains descriptors by the index upon the SCMI drivers requests through the SCMI sensor operations interface can potentially lead to out-of-bound violations if the SCMI driver misbehave.
Add an internal consistency check before any such domains descriptors accesses.
--- drivers/firmware/arm_scmi/sensors.c | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-)
drivers/firmware/arm_scmi/sensors.c +18 -4
@@ -631,6 +631,10 @@ static int scmi_sensor_config_get(const struct scmi_protocol_handle *ph, {int ret;struct scmi_xfer *t; +struct sensors_info *si = ph->get_priv (ph); + +if (sensor_id >= si->num_sensors) +return -EINVAL ; ret = ph->xops->xfer_get_init (ph,SENSOR_CONFIG_GET ,sizeof (__le32),sizeof (__le32), &t);
@@ -640,7 +644,6 @@ static int scmi_sensor_config_get(const struct scmi_protocol_handle *ph,put_unaligned_le32 (sensor_id, t->tx.buf); ret = ph->xops->do_xfer (ph, t);if (!ret) { -struct sensors_info *si = ph->get_priv (ph);struct scmi_sensor_info *s = si->sensors + sensor_id; *sensor_config =get_unaligned_le64 (t->rx.buf);
@@ -657,6 +660,10 @@ static int scmi_sensor_config_set(const struct scmi_protocol_handle *ph,int ret;struct scmi_xfer *t;struct scmi_msg_sensor_config_set *msg; +struct sensors_info *si = ph->get_priv (ph); + +if (sensor_id >= si->num_sensors) +return -EINVAL ; ret = ph->xops->xfer_get_init (ph,SENSOR_CONFIG_SET ,sizeof (*msg),0 , &t);
@@ -669,7 +676,6 @@ static int scmi_sensor_config_set(const struct scmi_protocol_handle *ph, ret = ph->xops->do_xfer (ph, t);if (!ret) { -struct sensors_info *si = ph->get_priv (ph);struct scmi_sensor_info *s = si->sensors + sensor_id; s->sensor_config = sensor_config;
@@ -700,8 +706,11 @@ static int scmi_sensor_reading_get(const struct scmi_protocol_handle *ph,int ret;struct scmi_xfer *t;struct scmi_msg_sensor_reading_get *sensor; +struct scmi_sensor_info *s;struct sensors_info *si = ph->get_priv (ph); -struct scmi_sensor_info *s = si->sensors + sensor_id; + +if (sensor_id >= si->num_sensors) +return -EINVAL ; ret = ph->xops->xfer_get_init (ph,SENSOR_READING_GET ,sizeof (*sensor),0 , &t);
@@ -710,6 +719,7 @@ static int scmi_sensor_reading_get(const struct scmi_protocol_handle *ph, sensor = t->tx.buf; sensor->id =cpu_to_le32 (sensor_id); + s = si->sensors + sensor_id;if (s->async) { sensor->flags =cpu_to_le32 (SENSOR_READ_ASYNC ); ret = ph->xops->do_xfer_with_response (ph, t);
@@ -764,9 +774,13 @@ scmi_sensor_reading_get_timestamped(const struct scmi_protocol_handle *ph,int ret;struct scmi_xfer *t;struct scmi_msg_sensor_reading_get *sensor; +struct scmi_sensor_info *s;struct sensors_info *si = ph->get_priv (ph); -struct scmi_sensor_info *s = si->sensors + sensor_id; +if (sensor_id >= si->num_sensors) +return -EINVAL ; + + s = si->sensors + sensor_id;if (!count || !readings || (!s->num_axis && count >1 ) || (s->num_axis && count > s->num_axis))return -EINVAL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 11/37 firmware: arm_scmi: Add SCMI PM driver remove routine
In reply to Greg Kroah-HartmanFrom: Cristian Marussi <[email protected]>
[ Upstream commit dea796fcab0a219830831c070b8dc367d7e0f708 ]
Currently, when removing the SCMI PM driver not all the resources registered with genpd subsystem are properly de-registered.
As a side effect of this after a driver unload/load cycle you get a splat with a few warnings like this:
| debugfs: Directory 'BIG_CPU0' with parent 'pm_genpd' already present! | debugfs: Directory 'BIG_CPU1' with parent 'pm_genpd' already present! | debugfs: Directory 'LITTLE_CPU0' with parent 'pm_genpd' already present! | debugfs: Directory 'LITTLE_CPU1' with parent 'pm_genpd' already present! | debugfs: Directory 'LITTLE_CPU2' with parent 'pm_genpd' already present! | debugfs: Directory 'LITTLE_CPU3' with parent 'pm_genpd' already present! | debugfs: Directory 'BIG_SSTOP' with parent 'pm_genpd' already present! | debugfs: Directory 'LITTLE_SSTOP' with parent 'pm_genpd' already present! | debugfs: Directory 'DBGSYS' with parent 'pm_genpd' already present! | debugfs: Directory 'GPUTOP' with parent 'pm_genpd' already present!
Add a proper scmi_pm_domain_remove callback to the driver in order to take care of all the needed cleanups not handled by devres framework.
--- drivers/firmware/arm_scmi/scmi_pm_domain.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
drivers/firmware/arm_scmi/scmi_pm_domain.c +20 -0
@@ -112,9 +112,28 @@ static int scmi_pm_domain_probe(struct scmi_device *sdev) scmi_pd_data->domains = domains; scmi_pd_data->num_domains = num_domains; +dev_set_drvdata (dev, scmi_pd_data); +return of_genpd_add_provider_onecell (np, scmi_pd_data); } +static void scmi_pm_domain_remove (struct scmi_device *sdev) +{ +int i; +struct genpd_onecell_data *scmi_pd_data; +struct device *dev = &sdev->dev; +struct device_node *np = dev->of_node; + +of_genpd_del_provider (np); + + scmi_pd_data =dev_get_drvdata (dev); +for (i =0 ; i < scmi_pd_data->num_domains; i++) { +if (!scmi_pd_data->domains[i]) +continue ; +pm_genpd_remove (scmi_pd_data->domains[i]); + } +} +static const struct scmi_device_id scmi_id_table[] = { {SCMI_PROTOCOL_POWER ,"genpd" }, { },
@@ -124,6 +143,7 @@ MODULE_DEVICE_TABLE(scmi, scmi_id_table);static struct scmi_driver scmi_power_domain_driver = { .name ="scmi-power-domain" , .probe = scmi_pm_domain_probe, + .remove = scmi_pm_domain_remove, .id_table = scmi_id_table, };module_scmi_driver (scmi_power_domain_driver);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 12/37 dmaengine: xilinx_dma: Fix devm_platform_ioremap_resource error handling
In reply to Greg Kroah-HartmanFrom: Swati Agarwal <[email protected]>
[ Upstream commit 91df7751eb890e970afc08f50b8f0fa5ea39e03d ]
Add missing cleanup in devm_platform_ioremap_resource(). When probe fails remove dma channel resources and disable clocks in accordance with the order of resources allocated .
--- drivers/dma/xilinx/xilinx_dma.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/dma/xilinx/xilinx_dma.c +7 -6
@@ -3037,9 +3037,10 @@ static int xilinx_dma_probe(struct platform_device *pdev)/* Request and map I/O memory */ xdev->regs =devm_platform_ioremap_resource (pdev,0 ); -if (IS_ERR (xdev->regs)) -return PTR_ERR (xdev->regs); - +if (IS_ERR (xdev->regs)) { + err =PTR_ERR (xdev->regs); + goto disable_clks; + }/* Retrieve the DMA engine properties from the device tree */ xdev->max_buffer_len =GENMASK (XILINX_DMA_MAX_TRANS_LEN_MAX -1 ,0 ); xdev->s2mm_chan_id = xdev->dma_config->max_channels /2 ;
@@ -3134,7 +3135,7 @@ static int xilinx_dma_probe(struct platform_device *pdev)for_each_child_of_node (node, child) { err =xilinx_dma_child_probe (xdev, child);if (err <0 ) - goto disable_clks; + goto error; }if (xdev->dma_config->dmatype ==XDMA_TYPE_VDMA ) {
@@ -3169,12 +3170,12 @@ static int xilinx_dma_probe(struct platform_device *pdev)return 0 ; -disable_clks: -xdma_disable_allclks (xdev); error:for (i =0 ; i < xdev->dma_config->max_channels; i++)if (xdev->chan[i])xilinx_dma_chan_remove (xdev->chan[i]); +disable_clks: +xdma_disable_allclks (xdev);return err; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 13/37 dmaengine: xilinx_dma: cleanup for fetching xlnx,num-fstores property
In reply to Greg Kroah-HartmanFrom: Swati Agarwal <[email protected]>
[ Upstream commit 462bce790e6a7e68620a4ce260cc38f7ed0255d5 ]
Free the allocated resources for missing xlnx,num-fstores property.
--- drivers/dma/xilinx/xilinx_dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dma/xilinx/xilinx_dma.c +1 -1
@@ -3068,7 +3068,7 @@ static int xilinx_dma_probe(struct platform_device *pdev)if (err <0 ) {dev_err (xdev->dev,"missing xlnx,num-fstores property\n" ); -return err; + goto disable_clks; } err = of_property_read_u32(node, "xlnx,flush-fsync",
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 14/37 dmaengine: xilinx_dma: Report error in case of dma_set_mask_and_coherent API failure
In reply to Greg Kroah-HartmanFrom: Swati Agarwal <[email protected]>
[ Upstream commit 8f2b6bc79c32f0fa60df000ae387a790ec80eae9 ]
The driver does not handle the failure case while calling dma_set_mask_and_coherent API.
In case of failure, capture the return value of API and then report an error.
Addresses-coverity: Unchecked return value (CHECKED_RETURN)
--- drivers/dma/xilinx/xilinx_dma.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/dma/xilinx/xilinx_dma.c +5 -1
@@ -3088,7 +3088,11 @@ static int xilinx_dma_probe(struct platform_device *pdev) xdev->ext_addr = false;/* Set the dma mask bits */ -dma_set_mask_and_coherent (xdev->dev,DMA_BIT_MASK (addr_width)); + err =dma_set_mask_and_coherent (xdev->dev,DMA_BIT_MASK (addr_width)); +if (err <0 ) { +dev_err (xdev->dev,"DMA mask error %d\n" , err); + goto disable_clks; + }/* Initialize the DMA engine */ xdev->common.dev = &pdev->dev;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 15/37 ARM: dts: fix Moxa SDIO compatible, remove sdhci misnomer
In reply to Greg Kroah-HartmanFrom: Sergei Antonov <[email protected]>
[ Upstream commit 02181e68275d28cab3c3f755852770367f1bc229 ]
Driver moxart-mmc.c has .compatible = "moxa,moxart-mmc".
But moxart .dts/.dtsi and the documentation file moxa,moxart-dma.txt contain compatible = "moxa,moxart-sdhci".
Change moxart .dts/.dtsi files and moxa,moxart-dma.txt to match the driver.
Replace 'sdhci' with 'mmc' in names too, since SDHCI is a different controller from FTSDC010.
--- Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt | 4 ++-- arch/arm/boot/dts/moxart-uc7112lx.dts | 2 +- arch/arm/boot/dts/moxart.dtsi | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-)
Documentation/devicetree/bindings/dma/moxa,moxart-dma.txt +2 -2
@@ -34,8 +34,8 @@ Example: Use specific request line passing from dma For example, MMC request line is 5 - sdhci: sdhci@98e00000 { - compatible = "moxa,moxart-sdhci"; + mmc: mmc@98e00000 { + compatible = "moxa,moxart-mmc"; reg = <0x98e00000 0x5C>; interrupts = <5 0>; clocks = <&clk_apb>;
arch/arm/boot/dts/moxart-uc7112lx.dts +1 -1
@@ -79,7 +79,7 @@ &clk_pll { clocks = <&ref12>; }; -&sdhci { +&mmc { status = "okay"; };
arch/arm/boot/dts/moxart.dtsi +2 -2
@@ -93,8 +93,8 @@ watchdog: watchdog@98500000 { clock-names = "PCLK"; }; - sdhci: sdhci@98e00000 { - compatible = "moxa,moxart-sdhci"; + mmc: mmc@98e00000 { + compatible = "moxa,moxart-mmc"; reg = <0x98e00000 0x5C>; interrupts = <5 IRQ_TYPE_LEVEL_HIGH>; clocks = <&clk_apb>;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 16/37 scsi: qedf: Fix a UAF bug in __qedf_probe()
In reply to Greg Kroah-HartmanFrom: Letu Ren <[email protected]>
[ Upstream commit fbfe96869b782364caebae0445763969ddb6ea67 ]
In __qedf_probe(), if qedf->cdev is NULL which means qed_ops->common->probe() failed, then the program will goto label err1, and scsi_host_put() will free lport->host pointer. Because the memory qedf points to is allocated by libfc_host_alloc(), it will be freed by scsi_host_put(). However, the if statement below label err0 only checks whether qedf is NULL but doesn't check whether the memory has been freed. So a UAF bug can occur.
There are two ways to reach the statements below err0. The first one is described as before, "qedf" should be set to NULL. The second one is goto "err0" directly. In the latter scenario qedf hasn't been changed and it has the initial value NULL. As a result the if statement is not reachable in any situation.
The KASAN logs are as follows:
[ 2.312969] BUG: KASAN: use-after-free in __qedf_probe+0x5dcf/0x6bc0 [ 2.312969] [ 2.312969] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 2.312969] Call Trace: [ 2.312969] dump_stack_lvl+0x59/0x7b [ 2.312969] print_address_description+0x7c/0x3b0 [ 2.312969] ? __qedf_probe+0x5dcf/0x6bc0 [ 2.312969] __kasan_report+0x160/0x1c0 [ 2.312969] ? __qedf_probe+0x5dcf/0x6bc0 [ 2.312969] kasan_report+0x4b/0x70 [ 2.312969] ? kobject_put+0x25d/0x290 [ 2.312969] kasan_check_range+0x2ca/0x310 [ 2.312969] __qedf_probe+0x5dcf/0x6bc0 [ 2.312969] ? selinux_kernfs_init_security+0xdc/0x5f0 [ 2.312969] ? trace_rpm_return_int_rcuidle+0x18/0x120 [ 2.312969] ? rpm_resume+0xa5c/0x16e0 [ 2.312969] ? qedf_get_generic_tlv_data+0x160/0x160 [ 2.312969] local_pci_probe+0x13c/0x1f0 [ 2.312969] pci_device_probe+0x37e/0x6c0
--- drivers/scsi/qedf/qedf_main.c | 5 ----- 1 file changed, 5 deletions(-)
drivers/scsi/qedf/qedf_main.c +0 -5
@@ -3686,11 +3686,6 @@ static int __qedf_probe(struct pci_dev *pdev, int mode) err1:scsi_host_put (lport->host); err0: -if (qedf) { -QEDF_INFO (&qedf->dbg_ctx,QEDF_LOG_DISC ,"Probe done.\n" ); - -clear_bit (QEDF_PROBING , &qedf->flags); - }return rc; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 17/37 net/ieee802154: fix uninit value bug in dgram_sendmsg
In reply to Greg Kroah-HartmanFrom: Haimin Zhang <[email protected]>
[ Upstream commit 94160108a70c8af17fa1484a37e05181c0e094af ]
There is uninit value bug in dgram_sendmsg function in net/ieee802154/socket.c when the length of valid data pointed by the msg->msg_name isn't verified.
We introducing a helper function ieee802154_sockaddr_check_size to check namelen. First we check there is addr_type in ieee802154_addr_sa. Then, we check namelen according to addr_type.
Also fixed in raw_bind, dgram_bind, dgram_connect.
--- include/net/ieee802154_netdev.h | 37 +++++++++++++++++++++++++++++ net/ieee802154/socket.c | 42 ++++++++++++++++++--------------- 2 files changed, 60 insertions(+), 19 deletions(-)
include/net/ieee802154_netdev.h +37 -0
@@ -15,6 +15,22 @@#ifndef IEEE802154_NETDEVICE_H #define IEEE802154_NETDEVICE_H +#define IEEE802154_REQUIRED_SIZE (struct_type, member) \ + (offsetof(typeof(struct_type), member) + \ + sizeof(((typeof(struct_type) *)(NULL))->member)) + +#define IEEE802154_ADDR_OFFSET \ + offsetof(typeof(struct sockaddr_ieee802154), addr) + +#define IEEE802154_MIN_NAMELEN (IEEE802154_ADDR_OFFSET + \ + IEEE802154_REQUIRED_SIZE(struct ieee802154_addr_sa, addr_type)) + +#define IEEE802154_NAMELEN_SHORT (IEEE802154_ADDR_OFFSET + \ + IEEE802154_REQUIRED_SIZE(struct ieee802154_addr_sa, short_addr)) + +#define IEEE802154_NAMELEN_LONG (IEEE802154_ADDR_OFFSET + \ + IEEE802154_REQUIRED_SIZE(struct ieee802154_addr_sa, hwaddr)) +#include <net/af_ieee802154.h> #include <linux/netdevice.h> #include <linux/skbuff.h>
@@ -165,6 +181,27 @@ static inline void ieee802154_devaddr_to_raw(void *raw, __le64 addr)memcpy (raw, &temp,IEEE802154_ADDR_LEN ); } +static inline int +ieee802154_sockaddr_check_size (struct sockaddr_ieee802154 *daddr,int len) +{ +struct ieee802154_addr_sa *sa; + + sa = &daddr->addr; +if (len <IEEE802154_MIN_NAMELEN ) +return -EINVAL ; +switch (sa->addr_type) { +case IEEE802154_ADDR_SHORT : +if (len <IEEE802154_NAMELEN_SHORT ) +return -EINVAL ; +break ; +case IEEE802154_ADDR_LONG : +if (len <IEEE802154_NAMELEN_LONG ) +return -EINVAL ; +break ; + } +return 0 ; +} +static inline void ieee802154_addr_from_sa (struct ieee802154_addr *a,const struct ieee802154_addr_sa *sa) {
net/ieee802154/socket.c +23 -19
78 lines not on this page · raw message
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 18/37 net: marvell: prestera: add support for for Aldrin2
In reply to Greg Kroah-HartmanFrom: Oleksandr Mazur <[email protected]>
[ Upstream commit 9124dbcc2dd6c51e81f97f63f7807118c4eb140a ]
Aldrin2 (98DX8525) is a Marvell Prestera PP, with 100G support.
V2:
- retarget to net tree instead of net-next;
- fix missed colon in patch subject ('net marvell' vs 'net: mavell');
--- drivers/net/ethernet/marvell/prestera/prestera_pci.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/marvell/prestera/prestera_pci.c +1 -0
@@ -815,6 +815,7 @@ static void prestera_pci_remove(struct pci_dev *pdev)static const struct pci_device_id prestera_pci_devices[] = { {PCI_DEVICE (PCI_VENDOR_ID_MARVELL ,0xC804 ) }, {PCI_DEVICE (PCI_VENDOR_ID_MARVELL ,0xC80C ) }, + {PCI_DEVICE (PCI_VENDOR_ID_MARVELL ,0xCC1E ) }, { } };MODULE_DEVICE_TABLE (pci, prestera_pci_devices);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 19/37 ALSA: hda/hdmi: Fix the converter reuse for the silent stream
In reply to Greg Kroah-HartmanFrom: Jaroslav Kysela <[email protected]>
[ Upstream commit 5f80d6bd2b01de4cafac3302f58456bf860322fc ]
When the user space pcm stream uses the silent stream converter, it is no longer allocated for the silent stream. Clear the appropriate flag in the hdmi_pcm_open() function. The silent stream setup may be applied in hdmi_pcm_close() (and the error path - open fcn) again.
If the flag is not cleared, the reuse conditions for the silent stream converter in hdmi_choose_cvt() may improperly share this converter.
--- sound/pci/hda/patch_hdmi.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_hdmi.c +1 -0
@@ -1270,6 +1270,7 @@ static int hdmi_pcm_open(struct hda_pcm_stream *hinfo,set_bit (pcm_idx, &spec->pcm_in_use); per_pin =get_pin (spec, pin_idx); per_pin->cvt_nid = per_cvt->cvt_nid; + per_pin->silent_stream = false; hinfo->nid = per_cvt->cvt_nid;/* flip stripe flag for the assigned stream if supported */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 20/37 um: Cleanup syscall_handler_t cast in syscalls_32.h
In reply to Greg Kroah-HartmanFrom: Lukas Straub <[email protected]>
[ Upstream commit 61670b4d270c71219def1fbc9441debc2ac2e6e9 ]
Like in f4f03f299a56ce4d73c5431e0327b3b6cb55ebb9 "um: Cleanup syscall_handler_t definition/cast, fix warning", remove the cast to to fix the compiler warning.
--- arch/x86/um/shared/sysdep/syscalls_32.h | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
arch/x86/um/shared/sysdep/syscalls_32.h +2 -3
@@ -6,10 +6,9 @@#include <asm/unistd.h> #include <sysdep/ptrace.h> -typedef long syscall_handler_t (struct pt_regs ); +typedef long syscall_handler_t (struct syscall_args );extern syscall_handler_t *sys_call_table[];#define EXECUTE_SYSCALL (syscall, regs) \ - ((long (*)(struct syscall_args)) \ - (*sys_call_table[syscall]))(SYSCALL_ARGS(®s->regs)) + ((*sys_call_table[syscall]))(SYSCALL_ARGS(®s->regs))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 21/37 um: Cleanup compiler warning in arch/x86/um/tls_32.c
In reply to Greg Kroah-HartmanFrom: Lukas Straub <[email protected]>
[ Upstream commit d27fff3499671dc23a08efd01cdb8b3764a391c4 ]
arch.tls_array is statically allocated so checking for NULL doesn't make sense. This causes the compiler warning below.
Remove the checks to silence these warnings.
../arch/x86/um/tls_32.c: In function 'get_free_idx':../arch/x86/um/tls_32.c:68:13: warning: the comparison will always evaluate as 'true' for the address of 'tls_array' will never be NULL [-Waddress]
68 | if (!t->arch.tls_array)
| ^
In file included from ../arch/x86/um/asm/processor.h:10,
from ../include/linux/rcupdate.h:30,
from ../include/linux/rculist.h:11,
from ../include/linux/pid.h:5,
from ../include/linux/sched.h:14,
from ../arch/x86/um/tls_32.c:7:../arch/x86/um/asm/processor_32.h:22:31: note: 'tls_array' declared here
22 | struct uml_tls_struct tls_array[GDT_ENTRY_TLS_ENTRIES];
| ^~~~~~~~~../arch/x86/um/tls_32.c: In function 'get_tls_entry':../arch/x86/um/tls_32.c:243:13: warning: the comparison will always evaluate as 'true' for the address of 'tls_array' will never be NULL [-Waddress]
243 | if (!t->arch.tls_array)
| ^../arch/x86/um/asm/processor_32.h:22:31: note: 'tls_array' declared here
22 | struct uml_tls_struct tls_array[GDT_ENTRY_TLS_ENTRIES];
| ^~~~~~~~~
--- arch/x86/um/tls_32.c | 6 ------ 1 file changed, 6 deletions(-)
arch/x86/um/tls_32.c +0 -6
@@ -65,9 +65,6 @@ static int get_free_idx(struct task_struct* task)struct thread_struct *t = &task->thread;int idx; -if (!t->arch.tls_array) -return GDT_ENTRY_TLS_MIN ; -for (idx =0 ; idx <GDT_ENTRY_TLS_ENTRIES ; idx++)if (!t->arch.tls_array[idx].present)return idx +GDT_ENTRY_TLS_MIN ;
@@ -240,9 +237,6 @@ static int get_tls_entry(struct task_struct *task, struct user_desc *info, {struct thread_struct *t = &task->thread; -if (!t->arch.tls_array) - goto clear; -if (idx <GDT_ENTRY_TLS_MIN || idx >GDT_ENTRY_TLS_MAX )return -EINVAL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 22/37 arch: um: Mark the stack non-executable to fix a binutils warning
In reply to Greg Kroah-HartmanFrom: David Gow <[email protected]>
[ Upstream commit bd71558d585ac61cfd799db7f25e78dca404dd7a ]
Since binutils 2.39, ld will print a warning if any stack section is executable, which is the default for stack sections on files without a .note.GNU-stack section.
This was fixed for x86 in commit ffcf9c5700e4 ("x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments"), but remained broken for UML, resulting in several warnings:
/usr/bin/ld: warning: arch/x86/um/vdso/vdso.o: missing .note.GNU-stack section implies executable stack /usr/bin/ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker /usr/bin/ld: warning: .tmp_vmlinux.kallsyms1 has a LOAD segment with RWX permissions /usr/bin/ld: warning: .tmp_vmlinux.kallsyms1.o: missing .note.GNU-stack section implies executable stack /usr/bin/ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker /usr/bin/ld: warning: .tmp_vmlinux.kallsyms2 has a LOAD segment with RWX permissions /usr/bin/ld: warning: .tmp_vmlinux.kallsyms2.o: missing .note.GNU-stack section implies executable stack /usr/bin/ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker /usr/bin/ld: warning: vmlinux has a LOAD segment with RWX permissions
Link both the VDSO and vmlinux with -z noexecstack, fixing the warnings about .note.GNU-stack sections. In addition, pass --no-warn-rwx-segments to dodge the remaining warnings about LOAD segments with RWX permissions in the kallsyms objects. (Note that this flag is apparently not available on lld, so hide it behind a test for BFD, which is what the x86 patch does.)
--- arch/um/Makefile | 8 ++++++++ arch/x86/um/vdso/Makefile | 2 +- 2 files changed, 9 insertions(+), 1 deletion(-)
arch/um/Makefile +8 -0
@@ -132,10 +132,18 @@ export LDS_ELF_FORMAT := $(ELF_FORMAT) # The wrappers will select whether using "malloc" or the kernel allocator. LINK_WRAPS = -Wl,--wrap,malloc -Wl,--wrap,free -Wl,--wrap,calloc +# Avoid binutils 2.39+ warnings by marking the stack non-executable and +# ignorning warnings for the kallsyms sections. +LDFLAGS_EXECSTACK = -z noexecstack +ifeq ($(CONFIG_LD_IS_BFD),y) +LDFLAGS_EXECSTACK += $(call ld-option,--no-warn-rwx-segments) +endif + LD_FLAGS_CMDLINE = $(foreach opt,$(KBUILD_LDFLAGS),-Wl,$(opt)) # Used by link-vmlinux.sh which has special support for um link export CFLAGS_vmlinux := $(LINK-y) $(LINK_WRAPS) $(LD_FLAGS_CMDLINE) +export LDFLAGS_vmlinux := $(LDFLAGS_EXECSTACK) # When cleaning we don't include .config, so we don't include # TT or skas makefiles and don't clean skas_ptregs.h.
arch/x86/um/vdso/Makefile +1 -1
@@ -62,7 +62,7 @@ quiet_cmd_vdso = VDSO $@ -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^) && \ sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@' -VDSO_LDFLAGS = -fPIC -shared -Wl,--hash-style=sysv +VDSO_LDFLAGS = -fPIC -shared -Wl,--hash-style=sysv -z noexecstack GCOV_PROFILE := n #
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 23/37 net: atlantic: fix potential memory leak in aq_ndev_close()
In reply to Greg Kroah-HartmanFrom: Jianglei Nie <[email protected]>
[ Upstream commit 65e5d27df61283e5390f04b09dc79cd832f95607 ]
If aq_nic_stop() fails, aq_ndev_close() returns err without calling aq_nic_deinit() to release the relevant memory and resource, which will lead to a memory leak.
We can fix it by deleting the if condition judgment and goto statement to call aq_nic_deinit() directly after aq_nic_stop() to fix the memory leak.
--- drivers/net/ethernet/aquantia/atlantic/aq_main.c | 3 --- 1 file changed, 3 deletions(-)
drivers/net/ethernet/aquantia/atlantic/aq_main.c +0 -3
@@ -89,11 +89,8 @@ static int aq_ndev_close(struct net_device *ndev)int err =0 ; err =aq_nic_stop (aq_nic); -if (err <0 ) - goto err_exit;aq_nic_deinit (aq_nic, true); -err_exit:return err; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 24/37 drm/amd/display: Fix double cursor on non-video RGB MPO
In reply to Greg Kroah-HartmanFrom: Leo Li <[email protected]>
[ Upstream commit b261509952bc19d1012cf732f853659be6ebc61e ]
[Why]
DC makes use of layer_index (zpos) when picking the HW plane to enable HW cursor on. However, some compositors will not attach zpos information to each DRM plane. Consequently, in amdgpu, we default layer_index to 0 and do not update it.
This causes said DC logic to enable HW cursor on all planes of the same layer_index, which manifests as a double cursor issue if one of the planes is scaled (and hence scaling the cursor as well).
[How]
Use DRM core helpers to calculate a normalized_zpos value for each drm_plane_state under each crtc, within the atomic state.
This helper will first consider existing zpos values, and if identical/unset, fallback to plane ID ordering.
The normalized_zpos is then passed to dc_plane_info during atomic check for later use by the cursor logic.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +10 -2
@@ -5442,7 +5442,7 @@ fill_dc_plane_info_and_addr(struct amdgpu_device *adev, plane_info->visible = true; plane_info->stereo_format =PLANE_STEREO_FORMAT_NONE ; - plane_info->layer_index =0 ; + plane_info->layer_index = plane_state->normalized_zpos; ret =fill_plane_color_attributes (plane_state, plane_info->format, &plane_info->color_space);
@@ -5509,7 +5509,7 @@ static int fill_dc_plane_attributes(struct amdgpu_device *adev, dc_plane_state->global_alpha = plane_info.global_alpha; dc_plane_state->global_alpha_value = plane_info.global_alpha_value; dc_plane_state->dcc = plane_info.dcc; - dc_plane_state->layer_index = plane_info.layer_index;// Always returns 0 + dc_plane_state->layer_index = plane_info.layer_index; dc_plane_state->flip_int_enabled = true;/*
@@ -10828,6 +10828,14 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev, } } +/* +* DC consults the zpos (layer_index in DC terminology) to determine the +* hw plane on which to enable the hw cursor (see +* `dcn10_can_pipe_disable_cursor`). By now, all modified planes are in +* atomic state, so call drm helper to normalize zpos. +*/ +drm_atomic_normalize_zpos (dev, state); +/* Remove exiting planes if they are modified */ for_each_oldnew_plane_in_state_reverse (state, plane, old_plane_state, new_plane_state, i) { ret = dm_update_plane_state(dc, state, plane,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 25/37 drm/amd/display: Assume an LTTPR is always present on fixed_vs links
In reply to Greg Kroah-HartmanFrom: Michael Strauss <[email protected]>
[ Upstream commit 29956d0fded036a570bd8e7d4ea4b1a1730307d2 ]
[WHY]
LTTPRs can in very rare instsances fail to increment DPCD LTTPR count. This results in aux-i LTTPR requests to be sent to the wrong DPCD address, which causes link training failure.
[HOW]
Override internal repeater count if fixed_vs flag is set for a given link
--- drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +8 -0
@@ -3703,6 +3703,14 @@ bool dp_retrieve_lttpr_cap(struct dc_link *link) lttpr_dpcd_data[DP_PHY_REPEATER_EXTENDED_WAIT_TIMEOUT -DP_LT_TUNABLE_PHY_REPEATER_FIELD_DATA_STRUCTURE_REV ]; +/* If this chip cap is set, at least one retimer must exist in the chain +* Override count to 1 if we receive a known bad count (0 or an invalid value) */ +if (link->chip_caps &EXT_DISPLAY_PATH_CAPS__DP_FIXED_VS_EN && + (dp_convert_to_count (link->dpcd_caps.lttpr_caps.phy_repeater_cnt) ==0 )) { +ASSERT (0 ); + link->dpcd_caps.lttpr_caps.phy_repeater_cnt =0x80 ; + } +/* Attempt to train in LTTPR transparent mode if repeater count exceeds 8. */ is_lttpr_present = (dp_convert_to_count(link->dpcd_caps.lttpr_caps.phy_repeater_cnt) != 0 && link->dpcd_caps.lttpr_caps.max_lane_count > 0 &&
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 26/37 drm/amd/display: update gamut remap if plane has changed
In reply to Greg Kroah-HartmanFrom: Hugo Hu <[email protected]>
[ Upstream commit 52bb21499cf54fa65b56d97cd0d68579c90207dd ]
[Why]
The desktop plane and full-screen game plane may have different gamut remap coefficients, if switching between desktop and full-screen game without updating the gamut remap will cause incorrect color.
[How]
Update gamut remap if planes change.
--- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +1 -0
@@ -1513,6 +1513,7 @@ static void dcn20_update_dchubp_dpp(/* Any updates are handled in dc interface, just need * to apply existing for plane enable / opp change */ if (pipe_ctx->update_flags.bits.enable || pipe_ctx->update_flags.bits.opp_changed + || pipe_ctx->update_flags.bits.plane_changed || pipe_ctx->stream->update_flags.bits.gamut_remap || pipe_ctx->stream->update_flags.bits.out_csc) {/* dpp/cm gamut remap*/
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 27/37 drm/amd/display: skip audio setup when audio stream is enabled
In reply to Greg Kroah-HartmanFrom: zhikzhai <[email protected]>
[ Upstream commit 65fbfb02c2734cacffec5e3f492e1b4f1dabcf98 ]
[why]
We have minimal pipe split transition method to avoid pipe allocation outage.However, this method will invoke audio setup which cause audio output stuck once pipe reallocate.
[how]
skip audio setup for pipelines which audio stream has been enabled
--- drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c +4 -2
@@ -2108,7 +2108,8 @@ static void dce110_setup_audio_dto(continue ;if (pipe_ctx->stream->signal !=SIGNAL_TYPE_HDMI_TYPE_A )continue ; -if (pipe_ctx->stream_res.audio !=NULL ) { +if (pipe_ctx->stream_res.audio !=NULL && + pipe_ctx->stream_res.audio->enabled == false) {struct audio_output audio_output;build_audio_output (context, pipe_ctx, &audio_output);
@@ -2156,7 +2157,8 @@ static void dce110_setup_audio_dto(if (!dc_is_dp_signal (pipe_ctx->stream->signal))continue ; -if (pipe_ctx->stream_res.audio !=NULL ) { +if (pipe_ctx->stream_res.audio !=NULL && + pipe_ctx->stream_res.audio->enabled == false) {struct audio_output audio_output;build_audio_output (context, pipe_ctx, &audio_output);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 28/37 mmc: core: Replace with already defined values for readability
In reply to Greg Kroah-HartmanFrom: ChanWoo Lee <[email protected]>
[ Upstream commit e427266460826bea21b70f9b2bb29decfb2c2620 ]
SD_ROCR_S18A is already defined and is used to check the rocr value, so let's replace with already defined values for readability.
Stable-dep-of: e9233917a7e5 ("mmc: core: Terminate infinite loop in SD-UHS voltage switch")
--- drivers/mmc/core/sd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/core/sd.c +1 -1
@@ -863,7 +863,7 @@ int mmc_sd_get_cid(struct mmc_host *host, u32 ocr, u32 *cid, u32 *rocr)* the CCS bit is set as well. We deliberately deviate from the spec in * regards to this, which allows UHS-I to be supported for SDSC cards. */ -if (!mmc_host_is_spi (host) && rocr && (*rocr &0x01000000 )) { +if (!mmc_host_is_spi (host) && rocr && (*rocr &SD_ROCR_S18A )) { err =mmc_set_uhs_voltage (host, pocr);if (err == -EAGAIN ) { retries--;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 29/37 mmc: core: Terminate infinite loop in SD-UHS voltage switch
In reply to Greg Kroah-HartmanFrom: Brian Norris <[email protected]>
[ Upstream commit e9233917a7e53980664efbc565888163c0a33c3f ]
This loop intends to retry a max of 10 times, with some implicit termination based on the SD_{R,}OCR_S18A bit. Unfortunately, the termination condition depends on the value reported by the SD card (*rocr), which may or may not correctly reflect what we asked it to do.
Needless to say, it's not wise to rely on the card doing what we expect; we should at least terminate the loop regardless. So, check both the input and output values, so we ensure we will terminate regardless of the SD card behavior.
Note that SDIO learned a similar retry loop in commit 0797e5f1453b ("mmc: core: Fixup signal voltage switch"), but that used the 'ocr' result, and so the current pre-terminating condition looks like:
rocr & ocr & R4_18V_PRESENT
(i.e., it doesn't have the same bug.)
This addresses a number of crash reports seen on ChromeOS that look like the following:
... // lots of repeated: ...
<4>[13142.846061] mmc1: Skipping voltage switch
<4>[13143.406087] mmc1: Skipping voltage switch
<4>[13143.964724] mmc1: Skipping voltage switch
<4>[13144.526089] mmc1: Skipping voltage switch
<4>[13145.086088] mmc1: Skipping voltage switch
<4>[13145.645941] mmc1: Skipping voltage switch
<3>[13146.153969] INFO: task halt:30352 blocked for more than 122 seconds.
...--- drivers/mmc/core/sd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/mmc/core/sd.c +2 -1
@@ -863,7 +863,8 @@ int mmc_sd_get_cid(struct mmc_host *host, u32 ocr, u32 *cid, u32 *rocr)* the CCS bit is set as well. We deliberately deviate from the spec in * regards to this, which allows UHS-I to be supported for SDSC cards. */ -if (!mmc_host_is_spi (host) && rocr && (*rocr &SD_ROCR_S18A )) { +if (!mmc_host_is_spi (host) && (ocr &SD_OCR_S18R ) && + rocr && (*rocr &SD_ROCR_S18A )) { err =mmc_set_uhs_voltage (host, pocr);if (err == -EAGAIN ) { retries--;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 30/37 perf parse-events: Identify broken modifiers
In reply to Greg Kroah-HartmanFrom: Ian Rogers <[email protected]>
[ Upstream commit eabd4523395e4a8f2b049165642801f2ab8ff893 ]
Previously the broken modifier causes a usage message to printed but nothing else.
After:
$ perf stat -e 'cycles:kk' -a sleep 2
event syntax error: 'cycles:kk'
\___ Bad modifier
Run 'perf list' for a list of valid eventsUsage: perf stat [<options>] [<command>]
-e, --event <event> event selector. use 'perf list' to list available events
$ perf stat -e '{instructions,cycles}:kk' -a sleep 2
event syntax error: '..ns,cycles}:kk'
\___ Bad modifier
Run 'perf list' for a list of valid eventsUsage: perf stat [<options>] [<command>]
-e, --event <event> event selector. use 'perf list' to list available events
Stable-dep-of: 71c86cda750b ("perf parse-events: Remove "not supported" hybrid cache events")
--- tools/perf/util/parse-events.y | 10 ++++++++++ 1 file changed, 10 insertions(+)
tools/perf/util/parse-events.y +10 -0
@@ -183,6 +183,11 @@ group_def ':' PE_MODIFIER_EVENT err = parse_events__modifier_group(list, $3); free($3); if (err) { + struct parse_events_state *parse_state = _parse_state; + struct parse_events_error *error = parse_state->error; + + parse_events__handle_error(error, @3.first_column, + strdup("Bad modifier"), NULL); free_list_evsel(list); YYABORT; }
@@ -240,6 +245,11 @@ event_name PE_MODIFIER_EVENT err = parse_events__modifier_event(list, $2, false); free($2); if (err) { + struct parse_events_state *parse_state = _parse_state; + struct parse_events_error *error = parse_state->error; + + parse_events__handle_error(error, @2.first_column, + strdup("Bad modifier"), NULL); free_list_evsel(list); YYABORT; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 31/37 mm/huge_memory: minor cleanup for split_huge_pages_all
In reply to Greg Kroah-HartmanFrom: Miaohe Lin <[email protected]>
[ Upstream commit a17206dac7b262e7abed5a05e34a6bd6bd0a9b06 ]
There is nothing to do if a zone doesn't have any pages managed by the buddy allocator. So we should check managed_zone instead. Also if a thp is found, there's no need to traverse the subpages again.
Stable-dep-of: 2b7aa91ba0e8 ("mm/huge_memory: use pfn_to_online_page() in split_huge_pages_all()")
--- mm/huge_memory.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
mm/huge_memory.c +6 -1
@@ -2879,9 +2879,12 @@ static void split_huge_pages_all(void)unsigned long total =0 , split =0 ;pr_debug ("Split all THPs\n" ); -for_each_populated_zone (zone) { +for_each_zone (zone) { +if (!managed_zone (zone)) +continue ; max_zone_pfn =zone_end_pfn (zone);for (pfn = zone->zone_start_pfn; pfn < max_zone_pfn; pfn++) { +int nr_pages;if (!pfn_valid (pfn))continue ;
@@ -2897,8 +2900,10 @@ static void split_huge_pages_all(void) total++;lock_page (page); + nr_pages =thp_nr_pages (page);if (!split_huge_page (page)) split++; + pfn += nr_pages -1 ;unlock_page (page); next:put_page (page);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 32/37 mm/huge_memory: use pfn_to_online_page() in split_huge_pages_all()
In reply to Greg Kroah-HartmanFrom: Naoya Horiguchi <[email protected]>
[ Upstream commit 2b7aa91ba0e86b8643f5d3c83874c80599c731d7 ]
NULL pointer dereference is triggered when calling thp split via debugfs on the system with offlined memory blocks. With debug option enabled, the following kernel messages are printed out:
page:00000000467f4890 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x121c000
flags: 0x17fffc00000000(node=0|zone=2|lastcpupid=0x1ffff)
raw: 0017fffc00000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: unmovable page page:000000007d7ab72e is uninitialized and poisoned page dumped because: VM_BUG_ON_PAGE(PagePoisoned(p)) ------------[ cut here ]------------ kernel BUG at include/linux/mm.h:1248! invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 16 PID: 20964 Comm: bash Tainted: G I 6.0.0-rc3-foll-numa+ #41 ... RIP: 0010:split_huge_pages_write+0xcf4/0xe30
This shows that page_to_nid() in page_zone() is unexpectedly called for an offlined memmap.
Use pfn_to_online_page() to get struct page in PFN walker.
--- mm/huge_memory.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
mm/huge_memory.c +2 -4
@@ -2885,11 +2885,9 @@ static void split_huge_pages_all(void) max_zone_pfn =zone_end_pfn (zone);for (pfn = zone->zone_start_pfn; pfn < max_zone_pfn; pfn++) {int nr_pages; -if (!pfn_valid (pfn)) -continue ; - page =pfn_to_page (pfn); -if (!get_page_unless_zero (page)) + page =pfn_to_online_page (pfn); +if (!page || !get_page_unless_zero (page))continue ;if (zone !=page_zone (page))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 33/37 wifi: cfg80211: fix MCS divisor value
In reply to Greg Kroah-HartmanFrom: Tamizh Chelvam Raja <[email protected]>
[ Upstream commit 64e966d1e84b29c9fa916cfeaabbf4013703942e ]
The Bitrate for HE/EHT MCS6 is calculated wrongly due to the incorrect MCS divisor value for mcs6. Fix it with the proper value.
previous mcs_divisor value = (11769/6144) = 1.915527
fixed mcs_divisor value = (11377/6144) = 1.851725
--- net/wireless/util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/wireless/util.c +1 -1
@@ -1353,7 +1353,7 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate)25599 ,/* 4.166666... */ 17067 ,/* 2.777777... */ 12801 ,/* 2.083333... */ -11769 ,/* 1.851851... */ +11377 ,/* 1.851725... */ 10239 ,/* 1.666666... */ 8532 ,/* 1.388888... */ 7680, /* 1.250000... */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 34/37 net/mlx5: Disable irq when locking lag_lock
In reply to Greg Kroah-HartmanFrom: Vlad Buslov <[email protected]>
[ Upstream commit 8e93f29422ffe968d7161f91acdf0d47f5323727 ]
The lag_lock is taken from both process and softirq contexts which results lockdep warning[0] about potential deadlock. However, just disabling softirqs by using *_bh spinlock API is not enough since it will cause warning in some contexts where the lock is obtained with hard irqs disabled. To fix the issue save current irq state, disable them before obtaining the lock an re-enable irqs from saved state after releasing it.
[0]:
[Sun Aug 7 13:12:29 2022] ================================
[Sun Aug 7 13:12:29 2022] WARNING: inconsistent lock state
[Sun Aug 7 13:12:29 2022] 5.19.0_for_upstream_debug_2022_08_04_16_06 #1 Not tainted
[Sun Aug 7 13:12:29 2022] --------------------------------
[Sun Aug 7 13:12:29 2022] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
[Sun Aug 7 13:12:29 2022] swapper/0/0 [HC0[0]:SC1[1]:HE1:SE0] takes:
[Sun Aug 7 13:12:29 2022] ffffffffa06dc0d8 (lag_lock){+.?.}-{2:2}, at: mlx5_lag_is_shared_fdb+0x1f/0x120 [mlx5_core]
[Sun Aug 7 13:12:29 2022] {SOFTIRQ-ON-W} state was registered at:
[Sun Aug 7 13:12:29 2022] lock_acquire+0x1c1/0x550
[Sun Aug 7 13:12:29 2022] _raw_spin_lock+0x2c/0x40
[Sun Aug 7 13:12:29 2022] mlx5_lag_add_netdev+0x13b/0x480 [mlx5_core]
[Sun Aug 7 13:12:29 2022] mlx5e_nic_enable+0x114/0x470 [mlx5_core]
[Sun Aug 7 13:12:29 2022] mlx5e_attach_netdev+0x30e/0x6a0 [mlx5_core]
[Sun Aug 7 13:12:29 2022] mlx5e_resume+0x105/0x160 [mlx5_core]
[Sun Aug 7 13:12:29 2022] mlx5e_probe+0xac3/0x14f0 [mlx5_core]
[Sun Aug 7 13:12:29 2022] auxiliary_bus_probe+0x9d/0xe0
[Sun Aug 7 13:12:29 2022] really_probe+0x1e0/0xaa0
[Sun Aug 7 13:12:29 2022] __driver_probe_device+0x219/0x480
[Sun Aug 7 13:12:29 2022] driver_probe_device+0x49/0x130
[Sun Aug 7 13:12:29 2022] __driver_attach+0x1e4/0x4d0
[Sun Aug 7 13:12:29 2022] bus_for_each_dev+0x11e/0x1a0
[Sun Aug 7 13:12:29 2022] bus_add_driver+0x3f4/0x5a0
[Sun Aug 7 13:12:29 2022] driver_register+0x20f/0x390
[Sun Aug 7 13:12:29 2022] __auxiliary_driver_register+0x14e/0x260
[Sun Aug 7 13:12:29 2022] mlx5e_init+0x38/0x90 [mlx5_core]
[Sun Aug 7 13:12:29 2022] vhost_iotlb_itree_augment_rotate+0xcb/0x180 [vhost_iotlb]
[Sun Aug 7 13:12:29 2022] do_one_initcall+0xc4/0x400
[Sun Aug 7 13:12:29 2022] do_init_module+0x18a/0x620
[Sun Aug 7 13:12:29 2022] load_module+0x563a/0x7040
[Sun Aug 7 13:12:29 2022] __do_sys_finit_module+0x122/0x1d0
[Sun Aug 7 13:12:29 2022] do_syscall_64+0x3d/0x90
[Sun Aug 7 13:12:29 2022] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[Sun Aug 7 13:12:29 2022] irq event stamp: 3596508
[Sun Aug 7 13:12:29 2022] hardirqs last enabled at (3596508): [<ffffffff813687c2>] __local_bh_enable_ip+0xa2/0x100
[Sun Aug 7 13:12:29 2022] hardirqs last disabled at (3596507): [<ffffffff813687da>] __local_bh_enable_ip+0xba/0x100
[Sun Aug 7 13:12:29 2022] softirqs last enabled at (3596488): [<ffffffff81368a2a>] irq_exit_rcu+0x11a/0x170
[Sun Aug 7 13:12:29 2022] softirqs last disabled at (3596495): [<ffffffff81368a2a>] irq_exit_rcu+0x11a/0x170
[Sun Aug 7 13:12:29 2022]
other info that might help us debug this:
[Sun Aug 7 13:12:29 2022] Possible unsafe locking scenario:[Sun Aug 7 13:12:29 2022] CPU0
[Sun Aug 7 13:12:29 2022] ----
[Sun Aug 7 13:12:29 2022] lock(lag_lock);
[Sun Aug 7 13:12:29 2022] <Interrupt>
[Sun Aug 7 13:12:29 2022] lock(lag_lock);
[Sun Aug 7 13:12:29 2022]
*** DEADLOCK ***[Sun Aug 7 13:12:29 2022] 4 locks held by swapper/0/0:
[Sun Aug 7 13:12:29 2022] #0: ffffffff84643260 (rcu_read_lock){....}-{1:2}, at: mlx5e_napi_poll+0x43/0x20a0 [mlx5_core]
[Sun Aug 7 13:12:29 2022] #1: ffffffff84643260 (rcu_read_lock){....}-{1:2}, at: netif_receive_skb_list_internal+0x2d7/0xd60
[Sun Aug 7 13:12:29 2022] #2: ffff888144a18b58 (&br->hash_lock){+.-.}-{2:2}, at: br_fdb_update+0x301/0x570
[Sun Aug 7 13:12:29 2022] #3: ffffffff84643260 (rcu_read_lock){....}-{1:2}, at: atomic_notifier_call_chain+0x5/0x1d0
[Sun Aug 7 13:12:29 2022]
stack backtrace:
[Sun Aug 7 13:12:29 2022] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.19.0_for_upstream_debug_2022_08_04_16_06 #1
[Sun Aug 7 13:12:29 2022] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
[Sun Aug 7 13:12:29 2022] Call Trace:
[Sun Aug 7 13:12:29 2022] <IRQ>
[Sun Aug 7 13:12:29 2022] dump_stack_lvl+0x57/0x7d
[Sun Aug 7 13:12:29 2022] mark_lock.part.0.cold+0x5f/0x92
[Sun Aug 7 13:12:29 2022] ? lock_chain_count+0x20/0x20
[Sun Aug 7 13:12:29 2022] ? unwind_next_frame+0x1c4/0x1b50
[Sun Aug 7 13:12:29 2022] ? secondary_startup_64_no_verify+0xcd/0xdb
[Sun Aug 7 13:12:29 2022] ? mlx5e_napi_poll+0x4e9/0x20a0 [mlx5_core]
[Sun Aug 7 13:12:29 2022] ? mlx5e_napi_poll+0x4e9/0x20a0 [mlx5_core]
[Sun Aug 7 13:12:29 2022] ? stack_access_ok+0x1d0/0x1d0
[Sun Aug 7 13:12:29 2022] ? start_kernel+0x3a7/0x3c5
[Sun Aug 7 13:12:29 2022] __lock_acquire+0x1260/0x6720
[Sun Aug 7 13:12:29 2022] ? lock_chain_count+0x20/0x20
[Sun Aug 7 13:12:29 2022] ? lock_chain_count+0x20/0x20
[Sun Aug 7 13:12:29 2022] ? register_lock_class+0x1880/0x1880
[Sun Aug 7 13:12:29 2022] ? mark_lock.part.0+0xed/0x3060
[Sun Aug 7 13:12:29 2022] ? stack_trace_save+0x91/0xc0
[Sun Aug 7 13:12:29 2022] lock_acquire+0x1c1/0x550
[Sun Aug 7 13:12:29 2022] ? mlx5_lag_is_shared_fdb+0x1f/0x120 [mlx5_core]
[Sun Aug 7 13:12:29 2022] ? lockdep_hardirqs_on_prepare+0x400/0x400
[Sun Aug 7 13:12:29 2022] ? __lock_acquire+0xd6f/0x6720
[Sun Aug 7 13:12:29 2022] _raw_spin_lock+0x2c/0x40
[Sun Aug 7 13:12:29 2022] ? mlx5_lag_is_shared_fdb+0x1f/0x120 [mlx5_core]
[Sun Aug 7 13:12:29 2022] mlx5_lag_is_shared_fdb+0x1f/0x120 [mlx5_core]
[Sun Aug 7 13:12:29 2022] mlx5_esw_bridge_rep_vport_num_vhca_id_get+0x1a0/0x600 [mlx5_core]
[Sun Aug 7 13:12:29 2022] ? mlx5_esw_bridge_update_work+0x90/0x90 [mlx5_core]
[Sun Aug 7 13:12:29 2022] ? lock_acquire+0x1c1/0x550
[Sun Aug 7 13:12:29 2022] mlx5_esw_bridge_switchdev_event+0x185/0x8f0 [mlx5_core]
[Sun Aug 7 13:12:29 2022] ? mlx5_esw_bridge_port_obj_attr_set+0x3e0/0x3e0 [mlx5_core]
[Sun Aug 7 13:12:29 2022] ? check_chain_key+0x24a/0x580
[Sun Aug 7 13:12:29 2022] atomic_notifier_call_chain+0xd7/0x1d0
[Sun Aug 7 13:12:29 2022] br_switchdev_fdb_notify+0xea/0x100
[Sun Aug 7 13:12:29 2022] ? br_switchdev_set_port_flag+0x310/0x310
[Sun Aug 7 13:12:29 2022] fdb_notify+0x11b/0x150
[Sun Aug 7 13:12:29 2022] br_fdb_update+0x34c/0x570
[Sun Aug 7 13:12:29 2022] ? lock_chain_count+0x20/0x20
[Sun Aug 7 13:12:29 2022] ? br_fdb_add_local+0x50/0x50
[Sun Aug 7 13:12:29 2022] ? br_allowed_ingress+0x5f/0x1070
[Sun Aug 7 13:12:29 2022] ? check_chain_key+0x24a/0x580
[Sun Aug 7 13:12:29 2022] br_handle_frame_finish+0x786/0x18e0
[Sun Aug 7 13:12:29 2022] ? check_chain_key+0x24a/0x580
[Sun Aug 7 13:12:29 2022] ? br_handle_local_finish+0x20/0x20
[Sun Aug 7 13:12:29 2022] ? __lock_acquire+0xd6f/0x6720
[Sun Aug 7 13:12:29 2022] ? sctp_inet_bind_verify+0x4d/0x190
[Sun Aug 7 13:12:29 2022] ? xlog_unpack_data+0x2e0/0x310
[Sun Aug 7 13:12:29 2022] ? br_handle_local_finish+0x20/0x20
[Sun Aug 7 13:12:29 2022] br_nf_hook_thresh+0x227/0x380 [br_netfilter]
[Sun Aug 7 13:12:29 2022] ? setup_pre_routing+0x460/0x460 [br_netfilter]
[Sun Aug 7 13:12:29 2022] ? br_handle_local_finish+0x20/0x20
[Sun Aug 7 13:12:29 2022] ? br_nf_pre_routing_ipv6+0x48b/0x69c [br_netfilter]
[Sun Aug 7 13:12:29 2022] br_nf_pre_routing_finish_ipv6+0x5c2/0xbf0 [br_netfilter]
[Sun Aug 7 13:12:29 2022] ? br_handle_local_finish+0x20/0x20
[Sun Aug 7 13:12:29 2022] br_nf_pre_routing_ipv6+0x4c6/0x69c [br_netfilter]
[Sun Aug 7 13:12:29 2022] ? br_validate_ipv6+0x9e0/0x9e0 [br_netfilter]
[Sun Aug 7 13:12:29 2022] ? br_nf_forward_arp+0xb70/0xb70 [br_netfilter]
[Sun Aug 7 13:12:29 2022] ? br_nf_pre_routing+0xacf/0x1160 [br_netfilter]
[Sun Aug 7 13:12:29 2022] br_handle_frame+0x8a9/0x1270
[Sun Aug 7 13:12:29 2022] ? br_handle_frame_finish+0x18e0/0x18e0
[Sun Aug 7 13:12:29 2022] ? register_lock_class+0x1880/0x1880
[Sun Aug 7 13:12:29 2022] ? br_handle_local_finish+0x20/0x20
[Sun Aug 7 13:12:29 2022] ? bond_handle_frame+0xf9/0xac0 [bonding]
[Sun Aug 7 13:12:29 2022] ? br_handle_frame_finish+0x18e0/0x18e0
[Sun Aug 7 13:12:29 2022] __netif_receive_skb_core+0x7c0/0x2c70
[Sun Aug 7 13:12:29 2022] ? check_chain_key+0x24a/0x580
[Sun Aug 7 13:12:29 2022] ? generic_xdp_tx+0x5b0/0x5b0
[Sun Aug 7 13:12:29 2022] ? __lock_acquire+0xd6f/0x6720
[Sun Aug 7 13:12:29 2022] ? register_lock_class+0x1880/0x1880
[Sun Aug 7 13:12:29 2022] ? check_chain_key+0x24a/0x580
[Sun Aug 7 13:12:29 2022] __netif_receive_skb_list_core+0x2d7/0x8a0
[Sun Aug 7 13:12:29 2022] ? lock_acquire+0x1c1/0x550
[Sun Aug 7 13:12:29 2022] ? process_backlog+0x960/0x960
[Sun Aug 7 13:12:29 2022] ? lockdep_hardirqs_on_prepare+0x129/0x400
[Sun Aug 7 13:12:29 2022] ? kvm_clock_get_cycles+0x14/0x20
[Sun Aug 7 13:12:29 2022] netif_receive_skb_list_internal+0x5f4/0xd60
[Sun Aug 7 13:12:29 2022] ? do_xdp_generic+0x150/0x150
[Sun Aug 7 13:12:29 2022] ? mlx5e_poll_rx_cq+0xf6b/0x2960 [mlx5_core]
[Sun Aug 7 13:12:29 2022] ? mlx5e_poll_ico_cq+0x3d/0x1590 [mlx5_core]
[Sun Aug 7 13:12:29 2022] napi_complete_done+0x188/0x710
[Sun Aug 7 13:12:29 2022] mlx5e_napi_poll+0x4e9/0x20a0 [mlx5_core]
[Sun Aug 7 13:12:29 2022] ? __queue_work+0x53c/0xeb0
[Sun Aug 7 13:12:29 2022] __napi_poll+0x9f/0x540
[Sun Aug 7 13:12:29 2022] net_rx_action+0x420/0xb70
[Sun Aug 7 13:12:29 2022] ? napi_threaded_poll+0x470/0x470
[Sun Aug 7 13:12:29 2022] ? __common_interrupt+0x79/0x1a0
[Sun Aug 7 13:12:29 2022] __do_softirq+0x271/0x92c
[Sun Aug 7 13:12:29 2022] irq_exit_rcu+0x11a/0x170
[Sun Aug 7 13:12:29 2022] common_interrupt+0x7d/0xa0
[Sun Aug 7 13:12:29 2022] </IRQ>
[Sun Aug 7 13:12:29 2022] <TASK>
[Sun Aug 7 13:12:29 2022] asm_common_interrupt+0x22/0x40
[Sun Aug 7 13:12:29 2022] RIP: 0010:default_idle+0x42/0x60
[Sun Aug 7 13:12:29 2022] Code: c1 83 e0 07 48 c1 e9 03 83 c0 03 0f b6 14 11 38 d0 7c 04 84 d2 75 14 8b 05 6b f1 22 02 85 c0 7e 07 0f 00 2d 80 3b 4a 00 fb f4 <c3> 48 c7 c7 e0 07 7e 85 e8 21 bd 40 fe eb de 66 66 2e 0f 1f 84 00
[Sun Aug 7 13:12:29 2022] RSP: 0018:ffffffff84407e18 EFLAGS: 00000242
[Sun Aug 7 13:12:29 2022] RAX: 0000000000000001 RBX: ffffffff84ec4a68 RCX: 1ffffffff0afc0fc
[Sun Aug 7 13:12:29 2022] RDX: 0000000000000004 RSI: 0000000000000000 RDI: ffffffff835b1fac
[Sun Aug 7 13:12:29 2022] RBP: 0000000000000000 R08: 0000000000000001 R09: ffff8884d2c44ac3
[Sun Aug 7 13:12:29 2022] R10: ffffed109a588958 R11: 00000000ffffffff R12: 0000000000000000
[Sun Aug 7 13:12:29 2022] R13: ffffffff84efac20 R14: 0000000000000000 R15: dffffc0000000000
[Sun Aug 7 13:12:29 2022] ? default_idle_call+0xcc/0x460
[Sun Aug 7 13:12:29 2022] default_idle_call+0xec/0x460
[Sun Aug 7 13:12:29 2022] do_idle+0x394/0x450
[Sun Aug 7 13:12:29 2022] ? arch_cpu_idle_exit+0x40/0x40
[Sun Aug 7 13:12:29 2022] cpu_startup_entry+0x19/0x20
[Sun Aug 7 13:12:29 2022] rest_init+0x156/0x250
[Sun Aug 7 13:12:29 2022] arch_call_rest_init+0xf/0x15
[Sun Aug 7 13:12:29 2022] start_kernel+0x3a7/0x3c5
[Sun Aug 7 13:12:29 2022] secondary_startup_64_no_verify+0xcd/0xdb
[Sun Aug 7 13:12:29 2022] </TASK>--- drivers/net/ethernet/mellanox/mlx5/core/lag.c | 55 +++++++++++-------- 1 file changed, 33 insertions(+), 22 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/lag.c +33 -22
@@ -691,30 +691,32 @@ static void mlx5_ldev_add_netdev(struct mlx5_lag *ldev, struct net_device *netdev) {unsigned int fn =PCI_FUNC (dev->pdev->devfn); +unsigned long flags;if (fn >=MLX5_MAX_PORTS )return ; -spin_lock (&lag_lock); +spin_lock_irqsave (&lag_lock, flags); ldev->pf[fn].netdev = netdev; ldev->tracker.netdev_state[fn].link_up =0 ; ldev->tracker.netdev_state[fn].tx_enabled =0 ; -spin_unlock (&lag_lock); +spin_unlock_irqrestore (&lag_lock, flags); }static void mlx5_ldev_remove_netdev (struct mlx5_lag *ldev,struct net_device *netdev) { +unsigned long flags;int i; -spin_lock (&lag_lock); +spin_lock_irqsave (&lag_lock, flags);for (i =0 ; i <MLX5_MAX_PORTS ; i++) {if (ldev->pf[i].netdev == netdev) { ldev->pf[i].netdev =NULL ;break ; } } -spin_unlock (&lag_lock); +spin_unlock_irqrestore (&lag_lock, flags); } static void mlx5_ldev_add_mdev(struct mlx5_lag *ldev,
@@ -855,12 +857,13 @@ void mlx5_lag_add_netdev(struct mlx5_core_dev *dev,bool mlx5_lag_is_roce (struct mlx5_core_dev *dev) {struct mlx5_lag *ldev; +unsigned long flags;bool res; -spin_lock (&lag_lock); +spin_lock_irqsave (&lag_lock, flags); ldev =mlx5_lag_dev (dev); res = ldev &&__mlx5_lag_is_roce (ldev); -spin_unlock (&lag_lock); +spin_unlock_irqrestore (&lag_lock, flags);return res; }
@@ -869,12 +872,13 @@ EXPORT_SYMBOL(mlx5_lag_is_roce);bool mlx5_lag_is_active (struct mlx5_core_dev *dev) {struct mlx5_lag *ldev; +unsigned long flags;bool res; -spin_lock (&lag_lock); +spin_lock_irqsave (&lag_lock, flags); ldev =mlx5_lag_dev (dev); res = ldev &&__mlx5_lag_is_active (ldev); -spin_unlock (&lag_lock); +spin_unlock_irqrestore (&lag_lock, flags);return res; }
@@ -883,13 +887,14 @@ EXPORT_SYMBOL(mlx5_lag_is_active);bool mlx5_lag_is_master (struct mlx5_core_dev *dev) {struct mlx5_lag *ldev; +unsigned long flags;bool res; -spin_lock (&lag_lock); +spin_lock_irqsave (&lag_lock, flags); ldev =mlx5_lag_dev (dev); res = ldev &&__mlx5_lag_is_active (ldev) && dev == ldev->pf[MLX5_LAG_P1 ].dev; -spin_unlock (&lag_lock); +spin_unlock_irqrestore (&lag_lock, flags);return res; }
@@ -898,12 +903,13 @@ EXPORT_SYMBOL(mlx5_lag_is_master);bool mlx5_lag_is_sriov (struct mlx5_core_dev *dev) {struct mlx5_lag *ldev; +unsigned long flags;bool res; -spin_lock (&lag_lock); +spin_lock_irqsave (&lag_lock, flags); ldev =mlx5_lag_dev (dev); res = ldev &&__mlx5_lag_is_sriov (ldev); -spin_unlock (&lag_lock); +spin_unlock_irqrestore (&lag_lock, flags);return res; }
@@ -912,12 +918,13 @@ EXPORT_SYMBOL(mlx5_lag_is_sriov);bool mlx5_lag_is_shared_fdb (struct mlx5_core_dev *dev) {struct mlx5_lag *ldev; +unsigned long flags;bool res; -spin_lock (&lag_lock); +spin_lock_irqsave (&lag_lock, flags); ldev =mlx5_lag_dev (dev); res = ldev &&__mlx5_lag_is_sriov (ldev) && ldev->shared_fdb; -spin_unlock (&lag_lock); +spin_unlock_irqrestore (&lag_lock, flags);return res; }
@@ -965,8 +972,9 @@ struct net_device *mlx5_lag_get_roce_netdev(struct mlx5_core_dev *dev) {struct net_device *ndev =NULL ;struct mlx5_lag *ldev; +unsigned long flags; -spin_lock (&lag_lock); +spin_lock_irqsave (&lag_lock, flags); ldev =mlx5_lag_dev (dev);if (!(ldev &&__mlx5_lag_is_roce (ldev)))
@@ -983,7 +991,7 @@ struct net_device *mlx5_lag_get_roce_netdev(struct mlx5_core_dev *dev)dev_hold (ndev); unlock: -spin_unlock (&lag_lock); +spin_unlock_irqrestore (&lag_lock, flags);return ndev; }
@@ -993,9 +1001,10 @@ u8 mlx5_lag_get_slave_port(struct mlx5_core_dev *dev, struct net_device *slave) {struct mlx5_lag *ldev; +unsigned long flags;u8 port =0 ; -spin_lock (&lag_lock); +spin_lock_irqsave (&lag_lock, flags); ldev =mlx5_lag_dev (dev);if (!(ldev &&__mlx5_lag_is_roce (ldev))) goto unlock;
@@ -1008,7 +1017,7 @@ u8 mlx5_lag_get_slave_port(struct mlx5_core_dev *dev, port = ldev->v2p_map[port]; unlock: -spin_unlock (&lag_lock); +spin_unlock_irqrestore (&lag_lock, flags);return port; }EXPORT_SYMBOL (mlx5_lag_get_slave_port);
@@ -1017,8 +1026,9 @@ struct mlx5_core_dev *mlx5_lag_get_peer_mdev(struct mlx5_core_dev *dev) {struct mlx5_core_dev *peer_dev =NULL ;struct mlx5_lag *ldev; +unsigned long flags; -spin_lock (&lag_lock); +spin_lock_irqsave (&lag_lock, flags); ldev =mlx5_lag_dev (dev);if (!ldev) goto unlock;
@@ -1028,7 +1038,7 @@ struct mlx5_core_dev *mlx5_lag_get_peer_mdev(struct mlx5_core_dev *dev) ldev->pf[MLX5_LAG_P1 ].dev; unlock: -spin_unlock (&lag_lock); +spin_unlock_irqrestore (&lag_lock, flags);return peer_dev; }EXPORT_SYMBOL (mlx5_lag_get_peer_mdev);
@@ -1041,6 +1051,7 @@ int mlx5_lag_query_cong_counters(struct mlx5_core_dev *dev,int outlen =MLX5_ST_SZ_BYTES (query_cong_statistics_out);struct mlx5_core_dev *mdev[MLX5_MAX_PORTS ];struct mlx5_lag *ldev; +unsigned long flags;int num_ports;int ret, i, j;void *out;
@@ -1051,7 +1062,7 @@ int mlx5_lag_query_cong_counters(struct mlx5_core_dev *dev,memset (values,0 ,sizeof (*values) * num_counters); -spin_lock (&lag_lock); +spin_lock_irqsave (&lag_lock, flags); ldev =mlx5_lag_dev (dev);if (ldev &&__mlx5_lag_is_active (ldev)) { num_ports =MLX5_MAX_PORTS ;
@@ -1061,7 +1072,7 @@ int mlx5_lag_query_cong_counters(struct mlx5_core_dev *dev, num_ports =1 ; mdev[MLX5_LAG_P1 ] = dev; } -spin_unlock (&lag_lock); +spin_unlock_irqrestore (&lag_lock, flags);for (i =0 ; i < num_ports; ++i) {u32 in[MLX5_ST_SZ_DW (query_cong_statistics_in)] = {};
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 35/37 usb: mon: make mmapped memory read only
In reply to Greg Kroah-HartmanFrom: Tadeusz Struk <[email protected]>
commit a659daf63d16aa883be42f3f34ff84235c302198 upstream.
Syzbot found an issue in usbmon module, where the user space client can corrupt the monitor's internal memory, causing the usbmon module to crash the kernel with segfault, UAF, etc.
The reproducer mmaps the /dev/usbmon memory to user space, and overwrites it with arbitrary data, which causes all kinds of issues.
Return an -EPERM error from mon_bin_mmap() if the flag VM_WRTIE is set. Also clear VM_MAYWRITE to make it impossible to change it to writable later.
--- drivers/usb/mon/mon_bin.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/mon/mon_bin.c +5 -0
@@ -1268,6 +1268,11 @@ static int mon_bin_mmap(struct file *fil {/* don't do anything here: "fault" will set up page table entries */ vma->vm_ops = &mon_bin_vm_ops; + +if (vma->vm_flags &VM_WRITE ) +return -EPERM ; + + vma->vm_flags &= ~VM_MAYWRITE ; vma->vm_flags |=VM_DONTEXPAND |VM_DONTDUMP ; vma->vm_private_data = filp->private_data;mon_bin_vma_open (vma);
Greg Kroah-Hartman
maintainerPATCH 36/37 USB: serial: ftdi_sio: fix 300 bps rate for SIO
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 7bd7ad3c310cd6766f170927381eea0aa6f46c69 upstream.
The 300 bps rate of SIO devices has been mapped to 9600 bps since 2003... Let's fix the regression.
--- drivers/usb/serial/ftdi_sio.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/usb/serial/ftdi_sio.c +1 -2
@@ -1319,8 +1319,7 @@ static u32 get_ftdi_divisor(struct tty_scase 38400 : div_value = ftdi_sio_b38400;break ;case 57600 : div_value = ftdi_sio_b57600;break ;case 115200 : div_value = ftdi_sio_b115200;break ; - }/* baud */ -if (div_value ==0 ) { +default :dev_dbg (dev,"%s - Baudrate (%d) requested is not supported\n" , __func__, baud); div_value = ftdi_sio_b9600;
Greg Kroah-Hartman
maintainerPATCH 37/37 rpmsg: qcom: glink: replace strncpy() with strscpy_pad()
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
commit 766279a8f85df32345dbda03b102ca1ee3d5ddea upstream.
The use of strncpy() is considered deprecated for NUL-terminated strings[1]. Replace strncpy() with strscpy_pad(), to keep existing pad-behavior of strncpy, similarly to commit 08de420a8014 ("rpmsg:
glink: Replace strncpy() with strscpy_pad()"). This fixes W=1 warning:
In function ‘qcom_glink_rx_close’,
inlined from ‘qcom_glink_work’ at ../drivers/rpmsg/qcom_glink_native.c:1638:4:
drivers/rpmsg/qcom_glink_native.c:1549:17: warning: ‘strncpy’ specified bound 32 equals destination size [-Wstringop-truncation]
1549 | strncpy(chinfo.name, channel->name, sizeof(chinfo.name));
[1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strncpy-on-nul-terminated-strings
--- drivers/rpmsg/qcom_glink_native.c | 2 +- drivers/rpmsg/qcom_smd.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/rpmsg/qcom_glink_native.c +1 -1
@@ -1488,7 +1488,7 @@ static void qcom_glink_rx_close(struct qcancel_work_sync (&channel->intent_work);if (channel->rpdev) { -strncpy (chinfo.name, channel->name,sizeof (chinfo.name)); +strscpy_pad (chinfo.name, channel->name,sizeof (chinfo.name)); chinfo.src =RPMSG_ADDR_ANY ; chinfo.dst =RPMSG_ADDR_ANY ;
drivers/rpmsg/qcom_smd.c +2 -2
@@ -1089,7 +1089,7 @@ static int qcom_smd_create_device(struct/* Assign public information to the rpmsg_device */ rpdev = &qsdev->rpdev; -strncpy (rpdev->id.name, channel->name,RPMSG_NAME_SIZE ); +strscpy_pad (rpdev->id.name, channel->name,RPMSG_NAME_SIZE ); rpdev->src =RPMSG_ADDR_ANY ; rpdev->dst =RPMSG_ADDR_ANY ;
@@ -1320,7 +1320,7 @@ static void qcom_channel_state_worker(stspin_unlock_irqrestore (&edge->channels_lock, flags); -strncpy (chinfo.name, channel->name,sizeof (chinfo.name)); +strscpy_pad (chinfo.name, channel->name,sizeof (chinfo.name)); chinfo.src =RPMSG_ADDR_ANY ; chinfo.dst =RPMSG_ADDR_ANY ;rpmsg_unregister_device (&edge->dev, &chinfo);
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.73 release. There are 37 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Oct 2022 07:03:19 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.73-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro's test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 5.15.73-rc1
* git: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
* git branch: linux-5.15.y
* git commit: ebe70cd7f54131bf594f842a69d363a9e2812d67
* git describe: v5.15.72-38-gebe70cd7f541
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.15.y/build/v5.15.72-38-gebe70cd7f541
## No Test Regressions (compared to v5.15.71-71-gc68173b2012b)
## No Metric Regressions (compared to v5.15.71-71-gc68173b2012b)
## No Test Fixes (compared to v5.15.71-71-gc68173b2012b)
## No Metric Fixes (compared to v5.15.71-71-gc68173b2012b)
## Test result summary
total: 101182, pass: 89631, fail: 630, skip: 10732, xfail: 189
## Build Summary
* arc: 10 total, 10 passed, 0 failed
* arm: 339 total, 336 passed, 3 failed
* arm64: 72 total, 70 passed, 2 failed
* i386: 61 total, 55 passed, 6 failed
* mips: 62 total, 59 passed, 3 failed
* parisc: 14 total, 14 passed, 0 failed
* powerpc: 69 total, 66 passed, 3 failed
* riscv: 27 total, 27 passed, 0 failed
* s390: 30 total, 27 passed, 3 failed
* sh: 26 total, 24 passed, 2 failed
* sparc: 14 total, 14 passed, 0 failed
* x86_64: 65 total, 63 passed, 2 failed
## Test suites summary
* fwts
* igt-gpu-tools
* kunit
* kvm-unit-tests
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-test
* ltp-[
* ltp-cap_bounds
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-filecaps
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-fsx
* ltp-hugetlb
* ltp-io
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-open-posix-tests
* ltp-pty
* ltp-sched
* ltp-securebits
* ltp-syscalls
* ltp-tracing
* network-basic-tests
* rcutorture
* v4l2-compliance
* vdso
--
Linaro LKFT
https://lkft.linaro.org
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.73 release. There are 37 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Oct 2022 07:03:19 +0000. Anything received after that time might be too late.
Building h8300:allnoconfig ... failed
--------------
Error log:
In file included from include/linux/fs.h:6,
from include/linux/huge_mm.h:8,
from include/linux/mm.h:727,
from include/linux/pid_namespace.h:7,
from include/linux/ptrace.h:10,
from arch/h8300/kernel/asm-offsets.c:15:
include/linux/wait_bit.h: In function 'wait_on_bit':
include/linux/wait_bit.h:74:14: error: implicit declaration of function 'test_bit_acquire'; did you mean 'test_bit_le'? [-Werror=implicit-function-declaration]
74 | if (!test_bit_acquire(bit, word))
| ^~~~~~~~~~~~~~~~
| test_bit_leThis affects h8300 builds in all branches all the way back to v4.9.y. It also affects release candidates for various other architectures in v4.9.y..v5.10.y. In v4.9.y.queue, for example, I see 56 build failures out of 164 builds; most if not all of those can be attributed to problems with test_bit_acquire() - either due to a missing or due to a bad backport.
I can only hope that fix for the the problem that required the test_bit_acquire() backport is worth the trouble it causes.
Guenter
Greg Kroah-Hartman
maintainerQuoted 32 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.73 release. There are 37 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Oct 2022 07:03:19 +0000. Anything received after that time might be too late.
Building h8300:allnoconfig ... failed
--------------
Error log:
In file included frominclude/linux/fs.h:6,from include/linux/huge_mm.h:8, from include/linux/mm.h:727, from include/linux/pid_namespace.h:7, from include/linux/ptrace.h:10, from arch/h8300/kernel/asm-offsets.c:15: include/linux/wait_bit.h: In function 'wait_on_bit': include/linux/wait_bit.h:74:14: error: implicit declaration of function 'test_bit_acquire'; did you mean 'test_bit_le'? [-Werror=implicit-function-declaration] 74 | if (!test_bit_acquire(bit, word)) | ^~~~~~~~~~~~~~~~ | test_bit_leThis affects h8300 builds in all branches all the way back to v4.9.y. It also affects release candidates for various other architectures in v4.9.y..v5.10.y. In v4.9.y.queue, for example, I see 56 build failures out of 164 builds; most if not all of those can be attributed to problems with
test_bit_acquire()- either due to a missing or due to a bad backport.
Quoted 2 lines
I can only hope that fix for the the problem that required the
test_bit_acquire()backport is worth the trouble it causes.
Not yet, no. I'm dropping them all.
thanks,
greg k-h
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.73 release. There are 37 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Oct 2022 07:03:19 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.73-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.73 release. There are 37 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Oct 2022 07:03:19 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.73-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.73 release. There are 37 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 12 Oct 2022 07:03:19 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.73-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.73 release. There are 37 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Successfully cross-compiled for arm64 (bcm2711_defconfig, GCC 10.2.0) and powerpc (ps3_defconfig, GCC 12.1.0).
Signature · 1 line
An old man doll... just what I always wanted! - Clara
Quoted 7 lines · Bagas Sanjaya
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.73 release. There are 37 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 5 lines
Successfully cross-compiled for arm64 (
bcm2711_defconfig, GCC 10.2.0) and powerpc (ps3_defconfig, GCC 12.1.0).Tested-by Bagas Sanjaya <[email protected]>
Oops, replied to wrong -rc; please ignore the trailer above.
Signature · 1 line
An old man doll... just what I always wanted! - Clara