5.15.75-rc1 review
Subsystems (9)
Greg Kroah-Hartman
maintainercover 5.15.75-rc1 review
This is the start of the stable review cycle for the 5.15.75 release. There are 530 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 26 Oct 2022 11:29:24 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.75-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.15.75-rc1
Rafael Mendonca <[email protected]>
io-wq: Fix memory leak in worker creation
Martin Liska <[email protected]>
gcov: support GCC 12.1 and newer compilers
Rafael J. Wysocki <[email protected]>
thermal: intel_powerclamp: Use first online CPU as control_cpu
Jerry Lee 李修賢 <[email protected]>
ext4: continue to expand file system when the target size doesn't reach
Nathan Chancellor <[email protected]>
lib/Kconfig.debug: Add check for non-constant .{s,u}leb128 support to DWARF5
Masahiro Yamada <[email protected]>
Kconfig.debug: add toolchain checks for DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT
Masahiro Yamada <[email protected]>
Kconfig.debug: simplify the dependency of DEBUG_INFO_DWARF4/5
Nathan Chancellor <[email protected]>
drm/amd/display: Fix build breakage with CONFIG_DEBUG_FS=n
Tetsuo Handa <[email protected]>
net/ieee802154: don't warn zero-sized raw_sendmsg()
Alexander Aring <[email protected]>
Revert "net/ieee802154: reject zero-sized raw_sendmsg()"
Randy Dunlap <[email protected]>
net: ethernet: ti: davinci_mdio: fix build for mdio bitbang uses
Yu Kuai <[email protected]>
blk-wbt: fix that 'rwb->wc' is always set to 1 in wbt_init()
Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix last interface check for registration
Alexander Aring <[email protected]>
net: ieee802154: return -EINVAL for unknown addr type
Liu Shixin <[email protected]>
mm: hugetlb: fix UAF in hugetlb_handle_userfault
Pavel Begunkov <[email protected]>
io_uring/rw: fix unexpected link breakage
Pavel Begunkov <[email protected]>
io_uring/rw: fix error'ed retry return values
Pavel Begunkov <[email protected]>
io_uring/rw: fix short rw error handling
Pavel Begunkov <[email protected]>
io_uring: correct pinned_vm accounting
Pavel Begunkov <[email protected]>
io_uring/af_unix: defer registered files gc to io_uring release
Adrian Hunter <[email protected]>
perf intel-pt: Fix segfault in intel_pt_print_info() with uClibc
Ivan T. Ivanov <[email protected]>
clk: bcm2835: Round UART input clock up
Maxime Ripard <[email protected]>
clk: bcm2835: Make peripheral PLLC critical
Dongliang Mu <[email protected]>
usb: idmouse: fix an uninit-value in idmouse_open
Varun Prakash <[email protected]>
nvmet-tcp: add bounds check on Transfer Tag
Keith Busch <[email protected]>
nvme: copy firmware_rev on each init
Jan Kara <[email protected]>
ext2: Use kvmalloc() for group descriptor array
Arun Easi <[email protected]>
scsi: tracing: Fix compile error in trace_array calls when TRACING is disabled
Xiaoke Wang <[email protected]>
staging: rtl8723bs: fix a potential memory leak in rtw_init_cmd_priv()
Xiaoke Wang <[email protected]>
staging: rtl8723bs: fix potential memory leak in rtw_init_drv_sw()
sunghwan jung <[email protected]>
Revert "usb: storage: Add quirk for Samsung Fit flash"
Piyush Mehta <[email protected]>
usb: dwc3: core: Enable GUCTL1 bit 10 for fixing termination error after resume bug
Alexander Stein <[email protected]>
arm64: dts: imx8mp: Add snps,gfladj-refclk-lpm-sel quirk to USB nodes
Robin Guo <[email protected]>
usb: musb: Fix musb_gadget.c rxstate overflow bug
Jianglei Nie <[email protected]>
usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()
Logan Gunthorpe <[email protected]>
md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d
Dylan Yudaken <[email protected]>
eventfd: guard wake_up in eventfd fs calls as well
Hyunwoo Kim <[email protected]>
HID: roccat: Fix use-after-free in roccat_read()
Pierre-Louis Bossart <[email protected]>
soundwire: intel: fix error handling on dai registration issues
Richard Fitzgerald <[email protected]>
soundwire: cadence: Don't overwrite msg->buf during write commands
Coly Li <[email protected]>
bcache: fix set_at_max_writeback_rate() for multiple attached devices
Serge Semin <[email protected]>
ata: libahci_platform: Sanity check the DT child nodes number
Yu Kuai <[email protected]>
blk-throttle: prevent overflow while calculating wait time
Nam Cao <[email protected]>
staging: vt6655: fix potential memory leak
Wei Yongjun <[email protected]>
power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()
Yicong Yang <[email protected]>
iommu/arm-smmu-v3: Make default domain type of HiSilicon PTT device to identity
Shigeru Yoshida <[email protected]>
nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
Letu Ren <[email protected]>
scsi: 3w-9xxx: Avoid disabling device if failing to enable it
Vaishnav Achath <[email protected]>
dmaengine: ti: k3-udma: Reset UDMA_CHAN_RT byte counters to prevent overflow
Justin Chen <[email protected]>
usb: host: xhci-plat: suspend/resume clks for brcm
Justin Chen <[email protected]>
usb: host: xhci-plat: suspend and resume clocks
Quanyang Wang <[email protected]>
clk: zynqmp: pll: rectify rate rounding in zynqmp_pll_round_rate
Hangyu Hua <[email protected]>
media: platform: fix some double free in meson-ge2d and mtk-jpeg and s5p-mfc
Zheyu Ma <[email protected]>
media: cx88: Fix a null-ptr-deref bug in buffer_prepare()
Ian Nam <[email protected]>
clk: zynqmp: Fix stack-out-of-bounds in strncpy`
Alex Sverdlin <[email protected]>
ARM: 9242/1: kasan: Only map modules if CONFIG_KASAN_VMALLOC=n
Maciej S. Szmigiero <[email protected]>
btrfs: don't print information about space cache or tree every remount
Qu Wenruo <[email protected]>
btrfs: scrub: try to fix super block errors
Qu Wenruo <[email protected]>
btrfs: dump extra info if one free space cache has more bitmaps than it should
Sebastian Krzyszkowiak <[email protected]>
arm64: dts: imx8mq-librem5: Add bq25895 as max17055's power supply
Mark Brown <[email protected]>
kselftest/arm64: Fix validatation termination record after EXTRA_CONTEXT
Alexander Stein <[email protected]>
ARM: dts: imx6sx: add missing properties for sram
Alexander Stein <[email protected]>
ARM: dts: imx6sll: add missing properties for sram
Alexander Stein <[email protected]>
ARM: dts: imx6sl: add missing properties for sram
Alexander Stein <[email protected]>
ARM: dts: imx6qp: add missing properties for sram
Alexander Stein <[email protected]>
ARM: dts: imx6dl: add missing properties for sram
Alexander Stein <[email protected]>
ARM: dts: imx6q: add missing properties for sram
Haibo Chen <[email protected]>
ARM: dts: imx7d-sdb: config the max pressure for tsc2046
Aric Cyr <[email protected]>
drm/amd/display: Remove interface for periodic interrupt 1
Khaled Almahallawy <[email protected]>
drm/dp: Don't rewrite link config when setting phy test pattern
Richard Acayan <[email protected]>
mmc: sdhci-msm: add compatible string check for sdm670
Adrián Larumbe <[email protected]>
drm/meson: explicitly remove aggregate driver at module unload time
Adrián Larumbe <[email protected]>
drm/meson: reorder driver deinit sequence to fix use-after-free bug
hongao <[email protected]>
drm/amdgpu: fix initial connector audio value
Jairaj Arava <[email protected]>
ASoC: SOF: pci: Change DMI match info to support all Chrome platforms
Hans de Goede <[email protected]>
platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading
Jameson Thies <[email protected]>
platform/chrome: cros_ec: Notify the PM of wake events during resume
Maya Matuszczyk <[email protected]>
drm: panel-orientation-quirks: Add quirk for Anbernic Win600
Mateusz Kwiatkowski <[email protected]>
drm/vc4: vec: Fix timings for VEC modes
Takashi Iwai <[email protected]>
ALSA: usb-audio: Register card at the last interface
Lucas Stach <[email protected]>
drm: bridge: dw_hdmi: only trigger hotplug event on link change
Vivek Kasireddy <[email protected]>
udmabuf: Set ubuf->sg = NULL if the creation of sg table fails
David Gow <[email protected]>
drm/amd/display: fix overflow on MIN_I64 definition
Zeng Jingxiang <[email protected]>
gpu: lontium-lt9611: Fix NULL pointer dereference in lt9611_connector_init()
Liviu Dudau <[email protected]>
drm/komeda: Fix handling of atomic commits in the atomic_commit_tail hook
Javier Martinez Canillas <[email protected]>
drm: Prevent drm_copy_field() to attempt copying a NULL pointer
Javier Martinez Canillas <[email protected]>
drm: Use size_t type for len variable in drm_copy_field()
Jianglei Nie <[email protected]>
drm/nouveau/nouveau_bo: fix potential memory leak in nouveau_bo_alloc()
Andrew Gaul <[email protected]>
r8152: Rate limit overflow messages
Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix user-after-free
Liu Jian <[email protected]>
net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory
Jason A. Donenfeld <[email protected]>
hwmon: (sht4x) do not overflow clamping operation on 32-bit platforms
Daniel Golle <[email protected]>
wifi: rt2x00: correctly set BBP register 86 for MT7620
Daniel Golle <[email protected]>
wifi: rt2x00: set SoC wmac clock register
Daniel Golle <[email protected]>
wifi: rt2x00: set VGC gain for both chains of MT7620
Daniel Golle <[email protected]>
wifi: rt2x00: set correct TX_SW_CFG1 MAC register for MT7620
Daniel Golle <[email protected]>
wifi: rt2x00: don't run Rt5592 IQ calibration on MT7620
Ziyang Xuan <[email protected]>
can: bcm: check the result of can_send() in bcm_can_tx()
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times
Tetsuo Handa <[email protected]>
Bluetooth: L2CAP: initialize delayed works at l2cap_chan_create()
Sean Wang <[email protected]>
wifi: mt76: mt7921: reset msta->airtime_ac while clearing up hw value
Patrick Rudolph <[email protected]>
regulator: core: Prevent integer underflow
Kiran K <[email protected]>
Bluetooth: btintel: Mark Intel controller to support LE_STATES quirk
Alexander Coffin <[email protected]>
wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()
Michal Jaron <[email protected]>
iavf: Fix race between iavf_close and iavf_reset_task
Khalid Masum <[email protected]>
xfrm: Update ipcomp_scratches with NULL when freed
Mika Westerberg <[email protected]>
thunderbolt: Add back Intel Falcon Ridge end-to-end flow control workaround
Tetsuo Handa <[email protected]>
wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()
Jane Chu <[email protected]>
x86/mce: Retrieve poison range from hardware
Eric Dumazet <[email protected]>
tcp: annotate data-race around tcp_md5sig_pool_populated
Mike Pattrick <[email protected]>
openvswitch: Fix overreporting of drops in dropwatch
Mike Pattrick <[email protected]>
openvswitch: Fix double reporting of drops in dropwatch
Ravi Gunasekaran <[email protected]>
net: ethernet: ti: davinci_mdio: Add workaround for errata i2329
Jacob Keller <[email protected]>
ice: set tx_tstamps when creating new Tx rings via ethtool
Quentin Monnet <[email protected]>
bpftool: Clear errno after libcap's checks
Wright Feng <[email protected]>
wifi: brcmfmac: fix invalid address access when enabling SCAN log level
Dai Ngo <[email protected]>
NFSD: fix use-after-free on source server when doing inter-server copy
Anna Schumaker <[email protected]>
NFSD: Return nfserr_serverfault if splice_ok but buf->pages have data
Kees Cook <[email protected]>
x86/entry: Work around Clang __bdos() bug
Mario Limonciello <[email protected]>
ACPI: x86: Add a quirk for Dell Inspiron 14 2-in-1 for StorageD3Enable
Kees Cook <[email protected]>
ARM: decompressor: Include .data.rel.ro.local
Srinivas Pandruvada <[email protected]>
thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash
Chao Qin <[email protected]>
powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
Kees Cook <[email protected]>
MIPS: BCM47XX: Cast memcmp() of function to (void *)
Doug Smythies <[email protected]>
cpufreq: intel_pstate: Add Tigerlake support in no-HWP mode
Hans de Goede <[email protected]>
ACPI: tables: FPDT: Don't call acpi_os_map_memory() on invalid phys address
Arvid Norlander <[email protected]>
ACPI: video: Add Toshiba Satellite/Portege Z830 quirk
Zqiang <[email protected]>
rcu-tasks: Convert RCU_LOCKDEP_WARN() to WARN_ONCE()
Michal Hocko <[email protected]>
rcu: Back off upon fill_page_cache_func() allocation failure
Zqiang <[email protected]>
rcu: Avoid triggering strict-GP irq-work when RCU is idle
Alexander Aring <[email protected]>
fs: dlm: fix race in lowcomms
Stefan Berger <[email protected]>
selftest: tpm2: Add Client.__del__() to close /dev/tpm* handle
Chao Yu <[email protected]>
f2fs: fix to account FS_CP_DATA_IO correctly
Zhang Qilong <[email protected]>
f2fs: fix race condition on setting FI_NO_EXTENT flag
Shuai Xue <[email protected]>
ACPI: APEI: do not add task_work to kernel thread to avoid memory leak
Vincent Knecht <[email protected]>
thermal/drivers/qcom/tsens-v0_1: Fix MSM8939 fourth sensor hw_id
Dan Carpenter <[email protected]>
crypto: cavium - prevent integer overflow loading firmware
Dan Carpenter <[email protected]>
crypto: marvell/octeontx - prevent integer overflows
Janis Schoetterl-Glausch <[email protected]>
kbuild: rpm-pkg: fix breakage when V=1 is used
Masahiro Yamada <[email protected]>
kbuild: remove the target in signal traps when interrupted
Nico Pache <[email protected]>
tracing/osnoise: Fix possible recursive locking in stop_per_cpu_kthreads
Yipeng Zou <[email protected]>
tracing: kprobe: Make gen test module work in arm and riscv
Yipeng Zou <[email protected]>
tracing: kprobe: Fix kprobe event gen test module on exit
Robin Murphy <[email protected]>
iommu/iova: Fix module config properly
Enzo Matsumiya <[email protected]>
cifs: return correct error in ->calc_signature()
Damian Muszynski <[email protected]>
crypto: qat - fix DMA transfer direction
Peter Harliman Liem <[email protected]>
crypto: inside-secure - Change swab to swab32
Koba Ko <[email protected]>
crypto: ccp - Release dma channels before dmaengine unrgister
Ignat Korchagin <[email protected]>
crypto: akcipher - default implementation for setting a private key
Dan Carpenter <[email protected]>
iommu/omap: Fix buffer overflow in debugfs
Waiman Long <[email protected]>
cgroup/cpuset: Enable update_tasks_cpumask() on top_cpuset
Weili Qian <[email protected]>
crypto: hisilicon/qm - fix missing put dfx access
Lucas Segarra Fernandez <[email protected]>
crypto: qat - fix default value of WDT timer
Kshitiz Varshney <[email protected]>
hwrng: imx-rngc - Moving IRQ handler registering after imx_rngc_irq_mask_clear()
Michal Koutný <[email protected]>
cgroup: Honor caller's cgroup NS when resolving path
James Cowgill <[email protected]>
hwrng: arm-smccc-trng - fix NO_ENTROPY handling
Ye Weihua <[email protected]>
crypto: hisilicon/zip - fix mismatch in get/set sgl_sge_nr
Zhengchao Shao <[email protected]>
crypto: sahara - don't sleep when in softirq
Haren Myneni <[email protected]>
powerpc/pseries/vas: Pass hw_cpu_id to node associativity HCALL
Li Huafei <[email protected]>
powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe()
Pali Rohár <[email protected]>
powerpc: Fix SPE Power ISA properties for e500v1 platforms
Nicholas Piggin <[email protected]>
powerpc/64s: Fix GENERIC_CPU build flags for PPC970 / G5
Vitaly Kuznetsov <[email protected]>
x86/hyperv: Fix 'struct hv_enlightened_vmcs' definition
Rohan McLure <[email protected]>
powerpc: Fix fallocate and fadvise64_64 compat parameter combination
Zheng Yongjun <[email protected]>
powerpc/powernv: add missing of_node_put() in opal_export_attrs()
Liang He <[email protected]>
powerpc/pci_dn: Add missing of_node_put()
Liang He <[email protected]>
powerpc/sysdev/fsl_msi: Add missing of_node_put()
Nathan Chancellor <[email protected]>
powerpc/math_emu/efp: Include module.h
Michael Ellerman <[email protected]>
powerpc/configs: Properly enable PAPR_SCM in pseries_defconfig
Jack Wang <[email protected]>
mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg
Conor Dooley <[email protected]>
mailbox: mpfs: account for mbox offsets while sending
Conor Dooley <[email protected]>
mailbox: mpfs: fix handling of the reg property
Joel Stanley <[email protected]>
clk: ast2600: BCLK comes from EPLL
Miaoqian Lin <[email protected]>
clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe
Lin Yujun <[email protected]>
clk: imx: scu: fix memleak on platform_device_add() fails
Stefan Wahren <[email protected]>
clk: bcm2835: fix bcm2835_clock_rate_from_divisor declaration
Serge Semin <[email protected]>
clk: baikal-t1: Add SATA internal ref clock buffer
Serge Semin <[email protected]>
clk: baikal-t1: Add shared xGMAC ref/ptp clocks internal parent
Serge Semin <[email protected]>
clk: baikal-t1: Fix invalid xGMAC PTP clock divider
Serge Semin <[email protected]>
clk: vc5: Fix 5P49V6901 outputs disabling when enabling FOD
David Collins <[email protected]>
spmi: pmic-arb: correct duplicate APID to PPID mapping logic
Chunfeng Yun <[email protected]>
usb: mtu3: fix failed runtime suspend in host only mode
Dave Jiang <[email protected]>
dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup()
Chen-Yu Tsai <[email protected]>
clk: mediatek: mt8183: mfgcfg: Propagate rate changes to parent
Jiasheng Jiang <[email protected]>
mfd: sm501: Add check for platform_driver_register()
Dan Carpenter <[email protected]>
mfd: fsl-imx25: Fix check for platform_get_irq() errors
Christophe JAILLET <[email protected]>
mfd: lp8788: Fix an error handling path in lp8788_irq_init() and lp8788_irq_init()
Christophe JAILLET <[email protected]>
mfd: lp8788: Fix an error handling path in lp8788_probe()
Christophe JAILLET <[email protected]>
mfd: fsl-imx25: Fix an error handling path in mx25_tsadc_setup_irq()
Christophe JAILLET <[email protected]>
mfd: intel_soc_pmic: Fix an error handling path in intel_soc_pmic_i2c_probe()
Jiasheng Jiang <[email protected]>
fsi: core: Check error number after calling ida_simple_get
Bob Pearson <[email protected]>
RDMA/rxe: Fix resize_finish() in rxe_queue.c
Adam Skladowski <[email protected]>
clk: qcom: gcc-sm6115: Override default Alpha PLL regs
Robert Marko <[email protected]>
clk: qcom: apss-ipq6018: mark apcs_alias0_core_clk as critical
Mike Christie <[email protected]>
scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()
Mike Christie <[email protected]>
scsi: iscsi: Run recv path from workqueue
Mike Christie <[email protected]>
scsi: iscsi: Add recv workqueue helpers
Mike Christie <[email protected]>
scsi: iscsi: Rename iscsi_conn_queue_work()
Duoming Zhou <[email protected]>
scsi: libsas: Fix use-after-free bug in smp_execute_task_sg()
Pali Rohár <[email protected]>
serial: 8250: Fix restoring termios speed after suspend
Guilherme G. Piccoli <[email protected]>
firmware: google: Test spinlock on panic path to avoid lockups
Krzysztof Kozlowski <[email protected]>
slimbus: qcom-ngd-ctrl: allow compile testing without QCOM_RPROC_COMMON
Nam Cao <[email protected]>
staging: vt6655: fix some erroneous memory clean-up loops
Dongliang Mu <[email protected]>
phy: qualcomm: call clk_disable_unprepare in the error handling
Sherry Sun <[email protected]>
tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown
Ilpo Järvinen <[email protected]>
serial: 8250: Toggle IER bits on only after irq has been set up
Dan Carpenter <[email protected]>
drivers: serial: jsm: fix some leaks in probe
Albert Briscoe <[email protected]>
usb: gadget: function: fix dangling pnp_string in f_printer.c
Mario Limonciello <[email protected]>
xhci: Don't show warning for reinit on known broken suspend
Daisuke Matsuda <[email protected]>
IB: Set IOVA/LENGTH on IB_MR in core/uverbs layers
Mark Zhang <[email protected]>
RDMA/cm: Use SLID in the work completion as the DLID in responder side
David Sloan <[email protected]>
md/raid5: Remove unnecessary bio_put() in raid5_read_one_chunk()
Logan Gunthorpe <[email protected]>
md/raid5: Ensure stripe_fill happens on non-read IO with journal
Saurabh Sengar <[email protected]>
md: Replace snprintf with scnprintf
Dan Carpenter <[email protected]>
mtd: rawnand: meson: fix bit map use in meson_nfc_ecc_correct()
Niklas Cassel <[email protected]>
ata: fix ata_id_has_dipm()
Niklas Cassel <[email protected]>
ata: fix ata_id_has_ncq_autosense()
Niklas Cassel <[email protected]>
ata: fix ata_id_has_devslp()
Niklas Cassel <[email protected]>
ata: fix ata_id_sense_reporting_enabled() and ata_id_has_sense_reporting()
Bernard Metzler <[email protected]>
RDMA/siw: Fix QP destroy to wait for all references dropped.
Bernard Metzler <[email protected]>
RDMA/siw: Always consume all skbuf data in sk_data_ready() upcall.
Bart Van Assche <[email protected]>
RDMA/srp: Fix srp_abort()
Sindhu-Devale <[email protected]>
RDMA/irdma: Align AE id codes to correct flush code and event
Pali Rohár <[email protected]>
mtd: rawnand: fsl_elbc: Fix none ECC mode
Martin Blumenstingl <[email protected]>
mtd: rawnand: intel: Remove undocumented compatible string
Martin Blumenstingl <[email protected]>
mtd: rawnand: intel: Read the chip-select line from the correct OF node
Chunfeng Yun <[email protected]>
phy: phy-mtk-tphy: fix the phy type setting issue
Liang He <[email protected]>
phy: amlogic: phy-meson-axg-mipi-pcie-analog: Hold reference returned by of_get_parent()
William Dean <[email protected]>
mtd: devices: docg3: check the return value of devm_ioremap() in the probe
Dang Huynh <[email protected]>
clk: qcom: sm6115: Select QCOM_GDSC
Jim Cromie <[email protected]>
dyndbg: drop EXPORTed dynamic_debug_exec_queries
Jim Cromie <[email protected]>
dyndbg: let query-modname override actual module name
Jim Cromie <[email protected]>
dyndbg: fix module.dyndbg handling
Jim Cromie <[email protected]>
dyndbg: fix static_branch manipulation
Jie Hai <[email protected]>
dmaengine: hisilicon: Add multi-thread support for a DMA channel
Jie Hai <[email protected]>
dmaengine: hisilicon: Fix CQ head update
Jie Hai <[email protected]>
dmaengine: hisilicon: Disable channels when unregister hisi_dma
Dan Carpenter <[email protected]>
fpga: prevent integer overflow in dfl_feature_ioctl_set_irq()
Hangyu Hua <[email protected]>
misc: ocxl: fix possible refcount leak in afu_ioctl()
Zhu Yanjun <[email protected]>
RDMA/rxe: Fix the error caused by qp->sk
Zhu Yanjun <[email protected]>
RDMA/rxe: Fix "kernel NULL pointer dereference" error
Miaoqian Lin <[email protected]>
media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init
Yunke Cao <[email protected]>
media: uvcvideo: Use entity get_cur in uvc_ctrl_set
José Expósito <[email protected]>
media: uvcvideo: Fix memory leak in uvc_gpio_parse
Xu Qiang <[email protected]>
media: meson: vdec: add missing clk_disable_unprepare on error in vdec_hevc_start()
Shubhrajyoti Datta <[email protected]>
tty: xilinx_uartps: Fix the ignore_status
Liang He <[email protected]>
media: exynos4-is: fimc-is: Add of_node_put() when breaking out of loop
Jack Wang <[email protected]>
HSI: omap_ssi_port: Fix dma_map_sg error check
Miaoqian Lin <[email protected]>
HSI: omap_ssi: Fix refcount leak in ssi_probe
Miaoqian Lin <[email protected]>
clk: tegra20: Fix refcount leak in tegra20_clock_init
Miaoqian Lin <[email protected]>
clk: tegra: Fix refcount leak in tegra114_clock_init
Miaoqian Lin <[email protected]>
clk: tegra: Fix refcount leak in tegra210_clock_init
Liang He <[email protected]>
clk: sprd: Hold reference returned by of_get_parent()
Liang He <[email protected]>
clk: berlin: Add of_node_put() for of_get_parent()
Liang He <[email protected]>
clk: qoriq: Hold reference returned by of_get_parent()
Liang He <[email protected]>
clk: oxnas: Hold reference returned by of_get_parent()
Liang He <[email protected]>
clk: meson: Hold reference returned by of_get_parent()
Thinh Nguyen <[email protected]>
usb: common: debug: Check non-standard control requests
Aharon Landau <[email protected]>
RDMA/mlx5: Don't compare mkey tags in DEVX indirect mkey
Jakob Hauser <[email protected]>
iio: magnetometer: yas530: Change data type of hard_offsets to signed
Jonathan Cameron <[email protected]>
iio: ABI: Fix wrong format of differential capacitance channel ABI.
Nuno Sá <[email protected]>
iio: inkern: fix return value in devm_of_iio_channel_get_by_name()
Nuno Sá <[email protected]>
iio: inkern: only release the device node when done with it
Claudiu Beznea <[email protected]>
iio: adc: at91-sama5d2_adc: disable/prepare buffer on suspend/resume
Claudiu Beznea <[email protected]>
iio: adc: at91-sama5d2_adc: lock around oversampling and sample freq
Claudiu Beznea <[email protected]>
iio: adc: at91-sama5d2_adc: check return status for pressure and touch
Claudiu Beznea <[email protected]>
iio: adc: at91-sama5d2_adc: fix AT91_SAMA5D2_MR_TRACKTIM_MAX
Dmitry Torokhov <[email protected]>
ARM: dts: exynos: fix polarity of VBUS GPIO of Origen
Mark Rutland <[email protected]>
arm64: ftrace: fix module PLTs with mcount
Josh Triplett <[email protected]>
ext4: don't run ext4lazyinit for read-only filesystems
Geert Uytterhoeven <[email protected]>
ARM: Drop CMDLINE_* dependency on ATAGS
Dmitry Torokhov <[email protected]>
ARM: dts: exynos: correct s5k6a3 reset polarity on Midas family
Matt Ranostay <[email protected]>
arm64: dts: ti: k3-j7200: fix main pinmux range
Dmitry Osipenko <[email protected]>
soc/tegra: fuse: Drop Kconfig dependency on TEGRA20_APB_DMA
Randy Dunlap <[email protected]>
ia64: export memory_add_physaddr_to_nid to fix cxl build error
Michael Walle <[email protected]>
ARM: dts: kirkwood: lsxl: remove first ethernet port
Michael Walle <[email protected]>
ARM: dts: kirkwood: lsxl: fix serial line
Marek Behún <[email protected]>
ARM: dts: turris-omnia: Fix mpp26 pin name and comment
Lucas Stach <[email protected]>
ARM: dts: imx6qdl-kontron-samx6i: hook up DDC i2c bus
Liang He <[email protected]>
soc: qcom: smem_state: Add refcounting for the 'state->of_node'
Liang He <[email protected]>
soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe()
Amir Goldstein <[email protected]>
locks: fix TOCTOU race when granting write lease
Liang He <[email protected]>
memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings()
Liang He <[email protected]>
memory: of: Fix refcount leak bug in of_get_ddr_timings()
Liang He <[email protected]>
memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe()
Takashi Iwai <[email protected]>
ALSA: hda/hdmi: Don't skip notification handling during PM operation
Zhang Qilong <[email protected]>
ASoC: mt6660: Fix PM disable depth imbalance in mt6660_i2c_probe
Zhang Qilong <[email protected]>
ASoC: wm5102: Fix PM disable depth imbalance in wm5102_probe
Zhang Qilong <[email protected]>
ASoC: wm5110: Fix PM disable depth imbalance in wm5110_probe
Zhang Qilong <[email protected]>
ASoC: wm8997: Fix PM disable depth imbalance in wm8997_probe
Christophe JAILLET <[email protected]>
mmc: wmt-sdmmc: Fix an error handling path in wmt_mci_probe()
Andreas Pape <[email protected]>
ALSA: dmaengine: increment buffer pointer atomically
Christophe JAILLET <[email protected]>
ASoC: da7219: Fix an error handling path in da7219_register_dai_clks()
Srinivas Kandagatla <[email protected]>
ASoC: codecs: tx-macro: fix kcontrol put
Rafael Mendonca <[email protected]>
drm/vmwgfx: Fix memory leak in vmw_mksstat_add_ioctl()
Kuogee Hsieh <[email protected]>
drm/msm/dp: correct 1.62G link rate at dp_catalog_ctrl_config_msa()
Dmitry Baryshkov <[email protected]>
drm/msm/dpu: index dpu_kms->hw_vbif using vbif_idx
Liang He <[email protected]>
ASoC: eureka-tlv320: Hold reference returned from of_find_xxx API
Christophe JAILLET <[email protected]>
mmc: au1xmmc: Fix an error handling path in au1xmmc_probe()
Rafael Mendonca <[email protected]>
drm/amdgpu: Fix memory leak in hpd_rx_irq_create_workqueue()
Liang He <[email protected]>
drm/omap: dss: Fix refcount leak bugs
Gerd Hoffmann <[email protected]>
drm/bochs: fix blanking
Takashi Iwai <[email protected]>
ALSA: hda: beep: Simplify keep-power-at-enable behavior
Jiasheng Jiang <[email protected]>
ASoC: rsnd: Add check for rsnd_mod_power_on
Zheyu Ma <[email protected]>
drm/bridge: megachips: Fix a null pointer dereference bug
Yang Yingliang <[email protected]>
drm/amdgpu: add missing pci_disable_device() in amdgpu_pmops_runtime_resume()
Prashant Malani <[email protected]>
platform/chrome: cros_ec_typec: Correct alt mode index
Hans de Goede <[email protected]>
platform/x86: msi-laptop: Fix resource cleanup
Hans de Goede <[email protected]>
platform/x86: msi-laptop: Fix old-ec check for backlight registering
Martin Povišer <[email protected]>
ASoC: tas2764: Fix mute/unmute
Martin Povišer <[email protected]>
ASoC: tas2764: Drop conflicting set_bias_level power setting
Martin Povišer <[email protected]>
ASoC: tas2764: Allow mono streams
Dan Carpenter <[email protected]>
platform/chrome: fix memory corruption in ioctl
Rustam Subkhankulov <[email protected]>
platform/chrome: fix double-free in chromeos_laptop_prepare()
Dan Carpenter <[email protected]>
ASoC: mt6359: fix tests for platform_get_irq() failure
Liang He <[email protected]>
drm:pl111: Add of_node_put() when breaking out of for_each_available_child_of_node()
Simon Ser <[email protected]>
drm/dp_mst: fix drm_dp_dpcd_read return value checks
Chen-Yu Tsai <[email protected]>
drm/bridge: parade-ps8640: Fix regulator supply order
Dmitry Osipenko <[email protected]>
drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling
Maxime Ripard <[email protected]>
drm/mipi-dsi: Detach devices when removing the host
Dan Carpenter <[email protected]>
drm/bridge: Avoid uninitialized variable warning
Alvin Šipraga <[email protected]>
drm: bridge: adv7511: unregister cec i2c device after cec adapter
Alvin Šipraga <[email protected]>
drm: bridge: adv7511: fix CEC power down control register offset
Russell King (Oracle) <[email protected]>
net: mvpp2: fix mvpp2 debugfs leak
Eric Dumazet <[email protected]>
once: add DO_ONCE_SLOW() for sleepable contexts
Tetsuo Handa <[email protected]>
net/ieee802154: reject zero-sized raw_sendmsg()
Maxim Mikityanskiy <[email protected]>
net: wwan: iosm: Call mutex_init before locking it
Jianglei Nie <[email protected]>
bnx2x: fix potential memory leak in bnx2x_tpa_stop()
Tetsuo Handa <[email protected]>
net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()
Oleksandr Shamray <[email protected]>
hwmon: (pmbus/mp2888) Fix sensors readouts for MPS Multi-phase mp2888 controller
Marek Szyprowski <[email protected]>
spi: Ensure that sg_table won't be used after being freed
Neal Cardwell <[email protected]>
tcp: fix tcp_cwnd_validate() to not forget is_cwnd_limited
Xin Long <[email protected]>
sctp: handle the error returned from sctp_auth_asoc_init_active_key
Duoming Zhou <[email protected]>
mISDN: fix use-after-free bugs in l1oip timer handlers
Jakub Kicinski <[email protected]>
eth: alx: take rtnl_lock on resume
Junichi Uekawa <[email protected]>
vhost/vsock: Use kvmalloc/kvfree for larger packets.
Bitterblue Smith <[email protected]>
wifi: rtl8xxxu: Fix AIFS written to REG_EDCA_*_PARAM
Vincent Whitchurch <[email protected]>
spi: s3c64xx: Fix large transfers with DMA
Phil Sutter <[email protected]>
netfilter: nft_fib: Fix for rpath check with VRF devices
Liu Jian <[email protected]>
xfrm: Reinject transport-mode packets through workqueue
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_core: Fix not handling link timeouts propertly
Asmaa Mnebhi <[email protected]>
i2c: mlxbf: support lock mechanism
Liu Jian <[email protected]>
skmsg: Schedule psock work if the cached skb exists on the psock
Zhang Qilong <[email protected]>
spi/omap100k:Fix PM disable depth imbalance in omap1_spi100k_probe
Zhang Qilong <[email protected]>
spi: dw: Fix PM disable depth imbalance in dw_spi_bt1_probe
Luciano Leão <[email protected]>
x86/cpu: Include the header of init_ia32_feat_ctl()'s prototype
Kees Cook <[email protected]>
x86/microcode/AMD: Track patch allocation size explicitly
Jesus Fernandez Manzano <[email protected]>
wifi: ath11k: fix number of VHT beamformee spatial streams
Antoine Tenart <[email protected]>
netfilter: conntrack: revisit the gc initial rescheduling bias
Antoine Tenart <[email protected]>
netfilter: conntrack: fix the gc rescheduling delay
Tetsuo Handa <[email protected]>
Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure
Lee Jones <[email protected]>
bpf: Ensure correct locking around vulnerable function find_vpid()
Zheng Yongjun <[email protected]>
net: fs_enet: Fix wrong check in do_pd_setup
Luiz Augusto von Dentz <[email protected]>
Bluetooth: RFCOMM: Fix possible deadlock on socket shutdown/release
Howard Hsu <[email protected]>
wifi: mt76: mt7915: do not check state before configuring implicit beamform
Lorenzo Bianconi <[email protected]>
wifi: mt76: mt7615: add mt7615_mutex_acquire/release in mt7615_sta_set_decap_offload
YN Chen <[email protected]>
wifi: mt76: sdio: fix transmitting packet hangs
Bitterblue Smith <[email protected]>
wifi: rtl8xxxu: Remove copy-paste leftover in gen2_update_rate_mask
Bitterblue Smith <[email protected]>
wifi: rtl8xxxu: gen2: Fix mistake in path B IQ calibration
Lorenz Bauer <[email protected]>
bpf: btf: fix truncated last_member_type_id in btf_struct_resolve
Neil Armstrong <[email protected]>
spi: meson-spicc: do not rely on busy flag in pow2 clk ops
Bitterblue Smith <[email protected]>
wifi: rtl8xxxu: Fix skb misuse in TX queue selection
Xu Qiang <[email protected]>
spi: qup: add missing clk_disable_unprepare on error in spi_qup_pm_resume_runtime()
Xu Qiang <[email protected]>
spi: qup: add missing clk_disable_unprepare on error in spi_qup_resume()
Ian Rogers <[email protected]>
selftests/xsk: Avoid use-after-free on ctx
Yang Yingliang <[email protected]>
wifi: rtw88: add missing destroy_workqueue() on error path in rtw_core_init()
Dan Carpenter <[email protected]>
wifi: rtl8xxxu: tighten bounds checking in rtl8xxxu_read_efuse()
Sean Wang <[email protected]>
Bluetooth: btusb: mediatek: fix WMT failure during runtime suspend
Hou Tao <[email protected]>
bpf: Use this_cpu_{inc|dec|inc_return} for bpf_task_storage_busy
Hou Tao <[email protected]>
bpf: Propagate error from htab_lock_bucket() to userspace
Hou Tao <[email protected]>
bpf: Disable preemption when increasing per-cpu map_locked
Maciej Fijalkowski <[email protected]>
xsk: Fix backpressure mechanism on Tx
Kohei Tarumizu <[email protected]>
x86/resctrl: Fix to restore to original value when re-enabling hardware prefetch register
Christophe JAILLET <[email protected]>
spi: mt7621: Fix an error message in mt7621_spi_probe()
Lam Thai <[email protected]>
bpftool: Fix a wrong type cast in btf_dumper_int
Hari Chandrakanthan <[email protected]>
wifi: mac80211: allow bw change during channel switch in mesh
Kumar Kartikeya Dwivedi <[email protected]>
bpf: Fix reference state management for synchronous callbacks
Uwe Kleine-König <[email protected]>
leds: lm3601x: Don't use mutex after it was destroyed
Wen Gong <[email protected]>
wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state()
Ping-Ke Shih <[email protected]>
wifi: rtlwifi: 8192de: correct checking of IQK reload
Chuck Lever <[email protected]>
NFSD: Fix handling of oversized NFSv4 COMPOUND requests
Chuck Lever <[email protected]>
NFSD: Protect against send buffer overflow in NFSv2 READDIR
Chuck Lever <[email protected]>
SUNRPC: Fix svcxdr_init_encode's buflen calculation
Chuck Lever <[email protected]>
SUNRPC: Fix svcxdr_init_decode's end-of-buffer calculation
Christophe JAILLET <[email protected]>
nfsd: Fix a memory leak in an error handling path
Sami Tolvanen <[email protected]>
objtool: Preserve special st_shndx indexes in elf_update_symbol
Wang Kefeng <[email protected]>
ARM: 9247/1: mm: set readonly for MT_MEMORY_RO with ARM_LPAE
Wang Kefeng <[email protected]>
ARM: 9244/1: dump: Fix wrong pg_level in walk_pmd()
Lin Yujun <[email protected]>
MIPS: SGI-IP27: Fix platform-device leak in bridge_platform_create()
Christophe JAILLET <[email protected]>
MIPS: SGI-IP27: Free some unused memory
Kees Cook <[email protected]>
sh: machvec: Use char[] for section boundaries
Xuewen Yan <[email protected]>
thermal: cpufreq_cooling: Check the policy first in cpufreq_cooling_register()
Christian Brauner <[email protected]>
ntfs3: rework xattr handlers and switch to POSIX ACL VFS helpers
Ondrej Mosnacek <[email protected]>
userfaultfd: open userfaultfds with O_RDONLY
Mimi Zohar <[email protected]>
ima: fix blocking of security.ima xattrs of unsupported algorithms
Greg Kroah-Hartman <[email protected]>
selinux: use "grep -E" instead of "egrep"
Steve French <[email protected]>
smb3: must initialize two ACL struct fields to zero
Yunxiang Li <[email protected]>
drm/amd/display: Fix vblank refcount in vrr transition
Ville Syrjälä <[email protected]>
drm/i915: Fix watermark calculations for gen12+ CCS+CC modifier
Ville Syrjälä <[email protected]>
drm/i915: Fix watermark calculations for gen12+ MC CCS modifier
Ville Syrjälä <[email protected]>
drm/i915: Fix watermark calculations for gen12+ RC CCS modifier
Jianglei Nie <[email protected]>
drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()
Lyude Paul <[email protected]>
drm/nouveau/kms/nv140-: Disable interlacing
Greg Kroah-Hartman <[email protected]>
staging: greybus: audio_helper: remove unused and wrong debugfs usage
Sean Christopherson <[email protected]>
KVM: VMX: Drop bits 31:16 when shoving exception error code into VMCS
Sean Christopherson <[email protected]>
KVM: nVMX: Don't propagate vmcs12's PERF_GLOBAL_CTRL settings to vmcs02
Sean Christopherson <[email protected]>
KVM: nVMX: Unconditionally purge queued/injected events on nested "exit"
Michal Luczaj <[email protected]>
KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility
Yu Kuai <[email protected]>
blk-wbt: call rq_qos_add() after wb_normal is initialized
Dmitry Osipenko <[email protected]>
media: cedrus: Fix endless loop in cedrus_h265_skip_bits()
Dmitry Osipenko <[email protected]>
media: cedrus: Set the platform driver data earlier
Ard Biesheuvel <[email protected]>
efi: libstub: drop pointless get_memory_map() call
Mario Limonciello <[email protected]>
thunderbolt: Explicitly enable lane adapter hotplug events at startup
Steven Rostedt (Google) <[email protected]>
tracing: Fix reading strings from synthetic events
Steven Rostedt (Google) <[email protected]>
tracing: Add "(fault)" name injection to kernel probes
Steven Rostedt (Google) <[email protected]>
tracing: Move duplicate code of trace_kprobe/eprobe.c into header
Steven Rostedt (Google) <[email protected]>
tracing: Add ioctl() to force ring buffer waiters to wake up
Steven Rostedt (Google) <[email protected]>
tracing: Wake up waiters when tracing is disabled
Steven Rostedt (Google) <[email protected]>
tracing: Wake up ring buffer waiters on closing of the file
Waiman Long <[email protected]>
tracing: Disable interrupt or preemption before acquiring arch_spinlock_t
Steven Rostedt (Google) <[email protected]>
ring-buffer: Fix race between reset page and reading page
Steven Rostedt (Google) <[email protected]>
ring-buffer: Add ring_buffer_wake_waiters()
Steven Rostedt (Google) <[email protected]>
ring-buffer: Check pending waiters when doing wake ups as well
Steven Rostedt (Google) <[email protected]>
ring-buffer: Have the shortest_full queue be the shortest not longest
Steven Rostedt (Google) <[email protected]>
ring-buffer: Allow splice to read previous partially read pages
Zheng Yejian <[email protected]>
ftrace: Properly unset FTRACE_HASH_FL_MOD
Rik van Riel <[email protected]>
livepatch: fix race between fork and KLP transition
Ye Bin <[email protected]>
ext4: update 'state->fc_regions_size' after successful memory allocation
Ye Bin <[email protected]>
ext4: fix potential memory leak in ext4_fc_record_regions()
Ye Bin <[email protected]>
ext4: fix potential memory leak in ext4_fc_record_modified_inode()
Ye Bin <[email protected]>
ext4: fix miss release buffer head in ext4_fc_write_inode
Zhihao Cheng <[email protected]>
ext4: fix dir corruption when ext4_dx_add_entry() fails
Jinke Han <[email protected]>
ext4: place buffer head allocation before handle start
Zhang Yi <[email protected]>
ext4: ext4_read_bh_lock() should submit IO if the buffer isn't uptodate
Lukas Czerner <[email protected]>
ext4: don't increase iversion counter for ea_inodes
Jan Kara <[email protected]>
ext4: fix check for block being out of directory size
Lalith Rajendran <[email protected]>
ext4: make ext4_lazyinit_thread freezable
Baokun Li <[email protected]>
ext4: fix null-ptr-deref in ext4_write_info
Jan Kara <[email protected]>
ext4: avoid crash when inline data creation follows DIO write
Ye Bin <[email protected]>
jbd2: add miss release buffer head in fc_do_one_pass()
Ye Bin <[email protected]>
jbd2: fix potential use-after-free in jbd2_fc_wait_bufs
Ye Bin <[email protected]>
jbd2: fix potential buffer head reference count leak
Andrew Perepechko <[email protected]>
jbd2: wake up journal waiters in FIFO order, not LIFO
Kees Cook <[email protected]>
hardening: Remove Clang's enable flag for -ftrivial-auto-var-init=zero
Kees Cook <[email protected]>
hardening: Avoid harmless Clang option under CONFIG_INIT_STACK_ALL_ZERO
Chao Yu <[email protected]>
f2fs: fix to do sanity check on summary info
Chao Yu <[email protected]>
f2fs: fix to do sanity check on destination blkaddr during recovery
Jaegeuk Kim <[email protected]>
f2fs: increase the limit for reserve_root
Jaegeuk Kim <[email protected]>
f2fs: flush pending checkpoints when freezing super
Jaegeuk Kim <[email protected]>
f2fs: complete checkpoints during remount
Tetsuo Handa <[email protected]>
btrfs: set generation before calling btrfs_clean_tree_block in btrfs_init_new_buffer
Filipe Manana <[email protected]>
btrfs: fix race between quota enable and quota rescan ioctl
Lukas Czerner <[email protected]>
fs: record I_DIRTY_TIME even if inode already has I_DIRTY_INODE
Mickaël Salaün <[email protected]>
ksmbd: Fix user namespace mapping
Zhang Xiaoxu <[email protected]>
ksmbd: Fix wrong return value and message length check in smb2_ioctl()
Namjae Jeon <[email protected]>
ksmbd: fix endless loop when encryption for response fails
Hyunwoo Kim <[email protected]>
fbdev: smscufx: Fix use-after-free in ufx_ops_open()
Quentin Schulz <[email protected]>
pinctrl: rockchip: add pinmux_ops.gpio_set_direction callback
Quentin Schulz <[email protected]>
gpio: rockchip: request GPIO mux to pinctrl when setting direction
Saurav Kashyap <[email protected]>
scsi: qedf: Populate sysfs attributes for vport
Krzysztof Kozlowski <[email protected]>
slimbus: qcom-ngd: cleanup in probe error path
Krzysztof Kozlowski <[email protected]>
slimbus: qcom-ngd: use correct error in message of pdr_add_lookup() failure
Pali Rohár <[email protected]>
powerpc/boot: Explicitly disable usage of SPE instructions
Zhang Rui <[email protected]>
powercap: intel_rapl: Use standard Energy Unit for SPR Dram RAPL domain
Chuck Lever <[email protected]>
NFSD: Protect against send buffer overflow in NFSv3 READ
Chuck Lever <[email protected]>
NFSD: Protect against send buffer overflow in NFSv2 READ
Chuck Lever <[email protected]>
NFSD: Protect against send buffer overflow in NFSv3 READDIR
Maciej W. Rozycki <[email protected]>
serial: 8250: Request full 16550A feature probing for OxSemi PCIe devices
Maciej W. Rozycki <[email protected]>
serial: 8250: Let drivers request full 16550A feature probing
Maciej W. Rozycki <[email protected]>
PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge
M. Vefa Bicakci <[email protected]>
xen/gntdev: Accommodate VMA splitting
M. Vefa Bicakci <[email protected]>
xen/gntdev: Prevent leaking grants
Carlos Llamas <[email protected]>
mm/mmap: undo ->mmap() when arch_validate_flags() fails
Baolin Wang <[email protected]>
mm/damon: validate if the pmd entry is present before accessing
James Morse <[email protected]>
arm64: errata: Add Cortex-A55 to the repeat tlbi list
Takashi Iwai <[email protected]>
drm/udl: Restore display mode on resume
Dmitry Osipenko <[email protected]>
drm/virtio: Use appropriate atomic state in virtio_gpu_plane_cleanup_fb()
Dmitry Osipenko <[email protected]>
drm/virtio: Unlock reservations on virtio_gpu_object_shmem_init() error
Dmitry Osipenko <[email protected]>
drm/virtio: Check whether transferred 2D BO is shmem
Dario Binacchi <[email protected]>
dmaengine: mxs: use platform_driver_register
Hamza Mahfooz <[email protected]>
Revert "drm/amdgpu: use dirty framebuffer helper"
Rishabh Bhatnagar <[email protected]>
nvme-pci: set min_align_mask before calculating max_hw_sectors
Sagi Grimberg <[email protected]>
nvme-multipath: fix possible hang in live ns resize with ANA access
Gaosheng Cui <[email protected]>
nvmem: core: Fix memleak in nvmem_register()
Huacai Chen <[email protected]>
UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
Fangrui Song <[email protected]>
riscv: Pass -mno-relax only on lld < 15.0.0
Wenting Zhang <[email protected]>
riscv: always honor the CONFIG_CMDLINE_FORCE when parsing dtb
Andrew Bresticker <[email protected]>
riscv: Make VM_WRITE imply VM_READ
Andrew Bresticker <[email protected]>
riscv: Allow PROT_WRITE-only mmap()
Helge Deller <[email protected]>
parisc: fbdev/stifb: Align graphics memory size to 4MB
Maciej W. Rozycki <[email protected]>
RISC-V: Make port I/O string accessors actually work
Conor Dooley <[email protected]>
riscv: topology: fix default topology reporting
Conor Dooley <[email protected]>
arm64: topology: move store_cpu_topology() to shared code
Linus Walleij <[email protected]>
regulator: qcom_rpm: Fix circular deferral regression
Mika Westerberg <[email protected]>
net: thunderbolt: Enable DMA paths only after rings are enabled
Liang He <[email protected]>
hwmon: (gsc-hwmon) Call of_node_get() before of_find_xxx API
Krzysztof Kozlowski <[email protected]>
ASoC: wcd934x: fix order of Slimbus unprepare/disable
Krzysztof Kozlowski <[email protected]>
ASoC: wcd9335: fix order of Slimbus unprepare/disable
Patryk Duda <[email protected]>
platform/chrome: cros_ec_proto: Update version on GET_NEXT_EVENT failure
Zhihao Cheng <[email protected]>
quota: Check next/prev free block number after reading from quota file
Andri Yngvason <[email protected]>
HID: multitouch: Add memory barriers
Alexander Aring <[email protected]>
fs: dlm: handle -EBUSY first in lock arg validation
Alexander Aring <[email protected]>
fs: dlm: fix race between test_bit() and queue_work()
Jarkko Nikula <[email protected]>
i2c: designware: Fix handling of real but unexpected device interrupts
Wenchao Chen <[email protected]>
mmc: sdhci-sprd: Fix minimum clock limit
Anssi Hannula <[email protected]>
can: kvaser_usb_leaf: Fix CAN state after restart
Anssi Hannula <[email protected]>
can: kvaser_usb_leaf: Fix TX queue out of sync after restart
Anssi Hannula <[email protected]>
can: kvaser_usb_leaf: Fix overread with an invalid command
Anssi Hannula <[email protected]>
can: kvaser_usb: Fix use of uninitialized completion
Jean-Francois Le Fillatre <[email protected]>
usb: add quirks for Lenovo OneLink+ Dock
Rafael Mendonca <[email protected]>
xhci: dbc: Fix memory leak in xhci_alloc_dbc()
Eddie James <[email protected]>
iio: pressure: dps310: Reset chip after timeout
Eddie James <[email protected]>
iio: pressure: dps310: Refactor startup procedure
Nuno Sá <[email protected]>
iio: adc: ad7923: fix channel readings for some variants
Uwe Kleine-König <[email protected]>
iio: ltc2497: Fix reading conversion results
Michael Hennerich <[email protected]>
iio: dac: ad5593r: Fix i2c read protocol requirements
Zhang Xiaoxu <[email protected]>
cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message
Ronnie Sahlberg <[email protected]>
cifs: destage dirty pages before re-reading them for cache=none
Gaurav Kohli <[email protected]>
hv_netvsc: Fix race between VF offering and VF association message from host
Pavel Begunkov <[email protected]>
io_uring/net: don't update msg_name if not provided
Tudor Ambarus <[email protected]>
mtd: rawnand: atmel: Unmap streaming DMA mappings
Saranya Gopal <[email protected]>
ALSA: hda/realtek: Add Intel Reference SSID to support headset keys
Luke D. Jones <[email protected]>
ALSA: hda/realtek: Add quirk for ASUS GV601R laptop
Luke D. Jones <[email protected]>
ALSA: hda/realtek: Correct pin configs for ASUS G533Z
Callum Osmotherly <[email protected]>
ALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530
Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix NULL dererence at error path
Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix potential memory leaks
Takashi Iwai <[email protected]>
ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free()
Takashi Iwai <[email protected]>
ALSA: oss: Fix potential deadlock at unregistration
Sasha Levin <[email protected]>
Revert "fs: check FMODE_LSEEK to control internal pipe splicing"
-------------
Diffstat:
Documentation/ABI/testing/sysfs-bus-iio | 2 +- Documentation/arm64/silicon-errata.rst | 2 + Documentation/filesystems/vfs.rst | 3 + Makefile | 10 +- arch/arm/Kconfig | 1 - arch/arm/boot/compressed/vmlinux.lds.S | 2 + arch/arm/boot/dts/armada-385-turris-omnia.dts | 4 +- arch/arm/boot/dts/exynos4412-midas.dtsi | 2 +- arch/arm/boot/dts/exynos4412-origen.dts | 2 +- arch/arm/boot/dts/imx6dl.dtsi | 3 + arch/arm/boot/dts/imx6q.dtsi | 3 + arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 6 +- arch/arm/boot/dts/imx6qp.dtsi | 6 + arch/arm/boot/dts/imx6sl.dtsi | 3 + arch/arm/boot/dts/imx6sll.dtsi | 3 + arch/arm/boot/dts/imx6sx.dtsi | 6 + arch/arm/boot/dts/imx7d-sdb.dts | 7 +- arch/arm/boot/dts/kirkwood-lsxl.dtsi | 16 +- arch/arm/mm/dump.c | 2 +- arch/arm/mm/kasan_init.c | 9 +- arch/arm/mm/mmu.c | 4 + arch/arm64/Kconfig | 17 ++ arch/arm64/boot/dts/freescale/imx8mp.dtsi | 4 +- arch/arm64/boot/dts/freescale/imx8mq-librem5.dtsi | 1 + .../boot/dts/ti/k3-j7200-common-proc-board.dts | 10 +- arch/arm64/boot/dts/ti/k3-j7200-main.dtsi | 11 +- arch/arm64/kernel/cpu_errata.c | 5 + arch/arm64/kernel/ftrace.c | 17 +- arch/arm64/kernel/topology.c | 40 ---- arch/ia64/mm/numa.c | 1 + arch/mips/bcm47xx/prom.c | 4 +- arch/mips/sgi-ip27/ip27-xtalk.c | 74 ++++-- arch/powerpc/Makefile | 2 +- arch/powerpc/boot/Makefile | 1 + arch/powerpc/boot/dts/fsl/e500v1_power_isa.dtsi | 51 ++++ arch/powerpc/boot/dts/fsl/mpc8540ads.dts | 2 +- arch/powerpc/boot/dts/fsl/mpc8541cds.dts | 2 +- arch/powerpc/boot/dts/fsl/mpc8555cds.dts | 2 +- arch/powerpc/boot/dts/fsl/mpc8560ads.dts | 2 +- arch/powerpc/configs/pseries_defconfig | 1 + arch/powerpc/include/asm/syscalls.h | 12 + arch/powerpc/kernel/kprobes.c | 8 +- arch/powerpc/kernel/pci_dn.c | 1 + arch/powerpc/kernel/sys_ppc32.c | 14 +- arch/powerpc/kernel/syscalls.c | 4 +- arch/powerpc/math-emu/math_efp.c | 1 + arch/powerpc/platforms/powernv/opal.c | 1 + arch/powerpc/platforms/pseries/vas.c | 2 +- arch/powerpc/sysdev/fsl_msi.c | 2 + arch/riscv/Kconfig | 2 +- arch/riscv/Makefile | 2 + arch/riscv/include/asm/io.h | 16 +- arch/riscv/kernel/setup.c | 4 +- arch/riscv/kernel/smpboot.c | 3 +- arch/riscv/kernel/sys_riscv.c | 3 - arch/riscv/mm/fault.c | 3 +- arch/sh/include/asm/sections.h | 2 +- arch/sh/kernel/machvec.c | 10 +- arch/um/kernel/um_arch.c | 2 +- arch/x86/include/asm/hyperv-tlfs.h | 4 +- arch/x86/include/asm/microcode.h | 1 + arch/x86/kernel/cpu/feat_ctl.c | 2 +- arch/x86/kernel/cpu/mce/apei.c | 13 +- arch/x86/kernel/cpu/microcode/amd.c | 3 +- arch/x86/kernel/cpu/resctrl/pseudo_lock.c | 12 +- arch/x86/kvm/emulate.c | 2 +- arch/x86/kvm/vmx/nested.c | 37 ++- arch/x86/kvm/vmx/vmx.c | 12 +- arch/x86/xen/enlighten_pv.c | 3 +- block/blk-throttle.c | 8 +- block/blk-wbt.c | 10 +- crypto/akcipher.c | 8 + drivers/acpi/acpi_fpdt.c | 22 ++ drivers/acpi/acpi_video.c | 16 ++ drivers/acpi/apei/ghes.c | 2 +- drivers/acpi/x86/utils.c | 19 +- drivers/ata/libahci_platform.c | 14 +- drivers/base/arch_topology.c | 19 ++ drivers/block/nbd.c | 6 +- drivers/bluetooth/btintel.c | 17 +- drivers/bluetooth/btusb.c | 14 ++ drivers/bluetooth/hci_ldisc.c | 7 +- drivers/bluetooth/hci_serdev.c | 10 +- drivers/char/hw_random/arm_smccc_trng.c | 4 +- drivers/char/hw_random/imx-rngc.c | 14 +- drivers/clk/baikal-t1/ccu-div.c | 65 +++++ drivers/clk/baikal-t1/ccu-div.h | 10 + drivers/clk/baikal-t1/clk-ccu-div.c | 26 +- drivers/clk/bcm/clk-bcm2835.c | 43 +++- drivers/clk/berlin/bg2.c | 5 +- drivers/clk/berlin/bg2q.c | 6 +- drivers/clk/clk-ast2600.c | 2 +- drivers/clk/clk-oxnas.c | 6 +- drivers/clk/clk-qoriq.c | 10 +- drivers/clk/clk-versaclock5.c | 2 +- drivers/clk/imx/clk-scu.c | 6 +- drivers/clk/mediatek/clk-mt8183-mfgcfg.c | 6 +- drivers/clk/meson/meson-aoclk.c | 5 +- drivers/clk/meson/meson-eeclk.c | 5 +- drivers/clk/meson/meson8b.c | 5 +- drivers/clk/qcom/Kconfig | 1 + drivers/clk/qcom/apss-ipq6018.c | 2 +- drivers/clk/qcom/gcc-sm6115.c | 46 ++-- drivers/clk/sprd/common.c | 9 +- drivers/clk/tegra/clk-tegra114.c | 1 + drivers/clk/tegra/clk-tegra20.c | 1 + drivers/clk/tegra/clk-tegra210.c | 1 + drivers/clk/ti/clk-dra7-atl.c | 9 +- drivers/clk/zynqmp/clkc.c | 7 + drivers/clk/zynqmp/pll.c | 31 ++- drivers/cpufreq/intel_pstate.c | 1 + drivers/crypto/cavium/cpt/cptpf_main.c | 6 +- drivers/crypto/ccp/ccp-dmaengine.c | 6 +- drivers/crypto/hisilicon/qm.c | 6 +- drivers/crypto/hisilicon/zip/zip_crypto.c | 4 +- drivers/crypto/inside-secure/safexcel_hash.c | 8 +- drivers/crypto/marvell/octeontx/otx_cptpf_ucode.c | 18 +- drivers/crypto/qat/qat_common/adf_gen4_hw_data.h | 2 +- drivers/crypto/qat/qat_common/qat_algs.c | 18 +- drivers/crypto/sahara.c | 18 +- drivers/dma-buf/udmabuf.c | 9 +- drivers/dma/hisi_dma.c | 28 +-- drivers/dma/ioat/dma.c | 6 +- drivers/dma/mxs-dma.c | 11 +- drivers/dma/ti/k3-udma.c | 25 +- drivers/firmware/efi/libstub/fdt.c | 8 - drivers/firmware/google/gsmi.c | 9 + drivers/fpga/dfl.c | 2 +- drivers/fsi/fsi-core.c | 3 + drivers/gpio/gpio-rockchip.c | 7 + drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 14 +- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 5 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 67 +++--- drivers/gpu/drm/amd/display/dc/calcs/bw_fixed.c | 6 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 16 +- drivers/gpu/drm/amd/display/dc/dc_stream.h | 6 +- .../drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 35 +-- .../drm/amd/display/dc/dcn10/dcn10_hw_sequencer.h | 3 +- drivers/gpu/drm/amd/display/dc/inc/hw_sequencer.h | 8 +- drivers/gpu/drm/arm/display/komeda/komeda_crtc.c | 4 +- drivers/gpu/drm/arm/display/komeda/komeda_kms.c | 21 +- drivers/gpu/drm/arm/display/komeda/komeda_kms.h | 2 + drivers/gpu/drm/bridge/adv7511/adv7511.h | 5 +- drivers/gpu/drm/bridge/adv7511/adv7511_cec.c | 4 +- drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 4 +- drivers/gpu/drm/bridge/lontium-lt9611.c | 3 +- .../drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 4 +- drivers/gpu/drm/bridge/parade-ps8640.c | 4 +- drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 13 +- drivers/gpu/drm/drm_bridge.c | 4 +- drivers/gpu/drm/drm_dp_helper.c | 9 - drivers/gpu/drm/drm_dp_mst_topology.c | 6 +- drivers/gpu/drm/drm_ioctl.c | 8 +- drivers/gpu/drm/drm_mipi_dsi.c | 1 + drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 + drivers/gpu/drm/i915/intel_pm.c | 10 +- drivers/gpu/drm/meson/meson_drv.c | 10 +- drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 12 +- drivers/gpu/drm/msm/disp/dpu1/dpu_vbif.c | 29 +-- drivers/gpu/drm/msm/dp/dp_catalog.c | 2 +- drivers/gpu/drm/nouveau/nouveau_bo.c | 4 +- drivers/gpu/drm/nouveau/nouveau_connector.c | 3 +- drivers/gpu/drm/nouveau/nouveau_prime.c | 1 - drivers/gpu/drm/omapdrm/dss/dss.c | 3 + drivers/gpu/drm/pl111/pl111_versatile.c | 1 + drivers/gpu/drm/tiny/bochs.c | 2 + drivers/gpu/drm/udl/udl_modeset.c | 3 - drivers/gpu/drm/vc4/vc4_vec.c | 4 +- drivers/gpu/drm/virtio/virtgpu_object.c | 3 + drivers/gpu/drm/virtio/virtgpu_plane.c | 6 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 2 +- drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 1 + drivers/hid/hid-multitouch.c | 8 +- drivers/hid/hid-roccat.c | 4 + drivers/hsi/controllers/omap_ssi_core.c | 1 + drivers/hsi/controllers/omap_ssi_port.c | 8 +- drivers/hwmon/gsc-hwmon.c | 1 + drivers/hwmon/pmbus/mp2888.c | 13 +- drivers/hwmon/sht4x.c | 2 +- drivers/i2c/busses/i2c-designware-core.h | 7 +- drivers/i2c/busses/i2c-designware-master.c | 13 + drivers/i2c/busses/i2c-mlxbf.c | 44 +++- drivers/iio/adc/ad7923.c | 4 +- drivers/iio/adc/at91-sama5d2_adc.c | 28 ++- drivers/iio/adc/ltc2497.c | 13 + drivers/iio/dac/ad5593r.c | 46 ++-- drivers/iio/inkern.c | 8 +- drivers/iio/magnetometer/yamaha-yas530.c | 2 +- drivers/iio/pressure/dps310.c | 262 +++++++++++++-------- drivers/infiniband/core/cm.c | 14 +- drivers/infiniband/core/uverbs_cmd.c | 5 +- drivers/infiniband/core/verbs.c | 2 + drivers/infiniband/hw/hns/hns_roce_mr.c | 1 - drivers/infiniband/hw/irdma/defs.h | 1 + drivers/infiniband/hw/irdma/hw.c | 51 ++-- drivers/infiniband/hw/irdma/type.h | 1 + drivers/infiniband/hw/irdma/user.h | 1 + drivers/infiniband/hw/irdma/utils.c | 3 + drivers/infiniband/hw/irdma/verbs.c | 2 + drivers/infiniband/hw/mlx4/mr.c | 1 - drivers/infiniband/hw/mlx5/main.c | 3 + drivers/infiniband/hw/mlx5/odp.c | 3 +- drivers/infiniband/sw/rxe/rxe_qp.c | 10 +- drivers/infiniband/sw/rxe/rxe_queue.c | 12 +- drivers/infiniband/sw/siw/siw.h | 1 + drivers/infiniband/sw/siw/siw_qp.c | 2 +- drivers/infiniband/sw/siw/siw_qp_rx.c | 27 ++- drivers/infiniband/sw/siw/siw_verbs.c | 3 + drivers/infiniband/ulp/srp/ib_srp.c | 4 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 21 ++ drivers/iommu/omap-iommu-debug.c | 6 +- drivers/isdn/mISDN/l1oip.h | 1 + drivers/isdn/mISDN/l1oip_core.c | 13 +- drivers/leds/flash/leds-lm3601x.c | 2 - drivers/mailbox/bcm-flexrm-mailbox.c | 8 +- drivers/mailbox/mailbox-mpfs.c | 25 +- drivers/md/bcache/writeback.c | 73 ++++-- drivers/md/raid0.c | 2 +- drivers/md/raid5.c | 15 +- drivers/media/pci/cx88/cx88-vbi.c | 9 +- drivers/media/pci/cx88/cx88-video.c | 43 ++-- drivers/media/platform/exynos4-is/fimc-is.c | 1 + drivers/media/platform/meson/ge2d/ge2d.c | 1 - drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c | 1 - drivers/media/platform/s5p-mfc/s5p_mfc.c | 3 +- drivers/media/platform/xilinx/xilinx-vipp.c | 9 +- drivers/media/usb/uvc/uvc_ctrl.c | 83 ++++--- drivers/media/usb/uvc/uvc_driver.c | 8 +- drivers/memory/of_memory.c | 2 + drivers/memory/pl353-smc.c | 1 + drivers/mfd/fsl-imx25-tsadc.c | 34 ++- drivers/mfd/intel_soc_pmic_core.c | 1 + drivers/mfd/lp8788-irq.c | 3 + drivers/mfd/lp8788.c | 12 +- drivers/mfd/sm501.c | 7 +- drivers/misc/ocxl/file.c | 2 + drivers/mmc/host/au1xmmc.c | 3 +- drivers/mmc/host/sdhci-msm.c | 1 + drivers/mmc/host/sdhci-sprd.c | 2 +- drivers/mmc/host/wmt-sdmmc.c | 5 +- drivers/mtd/devices/docg3.c | 7 +- drivers/mtd/nand/raw/atmel/nand-controller.c | 1 + drivers/mtd/nand/raw/fsl_elbc_nand.c | 28 ++- drivers/mtd/nand/raw/intel-nand-controller.c | 12 +- drivers/mtd/nand/raw/meson_nand.c | 4 +- drivers/net/can/usb/kvaser_usb/kvaser_usb.h | 2 + drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 3 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 2 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 79 +++++++ drivers/net/ethernet/atheros/alx/main.c | 5 + drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 1 + drivers/net/ethernet/freescale/fs_enet/mac-fec.c | 2 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 177 +++++++++++--- drivers/net/ethernet/intel/ice/ice_ethtool.c | 1 + drivers/net/ethernet/marvell/mvpp2/mvpp2.h | 1 + drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c | 10 +- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 13 +- drivers/net/ethernet/ti/Kconfig | 1 + drivers/net/ethernet/ti/davinci_mdio.c | 242 ++++++++++++++++++- drivers/net/hyperv/hyperv_net.h | 3 +- drivers/net/hyperv/netvsc.c | 4 + drivers/net/hyperv/netvsc_drv.c | 19 ++ drivers/net/thunderbolt.c | 28 ++- drivers/net/usb/r8152.c | 4 +- drivers/net/wireless/ath/ath10k/mac.c | 54 +++-- drivers/net/wireless/ath/ath11k/mac.c | 25 +- drivers/net/wireless/ath/ath9k/htc_hst.c | 43 ++-- .../wireless/broadcom/brcm80211/brcmfmac/core.c | 3 +- .../net/wireless/broadcom/brcm80211/brcmfmac/pno.c | 12 +- drivers/net/wireless/mediatek/mt76/mt7615/main.c | 4 + .../net/wireless/mediatek/mt76/mt7915/debugfs.c | 6 +- drivers/net/wireless/mediatek/mt76/mt7921/main.c | 1 + drivers/net/wireless/mediatek/mt76/sdio.c | 2 +- drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 34 ++- .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 75 +++++- .../net/wireless/realtek/rtlwifi/rtl8192de/phy.c | 9 +- drivers/net/wireless/realtek/rtw88/main.c | 8 +- drivers/net/wwan/iosm/iosm_ipc_wwan.c | 5 +- drivers/nvme/host/core.c | 3 +- drivers/nvme/host/multipath.c | 1 + drivers/nvme/host/pci.c | 3 +- drivers/nvme/target/tcp.c | 11 +- drivers/nvmem/core.c | 15 +- drivers/pci/setup-res.c | 11 + .../phy/amlogic/phy-meson-axg-mipi-pcie-analog.c | 6 +- drivers/phy/mediatek/phy-mtk-tphy.c | 7 +- drivers/phy/qualcomm/phy-qcom-usb-hsic.c | 6 +- drivers/pinctrl/pinctrl-rockchip.c | 13 + drivers/platform/chrome/chromeos_laptop.c | 24 +- drivers/platform/chrome/cros_ec.c | 8 +- drivers/platform/chrome/cros_ec_chardev.c | 3 + drivers/platform/chrome/cros_ec_proto.c | 32 +++ drivers/platform/chrome/cros_ec_typec.c | 2 +- drivers/platform/x86/msi-laptop.c | 14 +- drivers/power/supply/adp5061.c | 6 +- drivers/powercap/intel_rapl_common.c | 4 +- drivers/regulator/core.c | 2 +- drivers/regulator/qcom_rpm-regulator.c | 24 +- drivers/scsi/3w-9xxx.c | 2 +- drivers/scsi/cxgbi/libcxgbi.c | 2 +- drivers/scsi/iscsi_tcp.c | 140 ++++++++--- drivers/scsi/iscsi_tcp.h | 5 + drivers/scsi/libiscsi.c | 41 +++- drivers/scsi/libsas/sas_expander.c | 2 +- drivers/scsi/qedf/qedf_main.c | 21 ++ drivers/slimbus/Kconfig | 3 +- drivers/slimbus/qcom-ngd-ctrl.c | 14 +- drivers/soc/qcom/smem_state.c | 3 +- drivers/soc/qcom/smsm.c | 20 +- drivers/soc/tegra/Kconfig | 1 - drivers/soundwire/cadence_master.c | 9 +- drivers/soundwire/intel.c | 1 - drivers/spi/spi-dw-bt1.c | 4 +- drivers/spi/spi-meson-spicc.c | 6 +- drivers/spi/spi-mt7621.c | 8 +- drivers/spi/spi-omap-100k.c | 1 + drivers/spi/spi-qup.c | 21 +- drivers/spi/spi-s3c64xx.c | 9 + drivers/spi/spi.c | 2 + drivers/spmi/spmi-pmic-arb.c | 13 +- drivers/staging/greybus/audio_helper.c | 11 - drivers/staging/media/meson/vdec/vdec_hevc.c | 6 +- drivers/staging/media/sunxi/cedrus/cedrus.c | 4 +- drivers/staging/media/sunxi/cedrus/cedrus_h265.c | 5 +- drivers/staging/rtl8723bs/core/rtw_cmd.c | 16 +- drivers/staging/rtl8723bs/os_dep/os_intfs.c | 60 ++--- drivers/staging/vt6655/device_main.c | 8 +- drivers/thermal/cpufreq_cooling.c | 10 +- drivers/thermal/intel/intel_powerclamp.c | 4 +- drivers/thermal/qcom/tsens-v0_1.c | 2 +- drivers/thunderbolt/nhi.c | 49 +++- drivers/thunderbolt/switch.c | 24 ++ drivers/thunderbolt/tb.h | 1 + drivers/thunderbolt/tb_regs.h | 1 + drivers/thunderbolt/usb4.c | 20 ++ drivers/tty/serial/8250/8250_core.c | 16 +- drivers/tty/serial/8250/8250_pci.c | 5 + drivers/tty/serial/8250/8250_port.c | 18 +- drivers/tty/serial/fsl_lpuart.c | 2 + drivers/tty/serial/jsm/jsm_driver.c | 3 +- drivers/tty/serial/xilinx_uartps.c | 2 + drivers/usb/common/debug.c | 96 +++++--- drivers/usb/core/quirks.c | 4 + drivers/usb/dwc3/core.c | 17 ++ drivers/usb/dwc3/core.h | 4 + drivers/usb/gadget/function/f_printer.c | 12 +- drivers/usb/host/xhci-dbgcap.c | 2 +- drivers/usb/host/xhci-mem.c | 7 +- drivers/usb/host/xhci-plat.c | 18 +- drivers/usb/host/xhci.c | 3 +- drivers/usb/host/xhci.h | 1 + drivers/usb/misc/idmouse.c | 8 +- drivers/usb/mtu3/mtu3_core.c | 2 - drivers/usb/mtu3/mtu3_plat.c | 2 + drivers/usb/musb/musb_gadget.c | 3 + drivers/usb/storage/unusual_devs.h | 6 - drivers/vhost/vsock.c | 2 +- drivers/video/fbdev/smscufx.c | 14 +- drivers/video/fbdev/stifb.c | 2 +- drivers/xen/gntdev-common.h | 3 +- drivers/xen/gntdev.c | 80 ++++--- fs/btrfs/extent-tree.c | 3 + fs/btrfs/free-space-cache.c | 6 + fs/btrfs/qgroup.c | 15 ++ fs/btrfs/scrub.c | 36 +++ fs/btrfs/super.c | 11 +- fs/cifs/file.c | 9 + fs/cifs/smb2pdu.c | 7 +- fs/cifs/smb2transport.c | 10 +- fs/dlm/ast.c | 6 +- fs/dlm/lock.c | 16 +- fs/dlm/lowcomms.c | 4 + fs/eventfd.c | 10 +- fs/ext2/super.c | 6 +- fs/ext4/fast_commit.c | 40 ++-- fs/ext4/file.c | 6 + fs/ext4/inode.c | 14 +- fs/ext4/namei.c | 17 +- fs/ext4/resize.c | 2 +- fs/ext4/super.c | 25 +- fs/f2fs/checkpoint.c | 47 +++- fs/f2fs/data.c | 4 +- fs/f2fs/extent_cache.c | 3 +- fs/f2fs/f2fs.h | 9 +- fs/f2fs/gc.c | 10 +- fs/f2fs/recovery.c | 23 +- fs/f2fs/segment.c | 2 +- fs/f2fs/super.c | 15 +- fs/file_table.c | 7 +- fs/fs-writeback.c | 37 ++- fs/internal.h | 10 + fs/io-wq.c | 2 +- fs/io_uring.c | 43 ++-- fs/jbd2/commit.c | 2 +- fs/jbd2/journal.c | 10 +- fs/jbd2/recovery.c | 1 + fs/jbd2/transaction.c | 6 +- fs/ksmbd/server.c | 4 +- fs/ksmbd/smb2pdu.c | 13 +- fs/ksmbd/smb_common.c | 6 +- fs/nfsd/nfs3proc.c | 11 +- fs/nfsd/nfs4proc.c | 19 +- fs/nfsd/nfs4recover.c | 4 +- fs/nfsd/nfs4state.c | 5 + fs/nfsd/nfs4xdr.c | 13 +- fs/nfsd/nfsproc.c | 6 +- fs/nfsd/xdr4.h | 3 +- fs/ntfs3/inode.c | 2 - fs/ntfs3/xattr.c | 102 +------- fs/open.c | 11 +- fs/quota/quota_tree.c | 38 +++ fs/splice.c | 10 +- fs/userfaultfd.c | 4 +- fs/xfs/xfs_super.c | 10 +- include/linux/ata.h | 39 +-- include/linux/bpf_verifier.h | 11 + include/linux/dynamic_debug.h | 11 +- include/linux/eventfd.h | 2 +- include/linux/fs.h | 9 +- include/linux/iova.h | 2 +- include/linux/once.h | 28 +++ include/linux/ring_buffer.h | 2 +- include/linux/sched.h | 2 +- include/linux/serial_8250.h | 1 + include/linux/serial_core.h | 3 +- include/linux/skbuff.h | 2 + include/linux/sunrpc/svc.h | 19 +- include/linux/tcp.h | 2 +- include/linux/trace.h | 36 ++- include/linux/trace_events.h | 1 + include/net/ieee802154_netdev.h | 12 +- include/net/tcp.h | 5 +- include/scsi/libiscsi.h | 6 +- include/uapi/rdma/mlx5-abi.h | 1 + kernel/bpf/bpf_local_storage.c | 4 +- kernel/bpf/bpf_task_storage.c | 8 +- kernel/bpf/btf.c | 2 +- kernel/bpf/hashtab.c | 30 ++- kernel/bpf/syscall.c | 2 + kernel/bpf/verifier.c | 42 +++- kernel/cgroup/cgroup.c | 6 +- kernel/cgroup/cpuset.c | 18 +- kernel/gcov/gcc_4_7.c | 18 +- kernel/livepatch/transition.c | 18 +- kernel/rcu/tasks.h | 2 +- kernel/rcu/tree.c | 17 +- kernel/rcu/tree_plugin.h | 3 +- kernel/trace/ftrace.c | 8 +- kernel/trace/kprobe_event_gen_test.c | 49 +++- kernel/trace/ring_buffer.c | 87 ++++++- kernel/trace/trace.c | 66 ++++++ kernel/trace/trace_eprobe.c | 60 +---- kernel/trace/trace_events_synth.c | 23 +- kernel/trace/trace_kprobe.c | 60 +---- kernel/trace/trace_osnoise.c | 3 +- kernel/trace/trace_probe_kernel.h | 115 +++++++++ lib/Kconfig.debug | 8 +- lib/dynamic_debug.c | 45 +--- lib/once.c | 30 +++ mm/damon/vaddr.c | 10 + mm/hugetlb.c | 37 ++- mm/mmap.c | 5 +- net/bluetooth/hci_core.c | 34 ++- net/bluetooth/hci_sysfs.c | 3 + net/bluetooth/l2cap_core.c | 17 +- net/bluetooth/rfcomm/sock.c | 3 + net/can/bcm.c | 7 +- net/core/skmsg.c | 12 +- net/core/stream.c | 3 +- net/ieee802154/socket.c | 4 + net/ipv4/inet_hashtables.c | 4 +- net/ipv4/netfilter/nft_fib_ipv4.c | 3 + net/ipv4/tcp.c | 16 +- net/ipv4/tcp_output.c | 19 +- net/ipv6/netfilter/nft_fib_ipv6.c | 6 +- net/mac80211/cfg.c | 3 - net/netfilter/nf_conntrack_core.c | 18 +- net/openvswitch/datapath.c | 18 +- net/rds/tcp.c | 2 +- net/sctp/auth.c | 18 +- net/unix/garbage.c | 20 ++ net/vmw_vsock/virtio_transport_common.c | 2 +- net/xdp/xsk.c | 22 +- net/xdp/xsk_queue.h | 22 +- net/xfrm/xfrm_input.c | 18 +- net/xfrm/xfrm_ipcomp.c | 1 + scripts/Kbuild.include | 23 +- scripts/package/mkspec | 4 +- scripts/selinux/install_policy.sh | 2 +- security/Kconfig.hardening | 13 +- security/integrity/ima/ima_appraise.c | 12 +- sound/core/pcm_dmaengine.c | 8 +- sound/core/rawmidi.c | 2 - sound/core/sound_oss.c | 13 +- sound/pci/hda/hda_beep.c | 15 +- sound/pci/hda/hda_beep.h | 1 + sound/pci/hda/patch_hdmi.c | 6 - sound/pci/hda/patch_realtek.c | 11 +- sound/pci/hda/patch_sigmatel.c | 25 +- sound/soc/codecs/da7219.c | 5 +- sound/soc/codecs/lpass-tx-macro.c | 13 +- sound/soc/codecs/mt6359-accdet.c | 6 +- sound/soc/codecs/mt6660.c | 8 +- sound/soc/codecs/tas2764.c | 78 ++---- sound/soc/codecs/wcd9335.c | 2 +- sound/soc/codecs/wcd934x.c | 2 +- sound/soc/codecs/wm5102.c | 6 +- sound/soc/codecs/wm5110.c | 6 +- sound/soc/codecs/wm8997.c | 6 +- sound/soc/fsl/eukrea-tlv320.c | 8 +- sound/soc/sh/rcar/ctu.c | 6 +- sound/soc/sh/rcar/dvc.c | 6 +- sound/soc/sh/rcar/mix.c | 6 +- sound/soc/sh/rcar/src.c | 5 +- sound/soc/sh/rcar/ssi.c | 4 +- sound/soc/sof/sof-pci-dev.c | 2 +- sound/usb/card.c | 32 ++- sound/usb/endpoint.c | 6 +- sound/usb/quirks.c | 42 ---- sound/usb/quirks.h | 2 - sound/usb/usbaudio.h | 1 + tools/bpf/bpftool/btf_dumper.c | 2 +- tools/bpf/bpftool/main.c | 10 + tools/lib/bpf/xsk.c | 6 +- tools/objtool/elf.c | 7 +- tools/perf/util/intel-pt.c | 9 +- .../selftests/arm64/signal/testcases/testcases.c | 2 +- tools/testing/selftests/tpm2/tpm2.py | 4 + 529 files changed, 4805 insertions(+), 2196 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/530 Revert "fs: check FMODE_LSEEK to control internal pipe splicing"
This reverts commit fd0a6e99b61e6c08fa5cf585d54fd956f70c73a6.
Which was upstream commit 97ef77c52b789ec1411d360ed99dca1efe4b2c81.
The commit is missing dependencies and breaks NFS tests, remove it for now.
--- fs/splice.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
fs/splice.c +6 -4
@@ -814,15 +814,17 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd, {struct pipe_inode_info *pipe;long ret, bytes; +umode_t i_mode;size_t len;int i, flags, more;/* -* We require the input to be seekable, as we don't want to randomly -* drop data for eg socket -> socket splicing. Use the piped splicing -* for that! +* We require the input being a regular file, as we don't want to +* randomly drop data for eg socket -> socket splicing. Use the +* piped splicing for that! */ -if (unlikely (!(in->f_mode &FMODE_LSEEK ))) + i_mode =file_inode (in)->i_mode; +if (unlikely (!S_ISREG (i_mode) && !S_ISBLK (i_mode)))return -EINVAL ;/*
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 2/530 ALSA: oss: Fix potential deadlock at unregistration
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 97d917879d7f92df09c3f21fd54609a8bcd654b2 upstream.
We took sound_oss_mutex around the calls of unregister_sound_special() at unregistering OSS devices. This may, however, lead to a deadlock, because we manage the card release via the card's device object, and the release may happen at unregister_sound_special() call -- which will take sound_oss_mutex again in turn.
Although the deadlock might be fixed by relaxing the rawmidi mutex in the previous commit, it's safer to move unregister_sound_special() calls themselves out of the sound_oss_mutex, too. The call is race-safe as the function has a spinlock protection by itself.
--- sound/core/sound_oss.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
sound/core/sound_oss.c +9 -4
@@ -162,7 +162,6 @@ int snd_unregister_oss_device(int type,mutex_unlock (&sound_oss_mutex);return -ENOENT ; } -unregister_sound_special (minor);switch (SNDRV_MINOR_OSS_DEVICE (minor)) {case SNDRV_MINOR_OSS_PCM : track2 =SNDRV_MINOR_OSS (cidx,SNDRV_MINOR_OSS_AUDIO );
@@ -174,12 +173,18 @@ int snd_unregister_oss_device(int type, track2 =SNDRV_MINOR_OSS (cidx,SNDRV_MINOR_OSS_DMMIDI1 );break ; } -if (track2 >=0 ) { -unregister_sound_special (track2); +if (track2 >=0 ) snd_oss_minors[track2] =NULL ; - } snd_oss_minors[minor] =NULL ;mutex_unlock (&sound_oss_mutex); + +/* call unregister_sound_special() outside sound_oss_mutex; +* otherwise may deadlock, as it can trigger the release of a card +*/ +unregister_sound_special (minor); +if (track2 >=0 ) +unregister_sound_special (track2); +kfree (mptr);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 3/530 ALSA: rawmidi: Drop register_mutex in snd_rawmidi_free()
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit a70aef7982b012e86dfd39fbb235e76a21ae778a upstream.
The register_mutex taken around the dev_unregister callback call in snd_rawmidi_free() may potentially lead to a mutex deadlock, when OSS emulation and a hot unplug are involved.
Since the mutex doesn't protect the actual race (as the registration itself is already protected by another means), let's drop it.
--- sound/core/rawmidi.c | 2 -- 1 file changed, 2 deletions(-)
sound/core/rawmidi.c +0 -2
@@ -1835,10 +1835,8 @@ static int snd_rawmidi_free(struct snd_rsnd_info_free_entry (rmidi->proc_entry); rmidi->proc_entry =NULL ; -mutex_lock (®ister_mutex);if (rmidi->ops && rmidi->ops->dev_unregister) rmidi->ops->dev_unregister (rmidi); -mutex_unlock (®ister_mutex);snd_rawmidi_free_substreams (&rmidi->streams[SNDRV_RAWMIDI_STREAM_INPUT ]);snd_rawmidi_free_substreams (&rmidi->streams[SNDRV_RAWMIDI_STREAM_OUTPUT ]);
Greg Kroah-Hartman
maintainerPATCH 4/530 ALSA: usb-audio: Fix potential memory leaks
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 6382da0828995af87aa8b8bef28cc61aceb4aff3 upstream.
When the driver hits -ENOMEM at allocating a URB or a buffer, it aborts and goes to the error path that releases the all previously allocated resources. However, when -ENOMEM hits at the middle of the sync EP URB allocation loop, the partially allocated URBs might be left without released, because ep->nurbs is still zero at that point.
Fix it by setting ep->nurbs at first, so that the error handler loops over the full URB list.
--- sound/usb/endpoint.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
sound/usb/endpoint.c +1 -2
@@ -1223,6 +1223,7 @@ static int sync_ep_set_params(struct sndif (!ep->syncbuf)return -ENOMEM ; + ep->nurbs =SYNC_URBS ;for (i =0 ; i <SYNC_URBS ; i++) {struct snd_urb_ctx *u = &ep->urb[i]; u->index = i;
@@ -1242,8 +1243,6 @@ static int sync_ep_set_params(struct snd u->urb->complete = snd_complete_urb; } - ep->nurbs =SYNC_URBS ; -return 0 ; out_of_memory:
Greg Kroah-Hartman
maintainerPATCH 5/530 ALSA: usb-audio: Fix NULL dererence at error path
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 568be8aaf8a535f79c4db76cabe17b035aa2584d upstream.
At an error path to release URB buffers and contexts, the driver might hit a NULL dererence for u->urb pointer, when u->buffer_size has been already set but the actual URB allocation failed.
Fix it by adding the NULL check of urb. Also, make sure that buffer_size is cleared after the error path or the close.
--- sound/usb/endpoint.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/usb/endpoint.c +2 -1
@@ -85,12 +85,13 @@ static inline unsigned get_usb_high_spee*/ static void release_urb_ctx (struct snd_urb_ctx *u) { -if (u->buffer_size) +if (u->urb && u->buffer_size)usb_free_coherent (u->ep->chip->dev, u->buffer_size, u->urb->transfer_buffer, u->urb->transfer_dma);usb_free_urb (u->urb); u->urb =NULL ; + u->buffer_size =0 ; }static const char *usb_error_string (int err)
Greg Kroah-Hartman
maintainerPATCH 6/530 ALSA: hda/realtek: remove ALC289_FIXUP_DUAL_SPK for Dell 5530
In reply to Greg Kroah-HartmanFrom: Callum Osmotherly <[email protected]>
commit 417b9c51f59734d852e47252476fadc293ad994a upstream.
After some feedback from users with Dell Precision 5530 machines, this patch reverts the previous change to add ALC289_FIXUP_DUAL_SPK. While it improved the speaker output quality, it caused the headphone jack to have an audible "pop" sound when power saving was toggled.
--- sound/pci/hda/patch_realtek.c | 1 - 1 file changed, 1 deletion(-)
sound/pci/hda/patch_realtek.c +0 -1
@@ -8847,7 +8847,6 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1028 ,0x0871 ,"Dell Precision 3630" ,ALC255_FIXUP_DELL_HEADSET_MIC ),SND_PCI_QUIRK (0x1028 ,0x0872 ,"Dell Precision 3630" ,ALC255_FIXUP_DELL_HEADSET_MIC ),SND_PCI_QUIRK (0x1028 ,0x0873 ,"Dell Precision 3930" ,ALC255_FIXUP_DUMMY_LINEOUT_VERB ), -SND_PCI_QUIRK (0x1028 ,0x087d ,"Dell Precision 5530" ,ALC289_FIXUP_DUAL_SPK ),SND_PCI_QUIRK (0x1028 ,0x08ad ,"Dell WYSE AIO" ,ALC225_FIXUP_DELL_WYSE_AIO_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1028 ,0x08ae ,"Dell WYSE NB" ,ALC225_FIXUP_DELL1_MIC_NO_PRESENCE ), SND_PCI_QUIRK(0x1028, 0x0935, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB),
Greg Kroah-Hartman
maintainerPATCH 7/530 ALSA: hda/realtek: Correct pin configs for ASUS G533Z
In reply to Greg Kroah-HartmanFrom: Luke D. Jones <[email protected]>
commit 66ba7c88507344dee68ad1acbdb630473ab36114 upstream.
The initial fix for ASUS G533Z was based on faulty information. This fixes the pincfg to values that have been verified with no existing module options or other hacks enabled.
Enables headphone jack, and 5.1 surround.
[ corrected the indent level by tiwai ]
--- sound/pci/hda/patch_realtek.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
sound/pci/hda/patch_realtek.c +5 -3
@@ -8221,11 +8221,13 @@ static const struct hda_fixup alc269_fix [ALC285_FIXUP_ASUS_G533Z_PINS] = { .type = HDA_FIXUP_PINS, .v.pins = (const struct hda_pintbl []) { - {0x14 ,0x90170120 }, + {0x14 ,0x90170152 },/* Speaker Surround Playback Switch */ + {0x19 ,0x03a19020 },/* Mic Boost Volume */ + {0x1a ,0x03a11c30 },/* Mic Boost Volume */ + {0x1e ,0x90170151 },/* Rear jack, IN OUT EAPD Detect */ + {0x21 ,0x03211420 }, { } }, - .chained = true, - .chain_id = ALC294_FIXUP_ASUS_G513_PINS, }, [ALC294_FIXUP_ASUS_COEF_1B] = { .type = HDA_FIXUP_VERBS,
Greg Kroah-Hartman
maintainerPATCH 8/530 ALSA: hda/realtek: Add quirk for ASUS GV601R laptop
In reply to Greg Kroah-HartmanFrom: Luke D. Jones <[email protected]>
commit 2ea8e1297801f7b0220ebf6ae61a5b74ca83981e upstream.
The ASUS ROG X16 (GV601R) series laptop has the same node-to-DAC pairs as early models and the G14, this includes bass speakers which are by default mapped incorrectly to the 0x06 node.
Add a quirk to use the same DAC pairs as the G14.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -9047,6 +9047,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1043 ,0x1e8e ,"ASUS Zephyrus G15" ,ALC289_FIXUP_ASUS_GA401 ),SND_PCI_QUIRK (0x1043 ,0x1c52 ,"ASUS Zephyrus G15 2022" ,ALC289_FIXUP_ASUS_GA401 ),SND_PCI_QUIRK (0x1043 ,0x1f11 ,"ASUS Zephyrus G14" ,ALC289_FIXUP_ASUS_GA401 ), +SND_PCI_QUIRK (0x1043 ,0x1f92 ,"ASUS ROG Flow X16" ,ALC289_FIXUP_ASUS_GA401 ),SND_PCI_QUIRK (0x1043 ,0x3030 ,"ASUS ZN270IE" ,ALC256_FIXUP_ASUS_AIO_GPIO2 ),SND_PCI_QUIRK (0x1043 ,0x831a ,"ASUS P901" ,ALC269_FIXUP_STEREO_DMIC ), SND_PCI_QUIRK(0x1043, 0x834a, "ASUS S101", ALC269_FIXUP_STEREO_DMIC),
Greg Kroah-Hartman
maintainerPATCH 9/530 ALSA: hda/realtek: Add Intel Reference SSID to support headset keys
In reply to Greg Kroah-HartmanFrom: Saranya Gopal <[email protected]>
commit 4f2e56a59b9947b3e698d3cabcb858765c12b1e8 upstream.
This patch fixes the issue with 3.5mm headset keys on RPL-P platform.
[ Rearranged the entry in SSID order by tiwai ]
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -9069,6 +9069,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x10ec ,0x10f2 ,"Intel Reference board" ,ALC700_FIXUP_INTEL_REFERENCE ),SND_PCI_QUIRK (0x10ec ,0x118c ,"Medion EE4254 MD62100" ,ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE ),SND_PCI_QUIRK (0x10ec ,0x1230 ,"Intel Reference board" ,ALC295_FIXUP_CHROME_BOOK ), +SND_PCI_QUIRK (0x10ec ,0x124c ,"Intel Reference board" ,ALC295_FIXUP_CHROME_BOOK ),SND_PCI_QUIRK (0x10ec ,0x1252 ,"Intel Reference board" ,ALC295_FIXUP_CHROME_BOOK ),SND_PCI_QUIRK (0x10ec ,0x1254 ,"Intel Reference board" ,ALC295_FIXUP_CHROME_BOOK ), SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-SZ6", ALC269_FIXUP_HEADSET_MODE),
Greg Kroah-Hartman
maintainerPATCH 10/530 mtd: rawnand: atmel: Unmap streaming DMA mappings
In reply to Greg Kroah-HartmanFrom: Tudor Ambarus <[email protected]>
commit 1161703c9bd664da5e3b2eb1a3bb40c210e026ea upstream.
Every dma_map_single() call should have its dma_unmap_single() counterpart, because the DMA address space is a shared resource and one could render the machine unusable by consuming all DMA addresses.
--- drivers/mtd/nand/raw/atmel/nand-controller.c | 1 + 1 file changed, 1 insertion(+)
drivers/mtd/nand/raw/atmel/nand-controller.c +1 -0
@@ -405,6 +405,7 @@ static int atmel_nand_dma_transfer(strucdma_async_issue_pending (nc->dmac);wait_for_completion (&finished); +dma_unmap_single (nc->dev, buf_dma, len, dir);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 11/530 io_uring/net: dont update msg_name if not provided
In reply to Greg Kroah-HartmanFrom: Pavel Begunkov <[email protected]>
commit 6f10ae8a155446248055c7ddd480ef40139af788 upstream.
io_sendmsg_copy_hdr() may clear msg->msg_name if the userspace didn't provide it, we should retain NULL in this case.
--- fs/io_uring.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/io_uring.c +2 -1
@@ -4762,7 +4762,8 @@ static int io_setup_async_msg(struct io_ async_msg = req->async_data; req->flags |=REQ_F_NEED_CLEANUP ;memcpy (async_msg, kmsg,sizeof (*kmsg)); - async_msg->msg.msg_name = &async_msg->addr; +if (async_msg->msg.msg_name) + async_msg->msg.msg_name = &async_msg->addr;/* if were using fast_iov, set it to the new one */ if (!async_msg->free_iov) async_msg->msg.msg_iter.iov = async_msg->fast_iov;
Greg Kroah-Hartman
maintainerPATCH 12/530 hv_netvsc: Fix race between VF offering and VF association message from host
In reply to Greg Kroah-HartmanFrom: Gaurav Kohli <[email protected]>
commit 365e1ececb2905f94cc10a5817c5b644a32a3ae2 upstream.
During vm boot, there might be possibility that vf registration call comes before the vf association from host to vm.
And this might break netvsc vf path, To prevent the same block vf registration until vf bind message comes from host.
--- drivers/net/hyperv/hyperv_net.h | 3 ++- drivers/net/hyperv/netvsc.c | 4 ++++ drivers/net/hyperv/netvsc_drv.c | 19 +++++++++++++++++++ 3 files changed, 25 insertions(+), 1 deletion(-)
drivers/net/hyperv/hyperv_net.h +2 -1
@@ -1037,7 +1037,8 @@ struct net_device_context {u32 vf_alloc;/* Serial number of the VF to team with */ u32 vf_serial; - +/* completion variable to confirm vf association */ +struct completion vf_add;/* Is the current data path through the VF NIC? */ bool data_path_is_vf;
drivers/net/hyperv/netvsc.c +4 -0
@@ -1450,6 +1450,10 @@ static void netvsc_send_vf(struct net_de net_device_ctx->vf_alloc = nvmsg->msg.v4_msg.vf_assoc.allocated; net_device_ctx->vf_serial = nvmsg->msg.v4_msg.vf_assoc.serial; + +if (net_device_ctx->vf_alloc) +complete (&net_device_ctx->vf_add); +netdev_info (ndev,"VF slot %u %s\n" , net_device_ctx->vf_serial, net_device_ctx->vf_alloc ?"added" :"removed" );
drivers/net/hyperv/netvsc_drv.c +19 -0
@@ -2336,6 +2336,18 @@ static struct net_device *get_netvsc_bys } +/* Fallback path to check synthetic vf with +* help of mac addr +*/ +list_for_each_entry (ndev_ctx, &netvsc_dev_list, list) { + ndev =hv_get_drvdata (ndev_ctx->device_ctx); +if (ether_addr_equal (vf_netdev->perm_addr, ndev->perm_addr)) { +netdev_notice (vf_netdev, +"falling back to mac addr based matching\n" ); +return ndev; + } + } +netdev_notice (vf_netdev,"no netdev found for vf serial:%u\n" , serial);return NULL ;
@@ -2432,6 +2444,11 @@ static int netvsc_vf_changed(struct net_if (net_device_ctx->data_path_is_vf == vf_is_up)return NOTIFY_OK ; +if (vf_is_up && !net_device_ctx->vf_alloc) { +netdev_info (ndev,"Waiting for the VF association from host\n" ); +wait_for_completion (&net_device_ctx->vf_add); + } + ret =netvsc_switch_datapath (ndev, vf_is_up);if (ret) {
@@ -2463,6 +2480,7 @@ static int netvsc_unregister_vf(struct nnetvsc_vf_setxdp (vf_netdev,NULL ); +reinit_completion (&net_device_ctx->vf_add);netdev_rx_handler_unregister (vf_netdev);netdev_upper_dev_unlink (vf_netdev, ndev);RCU_INIT_POINTER (net_device_ctx->vf_netdev,NULL );
@@ -2502,6 +2520,7 @@ static int netvsc_probe(struct hv_deviceINIT_DELAYED_WORK (&net_device_ctx->dwork, netvsc_link_change); +init_completion (&net_device_ctx->vf_add);spin_lock_init (&net_device_ctx->lock);INIT_LIST_HEAD (&net_device_ctx->reconfig_events);INIT_DELAYED_WORK (&net_device_ctx->vf_takeover, netvsc_vf_setup);
Greg Kroah-Hartman
maintainerPATCH 13/530 cifs: destage dirty pages before re-reading them for cache=none
In reply to Greg Kroah-HartmanFrom: Ronnie Sahlberg <[email protected]>
commit bb44c31cdcac107344dd2fcc3bd0504a53575c51 upstream.
This is the opposite case of kernel bugzilla 216301.
If we mmap a file using cache=none and then proceed to update the mmapped area these updates are not reflected in a later pread() of that part of the file.
To fix this we must first destage any dirty pages in the range before we allow the pread() to proceed.
--- fs/cifs/file.c | 9 +++++++++ 1 file changed, 9 insertions(+)
fs/cifs/file.c +9 -0
@@ -4015,6 +4015,15 @@ static ssize_t __cifs_readv( len = ctx->len; } +if (direct) { + rc =filemap_write_and_wait_range (file->f_inode->i_mapping, + offset, offset + len -1 ); +if (rc) { +kref_put (&ctx->refcount, cifs_aio_ctx_release); +return -EAGAIN ; + } + } +/* grab a lock here due to read response handlers can access ctx */ mutex_lock (&ctx->aio_mutex);
Greg Kroah-Hartman
maintainerPATCH 14/530 cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message
In reply to Greg Kroah-HartmanFrom: Zhang Xiaoxu <[email protected]>
commit e98ecc6e94f4e6d21c06660b0f336df02836694f upstream.
Commit d5c7076b772a ("smb3: add smb3.1.1 to default dialect list") extend the dialects from 3 to 4, but forget to decrease the extended length when specific the dialect, then the message length is larger than expected.
This maybe leak some info through network because not initialize the message body.
After apply this patch, the VALIDATE_NEGOTIATE_INFO message length is reduced from 28 bytes to 26 bytes.
--- fs/cifs/smb2pdu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/cifs/smb2pdu.c +2 -2
@@ -1137,9 +1137,9 @@ int smb3_validate_negotiate(const unsign pneg_inbuf->Dialects[0 ] =cpu_to_le16 (server->vals->protocol_id); pneg_inbuf->DialectCount =cpu_to_le16 (1 ); -/* structure is big enough for 3 dialects, sending only 1 */ +/* structure is big enough for 4 dialects, sending only 1 */ inbuflen =sizeof (*pneg_inbuf) - -sizeof (pneg_inbuf->Dialects[0 ]) *2 ; +sizeof (pneg_inbuf->Dialects[0 ]) *3 ; } rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID,
Greg Kroah-Hartman
maintainerPATCH 15/530 iio: dac: ad5593r: Fix i2c read protocol requirements
In reply to Greg Kroah-HartmanFrom: Michael Hennerich <[email protected]>
commit 558a25f903b4af6361b7fbeea08a6446a0745653 upstream.
For reliable operation across the full range of supported interface rates, the AD5593R needs a STOP condition between address write, and data read (like show in the datasheet Figure 40) so in turn i2c_smbus_read_word_swapped cannot be used.
While at it, a simple helper was added to make the code simpler.
--- drivers/iio/dac/ad5593r.c | 46 +++++++++++++++++++++++++++------------------- 1 file changed, 27 insertions(+), 19 deletions(-)
drivers/iio/dac/ad5593r.c +27 -19
@@ -13,6 +13,8 @@#include <linux/module.h> #include <linux/mod_devicetable.h> +#include <asm/unaligned.h> +#define AD5593R_MODE_CONF (0 << 4)#define AD5593R_MODE_DAC_WRITE (1 << 4)#define AD5593R_MODE_ADC_READBACK (4 << 4)
@@ -20,6 +22,24 @@#define AD5593R_MODE_GPIO_READBACK (6 << 4)#define AD5593R_MODE_REG_READBACK (7 << 4) +static int ad5593r_read_word (struct i2c_client *i2c,u8 reg,u16 *value) +{ +int ret; +u8 buf[2 ]; + + ret =i2c_smbus_write_byte (i2c, reg); +if (ret <0 ) +return ret; + + ret =i2c_master_recv (i2c, buf,sizeof (buf)); +if (ret <0 ) +return ret; + + *value =get_unaligned_be16 (buf); + +return 0 ; +} +static int ad5593r_write_dac (struct ad5592r_state *st,unsigned chan,u16 value) {struct i2c_client *i2c =to_i2c_client (st->dev);
@@ -38,13 +58,7 @@ static int ad5593r_read_adc(struct ad559if (val <0 )return (int ) val; - val =i2c_smbus_read_word_swapped (i2c,AD5593R_MODE_ADC_READBACK ); -if (val <0 ) -return (int ) val; - - *value = (u16 ) val; - -return 0 ; +return ad5593r_read_word (i2c,AD5593R_MODE_ADC_READBACK , value); }static int ad5593r_reg_write (struct ad5592r_state *st,u8 reg,u16 value)
@@ -58,25 +72,19 @@ static int ad5593r_reg_write(struct ad55static int ad5593r_reg_read (struct ad5592r_state *st,u8 reg,u16 *value) {struct i2c_client *i2c =to_i2c_client (st->dev); -s32 val; - - val =i2c_smbus_read_word_swapped (i2c,AD5593R_MODE_REG_READBACK | reg); -if (val <0 ) -return (int ) val; - *value = (u16 ) val; - -return 0 ; +return ad5593r_read_word (i2c,AD5593R_MODE_REG_READBACK | reg, value); }static int ad5593r_gpio_read (struct ad5592r_state *st,u8 *value) {struct i2c_client *i2c =to_i2c_client (st->dev); -s32 val; +u16 val; +int ret; - val =i2c_smbus_read_word_swapped (i2c,AD5593R_MODE_GPIO_READBACK ); -if (val <0 ) -return (int ) val; + ret =ad5593r_read_word (i2c,AD5593R_MODE_GPIO_READBACK , &val); +if (ret) +return ret; *value = (u8 ) val;
Greg Kroah-Hartman
maintainerPATCH 16/530 iio: ltc2497: Fix reading conversion results
In reply to Greg Kroah-HartmanFrom: Uwe Kleine-König <[email protected]>
commit 7f4f1096d5921f5d90547596f9ce80e0b924f887 upstream.
After the result of the previous conversion is read the chip automatically starts a new conversion and doesn't accept new i2c transfers until this conversion is completed which makes the function return failure.
So add an early return iff the programming of the new address isn't needed. Note this will not fix the problem in general, but all cases that are currently used. Once this changes we get the failure back, but this can be addressed when the need arises.
--- drivers/iio/adc/ltc2497.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/iio/adc/ltc2497.c +13 -0
@@ -41,6 +41,19 @@ static int ltc2497_result_and_measure(st } *val = (be32_to_cpu (st->buf) >>14 ) - (1 <<17 ); + +/* +* The part started a new conversion at the end of the above i2c +* transfer, so if the address didn't change since the last call +* everything is fine and we can return early. +* If not (which should only happen when some sort of bulk +* conversion is implemented) we have to program the new +* address. Note that this probably fails as the conversion that +* was triggered above is like not complete yet and the two +* operations have to be done in a single transfer. +*/ +if (ddata->addr_prev == address) +return 0 ; } ret = i2c_smbus_write_byte(st->client,
Greg Kroah-Hartman
maintainerPATCH 17/530 iio: adc: ad7923: fix channel readings for some variants
In reply to Greg Kroah-HartmanFrom: Nuno Sá <[email protected]>
commit f4f43f01cff2f29779343ade755191afd2581c77 upstream.
Some of the supported devices have 4 or 2 LSB trailing bits that should not be taken into account. Hence we need to shift these bits out which fits perfectly on the scan type shift property. This change fixes both raw and buffered reads.
--- drivers/iio/adc/ad7923.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/iio/adc/ad7923.c +3 -1
@@ -93,6 +93,7 @@ enum ad7923_id { .sign = 'u', \ .realbits = (bits), \ .storagebits = 16, \ + .shift = 12 - (bits), \ .endianness = IIO_BE, \ }, \ }
@@ -268,7 +269,8 @@ static int ad7923_read_raw(struct iio_dereturn ret;if (chan->address ==EXTRACT (ret,12 ,4 )) - *val =EXTRACT (ret,0 ,12 ); + *val =EXTRACT (ret, chan->scan_type.shift, + chan->scan_type.realbits);else return -EIO ;
Greg Kroah-Hartman
maintainerPATCH 18/530 iio: pressure: dps310: Refactor startup procedure
In reply to Greg Kroah-HartmanFrom: Eddie James <[email protected]>
commit c2329717bdd3fa62f8a2f3d8d85ad0bee4556bd7 upstream.
Move the startup procedure into a function, and correct a missing check on the return code for writing the PRS_CFG register.
--- drivers/iio/pressure/dps310.c | 188 ++++++++++++++++++++++-------------------- 1 file changed, 99 insertions(+), 89 deletions(-)
drivers/iio/pressure/dps310.c +99 -89
@@ -159,6 +159,102 @@ static int dps310_get_coefs(struct dps31return 0 ; } +/* +* Some versions of the chip will read temperatures in the ~60C range when +* it's actually ~20C. This is the manufacturer recommended workaround +* to correct the issue. The registers used below are undocumented. +*/ +static int dps310_temp_workaround (struct dps310_data *data) +{ +int rc; +int reg; + + rc =regmap_read (data->regmap,0x32 , ®); +if (rc) +return rc; + +/* +* If bit 1 is set then the device is okay, and the workaround does not +* need to be applied +*/ +if (reg &BIT (1 )) +return 0 ; + + rc =regmap_write (data->regmap,0x0e ,0xA5 ); +if (rc) +return rc; + + rc =regmap_write (data->regmap,0x0f ,0x96 ); +if (rc) +return rc; + + rc =regmap_write (data->regmap,0x62 ,0x02 ); +if (rc) +return rc; + + rc =regmap_write (data->regmap,0x0e ,0x00 ); +if (rc) +return rc; + +return regmap_write (data->regmap,0x0f ,0x00 ); +} + +static int dps310_startup (struct dps310_data *data) +{ +int rc; +int ready; + +/* +* Set up pressure sensor in single sample, one measurement per second +* mode +*/ + rc =regmap_write (data->regmap,DPS310_PRS_CFG ,0 ); +if (rc) +return rc; + +/* +* Set up external (MEMS) temperature sensor in single sample, one +* measurement per second mode +*/ + rc =regmap_write (data->regmap,DPS310_TMP_CFG ,DPS310_TMP_EXT ); +if (rc) +return rc; + +/* Temp and pressure shifts are disabled when PRC <= 8 */ + rc =regmap_write_bits (data->regmap,DPS310_CFG_REG , +DPS310_PRS_SHIFT_EN |DPS310_TMP_SHIFT_EN ,0 ); +if (rc) +return rc; + +/* MEAS_CFG doesn't update correctly unless first written with 0 */ + rc =regmap_write_bits (data->regmap,DPS310_MEAS_CFG , +DPS310_MEAS_CTRL_BITS ,0 ); +if (rc) +return rc; + +/* Turn on temperature and pressure measurement in the background */ + rc =regmap_write_bits (data->regmap,DPS310_MEAS_CFG , +DPS310_MEAS_CTRL_BITS ,DPS310_PRS_EN | +DPS310_TEMP_EN |DPS310_BACKGROUND ); +if (rc) +return rc; + +/* +* Calibration coefficients required for reporting temperature. +* They are available 40ms after the device has started +*/ + rc =regmap_read_poll_timeout (data->regmap,DPS310_MEAS_CFG , ready, + ready &DPS310_COEF_RDY ,10000 ,40000 ); +if (rc) +return rc; + + rc =dps310_get_coefs (data); +if (rc) +return rc; + +return dps310_temp_workaround (data); +} +static int dps310_get_pres_precision (struct dps310_data *data) {int rc;
@@ -677,52 +773,12 @@ static const struct iio_info dps310_info .write_raw = dps310_write_raw, }; -/* -* Some verions of chip will read temperatures in the ~60C range when -* its actually ~20C. This is the manufacturer recommended workaround -* to correct the issue. The registers used below are undocumented. -*/ -static int dps310_temp_workaround (struct dps310_data *data) -{ -int rc; -int reg; - - rc =regmap_read (data->regmap,0x32 , ®); -if (rc <0 ) -return rc; - -/* -* If bit 1 is set then the device is okay, and the workaround does not -* need to be applied -*/ -if (reg &BIT (1 )) -return 0 ; - - rc =regmap_write (data->regmap,0x0e ,0xA5 ); -if (rc <0 ) -return rc; - - rc =regmap_write (data->regmap,0x0f ,0x96 ); -if (rc <0 ) -return rc; - - rc =regmap_write (data->regmap,0x62 ,0x02 ); -if (rc <0 ) -return rc; - - rc =regmap_write (data->regmap,0x0e ,0x00 ); -if (rc <0 ) -return rc; - -return regmap_write (data->regmap,0x0f ,0x00 ); -} -static int dps310_probe (struct i2c_client *client,const struct i2c_device_id *id) {struct dps310_data *data;struct iio_dev *iio; -int rc, ready; +int rc; iio =devm_iio_device_alloc (&client->dev,sizeof (*data));if (!iio)
@@ -747,54 +803,8 @@ static int dps310_probe(struct i2c_clienif (rc)return rc; -/* -* Set up pressure sensor in single sample, one measurement per second -* mode -*/ - rc =regmap_write (data->regmap,DPS310_PRS_CFG ,0 ); - -/* -* Set up external (MEMS) temperature sensor in single sample, one -* measurement per second mode -*/ - rc =regmap_write (data->regmap,DPS310_TMP_CFG ,DPS310_TMP_EXT ); -if (rc <0 ) -return rc; - -/* Temp and pressure shifts are disabled when PRC <= 8 */ - rc =regmap_write_bits (data->regmap,DPS310_CFG_REG , -DPS310_PRS_SHIFT_EN |DPS310_TMP_SHIFT_EN ,0 ); -if (rc <0 ) -return rc; - -/* MEAS_CFG doesn't update correctly unless first written with 0 */ - rc =regmap_write_bits (data->regmap,DPS310_MEAS_CFG , -DPS310_MEAS_CTRL_BITS ,0 ); -if (rc <0 ) -return rc; - -/* Turn on temperature and pressure measurement in the background */ - rc =regmap_write_bits (data->regmap,DPS310_MEAS_CFG , -DPS310_MEAS_CTRL_BITS ,DPS310_PRS_EN | -DPS310_TEMP_EN |DPS310_BACKGROUND ); -if (rc <0 ) -return rc; - -/* -* Calibration coefficients required for reporting temperature. -* They are available 40ms after the device has started -*/ - rc =regmap_read_poll_timeout (data->regmap,DPS310_MEAS_CFG , ready, - ready &DPS310_COEF_RDY ,10000 ,40000 ); -if (rc <0 ) -return rc; - - rc =dps310_get_coefs (data); -if (rc <0 ) -return rc; - - rc =dps310_temp_workaround (data); -if (rc <0 ) + rc =dps310_startup (data); +if (rc)return rc; rc =devm_iio_device_register (&client->dev, iio);
Greg Kroah-Hartman
maintainerPATCH 19/530 iio: pressure: dps310: Reset chip after timeout
In reply to Greg Kroah-HartmanFrom: Eddie James <[email protected]>
commit 7b4ab4abcea4c0c10b25187bf2569e5a07e9a20c upstream.
The DPS310 chip has been observed to get "stuck" such that pressure and temperature measurements are never indicated as "ready" in the MEAS_CFG register. The only solution is to reset the device and try again. In order to avoid continual failures, use a boolean flag to only try the reset after timeout once if errors persist.
--- drivers/iio/pressure/dps310.c | 74 ++++++++++++++++++++++++++++++++++++------ 1 file changed, 64 insertions(+), 10 deletions(-)
drivers/iio/pressure/dps310.c +64 -10
@@ -89,6 +89,7 @@ struct dps310_data {s32 c00, c10, c20, c30, c01, c11, c21;s32 pressure_raw;s32 temp_raw; +bool timeout_recovery_failed; };static const struct iio_chan_spec dps310_channels[] = {
@@ -393,11 +394,69 @@ static int dps310_get_temp_k(struct dps3return scale_factors[ilog2 (rc)]; } +static int dps310_reset_wait (struct dps310_data *data) +{ +int rc; + + rc =regmap_write (data->regmap,DPS310_RESET ,DPS310_RESET_MAGIC ); +if (rc) +return rc; + +/* Wait for device chip access: 2.5ms in specification */ +usleep_range (2500 ,12000 ); +return 0 ; +} + +static int dps310_reset_reinit (struct dps310_data *data) +{ +int rc; + + rc =dps310_reset_wait (data); +if (rc) +return rc; + +return dps310_startup (data); +} + +static int dps310_ready_status (struct dps310_data *data,int ready_bit,int timeout) +{ +int sleep =DPS310_POLL_SLEEP_US (timeout); +int ready; + +return regmap_read_poll_timeout (data->regmap,DPS310_MEAS_CFG , ready, ready & ready_bit, + sleep, timeout); +} + +static int dps310_ready (struct dps310_data *data,int ready_bit,int timeout) +{ +int rc; + + rc =dps310_ready_status (data, ready_bit, timeout); +if (rc) { +if (rc == -ETIMEDOUT && !data->timeout_recovery_failed) { +/* Reset and reinitialize the chip. */ +if (dps310_reset_reinit (data)) { + data->timeout_recovery_failed = true; + }else { +/* Try again to get sensor ready status. */ +if (dps310_ready_status (data, ready_bit, timeout)) + data->timeout_recovery_failed = true; +else +return 0 ; + } + } + +return rc; + } + + data->timeout_recovery_failed = false; +return 0 ; +} +static int dps310_read_pres_raw (struct dps310_data *data) {int rc;int rate; -int ready;int timeout;s32 raw;u8 val[3 ];
@@ -409,9 +468,7 @@ static int dps310_read_pres_raw(struct d timeout =DPS310_POLL_TIMEOUT_US (rate);/* Poll for sensor readiness; base the timeout upon the sample rate. */ - rc =regmap_read_poll_timeout (data->regmap,DPS310_MEAS_CFG , ready, - ready &DPS310_PRS_RDY , -DPS310_POLL_SLEEP_US (timeout), timeout); + rc =dps310_ready (data,DPS310_PRS_RDY , timeout);if (rc) goto done;
@@ -448,7 +505,6 @@ static int dps310_read_temp_raw(struct d {int rc;int rate; -int ready;int timeout;if (mutex_lock_interruptible (&data->lock))
@@ -458,10 +514,8 @@ static int dps310_read_temp_raw(struct d timeout =DPS310_POLL_TIMEOUT_US (rate);/* Poll for sensor readiness; base the timeout upon the sample rate. */ - rc =regmap_read_poll_timeout (data->regmap,DPS310_MEAS_CFG , ready, - ready &DPS310_TMP_RDY , -DPS310_POLL_SLEEP_US (timeout), timeout); -if (rc <0 ) + rc =dps310_ready (data,DPS310_TMP_RDY , timeout); +if (rc) goto done; rc =dps310_read_temp_ready (data);
@@ -756,7 +810,7 @@ static void dps310_reset(void *action_da {struct dps310_data *data = action_data; -regmap_write (data->regmap,DPS310_RESET ,DPS310_RESET_MAGIC ); +dps310_reset_wait (data); }static const struct regmap_config dps310_regmap_config = {
Greg Kroah-Hartman
maintainerPATCH 20/530 xhci: dbc: Fix memory leak in xhci_alloc_dbc()
In reply to Greg Kroah-HartmanFrom: Rafael Mendonca <[email protected]>
commit d591b32e519603524a35b172156db71df9116902 upstream.
If DbC is already in use, then the allocated memory for the xhci_dbc struct doesn't get freed before returning NULL, which leads to a memleak.
--- drivers/usb/host/xhci-dbgcap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/xhci-dbgcap.c +1 -1
@@ -988,7 +988,7 @@ xhci_alloc_dbc(struct device *dev, void dbc->driver = driver;if (readl (&dbc->regs->control) &DBC_CTRL_DBC_ENABLE ) -return NULL ; + goto err;INIT_DELAYED_WORK (&dbc->event_work, xhci_dbc_handle_events);spin_lock_init (&dbc->lock);
Greg Kroah-Hartman
maintainerPATCH 21/530 usb: add quirks for Lenovo OneLink+ Dock
In reply to Greg Kroah-HartmanFrom: Jean-Francois Le Fillatre <[email protected]>
commit 37d49519b41405b08748392c6a7f193d9f77ecd2 upstream.
The Lenovo OneLink+ Dock contains two VL812 USB3.0 controllers:
17ef:1018 upstream
17ef:1019 downstream
These hubs suffer from two separate problems:
1) After the host system was suspended and woken up, the hubs appear to be in a random state. Some downstream ports (both internal to the built-in audio and network controllers, and external to USB sockets) may no longer be functional. The exact list of disabled ports (if any) changes from wakeup to wakeup. Ports remain in that state until the dock is power-cycled, or until the laptop is rebooted.
Wakeup sources connected to the hubs (keyboard, WoL on the integrated gigabit controller) will wake the system up from suspend, but they may no longer work after wakeup (and in that case will no longer work as wakeup source in a subsequent suspend-wakeup cycle).
This issue appears in the logs with messages such as:
usb 1-6.1-port4: cannot disable (err = -71)
usb 1-6-port2: cannot disable (err = -71)
usb 1-6.1: clear tt 1 (80c0) error -71
usb 1-6-port4: cannot disable (err = -71)
usb 1-6.4: PM: dpm_run_callback(): usb_dev_resume+0x0/0x10 [usbcore] returns -71
usb 1-6.4: PM: failed to resume async: error -71
usb 1-7: reset full-speed USB device number 5 using xhci_hcd
usb 1-6.1-port1: cannot reset (err = -71)
usb 1-6.1-port1: cannot reset (err = -71)
usb 1-6.1-port1: cannot reset (err = -71)
usb 1-6.1-port1: cannot reset (err = -71)
usb 1-6.1-port1: cannot reset (err = -71)
usb 1-6.1-port1: Cannot enable. Maybe the USB cable is bad?
usb 1-6.1-port1: cannot disable (err = -71)
usb 1-6.1-port1: cannot reset (err = -71)
usb 1-6.1-port1: cannot reset (err = -71)
usb 1-6.1-port1: cannot reset (err = -71)
usb 1-6.1-port1: cannot reset (err = -71)
usb 1-6.1-port1: cannot reset (err = -71)
usb 1-6.1-port1: Cannot enable. Maybe the USB cable is bad?
usb 1-6.1-port1: cannot disable (err = -71)2) Some USB devices cannot be enumerated properly. So far I have only seen the issue with USB 3.0 devices. The same devices work without problem directly connected to the host system, to other systems or to other hubs (even when those hubs are connected to the OneLink+ dock).
One very reliable reproducer is this USB 3.0 HDD enclosure:
152d:9561 JMicron Technology Corp. / JMicron USA Technology Corp. Mobius
I have seen it happen sporadically with other USB 3.0 enclosures, with controllers from different manufacturers, all self-powered.
Typical messages in the logs:
xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command usb 2-1.4: device not accepting address 6, error -62 xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command usb 2-1.4: device not accepting address 7, error -62
usb 2-1-port4: attempt power cycle
xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command usb 2-1.4: device not accepting address 8, error -62 xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command xhci_hcd 0000:00:14.0: Timeout while waiting for setup device command usb 2-1.4: device not accepting address 9, error -62
usb 2-1-port4: unable to enumerate USB device
Through trial and error, I found that the USB_QUIRK_RESET_RESUME solved the second issue. Further testing then uncovered the first issue. Test results are summarized in this table:
=======================================================================================
Settings USB2 hotplug USB3 hotplug State after waking up
---------------------------------------------------------------------------------------
power/control=auto works fails broken
usbcore.autosuspend=-1 works works broken
OR power/control=on
power/control=auto works (1) works (1) works
and USB_QUIRK_RESET_RESUME
power/control=on works works works
and USB_QUIRK_RESET_RESUME
HUB_QUIRK_DISABLE_AUTOSUSPEND works works works
and USB_QUIRK_RESET_RESUME
=======================================================================================
In those results, the power/control settings are applied to both hubs, both on the USB2 and USB3 side, before each test.
Quoted 1 line
From those results,
USB_QUIRK_RESET_RESUMEis required to reset the hubs
properly after a suspend-wakeup cycle, and the hubs must not autosuspend to work around the USB3 issue.
A secondary effect of USB_QUIRK_RESET_RESUME is to prevent the hubs' upstream links from suspending (the downstream ports can still suspend). This secondary effect is used in results (1). It is enough to solve the USB3 problem.
Setting USB_QUIRK_RESET_RESUME on those hubs is the smallest patch that solves both issues.
Prior to creating this patch, I have used the USB_QUIRK_RESET_RESUME via the kernel command line for over a year without noticing any side effect.
Thanks to Oliver Neukum @Suse for explanations of the operations of USB_QUIRK_RESET_RESUME, and requesting more testing.
--- drivers/usb/core/quirks.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/core/quirks.c +4 -0
@@ -437,6 +437,10 @@ static const struct usb_device_id usb_qu { USB_DEVICE(0x1532, 0x0116), .driver_info = USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL }, + /* Lenovo ThinkPad OneLink+ Dock twin hub controllers (VIA Labs VL812) */ + { USB_DEVICE(0x17ef, 0x1018), .driver_info = USB_QUIRK_RESET_RESUME }, + { USB_DEVICE(0x17ef, 0x1019), .driver_info = USB_QUIRK_RESET_RESUME }, + /* Lenovo USB-C to Ethernet Adapter RTL8153-04 */ { USB_DEVICE(0x17ef, 0x720c), .driver_info = USB_QUIRK_NO_LPM },
Greg Kroah-Hartman
maintainerPATCH 22/530 can: kvaser_usb: Fix use of uninitialized completion
In reply to Greg Kroah-HartmanFrom: Anssi Hannula <[email protected]>
commit cd7f30e174d09a02ca2afa5ef093fb0f0352e0d8 upstream.
flush_comp is initialized when CMD_FLUSH_QUEUE is sent to the device and completed when the device sends CMD_FLUSH_QUEUE_RESP.
This causes completion of uninitialized completion if the device sends CMD_FLUSH_QUEUE_RESP before CMD_FLUSH_QUEUE is ever sent (e.g. as a response to a flush by a previously bound driver, or a misbehaving device).
Fix that by initializing flush_comp in kvaser_usb_init_one() like the other completions.
This issue is only triggerable after RX URBs have been set up, i.e. the interface has been opened at least once.
--- drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 1 + drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-)
drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +1 -0
@@ -717,6 +717,7 @@ static int kvaser_usb_init_one(struct kvinit_usb_anchor (&priv->tx_submitted);init_completion (&priv->start_comp);init_completion (&priv->stop_comp); +init_completion (&priv->flush_comp); priv->can.ctrlmode_supported =0 ; priv->dev = dev;
drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +1 -1
@@ -1914,7 +1914,7 @@ static int kvaser_usb_hydra_flush_queue( {int err; -init_completion (&priv->flush_comp); +reinit_completion (&priv->flush_comp); err =kvaser_usb_hydra_send_simple_cmd (priv->dev,CMD_FLUSH_QUEUE , priv->channel);
Greg Kroah-Hartman
maintainerPATCH 23/530 can: kvaser_usb_leaf: Fix overread with an invalid command
In reply to Greg Kroah-HartmanFrom: Anssi Hannula <[email protected]>
commit 1499ecaea9d2ba68d5e18d80573b4561a8dc4ee7 upstream.
For command events read from the device, kvaser_usb_leaf_read_bulk_callback() verifies that cmd->len does not exceed the size of the received data, but the actual kvaser_cmd handlers will happily read any kvaser_cmd fields without checking for cmd->len.
This can cause an overread if the last cmd in the buffer is shorter than expected for the command type (with cmd->len showing the actual short size).
Maximum overread seems to be 22 bytes (CMD_LEAF_LOG_MESSAGE), some of which are delivered to userspace as-is.
Fix that by verifying the length of command before handling it.
This issue can only occur after RX URBs have been set up, i.e. the interface has been opened at least once.
--- drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 75 +++++++++++++++++++++++ 1 file changed, 75 insertions(+)
drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +75 -0
@@ -309,6 +309,38 @@ struct kvaser_cmd { } u; } __packed; +#define CMD_SIZE_ANY 0xff +#define kvaser_fsize (field) sizeof_field(struct kvaser_cmd, field) + +static const u8 kvaser_usb_leaf_cmd_sizes_leaf[] = { + [CMD_START_CHIP_REPLY ] =kvaser_fsize (u.simple), + [CMD_STOP_CHIP_REPLY ] =kvaser_fsize (u.simple), + [CMD_GET_CARD_INFO_REPLY ] =kvaser_fsize (u.cardinfo), + [CMD_TX_ACKNOWLEDGE ] =kvaser_fsize (u.tx_acknowledge_header), + [CMD_GET_SOFTWARE_INFO_REPLY ] =kvaser_fsize (u.leaf.softinfo), + [CMD_RX_STD_MESSAGE ] =kvaser_fsize (u.leaf.rx_can), + [CMD_RX_EXT_MESSAGE ] =kvaser_fsize (u.leaf.rx_can), + [CMD_LEAF_LOG_MESSAGE ] =kvaser_fsize (u.leaf.log_message), + [CMD_CHIP_STATE_EVENT ] =kvaser_fsize (u.leaf.chip_state_event), + [CMD_CAN_ERROR_EVENT ] =kvaser_fsize (u.leaf.error_event), +/* ignored events: */ + [CMD_FLUSH_QUEUE_REPLY ] =CMD_SIZE_ANY , +}; + +static const u8 kvaser_usb_leaf_cmd_sizes_usbcan[] = { + [CMD_START_CHIP_REPLY ] =kvaser_fsize (u.simple), + [CMD_STOP_CHIP_REPLY ] =kvaser_fsize (u.simple), + [CMD_GET_CARD_INFO_REPLY ] =kvaser_fsize (u.cardinfo), + [CMD_TX_ACKNOWLEDGE ] =kvaser_fsize (u.tx_acknowledge_header), + [CMD_GET_SOFTWARE_INFO_REPLY ] =kvaser_fsize (u.usbcan.softinfo), + [CMD_RX_STD_MESSAGE ] =kvaser_fsize (u.usbcan.rx_can), + [CMD_RX_EXT_MESSAGE ] =kvaser_fsize (u.usbcan.rx_can), + [CMD_CHIP_STATE_EVENT ] =kvaser_fsize (u.usbcan.chip_state_event), + [CMD_CAN_ERROR_EVENT ] =kvaser_fsize (u.usbcan.error_event), +/* ignored events: */ + [CMD_USBCAN_CLOCK_OVERFLOW_EVENT ] =CMD_SIZE_ANY , +}; +/* Summary of a kvaser error event, for a unified Leaf/Usbcan error * handling. Some discrepancies between the two families exist: *
@@ -396,6 +428,43 @@ static const struct kvaser_usb_dev_cfg k .bittiming_const = &kvaser_usb_flexc_bittiming_const, }; +static int kvaser_usb_leaf_verify_size (const struct kvaser_usb *dev, +const struct kvaser_cmd *cmd) +{ +/* buffer size >= cmd->len ensured by caller */ +u8 min_size =0 ; + +switch (dev->driver_info->family) { +case KVASER_LEAF : +if (cmd->id <ARRAY_SIZE (kvaser_usb_leaf_cmd_sizes_leaf)) + min_size = kvaser_usb_leaf_cmd_sizes_leaf[cmd->id]; +break ; +case KVASER_USBCAN : +if (cmd->id <ARRAY_SIZE (kvaser_usb_leaf_cmd_sizes_usbcan)) + min_size = kvaser_usb_leaf_cmd_sizes_usbcan[cmd->id]; +break ; + } + +if (min_size ==CMD_SIZE_ANY ) +return 0 ; + +if (min_size) { + min_size +=CMD_HEADER_LEN ; +if (cmd->len >= min_size) +return 0 ; + +dev_err_ratelimited (&dev->intf->dev, +"Received command %u too short (size %u, needed %u)" , + cmd->id, cmd->len, min_size); +return -EIO ; + } + +dev_warn_ratelimited (&dev->intf->dev, +"Unhandled command (%d, size %d)\n" , + cmd->id, cmd->len); +return -EINVAL ; +} +static void * kvaser_usb_leaf_frame_to_cmd(const struct kvaser_usb_net_priv *priv, const struct sk_buff *skb, int *frame_len,
@@ -503,6 +572,9 @@ static int kvaser_usb_leaf_wait_cmd(cons end:kfree (buf); +if (err ==0 ) + err =kvaser_usb_leaf_verify_size (dev, cmd); +return err; }
@@ -1137,6 +1209,9 @@ static void kvaser_usb_leaf_stop_chip_restatic void kvaser_usb_leaf_handle_command (const struct kvaser_usb *dev,const struct kvaser_cmd *cmd) { +if (kvaser_usb_leaf_verify_size (dev, cmd) <0 ) +return ; +switch (cmd->id) {case CMD_START_CHIP_REPLY :kvaser_usb_leaf_start_chip_reply (dev, cmd);
Greg Kroah-Hartman
maintainerPATCH 24/530 can: kvaser_usb_leaf: Fix TX queue out of sync after restart
In reply to Greg Kroah-HartmanFrom: Anssi Hannula <[email protected]>
commit 455561fb618fde40558776b5b8435f9420f335db upstream.
The TX queue seems to be implicitly flushed by the hardware during bus-off or bus-off recovery, but the driver does not reset the TX bookkeeping.
Despite not resetting TX bookkeeping the driver still re-enables TX queue unconditionally, leading to "cannot find free context" / NETDEV_TX_BUSY errors if the TX queue was full at bus-off time.
Fix that by resetting TX bookkeeping on CAN restart.
Tested with 0bfd:0124 Kvaser Mini PCI Express 2xHS FW 4.18.778.
--- drivers/net/can/usb/kvaser_usb/kvaser_usb.h | 2 ++ drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c | 2 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 2 ++ 3 files changed, 5 insertions(+), 1 deletion(-)
drivers/net/can/usb/kvaser_usb/kvaser_usb.h +2 -0
@@ -178,6 +178,8 @@ struct kvaser_usb_dev_cfg {extern const struct kvaser_usb_dev_ops kvaser_usb_hydra_dev_ops;extern const struct kvaser_usb_dev_ops kvaser_usb_leaf_dev_ops; +void kvaser_usb_unlink_tx_urbs (struct kvaser_usb_net_priv *priv); +int kvaser_usb_recv_cmd (const struct kvaser_usb *dev,void *cmd,int len,int *actual_len);
drivers/net/can/usb/kvaser_usb/kvaser_usb_core.c +1 -1
@@ -480,7 +480,7 @@ static void kvaser_usb_reset_tx_urb_cont/* This method might sleep. Do not call it in the atomic context * of URB completions. */ -static void kvaser_usb_unlink_tx_urbs (struct kvaser_usb_net_priv *priv) +void kvaser_usb_unlink_tx_urbs (struct kvaser_usb_net_priv *priv) {usb_kill_anchored_urbs (&priv->tx_submitted);kvaser_usb_reset_tx_urb_contexts (priv);
drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +2 -0
@@ -1430,6 +1430,8 @@ static int kvaser_usb_leaf_set_mode(struswitch (mode) {case CAN_MODE_START : +kvaser_usb_unlink_tx_urbs (priv); + err =kvaser_usb_leaf_simple_cmd_async (priv,CMD_START_CHIP );if (err)return err;
Greg Kroah-Hartman
maintainerPATCH 25/530 can: kvaser_usb_leaf: Fix CAN state after restart
In reply to Greg Kroah-HartmanFrom: Anssi Hannula <[email protected]>
commit 0be1a655fe68c8e6dcadbcbddb69cf2fb29881f5 upstream.
can_restart() expects CMD_START_CHIP to set the error state to ERROR_ACTIVE as it calls netif_carrier_on() immediately afterwards.
Otherwise the user may immediately trigger restart again and hit a BUG_ON() in can_restart().
Fix kvaser_usb_leaf set_mode(CMD_START_CHIP) to set the expected state.
--- drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +2 -0
@@ -1435,6 +1435,8 @@ static int kvaser_usb_leaf_set_mode(stru err =kvaser_usb_leaf_simple_cmd_async (priv,CMD_START_CHIP );if (err)return err; + + priv->can.state =CAN_STATE_ERROR_ACTIVE ;break ;default :return -EOPNOTSUPP ;
Greg Kroah-Hartman
maintainerPATCH 26/530 mmc: sdhci-sprd: Fix minimum clock limit
In reply to Greg Kroah-HartmanFrom: Wenchao Chen <[email protected]>
commit 6e141772e6465f937458b35ddcfd0a981b6f5280 upstream.
The Spreadtrum controller supports 100KHz minimal clock rate, which means that the current value 400KHz is wrong.
Unfortunately this has also lead to fail to initialize some cards, which are allowed to require 100KHz to work. So, let's fix the problem by changing the minimal supported clock rate to 100KHz.
--- drivers/mmc/host/sdhci-sprd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/host/sdhci-sprd.c +1 -1
@@ -296,7 +296,7 @@ static unsigned int sdhci_sprd_get_max_cstatic unsigned int sdhci_sprd_get_min_clock (struct sdhci_host *host) { -return 400000 ; +return 100000 ; } static void sdhci_sprd_set_uhs_signaling(struct sdhci_host *host,
Greg Kroah-Hartman
maintainerPATCH 27/530 i2c: designware: Fix handling of real but unexpected device interrupts
In reply to Greg Kroah-HartmanFrom: Jarkko Nikula <[email protected]>
commit 301c8f5c32c8fb79c67539bc23972dc3ef48024c upstream.
Commit c7b79a752871 ("mfd: intel-lpss: Add Intel Alder Lake PCH-S PCI IDs") caused a regression on certain Gigabyte motherboards for Intel Alder Lake-S where system crashes to NULL pointer dereference in i2c_dw_xfer_msg() when system resumes from S3 sleep state ("deep").
I was able to debug the issue on Gigabyte Z690 AORUS ELITE and made following notes:
- Issue happens when resuming from S3 but not when resuming from "s2idle"
- PCI device 00:15.0 == i2c_designware.0 is already in D0 state when system enters into pci_pm_resume_noirq() while all other i2c_designware PCI devices are in D3. Devices were runtime suspended and in D3 prior entering into suspend
- Interrupt comes after pci_pm_resume_noirq() when device interrupts are re-enabled
- According to register dump the interrupt really comes from the i2c_designware.0. Controller is enabled, I2C target address register points to a one detectable I2C device address 0x60 and the DW_IC_RAW_INTR_STAT register START_DET, STOP_DET, ACTIVITY and TX_EMPTY bits are set indicating completed I2C transaction.
My guess is that the firmware uses this controller to communicate with an on-board I2C device during resume but does not disable the controller before giving control to an operating system.
I was told the UEFI update fixes this but never the less it revealed the driver is not ready to handle TX_EMPTY (or RX_FULL) interrupt when device is supposed to be idle and state variables are not set (especially the dev->msgs pointer which may point to NULL or stale old data).
Introduce a new software status flag STATUS_ACTIVE indicating when the controller is active in driver point of view. Now treat all interrupts that occur when is not set as unexpected and mask all interrupts from the controller.
--- drivers/i2c/busses/i2c-designware-core.h | 7 +++++-- drivers/i2c/busses/i2c-designware-master.c | 13 +++++++++++++ 2 files changed, 18 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-designware-core.h +5 -2
@@ -126,8 +126,9 @@* status codes */ #define STATUS_IDLE 0x0 -#define STATUS_WRITE_IN_PROGRESS 0x1 -#define STATUS_READ_IN_PROGRESS 0x2 +#define STATUS_ACTIVE 0x1 +#define STATUS_WRITE_IN_PROGRESS 0x2 +#define STATUS_READ_IN_PROGRESS 0x4/* * operation modes
@@ -322,12 +323,14 @@ void i2c_dw_disable_int(struct dw_i2c_destatic inline void __i2c_dw_enable (struct dw_i2c_dev *dev) { + dev->status |=STATUS_ACTIVE ;regmap_write (dev->map,DW_IC_ENABLE ,1 ); }static inline void __i2c_dw_disable_nowait (struct dw_i2c_dev *dev) {regmap_write (dev->map,DW_IC_ENABLE ,0 ); + dev->status &= ~STATUS_ACTIVE ; }void __i2c_dw_disable (struct dw_i2c_dev *dev);
drivers/i2c/busses/i2c-designware-master.c +13 -0
@@ -720,6 +720,19 @@ static int i2c_dw_irq_handler_master(stru32 stat; stat =i2c_dw_read_clear_intrbits (dev); + +if (!(dev->status &STATUS_ACTIVE )) { +/* +* Unexpected interrupt in driver point of view. State +* variables are either unset or stale so acknowledge and +* disable interrupts for suppressing further interrupts if +* interrupt really came from this HW (E.g. firmware has left +* the HW active). +*/ +regmap_write (dev->map,DW_IC_INTR_MASK ,0 ); +return 0 ; + } +if (stat &DW_IC_INTR_TX_ABRT ) { dev->cmd_err |=DW_IC_ERR_TX_ABRT ; dev->status =STATUS_IDLE ;
Greg Kroah-Hartman
maintainerPATCH 28/530 fs: dlm: fix race between test_bit() and queue_work()
In reply to Greg Kroah-HartmanFrom: Alexander Aring <[email protected]>
commit eef6ec9bf390e836a6c4029f3620fe49528aa1fe upstream.
This patch fixes a race by using ls_cb_mutex around the bit operations and conditional code blocks for LSFL_CB_DELAY.
The function dlm_callback_stop() expects to stop all callbacks and flush all currently queued onces. The set_bit() is not enough because there can still be queue_work() after the workqueue was flushed. To avoid queue_work() after set_bit(), surround both by ls_cb_mutex.
--- fs/dlm/ast.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/dlm/ast.c +4 -2
@@ -198,13 +198,13 @@ void dlm_add_cb(struct dlm_lkb *lkb, uinif (!prev_seq) {kref_get (&lkb->lkb_ref); +mutex_lock (&ls->ls_cb_mutex);if (test_bit (LSFL_CB_DELAY , &ls->ls_flags)) { -mutex_lock (&ls->ls_cb_mutex);list_add (&lkb->lkb_cb_list, &ls->ls_cb_delay); -mutex_unlock (&ls->ls_cb_mutex); }else {queue_work (ls->ls_callback_wq, &lkb->lkb_cb_work); } +mutex_unlock (&ls->ls_cb_mutex); } out:mutex_unlock (&lkb->lkb_cb_mutex);
@@ -284,7 +284,9 @@ void dlm_callback_stop(struct dlm_ls *lsvoid dlm_callback_suspend (struct dlm_ls *ls) { +mutex_lock (&ls->ls_cb_mutex);set_bit (LSFL_CB_DELAY , &ls->ls_flags); +mutex_unlock (&ls->ls_cb_mutex);if (ls->ls_callback_wq)flush_workqueue (ls->ls_callback_wq);
Greg Kroah-Hartman
maintainerPATCH 29/530 fs: dlm: handle -EBUSY first in lock arg validation
In reply to Greg Kroah-HartmanFrom: Alexander Aring <[email protected]>
commit 44637ca41d551d409a481117b07fa209b330fca9 upstream.
During lock arg validation, first check for -EBUSY cases, then for -EINVAL cases. The -EINVAL checks look at lkb state variables which are not stable when an lkb is busy and would cause an -EBUSY result, e.g. lkb->lkb_grmode.
--- fs/dlm/lock.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
fs/dlm/lock.c +8 -8
@@ -2888,24 +2888,24 @@ static int set_unlock_args(uint32_t flagstatic int validate_lock_args (struct dlm_ls *ls,struct dlm_lkb *lkb,struct dlm_args *args) { -int rv = -EINVAL ; +int rv = -EBUSY ;if (args->flags &DLM_LKF_CONVERT ) { -if (lkb->lkb_flags &DLM_IFL_MSTCPY ) +if (lkb->lkb_status !=DLM_LKSTS_GRANTED ) goto out; -if (args->flags &DLM_LKF_QUECVT && - !__quecvt_compat_matrix[lkb->lkb_grmode+1 ][args->mode+1 ]) +if (lkb->lkb_wait_type) goto out; - rv = -EBUSY ; -if (lkb->lkb_status !=DLM_LKSTS_GRANTED ) +if (is_overlap (lkb)) goto out; -if (lkb->lkb_wait_type) + rv = -EINVAL ; +if (lkb->lkb_flags &DLM_IFL_MSTCPY ) goto out; -if (is_overlap (lkb)) +if (args->flags &DLM_LKF_QUECVT && + !__quecvt_compat_matrix[lkb->lkb_grmode+1 ][args->mode+1 ]) goto out; }
Greg Kroah-Hartman
maintainerPATCH 30/530 HID: multitouch: Add memory barriers
In reply to Greg Kroah-HartmanFrom: Andri Yngvason <[email protected]>
commit be6e2b5734a425941fcdcdbd2a9337be498ce2cf upstream.
This fixes broken atomic checks which cause a race between the release-timer and processing of hid input.
I noticed that contacts were sometimes sticking, even with the "sticky fingers" quirk enabled. This fixes that problem.
--- drivers/hid/hid-multitouch.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/hid/hid-multitouch.c +4 -4
@@ -1186,7 +1186,7 @@ static void mt_touch_report(struct hid_dint contact_count =-1 ;/* sticky fingers release in progress, abort */ -if (test_and_set_bit (MT_IO_FLAGS_RUNNING , &td->mt_io_flags)) +if (test_and_set_bit_lock (MT_IO_FLAGS_RUNNING , &td->mt_io_flags))return ; scantime = *app->scantime;
@@ -1267,7 +1267,7 @@ static void mt_touch_report(struct hid_ddel_timer (&td->release_timer); } -clear_bit (MT_IO_FLAGS_RUNNING , &td->mt_io_flags); +clear_bit_unlock (MT_IO_FLAGS_RUNNING , &td->mt_io_flags); } static int mt_touch_input_configured(struct hid_device *hdev,
@@ -1702,11 +1702,11 @@ static void mt_expired_timeout(struct ti* An input report came in just before we release the sticky fingers, * it will take care of the sticky fingers. */ -if (test_and_set_bit (MT_IO_FLAGS_RUNNING , &td->mt_io_flags)) +if (test_and_set_bit_lock (MT_IO_FLAGS_RUNNING , &td->mt_io_flags))return ;if (test_bit (MT_IO_FLAGS_PENDING_SLOTS , &td->mt_io_flags))mt_release_contacts (hdev); -clear_bit (MT_IO_FLAGS_RUNNING , &td->mt_io_flags); +clear_bit_unlock (MT_IO_FLAGS_RUNNING , &td->mt_io_flags); }static int mt_probe (struct hid_device *hdev,const struct hid_device_id *id)
Greg Kroah-Hartman
maintainerPATCH 31/530 quota: Check next/prev free block number after reading from quota file
In reply to Greg Kroah-HartmanFrom: Zhihao Cheng <[email protected]>
commit 6c8ea8b8cd4722efd419f91ca46a2dc81b7d89a3 upstream.
Following process:
Init: v2_read_file_info: <3> dqi_free_blk 0 dqi_free_entry 5 dqi_blks 6
Step 1. chown bin f_a -> dquot_acquire -> v2_write_dquot:
qtree_write_dquot
do_insert_tree
find_free_dqentry
get_free_dqblk
write_blk(info->dqi_blocks) // info->dqi_blocks = 6, failure. The
content in physical block (corresponding to blk 6) is random.
Step 2. chown root f_a -> dquot_transfer -> dqput_all -> dqput ->
ext4_release_dquot -> v2_release_dquot -> qtree_delete_dquot:
dquot_release
remove_tree
free_dqentry
put_free_dqblk(6)
info->dqi_free_blk = blk // info->dqi_free_blk = 6Step 3. drop cache (buffer head for block 6 is released)
Step 4. chown bin f_b -> dquot_acquire -> commit_dqblk -> v2_write_dquot:
qtree_write_dquot
do_insert_tree
find_free_dqentry
get_free_dqblk
dh = (struct qt_disk_dqdbheader *)buf
blk = info->dqi_free_blk // 6
ret = read_blk(info, blk, buf) // The content of buf is random info->dqi_free_blk = le32_to_cpu(dh->dqdh_next_free) // random blk
Step 5. chown bin f_c -> notify_change -> ext4_setattr -> dquot_transfer:
dquot = dqget -> acquire_dquot -> ext4_acquire_dquot -> dquot_acquire ->
commit_dqblk -> v2_write_dquot -> dq_insert_tree:
do_insert_tree
find_free_dqentry
get_free_dqblk
blk = info->dqi_free_blk // If blk < 0 and blk is not an error
code, it will be returned as dquot
transfer_to[USRQUOTA] = dquot // A random negative value __dquot_transfer(transfer_to)
dquot_add_inodes(transfer_to[cnt])
spin_lock(&dquot->dq_dqb_lock) // page fault
, which will lead to kernel page fault:
Quota error (device sda): qtree_write_dquot: Error -8000 occurred while creating quota
BUG: unable to handle page fault for address: ffffffffffffe120 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page Oops: 0002 [#1] PREEMPT SMP CPU: 0 PID: 5974 Comm: chown Not tainted 6.0.0-rc1-00004 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:_raw_spin_lock+0x3a/0x90 Call Trace: dquot_add_inodes+0x28/0x270 __dquot_transfer+0x377/0x840 dquot_transfer+0xde/0x540 ext4_setattr+0x405/0x14d0 notify_change+0x68e/0x9f0 chown_common+0x300/0x430 __x64_sys_fchownat+0x29/0x40
In order to avoid accessing invalid quota memory address, this patch adds block number checking of next/prev free block read from quota file.
Fetch a reproducer in [Link].
--- fs/quota/quota_tree.c | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+)
fs/quota/quota_tree.c +38 -0
@@ -71,6 +71,35 @@ static ssize_t write_blk(struct qtree_mereturn ret; } +static inline int do_check_range (struct super_block *sb,const char *val_name, +uint val,uint min_val,uint max_val) +{ +if (val < min_val || val > max_val) { +quota_error (sb,"Getting %s %u out of range %u-%u" , + val_name, val, min_val, max_val); +return -EUCLEAN ; + } + +return 0 ; +} + +static int check_dquot_block_header (struct qtree_mem_dqinfo *info, +struct qt_disk_dqdbheader *dh) +{ +int err =0 ; + + err =do_check_range (info->dqi_sb,"dqdh_next_free" , +le32_to_cpu (dh->dqdh_next_free),0 , + info->dqi_blocks -1 ); +if (err) +return err; + err =do_check_range (info->dqi_sb,"dqdh_prev_free" , +le32_to_cpu (dh->dqdh_prev_free),0 , + info->dqi_blocks -1 ); + +return err; +} +/* Remove empty block from list and return it */ static int get_free_dqblk (struct qtree_mem_dqinfo *info) {
@@ -85,6 +114,9 @@ static int get_free_dqblk(struct qtree_m ret =read_blk (info, blk, buf);if (ret <0 ) goto out_buf; + ret =check_dquot_block_header (info, dh); +if (ret) + goto out_buf; info->dqi_free_blk =le32_to_cpu (dh->dqdh_next_free); }else {
@@ -232,6 +264,9 @@ static uint find_free_dqentry(struct qtr *err =read_blk (info, blk, buf);if (*err <0 ) goto out_buf; + *err =check_dquot_block_header (info, dh); +if (*err) + goto out_buf; }else { blk =get_free_dqblk (info);if ((int )blk <0 ) {
@@ -424,6 +459,9 @@ static int free_dqentry(struct qtree_mem goto out_buf; } dh = (struct qt_disk_dqdbheader *)buf; + ret =check_dquot_block_header (info, dh); +if (ret) + goto out_buf;le16_add_cpu (&dh->dqdh_entries,-1 );if (!le16_to_cpu (dh->dqdh_entries)) {/* Block got free? */ ret =remove_free_dqentry (info, buf, blk);
Greg Kroah-Hartman
maintainerPATCH 32/530 platform/chrome: cros_ec_proto: Update version on GET_NEXT_EVENT failure
In reply to Greg Kroah-HartmanFrom: Patryk Duda <[email protected]>
commit f74c7557ed0d321947e8bb4e9d47c1013f8b2227 upstream.
Some EC based devices (e.g. Fingerpint MCU) can jump to RO part of the firmware (intentionally or due to device reboot). The RO part doesn't change during the device lifecycle, so it won't support newer version of EC_CMD_GET_NEXT_EVENT command.
Function cros_ec_query_all() is responsible for finding maximum supported MKBP event version. It's usually called when the device is running RW part of the firmware, so the command version can be potentially higher than version supported by the RO.
The problem was fixed by updating maximum supported version when the device returns EC_RES_INVALID_VERSION (mapped to -ENOPROTOOPT). That way the kernel will use highest common version supported by RO and RW.
--- drivers/platform/chrome/cros_ec_proto.c | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+)
drivers/platform/chrome/cros_ec_proto.c +32 -0
@@ -748,6 +748,7 @@ int cros_ec_get_next_event(struct cros_eu8 event_type;u32 host_event;int ret; +u32 ver_mask;/* * Default value for wake_event.
@@ -769,6 +770,37 @@ int cros_ec_get_next_event(struct cros_ereturn get_keyboard_state_event (ec_dev); ret =get_next_event (ec_dev); +/* +* -ENOPROTOOPT is returned when EC returns EC_RES_INVALID_VERSION. +* This can occur when EC based device (e.g. Fingerprint MCU) jumps to +* the RO image which doesn't support newer version of the command. In +* this case we will attempt to update maximum supported version of the +* EC_CMD_GET_NEXT_EVENT. +*/ +if (ret == -ENOPROTOOPT ) { +dev_dbg (ec_dev->dev, +"GET_NEXT_EVENT returned invalid version error.\n" ); + ret =cros_ec_get_host_command_version_mask (ec_dev, +EC_CMD_GET_NEXT_EVENT , + &ver_mask); +if (ret <0 || ver_mask ==0 ) +/* +* Do not change the MKBP supported version if we can't +* obtain supported version correctly. Please note that +* calling EC_CMD_GET_NEXT_EVENT returned +* EC_RES_INVALID_VERSION which means that the command +* is present. +*/ +return -ENOPROTOOPT ; + + ec_dev->mkbp_event_supported =fls (ver_mask); +dev_dbg (ec_dev->dev,"MKBP support version changed to %u\n" , + ec_dev->mkbp_event_supported -1 ); + +/* Try to get next event with new MKBP support version set. */ + ret =get_next_event (ec_dev); + } +if (ret <=0 )return ret;
Greg Kroah-Hartman
maintainerPATCH 33/530 ASoC: wcd9335: fix order of Slimbus unprepare/disable
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
commit ea8ef003aa53ad23e7705c5cab1c4e664faa6c79 upstream.
Slimbus streams are first prepared and then enabled, so the cleanup path should reverse it. The unprepare sets stream->num_ports to 0 and frees the stream->ports. Calling disable after unprepare was not really effective (channels was not deactivated) and could lead to further issues due to making transfers on unprepared stream.
--- sound/soc/codecs/wcd9335.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/wcd9335.c +1 -1
@@ -1971,8 +1971,8 @@ static int wcd9335_trigger(struct snd_pccase SNDRV_PCM_TRIGGER_STOP :case SNDRV_PCM_TRIGGER_SUSPEND :case SNDRV_PCM_TRIGGER_PAUSE_PUSH : -slim_stream_unprepare (dai_data->sruntime);slim_stream_disable (dai_data->sruntime); +slim_stream_unprepare (dai_data->sruntime);break ;default :break ;
Greg Kroah-Hartman
maintainerPATCH 34/530 ASoC: wcd934x: fix order of Slimbus unprepare/disable
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
commit e96bca7eaa5747633ec638b065630ff83728982a upstream.
Slimbus streams are first prepared and then enabled, so the cleanup path should reverse it. The unprepare sets stream->num_ports to 0 and frees the stream->ports. Calling disable after unprepare was not really effective (channels was not deactivated) and could lead to further issues due to making transfers on unprepared stream.
--- sound/soc/codecs/wcd934x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/wcd934x.c +1 -1
@@ -1913,8 +1913,8 @@ static int wcd934x_trigger(struct snd_pccase SNDRV_PCM_TRIGGER_STOP :case SNDRV_PCM_TRIGGER_SUSPEND :case SNDRV_PCM_TRIGGER_PAUSE_PUSH : -slim_stream_unprepare (dai_data->sruntime);slim_stream_disable (dai_data->sruntime); +slim_stream_unprepare (dai_data->sruntime);break ;default :break ;
Greg Kroah-Hartman
maintainerPATCH 35/530 hwmon: (gsc-hwmon) Call of_node_get() before of_find_xxx API
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
commit 7f62cf781e6567d59c8935dc8c6068ce2bb904b7 upstream.
In gsc_hwmon_get_devtree_pdata(), we should call of_node_get() before the of_find_compatible_node() which will automatically call of_node_put() for the 'from' argument.
--- drivers/hwmon/gsc-hwmon.c | 1 + 1 file changed, 1 insertion(+)
drivers/hwmon/gsc-hwmon.c +1 -0
@@ -267,6 +267,7 @@ gsc_hwmon_get_devtree_pdata(struct devic pdata->nchannels = nchannels;/* fan controller base address */ +of_node_get (dev->parent->of_node); fan =of_find_compatible_node (dev->parent->of_node,NULL ,"gw,gsc-fan" );if (fan &&of_property_read_u32 (fan,"reg" , &pdata->fan_base)) {dev_err (dev,"fan node without base\n" );
Greg Kroah-Hartman
maintainerPATCH 36/530 net: thunderbolt: Enable DMA paths only after rings are enabled
In reply to Greg Kroah-HartmanFrom: Mika Westerberg <[email protected]>
commit ff7cd07f306406493f7b78890475e85b6d0811ed upstream.
If the other host starts sending packets early on it is possible that we are still in the middle of populating the initial Rx ring packets to the ring. This causes the tbnet_poll() to mess over the queue and causes list corruption. This happens specifically when connected with macOS as it seems start sending various IP discovery packets as soon as its side of the paths are configured.
To prevent this we move the DMA path enabling to happen after we have primed the Rx ring. This makes sure no incoming packets can arrive before we are ready to handle them.
--- drivers/net/thunderbolt.c | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-)
drivers/net/thunderbolt.c +17 -11
@@ -612,18 +612,13 @@ static void tbnet_connected_work(structreturn ; } -/* Both logins successful so enable the high-speed DMA paths and -* start the network device queue. +/* Both logins successful so enable the rings, high-speed DMA +* paths and start the network device queue. +* +* Note we enable the DMA paths last to make sure we have primed +* the Rx ring before any incoming packets are allowed to +* arrive. */ - ret =tb_xdomain_enable_paths (net->xd, net->local_transmit_path, - net->rx_ring.ring->hop, - net->remote_transmit_path, - net->tx_ring.ring->hop); -if (ret) { -netdev_err (net->dev,"failed to enable DMA paths\n" ); -return ; - } -tb_ring_start (net->tx_ring.ring);tb_ring_start (net->rx_ring.ring);
@@ -635,10 +630,21 @@ static void tbnet_connected_work(structif (ret) goto err_free_rx_buffers; + ret =tb_xdomain_enable_paths (net->xd, net->local_transmit_path, + net->rx_ring.ring->hop, + net->remote_transmit_path, + net->tx_ring.ring->hop); +if (ret) { +netdev_err (net->dev,"failed to enable DMA paths\n" ); + goto err_free_tx_buffers; + } +netif_carrier_on (net->dev);netif_start_queue (net->dev);return ; +err_free_tx_buffers: +tbnet_free_buffers (&net->tx_ring); err_free_rx_buffers:tbnet_free_buffers (&net->rx_ring); err_stop_rings:
Greg Kroah-Hartman
maintainerPATCH 37/530 regulator: qcom_rpm: Fix circular deferral regression
In reply to Greg Kroah-HartmanFrom: Linus Walleij <[email protected]>
commit 8478ed5844588703a1a4c96a004b1525fbdbdd5e upstream.
On recent kernels, the PM8058 L16 (or any other PM8058 LDO-regulator) does not come up if they are supplied by an SMPS-regulator. This is not very strange since the regulators are registered in a long array and the L-regulators are registered before the S-regulators, and if an L-regulator defers, it will never get around to registering the S-regulator that it needs.
See arch/arm/boot/dts/qcom-apq8060-dragonboard.dts:
pm8058-regulators {
(...)
vdd_l13_l16-supply = <&pm8058_s4>;
(...)Ooops.
Fix this by moving the PM8058 S-regulators first in the array.
Do the same for the PM8901 S-regulators (though this is currently not causing any problems with out device trees) so that the pattern of registration order is the same on all PMnnnn chips.
--- drivers/regulator/qcom_rpm-regulator.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
drivers/regulator/qcom_rpm-regulator.c +12 -12
@@ -802,6 +802,12 @@ static const struct rpm_regulator_data r };static const struct rpm_regulator_data rpm_pm8058_regulators[] = { + {"s0" ,QCOM_RPM_PM8058_SMPS0 , &pm8058_smps,"vdd_s0" }, + {"s1" ,QCOM_RPM_PM8058_SMPS1 , &pm8058_smps,"vdd_s1" }, + {"s2" ,QCOM_RPM_PM8058_SMPS2 , &pm8058_smps,"vdd_s2" }, + {"s3" ,QCOM_RPM_PM8058_SMPS3 , &pm8058_smps,"vdd_s3" }, + {"s4" ,QCOM_RPM_PM8058_SMPS4 , &pm8058_smps,"vdd_s4" }, + {"l0" ,QCOM_RPM_PM8058_LDO0 , &pm8058_nldo,"vdd_l0_l1_lvs" }, {"l1" ,QCOM_RPM_PM8058_LDO1 , &pm8058_nldo,"vdd_l0_l1_lvs" }, {"l2" ,QCOM_RPM_PM8058_LDO2 , &pm8058_pldo,"vdd_l2_l11_l12" },
@@ -829,12 +835,6 @@ static const struct rpm_regulator_data r { "l24", QCOM_RPM_PM8058_LDO24, &pm8058_nldo, "vdd_l23_l24_l25" }, { "l25", QCOM_RPM_PM8058_LDO25, &pm8058_nldo, "vdd_l23_l24_l25" }, - { "s0", QCOM_RPM_PM8058_SMPS0, &pm8058_smps, "vdd_s0" }, - { "s1", QCOM_RPM_PM8058_SMPS1, &pm8058_smps, "vdd_s1" }, - { "s2", QCOM_RPM_PM8058_SMPS2, &pm8058_smps, "vdd_s2" }, - { "s3", QCOM_RPM_PM8058_SMPS3, &pm8058_smps, "vdd_s3" }, - { "s4", QCOM_RPM_PM8058_SMPS4, &pm8058_smps, "vdd_s4" }, - { "lvs0", QCOM_RPM_PM8058_LVS0, &pm8058_switch, "vdd_l0_l1_lvs" }, { "lvs1", QCOM_RPM_PM8058_LVS1, &pm8058_switch, "vdd_l0_l1_lvs" },
@@ -843,6 +843,12 @@ static const struct rpm_regulator_data r };static const struct rpm_regulator_data rpm_pm8901_regulators[] = { + {"s0" ,QCOM_RPM_PM8901_SMPS0 , &pm8901_ftsmps,"vdd_s0" }, + {"s1" ,QCOM_RPM_PM8901_SMPS1 , &pm8901_ftsmps,"vdd_s1" }, + {"s2" ,QCOM_RPM_PM8901_SMPS2 , &pm8901_ftsmps,"vdd_s2" }, + {"s3" ,QCOM_RPM_PM8901_SMPS3 , &pm8901_ftsmps,"vdd_s3" }, + {"s4" ,QCOM_RPM_PM8901_SMPS4 , &pm8901_ftsmps,"vdd_s4" }, + {"l0" ,QCOM_RPM_PM8901_LDO0 , &pm8901_nldo,"vdd_l0" }, {"l1" ,QCOM_RPM_PM8901_LDO1 , &pm8901_pldo,"vdd_l1" }, {"l2" ,QCOM_RPM_PM8901_LDO2 , &pm8901_pldo,"vdd_l2" },
@@ -851,12 +857,6 @@ static const struct rpm_regulator_data r { "l5", QCOM_RPM_PM8901_LDO5, &pm8901_pldo, "vdd_l5" }, { "l6", QCOM_RPM_PM8901_LDO6, &pm8901_pldo, "vdd_l6" }, - { "s0", QCOM_RPM_PM8901_SMPS0, &pm8901_ftsmps, "vdd_s0" }, - { "s1", QCOM_RPM_PM8901_SMPS1, &pm8901_ftsmps, "vdd_s1" }, - { "s2", QCOM_RPM_PM8901_SMPS2, &pm8901_ftsmps, "vdd_s2" }, - { "s3", QCOM_RPM_PM8901_SMPS3, &pm8901_ftsmps, "vdd_s3" }, - { "s4", QCOM_RPM_PM8901_SMPS4, &pm8901_ftsmps, "vdd_s4" }, - { "lvs0", QCOM_RPM_PM8901_LVS0, &pm8901_switch, "lvs0_in" }, { "lvs1", QCOM_RPM_PM8901_LVS1, &pm8901_switch, "lvs1_in" }, { "lvs2", QCOM_RPM_PM8901_LVS2, &pm8901_switch, "lvs2_in" },
Greg Kroah-Hartman
maintainerPATCH 38/530 arm64: topology: move store_cpu_topology() to shared code
In reply to Greg Kroah-HartmanFrom: Conor Dooley <[email protected]>
commit 456797da792fa7cbf6698febf275fe9b36691f78 upstream.
arm64's method of defining a default cpu topology requires only minimal changes to apply to RISC-V also. The current arm64 implementation exits early in a uniprocessor configuration by reading MPIDR & claiming that uniprocessor can rely on the default values.
This is appears to be a hangover from prior to '3102bc0e6ac7 ("arm64:
topology: Stop using MPIDR for topology information")', because the current code just assigns default values for multiprocessor systems.
With the MPIDR references removed, store_cpu_topolgy() can be moved to the common arch_topology code.
--- arch/arm64/kernel/topology.c | 40 ---------------------------------------- drivers/base/arch_topology.c | 19 +++++++++++++++++++ 2 files changed, 19 insertions(+), 40 deletions(-)
arch/arm64/kernel/topology.c +0 -40
@@ -22,46 +22,6 @@#include <asm/cputype.h> #include <asm/topology.h> -void store_cpu_topology (unsigned int cpuid) -{ -struct cpu_topology *cpuid_topo = &cpu_topology[cpuid]; -u64 mpidr; - -if (cpuid_topo->package_id !=-1 ) - goto topology_populated; - - mpidr =read_cpuid_mpidr (); - -/* Uniprocessor systems can rely on default topology values */ -if (mpidr &MPIDR_UP_BITMASK ) -return ; - -/* -* This would be the place to create cpu topology based on MPIDR. -* -* However, it cannot be trusted to depict the actual topology; some -* pieces of the architecture enforce an artificial cap on Aff0 values -* (e.g. GICv3's ICC_SGI1R_EL1 limits it to 15), leading to an -* artificial cycling of Aff1, Aff2 and Aff3 values. IOW, these end up -* having absolutely no relationship to the actual underlying system -* topology, and cannot be reasonably used as core / package ID. -* -* If the MT bit is set, Aff0 *could* be used to define a thread ID, but -* we still wouldn't be able to obtain a sane core ID. This means we -* need to entirely ignore MPIDR for any topology deduction. -*/ - cpuid_topo->thread_id =-1 ; - cpuid_topo->core_id = cpuid; - cpuid_topo->package_id =cpu_to_node (cpuid); - -pr_debug ("CPU%u: cluster %d core %d thread %d mpidr %#016llx\n" , - cpuid, cpuid_topo->package_id, cpuid_topo->core_id, - cpuid_topo->thread_id, mpidr); - -topology_populated: -update_siblings_masks (cpuid); -} -#ifdef CONFIG_ACPI static bool __init acpi_cpu_is_threaded (int cpu) {
drivers/base/arch_topology.c +19 -0
@@ -690,4 +690,23 @@ void __init init_cpu_topology(void) else if (of_have_populated_dt() && parse_dt_topology()) reset_cpu_topology(); } + +void store_cpu_topology (unsigned int cpuid) +{ +struct cpu_topology *cpuid_topo = &cpu_topology[cpuid]; + +if (cpuid_topo->package_id !=-1 ) + goto topology_populated; + + cpuid_topo->thread_id =-1 ; + cpuid_topo->core_id = cpuid; + cpuid_topo->package_id =cpu_to_node (cpuid); + +pr_debug ("CPU%u: package %d core %d thread %d\n" , + cpuid, cpuid_topo->package_id, cpuid_topo->core_id, + cpuid_topo->thread_id); + +topology_populated: +update_siblings_masks (cpuid); +}#endif
Greg Kroah-Hartman
maintainerPATCH 39/530 riscv: topology: fix default topology reporting
In reply to Greg Kroah-HartmanFrom: Conor Dooley <[email protected]>
commit fbd92809997a391f28075f1c8b5ee314c225557c upstream.
RISC-V has no sane defaults to fall back on where there is no cpu-map in the devicetree.
Without sane defaults, the package, core and thread IDs are all set to -1. This causes user-visible inaccuracies for tools like hwloc/lstopo which rely on the sysfs cpu topology files to detect a system's topology.
On a PolarFire SoC, which should have 4 harts with a thread each, lstopo currently reports:
Machine (793MB total)
Package L#0
NUMANode L#0 (P#0 793MB)
Core L#0
L1d L#0 (32KB) + L1i L#0 (32KB) + PU L#0 (P#0)
L1d L#1 (32KB) + L1i L#1 (32KB) + PU L#1 (P#1)
L1d L#2 (32KB) + L1i L#2 (32KB) + PU L#2 (P#2)
L1d L#3 (32KB) + L1i L#3 (32KB) + PU L#3 (P#3)Adding calls to store_cpu_topology() in {boot,smp} hart bringup code results in the correct topolgy being reported:
Machine (793MB total)
Package L#0
NUMANode L#0 (P#0 793MB)
L1d L#0 (32KB) + L1i L#0 (32KB) + Core L#0 + PU L#0 (P#0)
L1d L#1 (32KB) + L1i L#1 (32KB) + Core L#1 + PU L#1 (P#1)
L1d L#2 (32KB) + L1i L#2 (32KB) + Core L#2 + PU L#2 (P#2)
L1d L#3 (32KB) + L1i L#3 (32KB) + Core L#3 + PU L#3 (P#3)--- arch/riscv/Kconfig | 2 +- arch/riscv/kernel/smpboot.c | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-)
arch/riscv/Kconfig +1 -1
@@ -46,7 +46,7 @@ config RISCV select CLINT_TIMER if !MMU select COMMON_CLK select EDAC_SUPPORT - select GENERIC_ARCH_TOPOLOGY if SMP + select GENERIC_ARCH_TOPOLOGY select GENERIC_ATOMIC64 if !64BIT select GENERIC_CLOCKEVENTS_BROADCAST if SMP select GENERIC_EARLY_IOREMAP
arch/riscv/kernel/smpboot.c +2 -1
@@ -53,6 +53,7 @@ void __init smp_prepare_cpus(unsigned inunsigned int curr_cpuid; curr_cpuid =smp_processor_id (); +store_cpu_topology (curr_cpuid);numa_store_cpu_info (curr_cpuid);numa_add_cpu (curr_cpuid);
@@ -165,9 +166,9 @@ asmlinkage __visible void smp_callin(voimmgrab (mm); current->active_mm = mm; +store_cpu_topology (curr_cpuid);notify_cpu_starting (curr_cpuid);numa_add_cpu (curr_cpuid); -update_siblings_masks (curr_cpuid);set_cpu_online (curr_cpuid,1 );/*
Greg Kroah-Hartman
maintainerPATCH 40/530 RISC-V: Make port I/O string accessors actually work
In reply to Greg Kroah-HartmanFrom: Maciej W. Rozycki <[email protected]>
commit 9cc205e3c17d5716da7ebb7fa0c985555e95d009 upstream.
Fix port I/O string accessors such as insb', outsb', etc. which use the physical PCI port I/O address rather than the corresponding memory mapping to get at the requested location, which in turn breaks at least accesses made by our parport driver to a PCIe parallel port such as:
PCI parallel port detected: 1415:c118, I/O at 0x1000(0x1008), IRQ 20
parport0: PC-style at 0x1000 (0x1008), irq 20, using FIFO [PCSPP,TRISTATE,COMPAT,EPP,ECP]
causing a memory access fault:
Unable to handle kernel access to user memory without uaccess routines at virtual address 0000000000001008 Oops [#1] Modules linked in: CPU: 1 PID: 350 Comm: cat Not tainted 6.0.0-rc2-00283-g10d4879f9ef0-dirty #23 Hardware name: SiFive HiFive Unmatched A00 (DT) epc : parport_pc_fifo_write_block_pio+0x266/0x416 ra : parport_pc_fifo_write_block_pio+0xb4/0x416
epc : ffffffff80542c3e ra : ffffffff80542a8c sp : ffffffd88899fc60
gp : ffffffff80fa2700 tp : ffffffd882b1e900 t0 : ffffffd883d0b000 t1 : ffffffffff000002 t2 : 4646393043330a38 s0 : ffffffd88899fcf0 s1 : 0000000000001000 a0 : 0000000000000010 a1 : 0000000000000000 a2 : ffffffd883d0a010 a3 : 0000000000000023 a4 : 00000000ffff8fbb a5 : ffffffd883d0a001 a6 : 0000000100000000 a7 : ffffffc800000000 s2 : ffffffffff000002 s3 : ffffffff80d28880 s4 : ffffffff80fa1f50 s5 : 0000000000001008 s6 : 0000000000000008 s7 : ffffffd883d0a000 s8 : 0004000000000000 s9 : ffffffff80dc1d80 s10: ffffffd8807e4000
s11: 0000000000000000 t3 : 00000000000000ff t4 : 393044410a303930 t5 : 0000000000001000 t6 : 0000000000040000
status: 0000000200000120 badaddr: 0000000000001008 cause: 000000000000000f
[<ffffffff80543212>] parport_pc_compat_write_block_pio+0xfe/0x200 [<ffffffff8053bbc0>] parport_write+0x46/0xf8 [<ffffffff8050530e>] lp_write+0x158/0x2d2 [<ffffffff80185716>] vfs_write+0x8e/0x2c2 [<ffffffff80185a74>] ksys_write+0x52/0xc2 [<ffffffff80185af2>] sys_write+0xe/0x16 [<ffffffff80003770>] ret_from_syscall+0x0/0x2 ---[ end trace 0000000000000000 ]---
For simplicity address the problem by adding PCI_IOBASE to the physical address requested in the respective wrapper macros only, observing that the raw accessors such as __insb', __outsb', etc. are not supposed to be used other than by said macros. Remove the cast to long' that is no longer needed on addr' now that it is used as an offset from PCI_IOBASE and add parentheses around `addr' needed for predictable evaluation in macro expansion. No need to make said adjustments in separate changes given that current code is gravely broken and does not ever work.
--- arch/riscv/include/asm/io.h | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
arch/riscv/include/asm/io.h +8 -8
@@ -101,9 +101,9 @@ __io_reads_ins(reads, u32, l, __io_br(), __io_reads_ins(ins, u8, b, __io_pbr(), __io_par(addr)) __io_reads_ins(ins, u16, w, __io_pbr(), __io_par(addr)) __io_reads_ins(ins, u32, l, __io_pbr(), __io_par(addr)) -#define insb (addr, buffer, count) __insb((void __iomem *)(long)addr, buffer, count) -#define insw (addr, buffer, count) __insw((void __iomem *)(long)addr, buffer, count) -#define insl (addr, buffer, count) __insl((void __iomem *)(long)addr, buffer, count) +#define insb (addr, buffer, count) __insb(PCI_IOBASE + (addr), buffer, count) +#define insw (addr, buffer, count) __insw(PCI_IOBASE + (addr), buffer, count) +#define insl (addr, buffer, count) __insl(PCI_IOBASE + (addr), buffer, count) __io_writes_outs(writes, u8, b, __io_bw(), __io_aw())__io_writes_outs (writes, u16, w,__io_bw (),__io_aw ())
@@ -115,22 +115,22 @@ __io_writes_outs(writes, u32, l, __io_bw __io_writes_outs(outs, u8, b, __io_pbw(), __io_paw()) __io_writes_outs(outs, u16, w, __io_pbw(), __io_paw()) __io_writes_outs(outs, u32, l, __io_pbw(), __io_paw()) -#define outsb (addr, buffer, count) __outsb((void __iomem *)(long)addr, buffer, count) -#define outsw (addr, buffer, count) __outsw((void __iomem *)(long)addr, buffer, count) -#define outsl (addr, buffer, count) __outsl((void __iomem *)(long)addr, buffer, count) +#define outsb (addr, buffer, count) __outsb(PCI_IOBASE + (addr), buffer, count) +#define outsw (addr, buffer, count) __outsw(PCI_IOBASE + (addr), buffer, count) +#define outsl (addr, buffer, count) __outsl(PCI_IOBASE + (addr), buffer, count)#ifdef CONFIG_64BIT __io_reads_ins(reads, u64, q, __io_br(), __io_ar(addr))#define readsq (addr, buffer, count) __readsq(addr, buffer, count) __io_reads_ins(ins, u64, q, __io_pbr(), __io_par(addr)) -#define insq (addr, buffer, count) __insq((void __iomem *)addr, buffer, count) +#define insq (addr, buffer, count) __insq(PCI_IOBASE + (addr), buffer, count) __io_writes_outs(writes, u64, q, __io_bw(), __io_aw())#define writesq (addr, buffer, count) __writesq(addr, buffer, count) __io_writes_outs(outs, u64, q, __io_pbr(), __io_paw()) -#define outsq (addr, buffer, count) __outsq((void __iomem *)addr, buffer, count) +#define outsq (addr, buffer, count) __outsq(PCI_IOBASE + (addr), buffer, count)#endif #include <asm-generic/io.h>
Greg Kroah-Hartman
maintainerPATCH 41/530 parisc: fbdev/stifb: Align graphics memory size to 4MB
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
commit aca7c13d3bee81a968337a5515411409ae9d095d upstream.
Independend of the current graphics resolution, adjust the reported graphics card memory size to the next 4MB boundary.
This fixes the fbtest program which expects a naturally aligned size.
--- drivers/video/fbdev/stifb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/fbdev/stifb.c +1 -1
@@ -1257,7 +1257,7 @@ static int __init stifb_init_fb(struct s/* limit fbsize to max visible screen size */ if (fix->smem_len > yres*fix->line_length) - fix->smem_len = yres*fix->line_length; + fix->smem_len =ALIGN (yres*fix->line_length,4 *1024 *1024 ); fix->accel =FB_ACCEL_NONE ;
Greg Kroah-Hartman
maintainerPATCH 42/530 riscv: Allow PROT_WRITE-only mmap()
In reply to Greg Kroah-HartmanFrom: Andrew Bresticker <[email protected]>
commit 9e2e6042a7ec6504fe8e366717afa2f40cf16488 upstream.
Commit 2139619bcad7 ("riscv: mmap with PROT_WRITE but no PROT_READ is invalid") made mmap() return EINVAL if PROT_WRITE was set wihtout PROT_READ with the justification that a write-only PTE is considered a reserved PTE permission bit pattern in the privileged spec. This check is unnecessary since we let VM_WRITE imply VM_READ on RISC-V, and it is inconsistent with other architectures that don't support write-only PTEs, creating a potential software portability issue. Just remove the check altogether and let PROT_WRITE imply PROT_READ as is the case on other architectures.
Note that this also allows PROT_WRITE|PROT_EXEC mappings which were disallowed prior to the aforementioned commit; PROT_READ is implied in such mappings as well.
--- arch/riscv/kernel/sys_riscv.c | 3 --- 1 file changed, 3 deletions(-)
arch/riscv/kernel/sys_riscv.c +0 -3
@@ -18,9 +18,6 @@ static long riscv_sys_mmap(unsigned longif (unlikely (offset & (~PAGE_MASK >> page_shift_offset)))return -EINVAL ; -if (unlikely ((prot &PROT_WRITE ) && !(prot &PROT_READ ))) -return -EINVAL ; -return ksys_mmap_pgoff (addr, len, prot, flags, fd, offset >> (PAGE_SHIFT - page_shift_offset)); }
Greg Kroah-Hartman
maintainerPATCH 43/530 riscv: Make VM_WRITE imply VM_READ
In reply to Greg Kroah-HartmanFrom: Andrew Bresticker <[email protected]>
commit 7ab72c597356be1e7f0f3d856e54ce78527f43c8 upstream.
RISC-V does not presently have write-only mappings as that PTE bit pattern is considered reserved in the privileged spec, so allow handling of read faults in VMAs that have VM_WRITE without VM_READ in order to be consistent with other architectures that have similar limitations.
--- arch/riscv/mm/fault.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/riscv/mm/fault.c +2 -1
@@ -188,7 +188,8 @@ static inline bool access_error(unsigned }break ;case EXC_LOAD_PAGE_FAULT : -if (!(vma->vm_flags &VM_READ )) { +/* Write implies read */ +if (!(vma->vm_flags & (VM_READ |VM_WRITE ))) {return true; }break ;
Greg Kroah-Hartman
maintainerPATCH 44/530 riscv: always honor the CONFIG_CMDLINE_FORCE when parsing dtb
In reply to Greg Kroah-HartmanFrom: Wenting Zhang <[email protected]>
commit 10f6913c548b32ecb73801a16b120e761c6957ea upstream.
When CONFIG_CMDLINE_FORCE is enabled, cmdline provided by CONFIG_CMDLINE are always used. This allows CONFIG_CMDLINE to be used regardless of the result of device tree scanning.
This especially fixes the case where a device tree without the chosen node is supplied to the kernel. In such cases, early_init_dt_scan would return true. But inside early_init_dt_scan_chosen, the cmdline won't be updated as there is no chosen node in the device tree. As a result, CONFIG_CMDLINE is not copied into boot_command_line even if CONFIG_CMDLINE_FORCE is enabled. This commit allows properly update boot_command_line in this situation.
--- arch/riscv/kernel/setup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/riscv/kernel/setup.c +2 -2
@@ -260,10 +260,10 @@ static void __init parse_dtb(void)pr_info ("Machine model: %s\n" , name);dump_stack_set_arch_desc ("%s (DT)" , name); } -return ; + }else { +pr_err ("No DTB passed to the kernel\n" ); } -pr_err ("No DTB passed to the kernel\n" );#ifdef CONFIG_CMDLINE_FORCE strscpy (boot_command_line,CONFIG_CMDLINE ,COMMAND_LINE_SIZE );pr_info ("Forcing kernel command line to: %s\n" , boot_command_line);
Greg Kroah-Hartman
maintainerPATCH 45/530 riscv: Pass -mno-relax only on lld < 15.0.0
In reply to Greg Kroah-HartmanFrom: Fangrui Song <[email protected]>
commit 3cebf80e9a0d3adcb174053be32c88a640b3344b upstream.
lld since llvm:6611d58f5bbc ("[ELF] Relax R_RISCV_ALIGN"), which will be included in the 15.0.0 release, has implemented some RISC-V linker relaxation. -mno-relax is no longer needed in KBUILD_CFLAGS/KBUILD_AFLAGS to suppress R_RISCV_ALIGN which older lld can not handle:
ld.lld: error: capability.c:(.fixup+0x0): relocation R_RISCV_ALIGN requires unimplemented linker relaxation; recompile with -mno-relax but the .o is already compiled with -mno-relax
--- arch/riscv/Makefile | 2 ++ 1 file changed, 2 insertions(+)
arch/riscv/Makefile +2 -0
@@ -39,6 +39,7 @@ else endif ifeq ($(CONFIG_LD_IS_LLD),y) +ifeq ($(shell test $(CONFIG_LLD_VERSION) -lt 150000; echo $$?),0) KBUILD_CFLAGS += -mno-relax KBUILD_AFLAGS += -mno-relax ifndef CONFIG_AS_IS_LLVM
@@ -46,6 +47,7 @@ ifndef CONFIG_AS_IS_LLVM KBUILD_AFLAGS += -Wa,-mno-relax endif endif +endif # ISA string setting riscv-march-$(CONFIG_ARCH_RV32I) := rv32ima
Greg Kroah-Hartman
maintainerPATCH 46/530 UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
In reply to Greg Kroah-HartmanFrom: Huacai Chen <[email protected]>
commit 16c546e148fa6d14a019431436a6f7b4087dbccd upstream.
When CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS is selected, cpu_max_bits_warn() generates a runtime warning similar as below while we show /proc/cpuinfo. Fix this by using nr_cpu_ids (the runtime limit) instead of NR_CPUS to iterate CPUs.
[ 3.052463] ------------[ cut here ]------------ [ 3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_cpuinfo+0x5e8/0x5f0 [ 3.070072] Modules linked in: efivarfs autofs4 [ 3.076257] CPU: 0 PID: 1 Comm: systemd Not tainted 5.19-rc5+ #1052 [ 3.099465] Stack : 9000000100157b08 9000000000f18530 9000000000cf846c 9000000100154000 [ 3.109127] 9000000100157a50 0000000000000000 9000000100157a58 9000000000ef7430 [ 3.118774] 90000001001578e8 0000000000000040 0000000000000020 ffffffffffffffff [ 3.128412] 0000000000aaaaaa 1ab25f00eec96a37 900000010021de80 900000000101c890 [ 3.138056] 0000000000000000 0000000000000000 0000000000000000 0000000000aaaaaa [ 3.147711] ffff8000339dc220 0000000000000001 0000000006ab4000 0000000000000000 [ 3.157364] 900000000101c998 0000000000000004 9000000000ef7430 0000000000000000 [ 3.167012] 0000000000000009 000000000000006c 0000000000000000 0000000000000000 [ 3.176641] 9000000000d3de08 9000000001639390 90000000002086d8 00007ffff0080286 [ 3.186260] 00000000000000b0 0000000000000004 0000000000000000 0000000000071c1c [ 3.195868] ... [ 3.199917] Call Trace: [ 3.203941] [<90000000002086d8>] show_stack+0x38/0x14c [ 3.210666] [<9000000000cf846c>] dump_stack_lvl+0x60/0x88 [ 3.217625] [<900000000023d268>] __warn+0xd0/0x100 [ 3.223958] [<9000000000cf3c90>] warn_slowpath_fmt+0x7c/0xcc [ 3.231150] [<9000000000210220>] show_cpuinfo+0x5e8/0x5f0 [ 3.238080] [<90000000004f578c>] seq_read_iter+0x354/0x4b4 [ 3.245098] [<90000000004c2e90>] new_sync_read+0x17c/0x1c4 [ 3.252114] [<90000000004c5174>] vfs_read+0x138/0x1d0 [ 3.258694] [<90000000004c55f8>] ksys_read+0x70/0x100 [ 3.265265] [<9000000000cfde9c>] do_syscall+0x7c/0x94 [ 3.271820] [<9000000000202fe4>] handle_syscall+0xc4/0x160 [ 3.281824] ---[ end trace 8b484262b4b8c24c ]---
--- arch/um/kernel/um_arch.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/um/kernel/um_arch.c +1 -1
@@ -94,7 +94,7 @@ static int show_cpuinfo(struct seq_filestatic void *c_start (struct seq_file *m,loff_t *pos) { -return *pos <NR_CPUS ? cpu_data + *pos :NULL ; +return *pos < nr_cpu_ids ? cpu_data + *pos :NULL ; }static void *c_next (struct seq_file *m,void *v,loff_t *pos)
Greg Kroah-Hartman
maintainerPATCH 47/530 nvmem: core: Fix memleak in nvmem_register()
In reply to Greg Kroah-HartmanFrom: Gaosheng Cui <[email protected]>
commit bd1244561fa2a4531ded40dbf09c9599084f8b29 upstream.
dev_set_name will alloc memory for nvmem->dev.kobj.name in nvmem_register, when nvmem_validate_keepouts failed, nvmem's memory will be freed and return, but nobody will free memory for nvmem->dev.kobj.name, there will be memleak, so moving nvmem_validate_keepouts() after device_register() and let the device core deal with cleaning name in error cases.
--- drivers/nvmem/core.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
drivers/nvmem/core.c +6 -9
@@ -824,21 +824,18 @@ struct nvmem_device *nvmem_register(cons nvmem->dev.groups = nvmem_dev_groups;#endif -if (nvmem->nkeepout) { - rval =nvmem_validate_keepouts (nvmem); -if (rval) { -ida_free (&nvmem_ida, nvmem->id); -kfree (nvmem); -return ERR_PTR (rval); - } - } -dev_dbg (&nvmem->dev,"Registering nvmem device %s\n" , config->name); rval =device_register (&nvmem->dev);if (rval) goto err_put_device; +if (nvmem->nkeepout) { + rval =nvmem_validate_keepouts (nvmem); +if (rval) + goto err_device_del; + } +if (config->compat) { rval =nvmem_sysfs_setup_compat (nvmem, config);if (rval)
Greg Kroah-Hartman
maintainerPATCH 48/530 nvme-multipath: fix possible hang in live ns resize with ANA access
In reply to Greg Kroah-HartmanFrom: Sagi Grimberg <[email protected]>
commit 72e3b8883a36e80ebfa41015c7b6926ce31ace05 upstream.
When we revalidate paths as part of ns size change (as of commit e7d65803e2bb), it is possible that during the path revalidation, the only paths that is IO capable (i.e. optimized/non-optimized) are the ones that ns resize was not yet informed to the host, which will cause inflight requests to be requeued (as we have available paths but none are IO capable). These requests on the requeue list are waiting for someone to resubmit them at some point.
The IO capable paths will eventually notify the ns resize change to the host, but there is nothing that will kick the requeue list to resubmit the queued requests.
Fix this by always kicking the requeue list, and if no IO capable path exists, these requests will be queued again.
A typical log that indicates that IOs are requeued:
--
nvme nvme1: creating 4 I/O queues.
nvme nvme1: new ctrl: "testnqn1"
nvme nvme2: creating 4 I/O queues.
nvme nvme2: mapped 4/0/0 default/read/poll queues. nvme nvme2: new ctrl: NQN "testnqn1", addr 127.0.0.1:8009 nvme nvme1: rescanning namespaces.
nvme1n1: detected capacity change from 2097152 to 4194304 block nvme1n1: no usable path - requeuing I/O block nvme1n1: no usable path - requeuing I/O block nvme1n1: no usable path - requeuing I/O block nvme1n1: no usable path - requeuing I/O block nvme1n1: no usable path - requeuing I/O block nvme1n1: no usable path - requeuing I/O block nvme1n1: no usable path - requeuing I/O block nvme1n1: no usable path - requeuing I/O block nvme1n1: no usable path - requeuing I/O block nvme1n1: no usable path - requeuing I/O nvme nvme2: rescanning namespaces.
--
--- drivers/nvme/host/multipath.c | 1 + 1 file changed, 1 insertion(+)
drivers/nvme/host/multipath.c +1 -0
@@ -159,6 +159,7 @@ void nvme_mpath_revalidate_paths(structfor_each_node (node)rcu_assign_pointer (head->current_path[node],NULL ); +kblockd_schedule_work (&head->requeue_work); }static bool nvme_path_is_disabled (struct nvme_ns *ns)
Greg Kroah-Hartman
maintainerPATCH 49/530 nvme-pci: set min_align_mask before calculating max_hw_sectors
In reply to Greg Kroah-HartmanFrom: Rishabh Bhatnagar <[email protected]>
commit 61ce339f19fabbc3e51237148a7ef6f2270e44fa upstream.
If swiotlb is force enabled dma_max_mapping_size ends up calling swiotlb_max_mapping_size which takes into account the min align mask for the device. Set the min align mask for nvme driver before calling dma_max_mapping_size while calculating max hw sectors.
--- drivers/nvme/host/pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/nvme/host/pci.c +2 -1
@@ -2732,6 +2732,8 @@ static void nvme_reset_work(struct work_if (result) goto out_unlock; +dma_set_min_align_mask (dev->dev,NVME_CTRL_PAGE_SIZE -1 ); +/* * Limit the max command size to prevent iod->sg allocations going * over a single page.
@@ -2744,7 +2746,6 @@ static void nvme_reset_work(struct work_* Don't limit the IOMMU merged segment size. */ dma_set_max_seg_size (dev->dev,0xffffffff ); -dma_set_min_align_mask (dev->dev,NVME_CTRL_PAGE_SIZE -1 );mutex_unlock (&dev->shutdown_lock);
Greg Kroah-Hartman
maintainerPATCH 50/530 Revert "drm/amdgpu: use dirty framebuffer helper"
In reply to Greg Kroah-HartmanFrom: Hamza Mahfooz <[email protected]>
commit 17d819e2828cacca2e4c909044eb9798ed379cd2 upstream.
This reverts commit 66f99628eb24409cb8feb5061f78283c8b65f820.
Unfortunately, that commit causes performance regressions on non-PSR setups. So, just revert it until FB_DAMAGE_CLIPS support can be added.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_display.c +2 -12
@@ -35,8 +35,6 @@#include <linux/pci.h> #include <linux/pm_runtime.h> #include <drm/drm_crtc_helper.h> -#include <drm/drm_damage_helper.h> -#include <drm/drm_drv.h> #include <drm/drm_edid.h> #include <drm/drm_gem_framebuffer_helper.h> #include <drm/drm_fb_helper.h>
@@ -494,12 +492,6 @@ static const struct drm_framebuffer_func .create_handle = drm_gem_fb_create_handle, }; -static const struct drm_framebuffer_funcs amdgpu_fb_funcs_atomic = { - .destroy = drm_gem_fb_destroy, - .create_handle = drm_gem_fb_create_handle, - .dirty = drm_atomic_helper_dirtyfb, -}; -uint32_t amdgpu_display_supported_domains (struct amdgpu_device *adev,uint64_t bo_flags) {
@@ -1117,10 +1109,8 @@ int amdgpu_display_gem_fb_verify_and_iniif (ret) goto err; -if (drm_drv_uses_atomic_modeset (dev)) - ret =drm_framebuffer_init (dev, &rfb->base, &amdgpu_fb_funcs_atomic); -else - ret =drm_framebuffer_init (dev, &rfb->base, &amdgpu_fb_funcs); + ret =drm_framebuffer_init (dev, &rfb->base, &amdgpu_fb_funcs); +if (ret) goto err;
Greg Kroah-Hartman
maintainerPATCH 51/530 dmaengine: mxs: use platform_driver_register
In reply to Greg Kroah-HartmanFrom: Dario Binacchi <[email protected]>
commit 26696d4657167112a1079f86cba1739765c1360e upstream.
Driver registration fails on SOC imx8mn as its supplier, the clock control module, is probed later than subsys initcall level. This driver uses platform_driver_probe which is not compatible with deferred probing and won't be probed again later if probe function fails due to clock not being available at that time.
This patch replaces the use of platform_driver_probe with platform_driver_register which will allow probing the driver later again when the clock control module will be available.
The __init annotation has been dropped because it is not compatible with deferred probing. The code is not executed once and its memory cannot be freed.
--- drivers/dma/mxs-dma.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-)
drivers/dma/mxs-dma.c +4 -7
@@ -670,7 +670,7 @@ static enum dma_status mxs_dma_tx_statusreturn mxs_chan->status; } -static int __init mxs_dma_init (struct mxs_dma_engine *mxs_dma) +static int mxs_dma_init (struct mxs_dma_engine *mxs_dma) {int ret;
@@ -741,7 +741,7 @@ static struct dma_chan *mxs_dma_xlate(st ofdma->of_node); } -static int __init mxs_dma_probe (struct platform_device *pdev) +static int mxs_dma_probe (struct platform_device *pdev) {struct device_node *np = pdev->dev.of_node;const struct mxs_dma_type *dma_type;
@@ -839,10 +839,7 @@ static struct platform_driver mxs_dma_dr .name = "mxs-dma", .of_match_table = mxs_dma_dt_ids, }, + .probe = mxs_dma_probe, }; -static int __init mxs_dma_module_init (void ) -{ -return platform_driver_probe (&mxs_dma_driver, mxs_dma_probe); -} -subsys_initcall (mxs_dma_module_init); +builtin_platform_driver (mxs_dma_driver);
Greg Kroah-Hartman
maintainerPATCH 52/530 drm/virtio: Check whether transferred 2D BO is shmem
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
commit e473216b42aa1fd9fc6b94b608b42c210c655908 upstream.
Transferred 2D BO always must be a shmem BO. Add check for that to prevent NULL dereference if userspace passes a VRAM BO.
--- drivers/gpu/drm/virtio/virtgpu_vq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/virtio/virtgpu_vq.c +1 -1
@@ -604,7 +604,7 @@ void virtio_gpu_cmd_transfer_to_host_2d(bool use_dma_api = !virtio_has_dma_quirk (vgdev->vdev);struct virtio_gpu_object_shmem *shmem =to_virtio_gpu_shmem (bo); -if (use_dma_api) +if (virtio_gpu_is_shmem (bo) && use_dma_api)dma_sync_sgtable_for_device (vgdev->vdev->dev.parent, shmem->pages,DMA_TO_DEVICE );
Greg Kroah-Hartman
maintainerPATCH 53/530 drm/virtio: Unlock reservations on virtio_gpu_object_shmem_init() error
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
commit fdf0ff4d12cbcd76b53f27c96ce51ddca400884a upstream.
Unlock reservations in the error code path of virtio_gpu_object_create() to silence debug warning splat produced by ww_mutex_destroy(&obj->lock) when GEM is released with the held lock.
--- drivers/gpu/drm/virtio/virtgpu_object.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/virtio/virtgpu_object.c +2 -0
@@ -247,6 +247,8 @@ int virtio_gpu_object_create(struct virt ret =virtio_gpu_object_shmem_init (vgdev, bo, &ents, &nents);if (ret !=0 ) { +if (fence) +virtio_gpu_array_unlock_resv (objs);virtio_gpu_array_put_free (objs);virtio_gpu_free_object (&shmem_obj->base);return ret;
Greg Kroah-Hartman
maintainerPATCH 54/530 drm/virtio: Use appropriate atomic state in virtio_gpu_plane_cleanup_fb()
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
commit 4656b3a26a9e9fe5f04bfd2ab55b066266ba7f4d upstream.
Make virtio_gpu_plane_cleanup_fb() to clean the state which DRM core wants to clean up and not the current plane's state. Normally the older atomic state is cleaned up, but the newer state could also be cleaned up in case of aborted commits.
--- drivers/gpu/drm/virtio/virtgpu_plane.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/virtio/virtgpu_plane.c +3 -3
@@ -265,14 +265,14 @@ static int virtio_gpu_plane_prepare_fb(s }static void virtio_gpu_plane_cleanup_fb (struct drm_plane *plane, -struct drm_plane_state *old_state) +struct drm_plane_state *state) {struct virtio_gpu_framebuffer *vgfb; -if (!plane->state->fb) +if (!state->fb)return ; - vgfb =to_virtio_gpu_framebuffer (plane->state->fb); + vgfb =to_virtio_gpu_framebuffer (state->fb);if (vgfb->fence) {dma_fence_put (&vgfb->fence->f); vgfb->fence =NULL ;
Greg Kroah-Hartman
maintainerPATCH 55/530 drm/udl: Restore display mode on resume
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 6d6e732835db92e66c28dbcf258a7e3d3c71420d upstream.
Restore the display mode whne resuming from suspend. Currently, the display remains dark.
On resume, the CRTC's mode does not change, but the 'active' flag changes to 'true'. Taking this into account when considering a mode switch restores the display mode.
The bug is reproducable by using Gnome with udl and observing the adapter's suspend/resume behavior.
Actually, the whole check added in udl_simple_display_pipe_enable() about the crtc_state->mode_changed was bogus. We should drop the whole check and always apply the mode change in this function.
[ tiwai -- Drop the mode_changed check entirely instead, per Daniel's
suggestion ]
--- drivers/gpu/drm/udl/udl_modeset.c | 3 --- 1 file changed, 3 deletions(-)
drivers/gpu/drm/udl/udl_modeset.c +0 -3
@@ -381,9 +381,6 @@ udl_simple_display_pipe_enable(struct drudl_handle_damage (fb, &shadow_plane_state->data[0 ],0 ,0 , fb->width, fb->height); -if (!crtc_state->mode_changed) -return ; -/* enable display */ udl_crtc_write_mode_to_hw (crtc); }
Greg Kroah-Hartman
maintainerPATCH 56/530 arm64: errata: Add Cortex-A55 to the repeat tlbi list
In reply to Greg Kroah-HartmanFrom: James Morse <[email protected]>
commit 171df58028bf4649460fb146a56a58dcb0c8f75a upstream.
Cortex-A55 is affected by an erratum where in rare circumstances the CPUs may not handle a race between a break-before-make sequence on one CPU, and another CPU accessing the same page. This could allow a store to a page that has been unmapped.
Work around this by adding the affected CPUs to the list that needs TLB sequences to be done twice.
--- Documentation/arm64/silicon-errata.rst | 2 ++ arch/arm64/Kconfig | 17 +++++++++++++++++ arch/arm64/kernel/cpu_errata.c | 5 +++++ 3 files changed, 24 insertions(+)
Documentation/arm64/silicon-errata.rst +2 -0
@@ -68,6 +68,8 @@ stable kernels. +----------------+-----------------+-----------------+-----------------------------+ | ARM | Cortex-A55 | #1530923 | ARM64_ERRATUM_1530923 | +----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-A55 | #2441007 | ARM64_ERRATUM_2441007 | ++----------------+-----------------+-----------------+-----------------------------+ | ARM | Cortex-A57 | #832075 | ARM64_ERRATUM_832075 | +----------------+-----------------+-----------------+-----------------------------+ | ARM | Cortex-A57 | #852523 | N/A |
arch/arm64/Kconfig +17 -0
@@ -596,6 +596,23 @@ config ARM64_ERRATUM_1530923 config ARM64_WORKAROUND_REPEAT_TLBI bool +config ARM64_ERRATUM_2441007 + bool "Cortex-A55: Completion of affected memory accesses might not be guaranteed by completion of a TLBI" + default y + select ARM64_WORKAROUND_REPEAT_TLBI + help + This option adds a workaround for ARM Cortex-A55 erratum #2441007. + + Under very rare circumstances, affected Cortex-A55 CPUs + may not handle a race between a break-before-make sequence on one + CPU, and another CPU accessing the same page. This could allow a + store to a page that has been unmapped. + + Work around this by adding the affected CPUs to the list that needs + TLB sequences to be done twice. + + If unsure, say Y. + config ARM64_ERRATUM_1286807 bool "Cortex-A76: Modification of the translation table for a virtual address might lead to read-after-read ordering violation" default y
arch/arm64/kernel/cpu_errata.c +5 -0
@@ -214,6 +214,11 @@ static const struct arm64_cpu_capabiliti ERRATA_MIDR_RANGE(MIDR_QCOM_KRYO_4XX_GOLD, 0xc, 0xe, 0xf, 0xe), },#endif +#ifdef CONFIG_ARM64_ERRATUM_2441007 + { + ERRATA_MIDR_ALL_VERSIONS(MIDR_CORTEX_A55), + }, +#endif #ifdef CONFIG_ARM64_ERRATUM_2441009 {/* Cortex-A510 r0p0 -> r1p1. Fixed in r1p2 */
Greg Kroah-Hartman
maintainerPATCH 57/530 mm/damon: validate if the pmd entry is present before accessing
In reply to Greg Kroah-HartmanFrom: Baolin Wang <[email protected]>
commit c8b9aff419303e4d4219b5ff64b1c7e062dee48e upstream.
pmd_huge() is used to validate if the pmd entry is mapped by a huge page, also including the case of non-present (migration or hwpoisoned) pmd entry on arm64 or x86 architectures. This means that pmd_pfn() can not get the correct pfn number for a non-present pmd entry, which will cause damon_get_page() to get an incorrect page struct (also may be NULL by pfn_to_online_page()), making the access statistics incorrect.
This means that the DAMON may make incorrect decision according to the incorrect statistics, for example, DAMON may can not reclaim cold page in time due to this cold page was regarded as accessed mistakenly if DAMOS_PAGEOUT operation is specified.
Moreover it does not make sense that we still waste time to get the page of the non-present entry. Just treat it as not-accessed and skip it, which maintains consistency with non-present pte level entries.
So add pmd entry present validation to fix the above issues.
--- mm/damon/vaddr.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
mm/damon/vaddr.c +10 -0
@@ -456,6 +456,11 @@ static int damon_mkold_pmd_entry(pmd_t *if (pmd_huge (*pmd)) { ptl =pmd_lock (walk->mm, pmd); +if (!pmd_present (*pmd)) { +spin_unlock (ptl); +return 0 ; + } +if (pmd_huge (*pmd)) {damon_pmdp_mkold (pmd, walk->mm, addr);spin_unlock (ptl);
@@ -530,6 +535,11 @@ static int damon_young_pmd_entry(pmd_t *#ifdef CONFIG_TRANSPARENT_HUGEPAGE if (pmd_huge (*pmd)) { ptl =pmd_lock (walk->mm, pmd); +if (!pmd_present (*pmd)) { +spin_unlock (ptl); +return 0 ; + } +if (!pmd_huge (*pmd)) {spin_unlock (ptl); goto regular_page;
Greg Kroah-Hartman
maintainerPATCH 58/530 mm/mmap: undo ->mmap() when arch_validate_flags() fails
In reply to Greg Kroah-HartmanFrom: Carlos Llamas <[email protected]>
commit deb0f6562884b5b4beb883d73e66a7d3a1b96d99 upstream.
Commit c462ac288f2c ("mm: Introduce arch_validate_flags()") added a late check in mmap_region() to let architectures validate vm_flags. The check needs to happen after calling ->mmap() as the flags can potentially be modified during this callback.
If arch_validate_flags() check fails we unmap and free the vma. However, the error path fails to undo the ->mmap() call that previously succeeded and depending on the specific ->mmap() implementation this translates to reference increments, memory allocations and other operations what will not be cleaned up.
There are several places (mainly device drivers) where this is an issue. However, one specific example is bpf_map_mmap() which keeps count of the mappings in map->writecnt. The count is incremented on ->mmap() and then decremented on vm_ops->close(). When arch_validate_flags() fails this count is off since bpf_map_mmap_close() is never called.
One can reproduce this issue in arm64 devices with MTE support. Here the vm_flags are checked to only allow VM_MTE if VM_MTE_ALLOWED has been set previously. From userspace then is enough to pass the PROT_MTE flag to mmap() syscall to trigger the arch_validate_flags() failure.
The following program reproduces this issue:
#include <stdio.h> #include <unistd.h> #include <linux/unistd.h> #include <linux/bpf.h> #include <sys/mman.h>
int main(void)
{
union bpf_attr attr = {
.map_type = BPF_MAP_TYPE_ARRAY,
.key_size = sizeof(int),
.value_size = sizeof(long long),
.max_entries = 256,
.map_flags = BPF_F_MMAPABLE,
};
int fd;
fd = syscall(__NR_bpf, BPF_MAP_CREATE, &attr, sizeof(attr));
mmap(NULL, 4096, PROT_WRITE | PROT_MTE, MAP_SHARED, fd, 0);
return 0;}
By manually adding some log statements to the vm_ops callbacks we can confirm that when passing PROT_MTE to mmap() the map->writecnt is off upon ->release():
With PROT_MTE flag:
root@debian:~# ./bpf-test [ 111.263874] bpf_map_write_active_inc: map=9 writecnt=1 [ 111.288763] bpf_map_release: map=9 writecnt=1
Without PROT_MTE flag:
root@debian:~# ./bpf-test [ 157.816912] bpf_map_write_active_inc: map=10 writecnt=1 [ 157.830442] bpf_map_write_active_dec: map=10 writecnt=0 [ 157.832396] bpf_map_release: map=10 writecnt=0
This patch fixes the above issue by calling vm_ops->close() when the arch_validate_flags() check fails, after this we can proceed to unmap and free the vma on the error path.
--- mm/mmap.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
mm/mmap.c +4 -1
@@ -1836,7 +1836,7 @@ unsigned long mmap_region(struct file *fif (!arch_validate_flags (vma->vm_flags)) { error = -EINVAL ;if (file) - goto unmap_and_free_vma; + goto close_and_free_vma;else goto free_vma; }
@@ -1876,6 +1876,9 @@ out:return addr; +close_and_free_vma: +if (vma->vm_ops && vma->vm_ops->close) + vma->vm_ops->close (vma); unmap_and_free_vma:fput (vma->vm_file); vma->vm_file =NULL ;
Greg Kroah-Hartman
maintainerPATCH 59/530 xen/gntdev: Prevent leaking grants
In reply to Greg Kroah-HartmanFrom: M. Vefa Bicakci <[email protected]>
commit 0991028cd49567d7016d1b224fe0117c35059f86 upstream.
Prior to this commit, if a grant mapping operation failed partially, some of the entries in the map_ops array would be invalid, whereas all of the entries in the kmap_ops array would be valid. This in turn would cause the following logic in gntdev_map_grant_pages to become invalid:
for (i = 0; i < map->count; i++) {
if (map->map_ops[i].status == GNTST_okay) {
map->unmap_ops[i].handle = map->map_ops[i].handle;
if (!use_ptemod)
alloced++;
}
if (use_ptemod) {
if (map->kmap_ops[i].status == GNTST_okay) {
if (map->map_ops[i].status == GNTST_okay)
alloced++;
map->kunmap_ops[i].handle = map->kmap_ops[i].handle;
}
}
}
...
atomic_add(alloced, &map->live_grants);Assume that use_ptemod is true (i.e., the domain mapping the granted pages is a paravirtualized domain). In the code excerpt above, note that the "alloced" variable is only incremented when both kmap_ops[i].status and map_ops[i].status are set to GNTST_okay (i.e., both mapping operations are successful). However, as also noted above, there are cases where a grant mapping operation fails partially, breaking the assumption of the code excerpt above.
The aforementioned causes map->live_grants to be incorrectly set. In some cases, all of the map_ops mappings fail, but all of the kmap_ops mappings succeed, meaning that live_grants may remain zero. This in turn makes it impossible to unmap the successfully grant-mapped pages pointed to by kmap_ops, because unmap_grant_pages has the following snippet of code at its beginning:
if (atomic_read(&map->live_grants) == 0)
return; /* Nothing to do */
In other cases where only some of the map_ops mappings fail but all kmap_ops mappings succeed, live_grants is made positive, but when the user requests unmapping the grant-mapped pages, __unmap_grant_pages_done will then make map->live_grants negative, because the latter function does not check if all of the pages that were requested to be unmapped were actually unmapped, and the same function unconditionally subtracts "data->count" (i.e., a value that can be greater than map->live_grants) from map->live_grants. The side effects of a negative live_grants value have not been studied.
The net effect of all of this is that grant references are leaked in one of the above conditions. In Qubes OS v4.1 (which uses Xen's grant mechanism extensively for X11 GUI isolation), this issue manifests itself with warning messages like the following to be printed out by the Linux kernel in the VM that had granted pages (that contain X11 GUI window data) to dom0: "g.e. 0x1234 still pending", especially after the user rapidly resizes GUI VM windows (causing some grant-mapping operations to partially or completely fail, due to the fact that the VM unshares some of the pages as part of the window resizing, making the pages impossible to grant-map from dom0).
The fix for this issue involves counting all successful map_ops and kmap_ops mappings separately, and then adding the sum to live_grants. During unmapping, only the number of successfully unmapped grants is subtracted from live_grants. The code is also modified to check for negative live_grants values after the subtraction and warn the user.
--- drivers/xen/gntdev.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-)
drivers/xen/gntdev.c +17 -5
@@ -367,8 +367,7 @@ int gntdev_map_grant_pages(struct gntdevfor (i =0 ; i < map->count; i++) {if (map->map_ops[i].status == GNTST_okay) { map->unmap_ops[i].handle = map->map_ops[i].handle; -if (!use_ptemod) - alloced++; + alloced++; }else if (!err) err = -EINVAL ;
@@ -377,8 +376,7 @@ int gntdev_map_grant_pages(struct gntdevif (use_ptemod) {if (map->kmap_ops[i].status == GNTST_okay) { -if (map->map_ops[i].status == GNTST_okay) - alloced++; + alloced++; map->kunmap_ops[i].handle = map->kmap_ops[i].handle; }else if (!err) err = -EINVAL ;
@@ -394,8 +392,14 @@ static void __unmap_grant_pages_done(intunsigned int i;struct gntdev_grant_map *map = data->data;unsigned int offset = data->unmap_ops - map->unmap_ops; +int successful_unmaps =0 ; +int live_grants;for (i =0 ; i < data->count; i++) { +if (map->unmap_ops[offset + i].status == GNTST_okay && + map->unmap_ops[offset + i].handle !=INVALID_GRANT_HANDLE ) + successful_unmaps++; +WARN_ON (map->unmap_ops[offset + i].status != GNTST_okay && map->unmap_ops[offset + i].handle !=INVALID_GRANT_HANDLE ); pr_debug("unmap handle=%d st=%d\n",
@@ -403,6 +407,10 @@ static void __unmap_grant_pages_done(int map->unmap_ops[offset+i].status); map->unmap_ops[offset+i].handle =INVALID_GRANT_HANDLE ;if (use_ptemod) { +if (map->kunmap_ops[offset + i].status == GNTST_okay && + map->kunmap_ops[offset + i].handle !=INVALID_GRANT_HANDLE ) + successful_unmaps++; +WARN_ON (map->kunmap_ops[offset + i].status != GNTST_okay && map->kunmap_ops[offset + i].handle !=INVALID_GRANT_HANDLE ); pr_debug("kunmap handle=%u st=%d\n",
@@ -411,11 +419,15 @@ static void __unmap_grant_pages_done(int map->kunmap_ops[offset+i].handle =INVALID_GRANT_HANDLE ; } } +/* * Decrease the live-grant counter. This must happen after the loop to * prevent premature reuse of the grants by gnttab_mmap(). */ -atomic_sub (data->count, &map->live_grants); + live_grants =atomic_sub_return (successful_unmaps, &map->live_grants); +if (WARN_ON (live_grants <0 )) +pr_err ("%s: live_grants became negative (%d) after unmapping %d pages!\n" , + __func__, live_grants, successful_unmaps);/* Release reference taken by __unmap_grant_pages */ gntdev_put_map (NULL , map);
Greg Kroah-Hartman
maintainerPATCH 60/530 xen/gntdev: Accommodate VMA splitting
In reply to Greg Kroah-HartmanFrom: M. Vefa Bicakci <[email protected]>
commit 5c13a4a0291b30191eff9ead8d010e1ca43a4d0c upstream.
Prior to this commit, the gntdev driver code did not handle the following scenario correctly with paravirtualized (PV) Xen domains:
* User process sets up a gntdev mapping composed of two grant mappings (i.e., two pages shared by another Xen domain).
* User process munmap()s one of the pages.
* User process munmap()s the remaining page.
* User process exits.
In the scenario above, the user process would cause the kernel to log the following messages in dmesg for the first munmap(), and the second munmap() call would result in similar log messages:
BUG: Bad page map in process doublemap.test pte:... pmd:...
page:0000000057c97bff refcount:1 mapcount:-1 \
mapping:0000000000000000 index:0x0 pfn:...
...
page dumped because: bad pte
...
file:gntdev fault:0x0 mmap:gntdev_mmap [xen_gntdev] readpage:0x0
...
Call Trace:
<TASK>
dump_stack_lvl+0x46/0x5e
print_bad_pte.cold+0x66/0xb6
unmap_page_range+0x7e5/0xdc0
unmap_vmas+0x78/0xf0
unmap_region+0xa8/0x110
__do_munmap+0x1ea/0x4e0
__vm_munmap+0x75/0x120
__x64_sys_munmap+0x28/0x40
do_syscall_64+0x38/0x90
entry_SYSCALL_64_after_hwframe+0x61/0xcb
...For each munmap() call, the Xen hypervisor (if built with CONFIG_DEBUG) would print out the following and trigger a general protection fault in the affected Xen PV domain:
(XEN) d0v... Attempt to implicitly unmap d0's grant PTE ... (XEN) d0v... Attempt to implicitly unmap d0's grant PTE ...
As of this writing, gntdev_grant_map structure's vma field (referred to as map->vma below) is mainly used for checking the start and end addresses of mappings. However, with split VMAs, these may change, and there could be more than one VMA associated with a gntdev mapping. Hence, remove the use of map->vma and rely on map->pages_vm_start for the original start address and on (map->count << PAGE_SHIFT) for the original mapping size. Let the invalidate() and find_special_page() hooks use these.
Also, given that there can be multiple VMAs associated with a gntdev mapping, move the "mmu_interval_notifier_remove(&map->notifier)" call to the end of gntdev_put_map, so that the MMU notifier is only removed after the closing of the last remaining VMA.
Finally, use an atomic to prevent inadvertent gntdev mapping re-use, instead of using the map->live_grants atomic counter and/or the map->vma pointer (the latter of which is now removed). This prevents the userspace from mmap()'ing (with MAP_FIXED) a gntdev mapping over the same address range as a previously set up gntdev mapping. This scenario can be summarized with the following call-trace, which was valid prior to this commit:
mmap
gntdev_mmap
mmap (repeat mmap with MAP_FIXED over the same address range)
gntdev_invalidate
unmap_grant_pages (sets 'being_removed' entries to true)
gnttab_unmap_refs_async
unmap_single_vma
gntdev_mmap (maps the shared pages again)
munmap
gntdev_invalidate
unmap_grant_pages
(no-op because 'being_removed' entries are true)
unmap_single_vma (For PV domains, Xen reports that a granted page
is being unmapped and triggers a general protection fault in the affected domain, if Xen was built with CONFIG_DEBUG)
The fix for this last scenario could be worth its own commit, but we opted for a single commit, because removing the gntdev_grant_map structure's vma field requires guarding the entry to gntdev_mmap(), and the live_grants atomic counter is not sufficient on its own to prevent the mmap() over a pre-existing mapping.
--- drivers/xen/gntdev-common.h | 3 +- drivers/xen/gntdev.c | 58 ++++++++++++++++++-------------------------- 2 files changed, 27 insertions(+), 34 deletions(-)
drivers/xen/gntdev-common.h +2 -1
@@ -44,9 +44,10 @@ struct gntdev_unmap_notify { };struct gntdev_grant_map { +atomic_t in_use;struct mmu_interval_notifier notifier; +bool notifier_init;struct list_head next; -struct vm_area_struct *vma;int index;int count;int flags;
drivers/xen/gntdev.c +25 -33
131 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 61/530 PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge
In reply to Greg Kroah-HartmanFrom: Maciej W. Rozycki <[email protected]>
commit 0e32818397426a688f598f35d3bc762eca6d7592 upstream.
When pci_assign_resource() is unable to assign resources to a BAR, it uses pci_revert_fw_address() to fall back to a firmware assignment (if any). Previously pci_revert_fw_address() assumed all addresses could reach the device, but this is not true if the device is below a bridge that only forwards addresses within its windows.
This problem was observed on a Tyan Tomcat IV S1564D system where the BIOS did not assign valid addresses to several bridges and USB devices:
pci 0000:00:11.0: PCI-to-PCIe bridge to [bus 01-ff]
pci 0000:00:11.0: bridge window [io 0xe000-0xefff]
pci 0000:01:00.0: PCIe Upstream Port to [bus 02-ff]
pci 0000:01:00.0: bridge window [io 0x0000-0x0fff] # unreachable
pci 0000:02:02.0: PCIe Downstream Port to [bus 05-ff]
pci 0000:02:02.0: bridge window [io 0x0000-0x0fff] # unreachable
pci 0000:05:00.0: PCIe-to-PCI bridge to [bus 06-ff]
pci 0000:05:00.0: bridge window [io 0x0000-0x0fff] # unreachable
pci 0000:06:08.0: USB UHCI 1.1
pci 0000:06:08.0: BAR 4: [io 0xfce0-0xfcff] # unreachable
pci 0000:06:08.1: USB UHCI 1.1
pci 0000:06:08.1: BAR 4: [io 0xfce0-0xfcff] # unreachable
pci 0000:06:08.0: can't claim BAR 4 [io 0xfce0-0xfcff]: no compatible bridge window pci 0000:06:08.1: can't claim BAR 4 [io 0xfce0-0xfcff]: no compatible bridge window
During the first pass of assigning unassigned resources, there was not enough I/O space available, so we couldn't assign the 06:08.0 BAR and reverted to the firmware assignment (still unreachable). Reverting the 06:08.1 assignment failed because it conflicted with 06:08.0:
pci 0000:00:11.0: bridge window [io 0xe000-0xefff]
pci 0000:01:00.0: no space for bridge window [io size 0x2000] pci 0000:02:02.0: no space for bridge window [io size 0x1000] pci 0000:05:00.0: no space for bridge window [io size 0x1000]
pci 0000:06:08.0: BAR 4: no space for [io size 0x0020]
pci 0000:06:08.0: BAR 4: trying firmware assignment [io 0xfce0-0xfcff]
pci 0000:06:08.1: BAR 4: no space for [io size 0x0020]
pci 0000:06:08.1: BAR 4: trying firmware assignment [io 0xfce0-0xfcff]
pci 0000:06:08.1: BAR 4: [io 0xfce0-0xfcff] conflicts with 0000:06:08.0 [io 0xfce0-0xfcff]
A subsequent pass assigned valid bridge windows and a valid 06:08.1 BAR, but left the 06:08.0 BAR alone, so the UHCI device was still unusable:
pci 0000:00:11.0: bridge window [io 0xe000-0xefff] released pci 0000:00:11.0: bridge window [io 0x1000-0x2fff] # reassigned pci 0000:01:00.0: bridge window [io 0x1000-0x2fff] # reassigned pci 0000:02:02.0: bridge window [io 0x2000-0x2fff] # reassigned pci 0000:05:00.0: bridge window [io 0x2000-0x2fff] # reassigned pci 0000:06:08.0: BAR 4: assigned [io 0xfce0-0xfcff] # left alone pci 0000:06:08.1: BAR 4: assigned [io 0x2000-0x201f]
...
uhci_hcd 0000:06:08.0: host system error, PCI problems?
uhci_hcd 0000:06:08.0: host controller process error, something bad happened! uhci_hcd 0000:06:08.0: host controller halted, very bad! uhci_hcd 0000:06:08.0: HCRESET not completed yet!
uhci_hcd 0000:06:08.0: HC died; cleaning up
If the address assigned by firmware is not reachable because it's not within upstream bridge windows, fail instead of assigning the unusable address from firmware.
--- drivers/pci/setup-res.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/pci/setup-res.c +11 -0
@@ -210,6 +210,17 @@ static int pci_revert_fw_address(struct root =pci_find_parent_resource (dev, res);if (!root) { +/* +* If dev is behind a bridge, accesses will only reach it +* if res is inside the relevant bridge window. +*/ +if (pci_upstream_bridge (dev)) +return -ENXIO ; + +/* +* On the root bus, assume the host bridge will forward +* everything. +*/ if (res->flags &IORESOURCE_IO ) root = &ioport_resource;else
Greg Kroah-Hartman
maintainerPATCH 62/530 serial: 8250: Let drivers request full 16550A feature probing
In reply to Greg Kroah-HartmanFrom: Maciej W. Rozycki <[email protected]>
commit 9906890c89e4dbd900ed87ad3040080339a7f411 upstream.
A SERIAL_8250_16550A_VARIANTS configuration option has been recently defined that lets one request the 8250 driver not to probe for 16550A device features so as to reduce the driver's device startup time in virtual machines.
Some actual hardware devices require these features to have been fully determined however for their driver to work correctly, so define a flag to let drivers request full 16550A feature probing on a device-by-device basis if required regardless of the SERIAL_8250_16550A_VARIANTS option setting chosen.
--- drivers/tty/serial/8250/8250_port.c | 3 ++- include/linux/serial_core.h | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-)
drivers/tty/serial/8250/8250_port.c +2 -1
@@ -1029,7 +1029,8 @@ static void autoconfig_16550a(struct uar up->port.type =PORT_16550A ; up->capabilities |=UART_CAP_FIFO ; -if (!IS_ENABLED (CONFIG_SERIAL_8250_16550A_VARIANTS )) +if (!IS_ENABLED (CONFIG_SERIAL_8250_16550A_VARIANTS ) && + !(up->port.flags &UPF_FULL_PROBE ))return ;/*
include/linux/serial_core.h +2 -1
@@ -100,7 +100,7 @@ struct uart_icount {__u32 buf_overrun; }; -typedef unsigned int __bitwise upf_t ; +typedef u64 __bitwise upf_t ;typedef unsigned int __bitwise upstat_t ;struct uart_port {
@@ -207,6 +207,7 @@ struct uart_port {#define UPF_FIXED_PORT ((__force upf_t) (1 << 29))#define UPF_DEAD ((__force upf_t) (1 << 30))#define UPF_IOREMAP ((__force upf_t) (1 << 31)) +#define UPF_FULL_PROBE ((__force upf_t) (1ULL << 32))#define __UPF_CHANGE_MASK 0x17fff#define UPF_CHANGE_MASK ((__force upf_t) __UPF_CHANGE_MASK)
Greg Kroah-Hartman
maintainerPATCH 63/530 serial: 8250: Request full 16550A feature probing for OxSemi PCIe devices
In reply to Greg Kroah-HartmanFrom: Maciej W. Rozycki <[email protected]>
commit 00b7a4d4ee42be1c515e56cb1e8ba0f25e271d8e upstream.
Oxford Semiconductor PCIe (Tornado) 950 serial port devices need to operate in the enhanced mode via the EFR register for the Divide-by-M N/8 baud rate generator prescaler to be used in their native UART mode. Otherwise the prescaler is fixed at 1 causing grossly incorrect baud rates to be programmed.
Accessing the EFR register requires 16550A features to have been probed for, so request this to happen regardless of SERIAL_8250_16550A_VARIANTS by setting UPF_FULL_PROBE in port flags.
--- drivers/tty/serial/8250/8250_pci.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/tty/serial/8250/8250_pci.c +5 -0
@@ -1232,6 +1232,10 @@ static void pci_oxsemi_tornado_set_mctrlserial8250_do_set_mctrl (port, mctrl); } +/* +* We require EFR features for clock programming, so set UPF_FULL_PROBE +* for full probing regardless of CONFIG_SERIAL_8250_16550A_VARIANTS setting. +*/ static int pci_oxsemi_tornado_setup (struct serial_private *priv,const struct pciserial_board *board,struct uart_8250_port *up,int idx)
@@ -1239,6 +1243,7 @@ static int pci_oxsemi_tornado_setup(strustruct pci_dev *dev = priv->dev;if (pci_oxsemi_tornado_p (dev)) { + up->port.flags |=UPF_FULL_PROBE ; up->port.get_divisor = pci_oxsemi_tornado_get_divisor; up->port.set_divisor = pci_oxsemi_tornado_set_divisor; up->port.set_mctrl = pci_oxsemi_tornado_set_mctrl;
Greg Kroah-Hartman
maintainerPATCH 64/530 NFSD: Protect against send buffer overflow in NFSv3 READDIR
In reply to Greg Kroah-HartmanFrom: Chuck Lever <[email protected]>
commit 640f87c190e0d1b2a0fcb2ecf6d2cd53b1c41991 upstream.
Since before the git era, NFSD has conserved the number of pages held by each nfsd thread by combining the RPC receive and send buffers into a single array of pages. This works because there are no cases where an operation needs a large RPC Call message and a large RPC Reply message at the same time.
Once an RPC Call has been received, svc_process() updates svc_rqst::rq_res to describe the part of rq_pages that can be used for constructing the Reply. This means that the send buffer (rq_res) shrinks when the received RPC record containing the RPC Call is large.
A client can force this shrinkage on TCP by sending a correctly- formed RPC Call header contained in an RPC record that is excessively large. The full maximum payload size cannot be constructed in that case.
Thanks to Aleksi Illikainen and Kari Hulkko for uncovering this issue.
--- fs/nfsd/nfs3proc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
fs/nfsd/nfs3proc.c +4 -3
@@ -447,13 +447,14 @@ static void nfsd3_init_dirlist_pages(str {struct xdr_buf *buf = &resp->dirlist;struct xdr_stream *xdr = &resp->xdr; - - count =clamp (count, (u32)(XDR_UNIT *2 ),svc_max_payload (rqstp)); + unsigned int sendbuf = min_t(unsigned int, rqstp->rq_res.buflen, +svc_max_payload (rqstp));memset (buf,0 ,sizeof (*buf));/* Reserve room for the NULL ptr & eof flag (-2 words) */ - buf->buflen = count -XDR_UNIT *2 ; + buf->buflen =clamp (count, (u32)(XDR_UNIT *2 ), sendbuf); + buf->buflen -=XDR_UNIT *2 ; buf->pages = rqstp->rq_next_page; rqstp->rq_next_page += (buf->buflen +PAGE_SIZE -1 ) >>PAGE_SHIFT ;
Greg Kroah-Hartman
maintainerPATCH 65/530 NFSD: Protect against send buffer overflow in NFSv2 READ
In reply to Greg Kroah-HartmanFrom: Chuck Lever <[email protected]>
commit 401bc1f90874280a80b93f23be33a0e7e2d1f912 upstream.
Since before the git era, NFSD has conserved the number of pages held by each nfsd thread by combining the RPC receive and send buffers into a single array of pages. This works because there are no cases where an operation needs a large RPC Call message and a large RPC Reply at the same time.
Once an RPC Call has been received, svc_process() updates svc_rqst::rq_res to describe the part of rq_pages that can be used for constructing the Reply. This means that the send buffer (rq_res) shrinks when the received RPC record containing the RPC Call is large.
A client can force this shrinkage on TCP by sending a correctly- formed RPC Call header contained in an RPC record that is excessively large. The full maximum payload size cannot be constructed in that case.
--- fs/nfsd/nfsproc.c | 1 + 1 file changed, 1 insertion(+)
fs/nfsd/nfsproc.c +1 -0
@@ -182,6 +182,7 @@ nfsd_proc_read(struct svc_rqst *rqstp) argp->count, argp->offset); argp->count =min_t (u32, argp->count,NFSSVC_MAXBLKSIZE_V2 ); + argp->count =min_t (u32, argp->count, rqstp->rq_res.buflen); v =0 ; len = argp->count;
Greg Kroah-Hartman
maintainerPATCH 66/530 NFSD: Protect against send buffer overflow in NFSv3 READ
In reply to Greg Kroah-HartmanFrom: Chuck Lever <[email protected]>
commit fa6be9cc6e80ec79892ddf08a8c10cabab9baf38 upstream.
Since before the git era, NFSD has conserved the number of pages held by each nfsd thread by combining the RPC receive and send buffers into a single array of pages. This works because there are no cases where an operation needs a large RPC Call message and a large RPC Reply at the same time.
Once an RPC Call has been received, svc_process() updates svc_rqst::rq_res to describe the part of rq_pages that can be used for constructing the Reply. This means that the send buffer (rq_res) shrinks when the received RPC record containing the RPC Call is large.
A client can force this shrinkage on TCP by sending a correctly- formed RPC Call header contained in an RPC record that is excessively large. The full maximum payload size cannot be constructed in that case.
--- fs/nfsd/nfs3proc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/nfsd/nfs3proc.c +2 -2
@@ -146,7 +146,6 @@ nfsd3_proc_read(struct svc_rqst *rqstp) {struct nfsd3_readargs *argp = rqstp->rq_argp;struct nfsd3_readres *resp = rqstp->rq_resp; -u32 max_blocksize =svc_max_payload (rqstp);unsigned int len;int v;
@@ -155,7 +154,8 @@ nfsd3_proc_read(struct svc_rqst *rqstp) (unsigned long ) argp->count, (unsigned long long) argp->offset); - argp->count =min_t (u32, argp->count, max_blocksize); + argp->count =min_t (u32, argp->count,svc_max_payload (rqstp)); + argp->count =min_t (u32, argp->count, rqstp->rq_res.buflen);if (argp->offset > (u64 )OFFSET_MAX ) argp->offset = (u64 )OFFSET_MAX ;if (argp->offset + argp->count > (u64 )OFFSET_MAX )
Greg Kroah-Hartman
maintainerPATCH 67/530 powercap: intel_rapl: Use standard Energy Unit for SPR Dram RAPL domain
In reply to Greg Kroah-HartmanFrom: Zhang Rui <[email protected]>
commit 4c081324df5608b73428662ca54d5221ea03a6bd upstream.
Intel Xeon servers used to use a fixed energy resolution (15.3uj) for Dram RAPL domain. But on SPR, Dram RAPL domain follows the standard energy resolution as described in MSR_RAPL_POWER_UNIT.
Remove the SPR dram_domain_energy_unit quirk.
--- drivers/powercap/intel_rapl_common.c | 1 - 1 file changed, 1 deletion(-)
drivers/powercap/intel_rapl_common.c +0 -1
@@ -979,7 +979,6 @@ static const struct rapl_defaults rapl_d .check_unit = rapl_check_unit_core, .set_floor_freq = set_floor_freq_default, .compute_time_window = rapl_compute_time_window_core, - .dram_domain_energy_unit = 15300, .psys_domain_energy_unit = 1000000000, };
Greg Kroah-Hartman
maintainerPATCH 68/530 powerpc/boot: Explicitly disable usage of SPE instructions
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
commit 110a58b9f91c66f743c01a2c217243d94c899c23 upstream.
uImage boot wrapper should not use SPE instructions, like kernel itself. Boot wrapper has already disabled Altivec and VSX instructions but not SPE. Options -mno-spe and -mspe=no already set when compilation of kernel, but not when compiling uImage wrapper yet. Fix it.
--- arch/powerpc/boot/Makefile | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/boot/Makefile +1 -0
@@ -34,6 +34,7 @@ endif BOOTCFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \ -fno-strict-aliasing -O2 -msoft-float -mno-altivec -mno-vsx \ + $(call cc-option,-mno-spe) $(call cc-option,-mspe=no) \ -pipe -fomit-frame-pointer -fno-builtin -fPIC -nostdinc \ $(LINUXINCLUDE)
Greg Kroah-Hartman
maintainerPATCH 69/530 slimbus: qcom-ngd: use correct error in message of pdr_add_lookup() failure
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
commit 5038d21dde818fe74ba1fcb6f2cee35b8c2ebbf2 upstream.
Use correct error code, instead of previous 'ret' value, when printing error from pdr_add_lookup() failure.
--- drivers/slimbus/qcom-ngd-ctrl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/slimbus/qcom-ngd-ctrl.c +2 -1
@@ -1572,8 +1572,9 @@ static int qcom_slim_ngd_ctrl_probe(stru pds =pdr_add_lookup (ctrl->pdr,"avs/audio" ,"msm/adsp/audio_pd" );if (IS_ERR (pds) &&PTR_ERR (pds) != -EALREADY ) { + ret =PTR_ERR (pds);dev_err (dev,"pdr add lookup failed: %d\n" , ret); -return PTR_ERR (pds); +return ret; }platform_driver_register (&qcom_slim_ngd_driver);
Greg Kroah-Hartman
maintainerPATCH 70/530 slimbus: qcom-ngd: cleanup in probe error path
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
commit 16f14551d0df9e7cd283545d7d748829594d912f upstream.
Add proper error path in probe() to cleanup resources previously acquired/allocated to fix warnings visible during probe deferral:
notifier callback qcom_slim_ngd_ssr_notify already registered
WARNING: CPU: 6 PID: 70 at kernel/notifier.c:28 notifier_chain_register+0x5c/0x90 Modules linked in: CPU: 6 PID: 70 Comm: kworker/u16:1 Not tainted 6.0.0-rc3-next-20220830 #380 Call trace: notifier_chain_register+0x5c/0x90 srcu_notifier_chain_register+0x44/0x90 qcom_register_ssr_notifier+0x38/0x4c qcom_slim_ngd_ctrl_probe+0xd8/0x400 platform_probe+0x6c/0xe0 really_probe+0xbc/0x2d4 __driver_probe_device+0x78/0xe0 driver_probe_device+0x3c/0x12c __device_attach_driver+0xb8/0x120 bus_for_each_drv+0x78/0xd0 __device_attach+0xa8/0x1c0 device_initial_probe+0x18/0x24 bus_probe_device+0xa0/0xac deferred_probe_work_func+0x88/0xc0 process_one_work+0x1d4/0x320 worker_thread+0x2cc/0x44c kthread+0x110/0x114 ret_from_fork+0x10/0x20
--- drivers/slimbus/qcom-ngd-ctrl.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/slimbus/qcom-ngd-ctrl.c +11 -2
@@ -1567,18 +1567,27 @@ static int qcom_slim_ngd_ctrl_probe(stru ctrl->pdr =pdr_handle_alloc (slim_pd_status, ctrl);if (IS_ERR (ctrl->pdr)) {dev_err (dev,"Failed to init PDR handle\n" ); -return PTR_ERR (ctrl->pdr); + ret =PTR_ERR (ctrl->pdr); + goto err_pdr_alloc; } pds =pdr_add_lookup (ctrl->pdr,"avs/audio" ,"msm/adsp/audio_pd" );if (IS_ERR (pds) &&PTR_ERR (pds) != -EALREADY ) { ret =PTR_ERR (pds);dev_err (dev,"pdr add lookup failed: %d\n" , ret); -return ret; + goto err_pdr_lookup; }platform_driver_register (&qcom_slim_ngd_driver);return of_qcom_slim_ngd_register (dev, ctrl); + +err_pdr_alloc: +qcom_unregister_ssr_notifier (ctrl->notifier, &ctrl->nb); + +err_pdr_lookup: +pdr_handle_release (ctrl->pdr); + +return ret; }static int qcom_slim_ngd_ctrl_remove (struct platform_device *pdev)
Greg Kroah-Hartman
maintainerPATCH 71/530 scsi: qedf: Populate sysfs attributes for vport
In reply to Greg Kroah-HartmanFrom: Saurav Kashyap <[email protected]>
commit 592642e6b11e620e4b43189f8072752429fc8dc3 upstream.
Few vport parameters were displayed by systool as 'Unknown' or 'NULL'. Copy speed, supported_speed, frame_size and update port_type for NPIV port.
--- drivers/scsi/qedf/qedf_main.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
drivers/scsi/qedf/qedf_main.c +21 -0
@@ -1921,6 +1921,27 @@ static int qedf_vport_create(struct fc_vfc_vport_setlink (vn_port); } +/* Set symbolic node name */ +if (base_qedf->pdev->device == QL45xxx) +snprintf (fc_host_symbolic_name (vn_port->host),256 , +"Marvell FastLinQ 45xxx FCoE v%s" ,QEDF_VERSION ); + +if (base_qedf->pdev->device == QL41xxx) +snprintf (fc_host_symbolic_name (vn_port->host),256 , +"Marvell FastLinQ 41xxx FCoE v%s" ,QEDF_VERSION ); + +/* Set supported speed */ +fc_host_supported_speeds (vn_port->host) = n_port->link_supported_speeds; + +/* Set speed */ + vn_port->link_speed = n_port->link_speed; + +/* Set port type */ +fc_host_port_type (vn_port->host) =FC_PORTTYPE_NPIV ; + +/* Set maxframe size */ +fc_host_maxframe_size (vn_port->host) = n_port->mfs; +QEDF_INFO (&(base_qedf->dbg_ctx),QEDF_LOG_NPIV ,"vn_port=%p.\n" , vn_port);
Greg Kroah-Hartman
maintainerPATCH 72/530 gpio: rockchip: request GPIO mux to pinctrl when setting direction
In reply to Greg Kroah-HartmanFrom: Quentin Schulz <[email protected]>
commit 8ea8af6c8469156ac2042d83d73f6b74eb4b4b45 upstream.
Before the split of gpio and pinctrl sections in their own driver, rockchip_set_mux was called in pinmux_ops.gpio_set_direction for configuring a pin in its GPIO function.
This is essential for cases where pinctrl is "bypassed" by gpio consumers otherwise the GPIO function is not configured for the pin and it does not work. Such was the case for the sysfs/libgpiod userspace GPIO handling.
Let's call pinctrl_gpio_direction_input/output when setting the direction of a GPIO so that the pinctrl core requests from the rockchip pinctrl driver to put the pin in its GPIO function.
--- drivers/gpio/gpio-rockchip.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/gpio/gpio-rockchip.c +7 -0
@@ -19,6 +19,7 @@#include <linux/of_address.h> #include <linux/of_device.h> #include <linux/of_irq.h> +#include <linux/pinctrl/consumer.h> #include <linux/pinctrl/pinconf-generic.h> #include <linux/regmap.h>
@@ -155,6 +156,12 @@ static int rockchip_gpio_set_direction(sunsigned long flags;u32 data = input ?0 :1 ; + +if (input) +pinctrl_gpio_direction_input (bank->pin_base + offset); +else +pinctrl_gpio_direction_output (bank->pin_base + offset); +raw_spin_lock_irqsave (&bank->slock, flags);rockchip_gpio_writel_bit (bank, offset, data, bank->gpio_regs->port_ddr);raw_spin_unlock_irqrestore (&bank->slock, flags);
Greg Kroah-Hartman
maintainerPATCH 73/530 pinctrl: rockchip: add pinmux_ops.gpio_set_direction callback
In reply to Greg Kroah-HartmanFrom: Quentin Schulz <[email protected]>
commit 4635c0e2a7f7f3568cbfccae70121f9835efa62c upstream.
Before the split of gpio and pinctrl sections in their own driver, rockchip_set_mux was called in pinmux_ops.gpio_set_direction for configuring a pin in its GPIO function.
This is essential for cases where pinctrl is "bypassed" by gpio consumers otherwise the GPIO function is not configured for the pin and it does not work. Such was the case for the sysfs/libgpiod userspace GPIO handling.
Let's re-implement the pinmux_ops.gpio_set_direction callback so that the gpio subsystem can request from the pinctrl driver to put the pin in its GPIO function.
--- drivers/pinctrl/pinctrl-rockchip.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/pinctrl/pinctrl-rockchip.c +13 -0
@@ -2072,11 +2072,24 @@ static int rockchip_pmx_set(struct pinctreturn 0 ; } +static int rockchip_pmx_gpio_set_direction (struct pinctrl_dev *pctldev, +struct pinctrl_gpio_range *range, +unsigned offset, +bool input) +{ +struct rockchip_pinctrl *info =pinctrl_dev_get_drvdata (pctldev); +struct rockchip_pin_bank *bank; + + bank =pin_to_bank (info, offset); +return rockchip_set_mux (bank, offset - bank->pin_base,RK_FUNC_GPIO ); +} +static const struct pinmux_ops rockchip_pmx_ops = { .get_functions_count = rockchip_pmx_get_funcs_count, .get_function_name = rockchip_pmx_get_func_name, .get_function_groups = rockchip_pmx_get_groups, .set_mux = rockchip_pmx_set, + .gpio_set_direction = rockchip_pmx_gpio_set_direction, };/*
Greg Kroah-Hartman
maintainerPATCH 74/530 fbdev: smscufx: Fix use-after-free in ufx_ops_open()
In reply to Greg Kroah-HartmanFrom: Hyunwoo Kim <[email protected]>
commit 5610bcfe8693c02e2e4c8b31427f1bdbdecc839c upstream.
A race condition may occur if the user physically removes the USB device while calling open() for this device node.
This is a race condition between the ufx_ops_open() function and the ufx_usb_disconnect() function, which may eventually result in UAF.
So, add a mutex to the ufx_ops_open() and ufx_usb_disconnect() functions to avoid race contidion of krefs.
--- drivers/video/fbdev/smscufx.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/video/fbdev/smscufx.c +13 -1
@@ -137,6 +137,8 @@ static int ufx_submit_urb(struct ufx_datstatic int ufx_alloc_urb_list (struct ufx_data *dev,int count,size_t size);static void ufx_free_urb_list (struct ufx_data *dev); +static DEFINE_MUTEX (disconnect_mutex); +/* reads a control register */ static int ufx_reg_read (struct ufx_data *dev,u32 index,u32 *data) {
@@ -1070,9 +1072,13 @@ static int ufx_ops_open(struct fb_info *if (user ==0 && !console)return -EBUSY ; +mutex_lock (&disconnect_mutex); +/* If the USB device is gone, we don't accept new opens */ -if (dev->virtualized) +if (dev->virtualized) { +mutex_unlock (&disconnect_mutex);return -ENODEV ; + } dev->fb_count++;
@@ -1096,6 +1102,8 @@ static int ufx_ops_open(struct fb_info *pr_debug ("open /dev/fb%d user=%d fb_info=%p count=%d" , info->node, user, info, dev->fb_count); +mutex_unlock (&disconnect_mutex); +return 0 ; }
@@ -1740,6 +1748,8 @@ static void ufx_usb_disconnect(struct us {struct ufx_data *dev; +mutex_lock (&disconnect_mutex); + dev =usb_get_intfdata (interface);pr_debug ("USB disconnect starting\n" );
@@ -1760,6 +1770,8 @@ static void ufx_usb_disconnect(struct uskref_put (&dev->kref, ufx_free);/* consider ufx_data freed */ + +mutex_unlock (&disconnect_mutex); }static struct usb_driver ufx_driver = {
Greg Kroah-Hartman
maintainerPATCH 75/530 ksmbd: fix endless loop when encryption for response fails
In reply to Greg Kroah-HartmanFrom: Namjae Jeon <[email protected]>
commit 360c8ee6fefdb496fffd2c18bb9a96a376a1a804 upstream.
If ->encrypt_resp return error, goto statement cause endless loop. It send an error response immediately after removing it.
--- fs/ksmbd/server.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
fs/ksmbd/server.c +1 -3
@@ -235,10 +235,8 @@ send:if (work->sess && work->sess->enc && work->encrypted && conn->ops->encrypt_resp) { rc = conn->ops->encrypt_resp (work); -if (rc <0 ) { +if (rc <0 ) conn->ops->set_rsp_status (work,STATUS_DATA_ERROR ); - goto send; - } }ksmbd_conn_write (work);
Greg Kroah-Hartman
maintainerPATCH 76/530 ksmbd: Fix wrong return value and message length check in smb2_ioctl()
In reply to Greg Kroah-HartmanFrom: Zhang Xiaoxu <[email protected]>
commit b1763d265af62800ec96eeb79803c4c537dcef3a upstream.
Commit c7803b05f74b ("smb3: fix ksmbd bigendian bug in oplock break, and move its struct to smbfs_common") use the defination of 'struct validate_negotiate_info_req' in smbfs_common, the array length of 'Dialects' changed from 1 to 4, but the protocol does not require the client to send all 4. This lead the request which satisfied with protocol and server to fail.
So just ensure the request payload has the 'DialectCount' in smb2_ioctl(), then fsctl_validate_negotiate_info() will use it to validate the payload length and each dialect.
Also when the {in, out}_buf_len is less than the required, should goto out to initialize the status in the response header.
--- fs/ksmbd/smb2pdu.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
fs/ksmbd/smb2pdu.c +9 -4
@@ -7617,11 +7617,16 @@ int smb2_ioctl(struct ksmbd_work *work) goto out; } -if (in_buf_len <sizeof (struct validate_negotiate_info_req )) -return -EINVAL ; +if (in_buf_len < offsetof(struct validate_negotiate_info_req , + Dialects)) { + ret = -EINVAL ; + goto out; + } -if (out_buf_len <sizeof (struct validate_negotiate_info_rsp )) -return -EINVAL ; +if (out_buf_len <sizeof (struct validate_negotiate_info_rsp )) { + ret = -EINVAL ; + goto out; + } ret = fsctl_validate_negotiate_info(conn, (struct validate_negotiate_info_req *)&req->Buffer[0],
Greg Kroah-Hartman
maintainerPATCH 77/530 ksmbd: Fix user namespace mapping
In reply to Greg Kroah-HartmanFrom: Mickaël Salaün <[email protected]>
commit 7c88c1e0ab1704bacb751341ee6431c3be34b834 upstream.
A kernel daemon should not rely on the current thread, which is unknown and might be malicious. Before this security fix, ksmbd_override_fsids() didn't correctly override FS UID/GID which means that arbitrary user space threads could trick the kernel to impersonate arbitrary users or groups for file system access checks, leading to file system access bypass.
This was found while investigating truncate support for Landlock:
https://lore.kernel.org/r/CAKYAXd8fpMJ7guizOjHgxEyyjoUwPsx3jLOPZP=wPYcbhkVXqA@mail.gmail.com
--- fs/ksmbd/smb_common.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/ksmbd/smb_common.c +4 -2
@@ -4,6 +4,8 @@* Copyright (C) 2018 Namjae Jeon <[email protected]> */ +#include <linux/user_namespace.h> +#include "smb_common.h" #include "server.h" #include "misc.h"
@@ -624,8 +626,8 @@ int ksmbd_override_fsids(struct ksmbd_woif (!cred)return -ENOMEM ; - cred->fsuid =make_kuid (current_user_ns (), uid); - cred->fsgid =make_kgid (current_user_ns (), gid); + cred->fsuid =make_kuid (&init_user_ns, uid); + cred->fsgid =make_kgid (&init_user_ns, gid); gi =groups_alloc (0 );if (!gi) {
Greg Kroah-Hartman
maintainerPATCH 78/530 fs: record I_DIRTY_TIME even if inode already has I_DIRTY_INODE
In reply to Greg Kroah-HartmanFrom: Lukas Czerner <[email protected]>
commit cbfecb927f429a6fa613d74b998496bd71e4438a upstream.
Currently the I_DIRTY_TIME will never get set if the inode already has I_DIRTY_INODE with assumption that it supersedes I_DIRTY_TIME. That's true, however ext4 will only update the on-disk inode in ->dirty_inode(), not on actual writeback. As a result if the inode already has I_DIRTY_INODE state by the time we get to __mark_inode_dirty() only with I_DIRTY_TIME, the time was already filled into on-disk inode and will not get updated until the next I_DIRTY_INODE update, which might never come if we crash or get a power failure.
The problem can be reproduced on ext4 by running xfstest generic/622 with -o iversion mount option.
Fix it by allowing I_DIRTY_TIME to be set even if the inode already has I_DIRTY_INODE. Also make sure that the case is properly handled in writeback_single_inode() as well. Additionally changes in xfs_fs_dirty_inode() was made to accommodate for I_DIRTY_TIME in flag.
Thanks Jan Kara for suggestions on how to make this work properly.
--- Documentation/filesystems/vfs.rst | 3 +++ fs/fs-writeback.c | 37 +++++++++++++++++++++++++------------ fs/xfs/xfs_super.c | 10 ++++++++-- include/linux/fs.h | 9 +++++---- 4 files changed, 41 insertions(+), 18 deletions(-)
Documentation/filesystems/vfs.rst +3 -0
@@ -274,6 +274,9 @@ or bottom half). This is specifically for the inode itself being marked dirty, not its data. If the update needs to be persisted by fdatasync(), then I_DIRTY_DATASYNC will be set in the flags argument. + I_DIRTY_TIME will be set in the flags in case lazytime is enabled + and struct inode has times updated since the last ->dirty_inode + call. ``write_inode`` this method is called when the VFS needs to write an inode to
fs/fs-writeback.c +25 -12
@@ -1745,9 +1745,14 @@ static int writeback_single_inode(struct*/ if (!(inode->i_state &I_DIRTY_ALL ))inode_cgwb_move_to_attached (inode, wb); -else if (!(inode->i_state &I_SYNC_QUEUED ) && - (inode->i_state &I_DIRTY )) -redirty_tail_locked (inode, wb); +else if (!(inode->i_state &I_SYNC_QUEUED )) { +if ((inode->i_state &I_DIRTY )) +redirty_tail_locked (inode, wb); +else if (inode->i_state &I_DIRTY_TIME ) { + inode->dirtied_when = jiffies; +inode_io_list_move_locked (inode, wb, &wb->b_dirty_time); + } + }spin_unlock (&wb->list_lock);inode_sync_complete (inode);
@@ -2401,6 +2406,20 @@ void __mark_inode_dirty(struct inode *inif (flags &I_DIRTY_INODE ) {/* +* Inode timestamp update will piggback on this dirtying. +* We tell ->dirty_inode callback that timestamps need to +* be updated by setting I_DIRTY_TIME in flags. +*/ +if (inode->i_state &I_DIRTY_TIME ) { +spin_lock (&inode->i_lock); +if (inode->i_state &I_DIRTY_TIME ) { + inode->i_state &= ~I_DIRTY_TIME ; + flags |=I_DIRTY_TIME ; + } +spin_unlock (&inode->i_lock); + } + +/* * Notify the filesystem about the inode being dirtied, so that * (if needed) it can update on-disk fields and journal the * inode. This is only needed when the inode itself is being
@@ -2409,7 +2428,8 @@ void __mark_inode_dirty(struct inode *in*/ trace_writeback_dirty_inode_start (inode, flags);if (sb->s_op->dirty_inode) - sb->s_op->dirty_inode (inode, flags &I_DIRTY_INODE ); + sb->s_op->dirty_inode (inode, + flags & (I_DIRTY_INODE |I_DIRTY_TIME ));trace_writeback_dirty_inode (inode, flags);/* I_DIRTY_INODE supersedes I_DIRTY_TIME. */
@@ -2430,21 +2450,15 @@ void __mark_inode_dirty(struct inode *in*/ smp_mb (); -if (((inode->i_state & flags) == flags) || - (dirtytime && (inode->i_state &I_DIRTY_INODE ))) +if ((inode->i_state & flags) == flags)return ;spin_lock (&inode->i_lock); -if (dirtytime && (inode->i_state &I_DIRTY_INODE )) - goto out_unlock_inode;if ((inode->i_state & flags) != flags) {const int was_dirty = inode->i_state &I_DIRTY ;inode_attach_wb (inode,NULL ); -/* I_DIRTY_INODE supersedes I_DIRTY_TIME. */ -if (flags &I_DIRTY_INODE ) - inode->i_state &= ~I_DIRTY_TIME ; inode->i_state |= flags;/*
@@ -2517,7 +2531,6 @@ void __mark_inode_dirty(struct inode *in out_unlock:if (wb)spin_unlock (&wb->list_lock); -out_unlock_inode:spin_unlock (&inode->i_lock); }EXPORT_SYMBOL (__mark_inode_dirty);
fs/xfs/xfs_super.c +8 -2
@@ -642,7 +642,7 @@ xfs_fs_destroy_inode(static void xfs_fs_dirty_inode (struct inode *inode, -int flag) +int flags) {struct xfs_inode *ip =XFS_I (inode);struct xfs_mount *mp = ip->i_mount;
@@ -650,7 +650,13 @@ xfs_fs_dirty_inode(if (!(inode->i_sb->s_flags &SB_LAZYTIME ))return ; -if (flag !=I_DIRTY_SYNC || !(inode->i_state &I_DIRTY_TIME )) + +/* +* Only do the timestamp update if the inode is dirty (I_DIRTY_SYNC) +* and has dirty timestamp (I_DIRTY_TIME). I_DIRTY_TIME can be passed +* in flags possibly together with I_DIRTY_SYNC. +*/ +if ((flags & ~I_DIRTY_TIME ) !=I_DIRTY_SYNC || !(flags &I_DIRTY_TIME ))return ;if (xfs_trans_alloc (mp, &M_RES (mp)->tr_fsyncts,0 ,0 ,0 , &tp))
include/linux/fs.h +5 -4
@@ -2288,13 +2288,14 @@ static inline void kiocb_clone(struct ki* don't have to write inode on fdatasync() when only * e.g. the timestamps have changed. * I_DIRTY_PAGES Inode has dirty pages. Inode itself may be clean. -* I_DIRTY_TIME The inode itself only has dirty timestamps, and the +* I_DIRTY_TIME The inode itself has dirty timestamps, and the * lazytime mount option is enabled. We keep track of this * separately from I_DIRTY_SYNC in order to implement * lazytime. This gets cleared if I_DIRTY_INODE -* (I_DIRTY_SYNC and/or I_DIRTY_DATASYNC) gets set. I.e. -* either I_DIRTY_TIME *or* I_DIRTY_INODE can be set in -* i_state, but not both. I_DIRTY_PAGES may still be set. +* (I_DIRTY_SYNC and/or I_DIRTY_DATASYNC) gets set. But +* I_DIRTY_TIME can still be set if I_DIRTY_SYNC is already +* in place because writeback might already be in progress +* and we don't want to lose the time update * I_NEW Serves as both a mutex and completion notification. * New inodes set I_NEW. If two processes both create * the same inode, one of them will release its inode and
Greg Kroah-Hartman
maintainerPATCH 79/530 btrfs: fix race between quota enable and quota rescan ioctl
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 331cd9461412e103d07595a10289de90004ac890 upstream.
When enabling quotas, at btrfs_quota_enable(), after committing the transaction, we change fs_info->quota_root to point to the quota root we created and set BTRFS_FS_QUOTA_ENABLED at fs_info->flags. Then we try to start the qgroup rescan worker, first by initializing it with a call to qgroup_rescan_init() - however if that fails we end up freeing the quota root but we leave fs_info->quota_root still pointing to it, this can later result in a use-after-free somewhere else.
We have previously set the flags BTRFS_FS_QUOTA_ENABLED and BTRFS_QGROUP_STATUS_FLAG_ON, so we can only fail with -EINPROGRESS at btrfs_quota_enable(), which is possible if someone already called the quota rescan ioctl, and therefore started the rescan worker.
So fix this by ignoring an -EINPROGRESS and asserting we can't get any other error.
--- fs/btrfs/qgroup.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
fs/btrfs/qgroup.c +15 -0
@@ -1157,6 +1157,21 @@ out_add_root: fs_info->qgroup_rescan_running = true;btrfs_queue_work (fs_info->qgroup_rescan_workers, &fs_info->qgroup_rescan_work); + }else { +/* +* We have set both BTRFS_FS_QUOTA_ENABLED and +* BTRFS_QGROUP_STATUS_FLAG_ON, so we can only fail with +* -EINPROGRESS. That can happen because someone started the +* rescan worker by calling quota rescan ioctl before we +* attempted to initialize the rescan worker. Failure due to +* quotas disabled in the meanwhile is not possible, because +* we are holding a write lock on fs_info->subvol_sem, which +* is also acquired when disabling quotas. +* Ignore such error, and any other error would need to undo +* everything we did in the transaction we just committed. +*/ +ASSERT (ret == -EINPROGRESS ); + ret =0 ; } out_free_path:
Greg Kroah-Hartman
maintainerPATCH 80/530 btrfs: set generation before calling btrfs_clean_tree_block in btrfs_init_new_buffer
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
commit cbddcc4fa3443fe8cfb2ff8e210deb1f6a0eea38 upstream.
syzbot is reporting uninit-value in btrfs_clean_tree_block() [1], for commit bc877d285ca3dba2 ("btrfs: Deduplicate extent_buffer init code") missed that btrfs_set_header_generation() in btrfs_init_new_buffer() must not be moved to after clean_tree_block() because clean_tree_block() is calling btrfs_header_generation() since commit 55c69072d6bd5be1 ("Btrfs:
Fix extent_buffer usage when nodesize != leafsize").
Since memzero_extent_buffer() will reset "struct btrfs_header" part, we can't move btrfs_set_header_generation() to before memzero_extent_buffer(). Just re-add btrfs_set_header_generation() before btrfs_clean_tree_block().
--- fs/btrfs/extent-tree.c | 3 +++ 1 file changed, 3 insertions(+)
fs/btrfs/extent-tree.c +3 -0
@@ -4802,6 +4802,9 @@ btrfs_init_new_buffer(struct btrfs_trans !test_bit(BTRFS_ROOT_RESET_LOCKDEP_CLASS, &root->state)) lockdep_owner =BTRFS_FS_TREE_OBJECTID ; +/* btrfs_clean_tree_block() accesses generation field. */ +btrfs_set_header_generation (buf, trans->transid); +/* * This needs to stay, because we could allocate a freed block from an * old tree into a new tree, so we need to make sure this new block is
Greg Kroah-Hartman
maintainerPATCH 81/530 f2fs: complete checkpoints during remount
In reply to Greg Kroah-HartmanFrom: Jaegeuk Kim <[email protected]>
commit 4f99484d27961cb194cebcd917176fa038a5025f upstream.
Otherwise, pending checkpoints can contribute a race condition to give a quota warning.
- Thread - checkpoint thread
add checkpoints to the listdo_remount()
down_write(&sb->s_umount);
f2fs_remount()
block_operations()
down_read_trylock(&sb->s_umount) = 0
up_write(&sb->s_umount);
f2fs_quota_sync()
dquot_writeback_dquots()
WARN_ON_ONCE(!rwsem_is_locked(&sb->s_umount));Or,
do_remount()
down_write(&sb->s_umount);
f2fs_remount()
create a ckpt thread f2fs_enable_checkpoint() adds checkpoints wait for f2fs_sync_fs() trigger another pending checkpoint
block_operations()
down_read_trylock(&sb->s_umount) = 0
up_write(&sb->s_umount);
f2fs_quota_sync()
dquot_writeback_dquots()
WARN_ON_ONCE(!rwsem_is_locked(&sb->s_umount));--- fs/f2fs/super.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/f2fs/super.c +6 -0
@@ -2152,6 +2152,9 @@ static void f2fs_enable_checkpoint(strucup_write (&sbi->gc_lock);f2fs_sync_fs (sbi->sb,1 ); + +/* Let's ensure there's no pending checkpoint anymore */ +f2fs_flush_ckpt_thread (sbi); }static int f2fs_remount (struct super_block *sb,int *flags,char *data)
@@ -2318,6 +2321,9 @@ static int f2fs_remount(struct super_blof2fs_stop_ckpt_thread (sbi); need_restart_ckpt = true; }else { +/* Flush if the prevous checkpoint, if exists. */ +f2fs_flush_ckpt_thread (sbi); + err =f2fs_start_ckpt_thread (sbi);if (err) { f2fs_err(sbi,
Greg Kroah-Hartman
maintainerPATCH 82/530 f2fs: flush pending checkpoints when freezing super
In reply to Greg Kroah-HartmanFrom: Jaegeuk Kim <[email protected]>
commit c7b58576370147833999fd4cc874d0f918bdf9ca upstream.
This avoids -EINVAL when trying to freeze f2fs.
--- fs/f2fs/checkpoint.c | 24 ++++++++++++++++++------ fs/f2fs/f2fs.h | 1 + fs/f2fs/super.c | 5 ++--- 3 files changed, 21 insertions(+), 9 deletions(-)
fs/f2fs/checkpoint.c +18 -6
@@ -1892,15 +1892,27 @@ int f2fs_start_ckpt_thread(struct f2fs_svoid f2fs_stop_ckpt_thread (struct f2fs_sb_info *sbi) {struct ckpt_req_control *cprc = &sbi->cprc_info; +struct task_struct *ckpt_task; -if (cprc->f2fs_issue_ckpt) { -struct task_struct *ckpt_task = cprc->f2fs_issue_ckpt; +if (!cprc->f2fs_issue_ckpt) +return ; - cprc->f2fs_issue_ckpt =NULL ; -kthread_stop (ckpt_task); + ckpt_task = cprc->f2fs_issue_ckpt; + cprc->f2fs_issue_ckpt =NULL ; +kthread_stop (ckpt_task); -flush_remained_ckpt_reqs (sbi,NULL ); - } +f2fs_flush_ckpt_thread (sbi); +} + +void f2fs_flush_ckpt_thread (struct f2fs_sb_info *sbi) +{ +struct ckpt_req_control *cprc = &sbi->cprc_info; + +flush_remained_ckpt_reqs (sbi,NULL ); + +/* Let's wait for the previous dispatched checkpoint. */ +while (atomic_read (&cprc->queued_ckpt)) +io_schedule_timeout (DEFAULT_IO_TIMEOUT ); }void f2fs_init_ckpt_req_control (struct f2fs_sb_info *sbi)
fs/f2fs/f2fs.h +1 -0
@@ -3540,6 +3540,7 @@ unsigned int f2fs_usable_blks_in_seg(str* checkpoint.c */ void f2fs_stop_checkpoint (struct f2fs_sb_info *sbi,bool end_io); +void f2fs_flush_ckpt_thread (struct f2fs_sb_info *sbi);struct page *f2fs_grab_meta_page (struct f2fs_sb_info *sbi,pgoff_t index);struct page *f2fs_get_meta_page (struct f2fs_sb_info *sbi,pgoff_t index);struct page *f2fs_get_meta_page_retry (struct f2fs_sb_info *sbi,pgoff_t index);
fs/f2fs/super.c +2 -3
@@ -1661,9 +1661,8 @@ static int f2fs_freeze(struct super_blocif (is_sbi_flag_set (F2FS_SB (sb),SBI_IS_DIRTY ))return -EINVAL ; -/* ensure no checkpoint required */ -if (!llist_empty (&F2FS_SB (sb)->cprc_info.issue_list)) -return -EINVAL ; +/* Let's flush checkpoints and stop the thread. */ +f2fs_flush_ckpt_thread (F2FS_SB (sb));/* to avoid deadlock on f2fs_evict_inode->SB_FREEZE_FS */ set_sbi_flag (F2FS_SB (sb),SBI_IS_FREEZING );
Greg Kroah-Hartman
maintainerPATCH 83/530 f2fs: increase the limit for reserve_root
In reply to Greg Kroah-HartmanFrom: Jaegeuk Kim <[email protected]>
commit da35fe96d12d15779f3cb74929b7ed03941cf983 upstream.
This patch increases the threshold that limits the reserved root space from 0.2% to 12.5% by using simple shift operation.
Typically Android sets 128MB, but if the storage capacity is 32GB, 0.2% which is around 64MB becomes too small. Let's relax it.
--- fs/f2fs/super.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/f2fs/super.c +2 -2
@@ -306,10 +306,10 @@ static void f2fs_destroy_casefold_cache(static inline void limit_reserve_root (struct f2fs_sb_info *sbi) { -block_t limit =min ((sbi->user_block_count <<1 ) /1000 , +block_t limit =min ((sbi->user_block_count >>3 ), sbi->user_block_count - sbi->reserved_blocks); -/* limit is 0.2% */ +/* limit is 12.5% */ if (test_opt (sbi,RESERVE_ROOT ) &&F2FS_OPTION (sbi).root_reserved_blocks > limit) {F2FS_OPTION (sbi).root_reserved_blocks = limit;
Greg Kroah-Hartman
maintainerPATCH 84/530 f2fs: fix to do sanity check on destination blkaddr during recovery
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
commit 0ef4ca04a3f9223ff8bc440041c524b2123e09a3 upstream.
As Wenqing Liu reported in bugzilla:
https://bugzilla.kernel.org/show_bug.cgi?id=216456
loop5: detected capacity change from 0 to 131072 F2FS-fs (loop5): recover_inode: ino = 6, name = hln, inline = 1 F2FS-fs (loop5): recover_data: ino = 6 (i_size: recover) err = 0 F2FS-fs (loop5): recover_inode: ino = 6, name = hln, inline = 1 F2FS-fs (loop5): recover_data: ino = 6 (i_size: recover) err = 0 F2FS-fs (loop5): recover_inode: ino = 6, name = hln, inline = 1 F2FS-fs (loop5): recover_data: ino = 6 (i_size: recover) err = 0 F2FS-fs (loop5): Bitmap was wrongly set, blk:5634
------------[ cut here ]------------ WARNING: CPU: 3 PID: 1013 at fs/f2fs/segment.c:2198 RIP: 0010:update_sit_entry+0xa55/0x10b0 [f2fs] Call Trace: <TASK> f2fs_do_replace_block+0xa98/0x1890 [f2fs] f2fs_replace_block+0xeb/0x180 [f2fs] recover_data+0x1a69/0x6ae0 [f2fs] f2fs_recover_fsync_data+0x120d/0x1fc0 [f2fs] f2fs_fill_super+0x4665/0x61e0 [f2fs] mount_bdev+0x2cf/0x3b0 legacy_get_tree+0xed/0x1d0 vfs_get_tree+0x81/0x2b0 path_mount+0x47e/0x19d0 do_mount+0xce/0xf0 __x64_sys_mount+0x12c/0x1a0 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd
If we enable CONFIG_F2FS_CHECK_FS config, it will trigger a kernel panic instead of warning.
The root cause is: in fuzzed image, SIT table is inconsistent with inode mapping table, result in triggering such warning during SIT table update.
This patch introduces a new flag DATA_GENERIC_ENHANCE_UPDATE, w/ this flag, data block recovery flow can check destination blkaddr's validation in SIT table, and skip f2fs_replace_block() to avoid inconsistent status.
--- fs/f2fs/checkpoint.c | 10 +++++++++- fs/f2fs/f2fs.h | 4 ++++ fs/f2fs/recovery.c | 8 ++++++++ 3 files changed, 21 insertions(+), 1 deletion(-)
fs/f2fs/checkpoint.c +9 -1
@@ -139,7 +139,7 @@ static bool __is_bitmap_valid(struct f2funsigned int segno, offset;bool exist; -if (type !=DATA_GENERIC_ENHANCE && type !=DATA_GENERIC_ENHANCE_READ ) +if (type ==DATA_GENERIC )return true; segno =GET_SEGNO (sbi, blkaddr);
@@ -147,6 +147,13 @@ static bool __is_bitmap_valid(struct f2f se =get_seg_entry (sbi, segno); exist =f2fs_test_bit (offset, se->cur_valid_map); +if (exist && type ==DATA_GENERIC_ENHANCE_UPDATE ) { +f2fs_err (sbi,"Inconsistent error blkaddr:%u, sit bitmap:%d" , + blkaddr, exist); +set_sbi_flag (sbi,SBI_NEED_FSCK ); +return exist; + } +if (!exist && type ==DATA_GENERIC_ENHANCE ) {f2fs_err (sbi,"Inconsistent error blkaddr:%u, sit bitmap:%d" , blkaddr, exist);
@@ -184,6 +191,7 @@ bool f2fs_is_valid_blkaddr(struct f2fs_scase DATA_GENERIC :case DATA_GENERIC_ENHANCE :case DATA_GENERIC_ENHANCE_READ : +case DATA_GENERIC_ENHANCE_UPDATE :if (unlikely (blkaddr >=MAX_BLKADDR (sbi) || blkaddr <MAIN_BLKADDR (sbi))) { f2fs_warn(sbi, "access invalid blkaddr:%u",
fs/f2fs/f2fs.h +4 -0
@@ -249,6 +249,10 @@ enum {* condition of read on truncated area * by extent_cache */ +DATA_GENERIC_ENHANCE_UPDATE ,/* +* strong check on range and segment +* bitmap for update case +*/ META_GENERIC, };
fs/f2fs/recovery.c +8 -0
@@ -677,6 +677,14 @@ retry_prev: goto err; } +if (f2fs_is_valid_blkaddr (sbi, dest, +DATA_GENERIC_ENHANCE_UPDATE )) { +f2fs_err (sbi,"Inconsistent dest blkaddr:%u, ino:%lu, ofs:%u" , + dest, inode->i_ino, dn.ofs_in_node); + err = -EFSCORRUPTED ; + goto err; + } +/* write dummy data page */ f2fs_replace_block (sbi, &dn, src, dest, ni.version, false, false);
Greg Kroah-Hartman
maintainerPATCH 85/530 f2fs: fix to do sanity check on summary info
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
commit c6ad7fd16657ebd34a87a97d9588195aae87597d upstream.
As Wenqing Liu reported in bugzilla:
https://bugzilla.kernel.org/show_bug.cgi?id=216456
BUG: KASAN: use-after-free in recover_data+0x63ae/0x6ae0 [f2fs] Read of size 4 at addr ffff8881464dcd80 by task mount/1013 CPU: 3 PID: 1013 Comm: mount Tainted: G W 6.0.0-rc4 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 Call Trace: dump_stack_lvl+0x45/0x5e print_report.cold+0xf3/0x68d kasan_report+0xa8/0x130 recover_data+0x63ae/0x6ae0 [f2fs] f2fs_recover_fsync_data+0x120d/0x1fc0 [f2fs] f2fs_fill_super+0x4665/0x61e0 [f2fs] mount_bdev+0x2cf/0x3b0 legacy_get_tree+0xed/0x1d0 vfs_get_tree+0x81/0x2b0 path_mount+0x47e/0x19d0 do_mount+0xce/0xf0 __x64_sys_mount+0x12c/0x1a0 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd
The root cause is: in fuzzed image, SSA table is corrupted: ofs_in_node is larger than ADDRS_PER_PAGE(), result in out-of-range access on 4k-size page.
- recover_data
- do_recover_data
- check_index_in_prev_nodes
- f2fs_data_blkaddr
This patch adds sanity check on summary info in recovery and GC flow in where the flows rely on them.
After patch:
[ 29.310883] F2FS-fs (loop0): Inconsistent ofs_in_node:65286 in summary, ino:0, nid:6, max:1018
--- fs/f2fs/gc.c | 10 +++++++++- fs/f2fs/recovery.c | 15 ++++++++++++--- 2 files changed, 21 insertions(+), 4 deletions(-)
fs/f2fs/gc.c +9 -1
@@ -1002,7 +1002,7 @@ static bool is_alive(struct f2fs_sb_info {struct page *node_page;nid_t nid; -unsigned int ofs_in_node; +unsigned int ofs_in_node, max_addrs;block_t source_blkaddr; nid =le32_to_cpu (sum->nid);
@@ -1028,6 +1028,14 @@ static bool is_alive(struct f2fs_sb_inforeturn false; } + max_addrs =IS_INODE (node_page) ?DEF_ADDRS_PER_INODE : +DEF_ADDRS_PER_BLOCK ; +if (ofs_in_node >= max_addrs) { +f2fs_err (sbi,"Inconsistent ofs_in_node:%u in summary, ino:%u, nid:%u, max:%u" , + ofs_in_node, dni->ino, dni->nid, max_addrs); +return false; + } + *nofs =ofs_of_node (node_page); source_blkaddr =data_blkaddr (NULL , node_page, ofs_in_node);f2fs_put_page (node_page,1 );
fs/f2fs/recovery.c +12 -3
@@ -452,7 +452,7 @@ static int check_index_in_prev_nodes(strstruct dnode_of_data tdn = *dn;nid_t ino, nid;struct inode *inode; -unsigned int offset; +unsigned int offset, ofs_in_node, max_addrs;block_t bidx;int i;
@@ -479,15 +479,24 @@ static int check_index_in_prev_nodes(str got_it:/* Use the locked dnode page and inode */ nid =le32_to_cpu (sum.nid); + ofs_in_node =le16_to_cpu (sum.ofs_in_node); + + max_addrs =ADDRS_PER_PAGE (dn->node_page, dn->inode); +if (ofs_in_node >= max_addrs) { +f2fs_err (sbi,"Inconsistent ofs_in_node:%u in summary, ino:%lu, nid:%u, max:%u" , + ofs_in_node, dn->inode->i_ino, nid, max_addrs); +return -EFSCORRUPTED ; + } +if (dn->inode->i_ino == nid) { tdn.nid = nid;if (!dn->inode_page_locked)lock_page (dn->inode_page); tdn.node_page = dn->inode_page; - tdn.ofs_in_node =le16_to_cpu (sum.ofs_in_node); + tdn.ofs_in_node = ofs_in_node; goto truncate_out; }else if (dn->nid == nid) { - tdn.ofs_in_node =le16_to_cpu (sum.ofs_in_node); + tdn.ofs_in_node = ofs_in_node; goto truncate_out; }
Greg Kroah-Hartman
maintainerPATCH 86/530 hardening: Avoid harmless Clang option under CONFIG_INIT_STACK_ALL_ZERO
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
commit f02003c860d921171be4a27e2893766eb3bc6871 upstream.
Currently under Clang, CC_HAS_AUTO_VAR_INIT_ZERO requires an extra -enable flag compared to CC_HAS_AUTO_VAR_INIT_PATTERN. GCC 12[1] will not, and will happily ignore the Clang-specific flag. However, its presence on the command-line is both cumbersome and confusing. Due to GCC's tolerant behavior, though, we can continue to use a single Kconfig cc-option test for the feature on both compilers, but then drop the Clang-specific option in the Makefile.
In other words, this patch does not change anything other than making the compiler command line shorter once GCC supports -ftrivial-auto-var-init=zero.
[1] https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff;h=a25e0b5e6ac8a77a71c229e0a7b744603365b0e9
--- Makefile | 6 +++--- security/Kconfig.hardening | 5 ++++- 2 files changed, 7 insertions(+), 4 deletions(-)
Makefile +3 -3
@@ -844,12 +844,12 @@ endif # Initialize all stack variables with a zero value. ifdef CONFIG_INIT_STACK_ALL_ZERO -# Future support for zero initialization is still being debated, see -# https://bugs.llvm.org/show_bug.cgi?id=45497. These flags are subject to being -# renamed or dropped. KBUILD_CFLAGS += -ftrivial-auto-var-init=zero +ifdef CONFIG_CC_IS_CLANG +# https://bugs.llvm.org/show_bug.cgi?id=45497 KBUILD_CFLAGS += -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang endif +endif # While VLAs have been removed, GCC produces unreachable stack probes # for the randomize_kstack_offset feature. Disable it for all compilers.
security/Kconfig.hardening +4 -1
@@ -23,13 +23,16 @@ config CC_HAS_AUTO_VAR_INIT_PATTERN def_bool $(cc-option,-ftrivial-auto-var-init=pattern) config CC_HAS_AUTO_VAR_INIT_ZERO + # GCC ignores the -enable flag, so we can test for the feature with + # a single invocation using the flag, but drop it as appropriate in + # the Makefile, depending on the presence of Clang. def_bool $(cc-option,-ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang) choice prompt "Initialize kernel stack variables at function entry" default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL if COMPILE_TEST && GCC_PLUGINS default INIT_STACK_ALL_PATTERN if COMPILE_TEST && CC_HAS_AUTO_VAR_INIT_PATTERN - default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_PATTERN + default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_ZERO default INIT_STACK_NONE help This option enables initialization of stack variables at
Greg Kroah-Hartman
maintainerPATCH 87/530 hardening: Remove Clangs enable flag for -ftrivial-auto-var-init=zero
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
commit 607e57c6c62c00965ae276902c166834ce73014a upstream.
Now that Clang's -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang option is no longer required, remove it from the command line. Clang 16
and later will warn when it is used, which will cause Kconfig to think
it can't use -ftrivial-auto-var-init=zero at all. Check for whether it
is required and only use it when so.
--- Makefile | 4 ++-- security/Kconfig.hardening | 14 ++++++++++---- 2 files changed, 12 insertions(+), 6 deletions(-)
Makefile +2 -2
@@ -845,8 +845,8 @@ endif # Initialize all stack variables with a zero value. ifdef CONFIG_INIT_STACK_ALL_ZERO KBUILD_CFLAGS += -ftrivial-auto-var-init=zero -ifdef CONFIG_CC_IS_CLANG -# https://bugs.llvm.org/show_bug.cgi?id=45497 +ifdef CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO_ENABLER +# https://github.com/llvm/llvm-project/issues/44842 KBUILD_CFLAGS += -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang endif endif
security/Kconfig.hardening +10 -4
@@ -22,11 +22,17 @@ menu "Memory initialization" config CC_HAS_AUTO_VAR_INIT_PATTERN def_bool $(cc-option,-ftrivial-auto-var-init=pattern) -config CC_HAS_AUTO_VAR_INIT_ZERO - # GCC ignores the -enable flag, so we can test for the feature with - # a single invocation using the flag, but drop it as appropriate in - # the Makefile, depending on the presence of Clang. +config CC_HAS_AUTO_VAR_INIT_ZERO_BARE + def_bool $(cc-option,-ftrivial-auto-var-init=zero) + +config CC_HAS_AUTO_VAR_INIT_ZERO_ENABLER + # Clang 16 and later warn about using the -enable flag, but it + # is required before then. def_bool $(cc-option,-ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang) + depends on !CC_HAS_AUTO_VAR_INIT_ZERO_BARE + +config CC_HAS_AUTO_VAR_INIT_ZERO + def_bool CC_HAS_AUTO_VAR_INIT_ZERO_BARE || CC_HAS_AUTO_VAR_INIT_ZERO_ENABLER choice prompt "Initialize kernel stack variables at function entry"
Greg Kroah-Hartman
maintainerPATCH 88/530 jbd2: wake up journal waiters in FIFO order, not LIFO
In reply to Greg Kroah-HartmanFrom: Andrew Perepechko <[email protected]>
commit 34fc8768ec6089565d6d73bad26724083cecf7bd upstream.
LIFO wakeup order is unfair and sometimes leads to a journal user not being able to get a journal handle for hundreds of transactions in a row.
FIFO wakeup can make things more fair.
--- fs/jbd2/commit.c | 2 +- fs/jbd2/transaction.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-)
fs/jbd2/commit.c +1 -1
@@ -581,7 +581,7 @@ void jbd2_journal_commit_transaction(jou journal->j_running_transaction =NULL ; start_time =ktime_get (); commit_transaction->t_log_start = journal->j_head; -wake_up (&journal->j_wait_transaction_locked); +wake_up_all (&journal->j_wait_transaction_locked);write_unlock (&journal->j_state_lock);jbd_debug (3 ,"JBD2: commit phase 2a\n" );
fs/jbd2/transaction.c +3 -3
@@ -173,7 +173,7 @@ static void wait_transaction_locked(jourint need_to_start;tid_t tid = journal->j_running_transaction->t_tid; -prepare_to_wait (&journal->j_wait_transaction_locked, &wait, +prepare_to_wait_exclusive (&journal->j_wait_transaction_locked, &wait,TASK_UNINTERRUPTIBLE ); need_to_start = !tid_geq (journal->j_commit_request, tid);read_unlock (&journal->j_state_lock);
@@ -199,7 +199,7 @@ static void wait_transaction_switching(jread_unlock (&journal->j_state_lock);return ; } -prepare_to_wait (&journal->j_wait_transaction_locked, &wait, +prepare_to_wait_exclusive (&journal->j_wait_transaction_locked, &wait,TASK_UNINTERRUPTIBLE );read_unlock (&journal->j_state_lock);/*
@@ -911,7 +911,7 @@ void jbd2_journal_unlock_updates (journawrite_lock (&journal->j_state_lock); --journal->j_barrier_count;write_unlock (&journal->j_state_lock); -wake_up (&journal->j_wait_transaction_locked); +wake_up_all (&journal->j_wait_transaction_locked); }static void warn_dirty_buffer (struct buffer_head *bh)
Greg Kroah-Hartman
maintainerPATCH 89/530 jbd2: fix potential buffer head reference count leak
In reply to Greg Kroah-HartmanFrom: Ye Bin <[email protected]>
commit e0d5fc7a6d80ac2406c7dfc6bb625201d0250a8a upstream.
As in 'jbd2_fc_wait_bufs' if buffer isn't uptodate, will return -EIO without update 'journal->j_fc_off'. But 'jbd2_fc_release_bufs' will release buffer head from ‘j_fc_off - 1’ if 'bh' is NULL will terminal release which will lead to buffer head buffer head reference count leak.
To solve above issue, update 'journal->j_fc_off' before return -EIO.
--- fs/jbd2/journal.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/jbd2/journal.c +7 -1
@@ -926,8 +926,14 @@ int jbd2_fc_wait_bufs(journal_t *journalwait_on_buffer (bh);put_bh (bh); journal->j_fc_wbuf[i] =NULL ; -if (unlikely (!buffer_uptodate (bh))) +/* +* Update j_fc_off so jbd2_fc_release_bufs can release remain +* buffer head. +*/ +if (unlikely (!buffer_uptodate (bh))) { + journal->j_fc_off = i;return -EIO ; + } }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 90/530 jbd2: fix potential use-after-free in jbd2_fc_wait_bufs
In reply to Greg Kroah-HartmanFrom: Ye Bin <[email protected]>
commit 243d1a5d505d0b0460c9af0ad56ed4a56ef0bebd upstream.
In 'jbd2_fc_wait_bufs' use 'bh' after put buffer head reference count which may lead to use-after-free.
So judge buffer if uptodate before put buffer head reference count.
--- fs/jbd2/journal.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/jbd2/journal.c +3 -3
@@ -924,16 +924,16 @@ int jbd2_fc_wait_bufs(journal_t *journalfor (i = j_fc_off -1 ; i >= j_fc_off - num_blks; i--) { bh = journal->j_fc_wbuf[i];wait_on_buffer (bh); -put_bh (bh); - journal->j_fc_wbuf[i] =NULL ;/* * Update j_fc_off so jbd2_fc_release_bufs can release remain * buffer head. */ if (unlikely (!buffer_uptodate (bh))) { - journal->j_fc_off = i; + journal->j_fc_off = i +1 ;return -EIO ; } +put_bh (bh); + journal->j_fc_wbuf[i] =NULL ; }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 91/530 jbd2: add miss release buffer head in fc_do_one_pass()
In reply to Greg Kroah-HartmanFrom: Ye Bin <[email protected]>
commit dfff66f30f66b9524b661f311bbed8ff3d2ca49f upstream.
In fc_do_one_pass() miss release buffer head after use which will lead to reference count leak.
--- fs/jbd2/recovery.c | 1 + 1 file changed, 1 insertion(+)
fs/jbd2/recovery.c +1 -0
@@ -256,6 +256,7 @@ static int fc_do_one_pass(journal_t *jou err = journal->j_fc_replay_callback (journal, bh, pass, next_fc_block - journal->j_fc_first, expected_commit_id); +brelse (bh); next_fc_block++;if (err <0 || err ==JBD2_FC_REPLAY_STOP )break ;
Greg Kroah-Hartman
maintainerPATCH 92/530 ext4: avoid crash when inline data creation follows DIO write
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
commit 4bb26f2885ac6930984ee451b952c5a6042f2c0e upstream.
When inode is created and written to using direct IO, there is nothing to clear the EXT4_STATE_MAY_INLINE_DATA flag. Thus when inode gets truncated later to say 1 byte and written using normal write, we will try to store the data as inline data. This confuses the code later because the inode now has both normal block and inline data allocated and the confusion manifests for example as:
kernel BUG at fs/ext4/inode.c:2721!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 359 Comm: repro Not tainted 5.19.0-rc8-00001-g31ba1e3b8305-dirty #15 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.fc36 04/01/2014 RIP: 0010:ext4_writepages+0x363d/0x3660 RSP: 0018:ffffc90000ccf260 EFLAGS: 00010293 RAX: ffffffff81e1abcd RBX: 0000008000000000 RCX: ffff88810842a180 RDX: 0000000000000000 RSI: 0000008000000000 RDI: 0000000000000000 RBP: ffffc90000ccf650 R08: ffffffff81e17d58 R09: ffffed10222c680b R10: dfffe910222c680c R11: 1ffff110222c680a R12: ffff888111634128 R13: ffffc90000ccf880 R14: 0000008410000000 R15: 0000000000000001 FS: 00007f72635d2640(0000) GS:ffff88811b000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000565243379180 CR3: 000000010aa74000 CR4: 0000000000150eb0 Call Trace: <TASK> do_writepages+0x397/0x640 filemap_fdatawrite_wbc+0x151/0x1b0 file_write_and_wait_range+0x1c9/0x2b0 ext4_sync_file+0x19e/0xa00 vfs_fsync_range+0x17b/0x190 ext4_buffered_write_iter+0x488/0x530 ext4_file_write_iter+0x449/0x1b90 vfs_write+0xbcd/0xf40 ksys_write+0x198/0x2c0 __x64_sys_write+0x7b/0x90 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK>
Fix the problem by clearing EXT4_STATE_MAY_INLINE_DATA when we are doing direct IO write to a file.
--- fs/ext4/file.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/ext4/file.c +6 -0
@@ -528,6 +528,12 @@ static ssize_t ext4_dio_write_iter(struc ret = -EAGAIN ; goto out; } +/* +* Make sure inline data cannot be created anymore since we are going +* to allocate blocks for DIO. We know the inode does not have any +* inline data now because ext4_dio_supported() checked for that. +*/ +ext4_clear_inode_state (inode,EXT4_STATE_MAY_INLINE_DATA ); offset = iocb->ki_pos; count = ret;
Greg Kroah-Hartman
maintainerPATCH 93/530 ext4: fix null-ptr-deref in ext4_write_info
In reply to Greg Kroah-HartmanFrom: Baokun Li <[email protected]>
commit f9c1f248607d5546075d3f731e7607d5571f2b60 upstream.
I caught a null-ptr-deref bug as follows:
==================================================================
KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f] CPU: 1 PID: 1589 Comm: umount Not tainted 5.10.0-02219-dirty #339 RIP: 0010:ext4_write_info+0x53/0x1b0 [...] Call Trace: dquot_writeback_dquots+0x341/0x9a0 ext4_sync_fs+0x19e/0x800 __sync_filesystem+0x83/0x100 sync_filesystem+0x89/0xf0 generic_shutdown_super+0x79/0x3e0 kill_block_super+0xa1/0x110 deactivate_locked_super+0xac/0x130 deactivate_super+0xb6/0xd0 cleanup_mnt+0x289/0x400 __cleanup_mnt+0x16/0x20 task_work_run+0x11c/0x1c0 exit_to_user_mode_prepare+0x203/0x210 syscall_exit_to_user_mode+0x5b/0x3a0 do_syscall_64+0x59/0x70 entry_SYSCALL_64_after_hwframe+0x44/0xa9 ==================================================================
Above issue may happen as follows:
-------------------------------------exit_to_user_mode_prepare
task_work_run
__cleanup_mnt
cleanup_mnt
deactivate_super
deactivate_locked_super
kill_block_super
generic_shutdown_super
shrink_dcache_for_umount
dentry = sb->s_root
sb->s_root = NULL <--- Here set NULL
sync_filesystem
__sync_filesystem
sb->s_op->sync_fs > ext4_sync_fs
dquot_writeback_dquots
sb->dq_op->write_info > ext4_write_info
ext4_journal_start(d_inode(sb->s_root), EXT4_HT_QUOTA, 2)
d_inode(sb->s_root)
s_root->d_inode <--- Null pointer dereferenceTo solve this problem, we use ext4_journal_start_sb directly to avoid s_root being used.
--- fs/ext4/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/super.c +1 -1
@@ -6207,7 +6207,7 @@ static int ext4_write_info(struct super_handle_t *handle;/* Data block + inode block */ - handle =ext4_journal_start (d_inode (sb->s_root),EXT4_HT_QUOTA ,2 ); + handle =ext4_journal_start_sb (sb,EXT4_HT_QUOTA ,2 );if (IS_ERR (handle))return PTR_ERR (handle); ret =dquot_commit_info (sb, type);
Greg Kroah-Hartman
maintainerPATCH 94/530 ext4: make ext4_lazyinit_thread freezable
In reply to Greg Kroah-HartmanFrom: Lalith Rajendran <[email protected]>
commit 3b575495ab8dbb4dbe85b4ac7f991693c3668ff5 upstream.
ext4_lazyinit_thread is not set freezable. Hence when the thread calls try_to_freeze it doesn't freeze during suspend and continues to send requests to the storage during suspend, resulting in suspend failures.
--- fs/ext4/super.c | 1 + 1 file changed, 1 insertion(+)
fs/ext4/super.c +1 -0
@@ -3377,6 +3377,7 @@ static int ext4_lazyinit_thread(void *arunsigned long next_wakeup, cur;BUG_ON (NULL == eli); +set_freezable (); cont_thread:while (true) {
Greg Kroah-Hartman
maintainerPATCH 95/530 ext4: fix check for block being out of directory size
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
commit 61a1d87a324ad5e3ed27c6699dfc93218fcf3201 upstream.
The check in __ext4_read_dirblock() for block being outside of directory size was wrong because it compared block number against directory size in bytes. Fix it.
CVE: CVE-2022-1184
--- fs/ext4/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/namei.c +1 -1
@@ -126,7 +126,7 @@ static struct buffer_head *__ext4_read_dstruct ext4_dir_entry *dirent;int is_dx_block =0 ; -if (block >= inode->i_size) { +if (block >= inode->i_size >> inode->i_blkbits) {ext4_error_inode (inode, func, line, block,"Attempting to read directory block (%u) that is past i_size (%llu)" , block, inode->i_size);
Greg Kroah-Hartman
maintainerPATCH 96/530 ext4: dont increase iversion counter for ea_inodes
In reply to Greg Kroah-HartmanFrom: Lukas Czerner <[email protected]>
commit 50f094a5580e6297bf10a807d16f0ee23fa576cf upstream.
ea_inodes are using i_version for storing part of the reference count so we really need to leave it alone.
The problem can be reproduced by xfstest ext4/026 when iversion is enabled. Fix it by not calling inode_inc_iversion() for EXT4_EA_INODE_FL inodes in ext4_mark_iloc_dirty().
--- fs/ext4/inode.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/ext4/inode.c +6 -1
@@ -5701,7 +5701,12 @@ int ext4_mark_iloc_dirty(handle_t *handl }ext4_fc_track_inode (handle, inode); -if (IS_I_VERSION (inode)) +/* +* ea_inodes are using i_version for storing reference count, don't +* mess with it +*/ +if (IS_I_VERSION (inode) && + !(EXT4_I (inode)->i_flags &EXT4_EA_INODE_FL ))inode_inc_iversion (inode);/* the do_update_inode consumes one bh->b_count */
Greg Kroah-Hartman
maintainerPATCH 97/530 ext4: ext4_read_bh_lock() should submit IO if the buffer isnt uptodate
In reply to Greg Kroah-HartmanFrom: Zhang Yi <[email protected]>
commit 0b73284c564d3ae4feef4bc920292f004acf4980 upstream.
Recently we notice that ext4 filesystem would occasionally fail to read metadata from disk and report error message, but the disk and block layer looks fine. After analyse, we lockon commit 88dbcbb3a484 ("blkdev: avoid migration stalls for blkdev pages"). It provide a migration method for the bdev, we could move page that has buffers without extra users now, but it lock the buffers on the page, which breaks the fragile metadata read operation on ext4 filesystem, ext4_read_bh_lock() was copied from ll_rw_block(), it depends on the assumption of that locked buffer means it is under IO. So it just trylock the buffer and skip submit IO if it lock failed, after wait_on_buffer() we conclude IO error because the buffer is not uptodate.
This issue could be easily reproduced by add some delay just after buffer_migrate_lock_buffers() in __buffer_migrate_folio() and do fsstress on ext4 filesystem.
EXT4-fs error (device pmem1): __ext4_find_entry:1658: inode #73193:
comm fsstress: reading directory lblock 0
EXT4-fs error (device pmem1): __ext4_find_entry:1658: inode #75334:
comm fsstress: reading directory lblock 0
Fix it by removing the trylock logic in ext4_read_bh_lock(), just lock the buffer and submit IO if it's not uptodate, and also leave over readahead helper.
--- fs/ext4/super.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-)
fs/ext4/super.c +5 -11
@@ -186,19 +186,12 @@ int ext4_read_bh(struct buffer_head *bh,int ext4_read_bh_lock (struct buffer_head *bh,int op_flags,bool wait) { -if (trylock_buffer (bh)) { -if (wait) -return ext4_read_bh (bh, op_flags,NULL ); +lock_buffer (bh); +if (!wait) {ext4_read_bh_nowait (bh, op_flags,NULL );return 0 ; } -if (wait) { -wait_on_buffer (bh); -if (buffer_uptodate (bh)) -return 0 ; -return -EIO ; - } -return 0 ; +return ext4_read_bh (bh, op_flags,NULL ); }/*
@@ -245,7 +238,8 @@ void ext4_sb_breadahead_unmovable(structstruct buffer_head *bh =sb_getblk_gfp (sb, block,0 );if (likely (bh)) { -ext4_read_bh_lock (bh,REQ_RAHEAD , false); +if (trylock_buffer (bh)) +ext4_read_bh_nowait (bh,REQ_RAHEAD ,NULL );brelse (bh); } }
Greg Kroah-Hartman
maintainerPATCH 98/530 ext4: place buffer head allocation before handle start
In reply to Greg Kroah-HartmanFrom: Jinke Han <[email protected]>
commit d1052d236eddf6aa851434db1897b942e8db9921 upstream.
In our product environment, we encounter some jbd hung waiting handles to stop while several writters were doing memory reclaim for buffer head allocation in delay alloc write path. Ext4 do buffer head allocation with holding transaction handle which may be blocked too long if the reclaim works not so smooth. According to our bcc trace, the reclaim time in buffer head allocation can reach 258s and the jbd transaction commit also take almost the same time meanwhile. Except for these extreme cases, we often see several seconds delays for cgroup memory reclaim on our servers. This is more likely to happen considering docker environment.
One thing to note, the allocation of buffer heads is as often as page allocation or more often when blocksize less than page size. Just like page cache allocation, we should also place the buffer head allocation before startting the handle.
--- fs/ext4/inode.c | 7 +++++++ 1 file changed, 7 insertions(+)
fs/ext4/inode.c +7 -0
@@ -1177,6 +1177,13 @@ retry_grab: page =grab_cache_page_write_begin (mapping, index, flags);if (!page)return -ENOMEM ; +/* +* The same as page allocation, we prealloc buffer heads before +* starting the handle. +*/ +if (!page_has_buffers (page)) +create_empty_buffers (page, inode->i_sb->s_blocksize,0 ); +unlock_page (page); retry_journal:
Greg Kroah-Hartman
maintainerPATCH 99/530 ext4: fix dir corruption when ext4_dx_add_entry() fails
In reply to Greg Kroah-HartmanFrom: Zhihao Cheng <[email protected]>
commit 7177dd009c7c04290891e9a534cd47d1b620bd04 upstream.
Following process may lead to fs corruption:
1. ext4_create(dir/foo)
ext4_add_nondir
ext4_add_entry
ext4_dx_add_entry
a. add_dirent_to_buf
ext4_mark_inode_dirty
ext4_handle_dirty_metadata // dir inode bh is recorded into journal
b. ext4_append // dx_get_count(entries) == dx_get_limit(entries)
ext4_bread(EXT4_GET_BLOCKS_CREATE)
ext4_getblk
ext4_map_blocks
ext4_ext_map_blocks
ext4_mb_new_blocks
dquot_alloc_block
dquot_alloc_space_nodirty
inode_add_bytes // update dir's i_blocks
ext4_ext_insert_extent
ext4_ext_dirty // record extent bh into journal
ext4_handle_dirty_metadata(bh)
// record new block into journal
inode->i_size += inode->i_sb->s_blocksize // new size(in mem)
c. ext4_handle_dirty_dx_node(bh2)
// record dir's new block(dx_node) into journal
d. ext4_handle_dirty_dx_node((frame - 1)->bh)
e. ext4_handle_dirty_dx_node(frame->bh)
f. do_split // ret err!
g. add_dirent_to_buf
ext4_mark_inode_dirty(dir) // update raw_inode on disk(skipped)2. fsck -a /dev/sdb
drop last block(dx_node) which beyonds dir's i_size.
/dev/sdb: recovering journal
/dev/sdb contains a file system with errors, check forced. /dev/sdb: Inode 12, end of extent exceeds allowed value
(logical block 128, physical block 3938, len 1)
3. fsck -fn /dev/sdb
dx_node->entry[i].blk > dir->i_size
Pass 2: Checking directory structure
Problem in HTREE directory inode 12 (/dir): bad block number 128. Clear HTree index? no
Problem in HTREE directory inode 12: block #3 has invalid depth (2) Problem in HTREE directory inode 12: block #3 has bad max hash Problem in HTREE directory inode 12: block #3 not referenced
Fix it by marking inode dirty directly inside ext4_append(). Fetch a reproducer in [Link].
--- fs/ext4/namei.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
fs/ext4/namei.c +10 -5
@@ -85,15 +85,20 @@ static struct buffer_head *ext4_append(hreturn bh; inode->i_size += inode->i_sb->s_blocksize;EXT4_I (inode)->i_disksize = inode->i_size; + err =ext4_mark_inode_dirty (handle, inode); +if (err) + goto out;BUFFER_TRACE (bh,"get_write_access" ); err =ext4_journal_get_write_access (handle, inode->i_sb, bh,EXT4_JTR_NONE ); -if (err) { -brelse (bh); -ext4_std_error (inode->i_sb, err); -return ERR_PTR (err); - } +if (err) + goto out;return bh; + +out: +brelse (bh); +ext4_std_error (inode->i_sb, err); +return ERR_PTR (err); } static int ext4_dx_csum_verify(struct inode *inode,
Greg Kroah-Hartman
maintainerPATCH 100/530 ext4: fix miss release buffer head in ext4_fc_write_inode
In reply to Greg Kroah-HartmanFrom: Ye Bin <[email protected]>
commit ccbf8eeb39f2ff00b54726a2b20b35d788c4ecb5 upstream.
In 'ext4_fc_write_inode' function first call 'ext4_get_inode_loc' get 'iloc', after use it miss release 'iloc.bh'.
So just release 'iloc.bh' before 'ext4_fc_write_inode' return.
--- fs/ext4/fast_commit.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
fs/ext4/fast_commit.c +9 -6
@@ -794,22 +794,25 @@ static int ext4_fc_write_inode(struct in tl.fc_tag =cpu_to_le16 (EXT4_FC_TAG_INODE ); tl.fc_len =cpu_to_le16 (inode_len +sizeof (fc_inode.fc_ino)); + ret = -ECANCELED ; dst =ext4_fc_reserve_space (inode->i_sb,sizeof (tl) + inode_len +sizeof (fc_inode.fc_ino), crc);if (!dst) -return -ECANCELED ; + goto err;if (!ext4_fc_memcpy (inode->i_sb, dst, &tl,sizeof (tl), crc)) -return -ECANCELED ; + goto err; dst +=sizeof (tl);if (!ext4_fc_memcpy (inode->i_sb, dst, &fc_inode,sizeof (fc_inode), crc)) -return -ECANCELED ; + goto err; dst +=sizeof (fc_inode);if (!ext4_fc_memcpy (inode->i_sb, dst, (u8 *)ext4_raw_inode (&iloc), inode_len, crc)) -return -ECANCELED ; - -return 0 ; + goto err; + ret =0 ; +err: +brelse (iloc.bh); +return ret; }/*
Greg Kroah-Hartman
maintainerPATCH 101/530 ext4: fix potential memory leak in ext4_fc_record_modified_inode()
In reply to Greg Kroah-HartmanFrom: Ye Bin <[email protected]>
commit 9305721a309fa1bd7c194e0d4a2335bf3b29dca4 upstream.
As krealloc may return NULL, in this case 'state->fc_modified_inodes' may not be freed by krealloc, but 'state->fc_modified_inodes' already set NULL. Then will lead to 'state->fc_modified_inodes' memory leak.
--- fs/ext4/fast_commit.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
fs/ext4/fast_commit.c +5 -3
@@ -1414,13 +1414,15 @@ static int ext4_fc_record_modified_inodeif (state->fc_modified_inodes[i] == ino)return 0 ;if (state->fc_modified_inodes_used == state->fc_modified_inodes_size) { - state->fc_modified_inodes =krealloc ( - state->fc_modified_inodes, +int *fc_modified_inodes; + + fc_modified_inodes =krealloc (state->fc_modified_inodes,sizeof (int ) * (state->fc_modified_inodes_size +EXT4_FC_REPLAY_REALLOC_INCREMENT ),GFP_KERNEL ); -if (!state->fc_modified_inodes) +if (!fc_modified_inodes)return -ENOMEM ; + state->fc_modified_inodes = fc_modified_inodes; state->fc_modified_inodes_size +=EXT4_FC_REPLAY_REALLOC_INCREMENT ; }
Greg Kroah-Hartman
maintainerPATCH 102/530 ext4: fix potential memory leak in ext4_fc_record_regions()
In reply to Greg Kroah-HartmanFrom: Ye Bin <[email protected]>
commit 7069d105c1f15c442b68af43f7fde784f3126739 upstream.
As krealloc may return NULL, in this case 'state->fc_regions' may not be freed by krealloc, but 'state->fc_regions' already set NULL. Then will lead to 'state->fc_regions' memory leak.
--- fs/ext4/fast_commit.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
fs/ext4/fast_commit.c +8 -6
@@ -1607,15 +1607,17 @@ int ext4_fc_record_regions(struct super_if (replay && state->fc_regions_used != state->fc_regions_valid) state->fc_regions_used = state->fc_regions_valid;if (state->fc_regions_used == state->fc_regions_size) { +struct ext4_fc_alloc_region *fc_regions; + state->fc_regions_size +=EXT4_FC_REPLAY_REALLOC_INCREMENT ; - state->fc_regions =krealloc ( - state->fc_regions, - state->fc_regions_size * -sizeof (struct ext4_fc_alloc_region ), -GFP_KERNEL ); -if (!state->fc_regions) + fc_regions =krealloc (state->fc_regions, + state->fc_regions_size * +sizeof (struct ext4_fc_alloc_region ), +GFP_KERNEL ); +if (!fc_regions)return -ENOMEM ; + state->fc_regions = fc_regions; } region = &state->fc_regions[state->fc_regions_used++]; region->ino = ino;
Greg Kroah-Hartman
maintainerPATCH 103/530 ext4: update state->fc_regions_size after successful memory allocation
In reply to Greg Kroah-HartmanFrom: Ye Bin <[email protected]>
commit 27cd49780381c6ccbf248798e5e8fd076200ffba upstream.
To avoid to 'state->fc_regions_size' mismatch with 'state->fc_regions' when fail to reallocate 'fc_reqions',only update 'state->fc_regions_size' after 'state->fc_regions' is allocated successfully.
--- fs/ext4/fast_commit.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
fs/ext4/fast_commit.c +5 -4
@@ -1609,14 +1609,15 @@ int ext4_fc_record_regions(struct super_if (state->fc_regions_used == state->fc_regions_size) {struct ext4_fc_alloc_region *fc_regions; - state->fc_regions_size += -EXT4_FC_REPLAY_REALLOC_INCREMENT ; fc_regions =krealloc (state->fc_regions, - state->fc_regions_size * -sizeof (struct ext4_fc_alloc_region ), +sizeof (struct ext4_fc_alloc_region ) * + (state->fc_regions_size + +EXT4_FC_REPLAY_REALLOC_INCREMENT ),GFP_KERNEL );if (!fc_regions)return -ENOMEM ; + state->fc_regions_size += +EXT4_FC_REPLAY_REALLOC_INCREMENT ; state->fc_regions = fc_regions; } region = &state->fc_regions[state->fc_regions_used++];
Greg Kroah-Hartman
maintainerPATCH 104/530 livepatch: fix race between fork and KLP transition
In reply to Greg Kroah-HartmanFrom: Rik van Riel <[email protected]>
commit 747f7a2901174c9afa805dddfb7b24db6f65e985 upstream.
The KLP transition code depends on the TIF_PATCH_PENDING and the task->patch_state to stay in sync. On a normal (forward) transition, TIF_PATCH_PENDING will be set on every task in the system, while on a reverse transition (after a failed forward one) first TIF_PATCH_PENDING will be cleared from every task, followed by it being set on tasks that need to be transitioned back to the original code.
However, the fork code copies over the TIF_PATCH_PENDING flag from the parent to the child early on, in dup_task_struct and setup_thread_stack. Much later, klp_copy_process will set child->patch_state to match that of the parent.
However, the parent's patch_state may have been changed by KLP loading or unloading since it was initially copied over into the child.
This results in the KLP code occasionally hitting this warning in klp_complete_transition:
for_each_process_thread(g, task) {
WARN_ON_ONCE(test_tsk_thread_flag(task, TIF_PATCH_PENDING));
task->patch_state = KLP_UNDEFINED;
}Set, or clear, the TIF_PATCH_PENDING flag in the child task depending on whether or not it is needed at the time klp_copy_process is called, at a point in copy_process where the tasklist_lock is held exclusively, preventing races with the KLP code.
The KLP code does have a few places where the state is changed without the tasklist_lock held, but those should not cause problems because klp_update_patch_state(current) cannot be called while the current task is in the middle of fork, klp_check_and_switch_task() which is called under the pi_lock, which prevents rescheduling, and manipulation of the patch state of idle tasks, which do not fork.
This should prevent this warning from triggering again in the future, and close the race for both normal and reverse transitions.
--- kernel/livepatch/transition.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
kernel/livepatch/transition.c +16 -2
@@ -610,9 +610,23 @@ void klp_reverse_transition(void)/* Called from copy_process() during fork */ void klp_copy_process (struct task_struct *child) { - child->patch_state = current->patch_state; -/* TIF_PATCH_PENDING gets copied in setup_thread_stack() */ +/* +* The parent process may have gone through a KLP transition since +* the thread flag was copied in setup_thread_stack earlier. Bring +* the task flag up to date with the parent here. +* +* The operation is serialized against all klp_*_transition() +* operations by the tasklist_lock. The only exception is +* klp_update_patch_state(current), but we cannot race with +* that because we are current. +*/ +if (test_tsk_thread_flag (current,TIF_PATCH_PENDING )) +set_tsk_thread_flag (child,TIF_PATCH_PENDING ); +else +clear_tsk_thread_flag (child,TIF_PATCH_PENDING ); + + child->patch_state = current->patch_state; }/*
Greg Kroah-Hartman
maintainerPATCH 105/530 ftrace: Properly unset FTRACE_HASH_FL_MOD
In reply to Greg Kroah-HartmanFrom: Zheng Yejian <[email protected]>
commit 0ce0638edf5ec83343302b884fa208179580700a upstream.
When executing following commands like what document said, but the log "#### all functions enabled ####" was not shown as expect:
1. Set a 'mod' filter:
$ echo 'write*:mod:ext3' > /sys/kernel/tracing/set_ftrace_filter
2. Invert above filter:
$ echo '!write*:mod:ext3' >> /sys/kernel/tracing/set_ftrace_filter
3. Read the file:
$ cat /sys/kernel/tracing/set_ftrace_filterBy some debugging, I found that flag FTRACE_HASH_FL_MOD was not unset after inversion like above step 2 and then result of ftrace_hash_empty() is incorrect.
--- kernel/trace/ftrace.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
kernel/trace/ftrace.c +6 -2
@@ -5654,8 +5654,12 @@ int ftrace_regex_release(struct inode *iif (filter_hash) { orig_hash = &iter->ops->func_hash->filter_hash; -if (iter->tr && !list_empty (&iter->tr->mod_trace)) - iter->hash->flags |=FTRACE_HASH_FL_MOD ; +if (iter->tr) { +if (list_empty (&iter->tr->mod_trace)) + iter->hash->flags &= ~FTRACE_HASH_FL_MOD ; +else + iter->hash->flags |=FTRACE_HASH_FL_MOD ; + } }else orig_hash = &iter->ops->func_hash->notrace_hash;
Greg Kroah-Hartman
maintainerPATCH 106/530 ring-buffer: Allow splice to read previous partially read pages
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (Google) <[email protected]>
commit fa8f4a89736b654125fb254b0db753ac68a5fced upstream.
If a page is partially read, and then the splice system call is run against the ring buffer, it will always fail to read, no matter how much is in the ring buffer. That's because the code path for a partial read of the page does will fail if the "full" flag is set.
The splice system call wants full pages, so if the read of the ring buffer is not yet full, it should return zero, and the splice will block. But if a previous read was done, where the beginning has been consumed, it should still be given to the splice caller if the rest of the page has been written to.
This caused the splice command to never consume data in this scenario, and let the ring buffer just fill up and lose events.
--- kernel/trace/ring_buffer.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
kernel/trace/ring_buffer.c +9 -1
@@ -5574,7 +5574,15 @@ int ring_buffer_read_page(struct trace_bunsigned int pos =0 ;unsigned int size; -if (full) +/* +* If a full page is expected, this can still be returned +* if there's been a previous partial read and the +* rest of the page can be read and the commit page is off +* the reader page. +*/ +if (full && + (!read || (len < (commit - read)) || + cpu_buffer->reader_page == cpu_buffer->commit_page)) goto out_unlock;if (len > (commit - read))
Greg Kroah-Hartman
maintainerPATCH 107/530 ring-buffer: Have the shortest_full queue be the shortest not longest
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (Google) <[email protected]>
commit 3b19d614b61b93a131f463817e08219c9ce1fee3 upstream.
The logic to know when the shortest waiters on the ring buffer should be woken up or not has uses a less than instead of a greater than compare, which causes the shortest_full to actually be the longest.
--- kernel/trace/ring_buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/ring_buffer.c +1 -1
@@ -975,7 +975,7 @@ int ring_buffer_wait(struct trace_buffer nr_pages = cpu_buffer->nr_pages; dirty =ring_buffer_nr_dirty_pages (buffer, cpu);if (!cpu_buffer->shortest_full || - cpu_buffer->shortest_full < full) + cpu_buffer->shortest_full > full) cpu_buffer->shortest_full = full;raw_spin_unlock_irqrestore (&cpu_buffer->reader_lock, flags); if (!pagebusy &&
Greg Kroah-Hartman
maintainerPATCH 108/530 ring-buffer: Check pending waiters when doing wake ups as well
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (Google) <[email protected]>
commit ec0bbc5ec5664dcee344f79373852117dc672c86 upstream.
The wake up waiters only checks the "wakeup_full" variable and not the "full_waiters_pending". The full_waiters_pending is set when a waiter is added to the wait queue. The wakeup_full is only set when an event is triggered, and it clears the full_waiters_pending to avoid multiple calls to irq_work_queue().
The irq_work callback really needs to check both wakeup_full as well as full_waiters_pending such that this code can be used to wake up waiters when a file is closed that represents the ring buffer and the waiters need to be woken up.
--- kernel/trace/ring_buffer.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/trace/ring_buffer.c +2 -1
@@ -881,8 +881,9 @@ static void rb_wake_up_waiters(struct ir struct rb_irq_work *rbwork = container_of(work, struct rb_irq_work, work);wake_up_all (&rbwork->waiters); -if (rbwork->wakeup_full) { +if (rbwork->full_waiters_pending || rbwork->wakeup_full) { rbwork->wakeup_full = false; + rbwork->full_waiters_pending = false;wake_up_all (&rbwork->full_waiters); } }
Greg Kroah-Hartman
maintainerPATCH 109/530 ring-buffer: Add ring_buffer_wake_waiters()
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (Google) <[email protected]>
commit 7e9fbbb1b776d8d7969551565bc246f74ec53b27 upstream.
On closing of a file that represents a ring buffer or flushing the file, there may be waiters on the ring buffer that needs to be woken up and exit the ring_buffer_wait() function.
Add ring_buffer_wake_waiters() to wake up the waiters on the ring buffer and allow them to exit the wait loop.
--- include/linux/ring_buffer.h | 2 +- kernel/trace/ring_buffer.c | 39 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 40 insertions(+), 1 deletion(-)
include/linux/ring_buffer.h +1 -1
@@ -101,7 +101,7 @@ __ring_buffer_alloc(unsigned long size,int ring_buffer_wait (struct trace_buffer *buffer,int cpu,int full);__poll_t ring_buffer_poll_wait (struct trace_buffer *buffer,int cpu,struct file *filp,poll_table *poll_table); - +void ring_buffer_wake_waiters (struct trace_buffer *buffer,int cpu);#define RING_BUFFER_ALL_CPUS -1
kernel/trace/ring_buffer.c +39 -0
@@ -405,6 +405,7 @@ struct rb_irq_work {struct irq_work work;wait_queue_head_t waiters;wait_queue_head_t full_waiters; +long wait_index;bool waiters_pending;bool full_waiters_pending;bool wakeup_full;
@@ -889,6 +890,37 @@ static void rb_wake_up_waiters(struct ir }/** +* ring_buffer_wake_waiters - wake up any waiters on this ring buffer +* @buffer: The ring buffer to wake waiters on +* +* In the case of a file that represents a ring buffer is closing, +* it is prudent to wake up any waiters that are on this. +*/ +void ring_buffer_wake_waiters (struct trace_buffer *buffer,int cpu) +{ +struct ring_buffer_per_cpu *cpu_buffer; +struct rb_irq_work *rbwork; + +if (cpu ==RING_BUFFER_ALL_CPUS ) { + +/* Wake up individual ones too. One level recursion */ +for_each_buffer_cpu (buffer, cpu) +ring_buffer_wake_waiters (buffer, cpu); + + rbwork = &buffer->irq_work; + }else { + cpu_buffer = buffer->buffers[cpu]; + rbwork = &cpu_buffer->irq_work; + } + + rbwork->wait_index++; +/* make sure the waiters see the new index */ +smp_wmb (); + +rb_wake_up_waiters (&rbwork->work); +} + +/** * ring_buffer_wait - wait for input to the ring buffer * @buffer: buffer to wait on * @cpu: the cpu buffer to wait on
@@ -903,6 +935,7 @@ int ring_buffer_wait(struct trace_bufferstruct ring_buffer_per_cpu *cpu_buffer;DEFINE_WAIT (wait);struct rb_irq_work *work; +long wait_index;int ret =0 ;/*
@@ -921,6 +954,7 @@ int ring_buffer_wait(struct trace_buffer work = &cpu_buffer->irq_work; } + wait_index =READ_ONCE (work->wait_index);while (true) {if (full)
@@ -985,6 +1019,11 @@ int ring_buffer_wait(struct trace_buffer }schedule (); + +/* Make sure to see the new wait index */ +smp_rmb (); +if (wait_index != work->wait_index) +break ; }if (full)
Greg Kroah-Hartman
maintainerPATCH 110/530 ring-buffer: Fix race between reset page and reading page
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (Google) <[email protected]>
commit a0fcaaed0c46cf9399d3a2d6e0c87ddb3df0e044 upstream.
The ring buffer is broken up into sub buffers (currently of page size). Each sub buffer has a pointer to its "tail" (the last event written to the sub buffer). When a new event is requested, the tail is locally incremented to cover the size of the new event. This is done in a way that there is no need for locking.
If the tail goes past the end of the sub buffer, the process of moving to the next sub buffer takes place. After setting the current sub buffer to the next one, the previous one that had the tail go passed the end of the sub buffer needs to be reset back to the original tail location (before the new event was requested) and the rest of the sub buffer needs to be "padded".
The race happens when a reader takes control of the sub buffer. As readers do a "swap" of sub buffers from the ring buffer to get exclusive access to the sub buffer, it replaces the "head" sub buffer with an empty sub buffer that goes back into the writable portion of the ring buffer. This swap can happen as soon as the writer moves to the next sub buffer and before it updates the last sub buffer with padding.
Because the sub buffer can be released to the reader while the writer is still updating the padding, it is possible for the reader to see the event that goes past the end of the sub buffer. This can cause obvious issues.
To fix this, add a few memory barriers so that the reader definitely sees the updates to the sub buffer, and also waits until the writer has put back the "tail" of the sub buffer back to the last event that was written on it.
To be paranoid, it will only spin for 1 second, otherwise it will warn and shutdown the ring buffer code. 1 second should be enough as the writer does have preemption disabled. If the writer doesn't move within 1 second (with preemption disabled) something is horribly wrong. No interrupt should last 1 second!
--- kernel/trace/ring_buffer.c | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+)
kernel/trace/ring_buffer.c +33 -0
@@ -2612,6 +2612,9 @@ rb_reset_tail(struct ring_buffer_per_cpu/* Mark the rest of the page with padding */ rb_event_set_padding (event); +/* Make sure the padding is visible before the write update */ +smp_wmb (); +/* Set the write back to the previous setting */ local_sub (length, &tail_page->write);return ;
@@ -2623,6 +2626,9 @@ rb_reset_tail(struct ring_buffer_per_cpu/* time delta must be non zero */ event->time_delta =1 ; +/* Make sure the padding is visible before the tail_page->write update */ +smp_wmb (); +/* Set write to end of buffer */ length = (tail + length) -BUF_PAGE_SIZE ;local_sub (length, &tail_page->write);
@@ -4587,6 +4593,33 @@ rb_get_reader_page(struct ring_buffer_pearch_spin_unlock (&cpu_buffer->lock);local_irq_restore (flags); +/* +* The writer has preempt disable, wait for it. But not forever +* Although, 1 second is pretty much "forever" +*/ +#define USECS_WAIT 1000000 +for (nr_loops =0 ; nr_loops <USECS_WAIT ; nr_loops++) { +/* If the write is past the end of page, a writer is still updating it */ +if (likely (!reader ||rb_page_write (reader) <=BUF_PAGE_SIZE )) +break ; + +udelay (1 ); + +/* Get the latest version of the reader write value */ +smp_rmb (); + } + +/* The writer is not moving forward? Something is wrong */ +if (RB_WARN_ON (cpu_buffer, nr_loops ==USECS_WAIT )) + reader =NULL ; + +/* +* Make sure we see any padding after the write update +* (see rb_reset_tail()) +*/ +smp_rmb (); + +return reader; }
Greg Kroah-Hartman
maintainerPATCH 111/530 tracing: Disable interrupt or preemption before acquiring arch_spinlock_t
In reply to Greg Kroah-HartmanFrom: Waiman Long <[email protected]>
commit c0a581d7126c0bbc96163276f585fd7b4e4d8d0e upstream.
It was found that some tracing functions in kernel/trace/trace.c acquire an arch_spinlock_t with preemption and irqs enabled. An example is the tracing_saved_cmdlines_size_read() function which intermittently causes a "BUG: using smp_processor_id() in preemptible" warning when the LTP read_all_proc test is run.
That can be problematic in case preemption happens after acquiring the lock. Add the necessary preemption or interrupt disabling code in the appropriate places before acquiring an arch_spinlock_t.
The convention here is to disable preemption for trace_cmdline_lock and interupt for max_lock.
--- kernel/trace/trace.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
kernel/trace/trace.c +23 -0
@@ -1181,12 +1181,14 @@ void *tracing_cond_snapshot_data(struct {void *cond_data =NULL ; +local_irq_disable ();arch_spin_lock (&tr->max_lock);if (tr->cond_snapshot) cond_data = tr->cond_snapshot->cond_data;arch_spin_unlock (&tr->max_lock); +local_irq_enable ();return cond_data; }
@@ -1322,9 +1324,11 @@ int tracing_snapshot_cond_enable(struct goto fail_unlock; } +local_irq_disable ();arch_spin_lock (&tr->max_lock); tr->cond_snapshot = cond_snapshot;arch_spin_unlock (&tr->max_lock); +local_irq_enable ();mutex_unlock (&trace_types_lock);
@@ -1351,6 +1355,7 @@ int tracing_snapshot_cond_disable(struct {int ret =0 ; +local_irq_disable ();arch_spin_lock (&tr->max_lock);if (!tr->cond_snapshot)
@@ -1361,6 +1366,7 @@ int tracing_snapshot_cond_disable(struct }arch_spin_unlock (&tr->max_lock); +local_irq_enable ();return ret; }
@@ -2187,6 +2193,11 @@ static size_t tgid_map_max;#define SAVED_CMDLINES_DEFAULT 128#define NO_CMDLINE_MAP UINT_MAX +/* +* Preemption must be disabled before acquiring trace_cmdline_lock. +* The various trace_arrays' max_lock must be acquired in a context +* where interrupt is disabled. +*/ static arch_spinlock_t trace_cmdline_lock = __ARCH_SPIN_LOCK_UNLOCKED;struct saved_cmdlines_buffer {unsigned map_pid_to_cmdline[PID_MAX_DEFAULT +1 ];
@@ -2399,7 +2410,11 @@ static int trace_save_cmdline(struct tas* the lock, but we also don't want to spin * nor do we want to disable interrupts, * so if we miss here, then better luck next time. +* +* This is called within the scheduler and wake up, so interrupts +* had better been disabled and run queue lock been held. */ +lockdep_assert_preemption_disabled ();if (!arch_spin_trylock (&trace_cmdline_lock))return 0 ;
@@ -5861,9 +5876,11 @@ tracing_saved_cmdlines_size_read(structchar buf[64 ];int r; +preempt_disable ();arch_spin_lock (&trace_cmdline_lock); r =scnprintf (buf,sizeof (buf),"%u\n" , savedcmd->cmdline_num);arch_spin_unlock (&trace_cmdline_lock); +preempt_enable ();return simple_read_from_buffer (ubuf, cnt, ppos, buf, r); }
@@ -5888,10 +5905,12 @@ static int tracing_resize_saved_cmdlinesreturn -ENOMEM ; } +preempt_disable ();arch_spin_lock (&trace_cmdline_lock); savedcmd_temp = savedcmd; savedcmd = s;arch_spin_unlock (&trace_cmdline_lock); +preempt_enable ();free_saved_cmdlines_buffer (savedcmd_temp);return 0 ;
@@ -6344,10 +6363,12 @@ int tracing_set_tracer(struct trace_arra#ifdef CONFIG_TRACER_SNAPSHOT if (t->use_max_tr) { +local_irq_disable ();arch_spin_lock (&tr->max_lock);if (tr->cond_snapshot) ret = -EBUSY ;arch_spin_unlock (&tr->max_lock); +local_irq_enable ();if (ret) goto out; }
@@ -7420,10 +7441,12 @@ tracing_snapshot_write(struct file *filp goto out; } +local_irq_disable ();arch_spin_lock (&tr->max_lock);if (tr->cond_snapshot) ret = -EBUSY ;arch_spin_unlock (&tr->max_lock); +local_irq_enable ();if (ret) goto out;
Greg Kroah-Hartman
maintainerPATCH 112/530 tracing: Wake up ring buffer waiters on closing of the file
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (Google) <[email protected]>
commit f3ddb74ad0790030c9592229fb14d8c451f4e9a8 upstream.
When the file that represents the ring buffer is closed, there may be waiters waiting on more input from the ring buffer. Call ring_buffer_wake_waiters() to wake up any waiters when the file is closed.
--- include/linux/trace_events.h | 1 + kernel/trace/trace.c | 15 +++++++++++++++ 2 files changed, 16 insertions(+)
include/linux/trace_events.h +1 -0
@@ -91,6 +91,7 @@ struct trace_iterator {unsigned int temp_size;char *fmt;/* modified format holder */ unsigned int fmt_size; +long wait_index;/* trace_seq for __print_flags() and __print_symbolic() etc. */ struct trace_seq tmp_seq;
kernel/trace/trace.c +15 -0
@@ -8117,6 +8117,12 @@ static int tracing_buffers_release(struc__trace_array_put (iter->tr); + iter->wait_index++; +/* Make sure the waiters see the new wait_index */ +smp_wmb (); + +ring_buffer_wake_waiters (iter->array_buffer->buffer, iter->cpu_file); +if (info->spare)ring_buffer_free_read_page (iter->array_buffer->buffer, info->spare_cpu, info->spare);
@@ -8270,6 +8276,8 @@ tracing_buffers_splice_read(struct file/* did we read anything? */ if (!spd.nr_pages) { +long wait_index; +if (ret) goto out;
@@ -8277,10 +8285,17 @@ tracing_buffers_splice_read(struct fileif ((file->f_flags &O_NONBLOCK ) || (flags &SPLICE_F_NONBLOCK )) goto out; + wait_index =READ_ONCE (iter->wait_index); + ret =wait_on_pipe (iter, iter->tr->buffer_percent);if (ret) goto out; +/* Make sure we see the new wait_index */ +smp_rmb (); +if (wait_index != iter->wait_index) + goto out; + goto again; }
Greg Kroah-Hartman
maintainerPATCH 113/530 tracing: Wake up waiters when tracing is disabled
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (Google) <[email protected]>
commit 2b0fd9a59b7990c161fa1cb7b79edb22847c87c2 upstream.
When tracing is disabled, there's no reason that waiters should stay waiting, wake them up, otherwise tasks get stuck when they should be flushing the buffers.
--- kernel/trace/trace.c | 6 ++++++ 1 file changed, 6 insertions(+)
kernel/trace/trace.c +6 -0
@@ -8291,6 +8291,10 @@ tracing_buffers_splice_read(struct fileif (ret) goto out; +/* No need to wait after waking up when tracing is off */ +if (!tracer_tracing_is_on (iter->tr)) + goto out; +/* Make sure we see the new wait_index */ smp_rmb ();if (wait_index != iter->wait_index)
@@ -9000,6 +9004,8 @@ rb_simple_write(struct file *filp, consttracer_tracing_off (tr);if (tr->current_trace->stop) tr->current_trace->stop (tr); +/* Wake up any waiters */ +ring_buffer_wake_waiters (buffer,RING_BUFFER_ALL_CPUS ); }mutex_unlock (&trace_types_lock); }
Greg Kroah-Hartman
maintainerPATCH 114/530 tracing: Add ioctl() to force ring buffer waiters to wake up
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (Google) <[email protected]>
commit 01b2a52171735c6eea80ee2f355f32bea6c41418 upstream.
If a process is waiting on the ring buffer for data, there currently isn't a clean way to force it to wake up. Add an ioctl call that will force any tasks that are waiting on the trace_pipe_raw file to wake up.
--- kernel/trace/trace.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+)
kernel/trace/trace.c +22 -0
@@ -8310,12 +8310,34 @@ out:return ret; } +/* An ioctl call with cmd 0 to the ring buffer file will wake up all waiters */ +static long tracing_buffers_ioctl (struct file *file,unsigned int cmd,unsigned long arg) +{ +struct ftrace_buffer_info *info = file->private_data; +struct trace_iterator *iter = &info->iter; + +if (cmd) +return -ENOIOCTLCMD ; + +mutex_lock (&trace_types_lock); + + iter->wait_index++; +/* Make sure the waiters see the new wait_index */ +smp_wmb (); + +ring_buffer_wake_waiters (iter->array_buffer->buffer, iter->cpu_file); + +mutex_unlock (&trace_types_lock); +return 0 ; +} +static const struct file_operations tracing_buffers_fops = { .open = tracing_buffers_open, .read = tracing_buffers_read, .poll = tracing_buffers_poll, .release = tracing_buffers_release, .splice_read = tracing_buffers_splice_read, + .unlocked_ioctl = tracing_buffers_ioctl, .llseek = no_llseek, };
Greg Kroah-Hartman
maintainerPATCH 115/530 tracing: Move duplicate code of trace_kprobe/eprobe.c into header
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (Google) <[email protected]>
commit f1d3cbfaafc10464550c6d3a125f4fc802bbaed5 upstream.
The functions:
fetch_store_strlen_user()
fetch_store_strlen()
fetch_store_string_user()
fetch_store_string()
are identical in both trace_kprobe.c and trace_eprobe.c. Move them into a new header file trace_probe_kernel.h to share it. This code will later be used by the synthetic events as well.
Marked for stable as a fix for a crash in synthetic events requires it.
--- kernel/trace/trace_eprobe.c | 60 +---------------------- kernel/trace/trace_kprobe.c | 60 +---------------------- kernel/trace/trace_probe_kernel.h | 96 ++++++++++++++++++++++++++++++++++++++ 3 files changed, 106 insertions(+), 110 deletions(-) create mode 100644 kernel/trace/trace_probe_kernel.h
kernel/trace/trace_eprobe.c +5 -55
@@ -16,6 +16,7 @@#include "trace_dynevent.h" #include "trace_probe.h" #include "trace_probe_tmpl.h" +#include "trace_probe_kernel.h" #define EPROBE_EVENT_SYSTEM "eprobes"
@@ -447,29 +448,14 @@ NOKPROBE_SYMBOL(process_fetch_insn) static nokprobe_inline intfetch_store_strlen_user (unsigned long addr) { -const void __user *uaddr = (__force const void __user *)addr; - -return strnlen_user_nofault (uaddr,MAX_STRING_SIZE ); +return kern_fetch_store_strlen_user (addr); }/* Return the length of string -- including null terminal byte */ static nokprobe_inline intfetch_store_strlen (unsigned long addr) { -int ret, len =0 ; -u8 c; - -#ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE -if (addr <TASK_SIZE ) -return fetch_store_strlen_user (addr); -#endif - -do { - ret =copy_from_kernel_nofault (&c, (u8 *)addr + len,1 ); - len++; - }while (c && ret ==0 && len <MAX_STRING_SIZE ); - -return (ret <0 ) ? ret : len; +return kern_fetch_store_strlen (addr); }/*
@@ -479,21 +465,7 @@ fetch_store_strlen(unsigned long addr) static nokprobe_inline intfetch_store_string_user (unsigned long addr,void *dest,void *base) { -const void __user *uaddr = (__force const void __user *)addr; -int maxlen =get_loc_len (*(u32 *)dest); -void *__dest; -long ret; - -if (unlikely (!maxlen)) -return -ENOMEM ; - - __dest =get_loc_data (dest, base); - - ret =strncpy_from_user_nofault (__dest, uaddr, maxlen); -if (ret >=0 ) - *(u32 *)dest =make_data_loc (ret, __dest - base); - -return ret; +return kern_fetch_store_string_user (addr, dest, base); }/*
@@ -503,29 +475,7 @@ fetch_store_string_user(unsigned long ad static nokprobe_inline intfetch_store_string (unsigned long addr,void *dest,void *base) { -int maxlen =get_loc_len (*(u32 *)dest); -void *__dest; -long ret; - -#ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE -if ((unsigned long )addr <TASK_SIZE ) -return fetch_store_string_user (addr, dest, base); -#endif - -if (unlikely (!maxlen)) -return -ENOMEM ; - - __dest =get_loc_data (dest, base); - -/* -* Try to get string again, since the string can be changed while -* probing. -*/ - ret =strncpy_from_kernel_nofault (__dest, (void *)addr, maxlen); -if (ret >=0 ) - *(u32 *)dest =make_data_loc (ret, __dest - base); - -return ret; +return kern_fetch_store_string (addr, dest, base); }static nokprobe_inline int
kernel/trace/trace_kprobe.c +5 -55
90 lines not on this page · raw message
kernel/trace/trace_probe_kernel.h new file +96 -0
96 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 116/530 tracing: Add "(fault)" name injection to kernel probes
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (Google) <[email protected]>
commit 2e9906f84fc7c99388bb7123ade167250d50f1c0 upstream.
Have the specific functions for kernel probes that read strings to inject the "(fault)" name directly. trace_probes.c does this too (for uprobes) but as the code to read strings are going to be used by synthetic events (and perhaps other utilities), it simplifies the code by making sure those other uses do not need to implement the "(fault)" name injection as well.
--- kernel/trace/trace_probe_kernel.h | 31 +++++++++++++++++++++++++------ 1 file changed, 25 insertions(+), 6 deletions(-)
kernel/trace/trace_probe_kernel.h +25 -6
@@ -2,6 +2,8 @@#ifndef __TRACE_PROBE_KERNEL_H_#define __TRACE_PROBE_KERNEL_H_ +#define FAULT_STRING "(fault)" +/* * This depends on trace_probe.h, but can not include it due to * the way trace_probe_tmpl.h is used by trace_kprobe.c and trace_eprobe.c.
@@ -13,8 +15,16 @@ static nokprobe_inline int kern_fetch_store_strlen_user(unsigned long addr) {const void __user *uaddr = (__force const void __user *)addr; +int ret; -return strnlen_user_nofault (uaddr,MAX_STRING_SIZE ); + ret =strnlen_user_nofault (uaddr,MAX_STRING_SIZE ); +/* +* strnlen_user_nofault returns zero on fault, insert the +* FAULT_STRING when that occurs. +*/ +if (ret <=0 ) +return strlen (FAULT_STRING ) +1 ; +return ret; }/* Return the length of string -- including null terminal byte */
@@ -34,7 +44,18 @@ kern_fetch_store_strlen(unsigned long ad len++; }while (c && ret ==0 && len <MAX_STRING_SIZE ); -return (ret <0 ) ? ret : len; +/* For faults, return enough to hold the FAULT_STRING */ +return (ret <0 ) ?strlen (FAULT_STRING ) +1 : len; +} + +static nokprobe_inline void set_data_loc(int ret, void *dest, void *__dest, void *base, int len) +{ +if (ret >=0 ) { + *(u32 *)dest =make_data_loc (ret, __dest - base); + }else { +strscpy (__dest,FAULT_STRING , len); + ret =strlen (__dest) +1 ; + } }/*
@@ -55,8 +76,7 @@ kern_fetch_store_string_user(unsigned lo __dest =get_loc_data (dest, base); ret =strncpy_from_user_nofault (__dest, uaddr, maxlen); -if (ret >=0 ) - *(u32 *)dest =make_data_loc (ret, __dest - base); +set_data_loc (ret, dest, __dest, base, maxlen);return ret; }
@@ -87,8 +107,7 @@ kern_fetch_store_string(unsigned long ad* probing. */ ret =strncpy_from_kernel_nofault (__dest, (void *)addr, maxlen); -if (ret >=0 ) - *(u32 *)dest =make_data_loc (ret, __dest - base); +set_data_loc (ret, dest, __dest, base, maxlen);return ret; }
Greg Kroah-Hartman
maintainerPATCH 117/530 tracing: Fix reading strings from synthetic events
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (Google) <[email protected]>
commit 0934ae9977c27133449b6dd8c6213970e7eece38 upstream.
The follow commands caused a crash:
# cd /sys/kernel/tracing # echo 's:open char file[]' > dynamic_events # echo 'hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)' > events/syscalls/sys_enter_openat/trigger' # echo 1 > events/synthetic/open/enable
BOOM!
The problem is that the synthetic event field "char file[]" will read the value given to it as a string without any memory checks to make sure the address is valid. The above example will pass in the user space address and the sythetic event code will happily call strlen() on it and then strscpy() where either one will cause an oops when accessing user space addresses.
Use the helper functions from trace_kprobe and trace_eprobe that can read strings safely (and actually succeed when the address is from user space and the memory is mapped in).
Now the above can show:
packagekitd-1721 [000] ...2. 104.597170: open: file=/usr/lib/rpm/fileattrs/cmake.attr
in:imjournal-978 [006] ...2. 104.599642: open: file=/var/lib/rsyslog/imjournal.state.tmp
packagekitd-1721 [000] ...2. 104.626308: open: file=/usr/lib/rpm/fileattrs/debuginfo.attr--- kernel/trace/trace_events_synth.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-)
kernel/trace/trace_events_synth.c +17 -6
@@ -17,6 +17,8 @@/* for gfp flag names */ #include <linux/trace_events.h> #include <trace/events/mmflags.h> +#include "trace_probe.h" +#include "trace_probe_kernel.h" #include "trace_synth.h"
@@ -401,6 +403,7 @@ static unsigned int trace_string(struct {unsigned int len =0 ;char *str_field; +int ret;if (is_dynamic) {u32 data_offset;
@@ -409,19 +412,27 @@ static unsigned int trace_string(struct data_offset += event->n_u64 *sizeof (u64); data_offset += data_size; - str_field = (char *)entry + data_offset; - - len =strlen (str_val) +1 ; -strscpy (str_field, str_val, len); + len =kern_fetch_store_strlen ((unsigned long )str_val); data_offset |= len <<16 ; *(u32 *)&entry->fields[*n_u64] = data_offset; + ret =kern_fetch_store_string ((unsigned long )str_val, &entry->fields[*n_u64], entry); + (*n_u64)++; }else { str_field = (char *)&entry->fields[*n_u64]; -strscpy (str_field, str_val,STR_VAR_LEN_MAX ); +#ifdef CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE +if ((unsigned long )str_val <TASK_SIZE ) + ret =strncpy_from_user_nofault (str_field, str_val,STR_VAR_LEN_MAX ); + else +#endif + ret =strncpy_from_kernel_nofault (str_field, str_val,STR_VAR_LEN_MAX ); + +if (ret <0 ) +strcpy (str_field,FAULT_STRING ); + (*n_u64) +=STR_VAR_LEN_MAX /sizeof (u64); }
@@ -454,7 +465,7 @@ static notrace void trace_event_raw_even val_idx = var_ref_idx[field_pos]; str_val = (char *)(long )var_ref_vals[val_idx]; - len =strlen (str_val) +1 ; + len =kern_fetch_store_strlen ((unsigned long )str_val); fields_size += len; }
Greg Kroah-Hartman
maintainerPATCH 118/530 thunderbolt: Explicitly enable lane adapter hotplug events at startup
In reply to Greg Kroah-HartmanFrom: Mario Limonciello <[email protected]>
commit 5d2569cb4a65c373896ec0217febdf88739ed295 upstream.
Software that has run before the USB4 CM in Linux runs may have disabled hotplug events for a given lane adapter.
Other CMs such as that one distributed with Windows 11 will enable hotplug events. Do the same thing in the Linux CM which fixes hotplug events on "AMD Pink Sardine".
--- drivers/thunderbolt/switch.c | 24 ++++++++++++++++++++++++ drivers/thunderbolt/tb.h | 1 + drivers/thunderbolt/tb_regs.h | 1 + drivers/thunderbolt/usb4.c | 20 ++++++++++++++++++++ 4 files changed, 46 insertions(+)
drivers/thunderbolt/switch.c +24 -0
@@ -2690,6 +2690,26 @@ static void tb_switch_credits_init(structb_sw_info (sw,"failed to determine preferred buffer allocation, using defaults\n" ); } +static int tb_switch_port_hotplug_enable (struct tb_switch *sw) +{ +struct tb_port *port; + +if (tb_switch_is_icm (sw)) +return 0 ; + +tb_switch_for_each_port (sw, port) { +int res; + +if (!port->cap_usb4) +continue ; + + res =usb4_port_hotplug_enable (port); +if (res) +return res; + } +return 0 ; +} +/** * tb_switch_add() - Add a switch to the domain * @sw: Switch to add
@@ -2761,6 +2781,10 @@ int tb_switch_add(struct tb_switch *sw)return ret; } + ret =tb_switch_port_hotplug_enable (sw); +if (ret) +return ret; + ret =device_add (&sw->dev);if (ret) {dev_err (&sw->dev,"failed to add device: %d\n" , ret);
drivers/thunderbolt/tb.h +1 -0
@@ -1067,6 +1067,7 @@ int usb4_switch_add_ports(struct tb_switvoid usb4_switch_remove_ports (struct tb_switch *sw);int usb4_port_unlock (struct tb_port *port); +int usb4_port_hotplug_enable (struct tb_port *port);int usb4_port_configure (struct tb_port *port);void usb4_port_unconfigure (struct tb_port *port);int usb4_port_configure_xdomain (struct tb_port *port);
drivers/thunderbolt/tb_regs.h +1 -0
@@ -301,6 +301,7 @@ struct tb_regs_port_header {#define ADP_CS_5 0x05#define ADP_CS_5_LCA_MASK GENMASK(28, 22)#define ADP_CS_5_LCA_SHIFT 22 +#define ADP_CS_5_DHP BIT(31)/* TMU adapter registers */ #define TMU_ADP_CS_3 0x03
drivers/thunderbolt/usb4.c +20 -0
@@ -1068,6 +1068,26 @@ int usb4_port_unlock(struct tb_port *porreturn tb_port_write (port, &val,TB_CFG_PORT ,ADP_CS_4 ,1 ); } +/** +* usb4_port_hotplug_enable() - Enables hotplug for a port +* @port: USB4 port to operate on +* +* Enables hot plug events on a given port. This is only intended +* to be used on lane, DP-IN, and DP-OUT adapters. +*/ +int usb4_port_hotplug_enable (struct tb_port *port) +{ +int ret; +u32 val; + + ret =tb_port_read (port, &val,TB_CFG_PORT ,ADP_CS_5 ,1 ); +if (ret) +return ret; + + val &= ~ADP_CS_5_DHP ; +return tb_port_write (port, &val,TB_CFG_PORT ,ADP_CS_5 ,1 ); +} +static int usb4_port_set_configured (struct tb_port *port,bool configured) {int ret;
Greg Kroah-Hartman
maintainerPATCH 119/530 efi: libstub: drop pointless get_memory_map() call
In reply to Greg Kroah-HartmanFrom: Ard Biesheuvel <[email protected]>
commit d80ca810f096ff66f451e7a3ed2f0cd9ef1ff519 upstream.
Currently, the non-x86 stub code calls get_memory_map() redundantly, given that the data it returns is never used anywhere. So drop the call.
--- drivers/firmware/efi/libstub/fdt.c | 8 -------- 1 file changed, 8 deletions(-)
drivers/firmware/efi/libstub/fdt.c +0 -8
@@ -280,14 +280,6 @@ efi_status_t allocate_new_fdt_and_exit_b goto fail; } -/* -* Now that we have done our final memory allocation (and free) -* we can get the memory map key needed for exit_boot_services(). -*/ - status =efi_get_memory_map (&map); -if (status !=EFI_SUCCESS ) - goto fail_free_new_fdt; - status =update_fdt ((void *)fdt_addr, fdt_size, (void *)*new_fdt_addr,MAX_FDT_SIZE , cmdline_ptr, initrd_addr, initrd_size);
Greg Kroah-Hartman
maintainerPATCH 120/530 media: cedrus: Set the platform driver data earlier
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
commit 708938f8495147fe2e77a9a3e1015d8e6899323e upstream.
The cedrus_hw_resume() crashes with NULL deference on driver probe if runtime PM is disabled because it uses platform data that hasn't been set up yet. Fix this by setting the platform data earlier during probe.
--- drivers/staging/media/sunxi/cedrus/cedrus.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/staging/media/sunxi/cedrus/cedrus.c +2 -2
@@ -369,6 +369,8 @@ static int cedrus_probe(struct platform_if (!dev)return -ENOMEM ; +platform_set_drvdata (pdev, dev); + dev->vfd = cedrus_video_device; dev->dev = &pdev->dev; dev->pdev = pdev;
@@ -440,8 +442,6 @@ static int cedrus_probe(struct platform_ goto err_m2m_mc; } -platform_set_drvdata (pdev, dev); -return 0 ; err_m2m_mc:
Greg Kroah-Hartman
maintainerPATCH 121/530 media: cedrus: Fix endless loop in cedrus_h265_skip_bits()
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
commit 91db7a3fc7fe670cf1770a398a43bb4a1f776bf1 upstream.
The busy status bit may never de-assert if number of programmed skip bits is incorrect, resulting in a kernel hang because the bit is polled endlessly in the code. Fix it by adding timeout for the bit-polling. This problem is reproducible by setting the data_bit_offset field of the HEVC slice params to a wrong value by userspace.
--- drivers/staging/media/sunxi/cedrus/cedrus_h265.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/staging/media/sunxi/cedrus/cedrus_h265.c +3 -2
@@ -234,8 +234,9 @@ static void cedrus_h265_skip_bits(structcedrus_write (dev,VE_DEC_H265_TRIGGER ,VE_DEC_H265_TRIGGER_FLUSH_BITS |VE_DEC_H265_TRIGGER_TYPE_N_BITS (tmp)); -while (cedrus_read (dev,VE_DEC_H265_STATUS ) &VE_DEC_H265_STATUS_VLD_BUSY ) -udelay (1 ); + +if (cedrus_wait_for (dev,VE_DEC_H265_STATUS ,VE_DEC_H265_STATUS_VLD_BUSY )) +dev_err_ratelimited (dev->dev,"timed out waiting to skip bits\n" ); count += tmp; }
Greg Kroah-Hartman
maintainerPATCH 122/530 blk-wbt: call rq_qos_add() after wb_normal is initialized
In reply to Greg Kroah-HartmanFrom: Yu Kuai <[email protected]>
commit 8c5035dfbb9475b67c82b3fdb7351236525bf52b upstream.
Our test found a problem that wbt inflight counter is negative, which will cause io hang(noted that this problem doesn't exist in mainline):
t1: device create t2: issue ioadd_disk
blk_register_queue
wbt_enable_default
wbt_init
rq_qos_add
// wb_normal is still 0
/*
* in mainline, disk can't be opened before
* bdev_add(), however, in old kernels, disk
* can be opened before blk_register_queue().
*/
blkdev_issue_flush
// disk size is 0, however, it's not checked
submit_bio_wait
submit_bio
blk_mq_submit_bio
rq_qos_throttle
wbt_wait
bio_to_wbt_flags
rwb_enabled
// wb_normal is 0, inflight is not increased
wbt_queue_depth_changed(&rwb->rqos);
wbt_update_limits
// wb_normal is initialized
rq_qos_track
wbt_track
rq->wbt_flags |= bio_to_wbt_flags(rwb, bio);
// wb_normal is not 0，wbt_flags will be sett3: io completionblk_mq_free_request
rq_qos_done
wbt_done
wbt_is_tracked
// return true
__wbt_done
wbt_rqw_done
atomic_dec_return(&rqw->inflight);
// inflight is decreasedcommit 8235b5c1e8c1 ("block: call bdev_add later in device_add_disk") can avoid this problem, however it's better to fix this problem in wbt:
1) Lower kernel can't backport this patch due to lots of refactor.
2) Root cause is that wbt call rq_qos_add() before wb_normal is initialized.
--- block/blk-wbt.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
block/blk-wbt.c +4 -5
@@ -843,6 +843,10 @@ int wbt_init(struct request_queue *q) rwb->enable_state =WBT_STATE_ON_DEFAULT ; rwb->wc =1 ; rwb->rq_depth.default_depth =RWB_DEF_DEPTH ; + rwb->min_lat_nsec =wbt_default_latency_nsec (q); + +wbt_queue_depth_changed (&rwb->rqos); +wbt_set_write_cache (q,test_bit (QUEUE_FLAG_WC , &q->queue_flags));/* * Assign rwb and add the stats callback.
@@ -853,11 +857,6 @@ int wbt_init(struct request_queue *q)blk_stat_add_callback (q, rwb->cb); - rwb->min_lat_nsec =wbt_default_latency_nsec (q); - -wbt_queue_depth_changed (&rwb->rqos); -wbt_set_write_cache (q,test_bit (QUEUE_FLAG_WC , &q->queue_flags)); -return 0 ; err_free:
Greg Kroah-Hartman
maintainerPATCH 123/530 KVM: x86/emulator: Fix handing of POP SS to correctly set interruptibility
In reply to Greg Kroah-HartmanFrom: Michal Luczaj <[email protected]>
commit 6aa5c47c351b22c21205c87977c84809cd015fcf upstream.
The emulator checks the wrong variable while setting the CPU interruptibility state, the target segment is embedded in the instruction opcode, not the ModR/M register. Fix the condition.
--- arch/x86/kvm/emulate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kvm/emulate.c +1 -1
@@ -1936,7 +1936,7 @@ static int em_pop_sreg(struct x86_emulatif (rc !=X86EMUL_CONTINUE )return rc; -if (ctxt->modrm_reg ==VCPU_SREG_SS ) +if (seg ==VCPU_SREG_SS ) ctxt->interruptibility =KVM_X86_SHADOW_INT_MOV_SS ;if (ctxt->op_bytes >2 )rsp_increment (ctxt, ctxt->op_bytes -2 );
Greg Kroah-Hartman
maintainerPATCH 124/530 KVM: nVMX: Unconditionally purge queued/injected events on nested "exit"
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit d953540430c5af57f5de97ea9e36253908204027 upstream.
Drop pending exceptions and events queued for re-injection when leaving nested guest mode, even if the "exit" is due to VM-Fail, SMI, or forced by host userspace. Failure to purge events could result in an event belonging to L2 being injected into L1.
This _should_ never happen for VM-Fail as all events should be blocked by nested_run_pending, but it's possible if KVM, not the L1 hypervisor, is the source of VM-Fail when running vmcs02.
SMI is a nop (barring unknown bugs) as recognition of SMI and thus entry to SMM is blocked by pending exceptions and re-injected events.
Forced exit is definitely buggy, but has likely gone unnoticed because userspace probably follows the forced exit with KVM_SET_VCPU_EVENTS (or some other ioctl() that purges the queue).
--- arch/x86/kvm/vmx/nested.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-)
arch/x86/kvm/vmx/nested.c +11 -8
@@ -4251,14 +4251,6 @@ static void prepare_vmcs12(struct kvm_vcnested_vmx_abort (vcpu,VMX_ABORT_SAVE_GUEST_MSR_FAIL ); } - -/* -* Drop what we picked up for L2 via vmx_complete_interrupts. It is -* preserved above and would only end up incorrectly in L1. -*/ - vcpu->arch.nmi_injected = false; -kvm_clear_exception_queue (vcpu); -kvm_clear_interrupt_queue (vcpu); }/*
@@ -4598,6 +4590,17 @@ void nested_vmx_vmexit(struct kvm_vcpu *WARN_ON_ONCE (nested_early_check); } +/* +* Drop events/exceptions that were queued for re-injection to L2 +* (picked up via vmx_complete_interrupts()), as well as exceptions +* that were pending for L2. Note, this must NOT be hoisted above +* prepare_vmcs12(), events/exceptions queued for re-injection need to +* be captured in vmcs12 (see vmcs12_save_pending_event()). +*/ + vcpu->arch.nmi_injected = false; +kvm_clear_exception_queue (vcpu); +kvm_clear_interrupt_queue (vcpu); +vmx_switch_vmcs (vcpu, &vmx->vmcs01);/* Update any VMCS fields that might have changed while L2 ran */
Greg Kroah-Hartman
maintainerPATCH 125/530 KVM: nVMX: Dont propagate vmcs12s PERF_GLOBAL_CTRL settings to vmcs02
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit def9d705c05eab3fdedeb10ad67907513b12038e upstream.
Don't propagate vmcs12's VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL to vmcs02. KVM doesn't disallow L1 from using VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL even when KVM itself doesn't use the control, e.g. due to the various CPU errata that where the MSR can be corrupted on VM-Exit.
Preserve KVM's (vmcs01) setting to hopefully avoid having to toggle the bit in vmcs02 at a later point. E.g. if KVM is loading PERF_GLOBAL_CTRL when running L1, then odds are good KVM will also load the MSR when running L2.
--- arch/x86/kvm/vmx/nested.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
arch/x86/kvm/vmx/nested.c +6 -1
@@ -2313,9 +2313,14 @@ static void prepare_vmcs02_early(struct* are emulated by vmx_set_efer() in prepare_vmcs02(), but speculate * on the related bits (if supported by the CPU) in the hope that * we can avoid VMWrites during vmx_set_efer(). +* +* Similarly, take vmcs01's PERF_GLOBAL_CTRL in the hope that if KVM is +* loading PERF_GLOBAL_CTRL via the VMCS for L1, then KVM will want to +* do the same for L2. */ exec_control =__vm_entry_controls_get (vmcs01); - exec_control |= vmcs12->vm_entry_controls; + exec_control |= (vmcs12->vm_entry_controls & + ~VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL ); exec_control &= ~(VM_ENTRY_IA32E_MODE |VM_ENTRY_LOAD_IA32_EFER );if (cpu_has_load_ia32_efer ()) {if (guest_efer &EFER_LMA )
Greg Kroah-Hartman
maintainerPATCH 126/530 KVM: VMX: Drop bits 31:16 when shoving exception error code into VMCS
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit eba9799b5a6efe2993cf92529608e4aa8163d73b upstream.
Deliberately truncate the exception error code when shoving it into the VMCS (VM-Entry field for vmcs01 and vmcs02, VM-Exit field for vmcs12). Intel CPUs are incapable of handling 32-bit error codes and will never generate an error code with bits 31:16, but userspace can provide an arbitrary error code via KVM_SET_VCPU_EVENTS. Failure to drop the bits on exception injection results in failed VM-Entry, as VMX disallows setting bits 31:16. Setting the bits on VM-Exit would at best confuse L1, and at worse induce a nested VM-Entry failure, e.g. if L1 decided to reinject the exception back into L2.
--- arch/x86/kvm/vmx/nested.c | 11 ++++++++++- arch/x86/kvm/vmx/vmx.c | 12 +++++++++++- 2 files changed, 21 insertions(+), 2 deletions(-)
arch/x86/kvm/vmx/nested.c +10 -1
@@ -3826,7 +3826,16 @@ static void nested_vmx_inject_exception_u32 intr_info = nr |INTR_INFO_VALID_MASK ;if (vcpu->arch.exception.has_error_code) { - vmcs12->vm_exit_intr_error_code = vcpu->arch.exception.error_code; +/* +* Intel CPUs do not generate error codes with bits 31:16 set, +* and more importantly VMX disallows setting bits 31:16 in the +* injected error code for VM-Entry. Drop the bits to mimic +* hardware and avoid inducing failure on nested VM-Entry if L1 +* chooses to inject the exception back to L2. AMD CPUs _do_ +* generate "full" 32-bit error codes, so KVM allows userspace +* to inject exception error codes with bits 31:16 set. +*/ + vmcs12->vm_exit_intr_error_code = (u16 )vcpu->arch.exception.error_code; intr_info |=INTR_INFO_DELIVER_CODE_MASK ; }
arch/x86/kvm/vmx/vmx.c +11 -1
@@ -1676,7 +1676,17 @@ static void vmx_queue_exception(struct kkvm_deliver_exception_payload (vcpu);if (has_error_code) { -vmcs_write32 (VM_ENTRY_EXCEPTION_ERROR_CODE , error_code); +/* +* Despite the error code being architecturally defined as 32 +* bits, and the VMCS field being 32 bits, Intel CPUs and thus +* VMX don't actually supporting setting bits 31:16. Hardware +* will (should) never provide a bogus error code, but AMD CPUs +* do generate error codes with bits 31:16 set, and so KVM's +* ABI lets userspace shove in arbitrary 32-bit values. Drop +* the upper bits to avoid VM-Fail, losing information that +* does't really exist is preferable to killing the VM. +*/ +vmcs_write32 (VM_ENTRY_EXCEPTION_ERROR_CODE , (u16 )error_code); intr_info |=INTR_INFO_DELIVER_CODE_MASK ; }
Greg Kroah-Hartman
maintainerPATCH 127/530 staging: greybus: audio_helper: remove unused and wrong debugfs usage
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
commit d517cdeb904ddc0cbebcc959d43596426cac40b0 upstream.
In the greybus audio_helper code, the debugfs file for the dapm has the potential to be removed and memory will be leaked. There is also the very real potential for this code to remove ALL debugfs entries from the system, and it seems like this is what will really happen if this code ever runs. This all is very wrong as the greybus audio driver did not create this debugfs file, the sound core did and controls the lifespan of it.
So remove all of the debugfs logic from the audio_helper code as there's no way it could be correct. If this really is needed, it can come back with a fixup for the incorrect usage of the debugfs_lookup() call which is what caused this to be noticed at all.
--- drivers/staging/greybus/audio_helper.c | 11 ----------- 1 file changed, 11 deletions(-)
drivers/staging/greybus/audio_helper.c +0 -11
@@ -3,7 +3,6 @@* Greybus Audio Sound SoC helper APIs */ -#include <linux/debugfs.h> #include <sound/core.h> #include <sound/soc.h> #include <sound/soc-dapm.h>
@@ -116,10 +115,6 @@ int gbaudio_dapm_free_controls(struct sn {int i;struct snd_soc_dapm_widget *w, *next_w; -#ifdef CONFIG_DEBUG_FS -struct dentry *parent = dapm->debugfs_dapm; -struct dentry *debugfs_w =NULL ; -#endif mutex_lock (&dapm->card->dapm_mutex);for (i =0 ; i < num; i++) {
@@ -139,12 +134,6 @@ int gbaudio_dapm_free_controls(struct sncontinue ; } widget++; -#ifdef CONFIG_DEBUG_FS -if (!parent) - debugfs_w =debugfs_lookup (w->name, parent); -debugfs_remove (debugfs_w); - debugfs_w =NULL ; -#endif gbaudio_dapm_free_widget (w); }mutex_unlock (&dapm->card->dapm_mutex);
Greg Kroah-Hartman
maintainerPATCH 128/530 drm/nouveau/kms/nv140-: Disable interlacing
In reply to Greg Kroah-HartmanFrom: Lyude Paul <[email protected]>
commit 8ba9249396bef37cb68be9e8dee7847f1737db9d upstream.
As it turns out: while Nvidia does actually have interlacing knobs on their GPU still pretty much no current GPUs since Volta actually support it. Trying interlacing on these GPUs will result in NVDisplay being quite unhappy like so:
nouveau 0000:1f:00.0: disp: chid 0 stat 00004802 reason 4 [INVALID_ARG] mthd 2008 data 00000001 code 00080000 nouveau 0000:1f:00.0: disp: chid 0 stat 10005080 reason 5 [INVALID_STATE] mthd 0200 data 00000001 code 00000001
So let's fix this by following the same behavior Nvidia's driver does and disable interlacing entirely.
--- drivers/gpu/drm/nouveau/nouveau_connector.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nouveau_connector.c +2 -1
@@ -503,7 +503,8 @@ nouveau_connector_set_encoder(struct drm connector->interlace_allowed = nv_encoder->caps.dp_interlace; else - connector->interlace_allowed = true; + connector->interlace_allowed = + drm->client.device.info.family <NV_DEVICE_INFO_V0_VOLTA ; connector->doublescan_allowed = true; }else if (nv_encoder->dcb->type == DCB_OUTPUT_LVDS ||
Greg Kroah-Hartman
maintainerPATCH 129/530 drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table()
In reply to Greg Kroah-HartmanFrom: Jianglei Nie <[email protected]>
commit 540dfd188ea2940582841c1c220bd035a7db0e51 upstream.
nouveau_bo_init() is backed by ttm_bo_init() and ferries its return code back to the caller. On failures, ttm will call nouveau_bo_del_ttm() and free the memory.Thus, when nouveau_bo_init() returns an error, the gem object has already been released. Then the call to nouveau_bo_ref() will use the freed "nvbo->bo" and lead to a use-after-free bug.
We should delete the call to nouveau_bo_ref() to avoid the use-after-free.
--- drivers/gpu/drm/nouveau/nouveau_prime.c | 1 - 1 file changed, 1 deletion(-)
drivers/gpu/drm/nouveau/nouveau_prime.c +0 -1
@@ -71,7 +71,6 @@ struct drm_gem_object *nouveau_gem_prime ret =nouveau_bo_init (nvbo, size, align,NOUVEAU_GEM_DOMAIN_GART , sg, robj);if (ret) { -nouveau_bo_ref (NULL , &nvbo); obj =ERR_PTR (ret); goto unlock; }
Greg Kroah-Hartman
maintainerPATCH 130/530 drm/i915: Fix watermark calculations for gen12+ RC CCS modifier
In reply to Greg Kroah-HartmanFrom: Ville Syrjälä <[email protected]>
commit c56453a00f19ccddee302f5f9fe96b80e0b47fd3 upstream.
Take the gen12+ RC CCS modifier into account when calculating the watermarks. Othwerwise we'll calculate the watermarks thinking this Y-tiled modifier is linear.
The rc_surface part is actually a nop since that is not used for any glk+ platform.
v2: Split RC CCS vs. MC CCS to separate patches
--- drivers/gpu/drm/i915/intel_pm.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/i915/intel_pm.c +4 -2
@@ -5402,10 +5402,12 @@ skl_compute_wm_params(const struct intel wp->y_tiled = modifier ==I915_FORMAT_MOD_Y_TILED || modifier == I915_FORMAT_MOD_Yf_TILED || modifier ==I915_FORMAT_MOD_Y_TILED_CCS || - modifier == I915_FORMAT_MOD_Yf_TILED_CCS; + modifier == I915_FORMAT_MOD_Yf_TILED_CCS || + modifier ==I915_FORMAT_MOD_Y_TILED_GEN12_RC_CCS ; wp->x_tiled = modifier ==I915_FORMAT_MOD_X_TILED ; wp->rc_surface = modifier ==I915_FORMAT_MOD_Y_TILED_CCS || - modifier == I915_FORMAT_MOD_Yf_TILED_CCS; + modifier == I915_FORMAT_MOD_Yf_TILED_CCS || + modifier ==I915_FORMAT_MOD_Y_TILED_GEN12_RC_CCS ; wp->is_planar =intel_format_info_is_yuv_semiplanar (format, modifier); wp->width = width;
Greg Kroah-Hartman
maintainerPATCH 131/530 drm/i915: Fix watermark calculations for gen12+ MC CCS modifier
In reply to Greg Kroah-HartmanFrom: Ville Syrjälä <[email protected]>
commit 484b2b9281000274ef7c5cb0a9ebc5da6f5c281c upstream.
Take the gen12+ MC CCS modifier into account when calculating the watermarks. Othwerwise we'll calculate the watermarks thinking this Y-tiled modifier is linear.
The rc_surface part is actually a nop since that is not used for any glk+ platform.
v2: Split RC CCS vs. MC CCS to separate patches
--- drivers/gpu/drm/i915/intel_pm.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/i915/intel_pm.c +4 -2
@@ -5403,11 +5403,13 @@ skl_compute_wm_params(const struct intel modifier == I915_FORMAT_MOD_Yf_TILED || modifier ==I915_FORMAT_MOD_Y_TILED_CCS || modifier == I915_FORMAT_MOD_Yf_TILED_CCS || - modifier ==I915_FORMAT_MOD_Y_TILED_GEN12_RC_CCS ; + modifier ==I915_FORMAT_MOD_Y_TILED_GEN12_RC_CCS || + modifier ==I915_FORMAT_MOD_Y_TILED_GEN12_MC_CCS ; wp->x_tiled = modifier ==I915_FORMAT_MOD_X_TILED ; wp->rc_surface = modifier ==I915_FORMAT_MOD_Y_TILED_CCS || modifier == I915_FORMAT_MOD_Yf_TILED_CCS || - modifier ==I915_FORMAT_MOD_Y_TILED_GEN12_RC_CCS ; + modifier ==I915_FORMAT_MOD_Y_TILED_GEN12_RC_CCS || + modifier ==I915_FORMAT_MOD_Y_TILED_GEN12_MC_CCS ; wp->is_planar =intel_format_info_is_yuv_semiplanar (format, modifier); wp->width = width;
Greg Kroah-Hartman
maintainerPATCH 132/530 drm/i915: Fix watermark calculations for gen12+ CCS+CC modifier
In reply to Greg Kroah-HartmanFrom: Ville Syrjälä <[email protected]>
commit 070a2855900de17b1e11a0dc35af9794e80f1a28 upstream.
Take the gen12+ CCS+CC modifier into account when calculating the watermarks. Othwerwise we'll calculate the watermarks thinking this Y-tiled modifier is linear.
The rc_surface part is actually a nop since that is not used for any glk+ platform.
--- drivers/gpu/drm/i915/intel_pm.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/i915/intel_pm.c +4 -2
@@ -5404,12 +5404,14 @@ skl_compute_wm_params(const struct intel modifier ==I915_FORMAT_MOD_Y_TILED_CCS || modifier == I915_FORMAT_MOD_Yf_TILED_CCS || modifier ==I915_FORMAT_MOD_Y_TILED_GEN12_RC_CCS || - modifier ==I915_FORMAT_MOD_Y_TILED_GEN12_MC_CCS ; + modifier ==I915_FORMAT_MOD_Y_TILED_GEN12_MC_CCS || + modifier ==I915_FORMAT_MOD_Y_TILED_GEN12_RC_CCS_CC ; wp->x_tiled = modifier ==I915_FORMAT_MOD_X_TILED ; wp->rc_surface = modifier ==I915_FORMAT_MOD_Y_TILED_CCS || modifier == I915_FORMAT_MOD_Yf_TILED_CCS || modifier ==I915_FORMAT_MOD_Y_TILED_GEN12_RC_CCS || - modifier ==I915_FORMAT_MOD_Y_TILED_GEN12_MC_CCS ; + modifier ==I915_FORMAT_MOD_Y_TILED_GEN12_MC_CCS || + modifier ==I915_FORMAT_MOD_Y_TILED_GEN12_RC_CCS_CC ; wp->is_planar =intel_format_info_is_yuv_semiplanar (format, modifier); wp->width = width;
Greg Kroah-Hartman
maintainerPATCH 133/530 drm/amd/display: Fix vblank refcount in vrr transition
In reply to Greg Kroah-HartmanFrom: Yunxiang Li <[email protected]>
commit 8799c0be89ebb99a16098bdf618f49f817bef76a upstream.
manage_dm_interrupts disable/enable vblank using drm_crtc_vblank_off/on which causes drm_crtc_vblank_get in vrr_transition to fail, and later when drm_crtc_vblank_put is called the refcount on vblank will be messed up. Therefore move the call to after manage_dm_interrupts.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 55 ++++++++++------------ 1 file changed, 26 insertions(+), 29 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +26 -29
@@ -8860,15 +8860,15 @@ static void amdgpu_dm_handle_vrr_transit* We also need vupdate irq for the actual core vblank handling * at end of vblank. */ -dm_set_vupdate_irq (new_state->base.crtc, true); -drm_crtc_vblank_get (new_state->base.crtc); +WARN_ON (dm_set_vupdate_irq (new_state->base.crtc, true) !=0 ); +WARN_ON (drm_crtc_vblank_get (new_state->base.crtc) !=0 );DRM_DEBUG_DRIVER ("%s: crtc=%u VRR off->on: Get vblank ref\n" , __func__, new_state->base.crtc->base.id); }else if (old_vrr_active && !new_vrr_active) {/* Transition VRR active -> inactive: * Allow vblank irq disable again for fixed refresh rate. */ -dm_set_vupdate_irq (new_state->base.crtc, false); +WARN_ON (dm_set_vupdate_irq (new_state->base.crtc, false) !=0 );drm_crtc_vblank_put (new_state->base.crtc);DRM_DEBUG_DRIVER ("%s: crtc=%u VRR on->off: Drop vblank ref\n" , __func__, new_state->base.crtc->base.id);
@@ -9604,23 +9604,6 @@ static void amdgpu_dm_atomic_commit_tailmutex_unlock (&dm->dc_lock); } -/* Count number of newly disabled CRTCs for dropping PM refs later. */ -for_each_oldnew_crtc_in_state (state, crtc, old_crtc_state, - new_crtc_state, i) { -if (old_crtc_state->active && !new_crtc_state->active) - crtc_disable_count++; - - dm_new_crtc_state =to_dm_crtc_state (new_crtc_state); - dm_old_crtc_state =to_dm_crtc_state (old_crtc_state); - -/* For freesync config update on crtc state and params for irq */ -update_stream_irq_parameters (dm, dm_new_crtc_state); - -/* Handle vrr on->off / off->on transitions */ -amdgpu_dm_handle_vrr_transition (dm_old_crtc_state, - dm_new_crtc_state); - } -/** * Enable interrupts for CRTCs that are newly enabled or went through * a modeset. It was intentionally deferred until after the front end
@@ -9630,16 +9613,29 @@ static void amdgpu_dm_atomic_commit_tailfor_each_oldnew_crtc_in_state (state, crtc, old_crtc_state, new_crtc_state, i) {struct amdgpu_crtc *acrtc =to_amdgpu_crtc (crtc);#ifdef CONFIG_DEBUG_FS -bool configure_crc = false;enum amdgpu_dm_pipe_crc_source cur_crc_src;#if defined(CONFIG_DRM_AMD_SECURE_DISPLAY ) -struct crc_rd_work *crc_rd_wrk = dm->crc_rd_wrk; +struct crc_rd_work *crc_rd_wrk; +#endif +#endif +/* Count number of newly disabled CRTCs for dropping PM refs later. */ +if (old_crtc_state->active && !new_crtc_state->active) + crtc_disable_count++; + + dm_new_crtc_state =to_dm_crtc_state (new_crtc_state); + dm_old_crtc_state =to_dm_crtc_state (old_crtc_state); + +/* For freesync config update on crtc state and params for irq */ +update_stream_irq_parameters (dm, dm_new_crtc_state); + +#ifdef CONFIG_DEBUG_FS +#if defined(CONFIG_DRM_AMD_SECURE_DISPLAY ) + crc_rd_wrk = dm->crc_rd_wrk;#endif spin_lock_irqsave (&adev_to_drm (adev)->event_lock, flags); cur_crc_src = acrtc->dm_irq_params.crc_src;spin_unlock_irqrestore (&adev_to_drm (adev)->event_lock, flags);#endif - dm_new_crtc_state =to_dm_crtc_state (new_crtc_state); if (new_crtc_state->active && (!old_crtc_state->active ||
@@ -9647,16 +9643,19 @@ static void amdgpu_dm_atomic_commit_taildc_stream_retain (dm_new_crtc_state->stream); acrtc->dm_irq_params.stream = dm_new_crtc_state->stream;manage_dm_interrupts (adev, acrtc, true); + } +/* Handle vrr on->off / off->on transitions */ +amdgpu_dm_handle_vrr_transition (dm_old_crtc_state, dm_new_crtc_state);#ifdef CONFIG_DEBUG_FS +if (new_crtc_state->active && + (!old_crtc_state->active || +drm_atomic_crtc_needs_modeset (new_crtc_state))) {/** * Frontend may have changed so reapply the CRC capture * settings for the stream. */ - dm_new_crtc_state =to_dm_crtc_state (new_crtc_state); -if (amdgpu_dm_is_valid_crc_source (cur_crc_src)) { - configure_crc = true;#if defined(CONFIG_DRM_AMD_SECURE_DISPLAY )if (amdgpu_dm_crc_window_is_activated (crtc)) {spin_lock_irqsave (&adev_to_drm (adev)->event_lock, flags);
@@ -9668,12 +9667,10 @@ static void amdgpu_dm_atomic_commit_tailspin_unlock_irqrestore (&adev_to_drm (adev)->event_lock, flags); }#endif - } - -if (configure_crc)if (amdgpu_dm_crtc_configure_crc_source ( crtc, dm_new_crtc_state, cur_crc_src))DRM_DEBUG_DRIVER ("Failed to configure crc source" ); + }#endif } }
Greg Kroah-Hartman
maintainerPATCH 134/530 smb3: must initialize two ACL struct fields to zero
In reply to Greg Kroah-HartmanFrom: Steve French <[email protected]>
commit f09bd695af3b8ab46fc24e5d6954a24104c38387 upstream.
Coverity spotted that we were not initalizing Stbz1 and Stbz2 to zero in create_sd_buf.
Addresses-Coverity: 1513848 ("Uninitialized scalar variable")
--- fs/cifs/smb2pdu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/cifs/smb2pdu.c +2 -1
@@ -2354,7 +2354,7 @@ create_sd_buf(umode_t mode, bool set_ownunsigned int acelen, acl_size, ace_count;unsigned int owner_offset =0 ;unsigned int group_offset =0 ; -struct smb3_acl acl; +struct smb3_acl acl = {}; *len =roundup (sizeof (struct crt_sd_ctxt ) + (sizeof (struct cifs_ace ) *4 ),8 );
@@ -2427,6 +2427,7 @@ create_sd_buf(umode_t mode, bool set_own acl.AclRevision =ACL_REVISION ;/* See 2.4.4.1 of MS-DTYP */ acl.AclSize =cpu_to_le16 (acl_size); acl.AceCount =cpu_to_le16 (ace_count); +/* acl.Sbz1 and Sbz2 MBZ so are not set here, but initialized above */ memcpy (aclptr, &acl,sizeof (struct smb3_acl )); buf->ccontext.DataLength =cpu_to_le32 (ptr - (__u8 *)&buf->sd);
Greg Kroah-Hartman
maintainerPATCH 135/530 selinux: use "grep -E" instead of "egrep"
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
commit c969bb8dbaf2f3628927eae73e7c579a74cf1b6e upstream.
The latest version of grep claims that egrep is now obsolete so the build now contains warnings that look like:
egrep: warning: egrep is obsolescent; using grep -E
fix this by using "grep -E" instead.
--- scripts/selinux/install_policy.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/selinux/install_policy.sh +1 -1
@@ -78,7 +78,7 @@ cd /etc/selinux/dummy/contexts/files $SF -F file_contexts / mounts=`cat /proc/$$/mounts | \ - egrep "ext[234]|jfs|xfs|reiserfs|jffs2|gfs2|btrfs|f2fs|ocfs2" | \ + grep -E "ext[234]|jfs|xfs|reiserfs|jffs2|gfs2|btrfs|f2fs|ocfs2" | \ awk '{ print $2 '}` $SF -F file_contexts $mounts
Greg Kroah-Hartman
maintainerPATCH 136/530 ima: fix blocking of security.ima xattrs of unsupported algorithms
In reply to Greg Kroah-HartmanFrom: Mimi Zohar <[email protected]>
[ Upstream commit 5926586f291b53cb8a0c9631fc19489be1186e2d ]
Limit validating the hash algorithm to just security.ima xattr, not the security.evm xattr or any of the protected EVM security xattrs, nor posix acls.
--- security/integrity/ima/ima_appraise.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
security/integrity/ima/ima_appraise.c +8 -4
@@ -644,22 +644,26 @@ int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name,const struct evm_ima_xattr_data *xvalue = xattr_value;int digsig =0 ;int result; +int err; result =ima_protect_xattr (dentry, xattr_name, xattr_value, xattr_value_len);if (result ==1 ) {if (!xattr_value_len || (xvalue->type >=IMA_XATTR_LAST ))return -EINVAL ; + + err =validate_hash_algo (dentry, xvalue, xattr_value_len); +if (err) +return err; + digsig = (xvalue->type ==EVM_IMA_XATTR_DIGSIG ); }else if (!strcmp (xattr_name,XATTR_NAME_EVM ) && xattr_value_len >0 ) { digsig = (xvalue->type ==EVM_XATTR_PORTABLE_DIGSIG ); }if (result ==1 ||evm_revalidate_status (xattr_name)) { - result =validate_hash_algo (dentry, xvalue, xattr_value_len); -if (result) -return result; -ima_reset_appraise_flags (d_backing_inode (dentry), digsig); +if (result ==1 ) + result =0 ; }return result; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 137/530 userfaultfd: open userfaultfds with O_RDONLY
In reply to Greg Kroah-HartmanFrom: Ondrej Mosnacek <[email protected]>
[ Upstream commit abec3d015fdfb7c63105c7e1c956188bf381aa55 ]
Since userfaultfd doesn't implement a write operation, it is more appropriate to open it read-only.
When userfaultfds are opened read-write like it is now, and such fd is passed from one process to another, SELinux will check both read and write permissions for the target process, even though it can't actually do any write operation on the fd later.
Inspired by the following bug report, which has hit the SELinux scenario described above:
https://bugzilla.redhat.com/show_bug.cgi?id=1974559
--- fs/userfaultfd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/userfaultfd.c +2 -2
@@ -982,7 +982,7 @@ static int resolve_userfault_fork(struct userfaultfd_ctx *new,int fd; fd =anon_inode_getfd_secure ("[userfaultfd]" , &userfaultfd_fops, new, -O_RDWR | (new->flags &UFFD_SHARED_FCNTL_FLAGS ), inode); +O_RDONLY | (new->flags &UFFD_SHARED_FCNTL_FLAGS ), inode);if (fd <0 )return fd;
@@ -2097,7 +2097,7 @@ SYSCALL_DEFINE1(userfaultfd, int, flags)mmgrab (ctx->mm); fd =anon_inode_getfd_secure ("[userfaultfd]" , &userfaultfd_fops, ctx, -O_RDWR | (flags &UFFD_SHARED_FCNTL_FLAGS ),NULL ); +O_RDONLY | (flags &UFFD_SHARED_FCNTL_FLAGS ),NULL );if (fd <0 ) {mmdrop (ctx->mm);kmem_cache_free (userfaultfd_ctx_cachep, ctx);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 138/530 ntfs3: rework xattr handlers and switch to POSIX ACL VFS helpers
In reply to Greg Kroah-HartmanFrom: Christian Brauner <[email protected]>
[ Upstream commit a26aa12384158116c0d80d50e0bdc7b3323551e2 ]
The xattr code in ntfs3 is currently a bit confused. For example, it defines a POSIX ACL i_op->set_acl() method but instead of relying on the generic POSIX ACL VFS helpers it defines its own set of xattr helpers with the consequence that i_op->set_acl() is currently dead code.
Switch ntfs3 to rely on the VFS POSIX ACL xattr handlers. Also remove i_op->{g,s}et_acl() methods from symlink inode operations. Symlinks don't support xattrs.
This is a preliminary change for the following patches which move handling idmapped mounts directly in posix_acl_xattr_set().
This survives POSIX ACL xfstests.
--- fs/ntfs3/inode.c | 2 - fs/ntfs3/xattr.c | 102 +++-------------------------------------------- 2 files changed, 6 insertions(+), 98 deletions(-)
fs/ntfs3/inode.c +0 -2
@@ -1942,8 +1942,6 @@ const struct inode_operations ntfs_link_inode_operations = { .setattr = ntfs3_setattr, .listxattr = ntfs_listxattr, .permission = ntfs_permission, - .get_acl = ntfs_get_acl, - .set_acl = ntfs_set_acl, };const struct address_space_operations ntfs_aops = {
fs/ntfs3/xattr.c +6 -96
132 lines not on this page · raw message
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 139/530 thermal: cpufreq_cooling: Check the policy first in cpufreq_cooling_register()
In reply to Greg Kroah-HartmanFrom: Xuewen Yan <[email protected]>
[ Upstream commit cff895277c8558221ba180aefe26799dcb4eec86 ]
Since the policy needs to be accessed first when obtaining cpu devices, first check whether the policy is legal before this.
--- drivers/thermal/cpufreq_cooling.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/thermal/cpufreq_cooling.c +5 -5
@@ -525,17 +525,17 @@ __cpufreq_cooling_register(struct device_node *np,struct thermal_cooling_device_ops *cooling_ops;char *name; +if (IS_ERR_OR_NULL (policy)) { +pr_err ("%s: cpufreq policy isn't valid: %p\n" , __func__, policy); +return ERR_PTR (-EINVAL ); + } + dev =get_cpu_device (policy->cpu);if (unlikely (!dev)) {pr_warn ("No cpu device for cpu %d\n" , policy->cpu);return ERR_PTR (-ENODEV ); } -if (IS_ERR_OR_NULL (policy)) { -pr_err ("%s: cpufreq policy isn't valid: %p\n" , __func__, policy); -return ERR_PTR (-EINVAL ); - } - i =cpufreq_table_count_valid_entries (policy);if (!i) { pr_debug("%s: CPUFreq table not found or has no valid entries\n",
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 140/530 sh: machvec: Use char[] for section boundaries
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
[ Upstream commit c5783af354688b24abd359f7086c282ec74de993 ]
As done for other sections, define the extern as a character array, which relaxes many of the compiler-time object size checks, which would otherwise assume it's a single long. Solves the following build error:
arch/sh/kernel/machvec.c: error: array subscript 'struct sh_machine_vector[0]' is partly outside array bounds of 'long int[1]' [-Werror=array-bounds]: => 105:33
--- arch/sh/include/asm/sections.h | 2 +- arch/sh/kernel/machvec.c | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-)
arch/sh/include/asm/sections.h +1 -1
@@ -4,7 +4,7 @@#include <asm-generic/sections.h> -extern long __machvec_start, __machvec_end; +extern char __machvec_start[], __machvec_end[];extern char __uncached_start, __uncached_end;extern char __start_eh_frame[], __stop_eh_frame[];
arch/sh/kernel/machvec.c +5 -5
@@ -20,8 +20,8 @@#define MV_NAME_SIZE 32#define for_each_mv (mv) \ - for ((mv) = (struct sh_machine_vector *)&__machvec_start; \ - (mv) && (unsigned long)(mv) < (unsigned long)&__machvec_end; \ + for ((mv) = (struct sh_machine_vector *)__machvec_start; \ + (mv) && (unsigned long)(mv) < (unsigned long)__machvec_end; \ (mv)++)static struct sh_machine_vector *__init get_mv_byname (const char *name)
@@ -87,8 +87,8 @@ void __init sh_mv_setup(void)if (!machvec_selected) {unsigned long machvec_size; - machvec_size = ((unsigned long )&__machvec_end - - (unsigned long )&__machvec_start); + machvec_size = ((unsigned long )__machvec_end - + (unsigned long )__machvec_start);/* * Sanity check for machvec section alignment. Ensure
@@ -102,7 +102,7 @@ void __init sh_mv_setup(void)* vector (usually the only one) from .machvec.init. */ if (machvec_size >=sizeof (struct sh_machine_vector )) - sh_mv = *(struct sh_machine_vector *)&__machvec_start; + sh_mv = *(struct sh_machine_vector *)__machvec_start; }pr_notice ("Booting machvec: %s\n" ,get_system_type ());
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 141/530 MIPS: SGI-IP27: Free some unused memory
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 33d7085682b4aa212ebfadbc21da81dfefaaac16 ]
platform_device_add_data() duplicates the memory it is passed. So we can free some memory to save a few bytes that would remain unused otherwise.
Stable-dep-of: 11bec9cba4de ("MIPS: SGI-IP27: Fix platform-device leak in bridge_platform_create()")
--- arch/mips/sgi-ip27/ip27-xtalk.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/mips/sgi-ip27/ip27-xtalk.c +4 -0
@@ -53,6 +53,8 @@ static void bridge_platform_create(nasid_t nasid, int widget, int masterwid) }platform_device_add_resources (pdev, &w1_res,1 );platform_device_add_data (pdev, wd,sizeof (*wd)); +/* platform_device_add_data() duplicates the data */ +kfree (wd);platform_device_add (pdev); bd =kzalloc (sizeof (*bd),GFP_KERNEL );
@@ -83,6 +85,8 @@ static void bridge_platform_create(nasid_t nasid, int widget, int masterwid) bd->io_offset = offset;platform_device_add_data (pdev, bd,sizeof (*bd)); +/* platform_device_add_data() duplicates the data */ +kfree (bd);platform_device_add (pdev);pr_info ("xtalk:n%d/%x bridge widget\n" , nasid, widget);return ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 142/530 MIPS: SGI-IP27: Fix platform-device leak in bridge_platform_create()
In reply to Greg Kroah-HartmanFrom: Lin Yujun <[email protected]>
[ Upstream commit 11bec9cba4de06b3c0e9e4041453c2caaa1cbec1 ]
In error case in bridge_platform_create after calling platform_device_add()/platform_device_add_data()/ platform_device_add_resources(), release the failed 'pdev' or it will be leak, call platform_device_put() to fix this problem.
Besides, 'pdev' is divided into 'pdev_wd' and 'pdev_bd', use platform_device_unregister() to release sgi_w1 resources when xtalk-bridge registration fails.
--- arch/mips/sgi-ip27/ip27-xtalk.c | 70 +++++++++++++++++++++++---------- 1 file changed, 50 insertions(+), 20 deletions(-)
arch/mips/sgi-ip27/ip27-xtalk.c +50 -20
@@ -27,15 +27,18 @@ static void bridge_platform_create(nasid_t nasid, int widget, int masterwid) {struct xtalk_bridge_platform_data *bd;struct sgi_w1_platform_data *wd; -struct platform_device *pdev; +struct platform_device *pdev_wd; +struct platform_device *pdev_bd;struct resource w1_res;unsigned long offset; offset =NODE_OFFSET (nasid); wd =kzalloc (sizeof (*wd),GFP_KERNEL ); -if (!wd) - goto no_mem; +if (!wd) { +pr_warn ("xtalk:n%d/%x bridge create out of memory\n" , nasid, widget); +return ; + }snprintf (wd->dev_id,sizeof (wd->dev_id),"bridge-%012lx" , offset + (widget <<SWIN_SIZE_BITS ));
@@ -46,24 +49,35 @@ static void bridge_platform_create(nasid_t nasid, int widget, int masterwid) w1_res.end = w1_res.start +3 ; w1_res.flags =IORESOURCE_MEM ; - pdev =platform_device_alloc ("sgi_w1" ,PLATFORM_DEVID_AUTO ); -if (!pdev) { -kfree (wd); - goto no_mem; + pdev_wd =platform_device_alloc ("sgi_w1" ,PLATFORM_DEVID_AUTO ); +if (!pdev_wd) { +pr_warn ("xtalk:n%d/%x bridge create out of memory\n" , nasid, widget); + goto err_kfree_wd; + } +if (platform_device_add_resources (pdev_wd, &w1_res,1 )) { +pr_warn ("xtalk:n%d/%x bridge failed to add platform resources.\n" , nasid, widget); + goto err_put_pdev_wd; + } +if (platform_device_add_data (pdev_wd, wd,sizeof (*wd))) { +pr_warn ("xtalk:n%d/%x bridge failed to add platform data.\n" , nasid, widget); + goto err_put_pdev_wd; + } +if (platform_device_add (pdev_wd)) { +pr_warn ("xtalk:n%d/%x bridge failed to add platform device.\n" , nasid, widget); + goto err_put_pdev_wd; } -platform_device_add_resources (pdev, &w1_res,1 ); -platform_device_add_data (pdev, wd,sizeof (*wd));/* platform_device_add_data() duplicates the data */ kfree (wd); -platform_device_add (pdev); bd =kzalloc (sizeof (*bd),GFP_KERNEL ); -if (!bd) - goto no_mem; - pdev =platform_device_alloc ("xtalk-bridge" ,PLATFORM_DEVID_AUTO ); -if (!pdev) { -kfree (bd); - goto no_mem; +if (!bd) { +pr_warn ("xtalk:n%d/%x bridge create out of memory\n" , nasid, widget); + goto err_unregister_pdev_wd; + } + pdev_bd =platform_device_alloc ("xtalk-bridge" ,PLATFORM_DEVID_AUTO ); +if (!pdev_bd) { +pr_warn ("xtalk:n%d/%x bridge create out of memory\n" , nasid, widget); + goto err_kfree_bd; }
@@ -84,15 +98,31 @@ static void bridge_platform_create(nasid_t nasid, int widget, int masterwid) bd->io.flags =IORESOURCE_IO ; bd->io_offset = offset; -platform_device_add_data (pdev, bd,sizeof (*bd)); +if (platform_device_add_data (pdev_bd, bd,sizeof (*bd))) { +pr_warn ("xtalk:n%d/%x bridge failed to add platform data.\n" , nasid, widget); + goto err_put_pdev_bd; + } +if (platform_device_add (pdev_bd)) { +pr_warn ("xtalk:n%d/%x bridge failed to add platform device.\n" , nasid, widget); + goto err_put_pdev_bd; + }/* platform_device_add_data() duplicates the data */ kfree (bd); -platform_device_add (pdev);pr_info ("xtalk:n%d/%x bridge widget\n" , nasid, widget);return ; -no_mem: -pr_warn ("xtalk:n%d/%x bridge create out of memory\n" , nasid, widget); +err_put_pdev_bd: +platform_device_put (pdev_bd); +err_kfree_bd: +kfree (bd); +err_unregister_pdev_wd: +platform_device_unregister (pdev_wd); +return ; +err_put_pdev_wd: +platform_device_put (pdev_wd); +err_kfree_wd: +kfree (wd); +return ; }static int probe_one_port (nasid_t nasid,int widget,int masterwid)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 143/530 ARM: 9244/1: dump: Fix wrong pg_level in walk_pmd()
In reply to Greg Kroah-HartmanFrom: Wang Kefeng <[email protected]>
[ Upstream commit 2ccd19b3ffac07cc7e75a2bd1ed779728bb67197 ]
After ARM supports p4d page tables, the pg_level for note_page() in walk_pmd() should be 4, not 3, fix it.
--- arch/arm/mm/dump.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/mm/dump.c +1 -1
@@ -346,7 +346,7 @@ static void walk_pmd(struct pg_state *st, pud_t *pud, unsigned long start) addr = start + i *PMD_SIZE ; domain =get_domain_name (pmd);if (pmd_none (*pmd) ||pmd_large (*pmd) || !pmd_present (*pmd)) -note_page (st, addr,3 ,pmd_val (*pmd), domain); +note_page (st, addr,4 ,pmd_val (*pmd), domain);else walk_pte (st, pmd, addr, domain);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 144/530 ARM: 9247/1: mm: set readonly for MT_MEMORY_RO with ARM_LPAE
In reply to Greg Kroah-HartmanFrom: Wang Kefeng <[email protected]>
[ Upstream commit 14ca1a4690750bb54e1049e49f3140ef48958a6e ]
MT_MEMORY_RO is introduced by commit 598f0a99fa8a ("ARM: 9210/1:
Mark the FDT_FIXED sections as shareable"), which is a readonly memory type for FDT area, but there are some different between ARM_LPAE and non-ARM_LPAE, we need to setup PMD_SECT_AP2 and L_PMD_SECT_RDONLY for MT_MEMORY_RO when ARM_LAPE enabled.
non-ARM_LPAE 0xff800000-0xffa00000 2M PGD KERNEL ro NX SHDARM_LPAE 0xff800000-0xffc00000 4M PMD RW NX SHD
ARM_LPAE+fix 0xff800000-0xffc00000 4M PMD ro NX SHD
--- arch/arm/mm/mmu.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/arm/mm/mmu.c +4 -0
@@ -300,7 +300,11 @@ static struct mem_type mem_types[] __ro_after_init = { .prot_pte = L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_DIRTY | L_PTE_XN | L_PTE_RDONLY, .prot_l1 =PMD_TYPE_TABLE , +#ifdef CONFIG_ARM_LPAE + .prot_sect = PMD_TYPE_SECT | L_PMD_SECT_RDONLY | PMD_SECT_AP2, +#else .prot_sect = PMD_TYPE_SECT, +#endif .domain = DOMAIN_KERNEL, }, [MT_ROM] = {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 145/530 objtool: Preserve special st_shndx indexes in elf_update_symbol
In reply to Greg Kroah-HartmanFrom: Sami Tolvanen <[email protected]>
[ Upstream commit 5141d3a06b2da1731ac82091298b766a1f95d3d8 ]
elf_update_symbol fails to preserve the special st_shndx values between [SHN_LORESERVE, SHN_HIRESERVE], which results in it converting SHN_ABS entries into SHN_UNDEF, for example. Explicitly check for the special indexes and ensure these symbols are not marked undefined.
--- tools/objtool/elf.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
tools/objtool/elf.c +6 -1
@@ -555,6 +555,11 @@ static int elf_update_symbol(struct elf *elf, struct section *symtab,Elf64_Xword entsize = symtab->sh.sh_entsize;int max_idx, idx = sym->idx;Elf_Scn *s, *t =NULL ; +bool is_special_shndx = sym->sym.st_shndx >=SHN_LORESERVE && + sym->sym.st_shndx !=SHN_XINDEX ; + +if (is_special_shndx) + shndx = sym->sym.st_shndx; s =elf_getscn (elf->elf, symtab->idx);if (!s) {
@@ -640,7 +645,7 @@ static int elf_update_symbol(struct elf *elf, struct section *symtab, }/* setup extended section index magic and write the symbol */ -if (shndx >=SHN_UNDEF && shndx <SHN_LORESERVE ) { +if ((shndx >=SHN_UNDEF && shndx <SHN_LORESERVE ) || is_special_shndx) { sym->sym.st_shndx = shndx;if (!shndx_data) shndx =0 ;
Signature · 1 line
2.35.1