5.4.223-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 5.4.223-rc1 review
This is the start of the stable review cycle for the 5.4.223 release. There are 64 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 04 Nov 2022 02:20:38 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.223-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.4.223-rc1
Biju Das <[email protected]>
can: rcar_canfd: rcar_canfd_handle_global_receive(): fix IRQ storm on global FIFO receive
Vladimir Oltean <[email protected]>
net: enetc: survive memory pressure without crashing
Tariq Toukan <[email protected]>
net/mlx5: Fix possible use-after-free in async command interface
Hyong Youb Kim <[email protected]>
net/mlx5e: Do not increment ESN when updating IPsec ESN state
Nicolas Dichtel <[email protected]>
nh: fix scope used to find saddr when adding non gw nh
Yang Yingliang <[email protected]>
net: ehea: fix possible memory leak in ehea_register_port()
Aaron Conole <[email protected]>
openvswitch: switch from WARN to pr_warn
Takashi Iwai <[email protected]>
ALSA: aoa: Fix I2S device accounting
Yang Yingliang <[email protected]>
ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev()
Sudeep Holla <[email protected]>
PM: domains: Fix handling of unavailable/disabled idle states
Yang Yingliang <[email protected]>
net: ksz884x: fix missing pci_disable_device() on error in pcidev_init()
Slawomir Laba <[email protected]>
i40e: Fix flow-type by setting GL_HASH_INSET registers
Sylwester Dziedziuch <[email protected]>
i40e: Fix VF hang when reset is triggered on another VF
Slawomir Laba <[email protected]>
i40e: Fix ethtool rx-flow-hash setting for X722
Hans Verkuil <[email protected]>
media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check 'interlaced'
Hans Verkuil <[email protected]>
media: v4l2-dv-timings: add sanity checks for blanking values
Hans Verkuil <[email protected]>
media: vivid: dev->bitmap_cap wasn't freed in all cases
Hans Verkuil <[email protected]>
media: vivid: s_fbuf: add more sanity checks
Mario Limonciello <[email protected]>
PM: hibernate: Allow hybrid sleep to work with s2idle
Dongliang Mu <[email protected]>
can: mscan: mpc5xxx: mpc5xxx_can_probe(): add missing put_clock() in error path
Neal Cardwell <[email protected]>
tcp: fix indefinite deferral of RTO with SACK reneging
Zhang Changzhong <[email protected]>
net: lantiq_etop: don't free skb when returning NETDEV_TX_BUSY
Zhengchao Shao <[email protected]>
net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed
Eric Dumazet <[email protected]>
kcm: annotate data-races around kcm->rx_wait
Eric Dumazet <[email protected]>
kcm: annotate data-races around kcm->rx_psock
Raju Rangoju <[email protected]>
amd-xgbe: add the bit rate quirk for Molex cables
Raju Rangoju <[email protected]>
amd-xgbe: fix the SFP compliance codes check for DAC cables
Chen Zhongjin <[email protected]>
x86/unwind/orc: Fix unreliable stack dump with gcov
Yang Yingliang <[email protected]>
net: netsec: fix error handling in netsec_register_mdio()
Xin Long <[email protected]>
tipc: fix a null-ptr-deref in tipc_topsrv_accept
Yang Yingliang <[email protected]>
ALSA: ac97: fix possible memory leak in snd_ac97_dev_register()
Randy Dunlap <[email protected]>
arc: iounmap() arg is volatile
Nathan Huckleberry <[email protected]>
drm/msm: Fix return type of mdp4_lvds_connector_mode_valid
Alexander Stein <[email protected]>
media: v4l2: Fix v4l2_i2c_subdev_set_name function documentation
Wei Yongjun <[email protected]>
net: ieee802154: fix error return code in dgram_bind()
Rik van Riel <[email protected]>
mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages
Chen Zhou <[email protected]>
cgroup-v1: add disabled controller check in cgroup1_parse_param()
M. Vefa Bicakci <[email protected]>
xen/gntdev: Prevent leaking grants
Jan Beulich <[email protected]>
Xen/gntdev: don't ignore kernel unmapping error
Chandan Babu R <[email protected]>
xfs: force the log after remapping a synchronous-writes file
Chandan Babu R <[email protected]>
xfs: clear XFS_DQ_FREEING if we can't lock the dquot buffer to flush
Chandan Babu R <[email protected]>
xfs: finish dfops on every insert range shift iteration
Heiko Carstens <[email protected]>
s390/pci: add missing EX_TABLE entries to __pcistg_mio_inuser()/__pcilg_mio_inuser()
Heiko Carstens <[email protected]>
s390/futex: add missing EX_TABLE entry to __futex_atomic_op()
Adrian Hunter <[email protected]>
perf auxtrace: Fix address filter symbol name match for modules
Christian A. Ehrhardt <[email protected]>
kernfs: fix use-after-free in __kernfs_remove
Matthew Ma <[email protected]>
mmc: core: Fix kernel panic when remove non-standard SDIO card
Johan Hovold <[email protected]>
drm/msm/hdmi: fix memory corruption with too many bridges
Johan Hovold <[email protected]>
drm/msm/dsi: fix memory corruption with too many bridges
Miquel Raynal <[email protected]>
mac802154: Fix LQI recording
Hyunwoo Kim <[email protected]>
fbdev: smscufx: Fix several use-after-free bugs
Shreeya Patel <[email protected]>
iio: light: tsl2583: Fix module unloading
Matti Vaittinen <[email protected]>
tools: iio: iio_utils: fix digit calculation
Mathias Nyman <[email protected]>
xhci: Remove device endpoints from bandwidth list when freeing the device
Tony O'Brien <[email protected]>
mtd: rawnand: marvell: Use correct logic for nand-keep-config
Jens Glathe <[email protected]>
usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96 controller
Justin Chen <[email protected]>
usb: bdc: change state when port disconnected
Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Don't set IMI for no_interrupt
Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Stop processing more requests on IMI
Hannu Hartikainen <[email protected]>
USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM
Jason A. Donenfeld <[email protected]>
ALSA: au88x0: use explicitly signed char
Steven Rostedt (Google) <[email protected]>
ALSA: Use del_timer_sync() before freeing timer
Anssi Hannula <[email protected]>
can: kvaser_usb: Fix possible completions during init_completion
Yang Yingliang <[email protected]>
can: j1939: transport: j1939_session_skb_drop_old(): spin_unlock_irqrestore() before kfree_skb()
-------------
Diffstat:
Makefile | 4 +- arch/arc/include/asm/io.h | 2 +- arch/arc/mm/ioremap.c | 2 +- arch/s390/include/asm/futex.h | 3 +- arch/s390/pci/pci_mmio.c | 8 +- arch/x86/kernel/unwind_orc.c | 2 +- drivers/base/power/domain.c | 4 + .../gpu/drm/msm/disp/mdp4/mdp4_lvds_connector.c | 5 +- drivers/gpu/drm/msm/dsi/dsi.c | 6 ++ drivers/gpu/drm/msm/hdmi/hdmi.c | 5 ++ drivers/iio/light/tsl2583.c | 2 +- drivers/media/platform/vivid/vivid-core.c | 22 +++++ drivers/media/platform/vivid/vivid-core.h | 2 + drivers/media/platform/vivid/vivid-vid-cap.c | 27 ++++-- drivers/media/v4l2-core/v4l2-dv-timings.c | 14 +++ drivers/mmc/core/sdio_bus.c | 3 +- drivers/mtd/nand/raw/marvell_nand.c | 2 +- drivers/net/can/mscan/mpc5xxx_can.c | 8 +- drivers/net/can/rcar/rcar_canfd.c | 6 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 4 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 4 +- drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 17 ++-- drivers/net/ethernet/freescale/enetc/enetc.c | 5 ++ drivers/net/ethernet/ibm/ehea/ehea_main.c | 1 + drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 100 ++++++++++++--------- drivers/net/ethernet/intel/i40e/i40e_type.h | 4 + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 43 ++++++--- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h | 1 + drivers/net/ethernet/lantiq_etop.c | 1 - drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 10 +-- .../ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 3 - drivers/net/ethernet/micrel/ksz884x.c | 2 +- drivers/net/ethernet/socionext/netsec.c | 2 + drivers/usb/core/quirks.c | 9 ++ drivers/usb/dwc3/gadget.c | 8 +- drivers/usb/gadget/udc/bdc/bdc_udc.c | 1 + drivers/usb/host/xhci-mem.c | 20 +++-- drivers/usb/host/xhci-pci.c | 8 +- drivers/video/fbdev/smscufx.c | 55 ++++++------ drivers/xen/gntdev.c | 30 +++++-- fs/kernfs/dir.c | 5 +- fs/xfs/xfs_bmap_util.c | 2 +- fs/xfs/xfs_file.c | 17 +++- fs/xfs/xfs_qm.c | 1 + include/linux/mlx5/driver.h | 2 +- include/media/v4l2-common.h | 3 +- include/uapi/linux/videodev2.h | 3 +- kernel/cgroup/cgroup-v1.c | 3 + kernel/power/hibernate.c | 2 +- mm/hugetlb.c | 2 +- net/can/j1939/transport.c | 4 +- net/core/net_namespace.c | 7 ++ net/ieee802154/socket.c | 4 +- net/ipv4/nexthop.c | 2 +- net/ipv4/tcp_input.c | 3 +- net/kcm/kcmsock.c | 23 +++-- net/mac802154/rx.c | 5 +- net/openvswitch/datapath.c | 3 +- net/tipc/topsrv.c | 16 +++- sound/aoa/soundbus/i2sbus/core.c | 7 +- sound/pci/ac97/ac97_codec.c | 1 + sound/pci/au88x0/au88x0.h | 6 +- sound/pci/au88x0/au88x0_core.c | 2 +- sound/synth/emux/emux.c | 7 +- tools/iio/iio_utils.c | 4 + tools/perf/util/auxtrace.c | 10 ++- 66 files changed, 423 insertions(+), 176 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/64 can: j1939: transport: j1939_session_skb_drop_old(): spin_unlock_irqrestore() before kfree_skb()
From: Yang Yingliang <[email protected]>
commit c3c06c61890da80494bb196f75d89b791adda87f upstream.
It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. The skb is unlinked from the queue, so it can be freed after spin_unlock_irqrestore().
--- net/can/j1939/transport.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/can/j1939/transport.c +3 -1
@@ -338,10 +338,12 @@ static void j1939_session_skb_drop_old(s__skb_unlink (do_skb, &session->skb_queue);/* drop ref taken in j1939_session_skb_queue() */ skb_unref (do_skb); +spin_unlock_irqrestore (&session->skb_queue.lock, flags);kfree_skb (do_skb); + }else { +spin_unlock_irqrestore (&session->skb_queue.lock, flags); } -spin_unlock_irqrestore (&session->skb_queue.lock, flags); } void j1939_session_skb_queue(struct j1939_session *session,
Greg Kroah-Hartman
maintainerPATCH 2/64 can: kvaser_usb: Fix possible completions during init_completion
In reply to Greg Kroah-HartmanFrom: Anssi Hannula <[email protected]>
commit 2871edb32f4622c3a25ce4b3977bad9050b91974 upstream.
kvaser_usb uses completions to signal when a response event is received for outgoing commands.
However, it uses init_completion() to reinitialize the start_comp and stop_comp completions before sending the start/stop commands.
In case the device sends the corresponding response just before the actual command is sent, complete() may be called concurrently with init_completion() which is not safe.
This might be triggerable even with a properly functioning device by stopping the interface (CMD_STOP_CHIP) just after it goes bus-off (which also causes the driver to send CMD_STOP_CHIP when restart-ms is off), but that was not tested.
Fix the issue by using reinit_completion() instead.
--- drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 4 ++-- drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c +2 -2
@@ -1845,7 +1845,7 @@ static int kvaser_usb_hydra_start_chip(s {int err; -init_completion (&priv->start_comp); +reinit_completion (&priv->start_comp); err =kvaser_usb_hydra_send_simple_cmd (priv->dev,CMD_START_CHIP_REQ , priv->channel);
@@ -1863,7 +1863,7 @@ static int kvaser_usb_hydra_stop_chip(st {int err; -init_completion (&priv->stop_comp); +reinit_completion (&priv->stop_comp);/* Make sure we do not report invalid BUS_OFF from CMD_CHIP_STATE_EVENT * see comment in kvaser_usb_hydra_update_state()
drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c +2 -2
@@ -1324,7 +1324,7 @@ static int kvaser_usb_leaf_start_chip(st {int err; -init_completion (&priv->start_comp); +reinit_completion (&priv->start_comp); err =kvaser_usb_leaf_send_simple_cmd (priv->dev,CMD_START_CHIP , priv->channel);
@@ -1342,7 +1342,7 @@ static int kvaser_usb_leaf_stop_chip(str {int err; -init_completion (&priv->stop_comp); +reinit_completion (&priv->stop_comp); err =kvaser_usb_leaf_send_simple_cmd (priv->dev,CMD_STOP_CHIP , priv->channel);
Greg Kroah-Hartman
maintainerPATCH 3/64 ALSA: Use del_timer_sync() before freeing timer
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (Google) <[email protected]>
commit f0a868788fcbf63cdab51f5adcf73b271ede8164 upstream.
The current code for freeing the emux timer is extremely dangerous:
CPU0 CPU1
---- ----snd_emux_timer_callback()
snd_emux_free() spin_lock(&emu->voice_lock) del_timer(&emu->tlist); <-- returns immediately spin_unlock(&emu->voice_lock); [..] kfree(emu);
spin_lock(&emu->voice_lock);
[BOOM!]
Instead just use del_timer_sync() which will wait for the timer to finish before continuing. No need to check if the timer is active or not when doing so.
This doesn't fix the race of a possible re-arming of the timer, but at least it won't use the data that has just been freed.
[ Fixed unused variable warning by tiwai ]
--- sound/synth/emux/emux.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-)
sound/synth/emux/emux.c +1 -6
@@ -125,15 +125,10 @@ EXPORT_SYMBOL(snd_emux_register);*/ int snd_emux_free (struct snd_emux *emu) { -unsigned long flags; -if (! emu)return -EINVAL ; -spin_lock_irqsave (&emu->voice_lock, flags); -if (emu->timer_active) -del_timer (&emu->tlist); -spin_unlock_irqrestore (&emu->voice_lock, flags); +del_timer_sync (&emu->tlist);snd_emux_proc_free (emu);snd_emux_delete_virmidi (emu);
Greg Kroah-Hartman
maintainerPATCH 4/64 ALSA: au88x0: use explicitly signed char
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
commit ee03c0f200eb0d9f22dd8732d9fb7956d91019c2 upstream.
With char becoming unsigned by default, and with char alone being ambiguous and based on architecture, signed chars need to be marked explicitly as such. This fixes warnings like:
sound/pci/au88x0/au88x0_core.c:2029 vortex_adb_checkinout() warn: signedness bug returning '(-22)' sound/pci/au88x0/au88x0_core.c:2046 vortex_adb_checkinout() warn: signedness bug returning '(-12)' sound/pci/au88x0/au88x0_core.c:2125 vortex_adb_allocroute() warn: 'vortex_adb_checkinout(vortex, (0), en, 0)' is unsigned sound/pci/au88x0/au88x0_core.c:2170 vortex_adb_allocroute() warn: 'vortex_adb_checkinout(vortex, stream->resources, en, 4)' is unsigned
As well, since one function returns errnos, return an int rather than a signed char.
--- sound/pci/au88x0/au88x0.h | 6 +++--- sound/pci/au88x0/au88x0_core.c | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-)
sound/pci/au88x0/au88x0.h +3 -3
@@ -141,7 +141,7 @@ struct snd_vortex {#ifndef CHIP_AU8810 stream_t dma_wt[NR_WT ];wt_voice_t wt_voice[NR_WT ];/* WT register cache. */ -char mixwt[(NR_WT /NR_WTPB ) *6 ];/* WT mixin objects */ +s8 mixwt[(NR_WT /NR_WTPB ) *6 ];/* WT mixin objects */ #endif /* Global resources */
@@ -235,8 +235,8 @@ static int vortex_alsafmt_aspfmt(snd_pcmstatic void vortex_connect_default (vortex_t * vortex,int en);static int vortex_adb_allocroute (vortex_t * vortex,int dma,int nr_ch,int dir,int type,int subdev); -static char vortex_adb_checkinout (vortex_t * vortex,int resmap[],int out, -int restype); +static int vortex_adb_checkinout (vortex_t * vortex,int resmap[],int out, +int restype);#ifndef CHIP_AU8810 static int vortex_wt_allocroute (vortex_t * vortex,int dma,int nr_ch);static void vortex_wt_connect (vortex_t * vortex,int en);
sound/pci/au88x0/au88x0_core.c +1 -1
@@ -1998,7 +1998,7 @@ static int resnum[VORTEX_RESOURCE_LAST]out: Mean checkout if != 0. Else mean Checkin resource. restype: Indicates type of resource to be checked in or out. */ -static char +static int vortex_adb_checkinout (vortex_t * vortex,int resmap[],int out,int restype) {int i, qty = resnum[restype], resinuse =0 ;
Greg Kroah-Hartman
maintainerPATCH 5/64 USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM
In reply to Greg Kroah-HartmanFrom: Hannu Hartikainen <[email protected]>
commit fc4ade55c617dc73c7e9756b57f3230b4ff24540 upstream.
NVIDIA Jetson devices in Force Recovery mode (RCM) do not support suspending, ie. flashing fails if the device has been suspended. The devices are still visible in lsusb and seem to work otherwise, making the issue hard to debug. This has been discovered in various forum posts, eg. [1].
The patch has been tested on NVIDIA Jetson AGX Xavier, but I'm adding all the Jetson models listed in [2] on the assumption that they all behave similarly.
[1]: https://forums.developer.nvidia.com/t/flashing-not-working/72365
[2]: https://docs.nvidia.com/jetson/archives/l4t-archived/l4t-3271/index.html#page/Tegra%20Linux%20Driver%20Package%20Development%20Guide/quick_start.html
--- drivers/usb/core/quirks.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/usb/core/quirks.c +9 -0
@@ -388,6 +388,15 @@ static const struct usb_device_id usb_qu/* Kingston DataTraveler 3.0 */ { USB_DEVICE(0x0951, 0x1666), .driver_info = USB_QUIRK_NO_LPM }, + /* NVIDIA Jetson devices in Force Recovery mode */ + { USB_DEVICE(0x0955, 0x7018), .driver_info = USB_QUIRK_RESET_RESUME }, + { USB_DEVICE(0x0955, 0x7019), .driver_info = USB_QUIRK_RESET_RESUME }, + { USB_DEVICE(0x0955, 0x7418), .driver_info = USB_QUIRK_RESET_RESUME }, + { USB_DEVICE(0x0955, 0x7721), .driver_info = USB_QUIRK_RESET_RESUME }, + { USB_DEVICE(0x0955, 0x7c18), .driver_info = USB_QUIRK_RESET_RESUME }, + { USB_DEVICE(0x0955, 0x7e19), .driver_info = USB_QUIRK_RESET_RESUME }, + { USB_DEVICE(0x0955, 0x7f21), .driver_info = USB_QUIRK_RESET_RESUME }, + /* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */ { USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF },
Greg Kroah-Hartman
maintainerPATCH 6/64 usb: dwc3: gadget: Stop processing more requests on IMI
In reply to Greg Kroah-HartmanFrom: Thinh Nguyen <[email protected]>
commit f78961f8380b940e0cfc7e549336c21a2ad44f4d upstream.
When servicing a transfer completion event, the dwc3 driver will reclaim TRBs of started requests up to the request associated with the interrupt event. Currently we don't check for interrupt due to missed isoc, and the driver may attempt to reclaim TRBs beyond the associated event. This causes invalid memory access when the hardware still owns the TRB. If there's a missed isoc TRB with IMI (interrupt on missed isoc), make sure to stop servicing further.
Note that only the last TRB of chained TRBs has its status updated with missed isoc.
--- drivers/usb/dwc3/gadget.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/dwc3/gadget.c +4 -0
@@ -2681,6 +2681,10 @@ static int dwc3_gadget_ep_reclaim_compleif (event->status &DEPEVT_STATUS_SHORT && !chain)return 1 ; +if ((trb->ctrl &DWC3_TRB_CTRL_ISP_IMI ) && +DWC3_TRB_SIZE_TRBSTS (trb->size) ==DWC3_TRBSTS_MISSED_ISOC ) +return 1 ; +if ((trb->ctrl &DWC3_TRB_CTRL_IOC ) || (trb->ctrl &DWC3_TRB_CTRL_LST ))return 1 ;
Greg Kroah-Hartman
maintainerPATCH 7/64 usb: dwc3: gadget: Dont set IMI for no_interrupt
In reply to Greg Kroah-HartmanFrom: Thinh Nguyen <[email protected]>
commit 308c316d16cbad99bb834767382baa693ac42169 upstream.
The gadget driver may have a certain expectation of how the request completion flow should be from to its configuration. Make sure the controller driver respect that. That is, don't set IMI (Interrupt on Missed Isoc) when usb_request->no_interrupt is set. Also, the driver should only set IMI to the last TRB of a chain.
--- drivers/usb/dwc3/gadget.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/dwc3/gadget.c +2 -2
@@ -981,8 +981,8 @@ static void __dwc3_prepare_one_trb(struc trb->ctrl =DWC3_TRBCTL_ISOCHRONOUS ; } -/* always enable Interrupt on Missed ISOC */ - trb->ctrl |=DWC3_TRB_CTRL_ISP_IMI ; +if (!no_interrupt && !chain) + trb->ctrl |=DWC3_TRB_CTRL_ISP_IMI ;break ;case USB_ENDPOINT_XFER_BULK :
Greg Kroah-Hartman
maintainerPATCH 8/64 usb: bdc: change state when port disconnected
In reply to Greg Kroah-HartmanFrom: Justin Chen <[email protected]>
commit fb8f60dd1b67520e0e0d7978ef17d015690acfc1 upstream.
When port is connected and then disconnected, the state stays as configured. Which is incorrect as the port is no longer configured, but in a not attached state.
--- drivers/usb/gadget/udc/bdc/bdc_udc.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/gadget/udc/bdc/bdc_udc.c +1 -0
@@ -151,6 +151,7 @@ static void bdc_uspc_disconnected(struct bdc->delayed_status = false; bdc->reinit = reinit; bdc->test_mode = false; +usb_gadget_set_state (&bdc->gadget,USB_STATE_NOTATTACHED ); }/* TNotify wkaeup timer */
Greg Kroah-Hartman
maintainerPATCH 9/64 usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being a V0.96 controller
In reply to Greg Kroah-HartmanFrom: Jens Glathe <[email protected]>
commit 4f547472380136718b56064ea5689a61e135f904 upstream.
This appears to fix the error:
"xhci_hcd <address>; ERROR Transfer event TRB DMA ptr not part of current TD ep_index 2 comp_code 13" that appear spuriously (or pretty often) when using a r8152 USB3 ethernet adapter with integrated hub.
ASM1042 reports as a 0.96 controller, but appears to behave more like 1.0
Inspired by this email thread: https://markmail.org/thread/7vzqbe7t6du6qsw3
--- drivers/usb/host/xhci-pci.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/usb/host/xhci-pci.c +7 -1
@@ -272,8 +272,14 @@ static void xhci_pci_quirks(struct devic xhci->quirks |=XHCI_BROKEN_STREAMS ;if (pdev->vendor ==PCI_VENDOR_ID_ASMEDIA && - pdev->device ==PCI_DEVICE_ID_ASMEDIA_1042_XHCI ) + pdev->device ==PCI_DEVICE_ID_ASMEDIA_1042_XHCI ) { +/* +* try to tame the ASMedia 1042 controller which reports 0.96 +* but appears to behave more like 1.0 +*/ + xhci->quirks |=XHCI_SPURIOUS_SUCCESS ; xhci->quirks |=XHCI_BROKEN_STREAMS ; + }if (pdev->vendor ==PCI_VENDOR_ID_ASMEDIA && pdev->device ==PCI_DEVICE_ID_ASMEDIA_1042A_XHCI ) { xhci->quirks |=XHCI_TRUST_TX_LENGTH ;
Greg Kroah-Hartman
maintainerPATCH 10/64 mtd: rawnand: marvell: Use correct logic for nand-keep-config
In reply to Greg Kroah-HartmanFrom: Tony O'Brien <[email protected]>
commit ce107713b722af57c4b7f2477594d445b496420e upstream.
Originally the absence of the marvell,nand-keep-config property caused the setup_data_interface function to be provided. However when setup_data_interface was moved into nand_controller_ops the logic was unintentionally inverted. Update the logic so that only if the marvell,nand-keep-config property is present the bootloader NAND config kept.
--- drivers/mtd/nand/raw/marvell_nand.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/nand/raw/marvell_nand.c +1 -1
@@ -2630,7 +2630,7 @@ static int marvell_nand_chip_init(struct chip->controller = &nfc->controller;nand_set_flash_node (chip, np); -if (!of_property_read_bool (np,"marvell,nand-keep-config" )) +if (of_property_read_bool (np,"marvell,nand-keep-config" )) chip->options |=NAND_KEEP_TIMINGS ; mtd =nand_to_mtd (chip);
Greg Kroah-Hartman
maintainerPATCH 11/64 xhci: Remove device endpoints from bandwidth list when freeing the device
In reply to Greg Kroah-HartmanFrom: Mathias Nyman <[email protected]>
commit 5aed5b7c2430ce318a8e62f752f181e66f0d1053 upstream.
Endpoints are normally deleted from the bandwidth list when they are dropped, before the virt device is freed.
If xHC host is dying or being removed then the endpoints aren't dropped cleanly due to functions returning early to avoid interacting with a non-accessible host controller.
So check and delete endpoints that are still on the bandwidth list when freeing the virt device.
Solves a list_del corruption kernel crash when unbinding xhci-pci, caused by xhci_mem_cleanup() when it later tried to delete already freed endpoints from the bandwidth list.
This only affects hosts that use software bandwidth checking, which currenty is only the xHC in intel Panther Point PCH (Ivy Bridge)
--- drivers/usb/host/xhci-mem.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-)
drivers/usb/host/xhci-mem.c +12 -8
@@ -906,15 +906,19 @@ void xhci_free_virt_device(struct xhci_hif (dev->eps[i].stream_info)xhci_free_stream_info (xhci, dev->eps[i].stream_info); -/* Endpoints on the TT/root port lists should have been removed -* when usb_disable_device() was called for the device. -* We can't drop them anyway, because the udev might have gone -* away by this point, and we can't tell what speed it was. +/* +* Endpoints are normally deleted from the bandwidth list when +* endpoints are dropped, before device is freed. +* If host is dying or being removed then endpoints aren't +* dropped cleanly, so delete the endpoint from list here. +* Only applicable for hosts with software bandwidth checking. */ -if (!list_empty (&dev->eps[i].bw_endpoint_list)) -xhci_warn (xhci,"Slot %u endpoint %u " -"not removed from BW list!\n" , - slot_id, i); + +if (!list_empty (&dev->eps[i].bw_endpoint_list)) { +list_del_init (&dev->eps[i].bw_endpoint_list); +xhci_dbg (xhci,"Slot %u endpoint %u not removed from BW list!\n" , + slot_id, i); + } }/* If this is a hub, free the TT(s) from the TT list */ xhci_free_tt_info (xhci, dev, slot_id);
Greg Kroah-Hartman
maintainerPATCH 12/64 tools: iio: iio_utils: fix digit calculation
In reply to Greg Kroah-HartmanFrom: Matti Vaittinen <[email protected]>
commit 72b2aa38191bcba28389b0e20bf6b4f15017ff2b upstream.
The iio_utils uses a digit calculation in order to know length of the file name containing a buffer number. The digit calculation does not work for number 0.
This leads to allocation of one character too small buffer for the file-name when file name contains value '0'. (Eg. buffer0).
Fix digit calculation by returning one digit to be present for number '0'.
--- tools/iio/iio_utils.c | 4 ++++ 1 file changed, 4 insertions(+)
tools/iio/iio_utils.c +4 -0
@@ -543,6 +543,10 @@ static int calc_digits(int num) {int count =0 ; +/* It takes a digit to represent zero */ +if (!num) +return 1 ; +while (num !=0 ) { num /=10 ; count++;
Greg Kroah-Hartman
maintainerPATCH 13/64 iio: light: tsl2583: Fix module unloading
In reply to Greg Kroah-HartmanFrom: Shreeya Patel <[email protected]>
commit 0dec4d2f2636b9e54d9d29f17afc7687c5407f78 upstream.
tsl2583 probe() uses devm_iio_device_register() and calling iio_device_unregister() causes the unregister to occur twice. s Switch to iio_device_register() instead of devm_iio_device_register() in probe to avoid the device managed cleanup.
--- drivers/iio/light/tsl2583.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/light/tsl2583.c +1 -1
@@ -857,7 +857,7 @@ static int tsl2583_probe(struct i2c_clie TSL2583_POWER_OFF_DELAY_MS);pm_runtime_use_autosuspend (&clientp->dev); - ret =devm_iio_device_register (indio_dev->dev.parent, indio_dev); + ret =iio_device_register (indio_dev);if (ret) {dev_err (&clientp->dev,"%s: iio registration failed\n" , __func__);
Greg Kroah-Hartman
maintainerPATCH 14/64 fbdev: smscufx: Fix several use-after-free bugs
In reply to Greg Kroah-HartmanFrom: Hyunwoo Kim <[email protected]>
commit cc67482c9e5f2c80d62f623bcc347c29f9f648e1 upstream.
Several types of UAFs can occur when physically removing a USB device.
Adds ufx_ops_destroy() function to .fb_destroy of fb_ops, and in this function, there is kref_put() that finally calls ufx_free().
This fix prevents multiple UAFs.
--- drivers/video/fbdev/smscufx.c | 55 ++++++++++++++++++++++-------------------- 1 file changed, 30 insertions(+), 25 deletions(-)
drivers/video/fbdev/smscufx.c +30 -25
@@ -97,7 +97,6 @@ struct ufx_data {struct kref kref;int fb_count;bool virtualized;/* true when physical usb device not present */ -struct delayed_work free_framebuffer_work;atomic_t usb_active;/* 0 = update virtual buffer, but no usb traffic */ atomic_t lost_pixels;/* 1 = a render op failed. Need screen refresh */ u8 *edid;/* null until we read edid from hw or get from sysfs */
@@ -1116,15 +1115,24 @@ static void ufx_free(struct kref *kref) { struct ufx_data *dev = container_of(kref, struct ufx_data, kref); -/* this function will wait for all in-flight urbs to complete */ -if (dev->urbs.count >0 ) -ufx_free_urb_list (dev); +kfree (dev); +} -pr_debug ("freeing ufx_data %p" , dev); +static void ufx_ops_destory (struct fb_info *info) +{ +struct ufx_data *dev = info->par; +int node = info->node; -kfree (dev); +/* Assume info structure is freed after this point */ +framebuffer_release (info); + +pr_debug ("fb_info for /dev/fb%d has been freed" , node); + +/* release reference taken by kref_init in probe() */ +kref_put (&dev->kref, ufx_free); } +static void ufx_release_urb_work (struct work_struct *work) { struct urb_node *unode = container_of(work, struct urb_node,
@@ -1133,14 +1141,9 @@ static void ufx_release_urb_work(structup (&unode->dev->urbs.limit_sem); } -static void ufx_free_framebuffer_work (struct work_struct *work) +static void ufx_free_framebuffer (struct ufx_data *dev) { - struct ufx_data *dev = container_of(work, struct ufx_data, - free_framebuffer_work.work);struct fb_info *info = dev->info; -int node = info->node; - -unregister_framebuffer (info);if (info->cmap.len !=0 )fb_dealloc_cmap (&info->cmap);
@@ -1152,11 +1155,6 @@ static void ufx_free_framebuffer_work(st dev->info =NULL ; -/* Assume info structure is freed after this point */ -framebuffer_release (info); - -pr_debug ("fb_info for /dev/fb%d has been freed" , node); -/* ref taken in probe() as part of registering framebfufer */ kref_put (&dev->kref, ufx_free); }
@@ -1168,11 +1166,13 @@ static int ufx_ops_release(struct fb_inf {struct ufx_data *dev = info->par; +mutex_lock (&disconnect_mutex); + dev->fb_count--;/* We can't free fb_info here - fbmem will touch it when we return */ if (dev->virtualized && (dev->fb_count ==0 )) -schedule_delayed_work (&dev->free_framebuffer_work,HZ ); +ufx_free_framebuffer (dev);if ((dev->fb_count ==0 ) && (info->fbdefio)) {fb_deferred_io_cleanup (info);
@@ -1186,6 +1186,8 @@ static int ufx_ops_release(struct fb_infkref_put (&dev->kref, ufx_free); +mutex_unlock (&disconnect_mutex); +return 0 ; }
@@ -1292,6 +1294,7 @@ static struct fb_ops ufx_ops = { .fb_blank = ufx_ops_blank, .fb_check_var = ufx_ops_check_var, .fb_set_par = ufx_ops_set_par, + .fb_destroy = ufx_ops_destory, };/* Assumes &info->lock held by caller
@@ -1673,9 +1676,6 @@ static int ufx_usb_probe(struct usb_inte goto destroy_modedb; } -INIT_DELAYED_WORK (&dev->free_framebuffer_work, - ufx_free_framebuffer_work); - retval =ufx_reg_read (dev,0x3000 , &id_rev);check_warn_goto_error (retval,"error %d reading 0x3000 register from device" , retval);dev_dbg (dev->gdev,"ID_REV register value 0x%08x" , id_rev);
@@ -1748,10 +1748,12 @@ e_nomem:static void ufx_usb_disconnect (struct usb_interface *interface) {struct ufx_data *dev; +struct fb_info *info;mutex_lock (&disconnect_mutex); dev =usb_get_intfdata (interface); + info = dev->info;pr_debug ("USB disconnect starting\n" );
@@ -1765,12 +1767,15 @@ static void ufx_usb_disconnect(struct us/* if clients still have us open, will be freed on last close */ if (dev->fb_count ==0 ) -schedule_delayed_work (&dev->free_framebuffer_work,0 ); +ufx_free_framebuffer (dev); -/* release reference taken by kref_init in probe() */ -kref_put (&dev->kref, ufx_free); +/* this function will wait for all in-flight urbs to complete */ +if (dev->urbs.count >0 ) +ufx_free_urb_list (dev); -/* consider ufx_data freed */ +pr_debug ("freeing ufx_data %p" , dev); + +unregister_framebuffer (info);mutex_unlock (&disconnect_mutex); }
Greg Kroah-Hartman
maintainerPATCH 15/64 mac802154: Fix LQI recording
In reply to Greg Kroah-HartmanFrom: Miquel Raynal <[email protected]>
commit 5a5c4e06fd03b595542d5590f2bc05a6b7fc5c2b upstream.
Back in 2014, the LQI was saved in the skb control buffer (skb->cb, or mac_cb(skb)) without any actual reset of this area prior to its use.
As part of a useful rework of the use of this region, 32edc40ae65c ("ieee802154: change _cb handling slightly") introduced mac_cb_init() to basically memset the cb field to 0. In particular, this new function got called at the beginning of mac802154_parse_frame_start(), right before the location where the buffer got actually filled.
What went through unnoticed however, is the fact that the very first helper called by device drivers in the receive path already used this area to save the LQI value for later extraction. Resetting the cb field "so late" led to systematically zeroing the LQI.
If we consider the reset of the cb field needed, we can make it as soon as we get an skb from a device driver, right before storing the LQI, as is the very first time we need to write something there.
--- net/mac802154/rx.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/mac802154/rx.c +3 -2
@@ -132,7 +132,7 @@ static int ieee802154_parse_frame_start(struct sk_buff *skb, struct ieee802154_hdr *hdr) { int hlen; -struct ieee802154_mac_cb *cb =mac_cb_init (skb); +struct ieee802154_mac_cb *cb =mac_cb (skb);skb_reset_mac_header (skb);
@@ -294,8 +294,9 @@ void ieee802154_rx_irqsafe(struct ieee802154_hw *hw, struct sk_buff *skb, u8 lqi) { struct ieee802154_local *local = hw_to_local(hw); +struct ieee802154_mac_cb *cb =mac_cb_init (skb); -mac_cb (skb)->lqi = lqi; + cb->lqi = lqi; skb->pkt_type =IEEE802154_RX_MSG ;skb_queue_tail (&local->skb_queue, skb);tasklet_schedule (&local->tasklet);
Greg Kroah-Hartman
maintainerPATCH 16/64 drm/msm/dsi: fix memory corruption with too many bridges
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 2e786eb2f9cebb07e317226b60054df510b60c65 upstream.
Add the missing sanity check on the bridge counter to avoid corrupting data beyond the fixed-sized bridge array in case there are ever more than eight bridges.
Patchwork: https://patchwork.freedesktop.org/patch/502668/
--- drivers/gpu/drm/msm/dsi/dsi.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/msm/dsi/dsi.c +6 -0
@@ -203,6 +203,12 @@ int msm_dsi_modeset_init(struct msm_dsireturn -EINVAL ; priv = dev->dev_private; + +if (priv->num_bridges ==ARRAY_SIZE (priv->bridges)) { +DRM_DEV_ERROR (dev->dev,"too many bridges\n" ); +return -ENOSPC ; + } + msm_dsi->dev = dev; ret =msm_dsi_host_modeset_init (msm_dsi->host, dev);
Greg Kroah-Hartman
maintainerPATCH 17/64 drm/msm/hdmi: fix memory corruption with too many bridges
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 4c1294da6aed1f16d47a417dcfe6602833c3c95c upstream.
Add the missing sanity check on the bridge counter to avoid corrupting data beyond the fixed-sized bridge array in case there are ever more than eight bridges.
Patchwork: https://patchwork.freedesktop.org/patch/502670/
--- drivers/gpu/drm/msm/hdmi/hdmi.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/gpu/drm/msm/hdmi/hdmi.c +5 -0
@@ -293,6 +293,11 @@ int msm_hdmi_modeset_init(struct hdmi *hstruct platform_device *pdev = hdmi->pdev;int ret; +if (priv->num_bridges ==ARRAY_SIZE (priv->bridges)) { +DRM_DEV_ERROR (dev->dev,"too many bridges\n" ); +return -ENOSPC ; + } + hdmi->dev = dev; hdmi->encoder = encoder;
Greg Kroah-Hartman
maintainerPATCH 18/64 mmc: core: Fix kernel panic when remove non-standard SDIO card
In reply to Greg Kroah-HartmanFrom: Matthew Ma <[email protected]>
commit 9972e6b404884adae9eec7463e30d9b3c9a70b18 upstream.
SDIO tuple is only allocated for standard SDIO card, especially it causes memory corruption issues when the non-standard SDIO card has removed, which is because the card device's reference counter does not increase for it at sdio_init_func(), but all SDIO card device reference counter gets decreased at sdio_release_func().
--- drivers/mmc/core/sdio_bus.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/mmc/core/sdio_bus.c +2 -1
@@ -266,7 +266,8 @@ static void sdio_release_func(struct dev {struct sdio_func *func =dev_to_sdio_func (dev); -sdio_free_func_cis (func); +if (!(func->card->quirks &MMC_QUIRK_NONSTD_SDIO )) +sdio_free_func_cis (func);kfree (func->info);kfree (func->tmpbuf);
Greg Kroah-Hartman
maintainerPATCH 19/64 kernfs: fix use-after-free in __kernfs_remove
In reply to Greg Kroah-HartmanFrom: Christian A. Ehrhardt <[email protected]>
commit 4abc99652812a2ddf932f137515d5c5a04723538 upstream.
Syzkaller managed to trigger concurrent calls to kernfs_remove_by_name_ns() for the same file resulting in a KASAN detected use-after-free. The race occurs when the root node is freed during kernfs_drain().
To prevent this acquire an additional reference for the root of the tree that is removed before calling __kernfs_remove().
Found by syzkaller with the following reproducer (slab_nomerge is required):
syz_mount_image$ext4(0x0, &(0x7f0000000100)='./file0\x00', 0x100000, 0x0, 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0)
close(r0)pipe2(&(0x7f0000000140)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x800)
mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0), 0x408, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@mmap}, {@loose}, {@loose}, {@mmap}], [{@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@fsmagic={'fsmagic', 0x3d, 0x10001}}, {@dont_hash}]}})
Sample report:
==================================================================
BUG: KASAN: use-after-free in kernfs_type include/linux/kernfs.h:335 [inline] BUG: KASAN: use-after-free in kernfs_leftmost_descendant fs/kernfs/dir.c:1261 [inline] BUG: KASAN: use-after-free in __kernfs_remove.part.0+0x843/0x960 fs/kernfs/dir.c:1369 Read of size 2 at addr ffff8880088807f0 by task syz-executor.2/857 CPU: 0 PID: 857 Comm: syz-executor.2 Not tainted 6.0.0-rc3-00363-g7726d4c3e60b #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x6e/0x91 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x5e/0x5e5 mm/kasan/report.c:433 kasan_report+0xa3/0x130 mm/kasan/report.c:495 kernfs_type include/linux/kernfs.h:335 [inline] kernfs_leftmost_descendant fs/kernfs/dir.c:1261 [inline] __kernfs_remove.part.0+0x843/0x960 fs/kernfs/dir.c:1369 __kernfs_remove fs/kernfs/dir.c:1356 [inline] kernfs_remove_by_name_ns+0x108/0x190 fs/kernfs/dir.c:1589 sysfs_slab_add+0x133/0x1e0 mm/slub.c:5943 __kmem_cache_create+0x3e0/0x550 mm/slub.c:4899 create_cache mm/slab_common.c:229 [inline] kmem_cache_create_usercopy+0x167/0x2a0 mm/slab_common.c:335 p9_client_create+0xd4d/0x1190 net/9p/client.c:993 v9fs_session_init+0x1e6/0x13c0 fs/9p/v9fs.c:408 v9fs_mount+0xb9/0xbd0 fs/9p/vfs_super.c:126 legacy_get_tree+0xf1/0x200 fs/fs_context.c:610 vfs_get_tree+0x85/0x2e0 fs/super.c:1530 do_new_mount fs/namespace.c:3040 [inline] path_mount+0x675/0x1d00 fs/namespace.c:3370 do_mount fs/namespace.c:3383 [inline] __do_sys_mount fs/namespace.c:3591 [inline] __se_sys_mount fs/namespace.c:3568 [inline] __x64_sys_mount+0x282/0x300 fs/namespace.c:3568 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f725f983aed Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f725f0f7028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f725faa3f80 RCX: 00007f725f983aed RDX: 00000000200000c0 RSI: 0000000020000040 RDI: 0000000000000000 RBP: 00007f725f9f419c R08: 0000000020000280 R09: 0000000000000000 R10: 0000000000000408 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000006 R14: 00007f725faa3f80 R15: 00007f725f0d7000 </TASK> Allocated by task 855: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:437 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:470 kasan_slab_alloc include/linux/kasan.h:224 [inline] slab_post_alloc_hook mm/slab.h:727 [inline] slab_alloc_node mm/slub.c:3243 [inline] slab_alloc mm/slub.c:3251 [inline] __kmem_cache_alloc_lru mm/slub.c:3258 [inline] kmem_cache_alloc+0xbf/0x200 mm/slub.c:3268 kmem_cache_zalloc include/linux/slab.h:723 [inline] __kernfs_new_node+0xd4/0x680 fs/kernfs/dir.c:593 kernfs_new_node fs/kernfs/dir.c:655 [inline] kernfs_create_dir_ns+0x9c/0x220 fs/kernfs/dir.c:1010 sysfs_create_dir_ns+0x127/0x290 fs/sysfs/dir.c:59 create_dir lib/kobject.c:63 [inline] kobject_add_internal+0x24a/0x8d0 lib/kobject.c:223 kobject_add_varg lib/kobject.c:358 [inline] kobject_init_and_add+0x101/0x160 lib/kobject.c:441 sysfs_slab_add+0x156/0x1e0 mm/slub.c:5954 __kmem_cache_create+0x3e0/0x550 mm/slub.c:4899 create_cache mm/slab_common.c:229 [inline] kmem_cache_create_usercopy+0x167/0x2a0 mm/slab_common.c:335 p9_client_create+0xd4d/0x1190 net/9p/client.c:993 v9fs_session_init+0x1e6/0x13c0 fs/9p/v9fs.c:408 v9fs_mount+0xb9/0xbd0 fs/9p/vfs_super.c:126 legacy_get_tree+0xf1/0x200 fs/fs_context.c:610 vfs_get_tree+0x85/0x2e0 fs/super.c:1530 do_new_mount fs/namespace.c:3040 [inline] path_mount+0x675/0x1d00 fs/namespace.c:3370 do_mount fs/namespace.c:3383 [inline] __do_sys_mount fs/namespace.c:3591 [inline] __se_sys_mount fs/namespace.c:3568 [inline] __x64_sys_mount+0x282/0x300 fs/namespace.c:3568 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 857: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:45 kasan_set_free_info+0x20/0x40 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:367 [inline] ____kasan_slab_free mm/kasan/common.c:329 [inline] __kasan_slab_free+0x108/0x190 mm/kasan/common.c:375 kasan_slab_free include/linux/kasan.h:200 [inline] slab_free_hook mm/slub.c:1754 [inline] slab_free_freelist_hook mm/slub.c:1780 [inline] slab_free mm/slub.c:3534 [inline] kmem_cache_free+0x9c/0x340 mm/slub.c:3551 kernfs_put.part.0+0x2b2/0x520 fs/kernfs/dir.c:547 kernfs_put+0x42/0x50 fs/kernfs/dir.c:521 __kernfs_remove.part.0+0x72d/0x960 fs/kernfs/dir.c:1407 __kernfs_remove fs/kernfs/dir.c:1356 [inline] kernfs_remove_by_name_ns+0x108/0x190 fs/kernfs/dir.c:1589 sysfs_slab_add+0x133/0x1e0 mm/slub.c:5943 __kmem_cache_create+0x3e0/0x550 mm/slub.c:4899 create_cache mm/slab_common.c:229 [inline] kmem_cache_create_usercopy+0x167/0x2a0 mm/slab_common.c:335 p9_client_create+0xd4d/0x1190 net/9p/client.c:993 v9fs_session_init+0x1e6/0x13c0 fs/9p/v9fs.c:408 v9fs_mount+0xb9/0xbd0 fs/9p/vfs_super.c:126 legacy_get_tree+0xf1/0x200 fs/fs_context.c:610 vfs_get_tree+0x85/0x2e0 fs/super.c:1530 do_new_mount fs/namespace.c:3040 [inline] path_mount+0x675/0x1d00 fs/namespace.c:3370 do_mount fs/namespace.c:3383 [inline] __do_sys_mount fs/namespace.c:3591 [inline] __se_sys_mount fs/namespace.c:3568 [inline] __x64_sys_mount+0x282/0x300 fs/namespace.c:3568 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The buggy address belongs to the object at ffff888008880780 which belongs to the cache kernfs_node_cache of size 128
The buggy address is located 112 bytes inside of
128-byte region [ffff888008880780, ffff888008880800)
The buggy address belongs to the physical page:
page:00000000732833f8 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8880
flags: 0x100000000000200(slab|node=0|zone=1)
raw: 0100000000000200 0000000000000000 dead000000000122 ffff888001147280
raw: 0000000000000000 0000000000150015 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888008880680: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
ffff888008880700: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff888008880780: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888008880800: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
ffff888008880880: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================--- fs/kernfs/dir.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/kernfs/dir.c +4 -1
@@ -1515,8 +1515,11 @@ int kernfs_remove_by_name_ns(struct kernmutex_lock (&kernfs_mutex); kn =kernfs_find_ns (parent, name, ns); -if (kn) +if (kn) { +kernfs_get (kn);__kernfs_remove (kn); +kernfs_put (kn); + }mutex_unlock (&kernfs_mutex);
Greg Kroah-Hartman
maintainerPATCH 20/64 perf auxtrace: Fix address filter symbol name match for modules
In reply to Greg Kroah-HartmanFrom: Adrian Hunter <[email protected]>
commit cba04f3136b658583adb191556f99d087589c1cc upstream.
For modules, names from kallsyms__parse() contain the module name which meant that module symbols did not match exactly by name.
Fix by matching the name string up to the separating tab character.
--- tools/perf/util/auxtrace.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
tools/perf/util/auxtrace.c +9 -1
@@ -1710,11 +1710,19 @@ struct sym_args {bool near; }; +static bool kern_sym_name_match (const char *kname,const char *name) +{ +size_t n =strlen (name); + +return !strcmp (kname, name) || + (!strncmp (kname, name, n) && kname[n] =='\t' ); +} +static bool kern_sym_match (struct sym_args *args,const char *name,char type) {/* A function with the same name, and global or the n'th found or any */ return kallsyms__is_function (type) && - !strcmp (name, args->name) && +kern_sym_name_match (name, args->name) && ((args->global &&isupper (type)) || (args->selected && ++(args->cnt) == args->idx) || (!args->global && !args->selected));
Greg Kroah-Hartman
maintainerPATCH 21/64 s390/futex: add missing EX_TABLE entry to __futex_atomic_op()
In reply to Greg Kroah-HartmanFrom: Heiko Carstens <[email protected]>
commit a262d3ad6a433e4080cecd0a8841104a5906355e upstream.
For some exception types the instruction address points behind the instruction that caused the exception. Take that into account and add the missing exception table entry.
--- arch/s390/include/asm/futex.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/s390/include/asm/futex.h +2 -1
@@ -16,7 +16,8 @@"3: jl 1b\n" \" lhi %0,0\n" \"4: sacf 768\n" \ - EX_TABLE(0b,4b) EX_TABLE(2b,4b) EX_TABLE(3b,4b) \ + EX_TABLE(0b,4b) EX_TABLE(1b,4b) \ + EX_TABLE(2b,4b) EX_TABLE(3b,4b) \ : "=d" (ret), "=&d" (oldval), "=&d" (newval), \" =m" (*uaddr) \ : "0" (-EFAULT), "d" (oparg), "a" (uaddr), \
Greg Kroah-Hartman
maintainerPATCH 22/64 s390/pci: add missing EX_TABLE entries to __pcistg_mio_inuser()/__pcilg_mio_inuser()
In reply to Greg Kroah-HartmanFrom: Heiko Carstens <[email protected]>
commit 6ec803025cf3173a57222e4411097166bd06fa98 upstream.
For some exception types the instruction address points behind the instruction that caused the exception. Take that into account and add the missing exception table entry.
--- arch/s390/pci/pci_mmio.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/s390/pci/pci_mmio.c +4 -4
@@ -64,7 +64,7 @@ static inline int __pcistg_mio_inuser( asmvolatile (" sacf 256\n" "0: llgc %[tmp],0(%[src])\n" -" sllg %[val],%[val],8\n" +"4: sllg %[val],%[val],8\n" " aghi %[src],1\n" " ogr %[val],%[tmp]\n" " brctg %[cnt],0b\n"
@@ -72,7 +72,7 @@ static inline int __pcistg_mio_inuser("2: ipm %[cc]\n" " srl %[cc],28\n" "3: sacf 768\n" - EX_TABLE(0b, 3b) EX_TABLE(1b, 3b) EX_TABLE(2b, 3b) + EX_TABLE(0b, 3b) EX_TABLE(4b, 3b) EX_TABLE(1b, 3b) EX_TABLE(2b, 3b) : [src] "+a" (src), [cnt] "+d" (cnt), [val] "+d" (val), [tmp] "=d" (tmp),
@@ -220,10 +220,10 @@ static inline int __pcilg_mio_inuser("2: ahi %[shift],-8\n" " srlg %[tmp],%[val],0(%[shift])\n" "3: stc %[tmp],0(%[dst])\n" -" aghi %[dst],1\n" +"5: aghi %[dst],1\n" " brctg %[cnt],2b\n" "4: sacf 768\n" - EX_TABLE(0b, 4b) EX_TABLE(1b, 4b) EX_TABLE(3b, 4b) + EX_TABLE(0b, 4b) EX_TABLE(1b, 4b) EX_TABLE(3b, 4b) EX_TABLE(5b, 4b) : [cc] "+d" (cc), [val] "=d" (val), [len] "+d" (len), [dst] "+a" (dst), [cnt] "+d" (cnt), [tmp] "=d" (tmp),
Greg Kroah-Hartman
maintainerPATCH 23/64 xfs: finish dfops on every insert range shift iteration
In reply to Greg Kroah-HartmanFrom: Chandan Babu R <[email protected]>
From: Brian Foster <[email protected]>
commit 9c516e0e4554e8f26ab73d46cbc789d7d8db664d upstream.
The recent change to make insert range an atomic operation used the incorrect transaction rolling mechanism. The explicit transaction roll does not finish deferred operations. This means that intents for rmapbt updates caused by extent shifts are not logged until the final transaction commits. Thus if a crash occurs during an insert range, log recovery might leave the rmapbt in an inconsistent state. This was discovered by repeated runs of generic/455.
Update insert range to finish dfops on every shift iteration. This is similar to collapse range and ensures that intents are logged with the transactions that make associated changes.
--- fs/xfs/xfs_bmap_util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/xfs/xfs_bmap_util.c +1 -1
@@ -1340,7 +1340,7 @@ xfs_insert_file_space( goto out_trans_cancel; do { - error = xfs_trans_roll_inode(&tp, ip); + error = xfs_defer_finish(&tp); if (error) goto out_trans_cancel;
Greg Kroah-Hartman
maintainerPATCH 24/64 xfs: clear XFS_DQ_FREEING if we cant lock the dquot buffer to flush
In reply to Greg Kroah-HartmanFrom: Chandan Babu R <[email protected]>
From: "Darrick J. Wong" <[email protected]>
commit c97738a960a86081a147e7d436138e6481757445 upstream.
In commit 8d3d7e2b35ea, we changed xfs_qm_dqpurge to bail out if we can't lock the dquot buf to flush the dquot. This prevents the AIL from blocking on the dquot, but it also forgets to clear the FREEING flag on its way out. A subsequent purge attempt will see the FREEING flag is set and bail out, which leads to dqpurge_all failing to purge all the dquots.
(copy-pasting from Dave Chinner's identical patch)
This was found by inspection after having xfs/305 hang 1 in ~50 iterations in a quotaoff operation:
[ 8872.301115] xfs_quota D13888 92262 91813 0x00004002 [ 8872.302538] Call Trace: [ 8872.303193] __schedule+0x2d2/0x780 [ 8872.304108] ? do_raw_spin_unlock+0x57/0xd0 [ 8872.305198] schedule+0x6e/0xe0 [ 8872.306021] schedule_timeout+0x14d/0x300 [ 8872.307060] ? __next_timer_interrupt+0xe0/0xe0 [ 8872.308231] ? xfs_qm_dqusage_adjust+0x200/0x200 [ 8872.309422] schedule_timeout_uninterruptible+0x2a/0x30 [ 8872.310759] xfs_qm_dquot_walk.isra.0+0x15a/0x1b0 [ 8872.311971] xfs_qm_dqpurge_all+0x7f/0x90 [ 8872.313022] xfs_qm_scall_quotaoff+0x18d/0x2b0 [ 8872.314163] xfs_quota_disable+0x3a/0x60 [ 8872.315179] kernel_quotactl+0x7e2/0x8d0 [ 8872.316196] ? __do_sys_newstat+0x51/0x80 [ 8872.317238] __x64_sys_quotactl+0x1e/0x30 [ 8872.318266] do_syscall_64+0x46/0x90 [ 8872.319193] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 8872.320490] RIP: 0033:0x7f46b5490f2a [ 8872.321414] Code: Bad RIP value.
Returning -EAGAIN from xfs_qm_dqpurge() without clearing the XFS_DQ_FREEING flag means the xfs_qm_dqpurge_all() code can never free the dquot, and we loop forever waiting for the XFS_DQ_FREEING flag to go away on the dquot that leaked it via -EAGAIN.
--- fs/xfs/xfs_qm.c | 1 + 1 file changed, 1 insertion(+)
fs/xfs/xfs_qm.c +1 -0
@@ -148,6 +148,7 @@ xfs_qm_dqpurge( error =xfs_bwrite (bp);xfs_buf_relse (bp); }else if (error == -EAGAIN ) { + dqp->dq_flags &= ~XFS_DQ_FREEING ; goto out_unlock; }xfs_dqflock (dqp);
Greg Kroah-Hartman
maintainerPATCH 25/64 xfs: force the log after remapping a synchronous-writes file
In reply to Greg Kroah-HartmanFrom: Chandan Babu R <[email protected]>
From: "Darrick J. Wong" <[email protected]>
commit 5ffce3cc22a0e89813ed0c7162a68b639aef9ab6 upstream.
Commit 5833112df7e9 tried to make it so that a remap operation would force the log out to disk if the filesystem is mounted with mandatory synchronous writes. Unfortunately, that commit failed to handle the case where the inode or the file descriptor require mandatory synchronous writes.
Refactor the check into into a helper that will look for all three conditions, and now we can treat reflink just like any other synchronous write.
--- fs/xfs/xfs_file.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
fs/xfs/xfs_file.c +16 -1
@@ -990,6 +990,21 @@ xfs_file_fadvise(return ret; } +/* Does this file, inode, or mount want synchronous writes? */ +static inline bool xfs_file_sync_writes (struct file *filp) +{ +struct xfs_inode *ip =XFS_I (file_inode (filp)); + +if (ip->i_mount->m_flags &XFS_MOUNT_WSYNC ) +return true; +if (filp->f_flags & (__O_SYNC |O_DSYNC )) +return true; +if (IS_SYNC (file_inode (filp))) +return true; + +return false; +} + STATIC loff_t xfs_file_remap_range( struct file *file_in,
@@ -1047,7 +1062,7 @@ xfs_file_remap_range(if (ret) goto out_unlock; -if (mp->m_flags &XFS_MOUNT_WSYNC ) +if (xfs_file_sync_writes (file_in) ||xfs_file_sync_writes (file_out))xfs_log_force_inode (dest); out_unlock:xfs_reflink_remap_unlock (file_in, file_out);
Greg Kroah-Hartman
maintainerPATCH 26/64 Xen/gntdev: dont ignore kernel unmapping error
In reply to Greg Kroah-HartmanFrom: Jan Beulich <[email protected]>
commit f28347cc66395e96712f5c2db0a302ee75bafce6 upstream.
While working on XSA-361 and its follow-ups, I failed to spot another place where the kernel mapping part of an operation was not treated the same as the user space part. Detect and propagate errors and add a 2nd pr_debug().
--- drivers/xen/gntdev.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/xen/gntdev.c +8 -0
@@ -419,6 +419,14 @@ static void __unmap_grant_pages_done(int map->unmap_ops[offset+i].handle, map->unmap_ops[offset+i].status); map->unmap_ops[offset+i].handle =-1 ; +if (use_ptemod) { +WARN_ON (map->kunmap_ops[offset+i].status && + map->kunmap_ops[offset+i].handle !=-1 ); +pr_debug ("kunmap handle=%u st=%d\n" , + map->kunmap_ops[offset+i].handle, + map->kunmap_ops[offset+i].status); + map->kunmap_ops[offset+i].handle =-1 ; + } }/* * Decrease the live-grant counter. This must happen after the loop to
Greg Kroah-Hartman
maintainerPATCH 27/64 xen/gntdev: Prevent leaking grants
In reply to Greg Kroah-HartmanFrom: M. Vefa Bicakci <[email protected]>
commit 0991028cd49567d7016d1b224fe0117c35059f86 upstream.
Prior to this commit, if a grant mapping operation failed partially, some of the entries in the map_ops array would be invalid, whereas all of the entries in the kmap_ops array would be valid. This in turn would cause the following logic in gntdev_map_grant_pages to become invalid:
for (i = 0; i < map->count; i++) {
if (map->map_ops[i].status == GNTST_okay) {
map->unmap_ops[i].handle = map->map_ops[i].handle;
if (!use_ptemod)
alloced++;
}
if (use_ptemod) {
if (map->kmap_ops[i].status == GNTST_okay) {
if (map->map_ops[i].status == GNTST_okay)
alloced++;
map->kunmap_ops[i].handle = map->kmap_ops[i].handle;
}
}
}
...
atomic_add(alloced, &map->live_grants);Assume that use_ptemod is true (i.e., the domain mapping the granted pages is a paravirtualized domain). In the code excerpt above, note that the "alloced" variable is only incremented when both kmap_ops[i].status and map_ops[i].status are set to GNTST_okay (i.e., both mapping operations are successful). However, as also noted above, there are cases where a grant mapping operation fails partially, breaking the assumption of the code excerpt above.
The aforementioned causes map->live_grants to be incorrectly set. In some cases, all of the map_ops mappings fail, but all of the kmap_ops mappings succeed, meaning that live_grants may remain zero. This in turn makes it impossible to unmap the successfully grant-mapped pages pointed to by kmap_ops, because unmap_grant_pages has the following snippet of code at its beginning:
if (atomic_read(&map->live_grants) == 0)
return; /* Nothing to do */
In other cases where only some of the map_ops mappings fail but all kmap_ops mappings succeed, live_grants is made positive, but when the user requests unmapping the grant-mapped pages, __unmap_grant_pages_done will then make map->live_grants negative, because the latter function does not check if all of the pages that were requested to be unmapped were actually unmapped, and the same function unconditionally subtracts "data->count" (i.e., a value that can be greater than map->live_grants) from map->live_grants. The side effects of a negative live_grants value have not been studied.
The net effect of all of this is that grant references are leaked in one of the above conditions. In Qubes OS v4.1 (which uses Xen's grant mechanism extensively for X11 GUI isolation), this issue manifests itself with warning messages like the following to be printed out by the Linux kernel in the VM that had granted pages (that contain X11 GUI window data) to dom0: "g.e. 0x1234 still pending", especially after the user rapidly resizes GUI VM windows (causing some grant-mapping operations to partially or completely fail, due to the fact that the VM unshares some of the pages as part of the window resizing, making the pages impossible to grant-map from dom0).
The fix for this issue involves counting all successful map_ops and kmap_ops mappings separately, and then adding the sum to live_grants. During unmapping, only the number of successfully unmapped grants is subtracted from live_grants. The code is also modified to check for negative live_grants values after the subtraction and warn the user.
--- drivers/xen/gntdev.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-)
drivers/xen/gntdev.c +17 -5
@@ -384,8 +384,7 @@ int gntdev_map_grant_pages(struct gntdevfor (i =0 ; i < map->count; i++) {if (map->map_ops[i].status == GNTST_okay) { map->unmap_ops[i].handle = map->map_ops[i].handle; -if (!use_ptemod) - alloced++; + alloced++; }else if (!err) err = -EINVAL ;
@@ -394,8 +393,7 @@ int gntdev_map_grant_pages(struct gntdevif (use_ptemod) {if (map->kmap_ops[i].status == GNTST_okay) { -if (map->map_ops[i].status == GNTST_okay) - alloced++; + alloced++; map->kunmap_ops[i].handle = map->kmap_ops[i].handle; }else if (!err) err = -EINVAL ;
@@ -411,8 +409,14 @@ static void __unmap_grant_pages_done(intunsigned int i;struct gntdev_grant_map *map = data->data;unsigned int offset = data->unmap_ops - map->unmap_ops; +int successful_unmaps =0 ; +int live_grants;for (i =0 ; i < data->count; i++) { +if (map->unmap_ops[offset + i].status == GNTST_okay && + map->unmap_ops[offset + i].handle !=-1 ) + successful_unmaps++; +WARN_ON (map->unmap_ops[offset+i].status && map->unmap_ops[offset+i].handle !=-1 ); pr_debug("unmap handle=%d st=%d\n",
@@ -420,6 +424,10 @@ static void __unmap_grant_pages_done(int map->unmap_ops[offset+i].status); map->unmap_ops[offset+i].handle =-1 ;if (use_ptemod) { +if (map->kunmap_ops[offset + i].status == GNTST_okay && + map->kunmap_ops[offset + i].handle !=-1 ) + successful_unmaps++; +WARN_ON (map->kunmap_ops[offset+i].status && map->kunmap_ops[offset+i].handle !=-1 ); pr_debug("kunmap handle=%u st=%d\n",
@@ -428,11 +436,15 @@ static void __unmap_grant_pages_done(int map->kunmap_ops[offset+i].handle =-1 ; } } +/* * Decrease the live-grant counter. This must happen after the loop to * prevent premature reuse of the grants by gnttab_mmap(). */ -atomic_sub (data->count, &map->live_grants); + live_grants =atomic_sub_return (successful_unmaps, &map->live_grants); +if (WARN_ON (live_grants <0 )) +pr_err ("%s: live_grants became negative (%d) after unmapping %d pages!\n" , + __func__, live_grants, successful_unmaps);/* Release reference taken by __unmap_grant_pages */ gntdev_put_map (NULL , map);
Greg Kroah-Hartman
maintainerPATCH 28/64 cgroup-v1: add disabled controller check in cgroup1_parse_param()
In reply to Greg Kroah-HartmanFrom: Chen Zhou <[email protected]>
commit 61e960b07b637f0295308ad91268501d744c21b5 upstream.
When mounting a cgroup hierarchy with disabled controller in cgroup v1, all available controllers will be attached.
For example, boot with cgroup_no_v1=cpu or cgroup_disable=cpu, and then mount with "mount -t cgroup -ocpu cpu /sys/fs/cgroup/cpu", then all enabled controllers will be attached except cpu.
Fix this by adding disabled controller check in cgroup1_parse_param(). If the specified controller is disabled, just return error with information "Disabled controller xx" rather than attaching all the other enabled controllers.
--- kernel/cgroup/cgroup-v1.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/cgroup/cgroup-v1.c +3 -0
@@ -944,6 +944,9 @@ int cgroup1_parse_param(struct fs_contexfor_each_subsys (ss, i) {if (strcmp (param->key, ss->legacy_name))continue ; +if (!cgroup_ssid_enabled (i) ||cgroup1_ssid_disabled (i)) +return invalf (fc,"Disabled controller '%s'" , + param->key); ctx->subsys_mask |= (1 << i);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 29/64 mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages
In reply to Greg Kroah-HartmanFrom: Rik van Riel <[email protected]>
commit 12df140f0bdfae5dcfc81800970dd7f6f632e00c upstream.
The h->*_huge_pages counters are protected by the hugetlb_lock, but alloc_huge_page has a corner case where it can decrement the counter outside of the lock.
This could lead to a corrupted value of h->resv_huge_pages, which we have observed on our systems.
Take the hugetlb_lock before decrementing h->resv_huge_pages to avoid a potential race.
--- mm/hugetlb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/hugetlb.c +1 -1
@@ -2218,11 +2218,11 @@ struct page *alloc_huge_page(struct vm_a page =alloc_buddy_huge_page_with_mpol (h, vma, addr);if (!page) goto out_uncharge_cgroup; +spin_lock (&hugetlb_lock);if (!avoid_reserve &&vma_has_reserves (vma, gbl_chg)) {SetPagePrivate (page); h->resv_huge_pages--; } -spin_lock (&hugetlb_lock);list_move (&page->lru, &h->hugepage_activelist);/* Fall through */ }
Greg Kroah-Hartman
maintainerPATCH 30/64 net: ieee802154: fix error return code in dgram_bind()
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
commit 444d8ad4916edec8a9fc684e841287db9b1e999f upstream.
Fix to return error code -EINVAL from the error handling case instead of 0, as done elsewhere in this function.
--- net/ieee802154/socket.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/ieee802154/socket.c +3 -1
@@ -507,8 +507,10 @@ static int dgram_bind(struct sock *sk, sif (err <0 ) goto out; -if (addr->family !=AF_IEEE802154 ) +if (addr->family !=AF_IEEE802154 ) { + err = -EINVAL ; goto out; + }ieee802154_addr_from_sa (&haddr, &addr->addr); dev =ieee802154_get_dev (sock_net (sk), &haddr);
Greg Kroah-Hartman
maintainerPATCH 31/64 media: v4l2: Fix v4l2_i2c_subdev_set_name function documentation
In reply to Greg Kroah-HartmanFrom: Alexander Stein <[email protected]>
[ Upstream commit bb9ea2c31fa11b789ade4c3abcdda3c5370a76ab ]
The doc says the I²C device's name is used if devname is NULL, but actually the I²C device driver's name is used.
--- include/media/v4l2-common.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
include/media/v4l2-common.h +2 -1
@@ -174,7 +174,8 @@ struct v4l2_subdev *v4l2_i2c_new_subdev_board(struct v4l2_device *v4l2_dev,* * @sd: pointer to &struct v4l2_subdev * @client: pointer to struct i2c_client -* @devname: the name of the device; if NULL, the I²C device's name will be used +* @devname: the name of the device; if NULL, the I²C device drivers's name +* will be used * @postfix: sub-device specific string to put right after the I²C device name; * may be NULL */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 32/64 drm/msm: Fix return type of mdp4_lvds_connector_mode_valid
In reply to Greg Kroah-HartmanFrom: Nathan Huckleberry <[email protected]>
[ Upstream commit 0b33a33bd15d5bab73b87152b220a8d0153a4587 ]
The mode_valid field in drm_connector_helper_funcs is expected to be of type:
enum drm_mode_status (* mode_valid) (struct drm_connector *connector,
struct drm_display_mode *mode);
The mismatched return type breaks forward edge kCFI since the underlying function definition does not match the function hook definition.
The return type of mdp4_lvds_connector_mode_valid should be changed from int to enum drm_mode_status.
Patchwork: https://patchwork.freedesktop.org/patch/502878/
--- drivers/gpu/drm/msm/disp/mdp4/mdp4_lvds_connector.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/msm/disp/mdp4/mdp4_lvds_connector.c +3 -2
@@ -61,8 +61,9 @@ static int mdp4_lvds_connector_get_modes(struct drm_connector *connector)return ret; } -static int mdp4_lvds_connector_mode_valid (struct drm_connector *connector, -struct drm_display_mode *mode) +static enum drm_mode_status +mdp4_lvds_connector_mode_valid (struct drm_connector *connector, +struct drm_display_mode *mode) {struct mdp4_lvds_connector *mdp4_lvds_connector =to_mdp4_lvds_connector (connector);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 33/64 arc: iounmap() arg is volatile
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit c44f15c1c09481d50fd33478ebb5b8284f8f5edb ]
Add 'volatile' to iounmap()'s argument to prevent build warnings. This make it the same as other major architectures.
Placates these warnings: (12 such warnings)
../drivers/video/fbdev/riva/fbdev.c: In function 'rivafb_probe':../drivers/video/fbdev/riva/fbdev.c:2067:42: error: passing argument 1 of 'iounmap' discards 'volatile' qualifier from pointer target type [-Werror=discarded-qualifiers]
2067 | iounmap(default_par->riva.PRAMIN);
--- arch/arc/include/asm/io.h | 2 +- arch/arc/mm/ioremap.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/arc/include/asm/io.h +1 -1
@@ -32,7 +32,7 @@ static inline void ioport_unmap(void __iomem *addr) { } -extern void iounmap (const void __iomem *addr); +extern void iounmap (const volatile void __iomem *addr);#define ioremap_nocache (phy, sz) ioremap(phy, sz)#define ioremap_wc (phy, sz) ioremap(phy, sz)
arch/arc/mm/ioremap.c +1 -1
@@ -93,7 +93,7 @@ void __iomem *ioremap_prot(phys_addr_t paddr, unsigned long size,EXPORT_SYMBOL (ioremap_prot); -void iounmap (const void __iomem *addr) +void iounmap (const volatile void __iomem *addr) {/* weird double cast to handle phys_addr_t > 32 bits */ if (arc_uncached_addr_space ((phys_addr_t )(u32 )addr))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 34/64 ALSA: ac97: fix possible memory leak in snd_ac97_dev_register()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 4881bda5ea05c8c240fc8afeaa928e2bc43f61fa ]
If device_register() fails in snd_ac97_dev_register(), it should call put_device() to give up reference, or the name allocated in dev_set_name() is leaked.
--- sound/pci/ac97/ac97_codec.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/ac97/ac97_codec.c +1 -0
@@ -1945,6 +1945,7 @@ static int snd_ac97_dev_register(struct snd_device *device) snd_ac97_get_short_name(ac97));if ((err =device_register (&ac97->dev)) <0 ) {ac97_err (ac97,"Can't register ac97 bus\n" ); +put_device (&ac97->dev); ac97->dev.bus =NULL ;return err; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 35/64 tipc: fix a null-ptr-deref in tipc_topsrv_accept
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
[ Upstream commit 82cb4e4612c633a9ce320e1773114875604a3cce ]
syzbot found a crash in tipc_topsrv_accept:
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] Workqueue: tipc_rcv tipc_topsrv_accept RIP: 0010:kernel_accept+0x22d/0x350 net/socket.c:3487 Call Trace: <TASK> tipc_topsrv_accept+0x197/0x280 net/tipc/topsrv.c:460 process_one_work+0x991/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e4/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
It was caused by srv->listener that might be set to null by tipc_topsrv_stop() in net .exit whereas it's still used in tipc_topsrv_accept() worker.
srv->listener is protected by srv->idr_lock in tipc_topsrv_stop(), so add a check for srv->listener under srv->idr_lock in tipc_topsrv_accept() to avoid the null-ptr-deref. To ensure the lsock is not released during the tipc_topsrv_accept(), move sock_release() after tipc_topsrv_work_stop() where it's waiting until the tipc_topsrv_accept worker to be done.
Note that sk_callback_lock is used to protect sk->sk_user_data instead of srv->listener, and it should check srv in tipc_topsrv_listener_data_ready() instead. This also ensures that no more tipc_topsrv_accept worker will be started after tipc_conn_close() is called in tipc_topsrv_stop() where it sets sk->sk_user_data to null.
--- net/tipc/topsrv.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
net/tipc/topsrv.c +12 -4
@@ -450,12 +450,19 @@ static void tipc_conn_data_ready(struct sock *sk)static void tipc_topsrv_accept (struct work_struct *work) { struct tipc_topsrv *srv = container_of(work, struct tipc_topsrv, awork); -struct socket *lsock = srv->listener; -struct socket *newsock; +struct socket *newsock, *lsock;struct tipc_conn *con;struct sock *newsk;int ret; +spin_lock_bh (&srv->idr_lock); +if (!srv->listener) { +spin_unlock_bh (&srv->idr_lock); +return ; + } + lsock = srv->listener; +spin_unlock_bh (&srv->idr_lock); +while (1 ) { ret =kernel_accept (lsock, &newsock,O_NONBLOCK );if (ret <0 )
@@ -489,7 +496,7 @@ static void tipc_topsrv_listener_data_ready(struct sock *sk)read_lock_bh (&sk->sk_callback_lock); srv = sk->sk_user_data; -if (srv->listener) +if (srv)queue_work (srv->rcv_wq, &srv->awork);read_unlock_bh (&sk->sk_callback_lock); }
@@ -699,8 +706,9 @@ static void tipc_topsrv_stop(struct net *net)__module_get (lsock->sk->sk_prot_creator->owner); srv->listener =NULL ;spin_unlock_bh (&srv->idr_lock); -sock_release (lsock); +tipc_topsrv_work_stop (srv); +sock_release (lsock);idr_destroy (&srv->conn_idr);kfree (srv); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 36/64 net: netsec: fix error handling in netsec_register_mdio()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 94423589689124e8cd145b38a1034be7f25835b2 ]
If phy_device_register() fails, phy_device_free() need be called to put refcount, so memory of phy device and device name can be freed in callback function.
If get_phy_device() fails, mdiobus_unregister() need be called, or it will cause warning in mdiobus_free() and kobject is leaked.
--- drivers/net/ethernet/socionext/netsec.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/socionext/netsec.c +2 -0
@@ -1936,11 +1936,13 @@ static int netsec_register_mdio(struct netsec_priv *priv, u32 phy_addr) ret =PTR_ERR (priv->phydev);dev_err (priv->dev,"get_phy_device err(%d)\n" , ret); priv->phydev =NULL ; +mdiobus_unregister (bus);return -ENODEV ; } ret =phy_device_register (priv->phydev);if (ret) { +phy_device_free (priv->phydev);mdiobus_unregister (bus);dev_err (priv->dev,"phy_device_register err(%d)\n" , ret);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 37/64 x86/unwind/orc: Fix unreliable stack dump with gcov
In reply to Greg Kroah-HartmanFrom: Chen Zhongjin <[email protected]>
[ Upstream commit 230db82413c091bc16acee72650f48d419cebe49 ]
When a console stack dump is initiated with CONFIG_GCOV_PROFILE_ALL enabled, show_trace_log_lvl() gets out of sync with the ORC unwinder, causing the stack trace to show all text addresses as unreliable:
# echo l > /proc/sysrq-trigger [ 477.521031] sysrq: Show backtrace of all active CPUs [ 477.523813] NMI backtrace for cpu 0 [ 477.524492] CPU: 0 PID: 1021 Comm: bash Not tainted 6.0.0 #65 [ 477.525295] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-1.fc36 04/01/2014 [ 477.526439] Call Trace: [ 477.526854] <TASK> [ 477.527216] ? dump_stack_lvl+0xc7/0x114 [ 477.527801] ? dump_stack+0x13/0x1f [ 477.528331] ? nmi_cpu_backtrace.cold+0xb5/0x10d [ 477.528998] ? lapic_can_unplug_cpu+0xa0/0xa0 [ 477.529641] ? nmi_trigger_cpumask_backtrace+0x16a/0x1f0 [ 477.530393] ? arch_trigger_cpumask_backtrace+0x1d/0x30 [ 477.531136] ? sysrq_handle_showallcpus+0x1b/0x30 [ 477.531818] ? __handle_sysrq.cold+0x4e/0x1ae [ 477.532451] ? write_sysrq_trigger+0x63/0x80 [ 477.533080] ? proc_reg_write+0x92/0x110 [ 477.533663] ? vfs_write+0x174/0x530 [ 477.534265] ? handle_mm_fault+0x16f/0x500 [ 477.534940] ? ksys_write+0x7b/0x170 [ 477.535543] ? __x64_sys_write+0x1d/0x30 [ 477.536191] ? do_syscall_64+0x6b/0x100 [ 477.536809] ? entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 477.537609] </TASK>
This happens when the compiled code for show_stack() has a single word on the stack, and doesn't use a tail call to show_stack_log_lvl(). (CONFIG_GCOV_PROFILE_ALL=y is the only known case of this.) Then the __unwind_start() skip logic hits an off-by-one bug and fails to unwind all the way to the intended starting frame.
Fix it by reverting the following commit:
f1d9a2abff66 ("x86/unwind/orc: Don't skip the first frame for inactive tasks")
The original justification for that commit no longer exists. That original issue was later fixed in a different way, with the following commit:
f2ac57a4c49d ("x86/unwind/orc: Fix inactive tasks with stack pointer in %sp on GCC 10 compiled kernels")
--- arch/x86/kernel/unwind_orc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/unwind_orc.c +1 -1
@@ -687,7 +687,7 @@ void __unwind_start(struct unwind_state *state, struct task_struct *task,/* Otherwise, skip ahead to the user-specified starting frame: */ while (!unwind_done (state) && (!on_stack (&state->stack_info, first_frame,sizeof (long )) || - state->sp < (unsigned long )first_frame)) + state->sp <= (unsigned long )first_frame))unwind_next_frame (state);return ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 38/64 amd-xgbe: fix the SFP compliance codes check for DAC cables
In reply to Greg Kroah-HartmanFrom: Raju Rangoju <[email protected]>
[ Upstream commit 09c5f6bf11ac98874339e55f4f5f79a9dbc9b375 ]
The current XGBE code assumes that offset 6 of EEPROM SFP DAC (passive) cables is NULL. However, some cables (the 5 meter and 7 meter Molex passive cables) have non-zero data at offset 6. Fix the logic by moving the passive cable check above the active checks, so as not to be improperly identified as an active cable. This will fix the issue for any passive cable that advertises 1000Base-CX in offset 6.
--- drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +4 -4
@@ -1150,7 +1150,10 @@ static void xgbe_phy_sfp_parse_eeprom(struct xgbe_prv_data *pdata) }/* Determine the type of SFP */ -if (sfp_base[XGBE_SFP_BASE_10GBE_CC ] &XGBE_SFP_BASE_10GBE_CC_SR ) +if (phy_data->sfp_cable ==XGBE_SFP_CABLE_PASSIVE && +xgbe_phy_sfp_bit_rate (sfp_eeprom,XGBE_SFP_SPEED_10000 )) + phy_data->sfp_base =XGBE_SFP_BASE_10000_CR ; +else if (sfp_base[XGBE_SFP_BASE_10GBE_CC ] &XGBE_SFP_BASE_10GBE_CC_SR ) phy_data->sfp_base =XGBE_SFP_BASE_10000_SR ;else if (sfp_base[XGBE_SFP_BASE_10GBE_CC ] &XGBE_SFP_BASE_10GBE_CC_LR ) phy_data->sfp_base =XGBE_SFP_BASE_10000_LR ;
@@ -1166,9 +1169,6 @@ static void xgbe_phy_sfp_parse_eeprom(struct xgbe_prv_data *pdata) phy_data->sfp_base =XGBE_SFP_BASE_1000_CX ; else if (sfp_base[XGBE_SFP_BASE_1GBE_CC] & XGBE_SFP_BASE_1GBE_CC_T) phy_data->sfp_base = XGBE_SFP_BASE_1000_T; - else if ((phy_data->sfp_cable == XGBE_SFP_CABLE_PASSIVE) && - xgbe_phy_sfp_bit_rate(sfp_eeprom, XGBE_SFP_SPEED_10000)) - phy_data->sfp_base = XGBE_SFP_BASE_10000_CR;switch (phy_data->sfp_base) {case XGBE_SFP_BASE_1000_T :
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 39/64 amd-xgbe: add the bit rate quirk for Molex cables
In reply to Greg Kroah-HartmanFrom: Raju Rangoju <[email protected]>
[ Upstream commit 170a9e341a3b02c0b2ea0df16ef14a33a4f41de8 ]
The offset 12 (bit-rate) of EEPROM SFP DAC (passive) cables is expected to be in the range 0x64 to 0x68. However, the 5 meter and 7 meter Molex passive cables have the rate ceiling 0x78 at offset 12.
Add a quirk for Molex passive cables to extend the rate ceiling to 0x78.
--- drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +8 -1
@@ -238,6 +238,7 @@ enum xgbe_sfp_speed {#define XGBE_SFP_BASE_BR_1GBE_MAX 0x0d#define XGBE_SFP_BASE_BR_10GBE_MIN 0x64#define XGBE_SFP_BASE_BR_10GBE_MAX 0x68 +#define XGBE_MOLEX_SFP_BASE_BR_10GBE_MAX 0x78#define XGBE_SFP_BASE_CU_CABLE_LEN 18
@@ -283,6 +284,8 @@ struct xgbe_sfp_eeprom {#define XGBE_BEL_FUSE_VENDOR "BEL-FUSE "#define XGBE_BEL_FUSE_PARTNO "1GBT-SFP06 " +#define XGBE_MOLEX_VENDOR "Molex Inc. " +struct xgbe_sfp_ascii {union {char vendor[XGBE_SFP_BASE_VENDOR_NAME_LEN +1 ];
@@ -833,7 +836,11 @@ static bool xgbe_phy_sfp_bit_rate(struct xgbe_sfp_eeprom *sfp_eeprom,break ;case XGBE_SFP_SPEED_10000 : min =XGBE_SFP_BASE_BR_10GBE_MIN ; - max =XGBE_SFP_BASE_BR_10GBE_MAX ; +if (memcmp (&sfp_eeprom->base[XGBE_SFP_BASE_VENDOR_NAME ], +XGBE_MOLEX_VENDOR ,XGBE_SFP_BASE_VENDOR_NAME_LEN ) ==0 ) + max =XGBE_MOLEX_SFP_BASE_BR_10GBE_MAX ; +else + max =XGBE_SFP_BASE_BR_10GBE_MAX ;break ;default :return false;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 40/64 kcm: annotate data-races around kcm->rx_psock
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 15e4dabda11b0fa31d510a915d1a580f47dfc92e ]
kcm->rx_psock can be read locklessly in kcm_rfree(). Annotate the read and writes accordingly.
We do the same for kcm->rx_wait in the following patch.
syzbot reported:
BUG: KCSAN: data-race in kcm_rfree / unreserve_rx_kcm
write to 0xffff888123d827b8 of 8 bytes by task 2758 on cpu 1:
unreserve_rx_kcm+0x72/0x1f0 net/kcm/kcmsock.c:313 kcm_rcv_strparser+0x2b5/0x3a0 net/kcm/kcmsock.c:373 __strp_recv+0x64c/0xd20 net/strparser/strparser.c:301 strp_recv+0x6d/0x80 net/strparser/strparser.c:335 tcp_read_sock+0x13e/0x5a0 net/ipv4/tcp.c:1703 strp_read_sock net/strparser/strparser.c:358 [inline] do_strp_work net/strparser/strparser.c:406 [inline] strp_work+0xe8/0x180 net/strparser/strparser.c:415 process_one_work+0x3d3/0x720 kernel/workqueue.c:2289 worker_thread+0x618/0xa70 kernel/workqueue.c:2436 kthread+0x1a9/0x1e0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
read to 0xffff888123d827b8 of 8 bytes by task 5859 on cpu 0:
kcm_rfree+0x14c/0x220 net/kcm/kcmsock.c:181 skb_release_head_state+0x8e/0x160 net/core/skbuff.c:841 skb_release_all net/core/skbuff.c:852 [inline] __kfree_skb net/core/skbuff.c:868 [inline] kfree_skb_reason+0x5c/0x260 net/core/skbuff.c:891 kfree_skb include/linux/skbuff.h:1216 [inline] kcm_recvmsg+0x226/0x2b0 net/kcm/kcmsock.c:1161 ____sys_recvmsg+0x16c/0x2e0 ___sys_recvmsg net/socket.c:2743 [inline] do_recvmmsg+0x2f1/0x710 net/socket.c:2837 __sys_recvmmsg net/socket.c:2916 [inline] __do_sys_recvmmsg net/socket.c:2939 [inline] __se_sys_recvmmsg net/socket.c:2932 [inline] __x64_sys_recvmmsg+0xde/0x160 net/socket.c:2932 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
value changed: 0xffff88812971ce00 -> 0x0000000000000000
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 5859 Comm: syz-executor.3 Not tainted 6.0.0-syzkaller-12189-g19d17ab7c68b-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
--- net/kcm/kcmsock.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
net/kcm/kcmsock.c +5 -3
@@ -177,7 +177,7 @@ static void kcm_rfree(struct sk_buff *skb)/* For reading rx_wait and rx_psock without holding lock */ smp_mb__after_atomic (); -if (!kcm->rx_wait && !kcm->rx_psock && +if (!kcm->rx_wait && !READ_ONCE (kcm->rx_psock) &&sk_rmem_alloc_get (sk) < sk->sk_rcvlowat) {spin_lock_bh (&mux->rx_lock);kcm_rcv_ready (kcm);
@@ -282,7 +282,8 @@ static struct kcm_sock *reserve_rx_kcm(struct kcm_psock *psock, kcm->rx_wait = false; psock->rx_kcm = kcm; - kcm->rx_psock = psock; +/* paired with lockless reads in kcm_rfree() */ +WRITE_ONCE (kcm->rx_psock, psock);spin_unlock_bh (&mux->rx_lock);
@@ -309,7 +310,8 @@ static void unreserve_rx_kcm(struct kcm_psock *psock,spin_lock_bh (&mux->rx_lock); psock->rx_kcm =NULL ; - kcm->rx_psock =NULL ; +/* paired with lockless reads in kcm_rfree() */ +WRITE_ONCE (kcm->rx_psock,NULL );/* Commit kcm->rx_psock before sk_rmem_alloc_get to sync with * kcm_rfree
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 41/64 kcm: annotate data-races around kcm->rx_wait
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 0c745b5141a45a076f1cb9772a399f7ebcb0948a ]
kcm->rx_psock can be read locklessly in kcm_rfree(). Annotate the read and writes accordingly.
syzbot reported:
BUG: KCSAN: data-race in kcm_rcv_strparser / kcm_rfree
write to 0xffff88810784e3d0 of 1 bytes by task 1823 on cpu 1:
reserve_rx_kcm net/kcm/kcmsock.c:283 [inline] kcm_rcv_strparser+0x250/0x3a0 net/kcm/kcmsock.c:363 __strp_recv+0x64c/0xd20 net/strparser/strparser.c:301 strp_recv+0x6d/0x80 net/strparser/strparser.c:335 tcp_read_sock+0x13e/0x5a0 net/ipv4/tcp.c:1703 strp_read_sock net/strparser/strparser.c:358 [inline] do_strp_work net/strparser/strparser.c:406 [inline] strp_work+0xe8/0x180 net/strparser/strparser.c:415 process_one_work+0x3d3/0x720 kernel/workqueue.c:2289 worker_thread+0x618/0xa70 kernel/workqueue.c:2436 kthread+0x1a9/0x1e0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
read to 0xffff88810784e3d0 of 1 bytes by task 17869 on cpu 0:
kcm_rfree+0x121/0x220 net/kcm/kcmsock.c:181 skb_release_head_state+0x8e/0x160 net/core/skbuff.c:841 skb_release_all net/core/skbuff.c:852 [inline] __kfree_skb net/core/skbuff.c:868 [inline] kfree_skb_reason+0x5c/0x260 net/core/skbuff.c:891 kfree_skb include/linux/skbuff.h:1216 [inline] kcm_recvmsg+0x226/0x2b0 net/kcm/kcmsock.c:1161 ____sys_recvmsg+0x16c/0x2e0 ___sys_recvmsg net/socket.c:2743 [inline] do_recvmmsg+0x2f1/0x710 net/socket.c:2837 __sys_recvmmsg net/socket.c:2916 [inline] __do_sys_recvmmsg net/socket.c:2939 [inline] __se_sys_recvmmsg net/socket.c:2932 [inline] __x64_sys_recvmmsg+0xde/0x160 net/socket.c:2932 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
value changed: 0x01 -> 0x00
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 17869 Comm: syz-executor.2 Not tainted 6.1.0-rc1-syzkaller-00010-gbb1a1146467a-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022
--- net/kcm/kcmsock.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
net/kcm/kcmsock.c +11 -6
@@ -161,7 +161,8 @@ static void kcm_rcv_ready(struct kcm_sock *kcm)/* Buffer limit is okay now, add to ready list */ list_add_tail (&kcm->wait_rx_list, &kcm->mux->kcm_rx_waiters); - kcm->rx_wait = true; +/* paired with lockless reads in kcm_rfree() */ +WRITE_ONCE (kcm->rx_wait, true); }static void kcm_rfree (struct sk_buff *skb)
@@ -177,7 +178,7 @@ static void kcm_rfree(struct sk_buff *skb)/* For reading rx_wait and rx_psock without holding lock */ smp_mb__after_atomic (); -if (!kcm->rx_wait && !READ_ONCE (kcm->rx_psock) && +if (!READ_ONCE (kcm->rx_wait) && !READ_ONCE (kcm->rx_psock) &&sk_rmem_alloc_get (sk) < sk->sk_rcvlowat) {spin_lock_bh (&mux->rx_lock);kcm_rcv_ready (kcm);
@@ -236,7 +237,8 @@ static void requeue_rx_msgs(struct kcm_mux *mux, struct sk_buff_head *head)if (kcm_queue_rcv_skb (&kcm->sk, skb)) {/* Should mean socket buffer full */ list_del (&kcm->wait_rx_list); - kcm->rx_wait = false; +/* paired with lockless reads in kcm_rfree() */ +WRITE_ONCE (kcm->rx_wait, false);/* Commit rx_wait to read in kcm_free */ smp_wmb ();
@@ -279,7 +281,8 @@ static struct kcm_sock *reserve_rx_kcm(struct kcm_psock *psock, kcm =list_first_entry (&mux->kcm_rx_waiters, struct kcm_sock, wait_rx_list);list_del (&kcm->wait_rx_list); - kcm->rx_wait = false; +/* paired with lockless reads in kcm_rfree() */ +WRITE_ONCE (kcm->rx_wait, false); psock->rx_kcm = kcm;/* paired with lockless reads in kcm_rfree() */
@@ -1243,7 +1246,8 @@ static void kcm_recv_disable(struct kcm_sock *kcm)if (!kcm->rx_psock) {if (kcm->rx_wait) {list_del (&kcm->wait_rx_list); - kcm->rx_wait = false; +/* paired with lockless reads in kcm_rfree() */ +WRITE_ONCE (kcm->rx_wait, false); }requeue_rx_msgs (mux, &kcm->sk.sk_receive_queue);
@@ -1796,7 +1800,8 @@ static void kcm_done(struct kcm_sock *kcm)if (kcm->rx_wait) {list_del (&kcm->wait_rx_list); - kcm->rx_wait = false; +/* paired with lockless reads in kcm_rfree() */ +WRITE_ONCE (kcm->rx_wait, false); }/* Move any pending receive messages to other kcm sockets */ requeue_rx_msgs (mux, &sk->sk_receive_queue);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 42/64 net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed
In reply to Greg Kroah-HartmanFrom: Zhengchao Shao <[email protected]>
[ Upstream commit d266935ac43d57586e311a087510fe6a084af742 ]
When the ops_init() interface is invoked to initialize the net, but ops->init() fails, data is released. However, the ptr pointer in net->gen is invalid. In this case, when nfqnl_nf_hook_drop() is invoked to release the net, invalid address access occurs.
The process is as follows:setup_net()
ops_init() data = kzalloc(...) ---> alloc "data" net_assign_generic() ---> assign "date" to ptr in net->gen ... ops->init() ---> failed ... kfree(data); ---> ptr in net->gen is invalid ... ops_exit_list() ... nfqnl_nf_hook_drop() *q = nfnl_queue_pernet(net) ---> q is invalid
The following is the Call Trace information:
BUG: KASAN: use-after-free in nfqnl_nf_hook_drop+0x264/0x280 Read of size 8 at addr ffff88810396b240 by task ip/15855 Call Trace: <TASK> dump_stack_lvl+0x8e/0xd1 print_report+0x155/0x454 kasan_report+0xba/0x1f0 nfqnl_nf_hook_drop+0x264/0x280 nf_queue_nf_hook_drop+0x8b/0x1b0 __nf_unregister_net_hook+0x1ae/0x5a0 nf_unregister_net_hooks+0xde/0x130 ops_exit_list+0xb0/0x170 setup_net+0x7ac/0xbd0 copy_net_ns+0x2e6/0x6b0 create_new_namespaces+0x382/0xa50 unshare_nsproxy_namespaces+0xa6/0x1c0 ksys_unshare+0x3a4/0x7e0 __x64_sys_unshare+0x2d/0x40 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK> Allocated by task 15855: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0xa1/0xb0 __kmalloc+0x49/0xb0 ops_init+0xe7/0x410 setup_net+0x5aa/0xbd0 copy_net_ns+0x2e6/0x6b0 create_new_namespaces+0x382/0xa50 unshare_nsproxy_namespaces+0xa6/0x1c0 ksys_unshare+0x3a4/0x7e0 __x64_sys_unshare+0x2d/0x40 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Freed by task 15855: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x155/0x1b0 slab_free_freelist_hook+0x11b/0x220 __kmem_cache_free+0xa4/0x360 ops_init+0xb9/0x410 setup_net+0x5aa/0xbd0 copy_net_ns+0x2e6/0x6b0 create_new_namespaces+0x382/0xa50 unshare_nsproxy_namespaces+0xa6/0x1c0 ksys_unshare+0x3a4/0x7e0 __x64_sys_unshare+0x2d/0x40 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0
--- net/core/net_namespace.c | 7 +++++++ 1 file changed, 7 insertions(+)
net/core/net_namespace.c +7 -0
@@ -120,6 +120,7 @@ static int net_assign_generic(struct net *net, unsigned int id, void *data)static int ops_init (const struct pernet_operations *ops,struct net *net) { +struct net_generic *ng;int err = -ENOMEM ;void *data =NULL ;
@@ -138,7 +139,13 @@ static int ops_init(const struct pernet_operations *ops, struct net *net)if (!err)return 0 ; +if (ops->id && ops->size) { cleanup: + ng =rcu_dereference_protected (net->gen, +lockdep_is_held (&pernet_ops_rwsem)); + ng->ptr[*ops->id] =NULL ; + } +kfree (data); out:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 43/64 net: lantiq_etop: dont free skb when returning NETDEV_TX_BUSY
In reply to Greg Kroah-HartmanFrom: Zhang Changzhong <[email protected]>
[ Upstream commit 9c1eaa27ec599fcc25ed4970c0b73c247d147a2b ]
The ndo_start_xmit() method must not free skb when returning NETDEV_TX_BUSY, since caller is going to requeue freed skb.
--- drivers/net/ethernet/lantiq_etop.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/ethernet/lantiq_etop.c +0 -1
@@ -466,7 +466,6 @@ ltq_etop_tx(struct sk_buff *skb, struct net_device *dev) len = skb->len <ETH_ZLEN ?ETH_ZLEN : skb->len;if ((desc->ctl & (LTQ_DMA_OWN |LTQ_DMA_C )) || ch->skb[ch->dma.desc]) { -dev_kfree_skb_any (skb);netdev_err (dev,"tx ring full\n" );netif_tx_stop_queue (txq);return NETDEV_TX_BUSY ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 44/64 tcp: fix indefinite deferral of RTO with SACK reneging
In reply to Greg Kroah-HartmanFrom: Neal Cardwell <[email protected]>
[ Upstream commit 3d2af9cce3133b3bc596a9d065c6f9d93419ccfb ]
This commit fixes a bug that can cause a TCP data sender to repeatedly defer RTOs when encountering SACK reneging.
The bug is that when we're in fast recovery in a scenario with SACK reneging, every time we get an ACK we call tcp_check_sack_reneging() and it can note the apparent SACK reneging and rearm the RTO timer for srtt/2 into the future. In some SACK reneging scenarios that can happen repeatedly until the receive window fills up, at which point the sender can't send any more, the ACKs stop arriving, and the RTO fires at srtt/2 after the last ACK. But that can take far too long (O(10 secs)), since the connection is stuck in fast recovery with a low cwnd that cannot grow beyond ssthresh, even if more bandwidth is available.
This fix changes the logic in tcp_check_sack_reneging() to only rearm the RTO timer if data is cumulatively ACKed, indicating forward progress. This avoids this kind of nearly infinite loop of RTO timer re-arming. In addition, this meets the goals of tcp_check_sack_reneging() in handling Windows TCP behavior that looks temporarily like SACK reneging but is not really.
Many thanks to Jakub Kicinski and Neil Spring, who reported this issue and provided critical packet traces that enabled root-causing this issue. Also, many thanks to Jakub Kicinski for testing this fix.
--- net/ipv4/tcp_input.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ipv4/tcp_input.c +2 -1
@@ -2047,7 +2047,8 @@ void tcp_enter_loss(struct sock *sk)*/ static bool tcp_check_sack_reneging (struct sock *sk,int flag) { -if (flag &FLAG_SACK_RENEGING ) { +if (flag &FLAG_SACK_RENEGING && + flag &FLAG_SND_UNA_ADVANCED ) {struct tcp_sock *tp =tcp_sk (sk);unsigned long delay =max (usecs_to_jiffies (tp->srtt_us >>4 ),msecs_to_jiffies (10 ));
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 45/64 can: mscan: mpc5xxx: mpc5xxx_can_probe(): add missing put_clock() in error path
In reply to Greg Kroah-HartmanFrom: Dongliang Mu <[email protected]>
[ Upstream commit 3e5b3418827cefb5e1cc658806f02965791b8f07 ]
The commit 1149108e2fbf ("can: mscan: improve clock API use") only adds put_clock() in mpc5xxx_can_remove() function, forgetting to add put_clock() in the error handling code.
Fix this bug by adding put_clock() in the error handling code.
--- drivers/net/can/mscan/mpc5xxx_can.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/net/can/mscan/mpc5xxx_can.c +5 -3
@@ -325,14 +325,14 @@ static int mpc5xxx_can_probe(struct platform_device *ofdev) &mscan_clksrc);if (!priv->can.clock.freq) {dev_err (&ofdev->dev,"couldn't get MSCAN clock properties\n" ); - goto exit_free_mscan; + goto exit_put_clock; } err =register_mscandev (dev, mscan_clksrc);if (err) {dev_err (&ofdev->dev,"registering %s failed (err=%d)\n" ,DRV_NAME , err); - goto exit_free_mscan; + goto exit_put_clock; } dev_info(&ofdev->dev, "MSCAN at 0x%p, irq %d, clock %d Hz\n",
@@ -340,7 +340,9 @@ static int mpc5xxx_can_probe(struct platform_device *ofdev)return 0 ; -exit_free_mscan: +exit_put_clock: +if (data->put_clock) + data->put_clock (ofdev);free_candev (dev); exit_dispose_irq:irq_dispose_mapping (irq);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 46/64 PM: hibernate: Allow hybrid sleep to work with s2idle
In reply to Greg Kroah-HartmanFrom: Mario Limonciello <[email protected]>
[ Upstream commit 85850af4fc47132f3f2f0dd698b90f67906600b4 ]
Hybrid sleep is currently hardcoded to only operate with S3 even on systems that might not support it.
Instead of assuming this mode is what the user wants to use, for hybrid sleep follow the setting of mem_sleep_current which will respect mem_sleep_default kernel command line and policy decisions made by the presence of the FADT low power idle bit.
--- kernel/power/hibernate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/power/hibernate.c +1 -1
@@ -625,7 +625,7 @@ static void power_down(void)int error;if (hibernation_mode ==HIBERNATION_SUSPEND ) { - error =suspend_devices_and_enter (PM_SUSPEND_MEM ); + error =suspend_devices_and_enter (mem_sleep_current);if (error) { hibernation_mode = hibernation_ops ? HIBERNATION_PLATFORM :
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 47/64 media: vivid: s_fbuf: add more sanity checks
In reply to Greg Kroah-HartmanFrom: Hans Verkuil <[email protected]>
[ Upstream commit f8bcaf714abfc94818dff8c0db84d750433984f4 ]
VIDIOC_S_FBUF is by definition a scary ioctl, which is why only root can use it. But at least check if the framebuffer parameters match that of one of the framebuffer created by vivid, and reject anything else.
--- drivers/media/platform/vivid/vivid-core.c | 22 ++++++++++++++++++++ drivers/media/platform/vivid/vivid-core.h | 2 ++ drivers/media/platform/vivid/vivid-vid-cap.c | 9 +++++++- 3 files changed, 32 insertions(+), 1 deletion(-)
drivers/media/platform/vivid/vivid-core.c +22 -0
@@ -297,6 +297,28 @@ static int vidioc_g_fbuf(struct file *file, void *fh, struct v4l2_framebuffer *areturn vivid_vid_out_g_fbuf (file, fh, a); } +/* +* Only support the framebuffer of one of the vivid instances. +* Anything else is rejected. +*/ +bool vivid_validate_fb (const struct v4l2_framebuffer *a) +{ +struct vivid_dev *dev; +int i; + +for (i =0 ; i < n_devs; i++) { + dev = vivid_devs[i]; +if (!dev || !dev->video_pbase) +continue ; +if ((unsigned long )a->base == dev->video_pbase && + a->fmt.width <= dev->display_width && + a->fmt.height <= dev->display_height && + a->fmt.bytesperline <= dev->display_byte_stride) +return true; + } +return false; +} +static int vidioc_s_fbuf (struct file *file,void *fh,const struct v4l2_framebuffer *a) {struct video_device *vdev =video_devdata (file);
drivers/media/platform/vivid/vivid-core.h +2 -0
@@ -564,4 +564,6 @@ static inline bool vivid_is_hdmi_out(const struct vivid_dev *dev) return dev->output_type[dev->output] == HDMI; } +bool vivid_validate_fb (const struct v4l2_framebuffer *a); +#endif
drivers/media/platform/vivid/vivid-vid-cap.c +8 -1
@@ -1250,7 +1250,14 @@ int vivid_vid_cap_s_fbuf(struct file *file, void *fh,return -EINVAL ;if (a->fmt.bytesperline < (a->fmt.width * fmt->bit_depth[0 ]) /8 )return -EINVAL ; -if (a->fmt.height * a->fmt.bytesperline < a->fmt.sizeimage) +if (a->fmt.bytesperline > a->fmt.sizeimage / a->fmt.height) +return -EINVAL ; + +/* +* Only support the framebuffer of one of the vivid instances. +* Anything else is rejected. +*/ +if (!vivid_validate_fb (a))return -EINVAL ; dev->fb_vbase_cap =phys_to_virt ((unsigned long )a->base);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 48/64 media: vivid: dev->bitmap_cap wasnt freed in all cases
In reply to Greg Kroah-HartmanFrom: Hans Verkuil <[email protected]>
[ Upstream commit 1f65ea411cc7b6ff128d82a3493d7b5648054e6f ]
Whenever the compose width/height values change, the dev->bitmap_cap vmalloc'ed array must be freed and dev->bitmap_cap set to NULL.
This was done in some places, but not all. This is only an issue if overlay support is enabled and the bitmap clipping is used.
--- drivers/media/platform/vivid/vivid-vid-cap.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
drivers/media/platform/vivid/vivid-vid-cap.c +13 -5
@@ -452,6 +452,12 @@ void vivid_update_format_cap(struct vivid_dev *dev, bool keep_controls)tpg_reset_source (&dev->tpg, dev->src_rect.width, dev->src_rect.height, dev->field_cap); dev->crop_cap = dev->src_rect; dev->crop_bounds_cap = dev->src_rect; +if (dev->bitmap_cap && + (dev->compose_cap.width != dev->crop_cap.width || + dev->compose_cap.height != dev->crop_cap.height)) { +vfree (dev->bitmap_cap); + dev->bitmap_cap =NULL ; + } dev->compose_cap = dev->crop_cap;if (V4L2_FIELD_HAS_T_OR_B (dev->field_cap)) dev->compose_cap.height /=2 ;
@@ -883,6 +889,8 @@ int vivid_vid_cap_s_selection(struct file *file, void *fh, struct v4l2_selectionstruct vivid_dev *dev =video_drvdata (file);struct v4l2_rect *crop = &dev->crop_cap;struct v4l2_rect *compose = &dev->compose_cap; +unsigned orig_compose_w = compose->width; +unsigned orig_compose_h = compose->height;unsigned factor =V4L2_FIELD_HAS_T_OR_B (dev->field_cap) ?2 :1 ;int ret;
@@ -999,17 +1007,17 @@ int vivid_vid_cap_s_selection(struct file *file, void *fh, struct v4l2_selection s->r.height /= factor; }v4l2_rect_map_inside (&s->r, &dev->fmt_cap_rect); -if (dev->bitmap_cap && (compose->width != s->r.width || - compose->height != s->r.height)) { -vfree (dev->bitmap_cap); - dev->bitmap_cap =NULL ; - } *compose = s->r;break ;default :return -EINVAL ; } +if (dev->bitmap_cap && (compose->width != orig_compose_w || + compose->height != orig_compose_h)) { +vfree (dev->bitmap_cap); + dev->bitmap_cap =NULL ; + }tpg_s_crop_compose (&dev->tpg, crop, compose);return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 49/64 media: v4l2-dv-timings: add sanity checks for blanking values
In reply to Greg Kroah-HartmanFrom: Hans Verkuil <[email protected]>
[ Upstream commit 4b6d66a45ed34a15721cb9e11492fa1a24bc83df ]
Add sanity checks to v4l2_valid_dv_timings() to ensure that the provided blanking values are reasonable.
--- drivers/media/v4l2-core/v4l2-dv-timings.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/media/v4l2-core/v4l2-dv-timings.c +14 -0
@@ -161,6 +161,20 @@ bool v4l2_valid_dv_timings(const struct v4l2_dv_timings *t, (bt->interlaced && !(caps &V4L2_DV_BT_CAP_INTERLACED )) || (!bt->interlaced && !(caps & V4L2_DV_BT_CAP_PROGRESSIVE))) return false; + +/* sanity checks for the blanking timings */ +if (!bt->interlaced && + (bt->il_vbackporch || bt->il_vsync || bt->il_vfrontporch)) +return false; +if (bt->hfrontporch >2 * bt->width || + bt->hsync >1024 || bt->hbackporch >1024 ) +return false; +if (bt->vfrontporch >4096 || + bt->vsync >128 || bt->vbackporch >4096 ) +return false; +if (bt->interlaced && (bt->il_vfrontporch >4096 || + bt->il_vsync >128 || bt->il_vbackporch >4096 )) +return false;return fnc ==NULL ||fnc (t, fnc_handle); }EXPORT_SYMBOL_GPL (v4l2_valid_dv_timings);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 50/64 media: videodev2.h: V4L2_DV_BT_BLANKING_HEIGHT should check interlaced
In reply to Greg Kroah-HartmanFrom: Hans Verkuil <[email protected]>
[ Upstream commit 8da7f0976b9071b528c545008de9d10cc81883b1 ]
If it is a progressive (non-interlaced) format, then ignore the interlaced timing values.
--- include/uapi/linux/videodev2.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
include/uapi/linux/videodev2.h +2 -1
@@ -1496,7 +1496,8 @@ struct v4l2_bt_timings { ((bt)->width + V4L2_DV_BT_BLANKING_WIDTH(bt))#define V4L2_DV_BT_BLANKING_HEIGHT (bt) \ ((bt)->vfrontporch + (bt)->vsync + (bt)->vbackporch + \ - (bt)->il_vfrontporch + (bt)->il_vsync + (bt)->il_vbackporch) + ((bt)->interlaced ? \ + ((bt)->il_vfrontporch + (bt)->il_vsync + (bt)->il_vbackporch) : 0))#define V4L2_DV_BT_FRAME_HEIGHT (bt) \ ((bt)->height + V4L2_DV_BT_BLANKING_HEIGHT(bt))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 51/64 i40e: Fix ethtool rx-flow-hash setting for X722
In reply to Greg Kroah-HartmanFrom: Slawomir Laba <[email protected]>
[ Upstream commit 54b5af5a438076082d482cab105b1bd484ab5074 ]
When enabling flow type for RSS hash via ethtool:
ethtool -N $pf rx-flow-hash tcp4|tcp6|udp4|udp6 s|d
the driver would fail to setup this setting on X722 device since it was using the mask on the register dedicated for X710 devices.
Apply a different mask on the register when setting the RSS hash for the X722 device.
When displaying the flow types enabled via ethtool:
ethtool -n $pf rx-flow-hash tcp4|tcp6|udp4|udp6
the driver would print wrong values for X722 device.
Fix this issue by testing masks for X722 device in i40e_get_rss_hash_opts function.
--- .../net/ethernet/intel/i40e/i40e_ethtool.c | 31 ++++++++++++++----- drivers/net/ethernet/intel/i40e/i40e_type.h | 4 +++ 2 files changed, 27 insertions(+), 8 deletions(-)
drivers/net/ethernet/intel/i40e/i40e_ethtool.c +23 -8
@@ -3082,10 +3082,17 @@ static int i40e_get_rss_hash_opts(struct i40e_pf *pf, struct ethtool_rxnfc *cmd)if (cmd->flow_type ==TCP_V4_FLOW || cmd->flow_type ==UDP_V4_FLOW ) { -if (i_set &I40E_L3_SRC_MASK ) - cmd->data |=RXH_IP_SRC ; -if (i_set &I40E_L3_DST_MASK ) - cmd->data |=RXH_IP_DST ; +if (hw->mac.type ==I40E_MAC_X722 ) { +if (i_set &I40E_X722_L3_SRC_MASK ) + cmd->data |=RXH_IP_SRC ; +if (i_set &I40E_X722_L3_DST_MASK ) + cmd->data |=RXH_IP_DST ; + }else { +if (i_set &I40E_L3_SRC_MASK ) + cmd->data |=RXH_IP_SRC ; +if (i_set &I40E_L3_DST_MASK ) + cmd->data |=RXH_IP_DST ; + } }else if (cmd->flow_type ==TCP_V6_FLOW || cmd->flow_type ==UDP_V6_FLOW ) {if (i_set &I40E_L3_V6_SRC_MASK )
@@ -3392,12 +3399,15 @@ static int i40e_get_rxnfc(struct net_device *netdev, struct ethtool_rxnfc *cmd,/** * i40e_get_rss_hash_bits - Read RSS Hash bits from register +* @hw: hw structure * @nfc: pointer to user request * @i_setc: bits currently set * * Returns value of bits to be set per user request **/ -static u64 i40e_get_rss_hash_bits (struct ethtool_rxnfc *nfc,u64 i_setc) +static u64 i40e_get_rss_hash_bits (struct i40e_hw *hw, +struct ethtool_rxnfc *nfc, +u64 i_setc) {u64 i_set = i_setc;u64 src_l3 =0 , dst_l3 =0 ;
@@ -3416,8 +3426,13 @@ static u64 i40e_get_rss_hash_bits(struct ethtool_rxnfc *nfc, u64 i_setc) dst_l3 =I40E_L3_V6_DST_MASK ; }else if (nfc->flow_type ==TCP_V4_FLOW || nfc->flow_type ==UDP_V4_FLOW ) { - src_l3 =I40E_L3_SRC_MASK ; - dst_l3 =I40E_L3_DST_MASK ; +if (hw->mac.type ==I40E_MAC_X722 ) { + src_l3 =I40E_X722_L3_SRC_MASK ; + dst_l3 =I40E_X722_L3_DST_MASK ; + }else { + src_l3 =I40E_L3_SRC_MASK ; + dst_l3 =I40E_L3_DST_MASK ; + } }else {/* Any other flow type are not supported here */ return i_set;
@@ -3532,7 +3547,7 @@ static int i40e_set_rss_hash_opt(struct i40e_pf *pf, struct ethtool_rxnfc *nfc) flow_pctype)) | ((u64 )i40e_read_rx_ctl (hw,I40E_GLQF_HASH_INSET (1 , flow_pctype)) <<32 ); - i_set =i40e_get_rss_hash_bits (nfc, i_setc); + i_set =i40e_get_rss_hash_bits (&pf->hw, nfc, i_setc);i40e_write_rx_ctl (hw,I40E_GLQF_HASH_INSET (0 , flow_pctype), (u32 )i_set); i40e_write_rx_ctl(hw, I40E_GLQF_HASH_INSET(1, flow_pctype),
drivers/net/ethernet/intel/i40e/i40e_type.h +4 -0
@@ -1470,6 +1470,10 @@ struct i40e_lldp_variables {#define I40E_PFQF_CTL_0_HASHLUTSIZE_512 0x00010000/* INPUT SET MASK for RSS, flow director, and flexible payload */ +#define I40E_X722_L3_SRC_SHIFT 49 +#define I40E_X722_L3_SRC_MASK (0x3ULL << I40E_X722_L3_SRC_SHIFT) +#define I40E_X722_L3_DST_SHIFT 41 +#define I40E_X722_L3_DST_MASK (0x3ULL << I40E_X722_L3_DST_SHIFT)#define I40E_L3_SRC_SHIFT 47#define I40E_L3_SRC_MASK (0x3ULL << I40E_L3_SRC_SHIFT)#define I40E_L3_V6_SRC_SHIFT 43
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 52/64 i40e: Fix VF hang when reset is triggered on another VF
In reply to Greg Kroah-HartmanFrom: Sylwester Dziedziuch <[email protected]>
[ Upstream commit 52424f974bc53c26ba3f00300a00e9de9afcd972 ]
When a reset was triggered on one VF with i40e_reset_vf global PF state __I40E_VF_DISABLE was set on a PF until the reset finished. If immediately after triggering reset on one VF there is a request to reset on another it will cause a hang on VF side because VF will be notified of incoming reset but the reset will never happen because of this global state, we will get such error message:
[ +4.890195] iavf 0000:86:02.1: Never saw reset
and VF will hang waiting for the reset to be triggered.
Fix this by introducing new VF state I40E_VF_STATE_RESETTING that will be set on a VF if it is currently resetting instead of the global __I40E_VF_DISABLE PF state.
--- .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 43 ++++++++++++++----- .../ethernet/intel/i40e/i40e_virtchnl_pf.h | 1 + 2 files changed, 33 insertions(+), 11 deletions(-)
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +32 -11
@@ -1352,10 +1352,12 @@ bool i40e_reset_vf(struct i40e_vf *vf, bool flr)if (test_bit (__I40E_VF_RESETS_DISABLED, pf->state))return true; -/* If the VFs have been disabled, this means something else is -* resetting the VF, so we shouldn't continue. -*/ -if (test_and_set_bit (__I40E_VF_DISABLE, pf->state)) +/* Bail out if VFs are disabled. */ +if (test_bit (__I40E_VF_DISABLE, pf->state)) +return true; + +/* If VF is being reset already we don't need to continue. */ +if (test_and_set_bit (I40E_VF_STATE_RESETTING , &vf->vf_states))return true;i40e_trigger_vf_reset (vf, flr);
@@ -1392,7 +1394,7 @@ bool i40e_reset_vf(struct i40e_vf *vf, bool flr)i40e_cleanup_reset_vf (vf);i40e_flush (hw); -clear_bit (__I40E_VF_DISABLE, pf->state); +clear_bit (I40E_VF_STATE_RESETTING , &vf->vf_states);return true; }
@@ -1425,8 +1427,12 @@ bool i40e_reset_all_vfs(struct i40e_pf *pf, bool flr)return false;/* Begin reset on all VFs at once */ -for (v =0 ; v < pf->num_alloc_vfs; v++) -i40e_trigger_vf_reset (&pf->vf[v], flr); +for (v =0 ; v < pf->num_alloc_vfs; v++) { + vf = &pf->vf[v]; +/* If VF is being reset no need to trigger reset again */ +if (!test_bit (I40E_VF_STATE_RESETTING , &vf->vf_states)) +i40e_trigger_vf_reset (&pf->vf[v], flr); + }/* HW requires some time to make sure it can flush the FIFO for a VF * when it resets it. Poll the VPGEN_VFRSTAT register for each VF in
@@ -1442,9 +1448,11 @@ bool i40e_reset_all_vfs(struct i40e_pf *pf, bool flr)*/ while (v < pf->num_alloc_vfs) { vf = &pf->vf[v]; - reg =rd32 (hw,I40E_VPGEN_VFRSTAT (vf->vf_id)); -if (!(reg &I40E_VPGEN_VFRSTAT_VFRD_MASK )) -break ; +if (!test_bit (I40E_VF_STATE_RESETTING , &vf->vf_states)) { + reg =rd32 (hw,I40E_VPGEN_VFRSTAT (vf->vf_id)); +if (!(reg &I40E_VPGEN_VFRSTAT_VFRD_MASK )) +break ; + }/* If the current VF has finished resetting, move on * to the next VF in sequence.
@@ -1472,6 +1480,10 @@ bool i40e_reset_all_vfs(struct i40e_pf *pf, bool flr)if (pf->vf[v].lan_vsi_idx ==0 )continue ; +/* If VF is reset in another thread just continue */ +if (test_bit (I40E_VF_STATE_RESETTING , &vf->vf_states)) +continue ; +i40e_vsi_stop_rings_no_wait (pf->vsi[pf->vf[v].lan_vsi_idx]); }
@@ -1483,6 +1495,10 @@ bool i40e_reset_all_vfs(struct i40e_pf *pf, bool flr)if (pf->vf[v].lan_vsi_idx ==0 )continue ; +/* If VF is reset in another thread just continue */ +if (test_bit (I40E_VF_STATE_RESETTING , &vf->vf_states)) +continue ; +i40e_vsi_wait_queues_disabled (pf->vsi[pf->vf[v].lan_vsi_idx]); }
@@ -1492,8 +1508,13 @@ bool i40e_reset_all_vfs(struct i40e_pf *pf, bool flr)mdelay (50 );/* Finish the reset on each VF */ -for (v =0 ; v < pf->num_alloc_vfs; v++) +for (v =0 ; v < pf->num_alloc_vfs; v++) { +/* If VF is reset in another thread just continue */ +if (test_bit (I40E_VF_STATE_RESETTING , &vf->vf_states)) +continue ; +i40e_cleanup_reset_vf (&pf->vf[v]); + }i40e_flush (hw);clear_bit (__I40E_VF_DISABLE, pf->state);
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h +1 -0
@@ -41,6 +41,7 @@ enum i40e_vf_states {I40E_VF_STATE_MC_PROMISC ,I40E_VF_STATE_UC_PROMISC ,I40E_VF_STATE_PRE_ENABLE , + I40E_VF_STATE_RESETTING };/* VF capabilities */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 53/64 i40e: Fix flow-type by setting GL_HASH_INSET registers
In reply to Greg Kroah-HartmanFrom: Slawomir Laba <[email protected]>
[ Upstream commit 3b32c9932853e11d71f9db012d69e92e4669ba23 ]
Fix setting bits for specific flow_type for GLQF_HASH_INSET register. In previous version all of the bits were set only in hena register, while in inset only one bit was set. In order for this working correctly on all types of cards these bits needs to be set correctly for both hena and inset registers.
--- .../net/ethernet/intel/i40e/i40e_ethtool.c | 71 ++++++++++--------- 1 file changed, 38 insertions(+), 33 deletions(-)
drivers/net/ethernet/intel/i40e/i40e_ethtool.c +38 -33
@@ -3450,6 +3450,7 @@ static u64 i40e_get_rss_hash_bits(struct i40e_hw *hw,return i_set; } +#define FLOW_PCTYPES_SIZE 64/** * i40e_set_rss_hash_opt - Enable/Disable flow types for RSS hash * @pf: pointer to the physical function struct
@@ -3462,9 +3463,11 @@ static int i40e_set_rss_hash_opt(struct i40e_pf *pf, struct ethtool_rxnfc *nfc)struct i40e_hw *hw = &pf->hw;u64 hena = (u64 )i40e_read_rx_ctl (hw,I40E_PFQF_HENA (0 )) | ((u64 )i40e_read_rx_ctl (hw,I40E_PFQF_HENA (1 )) <<32 ); -u8 flow_pctype =0 ; +DECLARE_BITMAP (flow_pctypes,FLOW_PCTYPES_SIZE );u64 i_set, i_setc; +bitmap_zero (flow_pctypes,FLOW_PCTYPES_SIZE ); +if (pf->flags &I40E_FLAG_MFP_ENABLED ) {dev_err (&pf->pdev->dev,"Change of RSS hash input set is not supported when MFP mode is enabled\n" );
@@ -3480,36 +3483,35 @@ static int i40e_set_rss_hash_opt(struct i40e_pf *pf, struct ethtool_rxnfc *nfc)switch (nfc->flow_type) {case TCP_V4_FLOW : - flow_pctype =I40E_FILTER_PCTYPE_NONF_IPV4_TCP ; +set_bit (I40E_FILTER_PCTYPE_NONF_IPV4_TCP , flow_pctypes);if (pf->hw_features &I40E_HW_MULTIPLE_TCP_UDP_RSS_PCTYPE ) - hena |= -BIT_ULL (I40E_FILTER_PCTYPE_NONF_IPV4_TCP_SYN_NO_ACK ); +set_bit (I40E_FILTER_PCTYPE_NONF_IPV4_TCP_SYN_NO_ACK , + flow_pctypes);break ;case TCP_V6_FLOW : - flow_pctype =I40E_FILTER_PCTYPE_NONF_IPV6_TCP ; -if (pf->hw_features &I40E_HW_MULTIPLE_TCP_UDP_RSS_PCTYPE ) - hena |= -BIT_ULL (I40E_FILTER_PCTYPE_NONF_IPV4_TCP_SYN_NO_ACK ); +set_bit (I40E_FILTER_PCTYPE_NONF_IPV6_TCP , flow_pctypes);if (pf->hw_features &I40E_HW_MULTIPLE_TCP_UDP_RSS_PCTYPE ) - hena |= -BIT_ULL (I40E_FILTER_PCTYPE_NONF_IPV6_TCP_SYN_NO_ACK ); +set_bit (I40E_FILTER_PCTYPE_NONF_IPV6_TCP_SYN_NO_ACK , + flow_pctypes);break ;case UDP_V4_FLOW : - flow_pctype =I40E_FILTER_PCTYPE_NONF_IPV4_UDP ; -if (pf->hw_features &I40E_HW_MULTIPLE_TCP_UDP_RSS_PCTYPE ) - hena |= -BIT_ULL (I40E_FILTER_PCTYPE_NONF_UNICAST_IPV4_UDP ) | -BIT_ULL (I40E_FILTER_PCTYPE_NONF_MULTICAST_IPV4_UDP ); - +set_bit (I40E_FILTER_PCTYPE_NONF_IPV4_UDP , flow_pctypes); +if (pf->hw_features &I40E_HW_MULTIPLE_TCP_UDP_RSS_PCTYPE ) { +set_bit (I40E_FILTER_PCTYPE_NONF_UNICAST_IPV4_UDP , + flow_pctypes); +set_bit (I40E_FILTER_PCTYPE_NONF_MULTICAST_IPV4_UDP , + flow_pctypes); + } hena |=BIT_ULL (I40E_FILTER_PCTYPE_FRAG_IPV4 );break ;case UDP_V6_FLOW : - flow_pctype =I40E_FILTER_PCTYPE_NONF_IPV6_UDP ; -if (pf->hw_features &I40E_HW_MULTIPLE_TCP_UDP_RSS_PCTYPE ) - hena |= -BIT_ULL (I40E_FILTER_PCTYPE_NONF_UNICAST_IPV6_UDP ) | -BIT_ULL (I40E_FILTER_PCTYPE_NONF_MULTICAST_IPV6_UDP ); - +set_bit (I40E_FILTER_PCTYPE_NONF_IPV6_UDP , flow_pctypes); +if (pf->hw_features &I40E_HW_MULTIPLE_TCP_UDP_RSS_PCTYPE ) { +set_bit (I40E_FILTER_PCTYPE_NONF_UNICAST_IPV6_UDP , + flow_pctypes); +set_bit (I40E_FILTER_PCTYPE_NONF_MULTICAST_IPV6_UDP , + flow_pctypes); + } hena |=BIT_ULL (I40E_FILTER_PCTYPE_FRAG_IPV6 );break ;case AH_ESP_V4_FLOW :
@@ -3542,17 +3544,20 @@ static int i40e_set_rss_hash_opt(struct i40e_pf *pf, struct ethtool_rxnfc *nfc)return -EINVAL ; } -if (flow_pctype) { - i_setc = (u64 )i40e_read_rx_ctl (hw,I40E_GLQF_HASH_INSET (0 , - flow_pctype)) | - ((u64 )i40e_read_rx_ctl (hw,I40E_GLQF_HASH_INSET (1 , - flow_pctype)) <<32 ); - i_set =i40e_get_rss_hash_bits (&pf->hw, nfc, i_setc); -i40e_write_rx_ctl (hw,I40E_GLQF_HASH_INSET (0 , flow_pctype), - (u32 )i_set); -i40e_write_rx_ctl (hw,I40E_GLQF_HASH_INSET (1 , flow_pctype), - (u32)(i_set >>32 )); - hena |=BIT_ULL (flow_pctype); +if (bitmap_weight (flow_pctypes,FLOW_PCTYPES_SIZE )) { +u8 flow_id; + +for_each_set_bit (flow_id, flow_pctypes,FLOW_PCTYPES_SIZE ) { + i_setc = (u64 )i40e_read_rx_ctl (hw,I40E_GLQF_HASH_INSET (0 , flow_id)) | + ((u64 )i40e_read_rx_ctl (hw,I40E_GLQF_HASH_INSET (1 , flow_id)) <<32 ); + i_set =i40e_get_rss_hash_bits (&pf->hw, nfc, i_setc); + +i40e_write_rx_ctl (hw,I40E_GLQF_HASH_INSET (0 , flow_id), + (u32 )i_set); +i40e_write_rx_ctl (hw,I40E_GLQF_HASH_INSET (1 , flow_id), + (u32)(i_set >>32 )); + hena |=BIT_ULL (flow_id); + } }i40e_write_rx_ctl (hw,I40E_PFQF_HENA (0 ), (u32 )hena);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 54/64 net: ksz884x: fix missing pci_disable_device() on error in pcidev_init()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 5da6d65590a0698199df44d095e54b0ed1708178 ]
pci_disable_device() need be called while module exiting, switch to use pcim_enable(), pci_disable_device() will be called in pcim_release() while unbinding device.
--- drivers/net/ethernet/micrel/ksz884x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/micrel/ksz884x.c +1 -1
@@ -6928,7 +6928,7 @@ static int pcidev_init(struct pci_dev *pdev, const struct pci_device_id *id)char banner[sizeof (version)];struct ksz_switch *sw =NULL ; - result =pci_enable_device (pdev); + result =pcim_enable_device (pdev);if (result)return result;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 55/64 PM: domains: Fix handling of unavailable/disabled idle states
In reply to Greg Kroah-HartmanFrom: Sudeep Holla <[email protected]>
[ Upstream commit e0c57a5c70c13317238cb19a7ded0eab4a5f7de5 ]
Platforms can provide the information about the availability of each idle states via status flag. Platforms may have to disable one or more idle states for various reasons like broken firmware or other unmet dependencies.
Fix handling of such unavailable/disabled idle states by ignoring them while parsing the states.
--- drivers/base/power/domain.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/base/power/domain.c +4 -0
@@ -2622,6 +2622,10 @@ static int genpd_iterate_idle_states(struct device_node *dn, np = it.node;if (!of_match_node (idle_state_match, np))continue ; + +if (!of_device_is_available (np)) +continue ; +if (states) { ret =genpd_parse_state (&states[i], np);if (ret) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 56/64 ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 4a4c8482e370d697738a78dcd7bf2780832cb712 ]
dev_set_name() in soundbus_add_one() allocates memory for name, it need be freed when of_device_register() fails, call soundbus_dev_put() to give up the reference that hold in device_initialize(), so that it can be freed in kobject_cleanup() when the refcount hit to 0. And other resources are also freed in i2sbus_release_dev(), so it can return 0 directly.
--- sound/aoa/soundbus/i2sbus/core.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/aoa/soundbus/i2sbus/core.c +4 -0
@@ -302,6 +302,10 @@ static int i2sbus_add_dev(struct macio_dev *macio,if (soundbus_add_one (&dev->sound)) {printk (KERN_DEBUG "i2sbus: device registration error!\n" ); +if (dev->sound.ofdev.dev.kobj.state_initialized) { +soundbus_dev_put (&dev->sound); +return 0 ; + } goto err; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 57/64 ALSA: aoa: Fix I2S device accounting
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
[ Upstream commit f1fae475f10a26b7e34da4ff2e2f19b7feb3548e ]
i2sbus_add_dev() is supposed to return the number of probed devices, i.e. either 1 or 0. However, i2sbus_add_dev() has one error handling that returns -ENODEV; this will screw up the accumulation number counted in the caller, i2sbus_probe().
Fix the return value to 0 and add the comment for better understanding for readers.
--- sound/aoa/soundbus/i2sbus/core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/aoa/soundbus/i2sbus/core.c +2 -1
@@ -147,6 +147,7 @@ static int i2sbus_get_and_fixup_rsrc(struct device_node *np, int index,return rc; } +/* Returns 1 if added, 0 for otherwise; don't return a negative value! */ /* FIXME: look at device node refcounting */ static int i2sbus_add_dev(struct macio_dev *macio, struct i2sbus_control *control,
@@ -213,7 +214,7 @@ static int i2sbus_add_dev(struct macio_dev *macio,* either as the second one in that case is just a modem. */ if (!ok) {kfree (dev); -return -ENODEV ; +return 0 ; }mutex_init (&dev->lock);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 58/64 openvswitch: switch from WARN to pr_warn
In reply to Greg Kroah-HartmanFrom: Aaron Conole <[email protected]>
[ Upstream commit fd954cc1919e35cb92f78671cab6e42d661945a3 ]
As noted by Paolo Abeni, pr_warn doesn't generate any splat and can still preserve the warning to the user that feature downgrade occurred. We likely cannot introduce other kinds of checks / enforcement here because syzbot can generate different genl versions to the datapath.
--- net/openvswitch/datapath.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/openvswitch/datapath.c +2 -1
@@ -1560,7 +1560,8 @@ static void ovs_dp_reset_user_features(struct sk_buff *skb, struct genl_info *inif (IS_ERR (dp))return ; -WARN (dp->user_features,"Dropping previously announced user features\n" ); +pr_warn ("%s: Dropping previously announced user features\n" , +ovs_dp_name (dp)); dp->user_features =0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 59/64 net: ehea: fix possible memory leak in ehea_register_port()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 0e7ce23a917a9cc83ca3c779fbba836bca3bcf1e ]
If of_device_register() returns error, the of node and the name allocated in dev_set_name() is leaked, call put_device() to give up the reference that was set in device_initialize(), so that of node is put in logical_port_release() and the name is freed in kobject_cleanup().
--- drivers/net/ethernet/ibm/ehea/ehea_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/ibm/ehea/ehea_main.c +1 -0
@@ -2897,6 +2897,7 @@ static struct device *ehea_register_port(struct ehea_port *port, ret =of_device_register (&port->ofdev);if (ret) {pr_err ("failed to register device. ret=%d\n" , ret); +put_device (&port->ofdev.dev); goto out; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 60/64 nh: fix scope used to find saddr when adding non gw nh
In reply to Greg Kroah-HartmanFrom: Nicolas Dichtel <[email protected]>
[ Upstream commit bac0f937c343d651874f83b265ca8f5070ed4f06 ]
As explained by Julian, fib_nh_scope is related to fib_nh_gw4, but fib_info_update_nhc_saddr() needs the scope of the route, which is the scope "before" fib_nh_scope, ie fib_nh_scope - 1.
This patch fixes the problem described in commit 747c14307214 ("ip: fix dflt addr selection for connected nexthop").
--- net/ipv4/nexthop.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/nexthop.c +1 -1
@@ -1222,7 +1222,7 @@ static int nh_create_ipv4(struct net *net, struct nexthop *nh,if (!err) { nh->nh_flags = fib_nh->fib_nh_flags;fib_info_update_nhc_saddr (net, &fib_nh->nh_common, - fib_nh->fib_nh_scope); + !fib_nh->fib_nh_scope ?0 : fib_nh->fib_nh_scope -1 ); }else {fib_nh_release (net, fib_nh); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 61/64 net/mlx5e: Do not increment ESN when updating IPsec ESN state
In reply to Greg Kroah-HartmanFrom: Hyong Youb Kim <[email protected]>
[ Upstream commit 888be6b279b7257b5f6e4c9527675bff0a335596 ]
An offloaded SA stops receiving after about 2^32 + replay_window packets. For example, when SA reaches <seq-hi 0x1, seq 0x2c>, all subsequent packets get dropped with SA-icv-failure (integrity_failed).
To reproduce the bug:
- ConnectX-6 Dx with crypto enabled (FW 22.30.1004)
- ipsec.conf:
nic-offload = yes
replay-window = 32
esn = yes
salifetime=24h
- Run netperf for a long time to send more than 2^32 packets netperf -H <device-under-test> -t TCP_STREAM -l 20000
When 2^32 + replay_window packets are received, the replay window moves from the 2nd half of subspace (overlap=1) to the 1st half (overlap=0). The driver then updates the 'esn' value in NIC (i.e. seq_hi) as follows.
seq_hi = xfrm_replay_seqhi(seq_bottom)
new esn in NIC = seq_hi + 1
The +1 increment is wrong, as seq_hi already contains the correct seq_hi. For example, when seq_hi=1, the driver actually tells NIC to use seq_hi=2 (esn). This incorrect esn value causes all subsequent packets to fail integrity checks (SA-icv-failure). So, do not increment.
--- drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 3 --- 1 file changed, 3 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c +0 -3
@@ -117,7 +117,6 @@ static bool mlx5e_ipsec_update_esn_state(struct mlx5e_ipsec_sa_entry *sa_entry)struct xfrm_replay_state_esn *replay_esn;u32 seq_bottom;u8 overlap; -u32 *esn;if (!(sa_entry->x->props.flags &XFRM_STATE_ESN )) { sa_entry->esn_state.trigger =0 ;
@@ -130,11 +129,9 @@ static bool mlx5e_ipsec_update_esn_state(struct mlx5e_ipsec_sa_entry *sa_entry) sa_entry->esn_state.esn =xfrm_replay_seqhi (sa_entry->x,htonl (seq_bottom)); - esn = &sa_entry->esn_state.esn; sa_entry->esn_state.trigger =1 ;if (unlikely (overlap && seq_bottom <MLX5E_IPSEC_ESN_SCOPE_MID )) { - ++(*esn); sa_entry->esn_state.overlap =0 ;return true; } else if (unlikely(!overlap &&
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 62/64 net/mlx5: Fix possible use-after-free in async command interface
In reply to Greg Kroah-HartmanFrom: Tariq Toukan <[email protected]>
[ Upstream commit bacd22df95147ed673bec4692ab2d4d585935241 ]
mlx5_cmd_cleanup_async_ctx should return only after all its callback handlers were completed. Before this patch, the below race between mlx5_cmd_cleanup_async_ctx and mlx5_cmd_exec_cb_handler was possible and lead to a use-after-free:
1. mlx5_cmd_cleanup_async_ctx is called while num_inflight is 2 (i.e. elevated by 1, a single inflight callback).
2. mlx5_cmd_cleanup_async_ctx decreases num_inflight to 1.
3. mlx5_cmd_exec_cb_handler is called, decreases num_inflight to 0 and is about to call wake_up().
4. mlx5_cmd_cleanup_async_ctx calls wait_event, which returns immediately as the condition (num_inflight == 0) holds.
5. mlx5_cmd_cleanup_async_ctx returns.
6. The caller of mlx5_cmd_cleanup_async_ctx frees the mlx5_async_ctx object.
7. mlx5_cmd_exec_cb_handler goes on and calls wake_up() on the freed object.
Fix it by syncing using a completion object. Mark it completed when num_inflight reaches 0.
Trace:
BUG: KASAN: use-after-free in do_raw_spin_lock+0x23d/0x270 Read of size 4 at addr ffff888139cd12f4 by task swapper/5/0 CPU: 5 PID: 0 Comm: swapper/5 Not tainted 6.0.0-rc3_for_upstream_debug_2022_08_30_13_10 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace: <IRQ> dump_stack_lvl+0x57/0x7d print_report.cold+0x2d5/0x684 ? do_raw_spin_lock+0x23d/0x270 kasan_report+0xb1/0x1a0 ? do_raw_spin_lock+0x23d/0x270 do_raw_spin_lock+0x23d/0x270 ? rwlock_bug.part.0+0x90/0x90 ? __delete_object+0xb8/0x100 ? lock_downgrade+0x6e0/0x6e0 _raw_spin_lock_irqsave+0x43/0x60 ? __wake_up_common_lock+0xb9/0x140 __wake_up_common_lock+0xb9/0x140 ? __wake_up_common+0x650/0x650 ? destroy_tis_callback+0x53/0x70 [mlx5_core] ? kasan_set_track+0x21/0x30 ? destroy_tis_callback+0x53/0x70 [mlx5_core] ? kfree+0x1ba/0x520 ? do_raw_spin_unlock+0x54/0x220 mlx5_cmd_exec_cb_handler+0x136/0x1a0 [mlx5_core] ? mlx5_cmd_cleanup_async_ctx+0x220/0x220 [mlx5_core] ? mlx5_cmd_cleanup_async_ctx+0x220/0x220 [mlx5_core] mlx5_cmd_comp_handler+0x65a/0x12b0 [mlx5_core] ? dump_command+0xcc0/0xcc0 [mlx5_core] ? lockdep_hardirqs_on_prepare+0x400/0x400 ? cmd_comp_notifier+0x7e/0xb0 [mlx5_core] cmd_comp_notifier+0x7e/0xb0 [mlx5_core] atomic_notifier_call_chain+0xd7/0x1d0 mlx5_eq_async_int+0x3ce/0xa20 [mlx5_core] atomic_notifier_call_chain+0xd7/0x1d0 ? irq_release+0x140/0x140 [mlx5_core] irq_int_handler+0x19/0x30 [mlx5_core] __handle_irq_event_percpu+0x1f2/0x620 handle_irq_event+0xb2/0x1d0 handle_edge_irq+0x21e/0xb00 __common_interrupt+0x79/0x1a0 common_interrupt+0x78/0xa0 </IRQ> <TASK> asm_common_interrupt+0x22/0x40 RIP: 0010:default_idle+0x42/0x60 Code: c1 83 e0 07 48 c1 e9 03 83 c0 03 0f b6 14 11 38 d0 7c 04 84 d2 75 14 8b 05 eb 47 22 02 85 c0 7e 07 0f 00 2d e0 9f 48 00 fb f4 <c3> 48 c7 c7 80 08 7f 85 e8 d1 d3 3e fe eb de 66 66 2e 0f 1f 84 00 RSP: 0018:ffff888100dbfdf0 EFLAGS: 00000242 RAX: 0000000000000001 RBX: ffffffff84ecbd48 RCX: 1ffffffff0afe110 RDX: 0000000000000004 RSI: 0000000000000000 RDI: ffffffff835cc9bc RBP: 0000000000000005 R08: 0000000000000001 R09: ffff88881dec4ac3 R10: ffffed1103bd8958 R11: 0000017d0ca571c9 R12: 0000000000000005 R13: ffffffff84f024e0 R14: 0000000000000000 R15: dffffc0000000000 ? default_idle_call+0xcc/0x450 default_idle_call+0xec/0x450 do_idle+0x394/0x450 ? arch_cpu_idle_exit+0x40/0x40 ? do_idle+0x17/0x450 cpu_startup_entry+0x19/0x20 start_secondary+0x221/0x2b0 ? set_cpu_sibling_map+0x2070/0x2070 secondary_startup_64_no_verify+0xcd/0xdb </TASK> Allocated by task 49502: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x81/0xa0 kvmalloc_node+0x48/0xe0 mlx5e_bulk_async_init+0x35/0x110 [mlx5_core] mlx5e_tls_priv_tx_list_cleanup+0x84/0x3e0 [mlx5_core] mlx5e_ktls_cleanup_tx+0x38f/0x760 [mlx5_core] mlx5e_cleanup_nic_tx+0xa7/0x100 [mlx5_core] mlx5e_detach_netdev+0x1ca/0x2b0 [mlx5_core] mlx5e_suspend+0xdb/0x140 [mlx5_core] mlx5e_remove+0x89/0x190 [mlx5_core] auxiliary_bus_remove+0x52/0x70 device_release_driver_internal+0x40f/0x650 driver_detach+0xc1/0x180 bus_remove_driver+0x125/0x2f0 auxiliary_driver_unregister+0x16/0x50 mlx5e_cleanup+0x26/0x30 [mlx5_core] cleanup+0xc/0x4e [mlx5_core] __x64_sys_delete_module+0x2b5/0x450 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Freed by task 49502: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_set_free_info+0x20/0x30 ____kasan_slab_free+0x11d/0x1b0 kfree+0x1ba/0x520 mlx5e_tls_priv_tx_list_cleanup+0x2e7/0x3e0 [mlx5_core] mlx5e_ktls_cleanup_tx+0x38f/0x760 [mlx5_core] mlx5e_cleanup_nic_tx+0xa7/0x100 [mlx5_core] mlx5e_detach_netdev+0x1ca/0x2b0 [mlx5_core] mlx5e_suspend+0xdb/0x140 [mlx5_core] mlx5e_remove+0x89/0x190 [mlx5_core] auxiliary_bus_remove+0x52/0x70 device_release_driver_internal+0x40f/0x650 driver_detach+0xc1/0x180 bus_remove_driver+0x125/0x2f0 auxiliary_driver_unregister+0x16/0x50 mlx5e_cleanup+0x26/0x30 [mlx5_core] cleanup+0xc/0x4e [mlx5_core] __x64_sys_delete_module+0x2b5/0x450 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0
--- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 10 +++++----- include/linux/mlx5/driver.h | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/cmd.c +5 -5
@@ -1850,7 +1850,7 @@ void mlx5_cmd_init_async_ctx(struct mlx5_core_dev *dev, ctx->dev = dev;/* Starts at 1 to avoid doing wake_up if we are not cleaning up */ atomic_set (&ctx->num_inflight,1 ); -init_waitqueue_head (&ctx->wait); +init_completion (&ctx->inflight_done); }EXPORT_SYMBOL (mlx5_cmd_init_async_ctx);
@@ -1864,8 +1864,8 @@ EXPORT_SYMBOL(mlx5_cmd_init_async_ctx);*/ void mlx5_cmd_cleanup_async_ctx (struct mlx5_async_ctx *ctx) { -atomic_dec (&ctx->num_inflight); -wait_event (ctx->wait,atomic_read (&ctx->num_inflight) ==0 ); +if (!atomic_dec_and_test (&ctx->num_inflight)) +wait_for_completion (&ctx->inflight_done); }EXPORT_SYMBOL (mlx5_cmd_cleanup_async_ctx);
@@ -1876,7 +1876,7 @@ static void mlx5_cmd_exec_cb_handler(int status, void *_work) work->user_callback (status, work);if (atomic_dec_and_test (&ctx->num_inflight)) -wake_up (&ctx->wait); +complete (&ctx->inflight_done); } int mlx5_cmd_exec_cb(struct mlx5_async_ctx *ctx, void *in, int in_size,
@@ -1892,7 +1892,7 @@ int mlx5_cmd_exec_cb(struct mlx5_async_ctx *ctx, void *in, int in_size, ret =cmd_exec (ctx->dev, in, in_size, out, out_size, mlx5_cmd_exec_cb_handler, work, false);if (ret &&atomic_dec_and_test (&ctx->num_inflight)) -wake_up (&ctx->wait); +complete (&ctx->inflight_done);return ret; }
include/linux/mlx5/driver.h +1 -1
@@ -904,7 +904,7 @@ void mlx5_cmd_allowed_opcode(struct mlx5_core_dev *dev, u16 opcode);struct mlx5_async_ctx {struct mlx5_core_dev *dev;atomic_t num_inflight; -struct wait_queue_head wait; +struct completion inflight_done; };struct mlx5_async_work ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 63/64 net: enetc: survive memory pressure without crashing
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 84ce1ca3fe9e1249bf21176ff162200f1c4e5ed1 ]
Under memory pressure, enetc_refill_rx_ring() may fail, and when called during the enetc_open() -> enetc_setup_rxbdr() procedure, this is not checked for.
An extreme case of memory pressure will result in exactly zero buffers being allocated for the RX ring, and in such a case it is expected that hardware drops all RX packets due to lack of buffers.
This does not happen, because the reset-default value of the consumer and produces index is 0, and this makes the ENETC think that all buffers have been initialized and that it owns them (when in reality none were).
The hardware guide explains this best:
| Configure the receive ring producer index register RBaPIR with a value | of 0. The producer index is initially configured by software but owned | by hardware after the ring has been enabled. Hardware increments the | index when a frame is received which may consume one or more BDs. | Hardware is not allowed to increment the producer index to match the | consumer index since it is used to indicate an empty condition. The ring | can hold at most RBLENR[LENGTH]-1 received BDs. | | Configure the receive ring consumer index register RBaCIR. The | consumer index is owned by software and updated during operation of the | of the BD ring by software, to indicate that any receive data occupied | in the BD has been processed and it has been prepared for new data. | - If consumer index and producer index are initialized to the same | value, it indicates that all BDs in the ring have been prepared and | hardware owns all of the entries. | - If consumer index is initialized to producer index plus N, it would | indicate N BDs have been prepared. Note that hardware cannot start if | only a single buffer is prepared due to the restrictions described in | (2). | - Software may write consumer index to match producer index anytime | while the ring is operational to indicate all received BDs prior have | been processed and new BDs prepared for hardware.
Normally, the value of rx_ring->rcir (consumer index) is brought in sync with the rx_ring->next_to_use software index, but this only happens if page allocation ever succeeded.
When PI==CI==0, the hardware appears to receive frames and write them to DMA address 0x0 (?!), then set the READY bit in the BD.
The enetc_clean_rx_ring() function (and its XDP derivative) is naturally not prepared to handle such a condition. It will attempt to process those frames using the rx_swbd structure associated with index i of the RX ring, but that structure is not fully initialized (enetc_new_page() does all of that). So what happens next is undefined behavior.
To operate using no buffer, we must initialize the CI to PI + 1, which will block the hardware from advancing the CI any further, and drop everything.
The issue was seen while adding support for zero-copy AF_XDP sockets, where buffer memory comes from user space, which can even decide to supply no buffers at all (example: "xdpsock --txonly"). However, the bug is present also with the network stack code, even though it would take a very determined person to trigger a page allocation failure at the perfect time (a series of ifup/ifdown under memory pressure should eventually reproduce it given enough retries).
--- drivers/net/ethernet/freescale/enetc/enetc.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/freescale/enetc/enetc.c +5 -0
@@ -1146,7 +1146,12 @@ static void enetc_setup_rxbdr(struct enetc_hw *hw, struct enetc_bdr *rx_ring)enetc_rxbdr_wr (hw, idx,ENETC_RBBSR ,ENETC_RXB_DMA_SIZE ); +/* Also prepare the consumer index in case page allocation never +* succeeds. In that case, hardware will never advance producer index +* to match consumer index, and will drop all frames. +*/ enetc_rxbdr_wr (hw, idx,ENETC_RBPIR ,0 ); +enetc_rxbdr_wr (hw, idx,ENETC_RBCIR ,1 );/* enable Rx ints by setting pkt thr to 1 */ enetc_rxbdr_wr (hw, idx,ENETC_RBICIR0 ,ENETC_RBICIR0_ICEN |0x1 );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 64/64 can: rcar_canfd: rcar_canfd_handle_global_receive(): fix IRQ storm on global FIFO receive
In reply to Greg Kroah-HartmanFrom: Biju Das <[email protected]>
commit 702de2c21eed04c67cefaaedc248ef16e5f6b293 upstream.
We are seeing an IRQ storm on the global receive IRQ line under heavy CAN bus load conditions with both CAN channels enabled.
Conditions:
The global receive IRQ line is shared between can0 and can1, either of the channels can trigger interrupt while the other channel's IRQ line is disabled (RFIE).
When global a receive IRQ interrupt occurs, we mask the interrupt in the IRQ handler. Clearing and unmasking of the interrupt is happening in rx_poll(). There is a race condition where rx_poll() unmasks the interrupt, but the next IRQ handler does not mask the IRQ due to NAPIF_STATE_MISSED flag (e.g.: can0 RX FIFO interrupt is disabled and can1 is triggering RX interrupt, the delay in rx_poll() processing results in setting NAPIF_STATE_MISSED flag) leading to an IRQ storm.
This patch fixes the issue by checking IRQ active and enabled before handling the IRQ on a particular channel.
--- drivers/net/can/rcar/rcar_canfd.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/can/rcar/rcar_canfd.c +4 -2
@@ -1075,7 +1075,7 @@ static irqreturn_t rcar_canfd_global_interrupt(int irq, void *dev_id)struct rcar_canfd_global *gpriv = dev_id;struct net_device *ndev;struct rcar_canfd_channel *priv; -u32 sts, gerfl; +u32 sts, cc, gerfl;u32 ch, ridx;/* Global error interrupts still indicate a condition specific
@@ -1093,7 +1093,9 @@ static irqreturn_t rcar_canfd_global_interrupt(int irq, void *dev_id)/* Handle Rx interrupts */ sts =rcar_canfd_read (priv->base,RCANFD_RFSTS (ridx)); -if (likely (sts &RCANFD_RFSTS_RFIF )) { + cc =rcar_canfd_read (priv->base,RCANFD_RFCC (ridx)); +if (likely (sts &RCANFD_RFSTS_RFIF && + cc &RCANFD_RFCC_RFIE )) {if (napi_schedule_prep (&priv->napi)) {/* Disable Rx FIFO interrupts */ rcar_canfd_clear_bit(priv->base,
Signature · 1 line
2.25.1
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.223 release. There are 64 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 04 Nov 2022 02:20:38 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.223-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v5.4:
10 builds: 10 pass, 0 fail
26 boots: 26 pass, 0 fail
59 tests: 59 pass, 0 failLinux version: 5.4.223-rc1-g01e7d36eb536
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04Jon
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.223 release. There are 64 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 04 Nov 2022 02:20:38 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.223-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.223 release. There are 64 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 04 Nov 2022 02:20:38 +0000. Anything received after that time might be too late.
Build results:
total: 161 pass: 161 fail: 0 Qemu test results: total: 447 pass: 447 fail: 0
Guenter
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.223 release. There are 64 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 04 Nov 2022 02:20:38 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.223-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
NOTE:
1)
Build failures: Perf on arm64/i386/x86 on 5.4/5.10/5.15, not on arm32. perf build started to pass on stable-rc 6.0 and mainline and next master branches.
Build error:util/annotate.c: In function 'symbol__disassemble_bpf':util/annotate.c:1739:9: error: too few arguments to function 'init_disassemble_info'
1739 | init_disassemble_info(&info, s,
| ^~~~~~~~~~~~~~~~~~~~~In file included from util/annotate.c:1692:/usr/include/dis-asm.h:472:13: note: declared here
472 | extern void init_disassemble_info (struct disassemble_info
*dinfo, void *stream,
| ^~~~~~~~~~~~~~~~~~~~~
make[4]: *** [/ tools/build/Makefile.build:97:/home/tuxbuild/.cache/tuxmake/builds/1/build/util/annotate.o] Error 1
Build log link,
[1] https://builds.tuxbuild.com/2GyMi25XnyDaaKJ170L0VWShkT9/
2)
While running selftests: net: pmtu.sh tests on arm32 x15 device the following kernel warning got noticed.
This is not a regression. The reported warning started when we started testing kselftests net.
[ 462.965664] ------------[ cut here ]------------ [ 462.970478] WARNING: CPU: 1 PID: 0 at kernel/softirq.c:169 __local_bh_enable_ip+0x114/0x18c [ 462.978948] IRQs not enabled as expected [ 462.982898] Modules linked in: sit bridge stp llc act_csum
libcrc32c act_pedit cls_flower sch_prio ip_tables x_tables veth tun cfg80211 bluetooth snd_soc_simple_card snd_soc_simple_card_utils snd_soc_core ac97_bus snd_pcm_dmaengine snd_pcm snd_timer snd soundcore fuse [last unloaded: test_blackhole_dev]
[ 463.009975] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.4.223-rc1 #1 [ 463.016361] Hardware name: Generic DRA74X (Flattened Device Tree) [ 463.022485] Backtrace: [ 463.024955] [<c131482c>] (dump_backtrace) from [<c1314bdc>] (show_stack+0x20/0x24) [ 463.032566] r7:ffffffff r6:00000000 r5:60070113 r4:c1fd8b44 [ 463.038257] [<c1314bbc>] (show_stack) from [<c132b588>] (dump_stack+0xe0/0x10c) [ 463.045605] [<c132b4a8>] (dump_stack) from [<c03578f0>] (__warn+0xe0/0x11c) [ 463.052603] r9:00000009 r8:c0360490 r7:000000a9 r6:00000009 r5:c0360490 r4:c1989b9c [ 463.060388] [<c0357810>] (__warn) from [<c1315d70>] (warn_slowpath_fmt+0x8c/0xa8) [ 463.067909] r7:000000a9 r6:c1989b9c r5:c1989c88 r4:ee1fe000 [ 463.073598] [<c1315ce8>] (warn_slowpath_fmt) from [<c0360490>] (__local_bh_enable_ip+0x114/0x18c) [ 463.082516] r9:e8cb74f4 r8:ee1ffc30 r7:e76ddb80 r6:ee1ffc98 r5:c124a9f4 r4:00000201 [ 463.090302] [<c036037c>] (__local_bh_enable_ip) from [<c13349c8>] (_raw_spin_unlock_bh+0x40/0x44) [ 463.099219] r7:e76ddb80 r6:ee1ffc98 r5:eeb8c600 r4:c124a9f4 [ 463.104912] [<c1334988>] (_raw_spin_unlock_bh) from [<c124a9f4>] (icmp6_dst_alloc+0xfc/0x1b8) [ 463.113478] r5:eeb8c600 r4:e8cb7480 [ 463.117077] [<c124a8f8>] (icmp6_dst_alloc) from [<c1266fc0>] (mld_sendpack+0x26c/0x7b4) [ 463.125122] r9:ee1ffc60 r8:c1267fd8 r7:e6a1c400 r6:e690f810 r5:e76ddb80 r4:ec773180 [ 463.132904] [<c1266d54>] (mld_sendpack) from [<c1267fd8>] (mld_ifc_timer_expire+0x1f0/0x49c) [ 463.141385] r10:00000101 r9:00000001 r8:e68e57e0 r7:e6a1c46c r6:00000000 r5:ec773180 [ 463.149252] r4:00000000 [ 463.151804] [<c1267de8>] (mld_ifc_timer_expire) from [<c0401f88>] (call_timer_fn+0xe0/0x3e8) [ 463.160283] r10:00000101 r9:c1267de8 r8:c1e086e8 r7:c1fe147c r6:e6a1c46c r5:ee1fe000 [ 463.168152] r4:ee1ffd8c [ 463.170703] [<c0401ea8>] (call_timer_fn) from [<c0402738>] (__run_timers.part.0+0x1cc/0x238) [ 463.179183] r10:c1267de8 r9:00000000 r8:00003fa6 r7:00000000 r6:ee1ffde4 r5:eeb83880 [ 463.187049] r4:e6a1c46c [ 463.189599] [<c040256c>] (__run_timers.part.0) from [<c04027ec>] (run_timer_softirq+0x48/0x78) [ 463.198254] r10:ee1fe000 r9:00000282 r8:c1e086e8 r7:c1fe0fa4 r6:00000001 r5:00000002 [ 463.206121] r4:c1e05900 [ 463.208673] [<c04027a4>] (run_timer_softirq) from [<c0302e48>] (__do_softirq+0x1e8/0x5c4) [ 463.216889] r5:00000002 r4:c1e03084 [ 463.220487] [<c0302c60>] (__do_softirq) from [<c03606f0>] (irq_exit+0x154/0x1a8) [ 463.227919] r10:00000000 r9:fa213000 r8:ee03c400 r7:00000001 r6:00000000 r5:00000000 [ 463.235785] r4:ffffe000 [ 463.238336] [<c036059c>] (irq_exit) from [<c03de4ec>] (__handle_domain_irq+0x80/0xd0) [ 463.246204] r5:00000000 r4:c1dc4408 [ 463.249802] [<c03de46c>] (__handle_domain_irq) from [<c0302758>] (gic_handle_irq+0x68/0xac) [ 463.258193] r9:fa213000 r8:fa21200c r7:ee1fff28 r6:c1ea4560 r5:fa212000 r4:c1e09228 [ 463.265976] [<c03026f0>] (gic_handle_irq) from [<c0301af0>] (__irq_svc+0x70/0x98) [ 463.273496] Exception stack(0xee1fff28 to 0xee1fff70) [ 463.278577] ff20: 00000001 00000006 00000000 ee1f2c40 00000001 ee1fe000 [ 463.286797] ff40: c1e086e8 c1e08730 00000000 ee1fe000 00000000 ee1fff84 00000000 ee1fff78 [ 463.295013] ff60: c03cd670 c030b2c8 20070013 ffffffff [ 463.300091] r9:ee1fe000 r8:00000000 r7:ee1fff5c r6:ffffffff r5:20070013 r4:c030b2c8 [ 463.307878] [<c030b294>] (arch_cpu_idle) from [<c039cc38>] (do_idle+0x25c/0x2f4) [ 463.315311] [<c039c9dc>] (do_idle) from [<c039d0e0>] (cpu_startup_entry+0x28/0x30) [ 463.322919] r10:00000000 r9:412fc0f2 r8:8020406a r7:c2017650 r6:10c0387d r5:00000001 [ 463.330786] r4:0000008c [ 463.333338] [<c039d0b8>] (cpu_startup_entry) from [<c0312e58>] (secondary_start_kernel+0x18c/0x1b0) [ 463.342432] [<c0312ccc>] (secondary_start_kernel) from [<803032cc>] (0x803032cc) [ 463.349863] r5:00000051 r4:ae1ec06a [ 463.353520] irq event stamp: 644488 [ 463.357067] hardirqs last enabled at (644498): [<c03dbb84>] console_unlock+0x4d0/0x6ac [ 463.365114] hardirqs last disabled at (644505): [<c03db798>] console_unlock+0xe4/0x6ac [ 463.373131] softirqs last enabled at (644380): [<c035f7c8>] _local_bh_enable+0x34/0x6c [ 463.381215] softirqs last disabled at (644381): [<c03606f0>] irq_exit+0x154/0x1a8 [ 463.388768] ---[ end trace 7d3ddd65f6dff4cc ]---
[2] https://lkft.validation.linaro.org/scheduler/job/5798725#L4600
[3] https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.4.y/build/v5.4.222-65-g01e7d36eb536/testrun/12814333/suite/log-parser-test/tests/
[4] https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.4.y/build/v5.4.222-65-g01e7d36eb536/testrun/12814333/suite/log-parser-test/test/check-kernel-warning-70ee64c3ae1e2e977858cae153f4e3976e17673c73d98e38878fb6ae7520dd4e/history/
## Build
* kernel: 5.4.223-rc1
* git: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
* git branch: linux-5.4.y
* git commit: 01e7d36eb536773debcbd1ff966edcf6f39851f6
* git describe: v5.4.222-65-g01e7d36eb536
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.4.y/build/v5.4.222-65-g01e7d36eb536
## No Test Regressions (compared to v5.4.222)
## No Metric Regressions (compared to v5.4.222)
## No Test Fixes (compared to v5.4.222)
## No Metric Fixes (compared to v5.4.222)
## Test result summary
total: 126679, pass: 107102, fail: 2174, skip: 16900, xfail: 503
## Build Summary
* arc: 10 total, 10 passed, 0 failed
* arm: 334 total, 334 passed, 0 failed
* arm64: 64 total, 59 passed, 5 failed
* i386: 31 total, 29 passed, 2 failed
* mips: 56 total, 56 passed, 0 failed
* parisc: 12 total, 12 passed, 0 failed
* powerpc: 63 total, 63 passed, 0 failed
* riscv: 27 total, 26 passed, 1 failed
* s390: 15 total, 15 passed, 0 failed
* sh: 24 total, 24 passed, 0 failed
* sparc: 12 total, 12 passed, 0 failed
* x86_64: 57 total, 55 passed, 2 failed
## Test suites summary
* fwts
* igt-gpu-tools
* kselftest-android
* kselftest-arm64
* kselftest-arm64/arm64.btitest.bti_c_func
* kselftest-arm64/arm64.btitest.bti_j_func
* kselftest-arm64/arm64.btitest.bti_jc_func
* kselftest-arm64/arm64.btitest.bti_none_func
* kselftest-arm64/arm64.btitest.nohint_func
* kselftest-arm64/arm64.btitest.paciasp_func
* kselftest-arm64/arm64.nobtitest.bti_c_func
* kselftest-arm64/arm64.nobtitest.bti_j_func
* kselftest-arm64/arm64.nobtitest.bti_jc_func
* kselftest-arm64/arm64.nobtitest.bti_none_func
* kselftest-arm64/arm64.nobtitest.nohint_func
* kselftest-arm64/arm64.nobtitest.paciasp_func
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-drivers-dma-buf
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-firmware
* kselftest-fpu
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-net-forwarding
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-tc-testing
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-vm
* kselftest-x86
* kselftest-zram
* kunit
* kvm-unit-tests
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-test
* ltp-cap_bounds
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-filecaps
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-fsx
* ltp-hugetlb
* ltp-io
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-open-posix-tests
* ltp-pty
* ltp-sched
* ltp-securebits
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* network-basic-tests
* packetdrill
* perf
* perf/Zstd-perf.data-compression
* rcutorture
* v4l2-compliance
Quoted 262 lines
-------------
Pseudo-Shortlog of commits:Greg Kroah-Hartman <[email protected]>
Linux 5.4.223-rc1Biju Das <[email protected]>
can:rcar_canfd:rcar_canfd_handle_global_receive(): fix IRQ storm on global FIFO receiveVladimir Oltean <[email protected]>
net: enetc: survive memory pressure without crashingTariq Toukan <[email protected]>
net/mlx5: Fix possible use-after-free in async command interfaceHyong Youb Kim <[email protected]>
net/mlx5e: Do not increment ESN when updating IPsec ESN stateNicolas Dichtel <[email protected]>
nh: fix scope used to find saddr when adding non gw nhYang Yingliang <[email protected]>
net: ehea: fix possible memory leak inehea_register_port()Aaron Conole <[email protected]>
openvswitch: switch from WARN topr_warnTakashi Iwai <[email protected]>
ALSA: aoa: Fix I2S device accountingYang Yingliang <[email protected]>
ALSA: aoa: i2sbus: fix possible memory leak ini2sbus_add_dev()Sudeep Holla <[email protected]>
PM: domains: Fix handling of unavailable/disabled idle statesYang Yingliang <[email protected]>
net: ksz884x: fix missingpci_disable_device()on error inpcidev_init()Slawomir Laba <[email protected]>
i40e: Fix flow-type by settingGL_HASH_INSETregistersSylwester Dziedziuch <[email protected]>
i40e: Fix VF hang when reset is triggered on another VFSlawomir Laba <[email protected]>
i40e: Fix ethtool rx-flow-hash setting for X722Hans Verkuil <[email protected]>
media:videodev2.h:V4L2_DV_BT_BLANKING_HEIGHTshould check 'interlaced'Hans Verkuil <[email protected]>
media: v4l2-dv-timings: add sanity checks for blanking valuesHans Verkuil <[email protected]>
media: vivid: dev->bitmap_cap wasn't freed in all casesHans Verkuil <[email protected]>
media: vivid:s_fbuf: add more sanity checksMario Limonciello <[email protected]>
PM: hibernate: Allow hybrid sleep to work with s2idleDongliang Mu <[email protected]>
can: mscan: mpc5xxx:mpc5xxx_can_probe(): add missingput_clock()in error pathNeal Cardwell <[email protected]>
tcp: fix indefinite deferral of RTO with SACK renegingZhang Changzhong <[email protected]>
net:lantiq_etop: don't free skb when returningNETDEV_TX_BUSYZhengchao Shao <[email protected]>
net: fix UAF issue innfqnl_nf_hook_drop()whenops_init()failedEric Dumazet <[email protected]>
kcm: annotate data-races around kcm->rx_waitEric Dumazet <[email protected]>
kcm: annotate data-races around kcm->rx_psockRaju Rangoju <[email protected]>
amd-xgbe: add the bit rate quirk for Molex cablesRaju Rangoju <[email protected]>
amd-xgbe: fix the SFP compliance codes check for DAC cablesChen Zhongjin <[email protected]>
x86/unwind/orc: Fix unreliable stack dump with gcovYang Yingliang <[email protected]>
net: netsec: fix error handling innetsec_register_mdio()Xin Long <[email protected]>
tipc: fix a null-ptr-deref intipc_topsrv_acceptYang Yingliang <[email protected]>
ALSA: ac97: fix possible memory leak insnd_ac97_dev_register()Randy Dunlap <[email protected]>
arc:iounmap()arg is volatileNathan Huckleberry <[email protected]>
drm/msm: Fix return type ofmdp4_lvds_connector_mode_validAlexander Stein <[email protected]>
media: v4l2: Fixv4l2_i2c_subdev_set_namefunction documentationWei Yongjun <[email protected]>
net: ieee802154: fix error return code indgram_bind()Rik van Riel <[email protected]>
mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pagesChen Zhou <[email protected]>
cgroup-v1: add disabled controller check incgroup1_parse_param()M. Vefa Bicakci <[email protected]>
xen/gntdev: Prevent leaking grantsJan Beulich <[email protected]>
Xen/gntdev: don't ignore kernel unmapping errorChandan Babu R <[email protected]>
xfs: force the log after remapping a synchronous-writes fileChandan Babu R <[email protected]>
xfs: clearXFS_DQ_FREEINGif we can't lock the dquot buffer to flushChandan Babu R <[email protected]>
xfs: finish dfops on every insert range shift iterationHeiko Carstens <[email protected]>
s390/pci: add missingEX_TABLEentries to __pcistg_mio_inuser()/__pcilg_mio_inuser()Heiko Carstens <[email protected]>
s390/futex: add missingEX_TABLEentry to__futex_atomic_op()Adrian Hunter <[email protected]>
perf auxtrace: Fix address filter symbol name match for modulesChristian A. Ehrhardt <[email protected]>
kernfs: fix use-after-free in__kernfs_removeMatthew Ma <[email protected]>
mmc: core: Fix kernel panic when remove non-standard SDIO cardJohan Hovold <[email protected]>
drm/msm/hdmi: fix memory corruption with too many bridgesJohan Hovold <[email protected]>
drm/msm/dsi: fix memory corruption with too many bridgesMiquel Raynal <[email protected]>
mac802154: Fix LQI recordingHyunwoo Kim <[email protected]>
fbdev: smscufx: Fix several use-after-free bugsShreeya Patel <[email protected]>
iio: light: tsl2583: Fix module unloadingMatti Vaittinen <[email protected]>
tools: iio:iio_utils: fix digit calculationMathias Nyman <[email protected]>
xhci: Remove device endpoints from bandwidth list when freeing the deviceTony O'Brien <[email protected]>
mtd: rawnand: marvell: Use correct logic for nand-keep-configJens Glathe <[email protected]>
usb: xhci: addXHCI_SPURIOUS_SUCCESSto ASM1042 despite being a V0.96 controllerJustin Chen <[email protected]>
usb: bdc: change state when port disconnectedThinh Nguyen <[email protected]>
usb: dwc3: gadget: Don't set IMI forno_interruptThinh Nguyen <[email protected]>
usb: dwc3: gadget: Stop processing more requests on IMIHannu Hartikainen <[email protected]>
USB: addRESET_RESUMEquirk for NVIDIA Jetson devices in RCMJason A. Donenfeld <[email protected]>
ALSA: au88x0: use explicitly signed charSteven Rostedt (Google) <[email protected]>
ALSA: Usedel_timer_sync()before freeing timerAnssi Hannula <[email protected]>
can:kvaser_usb: Fix possible completions duringinit_completionYang Yingliang <[email protected]>
can: j1939: transport: j1939_session_skb_drop_old(): spin_unlock_irqrestore() before kfree_skb()-------------
Diffstat:
Makefile | 4 +- arch/arc/include/asm/io.h | 2 +- arch/arc/mm/ioremap.c | 2 +- arch/s390/include/asm/futex.h | 3 +- arch/s390/pci/pci_mmio.c | 8 +- arch/x86/kernel/unwind_orc.c | 2 +- drivers/base/power/domain.c | 4 + .../gpu/drm/msm/disp/mdp4/mdp4_lvds_connector.c | 5 +- drivers/gpu/drm/msm/dsi/dsi.c | 6 ++ drivers/gpu/drm/msm/hdmi/hdmi.c | 5 ++ drivers/iio/light/tsl2583.c | 2 +- drivers/media/platform/vivid/vivid-core.c | 22 +++++ drivers/media/platform/vivid/vivid-core.h | 2 + drivers/media/platform/vivid/vivid-vid-cap.c | 27 ++++-- drivers/media/v4l2-core/v4l2-dv-timings.c | 14 +++ drivers/mmc/core/sdio_bus.c | 3 +- drivers/mtd/nand/raw/marvell_nand.c | 2 +- drivers/net/can/mscan/mpc5xxx_can.c | 8 +- drivers/net/can/rcar/rcar_canfd.c | 6 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_hydra.c | 4 +- drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 4 +- drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c | 17 ++-- drivers/net/ethernet/freescale/enetc/enetc.c | 5 ++ drivers/net/ethernet/ibm/ehea/ehea_main.c | 1 + drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 100 ++++++++++++--------- drivers/net/ethernet/intel/i40e/i40e_type.h | 4 + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 43 ++++++--- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h | 1 + drivers/net/ethernet/lantiq_etop.c | 1 - drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 10 +-- .../ethernet/mellanox/mlx5/core/en_accel/ipsec.c | 3 - drivers/net/ethernet/micrel/ksz884x.c | 2 +- drivers/net/ethernet/socionext/netsec.c | 2 + drivers/usb/core/quirks.c | 9 ++ drivers/usb/dwc3/gadget.c | 8 +- drivers/usb/gadget/udc/bdc/bdc_udc.c | 1 + drivers/usb/host/xhci-mem.c | 20 +++-- drivers/usb/host/xhci-pci.c | 8 +- drivers/video/fbdev/smscufx.c | 55 ++++++------ drivers/xen/gntdev.c | 30 +++++-- fs/kernfs/dir.c | 5 +- fs/xfs/xfs_bmap_util.c | 2 +- fs/xfs/xfs_file.c | 17 +++- fs/xfs/xfs_qm.c | 1 + include/linux/mlx5/driver.h | 2 +- include/media/v4l2-common.h | 3 +- include/uapi/linux/videodev2.h | 3 +- kernel/cgroup/cgroup-v1.c | 3 + kernel/power/hibernate.c | 2 +- mm/hugetlb.c | 2 +- net/can/j1939/transport.c | 4 +- net/core/net_namespace.c | 7 ++ net/ieee802154/socket.c | 4 +- net/ipv4/nexthop.c | 2 +- net/ipv4/tcp_input.c | 3 +- net/kcm/kcmsock.c | 23 +++-- net/mac802154/rx.c | 5 +- net/openvswitch/datapath.c | 3 +- net/tipc/topsrv.c | 16 +++-
Quoted 10 lines
sound/aoa/soundbus/i2sbus/core.c | 7 +- sound/pci/ac97/ac97_codec.c | 1 + sound/pci/au88x0/au88x0.h | 6 +- sound/pci/au88x0/au88x0_core.c | 2 +- sound/synth/emux/emux.c | 7 +- tools/iio/iio_utils.c | 4 + tools/perf/util/auxtrace.c | 10 ++- 66 files changed, 423 insertions(+), 176 deletions(-)
* vdso
--
Linaro LKFT
https://lkft.linaro.org
Hi Greg,
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.223 release. There are 64 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 04 Nov 2022 02:20:38 +0000. Anything received after that time might be too late.
Build test (gcc version 11.3.1 20221016):
mips: 65 configs -> no failure
arm: 106 configs -> no failure
arm64: 2 configs -> no failurex86_64: 4 configs -> no failure
alpha allmodconfig -> no failure
powerpc allmodconfig -> no failure
riscv allmodconfig -> no failure
s390 allmodconfig -> no failure
xtensa allmodconfig -> no failure
Boot test:x86_64: Booted on my test laptop. No regression.x86_64: Booted on qemu. No regression. [1]
[1]. https://openqa.qa.codethink.co.uk/tests/2087
Signature · 2 lines
Regards Sudip