6.0.11-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 6.0.11-rc1 review
This is the start of the stable review cycle for the 6.0.11 release. There are 289 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 02 Dec 2022 18:05:05 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.0.11-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.0.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.0.11-rc1
Andrzej Hajda <[email protected]>
drm/i915: fix TLB invalidation for Gen12 video and compute engines
Alex Deucher <[email protected]>
drm/amdgpu: Partially revert "drm/amdgpu: update drm_display_info correctly when the edid is read"
Christian König <[email protected]>
drm/amdgpu: always register an MMU notifier for userptr
Dillon Varone <[email protected]>
drm/amd/display: Update soc bounding box for dcn32/dcn321
Jack Xiao <[email protected]>
drm/amd/amdgpu: reserve vm invalidation engine for firmware
Ramesh Errabolu <[email protected]>
drm/amdgpu: Enable Aldebaran devices to report CU Occupancy
Alex Deucher <[email protected]>
drm/amdgpu/psp: don't free PSP buffers on suspend
Tsung-hua Lin <[email protected]>
drm/amd/display: No display after resume from WB/CB
Lyude Paul <[email protected]>
drm/amd/dc/dce120: Fix audio register mapping, stop triggering KASAN
Lyude Paul <[email protected]>
drm/display/dp_mst: Fix drm_dp_mst_add_affected_dsc_crtcs() return code
Matthew Auld <[email protected]>
drm/i915/ttm: never purge busy objects
Filipe Manana <[email protected]>
btrfs: do not modify log tree while holding a leaf from fs tree locked
Zhen Lei <[email protected]>
btrfs: sysfs: normalize the error handling branch in btrfs_init_sysfs()
Christoph Hellwig <[email protected]>
btrfs: use kvcalloc in btrfs_get_dev_zone_info
Christoph Hellwig <[email protected]>
btrfs: zoned: fix missing endianness conversion in sb_write_pointer
Anand Jain <[email protected]>
btrfs: free btrfs_path before copying subvol info to userspace
Anand Jain <[email protected]>
btrfs: free btrfs_path before copying fspath to userspace
Anand Jain <[email protected]>
btrfs: free btrfs_path before copying inodes to userspace
Josef Bacik <[email protected]>
btrfs: free btrfs_path before copying root refs to userspace
Phil Turnbull <[email protected]>
wifi: wilc1000: validate number of channels
Phil Turnbull <[email protected]>
wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_CHANNEL_LIST attribute
Phil Turnbull <[email protected]>
wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_OPER_CHANNEL attribute
Phil Turnbull <[email protected]>
wifi: wilc1000: validate pairwise and authentication suite offsets
Miklos Szeredi <[email protected]>
fuse: lock inode unconditionally in fuse_fallocate()
Mikulas Patocka <[email protected]>
dm integrity: clear the journal on suspend
Mikulas Patocka <[email protected]>
dm integrity: flush the journal on suspend
Robin Murphy <[email protected]>
gpu: host1x: Avoid trying to use GART on Tegra20
Zhou Guanghui <[email protected]>
scsi: iscsi: Fix possible memory leak when device_register() failed
Shin'ichiro Kawasaki <[email protected]>
scsi: mpi3mr: Suppress command reply debug prints
Enrico Sau <[email protected]>
net: usb: qmi_wwan: add Telit 0x103a composition
Keith Busch <[email protected]>
dm-log-writes: set dma_alignment limit in io_hints
Keith Busch <[email protected]>
dm-integrity: set dma_alignment limit in io_hints
Keith Busch <[email protected]>
block: make blk_set_default_limits() private
Gleb Mazovetskiy <[email protected]>
tcp: configurable source port perturb table size
Hans de Goede <[email protected]>
platform/x86: ideapad-laptop: Add module parameters to match DMI quirk tables
Arnav Rawat <[email protected]>
platform/x86: ideapad-laptop: Fix interrupt storm on fn-lock toggle on some Yoga laptops
Kai-Heng Feng <[email protected]>
platform/x86: hp-wmi: Ignore Smart Experience App event
Maximilian Luz <[email protected]>
platform/surface: aggregator_registry: Add support for Surface Laptop 5
Damien Le Moal <[email protected]>
zonefs: fix zone report size in __zonefs_io_error()
Eric Huang <[email protected]>
drm/amdkfd: Fix a memory limit issue
Guchun Chen <[email protected]>
drm/amdgpu: disable BACO support on more cards
Dillon Varone <[email protected]>
drm/amd/display: use uclk pstate latency for fw assisted mclk validation dcn32
Maximilian Luz <[email protected]>
platform/surface: aggregator_registry: Add support for Surface Pro 9
Hans de Goede <[email protected]>
platform/x86: acer-wmi: Enable SW_TABLET_MODE on Switch V 10 (SW5-017)
Xiongfeng Wang <[email protected]>
platform/x86: asus-wmi: add missing pci_dev_put() in asus_wmi_set_xusb2pr()
Lennard Gäher <[email protected]>
platform/x86: thinkpad_acpi: Enable s2idle quirk for 21A1 machine type
ruanjinjie <[email protected]>
xen/platform-pci: add missing free_irq() in error path
Marek Marczykowski-Górecki <[email protected]>
xen-pciback: Allow setting PCI_MSIX_FLAGS_MASKALL too
Olivier Moysan <[email protected]>
ASoC: stm32: dfsdm: manage cb buffers cleanup
Takashi Iwai <[email protected]>
Input: i8042 - apply probe defer to more ASUS ZenBook models
Anjana Hari <[email protected]>
pinctrl: qcom: sc8280xp: Rectify UFS reset pins
Hans de Goede <[email protected]>
Input: soc_button_array - add Acer Switch V 10 to dmi_use_low_level_irq[]
Hans de Goede <[email protected]>
Input: soc_button_array - add use_low_level_irq module parameter
Zhu Ning <[email protected]>
ASoC: sof_es8336: reduce pop noise on speaker
Peter Zijlstra <[email protected]>
bpf: Convert BPF_DISPATCHER to use static_call() (not ftrace)
Hans de Goede <[email protected]>
Input: goodix - try resetting the controller when no config is set
Fedor Pchelkin <[email protected]>
Revert "tty: n_gsm: replace kicktimer with delayed_work"
Fedor Pchelkin <[email protected]>
Revert "tty: n_gsm: avoid call of sleeping functions from atomic context"
Lukas Wunner <[email protected]>
serial: 8250: 8250_omap: Avoid RS485 RTS glitch on ->set_termios()
Kai Vehmanen <[email protected]>
ASoC: SOF: ipc3-topology: use old pipeline teardown flow with SOF2.1 and older
Pierre-Louis Bossart <[email protected]>
ASoC: hda: intel-dsp-config: add ES83x6 quirk for IceLake
Matti Vaittinen <[email protected]>
tools: iio: iio_generic_buffer: Fix read size
Pierre-Louis Bossart <[email protected]>
ASoC: Intel: soc-acpi: add ES83x6 support to IceLake
Hans de Goede <[email protected]>
ASoC: Intel: bytcht_es8316: Add quirk for the Nanote UMPC-01
Brent Mendelsohn <[email protected]>
ASoC: amd: yc: Add Alienware m17 R5 AMD into DMI table
Aman Dhoot <[email protected]>
Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode
Yang Yingliang <[email protected]>
ASoC: SOF: Intel: hda-codec: fix possible memory leak in hda_codec_device_init()
Yang Yingliang <[email protected]>
ASoC: Intel: Skylake: fix possible memory leak in skl_codec_device_init()
Gaosheng Cui <[email protected]>
ASoC: Intel: fix unused-variable warning in probe_codec
Cezary Rojewski <[email protected]>
ASoC: SOF: Fix compilation when HDA_AUDIO_CODEC config is disabled
Huacai Chen <[email protected]>
LoongArch: Set _PAGE_DIRTY only if _PAGE_WRITE is set in {pmd,pte}_mkdirty()
Huacai Chen <[email protected]>
LoongArch: Clear FPU/SIMD thread info flags for kernel thread
Li Liguang <[email protected]>
mm: correctly charge compressed memory to its memcg
Qi Zheng <[email protected]>
mm: fix unexpected changes to {failslab|fail_page_alloc}.attr
Michael Kelley <[email protected]>
x86/ioremap: Fix page aligned size calculation in __ioremap_caller()
Pawan Gupta <[email protected]>
x86/pm: Add enumeration check before spec MSRs save/restore setup
Pawan Gupta <[email protected]>
x86/tsx: Add a feature bit for TSX control MSR support
David Woodhouse <[email protected]>
KVM: Update gfn_to_pfn_cache khva when it moves within the same page
Maxim Levitsky <[email protected]>
KVM: x86: remove exit_int_info warning in svm_handle_exit
Maxim Levitsky <[email protected]>
KVM: x86: add kvm_leave_nested
Maxim Levitsky <[email protected]>
KVM: x86: nSVM: harden svm_free_nested against freeing vmcb02 while still in use
Maxim Levitsky <[email protected]>
KVM: x86: forcibly leave nested mode on vCPU reset
Maxim Levitsky <[email protected]>
KVM: x86: nSVM: leave nested mode on vCPU free
Sean Christopherson <[email protected]>
drm/i915/gvt: Get reference to KVM iff attachment to VM is successful
David Woodhouse <[email protected]>
KVM: x86/xen: Validate port number in SCHEDOP_poll
David Woodhouse <[email protected]>
KVM: x86/xen: Only do in-kernel acceleration of hypercalls for guest CPL0
Kazuki Takiguchi <[email protected]>
KVM: x86/mmu: Fix race condition in direct_page_fault
Russ Weight <[email protected]>
fpga: m10bmc-sec: Fix kconfig dependencies
Johannes Weiner <[email protected]>
mm: vmscan: fix extreme overreclaim and swap floods
Aneesh Kumar K.V <[email protected]>
mm/cgroup/reclaim: fix dirty pages throttling on cgroup v1
Mukesh Ojha <[email protected]>
gcov: clang: fix the buffer overflow issue
Chen Zhongjin <[email protected]>
nilfs2: fix nilfs_sufile_mark_dirty() not set segment usage as dirty
Jens Axboe <[email protected]>
io_uring: clear TIF_NOTIFY_SIGNAL if set and task_work not available
Pavel Begunkov <[email protected]>
io_uring: make poll refs more robust
Pavel Begunkov <[email protected]>
io_uring: cmpxchg for poll arm refs release
Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Clear ep descriptor last
Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Return -ESHUTDOWN on ep disable
Michael Grzeschik <[email protected]>
usb: dwc3: gadget: conditionally remove requests
George Shen <[email protected]>
drm/amd/display: Fix calculation for cursor CAB allocation
Alvin Lee <[email protected]>
drm/amd/display: Update MALL SS NumWays calculation
Alvin Lee <[email protected]>
drm/amd/display: Add debug option for allocating extra way for cursor
Lee, Alvin <[email protected]>
drm/amd/display: Added debug option for forcing subvp num ways
Jay Cornwall <[email protected]>
drm/amdkfd: update GFX11 CWSR trap handler
David Belanger <[email protected]>
drm/amdgpu: Enable SA software trap.
Randy Dunlap <[email protected]>
nios2: add FORCE for vmlinuz.gz
Chuck Lever <[email protected]>
NFSD: Fix reads with a non-zero offset that don't end on a page boundary
Alexandre Belloni <[email protected]>
init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash
Marc Kleine-Budde <[email protected]>
spi: spi-imx: spi_imx_transfer_one(): check for DMA transfer first
Frieder Schrempf <[email protected]>
spi: spi-imx: Fix spi_bus_clk if requested clock is higher than input clock
Linus Walleij <[email protected]>
bus: ixp4xx: Don't touch bit 7 on IXP42x
Damien Le Moal <[email protected]>
zonefs: Fix active zone accounting
Wyes Karny <[email protected]>
cpufreq: amd-pstate: cpufreq: amd-pstate: reset MSR_AMD_PERF_CTL register at init
Peter Gonda <[email protected]>
virt/sev-guest: Prevent IV reuse in the SNP guest driver
SeongJae Park <[email protected]>
mm/damon/sysfs-schemes: skip stats update if the scheme directory is removed
Billy Tsai <[email protected]>
dt-bindings: iio: adc: Remove the property "aspeed,trim-data-valid"
Dong Chenchen <[email protected]>
iio: accel: bma400: Fix memory leak in bma400_get_steps_reg()
Chen Zhongjin <[email protected]>
iio: core: Fix entry not deleted when iio_register_sw_trigger_type() fails
Alejandro Concepción Rodríguez <[email protected]>
iio: light: apds9960: fix wrong register for gesture gain
Billy Tsai <[email protected]>
iio: adc: aspeed: Remove the trim valid dts property.
Sam James <[email protected]>
kbuild: fix -Wimplicit-function-declaration in license_is_gpl_compatible
Jakob Unterwurzacher <[email protected]>
arm64: dts: rockchip: lower rk3399-puma-haikou SD controller clock frequency
Baokun Li <[email protected]>
ext4: fix use-after-free in ext4_ext_shift_extents
Dan Carpenter <[email protected]>
cifs: Use after free in debug code
ChenXiaoSong <[email protected]>
cifs: fix missing unlock in cifs_file_copychunk_range()
Jason Ekstrand <[email protected]>
dma-buf: Use dma_fence_unwrap_for_each when importing fences
Pawel Laszczak <[email protected]>
usb: cdnsp: fix issue with ZLP - added TD_SIZE = 1
Pawel Laszczak <[email protected]>
usb: cdnsp: Fix issue with Clear Feature Halt Endpoint
Marek Szyprowski <[email protected]>
usb: dwc3: exynos: Fix remove() function
Vasanth Sadhasivan <[email protected]>
can: gs_usb: remove dma allocations
Greg Kroah-Hartman <[email protected]>
lib/vdso: use "grep -E" instead of "egrep"
Lin Ma <[email protected]>
io_uring/poll: fix poll_refs race with cancelation
Lin Ma <[email protected]>
io_uring/filetable: fix file reference underflow
Heiko Carstens <[email protected]>
s390/crashdump: fix TOD programmable field size
Yu Liao <[email protected]>
net: thunderx: Fix the ACPI memory leak
Xiongfeng Wang <[email protected]>
octeontx2-af: Fix reference count issue in rvu_sdp_init()
Li Zetao <[email protected]>
virtio_net: Fix probe failed when modprobe virtio_net
Hanjun Guo <[email protected]>
net: wwan: t7xx: Fix the ACPI memory leak
Jiasheng Jiang <[email protected]>
octeontx2-pf: Add check for devm_kcalloc
Vladimir Oltean <[email protected]>
net: enetc: preserve TX ring priority across reconfiguration
Vladimir Oltean <[email protected]>
net: enetc: cache accesses to &priv->si->hw
Zhang Changzhong <[email protected]>
net: marvell: prestera: add missing unregister_netdev() in prestera_port_create()
Martin Faltesek <[email protected]>
nfc: st-nci: fix incorrect sizing calculations in EVT_TRANSACTION
Martin Faltesek <[email protected]>
nfc: st-nci: fix memory leaks in EVT_TRANSACTION
Martin Faltesek <[email protected]>
nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION
David Howells <[email protected]>
fscache: fix OOB Read in __fscache_acquire_volume
Stefan Haberland <[email protected]>
s390/dasd: fix no record found for raw_track_access
Wei Yongjun <[email protected]>
s390/ap: fix memory leak in ap_init_qci_info()
Santiago Ruano Rincón <[email protected]>
net/cdc_ncm: Fix multicast RX support for CDC NCM devices with ZLP
Yuan Can <[email protected]>
net: dm9051: Fix missing dev_kfree_skb() in dm9051_loop_rx()
Wang Hai <[email protected]>
arcnet: fix potential memory leak in com20020_probe()
Ziyang Xuan <[email protected]>
ipv4: Fix error return code in fib_table_insert()
Yan Cangang <[email protected]>
net: ethernet: mtk_eth_soc: fix resource leak in error path
Lorenzo Bianconi <[email protected]>
net: ethernet: mtk_eth_soc: move ppe table hash offset to mtk_soc_data structure
Lorenzo Bianconi <[email protected]>
net: ethernet: mtk_eth_soc: move gdma_to_ppe and ppe_base definitions in mtk register map
Ziyang Xuan <[email protected]>
net: ethernet: mtk_eth_soc: fix potential memory leak in mtk_rx_alloc()
Kuniyuki Iwashima <[email protected]>
dccp/tcp: Reset saddr on failure after inet6?_hash_connect().
Li Hua <[email protected]>
test_kprobes: fix implicit declaration error of test_kprobes
Christoph Hellwig <[email protected]>
blk-mq: fix queue reference leak on blk_mq_alloc_disk_for_queue failure
Svyatoslav Feldsherov <[email protected]>
fs: do not update freeing inode i_io_list
Felix Fietkau <[email protected]>
netfilter: flowtable_offload: add missing locking
Jozsef Kadlecsik <[email protected]>
netfilter: ipset: restore allowing 64 clashing elements in hash:net,iface
Perry Yuan <[email protected]>
cpufreq: amd-pstate: change amd-pstate driver to be built-in type
Gerhard Engleder <[email protected]>
tsnep: Fix rotten packets
Dawei Li <[email protected]>
dma-buf: fix racing conflict of dma_heap_add()
Yang Yingliang <[email protected]>
bnx2x: fix pci device refcount leak in bnx2x_vf_is_pcie_pending()
Andreas Kemnade <[email protected]>
regulator: twl6030: re-add TWL6032_SUBCLASS
Liu Shixin <[email protected]>
NFC: nci: fix memory leak in nci_rx_data_packet()
Xin Long <[email protected]>
net: sched: allow act_ct to be built without NF_NAT
Liu Jian <[email protected]>
net: sparx5: fix error handling in sparx5_port_open()
Zhang Changzhong <[email protected]>
sfc: fix potential memleak in __ef100_hard_start_xmit()
Wang ShaoBo <[email protected]>
net: wwan: iosm: use ACPI_FREE() but not kfree() in ipc_pcie_read_bios_cfg()
Chen Zhongjin <[email protected]>
xfrm: Fix ignored return value in xfrm6_init()
Thomas Jarosch <[email protected]>
xfrm: Fix oops in __xfrm_state_delete()
Zhang Xiaoxu <[email protected]>
zonefs: Fix race between modprobe and mount
YueHaibing <[email protected]>
tipc: check skb_linearize() return value in tipc_disc_rcv()
Xin Long <[email protected]>
tipc: add an extra conn_get in tipc_conn_alloc
Xin Long <[email protected]>
tipc: set con sock in tipc_conn_alloc
Wei Yongjun <[email protected]>
net: phy: at803x: fix error return code in at803x_probe()
Chris Mi <[email protected]>
net/mlx5e: Offload rule only when all encaps are valid
Moshe Shemesh <[email protected]>
net/mlx5: Fix sync reset event handler error flow
Roi Dayan <[email protected]>
net/mlx5: E-Switch, Set correctly vport destination
Moshe Shemesh <[email protected]>
net/mlx5: Fix handling of entry refcount when command is not issued to FW
Moshe Shemesh <[email protected]>
net/mlx5: cmdif, Print info on any firmware cmd failure to tracepoint
Shay Drory <[email protected]>
net/mlx5: SF: Fix probing active SFs during driver probe phase
Moshe Shemesh <[email protected]>
net/mlx5: Fix FW tracer timestamp calculation
Roy Novich <[email protected]>
net/mlx5: Do not query pci info while pci disabled
Vishwanath Pai <[email protected]>
netfilter: ipset: regression in ip_set_hash_ip.c
Yang Yingliang <[email protected]>
Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register()
Yang Yingliang <[email protected]>
Drivers: hv: vmbus: fix double free in the error path of vmbus_add_channel_work()
Imre Deak <[email protected]>
drm/i915: Fix warn in intel_display_power_*_domain() functions
YueHaibing <[email protected]>
macsec: Fix invalid error code set
Hangbin Liu <[email protected]>
bonding: fix ICMPv6 header handling when receiving IPv6 messages
Jaco Coetzee <[email protected]>
nfp: add port from netdev validation for EEPROM access
Diana Wang <[email protected]>
nfp: fill splittable of devlink_port_attrs correctly
Yang Yingliang <[email protected]>
net: pch_gbe: fix pci device refcount leak while module exiting
Yang Yingliang <[email protected]>
octeontx2-af: debugsfs: fix pci device refcount leak
Zhang Changzhong <[email protected]>
net/qla3xxx: fix potential memleak in ql3xxx_send()
Hui Tang <[email protected]>
net: mvpp2: fix possible invalid pointer dereference
Peter Kosyh <[email protected]>
net/mlx4: Check retval of mlx4_bitmap_init
Liu Jian <[email protected]>
net: ethernet: mtk_eth_soc: fix error handling in mtk_open()
Fabio Estevam <[email protected]>
ARM: dts: imx6q-prti6q: Fix ref/tcxo-clock-frequency properties
Zheng Yongjun <[email protected]>
ARM: mxs: fix memory leak in mxs_machine_init()
Slawomir Laba <[email protected]>
iavf: Fix race condition between iavf_shutdown and iavf_remove
Stefan Assmann <[email protected]>
iavf: remove INITIAL_MAC_SET to allow gARP to work properly
Ivan Vecera <[email protected]>
iavf: Do not restart Tx queues after reset task failure
Ivan Vecera <[email protected]>
iavf: Fix a crash during reset task
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: do not set up extensions for end interval
Daniel Xu <[email protected]>
netfilter: conntrack: Fix data-races around ct mark
Zhengchao Shao <[email protected]>
9p/fd: fix issue of list_del corruption in p9_fd_cancel()
Wang Hai <[email protected]>
net: pch_gbe: fix potential memleak in pch_gbe_tx_queue()
Lin Ma <[email protected]>
nfc/nci: fix race with opening and closing
Vladimir Oltean <[email protected]>
net: dsa: sja1105: disallow C45 transactions on the BASE-TX MDIO bus
David Howells <[email protected]>
rxrpc: Fix race between conn bundle lookup and bundle removal [ZDI-CAN-15975]
Mahesh Bandewar <[email protected]>
ipvlan: hold lower dev to avoid possible use-after-free
Thomas Zeitlhofer <[email protected]>
net: neigh: decrement the family specific qlen
Leon Romanovsky <[email protected]>
net: liquidio: simplify if expression
Matthieu Baerts <[email protected]>
selftests: mptcp: fix mibit vs mbit mix up
Matthieu Baerts <[email protected]>
selftests: mptcp: run mptcp_sockopt from a new netns
Paolo Abeni <[email protected]>
selftests: mptcp: gives slow test-case more time
Michael Grzeschik <[email protected]>
ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl
Krishna Yarlagadda <[email protected]>
spi: tegra210-quad: Fix duplicate resource error
Yang Yingliang <[email protected]>
tee: optee: fix possible memory leak in optee_register_device()
Samuel Holland <[email protected]>
bus: sunxi-rsb: Support atomic transfers
Samuel Holland <[email protected]>
bus: sunxi-rsb: Remove the shutdown callback
Yang Yingliang <[email protected]>
regulator: core: fix UAF in destroy_regulator()
Xiongfeng Wang <[email protected]>
spi: dw-dma: decrease reference count in dw_spi_dma_init_mfld()
Yang Yingliang <[email protected]>
regulator: rt5759: fix OOB in validate_desc()
Zeng Heng <[email protected]>
regulator: core: fix kobject release warning and memory leak in regulator_register()
Jiasheng Jiang <[email protected]>
ASoC: max98373: Add checks for devm_kcalloc
Chen-Yu Tsai <[email protected]>
arm64: dts: rockchip: Fix Pine64 Quartz4-B PMIC interrupt
Dexuan Cui <[email protected]>
PCI: hv: Only reuse existing IRTE allocation for Multi-MSI
Michael Kelley <[email protected]>
scsi: storvsc: Fix handling of srb_status and capacity change events
Vitaly Kuznetsov <[email protected]>
x86/hyperv: Restore VP assist page after cpu offlining/onlining
Richard Fitzgerald <[email protected]>
ASoC: soc-pcm: Don't zero TDM masks in __soc_pcm_open()
Detlev Casanova <[email protected]>
ASoC: sgtl5000: Reset the CHIP_CLK_CTRL reg on remove
Junxiao Chang <[email protected]>
ASoC: hdac_hda: fix hda pcm buffer overflow issue
Cezary Rojewski <[email protected]>
ASoC: Intel: Drop hdac_ext usage for codec device creation
Cezary Rojewski <[email protected]>
ASoC: SOF: Intel: Introduce HDA codec init and exit routines
Cezary Rojewski <[email protected]>
ASoC: Intel: Skylake: Introduce HDA codec init and exit routines
Dominik Haller <[email protected]>
ARM: dts: am335x-pcm-953: Define fixed regulators in root node
Linus Walleij <[email protected]>
power: supply: ab8500: Defer thermal zone probe
Ondrej Jirman <[email protected]>
power: supply: ip5xxx: Fix integer overflow in current_now calculation
Herbert Xu <[email protected]>
af_key: Fix send_acquire race with pfkey_register
Christian Langrock <[email protected]>
xfrm: replay: Fix ESN wrap around for GSO
Lev Popov <[email protected]>
arm64: dts: rockchip: fix quartz64-a bluetooth configuration
Eyal Birger <[email protected]>
xfrm: fix "disable_policy" on ipv4 early demux
Pavel Begunkov <[email protected]>
io_uring/poll: lockdep annote io_poll_req_insert_locked
Jason A. Donenfeld <[email protected]>
MIPS: pic32: treat port as signed integer
Nathan Chancellor <[email protected]>
RISC-V: vdso: Do not add missing symbols to version section in linker script
Ai Chao <[email protected]>
ALSA: usb-audio: add quirk to fix Hamedal C20 disconnect issue
Hamza Mahfooz <[email protected]>
drm/amd/display: only fill dirty rectangles when PSR is enabled
Philip Yang <[email protected]>
drm/amdgpu: Drop eviction lock when allocating PT BO
Asher Song <[email protected]>
Revert "drm/amdgpu: Revert "drm/amdgpu: getting fan speed pwm for vega10 properly""
Steve Su <[email protected]>
drm/amd/display: Fix gpio port mapping issue
Chaitanya Dhere <[email protected]>
drm/amd/display: Fix FCLK deviation and tool compile issues
Aurabindo Pillai <[email protected]>
drm/amd/display: Zeromem mypipe heap struct before using it
M Chetan Kumar <[email protected]>
net: wwan: iosm: fix kernel test robot reported errors
Aleksandr Miloserdov <[email protected]>
nvmet: fix memory leak in nvmet_subsys_attr_model_store_locked
Keith Busch <[email protected]>
nvme: quiet user passthrough command errors
Kuniyuki Iwashima <[email protected]>
arm64/syscall: Include asm/ptrace.h in syscall_wrapper header.
Heiko Carstens <[email protected]>
s390: always build relocatable kernel
Yu Kuai <[email protected]>
block, bfq: fix null pointer dereference in bfq_bio_bfqg()
Hans de Goede <[email protected]>
drm: panel-orientation-quirks: Add quirk for Acer Switch V 10 (SW5-017)
Hans de Goede <[email protected]>
drm: panel-orientation-quirks: Add quirk for Nanote UMPC-01
Bart Van Assche <[email protected]>
scsi: scsi_debug: Make the READ CAPACITY response compliant with ZBC
Brian King <[email protected]>
scsi: ibmvfc: Avoid path failures during live migration
Ivan Hu <[email protected]>
platform/x86/intel/hid: Add some ACPI device IDs
David E. Box <[email protected]>
platform/x86/intel/pmt: Sapphire Rapids PMT errata fix
Hans de Goede <[email protected]>
platform/x86: touchscreen_dmi: Add info for the RCA Cambio W101 v2 2-in-1
Manyi Li <[email protected]>
platform/x86: ideapad-laptop: Disable touchpad_switch
Hans de Goede <[email protected]>
ACPI: video: Add backlight=native DMI quirk for Dell G15 5515
Sabrina Dubroca <[email protected]>
Revert "net: macsec: report real_dev features when HW offloading is enabled"
Adrien Thierry <[email protected]>
selftests/net: give more time to udpgro bg processes to complete startup
Youlin Li <[email protected]>
selftests/bpf: Add verifier test for release_reference()
Sean Nyekjaer <[email protected]>
spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run
Harald Freudenberger <[email protected]>
s390/zcrypt: fix warning about field-spanning write
Tyler J. Stachecki <[email protected]>
wifi: ath11k: Fix QCN9074 firmware boot on x86
Pavel Begunkov <[email protected]>
selftests/net: don't tests batched TCP io_uring zc
Nicolas Cavallari <[email protected]>
wifi: mac80211: Fix ack frame idr leak when mesh has no route
Jason A. Donenfeld <[email protected]>
wifi: airo: do not assign -1 to unsigned char
Gaosheng Cui <[email protected]>
audit: fix undefined behavior in bit shift for AUDIT_BIT
Emil Renner Berthing <[email protected]>
riscv: dts: sifive unleashed: Add PWM controlled LEDs
Jon Hunter <[email protected]>
spi: tegra210-quad: Don't initialise DMA if not supported
Jonas Jelonek <[email protected]>
wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support
Paul Zhang <[email protected]>
wifi: cfg80211: Fix bitrates overflow issue
taozhang <[email protected]>
wifi: mac80211: fix memory free error when registering wiphy fail
Xiubo Li <[email protected]>
ceph: fix NULL pointer dereference for req->r_session
Kenneth Lee <[email protected]>
ceph: Use kcalloc for allocating multiple elements
Carlos Llamas <[email protected]>
binder: validate alloc->mm in ->mmap() handler
-------------
Diffstat:
.../bindings/iio/adc/aspeed,ast2600-adc.yaml | 7 - Makefile | 4 +- arch/arm/boot/dts/am335x-pcm-953.dtsi | 28 ++- arch/arm/boot/dts/at91sam9g20ek_common.dtsi | 9 + arch/arm/boot/dts/imx6q-prti6q.dts | 4 +- arch/arm/mach-mxs/mach-mxs.c | 4 +- .../arm64/boot/dts/rockchip/rk3399-puma-haikou.dts | 2 +- arch/arm64/boot/dts/rockchip/rk3566-quartz64-a.dts | 7 +- arch/arm64/boot/dts/rockchip/rk3566-quartz64-b.dts | 2 +- arch/arm64/include/asm/syscall_wrapper.h | 2 +- arch/loongarch/include/asm/pgtable.h | 8 +- arch/loongarch/kernel/process.c | 9 +- arch/mips/include/asm/fw/fw.h | 2 +- arch/mips/pic32/pic32mzda/early_console.c | 13 +- arch/mips/pic32/pic32mzda/init.c | 2 +- arch/nios2/boot/Makefile | 2 +- .../riscv/boot/dts/sifive/hifive-unleashed-a00.dts | 38 ++++ arch/riscv/kernel/vdso/Makefile | 3 + arch/riscv/kernel/vdso/vdso.lds.S | 2 + arch/s390/Kconfig | 6 +- arch/s390/Makefile | 2 - arch/s390/boot/Makefile | 3 +- arch/s390/boot/startup.c | 3 +- arch/s390/kernel/crash_dump.c | 2 +- arch/x86/hyperv/hv_init.c | 54 +++--- arch/x86/include/asm/cpufeatures.h | 3 + arch/x86/kernel/cpu/tsx.c | 38 ++-- arch/x86/kvm/mmu/mmu.c | 13 +- arch/x86/kvm/svm/nested.c | 6 +- arch/x86/kvm/svm/svm.c | 16 +- arch/x86/kvm/vmx/nested.c | 3 - arch/x86/kvm/x86.c | 18 +- arch/x86/kvm/xen.c | 32 +++- arch/x86/mm/ioremap.c | 8 +- arch/x86/power/cpu.c | 23 ++- block/bfq-cgroup.c | 4 + block/blk-mq.c | 7 +- block/blk-settings.c | 1 - block/blk.h | 1 + drivers/acpi/video_detect.c | 14 ++ drivers/android/binder_alloc.c | 7 + drivers/bus/intel-ixp4xx-eb.c | 9 +- drivers/bus/sunxi-rsb.c | 38 ++-- drivers/cpufreq/Kconfig.x86 | 2 +- drivers/cpufreq/amd-pstate.c | 21 +- drivers/dma-buf/dma-buf.c | 23 ++- drivers/dma-buf/dma-heap.c | 28 +-- drivers/fpga/Kconfig | 4 +- .../gpu/drm/amd/amdgpu/amdgpu_amdkfd_aldebaran.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 1 - drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 6 + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 16 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 26 --- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 26 +++ drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c | 2 + drivers/gpu/drm/amd/amdgpu/mes_v11_0.c | 6 +- drivers/gpu/drm/amd/amdkfd/cwsr_trap_handler.h | 31 +-- .../gpu/drm/amd/amdkfd/cwsr_trap_handler_gfx10.asm | 27 +++ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 44 ++++- drivers/gpu/drm/amd/display/dc/dc.h | 3 + .../drm/amd/display/dc/dce120/dce120_resource.c | 3 +- drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c | 213 ++++++++++----------- .../gpu/drm/amd/display/dc/dcn32/dcn32_resource.c | 1 + .../amd/display/dc/dcn32/dcn32_resource_helpers.c | 11 +- .../drm/amd/display/dc/dcn321/dcn321_resource.c | 1 + .../gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 22 ++- .../amd/display/dc/dml/dcn32/display_mode_vba_32.c | 1 + .../dc/dml/dcn32/display_mode_vba_util_32.c | 2 +- .../dc/dml/dcn32/display_mode_vba_util_32.h | 2 +- .../gpu/drm/amd/display/dc/dml/dcn321/dcn321_fpu.c | 8 +- .../amd/display/dc/gpio/dcn32/hw_factory_dcn32.c | 14 ++ drivers/gpu/drm/amd/display/dc/gpio/hw_ddc.c | 9 +- .../drm/amd/pm/powerplay/hwmgr/vega10_thermal.c | 25 ++- .../drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 4 + drivers/gpu/drm/display/drm_dp_mst_topology.c | 2 +- drivers/gpu/drm/drm_panel_orientation_quirks.c | 12 ++ drivers/gpu/drm/i915/display/intel_display_power.c | 8 +- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 4 + drivers/gpu/drm/i915/gt/intel_gt.c | 5 + drivers/gpu/drm/i915/gvt/kvmgt.c | 3 +- drivers/gpu/drm/tegra/drm.c | 4 + drivers/gpu/host1x/dev.c | 4 + drivers/hv/channel_mgmt.c | 6 +- drivers/hv/vmbus_drv.c | 1 + drivers/iio/accel/bma400_core.c | 4 +- drivers/iio/adc/aspeed_adc.c | 11 +- drivers/iio/industrialio-sw-trigger.c | 6 +- drivers/iio/light/apds9960.c | 12 +- drivers/input/misc/soc_button_array.c | 14 +- drivers/input/mouse/synaptics.c | 1 + drivers/input/serio/i8042-x86ia64io.h | 8 +- drivers/input/touchscreen/goodix.c | 11 ++ drivers/md/dm-integrity.c | 21 +- drivers/md/dm-log-writes.c | 1 + drivers/net/arcnet/com20020_cs.c | 11 +- drivers/net/bonding/bond_main.c | 17 +- drivers/net/can/usb/gs_usb.c | 39 +--- drivers/net/dsa/sja1105/sja1105_mdio.c | 6 + drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | 12 +- drivers/net/ethernet/cavium/liquidio/lio_main.c | 4 +- drivers/net/ethernet/cavium/thunder/thunder_bgx.c | 4 +- drivers/net/ethernet/davicom/dm9051.c | 4 +- drivers/net/ethernet/engleder/tsnep_main.c | 57 +++++- drivers/net/ethernet/freescale/enetc/enetc.c | 32 ++-- drivers/net/ethernet/freescale/enetc/enetc.h | 10 +- drivers/net/ethernet/freescale/enetc/enetc_qos.c | 77 ++++---- drivers/net/ethernet/intel/iavf/iavf.h | 1 - drivers/net/ethernet/intel/iavf/iavf_main.c | 41 ++-- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 8 +- .../ethernet/marvell/octeontx2/af/rvu_debugfs.c | 3 + .../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 2 + .../net/ethernet/marvell/octeontx2/af/rvu_sdp.c | 7 +- .../net/ethernet/marvell/prestera/prestera_main.c | 1 + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 31 ++- drivers/net/ethernet/mediatek/mtk_eth_soc.h | 5 +- drivers/net/ethernet/mediatek/mtk_ppe.c | 24 ++- drivers/net/ethernet/mediatek/mtk_ppe.h | 4 +- drivers/net/ethernet/mellanox/mlx4/qp.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 47 ++--- .../mellanox/mlx5/core/diag/cmd_tracepoint.h | 45 +++++ .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +- .../ethernet/mellanox/mlx5/core/en/tc_tun_encap.c | 16 +- .../ethernet/mellanox/mlx5/core/en/tc_tun_encap.h | 3 +- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 17 +- .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 9 +- drivers/net/ethernet/mellanox/mlx5/core/main.c | 9 +- .../net/ethernet/mellanox/mlx5/core/sf/dev/dev.c | 88 +++++++++ .../net/ethernet/microchip/sparx5/sparx5_netdev.c | 14 +- drivers/net/ethernet/netronome/nfp/nfp_devlink.c | 2 +- .../net/ethernet/netronome/nfp/nfp_net_ethtool.c | 3 + .../net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c | 6 +- drivers/net/ethernet/qlogic/qla3xxx.c | 1 + drivers/net/ethernet/sfc/ef100_netdev.c | 1 + drivers/net/ipvlan/ipvlan.h | 1 + drivers/net/ipvlan/ipvlan_main.c | 2 + drivers/net/macsec.c | 28 +-- drivers/net/phy/at803x.c | 4 +- drivers/net/usb/cdc_ncm.c | 1 + drivers/net/usb/qmi_wwan.c | 1 + drivers/net/virtio_net.c | 3 +- drivers/net/wireless/ath/ath11k/qmi.h | 2 +- drivers/net/wireless/cisco/airo.c | 18 +- drivers/net/wireless/mac80211_hwsim.c | 5 + drivers/net/wireless/microchip/wilc1000/cfg80211.c | 39 +++- drivers/net/wireless/microchip/wilc1000/hif.c | 21 +- drivers/net/wwan/iosm/iosm_ipc_coredump.c | 1 + drivers/net/wwan/iosm/iosm_ipc_devlink.c | 1 + drivers/net/wwan/iosm/iosm_ipc_pcie.c | 2 +- drivers/net/wwan/t7xx/t7xx_modem_ops.c | 2 + drivers/nfc/st-nci/se.c | 49 +++-- drivers/nvme/host/core.c | 3 +- drivers/nvme/host/pci.c | 2 - drivers/nvme/target/configfs.c | 7 +- drivers/pci/controller/pci-hyperv.c | 90 +++++++-- drivers/pinctrl/qcom/pinctrl-sc8280xp.c | 4 +- .../platform/surface/surface_aggregator_registry.c | 37 ++++ drivers/platform/x86/acer-wmi.c | 9 + drivers/platform/x86/asus-wmi.c | 2 + drivers/platform/x86/hp-wmi.c | 3 + drivers/platform/x86/ideapad-laptop.c | 62 +++++- drivers/platform/x86/intel/hid.c | 3 + drivers/platform/x86/intel/pmt/class.c | 31 ++- drivers/platform/x86/thinkpad_acpi.c | 8 + drivers/platform/x86/touchscreen_dmi.c | 25 +++ drivers/power/supply/ab8500_btemp.c | 9 +- drivers/power/supply/ip5xxx_power.c | 2 +- drivers/regulator/core.c | 8 +- drivers/regulator/rt5759-regulator.c | 1 + drivers/regulator/twl6030-regulator.c | 2 + drivers/s390/block/dasd_eckd.c | 6 +- drivers/s390/crypto/ap_bus.c | 5 +- drivers/s390/crypto/zcrypt_msgtype6.c | 21 +- drivers/scsi/ibmvscsi/ibmvfc.c | 14 +- drivers/scsi/mpi3mr/mpi3mr_os.c | 3 +- drivers/scsi/scsi_debug.c | 7 + drivers/scsi/scsi_transport_iscsi.c | 31 +-- drivers/scsi/storvsc_drv.c | 69 ++++--- drivers/spi/spi-dw-dma.c | 3 + drivers/spi/spi-imx.c | 13 +- drivers/spi/spi-stm32.c | 2 +- drivers/spi/spi-tegra210-quad.c | 9 +- drivers/tee/optee/device.c | 2 +- drivers/tty/n_gsm.c | 69 +++---- drivers/tty/serial/8250/8250_omap.c | 7 +- drivers/usb/cdns3/cdnsp-gadget.c | 12 +- drivers/usb/cdns3/cdnsp-ring.c | 17 +- drivers/usb/dwc3/dwc3-exynos.c | 11 +- drivers/usb/dwc3/gadget.c | 22 +-- drivers/virt/coco/sev-guest/sev-guest.c | 84 ++++++-- drivers/xen/platform-pci.c | 7 +- drivers/xen/xen-pciback/conf_space_capability.c | 9 +- fs/btrfs/ioctl.c | 23 ++- fs/btrfs/sysfs.c | 7 +- fs/btrfs/tree-log.c | 59 +++++- fs/btrfs/zoned.c | 9 +- fs/ceph/caps.c | 50 ++--- fs/cifs/cifsfs.c | 4 +- fs/cifs/sess.c | 4 +- fs/ext4/extents.c | 18 +- fs/fs-writeback.c | 30 +-- fs/fscache/volume.c | 7 +- fs/fuse/file.c | 37 ++-- fs/nfsd/vfs.c | 7 +- fs/nilfs2/sufile.c | 8 + fs/zonefs/super.c | 60 ++++-- fs/zonefs/zonefs.h | 6 +- include/linux/blkdev.h | 1 - include/linux/bpf.h | 39 +++- include/linux/fault-inject.h | 7 +- include/linux/fscache.h | 2 +- include/linux/license.h | 2 + include/linux/mlx5/driver.h | 1 + include/net/neighbour.h | 2 +- include/sound/sof/info.h | 4 + include/uapi/linux/audit.h | 2 +- init/Kconfig | 2 +- io_uring/filetable.c | 2 - io_uring/io_uring.h | 9 +- io_uring/poll.c | 49 ++++- kernel/bpf/dispatcher.c | 22 +-- kernel/gcov/clang.c | 2 + lib/Kconfig.debug | 1 + lib/fault-inject.c | 13 +- lib/vdso/Makefile | 2 +- mm/damon/sysfs.c | 4 + mm/failslab.c | 12 +- mm/memcontrol.c | 2 +- mm/page_alloc.c | 7 +- mm/vmscan.c | 24 ++- net/9p/trans_fd.c | 2 + net/core/flow_dissector.c | 2 +- net/core/neighbour.c | 58 +++--- net/dccp/ipv4.c | 2 + net/dccp/ipv6.c | 2 + net/ipv4/Kconfig | 10 + net/ipv4/esp4_offload.c | 3 + net/ipv4/fib_trie.c | 4 +- net/ipv4/inet_hashtables.c | 10 +- net/ipv4/ip_input.c | 5 + net/ipv4/netfilter/ipt_CLUSTERIP.c | 4 +- net/ipv4/tcp_ipv4.c | 2 + net/ipv6/esp6_offload.c | 3 + net/ipv6/tcp_ipv6.c | 2 + net/ipv6/xfrm6_policy.c | 6 +- net/key/af_key.c | 34 ++-- net/mac80211/main.c | 8 +- net/mac80211/mesh_pathtbl.c | 2 +- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- net/netfilter/ipset/ip_set_hash_ip.c | 8 +- net/netfilter/nf_conntrack_core.c | 2 +- net/netfilter/nf_conntrack_netlink.c | 24 ++- net/netfilter/nf_conntrack_standalone.c | 2 +- net/netfilter/nf_flow_table_offload.c | 4 + net/netfilter/nf_tables_api.c | 6 +- net/netfilter/nft_ct.c | 6 +- net/netfilter/xt_connmark.c | 18 +- net/nfc/nci/core.c | 2 +- net/nfc/nci/data.c | 4 +- net/openvswitch/conntrack.c | 8 +- net/rxrpc/ar-internal.h | 1 + net/rxrpc/conn_client.c | 38 ++-- net/sched/Kconfig | 2 +- net/sched/act_connmark.c | 4 +- net/sched/act_ct.c | 8 +- net/sched/act_ctinfo.c | 6 +- net/tipc/discover.c | 5 +- net/tipc/topsrv.c | 20 +- net/wireless/util.c | 6 +- net/xfrm/xfrm_device.c | 15 +- net/xfrm/xfrm_replay.c | 2 +- sound/hda/intel-dsp-config.c | 5 + sound/soc/amd/yc/acp6x-mach.c | 7 + sound/soc/codecs/hdac_hda.c | 26 +-- sound/soc/codecs/hdac_hda.h | 6 +- sound/soc/codecs/max98373-i2c.c | 4 + sound/soc/codecs/sgtl5000.c | 1 + sound/soc/intel/boards/bytcht_es8316.c | 7 + sound/soc/intel/boards/hda_dsp_common.c | 2 +- sound/soc/intel/boards/skl_hda_dsp_generic.c | 2 +- sound/soc/intel/boards/sof_es8336.c | 60 ++++-- sound/soc/intel/common/soc-acpi-intel-icl-match.c | 13 ++ sound/soc/intel/skylake/skl.c | 49 +++-- sound/soc/soc-pcm.c | 5 - sound/soc/sof/intel/hda-codec.c | 49 +++-- sound/soc/sof/ipc3-topology.c | 15 +- sound/soc/stm/stm32_adfsdm.c | 11 ++ sound/usb/endpoint.c | 3 +- sound/usb/quirks.c | 2 + sound/usb/usbaudio.h | 3 + tools/iio/iio_generic_buffer.c | 4 +- .../testing/selftests/bpf/verifier/ref_tracking.c | 36 ++++ .../testing/selftests/net/io_uring_zerocopy_tx.sh | 2 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 6 +- tools/testing/selftests/net/mptcp/mptcp_sockopt.sh | 9 +- tools/testing/selftests/net/mptcp/simult_flows.sh | 5 +- tools/testing/selftests/net/udpgro.sh | 4 +- tools/testing/selftests/net/udpgro_bench.sh | 2 +- tools/testing/selftests/net/udpgro_frglist.sh | 2 +- virt/kvm/pfncache.c | 7 +- 302 files changed, 2720 insertions(+), 1290 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/289 binder: validate alloc->mm in ->mmap() handler
From: Carlos Llamas <[email protected]>
[ Upstream commit 3ce00bb7e91cf57d723905371507af57182c37ef ]
Since commit 1da52815d5f1 ("binder: fix alloc->vma_vm_mm null-ptr dereference") binder caches a pointer to the current->mm during open(). This fixes a null-ptr dereference reported by syzkaller. Unfortunately, it also opens the door for a process to update its mm after the open(), (e.g. via execve) making the cached alloc->mm pointer invalid.
Things get worse when the process continues to mmap() a vma. From this point forward, binder will attempt to find this vma using an obsolete alloc->mm reference. Such as in binder_update_page_range(), where the wrong vma is obtained via vma_lookup(), yet binder proceeds to happily insert new pages into it.
To avoid this issue fail the ->mmap() callback if we detect a mismatch between the vma->vm_mm and the original alloc->mm pointer. This prevents alloc->vm_addr from getting set, so that any subsequent vma_lookup() calls fail as expected.
--- drivers/android/binder_alloc.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/android/binder_alloc.c +7 -0
@@ -760,6 +760,12 @@ int binder_alloc_mmap_handler(struct binder_alloc *alloc,const char *failure_string;struct binder_buffer *buffer; +if (unlikely (vma->vm_mm != alloc->vma_vm_mm)) { + ret = -EINVAL ; + failure_string ="invalid vma->vm_mm" ; + goto err_invalid_mm; + } +mutex_lock (&binder_alloc_mmap_lock);if (alloc->buffer_size) { ret = -EBUSY ;
@@ -806,6 +812,7 @@ int binder_alloc_mmap_handler(struct binder_alloc *alloc, alloc->buffer_size =0 ; err_already_mapped:mutex_unlock (&binder_alloc_mmap_lock); +err_invalid_mm: binder_alloc_debug(BINDER_DEBUG_USER_ERROR, "%s: %d %lx-%lx %s failed %d\n", __func__, alloc->pid, vma->vm_start, vma->vm_end,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 2/289 ceph: Use kcalloc for allocating multiple elements
In reply to Greg Kroah-HartmanFrom: Kenneth Lee <[email protected]>
[ Upstream commit aa1d627207cace003163dee24d1c06fa4e910c6b ]
Prefer using kcalloc(a, b) over kzalloc(a * b) as this improves semantics since kcalloc is intended for allocating an array of memory.
Stable-dep-of: 5bd76b8de5b7 ("ceph: fix NULL pointer dereference for req->r_session")
--- fs/ceph/caps.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ceph/caps.c +1 -1
@@ -2285,7 +2285,7 @@ static int flush_mdlog_and_wait_inode_unsafe_requests(struct inode *inode)struct ceph_mds_request *req;int i; - sessions =kzalloc (max_sessions *sizeof (s),GFP_KERNEL ); + sessions =kcalloc (max_sessions,sizeof (s),GFP_KERNEL );if (!sessions) { err = -ENOMEM ; goto out;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 3/289 ceph: fix NULL pointer dereference for req->r_session
In reply to Greg Kroah-HartmanFrom: Xiubo Li <[email protected]>
[ Upstream commit 5bd76b8de5b74fa941a6eafee87728a0fe072267 ]
The request's r_session maybe changed when it was forwarded or resent. Both the forwarding and resending cases the requests will be protected by the mdsc->mutex.
--- fs/ceph/caps.c | 48 ++++++++++++------------------------------------ 1 file changed, 12 insertions(+), 36 deletions(-)
fs/ceph/caps.c +12 -36
@@ -2247,7 +2247,6 @@ static int flush_mdlog_and_wait_inode_unsafe_requests(struct inode *inode)struct ceph_mds_client *mdsc =ceph_sb_to_client (inode->i_sb)->mdsc;struct ceph_inode_info *ci =ceph_inode (inode);struct ceph_mds_request *req1 =NULL , *req2 =NULL ; -unsigned int max_sessions;int ret, err =0 ;spin_lock (&ci->i_unsafe_lock);
@@ -2265,28 +2264,24 @@ static int flush_mdlog_and_wait_inode_unsafe_requests(struct inode *inode) }spin_unlock (&ci->i_unsafe_lock); -/* -* The mdsc->max_sessions is unlikely to be changed -* mostly, here we will retry it by reallocating the -* sessions array memory to get rid of the mdsc->mutex -* lock. -*/ -retry: - max_sessions = mdsc->max_sessions; -/* * Trigger to flush the journal logs in all the relevant MDSes * manually, or in the worst case we must wait at most 5 seconds * to wait the journal logs to be flushed by the MDSes periodically. */ -if ((req1 || req2) &&likely (max_sessions)) { -struct ceph_mds_session **sessions =NULL ; -struct ceph_mds_session *s; +if (req1 || req2) {struct ceph_mds_request *req; +struct ceph_mds_session **sessions; +struct ceph_mds_session *s; +unsigned int max_sessions;int i; +mutex_lock (&mdsc->mutex); + max_sessions = mdsc->max_sessions; + sessions =kcalloc (max_sessions,sizeof (s),GFP_KERNEL );if (!sessions) { +mutex_unlock (&mdsc->mutex); err = -ENOMEM ; goto out; }
@@ -2298,16 +2293,6 @@ static int flush_mdlog_and_wait_inode_unsafe_requests(struct inode *inode) s = req->r_session;if (!s)continue ; -if (unlikely (s->s_mds >= max_sessions)) { -spin_unlock (&ci->i_unsafe_lock); -for (i =0 ; i < max_sessions; i++) { - s = sessions[i]; -if (s) -ceph_put_mds_session (s); - } -kfree (sessions); - goto retry; - }if (!sessions[s->s_mds]) { s =ceph_get_mds_session (s); sessions[s->s_mds] = s;
@@ -2320,16 +2305,6 @@ static int flush_mdlog_and_wait_inode_unsafe_requests(struct inode *inode) s = req->r_session;if (!s)continue ; -if (unlikely (s->s_mds >= max_sessions)) { -spin_unlock (&ci->i_unsafe_lock); -for (i =0 ; i < max_sessions; i++) { - s = sessions[i]; -if (s) -ceph_put_mds_session (s); - } -kfree (sessions); - goto retry; - }if (!sessions[s->s_mds]) { s =ceph_get_mds_session (s); sessions[s->s_mds] = s;
@@ -2341,11 +2316,12 @@ static int flush_mdlog_and_wait_inode_unsafe_requests(struct inode *inode)/* the auth MDS */ spin_lock (&ci->i_ceph_lock);if (ci->i_auth_cap) { - s = ci->i_auth_cap->session; -if (!sessions[s->s_mds]) - sessions[s->s_mds] =ceph_get_mds_session (s); + s = ci->i_auth_cap->session; +if (!sessions[s->s_mds]) + sessions[s->s_mds] =ceph_get_mds_session (s); }spin_unlock (&ci->i_ceph_lock); +mutex_unlock (&mdsc->mutex);/* send flush mdlog request to MDSes */ for (i =0 ; i < max_sessions; i++) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 4/289 wifi: mac80211: fix memory free error when registering wiphy fail
In reply to Greg Kroah-HartmanFrom: taozhang <[email protected]>
[ Upstream commit 50b2e8711462409cd368c41067405aa446dfa2af ]
ieee80211_register_hw free the allocated cipher suites when registering wiphy fail, and ieee80211_free_hw will re-free it.
set wiphy_ciphers_allocated to false after freeing allocated cipher suites.
--- net/mac80211/main.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/mac80211/main.c +6 -2
@@ -1437,8 +1437,10 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)ieee80211_led_exit (local);destroy_workqueue (local->workqueue); fail_workqueue: -if (local->wiphy_ciphers_allocated) +if (local->wiphy_ciphers_allocated) {kfree (local->hw.wiphy->cipher_suites); + local->wiphy_ciphers_allocated = false; + }kfree (local->int_scan_req);return result; }
@@ -1506,8 +1508,10 @@ void ieee80211_free_hw(struct ieee80211_hw *hw)mutex_destroy (&local->iflist_mtx);mutex_destroy (&local->mtx); -if (local->wiphy_ciphers_allocated) +if (local->wiphy_ciphers_allocated) {kfree (local->hw.wiphy->cipher_suites); + local->wiphy_ciphers_allocated = false; + }idr_for_each (&local->ack_status_frames, ieee80211_free_ack_frame,NULL );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 5/289 wifi: cfg80211: Fix bitrates overflow issue
In reply to Greg Kroah-HartmanFrom: Paul Zhang <[email protected]>
[ Upstream commit 18429c51c7ff6e6bfd627316c54670230967a7e5 ]
When invoking function cfg80211_calculate_bitrate_eht about (320 MHz, EHT-MCS 13, EHT-NSS 2, EHT-GI 0), which means the parameters as flags: 0x80, bw: 7, mcs: 13, eht_gi: 0, nss: 2, this formula (result * rate->nss) will overflow and causes the returned bitrate to be 3959 when it should be 57646.
Here is the explanation:
u64 tmp;
u32 result;
…
/* tmp = result = 4 * rates_996[0]
* = 4 * 480388888 = 0x72889c60
*/
tmp = result;
/* tmp = 0x72889c60 * 6144 = 0xabccea90000 */
tmp *= SCALE;
/* tmp = 0xabccea90000 / mcs_divisors[13]
* = 0xabccea90000 / 5120 = 0x8970bba6
*/
do_div(tmp, mcs_divisors[rate->mcs]);
/* result = 0x8970bba6 */
result = tmp;
/* normally (result * rate->nss) = 0x8970bba6 * 2 = 0x112e1774c,
* but since result is u32, (result * rate->nss) = 0x12e1774c,
* overflow happens and it loses the highest bit.
* Then result = 0x12e1774c / 8 = 39595753,
*/
result = (result * rate->nss) / 8;
--- net/wireless/util.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/wireless/util.c +4 -2
@@ -1555,10 +1555,12 @@ static u32 cfg80211_calculate_bitrate_eht(struct rate_info *rate) tmp = result; tmp *=SCALE ;do_div (tmp, mcs_divisors[rate->mcs]); - result = tmp;/* and take NSS */ - result = (result * rate->nss) /8 ; + tmp *= rate->nss; +do_div (tmp,8 ); + + result = tmp;return result /10000 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 6/289 wifi: mac80211_hwsim: fix debugfs attribute ps with rc table support
In reply to Greg Kroah-HartmanFrom: Jonas Jelonek <[email protected]>
[ Upstream commit 69188df5f6e4cecc6b76b958979ba363cd5240e8 ]
Fixes a warning that occurs when rc table support is enabled (IEEE80211_HW_SUPPORTS_RC_TABLE) in mac80211_hwsim and the PS mode is changed via the exported debugfs attribute.
When the PS mode is changed, a packet is broadcasted via hwsim_send_nullfunc by creating and transmitting a plain skb with only header initialized. The ieee80211 rate array in the control buffer is zero-initialized. When ratetbl support is enabled, ieee80211_get_tx_rates is called for the skb with sta parameter set to NULL and thus no ratetbl can be used. The final rate array then looks like [-1,0; 0,0; 0,0; 0,0] which causes the warning in ieee80211_get_tx_rate.
The issue is fixed by setting the count of the first rate with idx '0' to 1 and hence ieee80211_get_tx_rates won't overwrite it with idx '-1'.
--- drivers/net/wireless/mac80211_hwsim.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/wireless/mac80211_hwsim.c +5 -0
@@ -910,6 +910,7 @@ static void hwsim_send_nullfunc(struct mac80211_hwsim_data *data, u8 *mac,struct hwsim_vif_priv *vp = (void *)vif->drv_priv;struct sk_buff *skb;struct ieee80211_hdr *hdr; +struct ieee80211_tx_info *cb;if (!vp->assoc)return ;
@@ -931,6 +932,10 @@ static void hwsim_send_nullfunc(struct mac80211_hwsim_data *data, u8 *mac,memcpy (hdr->addr2, mac,ETH_ALEN );memcpy (hdr->addr3, vp->bssid,ETH_ALEN ); + cb =IEEE80211_SKB_CB (skb); + cb->control.rates[0 ].count =1 ; + cb->control.rates[1 ].idx =-1 ; +rcu_read_lock ();mac80211_hwsim_tx_frame (data->hw, skb,rcu_dereference (vif->bss_conf.chanctx_conf)->def.chan);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 7/289 spi: tegra210-quad: Dont initialise DMA if not supported
In reply to Greg Kroah-HartmanFrom: Jon Hunter <[email protected]>
[ Upstream commit ae4b3c1252f0fd0951d2f072a02ba46cac8d6c92 ]
The following error messages are observed on boot for Tegra234 ...
ERR KERN tegra-qspi 3270000.spi: cannot use DMA: -19 ERR KERN tegra-qspi 3270000.spi: falling back to PIO
Tegra234 does not support DMA for the QSPI and so initialising the DMA is expected to fail. The above error messages are misleading for devices that don't support DMA and so fix this by skipping the DMA initialisation for devices that don't support DMA.
--- drivers/spi/spi-tegra210-quad.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/spi/spi-tegra210-quad.c +6 -0
@@ -720,6 +720,9 @@ static int tegra_qspi_start_cpu_based_transfer(struct tegra_qspi *qspi, struct sstatic void tegra_qspi_deinit_dma (struct tegra_qspi *tqspi) { +if (!tqspi->soc_data->has_dma) +return ; +if (tqspi->tx_dma_buf) {dma_free_coherent (tqspi->dev, tqspi->dma_buf_size, tqspi->tx_dma_buf, tqspi->tx_dma_phys);
@@ -750,6 +753,9 @@ static int tegra_qspi_init_dma(struct tegra_qspi *tqspi)u32 *dma_buf;int err; +if (!tqspi->soc_data->has_dma) +return 0 ; + dma_chan =dma_request_chan (tqspi->dev,"rx" );if (IS_ERR (dma_chan)) { err =PTR_ERR (dma_chan);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 8/289 riscv: dts: sifive unleashed: Add PWM controlled LEDs
In reply to Greg Kroah-HartmanFrom: Emil Renner Berthing <[email protected]>
[ Upstream commit 8bc8824d30193eb7755043d5bb65fa7f0d11a595 ]
This adds the 4 PWM controlled green LEDs to the HiFive Unleashed device tree. The schematic doesn't specify any special function for the LEDs, so they're added here without any default triggers and named d1, d2, d3 and d4 just like in the schematic.
--- .../boot/dts/sifive/hifive-unleashed-a00.dts | 38 +++++++++++++++++++ 1 file changed, 38 insertions(+)
arch/riscv/boot/dts/sifive/hifive-unleashed-a00.dts +38 -0
@@ -3,6 +3,8 @@ #include "fu540-c000.dtsi" #include <dt-bindings/gpio/gpio.h> +#include <dt-bindings/leds/common.h> +#include <dt-bindings/pwm/pwm.h> /* Clock frequency (in Hz) of the PCB crystal for rtcclk */ #define RTCCLK_FREQ 1000000
@@ -42,6 +44,42 @@ gpio-restart { compatible = "gpio-restart"; gpios = <&gpio 10 GPIO_ACTIVE_LOW>; }; + + led-controller { + compatible = "pwm-leds"; + + led-d1 { + pwms = <&pwm0 0 7812500 PWM_POLARITY_INVERTED>; + active-low; + color = <LED_COLOR_ID_GREEN>; + max-brightness = <255>; + label = "d1"; + }; + + led-d2 { + pwms = <&pwm0 1 7812500 PWM_POLARITY_INVERTED>; + active-low; + color = <LED_COLOR_ID_GREEN>; + max-brightness = <255>; + label = "d2"; + }; + + led-d3 { + pwms = <&pwm0 2 7812500 PWM_POLARITY_INVERTED>; + active-low; + color = <LED_COLOR_ID_GREEN>; + max-brightness = <255>; + label = "d3"; + }; + + led-d4 { + pwms = <&pwm0 3 7812500 PWM_POLARITY_INVERTED>; + active-low; + color = <LED_COLOR_ID_GREEN>; + max-brightness = <255>; + label = "d4"; + }; + }; }; &uart0 {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 9/289 audit: fix undefined behavior in bit shift for AUDIT_BIT
In reply to Greg Kroah-HartmanFrom: Gaosheng Cui <[email protected]>
[ Upstream commit 986d93f55bdeab1cac858d1e47b41fac10b2d7f6 ]
Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below:
UBSAN: shift-out-of-bounds in kernel/auditfilter.c:179:23 left shift of 1 by 31 places cannot be represented in type 'int' Call Trace: <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c audit_register_class+0x9d/0x137 audit_classes_init+0x4d/0xb8 do_one_initcall+0x76/0x430 kernel_init_freeable+0x3b3/0x422 kernel_init+0x24/0x1e0 ret_from_fork+0x1f/0x30 </TASK>
--- include/uapi/linux/audit.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/uapi/linux/audit.h +1 -1
@@ -187,7 +187,7 @@#define AUDIT_MAX_KEY_LEN 256#define AUDIT_BITMASK_SIZE 64#define AUDIT_WORD (nr) ((__u32)((nr)/32)) -#define AUDIT_BIT (nr) (1 << ((nr) - AUDIT_WORD(nr)*32)) +#define AUDIT_BIT (nr) (1U << ((nr) - AUDIT_WORD(nr)*32))#define AUDIT_SYSCALL_CLASSES 16#define AUDIT_CLASS_DIR_WRITE 0
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 10/289 wifi: airo: do not assign -1 to unsigned char
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
[ Upstream commit e6cb8769452e8236b52134e5cb4a18b8f5986932 ]
With char becoming unsigned by default, and with char alone being ambiguous and based on architecture, we get a warning when assigning the unchecked output of hex_to_bin() to that unsigned char. Mark key as a u8, which matches the struct's type, and then check each call to hex_to_bin() before casting.
--- drivers/net/wireless/cisco/airo.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
drivers/net/wireless/cisco/airo.c +14 -4
@@ -5232,7 +5232,7 @@ static int get_wep_tx_idx(struct airo_info *ai)return -1 ; } -static int set_wep_key (struct airo_info *ai,u16 index,const char *key, +static int set_wep_key (struct airo_info *ai,u16 index,const u8 *key,u16 keylen,int perm,int lock) {static const unsigned char macaddr[ETH_ALEN ] = {0x01 ,0 ,0 ,0 ,0 ,0 };
@@ -5283,7 +5283,7 @@ static void proc_wepkey_on_close(struct inode *inode, struct file *file)struct net_device *dev =pde_data (inode);struct airo_info *ai = dev->ml_priv;int i, rc; -char key[16 ]; +u8 key[16 ];u16 index =0 ;int j =0 ;
@@ -5311,12 +5311,22 @@ static void proc_wepkey_on_close(struct inode *inode, struct file *file) }for (i =0 ; i <16 *3 && data->wbuffer[i+j]; i++) { +int val; + +if (i %3 ==2 ) +continue ; + + val =hex_to_bin (data->wbuffer[i+j]); +if (val <0 ) { +airo_print_err (ai->dev->name,"WebKey passed invalid key hex" ); +return ; + }switch (i%3 ) {case 0 : - key[i/3 ] =hex_to_bin (data->wbuffer[i+j])<<4 ; + key[i/3 ] = (u8 )val <<4 ;break ;case 1 : - key[i/3 ] |=hex_to_bin (data->wbuffer[i+j]); + key[i/3 ] |= (u8 )val;break ; } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 11/289 wifi: mac80211: Fix ack frame idr leak when mesh has no route
In reply to Greg Kroah-HartmanFrom: Nicolas Cavallari <[email protected]>
[ Upstream commit 39e7b5de9853bd92ddbfa4b14165babacd7da0ba ]
When trying to transmit an data frame with tx_status to a destination that have no route in the mesh, then it is dropped without recrediting the ack_status_frames idr.
Once it is exhausted, wpa_supplicant starts failing to do SAE with NL80211_CMD_FRAME and logs "nl80211: Frame command failed".
Use ieee80211_free_txskb() instead of kfree_skb() to fix it.
--- net/mac80211/mesh_pathtbl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/mac80211/mesh_pathtbl.c +1 -1
@@ -710,7 +710,7 @@ int mesh_path_send_to_gates(struct mesh_path *mpath)void mesh_path_discard_frame (struct ieee80211_sub_if_data *sdata,struct sk_buff *skb) { -kfree_skb (skb); +ieee80211_free_txskb (&sdata->local->hw, skb); sdata->u.mesh.mshstats.dropped_frames_no_route++; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 12/289 selftests/net: dont tests batched TCP io_uring zc
In reply to Greg Kroah-HartmanFrom: Pavel Begunkov <[email protected]>
[ Upstream commit 9921d5013a6e51892623bf2f1c5b49eaecda55ac ]
It doesn't make sense batch submitting io_uring requests to a single TCP socket without linking or some other kind of ordering. Moreover, it causes spurious -EINTR fails due to interaction with task_work. Disable it for now and keep queue depth=1.
--- tools/testing/selftests/net/io_uring_zerocopy_tx.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/io_uring_zerocopy_tx.sh +1 -1
@@ -29,7 +29,7 @@ if [[ "$#" -eq "0" ]]; then for IP in "${IPs[@]}"; do for mode in $(seq 1 3); do $0 "$IP" udp -m "$mode" -t 1 -n 32 - $0 "$IP" tcp -m "$mode" -t 1 -n 32 + $0 "$IP" tcp -m "$mode" -t 1 -n 1 done done
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 13/289 wifi: ath11k: Fix QCN9074 firmware boot on x86
In reply to Greg Kroah-HartmanFrom: Tyler J. Stachecki <[email protected]>
[ Upstream commit 3a89b6dec9920026eaa90fe8457f4348d3388a98 ]
The 2.7.0 series of QCN9074's firmware requests 5 segments of memory instead of 3 (as in the 2.5.0 series).
The first segment (11M) is too large to be kalloc'd in one go on x86 and requires piecemeal 1MB allocations, as was the case with the prior public firmware (2.5.0, 15M).
Since f6f92968e1e5, ath11k will break the memory requests, but only if there were fewer than 3 segments requested by the firmware. It seems that 5 segments works fine and allows QCN9074 to boot on x86 with firmware 2.7.0, so change things accordingly.
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.5.0.1-01208-QCAHKSWPL_SILICONZ-1
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.16
--- drivers/net/wireless/ath/ath11k/qmi.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath11k/qmi.h +1 -1
@@ -27,7 +27,7 @@#define ATH11K_QMI_WLANFW_MAX_NUM_MEM_SEG_V01 52#define ATH11K_QMI_CALDB_SIZE 0x480000#define ATH11K_QMI_BDF_EXT_STR_LENGTH 0x20 -#define ATH11K_QMI_FW_MEM_REQ_SEGMENT_CNT 3 +#define ATH11K_QMI_FW_MEM_REQ_SEGMENT_CNT 5#define QMI_WLFW_REQUEST_MEM_IND_V01 0x0035#define QMI_WLFW_FW_MEM_READY_IND_V01 0x0037
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 14/289 s390/zcrypt: fix warning about field-spanning write
In reply to Greg Kroah-HartmanFrom: Harald Freudenberger <[email protected]>
[ Upstream commit b43088f30db1a7bff61c8486238c195c77788d6d ]
This patch fixes the warning
memcpy: detected field-spanning write (size 60) of single field "to" at drivers/s390/crypto/zcrypt_api.h:173 (size 2)
WARNING: CPU: 1 PID: 2114 at drivers/s390/crypto/zcrypt_api.h:173 prep_ep11_ap_msg+0x2c6/0x2e0 [zcrypt]
The code has been rewritten to use a union in combination with a flex array to clearly state which part of the buffer the payload is to be copied in via z_copy_from_user function (which may call memcpy() in case of in-kernel calls).
--- drivers/s390/crypto/zcrypt_msgtype6.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-)
drivers/s390/crypto/zcrypt_msgtype6.c +15 -6
@@ -342,7 +342,10 @@ static int xcrb_msg_to_type6cprb_msgx(bool userspace, struct ap_message *ap_msg, };struct {struct type6_hdr hdr; -struct CPRBX cprbx; +union { +struct CPRBX cprbx; + DECLARE_FLEX_ARRAY(u8, userdata); + }; } __packed * msg = ap_msg->msg;int rcblen =CEIL4 (xcrb->request_control_blk_length);
@@ -403,7 +406,8 @@ static int xcrb_msg_to_type6cprb_msgx(bool userspace, struct ap_message *ap_msg, msg->hdr.fromcardlen2 = xcrb->reply_data_length;/* prepare CPRB */ -if (z_copy_from_user (userspace, &msg->cprbx, xcrb->request_control_blk_addr, +if (z_copy_from_user (userspace, msg->userdata, + xcrb->request_control_blk_addr, xcrb->request_control_blk_length))return -EFAULT ; if (msg->cprbx.cprb_len + sizeof(msg->hdr.function_code) >
@@ -469,9 +473,14 @@ static int xcrb_msg_to_type6_ep11cprb_msgx(bool userspace, struct ap_message *apstruct {struct type6_hdr hdr; -struct ep11_cprb cprbx; -unsigned char pld_tag;/* fixed value 0x30 */ -unsigned char pld_lenfmt;/* payload length format */ +union { +struct { +struct ep11_cprb cprbx; +unsigned char pld_tag;/* fixed value 0x30 */ +unsigned char pld_lenfmt;/* length format */ + } __packed; + DECLARE_FLEX_ARRAY(u8, userdata); + }; } __packed * msg = ap_msg->msg;struct pld_hdr {
@@ -500,7 +509,7 @@ static int xcrb_msg_to_type6_ep11cprb_msgx(bool userspace, struct ap_message *ap msg->hdr.fromcardlen1 = xcrb->resp_len;/* Import CPRB data from the ioctl input parameter */ -if (z_copy_from_user (userspace, &msg->cprbx.cprb_len, +if (z_copy_from_user (userspace, msg->userdata, (char __force __user *)xcrb->req, xcrb->req_len)) {return -EFAULT ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 15/289 spi: stm32: fix stm32_spi_prepare_mbr() that halves spi clk for every run
In reply to Greg Kroah-HartmanFrom: Sean Nyekjaer <[email protected]>
[ Upstream commit 62aa1a344b0904549f6de7af958e8a1136fd5228 ]
When this driver is used with a driver that uses preallocated spi_transfer structs. The speed_hz is halved by every run. This results in:
spi_stm32 44004000.spi: SPI transfer setup failed
ads7846 spi0.0: SPI transfer failed: -22
Example when running with DIV_ROUND_UP():
- First run; speed_hz = 1000000, spi->clk_rate 125000000
div 125 -> mbrdiv = 7, cur_speed = 976562
- Second run; speed_hz = 976562
div 128,00007 (roundup to 129) -> mbrdiv = 8, cur_speed = 488281
- Third run; speed_hz = 488281
div 256,000131072067109 (roundup to 257) and then -EINVAL is returned.
Use DIV_ROUND_CLOSEST to allow to round down and allow us to keep the set speed.
--- drivers/spi/spi-stm32.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-stm32.c +1 -1
@@ -434,7 +434,7 @@ static int stm32_spi_prepare_mbr(struct stm32_spi *spi, u32 speed_hz,u32 div, mbrdiv;/* Ensure spi->clk_rate is even */ - div =DIV_ROUND_UP (spi->clk_rate & ~0x1 , speed_hz); + div =DIV_ROUND_CLOSEST (spi->clk_rate & ~0x1 , speed_hz);/* * SPI framework set xfer->speed_hz to master->max_speed_hz if
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 16/289 selftests/bpf: Add verifier test for release_reference()
In reply to Greg Kroah-HartmanFrom: Youlin Li <[email protected]>
[ Upstream commit 475244f5e06beeda7b557d9dde46a5f439bf3379 ]
Add a test case to ensure that released pointer registers will not be leaked into the map.
Before fix:
./test_verifier 984
984/u reference tracking: try to leak released ptr reg FAIL Unexpected success to load!
verification time 67 usec
stack depth 4
processed 23 insns (limit 1000000) max_states_per_insn 0 total_states 2 peak_states 2 mark_read 1
984/p reference tracking: try to leak released ptr reg OK
Summary: 1 PASSED, 0 SKIPPED, 1 FAILED
After fix:
./test_verifier 984
984/u reference tracking: try to leak released ptr reg OK 984/p reference tracking: try to leak released ptr reg OK
Summary: 2 PASSED, 0 SKIPPED, 0 FAILED
--- .../selftests/bpf/verifier/ref_tracking.c | 36 +++++++++++++++++++ 1 file changed, 36 insertions(+)
tools/testing/selftests/bpf/verifier/ref_tracking.c +36 -0
@@ -905,3 +905,39 @@ .result_unpriv = REJECT, .errstr_unpriv = "unknown func", }, +{ + "reference tracking: try to leak released ptr reg", + .insns = { +BPF_MOV64_IMM (BPF_REG_0 ,0 ), +BPF_STX_MEM (BPF_W ,BPF_REG_10 ,BPF_REG_0 ,-4 ), +BPF_MOV64_REG (BPF_REG_2 ,BPF_REG_10 ), +BPF_ALU64_IMM (BPF_ADD ,BPF_REG_2 ,-4 ), +BPF_LD_MAP_FD (BPF_REG_1 ,0 ), +BPF_EMIT_CALL (BPF_FUNC_map_lookup_elem), +BPF_JMP_IMM (BPF_JNE ,BPF_REG_0 ,0 ,1 ), +BPF_EXIT_INSN (), +BPF_MOV64_REG (BPF_REG_9 ,BPF_REG_0 ), + +BPF_MOV64_IMM (BPF_REG_0 ,0 ), +BPF_LD_MAP_FD (BPF_REG_1 ,0 ), +BPF_MOV64_IMM (BPF_REG_2 ,8 ), +BPF_MOV64_IMM (BPF_REG_3 ,0 ), +BPF_EMIT_CALL (BPF_FUNC_ringbuf_reserve), +BPF_JMP_IMM (BPF_JNE ,BPF_REG_0 ,0 ,1 ), +BPF_EXIT_INSN (), +BPF_MOV64_REG (BPF_REG_8 ,BPF_REG_0 ), + +BPF_MOV64_REG (BPF_REG_1 ,BPF_REG_8 ), +BPF_MOV64_IMM (BPF_REG_2 ,0 ), +BPF_EMIT_CALL (BPF_FUNC_ringbuf_discard), +BPF_MOV64_IMM (BPF_REG_0 ,0 ), + +BPF_STX_MEM (BPF_DW ,BPF_REG_9 ,BPF_REG_8 ,0 ), +BPF_EXIT_INSN () + }, + .fixup_map_array_48b = { 4 }, + .fixup_map_ringbuf = { 11 }, + .result = ACCEPT, + .result_unpriv = REJECT, + .errstr_unpriv = "R8 !read_ok" +},
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 17/289 selftests/net: give more time to udpgro bg processes to complete startup
In reply to Greg Kroah-HartmanFrom: Adrien Thierry <[email protected]>
[ Upstream commit cdb525ca92b196f8916102b62431aa0d9a644ff2 ]
In some conditions, background processes in udpgro don't have enough time to set up the sockets. When foreground processes start, this results in the test failing with "./udpgso_bench_tx: sendmsg: Connection refused". For instance, this happens from time to time on a Qualcomm SA8540P SoC running CentOS Stream 9.
To fix this, increase the time given to background processes to complete the startup before foreground processes start.
--- tools/testing/selftests/net/udpgro.sh | 4 ++-- tools/testing/selftests/net/udpgro_bench.sh | 2 +- tools/testing/selftests/net/udpgro_frglist.sh | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-)
tools/testing/selftests/net/udpgro.sh +2 -2
@@ -50,7 +50,7 @@ run_one() { echo "failed" & # Hack: let bg programs complete the startup - sleep 0.1 + sleep 0.2 ./udpgso_bench_tx ${tx_args} ret=$? wait $(jobs -p)
@@ -117,7 +117,7 @@ run_one_2sock() { echo "failed" & # Hack: let bg programs complete the startup - sleep 0.1 + sleep 0.2 ./udpgso_bench_tx ${tx_args} -p 12345 sleep 0.1 # first UDP GSO socket should be closed at this point
tools/testing/selftests/net/udpgro_bench.sh +1 -1
@@ -39,7 +39,7 @@ run_one() { ip netns exec "${PEER_NS}" ./udpgso_bench_rx -t ${rx_args} -r & # Hack: let bg programs complete the startup - sleep 0.1 + sleep 0.2 ./udpgso_bench_tx ${tx_args} }
tools/testing/selftests/net/udpgro_frglist.sh +1 -1
@@ -44,7 +44,7 @@ run_one() { ip netns exec "${PEER_NS}" ./udpgso_bench_rx ${rx_args} -r & # Hack: let bg programs complete the startup - sleep 0.1 + sleep 0.2 ./udpgso_bench_tx ${tx_args} }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 18/289 Revert "net: macsec: report real_dev features when HW offloading is enabled"
In reply to Greg Kroah-HartmanFrom: Sabrina Dubroca <[email protected]>
[ Upstream commit 8bcd560ae8784da57c610d857118c5d6576b1a8f ]
This reverts commit c850240b6c4132574a00f2da439277ab94265b66.
That commit tried to improve the performance of macsec offload by taking advantage of some of the NIC's features, but in doing so, broke macsec offload when the lower device supports both macsec and ipsec offload, as the ipsec offload feature flags (mainly NETIF_F_HW_ESP) were copied from the real device. Since the macsec device doesn't provide xdo_* ops, the XFRM core rejects the registration of the new macsec device in xfrm_api_check.
Example perf trace when running
ip link add link eni1np1 type macsec port 4 offload mac
ip 737 [003] 795.477676: probe:xfrm_dev_event__REGISTER name="macsec0" features=0x1c000080014869
xfrm_dev_event+0x3a
notifier_call_chain+0x47
register_netdevice+0x846
macsec_newlink+0x25a
ip 737 [003] 795.477687: probe:xfrm_dev_event__return ret=0x8002 (NOTIFY_BAD)
notifier_call_chain+0x47
register_netdevice+0x846
macsec_newlink+0x25adev->features includes NETIF_F_HW_ESP (0x04000000000000), so xfrm_api_check returns NOTIFY_BAD because we don't have dev->xfrmdev_ops on the macsec device.
We could probably propagate GSO and a few other features from the lower device, similar to macvlan. This will be done in a future patch.
--- drivers/net/macsec.c | 27 ++++----------------------- 1 file changed, 4 insertions(+), 23 deletions(-)
drivers/net/macsec.c +4 -23
@@ -2685,11 +2685,6 @@ static int macsec_upd_offload(struct sk_buff *skb, struct genl_info *info)if (ret) goto rollback; -/* Force features update, since they are different for SW MACSec and -* HW offloading cases. -*/ -netdev_update_features (dev); -rtnl_unlock ();return 0 ;
@@ -3457,16 +3452,9 @@ static netdev_tx_t macsec_start_xmit(struct sk_buff *skb,return ret; } -#define SW_MACSEC_FEATURES \ +#define MACSEC_FEATURES \ (NETIF_F_SG | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST) -/* If h/w offloading is enabled, use real device features save for -* VLAN_FEATURES - they require additional ops -* HW_MACSEC - no reason to report it -*/ -#define REAL_DEV_FEATURES (dev) \ - ((dev)->features & ~(NETIF_F_VLAN_FEATURES | NETIF_F_HW_MACSEC)) -static int macsec_dev_init (struct net_device *dev) {struct macsec_dev *macsec =macsec_priv (dev);
@@ -3483,12 +3471,8 @@ static int macsec_dev_init(struct net_device *dev)return err; } -if (macsec_is_offloaded (macsec)) { - dev->features =REAL_DEV_FEATURES (real_dev); - }else { - dev->features = real_dev->features &SW_MACSEC_FEATURES ; - dev->features |=NETIF_F_LLTX |NETIF_F_GSO_SOFTWARE ; - } + dev->features = real_dev->features &MACSEC_FEATURES ; + dev->features |=NETIF_F_LLTX |NETIF_F_GSO_SOFTWARE ; dev->needed_headroom = real_dev->needed_headroom +MACSEC_NEEDED_HEADROOM ;
@@ -3520,10 +3504,7 @@ static netdev_features_t macsec_fix_features(struct net_device *dev,struct macsec_dev *macsec =macsec_priv (dev);struct net_device *real_dev = macsec->real_dev; -if (macsec_is_offloaded (macsec)) -return REAL_DEV_FEATURES (real_dev); - - features &= (real_dev->features &SW_MACSEC_FEATURES ) | + features &= (real_dev->features &MACSEC_FEATURES ) |NETIF_F_GSO_SOFTWARE |NETIF_F_SOFT_FEATURES ; features |=NETIF_F_LLTX ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 19/289 ACPI: video: Add backlight=native DMI quirk for Dell G15 5515
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit f46acc1efd4b5846de9fa05f966e504f328f34a6 ]
The Dell G15 5515 has the WMI interface (and WMI call returns) expected by the nvidia-wmi-ec-backlight interface. But the backlight class device registered by the nvidia-wmi-ec-backlight driver does not actually work.
The amdgpu_bl0 native GPU backlight class device does actually work, add a backlight=native DMI quirk for this.
--- drivers/acpi/video_detect.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/acpi/video_detect.c +14 -0
@@ -578,6 +578,20 @@ static const struct dmi_system_id video_detect_dmi_table[] = { DMI_MATCH(DMI_BOARD_NAME, "GMxRGxx"), }, }, +/* +* Models which have nvidia-ec-wmi support, but should not use it. +* Note this indicates a likely firmware bug on these models and should +* be revisited if/when Linux gets support for dynamic mux mode. +*/ + { + .callback = video_detect_force_native, + /* Dell G15 5515 */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), + DMI_MATCH(DMI_PRODUCT_NAME, "Dell G15 5515"), + }, + }, + /* * Desktops which falsely report a backlight and which our heuristics * for this do not catch.
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 20/289 platform/x86: ideapad-laptop: Disable touchpad_switch
In reply to Greg Kroah-HartmanFrom: Manyi Li <[email protected]>
[ Upstream commit a231224a601c1924b9df620281ad04472900d75f ]
Ideapads for "Lenovo Yoga 3 Pro 1370" and "ZhaoYang K4e-IML" do not use EC to switch touchpad.
Reading VPCCMD_R_TOUCHPAD will return zero thus touchpad may be blocked unexpectedly.
--- drivers/platform/x86/ideapad-laptop.c | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-)
drivers/platform/x86/ideapad-laptop.c +24 -1
@@ -1533,6 +1533,24 @@ static const struct dmi_system_id hw_rfkill_list[] = { {} }; +static const struct dmi_system_id no_touchpad_switch_list[] = { + { + .ident ="Lenovo Yoga 3 Pro 1370" , + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), +DMI_MATCH (DMI_PRODUCT_VERSION ,"Lenovo YOGA 3" ), + }, + }, + { + .ident ="ZhaoYang K4e-IML" , + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), +DMI_MATCH (DMI_PRODUCT_VERSION ,"ZhaoYang K4e-IML" ), + }, + }, + {} +}; +static void ideapad_check_features (struct ideapad_private *priv) {acpi_handle handle = priv->adev->handle;
@@ -1541,7 +1559,12 @@ static void ideapad_check_features(struct ideapad_private *priv) priv->features.hw_rfkill_switch =dmi_check_system (hw_rfkill_list);/* Most ideapads with ELAN0634 touchpad don't use EC touchpad switch */ - priv->features.touchpad_ctrl_via_ec = !acpi_dev_present ("ELAN0634" ,NULL ,-1 ); +if (acpi_dev_present ("ELAN0634" ,NULL ,-1 )) + priv->features.touchpad_ctrl_via_ec =0 ; +else if (dmi_check_system (no_touchpad_switch_list)) + priv->features.touchpad_ctrl_via_ec =0 ; +else + priv->features.touchpad_ctrl_via_ec =1 ;if (!read_ec_data (handle,VPCCMD_R_FAN , &val)) priv->features.fan_mode = true;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 21/289 platform/x86: touchscreen_dmi: Add info for the RCA Cambio W101 v2 2-in-1
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 0df044b34bf33e7e35c32b3bf6747fde6279c162 ]
Add touchscreen info for the RCA Cambio W101 v2 2-in-1.
--- drivers/platform/x86/touchscreen_dmi.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+)
drivers/platform/x86/touchscreen_dmi.c +25 -0
@@ -770,6 +770,22 @@ static const struct ts_dmi_data predia_basic_data = { .properties = predia_basic_props, }; +static const struct property_entry rca_cambio_w101_v2_props[] = { +PROPERTY_ENTRY_U32 ("touchscreen-min-x" ,4 ), +PROPERTY_ENTRY_U32 ("touchscreen-min-y" ,20 ), +PROPERTY_ENTRY_U32 ("touchscreen-size-x" ,1644 ), +PROPERTY_ENTRY_U32 ("touchscreen-size-y" ,874 ), +PROPERTY_ENTRY_BOOL ("touchscreen-swapped-x-y" ), +PROPERTY_ENTRY_STRING ("firmware-name" ,"gsl1680-rca-cambio-w101-v2.fw" ), +PROPERTY_ENTRY_U32 ("silead,max-fingers" ,10 ), + { } +}; + +static const struct ts_dmi_data rca_cambio_w101_v2_data = { + .acpi_name ="MSSL1680:00" , + .properties = rca_cambio_w101_v2_props, +}; +static const struct property_entry rwc_nanote_p8_props[] = {PROPERTY_ENTRY_U32 ("touchscreen-min-y" ,46 ),PROPERTY_ENTRY_U32 ("touchscreen-size-x" ,1728 ),
@@ -1409,6 +1425,15 @@ const struct dmi_system_id touchscreen_dmi_table[] = { DMI_EXACT_MATCH(DMI_BOARD_NAME, "0E57"), }, }, + { +/* RCA Cambio W101 v2 */ +/* https://github.com/onitake/gsl-firmware/discussions/193 */ + .driver_data = (void *)&rca_cambio_w101_v2_data, + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"RCA" ), + DMI_MATCH(DMI_PRODUCT_NAME, "W101SA23T1"), + }, + }, {/* RWC NANOTE P8 */ .driver_data = (void *)&rwc_nanote_p8_data,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 22/289 platform/x86/intel/pmt: Sapphire Rapids PMT errata fix
In reply to Greg Kroah-HartmanFrom: David E. Box <[email protected]>
[ Upstream commit bcdfa1f77ea7f67368d20384932a9d1e3047ddd2 ]
On Sapphire Rapids, due to a hardware issue affecting the PUNIT telemetry region, reads that are not done in QWORD quantities and alignment may return incorrect data. Use a custom 64-bit copy for this region.
--- drivers/platform/x86/intel/pmt/class.c | 31 +++++++++++++++++++++++++- 1 file changed, 30 insertions(+), 1 deletion(-)
drivers/platform/x86/intel/pmt/class.c +30 -1
@@ -9,6 +9,7 @@*/ #include <linux/kernel.h> +#include <linux/io-64-nonatomic-lo-hi.h> #include <linux/module.h> #include <linux/mm.h> #include <linux/pci.h>
@@ -19,6 +20,7 @@#define PMT_XA_START 0#define PMT_XA_MAX INT_MAX#define PMT_XA_LIMIT XA_LIMIT(PMT_XA_START, PMT_XA_MAX) +#define GUID_SPR_PUNIT 0x9956f43fbool intel_pmt_is_early_client_hw (struct device *dev) {
@@ -33,6 +35,29 @@ bool intel_pmt_is_early_client_hw(struct device *dev) }EXPORT_SYMBOL_GPL (intel_pmt_is_early_client_hw); +static inline int +pmt_memcpy64_fromio (void *to,const u64 __iomem *from,size_t count) +{ +int i, remain; +u64 *buf = to; + +if (!IS_ALIGNED ((unsigned long )from,8 )) +return -EFAULT ; + +for (i =0 ; i < count/8 ; i++) + buf[i] =readq (&from[i]); + +/* Copy any remaining bytes */ + remain = count %8 ; +if (remain) { +u64 tmp =readq (&from[i]); + +memcpy (&buf[i], &tmp, remain); + } + +return count; +} +/* * sysfs */
@@ -54,7 +79,11 @@ intel_pmt_read(struct file *filp, struct kobject *kobj,if (count > entry->size - off) count = entry->size - off; -memcpy_fromio (buf, entry->base + off, count); +if (entry->guid ==GUID_SPR_PUNIT ) +/* PUNIT on SPR only supports aligned 64-bit read */ + count =pmt_memcpy64_fromio (buf, entry->base + off, count); +else +memcpy_fromio (buf, entry->base + off, count);return count; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 23/289 platform/x86/intel/hid: Add some ACPI device IDs
In reply to Greg Kroah-HartmanFrom: Ivan Hu <[email protected]>
[ Upstream commit a977ece5773b6746b814aac410da4776023db239 ]
Add INTC1076 (JasonLake), INTC1077 (MeteorLake) and INTC1078 (RaptorLake) devices IDs.
--- drivers/platform/x86/intel/hid.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/platform/x86/intel/hid.c +3 -0
@@ -27,6 +27,9 @@ static const struct acpi_device_id intel_hid_ids[] = { {"INTC1051", 0}, {"INTC1054", 0}, {"INTC1070", 0}, + {"INTC1076", 0}, + {"INTC1077", 0}, + {"INTC1078", 0}, {"", 0}, };MODULE_DEVICE_TABLE (acpi, intel_hid_ids);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 24/289 scsi: ibmvfc: Avoid path failures during live migration
In reply to Greg Kroah-HartmanFrom: Brian King <[email protected]>
[ Upstream commit 62fa3ce05d5d73c5eccc40b2db493f55fecfc446 ]
Fix an issue reported when performing a live migration when multipath is configured with a short fast fail timeout of 5 seconds and also to have no_path_retry set to fail. In this scenario, all paths would go into the devloss state while the ibmvfc driver went through discovery to log back in. On a loaded system, the discovery might take longer than 5 seconds, which was resulting in all paths being marked failed, which then resulted in a read only filesystem.
This patch changes the migration code in ibmvfc to avoid deleting rports at all in this scenario, so we avoid losing all paths.
--- drivers/scsi/ibmvscsi/ibmvfc.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/scsi/ibmvscsi/ibmvfc.c +11 -3
@@ -708,8 +708,13 @@ static void ibmvfc_init_host(struct ibmvfc_host *vhost)memset (vhost->async_crq.msgs.async,0 ,PAGE_SIZE ); vhost->async_crq.cur =0 ; -list_for_each_entry (tgt, &vhost->targets, queue) -ibmvfc_del_tgt (tgt); +list_for_each_entry (tgt, &vhost->targets, queue) { +if (vhost->client_migrated) + tgt->need_login =1 ; +else +ibmvfc_del_tgt (tgt); + } +scsi_block_requests (vhost->host);ibmvfc_set_host_action (vhost,IBMVFC_HOST_ACTION_INIT ); vhost->job_step = ibmvfc_npiv_login;
@@ -3235,9 +3240,12 @@ static void ibmvfc_handle_crq(struct ibmvfc_crq *crq, struct ibmvfc_host *vhost,/* We need to re-setup the interpartition connection */ dev_info (vhost->dev,"Partition migrated, Re-enabling adapter\n" ); vhost->client_migrated =1 ; + +scsi_block_requests (vhost->host);ibmvfc_purge_requests (vhost,DID_REQUEUE ); -ibmvfc_link_down (vhost,IBMVFC_LINK_DOWN ); +ibmvfc_set_host_state (vhost,IBMVFC_LINK_DOWN );ibmvfc_set_host_action (vhost,IBMVFC_HOST_ACTION_REENABLE ); +wake_up (&vhost->work_wait_q); }else if (crq->format ==IBMVFC_PARTNER_FAILED || crq->format ==IBMVFC_PARTNER_DEREGISTER ) {dev_err (vhost->dev,"Host partner adapter deregistered or failed (rc=%d)\n" , crq->format);ibmvfc_purge_requests (vhost,DID_ERROR );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 25/289 scsi: scsi_debug: Make the READ CAPACITY response compliant with ZBC
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit ecb8c2580d37dbb641451049376d80c8afaa387f ]
Quoted 1 line
From ZBC-1:
- RC BASIS = 0: The RETURNED LOGICAL BLOCK ADDRESS field indicates the highest LBA of a contiguous range of zones that are not sequential write required zones starting with the first zone.
- RC BASIS = 1: The RETURNED LOGICAL BLOCK ADDRESS field indicates the LBA of the last logical block on the logical unit.
The current scsi_debug READ CAPACITY response does not comply with the above if there are one or more sequential write required zones. SCSI initiators need a way to retrieve the largest valid LBA from SCSI devices. Reporting the largest valid LBA if there are one or more sequential zones requires to set the RC BASIS field in the READ CAPACITY response to one. Hence this patch.
--- drivers/scsi/scsi_debug.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/scsi/scsi_debug.c +7 -0
@@ -1899,6 +1899,13 @@ static int resp_readcap16(struct scsi_cmnd *scp, arr[14 ] |=0x40 ; } +/* +* Since the scsi_debug READ CAPACITY implementation always reports the +* total disk capacity, set RC BASIS = 1 for host-managed ZBC devices. +*/ +if (devip->zmodel ==BLK_ZONED_HM ) + arr[12 ] |=1 <<4 ; + arr[15 ] = sdebug_lowest_aligned &0xff ;if (have_dif_prot) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 26/289 drm: panel-orientation-quirks: Add quirk for Nanote UMPC-01
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 308451d9c7fece33d9551230cb8e5eb7f3914988 ]
The Nanote UMPC-01 is a mini laptop with a 1200x1920 portrait screen mounted in a landscape oriented clamshell case. Add a quirk for this.
--- drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/drm_panel_orientation_quirks.c +6 -0
@@ -319,6 +319,12 @@ static const struct dmi_system_id orientation_data[] = { DMI_MATCH(DMI_BIOS_VERSION, "BLADE_21"), }, .driver_data = (void *)&lcd1200x1920_rightside_up, + }, { /* Nanote UMPC-01 */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"RWC CO.,LTD" ), + DMI_MATCH(DMI_PRODUCT_NAME, "UMPC-01"), + }, + .driver_data = (void *)&lcd1200x1920_rightside_up, }, { /* OneGX1 Pro */ .matches = { DMI_EXACT_MATCH(DMI_SYS_VENDOR, "SYSTEM_MANUFACTURER"),
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 27/289 drm: panel-orientation-quirks: Add quirk for Acer Switch V 10 (SW5-017)
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 653f2d94fcda200b02bd79cea2e0307b26c1b747 ]
Like the Acer Switch One 10 S1003, for which there already is a quirk, the Acer Switch V 10 (SW5-017) has a 800x1280 portrait screen mounted in the tablet part of a landscape oriented 2-in-1. Add a quirk for this.
--- drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/drm_panel_orientation_quirks.c +6 -0
@@ -134,6 +134,12 @@ static const struct dmi_system_id orientation_data[] = { DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "One S1003"), }, .driver_data = (void *)&lcd800x1280_rightside_up, + }, { /* Acer Switch V 10 (SW5-017) */ + .matches = { +DMI_EXACT_MATCH (DMI_SYS_VENDOR ,"Acer" ), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "SW5-017"), + }, + .driver_data = (void *)&lcd800x1280_rightside_up, }, { /* Anbernic Win600 */ .matches = { DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Anbernic"),
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 28/289 block, bfq: fix null pointer dereference in bfq_bio_bfqg()
In reply to Greg Kroah-HartmanFrom: Yu Kuai <[email protected]>
[ Upstream commit f02be9002c480cd3ec0fcf184ad27cf531bd6ece ]
Out test found a following problem in kernel 5.10, and the same problem should exist in mainline:
BUG: kernel NULL pointer dereference, address: 0000000000000094 PGD 0 P4D 0 Oops: 0000 [#1] SMP CPU: 7 PID: 155 Comm: kworker/7:1 Not tainted 5.10.0-01932-g19e0ace2ca1d-dirty 4 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-b4 Workqueue: kthrotld blk_throtl_dispatch_work_fn RIP: 0010:bfq_bio_bfqg+0x52/0xc0 Code: 94 00 00 00 00 75 2e 48 8b 40 30 48 83 05 35 06 c8 0b 01 48 85 c0 74 3d 4b RSP: 0018:ffffc90001a1fba0 EFLAGS: 00010002 RAX: ffff888100d60400 RBX: ffff8881132e7000 RCX: 0000000000000000 RDX: 0000000000000017 RSI: ffff888103580a18 RDI: ffff888103580a18 RBP: ffff8881132e7000 R08: 0000000000000000 R09: ffffc90001a1fe10 R10: 0000000000000a20 R11: 0000000000034320 R12: 0000000000000000 R13: ffff888103580a18 R14: ffff888114447000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88881fdc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000094 CR3: 0000000100cdb000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: bfq_bic_update_cgroup+0x3c/0x350 ? ioc_create_icq+0x42/0x270 bfq_init_rq+0xfd/0x1060 bfq_insert_requests+0x20f/0x1cc0 ? ioc_create_icq+0x122/0x270 blk_mq_sched_insert_requests+0x86/0x1d0 blk_mq_flush_plug_list+0x193/0x2a0 blk_flush_plug_list+0x127/0x170 blk_finish_plug+0x31/0x50 blk_throtl_dispatch_work_fn+0x151/0x190 process_one_work+0x27c/0x5f0 worker_thread+0x28b/0x6b0 ? rescuer_thread+0x590/0x590 kthread+0x153/0x1b0 ? kthread_flush_work+0x170/0x170 ret_from_fork+0x1f/0x30 Modules linked in: CR2: 0000000000000094 ---[ end trace e2e59ac014314547 ]--- RIP: 0010:bfq_bio_bfqg+0x52/0xc0 Code: 94 00 00 00 00 75 2e 48 8b 40 30 48 83 05 35 06 c8 0b 01 48 85 c0 74 3d 4b RSP: 0018:ffffc90001a1fba0 EFLAGS: 00010002 RAX: ffff888100d60400 RBX: ffff8881132e7000 RCX: 0000000000000000 RDX: 0000000000000017 RSI: ffff888103580a18 RDI: ffff888103580a18 RBP: ffff8881132e7000 R08: 0000000000000000 R09: ffffc90001a1fe10 R10: 0000000000000a20 R11: 0000000000034320 R12: 0000000000000000 R13: ffff888103580a18 R14: ffff888114447000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88881fdc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000094 CR3: 0000000100cdb000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Root cause is quite complex:
1) use bfq elevator for the test device.
2) create a cgroup CG
3) config blk throtl in CG
blkg_conf_prep
blkg_create
4) create a thread T1 and issue async io in CG:
bio_init
bio_associate_blkg
...
submit_bio
submit_bio_noacct
blk_throtl_bio -> io is throttled
// io submit is done5) switch elevator:
bfq_exit_queue
blkcg_deactivate_policy
list_for_each_entry(blkg, &q->blkg_list, q_node)
blkg->pd[] = NULL
// bfq policy is removed5) thread t1 exist, then remove the cgroup CG:
blkcg_unpin_online
blkcg_destroy_blkgs
blkg_destroy
list_del_init(&blkg->q_node)
// blkg is removed from queue list6) switch elevator back to bfq
bfq_init_queue
bfq_create_group_hierarchy
blkcg_activate_policy
list_for_each_entry_reverse(blkg, &q->blkg_list)
// blkg is removed from list, hence bfq policy is still NULL7) throttled io is dispatched to bfq:
bfq_insert_requests
bfq_init_rq
bfq_bic_update_cgroup
bfq_bio_bfqg
bfqg = blkg_to_bfqg(blkg)
// bfqg is NULL because bfq policy is NULL
The problem is only possible in bfq because only bfq can be deactivated and activated while queue is online, while others can only be deactivated while the device is removed.
Fix the problem in bfq by checking if blkg is online before calling blkg_to_bfqg().
--- block/bfq-cgroup.c | 4 ++++ 1 file changed, 4 insertions(+)
block/bfq-cgroup.c +4 -0
@@ -615,6 +615,10 @@ struct bfq_group *bfq_bio_bfqg(struct bfq_data *bfqd, struct bio *bio)struct bfq_group *bfqg;while (blkg) { +if (!blkg->online) { + blkg = blkg->parent; +continue ; + } bfqg =blkg_to_bfqg (blkg);if (bfqg->online) {bio_associate_blkg_from_css (bio, &blkg->blkcg->css);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 29/289 s390: always build relocatable kernel
In reply to Greg Kroah-HartmanFrom: Heiko Carstens <[email protected]>
[ Upstream commit 80ddf5ce1c9291cb175d52ed1227134ad48c47ee ]
Nathan Chancellor reported several link errors on s390 with CONFIG_RELOCATABLE disabled, after binutils commit 906f69cf65da ("IBM
zSystems: Issue error for *DBL relocs on misaligned symbols"). The binutils commit reveals potential miscompiles that might have happened already before with linker script defined symbols at odd addresses.
A similar bug was recently fixed in the kernel with commit c9305b6c1f52 ("s390: fix nospec table alignments").
See https://github.com/ClangBuiltLinux/linux/issues/1747 for an analysis from Ulich Weigand.
Therefore always build a relocatable kernel to avoid this problem. There is hardly any use-case for non-relocatable kernels, so this shouldn't be controversial.
--- arch/s390/Kconfig | 6 +++--- arch/s390/Makefile | 2 -- arch/s390/boot/Makefile | 3 +-- arch/s390/boot/startup.c | 3 +-- 4 files changed, 5 insertions(+), 9 deletions(-)
arch/s390/Kconfig +3 -3
@@ -568,8 +568,7 @@ config EXPOLINE_FULL endchoice config RELOCATABLE - bool "Build a relocatable kernel" - default y + def_bool y help This builds a kernel image that retains relocation information so it can be loaded at an arbitrary address.
@@ -578,10 +577,11 @@ config RELOCATABLE bootup process. The relocations make the kernel image about 15% larger (compressed 10%), but are discarded at runtime. + Note: this option exists only for documentation purposes, please do + not remove it. config RANDOMIZE_BASE bool "Randomize the address of the kernel image (KASLR)" - depends on RELOCATABLE default y help In support of Kernel Address Space Layout Randomization (KASLR),
arch/s390/Makefile +0 -2
@@ -14,10 +14,8 @@ KBUILD_AFLAGS_MODULE += -fPIC KBUILD_CFLAGS_MODULE += -fPIC KBUILD_AFLAGS += -m64 KBUILD_CFLAGS += -m64 -ifeq ($(CONFIG_RELOCATABLE),y) KBUILD_CFLAGS += -fPIE LDFLAGS_vmlinux := -pie -endif aflags_dwarf := -Wa,-gdwarf-2 KBUILD_AFLAGS_DECOMPRESSOR := $(CLANG_FLAGS) -m64 -D__ASSEMBLY__ ifndef CONFIG_AS_IS_LLVM
arch/s390/boot/Makefile +1 -2
@@ -37,9 +37,8 @@ CFLAGS_sclp_early_core.o += -I$(srctree)/drivers/s390/char obj-y := head.o als.o startup.o mem_detect.o ipl_parm.o ipl_report.o obj-y += string.o ebcdic.o sclp_early_core.o mem.o ipl_vmparm.o cmdline.o -obj-y += version.o pgm_check_info.o ctype.o ipl_data.o +obj-y += version.o pgm_check_info.o ctype.o ipl_data.o machine_kexec_reloc.o obj-$(findstring y, $(CONFIG_PROTECTED_VIRTUALIZATION_GUEST) $(CONFIG_PGSTE)) += uv.o -obj-$(CONFIG_RELOCATABLE) += machine_kexec_reloc.o obj-$(CONFIG_RANDOMIZE_BASE) += kaslr.o obj-y += $(if $(CONFIG_KERNEL_UNCOMPRESSED),,decompressor.o) info.o obj-$(CONFIG_KERNEL_ZSTD) += clz_ctz.o
arch/s390/boot/startup.c +1 -2
@@ -285,8 +285,7 @@ void startup_kernel(void)clear_bss_section ();copy_bootdata (); -if (IS_ENABLED (CONFIG_RELOCATABLE )) -handle_relocs (__kaslr_offset); +handle_relocs (__kaslr_offset);if (__kaslr_offset) {/*
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 30/289 arm64/syscall: Include asm/ptrace.h in syscall_wrapper header.
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
[ Upstream commit acfc35cfcee5df419391671ef1a631f43feee4e3 ]
Add the same change for ARM64 as done in the commit 9440c4294160 ("x86/syscall: Include asm/ptrace.h in syscall_wrapper header") to make sure all syscalls see 'struct pt_regs' definition and resulted BTF for '__arm64_sys_*(struct pt_regs *regs)' functions point to actual struct.
Without this patch, the BPF verifier refuses to load a tracing prog which accesses pt_regs.
bpf(BPF_PROG_LOAD, {prog_type=0x1a, ...}, 128) = -1 EACCES
With this patch, we can see the correct error, which saves us time in debugging the prog.
bpf(BPF_PROG_LOAD, {prog_type=0x1a, ...}, 128) = 4 bpf(BPF_RAW_TRACEPOINT_OPEN, {raw_tracepoint={name=NULL, prog_fd=4}}, 128) = -1 ENOTSUPP
--- arch/arm64/include/asm/syscall_wrapper.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/include/asm/syscall_wrapper.h +1 -1
@@ -8,7 +8,7 @@#ifndef __ASM_SYSCALL_WRAPPER_H#define __ASM_SYSCALL_WRAPPER_H -struct pt_regs ; +#include <asm/ptrace.h> #define SC_ARM64_REGS_TO_ARGS (x, ...) \ __MAP(x,__SC_ARGS \
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 31/289 nvme: quiet user passthrough command errors
In reply to Greg Kroah-HartmanFrom: Keith Busch <[email protected]>
[ Upstream commit d7ac8dca938cd60cf7bd9a89a229a173c6bcba87 ]
The driver is spamming the kernel logs for entirely harmless errors from user space submitting unsupported commands. Just silence the errors. The application has direct access to command status, so there's no need to log these.
And since every passthrough command now uses the quiet flag, move the setting to the common initializer.
--- drivers/nvme/host/core.c | 3 +-- drivers/nvme/host/pci.c | 2 -- 2 files changed, 1 insertion(+), 4 deletions(-)
drivers/nvme/host/core.c +1 -2
@@ -675,6 +675,7 @@ void nvme_init_request(struct request *req, struct nvme_command *cmd)if (req->mq_hctx->type ==HCTX_TYPE_POLL ) req->cmd_flags |=REQ_POLLED ;nvme_clear_nvme_request (req); + req->rq_flags |=RQF_QUIET ;memcpy (nvme_req (req)->cmd, cmd,sizeof (*cmd)); }EXPORT_SYMBOL_GPL (nvme_init_request);
@@ -1037,7 +1038,6 @@ int __nvme_submit_sync_cmd(struct request_queue *q, struct nvme_command *cmd, goto out; } - req->rq_flags |=RQF_QUIET ; ret =nvme_execute_rq (req, at_head);if (result && ret >=0 ) *result =nvme_req (req)->result;
@@ -1225,7 +1225,6 @@ static void nvme_keep_alive_work(struct work_struct *work) rq->timeout = ctrl->kato *HZ ; rq->end_io = nvme_keep_alive_end_io; rq->end_io_data = ctrl; - rq->rq_flags |=RQF_QUIET ;blk_execute_rq_nowait (rq, false); }
drivers/nvme/host/pci.c +0 -2
@@ -1438,7 +1438,6 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req) abort_req->end_io = abort_endio; abort_req->end_io_data =NULL ; - abort_req->rq_flags |=RQF_QUIET ;blk_execute_rq_nowait (abort_req, false);/*
@@ -2489,7 +2488,6 @@ static int nvme_delete_queue(struct nvme_queue *nvmeq, u8 opcode) req->end_io_data = nvmeq;init_completion (&nvmeq->delete_done); - req->rq_flags |=RQF_QUIET ;blk_execute_rq_nowait (req, false);return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 32/289 nvmet: fix memory leak in nvmet_subsys_attr_model_store_locked
In reply to Greg Kroah-HartmanFrom: Aleksandr Miloserdov <[email protected]>
[ Upstream commit becc4cac309dc867571f0080fde4426a6c2222e0 ]
Since model_number is allocated before it needs to be freed before kmemdump_nul.
--- drivers/nvme/target/configfs.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/nvme/target/configfs.c +5 -2
@@ -1215,6 +1215,7 @@ static ssize_t nvmet_subsys_attr_model_store_locked(struct nvmet_subsys *subsys, const char *page, size_t count) { int pos = 0, len; +char *val;if (subsys->subsys_discovered) { pr_err("Can't set model number. %s is already assigned\n",
@@ -1237,9 +1238,11 @@ static ssize_t nvmet_subsys_attr_model_store_locked(struct nvmet_subsys *subsys,return -EINVAL ; } - subsys->model_number =kmemdup_nul (page, len,GFP_KERNEL ); -if (!subsys->model_number) + val =kmemdup_nul (page, len,GFP_KERNEL ); +if (!val)return -ENOMEM ; +kfree (subsys->model_number); + subsys->model_number = val;return count; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 33/289 net: wwan: iosm: fix kernel test robot reported errors
In reply to Greg Kroah-HartmanFrom: M Chetan Kumar <[email protected]>
[ Upstream commit 980ec04a88c9f0046c1da65833fb77b2ffa34b04 ]
Include linux/vmalloc.h in iosm_ipc_coredump.c & iosm_ipc_devlink.c to resolve kernel test robot errors.
--- drivers/net/wwan/iosm/iosm_ipc_coredump.c | 1 + drivers/net/wwan/iosm/iosm_ipc_devlink.c | 1 + 2 files changed, 2 insertions(+)
drivers/net/wwan/iosm/iosm_ipc_coredump.c +1 -0
@@ -2,6 +2,7 @@/* * Copyright (C) 2020-2021 Intel Corporation. */ +#include <linux/vmalloc.h> #include "iosm_ipc_coredump.h"
drivers/net/wwan/iosm/iosm_ipc_devlink.c +1 -0
@@ -2,6 +2,7 @@/* * Copyright (C) 2020-2021 Intel Corporation. */ +#include <linux/vmalloc.h> #include "iosm_ipc_chnl_cfg.h" #include "iosm_ipc_coredump.h"
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 34/289 drm/amd/display: Zeromem mypipe heap struct before using it
In reply to Greg Kroah-HartmanFrom: Aurabindo Pillai <[email protected]>
[ Upstream commit ab4b35008db9b7ae747679250e5c26d7c3a90cea ]
[Why&How]
Bug was caused when moving variable from stack to heap because it was reusable and garbage was left over, so we need to zero mem.
--- drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c +1 -0
@@ -3197,6 +3197,7 @@ void dml32_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l mode_lib->vba.FCLKChangeLatency, mode_lib->vba.UrgLatency[i], mode_lib->vba.SREnterPlusExitTime); +memset (&v->dummy_vars.dml32_ModeSupportAndSystemConfigurationFull,0 ,sizeof (DmlPipe)); v->dummy_vars.dml32_ModeSupportAndSystemConfigurationFull.myPipe.Dppclk = mode_lib->vba.RequiredDPPCLK[i][j][k]; v->dummy_vars.dml32_ModeSupportAndSystemConfigurationFull.myPipe.Dispclk = mode_lib->vba.RequiredDISPCLK[i][j]; v->dummy_vars.dml32_ModeSupportAndSystemConfigurationFull.myPipe.PixelClock = mode_lib->vba.PixelClock[k];
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 35/289 drm/amd/display: Fix FCLK deviation and tool compile issues
In reply to Greg Kroah-HartmanFrom: Chaitanya Dhere <[email protected]>
[ Upstream commit 0d5c5c210a4d4e655feb93b379647f0b179cdafe ]
[Why]
Recent backports from open source do not have header inclusion pattern that is consistent with inclusion style in the rest of the file. This breaks the internal tool builds as well. A recent commit erronously modified the original DML formula for calculating ActiveClockChangeLatencyHidingY. This resulted in a FCLK deviation from the golden values.
[How]
Change the way in which display_mode_vba.h is included so that it is consistent with the inclusion style in rest of the file which also fixes the tool build. Restore the DML formula to its original state to fix the FCLK deviation.
--- .../gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c | 2 +- .../gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c +1 -1
@@ -4396,7 +4396,7 @@ void dml32_CalculateWatermarksMALLUseAndDRAMSpeedChangeSupport(if (v->NumberOfActiveSurfaces >1 ) { ActiveClockChangeLatencyHidingY = ActiveClockChangeLatencyHidingY - - (1 -1 / v->NumberOfActiveSurfaces) * SwathHeightY[k] * v->HTotal[k] + - (1.0 -1.0 / v->NumberOfActiveSurfaces) * SwathHeightY[k] * v->HTotal[k] / v->PixelClock[k] / v->VRatio[k]; }
drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.h +1 -1
@@ -30,7 +30,7 @@#include "os_types.h" #include "../dc_features.h" #include "../display_mode_structs.h" -#include "dml/display_mode_vba.h" +#include "../display_mode_vba.h" unsigned int dml32_dscceComputeDelay( unsigned int bpc,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 36/289 drm/amd/display: Fix gpio port mapping issue
In reply to Greg Kroah-HartmanFrom: Steve Su <[email protected]>
[ Upstream commit c0b2753f5db281b07013899c79b5f06a614055f9 ]
[Why]
1. Port of gpio has different mapping.
[How]
1. Add a dummy entry in mapping table.
2. Fix incorrect mask bit field access.
--- .../amd/display/dc/gpio/dcn32/hw_factory_dcn32.c | 14 ++++++++++++++ drivers/gpu/drm/amd/display/dc/gpio/hw_ddc.c | 9 ++++++--- 2 files changed, 20 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/display/dc/gpio/dcn32/hw_factory_dcn32.c +14 -0
@@ -107,6 +107,13 @@ static const struct ddc_registers ddc_data_regs_dcn[] = {ddc_data_regs_dcn2 (3 ),ddc_data_regs_dcn2 (4 ),ddc_data_regs_dcn2 (5 ), + { + // add a dummy entry for cases no such port + {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,}, + .ddc_setup =0 , + .phy_aux_cntl = 0, + .dc_gpio_aux_ctrl_5 = 0 + }, {DDC_GPIO_VGA_REG_LIST (DATA ), .ddc_setup = 0,
@@ -121,6 +128,13 @@ static const struct ddc_registers ddc_clk_regs_dcn[] = {ddc_clk_regs_dcn2 (3 ),ddc_clk_regs_dcn2 (4 ),ddc_clk_regs_dcn2 (5 ), + { + // add a dummy entry for cases no such port + {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,}, + .ddc_setup =0 , + .phy_aux_cntl = 0, + .dc_gpio_aux_ctrl_5 = 0 + }, {DDC_GPIO_VGA_REG_LIST (CLK ), .ddc_setup = 0,
drivers/gpu/drm/amd/display/dc/gpio/hw_ddc.c +6 -3
@@ -94,11 +94,14 @@ static enum gpio_result set_config(* is required for detection of AUX mode */ if (hw_gpio->base.en !=GPIO_DDC_LINE_VIP_PAD ) {if (!ddc_data_pd_en || !ddc_clk_pd_en) { - -REG_SET_2 (gpio.MASK_reg, regval, +if (hw_gpio->base.en ==GPIO_DDC_LINE_DDC_VGA ) { +// bit 4 of mask has different usage in some cases +REG_SET (gpio.MASK_reg, regval,DC_GPIO_DDC1DATA_PD_EN ,1 ); + }else { +REG_SET_2 (gpio.MASK_reg, regval,DC_GPIO_DDC1DATA_PD_EN ,1 ,DC_GPIO_DDC1CLK_PD_EN ,1 ); - + }if (config_data->type ==GPIO_CONFIG_TYPE_I2C_AUX_DUAL_MODE )msleep (3 );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 37/289 Revert "drm/amdgpu: Revert "drm/amdgpu: getting fan speed pwm for vega10 properly""
In reply to Greg Kroah-HartmanFrom: Asher Song <[email protected]>
[ Upstream commit 30b8e7b8ee3be003e0df85c857c5cd0e0bd58b82 ]
This reverts commit 4545ae2ed3f2f7c3f615a53399c9c8460ee5bca7.
The origin patch "drm/amdgpu: getting fan speed pwm for vega10 properly" works fine. Test failure is caused by test case self.
--- .../amd/pm/powerplay/hwmgr/vega10_thermal.c | 25 +++++++++---------- 1 file changed, 12 insertions(+), 13 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_thermal.c +12 -13
@@ -67,22 +67,21 @@ int vega10_fan_ctrl_get_fan_speed_info(struct pp_hwmgr *hwmgr,int vega10_fan_ctrl_get_fan_speed_pwm (struct pp_hwmgr *hwmgr,uint32_t *speed) { -uint32_t current_rpm; -uint32_t percent =0 ; - -if (hwmgr->thermal_controller.fanInfo.bNoFan) -return 0 ; +struct amdgpu_device *adev = hwmgr->adev; +uint32_t duty100, duty; +uint64_t tmp64; -if (vega10_get_current_rpm (hwmgr, ¤t_rpm)) -return -1 ; + duty100 =REG_GET_FIELD (RREG32_SOC15 (THM ,0 , mmCG_FDO_CTRL1), +CG_FDO_CTRL1 ,FMAX_DUTY100 ); + duty =REG_GET_FIELD (RREG32_SOC15 (THM ,0 , mmCG_THERMAL_STATUS), +CG_THERMAL_STATUS ,FDO_PWM_DUTY ); -if (hwmgr->thermal_controller. - advanceFanControlParameters.usMaxFanRPM !=0 ) - percent = current_rpm *255 / - hwmgr->thermal_controller. - advanceFanControlParameters.usMaxFanRPM; +if (!duty100) +return -EINVAL ; - *speed =MIN (percent,255 ); + tmp64 = (uint64_t )duty *255 ; +do_div (tmp64, duty100); + *speed =MIN ((uint32_t )tmp64,255 );return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 38/289 drm/amdgpu: Drop eviction lock when allocating PT BO
In reply to Greg Kroah-HartmanFrom: Philip Yang <[email protected]>
[ Upstream commit e034a0d9aaee5c9129d5dfdfdfcab988a953412d ]
Re-take the eviction lock immediately again after the allocation is completed, to fix circular locking warning with drm_buddy allocator.
Move amdgpu_vm_eviction_lock/unlock/trylock to amdgpu_vm.h as they are called from multiple files.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 26 ----------------------- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 26 +++++++++++++++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c | 2 ++ 3 files changed, 28 insertions(+), 26 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +0 -26
@@ -143,32 +143,6 @@ int amdgpu_vm_set_pasid(struct amdgpu_device *adev, struct amdgpu_vm *vm,return 0 ; } -/* -* vm eviction_lock can be taken in MMU notifiers. Make sure no reclaim-FS -* happens while holding this lock anywhere to prevent deadlocks when -* an MMU notifier runs in reclaim-FS context. -*/ -static inline void amdgpu_vm_eviction_lock (struct amdgpu_vm *vm) -{ -mutex_lock (&vm->eviction_lock); - vm->saved_flags =memalloc_noreclaim_save (); -} - -static inline int amdgpu_vm_eviction_trylock (struct amdgpu_vm *vm) -{ -if (mutex_trylock (&vm->eviction_lock)) { - vm->saved_flags =memalloc_noreclaim_save (); -return 1 ; - } -return 0 ; -} - -static inline void amdgpu_vm_eviction_unlock (struct amdgpu_vm *vm) -{ -memalloc_noreclaim_restore (vm->saved_flags); -mutex_unlock (&vm->eviction_lock); -} -/** * amdgpu_vm_bo_evicted - vm_bo is evicted *
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h +26 -0
@@ -503,4 +503,30 @@ static inline uint64_t amdgpu_vm_tlb_seq(struct amdgpu_vm *vm) return atomic64_read(&vm->tlb_seq); } +/* +* vm eviction_lock can be taken in MMU notifiers. Make sure no reclaim-FS +* happens while holding this lock anywhere to prevent deadlocks when +* an MMU notifier runs in reclaim-FS context. +*/ +static inline void amdgpu_vm_eviction_lock (struct amdgpu_vm *vm) +{ +mutex_lock (&vm->eviction_lock); + vm->saved_flags =memalloc_noreclaim_save (); +} + +static inline bool amdgpu_vm_eviction_trylock (struct amdgpu_vm *vm) +{ +if (mutex_trylock (&vm->eviction_lock)) { + vm->saved_flags =memalloc_noreclaim_save (); +return true; + } +return false; +} + +static inline void amdgpu_vm_eviction_unlock (struct amdgpu_vm *vm) +{ +memalloc_noreclaim_restore (vm->saved_flags); +mutex_unlock (&vm->eviction_lock); +} +#endif
drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c +2 -0
@@ -597,7 +597,9 @@ static int amdgpu_vm_pt_alloc(struct amdgpu_device *adev,if (entry->bo)return 0 ; +amdgpu_vm_eviction_unlock (vm); r =amdgpu_vm_pt_create (adev, vm, cursor->level, immediate, &pt); +amdgpu_vm_eviction_lock (vm);if (r)return r;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 39/289 drm/amd/display: only fill dirty rectangles when PSR is enabled
In reply to Greg Kroah-HartmanFrom: Hamza Mahfooz <[email protected]>
[ Upstream commit 675d84621a24490e1de3d59a4992a17fa9ff92b5 ]
Currently, we are calling fill_dc_dirty_rects() even if PSR isn't supported by the relevant link in amdgpu_dm_commit_planes(), this is undesirable especially because when drm.debug is enabled we are printing messages in fill_dc_dirty_rects() that are only useful for debugging PSR (and confusing otherwise). So, we can instead limit the filling of dirty rectangles to only when PSR is enabled.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +4 -3
@@ -7650,9 +7650,10 @@ static void amdgpu_dm_commit_planes(struct drm_atomic_state *state, bundle->surface_updates[planes_count].plane_info = &bundle->plane_infos[planes_count]; -fill_dc_dirty_rects (plane, old_plane_state, new_plane_state, - new_crtc_state, - &bundle->flip_addrs[planes_count]); +if (acrtc_state->stream->link->psr_settings.psr_feature_enabled) +fill_dc_dirty_rects (plane, old_plane_state, + new_plane_state, new_crtc_state, + &bundle->flip_addrs[planes_count]);/* * Only allow immediate flips for fast updates that don't
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 40/289 ALSA: usb-audio: add quirk to fix Hamedal C20 disconnect issue
In reply to Greg Kroah-HartmanFrom: Ai Chao <[email protected]>
[ Upstream commit bf990c10231937c0f51e5da5558e08cf5adc6a78 ]
For Hamedal C20, the current rate is different from the runtime rate, snd_usb_endpoint stop and close endpoint to resetting rate. if snd_usb_endpoint close the endpoint, sometimes usb will disconnect the device.
--- sound/usb/endpoint.c | 3 ++- sound/usb/quirks.c | 2 ++ sound/usb/usbaudio.h | 3 +++ 3 files changed, 7 insertions(+), 1 deletion(-)
sound/usb/endpoint.c +2 -1
@@ -923,7 +923,8 @@ void snd_usb_endpoint_close(struct snd_usb_audio *chip,usb_audio_dbg (chip,"Closing EP 0x%x (count %d)\n" , ep->ep_num, ep->opened); -if (!--ep->iface_ref->opened) +if (!--ep->iface_ref->opened && + !(chip->quirk_flags &QUIRK_FLAG_IFACE_SKIP_CLOSE ))endpoint_set_interface (chip, ep, false);if (!--ep->opened) {
sound/usb/quirks.c +2 -0
@@ -2186,6 +2186,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = { QUIRK_FLAG_GENERIC_IMPLICIT_FB),DEVICE_FLG (0x2b53 ,0x0031 ,/* Fiero SC-01 (firmware v1.1.0) */ QUIRK_FLAG_GENERIC_IMPLICIT_FB ), +DEVICE_FLG (0x0525 ,0xa4ad ,/* Hamedal C20 usb camero */ +QUIRK_FLAG_IFACE_SKIP_CLOSE ),/* Vendor matches */ VENDOR_FLG(0x045e, /* MS Lifecam */
sound/usb/usbaudio.h +3 -0
@@ -170,6 +170,8 @@ extern bool snd_usb_skip_validation;* Apply the generic implicit feedback sync mode (same as implicit_fb=1 option) * QUIRK_FLAG_SKIP_IMPLICIT_FB * Don't apply implicit feedback sync mode +* QUIRK_FLAG_IFACE_SKIP_CLOSE +* Don't closed interface during setting sample rate */ #define QUIRK_FLAG_GET_SAMPLE_RATE (1U << 0)
@@ -191,5 +193,6 @@ extern bool snd_usb_skip_validation;#define QUIRK_FLAG_SET_IFACE_FIRST (1U << 16)#define QUIRK_FLAG_GENERIC_IMPLICIT_FB (1U << 17)#define QUIRK_FLAG_SKIP_IMPLICIT_FB (1U << 18) +#define QUIRK_FLAG_IFACE_SKIP_CLOSE (1U << 19)#endif /* __USBAUDIO_H */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 41/289 RISC-V: vdso: Do not add missing symbols to version section in linker script
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
[ Upstream commit fcae44fd36d052e956e69a64642fc03820968d78 ]
Recently, ld.lld moved from '--undefined-version' to '--no-undefined-version' as the default, which breaks the compat vDSO build:
ld.lld: error: version script assignment of 'LINUX_4.15' to symbol '__vdso_gettimeofday' failed: symbol not defined ld.lld: error: version script assignment of 'LINUX_4.15' to symbol '__vdso_clock_gettime' failed: symbol not defined ld.lld: error: version script assignment of 'LINUX_4.15' to symbol '__vdso_clock_getres' failed: symbol not defined
These symbols are not present in the compat vDSO or the regular vDSO for 32-bit but they are unconditionally included in the version section of the linker script, which is prohibited with '--no-undefined-version'.
Fix this issue by only including the symbols that are actually exported in the version section of the linker script.
--- arch/riscv/kernel/vdso/Makefile | 3 +++ arch/riscv/kernel/vdso/vdso.lds.S | 2 ++ 2 files changed, 5 insertions(+)
arch/riscv/kernel/vdso/Makefile +3 -0
@@ -28,6 +28,9 @@ obj-vdso := $(addprefix $(obj)/, $(obj-vdso)) obj-y += vdso.o CPPFLAGS_vdso.lds += -P -C -U$(ARCH) +ifneq ($(filter vgettimeofday, $(vdso-syms)),) +CPPFLAGS_vdso.lds += -DHAS_VGETTIMEOFDAY +endif # Disable -pg to prevent insert call site CFLAGS_REMOVE_vgettimeofday.o = $(CC_FLAGS_FTRACE)
arch/riscv/kernel/vdso/vdso.lds.S +2 -0
@@ -68,9 +68,11 @@ VERSION LINUX_4.15 { global: __vdso_rt_sigreturn; +#ifdef HAS_VGETTIMEOFDAY __vdso_gettimeofday; __vdso_clock_gettime; __vdso_clock_getres; +#endif __vdso_getcpu; __vdso_flush_icache; local: *;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 42/289 MIPS: pic32: treat port as signed integer
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
[ Upstream commit 648060902aa302331b5d6e4f26d8ee0761d239ab ]
get_port_from_cmdline() returns an int, yet is assigned to a char, which is wrong in its own right, but also, with char becoming unsigned, this poses problems, because -1 is used as an error value. Further complicating things, fw_init_early_console() is only ever called with a -1 argument. Fix this up by removing the unused argument from fw_init_early_console() and treating port as a proper signed integer.
--- arch/mips/include/asm/fw/fw.h | 2 +- arch/mips/pic32/pic32mzda/early_console.c | 13 ++++++------- arch/mips/pic32/pic32mzda/init.c | 2 +- 3 files changed, 8 insertions(+), 9 deletions(-)
arch/mips/include/asm/fw/fw.h +1 -1
@@ -26,6 +26,6 @@ extern char *fw_getcmdline(void);extern void fw_meminit (void );extern char *fw_getenv (char *name);extern unsigned long fw_getenvl (char *name); -extern void fw_init_early_console (char port); +extern void fw_init_early_console (void );#endif /* __ASM_FW_H_ */
arch/mips/pic32/pic32mzda/early_console.c +6 -7
@@ -27,7 +27,7 @@#define U_BRG (x) (UART_BASE(x) + 0x40)static void __iomem *uart_base; -static char console_port =-1 ; +static int console_port =-1 ;static int __init configure_uart_pins (int port) {
@@ -47,7 +47,7 @@ static int __init configure_uart_pins(int port)return 0 ; } -static void __init configure_uart (char port,int baud) +static void __init configure_uart (int port,int baud) {u32 pbclk;
@@ -60,7 +60,7 @@ static void __init configure_uart(char port, int baud) uart_base + PIC32_SET(U_STA(port))); } -static void __init setup_early_console (char port,int baud) +static void __init setup_early_console (int port,int baud) {if (configure_uart_pins (port))return ;
@@ -130,16 +130,15 @@ static int __init get_baud_from_cmdline(char *arch_cmdline)return baud; } -void __init fw_init_early_console (char port) +void __init fw_init_early_console (void ) {char *arch_cmdline =pic32_getcmdline (); -int baud =-1 ; +int baud, port; uart_base =ioremap (PIC32_BASE_UART ,0xc00 ); baud =get_baud_from_cmdline (arch_cmdline); -if (port ==-1 ) - port =get_port_from_cmdline (arch_cmdline); + port =get_port_from_cmdline (arch_cmdline);if (port ==-1 ) port =EARLY_CONSOLE_PORT ;
arch/mips/pic32/pic32mzda/init.c +1 -1
@@ -47,7 +47,7 @@ void __init plat_mem_setup(void)strlcpy (arcs_cmdline, boot_command_line,COMMAND_LINE_SIZE );#ifdef CONFIG_EARLY_PRINTK -fw_init_early_console (-1 ); +fw_init_early_console ();#endif pic32_config_init (); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 43/289 io_uring/poll: lockdep annote io_poll_req_insert_locked
In reply to Greg Kroah-HartmanFrom: Pavel Begunkov <[email protected]>
[ Upstream commit 5576035f15dfcc6cb1cec236db40c2c0733b0ba4 ]
Add a lockdep annotation in io_poll_req_insert_locked().
--- io_uring/poll.c | 2 ++ 1 file changed, 2 insertions(+)
io_uring/poll.c +2 -0
@@ -116,6 +116,8 @@ static void io_poll_req_insert_locked(struct io_kiocb *req)struct io_hash_table *table = &req->ctx->cancel_table_locked;u32 index =hash_long (req->cqe.user_data, table->hash_bits); +lockdep_assert_held (&req->ctx->uring_lock); +hlist_add_head (&req->hash_node, &table->hbs[index].list); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 44/289 xfrm: fix "disable_policy" on ipv4 early demux
In reply to Greg Kroah-HartmanFrom: Eyal Birger <[email protected]>
[ Upstream commit 3a5913183aa1b14148c723bda030e6102ad73008 ]
The commit in the "Fixes" tag tried to avoid a case where policy check is ignored due to dst caching in next hops.
However, when the traffic is locally consumed, the dst may be cached in a local TCP or UDP socket as part of early demux. In this case the "disable_policy" flag is not checked as ip_route_input_noref() was only called before caching, and thus, packets after the initial packet in a flow will be dropped if not matching policies.
Fix by checking the "disable_policy" flag also when a valid dst is already available.
----
v2: use dev instead of skb->dev
--- net/ipv4/ip_input.c | 5 +++++ 1 file changed, 5 insertions(+)
net/ipv4/ip_input.c +5 -0
@@ -366,6 +366,11 @@ static int ip_rcv_finish_core(struct net *net, struct sock *sk, iph->tos, dev);if (unlikely (err)) goto drop_error; + }else { +struct in_device *in_dev =__in_dev_get_rcu (dev); + +if (in_dev &&IN_DEV_ORCONF (in_dev,NOPOLICY )) +IPCB (skb)->flags |=IPSKB_NOPOLICY ; }#ifdef CONFIG_IP_ROUTE_CLASSID
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 45/289 arm64: dts: rockchip: fix quartz64-a bluetooth configuration
In reply to Greg Kroah-HartmanFrom: Lev Popov <[email protected]>
[ Upstream commit 2dcd7e0c821fe9b663f7d3382b6d2faa8edf2129 ]
For "Quartz64 Model A" add missing RTS line to the UART interface used by bluetooth and swap bluetooth host-wakeup and device-wakeup gpio pins to match the boards physical layout. This changes are necessary to make bluetooth provided by the wireless module work.
Also set max-speed on the bluetooth device as it's not automatically detected.
--- arch/arm64/boot/dts/rockchip/rk3566-quartz64-a.dts | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
arch/arm64/boot/dts/rockchip/rk3566-quartz64-a.dts +4 -3
@@ -740,7 +740,7 @@ &uart0 { &uart1 { pinctrl-names = "default"; - pinctrl-0 = <&uart1m0_xfer &uart1m0_ctsn>; + pinctrl-0 = <&uart1m0_xfer &uart1m0_ctsn &uart1m0_rtsn>; status = "okay"; uart-has-rtscts;
@@ -748,13 +748,14 @@ bluetooth { compatible = "brcm,bcm43438-bt"; clocks = <&rk817 1>; clock-names = "lpo"; - device-wakeup-gpios = <&gpio2 RK_PC1 GPIO_ACTIVE_HIGH>; - host-wakeup-gpios = <&gpio2 RK_PC0 GPIO_ACTIVE_HIGH>; + host-wakeup-gpios = <&gpio2 RK_PC1 GPIO_ACTIVE_HIGH>; + device-wakeup-gpios = <&gpio2 RK_PC0 GPIO_ACTIVE_HIGH>; shutdown-gpios = <&gpio2 RK_PB7 GPIO_ACTIVE_HIGH>; pinctrl-names = "default"; pinctrl-0 = <&bt_host_wake_l &bt_wake_l &bt_enable_h>; vbat-supply = <&vcc_sys>; vddio-supply = <&vcca1v8_pmu>; + max-speed = <3000000>; }; };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 46/289 xfrm: replay: Fix ESN wrap around for GSO
In reply to Greg Kroah-HartmanFrom: Christian Langrock <[email protected]>
[ Upstream commit 4b549ccce941798703f159b227aa28c716aa78fa ]
When using GSO it can happen that the wrong seq_hi is used for the last packets before the wrap around. This can lead to double usage of a sequence number. To avoid this, we should serialize this last GSO packet.
--- net/ipv4/esp4_offload.c | 3 +++ net/ipv6/esp6_offload.c | 3 +++ net/xfrm/xfrm_device.c | 15 ++++++++++++++- net/xfrm/xfrm_replay.c | 2 +- 4 files changed, 21 insertions(+), 2 deletions(-)
net/ipv4/esp4_offload.c +3 -0
@@ -314,6 +314,9 @@ static int esp_xmit(struct xfrm_state *x, struct sk_buff *skb, netdev_features_ xo->seq.low +=skb_shinfo (skb)->gso_segs; } +if (xo->seq.low < seq) + xo->seq.hi++; + esp.seqno =cpu_to_be64 (seq + ((u64 )xo->seq.hi <<32 ));ip_hdr (skb)->tot_len =htons (skb->len);
net/ipv6/esp6_offload.c +3 -0
@@ -346,6 +346,9 @@ static int esp6_xmit(struct xfrm_state *x, struct sk_buff *skb, netdev_features xo->seq.low +=skb_shinfo (skb)->gso_segs; } +if (xo->seq.low < seq) + xo->seq.hi++; + esp.seqno =cpu_to_be64 (xo->seq.low + ((u64 )xo->seq.hi <<32 )); len = skb->len -sizeof (struct ipv6hdr );
net/xfrm/xfrm_device.c +14 -1
@@ -97,6 +97,18 @@ static void xfrm_outer_mode_prep(struct xfrm_state *x, struct sk_buff *skb) } } +static inline bool xmit_xfrm_check_overflow (struct sk_buff *skb) +{ +struct xfrm_offload *xo =xfrm_offload (skb); +__u32 seq = xo->seq.low; + + seq +=skb_shinfo (skb)->gso_segs; +if (unlikely (seq < xo->seq.low)) +return true; + +return false; +} +struct sk_buff *validate_xmit_xfrm (struct sk_buff *skb,netdev_features_t features,bool *again) {int err;
@@ -134,7 +146,8 @@ struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t featurreturn skb; } -if (skb_is_gso (skb) &&unlikely (x->xso.dev != dev)) { +if (skb_is_gso (skb) && (unlikely (x->xso.dev != dev) || +unlikely (xmit_xfrm_check_overflow (skb)))) {struct sk_buff *segs;/* Packet got rerouted, fixup features and segment it. */
net/xfrm/xfrm_replay.c +1 -1
@@ -714,7 +714,7 @@ static int xfrm_replay_overflow_offload_esn(struct xfrm_state *x, struct sk_buff oseq +=skb_shinfo (skb)->gso_segs; } -if (unlikely (oseq < replay_esn->oseq)) { +if (unlikely (xo->seq.low < replay_esn->oseq)) {XFRM_SKB_CB (skb)->seq.output.hi = ++oseq_hi; xo->seq.hi = oseq_hi; replay_esn->oseq_hi = oseq_hi;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 47/289 af_key: Fix send_acquire race with pfkey_register
In reply to Greg Kroah-HartmanFrom: Herbert Xu <[email protected]>
[ Upstream commit 7f57f8165cb6d2c206e2b9ada53b9e2d6d8af42f ]
The function pfkey_send_acquire may race with pfkey_register (which could even be in a different name space). This may result in a buffer overrun.
Allocating the maximum amount of memory that could be used prevents this.
--- net/key/af_key.c | 32 ++++++++++++++++++++++---------- 1 file changed, 22 insertions(+), 10 deletions(-)
net/key/af_key.c +22 -10
@@ -2905,7 +2905,7 @@ static int count_ah_combs(const struct xfrm_tmpl *t)break ;if (!aalg->pfkey_supported)continue ; -if (aalg_tmpl_set (t, aalg) && aalg->available) +if (aalg_tmpl_set (t, aalg)) sz +=sizeof (struct sadb_comb ); }return sz +sizeof (struct sadb_prop );
@@ -2923,7 +2923,7 @@ static int count_esp_combs(const struct xfrm_tmpl *t)if (!ealg->pfkey_supported)continue ; -if (!(ealg_tmpl_set (t, ealg) && ealg->available)) +if (!(ealg_tmpl_set (t, ealg)))continue ;for (k =1 ; ; k++) {
@@ -2934,16 +2934,17 @@ static int count_esp_combs(const struct xfrm_tmpl *t)if (!aalg->pfkey_supported)continue ; -if (aalg_tmpl_set (t, aalg) && aalg->available) +if (aalg_tmpl_set (t, aalg)) sz +=sizeof (struct sadb_comb ); } }return sz +sizeof (struct sadb_prop ); } -static void dump_ah_combs (struct sk_buff *skb,const struct xfrm_tmpl *t) +static int dump_ah_combs (struct sk_buff *skb,const struct xfrm_tmpl *t) {struct sadb_prop *p; +int sz =0 ;int i; p =skb_put (skb,sizeof (struct sadb_prop ));
@@ -2971,13 +2972,17 @@ static void dump_ah_combs(struct sk_buff *skb, const struct xfrm_tmpl *t) c->sadb_comb_soft_addtime =20 *60 *60 ; c->sadb_comb_hard_usetime =8 *60 *60 ; c->sadb_comb_soft_usetime =7 *60 *60 ; + sz +=sizeof (*c); } } + +return sz +sizeof (*p); } -static void dump_esp_combs (struct sk_buff *skb,const struct xfrm_tmpl *t) +static int dump_esp_combs (struct sk_buff *skb,const struct xfrm_tmpl *t) {struct sadb_prop *p; +int sz =0 ;int i, k; p =skb_put (skb,sizeof (struct sadb_prop ));
@@ -3019,8 +3024,11 @@ static void dump_esp_combs(struct sk_buff *skb, const struct xfrm_tmpl *t) c->sadb_comb_soft_addtime =20 *60 *60 ; c->sadb_comb_hard_usetime =8 *60 *60 ; c->sadb_comb_soft_usetime =7 *60 *60 ; + sz +=sizeof (*c); } } + +return sz +sizeof (*p); }static int key_notify_policy_expire (struct xfrm_policy *xp,const struct km_event *c)
@@ -3150,6 +3158,7 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, structstruct sadb_x_sec_ctx *sec_ctx;struct xfrm_sec_ctx *xfrm_ctx;int ctx_size =0 ; +int alg_size =0 ; sockaddr_size =pfkey_sockaddr_size (x->props.family);if (!sockaddr_size)
@@ -3161,16 +3170,16 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, structsizeof (struct sadb_x_policy );if (x->id.proto ==IPPROTO_AH ) - size +=count_ah_combs (t); + alg_size =count_ah_combs (t);else if (x->id.proto ==IPPROTO_ESP ) - size +=count_esp_combs (t); + alg_size =count_esp_combs (t);if ((xfrm_ctx = x->security)) { ctx_size =PFKEY_ALIGN8 (xfrm_ctx->ctx_len); size +=sizeof (struct sadb_x_sec_ctx ) + ctx_size; } - skb =alloc_skb (size +16 ,GFP_ATOMIC ); + skb =alloc_skb (size + alg_size +16 ,GFP_ATOMIC );if (skb ==NULL )return -ENOMEM ;
@@ -3224,10 +3233,13 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct pol->sadb_x_policy_priority = xp->priority;/* Set sadb_comb's. */ + alg_size =0 ;if (x->id.proto ==IPPROTO_AH ) -dump_ah_combs (skb, t); + alg_size =dump_ah_combs (skb, t);else if (x->id.proto ==IPPROTO_ESP ) -dump_esp_combs (skb, t); + alg_size =dump_esp_combs (skb, t); + + hdr->sadb_msg_len += alg_size /8 ;/* security context */ if (xfrm_ctx) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 48/289 power: supply: ip5xxx: Fix integer overflow in current_now calculation
In reply to Greg Kroah-HartmanFrom: Ondrej Jirman <[email protected]>
[ Upstream commit f9be5cb6c1f0191f8bcf4413b7e17e58e8dfaaa1 ]
When current is larger than ~2A, the multiplication in current_now property overflows and the kernel reports invalid negative current value. Change the numerator and denominator while preserving their ratio to allow up to +-6A before the overflow.
--- drivers/power/supply/ip5xxx_power.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/power/supply/ip5xxx_power.c +1 -1
@@ -352,7 +352,7 @@ static int ip5xxx_battery_get_property(struct power_supply *psy, ret =ip5xxx_battery_read_adc (ip5xxx,IP5XXX_BATIADC_DAT0 ,IP5XXX_BATIADC_DAT1 , &raw); - val->intval =DIV_ROUND_CLOSEST (raw *745985 ,1000 ); + val->intval =DIV_ROUND_CLOSEST (raw *149197 ,200 );return 0 ;case POWER_SUPPLY_PROP_CONSTANT_CHARGE_CURRENT :
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 49/289 power: supply: ab8500: Defer thermal zone probe
In reply to Greg Kroah-HartmanFrom: Linus Walleij <[email protected]>
[ Upstream commit 767e684367e4759d9855b184045b7a9d6b19acd2 ]
The call thermal_zone_get_zone_by_name() used to return the thermal zone right away, but recent refactorings in the thermal core has changed this so the thermal zone used by the battery is probed later, and the call returns -ENODEV.
This was always quite fragile. If we get -ENODEV, then return a -EPROBE_DEFER and try again later.
--- drivers/power/supply/ab8500_btemp.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/power/supply/ab8500_btemp.c +8 -1
@@ -725,7 +725,14 @@ static int ab8500_btemp_probe(struct platform_device *pdev)/* Get thermal zone and ADC */ di->tz =thermal_zone_get_zone_by_name ("battery-thermal" );if (IS_ERR (di->tz)) { -return dev_err_probe (dev,PTR_ERR (di->tz), + ret =PTR_ERR (di->tz); +/* +* This usually just means we are probing before the thermal +* zone, so just defer. +*/ +if (ret == -ENODEV ) + ret = -EPROBE_DEFER ; +return dev_err_probe (dev, ret,"failed to get battery thermal zone\n" ); } di->bat_ctrl =devm_iio_channel_get (dev,"bat_ctrl" );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 50/289 ARM: dts: am335x-pcm-953: Define fixed regulators in root node
In reply to Greg Kroah-HartmanFrom: Dominik Haller <[email protected]>
[ Upstream commit 8950f345a67d8046d2472dd6ea81fa18ef5b4844 ]
Remove the regulators node and define fixed regulators in the root node. Prevents the sdhci-omap driver from waiting in probe deferral forever because of the missing vmmc-supply and keeps am335x-pcm-953 consistent with the other Phytec AM335 boards.
Message-Id: <[email protected]>
--- arch/arm/boot/dts/am335x-pcm-953.dtsi | 28 +++++++++++++-------------- 1 file changed, 13 insertions(+), 15 deletions(-)
arch/arm/boot/dts/am335x-pcm-953.dtsi +13 -15
@@ -12,22 +12,20 @@ / { compatible = "phytec,am335x-pcm-953", "phytec,am335x-phycore-som", "ti,am33xx"; /* Power */ - regulators { - vcc3v3: fixedregulator@1 { - compatible = "regulator-fixed"; - regulator-name = "vcc3v3"; - regulator-min-microvolt = <3300000>; - regulator-max-microvolt = <3300000>; - regulator-boot-on; - }; + vcc3v3: fixedregulator1 { + compatible = "regulator-fixed"; + regulator-name = "vcc3v3"; + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; + regulator-boot-on; + }; - vcc1v8: fixedregulator@2 { - compatible = "regulator-fixed"; - regulator-name = "vcc1v8"; - regulator-min-microvolt = <1800000>; - regulator-max-microvolt = <1800000>; - regulator-boot-on; - }; + vcc1v8: fixedregulator2 { + compatible = "regulator-fixed"; + regulator-name = "vcc1v8"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; + regulator-boot-on; }; /* User IO */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 51/289 ASoC: Intel: Skylake: Introduce HDA codec init and exit routines
In reply to Greg Kroah-HartmanFrom: Cezary Rojewski <[email protected]>
[ Upstream commit e4746d94d00c52918461bc169e009b6784a38e21 ]
Preliminary step in making snd_hda_codec_device_init() the only constructor for struct hda_codec instances. To do that, existing usage of hdac_ext equivalents has to be dropped.
Stable-dep-of: 37882100cd06 ("ASoC: hdac_hda: fix hda pcm buffer overflow issue")
--- sound/soc/intel/skylake/skl.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+)
sound/soc/intel/skylake/skl.c +29 -0
@@ -689,6 +689,35 @@ static void load_codec_module(struct hda_codec *codec)#endif /* CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC */ +static void skl_codec_device_exit (struct device *dev) +{ +snd_hdac_device_exit (dev_to_hdac_dev (dev)); +} + +static __maybe_unused struct hda_codec *skl_codec_device_init (struct hdac_bus *bus,int addr) +{ +struct hda_codec *codec; +int ret; + + codec =snd_hda_codec_device_init (to_hda_bus (bus), addr,"ehdaudio%dD%d" , bus->idx, addr); +if (IS_ERR (codec)) { +dev_err (bus->dev,"device init failed for hdac device\n" ); +return codec; + } + + codec->core.type =HDA_DEV_ASOC ; + codec->core.dev.release = skl_codec_device_exit; + + ret =snd_hdac_device_register (&codec->core); +if (ret) { +dev_err (bus->dev,"failed to register hdac device\n" ); +snd_hdac_device_exit (&codec->core); +return ERR_PTR (ret); + } + +return codec; +} +/* * Probe the given codec address */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 52/289 ASoC: SOF: Intel: Introduce HDA codec init and exit routines
In reply to Greg Kroah-HartmanFrom: Cezary Rojewski <[email protected]>
[ Upstream commit 829c67319806009abfe3b0b82b3b8b153a2c5e32 ]
Preliminary step in making snd_hda_codec_device_init() the only constructor for struct hda_codec instances. To do that, existing usage of hdac_ext equivalents has to be dropped.
Stable-dep-of: 37882100cd06 ("ASoC: hdac_hda: fix hda pcm buffer overflow issue")
--- sound/soc/sof/intel/hda-codec.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+)
sound/soc/sof/intel/hda-codec.c +30 -0
@@ -109,6 +109,36 @@ EXPORT_SYMBOL_NS(hda_codec_jack_check, SND_SOC_SOF_HDA_AUDIO_CODEC);#define is_generic_config (x) 0#endif +static void hda_codec_device_exit (struct device *dev) +{ +snd_hdac_device_exit (dev_to_hdac_dev (dev)); +} + +static __maybe_unused struct hda_codec * +hda_codec_device_init (struct hdac_bus *bus,int addr,int type) +{ +struct hda_codec *codec; +int ret; + + codec =snd_hda_codec_device_init (to_hda_bus (bus), addr,"ehdaudio%dD%d" , bus->idx, addr); +if (IS_ERR (codec)) { +dev_err (bus->dev,"device init failed for hdac device\n" ); +return codec; + } + + codec->core.type = type; + codec->core.dev.release = hda_codec_device_exit; + + ret =snd_hdac_device_register (&codec->core); +if (ret) { +dev_err (bus->dev,"failed to register hdac device\n" ); +snd_hdac_device_exit (&codec->core); +return ERR_PTR (ret); + } + +return codec; +} +/* probe individual codec */ static int hda_codec_probe (struct snd_sof_dev *sdev,int address,bool hda_codec_use_common_hdmi)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 53/289 ASoC: Intel: Drop hdac_ext usage for codec device creation
In reply to Greg Kroah-HartmanFrom: Cezary Rojewski <[email protected]>
[ Upstream commit 3fd63658caed9494cca1d4789a66d3d2def2a0ab ]
To make snd_hda_codec_device_init() the only constructor for struct hda_codec instances remaining tasks are:
1) no struct may wrap struct hda_codec as its base type
2) bus drivers (skylake and sof) which are the current hdac_ext users need to be adjusted to make use of newly added codec init and exit routines instead
3) as bus drivers (skylake and sof) are to be responsible for creating codec device and assigning it to hdac_hda_priv->codec, hdac_hda_dev_probe() has to be freed of that job
To keep git bisect happy, all of these in made in one-go.
Stable-dep-of: 37882100cd06 ("ASoC: hdac_hda: fix hda pcm buffer overflow issue")
--- sound/soc/codecs/hdac_hda.c | 26 +++++++----------- sound/soc/codecs/hdac_hda.h | 2 +- sound/soc/intel/boards/hda_dsp_common.c | 2 +- sound/soc/intel/boards/skl_hda_dsp_generic.c | 2 +- sound/soc/intel/skylake/skl.c | 26 ++++++++---------- sound/soc/sof/intel/hda-codec.c | 29 ++++++++------------ 6 files changed, 36 insertions(+), 51 deletions(-)
sound/soc/codecs/hdac_hda.c +10 -16
@@ -246,7 +246,7 @@ static int hdac_hda_dai_hw_free(struct snd_pcm_substream *substream,return -EINVAL ; hda_stream = &pcm->stream[substream->stream]; -snd_hda_codec_cleanup (&hda_pvt->codec, hda_stream, substream); +snd_hda_codec_cleanup (hda_pvt->codec, hda_stream, substream);return 0 ; }
@@ -264,7 +264,7 @@ static int hdac_hda_dai_prepare(struct snd_pcm_substream *substream,int ret =0 ; hda_pvt =snd_soc_component_get_drvdata (component); - hdev = &hda_pvt->codec.core; + hdev = &hda_pvt->codec->core; pcm =snd_soc_find_pcm_from_dai (hda_pvt, dai);if (!pcm)return -EINVAL ;
@@ -274,7 +274,7 @@ static int hdac_hda_dai_prepare(struct snd_pcm_substream *substream, stream = hda_pvt->pcm[dai->id].stream_tag[substream->stream]; format_val = hda_pvt->pcm[dai->id].format_val[substream->stream]; - ret =snd_hda_codec_prepare (&hda_pvt->codec, hda_stream, + ret =snd_hda_codec_prepare (hda_pvt->codec, hda_stream, stream, format_val, substream);if (ret <0 )dev_err (&hdev->dev,"codec prepare failed %d\n" , ret);
@@ -299,7 +299,7 @@ static int hdac_hda_dai_open(struct snd_pcm_substream *substream, hda_stream = &pcm->stream[substream->stream]; -return hda_stream->ops.open (hda_stream, &hda_pvt->codec, substream); +return hda_stream->ops.open (hda_stream, hda_pvt->codec, substream); } static void hdac_hda_dai_close(struct snd_pcm_substream *substream,
@@ -317,7 +317,7 @@ static void hdac_hda_dai_close(struct snd_pcm_substream *substream, hda_stream = &pcm->stream[substream->stream]; - hda_stream->ops.close (hda_stream, &hda_pvt->codec, substream); + hda_stream->ops.close (hda_stream, hda_pvt->codec, substream);snd_hda_codec_pcm_put (pcm); }
@@ -325,7 +325,7 @@ static void hdac_hda_dai_close(struct snd_pcm_substream *substream,static struct hda_pcm *snd_soc_find_pcm_from_dai (struct hdac_hda_priv *hda_pvt,struct snd_soc_dai *dai) { -struct hda_codec *hcodec = &hda_pvt->codec; +struct hda_codec *hcodec = hda_pvt->codec;struct hda_pcm *cpcm;const char *pcm_name;
@@ -394,8 +394,8 @@ static int hdac_hda_codec_probe(struct snd_soc_component *component)snd_soc_component_get_drvdata (component);struct snd_soc_dapm_context *dapm =snd_soc_component_get_dapm (component); -struct hdac_device *hdev = &hda_pvt->codec.core; -struct hda_codec *hcodec = &hda_pvt->codec; +struct hdac_device *hdev = &hda_pvt->codec->core; +struct hda_codec *hcodec = hda_pvt->codec;struct hdac_ext_link *hlink;hda_codec_patch_t patch;int ret;
@@ -515,8 +515,8 @@ static void hdac_hda_codec_remove(struct snd_soc_component *component) {struct hdac_hda_priv *hda_pvt =snd_soc_component_get_drvdata (component); -struct hdac_device *hdev = &hda_pvt->codec.core; -struct hda_codec *codec = &hda_pvt->codec; +struct hdac_device *hdev = &hda_pvt->codec->core; +struct hda_codec *codec = hda_pvt->codec;struct hdac_ext_link *hlink =NULL ; hlink =snd_hdac_ext_bus_get_link (hdev->bus,dev_name (&hdev->dev));
@@ -584,7 +584,6 @@ static const struct snd_soc_component_driver hdac_hda_codec = {static int hdac_hda_dev_probe (struct hdac_device *hdev) {struct hdac_ext_link *hlink; -struct hdac_hda_priv *hda_pvt;int ret;/* hold the ref while we probe */
@@ -595,10 +594,6 @@ static int hdac_hda_dev_probe(struct hdac_device *hdev) }snd_hdac_ext_bus_link_get (hdev->bus, hlink); - hda_pvt =hdac_to_hda_priv (hdev); -if (!hda_pvt) -return -ENOMEM ; -/* ASoC specific initialization */ ret = devm_snd_soc_register_component(&hdev->dev, &hdac_hda_codec, hdac_hda_dais,
@@ -608,7 +603,6 @@ static int hdac_hda_dev_probe(struct hdac_device *hdev)return ret; } -dev_set_drvdata (&hdev->dev, hda_pvt);snd_hdac_ext_bus_link_put (hdev->bus, hlink);return ret;
sound/soc/codecs/hdac_hda.h +1 -1
@@ -23,7 +23,7 @@ struct hdac_hda_pcm { };struct hdac_hda_priv { -struct hda_codec codec; +struct hda_codec *codec;struct hdac_hda_pcm pcm[HDAC_LAST_DAI_ID ];bool need_display_power; };
sound/soc/intel/boards/hda_dsp_common.c +1 -1
@@ -54,7 +54,7 @@ int hda_dsp_hdmi_build_controls(struct snd_soc_card *card,return -EINVAL ; hda_pvt =snd_soc_component_get_drvdata (comp); - hcodec = &hda_pvt->codec; + hcodec = hda_pvt->codec;list_for_each_entry (hpcm, &hcodec->pcm_list_head, list) { spcm =hda_dsp_hdmi_pcm_handle (card, i);
sound/soc/intel/boards/skl_hda_dsp_generic.c +1 -1
@@ -190,7 +190,7 @@ static void skl_set_hda_codec_autosuspend_delay(struct snd_soc_card *card)* all codecs are on the same bus, so it's sufficient * to look up only the first one */ -snd_hda_set_power_save (hda_pvt->codec.bus, +snd_hda_set_power_save (hda_pvt->codec->bus,HDA_CODEC_AUTOSUSPEND_DELAY_MS );break ; }
sound/soc/intel/skylake/skl.c +11 -15
@@ -694,7 +694,7 @@ static void skl_codec_device_exit(struct device *dev)snd_hdac_device_exit (dev_to_hdac_dev (dev)); } -static __maybe_unused struct hda_codec *skl_codec_device_init (struct hdac_bus *bus,int addr) +static struct hda_codec *skl_codec_device_init (struct hdac_bus *bus,int addr) {struct hda_codec *codec;int ret;
@@ -729,9 +729,8 @@ static int probe_codec(struct hdac_bus *bus, int addr)struct skl_dev *skl =bus_to_skl (bus);#if IS_ENABLED (CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC )struct hdac_hda_priv *hda_codec; -int err;#endif -struct hdac_device *hdev; +struct hda_codec *codec;mutex_lock (&bus->cmd_mutex);snd_hdac_bus_send_cmd (bus, cmd);
@@ -747,25 +746,22 @@ static int probe_codec(struct hdac_bus *bus, int addr)if (!hda_codec)return -ENOMEM ; - hda_codec->codec.bus =skl_to_hbus (skl); - hdev = &hda_codec->codec.core; + codec =skl_codec_device_init (bus, addr); +if (IS_ERR (codec)) +return PTR_ERR (codec); - err =snd_hdac_ext_bus_device_init (bus, addr, hdev,HDA_DEV_ASOC ); -if (err <0 ) -return err; + hda_codec->codec = codec; +dev_set_drvdata (&codec->core.dev, hda_codec);/* use legacy bus only for HDA codecs, idisp uses ext bus */ if ((res &0xFFFF0000 ) !=IDISP_INTEL_VENDOR_ID ) { - hdev->type =HDA_DEV_LEGACY ; -load_codec_module (&hda_codec->codec); + codec->core.type =HDA_DEV_LEGACY ; +load_codec_module (hda_codec->codec); }return 0 ;#else - hdev =devm_kzalloc (&skl->pci->dev,sizeof (*hdev),GFP_KERNEL ); -if (!hdev) -return -ENOMEM ; - -return snd_hdac_ext_bus_device_init (bus, addr, hdev,HDA_DEV_ASOC ); + codec =skl_codec_device_init (bus, addr); +return PTR_ERR_OR_ZERO (codec);#endif /* CONFIG_SND_SOC_INTEL_SKYLAKE_HDAUDIO_CODEC */ }
sound/soc/sof/intel/hda-codec.c +12 -17
@@ -114,8 +114,7 @@ static void hda_codec_device_exit(struct device *dev)snd_hdac_device_exit (dev_to_hdac_dev (dev)); } -static __maybe_unused struct hda_codec * -hda_codec_device_init (struct hdac_bus *bus,int addr,int type) +static struct hda_codec *hda_codec_device_init (struct hdac_bus *bus,int addr,int type) {struct hda_codec *codec;int ret;
@@ -145,11 +144,10 @@ static int hda_codec_probe(struct snd_sof_dev *sdev, int address, {#if IS_ENABLED (CONFIG_SND_SOC_SOF_HDA_AUDIO_CODEC )struct hdac_hda_priv *hda_priv; -struct hda_codec *codec;int type =HDA_DEV_LEGACY ;#endif struct hda_bus *hbus =sof_to_hbus (sdev); -struct hdac_device *hdev; +struct hda_codec *codec;u32 hda_cmd = (address <<28 ) | (AC_NODE_ROOT <<20 ) | (AC_VERB_PARAMETERS <<8 ) |AC_PAR_VENDOR_ID ;u32 resp =-1 ;
@@ -172,20 +170,20 @@ static int hda_codec_probe(struct snd_sof_dev *sdev, int address,if (!hda_priv)return -ENOMEM ; - hda_priv->codec.bus = hbus; - hdev = &hda_priv->codec.core; - codec = &hda_priv->codec; -/* only probe ASoC codec drivers for HDAC-HDMI */ if (!hda_codec_use_common_hdmi && (resp &0xFFFF0000 ) ==IDISP_VID_INTEL ) type =HDA_DEV_ASOC ; - ret =snd_hdac_ext_bus_device_init (&hbus->core, address, hdev, type); + codec =hda_codec_device_init (&hbus->core, address, type); + ret =PTR_ERR_OR_ZERO (codec);if (ret <0 )return ret; + hda_priv->codec = codec; +dev_set_drvdata (&codec->core.dev, hda_priv); +if ((resp &0xFFFF0000 ) ==IDISP_VID_INTEL ) { -if (!hdev->bus->audio_component) { +if (!hbus->core.audio_component) {dev_dbg (sdev->dev,"iDisp hw present but no driver\n" ); ret = -ENOENT ;
@@ -211,15 +209,12 @@ static int hda_codec_probe(struct snd_sof_dev *sdev, int address, out:if (ret <0 ) { -snd_hdac_device_unregister (hdev); -put_device (&hdev->dev); +snd_hdac_device_unregister (&codec->core); +put_device (&codec->core.dev); }#else - hdev =devm_kzalloc (sdev->dev,sizeof (*hdev),GFP_KERNEL ); -if (!hdev) -return -ENOMEM ; - - ret =snd_hdac_ext_bus_device_init (&hbus->core, address, hdev,HDA_DEV_ASOC ); + codec =hda_codec_device_init (&hbus->core, address); + ret =PTR_ERR_OR_ZERO (codec);#endif return ret;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 54/289 ASoC: hdac_hda: fix hda pcm buffer overflow issue
In reply to Greg Kroah-HartmanFrom: Junxiao Chang <[email protected]>
[ Upstream commit 37882100cd0629d830db430a8cee0b724fe1fea3 ]
When KASAN is enabled, below log might be dumped with Intel EHL hardware:
[ 48.583597] ================================================================== [ 48.585921] BUG: KASAN: slab-out-of-bounds in hdac_hda_dai_hw_params+0x20a/0x22b [snd_soc_hdac_hda] [ 48.587995] Write of size 4 at addr ffff888103489708 by task pulseaudio/759
[ 48.589237] CPU: 2 PID: 759 Comm: pulseaudio Tainted: G U E 5.15.71-intel-ese-standard-lts #9 [ 48.591272] Hardware name: Intel Corporation Elkhart Lake Embedded Platform/ElkhartLake LPDDR4x T3 CRB, BIOS EHLSFWI1.R00.4251.A01.2206130432 06/13/2022 [ 48.593010] Call Trace: [ 48.593648] <TASK> [ 48.593852] dump_stack_lvl+0x34/0x48 [ 48.594404] print_address_description.constprop.0+0x1f/0x140 [ 48.595174] ? hdac_hda_dai_hw_params+0x20a/0x22b [snd_soc_hdac_hda] [ 48.595868] ? hdac_hda_dai_hw_params+0x20a/0x22b [snd_soc_hdac_hda] [ 48.596519] kasan_report.cold+0x7f/0x11b [ 48.597003] ? hdac_hda_dai_hw_params+0x20a/0x22b [snd_soc_hdac_hda] [ 48.597885] hdac_hda_dai_hw_params+0x20a/0x22b [snd_soc_hdac_hda]
HDAC_LAST_DAI_ID is last index id, pcm buffer array size should be +1 to avoid out of bound access.
--- sound/soc/codecs/hdac_hda.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/codecs/hdac_hda.h +2 -2
@@ -14,7 +14,7 @@ enum {HDAC_HDMI_1_DAI_ID ,HDAC_HDMI_2_DAI_ID ,HDAC_HDMI_3_DAI_ID , - HDAC_LAST_DAI_ID = HDAC_HDMI_3_DAI_ID, +HDAC_DAI_ID_NUM }; struct hdac_hda_pcm {
@@ -24,7 +24,7 @@ struct hdac_hda_pcm {struct hdac_hda_priv {struct hda_codec *codec; -struct hdac_hda_pcm pcm[HDAC_LAST_DAI_ID ]; +struct hdac_hda_pcm pcm[HDAC_DAI_ID_NUM ];bool need_display_power; };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 55/289 ASoC: sgtl5000: Reset the CHIP_CLK_CTRL reg on remove
In reply to Greg Kroah-HartmanFrom: Detlev Casanova <[email protected]>
[ Upstream commit 0bb8e9b36b5b7f2e77892981ff6c27ee831d8026 ]
Since commit bf2aebccddef ("ASoC: sgtl5000: Fix noise on shutdown/remove"), the device power control registers are reset when the driver is removed/shutdown.
This is an issue when the device is configured to use the PLL clock. The device will stop responding if it is still configured to use the PLL clock but the PLL clock is powered down.
When rebooting linux, the probe function will show:
sgtl5000 0-000a: Error reading chip id -11
Make sure that the CHIP_CLK_CTRL is reset to its default value before powering down the device.
--- sound/soc/codecs/sgtl5000.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/codecs/sgtl5000.c +1 -0
@@ -1794,6 +1794,7 @@ static int sgtl5000_i2c_remove(struct i2c_client *client) {struct sgtl5000_priv *sgtl5000 =i2c_get_clientdata (client); +regmap_write (sgtl5000->regmap,SGTL5000_CHIP_CLK_CTRL ,SGTL5000_CHIP_CLK_CTRL_DEFAULT );regmap_write (sgtl5000->regmap,SGTL5000_CHIP_DIG_POWER ,SGTL5000_DIG_POWER_DEFAULT );regmap_write (sgtl5000->regmap,SGTL5000_CHIP_ANA_POWER ,SGTL5000_ANA_POWER_DEFAULT );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 56/289 ASoC: soc-pcm: Dont zero TDM masks in __soc_pcm_open()
In reply to Greg Kroah-HartmanFrom: Richard Fitzgerald <[email protected]>
[ Upstream commit 39bd801d6908900e9ab0cdc2655150f95ddd4f1a ]
The DAI tx_mask and rx_mask are set by snd_soc_dai_set_tdm_slot() and used by later code that depends on the TDM settings. So __soc_pcm_open() should not be obliterating those mask values.
The code in __soc_pcm_hw_params() uses these masks to calculate the active channels so that only the AIF_IN/AIF_OUT widgets for the active TDM slots are enabled. The zeroing of the masks in __soc_pcm_open() disables this functionality so all AIF widgets were enabled even for channels that are not assigned to a TDM slot.
--- sound/soc/soc-pcm.c | 5 ----- 1 file changed, 5 deletions(-)
sound/soc/soc-pcm.c +0 -5
@@ -800,11 +800,6 @@ static int __soc_pcm_open(struct snd_soc_pcm_runtime *rtd, ret =snd_soc_dai_startup (dai, substream);if (ret <0 ) goto err; - -if (substream->stream ==SNDRV_PCM_STREAM_PLAYBACK ) - dai->tx_mask =0 ; -else - dai->rx_mask =0 ; }/* Dynamic PCM DAI links compat checks use dynamic capabilities */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 57/289 x86/hyperv: Restore VP assist page after cpu offlining/onlining
In reply to Greg Kroah-HartmanFrom: Vitaly Kuznetsov <[email protected]>
[ Upstream commit ee6815416380bc069b7dcbdff0682d4c53617527 ]
Commit e5d9b714fe40 ("x86/hyperv: fix root partition faults when writing to VP assist page MSR") moved 'wrmsrl(HV_X64_MSR_VP_ASSIST_PAGE)' under 'if (*hvp)' condition. This works for root partition as hv_cpu_die() does memunmap() and sets 'hv_vp_assist_page[cpu]' to NULL but breaks non-root partitions as hv_cpu_die() doesn't free 'hv_vp_assist_page[cpu]' for them. This causes VP assist page to remain unset after CPU offline/online cycle:
$ rdmsr -p 24 0x40000073 10212f001 $ echo 0 > /sys/devices/system/cpu/cpu24/online $ echo 1 > /sys/devices/system/cpu/cpu24/online $ rdmsr -p 24 0x40000073 0
Fix the issue by always writing to HV_X64_MSR_VP_ASSIST_PAGE in hv_cpu_init(). Note, checking 'if (!*hvp)', for root partition is pointless as hv_cpu_die() always sets 'hv_vp_assist_page[cpu]' to NULL (and it's also NULL initially).
Note: the fact that 'hv_vp_assist_page[cpu]' is reset to NULL may present a (potential) issue for KVM. While Hyper-V uses CPUHP_AP_ONLINE_DYN stage in CPU hotplug, KVM uses CPUHP_AP_KVM_STARTING which comes earlier in CPU teardown sequence. It is theoretically possible that Enlightened VMCS is still in use. It is unclear if the issue is real and if using KVM with Hyper-V root partition is even possible.
While on it, drop the unneeded smp_processor_id() call from hv_cpu_init().
--- arch/x86/hyperv/hv_init.c | 54 +++++++++++++++++++-------------------- 1 file changed, 26 insertions(+), 28 deletions(-)
arch/x86/hyperv/hv_init.c +26 -28
@@ -77,7 +77,7 @@ static int hyperv_init_ghcb(void)static int hv_cpu_init (unsigned int cpu) {union hv_vp_assist_msr_contents msr = {0 }; -struct hv_vp_assist_page **hvp = &hv_vp_assist_page[smp_processor_id ()]; +struct hv_vp_assist_page **hvp = &hv_vp_assist_page[cpu];int ret; ret =hv_common_cpu_init (cpu);
@@ -87,34 +87,32 @@ static int hv_cpu_init(unsigned int cpu)if (!hv_vp_assist_page)return 0 ; -if (!*hvp) { -if (hv_root_partition) { -/* -* For root partition we get the hypervisor provided VP assist -* page, instead of allocating a new page. -*/ -rdmsrl (HV_X64_MSR_VP_ASSIST_PAGE , msr.as_uint64); - *hvp =memremap (msr.pfn << -HV_X64_MSR_VP_ASSIST_PAGE_ADDRESS_SHIFT , -PAGE_SIZE ,MEMREMAP_WB ); - }else { -/* -* The VP assist page is an "overlay" page (see Hyper-V TLFS's -* Section 5.2.1 "GPA Overlay Pages"). Here it must be zeroed -* out to make sure we always write the EOI MSR in -* hv_apic_eoi_write() *after* the EOI optimization is disabled -* in hv_cpu_die(), otherwise a CPU may not be stopped in the -* case of CPU offlining and the VM will hang. -*/ +if (hv_root_partition) { +/* +* For root partition we get the hypervisor provided VP assist +* page, instead of allocating a new page. +*/ +rdmsrl (HV_X64_MSR_VP_ASSIST_PAGE , msr.as_uint64); + *hvp =memremap (msr.pfn <<HV_X64_MSR_VP_ASSIST_PAGE_ADDRESS_SHIFT , +PAGE_SIZE ,MEMREMAP_WB ); + }else { +/* +* The VP assist page is an "overlay" page (see Hyper-V TLFS's +* Section 5.2.1 "GPA Overlay Pages"). Here it must be zeroed +* out to make sure we always write the EOI MSR in +* hv_apic_eoi_write() *after* the EOI optimization is disabled +* in hv_cpu_die(), otherwise a CPU may not be stopped in the +* case of CPU offlining and the VM will hang. +*/ +if (!*hvp) *hvp =__vmalloc (PAGE_SIZE ,GFP_KERNEL | __GFP_ZERO); -if (*hvp) - msr.pfn =vmalloc_to_pfn (*hvp); - } -WARN_ON (!(*hvp)); -if (*hvp) { - msr.enable =1 ; -wrmsrl (HV_X64_MSR_VP_ASSIST_PAGE , msr.as_uint64); - } +if (*hvp) + msr.pfn =vmalloc_to_pfn (*hvp); + + } +if (!WARN_ON (!(*hvp))) { + msr.enable =1 ; +wrmsrl (HV_X64_MSR_VP_ASSIST_PAGE , msr.as_uint64); }return hyperv_init_ghcb ();
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 58/289 scsi: storvsc: Fix handling of srb_status and capacity change events
In reply to Greg Kroah-HartmanFrom: Michael Kelley <[email protected]>
[ Upstream commit b8a5376c321b4669f7ffabc708fd30c3970f3084 ]
Current handling of the srb_status is incorrect. Commit 52e1b3b3daa9 ("scsi: storvsc: Correctly handle multiple flags in srb_status") is based on srb_status being a set of flags, when in fact only the 2 high order bits are flags and the remaining 6 bits are an integer status. Because the integer values of interest mostly look like flags, the code actually works when treated that way.
But in the interest of correctness going forward, fix this by treating the low 6 bits of srb_status as an integer status code. Add handling for SRB_STATUS_INVALID_REQUEST, which was the original intent of commit 52e1b3b3daa9. Furthermore, treat the ERROR, ABORTED, and INVALID_REQUEST srb status codes as essentially equivalent for the cases we care about. There's no harm in doing so, and it isn't always clear which status code current or older versions of Hyper-V report for particular conditions.
Treating the srb status codes as equivalent has the additional benefit of ensuring that capacity change events result in an immediate rescan so that the new size is known to Linux. Existing code checks SCSI sense data for capacity change events when the srb status is ABORTED. But capacity change events are also being observed when Hyper-V reports the srb status as ERROR. Without the immediate rescan, the new size isn't known until something else causes a rescan (such as running fdisk to expand a partition), and in the meantime, tools such as "lsblk" continue to report the old size.
--- drivers/scsi/storvsc_drv.c | 69 +++++++++++++++++++------------------- 1 file changed, 34 insertions(+), 35 deletions(-)
drivers/scsi/storvsc_drv.c +34 -35
@@ -300,16 +300,21 @@ enum storvsc_request_type { };/* -* SRB status codes and masks; a subset of the codes used here. +* SRB status codes and masks. In the 8-bit field, the two high order bits +* are flags, while the remaining 6 bits are an integer status code. The +* definitions here include only the subset of the integer status codes that +* are tested for in this driver. */ -#define SRB_STATUS_AUTOSENSE_VALID 0x80#define SRB_STATUS_QUEUE_FROZEN 0x40 -#define SRB_STATUS_INVALID_LUN 0x20 -#define SRB_STATUS_SUCCESS 0x01 -#define SRB_STATUS_ABORTED 0x02 -#define SRB_STATUS_ERROR 0x04 -#define SRB_STATUS_DATA_OVERRUN 0x12 + +/* SRB status integer codes */ +#define SRB_STATUS_SUCCESS 0x01 +#define SRB_STATUS_ABORTED 0x02 +#define SRB_STATUS_ERROR 0x04 +#define SRB_STATUS_INVALID_REQUEST 0x06 +#define SRB_STATUS_DATA_OVERRUN 0x12 +#define SRB_STATUS_INVALID_LUN 0x20#define SRB_STATUS (status) \ (status & ~(SRB_STATUS_AUTOSENSE_VALID | SRB_STATUS_QUEUE_FROZEN))
@@ -966,38 +971,25 @@ static void storvsc_handle_error(struct vmscsi_request *vm_srb,void (*process_err_fn)(struct work_struct *work);struct hv_host_device *host_dev =shost_priv (host); -/* -* In some situations, Hyper-V sets multiple bits in the -* srb_status, such as ABORTED and ERROR. So process them -* individually, with the most specific bits first. -*/ - -if (vm_srb->srb_status &SRB_STATUS_INVALID_LUN ) { -set_host_byte (scmnd,DID_NO_CONNECT ); - process_err_fn = storvsc_remove_lun; - goto do_work; - } +switch (SRB_STATUS (vm_srb->srb_status)) { +case SRB_STATUS_ERROR : +case SRB_STATUS_ABORTED : +case SRB_STATUS_INVALID_REQUEST : +if (vm_srb->srb_status &SRB_STATUS_AUTOSENSE_VALID ) { +/* Check for capacity change */ +if ((asc ==0x2a ) && (ascq ==0x9 )) { + process_err_fn = storvsc_device_scan; +/* Retry the I/O that triggered this. */ +set_host_byte (scmnd,DID_REQUEUE ); + goto do_work; + } -if (vm_srb->srb_status &SRB_STATUS_ABORTED ) { -if (vm_srb->srb_status &SRB_STATUS_AUTOSENSE_VALID && -/* Capacity data has changed */ - (asc ==0x2a ) && (ascq ==0x9 )) { - process_err_fn = storvsc_device_scan;/* -* Retry the I/O that triggered this. +* Otherwise, let upper layer deal with the +* error when sense message is present */ -set_host_byte (scmnd,DID_REQUEUE ); - goto do_work; - } - } - -if (vm_srb->srb_status &SRB_STATUS_ERROR ) { -/* -* Let upper layer deal with error when -* sense message is present. -*/ -if (vm_srb->srb_status &SRB_STATUS_AUTOSENSE_VALID )return ; + }/* * If there is an error; offline the device since all
@@ -1020,6 +1012,13 @@ static void storvsc_handle_error(struct vmscsi_request *vm_srb,default :set_host_byte (scmnd,DID_ERROR ); } +return ; + +case SRB_STATUS_INVALID_LUN : +set_host_byte (scmnd,DID_NO_CONNECT ); + process_err_fn = storvsc_remove_lun; + goto do_work; + }return ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 59/289 PCI: hv: Only reuse existing IRTE allocation for Multi-MSI
In reply to Greg Kroah-HartmanFrom: Dexuan Cui <[email protected]>
[ Upstream commit c234ba8042920fa83635808dc5673f36869ca280 ]
Jeffrey added Multi-MSI support to the pci-hyperv driver by the 4 patches:08e61e861a0e ("PCI: hv: Fix multi-MSI to allow more than one MSI vector") 455880dfe292 ("PCI: hv: Fix hv_arch_irq_unmask() for multi-MSI") b4b77778ecc5 ("PCI: hv: Reuse existing IRTE allocation in compose_msi_msg()") a2bad844a67b ("PCI: hv: Fix interrupt mapping for multi-MSI")
It turns out that the third patch (b4b77778ecc5) causes a performance regression because all the interrupts now happen on 1 physical CPU (or two pCPUs, if one pCPU doesn't have enough vectors). When a guest has many PCI devices, it may suffer from soft lockups if the workload is heavy, e.g., see https://lwn.net/ml/linux-kernel/[email protected]/
Commit b4b77778ecc5 itself is good. The real issue is that the hypercall in hv_irq_unmask() -> hv_arch_irq_unmask() -> hv_do_hypercall(HVCALL_RETARGET_INTERRUPT...) only changes the target virtual CPU rather than physical CPU; with b4b77778ecc5, the pCPU is determined only once in hv_compose_msi_msg() where only vCPU0 is specified; consequently the hypervisor only uses 1 target pCPU for all the interrupts.
Note: before b4b77778ecc5, the pCPU is determined twice, and when the pCPU is determined the second time, the vCPU in the effective affinity mask is used (i.e., it isn't always vCPU0), so the hypervisor chooses different pCPU for each interrupt.
The hypercall will be fixed in future to update the pCPU as well, but that will take quite a while, so let's restore the old behavior in hv_compose_msi_msg(), i.e., don't reuse the existing IRTE allocation for single-MSI and MSI-X; for multi-MSI, we choose the vCPU in a round-robin manner for each PCI device, so the interrupts of different devices can happen on different pCPUs, though the interrupts of each device happen on some single pCPU.
The hypercall fix may not be backported to all old versions of Hyper-V, so we want to have this guest side change forever (or at least till we're sure the old affected versions of Hyper-V are no longer supported).
--- drivers/pci/controller/pci-hyperv.c | 90 ++++++++++++++++++++++++----- 1 file changed, 75 insertions(+), 15 deletions(-)
drivers/pci/controller/pci-hyperv.c +75 -15
@@ -1613,7 +1613,7 @@ static void hv_pci_compose_compl(void *context, struct pci_response *resp, }static u32 hv_compose_msi_req_v1 ( -struct pci_create_interrupt *int_pkt,const struct cpumask *affinity, +struct pci_create_interrupt *int_pkt,u32 slot,u8 vector,u16 vector_count) { int_pkt->message_type.type =PCI_CREATE_INTERRUPT_MESSAGE ;
@@ -1631,6 +1631,35 @@ static u32 hv_compose_msi_req_v1(return sizeof (*int_pkt); } +/* +* The vCPU selected by hv_compose_multi_msi_req_get_cpu() and +* hv_compose_msi_req_get_cpu() is a "dummy" vCPU because the final vCPU to be +* interrupted is specified later in hv_irq_unmask() and communicated to Hyper-V +* via the HVCALL_RETARGET_INTERRUPT hypercall. But the choice of dummy vCPU is +* not irrelevant because Hyper-V chooses the physical CPU to handle the +* interrupts based on the vCPU specified in message sent to the vPCI VSP in +* hv_compose_msi_msg(). Hyper-V's choice of pCPU is not visible to the guest, +* but assigning too many vPCI device interrupts to the same pCPU can cause a +* performance bottleneck. So we spread out the dummy vCPUs to influence Hyper-V +* to spread out the pCPUs that it selects. +* +* For the single-MSI and MSI-X cases, it's OK for hv_compose_msi_req_get_cpu() +* to always return the same dummy vCPU, because a second call to +* hv_compose_msi_msg() contains the "real" vCPU, causing Hyper-V to choose a +* new pCPU for the interrupt. But for the multi-MSI case, the second call to +* hv_compose_msi_msg() exits without sending a message to the vPCI VSP, so the +* original dummy vCPU is used. This dummy vCPU must be round-robin'ed so that +* the pCPUs are spread out. All interrupts for a multi-MSI device end up using +* the same pCPU, even though the vCPUs will be spread out by later calls +* to hv_irq_unmask(), but that is the best we can do now. +* +* With Hyper-V in Nov 2022, the HVCALL_RETARGET_INTERRUPT hypercall does *not* +* cause Hyper-V to reselect the pCPU based on the specified vCPU. Such an +* enhancement is planned for a future version. With that enhancement, the +* dummy vCPU selection won't matter, and interrupts for the same multi-MSI +* device will be spread across multiple pCPUs. +*/ +/* * Create MSI w/ dummy vCPU set targeting just one vCPU, overwritten * by subsequent retarget in hv_irq_unmask().
@@ -1640,18 +1669,39 @@ static int hv_compose_msi_req_get_cpu(const struct cpumask *affinity)return cpumask_first_and (affinity, cpu_online_mask); } -static u32 hv_compose_msi_req_v2 ( -struct pci_create_interrupt2 *int_pkt,const struct cpumask *affinity, -u32 slot,u8 vector,u16 vector_count) +/* +* Make sure the dummy vCPU values for multi-MSI don't all point to vCPU0. +*/ +static int hv_compose_multi_msi_req_get_cpu (void ) { +static DEFINE_SPINLOCK (multi_msi_cpu_lock); + +/* -1 means starting with CPU 0 */ +static int cpu_next =-1 ; + +unsigned long flags;int cpu; +spin_lock_irqsave (&multi_msi_cpu_lock, flags); + + cpu_next =cpumask_next_wrap (cpu_next, cpu_online_mask, nr_cpu_ids, + false); + cpu = cpu_next; + +spin_unlock_irqrestore (&multi_msi_cpu_lock, flags); + +return cpu; +} + +static u32 hv_compose_msi_req_v2 ( +struct pci_create_interrupt2 *int_pkt,int cpu, +u32 slot,u8 vector,u16 vector_count) +{ int_pkt->message_type.type =PCI_CREATE_INTERRUPT_MESSAGE2 ; int_pkt->wslot.slot = slot; int_pkt->int_desc.vector = vector; int_pkt->int_desc.vector_count = vector_count; int_pkt->int_desc.delivery_mode =DELIVERY_MODE ; - cpu =hv_compose_msi_req_get_cpu (affinity); int_pkt->int_desc.processor_array[0 ] =hv_cpu_number_to_vp_number (cpu); int_pkt->int_desc.processor_count =1 ;
@@ -1660,18 +1710,15 @@ static u32 hv_compose_msi_req_v2( }static u32 hv_compose_msi_req_v3 ( -struct pci_create_interrupt3 *int_pkt,const struct cpumask *affinity, +struct pci_create_interrupt3 *int_pkt,int cpu,u32 slot,u32 vector,u16 vector_count) { -int cpu; - int_pkt->message_type.type =PCI_CREATE_INTERRUPT_MESSAGE3 ; int_pkt->wslot.slot = slot; int_pkt->int_desc.vector = vector; int_pkt->int_desc.reserved =0 ; int_pkt->int_desc.vector_count = vector_count; int_pkt->int_desc.delivery_mode =DELIVERY_MODE ; - cpu =hv_compose_msi_req_get_cpu (affinity); int_pkt->int_desc.processor_array[0 ] =hv_cpu_number_to_vp_number (cpu); int_pkt->int_desc.processor_count =1 ;
@@ -1715,12 +1762,18 @@ static void hv_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)struct pci_create_interrupt3 v3; } int_pkts; }__packed ctxt; +bool multi_msi;u64 trans_id;u32 size;int ret; +int cpu; + + msi_desc =irq_data_get_msi_desc (data); + multi_msi = !msi_desc->pci.msi_attrib.is_msix && + msi_desc->nvec_used >1 ;/* Reuse the previous allocation */ -if (data->chip_data) { +if (data->chip_data && multi_msi) { int_desc = data->chip_data; msg->address_hi = int_desc->address >>32 ; msg->address_lo = int_desc->address &0xffffffff ;
@@ -1728,7 +1781,6 @@ static void hv_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)return ; } - msi_desc =irq_data_get_msi_desc (data); pdev =msi_desc_to_pci_dev (msi_desc); dest =irq_data_get_effective_affinity_mask (data); pbus = pdev->bus;
@@ -1738,11 +1790,18 @@ static void hv_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)if (!hpdev) goto return_null_message; +/* Free any previous message that might have already been composed. */ +if (data->chip_data && !multi_msi) { + int_desc = data->chip_data; + data->chip_data =NULL ; +hv_int_desc_free (hpdev, int_desc); + } + int_desc =kzalloc (sizeof (*int_desc),GFP_ATOMIC );if (!int_desc) goto drop_reference; -if (!msi_desc->pci.msi_attrib.is_msix && msi_desc->nvec_used >1 ) { +if (multi_msi) {/* * If this is not the first MSI of Multi MSI, we already have * a mapping. Can exit early.
@@ -1767,9 +1826,11 @@ static void hv_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)*/ vector =32 ; vector_count = msi_desc->nvec_used; + cpu =hv_compose_multi_msi_req_get_cpu (); }else { vector =hv_msi_get_int_vector (data); vector_count =1 ; + cpu =hv_compose_msi_req_get_cpu (dest); }/*
@@ -1785,7 +1846,6 @@ static void hv_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)switch (hbus->protocol_version) {case PCI_PROTOCOL_VERSION_1_1 : size =hv_compose_msi_req_v1 (&ctxt.int_pkts.v1, - dest, hpdev->desc.win_slot.slot, (u8 )vector, vector_count);
@@ -1794,7 +1854,7 @@ static void hv_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)case PCI_PROTOCOL_VERSION_1_2 :case PCI_PROTOCOL_VERSION_1_3 : size =hv_compose_msi_req_v2 (&ctxt.int_pkts.v2, - dest, + cpu, hpdev->desc.win_slot.slot, (u8 )vector, vector_count);
@@ -1802,7 +1862,7 @@ static void hv_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)case PCI_PROTOCOL_VERSION_1_4 : size =hv_compose_msi_req_v3 (&ctxt.int_pkts.v3, - dest, + cpu, hpdev->desc.win_slot.slot, vector, vector_count);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 60/289 arm64: dts: rockchip: Fix Pine64 Quartz4-B PMIC interrupt
In reply to Greg Kroah-HartmanFrom: Chen-Yu Tsai <[email protected]>
[ Upstream commit 562105c1b072411c71ac2202410d83ee79297624 ]
Ths PMIC's interrupt line is tied to GPIO0_A3. This is described correctly for the pinmux setting, but incorrectly for the interrupt.
Correct the interrupt setting so that interrupts from the PMIC get delivered.
--- arch/arm64/boot/dts/rockchip/rk3566-quartz64-b.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/rockchip/rk3566-quartz64-b.dts +1 -1
@@ -176,7 +176,7 @@ rk809: pmic@20 { compatible = "rockchip,rk809"; reg = <0x20>; interrupt-parent = <&gpio0>; - interrupts = <RK_PA7 IRQ_TYPE_LEVEL_LOW>; + interrupts = <RK_PA3 IRQ_TYPE_LEVEL_LOW>; clock-output-names = "rk808-clkout1", "rk808-clkout2"; pinctrl-names = "default";
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 61/289 ASoC: max98373: Add checks for devm_kcalloc
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 60591bbf6d5eb44f275eb733943b7757325c1b60 ]
As the devm_kcalloc may return NULL pointer,
it should be better to check the return value
in order to avoid NULL poineter dereference.
--- sound/soc/codecs/max98373-i2c.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/soc/codecs/max98373-i2c.c +4 -0
@@ -549,6 +549,10 @@ static int max98373_i2c_probe(struct i2c_client *i2c) max98373->cache =devm_kcalloc (&i2c->dev, max98373->cache_num,sizeof (*max98373->cache),GFP_KERNEL ); +if (!max98373->cache) { + ret = -ENOMEM ; +return ret; + }for (i =0 ; i < max98373->cache_num; i++) max98373->cache[i].reg = max98373_i2c_cache_reg[i];
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 62/289 regulator: core: fix kobject release warning and memory leak in regulator_register()
In reply to Greg Kroah-HartmanFrom: Zeng Heng <[email protected]>
[ Upstream commit 5f4b204b6b8153923d5be8002c5f7082985d153f ]
Here is a warning report about lack of registered release() from kobject lib:
Device '(null)' does not have a release() function, it is broken and must be fixed.
WARNING: CPU: 0 PID: 48430 at drivers/base/core.c:2332 device_release+0x104/0x120 Call Trace: kobject_put+0xdc/0x180 put_device+0x1b/0x30 regulator_register+0x651/0x1170 devm_regulator_register+0x4f/0xb0
When regulator_register() returns fail and directly goto clean symbol, rdev->dev has not registered release() function yet (which is registered by regulator_class in the following), so rdev needs to be freed manually. If rdev->dev.of_node is not NULL, which means the of_node has gotten by regulator_of_get_init_data(), it needs to call of_node_put() to avoid refcount leak.
Otherwise, only calling put_device() would lead memory leak of rdev in further:
unreferenced object 0xffff88810d0b1000 (size 2048):
comm "107-i2c-rtq6752", pid 48430, jiffies 4342258431 (age 1341.780s) backtrace:
kmalloc_trace+0x22/0x110
regulator_register+0x184/0x1170
devm_regulator_register+0x4f/0xb0When regulator_register() returns fail and goto wash symbol, rdev->dev has registered release() function, so directly call put_device() to cleanup everything.
--- drivers/regulator/core.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/regulator/core.c +5 -1
@@ -5616,11 +5616,15 @@ regulator_register(const struct regulator_desc *regulator_desc,mutex_lock (®ulator_list_mutex);regulator_ena_gpio_free (rdev);mutex_unlock (®ulator_list_mutex); +put_device (&rdev->dev); + rdev =NULL ; clean:if (dangling_of_gpiod)gpiod_put (config->ena_gpiod); +if (rdev && rdev->dev.of_node) +of_node_put (rdev->dev.of_node); +kfree (rdev);kfree (config); -put_device (&rdev->dev); rinse:if (dangling_cfg_gpiod)gpiod_put (cfg->ena_gpiod);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 63/289 regulator: rt5759: fix OOB in validate_desc()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 7920e0fbced429ab18ad4402e3914146a6a0921b ]
I got the following OOB report:
BUG: KASAN: slab-out-of-bounds in validate_desc+0xba/0x109 Read of size 8 at addr ffff888107db8ff0 by task python3/253 Call Trace: <TASK> dump_stack_lvl+0x67/0x83 print_report+0x178/0x4b0 kasan_report+0x90/0x190 validate_desc+0xba/0x109 gpiod_set_value_cansleep+0x40/0x5a regulator_ena_gpio_ctrl+0x93/0xfc _regulator_do_enable.cold.61+0x89/0x163 set_machine_constraints+0x140a/0x159c regulator_register.cold.73+0x762/0x10cd devm_regulator_register+0x57/0xb0 rt5759_probe+0x3a0/0x4ac [rt5759_regulator]
The desc used in validate_desc() is passed from 'reg_cfg.ena_gpiod', which is not initialized. Fix this by initializing 'reg_cfg' to 0.
--- drivers/regulator/rt5759-regulator.c | 1 + 1 file changed, 1 insertion(+)
drivers/regulator/rt5759-regulator.c +1 -0
@@ -243,6 +243,7 @@ static int rt5759_regulator_register(struct rt5759_priv *priv)if (priv->chip_type ==CHIP_TYPE_RT5759A ) reg_desc->uV_step =RT5759A_STEP_UV ; +memset (®_cfg,0 ,sizeof (reg_cfg)); reg_cfg.dev = priv->dev; reg_cfg.of_node = np; reg_cfg.init_data =of_get_regulator_init_data (priv->dev, np, reg_desc);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 64/289 spi: dw-dma: decrease reference count in dw_spi_dma_init_mfld()
In reply to Greg Kroah-HartmanFrom: Xiongfeng Wang <[email protected]>
[ Upstream commit 804313b64e412a81b0b3389a10e7622452004aa6 ]
pci_get_device() will increase the reference count for the returned pci_dev. Since 'dma_dev' is only used to filter the channel in dw_spi_dma_chan_filer() after using it we need to call pci_dev_put() to decrease the reference count. Also add pci_dev_put() for the error case.
--- drivers/spi/spi-dw-dma.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/spi/spi-dw-dma.c +3 -0
@@ -128,12 +128,15 @@ static int dw_spi_dma_init_mfld(struct device *dev, struct dw_spi *dws)dw_spi_dma_sg_burst_init (dws); +pci_dev_put (dma_dev); +return 0 ; free_rxchan:dma_release_channel (dws->rxchan); dws->rxchan =NULL ; err_exit: +pci_dev_put (dma_dev);return -EBUSY ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 65/289 regulator: core: fix UAF in destroy_regulator()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 1f386d6894d0f1b7de8ef640c41622ddd698e7ab ]
I got a UAF report as following:
==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x935/0x2060 Read of size 8 at addr ffff88810e838220 by task python3/268 Call Trace: <TASK> dump_stack_lvl+0x67/0x83 print_report+0x178/0x4b0 kasan_report+0x90/0x190 __lock_acquire+0x935/0x2060 lock_acquire+0x156/0x400 _raw_spin_lock+0x2a/0x40 lockref_get+0x11/0x30 simple_recursive_removal+0x41/0x440 debugfs_remove.part.12+0x32/0x50 debugfs_remove+0x29/0x30 _regulator_put.cold.54+0x3e/0x27f regulator_put+0x1f/0x30 release_nodes+0x6a/0xa0 devres_release_all+0xf8/0x150 Allocated by task 37: kasan_save_stack+0x1c/0x40 kasan_set_track+0x21/0x30 __kasan_slab_alloc+0x5d/0x70 slab_post_alloc_hook+0x62/0x510 kmem_cache_alloc_lru+0x222/0x5a0 __d_alloc+0x31/0x440 d_alloc+0x30/0xf0 d_alloc_parallel+0xc4/0xd20 __lookup_slow+0x15e/0x2f0 lookup_one_len+0x13a/0x150 start_creating+0xea/0x190 debugfs_create_dir+0x1e/0x210 create_regulator+0x254/0x4e0 _regulator_get+0x2a1/0x467 _devm_regulator_get+0x5a/0xb0 regulator_virtual_probe+0xb9/0x1a0 Freed by task 30: kasan_save_stack+0x1c/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x50 __kasan_slab_free+0x102/0x190 kmem_cache_free+0xf6/0x600 rcu_core+0x54c/0x12b0 __do_softirq+0xf2/0x5e3 Last potentially related work creation: kasan_save_stack+0x1c/0x40 __kasan_record_aux_stack+0x98/0xb0 call_rcu+0x42/0x700 dentry_free+0x6c/0xd0 __dentry_kill+0x23b/0x2d0 dput.part.31+0x431/0x780 simple_recursive_removal+0xa9/0x440 debugfs_remove.part.12+0x32/0x50 debugfs_remove+0x29/0x30 regulator_unregister+0xe3/0x230 release_nodes+0x6a/0xa0
==================================================================
Here is how happened:
processor A processor Bregulator_register()
rdev_init_debugfs()
rdev->debugfs = debugfs_create_dir() devm_regulator_get() rdev = regulator_dev_lookup() create_regulator(rdev) // using rdev->debugfs as parent debugfs_create_dir(rdev->debugfs)
mfd_remove_devices_fn()
release_nodes()
regulator_unregister()
// free rdev->debugfs
debugfs_remove_recursive(rdev->debugfs)
release_nodes()
destroy_regulator()
debugfs_remove_recursive() <- causes UAFIn devm_regulator_get(), after getting rdev, the refcount is get, so fix this by moving debugfs_remove_recursive() to regulator_dev_release(), then it can be proctected by the refcount, the 'rdev->debugfs' can not be freed until the refcount is 0.
--- drivers/regulator/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/regulator/core.c +1 -1
@@ -5138,6 +5138,7 @@ static void regulator_dev_release(struct device *dev) {struct regulator_dev *rdev =dev_get_drvdata (dev); +debugfs_remove_recursive (rdev->debugfs);kfree (rdev->constraints);of_node_put (rdev->dev.of_node);kfree (rdev);
@@ -5653,7 +5654,6 @@ void regulator_unregister(struct regulator_dev *rdev)mutex_lock (®ulator_list_mutex); -debugfs_remove_recursive (rdev->debugfs);WARN_ON (rdev->open_count);regulator_remove_coupling (rdev);unset_regulator_supplies (rdev);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 66/289 bus: sunxi-rsb: Remove the shutdown callback
In reply to Greg Kroah-HartmanFrom: Samuel Holland <[email protected]>
[ Upstream commit 5f4696ddca4b8a0bbbc36bd46829f97aab5a4552 ]
Shutting down the RSB controller prevents communicating with a PMIC inside pm_power_off(), since that gets called after device_shutdown(), so it breaks system poweroff on some boards.
--- drivers/bus/sunxi-rsb.c | 9 --------- 1 file changed, 9 deletions(-)
drivers/bus/sunxi-rsb.c +0 -9
@@ -812,14 +812,6 @@ static int sunxi_rsb_remove(struct platform_device *pdev)return 0 ; } -static void sunxi_rsb_shutdown (struct platform_device *pdev) -{ -struct sunxi_rsb *rsb =platform_get_drvdata (pdev); - -pm_runtime_disable (&pdev->dev); -sunxi_rsb_hw_exit (rsb); -} -static const struct dev_pm_ops sunxi_rsb_dev_pm_ops = {SET_RUNTIME_PM_OPS (sunxi_rsb_runtime_suspend, sunxi_rsb_runtime_resume,NULL )
@@ -835,7 +827,6 @@ MODULE_DEVICE_TABLE(of, sunxi_rsb_of_match_table);static struct platform_driver sunxi_rsb_driver = { .probe = sunxi_rsb_probe, .remove = sunxi_rsb_remove, - .shutdown = sunxi_rsb_shutdown, .driver = { .name =RSB_CTRL_NAME , .of_match_table = sunxi_rsb_of_match_table,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 67/289 bus: sunxi-rsb: Support atomic transfers
In reply to Greg Kroah-HartmanFrom: Samuel Holland <[email protected]>
[ Upstream commit 077686da0e2162c4ea5ae0df205849c2a7a84479 ]
When communicating with a PMIC during system poweroff (pm_power_off()), IRQs are disabled and we are in a RCU read-side critical section, so we cannot use wait_for_completion_io_timeout(). Instead, poll the status register for transfer completion.
--- drivers/bus/sunxi-rsb.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-)
drivers/bus/sunxi-rsb.c +21 -8
@@ -267,6 +267,9 @@ EXPORT_SYMBOL_GPL(sunxi_rsb_driver_register);/* common code that starts a transfer */ static int _sunxi_rsb_run_xfer (struct sunxi_rsb *rsb) { +u32 int_mask, status; +bool timeout; +if (readl (rsb->regs +RSB_CTRL ) &RSB_CTRL_START_TRANS ) {dev_dbg (rsb->dev,"RSB transfer still in progress\n" );return -EBUSY ;
@@ -274,13 +277,23 @@ static int _sunxi_rsb_run_xfer(struct sunxi_rsb *rsb)reinit_completion (&rsb->complete); -writel (RSB_INTS_LOAD_BSY |RSB_INTS_TRANS_ERR |RSB_INTS_TRANS_OVER , - rsb->regs +RSB_INTE ); + int_mask =RSB_INTS_LOAD_BSY |RSB_INTS_TRANS_ERR |RSB_INTS_TRANS_OVER ; +writel (int_mask, rsb->regs +RSB_INTE );writel (RSB_CTRL_START_TRANS |RSB_CTRL_GLOBAL_INT_ENB , rsb->regs +RSB_CTRL ); -if (!wait_for_completion_io_timeout (&rsb->complete, -msecs_to_jiffies (100 ))) { +if (irqs_disabled ()) { + timeout =readl_poll_timeout_atomic (rsb->regs +RSB_INTS , + status, (status & int_mask), +10 ,100000 ); +writel (status, rsb->regs +RSB_INTS ); + }else { + timeout = !wait_for_completion_io_timeout (&rsb->complete, +msecs_to_jiffies (100 )); + status = rsb->status; + } + +if (timeout) {dev_dbg (rsb->dev,"RSB timeout\n" );/* abort the transfer */
@@ -292,18 +305,18 @@ static int _sunxi_rsb_run_xfer(struct sunxi_rsb *rsb)return -ETIMEDOUT ; } -if (rsb->status &RSB_INTS_LOAD_BSY ) { +if (status &RSB_INTS_LOAD_BSY ) {dev_dbg (rsb->dev,"RSB busy\n" );return -EBUSY ; } -if (rsb->status &RSB_INTS_TRANS_ERR ) { -if (rsb->status &RSB_INTS_TRANS_ERR_ACK ) { +if (status &RSB_INTS_TRANS_ERR ) { +if (status &RSB_INTS_TRANS_ERR_ACK ) {dev_dbg (rsb->dev,"RSB slave nack\n" );return -EINVAL ; } -if (rsb->status &RSB_INTS_TRANS_ERR_DATA ) { +if (status &RSB_INTS_TRANS_ERR_DATA ) {dev_dbg (rsb->dev,"RSB transfer data error\n" );return -EIO ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 68/289 tee: optee: fix possible memory leak in optee_register_device()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit cce616e012c215d65c15e5d1afa73182dea49389 ]
If device_register() returns error in optee_register_device(), the name allocated by dev_set_name() need be freed. As comment of device_register() says, it should use put_device() to give up the reference in the error path. So fix this by calling put_device(), then the name can be freed in kobject_cleanup(), and optee_device is freed in optee_release_device().
--- drivers/tee/optee/device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tee/optee/device.c +1 -1
@@ -80,7 +80,7 @@ static int optee_register_device(const uuid_t *device_uuid) rc =device_register (&optee_device->dev);if (rc) {pr_err ("device registration failed, err: %d\n" , rc); -kfree (optee_device); +put_device (&optee_device->dev); }return rc;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 69/289 spi: tegra210-quad: Fix duplicate resource error
In reply to Greg Kroah-HartmanFrom: Krishna Yarlagadda <[email protected]>
[ Upstream commit 2197aa6b0aa236b9896a09b9d08d6924d18b84f6 ]
controller data alloc is done with client device data causing duplicate resource error. Allocate memory using controller device when using devm
--- drivers/spi/spi-tegra210-quad.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/spi/spi-tegra210-quad.c +2 -1
@@ -924,8 +924,9 @@ static int tegra_qspi_start_transfer_one(struct spi_device *spi,static struct tegra_qspi_client_data *tegra_qspi_parse_cdata_dt (struct spi_device *spi) {struct tegra_qspi_client_data *cdata; +struct tegra_qspi *tqspi =spi_master_get_devdata (spi->master); - cdata =devm_kzalloc (&spi->dev,sizeof (*cdata),GFP_KERNEL ); + cdata =devm_kzalloc (tqspi->dev,sizeof (*cdata),GFP_KERNEL );if (!cdata)return NULL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 70/289 ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl
In reply to Greg Kroah-HartmanFrom: Michael Grzeschik <[email protected]>
[ Upstream commit 40a2226e8bfacb79dd154dea68febeead9d847e9 ]
We set the PIOC to GPIO mode. This way the pin becomes an input signal will be usable by the controller. Without this change the udc on the 9g20ek does not work.
--- arch/arm/boot/dts/at91sam9g20ek_common.dtsi | 9 +++++++++ 1 file changed, 9 insertions(+)
arch/arm/boot/dts/at91sam9g20ek_common.dtsi +9 -0
@@ -39,6 +39,13 @@ pinctrl_pck0_as_mck: pck0_as_mck { }; + usb1 { + pinctrl_usb1_vbus_gpio: usb1_vbus_gpio { + atmel,pins = + <AT91_PIOC 5 AT91_PERIPH_GPIO AT91_PINCTRL_DEGLITCH>; /* PC5 GPIO */ + }; + }; + mmc0_slot1 { pinctrl_board_mmc0_slot1: mmc0_slot1-board { atmel,pins =
@@ -84,6 +91,8 @@ macb0: ethernet@fffc4000 { }; usb1: gadget@fffa4000 { + pinctrl-0 = <&pinctrl_usb1_vbus_gpio>; + pinctrl-names = "default"; atmel,vbus-gpio = <&pioC 5 GPIO_ACTIVE_HIGH>; status = "okay"; };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 71/289 selftests: mptcp: gives slow test-case more time
In reply to Greg Kroah-HartmanFrom: Paolo Abeni <[email protected]>
[ Upstream commit 22b29557aef3c9d673c887911b504c6d47009de4 ]
On slow or busy VM, some test-cases still fail because the data transfer completes before the endpoint manipulation actually took effect.
Address the issue by artificially increasing the runtime for the relevant test-cases.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +3 -3
@@ -2105,7 +2105,7 @@ remove_tests() pm_nl_set_limits $ns2 1 3 pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow - run_tests $ns1 $ns2 10.0.1.1 0 -1 -2 slow + run_tests $ns1 $ns2 10.0.1.1 0 -1 -2 speed_10 chk_join_nr 3 3 3 chk_add_nr 1 1 chk_rm_nr 2 2
@@ -2118,7 +2118,7 @@ remove_tests() pm_nl_add_endpoint $ns1 10.0.3.1 flags signal pm_nl_add_endpoint $ns1 10.0.4.1 flags signal pm_nl_set_limits $ns2 3 3 - run_tests $ns1 $ns2 10.0.1.1 0 -3 0 slow + run_tests $ns1 $ns2 10.0.1.1 0 -3 0 speed_10 chk_join_nr 3 3 3 chk_add_nr 3 3 chk_rm_nr 3 3 invert
@@ -2131,7 +2131,7 @@ remove_tests() pm_nl_add_endpoint $ns1 10.0.3.1 flags signal pm_nl_add_endpoint $ns1 10.0.14.1 flags signal pm_nl_set_limits $ns2 3 3 - run_tests $ns1 $ns2 10.0.1.1 0 -3 0 slow + run_tests $ns1 $ns2 10.0.1.1 0 -3 0 speed_10 chk_join_nr 1 1 1 chk_add_nr 3 3 chk_rm_nr 3 1 invert
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 72/289 selftests: mptcp: run mptcp_sockopt from a new netns
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
[ Upstream commit 7e68d31020f18f8d695d5f143fc16cdaa96166cb ]
Not running it from a new netns causes issues if some MPTCP settings are modified, e.g. if MPTCP is disabled from the sysctl knob, if multiple addresses are available and added to the MPTCP path-manager, etc.
In these cases, the created connection will not behave as expected, e.g. unable to create an MPTCP socket, more than one subflow is seen, etc.
A new "sandbox" net namespace is now created and used to run mptcp_sockopt from this controlled environment.
--- tools/testing/selftests/net/mptcp/mptcp_sockopt.sh | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_sockopt.sh +5 -4
@@ -35,8 +35,9 @@ init() ns1="ns1-$rndh" ns2="ns2-$rndh" + ns_sbox="ns_sbox-$rndh" - for netns in "$ns1" "$ns2";do + for netns in "$ns1" "$ns2" "$ns_sbox";do ip netns add $netns || exit $ksft_skip ip -net $netns link set lo up ip netns exec $netns sysctl -q net.mptcp.enabled=1
@@ -73,7 +74,7 @@ init() cleanup() { - for netns in "$ns1" "$ns2"; do + for netns in "$ns1" "$ns2" "$ns_sbox"; do ip netns del $netns done rm -f "$cin" "$cout"
@@ -243,7 +244,7 @@ do_mptcp_sockopt_tests() { local lret=0 - ./mptcp_sockopt + ip netns exec "$ns_sbox" ./mptcp_sockopt lret=$? if [ $lret -ne 0 ]; then
@@ -252,7 +253,7 @@ do_mptcp_sockopt_tests() return fi - ./mptcp_sockopt -6 + ip netns exec "$ns_sbox" ./mptcp_sockopt -6 lret=$? if [ $lret -ne 0 ]; then
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 73/289 selftests: mptcp: fix mibit vs mbit mix up
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
[ Upstream commit 3de88b95c4d436d78afc0266a0bed76c35ddeb62 ]
The estimated time was supposing the rate was expressed in mibit (bit * 1024^2) but it is in mbit (bit * 1000^2).
This makes the threshold higher but in a more realistic way to avoid false positives reported by CI instances.
Before this patch, the thresholds were at 7561/4005ms and now they are at 7906/4178ms.
While at it, also fix a typo in the linked comment, spotted by Mat.
--- tools/testing/selftests/net/mptcp/simult_flows.sh | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
tools/testing/selftests/net/mptcp/simult_flows.sh +3 -2
@@ -247,9 +247,10 @@ run_test() tc -n $ns2 qdisc add dev ns2eth1 root netem rate ${rate1}mbit $delay1 tc -n $ns2 qdisc add dev ns2eth2 root netem rate ${rate2}mbit $delay2 - # time is measured in ms, account for transfer size, affegated link speed + # time is measured in ms, account for transfer size, aggregated link speed # and header overhead (10%) - local time=$((size * 8 * 1000 * 10 / (( $rate1 + $rate2) * 1024 *1024 * 9) )) + # ms byte -> bit 10% mbit -> kbit -> bit 10% + local time=$((1000 * size * 8 * 10 / ((rate1 + rate2) * 1000 * 1000 * 9) )) # mptcp_connect will do some sleeps to allow the mp_join handshake # completion (see mptcp_connect): 200ms on each side, add some slack
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 74/289 net: liquidio: simplify if expression
In reply to Greg Kroah-HartmanFrom: Leon Romanovsky <[email protected]>
[ Upstream commit 733d4bbf9514890eb53ebe75827bf1fb4fd25ebe ]
Fix the warning reported by kbuild:
cocci warnings: (new ones prefixed by >>)
Quoted 1 line
Quoted 1 line
drivers/net/ethernet/cavium/liquidio/lio_main.c:1797:54-56: WARNING !A || A && B is equivalent to !A || B
drivers/net/ethernet/cavium/liquidio/lio_main.c:1827:54-56: WARNING !A || A && B is equivalent to !A || B
--- drivers/net/ethernet/cavium/liquidio/lio_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/cavium/liquidio/lio_main.c +2 -2
@@ -1799,7 +1799,7 @@ static int liquidio_open(struct net_device *netdev)ifstate_set (lio,LIO_IFSTATE_RUNNING ); -if (!OCTEON_CN23XX_PF (oct) || (OCTEON_CN23XX_PF (oct) && !oct->msix_on)) { +if (!OCTEON_CN23XX_PF (oct) || !oct->msix_on) { ret =setup_tx_poll_fn (netdev);if (ret) goto err_poll;
@@ -1829,7 +1829,7 @@ static int liquidio_open(struct net_device *netdev)return 0 ; err_rx_ctrl: -if (!OCTEON_CN23XX_PF (oct) || (OCTEON_CN23XX_PF (oct) && !oct->msix_on)) +if (!OCTEON_CN23XX_PF (oct) || !oct->msix_on)cleanup_tx_poll_fn (netdev); err_poll:if (lio->ptp_clock) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 75/289 net: neigh: decrement the family specific qlen
In reply to Greg Kroah-HartmanFrom: Thomas Zeitlhofer <[email protected]>
[ Upstream commit 8207f253a097fe15c93d85ac15ebb73c5e39e1e1 ]
Commit 0ff4eb3d5ebb ("neighbour: make proxy_queue.qlen limit per-device") introduced the length counter qlen in struct neigh_parms. There are separate neigh_parms instances for IPv4/ARP and IPv6/ND, and while the family specific qlen is incremented in pneigh_enqueue(), the mentioned commit decrements always the IPv4/ARP specific qlen, regardless of the currently processed family, in pneigh_queue_purge() and neigh_proxy_process().
As a result, with IPv6/ND, the family specific qlen is only incremented (and never decremented) until it exceeds PROXY_QLEN, and then, according to the check in pneigh_enqueue(), neighbor solicitations are not answered anymore. As an example, this is noted when using the subnet-router anycast address to access a Linux router. After a certain amount of time (in the observed case, qlen exceeded PROXY_QLEN after two days), the Linux router stops answering neighbor solicitations for its subnet-router anycast address and effectively becomes unreachable.
Another result with IPv6/ND is that the IPv4/ARP specific qlen is decremented more often than incremented. This leads to negative qlen values, as a signed integer has been used for the length counter qlen, and potentially to an integer overflow.
Fix this by introducing the helper function neigh_parms_qlen_dec(), which decrements the family specific qlen. Thereby, make use of the existing helper function neigh_get_dev_parms_rcu(), whose definition therefore needs to be placed earlier in neighbour.c. Take the family member from struct neigh_table to determine the currently processed family and appropriately call neigh_parms_qlen_dec() from pneigh_queue_purge() and neigh_proxy_process().
Additionally, use an unsigned integer for the length counter qlen.
--- include/net/neighbour.h | 2 +- net/core/neighbour.c | 58 +++++++++++++++++++++-------------------- 2 files changed, 31 insertions(+), 29 deletions(-)
include/net/neighbour.h +1 -1
@@ -83,7 +83,7 @@ struct neigh_parms {struct rcu_head rcu_head;int reachable_time; -int qlen; +u32 qlen;int data[NEIGH_VAR_DATA_MAX ];DECLARE_BITMAP (data_state,NEIGH_VAR_DATA_MAX ); };
net/core/neighbour.c +30 -28
95 lines not on this page · raw message
Signature · 1 line
2.35.1
Re: [PATCH 6.0 075/289] net: neigh: decrement the family specific qlen
Quoted 12 lines · Greg Kroah-Hartman
From: Thomas Zeitlhofer <[email protected]>
[ Upstream commit
8207f253a097fe15c93d85ac15ebb73c5e39e1e1]Commit
0ff4eb3d5ebb("neighbour: make proxy_queue.qlen limit per-device") introduced the length counter qlen in structneigh_parms. There are separateneigh_parmsinstances for IPv4/ARP and IPv6/ND, and while the family specific qlen is incremented inpneigh_enqueue(), the mentioned commit decrements always the IPv4/ARP specific qlen, regardless of the currently processed family, inpneigh_queue_purge()andneigh_proxy_process().
Quoted 8 lines
As a result, with IPv6/ND, the family specific qlen is only incremented (and never decremented) until it exceeds
PROXY_QLEN, and then, according to the check inpneigh_enqueue(), neighbor solicitations are not answered anymore. As an example, this is noted when using the subnet-router anycast address to access a Linux router. After a certain amount of time (in the observed case, qlen exceededPROXY_QLENafter two days), the Linux router stops answering neighbor solicitations for its subnet-router anycast address and effectively becomes unreachable.
In my environment, without this patch to 6.0.y, IPv6 proxy neighbours lose connectivity after two or three hours at most because at that point qlen > PROXY_QLEN in my router.
Quoted 133 lines
Another result with IPv6/ND is that the IPv4/ARP specific qlen is decremented more often than incremented. This leads to negative qlen values, as a signed integer has been used for the length counter qlen, and potentially to an integer overflow.
Fix this by introducing the helper function
neigh_parms_qlen_dec(), which decrements the family specific qlen. Thereby, make use of the existing helper functionneigh_get_dev_parms_rcu(), whose definition therefore needs to be placed earlier inneighbour.c. Take the family member from structneigh_tableto determine the currently processed family and appropriately callneigh_parms_qlen_dec()frompneigh_queue_purge()andneigh_proxy_process().Additionally, use an unsigned integer for the length counter qlen.
Fixes 0ff4eb3d5ebb ("neighbour: make proxy_queue.qlen limit per-device")Signed-off-by Thomas Zeitlhofer <[email protected]>Signed-off-by David S. Miller <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- include/net/neighbour.h | 2 +- net/core/neighbour.c | 58 +++++++++++++++++++++-------------------- 2 files changed, 31 insertions(+), 29 deletions(-)include/net/neighbour.h +1
-1@@ -83,7 +83,7 @@ struct neigh_parms {struct rcu_head rcu_head;int reachable_time; -int qlen; +u32 qlen;int data[NEIGH_VAR_DATA_MAX ];DECLARE_BITMAP (data_state,NEIGH_VAR_DATA_MAX ); };net/core/neighbour.c +30
-21@@ -307,7 +307,31 @@ static int neigh_del_timer(struct neighbour *n)return 0 ; } -static void pneigh_queue_purge (struct sk_buff_head *list,struct net *net) +static struct neigh_parms *neigh_get_dev_parms_rcu (struct net_device *dev, +int family) +{ +switch (family) { +case AF_INET : +return __in_dev_arp_parms_get_rcu (dev); +case AF_INET6 : +return __in6_dev_nd_parms_get_rcu (dev); + } +return NULL ; +} + +static void neigh_parms_qlen_dec (struct net_device *dev,int family) +{ +struct neigh_parms *p; + +rcu_read_lock (); + p =neigh_get_dev_parms_rcu (dev, family); +if (p) + p->qlen--; +rcu_read_unlock (); +} + +static void pneigh_queue_purge (struct sk_buff_head *list,struct net *net, +int family) {struct sk_buff_head tmp;unsigned long flags;@@ -321,13 +345,7 @@ static void pneigh_queue_purge(struct sk_buff_head *list, struct net *net)struct net_device *dev = skb->dev;if (net ==NULL ||net_eq (dev_net (dev), net)) { -struct in_device *in_dev; - -rcu_read_lock (); - in_dev =__in_dev_get_rcu (dev); -if (in_dev) - in_dev->arp_parms->qlen--; -rcu_read_unlock (); +neigh_parms_qlen_dec (dev, family);__skb_unlink (skb, list);__skb_queue_tail (&tmp, skb); }@@ -409,7 +427,8 @@ static int __neigh_ifdown(struct neigh_table *tbl, struct net_device *dev,write_lock_bh (&tbl->lock);neigh_flush_dev (tbl, dev, skip_perm);pneigh_ifdown_and_unlock (tbl, dev); -pneigh_queue_purge (&tbl->proxy_queue, dev ?dev_net (dev) :NULL ); +pneigh_queue_purge (&tbl->proxy_queue, dev ?dev_net (dev) :NULL , + tbl->family);if (skb_queue_empty_lockless (&tbl->proxy_queue))del_timer_sync (&tbl->proxy_timer);return 0 ;@@ -1621,13 +1640,8 @@ static void neigh_proxy_process(struct timer_list *t)if (tdif <=0 ) {struct net_device *dev = skb->dev; -struct in_device *in_dev; -rcu_read_lock (); - in_dev =__in_dev_get_rcu (dev); -if (in_dev) - in_dev->arp_parms->qlen--; -rcu_read_unlock (); +neigh_parms_qlen_dec (dev, tbl->family);__skb_unlink (skb, &tbl->proxy_queue);if (tbl->proxy_redo &&netif_running (dev)) {@@ -1821,7 +1835,7 @@ int neigh_table_clear(int index, struct neigh_table *tbl)cancel_delayed_work_sync (&tbl->managed_work);cancel_delayed_work_sync (&tbl->gc_work);del_timer_sync (&tbl->proxy_timer); -pneigh_queue_purge (&tbl->proxy_queue,NULL ); +pneigh_queue_purge (&tbl->proxy_queue,NULL , tbl->family);neigh_ifdown (tbl,NULL );if (atomic_read (&tbl->entries))pr_crit ("neighbour leakage\n" );@@ -3542,18 +3556,6 @@ static int proc_unres_qlen(struct ctl_table *ctl, int write,return ret; } -static struct neigh_parms *neigh_get_dev_parms_rcu (struct net_device *dev, -int family) -{ -switch (family) { -case AF_INET :
net/core/neighbour.c static int proc_unres_qlen(struct ctl_table *ctl, int write, · line 3561
Quoted 10 lines
net/core/neighbour.c +0
-7-return __in_dev_arp_parms_get_rcu (dev); -case AF_INET6 : -return __in6_dev_nd_parms_get_rcu (dev); - } -return NULL ; -} -static void neigh_copy_dflt_parms (struct net *net,struct neigh_parms *p,int index) {
Hi Greg,
I tested this patch on my IPv6 router. Given that without this patch, connectivity of IPv6 proxy neighbours is lost after 2-3 hours in my environment, a successful test requires:
- connectivity of IPv6 proxy neighbours must last at least six hours
- connectivity of IPv6 proxy neighbours must persist until router reboot
- no other observed bugs or regressions
I tested three kernels:
- Official Fedora 37 6.0.9 kernel plus this patch
- Official Fedora 37 6.0.10 kernel which includes this patch
- 6.0.11-rc1 kernel
All three kernels passed the test, with the longest test before rebooting the router of 12 hours for the 6.0.11-rc1 kernel.
On the Debian bug tracker, there is also a report of a successful test of this patch which resulted in 24 hours of continued IPv6 connectivity for IPv6 proxy neighbours (see the Link tag below).
AFAICS, 6.0.11-rc1 works great on my IPv6 router.
Thanks to all who worked on this for the quick fix.
Best regards,
Chuck Zmudzinski
Greg Kroah-Hartman
maintainerPATCH 76/289 ipvlan: hold lower dev to avoid possible use-after-free
In reply to Greg Kroah-HartmanFrom: Mahesh Bandewar <[email protected]>
[ Upstream commit 40b9d1ab63f5c4f3cb69450044d07b45e5af72e1 ]
Recently syzkaller discovered the issue of disappearing lower device (NETDEV_UNREGISTER) while the virtual device (like macvlan) is still having it as a lower device. So it's just a matter of time similar discovery will be made for IPvlan device setup. So fixing it preemptively. Also while at it, add a refcount tracker.
--- drivers/net/ipvlan/ipvlan.h | 1 + drivers/net/ipvlan/ipvlan_main.c | 2 ++ 2 files changed, 3 insertions(+)
drivers/net/ipvlan/ipvlan.h +1 -0
@@ -98,6 +98,7 @@ struct ipvl_port {struct sk_buff_head backlog;int count;struct ida ida; +netdevice_tracker dev_tracker; };struct ipvl_skb_cb {
drivers/net/ipvlan/ipvlan_main.c +2 -0
@@ -83,6 +83,7 @@ static int ipvlan_port_create(struct net_device *dev)if (err) goto err; +netdev_hold (dev, &port->dev_tracker,GFP_KERNEL );return 0 ; err:
@@ -95,6 +96,7 @@ static void ipvlan_port_destroy(struct net_device *dev)struct ipvl_port *port =ipvlan_port_get_rtnl (dev);struct sk_buff *skb; +netdev_put (dev, &port->dev_tracker);if (port->mode ==IPVLAN_MODE_L3S )ipvlan_l3s_unregister (port);netdev_rx_handler_unregister (dev);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 77/289 rxrpc: Fix race between conn bundle lookup and bundle removal [ZDI-CAN-15975]
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 3bcd6c7eaa53b56c3f584da46a1f7652e759d0e5 ]
After rxrpc_unbundle_conn() has removed a connection from a bundle, it checks to see if there are any conns with available channels and, if not, removes and attempts to destroy the bundle.
Whilst it does check after grabbing client_bundles_lock that there are no connections attached, this races with rxrpc_look_up_bundle() retrieving the bundle, but not attaching a connection for the connection to be attached later.
There is therefore a window in which the bundle can get destroyed before we manage to attach a new connection to it.
Fix this by adding an "active" counter to struct rxrpc_bundle:
(1) rxrpc_connect_call() obtains an active count by prepping/looking up a bundle and ditches it before returning.
(2) If, during rxrpc_connect_call(), a connection is added to the bundle, this obtains an active count, which is held until the connection is discarded.
(3) rxrpc_deactivate_bundle() is created to drop an active count on a bundle and destroy it when the active count reaches 0. The active count is checked inside client_bundles_lock() to prevent a race with rxrpc_look_up_bundle().
(4) rxrpc_unbundle_conn() then calls rxrpc_deactivate_bundle().
--- net/rxrpc/ar-internal.h | 1 + net/rxrpc/conn_client.c | 38 +++++++++++++++++++++++--------------- 2 files changed, 24 insertions(+), 15 deletions(-)
net/rxrpc/ar-internal.h +1 -0
@@ -399,6 +399,7 @@ enum rxrpc_conn_proto_state {struct rxrpc_bundle {struct rxrpc_conn_parameters params;refcount_t ref; +atomic_t active;/* Number of active users */ unsigned int debug_id;bool try_upgrade;/* True if the bundle is attempting upgrade */ bool alloc_conn;/* True if someone's getting a conn */
net/rxrpc/conn_client.c +23 -15
@@ -40,6 +40,8 @@ __read_mostly unsigned long rxrpc_conn_idle_client_fast_expiry = 2 * HZ;DEFINE_IDR (rxrpc_client_conn_ids);static DEFINE_SPINLOCK (rxrpc_conn_id_lock); +static void rxrpc_deactivate_bundle (struct rxrpc_bundle *bundle); +/* * Get a connection ID and epoch for a client connection from the global pool. * The connection struct pointer is then recorded in the idr radix tree. The
@@ -123,6 +125,7 @@ static struct rxrpc_bundle *rxrpc_alloc_bundle(struct rxrpc_conn_parameters *cp, bundle->params = *cp;rxrpc_get_peer (bundle->params.peer);refcount_set (&bundle->ref,1 ); +atomic_set (&bundle->active,1 );spin_lock_init (&bundle->channel_lock);INIT_LIST_HEAD (&bundle->waiting_calls); }
@@ -149,7 +152,7 @@ void rxrpc_put_bundle(struct rxrpc_bundle *bundle) dead =__refcount_dec_and_test (&bundle->ref, &r); -_debug ("PUT B=%x %d" , d, r); +_debug ("PUT B=%x %d" , d, r -1 );if (dead)rxrpc_free_bundle (bundle); }
@@ -338,6 +341,7 @@ static struct rxrpc_bundle *rxrpc_look_up_bundle(struct rxrpc_conn_parameters *crxrpc_free_bundle (candidate); found_bundle:rxrpc_get_bundle (bundle); +atomic_inc (&bundle->active);spin_unlock (&local->client_bundles_lock);_leave (" = %u [found]" , bundle->debug_id);return bundle;
@@ -435,6 +439,7 @@ static void rxrpc_add_conn_to_bundle(struct rxrpc_bundle *bundle, gfp_t gfp)if (old)trace_rxrpc_client (old,-1 , rxrpc_client_replace); candidate->bundle_shift = shift; +atomic_inc (&bundle->active); bundle->conns[i] = candidate;for (j =0 ; j <RXRPC_MAXCALLS ; j++)set_bit (shift + j, &bundle->avail_chans);
@@ -725,6 +730,7 @@ int rxrpc_connect_call(struct rxrpc_sock *rx,smp_rmb (); out_put_bundle: +rxrpc_deactivate_bundle (bundle);rxrpc_put_bundle (bundle); out:_leave (" = %d" , ret);
@@ -900,9 +906,8 @@ void rxrpc_disconnect_client_call(struct rxrpc_bundle *bundle, struct rxrpc_callstatic void rxrpc_unbundle_conn (struct rxrpc_connection *conn) {struct rxrpc_bundle *bundle = conn->bundle; -struct rxrpc_local *local = bundle->params.local;unsigned int bindex; -bool need_drop = false, need_put = false; +bool need_drop = false;int i;_enter ("C=%x" , conn->debug_id);
@@ -921,15 +926,22 @@ static void rxrpc_unbundle_conn(struct rxrpc_connection *conn) }spin_unlock (&bundle->channel_lock); -/* If there are no more connections, remove the bundle */ -if (!bundle->avail_chans) { -_debug ("maybe unbundle" ); -spin_lock (&local->client_bundles_lock); +if (need_drop) { +rxrpc_deactivate_bundle (bundle); +rxrpc_put_connection (conn); + } +} -for (i =0 ; i <ARRAY_SIZE (bundle->conns); i++) -if (bundle->conns[i]) -break ; -if (i ==ARRAY_SIZE (bundle->conns) && !bundle->params.exclusive) { +/* +* Drop the active count on a bundle. +*/ +static void rxrpc_deactivate_bundle (struct rxrpc_bundle *bundle) +{ +struct rxrpc_local *local = bundle->params.local; +bool need_put = false; + +if (atomic_dec_and_lock (&bundle->active, &local->client_bundles_lock)) { +if (!bundle->params.exclusive) {_debug ("erase bundle" );rb_erase (&bundle->local_node, &local->client_bundles); need_put = true;
@@ -939,10 +951,6 @@ static void rxrpc_unbundle_conn(struct rxrpc_connection *conn)if (need_put)rxrpc_put_bundle (bundle); } - -if (need_drop) -rxrpc_put_connection (conn); -_leave ("" ); }/*
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 78/289 net: dsa: sja1105: disallow C45 transactions on the BASE-TX MDIO bus
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 24deec6b9e4a051635f75777844ffc184644fec9 ]
You'd think people know that the internal 100BASE-TX PHY on the SJA1110 responds only to clause 22 MDIO transactions, but they don't :)
When a clause 45 transaction is attempted, sja1105_base_tx_mdio_read() and sja1105_base_tx_mdio_write() don't expect "reg" to contain bit 30 set (MII_ADDR_C45) and pack this value into the SPI transaction buffer.
But the field in the SPI buffer has a width smaller than 30 bits, so we see this confusing message from the packing() API rather than a proper rejection of C45 transactions:
Call trace: dump_stack+0x1c/0x38 sja1105_pack+0xbc/0xc0 [sja1105] sja1105_xfer+0x114/0x2b0 [sja1105] sja1105_xfer_u32+0x44/0xf4 [sja1105] sja1105_base_tx_mdio_read+0x44/0x7c [sja1105] mdiobus_read+0x44/0x80 get_phy_c45_ids+0x70/0x234 get_phy_device+0x68/0x15c fwnode_mdiobus_register_phy+0x74/0x240 of_mdiobus_register+0x13c/0x380 sja1105_mdiobus_register+0x368/0x490 [sja1105] sja1105_setup+0x94/0x119c [sja1105]
Cannot store 401d2405 inside bits 24-4 (would truncate)
--- drivers/net/dsa/sja1105/sja1105_mdio.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/dsa/sja1105/sja1105_mdio.c +6 -0
@@ -256,6 +256,9 @@ static int sja1105_base_tx_mdio_read(struct mii_bus *bus, int phy, int reg)u32 tmp;int rc; +if (reg &MII_ADDR_C45 ) +return -EOPNOTSUPP ; + rc =sja1105_xfer_u32 (priv,SPI_READ , regs->mdio_100base_tx + reg, &tmp,NULL );if (rc <0 )
@@ -272,6 +275,9 @@ static int sja1105_base_tx_mdio_write(struct mii_bus *bus, int phy, int reg,const struct sja1105_regs *regs = priv->info->regs;u32 tmp = val; +if (reg &MII_ADDR_C45 ) +return -EOPNOTSUPP ; +return sja1105_xfer_u32 (priv,SPI_WRITE , regs->mdio_100base_tx + reg, &tmp,NULL ); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 79/289 nfc/nci: fix race with opening and closing
In reply to Greg Kroah-HartmanFrom: Lin Ma <[email protected]>
[ Upstream commit 0ad6bded175e829c2ca261529c9dce39a32a042d ]
Previously we leverage NCI_UNREG and the lock inside nci_close_device to prevent the race condition between opening a device and closing a device. However, it still has problem because a failed opening command will erase the NCI_UNREG flag and allow another opening command to bypass the status checking.
This fix corrects that by making sure the NCI_UNREG is held.
--- net/nfc/nci/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/nfc/nci/core.c +1 -1
@@ -542,7 +542,7 @@ static int nci_open_device(struct nci_dev *ndev)skb_queue_purge (&ndev->tx_q); ndev->ops->close (ndev); - ndev->flags =0 ; + ndev->flags &=BIT (NCI_UNREG ); } done:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 80/289 net: pch_gbe: fix potential memleak in pch_gbe_tx_queue()
In reply to Greg Kroah-HartmanFrom: Wang Hai <[email protected]>
[ Upstream commit 2360f9b8c4e81d242d4cbf99d630a2fffa681fab ]
In pch_gbe_xmit_frame(), NETDEV_TX_OK will be returned whether pch_gbe_tx_queue() sends data successfully or not, so pch_gbe_tx_queue() needs to free skb before returning. But pch_gbe_tx_queue() returns without freeing skb in case of dma_map_single() fails. Add dev_kfree_skb_any() to fix it.
--- drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c +1 -0
@@ -1143,6 +1143,7 @@ static void pch_gbe_tx_queue(struct pch_gbe_adapter *adapter, buffer_info->dma =0 ; buffer_info->time_stamp =0 ; tx_ring->next_to_use = ring_num; +dev_kfree_skb_any (skb);return ; } buffer_info->mapped = true;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 81/289 9p/fd: fix issue of list_del corruption in p9_fd_cancel()
In reply to Greg Kroah-HartmanFrom: Zhengchao Shao <[email protected]>
[ Upstream commit 11c10956515b8ec44cf4f2a7b9d8bf8b9dc05ec4 ]
Syz reported the following issue:
kernel BUG at lib/list_debug.c:53!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
RIP: 0010:__list_del_entry_valid.cold+0x5c/0x72 Call Trace: <TASK> p9_fd_cancel+0xb1/0x270 p9_client_rpc+0x8ea/0xba0 p9_client_create+0x9c0/0xed0 v9fs_session_init+0x1e0/0x1620 v9fs_mount+0xba/0xb80 legacy_get_tree+0x103/0x200 vfs_get_tree+0x89/0x2d0 path_mount+0x4c0/0x1ac0 __x64_sys_mount+0x33b/0x430 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK>
The process is as follows:
Thread A: Thread B:p9_poll_workfn() p9_client_create()
... ...
p9_conn_cancel() p9_fd_cancel()
list_del() ...
... list_del() //list_del
corruption
There is no lock protection when deleting list in p9_conn_cancel(). After deleting list in Thread A, thread B will delete the same list again. It will cause issue of list_del corruption.
Setting req->status to REQ_STATUS_ERROR under lock prevents other cleanup paths from trying to manipulate req_list.
The other thread can safely check req->status because it still holds a reference to req at this point.
--- net/9p/trans_fd.c | 2 ++ 1 file changed, 2 insertions(+)
net/9p/trans_fd.c +2 -0
@@ -202,9 +202,11 @@ static void p9_conn_cancel(struct p9_conn *m, int err)list_for_each_entry_safe (req, rtmp, &m->req_list, req_list) {list_move (&req->req_list, &cancel_list); + req->status =REQ_STATUS_ERROR ; }list_for_each_entry_safe (req, rtmp, &m->unsent_req_list, req_list) {list_move (&req->req_list, &cancel_list); + req->status =REQ_STATUS_ERROR ; }spin_unlock (&m->req_lock);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 82/289 netfilter: conntrack: Fix data-races around ct mark
In reply to Greg Kroah-HartmanFrom: Daniel Xu <[email protected]>
[ Upstream commit 52d1aa8b8249ff477aaa38b6f74a8ced780d079c ]
nf_conn:mark can be read from and written to in parallel. Use READ_ONCE()/WRITE_ONCE() for reads and writes to prevent unwanted compiler optimizations.
--- net/core/flow_dissector.c | 2 +- net/ipv4/netfilter/ipt_CLUSTERIP.c | 4 ++-- net/netfilter/nf_conntrack_core.c | 2 +- net/netfilter/nf_conntrack_netlink.c | 24 ++++++++++++++---------- net/netfilter/nf_conntrack_standalone.c | 2 +- net/netfilter/nft_ct.c | 6 +++--- net/netfilter/xt_connmark.c | 18 ++++++++++-------- net/openvswitch/conntrack.c | 8 ++++---- net/sched/act_connmark.c | 4 ++-- net/sched/act_ct.c | 8 ++++---- net/sched/act_ctinfo.c | 6 +++--- 11 files changed, 45 insertions(+), 39 deletions(-)
net/core/flow_dissector.c +1 -1
@@ -272,7 +272,7 @@ skb_flow_dissect_ct(const struct sk_buff *skb, key->ct_zone = ct->zone.id;#endif #if IS_ENABLED (CONFIG_NF_CONNTRACK_MARK ) - key->ct_mark = ct->mark; + key->ct_mark =READ_ONCE (ct->mark);#endif cl =nf_ct_labels_find (ct);
net/ipv4/netfilter/ipt_CLUSTERIP.c +2 -2
@@ -435,7 +435,7 @@ clusterip_tg(struct sk_buff *skb, const struct xt_action_param *par)switch (ctinfo) {case IP_CT_NEW : - ct->mark = hash; +WRITE_ONCE (ct->mark, hash);break ;case IP_CT_RELATED :case IP_CT_RELATED_REPLY :
@@ -452,7 +452,7 @@ clusterip_tg(struct sk_buff *skb, const struct xt_action_param *par)#ifdef DEBUG nf_ct_dump_tuple_ip (&ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple);#endif -pr_debug ("hash=%u ct_hash=%u " , hash, ct->mark); +pr_debug ("hash=%u ct_hash=%u " , hash,READ_ONCE (ct->mark));if (!clusterip_responsible (cipinfo->config, hash)) {pr_debug ("not responsible\n" );return NF_DROP ;
net/netfilter/nf_conntrack_core.c +1 -1
@@ -1781,7 +1781,7 @@ init_conntrack(struct net *net, struct nf_conn *tmpl, }#ifdef CONFIG_NF_CONNTRACK_MARK - ct->mark = exp->master->mark; + ct->mark =READ_ONCE (exp->master->mark);#endif #ifdef CONFIG_NF_CONNTRACK_SECMARK ct->secmark = exp->master->secmark;
net/netfilter/nf_conntrack_netlink.c +14 -10
@@ -328,9 +328,9 @@ ctnetlink_dump_timestamp(struct sk_buff *skb, const struct nf_conn *ct) }#ifdef CONFIG_NF_CONNTRACK_MARK -static int ctnetlink_dump_mark (struct sk_buff *skb,const struct nf_conn *ct) +static int ctnetlink_dump_mark (struct sk_buff *skb,u32 mark) { -if (nla_put_be32 (skb,CTA_MARK ,htonl (ct->mark))) +if (nla_put_be32 (skb,CTA_MARK ,htonl (mark))) goto nla_put_failure;return 0 ;
@@ -543,7 +543,7 @@ static int ctnetlink_dump_extinfo(struct sk_buff *skb,static int ctnetlink_dump_info (struct sk_buff *skb,struct nf_conn *ct) { if (ctnetlink_dump_status(skb, ct) < 0 || - ctnetlink_dump_mark(skb, ct) < 0 || + ctnetlink_dump_mark(skb, READ_ONCE(ct->mark)) < 0 || ctnetlink_dump_secctx(skb, ct) < 0 || ctnetlink_dump_id(skb, ct) < 0 || ctnetlink_dump_use(skb, ct) < 0 ||
@@ -722,6 +722,7 @@ ctnetlink_conntrack_event(unsigned int events, const struct nf_ct_event *item)struct sk_buff *skb;unsigned int type;unsigned int flags =0 , group; +u32 mark;int err;if (events & (1 <<IPCT_DESTROY )) {
@@ -826,8 +827,9 @@ ctnetlink_conntrack_event(unsigned int events, const struct nf_ct_event *item) }#ifdef CONFIG_NF_CONNTRACK_MARK -if ((events & (1 <<IPCT_MARK ) || ct->mark) - &&ctnetlink_dump_mark (skb, ct) <0 ) + mark =READ_ONCE (ct->mark); +if ((events & (1 <<IPCT_MARK ) || mark) && +ctnetlink_dump_mark (skb, mark) <0 ) goto nla_put_failure;#endif nlmsg_end (skb, nlh);
@@ -1154,7 +1156,7 @@ static int ctnetlink_filter_match(struct nf_conn *ct, void *data) }#ifdef CONFIG_NF_CONNTRACK_MARK -if ((ct->mark & filter->mark.mask) != filter->mark.val) +if ((READ_ONCE (ct->mark) & filter->mark.mask) != filter->mark.val) goto ignore_entry;#endif status = (u32 )READ_ONCE (ct->status);
@@ -2002,9 +2004,9 @@ static void ctnetlink_change_mark(struct nf_conn *ct, mask = ~ntohl (nla_get_be32 (cda[CTA_MARK_MASK ])); mark =ntohl (nla_get_be32 (cda[CTA_MARK ])); - newmark = (ct->mark & mask) ^ mark; -if (newmark != ct->mark) - ct->mark = newmark; + newmark = (READ_ONCE (ct->mark) & mask) ^ mark; +if (newmark !=READ_ONCE (ct->mark)) + WRITE_ONCE(ct->mark, newmark); }#endif
@@ -2669,6 +2671,7 @@ static int __ctnetlink_glue_build(struct sk_buff *skb, struct nf_conn *ct) {const struct nf_conntrack_zone *zone;struct nlattr *nest_parms; +u32 mark; zone =nf_ct_zone (ct);
@@ -2730,7 +2733,8 @@ static int __ctnetlink_glue_build(struct sk_buff *skb, struct nf_conn *ct) goto nla_put_failure;#ifdef CONFIG_NF_CONNTRACK_MARK -if (ct->mark &&ctnetlink_dump_mark (skb, ct) <0 ) + mark =READ_ONCE (ct->mark); +if (mark &&ctnetlink_dump_mark (skb, mark) <0 ) goto nla_put_failure;#endif if (ctnetlink_dump_labels (skb, ct) <0 )
net/netfilter/nf_conntrack_standalone.c +1 -1
@@ -366,7 +366,7 @@ static int ct_seq_show(struct seq_file *s, void *v) goto release;#if defined(CONFIG_NF_CONNTRACK_MARK ) -seq_printf (s,"mark=%u " , ct->mark); +seq_printf (s,"mark=%u " ,READ_ONCE (ct->mark));#endif ct_show_secctx (s, ct);
net/netfilter/nft_ct.c +3 -3
@@ -98,7 +98,7 @@ static void nft_ct_get_eval(const struct nft_expr *expr,return ;#ifdef CONFIG_NF_CONNTRACK_MARK case NFT_CT_MARK : - *dest = ct->mark; + *dest =READ_ONCE (ct->mark);return ;#endif #ifdef CONFIG_NF_CONNTRACK_SECMARK
@@ -297,8 +297,8 @@ static void nft_ct_set_eval(const struct nft_expr *expr,switch (priv->key) {#ifdef CONFIG_NF_CONNTRACK_MARK case NFT_CT_MARK : -if (ct->mark != value) { - ct->mark = value; +if (READ_ONCE (ct->mark) != value) { +WRITE_ONCE (ct->mark, value);nf_conntrack_event_cache (IPCT_MARK , ct); }break ;
net/netfilter/xt_connmark.c +10 -8
@@ -30,6 +30,7 @@ connmark_tg_shift(struct sk_buff *skb, const struct xt_connmark_tginfo2 *info)u_int32_t new_targetmark;struct nf_conn *ct;u_int32_t newmark; +u_int32_t oldmark; ct =nf_ct_get (skb, &ctinfo);if (ct ==NULL )
@@ -37,14 +38,15 @@ connmark_tg_shift(struct sk_buff *skb, const struct xt_connmark_tginfo2 *info)switch (info->mode) {case XT_CONNMARK_SET : - newmark = (ct->mark & ~info->ctmask) ^ info->ctmark; + oldmark =READ_ONCE (ct->mark); + newmark = (oldmark & ~info->ctmask) ^ info->ctmark;if (info->shift_dir ==D_SHIFT_RIGHT ) newmark >>= info->shift_bits;else newmark <<= info->shift_bits; -if (ct->mark != newmark) { - ct->mark = newmark; +if (READ_ONCE (ct->mark) != newmark) { +WRITE_ONCE (ct->mark, newmark);nf_conntrack_event_cache (IPCT_MARK , ct); }break ;
@@ -55,15 +57,15 @@ connmark_tg_shift(struct sk_buff *skb, const struct xt_connmark_tginfo2 *info)else new_targetmark <<= info->shift_bits; - newmark = (ct->mark & ~info->ctmask) ^ + newmark = (READ_ONCE (ct->mark) & ~info->ctmask) ^ new_targetmark; -if (ct->mark != newmark) { - ct->mark = newmark; +if (READ_ONCE (ct->mark) != newmark) { +WRITE_ONCE (ct->mark, newmark);nf_conntrack_event_cache (IPCT_MARK , ct); }break ;case XT_CONNMARK_RESTORE : - new_targetmark = (ct->mark & info->ctmask); + new_targetmark = (READ_ONCE (ct->mark) & info->ctmask);if (info->shift_dir ==D_SHIFT_RIGHT ) new_targetmark >>= info->shift_bits;else
@@ -126,7 +128,7 @@ connmark_mt(const struct sk_buff *skb, struct xt_action_param *par)if (ct ==NULL )return false; -return ((ct->mark & info->mask) == info->mark) ^ info->invert; +return ((READ_ONCE (ct->mark) & info->mask) == info->mark) ^ info->invert; }static int connmark_mt_check (const struct xt_mtchk_param *par)
net/openvswitch/conntrack.c +4 -4
@@ -152,7 +152,7 @@ static u8 ovs_ct_get_state(enum ip_conntrack_info ctinfo)static u32 ovs_ct_get_mark (const struct nf_conn *ct) {#if IS_ENABLED (CONFIG_NF_CONNTRACK_MARK ) -return ct ? ct->mark :0 ; +return ct ?READ_ONCE (ct->mark) :0 ;#else return 0 ;#endif
@@ -340,9 +340,9 @@ static int ovs_ct_set_mark(struct nf_conn *ct, struct sw_flow_key *key,#if IS_ENABLED (CONFIG_NF_CONNTRACK_MARK )u32 new_mark; - new_mark = ct_mark | (ct->mark & ~(mask)); -if (ct->mark != new_mark) { - ct->mark = new_mark; + new_mark = ct_mark | (READ_ONCE (ct->mark) & ~(mask)); +if (READ_ONCE (ct->mark) != new_mark) { +WRITE_ONCE (ct->mark, new_mark);if (nf_ct_is_confirmed (ct))nf_conntrack_event_cache (IPCT_MARK , ct); key->ct.mark = new_mark;
net/sched/act_connmark.c +2 -2
@@ -62,7 +62,7 @@ static int tcf_connmark_act(struct sk_buff *skb, const struct tc_action *a, c =nf_ct_get (skb, &ctinfo);if (c) { - skb->mark = c->mark; + skb->mark =READ_ONCE (c->mark);/* using overlimits stats to count how many packets marked */ ca->tcf_qstats.overlimits++; goto out;
@@ -82,7 +82,7 @@ static int tcf_connmark_act(struct sk_buff *skb, const struct tc_action *a, c =nf_ct_tuplehash_to_ctrack (thash);/* using overlimits stats to count how many packets marked */ ca->tcf_qstats.overlimits++; - skb->mark = c->mark; + skb->mark =READ_ONCE (c->mark);nf_ct_put (c); out:
net/sched/act_ct.c +4 -4
@@ -178,7 +178,7 @@ static void tcf_ct_flow_table_add_action_meta(struct nf_conn *ct, entry =tcf_ct_flow_table_flow_action_get_next (action); entry->id =FLOW_ACTION_CT_METADATA ;#if IS_ENABLED (CONFIG_NF_CONNTRACK_MARK ) - entry->ct_metadata.mark = ct->mark; + entry->ct_metadata.mark =READ_ONCE (ct->mark);#endif ctinfo = dir ==IP_CT_DIR_ORIGINAL ?IP_CT_ESTABLISHED :IP_CT_ESTABLISHED_REPLY ;
@@ -940,9 +940,9 @@ static void tcf_ct_act_set_mark(struct nf_conn *ct, u32 mark, u32 mask)if (!mask)return ; - new_mark = mark | (ct->mark & ~(mask)); -if (ct->mark != new_mark) { - ct->mark = new_mark; + new_mark = mark | (READ_ONCE (ct->mark) & ~(mask)); +if (READ_ONCE (ct->mark) != new_mark) { +WRITE_ONCE (ct->mark, new_mark);if (nf_ct_is_confirmed (ct))nf_conntrack_event_cache (IPCT_MARK , ct); }
net/sched/act_ctinfo.c +3 -3
@@ -33,7 +33,7 @@ static void tcf_ctinfo_dscp_set(struct nf_conn *ct, struct tcf_ctinfo *ca, {u8 dscp, newdscp; - newdscp = (((ct->mark & cp->dscpmask) >> cp->dscpmaskshift) <<2 ) & + newdscp = (((READ_ONCE (ct->mark) & cp->dscpmask) >> cp->dscpmaskshift) <<2 ) & ~INET_ECN_MASK ;switch (proto) {
@@ -73,7 +73,7 @@ static void tcf_ctinfo_cpmark_set(struct nf_conn *ct, struct tcf_ctinfo *ca, struct sk_buff *skb) { ca->stats_cpmark_set++; - skb->mark = ct->mark & cp->cpmarkmask; + skb->mark =READ_ONCE (ct->mark) & cp->cpmarkmask; } static int tcf_ctinfo_act(struct sk_buff *skb, const struct tc_action *a,
@@ -131,7 +131,7 @@ static int tcf_ctinfo_act(struct sk_buff *skb, const struct tc_action *a, }if (cp->mode &CTINFO_MODE_DSCP ) -if (!cp->dscpstatemask || (ct->mark & cp->dscpstatemask)) +if (!cp->dscpstatemask || (READ_ONCE (ct->mark) & cp->dscpstatemask))tcf_ctinfo_dscp_set (ct, ca, cp, skb, wlen, proto);if (cp->mode &CTINFO_MODE_CPMARK )
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 83/289 netfilter: nf_tables: do not set up extensions for end interval
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 33c7aba0b4ffd6d7cdab862a034eb582a5120a38 ]
Elements with an end interval flag set on do not store extensions. The global set definition is currently setting on the timeout and stateful expression for end interval elements.
This leads to skipping end interval elements from the set->ops->walk() path as the expired check bogusly reports true.
Moreover, do not set up stateful expressions for elements with end interval flag set on since this is never used.
--- net/netfilter/nf_tables_api.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/netfilter/nf_tables_api.c +4 -2
@@ -5958,7 +5958,8 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, &timeout);if (err)return err; - }else if (set->flags &NFT_SET_TIMEOUT ) { + }else if (set->flags &NFT_SET_TIMEOUT && + !(flags &NFT_SET_ELEM_INTERVAL_END )) { timeout = set->timeout; }
@@ -6024,7 +6025,8 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, err = -EOPNOTSUPP ; goto err_set_elem_expr; } - }else if (set->num_exprs >0 ) { + }else if (set->num_exprs >0 && + !(flags &NFT_SET_ELEM_INTERVAL_END )) { err =nft_set_elem_expr_clone (ctx, set, expr_array);if (err <0 ) goto err_set_elem_expr_clone;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 84/289 iavf: Fix a crash during reset task
In reply to Greg Kroah-HartmanFrom: Ivan Vecera <[email protected]>
[ Upstream commit c678669d6b13b77de3b99b97526aaf23c3088d0a ]
Recent commit aa626da947e9 ("iavf: Detach device during reset task") removed netif_tx_stop_all_queues() with an assumption that Tx queues are already stopped by netif_device_detach() in the beginning of reset task. This assumption is incorrect because during reset task a potential link event can start Tx queues again. Revert this change to fix this issue.
Reproducer:
1. Run some Tx traffic (e.g. iperf3) over iavf interface
2. Switch MTU of this interface in a loop
[root@host ~]# cat repro.sh
IF=enp2s0f0v0
iperf3 -c 192.168.0.1 -t 600 --logfile /dev/null & sleep 2
while :; do
for i in 1280 1500 2000 900 ; do
ip link set $IF mtu $i
sleep 2
done
done
[root@host ~]# ./repro.sh
Result:
[ 306.199917] iavf 0000:02:02.0 enp2s0f0v0: NIC Link is Up Speed is 40 Gbps Full Duplex [ 308.205944] iavf 0000:02:02.0 enp2s0f0v0: NIC Link is Up Speed is 40 Gbps Full Duplex [ 310.103223] BUG: kernel NULL pointer dereference, address: 0000000000000008 [ 310.110179] #PF: supervisor write access in kernel mode [ 310.115396] #PF: error_code(0x0002) - not-present page [ 310.120526] PGD 0 P4D 0 [ 310.123057] Oops: 0002 [#1] PREEMPT SMP NOPTI [ 310.127408] CPU: 24 PID: 183 Comm: kworker/u64:9 Kdump: loaded Not tainted 6.1.0-rc3+ #2 [ 310.135485] Hardware name: Abacus electric, s.r.o. - [email protected] Super Server/H12SSW-iN, BIOS 2.4 04/13/2022 [ 310.145728] Workqueue: iavf iavf_reset_task [iavf] [ 310.150520] RIP: 0010:iavf_xmit_frame_ring+0xd1/0xf70 [iavf] [ 310.156180] Code: d0 0f 86 da 00 00 00 83 e8 01 0f b7 fa 29 f8 01 c8 39 c6 0f 8f a0 08 00 00 48 8b 45 20 48 8d 14 92 bf 01 00 00 00 4c 8d 3c d0 <49> 89 5f 08 8b 43 70 66 41 89 7f 14 41 89 47 10 f6 83 82 00 00 00 [ 310.174918] RSP: 0018:ffffbb5f0082caa0 EFLAGS: 00010293 [ 310.180137] RAX: 0000000000000000 RBX: ffff92345471a6e8 RCX: 0000000000000200 [ 310.187259] RDX: 0000000000000000 RSI: 000000000000000d RDI: 0000000000000001 [ 310.194385] RBP: ffff92341d249000 R08: ffff92434987fcac R09: 0000000000000001 [ 310.201509] R10: 0000000011f683b9 R11: 0000000011f50641 R12: 0000000000000008 [ 310.208631] R13: ffff923447500000 R14: 0000000000000000 R15: 0000000000000000 [ 310.215756] FS: 0000000000000000(0000) GS:ffff92434ee00000(0000) knlGS:0000000000000000 [ 310.223835] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 310.229572] CR2: 0000000000000008 CR3: 0000000fbc210004 CR4: 0000000000770ee0 [ 310.236696] PKRU: 55555554 [ 310.239399] Call Trace: [ 310.241844] <IRQ> [ 310.243855] ? dst_alloc+0x5b/0xb0 [ 310.247260] dev_hard_start_xmit+0x9e/0x1f0 [ 310.251439] sch_direct_xmit+0xa0/0x370 [ 310.255276] __qdisc_run+0x13e/0x580 [ 310.258848] __dev_queue_xmit+0x431/0xd00 [ 310.262851] ? selinux_ip_postroute+0x147/0x3f0 [ 310.267377] ip_finish_output2+0x26c/0x540
--- drivers/net/ethernet/intel/iavf/iavf_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/intel/iavf/iavf_main.c +1 -0
@@ -3033,6 +3033,7 @@ static void iavf_reset_task(struct work_struct *work)if (running) {netif_carrier_off (netdev); +netif_tx_stop_all_queues (netdev); adapter->link_up = false;iavf_napi_disable_all (adapter); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 85/289 iavf: Do not restart Tx queues after reset task failure
In reply to Greg Kroah-HartmanFrom: Ivan Vecera <[email protected]>
[ Upstream commit 08f1c147b7265245d67321585c68a27e990e0c4b ]
After commit aa626da947e9 ("iavf: Detach device during reset task") the device is detached during reset task and re-attached at its end. The problem occurs when reset task fails because Tx queues are restarted during device re-attach and this leads later to a crash.
To resolve this issue properly close the net device in cause of failure in reset task to avoid restarting of tx queues at the end. Also replace the hacky manipulation with IFF_UP flag by device close that clears properly both IFF_UP and __LINK_STATE_START flags. In these case iavf_close() does not do anything because the adapter state is already __IAVF_DOWN.
Reproducer:
1) Run some Tx traffic (e.g. iperf3) over iavf interface
2) Set VF trusted / untrusted in loop
[root@host ~]# cat repro.sh
PF=enp65s0f0
IF=${PF}v0
ip link set up $IF
ip addr add 192.168.0.2/24 dev $IF
sleep 1
iperf3 -c 192.168.0.1 -t 600 --logfile /dev/null & sleep 2
while :; do
ip link set $PF vf 0 trust on
ip link set $PF vf 0 trust off
done
[root@host ~]# ./repro.sh
Result:
[ 2006.650969] iavf 0000:41:01.0: Failed to init adminq: -53 [ 2006.675662] ice 0000:41:00.0: VF 0 is now trusted [ 2006.689997] iavf 0000:41:01.0: Reset task did not complete, VF disabled [ 2006.696611] iavf 0000:41:01.0: failed to allocate resources during reinit [ 2006.703209] ice 0000:41:00.0: VF 0 is now untrusted [ 2006.737011] ice 0000:41:00.0: VF 0 is now trusted [ 2006.764536] ice 0000:41:00.0: VF 0 is now untrusted [ 2006.768919] BUG: kernel NULL pointer dereference, address: 0000000000000b4a [ 2006.776358] #PF: supervisor read access in kernel mode [ 2006.781488] #PF: error_code(0x0000) - not-present page [ 2006.786620] PGD 0 P4D 0 [ 2006.789152] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 2006.792903] ice 0000:41:00.0: VF 0 is now trusted [ 2006.793501] CPU: 4 PID: 0 Comm: swapper/4 Kdump: loaded Not tainted 6.1.0-rc3+ #2 [ 2006.805668] Hardware name: Abacus electric, s.r.o. - [email protected] Super Server/H12SSW-iN, BIOS 2.4 04/13/2022 [ 2006.815915] RIP: 0010:iavf_xmit_frame_ring+0x96/0xf70 [iavf] [ 2006.821028] ice 0000:41:00.0: VF 0 is now untrusted [ 2006.821572] Code: 48 83 c1 04 48 c1 e1 04 48 01 f9 48 83 c0 10 6b 50 f8 55 c1 ea 14 45 8d 64 14 01 48 39 c8 75 eb 41 83 fc 07 0f 8f e9 08 00 00 <0f> b7 45 4a 0f b7 55 48 41 8d 74 24 05 31 c9 66 39 d0 0f 86 da 00 [ 2006.845181] RSP: 0018:ffffb253004bc9e8 EFLAGS: 00010293 [ 2006.850397] RAX: ffff9d154de45b00 RBX: ffff9d15497d52e8 RCX: ffff9d154de45b00 [ 2006.856327] ice 0000:41:00.0: VF 0 is now trusted [ 2006.857523] RDX: 0000000000000000 RSI: 00000000000005a8 RDI: ffff9d154de45ac0 [ 2006.857525] RBP: 0000000000000b00 R08: ffff9d159cb010ac R09: 0000000000000001 [ 2006.857526] R10: ffff9d154de45940 R11: 0000000000000000 R12: 0000000000000002 [ 2006.883600] R13: ffff9d1770838dc0 R14: 0000000000000000 R15: ffffffffc07b8380 [ 2006.885840] ice 0000:41:00.0: VF 0 is now untrusted [ 2006.890725] FS: 0000000000000000(0000) GS:ffff9d248e900000(0000) knlGS:0000000000000000 [ 2006.890727] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2006.909419] CR2: 0000000000000b4a CR3: 0000000c39c10002 CR4: 0000000000770ee0 [ 2006.916543] PKRU: 55555554 [ 2006.918254] ice 0000:41:00.0: VF 0 is now trusted [ 2006.919248] Call Trace: [ 2006.919250] <IRQ> [ 2006.919252] dev_hard_start_xmit+0x9e/0x1f0 [ 2006.932587] sch_direct_xmit+0xa0/0x370 [ 2006.936424] __dev_queue_xmit+0x7af/0xd00 [ 2006.940429] ip_finish_output2+0x26c/0x540 [ 2006.944519] ip_output+0x71/0x110 [ 2006.947831] ? __ip_finish_output+0x2b0/0x2b0 [ 2006.952180] __ip_queue_xmit+0x16d/0x400 [ 2006.952721] ice 0000:41:00.0: VF 0 is now untrusted [ 2006.956098] __tcp_transmit_skb+0xa96/0xbf0 [ 2006.965148] __tcp_retransmit_skb+0x174/0x860 [ 2006.969499] ? cubictcp_cwnd_event+0x40/0x40 [ 2006.973769] tcp_retransmit_skb+0x14/0xb0
...
--- drivers/net/ethernet/intel/iavf/iavf_main.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/iavf/iavf_main.c +15 -1
@@ -2921,7 +2921,6 @@ static void iavf_disable_vf(struct iavf_adapter *adapter)iavf_free_queues (adapter);memset (adapter->vf_res,0 ,IAVF_VIRTCHNL_VF_RESOURCE_SIZE );iavf_shutdown_adminq (&adapter->hw); - adapter->netdev->flags &= ~IFF_UP ; adapter->flags &= ~IAVF_FLAG_RESET_PENDING ;iavf_change_state (adapter, __IAVF_DOWN);wake_up (&adapter->down_waitqueue);
@@ -3021,6 +3020,11 @@ static void iavf_reset_task(struct work_struct *work)iavf_disable_vf (adapter);mutex_unlock (&adapter->client_lock);mutex_unlock (&adapter->crit_lock); +if (netif_running (netdev)) { +rtnl_lock (); +dev_close (netdev); +rtnl_unlock (); + }return ;/* Do not attempt to reinit. It's dead, Jim. */ }
@@ -3173,6 +3177,16 @@ static void iavf_reset_task(struct work_struct *work)mutex_unlock (&adapter->client_lock);mutex_unlock (&adapter->crit_lock); + +if (netif_running (netdev)) { +/* Close device to ensure that Tx queues will not be started +* during netif_device_attach() at the end of the reset task. +*/ +rtnl_lock (); +dev_close (netdev); +rtnl_unlock (); + } +dev_err (&adapter->pdev->dev,"failed to allocate resources during reinit\n" ); reset_finish:rtnl_lock ();
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 86/289 iavf: remove INITIAL_MAC_SET to allow gARP to work properly
In reply to Greg Kroah-HartmanFrom: Stefan Assmann <[email protected]>
[ Upstream commit bb861c14f1b8cb9cbf03a132db7f22ec4e692b91 ]
IAVF_FLAG_INITIAL_MAC_SET prevents waiting on iavf_is_mac_set_handled() the first time the MAC is set. This breaks gratuitous ARP because the MAC address has not been updated yet when the gARP packet is sent out.
Current behaviour:
$ echo 1 > /sys/class/net/ens4f0/device/sriov_numvfs iavf 0000:88:02.0: MAC address: ee:04:19:14:ec:ea $ ip addr add 192.168.1.1/24 dev ens4f0v0 $ ip link set dev ens4f0v0 up $ echo 1 > /proc/sys/net/ipv4/conf/ens4f0v0/arp_notify $ ip link set ens4f0v0 addr 00:11:22:33:44:55 07:23:41.676611 ee:04:19:14:ec:ea > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 192.168.1.1 tell 192.168.1.1, length 28
With IAVF_FLAG_INITIAL_MAC_SET removed:
$ echo 1 > /sys/class/net/ens4f0/device/sriov_numvfs iavf 0000:88:02.0: MAC address: 3e:8a:16:a2:37:6d $ ip addr add 192.168.1.1/24 dev ens4f0v0 $ ip link set dev ens4f0v0 up $ echo 1 > /proc/sys/net/ipv4/conf/ens4f0v0/arp_notify $ ip link set ens4f0v0 addr 00:11:22:33:44:55 07:28:01.836608 00:11:22:33:44:55 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 192.168.1.1 tell 192.168.1.1, length 28
--- drivers/net/ethernet/intel/iavf/iavf.h | 1 - drivers/net/ethernet/intel/iavf/iavf_main.c | 8 -------- 2 files changed, 9 deletions(-)
drivers/net/ethernet/intel/iavf/iavf.h +0 -1
@@ -298,7 +298,6 @@ struct iavf_adapter {#define IAVF_FLAG_QUEUES_DISABLED BIT(17)#define IAVF_FLAG_SETUP_NETDEV_FEATURES BIT(18)#define IAVF_FLAG_REINIT_MSIX_NEEDED BIT(20) -#define IAVF_FLAG_INITIAL_MAC_SET BIT(23)/* duplicates for common code */ #define IAVF_FLAG_DCB_ENABLED 0/* flags for admin queue service task */
drivers/net/ethernet/intel/iavf/iavf_main.c +0 -8
@@ -1087,12 +1087,6 @@ static int iavf_set_mac(struct net_device *netdev, void *p)if (ret)return ret; -/* If this is an initial set MAC during VF spawn do not wait */ -if (adapter->flags &IAVF_FLAG_INITIAL_MAC_SET ) { - adapter->flags &= ~IAVF_FLAG_INITIAL_MAC_SET ; -return 0 ; - } - ret =wait_event_interruptible_timeout (adapter->vc_waitqueue,iavf_is_mac_set_handled (netdev, addr->sa_data),msecs_to_jiffies (2500 ));
@@ -2605,8 +2599,6 @@ static void iavf_init_config_adapter(struct iavf_adapter *adapter)ether_addr_copy (netdev->perm_addr, adapter->hw.mac.addr); } - adapter->flags |=IAVF_FLAG_INITIAL_MAC_SET ; - adapter->tx_desc_count =IAVF_DEFAULT_TXD ; adapter->rx_desc_count =IAVF_DEFAULT_RXD ; err =iavf_init_interrupt_scheme (adapter);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 87/289 iavf: Fix race condition between iavf_shutdown and iavf_remove
In reply to Greg Kroah-HartmanFrom: Slawomir Laba <[email protected]>
[ Upstream commit a8417330f8a57275ed934293e832982b6d882713 ]
Fix a deadlock introduced by commit974578017fc1 ("iavf: Add waiting so the port is initialized in remove") due to race condition between iavf_shutdown and iavf_remove, where iavf_remove stucks forever in while loop since iavf_shutdown already set __IAVF_REMOVE adapter state.
Fix this by checking if the __IAVF_IN_REMOVE_TASK has already been set and return if so.
--- drivers/net/ethernet/intel/iavf/iavf_main.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-)
drivers/net/ethernet/intel/iavf/iavf_main.c +7 -9
@@ -5042,23 +5042,21 @@ static int __maybe_unused iavf_resume(struct device *dev_d)static void iavf_remove (struct pci_dev *pdev) {struct iavf_adapter *adapter =iavf_pdev_to_adapter (pdev); -struct net_device *netdev = adapter->netdev;struct iavf_fdir_fltr *fdir, *fdirtmp;struct iavf_vlan_filter *vlf, *vlftmp; +struct iavf_cloud_filter *cf, *cftmp;struct iavf_adv_rss *rss, *rsstmp;struct iavf_mac_filter *f, *ftmp; -struct iavf_cloud_filter *cf, *cftmp; -struct iavf_hw *hw = &adapter->hw; +struct net_device *netdev; +struct iavf_hw *hw;int err; -/* When reboot/shutdown is in progress no need to do anything -* as the adapter is already REMOVE state that was set during -* iavf_shutdown() callback. -*/ -if (adapter->state == __IAVF_REMOVE) + netdev = adapter->netdev; + hw = &adapter->hw; + +if (test_and_set_bit (__IAVF_IN_REMOVE_TASK, &adapter->crit_section))return ; -set_bit (__IAVF_IN_REMOVE_TASK, &adapter->crit_section);/* Wait until port initialization is complete. * There are flows where register/unregister netdev may race. */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 88/289 ARM: mxs: fix memory leak in mxs_machine_init()
In reply to Greg Kroah-HartmanFrom: Zheng Yongjun <[email protected]>
[ Upstream commit f31e3c204d1844b8680a442a48868af5ac3d5481 ]
If of_property_read_string() failed, 'soc_dev_attr' should be freed before return. Otherwise there is a memory leak.
--- arch/arm/mach-mxs/mach-mxs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/arm/mach-mxs/mach-mxs.c +3 -1
@@ -393,8 +393,10 @@ static void __init mxs_machine_init(void) root =of_find_node_by_path ("/" ); ret =of_property_read_string (root,"model" , &soc_dev_attr->machine); -if (ret) +if (ret) { +kfree (soc_dev_attr);return ; + } soc_dev_attr->family ="Freescale MXS Family" ; soc_dev_attr->soc_id =mxs_get_soc_id ();
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 89/289 ARM: dts: imx6q-prti6q: Fix ref/tcxo-clock-frequency properties
In reply to Greg Kroah-HartmanFrom: Fabio Estevam <[email protected]>
[ Upstream commit e68be7b39f21d8a9291a5a3019787cd3ca999dd7 ]
make dtbs_check gives the following errors:
ref-clock-frequency: size (9) error for type uint32
tcxo-clock-frequency: size (9) error for type uint32
Fix it by passing the frequencies inside < > as documented in Documentation/devicetree/bindings/net/wireless/ti,wlcore.yaml.
--- arch/arm/boot/dts/imx6q-prti6q.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/imx6q-prti6q.dts +2 -2
@@ -364,8 +364,8 @@ wifi { pinctrl-names = "default"; pinctrl-0 = <&pinctrl_wifi>; interrupts-extended = <&gpio1 30 IRQ_TYPE_LEVEL_HIGH>; - ref-clock-frequency = "38400000"; - tcxo-clock-frequency = "19200000"; + ref-clock-frequency = <38400000>; + tcxo-clock-frequency = <19200000>; }; };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 90/289 net: ethernet: mtk_eth_soc: fix error handling in mtk_open()
In reply to Greg Kroah-HartmanFrom: Liu Jian <[email protected]>
[ Upstream commit f70074140524c59a0935947b06dd6cb6e1ea642d ]
If mtk_start_dma() fails, invoke phylink_disconnect_phy() to perform cleanup. phylink_disconnect_phy() contains the put_device action. If phylink_disconnect_phy is not performed, the Kref of netdev will leak.
--- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/mediatek/mtk_eth_soc.c +3 -1
@@ -2979,8 +2979,10 @@ static int mtk_open(struct net_device *dev)u32 gdm_config =MTK_GDMA_TO_PDMA ; err =mtk_start_dma (eth); -if (err) +if (err) { +phylink_disconnect_phy (mac->phylink);return err; + }if (eth->soc->offload_version &&mtk_ppe_start (eth->ppe) ==0 ) gdm_config =MTK_GDMA_TO_PPE ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 91/289 net/mlx4: Check retval of mlx4_bitmap_init
In reply to Greg Kroah-HartmanFrom: Peter Kosyh <[email protected]>
[ Upstream commit 594c61ffc77de0a197934aa0f1df9285c68801c6 ]
If mlx4_bitmap_init fails, mlx4_bitmap_alloc_range will dereference the NULL pointer (bitmap->table).
Make sure, that mlx4_bitmap_alloc_range called in no error case.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/ethernet/mellanox/mlx4/qp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx4/qp.c +2 -1
@@ -697,7 +697,8 @@ static int mlx4_create_zones(struct mlx4_dev *dev, err =mlx4_bitmap_init (*bitmap + k,1 ,MLX4_QP_TABLE_RAW_ETH_SIZE -1 ,0 ,0 ); -mlx4_bitmap_alloc_range (*bitmap + k,1 ,1 ,0 ); +if (!err) +mlx4_bitmap_alloc_range (*bitmap + k,1 ,1 ,0 ); }if (err)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 92/289 net: mvpp2: fix possible invalid pointer dereference
In reply to Greg Kroah-HartmanFrom: Hui Tang <[email protected]>
[ Upstream commit cbe867685386af1f0a2648f5279f6e4c74bfd17f ]
It will cause invalid pointer dereference to priv->cm3_base behind, if PTR_ERR(priv->cm3_base) in mvpp2_get_sram().
--- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +6 -2
@@ -7352,6 +7352,7 @@ static int mvpp2_get_sram(struct platform_device *pdev, struct mvpp2 *priv) {struct resource *res; +void __iomem *base; res =platform_get_resource (pdev,IORESOURCE_MEM ,2 );if (!res) {
@@ -7362,9 +7363,12 @@ static int mvpp2_get_sram(struct platform_device *pdev,return 0 ; } - priv->cm3_base =devm_ioremap_resource (&pdev->dev, res); + base =devm_ioremap_resource (&pdev->dev, res); +if (IS_ERR (base)) +return PTR_ERR (base); -return PTR_ERR_OR_ZERO (priv->cm3_base); + priv->cm3_base = base; +return 0 ; }static int mvpp2_probe (struct platform_device *pdev)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 93/289 net/qla3xxx: fix potential memleak in ql3xxx_send()
In reply to Greg Kroah-HartmanFrom: Zhang Changzhong <[email protected]>
[ Upstream commit 62a7311fb96c61d281da9852dbee4712fc8c3277 ]
The ql3xxx_send() returns NETDEV_TX_OK without freeing skb in error handling case, add dev_kfree_skb_any() to fix it.
--- drivers/net/ethernet/qlogic/qla3xxx.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/qlogic/qla3xxx.c +1 -0
@@ -2471,6 +2471,7 @@ static netdev_tx_t ql3xxx_send(struct sk_buff *skb, skb_shinfo(skb)->nr_frags);if (tx_cb->seg_count ==-1 ) {netdev_err (ndev,"%s: invalid segment count!\n" , __func__); +dev_kfree_skb_any (skb);return NETDEV_TX_OK ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 94/289 octeontx2-af: debugsfs: fix pci device refcount leak
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit d66608803aa2ffb9e475623343f69996305771ae ]
As comment of pci_get_domain_bus_and_slot() says, it returns a pci device with refcount increment, when finish using it, the caller must decrement the reference count by calling pci_dev_put().
So before returning from rvu_dbg_rvu_pf_cgx_map_display() or cgx_print_dmac_flt(), pci_dev_put() is called to avoid refcount leak.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c +3 -0
@@ -535,6 +535,8 @@ static int rvu_dbg_rvu_pf_cgx_map_display(struct seq_file *filp, void *unused)sprintf (lmac,"LMAC%d" , lmac_id);seq_printf (filp,"%s\t0x%x\t\tNIX%d\t\t%s\t%s\n" ,dev_name (&pdev->dev), pcifunc, blkid, cgx, lmac); + +pci_dev_put (pdev); }return 0 ; }
@@ -2221,6 +2223,7 @@ static int cgx_print_dmac_flt(struct seq_file *s, int lmac_id) } } +pci_dev_put (pdev);return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 95/289 net: pch_gbe: fix pci device refcount leak while module exiting
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 5619537284f1017e9f6c7500b02b859b3830a06d ]
As comment of pci_get_domain_bus_and_slot() says, it returns a pci device with refcount increment, when finish using it, the caller must decrement the reference count by calling pci_dev_put().
In pch_gbe_probe(), pci_get_domain_bus_and_slot() is called, so in error path in probe() and remove() function, pci_dev_put() should be called to avoid refcount leak. Compile tested only.
--- drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c +4 -1
@@ -2460,6 +2460,7 @@ static void pch_gbe_remove(struct pci_dev *pdev)unregister_netdev (netdev);pch_gbe_phy_hw_reset (&adapter->hw); +pci_dev_put (adapter->ptp_pdev);free_netdev (netdev); }
@@ -2535,7 +2536,7 @@ static int pch_gbe_probe(struct pci_dev *pdev,/* setup the private structure */ ret =pch_gbe_sw_init (adapter);if (ret) - goto err_free_netdev; + goto err_put_dev;/* Initialize PHY */ ret =pch_gbe_init_phy (adapter);
@@ -2593,6 +2594,8 @@ static int pch_gbe_probe(struct pci_dev *pdev, err_free_adapter:pch_gbe_phy_hw_reset (&adapter->hw); +err_put_dev: +pci_dev_put (adapter->ptp_pdev); err_free_netdev:free_netdev (netdev);return ret;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 96/289 nfp: fill splittable of devlink_port_attrs correctly
In reply to Greg Kroah-HartmanFrom: Diana Wang <[email protected]>
[ Upstream commit 4abd9600b9d15d3d92a9ac25cf200422a4c415ee ]
The error is reflected in that it shows wrong splittable status of port when executing "devlink port show".
The reason which leads the error is that the assigned operation of splittable is just a simple negation operation of split and it does not consider port lanes quantity. A splittable port should have several lanes that can be split(lanes quantity > 1).
If without the judgement, it will show wrong message for some firmware, such as 2x25G, 2x10G.
--- drivers/net/ethernet/netronome/nfp/nfp_devlink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/netronome/nfp/nfp_devlink.c +1 -1
@@ -341,7 +341,7 @@ int nfp_devlink_port_register(struct nfp_app *app, struct nfp_port *port)return ret; attrs.split = eth_port.is_split; - attrs.splittable = !attrs.split; + attrs.splittable = eth_port.port_lanes >1 && !attrs.split; attrs.lanes = eth_port.port_lanes; attrs.flavour =DEVLINK_PORT_FLAVOUR_PHYSICAL ; attrs.phys.port_number = eth_port.label_port;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 97/289 nfp: add port from netdev validation for EEPROM access
In reply to Greg Kroah-HartmanFrom: Jaco Coetzee <[email protected]>
[ Upstream commit 0873016d46f6dfafd1bdf4d9b935b3331b226f7c ]
Setting of the port flag NFP_PORT_CHANGED, introduced to ensure the correct reading of EEPROM data, causes a fatal kernel NULL pointer dereference in cases where the target netdev type cannot be determined.
Add validation of port struct pointer before attempting to set the NFP_PORT_CHANGED flag. Return that operation is not supported if the netdev type cannot be determined.
--- drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +3 -0
@@ -1395,6 +1395,9 @@ nfp_port_get_module_info(struct net_device *netdev,u8 data; port =nfp_port_from_netdev (netdev); +if (!port) +return -EOPNOTSUPP ; +/* update port state to get latest interface */ set_bit (NFP_PORT_CHANGED , &port->flags); eth_port =nfp_port_get_eth_port (port);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 98/289 bonding: fix ICMPv6 header handling when receiving IPv6 messages
In reply to Greg Kroah-HartmanFrom: Hangbin Liu <[email protected]>
[ Upstream commit 4d633d1b468b6eb107a81b2fd10b9debddca3d47 ]
Currently, we get icmp6hdr via function icmp6_hdr(), which needs the skb transport header to be set first. But there is no rule to ask driver set transport header before netif_receive_skb() and bond_handle_frame(). So we will not able to get correct icmp6hdr on some drivers.
Fix this by using skb_header_pointer to get the IPv6 and ICMPV6 headers.
--- drivers/net/bonding/bond_main.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
drivers/net/bonding/bond_main.c +12 -5
@@ -3231,16 +3231,23 @@ static int bond_na_rcv(const struct sk_buff *skb, struct bonding *bond, struct slave *slave) {struct slave *curr_active_slave, *curr_arp_slave; -struct icmp6hdr *hdr =icmp6_hdr (skb);struct in6_addr *saddr, *daddr; +struct { +struct ipv6hdr ip6; +struct icmp6hdr icmp6; + } *combined, _combined;if (skb->pkt_type ==PACKET_OTHERHOST || - skb->pkt_type ==PACKET_LOOPBACK || - hdr->icmp6_type !=NDISC_NEIGHBOUR_ADVERTISEMENT ) + skb->pkt_type ==PACKET_LOOPBACK ) + goto out; + + combined =skb_header_pointer (skb,0 ,sizeof (_combined), &_combined); +if (!combined || combined->ip6.nexthdr !=NEXTHDR_ICMP || + combined->icmp6.icmp6_type !=NDISC_NEIGHBOUR_ADVERTISEMENT ) goto out; - saddr = &ipv6_hdr (skb)->saddr; - daddr = &ipv6_hdr (skb)->daddr; + saddr = &combined->ip6.saddr; + daddr = &combined->ip6.saddr; slave_dbg(bond->dev, slave->dev, "%s: %s/%d av %d sv %d sip %pI6c tip %pI6c\n", __func__, slave->dev->name, bond_slave_state(slave),
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 99/289 macsec: Fix invalid error code set
In reply to Greg Kroah-HartmanFrom: YueHaibing <[email protected]>
[ Upstream commit 7cef6b73fba96abef731a53501924fc3c4a0f947 ]
'ret' is defined twice in macsec_changelink(), when it is set in macsec_is_offloaded case, it will be invalid before return.
--- drivers/net/macsec.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/macsec.c +0 -1
@@ -3855,7 +3855,6 @@ static int macsec_changelink(struct net_device *dev, struct nlattr *tb[],if (macsec_is_offloaded (macsec)) {const struct macsec_ops *ops;struct macsec_context ctx; -int ret; ops =macsec_get_ops (netdev_priv (dev), &ctx);if (!ops) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 100/289 drm/i915: Fix warn in intel_display_power_*_domain() functions
In reply to Greg Kroah-HartmanFrom: Imre Deak <[email protected]>
[ Upstream commit ebbaa4392e36521fb893973d8a0fcb32f3b6d5eb ]
The intel_display_power_*_domain() functions should always warn if a default domain is returned as a fallback, fix this up. Spotted by Ville.
--- drivers/gpu/drm/i915/display/intel_display_power.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/i915/display/intel_display_power.c +4 -4
@@ -2427,7 +2427,7 @@ intel_display_power_ddi_io_domain(struct drm_i915_private *i915, enum port port) {const struct intel_ddi_port_domains *domains =intel_port_domains_for_port (i915, port); -if (drm_WARN_ON (&i915->drm, !domains) || domains->ddi_io ==POWER_DOMAIN_INVALID ) +if (drm_WARN_ON (&i915->drm, !domains || domains->ddi_io ==POWER_DOMAIN_INVALID ))return POWER_DOMAIN_PORT_DDI_IO_A ;return domains->ddi_io + (int )(port - domains->port_start);
@@ -2438,7 +2438,7 @@ intel_display_power_ddi_lanes_domain(struct drm_i915_private *i915, enum port po {const struct intel_ddi_port_domains *domains =intel_port_domains_for_port (i915, port); -if (drm_WARN_ON (&i915->drm, !domains) || domains->ddi_lanes ==POWER_DOMAIN_INVALID ) +if (drm_WARN_ON (&i915->drm, !domains || domains->ddi_lanes ==POWER_DOMAIN_INVALID ))return POWER_DOMAIN_PORT_DDI_LANES_A ;return domains->ddi_lanes + (int )(port - domains->port_start);
@@ -2464,7 +2464,7 @@ intel_display_power_legacy_aux_domain(struct drm_i915_private *i915, enum aux_ch {const struct intel_ddi_port_domains *domains =intel_port_domains_for_aux_ch (i915, aux_ch); -if (drm_WARN_ON (&i915->drm, !domains) || domains->aux_legacy_usbc ==POWER_DOMAIN_INVALID ) +if (drm_WARN_ON (&i915->drm, !domains || domains->aux_legacy_usbc ==POWER_DOMAIN_INVALID ))return POWER_DOMAIN_AUX_A ;return domains->aux_legacy_usbc + (int )(aux_ch - domains->aux_ch_start);
@@ -2475,7 +2475,7 @@ intel_display_power_tbt_aux_domain(struct drm_i915_private *i915, enum aux_ch au {const struct intel_ddi_port_domains *domains =intel_port_domains_for_aux_ch (i915, aux_ch); -if (drm_WARN_ON (&i915->drm, !domains) || domains->aux_tbt ==POWER_DOMAIN_INVALID ) +if (drm_WARN_ON (&i915->drm, !domains || domains->aux_tbt ==POWER_DOMAIN_INVALID ))return POWER_DOMAIN_AUX_TBT1 ;return domains->aux_tbt + (int )(aux_ch - domains->aux_ch_start);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 101/289 Drivers: hv: vmbus: fix double free in the error path of vmbus_add_channel_work()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit f92a4b50f0bd7fd52391dc4bb9a309085d278f91 ]
In the error path of vmbus_device_register(), device_unregister() is called, which calls vmbus_device_release(). The latter frees the struct hv_device that was passed in to vmbus_device_register(). So remove the kfree() in vmbus_add_channel_work() to avoid a double free.
--- drivers/hv/channel_mgmt.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/hv/channel_mgmt.c +5 -1
@@ -533,13 +533,17 @@ static void vmbus_add_channel_work(struct work_struct *work)* Add the new device to the bus. This will kick off device-driver * binding which eventually invokes the device driver's AddDevice() * method. +* +* If vmbus_device_register() fails, the 'device_obj' is freed in +* vmbus_device_release() as called by device_unregister() in the +* error path of vmbus_device_register(). In the outside error +* path, there's no need to free it. */ ret =vmbus_device_register (newchannel->device_obj);if (ret !=0 ) {pr_err ("unable to add child device object (relid %d)\n" , newchannel->offermsg.child_relid); -kfree (newchannel->device_obj); goto err_deq_chan; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 102/289 Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 25c94b051592c010abe92c85b0485f1faedc83f3 ]
If device_register() returns error in vmbus_device_register(), the name allocated by dev_set_name() must be freed. As comment of device_register() says, it should use put_device() to give up the reference in the error path. So fix this by calling put_device(), then the name can be freed in kobject_cleanup().
--- drivers/hv/vmbus_drv.c | 1 + 1 file changed, 1 insertion(+)
drivers/hv/vmbus_drv.c +1 -0
@@ -2083,6 +2083,7 @@ int vmbus_device_register(struct hv_device *child_device_obj) ret =device_register (&child_device_obj->device);if (ret) {pr_err ("Unable to register child device\n" ); +put_device (&child_device_obj->device);return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 103/289 netfilter: ipset: regression in ip_set_hash_ip.c
In reply to Greg Kroah-HartmanFrom: Vishwanath Pai <[email protected]>
[ Upstream commit c7aa1a76d4a0a3c401025b60c401412bbb60f8c6 ]
This patch introduced a regression: commit 48596a8ddc46 ("netfilter:
ipset: Fix adding an IPv4 range containing more than 2^31 addresses")
The variable e.ip is passed to adtfn() function which finally adds the ip address to the set. The patch above refactored the for loop and moved e.ip = htonl(ip) to the end of the for loop.
What this means is that if the value of "ip" changes between the first assignement of e.ip and the forloop, then e.ip is pointing to a different ip address than "ip".
Test case:
$ ipset create jdtest_tmp hash:ip family inet hashsize 2048 maxelem 100000 $ ipset add jdtest_tmp 10.0.1.1/31 ipset v6.21.1: Element cannot be added to the set: it's already added
The value of ip gets updated inside the "else if (tb[IPSET_ATTR_CIDR])" block but e.ip is still pointing to the old value.
--- net/netfilter/ipset/ip_set_hash_ip.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
net/netfilter/ipset/ip_set_hash_ip.c +3 -5
@@ -151,18 +151,16 @@ hash_ip4_uadt(struct ip_set *set, struct nlattr *tb[],if (((u64 )ip_to - ip +1 ) >> (32 - h->netmask) >IPSET_MAX_RANGE )return -ERANGE ; -if (retried) { +if (retried) ip =ntohl (h->next.ip); - e.ip =htonl (ip); - }for (; ip <= ip_to;) { + e.ip =htonl (ip); ret =adtfn (set, &e, &ext, &ext, flags);if (ret && !ip_set_eexist (ret, flags))return ret; ip += hosts; - e.ip =htonl (ip); -if (e.ip ==0 ) +if (ip ==0 )return 0 ; ret =0 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 104/289 net/mlx5: Do not query pci info while pci disabled
In reply to Greg Kroah-HartmanFrom: Roy Novich <[email protected]>
[ Upstream commit 394164f9d5a3020a7fd719d228386d48d544ec67 ]
The driver should not interact with PCI while PCI is disabled. Trying to do so may result in being unable to get vital signs during PCI reset, driver gets timed out and fails to recover.
--- drivers/net/ethernet/mellanox/mlx5/core/main.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/main.c +6 -3
@@ -1759,7 +1759,8 @@ static pci_ers_result_t mlx5_pci_err_detected(struct pci_dev *pdev, res = state == pci_channel_io_perm_failure ?PCI_ERS_RESULT_DISCONNECT :PCI_ERS_RESULT_NEED_RESET ; -mlx5_pci_trace (dev,"Exit, result = %d, %s\n" , res,result2str (res)); +mlx5_core_info (dev,"%s Device state = %d pci_status: %d. Exit, result = %d, %s\n" , + __func__, dev->state, dev->pci_status, res,result2str (res));return res; }
@@ -1798,7 +1799,8 @@ static pci_ers_result_t mlx5_pci_slot_reset(struct pci_dev *pdev)struct mlx5_core_dev *dev =pci_get_drvdata (pdev);int err; -mlx5_pci_trace (dev,"Enter\n" ); +mlx5_core_info (dev,"%s Device state = %d pci_status: %d. Enter\n" , + __func__, dev->state, dev->pci_status); err =mlx5_pci_enable_device (dev);if (err) {
@@ -1820,7 +1822,8 @@ static pci_ers_result_t mlx5_pci_slot_reset(struct pci_dev *pdev) res =PCI_ERS_RESULT_RECOVERED ; out: -mlx5_pci_trace (dev,"Exit, err = %d, result = %d, %s\n" , err, res,result2str (res)); +mlx5_core_info (dev,"%s Device state = %d pci_status: %d. Exit, err = %d, result = %d, %s\n" , + __func__, dev->state, dev->pci_status, err, res,result2str (res));return res; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 105/289 net/mlx5: Fix FW tracer timestamp calculation
In reply to Greg Kroah-HartmanFrom: Moshe Shemesh <[email protected]>
[ Upstream commit 61db3d7b99a367416e489ccf764cc5f9b00d62a1 ]
Fix a bug in calculation of FW tracer timestamp. Decreasing one in the calculation should effect only bits 52_7 and not effect bits 6_0 of the timestamp, otherwise bits 6_0 are always set in this calculation.
--- drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c +1 -1
@@ -638,7 +638,7 @@ static void mlx5_tracer_handle_timestamp_trace(struct mlx5_fw_tracer *tracer, trace_timestamp = (timestamp_event.timestamp &MASK_52_7 ) | (str_frmt->timestamp &MASK_6_0 ); else - trace_timestamp = ((timestamp_event.timestamp &MASK_52_7 ) -1 ) | + trace_timestamp = ((timestamp_event.timestamp -1 ) &MASK_52_7 ) | (str_frmt->timestamp &MASK_6_0 );mlx5_tracer_print_trace (str_frmt, dev, trace_timestamp);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 106/289 net/mlx5: SF: Fix probing active SFs during driver probe phase
In reply to Greg Kroah-HartmanFrom: Shay Drory <[email protected]>
[ Upstream commit 4f57332d6a551185ba729617f04455e83fbe4e41 ]
When SF devices and SF port representors are located on different functions, unloading and reloading of SF parent driver doesn't recreate the existing SF present in the device.
Fix it by querying SFs and probe active SFs during driver probe phase.
--- .../ethernet/mellanox/mlx5/core/sf/dev/dev.c | 88 +++++++++++++++++++ 1 file changed, 88 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/sf/dev/dev.c +88 -0
@@ -18,6 +18,10 @@ struct mlx5_sf_dev_table {phys_addr_t base_address;u64 sf_bar_length;struct notifier_block nb; +struct mutex table_lock;/* Serializes sf life cycle and vhca state change handler */ +struct workqueue_struct *active_wq; +struct work_struct work; + u8 stop_active_wq:1;struct mlx5_core_dev *dev; };
@@ -168,6 +172,7 @@ mlx5_sf_dev_state_change_handler(struct notifier_block *nb, unsigned long event_return 0 ; sf_index = event->function_id - base_id; +mutex_lock (&table->table_lock); sf_dev =xa_load (&table->devices, sf_index);switch (event->new_vhca_state) {case MLX5_VHCA_STATE_INVALID :
@@ -191,6 +196,7 @@ mlx5_sf_dev_state_change_handler(struct notifier_block *nb, unsigned long event_default :break ; } +mutex_unlock (&table->table_lock);return 0 ; }
@@ -215,6 +221,78 @@ static int mlx5_sf_dev_vhca_arm_all(struct mlx5_sf_dev_table *table)return 0 ; } +static void mlx5_sf_dev_add_active_work (struct work_struct *work) +{ + struct mlx5_sf_dev_table *table = container_of(work, struct mlx5_sf_dev_table, work); +u32 out[MLX5_ST_SZ_DW (query_vhca_state_out)] = {}; +struct mlx5_core_dev *dev = table->dev; +u16 max_functions; +u16 function_id; +u16 sw_func_id; +int err =0 ; +u8 state; +int i; + + max_functions =mlx5_sf_max_functions (dev); + function_id =MLX5_CAP_GEN (dev, sf_base_id); +for (i =0 ; i < max_functions; i++, function_id++) { +if (table->stop_active_wq) +return ; + err =mlx5_cmd_query_vhca_state (dev, function_id, out,sizeof (out)); +if (err) +/* A failure of specific vhca doesn't mean others will +* fail as well. +*/ +continue ; + state =MLX5_GET (query_vhca_state_out, out, vhca_state_context.vhca_state); +if (state !=MLX5_VHCA_STATE_ACTIVE ) +continue ; + + sw_func_id =MLX5_GET (query_vhca_state_out, out, vhca_state_context.sw_function_id); +mutex_lock (&table->table_lock); +/* Don't probe device which is already probe */ +if (!xa_load (&table->devices, i)) +mlx5_sf_dev_add (dev, i, function_id, sw_func_id); +/* There is a race where SF got inactive after the query +* above. e.g.: the query returns that the state of the +* SF is active, and after that the eswitch manager set it to +* inactive. +* This case cannot be managed in SW, since the probing of the +* SF is on one system, and the inactivation is on a different +* system. +* If the inactive is done after the SF perform init_hca(), +* the SF will fully probe and then removed. If it was +* done before init_hca(), the SF probe will fail. +*/ +mutex_unlock (&table->table_lock); + } +} + +/* In case SFs are generated externally, probe active SFs */ +static int mlx5_sf_dev_queue_active_work (struct mlx5_sf_dev_table *table) +{ +if (MLX5_CAP_GEN (table->dev, eswitch_manager)) +return 0 ;/* the table is local */ + +/* Use a workqueue to probe active SFs, which are in large +* quantity and may take up to minutes to probe. +*/ + table->active_wq =create_singlethread_workqueue ("mlx5_active_sf" ); +if (!table->active_wq) +return -ENOMEM ; +INIT_WORK (&table->work, &mlx5_sf_dev_add_active_work); +queue_work (table->active_wq, &table->work); +return 0 ; +} + +static void mlx5_sf_dev_destroy_active_work (struct mlx5_sf_dev_table *table) +{ +if (table->active_wq) { + table->stop_active_wq = true; +destroy_workqueue (table->active_wq); + } +} +void mlx5_sf_dev_table_create (struct mlx5_core_dev *dev) {struct mlx5_sf_dev_table *table;
@@ -240,11 +318,17 @@ void mlx5_sf_dev_table_create(struct mlx5_core_dev *dev) table->base_address =pci_resource_start (dev->pdev,2 ); table->max_sfs = max_sfs;xa_init (&table->devices); +mutex_init (&table->table_lock); dev->priv.sf_dev_table = table; err =mlx5_vhca_event_notifier_register (dev, &table->nb);if (err) goto vhca_err; + + err =mlx5_sf_dev_queue_active_work (table); +if (err) + goto add_active_err; + err =mlx5_sf_dev_vhca_arm_all (table);if (err) goto arm_err;
@@ -252,6 +336,8 @@ void mlx5_sf_dev_table_create(struct mlx5_core_dev *dev)return ; arm_err: +mlx5_sf_dev_destroy_active_work (table); +add_active_err:mlx5_vhca_event_notifier_unregister (dev, &table->nb); vhca_err: table->max_sfs =0 ;
@@ -279,7 +365,9 @@ void mlx5_sf_dev_table_destroy(struct mlx5_core_dev *dev)if (!table)return ; +mlx5_sf_dev_destroy_active_work (table);mlx5_vhca_event_notifier_unregister (dev, &table->nb); +mutex_destroy (&table->table_lock);/* Now that event handler is not running, it is safe to destroy * the sf device without race.
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 107/289 net/mlx5: cmdif, Print info on any firmware cmd failure to tracepoint
In reply to Greg Kroah-HartmanFrom: Moshe Shemesh <[email protected]>
[ Upstream commit 870c2481174b839e7159555127bc8b5a5d0699ba ]
While moving to new CMD API (quiet API), some pre-existing flows may call the new API function that in case of error, returns the error instead of printing it as previously done. For such flows we bring back the print but to tracepoint this time for sys admins to have the ability to check for errors especially for commands using the new quiet API.
Tracepoint output example:
devlink-1333 [001] ..... 822.746922: mlx5_cmd: ACCESS_REG(0x805) op_mod(0x0) failed, status bad resource(0x5), syndrome (0xb06e1f), err(-22)
--- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 41 +++++++++-------- .../mellanox/mlx5/core/diag/cmd_tracepoint.h | 45 +++++++++++++++++++ include/linux/mlx5/driver.h | 1 + 3 files changed, 68 insertions(+), 19 deletions(-) create mode 100644 drivers/net/ethernet/mellanox/mlx5/core/diag/cmd_tracepoint.h
drivers/net/ethernet/mellanox/mlx5/core/cmd.c +22 -19
@@ -45,6 +45,8 @@#include "mlx5_core.h" #include "lib/eq.h" #include "lib/tout.h" +#define CREATE_TRACE_POINTS +#include "diag/cmd_tracepoint.h" enum {CMD_IF_REV =5 ,
@@ -785,27 +787,14 @@ EXPORT_SYMBOL(mlx5_cmd_out_err);static void cmd_status_print (struct mlx5_core_dev *dev,void *in,void *out) {u16 opcode, op_mod; -u32 syndrome; -u8 status;u16 uid; -int err; - - syndrome =MLX5_GET (mbox_out, out, syndrome); - status =MLX5_GET (mbox_out, out, status); opcode =MLX5_GET (mbox_in, in, opcode); op_mod =MLX5_GET (mbox_in, in, op_mod); uid =MLX5_GET (mbox_in, in, uid); - err =cmd_status_to_err (status); -if (!uid && opcode !=MLX5_CMD_OP_DESTROY_MKEY )mlx5_cmd_out_err (dev, opcode, op_mod, out); -else -mlx5_core_dbg (dev, -"%s(0x%x) op_mod(0x%x) uid(%d) failed, status %s(0x%x), syndrome (0x%x), err(%d)\n" , -mlx5_command_str (opcode), opcode, op_mod, uid, -cmd_status_str (status), status, syndrome, err); }int mlx5_cmd_check (struct mlx5_core_dev *dev,int err,void *in,void *out)
@@ -1892,6 +1881,16 @@ static int cmd_exec(struct mlx5_core_dev *dev, void *in, int in_size, void *out,return err; } +static void mlx5_cmd_err_trace (struct mlx5_core_dev *dev,u16 opcode,u16 op_mod,void *out) +{ +u32 syndrome =MLX5_GET (mbox_out, out, syndrome); +u8 status =MLX5_GET (mbox_out, out, status); + +trace_mlx5_cmd (mlx5_command_str (opcode), opcode, op_mod, +cmd_status_str (status), status, syndrome, +cmd_status_to_err (status)); +} +static void cmd_status_log (struct mlx5_core_dev *dev,u16 opcode,u8 status,u32 syndrome,int err) {
@@ -1914,7 +1913,7 @@ static void cmd_status_log(struct mlx5_core_dev *dev, u16 opcode, u8 status, }/* preserve -EREMOTEIO for outbox.status != OK, otherwise return err as is */ -static int cmd_status_err (struct mlx5_core_dev *dev,int err,u16 opcode,void *out) +static int cmd_status_err (struct mlx5_core_dev *dev,int err,u16 opcode,u16 op_mod,void *out) {u32 syndrome =MLX5_GET (mbox_out, out, syndrome);u8 status =MLX5_GET (mbox_out, out, status);
@@ -1922,8 +1921,10 @@ static int cmd_status_err(struct mlx5_core_dev *dev, int err, u16 opcode, void *if (err == -EREMOTEIO )/* -EREMOTEIO is preserved */ err = -EIO ; -if (!err && status !=MLX5_CMD_STAT_OK ) +if (!err && status !=MLX5_CMD_STAT_OK ) { err = -EREMOTEIO ; +mlx5_cmd_err_trace (dev, opcode, op_mod, out); + }cmd_status_log (dev, opcode, status, syndrome, err);return err;
@@ -1951,9 +1952,9 @@ int mlx5_cmd_do(struct mlx5_core_dev *dev, void *in, int in_size, void *out, int {int err =cmd_exec (dev, in, in_size, out, out_size,NULL ,NULL , false);u16 opcode =MLX5_GET (mbox_in, in, opcode); +u16 op_mod =MLX5_GET (mbox_in, in, op_mod); - err =cmd_status_err (dev, err, opcode, out); -return err; +return cmd_status_err (dev, err, opcode, op_mod, out); }EXPORT_SYMBOL (mlx5_cmd_do);
@@ -1997,8 +1998,9 @@ int mlx5_cmd_exec_polling(struct mlx5_core_dev *dev, void *in, int in_size, {int err =cmd_exec (dev, in, in_size, out, out_size,NULL ,NULL , true);u16 opcode =MLX5_GET (mbox_in, in, opcode); +u16 op_mod =MLX5_GET (mbox_in, in, op_mod); - err =cmd_status_err (dev, err, opcode, out); + err =cmd_status_err (dev, err, opcode, op_mod, out);return mlx5_cmd_check (dev, err, in, out); }EXPORT_SYMBOL (mlx5_cmd_exec_polling);
@@ -2034,7 +2036,7 @@ static void mlx5_cmd_exec_cb_handler(int status, void *_work)struct mlx5_async_ctx *ctx; ctx = work->ctx; - status =cmd_status_err (ctx->dev, status, work->opcode, work->out); + status =cmd_status_err (ctx->dev, status, work->opcode, work->op_mod, work->out); work->user_callback (status, work);if (atomic_dec_and_test (&ctx->num_inflight))complete (&ctx->inflight_done);
@@ -2049,6 +2051,7 @@ int mlx5_cmd_exec_cb(struct mlx5_async_ctx *ctx, void *in, int in_size, work->ctx = ctx; work->user_callback = callback; work->opcode =MLX5_GET (mbox_in, in, opcode); + work->op_mod =MLX5_GET (mbox_in, in, op_mod); work->out = out;if (WARN_ON (!atomic_inc_not_zero (&ctx->num_inflight)))return -EIO ;
drivers/net/ethernet/mellanox/mlx5/core/diag/cmd_tracepoint.h new file +45 -0
45 lines not on this page · raw message
include/linux/mlx5/driver.h +1 -0
@@ -984,6 +984,7 @@ struct mlx5_async_work {struct mlx5_async_ctx *ctx;mlx5_async_cbk_t user_callback;u16 opcode;/* cmd opcode */ +u16 op_mod;/* cmd op_mod */ void *out;/* pointer to the cmd output buffer */ };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 108/289 net/mlx5: Fix handling of entry refcount when command is not issued to FW
In reply to Greg Kroah-HartmanFrom: Moshe Shemesh <[email protected]>
[ Upstream commit aaf2e65cac7f2e1ae729c2fbc849091df9699f96 ]
In case command interface is down, or the command is not allowed, driver did not increment the entry refcount, but might have decrement as part of forced completion handling.
Fix that by always increment and decrement the refcount to make it symmetric for all flows.
--- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/cmd.c +3 -3
@@ -1005,6 +1005,7 @@ static void cmd_work_handler(struct work_struct *work)cmd_ent_get (ent);set_bit (MLX5_CMD_ENT_STATE_PENDING_COMP , &ent->state); +cmd_ent_get (ent);/* for the _real_ FW event on completion */ /* Skip sending command to fw if internal error */ if (mlx5_cmd_is_down (dev) || !opcode_allowed (&dev->cmd, ent->op)) { ent->ret = -ENXIO ;
@@ -1012,7 +1013,6 @@ static void cmd_work_handler(struct work_struct *work)return ; } -cmd_ent_get (ent);/* for the _real_ FW event on completion */ /* ring doorbell after the descriptor is valid */ mlx5_core_dbg (dev,"writing 0x%x to command doorbell\n" ,1 << ent->idx);wmb ();
@@ -1661,8 +1661,8 @@ static void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool forcecmd_ent_put (ent);/* timeout work was canceled */ if (!forced ||/* Real FW completion */ -pci_channel_offline (dev->pdev) ||/* FW is inaccessible */ - dev->state ==MLX5_DEVICE_STATE_INTERNAL_ERROR ) +mlx5_cmd_is_down (dev) ||/* No real FW completion is expected */ + !opcode_allowed (cmd, ent->op))cmd_ent_put (ent); ent->ts2 =ktime_get_ns ();
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 109/289 net/mlx5: E-Switch, Set correctly vport destination
In reply to Greg Kroah-HartmanFrom: Roi Dayan <[email protected]>
[ Upstream commit 6d942e40448931be9371f1ba8cb592778807ce18 ]
The cited commit moved from using reformat_id integer to packet_reformat pointer which introduced the possibility to null pointer dereference. When setting packet reformat flag and pkt_reformat pointer must exists so checking MLX5_ESW_DEST_ENCAP is not enough, we need
to make sure the pkt_reformat is valid and check for MLX5_ESW_DEST_ENCAP_VALID. If the dest encap valid flag does not exists then pkt_reformat can be either invalid address or null.
Also, to make sure we don't try to access invalid pkt_reformat set it to null when invalidated and invalidate it before calling add flow code as its logically more correct and to be safe.
--- .../net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c | 10 ++++++---- .../net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 2 +- 2 files changed, 7 insertions(+), 5 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c +6 -4
@@ -224,15 +224,16 @@ void mlx5e_tc_encap_flows_del(struct mlx5e_priv *priv,list_for_each_entry (flow, flow_list, tmp_list) {if (!mlx5e_is_offloaded_flow (flow) ||flow_flag_test (flow,SLOW ))continue ; - spec = &flow->attr->parse_attr->spec; - -/* update from encap rule to slow path rule */ - rule =mlx5e_tc_offload_to_slow_path (esw, flow, spec); attr =mlx5e_tc_get_encap_attr (flow); esw_attr = attr->esw_attr;/* mark the flow's encap dest as non-valid */ esw_attr->dests[flow->tmp_entry_index].flags &= ~MLX5_ESW_DEST_ENCAP_VALID ; + esw_attr->dests[flow->tmp_entry_index].pkt_reformat =NULL ; + +/* update from encap rule to slow path rule */ + spec = &flow->attr->parse_attr->spec; + rule =mlx5e_tc_offload_to_slow_path (esw, flow, spec);if (IS_ERR (rule)) { err =PTR_ERR (rule);
@@ -251,6 +252,7 @@ void mlx5e_tc_encap_flows_del(struct mlx5e_priv *priv,/* we know that the encap is valid */ e->flags &= ~MLX5_ENCAP_ENTRY_VALID ;mlx5_packet_reformat_dealloc (priv->mdev, e->pkt_reformat); + e->pkt_reformat =NULL ; } static void mlx5e_take_tmp_flow(struct mlx5e_tc_flow *flow,
drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +1 -1
@@ -431,7 +431,7 @@ esw_setup_vport_dest(struct mlx5_flow_destination *dest, struct mlx5_flow_act *f mlx5_lag_mpesw_is_activated(esw->dev)) dest[dest_idx].type =MLX5_FLOW_DESTINATION_TYPE_UPLINK ; } -if (esw_attr->dests[attr_idx].flags &MLX5_ESW_DEST_ENCAP ) { +if (esw_attr->dests[attr_idx].flags &MLX5_ESW_DEST_ENCAP_VALID ) {if (pkt_reformat) { flow_act->action |=MLX5_FLOW_CONTEXT_ACTION_PACKET_REFORMAT ; flow_act->pkt_reformat = esw_attr->dests[attr_idx].pkt_reformat;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 110/289 net/mlx5: Fix sync reset event handler error flow
In reply to Greg Kroah-HartmanFrom: Moshe Shemesh <[email protected]>
[ Upstream commit e1ad07b9227f9cbaf4bd2b6ec00b84c303657593 ]
When sync reset now event handling fails on mlx5_pci_link_toggle() then no reset was done. However, since mlx5_cmd_fast_teardown_hca() was already done, the firmware function is closed and the driver is left without firmware functionality.
Fix it by setting device error state and reopen the firmware resources. Reopening is done by the thread that was called for devlink reload fw_activate as it already holds the devlink lock.
--- drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c +7 -2
@@ -9,7 +9,8 @@ enum {MLX5_FW_RESET_FLAGS_RESET_REQUESTED ,MLX5_FW_RESET_FLAGS_NACK_RESET_REQUEST ,MLX5_FW_RESET_FLAGS_PENDING_COMP , -MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS +MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS , +MLX5_FW_RESET_FLAGS_RELOAD_REQUIRED }; struct mlx5_fw_reset {
@@ -406,7 +407,7 @@ static void mlx5_sync_reset_now_event(struct work_struct *work) err =mlx5_pci_link_toggle (dev);if (err) {mlx5_core_warn (dev,"mlx5_pci_link_toggle failed, no reset done, err %d\n" , err); - goto done; +set_bit (MLX5_FW_RESET_FLAGS_RELOAD_REQUIRED , &fw_reset->reset_flags); }mlx5_enter_error_state (dev, true);
@@ -482,6 +483,10 @@ int mlx5_fw_reset_wait_reset_done(struct mlx5_core_dev *dev) goto out; } err = fw_reset->ret; +if (test_and_clear_bit (MLX5_FW_RESET_FLAGS_RELOAD_REQUIRED , &fw_reset->reset_flags)) { +mlx5_unload_one_devl_locked (dev); +mlx5_load_one_devl_locked (dev, false); + } out:clear_bit (MLX5_FW_RESET_FLAGS_PENDING_COMP , &fw_reset->reset_flags);return err;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 111/289 net/mlx5e: Offload rule only when all encaps are valid
In reply to Greg Kroah-HartmanFrom: Chris Mi <[email protected]>
[ Upstream commit f377422044b2093c835e5f3717f8c8c58da1db1f ]
The cited commit adds a for loop to support multiple encapsulations. But it only checks if the last encap is valid.
Fix it by setting slow path flag when one of the encap is invalid.
--- .../mellanox/mlx5/core/en/tc_tun_encap.c | 6 ++---- .../mellanox/mlx5/core/en/tc_tun_encap.h | 3 +-- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 17 ++++++----------- 3 files changed, 9 insertions(+), 17 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c +2 -4
@@ -764,8 +764,7 @@ int mlx5e_attach_encap(struct mlx5e_priv *priv,struct net_device *mirred_dev, int out_index, struct netlink_ext_ack *extack, - struct net_device **encap_dev, - bool *encap_valid) + struct net_device **encap_dev) { struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;struct mlx5e_tc_flow_parse_attr *parse_attr;
@@ -880,9 +879,8 @@ int mlx5e_attach_encap(struct mlx5e_priv *priv,if (e->flags &MLX5_ENCAP_ENTRY_VALID ) { attr->esw_attr->dests[out_index].pkt_reformat = e->pkt_reformat; attr->esw_attr->dests[out_index].flags |=MLX5_ESW_DEST_ENCAP_VALID ; - *encap_valid = true; }else { - *encap_valid = false; +flow_flag_set (flow,SLOW ); }mutex_unlock (&esw->offloads.encap_tbl_lock);
drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.h +1 -2
@@ -17,8 +17,7 @@ int mlx5e_attach_encap(struct mlx5e_priv *priv,struct net_device *mirred_dev, int out_index, struct netlink_ext_ack *extack, - struct net_device **encap_dev, - bool *encap_valid); + struct net_device **encap_dev); int mlx5e_attach_decap(struct mlx5e_priv *priv, struct mlx5e_tc_flow *flow,
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +6 -11
@@ -1620,7 +1620,6 @@ set_encap_dests(struct mlx5e_priv *priv,struct mlx5e_tc_flow *flow, struct mlx5_flow_attr *attr, struct netlink_ext_ack *extack, - bool *encap_valid, bool *vf_tun) { struct mlx5e_tc_flow_parse_attr *parse_attr;
@@ -1637,7 +1636,6 @@ set_encap_dests(struct mlx5e_priv *priv, parse_attr = attr->parse_attr; esw_attr = attr->esw_attr; *vf_tun = false; - *encap_valid = true;for (out_index =0 ; out_index <MLX5_MAX_FLOW_FWD_VPORTS ; out_index++) {struct net_device *out_dev;
@@ -1654,7 +1652,7 @@ set_encap_dests(struct mlx5e_priv *priv, goto out; } err =mlx5e_attach_encap (priv, flow, attr, out_dev, out_index, - extack, &encap_dev, encap_valid); + extack, &encap_dev);dev_put (out_dev);if (err) goto out;
@@ -1718,8 +1716,8 @@ mlx5e_tc_add_fdb_flow(struct mlx5e_priv *priv,struct mlx5e_tc_flow_parse_attr *parse_attr;struct mlx5_flow_attr *attr = flow->attr;struct mlx5_esw_flow_attr *esw_attr; -bool vf_tun, encap_valid;u32 max_prio, max_chain; +bool vf_tun;int err =0 ; parse_attr = attr->parse_attr;
@@ -1809,7 +1807,7 @@ mlx5e_tc_add_fdb_flow(struct mlx5e_priv *priv, esw_attr->int_port = int_port; } - err =set_encap_dests (priv, flow, attr, extack, &encap_valid, &vf_tun); + err =set_encap_dests (priv, flow, attr, extack, &vf_tun);if (err) goto err_out;
@@ -1839,7 +1837,7 @@ mlx5e_tc_add_fdb_flow(struct mlx5e_priv *priv,* (1) there's no error * (2) there's an encap action and we don't have valid neigh */ -if (!encap_valid ||flow_flag_test (flow,SLOW )) +if (flow_flag_test (flow,SLOW )) flow->rule[0 ] =mlx5e_tc_offload_to_slow_path (esw, flow, &parse_attr->spec);else flow->rule[0 ] =mlx5e_tc_offload_fdb_rules (esw, flow, &parse_attr->spec, attr);
@@ -3737,7 +3735,7 @@ alloc_flow_post_acts(struct mlx5e_tc_flow *flow, struct netlink_ext_ack *extack)struct mlx5e_post_act *post_act =get_post_action (flow->priv);struct mlx5_flow_attr *attr, *next_attr =NULL ;struct mlx5e_post_act_handle *handle; -bool vf_tun, encap_valid = true; +bool vf_tun;int err;/* This is going in reverse order as needed.
@@ -3759,13 +3757,10 @@ alloc_flow_post_acts(struct mlx5e_tc_flow *flow, struct netlink_ext_ack *extack)if (list_is_last (&attr->list, &flow->attrs))break ; - err =set_encap_dests (flow->priv, flow, attr, extack, &encap_valid, &vf_tun); + err =set_encap_dests (flow->priv, flow, attr, extack, &vf_tun);if (err) goto out_free; -if (!encap_valid) -flow_flag_set (flow,SLOW ); - err =actions_prepare_mod_hdr_actions (flow->priv, flow, attr, extack);if (err) goto out_free;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 112/289 net: phy: at803x: fix error return code in at803x_probe()
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
[ Upstream commit 1f0dd412e34e177621769866bef347f0b22364df ]
Fix to return a negative error code from the ccr read error handling case instead of 0, as done elsewhere in this function.
--- drivers/net/phy/at803x.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/phy/at803x.c +3 -1
@@ -862,8 +862,10 @@ static int at803x_probe(struct phy_device *phydev) .wolopts = 0, }; -if (ccr <0 ) +if (ccr <0 ) { + ret = ccr; goto err; + } mode_cfg = ccr &AT803X_MODE_CFG_MASK ;switch (mode_cfg) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 113/289 tipc: set con sock in tipc_conn_alloc
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
[ Upstream commit 0e5d56c64afcd6fd2d132ea972605b66f8a7d3c4 ]
A crash was reported by Wei Chen:
BUG: kernel NULL pointer dereference, address: 0000000000000018 RIP: 0010:tipc_conn_close+0x12/0x100 Call Trace: tipc_topsrv_exit_net+0x139/0x320 ops_exit_list.isra.9+0x49/0x80 cleanup_net+0x31a/0x540 process_one_work+0x3fa/0x9f0 worker_thread+0x42/0x5c0
It was caused by !con->sock in tipc_conn_close(). In tipc_topsrv_accept(), con is allocated in conn_idr then its sock is set:
con = tipc_conn_alloc(); ... <----[1] con->sock = newsock;
If tipc_conn_close() is called in anytime of [1], the null-pointer-def is triggered by con->sock->sk due to con->sock is not yet set.
This patch fixes it by moving the con->sock setting to tipc_conn_alloc() under s->idr_lock. So that con->sock can never be NULL when getting the con from s->conn_idr. It will be also safer to move con->server and flag CF_CONNECTED setting under s->idr_lock, as they should all be set before tipc_conn_alloc() is called.
--- net/tipc/topsrv.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
net/tipc/topsrv.c +5 -6
@@ -176,7 +176,7 @@ static void tipc_conn_close(struct tipc_conn *con)conn_put (con); } -static struct tipc_conn *tipc_conn_alloc (struct tipc_topsrv *s) +static struct tipc_conn *tipc_conn_alloc (struct tipc_topsrv *s,struct socket *sock) {struct tipc_conn *con;int ret;
@@ -202,10 +202,11 @@ static struct tipc_conn *tipc_conn_alloc(struct tipc_topsrv *s) } con->conid = ret; s->idr_in_use++; -spin_unlock_bh (&s->idr_lock);set_bit (CF_CONNECTED , &con->flags); con->server = s; + con->sock = sock; +spin_unlock_bh (&s->idr_lock);return con; }
@@ -467,7 +468,7 @@ static void tipc_topsrv_accept(struct work_struct *work) ret =kernel_accept (lsock, &newsock,O_NONBLOCK );if (ret <0 )return ; - con =tipc_conn_alloc (srv); + con =tipc_conn_alloc (srv, newsock);if (IS_ERR (con)) { ret =PTR_ERR (con);sock_release (newsock);
@@ -479,7 +480,6 @@ static void tipc_topsrv_accept(struct work_struct *work) newsk->sk_data_ready = tipc_conn_data_ready; newsk->sk_write_space = tipc_conn_write_space; newsk->sk_user_data = con; - con->sock = newsock;write_unlock_bh (&newsk->sk_callback_lock);/* Wake up receive process in case of 'SYN+' message */
@@ -577,12 +577,11 @@ bool tipc_topsrv_kern_subscr(struct net *net, u32 port, u32 type, u32 lower, sub.filter = filter; *(u64 *)&sub.usr_handle = (u64 )port; - con =tipc_conn_alloc (tipc_topsrv (net)); + con =tipc_conn_alloc (tipc_topsrv (net),NULL );if (IS_ERR (con))return false; *conid = con->conid; - con->sock =NULL ; rc =tipc_conn_rcv_sub (tipc_topsrv (net), con, &sub);if (rc >=0 )return true;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 114/289 tipc: add an extra conn_get in tipc_conn_alloc
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
[ Upstream commit a7b42969d63f47320853a802efd879fbdc4e010e ]
One extra conn_get() is needed in tipc_conn_alloc(), as after tipc_conn_alloc() is called, tipc_conn_close() may free this con before deferencing it in tipc_topsrv_accept():
tipc_conn_alloc();
newsk = newsock->sk;
<---- tipc_conn_close();
write_lock_bh(&sk->sk_callback_lock);
newsk->sk_data_ready = tipc_conn_data_ready;Then an uaf issue can be triggered:
BUG: KASAN: use-after-free in tipc_topsrv_accept+0x1e7/0x370 [tipc] Call Trace: <TASK> dump_stack_lvl+0x33/0x46 print_report+0x178/0x4b0 kasan_report+0x8c/0x100 kasan_check_range+0x179/0x1e0 tipc_topsrv_accept+0x1e7/0x370 [tipc] process_one_work+0x6a3/0x1030 worker_thread+0x8a/0xdf0
This patch fixes it by holding it in tipc_conn_alloc(), then after all accessing in tipc_topsrv_accept() releasing it. Note when does this in tipc_topsrv_kern_subscr(), as tipc_conn_rcv_sub() returns 0 or -1 only, we don't need to check for "> 0".
--- net/tipc/topsrv.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
net/tipc/topsrv.c +6 -3
@@ -206,6 +206,7 @@ static struct tipc_conn *tipc_conn_alloc(struct tipc_topsrv *s, struct socket *sset_bit (CF_CONNECTED , &con->flags); con->server = s; con->sock = sock; +conn_get (con);spin_unlock_bh (&s->idr_lock);return con;
@@ -484,6 +485,7 @@ static void tipc_topsrv_accept(struct work_struct *work)/* Wake up receive process in case of 'SYN+' message */ newsk->sk_data_ready (newsk); +conn_put (con); } }
@@ -583,10 +585,11 @@ bool tipc_topsrv_kern_subscr(struct net *net, u32 port, u32 type, u32 lower, *conid = con->conid; rc =tipc_conn_rcv_sub (tipc_topsrv (net), con, &sub); -if (rc >=0 ) -return true; +if (rc) +conn_put (con); +conn_put (con); -return false; +return !rc; }void tipc_topsrv_kern_unsubscr (struct net *net,int conid)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 115/289 tipc: check skb_linearize() return value in tipc_disc_rcv()
In reply to Greg Kroah-HartmanFrom: YueHaibing <[email protected]>
[ Upstream commit cd0f6421162201e4b22ce757a1966729323185eb ]
If skb_linearize() fails in tipc_disc_rcv(), we need to free the skb instead of handle it.
--- net/tipc/discover.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/tipc/discover.c +4 -1
@@ -211,7 +211,10 @@ void tipc_disc_rcv(struct net *net, struct sk_buff *skb,u32 self;int err; -skb_linearize (skb); +if (skb_linearize (skb)) { +kfree_skb (skb); +return ; + } hdr =buf_msg (skb);if (caps &TIPC_NODE_ID128 )
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 116/289 zonefs: Fix race between modprobe and mount
In reply to Greg Kroah-HartmanFrom: Zhang Xiaoxu <[email protected]>
[ Upstream commit 4e45886956a20942800259f326a04417292ae314 ]
There is a race between modprobe and mount as below:
modprobe zonefs | mount -t zonefs
--------------------------------|-------------------------
zonefs_init |
register_filesystem [1] |
| zonefs_fill_super [2]
zonefs_sysfs_init [3] |1. register zonefs suceess, then
2. user can mount the zonefs
3. if sysfs initialize failed, the module initialize failed.
Then the mount process maybe some error happened since the module initialize failed.
Let's register zonefs after all dependency resource ready. And reorder the dependency resource release in module exit.
--- fs/zonefs/super.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
fs/zonefs/super.c +6 -6
@@ -1905,18 +1905,18 @@ static int __init zonefs_init(void)if (ret)return ret; - ret =register_filesystem (&zonefs_type); + ret =zonefs_sysfs_init ();if (ret) goto destroy_inodecache; - ret =zonefs_sysfs_init (); + ret =register_filesystem (&zonefs_type);if (ret) - goto unregister_fs; + goto sysfs_exit;return 0 ; -unregister_fs: -unregister_filesystem (&zonefs_type); +sysfs_exit: +zonefs_sysfs_exit (); destroy_inodecache:zonefs_destroy_inodecache ();
@@ -1925,9 +1925,9 @@ static int __init zonefs_init(void) static void __exit zonefs_exit(void) { +unregister_filesystem (&zonefs_type);zonefs_sysfs_exit ();zonefs_destroy_inodecache (); -unregister_filesystem (&zonefs_type); }MODULE_AUTHOR ("Damien Le Moal" );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 117/289 xfrm: Fix oops in __xfrm_state_delete()
In reply to Greg Kroah-HartmanFrom: Thomas Jarosch <[email protected]>
[ Upstream commit b97df039a68b2f3e848e238df5d5d06343ea497b ]
Kernel 5.14 added a new "byseq" index to speed up xfrm_state lookups by sequence number in commit fe9f1d8779cb ("xfrm: add state hashtable keyed by seq")
While the patch was thorough, the function pfkey_send_new_mapping() in net/af_key.c also modifies x->km.seq and never added the current xfrm_state to the "byseq" index.
This leads to the following kernel Ooops:
BUG: kernel NULL pointer dereference, address: 0000000000000000
..
RIP: 0010:__xfrm_state_delete+0xc9/0x1c0
..
Call Trace:
<TASK>
xfrm_state_delete+0x1e/0x40
xfrm_del_sa+0xb0/0x110 [xfrm_user]
xfrm_user_rcv_msg+0x12d/0x270 [xfrm_user]
? remove_entity_load_avg+0x8a/0xa0
? copy_to_user_state_extra+0x580/0x580 [xfrm_user]
netlink_rcv_skb+0x51/0x100
xfrm_netlink_rcv+0x30/0x50 [xfrm_user]
netlink_unicast+0x1a6/0x270
netlink_sendmsg+0x22a/0x480
__sys_sendto+0x1a6/0x1c0
? __audit_syscall_entry+0xd8/0x130
? __audit_syscall_exit+0x249/0x2b0
__x64_sys_sendto+0x23/0x30
do_syscall_64+0x3a/0x90
entry_SYSCALL_64_after_hwframe+0x61/0xcbExact location of the crash in __xfrm_state_delete():
if (x->km.seq)
hlist_del_rcu(&x->byseq);The hlist_node "byseq" was never populated.
The bug only triggers if a new NAT traversal mapping (changed IP or port) is detected in esp_input_done2() / esp6_input_done2(), which in turn indirectly calls pfkey_send_new_mapping() *if* the kernel is compiled with CONFIG_NET_KEY and "af_key" is active.
The PF_KEYv2 message SADB_X_NAT_T_NEW_MAPPING is not part of RFC 2367. Various implementations have been examined how they handle the "sadb_msg_seq" header field:
- racoon (Android): does not process SADB_X_NAT_T_NEW_MAPPING
- strongswan: does not care about sadb_msg_seq
- openswan: does not care about sadb_msg_seq
There is no standard how PF_KEYv2 sadb_msg_seq should be populated for SADB_X_NAT_T_NEW_MAPPING and it's not used in popular implementations either. Herbert Xu suggested we should just use the current km.seq value as is. This fixes the root cause of the oops since we no longer modify km.seq itself.
The update of "km.seq" looks like a copy'n'paste error
from pfkey_send_acquire(). SADB_ACQUIRE must indeed assign a unique km.seq number according to RFC 2367. It has been verified that code paths involving pfkey_send_acquire() don't cause the same Oops.
PF_KEYv2 SADB_X_NAT_T_NEW_MAPPING support was originally added here:
https://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git
commit cbc3488685b20e7b2a98ad387a1a816aada569d8
Author: Derek Atkins <[email protected]>
AuthorDate: Wed Apr 2 13:21:02 2003 -0800
[IPSEC]: Implement UDP Encapsulation framework.
In particular, implement ESPinUDP encapsulation for IPsec Nat Traversal.
A note on triggering the bug: I was not able to trigger it using VMs. There is one VPN using a high latency link on our production VPN server that triggered it like once a day though.
--- net/key/af_key.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/key/af_key.c +1 -1
@@ -3394,7 +3394,7 @@ static int pfkey_send_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, hdr->sadb_msg_len = size /sizeof (uint64_t ); hdr->sadb_msg_errno =0 ; hdr->sadb_msg_reserved =0 ; - hdr->sadb_msg_seq = x->km.seq =get_acqseq (); + hdr->sadb_msg_seq = x->km.seq; hdr->sadb_msg_pid =0 ;/* SA */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 118/289 xfrm: Fix ignored return value in xfrm6_init()
In reply to Greg Kroah-HartmanFrom: Chen Zhongjin <[email protected]>
[ Upstream commit 40781bfb836eda57d19c0baa37c7e72590e05fdc ]
When IPv6 module initializing in xfrm6_init(), register_pernet_subsys() is possible to fail but its return value is ignored.
If IPv6 initialization fails later and xfrm6_fini() is called, removing uninitialized list in xfrm6_net_ops will cause null-ptr-deref:
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 1 PID: 330 Comm: insmod RIP: 0010:unregister_pernet_operations+0xc9/0x450 Call Trace: <TASK> unregister_pernet_subsys+0x31/0x3e xfrm6_fini+0x16/0x30 [ipv6] ip6_route_init+0xcd/0x128 [ipv6] inet6_init+0x29c/0x602 [ipv6] ...
Fix it by catching the error return value of register_pernet_subsys().
--- net/ipv6/xfrm6_policy.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/ipv6/xfrm6_policy.c +5 -1
@@ -287,9 +287,13 @@ int __init xfrm6_init(void)if (ret) goto out_state; -register_pernet_subsys (&xfrm6_net_ops); + ret =register_pernet_subsys (&xfrm6_net_ops); +if (ret) + goto out_protocol; out:return ret; +out_protocol: +xfrm6_protocol_fini (); out_state:xfrm6_state_fini (); out_policy:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 119/289 net: wwan: iosm: use ACPI_FREE() but not kfree() in ipc_pcie_read_bios_cfg()
In reply to Greg Kroah-HartmanFrom: Wang ShaoBo <[email protected]>
[ Upstream commit e541dd7763fc34aec2f93f652a396cc2e7b92d8d ]
acpi_evaluate_dsm() should be coupled with ACPI_FREE() to free the ACPI memory, because we need to track the allocation of acpi_object when ACPI_DBG_TRACK_ALLOCATIONS enabled, so use ACPI_FREE() instead of kfree().
--- drivers/net/wwan/iosm/iosm_ipc_pcie.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wwan/iosm/iosm_ipc_pcie.c +1 -1
@@ -249,7 +249,7 @@ static enum ipc_pcie_sleep_state ipc_pcie_read_bios_cfg(struct device *dev)if (object->integer.value ==3 ) sleep_state =IPC_PCIE_D3L2 ; -kfree (object); +ACPI_FREE (object); default_ret:return sleep_state;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 120/289 sfc: fix potential memleak in __ef100_hard_start_xmit()
In reply to Greg Kroah-HartmanFrom: Zhang Changzhong <[email protected]>
[ Upstream commit aad98abd5cb8133507f22654f56bcb443aaa2d89 ]
The __ef100_hard_start_xmit() returns NETDEV_TX_OK without freeing skb in error handling case, add dev_kfree_skb_any() to fix it.
--- drivers/net/ethernet/sfc/ef100_netdev.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/sfc/ef100_netdev.c +1 -0
@@ -217,6 +217,7 @@ netdev_tx_t __ef100_hard_start_xmit(struct sk_buff *skb, skb->len, skb->data_len, channel->channel);if (!efx->n_channels || !efx->n_tx_channels || !channel) {netif_stop_queue (net_dev); +dev_kfree_skb_any (skb); goto err; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 121/289 net: sparx5: fix error handling in sparx5_port_open()
In reply to Greg Kroah-HartmanFrom: Liu Jian <[email protected]>
[ Upstream commit 4305fe232b8aa59af3761adc9fe6b6aa40913960 ]
If phylink_of_phy_connect() fails, the port should be disabled. If sparx5_serdes_set()/phy_power_on() fails, the port should be disabled and the phylink should be stopped and disconnected.
--- .../net/ethernet/microchip/sparx5/sparx5_netdev.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/net/ethernet/microchip/sparx5/sparx5_netdev.c +12 -2
@@ -103,7 +103,7 @@ static int sparx5_port_open(struct net_device *ndev) err =phylink_of_phy_connect (port->phylink, port->of_node,0 );if (err) {netdev_err (ndev,"Could not attach to PHY\n" ); -return err; + goto err_connect; }phylink_start (port->phylink);
@@ -115,10 +115,20 @@ static int sparx5_port_open(struct net_device *ndev) err =sparx5_serdes_set (port->sparx5, port, &port->conf); else err =phy_power_on (port->serdes); -if (err) +if (err) {netdev_err (ndev,"%s failed\n" , __func__); + goto out_power; + } } +return 0 ; + +out_power: +phylink_stop (port->phylink); +phylink_disconnect_phy (port->phylink); +err_connect: +sparx5_port_enable (port, false); +return err; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 122/289 net: sched: allow act_ct to be built without NF_NAT
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
[ Upstream commit 8427fd100c7b7793650e212a81e42f1cf124613d ]
In commit f11fe1dae1c4 ("net/sched: Make NET_ACT_CT depends on NF_NAT"), it fixed the build failure when NF_NAT is m and NET_ACT_CT is y by adding depends on NF_NAT for NET_ACT_CT. However, it would also cause NET_ACT_CT cannot be built without NF_NAT, which is not expected. This patch fixes it by changing to use "(!NF_NAT || NF_NAT)" as the depend.
--- net/sched/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sched/Kconfig +1 -1
@@ -976,7 +976,7 @@ config NET_ACT_TUNNEL_KEY config NET_ACT_CT tristate "connection tracking tc action" - depends on NET_CLS_ACT && NF_CONNTRACK && NF_NAT && NF_FLOW_TABLE + depends on NET_CLS_ACT && NF_CONNTRACK && (!NF_NAT || NF_NAT) && NF_FLOW_TABLE help Say Y here to allow sending the packets to conntrack module.
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 123/289 NFC: nci: fix memory leak in nci_rx_data_packet()
In reply to Greg Kroah-HartmanFrom: Liu Shixin <[email protected]>
[ Upstream commit 53270fb0fd77fe786d8c07a0793981d797836b93 ]
Syzbot reported a memory leak about skb:
unreferenced object 0xffff88810e144e00 (size 240):
comm "syz-executor284", pid 3701, jiffies 4294952403 (age 12.620s) hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff83ab79a9>] __alloc_skb+0x1f9/0x270 net/core/skbuff.c:497
[<ffffffff82a5cf64>] alloc_skb include/linux/skbuff.h:1267 [inline]
[<ffffffff82a5cf64>] virtual_ncidev_write+0x24/0xe0 drivers/nfc/virtual_ncidev.c:116
[<ffffffff815f6503>] do_loop_readv_writev fs/read_write.c:759 [inline]
[<ffffffff815f6503>] do_loop_readv_writev fs/read_write.c:743 [inline]
[<ffffffff815f6503>] do_iter_write+0x253/0x300 fs/read_write.c:863
[<ffffffff815f66ed>] vfs_writev+0xdd/0x240 fs/read_write.c:934
[<ffffffff815f68f6>] do_writev+0xa6/0x1c0 fs/read_write.c:977
[<ffffffff848802d5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848802d5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcdIn nci_rx_data_packet(), if we don't get a valid conn_info, we will return directly but forget to release the skb.
--- net/nfc/nci/data.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/nfc/nci/data.c +3 -1
@@ -279,8 +279,10 @@ void nci_rx_data_packet(struct nci_dev *ndev, struct sk_buff *skb) nci_plen(skb->data)); conn_info =nci_get_conn_info_by_conn_id (ndev,nci_conn_id (skb->data)); -if (!conn_info) +if (!conn_info) { +kfree_skb (skb);return ; + }/* strip the nci data header */ skb_pull (skb,NCI_DATA_HDR_SIZE );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 124/289 regulator: twl6030: re-add TWL6032_SUBCLASS
In reply to Greg Kroah-HartmanFrom: Andreas Kemnade <[email protected]>
[ Upstream commit 3d6c982b26db94cc21bc9f7784f63e8286b7be62 ]
In former times, info->feature was populated via the parent driver by pdata/regulator_init_data->driver_data for all regulators when USB_PRODUCT_ID_LSB indicates a TWL6032.
Today, the information is not set, so re-add it at the regulator definitions.
--- drivers/regulator/twl6030-regulator.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/regulator/twl6030-regulator.c +2 -0
@@ -530,6 +530,7 @@ static const struct twlreg_info TWL6030_INFO_##label = { \#define TWL6032_ADJUSTABLE_LDO (label, offset) \ static const struct twlreg_info TWL6032_INFO_##label = { \ .base = offset, \ + .features = TWL6032_SUBCLASS, \ .desc = { \ .name = #label, \ .id = TWL6032_REG_##label, \
@@ -562,6 +563,7 @@ static const struct twlreg_info TWLFIXED_INFO_##label = { \#define TWL6032_ADJUSTABLE_SMPS (label, offset) \ static const struct twlreg_info TWLSMPS_INFO_##label = { \ .base = offset, \ + .features = TWL6032_SUBCLASS, \ .desc = { \ .name = #label, \ .id = TWL6032_REG_##label, \
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 125/289 bnx2x: fix pci device refcount leak in bnx2x_vf_is_pcie_pending()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 3637a29ccbb6461b7268c5c5db525935d510afc6 ]
As comment of pci_get_domain_bus_and_slot() says, it returns a pci device with refcount increment, when finish using it, the caller must decrement the reference count by calling pci_dev_put(). Call pci_dev_put() before returning from bnx2x_vf_is_pcie_pending() to avoid refcount leak.
--- drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c +8 -4
@@ -795,16 +795,20 @@ static void bnx2x_vf_enable_traffic(struct bnx2x *bp, struct bnx2x_virtf *vf)static u8 bnx2x_vf_is_pcie_pending (struct bnx2x *bp,u8 abs_vfid) { -struct pci_dev *dev;struct bnx2x_virtf *vf =bnx2x_vf_by_abs_fid (bp, abs_vfid); +struct pci_dev *dev; +bool pending;if (!vf)return false; dev =pci_get_domain_bus_and_slot (vf->domain, vf->bus, vf->devfn); -if (dev) -return bnx2x_is_pcie_pending (dev); -return false; +if (!dev) +return false; + pending =bnx2x_is_pcie_pending (dev); +pci_dev_put (dev); + +return pending; }int bnx2x_vf_flr_clnup_epilog (struct bnx2x *bp,u8 abs_vfid)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 126/289 dma-buf: fix racing conflict of dma_heap_add()
In reply to Greg Kroah-HartmanFrom: Dawei Li <[email protected]>
[ Upstream commit 432e25902b9651622578c6248e549297d03caf66 ]
Racing conflict could be:
task A task Blist_for_each_entrystrcmp(h->name))
list_for_each_entry
strcmp(h->name)
kzalloc kzalloc
...... .....
device_create device_createlist_add
list_add
The root cause is that task B has no idea about the fact someone else(A) has inserted heap with same name when it calls list_add, so a potential collision occurs.
--- drivers/dma-buf/dma-heap.c | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-)
drivers/dma-buf/dma-heap.c +15 -13
@@ -233,18 +233,6 @@ struct dma_heap *dma_heap_add(const struct dma_heap_export_info *exp_info)return ERR_PTR (-EINVAL ); } -/* check the name is unique */ -mutex_lock (&heap_list_lock); -list_for_each_entry (h, &heap_list, list) { -if (!strcmp (h->name, exp_info->name)) { -mutex_unlock (&heap_list_lock); -pr_err ("dma_heap: Already registered heap named %s\n" , - exp_info->name); -return ERR_PTR (-EINVAL ); - } - } -mutex_unlock (&heap_list_lock); - heap =kzalloc (sizeof (*heap),GFP_KERNEL );if (!heap)return ERR_PTR (-ENOMEM );
@@ -283,13 +271,27 @@ struct dma_heap *dma_heap_add(const struct dma_heap_export_info *exp_info) err_ret =ERR_CAST (dev_ret); goto err2; } -/* Add heap to the list */ +mutex_lock (&heap_list_lock); +/* check the name is unique */ +list_for_each_entry (h, &heap_list, list) { +if (!strcmp (h->name, exp_info->name)) { +mutex_unlock (&heap_list_lock); +pr_err ("dma_heap: Already registered heap named %s\n" , + exp_info->name); + err_ret =ERR_PTR (-EINVAL ); + goto err3; + } + } + +/* Add heap to the list */ list_add (&heap->list, &heap_list);mutex_unlock (&heap_list_lock);return heap; +err3: +device_destroy (dma_heap_class, heap->heap_devt); err2:cdev_del (&heap->heap_cdev); err1:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 127/289 tsnep: Fix rotten packets
In reply to Greg Kroah-HartmanFrom: Gerhard Engleder <[email protected]>
[ Upstream commit 2dc4ac91f845b690ddf2ad39172c3698b2769fa2 ]
If PTP synchronisation is done every second, then sporadic the interval is higher than one second:
ptp4l[696.582]: master offset -17 s2 freq -1891 path delay 573
ptp4l[697.582]: master offset -22 s2 freq -1901 path delay 573
ptp4l[699.368]: master offset -1 s2 freq -1887 path delay 573
^^^^^^^ Should be 698.582!This problem is caused by rotten packets, which are received after polling but before interrupts are enabled again. This can be fixed by checking for pending work and rescheduling if necessary after interrupts has been enabled again.
--- drivers/net/ethernet/engleder/tsnep_main.c | 57 +++++++++++++++++++++- 1 file changed, 56 insertions(+), 1 deletion(-)
drivers/net/ethernet/engleder/tsnep_main.c +56 -1
@@ -504,6 +504,27 @@ static bool tsnep_tx_poll(struct tsnep_tx *tx, int napi_budget)return (budget !=0 ); } +static bool tsnep_tx_pending (struct tsnep_tx *tx) +{ +unsigned long flags; +struct tsnep_tx_entry *entry; +bool pending = false; + +spin_lock_irqsave (&tx->lock, flags); + +if (tx->read != tx->write) { + entry = &tx->entry[tx->read]; +if ((__le32_to_cpu (entry->desc_wb->properties) & +TSNEP_TX_DESC_OWNER_MASK ) == + (entry->properties &TSNEP_TX_DESC_OWNER_MASK )) + pending = true; + } + +spin_unlock_irqrestore (&tx->lock, flags); + +return pending; +} +static int tsnep_tx_open (struct tsnep_adapter *adapter,void __iomem *addr,struct tsnep_tx *tx) {
@@ -751,6 +772,19 @@ static int tsnep_rx_poll(struct tsnep_rx *rx, struct napi_struct *napi,return done; } +static bool tsnep_rx_pending (struct tsnep_rx *rx) +{ +struct tsnep_rx_entry *entry; + + entry = &rx->entry[rx->read]; +if ((__le32_to_cpu (entry->desc_wb->properties) & +TSNEP_DESC_OWNER_COUNTER_MASK ) == + (entry->properties &TSNEP_DESC_OWNER_COUNTER_MASK )) +return true; + +return false; +} +static int tsnep_rx_open (struct tsnep_adapter *adapter,void __iomem *addr,struct tsnep_rx *rx) {
@@ -795,6 +829,17 @@ static void tsnep_rx_close(struct tsnep_rx *rx)tsnep_rx_ring_cleanup (rx); } +static bool tsnep_pending (struct tsnep_queue *queue) +{ +if (queue->tx &&tsnep_tx_pending (queue->tx)) +return true; + +if (queue->rx &&tsnep_rx_pending (queue->rx)) +return true; + +return false; +} +static int tsnep_poll (struct napi_struct *napi,int budget) { struct tsnep_queue *queue = container_of(napi, struct tsnep_queue,
@@ -815,9 +860,19 @@ static int tsnep_poll(struct napi_struct *napi, int budget)if (!complete)return budget; -if (likely (napi_complete_done (napi, done))) +if (likely (napi_complete_done (napi, done))) {tsnep_enable_irq (queue->adapter, queue->irq_mask); +/* reschedule if work is already pending, prevent rotten packets +* which are transmitted or received after polling but before +* interrupt enable +*/ +if (tsnep_pending (queue)) { +tsnep_disable_irq (queue->adapter, queue->irq_mask); +napi_schedule (napi); + } + } +return min (done, budget -1 ); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 128/289 cpufreq: amd-pstate: change amd-pstate driver to be built-in type
In reply to Greg Kroah-HartmanFrom: Perry Yuan <[email protected]>
[ Upstream commit 456ca88d8a5258fc66edc42a10053ac8473de2b1 ]
Currently when the amd-pstate and acpi_cpufreq are both built into kernel as module driver, amd-pstate will not be loaded by default in this case.
Change amd-pstate driver as built-in type, it will resolve the loading sequence problem to allow user to make amd-pstate driver as the default cpufreq scaling driver.
--- drivers/cpufreq/Kconfig.x86 | 2 +- drivers/cpufreq/amd-pstate.c | 11 +---------- 2 files changed, 2 insertions(+), 11 deletions(-)
drivers/cpufreq/Kconfig.x86 +1 -1
@@ -35,7 +35,7 @@ config X86_PCC_CPUFREQ If in doubt, say N. config X86_AMD_PSTATE - tristate "AMD Processor P-State driver" + bool "AMD Processor P-State driver" depends on X86 && ACPI select ACPI_PROCESSOR select ACPI_CPPC_LIB if X86_64
drivers/cpufreq/amd-pstate.c +1 -10
@@ -718,16 +718,7 @@ static int __init amd_pstate_init(void)return ret; } - -static void __exit amd_pstate_exit(void) -{ -cpufreq_unregister_driver (&amd_pstate_driver); - -amd_pstate_enable (false); -} - -module_init (amd_pstate_init); -module_exit (amd_pstate_exit); +device_initcall (amd_pstate_init);MODULE_AUTHOR ("Huang Rui <[email protected]>" );MODULE_DESCRIPTION ("AMD Processor P-state Frequency Driver" );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 129/289 netfilter: ipset: restore allowing 64 clashing elements in hash:net,iface
In reply to Greg Kroah-HartmanFrom: Jozsef Kadlecsik <[email protected]>
[ Upstream commit 6a66ce44a51bdfc47721f0c591137df2d4b21247 ]
The commit 510841da1fcc ("netfilter: ipset: enforce documented limit to prevent allocating huge memory") was too strict and prevented to add up to 64 clashing elements to a hash:net,iface type of set. This patch fixes the issue and now the type behaves as documented.
--- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/ipset/ip_set_hash_gen.h +1 -1
@@ -916,7 +916,7 @@ mtype_add(struct ip_set *set, void *value, const struct ip_set_ext *ext,#ifdef IP_SET_HASH_WITH_MULTI if (h->bucketsize >=AHASH_MAX_TUNED ) goto set_full; -else if (h->bucketsize < multi) +else if (h->bucketsize <= multi) h->bucketsize +=AHASH_INIT_SIZE ;#endif if (n->size >=AHASH_MAX (h)) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 130/289 netfilter: flowtable_offload: add missing locking
In reply to Greg Kroah-HartmanFrom: Felix Fietkau <[email protected]>
[ Upstream commit bcd9e3c1656d0f7dd9743598c65c3ae24efb38d0 ]
nf_flow_table_block_setup and the driver TC_SETUP_FT call can modify the flow block cb list while they are being traversed elsewhere, causing a crash. Add a write lock around the calls to protect readers
--- net/netfilter/nf_flow_table_offload.c | 4 ++++ 1 file changed, 4 insertions(+)
net/netfilter/nf_flow_table_offload.c +4 -0
@@ -1098,6 +1098,7 @@ static int nf_flow_table_block_setup(struct nf_flowtable *flowtable,struct flow_block_cb *block_cb, *next;int err =0 ; +down_write (&flowtable->flow_block_lock);switch (cmd) {case FLOW_BLOCK_BIND :list_splice (&bo->cb_list, &flowtable->flow_block.cb_list);
@@ -1112,6 +1113,7 @@ static int nf_flow_table_block_setup(struct nf_flowtable *flowtable,WARN_ON_ONCE (1 ); err = -EOPNOTSUPP ; } +up_write (&flowtable->flow_block_lock);return err; }
@@ -1168,7 +1170,9 @@ static int nf_flow_table_offload_cmd(struct flow_block_offload *bo,nf_flow_table_block_offload_init (bo,dev_net (dev), cmd, flowtable, extack); +down_write (&flowtable->flow_block_lock); err = dev->netdev_ops->ndo_setup_tc (dev,TC_SETUP_FT , bo); +up_write (&flowtable->flow_block_lock);if (err <0 )return err;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 131/289 fs: do not update freeing inode i_io_list
In reply to Greg Kroah-HartmanFrom: Svyatoslav Feldsherov <[email protected]>
[ Upstream commit 4e3c51f4e805291b057d12f5dda5aeb50a538dc4 ]
After commit cbfecb927f42 ("fs: record I_DIRTY_TIME even if inode already has I_DIRTY_INODE") writeback_single_inode can push inode with I_DIRTY_TIME set to b_dirty_time list. In case of freeing inode with I_DIRTY_TIME set this can happen after deletion of inode from i_io_list at evict. Stack trace is following.
evictfat_evict_inodefat_truncate_blocksfat_flush_inodeswriteback_inodesync_inode_metadata(inode, sync=0) writeback_single_inode(inode, wbc) <- wbc->sync_mode == WB_SYNC_NONE
This will lead to use after free in flusher thread.
Similar issue can be triggered if writeback_single_inode in the stack trace update inode->i_io_list. Add explicit check to avoid it.
--- fs/fs-writeback.c | 30 +++++++++++++++++++----------- 1 file changed, 19 insertions(+), 11 deletions(-)
fs/fs-writeback.c +19 -11
@@ -1712,18 +1712,26 @@ static int writeback_single_inode(struct inode *inode, wb =inode_to_wb_and_lock_list (inode);spin_lock (&inode->i_lock);/* -* If the inode is now fully clean, then it can be safely removed from -* its writeback list (if any). Otherwise the flusher threads are -* responsible for the writeback lists. +* If the inode is freeing, its i_io_list shoudn't be updated +* as it can be finally deleted at this moment. */ -if (!(inode->i_state &I_DIRTY_ALL )) -inode_cgwb_move_to_attached (inode, wb); -else if (!(inode->i_state &I_SYNC_QUEUED )) { -if ((inode->i_state &I_DIRTY )) -redirty_tail_locked (inode, wb); -else if (inode->i_state &I_DIRTY_TIME ) { - inode->dirtied_when = jiffies; -inode_io_list_move_locked (inode, wb, &wb->b_dirty_time); +if (!(inode->i_state &I_FREEING )) { +/* +* If the inode is now fully clean, then it can be safely +* removed from its writeback list (if any). Otherwise the +* flusher threads are responsible for the writeback lists. +*/ +if (!(inode->i_state &I_DIRTY_ALL )) +inode_cgwb_move_to_attached (inode, wb); +else if (!(inode->i_state &I_SYNC_QUEUED )) { +if ((inode->i_state &I_DIRTY )) +redirty_tail_locked (inode, wb); +else if (inode->i_state &I_DIRTY_TIME ) { + inode->dirtied_when = jiffies; +inode_io_list_move_locked (inode, + wb, + &wb->b_dirty_time); + } } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 132/289 blk-mq: fix queue reference leak on blk_mq_alloc_disk_for_queue failure
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 22c17e279a1b03bad7987e4a4192b289b890f293 ]
Drop the request queue reference just acquired when __alloc_disk_node failed.
--- block/blk-mq.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
block/blk-mq.c +6 -1
@@ -3956,9 +3956,14 @@ EXPORT_SYMBOL(__blk_mq_alloc_disk);struct gendisk *blk_mq_alloc_disk_for_queue (struct request_queue *q,struct lock_class_key *lkclass) { +struct gendisk *disk; +if (!blk_get_queue (q))return NULL ; -return __alloc_disk_node (q,NUMA_NO_NODE , lkclass); + disk =__alloc_disk_node (q,NUMA_NO_NODE , lkclass); +if (!disk) +blk_put_queue (q); +return disk; }EXPORT_SYMBOL (blk_mq_alloc_disk_for_queue);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 133/289 test_kprobes: fix implicit declaration error of test_kprobes
In reply to Greg Kroah-HartmanFrom: Li Hua <[email protected]>
[ Upstream commit de3db3f883a82c4800f4af0ae2cc3b96a408ee9b ]
If KPROBES_SANITY_TEST and ARCH_CORRECT_STACKTRACE_ON_KRETPROBE is enabled, but STACKTRACE is not set. Build failed as below:
lib/test_kprobes.c: In function `stacktrace_return_handler':lib/test_kprobes.c:228:8: error: implicit declaration of function stack_trace_save'; did you mean stacktrace_driver'? [-Werror=implicit-function-declaration]
ret = stack_trace_save(stack_buf, STACK_BUF_SIZE, 0);
^~~~~~~~~~~~~~~~
stacktrace_drivercc1: all warnings being treated as errors scripts/Makefile.build:250: recipe for target 'lib/test_kprobes.o' failed make[2]: *** [lib/test_kprobes.o] Error 1
To fix this error, Select STACKTRACE if ARCH_CORRECT_STACKTRACE_ON_KRETPROBE is enabled.
--- lib/Kconfig.debug | 1 + 1 file changed, 1 insertion(+)
lib/Kconfig.debug +1 -0
@@ -2095,6 +2095,7 @@ config KPROBES_SANITY_TEST depends on DEBUG_KERNEL depends on KPROBES depends on KUNIT + select STACKTRACE if ARCH_CORRECT_STACKTRACE_ON_KRETPROBE default KUNIT_ALL_TESTS help This option provides for testing basic kprobes functionality on
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 134/289 dccp/tcp: Reset saddr on failure after inet6?_hash_connect().
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 77934dc6db0d2b111a8f2759e9ad2fb67f5cffa5 ]
When connect() is called on a socket bound to the wildcard address, we change the socket's saddr to a local address. If the socket fails to connect() to the destination, we have to reset the saddr.
However, when an error occurs after inet_hash6?_connect() in (dccp|tcp)_v[46]_conect(), we forget to reset saddr and leave the socket bound to the address.
Quoted 1 line
From the user's point of view, whether saddr is reset or not varies
with errno. Let's fix this inconsistent behaviour.
Note that after this patch, the repro [0] will trigger the WARN_ON() in inet_csk_get_port() again, but this patch is not buggy and rather fixes a bug papering over the bhash2's bug for which we need another fix.
For the record, the repro causes -EADDRNOTAVAIL in inet_hash6_connect() by this sequence:
s1 = socket()
s1.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1) s1.bind(('127.0.0.1', 10000)) s1.sendto(b'hello', MSG_FASTOPEN, (('127.0.0.1', 10000)))
# or s1.connect(('127.0.0.1', 10000)) s2 = socket()
s2.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1) s2.bind(('0.0.0.0', 10000)) s2.connect(('127.0.0.1', 10000)) # -EADDRNOTAVAIL
s2.listen(32) # WARN_ON(inet_csk(sk)->icsk_bind2_hash != tb2);
[0]: https://syzkaller.appspot.com/bug?extid=015d756bbd1f8b5c8f09
--- net/dccp/ipv4.c | 2 ++ net/dccp/ipv6.c | 2 ++ net/ipv4/tcp_ipv4.c | 2 ++ net/ipv6/tcp_ipv6.c | 2 ++ 4 files changed, 8 insertions(+)
net/dccp/ipv4.c +2 -0
@@ -136,6 +136,8 @@ int dccp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)* This unhashes the socket and releases the local port, if necessary. */ dccp_set_state (sk,DCCP_CLOSED ); +if (!(sk->sk_userlocks &SOCK_BINDADDR_LOCK )) +inet_reset_saddr (sk);ip_rt_put (rt); sk->sk_route_caps =0 ; inet->inet_dport =0 ;
net/dccp/ipv6.c +2 -0
@@ -967,6 +967,8 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr, late_failure:dccp_set_state (sk,DCCP_CLOSED ); +if (!(sk->sk_userlocks &SOCK_BINDADDR_LOCK )) +inet_reset_saddr (sk);__sk_dst_reset (sk); failure: inet->inet_dport =0 ;
net/ipv4/tcp_ipv4.c +2 -0
@@ -323,6 +323,8 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)* if necessary. */ tcp_set_state (sk,TCP_CLOSE ); +if (!(sk->sk_userlocks &SOCK_BINDADDR_LOCK )) +inet_reset_saddr (sk);ip_rt_put (rt); sk->sk_route_caps =0 ; inet->inet_dport =0 ;
net/ipv6/tcp_ipv6.c +2 -0
@@ -340,6 +340,8 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr, late_failure:tcp_set_state (sk,TCP_CLOSE ); +if (!(sk->sk_userlocks &SOCK_BINDADDR_LOCK )) +inet_reset_saddr (sk); failure: inet->inet_dport =0 ; sk->sk_route_caps =0 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 135/289 net: ethernet: mtk_eth_soc: fix potential memory leak in mtk_rx_alloc()
In reply to Greg Kroah-HartmanFrom: Ziyang Xuan <[email protected]>
[ Upstream commit 3213f808ae21be3891885de2f3a775afafcda987 ]
When fail to dma_map_single() in mtk_rx_alloc(), it returns directly. But the memory allocated for local variable data is not freed, and local variabel data has not been attached to ring->data[i] yet, so the memory allocated for local variable data will not be freed outside mtk_rx_alloc() too. Thus memory leak would occur in this scenario.
Add skb_free_frag(data) when dma_map_single() failed.
--- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/mediatek/mtk_eth_soc.c +3 -1
@@ -2363,8 +2363,10 @@ static int mtk_rx_alloc(struct mtk_eth *eth, int ring_no, int rx_flag) data +NET_SKB_PAD + eth->ip_align, ring->buf_size, DMA_FROM_DEVICE);if (unlikely (dma_mapping_error (eth->dma_dev, - dma_addr))) + dma_addr))) { +skb_free_frag (data);return -ENOMEM ; + } } rxd->rxd1 = (unsigned int )dma_addr; ring->data[i] = data;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 136/289 net: ethernet: mtk_eth_soc: move gdma_to_ppe and ppe_base definitions in mtk register map
In reply to Greg Kroah-HartmanFrom: Lorenzo Bianconi <[email protected]>
[ Upstream commit 329bce5139cfb00dba40f038ec090572b81ff2a9 ]
This is a preliminary patch to introduce mt7986 hw packet engine.
Stable-dep-of: 8110437e5961 ("net: ethernet: mtk_eth_soc: fix resource leak in error path")
--- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 15 +++++++++++---- drivers/net/ethernet/mediatek/mtk_eth_soc.h | 3 ++- drivers/net/ethernet/mediatek/mtk_ppe.h | 2 -- 3 files changed, 13 insertions(+), 7 deletions(-)
drivers/net/ethernet/mediatek/mtk_eth_soc.c +11 -4
@@ -73,6 +73,8 @@ static const struct mtk_reg_map mtk_reg_map = { .fq_blen = 0x1b2c, }, .gdm1_cnt = 0x2400, + .gdma_to_ppe = 0x4444, + .ppe_base = 0x0c00, }; static const struct mtk_reg_map mt7628_reg_map = {
@@ -126,6 +128,8 @@ static const struct mtk_reg_map mt7986_reg_map = { .fq_blen = 0x472c, }, .gdm1_cnt = 0x1c00, + .gdma_to_ppe = 0x3333, + .ppe_base = 0x2000, };/* strings used by ethtool */
@@ -2978,6 +2982,7 @@ static int mtk_open(struct net_device *dev)/* we run 2 netdevs on the same dma ring so we only bring it up once */ if (!refcount_read (ð->dma_refcnt)) { +const struct mtk_soc_data *soc = eth->soc;u32 gdm_config =MTK_GDMA_TO_PDMA ; err =mtk_start_dma (eth);
@@ -2986,15 +2991,15 @@ static int mtk_open(struct net_device *dev)return err; } -if (eth->soc->offload_version &&mtk_ppe_start (eth->ppe) ==0 ) - gdm_config =MTK_GDMA_TO_PPE ; +if (soc->offload_version &&mtk_ppe_start (eth->ppe) ==0 ) + gdm_config = soc->reg_map->gdma_to_ppe;mtk_gdm_config (eth, gdm_config);napi_enable (ð->tx_napi);napi_enable (ð->rx_napi);mtk_tx_irq_enable (eth,MTK_TX_DONE_INT ); -mtk_rx_irq_enable (eth, eth->soc->txrx.rx_irq_done_mask); +mtk_rx_irq_enable (eth, soc->txrx.rx_irq_done_mask);refcount_set (ð->dma_refcnt,1 ); }else
@@ -4104,7 +4109,9 @@ static int mtk_probe(struct platform_device *pdev) }if (eth->soc->offload_version) { - eth->ppe =mtk_ppe_init (eth, eth->base +MTK_ETH_PPE_BASE ,2 ); +u32 ppe_addr = eth->soc->reg_map->ppe_base; + + eth->ppe =mtk_ppe_init (eth, eth->base + ppe_addr,2 );if (!eth->ppe) { err = -ENOMEM ; goto err_free_dev;
drivers/net/ethernet/mediatek/mtk_eth_soc.h +2 -1
@@ -105,7 +105,6 @@#define MTK_GDMA_TCS_EN BIT(21)#define MTK_GDMA_UCS_EN BIT(20)#define MTK_GDMA_TO_PDMA 0x0 -#define MTK_GDMA_TO_PPE 0x4444#define MTK_GDMA_DROP_ALL 0x7777/* Unicast Filter MAC Address Register - Low */
@@ -955,6 +954,8 @@ struct mtk_reg_map {u32 fq_blen;/* fq free page buffer length */ } qdma;u32 gdm1_cnt; +u32 gdma_to_ppe; +u32 ppe_base; };/* struct mtk_eth_data - This is the structure holding all differences
drivers/net/ethernet/mediatek/mtk_ppe.h +0 -2
@@ -8,8 +8,6 @@#include <linux/bitfield.h> #include <linux/rhashtable.h> -#define MTK_ETH_PPE_BASE 0xc00 -#define MTK_PPE_ENTRIES_SHIFT 3#define MTK_PPE_ENTRIES (1024 << MTK_PPE_ENTRIES_SHIFT)#define MTK_PPE_HASH_MASK (MTK_PPE_ENTRIES - 1)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 137/289 net: ethernet: mtk_eth_soc: move ppe table hash offset to mtk_soc_data structure
In reply to Greg Kroah-HartmanFrom: Lorenzo Bianconi <[email protected]>
[ Upstream commit ba2fc48c5e1e9e1934939f0d12ff8b985dcc6e5d ]
This is a preliminary patch to introduce mt7986 hw packet engine.
Stable-dep-of: 8110437e5961 ("net: ethernet: mtk_eth_soc: fix resource leak in error path")
--- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 4 ++++ drivers/net/ethernet/mediatek/mtk_eth_soc.h | 2 ++ drivers/net/ethernet/mediatek/mtk_ppe.c | 24 +++++++++++++++------ drivers/net/ethernet/mediatek/mtk_ppe.h | 2 +- 4 files changed, 25 insertions(+), 7 deletions(-)
drivers/net/ethernet/mediatek/mtk_eth_soc.c +4 -0
@@ -4210,6 +4210,7 @@ static const struct mtk_soc_data mt7621_data = { .required_clks = MT7621_CLKS_BITMAP, .required_pctl = false, .offload_version = 2, + .hash_offset = 2, .txrx = { .txd_size = sizeof(struct mtk_tx_dma), .rxd_size = sizeof(struct mtk_rx_dma),
@@ -4228,6 +4229,7 @@ static const struct mtk_soc_data mt7622_data = { .required_clks = MT7622_CLKS_BITMAP, .required_pctl = false, .offload_version = 2, + .hash_offset = 2, .txrx = { .txd_size = sizeof(struct mtk_tx_dma), .rxd_size = sizeof(struct mtk_rx_dma),
@@ -4245,6 +4247,7 @@ static const struct mtk_soc_data mt7623_data = { .required_clks = MT7623_CLKS_BITMAP, .required_pctl = true, .offload_version = 2, + .hash_offset = 2, .txrx = { .txd_size = sizeof(struct mtk_tx_dma), .rxd_size = sizeof(struct mtk_rx_dma),
@@ -4278,6 +4281,7 @@ static const struct mtk_soc_data mt7986_data = { .caps = MT7986_CAPS, .required_clks = MT7986_CLKS_BITMAP, .required_pctl = false, + .hash_offset = 4, .txrx = { .txd_size = sizeof(struct mtk_tx_dma_v2), .rxd_size = sizeof(struct mtk_rx_dma_v2),
drivers/net/ethernet/mediatek/mtk_eth_soc.h +2 -0
@@ -969,6 +969,7 @@ struct mtk_reg_map {* the target SoC * @required_pctl A bool value to show whether the SoC requires * the extra setup for those pins used by GMAC. +* @hash_offset Flow table hash offset. * @txd_size Tx DMA descriptor size. * @rxd_size Rx DMA descriptor size. * @rx_irq_done_mask Rx irq done register mask.
@@ -983,6 +984,7 @@ struct mtk_soc_data {u32 required_clks;bool required_pctl;u8 offload_version; +u8 hash_offset;netdev_features_t hw_features;struct {u32 txd_size;
drivers/net/ethernet/mediatek/mtk_ppe.c +18 -6
@@ -88,7 +88,7 @@ static void mtk_ppe_cache_enable(struct mtk_ppe *ppe, bool enable) enable * MTK_PPE_CACHE_CTL_EN); } -static u32 mtk_ppe_hash_entry (struct mtk_foe_entry *e) +static u32 mtk_ppe_hash_entry (struct mtk_eth *eth,struct mtk_foe_entry *e) {u32 hv1, hv2, hv3;u32 hash;
@@ -122,7 +122,7 @@ static u32 mtk_ppe_hash_entry(struct mtk_foe_entry *e) hash = (hash >>24 ) | ((hash &0xffffff ) <<8 ); hash ^= hv1 ^ hv2 ^ hv3; hash ^= hash >>16 ; - hash <<=1 ; + hash <<= (ffs (eth->soc->hash_offset) -1 ); hash &=MTK_PPE_ENTRIES -1 ;return hash;
@@ -540,15 +540,16 @@ mtk_foe_entry_commit_l2(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)int mtk_foe_entry_commit (struct mtk_ppe *ppe,struct mtk_flow_entry *entry) {int type =FIELD_GET (MTK_FOE_IB1_PACKET_TYPE , entry->data.ib1); +const struct mtk_soc_data *soc = ppe->eth->soc;u32 hash;if (type ==MTK_PPE_PKT_TYPE_BRIDGE )return mtk_foe_entry_commit_l2 (ppe, entry); - hash =mtk_ppe_hash_entry (&entry->data); + hash =mtk_ppe_hash_entry (ppe->eth, &entry->data); entry->hash =0xffff ;spin_lock_bh (&ppe_lock); -hlist_add_head (&entry->list, &ppe->foe_flow[hash /2 ]); +hlist_add_head (&entry->list, &ppe->foe_flow[hash / soc->hash_offset]);spin_unlock_bh (&ppe_lock);return 0 ;
@@ -558,6 +559,7 @@ static void mtk_foe_entry_commit_subflow(struct mtk_ppe *ppe, struct mtk_flow_entry *entry, u16 hash) { + const struct mtk_soc_data *soc = ppe->eth->soc;struct mtk_flow_entry *flow_info;struct mtk_foe_entry foe, *hwe;struct mtk_foe_mac_info *l2;
@@ -572,7 +574,8 @@ mtk_foe_entry_commit_subflow(struct mtk_ppe *ppe, struct mtk_flow_entry *entry, flow_info->l2_data.base_flow = entry; flow_info->type =MTK_FLOW_TYPE_L2_SUBFLOW ; flow_info->hash = hash; -hlist_add_head (&flow_info->list, &ppe->foe_flow[hash /2 ]); +hlist_add_head (&flow_info->list, + &ppe->foe_flow[hash / soc->hash_offset]);hlist_add_head (&flow_info->l2_data.list, &entry->l2_flows); hwe = &ppe->foe_table[hash];
@@ -596,7 +599,8 @@ mtk_foe_entry_commit_subflow(struct mtk_ppe *ppe, struct mtk_flow_entry *entry,void __mtk_ppe_check_skb (struct mtk_ppe *ppe,struct sk_buff *skb,u16 hash) { -struct hlist_head *head = &ppe->foe_flow[hash /2 ]; +const struct mtk_soc_data *soc = ppe->eth->soc; +struct hlist_head *head = &ppe->foe_flow[hash / soc->hash_offset];struct mtk_foe_entry *hwe = &ppe->foe_table[hash];struct mtk_flow_entry *entry;struct mtk_foe_bridge key = {};
@@ -680,9 +684,11 @@ int mtk_foe_entry_idle_time(struct mtk_ppe *ppe, struct mtk_flow_entry *entry)struct mtk_ppe *mtk_ppe_init (struct mtk_eth *eth,void __iomem *base,int version) { +const struct mtk_soc_data *soc = eth->soc;struct device *dev = eth->dev;struct mtk_foe_entry *foe;struct mtk_ppe *ppe; +u32 foe_flow_size; ppe =devm_kzalloc (dev,sizeof (*ppe),GFP_KERNEL );if (!ppe)
@@ -705,6 +711,12 @@ struct mtk_ppe *mtk_ppe_init(struct mtk_eth *eth, void __iomem *base, ppe->foe_table = foe; + foe_flow_size = (MTK_PPE_ENTRIES / soc->hash_offset) * +sizeof (*ppe->foe_flow); + ppe->foe_flow =devm_kzalloc (dev, foe_flow_size,GFP_KERNEL ); +if (!ppe->foe_flow) +return NULL ; +mtk_ppe_debugfs_init (ppe);return ppe;
drivers/net/ethernet/mediatek/mtk_ppe.h +1 -1
@@ -270,7 +270,7 @@ struct mtk_ppe {dma_addr_t foe_phys;u16 foe_check_time[MTK_PPE_ENTRIES ]; -struct hlist_head foe_flow[MTK_PPE_ENTRIES /2 ]; +struct hlist_head *foe_flow;struct rhashtable l2_flows;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 138/289 net: ethernet: mtk_eth_soc: fix resource leak in error path
In reply to Greg Kroah-HartmanFrom: Yan Cangang <[email protected]>
[ Upstream commit 8110437e59616293228cd781c486d8495a61e36a ]
In mtk_probe(), when mtk_ppe_init() or mtk_eth_offload_init() failed, mtk_mdio_cleanup() isn't called. Fix it.
--- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/mediatek/mtk_eth_soc.c +2 -2
@@ -4114,12 +4114,12 @@ static int mtk_probe(struct platform_device *pdev) eth->ppe =mtk_ppe_init (eth, eth->base + ppe_addr,2 );if (!eth->ppe) { err = -ENOMEM ; - goto err_free_dev; + goto err_deinit_mdio; } err =mtk_eth_offload_init (eth);if (err) - goto err_free_dev; + goto err_deinit_mdio; }for (i =0 ; i <MTK_MAX_DEVS ; i++) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 139/289 ipv4: Fix error return code in fib_table_insert()
In reply to Greg Kroah-HartmanFrom: Ziyang Xuan <[email protected]>
[ Upstream commit 568fe84940ac0e4e0b2cd7751b8b4911f7b9c215 ]
In fib_table_insert(), if the alias was already inserted, but node not exist, the error code should be set before return from error handling path.
--- net/ipv4/fib_trie.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/ipv4/fib_trie.c +3 -1
@@ -1381,8 +1381,10 @@ int fib_table_insert(struct net *net, struct fib_table *tb,/* The alias was already inserted, so the node must exist. */ l = l ? l :fib_find_node (t, &tp, key); -if (WARN_ON_ONCE (!l)) +if (WARN_ON_ONCE (!l)) { + err = -ENOENT ; goto out_free_new_fa; + }if (fib_find_alias (&l->leaf, new_fa->fa_slen,0 ,0 , tb->tb_id, true) == new_fa) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 140/289 arcnet: fix potential memory leak in com20020_probe()
In reply to Greg Kroah-HartmanFrom: Wang Hai <[email protected]>
[ Upstream commit 1c40cde6b5171d9c8dfc69be00464fd1c75e210b ]
In com20020_probe(), if com20020_config() fails, dev and info will not be freed, which will lead to a memory leak.
This patch adds freeing dev and info after com20020_config() fails to fix this bug.
Compile tested only.
--- drivers/net/arcnet/com20020_cs.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/net/arcnet/com20020_cs.c +9 -2
@@ -113,6 +113,7 @@ static int com20020_probe(struct pcmcia_device *p_dev)struct com20020_dev *info;struct net_device *dev;struct arcnet_local *lp; +int ret = -ENOMEM ;dev_dbg (&p_dev->dev,"com20020_attach()\n" );
@@ -142,12 +143,18 @@ static int com20020_probe(struct pcmcia_device *p_dev) info->dev = dev; p_dev->priv = info; -return com20020_config (p_dev); + ret =com20020_config (p_dev); +if (ret) + goto fail_config; + +return 0 ; +fail_config: +free_arcdev (dev); fail_alloc_dev:kfree (info); fail_alloc_info: -return -ENOMEM ; +return ret; }/* com20020_attach */ static void com20020_detach (struct pcmcia_device *link)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 141/289 net: dm9051: Fix missing dev_kfree_skb() in dm9051_loop_rx()
In reply to Greg Kroah-HartmanFrom: Yuan Can <[email protected]>
[ Upstream commit bac81f40c2c1484a2bd416b3fbf983f6e76488cd ]
The dm9051_loop_rx() returns without release skb when dm9051_stop_mrcmd() returns error, free the skb to avoid this leak.
--- drivers/net/ethernet/davicom/dm9051.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/davicom/dm9051.c +3 -1
@@ -798,8 +798,10 @@ static int dm9051_loop_rx(struct board_info *db) } ret =dm9051_stop_mrcmd (db); -if (ret) +if (ret) { +dev_kfree_skb (skb);return ret; + } skb->protocol =eth_type_trans (skb, db->ndev);if (db->ndev->features &NETIF_F_RXCSUM )
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 142/289 net/cdc_ncm: Fix multicast RX support for CDC NCM devices with ZLP
In reply to Greg Kroah-HartmanFrom: Santiago Ruano Rincón <[email protected]>
[ Upstream commit 748064b54c99418f615aabff5755996cd9816969 ]
ZLP for DisplayLink ethernet devices was enabled in 6.0:266c0190aee3 ("net/cdc_ncm: Enable ZLP for DisplayLink ethernet devices"). The related driver_info should be the "same as cdc_ncm_info, but with FLAG_SEND_ZLP". However, set_rx_mode that enables handling multicast traffic was missing in the new cdc_ncm_zlp_info.
usbnet_cdc_update_filter rx mode was introduced in linux 5.9 with:e10dcb1b6ba7 ("net: cdc_ncm: hook into set_rx_mode to admit multicast traffic")
Without this hook, multicast, and then IPv6 SLAAC, is broken.
--- drivers/net/usb/cdc_ncm.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/cdc_ncm.c +1 -0
@@ -1915,6 +1915,7 @@ static const struct driver_info cdc_ncm_zlp_info = { .status = cdc_ncm_status, .rx_fixup = cdc_ncm_rx_fixup, .tx_fixup = cdc_ncm_tx_fixup, + .set_rx_mode = usbnet_cdc_update_filter, };/* Same as cdc_ncm_info, but with FLAG_WWAN */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 143/289 s390/ap: fix memory leak in ap_init_qci_info()
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
[ Upstream commit 9ac74f0666ceab0b1047e9d59be846a3345e4e98 ]
If kzalloc() for 'ap_qci_info_old' failed, 'ap_qci_info' shold be freed before return. Otherwise it is a memory leak.
--- drivers/s390/crypto/ap_bus.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/s390/crypto/ap_bus.c +4 -1
@@ -233,8 +233,11 @@ static void __init ap_init_qci_info(void)if (!ap_qci_info)return ; ap_qci_info_old =kzalloc (sizeof (*ap_qci_info_old),GFP_KERNEL ); -if (!ap_qci_info_old) +if (!ap_qci_info_old) { +kfree (ap_qci_info); + ap_qci_info =NULL ;return ; + }if (ap_fetch_qci_info (ap_qci_info) !=0 ) {kfree (ap_qci_info);kfree (ap_qci_info_old);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 144/289 s390/dasd: fix no record found for raw_track_access
In reply to Greg Kroah-HartmanFrom: Stefan Haberland <[email protected]>
[ Upstream commit 590ce6d96d6a224b470a3862c33a483d5022bfdb ]
For DASD devices in raw_track_access mode only full track images are read and written.
For this purpose it is not necessary to do search operation in the locate record extended function. The documentation even states that this might fail if the searched record is not found on a track.
Currently the driver sets a value of 1 in the search field for the first record after record zero. This is the default for disks not in raw_track_access mode but record 1 might be missing on a completely empty track.
There has not been any problem with this on IBM storage servers but it might lead to errors with DASD devices on other vendors storage servers.
Fix this by setting the search field to 0. Record zero is always available even on a completely empty track.
--- drivers/s390/block/dasd_eckd.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/s390/block/dasd_eckd.c +2 -4
@@ -4681,7 +4681,6 @@ static struct dasd_ccw_req *dasd_eckd_build_cp_raw(struct dasd_device *startdev,struct dasd_device *basedev;struct req_iterator iter;struct dasd_ccw_req *cqr; -unsigned int first_offs;unsigned int trkcount;unsigned long *idaws;unsigned int size;
@@ -4715,7 +4714,6 @@ static struct dasd_ccw_req *dasd_eckd_build_cp_raw(struct dasd_device *startdev, last_trk = (blk_rq_pos (req) +blk_rq_sectors (req) -1 ) /DASD_RAW_SECTORS_PER_TRACK ; trkcount = last_trk - first_trk +1 ; - first_offs =0 ;if (rq_data_dir (req) ==READ ) cmd =DASD_ECKD_CCW_READ_TRACK ;
@@ -4759,13 +4757,13 @@ static struct dasd_ccw_req *dasd_eckd_build_cp_raw(struct dasd_device *startdev,if (use_prefix) {prefix_LRE (ccw++, data, first_trk, last_trk, cmd, basedev, - startdev,1 , first_offs +1 , trkcount,0 ,0 ); + startdev,1 ,0 , trkcount,0 ,0 ); }else {define_extent (ccw++, data, first_trk, last_trk, cmd, basedev,0 ); ccw[-1 ].flags |=CCW_FLAG_CC ; data +=sizeof (struct DE_eckd_data ); -locate_record_ext (ccw++, data, first_trk, first_offs +1 , +locate_record_ext (ccw++, data, first_trk,0 , trkcount, cmd, basedev,0 ,0 ); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 145/289 fscache: fix OOB Read in __fscache_acquire_volume
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 9f0933ac026f7e54fe096797af9de20724e79097 ]
The type of a->key[0] is char in fscache_volume_same(). If the length of cache volume key is greater than 127, the value of a->key[0] is less than 0. In this case, klen becomes much larger than 255 after type conversion, because the type of klen is size_t. As a result, memcmp() is read out of bounds.
This causes a slab-out-of-bounds Read in __fscache_acquire_volume(), as reported by Syzbot.
Fix this by changing the type of the stored key to "u8 *" rather than "char *" (it isn't a simple string anyway). Also put in a check that the volume name doesn't exceed NAME_MAX.
BUG: KASAN: slab-out-of-bounds in memcmp+0x16f/0x1c0 lib/string.c:757 Read of size 8 at addr ffff888016f3aa90 by task syz-executor344/3613 Call Trace: memcmp+0x16f/0x1c0 lib/string.c:757 memcmp include/linux/fortify-string.h:420 [inline] fscache_volume_same fs/fscache/volume.c:133 [inline] fscache_hash_volume fs/fscache/volume.c:171 [inline] __fscache_acquire_volume+0x76c/0x1080 fs/fscache/volume.c:328 fscache_acquire_volume include/linux/fscache.h:204 [inline] v9fs_cache_session_get_cookie+0x143/0x240 fs/9p/cache.c:34 v9fs_session_init+0x1166/0x1810 fs/9p/v9fs.c:473 v9fs_mount+0xba/0xc90 fs/9p/vfs_super.c:126 legacy_get_tree+0x105/0x220 fs/fs_context.c:610 vfs_get_tree+0x89/0x2f0 fs/super.c:1530 do_new_mount fs/namespace.c:3040 [inline] path_mount+0x1326/0x1e20 fs/namespace.c:3370 do_mount fs/namespace.c:3383 [inline] __do_sys_mount fs/namespace.c:3591 [inline] __se_sys_mount fs/namespace.c:3568 [inline] __x64_sys_mount+0x27f/0x300 fs/namespace.c:3568
--- fs/fscache/volume.c | 7 +++++-- include/linux/fscache.h | 2 +- 2 files changed, 6 insertions(+), 3 deletions(-)
fs/fscache/volume.c +5 -2
@@ -203,7 +203,11 @@ static struct fscache_volume *fscache_alloc_volume(const char *volume_key,struct fscache_volume *volume;struct fscache_cache *cache;size_t klen, hlen; -char *key; +u8 *key; + + klen =strlen (volume_key); +if (klen >NAME_MAX ) +return NULL ;if (!coherency_data) coherency_len =0 ;
@@ -229,7 +233,6 @@ static struct fscache_volume *fscache_alloc_volume(const char *volume_key,/* Stick the length on the front of the key and pad it out to make * hashing easier. */ - klen =strlen (volume_key); hlen =round_up (1 + klen +1 ,sizeof (__le32)); key =kzalloc (hlen,GFP_KERNEL );if (!key)
include/linux/fscache.h +1 -1
@@ -75,7 +75,7 @@ struct fscache_volume {atomic_t n_accesses;/* Number of cache accesses in progress */ unsigned int debug_id;unsigned int key_hash;/* Hash of key string */ -char *key;/* Volume ID, eg. "[email protected]@1234" */ +u8 *key;/* Volume ID, eg. "[email protected]@1234" */ struct list_head proc_link;/* Link in /proc/fs/fscache/volumes */ struct hlist_bl_node hash_link;/* Link in hash table */ struct work_struct work;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 146/289 nfc: st-nci: fix incorrect validating logic in EVT_TRANSACTION
In reply to Greg Kroah-HartmanFrom: Martin Faltesek <[email protected]>
[ Upstream commit c60c152230828825c06e62a8f1ce956d4b659266 ]
The first validation check for EVT_TRANSACTION has two different checks tied together with logical AND. One is a check for minimum packet length, and the other is for a valid aid_tag. If either condition is true (fails), then an error should be triggered. The fix is to change && to ||.
--- drivers/nfc/st-nci/se.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nfc/st-nci/se.c +1 -1
@@ -326,7 +326,7 @@ static int st_nci_hci_connectivity_event_received(struct nci_dev *ndev,* AID 81 5 to 16 * PARAMETERS 82 0 to 255 */ -if (skb->len <NFC_MIN_AID_LENGTH +2 && +if (skb->len <NFC_MIN_AID_LENGTH +2 || skb->data[0 ] !=NFC_EVT_TRANSACTION_AID_TAG )return -EPROTO ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 147/289 nfc: st-nci: fix memory leaks in EVT_TRANSACTION
In reply to Greg Kroah-HartmanFrom: Martin Faltesek <[email protected]>
[ Upstream commit 440f2ae9c9f06e26f5dcea697a53717fc61a318c ]
Error path does not free previously allocated memory. Add devm_kfree() to the failure path.
--- drivers/nfc/st-nci/se.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/nfc/st-nci/se.c +3 -1
@@ -339,8 +339,10 @@ static int st_nci_hci_connectivity_event_received(struct nci_dev *ndev,/* Check next byte is PARAMETERS tag (82) */ if (skb->data[transaction->aid_len +2 ] != -NFC_EVT_TRANSACTION_PARAMS_TAG ) +NFC_EVT_TRANSACTION_PARAMS_TAG ) { +devm_kfree (dev, transaction);return -EPROTO ; + } transaction->params_len = skb->data[transaction->aid_len +3 ]; memcpy(transaction->params, skb->data +
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 148/289 nfc: st-nci: fix incorrect sizing calculations in EVT_TRANSACTION
In reply to Greg Kroah-HartmanFrom: Martin Faltesek <[email protected]>
[ Upstream commit 0254f31a7df3bb3b90c2d9dd2d4052f7b95eb287 ]
The transaction buffer is allocated by using the size of the packet buf, and subtracting two which seems intended to remove the two tags which are not present in the target structure. This calculation leads to under counting memory because of differences between the packet contents and the target structure. The aid_len field is a u8 in the packet, but a u32 in the structure, resulting in at least 3 bytes always being under counted. Further, the aid data is a variable length field in the packet, but fixed in the structure, so if this field is less than the max, the difference is added to the under counting.
To fix, perform validation checks progressively to safely reach the next field, to determine the size of both buffers and verify both tags. Once all validation checks pass, allocate the buffer and copy the data. This eliminates freeing memory on the error path, as validation checks are moved ahead of memory allocation.
--- drivers/nfc/st-nci/se.c | 51 +++++++++++++++++++++++++++++------------ 1 file changed, 36 insertions(+), 15 deletions(-)
drivers/nfc/st-nci/se.c +36 -15
@@ -312,6 +312,8 @@ static int st_nci_hci_connectivity_event_received(struct nci_dev *ndev,int r =0 ;struct device *dev = &ndev->nfc_dev->dev;struct nfc_evt_transaction *transaction; +u32 aid_len; +u8 params_len;pr_debug ("connectivity gate event: %x\n" , event);
@@ -325,28 +327,47 @@ static int st_nci_hci_connectivity_event_received(struct nci_dev *ndev,* Description Tag Length * AID 81 5 to 16 * PARAMETERS 82 0 to 255 +* +* The key differences are aid storage length is variably sized +* in the packet, but fixed in nfc_evt_transaction, and that +* the aid_len is u8 in the packet, but u32 in the structure, +* and the tags in the packet are not included in +* nfc_evt_transaction. +* +* size(b): 1 1 5-16 1 1 0-255 +* offset: 0 1 2 aid_len + 2 aid_len + 3 aid_len + 4 +* mem name: aid_tag(M) aid_len aid params_tag(M) params_len params +* example: 0x81 5-16 X 0x82 0-255 X */ -if (skb->len <NFC_MIN_AID_LENGTH +2 || - skb->data[0 ] !=NFC_EVT_TRANSACTION_AID_TAG ) +if (skb->len <2 || skb->data[0 ] !=NFC_EVT_TRANSACTION_AID_TAG )return -EPROTO ; - transaction =devm_kzalloc (dev, skb->len -2 ,GFP_KERNEL ); -if (!transaction) -return -ENOMEM ; + aid_len = skb->data[1 ]; - transaction->aid_len = skb->data[1 ]; -memcpy (transaction->aid, &skb->data[2 ], transaction->aid_len); +if (skb->len < aid_len +4 || + aid_len >sizeof (transaction->aid)) +return -EPROTO ; -/* Check next byte is PARAMETERS tag (82) */ -if (skb->data[transaction->aid_len +2 ] != -NFC_EVT_TRANSACTION_PARAMS_TAG ) { -devm_kfree (dev, transaction); + params_len = skb->data[aid_len +3 ]; + +/* Verify PARAMETERS tag is (82), and final check that there is +* enough space in the packet to read everything. +*/ +if (skb->data[aid_len +2 ] !=NFC_EVT_TRANSACTION_PARAMS_TAG || + skb->len < aid_len +4 + params_len)return -EPROTO ; - } - transaction->params_len = skb->data[transaction->aid_len +3 ]; -memcpy (transaction->params, skb->data + - transaction->aid_len +4 , transaction->params_len); + transaction =devm_kzalloc (dev,sizeof (*transaction) + + params_len,GFP_KERNEL ); +if (!transaction) +return -ENOMEM ; + + transaction->aid_len = aid_len; + transaction->params_len = params_len; + +memcpy (transaction->aid, &skb->data[2 ], aid_len); +memcpy (transaction->params, &skb->data[aid_len +4 ], + params_len); r =nfc_se_transaction (ndev->nfc_dev, host, transaction);break ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 149/289 net: marvell: prestera: add missing unregister_netdev() in prestera_port_create()
In reply to Greg Kroah-HartmanFrom: Zhang Changzhong <[email protected]>
[ Upstream commit 9a234a2a085ab9fd2be8d0c1eedfcd10f74b97eb ]
If prestera_port_sfp_bind() fails, unregister_netdev() should be called in error handling path.
Compile tested only.
--- drivers/net/ethernet/marvell/prestera/prestera_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/marvell/prestera/prestera_main.c +1 -0
@@ -730,6 +730,7 @@ static int prestera_port_create(struct prestera_switch *sw, u32 id)return 0 ; err_sfp_bind: +unregister_netdev (dev); err_register_netdev:prestera_port_list_del (port); err_port_init:
Signature · 1 line
2.35.1