6.1.8-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 6.1.8-rc1 review
This is the start of the stable review cycle for the 6.1.8 release. There are 193 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue, 24 Jan 2023 15:02:08 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.8-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.1.8-rc1
Stephan Gerhold <[email protected]>
soc: qcom: apr: Make qcom,protection-domain optional again
Eric Dumazet <[email protected]>
Revert "wifi: mac80211: fix memory leak in ieee80211_if_add()"
Damien Le Moal <[email protected]>
block: mq-deadline: Rename deadline_is_seq_writes()
Yang Yingliang <[email protected]>
net/mlx5: fix missing mutex_unlock in mlx5_fw_fatal_reporter_err_work()
Kevin Hao <[email protected]>
octeontx2-pf: Fix the use of GFP_KERNEL in atomic context on rt
Paolo Abeni <[email protected]>
net/ulp: use consistent error code when blocking ULP
Geetha sowjanya <[email protected]>
octeontx2-pf: Avoid use of GFP_KERNEL in atomic context
Michael Ellerman <[email protected]>
powerpc/vmlinux.lds: Don't discard .comment
Michael Ellerman <[email protected]>
powerpc/vmlinux.lds: Don't discard .rela* for relocatable builds
Michael Ellerman <[email protected]>
powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT
Masahiro Yamada <[email protected]>
s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36
Lang Yu <[email protected]>
drm/amdgpu: correct MEC number for gfx11 APUs
Tim Huang <[email protected]>
drm/amdgpu: add tmz support for GC IP v11.0.4
Yifan Zhang <[email protected]>
drm/amdgpu: add tmz support for GC 11.0.1
Tim Huang <[email protected]>
drm/amdgpu: enable GFX Clock Gating control for GC IP v11.0.4
Tim Huang <[email protected]>
drm/amdgpu: enable GFX Power Gating for GC IP v11.0.4
Tim Huang <[email protected]>
drm/amdgpu: enable GFX IP v11.0.4 CG support
Tim Huang <[email protected]>
drm/amdgpu: enable PSP IP v13.0.11 support
Yifan Zhang <[email protected]>
drm/amdgpu/discovery: enable nbio support for NBIO v7.7.1
Tim Huang <[email protected]>
drm/amdgpu/pm: use the specific mailbox registers only for SMU IP v13.0.4
Tim Huang <[email protected]>
drm/amdgpu/soc21: add mode2 asic reset for SMU IP v13.0.11
Yifan Zhang <[email protected]>
drm/amdgpu/pm: add GFXOFF control IP version check for SMU IP v13.0.11
Yifan Zhang <[email protected]>
drm/amdgpu: add smu 13 support for smu 13.0.11
Yifan Zhang <[email protected]>
drm/amdgpu/pm: enable swsmu for SMU IP v13.0.11
Tim Huang <[email protected]>
drm/amdgpu/discovery: add PSP IP v13.0.11 support
Yifan Zhang <[email protected]>
drm/amdgpu: add gmc v11 support for GC 11.0.4
Yifan Zhang <[email protected]>
drm/amdgpu: add gfx support for GC 11.0.4
Yifan Zhang <[email protected]>
drm/amdgpu/discovery: set the APU flag for GC 11.0.4
Yifan Zhang <[email protected]>
drm/amdgpu: set GC 11.0.4 family
Yifan Zhang <[email protected]>
drm/amdgpu/discovery: enable mes support for GC v11.0.4
Yifan Zhang <[email protected]>
drm/amdgpu/discovery: enable gfx v11 for GC 11.0.4
Yifan Zhang <[email protected]>
drm/amdgpu/discovery: enable gmc v11 for GC 11.0.4
Yifan Zhang <[email protected]>
drm/amdgpu/discovery: enable soc21 common for GC 11.0.4
Masahiro Yamada <[email protected]>
arch: fix broken BuildID for arm64 and riscv
YingChi Long <[email protected]>
x86/fpu: Use _Alignof to avoid undefined behavior in TYPE_ALIGN
Kees Cook <[email protected]>
exit: Use READ_ONCE() for all oops/warn limit reads
Kees Cook <[email protected]>
docs: Fix path paste-o for /sys/kernel/warn_count
Kees Cook <[email protected]>
panic: Expose "warn_count" to sysfs
Kees Cook <[email protected]>
panic: Introduce warn_limit
Kees Cook <[email protected]>
panic: Consolidate open-coded panic_on_warn checks
Kees Cook <[email protected]>
exit: Allow oops_limit to be disabled
Kees Cook <[email protected]>
exit: Expose "oops_count" to sysfs
Jann Horn <[email protected]>
exit: Put an upper limit on how often we can oops
Kees Cook <[email protected]>
panic: Separate sysctl logic from CONFIG_SMP
Ard Biesheuvel <[email protected]>
efi: rt-wrapper: Add missing include
Ard Biesheuvel <[email protected]>
arm64: efi: Execute runtime services from a dedicated stack
Alon Zahavi <[email protected]>
fs/ntfs3: Fix attr_punch_hole() null pointer derenference
Paulo Alcantara <[email protected]>
cifs: reduce roundtrips on create/qinfo requests
Alex Deucher <[email protected]>
drm/amd/display: disable S/G display on DCN 3.1.4
Alex Deucher <[email protected]>
drm/amd/display: disable S/G display on DCN 3.1.5
Joshua Ashton <[email protected]>
drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix
Joshua Ashton <[email protected]>
drm/amd/display: Calculate output_color_space after pixel encoding adjustment
hongao <[email protected]>
drm/amd/display: Fix set scaling doesn's work
Nirmoy Das <[email protected]>
drm/i915: Remove unused variable
Thomas Zimmermann <[email protected]>
drm/i915: Allow switching away via vga-switcheroo if uninitialized
Drew Davenport <[email protected]>
drm/i915/display: Check source height is > 0
Sasa Dragic <[email protected]>
drm/i915: re-disable RC6p on Sandy Bridge
jie1zhan <[email protected]>
drm/amdgpu: Correct the power calcultion for Renior/Cezanne.
Lang Yu <[email protected]>
drm/amdgpu: allow multipipe policy on ASICs with one MEC
Christian König <[email protected]>
drm/amdgpu: fix amdgpu_job_free_resources v2
Arnd Bergmann <[email protected]>
ARM: omap1: fix !ARCH_OMAP1_ANY link failures
Krzysztof Kozlowski <[email protected]>
ARM: dts: qcom: apq8084-ifc6540: fix overriding SDHCI
Vishnu Dasa <[email protected]>
VMCI: Use threaded irqs instead of tasklets
Alexander Usyskin <[email protected]>
mei: me: add meteor lake point M DID
Alexander Usyskin <[email protected]>
mei: bus: fix unlink on bus in error path
Khazhismel Kumykov <[email protected]>
gsmi: fix null-deref in gsmi_get_variable
Matthew Howell <[email protected]>
serial: exar: Add support for Sealevel 7xxxC serial cards
Tobias Schramm <[email protected]>
serial: atmel: fix incorrect baudrate setup
Lino Sanfilippo <[email protected]>
serial: amba-pl011: fix high priority character transmission in rs486 mode
Reinette Chatre <[email protected]>
dmaengine: idxd: Do not call DMX TX callbacks during workqueue disable
Reinette Chatre <[email protected]>
dmaengine: idxd: Prevent use after free on completion memory
Reinette Chatre <[email protected]>
dmaengine: idxd: Let probe fail when workqueue cannot be enabled
Mohan Kumar <[email protected]>
dmaengine: tegra210-adma: fix global intr clear
Peter Harliman Liem <[email protected]>
dmaengine: lgm: Move DT parsing after initialization
Ilpo Järvinen <[email protected]>
serial: pch_uart: Pass correct sg to dma_unmap_sg()
Heiner Kallweit <[email protected]>
dt-bindings: phy: g12a-usb3-pcie-phy: fix compatible string documentation
Heiner Kallweit <[email protected]>
dt-bindings: phy: g12a-usb2-phy: fix compatible string documentation
Li Jun <[email protected]>
arm64: dts: imx8mp: correct usb clocks
Juhyung Park <[email protected]>
usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210
Maciej Żenczykowski <[email protected]>
usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
Chanh Nguyen <[email protected]>
USB: gadget: Add ID numbers to configfs-gadget driver names
Daniel Scally <[email protected]>
usb: gadget: g_webcam: Send color matching descriptor per frame
Prashant Malani <[email protected]>
usb: typec: altmodes/displayport: Fix pin assignment calculation
Prashant Malani <[email protected]>
usb: typec: altmodes/displayport: Add pin assignment helper
ChiYuan Huang <[email protected]>
usb: typec: tcpm: Fix altmode re-registration causes sysfs create fail
Yang Yingliang <[email protected]>
usb: musb: fix error return code in omap2430_probe()
Alexander Stein <[email protected]>
usb: host: ehci-fsl: Fix module alias
Pawel Laszczak <[email protected]>
usb: cdns3: remove fetched trb from cache before dequeuing
Michael Adler <[email protected]>
USB: serial: cp210x: add SCALANCE LPE-9000 device id
Alan Stern <[email protected]>
USB: gadgetfs: Fix race between mounting and unmounting
Matthieu Baerts <[email protected]>
selftests: mptcp: userspace: validate v4-v6 subflows mix
Matthieu Baerts <[email protected]>
mptcp: netlink: respect v4/v6-only sockets
Paolo Abeni <[email protected]>
mptcp: explicitly specify sock family at subflow creation time
Jens Axboe <[email protected]>
io_uring/poll: don't reissue in case of poll race on multishot request
Jens Axboe <[email protected]>
pktcdvd: check for NULL returna fter calling bio_split_to_limits()
Gaosheng Cui <[email protected]>
tty: fix possible null-ptr-defer in spk_ttyio_release
Krzysztof Kozlowski <[email protected]>
tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer
Paul Moore <[email protected]>
bpf: restore the ebpf program ID for BPF_AUDIT_UNLOAD and PERF_BPF_EVENT_PROG_UNLOAD
Ben Dooks <[email protected]>
riscv: dts: sifive: fu740: fix size of pcie 32bit memory
Mika Westerberg <[email protected]>
thunderbolt: Do not call PM runtime functions in tb_retimer_scan()
Utkarsh Patel <[email protected]>
thunderbolt: Do not report errors if on-board retimers are found
Mika Westerberg <[email protected]>
thunderbolt: Use correct function to calculate maximum USB3 link rate
Mika Westerberg <[email protected]>
thunderbolt: Disable XDomain lane 1 only in software connection manager
Enzo Matsumiya <[email protected]>
cifs: do not include page data when checking signature
Filipe Manana <[email protected]>
btrfs: fix race between quota rescan and disable leading to NULL pointer deref
Filipe Manana <[email protected]>
btrfs: fix invalid leaf access due to inline extent during lseek
Qu Wenruo <[email protected]>
btrfs: qgroup: do not warn on record without old_roots populated
Filipe Manana <[email protected]>
btrfs: do not abort transaction on failure to update log root
Filipe Manana <[email protected]>
btrfs: do not abort transaction on failure to write log tree when syncing log
Filipe Manana <[email protected]>
btrfs: add missing setup of log for full commit at add_conflicting_inode()
Filipe Manana <[email protected]>
btrfs: fix directory logging due to race with concurrent index key deletion
Filipe Manana <[email protected]>
btrfs: fix missing error handling when logging directory items
Qu Wenruo <[email protected]>
btrfs: add extra error messages to cover non-ENOMEM errors from device_add_list()
Zach O'Keefe <[email protected]>
mm/MADV_COLLAPSE: don't expand collapse when vm_end is past requested end
David Hildenbrand <[email protected]>
mm/userfaultfd: enable writenotify while userfaultfd-wp is enabled for a VMA
Peter Xu <[email protected]>
mm/hugetlb: pre-allocate pgtable pages for uffd wr-protects
David Hildenbrand <[email protected]>
mm/hugetlb: fix uffd-wp handling for migration entries in hugetlb_change_protection()
David Hildenbrand <[email protected]>
mm/hugetlb: fix PTE marker handling in hugetlb_change_protection()
Haibo Chen <[email protected]>
mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting
Samuel Holland <[email protected]>
mmc: sunxi-mmc: Fix clock refcount imbalance during unbind
Ard Biesheuvel <[email protected]>
ACPI: PRM: Check whether EFI runtime is available
Ian Abbott <[email protected]>
comedi: adv_pci1760: Fix PWM instruction handling
Flavio Suligoi <[email protected]>
usb: core: hub: disable autosuspend for TI TUSB8041
Ola Jeppsson <[email protected]>
misc: fastrpc: Fix use-after-free race condition for maps
Abel Vesa <[email protected]>
misc: fastrpc: Don't remove map on creater_process and device_release
Abel Vesa <[email protected]>
misc: fastrpc: Fix use-after-free and race in fastrpc_map_find
Matthias Kaehlcke <[email protected]>
usb: misc: onboard_hub: Move 'attach' work to the driver
Matthias Kaehlcke <[email protected]>
usb: misc: onboard_hub: Invert driver registration order
Greg Kroah-Hartman <[email protected]>
USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100
Arnd Bergmann <[email protected]>
staging: vchiq_arm: fix enum vchiq_status return types
Duke Xin(辛安文) <[email protected]>
USB: serial: option: add Quectel EM05CN modem
Duke Xin(辛安文) <[email protected]>
USB: serial: option: add Quectel EM05CN (SG) modem
Ali Mirghasemi <[email protected]>
USB: serial: option: add Quectel EC200U modem
Duke Xin(辛安文) <[email protected]>
USB: serial: option: add Quectel EM05-G (RS) modem
Duke Xin(辛安文) <[email protected]>
USB: serial: option: add Quectel EM05-G (CS) modem
Duke Xin(辛安文) <[email protected]>
USB: serial: option: add Quectel EM05-G (GR) modem
Greg Kroah-Hartman <[email protected]>
prlimit: do_prlimit needs to have a speculation check
Mathias Nyman <[email protected]>
xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables
Mathias Nyman <[email protected]>
usb: acpi: add helper to check port lpm capability using acpi _DSM
Mathias Nyman <[email protected]>
xhci: Add a flag to disable USB3 lpm on a xhci root port level.
Mathias Nyman <[email protected]>
xhci: Add update_hub_device override for PCI xHCI hosts
Mathias Nyman <[email protected]>
xhci: Fix null pointer dereference when host dies
Jimmy Hu <[email protected]>
usb: xhci: Check endpoint is valid before dereferencing it
Ricardo Ribalda <[email protected]>
xhci-pci: set the dma max_seg_size
Greg Kroah-Hartman <[email protected]>
Revert "serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler"
Marek Vasut <[email protected]>
serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler
Hugh Dickins <[email protected]>
mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma
James Houghton <[email protected]>
hugetlb: unshare some PMDs when splitting VMAs
Zach O'Keefe <[email protected]>
mm/shmem: restore SHMEM_HUGE_DENY precedence over MADV_COLLAPSE
Ryusuke Konishi <[email protected]>
nilfs2: fix general protection fault in nilfs_btree_insert()
Damien Le Moal <[email protected]>
zonefs: Detect append writes at invalid locations
Huacai Chen <[email protected]>
LoongArch: Add HWCAP_LOONGARCH_CPUCFG to elf_hwcap
Shawn.Shao <[email protected]>
Add exception protection processing for vd in axi_chan_handle_err function
Alexey Dobriyan <[email protected]>
proc: fix PIE proc-empty-vm, proc-pid-vm tests
Liam Howlett <[email protected]>
nommu: fix split_vma() map_count error
Liam Howlett <[email protected]>
nommu: fix do_munmap() error path
Liam Howlett <[email protected]>
nommu: fix memory leak in do_mmap() error path
Felix Fietkau <[email protected]>
wifi: mac80211: fix initialization of rx->link and rx->link_sta
Alexander Wetzel <[email protected]>
wifi: mac80211: sdata can be NULL during AMPDU start
Aloka Dixit <[email protected]>
wifi: mac80211: reset multiple BSSID options in stop_ap()
Felix Fietkau <[email protected]>
wifi: mac80211: fix MLO + AP_VLAN check
Arend van Spriel <[email protected]>
wifi: brcmfmac: fix regression for Broadcom PCIe wifi devices
Krzysztof Kozlowski <[email protected]>
Bluetooth: hci_qca: Fix driver shutdown on closed serdev
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2
Arnd Bergmann <[email protected]>
fbdev: omapfb: avoid stack overflow warning
Rob Herring <[email protected]>
of: fdt: Honor CONFIG_CMDLINE* even without /chosen node, take 2
Zhang Rui <[email protected]>
perf/x86/rapl: Add support for Intel Emerald Rapids
Zhang Rui <[email protected]>
perf/x86/rapl: Add support for Intel Meteor Lake
Aaron Thompson <[email protected]>
memblock tests: Fix compilation error.
Paulo Alcantara <[email protected]>
cifs: fix race in assemble_neg_contexts()
Chris Wilson <[email protected]>
perf/x86/rapl: Treat Tigerlake like Icelake
Jaegeuk Kim <[email protected]>
f2fs: let's avoid panic if extent_tree is not created
Mikulas Patocka <[email protected]>
x86/asm: Fix an assembler warning with current binutils
Qu Wenruo <[email protected]>
btrfs: always report error in run_one_delayed_ref()
Po-Hsu Lin <[email protected]>
selftests: net: fix cmsg_so_mark.sh test hang
Jiri Slaby (SUSE) <[email protected]>
RDMA/srp: Move large values to a new enum for gcc13
Kui-Feng Lee <[email protected]>
bpf: keep a reference to the mm, in case the task is dead.
Chunhao Lin <[email protected]>
r8169: fix dmar pte write access is not set error
Chunhao Lin <[email protected]>
r8169: move rtl_wol_enable_rx() and rtl_prepare_power_down()
Daniil Tatianin <[email protected]>
net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats
Cindy Lu <[email protected]>
vdpa_sim_net: should not drop the multicast/broadcast packet
Harshit Mogalapalli <[email protected]>
vduse: Validate vq_num in vduse_validate_config()
Angus Chen <[email protected]>
virtio_pci: modify ENOENT to EINVAL
Eli Cohen <[email protected]>
vdpa/mlx5: Avoid overwriting CVQ iotlb
Eli Cohen <[email protected]>
vdpa/mlx5: Avoid using reslock in event_handler
Eli Cohen <[email protected]>
vdpa/mlx5: Return error on vlan ctrl commands if not supported
Ricardo Cañuelo <[email protected]>
tools/virtio: initialize spinlocks in vring_test.c
Anuradha Weeraman <[email protected]>
net: ethernet: marvell: octeontx2: Fix uninitialized variable warning
Hao Sun <[email protected]>
selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID
Olga Kornievskaia <[email protected]>
pNFS/filelayout: Fix coalescing test for single DS
Johannes Berg <[email protected]>
wifi: iwlwifi: fw: skip PPAG for JF
Naohiro Aota <[email protected]>
btrfs: fix trace event name typo for FLUSH_DELAYED_REFS
Christian König <[email protected]>
dma-buf: fix dma_buf_export init order v2
-------------
Diffstat:
Documentation/ABI/testing/sysfs-kernel-oops_count | 6 + Documentation/ABI/testing/sysfs-kernel-warn_count | 6 + Documentation/admin-guide/sysctl/kernel.rst | 19 ++ ...2a-usb2-phy.yaml => amlogic,g12a-usb2-phy.yaml} | 8 +- ...ie-phy.yaml => amlogic,g12a-usb3-pcie-phy.yaml} | 6 +- MAINTAINERS | 2 + Makefile | 4 +- arch/arm/boot/dts/qcom-apq8084-ifc6540.dts | 20 +- arch/arm/boot/dts/qcom-apq8084.dtsi | 4 +- arch/arm/mach-omap1/Kconfig | 5 +- arch/arm/mach-omap1/Makefile | 4 - arch/arm/mach-omap1/io.c | 32 ++- arch/arm/mach-omap1/mcbsp.c | 21 -- arch/arm/mach-omap1/pm.h | 7 - arch/arm64/boot/dts/freescale/imx8mp.dtsi | 12 +- arch/arm64/include/asm/efi.h | 3 + arch/arm64/kernel/efi-rt-wrapper.S | 14 +- arch/arm64/kernel/efi.c | 27 +++ arch/loongarch/kernel/cpu-probe.c | 2 +- arch/powerpc/kernel/vmlinux.lds.S | 6 +- arch/riscv/boot/dts/sifive/fu740-c000.dtsi | 2 +- arch/s390/kernel/vmlinux.lds.S | 2 + arch/x86/events/rapl.c | 5 + arch/x86/kernel/fpu/init.c | 7 +- arch/x86/lib/iomap_copy_64.S | 2 +- block/mq-deadline.c | 4 +- drivers/accessibility/speakup/spk_ttyio.c | 3 + drivers/acpi/prmt.c | 10 + drivers/block/pktcdvd.c | 2 + drivers/bluetooth/hci_qca.c | 7 + drivers/comedi/drivers/adv_pci1760.c | 2 +- drivers/dma-buf/dma-buf-sysfs-stats.c | 7 +- drivers/dma-buf/dma-buf-sysfs-stats.h | 4 +- drivers/dma-buf/dma-buf.c | 84 ++++---- drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 6 + drivers/dma/idxd/device.c | 16 +- drivers/dma/lgm/lgm-dma.c | 10 +- drivers/dma/tegra210-adma.c | 2 +- drivers/firmware/google/gsmi.c | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c | 9 + drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 1 + drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 22 +- drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c | 1 + drivers/gpu/drm/amd/amdgpu/psp_v13_0.c | 3 + drivers/gpu/drm/amd/amdgpu/soc21.c | 19 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 +- .../gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 4 +- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 1 + drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c | 7 +- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 3 + .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c | 17 +- drivers/gpu/drm/i915/display/skl_universal_plane.c | 2 +- drivers/gpu/drm/i915/i915_driver.c | 5 +- drivers/gpu/drm/i915/i915_pci.c | 3 +- drivers/gpu/drm/i915/i915_switcheroo.c | 6 +- drivers/infiniband/ulp/srp/ib_srp.h | 8 +- drivers/misc/fastrpc.c | 67 ++++--- drivers/misc/mei/bus.c | 12 +- drivers/misc/mei/hw-me-regs.h | 2 + drivers/misc/mei/pci-me.c | 2 + drivers/misc/vmw_vmci/vmci_guest.c | 49 ++--- drivers/mmc/host/sdhci-esdhc-imx.c | 22 +- drivers/mmc/host/sunxi-mmc.c | 8 +- .../net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c | 2 +- .../ethernet/marvell/octeontx2/nic/otx2_common.c | 11 +- .../ethernet/marvell/octeontx2/nic/otx2_common.h | 2 + drivers/net/ethernet/mellanox/mlx5/core/health.c | 1 + drivers/net/ethernet/realtek/r8169_main.c | 58 +++--- .../wireless/broadcom/brcm80211/brcmfmac/pcie.c | 2 +- drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 5 + drivers/of/fdt.c | 28 +-- drivers/soc/qcom/apr.c | 3 +- .../include/linux/raspberrypi/vchiq.h | 2 +- .../vc04_services/interface/vchiq_arm/vchiq_arm.h | 4 +- drivers/thunderbolt/retimer.c | 20 +- drivers/thunderbolt/tb.c | 20 +- drivers/thunderbolt/tunnel.c | 2 +- drivers/thunderbolt/xdomain.c | 17 +- drivers/tty/serial/8250/8250_exar.c | 14 ++ drivers/tty/serial/amba-pl011.c | 8 +- drivers/tty/serial/atmel_serial.c | 8 +- drivers/tty/serial/pch_uart.c | 2 +- drivers/tty/serial/qcom_geni_serial.c | 18 +- drivers/usb/cdns3/cdns3-gadget.c | 12 ++ drivers/usb/core/hub.c | 13 ++ drivers/usb/core/usb-acpi.c | 65 ++++++ drivers/usb/gadget/configfs.c | 12 +- drivers/usb/gadget/function/f_ncm.c | 4 +- drivers/usb/gadget/legacy/inode.c | 28 ++- drivers/usb/gadget/legacy/webcam.c | 3 + drivers/usb/host/ehci-fsl.c | 2 +- drivers/usb/host/xhci-pci.c | 45 +++++ drivers/usb/host/xhci-ring.c | 5 +- drivers/usb/host/xhci.c | 18 +- drivers/usb/host/xhci.h | 5 + drivers/usb/misc/iowarrior.c | 2 +- drivers/usb/misc/onboard_usb_hub.c | 18 +- drivers/usb/musb/omap2430.c | 4 +- drivers/usb/serial/cp210x.c | 1 + drivers/usb/serial/option.c | 17 ++ drivers/usb/storage/uas-detect.h | 13 ++ drivers/usb/storage/unusual_uas.h | 7 - drivers/usb/typec/altmodes/displayport.c | 22 +- drivers/usb/typec/tcpm/tcpm.c | 7 +- drivers/vdpa/mlx5/core/mlx5_vdpa.h | 5 +- drivers/vdpa/mlx5/core/mr.c | 44 ++-- drivers/vdpa/mlx5/net/mlx5_vnet.c | 68 ++----- drivers/vdpa/vdpa_sim/vdpa_sim_net.c | 3 + drivers/vdpa/vdpa_user/vduse_dev.c | 3 + drivers/video/fbdev/omap2/omapfb/dss/dsi.c | 28 ++- drivers/virtio/virtio_pci_modern.c | 2 +- fs/btrfs/disk-io.c | 9 +- fs/btrfs/extent-tree.c | 7 +- fs/btrfs/file.c | 13 +- fs/btrfs/qgroup.c | 39 +++- fs/btrfs/tree-log.c | 47 +++-- fs/btrfs/volumes.c | 11 +- fs/cifs/connect.c | 16 -- fs/cifs/inode.c | 6 - fs/cifs/misc.c | 45 ----- fs/cifs/smb2inode.c | 45 +++-- fs/cifs/smb2ops.c | 28 ++- fs/cifs/smb2pdu.c | 26 ++- fs/f2fs/extent_cache.c | 3 +- fs/nfs/filelayout/filelayout.c | 8 + fs/nilfs2/btree.c | 15 +- fs/ntfs3/attrib.c | 2 +- fs/userfaultfd.c | 28 ++- fs/zonefs/super.c | 22 ++ include/asm-generic/vmlinux.lds.h | 5 + include/linux/panic.h | 1 + include/linux/soc/ti/omap1-io.h | 4 +- include/linux/usb.h | 3 + include/trace/events/btrfs.h | 2 +- io_uring/poll.c | 6 +- kernel/bpf/offload.c | 3 - kernel/bpf/syscall.c | 6 +- kernel/bpf/task_iter.c | 39 ++-- kernel/exit.c | 62 ++++++ kernel/kcsan/report.c | 3 +- kernel/panic.c | 48 ++++- kernel/sched/core.c | 3 +- kernel/sys.c | 2 + lib/ubsan.c | 3 +- mm/hugetlb.c | 95 ++++++--- mm/kasan/report.c | 4 +- mm/kfence/report.c | 3 +- mm/khugepaged.c | 16 +- mm/mmap.c | 4 + mm/nommu.c | 9 +- mm/shmem.c | 6 +- net/bluetooth/hci_sync.c | 6 +- net/ethtool/ioctl.c | 3 +- net/ipv4/tcp_ulp.c | 2 +- net/mac80211/agg-tx.c | 6 +- net/mac80211/cfg.c | 7 + net/mac80211/driver-ops.c | 3 + net/mac80211/iface.c | 5 +- net/mac80211/rx.c | 222 +++++++++------------ net/mptcp/pm.c | 25 +++ net/mptcp/pm_userspace.c | 7 + net/mptcp/protocol.c | 2 +- net/mptcp/protocol.h | 6 +- net/mptcp/subflow.c | 9 +- tools/testing/memblock/.gitignore | 1 + tools/testing/memblock/Makefile | 3 +- .../selftests/bpf/prog_tests/jeq_infer_not_null.c | 9 + .../selftests/bpf/progs/jeq_infer_not_null_fail.c | 42 ++++ tools/testing/selftests/net/cmsg_sender.c | 2 +- tools/testing/selftests/net/mptcp/userspace_pm.sh | 47 +++++ tools/testing/selftests/proc/proc-empty-vm.c | 12 +- tools/testing/selftests/proc/proc-pid-vm.c | 9 +- tools/virtio/vringh_test.c | 2 + 176 files changed, 1644 insertions(+), 854 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/193 dma-buf: fix dma_buf_export init order v2
From: Christian König <[email protected]>
[ Upstream commit f728a5ea27c92133893590e731ce10f6561ced87 ]
The init order and resulting error handling in dma_buf_export was pretty messy.
Subordinate objects like the file and the sysfs kernel objects were initializing and wiring itself up with the object in the wrong order resulting not only in complicating and partially incorrect error handling, but also in publishing only halve initialized DMA-buf objects.
Clean this up thoughtfully by allocating the file independent of the DMA-buf object. Then allocate and initialize the DMA-buf object itself, before publishing it through sysfs. If everything works as expected the file is then connected with the DMA-buf object and publish it through debugfs.
Also adds the missing dma_resv_fini() into the error handling.
v2: add some missing changes to dma_bug_getfile() and a missing NULL
check in dma_buf_file_release()
--- drivers/dma-buf/dma-buf-sysfs-stats.c | 7 +-- drivers/dma-buf/dma-buf-sysfs-stats.h | 4 +- drivers/dma-buf/dma-buf.c | 84 +++++++++++++-------------- 3 files changed, 43 insertions(+), 52 deletions(-)
drivers/dma-buf/dma-buf-sysfs-stats.c +2 -5
@@ -168,14 +168,11 @@ void dma_buf_uninit_sysfs_statistics(void)kset_unregister (dma_buf_stats_kset); } -int dma_buf_stats_setup (struct dma_buf *dmabuf) +int dma_buf_stats_setup (struct dma_buf *dmabuf,struct file *file) {struct dma_buf_sysfs_entry *sysfs_entry;int ret; -if (!dmabuf || !dmabuf->file) -return -EINVAL ; -if (!dmabuf->exp_name) {pr_err ("exporter name must not be empty if stats needed\n" );return -EINVAL ;
@@ -192,7 +189,7 @@ int dma_buf_stats_setup(struct dma_buf *dmabuf)/* create the directory for buffer stats */ ret =kobject_init_and_add (&sysfs_entry->kobj, &dma_buf_ktype,NULL , -"%lu" ,file_inode (dmabuf->file)->i_ino); +"%lu" ,file_inode (file)->i_ino);if (ret) goto err_sysfs_dmabuf;
drivers/dma-buf/dma-buf-sysfs-stats.h +2 -2
@@ -13,7 +13,7 @@int dma_buf_init_sysfs_statistics (void );void dma_buf_uninit_sysfs_statistics (void ); -int dma_buf_stats_setup (struct dma_buf *dmabuf); +int dma_buf_stats_setup (struct dma_buf *dmabuf,struct file *file);void dma_buf_stats_teardown (struct dma_buf *dmabuf);#else
@@ -25,7 +25,7 @@ static inline int dma_buf_init_sysfs_statistics(void)static inline void dma_buf_uninit_sysfs_statistics (void ) {} -static inline int dma_buf_stats_setup (struct dma_buf *dmabuf) +static inline int dma_buf_stats_setup (struct dma_buf *dmabuf,struct file *file) {return 0 ; }
drivers/dma-buf/dma-buf.c +39 -45
147 lines not on this page · raw message
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 2/193 btrfs: fix trace event name typo for FLUSH_DELAYED_REFS
In reply to Greg Kroah-HartmanFrom: Naohiro Aota <[email protected]>
[ Upstream commit 0a3212de8ab3e2ce5808c6265855e528d4a6767b ]
Fix a typo of printing FLUSH_DELAYED_REFS event in flush_space() as FLUSH_ELAYED_REFS.
--- include/trace/events/btrfs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/trace/events/btrfs.h +1 -1
@@ -98,7 +98,7 @@ struct raid56_bio_trace_info; EM( FLUSH_DELALLOC_WAIT, "FLUSH_DELALLOC_WAIT") \ EM( FLUSH_DELALLOC_FULL, "FLUSH_DELALLOC_FULL") \ EM( FLUSH_DELAYED_REFS_NR, "FLUSH_DELAYED_REFS_NR") \ - EM( FLUSH_DELAYED_REFS, "FLUSH_ELAYED_REFS") \ + EM( FLUSH_DELAYED_REFS, "FLUSH_DELAYED_REFS") \ EM( ALLOC_CHUNK, "ALLOC_CHUNK") \ EM( ALLOC_CHUNK_FORCE, "ALLOC_CHUNK_FORCE") \EM (RUN_DELAYED_IPUTS ,"RUN_DELAYED_IPUTS" ) \
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 3/193 wifi: iwlwifi: fw: skip PPAG for JF
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit 1c4c0b28b517d778d37900deedfe91088839f07a ]
For JF RFs we don't support PPAG, but many firmware images lie about it. Always skip support for JF to avoid firmware errors when sending the command.
--- drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/wireless/intel/iwlwifi/fw/acpi.c +5 -0
@@ -1106,6 +1106,11 @@ int iwl_read_ppag_table(struct iwl_fw_runtime *fwrt, union iwl_ppag_table_cmd *cint i, j, num_sub_bands;s8 *gain; +/* many firmware images for JF lie about this */ +if (CSR_HW_RFID_TYPE (fwrt->trans->hw_rf_id) == +CSR_HW_RFID_TYPE (CSR_HW_RF_ID_TYPE_JF )) +return -EOPNOTSUPP ; +if (!fw_has_capa (&fwrt->fw->ucode_capa,IWL_UCODE_TLV_CAPA_SET_PPAG )) {IWL_DEBUG_RADIO (fwrt,"PPAG capability not supported by FW, command not sent.\n" );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 4/193 pNFS/filelayout: Fix coalescing test for single DS
In reply to Greg Kroah-HartmanFrom: Olga Kornievskaia <[email protected]>
[ Upstream commit a6b9d2fa0024e7e399c26facd0fb466b7396e2b9 ]
When there is a single DS no striping constraints need to be placed on the IO. When such constraint is applied then buffered reads don't coalesce to the DS's rsize.
--- fs/nfs/filelayout/filelayout.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/nfs/filelayout/filelayout.c +8 -0
@@ -783,6 +783,12 @@ filelayout_alloc_lseg(struct pnfs_layout_hdr *layoutid,return &fl->generic_hdr; } +static bool +filelayout_lseg_is_striped (const struct nfs4_filelayout_segment *flseg) +{ +return flseg->num_fh >1 ; +} +/* * filelayout_pg_test(). Called by nfs_can_coalesce_requests() *
@@ -803,6 +809,8 @@ filelayout_pg_test(struct nfs_pageio_descriptor *pgio, struct nfs_page *prev, size =pnfs_generic_pg_test (pgio, prev, req);if (!size)return 0 ; +else if (!filelayout_lseg_is_striped (FILELAYOUT_LSEG (pgio->pg_lseg))) +return size;/* see if req and prev are in the same stripe */ if (prev) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 5/193 selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID
In reply to Greg Kroah-HartmanFrom: Hao Sun <[email protected]>
[ Upstream commit cedebd74cf3883f0384af9ec26b4e6f8f1964dd4 ]
Verify that nullness information is not porpagated in the branches of register to register JEQ and JNE operations if one of them is PTR_TO_BTF_ID. Implement this in C level so we can use CO-RE.
--- .../bpf/prog_tests/jeq_infer_not_null.c | 9 ++++ .../bpf/progs/jeq_infer_not_null_fail.c | 42 +++++++++++++++++++ 2 files changed, 51 insertions(+) create mode 100644 tools/testing/selftests/bpf/prog_tests/jeq_infer_not_null.c create mode 100644 tools/testing/selftests/bpf/progs/jeq_infer_not_null_fail.c
tools/testing/selftests/bpf/prog_tests/jeq_infer_not_null.c new file +9 -0
@@ -0,0 +1,9 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include <test_progs.h> +#include "jeq_infer_not_null_fail.skel.h" + +void test_jeq_infer_not_null (void ) +{ +RUN_TESTS (jeq_infer_not_null_fail); +}
tools/testing/selftests/bpf/progs/jeq_infer_not_null_fail.c new file +42 -0
42 lines not on this page · raw message
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 6/193 net: ethernet: marvell: octeontx2: Fix uninitialized variable warning
In reply to Greg Kroah-HartmanFrom: Anuradha Weeraman <[email protected]>
[ Upstream commit d3805695fe1e7383517903715cefc9bbdcffdc90 ]
Fix for uninitialized variable warning.
Addresses-Coverity: ("Uninitialized scalar variable")
--- drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/af/mcs_rvu_if.c +1 -1
@@ -589,7 +589,7 @@ int rvu_mbox_handler_mcs_free_resources(struct rvu *rvu,u16 pcifunc = req->hdr.pcifunc;struct mcs_rsrc_map *map;struct mcs *mcs; -int rc; +int rc =0 ;if (req->mcs_id >= rvu->mcs_blk_cnt)return MCS_AF_ERR_INVALID_MCSID ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 7/193 tools/virtio: initialize spinlocks in vring_test.c
In reply to Greg Kroah-HartmanFrom: Ricardo Cañuelo <[email protected]>
[ Upstream commit c262f75cb6bb5a63828e72ce3b8fe808e5029479 ]
The virtio_device vqs_list spinlocks must be initialized before use to prevent functions that manipulate the device virtualqueues, such as vring_new_virtqueue(), from blocking indefinitely.
Message-Id: <[email protected]>
--- tools/virtio/vringh_test.c | 2 ++ 1 file changed, 2 insertions(+)
tools/virtio/vringh_test.c +2 -0
@@ -308,6 +308,7 @@ static int parallel_test(u64 features, gvdev.vdev.features = features;INIT_LIST_HEAD (&gvdev.vdev.vqs); +spin_lock_init (&gvdev.vdev.vqs_list_lock); gvdev.to_host_fd = to_host[1 ]; gvdev.notifies =0 ;
@@ -455,6 +456,7 @@ int main(int argc, char *argv[]) getrange = getrange_iov; vdev.features =0 ;INIT_LIST_HEAD (&vdev.vqs); +spin_lock_init (&vdev.vqs_list_lock);while (argv[1 ]) {if (strcmp (argv[1 ],"--indirect" ) ==0 )
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 8/193 vdpa/mlx5: Return error on vlan ctrl commands if not supported
In reply to Greg Kroah-HartmanFrom: Eli Cohen <[email protected]>
[ Upstream commit 5aec804936bbff182081f1cdc271fcb76af1a4ff ]
Check if VIRTIO_NET_F_CTRL_VLAN is negotiated and return error if control VQ command is received.
Message-Id: <[email protected]>
--- drivers/vdpa/mlx5/net/mlx5_vnet.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/vdpa/mlx5/net/mlx5_vnet.c +3 -0
@@ -1823,6 +1823,9 @@ static virtio_net_ctrl_ack handle_ctrl_vlan(struct mlx5_vdpa_dev *mvdev, u8 cmd)size_t read;u16 id; +if (!(ndev->mvdev.actual_features &BIT_ULL (VIRTIO_NET_F_CTRL_VLAN ))) +return status; +switch (cmd) {case VIRTIO_NET_CTRL_VLAN_ADD : read =vringh_iov_pull_iotlb (&cvq->vring, &cvq->riov, &vlan,sizeof (vlan));
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 9/193 vdpa/mlx5: Avoid using reslock in event_handler
In reply to Greg Kroah-HartmanFrom: Eli Cohen <[email protected]>
[ Upstream commit 0dbc1b4ae07d003b2e88ba9d4142846320f8e349 ]
event_handler runs under atomic context and may not acquire reslock. We can still guarantee that the handler won't be called after suspend by clearing nb_registered, unregistering the handler and flushing the workqueue.
Message-Id: <[email protected]>
--- drivers/vdpa/mlx5/net/mlx5_vnet.c | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-)
drivers/vdpa/mlx5/net/mlx5_vnet.c +4 -12
@@ -2845,8 +2845,8 @@ static int mlx5_vdpa_suspend(struct vdpa_device *vdev)int i;down_write (&ndev->reslock); -mlx5_notifier_unregister (mvdev->mdev, &ndev->nb); ndev->nb_registered = false; +mlx5_notifier_unregister (mvdev->mdev, &ndev->nb);flush_workqueue (ndev->mvdev.wq);for (i =0 ; i < ndev->cur_num_vqs; i++) { mvq = &ndev->vqs[i];
@@ -3024,7 +3024,7 @@ static void update_carrier(struct work_struct *work)else ndev->config.status &=cpu_to_mlx5vdpa16 (mvdev, ~VIRTIO_NET_S_LINK_UP ); -if (ndev->config_cb.callback) +if (ndev->nb_registered && ndev->config_cb.callback) ndev->config_cb.callback (ndev->config_cb.private);kfree (wqent);
@@ -3041,21 +3041,13 @@ static int event_handler(struct notifier_block *nb, unsigned long event, void *pswitch (eqe->sub_type) {case MLX5_PORT_CHANGE_SUBTYPE_DOWN :case MLX5_PORT_CHANGE_SUBTYPE_ACTIVE : -down_read (&ndev->reslock); -if (!ndev->nb_registered) { -up_read (&ndev->reslock); -return NOTIFY_DONE ; - } wqent =kzalloc (sizeof (*wqent),GFP_ATOMIC ); -if (!wqent) { -up_read (&ndev->reslock); +if (!wqent)return NOTIFY_DONE ; - } wqent->mvdev = &ndev->mvdev;INIT_WORK (&wqent->work, update_carrier);queue_work (ndev->mvdev.wq, &wqent->work); -up_read (&ndev->reslock); ret =NOTIFY_OK ;break ;default :
@@ -3242,8 +3234,8 @@ static void mlx5_vdpa_dev_del(struct vdpa_mgmt_dev *v_mdev, struct vdpa_device *struct workqueue_struct *wq;if (ndev->nb_registered) { -mlx5_notifier_unregister (mvdev->mdev, &ndev->nb); ndev->nb_registered = false; +mlx5_notifier_unregister (mvdev->mdev, &ndev->nb); } wq = mvdev->wq; mvdev->wq =NULL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 10/193 vdpa/mlx5: Avoid overwriting CVQ iotlb
In reply to Greg Kroah-HartmanFrom: Eli Cohen <[email protected]>
[ Upstream commit 38fc462f57ef4e5dc722bab6824854b105de8aa2 ]
When qemu uses different address spaces for data and control virtqueues, the current code would overwrite the control virtqueue iotlb through the dup_iotlb call. Fix this by referring to the address space identifier and the group to asid mapping to determine which mapping needs to be updated. We also move the address space logic from mlx5 net to core directory.
Message-Id: <[email protected]>
--- drivers/vdpa/mlx5/core/mlx5_vdpa.h | 5 +-- drivers/vdpa/mlx5/core/mr.c | 44 ++++++++++++++++----------- drivers/vdpa/mlx5/net/mlx5_vnet.c | 49 ++++++------------------------ 3 files changed, 39 insertions(+), 59 deletions(-)
drivers/vdpa/mlx5/core/mlx5_vdpa.h +3 -2
@@ -116,8 +116,9 @@ int mlx5_vdpa_create_mkey(struct mlx5_vdpa_dev *mvdev, u32 *mkey, u32 *in, int inlen);int mlx5_vdpa_destroy_mkey (struct mlx5_vdpa_dev *mvdev,u32 mkey);int mlx5_vdpa_handle_set_map (struct mlx5_vdpa_dev *mvdev,struct vhost_iotlb *iotlb, -bool *change_map); -int mlx5_vdpa_create_mr (struct mlx5_vdpa_dev *mvdev,struct vhost_iotlb *iotlb); +bool *change_map,unsigned int asid); +int mlx5_vdpa_create_mr (struct mlx5_vdpa_dev *mvdev,struct vhost_iotlb *iotlb, +unsigned int asid);void mlx5_vdpa_destroy_mr (struct mlx5_vdpa_dev *mvdev);#define mlx5_vdpa_warn (__dev, format, ...) \
drivers/vdpa/mlx5/core/mr.c +26 -18
82 lines not on this page · raw message
drivers/vdpa/mlx5/net/mlx5_vnet.c +10 -39
95 lines not on this page · raw message
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 11/193 virtio_pci: modify ENOENT to EINVAL
In reply to Greg Kroah-HartmanFrom: Angus Chen <[email protected]>
[ Upstream commit b66ead2d0ecac00c3a06a6218af5411cb5fcb5d5 ]
Virtio_crypto use max_data_queues+1 to setup vqs,
we use vp_modern_get_num_queues to protect the vq range in setup_vq. We could enter index >= vp_modern_get_num_queues(mdev) in setup_vq if common->num_queues is not set well,and it return -ENOENT. It is better to use -EINVAL instead.
Message-Id: <[email protected]>
--- drivers/virtio/virtio_pci_modern.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/virtio/virtio_pci_modern.c +1 -1
@@ -303,7 +303,7 @@ static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev,int err;if (index >=vp_modern_get_num_queues (mdev)) -return ERR_PTR (-ENOENT ); +return ERR_PTR (-EINVAL );/* Check if queue is either not available or already active. */ num =vp_modern_get_queue_size (mdev, index);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 12/193 vduse: Validate vq_num in vduse_validate_config()
In reply to Greg Kroah-HartmanFrom: Harshit Mogalapalli <[email protected]>
[ Upstream commit 937c783aa3d8d77963ec91918d3298edb45b9161 ]
Add a limit to 'config->vq_num' which is user controlled data which comes from an vduse_ioctl to prevent large memory allocations.
Micheal says - This limit is somewhat arbitrary.
However, currently virtio pci and ccw are limited to a 16 bit vq number. While MMIO isn't it is also isn't used with lots of VQs due to current lack of support for per-vq interrupts.
Thus, the 0xffff limit on number of VQs corresponding
to a 16-bit VQ number seems sufficient for now.
This is found using static analysis with smatch.
Message-Id: <[email protected]>
--- drivers/vdpa/vdpa_user/vduse_dev.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/vdpa/vdpa_user/vduse_dev.c +3 -0
@@ -1440,6 +1440,9 @@ static bool vduse_validate_config(struct vduse_dev_config *config)if (config->config_size >PAGE_SIZE )return false; +if (config->vq_num >0xffff ) +return false; +if (!device_is_allowed (config->device_id))return false;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 13/193 vdpa_sim_net: should not drop the multicast/broadcast packet
In reply to Greg Kroah-HartmanFrom: Cindy Lu <[email protected]>
[ Upstream commit 72455a1142527e607e1d69439f3ffa2ef6d09e26 ]
In the receive_filter(), should not drop the packet with the broadcast/multicast address. Add the check for this
Message-Id: <[email protected]>
--- drivers/vdpa/vdpa_sim/vdpa_sim_net.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/vdpa/vdpa_sim/vdpa_sim_net.c +3 -0
@@ -62,6 +62,9 @@ static bool receive_filter(struct vdpasim *vdpasim, size_t len)if (len <ETH_ALEN + hdr_len)return false; +if (is_broadcast_ether_addr (vdpasim->buffer + hdr_len) || +is_multicast_ether_addr (vdpasim->buffer + hdr_len)) +return true;if (!strncmp (vdpasim->buffer + hdr_len, vio_config->mac,ETH_ALEN ))return true;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 14/193 net/ethtool/ioctl: return -EOPNOTSUPP if we have no phy stats
In reply to Greg Kroah-HartmanFrom: Daniil Tatianin <[email protected]>
[ Upstream commit 9deb1e9fb88b1120a908676fa33bdf9e2eeaefce ]
It's not very useful to copy back an empty ethtool_stats struct and return 0 if we didn't actually have any stats. This also allows for further simplification of this function in the future commits.
--- net/ethtool/ioctl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ethtool/ioctl.c +2 -1
@@ -2094,7 +2094,8 @@ static int ethtool_get_phy_stats(struct net_device *dev, void __user *useraddr)return n_stats;if (n_stats >S32_MAX /sizeof (u64))return -ENOMEM ; -WARN_ON_ONCE (!n_stats); +if (WARN_ON_ONCE (!n_stats)) +return -EOPNOTSUPP ;if (copy_from_user (&stats, useraddr,sizeof (stats)))return -EFAULT ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 15/193 r8169: move rtl_wol_enable_rx() and rtl_prepare_power_down()
In reply to Greg Kroah-HartmanFrom: Chunhao Lin <[email protected]>
[ Upstream commit ad425666a1f05d9b215a84cf010c3789b2ea8206 ]
There is no functional change. Moving these two functions for following patch "r8169: fix dmar pte write access is not set error".
--- drivers/net/ethernet/realtek/r8169_main.c | 44 +++++++++++------------ 1 file changed, 22 insertions(+), 22 deletions(-)
drivers/net/ethernet/realtek/r8169_main.c +22 -22
@@ -2207,28 +2207,6 @@ static int rtl_set_mac_address(struct net_device *dev, void *p)return 0 ; } -static void rtl_wol_enable_rx (struct rtl8169_private *tp) -{ -if (tp->mac_version >=RTL_GIGA_MAC_VER_25 ) -RTL_W32 (tp, RxConfig,RTL_R32 (tp, RxConfig) | - AcceptBroadcast | AcceptMulticast | AcceptMyPhys); -} - -static void rtl_prepare_power_down (struct rtl8169_private *tp) -{ -if (tp->dash_type !=RTL_DASH_NONE ) -return ; - -if (tp->mac_version ==RTL_GIGA_MAC_VER_32 || - tp->mac_version ==RTL_GIGA_MAC_VER_33 ) -rtl_ephy_write (tp,0x19 ,0xff64 ); - -if (device_may_wakeup (tp_to_dev (tp))) { -phy_speed_down (tp->phydev, false); -rtl_wol_enable_rx (tp); - } -} -static void rtl_init_rxcfg (struct rtl8169_private *tp) {switch (tp->mac_version) {
@@ -2452,6 +2430,28 @@ static void rtl_enable_rxdvgate(struct rtl8169_private *tp)rtl_wait_txrx_fifo_empty (tp); } +static void rtl_wol_enable_rx (struct rtl8169_private *tp) +{ +if (tp->mac_version >=RTL_GIGA_MAC_VER_25 ) +RTL_W32 (tp, RxConfig,RTL_R32 (tp, RxConfig) | + AcceptBroadcast | AcceptMulticast | AcceptMyPhys); +} + +static void rtl_prepare_power_down (struct rtl8169_private *tp) +{ +if (tp->dash_type !=RTL_DASH_NONE ) +return ; + +if (tp->mac_version ==RTL_GIGA_MAC_VER_32 || + tp->mac_version ==RTL_GIGA_MAC_VER_33 ) +rtl_ephy_write (tp,0x19 ,0xff64 ); + +if (device_may_wakeup (tp_to_dev (tp))) { +phy_speed_down (tp->phydev, false); +rtl_wol_enable_rx (tp); + } +} +static void rtl_set_tx_config_registers (struct rtl8169_private *tp) { u32 val = TX_DMA_BURST << TxDMAShift |
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 16/193 r8169: fix dmar pte write access is not set error
In reply to Greg Kroah-HartmanFrom: Chunhao Lin <[email protected]>
[ Upstream commit bb41c13c05c23d9bc46b4e37d8914078c6a40e3a ]
When close device, if wol is enabled, rx will be enabled. When open device it will cause rx packet to be dma to the wrong memory address after pci_set_master() and system log will show blow messages.
DMAR: DRHD: handling fault status reg 3
DMAR: [DMA Write] Request device [02:00.0] PASID ffffffff fault addr ffdd4000 [fault reason 05] PTE Write access is not set
In this patch, driver disable tx/rx when close device. If wol is enabled, only enable rx filter and disable rxdv_gate(if support) to let hardware only receive packet to fifo but not to dma it.
--- drivers/net/ethernet/realtek/r8169_main.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/net/ethernet/realtek/r8169_main.c +7 -7
@@ -2435,6 +2435,9 @@ static void rtl_wol_enable_rx(struct rtl8169_private *tp)if (tp->mac_version >=RTL_GIGA_MAC_VER_25 )RTL_W32 (tp, RxConfig,RTL_R32 (tp, RxConfig) | AcceptBroadcast | AcceptMulticast | AcceptMyPhys); + +if (tp->mac_version >=RTL_GIGA_MAC_VER_40 ) +rtl_disable_rxdvgate (tp); }static void rtl_prepare_power_down (struct rtl8169_private *tp)
@@ -3869,7 +3872,7 @@ static void rtl8169_tx_clear(struct rtl8169_private *tp)netdev_reset_queue (tp->dev); } -static void rtl8169_cleanup (struct rtl8169_private *tp,bool going_down) +static void rtl8169_cleanup (struct rtl8169_private *tp) {napi_disable (&tp->napi);
@@ -3881,9 +3884,6 @@ static void rtl8169_cleanup(struct rtl8169_private *tp, bool going_down)rtl_rx_close (tp); -if (going_down && tp->dev->wol_enabled) - goto no_reset; -switch (tp->mac_version) {case RTL_GIGA_MAC_VER_28 :case RTL_GIGA_MAC_VER_31 :
@@ -3904,7 +3904,7 @@ static void rtl8169_cleanup(struct rtl8169_private *tp, bool going_down) }rtl_hw_reset (tp); -no_reset: +rtl8169_tx_clear (tp);rtl8169_init_ring_indexes (tp); }
@@ -3915,7 +3915,7 @@ static void rtl_reset_work(struct rtl8169_private *tp)netif_stop_queue (tp->dev); -rtl8169_cleanup (tp, false); +rtl8169_cleanup (tp);for (i =0 ; i <NUM_RX_DESC ; i++)rtl8169_mark_to_asic (tp->RxDescArray + i);
@@ -4601,7 +4601,7 @@ static void rtl8169_down(struct rtl8169_private *tp)pci_clear_master (tp->pci_dev);rtl_pci_commit (tp); -rtl8169_cleanup (tp, true); +rtl8169_cleanup (tp);rtl_disable_exit_l1 (tp);rtl_prepare_power_down (tp); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 17/193 bpf: keep a reference to the mm, in case the task is dead.
In reply to Greg Kroah-HartmanFrom: Kui-Feng Lee <[email protected]>
[ Upstream commit 7ff94f276f8ea05df82eb115225e9b26f47a3347 ]
Fix the system crash that happens when a task iterator travel through vma of tasks.
In task iterators, we used to access mm by following the pointer on the task_struct; however, the death of a task will clear the pointer, even though we still hold the task_struct. That can cause an unexpected crash for a null pointer when an iterator is visiting a task that dies during the visit. Keeping a reference of mm on the iterator ensures we always have a valid pointer to mm.
--- kernel/bpf/task_iter.c | 39 +++++++++++++++++++++++++++------------ 1 file changed, 27 insertions(+), 12 deletions(-)
kernel/bpf/task_iter.c +27 -12
@@ -438,6 +438,7 @@ struct bpf_iter_seq_task_vma_info {*/ struct bpf_iter_seq_task_common common;struct task_struct *task; +struct mm_struct *mm;struct vm_area_struct *vma;u32 tid;unsigned long prev_vm_start;
@@ -456,16 +457,19 @@ task_vma_seq_get_next(struct bpf_iter_seq_task_vma_info *info)enum bpf_task_vma_iter_find_op op;struct vm_area_struct *curr_vma;struct task_struct *curr_task; +struct mm_struct *curr_mm;u32 saved_tid = info->tid;/* If this function returns a non-NULL vma, it holds a reference to -* the task_struct, and holds read lock on vma->mm->mmap_lock. +* the task_struct, holds a refcount on mm->mm_users, and holds +* read lock on vma->mm->mmap_lock. * If this function returns NULL, it does not hold any reference or * lock. */ if (info->task) { curr_task = info->task; curr_vma = info->vma; + curr_mm = info->mm;/* In case of lock contention, drop mmap_lock to unblock * the writer. *
@@ -504,13 +508,15 @@ task_vma_seq_get_next(struct bpf_iter_seq_task_vma_info *info)* 4.2) VMA2 and VMA2' covers different ranges, process * VMA2'. */ -if (mmap_lock_is_contended (curr_task->mm)) { +if (mmap_lock_is_contended (curr_mm)) { info->prev_vm_start = curr_vma->vm_start; info->prev_vm_end = curr_vma->vm_end; op = task_vma_iter_find_vma; -mmap_read_unlock (curr_task->mm); -if (mmap_read_lock_killable (curr_task->mm)) +mmap_read_unlock (curr_mm); +if (mmap_read_lock_killable (curr_mm)) { +mmput (curr_mm); goto finish; + } }else { op = task_vma_iter_next_vma; }
@@ -535,42 +541,47 @@ task_vma_seq_get_next(struct bpf_iter_seq_task_vma_info *info) op = task_vma_iter_find_vma; } -if (!curr_task->mm) + curr_mm =get_task_mm (curr_task); +if (!curr_mm) goto next_task; -if (mmap_read_lock_killable (curr_task->mm)) +if (mmap_read_lock_killable (curr_mm)) { +mmput (curr_mm); goto finish; + } }switch (op) {case task_vma_iter_first_vma: - curr_vma =find_vma (curr_task->mm,0 ); + curr_vma =find_vma (curr_mm,0 );break ;case task_vma_iter_next_vma: - curr_vma =find_vma (curr_task->mm, curr_vma->vm_end); + curr_vma =find_vma (curr_mm, curr_vma->vm_end);break ;case task_vma_iter_find_vma:/* We dropped mmap_lock so it is necessary to use find_vma * to find the next vma. This is similar to the mechanism * in show_smaps_rollup(). */ - curr_vma =find_vma (curr_task->mm, info->prev_vm_end -1 ); + curr_vma =find_vma (curr_mm, info->prev_vm_end -1 );/* case 1) and 4.2) above just use curr_vma */ /* check for case 2) or case 4.1) above */ if (curr_vma && curr_vma->vm_start == info->prev_vm_start && curr_vma->vm_end == info->prev_vm_end) - curr_vma =find_vma (curr_task->mm, curr_vma->vm_end); + curr_vma =find_vma (curr_mm, curr_vma->vm_end);break ; }if (!curr_vma) {/* case 3) above, or case 2) 4.1) with vma->next == NULL */ -mmap_read_unlock (curr_task->mm); +mmap_read_unlock (curr_mm); +mmput (curr_mm); goto next_task; } info->task = curr_task; info->vma = curr_vma; + info->mm = curr_mm;return curr_vma; next_task:
@@ -579,6 +590,7 @@ task_vma_seq_get_next(struct bpf_iter_seq_task_vma_info *info)put_task_struct (curr_task); info->task =NULL ; + info->mm =NULL ; info->tid++; goto again;
@@ -587,6 +599,7 @@ task_vma_seq_get_next(struct bpf_iter_seq_task_vma_info *info)put_task_struct (curr_task); info->task =NULL ; info->vma =NULL ; + info->mm =NULL ;return NULL ; }
@@ -658,7 +671,9 @@ static void task_vma_seq_stop(struct seq_file *seq, void *v)*/ info->prev_vm_start = ~0UL ; info->prev_vm_end = info->vma->vm_end; -mmap_read_unlock (info->task->mm); +mmap_read_unlock (info->mm); +mmput (info->mm); + info->mm =NULL ;put_task_struct (info->task); info->task =NULL ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 18/193 RDMA/srp: Move large values to a new enum for gcc13
In reply to Greg Kroah-HartmanFrom: Jiri Slaby (SUSE) <[email protected]>
[ Upstream commit 56c5dab20a6391604df9521f812c01d1e3fe1bd0 ]
Since gcc13, each member of an enum has the same type as the enum [1]. And that is inherited from its members. Provided these two:
SRP_TAG_NO_REQ = ~0U,
SRP_TAG_TSK_MGMT = 1U << 31
all other members are unsigned ints.
Esp. with SRP_MAX_SGE and SRP_TSK_MGMT_SQ_SIZE and their use in min(), this results in the following warnings:
include/linux/minmax.h:20:35: error: comparison of distinct pointer types lacks a cast drivers/infiniband/ulp/srp/ib_srp.c:563:42: note: in expansion of macro 'min'
include/linux/minmax.h:20:35: error: comparison of distinct pointer types lacks a cast drivers/infiniband/ulp/srp/ib_srp.c:2369:27: note: in expansion of macro 'min'
So move the large values away to a separate enum, so that they don't affect other members.
[1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=36113
--- drivers/infiniband/ulp/srp/ib_srp.h | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/infiniband/ulp/srp/ib_srp.h +5 -3
@@ -62,9 +62,6 @@ enum {SRP_DEFAULT_CMD_SQ_SIZE =SRP_DEFAULT_QUEUE_SIZE -SRP_RSP_SQ_SIZE -SRP_TSK_MGMT_SQ_SIZE , -SRP_TAG_NO_REQ = ~0U , -SRP_TAG_TSK_MGMT =1U <<31 , -SRP_MAX_PAGES_PER_MR =512 , SRP_MAX_ADD_CDB_LEN = 16,
@@ -79,6 +76,11 @@ enum { sizeof(struct srp_imm_buf), }; +enum { +SRP_TAG_NO_REQ = ~0U , +SRP_TAG_TSK_MGMT =BIT (31 ), +}; +enum srp_target_state {SRP_TARGET_SCANNING ,SRP_TARGET_LIVE ,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 19/193 selftests: net: fix cmsg_so_mark.sh test hang
In reply to Greg Kroah-HartmanFrom: Po-Hsu Lin <[email protected]>
[ Upstream commit 1573c6882018f69991aead951d09423ce978adac ]
This cmsg_so_mark.sh test will hang on non-amd64 systems because of the infinity loop for argument parsing in cmsg_sender.
Variable "o" in cs_parse_args() for taking getopt() should be an int, otherwise it will be 255 when getopt() returns -1 on non-amd64 system and thus causing infinity loop.
--- tools/testing/selftests/net/cmsg_sender.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/cmsg_sender.c +1 -1
@@ -110,7 +110,7 @@ static void __attribute__((noreturn)) cs_usage(const char *bin)static void cs_parse_args (int argc,char *argv[]) { -char o; +int o;while ((o =getopt (argc, argv,"46sS:p:m:M:d:tf:F:c:C:l:L:H:" )) !=-1 ) {switch (o) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 20/193 btrfs: always report error in run_one_delayed_ref()
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
[ Upstream commit 39f501d68ec1ed5cd5c66ac6ec2a7131c517bb92 ]
Currently we have a btrfs_debug() for run_one_delayed_ref() failure, but if end users hit such problem, there will be no chance that btrfs_debug() is enabled. This can lead to very little useful info for debugging.
This patch will:
- Add extra info for error reporting
Including:
* logical bytenr
* num_bytes
* type
* action
* ref_mod
- Replace the btrfs_debug() with btrfs_err()
- Move the error reporting into run_one_delayed_ref()
This is to avoid use-after-free, the @node can be freed in the caller.
This error should only be triggered at most once.
As if run_one_delayed_ref() failed, we trigger the error message, then causing the call chain to error out:
btrfs_run_delayed_refs()
`- btrfs_run_delayed_refs()
`- btrfs_run_delayed_refs_for_head()
`- run_one_delayed_ref()
And we will abort the current transaction in btrfs_run_delayed_refs(). If we have to run delayed refs for the abort transaction, run_one_delayed_ref() will just cleanup the refs and do nothing, thus no new error messages would be output.
--- fs/btrfs/extent-tree.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
fs/btrfs/extent-tree.c +5 -2
@@ -1706,6 +1706,11 @@ static int run_one_delayed_ref(struct btrfs_trans_handle *trans,BUG ();if (ret && insert_reserved)btrfs_pin_extent (trans, node->bytenr, node->num_bytes,1 ); +if (ret <0 ) +btrfs_err (trans->fs_info, +"failed to run delayed ref for logical %llu num_bytes %llu type %u action %u ref_mod %d: %d" , + node->bytenr, node->num_bytes, node->type, + node->action, node->ref_mod, ret);return ret; }
@@ -1947,8 +1952,6 @@ static int btrfs_run_delayed_refs_for_head(struct btrfs_trans_handle *trans,if (ret) {unselect_delayed_ref_head (delayed_refs, locked_ref);btrfs_put_delayed_ref (ref); -btrfs_debug (fs_info,"run_one_delayed_ref returned %d" , - ret);return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 21/193 x86/asm: Fix an assembler warning with current binutils
In reply to Greg Kroah-HartmanFrom: Mikulas Patocka <[email protected]>
[ Upstream commit 55d235361fccef573990dfa5724ab453866e7816 ]
Fix a warning: "found movsd'; assuming movsl' was meant"
--- arch/x86/lib/iomap_copy_64.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/lib/iomap_copy_64.S +1 -1
@@ -10,6 +10,6 @@ */ SYM_FUNC_START(__iowrite32_copy) movl %edx,%ecx - rep movsd + rep movsl RET SYM_FUNC_END(__iowrite32_copy)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 22/193 f2fs: lets avoid panic if extent_tree is not created
In reply to Greg Kroah-HartmanFrom: Jaegeuk Kim <[email protected]>
[ Upstream commit df9d44b645b83fffccfb4e28c1f93376585fdec8 ]
This patch avoids the below panic.
pc : __lookup_extent_tree+0xd8/0x760 lr : f2fs_do_write_data_page+0x104/0x87c
sp : ffffffc010cbb3c0
x29: ffffffc010cbb3e0 x28: 0000000000000000
x27: ffffff8803e7f020 x26: ffffff8803e7ed40
x25: ffffff8803e7f020 x24: ffffffc010cbb460
x23: ffffffc010cbb480 x22: 0000000000000000
x21: 0000000000000000 x20: ffffffff22e90900
x19: 0000000000000000 x18: ffffffc010c5d080
x17: 0000000000000000 x16: 0000000000000020
x15: ffffffdb1acdbb88 x14: ffffff888759e2b0
x13: 0000000000000000 x12: ffffff802da49000
x11: 000000000a001200 x10: ffffff8803e7ed40 x9 : ffffff8023195800 x8 : ffffff802da49078 x7 : 0000000000000001 x6 : 0000000000000000 x5 : 0000000000000006 x4 : ffffffc010cbba28 x3 : 0000000000000000 x2 : ffffffc010cbb480 x1 : 0000000000000000 x0 : ffffff8803e7ed40
Call trace: __lookup_extent_tree+0xd8/0x760 f2fs_do_write_data_page+0x104/0x87c f2fs_write_single_data_page+0x420/0xb60 f2fs_write_cache_pages+0x418/0xb1c __f2fs_write_data_pages+0x428/0x58c f2fs_write_data_pages+0x30/0x40 do_writepages+0x88/0x190 __writeback_single_inode+0x48/0x448 writeback_sb_inodes+0x468/0x9e8 __writeback_inodes_wb+0xb8/0x2a4 wb_writeback+0x33c/0x740 wb_do_writeback+0x2b4/0x400 wb_workfn+0xe4/0x34c process_one_work+0x24c/0x5bc worker_thread+0x3e8/0xa50 kthread+0x150/0x1b4
--- fs/f2fs/extent_cache.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/f2fs/extent_cache.c +2 -1
@@ -415,7 +415,8 @@ static bool f2fs_lookup_extent_tree(struct inode *inode, pgoff_t pgofs,struct extent_node *en;bool ret = false; -f2fs_bug_on (sbi, !et); +if (!et) +return false;trace_f2fs_lookup_extent_tree_start (inode, pgofs);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 23/193 perf/x86/rapl: Treat Tigerlake like Icelake
In reply to Greg Kroah-HartmanFrom: Chris Wilson <[email protected]>
[ Upstream commit c07311b5509f6035f1dd828db3e90ff4859cf3b9 ]
Since Tigerlake seems to have inherited its cstates and other RAPL power caps from Icelake, assume it also follows Icelake for its RAPL events.
--- arch/x86/events/rapl.c | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/events/rapl.c +2 -0
@@ -800,6 +800,8 @@ static const struct x86_cpu_id rapl_model_match[] __initconst = {X86_MATCH_INTEL_FAM6_MODEL (ICELAKE_X , &model_hsx),X86_MATCH_INTEL_FAM6_MODEL (COMETLAKE_L , &model_skl),X86_MATCH_INTEL_FAM6_MODEL (COMETLAKE , &model_skl), +X86_MATCH_INTEL_FAM6_MODEL (TIGERLAKE_L , &model_skl), +X86_MATCH_INTEL_FAM6_MODEL (TIGERLAKE , &model_skl),X86_MATCH_INTEL_FAM6_MODEL (ALDERLAKE , &model_skl),X86_MATCH_INTEL_FAM6_MODEL (ALDERLAKE_L , &model_skl), X86_MATCH_INTEL_FAM6_MODEL(ALDERLAKE_N, &model_skl),
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 24/193 cifs: fix race in assemble_neg_contexts()
In reply to Greg Kroah-HartmanFrom: Paulo Alcantara <[email protected]>
[ Upstream commit 775e44d6d86dca400d614cbda5dab4def4951fe7 ]
Serialise access of TCP_Server_Info::hostname in assemble_neg_contexts() by holding the server's mutex otherwise it might end up accessing an already-freed hostname pointer from cifs_reconnect() or cifs_resolve_server().
--- fs/cifs/smb2pdu.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
fs/cifs/smb2pdu.c +7 -4
@@ -541,9 +541,10 @@ static void assemble_neg_contexts(struct smb2_negotiate_req *req, struct TCP_Server_Info *server, unsigned int *total_len) { - char *pneg_ctxt; -char *hostname =NULL ; unsigned int ctxt_len, neg_context_count; +struct TCP_Server_Info *pserver; +char *pneg_ctxt; +char *hostname;if (*total_len >200 ) {/* In case length corrupted don't want to overrun smb buffer */
@@ -574,8 +575,9 @@ assemble_neg_contexts(struct smb2_negotiate_req *req,* secondary channels don't have the hostname field populated * use the hostname field in the primary channel instead */ - hostname =CIFS_SERVER_IS_CHAN (server) ? - server->primary_server->hostname : server->hostname; + pserver =CIFS_SERVER_IS_CHAN (server) ? server->primary_server : server; +cifs_server_lock (pserver); + hostname = pserver->hostname;if (hostname && (hostname[0 ] !=0 )) { ctxt_len =build_netname_ctxt ((struct smb2_netname_neg_context *)pneg_ctxt, hostname);
@@ -584,6 +586,7 @@ assemble_neg_contexts(struct smb2_negotiate_req *req, neg_context_count =3 ; }else neg_context_count =2 ; +cifs_server_unlock (pserver);build_posix_ctxt ((struct smb2_posix_neg_context *)pneg_ctxt); *total_len +=sizeof (struct smb2_posix_neg_context );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 25/193 memblock tests: Fix compilation error.
In reply to Greg Kroah-HartmanFrom: Aaron Thompson <[email protected]>
[ Upstream commit 340726747336716350eb5a928b860a29db955f05 ]
Commit cf4694be2b2cf ("tools: Add atomic_test_and_set_bit()") changed tools/arch/x86/include/asm/atomic.h to include <asm/asm.h>, which causes 'make -C tools/testing/memblock' to fail with:
In file included from ../../include/asm/atomic.h:6,
from ../../include/linux/atomic.h:5,
from ./linux/mmzone.h:5,
from ../../include/linux/mm.h:5,
from ../../include/linux/pfn.h:5,
from ./linux/memory_hotplug.h:6,
from ./linux/init.h:7,
from ./linux/memblock.h:11,
from tests/common.h:8,
from tests/basic_api.h:5,
from main.c:2:
../../include/asm/../../arch/x86/include/asm/atomic.h:11:10: fatal error: asm/asm.h: No such file or directory
11 | #include <asm/asm.h>
| ^~~~~~~~~~~Create a symlink to asm/asm.h in the same manner as the existing one to asm/cmpxchg.h.
--- tools/testing/memblock/.gitignore | 1 + tools/testing/memblock/Makefile | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-)
tools/testing/memblock/.gitignore +1 -0
@@ -1,4 +1,5 @@ main memblock.c linux/memblock.h +asm/asm.h asm/cmpxchg.h
tools/testing/memblock/Makefile +2 -1
@@ -29,13 +29,14 @@ include: ../../../include/linux/memblock.h ../../include/linux/*.h \ @mkdir -p linux test -L linux/memblock.h || ln -s ../../../../include/linux/memblock.h linux/memblock.h + test -L asm/asm.h || ln -s ../../../arch/x86/include/asm/asm.h asm/asm.h test -L asm/cmpxchg.h || ln -s ../../../arch/x86/include/asm/cmpxchg.h asm/cmpxchg.h memblock.c: $(EXTR_SRC) test -L memblock.c || ln -s $(EXTR_SRC) memblock.c clean: - $(RM) $(TARGETS) $(OFILES) linux/memblock.h memblock.c asm/cmpxchg.h + $(RM) $(TARGETS) $(OFILES) linux/memblock.h memblock.c asm/asm.h asm/cmpxchg.h help: @echo 'Memblock simulator'
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 26/193 perf/x86/rapl: Add support for Intel Meteor Lake
In reply to Greg Kroah-HartmanFrom: Zhang Rui <[email protected]>
[ Upstream commit f52853a668bfeddd79f319d536a506f68cc2b478 ]
Meteor Lake RAPL support is the same as previous Sky Lake. Add Meteor Lake model for RAPL.
--- arch/x86/events/rapl.c | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/events/rapl.c +2 -0
@@ -809,6 +809,8 @@ static const struct x86_cpu_id rapl_model_match[] __initconst = {X86_MATCH_INTEL_FAM6_MODEL (RAPTORLAKE , &model_skl),X86_MATCH_INTEL_FAM6_MODEL (RAPTORLAKE_P , &model_skl),X86_MATCH_INTEL_FAM6_MODEL (RAPTORLAKE_S , &model_skl), +X86_MATCH_INTEL_FAM6_MODEL (METEORLAKE , &model_skl), +X86_MATCH_INTEL_FAM6_MODEL (METEORLAKE_L , &model_skl), {}, };MODULE_DEVICE_TABLE (x86cpu, rapl_model_match);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 27/193 perf/x86/rapl: Add support for Intel Emerald Rapids
In reply to Greg Kroah-HartmanFrom: Zhang Rui <[email protected]>
[ Upstream commit 57512b57dcfaf63c52d8ad2fb35321328cde31b0 ]
Emerald Rapids RAPL support is the same as previous Sapphire Rapids. Add Emerald Rapids model for RAPL.
--- arch/x86/events/rapl.c | 1 + 1 file changed, 1 insertion(+)
arch/x86/events/rapl.c +1 -0
@@ -806,6 +806,7 @@ static const struct x86_cpu_id rapl_model_match[] __initconst = {X86_MATCH_INTEL_FAM6_MODEL (ALDERLAKE_L , &model_skl),X86_MATCH_INTEL_FAM6_MODEL (ALDERLAKE_N , &model_skl),X86_MATCH_INTEL_FAM6_MODEL (SAPPHIRERAPIDS_X , &model_spr), +X86_MATCH_INTEL_FAM6_MODEL (EMERALDRAPIDS_X , &model_spr),X86_MATCH_INTEL_FAM6_MODEL (RAPTORLAKE , &model_skl),X86_MATCH_INTEL_FAM6_MODEL (RAPTORLAKE_P , &model_skl), X86_MATCH_INTEL_FAM6_MODEL(RAPTORLAKE_S, &model_skl),
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 28/193 of: fdt: Honor CONFIG_CMDLINE* even without /chosen node, take 2
In reply to Greg Kroah-HartmanFrom: Rob Herring <[email protected]>
[ Upstream commit 064e32dc5b03114d0767893fecdaf7b5dfd8c286 ]
I do not read a strict requirement on /chosen node in either ePAPR or in Documentation/devicetree. Help text for CONFIG_CMDLINE and CONFIG_CMDLINE_EXTEND doesn't make their behavior explicitly dependent on the presence of /chosen or the presense of /chosen/bootargs.
However the early check for /chosen and bailing out in early_init_dt_scan_chosen() skips CONFIG_CMDLINE handling which is not really related to /chosen node or the particular method of passing cmdline from bootloader.
This leads to counterintuitive combinations (assuming CONFIG_CMDLINE_EXTEND=y):
a) bootargs="foo", CONFIG_CMDLINE="bar" => cmdline=="foo bar"
b) /chosen missing, CONFIG_CMDLINE="bar" => cmdline==""
c) bootargs="", CONFIG_CMDLINE="bar" => cmdline==" bar"
Rework early_init_dt_scan_chosen() so that the cmdline config options are always handled.
[commit msg written by Alexander Sverdlin]
--- drivers/of/fdt.c | 28 +++++++++++++++------------- 1 file changed, 15 insertions(+), 13 deletions(-)
drivers/of/fdt.c +15 -13
@@ -1163,18 +1163,32 @@ int __init early_init_dt_scan_chosen(char *cmdline)if (node <0 ) node =fdt_path_offset (fdt,"/chosen@0" );if (node <0 ) -return -ENOENT ; +/* Handle the cmdline config options even if no /chosen node */ + goto handle_cmdline; chosen_node_offset = node;early_init_dt_check_for_initrd (node);early_init_dt_check_for_elfcorehdr (node); + rng_seed =of_get_flat_dt_prop (node,"rng-seed" , &l); +if (rng_seed && l >0 ) { +add_bootloader_randomness (rng_seed, l); + +/* try to clear seed so it won't be found. */ +fdt_nop_property (initial_boot_params, node,"rng-seed" ); + +/* update CRC check value */ + of_fdt_crc32 =crc32_be (~0 , initial_boot_params, +fdt_totalsize (initial_boot_params)); + } +/* Retrieve command line */ p =of_get_flat_dt_prop (node,"bootargs" , &l);if (p !=NULL && l >0 )strscpy (cmdline, p,min (l,COMMAND_LINE_SIZE )); +handle_cmdline:/* * CONFIG_CMDLINE is meant to be a default in case nothing else * managed to set the command line, unless CONFIG_CMDLINE_FORCE
@@ -1195,18 +1209,6 @@ int __init early_init_dt_scan_chosen(char *cmdline)pr_debug ("Command line is: %s\n" , (char *)cmdline); - rng_seed =of_get_flat_dt_prop (node,"rng-seed" , &l); -if (rng_seed && l >0 ) { -add_bootloader_randomness (rng_seed, l); - -/* try to clear seed so it won't be found. */ -fdt_nop_property (initial_boot_params, node,"rng-seed" ); - -/* update CRC check value */ - of_fdt_crc32 =crc32_be (~0 , initial_boot_params, -fdt_totalsize (initial_boot_params)); - } -return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 29/193 fbdev: omapfb: avoid stack overflow warning
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 634cf6ead93988b0da9ac054521ab63a3ba189db ]
The dsi_irq_stats structure is a little too big to fit on the stack of a 32-bit task, depending on the specific gcc options:
fbdev/omap2/omapfb/dss/dsi.c: In function 'dsi_dump_dsidev_irqs':fbdev/omap2/omapfb/dss/dsi.c:1621:1: error: the frame size of 1064 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
Since this is only a debugfs file, performance is not critical, so just dynamically allocate it, and print an error message in there in place of a failure code when the allocation fails.
--- drivers/video/fbdev/omap2/omapfb/dss/dsi.c | 28 ++++++++++++++-------- 1 file changed, 18 insertions(+), 10 deletions(-)
drivers/video/fbdev/omap2/omapfb/dss/dsi.c +18 -10
@@ -1536,22 +1536,28 @@ static void dsi_dump_dsidev_irqs(struct platform_device *dsidev, {struct dsi_data *dsi =dsi_get_dsidrv_data (dsidev);unsigned long flags; -struct dsi_irq_stats stats; +struct dsi_irq_stats *stats; + + stats =kzalloc (sizeof (*stats),GFP_KERNEL ); +if (!stats) { +seq_printf (s,"out of memory\n" ); +return ; + }spin_lock_irqsave (&dsi->irq_stats_lock, flags); - stats = dsi->irq_stats; + *stats = dsi->irq_stats;memset (&dsi->irq_stats,0 ,sizeof (dsi->irq_stats)); dsi->irq_stats.last_reset = jiffies;spin_unlock_irqrestore (&dsi->irq_stats_lock, flags);seq_printf (s,"period %u ms\n" , -jiffies_to_msecs (jiffies - stats.last_reset)); +jiffies_to_msecs (jiffies - stats->last_reset)); -seq_printf (s,"irqs %d\n" , stats.irq_count); +seq_printf (s,"irqs %d\n" , stats->irq_count);#define PIS (x) \ - seq_printf(s, "%-20s %10d\n", #x, stats.dsi_irqs[ffs(DSI_IRQ_##x)-1]) + seq_printf(s, "%-20s %10d\n", #x, stats->dsi_irqs[ffs(DSI_IRQ_##x)-1])seq_printf (s,"-- DSI%d interrupts --\n" , dsi->module_id +1 );PIS (VC0 );
@@ -1575,10 +1581,10 @@ static void dsi_dump_dsidev_irqs(struct platform_device *dsidev,#define PIS (x) \ seq_printf(s, "%-20s %10d %10d %10d %10d\n", #x, \ - stats.vc_irqs[0][ffs(DSI_VC_IRQ_##x)-1], \ - stats.vc_irqs[1][ffs(DSI_VC_IRQ_##x)-1], \ - stats.vc_irqs[2][ffs(DSI_VC_IRQ_##x)-1], \ - stats.vc_irqs[3][ffs(DSI_VC_IRQ_##x)-1]); + stats->vc_irqs[0][ffs(DSI_VC_IRQ_##x)-1], \ + stats->vc_irqs[1][ffs(DSI_VC_IRQ_##x)-1], \ + stats->vc_irqs[2][ffs(DSI_VC_IRQ_##x)-1], \ + stats->vc_irqs[3][ffs(DSI_VC_IRQ_##x)-1]);seq_printf (s,"-- VC interrupts --\n" );PIS (CS );
@@ -1594,7 +1600,7 @@ static void dsi_dump_dsidev_irqs(struct platform_device *dsidev,#define PIS (x) \ seq_printf(s, "%-20s %10d\n", #x, \ - stats.cio_irqs[ffs(DSI_CIO_IRQ_##x)-1]); + stats->cio_irqs[ffs(DSI_CIO_IRQ_##x)-1]);seq_printf (s,"-- CIO interrupts --\n" );PIS (ERRSYNCESC1 );
@@ -1618,6 +1624,8 @@ static void dsi_dump_dsidev_irqs(struct platform_device *dsidev,PIS (ULPSACTIVENOT_ALL0 );PIS (ULPSACTIVENOT_ALL1 );#undef PIS + +kfree (stats); }static void dsi1_dump_irqs (struct seq_file *s)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 30/193 Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2
In reply to Greg Kroah-HartmanFrom: Luiz Augusto von Dentz <[email protected]>
commit 3a4d29b6d631bb00236a98887e1039bbfc1b6ab5 upstream.
Don't try to use HCI_OP_LE_READ_BUFFER_SIZE_V2 if controller don't support ISO channels, but in order to check if ISO channels are supported HCI_OP_LE_READ_LOCAL_FEATURES needs to be done earlier so the features bits can be checked on hci_le_read_buffer_size_sync.
--- net/bluetooth/hci_sync.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/bluetooth/hci_sync.c +3 -3
@@ -3554,7 +3554,7 @@ static const struct hci_init_stage hci_istatic int hci_le_read_buffer_size_sync (struct hci_dev *hdev) {/* Use Read LE Buffer Size V2 if supported */ -if (hdev->commands[41 ] &0x20 ) +if (iso_capable (hdev) && hdev->commands[41 ] &0x20 )return __hci_cmd_sync_status (hdev,HCI_OP_LE_READ_BUFFER_SIZE_V2 ,0 ,NULL ,HCI_CMD_TIMEOUT );
@@ -3579,10 +3579,10 @@ static int hci_le_read_supported_states_/* LE Controller init stage 2 command sequence */ static const struct hci_init_stage le_init2[] = { -/* HCI_OP_LE_READ_BUFFER_SIZE */ -HCI_INIT (hci_le_read_buffer_size_sync),/* HCI_OP_LE_READ_LOCAL_FEATURES */ HCI_INIT (hci_le_read_local_features_sync), +/* HCI_OP_LE_READ_BUFFER_SIZE */ +HCI_INIT (hci_le_read_buffer_size_sync),/* HCI_OP_LE_READ_SUPPORTED_STATES */ HCI_INIT (hci_le_read_supported_states_sync), {}
Greg Kroah-Hartman
maintainerPATCH 31/193 Bluetooth: hci_qca: Fix driver shutdown on closed serdev
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
commit 272970be3dabd24cbe50e393ffee8f04aec3b9a8 upstream.
The driver shutdown callback (which sends EDL_SOC_RESET to the device over serdev) should not be invoked when HCI device is not open (e.g. if hci_dev_open_sync() failed), because the serdev and its TTY are not open either. Also skip this step if device is powered off (qca_power_shutdown()).
The shutdown callback causes use-after-free during system reboot with Qualcomm Atheros Bluetooth:
Unable to handle kernel paging request at virtual address 0072662f67726fd7 ... CPU: 6 PID: 1 Comm: systemd-shutdow Tainted: G W 6.1.0-rt5-00325-g8a5f56bcfcca #8 Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) Call trace: tty_driver_flush_buffer+0x4/0x30 serdev_device_write_flush+0x24/0x34 qca_serdev_shutdown+0x80/0x130 [hci_uart] device_shutdown+0x15c/0x260 kernel_restart+0x48/0xac
KASAN report:
BUG: KASAN: use-after-free in tty_driver_flush_buffer+0x1c/0x50 Read of size 8 at addr ffff16270c2e0018 by task systemd-shutdow/1 CPU: 7 PID: 1 Comm: systemd-shutdow Not tainted 6.1.0-next-20221220-00014-gb85aaf97fb01-dirty #28 Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) Call trace: dump_backtrace.part.0+0xdc/0xf0 show_stack+0x18/0x30 dump_stack_lvl+0x68/0x84 print_report+0x188/0x488 kasan_report+0xa4/0xf0 __asan_load8+0x80/0xac tty_driver_flush_buffer+0x1c/0x50 ttyport_write_flush+0x34/0x44 serdev_device_write_flush+0x48/0x60 qca_serdev_shutdown+0x124/0x274 device_shutdown+0x1e8/0x350 kernel_restart+0x48/0xb0 __do_sys_reboot+0x244/0x2d0 __arm64_sys_reboot+0x54/0x70 invoke_syscall+0x60/0x190 el0_svc_common.constprop.0+0x7c/0x160 do_el0_svc+0x44/0xf0 el0_svc+0x2c/0x6c el0t_64_sync_handler+0xbc/0x140 el0t_64_sync+0x190/0x194
--- drivers/bluetooth/hci_qca.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/bluetooth/hci_qca.c +7 -0
@@ -2157,10 +2157,17 @@ static void qca_serdev_shutdown(struct dint timeout =msecs_to_jiffies (CMD_TRANS_TIMEOUT_MS );struct serdev_device *serdev =to_serdev_device (dev);struct qca_serdev *qcadev =serdev_device_get_drvdata (serdev); +struct hci_uart *hu = &qcadev->serdev_hu; +struct hci_dev *hdev = hu->hdev; +struct qca_data *qca = hu->priv;const u8 ibs_wake_cmd[] = {0xFD };const u8 edl_reset_soc_cmd[] = {0x01 ,0x00 ,0xFC ,0x01 ,0x05 };if (qcadev->btsoc_type ==QCA_QCA6390 ) { +if (test_bit (QCA_BT_OFF , &qca->flags) || + !test_bit (HCI_RUNNING , &hdev->flags)) +return ; +serdev_device_write_flush (serdev); ret =serdev_device_write_buf (serdev, ibs_wake_cmd,sizeof (ibs_wake_cmd));
Greg Kroah-Hartman
maintainerPATCH 32/193 wifi: brcmfmac: fix regression for Broadcom PCIe wifi devices
In reply to Greg Kroah-HartmanFrom: Arend van Spriel <[email protected]>
commit ed05cb177ae5cd7f02f1d6e7706ba627d30f1696 upstream.
A sanity check was introduced considering maximum flowrings above 256 as insane and effectively aborting the device probe. This resulted in regression for number of users as the value turns out to be sane after all.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +1 -1
@@ -1218,7 +1218,7 @@ static int brcmf_pcie_init_ringbuffers(sBRCMF_NROF_H2D_COMMON_MSGRINGS ; max_completionrings =BRCMF_NROF_D2H_COMMON_MSGRINGS ; } -if (max_flowrings >256 ) { +if (max_flowrings >512 ) {brcmf_err (bus,"invalid max_flowrings(%d)\n" , max_flowrings);return -EIO ; }
Greg Kroah-Hartman
maintainerPATCH 33/193 wifi: mac80211: fix MLO + AP_VLAN check
In reply to Greg Kroah-HartmanFrom: Felix Fietkau <[email protected]>
commit f216033d770f7ca0eda491fe01a9f02e7af59576 upstream.
Instead of preventing adding AP_VLAN to MLO enabled APs, this check was preventing adding more than one 4-addr AP_VLAN regardless of the MLO status. Fix this by adding missing extra checks.
--- net/mac80211/iface.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/mac80211/iface.c +3 -1
@@ -364,7 +364,9 @@ static int ieee80211_check_concurrent_iface(struct ieee80211_sub_if_data *sdata,/* No support for VLAN with MLO yet */ if (iftype ==NL80211_IFTYPE_AP_VLAN && - nsdata->wdev.use_4addr) + sdata->wdev.use_4addr && + nsdata->vif.type ==NL80211_IFTYPE_AP && + nsdata->vif.valid_links)return -EOPNOTSUPP ;/*
Signature · 1 line
2.39.1
Greg Kroah-Hartman
maintainerPATCH 34/193 wifi: mac80211: reset multiple BSSID options in stop_ap()
In reply to Greg Kroah-HartmanFrom: Aloka Dixit <[email protected]>
commit 0eb38842ada035d71bb06fb9116f26f24ee0f998 upstream.
Reset multiple BSSID options when all AP related configurations are reset in ieee80211_stop_ap().
Stale values result in HWSIM test failures (e.g. p2p_group_cli_invalid), if run after 'he_ap_ema'.
--- net/mac80211/cfg.c | 7 +++++++ 1 file changed, 7 insertions(+)
net/mac80211/cfg.c +7 -0
@@ -147,6 +147,7 @@ static int ieee80211_set_ap_mbssid_optio link_conf->bssid_index =0 ; link_conf->nontransmitted = false; link_conf->ema_ap = false; + link_conf->bssid_indicator =0 ;if (sdata->vif.type !=NL80211_IFTYPE_AP || !params.tx_wdev)return -EINVAL ;
@@ -1511,6 +1512,12 @@ static int ieee80211_stop_ap(struct wiphkfree (link_conf->ftmr_params); link_conf->ftmr_params =NULL ; + sdata->vif.mbssid_tx_vif =NULL ; + link_conf->bssid_index =0 ; + link_conf->nontransmitted = false; + link_conf->ema_ap = false; + link_conf->bssid_indicator =0 ; +__sta_info_flush (sdata, true);ieee80211_free_keys (sdata, true);
Greg Kroah-Hartman
maintainerPATCH 35/193 wifi: mac80211: sdata can be NULL during AMPDU start
In reply to Greg Kroah-HartmanFrom: Alexander Wetzel <[email protected]>
commit 69403bad97aa0162e3d7911b27e25abe774093df upstream.
ieee80211_tx_ba_session_handle_start() may get NULL for sdata when a deauthentication is ongoing.
Here a trace triggering the race with the hostapd test multi_ap_fronthaul_on_ap:
(gdb) list *drv_ampdu_action+0x460x8b16 is in drv_ampdu_action (net/mac80211/driver-ops.c:396).
391 int ret = -EOPNOTSUPP;
392
393 might_sleep();
394
395 sdata = get_bss_sdata(sdata);
396 if (!check_sdata_in_driver(sdata))
397 return -EIO;
398
399 trace_drv_ampdu_action(local, sdata, params);
400
wlan0: moving STA 02:00:00:00:03:00 to state 3
wlan0: associated
wlan0: deauthenticating from 02:00:00:00:03:00 by local choice (Reason: 3=DEAUTH_LEAVING) wlan3.sta1: Open BA session requested for 02:00:00:00:00:00 tid 0 wlan3.sta1: dropped frame to 02:00:00:00:00:00 (unauthorized port)
wlan0: moving STA 02:00:00:00:03:00 to state 2
wlan0: moving STA 02:00:00:00:03:00 to state 1
wlan0: Removed STA 02:00:00:00:03:00
wlan0: Destroyed STA 02:00:00:00:03:00
BUG: unable to handle page fault for address: fffffffffffffb48 PGD 11814067 P4D 11814067 PUD 11816067 PMD 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 2 PID: 133397 Comm: kworker/u16:1 Tainted: G W 6.1.0-rc8-wt+ #59 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-20220807_005459-localhost 04/01/2014 Workqueue: phy3 ieee80211_ba_session_work [mac80211] RIP: 0010:drv_ampdu_action+0x46/0x280 [mac80211] Code: 53 48 89 f3 be 89 01 00 00 e8 d6 43 bf ef e8 21 46 81 f0 83 bb a0 1b 00 00 04 75 0e 48 8b 9b 28 0d 00 00 48 81 eb 10 0e 00 00 <8b> 93 58 09 00 00 f6 c2 20 0f 84 3b 01 00 00 8b 05 dd 1c 0f 00 85 RSP: 0018:ffffc900025ebd20 EFLAGS: 00010287 RAX: 0000000000000000 RBX: fffffffffffff1f0 RCX: ffff888102228240 RDX: 0000000080000000 RSI: ffffffff918c5de0 RDI: ffff888102228b40 RBP: ffffc900025ebd40 R08: 0000000000000001 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888118c18ec0 R13: 0000000000000000 R14: ffffc900025ebd60 R15: ffff888018b7efb8 FS: 0000000000000000(0000) GS:ffff88817a600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffffffffffb48 CR3: 0000000105228006 CR4: 0000000000170ee0 Call Trace: <TASK> ieee80211_tx_ba_session_handle_start+0xd0/0x190 [mac80211] ieee80211_ba_session_work+0xff/0x2e0 [mac80211] process_one_work+0x29f/0x620 worker_thread+0x4d/0x3d0 ? process_one_work+0x620/0x620 kthread+0xfb/0x120 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 </TASK>
--- net/mac80211/agg-tx.c | 6 +++++- net/mac80211/driver-ops.c | 3 +++ 2 files changed, 8 insertions(+), 1 deletion(-)
net/mac80211/agg-tx.c +5 -1
@@ -491,7 +491,7 @@ void ieee80211_tx_ba_session_handle_star {struct tid_ampdu_tx *tid_tx;struct ieee80211_local *local = sta->local; -struct ieee80211_sub_if_data *sdata = sta->sdata; +struct ieee80211_sub_if_data *sdata;struct ieee80211_ampdu_params params = { .sta = &sta->sta, .action =IEEE80211_AMPDU_TX_START ,
@@ -521,6 +521,7 @@ void ieee80211_tx_ba_session_handle_star*/ synchronize_net (); + sdata = sta->sdata; params.ssn = sta->tid_seq[tid] >>4 ; ret =drv_ampdu_action (local, sdata, ¶ms); tid_tx->ssn = params.ssn;
@@ -534,6 +535,9 @@ void ieee80211_tx_ba_session_handle_star*/ set_bit (HT_AGG_STATE_DRV_READY , &tid_tx->state); }else if (ret) { +if (!sdata) +return ; +ht_dbg (sdata,"BA request denied - HW unavailable for %pM tid %d\n" , sta->sta.addr, tid);
net/mac80211/driver-ops.c +3 -0
@@ -391,6 +391,9 @@ int drv_ampdu_action(struct ieee80211_lomight_sleep (); +if (!sdata) +return -EIO ; + sdata =get_bss_sdata (sdata);if (!check_sdata_in_driver (sdata))return -EIO ;
Greg Kroah-Hartman
maintainerPATCH 36/193 wifi: mac80211: fix initialization of rx->link and rx->link_sta
In reply to Greg Kroah-HartmanFrom: Felix Fietkau <[email protected]>
commit e66b7920aa5ac5b1a1997a454004ba9246a3c005 upstream.
There are some codepaths that do not initialize rx->link_sta properly. This causes a crash in places which assume that rx->link_sta is valid if rx->sta is valid.
One known instance is triggered by __ieee80211_rx_h_amsdu being called from fast-rx. It results in a crash like this one:
BUG: kernel NULL pointer dereference, address: 00000000000000a8
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page PGD 0 P4D 0
Oops: 0002 [#1] PREEMPT SMP PTI
CPU: 1 PID: 506 Comm: mt76-usb-rx phy Tainted: G E 6.1.0-debian64x+1.7 #3
Hardware name: ZOTAC ZBOX-ID92/ZBOX-IQ01/ZBOX-ID92/ZBOX-IQ01, BIOS B220P007 05/21/2014
RIP: 0010:ieee80211_deliver_skb+0x62/0x1f0 [mac80211]
Code: 00 48 89 04 24 e8 9e a7 c3 df 89 c0 48 03 1c c5 a0 ea 39 a1 4c 01 6b 08 48 ff 03 48
83 7d 28 00 74 11 48 8b 45 30 48 63 55 44 <48> 83 84 d0 a8 00 00 00 01 41 8b 86 c0
11 00 00 8d 50 fd 83 fa 01
RSP: 0018:ffff999040803b10 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffffb9903f496480 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff999040803ce0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8d21828ac900
R13: 000000000000004a R14: ffff8d2198ed89c0 R15: ffff8d2198ed8000
FS: 0000000000000000(0000) GS:ffff8d24afe80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000000000a8 CR3: 0000000429810002 CR4: 00000000001706e0
Call Trace:
<TASK>
__ieee80211_rx_h_amsdu+0x1b5/0x240 [mac80211]
? ieee80211_prepare_and_rx_handle+0xcdd/0x1320 [mac80211]
? __local_bh_enable_ip+0x3b/0xa0
ieee80211_prepare_and_rx_handle+0xcdd/0x1320 [mac80211]
? prepare_transfer+0x109/0x1a0 [xhci_hcd]
ieee80211_rx_list+0xa80/0xda0 [mac80211]
mt76_rx_complete+0x207/0x2e0 [mt76]
mt76_rx_poll_complete+0x357/0x5a0 [mt76]
mt76u_rx_worker+0x4f5/0x600 [mt76_usb]
? mt76_get_min_avg_rssi+0x140/0x140 [mt76]
__mt76_worker_fn+0x50/0x80 [mt76]
kthread+0xed/0x120
? kthread_complete_and_exit+0x20/0x20
ret_from_fork+0x22/0x30Since the initialization of rx->link and rx->link_sta is rather convoluted and duplicated in many places, clean it up by using a helper function to set it.
--- net/mac80211/rx.c | 222 ++++++++++++++++++++++++------------------------------ 1 file changed, 99 insertions(+), 123 deletions(-)
net/mac80211/rx.c +99 -123
@@ -4070,6 +4070,58 @@ static void ieee80211_invoke_rx_handlers#undef CALL_RXH } +static bool +ieee80211_rx_is_valid_sta_link_id (struct ieee80211_sta *sta,u8 link_id) +{ +if (!sta->mlo) +return false; + +return !!(sta->valid_links &BIT (link_id)); +} + +static bool ieee80211_rx_data_set_link (struct ieee80211_rx_data *rx, +u8 link_id) +{ + rx->link_id = link_id; + rx->link =rcu_dereference (rx->sdata->link[link_id]); + +if (!rx->sta) +return rx->link; + +if (!ieee80211_rx_is_valid_sta_link_id (&rx->sta->sta, link_id)) +return false; + + rx->link_sta =rcu_dereference (rx->sta->link[link_id]); + +return rx->link && rx->link_sta; +} + +static bool ieee80211_rx_data_set_sta (struct ieee80211_rx_data *rx, +struct ieee80211_sta *pubsta, +int link_id) +{ +struct sta_info *sta; + + sta = container_of(pubsta, struct sta_info, sta); + + rx->link_id = link_id; + rx->sta = sta; + +if (sta) { + rx->local = sta->sdata->local; +if (!rx->sdata) + rx->sdata = sta->sdata; + rx->link_sta = &sta->deflink; + } + +if (link_id <0 ) + rx->link = &rx->sdata->deflink; +else if (!ieee80211_rx_data_set_link (rx, link_id)) +return false; + +return true; +} +/* * This function makes calls into the RX path, therefore * it has to be invoked under RCU read lock.
@@ -4078,16 +4130,19 @@ void ieee80211_release_reorder_timeout(s {struct sk_buff_head frames;struct ieee80211_rx_data rx = { - .sta = sta, - .sdata = sta->sdata, - .local = sta->local,/* This is OK -- must be QoS data frame */ .security_idx = tid, .seqno_idx = tid, - .link_id =-1 , };struct tid_ampdu_rx *tid_agg_rx; -u8 link_id; +int link_id =-1 ; + +/* FIXME: statistics won't be right with this */ +if (sta->sta.valid_links) + link_id =ffs (sta->sta.valid_links) -1 ; + +if (!ieee80211_rx_data_set_sta (&rx, &sta->sta, link_id)) +return ; tid_agg_rx =rcu_dereference (sta->ampdu_mlme.tid_rx[tid]);if (!tid_agg_rx)
@@ -4107,10 +4162,6 @@ void ieee80211_release_reorder_timeout(s };drv_event_callback (rx.local, rx.sdata, &event); } -/* FIXME: statistics won't be right with this */ - link_id = sta->sta.valid_links ?ffs (sta->sta.valid_links) -1 :0 ; - rx.link =rcu_dereference (sta->sdata->link[link_id]); - rx.link_sta =rcu_dereference (sta->link[link_id]);ieee80211_rx_handlers (&rx, &frames); }
@@ -4126,7 +4177,6 @@ void ieee80211_mark_rx_ba_filtered_frame/* This is OK -- must be QoS data frame */ .security_idx = tid, .seqno_idx = tid, - .link_id = -1, };int i, diff;
@@ -4137,10 +4187,8 @@ void ieee80211_mark_rx_ba_filtered_frame sta = container_of(pubsta, struct sta_info, sta); - rx.sta = sta; - rx.sdata = sta->sdata; - rx.link = &rx.sdata->deflink; - rx.local = sta->local; +if (!ieee80211_rx_data_set_sta (&rx, pubsta,-1 )) +return ;rcu_read_lock (); tid_agg_rx =rcu_dereference (sta->ampdu_mlme.tid_rx[tid]);
@@ -4527,15 +4575,6 @@ void ieee80211_check_fast_rx_iface(strucmutex_unlock (&local->sta_mtx); } -static bool -ieee80211_rx_is_valid_sta_link_id (struct ieee80211_sta *sta,u8 link_id) -{ -if (!sta->mlo) -return false; - -return !!(sta->valid_links &BIT (link_id)); -} -static void ieee80211_rx_8023 (struct ieee80211_rx_data *rx,struct ieee80211_fast_rx *fast_rx,int orig_len)
@@ -4646,7 +4685,6 @@ static bool ieee80211_invoke_fast_rx(strstruct sk_buff *skb = rx->skb;struct ieee80211_hdr *hdr = (void *)skb->data;struct ieee80211_rx_status *status =IEEE80211_SKB_RXCB (skb); -struct sta_info *sta = rx->sta;int orig_len = skb->len;int hdrlen =ieee80211_hdrlen (hdr->frame_control);int snap_offs = hdrlen;
@@ -4658,7 +4696,6 @@ static bool ieee80211_invoke_fast_rx(stru8 da[ETH_ALEN ];u8 sa[ETH_ALEN ]; } addrs__aligned(2) ; -struct link_sta_info *link_sta;struct ieee80211_sta_rx_stats *stats;/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
@@ -4761,18 +4798,10 @@ static bool ieee80211_invoke_fast_rx(str drop:dev_kfree_skb (skb); -if (rx->link_id >=0 ) { - link_sta =rcu_dereference (sta->link[rx->link_id]); -if (!link_sta) -return true; - }else { - link_sta = &sta->deflink; - } -if (fast_rx->uses_rss) - stats =this_cpu_ptr (link_sta->pcpu_rx_stats); + stats =this_cpu_ptr (rx->link_sta->pcpu_rx_stats);else - stats = &link_sta->rx_stats; + stats = &rx->link_sta->rx_stats; stats->dropped++;return true;
@@ -4790,8 +4819,8 @@ static bool ieee80211_prepare_and_rx_hanstruct ieee80211_local *local = rx->local;struct ieee80211_sub_if_data *sdata = rx->sdata;struct ieee80211_hdr *hdr = (void *)skb->data; -struct link_sta_info *link_sta =NULL ; -struct ieee80211_link_data *link; +struct link_sta_info *link_sta = rx->link_sta; +struct ieee80211_link_data *link = rx->link; rx->skb = skb;
@@ -4813,35 +4842,6 @@ static bool ieee80211_prepare_and_rx_hanif (!ieee80211_accept_frame (rx))return false; -if (rx->link_id >=0 ) { - link =rcu_dereference (rx->sdata->link[rx->link_id]); - -/* we might race link removal */ -if (!link) -return true; - rx->link = link; - -if (rx->sta) { - rx->link_sta = -rcu_dereference (rx->sta->link[rx->link_id]); -if (!rx->link_sta) -return true; - } - }else { -if (rx->sta) - rx->link_sta = &rx->sta->deflink; - - rx->link = &sdata->deflink; - } - -if (unlikely (!is_multicast_ether_addr (hdr->addr1) && - rx->link_id >=0 && rx->sta && rx->sta->sta.mlo)) { - link_sta =rcu_dereference (rx->sta->link[rx->link_id]); - -if (WARN_ON_ONCE (!link_sta)) -return true; - } -if (!consume) {struct skb_shared_hwtstamps *shwt;
@@ -4861,7 +4861,7 @@ static bool ieee80211_prepare_and_rx_han shwt->hwtstamp =skb_hwtstamps (skb)->hwtstamp; } -if (unlikely (link_sta)) { +if (unlikely (rx->sta && rx->sta->sta.mlo)) {/* translate to MLD addresses */ if (ether_addr_equal (link->conf->addr, hdr->addr1))ether_addr_copy (hdr->addr1, rx->sdata->vif.addr);
@@ -4891,6 +4891,7 @@ static void __ieee80211_rx_handle_8023(sstruct ieee80211_rx_status *status =IEEE80211_SKB_RXCB (skb);struct ieee80211_fast_rx *fast_rx;struct ieee80211_rx_data rx; +int link_id =-1 ;memset (&rx,0 ,sizeof (rx)); rx.skb = skb;
@@ -4907,12 +4908,8 @@ static void __ieee80211_rx_handle_8023(sif (!pubsta) goto drop; - rx.sta = container_of(pubsta, struct sta_info, sta); - rx.sdata = rx.sta->sdata; - -if (status->link_valid && - !ieee80211_rx_is_valid_sta_link_id (pubsta, status->link_id)) - goto drop; +if (status->link_valid) + link_id = status->link_id;/* * TODO: Should the frame be dropped if the right link_id is not
@@ -4921,19 +4918,8 @@ static void __ieee80211_rx_handle_8023(s* link_id is used only for stats purpose and updating the stats on * the deflink is fine? */ -if (status->link_valid) - rx.link_id = status->link_id; - -if (rx.link_id >=0 ) { -struct ieee80211_link_data *link; - - link =rcu_dereference (rx.sdata->link[rx.link_id]); -if (!link) - goto drop; - rx.link = link; - }else { - rx.link = &rx.sdata->deflink; - } +if (!ieee80211_rx_data_set_sta (&rx, pubsta, link_id)) + goto drop; fast_rx =rcu_dereference (rx.sta->fast_rx);if (!fast_rx)
@@ -4951,6 +4937,8 @@ static bool ieee80211_rx_for_interface(s {struct link_sta_info *link_sta;struct ieee80211_hdr *hdr = (void *)skb->data; +struct sta_info *sta; +int link_id =-1 ;/* * Look up link station first, in case there's a
@@ -4960,24 +4948,19 @@ static bool ieee80211_rx_for_interface(s*/ link_sta =link_sta_info_get_bss (rx->sdata, hdr->addr2);if (link_sta) { - rx->sta = link_sta->sta; - rx->link_id = link_sta->link_id; + sta = link_sta->sta; + link_id = link_sta->link_id; }else {struct ieee80211_rx_status *status =IEEE80211_SKB_RXCB (skb); - rx->sta =sta_info_get_bss (rx->sdata, hdr->addr2); -if (rx->sta) { -if (status->link_valid && - !ieee80211_rx_is_valid_sta_link_id (&rx->sta->sta, - status->link_id)) -return false; - - rx->link_id = status->link_valid ? status->link_id :-1 ; - }else { - rx->link_id =-1 ; - } + sta =sta_info_get_bss (rx->sdata, hdr->addr2); +if (status->link_valid) + link_id = status->link_id; } +if (!ieee80211_rx_data_set_sta (rx, &sta->sta, link_id)) +return false; +return ieee80211_prepare_and_rx_handle (rx, skb, consume); }
@@ -5036,19 +5019,15 @@ static void __ieee80211_rx_handle_packetif (ieee80211_is_data (fc)) {struct sta_info *sta, *prev_sta; -u8 link_id = status->link_id; +int link_id =-1 ; -if (pubsta) { - rx.sta = container_of(pubsta, struct sta_info, sta); - rx.sdata = rx.sta->sdata; +if (status->link_valid) + link_id = status->link_id; -if (status->link_valid && - !ieee80211_rx_is_valid_sta_link_id (pubsta, link_id)) +if (pubsta) { +if (!ieee80211_rx_data_set_sta (&rx, pubsta, link_id)) goto out; -if (status->link_valid) - rx.link_id = status->link_id; -/* * In MLO connection, fetch the link_id using addr2 * when the driver does not pass link_id in status.
@@ -5066,7 +5045,7 @@ static void __ieee80211_rx_handle_packetif (!link_sta) goto out; - rx.link_id = link_sta->link_id; +ieee80211_rx_data_set_link (&rx, link_sta->link_id); }if (ieee80211_prepare_and_rx_handle (&rx, skb, true))
@@ -5082,30 +5061,27 @@ static void __ieee80211_rx_handle_packetcontinue ; } -if ((status->link_valid && - !ieee80211_rx_is_valid_sta_link_id (&prev_sta->sta, - link_id)) || - (!status->link_valid && prev_sta->sta.mlo)) + rx.sdata = prev_sta->sdata; +if (!ieee80211_rx_data_set_sta (&rx, &prev_sta->sta, + link_id)) + goto out; + +if (!status->link_valid && prev_sta->sta.mlo)continue ; - rx.link_id = status->link_valid ? link_id :-1 ; - rx.sta = prev_sta; - rx.sdata = prev_sta->sdata;ieee80211_prepare_and_rx_handle (&rx, skb, false); prev_sta = sta; }if (prev_sta) { -if ((status->link_valid && - !ieee80211_rx_is_valid_sta_link_id (&prev_sta->sta, - link_id)) || - (!status->link_valid && prev_sta->sta.mlo)) + rx.sdata = prev_sta->sdata; +if (!ieee80211_rx_data_set_sta (&rx, &prev_sta->sta, + link_id)) goto out; - rx.link_id = status->link_valid ? link_id :-1 ; - rx.sta = prev_sta; - rx.sdata = prev_sta->sdata; +if (!status->link_valid && prev_sta->sta.mlo) + goto out;if (ieee80211_prepare_and_rx_handle (&rx, skb, true))return ;
Greg Kroah-Hartman
maintainerPATCH 37/193 nommu: fix memory leak in do_mmap() error path
In reply to Greg Kroah-HartmanFrom: Liam Howlett <[email protected]>
commit 7f31cced5724e6d414fe750aa1cd7e7b578ec22f upstream.
The preallocation of the maple tree nodes may leak if the error path to "error_just_free" is taken. Fix this by moving the freeing of the maple tree nodes to a shared location for all error paths.
--- mm/nommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/nommu.c +1 -1
@@ -1240,6 +1240,7 @@ unsigned long do_mmap(struct file *file, error_just_free:up_write (&nommu_region_sem); error: +mas_destroy (&mas);if (region->vm_file)fput (region->vm_file);kmem_cache_free (vm_region_jar, region);
@@ -1250,7 +1251,6 @@ unsigned long do_mmap(struct file *file, sharing_violation:up_write (&nommu_region_sem); -mas_destroy (&mas);pr_warn ("Attempt to share mismatched mappings\n" ); ret = -EINVAL ; goto error;
Signature · 1 line
2.39.1
Greg Kroah-Hartman
maintainerPATCH 38/193 nommu: fix do_munmap() error path
In reply to Greg Kroah-HartmanFrom: Liam Howlett <[email protected]>
commit 80be727ec87225797771a39f3e6801baf291faaf upstream.
When removing a VMA from the tree fails due to no memory, do not free the VMA since a reference still exists.
--- mm/nommu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
mm/nommu.c +2 -1
@@ -1509,7 +1509,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len, struct list erase_whole_vma:if (delete_vma_from_mm (vma)) ret = -ENOMEM ; -delete_vma (mm, vma); +else +delete_vma (mm, vma);return ret; }
Signature · 1 line
2.39.1
Greg Kroah-Hartman
maintainerPATCH 39/193 nommu: fix split_vma() map_count error
In reply to Greg Kroah-HartmanFrom: Liam Howlett <[email protected]>
commit fd9edbdbdcde6b489ce59f326755ef16a2ffadd7 upstream.
During the maple tree conversion of nommu, an error in counting the VMAs was introduced by counting the existing VMA again. The counting used to be decremented by one and incremented by two, but now it only increments by two. Fix the counting error by moving the increment outside the setup_vma_to_mm() function to the callers.
--- mm/nommu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
mm/nommu.c +3 -1
@@ -559,7 +559,6 @@ void vma_mas_remove(struct vm_area_struct *vma, struct ma_state *mas)static void setup_vma_to_mm (struct vm_area_struct *vma,struct mm_struct *mm) { - mm->map_count++; vma->vm_mm = mm;/* add the VMA to the mapping */
@@ -587,6 +586,7 @@ static void mas_add_vma_to_mm(struct ma_state *mas, struct mm_struct *mm,BUG_ON (!vma->vm_region);setup_vma_to_mm (vma, mm); + mm->map_count++;/* add the VMA to the tree */ vma_mas_store (vma, mas);
@@ -1347,6 +1347,7 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,if (vma->vm_file)return -ENOMEM ; + mm = vma->vm_mm;if (mm->map_count >= sysctl_max_map_count)return -ENOMEM ;
@@ -1398,6 +1399,7 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,mas_set_range (&mas, vma->vm_start, vma->vm_end -1 );mas_store (&mas, vma);vma_mas_store (new, &mas); + mm->map_count++;return 0 ; err_mas_preallocate:
Signature · 1 line
2.39.1
Greg Kroah-Hartman
maintainerPATCH 40/193 proc: fix PIE proc-empty-vm, proc-pid-vm tests
In reply to Greg Kroah-HartmanFrom: Alexey Dobriyan <[email protected]>
commit 5316a017d093f644675a56523bcf5787ba8f4fef upstream.
vsyscall detection code uses direct call to the beginning of the vsyscall page:
asm ("call %P0" :: "i" (0xffffffffff600000))It generates "call rel32" instruction but it is not relocated if binary is PIE, so binary segfaults into random userspace address and vsyscall page status is detected incorrectly.
Do more direct:
asm ("call *%rax")which doesn't do need any relocaltions.
Mark g_vsyscall as volatile for a good measure, I didn't find instruction setting it to 0. Now the code is obviously correct:
xor eax, eax mov rdi, rbp mov rsi, rbp mov DWORD PTR [rip+0x2d15], eax # g_vsyscall = 0 mov rax, 0xffffffffff600000 call rax mov DWORD PTR [rip+0x2d02], 1 # g_vsyscall = 1 mov eax, DWORD PTR ds:0xffffffffff600000 mov DWORD PTR [rip+0x2cf1], 2 # g_vsyscall = 2 mov edi, [rip+0x2ceb] # exit(g_vsyscall) call exit
Note: fixed proc-empty-vm test oopses 5.19.0-28-generic kernel
but this is separate story.
--- tools/testing/selftests/proc/proc-empty-vm.c | 12 +++++++----- tools/testing/selftests/proc/proc-pid-vm.c | 9 +++++---- 2 files changed, 12 insertions(+), 9 deletions(-)
tools/testing/selftests/proc/proc-empty-vm.c +7 -5
@@ -25,6 +25,7 @@#undef NDEBUG#include <assert.h> #include <errno.h> +#include <stdint.h> #include <stdio.h> #include <stdlib.h> #include <string.h>
@@ -41,7 +42,7 @@* 1: vsyscall VMA is --xp vsyscall=xonly * 2: vsyscall VMA is r-xp vsyscall=emulate */ -static int g_vsyscall; +static volatile int g_vsyscall;static const char *g_proc_pid_maps_vsyscall;static const char *g_proc_pid_smaps_vsyscall;
@@ -147,11 +148,12 @@ static void vsyscall(void) g_vsyscall =0 ;/* gettimeofday(NULL, NULL); */ +uint64_t rax =0xffffffffff600000 ; asmvolatile ( -"call %P0" - : - :"i" (0xffffffffff600000 ),"D" (NULL ),"S" (NULL ) - :"rax" ,"rcx" ,"r11" +"call *%[rax]" + : [rax]"+a" (rax) + :"D" (NULL ),"S" (NULL ) + :"rcx" ,"r11" ); g_vsyscall =1 ;
tools/testing/selftests/proc/proc-pid-vm.c +5 -4
@@ -257,11 +257,12 @@ static void vsyscall(void) g_vsyscall =0 ;/* gettimeofday(NULL, NULL); */ +uint64_t rax =0xffffffffff600000 ; asmvolatile ( -"call %P0" - : - :"i" (0xffffffffff600000 ),"D" (NULL ),"S" (NULL ) - :"rax" ,"rcx" ,"r11" +"call *%[rax]" + : [rax]"+a" (rax) + :"D" (NULL ),"S" (NULL ) + :"rcx" ,"r11" ); g_vsyscall =1 ;
Signature · 1 line
2.39.1
Greg Kroah-Hartman
maintainerPATCH 41/193 Add exception protection processing for vd in axi_chan_handle_err function
In reply to Greg Kroah-HartmanFrom: Shawn.Shao <[email protected]>
commit 57054fe516d59d03a7bcf1888e82479ccc244f87 upstream.
Since there is no protection for vd, a kernel panic will be triggered here in exceptional cases.
You can refer to the processing of axi_chan_block_xfer_complete function
The triggered kernel panic is as follows:
[ 67.848444] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000060 [ 67.848447] Mem abort info: [ 67.848449] ESR = 0x96000004 [ 67.848451] EC = 0x25: DABT (current EL), IL = 32 bits [ 67.848454] SET = 0, FnV = 0 [ 67.848456] EA = 0, S1PTW = 0 [ 67.848458] Data abort info: [ 67.848460] ISV = 0, ISS = 0x00000004 [ 67.848462] CM = 0, WnR = 0 [ 67.848465] user pgtable: 4k pages, 48-bit VAs, pgdp=00000800c4c0b000 [ 67.848468] [0000000000000060] pgd=0000000000000000, p4d=0000000000000000 [ 67.848472] Internal error: Oops: 96000004 [#1] SMP [ 67.848475] Modules linked in: dmatest [ 67.848479] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.10.100-emu_x2rc+ #11 [ 67.848483] pstate: 62000085 (nZCv daIf -PAN -UAO +TCO BTYPE=--) [ 67.848487] pc : axi_chan_handle_err+0xc4/0x230 [ 67.848491] lr : axi_chan_handle_err+0x30/0x230 [ 67.848493] sp : ffff0803fe55ae50 [ 67.848495] x29: ffff0803fe55ae50 x28: ffff800011212200 [ 67.848500] x27: ffff0800c42c0080 x26: ffff0800c097c080 [ 67.848504] x25: ffff800010d33880 x24: ffff80001139d850 [ 67.848508] x23: ffff0800c097c168 x22: 0000000000000000 [ 67.848512] x21: 0000000000000080 x20: 0000000000002000 [ 67.848517] x19: ffff0800c097c080 x18: 0000000000000000 [ 67.848521] x17: 0000000000000000 x16: 0000000000000000 [ 67.848525] x15: 0000000000000000 x14: 0000000000000000 [ 67.848529] x13: 0000000000000000 x12: 0000000000000040 [ 67.848533] x11: ffff0800c0400248 x10: ffff0800c040024a [ 67.848538] x9 : ffff800010576cd4 x8 : ffff0800c0400270 [ 67.848542] x7 : 0000000000000000 x6 : ffff0800c04003e0 [ 67.848546] x5 : ffff0800c0400248 x4 : ffff0800c4294480 [ 67.848550] x3 : dead000000000100 x2 : dead000000000122 [ 67.848555] x1 : 0000000000000100 x0 : ffff0800c097c168 [ 67.848559] Call trace: [ 67.848562] axi_chan_handle_err+0xc4/0x230 [ 67.848566] dw_axi_dma_interrupt+0xf4/0x590 [ 67.848569] __handle_irq_event_percpu+0x60/0x220 [ 67.848573] handle_irq_event+0x64/0x120 [ 67.848576] handle_fasteoi_irq+0xc4/0x220 [ 67.848580] __handle_domain_irq+0x80/0xe0 [ 67.848583] gic_handle_irq+0xc0/0x138 [ 67.848585] el1_irq+0xc8/0x180 [ 67.848588] arch_cpu_idle+0x14/0x2c [ 67.848591] default_idle_call+0x40/0x16c [ 67.848594] do_idle+0x1f0/0x250 [ 67.848597] cpu_startup_entry+0x2c/0x60 [ 67.848600] rest_init+0xc0/0xcc [ 67.848603] arch_call_rest_init+0x14/0x1c [ 67.848606] start_kernel+0x4cc/0x500 [ 67.848610] Code: eb0002ff 9a9f12d6 f2fbd5a2 f2fbd5a3 (a94602c1) [ 67.848613] ---[ end trace 585a97036f88203a ]---
--- drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c +6 -0
@@ -1018,6 +1018,11 @@ static noinline void axi_chan_handle_err/* The bad descriptor currently is in the head of vc list */ vd =vchan_next_desc (&chan->vc); +if (!vd) { +dev_err (chan2dev (chan),"BUG: %s, IRQ with no descriptors\n" , +axi_chan_name (chan)); + goto out; + }/* Remove the completed descriptor from issued list */ list_del (&vd->node);
@@ -1032,6 +1037,7 @@ static noinline void axi_chan_handle_err/* Try to restart the controller */ axi_chan_start_first_queued (chan); +out:spin_unlock_irqrestore (&chan->vc.lock, flags); }
Greg Kroah-Hartman
maintainerPATCH 42/193 LoongArch: Add HWCAP_LOONGARCH_CPUCFG to elf_hwcap
In reply to Greg Kroah-HartmanFrom: Huacai Chen <[email protected]>
commit d52fec86a465355b379e839fa372ead0334d62e6 upstream.
HWCAP_LOONGARCH_CPUCFG is missing in elf_hwcap, so add it for glibc's later use.
--- arch/loongarch/kernel/cpu-probe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/loongarch/kernel/cpu-probe.c +1 -1
@@ -94,7 +94,7 @@ static void cpu_probe_common(struct cpui c->options =LOONGARCH_CPU_CPUCFG |LOONGARCH_CPU_CSR |LOONGARCH_CPU_TLB |LOONGARCH_CPU_VINT |LOONGARCH_CPU_WATCH ; - elf_hwcap |=HWCAP_LOONGARCH_CRC32 ; + elf_hwcap =HWCAP_LOONGARCH_CPUCFG |HWCAP_LOONGARCH_CRC32 ; config =read_cpucfg (LOONGARCH_CPUCFG1 );if (config &CPUCFG1_UAL ) {
Greg Kroah-Hartman
maintainerPATCH 43/193 zonefs: Detect append writes at invalid locations
In reply to Greg Kroah-HartmanFrom: Damien Le Moal <[email protected]>
commit a608da3bd730d718f2d3ebec1c26f9865f8f17ce upstream.
Using REQ_OP_ZONE_APPEND operations for synchronous writes to sequential files succeeds regardless of the zone write pointer position, as long as the target zone is not full. This means that if an external (buggy) application writes to the zone of a sequential file underneath the file system, subsequent file write() operation will succeed but the file size will not be correct and the file will contain invalid data written by another application.
Modify zonefs_file_dio_append() to check the written sector of an append write (returned in bio->bi_iter.bi_sector) and return -EIO if there is a mismatch with the file zone wp offset field. This change triggers a call to zonefs_io_error() and a zone check. Modify zonefs_io_error_cb() to not expose the unexpected data after the current inode size when the errors=remount-ro mode is used. Other error modes are correctly handled already.
--- fs/zonefs/super.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+)
fs/zonefs/super.c +22 -0
@@ -442,6 +442,10 @@ static int zonefs_io_error_cb(struct blk data_size =zonefs_check_zone_condition (inode, zone, false, false); } + }else if (sbi->s_mount_opts &ZONEFS_MNTOPT_ERRORS_RO && + data_size > isize) { +/* Do not expose garbage data */ + data_size = isize; }/*
@@ -805,6 +809,24 @@ static ssize_t zonefs_file_dio_append(st ret =submit_bio_wait (bio); +/* +* If the file zone was written underneath the file system, the zone +* write pointer may not be where we expect it to be, but the zone +* append write can still succeed. So check manually that we wrote where +* we intended to, that is, at zi->i_wpoffset. +*/ +if (!ret) { +sector_t wpsector = + zi->i_zsector + (zi->i_wpoffset >>SECTOR_SHIFT ); + +if (bio->bi_iter.bi_sector != wpsector) { +zonefs_warn (inode->i_sb, +"Corrupted write pointer %llu for zone at %llu\n" , + wpsector, zi->i_zsector); + ret = -EIO ; + } + } +zonefs_file_write_dio_end_io (iocb, size, ret,0 );trace_zonefs_file_dio_append (inode, size, ret);
Greg Kroah-Hartman
maintainerPATCH 44/193 nilfs2: fix general protection fault in nilfs_btree_insert()
In reply to Greg Kroah-HartmanFrom: Ryusuke Konishi <[email protected]>
commit 7633355e5c7f29c049a9048e461427d1d8ed3051 upstream.
If nilfs2 reads a corrupted disk image and tries to reads a b-tree node block by calling __nilfs_btree_get_block() against an invalid virtual block address, it returns -ENOENT because conversion of the virtual block address to a disk block address fails. However, this return value is the same as the internal code that b-tree lookup routines return to indicate that the block being searched does not exist, so functions that operate on that b-tree may misbehave.
When nilfs_btree_insert() receives this spurious 'not found' code from nilfs_btree_do_lookup(), it misunderstands that the 'not found' check was successful and continues the insert operation using incomplete lookup path data, causing the following crash:
general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] ... RIP: 0010:nilfs_btree_get_nonroot_node fs/nilfs2/btree.c:418 [inline] RIP: 0010:nilfs_btree_prepare_insert fs/nilfs2/btree.c:1077 [inline] RIP: 0010:nilfs_btree_insert+0x6d3/0x1c10 fs/nilfs2/btree.c:1238 Code: bc 24 80 00 00 00 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 4b 02 92 fe 4d 8b 3f 49 83 c7 28 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 2e 02 92 fe 4d 8b 3f 49 83 c7 02 ... Call Trace: <TASK> nilfs_bmap_do_insert fs/nilfs2/bmap.c:121 [inline] nilfs_bmap_insert+0x20d/0x360 fs/nilfs2/bmap.c:147 nilfs_get_block+0x414/0x8d0 fs/nilfs2/inode.c:101 __block_write_begin_int+0x54c/0x1a80 fs/buffer.c:1991 __block_write_begin fs/buffer.c:2041 [inline] block_write_begin+0x93/0x1e0 fs/buffer.c:2102 nilfs_write_begin+0x9c/0x110 fs/nilfs2/inode.c:261 generic_perform_write+0x2e4/0x5e0 mm/filemap.c:3772 __generic_file_write_iter+0x176/0x400 mm/filemap.c:3900 generic_file_write_iter+0xab/0x310 mm/filemap.c:3932 call_write_iter include/linux/fs.h:2186 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x7dc/0xc50 fs/read_write.c:584 ksys_write+0x177/0x2a0 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd ... </TASK>
This patch fixes the root cause of this problem by replacing the error code that __nilfs_btree_get_block() returns on block address conversion failure from -ENOENT to another internal code -EINVAL which means that the b-tree metadata is corrupted.
By returning -EINVAL, it propagates without glitches, and for all relevant b-tree operations, functions in the upper bmap layer output an error message indicating corrupted b-tree metadata via nilfs_bmap_convert_error(), and code -EIO will be eventually returned as it should be.
--- fs/nilfs2/btree.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
fs/nilfs2/btree.c +12 -3
@@ -480,9 +480,18 @@ static int __nilfs_btree_get_block(const ret =nilfs_btnode_submit_block (btnc, ptr,0 ,REQ_OP_READ , &bh, &submit_ptr);if (ret) { -if (ret != -EEXIST ) -return ret; - goto out_check; +if (likely (ret == -EEXIST )) + goto out_check; +if (ret == -ENOENT ) { +/* +* Block address translation failed due to invalid +* value of 'ptr'. In this case, return internal code +* -EINVAL (broken bmap) to notify bmap layer of fatal +* metadata corruption. +*/ + ret = -EINVAL ; + } +return ret; }if (ra) {
Greg Kroah-Hartman
maintainerPATCH 45/193 mm/shmem: restore SHMEM_HUGE_DENY precedence over MADV_COLLAPSE
In reply to Greg Kroah-HartmanFrom: Zach O'Keefe <[email protected]>
commit 3de0c269adc6c2fac0bb1fb11965f0de699dc32b upstream.
SHMEM_HUGE_DENY is for emergency use by the admin, to disable allocation of shmem huge pages if, for example, a dangerous bug is found in their
usage: see "deny" in Documentation/mm/transhuge.rst. An app using madvise(,,MADV_COLLAPSE) should not be allowed to override it: restore its precedence over shmem_huge_force.
Restore SHMEM_HUGE_DENY precedence over MADV_COLLAPSE.
--- mm/shmem.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
mm/shmem.c +2 -4
@@ -472,12 +472,10 @@ bool shmem_is_huge(struct vm_area_structif (vma && ((vma->vm_flags &VM_NOHUGEPAGE ) ||test_bit (MMF_DISABLE_THP , &vma->vm_mm->flags)))return false; -if (shmem_huge_force) -return true; -if (shmem_huge ==SHMEM_HUGE_FORCE ) -return true;if (shmem_huge ==SHMEM_HUGE_DENY )return false; +if (shmem_huge_force || shmem_huge ==SHMEM_HUGE_FORCE ) +return true;switch (SHMEM_SB (inode->i_sb)->huge) {case SHMEM_HUGE_ALWAYS :
Greg Kroah-Hartman
maintainerPATCH 46/193 hugetlb: unshare some PMDs when splitting VMAs
In reply to Greg Kroah-HartmanFrom: James Houghton <[email protected]>
commit b30c14cd61025eeea2f2e8569606cd167ba9ad2d upstream.
PMD sharing can only be done in PUD_SIZE-aligned pieces of VMAs; however, it is possible that HugeTLB VMAs are split without unsharing the PMDs first.
Without this fix, it is possible to hit the uffd-wp-related WARN_ON_ONCE in hugetlb_change_protection [1]. The key there is that hugetlb_unshare_all_pmds will not attempt to unshare PMDs in non-PUD_SIZE-aligned sections of the VMA.
It might seem ideal to unshare in hugetlb_vm_op_open, but we need to unshare in both the new and old VMAs, so unsharing in hugetlb_vm_op_split seems natural.
[1]: https://lore.kernel.org/linux-mm/CADrL8HVeOkj0QH5VZZbRzybNE8CG-tEGFshnA+bG9nMgcWtBSg@mail.gmail.com/
--- mm/hugetlb.c | 44 +++++++++++++++++++++++++++++++++++--------- 1 file changed, 35 insertions(+), 9 deletions(-)
mm/hugetlb.c +35 -9
@@ -94,6 +94,8 @@ static int hugetlb_acct_memory(struct hsstatic void hugetlb_vma_lock_free (struct vm_area_struct *vma);static void hugetlb_vma_lock_alloc (struct vm_area_struct *vma);static void __hugetlb_vma_unlock_write_free (struct vm_area_struct *vma); +static void hugetlb_unshare_pmds (struct vm_area_struct *vma, +unsigned long start,unsigned long end);static inline bool subpool_is_free (struct hugepage_subpool *spool) {
@@ -4825,6 +4827,25 @@ static int hugetlb_vm_op_split(struct vm {if (addr & ~(huge_page_mask (hstate_vma (vma))))return -EINVAL ; + +/* +* PMD sharing is only possible for PUD_SIZE-aligned address ranges +* in HugeTLB VMAs. If we will lose PUD_SIZE alignment due to this +* split, unshare PMDs in the PUD_SIZE interval surrounding addr now. +*/ +if (addr & ~PUD_MASK ) { +/* +* hugetlb_vm_op_split is called right before we attempt to +* split the VMA. We will need to unshare PMDs in the old and +* new VMAs, so let's unshare before we split. +*/ +unsigned long floor = addr &PUD_MASK ; +unsigned long ceil = floor +PUD_SIZE ; + +if (floor >= vma->vm_start && ceil <= vma->vm_end) +hugetlb_unshare_pmds (vma, floor, ceil); + } +return 0 ; }
@@ -7386,26 +7407,21 @@ void move_hugetlb_state(struct page *old } } -/* -* This function will unconditionally remove all the shared pmd pgtable entries -* within the specific vma for a hugetlbfs memory range. -*/ -void hugetlb_unshare_all_pmds (struct vm_area_struct *vma) +static void hugetlb_unshare_pmds (struct vm_area_struct *vma, +unsigned long start, +unsigned long end) {struct hstate *h =hstate_vma (vma);unsigned long sz =huge_page_size (h);struct mm_struct *mm = vma->vm_mm;struct mmu_notifier_range range; -unsigned long address, start, end; +unsigned long address;spinlock_t *ptl;pte_t *ptep;if (!(vma->vm_flags &VM_MAYSHARE ))return ; - start =ALIGN (vma->vm_start,PUD_SIZE ); - end =ALIGN_DOWN (vma->vm_end,PUD_SIZE ); -if (start >= end)return ;
@@ -7437,6 +7453,16 @@ void hugetlb_unshare_all_pmds(struct vm_mmu_notifier_invalidate_range_end (&range); } +/* +* This function will unconditionally remove all the shared pmd pgtable entries +* within the specific vma for a hugetlbfs memory range. +*/ +void hugetlb_unshare_all_pmds (struct vm_area_struct *vma) +{ +hugetlb_unshare_pmds (vma,ALIGN (vma->vm_start,PUD_SIZE ), +ALIGN_DOWN (vma->vm_end,PUD_SIZE )); +} +#ifdef CONFIG_CMA static bool cma_reserve_called__initdata ;
Greg Kroah-Hartman
maintainerPATCH 47/193 mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma
In reply to Greg Kroah-HartmanFrom: Hugh Dickins <[email protected]>
commit ab0c3f1251b4670978fde0bd54161795a139b060 upstream.
uprobe_write_opcode() uses collapse_pte_mapped_thp() to restore huge pmd, when removing a breakpoint from hugepage text: vma->anon_vma is always set in that case, so undo the prohibition. And MADV_COLLAPSE ought to be able to collapse some page tables in a vma which happens to have anon_vma set from CoWing elsewhere.
Is anon_vma lock required? Almost not: if any page other than expected subpage of the non-anon huge page is found in the page table, collapse is aborted without making any change. However, it is possible that an anon page was CoWed from this extent in another mm or vma, in which case a concurrent lookup might look here: so keep it away while clearing pmd (but perhaps we shall go back to using pmd_lock() there in future).
Note that collapse_pte_mapped_thp() is exceptional in freeing a page table without having cleared its ptes: I'm uneasy about that, and had thought pte_clear()ing appropriate; but exclusive i_mmap lock does fix the problem, and we would have to move the mmu_notification if clearing those ptes.
What this fixes is not a dangerous instability. But I suggest Cc stable because uprobes "healing" has regressed in that way, so this should follow 8d3c106e19e8 into those stable releases where it was backported (and may want adjustment there - I'll supply backports as needed).
--- mm/khugepaged.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
mm/khugepaged.c +6 -8
@@ -1467,14 +1467,6 @@ int collapse_pte_mapped_thp(struct mm_stif (!hugepage_vma_check (vma, vma->vm_flags, false, false, false))return SCAN_VMA_CHECK ; -/* -* Symmetry with retract_page_tables(): Exclude MAP_PRIVATE mappings -* that got written to. Without this, we'd have to also lock the -* anon_vma if one exists. -*/ -if (vma->anon_vma) -return SCAN_VMA_CHECK ; -/* Keep pmd pgtable for uffd-wp; see comment in retract_page_tables() */ if (userfaultfd_wp (vma))return SCAN_PTE_UFFD_WP ;
@@ -1574,8 +1566,14 @@ int collapse_pte_mapped_thp(struct mm_st }/* step 4: remove pte entries */ +/* we make no change to anon, but protect concurrent anon page lookup */ +if (vma->anon_vma) +anon_vma_lock_write (vma->anon_vma); +collapse_and_free_pmd (mm, vma, haddr, pmd); +if (vma->anon_vma) +anon_vma_unlock_write (vma->anon_vma);i_mmap_unlock_write (vma->vm_file->f_mapping); maybe_install_pmd:
Greg Kroah-Hartman
maintainerPATCH 48/193 serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler
In reply to Greg Kroah-HartmanFrom: Marek Vasut <[email protected]>
commit f24771b62a83239f0dce816bddf0f6807f436235 upstream.
Requesting an interrupt with IRQF_ONESHOT will run the primary handler in the hard-IRQ context even in the force-threaded mode. The force-threaded mode is used by PREEMPT_RT in order to avoid acquiring sleeping locks (spinlock_t) in hard-IRQ context. This combination makes it impossible and leads to "sleeping while atomic" warnings.
Use one interrupt handler for both handlers (primary and secondary) and drop the IRQF_ONESHOT flag which is not needed.
--- drivers/tty/serial/stm32-usart.c | 31 ++++--------------------------- 1 file changed, 4 insertions(+), 27 deletions(-)
drivers/tty/serial/stm32-usart.c +4 -27
@@ -798,23 +798,9 @@ static irqreturn_t stm32_usart_interruptspin_unlock (&port->lock); } -if (stm32_usart_rx_dma_enabled (port)) -return IRQ_WAKE_THREAD ; -else -return IRQ_HANDLED ; -} - -static irqreturn_t stm32_usart_threaded_interrupt (int irq,void *ptr) -{ -struct uart_port *port = ptr; -struct tty_port *tport = &port->state->port; -struct stm32_port *stm32_port =to_stm32_port (port); -unsigned int size; -unsigned long flags; -/* Receiver timeout irq for DMA RX */ -if (!stm32_port->throttled) { -spin_lock_irqsave (&port->lock, flags); +if (stm32_usart_rx_dma_enabled (port) && !stm32_port->throttled) { +spin_lock (&port->lock); size =stm32_usart_receive_chars (port, false);uart_unlock_and_check_sysrq_irqrestore (port, flags);if (size)
@@ -1016,10 +1002,8 @@ static int stm32_usart_startup(struct uau32 val;int ret; - ret =request_threaded_irq (port->irq, stm32_usart_interrupt, - stm32_usart_threaded_interrupt, -IRQF_ONESHOT |IRQF_NO_SUSPEND , - name, port); + ret =request_irq (port->irq, stm32_usart_interrupt, +IRQF_NO_SUSPEND , name, port);if (ret)return ret;
@@ -1602,13 +1586,6 @@ static int stm32_usart_of_dma_rx_probe(sstruct dma_slave_config config;int ret; -/* -* Using DMA and threaded handler for the console could lead to -* deadlocks. -*/ -if (uart_console (port)) -return -ENODEV ; - stm32port->rx_buf =dma_alloc_coherent (dev,RX_BUF_L , &stm32port->rx_dma_buf,GFP_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 49/193 Revert "serial: stm32: Merge hard IRQ and threaded IRQ handling into single IRQ handler"
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
commit 2cbafffbf69addd7509072f4be5917f81d238cf6 upstream.
This reverts commit f24771b62a83239f0dce816bddf0f6807f436235 as it is reported to break the build.
--- drivers/tty/serial/stm32-usart.c | 31 +++++++++++++++++++++++++++---- 1 file changed, 27 insertions(+), 4 deletions(-)
drivers/tty/serial/stm32-usart.c +27 -4
@@ -798,9 +798,23 @@ static irqreturn_t stm32_usart_interruptspin_unlock (&port->lock); } +if (stm32_usart_rx_dma_enabled (port)) +return IRQ_WAKE_THREAD ; +else +return IRQ_HANDLED ; +} + +static irqreturn_t stm32_usart_threaded_interrupt (int irq,void *ptr) +{ +struct uart_port *port = ptr; +struct tty_port *tport = &port->state->port; +struct stm32_port *stm32_port =to_stm32_port (port); +unsigned int size; +unsigned long flags; +/* Receiver timeout irq for DMA RX */ -if (stm32_usart_rx_dma_enabled (port) && !stm32_port->throttled) { -spin_lock (&port->lock); +if (!stm32_port->throttled) { +spin_lock_irqsave (&port->lock, flags); size =stm32_usart_receive_chars (port, false);uart_unlock_and_check_sysrq_irqrestore (port, flags);if (size)
@@ -1002,8 +1016,10 @@ static int stm32_usart_startup(struct uau32 val;int ret; - ret =request_irq (port->irq, stm32_usart_interrupt, -IRQF_NO_SUSPEND , name, port); + ret =request_threaded_irq (port->irq, stm32_usart_interrupt, + stm32_usart_threaded_interrupt, +IRQF_ONESHOT |IRQF_NO_SUSPEND , + name, port);if (ret)return ret;
@@ -1586,6 +1602,13 @@ static int stm32_usart_of_dma_rx_probe(sstruct dma_slave_config config;int ret; +/* +* Using DMA and threaded handler for the console could lead to +* deadlocks. +*/ +if (uart_console (port)) +return -ENODEV ; + stm32port->rx_buf =dma_alloc_coherent (dev,RX_BUF_L , &stm32port->rx_dma_buf,GFP_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 50/193 xhci-pci: set the dma max_seg_size
In reply to Greg Kroah-HartmanFrom: Ricardo Ribalda <[email protected]>
commit 93915a4170e9defd56a767a18e6c4076f3d18609 upstream.
Allow devices to have dma operations beyond 64K, and avoid warnings such as:
xhci_hcd 0000:00:14.0: mapping sg segment longer than device claims to support [len=98304] [max=65536]
--- drivers/usb/host/xhci-pci.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/host/xhci-pci.c +2 -0
@@ -455,6 +455,8 @@ static int xhci_pci_probe(struct pci_devif (xhci->quirks &XHCI_DEFAULT_PM_RUNTIME_ALLOW )pm_runtime_allow (&dev->dev); +dma_set_max_seg_size (&dev->dev,UINT_MAX ); +return 0 ; put_usb3_hcd:
Greg Kroah-Hartman
maintainerPATCH 51/193 usb: xhci: Check endpoint is valid before dereferencing it
In reply to Greg Kroah-HartmanFrom: Jimmy Hu <[email protected]>
commit e8fb5bc76eb86437ab87002d4a36d6da02165654 upstream.
When the host controller is not responding, all URBs queued to all endpoints need to be killed. This can cause a kernel panic if we dereference an invalid endpoint.
Fix this by using xhci_get_virt_ep() helper to find the endpoint and checking if the endpoint is valid before dereferencing it.
[233311.853271] xhci-hcd xhci-hcd.1.auto: xHCI host controller not responding, assume dead [233311.853393] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000e8
[233311.853964] pc : xhci_hc_died+0x10c/0x270 [233311.853971] lr : xhci_hc_died+0x1ac/0x270
[233311.854077] Call trace: [233311.854085] xhci_hc_died+0x10c/0x270 [233311.854093] xhci_stop_endpoint_command_watchdog+0x100/0x1a4 [233311.854105] call_timer_fn+0x50/0x2d4 [233311.854112] expire_timers+0xac/0x2e4 [233311.854118] run_timer_softirq+0x300/0xabc [233311.854127] __do_softirq+0x148/0x528 [233311.854135] irq_exit+0x194/0x1a8 [233311.854143] __handle_domain_irq+0x164/0x1d0 [233311.854149] gic_handle_irq.22273+0x10c/0x188 [233311.854156] el1_irq+0xfc/0x1a8 [233311.854175] lpm_cpuidle_enter+0x25c/0x418 [msm_pm] [233311.854185] cpuidle_enter_state+0x1f0/0x764 [233311.854194] do_idle+0x594/0x6ac [233311.854201] cpu_startup_entry+0x7c/0x80 [233311.854209] secondary_start_kernel+0x170/0x198
Message-ID: <[email protected]>
--- drivers/usb/host/xhci-ring.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/usb/host/xhci-ring.c +4 -1
@@ -1170,7 +1170,10 @@ static void xhci_kill_endpoint_urbs(strustruct xhci_virt_ep *ep;struct xhci_ring *ring; - ep = &xhci->devs[slot_id]->eps[ep_index]; + ep =xhci_get_virt_ep (xhci, slot_id, ep_index); +if (!ep) +return ; +if ((ep->ep_state &EP_HAS_STREAMS ) || (ep->ep_state &EP_GETTING_NO_STREAMS )) {int stream_id;
Greg Kroah-Hartman
maintainerPATCH 52/193 xhci: Fix null pointer dereference when host dies
In reply to Greg Kroah-HartmanFrom: Mathias Nyman <[email protected]>
commit a2bc47c43e70cf904b1af49f76d572326c08bca7 upstream.
Make sure xhci_free_dev() and xhci_kill_endpoint_urbs() do not race and cause null pointer dereference when host suddenly dies.
Usb core may call xhci_free_dev() which frees the xhci->devs[slot_id] virt device at the same time that xhci_kill_endpoint_urbs() tries to loop through all the device's endpoints, checking if there are any cancelled urbs left to give back.
hold the xhci spinlock while freeing the virt device
--- drivers/usb/host/xhci.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/host/xhci.c +5 -0
@@ -3974,6 +3974,7 @@ static void xhci_free_dev(struct usb_hcdstruct xhci_hcd *xhci =hcd_to_xhci (hcd);struct xhci_virt_device *virt_dev;struct xhci_slot_ctx *slot_ctx; +unsigned long flags;int i, ret;/*
@@ -4000,7 +4001,11 @@ static void xhci_free_dev(struct usb_hcd virt_dev->eps[i].ep_state &= ~EP_STOP_CMD_PENDING ; virt_dev->udev =NULL ;xhci_disable_slot (xhci, udev->slot_id); + +spin_lock_irqsave (&xhci->lock, flags);xhci_free_virt_device (xhci, udev->slot_id); +spin_unlock_irqrestore (&xhci->lock, flags); + }int xhci_disable_slot (struct xhci_hcd *xhci,u32 slot_id)
Greg Kroah-Hartman
maintainerPATCH 53/193 xhci: Add update_hub_device override for PCI xHCI hosts
In reply to Greg Kroah-HartmanFrom: Mathias Nyman <[email protected]>
commit 23a3b8d5a2365653fd9bc5a9454d1e7f4facbf85 upstream.
Allow PCI hosts to check and tune roothub and port settings before the hub is up and running.
This override is needed to turn off U1 and U2 LPM for some ports based on per port ACPI _DSM, _UPC, or possibly vendor specific mmio values for Intel xHC hosts.
Usb core calls the host update_hub_device once it creates a hub.
Entering U1 or U2 link power save state on ports with this limitation will cause link to fail, turning the usb device unusable in that setup.
--- drivers/usb/host/xhci-pci.c | 9 +++++++++ drivers/usb/host/xhci.c | 5 ++++- drivers/usb/host/xhci.h | 4 ++++ 3 files changed, 17 insertions(+), 1 deletion(-)
drivers/usb/host/xhci-pci.c +9 -0
@@ -78,9 +78,12 @@ static const char hcd_name[] = "xhci_hcdstatic struct hc_driver __read_mostly xhci_pci_hc_driver;static int xhci_pci_setup (struct usb_hcd *hcd); +static int xhci_pci_update_hub_device (struct usb_hcd *hcd,struct usb_device *hdev, +struct usb_tt *tt,gfp_t mem_flags);static const struct xhci_driver_overrides xhci_pci_overrides__initconst = { .reset = xhci_pci_setup, + .update_hub_device = xhci_pci_update_hub_device, };/* called after powerup, by probe or system-pm "wakeup" */
@@ -386,6 +389,12 @@ static int xhci_pci_setup(struct usb_hcdreturn xhci_pci_reinit (xhci, pdev); } +static int xhci_pci_update_hub_device (struct usb_hcd *hcd,struct usb_device *hdev, +struct usb_tt *tt,gfp_t mem_flags) +{ +return xhci_update_hub_device (hcd, hdev, tt, mem_flags); +} +/* * We need to register our own PCI probe function (instead of the USB core's * function) in order to create a second roothub under xHCI.
drivers/usb/host/xhci.c +4 -1
@@ -5124,7 +5124,7 @@ static int xhci_disable_usb3_lpm_timeout/* Once a hub descriptor is fetched for a device, we need to update the xHC's * internal data structures for the device. */ -static int xhci_update_hub_device (struct usb_hcd *hcd,struct usb_device *hdev, +int xhci_update_hub_device (struct usb_hcd *hcd,struct usb_device *hdev,struct usb_tt *tt,gfp_t mem_flags) {struct xhci_hcd *xhci =hcd_to_xhci (hcd);
@@ -5224,6 +5224,7 @@ static int xhci_update_hub_device(structxhci_free_command (xhci, config_cmd);return ret; } +EXPORT_SYMBOL_GPL (xhci_update_hub_device);static int xhci_get_frame (struct usb_hcd *hcd) {
@@ -5507,6 +5508,8 @@ void xhci_init_driver(struct hc_driver * drv->check_bandwidth = over->check_bandwidth;if (over->reset_bandwidth) drv->reset_bandwidth = over->reset_bandwidth; +if (over->update_hub_device) + drv->update_hub_device = over->update_hub_device; } }EXPORT_SYMBOL_GPL (xhci_init_driver);
drivers/usb/host/xhci.h +4 -0
@@ -1943,6 +1943,8 @@ struct xhci_driver_overrides { struct usb_host_endpoint *ep);int (*check_bandwidth)(struct usb_hcd *,struct usb_device *);void (*reset_bandwidth)(struct usb_hcd *,struct usb_device *); +int (*update_hub_device)(struct usb_hcd *hcd,struct usb_device *hdev, +struct usb_tt *tt,gfp_t mem_flags); };#define XHCI_CFC_DELAY 10
@@ -2122,6 +2124,8 @@ int xhci_drop_endpoint(struct usb_hcd *h struct usb_host_endpoint *ep);int xhci_check_bandwidth (struct usb_hcd *hcd,struct usb_device *udev);void xhci_reset_bandwidth (struct usb_hcd *hcd,struct usb_device *udev); +int xhci_update_hub_device (struct usb_hcd *hcd,struct usb_device *hdev, +struct usb_tt *tt,gfp_t mem_flags);int xhci_disable_slot (struct xhci_hcd *xhci,u32 slot_id);int xhci_ext_cap_init (struct xhci_hcd *xhci);
Greg Kroah-Hartman
maintainerPATCH 54/193 xhci: Add a flag to disable USB3 lpm on a xhci root port level.
In reply to Greg Kroah-HartmanFrom: Mathias Nyman <[email protected]>
commit 0522b9a1653048440da5f21747f21e498b9220d1 upstream.
One USB3 roothub port may support link power management, while another root port on the same xHC can't due to different retimers used for the ports.
This is the case with Intel Alder Lake, and possible future platforms where retimers used for USB4 ports cause too long exit latecy to enable native USB3 lpm U1 and U2 states.
Add a flag in the xhci port structure to indicate if the port is lpm_incapable, and check it while calculating exit latency.
--- drivers/usb/host/xhci.c | 8 ++++++++ drivers/usb/host/xhci.h | 1 + 2 files changed, 9 insertions(+)
drivers/usb/host/xhci.c +8 -0
@@ -5049,6 +5049,7 @@ static int xhci_enable_usb3_lpm_timeout( struct usb_device *udev, enum usb3_link_state state) { struct xhci_hcd *xhci; +struct xhci_port *port;u16 hub_encoded_timeout;int mel;int ret;
@@ -5065,6 +5066,13 @@ static int xhci_enable_usb3_lpm_timeout(if (xhci_check_tier_policy (xhci, udev, state) <0 )return USB3_LPM_DISABLED ; +/* If connected to root port then check port can handle lpm */ +if (udev->parent && !udev->parent->parent) { + port = xhci->usb3_rhub.ports[udev->portnum -1 ]; +if (port->lpm_incapable) +return USB3_LPM_DISABLED ; + } + hub_encoded_timeout =xhci_calculate_lpm_timeout (hcd, udev, state); mel =calculate_max_exit_latency (udev, state, hub_encoded_timeout);if (mel <0 ) {
drivers/usb/host/xhci.h +1 -0
@@ -1735,6 +1735,7 @@ struct xhci_port {int hcd_portnum;struct xhci_hub *rhub;struct xhci_port_cap *port_cap; + unsigned int lpm_incapable:1; };struct xhci_hub {
Greg Kroah-Hartman
maintainerPATCH 55/193 usb: acpi: add helper to check port lpm capability using acpi _DSM
In reply to Greg Kroah-HartmanFrom: Mathias Nyman <[email protected]>
commit cd702d18c882d5a4ea44bbdb38edd5d5577ef640 upstream.
Add a helper to evaluate ACPI usb device specific method (_DSM) provided in case the USB3 port shouldn't enter U1 and U2 link states.
This _DSM was added as port specific retimer configuration may lead to exit latencies growing beyond U1/U2 exit limits, and OS needs a way to find which ports can't support U1/U2 link power management states.
This _DSM is also used by windows:
Some patch issues found in testing resolved by Ron Lee
--- drivers/usb/core/usb-acpi.c | 65 ++++++++++++++++++++++++++++++++++++++++++++ include/linux/usb.h | 3 ++ 2 files changed, 68 insertions(+)
drivers/usb/core/usb-acpi.c +65 -0
@@ -37,6 +37,71 @@ bool usb_acpi_power_manageable(struct us }EXPORT_SYMBOL_GPL (usb_acpi_power_manageable); +#define UUID_USB_CONTROLLER_DSM "ce2ee385-00e6-48cb-9f05-2edb927c4899" +#define USB_DSM_DISABLE_U1_U2_FOR_PORT 5 + +/** +* usb_acpi_port_lpm_incapable - check if lpm should be disabled for a port. +* @hdev: USB device belonging to the usb hub +* @index: zero based port index +* +* Some USB3 ports may not support USB3 link power management U1/U2 states +* due to different retimer setup. ACPI provides _DSM method which returns 0x01 +* if U1 and U2 states should be disabled. Evaluate _DSM with: +* Arg0: UUID = ce2ee385-00e6-48cb-9f05-2edb927c4899 +* Arg1: Revision ID = 0 +* Arg2: Function Index = 5 +* Arg3: (empty) +* +* Return 1 if USB3 port is LPM incapable, negative on error, otherwise 0 +*/ + +int usb_acpi_port_lpm_incapable (struct usb_device *hdev,int index) +{ +union acpi_object *obj; +acpi_handle port_handle; +int port1 = index +1 ; +guid_t guid; +int ret; + + ret =guid_parse (UUID_USB_CONTROLLER_DSM , &guid); +if (ret) +return ret; + + port_handle =usb_get_hub_port_acpi_handle (hdev, port1); +if (!port_handle) { +dev_dbg (&hdev->dev,"port-%d no acpi handle\n" , port1); +return -ENODEV ; + } + +if (!acpi_check_dsm (port_handle, &guid,0 , +BIT (USB_DSM_DISABLE_U1_U2_FOR_PORT ))) { +dev_dbg (&hdev->dev,"port-%d no _DSM function %d\n" , + port1,USB_DSM_DISABLE_U1_U2_FOR_PORT ); +return -ENODEV ; + } + + obj =acpi_evaluate_dsm (port_handle, &guid,0 , +USB_DSM_DISABLE_U1_U2_FOR_PORT ,NULL ); + +if (!obj) +return -ENODEV ; + +if (obj->type !=ACPI_TYPE_INTEGER ) { +dev_dbg (&hdev->dev,"evaluate port-%d _DSM failed\n" , port1); +ACPI_FREE (obj); +return -EINVAL ; + } + +if (obj->integer.value ==0x01 ) + ret =1 ; + +ACPI_FREE (obj); + +return ret; +} +EXPORT_SYMBOL_GPL (usb_acpi_port_lpm_incapable); +/** * usb_acpi_set_power_state - control usb port's power via acpi power * resource
include/linux/usb.h +3 -0
@@ -751,11 +751,14 @@ extern struct device *usb_intf_get_dma_dextern int usb_acpi_set_power_state (struct usb_device *hdev,int index,bool enable);extern bool usb_acpi_power_manageable (struct usb_device *hdev,int index); +extern int usb_acpi_port_lpm_incapable (struct usb_device *hdev,int index);#else static inline int usb_acpi_set_power_state (struct usb_device *hdev,int index,bool enable) {return 0 ; }static inline bool usb_acpi_power_manageable (struct usb_device *hdev,int index) {return true; } +static inline int usb_acpi_port_lpm_incapable (struct usb_device *hdev,int index) + {return 0 ; }#endif /* USB autosuspend and autoresume */
Greg Kroah-Hartman
maintainerPATCH 56/193 xhci: Detect lpm incapable xHC USB3 roothub ports from ACPI tables
In reply to Greg Kroah-HartmanFrom: Mathias Nyman <[email protected]>
commit 74622f0a81d0c2bcfc39f9192b788124e8c7f0af upstream.
USB3 ports on xHC hosts may have retimers that cause too long exit latency to work with native USB3 U1/U2 link power management states.
For now only use usb_acpi_port_lpm_incapable() to evaluate if port lpm should be disabled while setting up the USB3 roothub.
Other ways to identify lpm incapable ports can be added here later if ACPI _DSM does not exist.
Limit this to Intel hosts for now, this is to my knowledge only an Intel issue.
--- drivers/usb/host/xhci-pci.c | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+)
drivers/usb/host/xhci-pci.c +34 -0
@@ -355,8 +355,38 @@ static void xhci_pme_acpi_rtd3_enable(st NULL);ACPI_FREE (obj); } + +static void xhci_find_lpm_incapable_ports (struct usb_hcd *hcd,struct usb_device *hdev) +{ +struct xhci_hcd *xhci =hcd_to_xhci (hcd); +struct xhci_hub *rhub = &xhci->usb3_rhub; +int ret; +int i; + +/* This is not the usb3 roothub we are looking for */ +if (hcd != rhub->hcd) +return ; + +if (hdev->maxchild > rhub->num_ports) { +dev_err (&hdev->dev,"USB3 roothub port number mismatch\n" ); +return ; + } + +for (i =0 ; i < hdev->maxchild; i++) { + ret =usb_acpi_port_lpm_incapable (hdev, i); + +dev_dbg (&hdev->dev,"port-%d disable U1/U2 _DSM: %d\n" , i +1 , ret); + +if (ret >=0 ) { + rhub->ports[i]->lpm_incapable = ret; +continue ; + } + } +} +#else static void xhci_pme_acpi_rtd3_enable (struct pci_dev *dev) { } +static void xhci_find_lpm_incapable_ports (struct usb_hcd *hcd,struct usb_device *hdev) { }#endif /* CONFIG_ACPI */ /* called during probe() after chip reset completes */
@@ -392,6 +422,10 @@ static int xhci_pci_setup(struct usb_hcdstatic int xhci_pci_update_hub_device (struct usb_hcd *hcd,struct usb_device *hdev,struct usb_tt *tt,gfp_t mem_flags) { +/* Check if acpi claims some USB3 roothub ports are lpm incapable */ +if (!hdev->parent) +xhci_find_lpm_incapable_ports (hcd, hdev); +return xhci_update_hub_device (hcd, hdev, tt, mem_flags); }
Greg Kroah-Hartman
maintainerPATCH 57/193 prlimit: do_prlimit needs to have a speculation check
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
commit 739790605705ddcf18f21782b9c99ad7d53a8c11 upstream.
do_prlimit() adds the user-controlled resource value to a pointer that will subsequently be dereferenced. In order to help prevent this codepath from being used as a spectre "gadget" a barrier needs to be added after checking the range.
--- kernel/sys.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/sys.c +2 -0
@@ -1442,6 +1442,8 @@ static int do_prlimit(struct task_structif (resource >=RLIM_NLIMITS )return -EINVAL ; + resource =array_index_nospec (resource,RLIM_NLIMITS ); +if (new_rlim) {if (new_rlim->rlim_cur > new_rlim->rlim_max)return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 58/193 USB: serial: option: add Quectel EM05-G (GR) modem
In reply to Greg Kroah-HartmanFrom: Duke Xin(辛安文) <[email protected]>
commit 6c331f32e32ac71eb3e8b93fceda2802d7ecb889 upstream.
The EM05-G (GR) modem has 2 USB configurations that are configurable via the AT command AT+QCFG="usbnet",[ 0 | 2 ] which make the modem enumerate with the following interfaces, respectively:
"RMNET" : AT + DIAG + NMEA + Modem + QMI
"MBIM" : MBIM + AT + DIAG + NMEA + Modem
The detailed description of the USB configuration for each mode as follows:
RMNET Mode
--------------
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 21 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0313 Rev= 3.18 S: Manufacturer=Quectel S: Product=Quectel EM05-G C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
MBIM Mode
--------------
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 16 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0313 Rev= 3.18 S: Manufacturer=Quectel S: Product=Quectel EM05-G C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/serial/option.c +3 -0
@@ -256,6 +256,7 @@ static void option_instat_callback(struc#define QUECTEL_PRODUCT_EM05G 0x030a#define QUECTEL_PRODUCT_EM060K 0x030b#define QUECTEL_PRODUCT_EM05G_SG 0x0311 +#define QUECTEL_PRODUCT_EM05G_GR 0x0313#define QUECTEL_PRODUCT_EM12 0x0512#define QUECTEL_PRODUCT_RM500Q 0x0800#define QUECTEL_PRODUCT_RM520N 0x0801
@@ -1161,6 +1162,8 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) }, { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G, 0xff), .driver_info = RSVD(6) | ZLP }, + { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_GR, 0xff), + .driver_info = RSVD(6) | ZLP }, { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_SG, 0xff), .driver_info = RSVD(6) | ZLP }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0x00, 0x40) },
Greg Kroah-Hartman
maintainerPATCH 59/193 USB: serial: option: add Quectel EM05-G (CS) modem
In reply to Greg Kroah-HartmanFrom: Duke Xin(辛安文) <[email protected]>
commit bb78654b0b46316dac687fd4b7dc7cce636f46cd upstream.
The EM05-G (CS) modem has 2 USB configurations that are configurable via the AT command AT+QCFG="usbnet",[ 0 | 2 ] which make the modem enumerate with the following interfaces, respectively:
"RMNET" : AT + DIAG + NMEA + Modem + QMI
"MBIM" : MBIM + AT + DIAG + NMEA + Modem
The detailed description of the USB configuration for each mode as follows:
RMNET Mode
--------------
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 21 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=030C Rev= 3.18 S: Manufacturer=Quectel S: Product=Quectel EM05-G C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
MBIM Mode
--------------
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 16 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=030C Rev= 3.18 S: Manufacturer=Quectel S: Product=Quectel EM05-G C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/serial/option.c +3 -0
@@ -255,6 +255,7 @@ static void option_instat_callback(struc#define QUECTEL_PRODUCT_EP06 0x0306#define QUECTEL_PRODUCT_EM05G 0x030a#define QUECTEL_PRODUCT_EM060K 0x030b +#define QUECTEL_PRODUCT_EM05G_CS 0x030c#define QUECTEL_PRODUCT_EM05G_SG 0x0311#define QUECTEL_PRODUCT_EM05G_GR 0x0313#define QUECTEL_PRODUCT_EM12 0x0512
@@ -1164,6 +1165,8 @@ static const struct usb_device_id option .driver_info = RSVD(6) | ZLP }, { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_GR, 0xff), .driver_info = RSVD(6) | ZLP }, + { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_CS, 0xff), + .driver_info = RSVD(6) | ZLP }, { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_SG, 0xff), .driver_info = RSVD(6) | ZLP }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0x00, 0x40) },
Greg Kroah-Hartman
maintainerPATCH 60/193 USB: serial: option: add Quectel EM05-G (RS) modem
In reply to Greg Kroah-HartmanFrom: Duke Xin(辛安文) <[email protected]>
commit b72d13977689f0c717444010e108c4f20658dfee upstream.
The EM05-G (RS) modem has 2 USB configurations that are configurable via the AT command AT+QCFG="usbnet",[ 0 | 2 ] which make the modem enumerate with the following interfaces, respectively:
"RMNET" : AT + DIAG + NMEA + Modem + QMI
"MBIM" : MBIM + AT + DIAG + NMEA + Modem
The detailed description of the USB configuration for each mode as follows:
RMNET Mode
--------------
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 21 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0314 Rev= 3.18 S: Manufacturer=Quectel S: Product=Quectel EM05-G C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
MBIM Mode
--------------
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 16 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0314 Rev= 3.18 S: Manufacturer=Quectel S: Product=Quectel EM05-G C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/serial/option.c +3 -0
@@ -258,6 +258,7 @@ static void option_instat_callback(struc#define QUECTEL_PRODUCT_EM05G_CS 0x030c#define QUECTEL_PRODUCT_EM05G_SG 0x0311#define QUECTEL_PRODUCT_EM05G_GR 0x0313 +#define QUECTEL_PRODUCT_EM05G_RS 0x0314#define QUECTEL_PRODUCT_EM12 0x0512#define QUECTEL_PRODUCT_RM500Q 0x0800#define QUECTEL_PRODUCT_RM520N 0x0801
@@ -1167,6 +1168,8 @@ static const struct usb_device_id option .driver_info = RSVD(6) | ZLP }, { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_CS, 0xff), .driver_info = RSVD(6) | ZLP }, + { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_RS, 0xff), + .driver_info = RSVD(6) | ZLP }, { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_SG, 0xff), .driver_info = RSVD(6) | ZLP }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0x00, 0x40) },
Greg Kroah-Hartman
maintainerPATCH 61/193 USB: serial: option: add Quectel EC200U modem
In reply to Greg Kroah-HartmanFrom: Ali Mirghasemi <[email protected]>
commit d9bbb15881046bd76f8710c76e26a740eee997ef upstream.
Add support for EC200U modem
0x0901: EC200U - AT + AP + CP + NMEA + DIAG + MOS
usb-device output:
T: Bus=01 Lev=02 Prnt=02 Port=02 Cnt=01 Dev#= 4 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=2c7c ProdID=0901 Rev= 3.18
S: Manufacturer=Android
S: Product=Android
C:* #Ifs= 9 Cfg#= 1 Atr=e0 MxPwr=400mA
A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=06 Prot=00
I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=32ms
I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=83(I) Atr=03(Int.) MxPS= 512 Ivl=4096ms
I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 7 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=8a(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=89(I) Atr=03(Int.) MxPS= 512 Ivl=4096ms
I:* If#= 8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=08(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -262,6 +262,7 @@ static void option_instat_callback(struc#define QUECTEL_PRODUCT_EM12 0x0512#define QUECTEL_PRODUCT_RM500Q 0x0800#define QUECTEL_PRODUCT_RM520N 0x0801 +#define QUECTEL_PRODUCT_EC200U 0x0901#define QUECTEL_PRODUCT_EC200S_CN 0x6002#define QUECTEL_PRODUCT_EC200T 0x6026#define QUECTEL_PRODUCT_RM500K 0x7001
@@ -1189,6 +1190,7 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0xff, 0x30) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0, 0) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200U, 0xff, 0, 0) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200S_CN, 0xff, 0, 0) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500K, 0xff, 0x00, 0x00) },
Greg Kroah-Hartman
maintainerPATCH 62/193 USB: serial: option: add Quectel EM05CN (SG) modem
In reply to Greg Kroah-HartmanFrom: Duke Xin(辛安文) <[email protected]>
commit 1541dd0097c0f8f470e76eddf5120fc55a7e3101 upstream.
The EM05CN (SG) modem has 2 USB configurations that are configurable via the AT command AT+QCFG="usbnet",[ 0 | 2 ] which make the modem enumerate with the following interfaces, respectively:
"MBIM" : AT + MBIM + DIAG + NMEA + MODEM
"RMNET" : AT + DIAG + NMEA + Modem + QMI
The detailed description of the USB configuration for each mode as follows:
MBIM Mode
--------------
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0310 Rev= 3.18 S: Manufacturer=Quectel S: Product=Quectel EM05-CN C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA A: FirstIf#= 1 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I:* If#= 2 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
RMNET Mode
--------------
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0310 Rev= 3.18 S: Manufacturer=Quectel S: Product=Quectel EM05-CN C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/serial/option.c +3 -0
@@ -256,6 +256,7 @@ static void option_instat_callback(struc#define QUECTEL_PRODUCT_EM05G 0x030a#define QUECTEL_PRODUCT_EM060K 0x030b#define QUECTEL_PRODUCT_EM05G_CS 0x030c +#define QUECTEL_PRODUCT_EM05CN_SG 0x0310#define QUECTEL_PRODUCT_EM05G_SG 0x0311#define QUECTEL_PRODUCT_EM05G_GR 0x0313#define QUECTEL_PRODUCT_EM05G_RS 0x0314
@@ -1163,6 +1164,8 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff), .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) }, + { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05CN_SG, 0xff), + .driver_info = RSVD(6) | ZLP }, { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G, 0xff), .driver_info = RSVD(6) | ZLP }, { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_GR, 0xff),
Greg Kroah-Hartman
maintainerPATCH 63/193 USB: serial: option: add Quectel EM05CN modem
In reply to Greg Kroah-HartmanFrom: Duke Xin(辛安文) <[email protected]>
commit 71dfd381a7c051f16a61f82fbd38a4cca563bdca upstream.
The EM05CN modem has 2 USB configurations that are configurable via the AT command AT+QCFG="usbnet",[ 0 | 2 ] which make the modem enumerate with the following interfaces, respectively:
"MBIM" : AT + MBIM + DIAG + NMEA + MODEM
"RMNET" : AT + DIAG + NMEA + Modem + QMI
The detailed description of the USB configuration for each mode as follows:
MBIM Mode
--------------
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0312 Rev= 3.18 S: Manufacturer=Quectel S: Product=Quectel EM05-CN C:* #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA A: FirstIf#= 1 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I:* If#= 2 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
RMNET Mode
--------------
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0312 Rev= 3.18 S: Manufacturer=Quectel S: Product=Quectel EM05-CN C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/serial/option.c +3 -0
@@ -258,6 +258,7 @@ static void option_instat_callback(struc#define QUECTEL_PRODUCT_EM05G_CS 0x030c#define QUECTEL_PRODUCT_EM05CN_SG 0x0310#define QUECTEL_PRODUCT_EM05G_SG 0x0311 +#define QUECTEL_PRODUCT_EM05CN 0x0312#define QUECTEL_PRODUCT_EM05G_GR 0x0313#define QUECTEL_PRODUCT_EM05G_RS 0x0314#define QUECTEL_PRODUCT_EM12 0x0512
@@ -1164,6 +1165,8 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0xff, 0xff), .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06, 0xff, 0, 0) }, + { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05CN, 0xff), + .driver_info = RSVD(6) | ZLP }, { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05CN_SG, 0xff), .driver_info = RSVD(6) | ZLP }, { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G, 0xff),
Greg Kroah-Hartman
maintainerPATCH 64/193 staging: vchiq_arm: fix enum vchiq_status return types
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit 7d83299351fe7c812c529f5e39fe63b5312e4233 upstream.
gcc-13 notices a type mismatch between function declaration and definition for a few functions that have been converted from returning vchiq specific status values to regular error codes:
drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:662:5: error: conflicting types for 'vchiq_initialise' due to enum/integer mismatch; have 'int(struct vchiq_instance **)' [-Werror=enum-int-mismatch] drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1411:1: error: conflicting types for 'vchiq_use_internal' due to enum/integer mismatch; have 'int(struct vchiq_state *, struct vchiq_service *, enum USE_TYPE_E)' [-Werror=enum-int-mismatch] drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1468:1: error: conflicting types for 'vchiq_release_internal' due to enum/integer mismatch; have 'int(struct vchiq_state *, struct vchiq_service *)' [-Werror=enum-int-mismatch]
Change the declarations to match the actual function definition.
--- drivers/staging/vc04_services/include/linux/raspberrypi/vchiq.h | 2 +- drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.h | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/staging/vc04_services/include/linux/raspberrypi/vchiq.h +1 -1
@@ -86,7 +86,7 @@ struct vchiq_service_params_kernel {struct vchiq_instance ; -extern enum vchiq_status vchiq_initialise (struct vchiq_instance **pinstance); +extern int vchiq_initialise (struct vchiq_instance **pinstance);extern enum vchiq_status vchiq_shutdown (struct vchiq_instance *instance);extern enum vchiq_status vchiq_connect (struct vchiq_instance *instance); extern enum vchiq_status vchiq_open_service(struct vchiq_instance *instance,
drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.h +2 -2
@@ -100,10 +100,10 @@ vchiq_dump_platform_use_state(struct vchextern void vchiq_dump_service_use_state (struct vchiq_state *state); -extern enum vchiq_status +extern int vchiq_use_internal (struct vchiq_state *state,struct vchiq_service *service,enum USE_TYPE_E use_type); -extern enum vchiq_status +extern int vchiq_release_internal (struct vchiq_state *state,struct vchiq_service *service);
Greg Kroah-Hartman
maintainerPATCH 65/193 USB: misc: iowarrior: fix up header size for USB_DEVICE_ID_CODEMERCS_IOW100
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
commit 14ff7460bb58662d86aa50298943cc7d25532e28 upstream.
The USB_DEVICE_ID_CODEMERCS_IOW100 header size was incorrect, it should be 12, not 13.
--- drivers/usb/misc/iowarrior.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/misc/iowarrior.c +1 -1
@@ -814,7 +814,7 @@ static int iowarrior_probe(struct usb_inbreak ;case USB_DEVICE_ID_CODEMERCS_IOW100 : - dev->report_size =13 ; + dev->report_size =12 ;break ; } }
Greg Kroah-Hartman
maintainerPATCH 66/193 usb: misc: onboard_hub: Invert driver registration order
In reply to Greg Kroah-HartmanFrom: Matthias Kaehlcke <[email protected]>
commit e5854355d76b8d768cea8e4fc3ce6dfdba25518a upstream.
The onboard_hub 'driver' consists of two drivers, a platform driver and a USB driver. Currently when the onboard hub driver is initialized it first registers the platform driver, then the USB driver. This results in a race condition when the 'attach' work is executed, which is scheduled when the platform device is probed. The purpose of fhe 'attach' work is to bind elegible USB hub devices to the onboard_hub USB driver. This fails if the work runs before the USB driver has been registered.
Register the USB driver first, then the platform driver. This increases the chances that the onboard_hub USB devices are probed before their corresponding platform device, which the USB driver tries to locate in _probe(). The driver already handles this situation and defers probing if the onboard hub platform device doesn't exist yet.
--- drivers/usb/misc/onboard_usb_hub.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/misc/onboard_usb_hub.c +3 -3
@@ -431,13 +431,13 @@ static int __init onboard_hub_init(void) {int ret; - ret =platform_driver_register (&onboard_hub_driver); + ret =usb_register_device_driver (&onboard_hub_usbdev_driver,THIS_MODULE );if (ret)return ret; - ret =usb_register_device_driver (&onboard_hub_usbdev_driver,THIS_MODULE ); + ret =platform_driver_register (&onboard_hub_driver);if (ret) -platform_driver_unregister (&onboard_hub_driver); +usb_deregister_device_driver (&onboard_hub_usbdev_driver);return ret; }
Greg Kroah-Hartman
maintainerPATCH 67/193 usb: misc: onboard_hub: Move attach work to the driver
In reply to Greg Kroah-HartmanFrom: Matthias Kaehlcke <[email protected]>
commit cde37881e2e14590675d0acdfbad408300d9ca95 upstream.
Currently each onboard_hub platform device owns an 'attach' work, which is scheduled when the device probes. With this deadlocks have been reported on a Raspberry Pi 3 B+ [1], which has nested onboard hubs.
The flow of the deadlock is something like this (with the onboard_hub driver built as a module) [2]:
- USB root hub is instantiated
- core hub driver calls onboard_hub_create_pdevs(), which creates the 'raw' platform device for the 1st level hub
- 1st level hub is probed by the core hub driver
- core hub driver calls onboard_hub_create_pdevs(), which creates the 'raw' platform device for the 2nd level hub
- onboard_hub platform driver is registered
- platform device for 1st level hub is probed
- schedules 'attach' work
- platform device for 2nd level hub is probed
- schedules 'attach' work
- onboard_hub USB driver is registered
- device (and parent) lock of hub is held while the device is re-probed with the onboard_hub driver
- 'attach' work (running in another thread) calls driver_attach(), which blocks on one of the hub device locks
- onboard_hub_destroy_pdevs() is called by the core hub driver when one of the hubs is detached
- destroying the pdevs invokes onboard_hub_remove(), which waits for the 'attach' work to complete
- waits forever, since the 'attach' work can't acquire the device lock
Use a single work struct for the driver instead of having a work struct per onboard hub platform driver instance. With that it isn't necessary to cancel the work in onboard_hub_remove(), which fixes the deadlock. The work is only cancelled when the driver is unloaded.
[1] https://lore.kernel.org/r/[email protected]/
[2] https://lore.kernel.org/all/[email protected]/
--- drivers/usb/misc/onboard_usb_hub.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/usb/misc/onboard_usb_hub.c +6 -6
@@ -27,7 +27,10 @@#include "onboard_usb_hub.h" +static void onboard_hub_attach_usb_driver (struct work_struct *work); +static struct usb_device_driver onboard_hub_usbdev_driver; +static DECLARE_WORK(attach_usb_driver_work, onboard_hub_attach_usb_driver);/************************** Platform driver **************************/
@@ -45,7 +48,6 @@ struct onboard_hub {bool is_powered_on;bool going_away;struct list_head udev_list; -struct work_struct attach_usb_driver_work;struct mutex lock; };
@@ -271,8 +273,7 @@ static int onboard_hub_probe(struct plat* This needs to be done deferred to avoid self-deadlocks on systems * with nested onboard hubs. */ -INIT_WORK (&hub->attach_usb_driver_work, onboard_hub_attach_usb_driver); -schedule_work (&hub->attach_usb_driver_work); +schedule_work (&attach_usb_driver_work);return 0 ; }
@@ -285,9 +286,6 @@ static int onboard_hub_remove(struct pla hub->going_away = true; -if (&hub->attach_usb_driver_work !=current_work ()) -cancel_work_sync (&hub->attach_usb_driver_work); -mutex_lock (&hub->lock);/* unbind the USB devices to avoid dangling references to this device */
@@ -447,6 +445,8 @@ static void __exit onboard_hub_exit(void {usb_deregister_device_driver (&onboard_hub_usbdev_driver);platform_driver_unregister (&onboard_hub_driver); + +cancel_work_sync (&attach_usb_driver_work); }module_exit (onboard_hub_exit);
Greg Kroah-Hartman
maintainerPATCH 68/193 misc: fastrpc: Fix use-after-free and race in fastrpc_map_find
In reply to Greg Kroah-HartmanFrom: Abel Vesa <[email protected]>
commit 9446fa1683a7e3937d9970248ced427c1983a1c5 upstream.
Currently, there is a race window between the point when the mutex is unlocked in fastrpc_map_lookup and the reference count increasing (fastrpc_map_get) in fastrpc_map_find, which can also lead to use-after-free.
So lets merge fastrpc_map_find into fastrpc_map_lookup which allows us to both protect the maps list by also taking the &fl->lock spinlock and the reference count, since the spinlock will be released only after. Add take_ref argument to make this suitable for all callers.
--- drivers/misc/fastrpc.c | 41 +++++++++++++++++++++-------------------- 1 file changed, 21 insertions(+), 20 deletions(-)
drivers/misc/fastrpc.c +21 -20
@@ -333,30 +333,31 @@ static void fastrpc_map_get(struct fastrstatic int fastrpc_map_lookup (struct fastrpc_user *fl,int fd, -struct fastrpc_map **ppmap) +struct fastrpc_map **ppmap,bool take_ref) { +struct fastrpc_session_ctx *sess = fl->sctx;struct fastrpc_map *map =NULL ; +int ret = -ENOENT ; -mutex_lock (&fl->mutex); +spin_lock (&fl->lock);list_for_each_entry (map, &fl->maps, node) { -if (map->fd == fd) { - *ppmap = map; -mutex_unlock (&fl->mutex); -return 0 ; - } - } -mutex_unlock (&fl->mutex); - -return -ENOENT ; -} +if (map->fd != fd) +continue ; -static int fastrpc_map_find (struct fastrpc_user *fl,int fd, -struct fastrpc_map **ppmap) -{ -int ret =fastrpc_map_lookup (fl, fd, ppmap); +if (take_ref) { + ret =fastrpc_map_get (map); +if (ret) { +dev_dbg (sess->dev,"%s: Failed to get map fd=%d ret=%d\n" , + __func__, fd, ret); +break ; + } + } -if (!ret) -fastrpc_map_get (*ppmap); + *ppmap = map; + ret =0 ; +break ; + } +spin_unlock (&fl->lock);return ret; }
@@ -703,7 +704,7 @@ static int fastrpc_map_create(struct fasstruct fastrpc_map *map =NULL ;int err =0 ; -if (!fastrpc_map_find (fl, fd, ppmap)) +if (!fastrpc_map_lookup (fl, fd, ppmap, true))return 0 ; map =kzalloc (sizeof (*map),GFP_KERNEL );
@@ -1026,7 +1027,7 @@ static int fastrpc_put_args(struct fastrfor (i =0 ; i <FASTRPC_MAX_FDLIST ; i++) {if (!fdlist[i])break ; -if (!fastrpc_map_lookup (fl, (int )fdlist[i], &mmap)) +if (!fastrpc_map_lookup (fl, (int )fdlist[i], &mmap, false))fastrpc_map_put (mmap); }
Greg Kroah-Hartman
maintainerPATCH 69/193 misc: fastrpc: Dont remove map on creater_process and device_release
In reply to Greg Kroah-HartmanFrom: Abel Vesa <[email protected]>
commit 5bb96c8f9268e2fdb0e5321cbc358ee5941efc15 upstream.
Do not remove the map from the list on error path in fastrpc_init_create_process, instead call fastrpc_map_put, to avoid use-after-free. Do not remove it on fastrpc_device_release either, call fastrpc_map_put instead.
The fastrpc_free_map is the only proper place to remove the map. This is called only after the reference count is 0.
--- drivers/misc/fastrpc.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/misc/fastrpc.c +9 -9
@@ -316,6 +316,13 @@ static void fastrpc_free_map(struct krefdma_buf_put (map->buf); } +if (map->fl) { +spin_lock (&map->fl->lock); +list_del (&map->node); +spin_unlock (&map->fl->lock); + map->fl =NULL ; + } +kfree (map); }
@@ -1266,12 +1273,7 @@ err_invoke: fl->init_mem =NULL ;fastrpc_buf_free (imem); err_alloc: -if (map) { -spin_lock (&fl->lock); -list_del (&map->node); -spin_unlock (&fl->lock); -fastrpc_map_put (map); - } +fastrpc_map_put (map); err:kfree (args);
@@ -1347,10 +1349,8 @@ static int fastrpc_device_release(structfastrpc_context_put (ctx); } -list_for_each_entry_safe (map, m, &fl->maps, node) { -list_del (&map->node); +list_for_each_entry_safe (map, m, &fl->maps, node)fastrpc_map_put (map); - }list_for_each_entry_safe (buf, b, &fl->mmaps, node) {list_del (&buf->node);
Greg Kroah-Hartman
maintainerPATCH 70/193 misc: fastrpc: Fix use-after-free race condition for maps
In reply to Greg Kroah-HartmanFrom: Ola Jeppsson <[email protected]>
commit 96b328d119eca7563c1edcc4e1039a62e6370ecb upstream.
It is possible that in between calling fastrpc_map_get() until map->fl->lock is taken in fastrpc_free_map(), another thread can call fastrpc_map_lookup() and get a reference to a map that is about to be deleted.
Rewrite fastrpc_map_get() to only increase the reference count of a map if it's non-zero. Propagate this to callers so they can know if a map is about to be deleted.
Fixes this warning:refcount_t: addition on 0; use-after-free.
WARNING: CPU: 5 PID: 10100 at lib/refcount.c:25 refcount_warn_saturate ... Call trace: refcount_warn_saturate [fastrpc_map_get inlined] [fastrpc_map_lookup inlined] fastrpc_map_create fastrpc_internal_invoke fastrpc_device_ioctl __arm64_sys_ioctl invoke_syscall
--- drivers/misc/fastrpc.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/misc/fastrpc.c +5 -3
@@ -332,10 +332,12 @@ static void fastrpc_map_put(struct fastrkref_put (&map->refcount, fastrpc_free_map); } -static void fastrpc_map_get (struct fastrpc_map *map) +static int fastrpc_map_get (struct fastrpc_map *map) { -if (map) -kref_get (&map->refcount); +if (!map) +return -ENOENT ; + +return kref_get_unless_zero (&map->refcount) ?0 : -ENOENT ; }
Greg Kroah-Hartman
maintainerPATCH 71/193 usb: core: hub: disable autosuspend for TI TUSB8041
In reply to Greg Kroah-HartmanFrom: Flavio Suligoi <[email protected]>
commit 7171b0e261b17de96490adf053b8bb4b00061bcf upstream.
The Texas Instruments TUSB8041 has an autosuspend problem at high temperature.
If there is not USB traffic, after a couple of ms, the device enters in autosuspend mode. In this condition the external clock stops working, to save energy. When the USB activity turns on, ther hub exits the autosuspend state, the clock starts running again and all works fine.
At ambient temperature all works correctly, but at high temperature, when the USB activity turns on, the external clock doesn't restart and the hub disappears from the USB bus.
Disabling the autosuspend mode for this hub solves the issue.
--- drivers/usb/core/hub.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/usb/core/hub.c +13 -0
@@ -44,6 +44,9 @@#define USB_PRODUCT_USB5534B 0x5534#define USB_VENDOR_CYPRESS 0x04b4#define USB_PRODUCT_CY7C65632 0x6570 +#define USB_VENDOR_TEXAS_INSTRUMENTS 0x0451 +#define USB_PRODUCT_TUSB8041_USB3 0x8140 +#define USB_PRODUCT_TUSB8041_USB2 0x8142#define HUB_QUIRK_CHECK_PORT_AUTOSUSPEND 0x01#define HUB_QUIRK_DISABLE_AUTOSUSPEND 0x02
@@ -5798,6 +5801,16 @@ static const struct usb_device_id hub_id .idVendor = USB_VENDOR_GENESYS_LOGIC, .bInterfaceClass = USB_CLASS_HUB, .driver_info = HUB_QUIRK_CHECK_PORT_AUTOSUSPEND}, + { .match_flags = USB_DEVICE_ID_MATCH_VENDOR + | USB_DEVICE_ID_MATCH_PRODUCT, + .idVendor = USB_VENDOR_TEXAS_INSTRUMENTS, + .idProduct = USB_PRODUCT_TUSB8041_USB2, + .driver_info = HUB_QUIRK_DISABLE_AUTOSUSPEND}, + { .match_flags = USB_DEVICE_ID_MATCH_VENDOR + | USB_DEVICE_ID_MATCH_PRODUCT, + .idVendor = USB_VENDOR_TEXAS_INSTRUMENTS, + .idProduct = USB_PRODUCT_TUSB8041_USB3, + .driver_info = HUB_QUIRK_DISABLE_AUTOSUSPEND}, { .match_flags = USB_DEVICE_ID_MATCH_DEV_CLASS, .bDeviceClass = USB_CLASS_HUB}, { .match_flags = USB_DEVICE_ID_MATCH_INT_CLASS,
Greg Kroah-Hartman
maintainerPATCH 72/193 comedi: adv_pci1760: Fix PWM instruction handling
In reply to Greg Kroah-HartmanFrom: Ian Abbott <[email protected]>
commit 2efb6edd52dc50273f5e68ad863dd1b1fb2f2d1c upstream.
(Actually, this is fixing the "Read the Current Status" command sent to the device's outgoing mailbox, but it is only currently used for the PWM instructions.)
The PCI-1760 is operated mostly by sending commands to a set of Outgoing Mailbox registers, waiting for the command to complete, and reading the result from the Incoming Mailbox registers. One of these commands is the "Read the Current Status" command. The number of this command is 0x07 (see the User's Manual for the PCI-1760 at
<https://advdownload.advantech.com/productfile/Downloadfile2/1-11P6653/PCI-1760.pdf>.
The PCI1760_CMD_GET_STATUS macro defined in the driver should expand to this command number 0x07, but unfortunately it currently expands to 0x03. (Command number 0x03 is not defined in the User's Manual.) Correct the definition of the PCI1760_CMD_GET_STATUS macro to fix it.
This is used by all the PWM subdevice related instructions handled by pci1760_pwm_insn_config() which are probably all broken. The effect of sending the undefined command number 0x03 is not known.
--- drivers/comedi/drivers/adv_pci1760.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/comedi/drivers/adv_pci1760.c +1 -1
@@ -58,7 +58,7 @@#define PCI1760_CMD_CLR_IMB2 0x00/* Clears IMB2 */ #define PCI1760_CMD_SET_DO 0x01/* Set output state */ #define PCI1760_CMD_GET_DO 0x02/* Read output status */ -#define PCI1760_CMD_GET_STATUS 0x03/* Read current status */ +#define PCI1760_CMD_GET_STATUS 0x07/* Read current status */ #define PCI1760_CMD_GET_FW_VER 0x0e/* Read firmware version */ #define PCI1760_CMD_GET_HW_VER 0x0f/* Read hardware version */ #define PCI1760_CMD_SET_PWM_HI (x) (0x10 + (x) * 2)/* Set "hi" period */
Greg Kroah-Hartman
maintainerPATCH 73/193 ACPI: PRM: Check whether EFI runtime is available
In reply to Greg Kroah-HartmanFrom: Ard Biesheuvel <[email protected]>
commit 182da6f2b81a78709c58021542fb694f8ed80774 upstream.
The ACPI PRM address space handler calls efi_call_virt_pointer() to execute PRM firmware code, but doing so is only permitted when the EFI runtime environment is available. Otherwise, such calls are guaranteed to result in a crash, and must therefore be avoided.
Given that the EFI runtime services may become unavailable after a crash occurring in the firmware, we need to check this each time the PRM address space handler is invoked. If the EFI runtime services were not available at registration time to being with, don't install the address space handler at all.
--- drivers/acpi/prmt.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/acpi/prmt.c +10 -0
@@ -236,6 +236,11 @@ static acpi_status acpi_platformrt_spaceefi_status_t status;struct prm_context_buffer context; +if (!efi_enabled (EFI_RUNTIME_SERVICES )) { +pr_err_ratelimited ("PRM: EFI runtime services no longer available\n" ); +return AE_NO_HANDLER ; + } +/* * The returned acpi_status will always be AE_OK. Error values will be * saved in the first byte of the PRM message buffer to be used by ASL.
@@ -325,6 +330,11 @@ void __init init_prmt(void)pr_info ("PRM: found %u modules\n" , mc); +if (!efi_enabled (EFI_RUNTIME_SERVICES )) { +pr_err ("PRM: EFI runtime services unavailable\n" ); +return ; + } + status = acpi_install_address_space_handler(ACPI_ROOT_OBJECT, ACPI_ADR_SPACE_PLATFORM_RT, &acpi_platformrt_space_handler,
Greg Kroah-Hartman
maintainerPATCH 74/193 mmc: sunxi-mmc: Fix clock refcount imbalance during unbind
In reply to Greg Kroah-HartmanFrom: Samuel Holland <[email protected]>
commit 8509419758f2cc28dd05370385af0d91573b76b4 upstream.
If the controller is suspended by runtime PM, the clock is already disabled, so do not try to disable it again during removal. Use pm_runtime_disable() to flush any pending runtime PM transitions.
--- drivers/mmc/host/sunxi-mmc.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/mmc/host/sunxi-mmc.c +5 -3
@@ -1492,9 +1492,11 @@ static int sunxi_mmc_remove(struct platfstruct sunxi_mmc_host *host =mmc_priv (mmc);mmc_remove_host (mmc); -pm_runtime_force_suspend (&pdev->dev); -disable_irq (host->irq); -sunxi_mmc_disable (host); +pm_runtime_disable (&pdev->dev); +if (!pm_runtime_status_suspended (&pdev->dev)) { +disable_irq (host->irq); +sunxi_mmc_disable (host); + }dma_free_coherent (&pdev->dev,PAGE_SIZE , host->sg_cpu, host->sg_dma);mmc_free_host (mmc);
Greg Kroah-Hartman
maintainerPATCH 75/193 mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting
In reply to Greg Kroah-HartmanFrom: Haibo Chen <[email protected]>
commit 1e336aa0c0250ec84c6f16efac40c9f0138e367d upstream.
Current code logic may be impacted by the setting of ROM/Bootloader, so unmask these bits first, then setting these bits accordingly.
--- drivers/mmc/host/sdhci-esdhc-imx.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-)
drivers/mmc/host/sdhci-esdhc-imx.c +15 -7
@@ -107,6 +107,7 @@#define ESDHC_TUNING_START_TAP_DEFAULT 0x1#define ESDHC_TUNING_START_TAP_MASK 0x7f#define ESDHC_TUNING_CMD_CRC_CHECK_DISABLE (1 << 7) +#define ESDHC_TUNING_STEP_DEFAULT 0x1#define ESDHC_TUNING_STEP_MASK 0x00070000#define ESDHC_TUNING_STEP_SHIFT 16
@@ -1361,7 +1362,7 @@ static void sdhci_esdhc_imx_hwinit(strucstruct sdhci_pltfm_host *pltfm_host =sdhci_priv (host);struct pltfm_imx_data *imx_data =sdhci_pltfm_priv (pltfm_host);struct cqhci_host *cq_host = host->mmc->cqe_private; -int tmp; +u32 tmp;if (esdhc_is_usdhc (imx_data)) {/*
@@ -1416,17 +1417,24 @@ static void sdhci_esdhc_imx_hwinit(strucif (imx_data->socdata->flags &ESDHC_FLAG_STD_TUNING ) { tmp =readl (host->ioaddr +ESDHC_TUNING_CTRL ); - tmp |=ESDHC_STD_TUNING_EN | -ESDHC_TUNING_START_TAP_DEFAULT ; -if (imx_data->boarddata.tuning_start_tap) { - tmp &= ~ESDHC_TUNING_START_TAP_MASK ; + tmp |=ESDHC_STD_TUNING_EN ; + +/* +* ROM code or bootloader may config the start tap +* and step, unmask them first. +*/ + tmp &= ~(ESDHC_TUNING_START_TAP_MASK |ESDHC_TUNING_STEP_MASK ); +if (imx_data->boarddata.tuning_start_tap) tmp |= imx_data->boarddata.tuning_start_tap; - } +else + tmp |=ESDHC_TUNING_START_TAP_DEFAULT ;if (imx_data->boarddata.tuning_step) { - tmp &= ~ESDHC_TUNING_STEP_MASK ; tmp |= imx_data->boarddata.tuning_step <<ESDHC_TUNING_STEP_SHIFT ; + }else { + tmp |=ESDHC_TUNING_STEP_DEFAULT + <<ESDHC_TUNING_STEP_SHIFT ; }/* Disable the CMD CRC check for tuning, if not, need to
Greg Kroah-Hartman
maintainerPATCH 76/193 mm/hugetlb: fix PTE marker handling in hugetlb_change_protection()
In reply to Greg Kroah-HartmanFrom: David Hildenbrand <[email protected]>
commit 0e678153f5be7e6c8d28835f5a678618da4b7a9c upstream.
Patch series "mm/hugetlb: uffd-wp fixes for hugetlb_change_protection()".
Playing with virtio-mem and background snapshots (using uffd-wp) on hugetlb in QEMU, I managed to trigger a VM_BUG_ON(). Looking into the details, hugetlb_change_protection() seems to not handle uffd-wp correctly in all cases.
Patch #1 fixes my test case. I don't have reproducers for patch #2, as it requires running into migration entries.
I did not yet check in detail yet if !hugetlb code requires similar care.
This patch (of 2):
There are two problematic cases when stumbling over a PTE marker in hugetlb_change_protection():
(1) We protect an uffd-wp PTE marker a second time using uffd-wp: we will end up in the "!huge_pte_none(pte)" case and mess up the PTE marker.
(2) We unprotect a uffd-wp PTE marker: we will similarly end up in the "!huge_pte_none(pte)" case even though we cleared the PTE, because the "pte" variable is stale. We'll mess up the PTE marker.
For example, if we later stumble over such a "wrongly modified" PTE marker, we'll treat it like a present PTE that maps some garbage page.
This can, for example, be triggered by mapping a memfd backed by huge pages, registering uffd-wp, uffd-wp'ing an unmapped page and (a) uffd-wp'ing it a second time; or (b) uffd-unprotecting it; or (c) unregistering uffd-wp. Then, ff we trigger fallocate(FALLOC_FL_PUNCH_HOLE) on that file range, we will run into a VM_BUG_ON:
[ 195.039560] page:00000000ba1f2987 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x0 [ 195.039565] flags: 0x7ffffc0001000(reserved|node=0|zone=0|lastcpupid=0x1fffff) [ 195.039568] raw: 0007ffffc0001000 ffffe742c0000008 ffffe742c0000008 0000000000000000 [ 195.039569] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 195.039569] page dumped because: VM_BUG_ON_PAGE(compound && !PageHead(page)) [ 195.039573] ------------[ cut here ]------------ [ 195.039574] kernel BUG at mm/rmap.c:1346! [ 195.039579] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 195.039581] CPU: 7 PID: 4777 Comm: qemu-system-x86 Not tainted 6.0.12-200.fc36.x86_64 #1 [ 195.039583] Hardware name: LENOVO 20WNS1F81N/20WNS1F81N, BIOS N35ET50W (1.50 ) 09/15/2022 [ 195.039584] RIP: 0010:page_remove_rmap+0x45b/0x550 [ 195.039588] Code: [...] [ 195.039589] RSP: 0018:ffffbc03c3633ba8 EFLAGS: 00010292 [ 195.039591] RAX: 0000000000000040 RBX: ffffe742c0000000 RCX: 0000000000000000 [ 195.039592] RDX: 0000000000000002 RSI: ffffffff8e7aac1a RDI: 00000000ffffffff [ 195.039592] RBP: 0000000000000001 R08: 0000000000000000 R09: ffffbc03c3633a08 [ 195.039593] R10: 0000000000000003 R11: ffffffff8f146328 R12: ffff9b04c42754b0 [ 195.039594] R13: ffffffff8fcc6328 R14: ffffbc03c3633c80 R15: ffff9b0484ab9100 [ 195.039595] FS: 00007fc7aaf68640(0000) GS:ffff9b0bbf7c0000(0000) knlGS:0000000000000000 [ 195.039596] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 195.039597] CR2: 000055d402c49110 CR3: 0000000159392003 CR4: 0000000000772ee0 [ 195.039598] PKRU: 55555554 [ 195.039599] Call Trace: [ 195.039600] <TASK> [ 195.039602] __unmap_hugepage_range+0x33b/0x7d0 [ 195.039605] unmap_hugepage_range+0x55/0x70 [ 195.039608] hugetlb_vmdelete_list+0x77/0xa0 [ 195.039611] hugetlbfs_fallocate+0x410/0x550 [ 195.039612] ? _raw_spin_unlock_irqrestore+0x23/0x40 [ 195.039616] vfs_fallocate+0x12e/0x360 [ 195.039618] __x64_sys_fallocate+0x40/0x70 [ 195.039620] do_syscall_64+0x58/0x80 [ 195.039623] ? syscall_exit_to_user_mode+0x17/0x40 [ 195.039624] ? do_syscall_64+0x67/0x80 [ 195.039626] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 195.039628] RIP: 0033:0x7fc7b590651f [ 195.039653] Code: [...] [ 195.039654] RSP: 002b:00007fc7aaf66e70 EFLAGS: 00000293 ORIG_RAX: 000000000000011d [ 195.039655] RAX: ffffffffffffffda RBX: 0000558ef4b7f370 RCX: 00007fc7b590651f [ 195.039656] RDX: 0000000018000000 RSI: 0000000000000003 RDI: 000000000000000c [ 195.039657] RBP: 0000000008000000 R08: 0000000000000000 R09: 0000000000000073 [ 195.039658] R10: 0000000008000000 R11: 0000000000000293 R12: 0000000018000000 [ 195.039658] R13: 00007fb8bbe00000 R14: 000000000000000c R15: 0000000000001000 [ 195.039661] </TASK>
Fix it by not going into the "!huge_pte_none(pte)" case if we stumble over an exclusive marker. spin_unlock() + continue would get the job done.
However, instead, make it clearer that there are no fall-through
statements: we process each case (hwpoison, migration, marker, !none, none) and then unlock the page table to continue with the next PTE. Let's avoid "continue" statements and use a single spin_unlock() at the end.
--- mm/hugetlb.c | 21 +++++++-------------- 1 file changed, 7 insertions(+), 14 deletions(-)
mm/hugetlb.c +7 -14
@@ -6623,10 +6623,8 @@ unsigned long hugetlb_change_protection( } pte =huge_ptep_get (ptep);if (unlikely (is_hugetlb_entry_hwpoisoned (pte))) { -spin_unlock (ptl); -continue ; - } -if (unlikely (is_hugetlb_entry_migration (pte))) { +/* Nothing to do. */ + }else if (unlikely (is_hugetlb_entry_migration (pte))) {swp_entry_t entry =pte_to_swp_entry (pte);struct page *page =pfn_swap_entry_to_page (entry);
@@ -6647,18 +6645,13 @@ unsigned long hugetlb_change_protection(set_huge_pte_at (mm, address, ptep, newpte); pages++; } -spin_unlock (ptl); -continue ; - } -if (unlikely (pte_marker_uffd_wp (pte))) { -/* -* This is changing a non-present pte into a none pte, -* no need for huge_ptep_modify_prot_start/commit(). -*/ + }else if (unlikely (is_pte_marker (pte))) { +/* No other markers apply for now. */ +WARN_ON_ONCE (!pte_marker_uffd_wp (pte));if (uffd_wp_resolve) +/* Safe to modify directly (non-present->none). */ huge_pte_clear (mm, address, ptep, psize); - } -if (!huge_pte_none (pte)) { + }else if (!huge_pte_none (pte)) {pte_t old_pte;unsigned int shift =huge_page_shift (hstate_vma (vma));
Greg Kroah-Hartman
maintainerPATCH 77/193 mm/hugetlb: fix uffd-wp handling for migration entries in hugetlb_change_protection()
In reply to Greg Kroah-HartmanFrom: David Hildenbrand <[email protected]>
commit 44f86392bdd165da7e43d3c772aeb1e128ffd6c8 upstream.
We have to update the uffd-wp SWP PTE bit independent of the type of migration entry. Currently, if we're unlucky and we want to install/clear the uffd-wp bit just while we're migrating a read-only mapped hugetlb page, we would miss to set/clear the uffd-wp bit.
Further, if we're processing a readable-exclusive migration entry and neither want to set or clear the uffd-wp bit, we could currently end up losing the uffd-wp bit. Note that the same would hold for writable migrating entries, however, having a writable migration entry with the uffd-wp bit set would already mean that something went wrong.
Note that the change from !is_readable_migration_entry -> writable_migration_entry is harmless and actually cleaner, as raised by Miaohe Lin and discussed in [1].
[1] https://lkml.kernel.org/r/[email protected]
--- mm/hugetlb.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
mm/hugetlb.c +9 -8
@@ -6627,10 +6627,9 @@ unsigned long hugetlb_change_protection( }else if (unlikely (is_hugetlb_entry_migration (pte))) {swp_entry_t entry =pte_to_swp_entry (pte);struct page *page =pfn_swap_entry_to_page (entry); +pte_t newpte = pte; -if (!is_readable_migration_entry (entry)) { -pte_t newpte; - +if (is_writable_migration_entry (entry)) {if (PageAnon (page)) entry =make_readable_exclusive_migration_entry (swp_offset (entry));
@@ -6638,13 +6637,15 @@ unsigned long hugetlb_change_protection( entry =make_readable_migration_entry (swp_offset (entry)); newpte =swp_entry_to_pte (entry); -if (uffd_wp) - newpte =pte_swp_mkuffd_wp (newpte); -else if (uffd_wp_resolve) - newpte =pte_swp_clear_uffd_wp (newpte); -set_huge_pte_at (mm, address, ptep, newpte); pages++; } + +if (uffd_wp) + newpte =pte_swp_mkuffd_wp (newpte); +else if (uffd_wp_resolve) + newpte =pte_swp_clear_uffd_wp (newpte); +if (!pte_same (pte, newpte)) +set_huge_pte_at (mm, address, ptep, newpte); }else if (unlikely (is_pte_marker (pte))) {/* No other markers apply for now. */ WARN_ON_ONCE (!pte_marker_uffd_wp (pte));
Greg Kroah-Hartman
maintainerPATCH 78/193 mm/hugetlb: pre-allocate pgtable pages for uffd wr-protects
In reply to Greg Kroah-HartmanFrom: Peter Xu <[email protected]>
commit fed15f1345dc8a7fc8baa81e8b55c3ba010d7f4b upstream.
Userfaultfd-wp uses pte markers to mark wr-protected pages for both shmem and hugetlb. Shmem has pre-allocation ready for markers, but hugetlb path was overlooked.
Doing so by calling huge_pte_alloc() if the initial pgtable walk fails to find the huge ptep. It's possible that huge_pte_alloc() can fail with high memory pressure, in that case stop the loop immediately and fail silently. This is not the most ideal solution but it matches with what we do with shmem meanwhile it avoids the splat in dmesg.
--- mm/hugetlb.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
mm/hugetlb.c +11 -2
@@ -6604,8 +6604,17 @@ unsigned long hugetlb_change_protection(spinlock_t *ptl; ptep =huge_pte_offset (mm, address, psize);if (!ptep) { - address |= last_addr_mask; -continue ; +if (!uffd_wp) { + address |= last_addr_mask; +continue ; + } +/* +* Userfaultfd wr-protect requires pgtable +* pre-allocations to install pte markers. +*/ + ptep =huge_pte_alloc (mm, vma, address, psize); +if (!ptep) +break ; } ptl =huge_pte_lock (h, mm, ptep);if (huge_pmd_unshare (mm, vma, address, ptep)) {
Greg Kroah-Hartman
maintainerPATCH 79/193 mm/userfaultfd: enable writenotify while userfaultfd-wp is enabled for a VMA
In reply to Greg Kroah-HartmanFrom: David Hildenbrand <[email protected]>
commit 51d3d5eb74ff53b92dcff48b30ae2ed8edd85a32 upstream.
Currently, we don't enable writenotify when enabling userfaultfd-wp on a shared writable mapping (for now only shmem and hugetlb). The consequence is that vma->vm_page_prot will still include write permissions, to be set as default for all PTEs that get remapped (e.g., mprotect(), NUMA hinting, page migration, ...).
So far, vma->vm_page_prot is assumed to be a safe default, meaning that we only add permissions (e.g., mkwrite) but not remove permissions (e.g., wrprotect). For example, when enabling softdirty tracking, we enable writenotify. With uffd-wp on shared mappings, that changed. More details on vma->vm_page_prot semantics were summarized in [1].
This is problematic for uffd-wp: we'd have to manually check for a uffd-wp PTEs/PMDs and manually write-protect PTEs/PMDs, which is error prone. Prone to such issues is any code that uses vma->vm_page_prot to set PTE
permissions: primarily pte_modify() and mk_pte().
Instead, let's enable writenotify such that PTEs/PMDs/... will be mapped write-protected as default and we will only allow selected PTEs that are definitely safe to be mapped without write-protection (see can_change_pte_writable()) to be writable. In the future, we might want to enable write-bit recovery -- e.g., can_change_pte_writable() -- at more locations, for example, also when removing uffd-wp protection.
This fixes two known cases:
(a) remove_migration_pte() mapping uffd-wp'ed PTEs writable, resulting in uffd-wp not triggering on write access.
(b) do_numa_page() / do_huge_pmd_numa_page() mapping uffd-wp'ed PTEs/PMDs writable, resulting in uffd-wp not triggering on write access.
Note that do_numa_page() / do_huge_pmd_numa_page() can be reached even without NUMA hinting (which currently doesn't seem to be applicable to shmem), for example, by using uffd-wp with a PROT_WRITE shmem VMA. On such a VMA, userfaultfd-wp is currently non-functional.
Note that when enabling userfaultfd-wp, there is no need to walk page tables to enforce the new default protection for the PTEs: we know that they cannot be uffd-wp'ed yet, because that can only happen after enabling uffd-wp for the VMA in general.
Also note that this makes mprotect() on ranges with uffd-wp'ed PTEs not accidentally set the write bit -- which would result in uffd-wp not triggering on later write access. This commit makes uffd-wp on shmem behave just like uffd-wp on anonymous memory in that regard, even though, mixing mprotect with uffd-wp is controversial.
[1] https://lkml.kernel.org/r/[email protected]
--- fs/userfaultfd.c | 28 ++++++++++++++++++++++------ mm/mmap.c | 4 ++++ 2 files changed, 26 insertions(+), 6 deletions(-)
fs/userfaultfd.c +22 -6
@@ -108,6 +108,21 @@ static bool userfaultfd_is_initialized(sreturn ctx->features &UFFD_FEATURE_INITIALIZED ; } +static void userfaultfd_set_vm_flags (struct vm_area_struct *vma, +vm_flags_t flags) +{ +const bool uffd_wp_changed = (vma->vm_flags ^ flags) &VM_UFFD_WP ; + + vma->vm_flags = flags; +/* +* For shared mappings, we want to enable writenotify while +* userfaultfd-wp is enabled (see vma_wants_writenotify()). We'll simply +* recalculate vma->vm_page_prot whenever userfaultfd-wp changes. +*/ +if ((vma->vm_flags &VM_SHARED ) && uffd_wp_changed) +vma_set_page_prot (vma); +} +static int userfaultfd_wake_function (wait_queue_entry_t *wq,unsigned mode,int wake_flags,void *key) {
@@ -618,7 +633,8 @@ static void userfaultfd_event_wait_complfor_each_vma (vmi, vma) {if (vma->vm_userfaultfd_ctx.ctx == release_new_ctx) { vma->vm_userfaultfd_ctx =NULL_VM_UFFD_CTX ; - vma->vm_flags &= ~__VM_UFFD_FLAGS; +userfaultfd_set_vm_flags (vma, + vma->vm_flags & ~__VM_UFFD_FLAGS); } }mmap_write_unlock (mm);
@@ -652,7 +668,7 @@ int dup_userfaultfd(struct vm_area_struc octx = vma->vm_userfaultfd_ctx.ctx;if (!octx || !(octx->features &UFFD_FEATURE_EVENT_FORK )) { vma->vm_userfaultfd_ctx =NULL_VM_UFFD_CTX ; - vma->vm_flags &= ~__VM_UFFD_FLAGS; +userfaultfd_set_vm_flags (vma, vma->vm_flags & ~__VM_UFFD_FLAGS);return 0 ; }
@@ -733,7 +749,7 @@ void mremap_userfaultfd_prep(struct vm_a }else {/* Drop uffd context if remap feature not enabled */ vma->vm_userfaultfd_ctx =NULL_VM_UFFD_CTX ; - vma->vm_flags &= ~__VM_UFFD_FLAGS; +userfaultfd_set_vm_flags (vma, vma->vm_flags & ~__VM_UFFD_FLAGS); } }
@@ -895,7 +911,7 @@ static int userfaultfd_release(struct in prev = vma; } - vma->vm_flags = new_flags; +userfaultfd_set_vm_flags (vma, new_flags); vma->vm_userfaultfd_ctx =NULL_VM_UFFD_CTX ; }mmap_write_unlock (mm);
@@ -1463,7 +1479,7 @@ static int userfaultfd_register(struct u* the next vma was merged into the current one and * the current one has not been updated yet. */ - vma->vm_flags = new_flags; +userfaultfd_set_vm_flags (vma, new_flags); vma->vm_userfaultfd_ctx.ctx = ctx;if (is_vm_hugetlb_page (vma) &&uffd_disable_huge_pmd_share (vma))
@@ -1651,7 +1667,7 @@ static int userfaultfd_unregister(struct* the next vma was merged into the current one and * the current one has not been updated yet. */ - vma->vm_flags = new_flags; +userfaultfd_set_vm_flags (vma, new_flags); vma->vm_userfaultfd_ctx =NULL_VM_UFFD_CTX ; skip:
mm/mmap.c +4 -0
@@ -1524,6 +1524,10 @@ int vma_wants_writenotify(struct vm_areaif (vma_soft_dirty_enabled (vma) && !is_vm_hugetlb_page (vma))return 1 ; +/* Do we need write faults for uffd-wp tracking? */ +if (userfaultfd_wp (vma)) +return 1 ; +/* Specialty mapping? */ if (vm_flags &VM_PFNMAP )return 0 ;
Greg Kroah-Hartman
maintainerPATCH 80/193 mm/MADV_COLLAPSE: dont expand collapse when vm_end is past requested end
In reply to Greg Kroah-HartmanFrom: Zach O'Keefe <[email protected]>
commit 52dc031088f00e323140ece4004e70c33153c6dd upstream.
MADV_COLLAPSE acts on one hugepage-aligned/sized region at a time, until it has collapsed all eligible memory contained within the bounds supplied by the user.
At the top of each hugepage iteration we (re)lock mmap_lock and (re)validate the VMA for eligibility and update variables that might have changed while mmap_lock was dropped. One thing that might occur is that the VMA could be resized, and as such, we refetch vma->vm_end to make sure we don't collapse past the end of the VMA's new end.
However, it's possible that when refetching vma->vm_end that we expand the region acted on by MADV_COLLAPSE if vma->vm_end is greater than size+len supplied by the user.
The consequence here is that we may attempt to collapse more memory than requested, possibly yielding either "too much success" or "false failure" user-visible results. An example of the former is if we MADV_COLLAPSE the first 4MiB of a 2TiB mmap()'d file, the incorrect refetch would cause the operation to block for much longer than anticipated as we attempt to collapse the entire TiB region. An example of the latter is that applying MADV_COLLPSE to a 4MiB file mapped to the start of a 6MiB VMA will successfully collapse the first 4MiB, then incorrectly attempt to collapse the last hugepage-aligned/sized region -- fail (since readahead/page cache lookup will fail) -- and report a failure to the user.
I don't believe there is a kernel stability concern here as we always (re)validate the VMA / region accordingly. Also as Hugh mentions, the user-visible effects are: we try to collapse more memory than requested by the user, and/or failing an operation that should have otherwise succeeded. An example is trying to collapse a 4MiB file contained within a 12MiB VMA.
Don't expand the acted-on region when refetching vma->vm_end.
--- mm/khugepaged.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/khugepaged.c +1 -1
@@ -2644,7 +2644,7 @@ int madvise_collapse(struct vm_area_stru goto out_nolock; } - hend = vma->vm_end &HPAGE_PMD_MASK ; + hend =min (hend, vma->vm_end &HPAGE_PMD_MASK ); }mmap_assert_locked (mm);memset (cc->node_load,0 ,sizeof (cc->node_load));
Greg Kroah-Hartman
maintainerPATCH 81/193 btrfs: add extra error messages to cover non-ENOMEM errors from device_add_list()
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
commit ed02363fbbed52a3f5ea0d188edd09045a806eb5 upstream.
[BUG]
When test case btrfs/219 (aka, mount a registered device but with a lower generation) failed, there is not any useful information for the end user to find out what's going wrong.
The mount failure just looks like this:
# mount -o loop /tmp/219.img2 /mnt/btrfs/
mount: /mnt/btrfs: mount(2) system call failed: File exists.
dmesg(1) may have more information after failed mount system call.
While the dmesg contains nothing but the loop device change:
loop1: detected capacity change from 0 to 524288
[CAUSE]
In device_list_add() we have a lot of extra checks to reject invalid cases.
That function also contains the regular device scan result like the following prompt:
BTRFS: device fsid 6222333e-f9f1-47e6-b306-55ddd4dcaef4 devid 1 transid 8 /dev/loop0 scanned by systemd-udevd (3027)
But unfortunately not all errors have their own error messages, thus if we hit something wrong in device_add_list(), there may be no error messages at all.
[FIX]
Add errors message for all non-ENOMEM errors.
For ENOMEM, I'd say we're in a much worse situation, and there should be some OOM messages way before our call sites.
--- fs/btrfs/volumes.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
fs/btrfs/volumes.c +10 -1
@@ -770,8 +770,11 @@ static noinline struct btrfs_device *dev BTRFS_SUPER_FLAG_CHANGING_FSID_V2); error =lookup_bdev (path, &path_devt); -if (error) +if (error) { +btrfs_err (NULL ,"failed to lookup block device for path %s: %d" , + path, error);return ERR_PTR (error); + }if (fsid_change_in_progress) {if (!has_metadata_uuid)
@@ -836,6 +839,9 @@ static noinline struct btrfs_device *devif (!device) {if (fs_devices->opened) { +btrfs_err (NULL , +"device %s belongs to fsid %pU, and the fs is already mounted" , + path, fs_devices->fsid);mutex_unlock (&fs_devices->device_list_mutex);return ERR_PTR (-EBUSY ); }
@@ -910,6 +916,9 @@ static noinline struct btrfs_device *dev* generation are equal. */ mutex_unlock (&fs_devices->device_list_mutex); +btrfs_err (NULL , +"device %s already registered with a higher generation, found %llu expect %llu" , + path, found_transid, device->generation);return ERR_PTR (-EEXIST ); }
Greg Kroah-Hartman
maintainerPATCH 82/193 btrfs: fix missing error handling when logging directory items
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 6d3d970b2735b967650d319be27268fedc5598d1 upstream.
When logging a directory, at log_dir_items(), if we get an error when attempting to search the subvolume tree for a dir index item, we end up returning 0 (success) from log_dir_items() because 'err' is left with a value of 0.
This can lead to a few problems, specially in the case the variable 'last_offset' has a value of (u64)-1 (and it's initialized to that when it was declared):
1) By returning from log_dir_items() with success (0) and a value of (u64)-1 for '*last_offset_ret', we end up not logging any other dir index keys that follow the missing, just deleted, index key. The (u64)-1 value makes log_directory_changes() not call log_dir_items() again;
2) Before returning with success (0), log_dir_items(), will log a dir index range item covering a range from the last old dentry index (stored in the variable 'last_old_dentry_offset') to the value of 'last_offset'. If 'last_offset' has a value of (u64)-1, then it means if the log is persisted and replayed after a power failure, it will cause deletion of all the directory entries that have an index number between last_old_dentry_offset + 1 and (u64)-1;
3) We can end up returning from log_dir_items() with ctx->last_dir_item_offset having a lower value than inode->last_dir_index_offset, because the former is set to the current key we are processing at process_dir_items_leaf(), and at the end of log_directory_changes() we set inode->last_dir_index_offset to the current value of ctx->last_dir_item_offset. So if for example a deletion of a lower dir index key happened, we set ctx->last_dir_item_offset to that index value, then if we return from log_dir_items() because btrfs_search_slot() returned an error, we end up returning without any error from log_dir_items() and then log_directory_changes() sets inode->last_dir_index_offset to a lower value than it had before.
This can result in unpredictable and unexpected behaviour when we need to log again the directory in the same transaction, and can result in ending up with a log tree leaf that has duplicated keys, as we do batch insertions of dir index keys into a log tree.
Fix this by setting 'err' to the value of 'ret' in case btrfs_search_slot() or btrfs_previous_item() returned an error. That will result in falling back to a full transaction commit.
--- fs/btrfs/tree-log.c | 9 +++++++++ 1 file changed, 9 insertions(+)
fs/btrfs/tree-log.c +9 -0
@@ -3857,7 +3857,10 @@ static noinline int log_dir_items(struct path->slots[0]);if (tmp.type ==BTRFS_DIR_INDEX_KEY ) last_old_dentry_offset = tmp.offset; + }else if (ret <0 ) { + err = ret; } + goto done; }
@@ -3877,7 +3880,11 @@ static noinline int log_dir_items(struct*/ if (tmp.type ==BTRFS_DIR_INDEX_KEY ) last_old_dentry_offset = tmp.offset; + }else if (ret <0 ) { + err = ret; + goto done; } +btrfs_release_path (path);/*
@@ -3890,6 +3897,8 @@ static noinline int log_dir_items(struct*/ search: ret =btrfs_search_slot (NULL , root, &min_key, path,0 ,0 ); +if (ret <0 ) + err = ret;if (ret !=0 ) goto done;
Greg Kroah-Hartman
maintainerPATCH 83/193 btrfs: fix directory logging due to race with concurrent index key deletion
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 8bb6898da6271d82d8e76d8088d66b971a7dcfa6 upstream.
Sometimes we log a directory without holding its VFS lock, so while we logging it, dir index entries may be added or removed. This typically happens when logging a dentry from a parent directory that points to a new directory, through log_new_dir_dentries(), or when while logging some other inode we also need to log its parent directories (through btrfs_log_all_parents()).
This means that while we are at log_dir_items(), we may not find a dir index key we found before, because it was deleted in the meanwhile, so a call to btrfs_search_slot() may return 1 (key not found). In that case we return from log_dir_items() with a success value (the variable 'err' has a value of 0). This can lead to a few problems, specially in the case where the variable 'last_offset' has a value of (u64)-1 (and it's initialized to that when it was declared):
1) By returning from log_dir_items() with success (0) and a value of (u64)-1 for '*last_offset_ret', we end up not logging any other dir index keys that follow the missing, just deleted, index key. The (u64)-1 value makes log_directory_changes() not call log_dir_items() again;
2) Before returning with success (0), log_dir_items(), will log a dir index range item covering a range from the last old dentry index (stored in the variable 'last_old_dentry_offset') to the value of 'last_offset'. If 'last_offset' has a value of (u64)-1, then it means if the log is persisted and replayed after a power failure, it will cause deletion of all the directory entries that have an index number between last_old_dentry_offset + 1 and (u64)-1;
3) We can end up returning from log_dir_items() with ctx->last_dir_item_offset having a lower value than inode->last_dir_index_offset, because the former is set to the current key we are processing at process_dir_items_leaf(), and at the end of log_directory_changes() we set inode->last_dir_index_offset to the current value of ctx->last_dir_item_offset. So if for example a deletion of a lower dir index key happened, we set ctx->last_dir_item_offset to that index value, then if we return from log_dir_items() because btrfs_search_slot() returned 1, we end up returning from log_dir_items() with success (0) and then log_directory_changes() sets inode->last_dir_index_offset to a lower value than it had before.
This can result in unpredictable and unexpected behaviour when we need to log again the directory in the same transaction, and can result in ending up with a log tree leaf that has duplicated keys, as we do batch insertions of dir index keys into a log tree.
So fix this by making log_dir_items() move on to the next dir index key if it does not find the one it was looking for.
--- fs/btrfs/tree-log.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-)
fs/btrfs/tree-log.c +15 -6
@@ -3888,17 +3888,26 @@ static noinline int log_dir_items(structbtrfs_release_path (path);/* -* Find the first key from this transaction again. See the note for -* log_new_dir_dentries, if we're logging a directory recursively we -* won't be holding its i_mutex, which means we can modify the directory -* while we're logging it. If we remove an entry between our first -* search and this search we'll not find the key again and can just -* bail. +* Find the first key from this transaction again or the one we were at +* in the loop below in case we had to reschedule. We may be logging the +* directory without holding its VFS lock, which happen when logging new +* dentries (through log_new_dir_dentries()) or in some cases when we +* need to log the parent directory of an inode. This means a dir index +* key might be deleted from the inode's root, and therefore we may not +* find it anymore. If we can't find it, just move to the next key. We +* can not bail out and ignore, because if we do that we will simply +* not log dir index keys that come after the one that was just deleted +* and we can end up logging a dir index range that ends at (u64)-1 +* (@last_offset is initialized to that), resulting in removing dir +* entries we should not remove at log replay time. */ search: ret =btrfs_search_slot (NULL , root, &min_key, path,0 ,0 ); +if (ret >0 ) + ret =btrfs_next_item (root, path);if (ret <0 ) err = ret; +/* If ret is 1, there are no more keys in the inode's root. */ if (ret !=0 ) goto done;
Greg Kroah-Hartman
maintainerPATCH 84/193 btrfs: add missing setup of log for full commit at add_conflicting_inode()
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 94cd63ae679973edeb5ea95ec25a54467c3e54c8 upstream.
When logging conflicting inodes, if we reach the maximum limit of inodes, we return BTRFS_LOG_FORCE_COMMIT to force a transaction commit. However we don't mark the log for full commit (with btrfs_set_log_full_commit()), which means that once we leave the log transaction and before we commit the transaction, some other task may sync the log, which is incomplete as we have not logged all conflicting inodes, leading to some inconsistent in case that log ends up being replayed.
So also call btrfs_set_log_full_commit() at add_conflicting_inode().
--- fs/btrfs/tree-log.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/btrfs/tree-log.c +3 -1
@@ -5626,8 +5626,10 @@ static int add_conflicting_inode(struct* LOG_INODE_EXISTS mode) and slow down other fsyncs or transaction * commits. */ -if (ctx->num_conflict_inodes >=MAX_CONFLICT_INODES ) +if (ctx->num_conflict_inodes >=MAX_CONFLICT_INODES ) { +btrfs_set_log_full_commit (trans);return BTRFS_LOG_FORCE_COMMIT ; + } inode =btrfs_iget (root->fs_info->sb, ino, root);/*
Greg Kroah-Hartman
maintainerPATCH 85/193 btrfs: do not abort transaction on failure to write log tree when syncing log
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 16199ad9eb6db60a6b10794a09fc1ac6d09312ff upstream.
When syncing the log, if we fail to write log tree extent buffers, we mark the log for a full commit and abort the transaction. However we don't need to abort the transaction, all we really need to do is to make sure no one can commit a superblock pointing to new log tree roots. Just because we got a failure writing extent buffers for a log tree, it does not mean we will also fail to do a transaction commit.
One particular case is if due to a bug somewhere, when writing log tree extent buffers, the tree checker detects some corruption and the writeout fails because of that. Aborting the transaction can be very disruptive for a user, specially if the issue happened on a root filesystem. One example is the scenario in the Link tag below, where an isolated corruption on log tree leaves was causing transaction aborts when syncing the log.
--- fs/btrfs/disk-io.c | 9 ++++++++- fs/btrfs/tree-log.c | 2 -- 2 files changed, 8 insertions(+), 3 deletions(-)
fs/btrfs/disk-io.c +8 -1
@@ -344,7 +344,14 @@ error:btrfs_print_tree (eb,0 );btrfs_err (fs_info,"block=%llu write time tree block corruption detected" , eb->start); -WARN_ON (IS_ENABLED (CONFIG_BTRFS_DEBUG )); +/* +* Be noisy if this is an extent buffer from a log tree. We don't abort +* a transaction in case there's a bad log tree extent buffer, we just +* fallback to a transaction commit. Still we want to know when there is +* a bad log tree extent buffer, as that may signal a bug somewhere. +*/ +WARN_ON (IS_ENABLED (CONFIG_BTRFS_DEBUG ) || +btrfs_header_owner (eb) ==BTRFS_TREE_LOG_OBJECTID );return ret; }
fs/btrfs/tree-log.c +0 -2
@@ -3011,7 +3011,6 @@ int btrfs_sync_log(struct btrfs_trans_ha ret =0 ;if (ret) {blk_finish_plug (&plug); -btrfs_abort_transaction (trans, ret);btrfs_set_log_full_commit (trans);mutex_unlock (&root->log_mutex); goto out;
@@ -3143,7 +3142,6 @@ int btrfs_sync_log(struct btrfs_trans_ha goto out_wake_log_root; }else if (ret) {btrfs_set_log_full_commit (trans); -btrfs_abort_transaction (trans, ret);mutex_unlock (&log_root_tree->log_mutex); goto out_wake_log_root; }
Greg Kroah-Hartman
maintainerPATCH 86/193 btrfs: do not abort transaction on failure to update log root
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 09e44868f1e03c7825ca4283256abedc95e249a3 upstream.
When syncing a log, if we fail to update a log root in the log root tree, we are aborting the transaction if the failure was not -ENOSPC. This is excessive because there is a chance that a transaction commit can succeed, and therefore avoid to turn the filesystem into RO mode. All we need to be careful about is to mark the log for a full commit, which we already do, to make sure no one commits a super block pointing to an outdated log root tree.
So don't abort the transaction if we fail to update a log root in the log root tree, and log an error if the failure is not -ENOSPC, so that it does not go completely unnoticed.
--- fs/btrfs/tree-log.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-)
fs/btrfs/tree-log.c +4 -7
@@ -3075,15 +3075,12 @@ int btrfs_sync_log(struct btrfs_trans_hablk_finish_plug (&plug);btrfs_set_log_full_commit (trans); - -if (ret != -ENOSPC ) { -btrfs_abort_transaction (trans, ret); -mutex_unlock (&log_root_tree->log_mutex); - goto out; - } +if (ret != -ENOSPC ) +btrfs_err (fs_info, +"failed to update log for root %llu ret %d" , + root->root_key.objectid, ret);btrfs_wait_tree_log_extents (log, mark);mutex_unlock (&log_root_tree->log_mutex); - ret =BTRFS_LOG_FORCE_COMMIT ; goto out; }
Greg Kroah-Hartman
maintainerPATCH 87/193 btrfs: qgroup: do not warn on record without old_roots populated
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
commit 75181406b4eafacc531ff2ee5fb032bd93317e2b upstream.
[BUG]
There are some reports from the mailing list that since v6.1 kernel, the WARN_ON() inside btrfs_qgroup_account_extent() gets triggered during rescan:
WARNING: CPU: 3 PID: 6424 at fs/btrfs/qgroup.c:2756 btrfs_qgroup_account_extents+0x1ae/0x260 [btrfs] CPU: 3 PID: 6424 Comm: snapperd Tainted: P OE 6.1.2-1-default #1 openSUSE Tumbleweed 05c7a1b1b61d5627475528f71f50444637b5aad7 RIP: 0010:btrfs_qgroup_account_extents+0x1ae/0x260 [btrfs] Call Trace: <TASK> btrfs_commit_transaction+0x30c/0xb40 [btrfs c39c9c546c241c593f03bd6d5f39ea1b676250f6] ? start_transaction+0xc3/0x5b0 [btrfs c39c9c546c241c593f03bd6d5f39ea1b676250f6] btrfs_qgroup_rescan+0x42/0xc0 [btrfs c39c9c546c241c593f03bd6d5f39ea1b676250f6] btrfs_ioctl+0x1ab9/0x25c0 [btrfs c39c9c546c241c593f03bd6d5f39ea1b676250f6] ? __rseq_handle_notify_resume+0xa9/0x4a0 ? mntput_no_expire+0x4a/0x240 ? __seccomp_filter+0x319/0x4d0 __x64_sys_ioctl+0x90/0xd0 do_syscall_64+0x5b/0x80 ? syscall_exit_to_user_mode+0x17/0x40 ? do_syscall_64+0x67/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fd9b790d9bf </TASK>
[CAUSE]
Since commit e15e9f43c7ca ("btrfs: introduce BTRFS_QGROUP_RUNTIME_FLAG_NO_ACCOUNTING to skip qgroup accounting"), if our qgroup is already in inconsistent state, we will no longer do the time-consuming backref walk.
This can leave some qgroup records without a valid old_roots ulist. Normally this is fine, as btrfs_qgroup_account_extents() would also skip those records if we have NO_ACCOUNTING flag set.
But there is a small window, if we have NO_ACCOUNTING flag set, and inserted some qgroup_record without a old_roots ulist, but then the user triggered a qgroup rescan.
During btrfs_qgroup_rescan(), we firstly clear NO_ACCOUNTING flag, then commit current transaction.
And since we have a qgroup_record with old_roots = NULL, we trigger the WARN_ON() during btrfs_qgroup_account_extents().
[FIX]
Unfortunately due to the introduction of NO_ACCOUNTING flag, the assumption that every qgroup_record would have its old_roots populated is no longer correct.
Fix the false alerts and drop the WARN_ON().
--- fs/btrfs/qgroup.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
fs/btrfs/qgroup.c +12 -2
@@ -2751,9 +2751,19 @@ int btrfs_qgroup_account_extents(struct BTRFS_QGROUP_RUNTIME_FLAG_NO_ACCOUNTING)) {/* * Old roots should be searched when inserting qgroup -* extent record +* extent record. +* +* But for INCONSISTENT (NO_ACCOUNTING) -> rescan case, +* we may have some record inserted during +* NO_ACCOUNTING (thus no old_roots populated), but +* later we start rescan, which clears NO_ACCOUNTING, +* leaving some inserted records without old_roots +* populated. +* +* Those cases are rare and should not cause too much +* time spent during commit_transaction(). */ -if (WARN_ON (!record->old_roots)) { +if (!record->old_roots) {/* Search commit root to find old_roots */ ret = btrfs_find_all_roots(NULL, fs_info, record->bytenr, 0,
Greg Kroah-Hartman
maintainerPATCH 88/193 btrfs: fix invalid leaf access due to inline extent during lseek
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 1f55ee6d0901d915801618bda0af4e5b937e3db7 upstream.
During lseek, for SEEK_DATA and SEEK_HOLE modes, we access the disk_bytenr of an extent without checking its type. However inline extents have their data starting the offset of the disk_bytenr field, so accessing that field when we have an inline extent can result in either of the following:
1) Interpret the inline extent's data as a disk_bytenr value;
2) In case the inline data is less than 8 bytes, we access part of some other item in the leaf, or unused space in the leaf;
3) In case the inline data is less than 8 bytes and the extent item is the first item in the leaf, we can access beyond the leaf's limit.
So fix this by not accessing the disk_bytenr field if we have an inline extent.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216908
--- fs/btrfs/file.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
fs/btrfs/file.c +10 -3
@@ -3838,6 +3838,7 @@ static loff_t find_desired_extent(structstruct extent_buffer *leaf = path->nodes[0 ];struct btrfs_file_extent_item *extent;u64 extent_end; +u8 type;if (path->slots[0 ] >=btrfs_header_nritems (leaf)) { ret =btrfs_next_leaf (root, path);
@@ -3892,10 +3893,16 @@ static loff_t find_desired_extent(struct extent =btrfs_item_ptr (leaf, path->slots[0 ], struct btrfs_file_extent_item); + type =btrfs_file_extent_type (leaf, extent); -if (btrfs_file_extent_disk_bytenr (leaf, extent) ==0 || -btrfs_file_extent_type (leaf, extent) == -BTRFS_FILE_EXTENT_PREALLOC ) { +/* +* Can't access the extent's disk_bytenr field if this is an +* inline extent, since at that offset, it's where the extent +* data starts. +*/ +if (type ==BTRFS_FILE_EXTENT_PREALLOC || + (type ==BTRFS_FILE_EXTENT_REG && +btrfs_file_extent_disk_bytenr (leaf, extent) ==0 )) {/* * Explicit hole or prealloc extent, search for delalloc. * A prealloc extent is treated like a hole.
Greg Kroah-Hartman
maintainerPATCH 89/193 btrfs: fix race between quota rescan and disable leading to NULL pointer deref
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit b7adbf9ada3513d2092362c8eac5cddc5b651f5c upstream.
If we have one task trying to start the quota rescan worker while another one is trying to disable quotas, we can end up hitting a race that results in the quota rescan worker doing a NULL pointer dereference. The steps for this are the following:
1) Quotas are enabled;
2) Task A calls the quota rescan ioctl and enters btrfs_qgroup_rescan(). It calls qgroup_rescan_init() which returns 0 (success) and then joins a transaction and commits it;
3) Task B calls the quota disable ioctl and enters btrfs_quota_disable(). It clears the bit BTRFS_FS_QUOTA_ENABLED from fs_info->flags and calls btrfs_qgroup_wait_for_completion(), which returns immediately since the rescan worker is not yet running.
Then it starts a transaction and locks fs_info->qgroup_ioctl_lock;
4) Task A queues the rescan worker, by calling btrfs_queue_work();
5) The rescan worker starts, and calls rescan_should_stop() at the start of its while loop, which results in 0 iterations of the loop, since the flag BTRFS_FS_QUOTA_ENABLED was cleared from fs_info->flags by task B at step 3);
6) Task B sets fs_info->quota_root to NULL;
7) The rescan worker tries to start a transaction and uses fs_info->quota_root as the root argument for btrfs_start_transaction(). This results in a NULL pointer dereference down the call chain of btrfs_start_transaction(). The stack trace is something like the one reported in Link tag below:
general protection fault, probably for non-canonical address 0xdffffc0000000041: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000208-0x000000000000020f]
CPU: 1 PID: 34 Comm: kworker/u4:2 Not tainted 6.1.0-syzkaller-13872-gb6bb9676f216 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Workqueue: btrfs-qgroup-rescan btrfs_work_helper
RIP: 0010:start_transaction+0x48/0x10f0 fs/btrfs/transaction.c:564
Code: 48 89 fb 48 (...)
RSP: 0018:ffffc90000ab7ab0 EFLAGS: 00010206
RAX: 0000000000000041 RBX: 0000000000000208 RCX: ffff88801779ba80
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: dffffc0000000000 R08: 0000000000000001 R09: fffff52000156f5d
R10: fffff52000156f5d R11: 1ffff92000156f5c R12: 0000000000000000
R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000003
FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2bea75b718 CR3: 000000001d0cc000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
btrfs_qgroup_rescan_worker+0x3bb/0x6a0 fs/btrfs/qgroup.c:3402
btrfs_work_helper+0x312/0x850 fs/btrfs/async-thread.c:280
process_one_work+0x877/0xdb0 kernel/workqueue.c:2289
worker_thread+0xb14/0x1330 kernel/workqueue.c:2436
kthread+0x266/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
Modules linked in:So fix this by having the rescan worker function not attempt to start a transaction if it didn't do any rescan work.
--- fs/btrfs/qgroup.c | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-)
fs/btrfs/qgroup.c +17 -8
@@ -3348,6 +3348,7 @@ static void btrfs_qgroup_rescan_worker(sint err = -ENOMEM ;int ret =0 ;bool stopped = false; +bool did_leaf_rescans = false; path =btrfs_alloc_path ();if (!path)
@@ -3368,6 +3369,7 @@ static void btrfs_qgroup_rescan_worker(s } err =qgroup_rescan_leaf (trans, path); + did_leaf_rescans = true;if (err >0 )btrfs_commit_transaction (trans);
@@ -3388,16 +3390,23 @@ out:mutex_unlock (&fs_info->qgroup_rescan_lock);/* -* only update status, since the previous part has already updated the -* qgroup info. +* Only update status, since the previous part has already updated the +* qgroup info, and only if we did any actual work. This also prevents +* race with a concurrent quota disable, which has already set +* fs_info->quota_root to NULL and cleared BTRFS_FS_QUOTA_ENABLED at +* btrfs_quota_disable(). */ - trans =btrfs_start_transaction (fs_info->quota_root,1 ); -if (IS_ERR (trans)) { - err =PTR_ERR (trans); +if (did_leaf_rescans) { + trans =btrfs_start_transaction (fs_info->quota_root,1 ); +if (IS_ERR (trans)) { + err =PTR_ERR (trans); + trans =NULL ; +btrfs_err (fs_info, +"fail to start transaction for status update: %d" , + err); + } + }else { trans =NULL ; -btrfs_err (fs_info, -"fail to start transaction for status update: %d" , - err); }mutex_lock (&fs_info->qgroup_rescan_lock);
Greg Kroah-Hartman
maintainerPATCH 90/193 cifs: do not include page data when checking signature
In reply to Greg Kroah-HartmanFrom: Enzo Matsumiya <[email protected]>
commit 30b2b2196d6e4cc24cbec633535a2404f258ce69 upstream.
On async reads, page data is allocated before sending. When the response is received but it has no data to fill (e.g. STATUS_END_OF_FILE), __calc_signature() will still include the pages in its computation, leading to an invalid signature check.
This patch fixes this by not setting the async read smb_rqst page data (zeroed by default) if its got_bytes is 0.
This can be reproduced/verified with xfstests generic/465.
--- fs/cifs/smb2pdu.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
fs/cifs/smb2pdu.c +9 -6
@@ -4162,12 +4162,15 @@ smb2_readv_callback(struct mid_q_entry * (struct smb2_hdr *)rdata->iov[0 ].iov_base;struct cifs_credits credits = { .value =0 , .instance =0 };struct smb_rqst rqst = { .rq_iov = &rdata->iov[1 ], - .rq_nvec =1 , - .rq_pages = rdata->pages, - .rq_offset = rdata->page_offset, - .rq_npages = rdata->nr_pages, - .rq_pagesz = rdata->pagesz, - .rq_tailsz = rdata->tailsz }; + .rq_nvec =1 , }; + +if (rdata->got_bytes) { + rqst.rq_pages = rdata->pages; + rqst.rq_offset = rdata->page_offset; + rqst.rq_npages = rdata->nr_pages; + rqst.rq_pagesz = rdata->pagesz; + rqst.rq_tailsz = rdata->tailsz; + } WARN_ONCE(rdata->server != mid->server, "rdata server %p != mid server %p",
Greg Kroah-Hartman
maintainerPATCH 91/193 thunderbolt: Disable XDomain lane 1 only in software connection manager
In reply to Greg Kroah-HartmanFrom: Mika Westerberg <[email protected]>
commit 84ee211c83212f4d35b56e0603acdcc41f860f1b upstream.
When firmware connection manager is in use we should not touch the lane adapter (well or any) configuration space so do this only when we know that the software connection manager is active.
--- drivers/thunderbolt/xdomain.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
drivers/thunderbolt/xdomain.c +12 -5
@@ -1419,12 +1419,19 @@ static int tb_xdomain_get_properties(struct tb_xdomain *xd)* registered, we notify the userspace that it has changed. */ if (!update) { -struct tb_port *port; +/* +* Now disable lane 1 if bonding was not enabled. Do +* this only if bonding was possible at the beginning +* (that is we are the connection manager and there are +* two lanes). +*/ +if (xd->bonding_possible) { +struct tb_port *port; -/* Now disable lane 1 if bonding was not enabled */ - port =tb_port_at (xd->route,tb_xdomain_parent (xd)); -if (!port->bonded) -tb_port_disable (port->dual_link_port); + port =tb_port_at (xd->route,tb_xdomain_parent (xd)); +if (!port->bonded) +tb_port_disable (port->dual_link_port); + }if (device_add (&xd->dev)) {dev_err (&xd->dev,"failed to add XDomain device\n" );
Signature · 1 line
2.39.1
Greg Kroah-Hartman
maintainerPATCH 92/193 thunderbolt: Use correct function to calculate maximum USB3 link rate
In reply to Greg Kroah-HartmanFrom: Mika Westerberg <[email protected]>
commit e8ff07fb33026c5c1bb5b81293496faba5d68059 upstream.
We need to take minimum of both sides of the USB3 link into consideration, not just the downstream port. Fix this by calling tb_usb3_max_link_rate() instead.
--- drivers/thunderbolt/tunnel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/thunderbolt/tunnel.c +1 -1
@@ -1275,7 +1275,7 @@ static void tb_usb3_reclaim_available_bareturn ; }else if (!ret) {/* Use maximum link rate if the link valid is not set */ - ret =usb4_usb3_port_max_link_rate (tunnel->src_port); + ret =tb_usb3_max_link_rate (tunnel->dst_port, tunnel->src_port);if (ret <0 ) {tb_tunnel_warn (tunnel,"failed to read maximum link rate\n" );return ;
Greg Kroah-Hartman
maintainerPATCH 93/193 thunderbolt: Do not report errors if on-board retimers are found
In reply to Greg Kroah-HartmanFrom: Utkarsh Patel <[email protected]>
commit c28f3d80383571d3630df1a0e89500d23e855924 upstream.
Currently we return an error even if on-board retimers are found and that's not expected. Fix this to return an error only if there was one and 0 otherwise.
--- drivers/thunderbolt/retimer.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/thunderbolt/retimer.c +2 -3
@@ -471,10 +471,9 @@ int tb_retimer_scan(struct tb_port *portbreak ; } -if (!last_idx) { - ret =0 ; + ret =0 ; +if (!last_idx) goto out; - }/* Add on-board retimers if they do not exist already */ for (i =1 ; i <= last_idx; i++) {
Greg Kroah-Hartman
maintainerPATCH 94/193 thunderbolt: Do not call PM runtime functions in tb_retimer_scan()
In reply to Greg Kroah-HartmanFrom: Mika Westerberg <[email protected]>
commit 23257cfc1cb7202fd0065e9f4a6a0aac1c04c4a9 upstream.
We cannot call PM runtime functions in tb_retimer_scan() because it will also be called when retimers are scanned from userspace (happens when there is no device connected on ChromeOS for instance) and at the same USB4 port runtime resume hook. This leads to hang because neither can proceed.
Fix this by runtime resuming USB4 ports in tb_scan_port() instead. This makes sure the ports are runtime PM active when retimers are added under it while avoiding the reported hang as well.
--- drivers/thunderbolt/retimer.c | 17 +++-------------- drivers/thunderbolt/tb.c | 20 +++++++++++++++----- 2 files changed, 18 insertions(+), 19 deletions(-)
drivers/thunderbolt/retimer.c +3 -14
@@ -427,13 +427,6 @@ int tb_retimer_scan(struct tb_port *port {u32 status[TB_MAX_RETIMER_INDEX +1 ] = {};int ret, i, last_idx =0 ; -struct usb4_port *usb4; - - usb4 = port->usb4; -if (!usb4) -return 0 ; - -pm_runtime_get_sync (&usb4->dev);/* * Send broadcast RT to make sure retimer indices facing this
@@ -441,7 +434,7 @@ int tb_retimer_scan(struct tb_port *port*/ ret =usb4_port_enumerate_retimers (port);if (ret) - goto out; +return ret;/* * Enable sideband channel for each retimer. We can do this
@@ -471,11 +464,11 @@ int tb_retimer_scan(struct tb_port *portbreak ; } - ret =0 ;if (!last_idx) - goto out; +return 0 ;/* Add on-board retimers if they do not exist already */ + ret =0 ;for (i =1 ; i <= last_idx; i++) {struct tb_retimer *rt;
@@ -489,10 +482,6 @@ int tb_retimer_scan(struct tb_port *port } } -out: -pm_runtime_mark_last_busy (&usb4->dev); -pm_runtime_put_autosuspend (&usb4->dev); -return ret; }
drivers/thunderbolt/tb.c +15 -5
@@ -628,11 +628,15 @@ static void tb_scan_port(struct tb_port* Downstream switch is reachable through two ports. * Only scan on the primary port (link_nr == 0). */ + +if (port->usb4) +pm_runtime_get_sync (&port->usb4->dev); +if (tb_wait_for_port (port, false) <=0 ) -return ; + goto out_rpm_put;if (port->remote) {tb_port_dbg (port,"port already has a remote\n" ); -return ; + goto out_rpm_put; }tb_retimer_scan (port, true);
@@ -647,12 +651,12 @@ static void tb_scan_port(struct tb_port*/ if (PTR_ERR (sw) == -EIO ||PTR_ERR (sw) == -EADDRNOTAVAIL )tb_scan_xdomain (port); -return ; + goto out_rpm_put; }if (tb_switch_configure (sw)) {tb_switch_put (sw); -return ; + goto out_rpm_put; }/*
@@ -681,7 +685,7 @@ static void tb_scan_port(struct tb_portif (tb_switch_add (sw)) {tb_switch_put (sw); -return ; + goto out_rpm_put; }/* Link the switches using both links if available */
@@ -733,6 +737,12 @@ static void tb_scan_port(struct tb_porttb_add_dp_resources (sw);tb_scan_switch (sw); + +out_rpm_put: +if (port->usb4) { +pm_runtime_mark_last_busy (&port->usb4->dev); +pm_runtime_put_autosuspend (&port->usb4->dev); + } }static void tb_deactivate_and_free_tunnel (struct tb_tunnel *tunnel)
Greg Kroah-Hartman
maintainerPATCH 95/193 riscv: dts: sifive: fu740: fix size of pcie 32bit memory
In reply to Greg Kroah-HartmanFrom: Ben Dooks <[email protected]>
commit 43d5f5d63699724d47f0d9e0eae516a260d232b4 upstream.
The 32-bit memory resource is needed for non-prefetchable memory allocations on the PCIe bus, however with some cards (such as the SM768) the system fails to allocate memory from this.
Checking the allocation against the datasheet, it looks like there has been a mis-calcualation of the resource for the first memory region (0x0060090000..0x0070ffffff) which in the data-sheet for the fu740 (v1p2) is from 0x0060000000..0x007fffffff. Changing this to allocate from 0x0060090000..0x007fffffff fixes the probing issues.
--- arch/riscv/boot/dts/sifive/fu740-c000.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/boot/dts/sifive/fu740-c000.dtsi +1 -1
@@ -328,7 +328,7 @@ bus-range = <0x0 0xff>; ranges = <0x81000000 0x0 0x60080000 0x0 0x60080000 0x0 0x10000>, /* I/O */ <0x82000000 0x0 0x60090000 0x0 0x60090000 0x0 0xff70000>, /* mem */ - <0x82000000 0x0 0x70000000 0x0 0x70000000 0x0 0x1000000>, /* mem */ + <0x82000000 0x0 0x70000000 0x0 0x70000000 0x0 0x10000000>, /* mem */ <0xc3000000 0x20 0x00000000 0x20 0x00000000 0x20 0x00000000>; /* mem prefetchable */ num-lanes = <0x8>; interrupts = <56>, <57>, <58>, <59>, <60>, <61>, <62>, <63>, <64>;
Greg Kroah-Hartman
maintainerPATCH 96/193 bpf: restore the ebpf program ID for BPF_AUDIT_UNLOAD and PERF_BPF_EVENT_PROG_UNLOAD
In reply to Greg Kroah-HartmanFrom: Paul Moore <[email protected]>
commit ef01f4e25c1760920e2c94f1c232350277ace69b upstream.
When changing the ebpf program put() routines to support being called from within IRQ context the program ID was reset to zero prior to calling the perf event and audit UNLOAD record generators, which resulted in problems as the ebpf program ID was bogus (always zero). This patch addresses this problem by removing an unnecessary call to bpf_prog_free_id() in __bpf_prog_offload_destroy() and adjusting __bpf_prog_put() to only call bpf_prog_free_id() after audit and perf have finished their bpf program unload tasks in bpf_prog_put_deferred(). For the record, no one can determine, or remember, why it was necessary to free the program ID, and remove it from the IDR, prior to executing bpf_prog_put_deferred(); regardless, both Stanislav and Alexei agree that the approach in this patch should be safe.
It is worth noting that when moving the bpf_prog_free_id() call, the do_idr_lock parameter was forced to true as the ebpf devs determined this was the correct as the do_idr_lock should always be true. The do_idr_lock parameter will be removed in a follow-up patch, but it was kept here to keep the patch small in an effort to ease any stable backports.
I also modified the bpf_audit_prog() logic used to associate the AUDIT_BPF record with other associated records, e.g. @ctx != NULL. Instead of keying off the operation, it now keys off the execution context, e.g. '!in_irg && !irqs_disabled()', which is much more appropriate and should help better connect the UNLOAD operations with the associated audit state (other audit records).
--- kernel/bpf/offload.c | 3 --- kernel/bpf/syscall.c | 6 ++---- 2 files changed, 2 insertions(+), 7 deletions(-)
kernel/bpf/offload.c +0 -3
@@ -216,9 +216,6 @@ static void __bpf_prog_offload_destroy(sif (offload->dev_state) offload->offdev->ops->destroy (prog); -/* Make sure BPF_PROG_GET_NEXT_ID can't find this dead program */ -bpf_prog_free_id (prog, true); -list_del_init (&offload->offloads);kfree (offload); prog->aux->offload =NULL ;
kernel/bpf/syscall.c +2 -4
@@ -1958,7 +1958,7 @@ static void bpf_audit_prog(const structreturn ;if (audit_enabled ==AUDIT_OFF )return ; -if (op ==BPF_AUDIT_LOAD ) +if (!in_irq () && !irqs_disabled ()) ctx =audit_context (); ab =audit_log_start (ctx,GFP_ATOMIC ,AUDIT_BPF );if (unlikely (!ab))
@@ -2053,6 +2053,7 @@ static void bpf_prog_put_deferred(struct prog = aux->prog;perf_event_bpf_event (prog,PERF_BPF_EVENT_PROG_UNLOAD ,0 );bpf_audit_prog (prog,BPF_AUDIT_UNLOAD ); +bpf_prog_free_id (prog, true);__bpf_prog_put_noref (prog, true); }
@@ -2061,9 +2062,6 @@ static void __bpf_prog_put(struct bpf_prstruct bpf_prog_aux *aux = prog->aux;if (atomic64_dec_and_test (&aux->refcnt)) { -/* bpf_prog_free_id() must be called first */ -bpf_prog_free_id (prog, do_idr_lock); -if (in_irq () ||irqs_disabled ()) {INIT_WORK (&aux->work, bpf_prog_put_deferred);schedule_work (&aux->work);
Greg Kroah-Hartman
maintainerPATCH 97/193 tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
commit b8caf69a6946e18ffebad49847e258f5b6d52ac2 upstream.
Driver's probe allocates memory for RX FIFO (port->rx_fifo) based on default RX FIFO depth, e.g. 16. Later during serial startup the qcom_geni_serial_port_setup() updates the RX FIFO depth (port->rx_fifo_depth) to match real device capabilities, e.g. to 32.
The RX UART handle code will read "port->rx_fifo_depth" number of words into "port->rx_fifo" buffer, thus exceeding the bounds. This can be observed in certain configurations with Qualcomm Bluetooth HCI UART device and KASAN:
Bluetooth: hci0: QCA Product ID :0x00000010 Bluetooth: hci0: QCA SOC Version :0x400a0200 Bluetooth: hci0: QCA ROM Version :0x00000200 Bluetooth: hci0: QCA Patch Version:0x00000d2b Bluetooth: hci0: QCA controller version 0x02000200 Bluetooth: hci0: QCA Downloading qca/htbtfw20.tlv bluetooth hci0: Direct firmware load for qca/htbtfw20.tlv failed with error -2 Bluetooth: hci0: QCA Failed to request file: qca/htbtfw20.tlv (-2) Bluetooth: hci0: QCA Failed to download patch (-2) ================================================================== BUG: KASAN: slab-out-of-bounds in handle_rx_uart+0xa8/0x18c Write of size 4 at addr ffff279347d578c0 by task swapper/0/0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rt5-00350-gb2450b7e00be-dirty #26 Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) Call trace: dump_backtrace.part.0+0xe0/0xf0 show_stack+0x18/0x40 dump_stack_lvl+0x8c/0xb8 print_report+0x188/0x488 kasan_report+0xb4/0x100 __asan_store4+0x80/0xa4 handle_rx_uart+0xa8/0x18c qcom_geni_serial_handle_rx+0x84/0x9c qcom_geni_serial_isr+0x24c/0x760 __handle_irq_event_percpu+0x108/0x500 handle_irq_event+0x6c/0x110 handle_fasteoi_irq+0x138/0x2cc generic_handle_domain_irq+0x48/0x64
If the RX FIFO depth changes after probe, be sure to resize the buffer.
--- drivers/tty/serial/qcom_geni_serial.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
drivers/tty/serial/qcom_geni_serial.c +16 -2
@@ -864,9 +864,10 @@ out_unlock:return IRQ_HANDLED ; } -static void get_tx_fifo_size (struct qcom_geni_serial_port *port) +static int setup_fifos (struct qcom_geni_serial_port *port) {struct uart_port *uport; +u32 old_rx_fifo_depth = port->rx_fifo_depth; uport = &port->uport; port->tx_fifo_depth =geni_se_get_tx_fifo_depth (&port->se);
@@ -874,6 +875,16 @@ static void get_tx_fifo_size(struct qcom port->rx_fifo_depth =geni_se_get_rx_fifo_depth (&port->se); uport->fifosize = (port->tx_fifo_depth * port->tx_fifo_width) /BITS_PER_BYTE ; + +if (port->rx_fifo && (old_rx_fifo_depth != port->rx_fifo_depth) && port->rx_fifo_depth) { + port->rx_fifo =devm_krealloc (uport->dev, port->rx_fifo, + port->rx_fifo_depth *sizeof (u32), +GFP_KERNEL ); +if (!port->rx_fifo) +return -ENOMEM ; + } + +return 0 ; }
@@ -888,6 +899,7 @@ static int qcom_geni_serial_port_setup(su32 rxstale =DEFAULT_BITS_PER_CHAR *STALE_TIMEOUT ;u32 proto;u32 pin_swap; +int ret; proto =geni_se_read_proto (&port->se);if (proto !=GENI_SE_UART ) {
@@ -897,7 +909,9 @@ static int qcom_geni_serial_port_setup(sqcom_geni_serial_stop_rx (uport); -get_tx_fifo_size (port); + ret =setup_fifos (port); +if (ret) +return ret;writel (rxstale, uport->membase +SE_UART_RX_STALE_CNT );
Greg Kroah-Hartman
maintainerPATCH 98/193 tty: fix possible null-ptr-defer in spk_ttyio_release
In reply to Greg Kroah-HartmanFrom: Gaosheng Cui <[email protected]>
commit 5abbeebd8296c2301023b8dc4b5a6c0d5229b4f5 upstream.
Run the following tests on the qemu platform:
syzkaller:~# modprobe speakup_audptr input: Speakup as /devices/virtual/input/input4 initialized device: /dev/synth, node (MAJOR 10, MINOR 125) speakup 3.1.6: initialized synth name on entry is: (null) synth probe
spk_ttyio_initialise_ldisc failed because tty_kopen_exclusive returned failed (errno -16), then remove the module, we will get a null-ptr-defer problem, as follow:
syzkaller:~# modprobe -r speakup_audptr releasing synth audptr BUG: kernel NULL pointer dereference, address: 0000000000000080 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP PTI CPU: 2 PID: 204 Comm: modprobe Not tainted 6.1.0-rc6-dirty #1 RIP: 0010:mutex_lock+0x14/0x30 Call Trace: <TASK> spk_ttyio_release+0x19/0x70 [speakup] synth_release.part.6+0xac/0xc0 [speakup] synth_remove+0x56/0x60 [speakup] __x64_sys_delete_module+0x156/0x250 ? fpregs_assert_state_consistent+0x1d/0x50 do_syscall_64+0x37/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> Modules linked in: speakup_audptr(-) speakup Dumping ftrace buffer:
in_synth->dev was not initialized during modprobe, so we add check for in_synth->dev to fix this bug.
--- drivers/accessibility/speakup/spk_ttyio.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/accessibility/speakup/spk_ttyio.c +3 -0
@@ -354,6 +354,9 @@ void spk_ttyio_release(struct spk_synth {struct tty_struct *tty = in_synth->dev; +if (tty ==NULL ) +return ; +tty_lock (tty);if (tty->ops->close)
Greg Kroah-Hartman
maintainerPATCH 99/193 pktcdvd: check for NULL returna fter calling bio_split_to_limits()
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
commit 3e9900f3bd7ba30d60f82b162b70a1dffe4e8e24 upstream.
The revert of the removal of this driver happened after we fixed up the split limits for NOWAIT issue, hence it got missed. Ensure that we check for a NULL bio after splitting, in case it should be retried.
Marking this as fixing both commits, so that stable backport will do this correctly.
--- drivers/block/pktcdvd.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/block/pktcdvd.c +2 -0
@@ -2400,6 +2400,8 @@ static void pkt_submit_bio(struct bio *bstruct bio *split; bio =bio_split_to_limits (bio); +if (!bio) +return ; pkt_dbg(2, pd, "start = %6llx stop = %6llx\n", (unsigned long long)bio->bi_iter.bi_sector,
Greg Kroah-Hartman
maintainerPATCH 100/193 io_uring/poll: dont reissue in case of poll race on multishot request
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
commit 8caa03f10bf92cb8657408a6ece6a8a73f96ce13 upstream.
A previous commit fixed a poll race that can occur, but it's only applicable for multishot requests. For a multishot request, we can safely ignore a spurious wakeup, as we never leave the waitqueue to begin with.
A blunt reissue of a multishot armed request can cause us to leak a buffer, if they are ring provided. While this seems like a bug in itself, it's not really defined behavior to reissue a multishot request directly. It's less efficient to do so as well, and not required to rearm anything like it is for singleshot poll requests.
--- io_uring/poll.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
io_uring/poll.c +5 -1
@@ -281,8 +281,12 @@ static int io_poll_check_events(struct i* to the waitqueue, so if we get nothing back, we * should be safe and attempt a reissue. */ -if (unlikely (!req->cqe.res)) +if (unlikely (!req->cqe.res)) { +/* Multishot armed need not reissue */ +if (!(req->apoll_events &EPOLLONESHOT )) +continue ;return IOU_POLL_REISSUE ; + } }if (req->apoll_events &EPOLLONESHOT )return IOU_POLL_DONE ;
Greg Kroah-Hartman
maintainerPATCH 101/193 mptcp: explicitly specify sock family at subflow creation time
In reply to Greg Kroah-HartmanFrom: Paolo Abeni <[email protected]>
commit 6bc1fe7dd748ba5e76e7917d110837cafe7b931c upstream.
Let the caller specify the to-be-created subflow family.
For a given MPTCP socket created with the AF_INET6 family, the current userspace PM can already ask the kernel to create subflows in v4 and v6. If "plain" IPv4 addresses are passed to the kernel, they are automatically mapped in v6 addresses "by accident". This can be problematic because the userspace will need to pass different addresses, now the v4-mapped-v6 addresses to destroy this new subflow.
On the other hand, if the MPTCP socket has been created with the AF_INET family, the command to create a subflow in v6 will be accepted but the result will not be the one as expected as new subflow will be created in IPv4 using part of the v6 addresses passed to the kernel: not creating the expected subflow then.
No functional change intended for the in-kernel PM where an explicit enforcement is currently in place. This arbitrary enforcement will be leveraged by other patches in a future version.
--- net/mptcp/protocol.c | 2 +- net/mptcp/protocol.h | 3 ++- net/mptcp/subflow.c | 9 +++++---- 3 files changed, 8 insertions(+), 6 deletions(-)
net/mptcp/protocol.c +1 -1
@@ -107,7 +107,7 @@ static int __mptcp_socket_create(structstruct socket *ssock;int err; - err =mptcp_subflow_create_socket (sk, &ssock); + err =mptcp_subflow_create_socket (sk, sk->sk_family, &ssock);if (err)return err;
net/mptcp/protocol.h +2 -1
@@ -626,7 +626,8 @@ bool mptcp_addresses_equal(const struct/* called with sk socket lock held */ int __mptcp_subflow_connect (struct sock *sk,const struct mptcp_addr_info *loc,const struct mptcp_addr_info *remote); -int mptcp_subflow_create_socket (struct sock *sk,struct socket **new_sock); +int mptcp_subflow_create_socket (struct sock *sk,unsigned short family, +struct socket **new_sock);void mptcp_info2sockaddr (const struct mptcp_addr_info *info,struct sockaddr_storage *addr,unsigned short family);
net/mptcp/subflow.c +5 -4
@@ -1492,7 +1492,7 @@ int __mptcp_subflow_connect(struct sockif (!mptcp_is_fully_established (sk)) goto err_out; - err =mptcp_subflow_create_socket (sk, &sf); + err =mptcp_subflow_create_socket (sk, loc->family, &sf);if (err) goto err_out;
@@ -1604,7 +1604,9 @@ static void mptcp_subflow_ops_undo_overr#endif ssk->sk_prot = &tcp_prot; } -int mptcp_subflow_create_socket (struct sock *sk,struct socket **new_sock) + +int mptcp_subflow_create_socket (struct sock *sk,unsigned short family, +struct socket **new_sock) {struct mptcp_subflow_context *subflow;struct net *net =sock_net (sk);
@@ -1617,8 +1619,7 @@ int mptcp_subflow_create_socket(struct sif (unlikely (!sk->sk_socket))return -EINVAL ; - err =sock_create_kern (net, sk->sk_family,SOCK_STREAM ,IPPROTO_TCP , - &sf); + err =sock_create_kern (net, family,SOCK_STREAM ,IPPROTO_TCP , &sf);if (err)return err;
Greg Kroah-Hartman
maintainerPATCH 102/193 mptcp: netlink: respect v4/v6-only sockets
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit fb00ee4f3343acb2b9222ca9b73b47dd1e1a8efc upstream.
If an MPTCP socket has been created with AF_INET6 and the IPV6_V6ONLY option has been set, the userspace PM would allow creating subflows using IPv4 addresses, e.g. mapped in v6.
The kernel side of userspace PM will also accept creating subflows with local and remote addresses having different families. Depending on the subflow socket's family, different behaviours are expected:
- If AF_INET is forced with a v6 address, the kernel will take the last byte of the IP and try to connect to that: a new subflow is created but to a non expected address.
- If AF_INET6 is forced with a v4 address, the kernel will try to connect to a v4 address (v4-mapped-v6). A -EBADF error from the connect() part is then expected.
It is then required to check the given families can be accepted. This is done by using a new helper for addresses family matching, taking care of IPv4 vs IPv4-mapped-IPv6 addresses. This helper will be re-used later by the in-kernel path-manager to use mixed IPv4 and IPv6 addresses.
While at it, a clear error message is now reported if there are some conflicts with the families that have been passed by the userspace.
--- net/mptcp/pm.c | 25 +++++++++++++++++++++++++ net/mptcp/pm_userspace.c | 7 +++++++ net/mptcp/protocol.h | 3 +++ 3 files changed, 35 insertions(+)
net/mptcp/pm.c +25 -0
@@ -420,6 +420,31 @@ void mptcp_pm_subflow_chk_stale(const st } } +/* if sk is ipv4 or ipv6_only allows only same-family local and remote addresses, +* otherwise allow any matching local/remote pair +*/ +bool mptcp_pm_addr_families_match (const struct sock *sk, +const struct mptcp_addr_info *loc, +const struct mptcp_addr_info *rem) +{ +bool mptcp_is_v4 = sk->sk_family ==AF_INET ; + +#if IS_ENABLED (CONFIG_MPTCP_IPV6 ) +bool loc_is_v4 = loc->family ==AF_INET ||ipv6_addr_v4mapped (&loc->addr6); +bool rem_is_v4 = rem->family ==AF_INET ||ipv6_addr_v4mapped (&rem->addr6); + +if (mptcp_is_v4) +return loc_is_v4 && rem_is_v4; + +if (ipv6_only_sock (sk)) +return !loc_is_v4 && !rem_is_v4; + +return loc_is_v4 == rem_is_v4; +#else +return mptcp_is_v4 && loc->family ==AF_INET && rem->family ==AF_INET ; +#endif +} +void mptcp_pm_data_reset (struct mptcp_sock *msk) {u8 pm_type =mptcp_get_pm_type (sock_net ((struct sock *)msk));
net/mptcp/pm_userspace.c +7 -0
@@ -294,6 +294,13 @@ int mptcp_nl_cmd_sf_create(struct sk_buf } sk = &msk->sk.icsk_inet.sk; + +if (!mptcp_pm_addr_families_match (sk, &addr_l, &addr_r)) { +GENL_SET_ERR_MSG (info,"families mismatch" ); + err = -EINVAL ; + goto create_err; + } +lock_sock (sk); err =__mptcp_subflow_connect (sk, &addr_l, &addr_r);
net/mptcp/protocol.h +3 -0
@@ -762,6 +762,9 @@ int mptcp_pm_parse_addr(struct nlattr *aint mptcp_pm_parse_entry (struct nlattr *attr,struct genl_info *info,bool require_family,struct mptcp_pm_addr_entry *entry); +bool mptcp_pm_addr_families_match (const struct sock *sk, +const struct mptcp_addr_info *loc, +const struct mptcp_addr_info *rem);void mptcp_pm_subflow_chk_stale (const struct mptcp_sock *msk,struct sock *ssk);void mptcp_pm_nl_subflow_chk_stale (const struct mptcp_sock *msk,struct sock *ssk);void mptcp_pm_new_connection (struct mptcp_sock *msk,const struct sock *ssk,int server_side);
Greg Kroah-Hartman
maintainerPATCH 103/193 selftests: mptcp: userspace: validate v4-v6 subflows mix
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit 4656d72c1efa495a58ad6d8b073a60907073e4e6 upstream.
MPTCP protocol supports having subflows in both IPv4 and IPv6. In Linux, it is possible to have that if the MPTCP socket has been created with AF_INET6 family without the IPV6_V6ONLY option.
Here, a new IPv4 subflow is being added to the initial IPv6 connection, then being removed using Netlink commands.
--- tools/testing/selftests/net/mptcp/userspace_pm.sh | 47 ++++++++++++++++++++++ 1 file changed, 47 insertions(+)
tools/testing/selftests/net/mptcp/userspace_pm.sh +47 -0
@@ -776,6 +776,52 @@ test_subflows() rm -f "$evts" } +test_subflows_v4_v6_mix() +{ + # Attempt to add a listener at 10.0.2.1:<subflow-port> + ip netns exec "$ns1" ./pm_nl_ctl listen 10.0.2.1\ + $app6_port > /dev/null 2>&1 & + local listener_pid=$! + + # ADD_ADDR4 from server to client machine reusing the subflow port on + # the established v6 connection + :>"$client_evts" + ip netns exec "$ns1" ./pm_nl_ctl ann 10.0.2.1 token "$server6_token" id\ + $server_addr_id dev ns1eth2 > /dev/null 2>&1 + stdbuf -o0 -e0 printf "ADD_ADDR4 id:%d 10.0.2.1 (ns1) => ns2, reuse port\t\t" $server_addr_id + sleep 0.5 + verify_announce_event "$client_evts" "$ANNOUNCED" "$client6_token" "10.0.2.1"\ + "$server_addr_id" "$app6_port" + + # CREATE_SUBFLOW from client to server machine + :>"$client_evts" + ip netns exec "$ns2" ./pm_nl_ctl csf lip 10.0.2.2 lid 23 rip 10.0.2.1 rport\ + $app6_port token "$client6_token" > /dev/null 2>&1 + sleep 0.5 + verify_subflow_events "$client_evts" "$SUB_ESTABLISHED" "$client6_token"\ + "$AF_INET" "10.0.2.2" "10.0.2.1" "$app6_port" "23"\ + "$server_addr_id" "ns2" "ns1" + + # Delete the listener from the server ns, if one was created + kill_wait $listener_pid + + sport=$(sed --unbuffered -n 's/.*\(sport:\)\([[:digit:]]*\).*$/\2/p;q' "$client_evts") + + # DESTROY_SUBFLOW from client to server machine + :>"$client_evts" + ip netns exec "$ns2" ./pm_nl_ctl dsf lip 10.0.2.2 lport "$sport" rip 10.0.2.1 rport\ + $app6_port token "$client6_token" > /dev/null 2>&1 + sleep 0.5 + verify_subflow_events "$client_evts" "$SUB_CLOSED" "$client6_token" \ + "$AF_INET" "10.0.2.2" "10.0.2.1" "$app6_port" "23"\ + "$server_addr_id" "ns2" "ns1" + + # RM_ADDR from server to client machine + ip netns exec "$ns1" ./pm_nl_ctl rem id $server_addr_id token\ + "$server6_token" > /dev/null 2>&1 + sleep 0.5 +} + test_prio() { local count
@@ -812,6 +858,7 @@ make_connection "v6" test_announce test_remove test_subflows +test_subflows_v4_v6_mix test_prio exit 0
Greg Kroah-Hartman
maintainerPATCH 104/193 USB: gadgetfs: Fix race between mounting and unmounting
In reply to Greg Kroah-HartmanFrom: Alan Stern <[email protected]>
commit d18dcfe9860e842f394e37ba01ca9440ab2178f4 upstream.
The syzbot fuzzer and Gerald Lee have identified a use-after-free bug in the gadgetfs driver, involving processes concurrently mounting and unmounting the gadgetfs filesystem. In particular, gadgetfs_fill_super() can race with gadgetfs_kill_sb(), causing the latter to deallocate the_device while the former is using it. The output from KASAN says, in part:
BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:102 [inline] BUG: KASAN: use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:176 [inline] BUG: KASAN: use-after-free in __refcount_sub_and_test include/linux/refcount.h:272 [inline] BUG: KASAN: use-after-free in __refcount_dec_and_test include/linux/refcount.h:315 [inline] BUG: KASAN: use-after-free in refcount_dec_and_test include/linux/refcount.h:333 [inline] BUG: KASAN: use-after-free in put_dev drivers/usb/gadget/legacy/inode.c:159 [inline] BUG: KASAN: use-after-free in gadgetfs_kill_sb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086 Write of size 4 at addr ffff8880276d7840 by task syz-executor126/18689 CPU: 0 PID: 18689 Comm: syz-executor126 Not tainted 6.1.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> ... atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:176 [inline] __refcount_sub_and_test include/linux/refcount.h:272 [inline] __refcount_dec_and_test include/linux/refcount.h:315 [inline] refcount_dec_and_test include/linux/refcount.h:333 [inline] put_dev drivers/usb/gadget/legacy/inode.c:159 [inline] gadgetfs_kill_sb+0x33/0x100 drivers/usb/gadget/legacy/inode.c:2086 deactivate_locked_super+0xa7/0xf0 fs/super.c:332 vfs_get_super fs/super.c:1190 [inline] get_tree_single+0xd0/0x160 fs/super.c:1207 vfs_get_tree+0x88/0x270 fs/super.c:1531 vfs_fsconfig_locked fs/fsopen.c:232 [inline]
The simplest solution is to ensure that gadgetfs_fill_super() and gadgetfs_kill_sb() are serialized by making them both acquire a new mutex.
--- drivers/usb/gadget/legacy/inode.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-)
drivers/usb/gadget/legacy/inode.c +21 -7
@@ -229,6 +229,7 @@ static void put_ep (struct ep_data *data*/ static const char *CHIP ; +static DEFINE_MUTEX (sb_mutex);/* Serialize superblock operations */ /*----------------------------------------------------------------------*/
@@ -2010,13 +2011,20 @@ gadgetfs_fill_super (struct super_block {struct inode *inode;struct dev_data *dev; +int rc; -if (the_device) -return -ESRCH ; +mutex_lock (&sb_mutex); + +if (the_device) { + rc = -ESRCH ; + goto Done; + }CHIP =usb_get_gadget_udc_name (); -if (!CHIP ) -return -ENODEV ; +if (!CHIP ) { + rc = -ENODEV ; + goto Done; + }/* superblock */ sb->s_blocksize =PAGE_SIZE ;
@@ -2053,13 +2061,17 @@ gadgetfs_fill_super (struct super_block* from binding to a controller. */ the_device = dev; -return 0 ; + rc =0 ; + goto Done; -Enomem: + Enomem:kfree (CHIP );CHIP =NULL ; + rc = -ENOMEM ; -return -ENOMEM ; + Done: +mutex_unlock (&sb_mutex); +return rc; }/* "mount -t gadgetfs path /dev/gadget" ends up here */
@@ -2081,6 +2093,7 @@ static int gadgetfs_init_fs_context(strustatic void gadgetfs_kill_sb (struct super_block *sb) { +mutex_lock (&sb_mutex);kill_litter_super (sb);if (the_device) {put_dev (the_device);
@@ -2088,6 +2101,7 @@ gadgetfs_kill_sb (struct super_block *sb }kfree (CHIP );CHIP =NULL ; +mutex_unlock (&sb_mutex); }/*----------------------------------------------------------------------*/
Greg Kroah-Hartman
maintainerPATCH 105/193 USB: serial: cp210x: add SCALANCE LPE-9000 device id
In reply to Greg Kroah-HartmanFrom: Michael Adler <[email protected]>
commit 3f9e76e31704a325170e5aec2243c8d084d74854 upstream.
Add the USB serial console device ID for Siemens SCALANCE LPE-9000 which have a USB port for their serial console.
--- drivers/usb/serial/cp210x.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/cp210x.c +1 -0
@@ -60,6 +60,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x0846, 0x1100) }, /* NetGear Managed Switch M4100 series, M5300 series, M7100 series */ { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */ { USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */ + { USB_DEVICE(0x0908, 0x0070) }, /* Siemens SCALANCE LPE-9000 USB Serial Console */ { USB_DEVICE(0x0908, 0x01FF) }, /* Siemens RUGGEDCOM USB Serial Console */ { USB_DEVICE(0x0988, 0x0578) }, /* Teraoka AD2000 */ { USB_DEVICE(0x0B00, 0x3070) }, /* Ingenico 3070 */
Greg Kroah-Hartman
maintainerPATCH 106/193 usb: cdns3: remove fetched trb from cache before dequeuing
In reply to Greg Kroah-HartmanFrom: Pawel Laszczak <[email protected]>
commit 1301c7b9f7efad2f11ef924e317c18ebd714fc9a upstream.
After doorbell DMA fetches the TRB. If during dequeuing request driver changes NORMAL TRB to LINK TRB but doesn't delete it from controller cache then controller will handle cached TRB and packet can be lost.
The example scenario for this issue looks like:
1. queue request - set doorbell
2. dequeue request
3. send OUT data packet from host
4. Device will accept this packet which is unexpected
5. queue new request - set doorbell
6. Device lost the expected packet.
By setting DFLUSH controller clears DRDY bit and stop DMA transfer.
--- drivers/usb/cdns3/cdns3-gadget.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/usb/cdns3/cdns3-gadget.c +12 -0
@@ -2614,6 +2614,7 @@ int cdns3_gadget_ep_dequeue(struct usb_eu8 req_on_hw_ring =0 ;unsigned long flags;int ret =0 ; +int val;if (!ep || !request || !ep->desc)return -EINVAL ;
@@ -2649,6 +2650,13 @@ found:/* Update ring only if removed request is on pending_req_list list */ if (req_on_hw_ring && link_trb) { +/* Stop DMA */ +writel (EP_CMD_DFLUSH , &priv_dev->regs->ep_cmd); + +/* wait for DFLUSH cleared */ +readl_poll_timeout_atomic (&priv_dev->regs->ep_cmd, val, + !(val &EP_CMD_DFLUSH ),1 ,1000 ); + link_trb->buffer =cpu_to_le32 (TRB_BUFFER (priv_ep->trb_pool_dma + ((priv_req->end_trb +1 ) *TRB_SIZE ))); link_trb->control = cpu_to_le32((le32_to_cpu(link_trb->control) & TRB_CYCLE) |
@@ -2660,6 +2668,10 @@ found:cdns3_gadget_giveback (priv_ep, priv_req, -ECONNRESET ); + req =cdns3_next_request (&priv_ep->pending_req_list); +if (req) +cdns3_rearm_transfer (priv_ep,1 ); + not_found:spin_unlock_irqrestore (&priv_dev->lock, flags);return ret;
Greg Kroah-Hartman
maintainerPATCH 107/193 usb: host: ehci-fsl: Fix module alias
In reply to Greg Kroah-HartmanFrom: Alexander Stein <[email protected]>
commit 5d3d01ae15d2f37ed0325c99ab47ef0ae5d05f3c upstream.
Commit ca07e1c1e4a6 ("drivers:usb:fsl:Make fsl ehci drv an independent driver module") changed DRV_NAME which was used for MODULE_ALIAS as well. Starting from this the module alias didn't match the platform device name created in fsl-mph-dr-of.c
Change DRV_NAME to match the driver name for host mode in fsl-mph-dr-of. This is needed for module autoloading on ls1021a.
--- drivers/usb/host/ehci-fsl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/ehci-fsl.c +1 -1
@@ -29,7 +29,7 @@#include "ehci-fsl.h" #define DRIVER_DESC "Freescale EHCI Host controller driver" -#define DRV_NAME "ehci-fsl" +#define DRV_NAME "fsl-ehci"static struct hc_driver __read_mostly fsl_ehci_hc_driver;
Greg Kroah-Hartman
maintainerPATCH 108/193 usb: musb: fix error return code in omap2430_probe()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
commit bd449ad8cee9d4b523abbdfa73e1a2a08333f331 upstream.
Before calling platform_get_resource() in omap2430_probe(), the 'ret' is re-assgined to 0, it can't return an error code, if platform_get_resource fails. Set the error code to -EINVAL to fix this.
--- drivers/usb/musb/omap2430.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/musb/omap2430.c +3 -1
@@ -411,8 +411,10 @@ static int omap2430_probe(struct platform_device *pdev)memset (musb_res,0 ,sizeof (*musb_res) *ARRAY_SIZE (musb_res)); res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); -if (!res) +if (!res) { + ret = -EINVAL ; goto err2; + } musb_res[i].start = res->start; musb_res[i].end = res->end;
Signature · 1 line
2.39.1
Greg Kroah-Hartman
maintainerPATCH 109/193 usb: typec: tcpm: Fix altmode re-registration causes sysfs create fail
In reply to Greg Kroah-HartmanFrom: ChiYuan Huang <[email protected]>
commit 36f78477ac2c89e9a2eed4a31404a291a3450b5d upstream.
There's the altmode re-registeration issue after data role swap (DR_SWAP).
Comparing to USBPD 2.0, in USBPD 3.0, it loose the limit that only DFP can initiate the VDM command to get partner identity information.
For a USBPD 3.0 UFP device, it may already get the identity information from its port partner before DR_SWAP. If DR_SWAP send or receive at the mean time, 'send_discover' flag will be raised again. It causes discover identify action restart while entering ready state. And after all discover actions are done, the 'tcpm_register_altmodes' will be called. If old altmode is not unregistered, this sysfs create fail can be found.
In 'DR_SWAP_CHANGE_DR' state case, only DFP will unregister altmodes. For UFP, the original altmodes keep registered.
This patch fix the logic that after DR_SWAP, 'tcpm_unregister_altmodes' must be called whatever the current data role is.
--- drivers/usb/typec/tcpm/tcpm.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/usb/typec/tcpm/tcpm.c +3 -4
@@ -4594,14 +4594,13 @@ static void run_state_machine(struct tcptcpm_set_state (port,ready_state (port),0 );break ;case DR_SWAP_CHANGE_DR : -if (port->data_role ==TYPEC_HOST ) { -tcpm_unregister_altmodes (port); +tcpm_unregister_altmodes (port); +if (port->data_role ==TYPEC_HOST )tcpm_set_roles (port, true, port->pwr_role,TYPEC_DEVICE ); - }else { +else tcpm_set_roles (port, true, port->pwr_role,TYPEC_HOST ); - }tcpm_ams_finish (port);tcpm_set_state (port,ready_state (port),0 );break ;
Greg Kroah-Hartman
maintainerPATCH 110/193 usb: typec: altmodes/displayport: Add pin assignment helper
In reply to Greg Kroah-HartmanFrom: Prashant Malani <[email protected]>
commit 582836e3cfab4faafbdc93bbec96fce036a08ee1 upstream.
The code to extract a peripheral's currently supported Pin Assignments is repeated in a couple of locations. Factor it out into a separate function.
This will also make it easier to add fixes (we only need to update 1 location instead of 2).
--- drivers/usb/typec/altmodes/displayport.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-)
drivers/usb/typec/altmodes/displayport.c +14 -8
@@ -419,6 +419,18 @@ static const char * const pin_assignment [DP_PIN_ASSIGN_F] = "F", }; +/* +* Helper function to extract a peripheral's currently supported +* Pin Assignments from its DisplayPort alternate mode state. +*/ +static u8 get_current_pin_assignments (struct dp_altmode *dp) +{ +if (DP_CONF_CURRENTLY (dp->data.conf) ==DP_CONF_DFP_D ) +return DP_CAP_UFP_D_PIN_ASSIGN (dp->alt->vdo); +else +return DP_CAP_DFP_D_PIN_ASSIGN (dp->alt->vdo); +} +static ssize_t pin_assignment_store (struct device *dev,struct device_attribute *attr,const char *buf,size_t size)
@@ -445,10 +457,7 @@ pin_assignment_store(struct device *dev, goto out_unlock; } -if (DP_CONF_CURRENTLY (dp->data.conf) ==DP_CONF_DFP_D ) - assignments =DP_CAP_UFP_D_PIN_ASSIGN (dp->alt->vdo); -else - assignments =DP_CAP_DFP_D_PIN_ASSIGN (dp->alt->vdo); + assignments =get_current_pin_assignments (dp);if (!(DP_CONF_GET_PIN_ASSIGN (conf) & assignments)) { ret = -EINVAL ;
@@ -485,10 +494,7 @@ static ssize_t pin_assignment_show(struc cur =get_count_order (DP_CONF_GET_PIN_ASSIGN (dp->data.conf)); -if (DP_CONF_CURRENTLY (dp->data.conf) ==DP_CONF_DFP_D ) - assignments =DP_CAP_UFP_D_PIN_ASSIGN (dp->alt->vdo); -else - assignments =DP_CAP_DFP_D_PIN_ASSIGN (dp->alt->vdo); + assignments =get_current_pin_assignments (dp);for (i =0 ; assignments; assignments >>=1 , i++) {if (assignments &1 ) {
Greg Kroah-Hartman
maintainerPATCH 111/193 usb: typec: altmodes/displayport: Fix pin assignment calculation
In reply to Greg Kroah-HartmanFrom: Prashant Malani <[email protected]>
commit 9682b41e52cc9f42f5c33caf410464392adaef04 upstream.
Commit c1e5c2f0cb8a ("usb: typec: altmodes/displayport: correct pin assignment for UFP receptacles") fixed the pin assignment calculation to take into account whether the peripheral was a plug or a receptacle.
But the "pin_assignments" sysfs logic was not updated. Address this by using the macros introduced in the aforementioned commit in the sysfs logic too.
--- drivers/usb/typec/altmodes/displayport.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/typec/altmodes/displayport.c +2 -2
@@ -426,9 +426,9 @@ static const char * const pin_assignmentstatic u8 get_current_pin_assignments (struct dp_altmode *dp) {if (DP_CONF_CURRENTLY (dp->data.conf) ==DP_CONF_DFP_D ) -return DP_CAP_UFP_D_PIN_ASSIGN (dp->alt->vdo); +return DP_CAP_PIN_ASSIGN_DFP_D (dp->alt->vdo);else -return DP_CAP_DFP_D_PIN_ASSIGN (dp->alt->vdo); +return DP_CAP_PIN_ASSIGN_UFP_D (dp->alt->vdo); } static ssize_t
Greg Kroah-Hartman
maintainerPATCH 112/193 usb: gadget: g_webcam: Send color matching descriptor per frame
In reply to Greg Kroah-HartmanFrom: Daniel Scally <[email protected]>
commit e95765e97d9cb93258a4840440d410fa6ff7e819 upstream.
Currently the color matching descriptor is only sent across the wire a single time, following the descriptors for each format and frame. According to the UVC 1.5 Specification 3.9.2.6 ("Color Matching Descriptors"):
"Only one instance is allowed for a given format and if present, the Color Matching descriptor shall be placed following the Video and Still Image Frame descriptors for that format".
Add another reference to the color matching descriptor after the yuyv frames so that it's correctly transmitted for that format too.
--- drivers/usb/gadget/legacy/webcam.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/gadget/legacy/webcam.c +3 -0
@@ -293,6 +293,7 @@ static const struct uvc_descriptor_heade (const struct uvc_descriptor_header *) &uvc_format_yuv, (const struct uvc_descriptor_header *) &uvc_frame_yuv_360p, (const struct uvc_descriptor_header *) &uvc_frame_yuv_720p, + (const struct uvc_descriptor_header *) &uvc_color_matching, (const struct uvc_descriptor_header *) &uvc_format_mjpg, (const struct uvc_descriptor_header *) &uvc_frame_mjpg_360p, (const struct uvc_descriptor_header *) &uvc_frame_mjpg_720p,
@@ -305,6 +306,7 @@ static const struct uvc_descriptor_heade (const struct uvc_descriptor_header *) &uvc_format_yuv, (const struct uvc_descriptor_header *) &uvc_frame_yuv_360p, (const struct uvc_descriptor_header *) &uvc_frame_yuv_720p, + (const struct uvc_descriptor_header *) &uvc_color_matching, (const struct uvc_descriptor_header *) &uvc_format_mjpg, (const struct uvc_descriptor_header *) &uvc_frame_mjpg_360p, (const struct uvc_descriptor_header *) &uvc_frame_mjpg_720p,
@@ -317,6 +319,7 @@ static const struct uvc_descriptor_heade (const struct uvc_descriptor_header *) &uvc_format_yuv, (const struct uvc_descriptor_header *) &uvc_frame_yuv_360p, (const struct uvc_descriptor_header *) &uvc_frame_yuv_720p, + (const struct uvc_descriptor_header *) &uvc_color_matching, (const struct uvc_descriptor_header *) &uvc_format_mjpg, (const struct uvc_descriptor_header *) &uvc_frame_mjpg_360p, (const struct uvc_descriptor_header *) &uvc_frame_mjpg_720p,
Greg Kroah-Hartman
maintainerPATCH 113/193 USB: gadget: Add ID numbers to configfs-gadget driver names
In reply to Greg Kroah-HartmanFrom: Chanh Nguyen <[email protected]>
commit 7c07553807c5125c89de242d35c10c206fd8e6bb upstream.
It is unable to use configfs to attach more than one gadget. When attaching the second gadget, it always fails and the kernel message prints out:
Error: Driver 'configfs-gadget' is already registered, aborting... UDC core: g1: driver registration failed: -16
This commit fixes the problem by using the gadget name as a suffix to each configfs_gadget's driver name, thus making the names distinct.
--- drivers/usb/gadget/configfs.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/usb/gadget/configfs.c +10 -2
@@ -392,6 +392,7 @@ static void gadget_info_attr_release(strWARN_ON (!list_empty (&gi->string_list));WARN_ON (!list_empty (&gi->available_func));kfree (gi->composite.gadget_driver.function); +kfree (gi->composite.gadget_driver.driver.name);kfree (gi); }
@@ -1571,7 +1572,6 @@ static const struct usb_gadget_driver co .max_speed = USB_SPEED_SUPER_PLUS, .driver = { .owner = THIS_MODULE, - .name = "configfs-gadget", }, .match_existing_only = 1, };
@@ -1622,13 +1622,21 @@ static struct config_group *gadgets_make gi->composite.gadget_driver = configfs_driver_template; + gi->composite.gadget_driver.driver.name =kasprintf (GFP_KERNEL , +"configfs-gadget.%s" , name); +if (!gi->composite.gadget_driver.driver.name) + goto err; + gi->composite.gadget_driver.function =kstrdup (name,GFP_KERNEL ); gi->composite.name = gi->composite.gadget_driver.function;if (!gi->composite.gadget_driver.function) - goto err; + goto out_free_driver_name;return &gi->group; + +out_free_driver_name: +kfree (gi->composite.gadget_driver.driver.name); err:kfree (gi);return ERR_PTR (-ENOMEM );
Greg Kroah-Hartman
maintainerPATCH 114/193 usb: gadget: f_ncm: fix potential NULL ptr deref in ncm_bitrate()
In reply to Greg Kroah-HartmanFrom: Maciej Żenczykowski <[email protected]>
commit c6ec929595c7443250b2a4faea988c62019d5cd2 upstream.
In Google internal bug 265639009 we've received an (as yet) unreproducible crash report from an aarch64 GKI 5.10.149-android13 running device.
AFAICT the source code is at:
https://android.googlesource.com/kernel/common/+/refs/tags/ASB-2022-12-05_13-5.10
The call stack is:
ncm_close() -> ncm_notify() -> ncm_do_notify()
with the crash at:
ncm_do_notify+0x98/0x270 Code: 79000d0b b9000a6c f940012a f9400269 (b9405d4b)
Which I believe disassembles to (I don't know ARM assembly, but it looks sane enough to me...):
// halfword (16-bit) store presumably to event->wLength (at offset 6 of struct usb_cdc_notification)
0B 0D 00 79 strh w11, [x8, #6]
// word (32-bit) store presumably to req->Length (at offset 8 of struct usb_request)
6C 0A 00 B9 str w12, [x19, #8]
// x10 (NULL) was read here from offset 0 of valid pointer x9 // IMHO we're reading 'cdev->gadget' and getting NULL // gadget is indeed at offset 0 of struct usb_composite_dev
2A 01 40 F9 ldr x10, [x9]
// loading req->buf pointer, which is at offset 0 of struct usb_request
69 02 40 F9 ldr x9, [x19]
// x10 is null, crash, appears to be attempt to read cdev->gadget->max_speed
4B 5D 40 B9 ldr w11, [x10, #0x5c]
which seems to line up with ncm_do_notify() case NCM_NOTIFY_SPEED code fragment:
event->wLength = cpu_to_le16(8); req->length = NCM_STATUS_BYTECOUNT; /* SPEED_CHANGE data is up/down speeds in bits/sec */ data = req->buf + sizeof *event; data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget));
My analysis of registers and NULL ptr deref crash offset
(Unable to handle kernel NULL pointer dereference at virtual address 000000000000005c)
heavily suggests that the crash is due to 'cdev->gadget' being NULL when executing:
data[0] = cpu_to_le32(ncm_bitrate(cdev->gadget));
which calls:
ncm_bitrate(NULL)
which then calls:
gadget_is_superspeed(NULL)
which reads
((struct usb_gadget *)NULL)->max_speed
and hits a panic.
AFAICT, if I'm counting right, the offset of max_speed is indeed 0x5C. (remember there's a GKI KABI reservation of 16 bytes in struct work_struct)
It's not at all clear to me how this is all supposed to work... but returning 0 seems much better than panic-ing...
--- drivers/usb/gadget/function/f_ncm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/gadget/function/f_ncm.c +3 -1
@@ -83,7 +83,9 @@ static inline struct f_ncm *func_to_ncm(/* peak (theoretical) bulk transfer rate in bits-per-second */ static inline unsigned ncm_bitrate (struct usb_gadget *g) { -if (gadget_is_superspeed (g) && g->speed >=USB_SPEED_SUPER_PLUS ) +if (!g) +return 0 ; +else if (gadget_is_superspeed (g) && g->speed >=USB_SPEED_SUPER_PLUS )return 4250000000U ;else if (gadget_is_superspeed (g) && g->speed ==USB_SPEED_SUPER )return 3750000000U ;
Greg Kroah-Hartman
maintainerPATCH 115/193 usb-storage: apply IGNORE_UAS only for HIKSEMI MD202 on RTL9210
In reply to Greg Kroah-HartmanFrom: Juhyung Park <[email protected]>
commit dbd24ec17b85b45f4e823d1aa5607721920f2b05 upstream.
The commit e00b488e813f ("usb-storage: Add Hiksemi USB3-FW to IGNORE_UAS") blacklists UAS for all of RTL9210 enclosures.
The RTL9210 controller was advertised with UAS since its release back in 2019 and was shipped with a lot of enclosure products with different firmware combinations.
Blacklist UAS only for HIKSEMI MD202.
This should hopefully be replaced with more robust method than just comparing strings. But with limited information [1] provided thus far (dmesg when the device is plugged in, which includes manufacturer and product, but no lsusb -v to compare against), this is the best we can do for now.
[1] https://lore.kernel.org/all/[email protected]
--- drivers/usb/storage/uas-detect.h | 13 +++++++++++++ drivers/usb/storage/unusual_uas.h | 7 ------- 2 files changed, 13 insertions(+), 7 deletions(-)
drivers/usb/storage/uas-detect.h +13 -0
@@ -116,6 +116,19 @@ static int uas_use_uas_driver(struct usbif (le16_to_cpu (udev->descriptor.idVendor) ==0x0bc2 ) flags |=US_FL_NO_ATA_1X ; +/* +* RTL9210-based enclosure from HIKSEMI, MD202 reportedly have issues +* with UAS. This isn't distinguishable with just idVendor and +* idProduct, use manufacturer and product too. +* +* Reported-by: Hongling Zeng <[email protected]> +*/ +if (le16_to_cpu (udev->descriptor.idVendor) ==0x0bda && +le16_to_cpu (udev->descriptor.idProduct) ==0x9210 && + (udev->manufacturer && !strcmp (udev->manufacturer,"HIKSEMI" )) && + (udev->product && !strcmp (udev->product,"MD202" ))) + flags |=US_FL_IGNORE_UAS ; +usb_stor_adjust_quirks (udev, &flags);if (flags &US_FL_IGNORE_UAS ) {
drivers/usb/storage/unusual_uas.h +0 -7
@@ -83,13 +83,6 @@ UNUSUAL_DEV(0x0bc2, 0x331a, 0x0000, 0x99 USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NO_REPORT_LUNS), -/* Reported-by: Hongling Zeng <[email protected]> */ -UNUSUAL_DEV (0x0bda ,0x9210 ,0x0000 ,0x9999 , -"Hiksemi" , -"External HDD" , -USB_SC_DEVICE ,USB_PR_DEVICE ,NULL , -US_FL_IGNORE_UAS ), -/* Reported-by: Benjamin Tissoires <[email protected]> */ UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999, "Initio Corporation",
Greg Kroah-Hartman
maintainerPATCH 116/193 arm64: dts: imx8mp: correct usb clocks
In reply to Greg Kroah-HartmanFrom: Li Jun <[email protected]>
commit 8a1ed98fe0f2e7669f0409de0f46f317b275f8be upstream.
After commit cf7f3f4fa9e5 ("clk: imx8mp: fix usb_root_clk parent"), usb_root_clk is no longer for suspend clock so update dts accordingly to use right bus clock and suspend clock.
--- arch/arm64/boot/dts/freescale/imx8mp.dtsi | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
arch/arm64/boot/dts/freescale/imx8mp.dtsi +6 -6
@@ -1279,7 +1279,7 @@ reg = <0x32f10100 0x8>, <0x381f0000 0x20>; clocks = <&clk IMX8MP_CLK_HSIO_ROOT>, - <&clk IMX8MP_CLK_USB_ROOT>; + <&clk IMX8MP_CLK_USB_SUSP>; clock-names = "hsio", "suspend"; interrupts = <GIC_SPI 148 IRQ_TYPE_LEVEL_HIGH>; power-domains = <&hsio_blk_ctrl IMX8MP_HSIOBLK_PD_USB>;
@@ -1292,9 +1292,9 @@ usb_dwc3_0: usb@38100000 { compatible = "snps,dwc3"; reg = <0x38100000 0x10000>; - clocks = <&clk IMX8MP_CLK_HSIO_AXI>, + clocks = <&clk IMX8MP_CLK_USB_ROOT>, <&clk IMX8MP_CLK_USB_CORE_REF>, - <&clk IMX8MP_CLK_USB_ROOT>; + <&clk IMX8MP_CLK_USB_SUSP>; clock-names = "bus_early", "ref", "suspend"; interrupts = <GIC_SPI 40 IRQ_TYPE_LEVEL_HIGH>; phys = <&usb3_phy0>, <&usb3_phy0>;
@@ -1321,7 +1321,7 @@ reg = <0x32f10108 0x8>, <0x382f0000 0x20>; clocks = <&clk IMX8MP_CLK_HSIO_ROOT>, - <&clk IMX8MP_CLK_USB_ROOT>; + <&clk IMX8MP_CLK_USB_SUSP>; clock-names = "hsio", "suspend"; interrupts = <GIC_SPI 149 IRQ_TYPE_LEVEL_HIGH>; power-domains = <&hsio_blk_ctrl IMX8MP_HSIOBLK_PD_USB>;
@@ -1334,9 +1334,9 @@ usb_dwc3_1: usb@38200000 { compatible = "snps,dwc3"; reg = <0x38200000 0x10000>; - clocks = <&clk IMX8MP_CLK_HSIO_AXI>, + clocks = <&clk IMX8MP_CLK_USB_ROOT>, <&clk IMX8MP_CLK_USB_CORE_REF>, - <&clk IMX8MP_CLK_USB_ROOT>; + <&clk IMX8MP_CLK_USB_SUSP>; clock-names = "bus_early", "ref", "suspend"; interrupts = <GIC_SPI 41 IRQ_TYPE_LEVEL_HIGH>; phys = <&usb3_phy1>, <&usb3_phy1>;
Greg Kroah-Hartman
maintainerPATCH 117/193 dt-bindings: phy: g12a-usb2-phy: fix compatible string documentation
In reply to Greg Kroah-HartmanFrom: Heiner Kallweit <[email protected]>
commit c63835bf1c750c9b3aec1d5c23d811d6375fc23d upstream.
The compatible strings in the driver don't have the meson prefix. Fix this in the documentation and rename the file accordingly.
---
Documentation/devicetree/bindings/phy/amlogic,g12a-usb2-phy.yaml | 78 ++++++++++
Documentation/devicetree/bindings/phy/amlogic,meson-g12a-usb2-phy.yaml | 78 ----------
2 files changed, 78 insertions(+), 78 deletions(-)
rename Documentation/devicetree/bindings/phy/{amlogic,meson-g12a-usb2-phy.yaml => amlogic,g12a-usb2-phy.yaml} (85%)Documentation/devicetree/bindings/phy/amlogic,g12a-usb2-phy.yaml new file +78 -0
@@ -0,0 +1,78 @@ +# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause) +# Copyright 2019 BayLibre, SAS +%YAML 1.2 +--- +$id: "http://devicetree.org/schemas/phy/amlogic,g12a-usb2-phy.yaml#" +$schema: "http://devicetree.org/meta-schemas/core.yaml#" + +title: Amlogic G12A USB2 PHY + +maintainers: + - Neil Armstrong <[email protected]> + +properties: + compatible: + enum: + - amlogic,g12a-usb2-phy + - amlogic,a1-usb2-phy + + reg: + maxItems: 1 + + clocks: + maxItems: 1 + + clock-names: + items: + - const: xtal + + resets: + maxItems: 1 + + reset-names: + items: + - const: phy + + "#phy-cells": + const: 0 + + phy-supply: + description: + Phandle to a regulator that provides power to the PHY. This + regulator will be managed during the PHY power on/off sequence. + +required: + - compatible + - reg + - clocks + - clock-names + - resets + - reset-names + - "#phy-cells" + +if: + properties: + compatible: + enum: + - amlogic,meson-a1-usb-ctrl + +then: + properties: + power-domains: + maxItems: 1 + required: + - power-domains + +additionalProperties: false + +examples: + - | + phy@36000 { + compatible = "amlogic,g12a-usb2-phy"; + reg = <0x36000 0x2000>; + clocks = <&xtal>; + clock-names = "xtal"; + resets = <&phy_reset>; + reset-names = "phy"; + #phy-cells = <0>; + };
Documentation/devicetree/bindings/phy/amlogic,meson-g12a-usb2-phy.yaml deleted +0 -78
78 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 118/193 dt-bindings: phy: g12a-usb3-pcie-phy: fix compatible string documentation
In reply to Greg Kroah-HartmanFrom: Heiner Kallweit <[email protected]>
commit e181119046a0ec16126b682163040e8e33f310c1 upstream.
The compatible string in the driver doesn't have the meson prefix. Fix this in the documentation and rename the file accordingly.
---
Documentation/devicetree/bindings/phy/amlogic,g12a-usb3-pcie-phy.yaml | 59 ++++++++++
Documentation/devicetree/bindings/phy/amlogic,meson-g12a-usb3-pcie-phy.yaml | 59 ----------
2 files changed, 59 insertions(+), 59 deletions(-)
rename Documentation/devicetree/bindings/phy/{amlogic,meson-g12a-usb3-pcie-phy.yaml => amlogic,g12a-usb3-pcie-phy.yaml} (82%)Documentation/devicetree/bindings/phy/amlogic,g12a-usb3-pcie-phy.yaml new file +59 -0
@@ -0,0 +1,59 @@ +# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause) +# Copyright 2019 BayLibre, SAS +%YAML 1.2 +--- +$id: "http://devicetree.org/schemas/phy/amlogic,g12a-usb3-pcie-phy.yaml#" +$schema: "http://devicetree.org/meta-schemas/core.yaml#" + +title: Amlogic G12A USB3 + PCIE Combo PHY + +maintainers: + - Neil Armstrong <[email protected]> + +properties: + compatible: + enum: + - amlogic,g12a-usb3-pcie-phy + + reg: + maxItems: 1 + + clocks: + maxItems: 1 + + clock-names: + items: + - const: ref_clk + + resets: + maxItems: 1 + + reset-names: + items: + - const: phy + + "#phy-cells": + const: 1 + +required: + - compatible + - reg + - clocks + - clock-names + - resets + - reset-names + - "#phy-cells" + +additionalProperties: false + +examples: + - | + phy@46000 { + compatible = "amlogic,g12a-usb3-pcie-phy"; + reg = <0x46000 0x2000>; + clocks = <&ref_clk>; + clock-names = "ref_clk"; + resets = <&phy_reset>; + reset-names = "phy"; + #phy-cells = <1>; + };
Documentation/devicetree/bindings/phy/amlogic,meson-g12a-usb3-pcie-phy.yaml deleted +0 -59
59 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 119/193 serial: pch_uart: Pass correct sg to dma_unmap_sg()
In reply to Greg Kroah-HartmanFrom: Ilpo Järvinen <[email protected]>
commit e8914b52e5b024e4af3d810a935fe0805eee8a36 upstream.
A local variable sg is used to store scatterlist pointer in pch_dma_tx_complete(). The for loop doing Tx byte accounting before dma_unmap_sg() alters sg in its increment statement. Therefore, the pointer passed into dma_unmap_sg() won't match to the one given to dma_map_sg().
To fix the problem, use priv->sg_tx_p directly in dma_unmap_sg() instead of the local variable.
--- drivers/tty/serial/pch_uart.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/pch_uart.c +1 -1
@@ -752,7 +752,7 @@ static void pch_dma_tx_complete(void *ar } xmit->tail &=UART_XMIT_SIZE -1 ;async_tx_ack (priv->desc_tx); -dma_unmap_sg (port->dev, sg, priv->orig_nent,DMA_TO_DEVICE ); +dma_unmap_sg (port->dev, priv->sg_tx_p, priv->orig_nent,DMA_TO_DEVICE ); priv->tx_dma_use =0 ; priv->nent =0 ; priv->orig_nent =0 ;
Greg Kroah-Hartman
maintainerPATCH 120/193 dmaengine: lgm: Move DT parsing after initialization
In reply to Greg Kroah-HartmanFrom: Peter Harliman Liem <[email protected]>
commit 96b3bb18f6cbe259ef4e0bed3135911b7e8d2af5 upstream.
ldma_cfg_init() will parse DT to retrieve certain configs. However, that is called before ldma_dma_init_vXX(), which will make some initialization to channel configs. It will thus incorrectly overwrite certain configs that are declared in DT.
To fix that, we move DT parsing after initialization. Function name is renamed to better represent what it does.
--- drivers/dma/lgm/lgm-dma.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/dma/lgm/lgm-dma.c +5 -5
@@ -914,7 +914,7 @@ static void ldma_dev_init(struct ldma_de } } -static int ldma_cfg_init (struct ldma_dev *d) +static int ldma_parse_dt (struct ldma_dev *d) {struct fwnode_handle *fwnode =dev_fwnode (d->dev);struct ldma_port *p;
@@ -1661,10 +1661,6 @@ static int intel_ldma_probe(struct platf p->ldev = d; } - ret =ldma_cfg_init (d); -if (ret) -return ret; - dma_dev->dev = &pdev->dev; ch_mask = (unsigned long )d->channels_mask;
@@ -1675,6 +1671,10 @@ static int intel_ldma_probe(struct platfldma_dma_init_v3X (j, d); } + ret =ldma_parse_dt (d); +if (ret) +return ret; + dma_dev->device_alloc_chan_resources = ldma_alloc_chan_resources; dma_dev->device_free_chan_resources = ldma_free_chan_resources; dma_dev->device_terminate_all = ldma_terminate_all;
Greg Kroah-Hartman
maintainerPATCH 121/193 dmaengine: tegra210-adma: fix global intr clear
In reply to Greg Kroah-HartmanFrom: Mohan Kumar <[email protected]>
commit 9c7e355ccbb33d239360c876dbe49ad5ade65b47 upstream.
The current global interrupt clear programming register offset was not correct. Fix the programming with right offset
--- drivers/dma/tegra210-adma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dma/tegra210-adma.c +1 -1
@@ -221,7 +221,7 @@ static int tegra_adma_init(struct tegra_int ret;/* Clear any interrupts */ -tdma_write (tdma, tdma->cdata->global_int_clear,0x1 ); +tdma_write (tdma, tdma->cdata->ch_base_offset + tdma->cdata->global_int_clear,0x1 );/* Assert soft reset */ tdma_write (tdma,ADMA_GLOBAL_SOFT_RESET ,0x1 );
Greg Kroah-Hartman
maintainerPATCH 122/193 dmaengine: idxd: Let probe fail when workqueue cannot be enabled
In reply to Greg Kroah-HartmanFrom: Reinette Chatre <[email protected]>
commit b51b75f0604f17c0f6f3b6f68f1a521a5cc6b04f upstream.
The workqueue is enabled when the appropriate driver is loaded and disabled when the driver is removed. When the driver is removed it assumes that the workqueue was enabled successfully and proceeds to free allocations made during workqueue enabling.
Failure during workqueue enabling does not prevent the driver from being loaded. This is because the error path within drv_enable_wq() returns success unless a second failure is encountered during the error path. By returning success it is possible to load the driver even if the workqueue cannot be enabled and allocations that do not exist are attempted to be freed during driver remove.
Some examples of problematic flows:
(a)
idxd_dmaengine_drv_probe() -> drv_enable_wq() -> idxd_wq_request_irq():
In above flow, if idxd_wq_request_irq() fails then idxd_wq_unmap_portal() is called on error exit path, but drv_enable_wq() returns 0 because idxd_wq_disable() succeeds. The driver is thus loaded successfully.
idxd_dmaengine_drv_remove()->drv_disable_wq()->idxd_wq_unmap_portal() Above flow on driver unload triggers the WARN in devm_iounmap() because the device resource has already been removed during error path of drv_enable_wq().
(b)
idxd_dmaengine_drv_probe() -> drv_enable_wq() -> idxd_wq_request_irq():
In above flow, if idxd_wq_request_irq() fails then idxd_wq_init_percpu_ref() is never called to initialize the percpu counter, yet the driver loads successfully because drv_enable_wq() returns 0.
idxd_dmaengine_drv_remove()->__idxd_wq_quiesce()->percpu_ref_kill():
Above flow on driver unload triggers a BUG when attempting to drop the initial ref of the uninitialized percpu ref:
BUG: kernel NULL pointer dereference, address: 0000000000000010
Fix the drv_enable_wq() error path by returning the original error that indicates failure of workqueue enabling. This ensures that the probe fails when an error is encountered and the driver remove paths are only attempted when the workqueue was enabled successfully.
--- drivers/dma/idxd/device.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/dma/idxd/device.c +1 -2
@@ -1391,8 +1391,7 @@ err_res_alloc: err_irq:idxd_wq_unmap_portal (wq); err_map_portal: - rc =idxd_wq_disable (wq, false); -if (rc <0 ) +if (idxd_wq_disable (wq, false))dev_dbg (dev,"wq %s disable failed\n" ,dev_name (wq_confdev (wq))); err:return rc;
Greg Kroah-Hartman
maintainerPATCH 123/193 dmaengine: idxd: Prevent use after free on completion memory
In reply to Greg Kroah-HartmanFrom: Reinette Chatre <[email protected]>
commit 1beeec45f9ac31eba52478379f70a5fa9c2ad005 upstream.
On driver unload any pending descriptors are flushed at the time the interrupt is freed:idxd_dmaengine_drv_remove() ->
drv_disable_wq() -> idxd_wq_free_irq() -> idxd_flush_pending_descs().
If there are any descriptors present that need to be flushed this flow triggers a "not present" page fault as below:
BUG: unable to handle page fault for address: ff391c97c70c9040 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page
The address that triggers the fault is the address of the descriptor that was freed moments earlier via:
drv_disable_wq()->idxd_wq_free_resources()
Fix the use after free by freeing the descriptors after any possible usage. This is done after idxd_wq_reset() to ensure that the memory remains accessible during possible completion writes by the device.
--- drivers/dma/idxd/device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dma/idxd/device.c +1 -1
@@ -1408,11 +1408,11 @@ void drv_disable_wq(struct idxd_wq *wq)dev_warn (dev,"Clients has claim on wq %d: %d\n" , wq->id,idxd_wq_refcount (wq)); -idxd_wq_free_resources (wq);idxd_wq_unmap_portal (wq);idxd_wq_drain (wq);idxd_wq_free_irq (wq);idxd_wq_reset (wq); +idxd_wq_free_resources (wq);percpu_ref_exit (&wq->wq_active); wq->type =IDXD_WQT_NONE ; wq->client_count =0 ;
Greg Kroah-Hartman
maintainerPATCH 124/193 dmaengine: idxd: Do not call DMX TX callbacks during workqueue disable
In reply to Greg Kroah-HartmanFrom: Reinette Chatre <[email protected]>
commit 6744a030d81e456883bfbb627ac1f30465c1a989 upstream.
On driver unload any pending descriptors are flushed and pending DMA descriptors are explicitly completed:idxd_dmaengine_drv_remove() ->
drv_disable_wq() -> idxd_wq_free_irq() -> idxd_flush_pending_descs() -> idxd_dma_complete_txd()
With this done during driver unload any remaining descriptor is likely stuck and can be dropped. Even so, the descriptor may still have a callback set that could no longer be accessible. An example of such a problem is when the dmatest fails and the dmatest module is unloaded. The failure of dmatest leaves descriptors with dma_async_tx_descriptor::callback pointing to code that no longer exist. This causes a page fault as below at the time the IDXD driver is unloaded when it attempts to run the callback:
BUG: unable to handle page fault for address: ffffffffc0665190 #PF: supervisor instruction fetch in kernel mode #PF: error_code(0x0010) - not-present page
Fix this by clearing the callback pointers on the transmit descriptors only when workqueue is disabled.
--- drivers/dma/idxd/device.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/dma/idxd/device.c +11 -0
@@ -1173,8 +1173,19 @@ static void idxd_flush_pending_descs(strspin_unlock (&ie->list_lock);list_for_each_entry_safe (desc, itr, &flist, list) { +struct dma_async_tx_descriptor *tx; +list_del (&desc->list); ctype = desc->completion->status ?IDXD_COMPLETE_NORMAL :IDXD_COMPLETE_ABORT ; +/* +* wq is being disabled. Any remaining descriptors are +* likely to be stuck and can be dropped. callback could +* point to code that is no longer accessible, for example +* if dmatest module has been unloaded. +*/ + tx = &desc->txd; + tx->callback =NULL ; + tx->callback_result =NULL ;idxd_dma_complete_txd (desc, ctype, true); } }
Greg Kroah-Hartman
maintainerPATCH 125/193 serial: amba-pl011: fix high priority character transmission in rs486 mode
In reply to Greg Kroah-HartmanFrom: Lino Sanfilippo <[email protected]>
commit 4f39aca2360c82dccd2f5179d77e94aab665bea6 upstream.
In RS485 mode the transmission of a high priority character fails since it is written to the data register before the transmitter is enabled. Fix this in pl011_tx_chars() by enabling RS485 transmission before writing the character.
--- drivers/tty/serial/amba-pl011.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/tty/serial/amba-pl011.c +4 -4
@@ -1467,6 +1467,10 @@ static bool pl011_tx_chars(struct uart_astruct circ_buf *xmit = &uap->port.state->xmit;int count = uap->fifosize >>1 ; +if ((uap->port.rs485.flags &SER_RS485_ENABLED ) && + !uap->rs485_tx_started) +pl011_rs485_tx_start (uap); +if (uap->port.x_char) {if (!pl011_tx_char (uap, uap->port.x_char, from_irq))return true;
@@ -1478,10 +1482,6 @@ static bool pl011_tx_chars(struct uart_areturn false; } -if ((uap->port.rs485.flags &SER_RS485_ENABLED ) && - !uap->rs485_tx_started) -pl011_rs485_tx_start (uap); -/* If we are using DMA mode, try to send some characters. */ if (pl011_dma_tx_irq (uap))return true;
Greg Kroah-Hartman
maintainerPATCH 126/193 serial: atmel: fix incorrect baudrate setup
In reply to Greg Kroah-HartmanFrom: Tobias Schramm <[email protected]>
commit 5bfdd3c654bd879bff50c2e85e42f85ae698b42f upstream.
Commit ba47f97a18f2 ("serial: core: remove baud_rates when serial console setup") changed uart_set_options to select the correct baudrate configuration based on the absolute error between requested baudrate and available standard baudrate settings.
Prior to that commit the baudrate was selected based on which predefined standard baudrate did not exceed the requested baudrate.
This change of selection logic was never reflected in the atmel serial driver. Thus the comment left in the atmel serial driver is no longer accurate.
Additionally the manual rounding up described in that comment and applied via (quot - 1) requests an incorrect baudrate. Since uart_set_options uses tty_termios_encode_baud_rate to determine the appropriate baudrate flags this can cause baudrate selection to fail entirely because tty_termios_encode_baud_rate will only select a baudrate if relative error between requested and selected baudrate does not exceed +/-2%. Fix that by requesting actual, exact baudrate used by the serial.
--- drivers/tty/serial/atmel_serial.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
drivers/tty/serial/atmel_serial.c +1 -7
@@ -2673,13 +2673,7 @@ static void __init atmel_console_get_optelse if (mr ==ATMEL_US_PAR_ODD ) *parity ='o' ; -/* -* The serial core only rounds down when matching this to a -* supported baud rate. Make sure we don't end up slightly -* lower than one of those, as it would make us fall through -* to a much lower baud rate than we really want. -*/ - *baud = port->uartclk / (16 * (quot -1 )); + *baud = port->uartclk / (16 * quot); }static int __init atmel_console_setup (struct console *co,char *options)
Greg Kroah-Hartman
maintainerPATCH 127/193 serial: exar: Add support for Sealevel 7xxxC serial cards
In reply to Greg Kroah-HartmanFrom: Matthew Howell <[email protected]>
commit 14ee78d5932afeb710c8305196a676a715bfdea8 upstream.
Add support for Sealevel 7xxxC serial cards.
This patch:
* Adds IDs to recognize 7xxxC cards from Sealevel Systems.
* Updates exar_pci_probe() to set nr_ports to last two bytes of primary dev ID for these cards.
--- drivers/tty/serial/8250/8250_exar.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/tty/serial/8250/8250_exar.c +14 -0
@@ -43,6 +43,12 @@#define PCI_DEVICE_ID_EXAR_XR17V4358 0x4358#define PCI_DEVICE_ID_EXAR_XR17V8358 0x8358 +#define PCI_DEVICE_ID_SEALEVEL_710xC 0x1001 +#define PCI_DEVICE_ID_SEALEVEL_720xC 0x1002 +#define PCI_DEVICE_ID_SEALEVEL_740xC 0x1004 +#define PCI_DEVICE_ID_SEALEVEL_780xC 0x1008 +#define PCI_DEVICE_ID_SEALEVEL_716xC 0x1010 +#define UART_EXAR_INT0 0x80#define UART_EXAR_8XMODE 0x88/* 8X sampling rate select */ #define UART_EXAR_SLEEP 0x8b/* Sleep mode */
@@ -638,6 +644,8 @@ exar_pci_probe(struct pci_dev *pcidev, c nr_ports =BIT (((pcidev->device &0x38 ) >>3 ) -1 ); else if (board->num_ports) nr_ports = board->num_ports; + else if (pcidev->vendor == PCI_VENDOR_ID_SEALEVEL) + nr_ports = pcidev->device &0xff ; else nr_ports = pcidev->device &0x0f ;
@@ -864,6 +872,12 @@ static const struct pci_device_id exar_p EXAR_DEVICE(COMMTECH, 4224PCI335, pbn_fastcom335_4), EXAR_DEVICE(COMMTECH, 2324PCI335, pbn_fastcom335_4), EXAR_DEVICE(COMMTECH, 2328PCI335, pbn_fastcom335_8), + + EXAR_DEVICE(SEALEVEL, 710xC, pbn_exar_XR17V35x), + EXAR_DEVICE(SEALEVEL, 720xC, pbn_exar_XR17V35x), + EXAR_DEVICE(SEALEVEL, 740xC, pbn_exar_XR17V35x), + EXAR_DEVICE(SEALEVEL, 780xC, pbn_exar_XR17V35x), + EXAR_DEVICE(SEALEVEL, 716xC, pbn_exar_XR17V35x), { 0, } };MODULE_DEVICE_TABLE (pci, exar_pci_tbl);
Greg Kroah-Hartman
maintainerPATCH 128/193 gsmi: fix null-deref in gsmi_get_variable
In reply to Greg Kroah-HartmanFrom: Khazhismel Kumykov <[email protected]>
commit a769b05eeed7accc4019a1ed9799dd72067f1ce8 upstream.
We can get EFI variables without fetching the attribute, so we must allow for that in gsmi.
commit 859748255b43 ("efi: pstore: Omit efivars caching EFI varstore access layer") added a new get_variable call with attr=NULL, which triggers panic in gsmi.
--- drivers/firmware/google/gsmi.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/firmware/google/gsmi.c +4 -3
@@ -361,9 +361,10 @@ static efi_status_t gsmi_get_variable(efmemcpy (data, gsmi_dev.data_buf->start, *data_size);/* All variables are have the following attributes */ - *attr =EFI_VARIABLE_NON_VOLATILE | -EFI_VARIABLE_BOOTSERVICE_ACCESS | -EFI_VARIABLE_RUNTIME_ACCESS ; +if (attr) + *attr =EFI_VARIABLE_NON_VOLATILE | +EFI_VARIABLE_BOOTSERVICE_ACCESS | +EFI_VARIABLE_RUNTIME_ACCESS ; }spin_unlock_irqrestore (&gsmi_dev.lock, flags);
Greg Kroah-Hartman
maintainerPATCH 129/193 mei: bus: fix unlink on bus in error path
In reply to Greg Kroah-HartmanFrom: Alexander Usyskin <[email protected]>
commit a43866856125c3c432e2fbb6cc63cee1539ec4a7 upstream.
Unconditional call to mei_cl_unlink in mei_cl_bus_dev_release leads to call of the mei_cl_unlink without corresponding mei_cl_link. This leads to miscalculation of open_handle_count (decrease without increase).
Call unlink in mei_cldev_enable fail path and remove blanket unlink from mei_cl_bus_dev_release.
--- drivers/misc/mei/bus.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/misc/mei/bus.c +8 -4
@@ -665,13 +665,15 @@ void *mei_cldev_dma_map(struct mei_cl_deif (cl->state ==MEI_FILE_UNINITIALIZED ) { ret =mei_cl_link (cl);if (ret) - goto out; + goto notlinked;/* update pointers */ cl->cldev = cldev; } ret =mei_cl_dma_alloc_and_map (cl,NULL , buffer_id, size); -out: +if (ret) +mei_cl_unlink (cl); +notlinked:mutex_unlock (&bus->device_lock);if (ret)return ERR_PTR (ret);
@@ -721,7 +723,7 @@ int mei_cldev_enable(struct mei_cl_devicif (cl->state ==MEI_FILE_UNINITIALIZED ) { ret =mei_cl_link (cl);if (ret) - goto out; + goto notlinked;/* update pointers */ cl->cldev = cldev; }
@@ -748,6 +750,9 @@ int mei_cldev_enable(struct mei_cl_devic } out: +if (ret) +mei_cl_unlink (cl); +notlinked:mutex_unlock (&bus->device_lock);return ret;
@@ -1115,7 +1120,6 @@ static void mei_cl_bus_dev_release(strucmei_cl_flush_queues (cldev->cl,NULL );mei_me_cl_put (cldev->me_cl);mei_dev_bus_put (cldev->bus); -mei_cl_unlink (cldev->cl);kfree (cldev->cl);kfree (cldev); }
Greg Kroah-Hartman
maintainerPATCH 130/193 mei: me: add meteor lake point M DID
In reply to Greg Kroah-HartmanFrom: Alexander Usyskin <[email protected]>
commit 0c4d68261717f89fa8c4f98a6967c3832fcb3ad0 upstream.
Add Meteor Lake Point M device id.
--- drivers/misc/mei/hw-me-regs.h | 2 ++ drivers/misc/mei/pci-me.c | 2 ++ 2 files changed, 4 insertions(+)
drivers/misc/mei/hw-me-regs.h +2 -0
@@ -111,6 +111,8 @@#define MEI_DEV_ID_RPL_S 0x7A68/* Raptor Lake Point S */ +#define MEI_DEV_ID_MTL_M 0x7E70/* Meteor Lake Point M */ +/* * MEI HW Section */
drivers/misc/mei/pci-me.c +2 -0
@@ -118,6 +118,8 @@ static const struct pci_device_id mei_me {MEI_PCI_DEVICE(MEI_DEV_ID_RPL_S, MEI_ME_PCH15_CFG)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_MTL_M, MEI_ME_PCH15_CFG)}, +/* required last entry */ {0, } };
Greg Kroah-Hartman
maintainerPATCH 131/193 VMCI: Use threaded irqs instead of tasklets
In reply to Greg Kroah-HartmanFrom: Vishnu Dasa <[email protected]>
commit 3daed6345d5880464f46adab871d208e1baa2f3a upstream.
The vmci_dispatch_dgs() tasklet function calls vmci_read_data() which uses wait_event() resulting in invalid sleep in an atomic context (and therefore potentially in a deadlock).
Use threaded irqs to fix this issue and completely remove usage of tasklets.
[ 20.264639] BUG: sleeping function called from invalid context at drivers/misc/vmw_vmci/vmci_guest.c:145
[ 20.264643] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 762, name: vmtoolsd
[ 20.264645] preempt_count: 101, expected: 0
[ 20.264646] RCU nest depth: 0, expected: 0
[ 20.264647] 1 lock held by vmtoolsd/762:
[ 20.264648] #0: ffff0000874ae440 (sk_lock-AF_VSOCK){+.+.}-{0:0}, at: vsock_connect+0x60/0x330 [vsock]
[ 20.264658] Preemption disabled at:
[ 20.264659] [<ffff80000151d7d8>] vmci_send_datagram+0x44/0xa0 [vmw_vmci]
[ 20.264665] CPU: 0 PID: 762 Comm: vmtoolsd Not tainted 5.19.0-0.rc8.20220727git39c3c396f813.60.fc37.aarch64 #1
[ 20.264667] Hardware name: VMware, Inc. VBSA/VBSA, BIOS VEFI 12/31/2020
[ 20.264668] Call trace:
[ 20.264669] dump_backtrace+0xc4/0x130
[ 20.264672] show_stack+0x24/0x80
[ 20.264673] dump_stack_lvl+0x88/0xb4
[ 20.264676] dump_stack+0x18/0x34
[ 20.264677] __might_resched+0x1a0/0x280
[ 20.264679] __might_sleep+0x58/0x90
[ 20.264681] vmci_read_data+0x74/0x120 [vmw_vmci]
[ 20.264683] vmci_dispatch_dgs+0x64/0x204 [vmw_vmci]
[ 20.264686] tasklet_action_common.constprop.0+0x13c/0x150
[ 20.264688] tasklet_action+0x40/0x50
[ 20.264689] __do_softirq+0x23c/0x6b4
[ 20.264690] __irq_exit_rcu+0x104/0x214
[ 20.264691] irq_exit_rcu+0x1c/0x50
[ 20.264693] el1_interrupt+0x38/0x6c
[ 20.264695] el1h_64_irq_handler+0x18/0x24
[ 20.264696] el1h_64_irq+0x68/0x6c
[ 20.264697] preempt_count_sub+0xa4/0xe0
[ 20.264698] _raw_spin_unlock_irqrestore+0x64/0xb0
[ 20.264701] vmci_send_datagram+0x7c/0xa0 [vmw_vmci]
[ 20.264703] vmci_datagram_dispatch+0x84/0x100 [vmw_vmci]
[ 20.264706] vmci_datagram_send+0x2c/0x40 [vmw_vmci]
[ 20.264709] vmci_transport_send_control_pkt+0xb8/0x120 [vmw_vsock_vmci_transport]
[ 20.264711] vmci_transport_connect+0x40/0x7c [vmw_vsock_vmci_transport]
[ 20.264713] vsock_connect+0x278/0x330 [vsock]
[ 20.264715] __sys_connect_file+0x8c/0xc0
[ 20.264718] __sys_connect+0x84/0xb4
[ 20.264720] __arm64_sys_connect+0x2c/0x3c
[ 20.264721] invoke_syscall+0x78/0x100
[ 20.264723] el0_svc_common.constprop.0+0x68/0x124
[ 20.264724] do_el0_svc+0x38/0x4c
[ 20.264725] el0_svc+0x60/0x180
[ 20.264726] el0t_64_sync_handler+0x11c/0x150
[ 20.264728] el0t_64_sync+0x190/0x194--- drivers/misc/vmw_vmci/vmci_guest.c | 49 ++++++++++++------------------ 1 file changed, 19 insertions(+), 30 deletions(-)
drivers/misc/vmw_vmci/vmci_guest.c +19 -30
@@ -56,8 +56,6 @@ struct vmci_guest_device {bool exclusive_vectors; -struct tasklet_struct datagram_tasklet; -struct tasklet_struct bm_tasklet;struct wait_queue_head inout_wq;void *data_buffer;
@@ -304,9 +302,8 @@ static int vmci_check_host_caps(struct pci_dev *pdev)* This function assumes that it has exclusive access to the data * in register(s) for the duration of the call. */ -static void vmci_dispatch_dgs (unsigned long data) +static void vmci_dispatch_dgs (struct vmci_guest_device *vmci_dev) { -struct vmci_guest_device *vmci_dev = (struct vmci_guest_device *)data;u8 *dg_in_buffer = vmci_dev->data_buffer;struct vmci_datagram *dg;size_t dg_in_buffer_size =VMCI_MAX_DG_SIZE ;
@@ -465,10 +462,8 @@ static void vmci_dispatch_dgs(unsigned long data)* Scans the notification bitmap for raised flags, clears them * and handles the notifications. */ -static void vmci_process_bitmap (unsigned long data) +static void vmci_process_bitmap (struct vmci_guest_device *dev) { -struct vmci_guest_device *dev = (struct vmci_guest_device *)data; -if (!dev->notification_bitmap) {dev_dbg (dev->dev,"No bitmap present in %s\n" , __func__);return ;
@@ -486,13 +481,13 @@ static irqreturn_t vmci_interrupt(int irq, void *_dev)struct vmci_guest_device *dev = _dev;/* -* If we are using MSI-X with exclusive vectors then we simply schedule -* the datagram tasklet, since we know the interrupt was meant for us. +* If we are using MSI-X with exclusive vectors then we simply call +* vmci_dispatch_dgs(), since we know the interrupt was meant for us. * Otherwise we must read the ICR to determine what to do. */ if (dev->exclusive_vectors) { -tasklet_schedule (&dev->datagram_tasklet); +vmci_dispatch_dgs (dev); }else {unsigned int icr;
@@ -502,12 +497,12 @@ static irqreturn_t vmci_interrupt(int irq, void *_dev)return IRQ_NONE ;if (icr &VMCI_ICR_DATAGRAM ) { -tasklet_schedule (&dev->datagram_tasklet); +vmci_dispatch_dgs (dev); icr &= ~VMCI_ICR_DATAGRAM ; }if (icr &VMCI_ICR_NOTIFICATION ) { -tasklet_schedule (&dev->bm_tasklet); +vmci_process_bitmap (dev); icr &= ~VMCI_ICR_NOTIFICATION ; }
@@ -536,7 +531,7 @@ static irqreturn_t vmci_interrupt_bm(int irq, void *_dev)struct vmci_guest_device *dev = _dev;/* For MSI-X we can just assume it was meant for us. */ -tasklet_schedule (&dev->bm_tasklet); +vmci_process_bitmap (dev);return IRQ_HANDLED ; }
@@ -638,10 +633,6 @@ static int vmci_guest_probe_device(struct pci_dev *pdev, vmci_dev->iobase = iobase; vmci_dev->mmio_base = mmio_base; -tasklet_init (&vmci_dev->datagram_tasklet, - vmci_dispatch_dgs, (unsigned long )vmci_dev); -tasklet_init (&vmci_dev->bm_tasklet, - vmci_process_bitmap, (unsigned long )vmci_dev);init_waitqueue_head (&vmci_dev->inout_wq);if (mmio_base !=NULL ) {
@@ -808,8 +799,9 @@ static int vmci_guest_probe_device(struct pci_dev *pdev,* Request IRQ for legacy or MSI interrupts, or for first * MSI-X vector. */ - error =request_irq (pci_irq_vector (pdev,0 ), vmci_interrupt, -IRQF_SHARED ,KBUILD_MODNAME , vmci_dev); + error =request_threaded_irq (pci_irq_vector (pdev,0 ),NULL , + vmci_interrupt,IRQF_SHARED , +KBUILD_MODNAME , vmci_dev);if (error) {dev_err (&pdev->dev,"Irq %u in use: %d\n" ,pci_irq_vector (pdev,0 ), error);
@@ -823,9 +815,9 @@ static int vmci_guest_probe_device(struct pci_dev *pdev,* between the vectors. */ if (vmci_dev->exclusive_vectors) { - error =request_irq (pci_irq_vector (pdev,1 ), - vmci_interrupt_bm,0 ,KBUILD_MODNAME , - vmci_dev); + error =request_threaded_irq (pci_irq_vector (pdev,1 ),NULL , + vmci_interrupt_bm,0 , +KBUILD_MODNAME , vmci_dev);if (error) { dev_err(&pdev->dev, "Failed to allocate irq %u: %d\n",
@@ -833,9 +825,11 @@ static int vmci_guest_probe_device(struct pci_dev *pdev, goto err_free_irq; }if (caps_in_use &VMCI_CAPS_DMA_DATAGRAM ) { - error =request_irq (pci_irq_vector (pdev,2 ), - vmci_interrupt_dma_datagram, -0 ,KBUILD_MODNAME , vmci_dev); + error =request_threaded_irq (pci_irq_vector (pdev,2 ), +NULL , + vmci_interrupt_dma_datagram, +0 ,KBUILD_MODNAME , + vmci_dev);if (error) { dev_err(&pdev->dev, "Failed to allocate irq %u: %d\n",
@@ -871,8 +865,6 @@ static int vmci_guest_probe_device(struct pci_dev *pdev, err_free_irq:free_irq (pci_irq_vector (pdev,0 ), vmci_dev); -tasklet_kill (&vmci_dev->datagram_tasklet); -tasklet_kill (&vmci_dev->bm_tasklet); err_disable_msi:pci_free_irq_vectors (pdev);
@@ -943,9 +935,6 @@ static void vmci_guest_remove_device(struct pci_dev *pdev)free_irq (pci_irq_vector (pdev,0 ), vmci_dev);pci_free_irq_vectors (pdev); -tasklet_kill (&vmci_dev->datagram_tasklet); -tasklet_kill (&vmci_dev->bm_tasklet); -if (vmci_dev->notification_bitmap) {/* * The device reset above cleared the bitmap state of the
Signature · 1 line
2.39.1
Greg Kroah-Hartman
maintainerPATCH 132/193 ARM: dts: qcom: apq8084-ifc6540: fix overriding SDHCI
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
commit 0154252a3b87f77db1e44516d1ed2e82e2d29c30 upstream.
While changing node names of APQ8084 SDHCI, the ones in IFC6540 board were not updated leading to disabled and misconfigured SDHCI.
--- arch/arm/boot/dts/qcom-apq8084-ifc6540.dts | 20 ++++++++++---------- arch/arm/boot/dts/qcom-apq8084.dtsi | 4 ++-- 2 files changed, 12 insertions(+), 12 deletions(-)
arch/arm/boot/dts/qcom-apq8084-ifc6540.dts +10 -10
@@ -19,16 +19,16 @@ serial@f995e000 { status = "okay"; }; + }; +}; - sdhci@f9824900 { - bus-width = <8>; - non-removable; - status = "okay"; - }; +&sdhc_1 { + bus-width = <8>; + non-removable; + status = "okay"; +}; - sdhci@f98a4900 { - cd-gpios = <&tlmm 122 GPIO_ACTIVE_LOW>; - bus-width = <4>; - }; - }; +&sdhc_2 { + cd-gpios = <&tlmm 122 GPIO_ACTIVE_LOW>; + bus-width = <4>; };
arch/arm/boot/dts/qcom-apq8084.dtsi +2 -2
@@ -419,7 +419,7 @@ status = "disabled"; }; - mmc@f9824900 { + sdhc_1: mmc@f9824900 { compatible = "qcom,apq8084-sdhci", "qcom,sdhci-msm-v4"; reg = <0xf9824900 0x11c>, <0xf9824000 0x800>; reg-names = "hc", "core";
@@ -432,7 +432,7 @@ status = "disabled"; }; - mmc@f98a4900 { + sdhc_2: mmc@f98a4900 { compatible = "qcom,apq8084-sdhci", "qcom,sdhci-msm-v4"; reg = <0xf98a4900 0x11c>, <0xf98a4000 0x800>; reg-names = "hc", "core";
Greg Kroah-Hartman
maintainerPATCH 133/193 ARM: omap1: fix !ARCH_OMAP1_ANY link failures
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit 980a637d11fe8dfc734f508a422185c2de55e669 upstream.
While compile-testing randconfig builds for the upcoming boardfile removal, I noticed that an earlier patch of mine was completely broken, and the introduction of CONFIG_ARCH_OMAP1_ANY only replaced one set of build failures with another one, now resulting in link failures like
ld: drivers/video/fbdev/omap/omapfb_main.o: in function `omapfb_do_probe':drivers/video/fbdev/omap/omapfb_main.c:1703: undefined reference to `omap_set_dma_priority'
ld: drivers/dma/ti/omap-dma.o: in function `omap_dma_free_chan_resources':drivers/dma/ti/omap-dma.c:777: undefined reference to omap_free_dma' drivers/dma/ti/omap-dma.c:1685: undefined reference to omap_get_plat_info'
ld: drivers/usb/gadget/udc/omap_udc.o: in function `next_in_dma':drivers/usb/gadget/udc/omap_udc.c:820: undefined reference to `omap_get_dma_active_status'
I tried reworking it, but the resulting patch ended up much bigger than simply avoiding the original problem of unused-function warnings like
arch/arm/mach-omap1/mcbsp.c:76:30: error: unused variable 'omap1_mcbsp_ops' [-Werror,-Wunused-variable]
As a result, revert the previous fix, and rearrange the code that produces warnings to hide them. For mcbsp, the #ifdef check can simply be removed as the cpu_is_omapxxx() checks already achieve the same result, while in the io.c the easiest solution appears to be to merge the common map bits into each soc specific portion. This gets cleaned in a nicer way after omap7xx support gets dropped, as the remaining SoCs all have the exact same I/O map.
--- arch/arm/mach-omap1/Kconfig | 5 +---- arch/arm/mach-omap1/Makefile | 4 ---- arch/arm/mach-omap1/io.c | 32 +++++++++++++++----------------- arch/arm/mach-omap1/mcbsp.c | 21 --------------------- arch/arm/mach-omap1/pm.h | 7 ------- include/linux/soc/ti/omap1-io.h | 4 ++-- 6 files changed, 18 insertions(+), 55 deletions(-)
arch/arm/mach-omap1/Kconfig +1 -4
@@ -4,6 +4,7 @@ menuconfig ARCH_OMAP1 depends on ARCH_MULTI_V4T || ARCH_MULTI_V5 depends on CPU_LITTLE_ENDIAN depends on ATAGS + select ARCH_OMAP select ARCH_HAS_HOLES_MEMORYMODEL select ARCH_OMAP select CLKSRC_MMIO
@@ -45,10 +46,6 @@ config ARCH_OMAP16XX select CPU_ARM926T select OMAP_DM_TIMER -config ARCH_OMAP1_ANY - select ARCH_OMAP - def_bool ARCH_OMAP730 || ARCH_OMAP850 || ARCH_OMAP15XX || ARCH_OMAP16XX - config ARCH_OMAP bool
arch/arm/mach-omap1/Makefile +0 -4
@@ -3,8 +3,6 @@ # Makefile for the linux kernel. # -ifdef CONFIG_ARCH_OMAP1_ANY - # Common support obj-y := io.o id.o sram-init.o sram.o time.o irq.o mux.o flash.o \ serial.o devices.o dma.o omap-dma.o fb.o
@@ -59,5 +57,3 @@ obj-$(CONFIG_ARCH_OMAP730) += gpio7xx.o obj-$(CONFIG_ARCH_OMAP850) += gpio7xx.o obj-$(CONFIG_ARCH_OMAP15XX) += gpio15xx.o obj-$(CONFIG_ARCH_OMAP16XX) += gpio16xx.o - -endif
arch/arm/mach-omap1/io.c +15 -17
@@ -22,17 +22,14 @@* The machine specific code may provide the extra mapping besides the * default mapping provided here. */ -static struct map_desc omap_io_desc[]__initdata = { +#if defined (CONFIG_ARCH_OMAP730) || defined (CONFIG_ARCH_OMAP850) +static struct map_desc omap7xx_io_desc[] __initdata = { { .virtual = OMAP1_IO_VIRT, .pfn = __phys_to_pfn(OMAP1_IO_PHYS), .length = OMAP1_IO_SIZE, .type = MT_DEVICE - } -}; - -#if defined (CONFIG_ARCH_OMAP730) || defined (CONFIG_ARCH_OMAP850) -static struct map_desc omap7xx_io_desc[] __initdata = { + }, { .virtual = OMAP7XX_DSP_BASE, .pfn = __phys_to_pfn(OMAP7XX_DSP_START),
@@ -50,6 +47,12 @@ static struct map_desc omap7xx_io_desc[] #ifdef CONFIG_ARCH_OMAP15XX static struct map_desc omap1510_io_desc[] __initdata = { { + .virtual = OMAP1_IO_VIRT, + .pfn = __phys_to_pfn(OMAP1_IO_PHYS), + .length = OMAP1_IO_SIZE, + .type = MT_DEVICE + }, + { .virtual = OMAP1510_DSP_BASE, .pfn = __phys_to_pfn(OMAP1510_DSP_START), .length = OMAP1510_DSP_SIZE,
@@ -66,6 +69,12 @@ static struct map_desc omap1510_io_desc[ #if defined(CONFIG_ARCH_OMAP16XX) static struct map_desc omap16xx_io_desc[] __initdata = { { + .virtual = OMAP1_IO_VIRT, + .pfn = __phys_to_pfn(OMAP1_IO_PHYS), + .length = OMAP1_IO_SIZE, + .type = MT_DEVICE + }, + { .virtual = OMAP16XX_DSP_BASE, .pfn = __phys_to_pfn(OMAP16XX_DSP_START), .length = OMAP16XX_DSP_SIZE,
@@ -79,18 +88,9 @@ static struct map_desc omap16xx_io_desc[ };#endif -/* -* Maps common IO regions for omap1 -*/ -static void __init omap1_map_common_io (void ) -{ -iotable_init (omap_io_desc,ARRAY_SIZE (omap_io_desc)); -} -#if defined (CONFIG_ARCH_OMAP730 ) || defined (CONFIG_ARCH_OMAP850 )void __init omap7xx_map_io (void ) { -omap1_map_common_io ();iotable_init (omap7xx_io_desc,ARRAY_SIZE (omap7xx_io_desc)); }#endif
@@ -98,7 +98,6 @@ void __init omap7xx_map_io(void)#ifdef CONFIG_ARCH_OMAP15XX void __init omap15xx_map_io (void ) { -omap1_map_common_io ();iotable_init (omap1510_io_desc,ARRAY_SIZE (omap1510_io_desc)); }#endif
@@ -106,7 +105,6 @@ void __init omap15xx_map_io(void)#if defined(CONFIG_ARCH_OMAP16XX )void __init omap16xx_map_io (void ) { -omap1_map_common_io ();iotable_init (omap16xx_io_desc,ARRAY_SIZE (omap16xx_io_desc)); }#endif
arch/arm/mach-omap1/mcbsp.c +0 -21
@@ -89,7 +89,6 @@ static struct omap_mcbsp_ops omap1_mcbsp#define OMAP1610_MCBSP2_BASE 0xfffb1000#define OMAP1610_MCBSP3_BASE 0xe1017000 -#if defined(CONFIG_ARCH_OMAP730) || defined(CONFIG_ARCH_OMAP850)struct resource omap7xx_mcbsp_res[][6 ] = { { {
@@ -159,14 +158,7 @@ static struct omap_mcbsp_platform_data o };#define OMAP7XX_MCBSP_RES_SZ ARRAY_SIZE(omap7xx_mcbsp_res[1])#define OMAP7XX_MCBSP_COUNT ARRAY_SIZE(omap7xx_mcbsp_res) -#else -#define omap7xx_mcbsp_res_0 NULL -#define omap7xx_mcbsp_pdata NULL -#define OMAP7XX_MCBSP_RES_SZ 0 -#define OMAP7XX_MCBSP_COUNT 0 -#endif -#ifdef CONFIG_ARCH_OMAP15XXstruct resource omap15xx_mcbsp_res[][6 ] = { { {
@@ -266,14 +258,7 @@ static struct omap_mcbsp_platform_data o };#define OMAP15XX_MCBSP_RES_SZ ARRAY_SIZE(omap15xx_mcbsp_res[1])#define OMAP15XX_MCBSP_COUNT ARRAY_SIZE(omap15xx_mcbsp_res) -#else -#define omap15xx_mcbsp_res_0 NULL -#define omap15xx_mcbsp_pdata NULL -#define OMAP15XX_MCBSP_RES_SZ 0 -#define OMAP15XX_MCBSP_COUNT 0 -#endif -#ifdef CONFIG_ARCH_OMAP16XXstruct resource omap16xx_mcbsp_res[][6 ] = { { {
@@ -373,12 +358,6 @@ static struct omap_mcbsp_platform_data o };#define OMAP16XX_MCBSP_RES_SZ ARRAY_SIZE(omap16xx_mcbsp_res[1])#define OMAP16XX_MCBSP_COUNT ARRAY_SIZE(omap16xx_mcbsp_res) -#else -#define omap16xx_mcbsp_res_0 NULL -#define omap16xx_mcbsp_pdata NULL -#define OMAP16XX_MCBSP_RES_SZ 0 -#define OMAP16XX_MCBSP_COUNT 0 -#endif static void omap_mcbsp_register_board_cfg (struct resource *res,int res_count,struct omap_mcbsp_platform_data *config,int size)
arch/arm/mach-omap1/pm.h +0 -7
@@ -106,13 +106,6 @@#define OMAP7XX_IDLECT3 0xfffece24#define OMAP7XX_IDLE_LOOP_REQUEST 0x0C00 -#if !defined(CONFIG_ARCH_OMAP730 ) && \ - !defined(CONFIG_ARCH_OMAP850 ) && \ - !defined(CONFIG_ARCH_OMAP15XX ) && \ - !defined(CONFIG_ARCH_OMAP16XX ) -#warning "Power management for this processor not implemented yet" -#endif -#ifndef __ASSEMBLER__#include <linux/clk.h>
include/linux/soc/ti/omap1-io.h +2 -2
@@ -5,7 +5,7 @@#ifndef __ASSEMBLER__#include <linux/types.h> -#ifdef CONFIG_ARCH_OMAP1_ANY +#ifdef CONFIG_ARCH_OMAP1 /* * NOTE: Please use ioremap + __raw_read/write where possible instead of these */
@@ -15,7 +15,7 @@ extern u32 omap_readl(u32 pa);extern void omap_writeb (u8 v,u32 pa);extern void omap_writew (u16 v,u32 pa);extern void omap_writel (u32 v,u32 pa); -#else +#elif defined(CONFIG_COMPILE_TEST )static inline u8 omap_readb (u32 pa) {return 0 ; }static inline u16 omap_readw (u32 pa) {return 0 ; }static inline u32 omap_readl (u32 pa) {return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 134/193 drm/amdgpu: fix amdgpu_job_free_resources v2
In reply to Greg Kroah-HartmanFrom: Christian König <[email protected]>
commit 74ea8e78ab349514c9f4df0be1189d91267d750d upstream.
It can be that neither fence were initialized when we run out of UVD streams for example.
v2: fix typo breaking compile
--- drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_job.c +8 -2
@@ -154,8 +154,14 @@ void amdgpu_job_free_resources(struct amstruct dma_fence *f;unsigned i; -/* use sched fence if available */ - f = job->base.s_fence ? &job->base.s_fence->finished : &job->hw_fence; +/* Check if any fences where initialized */ +if (job->base.s_fence && job->base.s_fence->finished.ops) + f = &job->base.s_fence->finished; +else if (job->hw_fence.ops) + f = &job->hw_fence; +else + f =NULL ; +for (i =0 ; i < job->num_ibs; ++i)amdgpu_ib_free (ring->adev, &job->ibs[i], f); }
Greg Kroah-Hartman
maintainerPATCH 135/193 drm/amdgpu: allow multipipe policy on ASICs with one MEC
In reply to Greg Kroah-HartmanFrom: Lang Yu <[email protected]>
commit dc88063b87775971be564d79dc1b05f7b8b5c135 upstream.
Always enable multipipe policy on ASICs with GC VERSION > 9.0.0 instead of MEC number > 1.
This will allow multipipe policy on ASICs with one MEC, e.g., gfx11 APUs.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +3 -0
@@ -156,6 +156,9 @@ static bool amdgpu_gfx_is_compute_multipreturn amdgpu_compute_multipipe ==1 ; } +if (adev->ip_versions[GC_HWIP ][0 ] >IP_VERSION (9 ,0 ,0 )) +return true; +/* FIXME: spreading the queues across pipes causes perf regressions * on POLARIS11 compute workloads */ if (adev->asic_type ==CHIP_POLARIS11 )
Greg Kroah-Hartman
maintainerPATCH 136/193 drm/amdgpu: Correct the power calcultion for Renior/Cezanne.
In reply to Greg Kroah-HartmanFrom: jie1zhan <[email protected]>
commit c7bae4aaa5609c1fa9761c35dbcc5fcc92915222 upstream.
Quoted 1 line
From smu firmware,the value of power is transferred in units of watts.
--- drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c +6 -1
@@ -1171,6 +1171,7 @@ static int renoir_get_smu_metrics_data(sint ret =0 ;uint32_t apu_percent =0 ;uint32_t dgpu_percent =0 ; +struct amdgpu_device *adev = smu->adev; ret = smu_cmn_get_metrics_table(smu,
@@ -1196,7 +1197,11 @@ static int renoir_get_smu_metrics_data(s *value = metrics->AverageUvdActivity /100 ;break ;case METRICS_AVERAGE_SOCKETPOWER : - *value = (metrics->CurrentSocketPower <<8 ) /1000 ; +if (((adev->ip_versions[MP1_HWIP ][0 ] ==IP_VERSION (12 ,0 ,1 )) && (adev->pm.fw_version >=0x40000f )) || + ((adev->ip_versions[MP1_HWIP ][0 ] ==IP_VERSION (12 ,0 ,0 )) && (adev->pm.fw_version >=0x373200 ))) + *value = metrics->CurrentSocketPower <<8 ; +else + *value = (metrics->CurrentSocketPower <<8 ) /1000 ;break ;case METRICS_TEMPERATURE_EDGE : *value = (metrics->GfxTemperature / 100) *
Greg Kroah-Hartman
maintainerPATCH 137/193 drm/i915: re-disable RC6p on Sandy Bridge
In reply to Greg Kroah-HartmanFrom: Sasa Dragic <[email protected]>
commit 67b0b4ed259e425b7eed09da75b42c80682ca003 upstream.
RC6p on Sandy Bridge got re-enabled over time, causing visual glitches and GPU hangs.
Disabled originally in commit 1c8ecf80fdee ("drm/i915: do not enable RC6p on Sandy Bridge").
--- drivers/gpu/drm/i915/i915_pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/i915/i915_pci.c +2 -1
@@ -423,7 +423,8 @@ static const struct intel_device_info il .has_coherent_ggtt = true, \ .has_llc = 1, \ .has_rc6 = 1, \ - .has_rc6p = 1, \ +/* snb does support rc6p, but enabling it causes various issues */ \ + .has_rc6p = 0, \ .has_rps = true, \ .dma_mask_size = 40, \ .__runtime.ppgtt_type = INTEL_PPGTT_ALIASING, \
Greg Kroah-Hartman
maintainerPATCH 138/193 drm/i915/display: Check source height is > 0
In reply to Greg Kroah-HartmanFrom: Drew Davenport <[email protected]>
commit 8565c502e7c156d190d8e6d36e443f51b257f165 upstream.
The error message suggests that the height of the src rect must be at least 1. Reject source with height of 0.
--- drivers/gpu/drm/i915/display/skl_universal_plane.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/i915/display/skl_universal_plane.c +1 -1
@@ -1620,7 +1620,7 @@ static int skl_check_main_surface(structu32 offset;int ret; -if (w > max_width || w < min_width || h > max_height) { +if (w > max_width || w < min_width || h > max_height || h <1 ) {drm_dbg_kms (&dev_priv->drm,"requested Y/RGB source size %dx%d outside limits (min: %dx1 max: %dx%d)\n" , w, h, min_width, max_width, max_height);
Greg Kroah-Hartman
maintainerPATCH 139/193 drm/i915: Allow switching away via vga-switcheroo if uninitialized
In reply to Greg Kroah-HartmanFrom: Thomas Zimmermann <[email protected]>
commit a273e95721e96885971a05f1b34cb6d093904d9d upstream.
Always allow switching away via vga-switcheroo if the display is uninitalized. Instead prevent switching to i915 if the device has not been initialized.
This issue was introduced by commit 5df7bd130818 ("drm/i915: skip display initialization when there is no display") protected, which protects code paths from being executed on uninitialized devices. In the case of vga-switcheroo, we want to allow a switch away from i915's device. So run vga_switcheroo_process_delayed_switch() and test in the switcheroo callbacks if the i915 device is available.
--- drivers/gpu/drm/i915/i915_driver.c | 3 +-- drivers/gpu/drm/i915/i915_switcheroo.c | 6 +++++- 2 files changed, 6 insertions(+), 3 deletions(-)
drivers/gpu/drm/i915/i915_driver.c +1 -2
@@ -1074,8 +1074,7 @@ static void i915_driver_lastclose(structintel_fbdev_restore_mode (dev); -if (HAS_DISPLAY (i915)) -vga_switcheroo_process_delayed_switch (); +vga_switcheroo_process_delayed_switch (); }static void i915_driver_postclose (struct drm_device *dev,struct drm_file *file)
drivers/gpu/drm/i915/i915_switcheroo.c +5 -1
@@ -19,6 +19,10 @@ static void i915_switcheroo_set_state(stdev_err (&pdev->dev,"DRM not initialized, aborting switch.\n" );return ; } +if (!HAS_DISPLAY (i915)) { +dev_err (&pdev->dev,"Device state not initialized, aborting switch.\n" ); +return ; + }if (state ==VGA_SWITCHEROO_ON ) {drm_info (&i915->drm,"switched on\n" );
@@ -44,7 +48,7 @@ static bool i915_switcheroo_can_switch(s* locking inversion with the driver load path. And the access here is * completely racy anyway. So don't bother with locking for now. */ -return i915 &&atomic_read (&i915->drm.open_count) ==0 ; +return i915 &&HAS_DISPLAY (i915) &&atomic_read (&i915->drm.open_count) ==0 ; }static const struct vga_switcheroo_client_ops i915_switcheroo_ops = {
Greg Kroah-Hartman
maintainerPATCH 140/193 drm/i915: Remove unused variable
In reply to Greg Kroah-HartmanFrom: Nirmoy Das <[email protected]>
commit 2293a73ad4f3b6c37c06713ff1b67659d92ef43d upstream.
Removed unused i915 var.
--- drivers/gpu/drm/i915/i915_driver.c | 2 -- 1 file changed, 2 deletions(-)
drivers/gpu/drm/i915/i915_driver.c +0 -2
@@ -1070,8 +1070,6 @@ static int i915_driver_open(struct drm_d*/ static void i915_driver_lastclose (struct drm_device *dev) { -struct drm_i915_private *i915 =to_i915 (dev); -intel_fbdev_restore_mode (dev);vga_switcheroo_process_delayed_switch ();
Greg Kroah-Hartman
maintainerPATCH 141/193 drm/amd/display: Fix set scaling doesns work
In reply to Greg Kroah-HartmanFrom: hongao <[email protected]>
commit 040625ab82ce6dca7772cb3867fe5c9eb279a344 upstream.
[Why]
Setting scaling does not correctly update CRTC state. As a result dc stream state's src (composition area) && dest (addressable area) was not calculated as expected. This causes set scaling doesn's work.
[How]
Correctly update CRTC state when setting scaling property.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +2 -2
@@ -9433,8 +9433,8 @@ static int amdgpu_dm_atomic_check(struct goto fail; } -if (dm_old_con_state->abm_level != - dm_new_con_state->abm_level) +if (dm_old_con_state->abm_level != dm_new_con_state->abm_level || + dm_old_con_state->scaling != dm_new_con_state->scaling) new_crtc_state->connectors_changed = true; }
Greg Kroah-Hartman
maintainerPATCH 142/193 drm/amd/display: Calculate output_color_space after pixel encoding adjustment
In reply to Greg Kroah-HartmanFrom: Joshua Ashton <[email protected]>
commit 79601b894849cb6f6d6122e6590f1887ac4a66b3 upstream.
Code in get_output_color_space depends on knowing the pixel encoding to determine whether to pick between eg. COLOR_SPACE_SRGB or COLOR_SPACE_YCBCR709 for transparent RGB -> YCbCr 4:4:4 in the driver.
v2: Fixed patch being accidentally based on a personal feature branch, oops!
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +2 -2
@@ -5283,8 +5283,6 @@ static void fill_stream_properties_from_ timing_out->aspect_ratio =get_aspect_ratio (mode_in); - stream->output_color_space =get_output_color_space (timing_out); - stream->out_transfer_func->type =TF_TYPE_PREDEFINED ; stream->out_transfer_func->tf =TRANSFER_FUNCTION_SRGB ;if (stream->signal ==SIGNAL_TYPE_HDMI_TYPE_A ) {
@@ -5295,6 +5293,8 @@ static void fill_stream_properties_from_adjust_colour_depth_from_display_info (timing_out, info); } } + + stream->output_color_space =get_output_color_space (timing_out); } static void fill_audio_info(struct audio_info *audio_info,
Greg Kroah-Hartman
maintainerPATCH 143/193 drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix
In reply to Greg Kroah-HartmanFrom: Joshua Ashton <[email protected]>
commit 973a9c810c785ac270a6d50d8cf862b0c1643a10 upstream.
The YCC conversion matrix for RGB -> COLOR_SPACE_YCBCR2020_TYPE is missing the values for the fourth column of the matrix.
The fourth column of the matrix is essentially just a value that is added given that the color is 3 components in size.
These values are needed to bias the chroma from the [-1, 1] -> [0, 1] range.
This fixes color being very green when using Gamescope HDR on HDMI output which prefers YCC 4:4:4.
--- drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/core/dc_hw_sequencer.c +2 -2
@@ -90,8 +90,8 @@ static const struct out_csc_color_matrix {0xE00 ,0xF349 ,0xFEB7 ,0x1000 ,0x6CE ,0x16E3 , 0x24F, 0x200, 0xFCCB, 0xF535, 0xE00, 0x1000} }, { COLOR_SPACE_YCBCR2020_TYPE, - { 0x1000, 0xF149, 0xFEB7, 0x0000, 0x0868, 0x15B2, - 0x01E6, 0x0000, 0xFB88, 0xF478, 0x1000, 0x0000} }, + { 0x1000, 0xF149, 0xFEB7, 0x1004, 0x0868, 0x15B2, + 0x01E6, 0x201, 0xFB88, 0xF478, 0x1000, 0x1004} }, { COLOR_SPACE_YCBCR709_BLACK_TYPE, { 0x0000, 0x0000, 0x0000, 0x1000, 0x0000, 0x0000, 0x0000, 0x0200, 0x0000, 0x0000, 0x0000, 0x1000} },
Greg Kroah-Hartman
maintainerPATCH 144/193 drm/amd/display: disable S/G display on DCN 3.1.5
In reply to Greg Kroah-HartmanFrom: Alex Deucher <[email protected]>
commit e78cc6a4c7486f50c2786d91dd7d9649a87d1dcb upstream.
Causes flickering or white screens in some configurations. Disable it for now until we can fix the issue.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 - 1 file changed, 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +0 -1
@@ -1513,7 +1513,6 @@ static int amdgpu_dm_init(struct amdgpu_case IP_VERSION (3 ,1 ,2 ):case IP_VERSION (3 ,1 ,3 ):case IP_VERSION (3 ,1 ,4 ): -case IP_VERSION (3 ,1 ,5 ):case IP_VERSION (3 ,1 ,6 ): init_data.flags.gpu_vm_support = true;break ;
Greg Kroah-Hartman
maintainerPATCH 145/193 drm/amd/display: disable S/G display on DCN 3.1.4
In reply to Greg Kroah-HartmanFrom: Alex Deucher <[email protected]>
commit a52287d66dfa1cca32e6273623b63ba39d87f126 upstream.
Causes flickering or white screens in some configurations. Disable it for now until we can fix the issue.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 - 1 file changed, 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +0 -1
@@ -1512,7 +1512,6 @@ static int amdgpu_dm_init(struct amdgpu_case IP_VERSION (3 ,0 ,1 ):case IP_VERSION (3 ,1 ,2 ):case IP_VERSION (3 ,1 ,3 ): -case IP_VERSION (3 ,1 ,4 ):case IP_VERSION (3 ,1 ,6 ): init_data.flags.gpu_vm_support = true;break ;
Greg Kroah-Hartman
maintainerPATCH 146/193 cifs: reduce roundtrips on create/qinfo requests
In reply to Greg Kroah-HartmanFrom: Paulo Alcantara <[email protected]>
commit c877ce47e1378dbafa6f1bf84c0c83a05ca8972a upstream.
To work around some Window servers that return STATUS_OBJECT_NAME_INVALID on query infos under DFS namespaces that contain non-ASCII characters, we started checking for -ENOENT on every file open, and if so, then send additional requests to figure out whether it is a DFS link or not. It means that all those requests will be sent to every non-existing file.
So, in order to reduce the number of roundtrips, check earlier whether status code is STATUS_OBJECT_NAME_INVALID and tcon supports dfs, and if so, then map -ENOENT to -EREMOTE so mount or automount will take care of chasing the DFS link -- if it isn't an DFS link, then -ENOENT will be returned appropriately.
Before patch
SMB2 438 Create Request File: ada.test\dfs\foo;GetInfo Request... SMB2 310 Create Response, Error: STATUS_OBJECT_NAME_NOT_FOUND;... SMB2 228 Ioctl Request FSCTL_DFS_GET_REFERRALS, File: \ada.test\dfs\foo SMB2 143 Ioctl Response, Error: STATUS_OBJECT_PATH_NOT_FOUND SMB2 438 Create Request File: ada.test\dfs\foo;GetInfo Request... SMB2 310 Create Response, Error: STATUS_OBJECT_NAME_NOT_FOUND;... SMB2 228 Ioctl Request FSCTL_DFS_GET_REFERRALS, File: \ada.test\dfs\foo SMB2 143 Ioctl Response, Error: STATUS_OBJECT_PATH_NOT_FOUND
After patch
SMB2 438 Create Request File: ada.test\dfs\foo;GetInfo Request... SMB2 310 Create Response, Error: STATUS_OBJECT_NAME_NOT_FOUND;... SMB2 438 Create Request File: ada.test\dfs\foo;GetInfo Request... SMB2 310 Create Response, Error: STATUS_OBJECT_NAME_NOT_FOUND;...
--- fs/cifs/connect.c | 16 ---------------- fs/cifs/inode.c | 6 ------ fs/cifs/misc.c | 45 --------------------------------------------- fs/cifs/smb2inode.c | 45 ++++++++++++++++++++++++++++++++------------- fs/cifs/smb2ops.c | 28 ++++++++++++++++++++++++---- 5 files changed, 56 insertions(+), 84 deletions(-)
fs/cifs/connect.c +0 -16
@@ -3554,9 +3554,6 @@ static int is_path_remote(struct mount_cstruct cifs_tcon *tcon = mnt_ctx->tcon;struct smb3_fs_context *ctx = mnt_ctx->fs_ctx;char *full_path; -#ifdef CONFIG_CIFS_DFS_UPCALL -bool nodfs = cifs_sb->mnt_cifs_flags &CIFS_MOUNT_NO_DFS ; -#endif if (!server->ops->is_path_accessible)return -EOPNOTSUPP ;
@@ -3573,19 +3570,6 @@ static int is_path_remote(struct mount_c rc = server->ops->is_path_accessible (xid, tcon, cifs_sb, full_path); -#ifdef CONFIG_CIFS_DFS_UPCALL -if (nodfs) { -if (rc == -EREMOTE ) - rc = -EOPNOTSUPP ; - goto out; - } - -/* path *might* exist with non-ASCII characters in DFS root -* try again with full path (only if nodfs is not set) */ -if (rc == -ENOENT &&is_tcon_dfs (tcon)) - rc =cifs_dfs_query_info_nonascii_quirk (xid, tcon, cifs_sb, - full_path); -#endif if (rc !=0 && rc != -EREMOTE ) goto out;
fs/cifs/inode.c +0 -6
@@ -991,12 +991,6 @@ int cifs_get_inode_info(struct inode **i } rc = server->ops->query_path_info (xid, tcon, cifs_sb, full_path, &tmp_data, &adjust_tz, &is_reparse_point); -#ifdef CONFIG_CIFS_DFS_UPCALL -if (rc == -ENOENT &&is_tcon_dfs (tcon)) - rc =cifs_dfs_query_info_nonascii_quirk (xid, tcon, - cifs_sb, - full_path); -#endif data = &tmp_data; }
fs/cifs/misc.c +0 -45
49 lines not on this page · raw message
fs/cifs/smb2inode.c +32 -13
54 lines not on this page · raw message
fs/cifs/smb2ops.c +24 -4
@@ -797,7 +797,9 @@ smb2_is_path_accessible(const unsigned iint rc;__le16 *utf16_path;__u8 oplock =SMB2_OPLOCK_LEVEL_NONE ; +int err_buftype =CIFS_NO_BUFFER ;struct cifs_open_parms oparms; +struct kvec err_iov = {};struct cifs_fid fid;struct cached_fid *cfid;
@@ -821,14 +823,32 @@ smb2_is_path_accessible(const unsigned i oparms.fid = &fid; oparms.reconnect = false; - rc =SMB2_open (xid, &oparms, utf16_path, &oplock,NULL ,NULL ,NULL , -NULL ); + rc =SMB2_open (xid, &oparms, utf16_path, &oplock,NULL ,NULL , + &err_iov, &err_buftype);if (rc) { -kfree (utf16_path); -return rc; +struct smb2_hdr *hdr = err_iov.iov_base; + +if (unlikely (!hdr || err_buftype ==CIFS_NO_BUFFER )) + goto out; +/* +* Handle weird Windows SMB server behaviour. It responds with +* STATUS_OBJECT_NAME_INVALID code to SMB2 QUERY_INFO request +* for "\<server>\<dfsname>\<linkpath>" DFS reference, +* where <dfsname> contains non-ASCII unicode symbols. +*/ +if (rc != -EREMOTE &&IS_ENABLED (CONFIG_CIFS_DFS_UPCALL ) && + hdr->Status ==STATUS_OBJECT_NAME_INVALID ) + rc = -EREMOTE ; +if (rc == -EREMOTE &&IS_ENABLED (CONFIG_CIFS_DFS_UPCALL ) && cifs_sb && + (cifs_sb->mnt_cifs_flags &CIFS_MOUNT_NO_DFS )) + rc = -EOPNOTSUPP ; + goto out; } rc =SMB2_close (xid, tcon, fid.persistent_fid, fid.volatile_fid); + +out: +free_rsp_buf (err_buftype, err_iov.iov_base);kfree (utf16_path);return rc; }
Greg Kroah-Hartman
maintainerPATCH 147/193 fs/ntfs3: Fix attr_punch_hole() null pointer derenference
In reply to Greg Kroah-HartmanFrom: Alon Zahavi <[email protected]>
commit 6d5c9e79b726cc473d40e9cb60976dbe8e669624 upstream.
The bug occours due to a misuse of attr variable instead of attr_b. attr is being initialized as NULL, then being derenfernced as attr->res.data_size.
This bug causes a crash of the ntfs3 driver itself,
If compiled directly to the kernel, it crashes the whole system.
--- fs/ntfs3/attrib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ntfs3/attrib.c +1 -1
@@ -2038,7 +2038,7 @@ int attr_punch_hole(struct ntfs_inode *nreturn -ENOENT ;if (!attr_b->non_res) { -u32 data_size =le32_to_cpu (attr->res.data_size); +u32 data_size =le32_to_cpu (attr_b->res.data_size);u32 from, to;if (vbo > data_size)
Greg Kroah-Hartman
maintainerPATCH 148/193 arm64: efi: Execute runtime services from a dedicated stack
In reply to Greg Kroah-HartmanFrom: Ard Biesheuvel <[email protected]>
commit ff7a167961d1b97e0e205f245f806e564d3505e7 upstream.
With the introduction of PRMT in the ACPI subsystem, the EFI rts workqueue is no longer the only caller of efi_call_virt_pointer() in the kernel. This means the EFI runtime services lock is no longer sufficient to manage concurrent calls into firmware, but also that firmware calls may occur that are not marshalled via the workqueue mechanism, but originate directly from the caller context.
For added robustness, and to ensure that the runtime services have 8 KiB of stack space available as per the EFI spec, introduce a spinlock protected EFI runtime stack of 8 KiB, where the spinlock also ensures serialization between the EFI rts workqueue (which itself serializes EFI runtime calls) and other callers of efi_call_virt_pointer().
While at it, use the stack pivot to avoid reloading the shadow call stack pointer from the ordinary stack, as doing so could produce a gadget to defeat it.
--- arch/arm64/include/asm/efi.h | 3 +++ arch/arm64/kernel/efi-rt-wrapper.S | 13 ++++++++++++- arch/arm64/kernel/efi.c | 27 +++++++++++++++++++++++++++ 3 files changed, 42 insertions(+), 1 deletion(-)
arch/arm64/include/asm/efi.h +3 -0
@@ -25,6 +25,7 @@ int efi_set_mapping_permissions(struct m ({ \efi_virtmap_load (); \__efi_fpsimd_begin (); \ +spin_lock (&efi_rt_lock); \ })#undef arch_efi_call_virt
@@ -33,10 +34,12 @@ int efi_set_mapping_permissions(struct m#define arch_efi_call_virt_teardown () \ ({ \ + spin_unlock(&efi_rt_lock); \ __efi_fpsimd_end(); \ efi_virtmap_unload(); \ }) +extern spinlock_t efi_rt_lock;efi_status_t __efi_rt_asm_wrapper (void *,const char *, ...);#define ARCH_EFI_IRQ_FLAGS_MASK (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT)
arch/arm64/kernel/efi-rt-wrapper.S +12 -1
@@ -16,6 +16,12 @@ SYM_FUNC_START(__efi_rt_asm_wrapper) */ stp x1, x18, [sp, #16] + ldr_l x16, efi_rt_stack_top + mov sp, x16 +#ifdef CONFIG_SHADOW_CALL_STACK + str x18, [sp, #-16]! +#endif + /* * We are lucky enough that no EFI runtime services take more than * 5 arguments, so all are passed in registers rather than via the
@@ -29,6 +35,7 @@ SYM_FUNC_START(__efi_rt_asm_wrapper) mov x4, x6 blr x8 + mov sp, x29 ldp x1, x2, [sp, #16] cmp x2, x18 ldp x29, x30, [sp], #32
@@ -42,6 +49,10 @@ SYM_FUNC_START(__efi_rt_asm_wrapper) * called with preemption disabled and a separate shadow stack is used * for interrupts. */ - mov x18, x2 +#ifdef CONFIG_SHADOW_CALL_STACK + ldr_l x18, efi_rt_stack_top + ldr x18, [x18, #-16] +#endif + b efi_handle_corrupted_x18 // tail call SYM_FUNC_END(__efi_rt_asm_wrapper)
arch/arm64/kernel/efi.c +27 -0
@@ -144,3 +144,30 @@ asmlinkage efi_status_t efi_handle_corrupr_err_ratelimited (FW_BUG "register x18 corrupted by EFI %s\n" , f);return s; } + +DEFINE_SPINLOCK (efi_rt_lock); + +asmlinkage u64 *efi_rt_stack_top __ro_after_init; + +/* EFI requires 8 KiB of stack space for runtime services */ +static_assert (THREAD_SIZE >=SZ_8K ); + +static int __init arm64_efi_rt_init (void ) +{ +void *p; + +if (!efi_enabled (EFI_RUNTIME_SERVICES )) +return 0 ; + + p =__vmalloc_node (THREAD_SIZE ,THREAD_ALIGN ,GFP_KERNEL , +NUMA_NO_NODE , &&l); +l:if (!p) { +pr_warn ("Failed to allocate EFI runtime stack\n" ); +clear_bit (EFI_RUNTIME_SERVICES , &efi.flags); +return -ENOMEM ; + } + + efi_rt_stack_top = p +THREAD_SIZE ; +return 0 ; +} +core_initcall (arm64_efi_rt_init);
Greg Kroah-Hartman
maintainerPATCH 149/193 efi: rt-wrapper: Add missing include
In reply to Greg Kroah-HartmanFrom: Ard Biesheuvel <[email protected]>
commit 18bba1843fc7f264f58c9345d00827d082f9c558 upstream.
Add the missing #include of asm/assembler.h, which is where the ldr_l macro is defined.
--- arch/arm64/kernel/efi-rt-wrapper.S | 1 + 1 file changed, 1 insertion(+)
arch/arm64/kernel/efi-rt-wrapper.S +1 -0
@@ -4,6 +4,7 @@ */ #include <linux/linkage.h> +#include <asm/assembler.h> SYM_FUNC_START(__efi_rt_asm_wrapper) stp x29, x30, [sp, #-32]!
Greg Kroah-Hartman
maintainerPATCH 150/193 panic: Separate sysctl logic from CONFIG_SMP
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
commit 9360d035a579d95d1e76c471061b9065b18a0eb1 upstream.
In preparation for adding more sysctls directly in kernel/panic.c, split CONFIG_SMP from the logic that adds sysctls.
--- kernel/panic.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/panic.c +3 -1
@@ -75,8 +75,9 @@ ATOMIC_NOTIFIER_HEAD(panic_notifier_listEXPORT_SYMBOL (panic_notifier_list); -#if defined(CONFIG_SMP) && defined(CONFIG_SYSCTL) +#ifdef CONFIG_SYSCTL static struct ctl_table kern_panic_table[] = { +#ifdef CONFIG_SMP { .procname = "oops_all_cpu_backtrace", .data = &sysctl_oops_all_cpu_backtrace,
@@ -86,6 +87,7 @@ static struct ctl_table kern_panic_table .extra1 = SYSCTL_ZERO, .extra2 = SYSCTL_ONE, }, +#endif { } };
Greg Kroah-Hartman
maintainerPATCH 151/193 exit: Put an upper limit on how often we can oops
In reply to Greg Kroah-HartmanFrom: Jann Horn <[email protected]>
commit d4ccd54d28d3c8598e2354acc13e28c060961dbb upstream.
Many Linux systems are configured to not panic on oops; but allowing an attacker to oops the system **really** often can make even bugs that look completely unexploitable exploitable (like NULL dereferences and such) if each crash elevates a refcount by one or a lock is taken in read mode, and this causes a counter to eventually overflow.
The most interesting counters for this are 32 bits wide (like open-coded refcounts that don't use refcount_t). (The ldsem reader count on 32-bit platforms is just 16 bits, but probably nobody cares about 32-bit platforms that much nowadays.)
So let's panic the system if the kernel is constantly oopsing.
The speed of oopsing 2^32 times probably depends on several factors, like how long the stack trace is and which unwinder you're using; an empirically important one is whether your console is showing a graphical environment or a text console that oopses will be printed to.
In a quick single-threaded benchmark, it looks like oopsing in a vfork() child with a very short stack trace only takes ~510 microseconds per run when a graphical console is active; but switching to a text console that oopses are printed to slows it down around 87x, to ~45 milliseconds per run.
(Adding more threads makes this faster, but the actual oops printing happens under &die_lock on x86, so you can maybe speed this up by a factor of around 2 and then any further improvement gets eaten up by lock contention.)
It looks like it would take around 8-12 days to overflow a 32-bit counter with repeated oopsing on a multi-core X86 system running a graphical environment; both me (in an X86 VM) and Seth (with a distro kernel on normal hardware in a standard configuration) got numbers in that ballpark.
12 days aren't *that* short on a desktop system, and you'd likely need much longer on a typical server system (assuming that people don't run graphical desktop environments on their servers), and this is a *very* noisy and violent approach to exploiting the kernel; and it also seems to take orders of magnitude longer on some machines, probably because stuff like EFI pstore will slow it down a ton if that's active.
--- Documentation/admin-guide/sysctl/kernel.rst | 8 +++++ kernel/exit.c | 42 ++++++++++++++++++++++++++++ 2 files changed, 50 insertions(+)
Documentation/admin-guide/sysctl/kernel.rst +8 -0
@@ -667,6 +667,14 @@ This is the default behavior. an oops event is detected. +oops_limit +========== + +Number of kernel oopses after which the kernel should panic when +``panic_on_oops`` is not set. Setting this to 0 or 1 has the same effect +as setting ``panic_on_oops=1``. + + osrelease, ostype & version ===========================
kernel/exit.c +42 -0
60 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 152/193 exit: Expose "oops_count" to sysfs
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
commit 9db89b41117024f80b38b15954017fb293133364 upstream.
Since Oops count is now tracked and is a fairly interesting signal, add the entry /sys/kernel/oops_count to expose it to userspace.
--- Documentation/ABI/testing/sysfs-kernel-oops_count | 6 ++++++ MAINTAINERS | 1 + kernel/exit.c | 22 ++++++++++++++++++++-- 3 files changed, 27 insertions(+), 2 deletions(-) create mode 100644 Documentation/ABI/testing/sysfs-kernel-oops_count
Documentation/ABI/testing/sysfs-kernel-oops_count new file +6 -0
@@ -0,0 +1,6 @@ +What: /sys/kernel/oops_count +Date: November 2022 +KernelVersion: 6.2.0 +Contact: Linux Kernel Hardening List <[email protected]> +Description: + Shows how many times the system has Oopsed since last boot.
MAINTAINERS +1 -0
@@ -11112,6 +11112,7 @@ M: Kees Cook <[email protected]> L: [email protected] S: Supported T: git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/hardening +F: Documentation/ABI/testing/sysfs-kernel-oops_count F: include/linux/overflow.h F: include/linux/randomize_kstack.h F: mm/usercopy.c
kernel/exit.c +20 -2
@@ -67,6 +67,7 @@#include <linux/io_uring.h> #include <linux/kprobes.h> #include <linux/rethook.h> +#include <linux/sysfs.h> #include <linux/uaccess.h> #include <asm/unistd.h>
@@ -99,6 +100,25 @@ static __init int kernel_exit_sysctls_inlate_initcall (kernel_exit_sysctls_init);#endif +static atomic_t oops_count =ATOMIC_INIT (0 ); + +#ifdef CONFIG_SYSFS +static ssize_t oops_count_show (struct kobject *kobj,struct kobj_attribute *attr, +char *page) +{ +return sysfs_emit (page,"%d\n" ,atomic_read (&oops_count)); +} + +static struct kobj_attribute oops_count_attr =__ATTR_RO (oops_count); + +static __init int kernel_exit_sysfs_init (void ) +{ +sysfs_add_file_to_group (kernel_kobj, &oops_count_attr.attr,NULL ); +return 0 ; +} +late_initcall (kernel_exit_sysfs_init); +#endif +static void __unhash_process (struct task_struct *p,bool group_dead) { nr_threads--;
@@ -901,8 +921,6 @@ void __noreturn do_exit(long code)void __noreturn make_task_dead (int signr) { -static atomic_t oops_count =ATOMIC_INIT (0 ); -/* * Take the task off the cpu after something catastrophic has * happened.
Greg Kroah-Hartman
maintainerPATCH 153/193 exit: Allow oops_limit to be disabled
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
commit de92f65719cd672f4b48397540b9f9eff67eca40 upstream.
In preparation for keeping oops_limit logic in sync with warn_limit, have oops_limit == 0 disable checking the Oops counter.
--- Documentation/admin-guide/sysctl/kernel.rst | 5 +++-- kernel/exit.c | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-)
Documentation/admin-guide/sysctl/kernel.rst +3 -2
@@ -671,8 +671,9 @@ oops_limit ========== Number of kernel oopses after which the kernel should panic when -``panic_on_oops`` is not set. Setting this to 0 or 1 has the same effect -as setting ``panic_on_oops=1``. +``panic_on_oops`` is not set. Setting this to 0 disables checking +the count. Setting this to 1 has the same effect as setting +``panic_on_oops=1``. The default value is 10000. osrelease, ostype & version
kernel/exit.c +1 -1
@@ -954,7 +954,7 @@ void __noreturn make_task_dead(int signr* To make sure this can't happen, place an upper bound on how often the * kernel may oops without panic(). */ -if (atomic_inc_return (&oops_count) >=READ_ONCE (oops_limit)) +if (atomic_inc_return (&oops_count) >=READ_ONCE (oops_limit) && oops_limit)panic ("Oopsed too often (kernel.oops_limit is %d)" , oops_limit);/*
Greg Kroah-Hartman
maintainerPATCH 154/193 panic: Consolidate open-coded panic_on_warn checks
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
commit 79cc1ba7badf9e7a12af99695a557e9ce27ee967 upstream.
Several run-time checkers (KASAN, UBSAN, KFENCE, KCSAN, sched) roll their own warnings, and each check "panic_on_warn". Consolidate this into a single function so that future instrumentation can be added in a single location.
--- include/linux/panic.h | 1 + kernel/kcsan/report.c | 3 +-- kernel/panic.c | 9 +++++++-- kernel/sched/core.c | 3 +-- lib/ubsan.c | 3 +-- mm/kasan/report.c | 4 ++-- mm/kfence/report.c | 3 +-- 7 files changed, 14 insertions(+), 12 deletions(-)
include/linux/panic.h +1 -0
@@ -11,6 +11,7 @@ extern long (*panic_blink)(int state); __printf(1, 2)void panic (const char *fmt, ...)__noreturn __cold ;void nmi_panic (struct pt_regs *regs,const char *msg); +void check_panic_on_warn (const char *origin);extern void oops_enter (void );extern void oops_exit (void );extern bool oops_may_print (void );
kernel/kcsan/report.c +1 -2
@@ -492,8 +492,7 @@ static void print_report(enum kcsan_valudump_stack_print_info (KERN_DEFAULT );pr_err ("==================================================================\n" ); -if (panic_on_warn) -panic ("panic_on_warn set ...\n" ); +check_panic_on_warn ("KCSAN" ); }static void release_report (unsigned long *flags,struct other_info *other_info)
kernel/panic.c +7 -2
@@ -201,6 +201,12 @@ static void panic_print_sys_info(bool coftrace_dump (DUMP_ALL ); } +void check_panic_on_warn (const char *origin) +{ +if (panic_on_warn) +panic ("%s: panic_on_warn set ...\n" , origin); +} +/** * panic - halt the system * @fmt: The text string to print
@@ -619,8 +625,7 @@ void __warn(const char *file, int line,if (regs)show_regs (regs); -if (panic_on_warn) -panic ("panic_on_warn set ...\n" ); +check_panic_on_warn ("kernel" );if (!regs)dump_stack ();
kernel/sched/core.c +1 -2
@@ -5778,8 +5778,7 @@ static noinline void __schedule_bug(strupr_err ("Preemption disabled at:" );print_ip_sym (KERN_ERR , preempt_disable_ip); } -if (panic_on_warn) -panic ("scheduling while atomic\n" ); +check_panic_on_warn ("scheduling while atomic" );dump_stack ();add_taint (TAINT_WARN ,LOCKDEP_STILL_OK );
lib/ubsan.c +1 -2
@@ -154,8 +154,7 @@ static void ubsan_epilogue(void) current->in_ubsan--; -if (panic_on_warn) -panic ("panic_on_warn set ...\n" ); +check_panic_on_warn ("UBSAN" ); }void __ubsan_handle_divrem_overflow (void *_data,void *lhs,void *rhs)
mm/kasan/report.c +2 -2
@@ -164,8 +164,8 @@ static void end_report(unsigned long *fl (unsigned long)addr);pr_err ("==================================================================\n" );spin_unlock_irqrestore (&report_lock, *flags); -if (panic_on_warn && !test_bit (KASAN_BIT_MULTI_SHOT , &kasan_flags)) -panic ("panic_on_warn set ...\n" ); +if (!test_bit (KASAN_BIT_MULTI_SHOT , &kasan_flags)) +check_panic_on_warn ("KASAN" );if (kasan_arg_fault ==KASAN_ARG_FAULT_PANIC )panic ("kasan.fault=panic set ...\n" );add_taint (TAINT_BAD_PAGE ,LOCKDEP_NOW_UNRELIABLE );
mm/kfence/report.c +1 -2
@@ -273,8 +273,7 @@ void kfence_report_error(unsigned long alockdep_on (); -if (panic_on_warn) -panic ("panic_on_warn set ...\n" ); +check_panic_on_warn ("KFENCE" );/* We encountered a memory safety error, taint the kernel! */ add_taint (TAINT_BAD_PAGE ,LOCKDEP_STILL_OK );