5.4.231-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 5.4.231-rc1 review
This is the start of the stable review cycle for the 5.4.231 release. There are 134 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 05 Feb 2023 10:09:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.231-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.4.231-rc1
Greg Kroah-Hartman <[email protected]>
Revert "xprtrdma: Fix regbuf data not freed in rpcrdma_req_create()"
Peter Chen <[email protected]>
usb: host: xhci-plat: add wakeup entry at sysfs
Soenke Huster <[email protected]>
Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt
Eric Dumazet <[email protected]>
ipv6: ensure sane device mtu in tunnels
Kees Cook <[email protected]>
exit: Use READ_ONCE() for all oops/warn limit reads
Kees Cook <[email protected]>
docs: Fix path paste-o for /sys/kernel/warn_count
Kees Cook <[email protected]>
panic: Expose "warn_count" to sysfs
Kees Cook <[email protected]>
panic: Introduce warn_limit
Kees Cook <[email protected]>
panic: Consolidate open-coded panic_on_warn checks
Kees Cook <[email protected]>
exit: Allow oops_limit to be disabled
Kees Cook <[email protected]>
exit: Expose "oops_count" to sysfs
Jann Horn <[email protected]>
exit: Put an upper limit on how often we can oops
Randy Dunlap <[email protected]>
ia64: make IA64_MCA_RECOVERY bool instead of tristate
Nathan Chancellor <[email protected]>
csky: Fix function name in csky_alignment() and die()
Nathan Chancellor <[email protected]>
h8300: Fix build errors from do_exit() to make_task_dead() transition
Nathan Chancellor <[email protected]>
hexagon: Fix function name in die()
Eric W. Biederman <[email protected]>
objtool: Add a missing comma to avoid string concatenation
Eric W. Biederman <[email protected]>
exit: Add and use make_task_dead.
David Gow <[email protected]>
mm: kasan: do not panic if both panic_on_warn and kasan_multishot set
Tiezhu Yang <[email protected]>
panic: unset panic_on_warn inside panic()
Xiaoming Ni <[email protected]>
sysctl: add a new register_sysctl_init() interface
Hui Wang <[email protected]>
dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
Yu Kuai <[email protected]>
blk-cgroup: fix missing pd_online_fn() while activating policy
Hao Sun <[email protected]>
bpf: Skip task with pid=1 in send_signal_common()
Geert Uytterhoeven <[email protected]>
ARM: dts: imx: Fix pca9547 i2c-mux node name
Mikulas Patocka <[email protected]>
x86/asm: Fix an assembler warning with current binutils
Uwe Kleine-König <[email protected]>
clk: Fix pointer casting to prevent oops in devm_clk_release()
Colin Ian King <[email protected]>
perf/x86/amd: fix potential integer overflow on shift of a int
Sriram Yagnaraman <[email protected]>
netfilter: conntrack: unify established states for SCTP paths
Thomas Gleixner <[email protected]>
x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL
Christoph Hellwig <[email protected]>
block: fix and cleanup bio_check_ro
Trond Myklebust <[email protected]>
nfsd: Ensure knfsd shuts down when the "nfsd" pseudofs is unmounted
Dmitry Torokhov <[email protected]>
Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode"
Jerome Brunet <[email protected]>
net: mdio-mux-meson-g12a: force internal PHY off on mux switch
Andrew Lunn <[email protected]>
net: xgene: Move shared header file into include/linux
Andrew Lunn <[email protected]>
net/phy/mdio-i2c: Move header file to include/linux/mdio
David Christensen <[email protected]>
net/tg3: resolve deadlock in tg3_reset_task() during EEH
Rafael J. Wysocki <[email protected]>
thermal: intel: int340x: Add locking to int340x_thermal_get_trip_type()
Yoshihiro Shimoda <[email protected]>
net: ravb: Fix possible hang if RIS2_QFF1 happen
Marcelo Ricardo Leitner <[email protected]>
sctp: fail if no bound addresses can be used for a given scope
Eric Dumazet <[email protected]>
net/sched: sch_taprio: do not schedule in taprio_reset()
Kuniyuki Iwashima <[email protected]>
netrom: Fix use-after-free of a listening socket.
Sriram Yagnaraman <[email protected]>
netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE
Eric Dumazet <[email protected]>
ipv4: prevent potential spectre v1 gadget in fib_metrics_match()
Eric Dumazet <[email protected]>
ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()
Eric Dumazet <[email protected]>
netlink: annotate data races around sk_state
Eric Dumazet <[email protected]>
netlink: annotate data races around dst_portid and dst_group
Eric Dumazet <[email protected]>
netlink: annotate data races around nlk->portid
Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_rbtree: skip elements in transaction from garbage collection
Paolo Abeni <[email protected]>
net: fix UaF in netns ops registration error path
Eric Dumazet <[email protected]>
netlink: prevent potential spectre v1 gadgets
Manivannan Sadhasivam <[email protected]>
EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info
Manivannan Sadhasivam <[email protected]>
EDAC/device: Respect any driver-supplied workqueue polling value
Giulio Benetti <[email protected]>
ARM: 9280/1: mm: fix warning on phys_addr_t to void pointer assignment
Srinivas Pandruvada <[email protected]>
thermal: intel: int340x: Protect trip temperature from concurrent updates
Hendrik Borghorst <[email protected]>
KVM: x86/vmx: Do not skip segment attributes if unusable bit is set
David Howells <[email protected]>
cifs: Fix oops due to uncleared server->smbd_conn in reconnect
Steven Rostedt (Google) <[email protected]>
ftrace/scripts: Update the instructions for ftrace-bisect.sh
Natalia Petrova <[email protected]>
trace_events_hist: add check for return value of 'create_hist_field'
Steven Rostedt (Google) <[email protected]>
tracing: Make sure trace_printk() can output as soon as it can be used
Petr Pavlu <[email protected]>
module: Don't wait for GOING modules
Alexey V. Vissarionov <[email protected]>
scsi: hpsa: Fix allocation size for scsi_host_alloc()
Archie Pusaka <[email protected]>
Bluetooth: hci_sync: cancel cmd_timer if hci_open failed
Sasha Levin <[email protected]>
Revert "Revert "xhci: Set HCD flag to defer primary roothub registration""
Dongliang Mu <[email protected]>
fs: reiserfs: remove useless new_opts in reiserfs_remount
Florian Westphal <[email protected]>
netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state
Sasha Levin <[email protected]>
Revert "selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID"
Haibo Chen <[email protected]>
mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting
Haibo Chen <[email protected]>
mmc: sdhci-esdhc-imx: disable the CMD CRC check for standard tuning
Haibo Chen <[email protected]>
mmc: sdhci-esdhc-imx: clear pending interrupt and halt cqhci
Mateusz Guzik <[email protected]>
lockref: stop doing cpu_relax in the cmpxchg loop
Hans de Goede <[email protected]>
platform/x86: asus-nb-wmi: Add alternate mapping for KEY_SCREENLOCK
Michael Klein <[email protected]>
platform/x86: touchscreen_dmi: Add info for the CSL Panther Tab HD
Yihang Li <[email protected]>
scsi: hisi_sas: Set a port invalid only if there are no devices attached when refreshing port id
Heiko Carstens <[email protected]>
KVM: s390: interrupt: use READ_ONCE() before cmpxchg()
Bartosz Golaszewski <[email protected]>
spi: spidev: remove debug messages that access spidev->spi without locking
Mark Brown <[email protected]>
ASoC: fsl-asoc-card: Fix naming of AC'97 CODEC widgets
Mark Brown <[email protected]>
ASoC: fsl_ssi: Rename AC'97 streams to avoid collisions with AC'97 CODEC
Miles Chen <[email protected]>
cpufreq: armada-37xx: stop using 0 as NULL pointer
Niklas Schnelle <[email protected]>
s390/debug: add _ASM_S390_ prefix to header guard
Patrick Thompson <[email protected]>
drm: Add orientation quirk for Lenovo ideapad D330-10IGL
Chancel Liu <[email protected]>
ASoC: fsl_micfil: Correct the number of steps on SX controls
Sumit Gupta <[email protected]>
cpufreq: Add Tegra234 to cpufreq-dt-platdev blocklist
David Morley <[email protected]>
tcp: fix rate_app_limited to default to 1
Rakesh Sankaranarayanan <[email protected]>
net: dsa: microchip: ksz9477: port map correction in ALU table entry register
Chen Zhongjin <[email protected]>
driver core: Fix test_async_probe_init saves device in wrong array
Yang Yingliang <[email protected]>
w1: fix WARNING after calling w1_process()
Yang Yingliang <[email protected]>
w1: fix deadloop in __w1_remove_master_device()
Jason Xing <[email protected]>
tcp: avoid the lookup process failing to get sk in ehash table
Liu Shixin <[email protected]>
dmaengine: xilinx_dma: call of_node_put() when breaking out of for_each_child_of_node()
Swati Agarwal <[email protected]>
dmaengine: xilinx_dma: Fix devm_platform_ioremap_resource error handling
Radhey Shyam Pandey <[email protected]>
dmaengine: xilinx_dma: use devm_platform_ioremap_resource()
Pietro Borrello <[email protected]>
HID: betop: check shape of output reports
Robert Hancock <[email protected]>
net: macb: fix PTP TX timestamp failure due to packet padding
Koba Ko <[email protected]>
dmaengine: Fix double increment of client_count in dma_chan_get()
Arnd Bergmann <[email protected]>
drm/panfrost: fix GENERIC_ATOMIC64 dependency
Randy Dunlap <[email protected]>
net: mlx5: eliminate anonymous module_init & module_exit
Udipto Goswami <[email protected]>
usb: gadget: f_fs: Ensure ep0req is dequeued before free_request
Udipto Goswami <[email protected]>
usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
Jiri Kosina <[email protected]>
HID: revert CHERRY_MOUSE_000C quirk
Heiner Kallweit <[email protected]>
net: stmmac: fix invalid call to mdiobus_get_phy()
Pietro Borrello <[email protected]>
HID: check empty report_list in bigben_probe()
Pietro Borrello <[email protected]>
HID: check empty report_list in hid_validate_values()
Heiner Kallweit <[email protected]>
net: mdio: validate parameter addr in mdiobus_get_phy()
Szymon Heidrich <[email protected]>
net: usb: sr9700: Handle negative len
Jakub Sitnicki <[email protected]>
l2tp: Don't sleep and disable BH under writer-side sk_callback_lock
Jakub Sitnicki <[email protected]>
l2tp: Serialize access to sk_user_data with sk_callback_lock
Gong, Sishuai <[email protected]>
net: fix a concurrency bug in l2tp_tunnel_register()
Eric Dumazet <[email protected]>
net/sched: sch_taprio: fix possible use-after-free
Szymon Heidrich <[email protected]>
wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid
Marek Vasut <[email protected]>
gpio: mxc: Always set GPIOs used as interrupt source to INPUT mode
Esina Ekaterina <[email protected]>
net: wan: Add checks for NULL for utdm in undo_uhdlc_init and unmap_si_regs
Jisoo Jang <[email protected]>
net: nfc: Fix use-after-free in local_cleanup()
Shang XiaoJing <[email protected]>
phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on()
Luis Gerhorst <[email protected]>
bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
Raju Rangoju <[email protected]>
amd-xgbe: Delay AN timeout during KR training
Raju Rangoju <[email protected]>
amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent
Alexander Potapenko <[email protected]>
affs: initialize fsdata in affs_truncate()
Dean Luick <[email protected]>
IB/hfi1: Fix expected receive setup error exit issues
Dean Luick <[email protected]>
IB/hfi1: Reserve user expected TIDs
Dean Luick <[email protected]>
IB/hfi1: Reject a zero-length user expected buffer
Yonatan Nachum <[email protected]>
RDMA/core: Fix ib block iterator counter overflow
Masahiro Yamada <[email protected]>
tomoyo: fix broken dependency on *.conf.default
Miaoqian Lin <[email protected]>
EDAC/highbank: Fix memory leak in highbank_mc_probe()
Jiasheng Jiang <[email protected]>
HID: intel_ish-hid: Add check for ishtp_dma_tx_map
Dario Binacchi <[email protected]>
ARM: imx: add missing of_node_put()
Fabio Estevam <[email protected]>
ARM: imx35: Retrieve the IIM base address from devicetree
Fabio Estevam <[email protected]>
ARM: imx31: Retrieve the IIM base address from devicetree
Fabio Estevam <[email protected]>
ARM: imx27: Retrieve the SYSCTRL base address from devicetree
Fabio Estevam <[email protected]>
ARM: dts: imx6qdl-gw560x: Remove incorrect 'uart-has-rtscts'
Gaosheng Cui <[email protected]>
memory: mvebu-devbus: Fix missing clk_disable_unprepare in mvebu_devbus_probe()
Gaosheng Cui <[email protected]>
memory: atmel-sdramc: Fix missing clk_disable_unprepare in atmel_ramc_probe()
Uwe Kleine-König <[email protected]>
clk: Provide new devm_clk helpers for prepared and enabled clocks
Uwe Kleine-König <[email protected]>
clk: generalize devm_clk_get() a bit
-------------
Diffstat:
Documentation/ABI/testing/sysfs-kernel-oops_count | 6 ++
Documentation/ABI/testing/sysfs-kernel-warn_count | 6 ++
Documentation/admin-guide/sysctl/kernel.rst | 19 ++++
MAINTAINERS | 1 +
Makefile | 4 +-
arch/alpha/kernel/traps.c | 6 +-
arch/alpha/mm/fault.c | 2 +-
arch/arm/boot/dts/imx53-ppd.dts | 2 +-
arch/arm/boot/dts/imx6qdl-gw560x.dtsi | 1 -
arch/arm/kernel/traps.c | 2 +-
arch/arm/mach-imx/cpu-imx25.c | 1 +
arch/arm/mach-imx/cpu-imx27.c | 11 +-
arch/arm/mach-imx/cpu-imx31.c | 10 +-
arch/arm/mach-imx/cpu-imx35.c | 10 +-
arch/arm/mach-imx/cpu-imx5.c | 1 +
arch/arm/mm/fault.c | 2 +-
arch/arm/mm/nommu.c | 2 +-
arch/arm64/kernel/traps.c | 2 +-
arch/arm64/mm/fault.c | 2 +-
arch/csky/abiv1/alignment.c | 2 +-
arch/csky/kernel/traps.c | 2 +-
arch/h8300/kernel/traps.c | 3 +-
arch/h8300/mm/fault.c | 2 +-
arch/hexagon/kernel/traps.c | 2 +-
arch/ia64/Kconfig | 2 +-
arch/ia64/kernel/mca_drv.c | 2 +-
arch/ia64/kernel/traps.c | 2 +-
arch/ia64/mm/fault.c | 2 +-
arch/m68k/kernel/traps.c | 2 +-
arch/m68k/mm/fault.c | 2 +-
arch/microblaze/kernel/exceptions.c | 4 +-
arch/mips/kernel/traps.c | 2 +-
arch/nds32/kernel/fpu.c | 2 +-
arch/nds32/kernel/traps.c | 8 +-
arch/nios2/kernel/traps.c | 4 +-
arch/openrisc/kernel/traps.c | 2 +-
arch/parisc/kernel/traps.c | 2 +-
arch/powerpc/kernel/traps.c | 2 +-
arch/riscv/kernel/traps.c | 2 +-
arch/riscv/mm/fault.c | 2 +-
arch/s390/include/asm/debug.h | 6 +-
arch/s390/kernel/dumpstack.c | 2 +-
arch/s390/kernel/nmi.c | 2 +-
arch/s390/kvm/interrupt.c | 12 ++-
arch/sh/kernel/traps.c | 2 +-
arch/sparc/kernel/traps_32.c | 4 +-
arch/sparc/kernel/traps_64.c | 4 +-
arch/x86/entry/entry_32.S | 6 +-
arch/x86/entry/entry_64.S | 6 +-
arch/x86/events/amd/core.c | 2 +-
arch/x86/kernel/dumpstack.c | 4 +-
arch/x86/kernel/i8259.c | 1 +
arch/x86/kernel/irqinit.c | 4 +-
arch/x86/kvm/vmx/vmx.c | 21 ++--
arch/x86/lib/iomap_copy_64.S | 2 +-
arch/xtensa/kernel/traps.c | 2 +-
block/blk-cgroup.c | 4 +
block/blk-core.c | 5 +-
drivers/base/test/test_async_driver_probe.c | 2 +-
drivers/clk/clk-devres.c | 91 +++++++++++++---
drivers/cpufreq/armada-37xx-cpufreq.c | 2 +-
drivers/cpufreq/cpufreq-dt-platdev.c | 1 +
drivers/dma/dmaengine.c | 7 +-
drivers/dma/imx-sdma.c | 4 +-
drivers/dma/xilinx/xilinx_dma.c | 21 ++--
drivers/edac/edac_device.c | 15 ++-
drivers/edac/highbank_mc_edac.c | 7 +-
drivers/edac/qcom_edac.c | 5 +-
drivers/gpio/gpio-mxc.c | 2 +-
drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++
drivers/gpu/drm/panfrost/Kconfig | 3 +-
drivers/hid/hid-betopff.c | 17 +--
drivers/hid/hid-bigbenff.c | 5 +
drivers/hid/hid-core.c | 4 +-
drivers/hid/hid-ids.h | 1 -
drivers/hid/hid-quirks.c | 1 -
drivers/hid/intel-ish-hid/ishtp/dma-if.c | 10 ++
drivers/infiniband/core/verbs.c | 7 +-
drivers/infiniband/hw/hfi1/user_exp_rcv.c | 101 ++++++++++--------
drivers/input/mouse/synaptics.c | 1 -
drivers/memory/atmel-sdramc.c | 6 +-
drivers/memory/mvebu-devbus.c | 3 +-
drivers/mmc/host/sdhci-esdhc-imx.c | 53 +++++++--
drivers/net/dsa/microchip/ksz9477.c | 4 +-
drivers/net/ethernet/amd/xgbe/xgbe-dev.c | 23 ++--
drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 24 +++++
drivers/net/ethernet/amd/xgbe/xgbe.h | 2 +
drivers/net/ethernet/apm/xgene/xgene_enet_main.h | 2 +-
drivers/net/ethernet/broadcom/tg3.c | 8 +-
drivers/net/ethernet/cadence/macb_main.c | 9 +-
drivers/net/ethernet/mellanox/mlx5/core/main.c | 8 +-
drivers/net/ethernet/renesas/ravb_main.c | 4 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 5 +
drivers/net/phy/mdio-i2c.c | 3 +-
drivers/net/phy/mdio-mux-meson-g12a.c | 23 ++--
drivers/net/phy/mdio-xgene.c | 2 +-
drivers/net/phy/mdio_bus.c | 7 +-
drivers/net/phy/sfp.c | 2 +-
drivers/net/usb/sr9700.c | 2 +-
drivers/net/wan/fsl_ucc_hdlc.c | 6 +-
drivers/net/wireless/rndis_wlan.c | 19 ++--
drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 4 +-
drivers/platform/x86/asus-nb-wmi.c | 1 +
drivers/platform/x86/touchscreen_dmi.c | 25 +++++
drivers/scsi/hisi_sas/hisi_sas_main.c | 2 +-
drivers/scsi/hpsa.c | 2 +-
drivers/spi/spidev.c | 2 -
.../intel/int340x_thermal/int340x_thermal_zone.c | 28 +++--
.../intel/int340x_thermal/int340x_thermal_zone.h | 1 +
drivers/usb/gadget/function/f_fs.c | 7 ++
drivers/usb/host/xhci-plat.c | 2 +-
drivers/usb/host/xhci.c | 1 +
drivers/w1/w1.c | 6 +-
drivers/w1/w1_int.c | 5 +-
fs/affs/file.c | 2 +-
fs/cifs/smbdirect.c | 1 +
fs/nfsd/netns.h | 6 +-
fs/nfsd/nfs4state.c | 8 +-
fs/nfsd/nfsctl.c | 14 +--
fs/nfsd/nfsd.h | 3 +-
fs/nfsd/nfssvc.c | 35 +++++-
fs/proc/proc_sysctl.c | 33 ++++++
fs/reiserfs/super.c | 6 --
include/linux/clk.h | 109 +++++++++++++++++++
include/linux/kernel.h | 1 +
{drivers/net/phy => include/linux/mdio}/mdio-i2c.h | 0
.../net/phy => include/linux/mdio}/mdio-xgene.h | 0
include/linux/sched/task.h | 1 +
include/linux/sysctl.h | 3 +
include/net/sch_generic.h | 7 ++
include/net/sock.h | 2 +-
include/uapi/linux/netfilter/nf_conntrack_sctp.h | 2 +-
include/uapi/linux/netfilter/nfnetlink_cttimeout.h | 2 +-
kernel/bpf/verifier.c | 4 +-
kernel/exit.c | 72 +++++++++++++
kernel/module.c | 26 ++++-
kernel/panic.c | 75 +++++++++++--
kernel/sched/core.c | 3 +-
kernel/trace/bpf_trace.c | 3 +
kernel/trace/trace.c | 2 +
kernel/trace/trace.h | 1 +
kernel/trace/trace_events_hist.c | 2 +
kernel/trace/trace_output.c | 3 +-
lib/lockref.c | 1 -
lib/nlattr.c | 3 +
mm/kasan/report.c | 4 +-
net/bluetooth/hci_core.c | 1 +
net/bluetooth/hci_event.c | 13 +++
net/core/net_namespace.c | 2 +-
net/ipv4/fib_semantics.c | 2 +
net/ipv4/inet_hashtables.c | 17 ++-
net/ipv4/inet_timewait_sock.c | 8 +-
net/ipv4/metrics.c | 2 +
net/ipv4/tcp.c | 2 +
net/ipv6/ip6_gre.c | 12 ++-
net/ipv6/ip6_tunnel.c | 10 +-
net/ipv6/sit.c | 8 +-
net/l2tp/l2tp_core.c | 30 ++++--
net/netfilter/nf_conntrack_proto_sctp.c | 118 ++++++++++-----------
net/netfilter/nf_conntrack_proto_tcp.c | 10 ++
net/netfilter/nf_conntrack_standalone.c | 8 --
net/netfilter/nft_set_rbtree.c | 16 ++-
net/netlink/af_netlink.c | 38 ++++---
net/netrom/nr_timer.c | 1 +
net/nfc/llcp_core.c | 1 +
net/sched/sch_taprio.c | 2 +
net/sctp/bind_addr.c | 6 ++
net/sunrpc/xprtrdma/verbs.c | 1 -
scripts/tracing/ftrace-bisect.sh | 34 ++++--
security/tomoyo/Makefile | 2 +-
sound/soc/fsl/fsl-asoc-card.c | 8 +-
sound/soc/fsl/fsl_micfil.c | 16 +--
sound/soc/fsl/fsl_ssi.c | 4 +-
tools/objtool/check.c | 3 +-
.../selftests/bpf/prog_tests/jeq_infer_not_null.c | 9 --
.../selftests/bpf/progs/jeq_infer_not_null_fail.c | 42 --------
176 files changed, 1178 insertions(+), 528 deletions(-)Greg Kroah-Hartman
maintainerPATCH 1/134 clk: generalize devm_clk_get() a bit
From: Uwe Kleine-König <[email protected]>
[ Upstream commit abae8e57e49aa75f6db76aa866c775721523908f ]
Allow to add an exit hook to devm managed clocks. Also use clk_get_optional() in devm_clk_get_optional instead of open coding it. The generalisation will be used in the next commit to add some more devm_clk helpers.
Stable-dep-of: 340cb392a038 ("memory: atmel-sdramc: Fix missing clk_disable_unprepare in atmel_ramc_probe()")
--- drivers/clk/clk-devres.c | 66 +++++++++++++++++++++++++++++----------- 1 file changed, 49 insertions(+), 17 deletions(-)
drivers/clk/clk-devres.c +49 -17
@@ -4,39 +4,71 @@#include <linux/export.h> #include <linux/gfp.h> +struct devm_clk_state { +struct clk *clk; +void (*exit)(struct clk *clk); +}; +static void devm_clk_release (struct device *dev,void *res) { -clk_put (*(struct clk **)res); +struct devm_clk_state *state = *(struct devm_clk_state **)res; + +if (state->exit) + state->exit (state->clk); + +clk_put (state->clk); } -struct clk *devm_clk_get (struct device *dev,const char *id) +static struct clk *__devm_clk_get (struct device *dev,const char *id, +struct clk *(*get)(struct device *dev,const char *id), +int (*init)(struct clk *clk), +void (*exit)(struct clk *clk)) { -struct clk **ptr, *clk; +struct devm_clk_state *state; +struct clk *clk; +int ret; - ptr =devres_alloc (devm_clk_release,sizeof (*ptr),GFP_KERNEL ); -if (!ptr) + state =devres_alloc (devm_clk_release,sizeof (*state),GFP_KERNEL ); +if (!state)return ERR_PTR (-ENOMEM ); - clk =clk_get (dev, id); -if (!IS_ERR (clk)) { - *ptr = clk; -devres_add (dev, ptr); - }else { -devres_free (ptr); + clk =get (dev, id); +if (IS_ERR (clk)) { + ret =PTR_ERR (clk); + goto err_clk_get; } +if (init) { + ret =init (clk); +if (ret) + goto err_clk_init; + } + + state->clk = clk; + state->exit = exit; + +devres_add (dev, state); +return clk; + +err_clk_init: + +clk_put (clk); +err_clk_get: + +devres_free (state); +return ERR_PTR (ret); +} + +struct clk *devm_clk_get (struct device *dev,const char *id) +{ +return __devm_clk_get (dev, id, clk_get,NULL ,NULL ); }EXPORT_SYMBOL (devm_clk_get);struct clk *devm_clk_get_optional (struct device *dev,const char *id) { -struct clk *clk =devm_clk_get (dev, id); - -if (clk ==ERR_PTR (-ENOENT )) -return NULL ; - -return clk; +return __devm_clk_get (dev, id, clk_get_optional,NULL ,NULL ); }EXPORT_SYMBOL (devm_clk_get_optional);
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 2/134 clk: Provide new devm_clk helpers for prepared and enabled clocks
In reply to Greg Kroah-HartmanFrom: Uwe Kleine-König <[email protected]>
[ Upstream commit 7ef9651e9792b08eb310c6beb202cbc947f43cab ]
When a driver keeps a clock prepared (or enabled) during the whole lifetime of the driver, these helpers allow to simplify the drivers.
Stable-dep-of: 340cb392a038 ("memory: atmel-sdramc: Fix missing clk_disable_unprepare in atmel_ramc_probe()")
--- drivers/clk/clk-devres.c | 27 ++++++++++ include/linux/clk.h | 109 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 136 insertions(+)
drivers/clk/clk-devres.c +27 -0
@@ -66,12 +66,39 @@ struct clk *devm_clk_get(struct device *dev, const char *id) }EXPORT_SYMBOL (devm_clk_get); +struct clk *devm_clk_get_prepared (struct device *dev,const char *id) +{ +return __devm_clk_get (dev, id, clk_get, clk_prepare, clk_unprepare); +} +EXPORT_SYMBOL_GPL (devm_clk_get_prepared); + +struct clk *devm_clk_get_enabled (struct device *dev,const char *id) +{ +return __devm_clk_get (dev, id, clk_get, + clk_prepare_enable, clk_disable_unprepare); +} +EXPORT_SYMBOL_GPL (devm_clk_get_enabled); +struct clk *devm_clk_get_optional (struct device *dev,const char *id) {return __devm_clk_get (dev, id, clk_get_optional,NULL ,NULL ); }EXPORT_SYMBOL (devm_clk_get_optional); +struct clk *devm_clk_get_optional_prepared (struct device *dev,const char *id) +{ +return __devm_clk_get (dev, id, clk_get_optional, + clk_prepare, clk_unprepare); +} +EXPORT_SYMBOL_GPL (devm_clk_get_optional_prepared); + +struct clk *devm_clk_get_optional_enabled (struct device *dev,const char *id) +{ +return __devm_clk_get (dev, id, clk_get_optional, + clk_prepare_enable, clk_disable_unprepare); +} +EXPORT_SYMBOL_GPL (devm_clk_get_optional_enabled); +struct clk_bulk_devres {struct clk_bulk_data *clks;int num_clks;
include/linux/clk.h +109 -0
133 lines not on this page · raw message
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 3/134 memory: atmel-sdramc: Fix missing clk_disable_unprepare in atmel_ramc_probe()
In reply to Greg Kroah-HartmanFrom: Gaosheng Cui <[email protected]>
[ Upstream commit 340cb392a038cf70540a4cdf2e98a247c66b6df4 ]
The clk_disable_unprepare() should be called in the error handling of caps->has_mpddr_clk, fix it by replacing devm_clk_get and clk_prepare_enable by devm_clk_get_enabled.
--- drivers/memory/atmel-sdramc.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/memory/atmel-sdramc.c +2 -4
@@ -47,19 +47,17 @@ static int atmel_ramc_probe(struct platform_device *pdev) caps =of_device_get_match_data (&pdev->dev);if (caps->has_ddrck) { - clk =devm_clk_get (&pdev->dev,"ddrck" ); + clk =devm_clk_get_enabled (&pdev->dev,"ddrck" );if (IS_ERR (clk))return PTR_ERR (clk); -clk_prepare_enable (clk); }if (caps->has_mpddr_clk) { - clk =devm_clk_get (&pdev->dev,"mpddr" ); + clk =devm_clk_get_enabled (&pdev->dev,"mpddr" );if (IS_ERR (clk)) {pr_err ("AT91 RAMC: couldn't get mpddr clock\n" );return PTR_ERR (clk); } -clk_prepare_enable (clk); }return 0 ;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 4/134 memory: mvebu-devbus: Fix missing clk_disable_unprepare in mvebu_devbus_probe()
In reply to Greg Kroah-HartmanFrom: Gaosheng Cui <[email protected]>
[ Upstream commit cb8fd6f75775165390ededea8799b60d93d9fe3e ]
The clk_disable_unprepare() should be called in the error handling of devbus_get_timing_params() and of_platform_populate(), fix it by replacing devm_clk_get and clk_prepare_enable by devm_clk_get_enabled.
--- drivers/memory/mvebu-devbus.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/memory/mvebu-devbus.c +1 -2
@@ -282,10 +282,9 @@ static int mvebu_devbus_probe(struct platform_device *pdev)if (IS_ERR (devbus->base))return PTR_ERR (devbus->base); - clk =devm_clk_get (&pdev->dev,NULL ); + clk =devm_clk_get_enabled (&pdev->dev,NULL );if (IS_ERR (clk))return PTR_ERR (clk); -clk_prepare_enable (clk);/* * Obtain clock period in picoseconds,
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 5/134 ARM: dts: imx6qdl-gw560x: Remove incorrect uart-has-rtscts
In reply to Greg Kroah-HartmanFrom: Fabio Estevam <[email protected]>
[ Upstream commit 9dfbc72256b5de608ad10989bcbafdbbd1ac8d4e ]
The following build warning is seen when running:
make dtbs_check DT_SCHEMA_FILES=fsl-imx-uart.yaml
arch/arm/boot/dts/imx6dl-gw560x.dtb: serial@2020000: rts-gpios: False schema does not allow [[20, 1, 0]]
From schema: Documentation/devicetree/bindings/serial/fsl-imx-uart.yaml
The imx6qdl-gw560x board does not expose the UART RTS and CTS as native UART pins, so 'uart-has-rtscts' should not be used.
Using 'uart-has-rtscts' with 'rts-gpios' is an invalid combination detected by serial.yaml.
Fix the problem by removing the incorrect 'uart-has-rtscts' property.
--- arch/arm/boot/dts/imx6qdl-gw560x.dtsi | 1 - 1 file changed, 1 deletion(-)
arch/arm/boot/dts/imx6qdl-gw560x.dtsi +0 -1
@@ -464,7 +464,6 @@ &ssi1 { &uart1 { pinctrl-names = "default"; pinctrl-0 = <&pinctrl_uart1>; - uart-has-rtscts; rts-gpios = <&gpio7 1 GPIO_ACTIVE_HIGH>; status = "okay"; };
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 6/134 ARM: imx27: Retrieve the SYSCTRL base address from devicetree
In reply to Greg Kroah-HartmanFrom: Fabio Estevam <[email protected]>
[ Upstream commit 94b2bec1b0e054b27b0a0b5f52a0cd55c83340f4 ]
Now that imx27 has been converted to a devicetree-only platform, retrieve the SYSCTRL base address from devicetree.
To keep devicetree compatibilty the SYSCTRL base address will be retrieved from the CCM base address plus an 0x800 offset.
This is not a problem as the imx27.dtsi describes the CCM register range as 0x1000.
Stable-dep-of: 87b30c4b0efb ("ARM: imx: add missing of_node_put()")
--- arch/arm/mach-imx/cpu-imx27.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
arch/arm/mach-imx/cpu-imx27.c +9 -1
@@ -9,6 +9,7 @@*/ #include <linux/io.h> +#include <linux/of_address.h> #include <linux/module.h> #include "hardware.h"
@@ -17,16 +18,23 @@ static int mx27_cpu_rev = -1;static int mx27_cpu_partnumber;#define SYS_CHIP_ID 0x00/* The offset of CHIP ID register */ +#define SYSCTRL_OFFSET 0x800/* Offset from CCM base address */ static int mx27_read_cpu_rev (void ) { +void __iomem *ccm_base; +struct device_node *np;u32 val; + + np =of_find_compatible_node (NULL ,NULL ,"fsl,imx27-ccm" ); + ccm_base =of_iomap (np,0 ); +BUG_ON (!ccm_base);/* * now we have access to the IO registers. As we need * the silicon revision very early we read it here to * avoid any further hooks */ - val =imx_readl (MX27_IO_ADDRESS (MX27_SYSCTRL_BASE_ADDR +SYS_CHIP_ID )); + val =imx_readl (ccm_base +SYSCTRL_OFFSET +SYS_CHIP_ID ); mx27_cpu_partnumber = (int )((val >>12 ) &0xFFFF );
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 7/134 ARM: imx31: Retrieve the IIM base address from devicetree
In reply to Greg Kroah-HartmanFrom: Fabio Estevam <[email protected]>
[ Upstream commit 3172225d45bd918a5c4865e7cd8eb0c9d79f8530 ]
Now that imx31 has been converted to a devicetree-only platform, retrieve the IIM base address from devicetree.
Stable-dep-of: 87b30c4b0efb ("ARM: imx: add missing of_node_put()")
--- arch/arm/mach-imx/cpu-imx31.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
arch/arm/mach-imx/cpu-imx31.c +8 -1
@@ -6,6 +6,7 @@*/ #include <linux/module.h> +#include <linux/of_address.h> #include <linux/io.h> #include "common.h"
@@ -32,10 +33,16 @@ static struct {static int mx31_read_cpu_rev (void ) { +void __iomem *iim_base; +struct device_node *np;u32 i, srev; + np =of_find_compatible_node (NULL ,NULL ,"fsl,imx31-iim" ); + iim_base =of_iomap (np,0 ); +BUG_ON (!iim_base); +/* read SREV register from IIM module */ - srev =imx_readl (MX31_IO_ADDRESS (MX31_IIM_BASE_ADDR +MXC_IIMSREV )); + srev =imx_readl (iim_base +MXC_IIMSREV ); srev &=0xff ;for (i =0 ; i <ARRAY_SIZE (mx31_cpu_type); i++)
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 8/134 ARM: imx35: Retrieve the IIM base address from devicetree
In reply to Greg Kroah-HartmanFrom: Fabio Estevam <[email protected]>
[ Upstream commit f68ea682d1da77e0133a7726640c22836a900a67 ]
Now that imx35 has been converted to a devicetree-only platform, retrieve the IIM base address from devicetree.
Stable-dep-of: 87b30c4b0efb ("ARM: imx: add missing of_node_put()")
--- arch/arm/mach-imx/cpu-imx35.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
arch/arm/mach-imx/cpu-imx35.c +8 -1
@@ -5,6 +5,7 @@* Copyright (c) 2009 Daniel Mack <[email protected]> */ #include <linux/module.h> +#include <linux/of_address.h> #include <linux/io.h> #include "hardware.h"
@@ -14,9 +15,15 @@ static int mx35_cpu_rev = -1;static int mx35_read_cpu_rev (void ) { +void __iomem *iim_base; +struct device_node *np;u32 rev; - rev =imx_readl (MX35_IO_ADDRESS (MX35_IIM_BASE_ADDR +MXC_IIMSREV )); + np =of_find_compatible_node (NULL ,NULL ,"fsl,imx35-iim" ); + iim_base =of_iomap (np,0 ); +BUG_ON (!iim_base); + + rev =imx_readl (iim_base +MXC_IIMSREV );switch (rev) {case 0x00 :return IMX_CHIP_REVISION_1_0 ;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 9/134 ARM: imx: add missing of_node_put()
In reply to Greg Kroah-HartmanFrom: Dario Binacchi <[email protected]>
[ Upstream commit 87b30c4b0efb6a194a7b8eac2568a3da520d905f ]
Calling of_find_compatible_node() returns a node pointer with refcount incremented. Use of_node_put() on it when done.
The patch fixes the same problem on different i.MX platforms.
--- arch/arm/mach-imx/cpu-imx25.c | 1 + arch/arm/mach-imx/cpu-imx27.c | 1 + arch/arm/mach-imx/cpu-imx31.c | 1 + arch/arm/mach-imx/cpu-imx35.c | 1 + arch/arm/mach-imx/cpu-imx5.c | 1 + 5 files changed, 5 insertions(+)
arch/arm/mach-imx/cpu-imx25.c +1 -0
@@ -23,6 +23,7 @@ static int mx25_read_cpu_rev(void) np =of_find_compatible_node (NULL ,NULL ,"fsl,imx25-iim" ); iim_base =of_iomap (np,0 ); +of_node_put (np);BUG_ON (!iim_base); rev =readl (iim_base +MXC_IIMSREV );iounmap (iim_base);
arch/arm/mach-imx/cpu-imx27.c +1 -0
@@ -28,6 +28,7 @@ static int mx27_read_cpu_rev(void) np =of_find_compatible_node (NULL ,NULL ,"fsl,imx27-ccm" ); ccm_base =of_iomap (np,0 ); +of_node_put (np);BUG_ON (!ccm_base);/* * now we have access to the IO registers. As we need
arch/arm/mach-imx/cpu-imx31.c +1 -0
@@ -39,6 +39,7 @@ static int mx31_read_cpu_rev(void) np =of_find_compatible_node (NULL ,NULL ,"fsl,imx31-iim" ); iim_base =of_iomap (np,0 ); +of_node_put (np);BUG_ON (!iim_base);/* read SREV register from IIM module */
arch/arm/mach-imx/cpu-imx35.c +1 -0
@@ -21,6 +21,7 @@ static int mx35_read_cpu_rev(void) np =of_find_compatible_node (NULL ,NULL ,"fsl,imx35-iim" ); iim_base =of_iomap (np,0 ); +of_node_put (np);BUG_ON (!iim_base); rev =imx_readl (iim_base +MXC_IIMSREV );
arch/arm/mach-imx/cpu-imx5.c +1 -0
@@ -28,6 +28,7 @@ static u32 imx5_read_srev_reg(const char *compat) np =of_find_compatible_node (NULL ,NULL , compat); iim_base =of_iomap (np,0 ); +of_node_put (np);WARN_ON (!iim_base); srev =readl (iim_base +IIM_SREV ) &0xff ;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 10/134 HID: intel_ish-hid: Add check for ishtp_dma_tx_map
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit b3d40c3ec3dc4ad78017de6c3a38979f57aaaab8 ]
As the kcalloc may return NULL pointer,
it should be better to check the ishtp_dma_tx_map before use in order to avoid NULL pointer dereference.
--- drivers/hid/intel-ish-hid/ishtp/dma-if.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/hid/intel-ish-hid/ishtp/dma-if.c +10 -0
@@ -104,6 +104,11 @@ void *ishtp_cl_get_dma_send_buf(struct ishtp_device *dev,int required_slots = (size /DMA_SLOT_SIZE ) +1 * (size %DMA_SLOT_SIZE !=0 ); +if (!dev->ishtp_dma_tx_map) { +dev_err (dev->devc,"Fail to allocate Tx map\n" ); +return NULL ; + } +spin_lock_irqsave (&dev->ishtp_dma_tx_lock, flags);for (i =0 ; i <= (dev->ishtp_dma_num_slots - required_slots); i++) { free =1 ;
@@ -150,6 +155,11 @@ void ishtp_cl_release_dma_acked_mem(struct ishtp_device *dev,return ; } +if (!dev->ishtp_dma_tx_map) { +dev_err (dev->devc,"Fail to allocate Tx map\n" ); +return ; + } + i = (msg_addr - dev->ishtp_host_dma_tx_buf) /DMA_SLOT_SIZE ;spin_lock_irqsave (&dev->ishtp_dma_tx_lock, flags);for (j =0 ; j < acked_slots; j++) {
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 11/134 EDAC/highbank: Fix memory leak in highbank_mc_probe()
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit e7a293658c20a7945014570e1921bf7d25d68a36 ]
When devres_open_group() fails, it returns -ENOMEM without freeing memory allocated by edac_mc_alloc().
Call edac_mc_free() on the error handling path to avoid a memory leak.
[ bp: Massage commit message. ]
--- drivers/edac/highbank_mc_edac.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/edac/highbank_mc_edac.c +5 -2
@@ -174,8 +174,10 @@ static int highbank_mc_probe(struct platform_device *pdev) drvdata = mci->pvt_info;platform_set_drvdata (pdev, mci); -if (!devres_open_group (&pdev->dev,NULL ,GFP_KERNEL )) -return -ENOMEM ; +if (!devres_open_group (&pdev->dev,NULL ,GFP_KERNEL )) { + res = -ENOMEM ; + goto free; + } r =platform_get_resource (pdev,IORESOURCE_MEM ,0 );if (!r) {
@@ -243,6 +245,7 @@ static int highbank_mc_probe(struct platform_device *pdev)edac_mc_del_mc (&pdev->dev); err:devres_release_group (&pdev->dev,NULL ); +free:edac_mc_free (mci);return res; }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 12/134 tomoyo: fix broken dependency on *.conf.default
In reply to Greg Kroah-HartmanFrom: Masahiro Yamada <[email protected]>
[ Upstream commit eaf2213ba563b2d74a1f2c13a6b258273f689802 ]
If *.conf.default is updated, builtin-policy.h should be rebuilt, but this does not work when compiled with O= option.
[Without this commit]
$ touch security/tomoyo/policy/exception_policy.conf.default
$ make O=/tmp security/tomoyo/
make[1]: Entering directory '/tmp'
GEN Makefile
CALL /home/masahiro/ref/linux/scripts/checksyscalls.sh
DESCEND objtool
make[1]: Leaving directory '/tmp'[With this commit]
$ touch security/tomoyo/policy/exception_policy.conf.default
$ make O=/tmp security/tomoyo/
make[1]: Entering directory '/tmp'
GEN Makefile
CALL /home/masahiro/ref/linux/scripts/checksyscalls.sh
DESCEND objtool
POLICY security/tomoyo/builtin-policy.h
CC security/tomoyo/common.o
AR security/tomoyo/built-in.a
make[1]: Leaving directory '/tmp'$(srctree)/ is essential because $(wildcard ) does not follow VPATH.
--- security/tomoyo/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
security/tomoyo/Makefile +1 -1
@@ -10,7 +10,7 @@ endef quiet_cmd_policy = POLICY $@ cmd_policy = ($(call do_policy,profile); $(call do_policy,exception_policy); $(call do_policy,domain_policy); $(call do_policy,manager); $(call do_policy,stat)) >$@ -$(obj)/builtin-policy.h: $(wildcard $(obj)/policy/*.conf $(src)/policy/*.conf.default) FORCE +$(obj)/builtin-policy.h: $(wildcard $(obj)/policy/*.conf $(srctree)/$(src)/policy/*.conf.default) FORCE $(call if_changed,policy) $(obj)/common.o: $(obj)/builtin-policy.h
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 13/134 RDMA/core: Fix ib block iterator counter overflow
In reply to Greg Kroah-HartmanFrom: Yonatan Nachum <[email protected]>
[ Upstream commit 0afec5e9cea732cb47014655685a2a47fb180c31 ]
When registering a new DMA MR after selecting the best aligned page size for it, we iterate over the given sglist to split each entry to smaller, aligned to the selected page size, DMA blocks.
In given circumstances where the sg entry and page size fit certain sizes and the sg entry is not aligned to the selected page size, the total size of the aligned pages we need to cover the sg entry is >= 4GB. Under this circumstances, while iterating page aligned blocks, the counter responsible for counting how much we advanced from the start of the sg entry is overflowed because its type is u32 and we pass 4GB in size. This can lead to an infinite loop inside the iterator function because the overflow prevents the counter to be larger
than the size of the sg entry.
Fix the presented problem by changing the advancement condition to eliminate overflow.
Backtrace: [ 192.374329] efa_reg_user_mr_dmabuf [ 192.376783] efa_register_mr [ 192.382579] pgsz_bitmap 0xfffff000 rounddown 0x80000000 [ 192.386423] pg_sz [0x80000000] umem_length[0xc0000000] [ 192.392657] start 0x0 length 0xc0000000 params.page_shift 31 params.page_num 3 [ 192.399559] hp_cnt[3], pages_in_hp[524288] [ 192.403690] umem->sgt_append.sgt.nents[1] [ 192.407905] number entries: [1], pg_bit: [31] [ 192.411397] biter->__sg_nents [1] biter->__sg [0000000008b0c5d8] [ 192.415601] biter->__sg_advance [665837568] sg_dma_len[3221225472] [ 192.419823] biter->__sg_nents [1] biter->__sg [0000000008b0c5d8] [ 192.423976] biter->__sg_advance [2813321216] sg_dma_len[3221225472] [ 192.428243] biter->__sg_nents [1] biter->__sg [0000000008b0c5d8] [ 192.432397] biter->__sg_advance [665837568] sg_dma_len[3221225472]
--- drivers/infiniband/core/verbs.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/infiniband/core/verbs.c +5 -2
@@ -2840,15 +2840,18 @@ EXPORT_SYMBOL(__rdma_block_iter_start);bool __rdma_block_iter_next (struct ib_block_iter *biter) {unsigned int block_offset; +unsigned int sg_delta;if (!biter->__sg_nents || !biter->__sg)return false; biter->__dma_addr =sg_dma_address (biter->__sg) + biter->__sg_advance; block_offset = biter->__dma_addr & (BIT_ULL (biter->__pg_bit) -1 ); - biter->__sg_advance +=BIT_ULL (biter->__pg_bit) - block_offset; + sg_delta =BIT_ULL (biter->__pg_bit) - block_offset; -if (biter->__sg_advance >=sg_dma_len (biter->__sg)) { +if (sg_dma_len (biter->__sg) - biter->__sg_advance > sg_delta) { + biter->__sg_advance += sg_delta; + }else { biter->__sg_advance =0 ; biter->__sg =sg_next (biter->__sg); biter->__sg_nents--;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 14/134 IB/hfi1: Reject a zero-length user expected buffer
In reply to Greg Kroah-HartmanFrom: Dean Luick <[email protected]>
[ Upstream commit 0a0a6e80472c98947d73c3d13bcd7d101895f55d ]
A zero length user buffer makes no sense and the code does not handle it correctly. Instead, reject a zero length as invalid.
--- drivers/infiniband/hw/hfi1/user_exp_rcv.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/infiniband/hw/hfi1/user_exp_rcv.c +2 -0
@@ -325,6 +325,8 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd,if (!PAGE_ALIGNED (tinfo->vaddr))return -EINVAL ; +if (tinfo->length ==0 ) +return -EINVAL ; tidbuf =kzalloc (sizeof (*tidbuf),GFP_KERNEL );if (!tidbuf)
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 15/134 IB/hfi1: Reserve user expected TIDs
In reply to Greg Kroah-HartmanFrom: Dean Luick <[email protected]>
[ Upstream commit ecf91551cdd2925ed6d9a9d99074fa5f67b90596 ]
To avoid a race, reserve the number of user expected TIDs before setup.
--- drivers/infiniband/hw/hfi1/user_exp_rcv.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
drivers/infiniband/hw/hfi1/user_exp_rcv.c +6 -8
@@ -351,16 +351,13 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd,/* Find sets of physically contiguous pages */ tidbuf->n_psets =find_phys_blocks (tidbuf, pinned); -/* -* We don't need to access this under a lock since tid_used is per -* process and the same process cannot be in hfi1_user_exp_rcv_clear() -* and hfi1_user_exp_rcv_setup() at the same time. -*/ +/* Reserve the number of expected tids to be used. */ spin_lock (&fd->tid_lock);if (fd->tid_used + tidbuf->n_psets > fd->tid_limit) pageset_count = fd->tid_limit - fd->tid_used;else pageset_count = tidbuf->n_psets; + fd->tid_used += pageset_count;spin_unlock (&fd->tid_lock);if (!pageset_count)
@@ -469,10 +466,11 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd, nomem:hfi1_cdbg (TID ,"total mapped: tidpairs:%u pages:%u (%d)" , tididx, mapped_pages, ret); +/* adjust reserved tid_used to actual count */ +spin_lock (&fd->tid_lock); + fd->tid_used -= pageset_count - tididx; +spin_unlock (&fd->tid_lock);if (tididx) { -spin_lock (&fd->tid_lock); - fd->tid_used += tididx; -spin_unlock (&fd->tid_lock); tinfo->tidcnt = tididx; tinfo->length = mapped_pages *PAGE_SIZE ;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 16/134 IB/hfi1: Fix expected receive setup error exit issues
In reply to Greg Kroah-HartmanFrom: Dean Luick <[email protected]>
[ Upstream commit e0c4a422f5246abefbf7c178ef99a1f2dc3c5f62 ]
Fix three error exit issues in expected receive setup. Re-arrange error exits to increase readability.
Issues and fixes:
1. Possible missed page unpin if tidlist copyout fails and not all pinned pages where made part of a TID.
Fix: Unpin the unused pages.
2. Return success with unset return values tidcnt and length when no pages were pinned.
Fix: Return -ENOSPC if no pages were pinned.
3. Return success with unset return values tidcnt and length when no rcvarray entries available.
Fix: Return -ENOSPC if no rcvarray entries are available.
--- drivers/infiniband/hw/hfi1/user_exp_rcv.c | 83 ++++++++++++++--------- 1 file changed, 50 insertions(+), 33 deletions(-)
drivers/infiniband/hw/hfi1/user_exp_rcv.c +50 -33
@@ -337,15 +337,14 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd, tidbuf->psets =kcalloc (uctxt->expected_count,sizeof (*tidbuf->psets),GFP_KERNEL );if (!tidbuf->psets) { -kfree (tidbuf); -return -ENOMEM ; + ret = -ENOMEM ; + goto fail_release_mem; } pinned =pin_rcv_pages (fd, tidbuf);if (pinned <=0 ) { -kfree (tidbuf->psets); -kfree (tidbuf); -return pinned; + ret = (pinned <0 ) ? pinned : -ENOSPC ; + goto fail_unpin; }/* Find sets of physically contiguous pages */
@@ -360,14 +359,16 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd, fd->tid_used += pageset_count;spin_unlock (&fd->tid_lock); -if (!pageset_count) - goto bail; +if (!pageset_count) { + ret = -ENOSPC ; + goto fail_unreserve; + } ngroups = pageset_count / dd->rcv_entries.group_size; tidlist =kcalloc (pageset_count,sizeof (*tidlist),GFP_KERNEL );if (!tidlist) { ret = -ENOMEM ; - goto nomem; + goto fail_unreserve; } tididx =0 ;
@@ -463,44 +464,60 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd, } unlock:mutex_unlock (&uctxt->exp_mutex); -nomem:hfi1_cdbg (TID ,"total mapped: tidpairs:%u pages:%u (%d)" , tididx, mapped_pages, ret); + +/* fail if nothing was programmed, set error if none provided */ +if (tididx ==0 ) { +if (ret >=0 ) + ret = -ENOSPC ; + goto fail_unreserve; + } +/* adjust reserved tid_used to actual count */ spin_lock (&fd->tid_lock); fd->tid_used -= pageset_count - tididx;spin_unlock (&fd->tid_lock); -if (tididx) { - tinfo->tidcnt = tididx; - tinfo->length = mapped_pages *PAGE_SIZE ; -if (copy_to_user (u64_to_user_ptr (tinfo->tidlist), - tidlist,sizeof (tidlist[0 ]) * tididx)) { -/* -* On failure to copy to the user level, we need to undo -* everything done so far so we don't leak resources. -*/ - tinfo->tidlist = (unsigned long )&tidlist; -hfi1_user_exp_rcv_clear (fd, tinfo); - tinfo->tidlist =0 ; - ret = -EFAULT ; - goto bail; - } +/* unpin all pages not covered by a TID */ +unpin_rcv_pages (fd, tidbuf,NULL , mapped_pages, pinned - mapped_pages, + false); + + tinfo->tidcnt = tididx; + tinfo->length = mapped_pages *PAGE_SIZE ; + +if (copy_to_user (u64_to_user_ptr (tinfo->tidlist), + tidlist,sizeof (tidlist[0 ]) * tididx)) { + ret = -EFAULT ; + goto fail_unprogram; } -/* -* If not everything was mapped (due to insufficient RcvArray entries, -* for example), unpin all unmapped pages so we can pin them nex time. -*/ -if (mapped_pages != pinned) -unpin_rcv_pages (fd, tidbuf,NULL , mapped_pages, - (pinned - mapped_pages), false); -bail: +kfree (tidbuf->pages);kfree (tidbuf->psets); +kfree (tidbuf);kfree (tidlist); +return 0 ; + +fail_unprogram: +/* unprogram, unmap, and unpin all allocated TIDs */ + tinfo->tidlist = (unsigned long )tidlist; +hfi1_user_exp_rcv_clear (fd, tinfo); + tinfo->tidlist =0 ; + pinned =0 ;/* nothing left to unpin */ + pageset_count =0 ;/* nothing left reserved */ +fail_unreserve: +spin_lock (&fd->tid_lock); + fd->tid_used -= pageset_count; +spin_unlock (&fd->tid_lock); +fail_unpin: +if (pinned >0 ) +unpin_rcv_pages (fd, tidbuf,NULL ,0 , pinned, false); +fail_release_mem:kfree (tidbuf->pages); +kfree (tidbuf->psets);kfree (tidbuf); -return ret >0 ?0 : ret; +kfree (tidlist); +return ret; } int hfi1_user_exp_rcv_clear(struct hfi1_filedata *fd,
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 17/134 affs: initialize fsdata in affs_truncate()
In reply to Greg Kroah-HartmanFrom: Alexander Potapenko <[email protected]>
[ Upstream commit eef034ac6690118c88f357b00e2b3239c9d8575d ]
When aops->write_begin() does not initialize fsdata, KMSAN may report an error passing the latter to aops->write_end().
Fix this by unconditionally initializing fsdata.
--- fs/affs/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/affs/file.c +1 -1
@@ -878,7 +878,7 @@ affs_truncate(struct inode *inode)if (inode->i_size >AFFS_I (inode)->mmu_private) {struct address_space *mapping = inode->i_mapping;struct page *page; -void *fsdata; +void *fsdata =NULL ;loff_t isize = inode->i_size;int res;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 18/134 amd-xgbe: TX Flow Ctrl Registers are h/w ver dependent
In reply to Greg Kroah-HartmanFrom: Raju Rangoju <[email protected]>
[ Upstream commit 579923d84b04abb6cd4cd1fd9974096a2dd1832b ]
There is difference in the TX Flow Control registers (TFCR) between the revisions of the hardware. The older revisions of hardware used to have single register per queue. Whereas, the newer revision of hardware (from ver 30H onwards) have one register per priority.
Update the driver to use the TFCR based on the reported version of the hardware.
--- drivers/net/ethernet/amd/xgbe/xgbe-dev.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-)
drivers/net/ethernet/amd/xgbe/xgbe-dev.c +15 -8
@@ -524,19 +524,28 @@ static void xgbe_disable_vxlan(struct xgbe_prv_data *pdata)netif_dbg (pdata, drv, pdata->netdev,"VXLAN acceleration disabled\n" ); } +static unsigned int xgbe_get_fc_queue_count (struct xgbe_prv_data *pdata) +{ +unsigned int max_q_count =XGMAC_MAX_FLOW_CONTROL_QUEUES ; + +/* From MAC ver 30H the TFCR is per priority, instead of per queue */ +if (XGMAC_GET_BITS (pdata->hw_feat.version,MAC_VR ,SNPSVER ) >=0x30 ) +return max_q_count; +else + return min_t(unsigned int, pdata->tx_q_count, max_q_count); +} +static int xgbe_disable_tx_flow_control (struct xgbe_prv_data *pdata) { -unsigned int max_q_count, q_count;unsigned int reg, reg_val; -unsigned int i; +unsigned int i, q_count;/* Clear MTL flow control */ for (i =0 ; i < pdata->rx_q_count; i++)XGMAC_MTL_IOWRITE_BITS (pdata, i,MTL_Q_RQOMR ,EHFC ,0 );/* Clear MAC flow control */ - max_q_count =XGMAC_MAX_FLOW_CONTROL_QUEUES ; - q_count = min_t(unsigned int, pdata->tx_q_count, max_q_count); + q_count =xgbe_get_fc_queue_count (pdata); reg =MAC_Q0TFCR ;for (i =0 ; i < q_count; i++) { reg_val =XGMAC_IOREAD (pdata, reg);
@@ -553,9 +562,8 @@ static int xgbe_enable_tx_flow_control(struct xgbe_prv_data *pdata) {struct ieee_pfc *pfc = pdata->pfc;struct ieee_ets *ets = pdata->ets; -unsigned int max_q_count, q_count;unsigned int reg, reg_val; -unsigned int i; +unsigned int i, q_count;/* Set MTL flow control */ for (i =0 ; i < pdata->rx_q_count; i++) {
@@ -579,8 +587,7 @@ static int xgbe_enable_tx_flow_control(struct xgbe_prv_data *pdata) }/* Set MAC flow control */ - max_q_count =XGMAC_MAX_FLOW_CONTROL_QUEUES ; - q_count = min_t(unsigned int, pdata->tx_q_count, max_q_count); + q_count =xgbe_get_fc_queue_count (pdata); reg =MAC_Q0TFCR ;for (i =0 ; i < q_count; i++) { reg_val =XGMAC_IOREAD (pdata, reg);
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 19/134 amd-xgbe: Delay AN timeout during KR training
In reply to Greg Kroah-HartmanFrom: Raju Rangoju <[email protected]>
[ Upstream commit 926446ae24c03311a480fb96eb78f0ce7ea6d091 ]
AN restart triggered during KR training not only aborts the KR training process but also move the HW to unstable state. Driver has to wait upto 500ms or until the KR training is completed before restarting AN cycle.
--- drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 24 +++++++++++++++++++++++ drivers/net/ethernet/amd/xgbe/xgbe.h | 2 ++ 2 files changed, 26 insertions(+)
drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +24 -0
@@ -496,6 +496,7 @@ static enum xgbe_an xgbe_an73_tx_training(struct xgbe_prv_data *pdata, reg |=XGBE_KR_TRAINING_ENABLE ; reg |=XGBE_KR_TRAINING_START ;XMDIO_WRITE (pdata,MDIO_MMD_PMAPMD ,MDIO_PMA_10GBR_PMD_CTRL , reg); + pdata->kr_start_time = jiffies;netif_dbg (pdata, link, pdata->netdev,"KR training initiated\n" );
@@ -632,6 +633,8 @@ static enum xgbe_an xgbe_an73_incompat_link(struct xgbe_prv_data *pdata)xgbe_switch_mode (pdata); + pdata->an_result =XGBE_AN_READY ; +xgbe_an_restart (pdata);return XGBE_AN_INCOMPAT_LINK ;
@@ -1275,9 +1278,30 @@ static bool xgbe_phy_aneg_done(struct xgbe_prv_data *pdata)static void xgbe_check_link_timeout (struct xgbe_prv_data *pdata) {unsigned long link_timeout; +unsigned long kr_time; +int wait; link_timeout = pdata->link_check + (XGBE_LINK_TIMEOUT *HZ );if (time_after (jiffies, link_timeout)) { +if ((xgbe_cur_mode (pdata) ==XGBE_MODE_KR ) && + pdata->phy.autoneg ==AUTONEG_ENABLE ) { +/* AN restart should not happen while KR training is in progress. +* The while loop ensures no AN restart during KR training, +* waits up to 500ms and AN restart is triggered only if KR +* training is failed. +*/ + wait =XGBE_KR_TRAINING_WAIT_ITER ; +while (wait--) { + kr_time = pdata->kr_start_time + +msecs_to_jiffies (XGBE_AN_MS_TIMEOUT ); +if (time_after (jiffies, kr_time)) +break ; +/* AN restart is not required, if AN result is COMPLETE */ +if (pdata->an_result ==XGBE_AN_COMPLETE ) +return ; +usleep_range (10000 ,11000 ); + } + }netif_dbg (pdata, link, pdata->netdev,"AN link timeout\n" );xgbe_phy_config_aneg (pdata); }
drivers/net/ethernet/amd/xgbe/xgbe.h +2 -0
@@ -290,6 +290,7 @@/* Auto-negotiation */ #define XGBE_AN_MS_TIMEOUT 500#define XGBE_LINK_TIMEOUT 5 +#define XGBE_KR_TRAINING_WAIT_ITER 50#define XGBE_SGMII_AN_LINK_STATUS BIT(1)#define XGBE_SGMII_AN_LINK_SPEED (BIT(2) | BIT(3))
@@ -1266,6 +1267,7 @@ struct xgbe_prv_data {unsigned int parallel_detect;unsigned int fec_ability;unsigned long an_start; +unsigned long kr_start_time;enum xgbe_an_mode an_mode;/* I2C support */
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 20/134 bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
In reply to Greg Kroah-HartmanFrom: Luis Gerhorst <[email protected]>
[ Upstream commit e4f4db47794c9f474b184ee1418f42e6a07412b6 ]
To mitigate Spectre v4, 2039f26f3aca ("bpf: Fix leakage due to insufficient speculative store bypass mitigation") inserts lfence instructions after 1) initializing a stack slot and 2) spilling a pointer to the stack.
However, this does not cover cases where a stack slot is first initialized with a pointer (subject to sanitization) but then overwritten with a scalar (not subject to sanitization because the slot was already initialized). In this case, the second write may be subject to speculative store bypass (SSB) creating a speculative pointer-as-scalar type confusion. This allows the program to subsequently leak the numerical pointer value using, for example, a branch-based cache side channel.
To fix this, also sanitize scalars if they write a stack slot that previously contained a pointer. Assuming that pointer-spills are only generated by LLVM on register-pressure, the performance impact on most real-world BPF programs should be small.
The following unprivileged BPF bytecode drafts a minimal exploit and the mitigation:
[...]
// r6 = 0 or 1 (skalar, unknown user input)
// r7 = accessible ptr for side channel
// r10 = frame pointer (fp), to be leaked
//
r9 = r10 # fp alias to encourage ssb
*(u64 *)(r9 - 8) = r10 // fp[-8] = ptr, to be leaked
// lfence added here because of pointer spill to stack.
//
// Ommitted: Dummy bpf_ringbuf_output() here to train alias predictor // for no r9-r10 dependency.
//
*(u64 *)(r10 - 8) = r6 // fp[-8] = scalar, overwrites ptr
// 2039f26f3aca: no lfence added because stack slot was not STACK_INVALID, // store may be subject to SSB
//
// fix: also add an lfence when the slot contained a ptr
//
r8 = *(u64 *)(r9 - 8)
// r8 = architecturally a scalar, speculatively a ptr
//
// leak ptr using branch-based cache side channel:
r8 &= 1 // choose bit to leak
if r8 == 0 goto SLOW // no mispredict
// architecturally dead code if input r6 is 0,
// only executes speculatively iff ptr bit is 1
r8 = *(u64 *)(r7 + 0) # encode bit in cache (0: slow, 1: fast)
SLOW:
[...]
After running this, the program can time the access to *(r7 + 0) to determine whether the chosen pointer bit was 0 or 1. Repeat this 64 times to recover the whole address on amd64.
In summary, sanitization can only be skipped if one scalar is overwritten with another scalar. Scalar-confusion due to speculative store bypass can not lead to invalid accesses because the pointer bounds deducted during verification are enforced using branchless logic. See 979d63d50c0c ("bpf: prevent out of bounds speculation on pointer arithmetic") for details.
Do not make the mitigation depend on !env->allow_{uninit_stack,ptr_leaks} because speculative leaks are likely unexpected if these were enabled. For example, leaking the address to a protected log file may be acceptable while disabling the mitigation might unintentionally leak the address into the cached-state of a map that is accessible to unprivileged processes.
--- kernel/bpf/verifier.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/bpf/verifier.c +3 -1
@@ -1924,7 +1924,9 @@ static int check_stack_write(struct bpf_verifier_env *env,bool sanitize = reg &&is_spillable_regtype (reg->type);for (i =0 ; i < size; i++) { -if (state->stack[spi].slot_type[i] ==STACK_INVALID ) { +u8 type = state->stack[spi].slot_type[i]; + +if (type !=STACK_MISC && type !=STACK_ZERO ) { sanitize = true;break ; }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 21/134 phy: rockchip-inno-usb2: Fix missing clk_disable_unprepare() in rockchip_usb2phy_power_on()
In reply to Greg Kroah-HartmanFrom: Shang XiaoJing <[email protected]>
[ Upstream commit 5daba914da0e48950e9407ea4d75fa57029c9adc ]
The clk_disable_unprepare() should be called in the error handling of rockchip_usb2phy_power_on().
--- drivers/phy/rockchip/phy-rockchip-inno-usb2.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/phy/rockchip/phy-rockchip-inno-usb2.c +3 -1
@@ -467,8 +467,10 @@ static int rockchip_usb2phy_power_on(struct phy *phy)return ret; ret =property_enable (base, &rport->port_cfg->phy_sus, false); -if (ret) +if (ret) { +clk_disable_unprepare (rphy->clk480m);return ret; + }/* waiting for the utmi_clk to become stable */ usleep_range (1500 ,2000 );
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 22/134 net: nfc: Fix use-after-free in local_cleanup()
In reply to Greg Kroah-HartmanFrom: Jisoo Jang <[email protected]>
[ Upstream commit 4bb4db7f3187c6e3de6b229ffc87cdb30a2d22b6 ]
Fix a use-after-free that occurs in kfree_skb() called from local_cleanup(). This could happen when killing nfc daemon (e.g. neard) after detaching an nfc device.
When detaching an nfc device, local_cleanup() called from nfc_llcp_unregister_device() frees local->rx_pending and decreases local->ref by kref_put() in nfc_llcp_local_put().
In the terminating process, nfc daemon releases all sockets and it leads to decreasing local->ref. After the last release of local->ref, local_cleanup() called from local_release() frees local->rx_pending again, which leads to the bug.
Setting local->rx_pending to NULL in local_cleanup() could prevent use-after-free when local_cleanup() is called twice.
Found by a modified version of syzkaller.
BUG: KASAN: use-after-free in kfree_skb() Call Trace:
dump_stack_lvl (lib/dump_stack.c:106) print_address_description.constprop.0.cold (mm/kasan/report.c:306) kasan_check_range (mm/kasan/generic.c:189)kfree_skb (net/core/skbuff.c:955)local_cleanup (net/nfc/llcp_core.c:159) nfc_llcp_local_put.part.0 (net/nfc/llcp_core.c:172) nfc_llcp_local_put (net/nfc/llcp_core.c:181) llcp_sock_destruct (net/nfc/llcp_sock.c:959) __sk_destruct (net/core/sock.c:2133)sk_destruct (net/core/sock.c:2181)__sk_free (net/core/sock.c:2192)sk_free (net/core/sock.c:2203)llcp_sock_release (net/nfc/llcp_sock.c:646) __sock_release (net/socket.c:650)sock_close (net/socket.c:1365)__fput (fs/file_table.c:306)task_work_run (kernel/task_work.c:179)ptrace_notify (kernel/signal.c:2354) syscall_exit_to_user_mode_prepare (kernel/entry/common.c:278) syscall_exit_to_user_mode (kernel/entry/common.c:296) do_syscall_64 (arch/x86/entry/common.c:86) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:106)
Allocated by task 4719:
kasan_save_stack (mm/kasan/common.c:45) __kasan_slab_alloc (mm/kasan/common.c:325) slab_post_alloc_hook (mm/slab.h:766) kmem_cache_alloc_node (mm/slub.c:3497) __alloc_skb (net/core/skbuff.c:552) pn533_recv_response (drivers/nfc/pn533/usb.c:65) __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1671) usb_giveback_urb_bh (drivers/usb/core/hcd.c:1704) tasklet_action_common.isra.0 (kernel/softirq.c:797) __do_softirq (kernel/softirq.c:571)
Freed by task 1901:
kasan_save_stack (mm/kasan/common.c:45) kasan_set_track (mm/kasan/common.c:52) kasan_save_free_info (mm/kasan/genericdd.c:518) __kasan_slab_free (mm/kasan/common.c:236) kmem_cache_free (mm/slub.c:3809)kfree_skbmem (net/core/skbuff.c:874)kfree_skb (net/core/skbuff.c:931) local_cleanup (net/nfc/llcp_core.c:159) nfc_llcp_unregister_device (net/nfc/llcp_core.c:1617) nfc_unregister_device (net/nfc/core.c:1179) pn53x_unregister_nfc (drivers/nfc/pn533/pn533.c:2846) pn533_usb_disconnect (drivers/nfc/pn533/usb.c:579) usb_unbind_interface (drivers/usb/core/driver.c:458) device_release_driver_internal (drivers/base/dd.c:1279) bus_remove_device (drivers/base/bus.c:529) device_del (drivers/base/core.c:3665) usb_disable_device (drivers/usb/core/message.c:1420) usb_disconnect (drivers/usb/core.c:2261) hub_event (drivers/usb/core/hub.c:5833)
process_one_work (arch/x86/include/asm/jump_label.h:27 include/linux/jump_label.h:212 include/trace/events/workqueue.h:108 kernel/workqueue.c:2281) worker_thread (include/linux/list.h:282 kernel/workqueue.c:2423)
kthread (kernel/kthread.c:319)ret_from_fork (arch/x86/entry/entry_64.S:301)
--- net/nfc/llcp_core.c | 1 + 1 file changed, 1 insertion(+)
net/nfc/llcp_core.c +1 -0
@@ -159,6 +159,7 @@ static void local_cleanup(struct nfc_llcp_local *local)cancel_work_sync (&local->rx_work);cancel_work_sync (&local->timeout_work);kfree_skb (local->rx_pending); + local->rx_pending =NULL ;del_timer_sync (&local->sdreq_timer);cancel_work_sync (&local->sdreq_timeout_work);nfc_llcp_free_sdp_tlv_list (&local->pending_sdreqs);
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 23/134 net: wan: Add checks for NULL for utdm in undo_uhdlc_init and unmap_si_regs
In reply to Greg Kroah-HartmanFrom: Esina Ekaterina <[email protected]>
[ Upstream commit 488e0bf7f34af3d42d1d5e56f7a5a7beaff188a3 ]
If uhdlc_priv_tsa != 1 then utdm is not initialized. And if ret != NULL then goto undo_uhdlc_init, where utdm is dereferenced. Same if dev == NULL.
Found by Astra Linux on behalf of Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/wan/fsl_ucc_hdlc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/wan/fsl_ucc_hdlc.c +4 -2
@@ -1249,9 +1249,11 @@ static int ucc_hdlc_probe(struct platform_device *pdev) free_dev:free_netdev (dev); undo_uhdlc_init: -iounmap (utdm->siram); +if (utdm) +iounmap (utdm->siram); unmap_si_regs: -iounmap (utdm->si_regs); +if (utdm) +iounmap (utdm->si_regs); free_utdm:if (uhdlc_priv->tsa)kfree (utdm);
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 24/134 gpio: mxc: Always set GPIOs used as interrupt source to INPUT mode
In reply to Greg Kroah-HartmanFrom: Marek Vasut <[email protected]>
[ Upstream commit 8e88a0feebb241cab0253698b2f7358b6ebec802 ]
Always configure GPIO pins which are used as interrupt source as INPUTs. In case the default pin configuration is OUTPUT, or the prior stage does configure the pins as OUTPUT, then Linux will not reconfigure the pin as INPUT and no interrupts are received.
Always configure the interrupt source GPIO pin as input to fix the above case.
--- drivers/gpio/gpio-mxc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpio/gpio-mxc.c +1 -1
@@ -229,7 +229,7 @@ static int gpio_set_irq_type(struct irq_data *d, u32 type)writel (1 << gpio_idx, port->base +GPIO_ISR ); -return 0 ; +return port->gc.direction_input (&port->gc, gpio_idx); }static void mxc_flip_edge (struct mxc_gpio_port *port,u32 gpio)
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 25/134 wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid
In reply to Greg Kroah-HartmanFrom: Szymon Heidrich <[email protected]>
[ Upstream commit b870e73a56c4cccbec33224233eaf295839f228c ]
Since resplen and respoffs are signed integers sufficiently large values of unsigned int len and offset members of RNDIS response will result in negative values of prior variables. This may be utilized to bypass implemented security checks to either extract memory contents by manipulating offset or overflow the data buffer via memcpy by manipulating both offset and len.
Additionally assure that sum of resplen and respoffs does not overflow so buffer boundaries are kept.
--- drivers/net/wireless/rndis_wlan.c | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-)
drivers/net/wireless/rndis_wlan.c +6 -13
@@ -700,8 +700,8 @@ static int rndis_query_oid(struct usbnet *dev, u32 oid, void *data, int *len)struct rndis_query *get;struct rndis_query_c *get_c; } u; -int ret, buflen; -int resplen, respoffs, copylen; +int ret; +size_t buflen, resplen, respoffs, copylen; buflen = *len +sizeof (*u.get);if (buflen <CONTROL_BUFFER_SIZE )
@@ -736,22 +736,15 @@ static int rndis_query_oid(struct usbnet *dev, u32 oid, void *data, int *len)if (respoffs > buflen) {/* Device returned data offset outside buffer, error. */ -netdev_dbg (dev->net,"%s(%s): received invalid " -"data offset: %d > %d\n" , __func__, -oid_to_string (oid), respoffs, buflen); +netdev_dbg (dev->net, +"%s(%s): received invalid data offset: %zu > %zu\n" , + __func__,oid_to_string (oid), respoffs, buflen); ret = -EINVAL ; goto exit_unlock; } -if ((resplen + respoffs) > buflen) { -/* Device would have returned more data if buffer would -* have been big enough. Copy just the bits that we got. -*/ - copylen = buflen - respoffs; - }else { - copylen = resplen; - } + copylen =min (resplen, buflen - respoffs);if (copylen > *len) copylen = *len;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 26/134 net/sched: sch_taprio: fix possible use-after-free
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 3a415d59c1dbec9d772dbfab2d2520d98360caae ]
syzbot reported a nasty crash [1] in net_tx_action() which made little sense until we got a repro.
This repro installs a taprio qdisc, but providing an invalid TCA_RATE attribute.
qdisc_create() has to destroy the just initialized taprio qdisc, and taprio_destroy() is called.
However, the hrtimer used by taprio had already fired, therefore advance_sched() called __netif_schedule().
Then net_tx_action was trying to use a destroyed qdisc.
We can not undo the __netif_schedule(), so we must wait until one cpu serviced the qdisc before we can proceed.
Many thanks to Alexander Potapenko for his help.
[1]
BUG: KMSAN: uninit-value in queued_spin_trylock include/asm-generic/qspinlock.h:94 [inline] BUG: KMSAN: uninit-value in do_raw_spin_trylock include/linux/spinlock.h:191 [inline] BUG: KMSAN: uninit-value in __raw_spin_trylock include/linux/spinlock_api_smp.h:89 [inline] BUG: KMSAN: uninit-value in _raw_spin_trylock+0x92/0xa0 kernel/locking/spinlock.c:138 queued_spin_trylock include/asm-generic/qspinlock.h:94 [inline] do_raw_spin_trylock include/linux/spinlock.h:191 [inline] __raw_spin_trylock include/linux/spinlock_api_smp.h:89 [inline] _raw_spin_trylock+0x92/0xa0 kernel/locking/spinlock.c:138 spin_trylock include/linux/spinlock.h:359 [inline] qdisc_run_begin include/net/sch_generic.h:187 [inline] qdisc_run+0xee/0x540 include/net/pkt_sched.h:125 net_tx_action+0x77c/0x9a0 net/core/dev.c:5086 __do_softirq+0x1cc/0x7fb kernel/softirq.c:571 run_ksoftirqd+0x2c/0x50 kernel/softirq.c:934 smpboot_thread_fn+0x554/0x9f0 kernel/smpboot.c:164 kthread+0x31b/0x430 kernel/kthread.c:376 ret_from_fork+0x1f/0x30
Uninit was created at:
slab_post_alloc_hook mm/slab.h:732 [inline] slab_alloc_node mm/slub.c:3258 [inline] __kmalloc_node_track_caller+0x814/0x1250 mm/slub.c:4970 kmalloc_reserve net/core/skbuff.c:358 [inline] __alloc_skb+0x346/0xcf0 net/core/skbuff.c:430 alloc_skb include/linux/skbuff.h:1257 [inline] nlmsg_new include/net/netlink.h:953 [inline] netlink_ack+0x5f3/0x12b0 net/netlink/af_netlink.c:2436 netlink_rcv_skb+0x55d/0x6c0 net/netlink/af_netlink.c:2507 rtnetlink_rcv+0x30/0x40 net/core/rtnetlink.c:6108 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0xf3b/0x1270 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x1288/0x1440 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0xabc/0xe90 net/socket.c:2482 ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2536 __sys_sendmsg net/socket.c:2565 [inline] __do_sys_sendmsg net/socket.c:2574 [inline] __se_sys_sendmsg net/socket.c:2572 [inline] __x64_sys_sendmsg+0x367/0x540 net/socket.c:2572 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd CPU: 0 PID: 13 Comm: ksoftirqd/0 Not tainted 6.0.0-rc2-syzkaller-47461-gac3859c02d7f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
--- include/net/sch_generic.h | 7 +++++++ net/sched/sch_taprio.c | 3 +++ 2 files changed, 10 insertions(+)
include/net/sch_generic.h +7 -0
@@ -1334,4 +1334,11 @@ static inline void skb_tc_reinsert(struct sk_buff *skb, struct tcf_result *res) qstats_overlimit_inc(res->qstats); } +/* Make sure qdisc is no longer in SCHED state. */ +static inline void qdisc_synchronize (const struct Qdisc *q) +{ +while (test_bit (__QDISC_STATE_SCHED, &q->state)) +msleep (1 ); +} +#endif
net/sched/sch_taprio.c +3 -0
@@ -1622,6 +1622,8 @@ static void taprio_reset(struct Qdisc *sch)int i;hrtimer_cancel (&q->advance_timer); +qdisc_synchronize (sch); +if (q->qdiscs) {for (i =0 ; i < dev->num_tx_queues && q->qdiscs[i]; i++)qdisc_reset (q->qdiscs[i]);
@@ -1644,6 +1646,7 @@ static void taprio_destroy(struct Qdisc *sch)* happens in qdisc_create(), after taprio_init() has been called. */ hrtimer_cancel (&q->advance_timer); +qdisc_synchronize (sch);taprio_disable_offload (dev, q,NULL );
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 27/134 net: fix a concurrency bug in l2tp_tunnel_register()
In reply to Greg Kroah-HartmanFrom: Gong, Sishuai <[email protected]>
[ Upstream commit 69e16d01d1de4f1249869de342915f608feb55d5 ]
l2tp_tunnel_register() registers a tunnel without fully initializing its attribute. This can allow another kernel thread running l2tp_xmit_core() to access the uninitialized data and then cause a kernel NULL pointer dereference error, as shown below.
Thread 1 Thread 2
//l2tp_tunnel_register()
list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list);
//pppol2tp_connect()
tunnel = l2tp_tunnel_get(sock_net(sk), info.tunnel_id);
// Fetch the new tunnel
...
//l2tp_xmit_core()
struct sock *sk = tunnel->sock;
...
bh_lock_sock(sk);
//Null pointer error happenstunnel->sock = sk;
Fix this bug by initializing tunnel->sock before adding the tunnel into l2tp_tunnel_list.
--- net/l2tp/l2tp_core.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
net/l2tp/l2tp_core.c +5 -5
@@ -1500,11 +1500,15 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, tunnel->l2tp_net = net; pn =l2tp_pernet (net); + sk = sock->sk; +sock_hold (sk); + tunnel->sock = sk; +spin_lock_bh (&pn->l2tp_tunnel_list_lock);list_for_each_entry (tunnel_walk, &pn->l2tp_tunnel_list, list) {if (tunnel_walk->tunnel_id == tunnel->tunnel_id) {spin_unlock_bh (&pn->l2tp_tunnel_list_lock); - +sock_put (sk); ret = -EEXIST ; goto err_sock; }
@@ -1512,10 +1516,6 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net,list_add_rcu (&tunnel->list, &pn->l2tp_tunnel_list);spin_unlock_bh (&pn->l2tp_tunnel_list_lock); - sk = sock->sk; -sock_hold (sk); - tunnel->sock = sk; -if (tunnel->encap ==L2TP_ENCAPTYPE_UDP ) {struct udp_tunnel_sock_cfg udp_cfg = { .sk_user_data = tunnel,
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 28/134 l2tp: Serialize access to sk_user_data with sk_callback_lock
In reply to Greg Kroah-HartmanFrom: Jakub Sitnicki <[email protected]>
[ Upstream commit b68777d54fac21fc833ec26ea1a2a84f975ab035 ]
sk->sk_user_data has multiple users, which are not compatible with each other. Writers must synchronize by grabbing the sk->sk_callback_lock.
l2tp currently fails to grab the lock when modifying the underlying tunnel socket fields. Fix it by adding appropriate locking.
We err on the side of safety and grab the sk_callback_lock also inside the sk_destruct callback overridden by l2tp, even though there should be no refs allowing access to the sock at the time when sk_destruct gets called.
v4:
- serialize write to sk_user_data in l2tp sk_destruct
v3:
- switch from sock lock to sk_callback_lock
- document write-protection for sk_user_data
v2:
- update Fixes to point to origin of the bug
- use real names in Reported/Tested-by tags
--- include/net/sock.h | 2 +- net/l2tp/l2tp_core.c | 19 +++++++++++++------ 2 files changed, 14 insertions(+), 7 deletions(-)
include/net/sock.h +1 -1
@@ -300,7 +300,7 @@ struct bpf_sk_storage;* @sk_tskey: counter to disambiguate concurrent tstamp requests * @sk_zckey: counter to order MSG_ZEROCOPY notifications * @sk_socket: Identd and reporting IO signals -* @sk_user_data: RPC layer private data +* @sk_user_data: RPC layer private data. Write-protected by @sk_callback_lock. * @sk_frag: cached page frag * @sk_peek_off: current peek_offset value * @sk_send_head: front of stuff to transmit
net/l2tp/l2tp_core.c +13 -6
@@ -1171,8 +1171,10 @@ static void l2tp_tunnel_destruct(struct sock *sk) }/* Remove hooks into tunnel socket */ +write_lock_bh (&sk->sk_callback_lock); sk->sk_destruct = tunnel->old_sk_destruct; sk->sk_user_data =NULL ; +write_unlock_bh (&sk->sk_callback_lock);/* Call the original destructor */ if (sk->sk_destruct)
@@ -1491,16 +1493,18 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, sock =sockfd_lookup (tunnel->fd, &ret);if (!sock) goto err; - - ret =l2tp_validate_socket (sock->sk, net, tunnel->encap); -if (ret <0 ) - goto err_sock; } + sk = sock->sk; +write_lock (&sk->sk_callback_lock); + + ret =l2tp_validate_socket (sk, net, tunnel->encap); +if (ret <0 ) + goto err_sock; + tunnel->l2tp_net = net; pn =l2tp_pernet (net); - sk = sock->sk;sock_hold (sk); tunnel->sock = sk;
@@ -1526,7 +1530,7 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net,setup_udp_tunnel_sock (net, sock, &udp_cfg); }else { - sk->sk_user_data = tunnel; +rcu_assign_sk_user_data (sk, tunnel); } tunnel->old_sk_destruct = sk->sk_destruct;
@@ -1538,6 +1542,7 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net,if (tunnel->fd >=0 )sockfd_put (sock); +write_unlock (&sk->sk_callback_lock);return 0 ; err_sock:
@@ -1545,6 +1550,8 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net,sock_release (sock); elsesockfd_put (sock ); + +write_unlock (&sk->sk_callback_lock); err:return ret; }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 29/134 l2tp: Dont sleep and disable BH under writer-side sk_callback_lock
In reply to Greg Kroah-HartmanFrom: Jakub Sitnicki <[email protected]>
[ Upstream commit af295e854a4e3813ffbdef26dbb6a4d6226c3ea1 ]
When holding a reader-writer spin lock we cannot sleep. Calling setup_udp_tunnel_sock() with write lock held violates this rule, because we end up calling percpu_down_read(), which might sleep, as syzbot reports [1]:
__might_resched.cold+0x222/0x26b kernel/sched/core.c:9890 percpu_down_read include/linux/percpu-rwsem.h:49 [inline] cpus_read_lock+0x1b/0x140 kernel/cpu.c:310 static_key_slow_inc+0x12/0x20 kernel/jump_label.c:158 udp_tunnel_encap_enable include/net/udp_tunnel.h:187 [inline] setup_udp_tunnel_sock+0x43d/0x550 net/ipv4/udp_tunnel_core.c:81 l2tp_tunnel_register+0xc51/0x1210 net/l2tp/l2tp_core.c:1509 pppol2tp_connect+0xcdc/0x1a10 net/l2tp/l2tp_ppp.c:723
Trim the writer-side critical section for sk_callback_lock down to the minimum, so that it covers only operations on sk_user_data.
Also, when grabbing the sk_callback_lock, we always need to disable BH, as Eric points out. Failing to do so leads to deadlocks because we acquire sk_callback_lock in softirq context, which can get stuck waiting on us if:
1) it runs on the same CPU, or
CPU0
----
lock(clock-AF_INET6);
<Interrupt>
lock(clock-AF_INET6);2) lock ordering leads to priority inversion
CPU0 CPU1
---- ----
lock(clock-AF_INET6);
local_irq_disable();
lock(&tcp_hashinfo.bhash[i].lock);
lock(clock-AF_INET6);
<Interrupt>
lock(&tcp_hashinfo.bhash[i].lock);... as syzbot reports [2,3]. Use the _bh variants for write_(un)lock.
[1] https://lore.kernel.org/netdev/[email protected]/
[2] https://lore.kernel.org/netdev/[email protected]/
[3] https://lore.kernel.org/netdev/[email protected]/
v2:
- Check and set sk_user_data while holding sk_callback_lock for both L2TP encapsulation types (IP and UDP) (Tetsuo)
--- net/l2tp/l2tp_core.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
net/l2tp/l2tp_core.c +9 -8
@@ -1496,11 +1496,12 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, } sk = sock->sk; -write_lock (&sk->sk_callback_lock); - +write_lock_bh (&sk->sk_callback_lock); ret =l2tp_validate_socket (sk, net, tunnel->encap);if (ret <0 ) - goto err_sock; + goto err_inval_sock; +rcu_assign_sk_user_data (sk, tunnel); +write_unlock_bh (&sk->sk_callback_lock); tunnel->l2tp_net = net; pn =l2tp_pernet (net);
@@ -1529,8 +1530,6 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net, };setup_udp_tunnel_sock (net, sock, &udp_cfg); - }else { -rcu_assign_sk_user_data (sk, tunnel); } tunnel->old_sk_destruct = sk->sk_destruct;
@@ -1542,16 +1541,18 @@ int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net,if (tunnel->fd >=0 )sockfd_put (sock); -write_unlock (&sk->sk_callback_lock);return 0 ; err_sock: +write_lock_bh (&sk->sk_callback_lock); +rcu_assign_sk_user_data (sk,NULL ); +err_inval_sock: +write_unlock_bh (&sk->sk_callback_lock); +if (tunnel->fd <0 )sock_release (sock);else sockfd_put (sock); - -write_unlock (&sk->sk_callback_lock); err:return ret; }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 30/134 net: usb: sr9700: Handle negative len
In reply to Greg Kroah-HartmanFrom: Szymon Heidrich <[email protected]>
[ Upstream commit ecf7cf8efb59789e2b21d2f9ab926142579092b2 ]
Packet len computed as difference of length word extracted from skb data and four may result in a negative value. In such case processing of the buffer should be interrupted rather than setting sr_skb->len to an unexpectedly large value (due to cast from signed to unsigned integer) and passing sr_skb to usbnet_skb_return.
--- drivers/net/usb/sr9700.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/usb/sr9700.c +1 -1
@@ -410,7 +410,7 @@ static int sr9700_rx_fixup(struct usbnet *dev, struct sk_buff *skb)/* ignore the CRC length */ len = (skb->data[1 ] | (skb->data[2 ] <<8 )) -4 ; -if (len >ETH_FRAME_LEN || len > skb->len) +if (len >ETH_FRAME_LEN || len > skb->len || len <0 )return 0 ;/* the last packet of current skb */
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 31/134 net: mdio: validate parameter addr in mdiobus_get_phy()
In reply to Greg Kroah-HartmanFrom: Heiner Kallweit <[email protected]>
[ Upstream commit 867dbe784c5010a466f00a7d1467c1c5ea569c75 ]
The caller may pass any value as addr, what may result in an out-of-bounds access to array mdio_map. One existing case is stmmac_init_phy() that may pass -1 as addr. Therefore validate addr before using it.
--- drivers/net/phy/mdio_bus.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/phy/mdio_bus.c +6 -1
@@ -117,7 +117,12 @@ EXPORT_SYMBOL(mdiobus_unregister_device);struct phy_device *mdiobus_get_phy (struct mii_bus *bus,int addr) { -struct mdio_device *mdiodev = bus->mdio_map[addr]; +struct mdio_device *mdiodev; + +if (addr <0 || addr >=ARRAY_SIZE (bus->mdio_map)) +return NULL ; + + mdiodev = bus->mdio_map[addr];if (!mdiodev)return NULL ;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 32/134 HID: check empty report_list in hid_validate_values()
In reply to Greg Kroah-HartmanFrom: Pietro Borrello <[email protected]>
[ Upstream commit b12fece4c64857e5fab4290bf01b2e0317a88456 ]
Add a check for empty report_list in hid_validate_values(). The missing check causes a type confusion when issuing a list_entry() on an empty report_list.
The problem is caused by the assumption that the device must have valid report_list. While this will be true for all normal HID devices, a suitably malicious device can violate the assumption.
--- drivers/hid/hid-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hid/hid-core.c +2 -2
@@ -981,8 +981,8 @@ struct hid_report *hid_validate_values(struct hid_device *hid,* Validating on id 0 means we should examine the first * report in the list. */ - report =list_entry ( - hid->report_enum[type].report_list.next, + report =list_first_entry_or_null ( + &hid->report_enum[type].report_list, struct hid_report, list); }else { report = hid->report_enum[type].report_id_hash[id];
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 33/134 HID: check empty report_list in bigben_probe()
In reply to Greg Kroah-HartmanFrom: Pietro Borrello <[email protected]>
[ Upstream commit c7bf714f875531f227f2ef1fdcc8f4d44e7c7d9d ]
Add a check for empty report_list in bigben_probe().
The missing check causes a type confusion when issuing a list_entry() on an empty report_list.
The problem is caused by the assumption that the device must have valid report_list. While this will be true for all normal HID devices, a suitably malicious device can violate the assumption.
--- drivers/hid/hid-bigbenff.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/hid/hid-bigbenff.c +5 -0
@@ -344,6 +344,11 @@ static int bigben_probe(struct hid_device *hid, } report_list = &hid->report_enum[HID_OUTPUT_REPORT ].report_list; +if (list_empty (report_list)) { +hid_err (hid,"no output report found\n" ); + error = -ENODEV ; + goto error_hw_stop; + } bigben->report =list_entry (report_list->next, struct hid_report, list);
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 34/134 net: stmmac: fix invalid call to mdiobus_get_phy()
In reply to Greg Kroah-HartmanFrom: Heiner Kallweit <[email protected]>
[ Upstream commit 1f3bd64ad921f051254591fbed04fd30b306cde6 ]
In a number of cases the driver assigns a default value of -1 to priv->plat->phy_addr. This may result in calling mdiobus_get_phy() with addr parameter being -1. Therefore check for this scenario and bail out before calling mdiobus_get_phy().
--- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +5 -0
@@ -998,6 +998,11 @@ static int stmmac_init_phy(struct net_device *dev)int addr = priv->plat->phy_addr;struct phy_device *phydev; +if (addr <0 ) { +netdev_err (priv->dev,"no phy found\n" ); +return -ENODEV ; + } + phydev =mdiobus_get_phy (priv->mii, addr);if (!phydev) {netdev_err (priv->dev,"no phy at addr %d\n" , addr);
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 35/134 HID: revert CHERRY_MOUSE_000C quirk
In reply to Greg Kroah-HartmanFrom: Jiri Kosina <[email protected]>
[ Upstream commit cbf44580ce6b310272a73e3e794233fd064330bd ]
This partially reverts commit f6d910a89a2391 ("HID: usbhid: Add ALWAYS_POLL quirk for some mice"), as it turns out to break reboot on some platforms for reason yet to be understood.
--- drivers/hid/hid-ids.h | 1 - drivers/hid/hid-quirks.c | 1 - 2 files changed, 2 deletions(-)
drivers/hid/hid-ids.h +0 -1
@@ -259,7 +259,6 @@#define USB_DEVICE_ID_CH_AXIS_295 0x001c#define USB_VENDOR_ID_CHERRY 0x046a -#define USB_DEVICE_ID_CHERRY_MOUSE_000C 0x000c#define USB_DEVICE_ID_CHERRY_CYMOTION 0x0023#define USB_DEVICE_ID_CHERRY_CYMOTION_SOLAR 0x0027
drivers/hid/hid-quirks.c +0 -1
@@ -54,7 +54,6 @@ static const struct hid_device_id hid_quirks[] = { { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE), HID_QUIRK_NOGET }, { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS), HID_QUIRK_NOGET }, { HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_THROTTLE), HID_QUIRK_NOGET }, - { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_MOUSE_000C), HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB), HID_QUIRK_NO_INIT_REPORTS }, { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE), HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB), HID_QUIRK_NO_INIT_REPORTS },
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 36/134 usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait
In reply to Greg Kroah-HartmanFrom: Udipto Goswami <[email protected]>
[ Upstream commit 6a19da111057f69214b97c62fb0ac59023970850 ]
While performing fast composition switch, there is a possibility that the process of ffs_ep0_write/ffs_ep0_read get into a race condition due to ep0req being freed up from functionfs_unbind.
Consider the scenario that the ffs_ep0_write calls the ffs_ep0_queue_wait by taking a lock &ffs->ev.waitq.lock. However, the functionfs_unbind isn't bounded so it can go ahead and mark the ep0req to NULL, and since there is no NULL check in ffs_ep0_queue_wait we will end up in use-after-free.
Fix this by making a serialized execution between the two functions using a mutex_lock(ffs->mutex).
--- drivers/usb/gadget/function/f_fs.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/gadget/function/f_fs.c +5 -0
@@ -278,6 +278,9 @@ static int __ffs_ep0_queue_wait(struct ffs_data *ffs, char *data, size_t len)struct usb_request *req = ffs->ep0req;int ret; +if (!req) +return -EINVAL ; + req->zero = len <le16_to_cpu (ffs->ev.setup.wLength);spin_unlock_irq (&ffs->ev.waitq.lock);
@@ -1900,10 +1903,12 @@ static void functionfs_unbind(struct ffs_data *ffs)ENTER ();if (!WARN_ON (!ffs->gadget)) { +mutex_lock (&ffs->mutex);usb_ep_free_request (ffs->gadget->ep0, ffs->ep0req); ffs->ep0req =NULL ; ffs->gadget =NULL ;clear_bit (FFS_FL_BOUND , &ffs->flags); +mutex_unlock (&ffs->mutex);ffs_data_put (ffs); } }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 37/134 usb: gadget: f_fs: Ensure ep0req is dequeued before free_request
In reply to Greg Kroah-HartmanFrom: Udipto Goswami <[email protected]>
[ Upstream commit ce405d561b020e5a46340eb5146805a625dcacee ]
As per the documentation, function usb_ep_free_request guarantees the request will not be queued or no longer be re-queued (or otherwise used). However, with the current implementation it doesn't make sure that the request in ep0 isn't reused.
Fix this by dequeuing the ep0req on functionfs_unbind before freeing the request to align with the definition.
--- drivers/usb/gadget/function/f_fs.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/gadget/function/f_fs.c +2 -0
@@ -1903,6 +1903,8 @@ static void functionfs_unbind(struct ffs_data *ffs)ENTER ();if (!WARN_ON (!ffs->gadget)) { +/* dequeue before freeing ep0req */ +usb_ep_dequeue (ffs->gadget->ep0, ffs->ep0req);mutex_lock (&ffs->mutex);usb_ep_free_request (ffs->gadget->ep0, ffs->ep0req); ffs->ep0req =NULL ;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 38/134 net: mlx5: eliminate anonymous module_init & module_exit
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 2c1e1b949024989e20907b84e11a731a50778416 ]
Eliminate anonymous module_init() and module_exit(), which can lead to confusion or ambiguity when reading System.map, crashes/oops/bugs, or an initcall_debug log.
Give each of these init and exit functions unique driver-specific names to eliminate the anonymous names.
Example 1: (System.map)
ffffffff832fc78c t init
ffffffff832fc79e t init
ffffffff832fc8f8 t init
Example 2: (initcall_debug log)
calling init+0x0/0x12 @ 1
initcall init+0x0/0x12 returned 0 after 15 usecs
calling init+0x0/0x60 @ 1
initcall init+0x0/0x60 returned 0 after 2 usecs
calling init+0x0/0x9a @ 1
initcall init+0x0/0x9a returned 0 after 74 usecs
--- drivers/net/ethernet/mellanox/mlx5/core/main.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/main.c +4 -4
@@ -1640,7 +1640,7 @@ static void mlx5_core_verify_params(void) } } -static int __init init (void ) +static int __init mlx5_init (void ) {int err;
@@ -1665,7 +1665,7 @@ static int __init init(void)return err; } -static void __exit cleanup(void) +static void __exit mlx5_cleanup(void) {#ifdef CONFIG_MLX5_CORE_EN mlx5e_cleanup ();
@@ -1674,5 +1674,5 @@ static void __exit cleanup(void)mlx5_unregister_debugfs (); } -module_init (init); -module_exit (cleanup); +module_init (mlx5_init); +module_exit (mlx5_cleanup);
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 39/134 drm/panfrost: fix GENERIC_ATOMIC64 dependency
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 6437a549ae178a3f5a5c03e983f291ebcdc2bbc7 ]
On ARMv5 and earlier, a randconfig build can still run into
WARNING: unmet direct dependencies detected for IOMMU_IO_PGTABLE_LPAE
Depends on [n]: IOMMU_SUPPORT [=y] && (ARM [=y] || ARM64 || COMPILE_TEST [=y]) && !GENERIC_ATOMIC64 [=y] Selected by [y]:
- DRM_PANFROST [=y] && HAS_IOMEM [=y] && DRM [=y] && (ARM [=y] || ARM64 || COMPILE_TEST [=y] && !GENERIC_ATOMIC64 [=y]) && MMU [=y]
Rework the dependencies to always require a working cmpxchg64.
--- drivers/gpu/drm/panfrost/Kconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/panfrost/Kconfig +2 -1
@@ -3,7 +3,8 @@ config DRM_PANFROST tristate "Panfrost (DRM support for ARM Mali Midgard/Bifrost GPUs)" depends on DRM - depends on ARM || ARM64 || (COMPILE_TEST && !GENERIC_ATOMIC64) + depends on ARM || ARM64 || COMPILE_TEST + depends on !GENERIC_ATOMIC64 # for IOMMU_IO_PGTABLE_LPAE depends on MMU select DRM_SCHED select IOMMU_SUPPORT
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 40/134 dmaengine: Fix double increment of client_count in dma_chan_get()
In reply to Greg Kroah-HartmanFrom: Koba Ko <[email protected]>
[ Upstream commit f3dc1b3b4750851a94212dba249703dd0e50bb20 ]
The first time dma_chan_get() is called for a channel the channel client_count is incorrectly incremented twice for public channels, first in balance_ref_count(), and again prior to returning. This results in an incorrect client count which will lead to the channel resources not being freed when they should be. A simple
test of repeated module load and unload of async_tx on a Dell Power Edge R7425 also shows this resulting in a kref underflow warning.
[ 124.329662] async_tx: api initialized (async) [ 129.000627] async_tx: api initialized (async) [ 130.047839] ------------[ cut here ]------------ [ 130.052472] refcount_t: underflow; use-after-free. [ 130.057279] WARNING: CPU: 3 PID: 19364 at lib/refcount.c:28 refcount_warn_saturate+0xba/0x110 [ 130.065811] Modules linked in: async_tx(-) rfkill intel_rapl_msr
intel_rapl_common amd64_edac edac_mce_amd ipmi_ssif kvm_amd dcdbas kvm mgag200 drm_shmem_helper acpi_ipmi irqbypass drm_kms_helper ipmi_si syscopyarea sysfillrect rapl pcspkr ipmi_devintf sysimgblt fb_sys_fops k10temp i2c_piix4 ipmi_msghandler acpi_power_meter acpi_cpufreq vfat fat drm fuse xfs libcrc32c sd_mod t10_pi sg ahci crct10dif_pclmul libahci crc32_pclmul crc32c_intel ghash_clmulni_intel igb megaraid_sas i40e libata i2c_algo_bit ccp sp5100_tco dca dm_mirror dm_region_hash dm_log dm_mod [last unloaded: async_tx]
[ 130.117361] CPU: 3 PID: 19364 Comm: modprobe Kdump: loaded Not tainted 5.14.0-185.el9.x86_64 #1 [ 130.126091] Hardware name: Dell Inc. PowerEdge R7425/02MJ3T, BIOS 1.18.0 01/17/2022 [ 130.133806] RIP: 0010:refcount_warn_saturate+0xba/0x110 [ 130.139041] Code: 01 01 e8 6d bd 55 00 0f 0b e9 72 9d 8a 00 80 3d 26 18 9c 01 00 75 85 48 c7 c7 f8 a3 03 9d c6 05 16 18 9c 01 01 e8 4a bd 55 00 <0f> 0b e9 4f 9d 8a 00 80 3d 01 18 9c 01 00 0f 85 5e ff ff ff 48 c7 [ 130.157807] RSP: 0018:ffffbf98898afe68 EFLAGS: 00010286 [ 130.163036] RAX: 0000000000000000 RBX: ffff9da06028e598 RCX: 0000000000000000 [ 130.170172] RDX: ffff9daf9de26480 RSI: ffff9daf9de198a0 RDI: ffff9daf9de198a0 [ 130.177316] RBP: ffff9da7cddf3970 R08: 0000000000000000 R09: 00000000ffff7fff [ 130.184459] R10: ffffbf98898afd00 R11: ffffffff9d9e8c28 R12: ffff9da7cddf1970 [ 130.191596] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 130.198739] FS: 00007f646435c740(0000) GS:ffff9daf9de00000(0000) knlGS:0000000000000000 [ 130.206832] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 130.212586] CR2: 00007f6463b214f0 CR3: 00000008ab98c000 CR4: 00000000003506e0 [ 130.219729] Call Trace: [ 130.222192] <TASK> [ 130.224305] dma_chan_put+0x10d/0x110 [ 130.227988] dmaengine_put+0x7a/0xa0 [ 130.231575] __do_sys_delete_module.constprop.0+0x178/0x280 [ 130.237157] ? syscall_trace_enter.constprop.0+0x145/0x1d0 [ 130.242652] do_syscall_64+0x5c/0x90 [ 130.246240] ? exc_page_fault+0x62/0x150 [ 130.250178] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 130.255243] RIP: 0033:0x7f6463a3f5ab [ 130.258830] Code: 73 01 c3 48 8b 0d 75 a8 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 45 a8 1b 00 f7 d8 64 89 01 48 [ 130.277591] RSP: 002b:00007fff22f972c8 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 [ 130.285164] RAX: ffffffffffffffda RBX: 000055b6786edd40 RCX: 00007f6463a3f5ab [ 130.292303] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055b6786edda8 [ 130.299443] RBP: 000055b6786edd40 R08: 0000000000000000 R09: 0000000000000000 [ 130.306584] R10: 00007f6463b9eac0 R11: 0000000000000206 R12: 000055b6786edda8 [ 130.313731] R13: 0000000000000000 R14: 000055b6786edda8 R15: 00007fff22f995f8 [ 130.320875] </TASK> [ 130.323081] ---[ end trace eff7156d56b5cf25 ]---
cat /sys/class/dma/dma0chan*/in_use would get the wrong result. 2
2
2
--- drivers/dma/dmaengine.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/dma/dmaengine.c +4 -3
@@ -212,7 +212,8 @@ static int dma_chan_get(struct dma_chan *chan)/* The channel is already in use, update client count */ if (chan->client_count) {__module_get (owner); - goto out; + chan->client_count++; +return 0 ; }if (!try_module_get (owner))
@@ -225,11 +226,11 @@ static int dma_chan_get(struct dma_chan *chan) goto err_out; } + chan->client_count++; +if (!dma_has_cap (DMA_PRIVATE , chan->device->cap_mask))balance_ref_count (chan); -out: - chan->client_count++;return 0 ; err_out:
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 41/134 net: macb: fix PTP TX timestamp failure due to packet padding
In reply to Greg Kroah-HartmanFrom: Robert Hancock <[email protected]>
[ Upstream commit 7b90f5a665acd46efbbfa677a3a3a18d01ad6487 ]
PTP TX timestamp handling was observed to be broken with this driver when using the raw Layer 2 PTP encapsulation. ptp4l was not receiving the expected TX timestamp after transmitting a packet, causing it to enter a failure state.
The problem appears to be due to the way that the driver pads packets which are smaller than the Ethernet minimum of 60 bytes. If headroom space was available in the SKB, this caused the driver to move the data back to utilize it. However, this appears to cause other data references in the SKB to become inconsistent. In particular, this caused the ptp_one_step_sync function to later (in the TX completion path) falsely detect the packet as a one-step SYNC packet, even when it was not, which caused the TX timestamp to not be processed when it should be.
Using the headroom for this purpose seems like an unnecessary complexity as this is not a hot path in the driver, and in most cases it appears that there is sufficient tailroom to not require using the headroom anyway. Remove this usage of headroom to prevent this inconsistency from occurring and causing other problems.
--- drivers/net/ethernet/cadence/macb_main.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-)
drivers/net/ethernet/cadence/macb_main.c +1 -8
@@ -1752,7 +1752,6 @@ static int macb_pad_and_fcs(struct sk_buff **skb, struct net_device *ndev)bool cloned =skb_cloned (*skb) ||skb_header_cloned (*skb) ||skb_is_nonlinear (*skb);int padlen =ETH_ZLEN - (*skb)->len; -int headroom =skb_headroom (*skb);int tailroom =skb_tailroom (*skb);struct sk_buff *nskb;u32 fcs;
@@ -1766,9 +1765,6 @@ static int macb_pad_and_fcs(struct sk_buff **skb, struct net_device *ndev)/* FCS could be appeded to tailroom. */ if (tailroom >=ETH_FCS_LEN ) goto add_fcs; -/* FCS could be appeded by moving data to headroom. */ -else if (!cloned && headroom + tailroom >=ETH_FCS_LEN ) - padlen =0 ;/* No room for FCS, need to reallocate skb. */ else padlen =ETH_FCS_LEN ;
@@ -1777,10 +1773,7 @@ static int macb_pad_and_fcs(struct sk_buff **skb, struct net_device *ndev) padlen +=ETH_FCS_LEN ; } -if (!cloned && headroom + tailroom >= padlen) { - (*skb)->data =memmove ((*skb)->head, (*skb)->data, (*skb)->len); -skb_set_tail_pointer (*skb, (*skb)->len); - }else { +if (cloned || tailroom < padlen) { nskb =skb_copy_expand (*skb,0 , padlen,GFP_ATOMIC );if (!nskb)return -ENOMEM ;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 42/134 HID: betop: check shape of output reports
In reply to Greg Kroah-HartmanFrom: Pietro Borrello <[email protected]>
[ Upstream commit 3782c0d6edf658b71354a64d60aa7a296188fc90 ]
betopff_init() only checks the total sum of the report counts for each report field to be at least 4, but hid_betopff_play() expects 4 report fields.
A device advertising an output report with one field and 4 report counts would pass the check but crash the kernel with a NULL pointer dereference in hid_betopff_play().
--- drivers/hid/hid-betopff.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
drivers/hid/hid-betopff.c +9 -8
@@ -60,7 +60,6 @@ static int betopff_init(struct hid_device *hid)struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT ].report_list;struct input_dev *dev; -int field_count =0 ;int error;int i, j;
@@ -86,19 +85,21 @@ static int betopff_init(struct hid_device *hid)* ----------------------------------------- * Do init them with default value. */ +if (report->maxfield <4 ) { +hid_err (hid,"not enough fields in the report: %d\n" , + report->maxfield); +return -ENODEV ; + }for (i =0 ; i < report->maxfield; i++) { +if (report->field[i]->report_count <1 ) { +hid_err (hid,"no values in the field\n" ); +return -ENODEV ; + }for (j =0 ; j < report->field[i]->report_count; j++) { report->field[i]->value[j] =0x00 ; - field_count++; } } -if (field_count <4 ) { -hid_err (hid,"not enough fields in the report: %d\n" , - field_count); -return -ENODEV ; - } - betopff =kzalloc (sizeof (*betopff),GFP_KERNEL );if (!betopff)return -ENOMEM ;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 43/134 dmaengine: xilinx_dma: use devm_platform_ioremap_resource()
In reply to Greg Kroah-HartmanFrom: Radhey Shyam Pandey <[email protected]>
[ Upstream commit a8bd47542863947e2433db35558477caf0d89995 ]
Replace the chain of platform_get_resource() and devm_ioremap_resource() with devm_platform_ioremap_resource(). It simplifies the flow and there is no functional change.
Fixes below cocinelle warning-
WARNING: Use devm_platform_ioremap_resource for xdev -> regs
Stable-dep-of: 596b53ccc36a ("dmaengine: xilinx_dma: call of_node_put() when breaking out of for_each_child_of_node()")
--- drivers/dma/xilinx/xilinx_dma.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/dma/xilinx/xilinx_dma.c +1 -3
@@ -2626,7 +2626,6 @@ static int xilinx_dma_probe(struct platform_device *pdev)struct device_node *node = pdev->dev.of_node;struct xilinx_dma_device *xdev;struct device_node *child, *np = pdev->dev.of_node; -struct resource *io;u32 num_frames, addr_width, len_width;int i, err;
@@ -2652,8 +2651,7 @@ static int xilinx_dma_probe(struct platform_device *pdev)return err;/* Request and map I/O memory */ - io =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); - xdev->regs =devm_ioremap_resource (&pdev->dev, io); + xdev->regs =devm_platform_ioremap_resource (pdev,0 );if (IS_ERR (xdev->regs))return PTR_ERR (xdev->regs);
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 44/134 dmaengine: xilinx_dma: Fix devm_platform_ioremap_resource error handling
In reply to Greg Kroah-HartmanFrom: Swati Agarwal <[email protected]>
[ Upstream commit 91df7751eb890e970afc08f50b8f0fa5ea39e03d ]
Add missing cleanup in devm_platform_ioremap_resource(). When probe fails remove dma channel resources and disable clocks in accordance with the order of resources allocated .
Stable-dep-of: 596b53ccc36a ("dmaengine: xilinx_dma: call of_node_put() when breaking out of for_each_child_of_node()")
--- drivers/dma/xilinx/xilinx_dma.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/dma/xilinx/xilinx_dma.c +7 -6
@@ -2652,9 +2652,10 @@ static int xilinx_dma_probe(struct platform_device *pdev)/* Request and map I/O memory */ xdev->regs =devm_platform_ioremap_resource (pdev,0 ); -if (IS_ERR (xdev->regs)) -return PTR_ERR (xdev->regs); - +if (IS_ERR (xdev->regs)) { + err =PTR_ERR (xdev->regs); + goto disable_clks; + }/* Retrieve the DMA engine properties from the device tree */ xdev->max_buffer_len =GENMASK (XILINX_DMA_MAX_TRANS_LEN_MAX -1 ,0 );
@@ -2747,7 +2748,7 @@ static int xilinx_dma_probe(struct platform_device *pdev)for_each_child_of_node (node, child) { err =xilinx_dma_child_probe (xdev, child);if (err <0 ) - goto disable_clks; + goto error; }if (xdev->dma_config->dmatype ==XDMA_TYPE_VDMA ) {
@@ -2780,12 +2781,12 @@ static int xilinx_dma_probe(struct platform_device *pdev)return 0 ; -disable_clks: -xdma_disable_allclks (xdev); error:for (i =0 ; i < xdev->nr_channels; i++)if (xdev->chan[i])xilinx_dma_chan_remove (xdev->chan[i]); +disable_clks: +xdma_disable_allclks (xdev);return err; }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 45/134 dmaengine: xilinx_dma: call of_node_put() when breaking out of for_each_child_of_node()
In reply to Greg Kroah-HartmanFrom: Liu Shixin <[email protected]>
[ Upstream commit 596b53ccc36a546ab28e8897315c5b4d1d5a0200 ]
Since for_each_child_of_node() will increase the refcount of node, we need to call of_node_put() manually when breaking out of the iteration.
--- drivers/dma/xilinx/xilinx_dma.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/dma/xilinx/xilinx_dma.c +3 -1
@@ -2747,8 +2747,10 @@ static int xilinx_dma_probe(struct platform_device *pdev)/* Initialize the channels */ for_each_child_of_node (node, child) { err =xilinx_dma_child_probe (xdev, child); -if (err <0 ) +if (err <0 ) { +of_node_put (child); goto error; + } }if (xdev->dma_config->dmatype ==XDMA_TYPE_VDMA ) {
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 46/134 tcp: avoid the lookup process failing to get sk in ehash table
In reply to Greg Kroah-HartmanFrom: Jason Xing <[email protected]>
[ Upstream commit 3f4ca5fafc08881d7a57daa20449d171f2887043 ]
While one cpu is working on looking up the right socket from ehash table, another cpu is done deleting the request socket and is about to add (or is adding) the big socket from the table. It means that we could miss both of them, even though it has little chance.
Let me draw a call trace map of the server side.
CPU 0 CPU 1
----- -----tcp_v4_rcv() syn_recv_sock()
inet_ehash_insert()
-> sk_nulls_del_node_init_rcu(osk)
__inet_lookup_established()
-> __sk_nulls_add_node_rcu(sk, list)Notice that the CPU 0 is receiving the data after the final ack during 3-way shakehands and CPU 1 is still handling the final ack.
Why could this be a real problem?
This case is happening only when the final ack and the first data receiving by different CPUs. Then the server receiving data with ACK flag tries to search one proper established socket from ehash table, but apparently it fails as my map shows above. After that, the server fetches a listener socket and then sends a RST because it finds a ACK flag in the skb (data), which obeys RST definition in RFC 793.
Besides, Eric pointed out there's one more race condition where it handles tw socket hashdance. Only by adding to the tail of the list before deleting the old one can we avoid the race if the reader has already begun the bucket traversal and it would possibly miss the head.
Many thanks to Eric for great help from beginning to end.
--- net/ipv4/inet_hashtables.c | 17 +++++++++++++++-- net/ipv4/inet_timewait_sock.c | 8 ++++---- 2 files changed, 19 insertions(+), 6 deletions(-)
net/ipv4/inet_hashtables.c +15 -2
@@ -536,8 +536,20 @@ bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk)spin_lock (lock);if (osk) {WARN_ON_ONCE (sk->sk_hash != osk->sk_hash); - ret =sk_nulls_del_node_init_rcu (osk); - }else if (found_dup_sk) { + ret =sk_hashed (osk); +if (ret) { +/* Before deleting the node, we insert a new one to make +* sure that the look-up-sk process would not miss either +* of them and that at least one node would exist in ehash +* table all the time. Otherwise there's a tiny chance +* that lookup process could find nothing in ehash table. +*/ +__sk_nulls_add_node_tail_rcu (sk, list); +sk_nulls_del_node_init_rcu (osk); + } + goto unlock; + } +if (found_dup_sk) { *found_dup_sk =inet_ehash_lookup_by_sk (sk, list);if (*found_dup_sk) ret = false;
@@ -546,6 +558,7 @@ bool inet_ehash_insert(struct sock *sk, struct sock *osk, bool *found_dup_sk)if (ret)__sk_nulls_add_node_rcu (sk, list); +unlock:spin_unlock (lock);return ret;
net/ipv4/inet_timewait_sock.c +4 -4
@@ -81,10 +81,10 @@ void inet_twsk_put(struct inet_timewait_sock *tw) }EXPORT_SYMBOL_GPL (inet_twsk_put); -static void inet_twsk_add_node_rcu (struct inet_timewait_sock *tw, -struct hlist_nulls_head *list) +static void inet_twsk_add_node_tail_rcu (struct inet_timewait_sock *tw, +struct hlist_nulls_head *list) { -hlist_nulls_add_head_rcu (&tw->tw_node, list); +hlist_nulls_add_tail_rcu (&tw->tw_node, list); } static void inet_twsk_add_bind_node(struct inet_timewait_sock *tw,
@@ -120,7 +120,7 @@ void inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,spin_lock (lock); -inet_twsk_add_node_rcu (tw, &ehead->chain); +inet_twsk_add_node_tail_rcu (tw, &ehead->chain);/* Step 3: Remove SK from hash chain */ if (__sk_nulls_del_node_init_rcu (sk))
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 47/134 w1: fix deadloop in __w1_remove_master_device()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 25d5648802f12ae486076ceca5d7ddf1fef792b2 ]
I got a deadloop report while doing device(ds2482) add/remove test:
[ 162.241881] w1_master_driver w1_bus_master1: Waiting for w1_bus_master1 to become free: refcnt=1. [ 163.272251] w1_master_driver w1_bus_master1: Waiting for w1_bus_master1 to become free: refcnt=1. [ 164.296157] w1_master_driver w1_bus_master1: Waiting for w1_bus_master1 to become free: refcnt=1. ...
__w1_remove_master_device() can't return, because the dev->refcnt is not zero.
w1_add_master_device() |
w1_alloc_dev() |
atomic_set(&dev->refcnt, 2) |
kthread_run() |
|__w1_remove_master_device()
| kthread_stop()
// KTHREAD_SHOULD_STOP is set, |
// threadfn(w1_process) won't be |
// called. |
kthread() |
| // refcnt will never be 0, it's deadloop.
| while (atomic_read(&dev->refcnt)) {...}After calling w1_add_master_device(), w1_process() is not really invoked, before w1_process() starting, if kthread_stop() is called in __w1_remove_master_device(), w1_process() will never be called, the refcnt can not be decreased, then it causes deadloop in remove function because of non-zero refcnt.
We need to make sure w1_process() is really started, so move the set refcnt into w1_process() to fix this problem.
--- drivers/w1/w1.c | 2 ++ drivers/w1/w1_int.c | 5 ++--- 2 files changed, 4 insertions(+), 3 deletions(-)
drivers/w1/w1.c +2 -0
@@ -1131,6 +1131,8 @@ int w1_process(void *data)/* remainder if it woke up early */ unsigned long jremain =0 ; +atomic_inc (&dev->refcnt); +for (;;) {if (!jremain && dev->search_count) {
drivers/w1/w1_int.c +2 -3
@@ -51,10 +51,9 @@ static struct w1_master *w1_alloc_dev(u32 id, int slave_count, int slave_ttl, dev->search_count = w1_search_count; dev->enable_pullup = w1_enable_pullup; -/* 1 for w1_process to decrement -* 1 for __w1_remove_master_device to decrement +/* For __w1_remove_master_device to decrement */ -atomic_set (&dev->refcnt,2 ); +atomic_set (&dev->refcnt,1 );INIT_LIST_HEAD (&dev->slist);INIT_LIST_HEAD (&dev->async_list);
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 48/134 w1: fix WARNING after calling w1_process()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 36225a7c72e9e3e1ce4001b6ce72849f5c9a2d3b ]
I got the following WARNING message while removing driver(ds2482):
------------[ cut here ]------------ do not call blocking ops when !TASK_RUNNING; state=1 set at [<000000002d50bfb6>] w1_process+0x9e/0x1d0 [wire] WARNING: CPU: 0 PID: 262 at kernel/sched/core.c:9817 __might_sleep+0x98/0xa0 CPU: 0 PID: 262 Comm: w1_bus_master1 Tainted: G N 6.1.0-rc3+ #307 RIP: 0010:__might_sleep+0x98/0xa0 Call Trace: exit_signals+0x6c/0x550 do_exit+0x2b4/0x17e0 kthread_exit+0x52/0x60 kthread+0x16d/0x1e0 ret_from_fork+0x1f/0x30
The state of task is set to TASK_INTERRUPTIBLE in loop in w1_process(), set it to TASK_RUNNING when it breaks out of the loop to avoid the warning.
--- drivers/w1/w1.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/w1/w1.c +3 -1
@@ -1160,8 +1160,10 @@ int w1_process(void *data)*/ mutex_unlock (&dev->list_mutex); -if (kthread_should_stop ()) +if (kthread_should_stop ()) { +__set_current_state (TASK_RUNNING );break ; + }/* Only sleep when the search is active. */ if (dev->search_count) {
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 49/134 driver core: Fix test_async_probe_init saves device in wrong array
In reply to Greg Kroah-HartmanFrom: Chen Zhongjin <[email protected]>
[ Upstream commit 9be182da0a7526f1b9a3777a336f83baa2e64d23 ]
In test_async_probe_init, second set of asynchronous devices are saved in sync_dev[sync_id], which should be async_dev[async_id]. This makes these devices not unregistered when exit.
Quoted 3 lines
modprobe
test_async_driver_probe&& \
modprobe -rtest_async_driver_probe&& \
modprobetest_async_driver_probe
...
Quoted 2 lines
sysfs: cannot create duplicate filename '/devices/platform/test_async_driver.4'
kobject_add_internalfailed for test_async_driver.4 with-EEXIST,
don't try to register things with the same name in the same directory.
--- drivers/base/test/test_async_driver_probe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/test/test_async_driver_probe.c +1 -1
@@ -146,7 +146,7 @@ static int __init test_async_probe_init(void) calltime =ktime_get ();for_each_online_cpu (cpu) { nid =cpu_to_node (cpu); - pdev = &sync_dev[sync_id]; + pdev = &async_dev[async_id]; *pdev = test_platform_device_register_node("test_async_driver", async_id,
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 50/134 net: dsa: microchip: ksz9477: port map correction in ALU table entry register
In reply to Greg Kroah-HartmanFrom: Rakesh Sankaranarayanan <[email protected]>
[ Upstream commit 6c977c5c2e4c5d8ad1b604724cc344e38f96fe9b ]
ALU table entry 2 register in KSZ9477 have bit positions reserved for forwarding port map. This field is referred in ksz9477_fdb_del() for clearing forward port map and alu table.
But current fdb_del refer ALU table entry 3 register for accessing forward port map. Update ksz9477_fdb_del() to get forward port map from correct alu table entry register.
With this bug, issue can be observed while deleting static MAC entries. Delete any specific MAC entry using "bridge fdb del" command. This should clear all the specified MAC entries. But it is observed that entries with self static alone are retained.
Tested on LAN9370 EVB since ksz9477_fdb_del() is used common across LAN937x and KSZ series.
--- drivers/net/dsa/microchip/ksz9477.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/dsa/microchip/ksz9477.c +2 -2
@@ -682,10 +682,10 @@ static int ksz9477_port_fdb_del(struct dsa_switch *ds, int port,ksz_read32 (dev,REG_SW_ALU_VAL_D , &alu_table[3 ]);/* clear forwarding port */ - alu_table[2 ] &= ~BIT (port); + alu_table[1 ] &= ~BIT (port);/* if there is no port to forward, clear table */ -if ((alu_table[2 ] &ALU_V_PORT_MAP ) ==0 ) { +if ((alu_table[1 ] &ALU_V_PORT_MAP ) ==0 ) { alu_table[0 ] =0 ; alu_table[1 ] =0 ; alu_table[2 ] =0 ;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 51/134 tcp: fix rate_app_limited to default to 1
In reply to Greg Kroah-HartmanFrom: David Morley <[email protected]>
[ Upstream commit 300b655db1b5152d6101bcb6801d50899b20c2d6 ]
The initial default value of 0 for tp->rate_app_limited was incorrect, since a flow is indeed application-limited until it first sends data. Fixing the default to be 1 is generally correct but also specifically will help user-space applications avoid using the initial tcpi_delivery_rate value of 0 that persists until the connection has some non-zero bandwidth sample.
--- net/ipv4/tcp.c | 2 ++ 1 file changed, 2 insertions(+)
net/ipv4/tcp.c +2 -0
@@ -429,6 +429,7 @@ void tcp_init_sock(struct sock *sk)/* There's a bubble in the pipe until at least the first ACK. */ tp->app_limited = ~0U ; + tp->rate_app_limited =1 ;/* See draft-stevens-tcpca-spec-01 for discussion of the * initialization of these values.
@@ -2675,6 +2676,7 @@ int tcp_disconnect(struct sock *sk, int flags) tp->last_oow_ack_time =0 ;/* There's a bubble in the pipe until at least the first ACK. */ tp->app_limited = ~0U ; + tp->rate_app_limited =1 ; tp->rack.mstamp =0 ; tp->rack.advanced =0 ; tp->rack.reo_wnd_steps =1 ;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 52/134 cpufreq: Add Tegra234 to cpufreq-dt-platdev blocklist
In reply to Greg Kroah-HartmanFrom: Sumit Gupta <[email protected]>
[ Upstream commit 01c5bb0cc2a39fbc56ff9a5ef28b79447f0c2351 ]
Tegra234 platform uses the tegra194-cpufreq driver, so add it to the blocklist in cpufreq-dt-platdev driver to avoid the cpufreq driver registration from there.
--- drivers/cpufreq/cpufreq-dt-platdev.c | 1 + 1 file changed, 1 insertion(+)
drivers/cpufreq/cpufreq-dt-platdev.c +1 -0
@@ -126,6 +126,7 @@ static const struct of_device_id blacklist[] __initconst = { { .compatible = "nvidia,tegra124", }, { .compatible = "nvidia,tegra210", }, + { .compatible = "nvidia,tegra234", }, { .compatible = "qcom,apq8096", }, { .compatible = "qcom,msm8996", },
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 53/134 ASoC: fsl_micfil: Correct the number of steps on SX controls
In reply to Greg Kroah-HartmanFrom: Chancel Liu <[email protected]>
[ Upstream commit cdfa92eb90f5770b26a79824ef213ebdbbd988b1 ]
The parameter "max" of SOC_SINGLE_SX_TLV() means the number of steps rather than maximum value. This patch corrects the minimum value to -8 and the number of steps to 15.
--- sound/soc/fsl/fsl_micfil.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
sound/soc/fsl/fsl_micfil.c +8 -8
@@ -87,21 +87,21 @@ static DECLARE_TLV_DB_SCALE(gain_tlv, 0, 100, 0);static const struct snd_kcontrol_new fsl_micfil_snd_controls[] = {SOC_SINGLE_SX_TLV ("CH0 Volume" ,REG_MICFIL_OUT_CTRL , -MICFIL_OUTGAIN_CHX_SHIFT (0 ),0xF ,0x7 , gain_tlv), +MICFIL_OUTGAIN_CHX_SHIFT (0 ),0x8 ,0xF , gain_tlv),SOC_SINGLE_SX_TLV ("CH1 Volume" ,REG_MICFIL_OUT_CTRL , -MICFIL_OUTGAIN_CHX_SHIFT (1 ),0xF ,0x7 , gain_tlv), +MICFIL_OUTGAIN_CHX_SHIFT (1 ),0x8 ,0xF , gain_tlv),SOC_SINGLE_SX_TLV ("CH2 Volume" ,REG_MICFIL_OUT_CTRL , -MICFIL_OUTGAIN_CHX_SHIFT (2 ),0xF ,0x7 , gain_tlv), +MICFIL_OUTGAIN_CHX_SHIFT (2 ),0x8 ,0xF , gain_tlv),SOC_SINGLE_SX_TLV ("CH3 Volume" ,REG_MICFIL_OUT_CTRL , -MICFIL_OUTGAIN_CHX_SHIFT (3 ),0xF ,0x7 , gain_tlv), +MICFIL_OUTGAIN_CHX_SHIFT (3 ),0x8 ,0xF , gain_tlv),SOC_SINGLE_SX_TLV ("CH4 Volume" ,REG_MICFIL_OUT_CTRL , -MICFIL_OUTGAIN_CHX_SHIFT (4 ),0xF ,0x7 , gain_tlv), +MICFIL_OUTGAIN_CHX_SHIFT (4 ),0x8 ,0xF , gain_tlv),SOC_SINGLE_SX_TLV ("CH5 Volume" ,REG_MICFIL_OUT_CTRL , -MICFIL_OUTGAIN_CHX_SHIFT (5 ),0xF ,0x7 , gain_tlv), +MICFIL_OUTGAIN_CHX_SHIFT (5 ),0x8 ,0xF , gain_tlv),SOC_SINGLE_SX_TLV ("CH6 Volume" ,REG_MICFIL_OUT_CTRL , -MICFIL_OUTGAIN_CHX_SHIFT (6 ),0xF ,0x7 , gain_tlv), +MICFIL_OUTGAIN_CHX_SHIFT (6 ),0x8 ,0xF , gain_tlv),SOC_SINGLE_SX_TLV ("CH7 Volume" ,REG_MICFIL_OUT_CTRL , -MICFIL_OUTGAIN_CHX_SHIFT (7 ),0xF ,0x7 , gain_tlv), +MICFIL_OUTGAIN_CHX_SHIFT (7 ),0x8 ,0xF , gain_tlv),SOC_ENUM_EXT ("MICFIL Quality Select" , fsl_micfil_quality_enum, snd_soc_get_enum_double, snd_soc_put_enum_double),
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 54/134 drm: Add orientation quirk for Lenovo ideapad D330-10IGL
In reply to Greg Kroah-HartmanFrom: Patrick Thompson <[email protected]>
[ Upstream commit 0688773f0710528e1ab302c3d6317e269f2e2e6e ]
Panel is 800x1280 but mounted on a detachable form factor sideways.
--- drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/drm_panel_orientation_quirks.c +6 -0
@@ -272,6 +272,12 @@ static const struct dmi_system_id orientation_data[] = { DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad D330-10IGM"), }, .driver_data = (void *)&lcd1200x1920_rightside_up, + }, { /* Lenovo Ideapad D330-10IGL (HD) */ + .matches = { +DMI_EXACT_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), + DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo ideapad D330-10IGL"), + }, + .driver_data = (void *)&lcd800x1280_rightside_up, }, { /* Lenovo Yoga Book X90F / X91F / X91L */ .matches = {/* Non exact match to match all versions */
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 55/134 s390/debug: add _ASM_S390_ prefix to header guard
In reply to Greg Kroah-HartmanFrom: Niklas Schnelle <[email protected]>
[ Upstream commit 0d4d52361b6c29bf771acd4fa461f06d78fb2fac ]
Using DEBUG_H without a prefix is very generic and inconsistent with other header guards in arch/s390/include/asm. In fact it collides with the same name in the ath9k wireless driver though that depends on !S390 via disabled wireless support. Let's just use a consistent header guard name and prevent possible future trouble.
--- arch/s390/include/asm/debug.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/s390/include/asm/debug.h +3 -3
@@ -4,8 +4,8 @@* * Copyright IBM Corp. 1999, 2000 */ -#ifndef DEBUG_H -#define DEBUG_H +#ifndef _ASM_S390_DEBUG_H +#define _ASM_S390_DEBUG_H#include <linux/string.h> #include <linux/spinlock.h>
@@ -416,4 +416,4 @@ int debug_unregister_view(debug_info_t *id, struct debug_view *view); #define PRINT_FATAL(x...) printk(KERN_DEBUG PRINTK_HEADER x)#endif /* DASD_DEBUG */ -#endif /* DEBUG_H */ +#endif /* _ASM_S390_DEBUG_H */
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 56/134 cpufreq: armada-37xx: stop using 0 as NULL pointer
In reply to Greg Kroah-HartmanFrom: Miles Chen <[email protected]>
[ Upstream commit 08f0adb193c008de640fde34a2e00a666c01d77c ]
Use NULL for NULL pointer to fix the following sparse warning:drivers/cpufreq/armada-37xx-cpufreq.c:448:32: sparse: warning: Using plain integer as NULL pointer
--- drivers/cpufreq/armada-37xx-cpufreq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cpufreq/armada-37xx-cpufreq.c +1 -1
@@ -443,7 +443,7 @@ static int __init armada37xx_cpufreq_driver_init(void)return -ENODEV ; } - clk =clk_get (cpu_dev,0 ); + clk =clk_get (cpu_dev,NULL );if (IS_ERR (clk)) {dev_err (cpu_dev,"Cannot get clock for CPU0\n" );return PTR_ERR (clk);
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 57/134 ASoC: fsl_ssi: Rename AC97 streams to avoid collisions with AC97 CODEC
In reply to Greg Kroah-HartmanFrom: Mark Brown <[email protected]>
[ Upstream commit 8c6a42b5b0ed6f96624f56954e93eeae107440a6 ]
The SSI driver calls the AC'97 playback and transmit streams "AC97 Playback" and "AC97 Capture" respectively. This is the same name used by the generic AC'97 CODEC driver in ASoC, creating confusion for the Freescale ASoC card when it attempts to use these widgets in routing. Add a "CPU" in the name like the regular DAIs registered by the driver to disambiguate.
--- sound/soc/fsl/fsl-asoc-card.c | 8 ++++---- sound/soc/fsl/fsl_ssi.c | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-)
sound/soc/fsl/fsl-asoc-card.c +4 -4
@@ -112,11 +112,11 @@ static const struct snd_soc_dapm_route audio_map[] = {static const struct snd_soc_dapm_route audio_map_ac97[] = {/* 1st half -- Normal DAPM routes */ - {"Playback" ,NULL ,"AC97 Playback" }, - {"AC97 Capture" ,NULL ,"Capture" }, + {"Playback" ,NULL ,"CPU AC97 Playback" }, + {"CPU AC97 Capture" ,NULL ,"Capture" },/* 2nd half -- ASRC DAPM routes */ - {"AC97 Playback" ,NULL ,"ASRC-Playback" }, - {"ASRC-Capture" ,NULL ,"AC97 Capture" }, + {"CPU AC97 Playback" ,NULL ,"ASRC-Playback" }, + {"ASRC-Capture" ,NULL ,"CPU AC97 Capture" }, };/* Add all possible widgets into here without being redundant */
sound/soc/fsl/fsl_ssi.c +2 -2
@@ -1147,14 +1147,14 @@ static struct snd_soc_dai_driver fsl_ssi_ac97_dai = { .symmetric_channels = 1, .probe = fsl_ssi_dai_probe, .playback = { - .stream_name = "AC97 Playback", + .stream_name = "CPU AC97 Playback", .channels_min = 2, .channels_max = 2, .rates = SNDRV_PCM_RATE_8000_48000, .formats = SNDRV_PCM_FMTBIT_S16 | SNDRV_PCM_FMTBIT_S20, }, .capture = { - .stream_name = "AC97 Capture", + .stream_name = "CPU AC97 Capture", .channels_min = 2, .channels_max = 2, .rates = SNDRV_PCM_RATE_48000,
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 58/134 ASoC: fsl-asoc-card: Fix naming of AC97 CODEC widgets
In reply to Greg Kroah-HartmanFrom: Mark Brown <[email protected]>
[ Upstream commit 242fc66ae6e1e2b8519daacc7590a73cd0e8a6e4 ]
The fsl-asoc-card AC'97 support currently tries to route to Playback and Capture widgets provided by the AC'97 CODEC. This doesn't work since the generic AC'97 driver registers with an "AC97" at the front of the stream and hence widget names, update to reflect reality. It's not clear to me if or how this ever worked.
--- sound/soc/fsl/fsl-asoc-card.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/fsl/fsl-asoc-card.c +2 -2
@@ -112,8 +112,8 @@ static const struct snd_soc_dapm_route audio_map[] = {static const struct snd_soc_dapm_route audio_map_ac97[] = {/* 1st half -- Normal DAPM routes */ - {"Playback" ,NULL ,"CPU AC97 Playback" }, - {"CPU AC97 Capture" ,NULL ,"Capture" }, + {"AC97 Playback" ,NULL ,"CPU AC97 Playback" }, + {"CPU AC97 Capture" ,NULL ,"AC97 Capture" },/* 2nd half -- ASRC DAPM routes */ {"CPU AC97 Playback" ,NULL ,"ASRC-Playback" }, {"ASRC-Capture" ,NULL ,"CPU AC97 Capture" },
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 59/134 spi: spidev: remove debug messages that access spidev->spi without locking
In reply to Greg Kroah-HartmanFrom: Bartosz Golaszewski <[email protected]>
[ Upstream commit 6b35b173dbc1711f8d272e3f322d2ad697015919 ]
The two debug messages in spidev_open() dereference spidev->spi without taking the lock and without checking if it's not null. This can lead to a crash. Drop the messages as they're not needed - the user-space will get informed about ENOMEM with the syscall return value.
--- drivers/spi/spidev.c | 2 -- 1 file changed, 2 deletions(-)
drivers/spi/spidev.c +0 -2
@@ -588,7 +588,6 @@ static int spidev_open(struct inode *inode, struct file *filp)if (!spidev->tx_buffer) { spidev->tx_buffer =kmalloc (bufsiz,GFP_KERNEL );if (!spidev->tx_buffer) { -dev_dbg (&spidev->spi->dev,"open/ENOMEM\n" ); status = -ENOMEM ; goto err_find_dev; }
@@ -597,7 +596,6 @@ static int spidev_open(struct inode *inode, struct file *filp)if (!spidev->rx_buffer) { spidev->rx_buffer =kmalloc (bufsiz,GFP_KERNEL );if (!spidev->rx_buffer) { -dev_dbg (&spidev->spi->dev,"open/ENOMEM\n" ); status = -ENOMEM ; goto err_alloc_rx_buf; }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 60/134 KVM: s390: interrupt: use READ_ONCE() before cmpxchg()
In reply to Greg Kroah-HartmanFrom: Heiko Carstens <[email protected]>
[ Upstream commit 42400d99e9f0728c17240edb9645637ead40f6b9 ]
Use READ_ONCE() before cmpxchg() to prevent that the compiler generates code that fetches the to be compared old value several times from memory.
--- arch/s390/kvm/interrupt.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
arch/s390/kvm/interrupt.c +8 -4
@@ -81,8 +81,9 @@ static int sca_inject_ext_call(struct kvm_vcpu *vcpu, int src_id)struct esca_block *sca = vcpu->kvm->arch.sca;union esca_sigp_ctrl *sigp_ctrl = &(sca->cpu[vcpu->vcpu_id].sigp_ctrl); -union esca_sigp_ctrl new_val = {0 }, old_val = *sigp_ctrl; +union esca_sigp_ctrl new_val = {0 }, old_val; + old_val =READ_ONCE (*sigp_ctrl); new_val.scn = src_id; new_val.c =1 ; old_val.c =0 ;
@@ -93,8 +94,9 @@ static int sca_inject_ext_call(struct kvm_vcpu *vcpu, int src_id)struct bsca_block *sca = vcpu->kvm->arch.sca;union bsca_sigp_ctrl *sigp_ctrl = &(sca->cpu[vcpu->vcpu_id].sigp_ctrl); -union bsca_sigp_ctrl new_val = {0 }, old_val = *sigp_ctrl; +union bsca_sigp_ctrl new_val = {0 }, old_val; + old_val =READ_ONCE (*sigp_ctrl); new_val.scn = src_id; new_val.c =1 ; old_val.c =0 ;
@@ -124,16 +126,18 @@ static void sca_clear_ext_call(struct kvm_vcpu *vcpu)struct esca_block *sca = vcpu->kvm->arch.sca;union esca_sigp_ctrl *sigp_ctrl = &(sca->cpu[vcpu->vcpu_id].sigp_ctrl); -union esca_sigp_ctrl old = *sigp_ctrl; +union esca_sigp_ctrl old; + old =READ_ONCE (*sigp_ctrl); expect = old.value; rc =cmpxchg (&sigp_ctrl->value, old.value,0 ); }else {struct bsca_block *sca = vcpu->kvm->arch.sca;union bsca_sigp_ctrl *sigp_ctrl = &(sca->cpu[vcpu->vcpu_id].sigp_ctrl); -union bsca_sigp_ctrl old = *sigp_ctrl; +union bsca_sigp_ctrl old; + old =READ_ONCE (*sigp_ctrl); expect = old.value; rc =cmpxchg (&sigp_ctrl->value, old.value,0 ); }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 61/134 scsi: hisi_sas: Set a port invalid only if there are no devices attached when refreshing port id
In reply to Greg Kroah-HartmanFrom: Yihang Li <[email protected]>
[ Upstream commit f58c89700630da6554b24fd3df293a24874c10c1 ]
Currently the driver sets the port invalid if one phy in the port is not enabled, which may cause issues in expander situation. In directly attached situation, if phy up doesn't occur in time when refreshing port id, the port is incorrectly set to invalid which will also cause disk lost.
Therefore set a port invalid only if there are no devices attached to the port.
--- drivers/scsi/hisi_sas/hisi_sas_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/hisi_sas/hisi_sas_main.c +1 -1
@@ -1397,7 +1397,7 @@ static void hisi_sas_refresh_port_id(struct hisi_hba *hisi_hba) device->linkrate = phy->sas_phy.linkrate; hisi_hba->hw->setup_itct (hisi_hba, sas_dev); - }else + }else if (!port->port_attached) port->id =0xff ; } }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 62/134 platform/x86: touchscreen_dmi: Add info for the CSL Panther Tab HD
In reply to Greg Kroah-HartmanFrom: Michael Klein <[email protected]>
[ Upstream commit 36c2b9d6710427f802494ba070621cb415198293 ]
Add touchscreen info for the CSL Panther Tab HD.
--- drivers/platform/x86/touchscreen_dmi.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+)
drivers/platform/x86/touchscreen_dmi.c +25 -0
@@ -169,6 +169,23 @@ static const struct ts_dmi_data connect_tablet9_data = { .properties = connect_tablet9_props, }; +static const struct property_entry csl_panther_tab_hd_props[] = { +PROPERTY_ENTRY_U32 ("touchscreen-min-x" ,1 ), +PROPERTY_ENTRY_U32 ("touchscreen-min-y" ,20 ), +PROPERTY_ENTRY_U32 ("touchscreen-size-x" ,1980 ), +PROPERTY_ENTRY_U32 ("touchscreen-size-y" ,1526 ), +PROPERTY_ENTRY_BOOL ("touchscreen-inverted-y" ), +PROPERTY_ENTRY_BOOL ("touchscreen-swapped-x-y" ), +PROPERTY_ENTRY_STRING ("firmware-name" ,"gsl1680-csl-panther-tab-hd.fw" ), +PROPERTY_ENTRY_U32 ("silead,max-fingers" ,10 ), + { } +}; + +static const struct ts_dmi_data csl_panther_tab_hd_data = { + .acpi_name ="MSSL1680:00" , + .properties = csl_panther_tab_hd_props, +}; +static const struct property_entry cube_iwork8_air_props[] = {PROPERTY_ENTRY_U32 ("touchscreen-min-x" ,1 ),PROPERTY_ENTRY_U32 ("touchscreen-min-y" ,3 ),
@@ -721,6 +738,14 @@ static const struct dmi_system_id touchscreen_dmi_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "Tablet 9"), }, }, + { +/* CSL Panther Tab HD */ + .driver_data = (void *)&csl_panther_tab_hd_data, + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"CSL Computer GmbH & Co. KG" ), + DMI_MATCH(DMI_PRODUCT_NAME, "CSL Panther Tab HD"), + }, + }, {/* CUBE iwork8 Air */ .driver_data = (void *)&cube_iwork8_air_data,
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 63/134 platform/x86: asus-nb-wmi: Add alternate mapping for KEY_SCREENLOCK
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit db9494895b405bf318dc7e563dee6daa51b3b6ed ]
The 0x33 keycode is emitted by Fn + F6 on a ASUS FX705GE laptop.
--- drivers/platform/x86/asus-nb-wmi.c | 1 + 1 file changed, 1 insertion(+)
drivers/platform/x86/asus-nb-wmi.c +1 -0
@@ -528,6 +528,7 @@ static const struct key_entry asus_nb_wmi_keymap[] = { { KE_KEY, 0x30, { KEY_VOLUMEUP } }, { KE_KEY, 0x31, { KEY_VOLUMEDOWN } }, { KE_KEY, 0x32, { KEY_MUTE } }, + { KE_KEY, 0x33, { KEY_SCREENLOCK } }, { KE_KEY, 0x35, { KEY_SCREENLOCK } }, { KE_KEY, 0x40, { KEY_PREVIOUSSONG } }, { KE_KEY, 0x41, { KEY_NEXTSONG } },
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 64/134 lockref: stop doing cpu_relax in the cmpxchg loop
In reply to Greg Kroah-HartmanFrom: Mateusz Guzik <[email protected]>
[ Upstream commit f5fe24ef17b5fbe6db49534163e77499fb10ae8c ]
On the x86-64 architecture even a failing cmpxchg grants exclusive access to the cacheline, making it preferable to retry the failed op immediately instead of stalling with the pause instruction.
To illustrate the impact, below are benchmark results obtained by running various will-it-scale tests on top of the 6.2-rc3 kernel and Cascade Lake (2 sockets * 24 cores * 2 threads) CPU.
All results in ops/s. Note there is some variance in re-runs, but the code is consistently faster when contention is present.
open3 ("Same file open/close"):
proc stock no-pause
1 805603 814942 (+%1)
2 1054980 1054781 (-0%)
8 1544802 1822858 (+18%)
24 1191064 2199665 (+84%)
48 851582 1469860 (+72%)
96 609481 1427170 (+134%) fstat2 ("Same file fstat"):
proc stock no-pause
1 3013872 3047636 (+1%)
2 4284687 4400421 (+2%)
8 3257721 5530156 (+69%)
24 2239819 5466127 (+144%)
48 1701072 5256609 (+209%)
96 1269157 6649326 (+423%)Additionally, a kernel with a private patch to help access() scalability:
access2 ("Same file access"):
proc stock patched patched
+nopause
24 2378041 2005501 5370335 (-15% / +125%)That is, fixing the problems in access itself *reduces* scalability after the cacheline ping-pong only happens in lockref with the pause instruction.
Note that fstat and access benchmarks are not currently integrated into will-it-scale, but interested parties can find them in pull requests to said project.
Code at hand has a rather tortured history. First modification showed up in commit d472d9d98b46 ("lockref: Relax in cmpxchg loop"), written with Itanium in mind. Later it got patched up to use an arch-dependent macro to stop doing it on s390 where it caused a significant regression. Said macro had undergone revisions and was ultimately eliminated later, going back to cpu_relax.
While I intended to only remove cpu_relax for x86-64, I got the following comment from Linus:
I would actually prefer just removing it entirely and see if somebody else hollers. You have the numbers to prove it hurts on real hardware, and I don't think we have any numbers to the contrary.
So I think it's better to trust the numbers and remove it as a failure, than say "let's just remove it on x86-64 and leave everybody else with the potentially broken code"
Additionally, Will Deacon (maintainer of the arm64 port, one of the architectures previously benchmarked):
So, from the arm64 side of the fence, I'm perfectly happy just removing the cpu_relax() calls from lockref.
As such, come back full circle in history and whack it altogether.
--- lib/lockref.c | 1 - 1 file changed, 1 deletion(-)
lib/lockref.c +0 -1
@@ -24,7 +24,6 @@ } \if (!--retry) \break ; \ -cpu_relax (); \ } \ }while (0 )
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 65/134 mmc: sdhci-esdhc-imx: clear pending interrupt and halt cqhci
In reply to Greg Kroah-HartmanFrom: Haibo Chen <[email protected]>
[ Upstream commit 982cf37da3ee0f1e3e20d97e19f13cba79be51c7 ]
On i.MX8MM, we are running Dual Linux OS, with 1st Linux using SD Card as rootfs storage, 2nd Linux using eMMC as rootfs storage. We let the the 1st linux configure power/clock for the 2nd Linux.
When the 2nd Linux is booting into rootfs stage, we let the 1st Linux to destroy the 2nd linux, then restart the 2nd linux, we met SDHCI dump as following, after we clear the pending interrupt and halt CQCTL, issue gone.
[ 1.334594] mmc2: Got command interrupt 0x00000001 even though no command operation was in progress. [ 1.334595] mmc2: sdhci: ============ SDHCI REGISTER DUMP =========== [ 1.334599] mmc2: sdhci: Sys addr: 0xa05dcc00 | Version: 0x00000002 [ 1.345538] mmc2: sdhci: Blk size: 0x00000200 | Blk cnt: 0x00000000 [ 1.345541] mmc2: sdhci: Argument: 0x00018000 | Trn mode: 0x00000033 [ 1.345543] mmc2: sdhci: Present: 0x01f88008 | Host ctl: 0x00000031 [ 1.345547] mmc2: sdhci: Power: 0x00000002 | Blk gap: 0x00000080 [ 1.357903] mmc2: sdhci: Wake-up: 0x00000008 | Clock: 0x0000003f [ 1.357905] mmc2: sdhci: Timeout: 0x0000008f | Int stat: 0x00000000 [ 1.357908] mmc2: sdhci: Int enab: 0x107f100b | Sig enab: 0x107f100b [ 1.357911] mmc2: sdhci: AC12 err: 0x00000000 | Slot int: 0x00000502 [ 1.370268] mmc2: sdhci: Caps: 0x07eb0000 | Caps_1: 0x0000b400 [ 1.370270] mmc2: sdhci: Cmd: 0x00000d1a | Max curr: 0x00ffffff [ 1.370273] mmc2: sdhci: Resp[0]: 0x00000b00 | Resp[1]: 0xffffffff [ 1.370276] mmc2: sdhci: Resp[2]: 0x328f5903 | Resp[3]: 0x00d00f00 [ 1.382132] mmc2: sdhci: Host ctl2: 0x00000000 [ 1.382135] mmc2: sdhci: ADMA Err: 0x00000000 | ADMA Ptr: 0xa2040208
[ 2.060932] mmc2: Unexpected interrupt 0x00004000. [ 2.065538] mmc2: sdhci: ============ SDHCI REGISTER DUMP =========== [ 2.071720] mmc2: sdhci: Sys addr: 0x00000000 | Version: 0x00000002 [ 2.077902] mmc2: sdhci: Blk size: 0x00000200 | Blk cnt: 0x00000001 [ 2.084083] mmc2: sdhci: Argument: 0x00000000 | Trn mode: 0x00000000 [ 2.090264] mmc2: sdhci: Present: 0x01f88009 | Host ctl: 0x00000011 [ 2.096446] mmc2: sdhci: Power: 0x00000002 | Blk gap: 0x00000080 [ 2.102627] mmc2: sdhci: Wake-up: 0x00000008 | Clock: 0x000010ff [ 2.108809] mmc2: sdhci: Timeout: 0x0000008f | Int stat: 0x00004000 [ 2.114990] mmc2: sdhci: Int enab: 0x007f1003 | Sig enab: 0x007f1003 [ 2.121171] mmc2: sdhci: AC12 err: 0x00000000 | Slot int: 0x00000502 [ 2.127353] mmc2: sdhci: Caps: 0x07eb0000 | Caps_1: 0x0000b400 [ 2.133534] mmc2: sdhci: Cmd: 0x0000371a | Max curr: 0x00ffffff [ 2.139715] mmc2: sdhci: Resp[0]: 0x00000900 | Resp[1]: 0xffffffff [ 2.145896] mmc2: sdhci: Resp[2]: 0x328f5903 | Resp[3]: 0x00d00f00 [ 2.152077] mmc2: sdhci: Host ctl2: 0x00000000 [ 2.156342] mmc2: sdhci: ADMA Err: 0x00000000 | ADMA Ptr: 0x00000000
Stable-dep-of: 1e336aa0c025 ("mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting")
--- drivers/mmc/host/sdhci-esdhc-imx.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/mmc/host/sdhci-esdhc-imx.c +16 -0
@@ -1180,6 +1180,7 @@ static void sdhci_esdhc_imx_hwinit(struct sdhci_host *host) {struct sdhci_pltfm_host *pltfm_host =sdhci_priv (host);struct pltfm_imx_data *imx_data =sdhci_pltfm_priv (pltfm_host); +struct cqhci_host *cq_host = host->mmc->cqe_private;int tmp;if (esdhc_is_usdhc (imx_data)) {
@@ -1256,6 +1257,21 @@ static void sdhci_esdhc_imx_hwinit(struct sdhci_host *host) tmp &= ~ESDHC_STD_TUNING_EN ;writel (tmp, host->ioaddr +ESDHC_TUNING_CTRL ); } + +/* +* On i.MX8MM, we are running Dual Linux OS, with 1st Linux using SD Card +* as rootfs storage, 2nd Linux using eMMC as rootfs storage. We let the +* the 1st linux configure power/clock for the 2nd Linux. +* +* When the 2nd Linux is booting into rootfs stage, we let the 1st Linux +* to destroy the 2nd linux, then restart the 2nd linux, we met SDHCI dump. +* After we clear the pending interrupt and halt CQCTL, issue gone. +*/ +if (cq_host) { + tmp =cqhci_readl (cq_host,CQHCI_IS ); +cqhci_writel (cq_host, tmp,CQHCI_IS ); +cqhci_writel (cq_host,CQHCI_HALT ,CQHCI_CTL ); + } } }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 66/134 mmc: sdhci-esdhc-imx: disable the CMD CRC check for standard tuning
In reply to Greg Kroah-HartmanFrom: Haibo Chen <[email protected]>
[ Upstream commit 16e40e5b1e3c6646fd90d0c3186703d209216f03 ]
In current code, we add 1ms dealy after each tuning command for standard tuning method. Adding this 1ms dealy is because USDHC default check the CMD CRC and DATA line. If detect the CMD CRC, USDHC standard tuning IC logic do not wait for the tuning data sending out by the card, trigger the buffer read ready interrupt immediately, and step to next cycle. So when next time the new tuning command send out by USDHC, card may still not send out the tuning data of the upper command，then some eMMC cards may stuck, can't response to any command, block the whole tuning procedure.
If do not check the CMD CRC for tuning, then do not has this issue. USDHC will wait for the tuning data of each tuning command and check them. If the tuning data pass the check, it also means the CMD line also okay for tuning.
So this patch disable the CMD CRC check for tuning, save some time for the whole tuning procedure.
Stable-dep-of: 1e336aa0c025 ("mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting")
--- drivers/mmc/host/sdhci-esdhc-imx.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
drivers/mmc/host/sdhci-esdhc-imx.c +13 -2
@@ -89,6 +89,7 @@/* NOTE: the minimum valid tuning start tap for mx6sl is 1 */ #define ESDHC_TUNING_START_TAP_DEFAULT 0x1#define ESDHC_TUNING_START_TAP_MASK 0x7f +#define ESDHC_TUNING_CMD_CRC_CHECK_DISABLE (1 << 7)#define ESDHC_TUNING_STEP_MASK 0x00070000#define ESDHC_TUNING_STEP_SHIFT 16
@@ -1246,6 +1247,18 @@ static void sdhci_esdhc_imx_hwinit(struct sdhci_host *host) tmp |= imx_data->boarddata.tuning_step <<ESDHC_TUNING_STEP_SHIFT ; } + +/* Disable the CMD CRC check for tuning, if not, need to +* add some delay after every tuning command, because +* hardware standard tuning logic will directly go to next +* step once it detect the CMD CRC error, will not wait for +* the card side to finally send out the tuning data, trigger +* the buffer read ready interrupt immediately. If usdhc send +* the next tuning command some eMMC card will stuck, can't +* response, block the tuning procedure or the first command +* after the whole tuning procedure always can't get any response. +*/ + tmp |=ESDHC_TUNING_CMD_CRC_CHECK_DISABLE ;writel (tmp, host->ioaddr +ESDHC_TUNING_CTRL ); }else if (imx_data->socdata->flags &ESDHC_FLAG_MAN_TUNING ) {/*
@@ -1587,8 +1600,6 @@ static int sdhci_esdhc_imx_probe(struct platform_device *pdev)if (err) goto disable_ahb_clk; - host->tuning_delay =1 ; -sdhci_esdhc_imx_hwinit (host); err =sdhci_add_host (host);
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 67/134 mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting
In reply to Greg Kroah-HartmanFrom: Haibo Chen <[email protected]>
[ Upstream commit 1e336aa0c0250ec84c6f16efac40c9f0138e367d ]
Current code logic may be impacted by the setting of ROM/Bootloader, so unmask these bits first, then setting these bits accordingly.
--- drivers/mmc/host/sdhci-esdhc-imx.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-)
drivers/mmc/host/sdhci-esdhc-imx.c +15 -7
@@ -90,6 +90,7 @@#define ESDHC_TUNING_START_TAP_DEFAULT 0x1#define ESDHC_TUNING_START_TAP_MASK 0x7f#define ESDHC_TUNING_CMD_CRC_CHECK_DISABLE (1 << 7) +#define ESDHC_TUNING_STEP_DEFAULT 0x1#define ESDHC_TUNING_STEP_MASK 0x00070000#define ESDHC_TUNING_STEP_SHIFT 16
@@ -1182,7 +1183,7 @@ static void sdhci_esdhc_imx_hwinit(struct sdhci_host *host)struct sdhci_pltfm_host *pltfm_host =sdhci_priv (host);struct pltfm_imx_data *imx_data =sdhci_pltfm_priv (pltfm_host);struct cqhci_host *cq_host = host->mmc->cqe_private; -int tmp; +u32 tmp;if (esdhc_is_usdhc (imx_data)) {/*
@@ -1235,17 +1236,24 @@ static void sdhci_esdhc_imx_hwinit(struct sdhci_host *host)if (imx_data->socdata->flags &ESDHC_FLAG_STD_TUNING ) { tmp =readl (host->ioaddr +ESDHC_TUNING_CTRL ); - tmp |=ESDHC_STD_TUNING_EN | -ESDHC_TUNING_START_TAP_DEFAULT ; -if (imx_data->boarddata.tuning_start_tap) { - tmp &= ~ESDHC_TUNING_START_TAP_MASK ; + tmp |=ESDHC_STD_TUNING_EN ; + +/* +* ROM code or bootloader may config the start tap +* and step, unmask them first. +*/ + tmp &= ~(ESDHC_TUNING_START_TAP_MASK |ESDHC_TUNING_STEP_MASK ); +if (imx_data->boarddata.tuning_start_tap) tmp |= imx_data->boarddata.tuning_start_tap; - } +else + tmp |=ESDHC_TUNING_START_TAP_DEFAULT ;if (imx_data->boarddata.tuning_step) { - tmp &= ~ESDHC_TUNING_STEP_MASK ; tmp |= imx_data->boarddata.tuning_step <<ESDHC_TUNING_STEP_SHIFT ; + }else { + tmp |=ESDHC_TUNING_STEP_DEFAULT + <<ESDHC_TUNING_STEP_SHIFT ; }/* Disable the CMD CRC check for tuning, if not, need to
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 68/134 Revert "selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID"
In reply to Greg Kroah-HartmanThis reverts commit 4de1a5af1be3daa8177473904dfde03b53298785.
--- .../bpf/prog_tests/jeq_infer_not_null.c | 9 ---- .../bpf/progs/jeq_infer_not_null_fail.c | 42 ------------------- 2 files changed, 51 deletions(-) delete mode 100644 tools/testing/selftests/bpf/prog_tests/jeq_infer_not_null.c delete mode 100644 tools/testing/selftests/bpf/progs/jeq_infer_not_null_fail.c
tools/testing/selftests/bpf/prog_tests/jeq_infer_not_null.c deleted +0 -9
@@ -1,9 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0 - -#include <test_progs.h> -#include "jeq_infer_not_null_fail.skel.h" - -void test_jeq_infer_not_null (void ) -{ -RUN_TESTS (jeq_infer_not_null_fail); -}
tools/testing/selftests/bpf/progs/jeq_infer_not_null_fail.c deleted +0 -42
42 lines not on this page · raw message
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 69/134 netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ Upstream commit e15d4cdf27cb0c1e977270270b2cea12e0955edd ]
Consider:
client -----> conntrack ---> Host
client sends a SYN, but $Host is unreachable/silent. Client eventually gives up and the conntrack entry will time out.
However, if the client is restarted with same addr/port pair, it may prevent the conntrack entry from timing out.
This is noticeable when the existing conntrack entry has no NAT transformation or an outdated one and port reuse happens either on client or due to a NAT middlebox.
This change prevents refresh of the timeout for SYN retransmits, so entry is going away after nf_conntrack_tcp_timeout_syn_sent seconds (default: 60).
Entry will be re-created on next connection attempt, but then nat rules will be evaluated again.
--- net/netfilter/nf_conntrack_proto_tcp.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
net/netfilter/nf_conntrack_proto_tcp.c +10 -0
@@ -1158,6 +1158,16 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct,nf_ct_kill_acct (ct, ctinfo, skb);return NF_ACCEPT ; } + +if (index ==TCP_SYN_SET && old_state ==TCP_CONNTRACK_SYN_SENT ) { +/* do not renew timeout on SYN retransmit. +* +* Else port reuse by client or NAT middlebox can keep +* entry alive indefinitely (including nat info). +*/ +return NF_ACCEPT ; + } +/* ESTABLISHED without SEEN_REPLY, i.e. mid-connection * pickup with loose=1. Avoid large ESTABLISHED timeout. */
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 70/134 fs: reiserfs: remove useless new_opts in reiserfs_remount
In reply to Greg Kroah-HartmanFrom: Dongliang Mu <[email protected]>
commit 81dedaf10c20959bdf5624f9783f408df26ba7a4 upstream.
Since the commit c3d98ea08291 ("VFS: Don't use save/replace_mount_options if not using generic_show_options") eliminates replace_mount_options in reiserfs_remount, but does not handle the allocated new_opts, it will cause memory leak in the reiserfs_remount.
Because new_opts is useless in reiserfs_mount, so we fix this bug by removing the useless new_opts in reiserfs_remount.
--- fs/reiserfs/super.c | 6 ------ 1 file changed, 6 deletions(-)
fs/reiserfs/super.c +0 -6
@@ -1437,7 +1437,6 @@ static int reiserfs_remount(struct superunsigned long safe_mask =0 ;unsigned int commit_max_age = (unsigned int )-1 ;struct reiserfs_journal *journal =SB_JOURNAL (s); -char *new_opts;int err;char *qf_names[REISERFS_MAXQUOTAS ];unsigned int qfmt =0 ;
@@ -1445,10 +1444,6 @@ static int reiserfs_remount(struct superint i;#endif - new_opts =kstrdup (arg,GFP_KERNEL ); -if (arg && !new_opts) -return -ENOMEM ; -sync_filesystem (s);reiserfs_write_lock (s);
@@ -1599,7 +1594,6 @@ out_ok_unlocked: out_err_unlock:reiserfs_write_unlock (s); out_err: -kfree (new_opts);return err; }
Greg Kroah-Hartman
maintainerPATCH 71/134 Revert "Revert "xhci: Set HCD flag to defer primary roothub registration""
In reply to Greg Kroah-HartmanThis reverts commit 049849492b77aa0df7f7130f1d522f3553c4084b.
--- drivers/usb/host/xhci.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/host/xhci.c +1 -0
@@ -693,6 +693,7 @@ int xhci_run(struct usb_hcd *hcd)if (ret)xhci_free_command (xhci, command); } +set_bit (HCD_FLAG_DEFER_RH_REGISTER , &hcd->flags);xhci_dbg_trace (xhci, trace_xhci_dbg_init,"Finished xhci_run for USB2 roothub" );
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 72/134 Bluetooth: hci_sync: cancel cmd_timer if hci_open failed
In reply to Greg Kroah-HartmanFrom: Archie Pusaka <[email protected]>
commit 97dfaf073f5881c624856ef293be307b6166115c upstream.
If a command is already sent, we take care of freeing it, but we also need to cancel the timeout as well.
--- net/bluetooth/hci_core.c | 1 + 1 file changed, 1 insertion(+)
net/bluetooth/hci_core.c +1 -0
@@ -1582,6 +1582,7 @@ static int hci_dev_do_open(struct hci_dev *hdev) hdev->flush (hdev);if (hdev->sent_cmd) { +cancel_delayed_work_sync (&hdev->cmd_timer);kfree_skb (hdev->sent_cmd); hdev->sent_cmd =NULL ; }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 73/134 scsi: hpsa: Fix allocation size for scsi_host_alloc()
In reply to Greg Kroah-HartmanFrom: Alexey V. Vissarionov <[email protected]>
[ Upstream commit bbbd25499100c810ceaf5193c3cfcab9f7402a33 ]
The 'h' is a pointer to struct ctlr_info, so it's just 4 or 8 bytes, while the structure itself is much bigger.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/scsi/hpsa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/hpsa.c +1 -1
@@ -5810,7 +5810,7 @@ static int hpsa_scsi_host_alloc(struct ctlr_info *h) {struct Scsi_Host *sh; - sh =scsi_host_alloc (&hpsa_driver_template,sizeof (h)); + sh =scsi_host_alloc (&hpsa_driver_template,sizeof (struct ctlr_info ));if (sh ==NULL ) {dev_err (&h->pdev->dev,"scsi_host_alloc failed\n" );return -ENOMEM ;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 74/134 module: Dont wait for GOING modules
In reply to Greg Kroah-HartmanFrom: Petr Pavlu <[email protected]>
commit 0254127ab977e70798707a7a2b757c9f3c971210 upstream.
During a system boot, it can happen that the kernel receives a burst of requests to insert the same module but loading it eventually fails during its init call. For instance, udev can make a request to insert a frequency module for each individual CPU when another frequency module is already loaded which causes the init function of the new module to return an error.
Since commit 6e6de3dee51a ("kernel/module.c: Only return -EEXIST for modules that have finished loading"), the kernel waits for modules in MODULE_STATE_GOING state to finish unloading before making another attempt to load the same module.
This creates unnecessary work in the described scenario and delays the boot. In the worst case, it can prevent udev from loading drivers for other devices and might cause timeouts of services waiting on them and subsequently a failed boot.
This patch attempts a different solution for the problem 6e6de3dee51a was trying to solve. Rather than waiting for the unloading to complete, it returns a different error code (-EBUSY) for modules in the GOING state. This should avoid the error situation that was described in 6e6de3dee51a (user space attempting to load a dependent module because the -EEXIST error code would suggest to user space that the first module had been loaded successfully), while avoiding the delay situation too.
This has been tested on linux-next since December 2022 and passes all kmod selftests except test 0009 with module compression enabled but it has been confirmed that this issue has existed and has gone unnoticed since prior to this commit and can also be reproduced without module compression with a simple usleep(5000000) on tools/modprobe.c [0]. These failures are caused by hitting the kernel mod_concurrent_max and can happen either due to a self inflicted kernel module auto-loead DoS somehow or on a system with large CPU count and each CPU count incorrectly triggering many module auto-loads. Both of those issues need to be fixed in-kernel.
[0] https://lore.kernel.org/all/Y9A4fiobL6IHp%2F%[email protected]/
--- kernel/module.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-)
kernel/module.c +21 -5
@@ -3654,7 +3654,8 @@ static bool finished_loading(const charsched_annotate_sleep ();mutex_lock (&module_mutex); mod =find_module_all (name,strlen (name), true); - ret = !mod || mod->state ==MODULE_STATE_LIVE ; + ret = !mod || mod->state ==MODULE_STATE_LIVE + || mod->state ==MODULE_STATE_GOING ;mutex_unlock (&module_mutex);return ret;
@@ -3820,20 +3821,35 @@ static int add_unformed_module(struct mo mod->state =MODULE_STATE_UNFORMED ; -again:mutex_lock (&module_mutex); old =find_module_all (mod->name,strlen (mod->name), true);if (old !=NULL ) { -if (old->state !=MODULE_STATE_LIVE ) { +if (old->state ==MODULE_STATE_COMING + || old->state ==MODULE_STATE_UNFORMED ) {/* Wait in case it fails to load. */ mutex_unlock (&module_mutex); err =wait_event_interruptible (module_wq,finished_loading (mod->name));if (err) goto out_unlocked; - goto again; + +/* The module might have gone in the meantime. */ +mutex_lock (&module_mutex); + old =find_module_all (mod->name,strlen (mod->name), + true); } - err = -EEXIST ; + +/* +* We are here only when the same module was being loaded. Do +* not try to load it again right now. It prevents long delays +* caused by serialized module load failures. It might happen +* when more devices of the same type trigger load of +* a particular module. +*/ +if (old && old->state ==MODULE_STATE_LIVE ) + err = -EEXIST ; +else + err = -EBUSY ; goto out; }mod_update_bounds (mod);
Greg Kroah-Hartman
maintainerPATCH 75/134 tracing: Make sure trace_printk() can output as soon as it can be used
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (Google) <[email protected]>
commit 3bb06eb6e9acf7c4a3e1b5bc87aed398ff8e2253 upstream.
Currently trace_printk() can be used as soon as early_trace_init() is called from start_kernel(). But if a crash happens, and "ftrace_dump_on_oops" is set on the kernel command line, all you get will be:
[ 0.456075] <idle>-0 0dN.2. 347519us : Unknown type 6 [ 0.456075] <idle>-0 0dN.2. 353141us : Unknown type 6 [ 0.456075] <idle>-0 0dN.2. 358684us : Unknown type 6
This is because the trace_printk() event (type 6) hasn't been registered yet. That gets done via an early_initcall(), which may be early, but not early enough.
Instead of registering the trace_printk() event (and other ftrace events, which are not trace events) via an early_initcall(), have them registered at the same time that trace_printk() can be used. This way, if there is a crash before early_initcall(), then the trace_printk()s will actually be useful.
--- kernel/trace/trace.c | 2 ++ kernel/trace/trace.h | 1 + kernel/trace/trace_output.c | 3 +-- 3 files changed, 4 insertions(+), 2 deletions(-)
kernel/trace/trace.c +2 -0
@@ -9317,6 +9317,8 @@ void __init early_trace_init(void)static_key_enable (&tracepoint_printk_key.key); }tracer_alloc_buffers (); + +init_events (); }void __init trace_init (void )
kernel/trace/trace.h +1 -0
@@ -1590,6 +1590,7 @@ extern void trace_event_enable_cmd_recorextern void trace_event_enable_tgid_record (bool enable);extern int event_trace_init (void ); +extern int init_events (void );extern int event_trace_add_tracer (struct dentry *parent,struct trace_array *tr);extern int event_trace_del_tracer (struct trace_array *tr);
kernel/trace/trace_output.c +1 -2
@@ -1366,7 +1366,7 @@ static struct trace_event *events[] __in NULL }; -__init static int init_events (void ) +__init int init_events (void ) {struct trace_event *event;int i, ret;
@@ -1384,4 +1384,3 @@ __init static int init_events(void)return 0 ; } -early_initcall (init_events);
Greg Kroah-Hartman
maintainerPATCH 76/134 trace_events_hist: add check for return value of create_hist_field
In reply to Greg Kroah-HartmanFrom: Natalia Petrova <[email protected]>
commit 8b152e9150d07a885f95e1fd401fc81af202d9a4 upstream.
Function 'create_hist_field' is called recursively at trace_events_hist.c:1954 and can return NULL-value that's why we have to check it to avoid null pointer dereference.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- kernel/trace/trace_events_hist.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/trace/trace_events_hist.c +2 -0
@@ -2552,6 +2552,8 @@ static struct hist_field *create_hist_fiunsigned long fl = flags & ~HIST_FIELD_FL_LOG2 ; hist_field->fn = hist_field_log2; hist_field->operands[0 ] =create_hist_field (hist_data, field, fl,NULL ); +if (!hist_field->operands[0 ]) + goto free; hist_field->size = hist_field->operands[0 ]->size; hist_field->type =kstrdup (hist_field->operands[0 ]->type,GFP_KERNEL );if (!hist_field->type)
Greg Kroah-Hartman
maintainerPATCH 77/134 ftrace/scripts: Update the instructions for ftrace-bisect.sh
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (Google) <[email protected]>
commit 7ae4ba7195b1bac04a4210a499da9d8c63b0ba9c upstream.
The instructions for the ftrace-bisect.sh script, which is used to find what function is being traced that is causing a kernel crash, and possibly a triple fault reboot, uses the old method. In 5.1, a new feature was added that let the user write in the index into available_filter_functions that maps to the function a user wants to set in set_ftrace_filter (or set_ftrace_notrace). This takes O(1) to set, as suppose to writing a function name, which takes O(n) (where n is the number of functions in available_filter_functions).
The ftrace-bisect.sh requires setting half of the functions in available_filter_functions, which is O(n^2) using the name method to enable and can take several minutes to complete. The number method is O(n) which takes less than a second to complete. Using the number method for any kernel 5.1 and after is the proper way to do the bisect.
Update the usage to reflect the new change, as well as using the /sys/kernel/tracing path instead of the obsolete debugfs path.
--- scripts/tracing/ftrace-bisect.sh | 34 ++++++++++++++++++++++++++-------- 1 file changed, 26 insertions(+), 8 deletions(-)
scripts/tracing/ftrace-bisect.sh +26 -8
@@ -12,7 +12,7 @@ # (note, if this is a problem with function_graph tracing, then simply # replace "function" with "function_graph" in the following steps). # -# # cd /sys/kernel/debug/tracing +# # cd /sys/kernel/tracing # # echo schedule > set_ftrace_filter # # echo function > current_tracer #
@@ -20,22 +20,40 @@ # # # echo nop > current_tracer # -# # cat available_filter_functions > ~/full-file +# Starting with v5.1 this can be done with numbers, making it much faster: +# +# The old (slow) way, for kernels before v5.1. +# +# [old-way] # cat available_filter_functions > ~/full-file +# +# [old-way] *** Note *** this process will take several minutes to update the +# [old-way] filters. Setting multiple functions is an O(n^2) operation, and we +# [old-way] are dealing with thousands of functions. So go have coffee, talk +# [old-way] with your coworkers, read facebook. And eventually, this operation +# [old-way] will end. +# +# The new way (using numbers) is an O(n) operation, and usually takes less than a second. +# +# seq `wc -l available_filter_functions | cut -d' ' -f1` > ~/full-file +# +# This will create a sequence of numbers that match the functions in +# available_filter_functions, and when echoing in a number into the +# set_ftrace_filter file, it will enable the corresponding function in +# O(1) time. Making enabling all functions O(n) where n is the number of +# functions to enable. +# +# For either the new or old way, the rest of the operations remain the same. +# # # ftrace-bisect ~/full-file ~/test-file ~/non-test-file # # cat ~/test-file > set_ftrace_filter # -# *** Note *** this will take several minutes. Setting multiple functions is -# an O(n^2) operation, and we are dealing with thousands of functions. So go -# have coffee, talk with your coworkers, read facebook. And eventually, this -# operation will end. -# # # echo function > current_tracer # # If it crashes, we know that ~/test-file has a bad function. # # Reboot back to test kernel. # -# # cd /sys/kernel/debug/tracing +# # cd /sys/kernel/tracing # # mv ~/test-file ~/full-file # # If it didn't crash.
Greg Kroah-Hartman
maintainerPATCH 78/134 cifs: Fix oops due to uncleared server->smbd_conn in reconnect
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
commit b7ab9161cf5ddc42a288edf9d1a61f3bdffe17c7 upstream.
In smbd_destroy(), clear the server->smbd_conn pointer after freeing the smbd_connection struct that it points to so that reconnection doesn't get confused.
--- fs/cifs/smbdirect.c | 1 + 1 file changed, 1 insertion(+)
fs/cifs/smbdirect.c +1 -0
@@ -1478,6 +1478,7 @@ void smbd_destroy(struct TCP_Server_Infodestroy_workqueue (info->workqueue);log_rdma_event (INFO ,"rdma session destroyed\n" );kfree (info); + server->smbd_conn =NULL ; }/*
Greg Kroah-Hartman
maintainerPATCH 79/134 KVM: x86/vmx: Do not skip segment attributes if unusable bit is set
In reply to Greg Kroah-HartmanFrom: Hendrik Borghorst <[email protected]>
commit a44b331614e6f7e63902ed7dff7adc8c85edd8bc upstream.
When serializing and deserializing kvm_sregs, attributes of the segment descriptors are stored by user space. For unusable segments, vmx_segment_access_rights skips all attributes and sets them to 0.
This means we zero out the DPL (Descriptor Privilege Level) for unusable entries.
Unusable segments are - contrary to their name - usable in 64bit mode and are used by guests to for example create a linear map through the NULL selector.
VMENTER checks if SS.DPL is correct depending on the CS segment type. For types 9 (Execute Only) and 11 (Execute Read), CS.DPL must be equal to SS.DPL [1].
We have seen real world guests setting CS to a usable segment with DPL=3 and SS to an unusable segment with DPL=3. Once we go through an sregs get/set cycle, SS.DPL turns to 0. This causes the virtual machine to crash reproducibly.
This commit changes the attribute logic to always preserve attributes for unusable segments. According to [2] SS.DPL is always saved on VM exits, regardless of the unusable bit so user space applications should have saved the information on serialization correctly.
[3] specifies that besides SS.DPL the rest of the attributes of the descriptors are undefined after VM entry if unusable bit is set. So, there should be no harm in setting them all to the previous state.
[1] Intel SDM Vol 3C 26.3.1.2 Checks on Guest Segment Registers
[2] Intel SDM Vol 3C 27.3.2 Saving Segment Registers and Descriptor-Table Registers
[3] Intel SDM Vol 3C 26.3.2.2 Loading Guest Segment Registers and Descriptor-Table Registers
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/vmx.c | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-)
arch/x86/kvm/vmx/vmx.c +9 -12
@@ -3241,18 +3241,15 @@ static u32 vmx_segment_access_rights(str {u32 ar; -if (var->unusable || !var->present) - ar =1 <<16 ; -else { - ar = var->type &15 ; - ar |= (var->s &1 ) <<4 ; - ar |= (var->dpl &3 ) <<5 ; - ar |= (var->present &1 ) <<7 ; - ar |= (var->avl &1 ) <<12 ; - ar |= (var->l &1 ) <<13 ; - ar |= (var->db &1 ) <<14 ; - ar |= (var->g &1 ) <<15 ; - } + ar = var->type &15 ; + ar |= (var->s &1 ) <<4 ; + ar |= (var->dpl &3 ) <<5 ; + ar |= (var->present &1 ) <<7 ; + ar |= (var->avl &1 ) <<12 ; + ar |= (var->l &1 ) <<13 ; + ar |= (var->db &1 ) <<14 ; + ar |= (var->g &1 ) <<15 ; + ar |= (var->unusable || !var->present) <<16 ;return ar; }
Greg Kroah-Hartman
maintainerPATCH 80/134 thermal: intel: int340x: Protect trip temperature from concurrent updates
In reply to Greg Kroah-HartmanFrom: Srinivas Pandruvada <[email protected]>
commit 6757a7abe47bcb12cb2d45661067e182424b0ee3 upstream.
Trip temperatures are read using ACPI methods and stored in the memory during zone initializtion and when the firmware sends a notification for change. This trip temperature is returned when the thermal core calls via callback get_trip_temp().
But it is possible that while updating the memory copy of the trips when the firmware sends a notification for change, thermal core is reading the trip temperature via the callback get_trip_temp(). This may return invalid trip temperature.
To address this add a mutex to protect the invalid temperature reads in the callback get_trip_temp() and int340x_thermal_read_trips().
--- drivers/thermal/intel/int340x_thermal/int340x_thermal_zone.c | 18 +++++++++-- drivers/thermal/intel/int340x_thermal/int340x_thermal_zone.h | 1 2 files changed, 16 insertions(+), 3 deletions(-)
drivers/thermal/intel/int340x_thermal/int340x_thermal_zone.c +15 -3
@@ -43,11 +43,13 @@ static int int340x_thermal_get_trip_temp int trip, int *temp) { struct int34x_thermal_zone *d = zone->devdata; -int i; +int i, ret =0 ;if (d->override_ops && d->override_ops->get_trip_temp)return d->override_ops->get_trip_temp (zone, trip, temp); +mutex_lock (&d->trip_mutex); +if (trip < d->aux_trip_nr) *temp = d->aux_trips[trip];else if (trip == d->crt_trip_id)
@@ -65,10 +67,12 @@ static int int340x_thermal_get_trip_temp } }if (i ==INT340X_THERMAL_MAX_ACT_TRIP_COUNT ) -return -EINVAL ; + ret = -EINVAL ; } -return 0 ; +mutex_unlock (&d->trip_mutex); + +return ret; } static int int340x_thermal_get_trip_type(struct thermal_zone_device *zone,
@@ -173,6 +177,8 @@ int int340x_thermal_read_trips(struct inint trip_cnt = int34x_zone->aux_trip_nr;int i; +mutex_lock (&int34x_zone->trip_mutex); + int34x_zone->crt_trip_id =-1 ;if (!int340x_thermal_get_trip_config (int34x_zone->adev->handle,"_CRT" , &int34x_zone->crt_temp))
@@ -200,6 +206,8 @@ int int340x_thermal_read_trips(struct in int34x_zone->act_trips[i].valid = true; } +mutex_unlock (&int34x_zone->trip_mutex); +return trip_cnt; }EXPORT_SYMBOL_GPL (int340x_thermal_read_trips);
@@ -223,6 +231,8 @@ struct int34x_thermal_zone *int340x_therif (!int34x_thermal_zone)return ERR_PTR (-ENOMEM ); +mutex_init (&int34x_thermal_zone->trip_mutex); + int34x_thermal_zone->adev = adev; int34x_thermal_zone->override_ops = override_ops;
@@ -269,6 +279,7 @@ err_thermal_zone:acpi_lpat_free_conversion_table (int34x_thermal_zone->lpat_table);kfree (int34x_thermal_zone->aux_trips); err_trip_alloc: +mutex_destroy (&int34x_thermal_zone->trip_mutex);kfree (int34x_thermal_zone);return ERR_PTR (ret); }
@@ -280,6 +291,7 @@ void int340x_thermal_zone_remove(structthermal_zone_device_unregister (int34x_thermal_zone->zone);acpi_lpat_free_conversion_table (int34x_thermal_zone->lpat_table);kfree (int34x_thermal_zone->aux_trips); +mutex_destroy (&int34x_thermal_zone->trip_mutex);kfree (int34x_thermal_zone); }EXPORT_SYMBOL_GPL (int340x_thermal_zone_remove);
drivers/thermal/intel/int340x_thermal/int340x_thermal_zone.h +1 -0
@@ -32,6 +32,7 @@ struct int34x_thermal_zone {struct thermal_zone_device_ops *override_ops;void *priv_data;struct acpi_lpat_conversion_table *lpat_table; +struct mutex trip_mutex; }; struct int34x_thermal_zone *int340x_thermal_zone_add(struct acpi_device *,
Greg Kroah-Hartman
maintainerPATCH 81/134 ARM: 9280/1: mm: fix warning on phys_addr_t to void pointer assignment
In reply to Greg Kroah-HartmanFrom: Giulio Benetti <[email protected]>
commit a4e03921c1bb118e6718e0a3b0322a2c13ed172b upstream.
zero_page is a void* pointer but memblock_alloc() returns phys_addr_t type so this generates a warning while using clang and with -Wint-error enabled that becomes and error. So let's cast the return of memblock_alloc() to (void *).
--- arch/arm/mm/nommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/mm/nommu.c +1 -1
@@ -161,7 +161,7 @@ void __init paging_init(const struct macmpu_setup ();/* allocate the zero page. */ - zero_page =memblock_alloc (PAGE_SIZE ,PAGE_SIZE ); + zero_page = (void *)memblock_alloc (PAGE_SIZE ,PAGE_SIZE );if (!zero_page)panic ("%s: Failed to allocate %lu bytes align=0x%lx\n" , __func__,PAGE_SIZE ,PAGE_SIZE );
Greg Kroah-Hartman
maintainerPATCH 82/134 EDAC/device: Respect any driver-supplied workqueue polling value
In reply to Greg Kroah-HartmanFrom: Manivannan Sadhasivam <[email protected]>
commit cec669ff716cc83505c77b242aecf6f7baad869d upstream.
The EDAC drivers may optionally pass the poll_msec value. Use that value if available, else fall back to 1000ms.
[ bp: Touchups. ]
--- drivers/edac/edac_device.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
drivers/edac/edac_device.c +7 -8
@@ -34,6 +34,9 @@static DEFINE_MUTEX (device_ctls_mutex);static LIST_HEAD (edac_device_list); +/* Default workqueue processing interval on this instance, in msecs */ +#define DEFAULT_POLL_INTERVAL 1000 +#ifdef CONFIG_EDAC_DEBUG static void edac_device_dump_device (struct edac_device_ctl_info *edac_dev) {
@@ -366,7 +369,7 @@ static void edac_device_workq_function(s* whole one second to save timers firing all over the period * between integral seconds */ -if (edac_dev->poll_msec ==1000 ) +if (edac_dev->poll_msec ==DEFAULT_POLL_INTERVAL )edac_queue_work (&edac_dev->work,round_jiffies_relative (edac_dev->delay));else edac_queue_work (&edac_dev->work, edac_dev->delay);
@@ -396,7 +399,7 @@ static void edac_device_workq_setup(stru* timers firing on sub-second basis, while they are happy * to fire together on the 1 second exactly */ -if (edac_dev->poll_msec ==1000 ) +if (edac_dev->poll_msec ==DEFAULT_POLL_INTERVAL )edac_queue_work (&edac_dev->work,round_jiffies_relative (edac_dev->delay));else edac_queue_work (&edac_dev->work, edac_dev->delay);
@@ -430,7 +433,7 @@ void edac_device_reset_delay_period(stru edac_dev->delay =msecs_to_jiffies (msec);/* See comment in edac_device_workq_setup() above */ -if (edac_dev->poll_msec ==1000 ) +if (edac_dev->poll_msec ==DEFAULT_POLL_INTERVAL )edac_mod_work (&edac_dev->work,round_jiffies_relative (edac_dev->delay));else edac_mod_work (&edac_dev->work, edac_dev->delay);
@@ -472,11 +475,7 @@ int edac_device_add_device(struct edac_d/* This instance is NOW RUNNING */ edac_dev->op_state =OP_RUNNING_POLL ; -/* -* enable workq processing on this instance, -* default = 1000 msec -*/ -edac_device_workq_setup (edac_dev,1000 ); +edac_device_workq_setup (edac_dev, edac_dev->poll_msec ?:DEFAULT_POLL_INTERVAL ); }else { edac_dev->op_state =OP_RUNNING_INTERRUPT ; }
Greg Kroah-Hartman
maintainerPATCH 83/134 EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_infos pvt_info
In reply to Greg Kroah-HartmanFrom: Manivannan Sadhasivam <[email protected]>
commit 977c6ba624f24ae20cf0faee871257a39348d4a9 upstream.
The memory for llcc_driv_data is allocated by the LLCC driver. But when it is passed as the private driver info to the EDAC core, it will get freed during the qcom_edac driver release. So when the qcom_edac driver gets probed again, it will try to use the freed data leading to the use-after-free bug.
Hence, do not pass llcc_driv_data as pvt_info but rather reference it using the platform_data pointer in the qcom_edac driver.
--- drivers/edac/qcom_edac.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/edac/qcom_edac.c +2 -3
@@ -252,7 +252,7 @@ clear:static int dump_syn_reg (struct edac_device_ctl_info *edev_ctl,int err_type,u32 bank) { -struct llcc_drv_data *drv = edev_ctl->pvt_info; +struct llcc_drv_data *drv = edev_ctl->dev->platform_data;int ret; ret =dump_syn_reg_values (drv, bank, err_type);
@@ -289,7 +289,7 @@ static irqreturn_t llcc_ecc_irq_handler(int irq, void *edev_ctl) { struct edac_device_ctl_info *edac_dev_ctl = edev_ctl; -struct llcc_drv_data *drv = edac_dev_ctl->pvt_info; +struct llcc_drv_data *drv = edac_dev_ctl->dev->platform_data;irqreturn_t irq_rc =IRQ_NONE ;u32 drp_error, trp_error, i;int ret;
@@ -358,7 +358,6 @@ static int qcom_llcc_edac_probe(struct p edev_ctl->dev_name =dev_name (dev); edev_ctl->ctl_name ="llcc" ; edev_ctl->panic_on_ue =LLCC_ERP_PANIC_ON_UE ; - edev_ctl->pvt_info = llcc_driv_data; rc =edac_device_add_device (edev_ctl);if (rc)
Greg Kroah-Hartman
maintainerPATCH 84/134 netlink: prevent potential spectre v1 gadgets
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit f0950402e8c76e7dcb08563f1b4e8000fbc62455 ]
Most netlink attributes are parsed and validated from __nla_validate_parse() or validate_nla()
u16 type = nla_type(nla);
if (type == 0 || type > maxtype) {
/* error or continue */
}@type is then used as an array index and can be used as a Spectre v1 gadget.
array_index_nospec() can be used to prevent leaking content of kernel memory to malicious users.
This should take care of vast majority of netlink uses, but an audit is needed to take care of others where validation is not yet centralized in core netlink functions.
--- lib/nlattr.c | 3 +++ 1 file changed, 3 insertions(+)
lib/nlattr.c +3 -0
@@ -10,6 +10,7 @@#include <linux/kernel.h> #include <linux/errno.h> #include <linux/jiffies.h> +#include <linux/nospec.h> #include <linux/skbuff.h> #include <linux/string.h> #include <linux/types.h>
@@ -169,6 +170,7 @@ static int validate_nla(const struct nlattr *nla, int maxtype,if (type <=0 || type > maxtype)return 0 ; + type =array_index_nospec (type, maxtype +1 ); pt = &policy[type];BUG_ON (pt->type >NLA_TYPE_MAX );
@@ -377,6 +379,7 @@ static int __nla_validate_parse(const struct nlattr *head, int len, int maxtype, }continue ; } + type =array_index_nospec (type, maxtype +1 );if (policy) {int err =validate_nla (nla, maxtype, policy, validate, extack);
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 85/134 net: fix UaF in netns ops registration error path
In reply to Greg Kroah-HartmanFrom: Paolo Abeni <[email protected]>
[ Upstream commit 71ab9c3e2253619136c31c89dbb2c69305cc89b1 ]
If net_assign_generic() fails, the current error path in ops_init() tries to clear the gen pointer slot. Anyway, in such error path, the gen pointer itself has not been modified yet, and the existing and accessed one is smaller than the accessed index, causing an out-of-bounds error:
BUG: KASAN: slab-out-of-bounds in ops_init+0x2de/0x320
Write of size 8 at addr ffff888109124978 by task modprobe/1018
CPU: 2 PID: 1018 Comm: modprobe Not tainted 6.2.0-rc2.mptcp_ae5ac65fbed5+ #1641
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.1-2.fc37 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x6a/0x9f
print_address_description.constprop.0+0x86/0x2b5
print_report+0x11b/0x1fb
kasan_report+0x87/0xc0
ops_init+0x2de/0x320
register_pernet_operations+0x2e4/0x750
register_pernet_subsys+0x24/0x40
tcf_register_action+0x9f/0x560
do_one_initcall+0xf9/0x570
do_init_module+0x190/0x650
load_module+0x1fa5/0x23c0
__do_sys_finit_module+0x10d/0x1b0
do_syscall_64+0x58/0x80
entry_SYSCALL_64_after_hwframe+0x72/0xdc
RIP: 0033:0x7f42518f778d
Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48
89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff
ff 73 01 c3 48 8b 0d cb 56 2c 00 f7 d8 64 89 01 48
RSP: 002b:00007fff96869688 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
RAX: ffffffffffffffda RBX: 00005568ef7f7c90 RCX: 00007f42518f778d
RDX: 0000000000000000 RSI: 00005568ef41d796 RDI: 0000000000000003
RBP: 00005568ef41d796 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000
R13: 00005568ef7f7d30 R14: 0000000000040000 R15: 0000000000000000
</TASK>This change addresses the issue by skipping the gen pointer de-reference in the mentioned error-path.
Found by code inspection and verified with explicit error injection on a kasan-enabled kernel.
--- net/core/net_namespace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/core/net_namespace.c +1 -1
@@ -140,12 +140,12 @@ static int ops_init(const struct pernet_operations *ops, struct net *net)return 0 ;if (ops->id && ops->size) { -cleanup: ng =rcu_dereference_protected (net->gen,lockdep_is_held (&pernet_ops_rwsem)); ng->ptr[*ops->id] =NULL ; } +cleanup:kfree (data); out:
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 86/134 netfilter: nft_set_rbtree: skip elements in transaction from garbage collection
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 5d235d6ce75c12a7fdee375eb211e4116f7ab01b ]
Skip interference with an ongoing transaction, do not perform garbage collection on inactive elements. Reset annotated previous end interval if the expired element is marked as busy (control plane removed the element right before expiration).
--- net/netfilter/nft_set_rbtree.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
net/netfilter/nft_set_rbtree.c +15 -1
@@ -389,23 +389,37 @@ static void nft_rbtree_gc(struct work_struct *work)struct nft_rbtree *priv;struct rb_node *node;struct nft_set *set; +struct net *net; +u8 genmask; priv = container_of(work, struct nft_rbtree, gc_work.work); set =nft_set_container_of (priv); + net =read_pnet (&set->net); + genmask =nft_genmask_cur (net);write_lock_bh (&priv->lock);write_seqcount_begin (&priv->count);for (node =rb_first (&priv->root); node !=NULL ; node =rb_next (node)) { rbe = rb_entry(node, struct nft_rbtree_elem, node); +if (!nft_set_elem_active (&rbe->ext, genmask)) +continue ; + +/* elements are reversed in the rbtree for historical reasons, +* from highest to lowest value, that is why end element is +* always visited before the start element. +*/ if (nft_rbtree_interval_end (rbe)) { rbe_end = rbe;continue ; }if (!nft_set_elem_expired (&rbe->ext))continue ; -if (nft_set_elem_mark_busy (&rbe->ext)) + +if (nft_set_elem_mark_busy (&rbe->ext)) { + rbe_end =NULL ;continue ; + }if (rbe_prev) {rb_erase (&rbe_prev->node, &priv->root);
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 87/134 netlink: annotate data races around nlk->portid
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit c1bb9484e3b05166880da8574504156ccbd0549e ]
syzbot reminds us netlink_getname() runs locklessly [1]
This first patch annotates the race against nlk->portid.
Following patches take care of the remaining races.
[1]
BUG: KCSAN: data-race in netlink_getname / netlink_insert
write to 0xffff88814176d310 of 4 bytes by task 2315 on cpu 1:
netlink_insert+0xf1/0x9a0 net/netlink/af_netlink.c:583 netlink_autobind+0xae/0x180 net/netlink/af_netlink.c:856 netlink_sendmsg+0x444/0x760 net/netlink/af_netlink.c:1895 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0x38f/0x500 net/socket.c:2476 ___sys_sendmsg net/socket.c:2530 [inline] __sys_sendmsg+0x19a/0x230 net/socket.c:2559 __do_sys_sendmsg net/socket.c:2568 [inline] __se_sys_sendmsg net/socket.c:2566 [inline] __x64_sys_sendmsg+0x42/0x50 net/socket.c:2566 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
read to 0xffff88814176d310 of 4 bytes by task 2316 on cpu 0:
netlink_getname+0xcd/0x1a0 net/netlink/af_netlink.c:1144 __sys_getsockname+0x11d/0x1b0 net/socket.c:2026 __do_sys_getsockname net/socket.c:2041 [inline] __se_sys_getsockname net/socket.c:2038 [inline] __x64_sys_getsockname+0x3e/0x50 net/socket.c:2038 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
value changed: 0x00000000 -> 0xc9a49780
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 2316 Comm: syz-executor.2 Not tainted 6.2.0-rc3-syzkaller-00030-ge8f60cd7db24-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
--- net/netlink/af_netlink.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
net/netlink/af_netlink.c +5 -2
@@ -569,7 +569,9 @@ static int netlink_insert(struct sock *sk, u32 portid)if (nlk_sk (sk)->bound) goto err; -nlk_sk (sk)->portid = portid; +/* portid can be read locklessly from netlink_getname(). */ +WRITE_ONCE (nlk_sk (sk)->portid, portid); +sock_hold (sk); err =__netlink_insert (table, sk);
@@ -1123,7 +1125,8 @@ static int netlink_getname(struct socket *sock, struct sockaddr *addr, nladdr->nl_pid = nlk->dst_portid; nladdr->nl_groups =netlink_group_mask (nlk->dst_group); }else { - nladdr->nl_pid = nlk->portid; +/* Paired with WRITE_ONCE() in netlink_insert() */ + nladdr->nl_pid =READ_ONCE (nlk->portid);netlink_lock_table (); nladdr->nl_groups = nlk->groups ? nlk->groups[0 ] :0 ;netlink_unlock_table ();
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 88/134 netlink: annotate data races around dst_portid and dst_group
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 004db64d185a5f23dfb891d7701e23713b2420ee ]
netlink_getname(), netlink_sendmsg() and netlink_getsockbyportid() can read nlk->dst_portid and nlk->dst_group while another thread is changing them.
--- net/netlink/af_netlink.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)
net/netlink/af_netlink.c +14 -9
@@ -1081,8 +1081,9 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr,if (addr->sa_family ==AF_UNSPEC ) { sk->sk_state =NETLINK_UNCONNECTED ; - nlk->dst_portid =0 ; - nlk->dst_group =0 ; +/* dst_portid and dst_group can be read locklessly */ +WRITE_ONCE (nlk->dst_portid,0 ); +WRITE_ONCE (nlk->dst_group,0 );return 0 ; }if (addr->sa_family !=AF_NETLINK )
@@ -1104,8 +1105,9 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr,if (err ==0 ) { sk->sk_state =NETLINK_CONNECTED ; - nlk->dst_portid = nladdr->nl_pid; - nlk->dst_group =ffs (nladdr->nl_groups); +/* dst_portid and dst_group can be read locklessly */ +WRITE_ONCE (nlk->dst_portid, nladdr->nl_pid); +WRITE_ONCE (nlk->dst_group,ffs (nladdr->nl_groups)); }return err;
@@ -1122,8 +1124,9 @@ static int netlink_getname(struct socket *sock, struct sockaddr *addr, nladdr->nl_pad =0 ;if (peer) { - nladdr->nl_pid = nlk->dst_portid; - nladdr->nl_groups =netlink_group_mask (nlk->dst_group); +/* Paired with WRITE_ONCE() in netlink_connect() */ + nladdr->nl_pid =READ_ONCE (nlk->dst_portid); + nladdr->nl_groups =netlink_group_mask (READ_ONCE (nlk->dst_group)); }else {/* Paired with WRITE_ONCE() in netlink_insert() */ nladdr->nl_pid =READ_ONCE (nlk->portid);
@@ -1153,8 +1156,9 @@ static struct sock *netlink_getsockbyportid(struct sock *ssk, u32 portid)/* Don't bother queuing skb if kernel socket has no input function */ nlk =nlk_sk (sock); +/* dst_portid can be changed in netlink_connect() */ if (sock->sk_state ==NETLINK_CONNECTED && - nlk->dst_portid !=nlk_sk (ssk)->portid) { +READ_ONCE (nlk->dst_portid) !=nlk_sk (ssk)->portid) {sock_put (sock);return ERR_PTR (-ECONNREFUSED ); }
@@ -1890,8 +1894,9 @@ static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) goto out; netlink_skb_flags |=NETLINK_SKB_DST ; }else { - dst_portid = nlk->dst_portid; - dst_group = nlk->dst_group; +/* Paired with WRITE_ONCE() in netlink_connect() */ + dst_portid =READ_ONCE (nlk->dst_portid); + dst_group =READ_ONCE (nlk->dst_group); }/* Paired with WRITE_ONCE() in netlink_insert() */
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 89/134 netlink: annotate data races around sk_state
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 9b663b5cbb15b494ef132a3c937641c90646eb73 ]
netlink_getsockbyportid() reads sk_state while a concurrent netlink_connect() can change its value.
--- net/netlink/af_netlink.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
net/netlink/af_netlink.c +6 -4
@@ -1080,7 +1080,8 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr,return -EINVAL ;if (addr->sa_family ==AF_UNSPEC ) { - sk->sk_state =NETLINK_UNCONNECTED ; +/* paired with READ_ONCE() in netlink_getsockbyportid() */ +WRITE_ONCE (sk->sk_state,NETLINK_UNCONNECTED );/* dst_portid and dst_group can be read locklessly */ WRITE_ONCE (nlk->dst_portid,0 );WRITE_ONCE (nlk->dst_group,0 );
@@ -1104,7 +1105,8 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr, err =netlink_autobind (sock);if (err ==0 ) { - sk->sk_state =NETLINK_CONNECTED ; +/* paired with READ_ONCE() in netlink_getsockbyportid() */ +WRITE_ONCE (sk->sk_state,NETLINK_CONNECTED );/* dst_portid and dst_group can be read locklessly */ WRITE_ONCE (nlk->dst_portid, nladdr->nl_pid);WRITE_ONCE (nlk->dst_group,ffs (nladdr->nl_groups));
@@ -1156,8 +1158,8 @@ static struct sock *netlink_getsockbyportid(struct sock *ssk, u32 portid)/* Don't bother queuing skb if kernel socket has no input function */ nlk =nlk_sk (sock); -/* dst_portid can be changed in netlink_connect() */ -if (sock->sk_state ==NETLINK_CONNECTED && +/* dst_portid and sk_state can be changed in netlink_connect() */ +if (READ_ONCE (sock->sk_state) ==NETLINK_CONNECTED &&READ_ONCE (nlk->dst_portid) !=nlk_sk (ssk)->portid) {sock_put (sock);return ERR_PTR (-ECONNREFUSED );
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 90/134 ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 1d1d63b612801b3f0a39b7d4467cad0abd60e5c8 ]
if (!type)
continue; if (type > RTAX_MAX) return -EINVAL; ... metrics[type - 1] = val;
@type being used as an array index, we need to prevent cpu speculation or risk leaking kernel memory content.
--- net/ipv4/metrics.c | 2 ++ 1 file changed, 2 insertions(+)
net/ipv4/metrics.c +2 -0
@@ -1,5 +1,6 @@// SPDX-License-Identifier: GPL-2.0-only #include <linux/netlink.h> +#include <linux/nospec.h> #include <linux/rtnetlink.h> #include <linux/types.h> #include <net/ip.h>
@@ -28,6 +29,7 @@ static int ip_metrics_convert(struct net *net, struct nlattr *fc_mx,return -EINVAL ; } + type =array_index_nospec (type,RTAX_MAX +1 );if (type ==RTAX_CC_ALGO ) {char tmp[TCP_CA_NAME_MAX ];
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 91/134 ipv4: prevent potential spectre v1 gadget in fib_metrics_match()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 5e9398a26a92fc402d82ce1f97cc67d832527da0 ]
if (!type)
continue;
if (type > RTAX_MAX)
return false;
...
fi_val = fi->fib_metrics->metrics[type - 1];@type being used as an array index, we need to prevent cpu speculation or risk leaking kernel memory content.
--- net/ipv4/fib_semantics.c | 2 ++ 1 file changed, 2 insertions(+)
net/ipv4/fib_semantics.c +2 -0
@@ -30,6 +30,7 @@#include <linux/slab.h> #include <linux/netlink.h> #include <linux/hash.h> +#include <linux/nospec.h> #include <net/arp.h> #include <net/ip.h>
@@ -1009,6 +1010,7 @@ bool fib_metrics_match(struct fib_config *cfg, struct fib_info *fi)if (type >RTAX_MAX )return false; + type =array_index_nospec (type,RTAX_MAX +1 );if (type ==RTAX_CC_ALGO ) {char tmp[TCP_CA_NAME_MAX ];bool ecn_ca = false;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 92/134 netfilter: conntrack: fix vtag checks for ABORT/SHUTDOWN_COMPLETE
In reply to Greg Kroah-HartmanFrom: Sriram Yagnaraman <[email protected]>
[ Upstream commit a9993591fa94246b16b444eea55d84c54608282a ]
RFC 9260, Sec 8.5.1 states that for ABORT/SHUTDOWN_COMPLETE, the chunk MUST be accepted if the vtag of the packet matches its own tag and the T bit is not set OR if it is set to its peer's vtag and the T bit is set in chunk flags. Otherwise the packet MUST be silently dropped.
Update vtag verification for ABORT/SHUTDOWN_COMPLETE based on the above description.
--- net/netfilter/nf_conntrack_proto_sctp.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-)
net/netfilter/nf_conntrack_proto_sctp.c +16 -9
@@ -412,22 +412,29 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct, for_each_sctp_chunk (skb, sch, _sch, offset, dataoff, count) {/* Special cases of Verification tag check (Sec 8.5.1) */ if (sch->type ==SCTP_CID_INIT ) { -/* Sec 8.5.1 (A) */ +/* (A) vtag MUST be zero */ if (sh->vtag !=0 ) goto out_unlock; }else if (sch->type ==SCTP_CID_ABORT ) { -/* Sec 8.5.1 (B) */ -if (sh->vtag != ct->proto.sctp.vtag[dir] && - sh->vtag != ct->proto.sctp.vtag[!dir]) +/* (B) vtag MUST match own vtag if T flag is unset OR +* MUST match peer's vtag if T flag is set +*/ +if ((!(sch->flags &SCTP_CHUNK_FLAG_T ) && + sh->vtag != ct->proto.sctp.vtag[dir]) || + ((sch->flags &SCTP_CHUNK_FLAG_T ) && + sh->vtag != ct->proto.sctp.vtag[!dir])) goto out_unlock; }else if (sch->type ==SCTP_CID_SHUTDOWN_COMPLETE ) { -/* Sec 8.5.1 (C) */ -if (sh->vtag != ct->proto.sctp.vtag[dir] && - sh->vtag != ct->proto.sctp.vtag[!dir] && - sch->flags &SCTP_CHUNK_FLAG_T ) +/* (C) vtag MUST match own vtag if T flag is unset OR +* MUST match peer's vtag if T flag is set +*/ +if ((!(sch->flags &SCTP_CHUNK_FLAG_T ) && + sh->vtag != ct->proto.sctp.vtag[dir]) || + ((sch->flags &SCTP_CHUNK_FLAG_T ) && + sh->vtag != ct->proto.sctp.vtag[!dir])) goto out_unlock; }else if (sch->type ==SCTP_CID_COOKIE_ECHO ) { -/* Sec 8.5.1 (D) */ +/* (D) vtag must be same as init_vtag as found in INIT_ACK */ if (sh->vtag != ct->proto.sctp.vtag[dir]) goto out_unlock; }else if (sch->type ==SCTP_CID_HEARTBEAT ) {
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 93/134 netrom: Fix use-after-free of a listening socket.
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 409db27e3a2eb5e8ef7226ca33be33361b3ed1c9 ]
syzbot reported a use-after-free in do_accept(), precisely nr_accept() as sk_prot_alloc() allocated the memory and sock_put() frees it. [0]
The issue could happen if the heartbeat timer is fired and nr_heartbeat_expiry() calls nr_destroy_socket(), where a socket has SOCK_DESTROY or a listening socket has SOCK_DEAD.
In this case, the first condition cannot be true. SOCK_DESTROY is flagged in nr_release() only when the file descriptor is close()d, but accept() is being called for the listening socket, so the second condition must be true.
Usually, the AF_NETROM listener neither starts timers nor sets SOCK_DEAD. However, the condition is met if connect() fails before listen(). connect() starts the t1 timer and heartbeat timer, and t1timer calls nr_disconnect() when timeout happens. Then, SOCK_DEAD is set, and if we call listen(), the heartbeat timer calls nr_destroy_socket().
nr_connect
nr_establish_data_link(sk)
nr_start_t1timer(sk)
nr_start_heartbeat(sk)
nr_t1timer_expiry
nr_disconnect(sk, ETIMEDOUT)
nr_sk(sk)->state = NR_STATE_0
sk->sk_state = TCP_CLOSE
sock_set_flag(sk, SOCK_DEAD)
nr_listen
if (sk->sk_state != TCP_LISTEN)
sk->sk_state = TCP_LISTEN
nr_heartbeat_expiry
switch (nr->state)
case NR_STATE_0
if (sk->sk_state == TCP_LISTEN &&
sock_flag(sk, SOCK_DEAD))
nr_destroy_socket(sk)This path seems expected, and nr_destroy_socket() is called to clean up resources. Initially, there was sock_hold() before nr_destroy_socket() so that the socket would not be freed, but the commit 517a16b1a88b ("netrom: Decrease sock refcount when sock timers expire") accidentally removed it.
To fix use-after-free, let's add sock_hold().
[0]:
BUG: KASAN: use-after-free in do_accept+0x483/0x510 net/socket.c:1848 Read of size 8 at addr ffff88807978d398 by task syz-executor.3/5315 CPU: 0 PID: 5315 Comm: syz-executor.3 Not tainted 6.2.0-rc3-syzkaller-00165-gd9fc1511728c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:306 [inline] print_report+0x15e/0x461 mm/kasan/report.c:417 kasan_report+0xbf/0x1f0 mm/kasan/report.c:517 do_accept+0x483/0x510 net/socket.c:1848 __sys_accept4_file net/socket.c:1897 [inline] __sys_accept4+0x9a/0x120 net/socket.c:1927 __do_sys_accept net/socket.c:1944 [inline] __se_sys_accept net/socket.c:1941 [inline] __x64_sys_accept+0x75/0xb0 net/socket.c:1941 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fa436a8c0c9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fa437784168 EFLAGS: 00000246 ORIG_RAX: 000000000000002b RAX: ffffffffffffffda RBX: 00007fa436bac050 RCX: 00007fa436a8c0c9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005 RBP: 00007fa436ae7ae9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffebc6700df R14: 00007fa437784300 R15: 0000000000022000 </TASK> Allocated by task 5294: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:371 [inline] ____kasan_kmalloc mm/kasan/common.c:330 [inline] __kasan_kmalloc+0xa3/0xb0 mm/kasan/common.c:380 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slab_common.c:968 [inline] __kmalloc+0x5a/0xd0 mm/slab_common.c:981 kmalloc include/linux/slab.h:584 [inline] sk_prot_alloc+0x140/0x290 net/core/sock.c:2038 sk_alloc+0x3a/0x7a0 net/core/sock.c:2091 nr_create+0xb6/0x5f0 net/netrom/af_netrom.c:433 __sock_create+0x359/0x790 net/socket.c:1515 sock_create net/socket.c:1566 [inline] __sys_socket_create net/socket.c:1603 [inline] __sys_socket_create net/socket.c:1588 [inline] __sys_socket+0x133/0x250 net/socket.c:1636 __do_sys_socket net/socket.c:1649 [inline] __se_sys_socket net/socket.c:1647 [inline] __x64_sys_socket+0x73/0xb0 net/socket.c:1647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 14: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:518 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free+0x13b/0x1a0 mm/kasan/common.c:200 kasan_slab_free include/linux/kasan.h:177 [inline] __cache_free mm/slab.c:3394 [inline] __do_kmem_cache_free mm/slab.c:3580 [inline] __kmem_cache_free+0xcd/0x3b0 mm/slab.c:3587 sk_prot_free net/core/sock.c:2074 [inline] __sk_destruct+0x5df/0x750 net/core/sock.c:2166 sk_destruct net/core/sock.c:2181 [inline] __sk_free+0x175/0x460 net/core/sock.c:2192 sk_free+0x7c/0xa0 net/core/sock.c:2203 sock_put include/net/sock.h:1991 [inline] nr_heartbeat_expiry+0x1d7/0x460 net/netrom/nr_timer.c:148 call_timer_fn+0x1da/0x7c0 kernel/time/timer.c:1700 expire_timers+0x2c6/0x5c0 kernel/time/timer.c:1751 __run_timers kernel/time/timer.c:2022 [inline] __run_timers kernel/time/timer.c:1995 [inline] run_timer_softirq+0x326/0x910 kernel/time/timer.c:2035 __do_softirq+0x1fb/0xadc kernel/softirq.c:571
--- net/netrom/nr_timer.c | 1 + 1 file changed, 1 insertion(+)
net/netrom/nr_timer.c +1 -0
@@ -121,6 +121,7 @@ static void nr_heartbeat_expiry(struct timer_list *t)is accepted() it isn't 'dead' so doesn't get removed. */ if (sock_flag (sk,SOCK_DESTROY ) || (sk->sk_state ==TCP_LISTEN &&sock_flag (sk,SOCK_DEAD ))) { +sock_hold (sk);bh_unlock_sock (sk);nr_destroy_socket (sk); goto out;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 94/134 net/sched: sch_taprio: do not schedule in taprio_reset()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit ea4fdbaa2f7798cb25adbe4fd52ffc6356f097bb ]
As reported by syzbot and hinted by Vinicius, I should not have added a qdisc_synchronize() call in taprio_reset()
taprio_reset() can be called with qdisc spinlock held (and BH disabled) as shown in included syzbot report [1].
Only taprio_destroy() needed this synchronization, as explained in the blamed commit changelog.
[1]
BUG: scheduling while atomic: syz-executor150/5091/0x00000202 2 locks held by syz-executor150/5091: Modules linked in: Preemption disabled at: [<0000000000000000>] 0x0 Kernel panic - not syncing: scheduling while atomic: panic_on_warn set ... CPU: 1 PID: 5091 Comm: syz-executor150 Not tainted 6.2.0-rc3-syzkaller-00219-g010a74f52203 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 panic+0x2cc/0x626 kernel/panic.c:318 check_panic_on_warn.cold+0x19/0x35 kernel/panic.c:238 __schedule_bug.cold+0xd5/0xfe kernel/sched/core.c:5836 schedule_debug kernel/sched/core.c:5865 [inline] __schedule+0x34e4/0x5450 kernel/sched/core.c:6500 schedule+0xde/0x1b0 kernel/sched/core.c:6682 schedule_timeout+0x14e/0x2a0 kernel/time/timer.c:2167 schedule_timeout_uninterruptible kernel/time/timer.c:2201 [inline] msleep+0xb6/0x100 kernel/time/timer.c:2322 qdisc_synchronize include/net/sch_generic.h:1295 [inline] taprio_reset+0x93/0x270 net/sched/sch_taprio.c:1703 qdisc_reset+0x10c/0x770 net/sched/sch_generic.c:1022 dev_reset_queue+0x92/0x130 net/sched/sch_generic.c:1285 netdev_for_each_tx_queue include/linux/netdevice.h:2464 [inline] dev_deactivate_many+0x36d/0x9f0 net/sched/sch_generic.c:1351 dev_deactivate+0xed/0x1b0 net/sched/sch_generic.c:1374 qdisc_graft+0xe4a/0x1380 net/sched/sch_api.c:1080 tc_modify_qdisc+0xb6b/0x19a0 net/sched/sch_api.c:1689 rtnetlink_rcv_msg+0x43e/0xca0 net/core/rtnetlink.c:6141 netlink_rcv_skb+0x165/0x440 net/netlink/af_netlink.c:2564 netlink_unicast_kernel net/netlink/af_netlink.c:1330 [inline] netlink_unicast+0x547/0x7f0 net/netlink/af_netlink.c:1356 netlink_sendmsg+0x91b/0xe10 net/netlink/af_netlink.c:1932 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0xd3/0x120 net/socket.c:734 ____sys_sendmsg+0x712/0x8c0 net/socket.c:2476 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2530 __sys_sendmsg+0xf7/0x1c0 net/socket.c:2559 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
--- net/sched/sch_taprio.c | 1 - 1 file changed, 1 deletion(-)
net/sched/sch_taprio.c +0 -1
@@ -1622,7 +1622,6 @@ static void taprio_reset(struct Qdisc *sch)int i;hrtimer_cancel (&q->advance_timer); -qdisc_synchronize (sch);if (q->qdiscs) {for (i =0 ; i < dev->num_tx_queues && q->qdiscs[i]; i++)
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 95/134 sctp: fail if no bound addresses can be used for a given scope
In reply to Greg Kroah-HartmanFrom: Marcelo Ricardo Leitner <[email protected]>
[ Upstream commit 458e279f861d3f61796894cd158b780765a1569f ]
Currently, if you bind the socket to something like:
servaddr.sin6_family = AF_INET6;
servaddr.sin6_port = htons(0);
servaddr.sin6_scope_id = 0;
inet_pton(AF_INET6, "::1", &servaddr.sin6_addr);And then request a connect to:
connaddr.sin6_family = AF_INET6;
connaddr.sin6_port = htons(20000);
connaddr.sin6_scope_id = if_nametoindex("lo");
inet_pton(AF_INET6, "fe88::1", &connaddr.sin6_addr);What the stack does is:
- bind the socket
- create a new asoc
- to handle the connect
- copy the addresses that can be used for the given scope
- try to connect
But the copy returns 0 addresses, and the effect is that it ends up trying to connect as if the socket wasn't bound, which is not the desired behavior. This unexpected behavior also allows KASLR leaks through SCTP diag interface.
The fix here then is, if when trying to copy the addresses that can be used for the scope used in connect() it returns 0 addresses, bail out. This is what TCP does with a similar reproducer.
--- net/sctp/bind_addr.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/sctp/bind_addr.c +6 -0
@@ -73,6 +73,12 @@ int sctp_bind_addr_copy(struct net *net, struct sctp_bind_addr *dest, } } +/* If somehow no addresses were found that can be used with this +* scope, it's an error. +*/ +if (list_empty (&dest->address_list)) + error = -ENETUNREACH ; + out:if (error)sctp_bind_addr_clean (dest);
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 96/134 net: ravb: Fix possible hang if RIS2_QFF1 happen
In reply to Greg Kroah-HartmanFrom: Yoshihiro Shimoda <[email protected]>
[ Upstream commit f3c07758c9007a6bfff5290d9e19d3c41930c897 ]
Since this driver enables the interrupt by RIC2_QFE1, this driver should clear the interrupt flag if it happens. Otherwise, the interrupt causes to hang the system.
Note that this also fix a minor coding style (a comment indentation) around the fixed code.
--- drivers/net/ethernet/renesas/ravb_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/renesas/ravb_main.c +2 -2
@@ -736,14 +736,14 @@ static void ravb_error_interrupt(struct net_device *ndev)ravb_write (ndev, ~(EIS_QFS |EIS_RESERVED ),EIS );if (eis &EIS_QFS ) { ris2 =ravb_read (ndev,RIS2 ); -ravb_write (ndev, ~(RIS2_QFF0 |RIS2_RFFF |RIS2_RESERVED ), +ravb_write (ndev, ~(RIS2_QFF0 |RIS2_QFF1 |RIS2_RFFF |RIS2_RESERVED ),RIS2 );/* Receive Descriptor Empty int */ if (ris2 &RIS2_QFF0 ) priv->stats[RAVB_BE ].rx_over_errors++; -/* Receive Descriptor Empty int */ +/* Receive Descriptor Empty int */ if (ris2 &RIS2_QFF1 ) priv->stats[RAVB_NC ].rx_over_errors++;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 97/134 thermal: intel: int340x: Add locking to int340x_thermal_get_trip_type()
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
[ Upstream commit acd7e9ee57c880b99671dd99680cb707b7b5b0ee ]
In order to prevent int340x_thermal_get_trip_type() from possibly racing with int340x_thermal_read_trips() invoked by int3403_notify() add locking to it in analogy with int340x_thermal_get_trip_temp().
--- .../intel/int340x_thermal/int340x_thermal_zone.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/thermal/intel/int340x_thermal/int340x_thermal_zone.c +7 -3
@@ -80,11 +80,13 @@ static int int340x_thermal_get_trip_type(struct thermal_zone_device *zone, enum thermal_trip_type *type) {struct int34x_thermal_zone *d = zone->devdata; -int i; +int i, ret =0 ;if (d->override_ops && d->override_ops->get_trip_type)return d->override_ops->get_trip_type (zone, trip, type); +mutex_lock (&d->trip_mutex); +if (trip < d->aux_trip_nr) *type =THERMAL_TRIP_PASSIVE ;else if (trip == d->crt_trip_id)
@@ -102,10 +104,12 @@ static int int340x_thermal_get_trip_type(struct thermal_zone_device *zone, } }if (i ==INT340X_THERMAL_MAX_ACT_TRIP_COUNT ) -return -EINVAL ; + ret = -EINVAL ; } -return 0 ; +mutex_unlock (&d->trip_mutex); + +return ret; } static int int340x_thermal_set_trip_temp(struct thermal_zone_device *zone,
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 98/134 net/tg3: resolve deadlock in tg3_reset_task() during EEH
In reply to Greg Kroah-HartmanFrom: David Christensen <[email protected]>
[ Upstream commit 6c4ca03bd890566d873e3593b32d034bf2f5a087 ]
During EEH error injection testing, a deadlock was encountered in the tg3 driver when tg3_io_error_detected() was attempting to cancel outstanding reset tasks:
crash> foreach UN bt
...
PID: 159 TASK: c0000000067c6000 CPU: 8 COMMAND: "eehd"
...
#5 [c00000000681f990] __cancel_work_timer at c00000000019fd18 #6 [c00000000681fa30] tg3_io_error_detected at c00800000295f098 [tg3] #7 [c00000000681faf0] eeh_report_error at c00000000004e25c
...
PID: 290 TASK: c000000036e5f800 CPU: 6 COMMAND: "kworker/6:1"
...
#4 [c00000003721fbc0] rtnl_lock at c000000000c940d8 #5 [c00000003721fbe0] tg3_reset_task at c008000002969358 [tg3] #6 [c00000003721fc60] process_one_work at c00000000019e5c4
...
PID: 296 TASK: c000000037a65800 CPU: 21 COMMAND: "kworker/21:1"
...
#4 [c000000037247bc0] rtnl_lock at c000000000c940d8 #5 [c000000037247be0] tg3_reset_task at c008000002969358 [tg3] #6 [c000000037247c60] process_one_work at c00000000019e5c4
...
PID: 655 TASK: c000000036f49000 CPU: 16 COMMAND: "kworker/16:2"
...:1
#4 [c0000000373ebbc0] rtnl_lock at c000000000c940d8 #5 [c0000000373ebbe0] tg3_reset_task at c008000002969358 [tg3] #6 [c0000000373ebc60] process_one_work at c00000000019e5c4
...
Code inspection shows that both tg3_io_error_detected() and tg3_reset_task() attempt to acquire the RTNL lock at the beginning of their code blocks. If tg3_reset_task() should happen to execute between the times when tg3_io_error_deteced() acquires the RTNL lock and tg3_reset_task_cancel() is called, a deadlock will occur.
Moving tg3_reset_task_cancel() call earlier within the code block, prior to acquiring RTNL, prevents this from happening, but also exposes another deadlock issue where tg3_reset_task() may execute AFTER tg3_io_error_detected() has executed:
crash> foreach UN bt
PID: 159 TASK: c0000000067d2000 CPU: 9 COMMAND: "eehd"
...
#4 [c000000006867a60] rtnl_lock at c000000000c940d8
#5 [c000000006867a80] tg3_io_slot_reset at c0080000026c2ea8 [tg3] #6 [c000000006867b00] eeh_report_reset at c00000000004de88
...
PID: 363 TASK: c000000037564000 CPU: 6 COMMAND: "kworker/6:1"
...
#3 [c000000036c1bb70] msleep at c000000000259e6c
#4 [c000000036c1bba0] napi_disable at c000000000c6b848 #5 [c000000036c1bbe0] tg3_reset_task at c0080000026d942c [tg3] #6 [c000000036c1bc60] process_one_work at c00000000019e5c4
...
This issue can be avoided by aborting tg3_reset_task() if EEH error recovery is already in progress.
--- drivers/net/ethernet/broadcom/tg3.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/ethernet/broadcom/tg3.c +4 -4
@@ -11195,7 +11195,7 @@ static void tg3_reset_task(struct work_struct *work)rtnl_lock ();tg3_full_lock (tp,0 ); -if (!netif_running (tp->dev)) { +if (tp->pcierr_recovery || !netif_running (tp->dev)) {tg3_flag_clear (tp,RESET_TASK_PENDING );tg3_full_unlock (tp);rtnl_unlock ();
@@ -18187,6 +18187,9 @@ static pci_ers_result_t tg3_io_error_detected(struct pci_dev *pdev,netdev_info (netdev,"PCI I/O error detected\n" ); +/* Want to make sure that the reset task doesn't run */ +tg3_reset_task_cancel (tp); +rtnl_lock ();/* Could be second call or maybe we don't have netdev yet */
@@ -18203,9 +18206,6 @@ static pci_ers_result_t tg3_io_error_detected(struct pci_dev *pdev,tg3_timer_stop (tp); -/* Want to make sure that the reset task doesn't run */ -tg3_reset_task_cancel (tp); -netif_device_detach (netdev);/* Clean up software state, even if MMIO is blocked */
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 99/134 net/phy/mdio-i2c: Move header file to include/linux/mdio
In reply to Greg Kroah-HartmanFrom: Andrew Lunn <[email protected]>
[ Upstream commit fcba68bd75bb1d42b3aec7f471d382a9e639a672 ]
In preparation for moving all MDIO drivers into drivers/net/mdio, move the mdio-i2c header file into include/linux/mdio so it can be used by both the MDIO driver and the SFP code which instantiates I2C MDIO busses.
v2:
Add include/linux/mdio
Stable-dep-of: 7083df59abbc ("net: mdio-mux-meson-g12a: force internal PHY off on mux switch")
---
MAINTAINERS | 1 +
drivers/net/phy/mdio-i2c.c | 3 +--
drivers/net/phy/sfp.c | 2 +-
{drivers/net/phy => include/linux/mdio}/mdio-i2c.h | 0
4 files changed, 3 insertions(+), 3 deletions(-)
rename {drivers/net/phy => include/linux/mdio}/mdio-i2c.h (100%)MAINTAINERS +1 -0
@@ -14661,6 +14661,7 @@ L: [email protected] S: Maintained F: drivers/net/phy/phylink.c F: drivers/net/phy/sfp* +F: include/linux/mdio/mdio-i2c.h F: include/linux/phylink.h F: include/linux/sfp.h K: phylink
drivers/net/phy/mdio-i2c.c +1 -2
@@ -10,10 +10,9 @@* of their settings. */ #include <linux/i2c.h> +#include <linux/mdio/mdio-i2c.h> #include <linux/phy.h> -#include "mdio-i2c.h" -/* * I2C bus addresses 0x50 and 0x51 are normally an EEPROM, which is * specified to be present in SFP modules. These correspond with PHY
drivers/net/phy/sfp.c +1 -1
@@ -7,6 +7,7 @@#include <linux/i2c.h> #include <linux/interrupt.h> #include <linux/jiffies.h> +#include <linux/mdio/mdio-i2c.h> #include <linux/module.h> #include <linux/mutex.h> #include <linux/of.h>
@@ -16,7 +17,6 @@#include <linux/slab.h> #include <linux/workqueue.h> -#include "mdio-i2c.h" #include "sfp.h" #include "swphy.h"
include/linux/mdio/mdio-i2c.h renamed from drivers/net/phy/mdio-i2c.h +0 -0
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 100/134 net: xgene: Move shared header file into include/linux
In reply to Greg Kroah-HartmanFrom: Andrew Lunn <[email protected]>
[ Upstream commit 232e15e1d7ddb191c28248cb681f4544c0ff1c54 ]
This header file is currently included into the ethernet driver via a relative path into the PHY subsystem. This is bad practice, and causes issues for the upcoming move of the MDIO driver. Move the header file into include/linux to clean this up.
v2:
Move header to include/linux/mdio
Stable-dep-of: 7083df59abbc ("net: mdio-mux-meson-g12a: force internal PHY off on mux switch")
---
drivers/net/ethernet/apm/xgene/xgene_enet_main.h | 2 +-
drivers/net/phy/mdio-xgene.c | 2 +-
{drivers/net/phy => include/linux/mdio}/mdio-xgene.h | 0
3 files changed, 2 insertions(+), 2 deletions(-)
rename {drivers/net/phy => include/linux/mdio}/mdio-xgene.h (100%)drivers/net/ethernet/apm/xgene/xgene_enet_main.h +1 -1
@@ -18,6 +18,7 @@#include <linux/of_platform.h> #include <linux/of_net.h> #include <linux/of_mdio.h> +#include <linux/mdio/mdio-xgene.h> #include <linux/module.h> #include <net/ip.h> #include <linux/prefetch.h>
@@ -26,7 +27,6 @@#include "xgene_enet_hw.h" #include "xgene_enet_cle.h" #include "xgene_enet_ring2.h" -#include "../../../phy/mdio-xgene.h" #define XGENE_DRV_VERSION "v1.0"#define ETHER_MIN_PACKET 64
drivers/net/phy/mdio-xgene.c +1 -1
@@ -11,6 +11,7 @@#include <linux/efi.h> #include <linux/if_vlan.h> #include <linux/io.h> +#include <linux/mdio/mdio-xgene.h> #include <linux/module.h> #include <linux/of_platform.h> #include <linux/of_net.h>
@@ -18,7 +19,6 @@#include <linux/prefetch.h> #include <linux/phy.h> #include <net/ip.h> -#include "mdio-xgene.h" static bool xgene_mdio_status;
include/linux/mdio/mdio-xgene.h renamed from drivers/net/phy/mdio-xgene.h +0 -0
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 101/134 net: mdio-mux-meson-g12a: force internal PHY off on mux switch
In reply to Greg Kroah-HartmanFrom: Jerome Brunet <[email protected]>
[ Upstream commit 7083df59abbc2b7500db312cac706493be0273ff ]
Force the internal PHY off then on when switching to the internal path. This fixes problems where the PHY ID is not properly set.
--- drivers/net/phy/mdio-mux-meson-g12a.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-)
drivers/net/phy/mdio-mux-meson-g12a.c +16 -7
@@ -4,6 +4,7 @@*/ #include <linux/bitfield.h> +#include <linux/delay.h> #include <linux/clk.h> #include <linux/clk-provider.h> #include <linux/device.h>
@@ -148,6 +149,7 @@ static const struct clk_ops g12a_ephy_pll_ops = {static int g12a_enable_internal_mdio (struct g12a_mdio_mux *priv) { +u32 value;int ret;/* Enable the phy clock */
@@ -161,18 +163,25 @@ static int g12a_enable_internal_mdio(struct g12a_mdio_mux *priv)/* Initialize ephy control */ writel (EPHY_G12A_ID , priv->regs +ETH_PHY_CNTL0 ); -writel (FIELD_PREP (PHY_CNTL1_ST_MODE ,3 ) | -FIELD_PREP (PHY_CNTL1_ST_PHYADD ,EPHY_DFLT_ADD ) | -FIELD_PREP (PHY_CNTL1_MII_MODE ,EPHY_MODE_RMII ) | -PHY_CNTL1_CLK_EN | -PHY_CNTL1_CLKFREQ | -PHY_CNTL1_PHY_ENB , - priv->regs +ETH_PHY_CNTL1 ); + +/* Make sure we get a 0 -> 1 transition on the enable bit */ + value =FIELD_PREP (PHY_CNTL1_ST_MODE ,3 ) | +FIELD_PREP (PHY_CNTL1_ST_PHYADD ,EPHY_DFLT_ADD ) | +FIELD_PREP (PHY_CNTL1_MII_MODE ,EPHY_MODE_RMII ) | +PHY_CNTL1_CLK_EN | +PHY_CNTL1_CLKFREQ ; +writel (value, priv->regs +ETH_PHY_CNTL1 );writel (PHY_CNTL2_USE_INTERNAL |PHY_CNTL2_SMI_SRC_MAC |PHY_CNTL2_RX_CLK_EPHY , priv->regs +ETH_PHY_CNTL2 ); + value |=PHY_CNTL1_PHY_ENB ; +writel (value, priv->regs +ETH_PHY_CNTL1 ); + +/* The phy needs a bit of time to power up */ +mdelay (10 ); +return 0 ; }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 102/134 Revert "Input: synaptics - switch touchpad on HP Laptop 15-da3001TU to RMI mode"
In reply to Greg Kroah-HartmanFrom: Dmitry Torokhov <[email protected]>
commit 3c44e2b6cde674797b76e76d3a903a63ce8a18bb upstream.
This reverts commit ac5408991ea6b06e29129b4d4861097c4c3e0d59 because it causes loss of keyboard on HP 15-da1xxx.
Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1206358
--- drivers/input/mouse/synaptics.c | 1 - 1 file changed, 1 deletion(-)
drivers/input/mouse/synaptics.c +0 -1
@@ -189,7 +189,6 @@ static const char * const smbus_pnp_ids["SYN3221" ,/* HP 15-ay000 */ "SYN323d" ,/* HP Spectre X360 13-w013dx */ "SYN3257" ,/* HP Envy 13-ad105ng */ -"SYN3286" ,/* HP Laptop 15-da3001TU */ NULL };
Greg Kroah-Hartman
maintainerPATCH 103/134 nfsd: Ensure knfsd shuts down when the "nfsd" pseudofs is unmounted
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
commit c6c7f2a84da459bcc3714044e74a9cb66de31039 upstream.
In order to ensure that knfsd threads don't linger once the nfsd pseudofs is unmounted (e.g. when the container is killed) we let nfsd_umount() shut down those threads and wait for them to exit.
This also should ensure that we don't need to do a kernel mount of the pseudofs, since the thread lifetime is now limited by the lifetime of the filesystem.
--- fs/nfsd/netns.h | 6 +++--- fs/nfsd/nfs4state.c | 8 +------- fs/nfsd/nfsctl.c | 14 ++------------ fs/nfsd/nfsd.h | 3 +-- fs/nfsd/nfssvc.c | 35 ++++++++++++++++++++++++++++++++++- 5 files changed, 41 insertions(+), 25 deletions(-)
fs/nfsd/netns.h +3 -3
@@ -42,9 +42,6 @@ struct nfsd_net {bool grace_ended;time_t boot_time; -/* internal mount of the "nfsd" pseudofilesystem: */ -struct vfsmount *nfsd_mnt; -struct dentry *nfsd_client_dir;/*
@@ -121,6 +118,9 @@ struct nfsd_net {wait_queue_head_t ntf_wq;atomic_t ntf_refcnt; +/* Allow umount to wait for nfsd state cleanup */ +struct completion nfsd_shutdown_complete; +/* * clientid and stateid data for construction of net unique COPY * stateids.
fs/nfsd/nfs4state.c +1 -7
@@ -7754,14 +7754,9 @@ nfs4_state_start_net(struct net *net)struct nfsd_net *nn =net_generic (net, nfsd_net_id);int ret; - ret =get_nfsdfs (net); -if (ret) -return ret; ret =nfs4_state_create_net (net); -if (ret) { -mntput (nn->nfsd_mnt); +if (ret)return ret; - }locks_start_grace (net, &nn->nfsd4_manager);nfsd4_client_tracking_init (net);if (nn->track_reclaim_completes && nn->reclaim_str_hashtbl_size ==0 )
@@ -7830,7 +7825,6 @@ nfs4_state_shutdown_net(struct net *net)nfsd4_client_tracking_exit (net);nfs4_state_destroy_net (net); -mntput (nn->nfsd_mnt); }void
fs/nfsd/nfsctl.c +2 -12
@@ -1417,6 +1417,8 @@ static void nfsd_umount(struct super_blo {struct net *net = sb->s_fs_info; +nfsd_shutdown_threads (net); +kill_litter_super (sb);put_net (net); }
@@ -1429,18 +1431,6 @@ static struct file_system_type nfsd_fs_t };MODULE_ALIAS_FS ("nfsd" ); -int get_nfsdfs (struct net *net) -{ -struct nfsd_net *nn =net_generic (net, nfsd_net_id); -struct vfsmount *mnt; - - mnt =vfs_kern_mount (&nfsd_fs_type,SB_KERNMOUNT ,"nfsd" ,NULL ); -if (IS_ERR (mnt)) -return PTR_ERR (mnt); - nn->nfsd_mnt = mnt; -return 0 ; -} -#ifdef CONFIG_PROC_FS static int create_proc_exports_entry (void ) {
fs/nfsd/nfsd.h +1 -2
@@ -84,11 +84,10 @@ int nfsd_get_nrthreads(int n, int *, stint nfsd_set_nrthreads (int n,int *,struct net *);int nfsd_pool_stats_open (struct inode *,struct file *);int nfsd_pool_stats_release (struct inode *,struct file *); +void nfsd_shutdown_threads (struct net *net);void nfsd_destroy (struct net *net); -int get_nfsdfs (struct net *); -struct nfsdfs_client {struct kref cl_ref;void (*cl_release)(struct kref *kref);
fs/nfsd/nfssvc.c +34 -1
@@ -594,6 +594,37 @@ static const struct svc_serv_ops nfsd_th .svo_module = THIS_MODULE, }; +static void nfsd_complete_shutdown (struct net *net) +{ +struct nfsd_net *nn =net_generic (net, nfsd_net_id); + +WARN_ON (!mutex_is_locked (&nfsd_mutex)); + + nn->nfsd_serv =NULL ; +complete (&nn->nfsd_shutdown_complete); +} + +void nfsd_shutdown_threads (struct net *net) +{ +struct nfsd_net *nn =net_generic (net, nfsd_net_id); +struct svc_serv *serv; + +mutex_lock (&nfsd_mutex); + serv = nn->nfsd_serv; +if (serv ==NULL ) { +mutex_unlock (&nfsd_mutex); +return ; + } + +svc_get (serv); +/* Kill outstanding nfsd threads */ + serv->sv_ops->svo_setup (serv,NULL ,0 ); +nfsd_destroy (net); +mutex_unlock (&nfsd_mutex); +/* Wait for shutdown of nfsd_serv to complete */ +wait_for_completion (&nn->nfsd_shutdown_complete); +} +int nfsd_create_serv (struct net *net) {int error;
@@ -611,11 +642,13 @@ int nfsd_create_serv(struct net *net) &nfsd_thread_sv_ops);if (nn->nfsd_serv ==NULL )return -ENOMEM ; +init_completion (&nn->nfsd_shutdown_complete); nn->nfsd_serv->sv_maxconn = nn->max_connections; error =svc_bind (nn->nfsd_serv, net);if (error <0 ) {svc_destroy (nn->nfsd_serv); +nfsd_complete_shutdown (net);return error; }
@@ -664,7 +697,7 @@ void nfsd_destroy(struct net *net)svc_shutdown_net (nn->nfsd_serv, net);svc_destroy (nn->nfsd_serv);if (destroy) - nn->nfsd_serv =NULL ; +nfsd_complete_shutdown (net); }int nfsd_set_nrthreads (int n,int *nthreads,struct net *net)
Greg Kroah-Hartman
maintainerPATCH 104/134 block: fix and cleanup bio_check_ro
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
commit 57e95e4670d1126c103305bcf34a9442f49f6d6a upstream.
Don't use a WARN_ON when printing a potentially user triggered condition. Also don't print the partno when the block device name already includes it, and use the %pg specifier to simplify printing the block device name.
--- block/blk-core.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
block/blk-core.c +1 -4
@@ -793,10 +793,7 @@ static inline bool bio_check_ro(struct bif (op_is_flush (bio->bi_opf) && !bio_sectors (bio))return false; - -WARN_ONCE (1 , -"generic_make_request: Trying to write " -"to read-only block-device %s (partno %d)\n" , +pr_warn ("Trying to write to read-only block-device %s (partno %d)\n" ,bio_devname (bio, b), part->partno);/* Older lvm-tools actually trigger this */ return false;
Greg Kroah-Hartman
maintainerPATCH 105/134 x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL
In reply to Greg Kroah-HartmanFrom: Thomas Gleixner <[email protected]>
commit 5fa55950729d0762a787451dc52862c3f850f859 upstream.
Baoquan reported that after triggering a crash the subsequent crash-kernel fails to boot about half of the time. It triggers a NULL pointer dereference in the periodic tick code.
This happens because the legacy timer interrupt (IRQ0) is resent in software which happens in soft interrupt (tasklet) context. In this context get_irq_regs() returns NULL which leads to the NULL pointer dereference.
The reason for the resend is a spurious APIC interrupt on the IRQ0 vector which is captured and leads to a resend when the legacy timer interrupt is enabled. This is wrong because the legacy PIC interrupts are level triggered and therefore should never be resent in software, but nothing ever sets the IRQ_LEVEL flag on those interrupts, so the core code does not know about their trigger type.
Ensure that IRQ_LEVEL is set when the legacy PCI interrupts are set up.
--- arch/x86/kernel/i8259.c | 1 + arch/x86/kernel/irqinit.c | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-)
arch/x86/kernel/i8259.c +1 -0
@@ -114,6 +114,7 @@ static void make_8259A_irq(unsigned intdisable_irq_nosync (irq); io_apic_irqs &= ~(1 <<irq);irq_set_chip_and_handler (irq, &i8259A_chip, handle_level_irq); +irq_set_status_flags (irq,IRQ_LEVEL );enable_irq (irq);lapic_assign_legacy_vector (irq, true); }
arch/x86/kernel/irqinit.c +3 -1
@@ -72,8 +72,10 @@ void __init init_ISA_irqs(void) legacy_pic->init (0 ); -for (i =0 ; i <nr_legacy_irqs (); i++) +for (i =0 ; i <nr_legacy_irqs (); i++) {irq_set_chip_and_handler (i, chip, handle_level_irq); +irq_set_status_flags (i,IRQ_LEVEL ); + } }void __init init_IRQ (void )
Greg Kroah-Hartman
maintainerPATCH 106/134 netfilter: conntrack: unify established states for SCTP paths
In reply to Greg Kroah-HartmanFrom: Sriram Yagnaraman <[email protected]>
commit a44b7651489f26271ac784b70895e8a85d0cebf4 upstream.
An SCTP endpoint can start an association through a path and tear it down over another one. That means the initial path will not see the shutdown sequence, and the conntrack entry will remain in ESTABLISHED state for 5 days.
By merging the HEARTBEAT_ACKED and ESTABLISHED states into one ESTABLISHED state, there remains no difference between a primary or secondary path. The timeout for the merged ESTABLISHED state is set to 210 seconds (hb_interval * max_path_retrans + rto_max). So, even if a path doesn't see the shutdown sequence, it will expire in a reasonable amount of time.
With this change in place, there is now more than one state from which we can transition to ESTABLISHED, COOKIE_ECHOED and HEARTBEAT_SENT, so handle the setting of ASSURED bit whenever a state change has happened and the new state is ESTABLISHED. Removed the check for dir==REPLY since the transition to ESTABLISHED can happen only in the reply direction.
--- include/uapi/linux/netfilter/nf_conntrack_sctp.h | 2 include/uapi/linux/netfilter/nfnetlink_cttimeout.h | 2 net/netfilter/nf_conntrack_proto_sctp.c | 93 ++++++++------------- net/netfilter/nf_conntrack_standalone.c | 8 - 4 files changed, 41 insertions(+), 64 deletions(-)
include/uapi/linux/netfilter/nf_conntrack_sctp.h +1 -1
@@ -15,7 +15,7 @@ enum sctp_conntrack {SCTP_CONNTRACK_SHUTDOWN_RECD ,SCTP_CONNTRACK_SHUTDOWN_ACK_SENT ,SCTP_CONNTRACK_HEARTBEAT_SENT , -SCTP_CONNTRACK_HEARTBEAT_ACKED , +SCTP_CONNTRACK_HEARTBEAT_ACKED ,/* no longer used */ SCTP_CONNTRACK_MAX };
include/uapi/linux/netfilter/nfnetlink_cttimeout.h +1 -1
@@ -94,7 +94,7 @@ enum ctattr_timeout_sctp {CTA_TIMEOUT_SCTP_SHUTDOWN_RECD ,CTA_TIMEOUT_SCTP_SHUTDOWN_ACK_SENT ,CTA_TIMEOUT_SCTP_HEARTBEAT_SENT , -CTA_TIMEOUT_SCTP_HEARTBEAT_ACKED , +CTA_TIMEOUT_SCTP_HEARTBEAT_ACKED ,/* no longer used */ __CTA_TIMEOUT_SCTP_MAX };#define CTA_TIMEOUT_SCTP_MAX (__CTA_TIMEOUT_SCTP_MAX - 1)
net/netfilter/nf_conntrack_proto_sctp.c +39 -54
144 lines not on this page · raw message
net/netfilter/nf_conntrack_standalone.c +0 -8
@@ -581,7 +581,6 @@ enum nf_ct_sysctl_index {NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_SHUTDOWN_RECD ,NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_SHUTDOWN_ACK_SENT ,NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_HEARTBEAT_SENT , -NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_HEARTBEAT_ACKED , #endif #ifdef CONFIG_NF_CT_PROTO_DCCP NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_REQUEST,
@@ -851,12 +850,6 @@ static struct ctl_table nf_ct_sysctl_tab .mode = 0644, .proc_handler = proc_dointvec_jiffies, }, - [NF_SYSCTL_CT_PROTO_TIMEOUT_SCTP_HEARTBEAT_ACKED] = { - .procname = "nf_conntrack_sctp_timeout_heartbeat_acked", - .maxlen = sizeof(unsigned int), - .mode = 0644, - .proc_handler = proc_dointvec_jiffies, - },#endif #ifdef CONFIG_NF_CT_PROTO_DCCP [NF_SYSCTL_CT_PROTO_TIMEOUT_DCCP_REQUEST] = {
@@ -985,7 +978,6 @@ static void nf_conntrack_standalone_initXASSIGN (SHUTDOWN_RECD , sn);XASSIGN (SHUTDOWN_ACK_SENT , sn);XASSIGN (HEARTBEAT_SENT , sn); -XASSIGN (HEARTBEAT_ACKED , sn);#undef XASSIGN#endif }
Greg Kroah-Hartman
maintainerPATCH 107/134 perf/x86/amd: fix potential integer overflow on shift of a int
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
commit 08245672cdc6505550d1a5020603b0a8d4a6dcc7 upstream.
The left shift of int 32 bit integer constant 1 is evaluated using 32 bit arithmetic and then passed as a 64 bit function argument. In the case where i is 32 or more this can lead to an overflow. Avoid this by shifting using the BIT_ULL macro instead.
--- arch/x86/events/amd/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/events/amd/core.c +1 -1
@@ -969,7 +969,7 @@ static int __init amd_core_pmu_init(void* numbered counter following it. */ for (i =0 ; i < x86_pmu.num_counters -1 ; i +=2 ) - even_ctr_mask |=1 << i; + even_ctr_mask |=BIT_ULL (i); pair_constraint = (struct event_constraint ) __EVENT_CONSTRAINT(0, even_ctr_mask, 0,
Greg Kroah-Hartman
maintainerPATCH 108/134 clk: Fix pointer casting to prevent oops in devm_clk_release()
In reply to Greg Kroah-HartmanFrom: Uwe Kleine-König <[email protected]>
commit 8b3d743fc9e2542822826890b482afabf0e7522a upstream.
The release function is called with a pointer to the memory returned by devres_alloc(). I was confused about that by the code before the generalization that used a struct clk **ptr.
--- drivers/clk/clk-devres.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/clk-devres.c +1 -1
@@ -11,7 +11,7 @@ struct devm_clk_state {static void devm_clk_release (struct device *dev,void *res) { -struct devm_clk_state *state = *(struct devm_clk_state **)res; +struct devm_clk_state *state = res;if (state->exit) state->exit (state->clk);
Greg Kroah-Hartman
maintainerPATCH 109/134 x86/asm: Fix an assembler warning with current binutils
In reply to Greg Kroah-HartmanFrom: Mikulas Patocka <[email protected]>
commit 55d235361fccef573990dfa5724ab453866e7816 upstream.
Fix a warning: "found movsd'; assuming movsl' was meant"
--- arch/x86/lib/iomap_copy_64.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/lib/iomap_copy_64.S +1 -1
@@ -10,6 +10,6 @@ */ ENTRY(__iowrite32_copy) movl %edx,%ecx - rep movsd + rep movsl ret ENDPROC(__iowrite32_copy)
Greg Kroah-Hartman
maintainerPATCH 110/134 ARM: dts: imx: Fix pca9547 i2c-mux node name
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit f78985f9f58380eec37f82c8a2c765aa7670fc29 ]
"make dtbs_check":
arch/arm/boot/dts/imx53-ppd.dtb: i2c-switch@70: $nodename:0: 'i2c-switch@70' does not match '^(i2c-?)?mux'
From schema: Documentation/devicetree/bindings/i2c/i2c-mux-pca954x.yaml
arch/arm/boot/dts/imx53-ppd.dtb: i2c-switch@70: Unevaluated properties are not allowed ('#address-cells', '#size-cells', 'i2c@0', 'i2c@1', 'i2c@2', 'i2c@3', 'i2c@4', 'i2c@5', 'i2c@6', 'i2c@7' were unexpected)
From schema: Documentation/devicetree/bindings/i2c/i2c-mux-pca954x.yaml
Fix this by renaming the PCA9547 node to "i2c-mux", to match the I2C bus multiplexer/switch DT bindings and the Generic Names Recommendation in the Devicetree Specification.
--- arch/arm/boot/dts/imx53-ppd.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/imx53-ppd.dts +1 -1
@@ -461,7 +461,7 @@ &i2c1 { scl-gpios = <&gpio3 21 GPIO_ACTIVE_HIGH>; status = "okay"; - i2c-switch@70 { + i2c-mux@70 { compatible = "nxp,pca9547"; #address-cells = <1>; #size-cells = <0>;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 111/134 bpf: Skip task with pid=1 in send_signal_common()
In reply to Greg Kroah-HartmanFrom: Hao Sun <[email protected]>
[ Upstream commit a3d81bc1eaef48e34dd0b9b48eefed9e02a06451 ]
The following kernel panic can be triggered when a task with pid=1 attaches a prog that attempts to send killing signal to itself, also see [1] for more details:
Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b CPU: 3 PID: 1 Comm: systemd Not tainted 6.1.0-09652-g59fe41b5255f #148 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x100/0x178 lib/dump_stack.c:106 panic+0x2c4/0x60f kernel/panic.c:275 do_exit.cold+0x63/0xe4 kernel/exit.c:789 do_group_exit+0xd4/0x2a0 kernel/exit.c:950 get_signal+0x2460/0x2600 kernel/signal.c:2858 arch_do_signal_or_restart+0x78/0x5d0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296 do_syscall_64+0x44/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd
So skip task with pid=1 in bpf_send_signal_common() to avoid the panic.
[1] https://lore.kernel.org/bpf/[email protected]
--- kernel/trace/bpf_trace.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/trace/bpf_trace.c +3 -0
@@ -649,6 +649,9 @@ BPF_CALL_1(bpf_send_signal, u32, sig)return -EPERM ;if (unlikely (!nmi_uaccess_okay ()))return -EPERM ; +/* Task should not be pid=1 to avoid kernel panic. */ +if (unlikely (is_global_init (current))) +return -EPERM ;if (irqs_disabled ()) {/* Do an early check on signal validity. Otherwise,
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 112/134 blk-cgroup: fix missing pd_online_fn() while activating policy
In reply to Greg Kroah-HartmanFrom: Yu Kuai <[email protected]>
[ Upstream commit e3ff8887e7db757360f97634e0d6f4b8e27a8c46 ]
If the policy defines pd_online_fn(), it should be called after pd_init_fn(), like blkg_create().
--- block/blk-cgroup.c | 4 ++++ 1 file changed, 4 insertions(+)
block/blk-cgroup.c +4 -0
@@ -1445,6 +1445,10 @@ int blkcg_activate_policy(struct request_queue *q,list_for_each_entry_reverse (blkg, &q->blkg_list, q_node) pol->pd_init_fn (blkg->pd[pol->plid]); +if (pol->pd_online_fn) +list_for_each_entry_reverse (blkg, &q->blkg_list, q_node) + pol->pd_online_fn (blkg->pd[pol->plid]); +__set_bit (pol->plid, q->blkcg_pols); ret =0 ;
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 113/134 dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
In reply to Greg Kroah-HartmanFrom: Hui Wang <[email protected]>
[ Upstream commit 1417f59ac0b02130ee56c0c50794b9b257be3d17 ]
If the function sdma_load_context() fails, the sdma_desc will be freed, but the allocated desc->bd is forgot to be freed.
We already met the sdma_load_context() failure case and the log as below:
[ 450.699064] imx-sdma 30bd0000.dma-controller: Timeout waiting for CH0 ready
...
In this case, the desc->bd will not be freed without this change.
--- drivers/dma/imx-sdma.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/dma/imx-sdma.c +3 -1
@@ -1360,10 +1360,12 @@ static struct sdma_desc *sdma_transfer_init(struct sdma_channel *sdmac,sdma_config_ownership (sdmac, false, true, false);if (sdma_load_context (sdmac)) - goto err_desc_out; + goto err_bd_out;return desc; +err_bd_out: +sdma_free_bd (desc); err_desc_out:kfree (desc); err_out:
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 114/134 sysctl: add a new register_sysctl_init() interface
In reply to Greg Kroah-HartmanFrom: Xiaoming Ni <[email protected]>
commit 3ddd9a808cee7284931312f2f3e854c9617f44b2 upstream.
Patch series "sysctl: first set of kernel/sysctl cleanups", v2.
Finally had time to respin the series of the work we had started last year on cleaning up the kernel/sysct.c kitchen sink. People keeps stuffing their sysctls in that file and this creates a maintenance burden. So this effort is aimed at placing sysctls where they actually belong.
I'm going to split patches up into series as there is quite a bit of work.
This first set adds register_sysctl_init() for uses of registerting a sysctl on the init path, adds const where missing to a few places, generalizes common values so to be more easy to share, and starts the move of a few kernel/sysctl.c out where they belong.
The majority of rework on v2 in this first patch set is 0-day fixes. Eric Biederman's feedback is later addressed in subsequent patch sets.
I'll only post the first two patch sets for now. We can address the rest once the first two patch sets get completely reviewed / Acked.
This patch (of 9):
The kernel/sysctl.c is a kitchen sink where everyone leaves their dirty dishes, this makes it very difficult to maintain.
To help with this maintenance let's start by moving sysctls to places where they actually belong. The proc sysctl maintainers do not want to know what sysctl knobs you wish to add for your own piece of code, we just care about the core logic.
Today though folks heavily rely on tables on kernel/sysctl.c so they can easily just extend this table with their needed sysctls. In order to help users move their sysctls out we need to provide a helper which can be used during code initialization.
We special-case the initialization use of register_sysctl() since it *is* safe to fail, given all that sysctls do is provide a dynamic interface to query or modify at runtime an existing variable. So the use case of register_sysctl() on init should *not* stop if the sysctls don't end up getting registered. It would be counter productive to stop boot if a simple sysctl registration failed.
Provide a helper for init then, and document the recommended init levels to use for callers of this routine. We will later use this in subsequent patches to start slimming down kernel/sysctl.c tables and moving sysctl registration to the code which actually needs these sysctls.
[[email protected]: major commit log and documentation rephrasing also moved to fs/proc/proc_sysctl.c ]
--- fs/proc/proc_sysctl.c | 33 +++++++++++++++++++++++++++++++++ include/linux/sysctl.h | 3 +++ 2 files changed, 36 insertions(+)
fs/proc/proc_sysctl.c +33 -0
@@ -14,6 +14,7 @@#include <linux/mm.h> #include <linux/module.h> #include <linux/bpf-cgroup.h> +#include <linux/kmemleak.h> #include "internal.h" static const struct dentry_operations proc_sys_dentry_operations;
@@ -1397,6 +1398,38 @@ struct ctl_table_header *register_sysctl(const char *path, struct ctl_table *tab }EXPORT_SYMBOL (register_sysctl); +/** +* __register_sysctl_init() - register sysctl table to path +* @path: path name for sysctl base +* @table: This is the sysctl table that needs to be registered to the path +* @table_name: The name of sysctl table, only used for log printing when +* registration fails +* +* The sysctl interface is used by userspace to query or modify at runtime +* a predefined value set on a variable. These variables however have default +* values pre-set. Code which depends on these variables will always work even +* if register_sysctl() fails. If register_sysctl() fails you'd just loose the +* ability to query or modify the sysctls dynamically at run time. Chances of +* register_sysctl() failing on init are extremely low, and so for both reasons +* this function does not return any error as it is used by initialization code. +* +* Context: Can only be called after your respective sysctl base path has been +* registered. So for instance, most base directories are registered early on +* init before init levels are processed through proc_sys_init() and +* sysctl_init(). +*/ +void __init __register_sysctl_init (const char *path,struct ctl_table *table, +const char *table_name) +{ +struct ctl_table_header *hdr =register_sysctl (path, table); + +if (unlikely (!hdr)) { +pr_err ("failed when register_sysctl %s to %s\n" , table_name, path); +return ; + } +kmemleak_not_leak (hdr); +} +static char *append_path (const char *path,char *pos,const char *name) {int namelen;
include/linux/sysctl.h +3 -0
@@ -208,6 +208,9 @@ struct ctl_table_header *register_sysctl_paths(const struct ctl_path *path,void unregister_sysctl_table (struct ctl_table_header * table);extern int sysctl_init (void ); +extern void __register_sysctl_init (const char *path,struct ctl_table *table, +const char *table_name); +#define register_sysctl_init (path, table) __register_sysctl_init(path, table, #table)extern struct ctl_table sysctl_mount_point[];
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 115/134 panic: unset panic_on_warn inside panic()
In reply to Greg Kroah-HartmanFrom: Tiezhu Yang <[email protected]>
commit 1a2383e8b84c0451fd9b1eec3b9aab16f30b597c upstream.
In the current code, the following three places need to unset panic_on_warn before calling panic() to avoid recursive panics:
kernel/kcsan/report.c: print_report()kernel/sched/core.c: __schedule_bug()mm/kfence/report.c: kfence_report_error()
In order to avoid copy-pasting "panic_on_warn = 0" all over the places, it is better to move it inside panic() and then remove it from the other places.
--- kernel/panic.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-)
kernel/panic.c +11 -9
@@ -173,6 +173,16 @@ void panic(const char *fmt, ...)int old_cpu, this_cpu;bool _crash_kexec_post_notifiers = crash_kexec_post_notifiers; +if (panic_on_warn) { +/* +* This thread may hit another WARN() in the panic path. +* Resetting this prevents additional WARN() from panicking the +* system on this thread. Other threads are blocked by the +* panic_mutex in panic(). +*/ + panic_on_warn =0 ; + } +/* * Disable local interrupts. This will prevent panic_smp_self_stop * from deadlocking the first cpu that invokes the panic, since
@@ -571,16 +581,8 @@ void __warn(const char *file, int line, void *caller, unsigned taint,if (args)vprintk (args->fmt, args->args); -if (panic_on_warn) { -/* -* This thread may hit another WARN() in the panic path. -* Resetting this prevents additional WARN() from panicking the -* system on this thread. Other threads are blocked by the -* panic_mutex in panic(). -*/ - panic_on_warn =0 ; +if (panic_on_warn)panic ("panic_on_warn set ...\n" ); - }print_modules ();
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 116/134 mm: kasan: do not panic if both panic_on_warn and kasan_multishot set
In reply to Greg Kroah-HartmanFrom: David Gow <[email protected]>
commit be4f1ae978ffe98cc95ec49ceb95386fb4474974 upstream.
KASAN errors will currently trigger a panic when panic_on_warn is set. This renders kasan_multishot useless, as further KASAN errors won't be reported if the kernel has already paniced. By making kasan_multishot disable this behaviour for KASAN errors, we can still have the benefits of panic_on_warn for non-KASAN warnings, yet be able to use kasan_multishot.
This is particularly important when running KASAN tests, which need to trigger multiple KASAN errors: previously these would panic the system if panic_on_warn was set, now they can run (and will panic the system should non-KASAN warnings show up).
--- mm/kasan/report.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/kasan/report.c +1 -1
@@ -92,7 +92,7 @@ static void end_report(unsigned long *flags)pr_err ("==================================================================\n" );add_taint (TAINT_BAD_PAGE ,LOCKDEP_NOW_UNRELIABLE );spin_unlock_irqrestore (&report_lock, *flags); -if (panic_on_warn) +if (panic_on_warn && !test_bit (KASAN_BIT_MULTI_SHOT , &kasan_flags))panic ("panic_on_warn set ...\n" );kasan_enable_current (); }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 117/134 exit: Add and use make_task_dead.
In reply to Greg Kroah-HartmanFrom: Eric W. Biederman <[email protected]>
commit 0e25498f8cd43c1b5aa327f373dd094e9a006da7 upstream.
There are two big uses of do_exit. The first is it's design use to be the guts of the exit(2) system call. The second use is to terminate a task after something catastrophic has happened like a NULL pointer in kernel code.
Add a function make_task_dead that is initialy exactly the same as do_exit to cover the cases where do_exit is called to handle catastrophic failure. In time this can probably be reduced to just a light wrapper around do_task_dead. For now keep it exactly the same so that there will be no behavioral differences introducing this new concept.
Replace all of the uses of do_exit that use it for catastraphic task cleanup with make_task_dead to make it clear what the code is doing.
As part of this rename rewind_stack_do_exitrewind_stack_and_make_dead.
--- arch/alpha/kernel/traps.c | 6 +++--- arch/alpha/mm/fault.c | 2 +- arch/arm/kernel/traps.c | 2 +- arch/arm/mm/fault.c | 2 +- arch/arm64/kernel/traps.c | 2 +- arch/arm64/mm/fault.c | 2 +- arch/csky/abiv1/alignment.c | 2 +- arch/csky/kernel/traps.c | 2 +- arch/h8300/kernel/traps.c | 2 +- arch/h8300/mm/fault.c | 2 +- arch/hexagon/kernel/traps.c | 2 +- arch/ia64/kernel/mca_drv.c | 2 +- arch/ia64/kernel/traps.c | 2 +- arch/ia64/mm/fault.c | 2 +- arch/m68k/kernel/traps.c | 2 +- arch/m68k/mm/fault.c | 2 +- arch/microblaze/kernel/exceptions.c | 4 ++-- arch/mips/kernel/traps.c | 2 +- arch/nds32/kernel/fpu.c | 2 +- arch/nds32/kernel/traps.c | 8 ++++---- arch/nios2/kernel/traps.c | 4 ++-- arch/openrisc/kernel/traps.c | 2 +- arch/parisc/kernel/traps.c | 2 +- arch/powerpc/kernel/traps.c | 2 +- arch/riscv/kernel/traps.c | 2 +- arch/riscv/mm/fault.c | 2 +- arch/s390/kernel/dumpstack.c | 2 +- arch/s390/kernel/nmi.c | 2 +- arch/sh/kernel/traps.c | 2 +- arch/sparc/kernel/traps_32.c | 4 +--- arch/sparc/kernel/traps_64.c | 4 +--- arch/x86/entry/entry_32.S | 6 +++--- arch/x86/entry/entry_64.S | 6 +++--- arch/x86/kernel/dumpstack.c | 4 ++-- arch/xtensa/kernel/traps.c | 2 +- include/linux/sched/task.h | 1 + kernel/exit.c | 9 +++++++++ tools/objtool/check.c | 3 ++- 38 files changed, 59 insertions(+), 52 deletions(-)
arch/alpha/kernel/traps.c +3 -3
@@ -192,7 +192,7 @@ die_if_kernel(char * str, struct pt_regs *regs, long err, unsigned long *r9_15)local_irq_enable ();while (1 ); } -do_exit (SIGSEGV ); +make_task_dead (SIGSEGV ); }#ifndef CONFIG_MATHEMU
@@ -577,7 +577,7 @@ do_entUna(void * va, unsigned long opcode, unsigned long reg,printk ("Bad unaligned kernel access at %016lx: %p %lx %lu\n" , pc, va, opcode, reg); -do_exit (SIGSEGV ); +make_task_dead (SIGSEGV ); got_exception:/* Ok, we caught the exception, but we don't want it. Is there
@@ -632,7 +632,7 @@ do_entUna(void * va, unsigned long opcode, unsigned long reg,local_irq_enable ();while (1 ); } -do_exit (SIGSEGV ); +make_task_dead (SIGSEGV ); }/*
arch/alpha/mm/fault.c +1 -1
@@ -206,7 +206,7 @@ do_page_fault(unsigned long address, unsigned long mmcsr,printk (KERN_ALERT "Unable to handle kernel paging request at " "virtual address %016lx\n" , address);die_if_kernel ("Oops" , regs, cause, (unsigned long *)regs -16 ); -do_exit (SIGKILL ); +make_task_dead (SIGKILL );/* We ran out of memory, or some other thing happened to us that made us unable to handle the page fault gracefully. */
arch/arm/kernel/traps.c +1 -1
@@ -341,7 +341,7 @@ static void oops_end(unsigned long flags, struct pt_regs *regs, int signr)if (panic_on_oops)panic ("Fatal exception" );if (signr) -do_exit (signr); +make_task_dead (signr); }/*
arch/arm/mm/fault.c +1 -1
@@ -124,7 +124,7 @@ __do_kernel_fault(struct mm_struct *mm, unsigned long addr, unsigned int fsr,show_pte (KERN_ALERT , mm, addr);die ("Oops" , regs, fsr);bust_spinlocks (0 ); -do_exit (SIGKILL ); +make_task_dead (SIGKILL ); }/*
arch/arm64/kernel/traps.c +1 -1
@@ -202,7 +202,7 @@ void die(const char *str, struct pt_regs *regs, int err)raw_spin_unlock_irqrestore (&die_lock, flags);if (ret !=NOTIFY_STOP ) -do_exit (SIGSEGV ); +make_task_dead (SIGSEGV ); }static void arm64_show_signal (int signo,const char *str)
arch/arm64/mm/fault.c +1 -1
@@ -296,7 +296,7 @@ static void die_kernel_fault(const char *msg, unsigned long addr,show_pte (addr);die ("Oops" , regs, esr);bust_spinlocks (0 ); -do_exit (SIGKILL ); +make_task_dead (SIGKILL ); } static void __do_kernel_fault(unsigned long addr, unsigned int esr,
arch/csky/abiv1/alignment.c +1 -1
@@ -294,7 +294,7 @@ void csky_alignment(struct pt_regs *regs) __func__, opcode, rz, rx, imm, addr);show_regs (regs);bust_spinlocks (0 ); -do_exit (SIGKILL ); +make_dead_task (SIGKILL ); }force_sig_fault (SIGBUS ,BUS_ADRALN , (void __user *)addr);
arch/csky/kernel/traps.c +1 -1
@@ -85,7 +85,7 @@ void die_if_kernel(char *str, struct pt_regs *regs, int nr)pr_err ("%s: %08x\n" , str, nr);show_regs (regs);add_taint (TAINT_DIE ,LOCKDEP_NOW_UNRELIABLE ); -do_exit (SIGSEGV ); +make_dead_task (SIGSEGV ); }void buserr (struct pt_regs *regs)
arch/h8300/kernel/traps.c +1 -1
@@ -110,7 +110,7 @@ void die(const char *str, struct pt_regs *fp, unsigned long err)dump (fp);spin_unlock_irq (&die_lock); -do_exit (SIGSEGV ); +make_dead_task (SIGSEGV ); }static int kstack_depth_to_print =24 ;
arch/h8300/mm/fault.c +1 -1
@@ -52,7 +52,7 @@ asmlinkage int do_page_fault(struct pt_regs *regs, unsigned long address,printk (" at virtual address %08lx\n" , address);if (!user_mode (regs))die ("Oops" , regs, error_code); -do_exit (SIGKILL ); +make_dead_task (SIGKILL );return 1 ; }
arch/hexagon/kernel/traps.c +1 -1
@@ -221,7 +221,7 @@ int die(const char *str, struct pt_regs *regs, long err)panic ("Fatal exception" );oops_exit (); -do_exit (err); +make_dead_task (err);return 0 ; }
arch/ia64/kernel/mca_drv.c +1 -1
@@ -176,7 +176,7 @@ mca_handler_bh(unsigned long paddr, void *iip, unsigned long ipsr)spin_unlock (&mca_bh_lock);/* This process is about to be killed itself */ -do_exit (SIGKILL ); +make_task_dead (SIGKILL ); }/**
arch/ia64/kernel/traps.c +1 -1
@@ -85,7 +85,7 @@ die (const char *str, struct pt_regs *regs, long err)if (panic_on_oops)panic ("Fatal exception" ); -do_exit (SIGSEGV ); +make_task_dead (SIGSEGV );return 0 ; }
arch/ia64/mm/fault.c +1 -1
@@ -272,7 +272,7 @@ ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *re regs =NULL ;bust_spinlocks (0 );if (regs) -do_exit (SIGKILL ); +make_task_dead (SIGKILL );return ; out_of_memory:
arch/m68k/kernel/traps.c +1 -1
@@ -1139,7 +1139,7 @@ void die_if_kernel (char *str, struct pt_regs *fp, int nr)pr_crit ("%s: %08x\n" , str, nr);show_registers (fp);add_taint (TAINT_DIE ,LOCKDEP_NOW_UNRELIABLE ); -do_exit (SIGSEGV ); +make_task_dead (SIGSEGV ); } asmlinkage void set_esp0(unsigned long ssp)
arch/m68k/mm/fault.c +1 -1
@@ -48,7 +48,7 @@ int send_fault_sig(struct pt_regs *regs)pr_alert ("Unable to handle kernel access" );pr_cont (" at virtual address %p\n" , addr);die_if_kernel ("Oops" , regs,0 /*error_code*/ ); -do_exit (SIGKILL ); +make_task_dead (SIGKILL ); }return 1 ;
arch/microblaze/kernel/exceptions.c +2 -2
@@ -44,10 +44,10 @@ void die(const char *str, struct pt_regs *fp, long err)pr_warn ("Oops: %s, sig: %ld\n" , str, err);show_regs (fp);spin_unlock_irq (&die_lock); -/* do_exit() should take care of panic'ing from an interrupt +/* make_task_dead() should take care of panic'ing from an interrupt * context so we don't handle it here */ -do_exit (err); +make_task_dead (err); }/* for user application debugging */
arch/mips/kernel/traps.c +1 -1
@@ -415,7 +415,7 @@ void __noreturn die(const char *str, struct pt_regs *regs)if (regs &&kexec_should_crash (current))crash_kexec (regs); -do_exit (sig); +make_task_dead (sig); }extern struct exception_table_entry __start___dbe_table[];
arch/nds32/kernel/fpu.c +1 -1
@@ -223,7 +223,7 @@ inline void handle_fpu_exception(struct pt_regs *regs) } }else if (fpcsr & FPCSR_mskRIT) {if (!user_mode (regs)) -do_exit (SIGILL ); +make_task_dead (SIGILL ); si_signo =SIGILL ; }
arch/nds32/kernel/traps.c +4 -4
@@ -184,7 +184,7 @@ void die(const char *str, struct pt_regs *regs, int err)bust_spinlocks (0 );spin_unlock_irq (&die_lock); -do_exit (SIGSEGV ); +make_task_dead (SIGSEGV ); }EXPORT_SYMBOL (die);
@@ -288,7 +288,7 @@ void unhandled_interruption(struct pt_regs *regs)pr_emerg ("unhandled_interruption\n" );show_regs (regs);if (!user_mode (regs)) -do_exit (SIGKILL ); +make_task_dead (SIGKILL );force_sig (SIGKILL ); }
@@ -299,7 +299,7 @@ void unhandled_exceptions(unsigned long entry, unsigned long addr, addr, type);show_regs (regs);if (!user_mode (regs)) -do_exit (SIGKILL ); +make_task_dead (SIGKILL );force_sig (SIGKILL ); }
@@ -326,7 +326,7 @@ void do_revinsn(struct pt_regs *regs)pr_emerg ("Reserved Instruction\n" );show_regs (regs);if (!user_mode (regs)) -do_exit (SIGILL ); +make_task_dead (SIGILL );force_sig (SIGILL ); }
arch/nios2/kernel/traps.c +2 -2
@@ -37,10 +37,10 @@ void die(const char *str, struct pt_regs *regs, long err)show_regs (regs);spin_unlock_irq (&die_lock);/* -* do_exit() should take care of panic'ing from an interrupt +* make_task_dead() should take care of panic'ing from an interrupt * context so we don't handle it here */ -do_exit (err); +make_task_dead (err); }void _exception (int signo,struct pt_regs *regs,int code,unsigned long addr)
arch/openrisc/kernel/traps.c +1 -1
@@ -218,7 +218,7 @@ void die(const char *str, struct pt_regs *regs, long err) __asm__ __volatile__("l.nop 1" );do {}while (1 );#endif -do_exit (SIGSEGV ); +make_task_dead (SIGSEGV ); }/* This is normally the 'Oops' routine */
arch/parisc/kernel/traps.c +1 -1
@@ -268,7 +268,7 @@ void die_if_kernel(char *str, struct pt_regs *regs, long err)panic ("Fatal exception" );oops_exit (); -do_exit (SIGSEGV ); +make_task_dead (SIGSEGV ); }/* gdb uses break 4,8 */
arch/powerpc/kernel/traps.c +1 -1
@@ -246,7 +246,7 @@ static void oops_end(unsigned long flags, struct pt_regs *regs,if (panic_on_oops)panic ("Fatal exception" ); -do_exit (signr); +make_task_dead (signr); }NOKPROBE_SYMBOL (oops_end);
arch/riscv/kernel/traps.c +1 -1
@@ -57,7 +57,7 @@ void die(struct pt_regs *regs, const char *str)if (panic_on_oops)panic ("Fatal exception" );if (ret !=NOTIFY_STOP ) -do_exit (SIGSEGV ); +make_task_dead (SIGSEGV ); }void do_trap (struct pt_regs *regs,int signo,int code,unsigned long addr)
arch/riscv/mm/fault.c +1 -1
@@ -189,7 +189,7 @@ asmlinkage void do_page_fault(struct pt_regs *regs) (addr <PAGE_SIZE ) ?"NULL pointer dereference" : "paging request", addr);die (regs,"Oops" ); -do_exit (SIGKILL ); +make_task_dead (SIGKILL );/* * We ran out of memory, call the OOM killer, and return the userspace
arch/s390/kernel/dumpstack.c +1 -1
@@ -210,5 +210,5 @@ void die(struct pt_regs *regs, const char *str)if (panic_on_oops)panic ("Fatal exception: panic_on_oops" );oops_exit (); -do_exit (SIGSEGV ); +make_task_dead (SIGSEGV ); }
arch/s390/kernel/nmi.c +1 -1
@@ -179,7 +179,7 @@ void s390_handle_mcck(void) "malfunction (code 0x%016lx).\n", mcck.mcck_code);printk (KERN_EMERG "mcck: task: %s, pid: %d.\n" , current->comm, current->pid); -do_exit (SIGSEGV ); +make_task_dead (SIGSEGV ); } }EXPORT_SYMBOL_GPL (s390_handle_mcck);
arch/sh/kernel/traps.c +1 -1
@@ -57,7 +57,7 @@ void die(const char *str, struct pt_regs *regs, long err)if (panic_on_oops)panic ("Fatal exception" ); -do_exit (SIGSEGV ); +make_task_dead (SIGSEGV ); }void die_if_kernel (const char *str,struct pt_regs *regs,long err)
arch/sparc/kernel/traps_32.c +1 -3
@@ -86,9 +86,7 @@ void __noreturn die_if_kernel(char *str, struct pt_regs *regs) }printk ("Instruction DUMP:" );instruction_dump ((unsigned long *) regs->pc); -if (regs->psr &PSR_PS ) -do_exit (SIGKILL ); -do_exit (SIGSEGV ); +make_task_dead ((regs->psr &PSR_PS ) ?SIGKILL :SIGSEGV ); }void do_hw_interrupt (struct pt_regs *regs,unsigned long type)
arch/sparc/kernel/traps_64.c +1 -3
@@ -2564,9 +2564,7 @@ void __noreturn die_if_kernel(char *str, struct pt_regs *regs) }if (panic_on_oops)panic ("Fatal exception" ); -if (regs->tstate &TSTATE_PRIV ) -do_exit (SIGKILL ); -do_exit (SIGSEGV ); +make_task_dead ((regs->tstate &TSTATE_PRIV )?SIGKILL :SIGSEGV ); }EXPORT_SYMBOL (die_if_kernel);
arch/x86/entry/entry_32.S +3 -3
@@ -1659,13 +1659,13 @@ ENTRY(async_page_fault) END(async_page_fault) #endif -ENTRY(rewind_stack_do_exit) +ENTRY(rewind_stack_and_make_dead) /* Prevent any naive code from trying to unwind to our caller. */ xorl %ebp, %ebp movl PER_CPU_VAR(cpu_current_top_of_stack), %esi leal -TOP_OF_KERNEL_STACK_PADDING-PTREGS_SIZE(%esi), %esp - call do_exit + call make_task_dead 1: jmp 1b -END(rewind_stack_do_exit) +END(rewind_stack_and_make_dead)
arch/x86/entry/entry_64.S +3 -3
@@ -1757,7 +1757,7 @@ ENTRY(ignore_sysret) END(ignore_sysret) #endif -ENTRY(rewind_stack_do_exit) +ENTRY(rewind_stack_and_make_dead) UNWIND_HINT_FUNC /* Prevent any naive code from trying to unwind to our caller. */ xorl %ebp, %ebp
@@ -1766,5 +1766,5 @@ ENTRY(rewind_stack_do_exit) leaq -PTREGS_SIZE(%rax), %rsp UNWIND_HINT_REGS - call do_exit -END(rewind_stack_do_exit) + call make_task_dead +END(rewind_stack_and_make_dead)
arch/x86/kernel/dumpstack.c +2 -2
@@ -326,7 +326,7 @@ unsigned long oops_begin(void) }NOKPROBE_SYMBOL (oops_begin); -void __noreturn rewind_stack_do_exit (int signr); +void __noreturn rewind_stack_and_make_dead (int signr);void oops_end (unsigned long flags,struct pt_regs *regs,int signr) {
@@ -361,7 +361,7 @@ void oops_end(unsigned long flags, struct pt_regs *regs, int signr)* reuse the task stack and that existing poisons are invalid. */ kasan_unpoison_task_stack (current); -rewind_stack_do_exit (signr); +rewind_stack_and_make_dead (signr); }NOKPROBE_SYMBOL (oops_end);
arch/xtensa/kernel/traps.c +1 -1
@@ -543,5 +543,5 @@ void die(const char * str, struct pt_regs * regs, long err)if (panic_on_oops)panic ("Fatal exception" ); -do_exit (err); +make_task_dead (err); }
include/linux/sched/task.h +1 -0
@@ -51,6 +51,7 @@ extern int sched_fork(unsigned long clone_flags, struct task_struct *p);extern void sched_dead (struct task_struct *p);void __noreturn do_task_dead (void ); +void __noreturn make_task_dead (int signr);extern void proc_caches_init (void );
kernel/exit.c +9 -0
@@ -864,6 +864,15 @@ void __noreturn do_exit(long code) }EXPORT_SYMBOL_GPL (do_exit); +void __noreturn make_task_dead (int signr) +{ +/* +* Take the task off the cpu after something catastrophic has +* happened. +*/ +do_exit (signr); +} +void complete_and_exit (struct completion *comp,long code) {if (comp)
tools/objtool/check.c +2 -1
@@ -136,6 +136,7 @@ static bool __dead_end_function(struct objtool_file *file, struct symbol *func,"panic" ,"do_exit" ,"do_task_dead" , +"make_task_dead" ,"__module_put_and_exit" ,"complete_and_exit" , "__reiserfs_panic",
@@ -143,7 +144,7 @@ static bool __dead_end_function(struct objtool_file *file, struct symbol *func,"fortify_panic" ,"usercopy_abort" ,"machine_real_restart" , -"rewind_stack_do_exit" , +"rewind_stack_and_make_dead" "cpu_bringup_and_idle", };
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 118/134 objtool: Add a missing comma to avoid string concatenation
In reply to Greg Kroah-HartmanFrom: Eric W. Biederman <[email protected]>
commit 1fb466dff904e4a72282af336f2c355f011eec61 upstream.
Recently the kbuild robot reported two new errors:
Quoted 2 lines
Quoted 2 lines
lib/kunit/kunit-example-test.o: warning: objtool: .text.unlikely: unexpected end of sectionarch/x86/kernel/dumpstack.o: warning: objtool:oops_end()falls through to next functionshow_opcodes()
I don't know why they did not occur in my test setup but after digging it I realized I had accidentally dropped a comma in tools/objtool/check.c when I renamed rewind_stack_do_exit to rewind_stack_and_make_dead.
Add that comma back to fix objtool errors.
--- tools/objtool/check.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/objtool/check.c +1 -1
@@ -144,7 +144,7 @@ static bool __dead_end_function(struct objtool_file *file, struct symbol *func,"fortify_panic" ,"usercopy_abort" ,"machine_real_restart" , -"rewind_stack_and_make_dead" +"rewind_stack_and_make_dead" , "cpu_bringup_and_idle", };
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 119/134 hexagon: Fix function name in die()
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit 4f0712ccec09c071e221242a2db9a6779a55a949 upstream.
When building ARCH=hexagon defconfig:
arch/hexagon/kernel/traps.c:217:2: error: implicit declaration of function 'make_dead_task' [-Werror,-Wimplicit-function-declaration]
make_dead_task(err);
^The function's name is make_task_dead(), change it so there is no more build error.
--- arch/hexagon/kernel/traps.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/hexagon/kernel/traps.c +1 -1
@@ -221,7 +221,7 @@ int die(const char *str, struct pt_regs *regs, long err)panic ("Fatal exception" );oops_exit (); -make_dead_task (err); +make_task_dead (err);return 0 ; }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 120/134 h8300: Fix build errors from do_exit() to make_task_dead() transition
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit ab4ababdf77ccc56c7301c751dff49c79709c51c upstream.
When building ARCH=h8300 defconfig:
arch/h8300/kernel/traps.c: In function 'die':arch/h8300/kernel/traps.c:109:2: error: implicit declaration of function 'make_dead_task' [-Werror=implicit-function-declaration]
109 | make_dead_task(SIGSEGV);
| ^~~~~~~~~~~~~~arch/h8300/mm/fault.c: In function 'do_page_fault':arch/h8300/mm/fault.c:54:2: error: implicit declaration of function 'make_dead_task' [-Werror=implicit-function-declaration]
54 | make_dead_task(SIGKILL);
| ^~~~~~~~~~~~~~The function's name is make_task_dead(), change it so there is no more build error.
Additionally, include linux/sched/task.h in arch/h8300/kernel/traps.c to avoid the same error because do_exit()'s declaration is in kernel.h but make_task_dead()'s is in task.h, which is not included in traps.c.
--- arch/h8300/kernel/traps.c | 3 ++- arch/h8300/mm/fault.c | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-)
arch/h8300/kernel/traps.c +2 -1
@@ -17,6 +17,7 @@#include <linux/types.h> #include <linux/sched.h> #include <linux/sched/debug.h> +#include <linux/sched/task.h> #include <linux/mm_types.h> #include <linux/kernel.h> #include <linux/errno.h>
@@ -110,7 +111,7 @@ void die(const char *str, struct pt_regs *fp, unsigned long err)dump (fp);spin_unlock_irq (&die_lock); -make_dead_task (SIGSEGV ); +make_task_dead (SIGSEGV ); }static int kstack_depth_to_print =24 ;
arch/h8300/mm/fault.c +1 -1
@@ -52,7 +52,7 @@ asmlinkage int do_page_fault(struct pt_regs *regs, unsigned long address,printk (" at virtual address %08lx\n" , address);if (!user_mode (regs))die ("Oops" , regs, error_code); -make_dead_task (SIGKILL ); +make_task_dead (SIGKILL );return 1 ; }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 121/134 csky: Fix function name in csky_alignment() and die()
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit 751971af2e3615dc5bd12674080bc795505fefeb upstream.
When building ARCH=csky defconfig:
arch/csky/kernel/traps.c: In function 'die':arch/csky/kernel/traps.c:112:17: error: implicit declaration of function 'make_dead_task' [-Werror=implicit-function-declaration]
112 | make_dead_task(SIGSEGV);
| ^~~~~~~~~~~~~~The function's name is make_task_dead(), change it so there is no more build error.
--- arch/csky/abiv1/alignment.c | 2 +- arch/csky/kernel/traps.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/csky/abiv1/alignment.c +1 -1
@@ -294,7 +294,7 @@ void csky_alignment(struct pt_regs *regs) __func__, opcode, rz, rx, imm, addr);show_regs (regs);bust_spinlocks (0 ); -make_dead_task (SIGKILL ); +make_task_dead (SIGKILL ); }force_sig_fault (SIGBUS ,BUS_ADRALN , (void __user *)addr);
arch/csky/kernel/traps.c +1 -1
@@ -85,7 +85,7 @@ void die_if_kernel(char *str, struct pt_regs *regs, int nr)pr_err ("%s: %08x\n" , str, nr);show_regs (regs);add_taint (TAINT_DIE ,LOCKDEP_NOW_UNRELIABLE ); -make_dead_task (SIGSEGV ); +make_task_dead (SIGSEGV ); }void buserr (struct pt_regs *regs)
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 122/134 ia64: make IA64_MCA_RECOVERY bool instead of tristate
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
commit dbecf9b8b8ce580f4e11afed9d61e8aa294cddd2 upstream.
In linux-next, IA64_MCA_RECOVERY uses the (new) function make_task_dead(), which is not exported for use by modules. Instead of exporting it for one user, convert IA64_MCA_RECOVERY to be a bool Kconfig symbol.
In a config file from "kernel test robot <[email protected]>" for a different problem, this linker error was exposed when CONFIG_IA64_MCA_RECOVERY=m.
Fixes this build error:
ERROR: modpost: "make_task_dead" [arch/ia64/kernel/mca_recovery.ko] undefined!
--- arch/ia64/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/ia64/Kconfig +1 -1
@@ -360,7 +360,7 @@ config ARCH_PROC_KCORE_TEXT depends on PROC_KCORE config IA64_MCA_RECOVERY - tristate "MCA recovery from errors other than TLB." + bool "MCA recovery from errors other than TLB." config PERFMON bool "Performance monitor support"
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 123/134 exit: Put an upper limit on how often we can oops
In reply to Greg Kroah-HartmanFrom: Jann Horn <[email protected]>
commit d4ccd54d28d3c8598e2354acc13e28c060961dbb upstream.
Many Linux systems are configured to not panic on oops; but allowing an attacker to oops the system **really** often can make even bugs that look completely unexploitable exploitable (like NULL dereferences and such) if each crash elevates a refcount by one or a lock is taken in read mode, and this causes a counter to eventually overflow.
The most interesting counters for this are 32 bits wide (like open-coded refcounts that don't use refcount_t). (The ldsem reader count on 32-bit platforms is just 16 bits, but probably nobody cares about 32-bit platforms that much nowadays.)
So let's panic the system if the kernel is constantly oopsing.
The speed of oopsing 2^32 times probably depends on several factors, like how long the stack trace is and which unwinder you're using; an empirically important one is whether your console is showing a graphical environment or a text console that oopses will be printed to.
In a quick single-threaded benchmark, it looks like oopsing in a vfork() child with a very short stack trace only takes ~510 microseconds per run when a graphical console is active; but switching to a text console that oopses are printed to slows it down around 87x, to ~45 milliseconds per run.
(Adding more threads makes this faster, but the actual oops printing happens under &die_lock on x86, so you can maybe speed this up by a factor of around 2 and then any further improvement gets eaten up by lock contention.)
It looks like it would take around 8-12 days to overflow a 32-bit counter with repeated oopsing on a multi-core X86 system running a graphical environment; both me (in an X86 VM) and Seth (with a distro kernel on normal hardware in a standard configuration) got numbers in that ballpark.
12 days aren't *that* short on a desktop system, and you'd likely need much longer on a typical server system (assuming that people don't run graphical desktop environments on their servers), and this is a *very* noisy and violent approach to exploiting the kernel; and it also seems to take orders of magnitude longer on some machines, probably because stuff like EFI pstore will slow it down a ton if that's active.
--- Documentation/admin-guide/sysctl/kernel.rst | 8 ++++ kernel/exit.c | 43 +++++++++++++++++++++ 2 files changed, 51 insertions(+)
Documentation/admin-guide/sysctl/kernel.rst +8 -0
@@ -557,6 +557,14 @@ numa_balancing_scan_size_mb is how many megabytes worth of pages are scanned for a given scan. +oops_limit +========== + +Number of kernel oopses after which the kernel should panic when +``panic_on_oops`` is not set. Setting this to 0 or 1 has the same effect +as setting ``panic_on_oops=1``. + + osrelease, ostype & version: ============================
kernel/exit.c +43 -0
59 lines not on this page · raw message
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 124/134 exit: Expose "oops_count" to sysfs
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
commit 9db89b41117024f80b38b15954017fb293133364 upstream.
Since Oops count is now tracked and is a fairly interesting signal, add the entry /sys/kernel/oops_count to expose it to userspace.
--- .../ABI/testing/sysfs-kernel-oops_count | 6 +++++ kernel/exit.c | 22 +++++++++++++++++-- 2 files changed, 26 insertions(+), 2 deletions(-) create mode 100644 Documentation/ABI/testing/sysfs-kernel-oops_count
Documentation/ABI/testing/sysfs-kernel-oops_count new file +6 -0
@@ -0,0 +1,6 @@ +What: /sys/kernel/oops_count +Date: November 2022 +KernelVersion: 6.2.0 +Contact: Linux Kernel Hardening List <[email protected]> +Description: + Shows how many times the system has Oopsed since last boot.
kernel/exit.c +20 -2
@@ -63,6 +63,7 @@#include <linux/random.h> #include <linux/rcuwait.h> #include <linux/compat.h> +#include <linux/sysfs.h> #include <linux/uaccess.h> #include <asm/unistd.h>
@@ -96,6 +97,25 @@ static __init int kernel_exit_sysctls_init(void)late_initcall (kernel_exit_sysctls_init);#endif +static atomic_t oops_count =ATOMIC_INIT (0 ); + +#ifdef CONFIG_SYSFS +static ssize_t oops_count_show (struct kobject *kobj,struct kobj_attribute *attr, +char *page) +{ +return sysfs_emit (page,"%d\n" ,atomic_read (&oops_count)); +} + +static struct kobj_attribute oops_count_attr =__ATTR_RO (oops_count); + +static __init int kernel_exit_sysfs_init (void ) +{ +sysfs_add_file_to_group (kernel_kobj, &oops_count_attr.attr,NULL ); +return 0 ; +} +late_initcall (kernel_exit_sysfs_init); +#endif +static void __unhash_process (struct task_struct *p,bool group_dead) { nr_threads--;
@@ -893,8 +913,6 @@ EXPORT_SYMBOL_GPL(do_exit);void __noreturn make_task_dead (int signr) { -static atomic_t oops_count =ATOMIC_INIT (0 ); -/* * Take the task off the cpu after something catastrophic has * happened.
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 125/134 exit: Allow oops_limit to be disabled
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
commit de92f65719cd672f4b48397540b9f9eff67eca40 upstream.
In preparation for keeping oops_limit logic in sync with warn_limit, have oops_limit == 0 disable checking the Oops counter.
--- Documentation/admin-guide/sysctl/kernel.rst | 5 +++-- kernel/exit.c | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-)
Documentation/admin-guide/sysctl/kernel.rst +3 -2
@@ -561,8 +561,9 @@ oops_limit ========== Number of kernel oopses after which the kernel should panic when -``panic_on_oops`` is not set. Setting this to 0 or 1 has the same effect -as setting ``panic_on_oops=1``. +``panic_on_oops`` is not set. Setting this to 0 disables checking +the count. Setting this to 1 has the same effect as setting +``panic_on_oops=1``. The default value is 10000. osrelease, ostype & version:
kernel/exit.c +1 -1
@@ -928,7 +928,7 @@ void __noreturn make_task_dead(int signr)* To make sure this can't happen, place an upper bound on how often the * kernel may oops without panic(). */ -if (atomic_inc_return (&oops_count) >=READ_ONCE (oops_limit)) +if (atomic_inc_return (&oops_count) >=READ_ONCE (oops_limit) && oops_limit)panic ("Oopsed too often (kernel.oops_limit is %d)" , oops_limit);do_exit (signr);
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 126/134 panic: Consolidate open-coded panic_on_warn checks
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
commit 79cc1ba7badf9e7a12af99695a557e9ce27ee967 upstream.
Several run-time checkers (KASAN, UBSAN, KFENCE, KCSAN, sched) roll their own warnings, and each check "panic_on_warn". Consolidate this into a single function so that future instrumentation can be added in a single location.
--- include/linux/kernel.h | 1 + kernel/panic.c | 9 +++++++-- kernel/sched/core.c | 3 +-- mm/kasan/report.c | 4 ++-- 4 files changed, 11 insertions(+), 6 deletions(-)
include/linux/kernel.h +1 -0
@@ -321,6 +321,7 @@ extern long (*panic_blink)(int state); __printf(1, 2)void panic (const char *fmt, ...)__noreturn __cold ;void nmi_panic (struct pt_regs *regs,const char *msg); +void check_panic_on_warn (const char *origin);extern void oops_enter (void );extern void oops_exit (void );void print_oops_end_marker (void );
kernel/panic.c +7 -2
@@ -156,6 +156,12 @@ static void panic_print_sys_info(void)ftrace_dump (DUMP_ALL ); } +void check_panic_on_warn (const char *origin) +{ +if (panic_on_warn) +panic ("%s: panic_on_warn set ...\n" , origin); +} +/** * panic - halt the system * @fmt: The text string to print
@@ -581,8 +587,7 @@ void __warn(const char *file, int line, void *caller, unsigned taint,if (args)vprintk (args->fmt, args->args); -if (panic_on_warn) -panic ("panic_on_warn set ...\n" ); +check_panic_on_warn ("kernel" );print_modules ();
kernel/sched/core.c +1 -2
@@ -3964,8 +3964,7 @@ static noinline void __schedule_bug(struct task_struct *prev)print_ip_sym (preempt_disable_ip);pr_cont ("\n" ); } -if (panic_on_warn) -panic ("scheduling while atomic\n" ); +check_panic_on_warn ("scheduling while atomic" );dump_stack ();add_taint (TAINT_WARN ,LOCKDEP_STILL_OK );
mm/kasan/report.c +2 -2
@@ -92,8 +92,8 @@ static void end_report(unsigned long *flags)pr_err ("==================================================================\n" );add_taint (TAINT_BAD_PAGE ,LOCKDEP_NOW_UNRELIABLE );spin_unlock_irqrestore (&report_lock, *flags); -if (panic_on_warn && !test_bit (KASAN_BIT_MULTI_SHOT , &kasan_flags)) -panic ("panic_on_warn set ...\n" ); +if (!test_bit (KASAN_BIT_MULTI_SHOT , &kasan_flags)) +check_panic_on_warn ("KASAN" );kasan_enable_current (); }
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 127/134 panic: Introduce warn_limit
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
commit 9fc9e278a5c0b708eeffaf47d6eb0c82aa74ed78 upstream.
Like oops_limit, add warn_limit for limiting the number of warnings when panic_on_warn is not set.
--- Documentation/admin-guide/sysctl/kernel.rst | 10 ++++++++ kernel/panic.c | 27 +++++++++++++++++++++ 2 files changed, 37 insertions(+)
Documentation/admin-guide/sysctl/kernel.rst +10 -0
@@ -1186,6 +1186,16 @@ entry will default to 2 instead of 0. 2 Unprivileged calls to ``bpf()`` are disabled = ============================================================= + +warn_limit +========== + +Number of kernel warnings after which the kernel should panic when +``panic_on_warn`` is not set. Setting this to 0 disables checking +the warning count. Setting this to 1 has the same effect as setting +``panic_on_warn=1``. The default value is 0. + + watchdog: =========
kernel/panic.c +27 -0
@@ -44,6 +44,7 @@ static int pause_on_oops_flag;static DEFINE_SPINLOCK (pause_on_oops_lock);bool crash_kexec_post_notifiers;int panic_on_warn__read_mostly ; +static unsigned int warn_limit__read_mostly ;int panic_timeout =CONFIG_PANIC_TIMEOUT ;EXPORT_SYMBOL_GPL (panic_timeout);
@@ -60,6 +61,26 @@ ATOMIC_NOTIFIER_HEAD(panic_notifier_list);EXPORT_SYMBOL (panic_notifier_list); +#ifdef CONFIG_SYSCTL +static struct ctl_table kern_panic_table[] = { + { + .procname ="warn_limit" , + .data = &warn_limit, + .maxlen =sizeof (warn_limit), + .mode =0644 , + .proc_handler = proc_douintvec, + }, + { } +}; + +static __init int kernel_panic_sysctls_init (void ) +{ +register_sysctl_init ("kernel" , kern_panic_table); +return 0 ; +} +late_initcall (kernel_panic_sysctls_init); +#endif +static long no_blink (int state) {return 0 ;
@@ -158,8 +179,14 @@ static void panic_print_sys_info(void)void check_panic_on_warn (const char *origin) { +static atomic_t warn_count =ATOMIC_INIT (0 ); +if (panic_on_warn)panic ("%s: panic_on_warn set ...\n" , origin); + +if (atomic_inc_return (&warn_count) >=READ_ONCE (warn_limit) && warn_limit) +panic ("%s: system warned too often (kernel.warn_limit is %d)" , + origin, warn_limit); }/**
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 128/134 panic: Expose "warn_count" to sysfs
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
commit 8b05aa26336113c4cea25f1c333ee8cd4fc212a6 upstream.
Since Warn count is now tracked and is a fairly interesting signal, add the entry /sys/kernel/warn_count to expose it to userspace.
--- .../ABI/testing/sysfs-kernel-warn_count | 6 +++++ kernel/panic.c | 22 +++++++++++++++++-- 2 files changed, 26 insertions(+), 2 deletions(-) create mode 100644 Documentation/ABI/testing/sysfs-kernel-warn_count
Documentation/ABI/testing/sysfs-kernel-warn_count new file +6 -0
@@ -0,0 +1,6 @@ +What: /sys/kernel/oops_count +Date: November 2022 +KernelVersion: 6.2.0 +Contact: Linux Kernel Hardening List <[email protected]> +Description: + Shows how many times the system has Warned since last boot.
kernel/panic.c +20 -2
@@ -31,6 +31,7 @@#include <linux/bug.h> #include <linux/ratelimit.h> #include <linux/debugfs.h> +#include <linux/sysfs.h> #include <asm/sections.h> #define PANIC_TIMER_STEP 100
@@ -81,6 +82,25 @@ static __init int kernel_panic_sysctls_init(void)late_initcall (kernel_panic_sysctls_init);#endif +static atomic_t warn_count =ATOMIC_INIT (0 ); + +#ifdef CONFIG_SYSFS +static ssize_t warn_count_show (struct kobject *kobj,struct kobj_attribute *attr, +char *page) +{ +return sysfs_emit (page,"%d\n" ,atomic_read (&warn_count)); +} + +static struct kobj_attribute warn_count_attr =__ATTR_RO (warn_count); + +static __init int kernel_panic_sysfs_init (void ) +{ +sysfs_add_file_to_group (kernel_kobj, &warn_count_attr.attr,NULL ); +return 0 ; +} +late_initcall (kernel_panic_sysfs_init); +#endif +static long no_blink (int state) {return 0 ;
@@ -179,8 +199,6 @@ static void panic_print_sys_info(void)void check_panic_on_warn (const char *origin) { -static atomic_t warn_count =ATOMIC_INIT (0 ); -if (panic_on_warn)panic ("%s: panic_on_warn set ...\n" , origin);
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 129/134 docs: Fix path paste-o for /sys/kernel/warn_count
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
commit 00dd027f721e0458418f7750d8a5a664ed3e5994 upstream.
Running "make htmldocs" shows that "/sys/kernel/oops_count" was duplicated. This should have been "warn_count":
Warning: /sys/kernel/oops_count is defined 2 times:
./Documentation/ABI/testing/sysfs-kernel-warn_count:0 ./Documentation/ABI/testing/sysfs-kernel-oops_count:0
Fix the typo.
--- Documentation/ABI/testing/sysfs-kernel-warn_count | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/ABI/testing/sysfs-kernel-warn_count +1 -1
@@ -1,4 +1,4 @@ -What: /sys/kernel/oops_count +What: /sys/kernel/warn_count Date: November 2022 KernelVersion: 6.2.0 Contact: Linux Kernel Hardening List <[email protected]>
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 130/134 exit: Use READ_ONCE() for all oops/warn limit reads
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
commit 7535b832c6399b5ebfc5b53af5c51dd915ee2538 upstream.
Use a temporary variable to take full advantage of READ_ONCE() behavior. Without this, the report (and even the test) might be out of sync with the initial test.
--- kernel/exit.c | 6 ++++-- kernel/panic.c | 7 +++++-- 2 files changed, 9 insertions(+), 4 deletions(-)
kernel/exit.c +4 -2
@@ -917,6 +917,7 @@ void __noreturn make_task_dead(int signr)* Take the task off the cpu after something catastrophic has * happened. */ +unsigned int limit;/* * Every time the system oopses, if the oops happens while a reference
@@ -928,8 +929,9 @@ void __noreturn make_task_dead(int signr)* To make sure this can't happen, place an upper bound on how often the * kernel may oops without panic(). */ -if (atomic_inc_return (&oops_count) >=READ_ONCE (oops_limit) && oops_limit) -panic ("Oopsed too often (kernel.oops_limit is %d)" , oops_limit); + limit =READ_ONCE (oops_limit); +if (atomic_inc_return (&oops_count) >= limit && limit) +panic ("Oopsed too often (kernel.oops_limit is %d)" , limit);do_exit (signr); }
kernel/panic.c +5 -2
@@ -199,12 +199,15 @@ static void panic_print_sys_info(void)void check_panic_on_warn (const char *origin) { +unsigned int limit; +if (panic_on_warn)panic ("%s: panic_on_warn set ...\n" , origin); -if (atomic_inc_return (&warn_count) >=READ_ONCE (warn_limit) && warn_limit) + limit =READ_ONCE (warn_limit); +if (atomic_inc_return (&warn_count) >= limit && limit)panic ("%s: system warned too often (kernel.warn_limit is %d)" , - origin, warn_limit); + origin, limit); }/**
Signature · 1 line
2.39.0
Greg Kroah-Hartman
maintainerPATCH 131/134 ipv6: ensure sane device mtu in tunnels
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit d89d7ff01235f218dad37de84457717f699dee79 upstream.
Another syzbot report [1] with no reproducer hints at a bug in ip6_gre tunnel (dev:ip6gretap0)
Since ipv6 mcast code makes sure to read dev->mtu once and applies a sanity check on it (see commit b9b312a7a451 "ipv6: mcast: better catch silly mtu values"), a remaining possibility is that a layer is able to set dev->mtu to an underflowed value (high order bit set).
This could happen indeed in ip6gre_tnl_link_config_route(), ip6_tnl_link_config() and ipip6_tunnel_bind_dev()
Make sure to sanitize mtu value in a local variable before it is written once on dev->mtu, as lockless readers could catch wrong temporary value.
[1]
skbuff: skb_over_panic: text:ffff80000b7a2f38 len:40 put:40 head:ffff000149dcf200 data:ffff000149dcf2b0 tail:0xd8 end:0xc0 dev:ip6gretap0
------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:120 Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 10241 Comm: kworker/1:1 Not tainted 6.0.0-rc7-syzkaller-18095-gbbed346d5a96 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022 Workqueue: mld mld_ifc_work pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : skb_panic+0x4c/0x50 net/core/skbuff.c:116 lr : skb_panic+0x4c/0x50 net/core/skbuff.c:116
sp : ffff800020dd3b60
x29: ffff800020dd3b70 x28: 0000000000000000 x27: ffff00010df2a800
x26: 00000000000000c0 x25: 00000000000000b0 x24: ffff000149dcf200
x23: 00000000000000c0 x22: 00000000000000d8 x21: ffff80000b7a2f38
x20: ffff00014c2f7800 x19: 0000000000000028 x18: 00000000000001a9
x17: 0000000000000000 x16: ffff80000db49158 x15: ffff000113bf1a80
x14: 0000000000000000 x13: 00000000ffffffff x12: ffff000113bf1a80
x11: ff808000081c0d5c x10: 0000000000000000 x9 : 73f125dc5c63ba00 x8 : 73f125dc5c63ba00 x7 : ffff800008161d1c x6 : 0000000000000000 x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000 x2 : ffff0001fefddcd0 x1 : 0000000100000000 x0 : 0000000000000089
Call trace: skb_panic+0x4c/0x50 net/core/skbuff.c:116 skb_over_panic net/core/skbuff.c:125 [inline] skb_put+0xd4/0xdc net/core/skbuff.c:2049 ip6_mc_hdr net/ipv6/mcast.c:1714 [inline] mld_newpack+0x14c/0x270 net/ipv6/mcast.c:1765 add_grhead net/ipv6/mcast.c:1851 [inline] add_grec+0xa20/0xae0 net/ipv6/mcast.c:1989 mld_send_cr+0x438/0x5a8 net/ipv6/mcast.c:2115 mld_ifc_work+0x38/0x290 net/ipv6/mcast.c:2653 process_one_work+0x2d8/0x504 kernel/workqueue.c:2289 worker_thread+0x340/0x610 kernel/workqueue.c:2436 kthread+0x12c/0x158 kernel/kthread.c:376 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860 Code: 91011400 aa0803e1 a90027ea 94373093 (d4210000)
[ta: Backport patch for stable kernels < 5.10.y. Fix conflict in net/ipv6/ip6_tunnel.c, mtu initialized with:
mtu = rt->dst.dev->mtu - t_hlen;]
--- net/ipv6/ip6_gre.c | 12 +++++++----- net/ipv6/ip6_tunnel.c | 10 ++++++---- net/ipv6/sit.c | 8 +++++--- 3 files changed, 18 insertions(+), 12 deletions(-)
net/ipv6/ip6_gre.c +7 -5
@@ -1137,14 +1137,16 @@ static void ip6gre_tnl_link_config_route dev->needed_headroom = dst_len;if (set_mtu) { - dev->mtu = rt->dst.dev->mtu - t_hlen; +int mtu = rt->dst.dev->mtu - t_hlen; +if (!(t->parms.flags &IP6_TNL_F_IGN_ENCAP_LIMIT )) - dev->mtu -=8 ; + mtu -=8 ;if (dev->type ==ARPHRD_ETHER ) - dev->mtu -=ETH_HLEN ; + mtu -=ETH_HLEN ; -if (dev->mtu <IPV6_MIN_MTU ) - dev->mtu =IPV6_MIN_MTU ; +if (mtu <IPV6_MIN_MTU ) + mtu =IPV6_MIN_MTU ; +WRITE_ONCE (dev->mtu, mtu); } }ip6_rt_put (rt);
net/ipv6/ip6_tunnel.c +6 -4
@@ -1430,6 +1430,7 @@ static void ip6_tnl_link_config(struct istruct __ip6_tnl_parm *p = &t->parms;struct flowi6 *fl6 = &t->fl.u.ip6;int t_hlen; +int mtu;memcpy (dev->dev_addr, &p->laddr,sizeof (struct in6_addr ));memcpy (dev->broadcast, &p->raddr,sizeof (struct in6_addr ));
@@ -1472,12 +1473,13 @@ static void ip6_tnl_link_config(struct i dev->hard_header_len = rt->dst.dev->hard_header_len + t_hlen; - dev->mtu = rt->dst.dev->mtu - t_hlen; + mtu = rt->dst.dev->mtu - t_hlen;if (!(t->parms.flags &IP6_TNL_F_IGN_ENCAP_LIMIT )) - dev->mtu -=8 ; + mtu -=8 ; -if (dev->mtu <IPV6_MIN_MTU ) - dev->mtu =IPV6_MIN_MTU ; +if (mtu <IPV6_MIN_MTU ) + mtu =IPV6_MIN_MTU ; +WRITE_ONCE (dev->mtu, mtu); }ip6_rt_put (rt); }
net/ipv6/sit.c +5 -3
@@ -1083,10 +1083,12 @@ static void ipip6_tunnel_bind_dev(structif (tdev && !netif_is_l3_master (tdev)) {int t_hlen = tunnel->hlen +sizeof (struct iphdr ); +int mtu; - dev->mtu = tdev->mtu - t_hlen; -if (dev->mtu <IPV6_MIN_MTU ) - dev->mtu =IPV6_MIN_MTU ; + mtu = tdev->mtu - t_hlen; +if (mtu <IPV6_MIN_MTU ) + mtu =IPV6_MIN_MTU ; +WRITE_ONCE (dev->mtu, mtu); } }
Greg Kroah-Hartman
maintainerPATCH 132/134 Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt
In reply to Greg Kroah-HartmanFrom: Soenke Huster <[email protected]>
commit 3afee2118132e93e5f6fa636dfde86201a860ab3 upstream.
This event is just specified for SCO and eSCO link types.
On the reception of a HCI_Synchronous_Connection_Complete for a BDADDR of an existing LE connection, LE link type and a status that triggers the second case of the packet processing a NULL pointer dereference happens, as conn->link is NULL.
--- net/bluetooth/hci_event.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
net/bluetooth/hci_event.c +13 -0
@@ -4177,6 +4177,19 @@ static void hci_sync_conn_complete_evt(sstruct hci_ev_sync_conn_complete *ev = (void *) skb->data;struct hci_conn *conn; +switch (ev->link_type) { +case SCO_LINK : +case ESCO_LINK : +break ; +default : +/* As per Core 5.3 Vol 4 Part E 7.7.35 (p.2219), Link_Type +* for HCI_Synchronous_Connection_Complete is limited to +* either SCO or eSCO +*/ +bt_dev_err (hdev,"Ignoring connect complete event for invalid link type" ); +return ; + } +BT_DBG ("%s status 0x%2.2x" , hdev->name, ev->status);hci_dev_lock (hdev);
Greg Kroah-Hartman
maintainerPATCH 133/134 usb: host: xhci-plat: add wakeup entry at sysfs
In reply to Greg Kroah-HartmanFrom: Peter Chen <[email protected]>
commit 4bb4fc0dbfa23acab9b762949b91ffd52106fe4b upstream.
With this change, there will be a wakeup entry at /sys/../power/wakeup, and the user could use this entry to choose whether enable xhci wakeup features (wake up system from suspend) or not.
--- drivers/usb/host/xhci-plat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/xhci-plat.c +1 -1
@@ -276,7 +276,7 @@ static int xhci_plat_probe(struct platfo *priv = *priv_match; } -device_wakeup_enable (hcd->self.controller); +device_set_wakeup_capable (&pdev->dev, true); xhci->main_hcd = hcd; xhci->shared_hcd = __usb_create_hcd(driver, sysdev, &pdev->dev,
Greg Kroah-Hartman
maintainerPATCH 134/134 Revert "xprtrdma: Fix regbuf data not freed in rpcrdma_req_create()"
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
This reverts commit bcebcb11fcbc744de1add88601c51cca8b4e762c which is commit 9181f40fb2952fd59ecb75e7158620c9c669eee3 upstream.
The backport to 5.4.y causes problems, as reported by Harshit, so revert it for now and wait for a working backport to be added.
--- net/sunrpc/xprtrdma/verbs.c | 1 - 1 file changed, 1 deletion(-)
net/sunrpc/xprtrdma/verbs.c +0 -1
@@ -1037,7 +1037,6 @@ out4:kfree (req->rl_sendbuf); out3:kfree (req->rl_rdmabuf); -rpcrdma_regbuf_free (req->rl_sendbuf); out2:kfree (req); out1:
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.231 release. There are 134 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 05 Feb 2023 10:09:58 +0000. Anything received after that time might be too late.
Building ia64:defconfig ... failed
--------------
Error log:
<stdin>:1511:2: warning: #warning syscall clone3 not implemented [-Wcpp] arch/ia64/kernel/mca_drv.c: In function 'mca_handler_bh':arch/ia64/kernel/mca_drv.c:179:9: error: implicit declaration of function 'make_task_dead'
Caused by "exit: Add and use make_task_dead.". Did that really have to be backported ?
Guenter
Greg Kroah-Hartman
maintainerQuoted 10 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.231 release. There are 134 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 05 Feb 2023 10:09:58 +0000. Anything received after that time might be too late.
Quoted 8 lines
Building ia64:defconfig ... failed
--------------
Error log:
<stdin>:1511:2: warning: #warning syscall clone3 not implemented [-Wcpp]arch/ia64/kernel/mca_drv.c: In function 'mca_handler_bh':arch/ia64/kernel/mca_drv.c:179:9: error: implicit declaration of function 'make_task_dead'Caused by "exit: Add and use
make_task_dead.". Did that really have to be backported ?
Yup, it does!
Eric, any help with this?
thanks,
greg k-h
Quoted 18 lines · Greg Kroah-Hartman
Quoted 17 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.231 release. There are 134 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 05 Feb 2023 10:09:58 +0000. Anything received after that time might be too late.
Building ia64:defconfig ... failed
--------------
Error log:
<stdin>:1511:2: warning: #warning syscall clone3 not implemented [-Wcpp]arch/ia64/kernel/mca_drv.c: In function 'mca_handler_bh':arch/ia64/kernel/mca_drv.c:179:9: error: implicit declaration of function 'make_task_dead'
Quoted 6 lines
Quoted 1 line
Caused by "exit: Add and use
make_task_dead.". Did that really have to be backported ?Yup, it does!
Eric, any help with this?
Adding "#include <linux/sched/task.h>" to the affected file would probably be the easy fix. I did a quick check, and it works.
Note that the same problem is seen in v4.14.y and v4.19.y. Later kernels don't have the problem.
Guenter
Quoted 3 lines
thanks,
greg k-h
Quoted 23 lines · Guenter Roeck
Quoted 22 lines · Greg Kroah-Hartman
Quoted 10 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.231 release. There are 134 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 05 Feb 2023 10:09:58 +0000. Anything received after that time might be too late.
Quoted 8 lines
Building ia64:defconfig ... failed
--------------
Error log:
<stdin>:1511:2: warning: #warning syscall clone3 not implemented [-Wcpp]arch/ia64/kernel/mca_drv.c: In function 'mca_handler_bh':arch/ia64/kernel/mca_drv.c:179:9: error: implicit declaration of function 'make_task_dead'Caused by "exit: Add and use
make_task_dead.". Did that really have to be backported ?Yup, it does!
Quoted 9 lines
Quoted 2 lines
Eric, any help with this?
Adding "#include <
linux/sched/task.h>" to the affected file would probably be the easy fix. I did a quick check, and it works.Note that the same problem is seen in v4.14.y and v4.19.y. Later kernels don't have the problem.
This problem arises because <linux/mm.h> transitively includes <linux/sched/task.h> in 5.10 and later, but not in 5.4 and earlier.
Greg, any preference for how to handle this situation?
Just add '#include <linux/sched/task.h>' to the affected .c file (and hope there are no more affected .c files in the other arch directories) and call it a day?
Or should we backport the transitive inclusion (i.e., the #include added by commit 80fbaf1c3f29)? Or move the declaration of make_task_dead() into <linux/kernel.h> so that it's next to do_exit()?
- Eric
Quoted 37 lines · Eric Biggers
Quoted 23 lines · Guenter Roeck
Quoted 22 lines · Greg Kroah-Hartman
Quoted 10 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.231 release. There are 134 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 05 Feb 2023 10:09:58 +0000. Anything received after that time might be too late.
Quoted 8 lines
Building ia64:defconfig ... failed
--------------
Error log:
<stdin>:1511:2: warning: #warning syscall clone3 not implemented [-Wcpp]arch/ia64/kernel/mca_drv.c: In function 'mca_handler_bh':arch/ia64/kernel/mca_drv.c:179:9: error: implicit declaration of function 'make_task_dead'Caused by "exit: Add and use
make_task_dead.". Did that really have to be backported ?Yup, it does!
Quoted 9 lines
Quoted 2 lines
Eric, any help with this?
Adding "#include <
linux/sched/task.h>" to the affected file would probably be the easy fix. I did a quick check, and it works.Note that the same problem is seen in v4.14.y and v4.19.y. Later kernels don't have the problem.
This problem arises because <
linux/mm.h> transitively includes <linux/sched/task.h> in 5.10 and later, but not in 5.4 and earlier.
Quoted 8 lines
Greg, any preference for how to handle this situation?
Just add '#include <
linux/sched/task.h>' to the affected .c file (and hope there are no more affected .c files in the other arch directories) and call it a day?Or should we backport the transitive inclusion (i.e., the #include added by commit
80fbaf1c3f29)? Or move the declaration ofmake_task_dead()into <linux/kernel.h> so that it's next todo_exit()?
One question: do *all* the arches actually get built as part of the testing for each stable release? If so, we can just add the #include to the .c files that need it. If not, then it would be safer to take one of the other approaches.
- Eric
Quoted 43 lines · Eric Biggers
Quoted 42 lines · Eric Biggers
Quoted 23 lines · Guenter Roeck
Quoted 22 lines · Greg Kroah-Hartman
Quoted 10 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.231 release. There are 134 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 05 Feb 2023 10:09:58 +0000. Anything received after that time might be too late.
Quoted 8 lines
Building ia64:defconfig ... failed
--------------
Error log:
<stdin>:1511:2: warning: #warning syscall clone3 not implemented [-Wcpp]arch/ia64/kernel/mca_drv.c: In function 'mca_handler_bh':arch/ia64/kernel/mca_drv.c:179:9: error: implicit declaration of function 'make_task_dead'Caused by "exit: Add and use
make_task_dead.". Did that really have to be backported ?Yup, it does!
Quoted 9 lines
Quoted 2 lines
Eric, any help with this?
Adding "#include <
linux/sched/task.h>" to the affected file would probably be the easy fix. I did a quick check, and it works.Note that the same problem is seen in v4.14.y and v4.19.y. Later kernels don't have the problem.
This problem arises because <
linux/mm.h> transitively includes <linux/sched/task.h> in 5.10 and later, but not in 5.4 and earlier.Greg, any preference for how to handle this situation?
Just add '#include <
linux/sched/task.h>' to the affected .c file (and hope there are no more affected .c files in the other arch directories) and call it a day?
Quoted 8 lines
Quoted 3 lines
Or should we backport the transitive inclusion (i.e., the #include added by commit
80fbaf1c3f29)? Or move the declaration ofmake_task_dead()into <linux/kernel.h> so that it's next todo_exit()?One question: do *all* the arches actually get built as part of the testing for each stable release? If so, we can just add the #include to the .c files that need it. If not, then it would be safer to take one of the other approaches.
Yes, I do build all architectures for each stable release.
FWIW, I only noticed that one build failure due to this problem.
Guenter
Quoted 48 lines · Guenter Roeck
Quoted 47 lines · Eric Biggers
Quoted 45 lines · Eric Biggers
Quoted 23 lines · Guenter Roeck
Quoted 22 lines · Greg Kroah-Hartman
Quoted 10 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.231 release. There are 134 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 05 Feb 2023 10:09:58 +0000. Anything received after that time might be too late.
Quoted 8 lines
Building ia64:defconfig ... failed
--------------
Error log:
<stdin>:1511:2: warning: #warning syscall clone3 not implemented [-Wcpp]arch/ia64/kernel/mca_drv.c: In function 'mca_handler_bh':arch/ia64/kernel/mca_drv.c:179:9: error: implicit declaration of function 'make_task_dead'Caused by "exit: Add and use
make_task_dead.". Did that really have to be backported ?Yup, it does!
Quoted 9 lines
Quoted 2 lines
Eric, any help with this?
Adding "#include <
linux/sched/task.h>" to the affected file would probably be the easy fix. I did a quick check, and it works.Note that the same problem is seen in v4.14.y and v4.19.y. Later kernels don't have the problem.
This problem arises because <
linux/mm.h> transitively includes <linux/sched/task.h> in 5.10 and later, but not in 5.4 and earlier.Greg, any preference for how to handle this situation?
Just add '#include <
linux/sched/task.h>' to the affected .c file (and hope there are no more affected .c files in the other arch directories) and call it a day?Or should we backport the transitive inclusion (i.e., the #include added by commit
80fbaf1c3f29)? Or move the declaration ofmake_task_dead()into <linux/kernel.h> so that it's next todo_exit()?
Quoted 8 lines
Quoted 4 lines
One question: do *all* the arches actually get built as part of the testing for each stable release? If so, we can just add the #include to the .c files that need it. If not, then it would be safer to take one of the other approaches.
Yes, I do build all architectures for each stable release.
FWIW, I only noticed that one build failure due to this problem.
Okay, great. In that case, Greg or Sasha, can you fold the needed #include into arch/ia64/kernel/mca_drv.c in exit-add-and-use-make_task_dead.patch on 4.14, 4.19, and 5.4? Or should I just send the whole series again for each?
- Eric
Greg Kroah-Hartman
maintainerQuoted 54 lines · Eric Biggers
Quoted 53 lines · Guenter Roeck
Quoted 51 lines · Eric Biggers
Quoted 37 lines · Eric Biggers
Quoted 23 lines · Guenter Roeck
Quoted 22 lines · Greg Kroah-Hartman
Quoted 10 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.231 release. There are 134 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 05 Feb 2023 10:09:58 +0000. Anything received after that time might be too late.
Quoted 8 lines
Building ia64:defconfig ... failed
--------------
Error log:
<stdin>:1511:2: warning: #warning syscall clone3 not implemented [-Wcpp]arch/ia64/kernel/mca_drv.c: In function 'mca_handler_bh':arch/ia64/kernel/mca_drv.c:179:9: error: implicit declaration of function 'make_task_dead'Caused by "exit: Add and use
make_task_dead.". Did that really have to be backported ?Yup, it does!
Quoted 9 lines
Quoted 2 lines
Eric, any help with this?
Adding "#include <
linux/sched/task.h>" to the affected file would probably be the easy fix. I did a quick check, and it works.Note that the same problem is seen in v4.14.y and v4.19.y. Later kernels don't have the problem.
This problem arises because <
linux/mm.h> transitively includes <linux/sched/task.h> in 5.10 and later, but not in 5.4 and earlier.Quoted 8 lines
Greg, any preference for how to handle this situation?
Just add '#include <
linux/sched/task.h>' to the affected .c file (and hope there are no more affected .c files in the other arch directories) and call it a day?Or should we backport the transitive inclusion (i.e., the #include added by commit
80fbaf1c3f29)? Or move the declaration ofmake_task_dead()into <linux/kernel.h> so that it's next todo_exit()?One question: do *all* the arches actually get built as part of the testing for each stable release? If so, we can just add the #include to the .c files that need it. If not, then it would be safer to take one of the other approaches.
Quoted 7 lines
Quoted 3 lines
Yes, I do build all architectures for each stable release.
FWIW, I only noticed that one build failure due to this problem.
Okay, great. In that case, Greg or Sasha, can you fold the needed #include into
arch/ia64/kernel/mca_drv.cin exit-add-and-use-make_task_dead.patch on 4.14, 4.19, and 5.4? Or should I just send the whole series again for each?
I'll fold it in later today when I get a chance, no need to resubmit the whole thing, thanks!
greg k-h
Sasha Levin
maintainerQuoted 57 lines · Greg Kroah-Hartman
Quoted 56 lines · Eric Biggers
Quoted 55 lines · Guenter Roeck
Quoted 43 lines · Eric Biggers
Quoted 42 lines · Eric Biggers
Quoted 23 lines · Guenter Roeck
Quoted 22 lines · Greg Kroah-Hartman
Quoted 10 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.231 release. There are 134 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 05 Feb 2023 10:09:58 +0000. Anything received after that time might be too late.
Quoted 8 lines
Building ia64:defconfig ... failed
--------------
Error log:
<stdin>:1511:2: warning: #warning syscall clone3 not implemented [-Wcpp]arch/ia64/kernel/mca_drv.c: In function 'mca_handler_bh':arch/ia64/kernel/mca_drv.c:179:9: error: implicit declaration of function 'make_task_dead'Caused by "exit: Add and use
make_task_dead.". Did that really have to be backported ?Yup, it does!
Quoted 9 lines
Quoted 2 lines
Eric, any help with this?
Adding "#include <
linux/sched/task.h>" to the affected file would probably be the easy fix. I did a quick check, and it works.Note that the same problem is seen in v4.14.y and v4.19.y. Later kernels don't have the problem.
This problem arises because <
linux/mm.h> transitively includes <linux/sched/task.h> in 5.10 and later, but not in 5.4 and earlier.Greg, any preference for how to handle this situation?
Just add '#include <
linux/sched/task.h>' to the affected .c file (and hope there are no more affected .c files in the other arch directories) and call it a day?Quoted 8 lines
Quoted 3 lines
Or should we backport the transitive inclusion (i.e., the #include added by commit
80fbaf1c3f29)? Or move the declaration ofmake_task_dead()into <linux/kernel.h> so that it's next todo_exit()?One question: do *all* the arches actually get built as part of the testing for each stable release? If so, we can just add the #include to the .c files that need it. If not, then it would be safer to take one of the other approaches.
Yes, I do build all architectures for each stable release.
Quoted 8 lines
Quoted 5 lines
Quoted 1 line
FWIW, I only noticed that one build failure due to this problem.
Okay, great. In that case, Greg or Sasha, can you fold the needed #include into
arch/ia64/kernel/mca_drv.cin exit-add-and-use-make_task_dead.patch on 4.14, 4.19, and 5.4? Or should I just send the whole series again for each?I'll fold it in later today when I get a chance, no need to resubmit the whole thing, thanks!
Greg, I did it for the 5.4 backport. If I do it for 4.19 and 4.14 it's going to add a bunch of fuzz into those, lmk if you want me to push those too or whether you'll fix it up.
Signature · 2 lines
Thanks, Sasha
Greg Kroah-Hartman
maintainerQuoted 64 lines · Sasha Levin
Quoted 63 lines · Greg Kroah-Hartman
Quoted 61 lines · Eric Biggers
Quoted 48 lines · Guenter Roeck
Quoted 47 lines · Eric Biggers
Quoted 45 lines · Eric Biggers
Quoted 23 lines · Guenter Roeck
Quoted 22 lines · Greg Kroah-Hartman
Quoted 10 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.231 release. There are 134 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 05 Feb 2023 10:09:58 +0000. Anything received after that time might be too late.
Quoted 8 lines
Building ia64:defconfig ... failed
--------------
Error log:
<stdin>:1511:2: warning: #warning syscall clone3 not implemented [-Wcpp]arch/ia64/kernel/mca_drv.c: In function 'mca_handler_bh':arch/ia64/kernel/mca_drv.c:179:9: error: implicit declaration of function 'make_task_dead'Caused by "exit: Add and use
make_task_dead.". Did that really have to be backported ?Yup, it does!
Quoted 9 lines
Quoted 2 lines
Eric, any help with this?
Adding "#include <
linux/sched/task.h>" to the affected file would probably be the easy fix. I did a quick check, and it works.Note that the same problem is seen in v4.14.y and v4.19.y. Later kernels don't have the problem.
This problem arises because <
linux/mm.h> transitively includes <linux/sched/task.h> in 5.10 and later, but not in 5.4 and earlier.Greg, any preference for how to handle this situation?
Just add '#include <
linux/sched/task.h>' to the affected .c file (and hope there are no more affected .c files in the other arch directories) and call it a day?Or should we backport the transitive inclusion (i.e., the #include added by commit
80fbaf1c3f29)? Or move the declaration ofmake_task_dead()into <linux/kernel.h> so that it's next todo_exit()?Quoted 8 lines
Quoted 4 lines
One question: do *all* the arches actually get built as part of the testing for each stable release? If so, we can just add the #include to the .c files that need it. If not, then it would be safer to take one of the other approaches.
Yes, I do build all architectures for each stable release.
FWIW, I only noticed that one build failure due to this problem.
Okay, great. In that case, Greg or Sasha, can you fold the needed #include into
arch/ia64/kernel/mca_drv.cin exit-add-and-use-make_task_dead.patch on 4.14, 4.19, and 5.4? Or should I just send the whole series again for each?
Quoted 6 lines
Quoted 2 lines
I'll fold it in later today when I get a chance, no need to resubmit the whole thing, thanks!
Greg, I did it for the 5.4 backport. If I do it for 4.19 and 4.14 it's going to add a bunch of fuzz into those, lmk if you want me to push those too or whether you'll fix it up.
I just fixed up those 2 trees, and I don't understand what you mean by "a bunch of fuzz". Can you look at my changes to verify I got it right?
thanks,
greg k-h
Sasha Levin
maintainerQuoted 68 lines · Greg Kroah-Hartman
Quoted 67 lines · Sasha Levin
Quoted 65 lines · Greg Kroah-Hartman
Quoted 54 lines · Eric Biggers
Quoted 53 lines · Guenter Roeck
Quoted 51 lines · Eric Biggers
Quoted 37 lines · Eric Biggers
Quoted 23 lines · Guenter Roeck
Quoted 22 lines · Greg Kroah-Hartman
Quoted 10 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.231 release. There are 134 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 05 Feb 2023 10:09:58 +0000. Anything received after that time might be too late.
Quoted 8 lines
Building ia64:defconfig ... failed
--------------
Error log:
<stdin>:1511:2: warning: #warning syscall clone3 not implemented [-Wcpp]arch/ia64/kernel/mca_drv.c: In function 'mca_handler_bh':arch/ia64/kernel/mca_drv.c:179:9: error: implicit declaration of function 'make_task_dead'Caused by "exit: Add and use
make_task_dead.". Did that really have to be backported ?Yup, it does!
Quoted 9 lines
Quoted 2 lines
Eric, any help with this?
Adding "#include <
linux/sched/task.h>" to the affected file would probably be the easy fix. I did a quick check, and it works.Note that the same problem is seen in v4.14.y and v4.19.y. Later kernels don't have the problem.
This problem arises because <
linux/mm.h> transitively includes <linux/sched/task.h> in 5.10 and later, but not in 5.4 and earlier.Quoted 8 lines
Greg, any preference for how to handle this situation?
Just add '#include <
linux/sched/task.h>' to the affected .c file (and hope there are no more affected .c files in the other arch directories) and call it a day?Or should we backport the transitive inclusion (i.e., the #include added by commit
80fbaf1c3f29)? Or move the declaration ofmake_task_dead()into <linux/kernel.h> so that it's next todo_exit()?One question: do *all* the arches actually get built as part of the testing for each stable release? If so, we can just add the #include to the .c files that need it. If not, then it would be safer to take one of the other approaches.
Quoted 7 lines
Quoted 3 lines
Yes, I do build all architectures for each stable release.
FWIW, I only noticed that one build failure due to this problem.
Okay, great. In that case, Greg or Sasha, can you fold the needed #include into
arch/ia64/kernel/mca_drv.cin exit-add-and-use-make_task_dead.patch on 4.14, 4.19, and 5.4? Or should I just send the whole series again for each?I'll fold it in later today when I get a chance, no need to resubmit the whole thing, thanks!
Quoted 6 lines
Quoted 3 lines
Greg, I did it for the 5.4 backport. If I do it for 4.19 and 4.14 it's going to add a bunch of fuzz into those, lmk if you want me to push those too or whether you'll fix it up.
I just fixed up those 2 trees, and I don't understand what you mean by "a bunch of fuzz". Can you look at my changes to verify I got it right?
Your changes look right.
We're likely using different tools to format a patch - you can see differences in things like indentation of the diffstat, which headers are kept in the patch, and so on...
If I were to regenerate patches you have previously queued up, we'd see a somewhat big diff because of that.
Signature · 2 lines
Thanks, Sasha
Greg Kroah-Hartman
maintainerQuoted 73 lines · Sasha Levin
Quoted 72 lines · Greg Kroah-Hartman
Quoted 70 lines · Sasha Levin
Quoted 57 lines · Greg Kroah-Hartman
Quoted 56 lines · Eric Biggers
Quoted 55 lines · Guenter Roeck
Quoted 43 lines · Eric Biggers
Quoted 42 lines · Eric Biggers
Quoted 23 lines · Guenter Roeck
Quoted 22 lines · Greg Kroah-Hartman
Quoted 10 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.231 release. There are 134 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 05 Feb 2023 10:09:58 +0000. Anything received after that time might be too late.
Quoted 8 lines
Building ia64:defconfig ... failed
--------------
Error log:
<stdin>:1511:2: warning: #warning syscall clone3 not implemented [-Wcpp]arch/ia64/kernel/mca_drv.c: In function 'mca_handler_bh':arch/ia64/kernel/mca_drv.c:179:9: error: implicit declaration of function 'make_task_dead'Caused by "exit: Add and use
make_task_dead.". Did that really have to be backported ?Yup, it does!
Quoted 9 lines
Quoted 2 lines
Eric, any help with this?
Adding "#include <
linux/sched/task.h>" to the affected file would probably be the easy fix. I did a quick check, and it works.Note that the same problem is seen in v4.14.y and v4.19.y. Later kernels don't have the problem.
This problem arises because <
linux/mm.h> transitively includes <linux/sched/task.h> in 5.10 and later, but not in 5.4 and earlier.Greg, any preference for how to handle this situation?
Just add '#include <
linux/sched/task.h>' to the affected .c file (and hope there are no more affected .c files in the other arch directories) and call it a day?Quoted 8 lines
Quoted 3 lines
Or should we backport the transitive inclusion (i.e., the #include added by commit
80fbaf1c3f29)? Or move the declaration ofmake_task_dead()into <linux/kernel.h> so that it's next todo_exit()?One question: do *all* the arches actually get built as part of the testing for each stable release? If so, we can just add the #include to the .c files that need it. If not, then it would be safer to take one of the other approaches.
Yes, I do build all architectures for each stable release.
Quoted 8 lines
Quoted 5 lines
Quoted 1 line
FWIW, I only noticed that one build failure due to this problem.
Okay, great. In that case, Greg or Sasha, can you fold the needed #include into
arch/ia64/kernel/mca_drv.cin exit-add-and-use-make_task_dead.patch on 4.14, 4.19, and 5.4? Or should I just send the whole series again for each?I'll fold it in later today when I get a chance, no need to resubmit the whole thing, thanks!
Greg, I did it for the 5.4 backport. If I do it for 4.19 and 4.14 it's going to add a bunch of fuzz into those, lmk if you want me to push those too or whether you'll fix it up.
Quoted 8 lines
Quoted 2 lines
I just fixed up those 2 trees, and I don't understand what you mean by "a bunch of fuzz". Can you look at my changes to verify I got it right?
Your changes look right.
We're likely using different tools to format a patch - you can see differences in things like indentation of the diffstat, which headers are kept in the patch, and so on...
Yeah, I'm using quilt, you're using git, different whitespace in places.
thanks for verifying the change was correct.
greg k-h
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.231 release. There are 134 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 05 Feb 2023 10:09:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.231-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.231 release. There are 134 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 05 Feb 2023 10:09:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.231-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.231 release. There are 134 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 05 Feb 2023 10:09:58 +0000. Anything received after that time might be too late.
Build results:
total: 159 pass: 158 fail: 1 Failed builds: ia64:defconfig Qemu test results: total: 450 pass: 450 fail: 0
ia64 build error as already reported.
Guenter
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.231 release. There are 134 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 05 Feb 2023 10:09:58 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.231-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 5.4.231-rc1
* git: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
* git branch: linux-5.4.y
* git commit: f094cca7f934dd6b1c62254251d145087d40c30b
* git describe: v5.4.230-135-gf094cca7f934
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.4.y/build/v5.4.230-135-gf094cca7f934
## Test Regressions (compared to v5.4.230)
## Metric Regressions (compared to v5.4.230)
## Test Fixes (compared to v5.4.230)
## Metric Fixes (compared to v5.4.230)
## Test result summary
total: 130133, pass: 103865, fail: 3011, skip: 22894, xfail: 363
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 144 total, 143 passed, 1 failed
* arm64: 44 total, 40 passed, 4 failed
* i386: 26 total, 20 passed, 6 failed
* mips: 27 total, 27 passed, 0 failed
* parisc: 6 total, 6 passed, 0 failed
* powerpc: 30 total, 30 passed, 0 failed
* riscv: 12 total, 11 passed, 1 failed
* s390: 6 total, 6 passed, 0 failed
* sh: 12 total, 12 passed, 0 failed
* sparc: 6 total, 6 passed, 0 failed
* x86_64: 37 total, 35 passed, 2 failed
## Test suites summary
* boot
* fwts
* kselftest-android
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers-dma-buf
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-firmware
* kselftest-fpu
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-net-forwarding
* kselftest-net-mptcp
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-tc-testing
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-vm
* kselftest-x86
* kselftest-zram
* kunit
* kvm-unit-tests
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-test
* ltp-cap_bounds
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-filecaps
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-fsx
* ltp-hugetlb
* ltp-io
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-open-posix-tests
* ltp-pty
* ltp-sched
* ltp-securebits
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* network-basic-tests
* packetdrill
* perf
* rcutorture
* v4l2-compliance
* vdso
--
Linaro LKFT
https://lkft.linaro.org