6.2.4-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 6.2.4-rc1 review
This is the start of the stable review cycle for the 6.2.4 release. There are 211 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 12 Mar 2023 13:36:38 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.2.4-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.2.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.2.4-rc1
Yang Yingliang <[email protected]>
usb: gadget: uvc: fix missing mutex_unlock() if kstrtou8() fails
Pierre Gondois <[email protected]>
arm64: efi: Make efi_rt_lock a raw_spinlock
Ricardo Ribalda <[email protected]>
media: uvcvideo: Fix race condition with usb_kill_urb
Imre Deak <[email protected]>
drm/i915: Fix system suspend without fbdev being initialized
Imre Deak <[email protected]>
drm/i915/dp_mst: Fix payload removal during output disabling
Imre Deak <[email protected]>
drm/display/dp_mst: Handle old/new payload states in drm_dp_remove_payload()
Imre Deak <[email protected]>
drm/i915/dp_mst: Add the MST topology state for modesetted CRTCs
Imre Deak <[email protected]>
drm/display/dp_mst: Fix payload addition on a disconnected sink
Imre Deak <[email protected]>
drm/display/dp_mst: Fix down message handling after a packet reception error
Imre Deak <[email protected]>
drm/display/dp_mst: Fix down/up message handling after sink disconnect
Imre Deak <[email protected]>
drm/display/dp_mst: Add drm_atomic_get_old_mst_topology_state()
Zhu Lingshan <[email protected]>
vDPA/ifcvf: allocate the adapter in dev_add()
Zhu Lingshan <[email protected]>
vDPA/ifcvf: manage ifcvf_hw in the mgmt_dev
Zhu Lingshan <[email protected]>
vDPA/ifcvf: ifcvf_request_irq works on ifcvf_hw
Zhu Lingshan <[email protected]>
vDPA/ifcvf: decouple config/dev IRQ requester and vectors allocator from the adapter
Zhu Lingshan <[email protected]>
vDPA/ifcvf: decouple vq irq requester from the adapter
Zhu Lingshan <[email protected]>
vDPA/ifcvf: decouple config IRQ releaser from the adapter
Zhu Lingshan <[email protected]>
vDPA/ifcvf: decouple vq IRQ releasers from the adapter
Zhu Lingshan <[email protected]>
vDPA/ifcvf: alloc the mgmt_dev before the adapter
Zhu Lingshan <[email protected]>
vDPA/ifcvf: decouple config space ops from the adapter
Zhu Lingshan <[email protected]>
vDPA/ifcvf: decouple hw features manipulators from the adapter
Linus Torvalds <[email protected]>
x86/resctl: fix scheduler confusion with 'current'
Jakub Kicinski <[email protected]>
net: tls: avoid hanging tasks on the tx_lock
Jakub Kicinski <[email protected]>
eth: fealnx: bring back this old driver
Richard Fitzgerald <[email protected]>
soundwire: cadence: Drain the RX FIFO after an IO timeout
Richard Fitzgerald <[email protected]>
soundwire: cadence: Remove wasted space in response_buf
Kees Cook <[email protected]>
RDMA/cma: Distinguish between sockaddr_in and sockaddr_in6 by size
Jiapeng Chong <[email protected]>
phy: rockchip-typec: Fix unsigned comparison with less than zero
Manivannan Sadhasivam <[email protected]>
PCI: pciehp: Add Qualcomm quirk for Command Completed erratum
Mengyuan Lou <[email protected]>
PCI: Add ACS quirk for Wangxun NICs
Huacai Chen <[email protected]>
PCI: loongson: Add more devices that need MRRS quirk
Greg Kroah-Hartman <[email protected]>
kernel/fail_function: fix memory leak with using debugfs_lookup()
Greg Kroah-Hartman <[email protected]>
drivers: base: dd: fix memory leak with using debugfs_lookup()
Greg Kroah-Hartman <[email protected]>
drivers: base: component: fix memory leak with using debugfs_lookup()
Greg Kroah-Hartman <[email protected]>
misc: vmw_balloon: fix memory leak with using debugfs_lookup()
Greg Kroah-Hartman <[email protected]>
tty: pcn_uart: fix memory leak with using debugfs_lookup()
Mika Westerberg <[email protected]>
PCI: Distribute available resources for root buses, too
Mika Westerberg <[email protected]>
PCI: Take other bus devices into account when distributing resources
Mika Westerberg <[email protected]>
PCI: Align extra resources for hotplug bridges properly
Daniel Scally <[email protected]>
usb: gadget: uvc: Make bSourceID read/write
Daniel Scally <[email protected]>
usb: uvc: Enumerate valid values for color matching
Kees Cook <[email protected]>
USB: ene_usb6250: Allocate enough memory for full object
Kees Cook <[email protected]>
usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer math
Greg Kroah-Hartman <[email protected]>
USB: gadget: pxa27x_udc: fix memory leak with using debugfs_lookup()
Greg Kroah-Hartman <[email protected]>
USB: gadget: pxa25x_udc: fix memory leak with using debugfs_lookup()
Greg Kroah-Hartman <[email protected]>
USB: gadget: lpc32xx_udc: fix memory leak with using debugfs_lookup()
Greg Kroah-Hartman <[email protected]>
USB: gadget: bcm63xx_udc: fix memory leak with using debugfs_lookup()
Greg Kroah-Hartman <[email protected]>
USB: gadget: gr_udc: fix memory leak with using debugfs_lookup()
Greg Kroah-Hartman <[email protected]>
USB: isp1362: fix memory leak with using debugfs_lookup()
Greg Kroah-Hartman <[email protected]>
USB: isp116x: fix memory leak with using debugfs_lookup()
Greg Kroah-Hartman <[email protected]>
USB: fotg210: fix memory leak with using debugfs_lookup()
Greg Kroah-Hartman <[email protected]>
USB: sl811: fix memory leak with using debugfs_lookup()
Greg Kroah-Hartman <[email protected]>
USB: uhci: fix memory leak with using debugfs_lookup()
Greg Kroah-Hartman <[email protected]>
USB: ULPI: fix memory leak with using debugfs_lookup()
Greg Kroah-Hartman <[email protected]>
USB: chipidea: fix memory leak with using debugfs_lookup()
Greg Kroah-Hartman <[email protected]>
USB: dwc3: fix memory leak with using debugfs_lookup()
Greg Kroah-Hartman <[email protected]>
staging: pi433: fix memory leak with using debugfs_lookup()
Huacai Chen <[email protected]>
PCI: loongson: Prevent LS7A MRRS increases
Huacai Chen <[email protected]>
PCI/portdrv: Prevent LS7A Bus Master clearing on shutdown
Richard Fitzgerald <[email protected]>
soundwire: bus_type: Avoid lockdep assert in sdw_drv_probe()
Marek Vasut <[email protected]>
media: uvcvideo: Add GUID for BGRA/X 8:8:8:8
Harshit Mogalapalli <[email protected]>
iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_config_word()
Harshit Mogalapalli <[email protected]>
iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_status_word()
Manivannan Sadhasivam <[email protected]>
bus: mhi: ep: Fix the debug message for MHI_PKT_TYPE_RESET_CHAN_CMD cmd
Yulong Zhang <[email protected]>
tools/iio/iio_utils:fix memory leak
Alexander Usyskin <[email protected]>
mei: bus-fixup:upon error print return values of send and receive
Isaac True <[email protected]>
serial: sc16is7xx: setup GPIO controller later in probe
Sherry Sun <[email protected]>
tty: serial: fsl_lpuart: disable the CTS when send break signal
Sven Schnelle <[email protected]>
tty: fix out-of-bounds access in tty_driver_lookup_tty()
Yuan Can <[email protected]>
staging: emxx_udc: Add checks for dma_alloc_coherent()
Anand Moon <[email protected]>
dt-bindings: usb: Add device id for Genesys Logic hub controller
Linus Walleij <[email protected]>
usb: fotg210: List different variants
Yong-Xuan Wang <[email protected]>
cacheinfo: Fix shared_cpu_map to handle shared caches at different levels
Greg Kroah-Hartman <[email protected]>
USB: fix memory leak with using debugfs_lookup()
Kees Cook <[email protected]>
media: uvcvideo: Silence memcpy() run-time false positive warnings
Ricardo Ribalda <[email protected]>
media: uvcvideo: Quirk for autosuspend in Logitech B910 and C910
Guenter Roeck <[email protected]>
media: uvcvideo: Handle errors from calls to usb_string
Ricardo Ribalda <[email protected]>
media: uvcvideo: Handle cameras with invalid descriptors
Laurent Pinchart <[email protected]>
media: uvcvideo: Remove format descriptions
Rafael J. Wysocki <[email protected]>
PCI/ACPI: Account for _S0W of the target bridge in acpi_pci_bridge_d3()
Jason Gunthorpe <[email protected]>
iommu: Remove deferred attach check from __iommu_detach_device()
Dean Luick <[email protected]>
IB/hfi1: Update RMT size calculation
Liang He <[email protected]>
mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak
Souradeep Chowdhury <[email protected]>
bootconfig: Increase max nodes of bootconfig from 1024 to 8192 for DCC support
Darrell Kavanagh <[email protected]>
firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3
Greg Kroah-Hartman <[email protected]>
kernel/printk/index.c: fix memory leak with using debugfs_lookup()
Jia-Ju Bai <[email protected]>
tracing: Add NULL checks for buffer in ring_buffer_free_read_page()
Dan Carpenter <[email protected]>
cpufreq: apple-soc: Fix an IS_ERR() vs NULL check
Randy Dunlap <[email protected]>
thermal: intel: BXT_PMIC: select REGMAP instead of depending on it
Dan Carpenter <[email protected]>
thermal: intel: quark_dts: fix error pointer dereference
Trevor Wu <[email protected]>
ASoC: mediatek: mt8195: add missing initialization
Arnd Bergmann <[email protected]>
ASoC: zl38060 add gpiolib dependency
Daniel Wagner <[email protected]>
nvme-fabrics: show well known discovery name
Akinobu Mita <[email protected]>
nvme-tcp: don't access released socket during error recovery
Christoph Hellwig <[email protected]>
nvme: bring back auto-removal of deleted namespaces during sequential scan
Martin Povišer <[email protected]>
ASoC: apple: mca: Improve handling of unavailable DMA channels
Martin Povišer <[email protected]>
ASoC: apple: mca: Fix SERDES reset sequence
Martin Povišer <[email protected]>
ASoC: apple: mca: Fix final status read on SERDES reset
Nuno Sá <[email protected]>
ASoC: adau7118: don't disable regulators on device unbind
Zhong Jinghua <[email protected]>
loop: loop_set_status_from_info() check before assignment
Wojciech Lukowicz <[email protected]>
io_uring: fix size calculation when registering buf ring
Alexandre Belloni <[email protected]>
rtc: allow rtc_read_alarm without read_alarm callback
Shin'ichiro Kawasaki <[email protected]>
scsi: mpi3mr: Use number of bits to manage bitmap sizes
Tomas Henzl <[email protected]>
scsi: mpi3mr: Fix an issue found by KASAN
Arnd Bergmann <[email protected]>
scsi: ipr: Work around fortify-string warning
Sergey Shtylyov <[email protected]>
genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask()
Samuel Holland <[email protected]>
rtc: sun6i: Always export the internal oscillator
Krishna Yarlagadda <[email protected]>
spi: tegra210-quad: Fix iterator outside loop
George Kennedy <[email protected]>
vc_screen: modify vcs_size() handling in vcs_read()
Eric Dumazet <[email protected]>
tcp: tcp_check_req() can be called from process context
Krzysztof Kozlowski <[email protected]>
ARM: dts: spear320-hmi: correct STMPE GPIO compatible
Eddie James <[email protected]>
ARM: dts: aspeed: p10bmc: Update battery node name
Vladimir Oltean <[email protected]>
net: dsa: felix: fix internal MDIO controller resource length
Vladimir Oltean <[email protected]>
net: dsa: seville: ignore mscc-miim read errors from Lynx PCS
Pedro Tammela <[email protected]>
net/sched: act_sample: fix action bind logic
Pedro Tammela <[email protected]>
net/sched: act_mpls: fix action bind logic
Pedro Tammela <[email protected]>
net/sched: act_pedit: fix action bind logic
Pedro Tammela <[email protected]>
net/sched: transition act_pedit to rcu and percpu stats
Fedor Pchelkin <[email protected]>
nfc: fix memory leak of se_io context in nfc_genl_se_io
Zhang Yi <[email protected]>
ext4: fix incorrect options show of original mount_opt and extend mount_opt2
Maor Dickman <[email protected]>
net/mlx5: Geneve, Fix handling of Geneve object id as error code
Roi Dayan <[email protected]>
net/mlx5e: Verify flow_source cap before using it
Maher Sanalla <[email protected]>
net/mlx5: ECPF, wait for VF pages only after disabling host PFs
Vadim Fedorenko <[email protected]>
mlx5: fix possible ptp queue fifo use-after-free
Vadim Fedorenko <[email protected]>
mlx5: fix skb leak while fifo resync and push
Krishna Yarlagadda <[email protected]>
spi: tegra210-quad: Fix validate combined sequence
Zhengchao Shao <[email protected]>
9p/rdma: unmap receive dma buffer in rdma_request()/post_recv()
Juergen Gross <[email protected]>
9p/xen: fix connection sequence
Juergen Gross <[email protected]>
9p/xen: fix version parsing
Eric Dumazet <[email protected]>
net: fix __dev_kfree_skb_any() vs drop monitor
Deepak R Varma <[email protected]>
octeontx2-pf: Use correct struct reference in test condition
Xin Long <[email protected]>
sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop
Sean Anderson <[email protected]>
net: sunhme: Fix region request
Geetha sowjanya <[email protected]>
octeontx2-pf: Recalculate UDP checksum for ptp 1-step sync packet
Matt Roper <[email protected]>
drm/i915/xelpmp: Consider GSI offset when doing MCR lookups
Lu Wei <[email protected]>
ipv6: Add lwtunnel encap size of all siblings in nexthop calculation
Randy Dunlap <[email protected]>
drm/i915: move a Kconfig symbol to unbreak the menu presentation
Íñigo Huguet <[email protected]>
ptp: vclock: use mutex to fix "sleep on atomic" bug
Randy Dunlap <[email protected]>
swiotlb: mark swiotlb_memblock_alloc() as __init
Pavel Tikhomirov <[email protected]>
netfilter: x_tables: fix percpu counter block leak on error path when creating new netns
Florian Westphal <[email protected]>
netfilter: ctnetlink: make event listener tracking global
Xin Long <[email protected]>
netfilter: xt_length: use skb len to match in length_mt6
Florian Westphal <[email protected]>
netfilter: ebtables: fix table blob use-after-free
Phil Sutter <[email protected]>
netfilter: ip6t_rpfilter: Fix regression with VRF interfaces
Florian Westphal <[email protected]>
netfilter: conntrack: fix rmmod double-free race
Hangyu Hua <[email protected]>
netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack()
George Cherian <[email protected]>
watchdog: sbsa_wdog: Make sure the timeout programming is within the limits
Li Hua <[email protected]>
watchdog: pcwd_usb: Fix attempting to access uninitialized memory
Chen Jun <[email protected]>
watchdog: Fix kmemleak in watchdog_cdev_register
ruanjinjie <[email protected]>
watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path
Fabrizio Castro <[email protected]>
watchdog: rzg2l_wdt: Handle TYPE-B reset for RZ/V2M
Lad Prabhakar <[email protected]>
watchdog: rzg2l_wdt: Issue a reset before we put the PM clocks
Daeho Jeong <[email protected]>
f2fs: synchronize atomic write aborts
Benjamin Berg <[email protected]>
um: virt-pci: properly remove PCI device from bus
Benjamin Berg <[email protected]>
um: virtio_uml: move device breaking into workqueue
Benjamin Berg <[email protected]>
um: virtio_uml: mark device as unregistered when breaking it
Benjamin Berg <[email protected]>
um: virtio_uml: free command if adding to virtqueue failed
Ammar Faizi <[email protected]>
x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: allow to fetch set elements when table has an owner
Wang Jianjian <[email protected]>
ext4: don't show commit interval if it is zero
Eric Biggers <[email protected]>
ext4: use ext4_fc_tl_mem in fast-commit replay path
Yangtao Li <[email protected]>
f2fs: fix to set ipu policy
Yangtao Li <[email protected]>
f2fs: introduce IS_F2FS_IPU_* macro
Stephen Boyd <[email protected]>
soc: qcom: stats: Populate all subsystem debugfs files
Chao Yu <[email protected]>
f2fs: fix to update age extent in f2fs_do_zero_range()
Chao Yu <[email protected]>
f2fs: fix to update age extent correctly during truncation
Yangtao Li <[email protected]>
f2fs: fix to avoid potential memory corruption in __update_iostat_latency()
Chao Yu <[email protected]>
f2fs: fix to handle F2FS_IOC_START_ATOMIC_REPLACE in f2fs_compat_ioctl()
Zhihao Cheng <[email protected]>
ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed
Zhihao Cheng <[email protected]>
ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
Zhihao Cheng <[email protected]>
ubi: fastmap: Fix missed fm_anchor PEB in wear-leveling after disabling fastmap
Zhihao Cheng <[email protected]>
ubifs: ubifs_releasepage: Remove ubifs_assert(0) to valid this process
Zhihao Cheng <[email protected]>
ubifs: ubifs_writepage: Mark page dirty after writing inode failed
Zhihao Cheng <[email protected]>
ubifs: dirty_cow_znode: Fix memleak in error handling path
Zhihao Cheng <[email protected]>
ubifs: Re-statistic cleaned znode count if commit failed
Yang Yingliang <[email protected]>
ubi: Fix possible null-ptr-deref in ubi_free_volume()
Li Zetao <[email protected]>
ubifs: Fix memory leak in alloc_wbufs()
Li Zetao <[email protected]>
ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()
Li Zetao <[email protected]>
ubi: Fix use-after-free when volume resizing failed
Zhihao Cheng <[email protected]>
ubifs: Reserve one leb for each journal head while doing budget
Zhihao Cheng <[email protected]>
ubifs: do_rename: Fix wrong space budget when target inode's nlink > 1
Zhihao Cheng <[email protected]>
ubifs: Fix wrong dirty space budget for dirty inode
Zhihao Cheng <[email protected]>
ubifs: Rectify space budget for ubifs_xrename()
Zhihao Cheng <[email protected]>
ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted
Liu Shixin <[email protected]>
ubifs: Fix memory leak in ubifs_sysfs_init()
Li Hua <[email protected]>
ubifs: Fix build errors as symbol undefined
George Kennedy <[email protected]>
ubi: ensure that VID header offset + VID header size <= alloc, size
Xiang Yang <[email protected]>
um: vector: Fix memory leak in vector_config
Chao Yu <[email protected]>
f2fs: fix to abort atomic write only during do_exist()
Yangtao Li <[email protected]>
f2fs: allow set compression option of files without blocks
Alexander Potapenko <[email protected]>
fs: f2fs: initialize fsdata in pagecache_write()
Chao Yu <[email protected]>
f2fs: fix to do sanity check on extent cache correctly
Shang XiaoJing <[email protected]>
soc: mediatek: mtk-svs: Use pm_runtime_resume_and_get() in svs_init01()
Roger Lu <[email protected]>
soc: mediatek: mtk-svs: reset svs when svs_resume() fail
Roger Lu <[email protected]>
soc: mediatek: mtk-svs: restore default voltages when svs_init02() fail
Chao Yu <[email protected]>
f2fs: clear atomic_write_task in f2fs_abort_atomic_write()
Chao Yu <[email protected]>
f2fs: introduce trace_f2fs_replace_atomic_write_block
Fabrice Gasnier <[email protected]>
pwm: stm32-lp: fix the check on arr and cmp registers update
Emil Renner Berthing <[email protected]>
pwm: sifive: Always let the first pwm_apply_state succeed
Ricardo Ribalda <[email protected]>
soc: mediatek: mtk-svs: Enable the IRQ later
Geert Uytterhoeven <[email protected]>
memory: renesas-rpc-if: Move resource acquisition to .probe()
Geert Uytterhoeven <[email protected]>
memory: renesas-rpc-if: Split-off private data from struct rpcif
Stephan Gerhold <[email protected]>
soc: qcom: socinfo: Fix soc_id order
Tinghan Shen <[email protected]>
soc: mediatek: mtk-pm-domains: Allow mt8186 ADSP default power on
Miaoqian Lin <[email protected]>
objtool: Fix memory leak in create_static_call_sections()
Chao Yu <[email protected]>
f2fs: fix to avoid potential deadlock
Christoph Hellwig <[email protected]>
f2fs: don't rely on F2FS_MAP_* in f2fs_iomap_begin
Gaosheng Cui <[email protected]>
driver: soc: xilinx: fix memory leak in xlnx_add_cb_for_notify_event()
Liu Shixin via Jfs-discussion <[email protected]>
fs/jfs: fix shift exponent db_agl2size negative
Jianglei Nie <[email protected]>
auxdisplay: hd44780: Fix potential memory leak in hd44780_remove()
Jamal Hadi Salim <[email protected]>
net/sched: Retire tcindex classifier
-------------
Diffstat:
Documentation/ABI/testing/configfs-usb-gadget-uvc | 2 +- .../devicetree/bindings/usb/genesys,gl850g.yaml | 1 + Makefile | 4 +- arch/arm/boot/dts/aspeed-bmc-ibm-bonnell.dts | 2 +- arch/arm/boot/dts/aspeed-bmc-ibm-everest.dts | 2 +- arch/arm/boot/dts/aspeed-bmc-ibm-rainier.dts | 2 +- arch/arm/boot/dts/spear320-hmi.dts | 2 +- arch/arm64/include/asm/efi.h | 6 +- arch/arm64/kernel/efi.c | 2 +- arch/mips/configs/mtx1_defconfig | 1 + arch/powerpc/configs/ppc6xx_defconfig | 1 + arch/um/drivers/vector_kern.c | 1 + arch/um/drivers/virt-pci.c | 26 +- arch/um/drivers/virtio_uml.c | 18 +- arch/x86/include/asm/resctrl.h | 12 +- arch/x86/kernel/cpu/resctrl/rdtgroup.c | 4 +- arch/x86/kernel/process_32.c | 2 +- arch/x86/kernel/process_64.c | 2 +- arch/x86/um/vdso/um_vdso.c | 12 +- drivers/acpi/device_pm.c | 19 + drivers/auxdisplay/hd44780.c | 2 + drivers/base/cacheinfo.c | 27 +- drivers/base/component.c | 2 +- drivers/base/dd.c | 2 +- drivers/block/loop.c | 8 +- drivers/bus/mhi/ep/main.c | 2 +- drivers/cpufreq/apple-soc-cpufreq.c | 4 +- drivers/firmware/efi/sysfb_efi.c | 8 + .../drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 2 +- drivers/gpu/drm/display/drm_dp_mst_topology.c | 71 +- drivers/gpu/drm/i915/Kconfig | 6 +- drivers/gpu/drm/i915/display/intel_display.c | 4 + drivers/gpu/drm/i915/display/intel_dp_mst.c | 75 +- drivers/gpu/drm/i915/display/intel_dp_mst.h | 4 + drivers/gpu/drm/i915/display/intel_fbdev.c | 8 +- drivers/gpu/drm/i915/gt/intel_gt_mcr.c | 5 +- drivers/gpu/drm/nouveau/dispnv50/disp.c | 2 +- drivers/iio/accel/mma9551_core.c | 10 +- drivers/infiniband/core/cma.c | 17 +- drivers/infiniband/hw/hfi1/chip.c | 59 +- drivers/iommu/iommu.c | 70 +- drivers/media/usb/uvc/uvc_ctrl.c | 5 + drivers/media/usb/uvc/uvc_driver.c | 90 +- drivers/media/usb/uvc/uvc_entity.c | 2 +- drivers/media/usb/uvc/uvc_status.c | 37 + drivers/media/usb/uvc/uvc_v4l2.c | 2 - drivers/media/usb/uvc/uvc_video.c | 15 +- drivers/media/usb/uvc/uvcvideo.h | 4 +- drivers/memory/renesas-rpc-if.c | 120 +- drivers/mfd/arizona-core.c | 2 +- drivers/misc/mei/bus-fixup.c | 8 +- drivers/misc/vmw_balloon.c | 2 +- drivers/mtd/ubi/build.c | 7 + drivers/mtd/ubi/fastmap-wl.c | 12 +- drivers/mtd/ubi/vmt.c | 18 +- drivers/mtd/ubi/wl.c | 25 +- drivers/net/dsa/ocelot/felix_vsc9959.c | 2 +- drivers/net/dsa/ocelot/seville_vsc9953.c | 4 +- drivers/net/ethernet/Kconfig | 10 + drivers/net/ethernet/Makefile | 1 + drivers/net/ethernet/fealnx.c | 1953 ++++++++++++++++++++ .../ethernet/marvell/octeontx2/nic/otx2_flows.c | 2 +- .../net/ethernet/marvell/octeontx2/nic/otx2_txrx.c | 76 +- drivers/net/ethernet/mellanox/mlx5/core/ecpf.c | 4 + drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c | 25 +- drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h | 4 +- drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 1 + drivers/net/ethernet/mellanox/mlx5/core/en_stats.h | 1 + .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 3 +- .../net/ethernet/mellanox/mlx5/core/lib/geneve.c | 1 + drivers/net/ethernet/mellanox/mlx5/core/sriov.c | 4 + drivers/net/ethernet/sun/sunhme.c | 6 +- drivers/net/mdio/mdio-mscc-miim.c | 9 +- drivers/nfc/st-nci/se.c | 6 + drivers/nfc/st21nfca/se.c | 6 + drivers/nvme/host/core.c | 35 +- drivers/nvme/host/fabrics.h | 3 +- drivers/nvme/host/tcp.c | 6 + drivers/pci/controller/pci-loongson.c | 71 +- drivers/pci/hotplug/pciehp_hpc.c | 2 + drivers/pci/pci-acpi.c | 45 +- drivers/pci/pci.c | 10 + drivers/pci/pcie/portdrv.c | 16 +- drivers/pci/quirks.c | 22 + drivers/pci/setup-bus.c | 236 ++- drivers/phy/rockchip/phy-rockchip-typec.c | 3 +- drivers/ptp/ptp_private.h | 2 +- drivers/ptp/ptp_vclock.c | 44 +- drivers/pwm/pwm-sifive.c | 8 +- drivers/pwm/pwm-stm32-lp.c | 2 +- drivers/rtc/interface.c | 2 +- drivers/rtc/rtc-sun6i.c | 16 +- drivers/scsi/ipr.c | 41 +- drivers/scsi/mpi3mr/mpi3mr.h | 10 +- drivers/scsi/mpi3mr/mpi3mr_fw.c | 75 +- drivers/scsi/mpi3mr/mpi3mr_transport.c | 2 +- drivers/soc/mediatek/mt8186-pm-domains.h | 4 +- drivers/soc/mediatek/mtk-svs.c | 48 +- drivers/soc/qcom/qcom_stats.c | 10 +- drivers/soc/qcom/socinfo.c | 6 +- drivers/soc/xilinx/xlnx_event_manager.c | 4 +- drivers/soundwire/bus_type.c | 9 +- drivers/soundwire/cadence_master.c | 43 +- drivers/soundwire/cadence_master.h | 13 +- drivers/spi/spi-tegra210-quad.c | 14 +- drivers/staging/emxx_udc/emxx_udc.c | 7 +- drivers/staging/pi433/pi433_if.c | 11 +- drivers/thermal/intel/Kconfig | 3 +- drivers/thermal/intel/intel_quark_dts_thermal.c | 12 +- drivers/tty/serial/fsl_lpuart.c | 24 +- drivers/tty/serial/pch_uart.c | 2 +- drivers/tty/serial/sc16is7xx.c | 51 +- drivers/tty/tty_io.c | 8 +- drivers/tty/vt/vc_screen.c | 4 +- drivers/usb/chipidea/debug.c | 2 +- drivers/usb/common/ulpi.c | 14 +- drivers/usb/core/usb.c | 2 +- drivers/usb/dwc3/core.h | 2 + drivers/usb/dwc3/debug.h | 3 + drivers/usb/dwc3/debugfs.c | 19 +- drivers/usb/dwc3/gadget.c | 4 +- drivers/usb/fotg210/fotg210-core.c | 2 + drivers/usb/fotg210/fotg210-hcd.c | 2 +- drivers/usb/gadget/function/uvc_configfs.c | 59 +- drivers/usb/gadget/udc/bcm63xx_udc.c | 2 +- drivers/usb/gadget/udc/gr_udc.c | 2 +- drivers/usb/gadget/udc/lpc32xx_udc.c | 2 +- drivers/usb/gadget/udc/pxa25x_udc.c | 2 +- drivers/usb/gadget/udc/pxa27x_udc.c | 2 +- drivers/usb/host/isp116x-hcd.c | 2 +- drivers/usb/host/isp1362-hcd.c | 2 +- drivers/usb/host/sl811-hcd.c | 2 +- drivers/usb/host/uhci-hcd.c | 6 +- drivers/usb/host/xhci-mvebu.c | 2 +- drivers/usb/storage/ene_ub6250.c | 2 +- drivers/vdpa/ifcvf/ifcvf_base.c | 30 +- drivers/vdpa/ifcvf/ifcvf_base.h | 6 +- drivers/vdpa/ifcvf/ifcvf_main.c | 139 +- drivers/watchdog/at91sam9_wdt.c | 7 +- drivers/watchdog/pcwd_usb.c | 6 +- drivers/watchdog/rzg2l_wdt.c | 45 +- drivers/watchdog/sbsa_gwdt.c | 1 + drivers/watchdog/watchdog_dev.c | 2 +- fs/ext4/ext4.h | 1 + fs/ext4/fast_commit.c | 44 +- fs/ext4/super.c | 30 +- fs/f2fs/data.c | 49 +- fs/f2fs/file.c | 60 +- fs/f2fs/inode.c | 23 +- fs/f2fs/iostat.c | 6 +- fs/f2fs/segment.c | 13 +- fs/f2fs/segment.h | 23 + fs/f2fs/super.c | 17 +- fs/f2fs/sysfs.c | 9 + fs/f2fs/verity.c | 2 +- fs/jfs/jfs_dmap.c | 3 +- fs/ubifs/budget.c | 9 +- fs/ubifs/dir.c | 9 +- fs/ubifs/file.c | 31 +- fs/ubifs/super.c | 17 +- fs/ubifs/sysfs.c | 2 + fs/ubifs/tnc.c | 24 +- fs/ubifs/ubifs.h | 5 + include/acpi/acpi_bus.h | 1 + include/drm/display/drm_dp_mst_helper.h | 6 +- include/linux/bootconfig.h | 2 +- include/linux/iommu.h | 2 + include/linux/mdio/mdio-mscc-miim.h | 2 +- include/linux/netfilter.h | 5 + include/linux/pci.h | 1 + include/linux/pci_ids.h | 2 + include/media/v4l2-uvc.h | 8 + include/memory/renesas-rpc-if.h | 16 - include/net/netns/conntrack.h | 1 - include/net/sctp/structs.h | 1 + include/net/tc_act/tc_pedit.h | 81 +- include/net/tc_wrapper.h | 5 - include/trace/events/f2fs.h | 37 + include/uapi/linux/usb/video.h | 30 + include/uapi/linux/uvcvideo.h | 2 +- io_uring/kbuf.c | 2 +- kernel/dma/swiotlb.c | 3 +- kernel/fail_function.c | 5 +- kernel/irq/ipi.c | 8 +- kernel/printk/index.c | 2 +- kernel/trace/ring_buffer.c | 7 +- net/9p/trans_rdma.c | 15 +- net/9p/trans_xen.c | 48 +- net/bridge/netfilter/ebtables.c | 2 +- net/core/dev.c | 4 +- net/ipv4/netfilter/arp_tables.c | 4 + net/ipv4/netfilter/ip_tables.c | 7 +- net/ipv4/tcp_minisocks.c | 7 +- net/ipv6/netfilter/ip6_tables.c | 7 +- net/ipv6/netfilter/ip6t_rpfilter.c | 4 +- net/ipv6/route.c | 11 +- net/netfilter/core.c | 3 + net/netfilter/nf_conntrack_bpf.c | 1 - net/netfilter/nf_conntrack_core.c | 25 +- net/netfilter/nf_conntrack_ecache.c | 2 +- net/netfilter/nf_conntrack_netlink.c | 8 +- net/netfilter/nf_tables_api.c | 2 +- net/netfilter/nfnetlink.c | 9 +- net/netfilter/xt_length.c | 3 +- net/nfc/netlink.c | 4 + net/sched/Kconfig | 11 - net/sched/Makefile | 1 - net/sched/act_mpls.c | 66 +- net/sched/act_pedit.c | 178 +- net/sched/act_sample.c | 11 +- net/sched/cls_tcindex.c | 742 -------- net/sctp/stream_sched_prio.c | 52 +- net/tls/tls_sw.c | 26 +- sound/soc/apple/mca.c | 31 +- sound/soc/codecs/Kconfig | 1 + sound/soc/codecs/adau7118.c | 19 +- sound/soc/mediatek/mt8195/mt8195-dai-etdm.c | 3 + tools/iio/iio_utils.c | 23 +- tools/objtool/check.c | 2 + tools/testing/selftests/netfilter/rpath.sh | 32 +- .../tc-testing/tc-tests/filters/tcindex.json | 227 --- 221 files changed, 4262 insertions(+), 2206 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/211 net/sched: Retire tcindex classifier
From: Jamal Hadi Salim <[email protected]>
commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28 upstream.
The tcindex classifier has served us well for about a quarter of a century but has not been getting much TLC due to lack of known users. Most recently it has become easy prey to syzkaller. For this reason, we are retiring it.
--- include/net/tc_wrapper.h | 5 net/sched/Kconfig | 11 net/sched/Makefile | 1 net/sched/cls_tcindex.c | 742 ---------- tools/testing/selftests/tc-testing/tc-tests/filters/tcindex.json | 227 --- 5 files changed, 986 deletions(-) delete mode 100644 net/sched/cls_tcindex.c delete mode 100644 tools/testing/selftests/tc-testing/tc-tests/filters/tcindex.json
include/net/tc_wrapper.h +0 -5
@@ -154,7 +154,6 @@ TC_INDIRECT_FILTER_DECLARE(mall_classifyTC_INDIRECT_FILTER_DECLARE (route4_classify);TC_INDIRECT_FILTER_DECLARE (rsvp_classify);TC_INDIRECT_FILTER_DECLARE (rsvp6_classify); -TC_INDIRECT_FILTER_DECLARE (tcindex_classify);TC_INDIRECT_FILTER_DECLARE (u32_classify); static inline int tc_classify(struct sk_buff *skb, const struct tcf_proto *tp,
@@ -207,10 +206,6 @@ static inline int tc_classify(struct sk_if (tp->classify == rsvp6_classify)return rsvp6_classify (skb, tp, res);#endif -#if IS_BUILTIN (CONFIG_NET_CLS_TCINDEX ) -if (tp->classify == tcindex_classify) -return tcindex_classify (skb, tp, res); -#endif skip:return tp->classify (skb, tp, res);
net/sched/Kconfig +0 -11
@@ -503,17 +503,6 @@ config NET_CLS_BASIC To compile this code as a module, choose M here: the module will be called cls_basic. -config NET_CLS_TCINDEX - tristate "Traffic-Control Index (TCINDEX)" - select NET_CLS - help - Say Y here if you want to be able to classify packets based on - traffic control indices. You will want this feature if you want - to implement Differentiated Services together with DSMARK. - - To compile this code as a module, choose M here: the - module will be called cls_tcindex. - config NET_CLS_ROUTE4 tristate "Routing decision (ROUTE)" depends on INET
net/sched/Makefile +0 -1
@@ -70,7 +70,6 @@ obj-$(CONFIG_NET_CLS_U32) += cls_u32.o obj-$(CONFIG_NET_CLS_ROUTE4) += cls_route.o obj-$(CONFIG_NET_CLS_FW) += cls_fw.o obj-$(CONFIG_NET_CLS_RSVP) += cls_rsvp.o -obj-$(CONFIG_NET_CLS_TCINDEX) += cls_tcindex.o obj-$(CONFIG_NET_CLS_RSVP6) += cls_rsvp6.o obj-$(CONFIG_NET_CLS_BASIC) += cls_basic.o obj-$(CONFIG_NET_CLS_FLOW) += cls_flow.o
net/sched/cls_tcindex.c deleted +0 -742
742 lines not on this page · raw message
tools/testing/selftests/tc-testing/tc-tests/filters/tcindex.json deleted +0 -227
227 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 2/211 auxdisplay: hd44780: Fix potential memory leak in hd44780_remove()
In reply to Greg Kroah-HartmanFrom: Jianglei Nie <[email protected]>
[ Upstream commit ddf75a86aba2cfb7ec4497e8692b60c8c8fe0ee7 ]
hd44780_probe() allocates a memory chunk for hd with kzalloc() and makes "lcd->drvdata->hd44780" point to it. When we call hd44780_remove(), we should release all relevant memory and resource. But "lcd->drvdata ->hd44780" is not released, which will lead to a memory leak.
We should release the "lcd->drvdata->hd44780" in hd44780_remove() to fix the memory leak bug.
--- drivers/auxdisplay/hd44780.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/auxdisplay/hd44780.c +2 -0
@@ -322,8 +322,10 @@ static int hd44780_probe(struct platform_device *pdev)static int hd44780_remove (struct platform_device *pdev) {struct charlcd *lcd =platform_get_drvdata (pdev); +struct hd44780_common *hdc = lcd->drvdata;charlcd_unregister (lcd); +kfree (hdc->hd44780);kfree (lcd->drvdata);kfree (lcd);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 3/211 fs/jfs: fix shift exponent db_agl2size negative
In reply to Greg Kroah-HartmanFrom: Liu Shixin via Jfs-discussion <[email protected]>
[ Upstream commit fad376fce0af58deebc5075b8539dc05bf639af3 ]
As a shift exponent, db_agl2size can not be less than 0. Add the missing check to fix the shift-out-of-bounds bug reported by syzkaller:
UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:2227:15 shift exponent -744642816 is negative
--- fs/jfs/jfs_dmap.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/jfs/jfs_dmap.c +2 -1
@@ -193,7 +193,8 @@ int dbMount(struct inode *ipbmap) bmp->db_agwidth =le32_to_cpu (dbmp_le->dn_agwidth); bmp->db_agstart =le32_to_cpu (dbmp_le->dn_agstart); bmp->db_agl2size =le32_to_cpu (dbmp_le->dn_agl2size); -if (bmp->db_agl2size >L2MAXL2SIZE -L2MAXAG ) { +if (bmp->db_agl2size >L2MAXL2SIZE -L2MAXAG || + bmp->db_agl2size <0 ) { err = -EINVAL ; goto err_release_metapage; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 4/211 driver: soc: xilinx: fix memory leak in xlnx_add_cb_for_notify_event()
In reply to Greg Kroah-HartmanFrom: Gaosheng Cui <[email protected]>
[ Upstream commit 1bea534991b9b35c41848a397666ada436456beb ]
The kfree() should be called when memory fails to be allocated for cb_data in xlnx_add_cb_for_notify_event(), otherwise there will be a memory leak, so add kfree() to fix it.
--- drivers/soc/xilinx/xlnx_event_manager.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/soc/xilinx/xlnx_event_manager.c +3 -1
@@ -116,8 +116,10 @@ static int xlnx_add_cb_for_notify_event(const u32 node_id, const u32 event, consINIT_LIST_HEAD (&eve_data->cb_list_head); cb_data =kmalloc (sizeof (*cb_data),GFP_KERNEL ); -if (!cb_data) +if (!cb_data) { +kfree (eve_data);return -ENOMEM ; + } cb_data->eve_cb = cb_fun; cb_data->agent_data = data;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 5/211 f2fs: dont rely on F2FS_MAP_* in f2fs_iomap_begin
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 8d3c1fa3fa5eacfd14f5b018eddb6c1a91c57783 ]
When testing with a mixed zoned / convention device combination, there are regular but not 100% reproducible failures in xfstests generic/113 where the __is_valid_data_blkaddr assert hits due to finding a hole.
This seems to be because f2fs_map_blocks can set this flag on a hole when it was found in the extent cache.
Rework f2fs_iomap_begin to just check the special block numbers directly. This has the added benefits of the WARN_ON showing which invalid block address we found, and being properly error out on delalloc blocks that are confusingly called unwritten but not actually suitable for direct I/O.
--- fs/f2fs/data.c | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-)
fs/f2fs/data.c +14 -10
@@ -4155,20 +4155,24 @@ static int f2fs_iomap_begin(struct inode *inode, loff_t offset, loff_t length,*/ map.m_len =fscrypt_limit_io_blocks (inode, map.m_lblk, map.m_len); -if (map.m_flags & (F2FS_MAP_MAPPED |F2FS_MAP_UNWRITTEN )) { - iomap->length =blks_to_bytes (inode, map.m_len); -if (map.m_flags &F2FS_MAP_MAPPED ) { - iomap->type =IOMAP_MAPPED ; - iomap->flags |=IOMAP_F_MERGED ; - }else { - iomap->type =IOMAP_UNWRITTEN ; - } -if (WARN_ON_ONCE (!__is_valid_data_blkaddr (map.m_pblk))) -return -EINVAL ; +/* +* We should never see delalloc or compressed extents here based on +* prior flushing and checks. +*/ +if (WARN_ON_ONCE (map.m_pblk ==NEW_ADDR )) +return -EINVAL ; +if (WARN_ON_ONCE (map.m_pblk ==COMPRESS_ADDR )) +return -EINVAL ; +if (map.m_pblk !=NULL_ADDR ) { + iomap->length =blks_to_bytes (inode, map.m_len); + iomap->type =IOMAP_MAPPED ; + iomap->flags |=IOMAP_F_MERGED ; iomap->bdev = map.m_bdev; iomap->addr =blks_to_bytes (inode, map.m_pblk); }else { +if (flags &IOMAP_WRITE ) +return -ENOTBLK ; iomap->length =blks_to_bytes (inode, next_pgofs) - iomap->offset; iomap->type =IOMAP_HOLE ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 6/211 f2fs: fix to avoid potential deadlock
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit 5eaac835f27f2de6b73412d7c24e755733b49de0 ]
There is a potential deadlock reported by syzbot as below:
F2FS-fs (loop2): invalid crc value
F2FS-fs (loop2): Found nat_bits in checkpoint
F2FS-fs (loop2): Mounted with checkpoint version = 48b305e4
======================================================
WARNING: possible circular locking dependency detected 6.1.0-rc8-syzkaller-33330-ga5541c0811a0 #0 Not tainted
------------------------------------------------------
syz-executor.2/32123 is trying to acquire lock:ffff0000c0e1a608 (&mm->mmap_lock){++++}-{3:3}, at: __might_fault+0x54/0xb4 mm/memory.c:5644
but task is already holding lock:ffff0001317c6088 (&sbi->sb_lock){++++}-{3:3}, at: f2fs_down_write fs/f2fs/f2fs.h:2205 [inline] ffff0001317c6088 (&sbi->sb_lock){++++}-{3:3}, at: f2fs_ioc_get_encryption_pwsalt fs/f2fs/file.c:2334 [inline] ffff0001317c6088 (&sbi->sb_lock){++++}-{3:3}, at: __f2fs_ioctl+0x1370/0x3318 fs/f2fs/file.c:4151
which lock already depends on the new lock.
Chain exists of: &mm->mmap_lock --> &nm_i->nat_tree_lock --> &sbi->sb_lock Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&sbi->sb_lock);
lock(&nm_i->nat_tree_lock);
lock(&sbi->sb_lock); lock(&mm->mmap_lock);
Let's try to avoid above deadlock condition by moving __might_fault() out of sbi->sb_lock coverage.
--- fs/f2fs/file.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
fs/f2fs/file.c +6 -3
@@ -2338,6 +2338,7 @@ static int f2fs_ioc_get_encryption_pwsalt(struct file *filp, unsigned long arg) {struct inode *inode =file_inode (filp);struct f2fs_sb_info *sbi =F2FS_I_SB (inode); +u8 encrypt_pw_salt[16 ];int err;if (!f2fs_sb_has_encrypt (sbi))
@@ -2362,12 +2363,14 @@ static int f2fs_ioc_get_encryption_pwsalt(struct file *filp, unsigned long arg) goto out_err; } got_it: -if (copy_to_user ((__u8 __user *)arg, sbi->raw_super->encrypt_pw_salt, -16 )) - err = -EFAULT ; +memcpy (encrypt_pw_salt, sbi->raw_super->encrypt_pw_salt,16 ); out_err:f2fs_up_write (&sbi->sb_lock);mnt_drop_write_file (filp); + +if (!err &©_to_user ((__u8 __user *)arg, encrypt_pw_salt,16 )) + err = -EFAULT ; +return err; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 7/211 objtool: Fix memory leak in create_static_call_sections()
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 3da73f102309fe29150e5c35acd20dd82063ff67 ]
strdup() allocates memory for key_name. We need to release the memory in the following error paths. Add free() to avoid memory leak.
--- tools/objtool/check.c | 2 ++ 1 file changed, 2 insertions(+)
tools/objtool/check.c +2 -0
@@ -688,6 +688,7 @@ static int create_static_call_sections(struct objtool_file *file)if (strncmp (key_name,STATIC_CALL_TRAMP_PREFIX_STR ,STATIC_CALL_TRAMP_PREFIX_LEN )) {WARN ("static_call: trampoline name malformed: %s" , key_name); +free (key_name);return -1 ; } tmp = key_name +STATIC_CALL_TRAMP_PREFIX_LEN -STATIC_CALL_KEY_PREFIX_LEN ;
@@ -697,6 +698,7 @@ static int create_static_call_sections(struct objtool_file *file)if (!key_sym) {if (!opts.module) {WARN ("static_call: can't find static_call_key symbol: %s" , tmp); +free (key_name);return -1 ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 8/211 soc: mediatek: mtk-pm-domains: Allow mt8186 ADSP default power on
In reply to Greg Kroah-HartmanFrom: Tinghan Shen <[email protected]>
[ Upstream commit 0d08c56d97a614f56d74f490d693faf8038db125 ]
In the use case of configuring the access permissions of the ADSP core, the mt8186 SoC ADSP power will be switched on in the bootloader because the permission control registers are located in the ADSP subsys.
--- drivers/soc/mediatek/mt8186-pm-domains.h | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/soc/mediatek/mt8186-pm-domains.h +1 -3
@@ -304,7 +304,6 @@ static const struct scpsys_domain_data scpsys_domain_data_mt8186[] = { .ctl_offs = 0x9FC, .pwr_sta_offs = 0x16C, .pwr_sta2nd_offs = 0x170, - .caps = MTK_SCPD_KEEP_DEFAULT_OFF, }, [MT8186_POWER_DOMAIN_ADSP_INFRA] = { .name = "adsp_infra",
@@ -312,7 +311,6 @@ static const struct scpsys_domain_data scpsys_domain_data_mt8186[] = { .ctl_offs = 0x9F8, .pwr_sta_offs = 0x16C, .pwr_sta2nd_offs = 0x170, - .caps = MTK_SCPD_KEEP_DEFAULT_OFF, }, [MT8186_POWER_DOMAIN_ADSP_TOP] = { .name = "adsp_top",
@@ -332,7 +330,7 @@ static const struct scpsys_domain_data scpsys_domain_data_mt8186[] = { MT8186_TOP_AXI_PROT_EN_3_CLR, MT8186_TOP_AXI_PROT_EN_3_STA), }, - .caps = MTK_SCPD_SRAM_ISO | MTK_SCPD_KEEP_DEFAULT_OFF | MTK_SCPD_ACTIVE_WAKEUP, + .caps = MTK_SCPD_SRAM_ISO | MTK_SCPD_ACTIVE_WAKEUP, }, };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 9/211 soc: qcom: socinfo: Fix soc_id order
In reply to Greg Kroah-HartmanFrom: Stephan Gerhold <[email protected]>
[ Upstream commit 017a7c11a8a29e266aa40c6d1bf2ba83f880f719 ]
The soc_id array is mostly ordered by the numeric "msm-id" defined in qcom,ids.h but some recent entries were added at the wrong place.
While it does not make a functional difference it does make it harder to regenerate the entire array after adding a bunch of new IDs.
--- drivers/soc/qcom/socinfo.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/soc/qcom/socinfo.c +3 -3
@@ -250,8 +250,6 @@ static const struct soc_id soc_id[] = { { qcom_board_id(MSM8926) }, { qcom_board_id(MSM8326) }, { qcom_board_id(MSM8916) }, - { qcom_board_id(MSM8956) }, - { qcom_board_id(MSM8976) }, { qcom_board_id(MSM8994) }, { qcom_board_id_named(APQ8074PRO_AA, "APQ8074PRO-AA") }, { qcom_board_id_named(APQ8074PRO_AB, "APQ8074PRO-AB") },
@@ -283,6 +281,8 @@ static const struct soc_id soc_id[] = { { qcom_board_id(MSM8616) }, { qcom_board_id(MSM8992) }, { qcom_board_id(APQ8094) }, + { qcom_board_id(MSM8956) }, + { qcom_board_id(MSM8976) }, { qcom_board_id(MDM9607) }, { qcom_board_id(APQ8096) }, { qcom_board_id(MSM8998) },
@@ -341,7 +341,6 @@ static const struct soc_id soc_id[] = { { qcom_board_id(IPQ6005) }, { qcom_board_id(QRB5165) }, { qcom_board_id(SM8450) }, - { qcom_board_id(SM8550) }, { qcom_board_id(SM7225) }, { qcom_board_id(SA8295P) }, { qcom_board_id(SA8540P) },
@@ -352,6 +351,7 @@ static const struct soc_id soc_id[] = { { qcom_board_id(SC7280) }, { qcom_board_id(SC7180P) }, { qcom_board_id(SM6375) }, + { qcom_board_id(SM8550) }, { qcom_board_id(QRU1000) }, { qcom_board_id(QDU1000) }, { qcom_board_id(QDU1010) },
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 10/211 memory: renesas-rpc-if: Split-off private data from struct rpcif
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit 51de3fc9a84d8e99dd3f02536a623f9fb95d0c0a ]
The rpcif structure is used as a common data structure, shared by the RPC-IF core driver and by the HyperBus and SPI child drivers. This poses several problems:
- Most structure members describe private core driver state, which should not be accessible by the child drivers,
- The structure's lifetime is controlled by the child drivers, complicating use by the core driver.
Fix this by moving the private core driver state to its own structure, managed by the RPC-IF core driver, and store it in the core driver's private data field. This requires absorbing the child's platform device, as that was stored in the driver's private data field before.
--- drivers/memory/renesas-rpc-if.c | 75 +++++++++++++++++++++++++-------- include/memory/renesas-rpc-if.h | 16 ------- 2 files changed, 57 insertions(+), 34 deletions(-)
drivers/memory/renesas-rpc-if.c +57 -18
@@ -163,14 +163,36 @@ static const struct regmap_access_table rpcif_volatile_table = { .n_yes_ranges = ARRAY_SIZE(rpcif_volatile_ranges), }; +struct rpcif_priv { +struct device *dev; +void __iomem *base; +void __iomem *dirmap; +struct regmap *regmap; +struct reset_control *rstc; +struct platform_device *vdev; +size_t size; +enum rpcif_type type; +enum rpcif_data_dir dir; +u8 bus_size; +u8 xfer_size; +void *buffer; +u32 xferlen; +u32 smcr; +u32 smadr; +u32 command;/* DRCMR or SMCMR */ +u32 option;/* DROPR or SMOPR */ +u32 enable;/* DRENR or SMENR */ +u32 dummy;/* DRDMCR or SMDMCR */ +u32 ddr;/* DRDRENR or SMDRENR */ +};/* * Custom accessor functions to ensure SM[RW]DR[01] are always accessed with -* proper width. Requires rpcif.xfer_size to be correctly set before! +* proper width. Requires rpcif_priv.xfer_size to be correctly set before! */ static int rpcif_reg_read (void *context,unsigned int reg,unsigned int *val) { -struct rpcif *rpc = context; +struct rpcif_priv *rpc = context;switch (reg) {case RPCIF_SMRDR0 :
@@ -206,7 +228,7 @@ static int rpcif_reg_read(void *context, unsigned int reg, unsigned int *val)static int rpcif_reg_write (void *context,unsigned int reg,unsigned int val) { -struct rpcif *rpc = context; +struct rpcif_priv *rpc = context;switch (reg) {case RPCIF_SMWDR0 :
@@ -253,13 +275,12 @@ static const struct regmap_config rpcif_regmap_config = { .volatile_table = &rpcif_volatile_table, }; -int rpcif_sw_init (struct rpcif *rpc,struct device *dev) +int rpcif_sw_init (struct rpcif *rpcif,struct device *dev) {struct platform_device *pdev =to_platform_device (dev); +struct rpcif_priv *rpc =dev_get_drvdata (dev);struct resource *res; - rpc->dev = dev; - rpc->base =devm_platform_ioremap_resource_byname (pdev,"regs" );if (IS_ERR (rpc->base))return PTR_ERR (rpc->base);
@@ -280,12 +301,17 @@ int rpcif_sw_init(struct rpcif *rpc, struct device *dev) rpc->type = (uintptr_t )of_device_get_match_data (dev); rpc->rstc =devm_reset_control_get_exclusive (&pdev->dev,NULL ); +if (IS_ERR (rpc->rstc)) +return PTR_ERR (rpc->rstc); -return PTR_ERR_OR_ZERO (rpc->rstc); + rpcif->dev = dev; + rpcif->dirmap = rpc->dirmap; + rpcif->size = rpc->size; +return 0 ; }EXPORT_SYMBOL (rpcif_sw_init); -static void rpcif_rzg2l_timing_adjust_sdr (struct rpcif *rpc) +static void rpcif_rzg2l_timing_adjust_sdr (struct rpcif_priv *rpc) {regmap_write (rpc->regmap,RPCIF_PHYWR ,0xa5390000 );regmap_write (rpc->regmap,RPCIF_PHYADD ,0x80000000 );
@@ -299,8 +325,9 @@ static void rpcif_rzg2l_timing_adjust_sdr(struct rpcif *rpc)regmap_write (rpc->regmap,RPCIF_PHYADD ,0x80000032 ); } -int rpcif_hw_init (struct rpcif *rpc,bool hyperflash) +int rpcif_hw_init (struct rpcif *rpcif,bool hyperflash) { +struct rpcif_priv *rpc =dev_get_drvdata (rpcif->dev);u32 dummy;pm_runtime_get_sync (rpc->dev);
@@ -364,7 +391,7 @@ int rpcif_hw_init(struct rpcif *rpc, bool hyperflash) }EXPORT_SYMBOL (rpcif_hw_init); -static int wait_msg_xfer_end (struct rpcif *rpc) +static int wait_msg_xfer_end (struct rpcif_priv *rpc) {u32 sts;
@@ -373,7 +400,7 @@ static int wait_msg_xfer_end(struct rpcif *rpc) USEC_PER_SEC); } -static u8 rpcif_bits_set (struct rpcif *rpc,u32 nbytes) +static u8 rpcif_bits_set (struct rpcif_priv *rpc,u32 nbytes) {if (rpc->bus_size ==2 ) nbytes /=2 ;
@@ -386,9 +413,11 @@ static u8 rpcif_bit_size(u8 buswidth)return buswidth >4 ?2 :ilog2 (buswidth); } -void rpcif_prepare (struct rpcif *rpc,const struct rpcif_op *op,u64 *offs, +void rpcif_prepare (struct rpcif *rpcif,const struct rpcif_op *op,u64 *offs,size_t *len) { +struct rpcif_priv *rpc =dev_get_drvdata (rpcif->dev); + rpc->smcr =0 ; rpc->smadr =0 ; rpc->enable =0 ;
@@ -472,8 +501,9 @@ void rpcif_prepare(struct rpcif *rpc, const struct rpcif_op *op, u64 *offs, }EXPORT_SYMBOL (rpcif_prepare); -int rpcif_manual_xfer (struct rpcif *rpc) +int rpcif_manual_xfer (struct rpcif *rpcif) { +struct rpcif_priv *rpc =dev_get_drvdata (rpcif->dev);u32 smenr, smcr, pos =0 , max = rpc->bus_size ==2 ?8 :4 ;int ret =0 ;
@@ -593,7 +623,7 @@ int rpcif_manual_xfer(struct rpcif *rpc) err_out:if (reset_control_reset (rpc->rstc))dev_err (rpc->dev,"Failed to reset HW\n" ); -rpcif_hw_init (rpc, rpc->bus_size ==2 ); +rpcif_hw_init (rpcif, rpc->bus_size ==2 ); goto exit; }EXPORT_SYMBOL (rpcif_manual_xfer);
@@ -640,8 +670,9 @@ static void memcpy_fromio_readw(void *to, } } -ssize_t rpcif_dirmap_read (struct rpcif *rpc,u64 offs,size_t len,void *buf) +ssize_t rpcif_dirmap_read (struct rpcif *rpcif,u64 offs,size_t len,void *buf) { +struct rpcif_priv *rpc =dev_get_drvdata (rpcif->dev);loff_t from = offs & (rpc->size -1 );size_t size = rpc->size - from;
@@ -676,6 +707,7 @@ static int rpcif_probe(struct platform_device *pdev) {struct platform_device *vdev;struct device_node *flash; +struct rpcif_priv *rpc;const char *name;int ret;
@@ -696,11 +728,18 @@ static int rpcif_probe(struct platform_device *pdev) }of_node_put (flash); + rpc =devm_kzalloc (&pdev->dev,sizeof (*rpc),GFP_KERNEL ); +if (!rpc) +return -ENOMEM ; + vdev =platform_device_alloc (name, pdev->id);if (!vdev)return -ENOMEM ; vdev->dev.parent = &pdev->dev; -platform_set_drvdata (pdev, vdev); + + rpc->dev = &pdev->dev; + rpc->vdev = vdev; +platform_set_drvdata (pdev, rpc); ret =platform_device_add (vdev);if (ret) {
@@ -713,9 +752,9 @@ static int rpcif_probe(struct platform_device *pdev)static int rpcif_remove (struct platform_device *pdev) { -struct platform_device *vdev =platform_get_drvdata (pdev); +struct rpcif_priv *rpc =platform_get_drvdata (pdev); -platform_device_unregister (vdev); +platform_device_unregister (rpc->vdev);return 0 ; }
include/memory/renesas-rpc-if.h +0 -16
@@ -65,24 +65,8 @@ enum rpcif_type {struct rpcif {struct device *dev; -void __iomem *base;void __iomem *dirmap; -struct regmap *regmap; -struct reset_control *rstc;size_t size; -enum rpcif_type type; -enum rpcif_data_dir dir; -u8 bus_size; -u8 xfer_size; -void *buffer; -u32 xferlen; -u32 smcr; -u32 smadr; -u32 command;/* DRCMR or SMCMR */ -u32 option;/* DROPR or SMOPR */ -u32 enable;/* DRENR or SMENR */ -u32 dummy;/* DRDMCR or SMDMCR */ -u32 ddr;/* DRDRENR or SMDRENR */ };int rpcif_sw_init (struct rpcif *rpc,struct device *dev);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 11/211 memory: renesas-rpc-if: Move resource acquisition to .probe()
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit 8b3580df15f53045fda3ffae53f74575c96aa77e ]
While the acquired resources are tied to the lifetime of the RPC-IF core device (through the use of managed resource functions), the actual resource acquisition is triggered from the HyperBus and SPI child drivers. Due to this mismatch, unbinding and rebinding the child drivers manually fails with -EBUSY:
# echo rpc-if-hyperflash > /sys/bus/platform/drivers/rpc-if-hyperflash/unbind
# echo rpc-if-hyperflash > /sys/bus/platform/drivers/rpc-if-hyperflash/bind
rpc-if ee200000.spi: can't request region for resource [mem 0xee200000-0xee2001ff]
rpc-if-hyperflash: probe of rpc-if-hyperflash failed with error -16The same is true for rpc-if-spi.
Fix this by moving all resource acquisition to the core driver's probe routine.
--- drivers/memory/renesas-rpc-if.c | 49 ++++++++++++++++----------------- 1 file changed, 24 insertions(+), 25 deletions(-)
drivers/memory/renesas-rpc-if.c +24 -25
@@ -277,32 +277,7 @@ static const struct regmap_config rpcif_regmap_config = {int rpcif_sw_init (struct rpcif *rpcif,struct device *dev) { -struct platform_device *pdev =to_platform_device (dev);struct rpcif_priv *rpc =dev_get_drvdata (dev); -struct resource *res; - - rpc->base =devm_platform_ioremap_resource_byname (pdev,"regs" ); -if (IS_ERR (rpc->base)) -return PTR_ERR (rpc->base); - - rpc->regmap =devm_regmap_init (&pdev->dev,NULL , rpc, &rpcif_regmap_config); -if (IS_ERR (rpc->regmap)) { -dev_err (&pdev->dev, -"failed to init regmap for rpcif, error %ld\n" , -PTR_ERR (rpc->regmap)); -return PTR_ERR (rpc->regmap); - } - - res =platform_get_resource_byname (pdev,IORESOURCE_MEM ,"dirmap" ); - rpc->dirmap =devm_ioremap_resource (&pdev->dev, res); -if (IS_ERR (rpc->dirmap)) -return PTR_ERR (rpc->dirmap); - rpc->size =resource_size (res); - - rpc->type = (uintptr_t )of_device_get_match_data (dev); - rpc->rstc =devm_reset_control_get_exclusive (&pdev->dev,NULL ); -if (IS_ERR (rpc->rstc)) -return PTR_ERR (rpc->rstc); rpcif->dev = dev; rpcif->dirmap = rpc->dirmap;
@@ -705,9 +680,11 @@ EXPORT_SYMBOL(rpcif_dirmap_read);static int rpcif_probe (struct platform_device *pdev) { +struct device *dev = &pdev->dev;struct platform_device *vdev;struct device_node *flash;struct rpcif_priv *rpc; +struct resource *res;const char *name;int ret;
@@ -732,6 +709,28 @@ static int rpcif_probe(struct platform_device *pdev)if (!rpc)return -ENOMEM ; + rpc->base =devm_platform_ioremap_resource_byname (pdev,"regs" ); +if (IS_ERR (rpc->base)) +return PTR_ERR (rpc->base); + + rpc->regmap =devm_regmap_init (dev,NULL , rpc, &rpcif_regmap_config); +if (IS_ERR (rpc->regmap)) { +dev_err (dev,"failed to init regmap for rpcif, error %ld\n" , +PTR_ERR (rpc->regmap)); +return PTR_ERR (rpc->regmap); + } + + res =platform_get_resource_byname (pdev,IORESOURCE_MEM ,"dirmap" ); + rpc->dirmap =devm_ioremap_resource (dev, res); +if (IS_ERR (rpc->dirmap)) +return PTR_ERR (rpc->dirmap); + rpc->size =resource_size (res); + + rpc->type = (uintptr_t )of_device_get_match_data (dev); + rpc->rstc =devm_reset_control_get_exclusive (dev,NULL ); +if (IS_ERR (rpc->rstc)) +return PTR_ERR (rpc->rstc); + vdev =platform_device_alloc (name, pdev->id);if (!vdev)return -ENOMEM ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 12/211 soc: mediatek: mtk-svs: Enable the IRQ later
In reply to Greg Kroah-HartmanFrom: Ricardo Ribalda <[email protected]>
[ Upstream commit b74952aba6c3f47e7f2c5165abaeefa44c377140 ]
If the system does not come from reset (like when is booted via kexec()), the peripheral might triger an IRQ before the data structures are initialised.
Fixes:
[ 0.227710] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000f08 [ 0.227913] Call trace: [ 0.227918] svs_isr+0x8c/0x538
--- drivers/soc/mediatek/mtk-svs.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/soc/mediatek/mtk-svs.c +8 -8
@@ -2385,14 +2385,6 @@ static int svs_probe(struct platform_device *pdev) goto svs_probe_free_resource; } - ret =devm_request_threaded_irq (svsp->dev, svsp_irq,NULL , svs_isr, -IRQF_ONESHOT , svsp->name, svsp); -if (ret) { -dev_err (svsp->dev,"register irq(%d) failed: %d\n" , - svsp_irq, ret); - goto svs_probe_free_resource; - } - svsp->main_clk =devm_clk_get (svsp->dev,"main" );if (IS_ERR (svsp->main_clk)) { dev_err(svsp->dev, "failed to get clock: %ld\n",
@@ -2414,6 +2406,14 @@ static int svs_probe(struct platform_device *pdev) goto svs_probe_clk_disable; } + ret =devm_request_threaded_irq (svsp->dev, svsp_irq,NULL , svs_isr, +IRQF_ONESHOT , svsp->name, svsp); +if (ret) { +dev_err (svsp->dev,"register irq(%d) failed: %d\n" , + svsp_irq, ret); + goto svs_probe_iounmap; + } + ret =svs_start (svsp);if (ret) {dev_err (svsp->dev,"svs start fail: %d\n" , ret);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 13/211 pwm: sifive: Always let the first pwm_apply_state succeed
In reply to Greg Kroah-HartmanFrom: Emil Renner Berthing <[email protected]>
[ Upstream commit 334c7b13d38321e47d1a51dba0bef9f4c403ec75 ]
Commit 2cfe9bbec56ea579135cdd92409fff371841904f added support for the RGB and green PWM controlled LEDs on the HiFive Unmatched board managed by the leds-pwm-multicolor and leds-pwm drivers respectively. All three colours of the RGB LED and the green LED run from different lines of the same PWM, but with the same period so this works fine when the LED drivers are loaded one after the other.
Unfortunately it does expose a race in the PWM driver when both LED drivers are loaded at roughly the same time. Here is an example:
| Thread A | Thread B | | led_pwm_mc_probe | led_pwm_probe | | devm_fwnode_pwm_get | | | pwm_sifive_request | | | ddata->user_count++ | | | | devm_fwnode_pwm_get | | | pwm_sifive_request | | | ddata->user_count++ | | ... | ... | | pwm_state_apply | pwm_state_apply | | pwm_sifive_apply | pwm_sifive_apply |
Now both calls to pwm_sifive_apply will see that ddata->approx_period, initially 0, is different from the requested period and the clock needs to be updated. But since ddata->user_count >= 2 both calls will fail with -EBUSY, which will then cause both LED drivers to fail to probe.
Fix it by letting the first call to pwm_sifive_apply update the clock even when ddata->user_count != 1.
--- drivers/pwm/pwm-sifive.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/pwm/pwm-sifive.c +7 -1
@@ -161,7 +161,13 @@ static int pwm_sifive_apply(struct pwm_chip *chip, struct pwm_device *pwm,mutex_lock (&ddata->lock);if (state->period != ddata->approx_period) { -if (ddata->user_count !=1 ) { +/* +* Don't let a 2nd user change the period underneath the 1st user. +* However if ddate->approx_period == 0 this is the first time we set +* any period, so let whoever gets here first set the period so other +* users who agree on the period won't fail. +*/ +if (ddata->user_count !=1 && ddata->approx_period) {mutex_unlock (&ddata->lock);return -EBUSY ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 14/211 pwm: stm32-lp: fix the check on arr and cmp registers update
In reply to Greg Kroah-HartmanFrom: Fabrice Gasnier <[email protected]>
[ Upstream commit 3066bc2d58be31275afb51a589668f265e419c37 ]
The ARR (auto reload register) and CMP (compare) registers are successively written. The status bits to check the update of these registers are polled together with regmap_read_poll_timeout(). The condition to end the loop may become true, even if one of the register isn't correctly updated.
So ensure both status bits are set before clearing them.
--- drivers/pwm/pwm-stm32-lp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pwm/pwm-stm32-lp.c +1 -1
@@ -127,7 +127,7 @@ static int stm32_pwm_lp_apply(struct pwm_chip *chip, struct pwm_device *pwm,/* ensure CMP & ARR registers are properly written */ ret =regmap_read_poll_timeout (priv->regmap,STM32_LPTIM_ISR , val, - (val &STM32_LPTIM_CMPOK_ARROK ), + (val &STM32_LPTIM_CMPOK_ARROK ) ==STM32_LPTIM_CMPOK_ARROK ,100 ,1000 );if (ret) {dev_err (priv->chip.dev,"ARR/CMP registers write issue\n" );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 15/211 f2fs: introduce trace_f2fs_replace_atomic_write_block
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit 2f3a9ae990a7881c9a57a073bb52ebe34fdc3160 ]
Commit 3db1de0e582c ("f2fs: change the current atomic write way") removed old tracepoints, but it missed to add new one, this patch fixes to introduce trace_f2fs_replace_atomic_write_block to trace atomic_write commit flow.
--- fs/f2fs/segment.c | 3 +++ include/trace/events/f2fs.h | 37 +++++++++++++++++++++++++++++++++++++ 2 files changed, 40 insertions(+)
fs/f2fs/segment.c +3 -0
@@ -255,6 +255,9 @@ static int __replace_atomic_write_block(struct inode *inode, pgoff_t index, }f2fs_put_dnode (&dn); + +trace_f2fs_replace_atomic_write_block (inode,F2FS_I (inode)->cow_inode, + index, *old_addr, new_addr, recover);return 0 ; }
include/trace/events/f2fs.h +37 -0
@@ -1293,6 +1293,43 @@ DEFINE_EVENT(f2fs__page, f2fs_vm_page_mkwrite,TP_ARGS (page, type) ); +TRACE_EVENT (f2fs_replace_atomic_write_block, + + TP_PROTO(struct inode *inode, struct inode *cow_inode, pgoff_t index, + block_t old_addr, block_t new_addr, bool recovery), + +TP_ARGS (inode, cow_inode, index, old_addr, new_addr, recovery), + +TP_STRUCT__entry ( + __field(dev_t, dev) + __field(ino_t, ino) + __field(ino_t, cow_ino) + __field(pgoff_t, index) + __field(block_t, old_addr) + __field(block_t, new_addr) +__field (bool, recovery) + ), + +TP_fast_assign ( + __entry->dev = inode->i_sb->s_dev; + __entry->ino = inode->i_ino; + __entry->cow_ino = cow_inode->i_ino; + __entry->index = index; + __entry->old_addr = old_addr; + __entry->new_addr = new_addr; + __entry->recovery = recovery; + ), + +TP_printk ("dev = (%d,%d), ino = %lu, cow_ino = %lu, index = %lu, " +"old_addr = 0x%llx, new_addr = 0x%llx, recovery = %d" , +show_dev_ino (__entry), + __entry->cow_ino, + (unsigned long )__entry->index, + (unsigned long long )__entry->old_addr, + (unsigned long long )__entry->new_addr, + __entry->recovery) +); + TRACE_EVENT(f2fs_filemap_fault, TP_PROTO(struct inode *inode, pgoff_t index, unsigned long ret),
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 16/211 f2fs: clear atomic_write_task in f2fs_abort_atomic_write()
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit 0e8d040bfa4c476d7d2a23119527c744c7de13cd ]
Otherwise, last .atomic_write_task will be remained in structure f2fs_inode_info, resulting in aborting atomic_write accidentally in race case. Meanwhile, clear original_i_size as well.
--- fs/f2fs/segment.c | 3 +++ 1 file changed, 3 insertions(+)
fs/f2fs/segment.c +3 -0
@@ -201,9 +201,12 @@ void f2fs_abort_atomic_write(struct inode *inode, bool clean)clear_inode_flag (inode,FI_ATOMIC_FILE );stat_dec_atomic_inode (inode); +F2FS_I (inode)->atomic_write_task =NULL ; +if (clean) {truncate_inode_pages_final (inode->i_mapping);f2fs_i_size_write (inode, fi->original_i_size); + fi->original_i_size =0 ; } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 17/211 soc: mediatek: mtk-svs: restore default voltages when svs_init02() fail
In reply to Greg Kroah-HartmanFrom: Roger Lu <[email protected]>
[ Upstream commit a0674cd237fc24b08c7dcb4f8e48df3ee769293a ]
If svs init02 fail, it means we cannot rely on svs bank voltages anymore. We need to disable svs function and restore DVFS opp voltages back to the default voltages for making sure we have enough DVFS voltages.
--- drivers/soc/mediatek/mtk-svs.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-)
drivers/soc/mediatek/mtk-svs.c +22 -2
@@ -1461,6 +1461,7 @@ static int svs_init02(struct svs_platform *svsp) {struct svs_bank *svsb;unsigned long flags, time_left; +int ret;u32 idx;for (idx =0 ; idx < svsp->bank_max; idx++) {
@@ -1479,7 +1480,8 @@ static int svs_init02(struct svs_platform *svsp) msecs_to_jiffies(5000));if (!time_left) {dev_err (svsb->dev,"init02 completion timeout\n" ); -return -EBUSY ; + ret = -EBUSY ; + goto out_of_init02; } }
@@ -1497,12 +1499,30 @@ static int svs_init02(struct svs_platform *svsp)if (svsb->type ==SVSB_HIGH || svsb->type ==SVSB_LOW ) {if (svs_sync_bank_volts_from_opp (svsb)) {dev_err (svsb->dev,"sync volt fail\n" ); -return -EPERM ; + ret = -EPERM ; + goto out_of_init02; } } }return 0 ; + +out_of_init02: +for (idx =0 ; idx < svsp->bank_max; idx++) { + svsb = &svsp->banks[idx]; + +spin_lock_irqsave (&svs_lock, flags); + svsp->pbank = svsb; +svs_switch_bank (svsp); +svs_writel_relaxed (svsp,SVSB_PTPEN_OFF ,SVSEN ); +svs_writel_relaxed (svsp,SVSB_INTSTS_VAL_CLEAN ,INTSTS ); +spin_unlock_irqrestore (&svs_lock, flags); + + svsb->phase =SVSB_PHASE_ERROR ; +svs_adjust_pm_opp_volts (svsb); + } + +return ret; }static void svs_mon_mode (struct svs_platform *svsp)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 18/211 soc: mediatek: mtk-svs: reset svs when svs_resume() fail
In reply to Greg Kroah-HartmanFrom: Roger Lu <[email protected]>
[ Upstream commit f4f8ad204a15d57c1a3e8ea7eca62157b44cbf59 ]
Add svs reset when svs_resume() fail.
--- drivers/soc/mediatek/mtk-svs.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/soc/mediatek/mtk-svs.c +5 -1
@@ -1614,12 +1614,16 @@ static int svs_resume(struct device *dev) ret =svs_init02 (svsp);if (ret) - goto out_of_resume; + goto svs_resume_reset_assert;svs_mon_mode (svsp);return 0 ; +svs_resume_reset_assert: +dev_err (svsp->dev,"assert reset: %d\n" , +reset_control_assert (svsp->rst)); + out_of_resume:clk_disable_unprepare (svsp->main_clk);return ret;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 19/211 soc: mediatek: mtk-svs: Use pm_runtime_resume_and_get() in svs_init01()
In reply to Greg Kroah-HartmanFrom: Shang XiaoJing <[email protected]>
[ Upstream commit 37fa2aff8fe490771f2229b0f2fcd15796b1bfca ]
svs_init01() calls pm_runtime_get_sync() and added fail path as svs_init01_finish to put usage_counter. However, pm_runtime_get_sync() will increment usage_counter even it failed. Fix it by replacing it with pm_runtime_resume_and_get() to keep usage counter balanced.
--- drivers/soc/mediatek/mtk-svs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/mediatek/mtk-svs.c +1 -1
@@ -1324,7 +1324,7 @@ static int svs_init01(struct svs_platform *svsp) svsb->pm_runtime_enabled_count++; } - ret =pm_runtime_get_sync (svsb->opp_dev); + ret =pm_runtime_resume_and_get (svsb->opp_dev);if (ret <0 ) {dev_err (svsb->dev,"mtcmos on fail: %d\n" , ret); goto svs_init01_resume_cpuidle;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 20/211 f2fs: fix to do sanity check on extent cache correctly
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit d48a7b3a72f121655d95b5157c32c7d555e44c05 ]
In do_read_inode(), sanity_check_inode() should be called after f2fs_init_read_extent_tree(), fix it.
--- fs/f2fs/inode.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
fs/f2fs/inode.c +6 -6
@@ -413,12 +413,6 @@ static int do_read_inode(struct inode *inode) fi->i_inline_xattr_size =0 ; } -if (!sanity_check_inode (inode, node_page)) { -f2fs_put_page (node_page,1 ); -f2fs_handle_error (sbi,ERROR_CORRUPTED_INODE ); -return -EFSCORRUPTED ; - } -/* check data exist */ if (f2fs_has_inline_data (inode) && !f2fs_exist_data (inode))__recover_inline_status (inode, node_page);
@@ -482,6 +476,12 @@ static int do_read_inode(struct inode *inode)f2fs_init_read_extent_tree (inode, node_page);f2fs_init_age_extent_tree (inode); +if (!sanity_check_inode (inode, node_page)) { +f2fs_put_page (node_page,1 ); +f2fs_handle_error (sbi,ERROR_CORRUPTED_INODE ); +return -EFSCORRUPTED ; + } +f2fs_put_page (node_page,1 );stat_inc_inline_xattr (inode);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 21/211 fs: f2fs: initialize fsdata in pagecache_write()
In reply to Greg Kroah-HartmanFrom: Alexander Potapenko <[email protected]>
[ Upstream commit b1b9896718bc1a212dc288ad66a5fa2fef11353d ]
When aops->write_begin() does not initialize fsdata, KMSAN may report an error passing the latter to aops->write_end().
Fix this by unconditionally initializing fsdata.
--- fs/f2fs/verity.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/f2fs/verity.c +1 -1
@@ -81,7 +81,7 @@ static int pagecache_write(struct inode *inode, const void *buf, size_t count,size_t n =min_t (size_t, count,PAGE_SIZE -offset_in_page (pos));struct page *page; -void *fsdata; +void *fsdata =NULL ;int res; res = aops->write_begin (NULL , mapping, pos, n, &page, &fsdata);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 22/211 f2fs: allow set compression option of files without blocks
In reply to Greg Kroah-HartmanFrom: Yangtao Li <[email protected]>
[ Upstream commit e6261beb0c629403dc58997294dd521bd23664af ]
Files created by truncate have a size but no blocks, so they can be allowed to set compression option.
--- fs/f2fs/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/f2fs/file.c +1 -1
@@ -3945,7 +3945,7 @@ static int f2fs_ioc_set_compress_option(struct file *filp, unsigned long arg) goto out; } -if (inode->i_size !=0 ) { +if (F2FS_HAS_BLOCKS (inode)) { ret = -EFBIG ; goto out; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 23/211 f2fs: fix to abort atomic write only during do_exist()
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit ae267fc1cfe9f941afcb90dc963ee6448dae73cf ]
Commit 7a10f0177e11 ("f2fs: don't give partially written atomic data from process crash") attempted to drop atomic write data after process crash, however, f2fs_abort_atomic_write() may be called from noncrash case, fix it by adding missed PF_EXITING check condition f2fs_file_flush().
- application crashs
- do_exit
- exit_signals -- sets PF_EXITING
- exit_files
- put_files_struct
- close_files
- filp_close
- flush (f2fs_file_flush)
- check atomic_write_task && PF_EXITING
- f2fs_abort_atomic_write
--- fs/f2fs/file.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/f2fs/file.c +2 -1
@@ -1880,7 +1880,8 @@ static int f2fs_file_flush(struct file *file, fl_owner_t id)* until all the writers close its file. Since this should be done * before dropping file lock, it needs to do in ->flush. */ -if (F2FS_I (inode)->atomic_write_task == current) +if (F2FS_I (inode)->atomic_write_task == current && + (current->flags &PF_EXITING ))f2fs_abort_atomic_write (inode, true);return 0 ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 24/211 um: vector: Fix memory leak in vector_config
In reply to Greg Kroah-HartmanFrom: Xiang Yang <[email protected]>
[ Upstream commit 8f88c73afe481f93d40801596927e8c0047b6d96 ]
If the return value of the uml_parse_vector_ifspec function is NULL, we should call kfree(params) to prevent memory leak.
--- arch/um/drivers/vector_kern.c | 1 + 1 file changed, 1 insertion(+)
arch/um/drivers/vector_kern.c +1 -0
@@ -767,6 +767,7 @@ static int vector_config(char *str, char **error_out)if (parsed ==NULL ) { *error_out ="vector_config failed to parse parameters" ; +kfree (params);return -EINVAL ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 25/211 ubi: ensure that VID header offset + VID header size <= alloc, size
In reply to Greg Kroah-HartmanFrom: George Kennedy <[email protected]>
[ Upstream commit 1b42b1a36fc946f0d7088425b90d491b4257ca3e ]
Ensure that the VID header offset + VID header size does not exceed the allocated area to avoid slab OOB.
BUG: KASAN: slab-out-of-bounds in crc32_body lib/crc32.c:111 [inline] BUG: KASAN: slab-out-of-bounds in crc32_le_generic lib/crc32.c:179 [inline] BUG: KASAN: slab-out-of-bounds in crc32_le_base+0x58c/0x626 lib/crc32.c:197 Read of size 4 at addr ffff88802bb36f00 by task syz-executor136/1555 CPU: 2 PID: 1555 Comm: syz-executor136 Tainted: G W 6.0.0-1868 #1 Hardware name: Red Hat KVM, BIOS 1.13.0-2.module+el8.3.0+7860+a7792d29 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x85/0xad lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold.13+0xb6/0x6bb mm/kasan/report.c:433 kasan_report+0xa7/0x11b mm/kasan/report.c:495 crc32_body lib/crc32.c:111 [inline] crc32_le_generic lib/crc32.c:179 [inline] crc32_le_base+0x58c/0x626 lib/crc32.c:197 ubi_io_write_vid_hdr+0x1b7/0x472 drivers/mtd/ubi/io.c:1067 create_vtbl+0x4d5/0x9c4 drivers/mtd/ubi/vtbl.c:317 create_empty_lvol drivers/mtd/ubi/vtbl.c:500 [inline] ubi_read_volume_table+0x67b/0x288a drivers/mtd/ubi/vtbl.c:812 ubi_attach+0xf34/0x1603 drivers/mtd/ubi/attach.c:1601 ubi_attach_mtd_dev+0x6f3/0x185e drivers/mtd/ubi/build.c:965 ctrl_cdev_ioctl+0x2db/0x347 drivers/mtd/ubi/cdev.c:1043 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x213 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3e/0x86 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0x0 RIP: 0033:0x7f96d5cf753d
Code:
RSP: 002b:00007fffd72206f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f96d5cf753d
RDX: 0000000020000080 RSI: 0000000040186f40 RDI: 0000000000000003
RBP: 0000000000400cd0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000400be0
R13: 00007fffd72207e0 R14: 0000000000000000 R15: 0000000000000000
</TASK> Allocated by task 1555: kasan_save_stack+0x20/0x3d mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:437 [inline] ____kasan_kmalloc mm/kasan/common.c:516 [inline] __kasan_kmalloc+0x88/0xa3 mm/kasan/common.c:525 kasan_kmalloc include/linux/kasan.h:234 [inline] __kmalloc+0x138/0x257 mm/slub.c:4429 kmalloc include/linux/slab.h:605 [inline] ubi_alloc_vid_buf drivers/mtd/ubi/ubi.h:1093 [inline] create_vtbl+0xcc/0x9c4 drivers/mtd/ubi/vtbl.c:295 create_empty_lvol drivers/mtd/ubi/vtbl.c:500 [inline] ubi_read_volume_table+0x67b/0x288a drivers/mtd/ubi/vtbl.c:812 ubi_attach+0xf34/0x1603 drivers/mtd/ubi/attach.c:1601 ubi_attach_mtd_dev+0x6f3/0x185e drivers/mtd/ubi/build.c:965 ctrl_cdev_ioctl+0x2db/0x347 drivers/mtd/ubi/cdev.c:1043 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x213 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3e/0x86 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0x0 The buggy address belongs to the object at ffff88802bb36e00 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 0 bytes to the right of
256-byte region [ffff88802bb36e00, ffff88802bb36f00)
The buggy address belongs to the physical page:
page:00000000ea4d1263 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2bb36
head:00000000ea4d1263 order:1 compound_mapcount:0 compound_pincount:0
flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff)
raw: 000fffffc0010200 ffffea000066c300 dead000000000003 ffff888100042b40
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88802bb36e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88802bb36e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88802bb36f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88802bb36f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88802bb37000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================--- drivers/mtd/ubi/build.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/mtd/ubi/build.c +6 -0
@@ -663,6 +663,12 @@ static int io_init(struct ubi_device *ubi, int max_beb_per1024) ubi->ec_hdr_alsize =ALIGN (UBI_EC_HDR_SIZE , ubi->hdrs_min_io_size); ubi->vid_hdr_alsize =ALIGN (UBI_VID_HDR_SIZE , ubi->hdrs_min_io_size); +if (ubi->vid_hdr_offset && ((ubi->vid_hdr_offset +UBI_VID_HDR_SIZE ) > + ubi->vid_hdr_alsize)) { +ubi_err (ubi,"VID header offset %d too large." , ubi->vid_hdr_offset); +return -EINVAL ; + } +dbg_gen ("min_io_size %d" , ubi->min_io_size);dbg_gen ("max_write_size %d" , ubi->max_write_size);dbg_gen ("hdrs_min_io_size %d" , ubi->hdrs_min_io_size);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 26/211 ubifs: Fix build errors as symbol undefined
In reply to Greg Kroah-HartmanFrom: Li Hua <[email protected]>
[ Upstream commit aa6d148e6d6270274e3d5a529b71c54cd329d17f ]
With CONFIG_UBIFS_FS_AUTHENTICATION not set, the compiler can assume that ubifs_node_check_hash() is never true and drops the call to ubifs_bad_hash(). Is CONFIG_CC_OPTIMIZE_FOR_SIZE enabled this optimization does not happen anymore.
So When CONFIG_UBIFS_FS and CONFIG_CC_OPTIMIZE_FOR_SIZE is enabled but CONFIG_UBIFS_FS_AUTHENTICATION is not set, the build errors is as followd:
ERROR: modpost: "ubifs_bad_hash" [fs/ubifs/ubifs.ko] undefined!
Fix it by add no-op ubifs_bad_hash() for the CONFIG_UBIFS_FS_AUTHENTICATION=n case.
--- fs/ubifs/ubifs.h | 5 +++++ 1 file changed, 5 insertions(+)
fs/ubifs/ubifs.h +5 -0
@@ -1623,8 +1623,13 @@ static inline int ubifs_check_hmac(const struct ubifs_info *c,return crypto_memneq (expected, got, c->hmac_desc_len); } +#ifdef CONFIG_UBIFS_FS_AUTHENTICATION void ubifs_bad_hash (const struct ubifs_info *c,const void *node,const u8 *hash,int lnum,int offs); +#else +static inline void ubifs_bad_hash (const struct ubifs_info *c,const void *node, +const u8 *hash,int lnum,int offs) {}; +#endif int __ubifs_node_check_hash (const struct ubifs_info *c,const void *buf,const u8 *expected);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 27/211 ubifs: Fix memory leak in ubifs_sysfs_init()
In reply to Greg Kroah-HartmanFrom: Liu Shixin <[email protected]>
[ Upstream commit 203a55f04f66eea1a1ca7e5a302a7f5c99c62327 ]
When insmod ubifs.ko, a kmemleak reported as below:
unreferenced object 0xffff88817fb1a780 (size 8):
comm "insmod", pid 25265, jiffies 4295239702 (age 100.130s) hex dump (first 8 bytes):
75 62 69 66 73 00 ff ff ubifs...
backtrace:
[<ffffffff81b3fc4c>] slab_post_alloc_hook+0x9c/0x3c0
[<ffffffff81b44bf3>] __kmalloc_track_caller+0x183/0x410
[<ffffffff8198d3da>] kstrdup+0x3a/0x80
[<ffffffff8198d486>] kstrdup_const+0x66/0x80
[<ffffffff83989325>] kvasprintf_const+0x155/0x190
[<ffffffff83bf55bb>] kobject_set_name_vargs+0x5b/0x150
[<ffffffff83bf576b>] kobject_set_name+0xbb/0xf0
[<ffffffff8100204c>] do_one_initcall+0x14c/0x5a0
[<ffffffff8157e380>] do_init_module+0x1f0/0x660
[<ffffffff815857be>] load_module+0x6d7e/0x7590
[<ffffffff8158644f>] __do_sys_finit_module+0x19f/0x230
[<ffffffff815866b3>] __x64_sys_finit_module+0x73/0xb0
[<ffffffff88c98e85>] do_syscall_64+0x35/0x80
[<ffffffff88e00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcdWhen kset_register() failed, we should call kset_put to cleanup it.
--- fs/ubifs/sysfs.c | 2 ++ 1 file changed, 2 insertions(+)
fs/ubifs/sysfs.c +2 -0
@@ -144,6 +144,8 @@ int __init ubifs_sysfs_init(void)kobject_set_name (&ubifs_kset.kobj,"ubifs" ); ubifs_kset.kobj.parent = fs_kobj; ret =kset_register (&ubifs_kset); +if (ret) +kset_put (&ubifs_kset);return ret; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 28/211 ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted
In reply to Greg Kroah-HartmanFrom: Zhihao Cheng <[email protected]>
[ Upstream commit c2c36cc6ca23e614f9e4238d0ecf48549ee9002a ]
Fix bad space budget when symlink file is encrypted. Bad space budget may let make_reservation() return with -ENOSPC, which could turn ubifs to read-only mode in do_writepage() process.
Fetch a reproducer in [Link].
--- fs/ubifs/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ubifs/dir.c +1 -1
@@ -1151,7 +1151,6 @@ static int ubifs_symlink(struct user_namespace *mnt_userns, struct inode *dir,int err, sz_change, len =strlen (symname);struct fscrypt_str disk_link;struct ubifs_budget_req req = { .new_ino =1 , .new_dent =1 , - .new_ino_d =ALIGN (len,8 ), .dirtied_ino =1 };struct fscrypt_name nm;
@@ -1167,6 +1166,7 @@ static int ubifs_symlink(struct user_namespace *mnt_userns, struct inode *dir,* Budget request settings: new inode, new direntry and changing parent * directory inode. */ + req.new_ino_d =ALIGN (disk_link.len -1 ,8 ); err =ubifs_budget_space (c, &req);if (err)return err;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 29/211 ubifs: Rectify space budget for ubifs_xrename()
In reply to Greg Kroah-HartmanFrom: Zhihao Cheng <[email protected]>
[ Upstream commit 1b2ba09060e41adb356b9ae58ef94a7390928004 ]
There is no space budget for ubifs_xrename(). It may let make_reservation() return with -ENOSPC, which could turn ubifs to read-only mode in do_writepage() process. Fix it by adding space budget for ubifs_xrename().
Fetch a reproducer in [Link].
--- fs/ubifs/dir.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/ubifs/dir.c +5 -0
@@ -1576,6 +1576,10 @@ static int ubifs_xrename(struct inode *old_dir, struct dentry *old_dentry,return err; } + err =ubifs_budget_space (c, &req); +if (err) + goto out; +lock_4_inodes (old_dir, new_dir,NULL ,NULL ); time =current_time (old_dir);
@@ -1601,6 +1605,7 @@ static int ubifs_xrename(struct inode *old_dir, struct dentry *old_dentry,unlock_4_inodes (old_dir, new_dir,NULL ,NULL );ubifs_release_budget (c, &req); +out:fscrypt_free_filename (&fst_nm);fscrypt_free_filename (&snd_nm);return err;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 30/211 ubifs: Fix wrong dirty space budget for dirty inode
In reply to Greg Kroah-HartmanFrom: Zhihao Cheng <[email protected]>
[ Upstream commit b248eaf049d9cdc5eb76b59399e4d3de233f02ac ]
Each dirty inode should reserve 'c->bi.inode_budget' bytes in space budget calculation. Currently, space budget for dirty inode reports more space than what UBIFS actually needs to write.
--- fs/ubifs/budget.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ubifs/budget.c +1 -1
@@ -400,7 +400,7 @@ static int calc_dd_growth(const struct ubifs_info *c, dd_growth = req->dirtied_page ? c->bi.page_budget :0 ;if (req->dirtied_ino) - dd_growth += c->bi.inode_budget << (req->dirtied_ino -1 ); + dd_growth += c->bi.inode_budget * req->dirtied_ino;if (req->mod_dent) dd_growth += c->bi.dent_budget; dd_growth += req->dirtied_ino_d;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 31/211 ubifs: do_rename: Fix wrong space budget when target inodes nlink > 1
In reply to Greg Kroah-HartmanFrom: Zhihao Cheng <[email protected]>
[ Upstream commit 25fce616a61fc2f1821e4a9ce212d0e064707093 ]
If target inode is a special file (eg. block/char device) with nlink count greater than 1, the inode with ui->data will be re-written on disk. However, UBIFS losts target inode's data_len while doing space budget. Bad space budget may let make_reservation() return with -ENOSPC, which could turn ubifs to read-only mode in do_writepage() process.
Fetch a reproducer in [Link].
--- fs/ubifs/dir.c | 2 ++ 1 file changed, 2 insertions(+)
fs/ubifs/dir.c +2 -0
@@ -1324,6 +1324,8 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry,if (unlink) {ubifs_assert (c,inode_is_locked (new_inode)); +/* Budget for old inode's data when its nlink > 1. */ + req.dirtied_ino_d =ALIGN (ubifs_inode (new_inode)->data_len,8 ); err =ubifs_purge_xattrs (new_inode);if (err)return err;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 32/211 ubifs: Reserve one leb for each journal head while doing budget
In reply to Greg Kroah-HartmanFrom: Zhihao Cheng <[email protected]>
[ Upstream commit e874dcde1cbf82c786c0e7f2899811c02630cc52 ]
UBIFS calculates available space by c->main_bytes - c->lst.total_used (which means non-index lebs' free and dirty space is accounted into total available), then index lebs and four lebs (one for gc_lnum, one for deletions, two for journal heads) are deducted.
In following situation, ubifs may get -ENOSPC from make_reservation():
LEB 84: DATAHD free 122880 used 1920 dirty 2176 dark 6144 LEB 110:DELETION free 126976 used 0 dirty 0 dark 6144 (empty) LEB 201:gc_lnum free 126976 used 0 dirty 0 dark 6144 LEB 272:GCHD free 77824 used 47672 dirty 1480 dark 6144
LEB 356:BASEHD free 0 used 39776 dirty 87200 dark 6144
OTHERS: index lebs, zero-available non-index lebs
UBIFS calculates the available bytes is 6888 (How to calculate it:
126976 * 5[remain main bytes] - 1920[used] - 47672[used] - 39776[used] - 126976 * 1[deletions] - 126976 * 1[gc_lnum] - 126976 * 2[journal heads]
- 6144 * 5[dark] = 6888) after doing budget, however UBIFS cannot use BASEHD's dirty space(87200), because UBIFS cannot find next BASEHD to reclaim current BASEHD. (c->bi.min_idx_lebs equals to c->lst.idx_lebs, the empty leb won't be found by ubifs_find_free_space(), and dirty index lebs won't be picked as gced lebs. All non-index lebs has dirty space less then c->dead_wm, non-index lebs won't be picked as gced lebs either. So new free lebs won't be produced.). See more details in Link.
To fix it, reserve one leb for each journal head while doing budget.
--- fs/ubifs/budget.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
fs/ubifs/budget.c +3 -4
@@ -209,11 +209,10 @@ long long ubifs_calc_available(const struct ubifs_info *c, int min_idx_lebs) subtract_lebs +=1 ;/* -* The GC journal head LEB is not really accessible. And since -* different write types go to different heads, we may count only on -* one head's space. +* Since different write types go to different heads, we should +* reserve one leb for each head. */ - subtract_lebs += c->jhead_cnt -1 ; + subtract_lebs += c->jhead_cnt;/* We also reserve one LEB for deletions, which bypass budgeting */ subtract_lebs +=1 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 33/211 ubi: Fix use-after-free when volume resizing failed
In reply to Greg Kroah-HartmanFrom: Li Zetao <[email protected]>
[ Upstream commit 9af31d6ec1a4be4caab2550096c6bd2ba8fba472 ]
There is an use-after-free problem reported by KASAN:
==================================================================
BUG: KASAN: use-after-free in ubi_eba_copy_table+0x11f/0x1c0 [ubi] Read of size 8 at addr ffff888101eec008 by task ubirsvol/4735 CPU: 2 PID: 4735 Comm: ubirsvol Not tainted 6.1.0-rc1-00003-g84fa3304a7fc-dirty #14 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 ubi_eba_copy_table+0x11f/0x1c0 [ubi] ubi_resize_volume+0x4f9/0xbc0 [ubi] ubi_cdev_ioctl+0x701/0x1850 [ubi] __x64_sys_ioctl+0x11d/0x170 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 </TASK>
When ubi_change_vtbl_record() returns an error in ubi_resize_volume(), "new_eba_tbl" will be freed on error handing path, but it is holded by "vol->eba_tbl" in ubi_eba_replace_table(). It means that the liftcycle of "vol->eba_tbl" and "vol" are different, so when resizing volume in next time, it causing an use-after-free fault.
Fix it by not freeing "new_eba_tbl" after it replaced in ubi_eba_replace_table(), while will be freed in next volume resizing.
--- drivers/mtd/ubi/vmt.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/mtd/ubi/vmt.c +3 -1
@@ -464,7 +464,7 @@ int ubi_resize_volume(struct ubi_volume_desc *desc, int reserved_pebs)for (i =0 ; i < -pebs; i++) { err =ubi_eba_unmap_leb (ubi, vol, reserved_pebs + i);if (err) - goto out_acc; + goto out_free; }spin_lock (&ubi->volumes_lock); ubi->rsvd_pebs += pebs;
@@ -512,6 +512,8 @@ int ubi_resize_volume(struct ubi_volume_desc *desc, int reserved_pebs) ubi->avail_pebs += pebs;spin_unlock (&ubi->volumes_lock); } +return err; + out_free:kfree (new_eba_tbl);return err;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 34/211 ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()
In reply to Greg Kroah-HartmanFrom: Li Zetao <[email protected]>
[ Upstream commit 1e591ea072df7211f64542a09482b5f81cb3ad27 ]
There is a memory leaks problem reported by kmemleak:
unreferenced object 0xffff888102007a00 (size 128):
comm "ubirsvol", pid 32090, jiffies 4298464136 (age 2361.231s) hex dump (first 32 bytes):
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
backtrace:
[<ffffffff8176cecd>] __kmalloc+0x4d/0x150 [<ffffffffa02a9a36>] ubi_eba_create_table+0x76/0x170 [ubi] [<ffffffffa029764e>] ubi_resize_volume+0x1be/0xbc0 [ubi] [<ffffffffa02a3321>] ubi_cdev_ioctl+0x701/0x1850 [ubi] [<ffffffff81975d2d>] __x64_sys_ioctl+0x11d/0x170 [<ffffffff83c142a5>] do_syscall_64+0x35/0x80 [<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
This is due to a mismatch between create and destroy interfaces, and in detail that "new_eba_tbl" created by ubi_eba_create_table() but destroyed by kfree(), while will causing "new_eba_tbl->entries" not freed.
Fix it by replacing kfree(new_eba_tbl) withubi_eba_destroy_table(new_eba_tbl)
--- drivers/mtd/ubi/vmt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/ubi/vmt.c +1 -1
@@ -515,7 +515,7 @@ int ubi_resize_volume(struct ubi_volume_desc *desc, int reserved_pebs)return err; out_free: -kfree (new_eba_tbl); +ubi_eba_destroy_table (new_eba_tbl);return err; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 35/211 ubifs: Fix memory leak in alloc_wbufs()
In reply to Greg Kroah-HartmanFrom: Li Zetao <[email protected]>
[ Upstream commit 4a1ff3c5d04b9079b4f768d9a71b51c4af578dd2 ]
kmemleak reported a sequence of memory leaks, and show them as following:
unreferenced object 0xffff8881575f8400 (size 1024):
comm "mount", pid 19625, jiffies 4297119604 (age 20.383s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff8176cecd>] __kmalloc+0x4d/0x150
[<ffffffffa0406b2b>] ubifs_mount+0x307b/0x7170 [ubifs]
[<ffffffff819fa8fd>] legacy_get_tree+0xed/0x1d0
[<ffffffff81936f2d>] vfs_get_tree+0x7d/0x230
[<ffffffff819b2bd4>] path_mount+0xdd4/0x17b0
[<ffffffff819b37aa>] __x64_sys_mount+0x1fa/0x270
[<ffffffff83c14295>] do_syscall_64+0x35/0x80
[<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 unreferenced object 0xffff8881798a6e00 (size 512):
comm "mount", pid 19677, jiffies 4297121912 (age 37.816s)
hex dump (first 32 bytes):
6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
backtrace:
[<ffffffff8176cecd>] __kmalloc+0x4d/0x150
[<ffffffffa0418342>] ubifs_wbuf_init+0x52/0x480 [ubifs]
[<ffffffffa0406ca5>] ubifs_mount+0x31f5/0x7170 [ubifs]
[<ffffffff819fa8fd>] legacy_get_tree+0xed/0x1d0
[<ffffffff81936f2d>] vfs_get_tree+0x7d/0x230
[<ffffffff819b2bd4>] path_mount+0xdd4/0x17b0
[<ffffffff819b37aa>] __x64_sys_mount+0x1fa/0x270
[<ffffffff83c14295>] do_syscall_64+0x35/0x80
[<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0The problem is that the ubifs_wbuf_init() returns an error in the loop which in the alloc_wbufs(), then the wbuf->buf and wbuf->inodes that were successfully alloced before are not freed.
Fix it by adding error hanging path in alloc_wbufs() which frees the memory alloced before when ubifs_wbuf_init() returns an error.
--- fs/ubifs/super.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-)
fs/ubifs/super.c +13 -4
@@ -833,7 +833,7 @@ static int alloc_wbufs(struct ubifs_info *c)INIT_LIST_HEAD (&c->jheads[i].buds_list); err =ubifs_wbuf_init (c, &c->jheads[i].wbuf);if (err) -return err; + goto out_wbuf; c->jheads[i].wbuf.sync_callback = &bud_wbuf_callback; c->jheads[i].wbuf.jhead = i;
@@ -841,7 +841,7 @@ static int alloc_wbufs(struct ubifs_info *c) c->jheads[i].log_hash =ubifs_hash_get_desc (c);if (IS_ERR (c->jheads[i].log_hash)) { err =PTR_ERR (c->jheads[i].log_hash); - goto out; + goto out_log_hash; } }
@@ -854,9 +854,18 @@ static int alloc_wbufs(struct ubifs_info *c)return 0 ; -out: -while (i--) +out_log_hash: +kfree (c->jheads[i].wbuf.buf); +kfree (c->jheads[i].wbuf.inodes); + +out_wbuf: +while (i--) { +kfree (c->jheads[i].wbuf.buf); +kfree (c->jheads[i].wbuf.inodes);kfree (c->jheads[i].log_hash); + } +kfree (c->jheads); + c->jheads =NULL ;return err; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 36/211 ubi: Fix possible null-ptr-deref in ubi_free_volume()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit c15859bfd326c10230f09cb48a17f8a35f190342 ]
It willl cause null-ptr-deref in the following case:
uif_init()
ubi_add_volume()
cdev_add() -> if it fails, call kill_volumes()
device_register()kill_volumes() -> if ubi_add_volume() fails call this function
ubi_free_volume()
cdev_del()
device_unregister() -> trying to delete a not added device,
it causes null-ptr-derefSo in ubi_free_volume(), it delete devices whether they are added or not, it will causes null-ptr-deref.
Handle the error case whlie calling ubi_add_volume() to fix this problem. If add volume fails, set the corresponding vol to null, so it can not be accessed in kill_volumes() and release the resource in ubi_add_volume() error path.
--- drivers/mtd/ubi/build.c | 1 + drivers/mtd/ubi/vmt.c | 12 ++++++------ 2 files changed, 7 insertions(+), 6 deletions(-)
drivers/mtd/ubi/build.c +1 -0
@@ -468,6 +468,7 @@ static int uif_init(struct ubi_device *ubi) err =ubi_add_volume (ubi, ubi->volumes[i]);if (err) {ubi_err (ubi,"cannot add volume %d" , i); + ubi->volumes[i] =NULL ; goto out_volumes; } }
drivers/mtd/ubi/vmt.c +6 -6
@@ -582,6 +582,7 @@ int ubi_add_volume(struct ubi_device *ubi, struct ubi_volume *vol)if (err) {ubi_err (ubi,"cannot add character device for volume %d, error %d" , vol_id, err); +vol_release (&vol->dev);return err; }
@@ -592,15 +593,14 @@ int ubi_add_volume(struct ubi_device *ubi, struct ubi_volume *vol) vol->dev.groups = volume_dev_groups;dev_set_name (&vol->dev,"%s_%d" , ubi->ubi_name, vol->vol_id); err =device_register (&vol->dev); -if (err) - goto out_cdev; +if (err) { +cdev_del (&vol->cdev); +put_device (&vol->dev); +return err; + }self_check_volumes (ubi);return err; - -out_cdev: -cdev_del (&vol->cdev); -return err; }/**
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 37/211 ubifs: Re-statistic cleaned znode count if commit failed
In reply to Greg Kroah-HartmanFrom: Zhihao Cheng <[email protected]>
[ Upstream commit 944e096aa24071d3fe22822f6249d3ae309e39ea ]
Dirty znodes will be written on flash in committing process with following states:
process A | znode state
------------------------------------------------------do_commit | DIRTY_ZNODE
ubifs_tnc_start_commit | DIRTY_ZNODE
get_znodes_to_commit | DIRTY_ZNODE | COW_ZNODE
layout_commit | DIRTY_ZNODE | COW_ZNODE
fill_gap | 0
write master | 0 or OBSOLETE_ZNODE
process B | znode state
------------------------------------------------------do_commit | DIRTY_ZNODE[1]
ubifs_tnc_start_commit | DIRTY_ZNODE
get_znodes_to_commit | DIRTY_ZNODE | COW_ZNODE
ubifs_tnc_end_commit | DIRTY_ZNODE | COW_ZNODE
write_index | 0 write master | 0 or OBSOLETE_ZNODE[2] or | DIRTY_ZNODE[3]
[1] znode is dirtied without concurrent committing process
[2] znode is copied up (re-dirtied by other process) before cleaned up in committing process
[3] znode is re-dirtied after cleaned up in committing process
Currently, the clean znode count is updated in free_obsolete_znodes(), which is called only in normal path. If do_commit failed, clean znode count won't be updated, which triggers a failure ubifs assertion[4] in ubifs_tnc_close():
ubifs_assert_failed [ubifs]: UBIFS assert failed: freed == n
[4] Commit 380347e9ca7682 ("UBIFS: Add an assertion for clean_zn_cnt").
Fix it by re-statisticing cleaned znode count in tnc_destroy_cnext().
Fetch a reproducer in [Link].
--- fs/ubifs/tnc.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
fs/ubifs/tnc.c +15 -0
@@ -3053,6 +3053,21 @@ static void tnc_destroy_cnext(struct ubifs_info *c) cnext = cnext->cnext;if (ubifs_zn_obsolete (znode))kfree (znode); +else if (!ubifs_zn_cow (znode)) { +/* +* Don't forget to update clean znode count after +* committing failed, because ubifs will check this +* count while closing tnc. Non-obsolete znode could +* be re-dirtied during committing process, so dirty +* flag is untrustable. The flag 'COW_ZNODE' is set +* for each dirty znode before committing, and it is +* cleared as long as the znode become clean, so we +* can statistic clean znode count according to this +* flag. +*/ +atomic_long_inc (&c->clean_zn_cnt); +atomic_long_inc (&ubifs_clean_zn_cnt); + } }while (cnext && cnext != c->cnext); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 38/211 ubifs: dirty_cow_znode: Fix memleak in error handling path
In reply to Greg Kroah-HartmanFrom: Zhihao Cheng <[email protected]>
[ Upstream commit 122deabfe1428bffe95e2bf364ff8a5059bdf089 ]
Following process will cause a memleak for copied up znode:
dirty_cow_znode
zn = copy_znode(c, znode);
err = insert_old_idx(c, zbr->lnum, zbr->offs);
if (unlikely(err))
return ERR_PTR(err); // No one refers to zn.
Fix it by adding copied znode back to tnc, then it will be freed by ubifs_destroy_tnc_subtree() while closing tnc.
Fetch a reproducer in [Link].
--- fs/ubifs/tnc.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
fs/ubifs/tnc.c +8 -1
@@ -267,11 +267,18 @@ static struct ubifs_znode *dirty_cow_znode(struct ubifs_info *c,if (zbr->len) { err =insert_old_idx (c, zbr->lnum, zbr->offs);if (unlikely (err)) -return ERR_PTR (err); +/* +* Obsolete znodes will be freed by tnc_destroy_cnext() +* or free_obsolete_znodes(), copied up znodes should +* be added back to tnc and freed by +* ubifs_destroy_tnc_subtree(). +*/ + goto out; err =add_idx_dirt (c, zbr->lnum, zbr->len); }else err =0 ; +out: zbr->znode = zn; zbr->lnum =0 ; zbr->offs =0 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 39/211 ubifs: ubifs_writepage: Mark page dirty after writing inode failed
In reply to Greg Kroah-HartmanFrom: Zhihao Cheng <[email protected]>
[ Upstream commit fb8bc4c74ae4526d9489362ab2793a936d072b84 ]
There are two states for ubifs writing pages:
1. Dirty, Private
2. Not Dirty, Not Private
There is a third possibility which maybe related to [1] that page is private but not dirty caused by following process:
PA
lock(page)ubifs_write_end
attach_page_private // set Private
__set_page_dirty_nobuffers // set Dirty
unlock(page)
write_cache_pages
lock(page)
clear_page_dirty_for_io(page) // clear Dirty
ubifs_writepage
write_inode
// fail, goto out, following codes are not executed
// do_writepage
// set_page_writeback // set Writeback
// detach_page_private // clear Private
// end_page_writeback // clear Writeback
out:
unlock(page) // Private, Not Dirty
PB
ksys_fadvise64_64
generic_fadvise
invalidate_inode_page
// page is neither Dirty nor Writeback
invalidate_complete_page
// page_has_private is true
try_to_release_page
ubifs_releasepage
ubifs_assert(c, 0) !!!Then we may get following assertion failed:
UBIFS error (ubi0:0 pid 1492): ubifs_assert_failed [ubifs]:
UBIFS assert failed: 0, in fs/ubifs/file.c:1499 UBIFS warning (ubi0:0 pid 1492): ubifs_ro_mode [ubifs]:
switched to read-only mode, error -22
CPU: 2 PID: 1492 Comm: aa Not tainted 5.16.0-rc2-00012-g7bb767dee0ba-dirty
Call Trace:
dump_stack+0x13/0x1b
ubifs_ro_mode+0x54/0x60 [ubifs]
ubifs_assert_failed+0x4b/0x80 [ubifs]
ubifs_releasepage+0x7e/0x1e0 [ubifs]
try_to_release_page+0x57/0xe0
invalidate_inode_page+0xfb/0x130
invalidate_mapping_pagevec+0x12/0x20
generic_fadvise+0x303/0x3c0
vfs_fadvise+0x35/0x40
ksys_fadvise64_64+0x4c/0xb0Jump [2] to find a reproducer.
[1] https://linux-mtd.infradead.narkive.com/NQoBeT1u/patch-rfc-ubifs-fix-assert-failed-in-ubifs-set-page-dirty
[2] https://bugzilla.kernel.org/show_bug.cgi?id=215357
--- fs/ubifs/file.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
fs/ubifs/file.c +9 -3
@@ -1032,7 +1032,7 @@ static int ubifs_writepage(struct page *page, struct writeback_control *wbc)if (page->index >= synced_i_size >>PAGE_SHIFT ) { err = inode->i_sb->s_op->write_inode (inode,NULL );if (err) - goto out_unlock; + goto out_redirty;/* * The inode has been written, but the write-buffer has * not been synchronized, so in case of an unclean
@@ -1060,11 +1060,17 @@ static int ubifs_writepage(struct page *page, struct writeback_control *wbc)if (i_size > synced_i_size) { err = inode->i_sb->s_op->write_inode (inode,NULL );if (err) - goto out_unlock; + goto out_redirty; }return do_writepage (page, len); - +out_redirty: +/* +* redirty_page_for_writepage() won't call ubifs_dirty_inode() because +* it passes I_DIRTY_PAGES flag while calling __mark_inode_dirty(), so +* there is no need to do space budget for dirty inode. +*/ +redirty_page_for_writepage (wbc, page); out_unlock:unlock_page (page);return err;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 40/211 ubifs: ubifs_releasepage: Remove ubifs_assert(0) to valid this process
In reply to Greg Kroah-HartmanFrom: Zhihao Cheng <[email protected]>
[ Upstream commit 66f4742e93523ab2f062d9d9828b3e590bc61536 ]
There are two states for ubifs writing pages:
1. Dirty, Private
2. Not Dirty, Not Private
The normal process cannot go to ubifs_releasepage() which means there exists pages being private but not dirty. Reproducer[1] shows that it could occur (which maybe related to [2]) with following process:
PA PB PC
lock(page)[PA]ubifs_write_end
attach_page_private // set Private
__set_page_dirty_nobuffers // set Dirty
unlock(page)
write_cache_pages[PA]
lock(page)
clear_page_dirty_for_io(page) // clear Dirty
ubifs_writepage
do_truncation[PB]
truncate_setsize
i_size_write(inode, newsize) // newsize = 0
i_size = i_size_read(inode) // i_size = 0
end_index = i_size >> PAGE_SHIFT
if (page->index > end_index)
goto out // jump
out:
unlock(page) // Private, Not Dirty
generic_fadvise[PC] lock(page) invalidate_inode_page try_to_release_page ubifs_releasepage ubifs_assert(c, 0) // bad assertion! unlock(page) truncate_pagecache[PB]
Then we may get following assertion failed:
UBIFS error (ubi0:0 pid 1683): ubifs_assert_failed [ubifs]:
UBIFS assert failed: 0, in fs/ubifs/file.c:1513 UBIFS warning (ubi0:0 pid 1683): ubifs_ro_mode [ubifs]:
switched to read-only mode, error -22
CPU: 2 PID: 1683 Comm: aa Not tainted 5.16.0-rc5-00184-g0bca5994cacc-dirty #308
Call Trace:
dump_stack+0x13/0x1b
ubifs_ro_mode+0x54/0x60 [ubifs]
ubifs_assert_failed+0x4b/0x80 [ubifs]
ubifs_releasepage+0x67/0x1d0 [ubifs]
try_to_release_page+0x57/0xe0
invalidate_inode_page+0xfb/0x130
__invalidate_mapping_pages+0xb9/0x280
invalidate_mapping_pagevec+0x12/0x20
generic_fadvise+0x303/0x3c0
ksys_fadvise64_64+0x4c/0xb0[1] https://bugzilla.kernel.org/show_bug.cgi?id=215373
[2] https://linux-mtd.infradead.narkive.com/NQoBeT1u/patch-rfc-ubifs-fix-assert-failed-in-ubifs-set-page-dirty
--- fs/ubifs/file.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
fs/ubifs/file.c +14 -5
@@ -1472,14 +1472,23 @@ static bool ubifs_release_folio(struct folio *folio, gfp_t unused_gfp_flags)struct inode *inode = folio->mapping->host;struct ubifs_info *c = inode->i_sb->s_fs_info; -/* -* An attempt to release a dirty page without budgeting for it - should -* not happen. -*/ if (folio_test_writeback (folio))return false; + +/* +* Page is private but not dirty, weird? There is one condition +* making it happened. ubifs_writepage skipped the page because +* page index beyonds isize (for example. truncated by other +* process named A), then the page is invalidated by fadvise64 +* syscall before being truncated by process A. +*/ ubifs_assert (c,folio_test_private (folio)); -ubifs_assert (c,0 ); +if (folio_test_checked (folio)) +release_new_page_budget (c); +else +release_existing_page_budget (c); + +atomic_long_dec (&c->dirty_pg_cnt);folio_detach_private (folio);folio_clear_checked (folio);return true;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 41/211 ubi: fastmap: Fix missed fm_anchor PEB in wear-leveling after disabling fastmap
In reply to Greg Kroah-HartmanFrom: Zhihao Cheng <[email protected]>
[ Upstream commit 76f9476ece445a07aeb72df9d896cd563fb5b50f ]
After disabling fastmap(ubi->fm_disabled = 1), fastmap won't be updated, fm_anchor PEB is missed being scheduled for erasing. Besides, fm_anchor PEB may have smallest erase count, it doesn't participate wear-leveling. The difference of erase count between fm_anchor PEB and other PEBs will be larger and larger later on.
In which situation fastmap can be disabled? Initially, we have an UBI image with fastmap. Then the image will be atttached without module parameter 'fm_autoconvert', ubi turns to full scanning mode in one random attaching process(eg. bad fastmap caused by powercut), ubi fastmap is disabled since then.
Fix it by not getting fm_anchor if fastmap is disabled in ubi_refill_pools().
Fetch a reproducer in [Link].
--- drivers/mtd/ubi/fastmap-wl.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/mtd/ubi/fastmap-wl.c +7 -5
@@ -146,13 +146,15 @@ void ubi_refill_pools(struct ubi_device *ubi)if (ubi->fm_anchor) {wl_tree_add (ubi->fm_anchor, &ubi->free); ubi->free_count++; + ubi->fm_anchor =NULL ; } -/* -* All available PEBs are in ubi->free, now is the time to get -* the best anchor PEBs. -*/ - ubi->fm_anchor =ubi_wl_get_fm_peb (ubi,1 ); +if (!ubi->fm_disabled) +/* +* All available PEBs are in ubi->free, now is the time to get +* the best anchor PEBs. +*/ + ubi->fm_anchor =ubi_wl_get_fm_peb (ubi,1 );for (;;) { enough =0 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 42/211 ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
In reply to Greg Kroah-HartmanFrom: Zhihao Cheng <[email protected]>
[ Upstream commit a240bc5c43130c6aa50831d7caaa02a1d84e1bce ]
Wear-leveling entry could be freed in error path, which may be accessed again in eraseblk_count_seq_show(), for example:
__erase_worker eraseblk_count_seq_show
wl = ubi->lookuptbl[*block_number]
if (wl)
wl_entry_destroy
ubi->lookuptbl[e->pnum] = NULL
kmem_cache_free(ubi_wl_entry_slab, e)
erase_count = wl->ec // UAF!Wear-leveling entry updating/accessing in ubi->lookuptbl should be protected by ubi->wl_lock, fix it by adding ubi->wl_lock to serialize wl entry accessing between wl_entry_destroy() and eraseblk_count_seq_show().
Fetch a reproducer in [Link].
--- drivers/mtd/ubi/wl.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/mtd/ubi/wl.c +8 -1
@@ -890,8 +890,11 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk, err =do_sync_erase (ubi, e1, vol_id, lnum,0 );if (err) { -if (e2) +if (e2) { +spin_lock (&ubi->wl_lock);wl_entry_destroy (ubi, e2); +spin_unlock (&ubi->wl_lock); + } goto out_ro; }
@@ -1130,14 +1133,18 @@ static int __erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk)/* Re-schedule the LEB for erasure */ err1 =schedule_erase (ubi, e, vol_id, lnum,0 , false);if (err1) { +spin_lock (&ubi->wl_lock);wl_entry_destroy (ubi, e); +spin_unlock (&ubi->wl_lock); err = err1; goto out_ro; }return err; } +spin_lock (&ubi->wl_lock);wl_entry_destroy (ubi, e); +spin_unlock (&ubi->wl_lock);if (err != -EIO )/* * If this is not %-EIO, we have no idea what to do. Scheduling
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 43/211 ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed
In reply to Greg Kroah-HartmanFrom: Zhihao Cheng <[email protected]>
[ Upstream commit 4d57a7333e26040f2b583983e1970d9d460e56b0 ]
Following process will trigger an infinite loop in ubi_wl_put_peb():
ubifs_bgt ubi_bgtubifs_leb_unmap
ubi_leb_unmap
ubi_eba_unmap_leb
ubi_wl_put_peb wear_leveling_worker
e1 = rb_entry(rb_first(&ubi->used)
e2 = get_peb_for_wl(ubi)
ubi_io_read_vid_hdr // return err (flash fault)
out_error:
ubi->move_from = ubi->move_to = NULL
wl_entry_destroy(ubi, e1)
ubi->lookuptbl[e->pnum] = NULL
retry:
e = ubi->lookuptbl[pnum]; // return NULL
if (e == ubi->move_from) { // NULL == NULL gets true
goto retry; // infinite loop !!!$ top PID USER PR NI VIRT RES SHR S %CPU %MEM COMMAND 7676 root 20 0 0 0 0 R 100.0 0.0 ubifs_bgt0_0
Fix it by:
1) Letting ubi_wl_put_peb() returns directly if wearl leveling entry has
been removed from 'ubi->lookuptbl'.
2) Using 'ubi->wl_lock' protecting wl entry deletion to preventing an use-after-free problem for wl entry in ubi_wl_put_peb().
Fetch a reproducer in [Link].
--- drivers/mtd/ubi/wl.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
drivers/mtd/ubi/wl.c +14 -2
@@ -976,11 +976,11 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,spin_lock (&ubi->wl_lock); ubi->move_from = ubi->move_to =NULL ; ubi->move_to_put = ubi->wl_scheduled =0 ; +wl_entry_destroy (ubi, e1); +wl_entry_destroy (ubi, e2);spin_unlock (&ubi->wl_lock);ubi_free_vid_buf (vidb); -wl_entry_destroy (ubi, e1); -wl_entry_destroy (ubi, e2); out_ro:ubi_ro_mode (ubi);
@@ -1260,6 +1260,18 @@ int ubi_wl_put_peb(struct ubi_device *ubi, int vol_id, int lnum, retry:spin_lock (&ubi->wl_lock); e = ubi->lookuptbl[pnum]; +if (!e) { +/* +* This wl entry has been removed for some errors by other +* process (eg. wear leveling worker), corresponding process +* (except __erase_worker, which cannot concurrent with +* ubi_wl_put_peb) will set ubi ro_mode at the same time, +* just ignore this wl entry. +*/ +spin_unlock (&ubi->wl_lock); +up_read (&ubi->fm_protect); +return 0 ; + }if (e == ubi->move_from) {/* * User is putting the physical eraseblock which was selected to
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 44/211 f2fs: fix to handle F2FS_IOC_START_ATOMIC_REPLACE in f2fs_compat_ioctl()
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit 933141e4eb49d8b48721e2377835063a1e8fb823 ]
Otherwise, 32-bits binary call ioctl(F2FS_IOC_START_ATOMIC_REPLACE) will fail in 64-bits kernel.
--- fs/f2fs/file.c | 1 + 1 file changed, 1 insertion(+)
fs/f2fs/file.c +1 -0
@@ -4827,6 +4827,7 @@ long f2fs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)case F2FS_IOC32_MOVE_RANGE :return f2fs_compat_ioc_move_range (file, arg);case F2FS_IOC_START_ATOMIC_WRITE : +case F2FS_IOC_START_ATOMIC_REPLACE :case F2FS_IOC_COMMIT_ATOMIC_WRITE :case F2FS_IOC_START_VOLATILE_WRITE :case F2FS_IOC_RELEASE_VOLATILE_WRITE :
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 45/211 f2fs: fix to avoid potential memory corruption in __update_iostat_latency()
In reply to Greg Kroah-HartmanFrom: Yangtao Li <[email protected]>
[ Upstream commit 0dbbf0fb38d5ec5d4138d1aeaeb43d9217b9a592 ]
Add iotype sanity check to avoid potential memory corruption. This is to fix the compile error below:
fs/f2fs/iostat.c:231 __update_iostat_latency() error: buffer overflow 'io_lat->peak_lat[type]' 3 <= 3
vim +228 fs/f2fs/iostat.c
211 static inline void __update_iostat_latency(struct bio_iostat_ctx
*iostat_ctx,
212 enum iostat_lat_type type)
213 {
214 unsigned long ts_diff;
215 unsigned int page_type = iostat_ctx->type;
216 struct f2fs_sb_info *sbi = iostat_ctx->sbi;
217 struct iostat_lat_info *io_lat = sbi->iostat_io_lat;
218 unsigned long flags;
219
220 if (!sbi->iostat_enable)
221 return;
222
223 ts_diff = jiffies - iostat_ctx->submit_ts;
224 if (page_type >= META_FLUSH)
^^^^^^^^^^
225 page_type = META;
226
227 spin_lock_irqsave(&sbi->iostat_lat_lock, flags);
@228 io_lat->sum_lat[type][page_type] += ts_diff;
^^^^^^^^^Mixup between META_FLUSH and NR_PAGE_TYPE leads to memory corruption.
--- fs/f2fs/iostat.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/f2fs/iostat.c +5 -1
@@ -227,8 +227,12 @@ static inline void __update_iostat_latency(struct bio_iostat_ctx *iostat_ctx,return ; ts_diff = jiffies - iostat_ctx->submit_ts; -if (iotype >=META_FLUSH ) +if (iotype ==META_FLUSH ) { iotype =META ; + }else if (iotype >=NR_PAGE_TYPE ) { +f2fs_warn (sbi,"%s: %d over NR_PAGE_TYPE" , __func__, iotype); +return ; + }if (rw ==0 ) { idx =READ_IO ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 46/211 f2fs: fix to update age extent correctly during truncation
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit 8c0ed062ce27f6b7f0a568cb241e2b4dd2d9e6a6 ]
nr_free may be less than len, we should update age extent cache w/ range [fofs, len] rather than [fofs, nr_free].
--- fs/f2fs/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/f2fs/file.c +1 -1
@@ -619,7 +619,7 @@ void f2fs_truncate_data_blocks_range(struct dnode_of_data *dn, int count) fofs =f2fs_start_bidx_of_node (ofs_of_node (dn->node_page), dn->inode) + ofs;f2fs_update_read_extent_cache_range (dn, fofs,0 , len); -f2fs_update_age_extent_cache_range (dn, fofs, nr_free); +f2fs_update_age_extent_cache_range (dn, fofs, len);dec_valid_block_count (sbi, dn->inode, nr_free); } dn->ofs_in_node = ofs;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 47/211 f2fs: fix to update age extent in f2fs_do_zero_range()
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit a84153f939808102dfa10904aa0f743e734a3e1d ]
We should update age extent in f2fs_do_zero_range() like we did in f2fs_truncate_data_blocks_range().
--- fs/f2fs/file.c | 1 + 1 file changed, 1 insertion(+)
fs/f2fs/file.c +1 -0
@@ -1498,6 +1498,7 @@ static int f2fs_do_zero_range(struct dnode_of_data *dn, pgoff_t start, }f2fs_update_read_extent_cache_range (dn, start,0 , index - start); +f2fs_update_age_extent_cache_range (dn, start, index - start);return ret; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 48/211 soc: qcom: stats: Populate all subsystem debugfs files
In reply to Greg Kroah-HartmanFrom: Stephen Boyd <[email protected]>
[ Upstream commit acdbf5f9b2c492505145f6e50c65418521a547c4 ]
This driver relies on SMEM to populate items for each subsystem before the device probes. The items in SMEM that are being looked for are populated by the subsystems lazily, and therefore may not exist until the device has booted. For example, if I build this driver into the kernel on Trogdor Lazor and boot up, I don't see a 'modem' debugfs file populated, because the modem boots and populates the SMEM item after this driver probes.
Always populate the files for the subsystems if they're in SMEM, and make the qcom_subsystem_sleep_stats_show() function return 0 if the SMEM items still isn't there. This way we can run a simple command like
grep ^ /sys/kernel/debug/qcom_stats/*
and collect the subsystem sleep stats without interspersed errors or missing details entirely because this driver probed first.
--- drivers/soc/qcom/qcom_stats.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-)
drivers/soc/qcom/qcom_stats.c +2 -8
@@ -92,7 +92,7 @@ static int qcom_subsystem_sleep_stats_show(struct seq_file *s, void *unused)/* Items are allocated lazily, so lookup pointer each time */ stat =qcom_smem_get (subsystem->pid, subsystem->smem_item,NULL );if (IS_ERR (stat)) -return -EIO ; +return 0 ;qcom_print_stats (s, stat);
@@ -170,20 +170,14 @@ static void qcom_create_soc_sleep_stat_files(struct dentry *root, void __iomem *static void qcom_create_subsystem_stat_files (struct dentry *root,const struct stats_config *config) { -const struct sleep_stats *stat;int i;if (!config->subsystem_stats_in_smem)return ; -for (i =0 ; i <ARRAY_SIZE (subsystems); i++) { - stat =qcom_smem_get (subsystems[i].pid, subsystems[i].smem_item,NULL ); -if (IS_ERR (stat)) -continue ; - +for (i =0 ; i <ARRAY_SIZE (subsystems); i++)debugfs_create_file (subsystems[i].name,0400 , root, (void *)&subsystems[i], &qcom_subsystem_sleep_stats_fops); - } }static int qcom_stats_probe (struct platform_device *pdev)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 49/211 f2fs: introduce IS_F2FS_IPU_* macro
In reply to Greg Kroah-HartmanFrom: Yangtao Li <[email protected]>
[ Upstream commit fdb7ccc3f9cb316c399b072c7a75a106678eb421 ]
IS_F2FS_IPU_* macro can be used to identify whether f2fs ipu related policies are enabled.
BTW, convert to use BIT() instead of open code.
Stable-dep-of: c5bf83483382 ("f2fs: fix to set ipu policy")
--- fs/f2fs/data.c | 25 ++++++++++--------------- fs/f2fs/segment.c | 4 ++-- fs/f2fs/segment.h | 15 +++++++++++++++ fs/f2fs/super.c | 4 ++-- 4 files changed, 29 insertions(+), 19 deletions(-)
fs/f2fs/data.c +10 -15
@@ -2535,34 +2535,29 @@ static inline bool check_inplace_update_policy(struct inode *inode, struct f2fs_io_info *fio) {struct f2fs_sb_info *sbi =F2FS_I_SB (inode); -unsigned int policy =SM_I (sbi)->ipu_policy; -if (policy & (0x1 <<F2FS_IPU_HONOR_OPU_WRITE ) && -is_inode_flag_set (inode,FI_OPU_WRITE )) +if (IS_F2FS_IPU_HONOR_OPU_WRITE (sbi) && +is_inode_flag_set (inode,FI_OPU_WRITE ))return false; -if (policy & (0x1 <<F2FS_IPU_FORCE )) +if (IS_F2FS_IPU_FORCE (sbi))return true; -if (policy & (0x1 <<F2FS_IPU_SSR ) &&f2fs_need_SSR (sbi)) +if (IS_F2FS_IPU_SSR (sbi) &&f2fs_need_SSR (sbi))return true; -if (policy & (0x1 <<F2FS_IPU_UTIL ) && -utilization (sbi) >SM_I (sbi)->min_ipu_util) +if (IS_F2FS_IPU_UTIL (sbi) &&utilization (sbi) >SM_I (sbi)->min_ipu_util)return true; -if (policy & (0x1 <<F2FS_IPU_SSR_UTIL ) &&f2fs_need_SSR (sbi) && -utilization (sbi) >SM_I (sbi)->min_ipu_util) +if (IS_F2FS_IPU_SSR_UTIL (sbi) &&f2fs_need_SSR (sbi) && +utilization (sbi) >SM_I (sbi)->min_ipu_util)return true;/* * IPU for rewrite async pages */ -if (policy & (0x1 <<F2FS_IPU_ASYNC ) && - fio && fio->op ==REQ_OP_WRITE && - !(fio->op_flags &REQ_SYNC ) && - !IS_ENCRYPTED (inode)) +if (IS_F2FS_IPU_ASYNC (sbi) && fio && fio->op ==REQ_OP_WRITE && + !(fio->op_flags &REQ_SYNC ) && !IS_ENCRYPTED (inode))return true;/* this is only set during fdatasync */ -if (policy & (0x1 <<F2FS_IPU_FSYNC ) && -is_inode_flag_set (inode,FI_NEED_IPU )) +if (IS_F2FS_IPU_FSYNC (sbi) &&is_inode_flag_set (inode,FI_NEED_IPU ))return true; if (unlikely(fio && is_sbi_flag_set(sbi, SBI_CP_DISABLED) &&
fs/f2fs/segment.c +2 -2
@@ -3498,7 +3498,7 @@ int f2fs_inplace_write_data(struct f2fs_io_info *fio)stat_inc_inplace_blocks (fio->sbi); -if (fio->bio && !(SM_I (sbi)->ipu_policy & (1 <<F2FS_IPU_NOCACHE ))) +if (fio->bio && !IS_F2FS_IPU_NOCACHE (sbi)) err =f2fs_merge_page_bio (fio);else err =f2fs_submit_page_bio (fio);
@@ -5137,7 +5137,7 @@ int f2fs_build_segment_manager(struct f2fs_sb_info *sbi) sm_info->rec_prefree_segments =DEF_MAX_RECLAIM_PREFREE_SEGMENTS ;if (!f2fs_lfs_mode (sbi)) - sm_info->ipu_policy =1 <<F2FS_IPU_FSYNC ; + sm_info->ipu_policy =BIT (F2FS_IPU_FSYNC ); sm_info->min_ipu_util =DEF_MIN_IPU_UTIL ; sm_info->min_fsync_blocks =DEF_MIN_FSYNC_BLOCKS ; sm_info->min_seq_blocks = sbi->blocks_per_seg;
fs/f2fs/segment.h +15 -0
@@ -681,6 +681,21 @@ enum { F2FS_IPU_HONOR_OPU_WRITE, }; +#define F2FS_IPU_POLICY (name) \ +static inline int IS_##name(struct f2fs_sb_info *sbi) \ +{ \ + return SM_I(sbi)->ipu_policy & BIT(name); \ +} + +F2FS_IPU_POLICY (F2FS_IPU_FORCE ); +F2FS_IPU_POLICY (F2FS_IPU_SSR ); +F2FS_IPU_POLICY (F2FS_IPU_UTIL ); +F2FS_IPU_POLICY (F2FS_IPU_SSR_UTIL ); +F2FS_IPU_POLICY (F2FS_IPU_FSYNC ); +F2FS_IPU_POLICY (F2FS_IPU_ASYNC ); +F2FS_IPU_POLICY (F2FS_IPU_NOCACHE ); +F2FS_IPU_POLICY (F2FS_IPU_HONOR_OPU_WRITE ); +static inline unsigned int curseg_segno (struct f2fs_sb_info *sbi,int type) {
fs/f2fs/super.c +2 -2
@@ -4089,8 +4089,8 @@ static void f2fs_tuning_parameters(struct f2fs_sb_info *sbi)if (f2fs_block_unit_discard (sbi))SM_I (sbi)->dcc_info->discard_granularity =MIN_DISCARD_GRANULARITY ; -SM_I (sbi)->ipu_policy =1 <<F2FS_IPU_FORCE | -1 <<F2FS_IPU_HONOR_OPU_WRITE ; +SM_I (sbi)->ipu_policy =BIT (F2FS_IPU_FORCE ) | +BIT (F2FS_IPU_HONOR_OPU_WRITE ); } sbi->readdir_ra = true;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 50/211 f2fs: fix to set ipu policy
In reply to Greg Kroah-HartmanFrom: Yangtao Li <[email protected]>
[ Upstream commit c5bf83483382600988d7db5ffe9fcd1936b491fd ]
For LFS mode, it should update outplace and no need inplace update. When using LFS mode for small-volume devices, IPU will not be used, and the OPU writing method is actually used, but F2FS_IPU_FORCE can be read from the ipu_policy node, which is different from the actual situation. And remount to lfs mode should be disallowed when f2fs ipu is enabled, let's fix it.
--- fs/f2fs/segment.h | 10 +++++++++- fs/f2fs/super.c | 15 +++++++++++---- fs/f2fs/sysfs.c | 9 +++++++++ 3 files changed, 29 insertions(+), 5 deletions(-)
fs/f2fs/segment.h +9 -1
@@ -670,6 +670,8 @@ static inline int utilization(struct f2fs_sb_info *sbi)#define SMALL_VOLUME_SEGMENTS (16 * 512)/* 16GB */ +#define F2FS_IPU_DISABLE 0 +enum {F2FS_IPU_FORCE ,F2FS_IPU_SSR ,
@@ -679,10 +681,16 @@ enum {F2FS_IPU_ASYNC ,F2FS_IPU_NOCACHE ,F2FS_IPU_HONOR_OPU_WRITE , + F2FS_IPU_MAX, }; +static inline bool IS_F2FS_IPU_DISABLE (struct f2fs_sb_info *sbi) +{ +return SM_I (sbi)->ipu_policy ==F2FS_IPU_DISABLE ; +} +#define F2FS_IPU_POLICY (name) \ -static inline int IS_##name(struct f2fs_sb_info *sbi) \ +static inline bool IS_##name(struct f2fs_sb_info *sbi) \ { \ return SM_I(sbi)->ipu_policy & BIT(name); \ }
fs/f2fs/super.c +11 -4
@@ -1347,12 +1347,12 @@ static int parse_options(struct super_block *sb, char *options, bool is_remount) }if (test_opt (sbi,DISABLE_CHECKPOINT ) &&f2fs_lfs_mode (sbi)) { -f2fs_err (sbi,"LFS not compatible with checkpoint=disable" ); +f2fs_err (sbi,"LFS is not compatible with checkpoint=disable" );return -EINVAL ; }if (test_opt (sbi,ATGC ) &&f2fs_lfs_mode (sbi)) { -f2fs_err (sbi,"LFS not compatible with ATGC" ); +f2fs_err (sbi,"LFS is not compatible with ATGC" );return -EINVAL ; }
@@ -2306,6 +2306,12 @@ static int f2fs_remount(struct super_block *sb, int *flags, char *data) } }#endif +if (f2fs_lfs_mode (sbi) && !IS_F2FS_IPU_DISABLE (sbi)) { + err = -EINVAL ; +f2fs_warn (sbi,"LFS is not compatible with IPU" ); + goto restore_opts; + } +/* disallow enable atgc dynamically */ if (no_atgc == !!test_opt (sbi,ATGC )) { err = -EINVAL ;
@@ -4089,8 +4095,9 @@ static void f2fs_tuning_parameters(struct f2fs_sb_info *sbi)if (f2fs_block_unit_discard (sbi))SM_I (sbi)->dcc_info->discard_granularity =MIN_DISCARD_GRANULARITY ; -SM_I (sbi)->ipu_policy =BIT (F2FS_IPU_FORCE ) | -BIT (F2FS_IPU_HONOR_OPU_WRITE ); +if (!f2fs_lfs_mode (sbi)) +SM_I (sbi)->ipu_policy =BIT (F2FS_IPU_FORCE ) | +BIT (F2FS_IPU_HONOR_OPU_WRITE ); } sbi->readdir_ra = true;
fs/f2fs/sysfs.c +9 -0
@@ -686,6 +686,15 @@ static ssize_t __sbi_store(struct f2fs_attr *a,return count; } +if (!strcmp (a->attr.name,"ipu_policy" )) { +if (t >=BIT (F2FS_IPU_MAX )) +return -EINVAL ; +if (t &&f2fs_lfs_mode (sbi)) +return -EINVAL ; +SM_I (sbi)->ipu_policy = (unsigned int )t; +return count; + } + *ui = (unsigned int )t;return count;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 51/211 ext4: use ext4_fc_tl_mem in fast-commit replay path
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
[ Upstream commit 11768cfd98136dd8399480c60b7a5d3d3c7b109b ]
To avoid 'sparse' warnings about missing endianness conversions, don't store native endianness values into struct ext4_fc_tl. Instead, use a separate struct type, ext4_fc_tl_mem.
--- fs/ext4/fast_commit.c | 44 +++++++++++++++++++++++++------------------ 1 file changed, 26 insertions(+), 18 deletions(-)
fs/ext4/fast_commit.c +26 -18
@@ -1332,8 +1332,14 @@ struct dentry_info_args {char *dname; }; +/* Same as struct ext4_fc_tl, but uses native endianness fields */ +struct ext4_fc_tl_mem { +u16 fc_tag; +u16 fc_len; +}; +static inline void tl_to_darg (struct dentry_info_args *darg, -struct ext4_fc_tl *tl,u8 *val) +struct ext4_fc_tl_mem *tl,u8 *val) {struct ext4_fc_dentry_info fcd;
@@ -1345,16 +1351,18 @@ static inline void tl_to_darg(struct dentry_info_args *darg, darg->dname_len = tl->fc_len -sizeof (struct ext4_fc_dentry_info ); } -static inline void ext4_fc_get_tl (struct ext4_fc_tl *tl,u8 *val) +static inline void ext4_fc_get_tl (struct ext4_fc_tl_mem *tl,u8 *val) { -memcpy (tl, val,EXT4_FC_TAG_BASE_LEN ); - tl->fc_len =le16_to_cpu (tl->fc_len); - tl->fc_tag =le16_to_cpu (tl->fc_tag); +struct ext4_fc_tl tl_disk; + +memcpy (&tl_disk, val,EXT4_FC_TAG_BASE_LEN ); + tl->fc_len =le16_to_cpu (tl_disk.fc_len); + tl->fc_tag =le16_to_cpu (tl_disk.fc_tag); }/* Unlink replay function */ -static int ext4_fc_replay_unlink (struct super_block *sb,struct ext4_fc_tl *tl, -u8 *val) +static int ext4_fc_replay_unlink (struct super_block *sb, +struct ext4_fc_tl_mem *tl,u8 *val) {struct inode *inode, *old_parent;struct qstr entry;
@@ -1451,8 +1459,8 @@ static int ext4_fc_replay_link_internal(struct super_block *sb, }/* Link replay function */ -static int ext4_fc_replay_link (struct super_block *sb,struct ext4_fc_tl *tl, -u8 *val) +static int ext4_fc_replay_link (struct super_block *sb, +struct ext4_fc_tl_mem *tl,u8 *val) {struct inode *inode;struct dentry_info_args darg;
@@ -1506,8 +1514,8 @@ static int ext4_fc_record_modified_inode(struct super_block *sb, int ino)/* * Inode replay function */ -static int ext4_fc_replay_inode (struct super_block *sb,struct ext4_fc_tl *tl, -u8 *val) +static int ext4_fc_replay_inode (struct super_block *sb, +struct ext4_fc_tl_mem *tl,u8 *val) {struct ext4_fc_inode fc_inode;struct ext4_inode *raw_inode;
@@ -1609,8 +1617,8 @@ static int ext4_fc_replay_inode(struct super_block *sb, struct ext4_fc_tl *tl,* inode for which we are trying to create a dentry here, should already have * been replayed before we start here. */ -static int ext4_fc_replay_create (struct super_block *sb,struct ext4_fc_tl *tl, -u8 *val) +static int ext4_fc_replay_create (struct super_block *sb, +struct ext4_fc_tl_mem *tl,u8 *val) {int ret =0 ;struct inode *inode =NULL ;
@@ -1708,7 +1716,7 @@ int ext4_fc_record_regions(struct super_block *sb, int ino,/* Replay add range tag */ static int ext4_fc_replay_add_range (struct super_block *sb, -struct ext4_fc_tl *tl,u8 *val) +struct ext4_fc_tl_mem *tl,u8 *val) {struct ext4_fc_add_range fc_add_ex;struct ext4_extent newex, *ex;
@@ -1828,8 +1836,8 @@ static int ext4_fc_replay_add_range(struct super_block *sb,/* Replay DEL_RANGE tag */ static int -ext4_fc_replay_del_range (struct super_block *sb,struct ext4_fc_tl *tl, -u8 *val) +ext4_fc_replay_del_range (struct super_block *sb, +struct ext4_fc_tl_mem *tl,u8 *val) {struct inode *inode;struct ext4_fc_del_range lrange;
@@ -2025,7 +2033,7 @@ static int ext4_fc_replay_scan(journal_t *journal,struct ext4_fc_replay_state *state;int ret =JBD2_FC_REPLAY_CONTINUE ;struct ext4_fc_add_range ext; -struct ext4_fc_tl tl; +struct ext4_fc_tl_mem tl;struct ext4_fc_tail tail;__u8 *start, *end, *cur, *val;struct ext4_fc_head head;
@@ -2144,7 +2152,7 @@ static int ext4_fc_replay(journal_t *journal, struct buffer_head *bh, {struct super_block *sb = journal->j_private;struct ext4_sb_info *sbi =EXT4_SB (sb); -struct ext4_fc_tl tl; +struct ext4_fc_tl_mem tl;__u8 *start, *end, *cur, *val;int ret =JBD2_FC_REPLAY_CONTINUE ;struct ext4_fc_replay_state *state = &sbi->s_fc_replay_state;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 52/211 ext4: dont show commit interval if it is zero
In reply to Greg Kroah-HartmanFrom: Wang Jianjian <[email protected]>
[ Upstream commit 934b0de1e9fdea93c4c7f2e18915c54fae67bdc6 ]
If commit interval is 0, it means using default value.
--- fs/ext4/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/super.c +1 -1
@@ -2146,7 +2146,7 @@ static int ext4_parse_param(struct fs_context *fc, struct fs_parameter *param)return 0 ;case Opt_commit:if (result.uint_32 ==0 ) - ctx->s_commit_interval =JBD2_DEFAULT_MAX_COMMIT_AGE ; + result.uint_32 =JBD2_DEFAULT_MAX_COMMIT_AGE ;else if (result.uint_32 >INT_MAX /HZ ) {ext4_msg (NULL ,KERN_ERR , "Invalid commit interval %d, "
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 53/211 netfilter: nf_tables: allow to fetch set elements when table has an owner
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 92f3e96d642f5e05b9dc710c06fedc669f1b4f00 ]
NFT_MSG_GETSETELEM returns -EPERM when fetching set elements that belong to table that has an owner. This results in empty set/map listing from userspace.
--- net/netfilter/nf_tables_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +1 -1
@@ -5487,7 +5487,7 @@ static int nf_tables_getsetelem(struct sk_buff *skb,int rem, err =0 ; table =nft_table_lookup (net, nla[NFTA_SET_ELEM_LIST_TABLE ], family, - genmask,NETLINK_CB (skb).portid); + genmask,0 );if (IS_ERR (table)) {NL_SET_BAD_ATTR (extack, nla[NFTA_SET_ELEM_LIST_TABLE ]);return PTR_ERR (table);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 54/211 x86: um: vdso: Add %rcx and %r11 to the syscall clobber list
In reply to Greg Kroah-HartmanFrom: Ammar Faizi <[email protected]>
[ Upstream commit 5541992e512de8c9133110809f767bd1b54ee10d ]
The 'syscall' instruction clobbers '%rcx' and '%r11', but they are not listed in the inline Assembly that performs the syscall instruction.
No real bug is found. It wasn't buggy by luck because '%rcx' and '%r11' are caller-saved registers, and not used in the functions, and the functions are never inlined.
Add them to the clobber list for code correctness.
--- arch/x86/um/vdso/um_vdso.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
arch/x86/um/vdso/um_vdso.c +8 -4
@@ -17,8 +17,10 @@ int __vdso_clock_gettime(clockid_t clock, struct __kernel_old_timespec *ts) {long ret; - asm("syscall" :"=a" (ret) : -"0" (__NR_clock_gettime),"D" (clock),"S" (ts) :"memory" ); + asm("syscall" + :"=a" (ret) + :"0" (__NR_clock_gettime),"D" (clock),"S" (ts) + :"rcx" ,"r11" ,"memory" );return ret; }
@@ -29,8 +31,10 @@ int __vdso_gettimeofday(struct __kernel_old_timeval *tv, struct timezone *tz) {long ret; - asm("syscall" :"=a" (ret) : -"0" (__NR_gettimeofday),"D" (tv),"S" (tz) :"memory" ); + asm("syscall" + :"=a" (ret) + :"0" (__NR_gettimeofday),"D" (tv),"S" (tz) + :"rcx" ,"r11" ,"memory" );return ret; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 55/211 um: virtio_uml: free command if adding to virtqueue failed
In reply to Greg Kroah-HartmanFrom: Benjamin Berg <[email protected]>
[ Upstream commit 8a6ca543646f2940832665dbf4e04105262505e2 ]
If adding the command fails (i.e. the virtqueue is broken) then free it again if the function allocated a new buffer for it.
--- arch/um/drivers/virt-pci.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/um/drivers/virt-pci.c +4 -1
@@ -132,8 +132,11 @@ static int um_pci_send_cmd(struct um_pci_device *dev, out ?1 :0 , posted ? cmd :HANDLE_NO_FREE (cmd), GFP_ATOMIC); -if (ret) +if (ret) { +if (posted) +kfree (cmd); goto out; + }if (posted) {virtqueue_kick (dev->cmd_vq);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 56/211 um: virtio_uml: mark device as unregistered when breaking it
In reply to Greg Kroah-HartmanFrom: Benjamin Berg <[email protected]>
[ Upstream commit 8e9cd85139a2149d5a7c121b05e0cdb8287311f9 ]
Mark the device as not registered anymore when scheduling the work to remove it. Otherwise we could end up scheduling the work multiple times in a row, including scheduling it while it is already running.
--- arch/um/drivers/virtio_uml.c | 2 ++ 1 file changed, 2 insertions(+)
arch/um/drivers/virtio_uml.c +2 -0
@@ -168,6 +168,8 @@ static void vhost_user_check_reset(struct virtio_uml_device *vu_dev,if (!vu_dev->registered)return ; + vu_dev->registered =0 ; +virtio_break_device (&vu_dev->vdev);schedule_work (&pdata->conn_broken_wk); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 57/211 um: virtio_uml: move device breaking into workqueue
In reply to Greg Kroah-HartmanFrom: Benjamin Berg <[email protected]>
[ Upstream commit abdeb4fa5e1b5b4918034f02236fd886f40c20c1 ]
We should not be calling virtio_break_device from an IRQ context. Move breaking the device into the workqueue so that it is done from a reasonable context.
--- arch/um/drivers/virtio_uml.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
arch/um/drivers/virtio_uml.c +15 -1
@@ -170,7 +170,6 @@ static void vhost_user_check_reset(struct virtio_uml_device *vu_dev, vu_dev->registered =0 ; -virtio_break_device (&vu_dev->vdev);schedule_work (&pdata->conn_broken_wk); }
@@ -1138,6 +1137,15 @@ void virtio_uml_set_no_vq_suspend(struct virtio_device *vdev,static void vu_of_conn_broken (struct work_struct *wk) { +struct virtio_uml_platform_data *pdata; +struct virtio_uml_device *vu_dev; + + pdata = container_of(wk, struct virtio_uml_platform_data, conn_broken_wk); + + vu_dev =platform_get_drvdata (pdata->pdev); + +virtio_break_device (&vu_dev->vdev); +/* * We can't remove the device from the devicetree so the only thing we * can do is warn.
@@ -1268,8 +1276,14 @@ static int vu_unregister_cmdline_device(struct device *dev, void *data)static void vu_conn_broken (struct work_struct *wk) {struct virtio_uml_platform_data *pdata; +struct virtio_uml_device *vu_dev; pdata = container_of(wk, struct virtio_uml_platform_data, conn_broken_wk); + + vu_dev =platform_get_drvdata (pdata->pdev); + +virtio_break_device (&vu_dev->vdev); +vu_unregister_cmdline_device (&pdata->pdev->dev,NULL ); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 58/211 um: virt-pci: properly remove PCI device from bus
In reply to Greg Kroah-HartmanFrom: Benjamin Berg <[email protected]>
[ Upstream commit 339b84dcd7113dd076419ea2a47128cc53450305 ]
Triggering a bus rescan will not cause the PCI device to be removed. It is required to explicitly stop and remove the device from the bus.
--- arch/um/drivers/virt-pci.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-)
arch/um/drivers/virt-pci.c +16 -5
@@ -626,22 +626,33 @@ static void um_pci_virtio_remove(struct virtio_device *vdev)struct um_pci_device *dev = vdev->priv;int i; -/* Stop all virtqueues */ -virtio_reset_device (vdev); - vdev->config->del_vqs (vdev); -device_set_wakeup_enable (&vdev->dev, false);mutex_lock (&um_pci_mtx);for (i =0 ; i <MAX_DEVICES ; i++) {if (um_pci_devices[i].dev != dev)continue ; + um_pci_devices[i].dev =NULL ;irq_free_desc (dev->irq); + +break ; }mutex_unlock (&um_pci_mtx); -um_pci_rescan (); +if (i <MAX_DEVICES ) { +struct pci_dev *pci_dev; + + pci_dev =pci_get_slot (bridge->bus, i); +if (pci_dev) +pci_stop_and_remove_bus_device_locked (pci_dev); + } + +/* Stop all virtqueues */ +virtio_reset_device (vdev); + dev->cmd_vq =NULL ; + dev->irq_vq =NULL ; + vdev->config->del_vqs (vdev);kfree (dev); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 59/211 f2fs: synchronize atomic write aborts
In reply to Greg Kroah-HartmanFrom: Daeho Jeong <[email protected]>
[ Upstream commit a46bebd502fe1a3bd1d22f64cedd93e7e7702693 ]
To fix a race condition between atomic write aborts, I use the inode lock and make COW inode to be re-usable thoroughout the whole atomic file inode lifetime.
--- fs/f2fs/file.c | 44 +++++++++++++++++++++++++++++--------------- fs/f2fs/inode.c | 11 +++++++++-- fs/f2fs/segment.c | 3 --- fs/f2fs/super.c | 2 -- 4 files changed, 38 insertions(+), 22 deletions(-)
fs/f2fs/file.c +29 -15
@@ -1867,7 +1867,10 @@ static int f2fs_release_file(struct inode *inode, struct file *filp) atomic_read(&inode->i_writecount) != 1)return 0 ; +inode_lock (inode);f2fs_abort_atomic_write (inode, true); +inode_unlock (inode); +return 0 ; }
@@ -1882,8 +1885,12 @@ static int f2fs_file_flush(struct file *file, fl_owner_t id)* before dropping file lock, it needs to do in ->flush. */ if (F2FS_I (inode)->atomic_write_task == current && - (current->flags &PF_EXITING )) + (current->flags &PF_EXITING )) { +inode_lock (inode);f2fs_abort_atomic_write (inode, true); +inode_unlock (inode); + } +return 0 ; }
@@ -2089,19 +2096,28 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate) goto out; } -/* Create a COW inode for atomic write */ - pinode =f2fs_iget (inode->i_sb, fi->i_pino); -if (IS_ERR (pinode)) { -f2fs_up_write (&fi->i_gc_rwsem[WRITE ]); - ret =PTR_ERR (pinode); - goto out; - } +/* Check if the inode already has a COW inode */ +if (fi->cow_inode ==NULL ) { +/* Create a COW inode for atomic write */ + pinode =f2fs_iget (inode->i_sb, fi->i_pino); +if (IS_ERR (pinode)) { +f2fs_up_write (&fi->i_gc_rwsem[WRITE ]); + ret =PTR_ERR (pinode); + goto out; + } - ret =f2fs_get_tmpfile (mnt_userns, pinode, &fi->cow_inode); -iput (pinode); -if (ret) { -f2fs_up_write (&fi->i_gc_rwsem[WRITE ]); - goto out; + ret =f2fs_get_tmpfile (mnt_userns, pinode, &fi->cow_inode); +iput (pinode); +if (ret) { +f2fs_up_write (&fi->i_gc_rwsem[WRITE ]); + goto out; + } + +set_inode_flag (fi->cow_inode,FI_COW_FILE ); +clear_inode_flag (fi->cow_inode,FI_INLINE_DATA ); + }else { +/* Reuse the already created COW inode */ +f2fs_do_truncate_blocks (fi->cow_inode,0 , true); }f2fs_write_inode (inode,NULL );
@@ -2109,8 +2125,6 @@ static int f2fs_ioc_start_atomic_write(struct file *filp, bool truncate)stat_inc_atomic_inode (inode);set_inode_flag (inode,FI_ATOMIC_FILE ); -set_inode_flag (fi->cow_inode,FI_COW_FILE ); -clear_inode_flag (fi->cow_inode,FI_INLINE_DATA ); isize =i_size_read (inode); fi->original_i_size = isize;
fs/f2fs/inode.c +9 -2
@@ -767,11 +767,18 @@ int f2fs_write_inode(struct inode *inode, struct writeback_control *wbc)void f2fs_evict_inode (struct inode *inode) {struct f2fs_sb_info *sbi =F2FS_I_SB (inode); -nid_t xnid =F2FS_I (inode)->i_xattr_nid; +struct f2fs_inode_info *fi =F2FS_I (inode); +nid_t xnid = fi->i_xattr_nid;int err =0 ;f2fs_abort_atomic_write (inode, true); +if (fi->cow_inode) { +clear_inode_flag (fi->cow_inode,FI_COW_FILE ); +iput (fi->cow_inode); + fi->cow_inode =NULL ; + } +trace_f2fs_evict_inode (inode);truncate_inode_pages_final (&inode->i_data);
@@ -858,7 +865,7 @@ void f2fs_evict_inode(struct inode *inode)stat_dec_inline_inode (inode);stat_dec_compr_inode (inode);stat_sub_compr_blocks (inode, -atomic_read (&F2FS_I (inode)->i_compr_blocks)); +atomic_read (&fi->i_compr_blocks));if (likely (!f2fs_cp_error (sbi) && !is_sbi_flag_set (sbi,SBI_CP_DISABLED )))
fs/f2fs/segment.c +0 -3
@@ -192,9 +192,6 @@ void f2fs_abort_atomic_write(struct inode *inode, bool clean)if (!f2fs_is_atomic_file (inode))return ; -clear_inode_flag (fi->cow_inode,FI_COW_FILE ); -iput (fi->cow_inode); - fi->cow_inode =NULL ;release_atomic_write_cnt (inode);clear_inode_flag (inode,FI_ATOMIC_COMMITTED );clear_inode_flag (inode,FI_ATOMIC_REPLACE );
fs/f2fs/super.c +0 -2
@@ -1430,8 +1430,6 @@ static int f2fs_drop_inode(struct inode *inode)atomic_inc (&inode->i_count);spin_unlock (&inode->i_lock); -f2fs_abort_atomic_write (inode, true); -/* should remain fi->extent_tree for writepage */ f2fs_destroy_extent_node (inode);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 60/211 watchdog: rzg2l_wdt: Issue a reset before we put the PM clocks
In reply to Greg Kroah-HartmanFrom: Lad Prabhakar <[email protected]>
[ Upstream commit 6ba6f0f5910d5916539268c0ad55657bb8940616 ]
On RZ/Five SoC it was observed that setting timeout (to say 1 sec) wouldn't reset the system.
The procedure described in the HW manual (Procedure for Activating Modules) for activating the target module states we need to start supply of the clock module before applying the reset signal. This patch makes sure we follow the same procedure to clear the registers of the WDT module, fixing the issues seen on RZ/Five SoC.
While at it re-used rzg2l_wdt_stop() in rzg2l_wdt_set_timeout() as it has the same function calls.
--- drivers/watchdog/rzg2l_wdt.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/watchdog/rzg2l_wdt.c +4 -6
@@ -115,25 +115,23 @@ static int rzg2l_wdt_stop(struct watchdog_device *wdev) {struct rzg2l_wdt_priv *priv =watchdog_get_drvdata (wdev); -pm_runtime_put (wdev->parent);reset_control_reset (priv->rstc); +pm_runtime_put (wdev->parent);return 0 ; }static int rzg2l_wdt_set_timeout (struct watchdog_device *wdev,unsigned int timeout) { -struct rzg2l_wdt_priv *priv =watchdog_get_drvdata (wdev); - wdev->timeout = timeout;/* * If the watchdog is active, reset the module for updating the WDTSET -* register so that it is updated with new timeout values. +* register by calling rzg2l_wdt_stop() (which internally calls reset_control_reset() +* to reset the module) so that it is updated with new timeout values. */ if (watchdog_active (wdev)) { -pm_runtime_put (wdev->parent); -reset_control_reset (priv->rstc); +rzg2l_wdt_stop (wdev);rzg2l_wdt_start (wdev); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 61/211 watchdog: rzg2l_wdt: Handle TYPE-B reset for RZ/V2M
In reply to Greg Kroah-HartmanFrom: Fabrizio Castro <[email protected]>
[ Upstream commit f769f97917c1e756e12ff042a93f6e3167254b5b ]
As per section 48.4 of the HW User Manual, IPs in the RZ/V2M SoC need either a TYPE-A reset sequence or a TYPE-B reset sequence. More specifically, the watchdog IP needs a TYPE-B reset sequence.
If the proper reset sequence isn't implemented, then resetting IPs may lead to undesired behaviour. In the restart callback of the watchdog driver the reset has basically no effect on the desired funcionality, as the register writes following the reset happen before the IP manages to come out of reset.
Implement the TYPE-B reset sequence in the watchdog driver to address the issues with the restart callback on RZ/V2M.
--- drivers/watchdog/rzg2l_wdt.c | 37 +++++++++++++++++++++++++++++++++++- 1 file changed, 36 insertions(+), 1 deletion(-)
drivers/watchdog/rzg2l_wdt.c +36 -1
@@ -8,6 +8,7 @@#include <linux/clk.h> #include <linux/delay.h> #include <linux/io.h> +#include <linux/iopoll.h> #include <linux/kernel.h> #include <linux/module.h> #include <linux/of_device.h>
@@ -35,6 +36,8 @@#define F2CYCLE_NSEC (f) (1000000000 / (f)) +#define RZV2M_A_NSEC 730 +static bool nowayout =WATCHDOG_NOWAYOUT ;module_param (nowayout, bool,0 ); MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default="
@@ -51,11 +54,35 @@ struct rzg2l_wdt_priv {struct reset_control *rstc;unsigned long osc_clk_rate;unsigned long delay; +unsigned long minimum_assertion_period;struct clk *pclk;struct clk *osc_clk;enum rz_wdt_type devtype; }; +static int rzg2l_wdt_reset (struct rzg2l_wdt_priv *priv) +{ +int err, status; + +if (priv->devtype ==WDT_RZV2M ) { +/* WDT needs TYPE-B reset control */ + err =reset_control_assert (priv->rstc); +if (err) +return err; +ndelay (priv->minimum_assertion_period); + err =reset_control_deassert (priv->rstc); +if (err) +return err; + err =read_poll_timeout (reset_control_status, status, + status !=1 ,0 ,1000 , false, + priv->rstc); + }else { + err =reset_control_reset (priv->rstc); + } + +return err; +} +static void rzg2l_wdt_wait_delay (struct rzg2l_wdt_priv *priv) {/* delay timer when change the setting register */
@@ -115,7 +142,7 @@ static int rzg2l_wdt_stop(struct watchdog_device *wdev) {struct rzg2l_wdt_priv *priv =watchdog_get_drvdata (wdev); -reset_control_reset (priv->rstc); +rzg2l_wdt_reset (priv);pm_runtime_put (wdev->parent);return 0 ;
@@ -154,6 +181,7 @@ static int rzg2l_wdt_restart(struct watchdog_device *wdev,rzg2l_wdt_write (priv,PEEN_FORCE ,PEEN ); }else {/* RZ/V2M doesn't have parity error registers */ +rzg2l_wdt_reset (priv); wdev->timeout =0 ;
@@ -251,6 +279,13 @@ static int rzg2l_wdt_probe(struct platform_device *pdev) priv->devtype = (uintptr_t )of_device_get_match_data (dev); +if (priv->devtype ==WDT_RZV2M ) { + priv->minimum_assertion_period =RZV2M_A_NSEC + +3 *F2CYCLE_NSEC (pclk_rate) +5 * +max (F2CYCLE_NSEC (priv->osc_clk_rate), +F2CYCLE_NSEC (pclk_rate)); + } +pm_runtime_enable (&pdev->dev); priv->wdev.info = &rzg2l_wdt_ident;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 62/211 watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path
In reply to Greg Kroah-HartmanFrom: ruanjinjie <[email protected]>
[ Upstream commit 07bec0e09c1afbab4c5674fd2341f4f52d594f30 ]
free_irq() is missing in case of error in at91_wdt_init(), use devm_request_irq to fix that.
--- drivers/watchdog/at91sam9_wdt.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/watchdog/at91sam9_wdt.c +3 -4
@@ -206,10 +206,9 @@ static int at91_wdt_init(struct platform_device *pdev, struct at91wdt *wdt) "min heartbeat and max heartbeat might be too close for the system to handle it correctly\n");if ((tmp &AT91_WDT_WDFIEN ) && wdt->irq) { - err =request_irq (wdt->irq, wdt_interrupt, -IRQF_SHARED |IRQF_IRQPOLL | -IRQF_NO_SUSPEND , - pdev->name, wdt); + err =devm_request_irq (dev, wdt->irq, wdt_interrupt, +IRQF_SHARED |IRQF_IRQPOLL |IRQF_NO_SUSPEND , + pdev->name, wdt);if (err)return err; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 63/211 watchdog: Fix kmemleak in watchdog_cdev_register
In reply to Greg Kroah-HartmanFrom: Chen Jun <[email protected]>
[ Upstream commit 13721a2ac66b246f5802ba1b75ad8637e53eeecc ]
kmemleak reports memory leaks in watchdog_dev_register, as follows:
unreferenced object 0xffff888116233000 (size 2048):
comm ""modprobe"", pid 28147, jiffies 4353426116 (age 61.741s) hex dump (first 32 bytes):
80 fa b9 05 81 88 ff ff 08 30 23 16 81 88 ff ff .........0#.....
08 30 23 16 81 88 ff ff 00 00 00 00 00 00 00 00 .0#.............
backtrace:
[<000000007f001ffd>] __kmem_cache_alloc_node+0x157/0x220
[<000000006a389304>] kmalloc_trace+0x21/0x110
[<000000008d640eea>] watchdog_dev_register+0x4e/0x780 [watchdog]
[<0000000053c9f248>] __watchdog_register_device+0x4f0/0x680 [watchdog]
[<00000000b2979824>] watchdog_register_device+0xd2/0x110 [watchdog]
[<000000001f730178>] 0xffffffffc10880ae
[<000000007a1a8bcc>] do_one_initcall+0xcb/0x4d0
[<00000000b98be325>] do_init_module+0x1ca/0x5f0
[<0000000046d08e7c>] load_module+0x6133/0x70f0
...unreferenced object 0xffff888105b9fa80 (size 16):
comm ""modprobe"", pid 28147, jiffies 4353426116 (age 61.741s) hex dump (first 16 bytes):
77 61 74 63 68 64 6f 67 31 00 b9 05 81 88 ff ff watchdog1.......
backtrace:
[<000000007f001ffd>] __kmem_cache_alloc_node+0x157/0x220
[<00000000486ab89b>] __kmalloc_node_track_caller+0x44/0x1b0
[<000000005a39aab0>] kvasprintf+0xb5/0x140
[<0000000024806f85>] kvasprintf_const+0x55/0x180
[<000000009276cb7f>] kobject_set_name_vargs+0x56/0x150
[<00000000a92e820b>] dev_set_name+0xab/0xe0
[<00000000cec812c6>] watchdog_dev_register+0x285/0x780 [watchdog]
[<0000000053c9f248>] __watchdog_register_device+0x4f0/0x680 [watchdog]
[<00000000b2979824>] watchdog_register_device+0xd2/0x110 [watchdog]
[<000000001f730178>] 0xffffffffc10880ae
[<000000007a1a8bcc>] do_one_initcall+0xcb/0x4d0
[<00000000b98be325>] do_init_module+0x1ca/0x5f0
[<0000000046d08e7c>] load_module+0x6133/0x70f0
...The reason is that put_device is not be called if cdev_device_add fails and wdd->id != 0.
watchdog_cdev_register
wd_data = kzalloc [1]
err = dev_set_name [2]
..
err = cdev_device_add
if (err) {
if (wdd->id == 0) { // wdd->id != 0
..
}
return err; // [1],[2] would be leakedTo fix it, call put_device in all wdd->id cases.
--- drivers/watchdog/watchdog_dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/watchdog/watchdog_dev.c +1 -1
@@ -1061,8 +1061,8 @@ static int watchdog_cdev_register(struct watchdog_device *wdd)if (wdd->id ==0 ) {misc_deregister (&watchdog_miscdev); old_wd_data =NULL ; -put_device (&wd_data->dev); } +put_device (&wd_data->dev);return err; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 64/211 watchdog: pcwd_usb: Fix attempting to access uninitialized memory
In reply to Greg Kroah-HartmanFrom: Li Hua <[email protected]>
[ Upstream commit 7d06c07c67100fd0f8e6b3ab7145ce789f788117 ]
The stack variable msb and lsb may be used uninitialized in function usb_pcwd_get_temperature and usb_pcwd_get_timeleft when usb card no response.
The build waring is:drivers/watchdog/pcwd_usb.c:336:22: error: ‘lsb’ is used uninitialized in this function [-Werror=uninitialized]
*temperature = (lsb * 9 / 5) + 32;
~~~~^~~
drivers/watchdog/pcwd_usb.c:328:21: note: ‘lsb’ was declared here
unsigned char msb, lsb;
^~~cc1: all warnings being treated as errorsscripts/Makefile.build:250: recipe for target 'drivers/watchdog/pcwd_usb.o' failed make[3]: *** [drivers/watchdog/pcwd_usb.o] Error 1
--- drivers/watchdog/pcwd_usb.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/watchdog/pcwd_usb.c +4 -2
@@ -325,7 +325,8 @@ static int usb_pcwd_set_heartbeat(struct usb_pcwd_private *usb_pcwd, int t)static int usb_pcwd_get_temperature (struct usb_pcwd_private *usb_pcwd,int *temperature) { -unsigned char msb, lsb; +unsigned char msb =0x00 ; +unsigned char lsb =0x00 ;usb_pcwd_send_command (usb_pcwd,CMD_READ_TEMP , &msb, &lsb);
@@ -341,7 +342,8 @@ static int usb_pcwd_get_temperature(struct usb_pcwd_private *usb_pcwd,static int usb_pcwd_get_timeleft (struct usb_pcwd_private *usb_pcwd,int *time_left) { -unsigned char msb, lsb; +unsigned char msb =0x00 ; +unsigned char lsb =0x00 ;/* Read the time that's left before rebooting */ /* Note: if the board is not yet armed then we will read 0xFFFF */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 65/211 watchdog: sbsa_wdog: Make sure the timeout programming is within the limits
In reply to Greg Kroah-HartmanFrom: George Cherian <[email protected]>
[ Upstream commit 000987a38b53c172f435142a4026dd71378ca464 ]
Make sure to honour the max_hw_heartbeat_ms while programming the timeout value to WOR. Clamp the timeout passed to sbsa_gwdt_set_timeout() to make sure the programmed value is within the permissible range.
--- drivers/watchdog/sbsa_gwdt.c | 1 + 1 file changed, 1 insertion(+)
drivers/watchdog/sbsa_gwdt.c +1 -0
@@ -150,6 +150,7 @@ static int sbsa_gwdt_set_timeout(struct watchdog_device *wdd,struct sbsa_gwdt *gwdt =watchdog_get_drvdata (wdd); wdd->timeout = timeout; + timeout = clamp_t(unsigned int, timeout, 1, wdd->max_hw_heartbeat_ms / 1000);if (action)sbsa_gwdt_reg_write (gwdt->clk * timeout, gwdt);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 66/211 netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack()
In reply to Greg Kroah-HartmanFrom: Hangyu Hua <[email protected]>
[ Upstream commit ac4893980bbe79ce383daf9a0885666a30fe4c83 ]
nf_ct_put() needs to be called to put the refcount got by nf_conntrack_find_get() to avoid refcount leak when nf_conntrack_hash_check_insert() fails.
--- net/netfilter/nf_conntrack_netlink.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/netfilter/nf_conntrack_netlink.c +4 -1
@@ -2375,12 +2375,15 @@ ctnetlink_create_conntrack(struct net *net, err =nf_conntrack_hash_check_insert (ct);if (err <0 ) - goto err2; + goto err3;rcu_read_unlock ();return ct; +err3: +if (ct->master) +nf_ct_put (ct->master); err2:rcu_read_unlock (); err1:
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 67/211 netfilter: conntrack: fix rmmod double-free race
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ Upstream commit e6d57e9ff0aec323717ee36fc9ea34ad89217151 ]
nf_conntrack_hash_check_insert() callers free the ct entry directly, via nf_conntrack_free.
This isn't safe anymore because nf_conntrack_hash_check_insert() might place the entry into the conntrack table and then delteted the entry again because it found that a conntrack extension has been removed at the same time.
In this case, the just-added entry is removed again and an error is returned to the caller.
Problem is that another cpu might have picked up this entry and incremented its reference count.
This results in a use-after-free/double-free, once by the other cpu and once by the caller of nf_conntrack_hash_check_insert().
Fix this by making nf_conntrack_hash_check_insert() not fail anymore after the insertion, just like before the 'Fixes' commit.
This is safe because a racing nf_ct_iterate() has to wait for us to release the conntrack hash spinlocks.
While at it, make the function return -EAGAIN in the rmmod (genid changed) case, this makes nfnetlink replay the command (suggested by Pablo Neira).
--- net/netfilter/nf_conntrack_bpf.c | 1 - net/netfilter/nf_conntrack_core.c | 25 +++++++++++++++---------- net/netfilter/nf_conntrack_netlink.c | 3 --- 3 files changed, 15 insertions(+), 14 deletions(-)
net/netfilter/nf_conntrack_bpf.c +0 -1
@@ -381,7 +381,6 @@ struct nf_conn *bpf_ct_insert_entry(struct nf_conn___init *nfct_i)struct nf_conn *nfct = (struct nf_conn *)nfct_i;int err; - nfct->status |=IPS_CONFIRMED ; err =nf_conntrack_hash_check_insert (nfct);if (err <0 ) {nf_conntrack_free (nfct);
net/netfilter/nf_conntrack_core.c +15 -10
@@ -886,10 +886,8 @@ nf_conntrack_hash_check_insert(struct nf_conn *ct) zone =nf_ct_zone (ct); -if (!nf_ct_ext_valid_pre (ct->ext)) { -NF_CT_STAT_INC_ATOMIC (net, insert_failed); -return -ETIMEDOUT ; - } +if (!nf_ct_ext_valid_pre (ct->ext)) +return -EAGAIN ;local_bh_disable (); do {
@@ -924,6 +922,19 @@ nf_conntrack_hash_check_insert(struct nf_conn *ct) goto chaintoolong; } +/* If genid has changed, we can't insert anymore because ct +* extensions could have stale pointers and nf_ct_iterate_destroy +* might have completed its table scan already. +* +* Increment of the ext genid right after this check is fine: +* nf_ct_iterate_destroy blocks until locks are released. +*/ +if (!nf_ct_ext_valid_post (ct->ext)) { + err = -EAGAIN ; + goto out; + } + + ct->status |=IPS_CONFIRMED ;smp_wmb ();/* The caller holds a reference to this object */ refcount_set (&ct->ct_general.use,2 );
@@ -932,12 +943,6 @@ nf_conntrack_hash_check_insert(struct nf_conn *ct)NF_CT_STAT_INC (net, insert);local_bh_enable (); -if (!nf_ct_ext_valid_post (ct->ext)) { -nf_ct_kill (ct); -NF_CT_STAT_INC_ATOMIC (net, drop); -return -ETIMEDOUT ; - } -return 0 ; chaintoolong:NF_CT_STAT_INC (net, chaintoolong);
net/netfilter/nf_conntrack_netlink.c +0 -3
@@ -2316,9 +2316,6 @@ ctnetlink_create_conntrack(struct net *net,nfct_seqadj_ext_add (ct);nfct_synproxy_ext_add (ct); -/* we must add conntrack extensions before confirmation. */ - ct->status |=IPS_CONFIRMED ; -if (cda[CTA_STATUS ]) { err =ctnetlink_change_status (ct, cda);if (err <0 )
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 68/211 netfilter: ip6t_rpfilter: Fix regression with VRF interfaces
In reply to Greg Kroah-HartmanFrom: Phil Sutter <[email protected]>
[ Upstream commit efb056e5f1f0036179b2f92c1c15f5ea7a891d70 ]
When calling ip6_route_lookup() for the packet arriving on the VRF interface, the result is always the real (slave) interface. Expect this when validating the result.
--- net/ipv6/netfilter/ip6t_rpfilter.c | 4 ++- tools/testing/selftests/netfilter/rpath.sh | 32 ++++++++++++++++++---- 2 files changed, 29 insertions(+), 7 deletions(-)
net/ipv6/netfilter/ip6t_rpfilter.c +3 -1
@@ -72,7 +72,9 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb, goto out; } -if (rt->rt6i_idev->dev == dev || (flags &XT_RPFILTER_LOOSE )) +if (rt->rt6i_idev->dev == dev || +l3mdev_master_ifindex_rcu (rt->rt6i_idev->dev) == dev->ifindex || + (flags &XT_RPFILTER_LOOSE )) ret = true; out:ip6_rt_put (rt);
tools/testing/selftests/netfilter/rpath.sh +26 -6
@@ -62,10 +62,16 @@ ip -net "$ns1" a a fec0:42::2/64 dev v0 nodad ip -net "$ns2" a a fec0:42::1/64 dev d0 nodad # firewall matches to test -[ -n "$iptables" ] && ip netns exec "$ns2" \ - "$iptables" -t raw -A PREROUTING -s 192.168.0.0/16 -m rpfilter -[ -n "$ip6tables" ] && ip netns exec "$ns2" \ - "$ip6tables" -t raw -A PREROUTING -s fec0::/16 -m rpfilter +[ -n "$iptables" ] && { + common='-t raw -A PREROUTING -s 192.168.0.0/16' + ip netns exec "$ns2" "$iptables" $common -m rpfilter + ip netns exec "$ns2" "$iptables" $common -m rpfilter --invert +} +[ -n "$ip6tables" ] && { + common='-t raw -A PREROUTING -s fec0::/16' + ip netns exec "$ns2" "$ip6tables" $common -m rpfilter + ip netns exec "$ns2" "$ip6tables" $common -m rpfilter --invert +} [ -n "$nft" ] && ip netns exec "$ns2" $nft -f - <<EOF table inet t { chain c {
@@ -89,6 +95,11 @@ ipt_zero_rule() { # (command) [ -n "$1" ] || return 0 ip netns exec "$ns2" "$1" -t raw -vS | grep -q -- "-m rpfilter -c 0 0" } +ipt_zero_reverse_rule() { # (command) + [ -n "$1" ] || return 0 + ip netns exec "$ns2" "$1" -t raw -vS | \ + grep -q -- "-m rpfilter --invert -c 0 0" +} nft_zero_rule() { # (family) [ -n "$nft" ] || return 0 ip netns exec "$ns2" "$nft" list chain inet t c | \
@@ -101,8 +112,7 @@ netns_ping() { # (netns, args...) ip netns exec "$netns" ping -q -c 1 -W 1 "$@" >/dev/null } -testrun() { - # clear counters first +clear_counters() { [ -n "$iptables" ] && ip netns exec "$ns2" "$iptables" -t raw -Z [ -n "$ip6tables" ] && ip netns exec "$ns2" "$ip6tables" -t raw -Z if [ -n "$nft" ]; then
@@ -111,6 +121,10 @@ testrun() { ip netns exec "$ns2" $nft -s list table inet t; ) | ip netns exec "$ns2" $nft -f - fi +} + +testrun() { + clear_counters # test 1: martian traffic should fail rpfilter matches netns_ping "$ns1" -I v0 192.168.42.1 && \
@@ -120,9 +134,13 @@ testrun() { ipt_zero_rule "$iptables" || die "iptables matched martian" ipt_zero_rule "$ip6tables" || die "ip6tables matched martian" + ipt_zero_reverse_rule "$iptables" && die "iptables not matched martian" + ipt_zero_reverse_rule "$ip6tables" && die "ip6tables not matched martian" nft_zero_rule ip || die "nft IPv4 matched martian" nft_zero_rule ip6 || die "nft IPv6 matched martian" + clear_counters + # test 2: rpfilter match should pass for regular traffic netns_ping "$ns1" 192.168.23.1 || \ die "regular ping 192.168.23.1 failed"
@@ -131,6 +149,8 @@ testrun() { ipt_zero_rule "$iptables" && die "iptables match not effective" ipt_zero_rule "$ip6tables" && die "ip6tables match not effective" + ipt_zero_reverse_rule "$iptables" || die "iptables match over-effective" + ipt_zero_reverse_rule "$ip6tables" || die "ip6tables match over-effective" nft_zero_rule ip && die "nft IPv4 match not effective" nft_zero_rule ip6 && die "nft IPv6 match not effective"
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 69/211 netfilter: ebtables: fix table blob use-after-free
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ Upstream commit e58a171d35e32e6e8c37cfe0e8a94406732a331f ]
We are not allowed to return an error at this point. Looking at the code it looks like ret is always 0 at this point, but its not.
t = find_table_lock(net, repl->name, &ret, &ebt_mutex);
... this can return a valid table, with ret != 0.
This bug causes update of table->private with the new blob, but then frees the blob right away in the caller.
Syzbot report:
BUG: KASAN: vmalloc-out-of-bounds in __ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168 Read of size 4 at addr ffffc90005425000 by task kworker/u4:4/74 Workqueue: netns cleanup_net Call Trace: kasan_report+0xbf/0x1f0 mm/kasan/report.c:517 __ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168 ebt_unregister_table+0x35/0x40 net/bridge/netfilter/ebtables.c:1372 ops_exit_list+0xb0/0x170 net/core/net_namespace.c:169 cleanup_net+0x4ee/0xb10 net/core/net_namespace.c:613
...
ip(6)tables appears to be ok (ret should be 0 at this point) but make this more obvious.
--- net/bridge/netfilter/ebtables.c | 2 +- net/ipv4/netfilter/ip_tables.c | 3 +-- net/ipv6/netfilter/ip6_tables.c | 3 +-- 3 files changed, 3 insertions(+), 5 deletions(-)
net/bridge/netfilter/ebtables.c +1 -1
@@ -1090,7 +1090,7 @@ static int do_replace_finish(struct net *net, struct ebt_replace *repl,audit_log_nfcfg (repl->name,AF_BRIDGE , repl->nentries,AUDIT_XT_OP_REPLACE ,GFP_KERNEL ); -return ret; +return 0 ; free_unlock:mutex_unlock (&ebt_mutex);
net/ipv4/netfilter/ip_tables.c +1 -2
@@ -1045,7 +1045,6 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,struct xt_counters *counters;struct ipt_entry *iter; - ret =0 ; counters =xt_counters_alloc (num_counters);if (!counters) { ret = -ENOMEM ;
@@ -1091,7 +1090,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,net_warn_ratelimited ("iptables: counters copy to user failed while replacing table\n" ); }vfree (counters); -return ret; +return 0 ; put_module:module_put (t->me);
net/ipv6/netfilter/ip6_tables.c +1 -2
@@ -1062,7 +1062,6 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,struct xt_counters *counters;struct ip6t_entry *iter; - ret =0 ; counters =xt_counters_alloc (num_counters);if (!counters) { ret = -ENOMEM ;
@@ -1108,7 +1107,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,net_warn_ratelimited ("ip6tables: counters copy to user failed while replacing table\n" ); }vfree (counters); -return ret; +return 0 ; put_module:module_put (t->me);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 70/211 netfilter: xt_length: use skb len to match in length_mt6
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
[ Upstream commit 05c07c0c6cc8ec2278ace9871618c41f1365d1f5 ]
For IPv6 Jumbo packets, the ipv6_hdr(skb)->payload_len is always 0, and its real payload_len ( > 65535) is saved in hbh exthdr. With 0 length for the jumbo packets, it may mismatch.
To fix this, we can just use skb->len instead of parsing exthdrs, as the hbh exthdr parsing has been done before coming to length_mt6 in ip6_rcv_core() and br_validate_ipv6() and also the packet has been trimmed according to the correct IPv6 (ext)hdr length there, and skb len is trustable in length_mt6().
Note that this patch is especially needed after the IPv6 BIG TCP was supported in kernel, which is using IPv6 Jumbo packets. Besides, to match the packets greater than 65535 more properly, a v1 revision of xt_length may be needed to extend "min, max" to u32 in the future, and for now the IPv6 Jumbo packets can be matched by:
# ip6tables -m length ! --length 0:65535
--- net/netfilter/xt_length.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/netfilter/xt_length.c +1 -2
@@ -30,8 +30,7 @@ static bool length_mt6(const struct sk_buff *skb, struct xt_action_param *par) { const struct xt_length_info *info = par->matchinfo; -const u_int16_t pktlen =ntohs (ipv6_hdr (skb)->payload_len) + -sizeof (struct ipv6hdr ); +u32 pktlen = skb->len;return (pktlen >= info->min && pktlen <= info->max) ^ info->invert; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 71/211 netfilter: ctnetlink: make event listener tracking global
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ Upstream commit fdf6491193e411087ae77bcbc6468e3e1cff99ed ]
pernet tracking doesn't work correctly because other netns might have set NETLINK_LISTEN_ALL_NSID on its event socket.
In this case its expected that events originating in other net namespaces are also received.
Making pernet-tracking work while also honoring NETLINK_LISTEN_ALL_NSID requires much more intrusive changes both in netlink and nfnetlink, f.e. adding a 'setsockopt' callback that lets nfnetlink know that the event socket entered (or left) ALL_NSID mode.
Move to global tracking instead: if there is an event socket anywhere on the system, all net namespaces which have conntrack enabled and use autobind mode will allocate the ecache extension.
netlink_has_listeners() returns false only if the given group has no subscribers in any net namespace, the 'net' argument passed to nfnetlink_has_listeners is only used to derive the protocol (nfnetlink), it has no other effect.
For proper NETLINK_LISTEN_ALL_NSID-aware pernet tracking of event listeners a new netlink_has_net_listeners() is also needed.
--- include/linux/netfilter.h | 5 +++++ include/net/netns/conntrack.h | 1 - net/netfilter/core.c | 3 +++ net/netfilter/nf_conntrack_ecache.c | 2 +- net/netfilter/nfnetlink.c | 9 +++++---- 5 files changed, 14 insertions(+), 6 deletions(-)
include/linux/netfilter.h +5 -0
@@ -488,4 +488,9 @@ extern const struct nfnl_ct_hook __rcu *nfnl_ct_hook;*/ DECLARE_PER_CPU (bool, nf_skb_duplicated); +/** +* Contains bitmask of ctnetlink event subscribers, if any. +* Can't be pernet due to NETLINK_LISTEN_ALL_NSID setsockopt flag. +*/ +extern u8 nf_ctnetlink_has_listener;#endif /*__LINUX_NETFILTER_H*/
include/net/netns/conntrack.h +0 -1
@@ -95,7 +95,6 @@ struct nf_ip_net {struct netns_ct {#ifdef CONFIG_NF_CONNTRACK_EVENTS -u8 ctnetlink_has_listener;bool ecache_dwork_pending;#endif u8 sysctl_log_invalid;/* Log invalid packets */
net/netfilter/core.c +3 -0
@@ -669,6 +669,9 @@ const struct nf_ct_hook __rcu *nf_ct_hook __read_mostly;EXPORT_SYMBOL_GPL (nf_ct_hook);#if IS_ENABLED (CONFIG_NF_CONNTRACK ) +u8 nf_ctnetlink_has_listener; +EXPORT_SYMBOL_GPL (nf_ctnetlink_has_listener); +const struct nf_nat_hook __rcu *nf_nat_hook__read_mostly ;EXPORT_SYMBOL_GPL (nf_nat_hook);
net/netfilter/nf_conntrack_ecache.c +1 -1
@@ -309,7 +309,7 @@ bool nf_ct_ecache_ext_add(struct nf_conn *ct, u16 ctmask, u16 expmask, gfp_t gfpbreak ;return true;case 2 :/* autodetect: no event listener, don't allocate extension. */ -if (!READ_ONCE (net->ct.ctnetlink_has_listener)) +if (!READ_ONCE (nf_ctnetlink_has_listener))return true; fallthrough;case 1 :
net/netfilter/nfnetlink.c +5 -4
@@ -29,6 +29,7 @@#include <net/netlink.h> #include <net/netns/generic.h> +#include <linux/netfilter.h> #include <linux/netfilter/nfnetlink.h> MODULE_LICENSE ("GPL" );
@@ -685,12 +686,12 @@ static void nfnetlink_bind_event(struct net *net, unsigned int group) group_bit = (1 << group);spin_lock (&nfnl_grp_active_lock); - v =READ_ONCE (net->ct.ctnetlink_has_listener); + v =READ_ONCE (nf_ctnetlink_has_listener);if ((v & group_bit) ==0 ) { v |= group_bit;/* read concurrently without nfnl_grp_active_lock held. */ -WRITE_ONCE (net->ct.ctnetlink_has_listener, v); +WRITE_ONCE (nf_ctnetlink_has_listener, v); }spin_unlock (&nfnl_grp_active_lock);
@@ -744,12 +745,12 @@ static void nfnetlink_unbind(struct net *net, int group)spin_lock (&nfnl_grp_active_lock);if (!nfnetlink_has_listeners (net, group)) { -u8 v =READ_ONCE (net->ct.ctnetlink_has_listener); +u8 v =READ_ONCE (nf_ctnetlink_has_listener); v &= ~group_bit;/* read concurrently without nfnl_grp_active_lock held. */ -WRITE_ONCE (net->ct.ctnetlink_has_listener, v); +WRITE_ONCE (nf_ctnetlink_has_listener, v); }spin_unlock (&nfnl_grp_active_lock);#endif
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 72/211 netfilter: x_tables: fix percpu counter block leak on error path when creating new netns
In reply to Greg Kroah-HartmanFrom: Pavel Tikhomirov <[email protected]>
[ Upstream commit 0af8c09c896810879387decfba8c942994bb61f5 ]
Here is the stack where we allocate percpu counter block:
+-< __alloc_percpu
+-< xt_percpu_counter_alloc
+-< find_check_entry # {arp,ip,ip6}_tables.c
+-< translate_tableAnd it can be leaked on this code path:
+-> ip6t_register_table
+-> translate_table # allocates percpu counter block
+-> xt_register_table # failsthere is no freeing of the counter block on xt_register_table fail.
Note: xt_percpu_counter_free should be called to free it like we do in do_replace through cleanup_entry helper (or in __ip6t_unregister_table).
Probability of hitting this error path is low AFAICS (xt_register_table can only return ENOMEM here, as it is not replacing anything, as we are creating new netns, and it is hard to imagine that all previous allocations succeeded and after that one in xt_register_table failed). But it's worth fixing even the rare leak.
--- net/ipv4/netfilter/arp_tables.c | 4 ++++ net/ipv4/netfilter/ip_tables.c | 4 ++++ net/ipv6/netfilter/ip6_tables.c | 4 ++++ 3 files changed, 12 insertions(+)
net/ipv4/netfilter/arp_tables.c +4 -0
@@ -1525,6 +1525,10 @@ int arpt_register_table(struct net *net, new_table =xt_register_table (net, table, &bootstrap, newinfo);if (IS_ERR (new_table)) { +struct arpt_entry *iter; + + xt_entry_foreach(iter, loc_cpu_entry, newinfo->size) +cleanup_entry (iter, net);xt_free_table_info (newinfo);return PTR_ERR (new_table); }
net/ipv4/netfilter/ip_tables.c +4 -0
@@ -1741,6 +1741,10 @@ int ipt_register_table(struct net *net, const struct xt_table *table, new_table =xt_register_table (net, table, &bootstrap, newinfo);if (IS_ERR (new_table)) { +struct ipt_entry *iter; + + xt_entry_foreach(iter, loc_cpu_entry, newinfo->size) +cleanup_entry (iter, net);xt_free_table_info (newinfo);return PTR_ERR (new_table); }
net/ipv6/netfilter/ip6_tables.c +4 -0
@@ -1750,6 +1750,10 @@ int ip6t_register_table(struct net *net, const struct xt_table *table, new_table =xt_register_table (net, table, &bootstrap, newinfo);if (IS_ERR (new_table)) { +struct ip6t_entry *iter; + + xt_entry_foreach(iter, loc_cpu_entry, newinfo->size) +cleanup_entry (iter, net);xt_free_table_info (newinfo);return PTR_ERR (new_table); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 73/211 swiotlb: mark swiotlb_memblock_alloc() as __init
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 9b07d27d0fbb7f7441aa986859a0f53ec93a0335 ]
swiotlb_memblock_alloc() calls memblock_alloc(), which calls (__init) memblock_alloc_try_nid(). However, swiotlb_membloc_alloc() can be marked as __init since it is only called by swiotlb_init_remap(), which is already marked as __init. This prevents a modpost build warning/error:
WARNING: modpost: vmlinux.o: section mismatch in reference: swiotlb_memblock_alloc (section: .text) -> memblock_alloc_try_nid (section: .init.text)
WARNING: modpost: vmlinux.o: section mismatch in reference: swiotlb_memblock_alloc (section: .text) -> memblock_alloc_try_nid (section: .init.text)
This fixes the build warning/error seen on ARM64, PPC64, S390, i386, and x86_64.
--- kernel/dma/swiotlb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/dma/swiotlb.c +2 -1
@@ -300,7 +300,8 @@ static void swiotlb_init_io_tlb_mem(struct io_tlb_mem *mem, phys_addr_t start,return ; } -static void *swiotlb_memblock_alloc (unsigned long nslabs,unsigned int flags, +static void __init *swiotlb_memblock_alloc (unsigned long nslabs, +unsigned int flags,int (*remap)(void *tlb,unsigned long nslabs)) {size_t bytes =PAGE_ALIGN (nslabs <<IO_TLB_SHIFT );
Signature · 1 line
2.39.2
Re: [PATCH 6.2 073/211] swiotlb: mark swiotlb_memblock_alloc() as __init
Quoted 10 lines · Greg Kroah-Hartman
From: Randy Dunlap <[email protected]>
[ Upstream commit
9b07d27d0fbb7f7441aa986859a0f53ec93a0335]
swiotlb_memblock_alloc()callsmemblock_alloc(), which calls (__init)memblock_alloc_try_nid(). However,swiotlb_membloc_alloc()can be marked as__initsince it is only called byswiotlb_init_remap(), which is already marked as__init. This prevents a modpost build warning/error:
Quoted 5 lines
WARNING: modpost: vmlinux.o: section mismatch in reference:
swiotlb_memblock_alloc(section: .text) ->memblock_alloc_try_nid(section: .init.text)
WARNING: modpost: vmlinux.o: section mismatch in reference:swiotlb_memblock_alloc(section: .text) ->memblock_alloc_try_nid(section: .init.text)This fixes the build warning/error seen on ARM64, PPC64, S390, i386, and
x86_64.
Did you do something special in your config to get these warnings? Or it is your toolchain? I tested with whatever comes with Ubuntu2210 and Fedora36 and neither printed the warning and I want to see those :-/ Thanks,
Quoted 28 lines
Fixes 8d58aa484920 ("swiotlb: reduce the swiotlb buffer size on allocation failure")Signed-off-by Randy Dunlap <[email protected]>Cc Alexey Kardashevskiy <[email protected]>Cc Christoph Hellwig <[email protected]>Cc Mike Rapoport <[email protected]>Signed-off-by Christoph Hellwig <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- kernel/dma/swiotlb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)kernel/dma/swiotlb.c +2
-1@@ -300,7 +300,8 @@ static void swiotlb_init_io_tlb_mem(struct io_tlb_mem *mem, phys_addr_t start,return ; } -static void *swiotlb_memblock_alloc (unsigned long nslabs,unsigned int flags, +static void __init *swiotlb_memblock_alloc (unsigned long nslabs, +unsigned int flags,int (*remap)(void *tlb,unsigned long nslabs)) {size_t bytes =PAGE_ALIGN (nslabs <<IO_TLB_SHIFT );
Signature · 1 line
Alexey
Re: [PATCH 6.2 073/211] swiotlb: mark swiotlb_memblock_alloc() as __init
Hi,
Quoted 13 lines · Alexey Kardashevskiy
Quoted 10 lines · Greg Kroah-Hartman
From: Randy Dunlap <[email protected]>
[ Upstream commit
9b07d27d0fbb7f7441aa986859a0f53ec93a0335]
swiotlb_memblock_alloc()callsmemblock_alloc(), which calls (__init)memblock_alloc_try_nid(). However,swiotlb_membloc_alloc()can be marked as__initsince it is only called byswiotlb_init_remap(), which is already marked as__init. This prevents a modpost build warning/error:
Quoted 8 lines
Quoted 5 lines
WARNING: modpost: vmlinux.o: section mismatch in reference:
swiotlb_memblock_alloc(section: .text) ->memblock_alloc_try_nid(section: .init.text)
WARNING: modpost: vmlinux.o: section mismatch in reference:swiotlb_memblock_alloc(section: .text) ->memblock_alloc_try_nid(section: .init.text)This fixes the build warning/error seen on ARM64, PPC64, S390, i386, and
x86_64.Did you do something special in your config to get these warnings? Or it is your toolchain? I tested with whatever comes with Ubuntu2210 and Fedora36 and neither printed the warning and I want to see those :-/ Thanks,
I have no idea how I got these build warnings. I am using gcc-12.2.0. I don't know what .config file settings that I used.
I just tried about 6 different ARCH builds without this patch applied and I cannot recreate the build warnings/errors.
Sorry I couldn't help you with this.
Quoted 29 lines
Quoted 28 lines
Fixes 8d58aa484920 ("swiotlb: reduce the swiotlb buffer size on allocation failure")Signed-off-by Randy Dunlap <[email protected]>Cc Alexey Kardashevskiy <[email protected]>Cc Christoph Hellwig <[email protected]>Cc Mike Rapoport <[email protected]>Signed-off-by Christoph Hellwig <[email protected]>Signed-off-by Sasha Levin <[email protected]>---
kernel/dma/swiotlb.c| 3 ++-1 file changed, 2 insertions(+), 1 deletion(-)kernel/dma/swiotlb.c +2
-0@@ -300,7 +300,8 @@ static void swiotlb_init_io_tlb_mem(struct io_tlb_mem *mem, phys_addr_t start, return; } -static void *swiotlb_memblock_alloc(unsigned long nslabs, unsigned int flags, +static void __init *swiotlb_memblock_alloc (unsigned long nslabs, + unsigned int flags, int (*remap)(void *tlb, unsigned long nslabs)) { size_t bytes = PAGE_ALIGN(nslabs << IO_TLB_SHIFT);
Signature · 1 line
~Randy
Greg Kroah-Hartman
maintainerPATCH 74/211 ptp: vclock: use mutex to fix "sleep on atomic" bug
In reply to Greg Kroah-HartmanFrom: Íñigo Huguet <[email protected]>
[ Upstream commit 67d93ffc0f3c47094750bde6d62e7c5765dc47a6 ]
vclocks were using spinlocks to protect access to its timecounter and cyclecounter. Access to timecounter/cyclecounter is backed by the same driver callbacks that are used for non-virtual PHCs, but the usage of the spinlock imposes a new limitation that didn't exist previously: now they're called in atomic context so they mustn't sleep.
Some drivers like sfc or ice may sleep on these callbacks, causing errors like "BUG: scheduling while atomic: ptp5/25223/0x00000002"
Fix it replacing the vclock's spinlock by a mutex. It fix the mentioned bug and it doesn't introduce longer delays.
I've tested synchronizing various different combinations of clocks:
- vclock->sysclock
- sysclock->vclock
- vclock->vclock
- hardware PHC in different NIC -> vclock
- created 4 vclocks and launch 4 parallel phc2sys processes with lockdep enabled
In all cases, comparing the delays reported by phc2sys, they are in the same range of values than before applying the patch.
--- drivers/ptp/ptp_private.h | 2 +- drivers/ptp/ptp_vclock.c | 44 +++++++++++++++++++-------------------- 2 files changed, 23 insertions(+), 23 deletions(-)
drivers/ptp/ptp_private.h +1 -1
@@ -66,7 +66,7 @@ struct ptp_vclock {struct hlist_node vclock_hash_node;struct cyclecounter cc;struct timecounter tc; -spinlock_t lock;/* protects tc/cc */ +struct mutex lock;/* protects tc/cc */ };/*
drivers/ptp/ptp_vclock.c +22 -22
127 lines not on this page · raw message
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 75/211 drm/i915: move a Kconfig symbol to unbreak the menu presentation
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 0b93efca3659f6d55ed31cff6722dca5f6e4d6e2 ]
Inserting a Kconfig symbol that does not have a dependency (DRM_I915_GVT) into a list of other symbols that do have a dependency (on DRM_I915) breaks the driver menu presentation in 'make *config'.
Relocate the DRM_I915_GVT symbol so that it does not cause this problem.
--- drivers/gpu/drm/i915/Kconfig | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/i915/Kconfig +3 -3
@@ -107,9 +107,6 @@ config DRM_I915_USERPTR If in doubt, say "Y". -config DRM_I915_GVT - bool - config DRM_I915_GVT_KVMGT tristate "Enable KVM host support Intel GVT-g graphics virtualization" depends on DRM_I915
@@ -160,3 +157,6 @@ menu "drm/i915 Unstable Evolution" depends on DRM_I915 source "drivers/gpu/drm/i915/Kconfig.unstable" endmenu + +config DRM_I915_GVT + bool
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 76/211 ipv6: Add lwtunnel encap size of all siblings in nexthop calculation
In reply to Greg Kroah-HartmanFrom: Lu Wei <[email protected]>
[ Upstream commit 4cc59f386991ec9374cb4bc83dbe1c0b5a95033f ]
In function rt6_nlmsg_size(), the length of nexthop is calculated by multipling the nexthop length of fib6_info and the number of siblings. However if the fib6_info has no lwtunnel but the siblings have lwtunnels, the nexthop length is less than it should be, and it will trigger a warning in inet6_rt_notify() as follows:
WARNING: CPU: 0 PID: 6082 at net/ipv6/route.c:6180 inet6_rt_notify+0x120/0x130 ...... Call Trace: <TASK> fib6_add_rt2node+0x685/0xa30 fib6_add+0x96/0x1b0 ip6_route_add+0x50/0xd0 inet6_rtm_newroute+0x97/0xa0 rtnetlink_rcv_msg+0x156/0x3d0 netlink_rcv_skb+0x5a/0x110 netlink_unicast+0x246/0x350 netlink_sendmsg+0x250/0x4c0 sock_sendmsg+0x66/0x70 ___sys_sendmsg+0x7c/0xd0 __sys_sendmsg+0x5d/0xb0 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc
This bug can be reproduced by script:
ip -6 addr add 2002::2/64 dev ens2
ip -6 route add 100::/64 via 2002::1 dev ens2 metric 100
for i in 10 20 30 40 50 60 70;
do
ip link add link ens2 name ipv_$i type ipvlan ip -6 addr add 2002::$i/64 dev ipv_$i ifconfig ipv_$i up
done
for i in 10 20 30 40 50 60;
do
ip -6 route append 100::/64 encap ip6 dst 2002::$i via 2002::1
dev ipv_$i metric 100
done
ip -6 route append 100::/64 via 2002::1 dev ipv_70 metric 100
This patch fixes it by adding nexthop_len of every siblings using rt6_nh_nlmsg_size().
--- net/ipv6/route.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
net/ipv6/route.c +6 -5
@@ -5540,16 +5540,17 @@ static size_t rt6_nlmsg_size(struct fib6_info *f6i)nexthop_for_each_fib6_nh (f6i->nh, rt6_nh_nlmsg_size, &nexthop_len); }else { +struct fib6_info *sibling, *next_sibling;struct fib6_nh *nh = f6i->fib6_nh; nexthop_len =0 ;if (f6i->fib6_nsiblings) { - nexthop_len =nla_total_size (0 )/* RTA_MULTIPATH */ - +NLA_ALIGN (sizeof (struct rtnexthop )) - +nla_total_size (16 )/* RTA_GATEWAY */ - +lwtunnel_get_encap_size (nh->fib_nh_lws); +rt6_nh_nlmsg_size (nh, &nexthop_len); - nexthop_len *= f6i->fib6_nsiblings; +list_for_each_entry_safe (sibling, next_sibling, + &f6i->fib6_siblings, fib6_siblings) { +rt6_nh_nlmsg_size (sibling->fib6_nh, &nexthop_len); + } } nexthop_len +=lwtunnel_get_encap_size (nh->fib_nh_lws); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 77/211 drm/i915/xelpmp: Consider GSI offset when doing MCR lookups
In reply to Greg Kroah-HartmanFrom: Matt Roper <[email protected]>
[ Upstream commit 33c25354939099b76ecb6c82d1c7c50400fbcca6 ]
MCR range tables use the final MMIO offset of a register (including the 0x380000 GSI offset when applicable). Since the i915_mcr_reg_t passed as a parameter during steering lookup does not include the GSI offset, we need to add it back in for GSI registers before searching the tables.
--- drivers/gpu/drm/i915/gt/intel_gt_mcr.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/i915/gt/intel_gt_mcr.c +4 -1
@@ -464,12 +464,15 @@ static bool reg_needs_read_steering(struct intel_gt *gt, i915_mcr_reg_t reg, enum intel_steering_type type) { -const u32 offset =i915_mmio_reg_offset (reg); +u32 offset =i915_mmio_reg_offset (reg);const struct intel_mmio_range *entry;if (likely (!gt->steering_table[type]))return false; +if (IS_GSI_REG (offset)) + offset += gt->uncore->gsi_offset; +for (entry = gt->steering_table[type]; entry->end; entry++) {if (offset >= entry->start && offset <= entry->end)return true;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 78/211 octeontx2-pf: Recalculate UDP checksum for ptp 1-step sync packet
In reply to Greg Kroah-HartmanFrom: Geetha sowjanya <[email protected]>
[ Upstream commit edea0c5a994b7829c9ada8f5bc762c4e32f4f797 ]
When checksum offload is disabled in the driver via ethtool, the PTP 1-step sync packets contain incorrect checksum, since the stack calculates the checksum before driver updates PTP timestamp field in the packet. This results in PTP packets getting dropped at the other end. This patch fixes the issue by re-calculating the UDP checksum after updating PTP timestamp field in the driver.
--- .../marvell/octeontx2/nic/otx2_txrx.c | 76 ++++++++++++++----- 1 file changed, 57 insertions(+), 19 deletions(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c +57 -19
@@ -10,6 +10,7 @@#include <net/tso.h> #include <linux/bpf.h> #include <linux/bpf_trace.h> +#include <net/ip6_checksum.h> #include "otx2_reg.h" #include "otx2_common.h"
@@ -699,7 +700,7 @@ static void otx2_sqe_add_ext(struct otx2_nic *pfvf, struct otx2_snd_queue *sq,static void otx2_sqe_add_mem (struct otx2_snd_queue *sq,int *offset,int alg,u64 iova,int ptp_offset, -u64 base_ns,int udp_csum) +u64 base_ns,bool udp_csum_crt) {struct nix_sqe_mem_s *mem;
@@ -711,7 +712,7 @@ static void otx2_sqe_add_mem(struct otx2_snd_queue *sq, int *offset,if (ptp_offset) { mem->start_offset = ptp_offset; - mem->udp_csum_crt = udp_csum; + mem->udp_csum_crt = !!udp_csum_crt; mem->base_ns = base_ns; mem->step_type =1 ; }
@@ -986,10 +987,11 @@ static bool otx2_validate_network_transport(struct sk_buff *skb)return false; } -static bool otx2_ptp_is_sync (struct sk_buff *skb,int *offset,int *udp_csum) +static bool otx2_ptp_is_sync (struct sk_buff *skb,int *offset,bool *udp_csum_crt) {struct ethhdr *eth = (struct ethhdr *)(skb->data);u16 nix_offload_hlen =0 , inner_vhlen =0 ; +bool udp_hdr_present = false, is_sync;u8 *data = skb->data, *msgtype;__be16 proto = eth->h_proto;int network_depth =0 ;
@@ -1029,45 +1031,81 @@ static bool otx2_ptp_is_sync(struct sk_buff *skb, int *offset, int *udp_csum)if (!otx2_validate_network_transport (skb))return false; - *udp_csum =1 ; *offset = nix_offload_hlen +skb_transport_offset (skb) +sizeof (struct udphdr ); + udp_hdr_present = true; + } msgtype = data + *offset; -/* Check PTP messageId is SYNC or not */ -return (*msgtype &0xf ) ==0 ; + is_sync = !(*msgtype &0xf ); +if (is_sync) + *udp_csum_crt = udp_hdr_present; +else + *offset =0 ; + +return is_sync; }static void otx2_set_txtstamp (struct otx2_nic *pfvf,struct sk_buff *skb,struct otx2_snd_queue *sq,int *offset) { +struct ethhdr *eth = (struct ethhdr *)(skb->data);struct ptpv2_tstamp *origin_tstamp; -int ptp_offset =0 , udp_csum =0 ; +bool udp_csum_crt = false; +unsigned int udphoff;struct timespec64 ts; +int ptp_offset =0 ; +__wsum skb_csum;u64 iova;if (unlikely (!skb_shinfo (skb)->gso_size && (skb_shinfo (skb)->tx_flags &SKBTX_HW_TSTAMP ))) { -if (unlikely (pfvf->flags &OTX2_FLAG_PTP_ONESTEP_SYNC )) { -if (otx2_ptp_is_sync (skb, &ptp_offset, &udp_csum)) { - origin_tstamp = (struct ptpv2_tstamp *) - ((u8 *)skb->data + ptp_offset + -PTP_SYNC_SEC_OFFSET ); - ts =ns_to_timespec64 (pfvf->ptp->tstamp); - origin_tstamp->seconds_msb =htons ((ts.tv_sec >>32 ) &0xffff ); - origin_tstamp->seconds_lsb =htonl (ts.tv_sec &0xffffffff ); - origin_tstamp->nanoseconds =htonl (ts.tv_nsec); -/* Point to correction field in PTP packet */ - ptp_offset +=8 ; +if (unlikely (pfvf->flags &OTX2_FLAG_PTP_ONESTEP_SYNC && +otx2_ptp_is_sync (skb, &ptp_offset, &udp_csum_crt))) { + origin_tstamp = (struct ptpv2_tstamp *) + ((u8 *)skb->data + ptp_offset + +PTP_SYNC_SEC_OFFSET ); + ts =ns_to_timespec64 (pfvf->ptp->tstamp); + origin_tstamp->seconds_msb =htons ((ts.tv_sec >>32 ) &0xffff ); + origin_tstamp->seconds_lsb =htonl (ts.tv_sec &0xffffffff ); + origin_tstamp->nanoseconds =htonl (ts.tv_nsec); +/* Point to correction field in PTP packet */ + ptp_offset +=8 ; + +/* When user disables hw checksum, stack calculates the csum, +* but it does not cover ptp timestamp which is added later. +* Recalculate the checksum manually considering the timestamp. +*/ +if (udp_csum_crt) { +struct udphdr *uh =udp_hdr (skb); + +if (skb->ip_summed !=CHECKSUM_PARTIAL && uh->check !=0 ) { + udphoff =skb_transport_offset (skb); + uh->check =0 ; + skb_csum =skb_checksum (skb, udphoff, skb->len - udphoff, +0 ); +if (ntohs (eth->h_proto) ==ETH_P_IPV6 ) + uh->check =csum_ipv6_magic (&ipv6_hdr (skb)->saddr, + &ipv6_hdr (skb)->daddr, + skb->len - udphoff, +ipv6_hdr (skb)->nexthdr, + skb_csum); +else + uh->check =csum_tcpudp_magic (ip_hdr (skb)->saddr, +ip_hdr (skb)->daddr, + skb->len - udphoff, +IPPROTO_UDP , + skb_csum); + } } }else {skb_shinfo (skb)->tx_flags |=SKBTX_IN_PROGRESS ; } iova = sq->timestamps->iova + (sq->head *sizeof (u64));otx2_sqe_add_mem (sq, offset,NIX_SENDMEMALG_E_SETTSTMP , iova, - ptp_offset, pfvf->ptp->base_ns, udp_csum); + ptp_offset, pfvf->ptp->base_ns, udp_csum_crt); }else {skb_tx_timestamp (skb); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 79/211 net: sunhme: Fix region request
In reply to Greg Kroah-HartmanFrom: Sean Anderson <[email protected]>
[ Upstream commit ee0a735fd97ccde766ab557d1fc722c92cebacda ]
devm_request_region is for I/O regions. Use devm_request_mem_region instead. This fixes the driver failing to probe since 99df45c9e0a4 ("sunhme: fix an IS_ERR() vs NULL check in probe"), which checked the result.
--- drivers/net/ethernet/sun/sunhme.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/sun/sunhme.c +4 -2
@@ -2894,8 +2894,10 @@ static int happy_meal_pci_probe(struct pci_dev *pdev, goto err_out_clear_quattro; } - hpreg_res =devm_request_region (&pdev->dev,pci_resource_start (pdev,0 ), -pci_resource_len (pdev,0 ),DRV_NAME ); + hpreg_res =devm_request_mem_region (&pdev->dev, +pci_resource_start (pdev,0 ), +pci_resource_len (pdev,0 ), +DRV_NAME );if (!hpreg_res) { err = -EBUSY ;dev_err (&pdev->dev,"Cannot obtain PCI resources, aborting.\n" );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 80/211 sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
[ Upstream commit 68ba44639537de6f91fe32783766322d41848127 ]
With this refcnt added in sctp_stream_priorities, we don't need to traverse all streams to check if the prio is used by other streams when freeing one stream's prio in sctp_sched_prio_free_sid(). This can avoid a nested loop (up to 65535 * 65535), which may cause a stuck as Ying reported:
watchdog: BUG: soft lockup - CPU#23 stuck for 26s! [ksoftirqd/23:136]
Call Trace:
<TASK>
sctp_sched_prio_free_sid+0xab/0x100 [sctp]
sctp_stream_free_ext+0x64/0xa0 [sctp]
sctp_stream_free+0x31/0x50 [sctp]
sctp_association_free+0xa5/0x200 [sctp]Note that it doesn't need to use refcount_t type for this counter, as its accessing is always protected under the sock lock.
v1->v2:
- add a check in sctp_sched_prio_set to avoid the possible prio_head refcnt overflow.
--- include/net/sctp/structs.h | 1 + net/sctp/stream_sched_prio.c | 52 +++++++++++++++--------------------- 2 files changed, 22 insertions(+), 31 deletions(-)
include/net/sctp/structs.h +1 -0
@@ -1412,6 +1412,7 @@ struct sctp_stream_priorities {/* The next stream in line */ struct sctp_stream_out_ext *next;__u16 prio; +__u16 users; };struct sctp_stream_out_ext {
net/sctp/stream_sched_prio.c +21 -31
99 lines not on this page · raw message
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 81/211 octeontx2-pf: Use correct struct reference in test condition
In reply to Greg Kroah-HartmanFrom: Deepak R Varma <[email protected]>
[ Upstream commit 3acd9db9293f3b33ac04e8d44ed05b604ad1ac26 ]
Fix the typo/copy-paste error by replacing struct variable ah_esp_mask name by ah_esp_hdr.
Issue identified using doublebitand.cocci Coccinelle semantic patch.
--- drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_flows.c +1 -1
@@ -793,7 +793,7 @@ static int otx2_prepare_ipv6_flow(struct ethtool_rx_flow_spec *fsp,/* NPC profile doesn't extract AH/ESP header fields */ if ((ah_esp_mask->spi & ah_esp_hdr->spi) || - (ah_esp_mask->tclass & ah_esp_mask->tclass)) + (ah_esp_mask->tclass & ah_esp_hdr->tclass))return -EOPNOTSUPP ;if (flow_type ==AH_V6_FLOW )
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 82/211 net: fix __dev_kfree_skb_any() vs drop monitor
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit ac3ad19584b26fae9ac86e4faebe790becc74491 ]
dev_kfree_skb() is aliased to consume_skb().
When a driver is dropping a packet by calling dev_kfree_skb_any() we should propagate the drop reason instead of pretending the packet was consumed.
Note: Now we have enum skb_drop_reason we could remove enum skb_free_reason (for linux-6.4)
v2: added an unlikely(), suggested by Yunsheng Lin.
--- net/core/dev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/core/dev.c +3 -1
@@ -3131,8 +3131,10 @@ void __dev_kfree_skb_any(struct sk_buff *skb, enum skb_free_reason reason) {if (in_hardirq () ||irqs_disabled ())__dev_kfree_skb_irq (skb, reason); +else if (unlikely (reason ==SKB_REASON_DROPPED )) +kfree_skb (skb);else -dev_kfree_skb (skb); +consume_skb (skb); }EXPORT_SYMBOL (__dev_kfree_skb_any);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 83/211 9p/xen: fix version parsing
In reply to Greg Kroah-HartmanFrom: Juergen Gross <[email protected]>
[ Upstream commit f1956f4ec15195ec60976d9b5625326285ab102e ]
When connecting the Xen 9pfs frontend to the backend, the "versions" Xenstore entry written by the backend is parsed in a wrong way.
The "versions" entry is defined to contain the versions supported by the backend separated by commas (e.g. "1,2"). Today only version "1" is defined. Unfortunately the frontend doesn't look for "1" being listed in the entry, but it is expecting the entry to have the value "1".
This will result in failure as soon as the backend will support e.g. versions "1" and "2".
Fix that by scanning the entry correctly.
--- net/9p/trans_xen.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
net/9p/trans_xen.c +8 -2
@@ -378,13 +378,19 @@ static int xen_9pfs_front_probe(struct xenbus_device *dev,int ret, i;struct xenbus_transaction xbt;struct xen_9pfs_front_priv *priv =NULL ; -char *versions; +char *versions, *v;unsigned int max_rings, max_ring_order, len =0 ; versions =xenbus_read (XBT_NIL , dev->otherend,"versions" , &len);if (IS_ERR (versions))return PTR_ERR (versions); -if (strcmp (versions,"1" )) { +for (v = versions; *v; v++) { +if (simple_strtoul (v, &v,10 ) ==1 ) { + v =NULL ; +break ; + } + } +if (v) {kfree (versions);return -EINVAL ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 84/211 9p/xen: fix connection sequence
In reply to Greg Kroah-HartmanFrom: Juergen Gross <[email protected]>
[ Upstream commit c15fe55d14b3b4ded5af2a3260877460a6ffb8ad ]
Today the connection sequence of the Xen 9pfs frontend doesn't match the documented sequence. It can work reliably only for a PV 9pfs device having been added at boot time already, as the frontend is not waiting for the backend to have set its state to "XenbusStateInitWait" before reading the backend properties from Xenstore.
Fix that by following the documented sequence [1] (the documentation has a bug, so the reference is for the patch fixing that).
[1]: https://lore.kernel.org/xen-devel/[email protected]/T/#u
--- net/9p/trans_xen.c | 38 +++++++++++++++++++++++--------------- 1 file changed, 23 insertions(+), 15 deletions(-)
net/9p/trans_xen.c +23 -15
@@ -372,12 +372,11 @@ static int xen_9pfs_front_alloc_dataring(struct xenbus_device *dev,return ret; } -static int xen_9pfs_front_probe (struct xenbus_device *dev, -const struct xenbus_device_id *id) +static int xen_9pfs_front_init (struct xenbus_device *dev) {int ret, i;struct xenbus_transaction xbt; -struct xen_9pfs_front_priv *priv =NULL ; +struct xen_9pfs_front_priv *priv =dev_get_drvdata (&dev->dev);char *versions, *v;unsigned int max_rings, max_ring_order, len =0 ;
@@ -405,11 +404,6 @@ static int xen_9pfs_front_probe(struct xenbus_device *dev,if (p9_xen_trans.maxsize >XEN_FLEX_RING_SIZE (max_ring_order)) p9_xen_trans.maxsize =XEN_FLEX_RING_SIZE (max_ring_order) /2 ; - priv =kzalloc (sizeof (*priv),GFP_KERNEL ); -if (!priv) -return -ENOMEM ; - - priv->dev = dev; priv->num_rings =XEN_9PFS_NUM_RINGS ; priv->rings =kcalloc (priv->num_rings,sizeof (*priv->rings),GFP_KERNEL );
@@ -468,23 +462,35 @@ static int xen_9pfs_front_probe(struct xenbus_device *dev, goto error; } -write_lock (&xen_9pfs_lock); -list_add_tail (&priv->list, &xen_9pfs_devs); -write_unlock (&xen_9pfs_lock); -dev_set_drvdata (&dev->dev, priv); -xenbus_switch_state (dev, XenbusStateInitialised); -return 0 ; error_xenbus:xenbus_transaction_end (xbt,1 );xenbus_dev_fatal (dev, ret,"writing xenstore" ); error: -dev_set_drvdata (&dev->dev,NULL );xen_9pfs_front_free (priv);return ret; } +static int xen_9pfs_front_probe (struct xenbus_device *dev, +const struct xenbus_device_id *id) +{ +struct xen_9pfs_front_priv *priv =NULL ; + + priv =kzalloc (sizeof (*priv),GFP_KERNEL ); +if (!priv) +return -ENOMEM ; + + priv->dev = dev; +dev_set_drvdata (&dev->dev, priv); + +write_lock (&xen_9pfs_lock); +list_add_tail (&priv->list, &xen_9pfs_devs); +write_unlock (&xen_9pfs_lock); + +return 0 ; +} +static int xen_9pfs_front_resume (struct xenbus_device *dev) {dev_warn (&dev->dev,"suspend/resume unsupported\n" );
@@ -503,6 +509,8 @@ static void xen_9pfs_front_changed(struct xenbus_device *dev,break ;case XenbusStateInitWait: +if (!xen_9pfs_front_init (dev)) +xenbus_switch_state (dev, XenbusStateInitialised);break ;case XenbusStateConnected:
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 85/211 9p/rdma: unmap receive dma buffer in rdma_request()/post_recv()
In reply to Greg Kroah-HartmanFrom: Zhengchao Shao <[email protected]>
[ Upstream commit 74a25e6e916cb57dab4267a96fbe8864ed21abdb ]
When down_interruptible() or ib_post_send() failed in rdma_request(), receive dma buffer is not unmapped. Add unmap action to error path. Also if ib_post_recv() failed in post_recv(), dma buffer is not unmapped. Add unmap action to error path.
--- net/9p/trans_rdma.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
net/9p/trans_rdma.c +12 -3
@@ -385,6 +385,7 @@ post_recv(struct p9_client *client, struct p9_rdma_context *c)struct p9_trans_rdma *rdma = client->trans;struct ib_recv_wr wr;struct ib_sge sge; +int ret; c->busa = ib_dma_map_single(rdma->cm_id->device, c->rc.sdata, client->msize,
@@ -402,7 +403,12 @@ post_recv(struct p9_client *client, struct p9_rdma_context *c) wr.wr_cqe = &c->cqe; wr.sg_list = &sge; wr.num_sge =1 ; -return ib_post_recv (rdma->qp, &wr,NULL ); + + ret =ib_post_recv (rdma->qp, &wr,NULL ); +if (ret) +ib_dma_unmap_single (rdma->cm_id->device, c->busa, + client->msize,DMA_FROM_DEVICE ); +return ret; error:p9_debug (P9_DEBUG_ERROR ,"EIO\n" );
@@ -499,7 +505,7 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req)if (down_interruptible (&rdma->sq_sem)) { err = -EINTR ; - goto send_error; + goto dma_unmap; }/* Mark request as `sent' *before* we actually send it,
@@ -509,11 +515,14 @@ static int rdma_request(struct p9_client *client, struct p9_req_t *req)WRITE_ONCE (req->status,REQ_STATUS_SENT ); err =ib_post_send (rdma->qp, &wr,NULL );if (err) - goto send_error; + goto dma_unmap;/* Success */ return 0 ; +dma_unmap: +ib_dma_unmap_single (rdma->cm_id->device, c->busa, + c->req->tc.size,DMA_TO_DEVICE );/* Handle errors that happened during or while preparing the send: */ send_error:WRITE_ONCE (req->status,REQ_STATUS_ERROR );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 86/211 spi: tegra210-quad: Fix validate combined sequence
In reply to Greg Kroah-HartmanFrom: Krishna Yarlagadda <[email protected]>
[ Upstream commit 047ee71ae4f412d8819e39e4b08c588fa299cfc2 ]
Check for non dma transfers that do not fit in FIFO has issue and skips combined sequence for Tegra234 & Tegra241 which does not have GPCDMA.
--- drivers/spi/spi-tegra210-quad.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-tegra210-quad.c +1 -1
@@ -1297,7 +1297,7 @@ static bool tegra_qspi_validate_cmb_seq(struct tegra_qspi *tqspi,if (xfer->len >4 || xfer->len <3 )return false; xfer =list_next_entry (xfer, transfer_list); -if (!tqspi->soc_data->has_dma || xfer->len > (QSPI_FIFO_DEPTH <<2 )) +if (!tqspi->soc_data->has_dma && xfer->len > (QSPI_FIFO_DEPTH <<2 ))return false;return true;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 87/211 mlx5: fix skb leak while fifo resync and push
In reply to Greg Kroah-HartmanFrom: Vadim Fedorenko <[email protected]>
[ Upstream commit e435941b1da1a0be4ff8a7ae425774c76a5ac514 ]
During ptp resync operation SKBs were poped from the fifo but were never freed neither by napi_consume nor by dev_kfree_skb_any. Add call to napi_consume_skb to properly free SKBs.
Another leak was happening because mlx5e_skb_fifo_has_room() had an error in the check. Comparing free running counters works well unless C promotes the types to something wider than the counter. In this case counters are u16 but the result of the substraction is promouted to int and it causes wrong result (negative value) of the check when producer have already overlapped but consumer haven't yet. Explicit cast to u16 fixes the issue.
--- drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c | 6 ++++-- drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c +4 -2
@@ -86,7 +86,8 @@ static bool mlx5e_ptp_ts_cqe_drop(struct mlx5e_ptpsq *ptpsq, u16 skb_cc, u16 skbreturn (ptpsq->ts_cqe_ctr_mask && (skb_cc != skb_id)); } -static void mlx5e_ptp_skb_fifo_ts_cqe_resync (struct mlx5e_ptpsq *ptpsq,u16 skb_cc,u16 skb_id) +static void mlx5e_ptp_skb_fifo_ts_cqe_resync (struct mlx5e_ptpsq *ptpsq,u16 skb_cc, +u16 skb_id,int budget) {struct skb_shared_hwtstamps hwts = {};struct sk_buff *skb;
@@ -98,6 +99,7 @@ static void mlx5e_ptp_skb_fifo_ts_cqe_resync(struct mlx5e_ptpsq *ptpsq, u16 skb_ hwts.hwtstamp =mlx5e_skb_cb_get_hwts (skb)->cqe_hwtstamp;skb_tstamp_tx (skb, &hwts); ptpsq->cq_stats->resync_cqe++; +napi_consume_skb (skb, budget); skb_cc =PTP_WQE_CTR2IDX (ptpsq->skb_fifo_cc); } }
@@ -119,7 +121,7 @@ static void mlx5e_ptp_handle_ts_cqe(struct mlx5e_ptpsq *ptpsq, }if (mlx5e_ptp_ts_cqe_drop (ptpsq, skb_cc, skb_id)) -mlx5e_ptp_skb_fifo_ts_cqe_resync (ptpsq, skb_cc, skb_id); +mlx5e_ptp_skb_fifo_ts_cqe_resync (ptpsq, skb_cc, skb_id, budget); skb =mlx5e_skb_fifo_pop (&ptpsq->skb_fifo); hwtstamp =mlx5e_cqe_ts_to_ns (sq->ptp_cyc2time, sq->clock,get_cqe_ts (cqe));
drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h +1 -1
@@ -81,7 +81,7 @@ void mlx5e_free_txqsq_descs(struct mlx5e_txqsq *sq);static inline bool mlx5e_skb_fifo_has_room (struct mlx5e_skb_fifo *fifo) { -return (*fifo->pc - *fifo->cc) < fifo->mask; +return (u16)(*fifo->pc - *fifo->cc) < fifo->mask; } static inline bool
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 88/211 mlx5: fix possible ptp queue fifo use-after-free
In reply to Greg Kroah-HartmanFrom: Vadim Fedorenko <[email protected]>
[ Upstream commit 3a50cf1e8e5157b82268eee7e330dbe5736a0948 ]
Fifo indexes are not checked during pop operations and it leads to potential use-after-free when poping from empty queue. Such case was possible during re-sync action. WARN_ON_ONCE covers future cases.
There were out-of-order cqe spotted which lead to drain of the queue and use-after-free because of lack of fifo pointers check. Special check and counter are added to avoid resync operation if SKB could not exist in the fifo because of OOO cqe (skb_id must be between consumer and producer index).
--- .../net/ethernet/mellanox/mlx5/core/en/ptp.c | 19 ++++++++++++++++++- .../net/ethernet/mellanox/mlx5/core/en/txrx.h | 2 ++ .../ethernet/mellanox/mlx5/core/en_stats.c | 1 + .../ethernet/mellanox/mlx5/core/en_stats.h | 1 + 4 files changed, 22 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c +18 -1
@@ -86,6 +86,17 @@ static bool mlx5e_ptp_ts_cqe_drop(struct mlx5e_ptpsq *ptpsq, u16 skb_cc, u16 skbreturn (ptpsq->ts_cqe_ctr_mask && (skb_cc != skb_id)); } +static bool mlx5e_ptp_ts_cqe_ooo (struct mlx5e_ptpsq *ptpsq,u16 skb_id) +{ +u16 skb_cc =PTP_WQE_CTR2IDX (ptpsq->skb_fifo_cc); +u16 skb_pc =PTP_WQE_CTR2IDX (ptpsq->skb_fifo_pc); + +if (PTP_WQE_CTR2IDX (skb_id - skb_cc) >=PTP_WQE_CTR2IDX (skb_pc - skb_cc)) +return true; + +return false; +} +static void mlx5e_ptp_skb_fifo_ts_cqe_resync (struct mlx5e_ptpsq *ptpsq,u16 skb_cc,u16 skb_id,int budget) {
@@ -120,8 +131,14 @@ static void mlx5e_ptp_handle_ts_cqe(struct mlx5e_ptpsq *ptpsq, goto out; } -if (mlx5e_ptp_ts_cqe_drop (ptpsq, skb_cc, skb_id)) +if (mlx5e_ptp_ts_cqe_drop (ptpsq, skb_cc, skb_id)) { +if (mlx5e_ptp_ts_cqe_ooo (ptpsq, skb_id)) { +/* already handled by a previous resync */ + ptpsq->cq_stats->ooo_cqe_drop++; +return ; + }mlx5e_ptp_skb_fifo_ts_cqe_resync (ptpsq, skb_cc, skb_id, budget); + } skb =mlx5e_skb_fifo_pop (&ptpsq->skb_fifo); hwtstamp =mlx5e_cqe_ts_to_ns (sq->ptp_cyc2time, sq->clock,get_cqe_ts (cqe));
drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h +2 -0
@@ -297,6 +297,8 @@ void mlx5e_skb_fifo_push(struct mlx5e_skb_fifo *fifo, struct sk_buff *skb)static inline struct sk_buff *mlx5e_skb_fifo_pop (struct mlx5e_skb_fifo *fifo) { +WARN_ON_ONCE (*fifo->pc == *fifo->cc); +return *mlx5e_skb_fifo_get (fifo, (*fifo->cc)++); }
drivers/net/ethernet/mellanox/mlx5/core/en_stats.c +1 -0
@@ -2138,6 +2138,7 @@ static const struct counter_desc ptp_cq_stats_desc[] = { { MLX5E_DECLARE_PTP_CQ_STAT(struct mlx5e_ptp_cq_stats, abort_abs_diff_ns) }, { MLX5E_DECLARE_PTP_CQ_STAT(struct mlx5e_ptp_cq_stats, resync_cqe) }, { MLX5E_DECLARE_PTP_CQ_STAT(struct mlx5e_ptp_cq_stats, resync_event) }, + { MLX5E_DECLARE_PTP_CQ_STAT(struct mlx5e_ptp_cq_stats, ooo_cqe_drop) }, }; static const struct counter_desc ptp_rq_stats_desc[] = {
drivers/net/ethernet/mellanox/mlx5/core/en_stats.h +1 -0
@@ -461,6 +461,7 @@ struct mlx5e_ptp_cq_stats {u64 abort_abs_diff_ns;u64 resync_cqe;u64 resync_event; +u64 ooo_cqe_drop; };struct mlx5e_rep_stats {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 89/211 net/mlx5: ECPF, wait for VF pages only after disabling host PFs
In reply to Greg Kroah-HartmanFrom: Maher Sanalla <[email protected]>
[ Upstream commit e1ed30c8c09abc85a01c897845bdbd08c0333353 ]
Currently, during the early stages of their unloading, particularly during SRIOV disablement, PFs/ECPFs wait on the release of all of their VFs memory pages. Furthermore, ECPFs are considered the page supplier for host VFs, hence the host VFs memory pages are freed only during ECPF cleanup when host interfaces get disabled.
Thus, disabling SRIOV early in unload timeline causes the DPU ECPF to stall on driver unload while waiting on the release of host VF pages that won't be freed before host interfaces get disabled later on.
Therefore, for ECPFs, wait on the release of VFs pages only after the disablement of host PFs during ECPF cleanup flow. Then, host PFs and VFs are disabled and their memory shall be freed accordingly.
--- drivers/net/ethernet/mellanox/mlx5/core/ecpf.c | 4 ++++ drivers/net/ethernet/mellanox/mlx5/core/sriov.c | 4 ++++ 2 files changed, 8 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/ecpf.c +4 -0
@@ -90,4 +90,8 @@ void mlx5_ec_cleanup(struct mlx5_core_dev *dev) err =mlx5_wait_for_pages (dev, &dev->priv.page_counters[MLX5_HOST_PF ]);if (err)mlx5_core_warn (dev,"Timeout reclaiming external host PF pages err(%d)\n" , err); + + err =mlx5_wait_for_pages (dev, &dev->priv.page_counters[MLX5_VF ]); +if (err) +mlx5_core_warn (dev,"Timeout reclaiming external host VFs pages err(%d)\n" , err); }
drivers/net/ethernet/mellanox/mlx5/core/sriov.c +4 -0
@@ -147,6 +147,10 @@ mlx5_device_disable_sriov(struct mlx5_core_dev *dev, int num_vfs, bool clear_vf)mlx5_eswitch_disable_sriov (dev->priv.eswitch, clear_vf); +/* For ECPFs, skip waiting for host VF pages until ECPF is destroyed */ +if (mlx5_core_is_ecpf (dev)) +return ; +if (mlx5_wait_for_pages (dev, &dev->priv.page_counters[MLX5_VF ]))mlx5_core_warn (dev,"timeout reclaiming VFs pages\n" ); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 90/211 net/mlx5e: Verify flow_source cap before using it
In reply to Greg Kroah-HartmanFrom: Roi Dayan <[email protected]>
[ Upstream commit 1bf8b0dae8dde6f02520a5ea34fdaa3b39342e69 ]
When adding send to vport rule verify flow_source matching is supported by checking the flow_source cap.
--- drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +2 -1
@@ -1070,7 +1070,8 @@ mlx5_eswitch_add_send_to_vport_rule(struct mlx5_eswitch *on_esw, dest.vport.flags |=MLX5_FLOW_DEST_VPORT_VHCA_ID ; flow_act.action =MLX5_FLOW_CONTEXT_ACTION_FWD_DEST ; -if (rep->vport ==MLX5_VPORT_UPLINK ) +if (MLX5_CAP_ESW_FLOWTABLE (on_esw->dev, flow_source) && + rep->vport ==MLX5_VPORT_UPLINK ) spec->flow_context.flow_source =MLX5_FLOW_CONTEXT_FLOW_SOURCE_LOCAL_VPORT ; flow_rule = mlx5_add_flow_rules(mlx5_eswitch_get_slow_fdb(on_esw),
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 91/211 net/mlx5: Geneve, Fix handling of Geneve object id as error code
In reply to Greg Kroah-HartmanFrom: Maor Dickman <[email protected]>
[ Upstream commit d28a06d7dbedc598a06bd1e53a28125f87ca5d0c ]
On success, mlx5_geneve_tlv_option_create returns non negative Geneve object id. In case the object id is positive value the caller functions will handle it as an error (non zero) and will fail to offload the Geneve rule.
Fix this by changing caller function ,mlx5_geneve_tlv_option_add, to return 0 in case valid non negative object id was provided.
--- drivers/net/ethernet/mellanox/mlx5/core/lib/geneve.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/mellanox/mlx5/core/lib/geneve.c +1 -0
@@ -105,6 +105,7 @@ int mlx5_geneve_tlv_option_add(struct mlx5_geneve *geneve, struct geneve_opt *op geneve->opt_type = opt->type; geneve->obj_id = res; geneve->refcount++; + res =0 ; } unlock:
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 92/211 ext4: fix incorrect options show of original mount_opt and extend mount_opt2
In reply to Greg Kroah-HartmanFrom: Zhang Yi <[email protected]>
[ Upstream commit e3645d72f8865ffe36f9dc811540d40aa3c848d3 ]
Current _ext4_show_options() do not distinguish MOPT_2 flag, so it mixed extend sbi->s_mount_opt2 options with sbi->s_mount_opt, it could lead to show incorrect options, e.g. show fc_debug_force if we mount with errors=continue mode and miss it if we set.
$ mkfs.ext4 /dev/pmem0
$ mount -o errors=remount-ro /dev/pmem0 /mnt
$ cat /proc/fs/ext4/pmem0/options | grep fc_debug_force
#empty
$ mount -o remount,errors=continue /mnt
$ cat /proc/fs/ext4/pmem0/options | grep fc_debug_force
fc_debug_force
$ mount -o remount,errors=remount-ro,fc_debug_force /mnt
$ cat /proc/fs/ext4/pmem0/options | grep fc_debug_force
#empty--- fs/ext4/ext4.h | 1 + fs/ext4/super.c | 28 +++++++++++++++++++++------- 2 files changed, 22 insertions(+), 7 deletions(-)
fs/ext4/ext4.h +1 -0
@@ -1529,6 +1529,7 @@ struct ext4_sb_info {unsigned int s_mount_opt2;unsigned long s_mount_flags;unsigned int s_def_mount_opt; +unsigned int s_def_mount_opt2;ext4_fsblk_t s_sb_block;atomic64_t s_resv_clusters;kuid_t s_resuid;
fs/ext4/super.c +21 -7
@@ -2894,7 +2894,7 @@ static int _ext4_show_options(struct seq_file *seq, struct super_block *sb, {struct ext4_sb_info *sbi =EXT4_SB (sb);struct ext4_super_block *es = sbi->s_es; -int def_errors, def_mount_opt = sbi->s_def_mount_opt; +int def_errors;const struct mount_opts *m;char sep = nodefs ?'\n' :',' ;
@@ -2906,15 +2906,28 @@ static int _ext4_show_options(struct seq_file *seq, struct super_block *sb,for (m = ext4_mount_opts; m->token != Opt_err; m++) {int want_set = m->flags &MOPT_SET ; +int opt_2 = m->flags &MOPT_2 ; +unsigned int mount_opt, def_mount_opt; +if (((m->flags & (MOPT_SET |MOPT_CLEAR )) ==0 ) || m->flags &MOPT_SKIP )continue ; -if (!nodefs && !(m->mount_opt & (sbi->s_mount_opt ^ def_mount_opt))) -continue ;/* skip if same as the default */ + +if (opt_2) { + mount_opt = sbi->s_mount_opt2; + def_mount_opt = sbi->s_def_mount_opt2; + }else { + mount_opt = sbi->s_mount_opt; + def_mount_opt = sbi->s_def_mount_opt; + } +/* skip if same as the default */ +if (!nodefs && !(m->mount_opt & (mount_opt ^ def_mount_opt))) +continue ; +/* select Opt_noFoo vs Opt_Foo */ if ((want_set && - (sbi->s_mount_opt & m->mount_opt) != m->mount_opt) || - (!want_set && (sbi->s_mount_opt & m->mount_opt))) -continue ;/* select Opt_noFoo vs Opt_Foo */ + (mount_opt & m->mount_opt) != m->mount_opt) || + (!want_set && (mount_opt & m->mount_opt))) +continue ;SEQ_OPTS_PRINT ("%s" ,token2str (m->token)); }
@@ -2942,7 +2955,7 @@ static int _ext4_show_options(struct seq_file *seq, struct super_block *sb,if (nodefs || sbi->s_stripe)SEQ_OPTS_PRINT ("stripe=%lu" , sbi->s_stripe);if (nodefs ||EXT4_MOUNT_DATA_FLAGS & - (sbi->s_mount_opt ^ def_mount_opt)) { + (sbi->s_mount_opt ^ sbi->s_def_mount_opt)) {if (test_opt (sb,DATA_FLAGS ) ==EXT4_MOUNT_JOURNAL_DATA )SEQ_OPTS_PUTS ("data=journal" );else if (test_opt (sb,DATA_FLAGS ) ==EXT4_MOUNT_ORDERED_DATA )
@@ -5086,6 +5099,7 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb) goto failed_mount; sbi->s_def_mount_opt = sbi->s_mount_opt; + sbi->s_def_mount_opt2 = sbi->s_mount_opt2; err =ext4_check_opt_consistency (fc, sb);if (err <0 )
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 93/211 nfc: fix memory leak of se_io context in nfc_genl_se_io
In reply to Greg Kroah-HartmanFrom: Fedor Pchelkin <[email protected]>
[ Upstream commit 25ff6f8a5a3b8dc48e8abda6f013e8cc4b14ffea ]
The callback context for sending/receiving APDUs to/from the selected secure element is allocated inside nfc_genl_se_io and supposed to be eventually freed in se_io_cb callback function. However, there are several error paths where the bwi_timer is not charged to call se_io_cb later, and the cb_context is leaked.
The patch proposes to free the cb_context explicitly on those error paths.
At the moment we can't simply check 'dev->ops->se_io()' return value as it may be negative in both cases: when the timer was charged and was not.
--- drivers/nfc/st-nci/se.c | 6 ++++++ drivers/nfc/st21nfca/se.c | 6 ++++++ net/nfc/netlink.c | 4 ++++ 3 files changed, 16 insertions(+)
drivers/nfc/st-nci/se.c +6 -0
@@ -672,6 +672,12 @@ int st_nci_se_io(struct nci_dev *ndev, u32 se_idx,ST_NCI_EVT_TRANSMIT_DATA , apdu, apdu_length);default : +/* Need to free cb_context here as at the moment we can't +* clearly indicate to the caller if the callback function +* would be called (and free it) or not. In both cases a +* negative value may be returned to the caller. +*/ +kfree (cb_context);return -ENODEV ; } }
drivers/nfc/st21nfca/se.c +6 -0
@@ -236,6 +236,12 @@ int st21nfca_hci_se_io(struct nfc_hci_dev *hdev, u32 se_idx,ST21NFCA_EVT_TRANSMIT_DATA , apdu, apdu_length);default : +/* Need to free cb_context here as at the moment we can't +* clearly indicate to the caller if the callback function +* would be called (and free it) or not. In both cases a +* negative value may be returned to the caller. +*/ +kfree (cb_context);return -ENODEV ; } }
net/nfc/netlink.c +4 -0
@@ -1442,7 +1442,11 @@ static int nfc_se_io(struct nfc_dev *dev, u32 se_idx, rc = dev->ops->se_io (dev, se_idx, apdu, apdu_length, cb, cb_context); +device_unlock (&dev->dev); +return rc; + error: +kfree (cb_context);device_unlock (&dev->dev);return rc; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 94/211 net/sched: transition act_pedit to rcu and percpu stats
In reply to Greg Kroah-HartmanFrom: Pedro Tammela <[email protected]>
[ Upstream commit 52cf89f78c01bf39973f3e70d366921d70faff7a ]
The software pedit action didn't get the same love as some of the other actions and it's still using spinlocks and shared stats in the datapath.
Transition the action to rcu and percpu stats as this improves the action's performance dramatically on multiple cpu deployments.
Stable-dep-of: e9e42292ea76 ("net/sched: act_pedit: fix action bind logic")
--- include/net/tc_act/tc_pedit.h | 81 +++++++++++++++---- net/sched/act_pedit.c | 148 ++++++++++++++++++++-------------- 2 files changed, 153 insertions(+), 76 deletions(-)
include/net/tc_act/tc_pedit.h +66 -15
@@ -4,22 +4,29 @@#include <net/act_api.h> #include <linux/tc_act/tc_pedit.h> +#include <linux/types.h> struct tcf_pedit_key_ex {enum pedit_header_type htype;enum pedit_cmd cmd; }; -struct tcf_pedit { -struct tc_action common; -unsigned char tcfp_nkeys; -unsigned char tcfp_flags; -u32 tcfp_off_max_hint; +struct tcf_pedit_parms {struct tc_pedit_key *tcfp_keys;struct tcf_pedit_key_ex *tcfp_keys_ex; +u32 tcfp_off_max_hint; +unsigned char tcfp_nkeys; +unsigned char tcfp_flags; +struct rcu_head rcu; +}; + +struct tcf_pedit { +struct tc_action common; +struct tcf_pedit_parms __rcu *parms; };#define to_pedit (a) ((struct tcf_pedit *)a) +#define to_pedit_parms (a) (rcu_dereference(to_pedit(a)->parms))static inline bool is_tcf_pedit (const struct tc_action *a) {
@@ -32,37 +39,81 @@ static inline bool is_tcf_pedit(const struct tc_action *a)static inline int tcf_pedit_nkeys (const struct tc_action *a) { -return to_pedit (a)->tcfp_nkeys; +struct tcf_pedit_parms *parms; +int nkeys; + +rcu_read_lock (); + parms =to_pedit_parms (a); + nkeys = parms->tcfp_nkeys; +rcu_read_unlock (); + +return nkeys; }static inline u32 tcf_pedit_htype (const struct tc_action *a,int index) { -if (to_pedit (a)->tcfp_keys_ex) -return to_pedit (a)->tcfp_keys_ex[index].htype; +u32 htype =TCA_PEDIT_KEY_EX_HDR_TYPE_NETWORK ; +struct tcf_pedit_parms *parms; + +rcu_read_lock (); + parms =to_pedit_parms (a); +if (parms->tcfp_keys_ex) + htype = parms->tcfp_keys_ex[index].htype; +rcu_read_unlock (); -return TCA_PEDIT_KEY_EX_HDR_TYPE_NETWORK ; +return htype; }static inline u32 tcf_pedit_cmd (const struct tc_action *a,int index) { -if (to_pedit (a)->tcfp_keys_ex) -return to_pedit (a)->tcfp_keys_ex[index].cmd; +struct tcf_pedit_parms *parms; +u32 cmd = __PEDIT_CMD_MAX; -return __PEDIT_CMD_MAX; +rcu_read_lock (); + parms =to_pedit_parms (a); +if (parms->tcfp_keys_ex) + cmd = parms->tcfp_keys_ex[index].cmd; +rcu_read_unlock (); + +return cmd; }static inline u32 tcf_pedit_mask (const struct tc_action *a,int index) { -return to_pedit (a)->tcfp_keys[index].mask; +struct tcf_pedit_parms *parms; +u32 mask; + +rcu_read_lock (); + parms =to_pedit_parms (a); + mask = parms->tcfp_keys[index].mask; +rcu_read_unlock (); + +return mask; }static inline u32 tcf_pedit_val (const struct tc_action *a,int index) { -return to_pedit (a)->tcfp_keys[index].val; +struct tcf_pedit_parms *parms; +u32 val; + +rcu_read_lock (); + parms =to_pedit_parms (a); + val = parms->tcfp_keys[index].val; +rcu_read_unlock (); + +return val; }static inline u32 tcf_pedit_offset (const struct tc_action *a,int index) { -return to_pedit (a)->tcfp_keys[index].off; +struct tcf_pedit_parms *parms; +u32 off; + +rcu_read_lock (); + parms =to_pedit_parms (a); + off = parms->tcfp_keys[index].off; +rcu_read_unlock (); + +return off; }#endif /* __NET_TC_PED_H */
net/sched/act_pedit.c +87 -61
264 lines not on this page · raw message
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 95/211 net/sched: act_pedit: fix action bind logic
In reply to Greg Kroah-HartmanFrom: Pedro Tammela <[email protected]>
[ Upstream commit e9e42292ea76a8358b0c02ffd530d78e133a1b73 ]
The TC architecture allows filters and actions to be created independently. In filters the user can reference action objects using:
tc action add action pedit ... index 1
tc filter add ... action pedit index 1
In the current code for act_pedit this is broken as it checks netlink attributes for create/update before actually checking if we are binding to an existing action.
tdc results:
1..69
ok 1 319a - Add pedit action that mangles IP TTL
ok 2 7e67 - Replace pedit action with invalid goto chain
ok 3 377e - Add pedit action with RAW_OP offset u32
ok 4 a0ca - Add pedit action with RAW_OP offset u32 (INVALID)
ok 5 dd8a - Add pedit action with RAW_OP offset u16 u16
ok 6 53db - Add pedit action with RAW_OP offset u16 (INVALID)
ok 7 5c7e - Add pedit action with RAW_OP offset u8 add value
ok 8 2893 - Add pedit action with RAW_OP offset u8 quad
ok 9 3a07 - Add pedit action with RAW_OP offset u8-u16-u8
ok 10 ab0f - Add pedit action with RAW_OP offset u16-u8-u8
ok 11 9d12 - Add pedit action with RAW_OP offset u32 set u16 clear u8 invert ok 12 ebfa - Add pedit action with RAW_OP offset overflow u32 (INVALID)
ok 13 f512 - Add pedit action with RAW_OP offset u16 at offmask shift set ok 14 c2cb - Add pedit action with RAW_OP offset u32 retain value
ok 15 1762 - Add pedit action with RAW_OP offset u8 clear value
ok 16 bcee - Add pedit action with RAW_OP offset u8 retain value
ok 17 e89f - Add pedit action with RAW_OP offset u16 retain value
ok 18 c282 - Add pedit action with RAW_OP offset u32 clear value
ok 19 c422 - Add pedit action with RAW_OP offset u16 invert value
ok 20 d3d3 - Add pedit action with RAW_OP offset u32 invert value
ok 21 57e5 - Add pedit action with RAW_OP offset u8 preserve value
ok 22 99e0 - Add pedit action with RAW_OP offset u16 preserve value
ok 23 1892 - Add pedit action with RAW_OP offset u32 preserve value
ok 24 4b60 - Add pedit action with RAW_OP negative offset u16/u32 set value ok 25 a5a7 - Add pedit action with LAYERED_OP eth set src
ok 26 86d4 - Add pedit action with LAYERED_OP eth set src & dst
ok 27 f8a9 - Add pedit action with LAYERED_OP eth set dst
ok 28 c715 - Add pedit action with LAYERED_OP eth set src (INVALID)
ok 29 8131 - Add pedit action with LAYERED_OP eth set dst (INVALID)
ok 30 ba22 - Add pedit action with LAYERED_OP eth type set/clear sequence ok 31 dec4 - Add pedit action with LAYERED_OP eth set type (INVALID)
ok 32 ab06 - Add pedit action with LAYERED_OP eth add type
ok 33 918d - Add pedit action with LAYERED_OP eth invert src
ok 34 a8d4 - Add pedit action with LAYERED_OP eth invert dst
ok 35 ee13 - Add pedit action with LAYERED_OP eth invert type
ok 36 7588 - Add pedit action with LAYERED_OP ip set src
ok 37 0fa7 - Add pedit action with LAYERED_OP ip set dst
ok 38 5810 - Add pedit action with LAYERED_OP ip set src & dst
ok 39 1092 - Add pedit action with LAYERED_OP ip set ihl & dsfield
ok 40 02d8 - Add pedit action with LAYERED_OP ip set ttl & protocol
ok 41 3e2d - Add pedit action with LAYERED_OP ip set ttl (INVALID)
ok 42 31ae - Add pedit action with LAYERED_OP ip ttl clear/set
ok 43 486f - Add pedit action with LAYERED_OP ip set duplicate fields
ok 44 e790 - Add pedit action with LAYERED_OP ip set ce, df, mf, firstfrag, nofrag fields ok 45 cc8a - Add pedit action with LAYERED_OP ip set tos
ok 46 7a17 - Add pedit action with LAYERED_OP ip set precedence
ok 47 c3b6 - Add pedit action with LAYERED_OP ip add tos
ok 48 43d3 - Add pedit action with LAYERED_OP ip add precedence
ok 49 438e - Add pedit action with LAYERED_OP ip clear tos
ok 50 6b1b - Add pedit action with LAYERED_OP ip clear precedence
ok 51 824a - Add pedit action with LAYERED_OP ip invert tos
ok 52 106f - Add pedit action with LAYERED_OP ip invert precedence
ok 53 6829 - Add pedit action with LAYERED_OP beyond ip set dport & sport ok 54 afd8 - Add pedit action with LAYERED_OP beyond ip set icmp_type & icmp_code ok 55 3143 - Add pedit action with LAYERED_OP beyond ip set dport (INVALID) ok 56 815c - Add pedit action with LAYERED_OP ip6 set src
ok 57 4dae - Add pedit action with LAYERED_OP ip6 set dst
ok 58 fc1f - Add pedit action with LAYERED_OP ip6 set src & dst
ok 59 6d34 - Add pedit action with LAYERED_OP ip6 dst retain value (INVALID) ok 60 94bb - Add pedit action with LAYERED_OP ip6 traffic_class
ok 61 6f5e - Add pedit action with LAYERED_OP ip6 flow_lbl
ok 62 6795 - Add pedit action with LAYERED_OP ip6 set payload_len, nexthdr, hoplimit ok 63 1442 - Add pedit action with LAYERED_OP tcp set dport & sport
ok 64 b7ac - Add pedit action with LAYERED_OP tcp sport set (INVALID)
ok 65 cfcc - Add pedit action with LAYERED_OP tcp flags set
ok 66 3bc4 - Add pedit action with LAYERED_OP tcp set dport, sport & flags fields ok 67 f1c8 - Add pedit action with LAYERED_OP udp set dport & sport
ok 68 d784 - Add pedit action with mixed RAW/LAYERED_OP #1
ok 69 70ca - Add pedit action with mixed RAW/LAYERED_OP #2
--- net/sched/act_pedit.c | 58 +++++++++++++++++++++++-------------------- 1 file changed, 31 insertions(+), 27 deletions(-)
net/sched/act_pedit.c +31 -27
@@ -181,26 +181,6 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla, } parm =nla_data (pattr); -if (!parm->nkeys) { -NL_SET_ERR_MSG_MOD (extack,"Pedit requires keys to be passed" ); -return -EINVAL ; - } - ksize = parm->nkeys *sizeof (struct tc_pedit_key ); -if (nla_len (pattr) <sizeof (*parm) + ksize) { -NL_SET_ERR_MSG_ATTR (extack, pattr,"Length of TCA_PEDIT_PARMS or TCA_PEDIT_PARMS_EX pedit attribute is invalid" ); -return -EINVAL ; - } - - nparms =kzalloc (sizeof (*nparms),GFP_KERNEL ); -if (!nparms) -return -ENOMEM ; - - nparms->tcfp_keys_ex = -tcf_pedit_keys_ex_parse (tb[TCA_PEDIT_KEYS_EX ], parm->nkeys); -if (IS_ERR (nparms->tcfp_keys_ex)) { - ret =PTR_ERR (nparms->tcfp_keys_ex); - goto out_free; - } index = parm->index; err =tcf_idr_check_alloc (tn, &index, a, bind);
@@ -209,25 +189,49 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla, &act_pedit_ops, bind, flags);if (ret) {tcf_idr_cleanup (tn, index); - goto out_free_ex; +return ret; } ret =ACT_P_CREATED ; }else if (err >0 ) {if (bind) - goto out_free; +return 0 ;if (!(flags &TCA_ACT_FLAGS_REPLACE )) { ret = -EEXIST ; goto out_release; } }else { - ret = err; - goto out_free_ex; +return err; + } + +if (!parm->nkeys) { +NL_SET_ERR_MSG_MOD (extack,"Pedit requires keys to be passed" ); + ret = -EINVAL ; + goto out_release; + } + ksize = parm->nkeys *sizeof (struct tc_pedit_key ); +if (nla_len (pattr) <sizeof (*parm) + ksize) { +NL_SET_ERR_MSG_ATTR (extack, pattr,"Length of TCA_PEDIT_PARMS or TCA_PEDIT_PARMS_EX pedit attribute is invalid" ); + ret = -EINVAL ; + goto out_release; + } + + nparms =kzalloc (sizeof (*nparms),GFP_KERNEL ); +if (!nparms) { + ret = -ENOMEM ; + goto out_release; + } + + nparms->tcfp_keys_ex = +tcf_pedit_keys_ex_parse (tb[TCA_PEDIT_KEYS_EX ], parm->nkeys); +if (IS_ERR (nparms->tcfp_keys_ex)) { + ret =PTR_ERR (nparms->tcfp_keys_ex); + goto out_free; } err =tcf_action_check_ctrlact (parm->action, tp, &goto_ch, extack);if (err <0 ) { ret = err; - goto out_release; + goto out_free_ex; } nparms->tcfp_off_max_hint =0 ;
@@ -278,12 +282,12 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla, put_chain:if (goto_ch)tcf_chain_put_by_act (goto_ch); -out_release: -tcf_idr_release (*a, bind); out_free_ex:kfree (nparms->tcfp_keys_ex); out_free:kfree (nparms); +out_release: +tcf_idr_release (*a, bind);return ret; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 96/211 net/sched: act_mpls: fix action bind logic
In reply to Greg Kroah-HartmanFrom: Pedro Tammela <[email protected]>
[ Upstream commit e88d78a773cb5242e933930c8855bf4b2e8c2397 ]
The TC architecture allows filters and actions to be created independently. In filters the user can reference action objects using:
tc action add action mpls ... index 1
tc filter add ... action mpls index 1
In the current code for act_mpls this is broken as it checks netlink attributes for create/update before actually checking if we are binding to an existing action.
tdc results:
1..53
ok 1 a933 - Add MPLS dec_ttl action with pipe opcode
ok 2 08d1 - Add mpls dec_ttl action with pass opcode
ok 3 d786 - Add mpls dec_ttl action with drop opcode
ok 4 f334 - Add mpls dec_ttl action with reclassify opcode
ok 5 29bd - Add mpls dec_ttl action with continue opcode
ok 6 48df - Add mpls dec_ttl action with jump opcode
ok 7 62eb - Add mpls dec_ttl action with trap opcode
ok 8 09d2 - Add mpls dec_ttl action with opcode and cookie
ok 9 c170 - Add mpls dec_ttl action with opcode and cookie of max length ok 10 9118 - Add mpls dec_ttl action with invalid opcode
ok 11 6ce1 - Add mpls dec_ttl action with label (invalid)
ok 12 352f - Add mpls dec_ttl action with tc (invalid)
ok 13 fa1c - Add mpls dec_ttl action with ttl (invalid)
ok 14 6b79 - Add mpls dec_ttl action with bos (invalid)
ok 15 d4c4 - Add mpls pop action with ip proto
ok 16 91fb - Add mpls pop action with ip proto and cookie
ok 17 92fe - Add mpls pop action with mpls proto
ok 18 7e23 - Add mpls pop action with no protocol (invalid)
ok 19 6182 - Add mpls pop action with label (invalid)
ok 20 6475 - Add mpls pop action with tc (invalid)
ok 21 067b - Add mpls pop action with ttl (invalid)
ok 22 7316 - Add mpls pop action with bos (invalid)
ok 23 38cc - Add mpls push action with label
ok 24 c281 - Add mpls push action with mpls_mc protocol
ok 25 5db4 - Add mpls push action with label, tc and ttl
ok 26 7c34 - Add mpls push action with label, tc ttl and cookie of max length ok 27 16eb - Add mpls push action with label and bos
ok 28 d69d - Add mpls push action with no label (invalid)
ok 29 e8e4 - Add mpls push action with ipv4 protocol (invalid)
ok 30 ecd0 - Add mpls push action with out of range label (invalid) ok 31 d303 - Add mpls push action with out of range tc (invalid)
ok 32 fd6e - Add mpls push action with ttl of 0 (invalid)
ok 33 19e9 - Add mpls mod action with mpls label
ok 34 1fde - Add mpls mod action with max mpls label
ok 35 0c50 - Add mpls mod action with mpls label exceeding max (invalid) ok 36 10b6 - Add mpls mod action with mpls label of MPLS_LABEL_IMPLNULL (invalid) ok 37 57c9 - Add mpls mod action with mpls min tc
ok 38 6872 - Add mpls mod action with mpls max tc
ok 39 a70a - Add mpls mod action with mpls tc exceeding max (invalid) ok 40 6ed5 - Add mpls mod action with mpls ttl
ok 41 77c1 - Add mpls mod action with mpls ttl and cookie
ok 42 b80f - Add mpls mod action with mpls max ttl
ok 43 8864 - Add mpls mod action with mpls min ttl
ok 44 6c06 - Add mpls mod action with mpls ttl of 0 (invalid)
ok 45 b5d8 - Add mpls mod action with mpls ttl exceeding max (invalid) ok 46 451f - Add mpls mod action with mpls max bos
ok 47 a1ed - Add mpls mod action with mpls min bos
ok 48 3dcf - Add mpls mod action with mpls bos exceeding max (invalid) ok 49 db7c - Add mpls mod action with protocol (invalid)
ok 50 b070 - Replace existing mpls push action with new ID
ok 51 95a9 - Replace existing mpls push action with new label, tc, ttl and cookie ok 52 6cce - Delete mpls pop action
ok 53 d138 - Flush mpls actions
--- net/sched/act_mpls.c | 66 +++++++++++++++++++++++++------------------- 1 file changed, 37 insertions(+), 29 deletions(-)
net/sched/act_mpls.c +37 -29
@@ -190,40 +190,67 @@ static int tcf_mpls_init(struct net *net, struct nlattr *nla, parm =nla_data (tb[TCA_MPLS_PARMS ]); index = parm->index; + err =tcf_idr_check_alloc (tn, &index, a, bind); +if (err <0 ) +return err; + exists = err; +if (exists && bind) +return 0 ; + +if (!exists) { + ret =tcf_idr_create (tn, index, est, a, &act_mpls_ops, bind, + true, flags); +if (ret) { +tcf_idr_cleanup (tn, index); +return ret; + } + + ret =ACT_P_CREATED ; + }else if (!(flags &TCA_ACT_FLAGS_REPLACE )) { +tcf_idr_release (*a, bind); +return -EEXIST ; + } +/* Verify parameters against action type. */ switch (parm->m_action) {case TCA_MPLS_ACT_POP :if (!tb[TCA_MPLS_PROTO ]) {NL_SET_ERR_MSG_MOD (extack,"Protocol must be set for MPLS pop" ); -return -EINVAL ; + err = -EINVAL ; + goto release_idr; }if (!eth_proto_is_802_3 (nla_get_be16 (tb[TCA_MPLS_PROTO ]))) {NL_SET_ERR_MSG_MOD (extack,"Invalid protocol type for MPLS pop" ); -return -EINVAL ; + err = -EINVAL ; + goto release_idr; }if (tb[TCA_MPLS_LABEL ] || tb[TCA_MPLS_TTL ] || tb[TCA_MPLS_TC ] || tb[TCA_MPLS_BOS ]) {NL_SET_ERR_MSG_MOD (extack,"Label, TTL, TC or BOS cannot be used with MPLS pop" ); -return -EINVAL ; + err = -EINVAL ; + goto release_idr; }break ;case TCA_MPLS_ACT_DEC_TTL :if (tb[TCA_MPLS_PROTO ] || tb[TCA_MPLS_LABEL ] || tb[TCA_MPLS_TTL ] || tb[TCA_MPLS_TC ] || tb[TCA_MPLS_BOS ]) {NL_SET_ERR_MSG_MOD (extack,"Label, TTL, TC, BOS or protocol cannot be used with MPLS dec_ttl" ); -return -EINVAL ; + err = -EINVAL ; + goto release_idr; }break ;case TCA_MPLS_ACT_PUSH :case TCA_MPLS_ACT_MAC_PUSH :if (!tb[TCA_MPLS_LABEL ]) {NL_SET_ERR_MSG_MOD (extack,"Label is required for MPLS push" ); -return -EINVAL ; + err = -EINVAL ; + goto release_idr; }if (tb[TCA_MPLS_PROTO ] && !eth_p_mpls (nla_get_be16 (tb[TCA_MPLS_PROTO ]))) {NL_SET_ERR_MSG_MOD (extack,"Protocol must be an MPLS type for MPLS push" ); -return -EPROTONOSUPPORT ; + err = -EPROTONOSUPPORT ; + goto release_idr; }/* Push needs a TTL - if not specified, set a default value. */ if (!tb[TCA_MPLS_TTL ]) {
@@ -238,33 +265,14 @@ static int tcf_mpls_init(struct net *net, struct nlattr *nla,case TCA_MPLS_ACT_MODIFY :if (tb[TCA_MPLS_PROTO ]) {NL_SET_ERR_MSG_MOD (extack,"Protocol cannot be used with MPLS modify" ); -return -EINVAL ; + err = -EINVAL ; + goto release_idr; }break ;default :NL_SET_ERR_MSG_MOD (extack,"Unknown MPLS action" ); -return -EINVAL ; - } - - err =tcf_idr_check_alloc (tn, &index, a, bind); -if (err <0 ) -return err; - exists = err; -if (exists && bind) -return 0 ; - -if (!exists) { - ret =tcf_idr_create (tn, index, est, a, - &act_mpls_ops, bind, true, flags); -if (ret) { -tcf_idr_cleanup (tn, index); -return ret; - } - - ret =ACT_P_CREATED ; - }else if (!(flags &TCA_ACT_FLAGS_REPLACE )) { -tcf_idr_release (*a, bind); -return -EEXIST ; + err = -EINVAL ; + goto release_idr; } err =tcf_action_check_ctrlact (parm->action, tp, &goto_ch, extack);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 97/211 net/sched: act_sample: fix action bind logic
In reply to Greg Kroah-HartmanFrom: Pedro Tammela <[email protected]>
[ Upstream commit 4a20056a49a1854966562241922f68197f950539 ]
The TC architecture allows filters and actions to be created independently. In filters the user can reference action objects using:
tc action add action sample ... index 1
tc filter add ... action pedit index 1
In the current code for act_sample this is broken as it checks netlink attributes for create/update before actually checking if we are binding to an existing action.
tdc results:
1..29
ok 1 9784 - Add valid sample action with mandatory arguments
ok 2 5c91 - Add valid sample action with mandatory arguments and continue control action ok 3 334b - Add valid sample action with mandatory arguments and drop control action ok 4 da69 - Add valid sample action with mandatory arguments and reclassify control action ok 5 13ce - Add valid sample action with mandatory arguments and pipe control action ok 6 1886 - Add valid sample action with mandatory arguments and jump control action ok 7 7571 - Add sample action with invalid rate
ok 8 b6d4 - Add sample action with mandatory arguments and invalid control action ok 9 a874 - Add invalid sample action without mandatory arguments
ok 10 ac01 - Add invalid sample action without mandatory argument rate
ok 11 4203 - Add invalid sample action without mandatory argument group
ok 12 14a7 - Add invalid sample action without mandatory argument group
ok 13 8f2e - Add valid sample action with trunc argument
ok 14 45f8 - Add sample action with maximum rate argument
ok 15 ad0c - Add sample action with maximum trunc argument
ok 16 83a9 - Add sample action with maximum group argument
ok 17 ed27 - Add sample action with invalid rate argument
ok 18 2eae - Add sample action with invalid group argument
ok 19 6ff3 - Add sample action with invalid trunc size
ok 20 2b2a - Add sample action with invalid index
ok 21 dee2 - Add sample action with maximum allowed index
ok 22 560e - Add sample action with cookie
ok 23 704a - Replace existing sample action with new rate argument
ok 24 60eb - Replace existing sample action with new group argument
ok 25 2cce - Replace existing sample action with new trunc argument
ok 26 59d1 - Replace existing sample action with new control argument
ok 27 0a6e - Replace sample action with invalid goto chain control
ok 28 3872 - Delete sample action with valid index
ok 29 a394 - Delete sample action with invalid index
--- net/sched/act_sample.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
net/sched/act_sample.c +9 -2
@@ -55,8 +55,8 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla, sample_policy, NULL);if (ret <0 )return ret; -if (!tb[TCA_SAMPLE_PARMS ] || !tb[TCA_SAMPLE_RATE ] || - !tb[TCA_SAMPLE_PSAMPLE_GROUP ]) + +if (!tb[TCA_SAMPLE_PARMS ])return -EINVAL ; parm =nla_data (tb[TCA_SAMPLE_PARMS ]);
@@ -80,6 +80,13 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,tcf_idr_release (*a, bind);return -EEXIST ; } + +if (!tb[TCA_SAMPLE_RATE ] || !tb[TCA_SAMPLE_PSAMPLE_GROUP ]) { +NL_SET_ERR_MSG (extack,"sample rate and group are required" ); + err = -EINVAL ; + goto release_idr; + } + err =tcf_action_check_ctrlact (parm->action, tp, &goto_ch, extack);if (err <0 ) goto release_idr;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 98/211 net: dsa: seville: ignore mscc-miim read errors from Lynx PCS
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 0322ef49c1ac6f0e2ef37b146c0bf8440873072c ]
During the refactoring in the commit below, vsc9953_mdio_read() was replaced with mscc_miim_read(), which has one extra step: it checks for the MSCC_MIIM_DATA_ERROR bits before returning the result.
On T1040RDB, there are 8 QSGMII PCSes belonging to the switch, and they are organized in 2 groups. First group responds to MDIO addresses 4-7 because QSGMIIACR1[MDEV_PORT] is 1, and the second group responds to MDIO addresses 8-11 because QSGMIIBCR1[MDEV_PORT] is 2. I have double checked that these values are correctly set in the SERDES, as well as PCCR1[QSGMA_CFG] and PCCR1[QSGMB_CFG] are both 0b01.
mscc_miim_read: phyad 8 reg 0x1 MIIM_DATA 0x2dmscc_miim_read: phyad 8 reg 0x5 MIIM_DATA 0x5801mscc_miim_read: phyad 8 reg 0x1 MIIM_DATA 0x2dmscc_miim_read: phyad 8 reg 0x5 MIIM_DATA 0x5801mscc_miim_read: phyad 9 reg 0x1 MIIM_DATA 0x2dmscc_miim_read: phyad 9 reg 0x5 MIIM_DATA 0x5801mscc_miim_read: phyad 9 reg 0x1 MIIM_DATA 0x2dmscc_miim_read: phyad 9 reg 0x5 MIIM_DATA 0x5801mscc_miim_read: phyad 10 reg 0x1 MIIM_DATA 0x2dmscc_miim_read: phyad 10 reg 0x5 MIIM_DATA 0x5801mscc_miim_read: phyad 10 reg 0x1 MIIM_DATA 0x2dmscc_miim_read: phyad 10 reg 0x5 MIIM_DATA 0x5801mscc_miim_read: phyad 11 reg 0x1 MIIM_DATA 0x2dmscc_miim_read: phyad 11 reg 0x5 MIIM_DATA 0x5801mscc_miim_read: phyad 11 reg 0x1 MIIM_DATA 0x2dmscc_miim_read: phyad 11 reg 0x5 MIIM_DATA 0x5801mscc_miim_read: phyad 4 reg 0x1 MIIM_DATA 0x3002d, ERRORmscc_miim_read: phyad 4 reg 0x5 MIIM_DATA 0x3da01, ERRORmscc_miim_read: phyad 5 reg 0x1 MIIM_DATA 0x3002d, ERRORmscc_miim_read: phyad 5 reg 0x5 MIIM_DATA 0x35801, ERRORmscc_miim_read: phyad 5 reg 0x1 MIIM_DATA 0x3002d, ERRORmscc_miim_read: phyad 5 reg 0x5 MIIM_DATA 0x35801, ERRORmscc_miim_read: phyad 6 reg 0x1 MIIM_DATA 0x3002d, ERRORmscc_miim_read: phyad 6 reg 0x5 MIIM_DATA 0x35801, ERRORmscc_miim_read: phyad 6 reg 0x1 MIIM_DATA 0x3002d, ERRORmscc_miim_read: phyad 6 reg 0x5 MIIM_DATA 0x35801, ERRORmscc_miim_read: phyad 7 reg 0x1 MIIM_DATA 0x3002d, ERRORmscc_miim_read: phyad 7 reg 0x5 MIIM_DATA 0x35801, ERRORmscc_miim_read: phyad 7 reg 0x1 MIIM_DATA 0x3002d, ERRORmscc_miim_read: phyad 7 reg 0x5 MIIM_DATA 0x35801, ERROR
As can be seen, the data in MIIM_DATA is still valid despite having the MSCC_MIIM_DATA_ERROR bits set. The driver as introduced in commit 84705fc16552 ("net: dsa: felix: introduce support for Seville VSC9953 switch") was ignoring these bits, perhaps deliberately (although unbeknownst to me).
This is an old IP and the hardware team cannot seem to be able to help me track down a plausible reason for these failures. I'll keep investigating, but in the meantime, this is a direct regression which must be restored to a working state.
The only thing I can do is keep ignoring the errors as before.
--- drivers/net/dsa/ocelot/seville_vsc9953.c | 4 ++-- drivers/net/mdio/mdio-mscc-miim.c | 9 ++++++--- include/linux/mdio/mdio-mscc-miim.h | 2 +- 3 files changed, 9 insertions(+), 6 deletions(-)
drivers/net/dsa/ocelot/seville_vsc9953.c +2 -2
@@ -893,8 +893,8 @@ static int vsc9953_mdio_bus_alloc(struct ocelot *ocelot) rc =mscc_miim_setup (dev, &bus,"VSC9953 internal MDIO bus" , ocelot->targets[GCB ], - ocelot->map[GCB ][GCB_MIIM_MII_STATUS ®_MASK ]); - + ocelot->map[GCB ][GCB_MIIM_MII_STATUS ®_MASK ], + true);if (rc) {dev_err (dev,"failed to setup MDIO bus\n" );return rc;
drivers/net/mdio/mdio-mscc-miim.c +6 -3
@@ -52,6 +52,7 @@ struct mscc_miim_info {struct mscc_miim_dev {struct regmap *regs;int mii_status_offset; +bool ignore_read_errors;struct regmap *phy_regs;const struct mscc_miim_info *info;struct clk *clk;
@@ -138,7 +139,7 @@ static int mscc_miim_read(struct mii_bus *bus, int mii_id, int regnum) goto out; } -if (val &MSCC_MIIM_DATA_ERROR ) { +if (!miim->ignore_read_errors && !!(val &MSCC_MIIM_DATA_ERROR )) { ret = -EIO ; goto out; }
@@ -218,7 +219,8 @@ static const struct regmap_config mscc_miim_phy_regmap_config = { };int mscc_miim_setup (struct device *dev,struct mii_bus **pbus,const char *name, -struct regmap *mii_regmap,int status_offset) +struct regmap *mii_regmap,int status_offset, +bool ignore_read_errors) {struct mscc_miim_dev *miim;struct mii_bus *bus;
@@ -240,6 +242,7 @@ int mscc_miim_setup(struct device *dev, struct mii_bus **pbus, const char *name, miim->regs = mii_regmap; miim->mii_status_offset = status_offset; + miim->ignore_read_errors = ignore_read_errors; *pbus = bus;
@@ -291,7 +294,7 @@ static int mscc_miim_probe(struct platform_device *pdev)return dev_err_probe (dev,PTR_ERR (phy_regmap),"Unable to create phy register regmap\n" ); - ret =mscc_miim_setup (dev, &bus,"mscc_miim" , mii_regmap,0 ); + ret =mscc_miim_setup (dev, &bus,"mscc_miim" , mii_regmap,0 , false);if (ret <0 ) {dev_err (dev,"Unable to setup the MDIO bus\n" );return ret;
include/linux/mdio/mdio-mscc-miim.h +1 -1
@@ -14,6 +14,6 @@int mscc_miim_setup (struct device *device,struct mii_bus **bus,const char *name,struct regmap *mii_regmap, -int status_offset); +int status_offset,bool ignore_read_errors);#endif
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 99/211 net: dsa: felix: fix internal MDIO controller resource length
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 940af261321307cd1dd0fe8f9c34a6129f9d4bdc ]
The blamed commit did not properly convert the resource start/end format into the DEFINE_RES_MEM_NAMED() start/length format, resulting in a resource for vsc9959_imdio_res which is much longer than expected:
$ cat /proc/iomem
1f8000000-1f815ffff : pcie@1f0000000
1f8140000-1f815ffff : 0000:00:00.5
1f8148030-1f815006f : imdiovs (correct)
$ cat /proc/iomem
1f8000000-1f815ffff : pcie@1f0000000
1f8140000-1f815ffff : 0000:00:00.5
1f8148030-1f814803f : imdioLuckily it's not big enough to exceed the size of the parent resource (pci_resource_end(pdev, VSC9959_IMDIO_PCI_BAR)), and it doesn't overlap with anything else that the Linux driver uses currently, so the larger than expected size isn't a practical problem that I can see. Although it is clearly wrong in the /proc/iomem output.
--- drivers/net/dsa/ocelot/felix_vsc9959.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/ocelot/felix_vsc9959.c +1 -1
@@ -513,7 +513,7 @@ static const char * const vsc9959_resource_names[TARGET_MAX] = {* SGMII/QSGMII MAC PCS can be found. */ static const struct resource vsc9959_imdio_res = -DEFINE_RES_MEM_NAMED (0x8030 ,0x8040 ,"imdio" ); +DEFINE_RES_MEM_NAMED (0x8030 ,0x10 ,"imdio" );static const struct reg_field vsc9959_regfields[REGFIELD_MAX ] = { [ANA_ADVLEARN_VLAN_CHK ] =REG_FIELD (ANA_ADVLEARN ,6 ,6 ),
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 100/211 ARM: dts: aspeed: p10bmc: Update battery node name
In reply to Greg Kroah-HartmanFrom: Eddie James <[email protected]>
[ Upstream commit a8cef541dd5ef9445130660008c029205c4c5aa5 ]
The ADC sensor for the battery needs to be named "iio-hwmon" for compatibility with user space applications.
--- arch/arm/boot/dts/aspeed-bmc-ibm-bonnell.dts | 2 +- arch/arm/boot/dts/aspeed-bmc-ibm-everest.dts | 2 +- arch/arm/boot/dts/aspeed-bmc-ibm-rainier.dts | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
arch/arm/boot/dts/aspeed-bmc-ibm-bonnell.dts +1 -1
@@ -124,7 +124,7 @@ }; }; - iio-hwmon-battery { + iio-hwmon { compatible = "iio-hwmon"; io-channels = <&adc1 7>; };
arch/arm/boot/dts/aspeed-bmc-ibm-everest.dts +1 -1
@@ -244,7 +244,7 @@ }; }; - iio-hwmon-battery { + iio-hwmon { compatible = "iio-hwmon"; io-channels = <&adc1 7>; };
arch/arm/boot/dts/aspeed-bmc-ibm-rainier.dts +1 -1
@@ -220,7 +220,7 @@ }; }; - iio-hwmon-battery { + iio-hwmon { compatible = "iio-hwmon"; io-channels = <&adc1 7>; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 101/211 ARM: dts: spear320-hmi: correct STMPE GPIO compatible
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 33a0c1b850c8c85f400531dab3a0b022cdb164b1 ]
The compatible is st,stmpe-gpio.
--- arch/arm/boot/dts/spear320-hmi.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/spear320-hmi.dts +1 -1
@@ -241,7 +241,7 @@ irq-trigger = <0x1>; stmpegpio: stmpe-gpio { - compatible = "stmpe,gpio"; + compatible = "st,stmpe-gpio"; reg = <0>; gpio-controller; #gpio-cells = <2>;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 102/211 tcp: tcp_check_req() can be called from process context
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 580f98cc33a260bb8c6a39ae2921b29586b84fdf ]
This is a follow up of commit 0a375c822497 ("tcp: tcp_rtx_synack() can be called from process context").
Frederick Lawler reported another "__this_cpu_add() in preemptible" warning caused by the same reason.
In my former patch I took care of tcp_rtx_synack()
but forgot that tcp_check_req() also contained some SNMP updates.
Note that some parts of tcp_check_req() always run in BH context, I added a comment to clarify this.
--- net/ipv4/tcp_minisocks.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
net/ipv4/tcp_minisocks.c +5 -2
@@ -597,6 +597,9 @@ EXPORT_SYMBOL(tcp_create_openreq_child);* validation and inside tcp_v4_reqsk_send_ack(). Can we do better? * * We don't need to initialize tmp_opt.sack_ok as we don't use the results +* +* Note: If @fastopen is true, this can be called from process context. +* Otherwise, this is from BH context. */ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
@@ -748,7 +751,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb, &tcp_rsk(req)->last_oow_ack_time)) req->rsk_ops->send_ack (sk, skb, req);if (paws_reject) -__NET_INC_STATS (sock_net (sk),LINUX_MIB_PAWSESTABREJECTED ); +NET_INC_STATS (sock_net (sk),LINUX_MIB_PAWSESTABREJECTED );return NULL ; }
@@ -767,7 +770,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,* "fourth, check the SYN bit" */ if (flg & (TCP_FLAG_RST |TCP_FLAG_SYN )) { -__TCP_INC_STATS (sock_net (sk),TCP_MIB_ATTEMPTFAILS ); +TCP_INC_STATS (sock_net (sk),TCP_MIB_ATTEMPTFAILS ); goto embryonic_reset; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 103/211 vc_screen: modify vcs_size() handling in vcs_read()
In reply to Greg Kroah-HartmanFrom: George Kennedy <[email protected]>
[ Upstream commit 46d733d0efc79bc8430d63b57ab88011806d5180 ]
Restore the vcs_size() handling in vcs_read() to what it had been in previous version.
--- drivers/tty/vt/vc_screen.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/tty/vt/vc_screen.c +1 -3
@@ -415,10 +415,8 @@ vcs_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)*/ size =vcs_size (vc, attr, uni_mode);if (size <0 ) { -if (read) -break ; ret = size; - goto unlock_out; +break ; }if (pos >= size)break ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 104/211 spi: tegra210-quad: Fix iterator outside loop
In reply to Greg Kroah-HartmanFrom: Krishna Yarlagadda <[email protected]>
[ Upstream commit 2449d436681d40bc63ec2c766fd51b632270d8a7 ]
Fix warn: iterator used outside loop: 'xfer'. 'xfer' variable contain invalid value in few conditions. Complete transfer within DATA phase in successful case and at the end for failed transfer.
--- drivers/spi/spi-tegra210-quad.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/spi/spi-tegra210-quad.c +8 -4
@@ -1156,6 +1156,10 @@ static int tegra_qspi_combined_seq_xfer(struct tegra_qspi *tqspi, ret = -EIO ; goto exit; } +if (!xfer->cs_change) { +tegra_qspi_transfer_end (spi); +spi_transfer_delay_exec (xfer); + }break ;default : ret = -EINVAL ;
@@ -1164,14 +1168,14 @@ static int tegra_qspi_combined_seq_xfer(struct tegra_qspi *tqspi, msg->actual_length += xfer->len; transfer_phase++; } -if (!xfer->cs_change) { -tegra_qspi_transfer_end (spi); -spi_transfer_delay_exec (xfer); - } ret =0 ; exit: msg->status = ret; +if (ret <0 ) { +tegra_qspi_transfer_end (spi); +spi_transfer_delay_exec (xfer); + }return ret; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 105/211 rtc: sun6i: Always export the internal oscillator
In reply to Greg Kroah-HartmanFrom: Samuel Holland <[email protected]>
[ Upstream commit 344f4030f6c50a9db2d03021884c4bf36191b53a ]
On all variants of the hardware, the internal oscillator is one possible parent for the AR100 clock. It needs to be exported so we can model that relationship correctly in the devicetree.
--- drivers/rtc/rtc-sun6i.c | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-)
drivers/rtc/rtc-sun6i.c +4 -12
@@ -136,7 +136,6 @@ struct sun6i_rtc_clk_data { unsigned int fixed_prescaler : 16; unsigned int has_prescaler : 1; unsigned int has_out_clk : 1; - unsigned int export_iosc : 1; unsigned int has_losc_en : 1; unsigned int has_auto_swt : 1; };
@@ -271,10 +270,8 @@ static void __init sun6i_rtc_clk_init(struct device_node *node,/* Yes, I know, this is ugly. */ sun6i_rtc = rtc; -/* Only read IOSC name from device tree if it is exported */ -if (rtc->data->export_iosc) -of_property_read_string_index (node,"clock-output-names" ,2 , - &iosc_name); +of_property_read_string_index (node,"clock-output-names" ,2 , + &iosc_name); rtc->int_osc = clk_hw_register_fixed_rate_with_accuracy(NULL, iosc_name,
@@ -315,13 +312,10 @@ static void __init sun6i_rtc_clk_init(struct device_node *node, goto err_register; } - clk_data->num =2 ; + clk_data->num =3 ; clk_data->hws[0 ] = &rtc->hw; clk_data->hws[1 ] =__clk_get_hw (rtc->ext_losc); -if (rtc->data->export_iosc) { - clk_data->hws[2 ] = rtc->int_osc; - clk_data->num =3 ; - } + clk_data->hws[2 ] = rtc->int_osc;of_clk_add_hw_provider (node, of_clk_hw_onecell_get, clk_data);return ;
@@ -361,7 +355,6 @@ static const struct sun6i_rtc_clk_data sun8i_h3_rtc_data = { .fixed_prescaler = 32, .has_prescaler = 1, .has_out_clk = 1, - .export_iosc = 1, };static void __init sun8i_h3_rtc_clk_init (struct device_node *node)
@@ -379,7 +372,6 @@ static const struct sun6i_rtc_clk_data sun50i_h6_rtc_data = { .fixed_prescaler = 32, .has_prescaler = 1, .has_out_clk = 1, - .export_iosc = 1, .has_losc_en = 1, .has_auto_swt = 1, };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 106/211 genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask()
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit feabecaff5902f896531dde90646ca5dfa9d4f7d ]
If ipi_send_{mask|single}() is called with an invalid interrupt number, all the local variables there will be NULL. ipi_send_verify() which is invoked from these functions does verify its 'data' parameter, resulting in a kernel oops in irq_data_get_affinity_mask() as the passed NULL pointer gets dereferenced.
Add a missing NULL pointer check in ipi_send_verify()...
Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool.
--- kernel/irq/ipi.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
kernel/irq/ipi.c +6 -2
@@ -188,9 +188,9 @@ EXPORT_SYMBOL_GPL(ipi_get_hwirq);static int ipi_send_verify (struct irq_chip *chip,struct irq_data *data,const struct cpumask *dest,unsigned int cpu) { -const struct cpumask *ipimask =irq_data_get_affinity_mask (data); +const struct cpumask *ipimask; -if (!chip || !ipimask) +if (!chip || !data)return -EINVAL ;if (!chip->ipi_send_single && !chip->ipi_send_mask)
@@ -199,6 +199,10 @@ static int ipi_send_verify(struct irq_chip *chip, struct irq_data *data,if (cpu >= nr_cpu_ids)return -EINVAL ; + ipimask =irq_data_get_affinity_mask (data); +if (!ipimask) +return -EINVAL ; +if (dest) {if (!cpumask_subset (dest, ipimask))return -EINVAL ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 107/211 scsi: ipr: Work around fortify-string warning
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit ee4e7dfe4ffc9ca50c6875757bd119abfe22b5c5 ]
The ipr_log_vpd_compact() function triggers a fortified memcpy() warning about a potential string overflow with all versions of clang:
In file included from drivers/scsi/ipr.c:43:
In file included from include/linux/string.h:254:include/linux/fortify-string.h:520:4: error: call to '__write_overflow_field' declared with 'warning' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror,-Wattribute-warning]
__write_overflow_field(p_size_field, size);
^include/linux/fortify-string.h:520:4: error: call to '__write_overflow_field' declared with 'warning' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror,-Wattribute-warning] 2 errors generated.
I don't see anything actually wrong with the function, but this is the only instance I can reproduce of the fortification going wrong in the kernel at the moment, so the easiest solution may be to rewrite the function into something that does not trigger the warning.
Instead of having a combined buffer for vendor/device/serial strings, use three separate local variables and just truncate the whitespace individually.
--- drivers/scsi/ipr.c | 41 +++++++++++++++++++++-------------------- 1 file changed, 21 insertions(+), 20 deletions(-)
drivers/scsi/ipr.c +21 -20
@@ -1516,23 +1516,22 @@ static void ipr_process_ccn(struct ipr_cmnd *ipr_cmd) }/** -* strip_and_pad_whitespace - Strip and pad trailing whitespace. -* @i: index into buffer -* @buf: string to modify +* strip_whitespace - Strip and pad trailing whitespace. +* @i: size of buffer +* @buf: string to modify * -* This function will strip all trailing whitespace, pad the end -* of the string with a single space, and NULL terminate the string. +* This function will strip all trailing whitespace and +* NUL terminate the string. * -* Return value: -* new length of string **/ -static int strip_and_pad_whitespace (int i,char *buf) +static void strip_whitespace (int i,char *buf) { +if (i <1 ) +return ; + i--;while (i && buf[i] ==' ' ) i--; - buf[i+1 ] =' ' ; - buf[i+2 ] ='\0' ; -return i +2 ; + buf[i+1 ] ='\0' ; }/**
@@ -1547,19 +1546,21 @@ static int strip_and_pad_whitespace(int i, char *buf)static void ipr_log_vpd_compact (char *prefix,struct ipr_hostrcb *hostrcb,struct ipr_vpd *vpd) { -char buffer[IPR_VENDOR_ID_LEN +IPR_PROD_ID_LEN +IPR_SERIAL_NUM_LEN +3 ]; -int i =0 ; +char vendor_id[IPR_VENDOR_ID_LEN +1 ]; +char product_id[IPR_PROD_ID_LEN +1 ]; +char sn[IPR_SERIAL_NUM_LEN +1 ]; -memcpy (buffer, vpd->vpids.vendor_id,IPR_VENDOR_ID_LEN ); - i =strip_and_pad_whitespace (IPR_VENDOR_ID_LEN -1 , buffer); +memcpy (vendor_id, vpd->vpids.vendor_id,IPR_VENDOR_ID_LEN ); +strip_whitespace (IPR_VENDOR_ID_LEN , vendor_id); -memcpy (&buffer[i], vpd->vpids.product_id,IPR_PROD_ID_LEN ); - i =strip_and_pad_whitespace (i +IPR_PROD_ID_LEN -1 , buffer); +memcpy (product_id, vpd->vpids.product_id,IPR_PROD_ID_LEN ); +strip_whitespace (IPR_PROD_ID_LEN , product_id); -memcpy (&buffer[i], vpd->sn,IPR_SERIAL_NUM_LEN ); - buffer[IPR_SERIAL_NUM_LEN + i] ='\0' ; +memcpy (sn, vpd->sn,IPR_SERIAL_NUM_LEN ); +strip_whitespace (IPR_SERIAL_NUM_LEN , sn); -ipr_hcam_err (hostrcb,"%s VPID/SN: %s\n" , prefix, buffer); +ipr_hcam_err (hostrcb,"%s VPID/SN: %s %s %s\n" , prefix, + vendor_id, product_id, sn); }/**
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 108/211 scsi: mpi3mr: Fix an issue found by KASAN
In reply to Greg Kroah-HartmanFrom: Tomas Henzl <[email protected]>
[ Upstream commit ae7d45f5283d30274039b95d3e6d53d33c66e991 ]
Write only correct size (32 instead of 64 bytes).
--- drivers/scsi/mpi3mr/mpi3mr_transport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/mpi3mr/mpi3mr_transport.c +1 -1
@@ -1280,7 +1280,7 @@ void mpi3mr_sas_host_add(struct mpi3mr_ioc *mrioc)if (mrioc->sas_hba.enclosure_handle) {if (!(mpi3mr_cfg_get_enclosure_pg0 (mrioc, &ioc_status, - &encl_pg0,sizeof (dev_pg0), + &encl_pg0,sizeof (encl_pg0),MPI3_ENCLOS_PGAD_FORM_HANDLE , mrioc->sas_hba.enclosure_handle)) && (ioc_status ==MPI3_IOCSTATUS_SUCCESS ))
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 109/211 scsi: mpi3mr: Use number of bits to manage bitmap sizes
In reply to Greg Kroah-HartmanFrom: Shin'ichiro Kawasaki <[email protected]>
[ Upstream commit 339e61565f81a6534afdc18fd854b2e2628bf5db ]
To allocate bitmaps, the mpi3mr driver calculates sizes of bitmaps using byte as unit. However, bitmap helper functions assume that bitmaps are allocated using unsigned long as unit. This gap causes memory access beyond the bitmap sizes and results in "BUG: KASAN: slab-out-of-bounds". The BUG was observed at firmware download to eHBA-9600. Call trace indicated that the out-of-bounds access happened in find_first_zero_bit() called from mpi3mr_send_event_ack() for miroc->evtack_cmds_bitmap.
To fix the BUG, do not use bytes to manage bitmap sizes. Instead, use number of bits, and call bitmap helper functions which take number of bits as arguments. For memory allocation, call bitmap_zalloc() instead of kzalloc() and krealloc(). For memory free, call bitmap_free() instead of kfree(). For zero clear, call bitmap_clear() instead of memset().
Remove three fields for bitmap byte sizes in struct scmd_priv which are no longer required. Replace the field dev_handle_bitmap_sz with dev_handle_bitmap_bits to keep number of bits of removepend_bitmap across resize.
--- drivers/scsi/mpi3mr/mpi3mr.h | 10 +---- drivers/scsi/mpi3mr/mpi3mr_fw.c | 75 ++++++++++++++------------------- 2 files changed, 33 insertions(+), 52 deletions(-)
drivers/scsi/mpi3mr/mpi3mr.h +2 -8
@@ -955,19 +955,16 @@ struct scmd_priv {* @chain_buf_count: Chain buffer count * @chain_buf_pool: Chain buffer pool * @chain_sgl_list: Chain SGL list -* @chain_bitmap_sz: Chain buffer allocator bitmap size * @chain_bitmap: Chain buffer allocator bitmap * @chain_buf_lock: Chain buffer list lock * @bsg_cmds: Command tracker for BSG command * @host_tm_cmds: Command tracker for task management commands * @dev_rmhs_cmds: Command tracker for device removal commands * @evtack_cmds: Command tracker for event ack commands -* @devrem_bitmap_sz: Device removal bitmap size * @devrem_bitmap: Device removal bitmap -* @dev_handle_bitmap_sz: Device handle bitmap size +* @dev_handle_bitmap_bits: Number of bits in device handle bitmap * @removepend_bitmap: Remove pending bitmap * @delayed_rmhs_list: Delayed device removal list -* @evtack_cmds_bitmap_sz: Event Ack bitmap size * @evtack_cmds_bitmap: Event Ack bitmap * @delayed_evtack_cmds_list: Delayed event acknowledgment list * @ts_update_counter: Timestamp update counter
@@ -1128,7 +1125,6 @@ struct mpi3mr_ioc {u32 chain_buf_count;struct dma_pool *chain_buf_pool;struct chain_element *chain_sgl_list; -u16 chain_bitmap_sz;void *chain_bitmap;spinlock_t chain_buf_lock;
@@ -1136,12 +1132,10 @@ struct mpi3mr_ioc {struct mpi3mr_drv_cmd host_tm_cmds;struct mpi3mr_drv_cmd dev_rmhs_cmds[MPI3MR_NUM_DEVRMCMD ];struct mpi3mr_drv_cmd evtack_cmds[MPI3MR_NUM_EVTACKCMD ]; -u16 devrem_bitmap_sz;void *devrem_bitmap; -u16 dev_handle_bitmap_sz; +u16 dev_handle_bitmap_bits;void *removepend_bitmap;struct list_head delayed_rmhs_list; -u16 evtack_cmds_bitmap_sz;void *evtack_cmds_bitmap;struct list_head delayed_evtack_cmds_list;
drivers/scsi/mpi3mr/mpi3mr_fw.c +31 -44
135 lines not on this page · raw message
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 110/211 rtc: allow rtc_read_alarm without read_alarm callback
In reply to Greg Kroah-HartmanFrom: Alexandre Belloni <[email protected]>
[ Upstream commit a783c962619271a8b905efad1d89adfec11ae0c8 ]
.read_alarm is not necessary to read the current alarm because it is recorded in the aie_timer and so rtc_read_alarm() will never call rtc_read_alarm_internal() which is the only function calling the callback.
--- drivers/rtc/interface.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/rtc/interface.c +1 -1
@@ -392,7 +392,7 @@ int rtc_read_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm)return err;if (!rtc->ops) { err = -ENODEV ; - }else if (!test_bit (RTC_FEATURE_ALARM , rtc->features) || !rtc->ops->read_alarm) { + }else if (!test_bit (RTC_FEATURE_ALARM , rtc->features)) { err = -EINVAL ; }else {memset (alarm,0 ,sizeof (struct rtc_wkalrm ));
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 111/211 io_uring: fix size calculation when registering buf ring
In reply to Greg Kroah-HartmanFrom: Wojciech Lukowicz <[email protected]>
[ Upstream commit 48ba08374e779421ca34bd14b4834aae19fc3e6a ]
Using struct_size() to calculate the size of io_uring_buf_ring will sum the size of the struct and of the bufs array. However, the struct's fields are overlaid with the array making the calculated size larger than it should be.
When registering a ring with N * PAGE_SIZE / sizeof(struct io_uring_buf) entries, i.e. with fully filled pages, the calculated size will span one more page than it should and io_uring will try to pin the following page. Depending on how the application allocated the ring, it might succeed using an unrelated page or fail returning EFAULT.
The size of the ring should be the product of ring_entries and the size of io_uring_buf, i.e. the size of the bufs array only.
--- io_uring/kbuf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
io_uring/kbuf.c +1 -1
@@ -505,7 +505,7 @@ int io_register_pbuf_ring(struct io_ring_ctx *ctx, void __user *arg) } pages =io_pin_pages (reg.ring_addr, -struct_size (br, bufs, reg.ring_entries), +flex_array_size (br, bufs, reg.ring_entries), &nr_pages);if (IS_ERR (pages)) {kfree (free_bl);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 112/211 loop: loop_set_status_from_info() check before assignment
In reply to Greg Kroah-HartmanFrom: Zhong Jinghua <[email protected]>
[ Upstream commit 9f6ad5d533d1c71e51bdd06a5712c4fbc8768dfa ]
In loop_set_status_from_info(), lo->lo_offset and lo->lo_sizelimit should be checked before reassignment, because if an overflow error occurs, the original correct value will be changed to the wrong value, and it will not be changed back.
More, the original patch did not solve the problem, the value was set and ioctl returned an error, but the subsequent io used the value in the loop driver, which still caused an alarm:
loop_handle_cmd
do_req_filebacked
loff_t pos = ((loff_t) blk_rq_pos(rq) << 9) + lo->lo_offset; lo_rw_aio
cmd->iocb.ki_pos = pos
--- drivers/block/loop.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/block/loop.c +4 -4
@@ -977,13 +977,13 @@ loop_set_status_from_info(struct loop_device *lo,return -EINVAL ; } +/* Avoid assigning overflow values */ +if (info->lo_offset >LLONG_MAX || info->lo_sizelimit >LLONG_MAX ) +return -EOVERFLOW ; + lo->lo_offset = info->lo_offset; lo->lo_sizelimit = info->lo_sizelimit; -/* loff_t vars have been assigned __u64 */ -if (lo->lo_offset <0 || lo->lo_sizelimit <0 ) -return -EOVERFLOW ; -memcpy (lo->lo_file_name, info->lo_file_name,LO_NAME_SIZE ); lo->lo_file_name[LO_NAME_SIZE -1 ] =0 ; lo->lo_flags = info->lo_flags;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 113/211 ASoC: adau7118: dont disable regulators on device unbind
In reply to Greg Kroah-HartmanFrom: Nuno Sá <[email protected]>
[ Upstream commit b5bfa7277ee7d944421e0ef193586c6e34d7492c ]
The regulators are supposed to be controlled through the set_bias_level() component callback. Moreover, the regulators are not enabled during probe and so, this would lead to a regulator unbalanced use count.
--- sound/soc/codecs/adau7118.c | 19 +------------------ 1 file changed, 1 insertion(+), 18 deletions(-)
sound/soc/codecs/adau7118.c +1 -18
@@ -444,22 +444,6 @@ static const struct snd_soc_component_driver adau7118_component_driver = { .endianness = 1, }; -static void adau7118_regulator_disable (void *data) -{ -struct adau7118_data *st = data; -int ret; -/* -* If we fail to disable DVDD, don't bother in trying IOVDD. We -* actually don't want to be left in the situation where DVDD -* is enabled and IOVDD is disabled. -*/ - ret =regulator_disable (st->dvdd); -if (ret) -return ; - -regulator_disable (st->iovdd); -} -static int adau7118_regulator_setup (struct adau7118_data *st) { st->iovdd =devm_regulator_get (st->dev,"iovdd" );
@@ -481,8 +465,7 @@ static int adau7118_regulator_setup(struct adau7118_data *st)regcache_cache_only (st->map, true); } -return devm_add_action_or_reset (st->dev, adau7118_regulator_disable, - st); +return 0 ; }static int adau7118_parset_dt (const struct adau7118_data *st)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 114/211 ASoC: apple: mca: Fix final status read on SERDES reset
In reply to Greg Kroah-HartmanFrom: Martin Povišer <[email protected]>
[ Upstream commit aaf5f0d76b6e1870e3674408de2b13a92a4d4059 ]
Quoted 1 line
From within the early trigger we are doing a reset of the SERDES unit,
but the final status read is on a bad address. Add the missing SERDES unit offset in calculation of the address.
--- sound/soc/apple/mca.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/apple/mca.c +1 -1
@@ -210,7 +210,7 @@ static void mca_fe_early_trigger(struct snd_pcm_substream *substream, int cmd, SERDES_CONF_SOME_RST);readl_relaxed (cl->base + serdes_conf);mca_modify (cl, serdes_conf,SERDES_STATUS_RST ,0 ); -WARN_ON (readl_relaxed (cl->base +REG_SERDES_STATUS ) & +WARN_ON (readl_relaxed (cl->base + serdes_unit +REG_SERDES_STATUS ) &SERDES_STATUS_RST );break ;default :
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 115/211 ASoC: apple: mca: Fix SERDES reset sequence
In reply to Greg Kroah-HartmanFrom: Martin Povišer <[email protected]>
[ Upstream commit d8b3e396088d787771f19fd3b7949e080dc31d6f ]
Fix the reset sequence of reads and writes that we invoke from within the early trigger. It looks like there never was a SERDES_CONF_SOME_RST bit that should be involved in the reset sequence, and its presence in the driver code is a mistake from earlier.
Instead, the reset sequence should go as follows: We should switch the the SERDES unit's SYNC_SEL mux to the value of 7 (so outside the range of 1...6 representing cluster's SYNCGEN units), then raise the RST bit in SERDES_STATUS and wait for it to clear.
Properly resetting the SERDES unit fixes frame desynchronization hazard in case of long frames (longer than 4 used slots). The desynchronization manifests itself by rotating the PCM channels.
--- sound/soc/apple/mca.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
sound/soc/apple/mca.c +13 -5
@@ -101,7 +101,6 @@#define SERDES_CONF_UNK3 BIT(14)#define SERDES_CONF_NO_DATA_FEEDBACK BIT(15)#define SERDES_CONF_SYNC_SEL GENMASK(18, 16) -#define SERDES_CONF_SOME_RST BIT(19)#define REG_TX_SERDES_BITSTART 0x08#define REG_RX_SERDES_BITSTART 0x0c#define REG_TX_SERDES_SLOTMASK 0x0c
@@ -203,15 +202,24 @@ static void mca_fe_early_trigger(struct snd_pcm_substream *substream, int cmd,case SNDRV_PCM_TRIGGER_START :case SNDRV_PCM_TRIGGER_RESUME :case SNDRV_PCM_TRIGGER_PAUSE_RELEASE : +mca_modify (cl, serdes_conf,SERDES_CONF_SYNC_SEL , +FIELD_PREP (SERDES_CONF_SYNC_SEL ,0 )); +mca_modify (cl, serdes_conf,SERDES_CONF_SYNC_SEL , +FIELD_PREP (SERDES_CONF_SYNC_SEL ,7 ));mca_modify (cl, serdes_unit +REG_SERDES_STATUS ,SERDES_STATUS_EN |SERDES_STATUS_RST ,SERDES_STATUS_RST ); -mca_modify (cl, serdes_conf,SERDES_CONF_SOME_RST , -SERDES_CONF_SOME_RST ); -readl_relaxed (cl->base + serdes_conf); -mca_modify (cl, serdes_conf,SERDES_STATUS_RST ,0 ); +/* +* Experiments suggest that it takes at most ~1 us +* for the bit to clear, so wait 2 us for good measure. +*/ +udelay (2 );WARN_ON (readl_relaxed (cl->base + serdes_unit +REG_SERDES_STATUS ) &SERDES_STATUS_RST ); +mca_modify (cl, serdes_conf,SERDES_CONF_SYNC_SEL , +FIELD_PREP (SERDES_CONF_SYNC_SEL ,0 )); +mca_modify (cl, serdes_conf,SERDES_CONF_SYNC_SEL , +FIELD_PREP (SERDES_CONF_SYNC_SEL , cl->no +1 ));break ;default :break ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 116/211 ASoC: apple: mca: Improve handling of unavailable DMA channels
In reply to Greg Kroah-HartmanFrom: Martin Povišer <[email protected]>
[ Upstream commit fb1847cc460c127b12720119eae5f438ffc62e85 ]
When we fail to obtain a DMA channel, don't return a blanket -EINVAL, instead return the original error code if there's one. This makes deferring work as it should. Also don't print an error message for -EPROBE_DEFER.
--- sound/soc/apple/mca.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
sound/soc/apple/mca.c +9 -2
@@ -950,10 +950,17 @@ static int mca_pcm_new(struct snd_soc_component *component, chan =mca_request_dma_channel (cl, i);if (IS_ERR_OR_NULL (chan)) { +mca_pcm_free (component, rtd->pcm); + +if (chan &&PTR_ERR (chan) == -EPROBE_DEFER ) +return PTR_ERR (chan); +dev_err (component->dev,"unable to obtain DMA channel (stream %d cluster %d): %pe\n" , i, cl->no, chan); -mca_pcm_free (component, rtd->pcm); -return -EINVAL ; + +if (!chan) +return -EINVAL ; +return PTR_ERR (chan); } cl->dma_chans[i] = chan;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 117/211 nvme: bring back auto-removal of deleted namespaces during sequential scan
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 0dd6fff2aad4e35633fef1ea72838bec5b47559a ]
Bring back the check of the Identify Namespace return value for the legacy NVMe 1.0-style sequential scanning. While NVMe 1.0 does not support namespace management, there are "modern" cloud solutions like Google Cloud Platform that claim the obsolete 1.0 compliance for no good reason while supporting proprietary sideband namespace management.
--- drivers/nvme/host/core.c | 35 ++++++++++++++++++----------------- 1 file changed, 18 insertions(+), 17 deletions(-)
drivers/nvme/host/core.c +18 -17
@@ -38,6 +38,7 @@ struct nvme_ns_info {bool is_shared;bool is_readonly;bool is_ready; +bool is_removed; };unsigned int admin_timeout =60 ;
@@ -1445,16 +1446,8 @@ static int nvme_identify_ns(struct nvme_ctrl *ctrl, unsigned nsid, error =nvme_submit_sync_cmd (ctrl->admin_q, &c, *id,sizeof (**id));if (error) {dev_warn (ctrl->device,"Identify namespace failed (%d)\n" , error); - goto out_free_id; +kfree (*id); } - - error =NVME_SC_INVALID_NS |NVME_SC_DNR ; -if ((*id)->ncap ==0 )/* namespace not allocated or attached */ - goto out_free_id; -return 0 ; - -out_free_id: -kfree (*id);return error; }
@@ -1468,6 +1461,13 @@ static int nvme_ns_info_from_identify(struct nvme_ctrl *ctrl, ret =nvme_identify_ns (ctrl, info->nsid, &id);if (ret)return ret; + +if (id->ncap ==0 ) { +/* namespace not allocated or attached */ + info->is_removed = true; +return -ENODEV ; + } + info->anagrpid = id->anagrpid; info->is_shared = id->nmic &NVME_NS_NMIC_SHARED ; info->is_readonly = id->nsattr &NVME_NS_ATTR_RO ;
@@ -4418,6 +4418,7 @@ static void nvme_scan_ns(struct nvme_ctrl *ctrl, unsigned nsid) {struct nvme_ns_info info = { .nsid = nsid };struct nvme_ns *ns; +int ret;if (nvme_identify_ns_descs (ctrl, &info))return ;
@@ -4434,19 +4435,19 @@ static void nvme_scan_ns(struct nvme_ctrl *ctrl, unsigned nsid)* set up a namespace. If not fall back to the legacy version. */ if ((ctrl->cap &NVME_CAP_CRMS_CRIMS ) || - (info.ids.csi !=NVME_CSI_NVM && info.ids.csi !=NVME_CSI_ZNS )) { -if (nvme_ns_info_from_id_cs_indep (ctrl, &info)) -return ; - }else { -if (nvme_ns_info_from_identify (ctrl, &info)) -return ; - } + (info.ids.csi !=NVME_CSI_NVM && info.ids.csi !=NVME_CSI_ZNS )) + ret =nvme_ns_info_from_id_cs_indep (ctrl, &info); +else + ret =nvme_ns_info_from_identify (ctrl, &info); + +if (info.is_removed) +nvme_ns_remove_by_nsid (ctrl, nsid);/* * Ignore the namespace if it is not ready. We will get an AEN once it * becomes ready and restart the scan. */ -if (!info.is_ready) +if (ret || !info.is_ready)return ; ns =nvme_find_get_ns (ctrl, nsid);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 118/211 nvme-tcp: dont access released socket during error recovery
In reply to Greg Kroah-HartmanFrom: Akinobu Mita <[email protected]>
[ Upstream commit 76d54bf20cdcc1ed7569a89885e09636e9a8d71d ]
While the error recovery work is temporarily failing reconnect attempts, running the 'nvme list' command causes a kernel NULL pointer dereference by calling getsockname() with a released socket.
During error recovery work, the nvme tcp socket is released and a new one created, so it is not safe to access the socket without proper check.
--- drivers/nvme/host/tcp.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/nvme/host/tcp.c +6 -0
@@ -2486,6 +2486,10 @@ static int nvme_tcp_get_address(struct nvme_ctrl *ctrl, char *buf, int size) len =nvmf_get_address (ctrl, buf, size); +mutex_lock (&queue->queue_lock); + +if (!test_bit (NVME_TCP_Q_LIVE , &queue->flags)) + goto done; ret =kernel_getsockname (queue->sock, (struct sockaddr *)&src_addr);if (ret >0 ) {if (len >0 )
@@ -2493,6 +2497,8 @@ static int nvme_tcp_get_address(struct nvme_ctrl *ctrl, char *buf, int size) len +=scnprintf (buf + len, size - len,"%ssrc_addr=%pISc\n" , (len) ?"," :"" , &src_addr); } +done: +mutex_unlock (&queue->queue_lock);return len; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 119/211 nvme-fabrics: show well known discovery name
In reply to Greg Kroah-HartmanFrom: Daniel Wagner <[email protected]>
[ Upstream commit 26a57cb35548ae67c14871cccbf50da3edb01ea4 ]
The kernel always logs the unique subsystem name for a discovery controller, even in the case user space asked for the well known.
This has lead to confusion as the logs of nvme-cli and the kernel logs didn't match.
First, nvme-cli connects to the well known discovery controller to figure out if it supports TP8013. If so then nvme-cli disconnects and connects to the unique discovery controller. Currently, the kernel show that user space connected twice to the unique one.
To avoid further confusion, show the well known discovery controller if user space asked for it:
$ nvme connect-all -v -t tcp -a 192.168.0.1 nvme0: nqn.2014-08.org.nvmexpress.discovery connected nvme0: nqn.2014-08.org.nvmexpress.discovery disconnected nvme0: nqn.discovery connected
kernel log:
nvme nvme0: new ctrl: NQN "nqn.2014-08.org.nvmexpress.discovery", addr 192.168.0.1:8009 nvme nvme0: Removing ctrl: NQN "nqn.2014-08.org.nvmexpress.discovery" nvme nvme0: new ctrl: NQN "nqn.discovery", addr 192.168.0.1:8009
--- drivers/nvme/host/fabrics.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/nvme/host/fabrics.h +2 -1
@@ -189,7 +189,8 @@ nvmf_ctlr_matches_baseopts(struct nvme_ctrl *ctrl,static inline char *nvmf_ctrl_subsysnqn (struct nvme_ctrl *ctrl) { -if (!ctrl->subsys) +if (!ctrl->subsys || + !strcmp (ctrl->opts->subsysnqn,NVME_DISC_SUBSYS_NAME ))return ctrl->opts->subsysnqn;return ctrl->subsys->subnqn; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 120/211 ASoC: zl38060 add gpiolib dependency
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 0de2cc3707b6b6e2ad40bd24ce09a5c1f65d01e1 ]
Without gpiolib, this driver fails to link:
arm-linux-gnueabi-ld: sound/soc/codecs/zl38060.o: in function `chip_gpio_get':
zl38060.c:(.text+0x30): undefined reference to `gpiochip_get_data'
arm-linux-gnueabi-ld: sound/soc/codecs/zl38060.o: in function `zl38_spi_probe':
zl38060.c:(.text+0xa18): undefined reference to `devm_gpiochip_add_data_with_key'
This appears to have been in the driver since the start, but is hard to hit in randconfig testing since gpiolib is almost always selected by something else.
--- sound/soc/codecs/Kconfig | 1 + 1 file changed, 1 insertion(+)
sound/soc/codecs/Kconfig +1 -0
@@ -2045,6 +2045,7 @@ config SND_SOC_WSA883X config SND_SOC_ZL38060 tristate "Microsemi ZL38060 Connected Home Audio Processor" depends on SPI_MASTER + depends on GPIOLIB select REGMAP help Support for ZL38060 Connected Home Audio Processor from Microsemi,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 121/211 ASoC: mediatek: mt8195: add missing initialization
In reply to Greg Kroah-HartmanFrom: Trevor Wu <[email protected]>
[ Upstream commit b56ec2992a2e43bc3e60d6db86849d31640e791f ]
In etdm dai driver, dai_etdm_parse_of() function is used to parse dts properties to get parameters. There are two for-loops which are sepearately for all etdm and etdm input only cases. In etdm in only loop, dai_id is not initialized, so it keeps the value intiliazed in another loop.
In the patch, add the missing initialization to fix the unexpected parsing problem.
--- sound/soc/mediatek/mt8195/mt8195-dai-etdm.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/mediatek/mt8195/mt8195-dai-etdm.c +3 -0
@@ -2567,6 +2567,9 @@ static void mt8195_dai_etdm_parse_of(struct mtk_base_afe *afe)/* etdm in only */ for (i =0 ; i <2 ; i++) { + dai_id =ETDM_TO_DAI_ID (i); + etdm_data = afe_priv->dai_priv[dai_id]; + ret =snprintf (prop,sizeof (prop),"mediatek,%s-chn-disabled" , of_afe_etdms[i].name);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 122/211 thermal: intel: quark_dts: fix error pointer dereference
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit f1b930e740811d416de4d2074da48b6633a672c8 ]
If alloc_soc_dts() fails, then we can just return. Trying to free "soc_dts" will lead to an Oops.
--- drivers/thermal/intel/intel_quark_dts_thermal.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-)
drivers/thermal/intel/intel_quark_dts_thermal.c +2 -10
@@ -415,22 +415,14 @@ MODULE_DEVICE_TABLE(x86cpu, qrk_thermal_ids);static int __init intel_quark_thermal_init (void ) { -int err =0 ; -if (!x86_match_cpu (qrk_thermal_ids) || !iosf_mbi_available ())return -ENODEV ; soc_dts =alloc_soc_dts (); -if (IS_ERR (soc_dts)) { - err =PTR_ERR (soc_dts); - goto err_free; - } +if (IS_ERR (soc_dts)) +return PTR_ERR (soc_dts);return 0 ; - -err_free: -free_soc_dts (soc_dts); -return err; } static void __exit intel_quark_thermal_exit(void)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 123/211 thermal: intel: BXT_PMIC: select REGMAP instead of depending on it
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 1467fb960349dfa5e300658f1a409dde2cfb0c51 ]
REGMAP is a hidden (not user visible) symbol. Users cannot set it directly thru "make *config", so drivers should select it instead of depending on it if they need it.
Consistently using "select" or "depends on" can also help reduce Kconfig circular dependency issues.
Therefore, change the use of "depends on REGMAP" to "select REGMAP".
--- drivers/thermal/intel/Kconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/thermal/intel/Kconfig +2 -1
@@ -64,7 +64,8 @@ endmenu config INTEL_BXT_PMIC_THERMAL tristate "Intel Broxton PMIC thermal driver" - depends on X86 && INTEL_SOC_PMIC_BXTWC && REGMAP + depends on X86 && INTEL_SOC_PMIC_BXTWC + select REGMAP help Select this driver for Intel Broxton PMIC with ADC channels monitoring system temperature measurements and alerts.
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 124/211 cpufreq: apple-soc: Fix an IS_ERR() vs NULL check
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit f43523620f646c89ffd8ada840a0068290e51266 ]
The of_iomap() function returns NULL if it fails. It never returns error pointers. Fix the check accordingly.
--- drivers/cpufreq/apple-soc-cpufreq.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/cpufreq/apple-soc-cpufreq.c +2 -2
@@ -189,8 +189,8 @@ static int apple_soc_cpufreq_find_cluster(struct cpufreq_policy *policy, *info = match->data; *reg_base =of_iomap (args.np,0 ); -if (IS_ERR (*reg_base)) -return PTR_ERR (*reg_base); +if (!*reg_base) +return -ENOMEM ;return 0 ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 125/211 tracing: Add NULL checks for buffer in ring_buffer_free_read_page()
In reply to Greg Kroah-HartmanFrom: Jia-Ju Bai <[email protected]>
[ Upstream commit 3e4272b9954094907f16861199728f14002fcaf6 ]
In a previous commit 7433632c9ff6, buffer, buffer->buffers and buffer->buffers[cpu] in ring_buffer_wake_waiters() can be NULL, and thus the related checks are added.
However, in the same call stack, these variables are also used in ring_buffer_free_read_page():
tracing_buffers_release()
ring_buffer_wake_waiters(iter->array_buffer->buffer)
cpu_buffer = buffer->buffers[cpu] -> Add checks by previous commit
ring_buffer_free_read_page(iter->array_buffer->buffer)
cpu_buffer = buffer->buffers[cpu] -> No checkThus, to avod possible null-pointer derefernces, the related checks should be added.
These results are reported by a static tool designed by myself.
--- kernel/trace/ring_buffer.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
kernel/trace/ring_buffer.c +6 -1
@@ -5604,11 +5604,16 @@ EXPORT_SYMBOL_GPL(ring_buffer_alloc_read_page);*/ void ring_buffer_free_read_page (struct trace_buffer *buffer,int cpu,void *data) { -struct ring_buffer_per_cpu *cpu_buffer = buffer->buffers[cpu]; +struct ring_buffer_per_cpu *cpu_buffer;struct buffer_data_page *bpage = data;struct page *page =virt_to_page (bpage);unsigned long flags; +if (!buffer || !buffer->buffers || !buffer->buffers[cpu]) +return ; + + cpu_buffer = buffer->buffers[cpu]; +/* If the page is still in use someplace else, we can't reuse it */ if (page_ref_count (page) >1 ) goto out;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 126/211 kernel/printk/index.c: fix memory leak with using debugfs_lookup()
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
[ Upstream commit 55bf243c514553e907efcf2bda92ba090eca8c64 ]
When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once.
--- kernel/printk/index.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/printk/index.c +1 -1
@@ -145,7 +145,7 @@ static void pi_create_file(struct module *mod)#ifdef CONFIG_MODULES static void pi_remove_file (struct module *mod) { -debugfs_remove (debugfs_lookup (pi_get_module_name (mod), dfs_index)); +debugfs_lookup_and_remove (pi_get_module_name (mod), dfs_index); } static int pi_module_notify(struct notifier_block *nb, unsigned long op,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 127/211 firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3
In reply to Greg Kroah-HartmanFrom: Darrell Kavanagh <[email protected]>
[ Upstream commit e1d447157f232c650e6f32c9fb89ff3d0207c69a ]
Another Lenovo convertable which reports a landscape resolution of 1920x1200 with a pitch of (1920 * 4) bytes, while the actual framebuffer has a resolution of 1200x1920 with a pitch of (1200 * 4) bytes.
--- drivers/firmware/efi/sysfb_efi.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/firmware/efi/sysfb_efi.c +8 -0
@@ -264,6 +264,14 @@ static const struct dmi_system_id efifb_dmi_swap_width_height[] __initconst = { "Lenovo ideapad D330-10IGM"), }, }, + { + /* Lenovo IdeaPad Duet 3 10IGL5 with 1200x1920 portrait screen */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"), + DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, + "IdeaPad Duet 3 10IGL5"), + }, + }, {}, };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 128/211 bootconfig: Increase max nodes of bootconfig from 1024 to 8192 for DCC support
In reply to Greg Kroah-HartmanFrom: Souradeep Chowdhury <[email protected]>
[ Upstream commit 6c40624930c58529185a257380442547580ed837 ]
The Data Capture and Compare(DCC) is a debugging tool that uses the bootconfig for configuring the register values during boot-time. Increase the max nodes supported by bootconfig to cater to the requirements of the Data Capture and Compare Driver.
--- include/linux/bootconfig.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/bootconfig.h +1 -1
@@ -59,7 +59,7 @@ struct xbc_node {/* Maximum size of boot config is 32KB - 1 */ #define XBC_DATA_MAX (XBC_VALUE - 1) -#define XBC_NODE_MAX 1024 +#define XBC_NODE_MAX 8192#define XBC_KEYLEN_MAX 256#define XBC_DEPTH_MAX 16
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 129/211 mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 4414a7ab80cebf715045e3c4d465feefbad21139 ]
In arizona_clk32k_enable(), we should use pm_runtime_resume_and_get() as pm_runtime_get_sync() will increase the refcnt even when it returns an error.
--- drivers/mfd/arizona-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mfd/arizona-core.c +1 -1
@@ -45,7 +45,7 @@ int arizona_clk32k_enable(struct arizona *arizona)if (arizona->clk32k_ref ==1 ) {switch (arizona->pdata.clk32k_src) {case ARIZONA_32KZ_MCLK1 : - ret =pm_runtime_get_sync (arizona->dev); + ret =pm_runtime_resume_and_get (arizona->dev);if (ret !=0 ) goto err_ref; ret =clk_prepare_enable (arizona->mclk[ARIZONA_MCLK1 ]);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 130/211 IB/hfi1: Update RMT size calculation
In reply to Greg Kroah-HartmanFrom: Dean Luick <[email protected]>
[ Upstream commit 892ede5a77f337831609fb9c248ac60948061894 ]
Fix possible RMT overflow: Use the correct netdev size. Don't allow adjusted user contexts to go negative.
Fix QOS calculation: Send kernel context count as an argument since dd->n_krcv_queues is not yet set up in earliest call. Do not include the control context in the QOS calculation. Use the same sized variable to find the max of krcvq[] entries.
Update the RMT count explanation to make more sense.
--- drivers/infiniband/hw/hfi1/chip.c | 59 +++++++++++++++++-------------- 1 file changed, 32 insertions(+), 27 deletions(-)
drivers/infiniband/hw/hfi1/chip.c +32 -27
@@ -1056,7 +1056,7 @@ static void read_link_down_reason(struct hfi1_devdata *dd, u8 *ldr);static void handle_temp_err (struct hfi1_devdata *dd);static void dc_shutdown (struct hfi1_devdata *dd);static void dc_start (struct hfi1_devdata *dd); -static int qos_rmt_entries (struct hfi1_devdata *dd,unsigned int *mp, +static int qos_rmt_entries (unsigned int n_krcv_queues,unsigned int *mp,unsigned int *np);static void clear_full_mgmt_pkey (struct hfi1_pportdata *ppd);static int wait_link_transfer_active (struct hfi1_devdata *dd,int wait_ms);
@@ -13362,7 +13362,6 @@ static int set_up_context_variables(struct hfi1_devdata *dd)int ret;unsigned ngroups;int rmt_count; -int user_rmt_reduced;u32 n_usr_ctxts;u32 send_contexts =chip_send_contexts (dd);u32 rcv_contexts =chip_rcv_contexts (dd);
@@ -13421,28 +13420,34 @@ static int set_up_context_variables(struct hfi1_devdata *dd) (num_kernel_contexts + n_usr_ctxts), &node_affinity.real_cpu_mask);/* -* The RMT entries are currently allocated as shown below: -* 1. QOS (0 to 128 entries); -* 2. FECN (num_kernel_context - 1 + num_user_contexts + -* num_netdev_contexts); -* 3. netdev (num_netdev_contexts). -* It should be noted that FECN oversubscribe num_netdev_contexts -* entries of RMT because both netdev and PSM could allocate any receive -* context between dd->first_dyn_alloc_text and dd->num_rcv_contexts, -* and PSM FECN must reserve an RMT entry for each possible PSM receive -* context. +* RMT entries are allocated as follows: +* 1. QOS (0 to 128 entries) +* 2. FECN (num_kernel_context - 1 [a] + num_user_contexts + +* num_netdev_contexts [b]) +* 3. netdev (NUM_NETDEV_MAP_ENTRIES) +* +* Notes: +* [a] Kernel contexts (except control) are included in FECN if kernel +* TID_RDMA is active. +* [b] Netdev and user contexts are randomly allocated from the same +* context pool, so FECN must cover all contexts in the pool. */ - rmt_count =qos_rmt_entries (dd,NULL ,NULL ) + (num_netdev_contexts *2 ); -if (HFI1_CAP_IS_KSET (TID_RDMA )) - rmt_count += num_kernel_contexts -1 ; -if (rmt_count + n_usr_ctxts >NUM_MAP_ENTRIES ) { - user_rmt_reduced =NUM_MAP_ENTRIES - rmt_count; -dd_dev_err (dd, -"RMT size is reducing the number of user receive contexts from %u to %d\n" , - n_usr_ctxts, - user_rmt_reduced); -/* recalculate */ - n_usr_ctxts = user_rmt_reduced; + rmt_count =qos_rmt_entries (num_kernel_contexts -1 ,NULL ,NULL ) + + (HFI1_CAP_IS_KSET (TID_RDMA ) ? num_kernel_contexts -1 + :0 ) + + n_usr_ctxts + + num_netdev_contexts + +NUM_NETDEV_MAP_ENTRIES ; +if (rmt_count >NUM_MAP_ENTRIES ) { +int over = rmt_count -NUM_MAP_ENTRIES ; +/* try to squish user contexts, minimum of 1 */ +if (over >= n_usr_ctxts) { +dd_dev_err (dd,"RMT overflow: reduce the requested number of contexts\n" ); +return -EINVAL ; + } +dd_dev_err (dd,"RMT overflow: reducing # user contexts from %u to %u\n" , + n_usr_ctxts, n_usr_ctxts - over); + n_usr_ctxts -= over; }/* the first N are kernel contexts, the rest are user/netdev contexts */
@@ -14299,15 +14304,15 @@ static void clear_rsm_rule(struct hfi1_devdata *dd, u8 rule_index) }/* return the number of RSM map table entries that will be used for QOS */ -static int qos_rmt_entries (struct hfi1_devdata *dd,unsigned int *mp, +static int qos_rmt_entries (unsigned int n_krcv_queues,unsigned int *mp,unsigned int *np) {int i;unsigned int m, n; -u8 max_by_vl =0 ; +uint max_by_vl =0 ;/* is QOS active at all? */ -if (dd->n_krcv_queues <=MIN_KERNEL_KCTXTS || +if (n_krcv_queues <MIN_KERNEL_KCTXTS || num_vls ==1 || krcvqsset <=1 ) goto no_qos;
@@ -14365,7 +14370,7 @@ static void init_qos(struct hfi1_devdata *dd, struct rsm_map_table *rmt)if (!rmt) goto bail; - rmt_entries =qos_rmt_entries (dd, &m, &n); + rmt_entries =qos_rmt_entries (dd->n_krcv_queues -1 , &m, &n);if (rmt_entries ==0 ) goto bail; qpns_per_vl =1 << m;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 131/211 iommu: Remove deferred attach check from __iommu_detach_device()
In reply to Greg Kroah-HartmanFrom: Jason Gunthorpe <[email protected]>
[ Upstream commit dd8a25c557e109f868430bd2e3e8f394cb40eaa7 ]
At the current moment, __iommu_detach_device() is only called via call chains that are after the device driver is attached - eg via explicit attach APIs called by the device driver.
Commit bd421264ed30 ("iommu: Fix deferred domain attachment") has removed deferred domain attachment check from __iommu_attach_device() path, so it should just unconditionally work in the __iommu_detach_device() path.
It actually looks like a bug that we were blocking detach on these paths since the attach was unconditional and the caller is going to free the (probably) UNAMANGED domain once this returns.
The only place we should be testing for deferred attach is during the initial point the dma device is linked to the group, and then again during the dma api calls.
--- drivers/iommu/iommu.c | 70 ++++++++++++++++++++++--------------------- include/linux/iommu.h | 2 ++ 2 files changed, 38 insertions(+), 34 deletions(-)
drivers/iommu/iommu.c +36 -34
@@ -371,6 +371,30 @@ static int __iommu_probe_device(struct device *dev, struct list_head *group_listreturn ret; } +static bool iommu_is_attach_deferred (struct device *dev) +{ +const struct iommu_ops *ops =dev_iommu_ops (dev); + +if (ops->is_attach_deferred) +return ops->is_attach_deferred (dev); + +return false; +} + +static int iommu_group_do_dma_first_attach (struct device *dev,void *data) +{ +struct iommu_domain *domain = data; + +lockdep_assert_held (&dev->iommu_group->mutex); + +if (iommu_is_attach_deferred (dev)) { + dev->iommu->attach_deferred =1 ; +return 0 ; + } + +return __iommu_attach_device (domain, dev); +} +int iommu_probe_device (struct device *dev) {const struct iommu_ops *ops;
@@ -401,7 +425,7 @@ int iommu_probe_device(struct device *dev)* attach the default domain. */ if (group->default_domain && !group->owner) { - ret =__iommu_attach_device (group->default_domain, dev); + ret =iommu_group_do_dma_first_attach (dev, group->default_domain);if (ret) {mutex_unlock (&group->mutex);iommu_group_put (group);
@@ -951,16 +975,6 @@ static int iommu_create_device_direct_mappings(struct iommu_group *group,return ret; } -static bool iommu_is_attach_deferred (struct device *dev) -{ -const struct iommu_ops *ops =dev_iommu_ops (dev); - -if (ops->is_attach_deferred) -return ops->is_attach_deferred (dev); - -return false; -} -/** * iommu_group_add_device - add a device to an iommu group * @group: the group into which to add the device (reference should be held)
@@ -1013,8 +1027,8 @@ int iommu_group_add_device(struct iommu_group *group, struct device *dev)mutex_lock (&group->mutex);list_add_tail (&device->list, &group->devices); -if (group->domain && !iommu_is_attach_deferred (dev)) - ret =__iommu_attach_device (group->domain, dev); +if (group->domain) + ret =iommu_group_do_dma_first_attach (dev, group->domain);mutex_unlock (&group->mutex);if (ret) goto err_put_group;
@@ -1780,21 +1794,10 @@ static void probe_alloc_default_domain(struct bus_type *bus, } -static int iommu_group_do_dma_attach (struct device *dev,void *data) -{ -struct iommu_domain *domain = data; -int ret =0 ; - -if (!iommu_is_attach_deferred (dev)) - ret =__iommu_attach_device (domain, dev); - -return ret; -} - -static int __iommu_group_dma_attach (struct iommu_group *group) +static int __iommu_group_dma_first_attach (struct iommu_group *group) {return __iommu_group_for_each_dev (group, group->default_domain, - iommu_group_do_dma_attach); + iommu_group_do_dma_first_attach); }static int iommu_group_do_probe_finalize (struct device *dev,void *data)
@@ -1859,7 +1862,7 @@ int bus_iommu_probe(struct bus_type *bus)iommu_group_create_direct_mappings (group); - ret =__iommu_group_dma_attach (group); + ret =__iommu_group_dma_first_attach (group);mutex_unlock (&group->mutex);
@@ -1991,9 +1994,11 @@ static int __iommu_attach_device(struct iommu_domain *domain,return -ENODEV ; ret = domain->ops->attach_dev (domain, dev); -if (!ret) -trace_attach_device_to_domain (dev); -return ret; +if (ret) +return ret; + dev->iommu->attach_deferred =0 ; +trace_attach_device_to_domain (dev); +return 0 ; }/**
@@ -2038,7 +2043,7 @@ EXPORT_SYMBOL_GPL(iommu_attach_device);int iommu_deferred_attach (struct device *dev,struct iommu_domain *domain) { -if (iommu_is_attach_deferred (dev)) +if (dev->iommu && dev->iommu->attach_deferred)return __iommu_attach_device (domain, dev);return 0 ;
@@ -2047,9 +2052,6 @@ int iommu_deferred_attach(struct device *dev, struct iommu_domain *domain)static void __iommu_detach_device (struct iommu_domain *domain,struct device *dev) { -if (iommu_is_attach_deferred (dev)) -return ; - domain->ops->detach_dev (domain, dev);trace_detach_device_from_domain (dev); }
include/linux/iommu.h +2 -0
@@ -401,6 +401,7 @@ struct iommu_fault_param {* @iommu_dev: IOMMU device this device is linked to * @priv: IOMMU Driver private data * @max_pasids: number of PASIDs this device can consume +* @attach_deferred: the dma domain attachment is deferred * * TODO: migrate other per device data pointers under iommu_dev_data, e.g. * struct iommu_group *iommu_group;
@@ -413,6 +414,7 @@ struct dev_iommu {struct iommu_device *iommu_dev;void *priv;u32 max_pasids; + u32 attach_deferred:1; }; int iommu_device_register(struct iommu_device *iommu,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 132/211 PCI/ACPI: Account for _S0W of the target bridge in acpi_pci_bridge_d3()
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
[ Upstream commit 8133844a8f2434be9576850c6978179d7cca5c81 ]
It is questionable to allow a PCI bridge to go into D3 if it has _S0W returning D2 or a shallower power state, so modify acpi_pci_bridge_d3(() to always take the return value of _S0W for the target bridge into account. That is, make it return 'false' if _S0W returns D2 or a shallower power state for the target bridge regardless of its ancestor Root Port properties. Of course, this also causes 'false' to be returned if the Root Port itself is the target and its _S0W returns D2 or a shallower power state.
However, still allow bridges without _S0W that are power-manageable via ACPI to enter D3 to retain the current code behavior in that case.
This fixes problems where a hotplug notification is missed because a bridge is in D3. That means hot-added devices such as USB4 docks (and the devices they contain) and Thunderbolt 3 devices may not work.
--- drivers/acpi/device_pm.c | 19 +++++++++++++++++ drivers/pci/pci-acpi.c | 45 +++++++++++++++++++++++++++------------- include/acpi/acpi_bus.h | 1 + 3 files changed, 51 insertions(+), 14 deletions(-)
drivers/acpi/device_pm.c +19 -0
@@ -484,6 +484,25 @@ void acpi_dev_power_up_children_with_adr(struct acpi_device *adev)acpi_dev_for_each_child (adev, acpi_power_up_if_adr_present,NULL ); } +/** +* acpi_dev_power_state_for_wake - Deepest power state for wakeup signaling +* @adev: ACPI companion of the target device. +* +* Evaluate _S0W for @adev and return the value produced by it or return +* ACPI_STATE_UNKNOWN on errors (including _S0W not present). +*/ +u8 acpi_dev_power_state_for_wake (struct acpi_device *adev) +{ +unsigned long long state; +acpi_status status; + + status =acpi_evaluate_integer (adev->handle,"_S0W" ,NULL , &state); +if (ACPI_FAILURE (status)) +return ACPI_STATE_UNKNOWN ; + +return state; +} +#ifdef CONFIG_PM static DEFINE_MUTEX (acpi_pm_notifier_lock);static DEFINE_MUTEX (acpi_pm_notifier_install_lock);
drivers/pci/pci-acpi.c +31 -14
77 lines not on this page · raw message
include/acpi/acpi_bus.h +1 -0
@@ -534,6 +534,7 @@ int acpi_bus_update_power(acpi_handle handle, int *state_p);int acpi_device_update_power (struct acpi_device *device,int *state_p);bool acpi_bus_power_manageable (acpi_handle handle);void acpi_dev_power_up_children_with_adr (struct acpi_device *adev); +u8 acpi_dev_power_state_for_wake (struct acpi_device *adev);int acpi_device_power_add_dependent (struct acpi_device *adev,struct device *dev); void acpi_device_power_remove_dependent(struct acpi_device *adev,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 133/211 media: uvcvideo: Remove format descriptions
In reply to Greg Kroah-HartmanFrom: Laurent Pinchart <[email protected]>
[ Upstream commit 50459f103edfe47c9a599d766a850ef6014936c5 ]
The V4L2 core overwrites format descriptions in v4l_fill_fmtdesc(), there's no need to manually set the descriptions in the driver. This prepares for removal of the format descriptions from the uvc_fmts table.
Unlike V4L2, UVC makes a distinction between the SD-DV, SDL-DV and HD-DV formats. It also indicates whether the DV format uses 50Hz or 60Hz. This information is parsed by the driver to construct a format name string that is printed in a debug message, but serves no other purpose as V4L2 has a single V4L2_PIX_FMT_DV pixel format that covers all those cases.
As the information is available in the UVC descriptors, and thus accessible to users with lsusb if they really care, don't log it in a debug message and drop the format name string to simplify the code.
--- drivers/media/usb/uvc/uvc_driver.c | 24 ++---------------------- drivers/media/usb/uvc/uvc_v4l2.c | 2 -- drivers/media/usb/uvc/uvcvideo.h | 2 -- 3 files changed, 2 insertions(+), 26 deletions(-)
drivers/media/usb/uvc/uvc_driver.c +2 -22
@@ -252,14 +252,10 @@ static int uvc_parse_format(struct uvc_device *dev, fmtdesc =uvc_format_by_guid (&buffer[5 ]);if (fmtdesc !=NULL ) { -strscpy (format->name, fmtdesc->name, -sizeof (format->name)); format->fcc = fmtdesc->fcc; }else {dev_info (&streaming->intf->dev,"Unknown video format %pUl\n" , &buffer[5 ]); -snprintf (format->name,sizeof (format->name),"%pUl\n" , - &buffer[5 ]); format->fcc =0 ; }
@@ -271,8 +267,6 @@ static int uvc_parse_format(struct uvc_device *dev,*/ if (dev->quirks &UVC_QUIRK_FORCE_Y8 ) {if (format->fcc ==V4L2_PIX_FMT_YUYV ) { -strscpy (format->name,"Greyscale 8-bit (Y8 )" , -sizeof (format->name)); format->fcc =V4L2_PIX_FMT_GREY ; format->bpp =8 ; width_multiplier =2 ;
@@ -313,7 +307,6 @@ static int uvc_parse_format(struct uvc_device *dev,return -EINVAL ; } -strscpy (format->name,"MJPEG" ,sizeof (format->name)); format->fcc =V4L2_PIX_FMT_MJPEG ; format->flags =UVC_FMT_FLAG_COMPRESSED ; format->bpp =0 ;
@@ -329,17 +322,7 @@ static int uvc_parse_format(struct uvc_device *dev,return -EINVAL ; } -switch (buffer[8 ] &0x7f ) { -case 0 : -strscpy (format->name,"SD-DV" ,sizeof (format->name)); -break ; -case 1 : -strscpy (format->name,"SDL-DV" ,sizeof (format->name)); -break ; -case 2 : -strscpy (format->name,"HD-DV" ,sizeof (format->name)); -break ; -default : +if ((buffer[8 ] &0x7f ) >2 ) { uvc_dbg(dev, DESCR, "device %d videostreaming interface %d: unknown DV format %u\n", dev->udev->devnum,
@@ -347,9 +330,6 @@ static int uvc_parse_format(struct uvc_device *dev,return -EINVAL ; } -strlcat (format->name, buffer[8 ] & (1 <<7 ) ?" 60Hz" :" 50Hz" , -sizeof (format->name)); - format->fcc =V4L2_PIX_FMT_DV ; format->flags =UVC_FMT_FLAG_COMPRESSED |UVC_FMT_FLAG_STREAM ; format->bpp =0 ;
@@ -376,7 +356,7 @@ static int uvc_parse_format(struct uvc_device *dev,return -EINVAL ; } -uvc_dbg (dev,DESCR ,"Found format %s\n" , format->name); +uvc_dbg (dev,DESCR ,"Found format %p4cc" , &format->fcc); buflen -= buffer[0 ]; buffer += buffer[0 ];
drivers/media/usb/uvc/uvc_v4l2.c +0 -2
@@ -661,8 +661,6 @@ static int uvc_ioctl_enum_fmt(struct uvc_streaming *stream, fmt->flags =0 ;if (format->flags &UVC_FMT_FLAG_COMPRESSED ) fmt->flags |=V4L2_FMT_FLAG_COMPRESSED ; -strscpy (fmt->description, format->name,sizeof (fmt->description)); - fmt->description[sizeof (fmt->description) -1 ] =0 ; fmt->pixelformat = format->fcc;return 0 ; }
drivers/media/usb/uvc/uvcvideo.h +0 -2
@@ -264,8 +264,6 @@ struct uvc_format {u32 fcc;u32 flags; -char name[32 ]; -unsigned int nframes;struct uvc_frame *frame; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 134/211 media: uvcvideo: Handle cameras with invalid descriptors
In reply to Greg Kroah-HartmanFrom: Ricardo Ribalda <[email protected]>
[ Upstream commit 41ddb251c68ac75c101d3a50a68c4629c9055e4c ]
If the source entity does not contain any pads, do not create a link.
--- drivers/media/usb/uvc/uvc_entity.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/uvc/uvc_entity.c +1 -1
@@ -37,7 +37,7 @@ static int uvc_mc_create_links(struct uvc_video_chain *chain,continue ; remote =uvc_entity_by_id (chain->dev, entity->baSourceID[i]); -if (remote ==NULL ) +if (remote ==NULL || remote->num_pads ==0 )return -EINVAL ; source = (UVC_ENTITY_TYPE (remote) ==UVC_TT_STREAMING )
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 135/211 media: uvcvideo: Handle errors from calls to usb_string
In reply to Greg Kroah-HartmanFrom: Guenter Roeck <[email protected]>
[ Upstream commit 4867bb590ae445bcfaa711a86b603c97e94574b3 ]
On a Webcam from Quanta, we see the following error.
usb 3-5: New USB device found, idVendor=0408, idProduct=30d2, bcdDevice= 0.03 usb 3-5: New USB device strings: Mfr=3, Product=1, SerialNumber=2 usb 3-5: Product: USB2.0 HD UVC WebCam
usb 3-5: Manufacturer: Quanta
usb 3-5: SerialNumber: 0x0001
...
uvcvideo: Found UVC 1.10 device USB2.0 HD UVC WebCam (0408:30d2)
uvcvideo: Failed to initialize entity for entity 5
uvcvideo: Failed to register entities (-22).
The Webcam reports an entity of type UVC_VC_EXTENSION_UNIT. It reports a string index of '7' associated with that entity. The attempt to read that string from the camera fails with error -32 (-EPIPE). usb_string() returns that error, but it is ignored. As result, the entity name is empty. This later causes v4l2_device_register_subdev() to return -EINVAL, and no entities are registered as result.
While this appears to be a firmware problem with the camera, the kernel should still handle the situation gracefully. To do that, check the return value from usb_string(). If it reports an error, assign the entity's default name.
--- drivers/media/usb/uvc/uvc_driver.c | 48 ++++++++++++------------------ 1 file changed, 19 insertions(+), 29 deletions(-)
drivers/media/usb/uvc/uvc_driver.c +19 -29
@@ -860,10 +860,8 @@ static int uvc_parse_vendor_control(struct uvc_device *dev, + n;memcpy (unit->extension.bmControls, &buffer[23 +p],2 *n); -if (buffer[24 +p+2 *n] !=0 ) -usb_string (udev, buffer[24 +p+2 *n], unit->name, -sizeof (unit->name)); -else +if (buffer[24 +p+2 *n] ==0 || +usb_string (udev, buffer[24 +p+2 *n], unit->name,sizeof (unit->name)) <0 )sprintf (unit->name,"Extension %u" , buffer[3 ]);list_add_tail (&unit->list, &dev->entities);
@@ -987,15 +985,15 @@ static int uvc_parse_standard_control(struct uvc_device *dev,memcpy (term->media.bmTransportModes, &buffer[10 +n], p); } -if (buffer[7 ] !=0 ) -usb_string (udev, buffer[7 ], term->name, -sizeof (term->name)); -else if (UVC_ENTITY_TYPE (term) ==UVC_ITT_CAMERA ) -sprintf (term->name,"Camera %u" , buffer[3 ]); -else if (UVC_ENTITY_TYPE (term) ==UVC_ITT_MEDIA_TRANSPORT_INPUT ) -sprintf (term->name,"Media %u" , buffer[3 ]); -else -sprintf (term->name,"Input %u" , buffer[3 ]); +if (buffer[7 ] ==0 || +usb_string (udev, buffer[7 ], term->name,sizeof (term->name)) <0 ) { +if (UVC_ENTITY_TYPE (term) ==UVC_ITT_CAMERA ) +sprintf (term->name,"Camera %u" , buffer[3 ]); +if (UVC_ENTITY_TYPE (term) ==UVC_ITT_MEDIA_TRANSPORT_INPUT ) +sprintf (term->name,"Media %u" , buffer[3 ]); +else +sprintf (term->name,"Input %u" , buffer[3 ]); + }list_add_tail (&term->list, &dev->entities);break ;
@@ -1028,10 +1026,8 @@ static int uvc_parse_standard_control(struct uvc_device *dev,memcpy (term->baSourceID, &buffer[7 ],1 ); -if (buffer[8 ] !=0 ) -usb_string (udev, buffer[8 ], term->name, -sizeof (term->name)); -else +if (buffer[8 ] ==0 || +usb_string (udev, buffer[8 ], term->name,sizeof (term->name)) <0 )sprintf (term->name,"Output %u" , buffer[3 ]);list_add_tail (&term->list, &dev->entities);
@@ -1053,10 +1049,8 @@ static int uvc_parse_standard_control(struct uvc_device *dev,memcpy (unit->baSourceID, &buffer[5 ], p); -if (buffer[5 +p] !=0 ) -usb_string (udev, buffer[5 +p], unit->name, -sizeof (unit->name)); -else +if (buffer[5 +p] ==0 || +usb_string (udev, buffer[5 +p], unit->name,sizeof (unit->name)) <0 )sprintf (unit->name,"Selector %u" , buffer[3 ]);list_add_tail (&unit->list, &dev->entities);
@@ -1086,10 +1080,8 @@ static int uvc_parse_standard_control(struct uvc_device *dev,if (dev->uvc_version >=0x0110 ) unit->processing.bmVideoStandards = buffer[9 +n]; -if (buffer[8 +n] !=0 ) -usb_string (udev, buffer[8 +n], unit->name, -sizeof (unit->name)); -else +if (buffer[8 +n] ==0 || +usb_string (udev, buffer[8 +n], unit->name,sizeof (unit->name)) <0 )sprintf (unit->name,"Processing %u" , buffer[3 ]);list_add_tail (&unit->list, &dev->entities);
@@ -1117,10 +1109,8 @@ static int uvc_parse_standard_control(struct uvc_device *dev, unit->extension.bmControls = (u8 *)unit +sizeof (*unit);memcpy (unit->extension.bmControls, &buffer[23 +p], n); -if (buffer[23 +p+n] !=0 ) -usb_string (udev, buffer[23 +p+n], unit->name, -sizeof (unit->name)); -else +if (buffer[23 +p+n] ==0 || +usb_string (udev, buffer[23 +p+n], unit->name,sizeof (unit->name)) <0 )sprintf (unit->name,"Extension %u" , buffer[3 ]);list_add_tail (&unit->list, &dev->entities);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 136/211 media: uvcvideo: Quirk for autosuspend in Logitech B910 and C910
In reply to Greg Kroah-HartmanFrom: Ricardo Ribalda <[email protected]>
[ Upstream commit 136effa754b57632f99574fc4a3433e0cfc031d9 ]
Logitech B910 and C910 firmware are unable to recover from a USB autosuspend. When it resumes, the device is in a state where it only produces invalid frames. Eg:
$ echo 0xFFFF > /sys/module/uvcvideo/parameters/trace # enable verbose log $ yavta -c1 -n1 --file='frame#.jpg' --format MJPEG --size=1920x1080 /dev/video1 [350438.435219] uvcvideo: uvc_v4l2_open [350438.529794] uvcvideo: Resuming interface 2 [350438.529801] uvcvideo: Resuming interface 3 [350438.529991] uvcvideo: Trying format 0x47504a4d (MJPG): 1920x1080. [350438.529996] uvcvideo: Using default frame interval 33333.3 us (30.0 fps). [350438.551496] uvcvideo: uvc_v4l2_mmap [350438.555890] uvcvideo: Device requested 3060 B/frame bandwidth. [350438.555896] uvcvideo: Selecting alternate setting 11 (3060 B/frame bandwidth). [350438.556362] uvcvideo: Allocated 5 URB buffers of 32x3060 bytes each. [350439.316468] uvcvideo: Marking buffer as bad (error bit set). [350439.316475] uvcvideo: Frame complete (EOF found). [350439.316477] uvcvideo: EOF in empty payload. [350439.316484] uvcvideo: frame 1 stats: 149/261/417 packets, 1/149/417 pts (early initial), 416/417 scr, last pts/stc/sof 2976325734/2978107243/249 [350439.384510] uvcvideo: Marking buffer as bad (error bit set). [350439.384516] uvcvideo: Frame complete (EOF found). [350439.384518] uvcvideo: EOF in empty payload. [350439.384525] uvcvideo: frame 2 stats: 265/379/533 packets, 1/265/533 pts (early initial), 532/533 scr, last pts/stc/sof 2979524454/2981305193/316 [350439.448472] uvcvideo: Marking buffer as bad (error bit set). [350439.448478] uvcvideo: Frame complete (EOF found). [350439.448480] uvcvideo: EOF in empty payload. [350439.448487] uvcvideo: frame 3 stats: 265/377/533 packets, 1/265/533 pts (early initial), 532/533 scr, last pts/stc/sof 2982723174/2984503144/382 ...(loop)...
The devices can leave this invalid state if the alternate setting of the streaming interface is toggled.
This patch adds a quirk for this device so it can be autosuspended properly.
lsusb -v:
Bus 001 Device 049: ID 046d:0821 Logitech, Inc. HD Webcam C910 Device Descriptor:
bLength 18
bDescriptorType 1
bcdUSB 2.00
bDeviceClass 239 Miscellaneous Device
bDeviceSubClass 2
bDeviceProtocol 1 Interface Association
bMaxPacketSize0 64
idVendor 0x046d Logitech, Inc.
idProduct 0x0821 HD Webcam C910
bcdDevice 0.10
iManufacturer 0 iProduct 0 iSerial 1 390022B0 bNumConfigurations 1
--- drivers/media/usb/uvc/uvc_driver.c | 18 ++++++++++++++++++ drivers/media/usb/uvc/uvc_video.c | 11 +++++++++++ drivers/media/usb/uvc/uvcvideo.h | 1 + 3 files changed, 30 insertions(+)
drivers/media/usb/uvc/uvc_driver.c +18 -0
@@ -2450,6 +2450,24 @@ static const struct usb_device_id uvc_ids[] = { .bInterfaceSubClass = 1, .bInterfaceProtocol = 0, .driver_info = (kernel_ulong_t)&uvc_quirk_probe_minmax }, +/* Logitech, Webcam C910 */ + { .match_flags = USB_DEVICE_ID_MATCH_DEVICE + | USB_DEVICE_ID_MATCH_INT_INFO, + .idVendor = 0x046d, + .idProduct = 0x0821, + .bInterfaceClass = USB_CLASS_VIDEO, + .bInterfaceSubClass = 1, + .bInterfaceProtocol = 0, + .driver_info = UVC_INFO_QUIRK(UVC_QUIRK_WAKE_AUTOSUSPEND)}, + /* Logitech, Webcam B910 */ + { .match_flags = USB_DEVICE_ID_MATCH_DEVICE + | USB_DEVICE_ID_MATCH_INT_INFO, + .idVendor = 0x046d, + .idProduct = 0x0823, + .bInterfaceClass = USB_CLASS_VIDEO, + .bInterfaceSubClass = 1, + .bInterfaceProtocol = 0, + .driver_info = UVC_INFO_QUIRK(UVC_QUIRK_WAKE_AUTOSUSPEND)}, /* Logitech Quickcam Fusion */ { .match_flags = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
drivers/media/usb/uvc/uvc_video.c +11 -0
@@ -1965,6 +1965,17 @@ static int uvc_video_start_transfer(struct uvc_streaming *stream,"Selecting alternate setting %u (%u B/frame bandwidth)\n" , altsetting, best_psize); +/* +* Some devices, namely the Logitech C910 and B910, are unable +* to recover from a USB autosuspend, unless the alternate +* setting of the streaming interface is toggled. +*/ +if (stream->dev->quirks &UVC_QUIRK_WAKE_AUTOSUSPEND ) { +usb_set_interface (stream->dev->udev, intfnum, + altsetting); +usb_set_interface (stream->dev->udev, intfnum,0 ); + } + ret =usb_set_interface (stream->dev->udev, intfnum, altsetting);if (ret <0 )return ret;
drivers/media/usb/uvc/uvcvideo.h +1 -0
@@ -74,6 +74,7 @@#define UVC_QUIRK_RESTORE_CTRLS_ON_INIT 0x00000400#define UVC_QUIRK_FORCE_Y8 0x00000800#define UVC_QUIRK_FORCE_BPP 0x00001000 +#define UVC_QUIRK_WAKE_AUTOSUSPEND 0x00002000/* Format flags */ #define UVC_FMT_FLAG_COMPRESSED 0x00000001
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 137/211 media: uvcvideo: Silence memcpy() run-time false positive warnings
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
[ Upstream commit b839212988575c701aab4d3d9ca15e44c87e383c ]
The memcpy() in uvc_video_decode_meta() intentionally copies across the length and flags members and into the trailing buf flexible array. Split the copy so that the compiler can better reason about (the lack of) buffer overflows here. Avoid the run-time false positive warning:
memcpy: detected field-spanning write (size 12) of single field "&meta->length" at drivers/media/usb/uvc/uvc_video.c:1355 (size 1)
Additionally fix a typo in the documentation for struct uvc_meta_buf.
--- drivers/media/usb/uvc/uvc_video.c | 4 +++- include/uapi/linux/uvcvideo.h | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-)
drivers/media/usb/uvc/uvc_video.c +3 -1
@@ -1352,7 +1352,9 @@ static void uvc_video_decode_meta(struct uvc_streaming *stream,if (has_scr)memcpy (stream->clock.last_scr, scr,6 ); -memcpy (&meta->length, mem, length); + meta->length = mem[0 ]; + meta->flags = mem[1 ]; +memcpy (meta->buf, &mem[2 ], length -2 ); meta_buf->bytesused += length +sizeof (meta->ns) +sizeof (meta->sof); uvc_dbg(stream->dev, FRAME,
include/uapi/linux/uvcvideo.h +1 -1
@@ -86,7 +86,7 @@ struct uvc_xu_control_query {* struct. The first two fields are added by the driver, they can be used for * clock synchronisation. The rest is an exact copy of a UVC payload header. * Only complete objects with complete buffers are included. Therefore it's -* always sizeof(meta->ts) + sizeof(meta->sof) + meta->length bytes large. +* always sizeof(meta->ns) + sizeof(meta->sof) + meta->length bytes large. */ struct uvc_meta_buf {__u64 ns;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 138/211 USB: fix memory leak with using debugfs_lookup()
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
[ Upstream commit 30374434edab20e25776f8ecb4bc9d1e54309487 ]
When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once.
--- drivers/usb/core/usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/core/usb.c +1 -1
@@ -998,7 +998,7 @@ static void usb_debugfs_init(void)static void usb_debugfs_cleanup (void ) { -debugfs_remove (debugfs_lookup ("devices" , usb_debug_root)); +debugfs_lookup_and_remove ("devices" , usb_debug_root); }/*
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 139/211 cacheinfo: Fix shared_cpu_map to handle shared caches at different levels
In reply to Greg Kroah-HartmanFrom: Yong-Xuan Wang <[email protected]>
[ Upstream commit 198102c9103fc78d8478495971947af77edb05c1 ]
The cacheinfo sets up the shared_cpu_map by checking whether the caches with the same index are shared between CPUs. However, this will trigger slab-out-of-bounds access if the CPUs do not have the same cache hierarchy. Another problem is the mismatched shared_cpu_map when the shared cache does not have the same index between CPUs.
CPU0 I D L3
index 0 1 2 x
^ ^ ^ ^
index 0 1 2 3
CPU1 I D L2 L3
This patch checks each cache is shared with all caches on other CPUs.
--- drivers/base/cacheinfo.c | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-)
drivers/base/cacheinfo.c +17 -10
@@ -256,7 +256,7 @@ static int cache_shared_cpu_map_setup(unsigned int cpu) {struct cpu_cacheinfo *this_cpu_ci =get_cpu_cacheinfo (cpu);struct cacheinfo *this_leaf, *sib_leaf; -unsigned int index; +unsigned int index, sib_index;int ret =0 ;if (this_cpu_ci->cpu_map_populated)
@@ -284,11 +284,13 @@ static int cache_shared_cpu_map_setup(unsigned int cpu)if (i == cpu || !sib_cpu_ci->info_list)continue ;/* skip if itself or no cacheinfo */ - - sib_leaf =per_cpu_cacheinfo_idx (i, index); -if (cache_leaves_are_shared (this_leaf, sib_leaf)) { -cpumask_set_cpu (cpu, &sib_leaf->shared_cpu_map); -cpumask_set_cpu (i, &this_leaf->shared_cpu_map); +for (sib_index =0 ; sib_index <cache_leaves (i); sib_index++) { + sib_leaf =per_cpu_cacheinfo_idx (i, sib_index); +if (cache_leaves_are_shared (this_leaf, sib_leaf)) { +cpumask_set_cpu (cpu, &sib_leaf->shared_cpu_map); +cpumask_set_cpu (i, &this_leaf->shared_cpu_map); +break ; + } } }/* record the maximum cache line size */
@@ -302,7 +304,7 @@ static int cache_shared_cpu_map_setup(unsigned int cpu)static void cache_shared_cpu_map_remove (unsigned int cpu) {struct cacheinfo *this_leaf, *sib_leaf; -unsigned int sibling, index; +unsigned int sibling, index, sib_index;for (index =0 ; index <cache_leaves (cpu); index++) { this_leaf =per_cpu_cacheinfo_idx (cpu, index);
@@ -313,9 +315,14 @@ static void cache_shared_cpu_map_remove(unsigned int cpu)if (sibling == cpu || !sib_cpu_ci->info_list)continue ;/* skip if itself or no cacheinfo */ - sib_leaf =per_cpu_cacheinfo_idx (sibling, index); -cpumask_clear_cpu (cpu, &sib_leaf->shared_cpu_map); -cpumask_clear_cpu (sibling, &this_leaf->shared_cpu_map); +for (sib_index =0 ; sib_index <cache_leaves (sibling); sib_index++) { + sib_leaf =per_cpu_cacheinfo_idx (sibling, sib_index); +if (cache_leaves_are_shared (this_leaf, sib_leaf)) { +cpumask_clear_cpu (cpu, &sib_leaf->shared_cpu_map); +cpumask_clear_cpu (sibling, &this_leaf->shared_cpu_map); +break ; + } + } } } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 140/211 usb: fotg210: List different variants
In reply to Greg Kroah-HartmanFrom: Linus Walleij <[email protected]>
[ Upstream commit 170da81aab077c9e85fc2b786413ca07942774a0 ]
There are at least two variants of the FOTG: FOTG200 and FOTG210. Handle them in this driver and let's add more quirks as we go along.
--- drivers/usb/fotg210/fotg210-core.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/fotg210/fotg210-core.c +2 -0
@@ -127,7 +127,9 @@ static int fotg210_remove(struct platform_device *pdev)#ifdef CONFIG_OF static const struct of_device_id fotg210_of_match[] = { + { .compatible ="faraday,fotg200" }, { .compatible ="faraday,fotg210" }, +/* TODO: can we also handle FUSB220? */ {}, };MODULE_DEVICE_TABLE (of, fotg210_of_match);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 141/211 dt-bindings: usb: Add device id for Genesys Logic hub controller
In reply to Greg Kroah-HartmanFrom: Anand Moon <[email protected]>
[ Upstream commit b72654148e34c181f532275d03ef6f37de288f24 ]
Add usb hub device id for Genesys Logic, Inc. GL852G Hub USB 2.0 root hub.
--- Documentation/devicetree/bindings/usb/genesys,gl850g.yaml | 1 + 1 file changed, 1 insertion(+)
Documentation/devicetree/bindings/usb/genesys,gl850g.yaml +1 -0
@@ -16,6 +16,7 @@ properties: compatible: enum: - usb5e3,608 + - usb5e3,610 reg: true
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 142/211 staging: emxx_udc: Add checks for dma_alloc_coherent()
In reply to Greg Kroah-HartmanFrom: Yuan Can <[email protected]>
[ Upstream commit f6510a93cfd8c6c79b4dda0f2967cdc6df42eff4 ]
As the dma_alloc_coherent may return NULL, the return value needs to be checked to avoid NULL poineter dereference.
--- drivers/staging/emxx_udc/emxx_udc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/staging/emxx_udc/emxx_udc.c +6 -1
@@ -2587,10 +2587,15 @@ static int nbu2ss_ep_queue(struct usb_ep *_ep, req->unaligned = false;if (req->unaligned) { -if (!ep->virt_buf) +if (!ep->virt_buf) { ep->virt_buf =dma_alloc_coherent (udc->dev,PAGE_SIZE , &ep->phys_buf,GFP_ATOMIC |GFP_DMA ); +if (!ep->virt_buf) { +spin_unlock_irqrestore (&udc->lock, flags); +return -ENOMEM ; + } + }if (ep->epnum >0 ) {if (ep->direct ==USB_DIR_IN ) memcpy(ep->virt_buf, req->req.buf,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 143/211 tty: fix out-of-bounds access in tty_driver_lookup_tty()
In reply to Greg Kroah-HartmanFrom: Sven Schnelle <[email protected]>
[ Upstream commit db4df8e9d79e7d37732c1a1b560958e8dadfefa1 ]
When specifying an invalid console= device like console=tty3270, tty_driver_lookup_tty() returns the tty struct without checking whether index is a valid number.
To reproduce:
qemu-system-x86_64 -enable-kvm -nographic -serial mon:stdio \
-kernel ../linux-build-x86/arch/x86/boot/bzImage \
-append "console=ttyS0 console=tty3270"
This crashes with:
[ 0.770599] BUG: kernel NULL pointer dereference, address: 00000000000000ef [ 0.771265] #PF: supervisor read access in kernel mode [ 0.771773] #PF: error_code(0x0000) - not-present page [ 0.772609] Oops: 0000 [#1] PREEMPT SMP PTI [ 0.774878] RIP: 0010:tty_open+0x268/0x6f0 [ 0.784013] chrdev_open+0xbd/0x230 [ 0.784444] ? cdev_device_add+0x80/0x80 [ 0.784920] do_dentry_open+0x1e0/0x410 [ 0.785389] path_openat+0xca9/0x1050 [ 0.785813] do_filp_open+0xaa/0x150 [ 0.786240] file_open_name+0x133/0x1b0 [ 0.786746] filp_open+0x27/0x50 [ 0.787244] console_on_rootfs+0x14/0x4d [ 0.787800] kernel_init_freeable+0x1e4/0x20d [ 0.788383] ? rest_init+0xc0/0xc0 [ 0.788881] kernel_init+0x11/0x120 [ 0.789356] ret_from_fork+0x22/0x30
--- drivers/tty/tty_io.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/tty/tty_io.c +5 -3
@@ -1224,14 +1224,16 @@ static struct tty_struct *tty_driver_lookup_tty(struct tty_driver *driver, {struct tty_struct *tty; -if (driver->ops->lookup) +if (driver->ops->lookup) {if (!file) tty =ERR_PTR (-EIO );else tty = driver->ops->lookup (driver, file, idx); -else + }else { +if (idx >= driver->num) +return ERR_PTR (-EINVAL ); tty = driver->ttys[idx]; - + }if (!IS_ERR (tty))tty_kref_get (tty);return tty;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 144/211 tty: serial: fsl_lpuart: disable the CTS when send break signal
In reply to Greg Kroah-HartmanFrom: Sherry Sun <[email protected]>
[ Upstream commit c4c81db5cf8bc53d6160c3abf26d382c841aa434 ]
LPUART IP has a bug that it treats the CTS as higher priority than the break signal, which cause the break signal sending through UARTCTRL_SBK may impacted by the CTS input if the HW flow control is enabled.
Add this workaround patch to fix the IP bug, we can disable CTS before asserting SBK to avoid any interference from CTS, and re-enable it when break off.
Such as for the bluetooth chip power save feature, host can let the BT chip get into sleep state by sending a UART break signal, and wake it up by turning off the UART break. If the BT chip enters the sleep mode successfully, it will pull up the CTS line, if the BT chip is woken up, it will pull down the CTS line. If without this workaround patch, the UART TX pin cannot send the break signal successfully as it affected by the BT CTS pin. After adding this patch, the BT power save feature can work well.
--- drivers/tty/serial/fsl_lpuart.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-)
drivers/tty/serial/fsl_lpuart.c +22 -2
@@ -1462,12 +1462,32 @@ static void lpuart_break_ctl(struct uart_port *port, int break_state)static void lpuart32_break_ctl (struct uart_port *port,int break_state) { -unsigned long temp; +unsigned long temp, modem; +struct tty_struct *tty; +unsigned int cflag =0 ; + + tty =tty_port_tty_get (&port->state->port); +if (tty) { + cflag = tty->termios.c_cflag; +tty_kref_put (tty); + } temp =lpuart32_read (port,UARTCTRL ) & ~UARTCTRL_SBK ; + modem =lpuart32_read (port,UARTMODIR ); -if (break_state !=0 ) +if (break_state !=0 ) { temp |=UARTCTRL_SBK ; +/* +* LPUART CTS has higher priority than SBK, need to disable CTS before +* asserting SBK to avoid any interference if flow control is enabled. +*/ +if (cflag &CRTSCTS && modem &UARTMODIR_TXCTSE ) +lpuart32_write (port, modem & ~UARTMODIR_TXCTSE ,UARTMODIR ); + }else { +/* Re-enable the CTS when break off. */ +if (cflag &CRTSCTS && !(modem &UARTMODIR_TXCTSE )) +lpuart32_write (port, modem |UARTMODIR_TXCTSE ,UARTMODIR ); + }lpuart32_write (port, temp,UARTCTRL ); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 145/211 serial: sc16is7xx: setup GPIO controller later in probe
In reply to Greg Kroah-HartmanFrom: Isaac True <[email protected]>
[ Upstream commit c8f71b49ee4d28930c4a6798d1969fa91dc4ef3e ]
The GPIO controller component of the sc16is7xx driver is setup too early, which can result in a race condition where another device tries to utilise the GPIO lines before the sc16is7xx device has finished initialising.
This issue manifests itself as an Oops when the GPIO lines are configured:
Unable to handle kernel read from unreadable memory at virtual address
...
pc : sc16is7xx_gpio_direction_output+0x68/0x108 [sc16is7xx]
lr : sc16is7xx_gpio_direction_output+0x4c/0x108 [sc16is7xx]
...
Call trace:
sc16is7xx_gpio_direction_output+0x68/0x108 [sc16is7xx]
gpiod_direction_output_raw_commit+0x64/0x318
gpiod_direction_output+0xb0/0x170
create_gpio_led+0xec/0x198
gpio_led_probe+0x16c/0x4f0
platform_drv_probe+0x5c/0xb0
really_probe+0xe8/0x448
driver_probe_device+0xe8/0x138
__device_attach_driver+0x94/0x118
bus_for_each_drv+0x8c/0xe0
__device_attach+0x100/0x1b8
device_initial_probe+0x28/0x38
bus_probe_device+0xa4/0xb0
deferred_probe_work_func+0x90/0xe0
process_one_work+0x1c4/0x480
worker_thread+0x54/0x430
kthread+0x138/0x150
ret_from_fork+0x10/0x1cThis patch moves the setup of the GPIO controller functions to later in the probe function, ensuring the sc16is7xx device has already finished initialising by the time other devices try to make use of the GPIO lines. The error handling has also been reordered to reflect the new initialisation order.
--- drivers/tty/serial/sc16is7xx.c | 51 +++++++++++++++++----------------- 1 file changed, 26 insertions(+), 25 deletions(-)
drivers/tty/serial/sc16is7xx.c +26 -25
@@ -1423,25 +1423,6 @@ static int sc16is7xx_probe(struct device *dev, }sched_set_fifo (s->kworker_task); -#ifdef CONFIG_GPIOLIB -if (devtype->nr_gpio) { -/* Setup GPIO cotroller */ - s->gpio.owner =THIS_MODULE ; - s->gpio.parent = dev; - s->gpio.label =dev_name (dev); - s->gpio.direction_input = sc16is7xx_gpio_direction_input; - s->gpio.get = sc16is7xx_gpio_get; - s->gpio.direction_output = sc16is7xx_gpio_direction_output; - s->gpio.set = sc16is7xx_gpio_set; - s->gpio.base =-1 ; - s->gpio.ngpio = devtype->nr_gpio; - s->gpio.can_sleep =1 ; - ret =gpiochip_add_data (&s->gpio, s); -if (ret) - goto out_thread; - } -#endif -/* reset device, purging any pending irq / data */ regmap_write (s->regmap,SC16IS7XX_IOCONTROL_REG <<SC16IS7XX_REG_SHIFT ,SC16IS7XX_IOCONTROL_SRESET_BIT );
@@ -1518,6 +1499,25 @@ static int sc16is7xx_probe(struct device *dev, s->p[u].irda_mode = true; } +#ifdef CONFIG_GPIOLIB +if (devtype->nr_gpio) { +/* Setup GPIO cotroller */ + s->gpio.owner =THIS_MODULE ; + s->gpio.parent = dev; + s->gpio.label =dev_name (dev); + s->gpio.direction_input = sc16is7xx_gpio_direction_input; + s->gpio.get = sc16is7xx_gpio_get; + s->gpio.direction_output = sc16is7xx_gpio_direction_output; + s->gpio.set = sc16is7xx_gpio_set; + s->gpio.base =-1 ; + s->gpio.ngpio = devtype->nr_gpio; + s->gpio.can_sleep =1 ; + ret =gpiochip_add_data (&s->gpio, s); +if (ret) + goto out_thread; + } +#endif +/* * Setup interrupt. We first try to acquire the IRQ line as level IRQ. * If that succeeds, we can allow sharing the interrupt as well.
@@ -1537,18 +1537,19 @@ static int sc16is7xx_probe(struct device *dev,if (!ret)return 0 ; -out_ports: -for (i--; i >=0 ; i--) { -uart_remove_one_port (&sc16is7xx_uart, &s->p[i].port); -clear_bit (s->p[i].port.line, &sc16is7xx_lines); - } -#ifdef CONFIG_GPIOLIB if (devtype->nr_gpio)gpiochip_remove (&s->gpio); out_thread:#endif + +out_ports: +for (i--; i >=0 ; i--) { +uart_remove_one_port (&sc16is7xx_uart, &s->p[i].port); +clear_bit (s->p[i].port.line, &sc16is7xx_lines); + } +kthread_stop (s->kworker_task); out_clk:
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 146/211 mei: bus-fixup:upon error print return values of send and receive
In reply to Greg Kroah-HartmanFrom: Alexander Usyskin <[email protected]>
[ Upstream commit 4b8659e2c258e4fdac9ccdf06cc20c0677894ef9 ]
For easier debugging, upon error, print also return values from __mei_cl_recv() and __mei_cl_send() functions.
--- drivers/misc/mei/bus-fixup.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/misc/mei/bus-fixup.c +4 -4
@@ -151,7 +151,7 @@ static int mei_fwver(struct mei_cl_device *cldev) ret =__mei_cl_send (cldev->cl, (u8 *)&req,sizeof (req),0 ,MEI_CL_IO_TX_BLOCKING );if (ret <0 ) { -dev_err (&cldev->dev,"Could not send ReqFWVersion cmd\n" ); +dev_err (&cldev->dev,"Could not send ReqFWVersion cmd ret = %d\n" , ret);return ret; }
@@ -163,7 +163,7 @@ static int mei_fwver(struct mei_cl_device *cldev)* Should be at least one version block, * error out if nothing found */ -dev_err (&cldev->dev,"Could not read FW version\n" ); +dev_err (&cldev->dev,"Could not read FW version ret = %d\n" , bytes_recv);return -EIO ; }
@@ -380,7 +380,7 @@ static int mei_nfc_if_version(struct mei_cl *cl, ret =__mei_cl_send (cl, (u8 *)&cmd,sizeof (cmd),0 ,MEI_CL_IO_TX_BLOCKING );if (ret <0 ) { -dev_err (bus->dev,"Could not send IF version cmd\n" ); +dev_err (bus->dev,"Could not send IF version cmd ret = %d\n" , ret);return ret; }
@@ -395,7 +395,7 @@ static int mei_nfc_if_version(struct mei_cl *cl, bytes_recv =__mei_cl_recv (cl, (u8 *)reply, if_version_length, &vtag,0 ,0 );if (bytes_recv <0 || (size_t )bytes_recv < if_version_length) { -dev_err (bus->dev,"Could not read IF version\n" ); +dev_err (bus->dev,"Could not read IF version ret = %d\n" , bytes_recv); ret = -EIO ; goto err; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 147/211 tools/iio/iio_utils:fix memory leak
In reply to Greg Kroah-HartmanFrom: Yulong Zhang <[email protected]>
[ Upstream commit f2edf0c819a4823cd6c288801ce737e8d4fcde06 ]
1. fopen sysfs without fclose.
2. asprintf filename without free.
3. if asprintf return error,do not need to free the buffer.
--- tools/iio/iio_utils.c | 23 ++++++----------------- 1 file changed, 6 insertions(+), 17 deletions(-)
tools/iio/iio_utils.c +6 -17
@@ -264,6 +264,7 @@ int iioutils_get_param_float(float *output, const char *param_name,if (fscanf (sysfsfp,"%f" , output) !=1 ) ret = errno ? -errno : -ENODATA ; +fclose (sysfsfp);break ; } error_free_filename:
@@ -345,9 +346,9 @@ int build_channel_array(const char *device_dir, int buffer_idx, } sysfsfp =fopen (filename,"r" ); +free (filename);if (!sysfsfp) { ret = -errno; -free (filename); goto error_close_dir; }
@@ -357,7 +358,6 @@ int build_channel_array(const char *device_dir, int buffer_idx,if (fclose (sysfsfp))perror ("build_channel_array(): Failed to close file" ); -free (filename); goto error_close_dir; }if (ret ==1 )
@@ -365,11 +365,9 @@ int build_channel_array(const char *device_dir, int buffer_idx,if (fclose (sysfsfp)) { ret = -errno; -free (filename); goto error_close_dir; } -free (filename); } *ci_array =malloc (sizeof (**ci_array) * (*counter));
@@ -395,9 +393,9 @@ int build_channel_array(const char *device_dir, int buffer_idx, } sysfsfp =fopen (filename,"r" ); +free (filename);if (!sysfsfp) { ret = -errno; -free (filename); count--; goto error_cleanup_array; }
@@ -405,20 +403,17 @@ int build_channel_array(const char *device_dir, int buffer_idx, errno =0 ;if (fscanf (sysfsfp,"%i" , ¤t_enabled) !=1 ) { ret = errno ? -errno : -ENODATA ; -free (filename); count--; goto error_cleanup_array; }if (fclose (sysfsfp)) { ret = -errno; -free (filename); count--; goto error_cleanup_array; }if (!current_enabled) { -free (filename); count--;continue ; }
@@ -429,7 +424,6 @@ int build_channel_array(const char *device_dir, int buffer_idx,strlen (ent->d_name) - strlen("_en"));if (!current->name) { -free (filename); ret = -ENOMEM ; count--; goto error_cleanup_array;
@@ -439,7 +433,6 @@ int build_channel_array(const char *device_dir, int buffer_idx, ret =iioutils_break_up_name (current->name, ¤t->generic_name);if (ret) { -free (filename);free (current->name); count--; goto error_cleanup_array;
@@ -450,17 +443,16 @@ int build_channel_array(const char *device_dir, int buffer_idx, scan_el_dir, current->name);if (ret <0 ) { -free (filename); ret = -ENOMEM ; goto error_cleanup_array; } sysfsfp =fopen (filename,"r" ); +free (filename);if (!sysfsfp) { ret = -errno; -fprintf (stderr,"failed to open %s\n" , - filename); -free (filename); +fprintf (stderr,"failed to open %s/%s_index\n" , + scan_el_dir, current->name); goto error_cleanup_array; }
@@ -470,17 +462,14 @@ int build_channel_array(const char *device_dir, int buffer_idx,if (fclose (sysfsfp))perror ("build_channel_array(): Failed to close file" ); -free (filename); goto error_cleanup_array; }if (fclose (sysfsfp)) { ret = -errno; -free (filename); goto error_cleanup_array; } -free (filename);/* Find the scale */ ret = iioutils_get_param_float(¤t->scale, "scale",
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 148/211 bus: mhi: ep: Fix the debug message for MHI_PKT_TYPE_RESET_CHAN_CMD cmd
In reply to Greg Kroah-HartmanFrom: Manivannan Sadhasivam <[email protected]>
[ Upstream commit 8e697fcfdb9809634e268058ca743369c216b7ac ]
The debug log incorrectly mentions that STOP command is received instead of RESET command. Fix that.
--- drivers/bus/mhi/ep/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/bus/mhi/ep/main.c +1 -1
@@ -219,7 +219,7 @@ static int mhi_ep_process_cmd_ring(struct mhi_ep_ring *ring, struct mhi_ring_elemutex_unlock (&mhi_chan->lock);break ;case MHI_PKT_TYPE_RESET_CHAN_CMD : -dev_dbg (dev,"Received STOP command for channel (%u)\n" , ch_id); +dev_dbg (dev,"Received RESET command for channel (%u)\n" , ch_id);if (!ch_ring->started) {dev_err (dev,"Channel (%u) not opened\n" , ch_id);return -ENODEV ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 149/211 iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_status_word()
In reply to Greg Kroah-HartmanFrom: Harshit Mogalapalli <[email protected]>
[ Upstream commit e56d2c34ce9dc122b1a618172ec0e05e50adb9e9 ]
Smatch Warns: drivers/iio/accel/mma9551_core.c:357
mma9551_read_status_word() error: uninitialized symbol 'v'.
When (offset >= 1 << 12) is true mma9551_transfer() will return -EINVAL without 'v' being initialized, so check for the error and return.
Note: Not a bug as such because the caller checks return value and doesn't not use this parameter in the problem case.
--- drivers/iio/accel/mma9551_core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/iio/accel/mma9551_core.c +4 -1
@@ -354,9 +354,12 @@ int mma9551_read_status_word(struct i2c_client *client, u8 app_id, ret =mma9551_transfer (client, app_id,MMA9551_CMD_READ_STATUS , reg,NULL ,0 , (u8 *)&v,2 ); +if (ret <0 ) +return ret; + *val =be16_to_cpu (v); -return ret; +return 0 ; }EXPORT_SYMBOL_NS (mma9551_read_status_word,IIO_MMA9551 );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 150/211 iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_config_word()
In reply to Greg Kroah-HartmanFrom: Harshit Mogalapalli <[email protected]>
[ Upstream commit 64a68158738ec8f520347144352f7a09bdb9e169 ]
Smatch Warns:drivers/iio/accel/mma9551_core.c:299
mma9551_read_config_word() error: uninitialized symbol 'v'.
When (offset >= 1 << 12) is true mma9551_transfer() will return -EINVAL without 'v' being initialized, so check for the error and return.
Note: No actual bug as caller checks the return value and does not use the parameter in the problem case.
--- drivers/iio/accel/mma9551_core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/iio/accel/mma9551_core.c +4 -1
@@ -296,9 +296,12 @@ int mma9551_read_config_word(struct i2c_client *client, u8 app_id, ret =mma9551_transfer (client, app_id,MMA9551_CMD_READ_CONFIG , reg,NULL ,0 , (u8 *)&v,2 ); +if (ret <0 ) +return ret; + *val =be16_to_cpu (v); -return ret; +return 0 ; }EXPORT_SYMBOL_NS (mma9551_read_config_word,IIO_MMA9551 );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 151/211 media: uvcvideo: Add GUID for BGRA/X 8:8:8:8
In reply to Greg Kroah-HartmanFrom: Marek Vasut <[email protected]>
[ Upstream commit 015d44c2b700ba9639dd29672ba362796cc0be54 ]
The Cypress EZUSB FX3 UVC example can be configured to report pixel format "e436eb7e-524f-11ce-9f53-0020af0ba770". This is its GUID for BGRA/X 8:8:8:8.
The UVC 1.5 spec [1] only defines GUIDs for YUY2, NV12, M420 and I420. This seems to be an extension documented in the Microsoft Windows Media Format SDK[2]. This Media Format SDK defines this GUID as corresponding to MEDIASUBTYPE_RGB32, which is confirmed by [4] as MEDIASUBTYPE_ARGB32 has different GUID.
Note that in my case, the FX3 UVC can output either channel order, BGR or RGB or any other mix for that matter. Since Linux commit 1b8dc32286a1a ("[media] uvcvideo: Add GUID for BGR 8:8:8") defined a GUID for MEDIASUBTYPE_RGB24 channel order as BGR, keep this change consistent and define MEDIASUBTYPE_RGB32 as BGR as well. Document [3] also indicates the channel order is BGR.
[1] https://www.usb.org/document-library/video-class-v15-document-set
[2] https://learn.microsoft.com/en-us/windows/win32/wmformat/media-type-identifiers
[3] https://learn.microsoft.com/en-us/windows/win32/directshow/uncompressed-rgb-video-subtypes
[4] https://gix.github.io/media-types/
--- include/media/v4l2-uvc.h | 8 ++++++++ 1 file changed, 8 insertions(+)
include/media/v4l2-uvc.h +8 -0
@@ -99,6 +99,9 @@#define UVC_GUID_FORMAT_BGR3 \ { 0x7d, 0xeb, 0x36, 0xe4, 0x4f, 0x52, 0xce, 0x11, \ 0x9f, 0x53, 0x00, 0x20, 0xaf, 0x0b, 0xa7, 0x70} +#define UVC_GUID_FORMAT_BGR4 \ + { 0x7e, 0xeb, 0x36, 0xe4, 0x4f, 0x52, 0xce, 0x11, \ + 0x9f, 0x53, 0x00, 0x20, 0xaf, 0x0b, 0xa7, 0x70}#define UVC_GUID_FORMAT_M420 \ { 'M', '4', '2', '0', 0x00, 0x00, 0x10, 0x00, \ 0x80, 0x00, 0x00, 0xaa, 0x00, 0x38, 0x9b, 0x71}
@@ -266,6 +269,11 @@ static struct uvc_format_desc uvc_fmts[] = { .guid = UVC_GUID_FORMAT_BGR3, .fcc = V4L2_PIX_FMT_BGR24, }, + { + .name = "BGRA/X 8:8:8:8 (BGR4)", + .guid = UVC_GUID_FORMAT_BGR4, + .fcc = V4L2_PIX_FMT_XBGR32, + }, { .name = "H.264", .guid = UVC_GUID_FORMAT_H264,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 152/211 soundwire: bus_type: Avoid lockdep assert in sdw_drv_probe()
In reply to Greg Kroah-HartmanFrom: Richard Fitzgerald <[email protected]>
[ Upstream commit 3dca1f89ae3455963d7b53245ecf298ea9bae857 ]
Don't hold sdw_dev_lock while calling the peripheral driver probe() and remove() callbacks.
Holding sdw_dev_lock around the probe() and remove() calls causes a theoretical mutex inversion which lockdep will assert on.
During probe() the sdw_dev_lock mutex is taken first and then ASoC/ALSA locks are taken by the probe() implementation.
During normal operation ASoC can take its locks and then trigger a runtime resume of the component. The SoundWire resume will then take sdw_dev_lock. This is the reverse order compared to probe().
It's not necessary to hold sdw_dev_lock when calling the probe() and remove(), it is only used to prevent the bus core calling the driver callbacks if there isn't a driver or the driver is removing.
All calls to the driver callbacks are guarded by the 'probed' flag. So if sdw_dev_lock is held while setting and clearing the 'probed' flag this is sufficient to guarantee the safety of callback functions.
Removing the mutex from around the call to probe() means that it is now possible for a bus event (PING response) to be handled in parallel with the probe(). But sdw_bus_probe() already has handling for this by calling the device update_status() after the probe() has completed.
Example lockdep assert:
[ 46.098514] ======================================================
[ 46.104736] WARNING: possible circular locking dependency detected
[ 46.110961] 6.1.0-rc4-jamerson #1 Tainted: G E
[ 46.116842] ------------------------------------------------------
[ 46.123063] mpg123/1130 is trying to acquire lock:
[ 46.127883] ffff8b445031fb80 (&slave->sdw_dev_lock){+.+.}-{3:3}, at: sdw_update_slave_status+0x26/0x70
[ 46.137225]
but task is already holding lock:
[ 46.143074] ffffffffc1455310 (&card->pcm_mutex){+.+.}-{3:3}, at: dpcm_fe_dai_open+0x49/0x830
[ 46.151536]
which lock already depends on the new lock.[ 46.159732]
the existing dependency chain (in reverse order) is:
[ 46.167231]
-> #4 (&card->pcm_mutex){+.+.}-{3:3}:
[ 46.173428] __mutex_lock+0x94/0x920
[ 46.177542] snd_soc_dpcm_runtime_update+0x2e/0x100
[ 46.182958] snd_soc_dapm_put_enum_double+0x1c2/0x200
[ 46.188548] snd_ctl_elem_write+0x10c/0x1d0
[ 46.193268] snd_ctl_ioctl+0x126/0x850
[ 46.197556] __x64_sys_ioctl+0x87/0xc0
[ 46.201845] do_syscall_64+0x38/0x90
[ 46.205959] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 46.211553]
-> #3 (&card->controls_rwsem){++++}-{3:3}:
[ 46.218188] down_write+0x2b/0xd0
[ 46.222038] snd_ctl_add_replace+0x39/0xb0
[ 46.226672] snd_soc_add_controls+0x53/0x80
[ 46.231393] soc_probe_component+0x1e4/0x2a0
[ 46.236202] snd_soc_bind_card+0x51a/0xc80
[ 46.240836] devm_snd_soc_register_card+0x43/0x90
[ 46.246079] mc_probe+0x982/0xfe0 [snd_soc_sof_sdw]
[ 46.251500] platform_probe+0x3c/0xa0
[ 46.255700] really_probe+0xde/0x390
[ 46.259814] __driver_probe_device+0x78/0x180
[ 46.264710] driver_probe_device+0x1e/0x90
[ 46.269347] __driver_attach+0x9f/0x1f0
[ 46.273721] bus_for_each_dev+0x78/0xc0
[ 46.278098] bus_add_driver+0x1ac/0x200
[ 46.282473] driver_register+0x8f/0xf0
[ 46.286759] do_one_initcall+0x58/0x310
[ 46.291136] do_init_module+0x4c/0x1f0
[ 46.295422] __do_sys_finit_module+0xb4/0x130
[ 46.300321] do_syscall_64+0x38/0x90
[ 46.304434] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 46.310027]
-> #2 (&card->mutex){+.+.}-{3:3}:
[ 46.315883] __mutex_lock+0x94/0x920
[ 46.320000] snd_soc_bind_card+0x3e/0xc80
[ 46.324551] devm_snd_soc_register_card+0x43/0x90
[ 46.329798] mc_probe+0x982/0xfe0 [snd_soc_sof_sdw]
[ 46.335219] platform_probe+0x3c/0xa0
[ 46.339420] really_probe+0xde/0x390
[ 46.343532] __driver_probe_device+0x78/0x180
[ 46.348430] driver_probe_device+0x1e/0x90
[ 46.353065] __driver_attach+0x9f/0x1f0
[ 46.357437] bus_for_each_dev+0x78/0xc0
[ 46.361812] bus_add_driver+0x1ac/0x200
[ 46.366716] driver_register+0x8f/0xf0
[ 46.371528] do_one_initcall+0x58/0x310
[ 46.376424] do_init_module+0x4c/0x1f0
[ 46.381239] __do_sys_finit_module+0xb4/0x130
[ 46.386665] do_syscall_64+0x38/0x90
[ 46.391299] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 46.397416]
-> #1 (client_mutex){+.+.}-{3:3}:
[ 46.404307] __mutex_lock+0x94/0x920
[ 46.408941] snd_soc_add_component+0x24/0x2c0
[ 46.414345] devm_snd_soc_register_component+0x54/0xa0
[ 46.420522] cs35l56_common_probe+0x280/0x370 [snd_soc_cs35l56]
[ 46.427487] cs35l56_sdw_probe+0xf4/0x170 [snd_soc_cs35l56_sdw]
[ 46.434442] sdw_drv_probe+0x80/0x1a0
[ 46.439136] really_probe+0xde/0x390
[ 46.443738] __driver_probe_device+0x78/0x180
[ 46.449120] driver_probe_device+0x1e/0x90
[ 46.454247] __driver_attach+0x9f/0x1f0
[ 46.459106] bus_for_each_dev+0x78/0xc0
[ 46.463971] bus_add_driver+0x1ac/0x200
[ 46.468825] driver_register+0x8f/0xf0
[ 46.473592] do_one_initcall+0x58/0x310
[ 46.478441] do_init_module+0x4c/0x1f0
[ 46.483202] __do_sys_finit_module+0xb4/0x130
[ 46.488572] do_syscall_64+0x38/0x90
[ 46.493158] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 46.499229]
-> #0 (&slave->sdw_dev_lock){+.+.}-{3:3}:
[ 46.506737] __lock_acquire+0x1121/0x1df0
[ 46.511765] lock_acquire+0xd5/0x300
[ 46.516360] __mutex_lock+0x94/0x920
[ 46.520949] sdw_update_slave_status+0x26/0x70
[ 46.526409] sdw_clear_slave_status+0xd8/0xe0
[ 46.531783] intel_resume_runtime+0x139/0x2a0
[ 46.537155] __rpm_callback+0x41/0x120
[ 46.541919] rpm_callback+0x5d/0x70
[ 46.546422] rpm_resume+0x531/0x7e0
[ 46.550920] __pm_runtime_resume+0x4a/0x80
[ 46.556024] snd_soc_pcm_component_pm_runtime_get+0x2f/0xc0
[ 46.562611] __soc_pcm_open+0x62/0x520
[ 46.567375] dpcm_be_dai_startup+0x116/0x210
[ 46.572661] dpcm_fe_dai_open+0xf7/0x830
[ 46.577597] snd_pcm_open_substream+0x54a/0x8b0
[ 46.583145] snd_pcm_open.part.0+0xdc/0x200
[ 46.588341] snd_pcm_playback_open+0x51/0x80
[ 46.593625] chrdev_open+0xc0/0x250
[ 46.598129] do_dentry_open+0x15f/0x430
[ 46.602981] path_openat+0x75e/0xa80
[ 46.607575] do_filp_open+0xb2/0x160
[ 46.612162] do_sys_openat2+0x9a/0x160
[ 46.616922] __x64_sys_openat+0x53/0xa0
[ 46.621767] do_syscall_64+0x38/0x90
[ 46.626352] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 46.632414]
other info that might help us debug this:[ 46.641862] Chain exists of:
&slave->sdw_dev_lock --> &card->controls_rwsem --> &card->pcm_mutex[ 46.655145] Possible unsafe locking scenario:[ 46.662048] CPU0 CPU1
[ 46.667080] ---- ----
[ 46.672108] lock(&card->pcm_mutex);
[ 46.676267] lock(&card->controls_rwsem);
[ 46.683382] lock(&card->pcm_mutex);
[ 46.690063] lock(&slave->sdw_dev_lock);
[ 46.694574]
*** DEADLOCK ***[ 46.701942] 2 locks held by mpg123/1130:
[ 46.706356] #0: ffff8b4457b22b90 (&pcm->open_mutex){+.+.}-{3:3}, at: snd_pcm_open.part.0+0xc9/0x200
[ 46.715999] #1: ffffffffc1455310 (&card->pcm_mutex){+.+.}-{3:3}, at: dpcm_fe_dai_open+0x49/0x830
[ 46.725390]
stack backtrace:
[ 46.730752] CPU: 0 PID: 1130 Comm: mpg123 Tainted: G E 6.1.0-rc4-jamerson #1
[ 46.739703] Hardware name: AAEON UP-WHL01/UP-WHL01, BIOS UPW1AM19 11/10/2020
[ 46.747270] Call Trace:
[ 46.750239] <TASK>
[ 46.752857] dump_stack_lvl+0x56/0x73
[ 46.757045] check_noncircular+0x102/0x120
[ 46.761664] __lock_acquire+0x1121/0x1df0
[ 46.766197] lock_acquire+0xd5/0x300
[ 46.770292] ? sdw_update_slave_status+0x26/0x70
[ 46.775432] ? lock_is_held_type+0xe2/0x140
[ 46.780143] __mutex_lock+0x94/0x920
[ 46.784241] ? sdw_update_slave_status+0x26/0x70
[ 46.789387] ? find_held_lock+0x2b/0x80
[ 46.793750] ? sdw_update_slave_status+0x26/0x70
[ 46.798894] ? lock_release+0x147/0x2f0
[ 46.803262] ? lockdep_init_map_type+0x47/0x250
[ 46.808315] ? sdw_update_slave_status+0x26/0x70
[ 46.813456] sdw_update_slave_status+0x26/0x70
[ 46.818422] sdw_clear_slave_status+0xd8/0xe0
[ 46.823302] ? pm_generic_runtime_suspend+0x30/0x30
[ 46.828706] intel_resume_runtime+0x139/0x2a0
[ 46.833583] ? _raw_spin_unlock_irq+0x24/0x50
[ 46.838462] ? pm_generic_runtime_suspend+0x30/0x30
[ 46.843866] __rpm_callback+0x41/0x120
[ 46.848142] ? pm_generic_runtime_suspend+0x30/0x30
[ 46.853550] rpm_callback+0x5d/0x70
[ 46.857568] rpm_resume+0x531/0x7e0
[ 46.861578] ? _raw_spin_lock_irqsave+0x62/0x70
[ 46.866634] __pm_runtime_resume+0x4a/0x80
[ 46.871258] snd_soc_pcm_component_pm_runtime_get+0x2f/0xc0
[ 46.877358] __soc_pcm_open+0x62/0x520
[ 46.881634] ? dpcm_add_paths.isra.0+0x35d/0x4c0
[ 46.886784] dpcm_be_dai_startup+0x116/0x210
[ 46.891592] dpcm_fe_dai_open+0xf7/0x830
[ 46.896046] ? debug_mutex_init+0x33/0x50
[ 46.900591] snd_pcm_open_substream+0x54a/0x8b0
[ 46.905658] snd_pcm_open.part.0+0xdc/0x200
[ 46.910376] ? wake_up_q+0x90/0x90
[ 46.914312] snd_pcm_playback_open+0x51/0x80
[ 46.919118] chrdev_open+0xc0/0x250
[ 46.923147] ? cdev_device_add+0x90/0x90
[ 46.927608] do_dentry_open+0x15f/0x430
[ 46.931976] path_openat+0x75e/0xa80
[ 46.936086] do_filp_open+0xb2/0x160
[ 46.940194] ? lock_release+0x147/0x2f0
[ 46.944563] ? _raw_spin_unlock+0x29/0x50
[ 46.949101] do_sys_openat2+0x9a/0x160
[ 46.953377] __x64_sys_openat+0x53/0xa0
[ 46.957733] do_syscall_64+0x38/0x90
[ 46.961829] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 46.967402] RIP: 0033:0x7fa6397ccd3b
[ 46.971506] Code: 25 00 00 41 00 3d 00 00 41 00 74 4b 64 8b 04 25 18 00 00 00 85 c0 75 67 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 91 00 00 00 48 8b 4c 24 28 64 48 33 0c 25
[ 46.991413] RSP: 002b:00007fff838e8990 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 46.999580] RAX: ffffffffffffffda RBX: 0000000000080802 RCX: 00007fa6397ccd3b
[ 47.007311] RDX: 0000000000080802 RSI: 00007fff838e8b50 RDI: 00000000ffffff9c
[ 47.015047] RBP: 00007fff838e8b50 R08: 0000000000000000 R09: 0000000000000011
[ 47.022787] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000080802
[ 47.030539] R13: 0000000000000004 R14: 0000000000000000 R15: 00007fff838e8b50
[ 47.038289] </TASK>--- drivers/soundwire/bus_type.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
drivers/soundwire/bus_type.c +3 -6
@@ -105,20 +105,19 @@ static int sdw_drv_probe(struct device *dev)if (ret)return ret; -mutex_lock (&slave->sdw_dev_lock); - ret = drv->probe (slave, id);if (ret) { name = drv->name;if (!name) name = drv->driver.name; -mutex_unlock (&slave->sdw_dev_lock);dev_err (dev,"Probe of %s failed: %d\n" , name, ret);dev_pm_domain_detach (dev, false);return ret; } +mutex_lock (&slave->sdw_dev_lock); +/* device is probed so let's read the properties now */ if (drv->ops && drv->ops->read_prop) drv->ops->read_prop (slave);
@@ -167,14 +166,12 @@ static int sdw_drv_remove(struct device *dev)int ret =0 ;mutex_lock (&slave->sdw_dev_lock); - slave->probed = false; +mutex_unlock (&slave->sdw_dev_lock);if (drv->remove) ret = drv->remove (slave); -mutex_unlock (&slave->sdw_dev_lock); -dev_pm_domain_detach (dev, false);return ret;
Signature · 1 line
2.39.2