5.10.173-rc1 review
Subsystems (7)
Greg Kroah-Hartman
maintainercover 5.10.173-rc1 review
This is the start of the stable review cycle for the 5.10.173 release. There are 529 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 12 Mar 2023 13:36:38 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.173-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.10.173-rc1
Stefan Haberland <[email protected]>
s390/dasd: add missing discipline function
Yang Yingliang <[email protected]>
usb: gadget: uvc: fix missing mutex_unlock() if kstrtou8() fails
Miaoqian Lin <[email protected]>
malidp: Fix NULL vs IS_ERR() checking
Sreekanth Reddy <[email protected]>
scsi: mpt3sas: Remove usage of dma_get_required_mask() API
Sreekanth Reddy <[email protected]>
scsi: mpt3sas: re-do lost mpt3sas DMA mask fix
Sreekanth Reddy <[email protected]>
scsi: mpt3sas: Don't change DMA mask while reallocating pools
Salvatore Bonaccorso <[email protected]>
Revert "scsi: mpt3sas: Fix return value check of dma_get_required_mask()"
Ricardo Ribalda <[email protected]>
media: uvcvideo: Fix race condition with usb_kill_urb
Ricardo Ribalda <[email protected]>
media: uvcvideo: Provide sync and async uvc_ctrl_status_event
Harshit Mogalapalli <[email protected]>
drm/virtio: Fix error code in virtio_gpu_object_shmem_init()
Kuniyuki Iwashima <[email protected]>
tcp: Fix listen() regression in 5.10.163
Nguyen Dinh Phi <[email protected]>
Bluetooth: hci_sock: purge socket queues in the destruct() callback
Imre Deak <[email protected]>
drm/display/dp_mst: Fix down message handling after a packet reception error
Imre Deak <[email protected]>
drm/display/dp_mst: Fix down/up message handling after sink disconnect
Linus Torvalds <[email protected]>
x86/resctl: fix scheduler confusion with 'current'
Valentin Schneider <[email protected]>
x86/resctrl: Apply READ_ONCE/WRITE_ONCE to task_struct.{rmid,closid}Jakub Kicinski <[email protected]>
net: tls: avoid hanging tasks on the tx_lock
Richard Fitzgerald <[email protected]>
soundwire: cadence: Drain the RX FIFO after an IO timeout
Richard Fitzgerald <[email protected]>
soundwire: cadence: Remove wasted space in response_buf
Jiapeng Chong <[email protected]>
phy: rockchip-typec: Fix unsigned comparison with less than zero
Mengyuan Lou <[email protected]>
PCI: Add ACS quirk for Wangxun NICs
Huacai Chen <[email protected]>
PCI: loongson: Add more devices that need MRRS quirk
Greg Kroah-Hartman <[email protected]>
kernel/fail_function: fix memory leak with using debugfs_lookup()
Mika Westerberg <[email protected]>
PCI: Take other bus devices into account when distributing resources
Mika Westerberg <[email protected]>
PCI: Align extra resources for hotplug bridges properly
Daniel Scally <[email protected]>
usb: gadget: uvc: Make bSourceID read/write
Daniel Scally <[email protected]>
usb: uvc: Enumerate valid values for color matching
Kees Cook <[email protected]>
USB: ene_usb6250: Allocate enough memory for full object
Kees Cook <[email protected]>
usb: host: xhci: mvebu: Iterate over array indexes instead of using pointer math
Huacai Chen <[email protected]>
PCI: loongson: Prevent LS7A MRRS increases
Harshit Mogalapalli <[email protected]>
iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_config_word()
Harshit Mogalapalli <[email protected]>
iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_status_word()
Yulong Zhang <[email protected]>
tools/iio/iio_utils:fix memory leak
Alexander Usyskin <[email protected]>
mei: bus-fixup:upon error print return values of send and receive
Isaac True <[email protected]>
serial: sc16is7xx: setup GPIO controller later in probe
Sherry Sun <[email protected]>
tty: serial: fsl_lpuart: disable the CTS when send break signal
Sven Schnelle <[email protected]>
tty: fix out-of-bounds access in tty_driver_lookup_tty()
Yuan Can <[email protected]>
staging: emxx_udc: Add checks for dma_alloc_coherent()
Kees Cook <[email protected]>
media: uvcvideo: Silence memcpy() run-time false positive warnings
Ricardo Ribalda <[email protected]>
media: uvcvideo: Quirk for autosuspend in Logitech B910 and C910
Guenter Roeck <[email protected]>
media: uvcvideo: Handle errors from calls to usb_string
Ricardo Ribalda <[email protected]>
media: uvcvideo: Handle cameras with invalid descriptors
Dean Luick <[email protected]>
IB/hfi1: Update RMT size calculation
Liang He <[email protected]>
mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak
Souradeep Chowdhury <[email protected]>
bootconfig: Increase max nodes of bootconfig from 1024 to 8192 for DCC support
Darrell Kavanagh <[email protected]>
firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3
Jia-Ju Bai <[email protected]>
tracing: Add NULL checks for buffer in ring_buffer_free_read_page()
Randy Dunlap <[email protected]>
thermal: intel: BXT_PMIC: select REGMAP instead of depending on it
Dan Carpenter <[email protected]>
thermal: intel: quark_dts: fix error pointer dereference
Arnd Bergmann <[email protected]>
ASoC: zl38060 add gpiolib dependency
Mark Brown <[email protected]>
ASoC: zl38060: Remove spurious gpiolib select
Nuno Sá <[email protected]>
ASoC: adau7118: don't disable regulators on device unbind
Zhong Jinghua <[email protected]>
loop: loop_set_status_from_info() check before assignment
Arnd Bergmann <[email protected]>
scsi: ipr: Work around fortify-string warning
Samuel Holland <[email protected]>
rtc: sun6i: Always export the internal oscillator
George Kennedy <[email protected]>
vc_screen: modify vcs_size() handling in vcs_read()
Eric Dumazet <[email protected]>
tcp: tcp_check_req() can be called from process context
Krzysztof Kozlowski <[email protected]>
ARM: dts: spear320-hmi: correct STMPE GPIO compatible
Pedro Tammela <[email protected]>
net/sched: act_sample: fix action bind logic
Fedor Pchelkin <[email protected]>
nfc: fix memory leak of se_io context in nfc_genl_se_io
Maor Dickman <[email protected]>
net/mlx5: Geneve, Fix handling of Geneve object id as error code
Zhengchao Shao <[email protected]>
9p/rdma: unmap receive dma buffer in rdma_request()/post_recv()
Juergen Gross <[email protected]>
9p/xen: fix connection sequence
Juergen Gross <[email protected]>
9p/xen: fix version parsing
Eric Dumazet <[email protected]>
net: fix __dev_kfree_skb_any() vs drop monitor
Xin Long <[email protected]>
sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop
Lu Wei <[email protected]>
ipv6: Add lwtunnel encap size of all siblings in nexthop calculation
Florian Westphal <[email protected]>
netfilter: ebtables: fix table blob use-after-free
Hangyu Hua <[email protected]>
netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack()
Li Hua <[email protected]>
watchdog: pcwd_usb: Fix attempting to access uninitialized memory
Chen Jun <[email protected]>
watchdog: Fix kmemleak in watchdog_cdev_register
ruanjinjie <[email protected]>
watchdog: at91sam9_wdt: use devm_request_irq to avoid missing free_irq() in error path
Ammar Faizi <[email protected]>
x86: um: vdso: Add '%rcx' and '%r11' to the syscall clobber list
Zhihao Cheng <[email protected]>
ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed
Zhihao Cheng <[email protected]>
ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
Zhihao Cheng <[email protected]>
ubi: fastmap: Fix missed fm_anchor PEB in wear-leveling after disabling fastmap
Zhihao Cheng <[email protected]>
ubifs: ubifs_writepage: Mark page dirty after writing inode failed
Zhihao Cheng <[email protected]>
ubifs: dirty_cow_znode: Fix memleak in error handling path
Zhihao Cheng <[email protected]>
ubifs: Re-statistic cleaned znode count if commit failed
Yang Yingliang <[email protected]>
ubi: Fix possible null-ptr-deref in ubi_free_volume()
Li Zetao <[email protected]>
ubifs: Fix memory leak in alloc_wbufs()
Li Zetao <[email protected]>
ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume()
Li Zetao <[email protected]>
ubi: Fix use-after-free when volume resizing failed
Zhihao Cheng <[email protected]>
ubifs: Reserve one leb for each journal head while doing budget
Zhihao Cheng <[email protected]>
ubifs: do_rename: Fix wrong space budget when target inode's nlink > 1
Zhihao Cheng <[email protected]>
ubifs: Fix wrong dirty space budget for dirty inode
Zhihao Cheng <[email protected]>
ubifs: Rectify space budget for ubifs_xrename()
Zhihao Cheng <[email protected]>
ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted
Li Hua <[email protected]>
ubifs: Fix build errors as symbol undefined
George Kennedy <[email protected]>
ubi: ensure that VID header offset + VID header size <= alloc, size
Xiang Yang <[email protected]>
um: vector: Fix memory leak in vector_config
Alexander Potapenko <[email protected]>
fs: f2fs: initialize fsdata in pagecache_write()
Eric Biggers <[email protected]>
f2fs: use memcpy_{to,from}_page() where possible
Fabrice Gasnier <[email protected]>
pwm: stm32-lp: fix the check on arr and cmp registers update
Emil Renner Berthing <[email protected]>
pwm: sifive: Always let the first pwm_apply_state succeed
Uwe Kleine-König <[email protected]>
pwm: sifive: Reduce time the controller lock is held
Miaoqian Lin <[email protected]>
objtool: Fix memory leak in create_static_call_sections()
Liu Shixin via Jfs-discussion <[email protected]>
fs/jfs: fix shift exponent db_agl2size negative
Jamal Hadi Salim <[email protected]>
net/sched: Retire tcindex classifier
Dmitry Goncharov <[email protected]>
kbuild: Port silent mode detection to future gnu make.
Jonas Karlman <[email protected]>
pinctrl: rockchip: fix reading pull type on rk3568
Jonas Karlman <[email protected]>
pinctrl: rockchip: fix mux route data for rk3568
Arnd Bergmann <[email protected]>
wifi: ath9k: use proper statements in conditionals
Robert Marko <[email protected]>
arm64: dts: qcom: ipq8074: fix Gen2 PCIe QMP PHY
Jani Nikula <[email protected]>
drm/edid: fix AVI infoframe aspect ratio handling
Mark Hawrylak <[email protected]>
drm/radeon: Fix eDP for single-display iMac11,2
Mavroudis Chatzilaridis <[email protected]>
drm/i915/quirks: Add inverted backlight quirk for HP 14-r206nv
Steve Sistare <[email protected]>
vfio/type1: prevent underflow of locked_vm via exec()
Damien Le Moal <[email protected]>
PCI: Avoid FLR for AMD FCH AHCI adapters
Lukas Wunner <[email protected]>
PCI: hotplug: Allow marking devices as disconnected during bind/unbind
Lukas Wunner <[email protected]>
PCI/PM: Observe reset delay irrespective of bridge_d3
Andy Chiu <[email protected]>
riscv: jump_label: Fixup unaligned arch_static_branch function
Tomas Henzl <[email protected]>
scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()
Tomas Henzl <[email protected]>
scsi: ses: Fix possible desc_ptr out-of-bounds accesses
Tomas Henzl <[email protected]>
scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses
Tomas Henzl <[email protected]>
scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()
James Bottomley <[email protected]>
scsi: ses: Don't attach if enclosure has no components
Quinn Tran <[email protected]>
scsi: qla2xxx: Fix erroneous link down
Arun Easi <[email protected]>
scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests
Quinn Tran <[email protected]>
scsi: qla2xxx: Fix link failure in NPIV environment
Mukesh Ojha <[email protected]>
ring-buffer: Handle race between rb_move_tail and rb_check_pages
Steven Rostedt <[email protected]>
ktest.pl: Add RUN_TIMEOUT option with default unlimited
Steven Rostedt <[email protected]>
ktest.pl: Fix missing "end_monitor" when machine check fails
Steven Rostedt <[email protected]>
ktest.pl: Give back console on Ctrt^C on monitor
Yin Fengwei <[email protected]>
mm/thp: check and bail out if page in deferred queue already
Johannes Weiner <[email protected]>
mm: memcontrol: deprecate charge moving
John Ogness <[email protected]>
docs: gdbmacros: print newest record
Chen-Yu Tsai <[email protected]>
remoteproc/mtk_scp: Move clk ops outside send_lock
Sakari Ailus <[email protected]>
media: ipu3-cio2: Fix PM runtime usage_count in driver unbind
Elvira Khabirova <[email protected]>
mips: fix syscall_get_nr
Dan Williams <[email protected]>
dax/kmem: Fix leak of memory-hotplug resources
Al Viro <[email protected]>
alpha: fix FEN fault handling
Ilya Dryomov <[email protected]>
rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails
Krzysztof Kozlowski <[email protected]>
ARM: dts: exynos: correct TMU phandle in Odroid HC1
Krzysztof Kozlowski <[email protected]>
ARM: dts: exynos: correct TMU phandle in Odroid XU
Krzysztof Kozlowski <[email protected]>
ARM: dts: exynos: correct TMU phandle in Exynos5250
Krzysztof Kozlowski <[email protected]>
ARM: dts: exynos: correct TMU phandle in Odroid XU3 family
Krzysztof Kozlowski <[email protected]>
ARM: dts: exynos: correct TMU phandle in Exynos4
Krzysztof Kozlowski <[email protected]>
ARM: dts: exynos: correct TMU phandle in Exynos4210
Mikulas Patocka <[email protected]>
dm flakey: don't corrupt the zero page
Mikulas Patocka <[email protected]>
dm flakey: fix logic when corrupting a bio
Srinivas Pandruvada <[email protected]>
thermal: intel: powerclamp: Fix cur_state for multi package system
Alexander Wetzel <[email protected]>
wifi: cfg80211: Fix use after free for wext
Bitterblue Smith <[email protected]>
wifi: rtl8xxxu: Use a longer retry limit of 48
Pingfan Liu <[email protected]>
dm: add cond_resched() to dm_wq_work()
Louis Rannou <[email protected]>
mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type
Jun Nie <[email protected]>
ext4: refuse to create ea block when umounted
Jun Nie <[email protected]>
ext4: optimize ea_inode block expansion
Zhihao Cheng <[email protected]>
jbd2: fix data missing when reusing bh which is ready to be checkpointed
Łukasz Stelmach <[email protected]>
ALSA: hda/realtek: Add quirk for HP EliteDesk 800 G6 Tower PC
Dmitry Fomin <[email protected]>
ALSA: ice1712: Do not left ice->gpio_mutex locked in aureon_add_controls()
Jens Axboe <[email protected]>
io_uring/poll: allow some retries for poll triggering spuriously
David Lamparter <[email protected]>
io_uring: remove MSG_NOSIGNAL from recvmsg
Pavel Begunkov <[email protected]>
io_uring/rsrc: disallow multi-source reg buffers
Jens Axboe <[email protected]>
io_uring: add a conditional reschedule to the IOPOLL cancelation loop
Jens Axboe <[email protected]>
io_uring: mark task TASK_RUNNING before handling resume/task work
Jens Axboe <[email protected]>
io_uring: handle TIF_NOTIFY_RESUME when checking for task_work
Johan Hovold <[email protected]>
irqdomain: Drop bogus fwspec-mapping error handling
Johan Hovold <[email protected]>
irqdomain: Fix disassociation race
Johan Hovold <[email protected]>
irqdomain: Fix association race
Roberto Sassu <[email protected]>
ima: Align ima_file_mmap() parameters with mmap_file LSM hook
Jens Axboe <[email protected]>
brd: return 0/-error from brd_insert_page()
KP Singh <[email protected]>
Documentation/hw-vuln: Document the interaction between IBRS and STIBP
KP Singh <[email protected]>
x86/speculation: Allow enabling STIBP with legacy IBRS
Borislav Petkov (AMD) <[email protected]>
x86/microcode/AMD: Fix mixed steppings support
Borislav Petkov (AMD) <[email protected]>
x86/microcode/AMD: Add a @cpu parameter to the reloading functions
Borislav Petkov (AMD) <[email protected]>
x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter
Yang Jihong <[email protected]>
x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range
Yang Jihong <[email protected]>
x86/kprobes: Fix __recover_optprobed_insn check optimizing logic
Sean Christopherson <[email protected]>
x86/reboot: Disable SVM, not just VMX, when stopping CPUs
Sean Christopherson <[email protected]>
x86/reboot: Disable virtualization in an emergency if SVM is supported
Sean Christopherson <[email protected]>
x86/crash: Disable virt in core NMI crash handler to avoid double shootdown
Sean Christopherson <[email protected]>
x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows)
Nico Boehr <[email protected]>
KVM: s390: disable migration mode when dirty tracking is disabled
Sean Christopherson <[email protected]>
KVM: x86: Inject #GP if WRMSR sets reserved bits in APIC Self-IPI
Sean Christopherson <[email protected]>
KVM: Destroy target device if coalesced MMIO unregistration fails
Jan Kara <[email protected]>
udf: Fix file corruption when appending just after end of preallocated extent
Jan Kara <[email protected]>
udf: Detect system inodes linked into directory hierarchy
Jan Kara <[email protected]>
udf: Preserve link count of system files
Jan Kara <[email protected]>
udf: Do not update file length for failed writes to inline files
Jan Kara <[email protected]>
udf: Do not bother merging very long extents
Jan Kara <[email protected]>
udf: Truncate added extents on failed expansion
Heming Zhao via Ocfs2-devel <[email protected]>
ocfs2: fix non-auto defrag path not working issue
Heming Zhao via Ocfs2-devel <[email protected]>
ocfs2: fix defrag path triggering jbd2 ASSERT
Eric Biggers <[email protected]>
f2fs: fix cgroup writeback accounting with fs-layer encryption
Eric Biggers <[email protected]>
f2fs: fix information leak in f2fs_move_inline_dirents()
Yuezhang Mo <[email protected]>
exfat: fix inode->i_blocks for non-512 byte sector size device
Sungjong Seo <[email protected]>
exfat: redefine DIR_DELETED as the bad cluster number
Yuezhang Mo <[email protected]>
exfat: fix unexpected EOF while reading dir
Yuezhang Mo <[email protected]>
exfat: fix reporting fs error when reading dir beyond EOF
Dongliang Mu <[email protected]>
fs: hfsplus: fix UAF issue in hfsplus_put_super
Liu Shixin <[email protected]>
hfs: fix missing hfs_bnode_get() in __hfs_bnode_create
Krzysztof Kozlowski <[email protected]>
ARM: dts: exynos: correct HDMI phy compatible in Exynos4
Volker Lendecke <[email protected]>
cifs: Fix uninitialized memory read in smb3_qfs_tcon()
Vasily Gorbik <[email protected]>
s390/kprobes: fix current_kprobe never cleared after kprobes reenter
Vasily Gorbik <[email protected]>
s390/kprobes: fix irq mask clobbering on kprobe reenter from post_handler
Ilya Leoshkevich <[email protected]>
s390: discard .interp section
Gerald Schaefer <[email protected]>
s390/extmem: return correct segment type in __segment_load()
Corey Minyard <[email protected]>
ipmi_ssif: Rename idle state and check
Johan Hovold <[email protected]>
rtc: pm8xxx: fix set-alarm race
Alper Nebi Yasak <[email protected]>
firmware: coreboot: framebuffer: Ignore reserved pixel color bits
Jun ASAKA <[email protected]>
wifi: rtl8xxxu: fixing transmisison failure for rtl8192eu
Jeff Layton <[email protected]>
nfsd: zero out pointers after putting nfsd_files on COPY setup error
Mike Snitzer <[email protected]>
dm cache: add cond_resched() to various workqueue loops
Mike Snitzer <[email protected]>
dm thin: add cond_resched() to various workqueue loops
Darrell Kavanagh <[email protected]>
drm: panel-orientation-quirks: Add quirk for Lenovo IdeaPad Duet 3 10IGL5
Bastien Nocera <[email protected]>
HID: logitech-hidpp: Don't restart communication if not necessary
Claudiu Beznea <[email protected]>
pinctrl: at91: use devm_kasprintf() to avoid potential leaks
Robin Murphy <[email protected]>
hwmon: (coretemp) Simplify platform device handling
Andreas Gruenbacher <[email protected]>
gfs2: Improve gfs2_make_fs_rw error handling
Kees Cook <[email protected]>
regulator: s5m8767: Bounds check id indexing into arrays
Kees Cook <[email protected]>
regulator: max77802: Bounds check regulator id against opmode
Kees Cook <[email protected]>
ASoC: kirkwood: Iterate over array indexes instead of using pointer math
Jakob Koschel <[email protected]>
docs/scripts/gdb: add necessary make scripts_gdb step
Jiasheng Jiang <[email protected]>
drm/msm/dsi: Add missing check for alloc_ordered_workqueue
Konstantin Meskhidze <[email protected]>
drm: amd: display: Fix memory leakage
Liwei Song <[email protected]>
drm/radeon: free iio for atombios when driver shutdown
Carlo Caione <[email protected]>
drm/tiny: ili9486: Do not assume 8-bit only SPI controllers
Jingyuan Liang <[email protected]>
HID: Add Mapping for System Microphone Mute
Tomi Valkeinen <[email protected]>
drm/omap: dsi: Fix excessive stack usage
Roman Li <[email protected]>
drm/amd/display: Fix potential null-deref in dm_resume
Moises Cardona <[email protected]>
Bluetooth: btusb: Add VID:PID 13d3:3529 for Realtek RTL8821CE
Greg Kroah-Hartman <[email protected]>
PM: EM: fix memory leak with using debugfs_lookup()
Kees Cook <[email protected]>
uaccess: Add minimum bounds check on kernel buffer size
Kees Cook <[email protected]>
coda: Avoid partial allocation of sig_inputArgs
Shay Drory <[email protected]>
net/mlx5: fw_tracer: Fix debug print
Hans de Goede <[email protected]>
ACPI: video: Fix Lenovo Ideapad Z570 DMI match
Lorenzo Bianconi <[email protected]>
wifi: mt76: dma: free rx_head in mt76_dma_rx_cleanup
Michael Schmitz <[email protected]>
m68k: Check syscall_trace_enter() return code
Florian Fainelli <[email protected]>
net: bcmgenet: Add a check for oversized packets
Kees Cook <[email protected]>
crypto: hisilicon: Wipe entire pool on error
Feng Tang <[email protected]>
clocksource: Suspend the watchdog temporarily when high read latency detected
Mark Rutland <[email protected]>
ACPI: Don't build ACPICA with '-Os'
Jesse Brandeburg <[email protected]>
ice: add missing checks for PF vsi type
Pietro Borrello <[email protected]>
inet: fix fast path in __inet_hash_connect()
Jisoo Jang <[email protected]>
wifi: mt7601u: fix an integer underflow
Jisoo Jang <[email protected]>
wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds
Breno Leitao <[email protected]>
x86/bugs: Reset speculation control settings on init
Jann Horn <[email protected]>
timers: Prevent union confusion from unexpected restart_syscall()
Yang Li <[email protected]>
thermal: intel: Fix unsigned comparison with less than zero
Kalle Valo <[email protected]>
wifi: ath11k: debugfs: fix to work with multiple PCI devices
Zqiang <[email protected]>
rcu-tasks: Make rude RCU-Tasks work well with CPU hotplug
Paul E. McKenney <[email protected]>
rcu: Suppress smp_processor_id() complaint in synchronize_rcu_expedited_wait()
Paul E. McKenney <[email protected]>
rcu: Make RCU_LOCKDEP_WARN() avoid early lockdep checks
Jisoo Jang <[email protected]>
wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()
Minsuk Kang <[email protected]>
wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect()
Li Nan <[email protected]>
blk-iocost: fix divide by 0 error in calc_lcoefs()
Markuss Broks <[email protected]>
ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy
Jan Kara <[email protected]>
udf: Define EFSCORRUPTED error code
Bjorn Andersson <[email protected]>
rpmsg: glink: Avoid infinite loop on intent for missing channel
Tasos Sahanidis <[email protected]>
media: saa7134: Use video_unregister_device for radio_dev
Duoming Zhou <[email protected]>
media: usb: siano: Fix use after free bugs caused by do_submit_urb
Hans Verkuil <[email protected]>
media: i2c: ov7670: 0 instead of -EINVAL was returned
Duoming Zhou <[email protected]>
media: rc: Fix use-after-free bugs caused by ene_tx_irqsim()
Jai Luthra <[email protected]>
media: i2c: imx219: Fix binning for RAW8 capture
Adam Ford <[email protected]>
media: i2c: imx219: Split common registers from mode tables
Sameer Puri <[email protected]>
media: i2c: imx219: remove redundant writes
Yuan Can <[email protected]>
media: i2c: ov772x: Fix memleak in ov772x_probe()
Shang XiaoJing <[email protected]>
media: ov5675: Fix memleak in ov5675_init_controls()
Shang XiaoJing <[email protected]>
media: ov2740: Fix memleak in ov2740_init_controls()
Shang XiaoJing <[email protected]>
media: max9286: Fix memleak in max9286_v4l2_register()
Bastian Germann <[email protected]>
builddeb: clean generated package content
Nathan Chancellor <[email protected]>
powerpc: Remove linker flag from KBUILD_AFLAGS
Jiasheng Jiang <[email protected]>
media: platform: ti: Add missing check for devm_regulator_get
Gaosheng Cui <[email protected]>
media: ti: cal: fix possible memory leak in cal_ctx_create()
Sibi Sankar <[email protected]>
remoteproc: qcom_q6v5_mss: Use a carveout to authenticate modem headers
Jeff LaBundy <[email protected]>
Input: iqs269a - do not poll during ATI
Jeff LaBundy <[email protected]>
Input: iqs269a - do not poll during suspend or resume
Al Viro <[email protected]>
alpha/boot/tools/objstrip: fix the check for ELF header
Eli Cohen <[email protected]>
vdpa/mlx5: Don't clear mr struct on destroy MR
Randy Dunlap <[email protected]>
MIPS: vpe-mt: drop physical_memsize
Randy Dunlap <[email protected]>
MIPS: SMP-CPS: fix build error when HOTPLUG_CPU not set
Ganesh Goudar <[email protected]>
powerpc/eeh: Set channel state after notifying the drivers
Daniel Axtens <[email protected]>
powerpc/eeh: Small refactor of eeh_handle_normal_event()
Nathan Lynch <[email protected]>
powerpc/rtas: ensure 4KB alignment for rtas_data_buf
Nathan Lynch <[email protected]>
powerpc/rtas: make all exports GPL
Nathan Lynch <[email protected]>
powerpc/pseries/lparcfg: add missing RTAS retry status handling
Nathan Lynch <[email protected]>
powerpc/pseries/lpar: add missing RTAS retry status handling
Nathan Lynch <[email protected]>
powerpc/perf/hv-24x7: add missing RTAS retry status handling
Chen-Yu Tsai <[email protected]>
clk: Honor CLK_OPS_PARENT_ENABLE in clk_core_is_enabled()
Frederic Barrat <[email protected]>
powerpc/powernv/ioda: Skip unallocated resources when mapping to PE
Dmitry Baryshkov <[email protected]>
clk: qcom: gpucc-sdm845: fix clk_dis_wait being programmed for CX GDSC
Dmitry Baryshkov <[email protected]>
clk: qcom: gpucc-sc7180: fix clk_dis_wait being programmed for CX GDSC
Luca Ellero <[email protected]>
Input: ads7846 - don't check penirq immediately for 7845
Luca Ellero <[email protected]>
Input: ads7846 - always set last command to PWRDOWN
Oleksij Rempel <[email protected]>
Input: ads7846 - convert to one message
Oleksij Rempel <[email protected]>
Input: ads7846 - convert to full duplex
Luca Ellero <[email protected]>
Input: ads7846 - don't report pressure for ads7845
Peng Fan <[email protected]>
clk: imx: avoid memory leak
Geert Uytterhoeven <[email protected]>
clk: renesas: cpg-mssr: Remove superfluous check in resume code
Alexey Khoroshilov <[email protected]>
clk: renesas: cpg-mssr: Fix use after free if cpg_mssr_common_init() failed
Masahiro Yamada <[email protected]>
linux/kconfig.h: replace IF_ENABLED() with PTR_IF() in <linux/kernel.h>
Jeff LaBundy <[email protected]>
Input: iqs269a - configure device with a single block write
Jeff LaBundy <[email protected]>
Input: iqs269a - increase interrupt handler return delay
Jeff LaBundy <[email protected]>
Input: iqs269a - drop unused device node references
Samuel Holland <[email protected]>
mtd: rawnand: sunxi: Fix the size of the last OOB region
Heiko Stuebner <[email protected]>
RISC-V: fix funct4 definition for c.jalr in parse_asm.h
Dmitry Baryshkov <[email protected]>
clk: qcom: gcc-qcs404: fix names of the DSI clocks used as parents
Dmitry Baryshkov <[email protected]>
clk: qcom: gcc-qcs404: disable gpll[04]_out_aux parents
Qiheng Lin <[email protected]>
mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read()
Arnd Bergmann <[email protected]>
objtool: add UACCESS exceptions for __tsan_volatile_read/write
Arnd Bergmann <[email protected]>
printf: fix errname.c list
Masami Hiramatsu (Google) <[email protected]>
selftests/ftrace: Fix bash specific "==" operator
Randy Dunlap <[email protected]>
sparc: allow PM configs for sparc32 COMPILE_TEST
Yicong Yang <[email protected]>
perf tools: Fix auto-complete on aarch64
Miaoqian Lin <[email protected]>
leds: led-core: Fix refcount leak in of_led_get()
Ian Rogers <[email protected]>
perf llvm: Fix inadvertent file creation
Andreas Gruenbacher <[email protected]>
gfs2: jdata writepage fix
Zhang Xiaoxu <[email protected]>
cifs: Fix warning and UAF when destroy the MR list
Zhang Xiaoxu <[email protected]>
cifs: Fix lost destroy smbd connection when MR allocate failed
Benjamin Coddington <[email protected]>
nfsd: fix race to check ls_layouts
Pietro Borrello <[email protected]>
hid: bigben_probe(): validate report count
Pietro Borrello <[email protected]>
HID: bigben: use spinlock to safely schedule workers
Pietro Borrello <[email protected]>
HID: bigben_worker() remove unneeded check on report_field
Pietro Borrello <[email protected]>
HID: bigben: use spinlock to protect concurrent accesses
Lucas Tanure <[email protected]>
ASoC: soc-dapm.h: fixup warning struct snd_pcm_substream not declared
Christophe JAILLET <[email protected]>
spi: synquacer: Fix timeout handling in synquacer_spi_transfer_one()
NeilBrown <[email protected]>
NFS: fix disabling of swap
Benjamin Coddington <[email protected]>
nfs4trace: fix state manager flag printing
NeilBrown <[email protected]>
NFSv4: keep state manager thread active if swap is enabled
Trond Myklebust <[email protected]>
NFS: Fix up handling of outstanding layoutcommit in nfs_update_inode()
Mike Snitzer <[email protected]>
dm: remove flush_scheduled_work() during local_exit()
Steffen Aschbacher <[email protected]>
ASoC: tlv320adcx140: fix 'ti,gpio-config' DT property init
Vadim Pasternak <[email protected]>
hwmon: (mlxreg-fan) Return zero speed for broken fan
William Zhang <[email protected]>
spi: bcm63xx-hsspi: Fix multi-bit mode setting
Álvaro Fernández Rojas <[email protected]>
spi: bcm63xx-hsspi: fix pm_runtime
Jiasheng Jiang <[email protected]>
scsi: aic94xx: Add missing check for dma_map_single()
Tomas Henzl <[email protected]>
scsi: mpt3sas: Fix a memory leak
Arnd Bergmann <[email protected]>
drm/amdgpu: fix enum odm_combine_mode mismatch
Jonathan Cormier <[email protected]>
hwmon: (ltc2945) Handle error case in ltc2945_value_store
Jerome Brunet <[email protected]>
ASoC: dt-bindings: meson: fix gx-card codec node regex
Nathan Chancellor <[email protected]>
ASoC: mchp-spdifrx: Fix uninitialized use of mr in mchp_spdifrx_hw_params()
Claudiu Beznea <[email protected]>
ASoC: mchp-spdifrx: disable all interrupts in mchp_spdifrx_dai_remove()
Claudiu Beznea <[email protected]>
ASoC: mchp-spdifrx: fix controls that works with completion mechanism
Claudiu Beznea <[email protected]>
ASoC: mchp-spdifrx: fix return value in case completion times out
Gu Shengxian <[email protected]>
ASoC: atmel: fix spelling mistakes
Claudiu Beznea <[email protected]>
ASoC: mchp-spdifrx: fix controls which rely on rsr register
Arnd Bergmann <[email protected]>
spi: dw_bt1: fix MUX_MMIO dependencies
Haibo Chen <[email protected]>
gpio: vf610: connect GPIO label to dev name
Kuninori Morimoto <[email protected]>
ASoC: soc-compress.c: fixup private_data on snd_soc_new_compress()
Nícolas F. R. A. Prado <[email protected]>
drm/mediatek: Clean dangling pointer on bind error path
ruanjinjie <[email protected]>
drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc
Rob Clark <[email protected]>
drm/mediatek: Drop unbalanced obj unref
Miles Chen <[email protected]>
drm/mediatek: Use NULL instead of 0 for NULL pointer
Xinlei Lee <[email protected]>
drm/mediatek: dsi: Reduce the time of dsi from LP11 to sending cmd
Mikko Perttunen <[email protected]>
gpu: host1x: Don't skip assigning syncpoints to channels
Guodong Liu <[email protected]>
pinctrl: mediatek: Initialize variable *buf to zero
Guodong Liu <[email protected]>
pinctrl: mediatek: Initialize variable pullen and pullup to zero
Andy Shevchenko <[email protected]>
pinctrl: bcm2835: Remove of_node_put() in bcm2835_of_gpio_ranges_fallback()
Jiasheng Jiang <[email protected]>
drm/msm/mdp5: Add check for kzalloc
Jiasheng Jiang <[email protected]>
drm/msm/dpu: Add check for pstates
Jiasheng Jiang <[email protected]>
drm/msm/dpu: Add check for cstate
Dmitry Baryshkov <[email protected]>
drm/msm: use strscpy instead of strncpy
Daniel Mentz <[email protected]>
drm/mipi-dsi: Fix byte order of 16-bit DCS set/get brightness
Dmitry Baryshkov <[email protected]>
drm/bridge: lt9611: pass a pointer to the of node
Dmitry Baryshkov <[email protected]>
drm/bridge: lt9611: fix clock calculation
Dmitry Baryshkov <[email protected]>
drm/bridge: lt9611: fix programming of video modes
Dmitry Baryshkov <[email protected]>
drm/bridge: lt9611: fix polarity programming
Dmitry Baryshkov <[email protected]>
drm/bridge: lt9611: fix HPD reenablement
Dmitry Baryshkov <[email protected]>
drm/bridge: lt9611: fix sleep mode setup
Marijn Suijten <[email protected]>
drm/msm/dpu: Disallow unallocated resources to be returned
Alexey V. Vissarionov <[email protected]>
ALSA: hda/ca0132: minor fix for allocation size
Akhil P Oommen <[email protected]>
drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup()
Shengjiu Wang <[email protected]>
ASoC: fsl_sai: initialize is_dsp_mode flag
Dave Stevenson <[email protected]>
drm/vc4: hdmi: Correct interlaced timings again
Dave Stevenson <[email protected]>
drm/vc4: hvs: Fix colour order for xRGB1555 on HVS5
Dave Stevenson <[email protected]>
drm/vc4: hvs: Set AXI panic modes
Miaoqian Lin <[email protected]>
pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups
Jianqun Xu <[email protected]>
pinctrl: rockchip: do coding style for mux route struct
Jianqun Xu <[email protected]>
pinctrl: rockchip: add support for rk3568
Miaoqian Lin <[email protected]>
pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain
Adam Skladowski <[email protected]>
pinctrl: qcom: pinctrl-msm8976: Correct function names for wcss pins
Jiasheng Jiang <[email protected]>
drm/msm/hdmi: Add missing check for alloc_ordered_workqueue
Liang He <[email protected]>
gpu: ipu-v3: common: Add of_node_put() for reference returned by of_graph_get_port_by_id()
Randolph Sapp <[email protected]>
drm: tidss: Fix pixel format definition
Dave Stevenson <[email protected]>
drm/vc4: dpi: Fix format mapping for RGB565
Dave Stevenson <[email protected]>
drm/vc4: dpi: Add option for inverting pixel clock and output enable
Yuan Can <[email protected]>
drm/vkms: Fix null-ptr-deref in vkms_release()
Yuan Can <[email protected]>
drm/bridge: megachips: Fix error handling in i2c_register_driver()
Geert Uytterhoeven <[email protected]>
drm: mxsfb: DRM_MXSFB should depend on ARCH_MXS || ARCH_MXC
Geert Uytterhoeven <[email protected]>
drm/fourcc: Add missing big-endian XRGB1555 and RGB565 formats
Shang XiaoJing <[email protected]>
drm: Fix potential null-ptr-deref due to drmm_mode_config_init()
Jiri Pirko <[email protected]>
sefltests: netdevsim: wait for devlink instance after netns removal
Roxana Nicolescu <[email protected]>
selftest: fib_tests: Always cleanup before exit
Doug Berger <[email protected]>
net: bcmgenet: fix MoCA LED control
Shigeru Yoshida <[email protected]>
l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register()
Jakub Sitnicki <[email protected]>
selftests/net: Interpret UDP_GRO cmsg data as an int value
Florian Fainelli <[email protected]>
irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts
Florian Fainelli <[email protected]>
irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts
Andrii Nakryiko <[email protected]>
bpf: Fix global subprog context argument resolution logic
Frank Jungclaus <[email protected]>
can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error
Yongqin Liu <[email protected]>
thermal/drivers/hisi: Drop second sensor hi3660
Shayne Chen <[email protected]>
wifi: mac80211: make rate u32 in sta_set_rate_info_rx()
Herbert Xu <[email protected]>
crypto: crypto4xx - Call dma_unmap_page when done
Ilya Leoshkevich <[email protected]>
selftests/bpf: Fix out-of-srctree build
Dan Carpenter <[email protected]>
wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize()
Jiasheng Jiang <[email protected]>
wifi: iwl4965: Add missing check for create_singlethread_workqueue()
Jiasheng Jiang <[email protected]>
wifi: iwl3945: Add missing check for create_singlethread_workqueue
Conor Dooley <[email protected]>
RISC-V: time: initialize hrtimer based broadcast clock event device
Randy Dunlap <[email protected]>
m68k: /proc/hardware should depend on PROC_FS
Herbert Xu <[email protected]>
crypto: rsa-pkcs1pad - Use akcipher_request_complete
Pietro Borrello <[email protected]>
rds: rds_rm_zerocopy_callback() correct order for list_add_tail()
Ilya Leoshkevich <[email protected]>
libbpf: Fix alen calculation in libbpf_nla_dump_errormsg()
Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix potential user-after-free
Qi Zheng <[email protected]>
OPP: fix error checking in opp_migrate_dentry()
Pietro Borrello <[email protected]>
tap: tap_open(): correctly initialize socket uid
Pietro Borrello <[email protected]>
tun: tun_chr_open(): correctly initialize socket uid
Pietro Borrello <[email protected]>
net: add sock_init_data_uid()
Vasily Gorbik <[email protected]>
s390/vmem: fix empty page tables cleanup under KASAN
Miaoqian Lin <[email protected]>
irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe
Miaoqian Lin <[email protected]>
irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe
Miaoqian Lin <[email protected]>
irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains
Miaoqian Lin <[email protected]>
irqchip: Fix refcount leak in platform_irqchip_probe
Jack Morgenstein <[email protected]>
net/mlx5: Enhance debug print in page allocation failure
Tonghao Zhang <[email protected]>
bpftool: profile online CPUs instead of possible
Tom Lendacky <[email protected]>
crypto: ccp - Flush the SEV-ES TMR memory before giving it to firmware
Peter Gonda <[email protected]>
crypto: ccp - Refactor out sev_fw_alloc()
Hans de Goede <[email protected]>
leds: led-class: Add missing put_device() to led_put()
Herbert Xu <[email protected]>
crypto: xts - Handle EBUSY correctly
Wang Qing <[email protected]>
net: ethernet: ti: add missing of_node_put before return
Grygorii Strashko <[email protected]>
net: ethernet: ti: am65-cpsw: handle deferred probe with dev_err_probe()
Grygorii Strashko <[email protected]>
net: ethernet: ti: am65-cpsw: fix tx csum offload for multi mac mode
Ashok Raj <[email protected]>
x86/microcode: Adjust late loading result reporting message
Ashok Raj <[email protected]>
x86/microcode: Check CPU capabilities after late microcode update correctly
Ashok Raj <[email protected]>
x86/microcode: Add a parameter to microcode_check() to store CPU capabilities
Ashok Raj <[email protected]>
x86/microcode: Print previous version of microcode after reload
Borislav Petkov <[email protected]>
x86/microcode: Default-disable late loading
Borislav Petkov <[email protected]>
x86/microcode: Rip out the OLD_INTERFACE
Peter Zijlstra <[email protected]>
x86: Mark stop_this_cpu() __noreturn
Sebastian Andrzej Siewior <[email protected]>
x86/microcode: Replace deprecated CPU-hotplug functions.
Borislav Petkov <[email protected]>
x86/cpu: Init AP exception handling from cpu_init_secondary()
Yang Yingliang <[email protected]>
powercap: fix possible name leak in powercap_register_zone()
Herbert Xu <[email protected]>
crypto: seqiv - Handle EBUSY correctly
Herbert Xu <[email protected]>
crypto: essiv - Handle EBUSY correctly
Koba Ko <[email protected]>
crypto: ccp - Failure on re-initialization due to duplicate sysfs filename
Armin Wolf <[email protected]>
ACPI: battery: Fix missing NUL-termination with large strings
Shivani Baranwal <[email protected]>
wifi: cfg80211: Fix extended KCK key length check in nl80211_set_rekey_data()
Miaoqian Lin <[email protected]>
wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup
Minsuk Kang <[email protected]>
wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()
Fedor Pchelkin <[email protected]>
wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
Pavel Skripkin <[email protected]>
ath9k: htc: clean up statistics macros
Wan Jiabing <[email protected]>
ath9k: hif_usb: simplify if-if to if-else
Fedor Pchelkin <[email protected]>
wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function
Alexey Kodanev <[email protected]>
wifi: orinoco: check return value of hermes_write_wordrec()
Bitterblue Smith <[email protected]>
wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU
Dmitry Baryshkov <[email protected]>
thermal/drivers/tsens: Sort out msm8976 vs msm8956 data
Dmitry Baryshkov <[email protected]>
thermal/drivers/tsens: Add compat string for the qcom,msm8960
Konrad Dybcio <[email protected]>
thermal/drivers/qcom/tsens_v1: Enable sensor 3 on MSM8976
Dmitry Baryshkov <[email protected]>
thermal/drivers/tsens: Drop msm8976-specific defines
Daniil Tatianin <[email protected]>
ACPICA: nsrepair: handle cases without a return value correctly
David Rientjes <[email protected]>
crypto: ccp - Avoid page allocation failure warning for SEV_GET_ID2
John Allen <[email protected]>
crypto: ccp - Use kzalloc for sev ioctl interfaces to prevent kernel memory leak
Sean Christopherson <[email protected]>
crypto: ccp: Use the stack and common buffer for status commands
Sean Christopherson <[email protected]>
crypto: ccp: Use the stack for small SEV command buffers
Herbert Xu <[email protected]>
lib/mpi: Fix buffer overrun when SG is too long
Frederic Weisbecker <[email protected]>
rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()
Frederic Weisbecker <[email protected]>
rcu-tasks: Remove preemption disablement around srcu_read_[un]lock() calls
Frederic Weisbecker <[email protected]>
rcu-tasks: Improve comments explaining tasks_rcu_exit_srcu purpose
Zhen Lei <[email protected]>
genirq: Fix the return type of kstat_cpu_irqs_sum()
Mario Limonciello <[email protected]>
ACPICA: Drop port I/O validation for some regions
Eric Biggers <[email protected]>
crypto: x86/ghash - fix unaligned access in ghash_setkey()
Yang Yingliang <[email protected]>
wifi: wl3501_cs: don't call kfree_skb() under spin_lock_irqsave()
Yang Yingliang <[email protected]>
wifi: libertas: cmdresp: don't call kfree_skb() under spin_lock_irqsave()
Yang Yingliang <[email protected]>
wifi: libertas: main: don't call kfree_skb() under spin_lock_irqsave()
Yang Yingliang <[email protected]>
wifi: libertas: if_usb: don't call kfree_skb() under spin_lock_irqsave()
Yang Yingliang <[email protected]>
wifi: libertas_tf: don't call kfree_skb() under spin_lock_irqsave()
Zhengchao Shao <[email protected]>
wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()
Zhang Changzhong <[email protected]>
wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()
Zhang Changzhong <[email protected]>
wifi: wilc1000: fix potential memory leak in wilc_mac_xmit()
Zhengchao Shao <[email protected]>
wifi: ipw2200: fix memory leak in ipw_wdev_init()
Yang Yingliang <[email protected]>
wifi: ipw2x00: don't call dev_kfree_skb() under spin_lock_irqsave()
Andrii Nakryiko <[email protected]>
libbpf: Fix btf__align_of() by taking into account field offsets
Li Zetao <[email protected]>
wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()
Arnd Bergmann <[email protected]>
rtlwifi: fix -Wpointer-sign warning
Yang Yingliang <[email protected]>
wifi: rtl8xxxu: don't call dev_kfree_skb() under spin_lock_irqsave()
Zhengchao Shao <[email protected]>
wifi: libertas: fix memory leak in lbs_init_adapter()
Yang Yingliang <[email protected]>
wifi: iwlegacy: common: don't call dev_kfree_skb() under spin_lock_irqsave()
Yang Yingliang <[email protected]>
wifi: rtlwifi: rtl8723be: don't call kfree_skb() under spin_lock_irqsave()
Yang Yingliang <[email protected]>
wifi: rtlwifi: rtl8188ee: don't call kfree_skb() under spin_lock_irqsave()
Yang Yingliang <[email protected]>
wifi: rtlwifi: rtl8821ae: don't call kfree_skb() under spin_lock_irqsave()
Yuan Can <[email protected]>
wifi: rsi: Fix memory leak in rsi_coex_attach()
Martin K. Petersen <[email protected]>
block: bio-integrity: Copy flags when bio_integrity_payload is cloned
silviazhao <[email protected]>
x86/perf/zhaoxin: Add stepping check for ZXC
Pietro Borrello <[email protected]>
sched/rt: pick_next_rt_entity(): check list_entry
Dietmar Eggemann <[email protected]>
sched/deadline,rt: Remove unused parameter from pick_next_[rt|dl]_entity()
Qiheng Lin <[email protected]>
s390/dasd: Fix potential memleak in dasd_eckd_init()
Jan Höppner <[email protected]>
s390/dasd: Prepare for additional path event handling
Kemeng Shi <[email protected]>
blk-mq: correct stale comment of .get_budget
Kemeng Shi <[email protected]>
blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx
Kemeng Shi <[email protected]>
blk-mq: avoid sleep in blk_mq_alloc_request_hctx
AngeloGioacchino Del Regno <[email protected]>
arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node
Peng Fan <[email protected]>
ARM: dts: imx7s: correct iomuxc gpr mux controller cells
Samuel Holland <[email protected]>
ARM: dts: sun8i: nanopi-duo2: Fix regulator GPIO reference
Adam Ford <[email protected]>
arm64: dts: renesas: beacon-renesom: Fix gpio expander reference
Neil Armstrong <[email protected]>
arm64: dts: amlogic: meson-gxbb-kii-pro: fix led node name
Neil Armstrong <[email protected]>
arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name
Neil Armstrong <[email protected]>
arm64: dts: amlogic: meson-gx-libretech-pc: fix update button name
Neil Armstrong <[email protected]>
arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name
Neil Armstrong <[email protected]>
arm64: dts: amlogic: meson-gx: add missing unit address to rng node name
Neil Armstrong <[email protected]>
arm64: dts: amlogic: meson-gxl-s905d-sml5442tw: drop invalid clock-names property
Neil Armstrong <[email protected]>
arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible
Neil Armstrong <[email protected]>
arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name
Neil Armstrong <[email protected]>
arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name
Angus Chen <[email protected]>
ARM: imx: Call ida_simple_remove() for ida_simple_get
Krzysztof Kozlowski <[email protected]>
ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato
Vaishnav Achath <[email protected]>
arm64: dts: ti: k3-j7200: Fix wakeup pinmux range
Arnd Bergmann <[email protected]>
ARM: s3c: fix s3c64xx_set_timer_source prototype
Yang Yingliang <[email protected]>
ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init()
Christian Hewitt <[email protected]>
arm64: dts: meson: remove CPU opps below 1GHz for G12A boards
Robert Marko <[email protected]>
arm64: dts: qcom: ipq8074: correct PCIe QMP PHY output clock names
Robert Marko <[email protected]>
arm64: dts: qcom: ipq8074: fix Gen3 PCIe node
Robert Marko <[email protected]>
arm64: dts: qcom: ipq8074: correct Gen2 PCIe ranges
Robert Marko <[email protected]>
arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY
Johan Hovold <[email protected]>
arm64: dts: qcom: ipq8074: fix PCIe PHY serdes size
Shawn Guo <[email protected]>
arm64: dts: qcom: Fix IPQ8074 PCIe PHY nodes
Robert Marko <[email protected]>
arm64: dts: qcom: ipq8074: correct USB3 QMP PHY-s clock output names
Martin Blumenstingl <[email protected]>
arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address
Martin Blumenstingl <[email protected]>
arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name
Martin Blumenstingl <[email protected]>
arm64: dts: meson-gx: Fix Ethernet MAC address unit name
Krzysztof Kozlowski <[email protected]>
arm64: dts: qcom: sc7180: correct SPMI bus address cells
Krzysztof Kozlowski <[email protected]>
arm64: dts: qcom: sdm845-db845c: fix audio codec interrupt pin name
Chen-Yu Tsai <[email protected]>
arm64: dts: mediatek: mt8183: Fix systimer 13 MHz clock description
Qiheng Lin <[email protected]>
ARM: zynq: Fix refcount leak in zynq_early_slcr_init
Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: qcs404: use symbol names for PCIe resets
Chen Hui <[email protected]>
ARM: OMAP2+: Fix memory leak in realtime_counter_init()
Anders Roxell <[email protected]>
powerpc/mm: Rearrange if-else block to avoid clang warning
Pietro Borrello <[email protected]>
HID: asus: use spinlock to safely schedule workers
Pietro Borrello <[email protected]>
HID: asus: use spinlock to protect concurrent accesses
Luke D. Jones <[email protected]>
HID: asus: Remove check for same LED brightness on set
-------------
Diffstat:
Documentation/ABI/testing/configfs-usb-gadget-uvc | 2 +- Documentation/admin-guide/cgroup-v1/memory.rst | 13 +- Documentation/admin-guide/hw-vuln/spectre.rst | 21 +- Documentation/admin-guide/kdump/gdbmacros.txt | 2 +- Documentation/dev-tools/gdb-kernel-debugging.rst | 4 + .../bindings/sound/amlogic,gx-sound-card.yaml | 2 +- Documentation/virt/kvm/api.rst | 18 +- Documentation/virt/kvm/devices/vm.rst | 4 + Makefile | 15 +- arch/alpha/boot/tools/objstrip.c | 2 +- arch/alpha/kernel/traps.c | 30 +- arch/arm/boot/dts/exynos3250-rinato.dts | 2 +- arch/arm/boot/dts/exynos4-cpu-thermal.dtsi | 2 +- arch/arm/boot/dts/exynos4.dtsi | 2 +- arch/arm/boot/dts/exynos4210.dtsi | 1 - arch/arm/boot/dts/exynos5250.dtsi | 2 +- arch/arm/boot/dts/exynos5410-odroidxu.dts | 1 - arch/arm/boot/dts/exynos5420.dtsi | 2 +- arch/arm/boot/dts/exynos5422-odroidhc1.dts | 10 +- arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi | 10 +- arch/arm/boot/dts/imx7s.dtsi | 2 +- arch/arm/boot/dts/spear320-hmi.dts | 2 +- arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts | 2 +- arch/arm/mach-imx/mmdc.c | 24 +- arch/arm/mach-omap1/timer.c | 2 +- arch/arm/mach-omap2/timer.c | 1 + arch/arm/mach-s3c/s3c64xx.c | 3 +- arch/arm/mach-zynq/slcr.c | 1 + arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 4 +- arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 2 +- arch/arm64/boot/dts/amlogic/meson-g12a.dtsi | 20 - .../boot/dts/amlogic/meson-gx-libretech-pc.dtsi | 2 +- arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 6 +- arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts | 2 +- .../dts/amlogic/meson-gxl-s905d-phicomm-n1.dts | 2 +- .../boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts | 1 - arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 2 +- arch/arm64/boot/dts/mediatek/mt7622.dtsi | 1 + arch/arm64/boot/dts/mediatek/mt8183.dtsi | 12 +- arch/arm64/boot/dts/qcom/ipq8074.dtsi | 93 +- arch/arm64/boot/dts/qcom/qcs404.dtsi | 12 +- arch/arm64/boot/dts/qcom/sc7180.dtsi | 4 +- arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 2 +- .../boot/dts/renesas/beacon-renesom-baseboard.dtsi | 24 +- .../boot/dts/ti/k3-j7200-common-proc-board.dts | 2 +- arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi | 29 +- arch/m68k/68000/entry.S | 2 + arch/m68k/Kconfig.devices | 1 + arch/m68k/coldfire/entry.S | 2 + arch/m68k/kernel/entry.S | 3 + arch/mips/include/asm/syscall.h | 2 +- arch/mips/include/asm/vpe.h | 1 - arch/mips/kernel/smp-cps.c | 8 +- arch/mips/kernel/vpe-mt.c | 7 +- arch/mips/lantiq/prom.c | 6 - arch/powerpc/Makefile | 2 +- arch/powerpc/kernel/eeh_driver.c | 71 +- arch/powerpc/kernel/rtas.c | 24 +- arch/powerpc/mm/book3s64/radix_tlb.c | 11 +- arch/powerpc/perf/hv-24x7.c | 42 +- arch/powerpc/platforms/powernv/pci-ioda.c | 3 +- arch/powerpc/platforms/pseries/lpar.c | 20 +- arch/powerpc/platforms/pseries/lparcfg.c | 20 +- arch/riscv/include/asm/jump_label.h | 2 + arch/riscv/include/asm/parse_asm.h | 2 +- arch/riscv/kernel/time.c | 3 + arch/s390/kernel/kprobes.c | 4 +- arch/s390/kernel/vmlinux.lds.S | 1 + arch/s390/kvm/kvm-s390.c | 17 + arch/s390/mm/extmem.c | 12 +- arch/s390/mm/vmem.c | 6 +- arch/sparc/Kconfig | 2 +- arch/um/drivers/vector_kern.c | 1 + arch/x86/Kconfig | 15 +- arch/x86/crypto/ghash-clmulni-intel_glue.c | 6 +- arch/x86/events/zhaoxin/core.c | 8 +- arch/x86/include/asm/microcode.h | 4 +- arch/x86/include/asm/microcode_amd.h | 4 +- arch/x86/include/asm/msr-index.h | 4 + arch/x86/include/asm/processor.h | 6 +- arch/x86/include/asm/reboot.h | 2 + arch/x86/include/asm/resctrl.h | 19 +- arch/x86/include/asm/virtext.h | 16 +- arch/x86/kernel/cpu/bugs.c | 35 +- arch/x86/kernel/cpu/common.c | 75 +- arch/x86/kernel/cpu/microcode/amd.c | 53 +- arch/x86/kernel/cpu/microcode/core.c | 148 +--- arch/x86/kernel/cpu/resctrl/rdtgroup.c | 14 +- arch/x86/kernel/crash.c | 17 +- arch/x86/kernel/kprobes/opt.c | 6 +- arch/x86/kernel/process.c | 2 +- arch/x86/kernel/process_32.c | 2 +- arch/x86/kernel/process_64.c | 2 +- arch/x86/kernel/reboot.c | 88 +- arch/x86/kernel/smp.c | 6 +- arch/x86/kernel/smpboot.c | 3 +- arch/x86/kernel/sysfb_efi.c | 8 + arch/x86/kernel/traps.c | 4 +- arch/x86/kvm/lapic.c | 10 +- arch/x86/um/vdso/um_vdso.c | 12 +- block/bio-integrity.c | 1 + block/blk-iocost.c | 11 +- block/blk-mq-sched.c | 7 +- block/blk-mq.c | 3 +- crypto/essiv.c | 7 +- crypto/rsa-pkcs1pad.c | 34 +- crypto/seqiv.c | 2 +- crypto/xts.c | 8 +- drivers/acpi/acpica/Makefile | 2 +- drivers/acpi/acpica/hwvalid.c | 7 +- drivers/acpi/acpica/nsrepair.c | 12 +- drivers/acpi/battery.c | 2 +- drivers/acpi/video_detect.c | 2 +- drivers/block/brd.c | 26 +- drivers/block/loop.c | 8 +- drivers/block/rbd.c | 20 +- drivers/bluetooth/btusb.c | 4 + drivers/char/ipmi/ipmi_ssif.c | 46 +- drivers/clk/clk.c | 11 + drivers/clk/imx/clk.c | 3 +- drivers/clk/qcom/gcc-qcs404.c | 24 +- drivers/clk/qcom/gpucc-sc7180.c | 7 +- drivers/clk/qcom/gpucc-sdm845.c | 7 +- drivers/clk/renesas/renesas-cpg-mssr.c | 8 +- drivers/crypto/amcc/crypto4xx_core.c | 10 +- drivers/crypto/ccp/ccp-dmaengine.c | 21 +- drivers/crypto/ccp/sev-dev.c | 185 ++-- drivers/crypto/ccp/sev-dev.h | 1 - drivers/crypto/hisilicon/sgl.c | 3 +- drivers/dax/bus.c | 2 +- drivers/dax/kmem.c | 4 +- drivers/firmware/google/framebuffer-coreboot.c | 4 +- drivers/gpio/gpio-vf610.c | 2 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 1 + .../amd/display/dc/dml/dcn20/display_mode_vba_20.c | 8 +- .../display/dc/dml/dcn20/display_mode_vba_20v2.c | 10 +- .../amd/display/dc/dml/dcn21/display_mode_vba_21.c | 12 +- drivers/gpu/drm/arm/malidp_planes.c | 2 +- drivers/gpu/drm/bridge/lontium-lt9611.c | 65 +- .../drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c | 6 +- drivers/gpu/drm/drm_dp_mst_topology.c | 5 +- drivers/gpu/drm/drm_edid.c | 21 +- drivers/gpu/drm/drm_fourcc.c | 4 + drivers/gpu/drm/drm_mipi_dsi.c | 52 ++ drivers/gpu/drm/drm_mode_config.c | 8 +- drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 + drivers/gpu/drm/i915/display/intel_quirks.c | 2 + drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 2 + drivers/gpu/drm/mediatek/mtk_drm_drv.c | 1 + drivers/gpu/drm/mediatek/mtk_drm_gem.c | 4 +- drivers/gpu/drm/mediatek/mtk_dsi.c | 2 +- drivers/gpu/drm/msm/adreno/adreno_gpu.c | 4 +- drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 7 +- drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c | 5 + drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 5 +- drivers/gpu/drm/msm/dsi/dsi_host.c | 3 + drivers/gpu/drm/msm/hdmi/hdmi.c | 4 + drivers/gpu/drm/msm/msm_fence.c | 2 +- drivers/gpu/drm/mxsfb/Kconfig | 1 + drivers/gpu/drm/omapdrm/dss/dsi.c | 26 +- drivers/gpu/drm/radeon/atombios_encoders.c | 5 +- drivers/gpu/drm/radeon/radeon_device.c | 1 + drivers/gpu/drm/tidss/tidss_dispc.c | 4 +- drivers/gpu/drm/tiny/ili9486.c | 13 +- drivers/gpu/drm/vc4/vc4_dpi.c | 66 +- drivers/gpu/drm/vc4/vc4_hdmi.c | 5 +- drivers/gpu/drm/vc4/vc4_hvs.c | 11 + drivers/gpu/drm/vc4/vc4_plane.c | 2 + drivers/gpu/drm/vc4/vc4_regs.h | 6 + drivers/gpu/drm/virtio/virtgpu_object.c | 3 +- drivers/gpu/drm/vkms/vkms_drv.c | 3 +- drivers/gpu/host1x/hw/syncpt_hw.c | 3 - drivers/gpu/ipu-v3/ipu-common.c | 1 + drivers/hid/hid-asus.c | 38 +- drivers/hid/hid-bigbenff.c | 75 +- drivers/hid/hid-debug.c | 1 + drivers/hid/hid-input.c | 8 + drivers/hid/hid-logitech-hidpp.c | 32 +- drivers/hwmon/coretemp.c | 128 ++- drivers/hwmon/ltc2945.c | 2 + drivers/hwmon/mlxreg-fan.c | 6 + drivers/iio/accel/mma9551_core.c | 10 +- drivers/infiniband/hw/hfi1/chip.c | 59 +- drivers/input/misc/iqs269a.c | 327 +++---- drivers/input/touchscreen/ads7846.c | 473 +++++----- drivers/irqchip/irq-alpine-msi.c | 1 + drivers/irqchip/irq-bcm7120-l2.c | 3 +- drivers/irqchip/irq-brcmstb-l2.c | 6 +- drivers/irqchip/irq-mvebu-gicp.c | 1 + drivers/irqchip/irq-ti-sci-intr.c | 1 + drivers/irqchip/irqchip.c | 8 +- drivers/leds/led-class.c | 6 +- drivers/md/dm-cache-target.c | 4 + drivers/md/dm-flakey.c | 30 +- drivers/md/dm-thin.c | 2 + drivers/md/dm.c | 2 +- drivers/media/i2c/imx219.c | 257 +++--- drivers/media/i2c/max9286.c | 1 + drivers/media/i2c/ov2740.c | 4 +- drivers/media/i2c/ov5675.c | 4 +- drivers/media/i2c/ov7670.c | 2 +- drivers/media/i2c/ov772x.c | 3 +- drivers/media/pci/intel/ipu3/ipu3-cio2.c | 3 + drivers/media/pci/saa7134/saa7134-core.c | 2 +- drivers/media/platform/omap3isp/isp.c | 9 + drivers/media/platform/ti-vpe/cal.c | 4 +- drivers/media/rc/ene_ir.c | 3 +- drivers/media/usb/siano/smsusb.c | 1 + drivers/media/usb/uvc/uvc_ctrl.c | 30 +- drivers/media/usb/uvc/uvc_driver.c | 66 +- drivers/media/usb/uvc/uvc_entity.c | 2 +- drivers/media/usb/uvc/uvc_status.c | 40 +- drivers/media/usb/uvc/uvc_video.c | 15 +- drivers/media/usb/uvc/uvcvideo.h | 6 +- drivers/mfd/arizona-core.c | 2 +- drivers/mfd/pcf50633-adc.c | 7 +- drivers/misc/mei/bus-fixup.c | 8 +- drivers/mtd/nand/raw/sunxi_nand.c | 2 +- drivers/mtd/spi-nor/core.c | 9 + drivers/mtd/spi-nor/core.h | 1 + drivers/mtd/spi-nor/sfdp.c | 4 +- drivers/mtd/ubi/build.c | 7 + drivers/mtd/ubi/fastmap-wl.c | 12 +- drivers/mtd/ubi/vmt.c | 18 +- drivers/mtd/ubi/wl.c | 25 +- drivers/net/can/usb/esd_usb2.c | 4 +- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 8 + drivers/net/ethernet/broadcom/genet/bcmmii.c | 11 +- drivers/net/ethernet/intel/ice/ice_main.c | 17 +- .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +- .../net/ethernet/mellanox/mlx5/core/lib/geneve.c | 1 + .../net/ethernet/mellanox/mlx5/core/pagealloc.c | 3 +- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 79 +- drivers/net/tap.c | 2 +- drivers/net/tun.c | 2 +- drivers/net/wireless/ath/ath11k/core.h | 1 - drivers/net/wireless/ath/ath11k/debugfs.c | 48 +- drivers/net/wireless/ath/ath11k/dp_rx.c | 1 + drivers/net/wireless/ath/ath9k/hif_usb.c | 62 +- drivers/net/wireless/ath/ath9k/htc.h | 32 +- drivers/net/wireless/ath/ath9k/htc_drv_init.c | 2 + drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 10 +- drivers/net/wireless/ath/ath9k/htc_hst.c | 4 +- drivers/net/wireless/ath/ath9k/wmi.c | 1 + .../wireless/broadcom/brcm80211/brcmfmac/common.c | 7 +- .../wireless/broadcom/brcm80211/brcmfmac/core.c | 1 + .../wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 5 +- drivers/net/wireless/intel/ipw2x00/ipw2200.c | 11 +- drivers/net/wireless/intel/iwlegacy/3945-mac.c | 16 +- drivers/net/wireless/intel/iwlegacy/4965-mac.c | 12 +- drivers/net/wireless/intel/iwlegacy/common.c | 4 +- drivers/net/wireless/intersil/orinoco/hw.c | 2 + drivers/net/wireless/marvell/libertas/cmdresp.c | 2 +- drivers/net/wireless/marvell/libertas/if_usb.c | 2 +- drivers/net/wireless/marvell/libertas/main.c | 3 +- drivers/net/wireless/marvell/libertas_tf/if_usb.c | 2 +- drivers/net/wireless/marvell/mwifiex/11n.c | 6 +- drivers/net/wireless/mediatek/mt76/dma.c | 13 +- drivers/net/wireless/mediatek/mt7601u/dma.c | 3 +- drivers/net/wireless/microchip/wilc1000/netdev.c | 1 + .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_8192e.c | 5 + .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 19 +- .../net/wireless/realtek/rtlwifi/rtl8188ee/hw.c | 6 +- .../net/wireless/realtek/rtlwifi/rtl8723be/hw.c | 6 +- .../net/wireless/realtek/rtlwifi/rtl8821ae/hw.c | 6 +- .../net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 91 +- .../net/wireless/realtek/rtlwifi/rtl8821ae/table.c | 4 +- .../net/wireless/realtek/rtlwifi/rtl8821ae/table.h | 4 +- drivers/net/wireless/rsi/rsi_91x_coex.c | 1 + drivers/net/wireless/wl3501_cs.c | 2 +- drivers/nfc/st-nci/se.c | 6 + drivers/nfc/st21nfca/se.c | 6 + drivers/opp/debugfs.c | 2 +- drivers/pci/controller/pci-loongson.c | 71 +- drivers/pci/pci.c | 12 +- drivers/pci/pci.h | 43 +- drivers/pci/quirks.c | 23 + drivers/pci/setup-bus.c | 179 ++-- drivers/phy/rockchip/phy-rockchip-typec.c | 3 +- drivers/pinctrl/bcm/pinctrl-bcm2835.c | 2 - drivers/pinctrl/mediatek/pinctrl-paris.c | 4 +- drivers/pinctrl/pinctrl-at91-pio4.c | 4 +- drivers/pinctrl/pinctrl-at91.c | 2 +- drivers/pinctrl/pinctrl-ingenic.c | 3 + drivers/pinctrl/pinctrl-rockchip.c | 952 ++++++++------------- drivers/pinctrl/qcom/pinctrl-msm8976.c | 8 +- drivers/pinctrl/stm32/pinctrl-stm32.c | 1 + drivers/powercap/powercap_sys.c | 14 +- drivers/pwm/pwm-sifive.c | 16 +- drivers/pwm/pwm-stm32-lp.c | 2 +- drivers/regulator/max77802-regulator.c | 34 +- drivers/regulator/s5m8767.c | 6 +- drivers/remoteproc/mtk_scp_ipi.c | 11 +- drivers/remoteproc/qcom_q6v5_mss.c | 59 +- drivers/rpmsg/qcom_glink_native.c | 1 + drivers/rtc/rtc-pm8xxx.c | 24 +- drivers/rtc/rtc-sun6i.c | 16 +- drivers/s390/block/dasd.c | 4 +- drivers/s390/block/dasd_diag.c | 8 +- drivers/s390/block/dasd_eckd.c | 82 +- drivers/s390/block/dasd_fba.c | 8 +- drivers/s390/block/dasd_int.h | 2 +- drivers/scsi/aic94xx/aic94xx_task.c | 3 + drivers/scsi/ipr.c | 41 +- drivers/scsi/mpt3sas/mpt3sas_base.c | 23 +- drivers/scsi/qla2xxx/qla_nvme.c | 19 +- drivers/scsi/qla2xxx/qla_os.c | 9 +- drivers/scsi/ses.c | 64 +- drivers/soundwire/cadence_master.c | 43 +- drivers/soundwire/cadence_master.h | 13 +- drivers/spi/Kconfig | 1 - drivers/spi/spi-bcm63xx-hsspi.c | 19 +- drivers/spi/spi-synquacer.c | 7 +- drivers/staging/emxx_udc/emxx_udc.c | 7 +- drivers/thermal/hisi_thermal.c | 4 - drivers/thermal/intel/Kconfig | 3 +- drivers/thermal/intel/intel_powerclamp.c | 20 +- drivers/thermal/intel/intel_quark_dts_thermal.c | 12 +- drivers/thermal/intel/intel_soc_dts_iosf.c | 2 +- drivers/thermal/qcom/tsens-v1.c | 63 +- drivers/thermal/qcom/tsens.c | 6 + drivers/thermal/qcom/tsens.h | 2 +- drivers/tty/serial/fsl_lpuart.c | 24 +- drivers/tty/serial/sc16is7xx.c | 51 +- drivers/tty/tty_io.c | 8 +- drivers/tty/vt/vc_screen.c | 4 +- drivers/usb/gadget/function/uvc_configfs.c | 59 +- drivers/usb/host/xhci-mvebu.c | 2 +- drivers/usb/storage/ene_ub6250.c | 2 +- drivers/vdpa/mlx5/core/mr.c | 1 - drivers/vfio/vfio_iommu_type1.c | 41 +- drivers/watchdog/at91sam9_wdt.c | 7 +- drivers/watchdog/pcwd_usb.c | 6 +- drivers/watchdog/watchdog_dev.c | 2 +- fs/cifs/smb2ops.c | 13 +- fs/cifs/smbdirect.c | 4 +- fs/coda/upcall.c | 2 +- fs/exfat/dir.c | 7 +- fs/exfat/exfat_fs.h | 2 +- fs/exfat/file.c | 3 +- fs/exfat/inode.c | 6 +- fs/exfat/namei.c | 2 +- fs/exfat/super.c | 3 +- fs/ext4/xattr.c | 35 +- fs/f2fs/data.c | 6 +- fs/f2fs/inline.c | 28 +- fs/f2fs/super.c | 11 +- fs/f2fs/verity.c | 12 +- fs/gfs2/aops.c | 3 +- fs/gfs2/super.c | 8 +- fs/hfs/bnode.c | 1 + fs/hfsplus/super.c | 4 +- fs/jbd2/transaction.c | 50 +- fs/jfs/jfs_dmap.c | 3 +- fs/nfs/file.c | 15 +- fs/nfs/inode.c | 6 +- fs/nfs/nfs4_fs.h | 1 + fs/nfs/nfs4proc.c | 22 + fs/nfs/nfs4state.c | 40 +- fs/nfs/nfs4trace.h | 42 +- fs/nfsd/nfs4layouts.c | 4 +- fs/nfsd/nfs4proc.c | 2 + fs/ocfs2/move_extents.c | 34 +- fs/ubifs/budget.c | 9 +- fs/ubifs/dir.c | 9 +- fs/ubifs/file.c | 12 +- fs/ubifs/super.c | 17 +- fs/ubifs/tnc.c | 24 +- fs/ubifs/ubifs.h | 5 + fs/udf/file.c | 26 +- fs/udf/inode.c | 74 +- fs/udf/super.c | 1 + fs/udf/udf_i.h | 3 +- fs/udf/udf_sb.h | 2 + include/drm/drm_mipi_dsi.h | 4 + include/linux/bootconfig.h | 2 +- include/linux/ima.h | 6 +- include/linux/kernel.h | 2 + include/linux/kernel_stat.h | 2 +- include/linux/kprobes.h | 2 + include/linux/nfs_xdr.h | 2 + include/linux/pci.h | 1 + include/linux/pci_ids.h | 2 + include/linux/rcupdate.h | 11 +- include/linux/uaccess.h | 4 + include/net/sctp/structs.h | 1 + include/net/sock.h | 7 +- include/sound/soc-dapm.h | 1 + include/uapi/linux/usb/video.h | 30 + include/uapi/linux/uvcvideo.h | 2 +- io_uring/io_uring.c | 41 +- kernel/bpf/btf.c | 13 +- kernel/fail_function.c | 5 +- kernel/irq/irqdomain.c | 31 +- kernel/kprobes.c | 6 +- kernel/pid_namespace.c | 17 + kernel/power/energy_model.c | 5 +- kernel/rcu/tasks.h | 64 +- kernel/rcu/tree_exp.h | 2 + kernel/resource.c | 14 - kernel/sched/deadline.c | 5 +- kernel/sched/rt.c | 10 +- kernel/time/clocksource.c | 45 +- kernel/time/hrtimer.c | 2 + kernel/time/posix-stubs.c | 2 + kernel/time/posix-timers.c | 2 + kernel/trace/ring_buffer.c | 49 +- lib/errname.c | 22 +- lib/mpi/mpicoder.c | 3 +- mm/huge_memory.c | 3 + mm/memcontrol.c | 4 + net/9p/trans_rdma.c | 15 +- net/9p/trans_xen.c | 48 +- net/bluetooth/hci_sock.c | 11 +- net/bluetooth/l2cap_core.c | 24 - net/bluetooth/l2cap_sock.c | 8 + net/bridge/netfilter/ebtables.c | 2 +- net/core/dev.c | 4 +- net/core/sock.c | 15 +- net/ipv4/inet_connection_sock.c | 1 + net/ipv4/inet_hashtables.c | 12 +- net/ipv4/netfilter/ip_tables.c | 3 +- net/ipv4/tcp_minisocks.c | 7 +- net/ipv6/netfilter/ip6_tables.c | 3 +- net/ipv6/route.c | 11 +- net/l2tp/l2tp_ppp.c | 125 +-- net/mac80211/sta_info.c | 2 +- net/netfilter/nf_conntrack_netlink.c | 5 +- net/nfc/netlink.c | 4 + net/rds/message.c | 2 +- net/sched/Kconfig | 11 - net/sched/Makefile | 1 - net/sched/act_sample.c | 11 +- net/sched/cls_tcindex.c | 756 ---------------- net/sctp/stream_sched_prio.c | 52 +- net/sunrpc/clnt.c | 4 + net/tls/tls_sw.c | 26 +- net/wireless/nl80211.c | 2 +- net/wireless/sme.c | 31 +- scripts/package/mkdebian | 2 +- security/integrity/ima/ima_main.c | 7 +- security/security.c | 7 +- sound/pci/hda/patch_ca0132.c | 2 +- sound/pci/hda/patch_realtek.c | 1 + sound/pci/ice1712/aureon.c | 2 +- sound/soc/atmel/mchp-spdifrx.c | 344 +++++--- sound/soc/atmel/mchp-spdiftx.c | 2 +- sound/soc/atmel/tse850-pcm5142.c | 2 +- sound/soc/codecs/Kconfig | 2 +- sound/soc/codecs/adau7118.c | 19 +- sound/soc/codecs/tlv320adcx140.c | 2 +- sound/soc/fsl/fsl_sai.c | 1 + sound/soc/kirkwood/kirkwood-dma.c | 2 +- sound/soc/soc-compress.c | 2 +- tools/bpf/bpftool/prog.c | 38 +- tools/iio/iio_utils.c | 23 +- tools/lib/bpf/btf.c | 13 + tools/lib/bpf/nlattr.c | 2 +- tools/objtool/check.c | 5 + tools/perf/perf-completion.sh | 11 +- tools/perf/util/llvm-utils.c | 25 +- tools/testing/ktest/ktest.pl | 26 +- tools/testing/ktest/sample.conf | 5 + tools/testing/selftests/bpf/Makefile | 2 - .../selftests/drivers/net/netdevsim/devlink.sh | 18 + .../ftrace/test.d/ftrace/func_event_triggers.tc | 2 +- tools/testing/selftests/net/fib_tests.sh | 2 + tools/testing/selftests/net/udpgso_bench_rx.c | 6 +- virt/kvm/coalesced_mmio.c | 8 +- 470 files changed, 4823 insertions(+), 4538 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/529 HID: asus: Remove check for same LED brightness on set
From: Luke D. Jones <[email protected]>
commit 3fdcf7cdfc229346d028242e73562704ad644dd0 upstream.
Remove the early return on LED brightness set so that any controller application, daemon, or desktop may set the same brightness at any stage.
This is required because many ASUS ROG keyboards will default to max brightness on laptop resume if the LEDs were set to off before sleep.
--- drivers/hid/hid-asus.c | 3 --- 1 file changed, 3 deletions(-)
drivers/hid/hid-asus.c +0 -3
@@ -402,9 +402,6 @@ static void asus_kbd_backlight_set(struc { struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds, cdev); -if (led->brightness == brightness) -return ; - led->brightness = brightness;schedule_work (&led->work); }
Greg Kroah-Hartman
maintainerPATCH 2/529 HID: asus: use spinlock to protect concurrent accesses
In reply to Greg Kroah-HartmanFrom: Pietro Borrello <[email protected]>
commit 315c537068a13f0b5681d33dd045a912f4bece6f upstream.
asus driver has a worker that may access data concurrently. Proct the accesses using a spinlock.
--- drivers/hid/hid-asus.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-)
drivers/hid/hid-asus.c +21 -1
@@ -95,6 +95,7 @@ struct asus_kbd_leds {struct hid_device *hdev;struct work_struct work;unsigned int brightness; +spinlock_t lock;bool removed; };
@@ -402,7 +403,12 @@ static void asus_kbd_backlight_set(struc { struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds, cdev); +unsigned long flags; + +spin_lock_irqsave (&led->lock, flags); led->brightness = brightness; +spin_unlock_irqrestore (&led->lock, flags); +schedule_work (&led->work); }
@@ -410,8 +416,14 @@ static enum led_brightness asus_kbd_back { struct asus_kbd_leds *led = container_of(led_cdev, struct asus_kbd_leds, cdev); +enum led_brightness brightness; +unsigned long flags; -return led->brightness; +spin_lock_irqsave (&led->lock, flags); + brightness = led->brightness; +spin_unlock_irqrestore (&led->lock, flags); + +return brightness; }static void asus_kbd_backlight_work (struct work_struct *work)
@@ -419,11 +431,14 @@ static void asus_kbd_backlight_work(stru struct asus_kbd_leds *led = container_of(work, struct asus_kbd_leds, work);u8 buf[] = {FEATURE_KBD_REPORT_ID ,0xba ,0xc5 ,0xc4 ,0x00 };int ret; +unsigned long flags;if (led->removed)return ; +spin_lock_irqsave (&led->lock, flags); buf[4 ] = led->brightness; +spin_unlock_irqrestore (&led->lock, flags); ret =asus_kbd_set_report (led->hdev, buf,sizeof (buf));if (ret <0 )
@@ -485,6 +500,7 @@ static int asus_kbd_register_leds(struct drvdata->kbd_backlight->cdev.brightness_set = asus_kbd_backlight_set; drvdata->kbd_backlight->cdev.brightness_get = asus_kbd_backlight_get;INIT_WORK (&drvdata->kbd_backlight->work, asus_kbd_backlight_work); +spin_lock_init (&drvdata->kbd_backlight->lock); ret =devm_led_classdev_register (&hdev->dev, &drvdata->kbd_backlight->cdev);if (ret <0 ) {
@@ -1013,9 +1029,13 @@ err_stop_hw:static void asus_remove (struct hid_device *hdev) {struct asus_drvdata *drvdata =hid_get_drvdata (hdev); +unsigned long flags;if (drvdata->kbd_backlight) { +spin_lock_irqsave (&drvdata->kbd_backlight->lock, flags); drvdata->kbd_backlight->removed = true; +spin_unlock_irqrestore (&drvdata->kbd_backlight->lock, flags); +cancel_work_sync (&drvdata->kbd_backlight->work); }
Greg Kroah-Hartman
maintainerPATCH 3/529 HID: asus: use spinlock to safely schedule workers
In reply to Greg Kroah-HartmanFrom: Pietro Borrello <[email protected]>
commit 4ab3a086d10eeec1424f2e8a968827a6336203df upstream.
Use spinlocks to deal with workers introducing a wrapper asus_schedule_work(), and several spinlock checks. Otherwise, asus_kbd_backlight_set() may schedule led->work after the structure has been freed, causing a use-after-free.
--- drivers/hid/hid-asus.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/hid/hid-asus.c +11 -4
@@ -398,6 +398,16 @@ static int asus_kbd_get_functions(structreturn ret; } +static void asus_schedule_work (struct asus_kbd_leds *led) +{ +unsigned long flags; + +spin_lock_irqsave (&led->lock, flags); +if (!led->removed) +schedule_work (&led->work); +spin_unlock_irqrestore (&led->lock, flags); +} +static void asus_kbd_backlight_set (struct led_classdev *led_cdev,enum led_brightness brightness) {
@@ -409,7 +419,7 @@ static void asus_kbd_backlight_set(struc led->brightness = brightness;spin_unlock_irqrestore (&led->lock, flags); -schedule_work (&led->work); +asus_schedule_work (led); }static enum led_brightness asus_kbd_backlight_get (struct led_classdev *led_cdev)
@@ -433,9 +443,6 @@ static void asus_kbd_backlight_work(struint ret;unsigned long flags; -if (led->removed) -return ; -spin_lock_irqsave (&led->lock, flags); buf[4 ] = led->brightness;spin_unlock_irqrestore (&led->lock, flags);
Greg Kroah-Hartman
maintainerPATCH 4/529 powerpc/mm: Rearrange if-else block to avoid clang warning
In reply to Greg Kroah-HartmanFrom: Anders Roxell <[email protected]>
commit d78c8e32890ef7eca79ffd67c96022c7f9d8cce4 upstream.
Clang warns:
arch/powerpc/mm/book3s64/radix_tlb.c:1191:23: error: variable 'hstart' is uninitialized when used here
__tlbiel_va_range(hstart, hend, pid,
^~~~~~
arch/powerpc/mm/book3s64/radix_tlb.c:1191:31: error: variable 'hend' is uninitialized when used here
__tlbiel_va_range(hstart, hend, pid,
^~~~
Rework the 'if (IS_ENABLE(CONFIG_TRANSPARENT_HUGEPAGE))' so hstart/hend is always initialized to silence the warnings. That will also simplify the 'else' path. Clang is getting confused with these warnings, but the warnings is a false-positive.
--- arch/powerpc/mm/book3s64/radix_tlb.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-)
arch/powerpc/mm/book3s64/radix_tlb.c +4 -7
@@ -941,15 +941,12 @@ is_local: } } }else { -bool hflush = false; +bool hflush;unsigned long hstart, hend; -if (IS_ENABLED (CONFIG_TRANSPARENT_HUGEPAGE )) { - hstart = (start +PMD_SIZE -1 ) &PMD_MASK ; - hend = end &PMD_MASK ; -if (hstart < hend) - hflush = true; - } + hstart = (start +PMD_SIZE -1 ) &PMD_MASK ; + hend = end &PMD_MASK ; + hflush =IS_ENABLED (CONFIG_TRANSPARENT_HUGEPAGE ) && hstart < hend;if (local) { asmvolatile ("ptesync" : : :"memory" );
Greg Kroah-Hartman
maintainerPATCH 5/529 ARM: OMAP2+: Fix memory leak in realtime_counter_init()
In reply to Greg Kroah-HartmanFrom: Chen Hui <[email protected]>
[ Upstream commit ed8167cbf65c2b6ff6faeb0f96ded4d6d581e1ac ]
The "sys_clk" resource is malloced by clk_get(),
it is not released when the function return.
Message-Id: <[email protected]>
--- arch/arm/mach-omap2/timer.c | 1 + 1 file changed, 1 insertion(+)
arch/arm/mach-omap2/timer.c +1 -0
@@ -76,6 +76,7 @@ static void __init realtime_counter_init(void) } rate =clk_get_rate (sys_clk); +clk_put (sys_clk);if (soc_is_dra7xx ()) {/*
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 6/529 arm64: dts: qcom: qcs404: use symbol names for PCIe resets
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit 41a37d157a613444c97e8f71a5fb2a21116b70d7 ]
The commit e5bbbff5b7d7 ("clk: gcc-qcs404: Add PCIe resets") added names for PCIe resets, but it did not change the existing qcs404.dtsi to use these names. Do it now and use symbol names to make it easier to check and modify the dtsi in future.
--- arch/arm64/boot/dts/qcom/qcs404.dtsi | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
arch/arm64/boot/dts/qcom/qcs404.dtsi +6 -6
@@ -775,7 +775,7 @@ pcie_phy: phy@7786000 { clocks = <&gcc GCC_PCIE_0_PIPE_CLK>; resets = <&gcc GCC_PCIEPHY_0_PHY_BCR>, - <&gcc 21>; + <&gcc GCC_PCIE_0_PIPE_ARES>; reset-names = "phy", "pipe"; clock-output-names = "pcie_0_pipe_clk";
@@ -1305,12 +1305,12 @@ pcie: pci@10000000 { <&gcc GCC_PCIE_0_SLV_AXI_CLK>; clock-names = "iface", "aux", "master_bus", "slave_bus"; - resets = <&gcc 18>, - <&gcc 17>, - <&gcc 15>, - <&gcc 19>, + resets = <&gcc GCC_PCIE_0_AXI_MASTER_ARES>, + <&gcc GCC_PCIE_0_AXI_SLAVE_ARES>, + <&gcc GCC_PCIE_0_AXI_MASTER_STICKY_ARES>, + <&gcc GCC_PCIE_0_CORE_STICKY_ARES>, <&gcc GCC_PCIE_0_BCR>, - <&gcc 16>; + <&gcc GCC_PCIE_0_AHB_ARES>; reset-names = "axi_m", "axi_s", "axi_m_sticky",
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 7/529 ARM: zynq: Fix refcount leak in zynq_early_slcr_init
In reply to Greg Kroah-HartmanFrom: Qiheng Lin <[email protected]>
[ Upstream commit 9eedb910a3be0005b88c696a8552c0d4c9937cd4 ]
of_find_compatible_node() returns a node pointer with refcount incremented, we should use of_node_put() on error path.
Add missing of_node_put() to avoid refcount leak.
--- arch/arm/mach-zynq/slcr.c | 1 + 1 file changed, 1 insertion(+)
arch/arm/mach-zynq/slcr.c +1 -0
@@ -213,6 +213,7 @@ int __init zynq_early_slcr_init(void) zynq_slcr_regmap =syscon_regmap_lookup_by_compatible ("xlnx,zynq-slcr" );if (IS_ERR (zynq_slcr_regmap)) {pr_err ("%s: failed to find zynq-slcr\n" , __func__); +of_node_put (np);return -ENODEV ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 8/529 arm64: dts: mediatek: mt8183: Fix systimer 13 MHz clock description
In reply to Greg Kroah-HartmanFrom: Chen-Yu Tsai <[email protected]>
[ Upstream commit ce8a06b5bac75ccce99c0cf91b96b767d64f28a7 ]
The systimer block derives its 13 MHz clock by dividing the main 26 MHz oscillator clock by 2 internally, not through the TOPCKGEN clock controller.
On the MT8183 this divider is set either by power-on-reset or by the bootloader. The bootloader may then make the divider unconfigurable to, but can be read out by, the operating system.
Making the systimer block take the 26 MHz clock directly requires changing the implementations. As an ABI compatible fix, change the input clock of the systimer block a fixed factor divide-by-2 clock that takes the 26 MHz oscillator as its input.
--- arch/arm64/boot/dts/mediatek/mt8183.dtsi | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/mediatek/mt8183.dtsi +10 -2
@@ -205,6 +205,15 @@ psci { method = "smc"; }; + clk13m: fixed-factor-clock-13m { + compatible = "fixed-factor-clock"; + #clock-cells = <0>; + clocks = <&clk26m>; + clock-div = <2>; + clock-mult = <1>; + clock-output-names = "clk13m"; + }; + clk26m: oscillator { compatible = "fixed-clock"; #clock-cells = <0>;
@@ -355,8 +364,7 @@ systimer: timer@10017000 { "mediatek,mt6765-timer"; reg = <0 0x10017000 0 0x1000>; interrupts = <GIC_SPI 200 IRQ_TYPE_LEVEL_HIGH>; - clocks = <&topckgen CLK_TOP_CLK13M>; - clock-names = "clk13m"; + clocks = <&clk13m>; }; gce: mailbox@10238000 {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 9/529 arm64: dts: qcom: sdm845-db845c: fix audio codec interrupt pin name
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 740862bb5f59b93efb390a417995f88a64bdc323 ]
The pin config entry should have a string, not number, for the GPIO used as WCD9340 audio codec interrupt.
--- arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/sdm845-db845c.dts +1 -1
@@ -896,7 +896,7 @@ sdc2_card_det_n: sd-card-det-n { }; wcd_intr_default: wcd_intr_default { - pins = <54>; + pins = "gpio54"; function = "gpio"; input-enable;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 10/529 arm64: dts: qcom: sc7180: correct SPMI bus address cells
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 1f75745537222172f84783d369bbd1fb2d4b6414 ]
The SPMI bus uses two address cells and zero size cells (second reg entry - SPMI_USID - is not the size):
spmi@c440000: #address-cells:0:0: 2 was expected
--- arch/arm64/boot/dts/qcom/sc7180.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/qcom/sc7180.dtsi +2 -2
@@ -3066,8 +3066,8 @@ spmi_bus: spmi@c440000 { interrupts-extended = <&pdc 1 IRQ_TYPE_LEVEL_HIGH>; qcom,ee = <0>; qcom,channel = <0>; - #address-cells = <1>; - #size-cells = <1>; + #address-cells = <2>; + #size-cells = <0>; interrupt-controller; #interrupt-cells = <4>; cell-index = <0>;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 11/529 arm64: dts: meson-gx: Fix Ethernet MAC address unit name
In reply to Greg Kroah-HartmanFrom: Martin Blumenstingl <[email protected]>
[ Upstream commit 8ed5310356bfa47cc6bb4221ae6b21258c52e3d1 ]
Unit names should use hyphens instead of underscores to not cause warnings.
--- arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-gx.dtsi +1 -1
@@ -226,7 +226,7 @@ sn: sn@14 { reg = <0x14 0x10>; }; - eth_mac: eth_mac@34 { + eth_mac: eth-mac@34 { reg = <0x34 0x10>; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 12/529 arm64: dts: meson-g12a: Fix internal Ethernet PHY unit name
In reply to Greg Kroah-HartmanFrom: Martin Blumenstingl <[email protected]>
[ Upstream commit e7303651bbc76c848007f1cfac1fbeaa65f600d1 ]
Documentation/devicetree/bindings/net/ethernet-phy.yaml defines that the node name for Ethernet PHYs should match the following pattern:
^ethernet-phy(@[a-f0-9]+)?$
Replace the underscore with a hyphen to adhere to this binding.
--- arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi +1 -1
@@ -1727,7 +1727,7 @@ int_mdio: mdio@1 { #address-cells = <1>; #size-cells = <0>; - internal_ephy: ethernet_phy@8 { + internal_ephy: ethernet-phy@8 { compatible = "ethernet-phy-id0180.3301", "ethernet-phy-ieee802.3-c22"; interrupts = <GIC_SPI 9 IRQ_TYPE_LEVEL_HIGH>;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 13/529 arm64: dts: meson-gx: Fix the SCPI DVFS node name and unit address
In reply to Greg Kroah-HartmanFrom: Martin Blumenstingl <[email protected]>
[ Upstream commit f189c869ad92787ddd753558bcbae89d75825bb6 ]
Node names should be generic and use hyphens instead of underscores to not cause warnings. Also nodes without a reg property should not have a unit-address. Change the scpi_dvfs node to use clock-controller as node name without a unit address (since it does not have a reg property).
--- arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-gx.dtsi +1 -1
@@ -243,7 +243,7 @@ scpi { scpi_clocks: clocks { compatible = "arm,scpi-clocks"; - scpi_dvfs: scpi_clocks@0 { + scpi_dvfs: clock-controller { compatible = "arm,scpi-dvfs-clocks"; #clock-cells = <1>; clock-indices = <0>;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 14/529 arm64: dts: qcom: ipq8074: correct USB3 QMP PHY-s clock output names
In reply to Greg Kroah-HartmanFrom: Robert Marko <[email protected]>
[ Upstream commit 877cff3568c0f54511d77918ae16b2d6e9a0dfce ]
It seems that clock-output-names for the USB3 QMP PHY-s where set without actually checking what is the GCC clock driver expecting, so clock core could never actually find the parents for usb0_pipe_clk_src and usb1_pipe_clk_src clocks in the GCC driver.
So, correct the names to be what the driver expects so that parenting works.
Before:
gcc_usb0_pipe_clk_src 0 0 0 125000000 0 0 50000 Y gcc_usb1_pipe_clk_src 0 0 0 125000000 0 0 50000 Y
After:
usb3phy_0_cc_pipe_clk 1 1 0 125000000 0 0 50000 Y
usb0_pipe_clk_src 1 1 0 125000000 0 0 50000 Y
gcc_usb0_pipe_clk 1 1 0 125000000 0 0 50000 Y
usb3phy_1_cc_pipe_clk 1 1 0 125000000 0 0 50000 Y
usb1_pipe_clk_src 1 1 0 125000000 0 0 50000 Y
gcc_usb1_pipe_clk 1 1 0 125000000 0 0 50000 Y--- arch/arm64/boot/dts/qcom/ipq8074.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/qcom/ipq8074.dtsi +2 -2
@@ -108,7 +108,7 @@ usb1_ssphy: lane@58200 { #phy-cells = <0>; clocks = <&gcc GCC_USB1_PIPE_CLK>; clock-names = "pipe0"; - clock-output-names = "gcc_usb1_pipe_clk_src"; + clock-output-names = "usb3phy_1_cc_pipe_clk"; }; };
@@ -151,7 +151,7 @@ usb0_ssphy: lane@78200 { #phy-cells = <0>; clocks = <&gcc GCC_USB0_PIPE_CLK>; clock-names = "pipe0"; - clock-output-names = "gcc_usb0_pipe_clk_src"; + clock-output-names = "usb3phy_0_cc_pipe_clk"; }; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 15/529 arm64: dts: qcom: Fix IPQ8074 PCIe PHY nodes
In reply to Greg Kroah-HartmanFrom: Shawn Guo <[email protected]>
[ Upstream commit 942bcd33ed455ad40b71a59901bd926bbf4a500e ]
IPQ8074 PCIe PHY nodes are broken in the many ways:
- '#address-cells', '#size-cells' and 'ranges' are missing.
- Child phy/lane node is missing, and the child properties like '#phy-cells' and 'clocks' are mistakenly put into parent node.
- The clocks properties for parent node are missing.
Fix them to get the nodes comply with the bindings schema.
Stable-dep-of: 7ba33591b45f ("arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY")
--- arch/arm64/boot/dts/qcom/ipq8074.dtsi | 46 +++++++++++++++++++++------ 1 file changed, 36 insertions(+), 10 deletions(-)
arch/arm64/boot/dts/qcom/ipq8074.dtsi +36 -10
@@ -167,34 +167,60 @@ qusb_phy_0: phy@79000 { resets = <&gcc GCC_QUSB2_0_PHY_BCR>; }; - pcie_phy0: phy@86000 { + pcie_qmp0: phy@86000 { compatible = "qcom,ipq8074-qmp-pcie-phy"; reg = <0x00086000 0x1000>; - #phy-cells = <0>; - clocks = <&gcc GCC_PCIE0_PIPE_CLK>; - clock-names = "pipe_clk"; - clock-output-names = "pcie20_phy0_pipe_clk"; + #address-cells = <1>; + #size-cells = <1>; + ranges; + clocks = <&gcc GCC_PCIE0_AUX_CLK>, + <&gcc GCC_PCIE0_AHB_CLK>; + clock-names = "aux", "cfg_ahb"; resets = <&gcc GCC_PCIE0_PHY_BCR>, <&gcc GCC_PCIE0PHY_PHY_BCR>; reset-names = "phy", "common"; status = "disabled"; + + pcie_phy0: phy@86200 { + reg = <0x86200 0x16c>, + <0x86400 0x200>, + <0x86800 0x4f4>; + #phy-cells = <0>; + #clock-cells = <0>; + clocks = <&gcc GCC_PCIE0_PIPE_CLK>; + clock-names = "pipe0"; + clock-output-names = "pcie_0_pipe_clk"; + }; }; - pcie_phy1: phy@8e000 { + pcie_qmp1: phy@8e000 { compatible = "qcom,ipq8074-qmp-pcie-phy"; reg = <0x0008e000 0x1000>; - #phy-cells = <0>; - clocks = <&gcc GCC_PCIE1_PIPE_CLK>; - clock-names = "pipe_clk"; - clock-output-names = "pcie20_phy1_pipe_clk"; + #address-cells = <1>; + #size-cells = <1>; + ranges; + clocks = <&gcc GCC_PCIE1_AUX_CLK>, + <&gcc GCC_PCIE1_AHB_CLK>; + clock-names = "aux", "cfg_ahb"; resets = <&gcc GCC_PCIE1_PHY_BCR>, <&gcc GCC_PCIE1PHY_PHY_BCR>; reset-names = "phy", "common"; status = "disabled"; + + pcie_phy1: phy@8e200 { + reg = <0x8e200 0x16c>, + <0x8e400 0x200>, + <0x8e800 0x4f4>; + #phy-cells = <0>; + #clock-cells = <0>; + clocks = <&gcc GCC_PCIE1_PIPE_CLK>; + clock-names = "pipe0"; + clock-output-names = "pcie_1_pipe_clk"; + }; }; tlmm: pinctrl@1000000 {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 16/529 arm64: dts: qcom: ipq8074: fix PCIe PHY serdes size
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
[ Upstream commit ed22cc93abae68f9d3fc4957c20a1d902cf28882 ]
The size of the PCIe PHY serdes register region is 0x1c4 and the corresponding 'reg' property should specifically not include the adjacent regions that are defined in the child node (e.g. tx and rx).
Stable-dep-of: 7ba33591b45f ("arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY")
--- arch/arm64/boot/dts/qcom/ipq8074.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/qcom/ipq8074.dtsi +2 -2
@@ -169,7 +169,7 @@ qusb_phy_0: phy@79000 { pcie_qmp0: phy@86000 { compatible = "qcom,ipq8074-qmp-pcie-phy"; - reg = <0x00086000 0x1000>; + reg = <0x00086000 0x1c4>; #address-cells = <1>; #size-cells = <1>; ranges;
@@ -197,7 +197,7 @@ pcie_phy0: phy@86200 { pcie_qmp1: phy@8e000 { compatible = "qcom,ipq8074-qmp-pcie-phy"; - reg = <0x0008e000 0x1000>; + reg = <0x0008e000 0x1c4>; #address-cells = <1>; #size-cells = <1>; ranges;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 17/529 arm64: dts: qcom: ipq8074: fix Gen3 PCIe QMP PHY
In reply to Greg Kroah-HartmanFrom: Robert Marko <[email protected]>
[ Upstream commit 7ba33591b45f9d547a317e42f1c2acd19c925eb6 ]
IPQ8074 comes in 2 silicon versions:
* v1 with 2x Gen2 PCIe ports and QMP PHY-s
* v2 with 1x Gen3 and 1x Gen2 PCIe ports and QMP PHY-s
v2 is the final and production version that is actually supported by the kernel, however it looks like PCIe related nodes were added for the v1 SoC.
Now that we have Gen3 QMP PHY support, we can start fixing the PCIe support by fixing the Gen3 QMP PHY node first.
Change the compatible to the Gen3 QMP PHY, correct the register space start and size, add the missing misc PCS register space.
--- arch/arm64/boot/dts/qcom/ipq8074.dtsi | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
arch/arm64/boot/dts/qcom/ipq8074.dtsi +8 -7
@@ -167,9 +167,9 @@ qusb_phy_0: phy@79000 { resets = <&gcc GCC_QUSB2_0_PHY_BCR>; }; - pcie_qmp0: phy@86000 { - compatible = "qcom,ipq8074-qmp-pcie-phy"; - reg = <0x00086000 0x1c4>; + pcie_qmp0: phy@84000 { + compatible = "qcom,ipq8074-qmp-gen3-pcie-phy"; + reg = <0x00084000 0x1bc>; #address-cells = <1>; #size-cells = <1>; ranges;
@@ -183,10 +183,11 @@ pcie_qmp0: phy@86000 { "common"; status = "disabled"; - pcie_phy0: phy@86200 { - reg = <0x86200 0x16c>, - <0x86400 0x200>, - <0x86800 0x4f4>; + pcie_phy0: phy@84200 { + reg = <0x84200 0x16c>, + <0x84400 0x200>, + <0x84800 0x1f0>, + <0x84c00 0xf4>; #phy-cells = <0>; #clock-cells = <0>; clocks = <&gcc GCC_PCIE0_PIPE_CLK>;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 18/529 arm64: dts: qcom: ipq8074: correct Gen2 PCIe ranges
In reply to Greg Kroah-HartmanFrom: Robert Marko <[email protected]>
[ Upstream commit 2055cb7dccea16bafa3adf9c5e3216949512c34a ]
Current ranges property set in Gen2 PCIe node is incorrect, replace it with the downstream 5.4 QCA kernel value.
--- arch/arm64/boot/dts/qcom/ipq8074.dtsi | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm64/boot/dts/qcom/ipq8074.dtsi +3 -3
@@ -610,9 +610,9 @@ pcie1: pci@10000000 { phy-names = "pciephy"; ranges = <0x81000000 0 0x10200000 0x10200000 - 0 0x100000 /* downstream I/O */ - 0x82000000 0 0x10300000 0x10300000 - 0 0xd00000>; /* non-prefetchable memory */ + 0 0x10000>, /* downstream I/O */ + <0x82000000 0 0x10220000 0x10220000 + 0 0xfde0000>; /* non-prefetchable memory */ interrupts = <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>; interrupt-names = "msi";
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 19/529 arm64: dts: qcom: ipq8074: fix Gen3 PCIe node
In reply to Greg Kroah-HartmanFrom: Robert Marko <[email protected]>
[ Upstream commit 3e83a9c41ab0244a45a4a2800b9adb8de0d15f82 ]
IPQ8074 comes in 2 silicon versions:
* v1 with 2x Gen2 PCIe ports and QMP PHY-s
* v2 with 1x Gen3 and 1x Gen2 PCIe ports and QMP PHY-s
v2 is the final and production version that is actually supported by the kernel, however it looks like PCIe related nodes were added for the v1 SoC.
Finish the PCIe fixup by using the correct compatible, adding missing ATU register space, declaring max-link-speed, use correct ranges, add missing clocks and resets.
--- arch/arm64/boot/dts/qcom/ipq8074.dtsi | 30 +++++++++++++++------------ 1 file changed, 17 insertions(+), 13 deletions(-)
arch/arm64/boot/dts/qcom/ipq8074.dtsi +17 -13
@@ -655,16 +655,18 @@ IRQ_TYPE_LEVEL_HIGH>, /* int_c */ }; pcie0: pci@20000000 { - compatible = "qcom,pcie-ipq8074"; + compatible = "qcom,pcie-ipq8074-gen3"; reg = <0x20000000 0xf1d>, <0x20000f20 0xa8>, - <0x00080000 0x2000>, + <0x20001000 0x1000>, + <0x00080000 0x4000>, <0x20100000 0x1000>; - reg-names = "dbi", "elbi", "parf", "config"; + reg-names = "dbi", "elbi", "atu", "parf", "config"; device_type = "pci"; linux,pci-domain = <0>; bus-range = <0x00 0xff>; num-lanes = <1>; + max-link-speed = <3>; #address-cells = <3>; #size-cells = <2>;
@@ -672,9 +674,9 @@ pcie0: pci@20000000 { phy-names = "pciephy"; ranges = <0x81000000 0 0x20200000 0x20200000 - 0 0x100000 /* downstream I/O */ - 0x82000000 0 0x20300000 0x20300000 - 0 0xd00000>; /* non-prefetchable memory */ + 0 0x10000>, /* downstream I/O */ + <0x82000000 0 0x20220000 0x20220000 + 0 0xfde0000>; /* non-prefetchable memory */ interrupts = <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>; interrupt-names = "msi";
@@ -692,28 +694,30 @@ IRQ_TYPE_LEVEL_HIGH>, /* int_c */ clocks = <&gcc GCC_SYS_NOC_PCIE0_AXI_CLK>, <&gcc GCC_PCIE0_AXI_M_CLK>, <&gcc GCC_PCIE0_AXI_S_CLK>, - <&gcc GCC_PCIE0_AHB_CLK>, - <&gcc GCC_PCIE0_AUX_CLK>; - + <&gcc GCC_PCIE0_AXI_S_BRIDGE_CLK>, + <&gcc GCC_PCIE0_RCHNG_CLK>; clock-names = "iface", "axi_m", "axi_s", - "ahb", - "aux"; + "axi_bridge", + "rchng"; + resets = <&gcc GCC_PCIE0_PIPE_ARES>, <&gcc GCC_PCIE0_SLEEP_ARES>, <&gcc GCC_PCIE0_CORE_STICKY_ARES>, <&gcc GCC_PCIE0_AXI_MASTER_ARES>, <&gcc GCC_PCIE0_AXI_SLAVE_ARES>, <&gcc GCC_PCIE0_AHB_ARES>, - <&gcc GCC_PCIE0_AXI_MASTER_STICKY_ARES>; + <&gcc GCC_PCIE0_AXI_MASTER_STICKY_ARES>, + <&gcc GCC_PCIE0_AXI_SLAVE_STICKY_ARES>; reset-names = "pipe", "sleep", "sticky", "axi_m", "axi_s", "ahb", - "axi_m_sticky"; + "axi_m_sticky", + "axi_s_sticky"; status = "disabled"; }; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 20/529 arm64: dts: qcom: ipq8074: correct PCIe QMP PHY output clock names
In reply to Greg Kroah-HartmanFrom: Robert Marko <[email protected]>
[ Upstream commit 0e8b90c0256cf9c9589e2cee517dedc987a34355 ]
Current PCIe QMP PHY output name were changed in ("arm64: dts: qcom: Fix IPQ8074 PCIe PHY nodes") however it did not account for the fact that GCC driver is relying on the old names to match them as they are being used as the parent for the gcc_pcie0_pipe_clk and gcc_pcie1_pipe_clk.
This broke parenting as GCC could not find the parent clock, so fix it by changing to the names that driver is expecting.
--- arch/arm64/boot/dts/qcom/ipq8074.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/qcom/ipq8074.dtsi +2 -2
@@ -192,7 +192,7 @@ pcie_phy0: phy@84200 { #clock-cells = <0>; clocks = <&gcc GCC_PCIE0_PIPE_CLK>; clock-names = "pipe0"; - clock-output-names = "pcie_0_pipe_clk"; + clock-output-names = "pcie20_phy0_pipe_clk"; }; };
@@ -220,7 +220,7 @@ pcie_phy1: phy@8e200 { #clock-cells = <0>; clocks = <&gcc GCC_PCIE1_PIPE_CLK>; clock-names = "pipe0"; - clock-output-names = "pcie_1_pipe_clk"; + clock-output-names = "pcie20_phy1_pipe_clk"; }; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 21/529 arm64: dts: meson: remove CPU opps below 1GHz for G12A boards
In reply to Greg Kroah-HartmanFrom: Christian Hewitt <[email protected]>
[ Upstream commit 3cbd431c2b34d84605d358c8c57654193fd661fb ]
Amlogic G12A devices experience CPU stalls and random board wedges when the system idles and CPU cores clock down to lower opp points. Recent vendor kernels include a change to remove 100-250MHz and other distro sources also remove the 500/667MHz points. Unless all 100-667Mhz opps are removed or the CPU governor forced to performance stalls are still observed, so let's remove them to improve stability and uptime.
--- arch/arm64/boot/dts/amlogic/meson-g12a.dtsi | 20 -------------------- 1 file changed, 20 deletions(-)
arch/arm64/boot/dts/amlogic/meson-g12a.dtsi +0 -20
@@ -57,26 +57,6 @@ cpu_opp_table: opp-table { compatible = "operating-points-v2"; opp-shared; - opp-100000000 { - opp-hz = /bits/ 64 <100000000>; - opp-microvolt = <731000>; - }; - - opp-250000000 { - opp-hz = /bits/ 64 <250000000>; - opp-microvolt = <731000>; - }; - - opp-500000000 { - opp-hz = /bits/ 64 <500000000>; - opp-microvolt = <731000>; - }; - - opp-667000000 { - opp-hz = /bits/ 64 <666666666>; - opp-microvolt = <731000>; - }; - opp-1000000000 { opp-hz = /bits/ 64 <1000000000>; opp-microvolt = <731000>;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 22/529 ARM: OMAP1: call platform_device_put() in error case in omap1_dm_timer_init()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 0414a100d6ab32721efa70ab55524540fdfe0ede ]
If platform_device_add() is not called or failed, it should call platform_device_put() in error case.
Message-Id: <[email protected]>
--- arch/arm/mach-omap1/timer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/mach-omap1/timer.c +1 -1
@@ -165,7 +165,7 @@ static int __init omap1_dm_timer_init(void)kfree (pdata); err_free_pdev: -platform_device_unregister (pdev); +platform_device_put (pdev);return ret; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 23/529 ARM: s3c: fix s3c64xx_set_timer_source prototype
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 5bf52f5e4d12b8109f348cab60cb7d51092c4270 ]
The prototype does not match the definition, as gcc-13 points out:
arch/arm/mach-s3c/s3c64xx.c:169:13: error: conflicting types for 's3c64xx_set_timer_source' due to enum/integer mismatch; have 'void(unsigned int, unsigned int)' [-Werror=enum-int-mismatch]
169 | void __init s3c64xx_set_timer_source(unsigned int event, unsigned int source)
| ^~~~~~~~~~~~~~~~~~~~~~~~
In file included from arch/arm/mach-s3c/s3c64xx.c:50:
arch/arm/mach-s3c/s3c64xx.h:62:20: note: previous declaration of 's3c64xx_set_timer_source' with type 'void(enum s3c64xx_timer_mode, enum s3c64xx_timer_mode)'
62 | extern void __init s3c64xx_set_timer_source(enum s3c64xx_timer_mode event,
| ^~~~~~~~~~~~~~~~~~~~~~~~--- arch/arm/mach-s3c/s3c64xx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm/mach-s3c/s3c64xx.c +2 -1
@@ -173,7 +173,8 @@ static struct samsung_pwm_variant s3c64xx_pwm_variant = { .tclk_mask = (1 << 7) | (1 << 6) | (1 << 5), }; -void __init s3c64xx_set_timer_source (unsigned int event,unsigned int source) +void __init s3c64xx_set_timer_source (enum s3c64xx_timer_mode event, +enum s3c64xx_timer_mode source) { s3c64xx_pwm_variant.output_mask =BIT (SAMSUNG_PWM_NUM ) -1 ; s3c64xx_pwm_variant.output_mask &= ~(BIT (event) |BIT (source));
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 24/529 arm64: dts: ti: k3-j7200: Fix wakeup pinmux range
In reply to Greg Kroah-HartmanFrom: Vaishnav Achath <[email protected]>
[ Upstream commit 9ae21ac445e911e3541985c20052fc05d60f6879 ]
The WKUP_PADCONFIG register region in J7200 has multiple non-addressable regions, split the existing wkup_pmx region as follows to avoid the non-addressable regions and include all valid WKUP_PADCONFIG registers. Also update references to old nodes with new ones.
wkup_pmx0 -> 13 pins (WKUP_PADCONFIG 0 - 12)wkup_pmx1 -> 2 pins (WKUP_PADCONFIG 14 - 15)wkup_pmx2 -> 59 pins (WKUP_PADCONFIG 26 - 84)wkup_pmx3 -> 8 pins (WKUP_PADCONFIG 93 - 100)
J7200 Datasheet (Table 6-106, Section 6.4 Pin Multiplexing) :
https://www.ti.com/lit/ds/symlink/dra821u.pdf
--- .../dts/ti/k3-j7200-common-proc-board.dts | 2 +- .../boot/dts/ti/k3-j7200-mcu-wakeup.dtsi | 29 ++++++++++++++++++- 2 files changed, 29 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/ti/k3-j7200-common-proc-board.dts +1 -1
@@ -16,7 +16,7 @@ chosen { }; }; -&wkup_pmx0 { +&wkup_pmx2 { mcu_cpsw_pins_default: mcu-cpsw-pins-default { pinctrl-single,pins = < J721E_WKUP_IOPAD(0x0068, PIN_OUTPUT, 0) /* MCU_RGMII1_TX_CTL */
arch/arm64/boot/dts/ti/k3-j7200-mcu-wakeup.dtsi +28 -1
@@ -56,7 +56,34 @@ chipid@43000014 { wkup_pmx0: pinctrl@4301c000 { compatible = "pinctrl-single"; /* Proxy 0 addressing */ - reg = <0x00 0x4301c000 0x00 0x178>; + reg = <0x00 0x4301c000 0x00 0x34>; + #pinctrl-cells = <1>; + pinctrl-single,register-width = <32>; + pinctrl-single,function-mask = <0xffffffff>; + }; + + wkup_pmx1: pinctrl@0x4301c038 { + compatible = "pinctrl-single"; + /* Proxy 0 addressing */ + reg = <0x00 0x4301c038 0x00 0x8>; + #pinctrl-cells = <1>; + pinctrl-single,register-width = <32>; + pinctrl-single,function-mask = <0xffffffff>; + }; + + wkup_pmx2: pinctrl@0x4301c068 { + compatible = "pinctrl-single"; + /* Proxy 0 addressing */ + reg = <0x00 0x4301c068 0x00 0xec>; + #pinctrl-cells = <1>; + pinctrl-single,register-width = <32>; + pinctrl-single,function-mask = <0xffffffff>; + }; + + wkup_pmx3: pinctrl@0x4301c174 { + compatible = "pinctrl-single"; + /* Proxy 0 addressing */ + reg = <0x00 0x4301c174 0x00 0x20>; #pinctrl-cells = <1>; pinctrl-single,register-width = <32>; pinctrl-single,function-mask = <0xffffffff>;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 25/529 ARM: dts: exynos: correct wr-active property in Exynos3250 Rinato
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit d15d2a617499882971ddb773a583015bf36fa492 ]
The property is wr-active:
exynos3250-rinato.dtb: fimd@11c00000: i80-if-timings: 'wr-act' does not match any of the regexes: 'pinctrl-[0-9]+'
--- arch/arm/boot/dts/exynos3250-rinato.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/exynos3250-rinato.dts +1 -1
@@ -249,7 +249,7 @@ &fimd { i80-if-timings { cs-setup = <0>; wr-setup = <0>; - wr-act = <1>; + wr-active = <1>; wr-hold = <0>; }; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 26/529 ARM: imx: Call ida_simple_remove() for ida_simple_get
In reply to Greg Kroah-HartmanFrom: Angus Chen <[email protected]>
[ Upstream commit ebeb49f43c8952f12aa20f03f00d7009edc2d1c5 ]
The function call ida_simple_get maybe fail,we should deal with it. And if ida_simple_get success ,it need to call ida_simple_remove also. BTW,devm_kasprintf can handle id is zero for consistency.
--- arch/arm/mach-imx/mmdc.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
arch/arm/mach-imx/mmdc.c +12 -12
@@ -99,6 +99,7 @@ struct mmdc_pmu {cpumask_t cpu;struct hrtimer hrtimer;unsigned int active_events; +int id;struct device *dev;struct perf_event *mmdc_events[MMDC_NUM_COUNTERS ];struct hlist_node node;
@@ -433,8 +434,6 @@ static enum hrtimer_restart mmdc_pmu_timer_handler(struct hrtimer *hrtimer)static int mmdc_pmu_init (struct mmdc_pmu *pmu_mmdc,void __iomem *mmdc_base,struct device *dev) { -int mmdc_num; - *pmu_mmdc = (struct mmdc_pmu ) { .pmu = (struct pmu ) { .task_ctx_nr = perf_invalid_context,
@@ -452,15 +451,16 @@ static int mmdc_pmu_init(struct mmdc_pmu *pmu_mmdc, .active_events = 0, }; - mmdc_num =ida_simple_get (&mmdc_ida,0 ,0 ,GFP_KERNEL ); + pmu_mmdc->id =ida_simple_get (&mmdc_ida,0 ,0 ,GFP_KERNEL ); -return mmdc_num; +return pmu_mmdc->id; }static int imx_mmdc_remove (struct platform_device *pdev) {struct mmdc_pmu *pmu_mmdc =platform_get_drvdata (pdev); +ida_simple_remove (&mmdc_ida, pmu_mmdc->id);cpuhp_state_remove_instance_nocalls (cpuhp_mmdc_state, &pmu_mmdc->node);perf_pmu_unregister (&pmu_mmdc->pmu);iounmap (pmu_mmdc->mmdc_base);
@@ -474,7 +474,6 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b {struct mmdc_pmu *pmu_mmdc;char *name; -int mmdc_num;int ret;const struct of_device_id *of_id =of_match_device (imx_mmdc_dt_ids, &pdev->dev);
@@ -497,14 +496,14 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b cpuhp_mmdc_state = ret; } - mmdc_num =mmdc_pmu_init (pmu_mmdc, mmdc_base, &pdev->dev); - pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk; -if (mmdc_num ==0 ) - name ="mmdc" ; -else - name =devm_kasprintf (&pdev->dev, -GFP_KERNEL ,"mmdc%d" , mmdc_num); + ret =mmdc_pmu_init (pmu_mmdc, mmdc_base, &pdev->dev); +if (ret <0 ) + goto pmu_free; + name =devm_kasprintf (&pdev->dev, +GFP_KERNEL ,"mmdc%d" , ret); + + pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk; pmu_mmdc->devtype_data = (struct fsl_mmdc_devtype_data *)of_id->data; hrtimer_init(&pmu_mmdc->hrtimer, CLOCK_MONOTONIC,
@@ -525,6 +524,7 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b pmu_register_err:pr_warn ("MMDC Perf PMU failed (%d), disabled\n" , ret); +ida_simple_remove (&mmdc_ida, pmu_mmdc->id);cpuhp_state_remove_instance_nocalls (cpuhp_mmdc_state, &pmu_mmdc->node);hrtimer_cancel (&pmu_mmdc->hrtimer); pmu_free:
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 27/529 arm64: dts: amlogic: meson-gx: fix SCPI clock dvfs node name
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
[ Upstream commit 127f79212b07c5d9a6657a87e3eafdd889335814 ]
Fixes:
scpi: clocks: 'clock-controller' does not match any of the regexes: '^clocks-[0-9a-f]+$', 'pinctrl-[0-9]+'
--- arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-gx.dtsi +1 -1
@@ -243,7 +243,7 @@ scpi { scpi_clocks: clocks { compatible = "arm,scpi-clocks"; - scpi_dvfs: clock-controller { + scpi_dvfs: clocks-0 { compatible = "arm,scpi-dvfs-clocks"; #clock-cells = <1>; clock-indices = <0>;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 28/529 arm64: dts: amlogic: meson-axg: fix SCPI clock dvfs node name
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
[ Upstream commit 5b7069d72f03c92a0ab919725017394ebce03a81 ]
Fixes:
scpi: clocks: 'clock-controller' does not match any of the regexes: '^clocks-[0-9a-f]+$', 'pinctrl-[0-9]+'
--- arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-axg.dtsi +1 -1
@@ -151,7 +151,7 @@ scpi { scpi_clocks: clocks { compatible = "arm,scpi-clocks"; - scpi_dvfs: clock-controller { + scpi_dvfs: clocks-0 { compatible = "arm,scpi-dvfs-clocks"; #clock-cells = <1>; clock-indices = <0>;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 29/529 arm64: dts: amlogic: meson-gx: add missing SCPI sensors compatible
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
[ Upstream commit 2ff650051493d5bdb6dd09d4c2850bb37db6be31 ]
Fixes:
scpi: sensors:compatible: 'oneOf' conditional failed, one must be fixed:
['amlogic,meson-gxbb-scpi-sensors'] is too short 'arm,scpi-sensors' was expected
--- arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-axg.dtsi +1 -1
@@ -160,7 +160,7 @@ scpi_dvfs: clocks-0 { }; scpi_sensors: sensors { - compatible = "amlogic,meson-gxbb-scpi-sensors"; + compatible = "amlogic,meson-gxbb-scpi-sensors", "arm,scpi-sensors"; #thermal-sensor-cells = <1>; }; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 30/529 arm64: dts: amlogic: meson-gxl-s905d-sml5442tw: drop invalid clock-names property
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
[ Upstream commit e3bd275ccbacf5eb18eaa311cea39f8bf8655feb ]
Fixes:
bluetooth: 'clock-names' does not match any of the regexes: 'pinctrl-[0-9]+'
--- arch/arm64/boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts | 1 - 1 file changed, 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-gxl-s905d-sml5442tw.dts +0 -1
@@ -75,6 +75,5 @@ bluetooth { enable-gpios = <&gpio GPIOX_17 GPIO_ACTIVE_HIGH>; max-speed = <2000000>; clocks = <&wifi32k>; - clock-names = "lpo"; }; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 31/529 arm64: dts: amlogic: meson-gx: add missing unit address to rng node name
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
[ Upstream commit 61ff70708b98a85516eccb3755084ac97b42cf48 ]
Fixes:
bus@c8834000: rng: {...} should not be valid under {'type': 'object'}
--- arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-gx.dtsi +1 -1
@@ -524,7 +524,7 @@ periphs: bus@c8834000 { #size-cells = <2>; ranges = <0x0 0x0 0x0 0xc8834000 0x0 0x2000>; - hwrng: rng { + hwrng: rng@0 { compatible = "amlogic,meson-rng"; reg = <0x0 0x0 0x0 0x4>; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 32/529 arm64: dts: amlogic: meson-gxl: add missing unit address to eth-phy-mux node name
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
[ Upstream commit d19189f70ba596798ea49166d2d1ef36a8df5289 ]
Fixes:
bus@c8834000: eth-phy-mux: {...} should not be valid under {'type': 'object'}
--- arch/arm64/boot/dts/amlogic/meson-gxl.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-gxl.dtsi +1 -1
@@ -759,7 +759,7 @@ mux { }; }; - eth-phy-mux { + eth-phy-mux@55c { compatible = "mdio-mux-mmioreg", "mdio-mux"; #address-cells = <1>; #size-cells = <0>;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 33/529 arm64: dts: amlogic: meson-gx-libretech-pc: fix update button name
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
[ Upstream commit 6bb506ed36968207a8832f0143ebc127f0770eef ]
Fixes:
adc-keys: 'update-button' does not match any of the regexes: '^button-', 'pinctrl-[0-9]+'
--- arch/arm64/boot/dts/amlogic/meson-gx-libretech-pc.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-gx-libretech-pc.dtsi +1 -1
@@ -17,7 +17,7 @@ adc-keys { io-channel-names = "buttons"; keyup-threshold-microvolt = <1800000>; - update-button { + button-update { label = "update"; linux,code = <KEY_VENDOR>; press-threshold-microvolt = <1300000>;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 34/529 arm64: dts: amlogic: meson-gxl-s905d-phicomm-n1: fix led node name
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
[ Upstream commit eee64d8fbbdaab72bbab3e462f3a7b742d20c8c2 ]
Fixes:
leds: status: {...} is not of type 'array'
--- arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-gxl-s905d-phicomm-n1.dts +1 -1
@@ -18,7 +18,7 @@ cvbs-connector { leds { compatible = "gpio-leds"; - status { + led { label = "n1:white:status"; gpios = <&gpio_ao GPIOAO_9 GPIO_ACTIVE_HIGH>; default-state = "on";
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 35/529 arm64: dts: amlogic: meson-gxbb-kii-pro: fix led node name
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
[ Upstream commit afdef3b188c934f79ad4b0a7bd8c692742f9b5af ]
Fixes:
leds: status: {...} is not of type 'array'
--- arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/amlogic/meson-gxbb-kii-pro.dts +1 -1
@@ -16,7 +16,7 @@ / { leds { compatible = "gpio-leds"; - status { + led { gpios = <&gpio_ao GPIOAO_13 GPIO_ACTIVE_LOW>; default-state = "off"; color = <LED_COLOR_ID_RED>;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 36/529 arm64: dts: renesas: beacon-renesom: Fix gpio expander reference
In reply to Greg Kroah-HartmanFrom: Adam Ford <[email protected]>
[ Upstream commit d7f9492dfc03153ac56ab59066a196558748f575 ]
The board used to originally introduce the Beacon Embedded RZ/G2[M/N/H] boards had a GPIO expander with address 20, but this was changed when the final board went to production.
The production boards changed both the part itself and the address. With the incorrect address, the LCD cannot come up. If the LCD fails, the rcar-du driver fails to come up, and that also breaks HDMI.
Pre-release board were not shipped to the general public, so it should be safe to push this as a fix. Anyone with a production board would have video fail due to this GPIO expander change.
--- .../dts/renesas/beacon-renesom-baseboard.dtsi | 24 ++++++++----------- 1 file changed, 10 insertions(+), 14 deletions(-)
arch/arm64/boot/dts/renesas/beacon-renesom-baseboard.dtsi +10 -14
@@ -399,20 +399,6 @@ wm8962_endpoint: endpoint { }; }; - /* 0 - lcd_reset */ - /* 1 - lcd_pwr */ - /* 2 - lcd_select */ - /* 3 - backlight-enable */ - /* 4 - Touch_shdwn */ - /* 5 - LCD_H_pol */ - /* 6 - lcd_V_pol */ - gpio_exp1: gpio@20 { - compatible = "onnn,pca9654"; - reg = <0x20>; - gpio-controller; - #gpio-cells = <2>; - }; - touchscreen@26 { compatible = "ilitek,ili2117"; reg = <0x26>;
@@ -445,6 +431,16 @@ hd3ss3220_ep: endpoint { }; }; }; + + gpio_exp1: gpio@70 { + compatible = "nxp,pca9538"; + reg = <0x70>; + gpio-controller; + #gpio-cells = <2>; + gpio-line-names = "lcd_reset", "lcd_pwr", "lcd_select", + "backlight-enable", "Touch_shdwn", + "LCD_H_pol", "lcd_V_pol"; + }; }; &lvds0 {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 37/529 ARM: dts: sun8i: nanopi-duo2: Fix regulator GPIO reference
In reply to Greg Kroah-HartmanFrom: Samuel Holland <[email protected]>
[ Upstream commit 2177d4ae971f79b4a9a3c411f2fb8ae6113d1430 ]
The property named in the schema is 'enable-gpios', not 'enable-gpio'. This makes no difference at runtime, because the regulator is marked as always-on, but it breaks validation.
--- arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/sun8i-h3-nanopi-duo2.dts +1 -1
@@ -57,7 +57,7 @@ reg_vdd_cpux: vdd-cpux-regulator { regulator-ramp-delay = <50>; /* 4ms */ enable-active-high; - enable-gpio = <&r_pio 0 8 GPIO_ACTIVE_HIGH>; /* PL8 */ + enable-gpios = <&r_pio 0 8 GPIO_ACTIVE_HIGH>; /* PL8 */ gpios = <&r_pio 0 6 GPIO_ACTIVE_HIGH>; /* PL6 */ gpios-states = <0x1>; states = <1100000 0>, <1300000 1>;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 38/529 ARM: dts: imx7s: correct iomuxc gpr mux controller cells
In reply to Greg Kroah-HartmanFrom: Peng Fan <[email protected]>
[ Upstream commit 0e3e1946606a2919b1dda9967ab2e1c5af2fedd6 ]
Per binding doc reg-mux.yaml, the #mux-control-cells should be 1
--- arch/arm/boot/dts/imx7s.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/imx7s.dtsi +1 -1
@@ -494,7 +494,7 @@ gpr: iomuxc-gpr@30340000 { mux: mux-controller { compatible = "mmio-mux"; - #mux-control-cells = <0>; + #mux-control-cells = <1>; mux-reg-masks = <0x14 0x00000010>; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 39/529 arm64: dts: mediatek: mt7622: Add missing pwm-cells to pwm node
In reply to Greg Kroah-HartmanFrom: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit 22925af785fa3470efdf566339616d801119d348 ]
Specify #pwm-cells on pwm@11006000 to make it actually usable.
--- arch/arm64/boot/dts/mediatek/mt7622.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/mediatek/mt7622.dtsi +1 -0
@@ -428,6 +428,7 @@ uart3: serial@11005000 { pwm: pwm@11006000 { compatible = "mediatek,mt7622-pwm"; reg = <0 0x11006000 0 0x1000>; + #pwm-cells = <2>; interrupts = <GIC_SPI 77 IRQ_TYPE_LEVEL_LOW>; clocks = <&topckgen CLK_TOP_PWM_SEL>, <&pericfg CLK_PERI_PWM_PD>,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 40/529 blk-mq: avoid sleep in blk_mq_alloc_request_hctx
In reply to Greg Kroah-HartmanFrom: Kemeng Shi <[email protected]>
[ Upstream commit 6ee858a3d3270a68902d66bb47c151a83622535c ]
Commit 1f5bd336b9150 ("blk-mq: add blk_mq_alloc_request_hctx") add blk_mq_alloc_request_hctx to send commands to a specific queue. If BLK_MQ_REQ_NOWAIT is not set in tag allocation, we may change to different hctx after sleep and get tag from unexpected hctx. So BLK_MQ_REQ_NOWAIT must be set in flags for blk_mq_alloc_request_hctx.
After commit 600c3b0cea784 ("blk-mq: open code __blk_mq_alloc_request in blk_mq_alloc_request_hctx"), blk_mq_alloc_request_hctx return -EINVAL if both BLK_MQ_REQ_NOWAIT and BLK_MQ_REQ_RESERVED are not set instead of if BLK_MQ_REQ_NOWAIT is not set. So if BLK_MQ_REQ_NOWAIT is not set and BLK_MQ_REQ_RESERVED is set, blk_mq_alloc_request_hctx could alloc tag from unexpected hctx. I guess what we need here is that return -EINVAL if either BLK_MQ_REQ_NOWAIT or BLK_MQ_REQ_RESERVED is not set.
Currently both BLK_MQ_REQ_NOWAIT and BLK_MQ_REQ_RESERVED will be set if specific hctx is needed in nvme_auth_submit, nvmf_connect_io_queue and nvmf_connect_admin_queue. Fix the potential BLK_MQ_REQ_NOWAIT missed case in future.
--- block/blk-mq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
block/blk-mq.c +2 -1
@@ -448,7 +448,8 @@ struct request *blk_mq_alloc_request_hctx(struct request_queue *q,* allocator for this for the rare use case of a command tied to * a specific queue. */ -if (WARN_ON_ONCE (!(flags & (BLK_MQ_REQ_NOWAIT |BLK_MQ_REQ_RESERVED )))) +if (WARN_ON_ONCE (!(flags &BLK_MQ_REQ_NOWAIT )) || +WARN_ON_ONCE (!(flags &BLK_MQ_REQ_RESERVED )))return ERR_PTR (-EINVAL );if (hctx_idx >= q->nr_hw_queues)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 41/529 blk-mq: remove stale comment for blk_mq_sched_mark_restart_hctx
In reply to Greg Kroah-HartmanFrom: Kemeng Shi <[email protected]>
[ Upstream commit c31e76bcc379182fe67a82c618493b7b8868c672 ]
Commit 97889f9ac24f8 ("blk-mq: remove synchronize_rcu() from blk_mq_del_queue_tag_set()") remove handle of TAG_SHARED in restart, then shared_hctx_restart counted for how many hardware queues are marked for restart is removed too.
Remove the stale comment that we still count hardware queues need restart.
--- block/blk-mq-sched.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
block/blk-mq-sched.c +1 -2
@@ -45,8 +45,7 @@ void blk_mq_sched_assign_ioc(struct request *rq) }/* -* Mark a hardware queue as needing a restart. For shared queues, maintain -* a count of how many hardware queues are marked for restart. +* Mark a hardware queue as needing a restart. */ void blk_mq_sched_mark_restart_hctx (struct blk_mq_hw_ctx *hctx) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 42/529 blk-mq: correct stale comment of .get_budget
In reply to Greg Kroah-HartmanFrom: Kemeng Shi <[email protected]>
[ Upstream commit 01542f651a9f58a9b176c3d3dc3eefbacee53b78 ]
Commit 88022d7201e96 ("blk-mq: don't handle failure in .get_budget") remove BLK_STS_RESOURCE return value and we only check if we can get the budget from .get_budget() now.
Correct stale comment that ".get_budget() returns BLK_STS_NO_RESOURCE" to ".get_budget() fails to get the budget".
--- block/blk-mq-sched.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
block/blk-mq-sched.c +2 -2
@@ -109,7 +109,7 @@ static bool blk_mq_dispatch_hctx_list(struct list_head *rq_list)/* * Only SCSI implements .get_budget and .put_budget, and SCSI restarts * its queue by itself in its completion handler, so we don't need to -* restart queue if .get_budget() returns BLK_STS_NO_RESOURCE. +* restart queue if .get_budget() fails to get the budget. * * Returns -EAGAIN if hctx->dispatch was found non-empty and run_work has to * be run again. This is necessary to avoid starving flushes.
@@ -223,7 +223,7 @@ static struct blk_mq_ctx *blk_mq_next_ctx(struct blk_mq_hw_ctx *hctx,/* * Only SCSI implements .get_budget and .put_budget, and SCSI restarts * its queue by itself in its completion handler, so we don't need to -* restart queue if .get_budget() returns BLK_STS_NO_RESOURCE. +* restart queue if .get_budget() fails to get the budget. * * Returns -EAGAIN if hctx->dispatch was found non-empty and run_work has to * be run again. This is necessary to avoid starving flushes.
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 43/529 s390/dasd: Prepare for additional path event handling
In reply to Greg Kroah-HartmanFrom: Jan Höppner <[email protected]>
[ Upstream commit b72949328869dfd45f6452c2410647afd7db5f1a ]
As more path events need to be handled for ECKD the current path verification infrastructure can be reused. Rename all path verifcation code to fit the more broadly based task of path event handling and put the path verification in a new separate function.
Stable-dep-of: 460e9bed82e4 ("s390/dasd: Fix potential memleak in dasd_eckd_init()")
--- drivers/s390/block/dasd.c | 4 +- drivers/s390/block/dasd_eckd.c | 78 +++++++++++++++++++--------------- drivers/s390/block/dasd_int.h | 1 + 3 files changed, 47 insertions(+), 36 deletions(-)
drivers/s390/block/dasd.c +2 -2
@@ -2128,8 +2128,8 @@ static void __dasd_device_check_path_events(struct dasd_device *device)if (device->stopped & ~(DASD_STOPPED_DC_WAIT |DASD_UNRESUMED_PM ))return ; - rc = device->discipline->verify_path (device, -dasd_path_get_tbvpm (device)); + rc = device->discipline->pe_handler (device, +dasd_path_get_tbvpm (device));if (rc)dasd_device_set_timer (device,50 );else
drivers/s390/block/dasd_eckd.c +44 -34
162 lines not on this page · raw message
drivers/s390/block/dasd_int.h +1 -0
@@ -299,6 +299,7 @@ struct dasd_discipline {* configuration. */ int (*verify_path)(struct dasd_device *,__u8 ); +int (*pe_handler)(struct dasd_device *,__u8 );/* * Last things to do when a device is set online, and first things
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 44/529 s390/dasd: Fix potential memleak in dasd_eckd_init()
In reply to Greg Kroah-HartmanFrom: Qiheng Lin <[email protected]>
[ Upstream commit 460e9bed82e49db1b823dcb4e421783854d86c40 ]
dasd_reserve_req is allocated before dasd_vol_info_req, and it also needs to be freed before the error returns, just like the other cases in this function.
--- drivers/s390/block/dasd_eckd.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/s390/block/dasd_eckd.c +3 -1
@@ -6763,8 +6763,10 @@ dasd_eckd_init(void)return -ENOMEM ; dasd_vol_info_req =kmalloc (sizeof (*dasd_vol_info_req),GFP_KERNEL |GFP_DMA ); -if (!dasd_vol_info_req) +if (!dasd_vol_info_req) { +kfree (dasd_reserve_req);return -ENOMEM ; + } pe_handler_worker =kmalloc (sizeof (*pe_handler_worker),GFP_KERNEL |GFP_DMA );if (!pe_handler_worker) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 45/529 sched/deadline,rt: Remove unused parameter from pick_next_[rt|dl]_entity()
In reply to Greg Kroah-HartmanFrom: Dietmar Eggemann <[email protected]>
[ Upstream commit 821aecd09e5ad2f8d4c3d8195333d272b392f7d3 ]
The struct rq *rq parameter isn't used. Remove it.
Stable-dep-of: 7c4a5b89a0b5 ("sched/rt: pick_next_rt_entity(): check list_entry")
--- kernel/sched/deadline.c | 5 ++--- kernel/sched/rt.c | 5 ++--- 2 files changed, 4 insertions(+), 6 deletions(-)
kernel/sched/deadline.c +2 -3
@@ -1847,8 +1847,7 @@ static void set_next_task_dl(struct rq *rq, struct task_struct *p, bool first)deadline_queue_push_tasks (rq); } -static struct sched_dl_entity *pick_next_dl_entity (struct rq *rq, -struct dl_rq *dl_rq) +static struct sched_dl_entity *pick_next_dl_entity (struct dl_rq *dl_rq) {struct rb_node *left =rb_first_cached (&dl_rq->root);
@@ -1867,7 +1866,7 @@ static struct task_struct *pick_next_task_dl(struct rq *rq)if (!sched_dl_runnable (rq))return NULL ; - dl_se =pick_next_dl_entity (rq, dl_rq); + dl_se =pick_next_dl_entity (dl_rq);BUG_ON (!dl_se); p =dl_task_of (dl_se);set_next_task_dl (rq, p, true);
kernel/sched/rt.c +2 -3
@@ -1605,8 +1605,7 @@ static inline void set_next_task_rt(struct rq *rq, struct task_struct *p, bool frt_queue_push_tasks (rq); } -static struct sched_rt_entity *pick_next_rt_entity (struct rq *rq, -struct rt_rq *rt_rq) +static struct sched_rt_entity *pick_next_rt_entity (struct rt_rq *rt_rq) {struct rt_prio_array *array = &rt_rq->active;struct sched_rt_entity *next =NULL ;
@@ -1628,7 +1627,7 @@ static struct task_struct *_pick_next_task_rt(struct rq *rq)struct rt_rq *rt_rq = &rq->rt;do { - rt_se =pick_next_rt_entity (rq, rt_rq); + rt_se =pick_next_rt_entity (rt_rq);BUG_ON (!rt_se); rt_rq =group_rt_rq (rt_se); }while (rt_rq);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 46/529 sched/rt: pick_next_rt_entity(): check list_entry
In reply to Greg Kroah-HartmanFrom: Pietro Borrello <[email protected]>
[ Upstream commit 7c4a5b89a0b5a57a64b601775b296abf77a9fe97 ]
Commit 326587b84078 ("sched: fix goto retry in pick_next_task_rt()") removed any path which could make pick_next_rt_entity() return NULL. However, BUG_ON(!rt_se) in _pick_next_task_rt() (the only caller of pick_next_rt_entity()) still checks the error condition, which can never happen, since list_entry() never returns NULL. Remove the BUG_ON check, and instead emit a warning in the only possible error condition here: the queue being empty which should never happen.
--- kernel/sched/rt.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
kernel/sched/rt.c +4 -1
@@ -1616,6 +1616,8 @@ static struct sched_rt_entity *pick_next_rt_entity(struct rt_rq *rt_rq)BUG_ON (idx >=MAX_RT_PRIO ); queue = array->queue + idx; +if (SCHED_WARN_ON (list_empty (queue))) +return NULL ; next = list_entry(queue->next, struct sched_rt_entity, run_list);return next;
@@ -1628,7 +1630,8 @@ static struct task_struct *_pick_next_task_rt(struct rq *rq)do { rt_se =pick_next_rt_entity (rt_rq); -BUG_ON (!rt_se); +if (unlikely (!rt_se)) +return NULL ; rt_rq =group_rt_rq (rt_se); }while (rt_rq);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 47/529 x86/perf/zhaoxin: Add stepping check for ZXC
In reply to Greg Kroah-HartmanFrom: silviazhao <[email protected]>
[ Upstream commit fd636b6a9bc6034f2e5bb869658898a2b472c037 ]
Some of Nano series processors will lead GP when accessing PMC fixed counter. Meanwhile, their hardware support for PMC has not announced externally. So exclude Nano CPUs from ZXC by checking stepping information. This is an unambiguous way to differentiate between ZXC and Nano CPUs.
Following are Nano and ZXC FMS information:
Nano FMS: Family=6, Model=F, Stepping=[0-A][C-D]
ZXC FMS: Family=6, Model=F, Stepping=E-F OR
Family=6, Model=0x19, Stepping=0-3--- arch/x86/events/zhaoxin/core.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
arch/x86/events/zhaoxin/core.c +7 -1
@@ -541,7 +541,13 @@ __init int zhaoxin_pmu_init(void)switch (boot_cpu_data.x86) {case 0x06 : -if (boot_cpu_data.x86_model ==0x0f || boot_cpu_data.x86_model ==0x19 ) { +/* +* Support Zhaoxin CPU from ZXC series, exclude Nano series through FMS. +* Nano FMS: Family=6, Model=F, Stepping=[0-A][C-D] +* ZXC FMS: Family=6, Model=F, Stepping=E-F OR Family=6, Model=0x19, Stepping=0-3 +*/ +if ((boot_cpu_data.x86_model ==0x0f && boot_cpu_data.x86_stepping >=0x0e ) || + boot_cpu_data.x86_model ==0x19 ) { x86_pmu.max_period = x86_pmu.cntval_mask >>1 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 48/529 block: bio-integrity: Copy flags when bio_integrity_payload is cloned
In reply to Greg Kroah-HartmanFrom: Martin K. Petersen <[email protected]>
[ Upstream commit b6a4bdcda430e3ca43bbb9cb1d4d4d34ebe15c40 ]
Make sure to copy the flags when a bio_integrity_payload is cloned. Otherwise per-I/O properties such as IP checksum flag will not be passed down to the HBA driver. Since the integrity buffer is owned by the original bio, the BIP_BLOCK_INTEGRITY flag needs to be masked off to avoid a double free in the completion path.
--- block/bio-integrity.c | 1 + 1 file changed, 1 insertion(+)
block/bio-integrity.c +1 -0
@@ -428,6 +428,7 @@ int bio_integrity_clone(struct bio *bio, struct bio *bio_src, bip->bip_vcnt = bip_src->bip_vcnt; bip->bip_iter = bip_src->bip_iter; + bip->bip_flags = bip_src->bip_flags & ~BIP_BLOCK_INTEGRITY ;return 0 ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 49/529 wifi: rsi: Fix memory leak in rsi_coex_attach()
In reply to Greg Kroah-HartmanFrom: Yuan Can <[email protected]>
[ Upstream commit 956fb851a6e19da5ab491e19c1bc323bb2c2cf6f ]
The coex_cb needs to be freed when rsi_create_kthread() failed in rsi_coex_attach().
--- drivers/net/wireless/rsi/rsi_91x_coex.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/rsi/rsi_91x_coex.c +1 -0
@@ -160,6 +160,7 @@ int rsi_coex_attach(struct rsi_common *common) rsi_coex_scheduler_thread, "Coex-Tx-Thread")) {rsi_dbg (ERR_ZONE ,"%s: Unable to init tx thrd\n" , __func__); +kfree (coex_cb);return -EINVAL ; }return 0 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 50/529 wifi: rtlwifi: rtl8821ae: dont call kfree_skb() under spin_lock_irqsave()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 106031c1f4a850915190d7ec1026696282f9359b ]
It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. All the SKBs have been dequeued from the old queue, so it's safe to enqueue these SKBs to a free queue, then free them after spin_unlock_irqrestore() at once. Compile tested only.
--- drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c +5 -1
@@ -26,8 +26,10 @@ static void _rtl8821ae_return_beacon_queue_skb(struct ieee80211_hw *hw)struct rtl_priv *rtlpriv =rtl_priv (hw);struct rtl_pci *rtlpci =rtl_pcidev (rtl_pcipriv (hw));struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE ]; +struct sk_buff_head free_list;unsigned long flags; +skb_queue_head_init (&free_list);spin_lock_irqsave (&rtlpriv->locks.irq_th_lock, flags);while (skb_queue_len (&ring->queue)) {struct rtl_tx_desc *entry = &ring->desc[ring->idx];
@@ -37,10 +39,12 @@ static void _rtl8821ae_return_beacon_queue_skb(struct ieee80211_hw *hw) rtlpriv->cfg->ops->get_desc (hw, (u8 *)entry, true,HW_DESC_TXBUFF_ADDR ), skb->len, DMA_TO_DEVICE); -kfree_skb (skb); +__skb_queue_tail (&free_list, skb); ring->idx = (ring->idx +1 ) % ring->entries; }spin_unlock_irqrestore (&rtlpriv->locks.irq_th_lock, flags); + +__skb_queue_purge (&free_list); } static void _rtl8821ae_set_bcn_ctrl_reg(struct ieee80211_hw *hw,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 51/529 wifi: rtlwifi: rtl8188ee: dont call kfree_skb() under spin_lock_irqsave()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 2611687fa7ffc84190f92292de0b80468de17220 ]
It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. All the SKBs have been dequeued from the old queue, so it's safe to enqueue these SKBs to a free queue, then free them after spin_unlock_irqrestore() at once. Compile tested only.
--- drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/wireless/realtek/rtlwifi/rtl8188ee/hw.c +5 -1
@@ -68,8 +68,10 @@ static void _rtl88ee_return_beacon_queue_skb(struct ieee80211_hw *hw)struct rtl_priv *rtlpriv =rtl_priv (hw);struct rtl_pci *rtlpci =rtl_pcidev (rtl_pcipriv (hw));struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE ]; +struct sk_buff_head free_list;unsigned long flags; +skb_queue_head_init (&free_list);spin_lock_irqsave (&rtlpriv->locks.irq_th_lock, flags);while (skb_queue_len (&ring->queue)) {struct rtl_tx_desc *entry = &ring->desc[ring->idx];
@@ -79,10 +81,12 @@ static void _rtl88ee_return_beacon_queue_skb(struct ieee80211_hw *hw) rtlpriv->cfg->ops->get_desc (hw, (u8 *)entry, true,HW_DESC_TXBUFF_ADDR ), skb->len, DMA_TO_DEVICE); -kfree_skb (skb); +__skb_queue_tail (&free_list, skb); ring->idx = (ring->idx +1 ) % ring->entries; }spin_unlock_irqrestore (&rtlpriv->locks.irq_th_lock, flags); + +__skb_queue_purge (&free_list); }static void _rtl88ee_disable_bcn_sub_func (struct ieee80211_hw *hw)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 52/529 wifi: rtlwifi: rtl8723be: dont call kfree_skb() under spin_lock_irqsave()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 313950c2114e7051c4e3020fd82495fa1fb526a8 ]
It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. All the SKBs have been dequeued from the old queue, so it's safe to enqueue these SKBs to a free queue, then free them after spin_unlock_irqrestore() at once. Compile tested only.
--- drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c +5 -1
@@ -30,8 +30,10 @@ static void _rtl8723be_return_beacon_queue_skb(struct ieee80211_hw *hw)struct rtl_priv *rtlpriv =rtl_priv (hw);struct rtl_pci *rtlpci =rtl_pcidev (rtl_pcipriv (hw));struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[BEACON_QUEUE ]; +struct sk_buff_head free_list;unsigned long flags; +skb_queue_head_init (&free_list);spin_lock_irqsave (&rtlpriv->locks.irq_th_lock, flags);while (skb_queue_len (&ring->queue)) {struct rtl_tx_desc *entry = &ring->desc[ring->idx];
@@ -41,10 +43,12 @@ static void _rtl8723be_return_beacon_queue_skb(struct ieee80211_hw *hw) rtlpriv->cfg->ops->get_desc (hw, (u8 *)entry, true,HW_DESC_TXBUFF_ADDR ), skb->len, DMA_TO_DEVICE); -kfree_skb (skb); +__skb_queue_tail (&free_list, skb); ring->idx = (ring->idx +1 ) % ring->entries; }spin_unlock_irqrestore (&rtlpriv->locks.irq_th_lock, flags); + +__skb_queue_purge (&free_list); } static void _rtl8723be_set_bcn_ctrl_reg(struct ieee80211_hw *hw,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 53/529 wifi: iwlegacy: common: dont call dev_kfree_skb() under spin_lock_irqsave()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 0c1528675d7a9787cb516b64d8f6c0f6f8efcb48 ]
It is not allowed to call consume_skb() from hardware interrupt context or with interrupts being disabled. So replace dev_kfree_skb() with dev_consume_skb_irq() under spin_lock_irqsave(). Compile tested only.
--- drivers/net/wireless/intel/iwlegacy/common.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/iwlegacy/common.c +2 -2
@@ -5176,7 +5176,7 @@ il_mac_reset_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)memset (&il->current_ht_config,0 ,sizeof (struct il_ht_config ));/* new association get rid of ibss beacon skb */ -dev_kfree_skb (il->beacon_skb); +dev_consume_skb_irq (il->beacon_skb); il->beacon_skb =NULL ; il->timestamp =0 ;
@@ -5295,7 +5295,7 @@ il_beacon_update(struct ieee80211_hw *hw, struct ieee80211_vif *vif) }spin_lock_irqsave (&il->lock, flags); -dev_kfree_skb (il->beacon_skb); +dev_consume_skb_irq (il->beacon_skb); il->beacon_skb = skb; timestamp = ((struct ieee80211_mgmt *)skb->data)->u.beacon.timestamp;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 54/529 wifi: libertas: fix memory leak in lbs_init_adapter()
In reply to Greg Kroah-HartmanFrom: Zhengchao Shao <[email protected]>
[ Upstream commit 16a03958618fb91bb1bc7077cf3211055162cc2f ]
When kfifo_alloc() failed in lbs_init_adapter(), cmd buffer is not released. Add free memory to processing error path.
--- drivers/net/wireless/marvell/libertas/main.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/marvell/libertas/main.c +1 -0
@@ -870,6 +870,7 @@ static int lbs_init_adapter(struct lbs_private *priv) ret =kfifo_alloc (&priv->event_fifo,sizeof (u32) *16 ,GFP_KERNEL );if (ret) {pr_err ("Out of memory allocating event FIFO buffer\n" ); +lbs_free_cmd_buffer (priv); goto out; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 55/529 wifi: rtl8xxxu: dont call dev_kfree_skb() under spin_lock_irqsave()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 4c2005ac87685907b3719b4f40215b578efd27c4 ]
It is not allowed to call kfree_skb() or consume_skb() from hardware interrupt context or with hardware interrupts being disabled.
It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead. The difference between them is free reason, dev_kfree_skb_irq() means the SKB is dropped in error and dev_consume_skb_irq() means the SKB is consumed in normal.
In this case, dev_kfree_skb() is called to free and drop the SKB when it's shutdown, so replace it with dev_kfree_skb_irq(). Compile tested only.
--- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +1 -1
@@ -5184,7 +5184,7 @@ static void rtl8xxxu_queue_rx_urb(struct rtl8xxxu_priv *priv, pending = priv->rx_urb_pending_count; }else { skb = (struct sk_buff *)rx_urb->urb.context; -dev_kfree_skb (skb); +dev_kfree_skb_irq (skb);usb_free_urb (&rx_urb->urb); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 56/529 rtlwifi: fix -Wpointer-sign warning
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit ef41937631bfee855e2b406e1d536efdaa9ce512 ]
There are thousands of warnings in a W=2 build from just one file:
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c:3788:15: warning: pointer targets in initialization of 'u8 *' {aka 'unsigned char *'} from 'char *' differ in signedness [-Wpointer-sign]
Change the types to consistently use 'const char *' for the strings.
Stable-dep-of: 117dbeda22ec ("wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()")
--- .../wireless/realtek/rtlwifi/rtl8821ae/phy.c | 81 ++++++++++--------- .../realtek/rtlwifi/rtl8821ae/table.c | 4 +- .../realtek/rtlwifi/rtl8821ae/table.h | 4 +- 3 files changed, 45 insertions(+), 44 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c +41 -40
@@ -1581,7 +1581,7 @@ static void _rtl8821ae_phy_txpower_by_rate_configuration(struct ieee80211_hw *hw }/* string is in decimal */ -static bool _rtl8812ae_get_integer_from_string (char *str,u8 *pint) +static bool _rtl8812ae_get_integer_from_string (const char *str,u8 *pint) {u16 i =0 ; *pint =0 ;
@@ -1599,7 +1599,7 @@ static bool _rtl8812ae_get_integer_from_string(char *str, u8 *pint)return true; } -static bool _rtl8812ae_eq_n_byte (u8 *str1,u8 *str2,u32 num) +static bool _rtl8812ae_eq_n_byte (const char *str1,const char *str2,u32 num) {if (num ==0 )return false;
@@ -1637,10 +1637,11 @@ static s8 _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt(struct ieee80211_hw *hw,return channel_index; } -static void _rtl8812ae_phy_set_txpower_limit (struct ieee80211_hw *hw,u8 *pregulation, -u8 *pband,u8 *pbandwidth, -u8 *prate_section,u8 *prf_path, -u8 *pchannel,u8 *ppower_limit) +static void _rtl8812ae_phy_set_txpower_limit (struct ieee80211_hw *hw, +const char *pregulation, +const char *pband,const char *pbandwidth, +const char *prate_section,const char *prf_path, +const char *pchannel,const char *ppower_limit) {struct rtl_priv *rtlpriv =rtl_priv (hw);struct rtl_phy *rtlphy = &rtlpriv->phy;
@@ -1648,8 +1649,8 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, u8 *pregulu8 channel_index;s8 power_limit =0 , prev_power_limit, ret; -if (!_rtl8812ae_get_integer_from_string ((char *)pchannel, &channel) || - !_rtl8812ae_get_integer_from_string ((char *)ppower_limit, +if (!_rtl8812ae_get_integer_from_string (pchannel, &channel) || + !_rtl8812ae_get_integer_from_string (ppower_limit, &power_limit)) { rtl_dbg(rtlpriv, COMP_INIT, DBG_TRACE, "Illegal index of pwr_lmt table [chnl %d][val %d]\n",
@@ -1659,42 +1660,42 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, u8 *pregul power_limit = power_limit >MAX_POWER_INDEX ?MAX_POWER_INDEX : power_limit; -if (_rtl8812ae_eq_n_byte (pregulation, (u8 *)("FCC" ),3 )) +if (_rtl8812ae_eq_n_byte (pregulation,"FCC" ,3 )) regulation =0 ; -else if (_rtl8812ae_eq_n_byte (pregulation, (u8 *)("MKK" ),3 )) +else if (_rtl8812ae_eq_n_byte (pregulation,"MKK" ,3 )) regulation =1 ; -else if (_rtl8812ae_eq_n_byte (pregulation, (u8 *)("ETSI" ),4 )) +else if (_rtl8812ae_eq_n_byte (pregulation,"ETSI" ,4 )) regulation =2 ; -else if (_rtl8812ae_eq_n_byte (pregulation, (u8 *)("WW13" ),4 )) +else if (_rtl8812ae_eq_n_byte (pregulation,"WW13" ,4 )) regulation =3 ; -if (_rtl8812ae_eq_n_byte (prate_section, (u8 *)("CCK" ),3 )) +if (_rtl8812ae_eq_n_byte (prate_section,"CCK" ,3 )) rate_section =0 ; -else if (_rtl8812ae_eq_n_byte (prate_section, (u8 *)("OFDM" ),4 )) +else if (_rtl8812ae_eq_n_byte (prate_section,"OFDM" ,4 )) rate_section =1 ; -else if (_rtl8812ae_eq_n_byte (prate_section, (u8 *)("HT" ),2 ) && -_rtl8812ae_eq_n_byte (prf_path, (u8 *)("1T" ),2 )) +else if (_rtl8812ae_eq_n_byte (prate_section,"HT" ,2 ) && +_rtl8812ae_eq_n_byte (prf_path,"1T" ,2 )) rate_section =2 ; -else if (_rtl8812ae_eq_n_byte (prate_section, (u8 *)("HT" ),2 ) && -_rtl8812ae_eq_n_byte (prf_path, (u8 *)("2T" ),2 )) +else if (_rtl8812ae_eq_n_byte (prate_section,"HT" ,2 ) && +_rtl8812ae_eq_n_byte (prf_path,"2T" ,2 )) rate_section =3 ; -else if (_rtl8812ae_eq_n_byte (prate_section, (u8 *)("VHT" ),3 ) && -_rtl8812ae_eq_n_byte (prf_path, (u8 *)("1T" ),2 )) +else if (_rtl8812ae_eq_n_byte (prate_section,"VHT" ,3 ) && +_rtl8812ae_eq_n_byte (prf_path,"1T" ,2 )) rate_section =4 ; -else if (_rtl8812ae_eq_n_byte (prate_section, (u8 *)("VHT" ),3 ) && -_rtl8812ae_eq_n_byte (prf_path, (u8 *)("2T" ),2 )) +else if (_rtl8812ae_eq_n_byte (prate_section,"VHT" ,3 ) && +_rtl8812ae_eq_n_byte (prf_path,"2T" ,2 )) rate_section =5 ; -if (_rtl8812ae_eq_n_byte (pbandwidth, (u8 *)("20M" ),3 )) +if (_rtl8812ae_eq_n_byte (pbandwidth,"20M" ,3 )) bandwidth =0 ; -else if (_rtl8812ae_eq_n_byte (pbandwidth, (u8 *)("40M" ),3 )) +else if (_rtl8812ae_eq_n_byte (pbandwidth,"40M" ,3 )) bandwidth =1 ; -else if (_rtl8812ae_eq_n_byte (pbandwidth, (u8 *)("80M" ),3 )) +else if (_rtl8812ae_eq_n_byte (pbandwidth,"80M" ,3 )) bandwidth =2 ; -else if (_rtl8812ae_eq_n_byte (pbandwidth, (u8 *)("160M" ),4 )) +else if (_rtl8812ae_eq_n_byte (pbandwidth,"160M" ,4 )) bandwidth =3 ; -if (_rtl8812ae_eq_n_byte (pband, (u8 *)("2.4G" ),4 )) { +if (_rtl8812ae_eq_n_byte (pband,"2.4G" ,4 )) { ret =_rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt (hw,BAND_ON_2_4G , channel);
@@ -1718,7 +1719,7 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, u8 *pregul regulation, bandwidth, rate_section, channel_index, rtlphy->txpwr_limit_2_4g[regulation][bandwidth] [rate_section][channel_index][RF90_PATH_A]); - }else if (_rtl8812ae_eq_n_byte (pband, (u8 *)("5G" ),2 )) { + }else if (_rtl8812ae_eq_n_byte (pband,"5G" ,2 )) { ret =_rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt (hw,BAND_ON_5G , channel);
@@ -1749,10 +1750,10 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, u8 *pregul }static void _rtl8812ae_phy_config_bb_txpwr_lmt (struct ieee80211_hw *hw, -u8 *regulation,u8 *band, -u8 *bandwidth,u8 *rate_section, -u8 *rf_path,u8 *channel, -u8 *power_limit) +const char *regulation,const char *band, +const char *bandwidth,const char *rate_section, +const char *rf_path,const char *channel, +const char *power_limit) { _rtl8812ae_phy_set_txpower_limit(hw, regulation, band, bandwidth, rate_section, rf_path, channel,
@@ -1765,7 +1766,7 @@ static void _rtl8821ae_phy_read_and_config_txpwr_lmt(struct ieee80211_hw *hw)struct rtl_hal *rtlhal =rtl_hal (rtlpriv);u32 i =0 ;u32 array_len; -u8 **array; +const char **array;if (rtlhal->hw_type ==HARDWARE_TYPE_RTL8812AE ) { array_len =RTL8812AE_TXPWR_LMT_ARRAY_LEN ;
@@ -1778,13 +1779,13 @@ static void _rtl8821ae_phy_read_and_config_txpwr_lmt(struct ieee80211_hw *hw)rtl_dbg (rtlpriv,COMP_INIT ,DBG_TRACE ,"\n" );for (i =0 ; i < array_len; i +=7 ) { -u8 *regulation = array[i]; -u8 *band = array[i+1 ]; -u8 *bandwidth = array[i+2 ]; -u8 *rate = array[i+3 ]; -u8 *rf_path = array[i+4 ]; -u8 *chnl = array[i+5 ]; -u8 *val = array[i+6 ]; +const char *regulation = array[i]; +const char *band = array[i+1 ]; +const char *bandwidth = array[i+2 ]; +const char *rate = array[i+3 ]; +const char *rf_path = array[i+4 ]; +const char *chnl = array[i+5 ]; +const char *val = array[i+6 ]; _rtl8812ae_phy_config_bb_txpwr_lmt(hw, regulation, band, bandwidth, rate, rf_path,
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.c +2 -2
@@ -2894,7 +2894,7 @@ u32 RTL8821AE_AGC_TAB_1TARRAYLEN = ARRAY_SIZE(RTL8821AE_AGC_TAB_ARRAY);* TXPWR_LMT.TXT ******************************************************************************/ -u8 *RTL8812AE_TXPWR_LMT [] = { +const char *RTL8812AE_TXPWR_LMT [] = {"FCC" ,"2.4G" ,"20M" ,"CCK" ,"1T" ,"01" ,"36" ,"ETSI" ,"2.4G" ,"20M" ,"CCK" ,"1T" ,"01" ,"32" ,"MKK" ,"2.4G" ,"20M" ,"CCK" ,"1T" ,"01" ,"32" ,
@@ -3463,7 +3463,7 @@ u8 *RTL8812AE_TXPWR_LMT[] = {u32 RTL8812AE_TXPWR_LMT_ARRAY_LEN =ARRAY_SIZE (RTL8812AE_TXPWR_LMT ); -u8 *RTL8821AE_TXPWR_LMT [] = { +const char *RTL8821AE_TXPWR_LMT [] = {"FCC" ,"2.4G" ,"20M" ,"CCK" ,"1T" ,"01" ,"32" ,"ETSI" ,"2.4G" ,"20M" ,"CCK" ,"1T" ,"01" ,"32" ,"MKK" ,"2.4G" ,"20M" ,"CCK" ,"1T" ,"01" ,"32" ,
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/table.h +2 -2
@@ -28,7 +28,7 @@ extern u32 RTL8821AE_AGC_TAB_ARRAY[];extern u32 RTL8812AE_AGC_TAB_1TARRAYLEN ;extern u32 RTL8812AE_AGC_TAB_ARRAY [];extern u32 RTL8812AE_TXPWR_LMT_ARRAY_LEN ; -extern u8 *RTL8812AE_TXPWR_LMT []; +extern const char *RTL8812AE_TXPWR_LMT [];extern u32 RTL8821AE_TXPWR_LMT_ARRAY_LEN ; -extern u8 *RTL8821AE_TXPWR_LMT []; +extern const char *RTL8821AE_TXPWR_LMT [];#endif
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 57/529 wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()
In reply to Greg Kroah-HartmanFrom: Li Zetao <[email protected]>
[ Upstream commit 117dbeda22ec5ea0918254d03b540ef8b8a64d53 ]
There is a global-out-of-bounds reported by KASAN:
BUG: KASAN: global-out-of-bounds in _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae] Read of size 1 at addr ffffffffa0773c43 by task NetworkManager/411 CPU: 6 PID: 411 Comm: NetworkManager Tainted: G D 6.1.0-rc8+ #144 e15588508517267d37 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), Call Trace: <TASK> ... kasan_report+0xbb/0x1c0 _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae] rtl8821ae_phy_bb_config.cold+0x346/0x641 [rtl8821ae] rtl8821ae_hw_init+0x1f5e/0x79b0 [rtl8821ae] ... </TASK>
The root cause of the problem is that the comparison order of "prate_section" in _rtl8812ae_phy_set_txpower_limit() is wrong. The _rtl8812ae_eq_n_byte() is used to compare the first n bytes of the two strings from tail to head, which causes the problem. In the _rtl8812ae_phy_set_txpower_limit(), it was originally intended to meet this requirement by carefully designing the comparison order. For example, "pregulation" and "pbandwidth" are compared in order of length from small to large, first is 3 and last is 4. However, the comparison order of "prate_section" dose not obey such order requirement, therefore when "prate_section" is "HT", when comparing from tail to head, it will lead to access out of bounds in _rtl8812ae_eq_n_byte(). As mentioned above, the _rtl8812ae_eq_n_byte() has the same function as strcmp(), so just strcmp() is enough.
Fix it by removing _rtl8812ae_eq_n_byte() and use strcmp() barely. Although it can be fixed by adjusting the comparison order of "prate_section", this may cause the value of "rate_section" to not be from 0 to 5. In addition, commit "21e4b0726dc6" not only moved driver from staging to regular tree, but also added setting txpower limit function during the driver config phase, so the problem was introduced by this commit.
--- .../wireless/realtek/rtlwifi/rtl8821ae/phy.c | 52 +++++++------------ 1 file changed, 20 insertions(+), 32 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c +20 -32
@@ -1599,18 +1599,6 @@ static bool _rtl8812ae_get_integer_from_string(const char *str, u8 *pint)return true; } -static bool _rtl8812ae_eq_n_byte (const char *str1,const char *str2,u32 num) -{ -if (num ==0 ) -return false; -while (num >0 ) { - num--; -if (str1[num] != str2[num]) -return false; - } -return true; -} -static s8 _rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt (struct ieee80211_hw *hw,u8 band,u8 channel) {
@@ -1660,42 +1648,42 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, power_limit = power_limit >MAX_POWER_INDEX ?MAX_POWER_INDEX : power_limit; -if (_rtl8812ae_eq_n_byte (pregulation,"FCC" ,3 )) +if (strcmp (pregulation,"FCC" ) ==0 ) regulation =0 ; -else if (_rtl8812ae_eq_n_byte (pregulation,"MKK" ,3 )) +else if (strcmp (pregulation,"MKK" ) ==0 ) regulation =1 ; -else if (_rtl8812ae_eq_n_byte (pregulation,"ETSI" ,4 )) +else if (strcmp (pregulation,"ETSI" ) ==0 ) regulation =2 ; -else if (_rtl8812ae_eq_n_byte (pregulation,"WW13" ,4 )) +else if (strcmp (pregulation,"WW13" ) ==0 ) regulation =3 ; -if (_rtl8812ae_eq_n_byte (prate_section,"CCK" ,3 )) +if (strcmp (prate_section,"CCK" ) ==0 ) rate_section =0 ; -else if (_rtl8812ae_eq_n_byte (prate_section,"OFDM" ,4 )) +else if (strcmp (prate_section,"OFDM" ) ==0 ) rate_section =1 ; -else if (_rtl8812ae_eq_n_byte (prate_section,"HT" ,2 ) && -_rtl8812ae_eq_n_byte (prf_path,"1T" ,2 )) +else if (strcmp (prate_section,"HT" ) ==0 && +strcmp (prf_path,"1T" ) ==0 ) rate_section =2 ; -else if (_rtl8812ae_eq_n_byte (prate_section,"HT" ,2 ) && -_rtl8812ae_eq_n_byte (prf_path,"2T" ,2 )) +else if (strcmp (prate_section,"HT" ) ==0 && +strcmp (prf_path,"2T" ) ==0 ) rate_section =3 ; -else if (_rtl8812ae_eq_n_byte (prate_section,"VHT" ,3 ) && -_rtl8812ae_eq_n_byte (prf_path,"1T" ,2 )) +else if (strcmp (prate_section,"VHT" ) ==0 && +strcmp (prf_path,"1T" ) ==0 ) rate_section =4 ; -else if (_rtl8812ae_eq_n_byte (prate_section,"VHT" ,3 ) && -_rtl8812ae_eq_n_byte (prf_path,"2T" ,2 )) +else if (strcmp (prate_section,"VHT" ) ==0 && +strcmp (prf_path,"2T" ) ==0 ) rate_section =5 ; -if (_rtl8812ae_eq_n_byte (pbandwidth,"20M" ,3 )) +if (strcmp (pbandwidth,"20M" ) ==0 ) bandwidth =0 ; -else if (_rtl8812ae_eq_n_byte (pbandwidth,"40M" ,3 )) +else if (strcmp (pbandwidth,"40M" ) ==0 ) bandwidth =1 ; -else if (_rtl8812ae_eq_n_byte (pbandwidth,"80M" ,3 )) +else if (strcmp (pbandwidth,"80M" ) ==0 ) bandwidth =2 ; -else if (_rtl8812ae_eq_n_byte (pbandwidth,"160M" ,4 )) +else if (strcmp (pbandwidth,"160M" ) ==0 ) bandwidth =3 ; -if (_rtl8812ae_eq_n_byte (pband,"2.4G" ,4 )) { +if (strcmp (pband,"2.4G" ) ==0 ) { ret =_rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt (hw,BAND_ON_2_4G , channel);
@@ -1719,7 +1707,7 @@ static void _rtl8812ae_phy_set_txpower_limit(struct ieee80211_hw *hw, regulation, bandwidth, rate_section, channel_index, rtlphy->txpwr_limit_2_4g[regulation][bandwidth] [rate_section][channel_index][RF90_PATH_A]); - }else if (_rtl8812ae_eq_n_byte (pband,"5G" ,2 )) { + }else if (strcmp (pband,"5G" ) ==0 ) { ret =_rtl8812ae_phy_get_chnl_idx_of_txpwr_lmt (hw,BAND_ON_5G , channel);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 58/529 libbpf: Fix btf__align_of() by taking into account field offsets
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit 25a4481b4136af7794e1df2d6c90ed2f354d60ce ]
btf__align_of() is supposed to be return alignment requirement of a requested BTF type. For STRUCT/UNION it doesn't always return correct value, because it calculates alignment only based on field types. But for packed structs this is not enough, we need to also check field offsets and struct size. If field offset isn't aligned according to field type's natural alignment, then struct must be packed. Similarly, if struct size is not a multiple of struct's natural alignment, then struct must be packed as well.
This patch fixes this issue precisely by additionally checking these conditions.
--- tools/lib/bpf/btf.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
tools/lib/bpf/btf.c +13 -0
@@ -614,8 +614,21 @@ int btf__align_of(const struct btf *btf, __u32 id)if (align <=0 )return align; max_align =max (max_align, align); + +/* if field offset isn't aligned according to field +* type's alignment, then struct must be packed +*/ +if (btf_member_bitfield_size (t, i) ==0 && + (m->offset % (8 * align)) !=0 ) +return 1 ; } +/* if struct/union size isn't a multiple of its alignment, +* then struct must be packed +*/ +if ((t->size % max_align) !=0 ) +return 1 ; +return max_align; }default :
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 59/529 wifi: ipw2x00: dont call dev_kfree_skb() under spin_lock_irqsave()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 45fc6d7461f18df2f238caf0cbc5acc4163203d1 ]
It is not allowed to call kfree_skb() or consume_skb() from hardware interrupt context or with hardware interrupts being disabled.
It should use dev_kfree_skb_irq() or dev_consume_skb_irq() instead. The difference between them is free reason, dev_kfree_skb_irq() means the SKB is dropped in error and dev_consume_skb_irq() means the SKB is consumed in normal.
In this case, dev_kfree_skb() is called to free and drop the SKB when it's reset, so replace it with dev_kfree_skb_irq(). Compile tested only.
--- drivers/net/wireless/intel/ipw2x00/ipw2200.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/ipw2x00/ipw2200.c +1 -1
@@ -3444,7 +3444,7 @@ static void ipw_rx_queue_reset(struct ipw_priv *priv,dma_unmap_single (&priv->pci_dev->dev, rxq->pool[i].dma_addr,IPW_RX_BUF_SIZE ,DMA_FROM_DEVICE ); -dev_kfree_skb (rxq->pool[i].skb); +dev_kfree_skb_irq (rxq->pool[i].skb); rxq->pool[i].skb =NULL ; }list_add_tail (&rxq->pool[i].list, &rxq->rx_used);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 60/529 wifi: ipw2200: fix memory leak in ipw_wdev_init()
In reply to Greg Kroah-HartmanFrom: Zhengchao Shao <[email protected]>
[ Upstream commit 9fe21dc626117fb44a8eb393713a86a620128ce3 ]
In the error path of ipw_wdev_init(), exception value is returned, and the memory applied for in the function is not released. Also the memory is not released in ipw_pci_probe(). As a result, memory leakage occurs. So memory release needs to be added to the error path of ipw_wdev_init().
--- drivers/net/wireless/intel/ipw2x00/ipw2200.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/ipw2x00/ipw2200.c +7 -2
@@ -11400,9 +11400,14 @@ static int ipw_wdev_init(struct net_device *dev)set_wiphy_dev (wdev->wiphy, &priv->pci_dev->dev);/* With that information in place, we can now register the wiphy... */ -if (wiphy_register (wdev->wiphy)) - rc = -EIO ; + rc =wiphy_register (wdev->wiphy); +if (rc) + goto out; + +return 0 ; out: +kfree (priv->ieee->a_band.channels); +kfree (priv->ieee->bg_band.channels);return rc; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 61/529 wifi: wilc1000: fix potential memory leak in wilc_mac_xmit()
In reply to Greg Kroah-HartmanFrom: Zhang Changzhong <[email protected]>
[ Upstream commit deb962ec9e1c9a81babd3d37542ad4bd6ac3396e ]
The wilc_mac_xmit() returns NETDEV_TX_OK without freeing skb, add dev_kfree_skb() to fix it. Compile tested only.
--- drivers/net/wireless/microchip/wilc1000/netdev.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/microchip/wilc1000/netdev.c +1 -0
@@ -684,6 +684,7 @@ netdev_tx_t wilc_mac_xmit(struct sk_buff *skb, struct net_device *ndev)if (skb->dev != ndev) {netdev_err (ndev,"Packet not destined to this device\n" ); +dev_kfree_skb (skb);return NETDEV_TX_OK ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 62/529 wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit()
In reply to Greg Kroah-HartmanFrom: Zhang Changzhong <[email protected]>
[ Upstream commit 212fde3fe76e962598ce1d47b97cc78afdfc71b3 ]
The brcmf_netdev_start_xmit() returns NETDEV_TX_OK without freeing skb in case of pskb_expand_head() fails, add dev_kfree_skb() to fix it. Compile tested only.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +1 -0
@@ -333,6 +333,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,bphy_err (drvr,"%s: failed to expand headroom\n" ,brcmf_ifname (ifp));atomic_inc (&drvr->bus_if->stats.pktcow_failed); +dev_kfree_skb (skb); goto done; } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 63/529 wifi: brcmfmac: unmap dma buffer in brcmf_msgbuf_alloc_pktid()
In reply to Greg Kroah-HartmanFrom: Zhengchao Shao <[email protected]>
[ Upstream commit b9f420032f2ba1e634b22ca7b433e5c40ea663af ]
After the DMA buffer is mapped to a physical address, address is stored in pktids in brcmf_msgbuf_alloc_pktid(). Then, pktids is parsed in brcmf_msgbuf_get_pktid()/brcmf_msgbuf_release_array() to obtain physaddr and later unmap the DMA buffer. But when count is always equal to pktids->array_size, physaddr isn't stored in pktids and the DMA buffer will not be unmapped anyway.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c +4 -1
@@ -346,8 +346,11 @@ brcmf_msgbuf_alloc_pktid(struct device *dev, count++; }while (count < pktids->array_size); -if (count == pktids->array_size) +if (count == pktids->array_size) { +dma_unmap_single (dev, *physaddr, skb->len - data_offset, + pktids->direction);return -ENOMEM ; + } array[*idx].data_offset = data_offset; array[*idx].physaddr = *physaddr;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 64/529 wifi: libertas_tf: dont call kfree_skb() under spin_lock_irqsave()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 9388ce97b98216833c969191ee6df61a7201d797 ]
It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile tested only.
--- drivers/net/wireless/marvell/libertas_tf/if_usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/marvell/libertas_tf/if_usb.c +1 -1
@@ -613,7 +613,7 @@ static inline void process_cmdrequest(int recvlength, uint8_t *recvbuff,spin_lock_irqsave (&priv->driver_lock, flags);memcpy (priv->cmd_resp_buff, recvbuff +MESSAGE_HEADER_LEN , recvlength -MESSAGE_HEADER_LEN ); -kfree_skb (skb); +dev_kfree_skb_irq (skb);lbtf_cmd_response_rx (priv);spin_unlock_irqrestore (&priv->driver_lock, flags); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 65/529 wifi: libertas: if_usb: dont call kfree_skb() under spin_lock_irqsave()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 3968e81ba644f10a7d45bae2539560db9edac501 ]
It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile tested only.
--- drivers/net/wireless/marvell/libertas/if_usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/marvell/libertas/if_usb.c +1 -1
@@ -637,7 +637,7 @@ static inline void process_cmdrequest(int recvlength, uint8_t *recvbuff, priv->resp_len[i] = (recvlength -MESSAGE_HEADER_LEN );memcpy (priv->resp_buf[i], recvbuff +MESSAGE_HEADER_LEN , priv->resp_len[i]); -kfree_skb (skb); +dev_kfree_skb_irq (skb);lbs_notify_command_response (priv, i);spin_unlock_irqrestore (&priv->driver_lock, flags);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 66/529 wifi: libertas: main: dont call kfree_skb() under spin_lock_irqsave()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit f393df151540bf858effbd29ff572ab94e76a4c4 ]
It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile tested only.
--- drivers/net/wireless/marvell/libertas/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/marvell/libertas/main.c +1 -1
@@ -217,7 +217,7 @@ int lbs_stop_iface(struct lbs_private *priv)spin_lock_irqsave (&priv->driver_lock, flags); priv->iface_running = false; -kfree_skb (priv->currenttxskb); +dev_kfree_skb_irq (priv->currenttxskb); priv->currenttxskb =NULL ; priv->tx_pending_len =0 ;spin_unlock_irqrestore (&priv->driver_lock, flags);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 67/529 wifi: libertas: cmdresp: dont call kfree_skb() under spin_lock_irqsave()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 708a49a64237f19bd404852f297aaadbc9e7fee0 ]
It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile tested only.
--- drivers/net/wireless/marvell/libertas/cmdresp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/marvell/libertas/cmdresp.c +1 -1
@@ -48,7 +48,7 @@ void lbs_mac_event_disconnected(struct lbs_private *priv,/* Free Tx and Rx packets */ spin_lock_irqsave (&priv->driver_lock, flags); -kfree_skb (priv->currenttxskb); +dev_kfree_skb_irq (priv->currenttxskb); priv->currenttxskb =NULL ; priv->tx_pending_len =0 ;spin_unlock_irqrestore (&priv->driver_lock, flags);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 68/529 wifi: wl3501_cs: dont call kfree_skb() under spin_lock_irqsave()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 44bacbdf9066c590423259dbd6d520baac99c1a8 ]
It is not allowed to call kfree_skb() from hardware interrupt context or with interrupts being disabled. So replace kfree_skb() with dev_kfree_skb_irq() under spin_lock_irqsave(). Compile tested only.
--- drivers/net/wireless/wl3501_cs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/wl3501_cs.c +1 -1
@@ -1330,7 +1330,7 @@ static netdev_tx_t wl3501_hard_start_xmit(struct sk_buff *skb, }else { ++dev->stats.tx_packets; dev->stats.tx_bytes += skb->len; -kfree_skb (skb); +dev_kfree_skb_irq (skb);if (this->tx_buffer_cnt <2 )netif_stop_queue (dev);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 69/529 crypto: x86/ghash - fix unaligned access in ghash_setkey()
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
[ Upstream commit 116db2704c193fff6d73ea6c2219625f0c9bdfc8 ]
The key can be unaligned, so use the unaligned memory access helpers.
--- arch/x86/crypto/ghash-clmulni-intel_glue.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/x86/crypto/ghash-clmulni-intel_glue.c +3 -3
@@ -19,6 +19,7 @@#include <crypto/internal/simd.h> #include <asm/cpu_device_id.h> #include <asm/simd.h> +#include <asm/unaligned.h> #define GHASH_BLOCK_SIZE 16#define GHASH_DIGEST_SIZE 16
@@ -54,15 +55,14 @@ static int ghash_setkey(struct crypto_shash *tfm, const u8 *key, unsigned int keylen) {struct ghash_ctx *ctx =crypto_shash_ctx (tfm); -be128 *x = (be128 *)key;u64 a, b;if (keylen !=GHASH_BLOCK_SIZE )return -EINVAL ;/* perform multiplication by 'x' in GF(2^128) */ - a =be64_to_cpu (x->a); - b =be64_to_cpu (x->b); + a =get_unaligned_be64 (key); + b =get_unaligned_be64 (key +8 ); ctx->shash.a = (b <<1 ) | (a >>63 ); ctx->shash.b = (a <<1 ) | (b >>63 );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 70/529 ACPICA: Drop port I/O validation for some regions
In reply to Greg Kroah-HartmanFrom: Mario Limonciello <[email protected]>
[ Upstream commit e1d9148582ab2c3dada5c5cf8ca7531ca269fee5 ]
Microsoft introduced support in Windows XP for blocking port I/O to various regions. For Windows compatibility ACPICA has adopted the same protections and will disallow writes to those (presumably) the same regions.
On some systems the AML included with the firmware will issue 4 byte long writes to 0x80. These writes aren't making it over because of this blockage. The first 4 byte write attempt is rejected, and then subsequently 1 byte at a time each offset is tried. The first at 0x80 works, but then the next 3 bytes are rejected.
This manifests in bizarre failures for devices that expected the AML to write all 4 bytes. Trying the same AML on Windows 10 or 11 doesn't hit this failure and all 4 bytes are written.
Either some of these regions were wrong or some point after Windows XP some of these regions blocks have been lifted.
In the last 15 years there doesn't seem to be any reports popping up of this error in the Windows event viewer anymore. There is no documentation at Microsoft's developer site indicating that Windows ACPI interpreter blocks these regions. Between the lack of documentation and the fact that the writes actually do work in Windows 10 and 11, it's quite likely Windows doesn't actually enforce this anymore.
So to help the issue, only enforce Windows XP specific entries if the latest _OSI supported is Windows XP. Continue to enforce the ALWAYS_ILLEGAL entries.
--- drivers/acpi/acpica/hwvalid.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/acpi/acpica/hwvalid.c +4 -3
@@ -23,8 +23,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width);* * The table is used to implement the Microsoft port access rules that * first appeared in Windows XP. Some ports are always illegal, and some -* ports are only illegal if the BIOS calls _OSI with a win_XP string or -* later (meaning that the BIOS itelf is post-XP.) +* ports are only illegal if the BIOS calls _OSI with nothing newer than +* the specific _OSI strings. * * This provides ACPICA with the desired port protections and * Microsoft compatibility.
@@ -145,7 +145,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width)/* Port illegality may depend on the _OSI calls made by the BIOS */ -if (acpi_gbl_osi_data >= port_info->osi_dependency) { +if (port_info->osi_dependency ==ACPI_ALWAYS_ILLEGAL || + acpi_gbl_osi_data == port_info->osi_dependency) { ACPI_DEBUG_PRINT((ACPI_DB_VALUES, "Denied AML access to port 0x%8.8X%8.8X/%X (%s 0x%.4X-0x%.4X)\n", ACPI_FORMAT_UINT64(address),
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 71/529 genirq: Fix the return type of kstat_cpu_irqs_sum()
In reply to Greg Kroah-HartmanFrom: Zhen Lei <[email protected]>
[ Upstream commit 47904aed898a08f028572b9b5a5cc101ddfb2d82 ]
The type of member ->irqs_sum is unsigned long, but kstat_cpu_irqs_sum() returns int, which can result in truncation. Therefore, change the kstat_cpu_irqs_sum() function's return value to unsigned long to avoid truncation.
--- include/linux/kernel_stat.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/kernel_stat.h +1 -1
@@ -73,7 +73,7 @@ extern unsigned int kstat_irqs_usr(unsigned int irq);/* * Number of interrupts per cpu, since bootup */ -static inline unsigned int kstat_cpu_irqs_sum (unsigned int cpu) +static inline unsigned long kstat_cpu_irqs_sum (unsigned int cpu) {return kstat_cpu (cpu).irqs_sum; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 72/529 rcu-tasks: Improve comments explaining tasks_rcu_exit_srcu purpose
In reply to Greg Kroah-HartmanFrom: Frederic Weisbecker <[email protected]>
[ Upstream commit e4e1e8089c5fd948da12cb9f4adc93821036945f ]
Make sure we don't need to look again into the depths of git blame in order not to miss a subtle part about how rcu-tasks is dealing with exiting tasks.
Stable-dep-of: 28319d6dc5e2 ("rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()")
--- kernel/rcu/tasks.h | 37 +++++++++++++++++++++++++++++-------- 1 file changed, 29 insertions(+), 8 deletions(-)
kernel/rcu/tasks.h +29 -8
@@ -416,11 +416,21 @@ static void rcu_tasks_pertask(struct task_struct *t, struct list_head *hop)static void rcu_tasks_postscan (struct list_head *hop) {/* -* Wait for tasks that are in the process of exiting. This -* does only part of the job, ensuring that all tasks that were -* previously exiting reach the point where they have disabled -* preemption, allowing the later synchronize_rcu() to finish -* the job. +* Exiting tasks may escape the tasklist scan. Those are vulnerable +* until their final schedule() with TASK_DEAD state. To cope with +* this, divide the fragile exit path part in two intersecting +* read side critical sections: +* +* 1) An _SRCU_ read side starting before calling exit_notify(), +* which may remove the task from the tasklist, and ending after +* the final preempt_disable() call in do_exit(). +* +* 2) An _RCU_ read side starting with the final preempt_disable() +* call in do_exit() and ending with the final call to schedule() +* with TASK_DEAD state. +* +* This handles the part 1). And postgp will handle part 2) with a +* call to synchronize_rcu(). */ synchronize_srcu (&tasks_rcu_exit_srcu); }
@@ -487,7 +497,10 @@ static void rcu_tasks_postgp(struct rcu_tasks *rtp)* * In addition, this synchronize_rcu() waits for exiting tasks * to complete their final preempt_disable() region of execution, -* cleaning up after the synchronize_srcu() above. +* cleaning up after synchronize_srcu(&tasks_rcu_exit_srcu), +* enforcing the whole region before tasklist removal until +* the final schedule() with TASK_DEAD state to be an RCU TASKS +* read side critical section. */ synchronize_rcu (); }
@@ -576,7 +589,11 @@ static void show_rcu_tasks_classic_gp_kthread(void) }#endif /* #ifndef CONFIG_TINY_RCU */ -/* Do the srcu_read_lock() for the above synchronize_srcu(). */ +/* +* Contribute to protect against tasklist scan blind spot while the +* task is exiting and may be removed from the tasklist. See +* corresponding synchronize_srcu() for further details. +*/ void exit_tasks_rcu_start(void) __acquires(&tasks_rcu_exit_srcu) {preempt_disable ();
@@ -584,7 +601,11 @@ void exit_tasks_rcu_start(void) __acquires(&tasks_rcu_exit_srcu)preempt_enable (); } -/* Do the srcu_read_unlock() for the above synchronize_srcu(). */ +/* +* Contribute to protect against tasklist scan blind spot while the +* task is exiting and may be removed from the tasklist. See +* corresponding synchronize_srcu() for further details. +*/ void exit_tasks_rcu_finish(void) __releases(&tasks_rcu_exit_srcu) {struct task_struct *t = current;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 73/529 rcu-tasks: Remove preemption disablement around srcu_read_[un]lock() calls
In reply to Greg Kroah-HartmanFrom: Frederic Weisbecker <[email protected]>
[ Upstream commit 44757092958bdd749775022f915b7ac974384c2a ]
Ever since the following commit:
5a41344a3d83 ("srcu: Simplify __srcu_read_unlock() via this_cpu_dec()")SRCU doesn't rely anymore on preemption to be disabled in order to modify the per-CPU counter. And even then it used to be done from the API itself.
Therefore and after checking further, it appears to be safe to remove the preemption disablement around __srcu_read_[un]lock() in exit_tasks_rcu_start() and exit_tasks_rcu_finish()
Stable-dep-of: 28319d6dc5e2 ("rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()")
--- kernel/rcu/tasks.h | 4 ---- 1 file changed, 4 deletions(-)
kernel/rcu/tasks.h +0 -4
@@ -596,9 +596,7 @@ static void show_rcu_tasks_classic_gp_kthread(void)*/ void exit_tasks_rcu_start(void) __acquires(&tasks_rcu_exit_srcu) { -preempt_disable (); current->rcu_tasks_idx =__srcu_read_lock (&tasks_rcu_exit_srcu); -preempt_enable (); }/*
@@ -610,9 +608,7 @@ void exit_tasks_rcu_finish(void) __releases(&tasks_rcu_exit_srcu) {struct task_struct *t = current; -preempt_disable ();__srcu_read_unlock (&tasks_rcu_exit_srcu, t->rcu_tasks_idx); -preempt_enable ();exit_tasks_rcu_finish_trace (t); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 74/529 rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()
In reply to Greg Kroah-HartmanFrom: Frederic Weisbecker <[email protected]>
[ Upstream commit 28319d6dc5e2ffefa452c2377dd0f71621b5bff0 ]
RCU Tasks and PID-namespace unshare can interact in do_exit() in a complicated circular dependency:
1) TASK A calls unshare(CLONE_NEWPID), this creates a new PID namespace that every subsequent child of TASK A will belong to. But TASK A doesn't itself belong to that new PID namespace.
2) TASK A forks() and creates TASK B. TASK A stays attached to its PID namespace (let's say PID_NS1) and TASK B is the first task belonging to the new PID namespace created by unshare() (let's call it PID_NS2).
3) Since TASK B is the first task attached to PID_NS2, it becomes the PID_NS2 child reaper.
4) TASK A forks() again and creates TASK C which get attached to PID_NS2. Note how TASK C has TASK A as a parent (belonging to PID_NS1) but has TASK B (belonging to PID_NS2) as a pid_namespace child_reaper.
5) TASK B exits and since it is the child reaper for PID_NS2, it has to kill all other tasks attached to PID_NS2, and wait for all of them to die before getting reaped itself (zap_pid_ns_process()).
6) TASK A calls synchronize_rcu_tasks() which leads to synchronize_srcu(&tasks_rcu_exit_srcu).
7) TASK B is waiting for TASK C to get reaped. But TASK B is under a tasks_rcu_exit_srcu SRCU critical section (exit_notify() is between exit_tasks_rcu_start() and exit_tasks_rcu_finish()), blocking TASK A.
8) TASK C exits and since TASK A is its parent, it waits for it to reap TASK C, but it can't because TASK A waits for TASK B that waits for TASK C.
Pid_namespace semantics can hardly be changed at this point. But the coverage of tasks_rcu_exit_srcu can be reduced instead.
The current task is assumed not to be concurrently reapable at this stage of exit_notify() and therefore tasks_rcu_exit_srcu can be temporarily relaxed without breaking its constraints, providing a way out of the deadlock scenario.
[ paulmck: Fix build failure by adding additional declaration. ]
--- include/linux/rcupdate.h | 2 ++ kernel/pid_namespace.c | 17 +++++++++++++++++ kernel/rcu/tasks.h | 15 +++++++++++++-- 3 files changed, 32 insertions(+), 2 deletions(-)
include/linux/rcupdate.h +2 -0
@@ -189,6 +189,7 @@ void synchronize_rcu_tasks_rude(void);#define rcu_note_voluntary_context_switch (t) rcu_tasks_qs(t, false)void exit_tasks_rcu_start (void ); +void exit_tasks_rcu_stop (void );void exit_tasks_rcu_finish (void );#else /* #ifdef CONFIG_TASKS_RCU_GENERIC */ #define rcu_tasks_qs (t, preempt) do { } while (0)
@@ -196,6 +197,7 @@ void exit_tasks_rcu_finish(void);#define call_rcu_tasks call_rcu#define synchronize_rcu_tasks synchronize_rcustatic inline void exit_tasks_rcu_start (void ) { } +static inline void exit_tasks_rcu_stop (void ) { }static inline void exit_tasks_rcu_finish (void ) { }#endif /* #else #ifdef CONFIG_TASKS_RCU_GENERIC */
kernel/pid_namespace.c +17 -0
@@ -251,7 +251,24 @@ void zap_pid_ns_processes(struct pid_namespace *pid_ns)set_current_state (TASK_INTERRUPTIBLE );if (pid_ns->pid_allocated == init_pids)break ; +/* +* Release tasks_rcu_exit_srcu to avoid following deadlock: +* +* 1) TASK A unshare(CLONE_NEWPID) +* 2) TASK A fork() twice -> TASK B (child reaper for new ns) +* and TASK C +* 3) TASK B exits, kills TASK C, waits for TASK A to reap it +* 4) TASK A calls synchronize_rcu_tasks() +* -> synchronize_srcu(tasks_rcu_exit_srcu) +* 5) *DEADLOCK* +* +* It is considered safe to release tasks_rcu_exit_srcu here +* because we assume the current task can not be concurrently +* reaped at this point. +*/ +exit_tasks_rcu_stop ();schedule (); +exit_tasks_rcu_start (); }__set_current_state (TASK_RUNNING );
kernel/rcu/tasks.h +13 -2
@@ -604,17 +604,28 @@ void exit_tasks_rcu_start(void) __acquires(&tasks_rcu_exit_srcu)* task is exiting and may be removed from the tasklist. See * corresponding synchronize_srcu() for further details. */ -void exit_tasks_rcu_finish(void) __releases(&tasks_rcu_exit_srcu) +void exit_tasks_rcu_stop(void) __releases(&tasks_rcu_exit_srcu) {struct task_struct *t = current;__srcu_read_unlock (&tasks_rcu_exit_srcu, t->rcu_tasks_idx); -exit_tasks_rcu_finish_trace (t); +} + +/* +* Contribute to protect against tasklist scan blind spot while the +* task is exiting and may be removed from the tasklist. See +* corresponding synchronize_srcu() for further details. +*/ +void exit_tasks_rcu_finish (void ) +{ +exit_tasks_rcu_stop (); +exit_tasks_rcu_finish_trace (current); }#else /* #ifdef CONFIG_TASKS_RCU */ static inline void show_rcu_tasks_classic_gp_kthread (void ) { }void exit_tasks_rcu_start (void ) { } +void exit_tasks_rcu_stop (void ) { }void exit_tasks_rcu_finish (void ) {exit_tasks_rcu_finish_trace (current); }#endif /* #else #ifdef CONFIG_TASKS_RCU */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 75/529 lib/mpi: Fix buffer overrun when SG is too long
In reply to Greg Kroah-HartmanFrom: Herbert Xu <[email protected]>
[ Upstream commit 7361d1bc307b926cbca214ab67b641123c2d6357 ]
The helper mpi_read_raw_from_sgl sets the number of entries in the SG list according to nbytes. However, if the last entry in the SG list contains more data than nbytes, then it may overrun the buffer because it only allocates enough memory for nbytes.
--- lib/mpi/mpicoder.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
lib/mpi/mpicoder.c +2 -1
@@ -504,7 +504,8 @@ MPI mpi_read_raw_from_sgl(struct scatterlist *sgl, unsigned int nbytes)while (sg_miter_next (&miter)) { buff = miter.addr; - len = miter.length; + len =min_t (unsigned, miter.length, nbytes); + nbytes -= len;for (x =0 ; x < len; x++) { a <<=8 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 76/529 crypto: ccp: Use the stack for small SEV command buffers
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit e4a9af799e5539b0feb99571f0aaed5a3c81dc5a ]
For commands with small input/output buffers, use the local stack to
"allocate" the structures used to communicate with the PSP. Now that__sev_do_cmd_locked() gracefully handles vmalloc'd buffers, there's no reason to avoid using the stack, e.g. CONFIG_VMAP_STACK=y will just work.
Message-Id: <[email protected]>
Stable-dep-of: 91dfd98216d8 ("crypto: ccp - Avoid page allocation failure warning for SEV_GET_ID2")
--- drivers/crypto/ccp/sev-dev.c | 117 +++++++++++++---------------------- 1 file changed, 44 insertions(+), 73 deletions(-)
drivers/crypto/ccp/sev-dev.c +44 -73
@@ -385,7 +385,7 @@ static int sev_ioctl_do_pek_csr(struct sev_issue_cmd *argp, bool writable) {struct sev_device *sev = psp_master->sev_data;struct sev_user_data_pek_csr input; -struct sev_data_pek_csr *data; +struct sev_data_pek_csr data;void __user *input_address;void *blob =NULL ;int ret;
@@ -396,9 +396,7 @@ static int sev_ioctl_do_pek_csr(struct sev_issue_cmd *argp, bool writable)if (copy_from_user (&input, (void __user *)argp->data,sizeof (input)))return -EFAULT ; - data =kzalloc (sizeof (*data),GFP_KERNEL ); -if (!data) -return -ENOMEM ; +memset (&data,0 ,sizeof (data));/* userspace wants to query CSR length */ if (!input.address || !input.length)
@@ -406,19 +404,15 @@ static int sev_ioctl_do_pek_csr(struct sev_issue_cmd *argp, bool writable)/* allocate a physically contiguous buffer to store the CSR blob */ input_address = (void __user *)input.address; -if (input.length >SEV_FW_BLOB_MAX_SIZE ) { - ret = -EFAULT ; - goto e_free; - } +if (input.length >SEV_FW_BLOB_MAX_SIZE ) +return -EFAULT ; blob =kmalloc (input.length,GFP_KERNEL ); -if (!blob) { - ret = -ENOMEM ; - goto e_free; - } +if (!blob) +return -ENOMEM ; - data->address =__psp_pa (blob); - data->len = input.length; + data.address =__psp_pa (blob); + data.len = input.length; cmd:if (sev->state ==SEV_STATE_UNINIT ) {
@@ -427,10 +421,10 @@ static int sev_ioctl_do_pek_csr(struct sev_issue_cmd *argp, bool writable) goto e_free_blob; } - ret =__sev_do_cmd_locked (SEV_CMD_PEK_CSR , data, &argp->error); + ret =__sev_do_cmd_locked (SEV_CMD_PEK_CSR , &data, &argp->error);/* If we query the CSR length, FW responded with expected data. */ - input.length = data->len; + input.length = data.len;if (copy_to_user ((void __user *)argp->data, &input,sizeof (input))) { ret = -EFAULT ;
@@ -444,8 +438,6 @@ static int sev_ioctl_do_pek_csr(struct sev_issue_cmd *argp, bool writable) e_free_blob:kfree (blob); -e_free: -kfree (data);return ret; }
@@ -577,7 +569,7 @@ static int sev_ioctl_do_pek_import(struct sev_issue_cmd *argp, bool writable) {struct sev_device *sev = psp_master->sev_data;struct sev_user_data_pek_cert_import input; -struct sev_data_pek_cert_import *data; +struct sev_data_pek_cert_import data;void *pek_blob, *oca_blob;int ret;
@@ -587,19 +579,14 @@ static int sev_ioctl_do_pek_import(struct sev_issue_cmd *argp, bool writable)if (copy_from_user (&input, (void __user *)argp->data,sizeof (input)))return -EFAULT ; - data =kzalloc (sizeof (*data),GFP_KERNEL ); -if (!data) -return -ENOMEM ; -/* copy PEK certificate blobs from userspace */ pek_blob =psp_copy_user_blob (input.pek_cert_address, input.pek_cert_len); -if (IS_ERR (pek_blob)) { - ret =PTR_ERR (pek_blob); - goto e_free; - } +if (IS_ERR (pek_blob)) +return PTR_ERR (pek_blob); - data->pek_cert_address =__psp_pa (pek_blob); - data->pek_cert_len = input.pek_cert_len; + data.reserved =0 ; + data.pek_cert_address =__psp_pa (pek_blob); + data.pek_cert_len = input.pek_cert_len;/* copy PEK certificate blobs from userspace */ oca_blob =psp_copy_user_blob (input.oca_cert_address, input.oca_cert_len);
@@ -608,8 +595,8 @@ static int sev_ioctl_do_pek_import(struct sev_issue_cmd *argp, bool writable) goto e_free_pek; } - data->oca_cert_address =__psp_pa (oca_blob); - data->oca_cert_len = input.oca_cert_len; + data.oca_cert_address =__psp_pa (oca_blob); + data.oca_cert_len = input.oca_cert_len;/* If platform is not in INIT state then transition it to INIT */ if (sev->state !=SEV_STATE_INIT ) {
@@ -618,21 +605,19 @@ static int sev_ioctl_do_pek_import(struct sev_issue_cmd *argp, bool writable) goto e_free_oca; } - ret =__sev_do_cmd_locked (SEV_CMD_PEK_CERT_IMPORT , data, &argp->error); + ret =__sev_do_cmd_locked (SEV_CMD_PEK_CERT_IMPORT , &data, &argp->error); e_free_oca:kfree (oca_blob); e_free_pek:kfree (pek_blob); -e_free: -kfree (data);return ret; }static int sev_ioctl_do_get_id2 (struct sev_issue_cmd *argp) {struct sev_user_data_get_id2 input; -struct sev_data_get_id *data; +struct sev_data_get_id data;void __user *input_address;void *id_blob =NULL ;int ret;
@@ -646,28 +631,25 @@ static int sev_ioctl_do_get_id2(struct sev_issue_cmd *argp) input_address = (void __user *)input.address; - data =kzalloc (sizeof (*data),GFP_KERNEL ); -if (!data) -return -ENOMEM ; -if (input.address && input.length) { id_blob =kmalloc (input.length,GFP_KERNEL ); -if (!id_blob) { -kfree (data); +if (!id_blob)return -ENOMEM ; - } - data->address =__psp_pa (id_blob); - data->len = input.length; + data.address =__psp_pa (id_blob); + data.len = input.length; + }else { + data.address =0 ; + data.len =0 ; } - ret =__sev_do_cmd_locked (SEV_CMD_GET_ID , data, &argp->error); + ret =__sev_do_cmd_locked (SEV_CMD_GET_ID , &data, &argp->error);/* * Firmware will return the length of the ID value (either the minimum * required length or the actual length written), return it to the user. */ - input.length = data->len; + input.length = data.len;if (copy_to_user ((void __user *)argp->data, &input,sizeof (input))) { ret = -EFAULT ;
@@ -675,7 +657,7 @@ static int sev_ioctl_do_get_id2(struct sev_issue_cmd *argp) }if (id_blob) { -if (copy_to_user (input_address, id_blob, data->len)) { +if (copy_to_user (input_address, id_blob, data.len)) { ret = -EFAULT ; goto e_free; }
@@ -683,7 +665,6 @@ static int sev_ioctl_do_get_id2(struct sev_issue_cmd *argp) e_free:kfree (id_blob); -kfree (data);return ret; }
@@ -733,7 +714,7 @@ static int sev_ioctl_do_pdh_export(struct sev_issue_cmd *argp, bool writable)struct sev_device *sev = psp_master->sev_data;struct sev_user_data_pdh_cert_export input;void *pdh_blob =NULL , *cert_blob =NULL ; -struct sev_data_pdh_cert_export *data; +struct sev_data_pdh_cert_export data;void __user *input_cert_chain_address;void __user *input_pdh_cert_address;int ret;
@@ -751,9 +732,7 @@ static int sev_ioctl_do_pdh_export(struct sev_issue_cmd *argp, bool writable)if (copy_from_user (&input, (void __user *)argp->data,sizeof (input)))return -EFAULT ; - data =kzalloc (sizeof (*data),GFP_KERNEL ); -if (!data) -return -ENOMEM ; +memset (&data,0 ,sizeof (data));/* Userspace wants to query the certificate length. */ if (!input.pdh_cert_address ||
@@ -765,25 +744,19 @@ static int sev_ioctl_do_pdh_export(struct sev_issue_cmd *argp, bool writable) input_cert_chain_address = (void __user *)input.cert_chain_address;/* Allocate a physically contiguous buffer to store the PDH blob. */ -if (input.pdh_cert_len >SEV_FW_BLOB_MAX_SIZE ) { - ret = -EFAULT ; - goto e_free; - } +if (input.pdh_cert_len >SEV_FW_BLOB_MAX_SIZE ) +return -EFAULT ;/* Allocate a physically contiguous buffer to store the cert chain blob. */ -if (input.cert_chain_len >SEV_FW_BLOB_MAX_SIZE ) { - ret = -EFAULT ; - goto e_free; - } +if (input.cert_chain_len >SEV_FW_BLOB_MAX_SIZE ) +return -EFAULT ; pdh_blob =kmalloc (input.pdh_cert_len,GFP_KERNEL ); -if (!pdh_blob) { - ret = -ENOMEM ; - goto e_free; - } +if (!pdh_blob) +return -ENOMEM ; - data->pdh_cert_address =__psp_pa (pdh_blob); - data->pdh_cert_len = input.pdh_cert_len; + data.pdh_cert_address =__psp_pa (pdh_blob); + data.pdh_cert_len = input.pdh_cert_len; cert_blob =kmalloc (input.cert_chain_len,GFP_KERNEL );if (!cert_blob) {
@@ -791,15 +764,15 @@ static int sev_ioctl_do_pdh_export(struct sev_issue_cmd *argp, bool writable) goto e_free_pdh; } - data->cert_chain_address =__psp_pa (cert_blob); - data->cert_chain_len = input.cert_chain_len; + data.cert_chain_address =__psp_pa (cert_blob); + data.cert_chain_len = input.cert_chain_len; cmd: - ret =__sev_do_cmd_locked (SEV_CMD_PDH_CERT_EXPORT , data, &argp->error); + ret =__sev_do_cmd_locked (SEV_CMD_PDH_CERT_EXPORT , &data, &argp->error);/* If we query the length, FW responded with expected data. */ - input.cert_chain_len = data->cert_chain_len; - input.pdh_cert_len = data->pdh_cert_len; + input.cert_chain_len = data.cert_chain_len; + input.pdh_cert_len = data.pdh_cert_len;if (copy_to_user ((void __user *)argp->data, &input,sizeof (input))) { ret = -EFAULT ;
@@ -824,8 +797,6 @@ static int sev_ioctl_do_pdh_export(struct sev_issue_cmd *argp, bool writable)kfree (cert_blob); e_free_pdh:kfree (pdh_blob); -e_free: -kfree (data);return ret; }
Signature · 1 line
2.39.2
Re: [PATCH 5.10 076/529] crypto: ccp: Use the stack for small SEV command buffers
Quoted 8 lines · Greg Kroah-Hartman
From: Sean Christopherson <[email protected]>
[ Upstream commit
e4a9af799e5539b0feb99571f0aaed5a3c81dc5a]For commands with small input/output buffers, use the local stack to
"allocate" the structures used to communicate with the PSP. Now that__sev_do_cmd_locked()gracefully handles vmalloc'd buffers, there's no reason to avoid using the stack, e.g.CONFIG_VMAP_STACK=ywill just work.
[...]
Julien Cristau reported a regression in ccp - the WARN_ON_ONCE(!virt_addr_valid(data)) is now being triggered. I believe this was introduced by the above commit, which depends on:
commit 8347b99473a313be6549a5b940bc3c56a71be81c
Author: Sean Christopherson <[email protected]> Date: Tue Apr 6 15:49:48 2021 -0700
crypto: ccp: Play nice with vmalloc'd memory for SEV command structs
Ben.
Signature · 2 lines
Ben Hutchings The two most common things in the universe are hydrogen and stupidity.
Greg Kroah-Hartman
maintainerRe: [PATCH 5.10 076/529] crypto: ccp: Use the stack for small SEV command buffers
Quoted 15 lines · Ben Hutchings
Quoted 8 lines · Greg Kroah-Hartman
From: Sean Christopherson <[email protected]>
[ Upstream commit
e4a9af799e5539b0feb99571f0aaed5a3c81dc5a]For commands with small input/output buffers, use the local stack to
"allocate" the structures used to communicate with the PSP. Now that__sev_do_cmd_locked()gracefully handles vmalloc'd buffers, there's no reason to avoid using the stack, e.g.CONFIG_VMAP_STACK=ywill just work.[...]
Julien Cristau reported a regression in ccp - the WARN_ON_ONCE(!virt_addr_valid(data)) is now being triggered. I believe this was introduced by the above commit, which depends on:
Quoted 8 lines
commit
8347b99473a313be6549a5b940bc3c56a71be81cAuthor: Sean Christopherson <[email protected]> Date: Tue Apr 6 15:49:48 2021 -0700crypto: ccp: Play nice with vmalloc'd memory for SEV command structs
Ben.
Thanks for letting me know, now queued up.
greg k-h
Greg Kroah-Hartman
maintainerRe: [PATCH 5.10 076/529] crypto: ccp: Use the stack for small SEV command buffers
Quoted 20 lines · Greg Kroah-Hartman
Quoted 19 lines · Ben Hutchings
Quoted 8 lines · Greg Kroah-Hartman
From: Sean Christopherson <[email protected]>
[ Upstream commit
e4a9af799e5539b0feb99571f0aaed5a3c81dc5a]For commands with small input/output buffers, use the local stack to
"allocate" the structures used to communicate with the PSP. Now that__sev_do_cmd_locked()gracefully handles vmalloc'd buffers, there's no reason to avoid using the stack, e.g.CONFIG_VMAP_STACK=ywill just work.[...]
Julien Cristau reported a regression in ccp - the WARN_ON_ONCE(!virt_addr_valid(data)) is now being triggered. I believe this was introduced by the above commit, which depends on:
commit
8347b99473a313be6549a5b940bc3c56a71be81cAuthor: Sean Christopherson <[email protected]> Date: Tue Apr 6 15:49:48 2021 -0700
Quoted 6 lines
Quoted 4 lines
crypto: ccp: Play nice with vmalloc'd memory for SEV command structs
Ben.
Thanks for letting me know, now queued up.
Nope, now dropped, it breaks the build :(
Re: [PATCH 5.10 076/529] crypto: ccp: Use the stack for small SEV command buffers
Quoted 21 lines · Greg Kroah-Hartman
Quoted 20 lines · Greg Kroah-Hartman
Quoted 19 lines · Ben Hutchings
Quoted 8 lines · Greg Kroah-Hartman
From: Sean Christopherson <[email protected]>
[ Upstream commit
e4a9af799e5539b0feb99571f0aaed5a3c81dc5a]For commands with small input/output buffers, use the local stack to
"allocate" the structures used to communicate with the PSP. Now that__sev_do_cmd_locked()gracefully handles vmalloc'd buffers, there's no reason to avoid using the stack, e.g.CONFIG_VMAP_STACK=ywill just work.[...]
Julien Cristau reported a regression in ccp - the WARN_ON_ONCE(!virt_addr_valid(data)) is now being triggered. I believe this was introduced by the above commit, which depends on:
commit
8347b99473a313be6549a5b940bc3c56a71be81cAuthor: Sean Christopherson <[email protected]> Date: Tue Apr 6 15:49:48 2021 -0700
Quoted 8 lines
Quoted 6 lines
Quoted 4 lines
crypto: ccp: Play nice with vmalloc'd memory for SEV command structs
Ben.
Thanks for letting me know, now queued up.
Nope, now dropped, it breaks the build :(
I've now looked further and found that we need both:
d5760dee127b crypto: ccp: Reject SEV commands with mismatching command buffer 8347b99473a3 crypto: ccp: Play nice with vmalloc'd memory for SEV command structs
(Not yet tested; I'll ask Julien if he can do that.)
Ben.
Signature · 2 lines
Ben Hutchings I haven't lost my mind; it's backed up on tape somewhere.
Greg Kroah-Hartman
maintainerRe: [PATCH 5.10 076/529] crypto: ccp: Use the stack for small SEV command buffers
Quoted 29 lines · Ben Hutchings
Quoted 28 lines · Greg Kroah-Hartman
Quoted 26 lines · Greg Kroah-Hartman
Quoted 15 lines · Ben Hutchings
Quoted 8 lines · Greg Kroah-Hartman
From: Sean Christopherson <[email protected]>
[ Upstream commit
e4a9af799e5539b0feb99571f0aaed5a3c81dc5a]For commands with small input/output buffers, use the local stack to
"allocate" the structures used to communicate with the PSP. Now that__sev_do_cmd_locked()gracefully handles vmalloc'd buffers, there's no reason to avoid using the stack, e.g.CONFIG_VMAP_STACK=ywill just work.[...]
Julien Cristau reported a regression in ccp - the WARN_ON_ONCE(!virt_addr_valid(data)) is now being triggered. I believe this was introduced by the above commit, which depends on:
Quoted 8 lines
commit
8347b99473a313be6549a5b940bc3c56a71be81cAuthor: Sean Christopherson <[email protected]> Date: Tue Apr 6 15:49:48 2021 -0700crypto: ccp: Play nice with vmalloc'd memory for SEV command structs
Ben.
Thanks for letting me know, now queued up.
Quoted 8 lines
Quoted 1 line
Nope, now dropped, it breaks the build :(
I've now looked further and found that we need both:
d5760dee127bcrypto: ccp: Reject SEV commands with mismatching command buffer8347b99473a3crypto: ccp: Play nice with vmalloc'd memory for SEV command structs(Not yet tested; I'll ask Julien if he can do that.)
Looks sane to me, both now queued up, thanks.
greg k-h
Re: [PATCH 5.10 076/529] crypto: ccp: Use the stack for small SEV command buffers
In reply to Ben HutchingsControl: close -1 5.10.191-1
Quoted 3 lines · Ben Hutchings
Quoted 2 lines · Greg Kroah-Hartman
Quoted 1 line · Greg Kroah-Hartman
On Wed, May 17, 2023 at 02:56:21PM +0200, Ben Hutchings wrote:
[..]
Quoted 19 lines
Quoted 12 lines
Quoted 12 lines
Julien Cristau reported a regression in ccp - the
Quoted 11 lines
WARN_ON_ONCE(!virt_addr_valid(data)) is now being triggered. I believe
this was introduced by the above commit, which depends on:commit
8347b99473a313be6549a5b940bc3c56a71be81cAuthor: Sean Christopherson <[email protected]> Date: Tue Apr 6 15:49:48 2021 -0700crypto: ccp: Play nice with vmalloc'd memory for SEV
command structsQuoted 6 lines
Quoted 4 lines
Quoted 2 lines
Ben.
Thanks for letting me know, now queued up.
Nope, now dropped, it breaks the build :(
Quoted 9 lines
I've now looked further and found that we need both:
d5760dee127bcrypto: ccp: Reject SEV commands with mismatching command buffer8347b99473a3crypto: ccp: Play nice with vmalloc'd memory for SEV command structs(Not yet tested; I'll ask Julien if he can do that.)
Having just upgraded several affected debian.org nodes, I'm happy to confirm that the 5.10.191-1 kernel resolves the issue for us.
Regards,
Adam
Greg Kroah-Hartman
maintainerPATCH 77/529 crypto: ccp: Use the stack and common buffer for status commands
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit 38103671aad38e888743dd26c767869cfc15adca ]
Drop the dedicated status_cmd_buf and instead use a local variable for PLATFORM_STATUS. Now that the low level helper uses an internal buffer for all commands, using the stack for the upper layers is safe even when running with CONFIG_VMAP_STACK=y.
Message-Id: <[email protected]>
Stable-dep-of: 91dfd98216d8 ("crypto: ccp - Avoid page allocation failure warning for SEV_GET_ID2")
--- drivers/crypto/ccp/sev-dev.c | 27 ++++++++++++--------------- drivers/crypto/ccp/sev-dev.h | 1 - 2 files changed, 12 insertions(+), 16 deletions(-)
drivers/crypto/ccp/sev-dev.c +12 -15
@@ -304,15 +304,14 @@ static int sev_platform_shutdown(int *error)static int sev_get_platform_state (int *state,int *error) { -struct sev_device *sev = psp_master->sev_data; +struct sev_user_data_status data;int rc; - rc =__sev_do_cmd_locked (SEV_CMD_PLATFORM_STATUS , - &sev->status_cmd_buf, error); + rc =__sev_do_cmd_locked (SEV_CMD_PLATFORM_STATUS , &data, error);if (rc)return rc; - *state = sev->status_cmd_buf.state; + *state = data.state;return rc; }
@@ -350,15 +349,14 @@ static int sev_ioctl_do_reset(struct sev_issue_cmd *argp, bool writable)static int sev_ioctl_do_platform_status (struct sev_issue_cmd *argp) { -struct sev_device *sev = psp_master->sev_data; -struct sev_user_data_status *data = &sev->status_cmd_buf; +struct sev_user_data_status data;int ret; - ret =__sev_do_cmd_locked (SEV_CMD_PLATFORM_STATUS , data, &argp->error); + ret =__sev_do_cmd_locked (SEV_CMD_PLATFORM_STATUS , &data, &argp->error);if (ret)return ret; -if (copy_to_user ((void __user *)argp->data, data,sizeof (*data))) +if (copy_to_user ((void __user *)argp->data, &data,sizeof (data))) ret = -EFAULT ;return ret;
@@ -457,21 +455,20 @@ EXPORT_SYMBOL_GPL(psp_copy_user_blob);static int sev_get_api_version (void ) {struct sev_device *sev = psp_master->sev_data; -struct sev_user_data_status *status; +struct sev_user_data_status status;int error =0 , ret; - status = &sev->status_cmd_buf; - ret =sev_platform_status (status, &error); + ret =sev_platform_status (&status, &error);if (ret) {dev_err (sev->dev,"SEV: failed to get status. Error: %#x\n" , error);return 1 ; } - sev->api_major = status->api_major; - sev->api_minor = status->api_minor; - sev->build = status->build; - sev->state = status->state; + sev->api_major = status.api_major; + sev->api_minor = status.api_minor; + sev->build = status.build; + sev->state = status.state;return 0 ; }
drivers/crypto/ccp/sev-dev.h +0 -1
@@ -46,7 +46,6 @@ struct sev_device {unsigned int int_rcvd;wait_queue_head_t int_queue;struct sev_misc_dev *misc; -struct sev_user_data_status status_cmd_buf;struct sev_data_init init_cmd_buf;u8 api_major;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 78/529 crypto: ccp - Use kzalloc for sev ioctl interfaces to prevent kernel memory leak
In reply to Greg Kroah-HartmanFrom: John Allen <[email protected]>
[ Upstream commit 13dc15a3f5fd7f884e4bfa8c011a0ae868df12ae ]
For some sev ioctl interfaces, input may be passed that is less than or equal to SEV_FW_BLOB_MAX_SIZE, but larger than the data that PSP firmware returns. In this case, kmalloc will allocate memory that is the size of the input rather than the size of the data. Since PSP firmware doesn't fully overwrite the buffer, the sev ioctl interfaces with the issue may return uninitialized slab memory.
Currently, all of the ioctl interfaces in the ccp driver are safe, but to prevent future problems, change all ioctl interfaces that allocate memory with kmalloc to use kzalloc and memset the data buffer to zero in sev_ioctl_do_platform_status.
Stable-dep-of: 91dfd98216d8 ("crypto: ccp - Avoid page allocation failure warning for SEV_GET_ID2")
--- drivers/crypto/ccp/sev-dev.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/crypto/ccp/sev-dev.c +6 -4
@@ -352,6 +352,8 @@ static int sev_ioctl_do_platform_status(struct sev_issue_cmd *argp)struct sev_user_data_status data;int ret; +memset (&data,0 ,sizeof (data)); + ret =__sev_do_cmd_locked (SEV_CMD_PLATFORM_STATUS , &data, &argp->error);if (ret)return ret;
@@ -405,7 +407,7 @@ static int sev_ioctl_do_pek_csr(struct sev_issue_cmd *argp, bool writable)if (input.length >SEV_FW_BLOB_MAX_SIZE )return -EFAULT ; - blob =kmalloc (input.length,GFP_KERNEL ); + blob =kzalloc (input.length,GFP_KERNEL );if (!blob)return -ENOMEM ;
@@ -629,7 +631,7 @@ static int sev_ioctl_do_get_id2(struct sev_issue_cmd *argp) input_address = (void __user *)input.address;if (input.address && input.length) { - id_blob =kmalloc (input.length,GFP_KERNEL ); + id_blob =kzalloc (input.length,GFP_KERNEL );if (!id_blob)return -ENOMEM ;
@@ -748,14 +750,14 @@ static int sev_ioctl_do_pdh_export(struct sev_issue_cmd *argp, bool writable)if (input.cert_chain_len >SEV_FW_BLOB_MAX_SIZE )return -EFAULT ; - pdh_blob =kmalloc (input.pdh_cert_len,GFP_KERNEL ); + pdh_blob =kzalloc (input.pdh_cert_len,GFP_KERNEL );if (!pdh_blob)return -ENOMEM ; data.pdh_cert_address =__psp_pa (pdh_blob); data.pdh_cert_len = input.pdh_cert_len; - cert_blob =kmalloc (input.cert_chain_len,GFP_KERNEL ); + cert_blob =kzalloc (input.cert_chain_len,GFP_KERNEL );if (!cert_blob) { ret = -ENOMEM ; goto e_free_pdh;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 79/529 crypto: ccp - Avoid page allocation failure warning for SEV_GET_ID2
In reply to Greg Kroah-HartmanFrom: David Rientjes <[email protected]>
[ Upstream commit 91dfd98216d817ec5f1c55890bacb7b4fe9b068a ]
For SEV_GET_ID2, the user provided length does not have a specified limitation because the length of the ID may change in the future. The kernel memory allocation, however, is implicitly limited to 4MB on x86 by the page allocator, otherwise the kzalloc() will fail.
When this happens, it is best not to spam the kernel log with the warning. Simply fail the allocation and return ENOMEM to the user.
--- drivers/crypto/ccp/sev-dev.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/crypto/ccp/sev-dev.c +8 -1
@@ -631,7 +631,14 @@ static int sev_ioctl_do_get_id2(struct sev_issue_cmd *argp) input_address = (void __user *)input.address;if (input.address && input.length) { - id_blob =kzalloc (input.length,GFP_KERNEL ); +/* +* The length of the ID shouldn't be assumed by software since +* it may change in the future. The allocation size is limited +* to 1 << (PAGE_SHIFT + MAX_ORDER - 1) by the page allocator. +* If the allocation fails, simply return ENOMEM rather than +* warning in the kernel log. +*/ + id_blob =kzalloc (input.length,GFP_KERNEL | __GFP_NOWARN);if (!id_blob)return -ENOMEM ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 80/529 ACPICA: nsrepair: handle cases without a return value correctly
In reply to Greg Kroah-HartmanFrom: Daniil Tatianin <[email protected]>
[ Upstream commit ca843a4c79486e99a19b859ef0b9887854afe146 ]
Previously acpi_ns_simple_repair() would crash if expected_btypes contained any combination of ACPI_RTYPE_NONE with a different type, e.g | ACPI_RTYPE_INTEGER because of slightly incorrect logic in the !return_object branch, which wouldn't return AE_AML_NO_RETURN_VALUE for such cases.
Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool.
--- drivers/acpi/acpica/nsrepair.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/acpi/acpica/nsrepair.c +7 -5
@@ -181,8 +181,9 @@ acpi_ns_simple_repair(struct acpi_evaluate_info *info,* Try to fix if there was no return object. Warning if failed to fix. */ if (!return_object) { -if (expected_btypes && (!(expected_btypes &ACPI_RTYPE_NONE ))) { -if (package_index !=ACPI_NOT_PACKAGE_ELEMENT ) { +if (expected_btypes) { +if (!(expected_btypes &ACPI_RTYPE_NONE ) && + package_index !=ACPI_NOT_PACKAGE_ELEMENT ) { ACPI_WARN_PREDEFINED((AE_INFO, info->full_pathname, ACPI_WARN_ALWAYS,
@@ -196,14 +197,15 @@ acpi_ns_simple_repair(struct acpi_evaluate_info *info,if (ACPI_SUCCESS (status)) {return (AE_OK );/* Repair was successful */ } - }else { + } + +if (expected_btypes !=ACPI_RTYPE_NONE ) {ACPI_WARN_PREDEFINED ((AE_INFO , info->full_pathname,ACPI_WARN_ALWAYS ,"Missing expected return value" )); +return (AE_AML_NO_RETURN_VALUE ); } - -return (AE_AML_NO_RETURN_VALUE ); } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 81/529 thermal/drivers/tsens: Drop msm8976-specific defines
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit 3bf0ea99e2e32b0335106b86d84404cc85bcd113 ]
Drop msm8976-specific defines, which duplicate generic ones.
--- drivers/thermal/qcom/tsens-v1.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-)
drivers/thermal/qcom/tsens-v1.c +2 -7
@@ -78,11 +78,6 @@#define MSM8976_CAL_SEL_MASK 0x3 -#define MSM8976_CAL_DEGC_PT1 30 -#define MSM8976_CAL_DEGC_PT2 120 -#define MSM8976_SLOPE_FACTOR 1000 -#define MSM8976_SLOPE_DEFAULT 3200 -/* eeprom layout data for qcs404/405 (v1) */ #define BASE0_MASK 0x000007f8#define BASE1_MASK 0x0007f800
@@ -160,8 +155,8 @@ static void compute_intercept_slope_8976(struct tsens_priv *priv, priv->sensor[10 ].slope =3286 ;for (i =0 ; i < priv->num_sensors; i++) { - priv->sensor[i].offset = (p1[i] *MSM8976_SLOPE_FACTOR ) - - (MSM8976_CAL_DEGC_PT1 * + priv->sensor[i].offset = (p1[i] *SLOPE_FACTOR ) - + (CAL_DEGC_PT1 * priv->sensor[i].slope); } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 82/529 thermal/drivers/qcom/tsens_v1: Enable sensor 3 on MSM8976
In reply to Greg Kroah-HartmanFrom: Konrad Dybcio <[email protected]>
[ Upstream commit 007d81a4519f04fa5ced5e9e28bf70cd753c398d ]
The sensor *is* in fact used and does report temperature.
Stable-dep-of: a7d3006be5ca ("thermal/drivers/tsens: Sort out msm8976 vs msm8956 data")
--- drivers/thermal/qcom/tsens-v1.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/thermal/qcom/tsens-v1.c +2 -2
@@ -375,11 +375,11 @@ static const struct tsens_ops ops_8976 = { .get_temp = get_temp_tsens_valid, }; -/* Valid for both MSM8956 and MSM8976. Sensor ID 3 is unused. */ +/* Valid for both MSM8956 and MSM8976. */ struct tsens_plat_data data_8976 = { .num_sensors =11 , .ops = &ops_8976, - .hw_ids = (unsigned int []){0 ,1 ,2 ,4 ,5 ,6 ,7 ,8 ,9 ,10 }, + .hw_ids = (unsigned int []){0 ,1 ,2 ,3 ,4 ,5 ,6 ,7 ,8 ,9 ,10 }, .feat = &tsens_v1_feat, .fields = tsens_v1_regfields, };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 83/529 thermal/drivers/tsens: Add compat string for the qcom,msm8960
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit 2caf73969de6675318a711d0622406c8c66afc03 ]
On apq8064 (msm8960) platforms the tsens device is created manually by the gcc driver. Prepare the tsens driver for the qcom,msm8960-tsens device instantiated from the device tree.
Stable-dep-of: a7d3006be5ca ("thermal/drivers/tsens: Sort out msm8976 vs msm8956 data")
--- drivers/thermal/qcom/tsens.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/thermal/qcom/tsens.c +3 -0
@@ -902,6 +902,9 @@ static const struct of_device_id tsens_table[] = { }, { .compatible = "qcom,msm8939-tsens", .data = &data_8939, + }, { + .compatible = "qcom,msm8960-tsens", + .data = &data_8960, }, { .compatible = "qcom,msm8974-tsens", .data = &data_8974,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 84/529 thermal/drivers/tsens: Sort out msm8976 vs msm8956 data
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit a7d3006be5ca7b04e4b84b5ceaae55a700e511bd ]
Tsens driver mentions that msm8976 data should be used for both msm8976 and msm8956 SoCs. This is not quite correct, as according to the vendor kernels, msm8976 should use standard slope values (3200), while msm8956 really uses the slope values found in the driver.
Add separate compatibility string for msm8956, move slope value overrides to the corresponding init function and use the standard compute_intercept_slope() function for both platforms.
--- drivers/thermal/qcom/tsens-v1.c | 56 ++++++++++++++++++--------------- drivers/thermal/qcom/tsens.c | 3 ++ drivers/thermal/qcom/tsens.h | 2 +- 3 files changed, 34 insertions(+), 27 deletions(-)
drivers/thermal/qcom/tsens-v1.c +30 -26
@@ -137,30 +137,6 @@#define CAL_SEL_MASK 7#define CAL_SEL_SHIFT 0 -static void compute_intercept_slope_8976 (struct tsens_priv *priv, -u32 *p1,u32 *p2,u32 mode) -{ -int i; - - priv->sensor[0 ].slope =3313 ; - priv->sensor[1 ].slope =3275 ; - priv->sensor[2 ].slope =3320 ; - priv->sensor[3 ].slope =3246 ; - priv->sensor[4 ].slope =3279 ; - priv->sensor[5 ].slope =3257 ; - priv->sensor[6 ].slope =3234 ; - priv->sensor[7 ].slope =3269 ; - priv->sensor[8 ].slope =3255 ; - priv->sensor[9 ].slope =3239 ; - priv->sensor[10 ].slope =3286 ; - -for (i =0 ; i < priv->num_sensors; i++) { - priv->sensor[i].offset = (p1[i] *SLOPE_FACTOR ) - - (CAL_DEGC_PT1 * - priv->sensor[i].slope); - } -} -static int calibrate_v1 (struct tsens_priv *priv) {u32 base0 =0 , base1 =0 ;
@@ -286,7 +262,7 @@ static int calibrate_8976(struct tsens_priv *priv)break ; } -compute_intercept_slope_8976 (priv, p1, p2, mode); +compute_intercept_slope (priv, p1, p2, mode);kfree (qfprom_cdata);return 0 ;
@@ -357,6 +333,22 @@ static const struct reg_field tsens_v1_regfields[MAX_REGFIELDS] = { [TRDY] = REG_FIELD(TM_TRDY_OFF, 0, 0), }; +static int __init init_8956 (struct tsens_priv *priv) { + priv->sensor[0 ].slope =3313 ; + priv->sensor[1 ].slope =3275 ; + priv->sensor[2 ].slope =3320 ; + priv->sensor[3 ].slope =3246 ; + priv->sensor[4 ].slope =3279 ; + priv->sensor[5 ].slope =3257 ; + priv->sensor[6 ].slope =3234 ; + priv->sensor[7 ].slope =3269 ; + priv->sensor[8 ].slope =3255 ; + priv->sensor[9 ].slope =3239 ; + priv->sensor[10 ].slope =3286 ; + +return init_common (priv); +} +static const struct tsens_ops ops_generic_v1 = { .init = init_common, .calibrate = calibrate_v1,
@@ -369,13 +361,25 @@ struct tsens_plat_data data_tsens_v1 = { .fields = tsens_v1_regfields, }; +static const struct tsens_ops ops_8956 = { + .init = init_8956, + .calibrate = calibrate_8976, + .get_temp = get_temp_tsens_valid, +}; + +struct tsens_plat_data data_8956 = { + .num_sensors =11 , + .ops = &ops_8956, + .feat = &tsens_v1_feat, + .fields = tsens_v1_regfields, +}; +static const struct tsens_ops ops_8976 = { .init = init_common, .calibrate = calibrate_8976, .get_temp = get_temp_tsens_valid, }; -/* Valid for both MSM8956 and MSM8976. */ struct tsens_plat_data data_8976 = { .num_sensors =11 , .ops = &ops_8976,
drivers/thermal/qcom/tsens.c +3 -0
@@ -902,6 +902,9 @@ static const struct of_device_id tsens_table[] = { }, { .compatible = "qcom,msm8939-tsens", .data = &data_8939, + }, { + .compatible = "qcom,msm8956-tsens", + .data = &data_8956, }, { .compatible = "qcom,msm8960-tsens", .data = &data_8960,
drivers/thermal/qcom/tsens.h +1 -1
@@ -588,7 +588,7 @@ extern struct tsens_plat_data data_8960;extern struct tsens_plat_data data_8916, data_8939, data_8974;/* TSENS v1 targets */ -extern struct tsens_plat_data data_tsens_v1, data_8976; +extern struct tsens_plat_data data_tsens_v1, data_8976, data_8956;/* TSENS v2 targets */ extern struct tsens_plat_data data_8996, data_tsens_v2;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 85/529 wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU
In reply to Greg Kroah-HartmanFrom: Bitterblue Smith <[email protected]>
[ Upstream commit b39f662ce1648db0b9de32e6a849b098480793cb ]
The wifi + bluetooth combo chip RTL8723BU can leak memory (especially?) when it's connected to a bluetooth audio device. The busy bluetooth traffic generates lots of C2H (card to host) messages, which are not freed correctly.
To fix this, move the dev_kfree_skb() call in rtl8xxxu_c2hcmd_callback() inside the loop where skb_dequeue() is called.
The RTL8192EU leaks memory because the C2H messages are added to the queue and left there forever. (This was fine in the past because it probably wasn't sending any C2H messages until commit e542e66b7c2e ("wifi: rtl8xxxu: gen2: Turn on the rate control"). Since that commit it sends a C2H message when the TX rate changes.)
To fix this, delete the check for rf_paths > 1 and the goto. Let the function process the C2H messages from RTL8192EU like the ones from the other chips.
Theoretically the RTL8188FU could also leak like RTL8723BU, but it most likely doesn't send C2H messages frequently enough.
This change was tested with RTL8723BU by Erhard F. I tested it with RTL8188FU and RTL8192EU.
--- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +2 -6
@@ -5491,9 +5491,6 @@ static void rtl8xxxu_c2hcmd_callback(struct work_struct *work) btcoex = &priv->bt_coex; rarpt = &priv->ra_report; -if (priv->rf_paths >1 ) - goto out; -while (!skb_queue_empty (&priv->c2hcmd_queue)) {spin_lock_irqsave (&priv->c2hcmd_lock, flags); skb =__skb_dequeue (&priv->c2hcmd_queue);
@@ -5547,10 +5544,9 @@ static void rtl8xxxu_c2hcmd_callback(struct work_struct *work)default :break ; } - } -out: -dev_kfree_skb (skb); +dev_kfree_skb (skb); + } } static void rtl8723bu_handle_c2h(struct rtl8xxxu_priv *priv,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 86/529 wifi: orinoco: check return value of hermes_write_wordrec()
In reply to Greg Kroah-HartmanFrom: Alexey Kodanev <[email protected]>
[ Upstream commit 1e346cbb096a5351a637ec1992beffbf330547f0 ]
There is currently no return check for writing an authentication type (HERMES_AUTH_SHARED_KEY or HERMES_AUTH_OPEN). It looks like it was accidentally skipped.
This patch adds a return check similar to the other checks in __orinoco_hw_setup_enc() for hermes_write_wordrec().
Detected using the static analysis tool - Svace.
--- drivers/net/wireless/intersil/orinoco/hw.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/intersil/orinoco/hw.c +2 -0
@@ -931,6 +931,8 @@ int __orinoco_hw_setup_enc(struct orinoco_private *priv) err =hermes_write_wordrec (hw,USER_BAP ,HERMES_RID_CNFAUTHENTICATION_AGERE , auth_flag); +if (err) +return err; } err = hermes_write_wordrec(hw, USER_BAP, HERMES_RID_CNFWEPENABLED_AGERE,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 87/529 wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function
In reply to Greg Kroah-HartmanFrom: Fedor Pchelkin <[email protected]>
[ Upstream commit 9b25e3985477ac3f02eca5fc1e0cc6850a3f7e69 ]
It is stated that ath9k_htc_rx_msg() either frees the provided skb or passes its management to another callback function. However, the skb is not freed in case there is no another callback function, and Syzkaller was able to cause a memory leak. Also minor comment fix.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- drivers/net/wireless/ath/ath9k/htc_hst.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath9k/htc_hst.c +3 -1
@@ -391,7 +391,7 @@ static void ath9k_htc_fw_panic_report(struct htc_target *htc_handle,* HTC Messages are handled directly here and the obtained SKB * is freed. * -* Service messages (Data, WMI) passed to the corresponding +* Service messages (Data, WMI) are passed to the corresponding * endpoint RX handlers, which have to free the SKB. */ void ath9k_htc_rx_msg(struct htc_target *htc_handle,
@@ -478,6 +478,8 @@ void ath9k_htc_rx_msg(struct htc_target *htc_handle,if (endpoint->ep_callbacks.rx) endpoint->ep_callbacks.rx (endpoint->ep_callbacks.priv, skb, epid); +else + goto invalid; } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 88/529 ath9k: hif_usb: simplify if-if to if-else
In reply to Greg Kroah-HartmanFrom: Wan Jiabing <[email protected]>
[ Upstream commit 2950833f10cfa601813262e1d9c8473f9415681b ]
Use if and else instead of if(A) and if (!A).
Stable-dep-of: 0af54343a762 ("wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails")
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/wireless/ath/ath9k/hif_usb.c +2 -3
@@ -368,10 +368,9 @@ static int __hif_usb_tx(struct hif_device_usb *hif_dev)__skb_queue_head_init (&tx_buf->skb_queue);list_move_tail (&tx_buf->list, &hif_dev->tx.tx_buf); hif_dev->tx.tx_buf_cnt++; - } - -if (!ret) + }else {TX_STAT_INC (buf_queued); + }return ret; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 89/529 ath9k: htc: clean up statistics macros
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
[ Upstream commit d7fc76039b74ad37b7056d5607b05d7cb31a5404 ]
I've changed *STAT_* macros a bit in previous patch and I seems like they become really unreadable. Align these macros definitions to make code cleaner and fix folllowing checkpatch warning
ERROR: Macros with complex values should be enclosed in parentheses
Also, statistics macros now accept an hif_dev as argument, since macros that depend on having a local variable with a magic name don't abide by the coding style.
No functional change
Stable-dep-of: 0af54343a762 ("wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails")
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 26 +++++++-------- drivers/net/wireless/ath/ath9k/htc.h | 32 +++++++++++-------- drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 10 +++--- 3 files changed, 36 insertions(+), 32 deletions(-)
drivers/net/wireless/ath/ath9k/hif_usb.c +13 -13
@@ -244,11 +244,11 @@ static inline void ath9k_skb_queue_complete(struct hif_device_usb *hif_dev,ath9k_htc_txcompletion_cb (hif_dev->htc_handle, skb, txok);if (txok) { -TX_STAT_INC (skb_success); -TX_STAT_ADD (skb_success_bytes, ln); +TX_STAT_INC (hif_dev, skb_success); +TX_STAT_ADD (hif_dev, skb_success_bytes, ln); }else -TX_STAT_INC (skb_failed); +TX_STAT_INC (hif_dev, skb_failed); } }
@@ -302,7 +302,7 @@ static void hif_usb_tx_cb(struct urb *urb) hif_dev->tx.tx_buf_cnt++;if (!(hif_dev->tx.flags &HIF_USB_TX_STOP ))__hif_usb_tx (hif_dev);/* Check for pending SKBs */ -TX_STAT_INC (buf_completed); +TX_STAT_INC (hif_dev, buf_completed);spin_unlock (&hif_dev->tx.tx_lock); }
@@ -353,7 +353,7 @@ static int __hif_usb_tx(struct hif_device_usb *hif_dev) tx_buf->len += tx_buf->offset;__skb_queue_tail (&tx_buf->skb_queue, nskb); -TX_STAT_INC (skb_queued); +TX_STAT_INC (hif_dev, skb_queued); } usb_fill_bulk_urb(tx_buf->urb, hif_dev->udev,
@@ -369,7 +369,7 @@ static int __hif_usb_tx(struct hif_device_usb *hif_dev)list_move_tail (&tx_buf->list, &hif_dev->tx.tx_buf); hif_dev->tx.tx_buf_cnt++; }else { -TX_STAT_INC (buf_queued); +TX_STAT_INC (hif_dev, buf_queued); }return ret;
@@ -514,7 +514,7 @@ static void hif_usb_sta_drain(void *hif_handle, u8 idx)ath9k_htc_txcompletion_cb (hif_dev->htc_handle, skb, false); hif_dev->tx.tx_skb_cnt--; -TX_STAT_INC (skb_failed); +TX_STAT_INC (hif_dev, skb_failed); } }
@@ -585,14 +585,14 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, pkt_tag =get_unaligned_le16 (ptr + index +2 );if (pkt_tag !=ATH_USB_RX_STREAM_MODE_TAG ) { -RX_STAT_INC (skb_dropped); +RX_STAT_INC (hif_dev, skb_dropped);return ; }if (pkt_len >2 *MAX_RX_BUF_SIZE ) {dev_err (&hif_dev->udev->dev,"ath9k_htc: invalid pkt_len (%x)\n" , pkt_len); -RX_STAT_INC (skb_dropped); +RX_STAT_INC (hif_dev, skb_dropped);return ; }
@@ -618,7 +618,7 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, goto err; }skb_reserve (nskb,32 ); -RX_STAT_INC (skb_allocated); +RX_STAT_INC (hif_dev, skb_allocated);memcpy (nskb->data, &(skb->data[chk_idx+4 ]), hif_dev->rx_transfer_len);
@@ -639,7 +639,7 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, goto err; }skb_reserve (nskb,32 ); -RX_STAT_INC (skb_allocated); +RX_STAT_INC (hif_dev, skb_allocated);memcpy (nskb->data, &(skb->data[chk_idx+4 ]), pkt_len);skb_put (nskb, pkt_len);
@@ -649,10 +649,10 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, err:for (i =0 ; i < pool_index; i++) { -RX_STAT_ADD (skb_completed_bytes, skb_pool[i]->len); +RX_STAT_ADD (hif_dev, skb_completed_bytes, skb_pool[i]->len);ath9k_htc_rx_msg (hif_dev->htc_handle, skb_pool[i], skb_pool[i]->len,USB_WLAN_RX_PIPE ); -RX_STAT_INC (skb_completed); +RX_STAT_INC (hif_dev, skb_completed); } }
drivers/net/wireless/ath/ath9k/htc.h +18 -14
@@ -327,14 +327,18 @@ static inline struct ath9k_htc_tx_ctl *HTC_SKB_CB(struct sk_buff *skb) }#ifdef CONFIG_ATH9K_HTC_DEBUGFS -#define __STAT_SAFE (expr) (hif_dev->htc_handle->drv_priv ? (expr) : 0) -#define TX_STAT_INC (c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx_stats.c++) -#define TX_STAT_ADD (c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx_stats.c += a) -#define RX_STAT_INC (c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c++) -#define RX_STAT_ADD (c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c += a) -#define CAB_STAT_INC priv->debug.tx_stats.cab_queued++ - -#define TX_QSTAT_INC (q) (priv->debug.tx_stats.queue_stats[q]++) +#define __STAT_SAFE (hif_dev, expr) ((hif_dev)->htc_handle->drv_priv ? (expr) : 0) +#define CAB_STAT_INC (priv) ((priv)->debug.tx_stats.cab_queued++) +#define TX_QSTAT_INC (priv, q) ((priv)->debug.tx_stats.queue_stats[q]++) + +#define TX_STAT_INC (hif_dev, c) \ + __STAT_SAFE((hif_dev), (hif_dev)->htc_handle->drv_priv->debug.tx_stats.c++) +#define TX_STAT_ADD (hif_dev, c, a) \ + __STAT_SAFE((hif_dev), (hif_dev)->htc_handle->drv_priv->debug.tx_stats.c += a) +#define RX_STAT_INC (hif_dev, c) \ + __STAT_SAFE((hif_dev), (hif_dev)->htc_handle->drv_priv->debug.skbrx_stats.c++) +#define RX_STAT_ADD (hif_dev, c, a) \ + __STAT_SAFE((hif_dev), (hif_dev)->htc_handle->drv_priv->debug.skbrx_stats.c += a)void ath9k_htc_err_stat_rx (struct ath9k_htc_priv *priv,struct ath_rx_status *rs);
@@ -374,13 +378,13 @@ void ath9k_htc_get_et_stats(struct ieee80211_hw *hw, struct ethtool_stats *stats, u64 *data);#else -#define TX_STAT_INC (c) do { } while (0) -#define TX_STAT_ADD (c, a) do { } while (0) -#define RX_STAT_INC (c) do { } while (0) -#define RX_STAT_ADD (c, a) do { } while (0) -#define CAB_STAT_INC do { } while (0) +#define TX_STAT_INC (hif_dev, c) +#define TX_STAT_ADD (hif_dev, c, a) +#define RX_STAT_INC (hif_dev, c) +#define RX_STAT_ADD (hif_dev, c, a) -#define TX_QSTAT_INC (c) do { } while (0) +#define CAB_STAT_INC (priv) +#define TX_QSTAT_INC (priv, c)static inline void ath9k_htc_err_stat_rx (struct ath9k_htc_priv *priv,struct ath_rx_status *rs)
drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +5 -5
@@ -106,20 +106,20 @@ static inline enum htc_endpoint_id get_htc_epid(struct ath9k_htc_priv *priv,switch (qnum) {case 0 : -TX_QSTAT_INC (IEEE80211_AC_VO ); +TX_QSTAT_INC (priv,IEEE80211_AC_VO ); epid = priv->data_vo_ep;break ;case 1 : -TX_QSTAT_INC (IEEE80211_AC_VI ); +TX_QSTAT_INC (priv,IEEE80211_AC_VI ); epid = priv->data_vi_ep;break ;case 2 : -TX_QSTAT_INC (IEEE80211_AC_BE ); +TX_QSTAT_INC (priv,IEEE80211_AC_BE ); epid = priv->data_be_ep;break ;case 3 :default : -TX_QSTAT_INC (IEEE80211_AC_BK ); +TX_QSTAT_INC (priv,IEEE80211_AC_BK ); epid = priv->data_bk_ep;break ; }
@@ -323,7 +323,7 @@ static void ath9k_htc_tx_data(struct ath9k_htc_priv *priv,memcpy (tx_fhdr, (u8 *) &tx_hdr,sizeof (tx_hdr));if (is_cab) { -CAB_STAT_INC ; +CAB_STAT_INC (priv); tx_ctl->epid = priv->cab_ep;return ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 90/529 wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
In reply to Greg Kroah-HartmanFrom: Fedor Pchelkin <[email protected]>
[ Upstream commit 0af54343a76263a12dbae7fafb64eb47c4a6ad38 ]
Syzkaller detected a memory leak of skbs in ath9k_hif_usb_rx_stream(). While processing skbs in ath9k_hif_usb_rx_stream(), the already allocated skbs in skb_pool are not freed if ath9k_hif_usb_rx_stream() fails. If we have an incorrect pkt_len or pkt_tag, the input skb is considered invalid and dropped. All the associated packets already in skb_pool should be dropped and freed. Added a comment describing this issue.
The patch also makes remain_skb NULL after being processed so that it cannot be referenced after potential free. The initialization of hif_dev fields which are associated with remain_skb (rx_remain_len, rx_transfer_len and rx_pad_len) is moved after a new remain_skb is allocated.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 31 +++++++++++++++++------- 1 file changed, 22 insertions(+), 9 deletions(-)
drivers/net/wireless/ath/ath9k/hif_usb.c +22 -9
@@ -561,11 +561,11 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,memcpy (ptr, skb->data, rx_remain_len); rx_pkt_len += rx_remain_len; - hif_dev->rx_remain_len =0 ;skb_put (remain_skb, rx_pkt_len); skb_pool[pool_index++] = remain_skb; - + hif_dev->remain_skb =NULL ; + hif_dev->rx_remain_len =0 ; }else { index = rx_remain_len; }
@@ -584,16 +584,21 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, pkt_len =get_unaligned_le16 (ptr + index); pkt_tag =get_unaligned_le16 (ptr + index +2 ); +/* It is supposed that if we have an invalid pkt_tag or +* pkt_len then the whole input SKB is considered invalid +* and dropped; the associated packets already in skb_pool +* are dropped, too. +*/ if (pkt_tag !=ATH_USB_RX_STREAM_MODE_TAG ) {RX_STAT_INC (hif_dev, skb_dropped); -return ; + goto invalid_pkt; }if (pkt_len >2 *MAX_RX_BUF_SIZE ) {dev_err (&hif_dev->udev->dev,"ath9k_htc: invalid pkt_len (%x)\n" , pkt_len);RX_STAT_INC (hif_dev, skb_dropped); -return ; + goto invalid_pkt; } pad_len =4 - (pkt_len &0x3 );
@@ -605,11 +610,6 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,if (index >MAX_RX_BUF_SIZE ) {spin_lock (&hif_dev->rx_lock); - hif_dev->rx_remain_len = index -MAX_RX_BUF_SIZE ; - hif_dev->rx_transfer_len = -MAX_RX_BUF_SIZE - chk_idx -4 ; - hif_dev->rx_pad_len = pad_len; - nskb =__dev_alloc_skb (pkt_len +32 ,GFP_ATOMIC );if (!nskb) { dev_err(&hif_dev->udev->dev,
@@ -617,6 +617,12 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,spin_unlock (&hif_dev->rx_lock); goto err; } + + hif_dev->rx_remain_len = index -MAX_RX_BUF_SIZE ; + hif_dev->rx_transfer_len = +MAX_RX_BUF_SIZE - chk_idx -4 ; + hif_dev->rx_pad_len = pad_len; +skb_reserve (nskb,32 );RX_STAT_INC (hif_dev, skb_allocated);
@@ -654,6 +660,13 @@ static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, skb_pool[i]->len, USB_WLAN_RX_PIPE);RX_STAT_INC (hif_dev, skb_completed); } +return ; +invalid_pkt: +for (i =0 ; i < pool_index; i++) { +dev_kfree_skb_any (skb_pool[i]); +RX_STAT_INC (hif_dev, skb_dropped); + } +return ; }static void ath9k_hif_usb_rx_cb (struct urb *urb)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 91/529 wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()
In reply to Greg Kroah-HartmanFrom: Minsuk Kang <[email protected]>
[ Upstream commit 8a2f35b9830692f7a616f2f627f943bc748af13a ]
Fix a stack-out-of-bounds write that occurs in a WMI response callback function that is called after a timeout occurs in ath9k_wmi_cmd(). The callback writes to wmi->cmd_rsp_buf, a stack-allocated buffer that could no longer be valid when a timeout occurs. Set wmi->last_seq_id to 0 when a timeout occurred.
Found by a modified version of syzkaller.
BUG: KASAN: stack-out-of-bounds in ath9k_wmi_ctrl_rx Write of size 4 Call Trace: memcpy ath9k_wmi_ctrl_rx ath9k_htc_rx_msg ath9k_hif_usb_reg_in_cb __usb_hcd_giveback_urb usb_hcd_giveback_urb dummy_timer call_timer_fn run_timer_softirq __do_softirq irq_exit_rcu sysvec_apic_timer_interrupt
--- drivers/net/wireless/ath/ath9k/wmi.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/ath/ath9k/wmi.c +1 -0
@@ -341,6 +341,7 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,if (!time_left) {ath_dbg (common,WMI ,"Timeout waiting for WMI command: %s\n" ,wmi_cmd_to_name (cmd_id)); + wmi->last_seq_id =0 ;mutex_unlock (&wmi->op_mutex);return -ETIMEDOUT ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 92/529 wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit ed3f83b3459a67a3ab9d806490ac304b567b1c2d ]
crypto_alloc_shash() allocates resources, which should be released by crypto_free_shash(). When ath11k_peer_find() fails, there has memory leak. Add missing crypto_free_shash() to fix this.
--- drivers/net/wireless/ath/ath11k/dp_rx.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/ath/ath11k/dp_rx.c +1 -0
@@ -3022,6 +3022,7 @@ int ath11k_peer_rx_frag_setup(struct ath11k *ar, const u8 *peer_mac, int vdev_idif (!peer) {ath11k_warn (ab,"failed to find the peer to set up fragment info\n" );spin_unlock_bh (&ab->base_lock); +crypto_free_shash (tfm);return -ENOENT ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 93/529 wifi: cfg80211: Fix extended KCK key length check in nl80211_set_rekey_data()
In reply to Greg Kroah-HartmanFrom: Shivani Baranwal <[email protected]>
[ Upstream commit df4969ca135b9b3b2c38c07514aaa775112ac835 ]
The extended KCK key length check wrongly using the KEK key attribute for validation. Due to this GTK rekey offload is failing when the KCK key length is 24 bytes even though the driver advertising WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK flag. Use correct attribute to fix the same.
--- net/wireless/nl80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/wireless/nl80211.c +1 -1
@@ -12675,7 +12675,7 @@ static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)return -ERANGE ;if (nla_len (tb[NL80211_REKEY_DATA_KCK ]) !=NL80211_KCK_LEN && !(rdev->wiphy.flags &WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK && -nla_len (tb[NL80211_REKEY_DATA_KEK ]) ==NL80211_KCK_EXT_LEN )) +nla_len (tb[NL80211_REKEY_DATA_KCK ]) ==NL80211_KCK_EXT_LEN ))return -ERANGE ; rekey_data.kek =nla_data (tb[NL80211_REKEY_DATA_KEK ]);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 94/529 ACPI: battery: Fix missing NUL-termination with large strings
In reply to Greg Kroah-HartmanFrom: Armin Wolf <[email protected]>
[ Upstream commit f2ac14b5f197e4a2dec51e5ceaa56682ff1592bc ]
When encountering a string bigger than the destination buffer (32 bytes), the string is not properly NUL-terminated, causing buffer overreads later.
This for example happens on the Inspiron 3505, where the battery model name is larger than 32 bytes, which leads to sysfs showing the model name together with the serial number string (which is NUL-terminated and thus prevents worse).
Fix this by using strscpy() which ensures that the result is always NUL-terminated.
--- drivers/acpi/battery.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/battery.c +1 -1
@@ -454,7 +454,7 @@ static int extract_package(struct acpi_battery *battery,u8 *ptr = (u8 *)battery + offsets[i].offset;if (element->type ==ACPI_TYPE_STRING || element->type ==ACPI_TYPE_BUFFER ) -strncpy (ptr, element->string.pointer,32 ); +strscpy (ptr, element->string.pointer,32 );else if (element->type ==ACPI_TYPE_INTEGER ) {strncpy (ptr, (u8 *)&element->integer.value,sizeof (u64));
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 95/529 crypto: ccp - Failure on re-initialization due to duplicate sysfs filename
In reply to Greg Kroah-HartmanFrom: Koba Ko <[email protected]>
[ Upstream commit 299bf602b3f92f1456aef59c6413591fb02e762a ]
The following warning appears during the CCP module re-initialization:
[ 140.965403] sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:07.1/0000:03:00.2/dma/dma0chan0' [ 140.975736] CPU: 0 PID: 388 Comm: kworker/0:2 Kdump: loaded Not tainted 6.2.0-0.rc2.18.eln124.x86_64 #1 [ 140.985185] Hardware name: HPE ProLiant DL325 Gen10/ProLiant DL325 Gen10, BIOS A41 07/17/2020 [ 140.993761] Workqueue: events work_for_cpu_fn [ 140.998151] Call Trace: [ 141.000613] <TASK> [ 141.002726] dump_stack_lvl+0x33/0x46 [ 141.006415] sysfs_warn_dup.cold+0x17/0x23 [ 141.010542] sysfs_create_dir_ns+0xba/0xd0 [ 141.014670] kobject_add_internal+0xba/0x260 [ 141.018970] kobject_add+0x81/0xb0 [ 141.022395] device_add+0xdc/0x7e0 [ 141.025822] ? complete_all+0x20/0x90 [ 141.029510] __dma_async_device_channel_register+0xc9/0x130 [ 141.035119] dma_async_device_register+0x19e/0x3b0 [ 141.039943] ccp_dmaengine_register+0x334/0x3f0 [ccp] [ 141.045042] ccp5_init+0x662/0x6a0 [ccp] [ 141.049000] ? devm_kmalloc+0x40/0xd0 [ 141.052688] ccp_dev_init+0xbb/0xf0 [ccp] [ 141.056732] ? __pci_set_master+0x56/0xd0 [ 141.060768] sp_init+0x70/0x90 [ccp] [ 141.064377] sp_pci_probe+0x186/0x1b0 [ccp] [ 141.068596] local_pci_probe+0x41/0x80 [ 141.072374] work_for_cpu_fn+0x16/0x20 [ 141.076145] process_one_work+0x1c8/0x380 [ 141.080181] worker_thread+0x1ab/0x380 [ 141.083953] ? __pfx_worker_thread+0x10/0x10 [ 141.088250] kthread+0xda/0x100 [ 141.091413] ? __pfx_kthread+0x10/0x10 [ 141.095185] ret_from_fork+0x2c/0x50 [ 141.098788] </TASK> [ 141.100996] kobject_add_internal failed for dma0chan0 with -EEXIST, don't try to register things with the same name in the same directory. [ 141.113703] ccp 0000:03:00.2: ccp initialization failed
The /dma/dma0chan0 sysfs file is not removed since dma_chan object has been released in ccp_dma_release() before releasing dma device. A correct procedure would be: release dma channels first => unregister dma device => release ccp dma object.
--- drivers/crypto/ccp/ccp-dmaengine.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-)
drivers/crypto/ccp/ccp-dmaengine.c +17 -4
@@ -643,14 +643,26 @@ static void ccp_dma_release(struct ccp_device *ccp) chan = ccp->ccp_dma_chan + i; dma_chan = &chan->dma_chan; -if (dma_chan->client_count) -dma_release_channel (dma_chan); -tasklet_kill (&chan->cleanup_tasklet);list_del_rcu (&dma_chan->device_node); } } +static void ccp_dma_release_channels (struct ccp_device *ccp) +{ +struct ccp_dma_chan *chan; +struct dma_chan *dma_chan; +unsigned int i; + +for (i =0 ; i < ccp->cmd_q_count; i++) { + chan = ccp->ccp_dma_chan + i; + dma_chan = &chan->dma_chan; + +if (dma_chan->client_count) +dma_release_channel (dma_chan); + } +} +int ccp_dmaengine_register (struct ccp_device *ccp) {struct ccp_dma_chan *chan;
@@ -771,8 +783,9 @@ void ccp_dmaengine_unregister(struct ccp_device *ccp)if (!dmaengine)return ; -ccp_dma_release (ccp); +ccp_dma_release_channels (ccp);dma_async_device_unregister (dma_dev); +ccp_dma_release (ccp);kmem_cache_destroy (ccp->dma_desc_cache);kmem_cache_destroy (ccp->dma_cmd_cache);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 96/529 crypto: essiv - Handle EBUSY correctly
In reply to Greg Kroah-HartmanFrom: Herbert Xu <[email protected]>
[ Upstream commit b5a772adf45a32c68bef28e60621f12617161556 ]
As it is essiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request.
However, as the caller of essiv may specify MAY_BACKLOG, we also need to expect EBUSY and treat it in the same way. Otherwise backlogged requests will trigger a use-after-free.
--- crypto/essiv.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
crypto/essiv.c +6 -1
@@ -170,7 +170,12 @@ static void essiv_aead_done(struct crypto_async_request *areq, int err)struct aead_request *req = areq->data;struct essiv_aead_request_ctx *rctx =aead_request_ctx (req); +if (err == -EINPROGRESS ) + goto out; +kfree (rctx->assoc); + +out:aead_request_complete (req, err); }
@@ -246,7 +251,7 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) err = enc ?crypto_aead_encrypt (subreq) :crypto_aead_decrypt (subreq); -if (rctx->assoc && err != -EINPROGRESS ) +if (rctx->assoc && err != -EINPROGRESS && err != -EBUSY )kfree (rctx->assoc);return err; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 97/529 crypto: seqiv - Handle EBUSY correctly
In reply to Greg Kroah-HartmanFrom: Herbert Xu <[email protected]>
[ Upstream commit 32e62025e5e52fbe4812ef044759de7010b15dbc ]
As it is seqiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request.
However, as the caller of seqiv may specify MAY_BACKLOG, we also need to expect EBUSY and treat it in the same way. Otherwise backlogged requests will trigger a use-after-free.
--- crypto/seqiv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
crypto/seqiv.c +1 -1
@@ -23,7 +23,7 @@ static void seqiv_aead_encrypt_complete2(struct aead_request *req, int err)struct aead_request *subreq =aead_request_ctx (req);struct crypto_aead *geniv; -if (err == -EINPROGRESS ) +if (err == -EINPROGRESS || err == -EBUSY )return ;if (err)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 98/529 powercap: fix possible name leak in powercap_register_zone()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 1b6599f741a4525ca761ecde46e5885ff1e6ba58 ]
In the error path after calling dev_set_name(), the device name is leaked. To fix this, calling dev_set_name() before device_register(), and call put_device() if it returns error.
All the resources is released in powercap_release(), so it can return from powercap_register_zone() directly.
--- drivers/powercap/powercap_sys.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
drivers/powercap/powercap_sys.c +9 -5
@@ -530,9 +530,6 @@ struct powercap_zone *powercap_register_zone( power_zone->name =kstrdup (name,GFP_KERNEL );if (!power_zone->name) goto err_name_alloc; -dev_set_name (&power_zone->dev,"%s:%x" , -dev_name (power_zone->dev.parent), - power_zone->id); power_zone->constraints =kcalloc (nr_constraints,sizeof (*power_zone->constraints),GFP_KERNEL );
@@ -555,9 +552,16 @@ struct powercap_zone *powercap_register_zone( power_zone->dev_attr_groups[0 ] = &power_zone->dev_zone_attr_group; power_zone->dev_attr_groups[1 ] =NULL ; power_zone->dev.groups = power_zone->dev_attr_groups; +dev_set_name (&power_zone->dev,"%s:%x" , +dev_name (power_zone->dev.parent), + power_zone->id); result =device_register (&power_zone->dev); -if (result) - goto err_dev_ret; +if (result) { +put_device (&power_zone->dev); +mutex_unlock (&control_type->lock); + +return ERR_PTR (result); + } control_type->nr_zones++;mutex_unlock (&control_type->lock);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 99/529 x86/cpu: Init AP exception handling from cpu_init_secondary()
In reply to Greg Kroah-HartmanFrom: Borislav Petkov <[email protected]>
[ Upstream commit b1efd0ff4bd16e8bb8607ba566b03f2024a830bb ]
SEV-ES guests require properly setup task register with which the TSS descriptor in the GDT can be located so that the IST-type #VC exception handler which they need to function properly, can be executed.
This setup needs to happen before attempting to load microcode in ucode_cpu_init() on secondary CPUs which can cause such #VC exceptions.
Simplify the machinery by running that exception setup from a new function cpu_init_secondary() and explicitly call cpu_init_exception_handling() for the boot CPU before cpu_init(). The latter prepares for fixing and simplifying the exception/IST setup on the boot CPU.
There should be no functional changes resulting from this patch.
[ tglx: Reworked it so cpu_init_exception_handling() stays seperate ]
Stable-dep-of: c0dd9245aa9e ("x86/microcode: Check CPU capabilities after late microcode update correctly")
--- arch/x86/include/asm/processor.h | 1 + arch/x86/kernel/cpu/common.c | 28 +++++++++++++++------------- arch/x86/kernel/smpboot.c | 3 +-- arch/x86/kernel/traps.c | 4 +--- 4 files changed, 18 insertions(+), 18 deletions(-)
arch/x86/include/asm/processor.h +1 -0
@@ -682,6 +682,7 @@ extern void load_direct_gdt(int);extern void load_fixmap_gdt (int );extern void load_percpu_segment (int );extern void cpu_init (void ); +extern void cpu_init_secondary (void );extern void cpu_init_exception_handling (void );extern void cr4_init (void );
arch/x86/kernel/cpu/common.c +15 -13
@@ -2048,13 +2048,12 @@ void cpu_init_exception_handling(void)/* * cpu_init() initializes state that is per-CPU. Some data is already -* initialized (naturally) in the bootstrap process, such as the GDT -* and IDT. We reload them nevertheless, this function acts as a -* 'CPU state barrier', nothing should get across. +* initialized (naturally) in the bootstrap process, such as the GDT. We +* reload it nevertheless, this function acts as a 'CPU state barrier', +* nothing should get across. */ void cpu_init (void ) { -struct tss_struct *tss =this_cpu_ptr (&cpu_tss_rw);struct task_struct *cur = current;int cpu =raw_smp_processor_id ();
@@ -2067,8 +2066,6 @@ void cpu_init(void) early_cpu_to_node(cpu) != NUMA_NO_NODE)set_numa_node (early_cpu_to_node (cpu));#endif -setup_getcpu (cpu); -pr_debug ("Initializing CPU#%d\n" , cpu); if (IS_ENABLED(CONFIG_X86_64) || cpu_feature_enabled(X86_FEATURE_VME) ||
@@ -2080,7 +2077,6 @@ void cpu_init(void)* and set up the GDT descriptor: */ switch_to_new_gdt (cpu); -load_current_idt ();if (IS_ENABLED (CONFIG_X86_64 )) {loadsegment (fs,0 );
@@ -2100,12 +2096,6 @@ void cpu_init(void)initialize_tlbstate_and_flush ();enter_lazy_tlb (&init_mm, cur); -/* Initialize the TSS. */ -tss_setup_ist (tss); -tss_setup_io_bitmap (tss); -set_tss_desc (cpu, &get_cpu_entry_area (cpu)->tss.x86_tss); - -load_TR_desc ();/* * sp0 points to the entry trampoline stack regardless of what task * is running.
@@ -2127,6 +2117,18 @@ void cpu_init(void)load_fixmap_gdt (cpu); } +#ifdef CONFIG_SMP +void cpu_init_secondary (void ) +{ +/* +* Relies on the BP having set-up the IDT tables, which are loaded +* on this CPU in cpu_init_exception_handling(). +*/ +cpu_init_exception_handling (); +cpu_init (); +} +#endif +/* * The microcode loader calls this upon late microcode load to recheck features, * only when microcode has been updated. Caller holds microcode_mutex and CPU
arch/x86/kernel/smpboot.c +1 -2
@@ -227,8 +227,7 @@ static void notrace start_secondary(void *unused)load_cr3 (swapper_pg_dir);__flush_tlb_all ();#endif -cpu_init_exception_handling (); -cpu_init (); +cpu_init_secondary ();rcu_cpu_starting (raw_smp_processor_id ()); x86_cpuinit.early_percpu_clock_init ();smp_callin ();
arch/x86/kernel/traps.c +1 -3
@@ -1185,9 +1185,7 @@ void __init trap_init(void)idt_setup_traps (); -/* -* Should be a barrier for any external CPU state: -*/ +cpu_init_exception_handling ();cpu_init ();idt_setup_ist_traps ();
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 100/529 x86/microcode: Replace deprecated CPU-hotplug functions.
In reply to Greg Kroah-HartmanFrom: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit 2089f34f8c5b91f7235023ec72e71e3247261ecc ]
The functions get_online_cpus() and put_online_cpus() have been deprecated during the CPU hotplug rework. They map directly to cpus_read_lock() and cpus_read_unlock().
Replace deprecated CPU-hotplug functions with the official version. The behavior remains unchanged.
Stable-dep-of: c0dd9245aa9e ("x86/microcode: Check CPU capabilities after late microcode update correctly")
--- arch/x86/kernel/cpu/microcode/core.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
arch/x86/kernel/cpu/microcode/core.c +9 -9
@@ -55,7 +55,7 @@ LIST_HEAD(microcode_cache);* All non cpu-hotplug-callback call sites use: * * - microcode_mutex to synchronize with each other; -* - get/put_online_cpus() to synchronize with +* - cpus_read_lock/unlock() to synchronize with * the cpu-hotplug-callback call sites. * * We guarantee that only a single cpu is being
@@ -431,7 +431,7 @@ static ssize_t microcode_write(struct file *file, const char __user *buf,return ret; } -get_online_cpus (); +cpus_read_lock ();mutex_lock (µcode_mutex);if (do_microcode_update (buf, len) ==0 )
@@ -441,7 +441,7 @@ static ssize_t microcode_write(struct file *file, const char __user *buf,perf_check_microcode ();mutex_unlock (µcode_mutex); -put_online_cpus (); +cpus_read_unlock ();return ret; }
@@ -629,7 +629,7 @@ static ssize_t reload_store(struct device *dev,if (val !=1 )return size; -get_online_cpus (); +cpus_read_lock (); ret =check_online_cpus ();if (ret)
@@ -644,7 +644,7 @@ static ssize_t reload_store(struct device *dev,mutex_unlock (µcode_mutex); put: -put_online_cpus (); +cpus_read_unlock ();if (ret ==0 ) ret = size;
@@ -853,14 +853,14 @@ int __init microcode_init(void)if (IS_ERR (microcode_pdev))return PTR_ERR (microcode_pdev); -get_online_cpus (); +cpus_read_lock ();mutex_lock (µcode_mutex); error =subsys_interface_register (&mc_cpu_interface);if (!error)perf_check_microcode ();mutex_unlock (µcode_mutex); -put_online_cpus (); +cpus_read_unlock ();if (error) goto out_pdev;
@@ -892,13 +892,13 @@ int __init microcode_init(void) &cpu_root_microcode_group); out_driver: -get_online_cpus (); +cpus_read_lock ();mutex_lock (µcode_mutex);subsys_interface_unregister (&mc_cpu_interface);mutex_unlock (µcode_mutex); -put_online_cpus (); +cpus_read_unlock (); out_pdev:platform_device_unregister (microcode_pdev);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 101/529 x86: Mark stop_this_cpu() __noreturn
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
[ Upstream commit f9cdf7ca57cada055f61ef6d0eb4db21c3f200db ]
vmlinux.o: warning: objtool: smp_stop_nmi_callback()+0x2b: unreachable instruction
0000 0000000000047cf0 <smp_stop_nmi_callback>:
...
0026 47d16: e8 00 00 00 00 call 47d1b <smp_stop_nmi_callback+0x2b> 47d17: R_X86_64_PLT32 stop_this_cpu-0x4 002b 47d1b: b8 01 00 00 00 mov $0x1,%eax
Stable-dep-of: c0dd9245aa9e ("x86/microcode: Check CPU capabilities after late microcode update correctly")
--- arch/x86/include/asm/processor.h | 2 +- arch/x86/kernel/process.c | 2 +- tools/objtool/check.c | 1 + 3 files changed, 3 insertions(+), 2 deletions(-)
arch/x86/include/asm/processor.h +1 -1
@@ -839,7 +839,7 @@ bool xen_set_default_idle(void);#define xen_set_default_idle 0#endif -void stop_this_cpu (void *dummy); +void __noreturn stop_this_cpu (void *dummy);void microcode_check (void );enum l1tf_mitigations {
arch/x86/kernel/process.c +1 -1
@@ -720,7 +720,7 @@ bool xen_set_default_idle(void) }#endif -void stop_this_cpu (void *dummy) +void __noreturn stop_this_cpu (void *dummy) {local_irq_disable ();/*
tools/objtool/check.c +1 -0
@@ -180,6 +180,7 @@ static bool __dead_end_function(struct objtool_file *file, struct symbol *func,"kunit_try_catch_throw" ,"xen_start_kernel" ,"cpu_bringup_and_idle" , + "stop_this_cpu", };if (!func)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 102/529 x86/microcode: Rip out the OLD_INTERFACE
In reply to Greg Kroah-HartmanFrom: Borislav Petkov <[email protected]>
[ Upstream commit 181b6f40e9ea80c76756d4d0cdeed396016c487e ]
Everything should be using the early initrd loading by now.
Stable-dep-of: c0dd9245aa9e ("x86/microcode: Check CPU capabilities after late microcode update correctly")
--- arch/x86/Kconfig | 12 ---- arch/x86/kernel/cpu/microcode/core.c | 100 --------------------------- 2 files changed, 112 deletions(-)
arch/x86/Kconfig +0 -12
@@ -1329,18 +1329,6 @@ config MICROCODE_AMD If you select this option, microcode patch loading support for AMD processors will be enabled. -config MICROCODE_OLD_INTERFACE - bool "Ancient loading interface (DEPRECATED)" - default n - depends on MICROCODE - help - DO NOT USE THIS! This is the ancient /dev/cpu/microcode interface - which was used by userspace tools like iucode_tool and microcode.ctl. - It is inadequate because it runs too late to be able to properly - load microcode on a machine and it needs special tools. Instead, you - should've switched to the early loading method with the initrd or - builtin microcode by now: Documentation/x86/microcode.rst - config X86_MSR tristate "/dev/cpu/*/msr - Model-specific register support" help
arch/x86/kernel/cpu/microcode/core.c +0 -100
118 lines not on this page · raw message
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 103/529 x86/microcode: Default-disable late loading
In reply to Greg Kroah-HartmanFrom: Borislav Petkov <[email protected]>
[ Upstream commit a77a94f86273ce42a39cb479217dd8d68acfe0ff ]
It is dangerous and it should not be used anyway - there's a nice early loading already.
Stable-dep-of: c0dd9245aa9e ("x86/microcode: Check CPU capabilities after late microcode update correctly")
--- arch/x86/Kconfig | 11 +++++++++++ arch/x86/kernel/cpu/common.c | 2 ++ arch/x86/kernel/cpu/microcode/core.c | 7 ++++++- 3 files changed, 19 insertions(+), 1 deletion(-)
arch/x86/Kconfig +11 -0
@@ -1329,6 +1329,17 @@ config MICROCODE_AMD If you select this option, microcode patch loading support for AMD processors will be enabled. +config MICROCODE_LATE_LOADING + bool "Late microcode loading (DANGEROUS)" + default n + depends on MICROCODE + help + Loading microcode late, when the system is up and executing instructions + is a tricky business and should be avoided if possible. Just the sequence + of synchronizing all cores and SMT threads is one fragile dance which does + not guarantee that cores might not softlock after the loading. Therefore, + use this at your own risk. Late loading taints the kernel too. + config X86_MSR tristate "/dev/cpu/*/msr - Model-specific register support" help
arch/x86/kernel/cpu/common.c +2 -0
@@ -2129,6 +2129,7 @@ void cpu_init_secondary(void) }#endif +#ifdef CONFIG_MICROCODE_LATE_LOADING /* * The microcode loader calls this upon late microcode load to recheck features, * only when microcode has been updated. Caller holds microcode_mutex and CPU
@@ -2158,6 +2159,7 @@ void microcode_check(void)pr_warn ("x86/CPU: CPU features have changed after loading microcode, but might not take effect.\n" ); pr_warn("x86/CPU: Please consider either early loading through initrd/built-in or a potential BIOS update.\n"); } +#endif /* * Invoked from core CPU hotplug code after hotplug operations
arch/x86/kernel/cpu/microcode/core.c +6 -1
@@ -393,6 +393,7 @@ static int apply_microcode_on_target(int cpu)/* fake device for request_firmware */ static struct platform_device *microcode_pdev; +#ifdef CONFIG_MICROCODE_LATE_LOADING /* * Late loading dance. Why the heavy-handed stomp_machine effort? *
@@ -560,6 +561,9 @@ static ssize_t reload_store(struct device *dev, return ret; } +static DEVICE_ATTR_WO (reload); +#endif +static ssize_t version_show (struct device *dev,struct device_attribute *attr,char *buf) {
@@ -576,7 +580,6 @@ static ssize_t pf_show(struct device *dev,return sprintf (buf,"0x%x\n" , uci->cpu_sig.pf); } -static DEVICE_ATTR_WO (reload); static DEVICE_ATTR(version, 0444, version_show, NULL); static DEVICE_ATTR(processor_flags, 0444, pf_show, NULL);
@@ -729,7 +732,9 @@ static int mc_cpu_down_prep(unsigned int cpu) }static struct attribute *cpu_root_microcode_attrs[] = { +#ifdef CONFIG_MICROCODE_LATE_LOADING &dev_attr_reload.attr, +#endifNULL };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 104/529 x86/microcode: Print previous version of microcode after reload
In reply to Greg Kroah-HartmanFrom: Ashok Raj <[email protected]>
[ Upstream commit 7fce8d6eccbc31a561d07c79f359ad09f0424347 ]
Print both old and new versions of microcode after a reload is complete because knowing the previous microcode version is sometimes important from a debugging perspective.
[ bp: Massage commit message. ]
Stable-dep-of: c0dd9245aa9e ("x86/microcode: Check CPU capabilities after late microcode update correctly")
--- arch/x86/kernel/cpu/microcode/core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/x86/kernel/cpu/microcode/core.c +3 -2
@@ -508,7 +508,7 @@ static int __reload_late(void *info)*/ static int microcode_reload_late (void ) { -int ret; +int old = boot_cpu_data.microcode, ret;atomic_set (&late_cpus_in,0 );atomic_set (&late_cpus_out,0 );
@@ -517,7 +517,8 @@ static int microcode_reload_late(void)if (ret ==0 )microcode_check (); -pr_info ("Reload completed, microcode revision: 0x%x\n" , boot_cpu_data.microcode); +pr_info ("Reload completed, microcode revision: 0x%x -> 0x%x\n" , + old, boot_cpu_data.microcode);return ret; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 105/529 x86/microcode: Add a parameter to microcode_check() to store CPU capabilities
In reply to Greg Kroah-HartmanFrom: Ashok Raj <[email protected]>
[ Upstream commit ab31c74455c64e69342ddab21fd9426fcbfefde7 ]
Add a parameter to store CPU capabilities before performing a microcode update so that CPU capabilities can be compared before and after update.
[ bp: Massage. ]
Stable-dep-of: c0dd9245aa9e ("x86/microcode: Check CPU capabilities after late microcode update correctly")
--- arch/x86/include/asm/processor.h | 2 +- arch/x86/kernel/cpu/common.c | 21 +++++++++++++-------- arch/x86/kernel/cpu/microcode/core.c | 3 ++- 3 files changed, 16 insertions(+), 10 deletions(-)
arch/x86/include/asm/processor.h +1 -1
@@ -840,7 +840,7 @@ bool xen_set_default_idle(void);#endif void __noreturn stop_this_cpu (void *dummy); -void microcode_check (void ); +void microcode_check (struct cpuinfo_x86 *prev_info);enum l1tf_mitigations {L1TF_MITIGATION_OFF ,
arch/x86/kernel/cpu/common.c +13 -8
@@ -2130,30 +2130,35 @@ void cpu_init_secondary(void)#endif #ifdef CONFIG_MICROCODE_LATE_LOADING -/* +/** +* microcode_check() - Check if any CPU capabilities changed after an update. +* @prev_info: CPU capabilities stored before an update. +* * The microcode loader calls this upon late microcode load to recheck features, * only when microcode has been updated. Caller holds microcode_mutex and CPU * hotplug lock. +* +* Return: None */ -void microcode_check (void ) +void microcode_check (struct cpuinfo_x86 *prev_info) { -struct cpuinfo_x86 info; -perf_check_microcode ();/* Reload CPUID max function as it might've changed. */ - info.cpuid_level =cpuid_eax (0 ); + prev_info->cpuid_level =cpuid_eax (0 );/* * Copy all capability leafs to pick up the synthetic ones so that * memcmp() below doesn't fail on that. The ones coming from CPUID will * get overwritten in get_cpu_cap(). */ -memcpy (&info.x86_capability, &boot_cpu_data.x86_capability,sizeof (info.x86_capability)); +memcpy (&prev_info->x86_capability, &boot_cpu_data.x86_capability, +sizeof (prev_info->x86_capability)); -get_cpu_cap (&info); +get_cpu_cap (prev_info); -if (!memcmp (&info.x86_capability, &boot_cpu_data.x86_capability,sizeof (info.x86_capability))) +if (!memcmp (&prev_info->x86_capability, &boot_cpu_data.x86_capability, +sizeof (prev_info->x86_capability)))return ;pr_warn ("x86/CPU: CPU features have changed after loading microcode, but might not take effect.\n" );
arch/x86/kernel/cpu/microcode/core.c +2 -1
@@ -509,13 +509,14 @@ static int __reload_late(void *info)static int microcode_reload_late (void ) {int old = boot_cpu_data.microcode, ret; +struct cpuinfo_x86 prev_info;atomic_set (&late_cpus_in,0 );atomic_set (&late_cpus_out,0 ); ret =stop_machine_cpuslocked (__reload_late,NULL , cpu_online_mask);if (ret ==0 ) -microcode_check (); +microcode_check (&prev_info);pr_info ("Reload completed, microcode revision: 0x%x -> 0x%x\n" , old, boot_cpu_data.microcode);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 106/529 x86/microcode: Check CPU capabilities after late microcode update correctly
In reply to Greg Kroah-HartmanFrom: Ashok Raj <[email protected]>
[ Upstream commit c0dd9245aa9e25a697181f6085692272c9ec61bc ]
The kernel caches each CPU's feature bits at boot in an x86_capability[] structure. However, the capabilities in the BSP's copy can be turned off as a result of certain command line parameters or configuration restrictions, for example the SGX bit. This can cause a mismatch when comparing the values before and after the microcode update.
Another example is X86_FEATURE_SRBDS_CTRL which gets added only after microcode update:
# --- cpuid.before 2023-01-21 14:54:15.652000747 +0100 # +++ cpuid.after 2023-01-21 14:54:26.632001024 +0100 # @@ -10,7 +10,7 @@ CPU: # 0x00000004 0x04: eax=0x00000000 ebx=0x00000000 ecx=0x00000000 edx=0x00000000 # 0x00000005 0x00: eax=0x00000040 ebx=0x00000040 ecx=0x00000003 edx=0x11142120 # 0x00000006 0x00: eax=0x000027f7 ebx=0x00000002 ecx=0x00000001 edx=0x00000000 # - 0x00000007 0x00: eax=0x00000000 ebx=0x029c6fbf ecx=0x40000000 edx=0xbc002400 # + 0x00000007 0x00: eax=0x00000000 ebx=0x029c6fbf ecx=0x40000000 edx=0xbc002e00
^^^
and which proves for a gazillionth time that late loading is a bad bad idea.
microcode_check() is called after an update to report any previously cached CPUID bits which might have changed due to the update.
Therefore, store the cached CPU caps before the update and compare them with the CPU caps after the microcode update has succeeded.
Thus, the comparison is done between the CPUID *hardware* bits before and after the upgrade instead of using the cached, possibly runtime modified values in BSP's boot_cpu_data copy.
As a result, false warnings about CPUID bits changes are avoided.
[ bp:
- Massage.
- Add SRBDS_CTRL example.
- Add kernel-doc.
- Incorporate forgotten review feedback from dhansen. ]
--- arch/x86/include/asm/processor.h | 1 + arch/x86/kernel/cpu/common.c | 36 ++++++++++++++++++---------- arch/x86/kernel/cpu/microcode/core.c | 6 +++++ 3 files changed, 30 insertions(+), 13 deletions(-)
arch/x86/include/asm/processor.h +1 -0
@@ -841,6 +841,7 @@ bool xen_set_default_idle(void);void __noreturn stop_this_cpu (void *dummy);void microcode_check (struct cpuinfo_x86 *prev_info); +void store_cpu_caps (struct cpuinfo_x86 *info);enum l1tf_mitigations {L1TF_MITIGATION_OFF ,
arch/x86/kernel/cpu/common.c +23 -13
@@ -2130,6 +2130,25 @@ void cpu_init_secondary(void)#endif #ifdef CONFIG_MICROCODE_LATE_LOADING +/** +* store_cpu_caps() - Store a snapshot of CPU capabilities +* @curr_info: Pointer where to store it +* +* Returns: None +*/ +void store_cpu_caps (struct cpuinfo_x86 *curr_info) +{ +/* Reload CPUID max function as it might've changed. */ + curr_info->cpuid_level =cpuid_eax (0 ); + +/* Copy all capability leafs and pick up the synthetic ones. */ +memcpy (&curr_info->x86_capability, &boot_cpu_data.x86_capability, +sizeof (curr_info->x86_capability)); + +/* Get the hardware CPUID leafs */ +get_cpu_cap (curr_info); +} +/** * microcode_check() - Check if any CPU capabilities changed after an update. * @prev_info: CPU capabilities stored before an update.
@@ -2142,22 +2161,13 @@ void cpu_init_secondary(void)*/ void microcode_check (struct cpuinfo_x86 *prev_info) { -perf_check_microcode (); - -/* Reload CPUID max function as it might've changed. */ - prev_info->cpuid_level =cpuid_eax (0 ); +struct cpuinfo_x86 curr_info; -/* -* Copy all capability leafs to pick up the synthetic ones so that -* memcmp() below doesn't fail on that. The ones coming from CPUID will -* get overwritten in get_cpu_cap(). -*/ -memcpy (&prev_info->x86_capability, &boot_cpu_data.x86_capability, -sizeof (prev_info->x86_capability)); +perf_check_microcode (); -get_cpu_cap (prev_info); +store_cpu_caps (&curr_info); -if (!memcmp (&prev_info->x86_capability, &boot_cpu_data.x86_capability, +if (!memcmp (&prev_info->x86_capability, &curr_info.x86_capability,sizeof (prev_info->x86_capability)))return ;
arch/x86/kernel/cpu/microcode/core.c +6 -0
@@ -514,6 +514,12 @@ static int microcode_reload_late(void)atomic_set (&late_cpus_in,0 );atomic_set (&late_cpus_out,0 ); +/* +* Take a snapshot before the microcode update in order to compare and +* check whether any bits changed after an update. +*/ +store_cpu_caps (&prev_info); + ret =stop_machine_cpuslocked (__reload_late,NULL , cpu_online_mask);if (ret ==0 )microcode_check (&prev_info);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 107/529 x86/microcode: Adjust late loading result reporting message
In reply to Greg Kroah-HartmanFrom: Ashok Raj <[email protected]>
[ Upstream commit 6eab3abac7043226e5375e9ead0c7607ced6767b ]
During late microcode loading, the "Reload completed" message is issued unconditionally, regardless of success or failure.
Adjust the message to report the result of the update.
[ bp: Massage. ]
--- arch/x86/kernel/cpu/microcode/core.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
arch/x86/kernel/cpu/microcode/core.c +7 -4
@@ -521,11 +521,14 @@ static int microcode_reload_late(void)store_cpu_caps (&prev_info); ret =stop_machine_cpuslocked (__reload_late,NULL , cpu_online_mask); -if (ret ==0 ) +if (!ret) { +pr_info ("Reload succeeded, microcode revision: 0x%x -> 0x%x\n" , + old, boot_cpu_data.microcode);microcode_check (&prev_info); - -pr_info ("Reload completed, microcode revision: 0x%x -> 0x%x\n" , - old, boot_cpu_data.microcode); + }else { +pr_info ("Reload failed, current microcode revision: 0x%x\n" , + boot_cpu_data.microcode); + }return ret; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 108/529 net: ethernet: ti: am65-cpsw: fix tx csum offload for multi mac mode
In reply to Greg Kroah-HartmanFrom: Grygorii Strashko <[email protected]>
[ Upstream commit 97067aaf127487788a297267dede0008cd75bb7b ]
The current implementation uses .ndo_set_features() callback to track NETIF_F_HW_CSUM feature changes and update generic CPSW_P0_CONTROL_REG.RX_CHECKSUM_EN option accordingly. It's not going to work in case of multi-port devices as TX csum offload can be changed per netdev.
On K3 CPSWxG devices TX csum offload enabled in the following way:
- the CPSW_P0_CONTROL_REG.RX_CHECKSUM_EN option enables TX csum offload in
generic and affects all TX DMA channels and packets;
- corresponding fields in TX DMA descriptor have to be filed properly when
upper layer wants to offload TX csum (skb->ip_summed == CHECKSUM_PARTIAL) and it's per-packet option.
The Linux Network core is expected to never request TX csum offload if netdev NETIF_F_HW_CSUM feature is disabled, and, as result, TX DMA descriptors should not be modified, and per-packet TX csum offload will be disabled (or enabled) on per-netdev basis. Which, in turn, makes it safe to enable the CPSW_P0_CONTROL_REG.RX_CHECKSUM_EN option unconditionally.
Hence, fix TX csum offload for multi-port devices by:
- enabling the CPSW_P0_CONTROL_REG.RX_CHECKSUM_EN option inam65_cpsw_nuss_common_open() unconditionally
- and removing .ndo_set_features() callback implementation, which was used
only NETIF_F_HW_CSUM feature update purposes
--- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 30 +----------------------- 1 file changed, 1 insertion(+), 29 deletions(-)
drivers/net/ethernet/ti/am65-cpsw-nuss.c +1 -29
@@ -426,9 +426,7 @@ static int am65_cpsw_nuss_common_open(struct am65_cpsw_common *common,writel (common->rx_flow_id_base, host_p->port_base +AM65_CPSW_PORT0_REG_FLOW_ID_OFFSET );/* en tx crc offload */ -if (features &NETIF_F_HW_CSUM ) -writel (AM65_CPSW_P0_REG_CTL_RX_CHECKSUM_EN , - host_p->port_base +AM65_CPSW_P0_REG_CTL ); +writel (AM65_CPSW_P0_REG_CTL_RX_CHECKSUM_EN , host_p->port_base +AM65_CPSW_P0_REG_CTL );am65_cpsw_nuss_set_p0_ptype (common);
@@ -1369,31 +1367,6 @@ static void am65_cpsw_nuss_ndo_get_stats(struct net_device *dev, stats->tx_dropped = dev->stats.tx_dropped; } -static int am65_cpsw_nuss_ndo_slave_set_features (struct net_device *ndev, -netdev_features_t features) -{ -struct am65_cpsw_common *common =am65_ndev_to_common (ndev); -netdev_features_t changes = features ^ ndev->features; -struct am65_cpsw_host *host_p; - - host_p =am65_common_get_host (common); - -if (changes &NETIF_F_HW_CSUM ) { -bool enable = !!(features &NETIF_F_HW_CSUM ); - -dev_info (common->dev,"Turn %s tx-checksum-ip-generic\n" , - enable ?"ON" :"OFF" ); -if (enable) -writel (AM65_CPSW_P0_REG_CTL_RX_CHECKSUM_EN , - host_p->port_base +AM65_CPSW_P0_REG_CTL ); -else -writel (0 , - host_p->port_base +AM65_CPSW_P0_REG_CTL ); - } - -return 0 ; -} -static const struct net_device_ops am65_cpsw_nuss_netdev_ops_2g = { .ndo_open = am65_cpsw_nuss_ndo_slave_open, .ndo_stop = am65_cpsw_nuss_ndo_slave_stop,
@@ -1406,7 +1379,6 @@ static const struct net_device_ops am65_cpsw_nuss_netdev_ops_2g = { .ndo_vlan_rx_add_vid = am65_cpsw_nuss_ndo_slave_add_vid, .ndo_vlan_rx_kill_vid = am65_cpsw_nuss_ndo_slave_kill_vid, .ndo_do_ioctl = am65_cpsw_nuss_ndo_slave_ioctl, - .ndo_set_features = am65_cpsw_nuss_ndo_slave_set_features, .ndo_setup_tc = am65_cpsw_qos_ndo_setup_tc, };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 109/529 net: ethernet: ti: am65-cpsw: handle deferred probe with dev_err_probe()
In reply to Greg Kroah-HartmanFrom: Grygorii Strashko <[email protected]>
[ Upstream commit 8fbc2f9edce23d19fc09ef5bf8d4eb38be2db0f8 ]
Use new dev_err_probe() API to handle deferred probe properly and simplify the code.
--- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 28 +++++++++--------------- 1 file changed, 10 insertions(+), 18 deletions(-)
drivers/net/ethernet/ti/am65-cpsw-nuss.c +10 -18
@@ -1487,9 +1487,8 @@ static int am65_cpsw_nuss_init_tx_chns(struct am65_cpsw_common *common) tx_chn->tx_chn_name, &tx_cfg);if (IS_ERR (tx_chn->tx_chn)) { - ret =PTR_ERR (tx_chn->tx_chn); -dev_err (dev,"Failed to request tx dma channel %d\n" , - ret); + ret =dev_err_probe (dev,PTR_ERR (tx_chn->tx_chn), +"Failed to request tx dma channel\n" ); goto err; }
@@ -1560,8 +1559,8 @@ static int am65_cpsw_nuss_init_rx_chns(struct am65_cpsw_common *common) rx_chn->rx_chn =k3_udma_glue_request_rx_chn (dev,"rx" , &rx_cfg);if (IS_ERR (rx_chn->rx_chn)) { - ret =PTR_ERR (rx_chn->rx_chn); -dev_err (dev,"Failed to request rx dma channel %d\n" , ret); + ret =dev_err_probe (dev,PTR_ERR (rx_chn->rx_chn), +"Failed to request rx dma channel\n" ); goto err; }
@@ -1768,12 +1767,10 @@ static int am65_cpsw_nuss_init_slave_ports(struct am65_cpsw_common *common)/* get phy/link info */ if (of_phy_is_fixed_link (port_np)) { ret =of_phy_register_fixed_link (port_np); -if (ret) { -if (ret != -EPROBE_DEFER ) -dev_err (dev,"%pOF failed to register fixed-link phy: %d\n" , - port_np, ret); -return ret; - } +if (ret) +return dev_err_probe (dev, ret, +"failed to register fixed-link phy %pOF\n" , + port_np); port->slave.phy_node =of_node_get (port_np); }else { port->slave.phy_node =
@@ -2062,13 +2059,8 @@ static int am65_cpsw_nuss_probe(struct platform_device *pdev)return -ENOMEM ; clk =devm_clk_get (dev,"fck" ); -if (IS_ERR (clk)) { - ret =PTR_ERR (clk); - -if (ret != -EPROBE_DEFER ) -dev_err (dev,"error getting fck clock %d\n" , ret); -return ret; - } +if (IS_ERR (clk)) +return dev_err_probe (dev,PTR_ERR (clk),"getting fck clock\n" ); common->bus_freq =clk_get_rate (clk);pm_runtime_enable (dev);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 110/529 net: ethernet: ti: add missing of_node_put before return
In reply to Greg Kroah-HartmanFrom: Wang Qing <[email protected]>
[ Upstream commit be565ec71d1d59438bed0c7ed0a252a327e0b0ef ]
Fix following coccicheck warning:
WARNING: Function "for_each_child_of_node"
should have of_node_put() before return.
Early exits from for_each_child_of_node should decrement the node reference counter.
--- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 29 ++++++++++++++++-------- 1 file changed, 20 insertions(+), 9 deletions(-)
drivers/net/ethernet/ti/am65-cpsw-nuss.c +20 -9
@@ -1724,13 +1724,14 @@ static int am65_cpsw_nuss_init_slave_ports(struct am65_cpsw_common *common)if (ret <0 ) {dev_err (dev,"%pOF error reading port_id %d\n" , port_np, ret); -return ret; + goto of_node_put; }if (!port_id || port_id > common->port_num) {dev_err (dev,"%pOF has invalid port_id %u %s\n" , port_np, port_id, port_np->name); -return -EINVAL ; + ret = -EINVAL ; + goto of_node_put; } port =am65_common_get_port (common, port_id);
@@ -1746,8 +1747,10 @@ static int am65_cpsw_nuss_init_slave_ports(struct am65_cpsw_common *common) (AM65_CPSW_NU_FRAM_PORT_OFFSET * (port_id -1 )); port->slave.mac_sl =cpsw_sl_get ("am65" , dev, port->port_base); -if (IS_ERR (port->slave.mac_sl)) -return PTR_ERR (port->slave.mac_sl); +if (IS_ERR (port->slave.mac_sl)) { + ret =PTR_ERR (port->slave.mac_sl); + goto of_node_put; + } port->disabled = !of_device_is_available (port_np);if (port->disabled)
@@ -1758,7 +1761,7 @@ static int am65_cpsw_nuss_init_slave_ports(struct am65_cpsw_common *common) ret =PTR_ERR (port->slave.ifphy);dev_err (dev,"%pOF error retrieving port phy: %d\n" , port_np, ret); -return ret; + goto of_node_put; } port->slave.mac_only =
@@ -1767,10 +1770,12 @@ static int am65_cpsw_nuss_init_slave_ports(struct am65_cpsw_common *common)/* get phy/link info */ if (of_phy_is_fixed_link (port_np)) { ret =of_phy_register_fixed_link (port_np); -if (ret) -return dev_err_probe (dev, ret, +if (ret) { + ret =dev_err_probe (dev, ret,"failed to register fixed-link phy %pOF\n" , port_np); + goto of_node_put; + } port->slave.phy_node =of_node_get (port_np); }else { port->slave.phy_node =
@@ -1780,14 +1785,15 @@ static int am65_cpsw_nuss_init_slave_ports(struct am65_cpsw_common *common)if (!port->slave.phy_node) {dev_err (dev,"slave[%d] no phy found\n" , port_id); -return -ENODEV ; + ret = -ENODEV ; + goto of_node_put; } ret =of_get_phy_mode (port_np, &port->slave.phy_if);if (ret) {dev_err (dev,"%pOF read phy-mode err %d\n" , port_np, ret); -return ret; + goto of_node_put; } mac_addr =of_get_mac_address (port_np);
@@ -1804,6 +1810,11 @@ static int am65_cpsw_nuss_init_slave_ports(struct am65_cpsw_common *common)of_node_put (node);return 0 ; + +of_node_put: +of_node_put (port_np); +of_node_put (node); +return ret; }static void am65_cpsw_pcpu_stats_free (void *data)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 111/529 crypto: xts - Handle EBUSY correctly
In reply to Greg Kroah-HartmanFrom: Herbert Xu <[email protected]>
[ Upstream commit 51c082514c2dedf2711c99d93c196cc4eedceb40 ]
As it is xts only handles the special return value of EINPROGRESS, which means that in all other cases it will free data related to the request.
However, as the caller of xts may specify MAY_BACKLOG, we also need to expect EBUSY and treat it in the same way. Otherwise backlogged requests will trigger a use-after-free.
--- crypto/xts.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
crypto/xts.c +4 -4
@@ -202,12 +202,12 @@ static void xts_encrypt_done(struct crypto_async_request *areq, int err)if (!err) {struct xts_request_ctx *rctx =skcipher_request_ctx (req); - rctx->subreq.base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP ; + rctx->subreq.base.flags &=CRYPTO_TFM_REQ_MAY_BACKLOG ; err =xts_xor_tweak_post (req, true);if (!err &&unlikely (req->cryptlen %XTS_BLOCK_SIZE )) { err =xts_cts_final (req, crypto_skcipher_encrypt); -if (err == -EINPROGRESS ) +if (err == -EINPROGRESS || err == -EBUSY )return ; } }
@@ -222,12 +222,12 @@ static void xts_decrypt_done(struct crypto_async_request *areq, int err)if (!err) {struct xts_request_ctx *rctx =skcipher_request_ctx (req); - rctx->subreq.base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP ; + rctx->subreq.base.flags &=CRYPTO_TFM_REQ_MAY_BACKLOG ; err =xts_xor_tweak_post (req, false);if (!err &&unlikely (req->cryptlen %XTS_BLOCK_SIZE )) { err =xts_cts_final (req, crypto_skcipher_decrypt); -if (err == -EINPROGRESS ) +if (err == -EINPROGRESS || err == -EBUSY )return ; } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 112/529 leds: led-class: Add missing put_device() to led_put()
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 445110941eb94709216363f9d807d2508e64abd7 ]
led_put() is used to "undo" a successful of_led_get() call, of_led_get() uses class_find_device_by_of_node() which returns a reference to the device which must be free-ed with put_device() when the caller is done with it.
Add a put_device() call to led_put() to free the reference returned by class_find_device_by_of_node().
And also add a put_device() in the error-exit case of try_module_get() failing.
--- drivers/leds/led-class.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/leds/led-class.c +4 -1
@@ -242,8 +242,10 @@ struct led_classdev *of_led_get(struct device_node *np, int index) led_cdev =dev_get_drvdata (led_dev); -if (!try_module_get (led_cdev->dev->parent->driver->owner)) +if (!try_module_get (led_cdev->dev->parent->driver->owner)) { +put_device (led_cdev->dev);return ERR_PTR (-ENODEV ); + }return led_cdev; }
@@ -256,6 +258,7 @@ EXPORT_SYMBOL_GPL(of_led_get);void led_put (struct led_classdev *led_cdev) {module_put (led_cdev->dev->parent->driver->owner); +put_device (led_cdev->dev); }EXPORT_SYMBOL_GPL (led_put);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 113/529 crypto: ccp - Refactor out sev_fw_alloc()
In reply to Greg Kroah-HartmanFrom: Peter Gonda <[email protected]>
[ Upstream commit cc17982d58d1e67eab831e7023ede999dda56173 ]
Create a helper function sev_fw_alloc() which can be used to allocate aligned memory regions for use by the PSP firmware. Currently only used for the SEV-ES TMR region but will be used for the SEV_INIT_EX NV memory region.
Stable-dep-of: 46a334a98f58 ("crypto: ccp - Flush the SEV-ES TMR memory before giving it to firmware")
--- drivers/crypto/ccp/sev-dev.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
drivers/crypto/ccp/sev-dev.c +13 -7
@@ -138,6 +138,17 @@ static int sev_cmd_buffer_len(int cmd)return 0 ; } +static void *sev_fw_alloc (unsigned long len) +{ +struct page *page; + + page =alloc_pages (GFP_KERNEL ,get_order (len)); +if (!page) +return NULL ; + +return page_address (page); +} +static int __sev_do_cmd_locked (int cmd,void *data,int *psp_ret) {struct psp_device *psp = psp_master;
@@ -1040,7 +1051,6 @@ EXPORT_SYMBOL_GPL(sev_issue_cmd_external_user);void sev_pci_init (void ) {struct sev_device *sev = psp_master->sev_data; -struct page *tmr_page;int error, rc;if (!sev)
@@ -1056,14 +1066,10 @@ void sev_pci_init(void)sev_get_api_version ();/* Obtain the TMR memory area for SEV-ES use */ - tmr_page =alloc_pages (GFP_KERNEL ,get_order (SEV_ES_TMR_SIZE )); -if (tmr_page) { - sev_es_tmr =page_address (tmr_page); - }else { - sev_es_tmr =NULL ; + sev_es_tmr =sev_fw_alloc (SEV_ES_TMR_SIZE ); +if (!sev_es_tmr)dev_warn (sev->dev,"SEV: TMR allocation failed, SEV-ES support unavailable\n" ); - }/* Initialize the platform */ rc =sev_platform_init (&error);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 114/529 crypto: ccp - Flush the SEV-ES TMR memory before giving it to firmware
In reply to Greg Kroah-HartmanFrom: Tom Lendacky <[email protected]>
[ Upstream commit 46a334a98f585ef78d51d8f5736596887bdd7f54 ]
Perform a cache flush on the SEV-ES TMR memory after allocation to prevent any possibility of the firmware encountering an error should dirty cache lines be present. Use clflush_cache_range() to flush the SEV-ES TMR memory.
--- drivers/crypto/ccp/sev-dev.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/crypto/ccp/sev-dev.c +5 -1
@@ -23,6 +23,7 @@#include <linux/gfp.h> #include <asm/smp.h> +#include <asm/cacheflush.h> #include "psp-dev.h" #include "sev-dev.h"
@@ -1067,7 +1068,10 @@ void sev_pci_init(void)/* Obtain the TMR memory area for SEV-ES use */ sev_es_tmr =sev_fw_alloc (SEV_ES_TMR_SIZE ); -if (!sev_es_tmr) +if (sev_es_tmr) +/* Must flush the cache before giving it to the firmware */ +clflush_cache_range (sev_es_tmr,SEV_ES_TMR_SIZE ); +else dev_warn (sev->dev,"SEV: TMR allocation failed, SEV-ES support unavailable\n" );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 115/529 bpftool: profile online CPUs instead of possible
In reply to Greg Kroah-HartmanFrom: Tonghao Zhang <[email protected]>
[ Upstream commit 377c16fa3f3c60d21e4b05314c8be034ce37f2eb ]
The number of online cpu may be not equal to possible cpu. "bpftool prog profile" can not create pmu event on possible but on online cpu.
$ dmidecode -s system-product-name PowerEdge R620 $ cat /sys/devices/system/cpu/possible 0-47 $ cat /sys/devices/system/cpu/online 0-31
Disable cpu dynamically:
$ echo 0 > /sys/devices/system/cpu/cpuX/online
If one cpu is offline, perf_event_open will return ENODEV. To fix this issue:
* check value returned and skip offline cpu.
* close pmu_fd immediately on error path, avoid fd leaking.
--- tools/bpf/bpftool/prog.c | 38 ++++++++++++++++++++++++++++++-------- 1 file changed, 30 insertions(+), 8 deletions(-)
tools/bpf/bpftool/prog.c +30 -8
@@ -1912,10 +1912,38 @@ static void profile_close_perf_events(struct profiler_bpf *obj) profile_perf_event_cnt =0 ; } +static int profile_open_perf_event (int mid,int cpu,int map_fd) +{ +int pmu_fd; + + pmu_fd =syscall (__NR_perf_event_open, &metrics[mid].attr, +-1 /*pid*/ , cpu,-1 /*group_fd*/ ,0 ); +if (pmu_fd <0 ) { +if (errno ==ENODEV ) { +p_info ("cpu %d may be offline, skip %s profiling." , + cpu, metrics[mid].name); + profile_perf_event_cnt++; +return 0 ; + } +return -1 ; + } + +if (bpf_map_update_elem (map_fd, + &profile_perf_event_cnt, + &pmu_fd,BPF_ANY ) || +ioctl (pmu_fd,PERF_EVENT_IOC_ENABLE ,0 )) { +close (pmu_fd); +return -1 ; + } + + profile_perf_events[profile_perf_event_cnt++] = pmu_fd; +return 0 ; +} +static int profile_open_perf_events (struct profiler_bpf *obj) {unsigned int cpu, m; -int map_fd, pmu_fd; +int map_fd; profile_perf_events =calloc (sizeof (int ), obj->rodata->num_cpu * obj->rodata->num_metric);
@@ -1934,17 +1962,11 @@ static int profile_open_perf_events(struct profiler_bpf *obj)if (!metrics[m].selected)continue ;for (cpu =0 ; cpu < obj->rodata->num_cpu; cpu++) { - pmu_fd =syscall (__NR_perf_event_open, &metrics[m].attr, --1 /*pid*/ , cpu,-1 /*group_fd*/ ,0 ); -if (pmu_fd <0 || -bpf_map_update_elem (map_fd, &profile_perf_event_cnt, - &pmu_fd,BPF_ANY ) || -ioctl (pmu_fd,PERF_EVENT_IOC_ENABLE ,0 )) { +if (profile_open_perf_event (m, cpu, map_fd)) {p_err ("failed to create event %s on cpu %d" , metrics[m].name, cpu);return -1 ; } - profile_perf_events[profile_perf_event_cnt++] = pmu_fd; } }return 0 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 116/529 net/mlx5: Enhance debug print in page allocation failure
In reply to Greg Kroah-HartmanFrom: Jack Morgenstein <[email protected]>
[ Upstream commit 7eef93003e5d20e1a6a6e59e12d914b5431cbda2 ]
Provide more details to aid debugging.
--- drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c +2 -1
@@ -216,7 +216,8 @@ static int alloc_4k(struct mlx5_core_dev *dev, u64 *addr, u32 function) n =find_first_bit (&fp->bitmask,8 *sizeof (fp->bitmask));if (n >=MLX5_NUM_4K_IN_PAGE ) { -mlx5_core_warn (dev,"alloc 4k bug\n" ); +mlx5_core_warn (dev,"alloc 4k bug: fw page = 0x%llx, n = %u, bitmask: %lu, max num of 4K pages: %d\n" , + fp->addr, n, fp->bitmask,MLX5_NUM_4K_IN_PAGE );return -ENOENT ; }clear_bit (n, &fp->bitmask);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 117/529 irqchip: Fix refcount leak in platform_irqchip_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 6caa5a2b78f5f53c433d3a3781e53325da22f0ac ]
of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak.
--- drivers/irqchip/irqchip.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/irqchip/irqchip.c +6 -2
@@ -38,8 +38,10 @@ int platform_irqchip_probe(struct platform_device *pdev)struct device_node *par_np =of_irq_find_parent (np);of_irq_init_cb_t irq_init_cb =of_device_get_match_data (&pdev->dev); -if (!irq_init_cb) +if (!irq_init_cb) { +of_node_put (par_np);return -EINVAL ; + }if (par_np == np) par_np =NULL ;
@@ -52,8 +54,10 @@ int platform_irqchip_probe(struct platform_device *pdev)* interrupt controller. The actual initialization callback of this * interrupt controller can check for specific domains as necessary. */ -if (par_np && !irq_find_matching_host (par_np,DOMAIN_BUS_ANY )) +if (par_np && !irq_find_matching_host (par_np,DOMAIN_BUS_ANY )) { +of_node_put (par_np);return -EPROBE_DEFER ; + }return irq_init_cb (np, par_np); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 118/529 irqchip/alpine-msi: Fix refcount leak in alpine_msix_init_domains
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 071d068b89e95d1b078aa6bbcb9d0961b77d6aa1 ]
of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak.
--- drivers/irqchip/irq-alpine-msi.c | 1 + 1 file changed, 1 insertion(+)
drivers/irqchip/irq-alpine-msi.c +1 -0
@@ -199,6 +199,7 @@ static int alpine_msix_init_domains(struct alpine_msix_data *priv, } gic_domain =irq_find_host (gic_node); +of_node_put (gic_node);if (!gic_domain) {pr_err ("Failed to find the GIC domain\n" );return -ENXIO ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 119/529 irqchip/irq-mvebu-gicp: Fix refcount leak in mvebu_gicp_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 9419e700021a393f67be36abd0c4f3acc6139041 ]
of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak.
--- drivers/irqchip/irq-mvebu-gicp.c | 1 + 1 file changed, 1 insertion(+)
drivers/irqchip/irq-mvebu-gicp.c +1 -0
@@ -223,6 +223,7 @@ static int mvebu_gicp_probe(struct platform_device *pdev) } parent_domain =irq_find_host (irq_parent_dn); +of_node_put (irq_parent_dn);if (!parent_domain) {dev_err (&pdev->dev,"failed to find parent IRQ domain\n" );return -ENODEV ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 120/529 irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 02298b7bae12936ca313975b02e7f98b06670d37 ]
of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak.
--- drivers/irqchip/irq-ti-sci-intr.c | 1 + 1 file changed, 1 insertion(+)
drivers/irqchip/irq-ti-sci-intr.c +1 -0
@@ -236,6 +236,7 @@ static int ti_sci_intr_irq_domain_probe(struct platform_device *pdev) } parent_domain =irq_find_host (parent_node); +of_node_put (parent_node);if (!parent_domain) {dev_err (dev,"Failed to find IRQ parent domain\n" );return -ENODEV ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 121/529 s390/vmem: fix empty page tables cleanup under KASAN
In reply to Greg Kroah-HartmanFrom: Vasily Gorbik <[email protected]>
[ Upstream commit 108303b0a2d27cb14eed565e33e64ad9eefe5d7e ]
Commit b9ff81003cf1 ("s390/vmem: cleanup empty page tables") introduced empty page tables cleanup in vmem code, but when the kernel is built with KASAN enabled the code has no effect due to wrong KASAN shadow memory intersection condition, which effectively ignores any memory range below KASAN shadow. Fix intersection condition to make code work as anticipated.
--- arch/s390/mm/vmem.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/s390/mm/vmem.c +3 -3
@@ -296,7 +296,7 @@ static void try_free_pmd_table(pud_t *pud, unsigned long start)if (end >VMALLOC_START )return ;#ifdef CONFIG_KASAN -if (start <KASAN_SHADOW_END &&KASAN_SHADOW_START > end) +if (start <KASAN_SHADOW_END && end >KASAN_SHADOW_START )return ;#endif pmd =pmd_offset (pud, start);
@@ -371,7 +371,7 @@ static void try_free_pud_table(p4d_t *p4d, unsigned long start)if (end >VMALLOC_START )return ;#ifdef CONFIG_KASAN -if (start <KASAN_SHADOW_END &&KASAN_SHADOW_START > end) +if (start <KASAN_SHADOW_END && end >KASAN_SHADOW_START )return ;#endif
@@ -425,7 +425,7 @@ static void try_free_p4d_table(pgd_t *pgd, unsigned long start)if (end >VMALLOC_START )return ;#ifdef CONFIG_KASAN -if (start <KASAN_SHADOW_END &&KASAN_SHADOW_START > end) +if (start <KASAN_SHADOW_END && end >KASAN_SHADOW_START )return ;#endif
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 122/529 net: add sock_init_data_uid()
In reply to Greg Kroah-HartmanFrom: Pietro Borrello <[email protected]>
[ Upstream commit 584f3742890e966d2f0a1f3c418c9ead70b2d99e ]
Add sock_init_data_uid() to explicitly initialize the socket uid. To initialise the socket uid, sock_init_data() assumes a the struct socket* sock is always embedded in a struct socket_alloc, used to access the corresponding inode uid. This may not be true. Examples are sockets created in tun_chr_open() and tap_open().
--- include/net/sock.h | 7 ++++++- net/core/sock.c | 15 ++++++++++++--- 2 files changed, 18 insertions(+), 4 deletions(-)
include/net/sock.h +6 -1
@@ -1775,7 +1775,12 @@ void sk_common_release(struct sock *sk);* Default socket callbacks and setup code */ -/* Initialise core socket variables */ +/* Initialise core socket variables using an explicit uid. */ +void sock_init_data_uid (struct socket *sock,struct sock *sk,kuid_t uid); + +/* Initialise core socket variables. +* Assumes struct socket *sock is embedded in a struct socket_alloc. +*/ void sock_init_data (struct socket *sock,struct sock *sk);/*
net/core/sock.c +12 -3
@@ -2968,7 +2968,7 @@ void sk_stop_timer_sync(struct sock *sk, struct timer_list *timer) }EXPORT_SYMBOL (sk_stop_timer_sync); -void sock_init_data (struct socket *sock,struct sock *sk) +void sock_init_data_uid (struct socket *sock,struct sock *sk,kuid_t uid) {sk_init_common (sk); sk->sk_send_head =NULL ;
@@ -2987,11 +2987,10 @@ void sock_init_data(struct socket *sock, struct sock *sk) sk->sk_type = sock->type;RCU_INIT_POINTER (sk->sk_wq, &sock->wq); sock->sk = sk; - sk->sk_uid =SOCK_INODE (sock)->i_uid; }else {RCU_INIT_POINTER (sk->sk_wq,NULL ); - sk->sk_uid =make_kuid (sock_net (sk)->user_ns,0 ); } + sk->sk_uid = uid;rwlock_init (&sk->sk_callback_lock);if (sk->sk_kern_sock)
@@ -3049,6 +3048,16 @@ void sock_init_data(struct socket *sock, struct sock *sk)refcount_set (&sk->sk_refcnt,1 );atomic_set (&sk->sk_drops,0 ); } +EXPORT_SYMBOL (sock_init_data_uid); + +void sock_init_data (struct socket *sock,struct sock *sk) +{ +kuid_t uid = sock ? +SOCK_INODE (sock)->i_uid : +make_kuid (sock_net (sk)->user_ns,0 ); + +sock_init_data_uid (sock, sk, uid); +}EXPORT_SYMBOL (sock_init_data);void lock_sock_nested (struct sock *sk,int subclass)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 123/529 tun: tun_chr_open(): correctly initialize socket uid
In reply to Greg Kroah-HartmanFrom: Pietro Borrello <[email protected]>
[ Upstream commit a096ccca6e503a5c575717ff8a36ace27510ab0a ]
sock_init_data() assumes that the struct socket passed in input is contained in a struct socket_alloc allocated with sock_alloc(). However, tun_chr_open() passes a struct socket embedded in a struct tun_file allocated with sk_alloc().
This causes a type confusion when issuing a container_of() with SOCK_INODE() in sock_init_data() which results in assigning a wrong sk_uid to the struct sock in input.
On default configuration, the type confused field overlaps with the high 4 bytes of struct tun_struct __rcu *tun of struct tun_file, NULL at the time of call, which makes the uid of all tun sockets 0, i.e., the root one.
Fix the assignment by using sock_init_data_uid().
--- drivers/net/tun.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/tun.c +1 -1
@@ -3457,7 +3457,7 @@ static int tun_chr_open(struct inode *inode, struct file * file) tfile->socket.file = file; tfile->socket.ops = &tun_socket_ops; -sock_init_data (&tfile->socket, &tfile->sk); +sock_init_data_uid (&tfile->socket, &tfile->sk, inode->i_uid); tfile->sk.sk_write_space = tun_sock_write_space; tfile->sk.sk_sndbuf =INT_MAX ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 124/529 tap: tap_open(): correctly initialize socket uid
In reply to Greg Kroah-HartmanFrom: Pietro Borrello <[email protected]>
[ Upstream commit 66b2c338adce580dfce2199591e65e2bab889cff ]
sock_init_data() assumes that the struct socket passed in input is contained in a struct socket_alloc allocated with sock_alloc(). However, tap_open() passes a struct socket embedded in a struct tap_queue allocated with sk_alloc().
This causes a type confusion when issuing a container_of() with SOCK_INODE() in sock_init_data() which results in assigning a wrong sk_uid to the struct sock in input.
On default configuration, the type confused field overlaps with padding bytes between int vnet_hdr_sz and struct tap_dev __rcu *tap in struct tap_queue, which makes the uid of all tap sockets 0, i.e., the root one.
Fix the assignment by using sock_init_data_uid().
--- drivers/net/tap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/tap.c +1 -1
@@ -523,7 +523,7 @@ static int tap_open(struct inode *inode, struct file *file) q->sock.state =SS_CONNECTED ; q->sock.file = file; q->sock.ops = &tap_socket_ops; -sock_init_data (&q->sock, &q->sk); +sock_init_data_uid (&q->sock, &q->sk, inode->i_uid); q->sk.sk_write_space = tap_sock_write_space; q->sk.sk_destruct = tap_sock_destruct; q->flags =IFF_VNET_HDR |IFF_NO_PI |IFF_TAP ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 125/529 OPP: fix error checking in opp_migrate_dentry()
In reply to Greg Kroah-HartmanFrom: Qi Zheng <[email protected]>
[ Upstream commit eca4c0eea53432ec4b711b2a8ad282cbad231b4f ]
Since commit ff9fb72bc077 ("debugfs: return error values, not NULL") changed return value of debugfs_rename() in error cases from %NULL to %ERR_PTR(-ERROR), we should also check error values instead of NULL.
--- drivers/opp/debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/opp/debugfs.c +1 -1
@@ -204,7 +204,7 @@ static void opp_migrate_dentry(struct opp_device *opp_dev, dentry =debugfs_rename (rootdir, opp_dev->dentry, rootdir, opp_table->dentry_name); -if (!dentry) { +if (IS_ERR (dentry)) {dev_err (dev,"%s: Failed to rename link from: %s to %s\n" , __func__,dev_name (opp_dev->dev),dev_name (dev));return ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 126/529 Bluetooth: L2CAP: Fix potential user-after-free
In reply to Greg Kroah-HartmanFrom: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit df5703348813235874d851934e957c3723d71644 ]
This fixes all instances of which requires to allocate a buffer calling alloc_skb which may release the chan lock and reacquire later which makes it possible that the chan is disconnected in the meantime.
--- net/bluetooth/l2cap_core.c | 24 ------------------------ net/bluetooth/l2cap_sock.c | 8 ++++++++ 2 files changed, 8 insertions(+), 24 deletions(-)
net/bluetooth/l2cap_core.c +0 -24
@@ -2679,14 +2679,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)if (IS_ERR (skb))return PTR_ERR (skb); -/* Channel lock is released before requesting new skb and then -* reacquired thus we need to recheck channel state. -*/ -if (chan->state !=BT_CONNECTED ) { -kfree_skb (skb); -return -ENOTCONN ; - } -l2cap_do_send (chan, skb);return len; }
@@ -2731,14 +2723,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)if (IS_ERR (skb))return PTR_ERR (skb); -/* Channel lock is released before requesting new skb and then -* reacquired thus we need to recheck channel state. -*/ -if (chan->state !=BT_CONNECTED ) { -kfree_skb (skb); -return -ENOTCONN ; - } -l2cap_do_send (chan, skb); err = len;break ;
@@ -2759,14 +2743,6 @@ int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)*/ err =l2cap_segment_sdu (chan, &seg_queue, msg, len); -/* The channel could have been closed while segmenting, -* check that it is still connected. -*/ -if (chan->state !=BT_CONNECTED ) { -__skb_queue_purge (&seg_queue); - err = -ENOTCONN ; - } -if (err)break ;
net/bluetooth/l2cap_sock.c +8 -0
@@ -1623,6 +1623,14 @@ static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,if (!skb)return ERR_PTR (err); +/* Channel lock is released before requesting new skb and then +* reacquired thus we need to recheck channel state. +*/ +if (chan->state !=BT_CONNECTED ) { +kfree_skb (skb); +return ERR_PTR (-ENOTCONN ); + } + skb->priority = sk->sk_priority;bt_cb (skb)->l2cap.chan = chan;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 127/529 libbpf: Fix alen calculation in libbpf_nla_dump_errormsg()
In reply to Greg Kroah-HartmanFrom: Ilya Leoshkevich <[email protected]>
[ Upstream commit 17bcd27a08a21397698edf143084d7c87ce17946 ]
The code assumes that everything that comes after nlmsgerr are nlattrs. When calculating their size, it does not account for the initial nlmsghdr. This may lead to accessing uninitialized memory.
--- tools/lib/bpf/nlattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/lib/bpf/nlattr.c +1 -1
@@ -178,7 +178,7 @@ int libbpf_nla_dump_errormsg(struct nlmsghdr *nlh) hlen +=nlmsg_len (&err->msg); attr = (struct nlattr *) ((void *) err + hlen); - alen = nlh->nlmsg_len - hlen; + alen = (void *)nlh + nlh->nlmsg_len - (void *)attr;if (libbpf_nla_parse (tb,NLMSGERR_ATTR_MAX , attr, alen, extack_policy) !=0 ) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 128/529 rds: rds_rm_zerocopy_callback() correct order for list_add_tail()
In reply to Greg Kroah-HartmanFrom: Pietro Borrello <[email protected]>
[ Upstream commit 68762148d1b011d47bc2ceed7321739b5aea1e63 ]
rds_rm_zerocopy_callback() uses list_add_tail() with swapped arguments. This links the list head with the new entry, losing the references to the remaining part of the list.
--- net/rds/message.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/rds/message.c +1 -1
@@ -118,7 +118,7 @@ static void rds_rm_zerocopy_callback(struct rds_sock *rs, ck = &info->zcookies;memset (ck,0 ,sizeof (*ck));WARN_ON (!rds_zcookie_add (info, cookie)); -list_add_tail (&q->zcookie_head, &info->rs_zcookie_next); +list_add_tail (&info->rs_zcookie_next, &q->zcookie_head);spin_unlock_irqrestore (&q->lock, flags);/* caller invokes rds_wake_sk_sleep() */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 129/529 crypto: rsa-pkcs1pad - Use akcipher_request_complete
In reply to Greg Kroah-HartmanFrom: Herbert Xu <[email protected]>
[ Upstream commit 564cabc0ca0bdfa8f0fc1ae74b24d0a7554522c5 ]
Use the akcipher_request_complete helper instead of calling the completion function directly. In fact the previous code was buggy in that EINPROGRESS was never passed back to the original caller.
--- crypto/rsa-pkcs1pad.c | 34 +++++++++++++++------------------- 1 file changed, 15 insertions(+), 19 deletions(-)
crypto/rsa-pkcs1pad.c +15 -19
@@ -214,16 +214,14 @@ static void pkcs1pad_encrypt_sign_complete_cb( struct crypto_async_request *child_async_req, int err) {struct akcipher_request *req = child_async_req->data; -struct crypto_async_request async_req;if (err == -EINPROGRESS ) -return ; + goto out; + + err =pkcs1pad_encrypt_sign_complete (req, err); - async_req.data = req->base.data; - async_req.tfm =crypto_akcipher_tfm (crypto_akcipher_reqtfm (req)); - async_req.flags = child_async_req->flags; - req->base.complete (&async_req, -pkcs1pad_encrypt_sign_complete (req, err)); +out: +akcipher_request_complete (req, err); }static int pkcs1pad_encrypt (struct akcipher_request *req)
@@ -332,15 +330,14 @@ static void pkcs1pad_decrypt_complete_cb( struct crypto_async_request *child_async_req, int err) {struct akcipher_request *req = child_async_req->data; -struct crypto_async_request async_req;if (err == -EINPROGRESS ) -return ; + goto out; + + err =pkcs1pad_decrypt_complete (req, err); - async_req.data = req->base.data; - async_req.tfm =crypto_akcipher_tfm (crypto_akcipher_reqtfm (req)); - async_req.flags = child_async_req->flags; - req->base.complete (&async_req,pkcs1pad_decrypt_complete (req, err)); +out: +akcipher_request_complete (req, err); }static int pkcs1pad_decrypt (struct akcipher_request *req)
@@ -512,15 +509,14 @@ static void pkcs1pad_verify_complete_cb( struct crypto_async_request *child_async_req, int err) {struct akcipher_request *req = child_async_req->data; -struct crypto_async_request async_req;if (err == -EINPROGRESS ) -return ; + goto out; - async_req.data = req->base.data; - async_req.tfm =crypto_akcipher_tfm (crypto_akcipher_reqtfm (req)); - async_req.flags = child_async_req->flags; - req->base.complete (&async_req,pkcs1pad_verify_complete (req, err)); + err =pkcs1pad_verify_complete (req, err); + +out: +akcipher_request_complete (req, err); }/*
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 130/529 m68k: /proc/hardware should depend on PROC_FS
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 1e5b5df65af99013b4d31607ddb3ca5731dbe44d ]
When CONFIG_PROC_FS is not set, there is a build error for an unused function. Make PROC_HARDWARE depend on PROC_FS to prevent this error.
In file included from ../arch/m68k/kernel/setup.c:3:../arch/m68k/kernel/setup_mm.c:477:12: error: 'hardware_proc_show' defined but not used [-Werror=unused-function]
477 | static int hardware_proc_show(struct seq_file *m, void *v)
| ^~~~~~~~~~~~~~~~~~
--- arch/m68k/Kconfig.devices | 1 + 1 file changed, 1 insertion(+)
arch/m68k/Kconfig.devices +1 -0
@@ -19,6 +19,7 @@ config HEARTBEAT # We have a dedicated heartbeat LED. :-) config PROC_HARDWARE bool "/proc/hardware support" + depends on PROC_FS help Say Y here to support the /proc/hardware file, which gives you access to information about the machine you're running on,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 131/529 RISC-V: time: initialize hrtimer based broadcast clock event device
In reply to Greg Kroah-HartmanFrom: Conor Dooley <[email protected]>
[ Upstream commit 8b3b8fbb4896984b5564789a42240e4b3caddb61 ]
Similarly to commit 022eb8ae8b5e ("ARM: 8938/1: kernel: initialize broadcast hrtimer based clock event device"), RISC-V needs to initiate hrtimer based broadcast clock event device before C3STOP can be used. Otherwise, the introduction of C3STOP for the RISC-V arch timer in commit 232ccac1bd9b ("clocksource/drivers/riscv: Events are stopped during CPU suspend") leaves us without any broadcast timer registered. This prevents the kernel from entering oneshot mode, which breaks timer behaviour, for example clock_nanosleep().
A test app that sleeps each cpu for 6, 5, 4, 3 ms respectively, HZ=250 & C3STOP enabled, the sleep times are rounded up to the next jiffy:
== CPU: 1 == == CPU: 2 == == CPU: 3 == == CPU: 4 == Mean: 7.974992 Mean: 7.976534 Mean: 7.962591 Mean: 3.952179
Std Dev: 0.154374 Std Dev: 0.156082 Std Dev: 0.171018 Std Dev: 0.076193
Hi: 9.472000 Hi: 10.495000 Hi: 8.864000 Hi: 4.736000
Lo: 6.087000 Lo: 6.380000 Lo: 4.872000 Lo: 3.403000
Samples: 521 Samples: 521 Samples: 521 Samples: 521
--- arch/riscv/kernel/time.c | 3 +++ 1 file changed, 3 insertions(+)
arch/riscv/kernel/time.c +3 -0
@@ -5,6 +5,7 @@*/ #include <linux/of_clk.h> +#include <linux/clockchips.h> #include <linux/clocksource.h> #include <linux/delay.h> #include <asm/sbi.h>
@@ -28,6 +29,8 @@ void __init time_init(void)of_clk_init (NULL );timer_probe (); + +tick_setup_hrtimer_broadcast (); }void clocksource_arch_init (struct clocksource *cs)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 132/529 wifi: iwl3945: Add missing check for create_singlethread_workqueue
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 1fdeb8b9f29dfd64805bb49475ac7566a3cb06cb ]
Add the check for the return value of the create_singlethread_workqueue in order to avoid NULL pointer dereference.
--- drivers/net/wireless/intel/iwlegacy/3945-mac.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/net/wireless/intel/iwlegacy/3945-mac.c +12 -4
@@ -3380,10 +3380,12 @@ static DEVICE_ATTR(dump_errors, 0200, NULL, il3945_dump_error_log);* *****************************************************************************/ -static void +static int il3945_setup_deferred_work (struct il_priv *il) { il->workqueue =create_singlethread_workqueue (DRV_NAME ); +if (!il->workqueue) +return -ENOMEM ;init_waitqueue_head (&il->wait_command_queue);
@@ -3400,6 +3402,8 @@ il3945_setup_deferred_work(struct il_priv *il)timer_setup (&il->watchdog, il_bg_watchdog,0 );tasklet_setup (&il->irq_tasklet, il3945_irq_tasklet); + +return 0 ; } static void
@@ -3721,7 +3725,10 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) }il_set_rxon_channel (il, &il->bands[NL80211_BAND_2GHZ ].channels[5 ]); -il3945_setup_deferred_work (il); + err =il3945_setup_deferred_work (il); +if (err) + goto out_remove_sysfs; +il3945_setup_handlers (il);il_power_initialize (il);
@@ -3733,7 +3740,7 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) err =il3945_setup_mac (il);if (err) - goto out_remove_sysfs; + goto out_destroy_workqueue;il_dbgfs_register (il,DRV_NAME );
@@ -3742,9 +3749,10 @@ il3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)return 0 ; -out_remove_sysfs: +out_destroy_workqueue:destroy_workqueue (il->workqueue); il->workqueue =NULL ; +out_remove_sysfs:sysfs_remove_group (&pdev->dev.kobj, &il3945_attribute_group); out_release_irq:free_irq (il->pci_dev->irq, il);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 133/529 wifi: iwl4965: Add missing check for create_singlethread_workqueue()
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 26e6775f75517ad6844fe5b79bc5f3fa8c22ee61 ]
Add the check for the return value of the create_singlethread_workqueue() in order to avoid NULL pointer dereference.
--- drivers/net/wireless/intel/iwlegacy/4965-mac.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/iwlegacy/4965-mac.c +10 -2
@@ -6212,10 +6212,12 @@ il4965_bg_txpower_work(struct work_struct *work)mutex_unlock (&il->mutex); } -static void +static int il4965_setup_deferred_work (struct il_priv *il) { il->workqueue =create_singlethread_workqueue (DRV_NAME ); +if (!il->workqueue) +return -ENOMEM ;init_waitqueue_head (&il->wait_command_queue);
@@ -6234,6 +6236,8 @@ il4965_setup_deferred_work(struct il_priv *il)timer_setup (&il->watchdog, il_bg_watchdog,0 );tasklet_setup (&il->irq_tasklet, il4965_irq_tasklet); + +return 0 ; } static void
@@ -6623,7 +6627,10 @@ il4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) goto out_disable_msi; } -il4965_setup_deferred_work (il); + err =il4965_setup_deferred_work (il); +if (err) + goto out_free_irq; +il4965_setup_handlers (il);/*********************************************
@@ -6661,6 +6668,7 @@ il4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) out_destroy_workqueue:destroy_workqueue (il->workqueue); il->workqueue =NULL ; +out_free_irq:free_irq (il->pci_dev->irq, il); out_disable_msi:pci_disable_msi (il->pci_dev);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 134/529 wifi: mwifiex: fix loop iterator in mwifiex_update_ampdu_txwinsize()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 3cfb7df24cee0f5fdc4cc5d3176cab9aadfcb430 ]
This code re-uses "i" to be the iterator for both the inside and outside loops. It means the outside loop will exit earlier than intended.
--- drivers/net/wireless/marvell/mwifiex/11n.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/wireless/marvell/mwifiex/11n.c +3 -3
@@ -890,7 +890,7 @@ mwifiex_send_delba_txbastream_tbl(struct mwifiex_private *priv, u8 tid)*/ void mwifiex_update_ampdu_txwinsize (struct mwifiex_adapter *adapter) { -u8 i; +u8 i, j;u32 tx_win_size;struct mwifiex_private *priv;
@@ -921,8 +921,8 @@ void mwifiex_update_ampdu_txwinsize(struct mwifiex_adapter *adapter)if (tx_win_size != priv->add_ba_param.tx_win_size) {if (!priv->media_connected)continue ; -for (i =0 ; i <MAX_NUM_TID ; i++) -mwifiex_send_delba_txbastream_tbl (priv, i); +for (j =0 ; j <MAX_NUM_TID ; j++) +mwifiex_send_delba_txbastream_tbl (priv, j); } } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 135/529 selftests/bpf: Fix out-of-srctree build
In reply to Greg Kroah-HartmanFrom: Ilya Leoshkevich <[email protected]>
[ Upstream commit 0b0757244754ea1d0721195c824770f5576e119e ]
Building BPF selftests out of srctree fails with:
make: *** No rule to make target '/linux-build//ima_setup.sh', needed by 'ima_setup.sh'. Stop.
The culprit is the rule that defines convenient shorthands like "make test_progs", which builds $(OUTPUT)/test_progs. These shorthands make sense only for binaries that are built though; scripts that live in the source tree do not end up in $(OUTPUT).
Therefore drop $(TEST_PROGS) and $(TEST_PROGS_EXTENDED) from the rule.
The issue exists for a while, but it became a problem only after commit d68ae4982cb7 ("selftests/bpf: Install all required files to run selftests"), which added dependencies on these scripts.
--- tools/testing/selftests/bpf/Makefile | 2 -- 1 file changed, 2 deletions(-)
tools/testing/selftests/bpf/Makefile +0 -2
@@ -119,8 +119,6 @@ RESOLVE_BTFIDS := $(BUILD_DIR)/resolve_btfids/resolve_btfids # NOTE: Semicolon at the end is critical to override lib.mk's default static # rule for binaries. $(notdir $(TEST_GEN_PROGS) \ - $(TEST_PROGS) \ - $(TEST_PROGS_EXTENDED) \ $(TEST_GEN_PROGS_EXTENDED) \ $(TEST_CUSTOM_PROGS)): %: $(OUTPUT)/% ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 136/529 crypto: crypto4xx - Call dma_unmap_page when done
In reply to Greg Kroah-HartmanFrom: Herbert Xu <[email protected]>
[ Upstream commit bcdda4301bdc4955d45f7e1ffefb6207967b067e ]
In crypto4xx_cipher_done, we should be unmapping the dst page, not mapping it.
This was flagged by a sparse warning about the unused addr variable. While we're at it, also fix a sparse warning regarding the unused ctx variable in crypto4xx_ahash_done (by actually using it).
--- drivers/crypto/amcc/crypto4xx_core.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/crypto/amcc/crypto4xx_core.c +4 -6
@@ -522,7 +522,6 @@ static void crypto4xx_cipher_done(struct crypto4xx_device *dev, {struct skcipher_request *req;struct scatterlist *dst; -dma_addr_t addr; req =skcipher_request_cast (pd_uinfo->async_req);
@@ -531,8 +530,8 @@ static void crypto4xx_cipher_done(struct crypto4xx_device *dev, req->cryptlen, req->dst); }else { dst = pd_uinfo->dest_va; - addr =dma_map_page (dev->core_dev->device,sg_page (dst), - dst->offset, dst->length,DMA_FROM_DEVICE ); +dma_unmap_page (dev->core_dev->device, pd->dest, dst->length, +DMA_FROM_DEVICE ); }if (pd_uinfo->sa_va->sa_command_0.bf.save_iv ==SA_SAVE_IV ) {
@@ -557,10 +556,9 @@ static void crypto4xx_ahash_done(struct crypto4xx_device *dev,struct ahash_request *ahash_req; ahash_req =ahash_request_cast (pd_uinfo->async_req); - ctx =crypto_tfm_ctx (ahash_req->base.tfm); + ctx =crypto_ahash_ctx (crypto_ahash_reqtfm (ahash_req)); -crypto4xx_copy_digest_to_dst (ahash_req->result, pd_uinfo, -crypto_tfm_ctx (ahash_req->base.tfm)); +crypto4xx_copy_digest_to_dst (ahash_req->result, pd_uinfo, ctx);crypto4xx_ret_sg_desc (dev, pd_uinfo);if (pd_uinfo->state &PD_ENTRY_BUSY )
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 137/529 wifi: mac80211: make rate u32 in sta_set_rate_info_rx()
In reply to Greg Kroah-HartmanFrom: Shayne Chen <[email protected]>
[ Upstream commit 59336e07b287d91dc4ec265e07724e8f7e3d0209 ]
The value of last_rate in ieee80211_sta_rx_stats is degraded from u32 to u16 after being assigned to rate variable, which causes information loss in STA_STATS_FIELD_TYPE and later bitfields.
--- net/mac80211/sta_info.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/mac80211/sta_info.c +1 -1
@@ -2159,7 +2159,7 @@ static void sta_stats_decode_rate(struct ieee80211_local *local, u32 rate,static int sta_set_rate_info_rx (struct sta_info *sta,struct rate_info *rinfo) { -u16 rate =READ_ONCE (sta_get_last_rx_stats (sta)->last_rate); +u32 rate =READ_ONCE (sta_get_last_rx_stats (sta)->last_rate);if (rate ==STA_STATS_RATE_INVALID )return -EINVAL ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 138/529 thermal/drivers/hisi: Drop second sensor hi3660
In reply to Greg Kroah-HartmanFrom: Yongqin Liu <[email protected]>
[ Upstream commit 15cc25829a97c3957e520e971868aacc84341317 ]
The commit 74c8e6bffbe1 ("driver core: Add __alloc_size hint to devm allocators") exposes a panic "BRK handler: Fatal exception" on the hi3660_thermal_probe funciton.
This is because the function allocates memory for only one sensors array entry, but tries to fill up a second one.
Fix this by removing the unneeded second access.
--- drivers/thermal/hisi_thermal.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/thermal/hisi_thermal.c +0 -4
@@ -435,10 +435,6 @@ static int hi3660_thermal_probe(struct hisi_thermal_data *data) data->sensor[0 ].irq_name ="tsensor_a73" ; data->sensor[0 ].data = data; - data->sensor[1 ].id =HI3660_LITTLE_SENSOR ; - data->sensor[1 ].irq_name ="tsensor_a53" ; - data->sensor[1 ].data = data; -return 0 ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 139/529 can: esd_usb: Move mislocated storage of SJA1000_ECC_SEG bits in case of a bus error
In reply to Greg Kroah-HartmanFrom: Frank Jungclaus <[email protected]>
[ Upstream commit 118469f88180438ef43dee93d71f77c00e7b425d ]
Move the supply for cf->data[3] (bit stream position of CAN error), in case of a bus- or protocol-error, outside of the "switch (ecc & SJA1000_ECC_MASK){}"-statement, because this bit stream position is independent of the error type.
--- drivers/net/can/usb/esd_usb2.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/can/usb/esd_usb2.c +3 -1
@@ -278,7 +278,6 @@ static void esd_usb2_rx_event(struct esd_usb2_net_priv *priv, cf->data[2 ] |=CAN_ERR_PROT_STUFF ;break ;default : - cf->data[3 ] = ecc &SJA1000_ECC_SEG ;break ; }
@@ -286,6 +285,9 @@ static void esd_usb2_rx_event(struct esd_usb2_net_priv *priv,if (!(ecc &SJA1000_ECC_DIR )) cf->data[2 ] |=CAN_ERR_PROT_TX ; +/* Bit stream position in CAN frame as the error was detected */ + cf->data[3 ] = ecc &SJA1000_ECC_SEG ; +if (priv->can.state ==CAN_STATE_ERROR_WARNING || priv->can.state ==CAN_STATE_ERROR_PASSIVE ) { cf->data[1] = (txerr > rxerr) ?
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 140/529 bpf: Fix global subprog context argument resolution logic
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit d384dce281ed1b504fae2e279507827638d56fa3 ]
KPROBE program's user-facing context type is defined as typedef bpf_user_pt_regs_t. This leads to a problem when trying to passing kprobe/uprobe/usdt context argument into global subprog, as kernel always strip away mods and typedefs of user-supplied type, but takes expected type from bpf_ctx_convert as is, which causes mismatch.
Current way to work around this is to define a fake struct with the same name as expected typedef:
struct bpf_user_pt_regs_t {};
__noinline my_global_subprog(struct bpf_user_pt_regs_t *ctx) { ... }
This patch fixes the issue by resolving expected type, if it's not a struct. It still leaves the above work-around working for backwards compatibility.
--- kernel/bpf/btf.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
kernel/bpf/btf.c +11 -2
@@ -4273,6 +4273,7 @@ btf_get_prog_ctx_type(struct bpf_verifier_log *log, struct btf *btf,if (!ctx_struct)/* should not happen */ return NULL ; +again: ctx_tname =btf_name_by_offset (btf_vmlinux, ctx_struct->name_off);if (!ctx_tname) {/* should not happen */
@@ -4286,8 +4287,16 @@ btf_get_prog_ctx_type(struct bpf_verifier_log *log, struct btf *btf,* int socket_filter_bpf_prog(struct __sk_buff *skb) * { // no fields of skb are ever used } */ -if (strcmp (ctx_tname, tname)) -return NULL ; +if (strcmp (ctx_tname, tname)) { +/* bpf_user_pt_regs_t is a typedef, so resolve it to +* underlying struct and check name again +*/ +if (!btf_type_is_modifier (ctx_struct)) +return NULL ; +while (btf_type_is_modifier (ctx_struct)) + ctx_struct =btf_type_by_id (btf_vmlinux, ctx_struct->type); + goto again; + }return ctx_type; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 141/529 irqchip/irq-brcmstb-l2: Set IRQ_LEVEL for level triggered interrupts
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit 94debe03e8afa1267f95a9001786a6aa506b9ff3 ]
When support for the level triggered interrupt controller flavor was added with c0ca7262088e, we forgot to update the flags to be set to contain IRQ_LEVEL. While the flow handler is correct, the output from /proc/interrupts does not show such interrupts as being level triggered when they are, correct that.
--- drivers/irqchip/irq-brcmstb-l2.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/irqchip/irq-brcmstb-l2.c +5 -1
@@ -161,6 +161,7 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np, *init_params) {unsigned int clr =IRQ_NOREQUEST |IRQ_NOPROBE |IRQ_NOAUTOEN ; +unsigned int set =0 ;struct brcmstb_l2_intc_data *data;struct irq_chip_type *ct;int ret;
@@ -208,9 +209,12 @@ static int __init brcmstb_l2_intc_of_init(struct device_node *np,if (IS_ENABLED (CONFIG_MIPS ) &&IS_ENABLED (CONFIG_CPU_BIG_ENDIAN )) flags |=IRQ_GC_BE_IO ; +if (init_params->handler == handle_level_irq) + set |=IRQ_LEVEL ; +/* Allocate a single Generic IRQ chip for this node */ ret =irq_alloc_domain_generic_chips (data->domain,32 ,1 , - np->full_name, init_params->handler, clr,0 , flags); + np->full_name, init_params->handler, clr, set, flags);if (ret) {pr_err ("failed to allocate generic irq chip\n" ); goto out_free_domain;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 142/529 irqchip/irq-bcm7120-l2: Set IRQ_LEVEL for level triggered interrupts
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit 13a157b38ca5b4f9eed81442b8821db293755961 ]
When support for the interrupt controller was added with a5042de2688d, we forgot to update the flags to be set to contain IRQ_LEVEL. While the flow handler is correct, the output from /proc/interrupts does not show such interrupts as being level triggered when they are, correct that.
--- drivers/irqchip/irq-bcm7120-l2.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/irqchip/irq-bcm7120-l2.c +2 -1
@@ -273,7 +273,8 @@ static int __init bcm7120_l2_intc_probe(struct device_node *dn, flags |=IRQ_GC_BE_IO ; ret =irq_alloc_domain_generic_chips (data->domain,IRQS_PER_WORD ,1 , - dn->full_name, handle_level_irq, clr,0 , flags); + dn->full_name, handle_level_irq, clr, +IRQ_LEVEL , flags);if (ret) {pr_err ("failed to allocate generic irq chip\n" ); goto out_free_domain;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 143/529 selftests/net: Interpret UDP_GRO cmsg data as an int value
In reply to Greg Kroah-HartmanFrom: Jakub Sitnicki <[email protected]>
[ Upstream commit 436864095a95fcc611c20c44a111985fa9848730 ]
Data passed to user-space with a (SOL_UDP, UDP_GRO) cmsg carries an int (see udp_cmsg_recv), not a u16 value, as strace confirms:
recvmsg(8, {msg_name=...,
msg_iov=[{iov_base="\0\0..."..., iov_len=96000}],
msg_iovlen=1,
msg_control=[{cmsg_len=20, <-- sizeof(cmsghdr) + 4
cmsg_level=SOL_UDP,
cmsg_type=0x68}], <-- UDP_GRO
msg_controllen=24,
msg_flags=0}, 0) = 11200Interpreting the data as an u16 value won't work on big-endian platforms. Since it is too late to back out of this API decision [1], fix the test.
[1]: https://lore.kernel.org/netdev/[email protected]/
--- tools/testing/selftests/net/udpgso_bench_rx.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
tools/testing/selftests/net/udpgso_bench_rx.c +2 -4
@@ -214,11 +214,10 @@ static void do_verify_udp(const char *data, int len)static int recv_msg (int fd,char *buf,int len,int *gso_size) { -char control[CMSG_SPACE (sizeof (uint16_t ))] = {0 }; +char control[CMSG_SPACE (sizeof (int ))] = {0 };struct msghdr msg = {0 };struct iovec iov = {0 };struct cmsghdr *cmsg; -uint16_t *gsosizeptr;int ret; iov.iov_base = buf;
@@ -237,8 +236,7 @@ static int recv_msg(int fd, char *buf, int len, int *gso_size) cmsg = CMSG_NXTHDR(&msg, cmsg)) {if (cmsg->cmsg_level ==SOL_UDP && cmsg->cmsg_type ==UDP_GRO ) { - gsosizeptr = (uint16_t *)CMSG_DATA (cmsg); - *gso_size = *gsosizeptr; + *gso_size = *(int *)CMSG_DATA (cmsg);break ; } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 144/529 l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register()
In reply to Greg Kroah-HartmanFrom: Shigeru Yoshida <[email protected]>
[ Upstream commit 9ca5e7ecab064f1f47da07f7c1ddf40e4bc0e5ac ]
When a file descriptor of pppol2tp socket is passed as file descriptor of UDP socket, a recursive deadlock occurs in l2tp_tunnel_register(). This situation is reproduced by the following program:
int main(void)
{
int sock;
struct sockaddr_pppol2tp addr;
sock = socket(AF_PPPOX, SOCK_DGRAM, PX_PROTO_OL2TP);
if (sock < 0) {
perror("socket");
return 1;
}
addr.sa_family = AF_PPPOX;
addr.sa_protocol = PX_PROTO_OL2TP;
addr.pppol2tp.pid = 0;
addr.pppol2tp.fd = sock;
addr.pppol2tp.addr.sin_family = PF_INET;
addr.pppol2tp.addr.sin_port = htons(0);
addr.pppol2tp.addr.sin_addr.s_addr = inet_addr("192.168.0.1");
addr.pppol2tp.s_tunnel = 1;
addr.pppol2tp.s_session = 0;
addr.pppol2tp.d_tunnel = 0;
addr.pppol2tp.d_session = 0;
if (connect(sock, (const struct sockaddr *)&addr, sizeof(addr)) < 0) {
perror("connect");
return 1;
}
return 0;
}This program causes the following lockdep warning:
============================================
WARNING: possible recursive locking detected 6.2.0-rc5-00205-gc96618275234 #56 Not tainted
--------------------------------------------
repro/8607 is trying to acquire lock:
ffff8880213c8130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: l2tp_tunnel_register+0x2b7/0x11c0
but task is already holding lock:
ffff8880213c8130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: pppol2tp_connect+0xa82/0x1a30
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
---- lock(sk_lock-AF_PPPOX);
lock(sk_lock-AF_PPPOX);
*** DEADLOCK ***
May be due to missing lock nesting notation
1 lock held by repro/8607:
#0: ffff8880213c8130 (sk_lock-AF_PPPOX){+.+.}-{0:0}, at: pppol2tp_connect+0xa82/0x1a30
stack backtrace: CPU: 0 PID: 8607 Comm: repro Not tainted 6.2.0-rc5-00205-gc96618275234 #56 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x100/0x178 __lock_acquire.cold+0x119/0x3b9 ? lockdep_hardirqs_on_prepare+0x410/0x410 lock_acquire+0x1e0/0x610 ? l2tp_tunnel_register+0x2b7/0x11c0 ? lock_downgrade+0x710/0x710 ? __fget_files+0x283/0x3e0 lock_sock_nested+0x3a/0xf0 ? l2tp_tunnel_register+0x2b7/0x11c0 l2tp_tunnel_register+0x2b7/0x11c0 ? sprintf+0xc4/0x100 ? l2tp_tunnel_del_work+0x6b0/0x6b0 ? debug_object_deactivate+0x320/0x320 ? lockdep_init_map_type+0x16d/0x7a0 ? lockdep_init_map_type+0x16d/0x7a0 ? l2tp_tunnel_create+0x2bf/0x4b0 ? l2tp_tunnel_create+0x3c6/0x4b0 pppol2tp_connect+0x14e1/0x1a30 ? pppol2tp_put_sk+0xd0/0xd0 ? aa_sk_perm+0x2b7/0xa80 ? aa_af_perm+0x260/0x260 ? bpf_lsm_socket_connect+0x9/0x10 ? pppol2tp_put_sk+0xd0/0xd0 __sys_connect_file+0x14f/0x190 __sys_connect+0x133/0x160 ? __sys_connect_file+0x190/0x190 ? lockdep_hardirqs_on+0x7d/0x100 ? ktime_get_coarse_real_ts64+0x1b7/0x200 ? ktime_get_coarse_real_ts64+0x147/0x200 ? __audit_syscall_entry+0x396/0x500 __x64_sys_connect+0x72/0xb0 do_syscall_64+0x38/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd
This patch fixes the issue by getting/creating the tunnel before locking the pppol2tp socket.
--- net/l2tp/l2tp_ppp.c | 125 ++++++++++++++++++++++++-------------------- 1 file changed, 67 insertions(+), 58 deletions(-)
net/l2tp/l2tp_ppp.c +67 -58
@@ -651,54 +651,22 @@ static int pppol2tp_tunnel_mtu(const struct l2tp_tunnel *tunnel)return mtu -PPPOL2TP_HEADER_OVERHEAD ; } -/* connect() handler. Attach a PPPoX socket to a tunnel UDP socket -*/ -static int pppol2tp_connect (struct socket *sock,struct sockaddr *uservaddr, -int sockaddr_len,int flags) +static struct l2tp_tunnel *pppol2tp_tunnel_get (struct net *net, +const struct l2tp_connect_info *info, +bool *new_tunnel) { -struct sock *sk = sock->sk; -struct pppox_sock *po =pppox_sk (sk); -struct l2tp_session *session =NULL ; -struct l2tp_connect_info info;struct l2tp_tunnel *tunnel; -struct pppol2tp_session *ps; -struct l2tp_session_cfg cfg = {0 , }; -bool drop_refcnt = false; -bool drop_tunnel = false; -bool new_session = false; -bool new_tunnel = false;int error; - error =pppol2tp_sockaddr_get_info (uservaddr, sockaddr_len, &info); -if (error <0 ) -return error; + *new_tunnel = false; -lock_sock (sk); - -/* Check for already bound sockets */ - error = -EBUSY ; -if (sk->sk_state &PPPOX_CONNECTED ) - goto end; - -/* We don't supporting rebinding anyway */ - error = -EALREADY ; -if (sk->sk_user_data) - goto end;/* socket is already attached */ - -/* Don't bind if tunnel_id is 0 */ - error = -EINVAL ; -if (!info.tunnel_id) - goto end; - - tunnel =l2tp_tunnel_get (sock_net (sk), info.tunnel_id); -if (tunnel) - drop_tunnel = true; + tunnel =l2tp_tunnel_get (net, info->tunnel_id);/* Special case: create tunnel context if session_id and * peer_session_id is 0. Otherwise look up tunnel using supplied * tunnel id. */ -if (!info.session_id && !info.peer_session_id) { +if (!info->session_id && !info->peer_session_id) {if (!tunnel) {struct l2tp_tunnel_cfg tcfg = { .encap = L2TP_ENCAPTYPE_UDP,
@@ -707,40 +675,82 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,/* Prevent l2tp_tunnel_register() from trying to set up * a kernel socket. */ -if (info.fd <0 ) { - error = -EBADF ; - goto end; - } +if (info->fd <0 ) +return ERR_PTR (-EBADF ); - error =l2tp_tunnel_create (info.fd, - info.version, - info.tunnel_id, - info.peer_tunnel_id, &tcfg, + error =l2tp_tunnel_create (info->fd, + info->version, + info->tunnel_id, + info->peer_tunnel_id, &tcfg, &tunnel);if (error <0 ) - goto end; +return ERR_PTR (error);l2tp_tunnel_inc_refcount (tunnel); - error =l2tp_tunnel_register (tunnel,sock_net (sk), - &tcfg); + error =l2tp_tunnel_register (tunnel, net, &tcfg);if (error <0 ) {kfree (tunnel); - goto end; +return ERR_PTR (error); } - drop_tunnel = true; - new_tunnel = true; + + *new_tunnel = true; } }else {/* Error if we can't find the tunnel */ - error = -ENOENT ;if (!tunnel) - goto end; +return ERR_PTR (-ENOENT );/* Error if socket is not prepped */ -if (!tunnel->sock) - goto end; +if (!tunnel->sock) { +l2tp_tunnel_dec_refcount (tunnel); +return ERR_PTR (-ENOENT ); + } } +return tunnel; +} + +/* connect() handler. Attach a PPPoX socket to a tunnel UDP socket +*/ +static int pppol2tp_connect (struct socket *sock,struct sockaddr *uservaddr, +int sockaddr_len,int flags) +{ +struct sock *sk = sock->sk; +struct pppox_sock *po =pppox_sk (sk); +struct l2tp_session *session =NULL ; +struct l2tp_connect_info info; +struct l2tp_tunnel *tunnel; +struct pppol2tp_session *ps; +struct l2tp_session_cfg cfg = {0 , }; +bool drop_refcnt = false; +bool new_session = false; +bool new_tunnel = false; +int error; + + error =pppol2tp_sockaddr_get_info (uservaddr, sockaddr_len, &info); +if (error <0 ) +return error; + +/* Don't bind if tunnel_id is 0 */ +if (!info.tunnel_id) +return -EINVAL ; + + tunnel =pppol2tp_tunnel_get (sock_net (sk), &info, &new_tunnel); +if (IS_ERR (tunnel)) +return PTR_ERR (tunnel); + +lock_sock (sk); + +/* Check for already bound sockets */ + error = -EBUSY ; +if (sk->sk_state &PPPOX_CONNECTED ) + goto end; + +/* We don't supporting rebinding anyway */ + error = -EALREADY ; +if (sk->sk_user_data) + goto end;/* socket is already attached */ +if (tunnel->peer_tunnel_id ==0 ) tunnel->peer_tunnel_id = info.peer_tunnel_id;
@@ -841,8 +851,7 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, }if (drop_refcnt)l2tp_session_dec_refcount (session); -if (drop_tunnel) -l2tp_tunnel_dec_refcount (tunnel); +l2tp_tunnel_dec_refcount (tunnel);release_sock (sk);return error;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 145/529 net: bcmgenet: fix MoCA LED control
In reply to Greg Kroah-HartmanFrom: Doug Berger <[email protected]>
[ Upstream commit a7515af9fb8f0890fe540b108def4a86b9e8330a ]
When the bcmgenet_mii_config() code was refactored it was missed that the LED control for the MoCA interface got overwritten by the port_ctrl value. Its previous programming is restored here.
--- drivers/net/ethernet/broadcom/genet/bcmmii.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-)
drivers/net/ethernet/broadcom/genet/bcmmii.c +2 -9
@@ -165,15 +165,6 @@ void bcmgenet_phy_power_set(struct net_device *dev, bool enable)static void bcmgenet_moca_phy_setup (struct bcmgenet_priv *priv) { -u32 reg; - -if (!GENET_IS_V5 (priv)) { -/* Speed settings are set in bcmgenet_mii_setup() */ - reg =bcmgenet_sys_readl (priv,SYS_PORT_CTRL ); - reg |=LED_ACT_SOURCE_MAC ; -bcmgenet_sys_writel (priv, reg,SYS_PORT_CTRL ); - } -if (priv->hw_params->flags &GENET_HAS_MOCA_LINK_DET )fixed_phy_set_link_update (priv->dev->phydev, bcmgenet_fixed_phy_link_update);
@@ -206,6 +197,8 @@ int bcmgenet_mii_config(struct net_device *dev, bool init)if (!phy_name) { phy_name ="MoCA" ; +if (!GENET_IS_V5 (priv)) + port_ctrl |=LED_ACT_SOURCE_MAC ;bcmgenet_moca_phy_setup (priv); }break ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 146/529 selftest: fib_tests: Always cleanup before exit
In reply to Greg Kroah-HartmanFrom: Roxana Nicolescu <[email protected]>
[ Upstream commit b60417a9f2b890a8094477b2204d4f73c535725e ]
Usage of set -e before executing a command causes immediate exit on failure, without cleanup up the resources allocated at setup. This can affect the next tests that use the same resources, leading to a chain of failures.
A simple fix is to always call cleanup function when the script exists. This approach is already used by other existing tests.
--- tools/testing/selftests/net/fib_tests.sh | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/net/fib_tests.sh +2 -0
@@ -1773,6 +1773,8 @@ EOF ################################################################################ # main +trap cleanup EXIT + while getopts :t:pPhv o do case $o in
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 147/529 sefltests: netdevsim: wait for devlink instance after netns removal
In reply to Greg Kroah-HartmanFrom: Jiri Pirko <[email protected]>
[ Upstream commit f922c7b1c1c45740d329bf248936fdb78c0cff6e ]
When devlink instance is put into network namespace and that network namespace gets deleted, devlink instance is moved back into init_ns. This is done as a part of cleanup_net() routine. Since cleanup_net() is called asynchronously from workqueue, there is no guarantee that the devlink instance move is done after "ip netns del" returns.
So fix this race by making sure that the devlink instance is present before any other operation.
--- .../selftests/drivers/net/netdevsim/devlink.sh | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
tools/testing/selftests/drivers/net/netdevsim/devlink.sh +18 -0
@@ -16,6 +16,18 @@ SYSFS_NET_DIR=/sys/bus/netdevsim/devices/$DEV_NAME/net/ DEBUGFS_DIR=/sys/kernel/debug/netdevsim/$DEV_NAME/ DL_HANDLE=netdevsim/$DEV_NAME +wait_for_devlink() +{ + "$@" | grep -q $DL_HANDLE +} + +devlink_wait() +{ + local timeout=$1 + + busywait "$timeout" wait_for_devlink devlink dev +} + fw_flash_test() { RET=0
@@ -255,6 +267,9 @@ netns_reload_test() ip netns del testns2 ip netns del testns1 + # Wait until netns async cleanup is done. + devlink_wait 2000 + log_test "netns reload test" }
@@ -347,6 +362,9 @@ resource_test() ip netns del testns2 ip netns del testns1 + # Wait until netns async cleanup is done. + devlink_wait 2000 + log_test "resource test" }
Signature · 1 line
2.39.2