6.2.8-rc1 review
Greg Kroah-Hartman
maintainercover 6.2.8-rc1 review
This is the start of the stable review cycle for the 6.2.8 release. There are 211 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 22 Mar 2023 14:54:32 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.2.8-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.2.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.2.8-rc1
Dionna Glaze <[email protected]>
virt/coco/sev-guest: Add throttling awareness
Borislav Petkov (AMD) <[email protected]>
virt/coco/sev-guest: Convert the sw_exit_info_2 checking to a switch-case
Borislav Petkov (AMD) <[email protected]>
virt/coco/sev-guest: Do some code style cleanups
Borislav Petkov (AMD) <[email protected]>
virt/coco/sev-guest: Carve out the request issuing logic into a helper
Borislav Petkov (AMD) <[email protected]>
virt/coco/sev-guest: Remove the disable_vmpck label in handle_guest_request()
Borislav Petkov (AMD) <[email protected]>
virt/coco/sev-guest: Simplify extended guest request handling
Borislav Petkov (AMD) <[email protected]>
virt/coco/sev-guest: Check SEV_SNP attribute at probe time
Christophe Leroy <[email protected]>
powerpc: Pass correct CPU reference to assembler
Shawn Wang <[email protected]>
x86/resctrl: Clear staged_config[] before and after it is used
Nikita Zhandarovich <[email protected]>
x86/mm: Fix use of uninitialized buffer in sme_enable()
Yazen Ghannam <[email protected]>
x86/mce: Make sure logged MCEs are processed after sysfs update
Krzysztof Kozlowski <[email protected]>
ASoC: qcom: q6prm: fix incorrect clk_root passed to ADSP
Pierre-Louis Bossart <[email protected]>
ASoC: Intel: soc-acpi: fix copy-paste issue in topology names
Shawn Guo <[email protected]>
cpuidle: psci: Iterate backwards over list in psci_pd_remove()
Pavel Begunkov <[email protected]>
io_uring/msg_ring: let target know allocated index
Dylan Jhong <[email protected]>
RISC-V: mm: Support huge page in vmalloc_fault()
Takashi Iwai <[email protected]>
fbdev: Fix incorrect page mapping clearance at fb_deferred_io_release()
Radu Pirea (OSS) <[email protected]>
net: phy: nxp-c45-tja11xx: fix MII_BASIC_CONFIG_REV bit
Sudeep Holla <[email protected]>
ACPI: PPTT: Fix to avoid sleep in the atomic context when PPTT is absent
Tero Kristo <[email protected]>
trace/hwlat: Do not start per-cpu thread if it is already running
Tero Kristo <[email protected]>
trace/hwlat: Do not wipe the contents of per-cpu thread data
Helge Deller <[email protected]>
fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks
Francesco Dolcini <[email protected]>
mmc: sdhci_am654: lower power-on failed message severity
Pali Rohár <[email protected]>
powerpc/boot: Don't always pass -mcpu=powerpc when building 32-bit uImage
Christophe Leroy <[email protected]>
powerpc/64: Set default CPU in Kconfig
James Houghton <[email protected]>
mm: teach mincore_hugetlb about pte markers
David Hildenbrand <[email protected]>
mm/userfaultfd: propagate uffd-wp bit when PTE-mapping the huge zeropage
Cindy Lu <[email protected]>
vp_vdpa: fix the crash in hot unplug with vp_vdpa
Dave Ertman <[email protected]>
ice: avoid bonding causing auxiliary plug/unplug under RTNL lock
Elmer Miroslav Mosher Golovin <[email protected]>
nvme-pci: add NVME_QUIRK_BOGUS_NID for Netac NV3000
Jan Kara via Ocfs2-devel <[email protected]>
ocfs2: fix data corruption after failed write
Chen Zhongjin <[email protected]>
ftrace: Fix invalid address access in lookup_rec() when index is 0
Paolo Abeni <[email protected]>
mptcp: fix lockdep false positive in mptcp_pm_nl_create_listen_socket()
Matthieu Baerts <[email protected]>
mptcp: avoid setting TCP_CLOSE state twice
Geliang Tang <[email protected]>
mptcp: add ro_after_init for tcp{,v6}_prot_override
Paolo Abeni <[email protected]>
mptcp: fix UaF in listener shutdown
Paolo Abeni <[email protected]>
mptcp: use the workqueue to destroy unaccepted sockets
Paolo Abeni <[email protected]>
mptcp: refactor passive socket initialization
Paolo Abeni <[email protected]>
mptcp: fix possible deadlock in subflow_error_report
Benjamin Cheng <[email protected]>
drm/amd/display: Write to correct dirty_rect
Ayush Gupta <[email protected]>
drm/amd/display: disconnect MPCC only on OTG change
Wesley Chalmers <[email protected]>
drm/amd/display: Do not set DRR on pipe Commit
Tim Huang <[email protected]>
drm/amd/pm: bump SMU 13.0.4 driver_if header version
Guilherme G. Piccoli <[email protected]>
drm/amdgpu/vcn: Disable indirect SRAM on Vangogh broken BIOSes
Błażej Szczygieł <[email protected]>
drm/amd/pm: Fix sienna cichlid incorrect OD volage after resume
Felix Kuehling <[email protected]>
drm/amdgpu: Don't resume IOMMU after incomplete init
Ankit Nautiyal <[email protected]>
drm/i915/dg2: Add HDMI pixel clock frequencies 267.30 and 319.89 MHz
Janusz Krzysztofik <[email protected]>
drm/i915/active: Fix misuse of non-idle barriers as fence trackers
Johan Hovold <[email protected]>
drm/sun4i: fix missing component unbind on bind errors
Dmitry Osipenko <[email protected]>
drm/shmem-helper: Remove another errant put in error path
Johan Hovold <[email protected]>
drm/edid: fix info leak when failing to get panel id
Guo Ren <[email protected]>
riscv: asid: Fixup stale TLB entry cause application crash
Sergey Matyukevich <[email protected]>
Revert "riscv: mm: notify remote harts about mmu cache updates"
Jeremy Szu <[email protected]>
ALSA: hda/realtek: fix speaker, mute/micmute LEDs not work on a HP platform
Hamidreza H. Fard <[email protected]>
ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro
Bard Liao <[email protected]>
ALSA: hda: intel-dsp-config: add MTL PCI id
Paolo Bonzini <[email protected]>
KVM: nVMX: add missing consistency checks for CR0 and CR4
Suravee Suthikulpanit <[email protected]>
KVM: SVM: Modify AVIC GATag to support max number of 512 vCPUs
Sean Christopherson <[email protected]>
KVM: SVM: Fix a benign off-by-one bug in AVIC physical table mask
Paulo Alcantara <[email protected]>
cifs: use DFS root session instead of tcon ses
Paulo Alcantara <[email protected]>
cifs: return DFS root session id in DebugData
Paulo Alcantara <[email protected]>
cifs: fix use-after-free bug in refresh_cache_worker()
Paulo Alcantara <[email protected]>
cifs: set DFS root session in cifs_get_smb_ses()
Volker Lendecke <[email protected]>
cifs: Fix smb2_set_path_size()
Steven Rostedt (Google) <[email protected]>
tracing: Make tracepoint lockdep check actually test something
Steven Rostedt (Google) <[email protected]>
tracing: Check field value in hist_field_name()
Steven Rostedt (Google) <[email protected]>
tracing: Do not let histogram values have some modifiers
Sung-hun Kim <[email protected]>
tracing: Make splice_read available again
Shyam Prasad N <[email protected]>
cifs: generate signkey for the channel that's reconnecting
NeilBrown <[email protected]>
md: select BLOCK_LEGACY_AUTOLOAD
Johan Hovold <[email protected]>
interconnect: exynos: fix registration race
Johan Hovold <[email protected]>
interconnect: exynos: fix node leak in probe PM QoS error path
Johan Hovold <[email protected]>
interconnect: qcom: msm8974: fix registration race
Johan Hovold <[email protected]>
interconnect: qcom: rpmh: fix registration race
Johan Hovold <[email protected]>
interconnect: qcom: rpmh: fix probe child-node error handling
Johan Hovold <[email protected]>
interconnect: qcom: rpm: fix registration race
Johan Hovold <[email protected]>
interconnect: qcom: rpm: fix probe child-node error handling
Johan Hovold <[email protected]>
interconnect: qcom: osm-l3: fix registration race
Johan Hovold <[email protected]>
interconnect: fix mem leak when freeing nodes
Johan Hovold <[email protected]>
interconnect: imx: fix registration race
Johan Hovold <[email protected]>
interconnect: fix provider registration API
Johan Hovold <[email protected]>
interconnect: fix icc_provider_del() error handling
Sven Schnelle <[email protected]>
s390/ipl: add missing intersection check to ipl_report handling
Thomas Hellström <[email protected]>
drm/ttm: Fix a NULL pointer dereference
Johan Hovold <[email protected]>
memory: tegra30-emc: fix interconnect registration race
Johan Hovold <[email protected]>
memory: tegra124-emc: fix interconnect registration race
Johan Hovold <[email protected]>
memory: tegra20-emc: fix interconnect registration race
Johan Hovold <[email protected]>
memory: tegra: fix interconnect registration race
Roman Gushchin <[email protected]>
firmware: xilinx: don't make a sleepable memory allocation from an atomic context
Randy Dunlap <[email protected]>
serial: 8250: ASPEED_VUART: select REGMAP instead of depending on it
Johan Hovold <[email protected]>
serial: 8250_fsl: fix handle_irq locking
Biju Das <[email protected]>
serial: 8250_em: Fix UART port type
Sherry Sun <[email protected]>
tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted
Alexander Sverdlin <[email protected]>
tty: serial: fsl_lpuart: fix race on RX DMA shutdown
Tom Rix <[email protected]>
Revert "tty: serial: fsl_lpuart: adjust SERIAL_FSL_LPUART_CONSOLE config dependency"
Theodore Ts'o <[email protected]>
ext4: fix possible double unlock when moving a directory
Alex Hung <[email protected]>
drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes
Horatio Zhang <[email protected]>
drm/amdgpu: fix ttm_bo calltrace warning in psp_hw_fini
Michael Karcher <[email protected]>
sh: intc: Avoid spurious sizeof-pointer-div warning
Tiezhu Yang <[email protected]>
LoongArch: Only call get_timer_irq() once in constant_clockevent_init()
Eric Van Hensbergen <[email protected]>
net/9p: fix bug in client create for .L
Qu Huang <[email protected]>
drm/amdkfd: Fix an illegal memory access
Baokun Li <[email protected]>
ext4: fix task hung in ext4_xattr_delete_inode
Baokun Li <[email protected]>
ext4: update s_journal_inum if it changes after journal replay
Linus Torvalds <[email protected]>
media: m5mols: fix off-by-one loop termination error
Lars-Peter Clausen <[email protected]>
hwmon: (ltc2992) Set can_sleep flag for GPIO chip
Lars-Peter Clausen <[email protected]>
hwmon: (adm1266) Set can_sleep flag for GPIO chip
Jurica Vukadin <[email protected]>
kconfig: Update config changed flag before calling callback
Krzysztof Kozlowski <[email protected]>
hwmon: tmp512: drop of_match_ptr for ID table
Lars-Peter Clausen <[email protected]>
hwmon: (ucd90320) Add minimum delay between bus accesses
Marcus Folkesson <[email protected]>
hwmon: (ina3221) return prober error code
Zheng Wang <[email protected]>
hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
Tony O'Brien <[email protected]>
hwmon: (adt7475) Fix masking of hysteresis registers
Tony O'Brien <[email protected]>
hwmon: (adt7475) Display smoothing attributes in correct order
Nikolay Aleksandrov <[email protected]>
bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails
Nikolay Aleksandrov <[email protected]>
bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change
Yoshihiro Shimoda <[email protected]>
net: renesas: rswitch: Fix the output value of quote from rswitch_rx()
Yoshihiro Shimoda <[email protected]>
net: renesas: rswitch: Rename rings in struct rswitch_gwca_queue
Liang He <[email protected]>
ethernet: sun: add check for the mdesc_grab()
Marek Vasut <[email protected]>
net: dsa: microchip: fix RGMII delay configuration on KSZ8765/KSZ8794/KSZ8795
Daniil Tatianin <[email protected]>
qed/qed_mng_tlv: correctly zero out ->min instead of ->hour
Po-Hsu Lin <[email protected]>
selftests: net: devlink_port_split.py: skip test if no suitable device available
Thomas Bogendoerfer <[email protected]>
i825xx: sni_82596: use eth_hw_addr_set()
Alexandra Winter <[email protected]>
net/iucv: Fix size of interrupt data
Toke Høiland-Jørgensen <[email protected]>
net: atlantic: Fix crash when XDP is enabled but no program is loaded
Szymon Heidrich <[email protected]>
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
Ido Schimmel <[email protected]>
ipv4: Fix incorrect table ID in IOCTL path
Wolfram Sang <[email protected]>
sh_eth: avoid PHY being resumed when interface is not up
Wolfram Sang <[email protected]>
ravb: avoid PHY being resumed when interface is not up
Vladimir Oltean <[email protected]>
net: dsa: mv88e6xxx: fix max_mtu of 1492 on 6165, 6191, 6220, 6250, 6290
Vladimir Oltean <[email protected]>
net: dsa: don't error out when drivers return ETH_DATA_LEN in .port_max_mtu()
Maciej Fijalkowski <[email protected]>
ice: xsk: disable txq irq before flushing hw
Shawn Bohrer <[email protected]>
veth: Fix use after free in XDP_REDIRECT
Shay Drory <[email protected]>
net/mlx5: Set BREAK_FW_WAIT flag first when removing driver
Paul Blakey <[email protected]>
net/mlx5e: Fix cleanup null-ptr deref on encap lock
Maor Dickman <[email protected]>
net/mlx5: E-switch, Fix missing set of split_count when forward to ovs internal port
Maor Dickman <[email protected]>
net/mlx5: E-switch, Fix wrong usage of source port rewrite in split rules
Daniel Jurgens <[email protected]>
net/mlx5: Disable eswitch before waiting for VF pages
Parav Pandit <[email protected]>
net/mlx5: Fix setting ec_function bit in MANAGE_PAGES
Parav Pandit <[email protected]>
net/mlx5e: Don't cache tunnel offloads capability
Emeel Hakim <[email protected]>
net/mlx5e: Fix macsec ASO context alignment
Yu Kuai <[email protected]>
block: count 'ios' and 'sectors' when io is done for bio-based device
Liang He <[email protected]>
block: sunvdc: add check for mdesc_grab() returning NULL
Damien Le Moal <[email protected]>
nvmet: avoid potential UAF in nvmet_req_complete()
Ming Lei <[email protected]>
nvme: fix handling single range discard request
Damien Le Moal <[email protected]>
block: null_blk: Fix handling of fake timeout request
Russell Currey <[email protected]>
powerpc/mm: Fix false detection of read faults
Liu Ying <[email protected]>
drm/bridge: Fix returned array size name for atomic_get_input_bus_fmts kdoc
Daniel Golle <[email protected]>
net: ethernet: mtk_eth_soc: only write values if needed
Daniel Golle <[email protected]>
net: ethernet: mtk_eth_soc: reset PCS state
Szymon Heidrich <[email protected]>
net: usb: smsc75xx: Limit packet length to skb->len
Wenjia Zhang <[email protected]>
net/smc: fix deadlock triggered by cancel_delayed_work_syn()
Ido Schimmel <[email protected]>
mlxsw: spectrum: Fix incorrect parsing depth after reload
Zheng Wang <[email protected]>
nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
Kuniyuki Iwashima <[email protected]>
tcp: Fix bind() conflict check for dual-stack wildcard address.
Heiner Kallweit <[email protected]>
net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
Eric Dumazet <[email protected]>
net: tunnels: annotate lockless accesses to dev->needed_headroom
Chris Leech <[email protected]>
blk-mq: fix "bad unlock balance detected" on q->srcu in __blk_mq_run_dispatch_ops
Bart Van Assche <[email protected]>
loop: Fix use-after-free issues
Jan Kara <[email protected]>
block: do not reverse request order when flushing plug list
Arınç ÜNAL <[email protected]>
net: dsa: mt7530: set PLL frequency and trgmii only when trgmii is used
Arınç ÜNAL <[email protected]>
net: dsa: mt7530: remove now incorrect comment regarding port 5
Daniil Tatianin <[email protected]>
qed/qed_dev: guard against a possible division by zero
D. Wythe <[email protected]>
net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()
Vadim Fedorenko <[email protected]>
bnxt_en: reset PHC frequency in free-running mode
Andrea Righi <[email protected]>
drm/i915/sseu: fix max_subslices array-index-out-of-bounds access
Jouni Högander <[email protected]>
drm/i915/psr: Use calculated io and fast wake lines
Niklas Schnelle <[email protected]>
PCI: s390: Fix use-after-free of PCI resources with per-function hotplug
Eugenio Pérez <[email protected]>
vdpa_sim: set last_used_idx as last_avail_idx in vdpasim_queue_ready
Eugenio Pérez <[email protected]>
vdpa_sim: not reset state in vdpasim_queue_ready
Gautam Dawar <[email protected]>
vhost-vdpa: free iommu domain after last use during cleanup
Ivan Vecera <[email protected]>
i40e: Fix kernel crash during reboot when adapter is in recovery mode
Jianguo Wu <[email protected]>
ipvlan: Make skb->skb_iif track skb->dev for l3s mode
Fedor Pchelkin <[email protected]>
nfc: pn533: initialize struct pn533_out_arg properly
Guillaume Tucker <[email protected]>
selftests: fix LLVM build for i386 and x86_64
Johannes Berg <[email protected]>
wifi: cfg80211: fix MLO connection ownership
Johannes Berg <[email protected]>
wifi: nl80211: fix NULL-ptr deref in offchan check
Si-Wei Liu <[email protected]>
vdpa/mlx5: should not activate virtq object when suspended
Breno Leitao <[email protected]>
tcp: tcp_make_synack() can be called from process context
Arnd Bergmann <[email protected]>
ftrace,kcfi: Define ftrace_stub_graph conditionally
Bart Van Assche <[email protected]>
scsi: core: Fix a procfs host directory removal regression
Lee Duncan <[email protected]>
scsi: core: Add BLIST_NO_VPD_SIZE for some VDASD
Jeremy Sowden <[email protected]>
netfilter: nft_redir: correct value of inet type .maxattrs
Jeremy Sowden <[email protected]>
netfilter: nft_redir: correct length for loading protocol registers
Jeremy Sowden <[email protected]>
netfilter: nft_masq: correct length for loading protocol registers
Jeremy Sowden <[email protected]>
netfilter: nft_nat: correct length for loading protocol registers
Bjorn Helgaas <[email protected]>
ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU()
Tomas Henzl <[email protected]>
scsi: mpi3mr: Fix expander node leak in mpi3mr_remove()
Ranjan Kumar <[email protected]>
scsi: mpi3mr: ioctl timeout when disabling/enabling interrupt
Tomas Henzl <[email protected]>
scsi: mpi3mr: Fix memory leaks in mpi3mr_init_ioc()
Ranjan Kumar <[email protected]>
scsi: mpi3mr: Return proper values for failures in firmware init path
Tomas Henzl <[email protected]>
scsi: mpi3mr: Fix sas_hba.phy memory leak in mpi3mr_remove()
Tomas Henzl <[email protected]>
scsi: mpi3mr: Fix mpi3mr_hba_port memory leak in mpi3mr_remove()
Tomas Henzl <[email protected]>
scsi: mpi3mr: Fix config page DMA memory leak
Tomas Henzl <[email protected]>
scsi: mpi3mr: Fix throttle_groups memory leak
Wenchao Hao <[email protected]>
scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
Glenn Washburn <[email protected]>
docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate
Jaska Uimonen <[email protected]>
ASoC: SOF: ipc4-topology: set dmic dai index from copier
Ranjani Sridharan <[email protected]>
ASOC: SOF: Intel: pci-tgl: Fix device description
Ranjani Sridharan <[email protected]>
ASoC: SOF: Intel: SKL: Fix device description
Ranjani Sridharan <[email protected]>
ASoC: SOF: Intel: HDA: Fix device description
Ranjani Sridharan <[email protected]>
ASoC: SOF: Intel: MTL: Fix the device description
Guillaume Tucker <[email protected]>
selftests: amd-pstate: fix TEST_FILES
Randy Dunlap <[email protected]>
clk: HI655X: select REGMAP instead of depending on it
Christian Hewitt <[email protected]>
drm/meson: fix 1px pink line on GXM when scaling video overlay
Zhang Xiaoxu <[email protected]>
cifs: Move the in_send statistic to __smb_send_rqst()
Dan Carpenter <[email protected]>
fbdev: chipsfb: Fix error codes in chipsfb_pci_init()
Dmitry Osipenko <[email protected]>
drm/panfrost: Don't sync rpm suspension after mmu flushing
Dmitry Osipenko <[email protected]>
drm/msm/gem: Prevent blocking within shrinker loop
Oleksandr Tyshchenko <[email protected]>
drm/virtio: Pass correct device to dma_sync_sgtable_for_device()
Herbert Xu <[email protected]>
xfrm: Allow transport-mode states with AF_UNSPEC selector
-------------
Diffstat:
Documentation/filesystems/vfs.rst | 2 +- Makefile | 4 +- arch/loongarch/kernel/time.c | 11 +- arch/powerpc/Makefile | 26 +--- arch/powerpc/boot/Makefile | 14 ++- arch/powerpc/mm/fault.c | 11 +- arch/powerpc/platforms/Kconfig.cputype | 12 +- arch/riscv/include/asm/mmu.h | 2 - arch/riscv/include/asm/tlbflush.h | 18 --- arch/riscv/mm/context.c | 40 +++--- arch/riscv/mm/fault.c | 5 + arch/riscv/mm/tlbflush.c | 28 +++-- arch/s390/boot/ipl_report.c | 8 ++ arch/s390/pci/pci.c | 16 ++- arch/s390/pci/pci_bus.c | 12 +- arch/s390/pci/pci_bus.h | 3 +- arch/x86/include/asm/sev-common.h | 3 +- arch/x86/include/asm/svm.h | 12 +- arch/x86/kernel/cpu/mce/core.c | 1 + arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 7 +- arch/x86/kernel/cpu/resctrl/internal.h | 1 + arch/x86/kernel/cpu/resctrl/rdtgroup.c | 25 +++- arch/x86/kernel/ftrace_64.S | 2 + arch/x86/kernel/sev.c | 26 ++-- arch/x86/kvm/svm/avic.c | 26 ++-- arch/x86/kvm/vmx/nested.c | 10 +- arch/x86/mm/mem_encrypt_identity.c | 3 +- block/blk-core.c | 16 +-- block/blk-mq.c | 5 +- block/blk-mq.h | 5 +- drivers/acpi/pptt.c | 5 +- drivers/block/loop.c | 25 ++-- drivers/block/null_blk/main.c | 6 +- drivers/block/sunvdc.c | 2 + drivers/block/zram/zram_drv.c | 4 +- drivers/clk/Kconfig | 2 +- drivers/cpuidle/cpuidle-psci-domain.c | 3 +- drivers/firmware/xilinx/zynqmp.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 19 +++ drivers/gpu/drm/amd/amdkfd/kfd_device.c | 11 +- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 9 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 +- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 3 - .../gpu/drm/amd/display/dc/dcn32/dcn32_resource.c | 6 +- .../amd/display/dc/dml/dcn30/display_mode_vba_30.c | 5 +- .../pm/swsmu/inc/pmfw_if/smu13_driver_if_v13_0_4.h | 4 +- drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h | 2 +- .../drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 43 +++++-- drivers/gpu/drm/drm_edid.c | 2 +- drivers/gpu/drm/drm_gem.c | 9 +- drivers/gpu/drm/drm_gem_shmem_helper.c | 9 +- drivers/gpu/drm/i915/display/intel_display_types.h | 2 + drivers/gpu/drm/i915/display/intel_psr.c | 78 +++++++++--- drivers/gpu/drm/i915/display/intel_snps_phy.c | 62 +++++++++ drivers/gpu/drm/i915/gt/intel_sseu.h | 2 +- drivers/gpu/drm/i915/i915_active.c | 25 ++-- drivers/gpu/drm/meson/meson_vpp.c | 2 + drivers/gpu/drm/msm/msm_gem_shrinker.c | 11 +- drivers/gpu/drm/panfrost/panfrost_mmu.c | 2 +- drivers/gpu/drm/sun4i/sun4i_drv.c | 6 +- drivers/gpu/drm/ttm/ttm_device.c | 2 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 4 +- drivers/hwmon/adt7475.c | 8 +- drivers/hwmon/ina3221.c | 2 +- drivers/hwmon/ltc2992.c | 1 + drivers/hwmon/pmbus/adm1266.c | 1 + drivers/hwmon/pmbus/ucd9000.c | 75 +++++++++++ drivers/hwmon/tmp513.c | 2 +- drivers/hwmon/xgene-hwmon.c | 1 + drivers/interconnect/core.c | 68 ++++++---- drivers/interconnect/imx/imx.c | 20 +-- drivers/interconnect/qcom/icc-rpm.c | 29 +++-- drivers/interconnect/qcom/icc-rpmh.c | 30 +++-- drivers/interconnect/qcom/msm8974.c | 20 ++- drivers/interconnect/qcom/osm-l3.c | 14 +-- drivers/interconnect/samsung/exynos.c | 26 ++-- drivers/md/Kconfig | 4 + drivers/md/dm.c | 6 +- drivers/media/i2c/m5mols/m5mols_core.c | 2 +- drivers/memory/tegra/mc.c | 16 ++- drivers/memory/tegra/tegra124-emc.c | 12 +- drivers/memory/tegra/tegra20-emc.c | 12 +- drivers/memory/tegra/tegra30-emc.c | 12 +- drivers/mmc/host/sdhci_am654.c | 2 +- drivers/net/bonding/bond_main.c | 23 ++-- drivers/net/dsa/microchip/ksz_common.c | 2 +- drivers/net/dsa/mt7530.c | 64 +++++----- drivers/net/dsa/mv88e6xxx/chip.c | 16 ++- drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 28 +++-- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 +- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 2 + drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 56 +++++---- drivers/net/ethernet/i825xx/sni_82596.c | 14 ++- drivers/net/ethernet/intel/i40e/i40e_main.c | 1 + drivers/net/ethernet/intel/ice/ice.h | 14 +-- drivers/net/ethernet/intel/ice/ice_main.c | 19 ++- drivers/net/ethernet/intel/ice/ice_xsk.c | 5 +- drivers/net/ethernet/mediatek/mtk_eth_soc.h | 4 + drivers/net/ethernet/mediatek/mtk_sgmii.c | 28 +++-- drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 - .../ethernet/mellanox/mlx5/core/en_accel/macsec.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 1 - drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 11 ++ .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 10 +- .../net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c | 1 - drivers/net/ethernet/mellanox/mlx5/core/main.c | 4 +- .../net/ethernet/mellanox/mlx5/core/pagealloc.c | 22 +++- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 2 + .../net/ethernet/mellanox/mlxsw/spectrum_router.c | 14 +++ drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 + drivers/net/ethernet/qlogic/qed/qed_mng_tlv.c | 2 +- drivers/net/ethernet/renesas/ravb_main.c | 12 +- drivers/net/ethernet/renesas/rswitch.c | 74 +++++------ drivers/net/ethernet/renesas/rswitch.h | 4 +- drivers/net/ethernet/renesas/sh_eth.c | 12 +- drivers/net/ethernet/sun/ldmvsw.c | 3 + drivers/net/ethernet/sun/sunvnet.c | 3 + drivers/net/ipvlan/ipvlan_l3s.c | 1 + drivers/net/phy/nxp-c45-tja11xx.c | 2 +- drivers/net/phy/smsc.c | 5 +- drivers/net/usb/smsc75xx.c | 7 ++ drivers/net/veth.c | 6 +- drivers/nfc/pn533/usb.c | 1 + drivers/nfc/st-nci/ndlc.c | 6 +- drivers/nvme/host/core.c | 28 +++-- drivers/nvme/host/multipath.c | 8 +- drivers/nvme/host/pci.c | 2 + drivers/nvme/target/core.c | 4 +- drivers/pci/bus.c | 21 ++++ drivers/scsi/hosts.c | 3 - drivers/scsi/mpi3mr/mpi3mr.h | 5 + drivers/scsi/mpi3mr/mpi3mr_fw.c | 71 +++++++---- drivers/scsi/mpi3mr/mpi3mr_os.c | 25 ++++ drivers/scsi/mpi3mr/mpi3mr_transport.c | 5 +- drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 ++- drivers/scsi/scsi.c | 3 + drivers/scsi/scsi_devinfo.c | 3 +- drivers/scsi/scsi_scan.c | 3 + drivers/tty/serial/8250/8250_em.c | 4 +- drivers/tty/serial/8250/8250_fsl.c | 4 +- drivers/tty/serial/8250/Kconfig | 3 +- drivers/tty/serial/Kconfig | 2 +- drivers/tty/serial/fsl_lpuart.c | 23 ++-- drivers/vdpa/mlx5/core/mlx5_vdpa.h | 1 + drivers/vdpa/mlx5/net/mlx5_vnet.c | 6 +- drivers/vdpa/vdpa_sim/vdpa_sim.c | 13 ++ drivers/vdpa/virtio_pci/vp_vdpa.c | 2 +- drivers/vhost/vdpa.c | 3 +- drivers/video/fbdev/chipsfb.c | 14 ++- drivers/video/fbdev/core/fb_defio.c | 17 ++- drivers/video/fbdev/stifb.c | 27 ++++ drivers/virt/coco/sev-guest/sev-guest.c | 128 +++++++++++-------- fs/cifs/cifs_debug.c | 5 + fs/cifs/cifs_dfs_ref.c | 1 + fs/cifs/cifs_fs_sb.h | 2 - fs/cifs/cifsglob.h | 4 +- fs/cifs/connect.c | 10 +- fs/cifs/dfs.c | 67 ++++++---- fs/cifs/dfs.h | 19 ++- fs/cifs/dfs_cache.c | 140 --------------------- fs/cifs/dfs_cache.h | 2 - fs/cifs/fs_context.h | 1 + fs/cifs/misc.c | 8 ++ fs/cifs/smb2inode.c | 31 +++-- fs/cifs/smb2transport.c | 2 +- fs/cifs/transport.c | 21 ++-- fs/ext4/namei.c | 4 +- fs/ext4/super.c | 7 +- fs/ext4/xattr.c | 11 ++ fs/ocfs2/aops.c | 19 ++- include/drm/drm_bridge.h | 4 +- include/drm/drm_gem.h | 4 +- include/linux/blk-mq.h | 6 + include/linux/blkdev.h | 5 +- include/linux/fb.h | 1 + include/linux/interconnect-provider.h | 12 ++ include/linux/netdevice.h | 6 +- include/linux/pci.h | 1 + include/linux/sh_intc.h | 5 +- include/linux/tracepoint.h | 15 +-- include/scsi/scsi_device.h | 2 + include/scsi/scsi_devinfo.h | 6 +- io_uring/msg_ring.c | 4 +- kernel/trace/ftrace.c | 3 +- kernel/trace/trace.c | 2 + kernel/trace/trace_events_hist.c | 12 ++ kernel/trace/trace_hwlat.c | 7 +- mm/huge_memory.c | 6 +- mm/mincore.c | 2 +- net/9p/client.c | 2 +- net/dsa/slave.c | 9 +- net/ipv4/fib_frontend.c | 3 + net/ipv4/inet_hashtables.c | 8 +- net/ipv4/ip_tunnel.c | 12 +- net/ipv4/tcp_output.c | 2 +- net/ipv6/ip6_tunnel.c | 4 +- net/iucv/iucv.c | 2 +- net/mptcp/pm_netlink.c | 16 +++ net/mptcp/protocol.c | 64 +++++----- net/mptcp/protocol.h | 6 +- net/mptcp/subflow.c | 128 +++++++------------ net/netfilter/nft_masq.c | 2 +- net/netfilter/nft_nat.c | 2 +- net/netfilter/nft_redir.c | 4 +- net/smc/smc_cdc.c | 3 + net/smc/smc_core.c | 2 +- net/wireless/nl80211.c | 18 ++- net/xfrm/xfrm_state.c | 5 - scripts/kconfig/confdata.c | 6 +- sound/hda/intel-dsp-config.c | 9 ++ sound/pci/hda/hda_intel.c | 5 +- sound/pci/hda/patch_realtek.c | 2 + sound/soc/intel/common/soc-acpi-intel-adl-match.c | 2 +- sound/soc/qcom/qdsp6/q6prm.c | 4 +- sound/soc/sof/intel/pci-apl.c | 1 + sound/soc/sof/intel/pci-cnl.c | 2 + sound/soc/sof/intel/pci-icl.c | 1 + sound/soc/sof/intel/pci-mtl.c | 1 + sound/soc/sof/intel/pci-skl.c | 2 + sound/soc/sof/intel/pci-tgl.c | 7 ++ sound/soc/sof/ipc4-topology.h | 2 +- tools/testing/selftests/amd-pstate/Makefile | 13 +- tools/testing/selftests/lib.mk | 2 + tools/testing/selftests/net/devlink_port_split.py | 36 +++++- 226 files changed, 1784 insertions(+), 1095 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/211 xfrm: Allow transport-mode states with AF_UNSPEC selector
From: Herbert Xu <[email protected]>
[ Upstream commit c276a706ea1f51cf9723ed8484feceaf961b8f89 ]
xfrm state selectors are matched against the inner-most flow which can be of any address family. Therefore middle states in nested configurations need to carry a wildcard selector in order to work at all.
However, this is currently forbidden for transport-mode states.
Fix this by removing the unnecessary check.
--- net/xfrm/xfrm_state.c | 5 ----- 1 file changed, 5 deletions(-)
net/xfrm/xfrm_state.c +0 -5
@@ -2815,11 +2815,6 @@ int __xfrm_init_state(struct xfrm_state *x, bool init_replay, bool offload, goto error; } -if (!(inner_mode->flags &XFRM_MODE_FLAG_TUNNEL )) { -NL_SET_ERR_MSG (extack,"Only tunnel modes can accommodate an AF_UNSPEC selector" ); - goto error; - } - x->inner_mode = *inner_mode;if (x->props.family ==AF_INET )
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 2/211 drm/virtio: Pass correct device to dma_sync_sgtable_for_device()
In reply to Greg Kroah-HartmanFrom: Oleksandr Tyshchenko <[email protected]>
[ Upstream commit a54bace095d00e9222161495649688bc43de4dde ]
The "vdev->dev.parent" should be used instead of "vdev->dev" as a device for which to perform the DMA operation in both virtio_gpu_cmd_transfer_to_host_2d(3d).
Because the virtio-gpu device "vdev->dev" doesn't really have DMA OPS assigned to it, but parent (virtio-pci or virtio-mmio) device "vdev->dev.parent" has. The more, the sgtable in question the code is trying to sync here was mapped for the parent device (by using its DMA OPS) previously at:
virtio_gpu_object_shmem_init()->drm_gem_shmem_get_pages_sgt()-> dma_map_sgtable(), so should be synced here for the same parent device.
--- drivers/gpu/drm/virtio/virtgpu_vq.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/virtio/virtgpu_vq.c +2 -2
@@ -597,7 +597,7 @@ void virtio_gpu_cmd_transfer_to_host_2d(struct virtio_gpu_device *vgdev,bool use_dma_api = !virtio_has_dma_quirk (vgdev->vdev);if (virtio_gpu_is_shmem (bo) && use_dma_api) -dma_sync_sgtable_for_device (&vgdev->vdev->dev, +dma_sync_sgtable_for_device (vgdev->vdev->dev.parent, bo->base.sgt,DMA_TO_DEVICE ); cmd_p =virtio_gpu_alloc_cmd (vgdev, &vbuf,sizeof (*cmd_p));
@@ -1019,7 +1019,7 @@ void virtio_gpu_cmd_transfer_to_host_3d(struct virtio_gpu_device *vgdev,bool use_dma_api = !virtio_has_dma_quirk (vgdev->vdev);if (virtio_gpu_is_shmem (bo) && use_dma_api) -dma_sync_sgtable_for_device (&vgdev->vdev->dev, +dma_sync_sgtable_for_device (vgdev->vdev->dev.parent, bo->base.sgt,DMA_TO_DEVICE ); cmd_p =virtio_gpu_alloc_cmd (vgdev, &vbuf,sizeof (*cmd_p));
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 3/211 drm/msm/gem: Prevent blocking within shrinker loop
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
[ Upstream commit 9630b585b607bd26f505d34620b14d75b9a5af7d ]
Consider this scenario:
1. APP1 continuously creates lots of small GEMs
2. APP2 triggers drop_caches
3. Shrinker starts to evict APP1 GEMs, while APP1 produces new purgeable GEMs
4. msm_gem_shrinker_scan() returns non-zero number of freed pages and causes shrinker to try shrink more
5. msm_gem_shrinker_scan() returns non-zero number of freed pages again, goto 4
6. The APP2 is blocked in drop_caches until APP1 stops producing purgeable GEMs
To prevent this blocking scenario, check number of remaining pages that GPU shrinker couldn't release due to a GEM locking contention or shrinking rejection. If there are no remaining pages left to shrink, then there is no need to free up more pages and shrinker may break out from the loop.
This problem was found during shrinker/madvise IOCTL testing of virtio-gpu driver. The MSM driver is affected in the same way.
--- drivers/gpu/drm/drm_gem.c | 9 +++++++-- drivers/gpu/drm/msm/msm_gem_shrinker.c | 11 +++++++++-- include/drm/drm_gem.h | 4 +++- 3 files changed, 19 insertions(+), 5 deletions(-)
drivers/gpu/drm/drm_gem.c +7 -2
@@ -1375,10 +1375,13 @@ EXPORT_SYMBOL(drm_gem_lru_move_tail);* * @lru: The LRU to scan * @nr_to_scan: The number of pages to try to reclaim +* @remaining: The number of pages left to reclaim, should be initialized by caller * @shrink: Callback to try to shrink/reclaim the object. */ unsigned long -drm_gem_lru_scan (struct drm_gem_lru *lru,unsigned nr_to_scan, +drm_gem_lru_scan (struct drm_gem_lru *lru, +unsigned int nr_to_scan, +unsigned long *remaining,bool (*shrink)(struct drm_gem_object *obj)) {struct drm_gem_lru still_in_lru;
@@ -1417,8 +1420,10 @@ drm_gem_lru_scan(struct drm_gem_lru *lru, unsigned nr_to_scan,* hit shrinker in response to trying to get backing pages * for this obj (ie. while it's lock is already held) */ -if (!dma_resv_trylock (obj->resv)) +if (!dma_resv_trylock (obj->resv)) { + *remaining += obj->size >>PAGE_SHIFT ; goto tail; + }if (shrink (obj)) { freed += obj->size >>PAGE_SHIFT ;
drivers/gpu/drm/msm/msm_gem_shrinker.c +9 -2
@@ -107,6 +107,7 @@ msm_gem_shrinker_scan(struct shrinker *shrinker, struct shrink_control *sc)bool (*shrink)(struct drm_gem_object *obj);bool cond;unsigned long freed; +unsigned long remaining; } stages[] = {/* Stages of progressively more aggressive/expensive reclaim: */ { &priv->lru.dontneed, purge, true },
@@ -116,14 +117,18 @@ msm_gem_shrinker_scan(struct shrinker *shrinker, struct shrink_control *sc) };long nr = sc->nr_to_scan;unsigned long freed =0 ; +unsigned long remaining =0 ;for (unsigned i =0 ; (nr >0 ) && (i <ARRAY_SIZE (stages)); i++) {if (!stages[i].cond)continue ; stages[i].freed = -drm_gem_lru_scan (stages[i].lru, nr, stages[i].shrink); +drm_gem_lru_scan (stages[i].lru, nr, + &stages[i].remaining, + stages[i].shrink); nr -= stages[i].freed; freed += stages[i].freed; + remaining += stages[i].remaining; }if (freed) {
@@ -132,7 +137,7 @@ msm_gem_shrinker_scan(struct shrinker *shrinker, struct shrink_control *sc) stages[3].freed); } -return (freed >0 ) ? freed :SHRINK_STOP ; +return (freed >0 && remaining >0 ) ? freed :SHRINK_STOP ; }#ifdef CONFIG_DEBUG_FS
@@ -182,10 +187,12 @@ msm_gem_shrinker_vmap(struct notifier_block *nb, unsigned long event, void *ptr) NULL, };unsigned idx, unmapped =0 ; +unsigned long remaining =0 ;for (idx =0 ; lrus[idx] && unmapped < vmap_shrink_limit; idx++) { unmapped +=drm_gem_lru_scan (lrus[idx], vmap_shrink_limit - unmapped, + &remaining, vmap_shrink); }
include/drm/drm_gem.h +3 -1
@@ -475,7 +475,9 @@ int drm_gem_dumb_map_offset(struct drm_file *file, struct drm_device *dev,void drm_gem_lru_init (struct drm_gem_lru *lru,struct mutex *lock);void drm_gem_lru_remove (struct drm_gem_object *obj);void drm_gem_lru_move_tail (struct drm_gem_lru *lru,struct drm_gem_object *obj); -unsigned long drm_gem_lru_scan (struct drm_gem_lru *lru,unsigned nr_to_scan, +unsigned long drm_gem_lru_scan (struct drm_gem_lru *lru, +unsigned int nr_to_scan, +unsigned long *remaining,bool (*shrink)(struct drm_gem_object *obj));#endif /* __DRM_GEM_H__ */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 4/211 drm/panfrost: Dont sync rpm suspension after mmu flushing
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
[ Upstream commit ba3be66f11c3c49afaa9f49b99e21d88756229ef ]
Lockdep warns about potential circular locking dependency of devfreq with the fs_reclaim caused by immediate device suspension when mapping is released by shrinker. Fix it by doing the suspension asynchronously.
--- drivers/gpu/drm/panfrost/panfrost_mmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/panfrost/panfrost_mmu.c +1 -1
@@ -282,7 +282,7 @@ static void panfrost_mmu_flush_range(struct panfrost_device *pfdev,if (pm_runtime_active (pfdev->dev))mmu_hw_do_operation (pfdev, mmu, iova, size,AS_COMMAND_FLUSH_PT ); -pm_runtime_put_sync_autosuspend (pfdev->dev); +pm_runtime_put_autosuspend (pfdev->dev); } static int mmu_map_sg(struct panfrost_device *pfdev, struct panfrost_mmu *mmu,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 5/211 fbdev: chipsfb: Fix error codes in chipsfb_pci_init()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 77bc762451c2dc72bdbea07b857c916c9e7f4952 ]
The error codes are not set on these error paths.
--- drivers/video/fbdev/chipsfb.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/video/fbdev/chipsfb.c +10 -4
@@ -358,16 +358,21 @@ static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent)if (rc)return rc; -if (pci_enable_device (dp) <0 ) { + rc =pci_enable_device (dp); +if (rc <0 ) {dev_err (&dp->dev,"Cannot enable PCI device\n" ); goto err_out; } -if ((dp->resource[0 ].flags &IORESOURCE_MEM ) ==0 ) +if ((dp->resource[0 ].flags &IORESOURCE_MEM ) ==0 ) { + rc = -ENODEV ; goto err_disable; + } addr =pci_resource_start (dp,0 ); -if (addr ==0 ) +if (addr ==0 ) { + rc = -ENODEV ; goto err_disable; + } p =framebuffer_alloc (0 , &dp->dev);if (p ==NULL ) {
@@ -417,7 +422,8 @@ static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent)init_chips (p, addr); -if (register_framebuffer (p) <0 ) { + rc =register_framebuffer (p); +if (rc <0 ) {dev_err (&dp->dev,"C&T 65550 framebuffer failed to register\n" ); goto err_unmap; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 6/211 cifs: Move the in_send statistic to __smb_send_rqst()
In reply to Greg Kroah-HartmanFrom: Zhang Xiaoxu <[email protected]>
[ Upstream commit d0dc41119905f740e8d5594adce277f7c0de8c92 ]
When send SMB_COM_NT_CANCEL and RFC1002_SESSION_REQUEST, the in_send statistic was lost.
Let's move the in_send statistic to the send function to avoid this scenario.
--- fs/cifs/transport.c | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-)
fs/cifs/transport.c +9 -12
@@ -297,7 +297,7 @@ static int __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst, struct smb_rqst *rqst) { - int rc = 0; + int rc;struct kvec *iov;int n_vec;unsigned int send_length =0 ;
@@ -308,6 +308,7 @@ __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst,struct msghdr smb_msg = {};__be32 rfc1002_marker; +cifs_in_send_inc (server);if (cifs_rdma_enabled (server)) {/* return -EAGAIN when connecting or reconnecting */ rc = -EAGAIN ;
@@ -316,14 +317,17 @@ __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst, goto smbd_done; } + rc = -EAGAIN ;if (ssocket ==NULL ) -return -EAGAIN ; + goto out; + rc = -ERESTARTSYS ;if (fatal_signal_pending (current)) {cifs_dbg (FYI ,"signal pending before send request\n" ); -return -ERESTARTSYS ; + goto out; } + rc =0 ;/* cork the socket */ tcp_sock_set_cork (ssocket->sk, true);
@@ -434,7 +438,8 @@ __smb_send_rqst(struct TCP_Server_Info *server, int num_rqst, rc); else if (rc > 0) rc =0 ; - +out: +cifs_in_send_dec (server);return rc; }
@@ -853,9 +858,7 @@ cifs_call_async(struct TCP_Server_Info *server, struct smb_rqst *rqst,* I/O response may come back and free the mid entry on another thread. */ cifs_save_when_sent (mid); -cifs_in_send_inc (server); rc =smb_send_rqst (server,1 , rqst, flags); -cifs_in_send_dec (server);if (rc <0 ) {revert_current_mid (server, mid->credits);
@@ -1146,9 +1149,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,else midQ[i]->callback = cifs_compound_last_callback; } -cifs_in_send_inc (server); rc =smb_send_rqst (server, num_rqst, rqst, flags); -cifs_in_send_dec (server);for (i =0 ; i < num_rqst; i++)cifs_save_when_sent (midQ[i]);
@@ -1398,9 +1399,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, midQ->mid_state =MID_REQUEST_SUBMITTED ; -cifs_in_send_inc (server); rc =smb_send (server, in_buf, len); -cifs_in_send_dec (server);cifs_save_when_sent (midQ);if (rc <0 )
@@ -1541,9 +1540,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, } midQ->mid_state =MID_REQUEST_SUBMITTED ; -cifs_in_send_inc (server); rc =smb_send (server, in_buf, len); -cifs_in_send_dec (server);cifs_save_when_sent (midQ);if (rc <0 )
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 7/211 drm/meson: fix 1px pink line on GXM when scaling video overlay
In reply to Greg Kroah-HartmanFrom: Christian Hewitt <[email protected]>
[ Upstream commit 5c8cf1664f288098a971a1d1e65716a2b6a279e1 ]
Playing media with a resolution smaller than the crtc size requires the video overlay to be scaled for output and GXM boards display a 1px pink line on the bottom of the scaled overlay. Comparing with the downstream vendor driver revealed VPP_DUMMY_DATA not being set [0].
Setting VPP_DUMMY_DATA prevents the 1px pink line from being seen.
[0] https://github.com/endlessm/linux-s905x/blob/master/drivers/amlogic/amports/video.c#L7869
--- drivers/gpu/drm/meson/meson_vpp.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/meson/meson_vpp.c +2 -0
@@ -100,6 +100,8 @@ void meson_vpp_init(struct meson_drm *priv) priv->io_base + _REG(VPP_DOLBY_CTRL));writel_relaxed (0x1020080 , priv->io_base +_REG (VPP_DUMMY_DATA1 )); +writel_relaxed (0x42020 , + priv->io_base +_REG (VPP_DUMMY_DATA )); }else if (meson_vpu_is_compatible (priv,VPU_COMPATIBLE_G12A ))writel_relaxed (0xf , priv->io_base +_REG (DOLBY_PATH_CTRL ));
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 8/211 clk: HI655X: select REGMAP instead of depending on it
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 0ffad67784a097beccf34d297ddd1b0773b3b8a3 ]
REGMAP is a hidden (not user visible) symbol. Users cannot set it directly thru "make *config", so drivers should select it instead of depending on it if they need it.
Consistently using "select" or "depends on" can also help reduce Kconfig circular dependency issues.
Therefore, change the use of "depends on REGMAP" to "select REGMAP".
--- drivers/clk/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/Kconfig +1 -1
@@ -92,7 +92,7 @@ config COMMON_CLK_RK808 config COMMON_CLK_HI655X tristate "Clock driver for Hi655x" if EXPERT depends on (MFD_HI655X_PMIC || COMPILE_TEST) - depends on REGMAP + select REGMAP default MFD_HI655X_PMIC help This driver supports the hi655x PMIC clock. This
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 9/211 selftests: amd-pstate: fix TEST_FILES
In reply to Greg Kroah-HartmanFrom: Guillaume Tucker <[email protected]>
[ Upstream commit 2da789cda462bda93679f53ee38f9aa2309d47e8 ]
Bring back the Python scripts that were initially added with TEST_GEN_FILES but now with TEST_FILES to avoid having them deleted when doing a clean. Also fix the way the architecture is being determined as they should also be installed when ARCH=x86_64 is provided explicitly. Then also append extra files to TEST_FILES and TEST_PROGS with += so they don't get discarded.
--- tools/testing/selftests/amd-pstate/Makefile | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
tools/testing/selftests/amd-pstate/Makefile +9 -4
@@ -4,10 +4,15 @@ # No binaries, but make sure arg-less "make" doesn't trigger "run_tests" all: -uname_M := $(shell uname -m 2>/dev/null || echo not) -ARCH ?= $(shell echo $(uname_M) | sed -e s/i.86/x86/ -e s/x86_64/x86/) +ARCH ?= $(shell uname -m 2>/dev/null || echo not) +ARCH := $(shell echo $(ARCH) | sed -e s/i.86/x86/ -e s/x86_64/x86/) -TEST_PROGS := run.sh -TEST_FILES := basic.sh tbench.sh gitsource.sh +ifeq (x86,$(ARCH)) +TEST_FILES += ../../../power/x86/amd_pstate_tracer/amd_pstate_trace.py +TEST_FILES += ../../../power/x86/intel_pstate_tracer/intel_pstate_tracer.py +endif + +TEST_PROGS += run.sh +TEST_FILES += basic.sh tbench.sh gitsource.sh include ../lib.mk
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 10/211 ASoC: SOF: Intel: MTL: Fix the device description
In reply to Greg Kroah-HartmanFrom: Ranjani Sridharan <[email protected]>
[ Upstream commit a659e35ca0af2765f567bdfdccfa247eff0cdab8 ]
Add the missing ops_free callback.
--- sound/soc/sof/intel/pci-mtl.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/sof/intel/pci-mtl.c +1 -0
@@ -46,6 +46,7 @@ static const struct sof_dev_desc mtl_desc = { .nocodec_tplg_filename = "sof-mtl-nocodec.tplg", .ops = &sof_mtl_ops, .ops_init = sof_mtl_ops_init, + .ops_free = hda_ops_free, };/* PCI IDs */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 11/211 ASoC: SOF: Intel: HDA: Fix device description
In reply to Greg Kroah-HartmanFrom: Ranjani Sridharan <[email protected]>
[ Upstream commit 9eb2b4cac223095d2079a6d52b8bbddc6e064288 ]
Add the missing ops_free callback for APL/CNL/CML/JSL/TGL/EHL platforms.
--- sound/soc/sof/intel/pci-apl.c | 1 + sound/soc/sof/intel/pci-cnl.c | 2 ++ sound/soc/sof/intel/pci-icl.c | 1 + sound/soc/sof/intel/pci-tgl.c | 5 +++++ 4 files changed, 9 insertions(+)
sound/soc/sof/intel/pci-apl.c +1 -0
@@ -78,6 +78,7 @@ static const struct sof_dev_desc glk_desc = { .nocodec_tplg_filename = "sof-glk-nocodec.tplg", .ops = &sof_apl_ops, .ops_init = sof_apl_ops_init, + .ops_free = hda_ops_free, };/* PCI IDs */
sound/soc/sof/intel/pci-cnl.c +2 -0
@@ -48,6 +48,7 @@ static const struct sof_dev_desc cnl_desc = { .nocodec_tplg_filename = "sof-cnl-nocodec.tplg", .ops = &sof_cnl_ops, .ops_init = sof_cnl_ops_init, + .ops_free = hda_ops_free, };static const struct sof_dev_desc cfl_desc = {
@@ -111,6 +112,7 @@ static const struct sof_dev_desc cml_desc = { .nocodec_tplg_filename = "sof-cnl-nocodec.tplg", .ops = &sof_cnl_ops, .ops_init = sof_cnl_ops_init, + .ops_free = hda_ops_free, };/* PCI IDs */
sound/soc/sof/intel/pci-icl.c +1 -0
@@ -79,6 +79,7 @@ static const struct sof_dev_desc jsl_desc = { .nocodec_tplg_filename = "sof-jsl-nocodec.tplg", .ops = &sof_cnl_ops, .ops_init = sof_cnl_ops_init, + .ops_free = hda_ops_free, };/* PCI IDs */
sound/soc/sof/intel/pci-tgl.c +5 -0
@@ -48,6 +48,7 @@ static const struct sof_dev_desc tgl_desc = { .nocodec_tplg_filename = "sof-tgl-nocodec.tplg", .ops = &sof_tgl_ops, .ops_init = sof_tgl_ops_init, + .ops_free = hda_ops_free, };static const struct sof_dev_desc tglh_desc = {
@@ -110,6 +111,7 @@ static const struct sof_dev_desc ehl_desc = { .nocodec_tplg_filename = "sof-ehl-nocodec.tplg", .ops = &sof_tgl_ops, .ops_init = sof_tgl_ops_init, + .ops_free = hda_ops_free, };static const struct sof_dev_desc adls_desc = {
@@ -141,6 +143,7 @@ static const struct sof_dev_desc adls_desc = { .nocodec_tplg_filename = "sof-adl-nocodec.tplg", .ops = &sof_tgl_ops, .ops_init = sof_tgl_ops_init, + .ops_free = hda_ops_free, };static const struct sof_dev_desc adl_desc = {
@@ -172,6 +175,7 @@ static const struct sof_dev_desc adl_desc = { .nocodec_tplg_filename = "sof-adl-nocodec.tplg", .ops = &sof_tgl_ops, .ops_init = sof_tgl_ops_init, + .ops_free = hda_ops_free, };static const struct sof_dev_desc adl_n_desc = {
@@ -203,6 +207,7 @@ static const struct sof_dev_desc adl_n_desc = { .nocodec_tplg_filename = "sof-adl-nocodec.tplg", .ops = &sof_tgl_ops, .ops_init = sof_tgl_ops_init, + .ops_free = hda_ops_free, };static const struct sof_dev_desc rpls_desc = {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 12/211 ASoC: SOF: Intel: SKL: Fix device description
In reply to Greg Kroah-HartmanFrom: Ranjani Sridharan <[email protected]>
[ Upstream commit 1f320bdb29b644a2c9fb301a6fb2d6170e6417e9 ]
Add missing ops_free callback for SKL/KBL platforms.
--- sound/soc/sof/intel/pci-skl.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/sof/intel/pci-skl.c +2 -0
@@ -38,6 +38,7 @@ static struct sof_dev_desc skl_desc = { .nocodec_tplg_filename = "sof-skl-nocodec.tplg", .ops = &sof_skl_ops, .ops_init = sof_skl_ops_init, + .ops_free = hda_ops_free, };static struct sof_dev_desc kbl_desc = {
@@ -61,6 +62,7 @@ static struct sof_dev_desc kbl_desc = { .nocodec_tplg_filename = "sof-kbl-nocodec.tplg", .ops = &sof_skl_ops, .ops_init = sof_skl_ops_init, + .ops_free = hda_ops_free, };/* PCI IDs */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 13/211 ASOC: SOF: Intel: pci-tgl: Fix device description
In reply to Greg Kroah-HartmanFrom: Ranjani Sridharan <[email protected]>
[ Upstream commit 376f79bbf521fc37b871b536276319951b5bef3a ]
Add the missing ops_free callback.
--- sound/soc/sof/intel/pci-tgl.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/sof/intel/pci-tgl.c +2 -0
@@ -239,6 +239,7 @@ static const struct sof_dev_desc rpls_desc = { .nocodec_tplg_filename = "sof-rpl-nocodec.tplg", .ops = &sof_tgl_ops, .ops_init = sof_tgl_ops_init, + .ops_free = hda_ops_free, };static const struct sof_dev_desc rpl_desc = {
@@ -270,6 +271,7 @@ static const struct sof_dev_desc rpl_desc = { .nocodec_tplg_filename = "sof-rpl-nocodec.tplg", .ops = &sof_tgl_ops, .ops_init = sof_tgl_ops_init, + .ops_free = hda_ops_free, };/* PCI IDs */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 14/211 ASoC: SOF: ipc4-topology: set dmic dai index from copier
In reply to Greg Kroah-HartmanFrom: Jaska Uimonen <[email protected]>
[ Upstream commit c99e48f4ce9b986ab7992ec7283a06dae875f668 ]
Dmic dai index was set incorrectly to bits 5-7, when it is actually using just the lowest 3. Fix the macro for setting the bits.
--- sound/soc/sof/ipc4-topology.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/sof/ipc4-topology.h +1 -1
@@ -46,7 +46,7 @@#define SOF_IPC4_NODE_INDEX_INTEL_SSP (x) (((x) & 0xf) << 4)/* Node ID for DMIC type DAI copiers */ -#define SOF_IPC4_NODE_INDEX_INTEL_DMIC (x) (((x) & 0x7) << 5) +#define SOF_IPC4_NODE_INDEX_INTEL_DMIC (x) ((x) & 0x7)#define SOF_IPC4_GAIN_ALL_CHANNELS_MASK 0xffffffff#define SOF_IPC4_VOL_ZERO_DB 0x7fffffff
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 15/211 docs: Correct missing "d_" prefix for dentry_operations member d_weak_revalidate
In reply to Greg Kroah-HartmanFrom: Glenn Washburn <[email protected]>
[ Upstream commit 74596085796fae0cfce3e42ee46bf4f8acbdac55 ]
The details for struct dentry_operations member d_weak_revalidate is missing a "d_" prefix.
--- Documentation/filesystems/vfs.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/filesystems/vfs.rst +1 -1
@@ -1222,7 +1222,7 @@ defined: return -ECHILD and it will be called again in ref-walk mode. -``_weak_revalidate`` +``d_weak_revalidate`` called when the VFS needs to revalidate a "jumped" dentry. This is called when a path-walk ends at dentry that was not acquired by doing a lookup in the parent directory. This includes "/",
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 16/211 scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
In reply to Greg Kroah-HartmanFrom: Wenchao Hao <[email protected]>
[ Upstream commit d3c57724f1569311e4b81e98fad0931028b9bdcd ]
Port is allocated by sas_port_alloc_num() and rphy is allocated by either sas_end_device_alloc() or sas_expander_alloc(), all of which may return NULL. So we need to check the rphy to avoid possible NULL pointer access.
If sas_rphy_add() returned with failure, rphy is set to NULL. We would access the rphy in the following lines which would also result NULL pointer access.
--- drivers/scsi/mpt3sas/mpt3sas_transport.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/scsi/mpt3sas/mpt3sas_transport.c +12 -2
@@ -785,7 +785,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, goto out_fail; } port =sas_port_alloc_num (sas_node->parent_dev); -if ((sas_port_add (port))) { +if (!port || (sas_port_add (port))) {ioc_err (ioc,"failure at %s:%d/%s()!\n" , __FILE__, __LINE__, __func__); goto out_fail;
@@ -824,6 +824,12 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, mpt3sas_port->remote_identify.sas_address; } +if (!rphy) { +ioc_err (ioc,"failure at %s:%d/%s()!\n" , + __FILE__, __LINE__, __func__); + goto out_delete_port; + } + rphy->identify = mpt3sas_port->remote_identify;if ((sas_rphy_add (rphy))) {
@@ -831,6 +837,7 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, __FILE__, __LINE__, __func__);sas_rphy_free (rphy); rphy =NULL ; + goto out_delete_port; }if (mpt3sas_port->remote_identify.device_type ==SAS_END_DEVICE ) {
@@ -857,7 +864,10 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle, rphy_to_expander_device(rphy), hba_port->port_id);return mpt3sas_port; - out_fail: +out_delete_port: +sas_port_delete (port); + +out_fail:list_for_each_entry_safe (mpt3sas_phy, next, &mpt3sas_port->phy_list, port_siblings)list_del (&mpt3sas_phy->port_siblings);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 17/211 scsi: mpi3mr: Fix throttle_groups memory leak
In reply to Greg Kroah-HartmanFrom: Tomas Henzl <[email protected]>
[ Upstream commit f305a7b6ca21a665e8d0cf70b5936991a298c93c ]
Add a missing kfree().
--- drivers/scsi/mpi3mr/mpi3mr_fw.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/scsi/mpi3mr/mpi3mr_fw.c +3 -0
@@ -4357,6 +4357,9 @@ void mpi3mr_free_mem(struct mpi3mr_ioc *mrioc) mrioc->pel_seqnum_virt =NULL ; } +kfree (mrioc->throttle_groups); + mrioc->throttle_groups =NULL ; +kfree (mrioc->logdata_buf); mrioc->logdata_buf =NULL ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 18/211 scsi: mpi3mr: Fix config page DMA memory leak
In reply to Greg Kroah-HartmanFrom: Tomas Henzl <[email protected]>
[ Upstream commit 7d2b02172b6a2ae6aecd7ef6480b9c4bf3dc59f4 ]
A fix for:
DMA-API: pci 0000:83:00.0: device driver has pending DMA allocations while released from device [count=1]
--- drivers/scsi/mpi3mr/mpi3mr_fw.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/scsi/mpi3mr/mpi3mr_fw.c +5 -1
@@ -4350,7 +4350,11 @@ void mpi3mr_free_mem(struct mpi3mr_ioc *mrioc) mrioc->admin_req_base, mrioc->admin_req_dma); mrioc->admin_req_base =NULL ; } - +if (mrioc->cfg_page) { +dma_free_coherent (&mrioc->pdev->dev, mrioc->cfg_page_sz, + mrioc->cfg_page, mrioc->cfg_page_dma); + mrioc->cfg_page =NULL ; + }if (mrioc->pel_seqnum_virt) {dma_free_coherent (&mrioc->pdev->dev, mrioc->pel_seqnum_sz, mrioc->pel_seqnum_virt, mrioc->pel_seqnum_dma);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 19/211 scsi: mpi3mr: Fix mpi3mr_hba_port memory leak in mpi3mr_remove()
In reply to Greg Kroah-HartmanFrom: Tomas Henzl <[email protected]>
[ Upstream commit d0f3c3728da8af76dfe435f7f0cfa2b9d9e43ef0 ]
Free mpi3mr_hba_port at .remove.
--- drivers/scsi/mpi3mr/mpi3mr_os.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/scsi/mpi3mr/mpi3mr_os.c +11 -0
@@ -5077,6 +5077,7 @@ static void mpi3mr_remove(struct pci_dev *pdev)struct workqueue_struct *wq;unsigned long flags;struct mpi3mr_tgt_dev *tgtdev, *tgtdev_next; +struct mpi3mr_hba_port *port, *hba_port_next;if (!shost)return ;
@@ -5116,6 +5117,16 @@ static void mpi3mr_remove(struct pci_dev *pdev)mpi3mr_free_mem (mrioc);mpi3mr_cleanup_resources (mrioc); +spin_lock_irqsave (&mrioc->sas_node_lock, flags); +list_for_each_entry_safe (port, hba_port_next, &mrioc->hba_port_table_list, list) { +ioc_info (mrioc, +"removing hba_port entry: %p port: %d from hba_port list\n" , + port, port->port_id); +list_del (&port->list); +kfree (port); + } +spin_unlock_irqrestore (&mrioc->sas_node_lock, flags); +spin_lock (&mrioc_list_lock);list_del (&mrioc->list);spin_unlock (&mrioc_list_lock);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 20/211 scsi: mpi3mr: Fix sas_hba.phy memory leak in mpi3mr_remove()
In reply to Greg Kroah-HartmanFrom: Tomas Henzl <[email protected]>
[ Upstream commit d4caa1a4255cc44be56bcab3db2c97c632e6cc10 ]
Free mrioc->sas_hba.phy at .remove.
--- drivers/scsi/mpi3mr/mpi3mr_os.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/scsi/mpi3mr/mpi3mr_os.c +6 -0
@@ -5127,6 +5127,12 @@ static void mpi3mr_remove(struct pci_dev *pdev) }spin_unlock_irqrestore (&mrioc->sas_node_lock, flags); +if (mrioc->sas_hba.num_phys) { +kfree (mrioc->sas_hba.phy); + mrioc->sas_hba.phy =NULL ; + mrioc->sas_hba.num_phys =0 ; + } +spin_lock (&mrioc_list_lock);list_del (&mrioc->list);spin_unlock (&mrioc_list_lock);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 21/211 scsi: mpi3mr: Return proper values for failures in firmware init path
In reply to Greg Kroah-HartmanFrom: Ranjan Kumar <[email protected]>
[ Upstream commit ba8a9ba41fbde250fd8b0ed1e5dad0dc9318df46 ]
Return proper non-zero return values for all the cases when the controller initialization and re-initialization fails.
Stable-dep-of: c798304470ca ("scsi: mpi3mr: Fix memory leaks in mpi3mr_init_ioc()")
--- drivers/scsi/mpi3mr/mpi3mr_fw.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/scsi/mpi3mr/mpi3mr_fw.c +9 -2
@@ -3816,8 +3816,10 @@ int mpi3mr_init_ioc(struct mpi3mr_ioc *mrioc)dprint_init (mrioc,"allocating config page buffers\n" ); mrioc->cfg_page =dma_alloc_coherent (&mrioc->pdev->dev,MPI3MR_DEFAULT_CFG_PAGE_SZ , &mrioc->cfg_page_dma,GFP_KERNEL ); -if (!mrioc->cfg_page) +if (!mrioc->cfg_page) { + retval =-1 ; goto out_failed_noretry; + } mrioc->cfg_page_sz =MPI3MR_DEFAULT_CFG_PAGE_SZ ;
@@ -3879,8 +3881,10 @@ int mpi3mr_init_ioc(struct mpi3mr_ioc *mrioc)dprint_init (mrioc,"allocating memory for throttle groups\n" ); sz =sizeof (struct mpi3mr_throttle_group_info ); mrioc->throttle_groups =kcalloc (mrioc->num_io_throttle_group, sz,GFP_KERNEL ); -if (!mrioc->throttle_groups) +if (!mrioc->throttle_groups) { + retval =-1 ; goto out_failed_noretry; + } } retval =mpi3mr_enable_events (mrioc);
@@ -3900,6 +3904,7 @@ int mpi3mr_init_ioc(struct mpi3mr_ioc *mrioc)mpi3mr_memset_buffers (mrioc); goto retry_init; } + retval =-1 ; out_failed_noretry:ioc_err (mrioc,"controller initialization failed\n" ); mpi3mr_issue_reset(mrioc, MPI3_SYSIF_HOST_DIAG_RESET_ACTION_DIAG_FAULT,
@@ -4012,6 +4017,7 @@ int mpi3mr_reinit_ioc(struct mpi3mr_ioc *mrioc, u8 is_resume)ioc_err (mrioc,"cannot create minimum number of operational queues expected:%d created:%d\n" , mrioc->shost->nr_hw_queues, mrioc->num_op_reply_q); + retval =-1 ; goto out_failed_noretry; }
@@ -4078,6 +4084,7 @@ int mpi3mr_reinit_ioc(struct mpi3mr_ioc *mrioc, u8 is_resume)mpi3mr_memset_buffers (mrioc); goto retry_init; } + retval =-1 ; out_failed_noretry:ioc_err (mrioc,"controller %s is failed\n" , (is_resume)?"resume" :"re-initialization" );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 22/211 scsi: mpi3mr: Fix memory leaks in mpi3mr_init_ioc()
In reply to Greg Kroah-HartmanFrom: Tomas Henzl <[email protected]>
[ Upstream commit c798304470cab88723d895726d17fcb96472e0e9 ]
Don't allocate memory again when IOC is being reinitialized.
--- drivers/scsi/mpi3mr/mpi3mr_fw.c | 41 ++++++++++++++++++--------------- 1 file changed, 23 insertions(+), 18 deletions(-)
drivers/scsi/mpi3mr/mpi3mr_fw.c +23 -18
@@ -3813,29 +3813,34 @@ int mpi3mr_init_ioc(struct mpi3mr_ioc *mrioc)mpi3mr_print_ioc_info (mrioc); -dprint_init (mrioc,"allocating config page buffers\n" ); - mrioc->cfg_page =dma_alloc_coherent (&mrioc->pdev->dev, -MPI3MR_DEFAULT_CFG_PAGE_SZ , &mrioc->cfg_page_dma,GFP_KERNEL );if (!mrioc->cfg_page) { - retval =-1 ; - goto out_failed_noretry; +dprint_init (mrioc,"allocating config page buffers\n" ); + mrioc->cfg_page_sz =MPI3MR_DEFAULT_CFG_PAGE_SZ ; + mrioc->cfg_page =dma_alloc_coherent (&mrioc->pdev->dev, + mrioc->cfg_page_sz, &mrioc->cfg_page_dma,GFP_KERNEL ); +if (!mrioc->cfg_page) { + retval =-1 ; + goto out_failed_noretry; + } } - mrioc->cfg_page_sz =MPI3MR_DEFAULT_CFG_PAGE_SZ ; - - retval =mpi3mr_alloc_reply_sense_bufs (mrioc); -if (retval) { -ioc_err (mrioc, -"%s :Failed to allocated reply sense buffers %d\n" , - __func__, retval); - goto out_failed_noretry; +if (!mrioc->init_cmds.reply) { + retval =mpi3mr_alloc_reply_sense_bufs (mrioc); +if (retval) { +ioc_err (mrioc, +"%s :Failed to allocated reply sense buffers %d\n" , + __func__, retval); + goto out_failed_noretry; + } } - retval =mpi3mr_alloc_chain_bufs (mrioc); -if (retval) { -ioc_err (mrioc,"Failed to allocated chain buffers %d\n" , - retval); - goto out_failed_noretry; +if (!mrioc->chain_sgl_list) { + retval =mpi3mr_alloc_chain_bufs (mrioc); +if (retval) { +ioc_err (mrioc,"Failed to allocated chain buffers %d\n" , + retval); + goto out_failed_noretry; + } } retval =mpi3mr_issue_iocinit (mrioc);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 23/211 scsi: mpi3mr: ioctl timeout when disabling/enabling interrupt
In reply to Greg Kroah-HartmanFrom: Ranjan Kumar <[email protected]>
[ Upstream commit 02ca7da2919ada525fb424640205110e24646b50 ]
As part of Task Management handling, the driver will disable and enable the MSIx index zero which belongs to the Admin reply queue. During this transition the driver loses some interrupts and this leads to Admin request and ioctl timeouts.
After enabling the interrupts, poll the Admin reply queue to avoid timeouts.
Stable-dep-of: ce756daa36e1 ("scsi: mpi3mr: Fix expander node leak in mpi3mr_remove()")
--- drivers/scsi/mpi3mr/mpi3mr.h | 3 +++ drivers/scsi/mpi3mr/mpi3mr_fw.c | 12 ++++++++++-- drivers/scsi/mpi3mr/mpi3mr_os.c | 1 + 3 files changed, 14 insertions(+), 2 deletions(-)
drivers/scsi/mpi3mr/mpi3mr.h +3 -0
@@ -903,6 +903,7 @@ struct scmd_priv {* @admin_reply_ephase:Admin reply queue expected phase * @admin_reply_base: Admin reply queue base virtual address * @admin_reply_dma: Admin reply queue base dma address +* @admin_reply_q_in_use: Queue is handled by poll/ISR * @ready_timeout: Controller ready timeout * @intr_info: Interrupt cookie pointer * @intr_info_count: Number of interrupt cookies
@@ -1056,6 +1057,7 @@ struct mpi3mr_ioc {u8 admin_reply_ephase;void *admin_reply_base;dma_addr_t admin_reply_dma; +atomic_t admin_reply_q_in_use;u32 ready_timeout;
@@ -1391,4 +1393,5 @@ void mpi3mr_add_event_wait_for_device_refresh(struct mpi3mr_ioc *mrioc);void mpi3mr_flush_drv_cmds (struct mpi3mr_ioc *mrioc);void mpi3mr_flush_cmds_for_unrecovered_controller (struct mpi3mr_ioc *mrioc);void mpi3mr_free_enclosure_list (struct mpi3mr_ioc *mrioc); +int mpi3mr_process_admin_reply_q (struct mpi3mr_ioc *mrioc);#endif /*MPI3MR_H_INCLUDED*/
drivers/scsi/mpi3mr/mpi3mr_fw.c +10 -2
@@ -415,7 +415,7 @@ static void mpi3mr_process_admin_reply_desc(struct mpi3mr_ioc *mrioc, le64_to_cpu(scsi_reply->sense_data_buffer_address)); } -static int mpi3mr_process_admin_reply_q (struct mpi3mr_ioc *mrioc) +int mpi3mr_process_admin_reply_q (struct mpi3mr_ioc *mrioc) {u32 exp_phase = mrioc->admin_reply_ephase;u32 admin_reply_ci = mrioc->admin_reply_ci;
@@ -423,12 +423,17 @@ static int mpi3mr_process_admin_reply_q(struct mpi3mr_ioc *mrioc)u64 reply_dma =0 ;struct mpi3_default_reply_descriptor *reply_desc; +if (!atomic_add_unless (&mrioc->admin_reply_q_in_use,1 ,1 )) +return 0 ; + reply_desc = (struct mpi3_default_reply_descriptor *)mrioc->admin_reply_base + admin_reply_ci;if ((le16_to_cpu (reply_desc->reply_flags) & -MPI3_REPLY_DESCRIPT_FLAGS_PHASE_MASK ) != exp_phase) +MPI3_REPLY_DESCRIPT_FLAGS_PHASE_MASK ) != exp_phase) { +atomic_dec (&mrioc->admin_reply_q_in_use);return 0 ; + } do { if (mrioc->unrecoverable)
@@ -454,6 +459,7 @@ static int mpi3mr_process_admin_reply_q(struct mpi3mr_ioc *mrioc)writel (admin_reply_ci, &mrioc->sysif_regs->admin_reply_queue_ci); mrioc->admin_reply_ci = admin_reply_ci; mrioc->admin_reply_ephase = exp_phase; +atomic_dec (&mrioc->admin_reply_q_in_use);return num_admin_replies; }
@@ -2605,6 +2611,7 @@ static int mpi3mr_setup_admin_qpair(struct mpi3mr_ioc *mrioc) mrioc->admin_reply_ci =0 ; mrioc->admin_reply_ephase =1 ; mrioc->admin_reply_base =NULL ; +atomic_set (&mrioc->admin_reply_q_in_use,0 );if (!mrioc->admin_req_base) { mrioc->admin_req_base = dma_alloc_coherent(&mrioc->pdev->dev,
@@ -4167,6 +4174,7 @@ void mpi3mr_memset_buffers(struct mpi3mr_ioc *mrioc)memset (mrioc->admin_req_base,0 , mrioc->admin_req_q_sz);if (mrioc->admin_reply_base)memset (mrioc->admin_reply_base,0 , mrioc->admin_reply_q_sz); +atomic_set (&mrioc->admin_reply_q_in_use,0 );if (mrioc->init_cmds.reply) {memset (mrioc->init_cmds.reply,0 ,sizeof (*mrioc->init_cmds.reply));
drivers/scsi/mpi3mr/mpi3mr_os.c +1 -0
@@ -3720,6 +3720,7 @@ int mpi3mr_issue_tm(struct mpi3mr_ioc *mrioc, u8 tm_type,mpi3mr_poll_pend_io_completions (mrioc);mpi3mr_ioc_enable_intr (mrioc);mpi3mr_poll_pend_io_completions (mrioc); +mpi3mr_process_admin_reply_q (mrioc); }switch (tm_type) {case MPI3_SCSITASKMGMT_TASKTYPE_TARGET_RESET :
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 24/211 scsi: mpi3mr: Fix expander node leak in mpi3mr_remove()
In reply to Greg Kroah-HartmanFrom: Tomas Henzl <[email protected]>
[ Upstream commit ce756daa36e1ba271bb3334267295e447aa57a5c ]
Add a missing resource clean up in .remove.
--- drivers/scsi/mpi3mr/mpi3mr.h | 2 ++ drivers/scsi/mpi3mr/mpi3mr_os.c | 7 +++++++ drivers/scsi/mpi3mr/mpi3mr_transport.c | 5 +---- 3 files changed, 10 insertions(+), 4 deletions(-)
drivers/scsi/mpi3mr/mpi3mr.h +2 -0
@@ -1394,4 +1394,6 @@ void mpi3mr_flush_drv_cmds(struct mpi3mr_ioc *mrioc);void mpi3mr_flush_cmds_for_unrecovered_controller (struct mpi3mr_ioc *mrioc);void mpi3mr_free_enclosure_list (struct mpi3mr_ioc *mrioc);int mpi3mr_process_admin_reply_q (struct mpi3mr_ioc *mrioc); +void mpi3mr_expander_node_remove (struct mpi3mr_ioc *mrioc, +struct mpi3mr_sas_node *sas_expander);#endif /*MPI3MR_H_INCLUDED*/
drivers/scsi/mpi3mr/mpi3mr_os.c +7 -0
@@ -5079,6 +5079,7 @@ static void mpi3mr_remove(struct pci_dev *pdev)unsigned long flags;struct mpi3mr_tgt_dev *tgtdev, *tgtdev_next;struct mpi3mr_hba_port *port, *hba_port_next; +struct mpi3mr_sas_node *sas_expander, *sas_expander_next;if (!shost)return ;
@@ -5119,6 +5120,12 @@ static void mpi3mr_remove(struct pci_dev *pdev)mpi3mr_cleanup_resources (mrioc);spin_lock_irqsave (&mrioc->sas_node_lock, flags); +list_for_each_entry_safe_reverse (sas_expander, sas_expander_next, + &mrioc->sas_expander_list, list) { +spin_unlock_irqrestore (&mrioc->sas_node_lock, flags); +mpi3mr_expander_node_remove (mrioc, sas_expander); +spin_lock_irqsave (&mrioc->sas_node_lock, flags); + }list_for_each_entry_safe (port, hba_port_next, &mrioc->hba_port_table_list, list) { ioc_info(mrioc, "removing hba_port entry: %p port: %d from hba_port list\n",
drivers/scsi/mpi3mr/mpi3mr_transport.c +1 -4
@@ -9,9 +9,6 @@#include "mpi3mr.h" -static void mpi3mr_expander_node_remove (struct mpi3mr_ioc *mrioc, -struct mpi3mr_sas_node *sas_expander); -/** * mpi3mr_post_transport_req - Issue transport requests and wait * @mrioc: Adapter instance reference
@@ -2163,7 +2160,7 @@ int mpi3mr_expander_add(struct mpi3mr_ioc *mrioc, u16 handle)* * Return nothing. */ -static void mpi3mr_expander_node_remove (struct mpi3mr_ioc *mrioc, +void mpi3mr_expander_node_remove (struct mpi3mr_ioc *mrioc,struct mpi3mr_sas_node *sas_expander) {struct mpi3mr_sas_port *mr_sas_port, *next;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 25/211 ALSA: hda: Match only Intel devices with CONTROLLER_IN_GPU()
In reply to Greg Kroah-HartmanFrom: Bjorn Helgaas <[email protected]>
[ Upstream commit ff447886e675979d66b2bc01810035d3baea1b3a ]
CONTROLLER_IN_GPU() is clearly intended to match only Intel devices, but previously it checked only the PCI Device ID, not the Vendor ID, so it could match devices from other vendors that happened to use the same Device ID.
Update CONTROLLER_IN_GPU() so it matches only Intel devices.
--- sound/pci/hda/hda_intel.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
sound/pci/hda/hda_intel.c +3 -2
@@ -328,14 +328,15 @@ enum {#define needs_eld_notify_link (chip) false#endif -#define CONTROLLER_IN_GPU (pci) (((pci)->device == 0x0a0c) || \ +#define CONTROLLER_IN_GPU (pci) (((pci)->vendor == 0x8086) && \ + (((pci)->device == 0x0a0c) || \ ((pci)->device == 0x0c0c) || \ ((pci)->device == 0x0d0c) || \ ((pci)->device == 0x160c) || \ ((pci)->device == 0x490d) || \ ((pci)->device == 0x4f90) || \ ((pci)->device == 0x4f91) || \ - ((pci)->device == 0x4f92)) + ((pci)->device == 0x4f92)))#define IS_BXT (pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x5a98)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 26/211 netfilter: nft_nat: correct length for loading protocol registers
In reply to Greg Kroah-HartmanFrom: Jeremy Sowden <[email protected]>
[ Upstream commit 068d82e75d537b444303b8c449a11e51ea659565 ]
The values in the protocol registers are two bytes wide. However, when parsing the register loads, the code currently uses the larger 16-byte size of a union nf_inet_addr. Change it to use the (correct) size of a union nf_conntrack_man_proto instead.
--- net/netfilter/nft_nat.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nft_nat.c +1 -1
@@ -226,7 +226,7 @@ static int nft_nat_init(const struct nft_ctx *ctx, const struct nft_expr *expr, priv->flags |=NF_NAT_RANGE_MAP_IPS ; } - plen = sizeof_field(struct nf_nat_range, min_addr.all); + plen = sizeof_field(struct nf_nat_range, min_proto.all);if (tb[NFTA_NAT_REG_PROTO_MIN ]) { err =nft_parse_register_load (tb[NFTA_NAT_REG_PROTO_MIN ], &priv->sreg_proto_min, plen);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 27/211 netfilter: nft_masq: correct length for loading protocol registers
In reply to Greg Kroah-HartmanFrom: Jeremy Sowden <[email protected]>
[ Upstream commit ec2c5917eb858428b2083d1c74f445aabbe8316b ]
The values in the protocol registers are two bytes wide. However, when parsing the register loads, the code currently uses the larger 16-byte size of a union nf_inet_addr. Change it to use the (correct) size of a union nf_conntrack_man_proto instead.
--- net/netfilter/nft_masq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nft_masq.c +1 -1
@@ -43,7 +43,7 @@ static int nft_masq_init(const struct nft_ctx *ctx,const struct nft_expr *expr, const struct nlattr * const tb[]) { - u32 plen = sizeof_field(struct nf_nat_range, min_addr.all); + u32 plen = sizeof_field(struct nf_nat_range, min_proto.all);struct nft_masq *priv =nft_expr_priv (expr);int err;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 28/211 netfilter: nft_redir: correct length for loading protocol registers
In reply to Greg Kroah-HartmanFrom: Jeremy Sowden <[email protected]>
[ Upstream commit 1f617b6b4c7a3d5ea7a56abb83a4c27733b60c2f ]
The values in the protocol registers are two bytes wide. However, when parsing the register loads, the code currently uses the larger 16-byte size of a union nf_inet_addr. Change it to use the (correct) size of a union nf_conntrack_man_proto instead.
--- net/netfilter/nft_redir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nft_redir.c +1 -1
@@ -48,7 +48,7 @@ static int nft_redir_init(const struct nft_ctx *ctx,unsigned int plen;int err; - plen = sizeof_field(struct nf_nat_range, min_addr.all); + plen = sizeof_field(struct nf_nat_range, min_proto.all);if (tb[NFTA_REDIR_REG_PROTO_MIN ]) { err =nft_parse_register_load (tb[NFTA_REDIR_REG_PROTO_MIN ], &priv->sreg_proto_min, plen);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 29/211 netfilter: nft_redir: correct value of inet type `.maxattrs`
In reply to Greg Kroah-HartmanFrom: Jeremy Sowden <[email protected]>
[ Upstream commit 493924519b1fe3faab13ee621a43b0d0939abab1 ]
nft_redir_inet_type.maxattrs was being set, presumably because of a cut-and-paste error, to NFTA_MASQ_MAX, instead of NFTA_REDIR_MAX.
--- net/netfilter/nft_redir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nft_redir.c +1 -1
@@ -236,7 +236,7 @@ static struct nft_expr_type nft_redir_inet_type __read_mostly = { .name = "redir", .ops = &nft_redir_inet_ops, .policy = nft_redir_policy, - .maxattr = NFTA_MASQ_MAX, + .maxattr = NFTA_REDIR_MAX, .owner = THIS_MODULE, };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 30/211 scsi: core: Add BLIST_NO_VPD_SIZE for some VDASD
In reply to Greg Kroah-HartmanFrom: Lee Duncan <[email protected]>
[ Upstream commit 4b1a2c2a8e0ddcb89c5f6c5003bd9b53142f69e3 ]
Some storage, such as AIX VDASD (virtual storage) and IBM 2076 (front end), fail as a result of commit c92a6b5d6335 ("scsi: core: Query VPD size before getting full page").
That commit changed getting SCSI VPD pages so that we now read just enough of the page to get the actual page size, then read the whole page in a second read. The problem is that the above mentioned hardware returns zero for the page size, because of a firmware error. In such cases, until the firmware is fixed, this new blacklist flag says to revert to the original method of reading the VPD pages, i.e. try to read a whole buffer's worth on the first try.
[mkp: reworked somewhat]
--- drivers/scsi/scsi.c | 3 +++ drivers/scsi/scsi_devinfo.c | 3 ++- drivers/scsi/scsi_scan.c | 3 +++ include/scsi/scsi_device.h | 2 ++ include/scsi/scsi_devinfo.h | 6 +++--- 5 files changed, 13 insertions(+), 4 deletions(-)
drivers/scsi/scsi.c +3 -0
@@ -326,6 +326,9 @@ static int scsi_get_vpd_size(struct scsi_device *sdev, u8 page)unsigned char vpd_header[SCSI_VPD_HEADER_SIZE ]__aligned(4) ;int result; +if (sdev->no_vpd_size) +return SCSI_DEFAULT_VPD_LEN ; +/* * Fetch the VPD page header to find out how big the page * is. This is done to prevent problems on legacy devices
drivers/scsi/scsi_devinfo.c +2 -1
@@ -134,7 +134,7 @@ static struct { {"3PARdata", "VV", NULL, BLIST_REPORTLUN2}, {"ADAPTEC", "AACRAID", NULL, BLIST_FORCELUN}, {"ADAPTEC", "Adaptec 5400S", NULL, BLIST_FORCELUN}, - {"AIX", "VDASD", NULL, BLIST_TRY_VPD_PAGES}, + {"AIX", "VDASD", NULL, BLIST_TRY_VPD_PAGES | BLIST_NO_VPD_SIZE}, {"AFT PRO", "-IX CF", "0.0>", BLIST_FORCELUN}, {"BELKIN", "USB 2 HS-CF", "1.95", BLIST_FORCELUN | BLIST_INQUIRY_36}, {"BROWNIE", "1200U3P", NULL, BLIST_NOREPORTLUN},
@@ -188,6 +188,7 @@ static struct { {"HPE", "OPEN-", "*", BLIST_REPORTLUN2 | BLIST_TRY_VPD_PAGES}, {"IBM", "AuSaV1S2", NULL, BLIST_FORCELUN}, {"IBM", "ProFibre 4000R", "*", BLIST_SPARSELUN | BLIST_LARGELUN}, + {"IBM", "2076", NULL, BLIST_NO_VPD_SIZE}, {"IBM", "2105", NULL, BLIST_RETRY_HWERROR}, {"iomega", "jaz 1GB", "J.86", BLIST_NOTQ | BLIST_NOLUN}, {"IOMEGA", "ZIP", NULL, BLIST_NOTQ | BLIST_NOLUN},
drivers/scsi/scsi_scan.c +3 -0
@@ -1055,6 +1055,9 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,else if (*bflags &BLIST_SKIP_VPD_PAGES ) sdev->skip_vpd_pages =1 ; +if (*bflags &BLIST_NO_VPD_SIZE ) + sdev->no_vpd_size =1 ; +transport_configure_device (&sdev->sdev_gendev);if (sdev->host->hostt->slave_configure) {
include/scsi/scsi_device.h +2 -0
@@ -145,6 +145,7 @@ struct scsi_device {const char * model;/* ... after scan; point to static string */ const char * rev;/* ... "nullnullnullnull" before scan */ +#define SCSI_DEFAULT_VPD_LEN 255/* default SCSI VPD page size (max) */ struct scsi_vpd __rcu *vpd_pg0;struct scsi_vpd __rcu *vpd_pg83;struct scsi_vpd __rcu *vpd_pg80;
@@ -215,6 +216,7 @@ struct scsi_device {* creation time */ unsigned ignore_media_change:1; /* Ignore MEDIA CHANGE on resume */ unsigned silence_suspend:1; /* Do not print runtime PM related messages */ + unsigned no_vpd_size:1; /* No VPD size reported in header */unsigned int queue_stopped;/* request queue is quiesced */ bool offline_already;/* Device offline message logged */
include/scsi/scsi_devinfo.h +3 -3
@@ -32,7 +32,8 @@#define BLIST_IGN_MEDIA_CHANGE ((__force blist_flags_t)(1ULL << 11))/* do not do automatic start on add */ #define BLIST_NOSTARTONADD ((__force blist_flags_t)(1ULL << 12)) -#define __BLIST_UNUSED_13 ((__force blist_flags_t)(1ULL << 13)) +/* do not ask for VPD page size first on some broken targets */ +#define BLIST_NO_VPD_SIZE ((__force blist_flags_t)(1ULL << 13))#define __BLIST_UNUSED_14 ((__force blist_flags_t)(1ULL << 14))#define __BLIST_UNUSED_15 ((__force blist_flags_t)(1ULL << 15))#define __BLIST_UNUSED_16 ((__force blist_flags_t)(1ULL << 16))
@@ -74,8 +75,7 @@#define __BLIST_HIGH_UNUSED (~(__BLIST_LAST_USED | \ (__force blist_flags_t) \ ((__force __u64)__BLIST_LAST_USED - 1ULL))) -#define __BLIST_UNUSED_MASK (__BLIST_UNUSED_13 | \ - __BLIST_UNUSED_14 | \ +#define __BLIST_UNUSED_MASK (__BLIST_UNUSED_14 | \ __BLIST_UNUSED_15 | \ __BLIST_UNUSED_16 | \ __BLIST_UNUSED_24 | \
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 31/211 scsi: core: Fix a procfs host directory removal regression
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit be03df3d4bfe7e8866d4aa43d62e648ffe884f5f ]
scsi_proc_hostdir_rm() decreases a reference counter and hence must only be called once per host that is removed. This change does not require a scsi_add_host_with_dma() change since scsi_add_host_with_dma() will return 0 (success) if scsi_proc_host_add() is called.
--- drivers/scsi/hosts.c | 3 --- 1 file changed, 3 deletions(-)
drivers/scsi/hosts.c +0 -3
@@ -341,9 +341,6 @@ static void scsi_host_dev_release(struct device *dev)struct Scsi_Host *shost =dev_to_shost (dev);struct device *parent = dev->parent; -/* In case scsi_remove_host() has not been called. */ -scsi_proc_hostdir_rm (shost->hostt); -/* Wait for functions invoked through call_rcu(&scmd->rcu, ...) */ rcu_barrier ();
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 32/211 ftrace,kcfi: Define ftrace_stub_graph conditionally
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit aa69f814920d85a2d4cfd5c294757c3d59d2fba6 ]
When CONFIG_FUNCTION_GRAPH_TRACER is disabled, __kcfi_typeid_ftrace_stub_graph is missing, causing a link failure:
ld.lld: error: undefined symbol: __kcfi_typeid_ftrace_stub_graph referenced by arch/x86/kernel/ftrace_64.o:(__cfi_ftrace_stub_graph) in archive vmlinux.a
Mark the reference to it as conditional on the same symbol, as is done on arm64.
See-also: 2598ac6ec493 ("arm64: ftrace: Define ftrace_stub_graph only with FUNCTION_GRAPH_TRACER")
--- arch/x86/kernel/ftrace_64.S | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/kernel/ftrace_64.S +2 -0
@@ -136,10 +136,12 @@ SYM_TYPED_FUNC_START(ftrace_stub) RET SYM_FUNC_END(ftrace_stub) +#ifdef CONFIG_FUNCTION_GRAPH_TRACER SYM_TYPED_FUNC_START(ftrace_stub_graph) CALL_DEPTH_ACCOUNT RET SYM_FUNC_END(ftrace_stub_graph) +#endif #ifdef CONFIG_DYNAMIC_FTRACE
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 33/211 tcp: tcp_make_synack() can be called from process context
In reply to Greg Kroah-HartmanFrom: Breno Leitao <[email protected]>
[ Upstream commit bced3f7db95ff2e6ca29dc4d1c9751ab5e736a09 ]
tcp_rtx_synack() now could be called in process context as explained in 0a375c822497 ("tcp: tcp_rtx_synack() can be called from process context").
tcp_rtx_synack() might call tcp_make_synack(), which will touch per-CPU variables with preemption enabled. This causes the following BUG:
BUG: using __this_cpu_add() in preemptible [00000000] code: ThriftIO1/5464
caller is tcp_make_synack+0x841/0xac0
Call Trace:
<TASK>
dump_stack_lvl+0x10d/0x1a0
check_preemption_disabled+0x104/0x110
tcp_make_synack+0x841/0xac0
tcp_v6_send_synack+0x5c/0x450
tcp_rtx_synack+0xeb/0x1f0
inet_rtx_syn_ack+0x34/0x60
tcp_check_req+0x3af/0x9e0
tcp_rcv_state_process+0x59b/0x2030
tcp_v6_do_rcv+0x5f5/0x700
release_sock+0x3a/0xf0
tcp_sendmsg+0x33/0x40
____sys_sendmsg+0x2f2/0x490
__sys_sendmsg+0x184/0x230
do_syscall_64+0x3d/0x90Avoid calling __TCP_INC_STATS() with will touch per-cpu variables. Use TCP_INC_STATS() which is safe to be called from context switch.
--- net/ipv4/tcp_output.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/tcp_output.c +1 -1
@@ -3605,7 +3605,7 @@ struct sk_buff *tcp_make_synack(const struct sock *sk, struct dst_entry *dst, th->window =htons (min (req->rsk_rcv_wnd,65535U ));tcp_options_write (th,NULL , &opts); th->doff = (tcp_header_size >>2 ); -__TCP_INC_STATS (sock_net (sk),TCP_MIB_OUTSEGS ); +TCP_INC_STATS (sock_net (sk),TCP_MIB_OUTSEGS );#ifdef CONFIG_TCP_MD5SIG /* Okay, we have all we need - do the md5 hash if needed */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 34/211 vdpa/mlx5: should not activate virtq object when suspended
In reply to Greg Kroah-HartmanFrom: Si-Wei Liu <[email protected]>
[ Upstream commit 09e65ee9059d76b89cb713795748805efd3f50c6 ]
Otherwise the virtqueue object to instate could point to invalid address that was unmapped from the MTT:
mlx5_core 0000:41:04.2: mlx5_cmd_out_err:782:(pid 8321):
CREATE_GENERAL_OBJECT(0xa00) op_mod(0xd) failed, status bad parameter(0x3), syndrome (0x5fa1c), err(-22)
Message-Id: <[email protected]>
--- drivers/vdpa/mlx5/core/mlx5_vdpa.h | 1 + drivers/vdpa/mlx5/net/mlx5_vnet.c | 6 +++++- 2 files changed, 6 insertions(+), 1 deletion(-)
drivers/vdpa/mlx5/core/mlx5_vdpa.h +1 -0
@@ -96,6 +96,7 @@ struct mlx5_vdpa_dev {struct mlx5_control_vq cvq;struct workqueue_struct *wq;unsigned int group2asid[MLX5_VDPA_NUMVQ_GROUPS ]; +bool suspended; };int mlx5_vdpa_alloc_pd (struct mlx5_vdpa_dev *dev,u32 *pdn,u16 uid);
drivers/vdpa/mlx5/net/mlx5_vnet.c +5 -1
@@ -2411,7 +2411,7 @@ static int mlx5_vdpa_change_map(struct mlx5_vdpa_dev *mvdev,if (err) goto err_mr; -if (!(mvdev->status &VIRTIO_CONFIG_S_DRIVER_OK )) +if (!(mvdev->status &VIRTIO_CONFIG_S_DRIVER_OK ) || mvdev->suspended) goto err_mr;restore_channels_info (ndev);
@@ -2579,6 +2579,7 @@ static int mlx5_vdpa_reset(struct vdpa_device *vdev)clear_vqs_ready (ndev);mlx5_vdpa_destroy_mr (&ndev->mvdev); ndev->mvdev.status =0 ; + ndev->mvdev.suspended = false; ndev->cur_num_vqs =0 ; ndev->mvdev.cvq.received_desc =0 ; ndev->mvdev.cvq.completed_desc =0 ;
@@ -2815,6 +2816,8 @@ static int mlx5_vdpa_suspend(struct vdpa_device *vdev)struct mlx5_vdpa_virtqueue *mvq;int i; +mlx5_vdpa_info (mvdev,"suspending device\n" ); +down_write (&ndev->reslock); ndev->nb_registered = false;mlx5_notifier_unregister (mvdev->mdev, &ndev->nb);
@@ -2824,6 +2827,7 @@ static int mlx5_vdpa_suspend(struct vdpa_device *vdev)suspend_vq (ndev, mvq); }mlx5_vdpa_cvq_suspend (mvdev); + mvdev->suspended = true;up_write (&ndev->reslock);return 0 ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 35/211 wifi: nl80211: fix NULL-ptr deref in offchan check
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit f624bb6fad23df3270580b4fcef415c6e7bf7705 ]
If, e.g. in AP mode, the link was already created by userspace but not activated yet, it has a chandef but the chandef isn't valid and has no channel. Check for this and ignore this link.
--- net/wireless/nl80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/wireless/nl80211.c +1 -1
@@ -8816,7 +8816,7 @@ static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev,struct cfg80211_chan_def *chandef; chandef =wdev_chandef (wdev, link_id); -if (!chandef) +if (!chandef || !chandef->chan)continue ;/*
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 36/211 wifi: cfg80211: fix MLO connection ownership
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit 96c069508377547f913e7265a80fffe9355de592 ]
When disconnecting from an MLO connection we need the AP MLD address, not an arbitrary BSSID. Fix the code to do that.
--- net/wireless/nl80211.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-)
net/wireless/nl80211.c +7 -9
@@ -10700,8 +10700,7 @@ static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,static struct cfg80211_bss *nl80211_assoc_bss (struct cfg80211_registered_device *rdev,const u8 *ssid,int ssid_len, -struct nlattr **attrs, -const u8 **bssid_out) +struct nlattr **attrs) {struct ieee80211_channel *chan;struct cfg80211_bss *bss;
@@ -10728,7 +10727,6 @@ static struct cfg80211_bss *nl80211_assoc_bss(struct cfg80211_registered_deviceif (!bss)return ERR_PTR (-ENOENT ); - *bssid_out = bssid;return bss; }
@@ -10738,7 +10736,7 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)struct net_device *dev = info->user_ptr[1 ];struct cfg80211_assoc_request req = {};struct nlattr **attrs =NULL ; -const u8 *bssid, *ssid; +const u8 *ap_addr, *ssid;unsigned int link_id;int err, ssid_len;
@@ -10875,6 +10873,7 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)return -EINVAL ; req.ap_mld_addr =nla_data (info->attrs[NL80211_ATTR_MLD_ADDR ]); + ap_addr = req.ap_mld_addr; attrs =kzalloc (attrsize,GFP_KERNEL );if (!attrs)
@@ -10900,8 +10899,7 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info) goto free; } req.links[link_id].bss = -nl80211_assoc_bss (rdev, ssid, ssid_len, attrs, - &bssid); +nl80211_assoc_bss (rdev, ssid, ssid_len, attrs);if (IS_ERR (req.links[link_id].bss)) { err =PTR_ERR (req.links[link_id].bss); req.links[link_id].bss =NULL ;
@@ -10952,10 +10950,10 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)if (req.link_id >=0 )return -EINVAL ; - req.bss =nl80211_assoc_bss (rdev, ssid, ssid_len, info->attrs, - &bssid); + req.bss =nl80211_assoc_bss (rdev, ssid, ssid_len, info->attrs);if (IS_ERR (req.bss))return PTR_ERR (req.bss); + ap_addr = req.bss->bssid; } err =nl80211_crypto_settings (rdev, info, &req.crypto,1 );
@@ -10968,7 +10966,7 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info) dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;memcpy (dev->ieee80211_ptr->disconnect_bssid, - bssid,ETH_ALEN ); + ap_addr,ETH_ALEN ); }wdev_unlock (dev->ieee80211_ptr);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 37/211 selftests: fix LLVM build for i386 and x86_64
In reply to Greg Kroah-HartmanFrom: Guillaume Tucker <[email protected]>
[ Upstream commit 624c60f326c6e5a80b008e8a5c7feffe8c27dc72 ]
Add missing cases for the i386 and x86_64 architectures when determining the LLVM target for building kselftest.
--- tools/testing/selftests/lib.mk | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/lib.mk +2 -0
@@ -10,12 +10,14 @@ endif CLANG_TARGET_FLAGS_arm := arm-linux-gnueabi CLANG_TARGET_FLAGS_arm64 := aarch64-linux-gnu CLANG_TARGET_FLAGS_hexagon := hexagon-linux-musl +CLANG_TARGET_FLAGS_i386 := i386-linux-gnu CLANG_TARGET_FLAGS_m68k := m68k-linux-gnu CLANG_TARGET_FLAGS_mips := mipsel-linux-gnu CLANG_TARGET_FLAGS_powerpc := powerpc64le-linux-gnu CLANG_TARGET_FLAGS_riscv := riscv64-linux-gnu CLANG_TARGET_FLAGS_s390 := s390x-linux-gnu CLANG_TARGET_FLAGS_x86 := x86_64-linux-gnu +CLANG_TARGET_FLAGS_x86_64 := x86_64-linux-gnu CLANG_TARGET_FLAGS := $(CLANG_TARGET_FLAGS_$(ARCH)) ifeq ($(CROSS_COMPILE),)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 38/211 nfc: pn533: initialize struct pn533_out_arg properly
In reply to Greg Kroah-HartmanFrom: Fedor Pchelkin <[email protected]>
[ Upstream commit 484b7059796e3bc1cb527caa61dfc60da649b4f6 ]
struct pn533_out_arg used as a temporary context for out_urb is not initialized properly. Its uninitialized 'phy' field can be dereferenced in error cases inside pn533_out_complete() callback function. It causes the following failure:
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.2.0-rc3-next-20230110-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 RIP: 0010:pn533_out_complete.cold+0x15/0x44 drivers/nfc/pn533/usb.c:441 Call Trace: <IRQ> __usb_hcd_giveback_urb+0x2b6/0x5c0 drivers/usb/core/hcd.c:1671 usb_hcd_giveback_urb+0x384/0x430 drivers/usb/core/hcd.c:1754 dummy_timer+0x1203/0x32d0 drivers/usb/gadget/udc/dummy_hcd.c:1988 call_timer_fn+0x1da/0x800 kernel/time/timer.c:1700 expire_timers+0x234/0x330 kernel/time/timer.c:1751 __run_timers kernel/time/timer.c:2022 [inline] __run_timers kernel/time/timer.c:1995 [inline] run_timer_softirq+0x326/0x910 kernel/time/timer.c:2035 __do_softirq+0x1fb/0xaf6 kernel/softirq.c:571 invoke_softirq kernel/softirq.c:445 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650 irq_exit_rcu+0x9/0x20 kernel/softirq.c:662 sysvec_apic_timer_interrupt+0x97/0xc0 arch/x86/kernel/apic/apic.c:1107
Initialize the field with the pn533_usb_phy currently used.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- drivers/nfc/pn533/usb.c | 1 + 1 file changed, 1 insertion(+)
drivers/nfc/pn533/usb.c +1 -0
@@ -175,6 +175,7 @@ static int pn533_usb_send_frame(struct pn533 *dev,print_hex_dump_debug ("PN533 TX: " ,DUMP_PREFIX_NONE ,16 ,1 , out->data, out->len, false); + arg.phy = phy;init_completion (&arg.done); cntx = phy->out_urb->context; phy->out_urb->context = &arg;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 39/211 ipvlan: Make skb->skb_iif track skb->dev for l3s mode
In reply to Greg Kroah-HartmanFrom: Jianguo Wu <[email protected]>
[ Upstream commit 59a0b022aa249e3f5735d93de0849341722c4754 ]
For l3s mode, skb->dev is set to ipvlan interface in ipvlan_nf_input():
skb->dev = addr->master->dev
but, skb->skb_iif remain unchanged, this will cause socket lookup failed if a target socket is bound to a interface, like the following example:
ip link add ipvlan0 link eth0 type ipvlan mode l3s ip addr add dev ipvlan0 192.168.124.111/24 ip link set ipvlan0 up
ping -c 1 -I ipvlan0 8.8.8.8
100% packet loss
This is because there is no match sk in __raw_v4_lookup() as sk->sk_bound_dev_if != dif(skb->skb_iif). Fix this by make skb->skb_iif track skb->dev in ipvlan_nf_input().
--- drivers/net/ipvlan/ipvlan_l3s.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ipvlan/ipvlan_l3s.c +1 -0
@@ -101,6 +101,7 @@ static unsigned int ipvlan_nf_input(void *priv, struct sk_buff *skb, goto out; skb->dev = addr->master->dev; + skb->skb_iif = skb->dev->ifindex; len = skb->len +ETH_HLEN ;ipvlan_count_rx (addr->master, len, true, false); out:
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 40/211 i40e: Fix kernel crash during reboot when adapter is in recovery mode
In reply to Greg Kroah-HartmanFrom: Ivan Vecera <[email protected]>
[ Upstream commit 7e4f8a0c495413a50413e8c9f1032ce1bc633bae ]
If the driver detects during probe that firmware is in recovery mode then i40e_init_recovery_mode() is called and the rest of probe function is skipped including pci_set_drvdata(). Subsequent i40e_shutdown() called during shutdown/reboot dereferences NULL pointer as pci_get_drvdata() returns NULL.
To fix call pci_set_drvdata() also during entering to recovery mode.
Reproducer:
1) Lets have i40e NIC with firmware in recovery mode
2) Run reboot
Result:
[ 139.084698] i40e: Intel(R) Ethernet Connection XL710 Network Driver [ 139.090959] i40e: Copyright (c) 2013 - 2019 Intel Corporation. [ 139.108438] i40e 0000:02:00.0: Firmware recovery mode detected. Limiting functionality. [ 139.116439] i40e 0000:02:00.0: Refer to the Intel(R) Ethernet Adapters and Devices User Guide for details on firmware recovery mode. [ 139.129499] i40e 0000:02:00.0: fw 8.3.64775 api 1.13 nvm 8.30 0x8000b78d 1.3106.0 [8086:1583] [15d9:084a] [ 139.215932] i40e 0000:02:00.0 enp2s0f0: renamed from eth0 [ 139.223292] i40e 0000:02:00.1: Firmware recovery mode detected. Limiting functionality. [ 139.231292] i40e 0000:02:00.1: Refer to the Intel(R) Ethernet Adapters and Devices User Guide for details on firmware recovery mode. [ 139.244406] i40e 0000:02:00.1: fw 8.3.64775 api 1.13 nvm 8.30 0x8000b78d 1.3106.0 [8086:1583] [15d9:084a] [ 139.329209] i40e 0000:02:00.1 enp2s0f1: renamed from eth0 ... [ 156.311376] BUG: kernel NULL pointer dereference, address: 00000000000006c2 [ 156.318330] #PF: supervisor write access in kernel mode [ 156.323546] #PF: error_code(0x0002) - not-present page [ 156.328679] PGD 0 P4D 0 [ 156.331210] Oops: 0002 [#1] PREEMPT SMP NOPTI [ 156.335567] CPU: 26 PID: 15119 Comm: reboot Tainted: G E 6.2.0+ #1 [ 156.343126] Hardware name: Abacus electric, s.r.o. - [email protected] Super Server/H12SSW-iN, BIOS 2.4 04/13/2022 [ 156.353369] RIP: 0010:i40e_shutdown+0x15/0x130 [i40e] [ 156.358430] Code: c1 fc ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 55 48 89 fd 53 48 8b 9f 48 01 00 00 <f0> 80 8b c2 06 00 00 04 f0 80 8b c0 06 00 00 08 48 8d bb 08 08 00 [ 156.377168] RSP: 0018:ffffb223c8447d90 EFLAGS: 00010282 [ 156.382384] RAX: ffffffffc073ee70 RBX: 0000000000000000 RCX: 0000000000000001 [ 156.389510] RDX: 0000000080000001 RSI: 0000000000000246 RDI: ffff95db49988000 [ 156.396634] RBP: ffff95db49988000 R08: ffffffffffffffff R09: ffffffff8bd17d40 [ 156.403759] R10: 0000000000000001 R11: ffffffff8a5e3d28 R12: ffff95db49988000 [ 156.410882] R13: ffffffff89a6fe17 R14: ffff95db49988150 R15: 0000000000000000 [ 156.418007] FS: 00007fe7c0cc3980(0000) GS:ffff95ea8ee80000(0000) knlGS:0000000000000000 [ 156.426083] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 156.431819] CR2: 00000000000006c2 CR3: 00000003092fc005 CR4: 0000000000770ee0 [ 156.438944] PKRU: 55555554 [ 156.441647] Call Trace: [ 156.444096] <TASK> [ 156.446199] pci_device_shutdown+0x38/0x60 [ 156.450297] device_shutdown+0x163/0x210 [ 156.454215] kernel_restart+0x12/0x70 [ 156.457872] __do_sys_reboot+0x1ab/0x230 [ 156.461789] ? vfs_writev+0xa6/0x1a0 [ 156.465362] ? __pfx_file_free_rcu+0x10/0x10 [ 156.469635] ? __call_rcu_common.constprop.85+0x109/0x5a0 [ 156.475034] do_syscall_64+0x3e/0x90 [ 156.478611] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 156.483658] RIP: 0033:0x7fe7bff37ab7
--- drivers/net/ethernet/intel/i40e/i40e_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/intel/i40e/i40e_main.c +1 -0
@@ -15518,6 +15518,7 @@ static int i40e_init_recovery_mode(struct i40e_pf *pf, struct i40e_hw *hw)int err;int v_idx; +pci_set_drvdata (pf->pdev, pf);pci_save_state (pf->pdev);/* set up periodic task facility */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 41/211 vhost-vdpa: free iommu domain after last use during cleanup
In reply to Greg Kroah-HartmanFrom: Gautam Dawar <[email protected]>
[ Upstream commit 5a522150093a0eabae9470a70a37a6e436bfad08 ]
Currently vhost_vdpa_cleanup() unmaps the DMA mappings by calling iommu_unmap(v->domain, map->start, map->size);
from vhost_vdpa_general_unmap() when the parent vDPA driver doesn't provide DMA config operations.
However, the IOMMU domain referred to by v->domain is freed in vhost_vdpa_free_domain() before vhost_vdpa_cleanup() in vhost_vdpa_release() which results in NULL pointer de-reference. Accordingly, moving the call to vhost_vdpa_free_domain() in vhost_vdpa_cleanup() would makes sense. This will also help detaching the dma device in error handling of vhost_vdpa_alloc_domain().
This issue was observed on terminating QEMU with SIGQUIT.
Message-Id: <[email protected]>
--- drivers/vhost/vdpa.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/vhost/vdpa.c +2 -1
@@ -1134,6 +1134,7 @@ static int vhost_vdpa_alloc_domain(struct vhost_vdpa *v) err_attach:iommu_domain_free (v->domain); + v->domain =NULL ;return ret; }
@@ -1178,6 +1179,7 @@ static void vhost_vdpa_cleanup(struct vhost_vdpa *v)vhost_vdpa_remove_as (v, asid); } +vhost_vdpa_free_domain (v);vhost_dev_cleanup (&v->vdev);kfree (v->vdev.vqs); }
@@ -1250,7 +1252,6 @@ static int vhost_vdpa_release(struct inode *inode, struct file *filep)vhost_vdpa_clean_irq (v);vhost_vdpa_reset (v);vhost_dev_stop (&v->vdev); -vhost_vdpa_free_domain (v);vhost_vdpa_config_put (v);vhost_vdpa_cleanup (v);mutex_unlock (&d->mutex);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 42/211 vdpa_sim: not reset state in vdpasim_queue_ready
In reply to Greg Kroah-HartmanFrom: Eugenio Pérez <[email protected]>
[ Upstream commit 0e84f918fac8ae61dcb790534fad5e3555ca2930 ]
vdpasim_queue_ready calls vringh_init_iotlb, which resets split indexes. But it can be called after setting a ring base with vdpasim_set_vq_state.
Fix it by stashing them. They're still resetted in vdpasim_vq_reset.
This was discovered and tested live migrating the vdpa_sim_net device.
Message-Id: <[email protected]>
Stable-dep-of: b4cca6d48eb3 ("vdpa_sim: set last_used_idx as last_avail_idx in vdpasim_queue_ready")
--- drivers/vdpa/vdpa_sim/vdpa_sim.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/vdpa/vdpa_sim/vdpa_sim.c +2 -0
@@ -66,6 +66,7 @@ static void vdpasim_vq_notify(struct vringh *vring)static void vdpasim_queue_ready (struct vdpasim *vdpasim,unsigned int idx) {struct vdpasim_virtqueue *vq = &vdpasim->vqs[idx]; +uint16_t last_avail_idx = vq->vring.last_avail_idx; vringh_init_iotlb(&vq->vring, vdpasim->features, vq->num, false, (struct vring_desc *)(uintptr_t)vq->desc_addr,
@@ -74,6 +75,7 @@ static void vdpasim_queue_ready(struct vdpasim *vdpasim, unsigned int idx) (struct vring_used *) (uintptr_t)vq->device_addr); + vq->vring.last_avail_idx = last_avail_idx; vq->vring.notify = vdpasim_vq_notify; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 43/211 vdpa_sim: set last_used_idx as last_avail_idx in vdpasim_queue_ready
In reply to Greg Kroah-HartmanFrom: Eugenio Pérez <[email protected]>
[ Upstream commit b4cca6d48eb3fa6f0d9caba4329b1a2b0ff67a77 ]
Starting from an used_idx different than 0 is needed in use cases like virtual machine migration. Not doing so and letting the caller set an avail idx different than 0 causes destination device to try to use old buffers that source driver already recover and are not available anymore.
Since vdpa_sim does not support receive inflight descriptors as a destination of a migration, let's set both avail_idx and used_idx the same at vq start. This is how vhost-user works in a VHOST_SET_VRING_BASE call.
Although the simple fix is to set last_used_idx at vdpasim_set_vq_state, it would be reset at vdpasim_queue_ready. The last_avail_idx case is fixed with commit 0e84f918fac8 ("vdpa_sim: not reset state in vdpasim_queue_ready"). Since the only option is to make it equal to last_avail_idx, adding the only change needed here.
This was discovered and tested live migrating the vdpa_sim_net device.
Message-Id: <[email protected]>
--- drivers/vdpa/vdpa_sim/vdpa_sim.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/vdpa/vdpa_sim/vdpa_sim.c +11 -0
@@ -76,6 +76,17 @@ static void vdpasim_queue_ready(struct vdpasim *vdpasim, unsigned int idx) (uintptr_t)vq->device_addr); vq->vring.last_avail_idx = last_avail_idx; + +/* +* Since vdpa_sim does not support receive inflight descriptors as a +* destination of a migration, let's set both avail_idx and used_idx +* the same at vq start. This is how vhost-user works in a +* VHOST_SET_VRING_BASE call. +* +* Although the simple fix is to set last_used_idx at +* vdpasim_set_vq_state, it would be reset at vdpasim_queue_ready. +*/ + vq->vring.last_used_idx = last_avail_idx; vq->vring.notify = vdpasim_vq_notify; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 44/211 PCI: s390: Fix use-after-free of PCI resources with per-function hotplug
In reply to Greg Kroah-HartmanFrom: Niklas Schnelle <[email protected]>
[ Upstream commit ab909509850b27fd39b8ba99e44cda39dbc3858c ]
On s390 PCI functions may be hotplugged individually even when they belong to a multi-function device. In particular on an SR-IOV device VFs may be removed and later re-added.
In commit a50297cf8235 ("s390/pci: separate zbus creation from scanning") it was missed however that struct pci_bus and struct zpci_bus's resource list retained a reference to the PCI functions MMIO resources even though those resources are released and freed on hot-unplug. These stale resources may subsequently be claimed when the PCI function re-appears resulting in use-after-free.
One idea of fixing this use-after-free in s390 specific code that was investigated was to simply keep resources around from the moment a PCI function first appeared until the whole virtual PCI bus created for a multi-function device disappears. The problem with this however is that due to the requirement of artificial MMIO addreesses (address cookies) extra logic is then needed to keep the address cookies compatible on re-plug. At the same time the MMIO resources semantically belong to the PCI function so tying their lifecycle to the function seems more logical.
Instead a simpler approach is to remove the resources of an individually hot-unplugged PCI function from the PCI bus's resource list while keeping the resources of other PCI functions on the PCI bus untouched.
This is done by introducing pci_bus_remove_resource() to remove an individual resource. Similarly the resource also needs to be removed from the struct zpci_bus's resource list. It turns out however, that there is really no need to add the MMIO resources to the struct zpci_bus's resource list at all and instead we can simply use the zpci_bar_struct's resource pointer directly.
--- arch/s390/pci/pci.c | 16 ++++++++++------ arch/s390/pci/pci_bus.c | 12 +++++------- arch/s390/pci/pci_bus.h | 3 +-- drivers/pci/bus.c | 21 +++++++++++++++++++++ include/linux/pci.h | 1 + 5 files changed, 38 insertions(+), 15 deletions(-)
arch/s390/pci/pci.c +10 -6
@@ -544,8 +544,7 @@ static struct resource *__alloc_res(struct zpci_dev *zdev, unsigned long start,return r; } -int zpci_setup_bus_resources (struct zpci_dev *zdev, -struct list_head *resources) +int zpci_setup_bus_resources (struct zpci_dev *zdev) {unsigned long addr, size, flags;struct resource *res;
@@ -581,7 +580,6 @@ int zpci_setup_bus_resources(struct zpci_dev *zdev,return -ENOMEM ; } zdev->bars[i].res = res; -pci_add_resource (resources, res); } zdev->has_resources =1 ;
@@ -590,17 +588,23 @@ int zpci_setup_bus_resources(struct zpci_dev *zdev,static void zpci_cleanup_bus_resources (struct zpci_dev *zdev) { +struct resource *res;int i; +pci_lock_rescan_remove ();for (i =0 ; i <PCI_STD_NUM_BARS ; i++) { -if (!zdev->bars[i].size || !zdev->bars[i].res) + res = zdev->bars[i].res; +if (!res)continue ; +release_resource (res); +pci_bus_remove_resource (zdev->zbus->bus, res);zpci_free_iomap (zdev, zdev->bars[i].map_idx); -release_resource (zdev->bars[i].res); -kfree (zdev->bars[i].res); + zdev->bars[i].res =NULL ; +kfree (res); } zdev->has_resources =0 ; +pci_unlock_rescan_remove (); }int pcibios_device_add (struct pci_dev *pdev)
arch/s390/pci/pci_bus.c +5 -7
@@ -41,9 +41,7 @@ static int zpci_nb_devices;*/ static int zpci_bus_prepare_device (struct zpci_dev *zdev) { -struct resource_entry *window, *n; -struct resource *res; -int rc; +int rc, i;if (!zdev_enabled (zdev)) { rc =zpci_enable_device (zdev);
@@ -57,10 +55,10 @@ static int zpci_bus_prepare_device(struct zpci_dev *zdev) }if (!zdev->has_resources) { -zpci_setup_bus_resources (zdev, &zdev->zbus->resources); -resource_list_for_each_entry_safe (window, n, &zdev->zbus->resources) { - res = window->res; -pci_bus_add_resource (zdev->zbus->bus, res,0 ); +zpci_setup_bus_resources (zdev); +for (i =0 ; i <PCI_STD_NUM_BARS ; i++) { +if (zdev->bars[i].res) +pci_bus_add_resource (zdev->zbus->bus, zdev->bars[i].res,0 ); } }
arch/s390/pci/pci_bus.h +1 -2
@@ -30,8 +30,7 @@ static inline void zpci_zdev_get(struct zpci_dev *zdev)int zpci_alloc_domain (int domain);void zpci_free_domain (int domain); -int zpci_setup_bus_resources (struct zpci_dev *zdev, -struct list_head *resources); +int zpci_setup_bus_resources (struct zpci_dev *zdev);static inline struct zpci_dev *zdev_from_bus (struct pci_bus *bus,unsigned int devfn)
drivers/pci/bus.c +21 -0
@@ -76,6 +76,27 @@ struct resource *pci_bus_resource_n(const struct pci_bus *bus, int n) }EXPORT_SYMBOL_GPL (pci_bus_resource_n); +void pci_bus_remove_resource (struct pci_bus *bus,struct resource *res) +{ +struct pci_bus_resource *bus_res, *tmp; +int i; + +for (i =0 ; i <PCI_BRIDGE_RESOURCE_NUM ; i++) { +if (bus->resource[i] == res) { + bus->resource[i] =NULL ; +return ; + } + } + +list_for_each_entry_safe (bus_res, tmp, &bus->resources, list) { +if (bus_res->res == res) { +list_del (&bus_res->list); +kfree (bus_res); +return ; + } + } +} +void pci_bus_remove_resources (struct pci_bus *bus) {int i;
include/linux/pci.h +1 -0
@@ -1437,6 +1437,7 @@ void pci_bus_add_resource(struct pci_bus *bus, struct resource *res, unsigned int flags);struct resource *pci_bus_resource_n (const struct pci_bus *bus,int n);void pci_bus_remove_resources (struct pci_bus *bus); +void pci_bus_remove_resource (struct pci_bus *bus,struct resource *res);int devm_request_pci_bus_resources (struct device *dev,struct list_head *resources);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 45/211 drm/i915/psr: Use calculated io and fast wake lines
In reply to Greg Kroah-HartmanFrom: Jouni Högander <[email protected]>
[ Upstream commit 71c602103c74b277bef3d20a308874a33ec8326d ]
Currently we are using hardcoded 7 for io and fast wake lines.
According to Bspec io and fast wake times are both 42us for DISPLAY_VER >= 12 and 50us and 32us for older platforms.
Calculate line counts for these and configure them into PSR2_CTL accordingly
Use 45 us for the fast wake calculation as 42 seems to be too tight based on testing.
Bspec: 49274, 4289
--- .../drm/i915/display/intel_display_types.h | 2 + drivers/gpu/drm/i915/display/intel_psr.c | 78 +++++++++++++++---- 2 files changed, 63 insertions(+), 17 deletions(-)
drivers/gpu/drm/i915/display/intel_display_types.h +2 -0
@@ -1618,6 +1618,8 @@ struct intel_psr {bool psr2_sel_fetch_cff_enabled;bool req_psr2_sdp_prior_scanline;u8 sink_sync_latency; +u8 io_wake_lines; +u8 fast_wake_lines;ktime_t last_entry_attempt;ktime_t last_exit;bool sink_not_reliable;
drivers/gpu/drm/i915/display/intel_psr.c +61 -17
110 lines not on this page · raw message
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 46/211 drm/i915/sseu: fix max_subslices array-index-out-of-bounds access
In reply to Greg Kroah-HartmanFrom: Andrea Righi <[email protected]>
[ Upstream commit 193c41926d152761764894f46e23b53c00186a82 ]
It seems that commit bc3c5e0809ae ("drm/i915/sseu: Don't try to store EU mask internally in UAPI format") exposed a potential out-of-bounds access, reported by UBSAN as following on a laptop with a gen 11 i915 card:
UBSAN: array-index-out-of-bounds in drivers/gpu/drm/i915/gt/intel_sseu.c:65:27 index 6 is out of range for type 'u16 [6]' CPU: 2 PID: 165 Comm: systemd-udevd Not tainted 6.2.0-9-generic #9-Ubuntu Hardware name: Dell Inc. XPS 13 9300/077Y9N, BIOS 1.11.0 03/22/2022 Call Trace: <TASK> show_stack+0x4e/0x61 dump_stack_lvl+0x4a/0x6f dump_stack+0x10/0x18 ubsan_epilogue+0x9/0x3a __ubsan_handle_out_of_bounds.cold+0x42/0x47 gen11_compute_sseu_info+0x121/0x130 [i915] intel_sseu_info_init+0x15d/0x2b0 [i915] intel_gt_init_mmio+0x23/0x40 [i915] i915_driver_mmio_probe+0x129/0x400 [i915] ? intel_gt_probe_all+0x91/0x2e0 [i915] i915_driver_probe+0xe1/0x3f0 [i915] ? drm_privacy_screen_get+0x16d/0x190 [drm] ? acpi_dev_found+0x64/0x80 i915_pci_probe+0xac/0x1b0 [i915] ...
According to the definition of sseu_dev_info, eu_mask->hsw is limited to a maximum of GEN_MAX_SS_PER_HSW_SLICE (6) sub-slices, but gen11_sseu_info_init() can potentially set 8 sub-slices, in the !IS_JSL_EHL(gt->i915) case.
Fix this by reserving up to 8 slots for max_subslices in the eu_mask struct.
--- drivers/gpu/drm/i915/gt/intel_sseu.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/i915/gt/intel_sseu.h +1 -1
@@ -27,7 +27,7 @@ struct drm_printer;* is only relevant to pre-Xe_HP platforms (Xe_HP and beyond use the * I915_MAX_SS_FUSE_BITS value below). */ -#define GEN_MAX_SS_PER_HSW_SLICE 6 +#define GEN_MAX_SS_PER_HSW_SLICE 8/* * Maximum number of 32-bit registers used by hardware to express the
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 47/211 bnxt_en: reset PHC frequency in free-running mode
In reply to Greg Kroah-HartmanFrom: Vadim Fedorenko <[email protected]>
[ Upstream commit 131db499162274858bdbd7b5323a639da4aab86c ]
When using a PHC in shared between multiple hosts, the previous frequency value may not be reset and could lead to host being unable to compensate the offset with timecounter adjustments. To avoid such state reset the hardware frequency of PHC to zero on init. Some refactoring is needed to make code readable.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 +- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 2 + drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 56 ++++++++++--------- 3 files changed, 35 insertions(+), 29 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +2 -4
@@ -6991,11 +6991,9 @@ static int bnxt_hwrm_func_qcfg(struct bnxt *bp)if (flags &FUNC_QCFG_RESP_FLAGS_FW_DCBX_AGENT_ENABLED ) bp->fw_cap |=BNXT_FW_CAP_DCBX_AGENT ; } -if (BNXT_PF (bp) && (flags &FUNC_QCFG_RESP_FLAGS_MULTI_HOST )) { +if (BNXT_PF (bp) && (flags &FUNC_QCFG_RESP_FLAGS_MULTI_HOST )) bp->flags |=BNXT_FLAG_MULTI_HOST ; -if (bp->fw_cap &BNXT_FW_CAP_PTP_RTC ) - bp->fw_cap &= ~BNXT_FW_CAP_PTP_RTC ; - } +if (flags &FUNC_QCFG_RESP_FLAGS_RING_MONITOR_ENABLED ) bp->fw_cap |=BNXT_FW_CAP_RING_MONITOR ;
drivers/net/ethernet/broadcom/bnxt/bnxt.h +2 -0
@@ -1992,6 +1992,8 @@ struct bnxt {u32 fw_dbg_cap;#define BNXT_NEW_RM (bp) ((bp)->fw_cap & BNXT_FW_CAP_NEW_RM) +#define BNXT_PTP_USE_RTC (bp) (!BNXT_MH(bp) && \ + ((bp)->fw_cap & BNXT_FW_CAP_PTP_RTC))u32 hwrm_spec_code;u16 hwrm_cmd_seq;u16 hwrm_cmd_kong_seq;
drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c +31 -25
99 lines not on this page · raw message
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 48/211 net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()
In reply to Greg Kroah-HartmanFrom: D. Wythe <[email protected]>
[ Upstream commit 22a825c541d775c1dbe7b2402786025acad6727b ]
When performing a stress test on SMC-R by rmmod mlx5_ib driver during the wrk/nginx test, we found that there is a probability of triggering a panic while terminating all link groups.
This issue dues to the race between smc_smcr_terminate_all() and smc_buf_create().
smc_smcr_terminate_all
smc_buf_create
/* init */conn->sndbuf_desc = NULL;
...
__smc_lgr_terminate smc_conn_kill smc_close_abort smc_cdc_get_slot_and_msg_send __softirqentry_text_start smc_wr_tx_process_cqe smc_cdc_tx_handler READ(conn->sndbuf_desc->len); /* panic dues to NULL sndbuf_desc */
conn->sndbuf_desc = xxx;
This patch tries to fix the issue by always to check the sndbuf_desc before send any cdc msg, to make sure that no null pointer is seen during cqe processing.
--- net/smc/smc_cdc.c | 3 +++ 1 file changed, 3 insertions(+)
net/smc/smc_cdc.c +3 -0
@@ -114,6 +114,9 @@ int smc_cdc_msg_send(struct smc_connection *conn,union smc_host_cursor cfed;int rc; +if (unlikely (!READ_ONCE (conn->sndbuf_desc))) +return -ENOBUFS ; +smc_cdc_add_pending_send (conn, pend); conn->tx_cdc_seq++;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 49/211 qed/qed_dev: guard against a possible division by zero
In reply to Greg Kroah-HartmanFrom: Daniil Tatianin <[email protected]>
[ Upstream commit 1a9dc5610ef89d807acdcfbff93a558f341a44da ]
Previously we would divide total_left_rate by zero if num_vports happened to be 1 because non_requested_count is calculated as num_vports - req_count. Guard against this by validating num_vports at the beginning and returning an error otherwise.
Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool.
--- drivers/net/ethernet/qlogic/qed/qed_dev.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/qlogic/qed/qed_dev.c +5 -0
@@ -5083,6 +5083,11 @@ static int qed_init_wfq_param(struct qed_hwfn *p_hwfn, num_vports = p_hwfn->qm_info.num_vports; +if (num_vports <2 ) { +DP_NOTICE (p_hwfn,"Unexpected num_vports: %d\n" , num_vports); +return -EINVAL ; + } +/* Accounting for the vports which are configured for WFQ explicitly */ for (i =0 ; i < num_vports; i++) {u32 tmp_speed;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 50/211 net: dsa: mt7530: remove now incorrect comment regarding port 5
In reply to Greg Kroah-HartmanFrom: Arınç ÜNAL <[email protected]>
[ Upstream commit feb03fd11c5616f3a47e4714d2f9917d0f1a2edd ]
Remove now incorrect comment regarding port 5 as GMAC5. This is supposed to be supported since commit 38f790a80560 ("net: dsa: mt7530: Add support for port 5") under mt7530_setup_port5().
--- drivers/net/dsa/mt7530.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/mt7530.c +1 -1
@@ -2206,7 +2206,7 @@ mt7530_setup(struct dsa_switch *ds)mt7530_pll_setup (priv); -/* Enable Port 6 only; P5 as GMAC5 which currently is not supported */ +/* Enable port 6 */ val =mt7530_read (priv,MT7530_MHWTRAP ); val &= ~MHWTRAP_P6_DIS & ~MHWTRAP_PHY_ACCESS ; val |=MHWTRAP_MANUAL ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 51/211 net: dsa: mt7530: set PLL frequency and trgmii only when trgmii is used
In reply to Greg Kroah-HartmanFrom: Arınç ÜNAL <[email protected]>
[ Upstream commit 0b086d76e7b011772b0ac214c6e5fd5816eff2df ]
As my testing on the MCM MT7530 switch on MT7621 SoC shows, setting the PLL frequency does not affect MII modes other than trgmii on port 5 and port 6. So the assumption is that the operation here called "setting the PLL frequency" actually sets the frequency of the TRGMII TX clock.
Make it so that it and the rest of the trgmii setup run only when the trgmii mode is used.
Tested rgmii and trgmii modes of port 6 on MCM MT7530 on MT7621AT Unielec U7621-06 and standalone MT7530 on MT7623NI Bananapi BPI-R2.
--- drivers/net/dsa/mt7530.c | 62 ++++++++++++++++++++-------------------- 1 file changed, 31 insertions(+), 31 deletions(-)
drivers/net/dsa/mt7530.c +31 -31
@@ -430,8 +430,6 @@ mt7530_pad_clk_setup(struct dsa_switch *ds, phy_interface_t interface)switch (interface) {case PHY_INTERFACE_MODE_RGMII : trgint =0 ; -/* PLL frequency: 125MHz */ - ncpo1 =0x0c80 ;break ;case PHY_INTERFACE_MODE_TRGMII : trgint =1 ;
@@ -462,38 +460,40 @@ mt7530_pad_clk_setup(struct dsa_switch *ds, phy_interface_t interface)mt7530_rmw (priv,MT7530_P6ECR ,P6_INTF_MODE_MASK ,P6_INTF_MODE (trgint)); -/* Lower Tx Driving for TRGMII path */ -for (i =0 ; i <NUM_TRGMII_CTRL ; i++) -mt7530_write (priv,MT7530_TRGMII_TD_ODT (i), -TD_DM_DRVP (8 ) |TD_DM_DRVN (8 )); - -/* Disable MT7530 core and TRGMII Tx clocks */ -core_clear (priv,CORE_TRGMII_GSW_CLK_CG , -REG_GSWCK_EN |REG_TRGMIICK_EN ); - -/* Setup the MT7530 TRGMII Tx Clock */ -core_write (priv,CORE_PLL_GROUP5 ,RG_LCDDS_PCW_NCPO1 (ncpo1)); -core_write (priv,CORE_PLL_GROUP6 ,RG_LCDDS_PCW_NCPO0 (0 )); -core_write (priv,CORE_PLL_GROUP10 ,RG_LCDDS_SSC_DELTA (ssc_delta)); -core_write (priv,CORE_PLL_GROUP11 ,RG_LCDDS_SSC_DELTA1 (ssc_delta)); -core_write (priv,CORE_PLL_GROUP4 , -RG_SYSPLL_DDSFBK_EN |RG_SYSPLL_BIAS_EN | -RG_SYSPLL_BIAS_LPF_EN ); -core_write (priv,CORE_PLL_GROUP2 , -RG_SYSPLL_EN_NORMAL |RG_SYSPLL_VODEN | -RG_SYSPLL_POSDIV (1 )); -core_write (priv,CORE_PLL_GROUP7 , -RG_LCDDS_PCW_NCPO_CHG |RG_LCCDS_C (3 ) | -RG_LCDDS_PWDB |RG_LCDDS_ISO_EN ); - -/* Enable MT7530 core and TRGMII Tx clocks */ -core_set (priv,CORE_TRGMII_GSW_CLK_CG , -REG_GSWCK_EN |REG_TRGMIICK_EN ); - -if (!trgint) +if (trgint) { +/* Lower Tx Driving for TRGMII path */ +for (i =0 ; i <NUM_TRGMII_CTRL ; i++) +mt7530_write (priv,MT7530_TRGMII_TD_ODT (i), +TD_DM_DRVP (8 ) |TD_DM_DRVN (8 )); + +/* Disable MT7530 core and TRGMII Tx clocks */ +core_clear (priv,CORE_TRGMII_GSW_CLK_CG , +REG_GSWCK_EN |REG_TRGMIICK_EN ); + +/* Setup the MT7530 TRGMII Tx Clock */ +core_write (priv,CORE_PLL_GROUP5 ,RG_LCDDS_PCW_NCPO1 (ncpo1)); +core_write (priv,CORE_PLL_GROUP6 ,RG_LCDDS_PCW_NCPO0 (0 )); +core_write (priv,CORE_PLL_GROUP10 ,RG_LCDDS_SSC_DELTA (ssc_delta)); +core_write (priv,CORE_PLL_GROUP11 ,RG_LCDDS_SSC_DELTA1 (ssc_delta)); +core_write (priv,CORE_PLL_GROUP4 , +RG_SYSPLL_DDSFBK_EN |RG_SYSPLL_BIAS_EN | +RG_SYSPLL_BIAS_LPF_EN ); +core_write (priv,CORE_PLL_GROUP2 , +RG_SYSPLL_EN_NORMAL |RG_SYSPLL_VODEN | +RG_SYSPLL_POSDIV (1 )); +core_write (priv,CORE_PLL_GROUP7 , +RG_LCDDS_PCW_NCPO_CHG |RG_LCCDS_C (3 ) | +RG_LCDDS_PWDB |RG_LCDDS_ISO_EN ); + +/* Enable MT7530 core and TRGMII Tx clocks */ +core_set (priv,CORE_TRGMII_GSW_CLK_CG , +REG_GSWCK_EN |REG_TRGMIICK_EN ); + }else {for (i =0 ; i <NUM_TRGMII_CTRL ; i++)mt7530_rmw (priv,MT7530_TRGMII_RD (i),RD_TAP_MASK ,RD_TAP (16 )); + } +return 0 ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 52/211 block: do not reverse request order when flushing plug list
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
[ Upstream commit 34e0a279a993debaff03158fc2fbf6a00c093643 ]
Commit 26fed4ac4eab ("block: flush plug based on hardware and software queue order") changed flushing of plug list to submit requests one device at a time. However while doing that it also started using list_add_tail() instead of list_add() used previously thus effectively submitting requests in reverse order. Also when forming a rq_list with remaining requests (in case two or more devices are used), we effectively reverse the ordering of the plug list for each device we process. Submitting requests in reverse order has negative impact on performance for rotational disks (when BFQ is not in use). We observe 10-25% regression in random 4k write throughput, as well as ~20% regression in MariaDB OLTP benchmark on rotational storage on btrfs filesystem.
Fix the problem by preserving ordering of the plug list when inserting requests into the queuelist as well as by appending to requeue_list instead of prepending to it.
--- block/blk-mq.c | 5 +++-- include/linux/blk-mq.h | 6 ++++++ 2 files changed, 9 insertions(+), 2 deletions(-)
block/blk-mq.c +3 -2
@@ -2743,6 +2743,7 @@ static void blk_mq_dispatch_plug_list(struct blk_plug *plug, bool from_sched)struct blk_mq_hw_ctx *this_hctx =NULL ;struct blk_mq_ctx *this_ctx =NULL ;struct request *requeue_list =NULL ; +struct request **requeue_lastp = &requeue_list;unsigned int depth =0 ;LIST_HEAD (list);
@@ -2753,10 +2754,10 @@ static void blk_mq_dispatch_plug_list(struct blk_plug *plug, bool from_sched) this_hctx = rq->mq_hctx; this_ctx = rq->mq_ctx; }else if (this_hctx != rq->mq_hctx || this_ctx != rq->mq_ctx) { -rq_list_add (&requeue_list, rq); +rq_list_add_tail (&requeue_lastp, rq);continue ; } -list_add_tail (&rq->queuelist, &list); +list_add (&rq->queuelist, &list); depth++; }while (!rq_list_empty (plug->mq_list));
include/linux/blk-mq.h +6 -0
@@ -228,6 +228,12 @@ static inline unsigned short req_get_ioprio(struct request *req) *(listptr) = rq; \ } while (0) +#define rq_list_add_tail (lastpptr, rq) do { \ + (rq)->rq_next = NULL; \ + **(lastpptr) = rq; \ + *(lastpptr) = &rq->rq_next; \ +} while (0) +#define rq_list_pop (listptr) \ ({ \ struct request *__req = NULL; \
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 53/211 loop: Fix use-after-free issues
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit 9b0cb770f5d7b1ff40bea7ca385438ee94570eec ]
do_req_filebacked() calls blk_mq_complete_request() synchronously or asynchronously when using asynchronous I/O unless memory allocation fails. Hence, modify loop_handle_cmd() such that it does not dereference 'cmd' nor 'rq' after do_req_filebacked() finished unless we are sure that the request has not yet been completed. This patch fixes the following kernel crash:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000054 Call trace: css_put.42938+0x1c/0x1ac loop_process_work+0xc8c/0xfd4 loop_rootcg_workfn+0x24/0x34 process_one_work+0x244/0x558 worker_thread+0x400/0x8fc kthread+0x16c/0x1e0 ret_from_fork+0x10/0x20
--- drivers/block/loop.c | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-)
drivers/block/loop.c +17 -8
@@ -1853,35 +1853,44 @@ static blk_status_t loop_queue_rq(struct blk_mq_hw_ctx *hctx,static void loop_handle_cmd (struct loop_cmd *cmd) { +struct cgroup_subsys_state *cmd_blkcg_css = cmd->blkcg_css; +struct cgroup_subsys_state *cmd_memcg_css = cmd->memcg_css;struct request *rq =blk_mq_rq_from_pdu (cmd);const bool write =op_is_write (req_op (rq));struct loop_device *lo = rq->q->queuedata;int ret =0 ;struct mem_cgroup *old_memcg =NULL ; +const bool use_aio = cmd->use_aio;if (write && (lo->lo_flags &LO_FLAGS_READ_ONLY )) { ret = -EIO ; goto failed; } -if (cmd->blkcg_css) -kthread_associate_blkcg (cmd->blkcg_css); -if (cmd->memcg_css) +if (cmd_blkcg_css) +kthread_associate_blkcg (cmd_blkcg_css); +if (cmd_memcg_css) old_memcg =set_active_memcg ( -mem_cgroup_from_css (cmd->memcg_css)); +mem_cgroup_from_css (cmd_memcg_css)); +/* +* do_req_filebacked() may call blk_mq_complete_request() synchronously +* or asynchronously if using aio. Hence, do not touch 'cmd' after +* do_req_filebacked() has returned unless we are sure that 'cmd' has +* not yet been completed. +*/ ret =do_req_filebacked (lo, rq); -if (cmd->blkcg_css) +if (cmd_blkcg_css)kthread_associate_blkcg (NULL ); -if (cmd->memcg_css) { +if (cmd_memcg_css) {set_active_memcg (old_memcg); -css_put (cmd->memcg_css); +css_put (cmd_memcg_css); } failed:/* complete non-aio request */ -if (!cmd->use_aio || ret) { +if (!use_aio || ret) {if (ret == -EOPNOTSUPP ) cmd->ret = ret;else
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 54/211 blk-mq: fix "bad unlock balance detected" on q->srcu in __blk_mq_run_dispatch_ops
In reply to Greg Kroah-HartmanFrom: Chris Leech <[email protected]>
[ Upstream commit 00e885efcfbb8712d3e1bfc1ae30639c15ca1d3b ]
The 'q' parameter of the macro __blk_mq_run_dispatch_ops may not be one local variable, such as, it is rq->q, then request queue pointed by this variable could be changed to another queue in case of BLK_MQ_F_TAG_QUEUE_SHARED after 'dispatch_ops' returns, then 'bad unlock balance' is triggered.
Fixes the issue by adding one local variable for doing srcu lock/unlock.
--- block/blk-mq.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
block/blk-mq.h +3 -2
@@ -378,12 +378,13 @@ static inline bool hctx_may_queue(struct blk_mq_hw_ctx *hctx,#define __blk_mq_run_dispatch_ops (q, check_sleep, dispatch_ops) \ do { \ if ((q)->tag_set->flags & BLK_MQ_F_BLOCKING) { \ + struct blk_mq_tag_set *__tag_set = (q)->tag_set; \ int srcu_idx; \ \ might_sleep_if(check_sleep); \ - srcu_idx = srcu_read_lock((q)->tag_set->srcu); \ + srcu_idx = srcu_read_lock(__tag_set->srcu); \ (dispatch_ops); \ - srcu_read_unlock((q)->tag_set->srcu, srcu_idx); \ + srcu_read_unlock(__tag_set->srcu, srcu_idx); \ } else { \ rcu_read_lock(); \ (dispatch_ops); \
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 55/211 net: tunnels: annotate lockless accesses to dev->needed_headroom
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 4b397c06cb987935b1b097336532aa6b4210e091 ]
IP tunnels can apparently update dev->needed_headroom in their xmit path.
This patch takes care of three tunnels xmit, and also the core LL_RESERVED_SPACE() and LL_RESERVED_SPACE_EXTRA() helpers.
More changes might be needed for completeness.
BUG: KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit
read to 0xffff88815b9da0ec of 2 bytes by task 888 on cpu 1:
ip_tunnel_xmit+0x1270/0x1730 net/ipv4/ip_tunnel.c:803 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip_finish_output2+0x740/0x840 net/ipv4/ip_output.c:228 ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:316 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:444 [inline] ip_local_out+0x64/0x80 net/ipv4/ip_output.c:126 iptunnel_xmit+0x34a/0x4b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1451/0x1730 net/ipv4/ip_tunnel.c:813 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246
write to 0xffff88815b9da0ec of 2 bytes by task 2379 on cpu 0:
ip_tunnel_xmit+0x1294/0x1730 net/ipv4/ip_tunnel.c:804 __gre_xmit net/ipv4/ip_gre.c:469 [inline] ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:661 __netdev_start_xmit include/linux/netdevice.h:4881 [inline] netdev_start_xmit include/linux/netdevice.h:4895 [inline] xmit_one net/core/dev.c:3580 [inline] dev_hard_start_xmit+0x127/0x400 net/core/dev.c:3596 __dev_queue_xmit+0x1007/0x1eb0 net/core/dev.c:4246 dev_queue_xmit include/linux/netdevice.h:3051 [inline] neigh_direct_output+0x17/0x20 net/core/neighbour.c:1623 neigh_output include/net/neighbour.h:546 [inline] ip6_finish_output2+0x9bc/0xc50 net/ipv6/ip6_output.c:134 __ip6_finish_output net/ipv6/ip6_output.c:195 [inline] ip6_finish_output+0x39a/0x4e0 net/ipv6/ip6_output.c:206 NF_HOOK_COND include/linux/netfilter.h:291 [inline] ip6_output+0xeb/0x220 net/ipv6/ip6_output.c:227 dst_output include/net/dst.h:444 [inline] NF_HOOK include/linux/netfilter.h:302 [inline] mld_sendpack+0x438/0x6a0 net/ipv6/mcast.c:1820 mld_send_cr net/ipv6/mcast.c:2121 [inline] mld_ifc_work+0x519/0x7b0 net/ipv6/mcast.c:2653 process_one_work+0x3e6/0x750 kernel/workqueue.c:2390 worker_thread+0x5f2/0xa10 kernel/workqueue.c:2537 kthread+0x1ac/0x1e0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
value changed: 0x0dd4 -> 0x0e14
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 2379 Comm: kworker/0:0 Not tainted 6.3.0-rc1-syzkaller-00002-g8ca09d5fa354-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 Workqueue: mld mld_ifc_work
--- include/linux/netdevice.h | 6 ++++-- net/ipv4/ip_tunnel.c | 12 ++++++------ net/ipv6/ip6_tunnel.c | 4 ++-- 3 files changed, 12 insertions(+), 10 deletions(-)
include/linux/netdevice.h +4 -2
@@ -295,9 +295,11 @@ struct hh_cache {* relationship HH alignment <= LL alignment. */ #define LL_RESERVED_SPACE (dev) \ - ((((dev)->hard_header_len+(dev)->needed_headroom)&~(HH_DATA_MOD - 1)) + HH_DATA_MOD) + ((((dev)->hard_header_len + READ_ONCE((dev)->needed_headroom)) \ + & ~(HH_DATA_MOD - 1)) + HH_DATA_MOD)#define LL_RESERVED_SPACE_EXTRA (dev,extra) \ - ((((dev)->hard_header_len+(dev)->needed_headroom+(extra))&~(HH_DATA_MOD - 1)) + HH_DATA_MOD) + ((((dev)->hard_header_len + READ_ONCE((dev)->needed_headroom) + (extra)) \ + & ~(HH_DATA_MOD - 1)) + HH_DATA_MOD)struct header_ops { int (*create) (struct sk_buff *skb, struct net_device *dev,
net/ipv4/ip_tunnel.c +6 -6
@@ -614,10 +614,10 @@ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, } headroom +=LL_RESERVED_SPACE (rt->dst.dev) + rt->dst.header_len; -if (headroom > dev->needed_headroom) - dev->needed_headroom = headroom; +if (headroom >READ_ONCE (dev->needed_headroom)) +WRITE_ONCE (dev->needed_headroom, headroom); -if (skb_cow_head (skb, dev->needed_headroom)) { +if (skb_cow_head (skb,READ_ONCE (dev->needed_headroom))) {ip_rt_put (rt); goto tx_dropped; }
@@ -800,10 +800,10 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, max_headroom =LL_RESERVED_SPACE (rt->dst.dev) +sizeof (struct iphdr ) + rt->dst.header_len +ip_encap_hlen (&tunnel->encap); -if (max_headroom > dev->needed_headroom) - dev->needed_headroom = max_headroom; +if (max_headroom >READ_ONCE (dev->needed_headroom)) +WRITE_ONCE (dev->needed_headroom, max_headroom); -if (skb_cow_head (skb, dev->needed_headroom)) { +if (skb_cow_head (skb,READ_ONCE (dev->needed_headroom))) {ip_rt_put (rt);DEV_STATS_INC (dev, tx_dropped);kfree_skb (skb);
net/ipv6/ip6_tunnel.c +2 -2
@@ -1240,8 +1240,8 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield,*/ max_headroom =LL_RESERVED_SPACE (dst->dev) +sizeof (struct ipv6hdr ) + dst->header_len + t->hlen; -if (max_headroom > dev->needed_headroom) - dev->needed_headroom = max_headroom; +if (max_headroom >READ_ONCE (dev->needed_headroom)) +WRITE_ONCE (dev->needed_headroom, max_headroom); err =ip6_tnl_encap (skb, t, &proto, fl6);if (err)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 56/211 net: phy: smsc: bail out in lan87xx_read_status if genphy_read_status fails
In reply to Greg Kroah-HartmanFrom: Heiner Kallweit <[email protected]>
[ Upstream commit c22c3bbf351e4ce905f082649cffa1ff893ea8c1 ]
If genphy_read_status fails then further access to the PHY may result in unpredictable behavior. To prevent this bail out immediately if genphy_read_status fails.
--- drivers/net/phy/smsc.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/phy/smsc.c +4 -1
@@ -199,8 +199,11 @@ static int lan95xx_config_aneg_ext(struct phy_device *phydev)static int lan87xx_read_status (struct phy_device *phydev) {struct smsc_phy_priv *priv = phydev->priv; +int err; -int err =genphy_read_status (phydev); + err =genphy_read_status (phydev); +if (err) +return err;if (!phydev->link && priv->energy_enable && phydev->irq ==PHY_POLL ) {/* Disable EDPD to wake up PHY */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 57/211 tcp: Fix bind() conflict check for dual-stack wildcard address.
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
[ Upstream commit d9ba9934285514f1f95d96326a82398a22dc77f2 ]
Paul Holzinger reported [0] that commit 5456262d2baa ("net: Fix incorrect address comparison when searching for a bind2 bucket") introduced a bind() regression. Paul also gave a nice repro that calls two types of bind() on the same port, both of which now succeed, but the second call should fail:
bind(fd1, ::, port) + bind(fd2, 127.0.0.1, port)
The cited commit added address family tests in three functions to fix the uninit-value KMSAN report. [1] However, the test added to inet_bind2_bucket_match_addr_any() removed a necessary conflict check; the dual-stack wildcard address no longer conflicts with an IPv4 non-wildcard address.
If tb->family is AF_INET6 and sk->sk_family is AF_INET in inet_bind2_bucket_match_addr_any(), we still need to check if tb has the dual-stack wildcard address.
Note that the IPv4 wildcard address does not conflict with IPv6 non-wildcard addresses.
[0]: https://lore.kernel.org/netdev/[email protected]/
[1]: https://lore.kernel.org/netdev/CAG_fn=Ud3zSW7AZWXc+asfMhZVL5ETnvuY44Pmyv4NPv-ijN-A@mail.gmail.com/
--- net/ipv4/inet_hashtables.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
net/ipv4/inet_hashtables.c +7 -1
@@ -828,8 +828,14 @@ bool inet_bind2_bucket_match_addr_any(const struct inet_bind2_bucket *tb, const#if IS_ENABLED (CONFIG_IPV6 )struct in6_addr addr_any = {}; -if (sk->sk_family != tb->family) +if (sk->sk_family != tb->family) { +if (sk->sk_family ==AF_INET ) +return net_eq (ib2_net (tb), net) && tb->port == port && + tb->l3mdev == l3mdev && +ipv6_addr_equal (&tb->v6_rcv_saddr, &addr_any); +return false; + }if (sk->sk_family ==AF_INET6 ) return net_eq(ib2_net(tb), net) && tb->port == port &&
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 58/211 nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
In reply to Greg Kroah-HartmanFrom: Zheng Wang <[email protected]>
[ Upstream commit 5000fe6c27827a61d8250a7e4a1d26c3298ef4f6 ]
This bug influences both st_nci_i2c_remove and st_nci_spi_remove. Take st_nci_i2c_remove as an example.
In st_nci_i2c_probe, it called ndlc_probe and bound &ndlc->sm_work with llt_ndlc_sm_work.
When it calls ndlc_recv or timeout handler, it will finally call schedule_work to start the work.
When we call st_nci_i2c_remove to remove the driver, there may be a sequence as follows:
Fix it by finishing the work before cleanup in ndlc_remove
CPU0 CPU1
|llt_ndlc_sm_work
st_nci_i2c_remove |
ndlc_remove |
st_nci_remove |
nci_free_device|
kfree(ndev) |
//free ndlc->ndev |
|llt_ndlc_rcv_queue
|nci_recv_frame
|//use ndlc->ndev--- drivers/nfc/st-nci/ndlc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/nfc/st-nci/ndlc.c +4 -2
@@ -282,13 +282,15 @@ EXPORT_SYMBOL(ndlc_probe);void ndlc_remove (struct llt_ndlc *ndlc) { -st_nci_remove (ndlc->ndev); -/* cancel timers */ del_timer_sync (&ndlc->t1_timer);del_timer_sync (&ndlc->t2_timer); ndlc->t2_active = false; ndlc->t1_active = false; +/* cancel work */ +cancel_work_sync (&ndlc->sm_work); + +st_nci_remove (ndlc->ndev);skb_queue_purge (&ndlc->rcv_q);skb_queue_purge (&ndlc->send_q);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 59/211 mlxsw: spectrum: Fix incorrect parsing depth after reload
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
[ Upstream commit 35c356924fe3669dfbb1185607ce3b37f70bfa80 ]
Spectrum ASICs have a configurable limit on how deep into the packet they parse. By default, the limit is 96 bytes.
There are several cases where this parsing depth is not enough and there is a need to increase it. For example, timestamping of PTP packets and a FIB multipath hash policy that requires hashing on inner fields. The driver therefore maintains a reference count that reflects the number of consumers that require an increased parsing depth.
During reload_down() the parsing depth reference count does not necessarily drop to zero, but the parsing depth itself is restored to the default during reload_up() when the firmware is reset. It is therefore possible to end up in situations where the driver thinks that the parsing depth was increased (reference count is non-zero), when it is not.
Fix by making sure that all the consumers that increase the parsing depth reference count also decrease it during reload_down(). Specifically, make sure that when the routing code is de-initialized it drops the reference count if it was increased because of a FIB multipath hash policy that requires hashing on inner fields.
Add a warning if the reference count is not zero after the driver was de-initialized and explicitly reset it to zero during initialization for good measures.
--- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 2 ++ .../net/ethernet/mellanox/mlxsw/spectrum_router.c | 14 ++++++++++++++ 2 files changed, 16 insertions(+)
drivers/net/ethernet/mellanox/mlxsw/spectrum.c +2 -0
@@ -2937,6 +2937,7 @@ static int mlxsw_sp_netdevice_event(struct notifier_block *unused,static void mlxsw_sp_parsing_init (struct mlxsw_sp *mlxsw_sp) { +refcount_set (&mlxsw_sp->parsing.parsing_depth_ref,0 ); mlxsw_sp->parsing.parsing_depth =MLXSW_SP_DEFAULT_PARSING_DEPTH ; mlxsw_sp->parsing.vxlan_udp_dport =MLXSW_SP_DEFAULT_VXLAN_UDP_DPORT ;mutex_init (&mlxsw_sp->parsing.lock);
@@ -2945,6 +2946,7 @@ static void mlxsw_sp_parsing_init(struct mlxsw_sp *mlxsw_sp)static void mlxsw_sp_parsing_fini (struct mlxsw_sp *mlxsw_sp) {mutex_destroy (&mlxsw_sp->parsing.lock); +WARN_ON_ONCE (refcount_read (&mlxsw_sp->parsing.parsing_depth_ref)); }struct mlxsw_sp_ipv6_addr_node {
drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +14 -0
@@ -10381,11 +10381,23 @@ static int mlxsw_sp_mp_hash_init(struct mlxsw_sp *mlxsw_sp) old_inc_parsing_depth); return err; } + +static void mlxsw_sp_mp_hash_fini (struct mlxsw_sp *mlxsw_sp) +{ +bool old_inc_parsing_depth = mlxsw_sp->router->inc_parsing_depth; + +mlxsw_sp_mp_hash_parsing_depth_adjust (mlxsw_sp, old_inc_parsing_depth, + false); +}#else static int mlxsw_sp_mp_hash_init (struct mlxsw_sp *mlxsw_sp) {return 0 ; } + +static void mlxsw_sp_mp_hash_fini (struct mlxsw_sp *mlxsw_sp) +{ +}#endif static int mlxsw_sp_dscp_init (struct mlxsw_sp *mlxsw_sp)
@@ -10615,6 +10627,7 @@ int mlxsw_sp_router_init(struct mlxsw_sp *mlxsw_sp, err_register_inetaddr_notifier:mlxsw_core_flush_owq (); err_dscp_init: +mlxsw_sp_mp_hash_fini (mlxsw_sp); err_mp_hash_init:mlxsw_sp_neigh_fini (mlxsw_sp); err_neigh_init:
@@ -10655,6 +10668,7 @@ void mlxsw_sp_router_fini(struct mlxsw_sp *mlxsw_sp)unregister_inet6addr_notifier (&mlxsw_sp->router->inet6addr_nb);unregister_inetaddr_notifier (&mlxsw_sp->router->inetaddr_nb);mlxsw_core_flush_owq (); +mlxsw_sp_mp_hash_fini (mlxsw_sp);mlxsw_sp_neigh_fini (mlxsw_sp);mlxsw_sp_lb_rif_fini (mlxsw_sp);mlxsw_sp_vrs_fini (mlxsw_sp);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 60/211 net/smc: fix deadlock triggered by cancel_delayed_work_syn()
In reply to Greg Kroah-HartmanFrom: Wenjia Zhang <[email protected]>
[ Upstream commit 13085e1b5cab8ad802904d72e6a6dae85ae0cd20 ]
The following LOCKDEP was detected:
Workqueue: events smc_lgr_free_work [smc]
WARNING: possible circular locking dependency detected
6.1.0-20221027.rc2.git8.56bc5b569087.300.fc36.s390x+debug #1 Not tainted
------------------------------------------------------
kworker/3:0/176251 is trying to acquire lock:
00000000f1467148 ((wq_completion)smc_tx_wq-00000000#2){+.+.}-{0:0},
at: __flush_workqueue+0x7a/0x4f0
but task is already holding lock:
0000037fffe97dc8 ((work_completion)(&(&lgr->free_work)->work)){+.+.}-{0:0},
at: process_one_work+0x232/0x730
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #4 ((work_completion)(&(&lgr->free_work)->work)){+.+.}-{0:0}:
__lock_acquire+0x58e/0xbd8
lock_acquire.part.0+0xe2/0x248
lock_acquire+0xac/0x1c8
__flush_work+0x76/0xf0
__cancel_work_timer+0x170/0x220
__smc_lgr_terminate.part.0+0x34/0x1c0 [smc]
smc_connect_rdma+0x15e/0x418 [smc]
__smc_connect+0x234/0x480 [smc]
smc_connect+0x1d6/0x230 [smc]
__sys_connect+0x90/0xc0
__do_sys_socketcall+0x186/0x370
__do_syscall+0x1da/0x208
system_call+0x82/0xb0
-> #3 (smc_client_lgr_pending){+.+.}-{3:3}:
__lock_acquire+0x58e/0xbd8
lock_acquire.part.0+0xe2/0x248
lock_acquire+0xac/0x1c8
__mutex_lock+0x96/0x8e8
mutex_lock_nested+0x32/0x40
smc_connect_rdma+0xa4/0x418 [smc]
__smc_connect+0x234/0x480 [smc]
smc_connect+0x1d6/0x230 [smc]
__sys_connect+0x90/0xc0
__do_sys_socketcall+0x186/0x370
__do_syscall+0x1da/0x208
system_call+0x82/0xb0
-> #2 (sk_lock-AF_SMC){+.+.}-{0:0}:
__lock_acquire+0x58e/0xbd8
lock_acquire.part.0+0xe2/0x248
lock_acquire+0xac/0x1c8
lock_sock_nested+0x46/0xa8
smc_tx_work+0x34/0x50 [smc]
process_one_work+0x30c/0x730
worker_thread+0x62/0x420
kthread+0x138/0x150
__ret_from_fork+0x3c/0x58
ret_from_fork+0xa/0x40
-> #1 ((work_completion)(&(&smc->conn.tx_work)->work)){+.+.}-{0:0}:
__lock_acquire+0x58e/0xbd8
lock_acquire.part.0+0xe2/0x248
lock_acquire+0xac/0x1c8
process_one_work+0x2bc/0x730
worker_thread+0x62/0x420
kthread+0x138/0x150
__ret_from_fork+0x3c/0x58
ret_from_fork+0xa/0x40
-> #0 ((wq_completion)smc_tx_wq-00000000#2){+.+.}-{0:0}:
check_prev_add+0xd8/0xe88
validate_chain+0x70c/0xb20
__lock_acquire+0x58e/0xbd8
lock_acquire.part.0+0xe2/0x248
lock_acquire+0xac/0x1c8
__flush_workqueue+0xaa/0x4f0
drain_workqueue+0xaa/0x158
destroy_workqueue+0x44/0x2d8
smc_lgr_free+0x9e/0xf8 [smc]
process_one_work+0x30c/0x730
worker_thread+0x62/0x420
kthread+0x138/0x150
__ret_from_fork+0x3c/0x58
ret_from_fork+0xa/0x40
other info that might help us debug this:
Chain exists of:
(wq_completion)smc_tx_wq-00000000#2
--> smc_client_lgr_pending
--> (work_completion)(&(&lgr->free_work)->work)
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock((work_completion)(&(&lgr->free_work)->work));
lock(smc_client_lgr_pending);
lock((work_completion)
(&(&lgr->free_work)->work));
lock((wq_completion)smc_tx_wq-00000000#2);
*** DEADLOCK ***
2 locks held by kworker/3:0/176251:
#0: 0000000080183548
((wq_completion)events){+.+.}-{0:0},
at: process_one_work+0x232/0x730
#1: 0000037fffe97dc8
((work_completion)
(&(&lgr->free_work)->work)){+.+.}-{0:0},
at: process_one_work+0x232/0x730
stack backtrace:
CPU: 3 PID: 176251 Comm: kworker/3:0 Not tainted
Hardware name: IBM 8561 T01 701 (z/VM 7.2.0)
Call Trace:
[<000000002983c3e4>] dump_stack_lvl+0xac/0x100
[<0000000028b477ae>] check_noncircular+0x13e/0x160
[<0000000028b48808>] check_prev_add+0xd8/0xe88
[<0000000028b49cc4>] validate_chain+0x70c/0xb20
[<0000000028b4bd26>] __lock_acquire+0x58e/0xbd8
[<0000000028b4cf6a>] lock_acquire.part.0+0xe2/0x248
[<0000000028b4d17c>] lock_acquire+0xac/0x1c8
[<0000000028addaaa>] __flush_workqueue+0xaa/0x4f0
[<0000000028addf9a>] drain_workqueue+0xaa/0x158
[<0000000028ae303c>] destroy_workqueue+0x44/0x2d8
[<000003ff8029af26>] smc_lgr_free+0x9e/0xf8 [smc]
[<0000000028adf3d4>] process_one_work+0x30c/0x730
[<0000000028adf85a>] worker_thread+0x62/0x420
[<0000000028aeac50>] kthread+0x138/0x150
[<0000000028a63914>] __ret_from_fork+0x3c/0x58
[<00000000298503da>] ret_from_fork+0xa/0x40
INFO: lockdep is turned off.
===================================================================This deadlock occurs because cancel_delayed_work_sync() waits for the work(&lgr->free_work) to finish, while the &lgr->free_work waits for the work(lgr->tx_wq), which needs the sk_lock-AF_SMC, that is already used under the mutex_lock.
The solution is to use cancel_delayed_work() instead, which kills off a pending work.
--- net/smc/smc_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/smc/smc_core.c +1 -1
@@ -1459,7 +1459,7 @@ static void __smc_lgr_terminate(struct smc_link_group *lgr, bool soft)if (lgr->terminating)return ;/* lgr already terminating */ /* cancel free_work sync, will terminate when lgr->freeing is set */ -cancel_delayed_work_sync (&lgr->free_work); +cancel_delayed_work (&lgr->free_work); lgr->terminating =1 ;/* kill remaining link group connections */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 61/211 net: usb: smsc75xx: Limit packet length to skb->len
In reply to Greg Kroah-HartmanFrom: Szymon Heidrich <[email protected]>
[ Upstream commit d8b228318935044dafe3a5bc07ee71a1f1424b8d ]
Packet length retrieved from skb data may be larger than the actual socket buffer length (up to 9026 bytes). In such case the cloned skb passed up the network stack will leak kernel memory contents.
--- drivers/net/usb/smsc75xx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/usb/smsc75xx.c +2 -1
@@ -2212,7 +2212,8 @@ static int smsc75xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb) dev->net->stats.rx_frame_errors++; }else {/* MAX_SINGLE_PACKET_SIZE + 4(CRC) + 2(COE) + 4(Vlan) */ -if (unlikely (size > (MAX_SINGLE_PACKET_SIZE +ETH_HLEN +12 ))) { +if (unlikely (size > (MAX_SINGLE_PACKET_SIZE +ETH_HLEN +12 ) || + size > skb->len)) {netif_dbg (dev, rx_err, dev->net,"size err rx_cmd_a=0x%08x\n" , rx_cmd_a);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 62/211 net: ethernet: mtk_eth_soc: reset PCS state
In reply to Greg Kroah-HartmanFrom: Daniel Golle <[email protected]>
[ Upstream commit 611e2dabb4b3243d176739fd6a5a34d007fa3f86 ]
Reset the internal PCS state machine when changing interface mode. This prevents confusing the state machine when changing interface modes, e.g. from SGMII to 2500Base-X or vice-versa.
--- drivers/net/ethernet/mediatek/mtk_eth_soc.h | 4 ++++ drivers/net/ethernet/mediatek/mtk_sgmii.c | 4 ++++ 2 files changed, 8 insertions(+)
drivers/net/ethernet/mediatek/mtk_eth_soc.h +4 -0
@@ -528,6 +528,10 @@#define SGMII_SEND_AN_ERROR_EN BIT(11)#define SGMII_IF_MODE_MASK GENMASK(5, 1) +/* Register to reset SGMII design */ +#define SGMII_RESERVED_0 0x34 +#define SGMII_SW_RESET BIT(0) +/* Register to set SGMII speed, ANA RG_ Control Signals III*/ #define SGMSYS_ANA_RG_CS3 0x2028#define RG_PHY_SPEED_MASK (BIT(2) | BIT(3))
drivers/net/ethernet/mediatek/mtk_sgmii.c +4 -0
@@ -88,6 +88,10 @@ static int mtk_pcs_config(struct phylink_pcs *pcs, unsigned int mode,regmap_update_bits (mpcs->regmap,SGMSYS_QPHY_PWR_STATE_CTRL ,SGMII_PHYA_PWD ,SGMII_PHYA_PWD ); +/* Reset SGMII PCS state */ +regmap_update_bits (mpcs->regmap,SGMII_RESERVED_0 , +SGMII_SW_RESET ,SGMII_SW_RESET ); +if (interface ==PHY_INTERFACE_MODE_2500BASEX ) rgc3 =RG_PHY_SPEED_3_125G ;else
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 63/211 net: ethernet: mtk_eth_soc: only write values if needed
In reply to Greg Kroah-HartmanFrom: Daniel Golle <[email protected]>
[ Upstream commit 6e933a804c7db8be64f367f33e63cd7dcc302ebb ]
Only restart auto-negotiation and write link timer if actually necessary. This prevents losing the link in case of minor changes.
--- drivers/net/ethernet/mediatek/mtk_sgmii.c | 24 +++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
drivers/net/ethernet/mediatek/mtk_sgmii.c +12 -12
@@ -38,20 +38,16 @@ static int mtk_pcs_config(struct phylink_pcs *pcs, unsigned int mode,const unsigned long *advertising, bool permit_pause_to_mac) { + bool mode_changed = false, changed, use_an;struct mtk_pcs *mpcs =pcs_to_mtk_pcs (pcs);unsigned int rgc3, sgm_mode, bmcr;int advertise, link_timer; -bool changed, use_an; advertise =phylink_mii_c22_pcs_encode_advertisement (interface, advertising);if (advertise <0 )return advertise; - link_timer =phylink_get_link_timer_ns (interface); -if (link_timer <0 ) -return link_timer; -/* Clearing IF_MODE_BIT0 switches the PCS to BASE-X mode, and * we assume that fixes it's speed at bitrate = line rate (in * other words, 1000Mbps or 2500Mbps).
@@ -77,13 +73,16 @@ static int mtk_pcs_config(struct phylink_pcs *pcs, unsigned int mode, }if (use_an) { -/* FIXME: Do we need to set AN_RESTART here? */ - bmcr =SGMII_AN_RESTART |SGMII_AN_ENABLE ; + bmcr =SGMII_AN_ENABLE ; }else { bmcr =0 ; }if (mpcs->interface != interface) { + link_timer =phylink_get_link_timer_ns (interface); +if (link_timer <0 ) +return link_timer; +/* PHYA power down */ regmap_update_bits (mpcs->regmap,SGMSYS_QPHY_PWR_STATE_CTRL ,SGMII_PHYA_PWD ,SGMII_PHYA_PWD );
@@ -101,16 +100,17 @@ static int mtk_pcs_config(struct phylink_pcs *pcs, unsigned int mode,regmap_update_bits (mpcs->regmap, mpcs->ana_rgc3,RG_PHY_SPEED_3_125G , rgc3); +/* Setup the link timer */ +regmap_write (mpcs->regmap,SGMSYS_PCS_LINK_TIMER , link_timer /2 /8 ); + mpcs->interface = interface; + mode_changed = true; }/* Update the advertisement, noting whether it has changed */ regmap_update_bits_check (mpcs->regmap,SGMSYS_PCS_ADVERTISE ,SGMII_ADVERTISE , advertise, &changed); -/* Setup the link timer and QPHY power up inside SGMIISYS */ -regmap_write (mpcs->regmap,SGMSYS_PCS_LINK_TIMER , link_timer /2 /8 ); -/* Update the sgmsys mode register */ regmap_update_bits(mpcs->regmap, SGMSYS_SGMII_MODE, SGMII_REMOTE_FAULT_DIS | SGMII_SPEED_DUPLEX_AN |
@@ -118,7 +118,7 @@ static int mtk_pcs_config(struct phylink_pcs *pcs, unsigned int mode,/* Update the BMCR */ regmap_update_bits (mpcs->regmap,SGMSYS_PCS_CONTROL_1 , -SGMII_AN_RESTART |SGMII_AN_ENABLE , bmcr); +SGMII_AN_ENABLE , bmcr);/* Release PHYA power down state * Only removing bit SGMII_PHYA_PWD isn't enough.
@@ -132,7 +132,7 @@ static int mtk_pcs_config(struct phylink_pcs *pcs, unsigned int mode,usleep_range (50 ,100 );regmap_write (mpcs->regmap,SGMSYS_QPHY_PWR_STATE_CTRL ,0 ); -return changed; +return changed || mode_changed; }static void mtk_pcs_restart_an (struct phylink_pcs *pcs)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 64/211 drm/bridge: Fix returned array size name for atomic_get_input_bus_fmts kdoc
In reply to Greg Kroah-HartmanFrom: Liu Ying <[email protected]>
[ Upstream commit 0d3c9333d976af41d7dbc6bf4d9d2e95fbdf9c89 ]
The returned array size for input formats is set through atomic_get_input_bus_fmts()'s 'num_input_fmts' argument, so use 'num_input_fmts' to represent the array size in the function's kdoc, not 'num_output_fmts'.
--- include/drm/drm_bridge.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/drm/drm_bridge.h +2 -2
@@ -447,11 +447,11 @@ struct drm_bridge_funcs {* * The returned array must be allocated with kmalloc() and will be * freed by the caller. If the allocation fails, NULL should be -* returned. num_output_fmts must be set to the returned array size. +* returned. num_input_fmts must be set to the returned array size. * Formats listed in the returned array should be listed in decreasing * preference order (the core will try all formats until it finds one * that works). When the format is not supported NULL should be -* returned and num_output_fmts should be set to 0. +* returned and num_input_fmts should be set to 0. * * This method is called on all elements of the bridge chain as part of * the bus format negotiation process that happens in
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 65/211 powerpc/mm: Fix false detection of read faults
In reply to Greg Kroah-HartmanFrom: Russell Currey <[email protected]>
[ Upstream commit f2c7e3562b4c4f1699acc1538ebf3e75f5cced35 ]
To support detection of read faults with Radix execute-only memory, the vma_is_accessible() check in access_error() (which checks for PROT_NONE) was replaced with a check to see if VM_READ was missing, and if so, returns true to assert the fault was caused by a bad read.
This is incorrect, as it ignores that both VM_WRITE and VM_EXEC imply read on powerpc, as defined in protection_map[]. This causes mappings containing VM_WRITE or VM_EXEC without VM_READ to misreport the cause of page faults, since the MMU is still allowing reads.
Correct this by restoring the original vma_is_accessible() check for PROT_NONE mappings, and adding a separate check for Radix PROT_EXEC-only mappings.
--- arch/powerpc/mm/fault.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
arch/powerpc/mm/fault.c +8 -3
@@ -271,11 +271,16 @@ static bool access_error(bool is_write, bool is_exec, struct vm_area_struct *vma }/* -* Check for a read fault. This could be caused by a read on an -* inaccessible page (i.e. PROT_NONE), or a Radix MMU execute-only page. +* VM_READ, VM_WRITE and VM_EXEC all imply read permissions, as +* defined in protection_map[]. Read faults can only be caused by +* a PROT_NONE mapping, or with a PROT_EXEC-only mapping on Radix. */ -if (unlikely (!(vma->vm_flags &VM_READ ))) +if (unlikely (!vma_is_accessible (vma)))return true; + +if (unlikely (radix_enabled () && ((vma->vm_flags &VM_ACCESS_FLAGS ) ==VM_EXEC ))) +return true; +/* * We should ideally do the vma pkey access check here. But in the * fault path, handle_mm_fault() also does the same check. To avoid
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 66/211 block: null_blk: Fix handling of fake timeout request
In reply to Greg Kroah-HartmanFrom: Damien Le Moal <[email protected]>
[ Upstream commit 63f886597085f346276e3b3c8974de0100d65f32 ]
When injecting a fake timeout into the null_blk driver using fail_io_timeout, the request timeout handler does not execute blk_mq_complete_request(), so the complete callback is never executed for a timedout request.
The null_blk driver also has a driver-specific fake timeout mechanism which does not have this problem. Fix the problem with fail_io_timeout by using the same meachanism as null_blk internal timeout feature, using the fake_timeout field of null_blk commands.
--- drivers/block/null_blk/main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/block/null_blk/main.c +3 -3
@@ -1413,8 +1413,7 @@ static inline void nullb_complete_cmd(struct nullb_cmd *cmd)case NULL_IRQ_SOFTIRQ :switch (cmd->nq->dev->queue_mode) {case NULL_Q_MQ : -if (likely (!blk_should_fake_timeout (cmd->rq->q))) -blk_mq_complete_request (cmd->rq); +blk_mq_complete_request (cmd->rq);break ;case NULL_Q_BIO :/*
@@ -1675,7 +1674,8 @@ static blk_status_t null_queue_rq(struct blk_mq_hw_ctx *hctx, cmd->rq = bd->rq; cmd->error =BLK_STS_OK ; cmd->nq = nq; - cmd->fake_timeout =should_timeout_request (bd->rq); + cmd->fake_timeout =should_timeout_request (bd->rq) || +blk_should_fake_timeout (bd->rq->q);blk_mq_start_request (bd->rq);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 67/211 nvme: fix handling single range discard request
In reply to Greg Kroah-HartmanFrom: Ming Lei <[email protected]>
[ Upstream commit 37f0dc2ec78af0c3f35dd05578763de059f6fe77 ]
When investigating one customer report on warning in nvme_setup_discard, we observed the controller(nvme/tcp) actually exposes queue_max_discard_segments(req->q) == 1.
Obviously the current code can't handle this situation, since contiguity merge like normal RW request is taken.
Fix the issue by building range from request sector/nr_sectors directly.
--- drivers/nvme/host/core.c | 28 +++++++++++++++++++--------- 1 file changed, 19 insertions(+), 9 deletions(-)
drivers/nvme/host/core.c +19 -9
@@ -781,16 +781,26 @@ static blk_status_t nvme_setup_discard(struct nvme_ns *ns, struct request *req, range =page_address (ns->ctrl->discard_page); } -__rq_for_each_bio (bio, req) { -u64 slba =nvme_sect_to_lba (ns, bio->bi_iter.bi_sector); -u32 nlb = bio->bi_iter.bi_size >> ns->lba_shift; - -if (n < segments) { - range[n].cattr =cpu_to_le32 (0 ); - range[n].nlb =cpu_to_le32 (nlb); - range[n].slba =cpu_to_le64 (slba); +if (queue_max_discard_segments (req->q) ==1 ) { +u64 slba =nvme_sect_to_lba (ns,blk_rq_pos (req)); +u32 nlb =blk_rq_sectors (req) >> (ns->lba_shift -9 ); + + range[0 ].cattr =cpu_to_le32 (0 ); + range[0 ].nlb =cpu_to_le32 (nlb); + range[0 ].slba =cpu_to_le64 (slba); + n =1 ; + }else { +__rq_for_each_bio (bio, req) { +u64 slba =nvme_sect_to_lba (ns, bio->bi_iter.bi_sector); +u32 nlb = bio->bi_iter.bi_size >> ns->lba_shift; + +if (n < segments) { + range[n].cattr =cpu_to_le32 (0 ); + range[n].nlb =cpu_to_le32 (nlb); + range[n].slba =cpu_to_le64 (slba); + } + n++; } - n++; }if (WARN_ON_ONCE (n != segments)) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 68/211 nvmet: avoid potential UAF in nvmet_req_complete()
In reply to Greg Kroah-HartmanFrom: Damien Le Moal <[email protected]>
[ Upstream commit 6173a77b7e9d3e202bdb9897b23f2a8afe7bf286 ]
An nvme target ->queue_response() operation implementation may free the request passed as argument. Such implementation potentially could result in a use after free of the request pointer when percpu_ref_put() is called in nvmet_req_complete().
Avoid such problem by using a local variable to save the sq pointer before calling __nvmet_req_complete(), thus avoiding dereferencing the req pointer after that function call.
--- drivers/nvme/target/core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/nvme/target/core.c +3 -1
@@ -756,8 +756,10 @@ static void __nvmet_req_complete(struct nvmet_req *req, u16 status)void nvmet_req_complete (struct nvmet_req *req,u16 status) { +struct nvmet_sq *sq = req->sq; +__nvmet_req_complete (req, status); -percpu_ref_put (&req->sq->ref); +percpu_ref_put (&sq->ref); }EXPORT_SYMBOL_GPL (nvmet_req_complete);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 69/211 block: sunvdc: add check for mdesc_grab() returning NULL
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 6030363199e3a6341afb467ddddbed56640cbf6a ]
In vdc_port_probe(), we should check the return value of mdesc_grab() as it may return NULL, which can cause potential NPD bug.
--- drivers/block/sunvdc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/block/sunvdc.c +2 -0
@@ -972,6 +972,8 @@ static int vdc_port_probe(struct vio_dev *vdev, const struct vio_device_id *id)print_version (); hp =mdesc_grab (); +if (!hp) +return -ENODEV ; err = -ENODEV ;if ((vdev->dev_no <<PARTITION_SHIFT ) & ~(u64 )MINORMASK ) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 70/211 block: count ios and sectors when io is done for bio-based device
In reply to Greg Kroah-HartmanFrom: Yu Kuai <[email protected]>
[ Upstream commit 5f27571382ca42daa3e3d40d1b252bf18c2b61d2 ]
While using iostat for raid, I observed very strange 'await' occasionally, and turns out it's due to that 'ios' and 'sectors' is counted in bdev_start_io_acct(), while 'nsecs' is counted in bdev_end_io_acct(). I'm not sure why they are ccounted like that but I think this behaviour is obviously wrong because user will get wrong disk stats.
Fix the problem by counting 'ios' and 'sectors' when io is done, like what rq-based device does.
--- block/blk-core.c | 16 ++++++---------- drivers/block/zram/zram_drv.c | 4 ++-- drivers/md/dm.c | 6 +++--- drivers/nvme/host/multipath.c | 8 ++++---- include/linux/blkdev.h | 5 ++--- 5 files changed, 17 insertions(+), 22 deletions(-)
block/blk-core.c +6 -10
@@ -946,16 +946,11 @@ void update_io_ticks(struct block_device *part, unsigned long now, bool end) } } -unsigned long bdev_start_io_acct (struct block_device *bdev, -unsigned int sectors,enum req_op op, +unsigned long bdev_start_io_acct (struct block_device *bdev,enum req_op op,unsigned long start_time) { -const int sgrp =op_stat_group (op); -part_stat_lock ();update_io_ticks (bdev, start_time, false); -part_stat_inc (bdev, ios[sgrp]); -part_stat_add (bdev, sectors[sgrp], sectors);part_stat_local_inc (bdev, in_flight[op_is_write (op)]);part_stat_unlock ();
@@ -971,13 +966,12 @@ EXPORT_SYMBOL(bdev_start_io_acct);*/ unsigned long bio_start_io_acct (struct bio *bio) { -return bdev_start_io_acct (bio->bi_bdev,bio_sectors (bio), -bio_op (bio), jiffies); +return bdev_start_io_acct (bio->bi_bdev,bio_op (bio), jiffies); }EXPORT_SYMBOL_GPL (bio_start_io_acct);void bdev_end_io_acct (struct block_device *bdev,enum req_op op, -unsigned long start_time) +unsigned int sectors,unsigned long start_time) {const int sgrp =op_stat_group (op);unsigned long now =READ_ONCE (jiffies);
@@ -985,6 +979,8 @@ void bdev_end_io_acct(struct block_device *bdev, enum req_op op,part_stat_lock ();update_io_ticks (bdev, now, true); +part_stat_inc (bdev, ios[sgrp]); +part_stat_add (bdev, sectors[sgrp], sectors);part_stat_add (bdev, nsecs[sgrp],jiffies_to_nsecs (duration));part_stat_local_dec (bdev, in_flight[op_is_write (op)]);part_stat_unlock ();
@@ -994,7 +990,7 @@ EXPORT_SYMBOL(bdev_end_io_acct);void bio_end_io_acct_remapped (struct bio *bio,unsigned long start_time,struct block_device *orig_bdev) { -bdev_end_io_acct (orig_bdev,bio_op (bio), start_time); +bdev_end_io_acct (orig_bdev,bio_op (bio),bio_sectors (bio), start_time); }EXPORT_SYMBOL_GPL (bio_end_io_acct_remapped);
drivers/block/zram/zram_drv.c +2 -2
@@ -2108,9 +2108,9 @@ static int zram_rw_page(struct block_device *bdev, sector_t sector, bv.bv_offset =0 ; start_time =bdev_start_io_acct (bdev->bd_disk->part0, -SECTORS_PER_PAGE , op, jiffies); + op, jiffies); ret =zram_bvec_rw (zram, &bv, index, offset, op,NULL ); -bdev_end_io_acct (bdev->bd_disk->part0, op, start_time); +bdev_end_io_acct (bdev->bd_disk->part0, op,SECTORS_PER_PAGE , start_time); out:/* * If I/O fails, just return error(ie, non-zero) without
drivers/md/dm.c +3 -3
@@ -510,10 +510,10 @@ static void dm_io_acct(struct dm_io *io, bool end) sectors = io->sectors;if (!end) -bdev_start_io_acct (bio->bi_bdev, sectors,bio_op (bio), - start_time); +bdev_start_io_acct (bio->bi_bdev,bio_op (bio), start_time);else -bdev_end_io_acct (bio->bi_bdev,bio_op (bio), start_time); +bdev_end_io_acct (bio->bi_bdev,bio_op (bio), sectors, + start_time);if (static_branch_unlikely (&stats_enabled) &&unlikely (dm_stats_used (&md->stats))) {
drivers/nvme/host/multipath.c +4 -4
@@ -123,9 +123,8 @@ void nvme_mpath_start_request(struct request *rq)return ;nvme_req (rq)->flags |=NVME_MPATH_IO_STATS ; -nvme_req (rq)->start_time =bdev_start_io_acct (disk->part0, -blk_rq_bytes (rq) >>SECTOR_SHIFT , -req_op (rq), jiffies); +nvme_req (rq)->start_time =bdev_start_io_acct (disk->part0,req_op (rq), + jiffies); }EXPORT_SYMBOL_GPL (nvme_mpath_start_request);
@@ -136,7 +135,8 @@ void nvme_mpath_end_request(struct request *rq)if (!(nvme_req (rq)->flags &NVME_MPATH_IO_STATS ))return ;bdev_end_io_acct (ns->head->disk->part0,req_op (rq), -nvme_req (rq)->start_time); +blk_rq_bytes (rq) >>SECTOR_SHIFT , +nvme_req (rq)->start_time); }void nvme_kick_requeue_lists (struct nvme_ctrl *ctrl)
include/linux/blkdev.h +2 -3
@@ -1434,11 +1434,10 @@ static inline void blk_wake_io_task(struct task_struct *waiter)wake_up_process (waiter); } -unsigned long bdev_start_io_acct (struct block_device *bdev, -unsigned int sectors,enum req_op op, +unsigned long bdev_start_io_acct (struct block_device *bdev,enum req_op op,unsigned long start_time);void bdev_end_io_acct (struct block_device *bdev,enum req_op op, -unsigned long start_time); +unsigned int sectors,unsigned long start_time);unsigned long bio_start_io_acct (struct bio *bio); void bio_end_io_acct_remapped(struct bio *bio, unsigned long start_time,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 71/211 net/mlx5e: Fix macsec ASO context alignment
In reply to Greg Kroah-HartmanFrom: Emeel Hakim <[email protected]>
[ Upstream commit 37beabe9a891b92174cd1aafbfa881fe9e05aa87 ]
Currently mlx5e_macsec_umr struct does not satisfy hardware memory alignment requirement. Hence the result of querying advanced steering operation (ASO) is not copied to the memory region as expected.
Fix by satisfying hardware memory alignment requirement and move context to be first field in struct for better readability.
--- drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c +1 -1
@@ -89,8 +89,8 @@ struct mlx5e_macsec_rx_sc { };struct mlx5e_macsec_umr { +u8 __aligned(64) ctx[MLX5_ST_SZ_BYTES (macsec_aso)];dma_addr_t dma_addr; -u8 ctx[MLX5_ST_SZ_BYTES (macsec_aso)];u32 mkey; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 72/211 net/mlx5e: Dont cache tunnel offloads capability
In reply to Greg Kroah-HartmanFrom: Parav Pandit <[email protected]>
[ Upstream commit 9a92fe1db9e57ea94388a1d768e8ee42af858377 ]
When mlx5e attaches again after device health recovery, the device capabilities might have changed by the eswitch manager.
For example in one flow when ECPF changes the eswitch mode between legacy and switchdev, it updates the flow table tunnel capability.
The cached value is only used in one place, so just check the capability there instead.
--- drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 - drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 +--- drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 1 - drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c | 1 - 4 files changed, 1 insertion(+), 6 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en.h +0 -1
@@ -313,7 +313,6 @@ struct mlx5e_params { } channel; } mqprio;bool rx_cqe_compress_def; -bool tunneled_offload_en;struct dim_cq_moder rx_cq_moderation;struct dim_cq_moder tx_cq_moderation;struct mlx5e_packet_merge_param packet_merge;
drivers/net/ethernet/mellanox/mlx5/core/en_main.c +1 -3
@@ -4923,8 +4923,6 @@ void mlx5e_build_nic_params(struct mlx5e_priv *priv, struct mlx5e_xsk *xsk, u16/* TX inline */ mlx5_query_min_inline (mdev, ¶ms->tx_min_inline_mode); - params->tunneled_offload_en =mlx5_tunnel_inner_ft_supported (mdev); -/* AF_XDP */ params->xsk = xsk;
@@ -5223,7 +5221,7 @@ static int mlx5e_init_nic_rx(struct mlx5e_priv *priv) } features =MLX5E_RX_RES_FEATURE_PTP ; -if (priv->channels.params.tunneled_offload_en) +if (mlx5_tunnel_inner_ft_supported (mdev)) features |=MLX5E_RX_RES_FEATURE_INNER_FT ; err = mlx5e_rx_res_init(priv->rx_res, priv->mdev, features, priv->max_nch, priv->drop_rq.rqn,
drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +0 -1
@@ -752,7 +752,6 @@ static void mlx5e_build_rep_params(struct net_device *netdev)mlx5e_set_rx_cq_mode_params (params, cq_period_mode); params->mqprio.num_tc =1 ; - params->tunneled_offload_en = false;if (rep->vport !=MLX5_VPORT_UPLINK ) params->vlan_strip_disable = true;
drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c +0 -1
@@ -70,7 +70,6 @@ static void mlx5i_build_nic_params(struct mlx5_core_dev *mdev, params->packet_merge.type =MLX5E_PACKET_MERGE_NONE ; params->hard_mtu =MLX5_IB_GRH_BYTES +MLX5_IPOIB_HARD_LEN ; - params->tunneled_offload_en = false;/* CQE compression is not supported for IPoIB */ params->rx_cqe_compress_def = false;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 73/211 net/mlx5: Fix setting ec_function bit in MANAGE_PAGES
In reply to Greg Kroah-HartmanFrom: Parav Pandit <[email protected]>
[ Upstream commit ba5d8f72b82cc197355c9340ef89dab813815865 ]
When ECPF is a page supplier, reclaim pages missed to honor the ec_function bit provided by the firmware. It always used the ec_function to true during driver unload flow for ECPF. This is incorrect.
Honor the ec_function bit provided by device during page allocation request event.
--- .../ethernet/mellanox/mlx5/core/pagealloc.c | 22 ++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c +17 -5
@@ -82,6 +82,16 @@ static u16 func_id_to_type(struct mlx5_core_dev *dev, u16 func_id, bool ec_functreturn func_id <=mlx5_core_max_vfs (dev) ?MLX5_VF :MLX5_SF ; } +static u32 mlx5_get_ec_function (u32 function) +{ +return function >>16 ; +} + +static u32 mlx5_get_func_id (u32 function) +{ +return function &0xffff ; +} +static struct rb_root *page_root_per_function (struct mlx5_core_dev *dev,u32 function) {struct rb_root *root;
@@ -665,20 +675,22 @@ static int optimal_reclaimed_pages(void) }static int mlx5_reclaim_root_pages (struct mlx5_core_dev *dev, -struct rb_root *root,u16 func_id) +struct rb_root *root,u32 function) {u64 recl_pages_to_jiffies =msecs_to_jiffies (mlx5_tout_ms (dev,RECLAIM_PAGES ));unsigned long end = jiffies + recl_pages_to_jiffies;while (!RB_EMPTY_ROOT (root)) { +u32 ec_function =mlx5_get_ec_function (function); +u32 function_id =mlx5_get_func_id (function);int nclaimed;int err; - err =reclaim_pages (dev, func_id,optimal_reclaimed_pages (), - &nclaimed, false,mlx5_core_is_ecpf (dev)); + err =reclaim_pages (dev, function_id,optimal_reclaimed_pages (), + &nclaimed, false, ec_function);if (err) { -mlx5_core_warn (dev,"failed reclaiming pages (%d) for func id 0x%x\n" , - err, func_id); +mlx5_core_warn (dev,"reclaim_pages err (%d) func_id=0x%x ec_func=0x%x\n" , + err, function_id, ec_function);return err; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 74/211 net/mlx5: Disable eswitch before waiting for VF pages
In reply to Greg Kroah-HartmanFrom: Daniel Jurgens <[email protected]>
[ Upstream commit 7ba930fc25def6fd736abcdfa224272948a65cf7 ]
The offending commit changed the ordering of moving to legacy mode and waiting for the VF pages. Moving to legacy mode is important in bluefield, because it sends the host driver into error state, and frees its pages. Without this transition we end up waiting 2 minutes for pages that aren't coming before carrying on with the unload process.
--- drivers/net/ethernet/mellanox/mlx5/core/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/main.c +1 -1
@@ -1346,8 +1346,8 @@ static void mlx5_unload(struct mlx5_core_dev *dev) {mlx5_devlink_traps_unregister (priv_to_devlink (dev));mlx5_sf_dev_table_destroy (dev); -mlx5_sriov_detach (dev);mlx5_eswitch_disable (dev->priv.eswitch); +mlx5_sriov_detach (dev);mlx5_lag_remove_mdev (dev);mlx5_ec_cleanup (dev);mlx5_sf_hw_table_destroy (dev);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 75/211 net/mlx5: E-switch, Fix wrong usage of source port rewrite in split rules
In reply to Greg Kroah-HartmanFrom: Maor Dickman <[email protected]>
[ Upstream commit 1313d78ac0c1cfcff7bdece8da54b080e71487c4 ]
In few cases, rules with mirror use case are split to two FTEs, one which do the mirror action and forward to second FTE which do the rest of the rule actions and the second redirect action.
In case of mirror rules which do split and forward to ovs internal port or VF stack devices, source port rewrite should be used in the second FTE but it is wrongly also set in the first FTE which break the offload.
Fix this issue by removing the wrong check if source port rewrite is needed to be used on the first FTE of the split and instead return EOPNOTSUPP which will block offload of rules which mirror to ovs internal port or VF stack devices which isn't supported.
--- .../net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +5 -5
@@ -726,11 +726,11 @@ mlx5_eswitch_add_fwd_rule(struct mlx5_eswitch *esw, flow_act.action =MLX5_FLOW_CONTEXT_ACTION_FWD_DEST ;for (i =0 ; i < esw_attr->split_count; i++) { -if (esw_is_indir_table (esw, attr)) - err =esw_setup_indir_table (dest, &flow_act, esw, attr, spec, false, &i); -else if (esw_is_chain_src_port_rewrite (esw, esw_attr)) - err =esw_setup_chain_src_port_rewrite (dest, &flow_act, esw, chains, attr, - &i); +if (esw_attr->dests[i].flags &MLX5_ESW_DEST_CHAIN_WITH_SRC_PORT_CHANGE ) +/* Source port rewrite (forward to ovs internal port or statck device) isn't +* supported in the rule of split action. +*/ + err = -EOPNOTSUPP ;else esw_setup_vport_dest (dest, &flow_act, esw, esw_attr, i, i, false);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 76/211 net/mlx5: E-switch, Fix missing set of split_count when forward to ovs internal port
In reply to Greg Kroah-HartmanFrom: Maor Dickman <[email protected]>
[ Upstream commit 28d3815a629cbdee660dd1c9de28d77cb3d77917 ]
Rules with mirror actions are split to two FTEs when the actions after the mirror action contains pedit, vlan push/pop or ct. Forward to ovs internal port adds implicit header rewrite (pedit) but missing trigger to do split.
Fix by setting split_count when forwarding to ovs internal port which will trigger split in mirror rules.
--- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +1 -0
@@ -4240,6 +4240,7 @@ int mlx5e_set_fwd_to_int_port_actions(struct mlx5e_priv *priv, esw_attr->dest_int_port = dest_int_port; esw_attr->dests[out_index].flags |=MLX5_ESW_DEST_CHAIN_WITH_SRC_PORT_CHANGE ; + esw_attr->split_count = out_index;/* Forward to root fdb for matching against the new source vport */ attr->dest_chain =0 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 77/211 net/mlx5e: Fix cleanup null-ptr deref on encap lock
In reply to Greg Kroah-HartmanFrom: Paul Blakey <[email protected]>
[ Upstream commit c9668f0b1d28570327dbba189f2c61f6f9e43ae7 ]
During module is unloaded while a peer tc flow is still offloaded, first the peer uplink rep profile is changed to a nic profile, and so neigh encap lock is destroyed. Next during unload, the VF reps netdevs are unregistered which causes the original non-peer tc flow to be deleted, which deletes the peer flow. The peer flow deletion detaches the encap entry and try to take the already destroyed encap lock, causing the below trace.
Fix this by clearing peer flows during tc eswitch cleanup (mlx5e_tc_esw_cleanup()).
Relevant trace:
[ 4316.837128] BUG: kernel NULL pointer dereference, address: 00000000000001d8 [ 4316.842239] RIP: 0010:__mutex_lock+0xb5/0xc40 [ 4316.851897] Call Trace: [ 4316.852481] <TASK> [ 4316.857214] mlx5e_rep_neigh_entry_release+0x93/0x790 [mlx5_core] [ 4316.858258] mlx5e_rep_encap_entry_detach+0xa7/0xf0 [mlx5_core] [ 4316.859134] mlx5e_encap_dealloc+0xa3/0xf0 [mlx5_core] [ 4316.859867] clean_encap_dests.part.0+0x5c/0xe0 [mlx5_core] [ 4316.860605] mlx5e_tc_del_fdb_flow+0x32a/0x810 [mlx5_core] [ 4316.862609] __mlx5e_tc_del_fdb_peer_flow+0x1a2/0x250 [mlx5_core] [ 4316.863394] mlx5e_tc_del_flow+0x(/0x630 [mlx5_core] [ 4316.864090] mlx5e_flow_put+0x5f/0x100 [mlx5_core] [ 4316.864771] mlx5e_delete_flower+0x4de/0xa40 [mlx5_core] [ 4316.865486] tc_setup_cb_reoffload+0x20/0x80 [ 4316.865905] fl_reoffload+0x47c/0x510 [cls_flower] [ 4316.869181] tcf_block_playback_offloads+0x91/0x1d0 [ 4316.869649] tcf_block_unbind+0xe7/0x1b0 [ 4316.870049] tcf_block_offload_cmd.isra.0+0x1ee/0x270 [ 4316.879266] tcf_block_offload_unbind+0x61/0xa0 [ 4316.879711] __tcf_block_put+0xa4/0x310
--- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +10 -0
@@ -5374,6 +5374,16 @@ int mlx5e_tc_esw_init(struct mlx5_rep_uplink_priv *uplink_priv)void mlx5e_tc_esw_cleanup (struct mlx5_rep_uplink_priv *uplink_priv) { +struct mlx5e_rep_priv *rpriv; +struct mlx5_eswitch *esw; +struct mlx5e_priv *priv; + + rpriv = container_of(uplink_priv, struct mlx5e_rep_priv, uplink_priv); + priv =netdev_priv (rpriv->netdev); + esw = priv->mdev->priv.eswitch; + +mlx5e_tc_clean_fdb_peer_flows (esw); +mlx5e_tc_tun_cleanup (uplink_priv->encap);mapping_destroy (uplink_priv->tunnel_enc_opts_mapping);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 78/211 net/mlx5: Set BREAK_FW_WAIT flag first when removing driver
In reply to Greg Kroah-HartmanFrom: Shay Drory <[email protected]>
[ Upstream commit 031a163f2c476adcb2c01e27a7d323e66174ac11 ]
Currently, BREAK_FW_WAIT flag is set after syncing with fw_reset. However, fw_reset can call mlx5_load_one() which is waiting for fw init bit and BREAK_FW_WAIT flag is intended to stop. e.g.: the driver might wait on a loop it should exit.
Fix it by setting the flag before syncing with fw_reset.
--- drivers/net/ethernet/mellanox/mlx5/core/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/main.c +1 -1
@@ -1768,11 +1768,11 @@ static void remove_one(struct pci_dev *pdev)struct mlx5_core_dev *dev =pci_get_drvdata (pdev);struct devlink *devlink =priv_to_devlink (dev); +set_bit (MLX5_BREAK_FW_WAIT , &dev->intf_state);/* mlx5_drain_fw_reset() is using devlink APIs. Hence, we must drain * fw_reset before unregistering the devlink. */ mlx5_drain_fw_reset (dev); -set_bit (MLX5_BREAK_FW_WAIT , &dev->intf_state);devlink_unregister (devlink);mlx5_sriov_disable (pdev);mlx5_crdump_disable (dev);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 79/211 veth: Fix use after free in XDP_REDIRECT
In reply to Greg Kroah-HartmanFrom: Shawn Bohrer <[email protected]>
[ Upstream commit 7c10131803e45269ddc6c817f19ed649110f3cae ]
Commit 718a18a0c8a6 ("veth: Rework veth_xdp_rcv_skb in order to accept non-linear skb") introduced a bug where it tried to use pskb_expand_head() if the headroom was less than XDP_PACKET_HEADROOM. This however uses kmalloc to expand the head, which will later allow consume_skb() to free the skb while is it still in use by AF_XDP.
Previously if the headroom was less than XDP_PACKET_HEADROOM we continued on to allocate a new skb from pages so this restores that behavior.
BUG: KASAN: use-after-free in __xsk_rcv+0x18d/0x2c0 Read of size 78 at addr ffff888976250154 by task napi/iconduit-g/148640 CPU: 5 PID: 148640 Comm: napi/iconduit-g Kdump: loaded Tainted: G O 6.1.4-cloudflare-kasan-2023.1.2 #1 Hardware name: Quanta Computer Inc. QuantaPlex T41S-2U/S2S-MB, BIOS S2S_3B10.03 06/21/2018 Call Trace: <TASK> dump_stack_lvl+0x34/0x48 print_report+0x170/0x473 ? __xsk_rcv+0x18d/0x2c0 kasan_report+0xad/0x130 ? __xsk_rcv+0x18d/0x2c0 kasan_check_range+0x149/0x1a0 memcpy+0x20/0x60 __xsk_rcv+0x18d/0x2c0 __xsk_map_redirect+0x1f3/0x490 ? veth_xdp_rcv_skb+0x89c/0x1ba0 [veth] xdp_do_redirect+0x5ca/0xd60 veth_xdp_rcv_skb+0x935/0x1ba0 [veth] ? __netif_receive_skb_list_core+0x671/0x920 ? veth_xdp+0x670/0x670 [veth] veth_xdp_rcv+0x304/0xa20 [veth] ? do_xdp_generic+0x150/0x150 ? veth_xdp_rcv_one+0xde0/0xde0 [veth] ? _raw_spin_lock_bh+0xe0/0xe0 ? newidle_balance+0x887/0xe30 ? __perf_event_task_sched_in+0xdb/0x800 veth_poll+0x139/0x571 [veth] ? veth_xdp_rcv+0xa20/0xa20 [veth] ? _raw_spin_unlock+0x39/0x70 ? finish_task_switch.isra.0+0x17e/0x7d0 ? __switch_to+0x5cf/0x1070 ? __schedule+0x95b/0x2640 ? io_schedule_timeout+0x160/0x160 __napi_poll+0xa1/0x440 napi_threaded_poll+0x3d1/0x460 ? __napi_poll+0x440/0x440 ? __kthread_parkme+0xc6/0x1f0 ? __napi_poll+0x440/0x440 kthread+0x2a2/0x340 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 </TASK> Freed by task 148640: kasan_save_stack+0x23/0x50 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x169/0x1d0 slab_free_freelist_hook+0xd2/0x190 __kmem_cache_free+0x1a1/0x2f0 skb_release_data+0x449/0x600 consume_skb+0x9f/0x1c0 veth_xdp_rcv_skb+0x89c/0x1ba0 [veth] veth_xdp_rcv+0x304/0xa20 [veth] veth_poll+0x139/0x571 [veth] __napi_poll+0xa1/0x440 napi_threaded_poll+0x3d1/0x460 kthread+0x2a2/0x340 ret_from_fork+0x22/0x30 The buggy address belongs to the object at ffff888976250000 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 340 bytes inside of
2048-byte region [ffff888976250000, ffff888976250800)
The buggy address belongs to the physical page: page:00000000ae18262a refcount:2 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x976250 head:00000000ae18262a order:3 compound_mapcount:0 compound_pincount:0 flags: 0x2ffff800010200(slab|head|node=0|zone=2|lastcpupid=0x1ffff) raw: 002ffff800010200 0000000000000000 dead000000000122 ffff88810004cf00 raw: 0000000000000000 0000000080080008 00000002ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888976250000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888976250080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
Quoted 1 line
ffff888976250100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888976250180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888976250200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
--- drivers/net/veth.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/veth.c +2 -4
@@ -701,7 +701,8 @@ static int veth_convert_skb_to_xdp_buff(struct veth_rq *rq,u32 frame_sz;if (skb_shared (skb) ||skb_head_is_locked (skb) || -skb_shinfo (skb)->nr_frags) { +skb_shinfo (skb)->nr_frags || +skb_headroom (skb) <XDP_PACKET_HEADROOM ) {u32 size, len, max_head_size, off;struct sk_buff *nskb;struct page *page;
@@ -766,9 +767,6 @@ static int veth_convert_skb_to_xdp_buff(struct veth_rq *rq,consume_skb (skb); skb = nskb; - }else if (skb_headroom (skb) <XDP_PACKET_HEADROOM && -pskb_expand_head (skb,VETH_XDP_HEADROOM ,0 ,GFP_ATOMIC )) { - goto drop; }/* SKB "head" area always have tailroom for skb_shared_info */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 80/211 ice: xsk: disable txq irq before flushing hw
In reply to Greg Kroah-HartmanFrom: Maciej Fijalkowski <[email protected]>
[ Upstream commit b830c9642386867863ac64295185f896ff2928ac ]
ice_qp_dis() intends to stop a given queue pair that is a target of xsk pool attach/detach. One of the steps is to disable interrupts on these queues. It currently is broken in a way that txq irq is turned off *after* HW flush which in turn takes no effect.
ice_qp_dis():
-> ice_qvec_dis_irq()
--> disable rxq irq
--> flush hw
-> ice_vsi_stop_tx_ring()
-->disable txq irq
Below splat can be triggered by following steps:
- start xdpsock WITHOUT loading xdp prog
- run xdp_rxq_info with XDP_TX action on this interface
- start traffic
- terminate xdpsock
[ 256.312485] BUG: kernel NULL pointer dereference, address: 0000000000000018 [ 256.319560] #PF: supervisor read access in kernel mode [ 256.324775] #PF: error_code(0x0000) - not-present page [ 256.329994] PGD 0 P4D 0 [ 256.332574] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 256.337006] CPU: 3 PID: 32 Comm: ksoftirqd/3 Tainted: G OE 6.2.0-rc5+ #51 [ 256.345218] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [ 256.355807] RIP: 0010:ice_clean_rx_irq_zc+0x9c/0x7d0 [ice] [ 256.361423] Code: b7 8f 8a 00 00 00 66 39 ca 0f 84 f1 04 00 00 49 8b 47 40 4c 8b 24 d0 41 0f b7 45 04 66 25 ff 3f 66 89 04 24 0f 84 85 02 00 00 <49> 8b 44 24 18 0f b7 14 24 48 05 00 01 00 00 49 89 04 24 49 89 44 [ 256.380463] RSP: 0018:ffffc900088bfd20 EFLAGS: 00010206 [ 256.385765] RAX: 000000000000003c RBX: 0000000000000035 RCX: 000000000000067f [ 256.393012] RDX: 0000000000000775 RSI: 0000000000000000 RDI: ffff8881deb3ac80 [ 256.400256] RBP: 000000000000003c R08: ffff889847982710 R09: 0000000000010000 [ 256.407500] R10: ffffffff82c060c0 R11: 0000000000000004 R12: 0000000000000000 [ 256.414746] R13: ffff88811165eea0 R14: ffffc9000d255000 R15: ffff888119b37600 [ 256.421990] FS: 0000000000000000(0000) GS:ffff8897e0cc0000(0000) knlGS:0000000000000000 [ 256.430207] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 256.436036] CR2: 0000000000000018 CR3: 0000000005c0a006 CR4: 00000000007706e0 [ 256.443283] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 256.450527] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 256.457770] PKRU: 55555554 [ 256.460529] Call Trace: [ 256.463015] <TASK> [ 256.465157] ? ice_xmit_zc+0x6e/0x150 [ice] [ 256.469437] ice_napi_poll+0x46d/0x680 [ice] [ 256.473815] ? _raw_spin_unlock_irqrestore+0x1b/0x40 [ 256.478863] __napi_poll+0x29/0x160 [ 256.482409] net_rx_action+0x136/0x260 [ 256.486222] __do_softirq+0xe8/0x2e5 [ 256.489853] ? smpboot_thread_fn+0x2c/0x270 [ 256.494108] run_ksoftirqd+0x2a/0x50 [ 256.497747] smpboot_thread_fn+0x1c1/0x270 [ 256.501907] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 256.506594] kthread+0xea/0x120 [ 256.509785] ? __pfx_kthread+0x10/0x10 [ 256.513597] ret_from_fork+0x29/0x50 [ 256.517238] </TASK>
In fact, irqs were not disabled and napi managed to be scheduled and run while xsk_pool pointer was still valid, but SW ring of xdp_buff pointers was already freed.
To fix this, call ice_qvec_dis_irq() after ice_vsi_stop_tx_ring(). Also while at it, remove redundant ice_clean_rx_ring() call - this is handled in ice_qp_clean_rings().
--- drivers/net/ethernet/intel/ice/ice_xsk.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/ethernet/intel/ice/ice_xsk.c +2 -3
@@ -184,8 +184,6 @@ static int ice_qp_dis(struct ice_vsi *vsi, u16 q_idx) }netif_tx_stop_queue (netdev_get_tx_queue (vsi->netdev, q_idx)); -ice_qvec_dis_irq (vsi, rx_ring, q_vector); -ice_fill_txq_meta (vsi, tx_ring, &txq_meta); err =ice_vsi_stop_tx_ring (vsi,ICE_NO_RESET ,0 , tx_ring, &txq_meta);if (err)
@@ -200,10 +198,11 @@ static int ice_qp_dis(struct ice_vsi *vsi, u16 q_idx)if (err)return err; } +ice_qvec_dis_irq (vsi, rx_ring, q_vector); + err =ice_vsi_ctrl_one_rx_ring (vsi, false, q_idx, true);if (err)return err; -ice_clean_rx_ring (rx_ring);ice_qvec_toggle_napi (vsi, q_vector, false);ice_qp_clean_rings (vsi, q_idx);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 81/211 net: dsa: dont error out when drivers return ETH_DATA_LEN in .port_max_mtu()
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 636e8adf7878eab3614250234341bde45537f47a ]
Currently, when dsa_slave_change_mtu() is called on a user port where dev->max_mtu is 1500 (as returned by ds->ops->port_max_mtu()), the code will stumble upon this check:
if (new_master_mtu > mtu_limit) return -ERANGE;
because new_master_mtu is adjusted for the tagger overhead but mtu_limit is not.
But it would be good if the logic went through, for example if the DSA master really depends on an MTU adjustment to accept DSA-tagged frames.
To make the code pass through the check, we need to adjust mtu_limit for the overhead as well, if the minimum restriction was caused by the DSA user port's MTU (dev->max_mtu). A DSA user port MTU and a DSA master MTU are always offset by the protocol overhead.
Currently no drivers return 1500 .port_max_mtu(), but this is only temporary and a bug in itself - mv88e6xxx should have done that, but since commit b9c587fed61c ("dsa: mv88e6xxx: Include tagger overhead when setting MTU for DSA and CPU ports") it no longer does. This is a preparation for fixing that.
--- net/dsa/slave.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
net/dsa/slave.c +5 -4
@@ -1899,6 +1899,7 @@ int dsa_slave_change_mtu(struct net_device *dev, int new_mtu)int new_master_mtu;int old_master_mtu;int mtu_limit; +int overhead;int cpu_mtu;int err;
@@ -1927,9 +1928,10 @@ int dsa_slave_change_mtu(struct net_device *dev, int new_mtu) largest_mtu = slave_mtu; } - mtu_limit =min_t (int, master->max_mtu, dev->max_mtu); + overhead =dsa_tag_protocol_overhead (cpu_dp->tag_ops); + mtu_limit =min_t (int, master->max_mtu, dev->max_mtu + overhead); old_master_mtu = master->mtu; - new_master_mtu = largest_mtu +dsa_tag_protocol_overhead (cpu_dp->tag_ops); + new_master_mtu = largest_mtu + overhead;if (new_master_mtu > mtu_limit)return -ERANGE ;
@@ -1964,8 +1966,7 @@ int dsa_slave_change_mtu(struct net_device *dev, int new_mtu) out_port_failed:if (new_master_mtu != old_master_mtu) -dsa_port_mtu_change (cpu_dp, old_master_mtu - -dsa_tag_protocol_overhead (cpu_dp->tag_ops)); +dsa_port_mtu_change (cpu_dp, old_master_mtu - overhead); out_cpu_failed:if (new_master_mtu != old_master_mtu)dev_set_mtu (master, old_master_mtu);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 82/211 net: dsa: mv88e6xxx: fix max_mtu of 1492 on 6165, 6191, 6220, 6250, 6290
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 7e9517375a14f44ee830ca1c3278076dd65fcc8f ]
There are 3 classes of switch families that the driver is aware of, as far as mv88e6xxx_change_mtu() is concerned:
- MTU configuration is available per port. Here, the chip->info->ops->port_set_jumbo_size() method will be present.
- MTU configuration is global to the switch. Here, the chip->info->ops->set_max_frame_size() method will be present.
- We don't know how to change the MTU. Here, none of the above methods will be present.
Switch families MV88E6165, MV88E6191, MV88E6220, MV88E6250 and MV88E6290 fall in category 3.
The blamed commit has adjusted the MTU for all 3 categories by EDSA_HLEN (8 bytes), resulting in a new maximum MTU of 1492 being reported by the driver for these switches.
I don't have the hardware to test, but I do have a MV88E6390 switch on which I can simulate this by commenting out its .port_set_jumbo_size definition from mv88e6390_ops. The result is this set of messages at probe time:
mv88e6085 d0032004.mdio-mii:10: nonfatal error -34 setting MTU to 1500 on port 1 mv88e6085 d0032004.mdio-mii:10: nonfatal error -34 setting MTU to 1500 on port 2 mv88e6085 d0032004.mdio-mii:10: nonfatal error -34 setting MTU to 1500 on port 3 mv88e6085 d0032004.mdio-mii:10: nonfatal error -34 setting MTU to 1500 on port 4 mv88e6085 d0032004.mdio-mii:10: nonfatal error -34 setting MTU to 1500 on port 5 mv88e6085 d0032004.mdio-mii:10: nonfatal error -34 setting MTU to 1500 on port 6 mv88e6085 d0032004.mdio-mii:10: nonfatal error -34 setting MTU to 1500 on port 7 mv88e6085 d0032004.mdio-mii:10: nonfatal error -34 setting MTU to 1500 on port 8
It is highly implausible that there exist Ethernet switches which don't support the standard MTU of 1500 octets, and this is what the DSA framework says as well - the error comes from dsa_slave_create() -> dsa_slave_change_mtu(slave_dev, ETH_DATA_LEN).
But the error messages are alarming, and it would be good to suppress them.
As a consequence of this unlikeliness, we reimplement mv88e6xxx_get_max_mtu() and mv88e6xxx_change_mtu() on switches from the 3rd category as follows:
the maximum supported MTU is 1500, and any request to set the MTU to a value larger than that fails in dev_validate_mtu().
--- drivers/net/dsa/mv88e6xxx/chip.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/net/dsa/mv88e6xxx/chip.c +12 -4
@@ -3549,7 +3549,7 @@ static int mv88e6xxx_get_max_mtu(struct dsa_switch *ds, int port)return 10240 -VLAN_ETH_HLEN -EDSA_HLEN -ETH_FCS_LEN ; else if (chip->info->ops->set_max_frame_size) return 1632 - VLAN_ETH_HLEN - EDSA_HLEN - ETH_FCS_LEN; -return 1522 -VLAN_ETH_HLEN -EDSA_HLEN -ETH_FCS_LEN ; +return ETH_DATA_LEN ; }static int mv88e6xxx_change_mtu (struct dsa_switch *ds,int port,int new_mtu)
@@ -3557,6 +3557,17 @@ static int mv88e6xxx_change_mtu(struct dsa_switch *ds, int port, int new_mtu)struct mv88e6xxx_chip *chip = ds->priv;int ret =0 ; +/* For families where we don't know how to alter the MTU, +* just accept any value up to ETH_DATA_LEN +*/ +if (!chip->info->ops->port_set_jumbo_size && + !chip->info->ops->set_max_frame_size) { +if (new_mtu >ETH_DATA_LEN ) +return -EINVAL ; + +return 0 ; + } +if (dsa_is_dsa_port (ds, port) ||dsa_is_cpu_port (ds, port)) new_mtu +=EDSA_HLEN ;
@@ -3565,9 +3576,6 @@ static int mv88e6xxx_change_mtu(struct dsa_switch *ds, int port, int new_mtu) ret = chip->info->ops->port_set_jumbo_size (chip, port, new_mtu); else if (chip->info->ops->set_max_frame_size) ret = chip->info->ops->set_max_frame_size (chip, new_mtu); - else - if (new_mtu > 1522) - ret = -EINVAL ;mv88e6xxx_reg_unlock (chip);return ret;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 83/211 ravb: avoid PHY being resumed when interface is not up
In reply to Greg Kroah-HartmanFrom: Wolfram Sang <[email protected]>
[ Upstream commit 7f5ebf5dae42e710162f1c481ebcf28ab7b741c7 ]
RAVB doesn't need mdiobus suspend/resume, that's why it sets 'mac_managed_pm'. However, setting it needs to be moved from init to probe, so mdiobus PM functions will really never be called (e.g. when the interface is not up yet during suspend/resume).
--- drivers/net/ethernet/renesas/ravb_main.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/net/ethernet/renesas/ravb_main.c +10 -2
@@ -1455,8 +1455,6 @@ static int ravb_phy_init(struct net_device *ndev)phy_remove_link_mode (phydev, ETHTOOL_LINK_MODE_100baseT_Half_BIT); } -/* Indicate that the MAC is responsible for managing PHY PM */ - phydev->mac_managed_pm = true;phy_attached_info (phydev);return 0 ;
@@ -2379,6 +2377,8 @@ static int ravb_mdio_init(struct ravb_private *priv) {struct platform_device *pdev = priv->pdev;struct device *dev = &pdev->dev; +struct phy_device *phydev; +struct device_node *pn;int error;/* Bitbang init */
@@ -2400,6 +2400,14 @@ static int ravb_mdio_init(struct ravb_private *priv)if (error) goto out_free_bus; + pn =of_parse_phandle (dev->of_node,"phy-handle" ,0 ); + phydev =of_phy_find_device (pn); +if (phydev) { + phydev->mac_managed_pm = true; +put_device (&phydev->mdio.dev); + } +of_node_put (pn); +return 0 ; out_free_bus:
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 84/211 sh_eth: avoid PHY being resumed when interface is not up
In reply to Greg Kroah-HartmanFrom: Wolfram Sang <[email protected]>
[ Upstream commit c6be7136afb224a01d4cde2983ddebac8da98693 ]
SH_ETH doesn't need mdiobus suspend/resume, that's why it sets 'mac_managed_pm'. However, setting it needs to be moved from init to probe, so mdiobus PM functions will really never be called (e.g. when the interface is not up yet during suspend/resume).
--- drivers/net/ethernet/renesas/sh_eth.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/net/ethernet/renesas/sh_eth.c +10 -2
@@ -2029,8 +2029,6 @@ static int sh_eth_phy_init(struct net_device *ndev)if (mdp->cd->register_type !=SH_ETH_REG_GIGABIT )phy_set_max_speed (phydev,SPEED_100 ); -/* Indicate that the MAC is responsible for managing PHY PM */ - phydev->mac_managed_pm = true;phy_attached_info (phydev);return 0 ;
@@ -3074,6 +3072,8 @@ static int sh_mdio_init(struct sh_eth_private *mdp,struct bb_info *bitbang;struct platform_device *pdev = mdp->pdev;struct device *dev = &mdp->pdev->dev; +struct phy_device *phydev; +struct device_node *pn;/* create bit control struct for PHY */ bitbang =devm_kzalloc (dev,sizeof (struct bb_info ),GFP_KERNEL );
@@ -3108,6 +3108,14 @@ static int sh_mdio_init(struct sh_eth_private *mdp,if (ret) goto out_free_bus; + pn =of_parse_phandle (dev->of_node,"phy-handle" ,0 ); + phydev =of_phy_find_device (pn); +if (phydev) { + phydev->mac_managed_pm = true; +put_device (&phydev->mdio.dev); + } +of_node_put (pn); +return 0 ; out_free_bus:
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 85/211 ipv4: Fix incorrect table ID in IOCTL path
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
[ Upstream commit 8a2618e14f81604a9b6ad305d57e0c8da939cd65 ]
Commit f96a3d74554d ("ipv4: Fix incorrect route flushing when source address is deleted") started to take the table ID field in the FIB info structure into account when determining if two structures are identical or not. This field is initialized using the 'fc_table' field in the route configuration structure, which is not set when adding a route via IOCTL.
The above can result in user space being able to install two identical routes that only differ in the table ID field of their associated FIB info.
Fix by initializing the table ID field in the route configuration structure in the IOCTL path.
Before the fix:
# ip route add default via 192.0.2.2 # route add default gw 192.0.2.2 # ip -4 r show default # default via 192.0.2.2 dev dummy10 # default via 192.0.2.2 dev dummy10
After the fix:
# ip route add default via 192.0.2.2 # route add default gw 192.0.2.2 SIOCADDRT: File exists # ip -4 r show default default via 192.0.2.2 dev dummy10
Audited the code paths to ensure there are no other paths that do not properly initialize the route configuration structure when installing a route.
--- net/ipv4/fib_frontend.c | 3 +++ 1 file changed, 3 insertions(+)
net/ipv4/fib_frontend.c +3 -0
@@ -576,6 +576,9 @@ static int rtentry_to_fib_config(struct net *net, int cmd, struct rtentry *rt, cfg->fc_scope =RT_SCOPE_UNIVERSE ; } +if (!cfg->fc_table) + cfg->fc_table =RT_TABLE_MAIN ; +if (cmd ==SIOCDELRT )return 0 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 86/211 net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
In reply to Greg Kroah-HartmanFrom: Szymon Heidrich <[email protected]>
[ Upstream commit 43ffe6caccc7a1bb9d7442fbab521efbf6c1378c ]
Packet length check needs to be located after size and align_count calculation to prevent kernel panic in skb_pull() in case rx_cmd_a & RX_CMD_A_RED evaluates to true.
--- drivers/net/usb/smsc75xx.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/net/usb/smsc75xx.c +8 -2
@@ -2200,6 +2200,13 @@ static int smsc75xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb) size = (rx_cmd_a &RX_CMD_A_LEN ) -RXW_PADDING ; align_count = (4 - ((size +RXW_PADDING ) %4 )) %4 ; +if (unlikely (size > skb->len)) { +netif_dbg (dev, rx_err, dev->net, +"size err rx_cmd_a=0x%08x\n" , + rx_cmd_a); +return 0 ; + } +if (unlikely (rx_cmd_a &RX_CMD_A_RED )) {netif_dbg (dev, rx_err, dev->net,"Error rx_cmd_a=0x%08x\n" , rx_cmd_a);
@@ -2212,8 +2219,7 @@ static int smsc75xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb) dev->net->stats.rx_frame_errors++; }else {/* MAX_SINGLE_PACKET_SIZE + 4(CRC) + 2(COE) + 4(Vlan) */ -if (unlikely (size > (MAX_SINGLE_PACKET_SIZE +ETH_HLEN +12 ) || - size > skb->len)) { +if (unlikely (size > (MAX_SINGLE_PACKET_SIZE +ETH_HLEN +12 ))) {netif_dbg (dev, rx_err, dev->net,"size err rx_cmd_a=0x%08x\n" , rx_cmd_a);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 87/211 net: atlantic: Fix crash when XDP is enabled but no program is loaded
In reply to Greg Kroah-HartmanFrom: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit 37d010399f7552add2b68e2b347901c83562dab8 ]
The aq_xdp_run_prog() function falls back to the XDP_ABORTED action handler (using a goto) if the operations for any of the other actions fail. The XDP_ABORTED handler in turn calls the bpf_warn_invalid_xdp_action() tracepoint. However, the function also jumps into the XDP_PASS helper if no XDP program is loaded on the device, which means the XDP_ABORTED handler can be run with a NULL program pointer. This results in a NULL pointer deref because the tracepoint dereferences the 'prog' pointer passed to it.
This situation can happen in multiple ways:
- If a packet arrives between the removal of the program from the interface and the static_branch_dec() in aq_xdp_setup()
- If there are multiple devices using the same driver in the system and one of them has an XDP program loaded and the other does not.
Fix this by refactoring the aq_xdp_run_prog() function to remove the 'goto pass' handling if there is no XDP program loaded. Instead, factor out the skb building in a separate small helper function.
--- .../net/ethernet/aquantia/atlantic/aq_ring.c | 28 ++++++++++++++----- 1 file changed, 21 insertions(+), 7 deletions(-)
drivers/net/ethernet/aquantia/atlantic/aq_ring.c +21 -7
@@ -412,6 +412,25 @@ int aq_xdp_xmit(struct net_device *dev, int num_frames,return num_frames - drop; } +static struct sk_buff *aq_xdp_build_skb (struct xdp_buff *xdp, +struct net_device *dev, +struct aq_ring_buff_s *buff) +{ +struct xdp_frame *xdpf; +struct sk_buff *skb; + + xdpf =xdp_convert_buff_to_frame (xdp); +if (unlikely (!xdpf)) +return NULL ; + + skb =xdp_build_skb_from_frame (xdpf, dev); +if (!skb) +return NULL ; + +aq_get_rxpages_xdp (buff, xdp); +return skb; +} + static struct sk_buff *aq_xdp_run_prog(struct aq_nic_s *aq_nic, struct xdp_buff *xdp, struct aq_ring_s *rx_ring,
@@ -431,7 +450,7 @@ static struct sk_buff *aq_xdp_run_prog(struct aq_nic_s *aq_nic, prog =READ_ONCE (rx_ring->xdp_prog);if (!prog) - goto pass; +return aq_xdp_build_skb (xdp, aq_nic->ndev, buff);prefetchw (xdp->data_hard_start);/* xdp_frame write */
@@ -442,17 +461,12 @@ static struct sk_buff *aq_xdp_run_prog(struct aq_nic_s *aq_nic, act =bpf_prog_run_xdp (prog, xdp);switch (act) {case XDP_PASS : -pass: - xdpf =xdp_convert_buff_to_frame (xdp); -if (unlikely (!xdpf)) - goto out_aborted; - skb =xdp_build_skb_from_frame (xdpf, aq_nic->ndev); + skb =aq_xdp_build_skb (xdp, aq_nic->ndev, buff);if (!skb) goto out_aborted;u64_stats_update_begin (&rx_ring->stats.rx.syncp); ++rx_ring->stats.rx.xdp_pass;u64_stats_update_end (&rx_ring->stats.rx.syncp); -aq_get_rxpages_xdp (buff, xdp);return skb;case XDP_TX : xdpf =xdp_convert_buff_to_frame (xdp);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 88/211 net/iucv: Fix size of interrupt data
In reply to Greg Kroah-HartmanFrom: Alexandra Winter <[email protected]>
[ Upstream commit 3d87debb8ed2649608ff432699e7c961c0c6f03b ]
iucv_irq_data needs to be 4 bytes larger.
These bytes are not used by the iucv module, but written by the z/VM hypervisor in case a CPU is deconfigured.
Reported as:
BUG dma-kmalloc-64 (Not tainted): kmalloc Redzone overwritten
-----------------------------------------------------------------------------
0x0000000000400564-0x0000000000400567 @offset=1380. First byte 0x80 instead of 0xcc Allocated in iucv_cpu_prepare+0x44/0xd0 age=167839 cpu=2 pid=1
__kmem_cache_alloc_node+0x166/0x450 kmalloc_node_trace+0x3a/0x70 iucv_cpu_prepare+0x44/0xd0 cpuhp_invoke_callback+0x156/0x2f0 cpuhp_issue_call+0xf0/0x298 __cpuhp_setup_state_cpuslocked+0x136/0x338 __cpuhp_setup_state+0xf4/0x288 iucv_init+0xf4/0x280 do_one_initcall+0x78/0x390 do_initcalls+0x11a/0x140 kernel_init_freeable+0x25e/0x2a0 kernel_init+0x2e/0x170 __ret_from_fork+0x3c/0x58 ret_from_fork+0xa/0x40 Freed in iucv_init+0x92/0x280 age=167839 cpu=2 pid=1 __kmem_cache_free+0x308/0x358 iucv_init+0x92/0x280 do_one_initcall+0x78/0x390 do_initcalls+0x11a/0x140 kernel_init_freeable+0x25e/0x2a0 kernel_init+0x2e/0x170 __ret_from_fork+0x3c/0x58 ret_from_fork+0xa/0x40
Slab 0x0000037200010000 objects=32 used=30 fp=0x0000000000400640 flags=0x1ffff00000010200(slab|head|node=0|zone=0| Object 0x0000000000400540 @offset=1344 fp=0x0000000000000000
Redzone 0000000000400500: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ Redzone 0000000000400510: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ Redzone 0000000000400520: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ Redzone 0000000000400530: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
Object 0000000000400540: 00 01 00 03 00 00 00 00 00 00 00 00 00 00 00 00 ................
Object 0000000000400550: f3 86 81 f2 f4 82 f8 82 f0 f0 f0 f0 f0 f0 f0 f2 ................
Object 0000000000400560: 00 00 00 00 80 00 00 00 cc cc cc cc cc cc cc cc ................
Object 0000000000400570: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
Redzone 0000000000400580: cc cc cc cc cc cc cc cc ........
Padding 00000000004005d4: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ Padding 00000000004005e4: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZZZZZ
Padding 00000000004005f4: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZ
CPU: 6 PID: 121030 Comm: 116-pai-crypto. Not tainted 6.3.0-20230221.rc0.git4.99b8246b2d71.300.fc37.s390x+debug #1 Hardware name: IBM 3931 A01 704 (z/VM 7.3.0) Call Trace: [<000000032aa034ec>] dump_stack_lvl+0xac/0x100 [<0000000329f5a6cc>] check_bytes_and_report+0x104/0x140 [<0000000329f5aa78>] check_object+0x370/0x3c0 [<0000000329f5ede6>] free_debug_processing+0x15e/0x348 [<0000000329f5f06a>] free_to_partial_list+0x9a/0x2f0 [<0000000329f5f4a4>] __slab_free+0x1e4/0x3a8 [<0000000329f61768>] __kmem_cache_free+0x308/0x358 [<000000032a91465c>] iucv_cpu_dead+0x6c/0x88 [<0000000329c2fc66>] cpuhp_invoke_callback+0x156/0x2f0 [<000000032aa062da>] _cpu_down.constprop.0+0x22a/0x5e0 [<0000000329c3243e>] cpu_device_down+0x4e/0x78 [<000000032a61dee0>] device_offline+0xc8/0x118 [<000000032a61e048>] online_store+0x60/0xe0 [<000000032a08b6b0>] kernfs_fop_write_iter+0x150/0x1e8 [<0000000329fab65c>] vfs_write+0x174/0x360 [<0000000329fab9fc>] ksys_write+0x74/0x100 [<000000032aa03a5a>] __do_syscall+0x1da/0x208 [<000000032aa177b2>] system_call+0x82/0xb0
INFO: lockdep is turned off.
FIX dma-kmalloc-64: Restoring kmalloc Redzone 0x0000000000400564-0x0000000000400567=0xcc FIX dma-kmalloc-64: Object at 0x0000000000400540 not freed
--- net/iucv/iucv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/iucv/iucv.c +1 -1
@@ -83,7 +83,7 @@ struct iucv_irq_data {u16 ippathid;u8 ipflags1;u8 iptype; -u32 res2[8 ]; +u32 res2[9 ]; };struct iucv_irq_list {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 89/211 i825xx: sni_82596: use eth_hw_addr_set()
In reply to Greg Kroah-HartmanFrom: Thomas Bogendoerfer <[email protected]>
[ Upstream commit f38373345c65529639a01fba3675eb8cb4c579c3 ]
netdev->dev_addr is now const, we can't write to it directly. Copy scrambled mac address octects into an array then eth_hw_addr_set().
--- drivers/net/ethernet/i825xx/sni_82596.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/net/ethernet/i825xx/sni_82596.c +8 -6
@@ -78,6 +78,7 @@ static int sni_82596_probe(struct platform_device *dev)void __iomem *mpu_addr;void __iomem *ca_addr;u8 __iomem *eth_addr; +u8 mac[ETH_ALEN ]; res =platform_get_resource (dev,IORESOURCE_MEM ,0 ); ca =platform_get_resource (dev,IORESOURCE_MEM ,1 );
@@ -109,12 +110,13 @@ static int sni_82596_probe(struct platform_device *dev) goto probe_failed;/* someone seems to like messed up stuff */ - netdevice->dev_addr[0 ] =readb (eth_addr +0x0b ); - netdevice->dev_addr[1 ] =readb (eth_addr +0x0a ); - netdevice->dev_addr[2 ] =readb (eth_addr +0x09 ); - netdevice->dev_addr[3 ] =readb (eth_addr +0x08 ); - netdevice->dev_addr[4 ] =readb (eth_addr +0x07 ); - netdevice->dev_addr[5 ] =readb (eth_addr +0x06 ); + mac[0 ] =readb (eth_addr +0x0b ); + mac[1 ] =readb (eth_addr +0x0a ); + mac[2 ] =readb (eth_addr +0x09 ); + mac[3 ] =readb (eth_addr +0x08 ); + mac[4 ] =readb (eth_addr +0x07 ); + mac[5 ] =readb (eth_addr +0x06 ); +eth_hw_addr_set (netdevice, mac);iounmap (eth_addr);if (netdevice->irq <0 ) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 90/211 selftests: net: devlink_port_split.py: skip test if no suitable device available
In reply to Greg Kroah-HartmanFrom: Po-Hsu Lin <[email protected]>
[ Upstream commit 24994513ad13ff2c47ba91d2b5df82c3d496c370 ]
The devlink -j port show command output may not contain the "flavour" key, an example from Ubuntu 22.10 s390x LPAR(5.19.0-37-generic), with mlx4 driver and iproute2-5.15.0:
{"port":{"pci/0001:00:00.0/1":{"type":"eth","netdev":"ens301"},
"pci/0001:00:00.0/2":{"type":"eth","netdev":"ens301d1"},
"pci/0002:00:00.0/1":{"type":"eth","netdev":"ens317"},
"pci/0002:00:00.0/2":{"type":"eth","netdev":"ens317d1"}}}This will cause a KeyError exception.
Create a validate_devlink_output() to check for this "flavour" from devlink command output to avoid this KeyError exception. Also let it handle the check for devlink -j dev show output in main().
Apart from this, if the test was not started because the max lanes of the designated device is 0. The script will still return 0 and thus causing a false-negative test result.
Use a found_max_lanes flag to determine if these tests were skipped due to this reason and return KSFT_SKIP to make it more clear.
--- .../selftests/net/devlink_port_split.py | 36 ++++++++++++++++--- 1 file changed, 31 insertions(+), 5 deletions(-)
tools/testing/selftests/net/devlink_port_split.py +31 -5
@@ -59,6 +59,8 @@ class devlink_ports(object): assert stderr == "" ports = json.loads(stdout)['port'] + validate_devlink_output(ports, 'flavour') + for port in ports: if dev in port: if ports[port]['flavour'] == 'physical':
@@ -220,6 +222,27 @@ def split_splittable_port(port, k, lanes, dev): unsplit(port.bus_info) +def validate_devlink_output(devlink_data, target_property=None): + """ + Determine if test should be skipped by checking: + 1. devlink_data contains values + 2. The target_property exist in devlink_data + """ + skip_reason = None + if any(devlink_data.values()): + if target_property: + skip_reason = "{} not found in devlink output, test skipped".format(target_property) + for key in devlink_data: + if target_property in devlink_data[key]: + skip_reason = None + else: + skip_reason = 'devlink output is empty, test skipped' + + if skip_reason: + print(skip_reason) + sys.exit(KSFT_SKIP) + + def make_parser(): parser = argparse.ArgumentParser(description='A test for port splitting.') parser.add_argument('--dev',
@@ -240,12 +263,9 @@ def main(cmdline=None): stdout, stderr = run_command(cmd) assert stderr == "" + validate_devlink_output(json.loads(stdout)) devs = json.loads(stdout)['dev'] - if devs: - dev = list(devs.keys())[0] - else: - print("no devlink device was found, test skipped") - sys.exit(KSFT_SKIP) + dev = list(devs.keys())[0] cmd = "devlink dev show %s" % dev stdout, stderr = run_command(cmd)
@@ -255,6 +275,7 @@ def main(cmdline=None): ports = devlink_ports(dev) + found_max_lanes = False for port in ports.if_names: max_lanes = get_max_lanes(port.name)
@@ -277,6 +298,11 @@ def main(cmdline=None): split_splittable_port(port, lane, max_lanes, dev) lane //= 2 + found_max_lanes = True + + if not found_max_lanes: + print(f"Test not started, no port of device {dev} reports max_lanes") + sys.exit(KSFT_SKIP) if __name__ == "__main__":
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 91/211 qed/qed_mng_tlv: correctly zero out ->min instead of ->hour
In reply to Greg Kroah-HartmanFrom: Daniil Tatianin <[email protected]>
[ Upstream commit 470efd68a4653d9819d391489886432cd31bcd0b ]
This fixes an issue where ->hour would erroneously get zeroed out instead of ->min because of a bad copy paste.
Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool.
--- drivers/net/ethernet/qlogic/qed/qed_mng_tlv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/qlogic/qed/qed_mng_tlv.c +1 -1
@@ -422,7 +422,7 @@ qed_mfw_get_tlv_time_value(struct qed_mfw_tlv_time *p_time,if (p_time->hour >23 ) p_time->hour =0 ;if (p_time->min >59 ) - p_time->hour =0 ; + p_time->min =0 ;if (p_time->msec >999 ) p_time->msec =0 ;if (p_time->usec >999 )
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 92/211 net: dsa: microchip: fix RGMII delay configuration on KSZ8765/KSZ8794/KSZ8795
In reply to Greg Kroah-HartmanFrom: Marek Vasut <[email protected]>
[ Upstream commit 5ae06327a3a5bad4ee246d81df203b1b00a7b390 ]
The blamed commit has replaced a ksz_write8() call to address REG_PORT_5_CTRL_6 (0x56) with a ksz_set_xmii() -> ksz_pwrite8() call to regs[P_XMII_CTRL_1], which is also defined as 0x56 for ksz8795_regs[].
The trouble is that, when compared to ksz_write8(), ksz_pwrite8() also adjusts the register offset with the port base address. So in reality, ksz_pwrite8(offset=0x56) accesses register 0x56 + 0x50 = 0xa6, which in this switch appears to be unmapped, and the RGMII delay configuration on the CPU port does nothing.
So if the switch wasn't fine with the RGMII delay configuration done through pin strapping and relied on Linux to apply a different one in order to pass traffic, this is now broken.
Using the offset translation logic imposed by ksz_pwrite8(), the correct value for regs[P_XMII_CTRL_1] should have been 0x6 on ksz8795_regs[], in order to really end up accessing register 0x56.
Static code analysis shows that, despite there being multiple other accesses to regs[P_XMII_CTRL_1] in this driver, the only code path that is applicable to ksz8795_regs[] and ksz8_dev_ops is ksz_set_xmii(). Therefore, the problem is isolated to RGMII delays.
In its current form, ksz8795_regs[] contains the same value for P_XMII_CTRL_0 and for P_XMII_CTRL_1, and this raises valid suspicions that writes made by the driver to regs[P_XMII_CTRL_0] might overwrite writes made to regs[P_XMII_CTRL_1] or vice versa.
Again, static analysis shows that the only accesses to P_XMII_CTRL_0 from the driver are made from code paths which are not reachable with ksz8_dev_ops. So the accesses made by ksz_set_xmii() are safe for this switch family.
[ vladimiroltean: rewrote commit message ]
--- drivers/net/dsa/microchip/ksz_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/microchip/ksz_common.c +1 -1
@@ -310,7 +310,7 @@ static const u16 ksz8795_regs[] = { [S_BROADCAST_CTRL] = 0x06, [S_MULTICAST_CTRL] = 0x04, [P_XMII_CTRL_0] = 0x06, - [P_XMII_CTRL_1] = 0x56, + [P_XMII_CTRL_1] = 0x06, };static const u32 ksz8795_masks[] = {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 93/211 ethernet: sun: add check for the mdesc_grab()
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 90de546d9a0b3c771667af18bb3f80567eabb89b ]
In vnet_port_probe() and vsw_port_probe(), we should check the return value of mdesc_grab() as it may return NULL which can caused NPD bugs.
--- drivers/net/ethernet/sun/ldmvsw.c | 3 +++ drivers/net/ethernet/sun/sunvnet.c | 3 +++ 2 files changed, 6 insertions(+)
drivers/net/ethernet/sun/ldmvsw.c +3 -0
@@ -287,6 +287,9 @@ static int vsw_port_probe(struct vio_dev *vdev, const struct vio_device_id *id) hp =mdesc_grab (); +if (!hp) +return -ENODEV ; + rmac =mdesc_get_property (hp, vdev->mp, remote_macaddr_prop, &len); err = -ENODEV ;if (!rmac) {
drivers/net/ethernet/sun/sunvnet.c +3 -0
@@ -433,6 +433,9 @@ static int vnet_port_probe(struct vio_dev *vdev, const struct vio_device_id *id) hp =mdesc_grab (); +if (!hp) +return -ENODEV ; + vp =vnet_find_parent (hp, vdev->mp, vdev);if (IS_ERR (vp)) {pr_err ("Cannot find port parent vnet\n" );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 94/211 net: renesas: rswitch: Rename rings in struct rswitch_gwca_queue
In reply to Greg Kroah-HartmanFrom: Yoshihiro Shimoda <[email protected]>
[ Upstream commit 251eadcc640a0b5fd2767aaeb22a6f1ebf9b3c96 ]
To add a new ring which is really related to timestamp (ts_ring) in the future, rename the following members to improve readability:
ring --> tx_ring
ts_ring --> rx_ringStable-dep-of: e05bb97d9c9d ("net: renesas: rswitch: Fix the output value of quote from rswitch_rx()")
--- drivers/net/ethernet/renesas/rswitch.c | 64 +++++++++++++------------- drivers/net/ethernet/renesas/rswitch.h | 4 +- 2 files changed, 34 insertions(+), 34 deletions(-)
drivers/net/ethernet/renesas/rswitch.c +32 -32
@@ -241,7 +241,7 @@ static int rswitch_get_num_cur_queues(struct rswitch_gwca_queue *gq)static bool rswitch_is_queue_rxed (struct rswitch_gwca_queue *gq) { -struct rswitch_ext_ts_desc *desc = &gq->ts_ring[gq->dirty]; +struct rswitch_ext_ts_desc *desc = &gq->rx_ring[gq->dirty];if ((desc->desc.die_dt &DT_MASK ) !=DT_FEMPTY )return true;
@@ -284,13 +284,13 @@ static void rswitch_gwca_queue_free(struct net_device *ndev,if (gq->gptp) {dma_free_coherent (ndev->dev.parent,sizeof (struct rswitch_ext_ts_desc ) * - (gq->ring_size +1 ), gq->ts_ring, gq->ring_dma); - gq->ts_ring =NULL ; + (gq->ring_size +1 ), gq->rx_ring, gq->ring_dma); + gq->rx_ring =NULL ; }else {dma_free_coherent (ndev->dev.parent,sizeof (struct rswitch_ext_desc ) * - (gq->ring_size +1 ), gq->ring, gq->ring_dma); - gq->ring =NULL ; + (gq->ring_size +1 ), gq->tx_ring, gq->ring_dma); + gq->tx_ring =NULL ; }if (!gq->dir_tx) {
@@ -322,14 +322,14 @@ static int rswitch_gwca_queue_alloc(struct net_device *ndev,rswitch_gwca_queue_alloc_skb (gq,0 , gq->ring_size);if (gptp) - gq->ts_ring =dma_alloc_coherent (ndev->dev.parent, + gq->rx_ring =dma_alloc_coherent (ndev->dev.parent,sizeof (struct rswitch_ext_ts_desc ) * (gq->ring_size +1 ), &gq->ring_dma,GFP_KERNEL );else - gq->ring =dma_alloc_coherent (ndev->dev.parent, -sizeof (struct rswitch_ext_desc ) * - (gq->ring_size +1 ), &gq->ring_dma,GFP_KERNEL ); -if (!gq->ts_ring && !gq->ring) + gq->tx_ring =dma_alloc_coherent (ndev->dev.parent, +sizeof (struct rswitch_ext_desc ) * + (gq->ring_size +1 ), &gq->ring_dma,GFP_KERNEL ); +if (!gq->rx_ring && !gq->tx_ring) goto out; i = gq->index /32 ;
@@ -362,14 +362,14 @@ static int rswitch_gwca_queue_format(struct net_device *ndev,struct rswitch_private *priv, struct rswitch_gwca_queue *gq) { - int tx_ring_size = sizeof(struct rswitch_ext_desc) * gq->ring_size; + int ring_size = sizeof(struct rswitch_ext_desc) * gq->ring_size;struct rswitch_ext_desc *desc;struct rswitch_desc *linkfix;dma_addr_t dma_addr;int i; -memset (gq->ring,0 , tx_ring_size); - for (i = 0, desc = gq->ring; i < gq->ring_size; i++, desc++) { +memset (gq->tx_ring,0 , ring_size); + for (i = 0, desc = gq->tx_ring; i < gq->ring_size; i++, desc++) { if (!gq->dir_tx) { dma_addr = dma_map_single(ndev->dev.parent, gq->skbs[i]->data, PKT_BUF_SZ,
@@ -398,7 +398,7 @@ static int rswitch_gwca_queue_format(struct net_device *ndev, err:if (!gq->dir_tx) { -for (i--, desc = gq->ring; i >=0 ; i--, desc++) { +for (i--, desc = gq->tx_ring; i >=0 ; i--, desc++) { dma_addr =rswitch_desc_get_dptr (&desc->desc);dma_unmap_single (ndev->dev.parent, dma_addr,PKT_BUF_SZ ,DMA_FROM_DEVICE );
@@ -408,9 +408,9 @@ static int rswitch_gwca_queue_format(struct net_device *ndev,return -ENOMEM ; } -static int rswitch_gwca_queue_ts_fill (struct net_device *ndev, -struct rswitch_gwca_queue *gq, -int start_index,int num) +static int rswitch_gwca_queue_ext_ts_fill (struct net_device *ndev, +struct rswitch_gwca_queue *gq, +int start_index,int num) {struct rswitch_device *rdev =netdev_priv (ndev);struct rswitch_ext_ts_desc *desc;
@@ -419,7 +419,7 @@ static int rswitch_gwca_queue_ts_fill(struct net_device *ndev,for (i =0 ; i < num; i++) { index = (i + start_index) % gq->ring_size; - desc = &gq->ts_ring[index]; + desc = &gq->rx_ring[index];if (!gq->dir_tx) { dma_addr = dma_map_single(ndev->dev.parent, gq->skbs[index]->data, PKT_BUF_SZ,
@@ -443,7 +443,7 @@ static int rswitch_gwca_queue_ts_fill(struct net_device *ndev,if (!gq->dir_tx) {for (i--; i >=0 ; i--) { index = (i + start_index) % gq->ring_size; - desc = &gq->ts_ring[index]; + desc = &gq->rx_ring[index]; dma_addr =rswitch_desc_get_dptr (&desc->desc);dma_unmap_single (ndev->dev.parent, dma_addr,PKT_BUF_SZ ,DMA_FROM_DEVICE );
@@ -453,21 +453,21 @@ static int rswitch_gwca_queue_ts_fill(struct net_device *ndev,return -ENOMEM ; } -static int rswitch_gwca_queue_ts_format (struct net_device *ndev, -struct rswitch_private *priv, -struct rswitch_gwca_queue *gq) +static int rswitch_gwca_queue_ext_ts_format (struct net_device *ndev, +struct rswitch_private *priv, +struct rswitch_gwca_queue *gq) { -int tx_ts_ring_size =sizeof (struct rswitch_ext_ts_desc ) * gq->ring_size; +int ring_size =sizeof (struct rswitch_ext_ts_desc ) * gq->ring_size;struct rswitch_ext_ts_desc *desc;struct rswitch_desc *linkfix;int err; -memset (gq->ts_ring,0 , tx_ts_ring_size); - err =rswitch_gwca_queue_ts_fill (ndev, gq,0 , gq->ring_size); +memset (gq->rx_ring,0 , ring_size); + err =rswitch_gwca_queue_ext_ts_fill (ndev, gq,0 , gq->ring_size);if (err <0 )return err; - desc = &gq->ts_ring[gq->ring_size];/* Last */ + desc = &gq->rx_ring[gq->ring_size];/* Last */ rswitch_desc_set_dptr (&desc->desc, gq->ring_dma); desc->desc.die_dt =DT_LINKFIX ;
@@ -595,7 +595,7 @@ static int rswitch_rxdmac_init(struct rswitch_private *priv, int index)struct rswitch_device *rdev = priv->rdev[index];struct net_device *ndev = rdev->ndev; -return rswitch_gwca_queue_ts_format (ndev, priv, rdev->rx_queue); +return rswitch_gwca_queue_ext_ts_format (ndev, priv, rdev->rx_queue); }static int rswitch_gwca_hw_init (struct rswitch_private *priv)
@@ -676,7 +676,7 @@ static bool rswitch_rx(struct net_device *ndev, int *quota) boguscnt =min_t (int, gq->ring_size, *quota); limit = boguscnt; - desc = &gq->ts_ring[gq->cur]; + desc = &gq->rx_ring[gq->cur];while ((desc->desc.die_dt &DT_MASK ) !=DT_FEMPTY ) {if (--boguscnt <0 )break ;
@@ -704,14 +704,14 @@ static bool rswitch_rx(struct net_device *ndev, int *quota) rdev->ndev->stats.rx_bytes += pkt_len; gq->cur =rswitch_next_queue_index (gq, true,1 ); - desc = &gq->ts_ring[gq->cur]; + desc = &gq->rx_ring[gq->cur]; } num =rswitch_get_num_cur_queues (gq); ret =rswitch_gwca_queue_alloc_skb (gq, gq->dirty, num);if (ret <0 ) goto err; - ret =rswitch_gwca_queue_ts_fill (ndev, gq, gq->dirty, num); + ret =rswitch_gwca_queue_ext_ts_fill (ndev, gq, gq->dirty, num);if (ret <0 ) goto err; gq->dirty =rswitch_next_queue_index (gq, false, num);
@@ -738,7 +738,7 @@ static int rswitch_tx_free(struct net_device *ndev, bool free_txed_only)for (;rswitch_get_num_cur_queues (gq) >0 ; gq->dirty =rswitch_next_queue_index (gq, false,1 )) { - desc = &gq->ring[gq->dirty]; + desc = &gq->tx_ring[gq->dirty];if (free_txed_only && (desc->desc.die_dt &DT_MASK ) !=DT_FEMPTY )break ;
@@ -1416,7 +1416,7 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff *skb, struct net_device *nd } gq->skbs[gq->cur] = skb; - desc = &gq->ring[gq->cur]; + desc = &gq->tx_ring[gq->cur];rswitch_desc_set_dptr (&desc->desc, dma_addr); desc->desc.info_ds =cpu_to_le16 (skb->len);
drivers/net/ethernet/renesas/rswitch.h +2 -2
@@ -915,8 +915,8 @@ struct rswitch_gwca_queue {bool dir_tx;bool gptp;union { -struct rswitch_ext_desc *ring; -struct rswitch_ext_ts_desc *ts_ring; +struct rswitch_ext_desc *tx_ring; +struct rswitch_ext_ts_desc *rx_ring; };dma_addr_t ring_dma;int ring_size;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 95/211 net: renesas: rswitch: Fix the output value of quote from rswitch_rx()
In reply to Greg Kroah-HartmanFrom: Yoshihiro Shimoda <[email protected]>
[ Upstream commit e05bb97d9c9dd4ba5739a27921044c935a7fb3be ]
If the RX descriptor doesn't have any data, the output value of quote from rswitch_rx() will be increased unexpectedily. So, fix it.
--- drivers/net/ethernet/renesas/rswitch.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/net/ethernet/renesas/rswitch.c +7 -3
@@ -673,13 +673,14 @@ static bool rswitch_rx(struct net_device *ndev, int *quota)u16 pkt_len;u32 get_ts; +if (*quota <=0 ) +return true; + boguscnt =min_t (int, gq->ring_size, *quota); limit = boguscnt; desc = &gq->rx_ring[gq->cur];while ((desc->desc.die_dt &DT_MASK ) !=DT_FEMPTY ) { -if (--boguscnt <0 ) -break ;dma_rmb (); pkt_len =le16_to_cpu (desc->desc.info_ds) &RX_DS ; skb = gq->skbs[gq->cur];
@@ -705,6 +706,9 @@ static bool rswitch_rx(struct net_device *ndev, int *quota) gq->cur =rswitch_next_queue_index (gq, true,1 ); desc = &gq->rx_ring[gq->cur]; + +if (--boguscnt <=0 ) +break ; } num =rswitch_get_num_cur_queues (gq);
@@ -716,7 +720,7 @@ static bool rswitch_rx(struct net_device *ndev, int *quota) goto err; gq->dirty =rswitch_next_queue_index (gq, false, num); - *quota -= limit - (++boguscnt); + *quota -= limit - boguscnt;return boguscnt <=0 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 96/211 bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change
In reply to Greg Kroah-HartmanFrom: Nikolay Aleksandrov <[email protected]>
[ Upstream commit 9ec7eb60dcbcb6c41076defbc5df7bbd95ceaba5 ]
Add bond_ether_setup helper which is used to fix ether_setup() calls in the bonding driver. It takes care of both IFF_MASTER and IFF_SLAVE flags, the former is always restored and the latter only if it was set.
If the bond enslaves non-ARPHRD_ETHER device (changes its type), then releases it and enslaves ARPHRD_ETHER device (changes back) then we use ether_setup() to restore the bond device type but it also resets its flags and removes IFF_MASTER and IFF_SLAVE[1]. Use the bond_ether_setup helper to restore both after such transition.
[1] reproduce (nlmon is non-ARPHRD_ETHER):
$ ip l add nlmon0 type nlmon
$ ip l add bond2 type bond mode active-backup
$ ip l set nlmon0 master bond2
$ ip l set nlmon0 nomaster
$ ip l add bond1 type bond
(we use bond1 as ARPHRD_ETHER device to restore bond2's mode)
$ ip l set bond1 master bond2
$ ip l sh dev bond2
37: bond2: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
link/ether be:d7:c5:40:5b:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 1500
(notice bond2's IFF_MASTER is missing)--- drivers/net/bonding/bond_main.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-)
drivers/net/bonding/bond_main.c +15 -4
@@ -1773,6 +1773,19 @@ void bond_lower_state_changed(struct slave *slave)slave_err (bond_dev, slave_dev,"Error: %s\n" , errmsg); \ }while (0 ) +/* The bonding driver uses ether_setup() to convert a master bond device +* to ARPHRD_ETHER, that resets the target netdevice's flags so we always +* have to restore the IFF_MASTER flag, and only restore IFF_SLAVE if it was set +*/ +static void bond_ether_setup(struct net_device *bond_dev) +{ +unsigned int slave_flag = bond_dev->flags &IFF_SLAVE ; + +ether_setup (bond_dev); + bond_dev->flags |=IFF_MASTER | slave_flag; + bond_dev->priv_flags &= ~IFF_TX_SKB_SHARING ; +} +/* enslave device <slave> to bond device <master> */ int bond_enslave (struct net_device *bond_dev,struct net_device *slave_dev,struct netlink_ext_ack *extack)
@@ -1864,10 +1877,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,if (slave_dev->type !=ARPHRD_ETHER )bond_setup_by_slave (bond_dev, slave_dev); -else { -ether_setup (bond_dev); - bond_dev->priv_flags &= ~IFF_TX_SKB_SHARING ; - } +else +bond_ether_setup (bond_dev);call_netdevice_notifiers (NETDEV_POST_TYPE_CHANGE , bond_dev);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 97/211 bonding: restore bonds IFF_SLAVE flag if a non-eth dev enslave fails
In reply to Greg Kroah-HartmanFrom: Nikolay Aleksandrov <[email protected]>
[ Upstream commit e667d469098671261d558be0cd93dca4d285ce1e ]
syzbot reported a warning[1] where the bond device itself is a slave and we try to enslave a non-ethernet device as the first slave which fails but then in the error path when ether_setup() restores the bond device it also clears all flags. In my previous fix[2] I restored the IFF_MASTER flag, but I didn't consider the case that the bond device itself might also be a slave with IFF_SLAVE set, so we need to restore that flag as well. Use the bond_ether_setup helper which does the right thing and restores the bond's flags properly.
Steps to reproduce using a nlmon dev:
$ ip l add nlmon0 type nlmon $ ip l add bond1 type bond $ ip l add bond2 type bond $ ip l set bond1 master bond2 $ ip l set dev nlmon0 master bond1 $ ip -d l sh dev bond1 22: bond1: <BROADCAST,MULTICAST,MASTER> mtu 1500 qdisc noqueue master bond2 state DOWN mode DEFAULT group default qlen 1000 (now bond1's IFF_SLAVE flag is gone and we'll hit a warning[3] if we try to delete it)
[1] https://syzkaller.appspot.com/bug?id=391c7b1f6522182899efba27d891f1743e8eb3ef
[2] commit 7d5cd2ce5292 ("bonding: correctly handle bonding type change on enslave failure")
[3] example warning:
[ 27.008664] bond1: (slave nlmon0): The slave device specified does not support setting the MAC address [ 27.008692] bond1: (slave nlmon0): Error -95 calling set_mac_address [ 32.464639] bond1 (unregistering): Released all slaves [ 32.464685] ------------[ cut here ]------------ [ 32.464686] WARNING: CPU: 1 PID: 2004 at net/core/dev.c:10829 unregister_netdevice_many+0x72a/0x780 [ 32.464694] Modules linked in: br_netfilter bridge bonding virtio_net [ 32.464699] CPU: 1 PID: 2004 Comm: ip Kdump: loaded Not tainted 5.18.0-rc3+ #47 [ 32.464703] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.1-2.fc37 04/01/2014 [ 32.464704] RIP: 0010:unregister_netdevice_many+0x72a/0x780 [ 32.464707] Code: 99 fd ff ff ba 90 1a 00 00 48 c7 c6 f4 02 66 96 48 c7 c7 20 4d 35 96 c6 05 fa c7 2b 02 01 e8 be 6f 4a 00 0f 0b e9 73 fd ff ff <0f> 0b e9 5f fd ff ff 80 3d e3 c7 2b 02 00 0f 85 3b fd ff ff ba 59 [ 32.464710] RSP: 0018:ffffa006422d7820 EFLAGS: 00010206 [ 32.464712] RAX: ffff8f6e077140a0 RBX: ffffa006422d7888 RCX: 0000000000000000 [ 32.464714] RDX: ffff8f6e12edbe58 RSI: 0000000000000296 RDI: ffffffff96d4a520 [ 32.464716] RBP: ffff8f6e07714000 R08: ffffffff96d63600 R09: ffffa006422d7728 [ 32.464717] R10: 0000000000000ec0 R11: ffffffff9698c988 R12: ffff8f6e12edb140 [ 32.464719] R13: dead000000000122 R14: dead000000000100 R15: ffff8f6e12edb140 [ 32.464723] FS: 00007f297c2f1740(0000) GS:ffff8f6e5d900000(0000) knlGS:0000000000000000 [ 32.464725] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.464726] CR2: 00007f297bf1c800 CR3: 00000000115e8000 CR4: 0000000000350ee0 [ 32.464730] Call Trace: [ 32.464763] <TASK> [ 32.464767] rtnl_dellink+0x13e/0x380 [ 32.464776] ? cred_has_capability.isra.0+0x68/0x100 [ 32.464780] ? __rtnl_unlock+0x33/0x60 [ 32.464783] ? bpf_lsm_capset+0x10/0x10 [ 32.464786] ? security_capable+0x36/0x50 [ 32.464790] rtnetlink_rcv_msg+0x14e/0x3b0 [ 32.464792] ? _copy_to_iter+0xb1/0x790 [ 32.464796] ? post_alloc_hook+0xa0/0x160 [ 32.464799] ? rtnl_calcit.isra.0+0x110/0x110 [ 32.464802] netlink_rcv_skb+0x50/0xf0 [ 32.464806] netlink_unicast+0x216/0x340 [ 32.464809] netlink_sendmsg+0x23f/0x480 [ 32.464812] sock_sendmsg+0x5e/0x60 [ 32.464815] ____sys_sendmsg+0x22c/0x270 [ 32.464818] ? import_iovec+0x17/0x20 [ 32.464821] ? sendmsg_copy_msghdr+0x59/0x90 [ 32.464823] ? do_set_pte+0xa0/0xe0 [ 32.464828] ___sys_sendmsg+0x81/0xc0 [ 32.464832] ? mod_objcg_state+0xc6/0x300 [ 32.464835] ? refill_obj_stock+0xa9/0x160 [ 32.464838] ? memcg_slab_free_hook+0x1a5/0x1f0 [ 32.464842] __sys_sendmsg+0x49/0x80 [ 32.464847] do_syscall_64+0x3b/0x90 [ 32.464851] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 32.464865] RIP: 0033:0x7f297bf2e5e7 [ 32.464868] Code: 64 89 02 48 c7 c0 ff ff ff ff eb bb 0f 1f 80 00 00 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 [ 32.464869] RSP: 002b:00007ffd96c824c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 32.464872] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f297bf2e5e7 [ 32.464874] RDX: 0000000000000000 RSI: 00007ffd96c82540 RDI: 0000000000000003 [ 32.464875] RBP: 00000000640f19de R08: 0000000000000001 R09: 000000000000007c [ 32.464876] R10: 00007f297bffabe0 R11: 0000000000000246 R12: 0000000000000001 [ 32.464877] R13: 00007ffd96c82d20 R14: 00007ffd96c82610 R15: 000055bfe38a7020 [ 32.464881] </TASK> [ 32.464882] ---[ end trace 0000000000000000 ]---
--- drivers/net/bonding/bond_main.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/net/bonding/bond_main.c +1 -3
@@ -2298,9 +2298,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,eth_hw_addr_random (bond_dev);if (bond_dev->type !=ARPHRD_ETHER ) {dev_close (bond_dev); -ether_setup (bond_dev); - bond_dev->flags |=IFF_MASTER ; - bond_dev->priv_flags &= ~IFF_TX_SKB_SHARING ; +bond_ether_setup (bond_dev); } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 98/211 hwmon: (adt7475) Display smoothing attributes in correct order
In reply to Greg Kroah-HartmanFrom: Tony O'Brien <[email protected]>
[ Upstream commit 5f8d1e3b6f9b5971f9c06d5846ce00c49e3a8d94 ]
Throughout the ADT7475 driver, attributes relating to the temperature sensors are displayed in the order Remote 1, Local, Remote 2. Make temp_st_show() conform to this expectation so that values set by temp_st_store() can be displayed using the correct attribute.
--- drivers/hwmon/adt7475.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hwmon/adt7475.c +2 -2
@@ -556,11 +556,11 @@ static ssize_t temp_st_show(struct device *dev, struct device_attribute *attr, val = data->enh_acoustics[0 ] &0xf ;break ;case 1 : - val = (data->enh_acoustics[1 ] >>4 ) &0xf ; + val = data->enh_acoustics[1 ] &0xf ;break ;case 2 :default : - val = data->enh_acoustics[1 ] &0xf ; + val = (data->enh_acoustics[1 ] >>4 ) &0xf ;break ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 99/211 hwmon: (adt7475) Fix masking of hysteresis registers
In reply to Greg Kroah-HartmanFrom: Tony O'Brien <[email protected]>
[ Upstream commit 48e8186870d9d0902e712d601ccb7098cb220688 ]
The wrong bits are masked in the hysteresis register; indices 0 and 2 should zero bits [7:4] and preserve bits [3:0], and index 1 should zero bits [3:0] and preserve bits [7:4].
--- drivers/hwmon/adt7475.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hwmon/adt7475.c +2 -2
@@ -488,10 +488,10 @@ static ssize_t temp_store(struct device *dev, struct device_attribute *attr, val = (temp - val) /1000 ;if (sattr->index !=1 ) { - data->temp[HYSTERSIS ][sattr->index] &=0xF0 ; + data->temp[HYSTERSIS ][sattr->index] &=0x0F ; data->temp[HYSTERSIS ][sattr->index] |= (val &0xF ) <<4 ; }else { - data->temp[HYSTERSIS ][sattr->index] &=0x0F ; + data->temp[HYSTERSIS ][sattr->index] &=0xF0 ; data->temp[HYSTERSIS ][sattr->index] |= (val &0xF ); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 100/211 hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
In reply to Greg Kroah-HartmanFrom: Zheng Wang <[email protected]>
[ Upstream commit cb090e64cf25602b9adaf32d5dfc9c8bec493cd1 ]
In xgene_hwmon_probe, &ctx->workq is bound with xgene_hwmon_evt_work. Then it will be started.
If we remove the driver which will call xgene_hwmon_remove to clean up, there may be unfinished work.
The possible sequence is as follows:
Fix it by finishing the work before cleanup in xgene_hwmon_remove.
CPU0 CPU1
|xgene_hwmon_evt_workxgene_hwmon_remove |
kfifo_free(&ctx->async_msg_fifo);|
|
|kfifo_out_spinlocked
|//use &ctx->async_msg_fifo--- drivers/hwmon/xgene-hwmon.c | 1 + 1 file changed, 1 insertion(+)
drivers/hwmon/xgene-hwmon.c +1 -0
@@ -761,6 +761,7 @@ static int xgene_hwmon_remove(struct platform_device *pdev) {struct xgene_hwmon_dev *ctx =platform_get_drvdata (pdev); +cancel_work_sync (&ctx->workq);hwmon_device_unregister (ctx->hwmon_dev);kfifo_free (&ctx->async_msg_fifo);if (acpi_disabled)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 101/211 hwmon: (ina3221) return prober error code
In reply to Greg Kroah-HartmanFrom: Marcus Folkesson <[email protected]>
[ Upstream commit c93f5e2ab53243b17febabb9422a697017d3d49a ]
ret is set to 0 which do not indicate an error.
Return -EINVAL instead.
--- drivers/hwmon/ina3221.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/ina3221.c +1 -1
@@ -772,7 +772,7 @@ static int ina3221_probe_child_from_dt(struct device *dev,return ret; }else if (val >INA3221_CHANNEL3 ) {dev_err (dev,"invalid reg %d of %pOFn\n" , val, child); -return ret; +return -EINVAL ; } input = &ina->inputs[val];
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 102/211 hwmon: (ucd90320) Add minimum delay between bus accesses
In reply to Greg Kroah-HartmanFrom: Lars-Peter Clausen <[email protected]>
[ Upstream commit 8d655e65237643c48ada2c131b83679bf1105373 ]
When probing the ucd90320 access to some of the registers randomly fails. Sometimes it NACKs a transfer, sometimes it returns just random data and the PEC check fails.
Experimentation shows that this seems to be triggered by a register access directly back to back with a previous register write. Experimentation also shows that inserting a small delay after register writes makes the issue go away.
Use a similar solution to what the max15301 driver does to solve the same problem. Create a custom set of bus read and write functions that make sure that the delay is added.
--- drivers/hwmon/pmbus/ucd9000.c | 75 +++++++++++++++++++++++++++++++++++ 1 file changed, 75 insertions(+)
drivers/hwmon/pmbus/ucd9000.c +75 -0
@@ -7,6 +7,7 @@*/ #include <linux/debugfs.h> +#include <linux/delay.h> #include <linux/kernel.h> #include <linux/module.h> #include <linux/of_device.h>
@@ -16,6 +17,7 @@#include <linux/i2c.h> #include <linux/pmbus.h> #include <linux/gpio/driver.h> +#include <linux/timekeeping.h> #include "pmbus.h" enum chips { ucd9000, ucd90120, ucd90124, ucd90160, ucd90320, ucd9090,
@@ -65,6 +67,7 @@ struct ucd9000_data {struct gpio_chip gpio;#endif struct dentry *debugfs; +ktime_t write_time; };#define to_ucd9000_data (_info) container_of(_info, struct ucd9000_data, info)
@@ -73,6 +76,73 @@ struct ucd9000_debugfs_entry {u8 index; }; +/* +* It has been observed that the UCD90320 randomly fails register access when +* doing another access right on the back of a register write. To mitigate this +* make sure that there is a minimum delay between a write access and the +* following access. The 250us is based on experimental data. At a delay of +* 200us the issue seems to go away. Add a bit of extra margin to allow for +* system to system differences. +*/ +#define UCD90320_WAIT_DELAY_US 250 + +static inline void ucd90320_wait (const struct ucd9000_data *data) +{ +s64 delta =ktime_us_delta (ktime_get (), data->write_time); + +if (delta <UCD90320_WAIT_DELAY_US ) +udelay (UCD90320_WAIT_DELAY_US - delta); +} + +static int ucd90320_read_word_data (struct i2c_client *client,int page, +int phase,int reg) +{ +const struct pmbus_driver_info *info =pmbus_get_driver_info (client); +struct ucd9000_data *data =to_ucd9000_data (info); + +if (reg >=PMBUS_VIRT_BASE ) +return -ENXIO ; + +ucd90320_wait (data); +return pmbus_read_word_data (client, page, phase, reg); +} + +static int ucd90320_read_byte_data (struct i2c_client *client,int page,int reg) +{ +const struct pmbus_driver_info *info =pmbus_get_driver_info (client); +struct ucd9000_data *data =to_ucd9000_data (info); + +ucd90320_wait (data); +return pmbus_read_byte_data (client, page, reg); +} + +static int ucd90320_write_word_data (struct i2c_client *client,int page, +int reg,u16 word) +{ +const struct pmbus_driver_info *info =pmbus_get_driver_info (client); +struct ucd9000_data *data =to_ucd9000_data (info); +int ret; + +ucd90320_wait (data); + ret =pmbus_write_word_data (client, page, reg, word); + data->write_time =ktime_get (); + +return ret; +} + +static int ucd90320_write_byte (struct i2c_client *client,int page,u8 value) +{ +const struct pmbus_driver_info *info =pmbus_get_driver_info (client); +struct ucd9000_data *data =to_ucd9000_data (info); +int ret; + +ucd90320_wait (data); + ret =pmbus_write_byte (client, page, value); + data->write_time =ktime_get (); + +return ret; +} +static int ucd9000_get_fan_config (struct i2c_client *client,int fan) {int fan_config =0 ;
@@ -598,6 +668,11 @@ static int ucd9000_probe(struct i2c_client *client) info->read_byte_data = ucd9000_read_byte_data; info->func[0 ] |=PMBUS_HAVE_FAN12 |PMBUS_HAVE_STATUS_FAN12 |PMBUS_HAVE_FAN34 |PMBUS_HAVE_STATUS_FAN34 ; + }else if (mid->driver_data == ucd90320) { + info->read_byte_data = ucd90320_read_byte_data; + info->read_word_data = ucd90320_read_word_data; + info->write_byte = ucd90320_write_byte; + info->write_word_data = ucd90320_write_word_data; }ucd9000_probe_gpio (client, mid, data);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 103/211 hwmon: tmp512: drop of_match_ptr for ID table
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 00d85e81796b17a29a0e096c5a4735daa47adef8 ]
The driver will match mostly by DT table (even thought there is regular ID table) so there is little benefit in of_match_ptr (this also allows ACPI matching via PRP0001, even though it might not be relevant here). This also fixes !CONFIG_OF error:
drivers/hwmon/tmp513.c:610:34: error: ‘tmp51x_of_match’ defined but not used [-Werror=unused-const-variable=]
--- drivers/hwmon/tmp513.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/tmp513.c +1 -1
@@ -758,7 +758,7 @@ static int tmp51x_probe(struct i2c_client *client)static struct i2c_driver tmp51x_driver = { .driver = { .name ="tmp51x" , - .of_match_table =of_match_ptr (tmp51x_of_match), + .of_match_table = tmp51x_of_match, }, .probe_new = tmp51x_probe, .id_table = tmp51x_id,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 104/211 kconfig: Update config changed flag before calling callback
In reply to Greg Kroah-HartmanFrom: Jurica Vukadin <[email protected]>
[ Upstream commit ee06a3ef7e3cddb62b90ac40aa661d3c12f7cabc ]
Prior to commit 5ee546594025 ("kconfig: change sym_change_count to a boolean flag"), the conf_updated flag was set to the new value *before* calling the callback. xconfig's save action depends on this behaviour, because xconfig calls conf_get_changed() directly from the callback and now sees the old value, thus never enabling the save button or the shortcut.
Restore the previous behaviour.
--- scripts/kconfig/confdata.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
scripts/kconfig/confdata.c +4 -2
@@ -1226,10 +1226,12 @@ static void (*conf_changed_callback)(void);void conf_set_changed (bool val) { -if (conf_changed_callback && conf_changed != val) -conf_changed_callback (); +bool changed = conf_changed != val; conf_changed = val; + +if (conf_changed_callback && changed) +conf_changed_callback (); }bool conf_get_changed (void )
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 105/211 hwmon: (adm1266) Set `can_sleep` flag for GPIO chip
In reply to Greg Kroah-HartmanFrom: Lars-Peter Clausen <[email protected]>
[ Upstream commit a5bb73b3f5db1a4e91402ad132b59b13d2651ed9 ]
The adm1266 driver uses I2C bus access in its GPIO chip set and get implementation. This means these functions can sleep and the GPIO chip should set the can_sleep property to true.
This will ensure that a warning is printed when trying to set or get the GPIO value from a context that potentially can't sleep.
--- drivers/hwmon/pmbus/adm1266.c | 1 + 1 file changed, 1 insertion(+)
drivers/hwmon/pmbus/adm1266.c +1 -0
@@ -301,6 +301,7 @@ static int adm1266_config_gpio(struct adm1266_data *data) data->gc.label = name; data->gc.parent = &data->client->dev; data->gc.owner =THIS_MODULE ; + data->gc.can_sleep = true; data->gc.base =-1 ; data->gc.names = data->gpio_names; data->gc.ngpio =ARRAY_SIZE (data->gpio_names);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 106/211 hwmon: (ltc2992) Set `can_sleep` flag for GPIO chip
In reply to Greg Kroah-HartmanFrom: Lars-Peter Clausen <[email protected]>
[ Upstream commit ab00709310eedcd8dae0df1f66d332f9bc64c99e ]
The ltc2992 drivers uses a mutex and I2C bus access in its GPIO chip set and get implementation. This means these functions can sleep and the GPIO chip should set the can_sleep property to true.
This will ensure that a warning is printed when trying to set or get the GPIO value from a context that potentially can't sleep.
--- drivers/hwmon/ltc2992.c | 1 + 1 file changed, 1 insertion(+)
drivers/hwmon/ltc2992.c +1 -0
@@ -323,6 +323,7 @@ static int ltc2992_config_gpio(struct ltc2992_state *st) st->gc.label = name; st->gc.parent = &st->client->dev; st->gc.owner =THIS_MODULE ; + st->gc.can_sleep = true; st->gc.base =-1 ; st->gc.names = st->gpio_names; st->gc.ngpio =ARRAY_SIZE (st->gpio_names);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 107/211 media: m5mols: fix off-by-one loop termination error
In reply to Greg Kroah-HartmanFrom: Linus Torvalds <[email protected]>
[ Upstream commit efbcbb12ee99f750c9f25c873b55ad774871de2a ]
The __find_restype() function loops over the m5mols_default_ffmt[] array, and the termination condition ends up being wrong: instead of stopping when the iterator becomes the size of the array it traverses, it stops after it has already overshot the array.
Now, in practice this doesn't likely matter, because the code will always find the entry it looks for, and will thus return early and never hit that last extra iteration.
But it turns out that clang will unroll the loop fully, because it has only two iterations (well, three due to the off-by-one bug), and then clang will end up just giving up in the middle of the loop unrolling when it notices that the code walks past the end of the array.
And that made 'objtool' very unhappy indeed, because the generated code just falls off the edge of the universe, and ends up falling through to the next function, causing this warning:
drivers/media/i2c/m5mols/m5mols.o: warning: objtool: m5mols_set_fmt() falls through to next function m5mols_get_frame_desc()
Fix the loop ending condition.
--- drivers/media/i2c/m5mols/m5mols_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/i2c/m5mols/m5mols_core.c +1 -1
@@ -488,7 +488,7 @@ static enum m5mols_restype __find_restype(u32 code)do {if (code == m5mols_default_ffmt[type].code)return type; - }while (type++ !=SIZE_DEFAULT_FFMT ); + }while (++type !=SIZE_DEFAULT_FFMT );return 0 ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 108/211 ext4: update s_journal_inum if it changes after journal replay
In reply to Greg Kroah-HartmanFrom: Baokun Li <[email protected]>
[ Upstream commit 3039d8b8692408438a618fac2776b629852663c3 ]
When mounting a crafted ext4 image, s_journal_inum may change after journal replay, which is obviously unreasonable because we have successfully loaded and replayed the journal through the old s_journal_inum. And the new s_journal_inum bypasses some of the checks in ext4_get_journal(), which may trigger a null pointer dereference problem. So if s_journal_inum changes after the journal replay, we ignore the change, and rewrite the current journal_inum to the superblock.
--- fs/ext4/super.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
fs/ext4/super.c +5 -2
@@ -5967,8 +5967,11 @@ static int ext4_load_journal(struct super_block *sb,if (!really_read_only && journal_devnum && journal_devnum !=le32_to_cpu (es->s_journal_dev)) { es->s_journal_dev =cpu_to_le32 (journal_devnum); - -/* Make sure we flush the recovery flag to disk. */ +ext4_commit_super (sb); + } +if (!really_read_only && journal_inum && + journal_inum !=le32_to_cpu (es->s_journal_inum)) { + es->s_journal_inum =cpu_to_le32 (journal_inum);ext4_commit_super (sb); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 109/211 ext4: fix task hung in ext4_xattr_delete_inode
In reply to Greg Kroah-HartmanFrom: Baokun Li <[email protected]>
[ Upstream commit 0f7bfd6f8164be32dbbdf36aa1e5d00485c53cd7 ]
Syzbot reported a hung task problem:
==================================================================
INFO: task syz-executor232:5073 blocked for more than 143 seconds.
Not tainted 6.2.0-rc2-syzkaller-00024-g512dee0c00ad #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-exec232 state:D stack:21024 pid:5073 ppid:5072 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5244 [inline]
__schedule+0x995/0xe20 kernel/sched/core.c:6555
schedule+0xcb/0x190 kernel/sched/core.c:6631
__wait_on_freeing_inode fs/inode.c:2196 [inline]
find_inode_fast+0x35a/0x4c0 fs/inode.c:950
iget_locked+0xb1/0x830 fs/inode.c:1273
__ext4_iget+0x22e/0x3ed0 fs/ext4/inode.c:4861
ext4_xattr_inode_iget+0x68/0x4e0 fs/ext4/xattr.c:389
ext4_xattr_inode_dec_ref_all+0x1a7/0xe50 fs/ext4/xattr.c:1148
ext4_xattr_delete_inode+0xb04/0xcd0 fs/ext4/xattr.c:2880
ext4_evict_inode+0xd7c/0x10b0 fs/ext4/inode.c:296
evict+0x2a4/0x620 fs/inode.c:664
ext4_orphan_cleanup+0xb60/0x1340 fs/ext4/orphan.c:474
__ext4_fill_super fs/ext4/super.c:5516 [inline]
ext4_fill_super+0x81cd/0x8700 fs/ext4/super.c:5644
get_tree_bdev+0x400/0x620 fs/super.c:1282
vfs_get_tree+0x88/0x270 fs/super.c:1489
do_new_mount+0x289/0xad0 fs/namespace.c:3145
do_mount fs/namespace.c:3488 [inline]
__do_sys_mount fs/namespace.c:3697 [inline]
__se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3674
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fa5406fd5ea
RSP: 002b:00007ffc7232f968 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fa5406fd5ea
RDX: 0000000020000440 RSI: 0000000020000000 RDI: 00007ffc7232f970
RBP: 00007ffc7232f970 R08: 00007ffc7232f9b0 R09: 0000000000000432
R10: 0000000000804a03 R11: 0000000000000202 R12: 0000000000000004
R13: 0000555556a7a2c0 R14: 00007ffc7232f9b0 R15: 0000000000000000
</TASK>
==================================================================The problem is that the inode contains an xattr entry with ea_inum of 15 when cleaning up an orphan inode <15>. When evict inode <15>, the reference counting of the corresponding EA inode is decreased. When EA inode <15> is found by find_inode_fast() in __ext4_iget(), it is found that the EA inode holds the I_FREEING flag and waits for the EA inode to complete deletion. As a result, when inode <15> is being deleted, we wait for inode <15> to complete the deletion, resulting in an infinite loop and triggering Hung Task. To solve this problem, we only need to check whether the ino of EA inode and parent is the same before getting EA inode.
--- fs/ext4/xattr.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
fs/ext4/xattr.c +11 -0
@@ -388,6 +388,17 @@ static int ext4_xattr_inode_iget(struct inode *parent, unsigned long ea_ino,struct inode *inode;int err; +/* +* We have to check for this corruption early as otherwise +* iget_locked() could wait indefinitely for the state of our +* parent inode. +*/ +if (parent->i_ino == ea_ino) { +ext4_error (parent->i_sb, +"Parent and EA inode have the same ino %lu" , ea_ino); +return -EFSCORRUPTED ; + } + inode =ext4_iget (parent->i_sb, ea_ino,EXT4_IGET_NORMAL );if (IS_ERR (inode)) { err =PTR_ERR (inode);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 110/211 drm/amdkfd: Fix an illegal memory access
In reply to Greg Kroah-HartmanFrom: Qu Huang <[email protected]>
[ Upstream commit 4fc8fff378b2f2039f2a666d9f8c570f4e58352c ]
In the kfd_wait_on_events() function, the kfd_event_waiter structure is allocated by alloc_event_waiters(), but the event field of the waiter structure is not initialized; When copy_from_user() fails in the kfd_wait_on_events() function, it will enter exception handling to release the previously allocated memory of the waiter structure; Due to the event field of the waiters structure being accessed in the free_waiters() function, this results in illegal memory access and system crash, here is the crash log:
localhost kernel: RIP: 0010:native_queued_spin_lock_slowpath+0x185/0x1e0 localhost kernel: RSP: 0018:ffffaa53c362bd60 EFLAGS: 00010082
localhost kernel: RAX: ff3d3d6bff4007cb RBX: 0000000000000282 RCX: 00000000002c0000 localhost kernel: RDX: ffff9e855eeacb80 RSI: 000000000000279c RDI: ffffe7088f6a21d0 localhost kernel: RBP: ffffe7088f6a21d0 R08: 00000000002c0000 R09: ffffaa53c362be64 localhost kernel: R10: ffffaa53c362bbd8 R11: 0000000000000001 R12: 0000000000000002 localhost kernel: R13: ffff9e7ead15d600 R14: 0000000000000000 R15: ffff9e7ead15d698 localhost kernel: FS: 0000152a3d111700(0000) GS:ffff9e855ee80000(0000) knlGS:0000000000000000 localhost kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
localhost kernel: CR2: 0000152938000010 CR3: 000000044d7a4000 CR4: 00000000003506e0 localhost kernel: Call Trace:
localhost kernel: _raw_spin_lock_irqsave+0x30/0x40
localhost kernel: remove_wait_queue+0x12/0x50
localhost kernel: kfd_wait_on_events+0x1b6/0x490 [hydcu]
localhost kernel: ? ftrace_graph_caller+0xa0/0xa0
localhost kernel: kfd_ioctl+0x38c/0x4a0 [hydcu]
localhost kernel: ? kfd_ioctl_set_trap_handler+0x70/0x70 [hydcu]
localhost kernel: ? kfd_ioctl_create_queue+0x5a0/0x5a0 [hydcu]
localhost kernel: ? ftrace_graph_caller+0xa0/0xa0
localhost kernel: __x64_sys_ioctl+0x8e/0xd0
localhost kernel: ? syscall_trace_enter.isra.18+0x143/0x1b0
localhost kernel: do_syscall_64+0x33/0x80
localhost kernel: entry_SYSCALL_64_after_hwframe+0x44/0xa9
localhost kernel: RIP: 0033:0x152a4dff68d7
Allocate the structure with kcalloc, and remove redundant 0-initialization and a redundant loop condition check.
--- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_events.c +3 -6
@@ -778,16 +778,13 @@ static struct kfd_event_waiter *alloc_event_waiters(uint32_t num_events)struct kfd_event_waiter *event_waiters;uint32_t i; - event_waiters =kmalloc_array (num_events, -sizeof (struct kfd_event_waiter ), -GFP_KERNEL ); + event_waiters =kcalloc (num_events,sizeof (struct kfd_event_waiter ), +GFP_KERNEL );if (!event_waiters)return NULL ; -for (i =0 ; (event_waiters) && (i < num_events) ; i++) { +for (i =0 ; i < num_events; i++)init_wait (&event_waiters[i].wait); - event_waiters[i].activated = false; - }return event_waiters; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 111/211 net/9p: fix bug in client create for .L
In reply to Greg Kroah-HartmanFrom: Eric Van Hensbergen <[email protected]>
[ Upstream commit 3866584a1c56a2bbc8c0981deb4476d0b801969e ]
We are supposed to set fid->mode to reflect the flags that were used to open the file. We were actually setting it to the creation mode which is the default perms of the file not the flags the file was opened with.
--- net/9p/client.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/9p/client.c +1 -1
@@ -1289,7 +1289,7 @@ int p9_client_create_dotl(struct p9_fid *ofid, const char *name, u32 flags, qid->type, qid->path, qid->version, iounit);memmove (&ofid->qid, qid,sizeof (struct p9_qid )); - ofid->mode = mode; + ofid->mode = flags; ofid->iounit = iounit; free_and_error:
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 112/211 LoongArch: Only call get_timer_irq() once in constant_clockevent_init()
In reply to Greg Kroah-HartmanFrom: Tiezhu Yang <[email protected]>
[ Upstream commit bb7a78e343468873bf00b2b181fcfd3c02d8cb56 ]
Under CONFIG_DEBUG_ATOMIC_SLEEP=y and CONFIG_DEBUG_PREEMPT=y, we can see the following messages on LoongArch, this is because using might_sleep() in preemption disable context.
[ 0.001127] smp: Bringing up secondary CPUs ... [ 0.001222] Booting CPU#1... [ 0.001244] 64-bit Loongson Processor probed (LA464 Core) [ 0.001247] CPU1 revision is: 0014c012 (Loongson-64bit) [ 0.001250] FPU1 revision is: 00000000 [ 0.001252] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:283 [ 0.001255] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/1 [ 0.001257] preempt_count: 1, expected: 0 [ 0.001258] RCU nest depth: 0, expected: 0 [ 0.001259] Preemption disabled at: [ 0.001261] [<9000000000223800>] arch_dup_task_struct+0x20/0x110 [ 0.001272] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.2.0-rc7+ #43 [ 0.001275] Hardware name: Loongson Loongson-3A5000-7A1000-1w-A2101/Loongson-LS3A5000-7A1000-1w-A2101, BIOS vUDK2018-LoongArch-V4.0.05132-beta10 12/13/202 [ 0.001277] Stack : 0072617764726148 0000000000000000 9000000000222f1c 90000001001e0000 [ 0.001286] 90000001001e3be0 90000001001e3be8 0000000000000000 0000000000000000 [ 0.001292] 90000001001e3be8 0000000000000040 90000001001e3cb8 90000001001e3a50 [ 0.001297] 9000000001642000 90000001001e3be8 be694d10ce4139dd 9000000100174500 [ 0.001303] 0000000000000001 0000000000000001 00000000ffffe0a2 0000000000000020 [ 0.001309] 000000000000002f 9000000001354116 00000000056b0000 ffffffffffffffff [ 0.001314] 0000000000000000 0000000000000000 90000000014f6e90 9000000001642000 [ 0.001320] 900000000022b69c 0000000000000001 0000000000000000 9000000001736a90 [ 0.001325] 9000000100038000 0000000000000000 9000000000222f34 0000000000000000 [ 0.001331] 00000000000000b0 0000000000000004 0000000000000000 0000000000070000 [ 0.001337] ... [ 0.001339] Call Trace: [ 0.001342] [<9000000000222f34>] show_stack+0x5c/0x180 [ 0.001346] [<90000000010bdd80>] dump_stack_lvl+0x60/0x88 [ 0.001352] [<9000000000266418>] __might_resched+0x180/0x1cc [ 0.001356] [<90000000010c742c>] mutex_lock+0x20/0x64 [ 0.001359] [<90000000002a8ccc>] irq_find_matching_fwspec+0x48/0x124 [ 0.001364] [<90000000002259c4>] constant_clockevent_init+0x68/0x204 [ 0.001368] [<900000000022acf4>] start_secondary+0x40/0xa8 [ 0.001371] [<90000000010c0124>] smpboot_entry+0x60/0x64
Here are the complete call chains:
smpboot_entry()
start_secondary()
constant_clockevent_init()
get_timer_irq()
irq_find_matching_fwnode()
irq_find_matching_fwspec()
mutex_lock()
might_sleep()
__might_sleep()
__might_resched()In order to avoid the above issue, we should break the call chains, using timer_irq_installed variable as check condition to only call get_timer_irq() once in constant_clockevent_init() is a simple and proper way.
--- arch/loongarch/kernel/time.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
arch/loongarch/kernel/time.c +6 -5
@@ -140,16 +140,17 @@ static int get_timer_irq(void)int constant_clockevent_init (void ) { -int irq;unsigned int cpu =smp_processor_id ();unsigned long min_delta =0x600 ;unsigned long max_delta = (1UL <<48 ) -1 ;struct clock_event_device *cd; -static int timer_irq_installed =0 ; +static int irq =0 , timer_irq_installed =0 ; - irq =get_timer_irq (); -if (irq <0 ) -pr_err ("Failed to map irq %d (timer)\n" , irq); +if (!timer_irq_installed) { + irq =get_timer_irq (); +if (irq <0 ) +pr_err ("Failed to map irq %d (timer)\n" , irq); + } cd = &per_cpu (constant_clockevent_device, cpu);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 113/211 sh: intc: Avoid spurious sizeof-pointer-div warning
In reply to Greg Kroah-HartmanFrom: Michael Karcher <[email protected]>
[ Upstream commit 250870824c1cf199b032b1ef889c8e8d69d9123a ]
GCC warns about the pattern sizeof(void*)/sizeof(void), as it looks like the abuse of a pattern to calculate the array size. This pattern appears in the unevaluated part of the ternary operator in _INTC_ARRAY if the parameter is NULL.
The replacement uses an alternate approach to return 0 in case of NULL which does not generate the pattern sizeof(void*)/sizeof(void), but still emits the warning if _INTC_ARRAY is called with a nonarray parameter.
This patch is required for successful compilation with -Werror enabled.
The idea to use _Generic for type distinction is taken from Comment #7 in https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108483 by Jakub Jelinek
--- include/linux/sh_intc.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
include/linux/sh_intc.h +4 -1
@@ -97,7 +97,10 @@ struct intc_hw_desc {unsigned int nr_subgroups; }; -#define _INTC_ARRAY (a) a, __same_type(a, NULL) ? 0 : sizeof(a)/sizeof(*a) +#define _INTC_SIZEOF_OR_ZERO (a) (_Generic(a, \ + typeof(NULL): 0, \ + default: sizeof(a))) +#define _INTC_ARRAY (a) a, _INTC_SIZEOF_OR_ZERO(a)/sizeof(*a)#define INTC_HW_DESC (vectors, groups, mask_regs, \ prio_regs, sense_regs, ack_regs) \
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 114/211 drm/amdgpu: fix ttm_bo calltrace warning in psp_hw_fini
In reply to Greg Kroah-HartmanFrom: Horatio Zhang <[email protected]>
[ Upstream commit 23f4a2d29ba57bf88095f817de5809d427fcbe7e ]
The call trace occurs when the amdgpu is removed after the mode1 reset. During mode1 reset, from suspend to resume, there is no need to reinitialize the ta firmware buffer which caused the bo pin_count increase redundantly.
[ 489.885525] Call Trace: [ 489.885525] <TASK> [ 489.885526] amdttm_bo_put+0x34/0x50 [amdttm] [ 489.885529] amdgpu_bo_free_kernel+0xe8/0x130 [amdgpu] [ 489.885620] psp_free_shared_bufs+0xb7/0x150 [amdgpu] [ 489.885720] psp_hw_fini+0xce/0x170 [amdgpu] [ 489.885815] amdgpu_device_fini_hw+0x2ff/0x413 [amdgpu] [ 489.885960] ? blocking_notifier_chain_unregister+0x56/0xb0 [ 489.885962] amdgpu_driver_unload_kms+0x51/0x60 [amdgpu] [ 489.886049] amdgpu_pci_remove+0x5a/0x140 [amdgpu] [ 489.886132] ? __pm_runtime_resume+0x60/0x90 [ 489.886134] pci_device_remove+0x3e/0xb0 [ 489.886135] __device_release_driver+0x1ab/0x2a0 [ 489.886137] driver_detach+0xf3/0x140 [ 489.886138] bus_remove_driver+0x6c/0xf0 [ 489.886140] driver_unregister+0x31/0x60 [ 489.886141] pci_unregister_driver+0x40/0x90 [ 489.886142] amdgpu_exit+0x15/0x451 [amdgpu]
--- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +3 -3
@@ -1685,7 +1685,7 @@ static int psp_hdcp_initialize(struct psp_context *psp) psp->hdcp_context.context.mem_context.shared_mem_size =PSP_HDCP_SHARED_MEM_SIZE ; psp->hdcp_context.context.ta_load_type =GFX_CMD_ID_LOAD_TA ; -if (!psp->hdcp_context.context.initialized) { +if (!psp->hdcp_context.context.mem_context.shared_buf) { ret =psp_ta_init_shared_buf (psp, &psp->hdcp_context.context.mem_context);if (ret)return ret;
@@ -1752,7 +1752,7 @@ static int psp_dtm_initialize(struct psp_context *psp) psp->dtm_context.context.mem_context.shared_mem_size =PSP_DTM_SHARED_MEM_SIZE ; psp->dtm_context.context.ta_load_type =GFX_CMD_ID_LOAD_TA ; -if (!psp->dtm_context.context.initialized) { +if (!psp->dtm_context.context.mem_context.shared_buf) { ret =psp_ta_init_shared_buf (psp, &psp->dtm_context.context.mem_context);if (ret)return ret;
@@ -1820,7 +1820,7 @@ static int psp_rap_initialize(struct psp_context *psp) psp->rap_context.context.mem_context.shared_mem_size =PSP_RAP_SHARED_MEM_SIZE ; psp->rap_context.context.ta_load_type =GFX_CMD_ID_LOAD_TA ; -if (!psp->rap_context.context.initialized) { +if (!psp->rap_context.context.mem_context.shared_buf) { ret =psp_ta_init_shared_buf (psp, &psp->rap_context.context.mem_context);if (ret)return ret;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 115/211 drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes
In reply to Greg Kroah-HartmanFrom: Alex Hung <[email protected]>
[ Upstream commit 031f196d1b1b6d5dfcb0533b431e3ab1750e6189 ]
[WHY]
When PTEBufferSizeInRequests is zero, UBSAN reports the following warning because dml_log2 returns an unexpected negative value:
shift exponent 4294966273 is too large for 32-bit type 'int'
[HOW]
In the case PTEBufferSizeInRequests is zero, skip the dml_log2() and assign the result directly.
--- .../gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dml/dcn30/display_mode_vba_30.c +4 -1
@@ -1802,7 +1802,10 @@ static unsigned int CalculateVMAndRowBytes( }if (SurfaceTiling == dm_sw_linear) { - *dpte_row_height =dml_min (128 ,1 << (unsigned int )dml_floor (dml_log2 (PTEBufferSizeInRequests * *PixelPTEReqWidth / Pitch),1 )); +if (PTEBufferSizeInRequests ==0 ) + *dpte_row_height =1 ; +else + *dpte_row_height =dml_min (128 ,1 << (unsigned int )dml_floor (dml_log2 (PTEBufferSizeInRequests * *PixelPTEReqWidth / Pitch),1 )); *dpte_row_width_ub = (dml_ceil (((double ) SwathWidth -1 ) / *PixelPTEReqWidth,1 ) +1 ) * *PixelPTEReqWidth; *PixelPTEBytesPerRow = *dpte_row_width_ub / *PixelPTEReqWidth * *PTERequestSize; }else if (ScanDirection != dm_vert) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 116/211 ext4: fix possible double unlock when moving a directory
In reply to Greg Kroah-HartmanFrom: Theodore Ts'o <[email protected]>
commit 70e42feab2e20618ddd0cbfc4ab4b08628236ecd upstream.
--- fs/ext4/namei.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
fs/ext4/namei.c +1 -3
@@ -3884,10 +3884,8 @@ static int ext4_rename(struct user_names goto end_rename; } retval =ext4_rename_dir_prepare (handle, &old); -if (retval) { -inode_unlock (old.inode); +if (retval) goto end_rename; - } }/* * If we're renaming a file within an inline_data dir and adding or
Greg Kroah-Hartman
maintainerPATCH 117/211 Revert "tty: serial: fsl_lpuart: adjust SERIAL_FSL_LPUART_CONSOLE config dependency"
In reply to Greg Kroah-HartmanFrom: Tom Rix <[email protected]>
commit 2d638be71155b2e036aca1966b6129e2d661e91f upstream.
This reverts commit 5779a072c248db7a40cfd0f5ea958097fd1d9a30.
This results in a link error of
ld: drivers/tty/serial/earlycon.o: in function `parse_options':drivers/tty/serial/earlycon.c:99: undefined reference to `uart_parse_earlycon'
When the config is in this state
CONFIG_SERIAL_CORE=mCONFIG_SERIAL_CORE_CONSOLE=yCONFIG_SERIAL_EARLYCON=yCONFIG_SERIAL_FSL_LPUART=mCONFIG_SERIAL_FSL_LPUART_CONSOLE=y
--- drivers/tty/serial/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/Kconfig +1 -1
@@ -1313,7 +1313,7 @@ config SERIAL_FSL_LPUART config SERIAL_FSL_LPUART_CONSOLE bool "Console on Freescale lpuart serial port" - depends on SERIAL_FSL_LPUART + depends on SERIAL_FSL_LPUART=y select SERIAL_CORE_CONSOLE select SERIAL_EARLYCON help
Greg Kroah-Hartman
maintainerPATCH 118/211 tty: serial: fsl_lpuart: fix race on RX DMA shutdown
In reply to Greg Kroah-HartmanFrom: Alexander Sverdlin <[email protected]>
commit 1be6f2b15f902c02e055ae0b419ca789200473c9 upstream.
Quoted 1 line
From time to time DMA completion can come in the middle of DMA shutdown:
<process ctx>: <IRQ>:lpuart32_shutdown()
lpuart_dma_shutdown()
del_timer_sync()
lpuart_dma_rx_complete()
lpuart_copy_rx_to_tty()
mod_timer()
lpuart_dma_rx_free()When the timer fires a bit later, sport->dma_rx_desc is NULL:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004 pc : lpuart_copy_rx_to_tty+0xcc/0x5bc lr : lpuart_timer_func+0x1c/0x2c Call trace: lpuart_copy_rx_to_tty lpuart_timer_func call_timer_fn __run_timers.part.0 run_timer_softirq __do_softirq __irq_exit_rcu irq_exit handle_domain_irq gic_handle_irq call_on_irq_stack do_interrupt_handler ...
To fix this fold del_timer_sync() into lpuart_dma_rx_free() after dmaengine_terminate_sync() to make sure timer will not be re-started in lpuart_copy_rx_to_tty() <= lpuart_dma_rx_complete().
--- drivers/tty/serial/fsl_lpuart.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-)
drivers/tty/serial/fsl_lpuart.c +3 -8
@@ -1328,6 +1328,7 @@ static void lpuart_dma_rx_free(struct uastruct dma_chan *chan = sport->dma_rx_chan;dmaengine_terminate_sync (chan); +del_timer_sync (&sport->lpuart_timer);dma_unmap_sg (chan->device->dev, &sport->rx_sgl,1 ,DMA_FROM_DEVICE );kfree (sport->rx_ring.buf); sport->rx_ring.tail =0 ;
@@ -1762,7 +1763,6 @@ static int lpuart32_startup(struct uart_static void lpuart_dma_shutdown (struct lpuart_port *sport) {if (sport->lpuart_dma_rx_use) { -del_timer_sync (&sport->lpuart_timer);lpuart_dma_rx_free (&sport->port); sport->lpuart_dma_rx_use = false; }
@@ -1922,10 +1922,8 @@ lpuart_set_termios(struct uart_port *por* Since timer function acqures sport->port.lock, need to stop before * acquring same lock because otherwise del_timer_sync() can deadlock. */ -if (old && sport->lpuart_dma_rx_use) { -del_timer_sync (&sport->lpuart_timer); +if (old && sport->lpuart_dma_rx_use)lpuart_dma_rx_free (&sport->port); - }spin_lock_irqsave (&sport->port.lock, flags);
@@ -2159,10 +2157,8 @@ lpuart32_set_termios(struct uart_port *p* Since timer function acqures sport->port.lock, need to stop before * acquring same lock because otherwise del_timer_sync() can deadlock. */ -if (old && sport->lpuart_dma_rx_use) { -del_timer_sync (&sport->lpuart_timer); +if (old && sport->lpuart_dma_rx_use)lpuart_dma_rx_free (&sport->port); - }spin_lock_irqsave (&sport->port.lock, flags);
@@ -2962,7 +2958,6 @@ static int lpuart_suspend(struct device* cannot resume as expected, hence gracefully release the * Rx DMA path before suspend and start Rx DMA path on resume. */ -del_timer_sync (&sport->lpuart_timer);lpuart_dma_rx_free (&sport->port);/* Disable Rx DMA to use UART port as wakeup source */
Greg Kroah-Hartman
maintainerPATCH 119/211 tty: serial: fsl_lpuart: skip waiting for transmission complete when UARTCTRL_SBK is asserted
In reply to Greg Kroah-HartmanFrom: Sherry Sun <[email protected]>
commit 2411fd94ceaa6e11326e95d6ebf876cbfed28d23 upstream.
According to LPUART RM, Transmission Complete Flag becomes 0 if queuing a break character by writing 1 to CTRL[SBK], so here need to skip waiting for transmission complete when UARTCTRL_SBK is asserted, otherwise the kernel may stuck here.
And actually set_termios() adds transmission completion waiting to avoid data loss or data breakage when changing the baud rate, but we don't need to worry about this when queuing break characters.
--- drivers/tty/serial/fsl_lpuart.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/tty/serial/fsl_lpuart.c +9 -3
@@ -2185,9 +2185,15 @@ lpuart32_set_termios(struct uart_port *p/* update the per-port timeout */ uart_update_timeout (port, termios->c_cflag, baud); -/* wait transmit engin complete */ -lpuart32_write (&sport->port,0 ,UARTMODIR ); -lpuart32_wait_bit_set (&sport->port,UARTSTAT ,UARTSTAT_TC ); +/* +* LPUART Transmission Complete Flag may never be set while queuing a break +* character, so skip waiting for transmission complete when UARTCTRL_SBK is +* asserted. +*/ +if (!(old_ctrl &UARTCTRL_SBK )) { +lpuart32_write (&sport->port,0 ,UARTMODIR ); +lpuart32_wait_bit_set (&sport->port,UARTSTAT ,UARTSTAT_TC ); + }/* disable transmit and receive */ lpuart32_write(&sport->port, old_ctrl & ~(UARTCTRL_TE | UARTCTRL_RE),
Greg Kroah-Hartman
maintainerPATCH 120/211 serial: 8250_em: Fix UART port type
In reply to Greg Kroah-HartmanFrom: Biju Das <[email protected]>
commit 32e293be736b853f168cd065d9cbc1b0c69f545d upstream.
As per HW manual for EMEV2 "R19UH0040EJ0400 Rev.4.00", the UART IP found on EMMA mobile SoC is Register-compatible with the general-purpose 16750 UART chip. Fix UART port type as 16750 and enable 64-bytes fifo support.
--- drivers/tty/serial/8250/8250_em.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/tty/serial/8250/8250_em.c +2 -2
@@ -106,8 +106,8 @@ static int serial8250_em_probe(struct plmemset (&up,0 ,sizeof (up)); up.port.mapbase = regs->start; up.port.irq = irq; - up.port.type =PORT_UNKNOWN ; - up.port.flags =UPF_BOOT_AUTOCONF |UPF_FIXED_PORT |UPF_IOREMAP ; + up.port.type =PORT_16750 ; + up.port.flags =UPF_FIXED_PORT |UPF_IOREMAP |UPF_FIXED_TYPE ; up.port.dev = &pdev->dev; up.port.private_data = priv;
Greg Kroah-Hartman
maintainerPATCH 121/211 serial: 8250_fsl: fix handle_irq locking
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 6e01f9a594ee0f69fb52cc8d11971612b4817f0b upstream.
The 8250 handle_irq callback is not just called from the interrupt handler but also from a timer callback when polling (e.g. for ports without an interrupt line). Consequently the callback must explicitly disable interrupts to avoid a potential deadlock with another interrupt in polled mode.
Fix up the two paths in the freescale callback that failed to re-enable interrupts when polling.
--- drivers/tty/serial/8250/8250_fsl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/tty/serial/8250/8250_fsl.c +2 -2
@@ -34,7 +34,7 @@ int fsl8250_handle_irq(struct uart_port *port) iir = port->serial_in (port,UART_IIR );if (iir &UART_IIR_NO_INT ) { -spin_unlock (&up->port.lock); +spin_unlock_irqrestore (&up->port.lock, flags);return 0 ; }
@@ -42,7 +42,7 @@ int fsl8250_handle_irq(struct uart_port *port)if (unlikely (up->lsr_saved_flags &UART_LSR_BI )) { up->lsr_saved_flags &= ~UART_LSR_BI ; port->serial_in (port,UART_RX ); -spin_unlock (&up->port.lock); +spin_unlock_irqrestore (&up->port.lock, flags);return 1 ; }
Signature · 1 line
2.40.0
Greg Kroah-Hartman
maintainerPATCH 122/211 serial: 8250: ASPEED_VUART: select REGMAP instead of depending on it
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
commit f8086d1a65ac693e3fd863128352b4b11ee7324d upstream.
REGMAP is a hidden (not user visible) symbol. Users cannot set it directly thru "make *config", so drivers should select it instead of depending on it if they need it.
Consistently using "select" or "depends on" can also help reduce Kconfig circular dependency issues.
Therefore, change the use of "depends on REGMAP" to "select REGMAP".
--- drivers/tty/serial/8250/Kconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/tty/serial/8250/Kconfig +2 -1
@@ -253,8 +253,9 @@ config SERIAL_8250_ASPEED_VUART tristate "Aspeed Virtual UART" depends on SERIAL_8250 depends on OF - depends on REGMAP && MFD_SYSCON + depends on MFD_SYSCON depends on ARCH_ASPEED || COMPILE_TEST + select REGMAP help If you want to use the virtual UART (VUART) device on Aspeed BMC platforms, enable this option. This enables the 16550A-
Greg Kroah-Hartman
maintainerPATCH 123/211 firmware: xilinx: dont make a sleepable memory allocation from an atomic context
In reply to Greg Kroah-HartmanFrom: Roman Gushchin <[email protected]>
commit 38ed310c22e7a0fc978b1f8292136a4a4a8b3051 upstream.
The following issue was discovered using lockdep:
[ 6.691371] BUG: sleeping function called from invalid context at include/linux/sched/mm.h:209
[ 6.694602] in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 1, name: swapper/0
[ 6.702431] 2 locks held by swapper/0/1:
[ 6.706300] #0: ffffff8800f6f188 (&dev->mutex){....}-{3:3}, at: __device_driver_lock+0x4c/0x90
[ 6.714900] #1: ffffffc009a2abb8 (enable_lock){....}-{2:2}, at: clk_enable_lock+0x4c/0x140
[ 6.723156] irq event stamp: 304030
[ 6.726596] hardirqs last enabled at (304029): [<ffffffc008d17ee0>] _raw_spin_unlock_irqrestore+0xc0/0xd0
[ 6.736142] hardirqs last disabled at (304030): [<ffffffc00876bc5c>] clk_enable_lock+0xfc/0x140
[ 6.744742] softirqs last enabled at (303958): [<ffffffc0080904f0>] _stext+0x4f0/0x894
[ 6.752655] softirqs last disabled at (303951): [<ffffffc0080e53b8>] irq_exit+0x238/0x280
[ 6.760744] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G U 5.15.36 #2
[ 6.768048] Hardware name: xlnx,zynqmp (DT)
[ 6.772179] Call trace:
[ 6.774584] dump_backtrace+0x0/0x300
[ 6.778197] show_stack+0x18/0x30
[ 6.781465] dump_stack_lvl+0xb8/0xec
[ 6.785077] dump_stack+0x1c/0x38
[ 6.788345] ___might_sleep+0x1a8/0x2a0
[ 6.792129] __might_sleep+0x6c/0xd0
[ 6.795655] kmem_cache_alloc_trace+0x270/0x3d0
[ 6.800127] do_feature_check_call+0x100/0x220
[ 6.804513] zynqmp_pm_invoke_fn+0x8c/0xb0
[ 6.808555] zynqmp_pm_clock_getstate+0x90/0xe0
[ 6.813027] zynqmp_pll_is_enabled+0x8c/0x120
[ 6.817327] zynqmp_pll_enable+0x38/0xc0
[ 6.821197] clk_core_enable+0x144/0x400
[ 6.825067] clk_core_enable+0xd4/0x400
[ 6.828851] clk_core_enable+0xd4/0x400
[ 6.832635] clk_core_enable+0xd4/0x400
[ 6.836419] clk_core_enable+0xd4/0x400
[ 6.840203] clk_core_enable+0xd4/0x400
[ 6.843987] clk_core_enable+0xd4/0x400
[ 6.847771] clk_core_enable+0xd4/0x400
[ 6.851555] clk_core_enable_lock+0x24/0x50
[ 6.855683] clk_enable+0x24/0x40
[ 6.858952] fclk_probe+0x84/0xf0
[ 6.862220] platform_probe+0x8c/0x110
[ 6.865918] really_probe+0x110/0x5f0
[ 6.869530] __driver_probe_device+0xcc/0x210
[ 6.873830] driver_probe_device+0x64/0x140
[ 6.877958] __driver_attach+0x114/0x1f0
[ 6.881828] bus_for_each_dev+0xe8/0x160
[ 6.885698] driver_attach+0x34/0x50
[ 6.889224] bus_add_driver+0x228/0x300
[ 6.893008] driver_register+0xc0/0x1e0
[ 6.896792] __platform_driver_register+0x44/0x60
[ 6.901436] fclk_driver_init+0x1c/0x28
[ 6.905220] do_one_initcall+0x104/0x590
[ 6.909091] kernel_init_freeable+0x254/0x2bc
[ 6.913390] kernel_init+0x24/0x130
[ 6.916831] ret_from_fork+0x10/0x20Fix it by passing the GFP_ATOMIC gfp flag for the corresponding memory allocation.
--- drivers/firmware/xilinx/zynqmp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/firmware/xilinx/zynqmp.c +1 -1
@@ -206,7 +206,7 @@ static int do_feature_check_call(const u }/* Add new entry if not present */ - feature_data =kmalloc (sizeof (*feature_data),GFP_KERNEL ); + feature_data =kmalloc (sizeof (*feature_data),GFP_ATOMIC );if (!feature_data)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 124/211 memory: tegra: fix interconnect registration race
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 5553055c62683ce339f9ef5fb2a26c8331485d68 upstream.
The current interconnect provider registration interface is inherently racy as nodes are not added until the after adding the provider. This can specifically cause racing DT lookups to fail.
Switch to using the new API where the provider is not registered until after it has been fully initialised.
--- drivers/memory/tegra/mc.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-)
drivers/memory/tegra/mc.c +7 -9
@@ -794,16 +794,12 @@ static int tegra_mc_interconnect_setup(s mc->provider.aggregate = mc->soc->icc_ops->aggregate; mc->provider.xlate_extended = mc->soc->icc_ops->xlate_extended; - err =icc_provider_add (&mc->provider); -if (err) -return err; +icc_provider_init (&mc->provider);/* create Memory Controller node */ node =icc_node_create (TEGRA_ICC_MC ); -if (IS_ERR (node)) { - err =PTR_ERR (node); - goto del_provider; - } +if (IS_ERR (node)) +return PTR_ERR (node); node->name ="Memory Controller" ;icc_node_add (node, &mc->provider);
@@ -830,12 +826,14 @@ static int tegra_mc_interconnect_setup(s goto remove_nodes; } + err =icc_provider_register (&mc->provider); +if (err) + goto remove_nodes; +return 0 ; remove_nodes:icc_nodes_remove (&mc->provider); -del_provider: -icc_provider_del (&mc->provider);return err; }
Greg Kroah-Hartman
maintainerPATCH 125/211 memory: tegra20-emc: fix interconnect registration race
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit c5587f61ec050f7e9ebb3e2da29d12af63e833d3 upstream.
The current interconnect provider registration interface is inherently racy as nodes are not added until the after adding the provider. This can specifically cause racing DT lookups to fail.
Switch to using the new API where the provider is not registered until after it has been fully initialised.
--- drivers/memory/tegra/tegra20-emc.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/memory/tegra/tegra20-emc.c +6 -6
@@ -1021,15 +1021,13 @@ static int tegra_emc_interconnect_init(s emc->provider.aggregate = soc->icc_ops->aggregate; emc->provider.xlate_extended = emc_of_icc_xlate_extended; - err =icc_provider_add (&emc->provider); -if (err) - goto err_msg; +icc_provider_init (&emc->provider);/* create External Memory Controller node */ node =icc_node_create (TEGRA_ICC_EMC );if (IS_ERR (node)) { err =PTR_ERR (node); - goto del_provider; + goto err_msg; } node->name ="External Memory Controller" ;
@@ -1050,12 +1048,14 @@ static int tegra_emc_interconnect_init(s node->name ="External Memory (DRAM)" ;icc_node_add (node, &emc->provider); + err =icc_provider_register (&emc->provider); +if (err) + goto remove_nodes; +return 0 ; remove_nodes:icc_nodes_remove (&emc->provider); -del_provider: -icc_provider_del (&emc->provider); err_msg:dev_err (emc->dev,"failed to initialize ICC: %d\n" , err);
Greg Kroah-Hartman
maintainerPATCH 126/211 memory: tegra124-emc: fix interconnect registration race
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit abd9f1b49cf25eebeaba193c7707355be3f48dae upstream.
The current interconnect provider registration interface is inherently racy as nodes are not added until the after adding the provider. This can specifically cause racing DT lookups to fail.
Switch to using the new API where the provider is not registered until after it has been fully initialised.
--- drivers/memory/tegra/tegra124-emc.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/memory/tegra/tegra124-emc.c +6 -6
@@ -1351,15 +1351,13 @@ static int tegra_emc_interconnect_init(s emc->provider.aggregate = soc->icc_ops->aggregate; emc->provider.xlate_extended = emc_of_icc_xlate_extended; - err =icc_provider_add (&emc->provider); -if (err) - goto err_msg; +icc_provider_init (&emc->provider);/* create External Memory Controller node */ node =icc_node_create (TEGRA_ICC_EMC );if (IS_ERR (node)) { err =PTR_ERR (node); - goto del_provider; + goto err_msg; } node->name ="External Memory Controller" ;
@@ -1380,12 +1378,14 @@ static int tegra_emc_interconnect_init(s node->name ="External Memory (DRAM)" ;icc_node_add (node, &emc->provider); + err =icc_provider_register (&emc->provider); +if (err) + goto remove_nodes; +return 0 ; remove_nodes:icc_nodes_remove (&emc->provider); -del_provider: -icc_provider_del (&emc->provider); err_msg:dev_err (emc->dev,"failed to initialize ICC: %d\n" , err);
Greg Kroah-Hartman
maintainerPATCH 127/211 memory: tegra30-emc: fix interconnect registration race
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 9db481c909dd6312ccfbdc7e343b50e41c727483 upstream.
The current interconnect provider registration interface is inherently racy as nodes are not added until the after adding the provider. This can specifically cause racing DT lookups to fail.
Switch to using the new API where the provider is not registered until after it has been fully initialised.
--- drivers/memory/tegra/tegra30-emc.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/memory/tegra/tegra30-emc.c +6 -6
@@ -1533,15 +1533,13 @@ static int tegra_emc_interconnect_init(s emc->provider.aggregate = soc->icc_ops->aggregate; emc->provider.xlate_extended = emc_of_icc_xlate_extended; - err =icc_provider_add (&emc->provider); -if (err) - goto err_msg; +icc_provider_init (&emc->provider);/* create External Memory Controller node */ node =icc_node_create (TEGRA_ICC_EMC );if (IS_ERR (node)) { err =PTR_ERR (node); - goto del_provider; + goto err_msg; } node->name ="External Memory Controller" ;
@@ -1562,12 +1560,14 @@ static int tegra_emc_interconnect_init(s node->name ="External Memory (DRAM)" ;icc_node_add (node, &emc->provider); + err =icc_provider_register (&emc->provider); +if (err) + goto remove_nodes; +return 0 ; remove_nodes:icc_nodes_remove (&emc->provider); -del_provider: -icc_provider_del (&emc->provider); err_msg:dev_err (emc->dev,"failed to initialize ICC: %d\n" , err);
Greg Kroah-Hartman
maintainerPATCH 128/211 drm/ttm: Fix a NULL pointer dereference
In reply to Greg Kroah-HartmanFrom: Thomas Hellström <[email protected]>
commit 9a9a8fe26751334b7739193a94eba741073b8a55 upstream.
The LRU mechanism may look up a resource in the process of being removed from an object. The locking rules here are a bit unclear but it looks currently like res->bo assignment is protected by the LRU lock, whereas bo->resource is protected by the object lock, while *clearing* of bo->resource is also protected by the LRU lock. This means that if we check that bo->resource points to the LRU resource under the LRU lock we should be safe.
So perform that check before deciding to swap out a bo. That avoids dereferencing a NULL bo->resource in ttm_bo_swapout().
--- drivers/gpu/drm/ttm/ttm_device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/ttm/ttm_device.c +1 -1
@@ -158,7 +158,7 @@ int ttm_device_swapout(struct ttm_devicestruct ttm_buffer_object *bo = res->bo;uint32_t num_pages; -if (!bo) +if (!bo || bo->resource != res)continue ; num_pages =PFN_UP (bo->base.size);
Greg Kroah-Hartman
maintainerPATCH 129/211 s390/ipl: add missing intersection check to ipl_report handling
In reply to Greg Kroah-HartmanFrom: Sven Schnelle <[email protected]>
commit a52e5cdbe8016d4e3e6322fd93d71afddb9a5af9 upstream.
The code which handles the ipl report is searching for a free location in memory where it could copy the component and certificate entries to. It checks for intersection between the sections required for the kernel and the component/certificate data area, but fails to check whether the data structures linking these data areas together intersect.
This might cause the iplreport copy code to overwrite the iplreport itself. Fix this by adding two addtional intersection checks.
--- arch/s390/boot/ipl_report.c | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/s390/boot/ipl_report.c +8 -0
@@ -57,11 +57,19 @@ repeat:if (IS_ENABLED (CONFIG_BLK_DEV_INITRD ) && initrd_data.start && initrd_data.size &&intersects (initrd_data.start, initrd_data.size, safe_addr, size)) safe_addr = initrd_data.start + initrd_data.size; +if (intersects (safe_addr, size, (unsigned long )comps, comps->len)) { + safe_addr = (unsigned long )comps + comps->len; + goto repeat; + }for_each_rb_entry (comp, comps)if (intersects (safe_addr, size, comp->addr, comp->len)) { safe_addr = comp->addr + comp->len; goto repeat; } +if (intersects (safe_addr, size, (unsigned long )certs, certs->len)) { + safe_addr = (unsigned long )certs + certs->len; + goto repeat; + }for_each_rb_entry (cert, certs)if (intersects (safe_addr, size, cert->addr, cert->len)) { safe_addr = cert->addr + cert->len;
Greg Kroah-Hartman
maintainerPATCH 130/211 interconnect: fix icc_provider_del() error handling
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit e0e7089bf9a87bc5e3997422e4e24563424f9018 upstream.
The interconnect framework currently expects that providers are only removed when there are no users and after all nodes have been removed.
There is currently nothing that guarantees this to be the case and the framework does not do any reference counting, but refusing to remove the provider is never correct as that would leave a dangling pointer to a resource that is about to be released in the global provider list (e.g. accessible through debugfs).
Replace the current sanity checks with WARN_ON() so that the provider is always removed.
--- drivers/interconnect/core.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-)
drivers/interconnect/core.c +2 -12
@@ -1061,18 +1061,8 @@ EXPORT_SYMBOL_GPL(icc_provider_add);void icc_provider_del (struct icc_provider *provider) {mutex_lock (&icc_lock); -if (provider->users) { -pr_warn ("interconnect provider still has %d users\n" , - provider->users); -mutex_unlock (&icc_lock); -return ; - } - -if (!list_empty (&provider->nodes)) { -pr_warn ("interconnect provider still has nodes\n" ); -mutex_unlock (&icc_lock); -return ; - } +WARN_ON (provider->users); +WARN_ON (!list_empty (&provider->nodes));list_del (&provider->provider_list);mutex_unlock (&icc_lock);
Greg Kroah-Hartman
maintainerPATCH 131/211 interconnect: fix provider registration API
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit eb59eca0d8ac15f8c1b7f1cd35999455a90292c0 upstream.
The current interconnect provider interface is inherently racy as providers are expected to be added before being fully initialised.
Specifically, nodes are currently not added and the provider data is not initialised until after registering the provider which can cause racing DT lookups to fail.
Add a new provider API which will be used to fix up the interconnect drivers.
The old API is reimplemented using the new interface and will be removed once all drivers have been fixed.
--- drivers/interconnect/core.c | 52 ++++++++++++++++++++++++---------- include/linux/interconnect-provider.h | 12 +++++++ 2 files changed, 50 insertions(+), 14 deletions(-)
drivers/interconnect/core.c +38 -14
@@ -1029,44 +1029,68 @@ int icc_nodes_remove(struct icc_providerEXPORT_SYMBOL_GPL (icc_nodes_remove);/** -* icc_provider_add() - add a new interconnect provider -* @provider: the interconnect provider that will be added into topology +* icc_provider_init() - initialize a new interconnect provider +* @provider: the interconnect provider to initialize +* +* Must be called before adding nodes to the provider. +*/ +void icc_provider_init (struct icc_provider *provider) +{ +WARN_ON (!provider->set); + +INIT_LIST_HEAD (&provider->nodes); +} +EXPORT_SYMBOL_GPL (icc_provider_init); + +/** +* icc_provider_register() - register a new interconnect provider +* @provider: the interconnect provider to register * * Return: 0 on success, or an error code otherwise */ -int icc_provider_add (struct icc_provider *provider) +int icc_provider_register (struct icc_provider *provider) { -if (WARN_ON (!provider->set)) -return -EINVAL ;if (WARN_ON (!provider->xlate && !provider->xlate_extended))return -EINVAL ;mutex_lock (&icc_lock); - -INIT_LIST_HEAD (&provider->nodes);list_add_tail (&provider->provider_list, &icc_providers); -mutex_unlock (&icc_lock); -dev_dbg (provider->dev,"interconnect provider added to topology\n" ); +dev_dbg (provider->dev,"interconnect provider registered\n" );return 0 ; } -EXPORT_SYMBOL_GPL (icc_provider_add); +EXPORT_SYMBOL_GPL (icc_provider_register);/** -* icc_provider_del() - delete previously added interconnect provider -* @provider: the interconnect provider that will be removed from topology +* icc_provider_deregister() - deregister an interconnect provider +* @provider: the interconnect provider to deregister */ -void icc_provider_del (struct icc_provider *provider) +void icc_provider_deregister (struct icc_provider *provider) {mutex_lock (&icc_lock);WARN_ON (provider->users); -WARN_ON (!list_empty (&provider->nodes));list_del (&provider->provider_list);mutex_unlock (&icc_lock); } +EXPORT_SYMBOL_GPL (icc_provider_deregister); + +int icc_provider_add (struct icc_provider *provider) +{ +icc_provider_init (provider); + +return icc_provider_register (provider); +} +EXPORT_SYMBOL_GPL (icc_provider_add); + +void icc_provider_del (struct icc_provider *provider) +{ +WARN_ON (!list_empty (&provider->nodes)); + +icc_provider_deregister (provider); +}EXPORT_SYMBOL_GPL (icc_provider_del);static int of_count_icc_providers (struct device_node *np)
include/linux/interconnect-provider.h +12 -0
@@ -122,6 +122,9 @@ int icc_link_destroy(struct icc_node *srvoid icc_node_add (struct icc_node *node,struct icc_provider *provider);void icc_node_del (struct icc_node *node);int icc_nodes_remove (struct icc_provider *provider); +void icc_provider_init (struct icc_provider *provider); +int icc_provider_register (struct icc_provider *provider); +void icc_provider_deregister (struct icc_provider *provider);int icc_provider_add (struct icc_provider *provider);void icc_provider_del (struct icc_provider *provider);struct icc_node_data *of_icc_get_from_provider (struct of_phandle_args *spec);
@@ -167,6 +170,15 @@ static inline int icc_nodes_remove(strucreturn -ENOTSUPP ; } +static inline void icc_provider_init (struct icc_provider *provider) { } + +static inline int icc_provider_register (struct icc_provider *provider) +{ +return -ENOTSUPP ; +} + +static inline void icc_provider_deregister (struct icc_provider *provider) { } +static inline int icc_provider_add (struct icc_provider *provider) {return -ENOTSUPP ;
Greg Kroah-Hartman
maintainerPATCH 132/211 interconnect: imx: fix registration race
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 9fbd35520f1f7f3cbe1873939a27ad9b009f21f9 upstream.
The current interconnect provider registration interface is inherently racy as nodes are not added until the after adding the provider. This can specifically cause racing DT lookups to fail.
Switch to using the new API where the provider is not registered until after it has been fully initialised.
--- drivers/interconnect/imx/imx.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
drivers/interconnect/imx/imx.c +10 -10
@@ -295,6 +295,9 @@ int imx_icc_register(struct platform_dev provider->xlate = of_icc_xlate_onecell; provider->data = data; provider->dev = dev->parent; + +icc_provider_init (provider); +platform_set_drvdata (pdev, imx_provider);if (settings) {
@@ -306,20 +309,18 @@ int imx_icc_register(struct platform_dev } } - ret =icc_provider_add (provider); -if (ret) { -dev_err (dev,"error adding interconnect provider: %d\n" , ret); + ret =imx_icc_register_nodes (imx_provider, nodes, nodes_count, settings); +if (ret)return ret; - } - ret =imx_icc_register_nodes (imx_provider, nodes, nodes_count, settings); + ret =icc_provider_register (provider);if (ret) - goto provider_del; + goto err_unregister_nodes;return 0 ; -provider_del: -icc_provider_del (provider); +err_unregister_nodes: +imx_icc_unregister_nodes (&imx_provider->provider);return ret; }EXPORT_SYMBOL_GPL (imx_icc_register);
@@ -328,9 +329,8 @@ void imx_icc_unregister(struct platform_ {struct imx_icc_provider *imx_provider =platform_get_drvdata (pdev); +icc_provider_deregister (&imx_provider->provider);imx_icc_unregister_nodes (&imx_provider->provider); - -icc_provider_del (&imx_provider->provider); }EXPORT_SYMBOL_GPL (imx_icc_unregister);
Greg Kroah-Hartman
maintainerPATCH 133/211 interconnect: fix mem leak when freeing nodes
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit a5904f415e1af72fa8fe6665aa4f554dc2099a95 upstream.
The node link array is allocated when adding links to a node but is not deallocated when nodes are destroyed.
--- drivers/interconnect/core.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/interconnect/core.c +4 -0
@@ -850,6 +850,10 @@ void icc_node_destroy(int id)mutex_unlock (&icc_lock); +if (!node) +return ; + +kfree (node->links);kfree (node); }EXPORT_SYMBOL_GPL (icc_node_destroy);
Greg Kroah-Hartman
maintainerPATCH 134/211 interconnect: qcom: osm-l3: fix registration race
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 174941ed28a3573db075da46d95b4dcf9d4c49c2 upstream.
The current interconnect provider registration interface is inherently racy as nodes are not added until the after adding the provider. This can specifically cause racing DT lookups to fail:
of_icc_xlate_onecell: invalid index 0
cpu cpu0: error -EINVAL: error finding src node
cpu cpu0: dev_pm_opp_of_find_icc_paths: Unable to get path0: -22
qcom-cpufreq-hw: probe of 18591000.cpufreq failed with error -22
Switch to using the new API where the provider is not registered until after it has been fully initialised.
--- drivers/interconnect/qcom/osm-l3.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
drivers/interconnect/qcom/osm-l3.c +6 -8
@@ -158,8 +158,8 @@ static int qcom_osm_l3_remove(struct pla {struct qcom_osm_l3_icc_provider *qp =platform_get_drvdata (pdev); +icc_provider_deregister (&qp->provider);icc_nodes_remove (&qp->provider); -icc_provider_del (&qp->provider);return 0 ; }
@@ -245,14 +245,9 @@ static int qcom_osm_l3_probe(struct plat provider->set = qcom_osm_l3_set; provider->aggregate = icc_std_aggregate; provider->xlate = of_icc_xlate_onecell; -INIT_LIST_HEAD (&provider->nodes); provider->data = data; - ret =icc_provider_add (provider); -if (ret) { -dev_err (&pdev->dev,"error adding interconnect provider\n" ); -return ret; - } +icc_provider_init (provider);for (i =0 ; i < num_nodes; i++) {size_t j;
@@ -275,12 +270,15 @@ static int qcom_osm_l3_probe(struct plat } data->num_nodes = num_nodes; + ret =icc_provider_register (provider); +if (ret) + goto err; +platform_set_drvdata (pdev, qp);return 0 ; err:icc_nodes_remove (provider); -icc_provider_del (provider);return ret; }
Greg Kroah-Hartman
maintainerPATCH 135/211 interconnect: qcom: rpm: fix probe child-node error handling
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit bc463201f60803fa6bf2741d59441031cd0910e4 upstream.
Make sure to clean up and release resources properly also in case probe fails when populating child devices.
--- drivers/interconnect/qcom/icc-rpm.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/interconnect/qcom/icc-rpm.c +5 -2
@@ -541,8 +541,11 @@ regmap_done:platform_set_drvdata (pdev, qp);/* Populate child NoC devices if any */ -if (of_get_child_count (dev->of_node) >0 ) -return of_platform_populate (dev->of_node,NULL ,NULL , dev); +if (of_get_child_count (dev->of_node) >0 ) { + ret =of_platform_populate (dev->of_node,NULL ,NULL , dev); +if (ret) + goto err; + }return 0 ; err:
Greg Kroah-Hartman
maintainerPATCH 136/211 interconnect: qcom: rpm: fix registration race
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 90ae93d8affc1061cd87ca8ddd9a838c7d31a158 upstream.
The current interconnect provider registration interface is inherently racy as nodes are not added until the after adding the provider. This can specifically cause racing DT lookups to fail.
Switch to using the new API where the provider is not registered until after it has been fully initialised.
--- drivers/interconnect/qcom/icc-rpm.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
drivers/interconnect/qcom/icc-rpm.c +12 -12
@@ -503,7 +503,6 @@ regmap_done: } provider = &qp->provider; -INIT_LIST_HEAD (&provider->nodes); provider->dev = dev; provider->set = qcom_icc_set; provider->pre_aggregate = qcom_icc_pre_bw_aggregate;
@@ -511,12 +510,7 @@ regmap_done: provider->xlate_extended = qcom_icc_xlate_extended; provider->data = data; - ret =icc_provider_add (provider); -if (ret) { -dev_err (dev,"error adding interconnect provider: %d\n" , ret); -clk_bulk_disable_unprepare (qp->num_clks, qp->bus_clks); -return ret; - } +icc_provider_init (provider);for (i =0 ; i < num_nodes; i++) {size_t j;
@@ -524,7 +518,7 @@ regmap_done: node =icc_node_create (qnodes[i]->id);if (IS_ERR (node)) { ret =PTR_ERR (node); - goto err; + goto err_remove_nodes; } node->name = qnodes[i]->name;
@@ -538,20 +532,26 @@ regmap_done: } data->num_nodes = num_nodes; + ret =icc_provider_register (provider); +if (ret) + goto err_remove_nodes; +platform_set_drvdata (pdev, qp);/* Populate child NoC devices if any */ if (of_get_child_count (dev->of_node) >0 ) { ret =of_platform_populate (dev->of_node,NULL ,NULL , dev);if (ret) - goto err; + goto err_deregister_provider; }return 0 ; -err: + +err_deregister_provider: +icc_provider_deregister (provider); +err_remove_nodes:icc_nodes_remove (provider);clk_bulk_disable_unprepare (qp->num_clks, qp->bus_clks); -icc_provider_del (provider);return ret; }
@@ -561,9 +561,9 @@ int qnoc_remove(struct platform_device * {struct qcom_icc_provider *qp =platform_get_drvdata (pdev); +icc_provider_deregister (&qp->provider);icc_nodes_remove (&qp->provider);clk_bulk_disable_unprepare (qp->num_clks, qp->bus_clks); -icc_provider_del (&qp->provider);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 137/211 interconnect: qcom: rpmh: fix probe child-node error handling
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 6570d1d46eeade82965ccc4a3ab7d778898ef4bf upstream.
Make sure to clean up and release resources properly also in case probe fails when populating child devices.
--- drivers/interconnect/qcom/icc-rpmh.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/interconnect/qcom/icc-rpmh.c +5 -2
@@ -235,8 +235,11 @@ int qcom_icc_rpmh_probe(struct platform_platform_set_drvdata (pdev, qp);/* Populate child NoC devices if any */ -if (of_get_child_count (dev->of_node) >0 ) -return of_platform_populate (dev->of_node,NULL ,NULL , dev); +if (of_get_child_count (dev->of_node) >0 ) { + ret =of_platform_populate (dev->of_node,NULL ,NULL , dev); +if (ret) + goto err; + }return 0 ; err:
Greg Kroah-Hartman
maintainerPATCH 138/211 interconnect: qcom: rpmh: fix registration race
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 74240a5bebd48d8b843c6d0f1acfaa722a5abeb7 upstream.
The current interconnect provider registration interface is inherently racy as nodes are not added until the after adding the provider. This can specifically cause racing DT lookups to fail.
Switch to using the new API where the provider is not registered until after it has been fully initialised.
--- drivers/interconnect/qcom/icc-rpmh.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-)
drivers/interconnect/qcom/icc-rpmh.c +15 -10
@@ -192,9 +192,10 @@ int qcom_icc_rpmh_probe(struct platform_ provider->pre_aggregate = qcom_icc_pre_aggregate; provider->aggregate = qcom_icc_aggregate; provider->xlate_extended = qcom_icc_xlate_extended; -INIT_LIST_HEAD (&provider->nodes); provider->data = data; +icc_provider_init (provider); + qp->dev = dev; qp->bcms = desc->bcms; qp->num_bcms = desc->num_bcms;
@@ -203,10 +204,6 @@ int qcom_icc_rpmh_probe(struct platform_if (IS_ERR (qp->voter))return PTR_ERR (qp->voter); - ret =icc_provider_add (provider); -if (ret) -return ret; -for (i =0 ; i < qp->num_bcms; i++)qcom_icc_bcm_init (qp->bcms[i], dev);
@@ -218,7 +215,7 @@ int qcom_icc_rpmh_probe(struct platform_ node =icc_node_create (qn->id);if (IS_ERR (node)) { ret =PTR_ERR (node); - goto err; + goto err_remove_nodes; } node->name = qn->name;
@@ -232,19 +229,27 @@ int qcom_icc_rpmh_probe(struct platform_ } data->num_nodes = num_nodes; + + ret =icc_provider_register (provider); +if (ret) + goto err_remove_nodes; +platform_set_drvdata (pdev, qp);/* Populate child NoC devices if any */ if (of_get_child_count (dev->of_node) >0 ) { ret =of_platform_populate (dev->of_node,NULL ,NULL , dev);if (ret) - goto err; + goto err_deregister_provider; }return 0 ; -err: + +err_deregister_provider: +icc_provider_deregister (provider); +err_remove_nodes:icc_nodes_remove (provider); -icc_provider_del (provider); +return ret; }EXPORT_SYMBOL_GPL (qcom_icc_rpmh_probe);
@@ -253,8 +258,8 @@ int qcom_icc_rpmh_remove(struct platform {struct qcom_icc_provider *qp =platform_get_drvdata (pdev); +icc_provider_deregister (&qp->provider);icc_nodes_remove (&qp->provider); -icc_provider_del (&qp->provider);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 139/211 interconnect: qcom: msm8974: fix registration race
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit bfe7bcd2b9f5215de2144f097f39971180e7ea54 upstream.
The current interconnect provider registration interface is inherently racy as nodes are not added until the after adding the provider. This can specifically cause racing DT lookups to fail.
Switch to using the new API where the provider is not registered until after it has been fully initialised.
--- drivers/interconnect/qcom/msm8974.c | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-)
drivers/interconnect/qcom/msm8974.c +8 -12
@@ -692,7 +692,6 @@ static int msm8974_icc_probe(struct platreturn ret; provider = &qp->provider; -INIT_LIST_HEAD (&provider->nodes); provider->dev = dev; provider->set = msm8974_icc_set; provider->aggregate = icc_std_aggregate;
@@ -700,11 +699,7 @@ static int msm8974_icc_probe(struct plat provider->data = data; provider->get_bw = msm8974_get_bw; - ret =icc_provider_add (provider); -if (ret) { -dev_err (dev,"error adding interconnect provider: %d\n" , ret); - goto err_disable_clks; - } +icc_provider_init (provider);for (i =0 ; i < num_nodes; i++) {size_t j;
@@ -712,7 +707,7 @@ static int msm8974_icc_probe(struct plat node =icc_node_create (qnodes[i]->id);if (IS_ERR (node)) { ret =PTR_ERR (node); - goto err_del_icc; + goto err_remove_nodes; } node->name = qnodes[i]->name;
@@ -729,15 +724,16 @@ static int msm8974_icc_probe(struct plat } data->num_nodes = num_nodes; + ret =icc_provider_register (provider); +if (ret) + goto err_remove_nodes; +platform_set_drvdata (pdev, qp);return 0 ; -err_del_icc: +err_remove_nodes:icc_nodes_remove (provider); -icc_provider_del (provider); - -err_disable_clks:clk_bulk_disable_unprepare (qp->num_clks, qp->bus_clks);return ret;
@@ -747,9 +743,9 @@ static int msm8974_icc_remove(struct pla {struct msm8974_icc_provider *qp =platform_get_drvdata (pdev); +icc_provider_deregister (&qp->provider);icc_nodes_remove (&qp->provider);clk_bulk_disable_unprepare (qp->num_clks, qp->bus_clks); -icc_provider_del (&qp->provider);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 140/211 interconnect: exynos: fix node leak in probe PM QoS error path
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 3aab264875bf3c915ea2517fae1eec213e0b4987 upstream.
Make sure to add the newly allocated interconnect node to the provider before adding the PM QoS request so that the node is freed on errors.
--- drivers/interconnect/samsung/exynos.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/interconnect/samsung/exynos.c +3 -3
@@ -149,6 +149,9 @@ static int exynos_generic_icc_probe(stru &priv->bus_clk_ratio)) priv->bus_clk_ratio =EXYNOS_ICC_DEFAULT_BUS_CLK_RATIO ; + icc_node->data = priv; +icc_node_add (icc_node, provider); +/* * Register a PM QoS request for the parent (devfreq) device. */
@@ -157,9 +160,6 @@ static int exynos_generic_icc_probe(struif (ret <0 ) goto err_node_del; - icc_node->data = priv; -icc_node_add (icc_node, provider); - icc_parent_node =exynos_icc_get_parent (bus_dev->of_node);if (IS_ERR (icc_parent_node)) { ret =PTR_ERR (icc_parent_node);
Greg Kroah-Hartman
maintainerPATCH 141/211 interconnect: exynos: fix registration race
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit c9e46ca612cfbb0cf890f7ae7389b742e90efe64 upstream.
The current interconnect provider registration interface is inherently racy as nodes are not added until the after adding the provider. This can specifically cause racing DT lookups to trigger a NULL-pointer deference when either a NULL pointer or not fully initialised node is returned from exynos_generic_icc_xlate().
Switch to using the new API where the provider is not registered until after it has been fully initialised.
--- drivers/interconnect/samsung/exynos.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
drivers/interconnect/samsung/exynos.c +10 -10
@@ -98,12 +98,13 @@ static int exynos_generic_icc_remove(strstruct exynos_icc_priv *priv =platform_get_drvdata (pdev);struct icc_node *parent_node, *node = priv->node; +icc_provider_deregister (&priv->provider); + parent_node =exynos_icc_get_parent (priv->dev->parent->of_node);if (parent_node && !IS_ERR (parent_node))icc_link_destroy (node, parent_node);icc_nodes_remove (&priv->provider); -icc_provider_del (&priv->provider);return 0 ; }
@@ -132,15 +133,11 @@ static int exynos_generic_icc_probe(stru provider->inter_set = true; provider->data = priv; - ret =icc_provider_add (provider); -if (ret <0 ) -return ret; +icc_provider_init (provider); icc_node =icc_node_create (pdev->id); -if (IS_ERR (icc_node)) { - ret =PTR_ERR (icc_node); - goto err_prov_del; - } +if (IS_ERR (icc_node)) +return PTR_ERR (icc_node); priv->node = icc_node; icc_node->name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%pOFn",
@@ -171,14 +168,17 @@ static int exynos_generic_icc_probe(stru goto err_pmqos_del; } + ret =icc_provider_register (provider); +if (ret <0 ) + goto err_pmqos_del; +return 0 ; err_pmqos_del:dev_pm_qos_remove_request (&priv->qos_req); err_node_del:icc_nodes_remove (provider); -err_prov_del: -icc_provider_del (provider); +return ret; }
Greg Kroah-Hartman
maintainerPATCH 142/211 md: select BLOCK_LEGACY_AUTOLOAD
In reply to Greg Kroah-HartmanFrom: NeilBrown <[email protected]>
commit 6c0f5898836c05c6d850a750ed7940ba29e4e6c5 upstream.
When BLOCK_LEGACY_AUTOLOAD is not enable, mdadm is not able to activate new arrays unless "CREATE names=yes" appears in mdadm.conf
As this is a regression we need to always enable BLOCK_LEGACY_AUTOLOAD for when MD is selected - at least until mdadm is updated and the updates widely available.
--- drivers/md/Kconfig | 4 ++++ 1 file changed, 4 insertions(+)
drivers/md/Kconfig +4 -0
@@ -16,6 +16,10 @@ if MD config BLK_DEV_MD tristate "RAID support" select BLOCK_HOLDER_DEPRECATED if SYSFS + # BLOCK_LEGACY_AUTOLOAD requirement should be removed + # after relevant mdadm enhancements - to make "names=yes" + # the default - are widely available. + select BLOCK_LEGACY_AUTOLOAD help This driver lets you combine several hard disk partitions into one logical block device. This can be used to simply append one
Greg Kroah-Hartman
maintainerPATCH 143/211 cifs: generate signkey for the channel thats reconnecting
In reply to Greg Kroah-HartmanFrom: Shyam Prasad N <[email protected]>
commit 05ce0448c3f36febd8db0ee0e9e16557f3ab5ee8 upstream.
Before my changes to how multichannel reconnects work, the primary channel was always used to do a non-binding session setup. With my changes, that is not the case anymore. Missed this place where channel at index 0 was forcibly updated with the signing key.
--- fs/cifs/smb2transport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/cifs/smb2transport.c +1 -1
@@ -425,7 +425,7 @@ generate_smb3signingkey(struct cifs_ses/* safe to access primary channel, since it will never go away */ spin_lock (&ses->chan_lock); -memcpy (ses->chans[0 ].signkey, ses->smb3signingkey, +memcpy (ses->chans[chan_index].signkey, ses->smb3signingkey,SMB3_SIGN_KEY_SIZE );spin_unlock (&ses->chan_lock);
Greg Kroah-Hartman
maintainerPATCH 144/211 tracing: Make splice_read available again
In reply to Greg Kroah-HartmanFrom: Sung-hun Kim <[email protected]>
commit e400be674a1a40e9dcb2e95f84d6c1fd2d88f31d upstream.
Since the commit 36e2c7421f02 ("fs: don't allow splice read/write without explicit ops") is applied to the kernel, splice() and sendfile() calls on the trace file (/sys/kernel/debug/tracing /trace) return EINVAL.
This patch restores these system calls by initializing splice_read in file_operations of the trace file. This patch only enables such functionalities for the read case.
--- kernel/trace/trace.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/trace/trace.c +2 -0
@@ -5119,6 +5119,8 @@ loff_t tracing_lseek(struct file *file,static const struct file_operations tracing_fops = { .open = tracing_open, .read = seq_read, + .read_iter = seq_read_iter, + .splice_read = generic_file_splice_read, .write = tracing_write_stub, .llseek = tracing_lseek, .release = tracing_release,
Greg Kroah-Hartman
maintainerPATCH 145/211 tracing: Do not let histogram values have some modifiers
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (Google) <[email protected]>
commit e0213434fe3e4a0d118923dc98d31e7ff1cd9e45 upstream.
Histogram values can not be strings, stacktraces, graphs, symbols, syscalls, or grouped in buckets or log. Give an error if a value is set to do so.
Note, the histogram code was not prepared to handle these modifiers for histograms and caused a bug.
Mark Rutland reported:
# echo 'p:copy_to_user __arch_copy_to_user n=$arg2' >> /sys/kernel/tracing/kprobe_events # echo 'hist:keys=n:vals=hitcount.buckets=8:sort=hitcount' > /sys/kernel/tracing/events/kprobes/copy_to_user/trigger # cat /sys/kernel/tracing/events/kprobes/copy_to_user/hist [ 143.694628] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 143.695190] Mem abort info: [ 143.695362] ESR = 0x0000000096000004 [ 143.695604] EC = 0x25: DABT (current EL), IL = 32 bits [ 143.695889] SET = 0, FnV = 0 [ 143.696077] EA = 0, S1PTW = 0 [ 143.696302] FSC = 0x04: level 0 translation fault [ 143.702381] Data abort info: [ 143.702614] ISV = 0, ISS = 0x00000004 [ 143.702832] CM = 0, WnR = 0 [ 143.703087] user pgtable: 4k pages, 48-bit VAs, pgdp=00000000448f9000 [ 143.703407] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 143.704137] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 143.704714] Modules linked in: [ 143.705273] CPU: 0 PID: 133 Comm: cat Not tainted 6.2.0-00003-g6fc512c10a7c #3 [ 143.706138] Hardware name: linux,dummy-virt (DT) [ 143.706723] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 143.707120] pc : hist_field_name.part.0+0x14/0x140 [ 143.707504] lr : hist_field_name.part.0+0x104/0x140 [ 143.707774] sp : ffff800008333a30 [ 143.707952] x29: ffff800008333a30 x28: 0000000000000001 x27: 0000000000400cc0 [ 143.708429] x26: ffffd7a653b20260 x25: 0000000000000000 x24: ffff10d303ee5800 [ 143.708776] x23: ffffd7a6539b27b0 x22: ffff10d303fb8c00 x21: 0000000000000001 [ 143.709127] x20: ffff10d303ec2000 x19: 0000000000000000 x18: 0000000000000000 [ 143.709478] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 143.709824] x14: 0000000000000000 x13: 203a6f666e692072 x12: 6567676972742023 [ 143.710179] x11: 0a230a6d6172676f x10: 000000000000002c x9 : ffffd7a6521e018c [ 143.710584] x8 : 000000000000002c x7 : 7f7f7f7f7f7f7f7f x6 : 000000000000002c [ 143.710915] x5 : ffff10d303b0103e x4 : ffffd7a653b20261 x3 : 000000000000003d [ 143.711239] x2 : 0000000000020001 x1 : 0000000000000001 x0 : 0000000000000000 [ 143.711746] Call trace: [ 143.712115] hist_field_name.part.0+0x14/0x140 [ 143.712642] hist_field_name.part.0+0x104/0x140 [ 143.712925] hist_field_print+0x28/0x140 [ 143.713125] event_hist_trigger_print+0x174/0x4d0 [ 143.713348] hist_show+0xf8/0x980 [ 143.713521] seq_read_iter+0x1bc/0x4b0 [ 143.713711] seq_read+0x8c/0xc4 [ 143.713876] vfs_read+0xc8/0x2a4 [ 143.714043] ksys_read+0x70/0xfc [ 143.714218] __arm64_sys_read+0x24/0x30 [ 143.714400] invoke_syscall+0x50/0x120 [ 143.714587] el0_svc_common.constprop.0+0x4c/0x100 [ 143.714807] do_el0_svc+0x44/0xd0 [ 143.714970] el0_svc+0x2c/0x84 [ 143.715134] el0t_64_sync_handler+0xbc/0x140 [ 143.715334] el0t_64_sync+0x190/0x194 [ 143.715742] Code: a9bd7bfd 910003fd a90153f3 aa0003f3 (f9400000) [ 143.716510] ---[ end trace 0000000000000000 ]--- Segmentation fault
--- kernel/trace/trace_events_hist.c | 9 +++++++++ 1 file changed, 9 insertions(+)
kernel/trace/trace_events_hist.c +9 -0
@@ -4199,6 +4199,15 @@ static int __create_val_field(struct his goto out; } +/* Some types cannot be a value */ +if (hist_field->flags & (HIST_FIELD_FL_GRAPH |HIST_FIELD_FL_PERCENT | +HIST_FIELD_FL_BUCKET |HIST_FIELD_FL_LOG2 | +HIST_FIELD_FL_SYM |HIST_FIELD_FL_SYM_OFFSET | +HIST_FIELD_FL_SYSCALL |HIST_FIELD_FL_STACKTRACE )) { +hist_err (file->tr,HIST_ERR_BAD_FIELD_MODIFIER ,errpos (field_str)); + ret = -EINVAL ; + } + hist_data->fields[val_idx] = hist_field; ++hist_data->n_vals;
Greg Kroah-Hartman
maintainerPATCH 146/211 tracing: Check field value in hist_field_name()
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (Google) <[email protected]>
commit 9f116f76fa8c04c81aef33ad870dbf9a158e5b70 upstream.
The function hist_field_name() cannot handle being passed a NULL field parameter. It should never be NULL, but due to a previous bug, NULL was passed to the function and the kernel crashed due to a NULL dereference. Mark Rutland reported this to me on IRC.
The bug was fixed, but to prevent future bugs from crashing the kernel, check the field and add a WARN_ON() if it is NULL.
--- kernel/trace/trace_events_hist.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/trace/trace_events_hist.c +3 -0
@@ -1334,6 +1334,9 @@ static const char *hist_field_name(struc {const char *field_name ="" ; +if (WARN_ON_ONCE (!field)) +return field_name; +if (level >1 )return field_name;
Greg Kroah-Hartman
maintainerPATCH 147/211 tracing: Make tracepoint lockdep check actually test something
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (Google) <[email protected]>
commit c2679254b9c9980d9045f0f722cf093a2b1f7590 upstream.
A while ago where the trace events had the following:
rcu_read_lock_sched_notrace(); rcu_dereference_sched(...); rcu_read_unlock_sched_notrace();
If the tracepoint is enabled, it could trigger RCU issues if called in the wrong place. And this warning was only triggered if lockdep was enabled. If the tracepoint was never enabled with lockdep, the bug would not be caught. To handle this, the above sequence was done when lockdep was enabled regardless if the tracepoint was enabled or not (although the always enabled code really didn't do anything, it would still trigger a warning).
But a lot has changed since that lockdep code was added. One is, that sequence no longer triggers any warning. Another is, the tracepoint when enabled doesn't even do that sequence anymore.
The main check we care about today is whether RCU is "watching" or not. So if lockdep is enabled, always check if rcu_is_watching() which will trigger a warning if it is not (tracepoints require RCU to be watching).
Note, that old sequence did add a bit of overhead when lockdep was enabled, and with the latest kernel updates, would cause the system to slow down enough to trigger kernel "stalled" warnings.
--- include/linux/tracepoint.h | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
include/linux/tracepoint.h +6 -9
@@ -231,12 +231,11 @@ static inline struct tracepoint *tracepo* not add unwanted padding between the beginning of the section and the * structure. Force alignment to the same alignment as the section start. * -* When lockdep is enabled, we make sure to always do the RCU portions of -* the tracepoint code, regardless of whether tracing is on. However, -* don't check if the condition is false, due to interaction with idle -* instrumentation. This lets us find RCU issues triggered with tracepoints -* even when this tracepoint is off. This code has no purpose other than -* poking RCU a bit. +* When lockdep is enabled, we make sure to always test if RCU is +* "watching" regardless if the tracepoint is enabled or not. Tracepoints +* require RCU to be active, and it should always warn at the tracepoint +* site if it is not watching, as it will need to be active when the +* tracepoint is enabled. */ #define __DECLARE_TRACE (name, proto, args, cond, data_proto) \ extern int __traceiter_##name(data_proto); \
@@ -249,9 +248,7 @@ static inline struct tracepoint *tracepoTP_ARGS (args), \ TP_CONDITION(cond), 0); \if (IS_ENABLED (CONFIG_LOCKDEP ) && (cond)) { \ -rcu_read_lock_sched_notrace (); \ - rcu_dereference_sched(__tracepoint_##name.funcs);\ - rcu_read_unlock_sched_notrace(); \ +WARN_ON_ONCE (!rcu_is_watching ()); \ } \ } \ __DECLARE_TRACE_RCU(name, PARAMS(proto), PARAMS(args), \
Greg Kroah-Hartman
maintainerPATCH 148/211 cifs: Fix smb2_set_path_size()
In reply to Greg Kroah-HartmanFrom: Volker Lendecke <[email protected]>
commit 211baef0eabf4169ce4f73ebd917749d1a7edd74 upstream.
If cifs_get_writable_path() finds a writable file, smb2_compound_op() must use that file's FID and not the COMPOUND_FID.
--- fs/cifs/smb2inode.c | 31 ++++++++++++++++++++++++------- 1 file changed, 24 insertions(+), 7 deletions(-)
fs/cifs/smb2inode.c +24 -7
@@ -234,15 +234,32 @@ static int smb2_compound_op(const unsign size[0 ] =8 ;/* sizeof __le64 */ data[0 ] = ptr; - rc =SMB2_set_info_init (tcon, server, - &rqst[num_rqst],COMPOUND_FID , -COMPOUND_FID , current->tgid, -FILE_END_OF_FILE_INFORMATION , -SMB2_O_INFO_FILE ,0 , data, size); +if (cfile) { + rc =SMB2_set_info_init (tcon, server, + &rqst[num_rqst], + cfile->fid.persistent_fid, + cfile->fid.volatile_fid, + current->tgid, +FILE_END_OF_FILE_INFORMATION , +SMB2_O_INFO_FILE ,0 , + data, size); + }else { + rc =SMB2_set_info_init (tcon, server, + &rqst[num_rqst], +COMPOUND_FID , +COMPOUND_FID , + current->tgid, +FILE_END_OF_FILE_INFORMATION , +SMB2_O_INFO_FILE ,0 , + data, size); +if (!rc) { +smb2_set_next_command (tcon, &rqst[num_rqst]); +smb2_set_related (&rqst[num_rqst]); + } + }if (rc) goto finished; -smb2_set_next_command (tcon, &rqst[num_rqst]); -smb2_set_related (&rqst[num_rqst++]); + num_rqst++;trace_smb3_set_eof_enter (xid, ses->Suid, tcon->tid, full_path);break ;case SMB2_OP_SET_INFO :
Greg Kroah-Hartman
maintainerPATCH 149/211 cifs: set DFS root session in cifs_get_smb_ses()
In reply to Greg Kroah-HartmanFrom: Paulo Alcantara <[email protected]>
commit b56bce502f55505a97e381d546ee881928183126 upstream.
Set the DFS root session pointer earlier when creating a new SMB session to prevent racing with smb2_reconnect(), cifs_reconnect_tcon() and DFS cache refresher.
--- fs/cifs/cifs_dfs_ref.c | 1 + fs/cifs/cifsglob.h | 1 - fs/cifs/connect.c | 1 + fs/cifs/dfs.c | 19 ++++++++----------- fs/cifs/dfs.h | 3 ++- fs/cifs/fs_context.h | 1 + 6 files changed, 13 insertions(+), 13 deletions(-)
fs/cifs/cifs_dfs_ref.c +1 -0
@@ -179,6 +179,7 @@ static struct vfsmount *cifs_dfs_do_auto tmp.source = full_path; tmp.leaf_fullpath =NULL ; tmp.UNC = tmp.prepath =NULL ; + tmp.dfs_root_ses =NULL ; rc =smb3_fs_context_dup (ctx, &tmp);if (rc) {
fs/cifs/cifsglob.h +0 -1
@@ -1767,7 +1767,6 @@ struct cifs_mount_ctx {struct TCP_Server_Info *server;struct cifs_ses *ses;struct cifs_tcon *tcon; -struct cifs_ses *root_ses;uuid_t mount_id;char *origin_fullpath, *leaf_fullpath; };
fs/cifs/connect.c +1 -0
@@ -2278,6 +2278,7 @@ cifs_get_smb_ses(struct TCP_Server_Info* need to lock before changing something in the session. */ spin_lock (&cifs_tcp_ses_lock); + ses->dfs_root_ses = ctx->dfs_root_ses;list_add (&ses->smb_ses_list, &server->smb_ses_list);spin_unlock (&cifs_tcp_ses_lock);
fs/cifs/dfs.c +8 -11
@@ -95,25 +95,22 @@ static int get_session(struct cifs_mount ctx->leaf_fullpath = (char *)full_path; rc =cifs_mount_get_session (mnt_ctx); ctx->leaf_fullpath =NULL ; -if (!rc) { -struct cifs_ses *ses = mnt_ctx->ses; -mutex_lock (&ses->session_mutex); - ses->dfs_root_ses = mnt_ctx->root_ses; -mutex_unlock (&ses->session_mutex); - }return rc; }static void set_root_ses (struct cifs_mount_ctx *mnt_ctx) { -if (mnt_ctx->ses) { +struct smb3_fs_context *ctx = mnt_ctx->fs_ctx; +struct cifs_ses *ses = mnt_ctx->ses; + +if (ses) {spin_lock (&cifs_tcp_ses_lock); - mnt_ctx->ses->ses_count++; + ses->ses_count++;spin_unlock (&cifs_tcp_ses_lock); -dfs_cache_add_refsrv_session (&mnt_ctx->mount_id, mnt_ctx->ses); +dfs_cache_add_refsrv_session (&mnt_ctx->mount_id, ses); } - mnt_ctx->root_ses = mnt_ctx->ses; + ctx->dfs_root_ses = mnt_ctx->ses; } static int get_dfs_conn(struct cifs_mount_ctx *mnt_ctx, const char *ref_path, const char *full_path,
@@ -260,7 +257,7 @@ int dfs_mount_share(struct cifs_mount_ct rc =get_session (mnt_ctx,NULL );if (rc)return rc; - mnt_ctx->root_ses = mnt_ctx->ses; + ctx->dfs_root_ses = mnt_ctx->ses;/* * If called with 'nodfs' mount option, then skip DFS resolving. Otherwise unconditionally * try to get an DFS referral (even cached) to determine whether it is an DFS mount.
fs/cifs/dfs.h +2 -1
@@ -22,9 +22,10 @@ static inline char *dfs_get_path(structstatic inline int dfs_get_referral (struct cifs_mount_ctx *mnt_ctx,const char *path,struct dfs_info3_param *ref,struct dfs_cache_tgt_list *tl) { +struct smb3_fs_context *ctx = mnt_ctx->fs_ctx;struct cifs_sb_info *cifs_sb = mnt_ctx->cifs_sb; -return dfs_cache_find (mnt_ctx->xid, mnt_ctx->root_ses, cifs_sb->local_nls, +return dfs_cache_find (mnt_ctx->xid, ctx->dfs_root_ses, cifs_sb->local_nls,cifs_remap (cifs_sb), path, ref, tl); }
fs/cifs/fs_context.h +1 -0
@@ -265,6 +265,7 @@ struct smb3_fs_context { bool rootfs:1; /* if it's a SMB root file system */ bool witness:1; /* use witness protocol */char *leaf_fullpath; +struct cifs_ses *dfs_root_ses; };extern const struct fs_parameter_spec smb3_fs_parameters[];
Greg Kroah-Hartman
maintainerPATCH 150/211 cifs: fix use-after-free bug in refresh_cache_worker()
In reply to Greg Kroah-HartmanFrom: Paulo Alcantara <[email protected]>
commit 396935de145589c8bfe552fa03a5e38604071829 upstream.
The UAF bug occurred because we were putting DFS root sessions in cifs_umount() while DFS cache refresher was being executed.
Make DFS root sessions have same lifetime as DFS tcons so we can avoid the use-after-free bug is DFS cache refresher and other places that require IPCs to get new DFS referrals on. Also, get rid of mount group handling in DFS cache as we no longer need it.
This fixes below use-after-free bug catched by KASAN
[ 379.946955] BUG: KASAN: use-after-free in __refresh_tcon.isra.0+0x10b/0xc10 [cifs] [ 379.947642] Read of size 8 at addr ffff888018f57030 by task kworker/u4:3/56 [ 379.948096] [ 379.948208] CPU: 0 PID: 56 Comm: kworker/u4:3 Not tainted 6.2.0-rc7-lku #23 [ 379.948661] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552-rebuilt.opensuse.org 04/01/2014 [ 379.949368] Workqueue: cifs-dfscache refresh_cache_worker [cifs] [ 379.949942] Call Trace: [ 379.950113] <TASK> [ 379.950260] dump_stack_lvl+0x50/0x67 [ 379.950510] print_report+0x16a/0x48e [ 379.950759] ? __virt_addr_valid+0xd8/0x160 [ 379.951040] ? __phys_addr+0x41/0x80 [ 379.951285] kasan_report+0xdb/0x110 [ 379.951533] ? __refresh_tcon.isra.0+0x10b/0xc10 [cifs] [ 379.952056] ? __refresh_tcon.isra.0+0x10b/0xc10 [cifs] [ 379.952585] __refresh_tcon.isra.0+0x10b/0xc10 [cifs] [ 379.953096] ? __pfx___refresh_tcon.isra.0+0x10/0x10 [cifs] [ 379.953637] ? __pfx___mutex_lock+0x10/0x10 [ 379.953915] ? lock_release+0xb6/0x720 [ 379.954167] ? __pfx_lock_acquire+0x10/0x10 [ 379.954443] ? refresh_cache_worker+0x34e/0x6d0 [cifs] [ 379.954960] ? __pfx_wb_workfn+0x10/0x10 [ 379.955239] refresh_cache_worker+0x4ad/0x6d0 [cifs] [ 379.955755] ? __pfx_refresh_cache_worker+0x10/0x10 [cifs] [ 379.956323] ? __pfx_lock_acquired+0x10/0x10 [ 379.956615] ? read_word_at_a_time+0xe/0x20 [ 379.956898] ? lockdep_hardirqs_on_prepare+0x12/0x220 [ 379.957235] process_one_work+0x535/0x990 [ 379.957509] ? __pfx_process_one_work+0x10/0x10 [ 379.957812] ? lock_acquired+0xb7/0x5f0 [ 379.958069] ? __list_add_valid+0x37/0xd0 [ 379.958341] ? __list_add_valid+0x37/0xd0 [ 379.958611] worker_thread+0x8e/0x630 [ 379.958861] ? __pfx_worker_thread+0x10/0x10 [ 379.959148] kthread+0x17d/0x1b0 [ 379.959369] ? __pfx_kthread+0x10/0x10 [ 379.959630] ret_from_fork+0x2c/0x50 [ 379.959879] </TASK>
--- fs/cifs/cifs_fs_sb.h | 2 fs/cifs/cifsglob.h | 3 - fs/cifs/connect.c | 9 +-- fs/cifs/dfs.c | 52 ++++++++++++++---- fs/cifs/dfs.h | 16 +++++ fs/cifs/dfs_cache.c | 140 --------------------------------------------------- fs/cifs/dfs_cache.h | 2 fs/cifs/misc.c | 7 ++ 8 files changed, 67 insertions(+), 164 deletions(-)
fs/cifs/cifs_fs_sb.h +0 -2
@@ -61,8 +61,6 @@ struct cifs_sb_info {/* only used when CIFS_MOUNT_USE_PREFIX_PATH is set */ char *prepath; -/* randomly generated 128-bit number for indexing dfs mount groups in referral cache */ -uuid_t dfs_mount_id;/* * Indicate whether serverino option was turned off later * (cifs_autodisable_serverino) in order to match new mounts.
fs/cifs/cifsglob.h +2 -1
@@ -1239,6 +1239,7 @@ struct cifs_tcon {/* BB add field for back pointer to sb struct(s)? */ #ifdef CONFIG_CIFS_DFS_UPCALL struct list_head ulist;/* cache update list */ +struct list_head dfs_ses_list;#endif struct delayed_work query_interfaces;/* query interfaces workqueue job */ };
@@ -1767,8 +1768,8 @@ struct cifs_mount_ctx {struct TCP_Server_Info *server;struct cifs_ses *ses;struct cifs_tcon *tcon; -uuid_t mount_id;char *origin_fullpath, *leaf_fullpath; +struct list_head dfs_ses_list; };static inline void free_dfs_info_param (struct dfs_info3_param *param)
fs/cifs/connect.c +3 -6
@@ -3457,7 +3457,8 @@ int cifs_mount(struct cifs_sb_info *cifsbool isdfs;int rc; -uuid_gen (&mnt_ctx.mount_id); +INIT_LIST_HEAD (&mnt_ctx.dfs_ses_list); + rc =dfs_mount_share (&mnt_ctx, &isdfs);if (rc) goto error;
@@ -3477,7 +3478,6 @@ int cifs_mount(struct cifs_sb_info *cifskfree (cifs_sb->prepath); cifs_sb->prepath = ctx->prepath; ctx->prepath =NULL ; -uuid_copy (&cifs_sb->dfs_mount_id, &mnt_ctx.mount_id); out:cifs_try_adding_channels (cifs_sb, mnt_ctx.ses);
@@ -3489,7 +3489,7 @@ out:return rc; error: -dfs_cache_put_refsrv_sessions (&mnt_ctx.mount_id); +dfs_put_root_smb_sessions (&mnt_ctx.dfs_ses_list);kfree (mnt_ctx.origin_fullpath);kfree (mnt_ctx.leaf_fullpath);cifs_mount_put_conns (&mnt_ctx);
@@ -3687,9 +3687,6 @@ cifs_umount(struct cifs_sb_info *cifs_sbspin_unlock (&cifs_sb->tlink_tree_lock);kfree (cifs_sb->prepath); -#ifdef CONFIG_CIFS_DFS_UPCALL -dfs_cache_put_refsrv_sessions (&cifs_sb->dfs_mount_id); -#endif call_rcu (&cifs_sb->rcu, delayed_free); }
fs/cifs/dfs.c +39 -13
110 lines not on this page · raw message
fs/cifs/dfs.h +16 -0
@@ -10,6 +10,11 @@#include "fs_context.h" #include "cifs_unicode.h" +struct dfs_root_ses { +struct list_head list; +struct cifs_ses *ses; +}; +int dfs_parse_target_referral (const char *full_path,const struct dfs_info3_param *ref,struct smb3_fs_context *ctx);int dfs_mount_share (struct cifs_mount_ctx *mnt_ctx,bool *isdfs);
@@ -44,4 +49,15 @@ static inline char *dfs_get_automount_de true); } +static inline void dfs_put_root_smb_sessions (struct list_head *head) +{ +struct dfs_root_ses *root, *tmp; + +list_for_each_entry_safe (root, tmp, head, list) { +list_del_init (&root->list); +cifs_put_smb_ses (root->ses); +kfree (root); + } +} +#endif /* _CIFS_DFS_H */
fs/cifs/dfs_cache.c +0 -140
174 lines not on this page · raw message
fs/cifs/dfs_cache.h +0 -2
@@ -40,8 +40,6 @@ int dfs_cache_get_tgt_referral(const cha struct dfs_info3_param *ref);int dfs_cache_get_tgt_share (char *path,const struct dfs_cache_tgt_iterator *it,char **share,char **prefix); -void dfs_cache_put_refsrv_sessions (const uuid_t *mount_id); -void dfs_cache_add_refsrv_session (const uuid_t *mount_id,struct cifs_ses *ses);char *dfs_cache_canonical_path (const char *path,const struct nls_table *cp,int remap);int dfs_cache_remount_fs (struct cifs_sb_info *cifs_sb);
fs/cifs/misc.c +7 -0
@@ -22,6 +22,7 @@#ifdef CONFIG_CIFS_DFS_UPCALL #include "dns_resolve.h" #include "dfs_cache.h" +#include "dfs.h" #endif #include "fs_context.h" #include "cached_dir.h"
@@ -134,6 +135,9 @@ tconInfoAlloc(void)spin_lock_init (&ret_buf->stat_lock);atomic_set (&ret_buf->num_local_opens,0 );atomic_set (&ret_buf->num_remote_opens,0 ); +#ifdef CONFIG_CIFS_DFS_UPCALL +INIT_LIST_HEAD (&ret_buf->dfs_ses_list); +#endif return ret_buf; }
@@ -149,6 +153,9 @@ tconInfoFree(struct cifs_tcon *tcon)atomic_dec (&tconInfoAllocCount);kfree (tcon->nativeFileSystem);kfree_sensitive (tcon->password); +#ifdef CONFIG_CIFS_DFS_UPCALL +dfs_put_root_smb_sessions (&tcon->dfs_ses_list); +#endif kfree (tcon); }
Greg Kroah-Hartman
maintainerPATCH 151/211 cifs: return DFS root session id in DebugData
In reply to Greg Kroah-HartmanFrom: Paulo Alcantara <[email protected]>
commit f446a630802f154ef0087771683bd4f8e9d08384 upstream.
Return the DFS root session id in /proc/fs/cifs/DebugData to make it easier to track which IPC tcon was used to get new DFS referrals for a specific connection, and aids in debugging.
A simple output of it would be
Sessions:
1) Address: 192.168.1.13 Uses: 1 Capability: 0x300067 Session Status: 1
Security type: RawNTLMSSP SessionId: 0xd80000000009
User: 0 Cred User: 0
DFS root session id: 0x128006c000035
--- fs/cifs/cifs_debug.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/cifs/cifs_debug.c +5 -0
@@ -419,6 +419,11 @@ skip_rdma:from_kuid (&init_user_ns, ses->linux_uid), from_kuid(&init_user_ns, ses->cred_uid)); +if (ses->dfs_root_ses) { +seq_printf (m,"\n\tDFS root session id: 0x%llx" , + ses->dfs_root_ses->Suid); + } +spin_lock (&ses->chan_lock);if (CIFS_CHAN_NEEDS_RECONNECT (ses,0 ))seq_puts (m,"\tPrimary channel: DISCONNECTED " );
Greg Kroah-Hartman
maintainerPATCH 152/211 cifs: use DFS root session instead of tcon ses
In reply to Greg Kroah-HartmanFrom: Paulo Alcantara <[email protected]>
commit 6284e46bdd47743a064fe6ac834a7ac05b1fd206 upstream.
Use DFS root session whenever possible to get new DFS referrals otherwise we might end up with an IPC tcon (tcon->ses->tcon_ipc) that doesn't respond to them. It should be safe accessing @ses->dfs_root_ses directly in cifs_inval_name_dfs_link_error() as it has same lifetime as of @tcon.
--- fs/cifs/misc.c | 1 + 1 file changed, 1 insertion(+)
fs/cifs/misc.c +1 -0
@@ -1364,6 +1364,7 @@ int cifs_inval_name_dfs_link_error(const* removing cached DFS targets that the client would eventually * need during failover. */ + ses =CIFS_DFS_ROOT_SES (ses);if (ses->server->ops->get_dfs_refer && !ses->server->ops->get_dfs_refer(xid, ses, ref_path, &refs, &num_refs, cifs_sb->local_nls,
Greg Kroah-Hartman
maintainerPATCH 153/211 KVM: SVM: Fix a benign off-by-one bug in AVIC physical table mask
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 3ec7a1b2743c07c45f4a0c508114f6cb410ddef3 upstream.
Define the "physical table max index mask" as bits 8:0, not 9:0. x2AVIC currently supports a max of 512 entries, i.e. the max index is 511, and the inputs to GENMASK_ULL() are inclusive. The bug is benign as bit 9 is reserved and never set by KVM, i.e. KVM is just clearing bits that are guaranteed to be zero.
Note, as of this writing, APM "Rev. 3.39-October 2022" incorrectly states that bits 11:8 are reserved in Table B-1. VMCB Layout, Control Area. I.e. that table wasn't updated when x2AVIC support was added.
Opportunistically fix the comment for the max AVIC ID to align with the code, and clean up comment formatting too.
Message-Id: <[email protected]>
--- arch/x86/include/asm/svm.h | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
arch/x86/include/asm/svm.h +7 -5
@@ -261,20 +261,22 @@ enum avic_ipi_failure_cause { AVIC_IPI_FAILURE_INVALID_BACKING_PAGE, }; -#define AVIC_PHYSICAL_MAX_INDEX_MASK GENMASK_ULL(9, 0) +#define AVIC_PHYSICAL_MAX_INDEX_MASK GENMASK_ULL(8, 0)/* -* For AVIC, the max index allowed for physical APIC ID -* table is 0xff (255). +* For AVIC, the max index allowed for physical APIC ID table is 0xfe (254), as +* 0xff is a broadcast to all CPUs, i.e. can't be targeted individually. */ #define AVIC_MAX_PHYSICAL_ID 0XFEULL/* -* For x2AVIC, the max index allowed for physical APIC ID -* table is 0x1ff (511). +* For x2AVIC, the max index allowed for physical APIC ID table is 0x1ff (511). */ #define X2AVIC_MAX_PHYSICAL_ID 0x1FFUL +static_assert ((AVIC_MAX_PHYSICAL_ID &AVIC_PHYSICAL_MAX_INDEX_MASK ) ==AVIC_MAX_PHYSICAL_ID ); +static_assert ((X2AVIC_MAX_PHYSICAL_ID &AVIC_PHYSICAL_MAX_INDEX_MASK ) ==X2AVIC_MAX_PHYSICAL_ID ); +#define AVIC_HPA_MASK ~((0xFFFULL << 52) | 0xFFF)#define VMCB_AVIC_APIC_BAR_MASK 0xFFFFFFFFFF000ULL
Greg Kroah-Hartman
maintainerPATCH 154/211 KVM: SVM: Modify AVIC GATag to support max number of 512 vCPUs
In reply to Greg Kroah-HartmanFrom: Suravee Suthikulpanit <[email protected]>
commit 5999715922c5a3ede5d8fe2a6b17aba58a157d41 upstream.
Define AVIC_VCPU_ID_MASK based on AVIC_PHYSICAL_MAX_INDEX, i.e. the mask that effectively controls the largest guest physical APIC ID supported by x2AVIC, instead of hardcoding the number of bits to 8 (and the number of VM bits to 24).
The AVIC GATag is programmed into the AMD IOMMU IRTE to provide a reference back to KVM in case the IOMMU cannot inject an interrupt into a non-running vCPU. In such a case, the IOMMU notifies software by creating a GALog entry with the corresponded GATag, and KVM then uses the GATag to find the correct VM+vCPU to kick. Dropping bit 8 from the GATag results in kicking the wrong vCPU when targeting vCPUs with x2APIC ID > 255.
Message-Id: <[email protected]>
--- arch/x86/kvm/svm/avic.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-)
arch/x86/kvm/svm/avic.c +18 -8
@@ -27,19 +27,29 @@#include "irq.h" #include "svm.h" -/* AVIC GATAG is encoded using VM and VCPU IDs */ -#define AVIC_VCPU_ID_BITS 8 -#define AVIC_VCPU_ID_MASK ((1 << AVIC_VCPU_ID_BITS) - 1) +/* +* Encode the arbitrary VM ID and the vCPU's default APIC ID, i.e the vCPU ID, +* into the GATag so that KVM can retrieve the correct vCPU from a GALog entry +* if an interrupt can't be delivered, e.g. because the vCPU isn't running. +* +* For the vCPU ID, use however many bits are currently allowed for the max +* guest physical APIC ID (limited by the size of the physical ID table), and +* use whatever bits remain to assign arbitrary AVIC IDs to VMs. Note, the +* size of the GATag is defined by hardware (32 bits), but is an opaque value +* as far as hardware is concerned. +*/ +#define AVIC_VCPU_ID_MASK AVIC_PHYSICAL_MAX_INDEX_MASK -#define AVIC_VM_ID_BITS 24 -#define AVIC_VM_ID_NR (1 << AVIC_VM_ID_BITS) -#define AVIC_VM_ID_MASK ((1 << AVIC_VM_ID_BITS) - 1) +#define AVIC_VM_ID_SHIFT HWEIGHT32(AVIC_PHYSICAL_MAX_INDEX_MASK) +#define AVIC_VM_ID_MASK (GENMASK(31, AVIC_VM_ID_SHIFT) >> AVIC_VM_ID_SHIFT) -#define AVIC_GATAG (x, y) (((x & AVIC_VM_ID_MASK) << AVIC_VCPU_ID_BITS) | \ +#define AVIC_GATAG (x, y) (((x & AVIC_VM_ID_MASK) << AVIC_VM_ID_SHIFT) | \ (y & AVIC_VCPU_ID_MASK)) -#define AVIC_GATAG_TO_VMID (x) ((x >> AVIC_VCPU_ID_BITS) & AVIC_VM_ID_MASK) +#define AVIC_GATAG_TO_VMID (x) ((x >> AVIC_VM_ID_SHIFT) & AVIC_VM_ID_MASK)#define AVIC_GATAG_TO_VCPUID (x) (x & AVIC_VCPU_ID_MASK) +static_assert (AVIC_GATAG (AVIC_VM_ID_MASK ,AVIC_VCPU_ID_MASK ) ==-1u ); +static bool force_avic;module_param_unsafe (force_avic, bool,0444 );
Greg Kroah-Hartman
maintainerPATCH 155/211 KVM: nVMX: add missing consistency checks for CR0 and CR4
In reply to Greg Kroah-HartmanFrom: Paolo Bonzini <[email protected]>
commit 112e66017bff7f2837030f34c2bc19501e9212d5 upstream.
The effective values of the guest CR0 and CR4 registers may differ from those included in the VMCS12. In particular, disabling EPT forces CR4.PAE=1 and disabling unrestricted guest mode forces CR0.PG=CR0.PE=1.
Therefore, checks on these bits cannot be delegated to the processor and must be performed by KVM.
--- arch/x86/kvm/vmx/nested.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
arch/x86/kvm/vmx/nested.c +8 -2
@@ -3021,7 +3021,7 @@ static int nested_vmx_check_guest_state(struct vmcs12 *vmcs12, enum vm_entry_failure_code *entry_failure_code) { - bool ia32e; + bool ia32e = !!(vmcs12->vm_entry_controls & VM_ENTRY_IA32E_MODE); *entry_failure_code =ENTRY_FAIL_DEFAULT ;
@@ -3047,6 +3047,13 @@ static int nested_vmx_check_guest_state( vmcs12->guest_ia32_perf_global_ctrl)))return -EINVAL ; +if (CC ((vmcs12->guest_cr0 & (X86_CR0_PG |X86_CR0_PE )) ==X86_CR0_PG )) +return -EINVAL ; + +if (CC (ia32e && !(vmcs12->guest_cr4 &X86_CR4_PAE )) || +CC (ia32e && !(vmcs12->guest_cr0 &X86_CR0_PG ))) +return -EINVAL ; +/* * If the load IA32_EFER VM-entry control is 1, the following checks * are performed on the field for the IA32_EFER MSR:
@@ -3058,7 +3065,6 @@ static int nested_vmx_check_guest_state(*/ if (to_vmx(vcpu)->nested.nested_run_pending && (vmcs12->vm_entry_controls & VM_ENTRY_LOAD_IA32_EFER)) { - ia32e = (vmcs12->vm_entry_controls & VM_ENTRY_IA32E_MODE) != 0; if (CC(!kvm_valid_efer(vcpu, vmcs12->guest_ia32_efer)) || CC(ia32e != !!(vmcs12->guest_ia32_efer & EFER_LMA)) || CC(((vmcs12->guest_cr0 & X86_CR0_PG) &&
Greg Kroah-Hartman
maintainerPATCH 156/211 ALSA: hda: intel-dsp-config: add MTL PCI id
In reply to Greg Kroah-HartmanFrom: Bard Liao <[email protected]>
commit bbdf904b13a62bb8b1272d92a7dde082dff86fbb upstream.
Use SOF as default audio driver.
--- sound/hda/intel-dsp-config.c | 9 +++++++++ 1 file changed, 9 insertions(+)
sound/hda/intel-dsp-config.c +9 -0
@@ -472,6 +472,15 @@ static const struct config_entry config_ },#endif +/* Meteor Lake */ +#if IS_ENABLED (CONFIG_SND_SOC_SOF_METEORLAKE ) +/* Meteorlake-P */ + { + .flags = FLAG_SOF | FLAG_SOF_ONLY_IF_DMIC_OR_SOUNDWIRE, + .device = 0x7e28, + }, +#endif + };static const struct config_entry *snd_intel_dsp_find_config
Greg Kroah-Hartman
maintainerPATCH 157/211 ALSA: hda/realtek: Fix the speaker output on Samsung Galaxy Book2 Pro
In reply to Greg Kroah-HartmanFrom: Hamidreza H. Fard <[email protected]>
commit a86e79e3015f5dd8e1b01ccfa49bd5c6e41047a1 upstream.
Samsung Galaxy Book2 Pro (13" 2022 NP930XED-KA1DE) with codec SSID 144d:c868 requires the same workaround for enabling the speaker amp like other Samsung models with ALC298 code.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -9538,6 +9538,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x144d ,0xc830 ,"Samsung Galaxy Book Ion (NT950XCJ-X716A)" ,ALC298_FIXUP_SAMSUNG_AMP ),SND_PCI_QUIRK (0x144d ,0xc832 ,"Samsung Galaxy Book Flex Alpha (NP730QCJ)" ,ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET ),SND_PCI_QUIRK (0x144d ,0xca03 ,"Samsung Galaxy Book2 Pro 360 (NP930QED)" ,ALC298_FIXUP_SAMSUNG_AMP ), +SND_PCI_QUIRK (0x144d ,0xc868 ,"Samsung Galaxy Book2 Pro (NP930XED)" ,ALC298_FIXUP_SAMSUNG_AMP ),SND_PCI_QUIRK (0x1458 ,0xfa53 ,"Gigabyte BXBT-2807" ,ALC283_FIXUP_HEADSET_MIC ),SND_PCI_QUIRK (0x1462 ,0xb120 ,"MSI Cubi MS-B120" ,ALC283_FIXUP_HEADSET_MIC ), SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC),
Greg Kroah-Hartman
maintainerPATCH 158/211 ALSA: hda/realtek: fix speaker, mute/micmute LEDs not work on a HP platform
In reply to Greg Kroah-HartmanFrom: Jeremy Szu <[email protected]>
commit 7bb62340951a9af20235a3bde8c98e2e292915df upstream.
There is a HP platform needs ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED quirk to make mic-mute/audio-mute/speaker working.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -9446,6 +9446,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x103c ,0x8b8a ,"HP" ,ALC236_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8b8b ,"HP" ,ALC236_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8b8d ,"HP" ,ALC236_FIXUP_HP_GPIO_LED ), +SND_PCI_QUIRK (0x103c ,0x8b8f ,"HP" ,ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8b92 ,"HP" ,ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8bf0 ,"HP" ,ALC236_FIXUP_HP_GPIO_LED ), SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),