5.10.177-rc1 review
Subsystems (7)
Greg Kroah-Hartman
maintainercover 5.10.177-rc1 review
This is the start of the stable review cycle for the 5.10.177 release. There are 173 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 05 Apr 2023 14:03:18 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.177-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.10.177-rc1
Matthieu Baerts <[email protected]>
hsr: ratelimit only when errors are printed
Andreas Gruenbacher <[email protected]>
gfs2: Always check inode size of inline inodes
Ye Bin <[email protected]>
ext4: fix kernel BUG in 'ext4_write_inline_data_end()'
Andrii Nakryiko <[email protected]>
libbpf: Fix btf_dump's packed struct determination
Andrii Nakryiko <[email protected]>
selftests/bpf: Add few corner cases to test padding handling of btf_dump
Andrii Nakryiko <[email protected]>
libbpf: Fix BTF-to-C converter's padding logic
Eduard Zingerman <[email protected]>
selftests/bpf: Test btf dump for struct with padding only fields
Damien Le Moal <[email protected]>
zonefs: Fix error message in zonefs_file_dio_append()
Anand Jain <[email protected]>
btrfs: scan device in non-exclusive mode
Heiko Carstens <[email protected]>
s390/uaccess: add missing earlyclobber annotations to __clear_user()
Fangzhi Zuo <[email protected]>
drm/amd/display: Add DSC Support for Synaptics Cascaded MST Hub
Lucas Stach <[email protected]>
drm/etnaviv: fix reference leak when mmaping imported buffer
Douglas Raillard <[email protected]>
rcu: Fix rcu_torture_read ftrace event
Max Filippov <[email protected]>
xtensa: fix KASAN report for show_stack
huangwenhui <[email protected]>
ALSA: hda/realtek: Add quirk for Lenovo ZhaoYang CF4620Z
Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix regression on detection of Roland VS-100
Takashi Iwai <[email protected]>
ALSA: hda/conexant: Partial revert of a quirk for Lenovo
Trond Myklebust <[email protected]>
NFSv4: Fix hangs when recovering open state after a server reboot
Jens Axboe <[email protected]>
powerpc: Don't try to copy PPR for task with NULL pt_regs
Johan Hovold <[email protected]>
pinctrl: at91-pio4: fix domain name assignment
Kornel Dulęba <[email protected]>
pinctrl: amd: Disable and mask interrupts on resume
Josua Mayer <[email protected]>
net: phy: dp83869: fix default value for tx-/rx-internal-delay
Juergen Gross <[email protected]>
xen/netback: don't do grant copy across page boundary
Filipe Manana <[email protected]>
btrfs: fix race between quota disable and quota assign ioctls
Hans de Goede <[email protected]>
Input: goodix - add Lenovo Yoga Book X90F to nine_bytes_report DMI table
David Disseldorp <[email protected]>
cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL
Paulo Alcantara <[email protected]>
cifs: prevent infinite recursion in CIFSGetDFSRefer()
Jason A. Donenfeld <[email protected]>
Input: focaltech - use explicitly signed char type
msizanoen <[email protected]>
Input: alps - fix compatibility with -funsigned-char
Horatiu Vultur <[email protected]>
pinctrl: ocelot: Fix alt mode for ocelot
Steffen Bätz <[email protected]>
net: dsa: mv88e6xxx: Enable IGMP snooping on user ports only
Michael Chan <[email protected]>
bnxt_en: Add missing 200G link speed reporting
Kalesh AP <[email protected]>
bnxt_en: Fix typo in PCI id to device description string mapping
Radoslaw Tyl <[email protected]>
i40e: fix registers dump after run ethtool adapter self test
Alex Elder <[email protected]>
net: ipa: compute DMA pool size properly
Tasos Sahanidis <[email protected]>
ALSA: ymfpci: Fix BUG_ON in probe function
Takashi Iwai <[email protected]>
ALSA: ymfpci: Fix assignment in if condition
Tony Krowiak <[email protected]>
s390/vfio-ap: fix memory leak in vfio_ap device driver
Ivan Orlov <[email protected]>
can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write
Vladimir Oltean <[email protected]>
net: stmmac: don't reject VLANs when IFF_PROMISC is set
Faicker Mo <[email protected]>
net/net_failover: fix txq exceeding warning
Christophe JAILLET <[email protected]>
regulator: Handle deferred clk
ChunHao Lin <[email protected]>
r8169: fix RTL8168H and RTL8107E rx crc error
SongJingyi <[email protected]>
ptp_qoriq: fix memory leak in probe()
Tomas Henzl <[email protected]>
scsi: megaraid_sas: Fix crash after a double completion
Íñigo Huguet <[email protected]>
sfc: ef10: don't overwrite offload features at NIC reset
Arseniy Krasnov <[email protected]>
mtd: rawnand: meson: invalidate cache on polling ECC bit
Álvaro Fernández Rojas <[email protected]>
mips: bmips: BCM6358: disable RAC flush for TP1
Harshit Mogalapalli <[email protected]>
ca8210: Fix unsigned mac_len comparison with zero in ca8210_skb_tx()
Anton Gusev <[email protected]>
tracing: Fix wrong return in kprobe_event_gen_test.c
Prarit Bhargava <[email protected]>
tools/power turbostat: Fix /dev/cpu_dma_latency warnings
Wei Chen <[email protected]>
fbdev: au1200fb: Fix potential divide by zero
Wei Chen <[email protected]>
fbdev: lxfb: Fix potential divide by zero
Wei Chen <[email protected]>
fbdev: intelfb: Fix potential divide by zero
Wei Chen <[email protected]>
fbdev: nvidia: Fix potential divide by zero
Linus Torvalds <[email protected]>
sched_getaffinity: don't assume 'cpumask_size()' is fully initialized
Wei Chen <[email protected]>
fbdev: tgafb: Fix potential divide by zero
Kuninori Morimoto <[email protected]>
ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()
Kuninori Morimoto <[email protected]>
ALSA: asihpi: check pao in control_message()
Kristian Overskeid <[email protected]>
net: hsr: Don't log netdev_err message on unknown prp dst node
NeilBrown <[email protected]>
md: avoid signed overflow in slot_store()
Eric Biggers <[email protected]>
fsverity: don't drop pagecache at end of FS_IOC_ENABLE_VERITY
Mike Snitzer <[email protected]>
dm crypt: avoid accessing uninitialized tasklet
Ivan Bornyakov <[email protected]>
bus: imx-weim: fix branch condition evaluates to a garbage value
Johan Hovold <[email protected]>
drm/meson: fix missing component unbind on bind errors
Martin Blumenstingl <[email protected]>
drm/meson: Fix error handling when afbcd.ops->init fails
Marco Elver <[email protected]>
kcsan: avoid passing -g for test
Anders Roxell <[email protected]>
kernel: kcsan: kcsan_test: build without structleak plugin
Wesley Cheng <[email protected]>
usb: dwc3: gadget: Add 1ms delay after end transfer command without IOC
Michael Grzeschik <[email protected]>
usb: dwc3: gadget: move cmd_endtransfer to extra function
Dai Ngo <[email protected]>
NFSD: fix use-after-free in __nfs42_ssc_open()
Miaohe Lin <[email protected]>
KVM: fix memoryleak in kvm_init()
Brian Foster <[email protected]>
xfs: don't reuse busy extents on extent trim
Darrick J. Wong <[email protected]>
xfs: shut down the filesystem if we screw up quota reservation
Jan Kara via Ocfs2-devel <[email protected]>
ocfs2: fix data corruption after failed write
Vincent Guittot <[email protected]>
sched/fair: Sanitize vruntime of entity being migrated
Zhang Qiao <[email protected]>
sched/fair: sanitize vruntime of entity being placed
Mikulas Patocka <[email protected]>
dm crypt: add cond_resched() to dmcrypt_write()
Jiasheng Jiang <[email protected]>
dm stats: check for and propagate alloc_percpu failure
Wei Chen <[email protected]>
i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()
Cristian Marussi <[email protected]>
firmware: arm_scmi: Fix device node validation for mailbox transport
Rijo Thomas <[email protected]>
tee: amdtee: fix race condition in amdtee_open_session
Ville Syrjälä <[email protected]>
drm/i915: Preserve crtc_state->inherited during state clearing
Nirmoy Das <[email protected]>
drm/i915/active: Fix missing debug object activation
Ryusuke Konishi <[email protected]>
nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
Felix Fietkau <[email protected]>
wifi: mac80211: fix qos on mesh interfaces
Hans de Goede <[email protected]>
usb: ucsi: Fix NULL pointer deref in ucsi_connector_change()
Xu Yang <[email protected]>
usb: chipidea: core: fix possible concurrent when switch role
Xu Yang <[email protected]>
usb: chipdea: core: fix return -EINVAL if request role is the same with current role
Pawel Laszczak <[email protected]>
usb: cdns3: Fix issue with using incorrect PCI device function
Coly Li <[email protected]>
dm thin: fix deadlock when swapping to thin device
Lin Ma <[email protected]>
igb: revert rtnl_lock() that causes deadlock
Nathan Huckleberry <[email protected]>
fsverity: Remove WQ_UNBOUND from fsverity read workqueue
Alvin Šipraga <[email protected]>
usb: gadget: u_audio: don't let userspace block driver unbind
Fabrice Gasnier <[email protected]>
usb: dwc2: fix a devres leak in hw_enable upon suspend resume
Joel Selvaraj <[email protected]>
scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR
Shyam Prasad N <[email protected]>
cifs: empty interface list when server doesn't support query interfaces
Al Viro <[email protected]>
sh: sanitize the flags on sigreturn
Enrico Sau <[email protected]>
net: usb: qmi_wwan: add Telit 0x1080 composition
Enrico Sau <[email protected]>
net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990
Michael Kelley <[email protected]>
scsi: storvsc: Handle BlockSize change in Hyper-V VHD/VHDX file
Jakob Koschel <[email protected]>
scsi: lpfc: Avoid usage of list iterator variable after loop
Adrien Thierry <[email protected]>
scsi: ufs: core: Add soft dependency on governor_simpleondemand
Kang Chen <[email protected]>
scsi: hisi_sas: Check devm_add_action() return value
Maurizio Lombardi <[email protected]>
scsi: target: iscsi: Fix an error message in iscsi_check_key()
Lorenz Bauer <[email protected]>
selftests/bpf: check that modifier resolves after pointer
Michael Schmitz <[email protected]>
m68k: Only force 030 bus error if PC not in exception table
Alexander Aring <[email protected]>
ca8210: fix mac_len negative array access
Danny Kaehn <[email protected]>
HID: cp2112: Fix driver not registering GPIO IRQ chip as threaded
Alexandre Ghiti <[email protected]>
riscv: Bump COMMAND_LINE_SIZE value to 1024
Mario Limonciello <[email protected]>
thunderbolt: Use const qualifier for ring_interrupt_index
Mika Westerberg <[email protected]>
thunderbolt: Use scale field when allocating USB3 bandwidth
Yaroslav Furman <[email protected]>
uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2
Nilesh Javali <[email protected]>
scsi: qla2xxx: Perform lockless command completion in abort path
Frank Crawford <[email protected]>
hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs
Phinex Hung <[email protected]>
hwmon: fix potential sensor registration fail if of_node is missing
Tzung-Bi Shih <[email protected]>
platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl
Zheng Wang <[email protected]>
Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work
Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix responding with wrong PDU type
Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix not checking for maximum number of DCID
Stephan Gerhold <[email protected]>
Bluetooth: btqcomsmd: Fix command timeout after setting BD address
Liang He <[email protected]>
net: mdio: thunder: Add missing fwnode_handle_put()
Arınç ÜNAL <[email protected]>
net: dsa: mt7530: move setting ssc_delta to PHY_INTERFACE_MODE_TRGMII case
Joshua Washington <[email protected]>
gve: Cache link_speed value from device
Caleb Sander <[email protected]>
nvme-tcp: fix nvme_tcp_term_pdu to match spec
Zhang Changzhong <[email protected]>
net/sonic: use dma_mapping_error() for error check
Eric Dumazet <[email protected]>
erspan: do not use skb_mac_header() in ndo_start_xmit()
Li Zetao <[email protected]>
atm: idt77252: fix kmemleak when rmmod idt77252
Dan Carpenter <[email protected]>
net/mlx5: E-Switch, Fix an Oops in error handling code
Maher Sanalla <[email protected]>
net/mlx5: Read the TC mapping of all priorities on ETS query
Lama Kayal <[email protected]>
net/mlx5: Fix steering rules cleanup
Daniel Borkmann <[email protected]>
bpf: Adjust insufficient default bpf_jit_limit
David Howells <[email protected]>
keys: Do not cache key in task struct if key is requested from kernel thread
Masami Hiramatsu (Google) <[email protected]>
bootconfig: Fix testcase to increase max node
Geoff Levand <[email protected]>
net/ps3_gelic_net: Use dma_mapping_error
Geoff Levand <[email protected]>
net/ps3_gelic_net: Fix RX sk_buff length
Zheng Wang <[email protected]>
net: qcom/emac: Fix use after free bug in emac_remove due to race condition
Maxime Bizon <[email protected]>
net: mdio: fix owner field for mdio buses registered using device-tree
Florian Fainelli <[email protected]>
net: phy: Ensure state transitions are processed from phy_stop()
Zheng Wang <[email protected]>
xirc2ps_cs: Fix use after free bug in xirc2ps_detach
Daniil Tatianin <[email protected]>
qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
Szymon Heidrich <[email protected]>
net: usb: smsc95xx: Limit packet length to skb->len
Yu Kuai <[email protected]>
scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()
Alexander Stein <[email protected]>
i2c: imx-lpi2c: check only for enabled interrupt flags
AKASHI Takahiro <[email protected]>
igc: fix the validation logic for taprio's gate list
Akihiko Odaki <[email protected]>
igbvf: Regard vf reset nack as success
Gaosheng Cui <[email protected]>
intel/igbvf: free irq on the error path in igbvf_request_msix()
Alexander Lobakin <[email protected]>
iavf: fix non-tunneled IPv6 UDP packet type and hashing
Alexander Lobakin <[email protected]>
iavf: fix inverted Rx hash condition leading to disabled hash
Kal Conley <[email protected]>
xsk: Add missing overflow check in xdp_umem_reg
Peng Fan <[email protected]>
ARM: dts: imx6sl: tolino-shine2hd: fix usbotg1 pinctrl
Peng Fan <[email protected]>
ARM: dts: imx6sll: e60k02: fix usbotg1 pinctrl
Zheng Wang <[email protected]>
power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition
Zheng Wang <[email protected]>
power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition
Minghao Chi <[email protected]>
power: supply: bq24190_charger: using pm_runtime_resume_and_get instead of pm_runtime_get_sync
Hangyu Hua <[email protected]>
net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf()
Johan Hovold <[email protected]>
drm/sun4i: fix missing component unbind on bind errors
Randy Dunlap <[email protected]>
serial: 8250: ASPEED_VUART: select REGMAP instead of depending on it
Geert Uytterhoeven <[email protected]>
serial: 8250: SERIAL_8250_ASPEED_VUART should depend on ARCH_ASPEED
Alexander Sverdlin <[email protected]>
tty: serial: fsl_lpuart: fix race on RX DMA shutdown
Jason Wang <[email protected]>
serial: fsl_lpuart: Fix comment typo
Sean Christopherson <[email protected]>
KVM: Register /dev/kvm as the _very_ last thing during initialization
Vitaly Kuznetsov <[email protected]>
KVM: Pre-allocate cpumasks for kvm_make_all_cpus_request_except()
Vitaly Kuznetsov <[email protected]>
KVM: Optimize kvm_make_vcpus_request_mask() a bit
Sean Christopherson <[email protected]>
KVM: KVM: Use cpumask_available() to check for NULL cpumask when kicking vCPUs
Sean Christopherson <[email protected]>
KVM: Clean up benign vcpu->cpu data races when kicking vCPUs
Corey Minyard <[email protected]>
ipmi:ssif: Add a timer between request retries
Corey Minyard <[email protected]>
ipmi:ssif: resend_msg() cannot fail
Corey Minyard <[email protected]>
ipmi:ssif: Increase the message retry time
Liguang Zhang <[email protected]>
ipmi:ssif: make ssif_i2c_send() void
Song Liu <[email protected]>
perf: fix perf_event_context->time
Yang Jihong <[email protected]>
perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output
Dmitry Baryshkov <[email protected]>
interconnect: qcom: osm-l3: fix icc_onecell_data allocation
-------------
Diffstat:
Makefile | 4 +- arch/arm/boot/dts/e60k02.dtsi | 1 + arch/arm/boot/dts/imx6sl-tolino-shine2hd.dts | 1 + arch/m68k/kernel/traps.c | 4 +- arch/mips/bmips/dma.c | 5 + arch/mips/bmips/setup.c | 8 + arch/powerpc/kernel/ptrace/ptrace-view.c | 6 + arch/riscv/include/uapi/asm/setup.h | 8 + arch/s390/lib/uaccess.c | 2 +- arch/sh/include/asm/processor_32.h | 1 + arch/sh/kernel/signal_32.c | 3 + arch/xtensa/kernel/traps.c | 16 +- drivers/atm/idt77252.c | 11 ++ drivers/bluetooth/btqcomsmd.c | 17 +- drivers/bluetooth/btsdio.c | 1 + drivers/bus/imx-weim.c | 2 +- drivers/char/ipmi/ipmi_ssif.c | 137 ++++++----------- drivers/firmware/arm_scmi/mailbox.c | 37 +++++ .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 19 +++ .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.h | 12 ++ drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c | 10 +- drivers/gpu/drm/i915/display/intel_display.c | 1 + drivers/gpu/drm/i915/i915_active.c | 3 +- drivers/gpu/drm/meson/meson_drv.c | 20 ++- drivers/gpu/drm/sun4i/sun4i_drv.c | 4 +- drivers/hid/hid-cp2112.c | 1 + drivers/hwmon/hwmon.c | 7 +- drivers/hwmon/it87.c | 4 +- drivers/i2c/busses/i2c-imx-lpi2c.c | 4 + drivers/i2c/busses/i2c-xgene-slimpro.c | 3 + drivers/input/mouse/alps.c | 16 +- drivers/input/mouse/focaltech.c | 8 +- drivers/input/touchscreen/goodix.c | 14 +- drivers/interconnect/qcom/osm-l3.c | 2 +- drivers/md/dm-crypt.c | 16 +- drivers/md/dm-stats.c | 7 +- drivers/md/dm-stats.h | 2 +- drivers/md/dm-thin.c | 2 + drivers/md/dm.c | 4 +- drivers/md/md.c | 3 + drivers/mtd/nand/raw/meson_nand.c | 8 +- drivers/net/dsa/mt7530.c | 9 +- drivers/net/dsa/mv88e6xxx/chip.c | 9 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 +- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 + drivers/net/ethernet/google/gve/gve_ethtool.c | 5 +- drivers/net/ethernet/intel/i40e/i40e_diag.c | 11 +- drivers/net/ethernet/intel/i40e/i40e_diag.h | 2 +- drivers/net/ethernet/intel/iavf/iavf_common.c | 2 +- drivers/net/ethernet/intel/iavf/iavf_txrx.c | 2 +- drivers/net/ethernet/intel/igb/igb_main.c | 2 - drivers/net/ethernet/intel/igbvf/netdev.c | 8 +- drivers/net/ethernet/intel/igbvf/vf.c | 13 +- drivers/net/ethernet/intel/igc/igc_main.c | 20 +-- drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 6 +- .../mellanox/mlx5/core/esw/acl/ingress_ofld.c | 3 +- drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 1 + drivers/net/ethernet/natsemi/sonic.c | 4 +- drivers/net/ethernet/qlogic/qed/qed_sriov.c | 5 +- drivers/net/ethernet/qualcomm/emac/emac.c | 6 + drivers/net/ethernet/realtek/r8169_phy_config.c | 3 + drivers/net/ethernet/sfc/ef10.c | 38 +++-- drivers/net/ethernet/sfc/efx.c | 17 +- drivers/net/ethernet/stmicro/stmmac/common.h | 1 - drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 61 +------- drivers/net/ethernet/toshiba/ps3_gelic_net.c | 41 ++--- drivers/net/ethernet/toshiba/ps3_gelic_net.h | 5 +- drivers/net/ethernet/xircom/xirc2ps_cs.c | 5 + drivers/net/ieee802154/ca8210.c | 5 +- drivers/net/ipa/gsi_trans.c | 2 +- drivers/net/mdio/mdio-thunder.c | 1 + drivers/net/mdio/of_mdio.c | 12 +- drivers/net/net_failover.c | 8 +- drivers/net/phy/dp83869.c | 6 +- drivers/net/phy/mdio_devres.c | 11 +- drivers/net/phy/phy.c | 23 ++- drivers/net/usb/cdc_mbim.c | 5 + drivers/net/usb/qmi_wwan.c | 1 + drivers/net/usb/smsc95xx.c | 6 + drivers/net/xen-netback/common.h | 2 +- drivers/net/xen-netback/netback.c | 25 ++- drivers/pinctrl/pinctrl-amd.c | 36 +++-- drivers/pinctrl/pinctrl-at91-pio4.c | 1 - drivers/pinctrl/pinctrl-ocelot.c | 2 +- drivers/platform/chrome/cros_ec_chardev.c | 2 +- drivers/power/supply/bq24190_charger.c | 64 +++----- drivers/power/supply/da9150-charger.c | 1 + drivers/ptp/ptp_qoriq.c | 2 +- drivers/regulator/fixed.c | 2 +- drivers/s390/crypto/vfio_ap_drv.c | 3 +- drivers/scsi/device_handler/scsi_dh_alua.c | 6 +- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 3 +- drivers/scsi/lpfc/lpfc_sli.c | 8 +- drivers/scsi/megaraid/megaraid_sas_fusion.c | 4 +- drivers/scsi/qla2xxx/qla_os.c | 11 ++ drivers/scsi/scsi_devinfo.c | 1 + drivers/scsi/storvsc_drv.c | 16 ++ drivers/scsi/ufs/ufshcd.c | 1 + drivers/target/iscsi/iscsi_target_parameters.c | 12 +- drivers/tee/amdtee/core.c | 29 ++-- drivers/thunderbolt/nhi.c | 2 +- drivers/thunderbolt/usb4.c | 22 ++- drivers/tty/serial/8250/Kconfig | 4 +- drivers/tty/serial/fsl_lpuart.c | 13 +- drivers/usb/cdns3/cdns3-pci-wrap.c | 5 + drivers/usb/chipidea/ci.h | 2 + drivers/usb/chipidea/core.c | 11 +- drivers/usb/chipidea/otg.c | 5 +- drivers/usb/dwc2/platform.c | 16 +- drivers/usb/dwc3/gadget.c | 79 ++++++---- drivers/usb/gadget/function/u_audio.c | 2 +- drivers/usb/storage/unusual_uas.h | 7 + drivers/usb/typec/ucsi/ucsi.c | 11 +- drivers/video/fbdev/au1200fb.c | 3 + drivers/video/fbdev/geode/lxfb_core.c | 3 + drivers/video/fbdev/intelfb/intelfbdrv.c | 3 + drivers/video/fbdev/nvidia/nvidia.c | 2 + drivers/video/fbdev/tgafb.c | 3 + fs/btrfs/ioctl.c | 2 + fs/btrfs/qgroup.c | 11 +- fs/btrfs/volumes.c | 11 +- fs/cifs/cifsfs.h | 5 +- fs/cifs/cifssmb.c | 9 +- fs/cifs/smb2ops.c | 2 +- fs/ext4/inode.c | 3 +- fs/gfs2/aops.c | 2 - fs/gfs2/bmap.c | 3 - fs/gfs2/glops.c | 3 + fs/nfs/nfs4proc.c | 5 +- fs/nfsd/nfs4proc.c | 22 +-- fs/nilfs2/ioctl.c | 2 +- fs/ocfs2/aops.c | 18 ++- fs/verity/enable.c | 24 +-- fs/verity/verify.c | 12 +- fs/xfs/xfs_extent_busy.c | 14 -- fs/xfs/xfs_trans_dquot.c | 13 +- fs/zonefs/super.c | 2 +- include/linux/nvme-tcp.h | 5 +- include/linux/of_mdio.h | 22 ++- include/net/bluetooth/l2cap.h | 1 + include/trace/events/rcu.h | 2 +- kernel/bpf/core.c | 2 +- kernel/compat.c | 2 +- kernel/events/core.c | 4 +- kernel/kcsan/Makefile | 3 +- kernel/sched/core.c | 7 +- kernel/sched/fair.c | 54 ++++++- kernel/trace/kprobe_event_gen_test.c | 4 +- net/bluetooth/l2cap_core.c | 129 +++++++++++----- net/can/bcm.c | 16 +- net/hsr/hsr_framereg.c | 2 +- net/ipv4/ip_gre.c | 4 +- net/ipv6/ip6_gre.c | 4 +- net/mac80211/wme.c | 6 +- net/tls/tls_main.c | 9 +- net/xdp/xdp_umem.c | 13 +- security/keys/request_key.c | 9 +- sound/pci/asihpi/hpi6205.c | 2 +- sound/pci/hda/patch_ca0132.c | 4 +- sound/pci/hda/patch_conexant.c | 6 +- sound/pci/hda/patch_realtek.c | 1 + sound/pci/ymfpci/ymfpci.c | 71 +++++---- sound/pci/ymfpci/ymfpci_main.c | 74 ++++++--- sound/usb/format.c | 8 +- tools/bootconfig/test-bootconfig.sh | 12 +- tools/lib/bpf/btf_dump.c | 154 +++++++++++++------ tools/power/x86/turbostat/turbostat.8 | 2 + tools/power/x86/turbostat/turbostat.c | 2 +- tools/testing/selftests/bpf/prog_tests/btf.c | 28 ++++ .../bpf/progs/btf_dump_test_case_bitfields.c | 2 +- .../bpf/progs/btf_dump_test_case_packing.c | 80 +++++++++- .../bpf/progs/btf_dump_test_case_padding.c | 171 ++++++++++++++++++--- virt/kvm/kvm_main.c | 149 +++++++++++++----- 174 files changed, 1652 insertions(+), 803 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/173 interconnect: qcom: osm-l3: fix icc_onecell_data allocation
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit f77ebdda0ee652124061c2ac42399bb6c367e729 ]
This is a struct with a trailing zero-length array of icc_node pointers but it's allocated as if it were a single array of icc_nodes instead.
Fortunately this overallocates memory rather then allocating less memory than required.
Fix by replacing devm_kcalloc() with devm_kzalloc() and struct_size() macro.
--- drivers/interconnect/qcom/osm-l3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/interconnect/qcom/osm-l3.c +1 -1
@@ -258,7 +258,7 @@ static int qcom_osm_l3_probe(struct platform_device *pdev) qnodes = desc->nodes; num_nodes = desc->num_nodes; - data =devm_kcalloc (&pdev->dev, num_nodes,sizeof (*node),GFP_KERNEL ); + data =devm_kzalloc (&pdev->dev,struct_size (data, nodes, num_nodes),GFP_KERNEL );if (!data)return -ENOMEM ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 2/173 perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output
In reply to Greg Kroah-HartmanFrom: Yang Jihong <[email protected]>
[ Upstream commit eb81a2ed4f52be831c9fb879752d89645a312c13 ]
syzkaller reportes a KASAN issue with stack-out-of-bounds. The call trace is as follows:
dump_stack+0x9c/0xd3 print_address_description.constprop.0+0x19/0x170 __kasan_report.cold+0x6c/0x84 kasan_report+0x3a/0x50 __perf_event_header__init_id+0x34/0x290 perf_event_header__init_id+0x48/0x60 perf_output_begin+0x4a4/0x560 perf_event_bpf_output+0x161/0x1e0 perf_iterate_sb_cpu+0x29e/0x340 perf_iterate_sb+0x4c/0xc0 perf_event_bpf_event+0x194/0x2c0 __bpf_prog_put.constprop.0+0x55/0xf0 __cls_bpf_delete_prog+0xea/0x120 [cls_bpf] cls_bpf_delete_prog_work+0x1c/0x30 [cls_bpf] process_one_work+0x3c2/0x730 worker_thread+0x93/0x650 kthread+0x1b8/0x210 ret_from_fork+0x1f/0x30
commit 267fb27352b6 ("perf: Reduce stack usage of perf_output_begin()") use on-stack struct perf_sample_data of the caller function.
However, perf_event_bpf_output uses incorrect parameter to convert small-sized data (struct perf_bpf_event) into large-sized data (struct perf_sample_data), which causes memory overwriting occurs in __perf_event_header__init_id.
--- kernel/events/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/events/core.c +1 -1
@@ -8710,7 +8710,7 @@ static void perf_event_bpf_output(struct perf_event *event, void *data)perf_event_header__init_id (&bpf_event->event_id.header, &sample, event); - ret =perf_output_begin (&handle, data, event, + ret =perf_output_begin (&handle, &sample, event, bpf_event->event_id.header.size);if (ret)return ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 3/173 perf: fix perf_event_context->time
In reply to Greg Kroah-HartmanFrom: Song Liu <[email protected]>
[ Upstream commit baf1b12a67f5b24f395baca03e442ce27cab0c18 ]
Time readers rely on perf_event_context->[time|timestamp|timeoffset] to get accurate time_enabled and time_running for an event. The difference between ctx->timestamp and ctx->time is the among of time when the context is not enabled. __update_context_time(ctx, false) is used to increase timestamp, but not time. Therefore, it should only be called in ctx_sched_in() when EVENT_TIME was not enabled.
--- kernel/events/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/events/core.c +1 -1
@@ -3817,7 +3817,7 @@ ctx_sched_in(struct perf_event_context *ctx,if (likely (!ctx->nr_events))return ; -if (is_active ^EVENT_TIME ) { +if (!(is_active &EVENT_TIME )) {/* start ctx time */ __update_context_time (ctx, false);perf_cgroup_set_timestamp (task, ctx);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 4/173 ipmi:ssif: make ssif_i2c_send() void
In reply to Greg Kroah-HartmanFrom: Liguang Zhang <[email protected]>
[ Upstream commit dcd10526ac5a0d6cc94ce60b9acfca458163277b ]
This function actually needs no return value. So remove the unneeded check and make it void.
Message-Id: <[email protected]>
Stable-dep-of: 00bb7e763ec9 ("ipmi:ssif: Add a timer between request retries")
--- drivers/char/ipmi/ipmi_ssif.c | 81 +++++++++-------------------------- 1 file changed, 20 insertions(+), 61 deletions(-)
drivers/char/ipmi/ipmi_ssif.c +20 -61
@@ -510,7 +510,7 @@ static int ipmi_ssif_thread(void *data)return 0 ; } -static int ssif_i2c_send (struct ssif_info *ssif_info, +static void ssif_i2c_send (struct ssif_info *ssif_info,ssif_i2c_done handler,int read_write,int command,unsigned char *data,unsigned int size)
@@ -522,7 +522,6 @@ static int ssif_i2c_send(struct ssif_info *ssif_info, ssif_info->i2c_data = data; ssif_info->i2c_size = size;complete (&ssif_info->wake_thread); -return 0 ; }
@@ -531,22 +530,12 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,static void start_get (struct ssif_info *ssif_info) { -int rv; - ssif_info->rtc_us_timer =0 ; ssif_info->multi_pos =0 ; - rv =ssif_i2c_send (ssif_info, msg_done_handler,I2C_SMBUS_READ , -SSIF_IPMI_RESPONSE , - ssif_info->recv,I2C_SMBUS_BLOCK_DATA ); -if (rv <0 ) { -/* request failed, just return the error. */ -if (ssif_info->ssif_debug &SSIF_DEBUG_MSG ) -dev_dbg (&ssif_info->client->dev, -"Error from i2c_non_blocking_op(5)\n" ); - -msg_done_handler (ssif_info, -EIO ,NULL ,0 ); - } +ssif_i2c_send (ssif_info, msg_done_handler,I2C_SMBUS_READ , +SSIF_IPMI_RESPONSE , + ssif_info->recv,I2C_SMBUS_BLOCK_DATA ); }static void retry_timeout (struct timer_list *t)
@@ -620,7 +609,6 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, {struct ipmi_smi_msg *msg;unsigned long oflags, *flags; -int rv;/* * We are single-threaded here, so no need for a lock until we
@@ -666,17 +654,10 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, ssif_info->multi_len = len; ssif_info->multi_pos =1 ; - rv =ssif_i2c_send (ssif_info, msg_done_handler,I2C_SMBUS_READ , -SSIF_IPMI_MULTI_PART_RESPONSE_MIDDLE , - ssif_info->recv,I2C_SMBUS_BLOCK_DATA ); -if (rv <0 ) { -if (ssif_info->ssif_debug &SSIF_DEBUG_MSG ) -dev_dbg (&ssif_info->client->dev, -"Error from i2c_non_blocking_op(1)\n" ); - - result = -EIO ; - }else -return ; +ssif_i2c_send (ssif_info, msg_done_handler,I2C_SMBUS_READ , +SSIF_IPMI_MULTI_PART_RESPONSE_MIDDLE , + ssif_info->recv,I2C_SMBUS_BLOCK_DATA ); +return ; }else if (ssif_info->multi_pos) {/* Middle of multi-part read. Start the next transaction. */ int i;
@@ -738,19 +719,12 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, ssif_info->multi_pos++; - rv =ssif_i2c_send (ssif_info, msg_done_handler, -I2C_SMBUS_READ , -SSIF_IPMI_MULTI_PART_RESPONSE_MIDDLE , - ssif_info->recv, -I2C_SMBUS_BLOCK_DATA ); -if (rv <0 ) { -if (ssif_info->ssif_debug &SSIF_DEBUG_MSG ) -dev_dbg (&ssif_info->client->dev, -"Error from ssif_i2c_send\n" ); - - result = -EIO ; - }else -return ; +ssif_i2c_send (ssif_info, msg_done_handler, +I2C_SMBUS_READ , +SSIF_IPMI_MULTI_PART_RESPONSE_MIDDLE , + ssif_info->recv, +I2C_SMBUS_BLOCK_DATA ); +return ; } }
@@ -931,8 +905,6 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result,static void msg_written_handler (struct ssif_info *ssif_info,int result,unsigned char *data,unsigned int len) { -int rv; -/* We are single-threaded here, so no need for a lock. */ if (result <0 ) { ssif_info->retries_left--;
@@ -995,18 +967,9 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result, ssif_info->multi_data =NULL ; } - rv =ssif_i2c_send (ssif_info, msg_written_handler, -I2C_SMBUS_WRITE , cmd, - data_to_send,I2C_SMBUS_BLOCK_DATA ); -if (rv <0 ) { -/* request failed, just return the error. */ -ssif_inc_stat (ssif_info, send_errors); - -if (ssif_info->ssif_debug &SSIF_DEBUG_MSG ) -dev_dbg (&ssif_info->client->dev, -"Error from i2c_non_blocking_op(3)\n" ); -msg_done_handler (ssif_info, -EIO ,NULL ,0 ); - } +ssif_i2c_send (ssif_info, msg_written_handler, +I2C_SMBUS_WRITE , cmd, + data_to_send,I2C_SMBUS_BLOCK_DATA ); }else {/* Ready to request the result. */ unsigned long oflags, *flags;
@@ -1035,7 +998,6 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result,static int start_resend (struct ssif_info *ssif_info) { -int rv;int command; ssif_info->got_alert = false;
@@ -1057,12 +1019,9 @@ static int start_resend(struct ssif_info *ssif_info) ssif_info->data[0 ] = ssif_info->data_len; } - rv =ssif_i2c_send (ssif_info, msg_written_handler,I2C_SMBUS_WRITE , - command, ssif_info->data,I2C_SMBUS_BLOCK_DATA ); -if (rv && (ssif_info->ssif_debug &SSIF_DEBUG_MSG )) -dev_dbg (&ssif_info->client->dev, -"Error from i2c_non_blocking_op(4)\n" ); -return rv; +ssif_i2c_send (ssif_info, msg_written_handler,I2C_SMBUS_WRITE , + command, ssif_info->data,I2C_SMBUS_BLOCK_DATA ); +return 0 ; } static int start_send(struct ssif_info *ssif_info,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 5/173 ipmi:ssif: Increase the message retry time
In reply to Greg Kroah-HartmanFrom: Corey Minyard <[email protected]>
[ Upstream commit 39721d62bbc16ebc9bb2bdc2c163658f33da3b0b ]
The spec states that the minimum message retry time is 60ms, but it was set to 20ms. Correct it.
Reported by: Tony Camuso <[email protected]>
Stable-dep-of: 00bb7e763ec9 ("ipmi:ssif: Add a timer between request retries")
--- drivers/char/ipmi/ipmi_ssif.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/ipmi/ipmi_ssif.c +1 -1
@@ -74,7 +74,7 @@/* * Timer values */ -#define SSIF_MSG_USEC 20000/* 20ms between message tries. */ +#define SSIF_MSG_USEC 60000/* 60ms between message tries. */ #define SSIF_MSG_PART_USEC 5000/* 5ms for a message part */ /* How many times to we retry sending/receiving the message. */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 6/173 ipmi:ssif: resend_msg() cannot fail
In reply to Greg Kroah-HartmanFrom: Corey Minyard <[email protected]>
[ Upstream commit 95767ed78a181d5404202627499f9cde56053b96 ]
The resend_msg() function cannot fail, but there was error handling around using it. Rework the handling of the error, and fix the out of retries debug reporting that was wrong around this, too.
Stable-dep-of: 00bb7e763ec9 ("ipmi:ssif: Add a timer between request retries")
--- drivers/char/ipmi/ipmi_ssif.c | 28 +++++++--------------------- 1 file changed, 7 insertions(+), 21 deletions(-)
drivers/char/ipmi/ipmi_ssif.c +7 -21
@@ -602,7 +602,7 @@ static void ssif_alert(struct i2c_client *client, enum i2c_alert_protocol type,start_get (ssif_info); } -static int start_resend (struct ssif_info *ssif_info); +static void start_resend (struct ssif_info *ssif_info);static void msg_done_handler (struct ssif_info *ssif_info,int result,unsigned char *data,unsigned int len)
@@ -909,31 +909,17 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result,if (result <0 ) { ssif_info->retries_left--;if (ssif_info->retries_left >0 ) { -if (!start_resend (ssif_info)) { -ssif_inc_stat (ssif_info, send_retries); -return ; - } -/* request failed, just return the error. */ -ssif_inc_stat (ssif_info, send_errors); - -if (ssif_info->ssif_debug &SSIF_DEBUG_MSG ) -dev_dbg (&ssif_info->client->dev, -"%s: Out of retries\n" , __func__); -msg_done_handler (ssif_info, -EIO ,NULL ,0 ); +start_resend (ssif_info);return ; }ssif_inc_stat (ssif_info, send_errors); -/* -* Got an error on transmit, let the done routine -* handle it. -*/ if (ssif_info->ssif_debug &SSIF_DEBUG_MSG )dev_dbg (&ssif_info->client->dev, -"%s: Error %d\n" , __func__, result); +"%s: Out of retries\n" , __func__); -msg_done_handler (ssif_info, result,NULL ,0 ); +msg_done_handler (ssif_info, -EIO ,NULL ,0 );return ; }
@@ -996,7 +982,7 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result, } } -static int start_resend (struct ssif_info *ssif_info) +static void start_resend (struct ssif_info *ssif_info) {int command;
@@ -1021,7 +1007,6 @@ static int start_resend(struct ssif_info *ssif_info)ssif_i2c_send (ssif_info, msg_written_handler,I2C_SMBUS_WRITE , command, ssif_info->data,I2C_SMBUS_BLOCK_DATA ); -return 0 ; } static int start_send(struct ssif_info *ssif_info,
@@ -1036,7 +1021,8 @@ static int start_send(struct ssif_info *ssif_info, ssif_info->retries_left =SSIF_SEND_RETRIES ;memcpy (ssif_info->data +1 , data, len); ssif_info->data_len = len; -return start_resend (ssif_info); +start_resend (ssif_info); +return 0 ; }/* Must be called with the message lock held. */
Signature · 1 line
2.39.2
Re: [PATCH 5.10 006/173] ipmi:ssif: resend_msg() cannot fail
Hi!
Quoted 12 lines
The
resend_msg()function cannot fail, but there was error handling around using it. Rework the handling of the error, and fix the out of retries debug reporting that was wrong around this, too.drivers/char/ipmi/ipmi_ssif.c +0
-4@@ -909,31 +909,17 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result,if (result <0 ) { ssif_info->retries_left--;if (ssif_info->retries_left >0 ) { -if (!start_resend (ssif_info)) { -ssif_inc_stat (ssif_info, send_retries); -return ; - }
drivers/char/ipmi/ipmi_ssif.c static void msg_written_handler(struct ssif_info *ssif_info, int result, · line 914
Quoted 10 lines
drivers/char/ipmi/ipmi_ssif.c +1
-7-/* request failed, just return the error. */ -ssif_inc_stat (ssif_info, send_errors); - -if (ssif_info->ssif_debug &SSIF_DEBUG_MSG ) -dev_dbg (&ssif_info->client->dev, -"%s: Out of retries\n" , __func__); -msg_done_handler (ssif_info, -EIO ,NULL ,0 ); +start_resend (ssif_info);return ; }
ssif_inc_stat(ssif_info, send_errors); disappeared here, is that intentional?
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Erika Unter HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Re: [PATCH 5.10 006/173] ipmi:ssif: resend_msg() cannot fail
Quoted 19 lines · Pavel Machek
Hi!
Quoted 17 lines
The
resend_msg()function cannot fail, but there was error handling around using it. Rework the handling of the error, and fix the out of retries debug reporting that was wrong around this, too.drivers/char/ipmi/ipmi_ssif.c +0
-9@@ -909,31 +909,17 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result,if (result <0 ) { ssif_info->retries_left--;if (ssif_info->retries_left >0 ) { -if (!start_resend (ssif_info)) { -ssif_inc_stat (ssif_info, send_retries); -return ; - } -/* request failed, just return the error. */ -ssif_inc_stat (ssif_info, send_errors); - -if (ssif_info->ssif_debug &SSIF_DEBUG_MSG ) - dev_dbg(&ssif_info->client->dev,
Quoted 8 lines
drivers/char/ipmi/ipmi_ssif.c static void msg_written_handler(struct ssif_info *ssif_info, int result, · line 914
Quoted 5 lines
drivers/char/ipmi/ipmi_ssif.c +1
-2- "%s: Out of retries\n", __func__); -msg_done_handler (ssif_info, -EIO ,NULL ,0 ); +start_resend (ssif_info);return ; }
ssif_inc_stat(ssif_info, send_errors); disappeared here, is that intentional?
Actually, ssif_inc_stat(ssif_info, send_retries); is the thing that disappeared, since start_resend() cannot fail. Thanks, I'll get in a fix for that.
-corey
Quoted 6 lines
Best regards,
PavelSignature · 2 lines
DENX Software Engineering GmbH, Managing Director: Erika Unter HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Greg Kroah-Hartman
maintainerPATCH 7/173 ipmi:ssif: Add a timer between request retries
In reply to Greg Kroah-HartmanFrom: Corey Minyard <[email protected]>
[ Upstream commit 00bb7e763ec9f384cb382455cb6ba5588b5375cf ]
The IPMI spec has a time (T6) specified between request retries. Add the handling for that.
Reported by: Tony Camuso <[email protected]>
--- drivers/char/ipmi/ipmi_ssif.c | 34 +++++++++++++++++++++++++++------- 1 file changed, 27 insertions(+), 7 deletions(-)
drivers/char/ipmi/ipmi_ssif.c +27 -7
@@ -74,7 +74,8 @@/* * Timer values */ -#define SSIF_MSG_USEC 60000/* 60ms between message tries. */ +#define SSIF_MSG_USEC 60000/* 60ms between message tries (T3). */ +#define SSIF_REQ_RETRY_USEC 60000/* 60ms between send retries (T6). */ #define SSIF_MSG_PART_USEC 5000/* 5ms for a message part */ /* How many times to we retry sending/receiving the message. */
@@ -82,7 +83,9 @@#define SSIF_RECV_RETRIES 250#define SSIF_MSG_MSEC (SSIF_MSG_USEC / 1000) +#define SSIF_REQ_RETRY_MSEC (SSIF_REQ_RETRY_USEC / 1000)#define SSIF_MSG_JIFFIES ((SSIF_MSG_USEC * 1000) / TICK_NSEC) +#define SSIF_REQ_RETRY_JIFFIES ((SSIF_REQ_RETRY_USEC * 1000) / TICK_NSEC)#define SSIF_MSG_PART_JIFFIES ((SSIF_MSG_PART_USEC * 1000) / TICK_NSEC)/*
@@ -229,6 +232,9 @@ struct ssif_info {bool got_alert;bool waiting_alert; +/* Used to inform the timeout that it should do a resend. */ +bool do_resend; +/* * If set to true, this will request events the next time the * state machine is idle.
@@ -538,22 +544,28 @@ static void start_get(struct ssif_info *ssif_info) ssif_info->recv, I2C_SMBUS_BLOCK_DATA); } +static void start_resend (struct ssif_info *ssif_info); +static void retry_timeout (struct timer_list *t) {struct ssif_info *ssif_info =from_timer (ssif_info, t, retry_timer);unsigned long oflags, *flags; -bool waiting; +bool waiting, resend;if (ssif_info->stopping)return ; flags =ipmi_ssif_lock_cond (ssif_info, &oflags); + resend = ssif_info->do_resend; + ssif_info->do_resend = false; waiting = ssif_info->waiting_alert; ssif_info->waiting_alert = false;ipmi_ssif_unlock_cond (ssif_info, flags);if (waiting)start_get (ssif_info); +if (resend) +start_resend (ssif_info); }static void watch_timeout (struct timer_list *t)
@@ -602,8 +614,6 @@ static void ssif_alert(struct i2c_client *client, enum i2c_alert_protocol type,start_get (ssif_info); } -static void start_resend (struct ssif_info *ssif_info); -static void msg_done_handler (struct ssif_info *ssif_info,int result,unsigned char *data,unsigned int len) {
@@ -909,7 +919,13 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result,if (result <0 ) { ssif_info->retries_left--;if (ssif_info->retries_left >0 ) { -start_resend (ssif_info); +/* +* Wait the retry timeout time per the spec, +* then redo the send. +*/ + ssif_info->do_resend = true; +mod_timer (&ssif_info->retry_timer, + jiffies +SSIF_REQ_RETRY_JIFFIES );return ; }
@@ -1322,8 +1338,10 @@ static int do_cmd(struct i2c_client *client, int len, unsigned char *msg, ret =i2c_smbus_write_block_data (client,SSIF_IPMI_REQUEST , len, msg);if (ret) { retry_cnt--; -if (retry_cnt >0 ) +if (retry_cnt >0 ) { +msleep (SSIF_REQ_RETRY_MSEC ); goto retry1; + }return -ENODEV ; }
@@ -1464,8 +1482,10 @@ static int start_multipart_test(struct i2c_client *client, 32, msg);if (ret) { retry_cnt--; -if (retry_cnt >0 ) +if (retry_cnt >0 ) { +msleep (SSIF_REQ_RETRY_MSEC ); goto retry_write; + }dev_err (&client->dev,"Could not write multi-part start, though the BMC said it could handle it. Just limit sends to one part.\n" );return ret; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 8/173 KVM: Clean up benign vcpu->cpu data races when kicking vCPUs
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit 85b640450ddcfa09cf72771b69a9c3daf0ddc772 ]
Fix a benign data race reported by syzbot+KCSAN[*] by ensuring vcpu->cpu is read exactly once, and by ensuring the vCPU is booted from guest mode if kvm_arch_vcpu_should_kick() returns true. Fix a similar race in kvm_make_vcpus_request_mask() by ensuring the vCPU is interrupted if kvm_request_needs_ipi() returns true.
Reading vcpu->cpu before vcpu->mode (via kvm_arch_vcpu_should_kick() or kvm_request_needs_ipi()) means the target vCPU could get migrated (change vcpu->cpu) and enter !OUTSIDE_GUEST_MODE between reading vcpu->cpud and reading vcpu->mode. If that happens, the kick/IPI will be sent to the old pCPU, not the new pCPU that is now running the vCPU or reading SPTEs.
Although failing to kick the vCPU is not exactly ideal, practically speaking it cannot cause a functional issue unless there is also a bug in the caller, and any such bug would exist regardless of kvm_vcpu_kick()'s behavior.
The purpose of sending an IPI is purely to get a vCPU into the host (or out of reading SPTEs) so that the vCPU can recognize a change in state, e.g. a KVM_REQ_* request. If vCPU's handling of the state change is required for correctness, KVM must ensure either the vCPU sees the change before entering the guest, or that the sender sees the vCPU as running in guest mode. All architectures handle this by (a) sending the request before calling kvm_vcpu_kick() and (b) checking for requests _after_ setting vcpu->mode.
x86's READING_SHADOW_PAGE_TABLES has similar requirements; KVM needs to ensure it kicks and waits for vCPUs that started reading SPTEs _before_ MMU changes were finalized, but any vCPU that starts reading after MMU changes were finalized will see the new state and can continue on uninterrupted.
For uses of kvm_vcpu_kick() that are not paired with a KVM_REQ_*, e.g. x86's kvm_arch_sync_dirty_log(), the order of the kick must not be relied upon for functional correctness, e.g. in the dirty log case, userspace cannot assume it has a 100% complete log if vCPUs are still running.
All that said, eliminate the benign race since the cost of doing so is an "extra" atomic cmpxchg() in the case where the target vCPU is loaded by the current pCPU or is not loaded at all. I.e. the kick will be skipped due to kvm_vcpu_exiting_guest_mode() seeing a compatible vcpu->mode as opposed to the kick being skipped because of the cpu checks.
Keep the "cpu != me" checks even though they appear useless/impossible at first glance. x86 processes guest IPI writes in a fast path that runs in IN_GUEST_MODE, i.e. can call kvm_vcpu_kick() from IN_GUEST_MODE. And calling kvm_vm_bugged()->kvm_make_vcpus_request_mask() from IN_GUEST or READING_SHADOW_PAGE_TABLES is perfectly reasonable.
Note, a race with the cpu_online() check in kvm_vcpu_kick() likely persists, e.g. the vCPU could exit guest mode and get offlined between the cpu_online() check and the sending of smp_send_reschedule(). But, the online check appears to exist only to avoid a WARN in x86's native_smp_send_reschedule() that fires if the target CPU is not online. The reschedule WARN exists because CPU offlining takes the CPU out of the scheduling pool, i.e. the WARN is intended to detect the case where the kernel attempts to schedule a task on an offline CPU. The actual sending of the IPI is a non-issue as at worst it will simpy be dropped on the floor. In other words, KVM's usurping of the reschedule IPI could theoretically trigger a WARN if the stars align, but there will be no loss of functionality.
[*] https://syzkaller.appspot.com/bug?extid=cd4154e502f43f10808a
Message-Id: <[email protected]>
Stable-dep-of: 2b0128127373 ("KVM: Register /dev/kvm as the _very_ last thing during initialization")
--- virt/kvm/kvm_main.c | 36 ++++++++++++++++++++++++++++-------- 1 file changed, 28 insertions(+), 8 deletions(-)
virt/kvm/kvm_main.c +28 -8
@@ -276,14 +276,26 @@ bool kvm_make_vcpus_request_mask(struct kvm *kvm, unsigned int req,continue ;kvm_make_request (req, vcpu); - cpu = vcpu->cpu;if (!(req &KVM_REQUEST_NO_WAKEUP ) &&kvm_vcpu_wake_up (vcpu))continue ; -if (tmp !=NULL && cpu !=-1 && cpu != me && -kvm_request_needs_ipi (vcpu, req)) -__cpumask_set_cpu (cpu, tmp); +/* +* Note, the vCPU could get migrated to a different pCPU at any +* point after kvm_request_needs_ipi(), which could result in +* sending an IPI to the previous pCPU. But, that's ok because +* the purpose of the IPI is to ensure the vCPU returns to +* OUTSIDE_GUEST_MODE, which is satisfied if the vCPU migrates. +* Entering READING_SHADOW_PAGE_TABLES after this point is also +* ok, as the requirement is only that KVM wait for vCPUs that +* were reading SPTEs _before_ any changes were finalized. See +* kvm_vcpu_kick() for more details on handling requests. +*/ +if (tmp !=NULL &&kvm_request_needs_ipi (vcpu, req)) { + cpu =READ_ONCE (vcpu->cpu); +if (cpu !=-1 && cpu != me) +__cpumask_set_cpu (cpu, tmp); + } } called =kvm_kick_many_cpus (tmp, !!(req &KVM_REQUEST_WAIT ));
@@ -2937,16 +2949,24 @@ EXPORT_SYMBOL_GPL(kvm_vcpu_wake_up);*/ void kvm_vcpu_kick (struct kvm_vcpu *vcpu) { -int me; -int cpu = vcpu->cpu; +int me, cpu;if (kvm_vcpu_wake_up (vcpu))return ; +/* +* Note, the vCPU could get migrated to a different pCPU at any point +* after kvm_arch_vcpu_should_kick(), which could result in sending an +* IPI to the previous pCPU. But, that's ok because the purpose of the +* IPI is to force the vCPU to leave IN_GUEST_MODE, and migrating the +* vCPU also requires it to leave IN_GUEST_MODE. +*/ me =get_cpu (); -if (cpu != me && (unsigned )cpu < nr_cpu_ids &&cpu_online (cpu)) -if (kvm_arch_vcpu_should_kick (vcpu)) +if (kvm_arch_vcpu_should_kick (vcpu)) { + cpu =READ_ONCE (vcpu->cpu); +if (cpu != me && (unsigned )cpu < nr_cpu_ids &&cpu_online (cpu))smp_send_reschedule (cpu); + }put_cpu (); }EXPORT_SYMBOL_GPL (kvm_vcpu_kick);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 9/173 KVM: KVM: Use cpumask_available() to check for NULL cpumask when kicking vCPUs
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit 0bbc2ca8515f9cdf11df84ccb63dc7c44bc3d8f4 ]
Check for a NULL cpumask_var_t when kicking multiple vCPUs via cpumask_available(), which performs a !NULL check if and only if cpumasks are configured to be allocated off-stack. This is a meaningless optimization, e.g. avoids a TEST+Jcc and TEST+CMOV on x86, but more importantly helps document that the NULL check is necessary even though all callers pass in a local variable.
No functional change intended.
Message-Id: <[email protected]>
Stable-dep-of: 2b0128127373 ("KVM: Register /dev/kvm as the _very_ last thing during initialization")
--- virt/kvm/kvm_main.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
virt/kvm/kvm_main.c +15 -3
@@ -248,9 +248,13 @@ static void ack_flush(void *_completed) { } -static inline bool kvm_kick_many_cpus (const struct cpumask *cpus,bool wait) +static inline bool kvm_kick_many_cpus (cpumask_var_t tmp,bool wait) { -if (unlikely (!cpus)) +const struct cpumask *cpus; + +if (likely (cpumask_available (tmp))) + cpus = tmp; +else cpus = cpu_online_mask;if (cpumask_empty (cpus))
@@ -280,6 +284,14 @@ bool kvm_make_vcpus_request_mask(struct kvm *kvm, unsigned int req,if (!(req &KVM_REQUEST_NO_WAKEUP ) &&kvm_vcpu_wake_up (vcpu))continue ; +/* +* tmp can be "unavailable" if cpumasks are allocated off stack +* as allocation of the mask is deliberately not fatal and is +* handled by falling back to kicking all online CPUs. +*/ +if (!cpumask_available (tmp)) +continue ; +/* * Note, the vCPU could get migrated to a different pCPU at any * point after kvm_request_needs_ipi(), which could result in
@@ -291,7 +303,7 @@ bool kvm_make_vcpus_request_mask(struct kvm *kvm, unsigned int req,* were reading SPTEs _before_ any changes were finalized. See * kvm_vcpu_kick() for more details on handling requests. */ -if (tmp !=NULL &&kvm_request_needs_ipi (vcpu, req)) { +if (kvm_request_needs_ipi (vcpu, req)) { cpu =READ_ONCE (vcpu->cpu);if (cpu !=-1 && cpu != me)__cpumask_set_cpu (cpu, tmp);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 10/173 KVM: Optimize kvm_make_vcpus_request_mask() a bit
In reply to Greg Kroah-HartmanFrom: Vitaly Kuznetsov <[email protected]>
[ Upstream commit ae0946cd3601752dc58f86d84258e5361e9c8cd4 ]
Iterating over set bits in 'vcpu_bitmap' should be faster than going through all vCPUs, especially when just a few bits are set.
Drop kvm_make_vcpus_request_mask() call from kvm_make_all_cpus_request_except() to avoid handling the special case when 'vcpu_bitmap' is NULL, move the code to kvm_make_all_cpus_request_except() itself.
Message-Id: <[email protected]>
Stable-dep-of: 2b0128127373 ("KVM: Register /dev/kvm as the _very_ last thing during initialization")
--- virt/kvm/kvm_main.c | 88 +++++++++++++++++++++++++++------------------ 1 file changed, 53 insertions(+), 35 deletions(-)
virt/kvm/kvm_main.c +53 -35
@@ -264,50 +264,57 @@ static inline bool kvm_kick_many_cpus(cpumask_var_t tmp, bool wait)return true; } +static void kvm_make_vcpu_request (struct kvm *kvm,struct kvm_vcpu *vcpu, +unsigned int req,cpumask_var_t tmp, +int current_cpu) +{ +int cpu; + +kvm_make_request (req, vcpu); + +if (!(req &KVM_REQUEST_NO_WAKEUP ) &&kvm_vcpu_wake_up (vcpu)) +return ; + +/* +* tmp can be "unavailable" if cpumasks are allocated off stack as +* allocation of the mask is deliberately not fatal and is handled by +* falling back to kicking all online CPUs. +*/ +if (!cpumask_available (tmp)) +return ; + +/* +* Note, the vCPU could get migrated to a different pCPU at any point +* after kvm_request_needs_ipi(), which could result in sending an IPI +* to the previous pCPU. But, that's OK because the purpose of the IPI +* is to ensure the vCPU returns to OUTSIDE_GUEST_MODE, which is +* satisfied if the vCPU migrates. Entering READING_SHADOW_PAGE_TABLES +* after this point is also OK, as the requirement is only that KVM wait +* for vCPUs that were reading SPTEs _before_ any changes were +* finalized. See kvm_vcpu_kick() for more details on handling requests. +*/ +if (kvm_request_needs_ipi (vcpu, req)) { + cpu =READ_ONCE (vcpu->cpu); +if (cpu !=-1 && cpu != current_cpu) +__cpumask_set_cpu (cpu, tmp); + } +} +bool kvm_make_vcpus_request_mask (struct kvm *kvm,unsigned int req,struct kvm_vcpu *except,unsigned long *vcpu_bitmap,cpumask_var_t tmp) { -int i, cpu, me;struct kvm_vcpu *vcpu; +int i, me;bool called; me =get_cpu (); -kvm_for_each_vcpu (i, vcpu, kvm) { -if ((vcpu_bitmap && !test_bit (i, vcpu_bitmap)) || - vcpu == except) +for_each_set_bit (i, vcpu_bitmap,KVM_MAX_VCPUS ) { + vcpu =kvm_get_vcpu (kvm, i); +if (!vcpu || vcpu == except)continue ; - -kvm_make_request (req, vcpu); - -if (!(req &KVM_REQUEST_NO_WAKEUP ) &&kvm_vcpu_wake_up (vcpu)) -continue ; - -/* -* tmp can be "unavailable" if cpumasks are allocated off stack -* as allocation of the mask is deliberately not fatal and is -* handled by falling back to kicking all online CPUs. -*/ -if (!cpumask_available (tmp)) -continue ; - -/* -* Note, the vCPU could get migrated to a different pCPU at any -* point after kvm_request_needs_ipi(), which could result in -* sending an IPI to the previous pCPU. But, that's ok because -* the purpose of the IPI is to ensure the vCPU returns to -* OUTSIDE_GUEST_MODE, which is satisfied if the vCPU migrates. -* Entering READING_SHADOW_PAGE_TABLES after this point is also -* ok, as the requirement is only that KVM wait for vCPUs that -* were reading SPTEs _before_ any changes were finalized. See -* kvm_vcpu_kick() for more details on handling requests. -*/ -if (kvm_request_needs_ipi (vcpu, req)) { - cpu =READ_ONCE (vcpu->cpu); -if (cpu !=-1 && cpu != me) -__cpumask_set_cpu (cpu, tmp); - } +kvm_make_vcpu_request (kvm, vcpu, req, tmp, me); } called =kvm_kick_many_cpus (tmp, !!(req &KVM_REQUEST_WAIT ));
@@ -319,12 +326,23 @@ bool kvm_make_vcpus_request_mask(struct kvm *kvm, unsigned int req,bool kvm_make_all_cpus_request_except (struct kvm *kvm,unsigned int req,struct kvm_vcpu *except) { +struct kvm_vcpu *vcpu;cpumask_var_t cpus;bool called; +int i, me;zalloc_cpumask_var (&cpus,GFP_ATOMIC ); - called =kvm_make_vcpus_request_mask (kvm, req, except,NULL , cpus); + me =get_cpu (); + +kvm_for_each_vcpu (i, vcpu, kvm) { +if (vcpu == except) +continue ; +kvm_make_vcpu_request (kvm, vcpu, req, cpus, me); + } + + called =kvm_kick_many_cpus (cpus, !!(req &KVM_REQUEST_WAIT )); +put_cpu ();free_cpumask_var (cpus);return called;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 11/173 KVM: Pre-allocate cpumasks for kvm_make_all_cpus_request_except()
In reply to Greg Kroah-HartmanFrom: Vitaly Kuznetsov <[email protected]>
[ Upstream commit baff59ccdc657d290be51b95b38ebe5de40036b4 ]
Allocating cpumask dynamically in zalloc_cpumask_var() is not ideal. Allocation is somewhat slow and can (in theory and when CPUMASK_OFFSTACK) fail. kvm_make_all_cpus_request_except() already disables preemption so we can use pre-allocated per-cpu cpumasks instead.
Message-Id: <[email protected]>
Stable-dep-of: 2b0128127373 ("KVM: Register /dev/kvm as the _very_ last thing during initialization")
--- virt/kvm/kvm_main.c | 29 +++++++++++++++++++++++------ 1 file changed, 23 insertions(+), 6 deletions(-)
virt/kvm/kvm_main.c +23 -6
@@ -154,6 +154,8 @@ static void kvm_uevent_notify_change(unsigned int type, struct kvm *kvm);static unsigned long long kvm_createvm_count;static unsigned long long kvm_active_vms; +static DEFINE_PER_CPU(cpumask_var_t, cpu_kick_mask); +__weak void kvm_arch_mmu_notifier_invalidate_range (struct kvm *kvm,unsigned long start,unsigned long end) {
@@ -327,14 +329,15 @@ bool kvm_make_all_cpus_request_except(struct kvm *kvm, unsigned int req, struct kvm_vcpu *except) {struct kvm_vcpu *vcpu; -cpumask_var_t cpus; +struct cpumask *cpus;bool called;int i, me; -zalloc_cpumask_var (&cpus,GFP_ATOMIC ); - me =get_cpu (); + cpus =this_cpu_cpumask_var_ptr (cpu_kick_mask); +cpumask_clear (cpus); +kvm_for_each_vcpu (i, vcpu, kvm) {if (vcpu == except)continue ;
@@ -344,7 +347,6 @@ bool kvm_make_all_cpus_request_except(struct kvm *kvm, unsigned int req, called =kvm_kick_many_cpus (cpus, !!(req &KVM_REQUEST_WAIT ));put_cpu (); -free_cpumask_var (cpus);return called; }
@@ -5002,9 +5004,17 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, goto out_free_3; } +for_each_possible_cpu (cpu) { +if (!alloc_cpumask_var_node (&per_cpu (cpu_kick_mask, cpu), +GFP_KERNEL ,cpu_to_node (cpu))) { + r = -ENOMEM ; + goto out_free_4; + } + } + r =kvm_async_pf_init ();if (r) - goto out_free; + goto out_free_5; kvm_chardev_ops.owner = module; kvm_vm_fops.owner = module;
@@ -5030,7 +5040,10 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, out_unreg:kvm_async_pf_deinit (); -out_free: +out_free_5: +for_each_possible_cpu (cpu) +free_cpumask_var (per_cpu (cpu_kick_mask, cpu)); +out_free_4:kmem_cache_destroy (kvm_vcpu_cache); out_free_3:unregister_reboot_notifier (&kvm_reboot_notifier);
@@ -5050,8 +5063,12 @@ EXPORT_SYMBOL_GPL(kvm_init);void kvm_exit (void ) { +int cpu; +debugfs_remove_recursive (kvm_debugfs_dir);misc_deregister (&kvm_dev); +for_each_possible_cpu (cpu) +free_cpumask_var (per_cpu (cpu_kick_mask, cpu));kmem_cache_destroy (kvm_vcpu_cache);kvm_async_pf_deinit ();unregister_syscore_ops (&kvm_syscore_ops);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 12/173 KVM: Register /dev/kvm as the _very_ last thing during initialization
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit 2b01281273738bf2d6551da48d65db2df3f28998 ]
Register /dev/kvm, i.e. expose KVM to userspace, only after all other setup has completed. Once /dev/kvm is exposed, userspace can start invoking KVM ioctls, creating VMs, etc... If userspace creates a VM before KVM is done with its configuration, bad things may happen, e.g. KVM will fail to properly migrate vCPU state if a VM is created before KVM has registered preemption notifiers.
Message-Id: <[email protected]>
--- virt/kvm/kvm_main.c | 31 ++++++++++++++++++++++--------- 1 file changed, 22 insertions(+), 9 deletions(-)
virt/kvm/kvm_main.c +22 -9
@@ -5020,12 +5020,6 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align, kvm_vm_fops.owner = module; kvm_vcpu_fops.owner = module; - r =misc_register (&kvm_dev); -if (r) { -pr_err ("kvm: misc device register failed\n" ); - goto out_unreg; - } -register_syscore_ops (&kvm_syscore_ops); kvm_preempt_ops.sched_in = kvm_sched_in;
@@ -5034,11 +5028,24 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,kvm_init_debug (); r =kvm_vfio_ops_init (); -WARN_ON (r); +if (WARN_ON_ONCE (r)) + goto err_vfio; + +/* +* Registration _must_ be the very last thing done, as this exposes +* /dev/kvm to userspace, i.e. all infrastructure must be setup! +*/ + r =misc_register (&kvm_dev); +if (r) { +pr_err ("kvm: misc device register failed\n" ); + goto err_register; + }return 0 ; -out_unreg: +err_register: +kvm_vfio_ops_exit (); +err_vfio:kvm_async_pf_deinit (); out_free_5:for_each_possible_cpu (cpu)
@@ -5065,8 +5072,14 @@ void kvm_exit(void) {int cpu; -debugfs_remove_recursive (kvm_debugfs_dir); +/* +* Note, unregistering /dev/kvm doesn't strictly need to come first, +* fops_get(), a.k.a. try_module_get(), prevents acquiring references +* to KVM while the module is being stopped. +*/ misc_deregister (&kvm_dev); + +debugfs_remove_recursive (kvm_debugfs_dir);for_each_possible_cpu (cpu)free_cpumask_var (per_cpu (cpu_kick_mask, cpu));kmem_cache_destroy (kvm_vcpu_cache);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 13/173 serial: fsl_lpuart: Fix comment typo
In reply to Greg Kroah-HartmanFrom: Jason Wang <[email protected]>
[ Upstream commit 374e01fa1304e1eabd2cd16f750da3ecaeab069b ]
The double `as' is duplicated in the comment, remove one.
Stable-dep-of: 1be6f2b15f90 ("tty: serial: fsl_lpuart: fix race on RX DMA shutdown")
--- drivers/tty/serial/fsl_lpuart.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/fsl_lpuart.c +1 -1
@@ -2766,7 +2766,7 @@ static int __maybe_unused lpuart_suspend(struct device *dev)* EDMA driver during suspend will forcefully release any * non-idle DMA channels. If port wakeup is enabled or if port * is console port or 'no_console_suspend' is set the Rx DMA -* cannot resume as as expected, hence gracefully release the +* cannot resume as expected, hence gracefully release the * Rx DMA path before suspend and start Rx DMA path on resume. */ if (irq_wake) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 14/173 tty: serial: fsl_lpuart: fix race on RX DMA shutdown
In reply to Greg Kroah-HartmanFrom: Alexander Sverdlin <[email protected]>
[ Upstream commit 1be6f2b15f902c02e055ae0b419ca789200473c9 ]
Quoted 1 line
From time to time DMA completion can come in the middle of DMA shutdown:
<process ctx>: <IRQ>:lpuart32_shutdown()
lpuart_dma_shutdown()
del_timer_sync()
lpuart_dma_rx_complete()
lpuart_copy_rx_to_tty()
mod_timer()
lpuart_dma_rx_free()When the timer fires a bit later, sport->dma_rx_desc is NULL:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004 pc : lpuart_copy_rx_to_tty+0xcc/0x5bc lr : lpuart_timer_func+0x1c/0x2c Call trace: lpuart_copy_rx_to_tty lpuart_timer_func call_timer_fn __run_timers.part.0 run_timer_softirq __do_softirq __irq_exit_rcu irq_exit handle_domain_irq gic_handle_irq call_on_irq_stack do_interrupt_handler ...
To fix this fold del_timer_sync() into lpuart_dma_rx_free() after dmaengine_terminate_sync() to make sure timer will not be re-started in lpuart_copy_rx_to_tty() <= lpuart_dma_rx_complete().
--- drivers/tty/serial/fsl_lpuart.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-)
drivers/tty/serial/fsl_lpuart.c +3 -8
@@ -1278,6 +1278,7 @@ static void lpuart_dma_rx_free(struct uart_port *port)struct dma_chan *chan = sport->dma_rx_chan;dmaengine_terminate_all (chan); +del_timer_sync (&sport->lpuart_timer);dma_unmap_sg (chan->device->dev, &sport->rx_sgl,1 ,DMA_FROM_DEVICE );kfree (sport->rx_ring.buf); sport->rx_ring.tail =0 ;
@@ -1743,7 +1744,6 @@ static int lpuart32_startup(struct uart_port *port)static void lpuart_dma_shutdown (struct lpuart_port *sport) {if (sport->lpuart_dma_rx_use) { -del_timer_sync (&sport->lpuart_timer);lpuart_dma_rx_free (&sport->port); sport->lpuart_dma_rx_use = false; }
@@ -1894,10 +1894,8 @@ lpuart_set_termios(struct uart_port *port, struct ktermios *termios,* Since timer function acqures sport->port.lock, need to stop before * acquring same lock because otherwise del_timer_sync() can deadlock. */ -if (old && sport->lpuart_dma_rx_use) { -del_timer_sync (&sport->lpuart_timer); +if (old && sport->lpuart_dma_rx_use)lpuart_dma_rx_free (&sport->port); - }spin_lock_irqsave (&sport->port.lock, flags);
@@ -2129,10 +2127,8 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,* Since timer function acqures sport->port.lock, need to stop before * acquring same lock because otherwise del_timer_sync() can deadlock. */ -if (old && sport->lpuart_dma_rx_use) { -del_timer_sync (&sport->lpuart_timer); +if (old && sport->lpuart_dma_rx_use)lpuart_dma_rx_free (&sport->port); - }spin_lock_irqsave (&sport->port.lock, flags);
@@ -2770,7 +2766,6 @@ static int __maybe_unused lpuart_suspend(struct device *dev)* Rx DMA path before suspend and start Rx DMA path on resume. */ if (irq_wake) { -del_timer_sync (&sport->lpuart_timer);lpuart_dma_rx_free (&sport->port); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 15/173 serial: 8250: SERIAL_8250_ASPEED_VUART should depend on ARCH_ASPEED
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit 806a449725cbd679a7f52c394d3c87b451d66bd5 ]
The Aspeed Virtual UART is only present on Aspeed BMC platforms. Hence add a dependency on ARCH_ASPEED, to prevent asking the user about this driver when configuring a kernel without Aspeed BMC support.
Stable-dep-of: f8086d1a65ac ("serial: 8250: ASPEED_VUART: select REGMAP instead of depending on it")
--- drivers/tty/serial/8250/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/tty/serial/8250/Kconfig +1 -0
@@ -255,6 +255,7 @@ config SERIAL_8250_ASPEED_VUART depends on SERIAL_8250 depends on OF depends on REGMAP && MFD_SYSCON + depends on ARCH_ASPEED || COMPILE_TEST help If you want to use the virtual UART (VUART) device on Aspeed BMC platforms, enable this option. This enables the 16550A-
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 16/173 serial: 8250: ASPEED_VUART: select REGMAP instead of depending on it
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit f8086d1a65ac693e3fd863128352b4b11ee7324d ]
REGMAP is a hidden (not user visible) symbol. Users cannot set it directly thru "make *config", so drivers should select it instead of depending on it if they need it.
Consistently using "select" or "depends on" can also help reduce Kconfig circular dependency issues.
Therefore, change the use of "depends on REGMAP" to "select REGMAP".
--- drivers/tty/serial/8250/Kconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/tty/serial/8250/Kconfig +2 -1
@@ -254,8 +254,9 @@ config SERIAL_8250_ASPEED_VUART tristate "Aspeed Virtual UART" depends on SERIAL_8250 depends on OF - depends on REGMAP && MFD_SYSCON + depends on MFD_SYSCON depends on ARCH_ASPEED || COMPILE_TEST + select REGMAP help If you want to use the virtual UART (VUART) device on Aspeed BMC platforms, enable this option. This enables the 16550A-
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 17/173 drm/sun4i: fix missing component unbind on bind errors
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
[ Upstream commit c22f2ff8724b49dce2ae797e9fbf4bc0fa91112f ]
Make sure to unbind all subcomponents when binding the aggregate device fails.
--- drivers/gpu/drm/sun4i/sun4i_drv.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/sun4i/sun4i_drv.c +3 -1
@@ -93,7 +93,7 @@ static int sun4i_drv_bind(struct device *dev)/* drm_vblank_init calls kcalloc, which can fail */ ret =drm_vblank_init (drm, drm->mode_config.num_crtc);if (ret) - goto cleanup_mode_config; + goto unbind_all; drm->irq_enabled = true;
@@ -117,6 +117,8 @@ static int sun4i_drv_bind(struct device *dev) finish_poll:drm_kms_helper_poll_fini (drm); +unbind_all: +component_unbind_all (dev,NULL ); cleanup_mode_config:drm_mode_config_cleanup (drm);of_reserved_mem_device_release (dev);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 18/173 net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf()
In reply to Greg Kroah-HartmanFrom: Hangyu Hua <[email protected]>
commit 49c47cc21b5b7a3d8deb18fc57b0aa2ab1286962 upstream.
ctx->crypto_send.info is not protected by lock_sock in do_tls_getsockopt_conf(). A race condition between do_tls_getsockopt_conf() and error paths of do_tls_setsockopt_conf() may lead to a use-after-free or null-deref.
More discussion: https://lore.kernel.org/all/Y/ht6gQL+u6fj3dG@hog/
--- net/tls/tls_main.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
net/tls/tls_main.c +5 -4
@@ -386,13 +386,11 @@ static int do_tls_getsockopt_conf(struct sock *sk, char __user *optval, rc = -EINVAL ; goto out; } -lock_sock (sk);memcpy (crypto_info_aes_gcm_128->iv, cctx->iv +TLS_CIPHER_AES_GCM_128_SALT_SIZE ,TLS_CIPHER_AES_GCM_128_IV_SIZE );memcpy (crypto_info_aes_gcm_128->rec_seq, cctx->rec_seq,TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE ); -release_sock (sk);if (copy_to_user (optval, crypto_info_aes_gcm_128,sizeof (*crypto_info_aes_gcm_128)))
@@ -410,13 +408,11 @@ static int do_tls_getsockopt_conf(struct sock *sk, char __user *optval, rc = -EINVAL ; goto out; } -lock_sock (sk);memcpy (crypto_info_aes_gcm_256->iv, cctx->iv +TLS_CIPHER_AES_GCM_256_SALT_SIZE ,TLS_CIPHER_AES_GCM_256_IV_SIZE );memcpy (crypto_info_aes_gcm_256->rec_seq, cctx->rec_seq,TLS_CIPHER_AES_GCM_256_REC_SEQ_SIZE ); -release_sock (sk);if (copy_to_user (optval, crypto_info_aes_gcm_256,sizeof (*crypto_info_aes_gcm_256)))
@@ -436,6 +432,8 @@ static int do_tls_getsockopt(struct sock *sk, int optname, {int rc =0 ; +lock_sock (sk); +switch (optname) {case TLS_TX :case TLS_RX :
@@ -446,6 +444,9 @@ static int do_tls_getsockopt(struct sock *sk, int optname, rc = -ENOPROTOOPT ;break ; } + +release_sock (sk); +return rc; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 19/173 power: supply: bq24190_charger: using pm_runtime_resume_and_get instead of pm_runtime_get_sync
In reply to Greg Kroah-HartmanFrom: Minghao Chi <[email protected]>
[ Upstream commit d96a89407e5f682d1cb22569d91784506c784863 ]
Using pm_runtime_resume_and_get is more appropriate for simplifing code
Stable-dep-of: 47c29d692129 ("power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition")
--- drivers/power/supply/bq24190_charger.c | 63 +++++++++----------------- 1 file changed, 21 insertions(+), 42 deletions(-)
drivers/power/supply/bq24190_charger.c +21 -42
@@ -448,11 +448,9 @@ static ssize_t bq24190_sysfs_show(struct device *dev,if (!info)return -EINVAL ; - ret =pm_runtime_get_sync (bdi->dev); -if (ret <0 ) { -pm_runtime_put_noidle (bdi->dev); + ret =pm_runtime_resume_and_get (bdi->dev); +if (ret <0 )return ret; - } ret =bq24190_read_mask (bdi, info->reg, info->mask, info->shift, &v);if (ret)
@@ -483,11 +481,9 @@ static ssize_t bq24190_sysfs_store(struct device *dev,if (ret <0 )return ret; - ret =pm_runtime_get_sync (bdi->dev); -if (ret <0 ) { -pm_runtime_put_noidle (bdi->dev); + ret =pm_runtime_resume_and_get (bdi->dev); +if (ret <0 )return ret; - } ret =bq24190_write_mask (bdi, info->reg, info->mask, info->shift, v);if (ret)
@@ -506,10 +502,9 @@ static int bq24190_set_charge_mode(struct regulator_dev *dev, u8 val)struct bq24190_dev_info *bdi =rdev_get_drvdata (dev);int ret; - ret =pm_runtime_get_sync (bdi->dev); + ret =pm_runtime_resume_and_get (bdi->dev);if (ret <0 ) {dev_warn (bdi->dev,"pm_runtime_get failed: %i\n" , ret); -pm_runtime_put_noidle (bdi->dev);return ret; }
@@ -539,10 +534,9 @@ static int bq24190_vbus_is_enabled(struct regulator_dev *dev)int ret;u8 val; - ret =pm_runtime_get_sync (bdi->dev); + ret =pm_runtime_resume_and_get (bdi->dev);if (ret <0 ) {dev_warn (bdi->dev,"pm_runtime_get failed: %i\n" , ret); -pm_runtime_put_noidle (bdi->dev);return ret; }
@@ -1083,11 +1077,9 @@ static int bq24190_charger_get_property(struct power_supply *psy,dev_dbg (bdi->dev,"prop: %d\n" , psp); - ret =pm_runtime_get_sync (bdi->dev); -if (ret <0 ) { -pm_runtime_put_noidle (bdi->dev); + ret =pm_runtime_resume_and_get (bdi->dev); +if (ret <0 )return ret; - }switch (psp) {case POWER_SUPPLY_PROP_CHARGE_TYPE :
@@ -1157,11 +1149,9 @@ static int bq24190_charger_set_property(struct power_supply *psy,dev_dbg (bdi->dev,"prop: %d\n" , psp); - ret =pm_runtime_get_sync (bdi->dev); -if (ret <0 ) { -pm_runtime_put_noidle (bdi->dev); + ret =pm_runtime_resume_and_get (bdi->dev); +if (ret <0 )return ret; - }switch (psp) {case POWER_SUPPLY_PROP_ONLINE :
@@ -1420,11 +1410,9 @@ static int bq24190_battery_get_property(struct power_supply *psy,dev_warn (bdi->dev,"warning: /sys/class/power_supply/bq24190-battery is deprecated\n" );dev_dbg (bdi->dev,"prop: %d\n" , psp); - ret =pm_runtime_get_sync (bdi->dev); -if (ret <0 ) { -pm_runtime_put_noidle (bdi->dev); + ret =pm_runtime_resume_and_get (bdi->dev); +if (ret <0 )return ret; - }switch (psp) {case POWER_SUPPLY_PROP_STATUS :
@@ -1468,11 +1456,9 @@ static int bq24190_battery_set_property(struct power_supply *psy,dev_warn (bdi->dev,"warning: /sys/class/power_supply/bq24190-battery is deprecated\n" );dev_dbg (bdi->dev,"prop: %d\n" , psp); - ret =pm_runtime_get_sync (bdi->dev); -if (ret <0 ) { -pm_runtime_put_noidle (bdi->dev); + ret =pm_runtime_resume_and_get (bdi->dev); +if (ret <0 )return ret; - }switch (psp) {case POWER_SUPPLY_PROP_ONLINE :
@@ -1626,10 +1612,9 @@ static irqreturn_t bq24190_irq_handler_thread(int irq, void *data)int error; bdi->irq_event = true; - error =pm_runtime_get_sync (bdi->dev); + error =pm_runtime_resume_and_get (bdi->dev);if (error <0 ) {dev_warn (bdi->dev,"pm_runtime_get failed: %i\n" , error); -pm_runtime_put_noidle (bdi->dev);return IRQ_NONE ; }bq24190_check_status (bdi);
@@ -1849,11 +1834,9 @@ static int bq24190_remove(struct i2c_client *client)struct bq24190_dev_info *bdi =i2c_get_clientdata (client);int error; - error =pm_runtime_get_sync (bdi->dev); -if (error <0 ) { + error =pm_runtime_resume_and_get (bdi->dev); +if (error <0 )dev_warn (bdi->dev,"pm_runtime_get failed: %i\n" , error); -pm_runtime_put_noidle (bdi->dev); - }bq24190_register_reset (bdi);if (bdi->battery)
@@ -1902,11 +1885,9 @@ static __maybe_unused int bq24190_pm_suspend(struct device *dev)struct bq24190_dev_info *bdi =i2c_get_clientdata (client);int error; - error =pm_runtime_get_sync (bdi->dev); -if (error <0 ) { + error =pm_runtime_resume_and_get (bdi->dev); +if (error <0 )dev_warn (bdi->dev,"pm_runtime_get failed: %i\n" , error); -pm_runtime_put_noidle (bdi->dev); - }bq24190_register_reset (bdi);
@@ -1927,11 +1908,9 @@ static __maybe_unused int bq24190_pm_resume(struct device *dev) bdi->f_reg =0 ; bdi->ss_reg =BQ24190_REG_SS_VBUS_STAT_MASK ;/* impossible state */ - error =pm_runtime_get_sync (bdi->dev); -if (error <0 ) { + error =pm_runtime_resume_and_get (bdi->dev); +if (error <0 )dev_warn (bdi->dev,"pm_runtime_get failed: %i\n" , error); -pm_runtime_put_noidle (bdi->dev); - }bq24190_register_reset (bdi);bq24190_set_config (bdi);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 20/173 power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition
In reply to Greg Kroah-HartmanFrom: Zheng Wang <[email protected]>
[ Upstream commit 47c29d69212911f50bdcdd0564b5999a559010d4 ]
In bq24190_probe, &bdi->input_current_limit_work is bound with bq24190_input_current_limit_work. When external power changed, it will call bq24190_charger_external_power_changed
to start the work.
If we remove the module which will call bq24190_remove to make cleanup, there may be a unfinished work. The possible sequence is as follows:
CPU0 CPUc1
|bq24190_input_current_limit_work
bq24190_remove |power_supply_unregister |device_unregister |
power_supply_dev_release|
kfree(psy) |
|
| power_supply_get_property_from_supplier
| //useFix it by finishing the work before cleanup in the bq24190_remove
--- drivers/power/supply/bq24190_charger.c | 1 + 1 file changed, 1 insertion(+)
drivers/power/supply/bq24190_charger.c +1 -0
@@ -1834,6 +1834,7 @@ static int bq24190_remove(struct i2c_client *client)struct bq24190_dev_info *bdi =i2c_get_clientdata (client);int error; +cancel_delayed_work_sync (&bdi->input_current_limit_work); error =pm_runtime_resume_and_get (bdi->dev);if (error <0 )dev_warn (bdi->dev,"pm_runtime_get failed: %i\n" , error);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 21/173 power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition
In reply to Greg Kroah-HartmanFrom: Zheng Wang <[email protected]>
[ Upstream commit 06615d11cc78162dfd5116efb71f29eb29502d37 ]
In da9150_charger_probe, &charger->otg_work is bound with da9150_charger_otg_work. da9150_charger_otg_ncb may be called to start the work.
If we remove the module which will call da9150_charger_remove to make cleanup, there may be a unfinished work. The possible sequence is as follows:
Fix it by canceling the work before cleanup in the da9150_charger_remove
CPU0 CPUc1
|da9150_charger_otg_work
da9150_charger_remove |power_supply_unregister |device_unregister |
power_supply_dev_release|
kfree(psy) |
|
| power_supply_changed(charger->usb);
| //use--- drivers/power/supply/da9150-charger.c | 1 + 1 file changed, 1 insertion(+)
drivers/power/supply/da9150-charger.c +1 -0
@@ -662,6 +662,7 @@ static int da9150_charger_remove(struct platform_device *pdev)if (!IS_ERR_OR_NULL (charger->usb_phy))usb_unregister_notifier (charger->usb_phy, &charger->otg_nb); +cancel_work_sync (&charger->otg_work);power_supply_unregister (charger->battery);power_supply_unregister (charger->usb);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 22/173 ARM: dts: imx6sll: e60k02: fix usbotg1 pinctrl
In reply to Greg Kroah-HartmanFrom: Peng Fan <[email protected]>
[ Upstream commit 957c04e9784c7c757e8cc293d7fb2a60cdf461b6 ]
usb@2184000: 'pinctrl-0' is a dependency of 'pinctrl-names'
--- arch/arm/boot/dts/e60k02.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/dts/e60k02.dtsi +1 -0
@@ -296,6 +296,7 @@ &usdhc3 { &usbotg1 { pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_usbotg1>; disable-over-current; srp-disable; hnp-disable;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 23/173 ARM: dts: imx6sl: tolino-shine2hd: fix usbotg1 pinctrl
In reply to Greg Kroah-HartmanFrom: Peng Fan <[email protected]>
[ Upstream commit 1cd489e1ada1cffa56bd06fd4609f5a60a985d43 ]
usb@2184000: 'pinctrl-0' is a dependency of 'pinctrl-names'
--- arch/arm/boot/dts/imx6sl-tolino-shine2hd.dts | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/dts/imx6sl-tolino-shine2hd.dts +1 -0
@@ -580,6 +580,7 @@ &usdhc3 { &usbotg1 { pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_usbotg1>; disable-over-current; srp-disable; hnp-disable;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 24/173 xsk: Add missing overflow check in xdp_umem_reg
In reply to Greg Kroah-HartmanFrom: Kal Conley <[email protected]>
[ Upstream commit c7df4813b149362248d6ef7be41a311e27bf75fe ]
The number of chunks can overflow u32. Make sure to return -EINVAL on overflow. Also remove a redundant u32 cast assigning umem->npgs.
--- net/xdp/xdp_umem.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
net/xdp/xdp_umem.c +7 -6
@@ -153,10 +153,11 @@ static int xdp_umem_account_pages(struct xdp_umem *umem)static int xdp_umem_reg (struct xdp_umem *umem,struct xdp_umem_reg *mr) { -u32 npgs_rem, chunk_size = mr->chunk_size, headroom = mr->headroom;bool unaligned_chunks = mr->flags &XDP_UMEM_UNALIGNED_CHUNK_FLAG ; -u64 npgs, addr = mr->addr, size = mr->len; -unsigned int chunks, chunks_rem; +u32 chunk_size = mr->chunk_size, headroom = mr->headroom; +u64 addr = mr->addr, size = mr->len; +u32 chunks_rem, npgs_rem; +u64 chunks, npgs;int err;if (chunk_size <XDP_UMEM_MIN_CHUNK_SIZE || chunk_size >PAGE_SIZE ) {
@@ -191,8 +192,8 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr)if (npgs >U32_MAX )return -EINVAL ; - chunks = (unsigned int )div_u64_rem (size, chunk_size, &chunks_rem); -if (chunks ==0 ) + chunks =div_u64_rem (size, chunk_size, &chunks_rem); +if (!chunks || chunks >U32_MAX )return -EINVAL ;if (!unaligned_chunks && chunks_rem)
@@ -205,7 +206,7 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr) umem->headroom = headroom; umem->chunk_size = chunk_size; umem->chunks = chunks; - umem->npgs = (u32 )npgs; + umem->npgs = npgs; umem->pgs =NULL ; umem->user =NULL ; umem->flags = mr->flags;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 25/173 iavf: fix inverted Rx hash condition leading to disabled hash
In reply to Greg Kroah-HartmanFrom: Alexander Lobakin <[email protected]>
[ Upstream commit 32d57f667f871bc5a8babbe27ea4c5e668ee0ea8 ]
Condition, which checks whether the netdev has hashing enabled is inverted. Basically, the tagged commit effectively disabled passing flow hash from descriptor to skb, unless user *disables* it via Ethtool. Commit a876c3ba59a6 ("i40e/i40evf: properly report Rx packet hash") fixed this problem, but only for i40e.
Invert the condition now in iavf and unblock passing hash to skbs again.
--- drivers/net/ethernet/intel/iavf/iavf_txrx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/iavf/iavf_txrx.c +1 -1
@@ -1061,7 +1061,7 @@ static inline void iavf_rx_hash(struct iavf_ring *ring,cpu_to_le64 ((u64 )IAVF_RX_DESC_FLTSTAT_RSS_HASH <<IAVF_RX_DESC_STATUS_FLTSTAT_SHIFT ); -if (ring->netdev->features &NETIF_F_RXHASH ) +if (!(ring->netdev->features &NETIF_F_RXHASH ))return ;if ((rx_desc->wb.qword1.status_error_len & rss_mask) == rss_mask) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 26/173 iavf: fix non-tunneled IPv6 UDP packet type and hashing
In reply to Greg Kroah-HartmanFrom: Alexander Lobakin <[email protected]>
[ Upstream commit de58647b4301fe181f9c38e8b46f7021584ae427 ]
Currently, IAVF's decode_rx_desc_ptype() correctly reports payload type of L4 for IPv4 UDP packets and IPv{4,6} TCP, but only L3 for IPv6 UDP. Originally, i40e, ice and iavf were affected.
Commit 73df8c9e3e3d ("i40e: Correct UDP packet header for non_tunnel-ipv6") fixed that in i40e, then
commit 638a0c8c8861 ("ice: fix incorrect payload indicator on PTYPE") fixed that for ice.
IPv6 UDP is L4 obviously. Fix it and make iavf report correct L4 hash type for such packets, so that the stack won't calculate it on CPU when needs it.
--- drivers/net/ethernet/intel/iavf/iavf_common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/iavf/iavf_common.c +1 -1
@@ -662,7 +662,7 @@ struct iavf_rx_ptype_decoded iavf_ptype_lookup[] = {/* Non Tunneled IPv6 */ IAVF_PTT (88 ,IP ,IPV6 ,FRG ,NONE ,NONE ,NOF ,NONE ,PAY3 ),IAVF_PTT (89 ,IP ,IPV6 ,NOF ,NONE ,NONE ,NOF ,NONE ,PAY3 ), -IAVF_PTT (90 ,IP ,IPV6 ,NOF ,NONE ,NONE ,NOF ,UDP ,PAY3 ), +IAVF_PTT (90 ,IP ,IPV6 ,NOF ,NONE ,NONE ,NOF ,UDP ,PAY4 ),IAVF_PTT_UNUSED_ENTRY (91 ),IAVF_PTT (92 ,IP ,IPV6 ,NOF ,NONE ,NONE ,NOF ,TCP ,PAY4 ), IAVF_PTT(93, IP, IPV6, NOF, NONE, NONE, NOF, SCTP, PAY4),
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 27/173 intel/igbvf: free irq on the error path in igbvf_request_msix()
In reply to Greg Kroah-HartmanFrom: Gaosheng Cui <[email protected]>
[ Upstream commit 85eb39bb39cbb5c086df1e19ba67cc1366693a77 ]
In igbvf_request_msix(), irqs have not been freed on the err path, we need to free it. Fix it.
--- drivers/net/ethernet/intel/igbvf/netdev.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/igbvf/netdev.c +6 -2
@@ -1074,7 +1074,7 @@ static int igbvf_request_msix(struct igbvf_adapter *adapter) igbvf_intr_msix_rx,0 , adapter->rx_ring->name, netdev);if (err) - goto out; + goto free_irq_tx; adapter->rx_ring->itr_register =E1000_EITR (vector); adapter->rx_ring->itr_val = adapter->current_itr;
@@ -1083,10 +1083,14 @@ static int igbvf_request_msix(struct igbvf_adapter *adapter) err =request_irq (adapter->msix_entries[vector].vector, igbvf_msix_other,0 , netdev->name, netdev);if (err) - goto out; + goto free_irq_rx;igbvf_configure_msix (adapter);return 0 ; +free_irq_rx: +free_irq (adapter->msix_entries[--vector].vector, netdev); +free_irq_tx: +free_irq (adapter->msix_entries[--vector].vector, netdev); out:return err; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 28/173 igbvf: Regard vf reset nack as success
In reply to Greg Kroah-HartmanFrom: Akihiko Odaki <[email protected]>
[ Upstream commit 02c83791ef969c6a8a150b4927193d0d0e50fb23 ]
vf reset nack actually represents the reset operation itself is performed but no address is assigned. Therefore, e1000_reset_hw_vf should fill the "perm_addr" with the zero address and return success on such an occasion. This prevents its callers in netdev.c from saying PF still resetting, and instead allows them to correctly report that no address is assigned.
--- drivers/net/ethernet/intel/igbvf/vf.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
drivers/net/ethernet/intel/igbvf/vf.c +10 -3
@@ -1,6 +1,8 @@// SPDX-License-Identifier: GPL-2.0 /* Copyright(c) 2009 - 2018 Intel Corporation. */ +#include <linux/etherdevice.h> +#include "vf.h" static s32 e1000_check_for_link_vf (struct e1000_hw *hw);
@@ -131,11 +133,16 @@ static s32 e1000_reset_hw_vf(struct e1000_hw *hw)/* set our "perm_addr" based on info provided by PF */ ret_val = mbx->ops.read_posted (hw, msgbuf,3 );if (!ret_val) { -if (msgbuf[0 ] == (E1000_VF_RESET | -E1000_VT_MSGTYPE_ACK )) +switch (msgbuf[0 ]) { +case E1000_VF_RESET |E1000_VT_MSGTYPE_ACK :memcpy (hw->mac.perm_addr, addr,ETH_ALEN ); -else +break ; +case E1000_VF_RESET |E1000_VT_MSGTYPE_NACK : +eth_zero_addr (hw->mac.perm_addr); +break ; +default : ret_val = -E1000_ERR_MAC_INIT ; + } } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 29/173 igc: fix the validation logic for taprios gate list
In reply to Greg Kroah-HartmanFrom: AKASHI Takahiro <[email protected]>
[ Upstream commit 2b4cc3d3f4d8ec42961e98568a0afeee96a943ab ]
The check introduced in the commit a5fd39464a40 ("igc: Lift TAPRIO schedule restriction") can detect a false positive error in some corner case. For instance,
tc qdisc replace ... taprio num_tc 4 ... sched-entry S 0x01 100000 # slot#1 sched-entry S 0x03 100000 # slot#2 sched-entry S 0x04 100000 # slot#3 sched-entry S 0x08 200000 # slot#4 flags 0x02 # hardware offload
Here the queue#0 (the first queue) is on at the slot#1 and #2, and off at the slot#3 and #4. Under the current logic, when the slot#4 is examined, validate_schedule() returns *false* since the enablement count for the queue#0 is two and it is already off at the previous slot (i.e. #3). But this definition is truely correct.
Let's fix the logic to enforce a strict validation for consecutively-opened slots.
--- drivers/net/ethernet/intel/igc/igc_main.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
drivers/net/ethernet/intel/igc/igc_main.c +10 -10
@@ -4874,18 +4874,18 @@ static bool validate_schedule(struct igc_adapter *adapter,if (e->command !=TC_TAPRIO_CMD_SET_GATES )return false; -for (i =0 ; i < adapter->num_tx_queues; i++) { -if (e->gate_mask &BIT (i)) +for (i =0 ; i < adapter->num_tx_queues; i++) +if (e->gate_mask &BIT (i)) { queue_uses[i]++; -/* There are limitations: A single queue cannot be -* opened and closed multiple times per cycle unless the -* gate stays open. Check for it. -*/ -if (queue_uses[i] >1 && - !(prev->gate_mask &BIT (i))) -return false; - } +/* There are limitations: A single queue cannot +* be opened and closed multiple times per cycle +* unless the gate stays open. Check for it. +*/ +if (queue_uses[i] >1 && + !(prev->gate_mask &BIT (i))) +return false; + } }return true;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 30/173 i2c: imx-lpi2c: check only for enabled interrupt flags
In reply to Greg Kroah-HartmanFrom: Alexander Stein <[email protected]>
[ Upstream commit 1c7885004567e8951d65a983be095f254dd20bef ]
When reading from I2C, the Tx watermark is set to 0. Unfortunately the TDF (transmit data flag) is enabled when Tx FIFO entries is equal or less than watermark. So it is set in every case, hence the reset default of 1. This results in the MSR_RDF _and_ MSR_TDF flags to be set thus trying to send Tx data on a read message.
Mask the IRQ status to filter for wanted flags only.
--- drivers/i2c/busses/i2c-imx-lpi2c.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/i2c/busses/i2c-imx-lpi2c.c +4 -0
@@ -502,10 +502,14 @@ static int lpi2c_imx_xfer(struct i2c_adapter *adapter,static irqreturn_t lpi2c_imx_isr (int irq,void *dev_id) {struct lpi2c_imx_struct *lpi2c_imx = dev_id; +unsigned int enabled;unsigned int temp; + enabled =readl (lpi2c_imx->base +LPI2C_MIER ); +lpi2c_imx_intctrl (lpi2c_imx,0 ); temp =readl (lpi2c_imx->base +LPI2C_MSR ); + temp &= enabled;if (temp &MSR_RDF )lpi2c_imx_read_rxfifo (lpi2c_imx);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 31/173 scsi: scsi_dh_alua: Fix memleak for qdata in alua_activate()
In reply to Greg Kroah-HartmanFrom: Yu Kuai <[email protected]>
[ Upstream commit a13faca032acbf2699293587085293bdfaafc8ae ]
If alua_rtpg_queue() failed from alua_activate(), then 'qdata' is not freed, which will cause following memleak:
unreferenced object 0xffff88810b2c6980 (size 32):
comm "kworker/u16:2", pid 635322, jiffies 4355801099 (age 1216426.076s) hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
40 39 24 c1 ff ff ff ff 00 f8 ea 0a 81 88 ff ff @9$.............
backtrace:
[<0000000098f3a26d>] alua_activate+0xb0/0x320
[<000000003b529641>] scsi_dh_activate+0xb2/0x140
[<000000007b296db3>] activate_path_work+0xc6/0xe0 [dm_multipath]
[<000000007adc9ace>] process_one_work+0x3c5/0x730
[<00000000c457a985>] worker_thread+0x93/0x650
[<00000000cb80e628>] kthread+0x1ba/0x210
[<00000000a1e61077>] ret_from_fork+0x22/0x30Fix the problem by freeing 'qdata' in error path.
--- drivers/scsi/device_handler/scsi_dh_alua.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/scsi/device_handler/scsi_dh_alua.c +4 -2
@@ -1036,10 +1036,12 @@ static int alua_activate(struct scsi_device *sdev,rcu_read_unlock ();mutex_unlock (&h->init_mutex); -if (alua_rtpg_queue (pg, sdev, qdata, true)) +if (alua_rtpg_queue (pg, sdev, qdata, true)) { fn =NULL ; -else + }else { +kfree (qdata); err =SCSI_DH_DEV_OFFLINED ; + }kref_put (&pg->kref, release_port_group); out:if (fn)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 32/173 net: usb: smsc95xx: Limit packet length to skb->len
In reply to Greg Kroah-HartmanFrom: Szymon Heidrich <[email protected]>
[ Upstream commit ff821092cf02a70c2bccd2d19269f01e29aa52cf ]
Packet length retrieved from descriptor may be larger than the actual socket buffer length. In such case the cloned skb passed up the network stack will leak kernel memory contents.
--- drivers/net/usb/smsc95xx.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/usb/smsc95xx.c +6 -0
@@ -1824,6 +1824,12 @@ static int smsc95xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb) size = (u16)((header &RX_STS_FL_ ) >>16 ); align_count = (4 - ((size +NET_IP_ALIGN ) %4 )) %4 ; +if (unlikely (size > skb->len)) { +netif_dbg (dev, rx_err, dev->net, +"size err header=0x%08x\n" , header); +return 0 ; + } +if (unlikely (header &RX_STS_ES_ )) {netif_dbg (dev, rx_err, dev->net,"Error header=0x%08x\n" , header);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 33/173 qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info
In reply to Greg Kroah-HartmanFrom: Daniil Tatianin <[email protected]>
[ Upstream commit 25143b6a01d0cc5319edd3de22ffa2578b045550 ]
We have to make sure that the info returned by the helper is valid before using it.
Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool.
--- drivers/net/ethernet/qlogic/qed/qed_sriov.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/qlogic/qed/qed_sriov.c +4 -1
@@ -4378,6 +4378,9 @@ qed_iov_configure_min_tx_rate(struct qed_dev *cdev, int vfid, u32 rate) } vf =qed_iov_get_vf_info (QED_LEADING_HWFN (cdev), (u16 )vfid, true); +if (!vf) +return -EINVAL ; + vport_id = vf->vport_id;return qed_configure_vport_wfq (cdev, vport_id, rate);
@@ -5123,7 +5126,7 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn)/* Validate that the VF has a configured vport */ vf =qed_iov_get_vf_info (hwfn, i, true); -if (!vf->vport_instance) +if (!vf || !vf->vport_instance)continue ;memset (¶ms,0 ,sizeof (params));
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 34/173 xirc2ps_cs: Fix use after free bug in xirc2ps_detach
In reply to Greg Kroah-HartmanFrom: Zheng Wang <[email protected]>
[ Upstream commit e8d20c3ded59a092532513c9bd030d1ea66f5f44 ]
In xirc2ps_probe, the local->tx_timeout_task was bounded with xirc2ps_tx_timeout_task. When timeout occurs, it will call xirc_tx_timeout->schedule_work to start the work.
When we call xirc2ps_detach to remove the driver, there may be a sequence as follows:
Stop responding to timeout tasks and complete scheduled tasks before cleanup in xirc2ps_detach, which will fix the problem.
CPU0 CPU1
|xirc2ps_tx_timeout_task
xirc2ps_detach |
free_netdev |
kfree(dev); |
|
| do_reset
| //use dev--- drivers/net/ethernet/xircom/xirc2ps_cs.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/xircom/xirc2ps_cs.c +5 -0
@@ -503,6 +503,11 @@ static void xirc2ps_detach(struct pcmcia_device *link) {struct net_device *dev = link->priv; +struct local_info *local =netdev_priv (dev); + +netif_carrier_off (dev); +netif_tx_disable (dev); +cancel_work_sync (&local->tx_timeout_task);dev_dbg (&link->dev,"detach\n" );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 35/173 net: phy: Ensure state transitions are processed from phy_stop()
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit 4203d84032e28f893594a453bd8bc9c3b15c7334 ]
In the phy_disconnect() -> phy_stop() path, we will be forcibly setting the PHY state machine to PHY_HALTED. This invalidates the old_state != phydev->state condition in phy_state_machine() such that we will neither display the state change for debugging, nor will we invoke the link_change_notify() callback.
Factor the code by introducing phy_process_state_change(), and ensure that we process the state change from phy_stop() as well.
--- drivers/net/phy/phy.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-)
drivers/net/phy/phy.c +16 -7
@@ -56,6 +56,18 @@ static const char *phy_state_to_str(enum phy_state st)return NULL ; } +static void phy_process_state_change (struct phy_device *phydev, +enum phy_state old_state) +{ +if (old_state != phydev->state) { +phydev_dbg (phydev,"PHY state change %s -> %s\n" , +phy_state_to_str (old_state), +phy_state_to_str (phydev->state)); +if (phydev->drv && phydev->drv->link_change_notify) + phydev->drv->link_change_notify (phydev); + } +} +static void phy_link_up (struct phy_device *phydev) { phydev->phy_link_change (phydev, true);
@@ -1110,6 +1122,7 @@ EXPORT_SYMBOL(phy_free_interrupt);void phy_stop (struct phy_device *phydev) {struct net_device *dev = phydev->attached_dev; +enum phy_state old_state;if (!phy_is_started (phydev) && phydev->state !=PHY_DOWN ) { WARN(1, "called from state %s\n",
@@ -1118,6 +1131,7 @@ void phy_stop(struct phy_device *phydev) }mutex_lock (&phydev->lock); + old_state = phydev->state;if (phydev->state ==PHY_CABLETEST ) {phy_abort_cable_test (phydev);
@@ -1128,6 +1142,7 @@ void phy_stop(struct phy_device *phydev)sfp_upstream_stop (phydev->sfp_bus); phydev->state =PHY_HALTED ; +phy_process_state_change (phydev, old_state);mutex_unlock (&phydev->lock);
@@ -1242,13 +1257,7 @@ void phy_state_machine(struct work_struct *work)if (err <0 )phy_error (phydev); -if (old_state != phydev->state) { -phydev_dbg (phydev,"PHY state change %s -> %s\n" , -phy_state_to_str (old_state), -phy_state_to_str (phydev->state)); -if (phydev->drv && phydev->drv->link_change_notify) - phydev->drv->link_change_notify (phydev); - } +phy_process_state_change (phydev, old_state);/* Only re-schedule a PHY state machine change if we are polling the * PHY, if PHY_IGNORE_INTERRUPT is set, then we will be moving
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 36/173 net: mdio: fix owner field for mdio buses registered using device-tree
In reply to Greg Kroah-HartmanFrom: Maxime Bizon <[email protected]>
[ Upstream commit 99669259f3361d759219811e670b7e0742668556 ]
Bus ownership is wrong when using of_mdiobus_register() to register an mdio bus. That function is not inline, so when it calls mdiobus_register() the wrong THIS_MODULE value is captured.
--- drivers/net/mdio/of_mdio.c | 12 +++++++----- drivers/net/phy/mdio_devres.c | 11 ++++++----- include/linux/of_mdio.h | 22 +++++++++++++++++++--- 3 files changed, 32 insertions(+), 13 deletions(-)
drivers/net/mdio/of_mdio.c +7 -5
@@ -238,21 +238,23 @@ bool of_mdiobus_child_is_phy(struct device_node *child)EXPORT_SYMBOL (of_mdiobus_child_is_phy);/** -* of_mdiobus_register - Register mii_bus and create PHYs from the device tree +* __of_mdiobus_register - Register mii_bus and create PHYs from the device tree * @mdio: pointer to mii_bus structure * @np: pointer to device_node of MDIO bus. +* @owner: module owning the @mdio object. * * This function registers the mii_bus structure and registers a phy_device * for each child node of @np. */ -int of_mdiobus_register (struct mii_bus *mdio,struct device_node *np) +int __of_mdiobus_register (struct mii_bus *mdio,struct device_node *np, +struct module *owner) {struct device_node *child;bool scanphys = false;int addr, rc;if (!np) -return mdiobus_register (mdio); +return __mdiobus_register (mdio, owner);/* Do not continue if the node is disabled */ if (!of_device_is_available (np))
@@ -272,7 +274,7 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np)of_property_read_u32 (np,"reset-post-delay-us" , &mdio->reset_post_delay_us);/* Register the MDIO bus */ - rc =mdiobus_register (mdio); + rc =__mdiobus_register (mdio, owner);if (rc)return rc;
@@ -336,7 +338,7 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np)mdiobus_unregister (mdio);return rc; } -EXPORT_SYMBOL (of_mdiobus_register); +EXPORT_SYMBOL (__of_mdiobus_register);/** * of_mdio_find_device - Given a device tree node, find the mdio_device
drivers/net/phy/mdio_devres.c +6 -5
@@ -98,13 +98,14 @@ EXPORT_SYMBOL(__devm_mdiobus_register);#if IS_ENABLED (CONFIG_OF_MDIO )/** -* devm_of_mdiobus_register - Resource managed variant of of_mdiobus_register() +* __devm_of_mdiobus_register - Resource managed variant of of_mdiobus_register() * @dev: Device to register mii_bus for * @mdio: MII bus structure to register * @np: Device node to parse +* @owner: Owning module */ -int devm_of_mdiobus_register (struct device *dev,struct mii_bus *mdio, -struct device_node *np) +int __devm_of_mdiobus_register (struct device *dev,struct mii_bus *mdio, +struct device_node *np,struct module *owner) {struct mdiobus_devres *dr;int ret;
@@ -117,7 +118,7 @@ int devm_of_mdiobus_register(struct device *dev, struct mii_bus *mdio,if (!dr)return -ENOMEM ; - ret =of_mdiobus_register (mdio, np); + ret =__of_mdiobus_register (mdio, np, owner);if (ret) {devres_free (dr);return ret;
@@ -127,7 +128,7 @@ int devm_of_mdiobus_register(struct device *dev, struct mii_bus *mdio,devres_add (dev, dr); return 0; } -EXPORT_SYMBOL (devm_of_mdiobus_register); +EXPORT_SYMBOL (__devm_of_mdiobus_register);#endif /* CONFIG_OF_MDIO */ MODULE_LICENSE ("GPL" );
include/linux/of_mdio.h +19 -3
@@ -14,9 +14,25 @@#if IS_ENABLED (CONFIG_OF_MDIO )bool of_mdiobus_child_is_phy (struct device_node *child); -int of_mdiobus_register (struct mii_bus *mdio,struct device_node *np); -int devm_of_mdiobus_register (struct device *dev,struct mii_bus *mdio, -struct device_node *np); +int __of_mdiobus_register (struct mii_bus *mdio,struct device_node *np, +struct module *owner); + +static inline int of_mdiobus_register (struct mii_bus *mdio, +struct device_node *np) +{ +return __of_mdiobus_register (mdio, np,THIS_MODULE ); +} + +int __devm_of_mdiobus_register (struct device *dev,struct mii_bus *mdio, +struct device_node *np,struct module *owner); + +static inline int devm_of_mdiobus_register (struct device *dev, +struct mii_bus *mdio, +struct device_node *np) +{ +return __devm_of_mdiobus_register (dev, mdio, np,THIS_MODULE ); +} +struct mdio_device *of_mdio_find_device (struct device_node *np);struct phy_device *of_phy_find_device (struct device_node *phy_np); struct phy_device *
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 37/173 net: qcom/emac: Fix use after free bug in emac_remove due to race condition
In reply to Greg Kroah-HartmanFrom: Zheng Wang <[email protected]>
[ Upstream commit 6b6bc5b8bd2d4ca9e1efa9ae0f98a0b0687ace75 ]
In emac_probe, &adpt->work_thread is bound with emac_work_thread. Then it will be started by timeout handler emac_tx_timeout or a IRQ handler emac_isr.
If we remove the driver which will call emac_remove
to make cleanup, there may be a unfinished work.
The possible sequence is as follows:
Fix it by finishing the work before cleanup in the emac_remove and disable timeout response.
CPU0 CPU1
|emac_work_thread
emac_remove |
free_netdev |
kfree(netdev); |
|emac_reinit_locked
|emac_mac_down
|//use netdev--- drivers/net/ethernet/qualcomm/emac/emac.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/ethernet/qualcomm/emac/emac.c +6 -0
@@ -728,9 +728,15 @@ static int emac_remove(struct platform_device *pdev)struct net_device *netdev =dev_get_drvdata (&pdev->dev);struct emac_adapter *adpt =netdev_priv (netdev); +netif_carrier_off (netdev); +netif_tx_disable (netdev); +unregister_netdev (netdev);netif_napi_del (&adpt->rx_q.napi); +free_irq (adpt->irq.irq, &adpt->irq); +cancel_work_sync (&adpt->work_thread); +emac_clks_teardown (adpt);put_device (&adpt->phydev->mdio.dev);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 38/173 net/ps3_gelic_net: Fix RX sk_buff length
In reply to Greg Kroah-HartmanFrom: Geoff Levand <[email protected]>
[ Upstream commit 19b3bb51c3bc288b3f2c6f8c4450b0f548320625 ]
The Gelic Ethernet device needs to have the RX sk_buffs aligned to GELIC_NET_RXBUF_ALIGN, and also the length of the RX sk_buffs must be a multiple of GELIC_NET_RXBUF_ALIGN.
The current Gelic Ethernet driver was not allocating sk_buffs large enough to allow for this alignment.
Also, correct the maximum and minimum MTU sizes, and add a new preprocessor macro for the maximum frame size, GELIC_NET_MAX_FRAME.
Fixes various randomly occurring runtime network errors.
--- drivers/net/ethernet/toshiba/ps3_gelic_net.c | 19 ++++++++++--------- drivers/net/ethernet/toshiba/ps3_gelic_net.h | 5 +++-- 2 files changed, 13 insertions(+), 11 deletions(-)
drivers/net/ethernet/toshiba/ps3_gelic_net.c +10 -9
@@ -365,26 +365,27 @@ static int gelic_card_init_chain(struct gelic_card *card,* * allocates a new rx skb, iommu-maps it and attaches it to the descriptor. * Activate the descriptor state-wise +* +* Gelic RX sk_buffs must be aligned to GELIC_NET_RXBUF_ALIGN and the length +* must be a multiple of GELIC_NET_RXBUF_ALIGN. */ static int gelic_descr_prepare_rx (struct gelic_card *card,struct gelic_descr *descr) { +static const unsigned int rx_skb_size = +ALIGN (GELIC_NET_MAX_FRAME ,GELIC_NET_RXBUF_ALIGN ) + +GELIC_NET_RXBUF_ALIGN -1 ;int offset; -unsigned int bufsize;if (gelic_descr_get_status (descr) !=GELIC_DESCR_DMA_NOT_IN_USE )dev_info (ctodev (card),"%s: ERROR status\n" , __func__); -/* we need to round up the buffer size to a multiple of 128 */ - bufsize =ALIGN (GELIC_NET_MAX_MTU ,GELIC_NET_RXBUF_ALIGN ); -/* and we need to have it 128 byte aligned, therefore we allocate a -* bit more */ - descr->skb =dev_alloc_skb (bufsize +GELIC_NET_RXBUF_ALIGN -1 ); + descr->skb =netdev_alloc_skb (*card->netdev, rx_skb_size);if (!descr->skb) { descr->buf_addr =0 ;/* tell DMAC don't touch memory */ return -ENOMEM ; } - descr->buf_size =cpu_to_be32 (bufsize); + descr->buf_size =cpu_to_be32 (rx_skb_size); descr->dmac_cmd_status =0 ; descr->result_size =0 ; descr->valid_size =0 ;
@@ -397,7 +398,7 @@ static int gelic_descr_prepare_rx(struct gelic_card *card,/* io-mmu-map the skb */ descr->buf_addr =cpu_to_be32 (dma_map_single (ctodev (card), descr->skb->data, -GELIC_NET_MAX_MTU , +GELIC_NET_MAX_FRAME ,DMA_FROM_DEVICE ));if (!descr->buf_addr) {dev_kfree_skb_any (descr->skb);
@@ -915,7 +916,7 @@ static void gelic_net_pass_skb_up(struct gelic_descr *descr, data_error =be32_to_cpu (descr->data_error);/* unmap skb buffer */ dma_unmap_single (ctodev (card),be32_to_cpu (descr->buf_addr), -GELIC_NET_MAX_MTU , +GELIC_NET_MAX_FRAME ,DMA_FROM_DEVICE ); skb_put(skb, be32_to_cpu(descr->valid_size)?
drivers/net/ethernet/toshiba/ps3_gelic_net.h +3 -2
@@ -19,8 +19,9 @@#define GELIC_NET_RX_DESCRIPTORS 128/* num of descriptors */ #define GELIC_NET_TX_DESCRIPTORS 128/* num of descriptors */ -#define GELIC_NET_MAX_MTU VLAN_ETH_FRAME_LEN -#define GELIC_NET_MIN_MTU VLAN_ETH_ZLEN +#define GELIC_NET_MAX_FRAME 2312 +#define GELIC_NET_MAX_MTU 2294 +#define GELIC_NET_MIN_MTU 64#define GELIC_NET_RXBUF_ALIGN 128#define GELIC_CARD_RX_CSUM_DEFAULT 1/* hw chksum */ #define GELIC_NET_WATCHDOG_TIMEOUT 5*HZ
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 39/173 net/ps3_gelic_net: Use dma_mapping_error
In reply to Greg Kroah-HartmanFrom: Geoff Levand <[email protected]>
[ Upstream commit bebe933d35a63d4f042fbf4dce4f22e689ba0fcd ]
The current Gelic Etherenet driver was checking the return value of its dma_map_single call, and not using the dma_mapping_error() routine.
Fixes runtime problems like these:
DMA-API: ps3_gelic_driver sb_05: device driver failed to check map error
WARNING: CPU: 0 PID: 0 at kernel/dma/debug.c:1027 .check_unmap+0x888/0x8dc
--- drivers/net/ethernet/toshiba/ps3_gelic_net.c | 24 +++++++++++--------- 1 file changed, 13 insertions(+), 11 deletions(-)
drivers/net/ethernet/toshiba/ps3_gelic_net.c +13 -11
@@ -317,15 +317,17 @@ static int gelic_card_init_chain(struct gelic_card *card,/* set up the hardware pointers in each descriptor */ for (i =0 ; i < no; i++, descr++) { +dma_addr_t cpu_addr; +gelic_descr_set_status (descr,GELIC_DESCR_DMA_NOT_IN_USE ); - descr->bus_addr = -dma_map_single (ctodev (card), descr, -GELIC_DESCR_SIZE , -DMA_BIDIRECTIONAL ); -if (!descr->bus_addr) + cpu_addr =dma_map_single (ctodev (card), descr, +GELIC_DESCR_SIZE ,DMA_BIDIRECTIONAL ); + +if (dma_mapping_error (ctodev (card), cpu_addr)) goto iommu_error; + descr->bus_addr =cpu_to_be32 (cpu_addr); descr->next = descr +1 ; descr->prev = descr -1 ; }
@@ -375,6 +377,7 @@ static int gelic_descr_prepare_rx(struct gelic_card *card,static const unsigned int rx_skb_size =ALIGN (GELIC_NET_MAX_FRAME ,GELIC_NET_RXBUF_ALIGN ) +GELIC_NET_RXBUF_ALIGN -1 ; +dma_addr_t cpu_addr;int offset;if (gelic_descr_get_status (descr) !=GELIC_DESCR_DMA_NOT_IN_USE )
@@ -396,11 +399,10 @@ static int gelic_descr_prepare_rx(struct gelic_card *card,if (offset)skb_reserve (descr->skb,GELIC_NET_RXBUF_ALIGN - offset);/* io-mmu-map the skb */ - descr->buf_addr =cpu_to_be32 (dma_map_single (ctodev (card), - descr->skb->data, -GELIC_NET_MAX_FRAME , -DMA_FROM_DEVICE )); -if (!descr->buf_addr) { + cpu_addr =dma_map_single (ctodev (card), descr->skb->data, +GELIC_NET_MAX_FRAME ,DMA_FROM_DEVICE ); + descr->buf_addr =cpu_to_be32 (cpu_addr); +if (dma_mapping_error (ctodev (card), cpu_addr)) {dev_kfree_skb_any (descr->skb); descr->skb =NULL ; dev_info(ctodev(card),
@@ -780,7 +782,7 @@ static int gelic_descr_prepare_tx(struct gelic_card *card, buf =dma_map_single (ctodev (card), skb->data, skb->len,DMA_TO_DEVICE ); -if (!buf) { +if (dma_mapping_error (ctodev (card), buf)) {dev_err (ctodev (card),"dma map 2 failed (%p, %i). Dropping packet\n" , skb->data, skb->len);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 40/173 bootconfig: Fix testcase to increase max node
In reply to Greg Kroah-HartmanFrom: Masami Hiramatsu (Google) <[email protected]>
[ Upstream commit b69245126a48e50882021180fa5d264dc7149ccc ]
Since commit 6c40624930c5 ("bootconfig: Increase max nodes of bootconfig from 1024 to 8192 for DCC support") increased the max number of bootconfig node to 8192, the bootconfig testcase of the max number of nodes fails. To fix this issue, we can not simply increase the number in the test script because the test bootconfig file becomes too big (>32KB). To fix that, we can use a combination of three alphabets (26^3 = 17576). But with that, we can not express the 8193 (just one exceed from the limitation) because it also exceeds the max size of bootconfig. So, the first 26 nodes will just use one alphabet.
With this fix, test-bootconfig.sh passes all tests.
--- tools/bootconfig/test-bootconfig.sh | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
tools/bootconfig/test-bootconfig.sh +8 -4
@@ -87,10 +87,14 @@ xfail grep -i "error" $OUTFILE echo "Max node number check" -echo -n > $TEMPCONF -for i in `seq 1 1024` ; do - echo "node$i" >> $TEMPCONF -done +awk ' +BEGIN { + for (i = 0; i < 26; i += 1) + printf("%c\n", 65 + i % 26) + for (i = 26; i < 8192; i += 1) + printf("%c%c%c\n", 65 + i % 26, 65 + (i / 26) % 26, 65 + (i / 26 / 26)) +} +' > $TEMPCONF xpass $BOOTCONF -a $TEMPCONF $INITRD echo "badnode" >> $TEMPCONF
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 41/173 keys: Do not cache key in task struct if key is requested from kernel thread
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 47f9e4c924025c5be87959d3335e66fcbb7f6b5c ]
The key which gets cached in task structure from a kernel thread does not get invalidated even after expiry. Due to which, a new key request from kernel thread will be served with the cached key if it's present in task struct irrespective of the key validity. The change is to not cache key in task_struct when key requested from kernel thread so that kernel thread gets a valid key on every key request.
The problem has been seen with the cifs module doing DNS lookups from a kernel thread and the results getting pinned by being attached to that kernel thread's cache - and thus not something that can be easily got rid of. The cache would ordinarily be cleared by notify-resume, but kernel threads don't do that.
This isn't seen with AFS because AFS is doing request_key() within the kernel half of a user thread - which will do notify-resume.
--- security/keys/request_key.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
security/keys/request_key.c +6 -3
@@ -38,9 +38,12 @@ static void cache_requested_key(struct key *key)#ifdef CONFIG_KEYS_REQUEST_CACHE struct task_struct *t = current; -key_put (t->cached_requested_key); - t->cached_requested_key =key_get (key); -set_tsk_thread_flag (t,TIF_NOTIFY_RESUME ); +/* Do not cache key if it is a kernel thread */ +if (!(t->flags &PF_KTHREAD )) { +key_put (t->cached_requested_key); + t->cached_requested_key =key_get (key); +set_tsk_thread_flag (t,TIF_NOTIFY_RESUME ); + }#endif }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 42/173 bpf: Adjust insufficient default bpf_jit_limit
In reply to Greg Kroah-HartmanFrom: Daniel Borkmann <[email protected]>
[ Upstream commit 10ec8ca8ec1a2f04c4ed90897225231c58c124a7 ]
We've seen recent AWS EKS (Kubernetes) user reports like the following:
After upgrading EKS nodes from v20230203 to v20230217 on our 1.24 EKS clusters after a few days a number of the nodes have containers stuck in ContainerCreating state or liveness/readiness probes reporting the following error:
Readiness probe errored: rpc error: code = Unknown desc = failed to exec in container: failed to start exec "4a11039f730203ffc003b7[...]":
OCI runtime exec failed: exec failed: unable to start container process:
unable to init seccomp: error loading seccomp filter into kernel:
error loading seccomp filter: errno 524: unknown
However, we had not been seeing this issue on previous AMIs and it only started to occur on v20230217 (following the upgrade from kernel 5.4 to 5.10) with no other changes to the underlying cluster or workloads.
We tried the suggestions from that issue (sysctl net.core.bpf_jit_limit=452534528) which helped to immediately allow containers to be created and probes to execute but after approximately a day the issue returned and the value returned by cat /proc/vmallocinfo | grep bpf_jit | awk '{s+=$2} END {print s}' was steadily increasing.
I tested bpf tree to observe bpf_jit_charge_modmem, bpf_jit_uncharge_modmem their sizes passed in as well as bpf_jit_current under tcpdump BPF filter, seccomp BPF and native (e)BPF programs, and the behavior all looks sane and expected, that is nothing "leaking" from an upstream perspective.
The bpf_jit_limit knob was originally added in order to avoid a situation where unprivileged applications loading BPF programs (e.g. seccomp BPF policies) consuming all the module memory space via BPF JIT such that loading of kernel modules would be prevented. The default limit was defined back in 2018 and while good enough back then, we are generally seeing far more BPF consumers today.
Adjust the limit for the BPF JIT pool from originally 1/4 to now 1/2 of the module memory space to better reflect today's needs and avoid more users running into potentially hard to debug issues.
--- kernel/bpf/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/bpf/core.c +1 -1
@@ -826,7 +826,7 @@ static int __init bpf_jit_charge_init(void) {/* Only used as heuristic here to derive limit. */ bpf_jit_limit_max =bpf_jit_alloc_exec_limit (); - bpf_jit_limit =min_t (u64,round_up (bpf_jit_limit_max >>2 , + bpf_jit_limit =min_t (u64,round_up (bpf_jit_limit_max >>1 ,PAGE_SIZE ),LONG_MAX );return 0 ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 43/173 net/mlx5: Fix steering rules cleanup
In reply to Greg Kroah-HartmanFrom: Lama Kayal <[email protected]>
[ Upstream commit 922f56e9a795d6f3dd72d3428ebdd7ee040fa855 ]
vport's mc, uc and multicast rules are not deleted in teardown path when EEH happens. Since the vport's promisc settings(uc, mc and all) in firmware are reset after EEH, mlx5 driver will try to delete the above rules in the initialization path. This cause kernel crash because these software rules are no longer valid.
Fix by nullifying these rules right after delete to avoid accessing any dangling pointers.
Call Trace: __list_del_entry_valid+0xcc/0x100 (unreliable) tree_put_node+0xf4/0x1b0 [mlx5_core] tree_remove_node+0x30/0x70 [mlx5_core] mlx5_del_flow_rules+0x14c/0x1f0 [mlx5_core] esw_apply_vport_rx_mode+0x10c/0x200 [mlx5_core] esw_update_vport_rx_mode+0xb4/0x180 [mlx5_core] esw_vport_change_handle_locked+0x1ec/0x230 [mlx5_core] esw_enable_vport+0x130/0x260 [mlx5_core] mlx5_eswitch_enable_sriov+0x2a0/0x2f0 [mlx5_core] mlx5_device_enable_sriov+0x74/0x440 [mlx5_core] mlx5_load_one+0x114c/0x1550 [mlx5_core] mlx5_pci_resume+0x68/0xf0 [mlx5_core] eeh_report_resume+0x1a4/0x230 eeh_pe_dev_traverse+0x98/0x170 eeh_handle_normal_event+0x3e4/0x640 eeh_handle_event+0x4c/0x370 eeh_event_handler+0x14c/0x210 kthread+0x168/0x1b0 ret_from_kernel_thread+0x5c/0x84
--- drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +1 -0
@@ -1339,6 +1339,7 @@ static void esw_disable_vport(struct mlx5_eswitch *esw, u16 vport_num)*/ esw_vport_change_handle_locked (vport); vport->enabled_events =0 ; +esw_apply_vport_rx_mode (esw, vport, false, false);esw_vport_cleanup (esw, vport); esw->enabled_vports--;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 44/173 net/mlx5: Read the TC mapping of all priorities on ETS query
In reply to Greg Kroah-HartmanFrom: Maher Sanalla <[email protected]>
[ Upstream commit 44d553188c38ac74b799dfdcebafef2f7bb70942 ]
When ETS configurations are queried by the user to get the mapping assignment between packet priority and traffic class, only priorities up to maximum TCs are queried from QTCT register in FW to retrieve their assigned TC, leaving the rest of the priorities mapped to the default TC #0 which might be misleading.
Fix by querying the TC mapping of all priorities on each ETS query, regardless of the maximum number of TCs configured in FW.
--- drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c +4 -2
@@ -117,12 +117,14 @@ static int mlx5e_dcbnl_ieee_getets(struct net_device *netdev,if (!MLX5_CAP_GEN (priv->mdev, ets))return -EOPNOTSUPP ; - ets->ets_cap =mlx5_max_tc (priv->mdev) +1 ; -for (i =0 ; i < ets->ets_cap; i++) { +for (i =0 ; i <IEEE_8021QAZ_MAX_TCS ; i++) { err =mlx5_query_port_prio_tc (mdev, i, &ets->prio_tc[i]);if (err)return err; + } + ets->ets_cap =mlx5_max_tc (priv->mdev) +1 ; +for (i =0 ; i < ets->ets_cap; i++) { err =mlx5_query_port_tc_group (mdev, i, &tc_group[i]);if (err)return err;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 45/173 net/mlx5: E-Switch, Fix an Oops in error handling code
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 640fcdbcf27fc62de9223f958ceb4e897a00e791 ]
The error handling dereferences "vport". There is nothing we can do if it is an error pointer except returning the error code.
--- drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_ofld.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_ofld.c +1 -2
@@ -301,8 +301,7 @@ int mlx5_esw_acl_ingress_vport_bond_update(struct mlx5_eswitch *esw, u16 vport_nif (WARN_ON_ONCE (IS_ERR (vport))) {esw_warn (esw->dev,"vport(%d) invalid!\n" , vport_num); - err =PTR_ERR (vport); - goto out; +return PTR_ERR (vport); }esw_acl_ingress_ofld_rules_destroy (esw, vport);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 46/173 atm: idt77252: fix kmemleak when rmmod idt77252
In reply to Greg Kroah-HartmanFrom: Li Zetao <[email protected]>
[ Upstream commit 4fe3c88552a3fbe1944426a4506a18cdeb457b5a ]
There are memory leaks reported by kmemleak:
unreferenced object 0xffff888106500800 (size 128):
comm "modprobe", pid 1017, jiffies 4297787785 (age 67.152s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000970ce626>] __kmem_cache_alloc_node+0x20c/0x380
[<00000000fb5f78d9>] kmalloc_trace+0x2f/0xb0
[<000000000e947e2a>] idt77252_init_one+0x2847/0x3c90 [idt77252]
[<000000006efb048e>] local_pci_probe+0xeb/0x1a0
... unreferenced object 0xffff888106500b00 (size 128):
comm "modprobe", pid 1017, jiffies 4297787785 (age 67.152s)
hex dump (first 32 bytes):
00 20 3d 01 80 88 ff ff 00 20 3d 01 80 88 ff ff . =...... =.....
f0 23 3d 01 80 88 ff ff 00 20 3d 01 00 00 00 00 .#=...... =.....
backtrace:
[<00000000970ce626>] __kmem_cache_alloc_node+0x20c/0x380
[<00000000fb5f78d9>] kmalloc_trace+0x2f/0xb0
[<00000000f451c5be>] alloc_scq.constprop.0+0x4a/0x400 [idt77252]
[<00000000e6313849>] idt77252_init_one+0x28cf/0x3c90 [idt77252]The root cause is traced to the vc_maps which alloced in open_card_oam() are not freed in close_card_oam(). The vc_maps are used to record open connections, so when close a vc_map in close_card_oam(), the memory should be freed. Moreover, the ubr0 is not closed when close a idt77252 device, leading to the memory leak of vc_map and scq_info.
Fix them by adding kfree in close_card_oam() and implementing new close_card_ubr0() to close ubr0.
--- drivers/atm/idt77252.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/atm/idt77252.c +11 -0
@@ -2915,6 +2915,7 @@ close_card_oam(struct idt77252_dev *card)recycle_rx_pool_skb (card, &vc->rcv.rx_pool); } +kfree (vc); } } }
@@ -2958,6 +2959,15 @@ open_card_ubr0(struct idt77252_dev *card)return 0 ; } +static void +close_card_ubr0 (struct idt77252_dev *card) +{ +struct vc_map *vc = card->vcs[0 ]; + +free_scq (card, vc->scq); +kfree (vc); +} +static int idt77252_dev_open (struct idt77252_dev *card) {
@@ -3007,6 +3017,7 @@ static void idt77252_dev_close(struct atm_dev *dev)struct idt77252_dev *card = dev->dev_data;u32 conf; +close_card_ubr0 (card);close_card_oam (card); conf = SAR_CFG_RXPTH | /* enable receive path */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 47/173 erspan: do not use skb_mac_header() in ndo_start_xmit()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 8e50ed774554f93d55426039b27b1e38d7fa64d8 ]
Drivers should not assume skb_mac_header(skb) == skb->data in their ndo_start_xmit().
Use skb_network_offset() and skb_transport_offset() which better describe what is needed in erspan_fb_xmit() and ip6erspan_tunnel_xmit()
syzbot reported:
WARNING: CPU: 0 PID: 5083 at include/linux/skbuff.h:2873 skb_mac_header include/linux/skbuff.h:2873 [inline] WARNING: CPU: 0 PID: 5083 at include/linux/skbuff.h:2873 ip6erspan_tunnel_xmit+0x1d9c/0x2d90 net/ipv6/ip6_gre.c:962 Modules linked in: CPU: 0 PID: 5083 Comm: syz-executor406 Not tainted 6.3.0-rc2-syzkaller-00866-gd4671cb96fa3 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 RIP: 0010:skb_mac_header include/linux/skbuff.h:2873 [inline] RIP: 0010:ip6erspan_tunnel_xmit+0x1d9c/0x2d90 net/ipv6/ip6_gre.c:962 Code: 04 02 41 01 de 84 c0 74 08 3c 03 0f 8e 1c 0a 00 00 45 89 b4 24 c8 00 00 00 c6 85 77 fe ff ff 01 e9 33 e7 ff ff e8 b4 27 a1 f8 <0f> 0b e9 b6 e7 ff ff e8 a8 27 a1 f8 49 8d bf f0 0c 00 00 48 b8 00 RSP: 0018:ffffc90003b2f830 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 000000000000ffff RCX: 0000000000000000 RDX: ffff888021273a80 RSI: ffffffff88e1bd4c RDI: 0000000000000003 RBP: ffffc90003b2f9d8 R08: 0000000000000003 R09: 000000000000ffff R10: 000000000000ffff R11: 0000000000000000 R12: ffff88802b28da00 R13: 00000000000000d0 R14: ffff88807e25b6d0 R15: ffff888023408000 FS: 0000555556a61300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055e5b11eb6e8 CR3: 0000000027c1b000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __netdev_start_xmit include/linux/netdevice.h:4900 [inline] netdev_start_xmit include/linux/netdevice.h:4914 [inline] __dev_direct_xmit+0x504/0x730 net/core/dev.c:4300 dev_direct_xmit include/linux/netdevice.h:3088 [inline] packet_xmit+0x20a/0x390 net/packet/af_packet.c:285 packet_snd net/packet/af_packet.c:3075 [inline] packet_sendmsg+0x31a0/0x5150 net/packet/af_packet.c:3107 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg+0xde/0x190 net/socket.c:747 __sys_sendto+0x23a/0x340 net/socket.c:2142 __do_sys_sendto net/socket.c:2154 [inline] __se_sys_sendto net/socket.c:2150 [inline] __x64_sys_sendto+0xe1/0x1b0 net/socket.c:2150 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f123aaa1039 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc15d12058 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f123aaa1039 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000020000040 R09: 0000000000000014 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f123aa648c0 R13: 431bde82d7b634db R14: 0000000000000000 R15: 0000000000000000
--- net/ipv4/ip_gre.c | 4 ++-- net/ipv6/ip6_gre.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
net/ipv4/ip_gre.c +2 -2
@@ -547,7 +547,7 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev) truncate = true; } - nhoff =skb_network_header (skb) -skb_mac_header (skb); + nhoff =skb_network_offset (skb);if (skb->protocol ==htons (ETH_P_IP ) && (ntohs (ip_hdr (skb)->tot_len) > skb->len - nhoff)) truncate = true;
@@ -556,7 +556,7 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev)int thoff;if (skb_transport_header_was_set (skb)) - thoff =skb_transport_header (skb) -skb_mac_header (skb); + thoff =skb_transport_offset (skb);else thoff = nhoff +sizeof (struct ipv6hdr );if (ntohs (ipv6_hdr (skb)->payload_len) > skb->len - thoff)
net/ipv6/ip6_gre.c +2 -2
@@ -959,7 +959,7 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb, truncate = true; } - nhoff =skb_network_header (skb) -skb_mac_header (skb); + nhoff =skb_network_offset (skb);if (skb->protocol ==htons (ETH_P_IP ) && (ntohs (ip_hdr (skb)->tot_len) > skb->len - nhoff)) truncate = true;
@@ -968,7 +968,7 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,int thoff;if (skb_transport_header_was_set (skb)) - thoff =skb_transport_header (skb) -skb_mac_header (skb); + thoff =skb_transport_offset (skb);else thoff = nhoff +sizeof (struct ipv6hdr );if (ntohs (ipv6_hdr (skb)->payload_len) > skb->len - thoff)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 48/173 net/sonic: use dma_mapping_error() for error check
In reply to Greg Kroah-HartmanFrom: Zhang Changzhong <[email protected]>
[ Upstream commit 4107b8746d93ace135b8c4da4f19bbae81db785f ]
The DMA address returned by dma_map_single() should be checked with dma_mapping_error(). Fix it accordingly.
--- drivers/net/ethernet/natsemi/sonic.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/natsemi/sonic.c +2 -2
@@ -292,7 +292,7 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev)*/ laddr =dma_map_single (lp->device, skb->data, length,DMA_TO_DEVICE ); -if (!laddr) { +if (dma_mapping_error (lp->device, laddr)) {pr_err_ratelimited ("%s: failed to map tx DMA buffer.\n" , dev->name);dev_kfree_skb_any (skb);return NETDEV_TX_OK ;
@@ -509,7 +509,7 @@ static bool sonic_alloc_rb(struct net_device *dev, struct sonic_local *lp, *new_addr =dma_map_single (lp->device,skb_put (*new_skb,SONIC_RBSIZE ),SONIC_RBSIZE ,DMA_FROM_DEVICE ); -if (!*new_addr) { +if (dma_mapping_error (lp->device, *new_addr)) {dev_kfree_skb (*new_skb); *new_skb =NULL ;return false;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 49/173 nvme-tcp: fix nvme_tcp_term_pdu to match spec
In reply to Greg Kroah-HartmanFrom: Caleb Sander <[email protected]>
[ Upstream commit aa01c67de5926fdb276793180564f172c55fb0d7 ]
The FEI field of C2HTermReq/H2CTermReq is 4 bytes but not 4-byte-aligned in the NVMe/TCP specification (it is located at offset 10 in the PDU). Split it into two 16-bit integers in struct nvme_tcp_term_pdu so no padding is inserted. There should also be 10 reserved bytes after. There are currently no users of this type.
--- include/linux/nvme-tcp.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
include/linux/nvme-tcp.h +3 -2
@@ -114,8 +114,9 @@ struct nvme_tcp_icresp_pdu {struct nvme_tcp_term_pdu {struct nvme_tcp_hdr hdr;__le16 fes; -__le32 fei; -__u8 rsvd[8 ]; +__le16 feil; +__le16 feiu; +__u8 rsvd[10 ]; };/**
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 50/173 gve: Cache link_speed value from device
In reply to Greg Kroah-HartmanFrom: Joshua Washington <[email protected]>
[ Upstream commit 68c3e4fc8628b1487c965aabb29207249657eb5f ]
The link speed is never changed for the uptime of a VM, and the current implementation sends an admin queue command for each call. Admin queue command invocations have nontrivial overhead (e.g., VM exits), which can be disruptive to users if triggered frequently. Our telemetry data shows that there are VMs that make frequent calls to this admin queue command. Caching the result of the original admin queue command would eliminate the need to send multiple admin queue commands on subsequent calls to retrieve link speed.
--- drivers/net/ethernet/google/gve/gve_ethtool.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/google/gve/gve_ethtool.c +4 -1
@@ -510,7 +510,10 @@ static int gve_get_link_ksettings(struct net_device *netdev, struct ethtool_link_ksettings *cmd) {struct gve_priv *priv =netdev_priv (netdev); -int err =gve_adminq_report_link_speed (priv); +int err =0 ; + +if (priv->link_speed ==0 ) + err =gve_adminq_report_link_speed (priv); cmd->base.speed = priv->link_speed;return err;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 51/173 net: dsa: mt7530: move setting ssc_delta to PHY_INTERFACE_MODE_TRGMII case
In reply to Greg Kroah-HartmanFrom: Arınç ÜNAL <[email protected]>
[ Upstream commit 407b508bdd70b6848993843d96ed49ac4108fb52 ]
Move setting the ssc_delta variable to under the PHY_INTERFACE_MODE_TRGMII case as it's only needed when trgmii is used.
--- drivers/net/dsa/mt7530.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/net/dsa/mt7530.c +4 -5
@@ -403,6 +403,10 @@ mt7530_pad_clk_setup(struct dsa_switch *ds, phy_interface_t interface)break ;case PHY_INTERFACE_MODE_TRGMII : trgint =1 ; +if (xtal ==HWTRAP_XTAL_25MHZ ) + ssc_delta =0x57 ; +else + ssc_delta =0x87 ;if (priv->id ==ID_MT7621 ) {/* PLL frequency: 150MHz: 1.2GBit */ if (xtal ==HWTRAP_XTAL_40MHZ )
@@ -422,11 +426,6 @@ mt7530_pad_clk_setup(struct dsa_switch *ds, phy_interface_t interface)return -EINVAL ; } -if (xtal ==HWTRAP_XTAL_25MHZ ) - ssc_delta =0x57 ; -else - ssc_delta =0x87 ; -mt7530_rmw (priv,MT7530_P6ECR ,P6_INTF_MODE_MASK ,P6_INTF_MODE (trgint));
Signature · 1 line
2.39.2
Re: [PATCH 5.10 051/173] net: dsa: mt7530: move setting ssc_delta to PHY_INTERFACE_MODE_TRGMII case
Hi!
Quoted 4 lines
[ Upstream commit
407b508bdd70b6848993843d96ed49ac4108fb52]Move setting the
ssc_deltavariable to under thePHY_INTERFACE_MODE_TRGMIIcase as it's only needed when trgmii is used.
This one is very wrong for 5.10. ssc_delta is unconditionally used below, and it will not use uninitialized variable.
(In mainline, that code is protected by if (trgint), so it does not have this problem).
Best regards,
Pavel
Quoted 24 lines
+++
b/drivers/net/dsa/mt7530.cdrivers/net/dsa/mt7530.c +4
-5@@ -403,6 +403,10 @@ mt7530_pad_clk_setup(struct dsa_switch *ds, phy_interface_t interface)break ;case PHY_INTERFACE_MODE_TRGMII : trgint =1 ; +if (xtal ==HWTRAP_XTAL_25MHZ ) + ssc_delta =0x57 ; +else + ssc_delta =0x87 ;if (priv->id ==ID_MT7621 ) {/* PLL frequency: 150MHz: 1.2GBit */ if (xtal ==HWTRAP_XTAL_40MHZ )@@ -422,11 +426,6 @@ mt7530_pad_clk_setup(struct dsa_switch *ds, phy_interface_t interface)return -EINVAL ; } -if (xtal ==HWTRAP_XTAL_25MHZ ) - ssc_delta =0x57 ; -else - ssc_delta =0x87 ; -mt7530_rmw (priv,MT7530_P6ECR ,P6_INTF_MODE_MASK ,P6_INTF_MODE (trgint));
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Erika Unter HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Re: [PATCH 5.10 051/173] net: dsa: mt7530: move setting ssc_delta to PHY_INTERFACE_MODE_TRGMII case
Quoted 4 lines · Pavel Machek
Hi!
Quoted 2 lines
[ Upstream commit
407b508bdd70b6848993843d96ed49ac4108fb52]
Quoted 8 lines
Quoted 2 lines
Move setting the
ssc_deltavariable to under thePHY_INTERFACE_MODE_TRGMIIcase as it's only needed when trgmii is used.This one is very wrong for 5.10.
ssc_deltais unconditionally used below, and it will not use uninitialized variable.(In mainline, that code is protected by if (trgint), so it does not have this problem).
This patch is not stable material in the first place. As a newbie I incorrectly sent it to net tree instead of net-next. This patch can just be ignored for 5.10, if that takes the least amount of effort for you folks.
Sorry about that and thanks for pointing this out Pavel.
Arınç
Re: [PATCH 5.10 051/173] net: dsa: mt7530: move setting ssc_delta to PHY_INTERFACE_MODE_TRGMII case
Hi!
Quoted 8 lines
Quoted 8 lines
Quoted 4 lines
[ Upstream commit
407b508bdd70b6848993843d96ed49ac4108fb52]Move setting the
ssc_deltavariable to under thePHY_INTERFACE_MODE_TRGMIIcase as it's only needed when trgmii is used.This one is very wrong for 5.10.
ssc_deltais unconditionally used below, and it will not use uninitialized variable.
Quoted 8 lines
Quoted 2 lines
(In mainline, that code is protected by if (trgint), so it does not have this problem).
This patch is not stable material in the first place. As a newbie I incorrectly sent it to net tree instead of net-next. This patch can just be ignored for 5.10, if that takes the least amount of effort for you folks.
Sorry about that and thanks for pointing this out Pavel.
I believe you did the right thing, but as it had Fixes header stable people picked it up.
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Erika Unter HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Sasha Levin
maintainerRe: [PATCH 5.10 051/173] net: dsa: mt7530: move setting ssc_delta to PHY_INTERFACE_MODE_TRGMII case
Quoted 13 lines · Pavel Machek
Hi!
Quoted 11 lines
Quoted 10 lines
Quoted 4 lines
[ Upstream commit
407b508bdd70b6848993843d96ed49ac4108fb52]Move setting the
ssc_deltavariable to under thePHY_INTERFACE_MODE_TRGMIIcase as it's only needed when trgmii is used.This one is very wrong for 5.10.
ssc_deltais unconditionally used below, and it will not use uninitialized variable.(In mainline, that code is protected by if (trgint), so it does not have this problem).
Quoted 8 lines
Quoted 5 lines
This patch is not stable material in the first place. As a newbie I incorrectly sent it to net tree instead of net-next. This patch can just be ignored for 5.10, if that takes the least amount of effort for you folks.
Sorry about that and thanks for pointing this out Pavel.
I believe you did the right thing, but as it had Fixes header stable people picked it up.
Right. I'll drop it.
Signature · 2 lines
Thanks, Sasha
Greg Kroah-Hartman
maintainerPATCH 52/173 net: mdio: thunder: Add missing fwnode_handle_put()
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit b1de5c78ebe9858ccec9d49af2f76724f1d47e3e ]
In device_for_each_child_node(), we should add fwnode_handle_put() when break out of the iteration device_for_each_child_node() as it will automatically increase and decrease the refcounter.
--- drivers/net/mdio/mdio-thunder.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/mdio/mdio-thunder.c +1 -0
@@ -104,6 +104,7 @@ static int thunder_mdiobus_pci_probe(struct pci_dev *pdev,if (i >=ARRAY_SIZE (nexus->buses))break ; } +fwnode_handle_put (fwn);return 0 ; err_release_regions:
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 53/173 Bluetooth: btqcomsmd: Fix command timeout after setting BD address
In reply to Greg Kroah-HartmanFrom: Stephan Gerhold <[email protected]>
[ Upstream commit 5d44ab9e204200a78ad55cdf185aa2bb109b5950 ]
On most devices using the btqcomsmd driver (e.g. the DragonBoard 410c and other devices based on the Qualcomm MSM8916/MSM8909/... SoCs) the Bluetooth firmware seems to become unresponsive for a while after setting the BD address. On recent kernel versions (at least 5.17+) this often causes timeouts for subsequent commands, e.g. the HCI reset sent by the Bluetooth core during initialization:
Bluetooth: hci0: Opcode 0x c03 failed: -110
Unfortunately this behavior does not seem to be documented anywhere. Experimentation suggests that the minimum necessary delay to avoid the problem is ~150us. However, to be sure add a sleep for > 1ms in case it is a bit longer on other firmware versions.
Older kernel versions are likely also affected, although perhaps with slightly different errors or less probability. Side effects can easily hide the issue in most cases, e.g. unrelated incoming interrupts that cause the necessary delay.
--- drivers/bluetooth/btqcomsmd.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
drivers/bluetooth/btqcomsmd.c +16 -1
@@ -122,6 +122,21 @@ static int btqcomsmd_setup(struct hci_dev *hdev)return 0 ; } +static int btqcomsmd_set_bdaddr (struct hci_dev *hdev,const bdaddr_t *bdaddr) +{ +int ret; + + ret =qca_set_bdaddr_rome (hdev, bdaddr); +if (ret) +return ret; + +/* The firmware stops responding for a while after setting the bdaddr, +* causing timeouts for subsequent commands. Sleep a bit to avoid this. +*/ +usleep_range (1000 ,10000 ); +return 0 ; +} +static int btqcomsmd_probe (struct platform_device *pdev) {struct btqcomsmd *btq;
@@ -162,7 +177,7 @@ static int btqcomsmd_probe(struct platform_device *pdev) hdev->close = btqcomsmd_close; hdev->send = btqcomsmd_send; hdev->setup = btqcomsmd_setup; - hdev->set_bdaddr = qca_set_bdaddr_rome; + hdev->set_bdaddr = btqcomsmd_set_bdaddr; ret =hci_register_dev (hdev);if (ret <0 )
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 54/173 Bluetooth: L2CAP: Fix not checking for maximum number of DCID
In reply to Greg Kroah-HartmanFrom: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 7cf3b1dd6aa603fd80969e9e7160becf1455a0eb ]
When receiving L2CAP_CREDIT_BASED_CONNECTION_REQ the remote may request more channels than allowed by the spec (10 octecs = 5 CIDs) so this checks if the number of channels is bigger than the maximum allowed and respond with an error.
Stable-dep-of: 9aa9d9473f15 ("Bluetooth: L2CAP: Fix responding with wrong PDU type")
--- include/net/bluetooth/l2cap.h | 1 + net/bluetooth/l2cap_core.c | 12 +++++++++--- 2 files changed, 10 insertions(+), 3 deletions(-)
include/net/bluetooth/l2cap.h +1 -0
@@ -493,6 +493,7 @@ struct l2cap_le_credits {#define L2CAP_ECRED_MIN_MTU 64#define L2CAP_ECRED_MIN_MPS 64 +#define L2CAP_ECRED_MAX_CID 5struct l2cap_ecred_conn_req {__le16 psm;
net/bluetooth/l2cap_core.c +9 -3
@@ -5952,7 +5952,7 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,struct l2cap_ecred_conn_req *req = (void *) data;struct {struct l2cap_ecred_conn_rsp rsp; -__le16 dcid[5 ]; +__le16 dcid[L2CAP_ECRED_MAX_CID ]; } __packed pdu;struct l2cap_chan *chan, *pchan;u16 mtu, mps;
@@ -5969,6 +5969,14 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn, goto response; } + cmd_len -=sizeof (*req); + num_scid = cmd_len /sizeof (u16); + +if (num_scid >ARRAY_SIZE (pdu.dcid)) { + result =L2CAP_CR_LE_INVALID_PARAMS ; + goto response; + } + mtu =__le16_to_cpu (req->mtu); mps =__le16_to_cpu (req->mps);
@@ -6013,8 +6021,6 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn, } result =L2CAP_CR_LE_SUCCESS ; - cmd_len -=sizeof (*req); - num_scid = cmd_len /sizeof (u16);for (i =0 ; i < num_scid; i++) {u16 scid =__le16_to_cpu (req->scid[i]);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 55/173 Bluetooth: L2CAP: Fix responding with wrong PDU type
In reply to Greg Kroah-HartmanFrom: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 9aa9d9473f1550d1936c31259720b3f1f4690576 ]
L2CAP_ECRED_CONN_REQ shall be responded with L2CAP_ECRED_CONN_RSP not L2CAP_LE_CONN_RSP:
L2CAP LE EATT Server - Reject - run
Listening for connections
New client connection with handle 0x002a
Sending L2CAP Request from client
Client received response code 0x15
Unexpected L2CAP response code (expected 0x18)
L2CAP LE EATT Server - Reject - test failed
Quoted 1 line
ACL Data RX: Handle 42 flags
0x02dlen 26
LE L2CAP: Enhanced Credit Connection Request (0x17) ident 1 len 18
PSM: 39 (0x0027)
MTU: 64
MPS: 64
Credits: 5
Source CID: 65
Source CID: 66
Source CID: 67
Source CID: 68
Source CID: 69
< ACL Data TX: Handle 42 flags 0x00 dlen 16
LE L2CAP: LE Connection Response (0x15) ident 1 len 8
invalid size
00 00 00 00 00 00 06 00L2CAP LE EATT Server - Reject - run
Listening for connections
New client connection with handle 0x002a
Sending L2CAP Request from client
Client received response code 0x18
L2CAP LE EATT Server - Reject - test passed
--- net/bluetooth/l2cap_core.c | 117 +++++++++++++++++++++++++------------ 1 file changed, 79 insertions(+), 38 deletions(-)
net/bluetooth/l2cap_core.c +79 -38
@@ -710,6 +710,17 @@ void l2cap_chan_del(struct l2cap_chan *chan, int err) }EXPORT_SYMBOL_GPL (l2cap_chan_del); +static void __l2cap_chan_list_id (struct l2cap_conn *conn,u16 id, +l2cap_chan_func_t func,void *data) +{ +struct l2cap_chan *chan, *l; + +list_for_each_entry_safe (chan, l, &conn->chan_l, list) { +if (chan->ident == id) +func (chan, data); + } +} +static void __l2cap_chan_list (struct l2cap_conn *conn,l2cap_chan_func_t func,void *data) {
@@ -777,23 +788,9 @@ static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan)static void l2cap_chan_ecred_connect_reject (struct l2cap_chan *chan) { -struct l2cap_conn *conn = chan->conn; -struct l2cap_ecred_conn_rsp rsp; -u16 result; - -if (test_bit (FLAG_DEFER_SETUP , &chan->flags)) - result =L2CAP_CR_LE_AUTHORIZATION ; -else - result =L2CAP_CR_LE_BAD_PSM ; -l2cap_state_change (chan,BT_DISCONN ); -memset (&rsp,0 ,sizeof (rsp)); - - rsp.result =cpu_to_le16 (result); - -l2cap_send_cmd (conn, chan->ident,L2CAP_LE_CONN_RSP ,sizeof (rsp), - &rsp); +__l2cap_ecred_conn_rsp_defer (chan); }static void l2cap_chan_connect_reject (struct l2cap_chan *chan)
@@ -848,7 +845,7 @@ void l2cap_chan_close(struct l2cap_chan *chan, int reason)break ;case L2CAP_MODE_EXT_FLOWCTL :l2cap_chan_ecred_connect_reject (chan); -break ; +return ; } } }
@@ -3934,43 +3931,86 @@ void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan) &rsp); } -void __l2cap_ecred_conn_rsp_defer (struct l2cap_chan *chan) +static void l2cap_ecred_list_defer (struct l2cap_chan *chan,void *data) { +int *result = data; + +if (*result ||test_bit (FLAG_ECRED_CONN_REQ_SENT , &chan->flags)) +return ; + +switch (chan->state) { +case BT_CONNECT2 : +/* If channel still pending accept add to result */ + (*result)++; +return ; +case BT_CONNECTED : +return ; +default : +/* If not connected or pending accept it has been refused */ + *result = -ECONNREFUSED ; +return ; + } +} + +struct l2cap_ecred_rsp_data {struct {struct l2cap_ecred_conn_rsp rsp; -__le16 dcid[5 ]; +__le16 scid[L2CAP_ECRED_MAX_CID ]; } __packed pdu; +int count; +}; + +static void l2cap_ecred_rsp_defer (struct l2cap_chan *chan,void *data) +{ +struct l2cap_ecred_rsp_data *rsp = data; + +if (test_bit (FLAG_ECRED_CONN_REQ_SENT , &chan->flags)) +return ; + +/* Reset ident so only one response is sent */ + chan->ident =0 ; + +/* Include all channels pending with the same ident */ +if (!rsp->pdu.rsp.result) + rsp->pdu.rsp.dcid[rsp->count++] =cpu_to_le16 (chan->scid); +else +l2cap_chan_del (chan,ECONNRESET ); +} + +void __l2cap_ecred_conn_rsp_defer (struct l2cap_chan *chan) +{struct l2cap_conn *conn = chan->conn; -u16 ident = chan->ident; -int i =0 ; +struct l2cap_ecred_rsp_data data; +u16 id = chan->ident; +int result =0 ; -if (!ident) +if (!id)return ; -BT_DBG ("chan %p ident %d" , chan, ident); +BT_DBG ("chan %p id %d" , chan, id); - pdu.rsp.mtu =cpu_to_le16 (chan->imtu); - pdu.rsp.mps =cpu_to_le16 (chan->mps); - pdu.rsp.credits =cpu_to_le16 (chan->rx_credits); - pdu.rsp.result =cpu_to_le16 (L2CAP_CR_LE_SUCCESS ); +memset (&data,0 ,sizeof (data)); -mutex_lock (&conn->chan_lock); + data.pdu.rsp.mtu =cpu_to_le16 (chan->imtu); + data.pdu.rsp.mps =cpu_to_le16 (chan->mps); + data.pdu.rsp.credits =cpu_to_le16 (chan->rx_credits); + data.pdu.rsp.result =cpu_to_le16 (L2CAP_CR_LE_SUCCESS ); -list_for_each_entry (chan, &conn->chan_l, list) { -if (chan->ident != ident) -continue ; +/* Verify that all channels are ready */ +__l2cap_chan_list_id (conn, id, l2cap_ecred_list_defer, &result); -/* Reset ident so only one response is sent */ - chan->ident =0 ; +if (result >0 ) +return ; -/* Include all channels pending with the same ident */ - pdu.dcid[i++] =cpu_to_le16 (chan->scid); - } +if (result <0 ) + data.pdu.rsp.result =cpu_to_le16 (L2CAP_CR_LE_AUTHORIZATION ); -mutex_unlock (&conn->chan_lock); +/* Build response */ +__l2cap_chan_list_id (conn, id, l2cap_ecred_rsp_defer, &data); -l2cap_send_cmd (conn, ident,L2CAP_ECRED_CONN_RSP , -sizeof (pdu.rsp) + i *sizeof (__le16), &pdu); +l2cap_send_cmd (conn, id,L2CAP_ECRED_CONN_RSP , +sizeof (data.pdu.rsp) + (data.count *sizeof (__le16)), + &data.pdu); }void __l2cap_connect_rsp_defer (struct l2cap_chan *chan)
@@ -6073,6 +6113,7 @@ static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,__set_chan_timer (chan, chan->ops->get_sndtimeo (chan)); chan->ident = cmd->ident; + chan->mode =L2CAP_MODE_EXT_FLOWCTL ;if (test_bit (FLAG_DEFER_SETUP , &chan->flags)) {l2cap_state_change (chan,BT_CONNECT2 );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 56/173 Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work
In reply to Greg Kroah-HartmanFrom: Zheng Wang <[email protected]>
[ Upstream commit 1e9ac114c4428fdb7ff4635b45d4f46017e8916f ]
In btsdio_probe, &data->work was bound with btsdio_work.In btsdio_send_frame, it was started by schedule_work.
If we call btsdio_remove with an unfinished job, there may be a race condition and cause UAF bug on hdev.
--- drivers/bluetooth/btsdio.c | 1 + 1 file changed, 1 insertion(+)
drivers/bluetooth/btsdio.c +1 -0
@@ -352,6 +352,7 @@ static void btsdio_remove(struct sdio_func *func)BT_DBG ("func %p" , func); +cancel_work_sync (&data->work);if (!data)return ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 57/173 platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl
In reply to Greg Kroah-HartmanFrom: Tzung-Bi Shih <[email protected]>
[ Upstream commit b20cf3f89c56b5f6a38b7f76a8128bf9f291bbd3 ]
It is possible to peep kernel page's data by providing larger insize in struct cros_ec_command[1] when invoking EC host commands.
Fix it by using zeroed memory.
[1]: https://elixir.bootlin.com/linux/v6.2/source/include/linux/platform_data/cros_ec_proto.h#L74
--- drivers/platform/chrome/cros_ec_chardev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/chrome/cros_ec_chardev.c +1 -1
@@ -284,7 +284,7 @@ static long cros_ec_chardev_ioctl_xcmd(struct cros_ec_dev *ec, void __user *arg) u_cmd.insize > EC_MAX_MSG_BYTES)return -EINVAL ; - s_cmd =kmalloc (sizeof (*s_cmd) +max (u_cmd.outsize, u_cmd.insize), + s_cmd =kzalloc (sizeof (*s_cmd) +max (u_cmd.outsize, u_cmd.insize),GFP_KERNEL );if (!s_cmd)return -ENOMEM ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 58/173 hwmon: fix potential sensor registration fail if of_node is missing
In reply to Greg Kroah-HartmanFrom: Phinex Hung <[email protected]>
[ Upstream commit 2315332efcbe7124252f080e03b57d3d2f1f4771 ]
It is not sufficient to check of_node in current device. In some cases, this would cause the sensor registration to fail.
This patch looks for device's ancestors to find a valid of_node if any.
--- drivers/hwmon/hwmon.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/hwmon/hwmon.c +5 -2
@@ -700,6 +700,7 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata, {struct hwmon_device *hwdev;struct device *hdev; +struct device *tdev = dev;int i, err, id;/* Complain about invalid characters in hwmon name attribute */
@@ -757,7 +758,9 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata, hwdev->name = name; hdev->class = &hwmon_class; hdev->parent = dev; - hdev->of_node = dev ? dev->of_node :NULL ; +while (tdev && !tdev->of_node) + tdev = tdev->parent; + hdev->of_node = tdev ? tdev->of_node :NULL ; hwdev->chip = chip;dev_set_drvdata (hdev, drvdata);dev_set_name (hdev,HWMON_ID_FORMAT , id);
@@ -769,7 +772,7 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata,INIT_LIST_HEAD (&hwdev->tzdata); -if (dev && dev->of_node && chip && chip->ops->read && +if (hdev->of_node && chip && chip->ops->read && chip->info[0 ]->type == hwmon_chip && (chip->info[0 ]->config[0 ] &HWMON_C_REGISTER_TZ )) { err =hwmon_thermal_register_sensors (hdev);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 59/173 hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs
In reply to Greg Kroah-HartmanFrom: Frank Crawford <[email protected]>
[ Upstream commit 968b66ffeb7956acc72836a7797aeb7b2444ec51 ]
Fix voltage scaling for chips that have 10.9mV ADCs, where scaling was not performed.
--- drivers/hwmon/it87.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/hwmon/it87.c +3 -1
@@ -486,6 +486,8 @@ static const struct it87_devices it87_devices[] = {#define has_pwm_freq2 (data) ((data)->features & FEAT_PWM_FREQ2)#define has_six_temp (data) ((data)->features & FEAT_SIX_TEMP)#define has_vin3_5v (data) ((data)->features & FEAT_VIN3_5V) +#define has_scaling (data) ((data)->features & (FEAT_12MV_ADC | \ + FEAT_10_9MV_ADC))struct it87_sio_data {int sioaddr;
@@ -3098,7 +3100,7 @@ static int it87_probe(struct platform_device *pdev) "Detected broken BIOS defaults, disabling PWM interface\n");/* Starting with IT8721F, we handle scaling of internal voltages */ -if (has_12mv_adc (data)) { +if (has_scaling (data)) {if (sio_data->internal &BIT (0 )) data->in_scaled |=BIT (3 );/* in3 is AVCC */ if (sio_data->internal &BIT (1 ))
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 60/173 scsi: qla2xxx: Perform lockless command completion in abort path
In reply to Greg Kroah-HartmanFrom: Nilesh Javali <[email protected]>
commit 0367076b0817d5c75dfb83001ce7ce5c64d803a9 upstream.
While adding and removing the controller, the following call trace was observed:
WARNING: CPU: 3 PID: 623596 at kernel/dma/mapping.c:532 dma_free_attrs+0x33/0x50 CPU: 3 PID: 623596 Comm: sh Kdump: loaded Not tainted 5.14.0-96.el9.x86_64 #1 RIP: 0010:dma_free_attrs+0x33/0x50 Call Trace: qla2x00_async_sns_sp_done+0x107/0x1b0 [qla2xxx] qla2x00_abort_srb+0x8e/0x250 [qla2xxx] ? ql_dbg+0x70/0x100 [qla2xxx] __qla2x00_abort_all_cmds+0x108/0x190 [qla2xxx] qla2x00_abort_all_cmds+0x24/0x70 [qla2xxx] qla2x00_abort_isp_cleanup+0x305/0x3e0 [qla2xxx] qla2x00_remove_one+0x364/0x400 [qla2xxx] pci_device_remove+0x36/0xa0 __device_release_driver+0x17a/0x230 device_release_driver+0x24/0x30 pci_stop_bus_device+0x68/0x90 pci_stop_and_remove_bus_device_locked+0x16/0x30 remove_store+0x75/0x90 kernfs_fop_write_iter+0x11c/0x1b0 new_sync_write+0x11f/0x1b0 vfs_write+0x1eb/0x280 ksys_write+0x5f/0xe0 do_syscall_64+0x5c/0x80 ? do_user_addr_fault+0x1d8/0x680 ? do_syscall_64+0x69/0x80 ? exc_page_fault+0x62/0x140 ? asm_exc_page_fault+0x8/0x30 entry_SYSCALL_64_after_hwframe+0x44/0xae
The command was completed in the abort path during driver unload with a lock held, causing the warning in abort path. Hence complete the command without any lock held.
--- drivers/scsi/qla2xxx/qla_os.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/scsi/qla2xxx/qla_os.c +11 -0
@@ -1762,6 +1762,17 @@ __qla2x00_abort_all_cmds(struct qla_qpaifor (cnt =1 ; cnt < req->num_outstanding_cmds; cnt++) { sp = req->outstanding_cmds[cnt];if (sp) { +/* +* perform lockless completion during driver unload +*/ +if (qla2x00_chip_is_down (vha)) { + req->outstanding_cmds[cnt] =NULL ; +spin_unlock_irqrestore (qp->qp_lock_ptr, flags); + sp->done (sp, res); +spin_lock_irqsave (qp->qp_lock_ptr, flags); +continue ; + } +switch (sp->cmd_type) {case TYPE_SRB :qla2x00_abort_srb (qp, sp, res, &flags);
Greg Kroah-Hartman
maintainerPATCH 61/173 uas: Add US_FL_NO_REPORT_OPCODES for JMicron JMS583Gen 2
In reply to Greg Kroah-HartmanFrom: Yaroslav Furman <[email protected]>
commit a37eb61b6ec064ac794b8a1e89fd33eb582fe51d upstream.
Just like other JMicron JMS5xx enclosures, it chokes on report-opcodes, let's avoid them.
--- drivers/usb/storage/unusual_uas.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/usb/storage/unusual_uas.h +7 -0
@@ -111,6 +111,13 @@ UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x99 USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_BROKEN_FUA), +/* Reported by: Yaroslav Furman <[email protected]> */ +UNUSUAL_DEV (0x152d ,0x0583 ,0x0000 ,0x9999 , +"JMicron" , +"JMS583Gen 2" , +USB_SC_DEVICE ,USB_PR_DEVICE ,NULL , +US_FL_NO_REPORT_OPCODES ), +/* Reported-by: Thinh Nguyen <[email protected]> */ UNUSUAL_DEV(0x154b, 0xf00b, 0x0000, 0x9999, "PNY",
Greg Kroah-Hartman
maintainerPATCH 62/173 thunderbolt: Use scale field when allocating USB3 bandwidth
In reply to Greg Kroah-HartmanFrom: Mika Westerberg <[email protected]>
commit c82510b1d87bdebfe916048857d2ef46f1778aa5 upstream.
When tunneling aggregated USB3 (20 Gb/s) the bandwidth values that are programmed to the ADP_USB3_CS_2 go higher than 4096 and that does not fit anymore to the 12-bit field. Fix this by scaling the value using the scale field accordingly.
--- drivers/thunderbolt/usb4.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-)
drivers/thunderbolt/usb4.c +17 -5
@@ -1636,18 +1636,30 @@ static int usb4_usb3_port_write_allocate int downstream_bw) {u32 val, ubw, dbw, scale; -int ret; +int ret, max_bw; -/* Read the used scale, hardware default is 0 */ - ret =tb_port_read (port, &scale,TB_CFG_PORT , - port->cap_adap +ADP_USB3_CS_3 ,1 ); +/* Figure out suitable scale */ + scale =0 ; + max_bw =max (upstream_bw, downstream_bw); +while (scale <64 ) { +if (mbps_to_usb3_bw (max_bw, scale) <4096 ) +break ; + scale++; + } + +if (WARN_ON (scale >=64 )) +return -EINVAL ; + + ret =tb_port_write (port, &scale,TB_CFG_PORT , + port->cap_adap +ADP_USB3_CS_3 ,1 );if (ret)return ret; - scale &=ADP_USB3_CS_3_SCALE_MASK ; ubw =mbps_to_usb3_bw (upstream_bw, scale); dbw =mbps_to_usb3_bw (downstream_bw, scale); +tb_port_dbg (port,"scaled bandwidth %u/%u, scale %u\n" , ubw, dbw, scale); + ret =tb_port_read (port, &val,TB_CFG_PORT , port->cap_adap +ADP_USB3_CS_2 ,1 );if (ret)
Greg Kroah-Hartman
maintainerPATCH 63/173 thunderbolt: Use const qualifier for `ring_interrupt_index`
In reply to Greg Kroah-HartmanFrom: Mario Limonciello <[email protected]>
commit 1716efdb07938bd6510e1127d02012799112c433 upstream.
ring_interrupt_index doesn't change the data for ring so mark it as const. This is needed by the following patch that disables interrupt auto clear for rings.
--- drivers/thunderbolt/nhi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/thunderbolt/nhi.c +1 -1
@@ -36,7 +36,7 @@#define NHI_MAILBOX_TIMEOUT 500/* ms */ -static int ring_interrupt_index (struct tb_ring *ring) +static int ring_interrupt_index (const struct tb_ring *ring) {int bit = ring->hop;if (!ring->is_tx)
Re: [PATCH 5.10 063/173] thunderbolt: Use const qualifier for `ring_interrupt_index`
Hi!
Quoted 7 lines
From: Mario Limonciello <[email protected]>
commit
1716efdb07938bd6510e1127d02012799112c433upstream.
ring_interrupt_indexdoesn't change the data forringso mark it as const. This is needed by the following patch that disables interrupt auto clear for rings.
Yeah, nice cleanup. But do we really need it in -stable?
Best regards,
Pavel
Quoted 12 lines
+++
b/drivers/thunderbolt/nhi.cdrivers/thunderbolt/nhi.c +1
-1@@ -36,7 +36,7 @@#define NHI_MAILBOX_TIMEOUT 500/* ms */ -static int ring_interrupt_index (struct tb_ring *ring) +static int ring_interrupt_index (const struct tb_ring *ring) {int bit = ring->hop;if (!ring->is_tx)
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Erika Unter HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Re: [PATCH 5.10 063/173] thunderbolt: Use const qualifier for `ring_interrupt_index`
Hi,
Quoted 11 lines · Pavel Machek
Hi!
Quoted 7 lines
From: Mario Limonciello <[email protected]>
commit
1716efdb07938bd6510e1127d02012799112c433upstream.
ring_interrupt_indexdoesn't change the data forringso mark it as const. This is needed by the following patch that disables interrupt auto clear for rings.Yeah, nice cleanup. But do we really need it in -stable?
Yes, it was followed by a fix patch that needs this:
468c49f44759 ("thunderbolt: Disable interrupt auto clear for rings")
I marked both for stable but perhaps the latter did not apply cleanly for v5.10?
RE: [PATCH 5.10 063/173] thunderbolt: Use const qualifier for `ring_interrupt_index`
[Public]
Quoted 11 lines · Pavel Machek
Quoted 10 lines
Hi!
Quoted 7 lines
From: Mario Limonciello <[email protected]>
commit
1716efdb07938bd6510e1127d02012799112c433upstream.
ring_interrupt_indexdoesn't change the data forringso mark it as const. This is needed by the following patch that disables interrupt auto clear for rings.
Quoted 8 lines
Quoted 1 line
Yeah, nice cleanup. But do we really need it in -stable?
Yes, it was followed by a fix patch that needs this:
468c49f44759("thunderbolt: Disable interrupt auto clear for rings")I marked both for stable but perhaps the latter did not apply cleanly for v5.10?
468c49f44759 was a fix for 7a1808f82a37 which landed in 5.15-rc1. The relevant AMD hardware w/ USB4 wasn't supported back in 5.10.
So no big reason to take this const qualifier patch in for 5.10 IMO.
Greg Kroah-Hartman
maintainerPATCH 64/173 riscv: Bump COMMAND_LINE_SIZE value to 1024
In reply to Greg Kroah-HartmanFrom: Alexandre Ghiti <[email protected]>
[ Upstream commit 61fc1ee8be26bc192d691932b0a67eabee45d12f ]
Increase COMMAND_LINE_SIZE as the current default value is too low for syzbot kernel command line.
There has been considerable discussion on this patch that has led to a larger patch set removing COMMAND_LINE_SIZE from the uapi headers on all ports. That's not quite done yet, but it's gotten far enough we're confident this is not a uABI change so this is safe.
--- arch/riscv/include/uapi/asm/setup.h | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 arch/riscv/include/uapi/asm/setup.h
arch/riscv/include/uapi/asm/setup.h new file +8 -0
@@ -0,0 +1,8 @@ +/* SPDX-License-Identifier: GPL-2.0-only WITH Linux-syscall-note */ + +#ifndef _UAPI_ASM_RISCV_SETUP_H +#define _UAPI_ASM_RISCV_SETUP_H + +#define COMMAND_LINE_SIZE 1024 + +#endif /* _UAPI_ASM_RISCV_SETUP_H */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 65/173 HID: cp2112: Fix driver not registering GPIO IRQ chip as threaded
In reply to Greg Kroah-HartmanFrom: Danny Kaehn <[email protected]>
[ Upstream commit 37f5b858a66543b2b67c0288280af623985abc29 ]
The CP2112 generates interrupts from a polling routine on a thread, and can only support threaded interrupts. This patch configures the gpiochip irq chip with this flag, disallowing consumers to request a hard IRQ from this driver, which resulted in a segfault previously.
--- drivers/hid/hid-cp2112.c | 1 + 1 file changed, 1 insertion(+)
drivers/hid/hid-cp2112.c +1 -0
@@ -1352,6 +1352,7 @@ static int cp2112_probe(struct hid_device *hdev, const struct hid_device_id *id) girq->parents =NULL ; girq->default_type =IRQ_TYPE_NONE ; girq->handler = handle_simple_irq; + girq->threaded = true; ret =gpiochip_add_data (&dev->gc, dev);if (ret <0 ) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 66/173 ca8210: fix mac_len negative array access
In reply to Greg Kroah-HartmanFrom: Alexander Aring <[email protected]>
[ Upstream commit 6c993779ea1d0cccdb3a5d7d45446dd229e610a3 ]
This patch fixes a buffer overflow access of skb->data if ieee802154_hdr_peek_addrs() fails.
--- drivers/net/ieee802154/ca8210.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ieee802154/ca8210.c +2 -0
@@ -1956,6 +1956,8 @@ static int ca8210_skb_tx(* packet */ mac_len =ieee802154_hdr_peek_addrs (skb, &header); +if (mac_len <0 ) +return mac_len; secspec.security_level = header.sec.level; secspec.key_id_mode = header.sec.key_id_mode;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 67/173 m68k: Only force 030 bus error if PC not in exception table
In reply to Greg Kroah-HartmanFrom: Michael Schmitz <[email protected]>
[ Upstream commit e36a82bebbf7da814530d5a179bef9df5934b717 ]
__get_kernel_nofault() does copy data in supervisor mode when forcing a task backtrace log through /proc/sysrq_trigger. This is expected cause a bus error exception on e.g. NULL pointer dereferencing when logging a kernel task has no workqueue associated. This bus error ought to be ignored.
Our 030 bus error handler is ill equipped to deal with this:
Whenever ssw indicates a kernel mode access on a data fault, we don't even attempt to handle the fault and instead always send a SEGV signal (or panic). As a result, the check for exception handling at the fault PC (buried in send_sig_fault() which gets called from do_page_fault() eventually) is never used.
In contrast, both 040 and 060 access error handlers do not care whether a fault happened on supervisor mode access, and will call do_page_fault() on those, ultimately honoring the exception table.
Add a check in bus_error030 to call do_page_fault() in case we do have an entry for the fault PC in our exception table.
I had attempted a fix for this earlier in 2019 that did rely on testing pagefault_disabled() (see link below) to achieve the same thing, but this patch should be more generic.
Tested on 030 Atari Falcon.
--- arch/m68k/kernel/traps.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/m68k/kernel/traps.c +3 -1
@@ -30,6 +30,7 @@#include <linux/init.h> #include <linux/ptrace.h> #include <linux/kallsyms.h> +#include <linux/extable.h> #include <asm/setup.h> #include <asm/fpu.h>
@@ -549,7 +550,8 @@ static inline void bus_error030 (struct frame *fp) errorcode |=2 ;if (mmusr & (MMU_I |MMU_WP )) { -if (ssw &4 ) { +/* We might have an exception table for this PC */ +if (ssw &4 && !search_exception_tables (fp->ptregs.pc)) { pr_err("Data %s fault at %#010lx in %s (pc=%#lx)\n", ssw & RW ? "read" : "write", fp->un.fmtb.daddr,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 68/173 selftests/bpf: check that modifier resolves after pointer
In reply to Greg Kroah-HartmanFrom: Lorenz Bauer <[email protected]>
[ Upstream commit dfdd608c3b365f0fd49d7e13911ebcde06b9865b ]
Add a regression test that ensures that a VAR pointing at a modifier which follows a PTR (or STRUCT or ARRAY) is resolved correctly by the datasec validator.
--- tools/testing/selftests/bpf/prog_tests/btf.c | 28 ++++++++++++++++++++ 1 file changed, 28 insertions(+)
tools/testing/selftests/bpf/prog_tests/btf.c +28 -0
@@ -882,6 +882,34 @@ static struct btf_raw_test raw_tests[] = { .btf_load_err = true, .err_str = "Invalid elem", }, +{ + .descr = "var after datasec, ptr followed by modifier", + .raw_types = { + /* .bss section */ /* [1] */ + BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_DATASEC, 0, 2), + sizeof(void*)+4), + BTF_VAR_SECINFO_ENC(4, 0, sizeof(void*)), + BTF_VAR_SECINFO_ENC(6, sizeof(void*), 4), + /* int */ /* [2] */ + BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), + /* int* */ /* [3] */ + BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 2), + BTF_VAR_ENC(NAME_TBD, 3, 0), /* [4] */ + /* const int */ /* [5] */ + BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_CONST, 0, 0), 2), + BTF_VAR_ENC(NAME_TBD, 5, 0), /* [6] */ + BTF_END_RAW, + }, + .str_sec = "\0a\0b\0c\0", + .str_sec_size = sizeof("\0a\0b\0c\0"), + .map_type = BPF_MAP_TYPE_ARRAY, + .map_name = ".bss", + .key_size = sizeof(int), + .value_size = sizeof(void*)+4, + .key_type_id = 0, + .value_type_id = 1, + .max_entries = 1, +}, /* Test member exceeds the size of struct. * * struct A {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 69/173 scsi: target: iscsi: Fix an error message in iscsi_check_key()
In reply to Greg Kroah-HartmanFrom: Maurizio Lombardi <[email protected]>
[ Upstream commit 6cc55c969b7ce8d85e09a636693d4126c3676c11 ]
The first half of the error message is printed by pr_err(), the second half is printed by pr_debug(). The user will therefore see only the first part of the message and will miss some useful information.
--- drivers/target/iscsi/iscsi_target_parameters.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/target/iscsi/iscsi_target_parameters.c +7 -5
@@ -1262,18 +1262,20 @@ static struct iscsi_param *iscsi_check_key(return param;if (!(param->phase & phase)) { -pr_err ("Key \"%s\" may not be negotiated during " , - param->name); +char *phase_name; +switch (phase) {case PHASE_SECURITY : -pr_debug ("Security phase.\n" ); + phase_name ="Security" ;break ;case PHASE_OPERATIONAL : -pr_debug ("Operational phase.\n" ); + phase_name ="Operational" ;break ;default : -pr_debug ("Unknown phase.\n" ); + phase_name ="Unknown" ; } +pr_err ("Key \"%s\" may not be negotiated during %s phase.\n" , + param->name, phase_name);return NULL ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 70/173 scsi: hisi_sas: Check devm_add_action() return value
In reply to Greg Kroah-HartmanFrom: Kang Chen <[email protected]>
[ Upstream commit 06d1a90de60208054cca15ef200138cfdbb642a9 ]
In case devm_add_action() fails, check it in the caller of interrupt_preinit_v3_hw().
--- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +1 -2
@@ -2402,8 +2402,7 @@ static int interrupt_preinit_v3_hw(struct hisi_hba *hisi_hba) hisi_hba->cq_nvecs = vectors -BASE_VECTORS_V3_HW ; shost->nr_hw_queues = hisi_hba->cq_nvecs; -devm_add_action (&pdev->dev, hisi_sas_v3_free_vectors, pdev); -return 0 ; +return devm_add_action (&pdev->dev, hisi_sas_v3_free_vectors, pdev); }static int interrupt_init_v3_hw (struct hisi_hba *hisi_hba)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 71/173 scsi: ufs: core: Add soft dependency on governor_simpleondemand
In reply to Greg Kroah-HartmanFrom: Adrien Thierry <[email protected]>
[ Upstream commit 2ebe16155dc8bd4e602cad5b5f65458d2eaa1a75 ]
The ufshcd driver uses simpleondemand governor for devfreq. Add it to the list of ufshcd softdeps to allow userspace initramfs tools like dracut to automatically pull the governor module into the initramfs together with UFS drivers.
--- drivers/scsi/ufs/ufshcd.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/ufs/ufshcd.c +1 -0
@@ -9311,5 +9311,6 @@ EXPORT_SYMBOL_GPL(ufshcd_init);MODULE_AUTHOR ("Santosh Yaragnavi <[email protected]>" );MODULE_AUTHOR ("Vinayak Holikatti <[email protected]>" );MODULE_DESCRIPTION ("Generic UFS host controller driver Core" ); +MODULE_SOFTDEP ("pre: governor_simpleondemand" );MODULE_LICENSE ("GPL" );MODULE_VERSION (UFSHCD_DRIVER_VERSION );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 72/173 scsi: lpfc: Avoid usage of list iterator variable after loop
In reply to Greg Kroah-HartmanFrom: Jakob Koschel <[email protected]>
[ Upstream commit 2850b23e9f9ae3696e472d2883ea1b43aafa884e ]
If the &epd_pool->list is empty when executing lpfc_get_io_buf_from_expedite_pool() the function would return an invalid pointer. Even in the case if the list is guaranteed to be populated, the iterator variable should not be used after the loop to be more robust for future changes.
Linus proposed to avoid any use of the list iterator variable after the loop, in the attempt to move the list iterator variable declaration into the macro to avoid any potential misuse after the loop [1].
--- drivers/scsi/lpfc/lpfc_sli.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/scsi/lpfc/lpfc_sli.c +4 -4
@@ -20816,20 +20816,20 @@ lpfc_get_io_buf_from_private_pool(struct lpfc_hba *phba,static struct lpfc_io_buf *lpfc_get_io_buf_from_expedite_pool (struct lpfc_hba *phba) { -struct lpfc_io_buf *lpfc_ncmd; +struct lpfc_io_buf *lpfc_ncmd =NULL , *iter;struct lpfc_io_buf *lpfc_ncmd_next;unsigned long iflag;struct lpfc_epd_pool *epd_pool; epd_pool = &phba->epd_pool; - lpfc_ncmd =NULL ;spin_lock_irqsave (&epd_pool->lock, iflag);if (epd_pool->count >0 ) { -list_for_each_entry_safe (lpfc_ncmd, lpfc_ncmd_next, +list_for_each_entry_safe (iter, lpfc_ncmd_next, &epd_pool->list, list) { -list_del (&lpfc_ncmd->list); +list_del (&iter->list); epd_pool->count--; + lpfc_ncmd = iter;break ; } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 73/173 scsi: storvsc: Handle BlockSize change in Hyper-V VHD/VHDX file
In reply to Greg Kroah-HartmanFrom: Michael Kelley <[email protected]>
[ Upstream commit 11d9874c4204a785f43d899a1ab12f9dc8d9de3e ]
Hyper-V uses a VHD or VHDX file on the host as the underlying storage for a virtual disk. The VHD/VHDX file format is a sparse format where real disk space on the host is assigned in chunks that the VHD/VHDX file format calls the BlockSize. This BlockSize is not to be confused with the 512-byte (or 4096-byte) sector size of the underlying storage device. The default block size for a new VHD/VHDX file is 32 Mbytes. When a guest VM touches any disk space within a 32 Mbyte chunk of the VHD/VHDX file, Hyper-V allocates 32 Mbytes of real disk space for that section of the VHD/VHDX. Similarly, if a discard operation is done that covers an entire 32 Mbyte chunk, Hyper-V will free the real disk space for that portion of the VHD/VHDX. This BlockSize is surfaced in Linux as the "discard_granularity" in /sys/block/sd<x>/queue, which makes sense.
Hyper-V also has differencing disks that can overlay a VHD/VHDX file to capture changes to the VHD/VHDX while preserving the original VHD/VHDX. One example of this differencing functionality is for VM snapshots. When a snapshot is created, a differencing disk is created. If the snapshot is rolled back, Hyper-V can just delete the differencing disk, and the VM will see the original disk contents at the time the snapshot was taken. Differencing disks are used in other scenarios as well.
The BlockSize for a differencing disk defaults to 2 Mbytes, not 32 Mbytes. The smaller default is used because changes to differencing disks are typically scattered all over, and Hyper-V doesn't want to allocate 32 Mbytes of real disk space for a stray write here or there. The smaller BlockSize provides more efficient use of real disk space.
When a differencing disk is added to a VHD/VHDX, Hyper-V reports UNIT_ATTENTION with a sense code indicating "Operating parameters have changed", because the value of discard_granularity should be changed to 2 Mbytes. When the differencing disk is removed, discard_granularity should be changed back to 32 Mbytes. However, current code simply reports a message from scsi_report_sense() and the value of /sys/block/sd<x>/queue/discard_granularity is not updated. The message isn't very actionable by a sysadmin.
Fix this by having the storvsc driver check for the sense code indicating that the underly VHD/VHDX block size has changed, and do a rescan of the device to pick up the new discard_granularity. With this change the entire transition to/from differencing disks is handled automatically and transparently, with no confusing messages being output.
--- drivers/scsi/storvsc_drv.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/scsi/storvsc_drv.c +16 -0
@@ -1013,6 +1013,22 @@ static void storvsc_handle_error(struct vmscsi_request *vm_srb, goto do_work; } +/* +* Check for "Operating parameters have changed" +* due to Hyper-V changing the VHD/VHDX BlockSize +* when adding/removing a differencing disk. This +* causes discard_granularity to change, so do a +* rescan to pick up the new granularity. We don't +* want scsi_report_sense() to output a message +* that a sysadmin wouldn't know what to do with. +*/ +if ((asc ==0x3f ) && (ascq !=0x03 ) && + (ascq !=0x0e )) { + process_err_fn = storvsc_device_scan; +set_host_byte (scmnd,DID_REQUEUE ); + goto do_work; + } +/* * Otherwise, let upper layer deal with the * error when sense message is present
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 74/173 net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990
In reply to Greg Kroah-HartmanFrom: Enrico Sau <[email protected]>
[ Upstream commit 418383e6ed6b4624a54ec05c535f13d184fbf33b ]
Add quirk CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE for Telit FE990 0x1081 composition in order to avoid bind error.
--- drivers/net/usb/cdc_mbim.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/usb/cdc_mbim.c +5 -0
@@ -663,6 +663,11 @@ static const struct usb_device_id mbim_devs[] = { .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle, }, +/* Telit FE990 */ + { USB_DEVICE_AND_INTERFACE_INFO(0x1bc7, 0x1081, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE), + .driver_info = (unsigned long )&cdc_mbim_info_avoid_altsetting_toggle, + }, + /* default entry */ { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE), .driver_info = (unsigned long)&cdc_mbim_info_zlp,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 75/173 net: usb: qmi_wwan: add Telit 0x1080 composition
In reply to Greg Kroah-HartmanFrom: Enrico Sau <[email protected]>
[ Upstream commit 382e363d5bed0cec5807b35761d14e55955eee63 ]
Add the following Telit FE990 composition:
0x1080: tty, adb, rmnet, tty, tty, tty, tty
--- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/qmi_wwan.c +1 -0
@@ -1297,6 +1297,7 @@ static const struct usb_device_id products[] = { {QMI_QUIRK_SET_DTR(0x1bc7, 0x1050, 2)}, /* Telit FN980 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1060, 2)}, /* Telit LN920 */ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1070, 2)}, /* Telit FN990 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1080, 2)}, /* Telit FE990 */ {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */ {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */ {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 76/173 sh: sanitize the flags on sigreturn
In reply to Greg Kroah-HartmanFrom: Al Viro <[email protected]>
[ Upstream commit 573b22ccb7ce9ab7f0539a2e11a9d3609a8783f5 ]
We fetch %SR value from sigframe; it might have been modified by signal handler, so we can't trust it with any bits that are not modifiable in user mode.
--- arch/sh/include/asm/processor_32.h | 1 + arch/sh/kernel/signal_32.c | 3 +++ 2 files changed, 4 insertions(+)
arch/sh/include/asm/processor_32.h +1 -0
@@ -50,6 +50,7 @@#define SR_FD 0x00008000#define SR_MD 0x40000000 +#define SR_USER_MASK 0x00000303 // M, Q, S, T bits/* * DSP structure and data */
arch/sh/kernel/signal_32.c +3 -0
@@ -115,6 +115,7 @@ static int restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc, int *r0_p) { unsigned int err = 0; +unsigned int sr = regs->sr & ~SR_USER_MASK ;#define COPY (x) err |= __get_user(regs->x, &sc->sc_##x)COPY (regs[1 ]);
@@ -130,6 +131,8 @@ restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc, int *r0_pCOPY (sr);COPY (pc);#undef COPY + regs->sr = (regs->sr &SR_USER_MASK ) | sr; +#ifdef CONFIG_SH_FPU if (boot_cpu_data.flags &CPU_HAS_FPU ) {int owned_fp;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 77/173 cifs: empty interface list when server doesnt support query interfaces
In reply to Greg Kroah-HartmanFrom: Shyam Prasad N <[email protected]>
commit 896cd316b841053f6df95ab77b5f1322c16a8e18 upstream.
When querying server interfaces returns -EOPNOTSUPP, clear the list of interfaces. Assumption is that multichannel would be disabled too.
--- fs/cifs/smb2ops.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/cifs/smb2ops.c +1 -1
@@ -593,7 +593,7 @@ SMB3_request_interfaces(const unsigned iif (rc == -EOPNOTSUPP ) {cifs_dbg (FYI ,"server does not support query network interfaces\n" ); - goto out; + ret_data_len =0 ; }else if (rc !=0 ) {cifs_tcon_dbg (VFS ,"error %d on ioctl to get interface list\n" , rc); goto out;
Greg Kroah-Hartman
maintainerPATCH 78/173 scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR
In reply to Greg Kroah-HartmanFrom: Joel Selvaraj <[email protected]>
commit a204b490595de71016b2360a1886ec8c12d0afac upstream.
Xiaomi Poco F1 (qcom/sdm845-xiaomi-beryllium*.dts) comes with a SKhynix H28U74301AMR UFS. The sd_read_cpr() operation leads to a 120 second timeout, making the device bootup very slow:
[ 121.457736] sd 0:0:0:1: [sdb] tag#23 timing out command, waited 120s
Setting the BLIST_SKIP_VPD_PAGES allows the device to skip the failing sd_read_cpr operation and boot normally.
--- drivers/scsi/scsi_devinfo.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/scsi_devinfo.c +1 -0
@@ -232,6 +232,7 @@ static struct { {"SGI", "RAID5", "*", BLIST_SPARSELUN}, {"SGI", "TP9100", "*", BLIST_REPORTLUN2}, {"SGI", "Universal Xport", "*", BLIST_NO_ULD_ATTACH}, + {"SKhynix", "H28U74301AMR", NULL, BLIST_SKIP_VPD_PAGES}, {"IBM", "Universal Xport", "*", BLIST_NO_ULD_ATTACH}, {"SUN", "Universal Xport", "*", BLIST_NO_ULD_ATTACH}, {"DELL", "Universal Xport", "*", BLIST_NO_ULD_ATTACH},
Greg Kroah-Hartman
maintainerPATCH 79/173 usb: dwc2: fix a devres leak in hw_enable upon suspend resume
In reply to Greg Kroah-HartmanFrom: Fabrice Gasnier <[email protected]>
commit f747313249b74f323ddf841a9c8db14d989f296a upstream.
Each time the platform goes to low power, PM suspend / resume routines
call: __dwc2_lowlevel_hw_enable -> devm_add_action_or_reset(). This adds a new devres each time.
This may also happen at runtime, as dwc2_lowlevel_hw_enable() can be called from udc_start().
This can be seen with tracing:
- echo 1 > /sys/kernel/debug/tracing/events/dev/devres_log/enable
- go to low power
- cat /sys/kernel/debug/tracing/trace
A new "ADD" entry is found upon each low power cycle:
... devres_log: 49000000.usb-otg ADD 82a13bba devm_action_release (8 bytes) ... devres_log: 49000000.usb-otg ADD 49889daf devm_action_release (8 bytes)
...
A second issue is addressed here:
- regulator_bulk_enable() is called upon each PM cycle (suspend/resume).
- regulator_bulk_disable() never gets called.
So the reference count for these regulators constantly increase, by one upon each low power cycle, due to missing regulator_bulk_disable() call in __dwc2_lowlevel_hw_disable().
The original fix that introduced the devm_add_action_or_reset() call, fixed an issue during probe, that happens due to other errors in dwc2_driver_probe() -> dwc2_core_reset(). Then the probe fails without disabling regulators, when dr_mode == USB_DR_MODE_PERIPHERAL.
Rather fix the error path: disable all the low level hardware in the error path, by using the "hsotg->ll_hw_enabled" flag. Checking dr_mode has been introduced to avoid a dual call to dwc2_lowlevel_hw_disable(). "ll_hw_enabled" should achieve the same (and is used currently in the remove() routine).
--- drivers/usb/dwc2/platform.c | 16 ++-------------- 1 file changed, 2 insertions(+), 14 deletions(-)
drivers/usb/dwc2/platform.c +2 -14
@@ -121,13 +121,6 @@ static int dwc2_get_dr_mode(struct dwc2_return 0 ; } -static void __dwc2_disable_regulators (void *data) -{ -struct dwc2_hsotg *hsotg = data; - -regulator_bulk_disable (ARRAY_SIZE (hsotg->supplies), hsotg->supplies); -} -static int __dwc2_lowlevel_hw_enable (struct dwc2_hsotg *hsotg) {struct platform_device *pdev =to_platform_device (hsotg->dev);
@@ -138,11 +131,6 @@ static int __dwc2_lowlevel_hw_enable(strif (ret)return ret; - ret =devm_add_action_or_reset (&pdev->dev, - __dwc2_disable_regulators, hsotg); -if (ret) -return ret; -if (hsotg->clk) { ret =clk_prepare_enable (hsotg->clk);if (ret)
@@ -198,7 +186,7 @@ static int __dwc2_lowlevel_hw_disable(stif (hsotg->clk)clk_disable_unprepare (hsotg->clk); -return 0 ; +return regulator_bulk_disable (ARRAY_SIZE (hsotg->supplies), hsotg->supplies); }/**
@@ -625,7 +613,7 @@ error_init:if (hsotg->params.activate_stm_id_vb_detection)regulator_disable (hsotg->usb33d); error: -if (hsotg->dr_mode !=USB_DR_MODE_PERIPHERAL ) +if (hsotg->ll_hw_enabled)dwc2_lowlevel_hw_disable (hsotg);return retval; }
Greg Kroah-Hartman
maintainerPATCH 80/173 usb: gadget: u_audio: dont let userspace block driver unbind
In reply to Greg Kroah-HartmanFrom: Alvin Šipraga <[email protected]>
commit 6c67ed9ad9b83e453e808f9b31a931a20a25629b upstream.
In the unbind callback for f_uac1 and f_uac2, a call to snd_card_free() via g_audio_cleanup() will disconnect the card and then wait for all resources to be released, which happens when the refcount falls to zero. Since userspace can keep the refcount incremented by not closing the relevant file descriptor, the call to unbind may block indefinitely. This can cause a deadlock during reboot, as evidenced by the following blocked task observed on my machine:
task:reboot state:D stack:0 pid:2827 ppid:569 flags:0x0000000c
Call trace: __switch_to+0xc8/0x140 __schedule+0x2f0/0x7c0 schedule+0x60/0xd0 schedule_timeout+0x180/0x1d4 wait_for_completion+0x78/0x180 snd_card_free+0x90/0xa0 g_audio_cleanup+0x2c/0x64 afunc_unbind+0x28/0x60 ... kernel_restart+0x4c/0xac __do_sys_reboot+0xcc/0x1ec __arm64_sys_reboot+0x28/0x30 invoke_syscall+0x4c/0x110 ...
The issue can also be observed by opening the card with arecord and then stopping the process through the shell before unbinding:
# arecord -D hw:UAC2Gadget -f S32_LE -c 2 -r 48000 /dev/null Recording WAVE '/dev/null' : Signed 32 bit Little Endian, Rate 48000 Hz, Stereo ^Z[1]+ Stopped arecord -D hw:UAC2Gadget -f S32_LE -c 2 -r 48000 /dev/null # echo gadget.0 > /sys/bus/gadget/drivers/configfs-gadget/unbind (observe that the unbind command never finishes)
Fix the problem by using snd_card_free_when_closed() instead, which will still disconnect the card as desired, but defer the task of freeing the resources to the core once userspace closes its file descriptor.
--- drivers/usb/gadget/function/u_audio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/function/u_audio.c +1 -1
@@ -613,7 +613,7 @@ void g_audio_cleanup(struct g_audio *g_a uac = g_audio->uac; card = uac->card;if (card) -snd_card_free (card); +snd_card_free_when_closed (card);kfree (uac->p_prm.ureq);kfree (uac->c_prm.ureq);
Greg Kroah-Hartman
maintainerPATCH 81/173 fsverity: Remove WQ_UNBOUND from fsverity read workqueue
In reply to Greg Kroah-HartmanFrom: Nathan Huckleberry <[email protected]>
commit f959325e6ac3f499450088b8d9c626d1177be160 upstream.
WQ_UNBOUND causes significant scheduler latency on ARM64/Android. This is problematic for latency sensitive workloads, like I/O post-processing.
Removing WQ_UNBOUND gives a 96% reduction in fsverity workqueue related scheduler latency and improves app cold startup times by ~30ms. WQ_UNBOUND was also removed from the dm-verity workqueue for the same reason [1].
This code was tested by running Android app startup benchmarks and measuring how long the fsverity workqueue spent in the runnable state.
Before
Total workqueue scheduler latency: 553800us
After
Total workqueue scheduler latency: 18962us
[1]: https://lore.kernel.org/all/[email protected]/
--- fs/verity/verify.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
fs/verity/verify.c +6 -6
@@ -279,15 +279,15 @@ EXPORT_SYMBOL_GPL(fsverity_enqueue_verifint __init fsverity_init_workqueue (void ) {/* -* Use an unbound workqueue to allow bios to be verified in parallel -* even when they happen to complete on the same CPU. This sacrifices -* locality, but it's worthwhile since hashing is CPU-intensive. +* Use a high-priority workqueue to prioritize verification work, which +* blocks reads from completing, over regular application tasks. * -* Also use a high-priority workqueue to prioritize verification work, -* which blocks reads from completing, over regular application tasks. +* For performance reasons, don't use an unbound workqueue. Using an +* unbound workqueue for crypto operations causes excessive scheduler +* latency on ARM64. */ fsverity_read_workqueue =alloc_workqueue ("fsverity_read_queue" , -WQ_UNBOUND |WQ_HIGHPRI , +WQ_HIGHPRI ,num_online_cpus ());if (!fsverity_read_workqueue)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 82/173 igb: revert rtnl_lock() that causes deadlock
In reply to Greg Kroah-HartmanFrom: Lin Ma <[email protected]>
commit 65f69851e44d71248b952a687e44759a7abb5016 upstream.
The commit 6faee3d4ee8b ("igb: Add lock to avoid data race") adds rtnl_lock to eliminate a false data race shown below
(FREE from device detaching) | (USE from netdev core)
igb_remove | igb_ndo_get_vf_config
igb_disable_sriov | vf >= adapter->vfs_allocated_count?
kfree(adapter->vf_data) |
adapter->vfs_allocated_count = 0 |
| memcpy(... adapter->vf_data[vf]The above race will never happen and the extra rtnl_lock causes deadlock below
[ 141.420169] <TASK> [ 141.420672] __schedule+0x2dd/0x840 [ 141.421427] schedule+0x50/0xc0 [ 141.422041] schedule_preempt_disabled+0x11/0x20 [ 141.422678] __mutex_lock.isra.13+0x431/0x6b0 [ 141.423324] unregister_netdev+0xe/0x20 [ 141.423578] igbvf_remove+0x45/0xe0 [igbvf] [ 141.423791] pci_device_remove+0x36/0xb0 [ 141.423990] device_release_driver_internal+0xc1/0x160 [ 141.424270] pci_stop_bus_device+0x6d/0x90 [ 141.424507] pci_stop_and_remove_bus_device+0xe/0x20 [ 141.424789] pci_iov_remove_virtfn+0xba/0x120 [ 141.425452] sriov_disable+0x2f/0xf0 [ 141.425679] igb_disable_sriov+0x4e/0x100 [igb] [ 141.426353] igb_remove+0xa0/0x130 [igb] [ 141.426599] pci_device_remove+0x36/0xb0 [ 141.426796] device_release_driver_internal+0xc1/0x160 [ 141.427060] driver_detach+0x44/0x90 [ 141.427253] bus_remove_driver+0x55/0xe0 [ 141.427477] pci_unregister_driver+0x2a/0xa0 [ 141.428296] __x64_sys_delete_module+0x141/0x2b0 [ 141.429126] ? mntput_no_expire+0x4a/0x240 [ 141.429363] ? syscall_trace_enter.isra.19+0x126/0x1a0 [ 141.429653] do_syscall_64+0x5b/0x80 [ 141.429847] ? exit_to_user_mode_prepare+0x14d/0x1c0 [ 141.430109] ? syscall_exit_to_user_mode+0x12/0x30 [ 141.430849] ? do_syscall_64+0x67/0x80 [ 141.431083] ? syscall_exit_to_user_mode_prepare+0x183/0x1b0 [ 141.431770] ? syscall_exit_to_user_mode+0x12/0x30 [ 141.432482] ? do_syscall_64+0x67/0x80 [ 141.432714] ? exc_page_fault+0x64/0x140 [ 141.432911] entry_SYSCALL_64_after_hwframe+0x72/0xdc
Since the igb_disable_sriov() will call pci_disable_sriov() before releasing any resources, the netdev core will synchronize the cleanup to avoid any races. This patch removes the useless rtnl_(un)lock to guarantee correctness.
--- drivers/net/ethernet/intel/igb/igb_main.c | 2 -- 1 file changed, 2 deletions(-)
drivers/net/ethernet/intel/igb/igb_main.c +0 -2
@@ -3821,9 +3821,7 @@ static void igb_remove(struct pci_dev *pigb_release_hw_control (adapter);#ifdef CONFIG_PCI_IOV -rtnl_lock ();igb_disable_sriov (pdev); -rtnl_unlock ();#endif unregister_netdev (netdev);
Greg Kroah-Hartman
maintainerPATCH 83/173 dm thin: fix deadlock when swapping to thin device
In reply to Greg Kroah-HartmanFrom: Coly Li <[email protected]>
commit 9bbf5feecc7eab2c370496c1c161bbfe62084028 upstream.
This is an already known issue that dm-thin volume cannot be used as swap, otherwise a deadlock may happen when dm-thin internal memory demand triggers swap I/O on the dm-thin volume itself.
But thanks to commit a666e5c05e7c ("dm: fix deadlock when swapping to encrypted device"), the limit_swap_bios target flag can also be used for dm-thin to avoid the recursive I/O when it is used as swap.
Fix is to simply set ti->limit_swap_bios to true in both pool_ctr() and thin_ctr().
In my test, I create a dm-thin volume /dev/vg/swap and use it as swap device. Then I run fio on another dm-thin volume /dev/vg/main and use large --blocksize to trigger swap I/O onto /dev/vg/swap.
The following fio command line is used in my test,
fio --name recursive-swap-io --lockmem 1 --iodepth 128 \
--ioengine libaio --filename /dev/vg/main --rw randrw \
--blocksize 1M --numjobs 32 --time_based --runtime=12hWithout this fix, the whole system can be locked up within 15 seconds.
With this fix, there is no any deadlock or hung task observed after 2 hours of running fio.
Furthermore, if blocksize is changed from 1M to 128M, after around 30 seconds fio has no visible I/O, and the out-of-memory killer message shows up in kernel message. After around 20 minutes all fio processes are killed and the whole system is back to being alive.
This is exactly what is expected when recursive I/O happens on dm-thin volume when it is used as swap.
Depends-on: a666e5c05e7c ("dm: fix deadlock when swapping to encrypted device")
--- drivers/md/dm-thin.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/md/dm-thin.c +2 -0
@@ -3383,6 +3383,7 @@ static int pool_ctr(struct dm_target *ti pt->low_water_blocks = low_water_blocks; pt->adjusted_pf = pt->requested_pf = pf; ti->num_flush_bios =1 ; + ti->limit_swap_bios = true;/* * Only need to enable discards if the pool should pass
@@ -4259,6 +4260,7 @@ static int thin_ctr(struct dm_target *ti goto bad; ti->num_flush_bios =1 ; + ti->limit_swap_bios = true; ti->flush_supported = true; ti->per_io_data_size =sizeof (struct dm_thin_endio_hook );
Greg Kroah-Hartman
maintainerPATCH 84/173 usb: cdns3: Fix issue with using incorrect PCI device function
In reply to Greg Kroah-HartmanFrom: Pawel Laszczak <[email protected]>
commit 1272fd652a226ccb34e9f47371b6121948048438 upstream.
PCI based platform can have more than two PCI functions. USBSS PCI Glue driver during initialization should consider only DRD/HOST/DEVICE PCI functions and all other should be ignored. This patch adds additional condition which causes that only DRD and HOST/DEVICE function will be accepted.
--- drivers/usb/cdns3/cdns3-pci-wrap.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/cdns3/cdns3-pci-wrap.c +5 -0
@@ -60,6 +60,11 @@ static struct pci_dev *cdns3_get_second_return NULL ; } +if (func->devfn !=PCI_DEV_FN_HOST_DEVICE && + func->devfn !=PCI_DEV_FN_OTG ) { +return NULL ; + } +return func; }
Greg Kroah-Hartman
maintainerPATCH 85/173 usb: chipdea: core: fix return -EINVAL if request role is the same with current role
In reply to Greg Kroah-HartmanFrom: Xu Yang <[email protected]>
commit 3670de80678961eda7fa2220883fc77c16868951 upstream.
It should not return -EINVAL if the request role is the same with current role, return non-error and without do anything instead.
--- drivers/usb/chipidea/core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/usb/chipidea/core.c +4 -1
@@ -966,9 +966,12 @@ static ssize_t role_store(struct device strlen(ci->roles[role]->name)))break ; -if (role ==CI_ROLE_END || role == ci->role) +if (role ==CI_ROLE_END )return -EINVAL ; +if (role == ci->role) +return n; +pm_runtime_get_sync (dev);disable_irq (ci->irq);ci_role_stop (ci);
Greg Kroah-Hartman
maintainerPATCH 86/173 usb: chipidea: core: fix possible concurrent when switch role
In reply to Greg Kroah-HartmanFrom: Xu Yang <[email protected]>
commit 451b15ed138ec15bffbebb58a00ebdd884c3e659 upstream.
The user may call role_store() when driver is handling ci_handle_id_switch() which is triggerred by otg event or power lost event. Unfortunately, the controller may go into chaos in this case. Fix this by protecting it with mutex lock.
--- drivers/usb/chipidea/ci.h | 2 ++ drivers/usb/chipidea/core.c | 8 +++++++- drivers/usb/chipidea/otg.c | 5 ++++- 3 files changed, 13 insertions(+), 2 deletions(-)
drivers/usb/chipidea/ci.h +2 -0
@@ -204,6 +204,7 @@ struct hw_bank {* @in_lpm: if the core in low power mode * @wakeup_int: if wakeup interrupt occur * @rev: The revision number for controller +* @mutex: protect code from concorrent running when doing role switch */ struct ci_hdrc {struct device *dev;
@@ -257,6 +258,7 @@ struct ci_hdrc {bool in_lpm;bool wakeup_int;enum ci_revision rev; +struct mutex mutex; };static inline struct ci_role_driver *ci_role (struct ci_hdrc *ci)
drivers/usb/chipidea/core.c +7 -1
@@ -969,8 +969,12 @@ static ssize_t role_store(struct deviceif (role ==CI_ROLE_END )return -EINVAL ; -if (role == ci->role) +mutex_lock (&ci->mutex); + +if (role == ci->role) { +mutex_unlock (&ci->mutex);return n; + }pm_runtime_get_sync (dev);disable_irq (ci->irq);
@@ -980,6 +984,7 @@ static ssize_t role_store(struct deviceci_handle_vbus_change (ci);enable_irq (ci->irq);pm_runtime_put_sync (dev); +mutex_unlock (&ci->mutex);return (ret ==0 ) ? n : ret; }
@@ -1015,6 +1020,7 @@ static int ci_hdrc_probe(struct platformreturn -ENOMEM ;spin_lock_init (&ci->lock); +mutex_init (&ci->mutex); ci->dev = dev; ci->platdata =dev_get_platdata (dev); ci->imx28_write_fix = !!(ci->platdata->flags &
drivers/usb/chipidea/otg.c +4 -1
@@ -166,8 +166,10 @@ static int hw_wait_vbus_lower_bsv(structstatic void ci_handle_id_switch (struct ci_hdrc *ci) { -enum ci_role role =ci_otg_role (ci); +enum ci_role role; +mutex_lock (&ci->mutex); + role =ci_otg_role (ci);if (role != ci->role) {dev_dbg (ci->dev,"switching from %s to %s\n" ,ci_role (ci)->name, ci->roles[role]->name);
@@ -197,6 +199,7 @@ static void ci_handle_id_switch(struct cif (role ==CI_ROLE_GADGET )ci_handle_vbus_change (ci); } +mutex_unlock (&ci->mutex); }/** * ci_otg_work - perform otg (vbus/id) event handle
Greg Kroah-Hartman
maintainerPATCH 87/173 usb: ucsi: Fix NULL pointer deref in ucsi_connector_change()
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit f87fb985452ab2083967103ac00bfd68fb182764 upstream.
When ucsi_init() fails, ucsi->connector is NULL, yet in case of ucsi_acpi we may still get events which cause the ucs_acpi code to call ucsi_connector_change(), which then derefs the NULL ucsi->connector pointer.
Fix this by not setting ucsi->ntfy inside ucsi_init() until ucsi_init() has succeeded, so that ucsi_connector_change() ignores the events because UCSI_ENABLE_NTFY_CONNECTOR_CHANGE is not set in the ntfy mask.
--- drivers/usb/typec/ucsi/ucsi.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/usb/typec/ucsi/ucsi.c +6 -5
@@ -1152,7 +1152,7 @@ out_unlock:static int ucsi_init (struct ucsi *ucsi) {struct ucsi_connector *con; -u64 command; +u64 command, ntfy;int ret;int i;
@@ -1164,8 +1164,8 @@ static int ucsi_init(struct ucsi *ucsi) }/* Enable basic notifications */ - ucsi->ntfy =UCSI_ENABLE_NTFY_CMD_COMPLETE |UCSI_ENABLE_NTFY_ERROR ; - command =UCSI_SET_NOTIFICATION_ENABLE | ucsi->ntfy; + ntfy =UCSI_ENABLE_NTFY_CMD_COMPLETE |UCSI_ENABLE_NTFY_ERROR ; + command =UCSI_SET_NOTIFICATION_ENABLE | ntfy; ret =ucsi_send_command (ucsi, command,NULL ,0 );if (ret <0 ) goto err_reset;
@@ -1197,12 +1197,13 @@ static int ucsi_init(struct ucsi *ucsi) }/* Enable all notifications */ - ucsi->ntfy =UCSI_ENABLE_NTFY_ALL ; - command =UCSI_SET_NOTIFICATION_ENABLE | ucsi->ntfy; + ntfy =UCSI_ENABLE_NTFY_ALL ; + command =UCSI_SET_NOTIFICATION_ENABLE | ntfy; ret =ucsi_send_command (ucsi, command,NULL ,0 );if (ret <0 ) goto err_unregister; + ucsi->ntfy = ntfy;return 0 ; err_unregister:
Greg Kroah-Hartman
maintainerPATCH 88/173 wifi: mac80211: fix qos on mesh interfaces
In reply to Greg Kroah-HartmanFrom: Felix Fietkau <[email protected]>
commit 4e348c6c6e23491ae6eb5e077848a42d0562339c upstream.
When ieee80211_select_queue is called for mesh, the sta pointer is usually NULL, since the nexthop is looked up much later in the tx path. Explicitly check for unicast address in that case in order to make qos work again.
--- net/mac80211/wme.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/mac80211/wme.c +4 -2
@@ -141,12 +141,14 @@ u16 ieee80211_select_queue_80211(structu16 __ieee80211_select_queue (struct ieee80211_sub_if_data *sdata,struct sta_info *sta,struct sk_buff *skb) { +const struct ethhdr *eth = (void *)skb->data;struct mac80211_qos_map *qos_map;bool qos;/* all mesh/ocb stations are required to support WME */ -if (sta && (sdata->vif.type ==NL80211_IFTYPE_MESH_POINT || - sdata->vif.type ==NL80211_IFTYPE_OCB )) +if ((sdata->vif.type ==NL80211_IFTYPE_MESH_POINT && + !is_multicast_ether_addr (eth->h_dest)) || + (sdata->vif.type ==NL80211_IFTYPE_OCB && sta)) qos = true;else if (sta) qos = sta->sta.wme;
Greg Kroah-Hartman
maintainerPATCH 89/173 nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()
In reply to Greg Kroah-HartmanFrom: Ryusuke Konishi <[email protected]>
commit 003587000276f81d0114b5ce773d80c119d8cb30 upstream.
The ioctl helper function nilfs_ioctl_wrap_copy(), which exchanges a metadata array to/from user space, may copy uninitialized buffer regions to user space memory for read-only ioctl commands NILFS_IOCTL_GET_SUINFO and NILFS_IOCTL_GET_CPINFO.
This can occur when the element size of the user space metadata given by the v_size member of the argument nilfs_argv structure is larger than the size of the metadata element (nilfs_suinfo structure or nilfs_cpinfo structure) on the file system side.
KMSAN-enabled kernels detect this issue as follows:
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0xc0/0x100 lib/usercopy.c:33 instrument_copy_to_user include/linux/instrumented.h:121 [inline] _copy_to_user+0xc0/0x100 lib/usercopy.c:33 copy_to_user include/linux/uaccess.h:169 [inline] nilfs_ioctl_wrap_copy+0x6fa/0xc10 fs/nilfs2/ioctl.c:99 nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline] nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290 nilfs_compat_ioctl+0x1b8/0x200 fs/nilfs2/ioctl.c:1343 __do_compat_sys_ioctl fs/ioctl.c:968 [inline] __se_compat_sys_ioctl+0x7dd/0x1000 fs/ioctl.c:910 __ia32_compat_sys_ioctl+0x93/0xd0 fs/ioctl.c:910 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246 entry_SYSENTER_compat_after_hwframe+0x70/0x82
Uninit was created at:
__alloc_pages+0x9f6/0xe90 mm/page_alloc.c:5572 alloc_pages+0xab0/0xd80 mm/mempolicy.c:2287 __get_free_pages+0x34/0xc0 mm/page_alloc.c:5599 nilfs_ioctl_wrap_copy+0x223/0xc10 fs/nilfs2/ioctl.c:74 nilfs_ioctl_get_info fs/nilfs2/ioctl.c:1173 [inline] nilfs_ioctl+0x2402/0x4450 fs/nilfs2/ioctl.c:1290 nilfs_compat_ioctl+0x1b8/0x200 fs/nilfs2/ioctl.c:1343 __do_compat_sys_ioctl fs/ioctl.c:968 [inline] __se_compat_sys_ioctl+0x7dd/0x1000 fs/ioctl.c:910 __ia32_compat_sys_ioctl+0x93/0xd0 fs/ioctl.c:910 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246 entry_SYSENTER_compat_after_hwframe+0x70/0x82
Bytes 16-127 of 3968 are uninitialized
...
This eliminates the leak issue by initializing the page allocated as buffer using get_zeroed_page().
--- fs/nilfs2/ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nilfs2/ioctl.c +1 -1
@@ -70,7 +70,7 @@ static int nilfs_ioctl_wrap_copy(structif (argv->v_index > ~(__u64 )0 - argv->v_nmembs)return -EINVAL ; - buf = (void *)__get_free_pages (GFP_NOFS ,0 ); + buf = (void *)get_zeroed_page (GFP_NOFS );if (unlikely (!buf))return -ENOMEM ; maxmembs =PAGE_SIZE / argv->v_size;
Greg Kroah-Hartman
maintainerPATCH 90/173 drm/i915/active: Fix missing debug object activation
In reply to Greg Kroah-HartmanFrom: Nirmoy Das <[email protected]>
commit e92eb246feb9019b0b137706c934b8891cdfe3c2 upstream.
debug_active_activate() expected ref->count to be zero which is not true anymore as __i915_active_activate() calls debug_active_activate() after incrementing the count.
v2: No need to check for "ref->count == 1" as __i915_active_activate() already make sure of that(Janusz).
--- drivers/gpu/drm/i915/i915_active.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/i915/i915_active.c +1 -2
@@ -96,8 +96,7 @@ static void debug_active_init(struct i91static void debug_active_activate (struct i915_active *ref) {lockdep_assert_held (&ref->tree_lock); -if (!atomic_read (&ref->count))/* before the first inc */ -debug_object_activate (ref, &active_debug_desc); +debug_object_activate (ref, &active_debug_desc); }static void debug_active_deactivate (struct i915_active *ref)
Greg Kroah-Hartman
maintainerPATCH 91/173 drm/i915: Preserve crtc_state->inherited during state clearing
In reply to Greg Kroah-HartmanFrom: Ville Syrjälä <[email protected]>
commit 3a84f2c6c9558c554a90ec26ad25df92fc5e05b7 upstream.
intel_crtc_prepare_cleared_state() is unintentionally losing the "inherited" flag. This will happen if intel_initial_commit() is forced to go through the full modeset calculations for whatever reason.
Afterwards the first real commit from userspace will not get forced to the full modeset path, and thus eg. audio state may not get recomputed properly. So if the monitor was already enabled during boot audio will not work until userspace itself does an explicit full modeset.
--- drivers/gpu/drm/i915/display/intel_display.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/i915/display/intel_display.c +1 -0
@@ -13335,6 +13335,7 @@ intel_crtc_prepare_cleared_state(struct* only fields that are know to not cause problems are preserved. */ saved_state->uapi = crtc_state->uapi; + saved_state->inherited = crtc_state->inherited; saved_state->scaler_state = crtc_state->scaler_state; saved_state->shared_dpll = crtc_state->shared_dpll; saved_state->dpll_hw_state = crtc_state->dpll_hw_state;
Greg Kroah-Hartman
maintainerPATCH 92/173 tee: amdtee: fix race condition in amdtee_open_session
In reply to Greg Kroah-HartmanFrom: Rijo Thomas <[email protected]>
commit f8502fba45bd30e1a6a354d9d898bc99d1a11e6d upstream.
There is a potential race condition in amdtee_open_session that may lead to use-after-free. For instance, in amdtee_open_session() after sess->sess_mask is set, and before setting:
sess->session_info[i] = session_info;
if amdtee_close_session() closes this same session, then 'sess' data structure will be released, causing kernel panic when 'sess' is accessed within amdtee_open_session().
The solution is to set the bit sess->sess_mask as the last step in amdtee_open_session().
--- drivers/tee/amdtee/core.c | 29 ++++++++++++++--------------- 1 file changed, 14 insertions(+), 15 deletions(-)
drivers/tee/amdtee/core.c +14 -15
@@ -267,35 +267,34 @@ int amdtee_open_session(struct tee_conte goto out; } +/* Open session with loaded TA */ +handle_open_session (arg, &session_info, param); +if (arg->ret !=TEEC_SUCCESS ) { +pr_err ("open_session failed %d\n" , arg->ret); +handle_unload_ta (ta_handle); +kref_put (&sess->refcount, destroy_session); + goto out; + } +/* Find an empty session index for the given TA */ spin_lock (&sess->lock); i =find_first_zero_bit (sess->sess_mask,TEE_NUM_SESSIONS ); -if (i <TEE_NUM_SESSIONS ) +if (i <TEE_NUM_SESSIONS ) { + sess->session_info[i] = session_info; +set_session_id (ta_handle, i, &arg->session);set_bit (i, sess->sess_mask); + }spin_unlock (&sess->lock);if (i >=TEE_NUM_SESSIONS ) {pr_err ("reached maximum session count %d\n" ,TEE_NUM_SESSIONS ); +handle_close_session (ta_handle, session_info);handle_unload_ta (ta_handle);kref_put (&sess->refcount, destroy_session); rc = -ENOMEM ; goto out; } -/* Open session with loaded TA */ -handle_open_session (arg, &session_info, param); -if (arg->ret !=TEEC_SUCCESS ) { -pr_err ("open_session failed %d\n" , arg->ret); -spin_lock (&sess->lock); -clear_bit (i, sess->sess_mask); -spin_unlock (&sess->lock); -handle_unload_ta (ta_handle); -kref_put (&sess->refcount, destroy_session); - goto out; - } - - sess->session_info[i] = session_info; -set_session_id (ta_handle, i, &arg->session); out:free_pages ((u64 )ta,get_order (ta_size));return rc;
Re: [PATCH 5.10 092/173] tee: amdtee: fix race condition in amdtee_open_session
Hi!
Quoted 6 lines
commit
f8502fba45bd30e1a6a354d9d898bc99d1a11e6dupstream.There is a potential race condition in
amdtee_open_sessionthat may lead to use-after-free. For instance, inamdtee_open_session()aftersess->sess_maskis set, and before setting:
Quoted 8 lines
sess->session_info[i] = session_info;if
amdtee_close_session()closes this same session, then 'sess' data structure will be released, causing kernel panic when 'sess' is accessed withinamdtee_open_session().The solution is to set the bit
sess->sess_maskas the last step inamdtee_open_session().
Ok, but:
drivers/tee/amdtee/core.c int amdtee_open_session(struct tee_conte · line 277
Quoted 13 lines
+++
b/drivers/tee/amdtee/core.cdrivers/tee/amdtee/core.c +8
-0@@ -267,35 +267,34 @@ int amdtee_open_session(struct tee_conte goto out; } +/* Open session with loaded TA */ +handle_open_session (arg, &session_info, param); +if (arg->ret !=TEEC_SUCCESS ) { +pr_err ("open_session failed %d\n" , arg->ret); +handle_unload_ta (ta_handle); +kref_put (&sess->refcount, destroy_session); + goto out; + }
rc needs to be set to something here, otherwise we'll return 0 below.
drivers/tee/amdtee/core.c int amdtee_open_session(struct tee_conte · line 300
Quoted 3 lines
drivers/tee/amdtee/core.c +0
-0out:free_pages ((u64 )ta,get_order (ta_size));return rc;
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Erika Unter HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Re: [PATCH 5.10 092/173] tee: amdtee: fix race condition in amdtee_open_session
Quoted 24 lines · Pavel Machek
Hi!
Quoted 6 lines
commit
f8502fba45bd30e1a6a354d9d898bc99d1a11e6dupstream.There is a potential race condition in
amdtee_open_sessionthat may lead to use-after-free. For instance, inamdtee_open_session()aftersess->sess_maskis set, and before setting:Quoted 8 lines
sess->session_info[i] = session_info;if
amdtee_close_session()closes this same session, then 'sess' data structure will be released, causing kernel panic when 'sess' is accessed withinamdtee_open_session().The solution is to set the bit
sess->sess_maskas the last step inamdtee_open_session().Ok, but:
Quoted 5 lines
+++
b/drivers/tee/amdtee/core.cdrivers/tee/amdtee/core.c +0
-0@@ -267,35 +267,34 @@ int amdtee_open_session(struct tee_conte goto out; }
Quoted 11 lines
drivers/tee/amdtee/core.c int amdtee_open_session(struct tee_conte · line 277
Quoted 8 lines
drivers/tee/amdtee/core.c +8
-0+/* Open session with loaded TA */ +handle_open_session (arg, &session_info, param); +if (arg->ret !=TEEC_SUCCESS ) { +pr_err ("open_session failed %d\n" , arg->ret); +handle_unload_ta (ta_handle); +kref_put (&sess->refcount, destroy_session); + goto out; + }rc needs to be set to something here, otherwise we'll return 0 below.
Sorry about the delay in my response. Somehow missed this email.
Yes, that is the expected behavior. rc will be 0 while arg->ret will have the return status.
Thanks,
Rijo
Quoted 7 lines
drivers/tee/amdtee/core.c int amdtee_open_session(struct tee_conte · line 300
Quoted 3 lines
drivers/tee/amdtee/core.c +0
-0out:free_pages ((u64 )ta,get_order (ta_size));return rc;Best regards,
Pavel
Greg Kroah-Hartman
maintainerPATCH 93/173 firmware: arm_scmi: Fix device node validation for mailbox transport
In reply to Greg Kroah-HartmanFrom: Cristian Marussi <[email protected]>
commit 2ab4f4018cb6b8010ca5002c3bdc37783b5d28c2 upstream.
When mailboxes are used as a transport it is possible to setup the SCMI transport layer, depending on the underlying channels configuration, to use one or two mailboxes, associated, respectively, to one or two, distinct, shared memory areas: any other combination should be treated as invalid.
Add more strict checking of SCMI mailbox transport device node descriptors.
--- drivers/firmware/arm_scmi/mailbox.c | 37 +++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+)
drivers/firmware/arm_scmi/mailbox.c +37 -0
@@ -52,6 +52,39 @@ static bool mailbox_chan_available(struct device_node *of_node, int idx) "#mbox-cells", idx, NULL); } +static int mailbox_chan_validate (struct device *cdev) +{ +int num_mb, num_sh, ret =0 ; +struct device_node *np = cdev->of_node; + + num_mb =of_count_phandle_with_args (np,"mboxes" ,"#mbox-cells" ); + num_sh =of_count_phandle_with_args (np,"shmem" ,NULL ); +/* Bail out if mboxes and shmem descriptors are inconsistent */ +if (num_mb <=0 || num_sh >2 || num_mb != num_sh) { +dev_warn (cdev,"Invalid channel descriptor for '%s'\n" , +of_node_full_name (np)); +return -EINVAL ; + } + +if (num_sh >1 ) { +struct device_node *np_tx, *np_rx; + + np_tx =of_parse_phandle (np,"shmem" ,0 ); + np_rx =of_parse_phandle (np,"shmem" ,1 ); +/* SCMI Tx and Rx shared mem areas have to be distinct */ +if (!np_tx || !np_rx || np_tx == np_rx) { +dev_warn (cdev,"Invalid shmem descriptor for '%s'\n" , +of_node_full_name (np)); + ret = -EINVAL ; + } + +of_node_put (np_tx); +of_node_put (np_rx); + } + +return ret; +} +static int mailbox_chan_setup (struct scmi_chan_info *cinfo,struct device *dev,bool tx) {
@@ -64,6 +97,10 @@ static int mailbox_chan_setup(struct scmi_chan_info *cinfo, struct device *dev,resource_size_t size;struct resource res; + ret =mailbox_chan_validate (cdev); +if (ret) +return ret; + smbox =devm_kzalloc (dev,sizeof (*smbox),GFP_KERNEL );if (!smbox)return -ENOMEM ;
Signature · 1 line
2.40.0
Greg Kroah-Hartman
maintainerPATCH 94/173 i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()
In reply to Greg Kroah-HartmanFrom: Wei Chen <[email protected]>
commit 92fbb6d1296f81f41f65effd7f5f8c0f74943d15 upstream.
The data->block[0] variable comes from user and is a number between 0-255. Without proper check, the variable may be very large to cause an out-of-bounds when performing memcpy in slimpro_i2c_blkwr.
Fix this bug by checking the value of writelen.
--- drivers/i2c/busses/i2c-xgene-slimpro.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/i2c/busses/i2c-xgene-slimpro.c +3 -0
@@ -308,6 +308,9 @@ static int slimpro_i2c_blkwr(struct slimu32 msg[3 ];int rc; +if (writelen >I2C_SMBUS_BLOCK_MAX ) +return -EINVAL ; +memcpy (ctx->dma_buffer, data, writelen); paddr =dma_map_single (ctx->dev, ctx->dma_buffer, writelen,DMA_TO_DEVICE );
Greg Kroah-Hartman
maintainerPATCH 95/173 dm stats: check for and propagate alloc_percpu failure
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
commit d3aa3e060c4a80827eb801fc448debc9daa7c46b upstream.
Check alloc_precpu()'s return value and return an error from dm_stats_init() if it fails. Update alloc_dev() to fail if dm_stats_init() does.
Otherwise, a NULL pointer dereference will occur in dm_stats_cleanup() even if dm-stats isn't being actively used.
--- drivers/md/dm-stats.c | 7 ++++++- drivers/md/dm-stats.h | 2 +- drivers/md/dm.c | 4 +++- 3 files changed, 10 insertions(+), 3 deletions(-)
drivers/md/dm-stats.c +6 -1
@@ -188,7 +188,7 @@ static int dm_stat_in_flight(struct dm_satomic_read (&shared->in_flight[WRITE ]); } -void dm_stats_init (struct dm_stats *stats) +int dm_stats_init (struct dm_stats *stats) {int cpu;struct dm_stats_last_position *last;
@@ -196,11 +196,16 @@ void dm_stats_init(struct dm_stats *statmutex_init (&stats->mutex);INIT_LIST_HEAD (&stats->list); stats->last = alloc_percpu(struct dm_stats_last_position); +if (!stats->last) +return -ENOMEM ; +for_each_possible_cpu (cpu) { last =per_cpu_ptr (stats->last, cpu); last->last_sector = (sector_t )ULLONG_MAX ; last->last_rw =UINT_MAX ; } + +return 0 ; }void dm_stats_cleanup (struct dm_stats *stats)
drivers/md/dm-stats.h +1 -1
@@ -22,7 +22,7 @@ struct dm_stats_aux {unsigned long long duration_ns; }; -void dm_stats_init (struct dm_stats *st); +int dm_stats_init (struct dm_stats *st);void dm_stats_cleanup (struct dm_stats *st);struct mapped_device ;
drivers/md/dm.c +3 -1
@@ -1910,7 +1910,9 @@ static struct mapped_device *alloc_dev(iif (!md->bdev) goto bad; -dm_stats_init (&md->stats); + r =dm_stats_init (&md->stats); +if (r <0 ) + goto bad;/* Populate the mapping, nobody knows we exist yet */ spin_lock (&_minor_lock);
Greg Kroah-Hartman
maintainerPATCH 96/173 dm crypt: add cond_resched() to dmcrypt_write()
In reply to Greg Kroah-HartmanFrom: Mikulas Patocka <[email protected]>
commit fb294b1c0ba982144ca467a75e7d01ff26304e2b upstream.
The loop in dmcrypt_write may be running for unbounded amount of time, thus we need cond_resched() in it.
This commit fixes the following warning:
[ 3391.153255][ C12] watchdog: BUG: soft lockup - CPU#12 stuck for 23s! [dmcrypt_write/2:2897] ... [ 3391.387210][ C12] Call trace: [ 3391.390338][ C12] blk_attempt_bio_merge.part.6+0x38/0x158 [ 3391.395970][ C12] blk_attempt_plug_merge+0xc0/0x1b0 [ 3391.401085][ C12] blk_mq_submit_bio+0x398/0x550 [ 3391.405856][ C12] submit_bio_noacct+0x308/0x380 [ 3391.410630][ C12] dmcrypt_write+0x1e4/0x208 [dm_crypt] [ 3391.416005][ C12] kthread+0x130/0x138 [ 3391.419911][ C12] ret_from_fork+0x10/0x18
--- drivers/md/dm-crypt.c | 1 + 1 file changed, 1 insertion(+)
drivers/md/dm-crypt.c +1 -0
@@ -1934,6 +1934,7 @@ pop_from_list: io =crypt_io_from_node (rb_first (&write_tree));rb_erase (&io->rb_node, &write_tree);kcryptd_io_write (io); +cond_resched (); }while (!RB_EMPTY_ROOT (&write_tree));blk_finish_plug (&plug); }
Greg Kroah-Hartman
maintainerPATCH 97/173 sched/fair: sanitize vruntime of entity being placed
In reply to Greg Kroah-HartmanFrom: Zhang Qiao <[email protected]>
commit 829c1651e9c4a6f78398d3e67651cef9bb6b42cc upstream.
When a scheduling entity is placed onto cfs_rq, its vruntime is pulled to the base level (around cfs_rq->min_vruntime), so that the entity doesn't gain extra boost when placed backwards.
However, if the entity being placed wasn't executed for a long time, its vruntime may get too far behind (e.g. while cfs_rq was executing a low-weight hog), which can inverse the vruntime comparison due to s64 overflow. This results in the entity being placed with its original vruntime way forwards, so that it will effectively never get to the cpu.
To prevent that, ignore the vruntime of the entity being placed if it didn't execute for much longer than the characteristic sheduler time scale.
--- kernel/sched/fair.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
kernel/sched/fair.c +13 -2
@@ -4278,6 +4278,7 @@ static void place_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int initial) { u64 vruntime = cfs_rq->min_vruntime; +u64 sleep_time;/* * The 'current' period is already promised to the current tasks,
@@ -4302,8 +4303,18 @@ place_entity(struct cfs_rq *cfs_rq, stru vruntime -= thresh; } -/* ensure we never gain time by being placed backwards. */ - se->vruntime =max_vruntime (se->vruntime, vruntime); +/* +* Pull vruntime of the entity being placed to the base level of +* cfs_rq, to prevent boosting it if placed backwards. If the entity +* slept for a long time, don't even try to compare its vruntime with +* the base as it may be too far off and the comparison may get +* inversed due to s64 overflow. +*/ + sleep_time =rq_clock_task (rq_of (cfs_rq)) - se->exec_start; +if ((s64 )sleep_time >60LL *NSEC_PER_SEC ) + se->vruntime = vruntime; +else + se->vruntime =max_vruntime (se->vruntime, vruntime); }static void check_enqueue_throttle (struct cfs_rq *cfs_rq);
Greg Kroah-Hartman
maintainerPATCH 98/173 sched/fair: Sanitize vruntime of entity being migrated
In reply to Greg Kroah-HartmanFrom: Vincent Guittot <[email protected]>
commit a53ce18cacb477dd0513c607f187d16f0fa96f71 upstream.
Commit 829c1651e9c4 ("sched/fair: sanitize vruntime of entity being placed") fixes an overflowing bug, but ignore a case that se->exec_start is reset after a migration.
For fixing this case, we delay the reset of se->exec_start after placing the entity which se->exec_start to detect long sleeping task.
In order to take into account a possible divergence between the clock_task of 2 rqs, we increase the threshold to around 104 days.
--- kernel/sched/core.c | 3 ++ kernel/sched/fair.c | 53 ++++++++++++++++++++++++++++++++++++++++++---------- 2 files changed, 46 insertions(+), 10 deletions(-)
kernel/sched/core.c +3 -0
@@ -1601,6 +1601,9 @@ static inline void dequeue_task(struct rvoid activate_task (struct rq *rq,struct task_struct *p,int flags) { +if (task_on_rq_migrating (p)) + flags |=ENQUEUE_MIGRATED ; +enqueue_task (rq, p, flags); p->on_rq =TASK_ON_RQ_QUEUED ;
kernel/sched/fair.c +43 -10
82 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 99/173 ocfs2: fix data corruption after failed write
In reply to Greg Kroah-HartmanFrom: Jan Kara via Ocfs2-devel <[email protected]>
commit 90410bcf873cf05f54a32183afff0161f44f9715 upstream.
When buffered write fails to copy data into underlying page cache page, ocfs2_write_end_nolock() just zeroes out and dirties the page. This can leave dirty page beyond EOF and if page writeback tries to write this page before write succeeds and expands i_size, page gets into inconsistent state where page dirty bit is clear but buffer dirty bits stay set resulting in page data never getting written and so data copied to the page is lost. Fix the problem by invalidating page beyond EOF after failed write.
--- fs/ocfs2/aops.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
fs/ocfs2/aops.c +16 -2
@@ -1981,11 +1981,25 @@ int ocfs2_write_end_nolock(struct addres }if (unlikely (copied < len) && wc->w_target_page) { +loff_t new_isize; +if (!PageUptodate (wc->w_target_page)) copied =0 ; -ocfs2_zero_new_buffers (wc->w_target_page, start+copied, - start+len); + new_isize =max_t (loff_t,i_size_read (inode), pos + copied); +if (new_isize >page_offset (wc->w_target_page)) +ocfs2_zero_new_buffers (wc->w_target_page, start+copied, + start+len); +else { +/* +* When page is fully beyond new isize (data copy +* failed), do not bother zeroing the page. Invalidate +* it instead so that writeback does not get confused +* put page & buffer dirty bits into inconsistent +* state. +*/ +block_invalidatepage (wc->w_target_page,0 ,PAGE_SIZE ); + } }if (wc->w_target_page)flush_dcache_page (wc->w_target_page);
Greg Kroah-Hartman
maintainerPATCH 100/173 xfs: shut down the filesystem if we screw up quota reservation
In reply to Greg Kroah-HartmanFrom: "Darrick J. Wong" <[email protected]>
commit 2a4bdfa8558ca2904dc17b83497dc82aa7fc05e9 upstream.
If we ever screw up the quota reservations enough to trip the assertions, something's wrong with the quota code. Shut down the filesystem when this happens, because this is corruption.
--- fs/xfs/xfs_trans_dquot.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
fs/xfs/xfs_trans_dquot.c +10 -3
@@ -16,6 +16,7 @@#include "xfs_quota.h" #include "xfs_qm.h" #include "xfs_trace.h" +#include "xfs_error.h" STATIC void xfs_trans_alloc_dqinfo(xfs_trans_t *);
@@ -708,9 +709,11 @@ xfs_trans_dqresv(XFS_TRANS_DQ_RES_INOS , ninos); } -ASSERT (dqp->q_blk.reserved >= dqp->q_blk.count); -ASSERT (dqp->q_rtb.reserved >= dqp->q_rtb.count); -ASSERT (dqp->q_ino.reserved >= dqp->q_ino.count); + +if (XFS_IS_CORRUPT (mp, dqp->q_blk.reserved < dqp->q_blk.count) || +XFS_IS_CORRUPT (mp, dqp->q_rtb.reserved < dqp->q_rtb.count) || +XFS_IS_CORRUPT (mp, dqp->q_ino.reserved < dqp->q_ino.count)) + goto error_corrupt;xfs_dqunlock (dqp);return 0 ;
@@ -720,6 +723,10 @@ error_return:if (xfs_dquot_type (dqp) ==XFS_DQTYPE_PROJ )return -ENOSPC ;return -EDQUOT ; +error_corrupt: +xfs_dqunlock (dqp); +xfs_force_shutdown (mp,SHUTDOWN_CORRUPT_INCORE ); +return -EFSCORRUPTED ; }
Greg Kroah-Hartman
maintainerPATCH 101/173 xfs: dont reuse busy extents on extent trim
In reply to Greg Kroah-HartmanFrom: Brian Foster <[email protected]>
commit 06058bc40534530e617e5623775c53bb24f032cb upstream.
Freed extents are marked busy from the point the freeing transaction commits until the associated CIL context is checkpointed to the log. This prevents reuse and overwrite of recently freed blocks before the changes are committed to disk, which can lead to corruption after a crash. The exception to this rule is that metadata allocation is allowed to reuse busy extents because metadata changes are also logged.
As of commit 97d3ac75e5e0 ("xfs: exact busy extent tracking"), XFS has allowed modification or complete invalidation of outstanding busy extents for metadata allocations. This implementation assumes that use of the associated extent is imminent, which is not always the case. For example, the trimmed extent might not satisfy the minimum length of the allocation request, or the allocation algorithm might be involved in a search for the optimal result based on locality.
generic/019 reproduces a corruption caused by this scenario. First, a metadata block (usually a bmbt or symlink block) is freed from an inode. A subsequent bmbt split on an unrelated inode attempts a near mode allocation request that invalidates the busy block during the search, but does not ultimately allocate it. Due to the busy state invalidation, the block is no longer considered busy to subsequent allocation. A direct I/O write request immediately allocates the block and writes to it. Finally, the filesystem crashes while in a state where the initial metadata block free had not committed to the on-disk log. After recovery, the original metadata block is in its original location as expected, but has been corrupted by the aforementioned dio.
This demonstrates that it is fundamentally unsafe to modify busy extent state for extents that are not guaranteed to be allocated. This applies to pretty much all of the code paths that currently trim busy extents for one reason or another. Therefore to address this problem, drop the reuse mechanism from the busy extent trim path. This code already knows how to return partial non-busy ranges of the targeted free extent and higher level code tracks the busy state of the allocation attempt. If a block allocation fails where one or more candidate extents is busy, we force the log and retry the allocation.
--- fs/xfs/xfs_extent_busy.c | 14 -------------- 1 file changed, 14 deletions(-)
fs/xfs/xfs_extent_busy.c +0 -14
@@ -344,7 +344,6 @@ xfs_extent_busy_trim(ASSERT (*len >0 );spin_lock (&args->pag->pagb_lock); -restart: fbno = *bno; flen = *len; rbp = args->pag->pagb_tree.rb_node;
@@ -363,19 +362,6 @@ restart:continue ; } -/* -* If this is a metadata allocation, try to reuse the busy -* extent instead of trimming the allocation. -*/ -if (!(args->datatype &XFS_ALLOC_USERDATA ) && - !(busyp->flags &XFS_EXTENT_BUSY_DISCARDED )) { -if (!xfs_extent_busy_update_extent (args->mp, args->pag, - busyp, fbno, flen, - false)) - goto restart; -continue ; - } -if (bbno <= fbno) {/* start overlap */
Greg Kroah-Hartman
maintainerPATCH 102/173 KVM: fix memoryleak in kvm_init()
In reply to Greg Kroah-HartmanFrom: Miaohe Lin <[email protected]>
commit 5a2a961be2ad6a16eb388a80442443b353c11d16 upstream.
When alloc_cpumask_var_node() fails for a certain cpu, there might be some allocated cpumasks for percpu cpu_kick_mask. We should free these cpumasks or memoryleak will occur.
--- virt/kvm/kvm_main.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
virt/kvm/kvm_main.c +2 -3
@@ -5014,7 +5014,7 @@ int kvm_init(void *opaque, unsigned vcpu r =kvm_async_pf_init ();if (r) - goto out_free_5; + goto out_free_4; kvm_chardev_ops.owner = module; kvm_vm_fops.owner = module;
@@ -5047,10 +5047,9 @@ err_register:kvm_vfio_ops_exit (); err_vfio:kvm_async_pf_deinit (); -out_free_5: +out_free_4:for_each_possible_cpu (cpu)free_cpumask_var (per_cpu (cpu_kick_mask, cpu)); -out_free_4:kmem_cache_destroy (kvm_vcpu_cache); out_free_3:unregister_reboot_notifier (&kvm_reboot_notifier);
Greg Kroah-Hartman
maintainerPATCH 103/173 NFSD: fix use-after-free in __nfs42_ssc_open()
In reply to Greg Kroah-HartmanFrom: Dai Ngo <[email protected]>
commit 75333d48f92256a0dec91dbf07835e804fc411c0 upstream.
Problem caused by source's vfsmount being unmounted but remains on the delayed unmount list. This happens when nfs42_ssc_open() return errors.
Fixed by removing nfsd4_interssc_connect(), leave the vfsmount for the laundromat to unmount when idle time expires.
We don't need to call nfs_do_sb_deactive when nfs42_ssc_open return errors since the file was not opened so nfs_server->active was not incremented. Same as in nfsd4_copy, if we fail to launch nfsd4_do_async_copy thread then there's no need to call nfs_do_sb_deactive
--- fs/nfsd/nfs4proc.c | 22 ++++++---------------- 1 file changed, 6 insertions(+), 16 deletions(-)
fs/nfsd/nfs4proc.c +6 -16
@@ -1248,13 +1248,6 @@ out_err:return status; } -static void -nfsd4_interssc_disconnect (struct vfsmount *ss_mnt) -{ -nfs_do_sb_deactive (ss_mnt->mnt_sb); -mntput (ss_mnt); -} -/* * Verify COPY destination stateid. *
@@ -1325,11 +1318,6 @@ nfsd4_cleanup_inter_ssc(struct vfsmount { } -static void -nfsd4_interssc_disconnect (struct vfsmount *ss_mnt) -{ -} -static struct file *nfs42_ssc_open (struct vfsmount *ss_mnt,struct nfs_fh *src_fh,nfs4_stateid *stateid)
@@ -1471,14 +1459,14 @@ static int nfsd4_do_async_copy(void *dat copy->nf_src =kzalloc (sizeof (struct nfsd_file ),GFP_KERNEL );if (!copy->nf_src) { copy->nfserr = nfserr_serverfault; -nfsd4_interssc_disconnect (copy->ss_mnt); +/* ss_mnt will be unmounted by the laundromat */ goto do_callback; } copy->nf_src->nf_file =nfs42_ssc_open (copy->ss_mnt, ©->c_fh, ©->stateid);if (IS_ERR (copy->nf_src->nf_file)) { copy->nfserr = nfserr_offload_denied; -nfsd4_interssc_disconnect (copy->ss_mnt); +/* ss_mnt will be unmounted by the laundromat */ goto do_callback; } }
@@ -1561,8 +1549,10 @@ out_err:if (async_copy)cleanup_async_copy (async_copy); status =nfserrno (-ENOMEM ); -if (!copy->cp_intra) -nfsd4_interssc_disconnect (copy->ss_mnt); +/* +* source's vfsmount of inter-copy will be unmounted +* by the laundromat +*/ goto out; }
Greg Kroah-Hartman
maintainerPATCH 104/173 usb: dwc3: gadget: move cmd_endtransfer to extra function
In reply to Greg Kroah-HartmanFrom: Michael Grzeschik <[email protected]>
[ Upstream commit e192cc7b52399d1b073f88cd3ba128b74d3a57f1 ]
This patch adds the extra function __dwc3_stop_active_transfer to consolidate the same codepath.
Stable-dep-of: d8a2bb4eb758 ("usb: dwc3: gadget: Add 1ms delay after end transfer command without IOC")
--- drivers/usb/dwc3/gadget.c | 69 +++++++++++++++++++++------------------ 1 file changed, 37 insertions(+), 32 deletions(-)
drivers/usb/dwc3/gadget.c +37 -32
@@ -1440,6 +1440,40 @@ static int __dwc3_gadget_get_frame(struct dwc3 *dwc)return DWC3_DSTS_SOFFN (reg); } +/** +* __dwc3_stop_active_transfer - stop the current active transfer +* @dep: isoc endpoint +* @force: set forcerm bit in the command +* @interrupt: command complete interrupt after End Transfer command +* +* When setting force, the ForceRM bit will be set. In that case +* the controller won't update the TRB progress on command +* completion. It also won't clear the HWO bit in the TRB. +* The command will also not complete immediately in that case. +*/ +static int __dwc3_stop_active_transfer (struct dwc3_ep *dep,bool force,bool interrupt) +{ +struct dwc3_gadget_ep_cmd_params params; +u32 cmd; +int ret; + + cmd =DWC3_DEPCMD_ENDTRANSFER ; + cmd |= force ?DWC3_DEPCMD_HIPRI_FORCERM :0 ; + cmd |= interrupt ?DWC3_DEPCMD_CMDIOC :0 ; + cmd |=DWC3_DEPCMD_PARAM (dep->resource_index); +memset (¶ms,0 ,sizeof (params)); + ret =dwc3_send_gadget_ep_cmd (dep, cmd, ¶ms); +WARN_ON_ONCE (ret); + dep->resource_index =0 ; + +if (!interrupt) + dep->flags &= ~DWC3_EP_TRANSFER_STARTED ; +else if (!ret) + dep->flags |=DWC3_EP_END_TRANSFER_PENDING ; + +return ret; +} +/** * dwc3_gadget_start_isoc_quirk - workaround invalid frame number * @dep: isoc endpoint
@@ -1609,21 +1643,8 @@ static int __dwc3_gadget_start_isoc(struct dwc3_ep *dep)* status, issue END_TRANSFER command and retry on the next XferNotReady * event. */ -if (ret == -EAGAIN ) { -struct dwc3_gadget_ep_cmd_params params; -u32 cmd; - - cmd =DWC3_DEPCMD_ENDTRANSFER | -DWC3_DEPCMD_CMDIOC | -DWC3_DEPCMD_PARAM (dep->resource_index); - - dep->resource_index =0 ; -memset (¶ms,0 ,sizeof (params)); - - ret =dwc3_send_gadget_ep_cmd (dep, cmd, ¶ms); -if (!ret) - dep->flags |=DWC3_EP_END_TRANSFER_PENDING ; - } +if (ret == -EAGAIN ) + ret =__dwc3_stop_active_transfer (dep, false, true);return ret; }
@@ -3250,10 +3271,6 @@ static void dwc3_reset_gadget(struct dwc3 *dwc)static void dwc3_stop_active_transfer (struct dwc3_ep *dep,bool force,bool interrupt) { -struct dwc3_gadget_ep_cmd_params params; -u32 cmd; -int ret; -if (!(dep->flags &DWC3_EP_TRANSFER_STARTED ) || (dep->flags &DWC3_EP_END_TRANSFER_PENDING ))return ;
@@ -3285,19 +3302,7 @@ static void dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force,* This mode is NOT available on the DWC_usb31 IP. */ - cmd =DWC3_DEPCMD_ENDTRANSFER ; - cmd |= force ?DWC3_DEPCMD_HIPRI_FORCERM :0 ; - cmd |= interrupt ?DWC3_DEPCMD_CMDIOC :0 ; - cmd |=DWC3_DEPCMD_PARAM (dep->resource_index); -memset (¶ms,0 ,sizeof (params)); - ret =dwc3_send_gadget_ep_cmd (dep, cmd, ¶ms); -WARN_ON_ONCE (ret); - dep->resource_index =0 ; - -if (!interrupt) - dep->flags &= ~DWC3_EP_TRANSFER_STARTED ; -else - dep->flags |=DWC3_EP_END_TRANSFER_PENDING ; +__dwc3_stop_active_transfer (dep, force, interrupt); }static void dwc3_clear_stall_all_ep (struct dwc3 *dwc)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 105/173 usb: dwc3: gadget: Add 1ms delay after end transfer command without IOC
In reply to Greg Kroah-HartmanFrom: Wesley Cheng <[email protected]>
[ Upstream commit d8a2bb4eb75866275b5cf7de2e593ac3449643e2 ]
Previously, there was a 100uS delay inserted after issuing an end transfer command for specific controller revisions. This was due to the fact that there was a GUCTL2 bit field which enabled synchronous completion of the end transfer command once the CMDACT bit was cleared in the DEPCMD register. Since this bit does not exist for all controller revisions and the current implementation heavily relies on utizling the EndTransfer command completion interrupt, add the delay back in for uses where the interrupt on completion bit is not set, and increase the duration to 1ms for the controller to complete the command.
An issue was seen where the USB request buffer was unmapped while the DWC3 controller was still accessing the TRB. However, it was confirmed that the end transfer command was successfully submitted. (no end transfer timeout) In situations, such as dwc3_gadget_soft_disconnect() and __dwc3_gadget_ep_disable(), the dwc3_remove_request() is utilized, which will issue the end transfer command, and follow up with dwc3_gadget_giveback(). At least for the USB ep disable path, it is required for any pending and started requests to be completed and returned to the function driver in the same context of the disable call. Without the GUCTL2 bit, it is not ensured that the end transfer is completed before the buffers are unmapped.
--- drivers/usb/dwc3/gadget.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/usb/dwc3/gadget.c +11 -3
@@ -1453,6 +1453,7 @@ static int __dwc3_gadget_get_frame(struct dwc3 *dwc)*/ static int __dwc3_stop_active_transfer (struct dwc3_ep *dep,bool force,bool interrupt) { +struct dwc3 *dwc = dep->dwc;struct dwc3_gadget_ep_cmd_params params;u32 cmd;int ret;
@@ -1466,10 +1467,13 @@ static int __dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force, bool intWARN_ON_ONCE (ret); dep->resource_index =0 ; -if (!interrupt) +if (!interrupt) { + if (!DWC3_IP_IS(DWC3) || DWC3_VER_IS_PRIOR(DWC3, 310A)) +mdelay (1 ); dep->flags &= ~DWC3_EP_TRANSFER_STARTED ; -else if (!ret) + }else if (!ret) { dep->flags |=DWC3_EP_END_TRANSFER_PENDING ; + }return ret; }
@@ -3299,7 +3303,11 @@ static void dwc3_stop_active_transfer(struct dwc3_ep *dep, bool force,* enabled, the EndTransfer command will have completed upon * returning from this function. * -* This mode is NOT available on the DWC_usb31 IP. +* This mode is NOT available on the DWC_usb31 IP. In this +* case, if the IOC bit is not set, then delay by 1ms +* after issuing the EndTransfer command. This allows for the +* controller to handle the command completely before DWC3 +* remove requests attempts to unmap USB request buffers. */ __dwc3_stop_active_transfer (dep, force, interrupt);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 106/173 kernel: kcsan: kcsan_test: build without structleak plugin
In reply to Greg Kroah-HartmanFrom: Anders Roxell <[email protected]>
[ Upstream commit 6fcd4267a840d0536b8e5334ad5f31e4105fce85 ]
Building kcsan_test with structleak plugin enabled makes the stack frame size to grow.
kernel/kcsan/kcsan_test.c:704:1: error: the frame size of 3296 bytes is larger than 2048 bytes [-Werror=frame-larger-than=]
Turn off the structleak plugin checks for kcsan_test.
Stable-dep-of: 5eb39cde1e24 ("kcsan: avoid passing -g for test")
--- kernel/kcsan/Makefile | 1 + 1 file changed, 1 insertion(+)
kernel/kcsan/Makefile +1 -0
@@ -14,4 +14,5 @@ obj-y := core.o debugfs.o report.o obj-$(CONFIG_KCSAN_SELFTEST) += selftest.o CFLAGS_kcsan-test.o := $(CFLAGS_KCSAN) -g -fno-omit-frame-pointer +CFLAGS_kcsan_test.o += $(DISABLE_STRUCTLEAK_PLUGIN) obj-$(CONFIG_KCSAN_TEST) += kcsan-test.o
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 107/173 kcsan: avoid passing -g for test
In reply to Greg Kroah-HartmanFrom: Marco Elver <[email protected]>
[ Upstream commit 5eb39cde1e2487ba5ec1802dc5e58a77e700d99e ]
Nathan reported that when building with GNU as and a version of clang that defaults to DWARF5, the assembler will complain with:
Error: non-constant .uleb128 is not supported
This is because -g defaults to the compiler debug info default. If the assembler does not support some of the directives used, the above errors occur. To fix, remove the explicit passing of -g.
All the test wants is that stack traces print valid function names, and debug info is not required for that. (I currently cannot recall why I added the explicit -g.)
--- kernel/kcsan/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/kcsan/Makefile +1 -1
@@ -13,6 +13,6 @@ CFLAGS_core.o := $(call cc-option,-fno-conserve-stack) \ obj-y := core.o debugfs.o report.o obj-$(CONFIG_KCSAN_SELFTEST) += selftest.o -CFLAGS_kcsan-test.o := $(CFLAGS_KCSAN) -g -fno-omit-frame-pointer +CFLAGS_kcsan-test.o := $(CFLAGS_KCSAN) -fno-omit-frame-pointer CFLAGS_kcsan_test.o += $(DISABLE_STRUCTLEAK_PLUGIN) obj-$(CONFIG_KCSAN_TEST) += kcsan-test.o
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 108/173 drm/meson: Fix error handling when afbcd.ops->init fails
In reply to Greg Kroah-HartmanFrom: Martin Blumenstingl <[email protected]>
[ Upstream commit fa747d75f65d1b1cbc3f4691fa67b695e8a399c8 ]
When afbcd.ops->init fails we need to free the struct drm_device. Also all errors which come after afbcd.ops->init was successful need to exit the AFBCD, just like meson_drv_unbind() does.
Stable-dep-of: ba98413bf45e ("drm/meson: fix missing component unbind on bind errors")
--- drivers/gpu/drm/meson/meson_drv.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-)
drivers/gpu/drm/meson/meson_drv.c +10 -7
@@ -320,38 +320,38 @@ static int meson_drv_bind_master(struct device *dev, bool has_components)if (priv->afbcd.ops) { ret = priv->afbcd.ops->init (priv);if (ret) -return ret; + goto free_drm; }/* Encoder Initialization */ ret =meson_venc_cvbs_create (priv);if (ret) - goto free_drm; + goto exit_afbcd;if (has_components) { ret =component_bind_all (drm->dev, drm);if (ret) {dev_err (drm->dev,"Couldn't bind all components\n" ); - goto free_drm; + goto exit_afbcd; } } ret =meson_plane_create (priv);if (ret) - goto free_drm; + goto exit_afbcd; ret =meson_overlay_create (priv);if (ret) - goto free_drm; + goto exit_afbcd; ret =meson_crtc_create (priv);if (ret) - goto free_drm; + goto exit_afbcd; ret =drm_irq_install (drm, priv->vsync_irq);if (ret) - goto free_drm; + goto exit_afbcd;drm_mode_config_reset (drm);
@@ -369,6 +369,9 @@ static int meson_drv_bind_master(struct device *dev, bool has_components) uninstall_irq:drm_irq_uninstall (drm); +exit_afbcd: +if (priv->afbcd.ops) + priv->afbcd.ops->exit (priv); free_drm:drm_dev_put (drm);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 109/173 drm/meson: fix missing component unbind on bind errors
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
[ Upstream commit ba98413bf45edbf33672e2539e321b851b2cfbd1 ]
Make sure to unbind all subcomponents when binding the aggregate device fails.
--- drivers/gpu/drm/meson/meson_drv.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/gpu/drm/meson/meson_drv.c +7 -4
@@ -339,19 +339,19 @@ static int meson_drv_bind_master(struct device *dev, bool has_components) ret =meson_plane_create (priv);if (ret) - goto exit_afbcd; + goto unbind_all; ret =meson_overlay_create (priv);if (ret) - goto exit_afbcd; + goto unbind_all; ret =meson_crtc_create (priv);if (ret) - goto exit_afbcd; + goto unbind_all; ret =drm_irq_install (drm, priv->vsync_irq);if (ret) - goto exit_afbcd; + goto unbind_all;drm_mode_config_reset (drm);
@@ -369,6 +369,9 @@ static int meson_drv_bind_master(struct device *dev, bool has_components) uninstall_irq:drm_irq_uninstall (drm); +unbind_all: +if (has_components) +component_unbind_all (drm->dev, drm); exit_afbcd:if (priv->afbcd.ops) priv->afbcd.ops->exit (priv);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 110/173 bus: imx-weim: fix branch condition evaluates to a garbage value
In reply to Greg Kroah-HartmanFrom: Ivan Bornyakov <[email protected]>
[ Upstream commit 1adab2922c58e7ff4fa9f0b43695079402cce876 ]
If bus type is other than imx50_weim_devtype and have no child devices, variable 'ret' in function weim_parse_dt() will not be initialized, but will be used as branch condition and return value. Fix this by initializing 'ret' with 0.
This was discovered with help of clang-analyzer, but the situation is quite possible in real life.
--- drivers/bus/imx-weim.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/bus/imx-weim.c +1 -1
@@ -192,8 +192,8 @@ static int weim_parse_dt(struct platform_device *pdev, void __iomem *base)const struct of_device_id *of_id =of_match_device (weim_id_table, &pdev->dev);const struct imx_weim_devtype *devtype = of_id->data; +int ret =0 , have_child =0 ;struct device_node *child; -int ret, have_child =0 ;struct cs_timing_state ts = {};u32 reg;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 111/173 dm crypt: avoid accessing uninitialized tasklet
In reply to Greg Kroah-HartmanFrom: Mike Snitzer <[email protected]>
[ Upstream commit d9a02e016aaf5a57fb44e9a5e6da8ccd3b9e2e70 ]
When neither "no_read_workqueue" nor "no_write_workqueue" are enabled, tasklet_trylock() in crypt_dec_pending() may still return false due to an uninitialized state, and dm-crypt will unnecessarily do io completion in io_queue workqueue instead of current context.
Fix this by adding an 'in_tasklet' flag to dm_crypt_io struct and initialize it to false in crypt_io_init(). Set this flag to true in kcryptd_queue_crypt() before calling tasklet_schedule(). If set crypt_dec_pending() will punt io completion to a workqueue.
This also nicely avoids the tasklet_trylock/unlock hack when tasklets aren't in use.
--- drivers/md/dm-crypt.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/md/dm-crypt.c +9 -6
@@ -67,7 +67,9 @@ struct dm_crypt_io {struct crypt_config *cc;struct bio *base_bio;u8 *integrity_metadata; -bool integrity_metadata_from_pool; + bool integrity_metadata_from_pool:1; + bool in_tasklet:1; +struct work_struct work;struct tasklet_struct tasklet;
@@ -1722,6 +1724,7 @@ static void crypt_io_init(struct dm_crypt_io *io, struct crypt_config *cc, io->ctx.r.req =NULL ; io->integrity_metadata =NULL ; io->integrity_metadata_from_pool = false; + io->in_tasklet = false;atomic_set (&io->io_pending,0 ); }
@@ -1767,14 +1770,13 @@ static void crypt_dec_pending(struct dm_crypt_io *io)* our tasklet. In this case we need to delay bio_endio() * execution to after the tasklet is done and dequeued. */ -if (tasklet_trylock (&io->tasklet)) { -tasklet_unlock (&io->tasklet); -bio_endio (base_bio); +if (io->in_tasklet) { +INIT_WORK (&io->work, kcryptd_io_bio_endio); +queue_work (cc->io_queue, &io->work);return ; } -INIT_WORK (&io->work, kcryptd_io_bio_endio); -queue_work (cc->io_queue, &io->work); +bio_endio (base_bio); }/*
@@ -2228,6 +2230,7 @@ static void kcryptd_queue_crypt(struct dm_crypt_io *io)* it is being executed with irqs disabled. */ if (in_irq () ||irqs_disabled ()) { + io->in_tasklet = true;tasklet_init (&io->tasklet, kcryptd_crypt_tasklet, (unsigned long )&io->work);tasklet_schedule (&io->tasklet);return ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 112/173 fsverity: dont drop pagecache at end of FS_IOC_ENABLE_VERITY
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
[ Upstream commit a075bacde257f755bea0e53400c9f1cdd1b8e8e6 ]
The full pagecache drop at the end of FS_IOC_ENABLE_VERITY is causing performance problems and is hindering adoption of fsverity. It was intended to solve a race condition where unverified pages might be left in the pagecache. But actually it doesn't solve it fully.
Since the incomplete solution for this race condition has too much performance impact for it to be worth it, let's remove it for now.
--- fs/verity/enable.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-)
fs/verity/enable.c +13 -11
@@ -391,25 +391,27 @@ int fsverity_ioctl_enable(struct file *filp, const void __user *uarg) goto out_drop_write; err =enable_verity (filp, &arg); -if (err) - goto out_allow_write_access;/* -* Some pages of the file may have been evicted from pagecache after -* being used in the Merkle tree construction, then read into pagecache -* again by another process reading from the file concurrently. Since -* these pages didn't undergo verification against the file measurement -* which fs-verity now claims to be enforcing, we have to wipe the -* pagecache to ensure that all future reads are verified. +* We no longer drop the inode's pagecache after enabling verity. This +* used to be done to try to avoid a race condition where pages could be +* evicted after being used in the Merkle tree construction, then +* re-instantiated by a concurrent read. Such pages are unverified, and +* the backing storage could have filled them with different content, so +* they shouldn't be used to fulfill reads once verity is enabled. +* +* But, dropping the pagecache has a big performance impact, and it +* doesn't fully solve the race condition anyway. So for those reasons, +* and also because this race condition isn't very important relatively +* speaking (especially for small-ish files, where the chance of a page +* being used, evicted, *and* re-instantiated all while enabling verity +* is quite small), we no longer drop the inode's pagecache. */ -filemap_write_and_wait (inode->i_mapping); -invalidate_inode_pages2 (inode->i_mapping);/* * allow_write_access() is needed to pair with deny_write_access(). * Regardless, the filesystem won't allow writing to verity files. */ -out_allow_write_access:allow_write_access (filp); out_drop_write:mnt_drop_write_file (filp);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 113/173 md: avoid signed overflow in slot_store()
In reply to Greg Kroah-HartmanFrom: NeilBrown <[email protected]>
[ Upstream commit 3bc57292278a0b6ac4656cad94c14f2453344b57 ]
slot_store() uses kstrtouint() to get a slot number, but stores the result in an "int" variable (by casting a pointer).
This can result in a negative slot number if the unsigned int value is very large.
A negative number means that the slot is empty, but setting a negative slot number this way will not remove the device from the array. I don't think this is a serious problem, but it could cause confusion and it is best to fix it.
--- drivers/md/md.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/md/md.c +3 -0
@@ -3207,6 +3207,9 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len) err =kstrtouint (buf,10 , (unsigned int *)&slot);if (err <0 )return err; +if (slot <0 ) +/* overflow */ +return -ENOSPC ; }if (rdev->mddev->pers && slot ==-1 ) {/* Setting 'slot' on an active array requires also
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 114/173 net: hsr: Dont log netdev_err message on unknown prp dst node
In reply to Greg Kroah-HartmanFrom: Kristian Overskeid <[email protected]>
[ Upstream commit 28e8cabe80f3e6e3c98121576eda898eeb20f1b1 ]
If no frames has been exchanged with a node for HSR_NODE_FORGET_TIME, the node will be deleted from the node_db list. If a frame is sent to the node after it is deleted, a netdev_err message for each slave interface is produced. This should not happen with dan nodes because of supervision frames, but can happen often with san nodes, which clutters the kernel log. Since the hsr protocol does not support sans, this is only relevant for the prp protocol.
--- net/hsr/hsr_framereg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/hsr/hsr_framereg.c +1 -1
@@ -380,7 +380,7 @@ void hsr_addr_subst_dest(struct hsr_node *node_src, struct sk_buff *skb, node_dst =find_node_by_addr_A (&port->hsr->node_db,eth_hdr (skb)->h_dest);if (!node_dst) { -if (net_ratelimit ()) +if (net_ratelimit () && port->hsr->prot_version !=PRP_V1 )netdev_err (skb->dev,"%s: Unknown node\n" , __func__);return ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 115/173 ALSA: asihpi: check pao in control_message()
In reply to Greg Kroah-HartmanFrom: Kuninori Morimoto <[email protected]>
[ Upstream commit 9026c0bf233db53b86f74f4c620715e94eb32a09 ]
control_message() might be called with pao = NULL. Here indicates control_message() as sample.
(B) static void control_message(struct hpi_adapter_obj *pao, ...)
{ ^^^
struct hpi_hw_obj *phw = pao->priv;
... ^^^
}(A) void _HPI_6205(struct hpi_adapter_obj *pao, ...)
{ ^^^
...
case HPI_OBJ_CONTROL:
(B) control_message(pao, phm, phr);
break; ^^^
...
}
void HPI_6205(...)
{
...
(A) _HPI_6205(NULL, phm, phr);
... ^^^^
}Therefore, We will get too many warning via cppcheck, like below
sound/pci/asihpi/hpi6205.c:238:27: warning: Possible null pointer dereference: pao [nullPointer] struct hpi_hw_obj *phw = pao->priv; ^ sound/pci/asihpi/hpi6205.c:433:13: note: Calling function '_HPI_6205', 1st argument 'NULL' value is 0 _HPI_6205(NULL, phm, phr); ^ sound/pci/asihpi/hpi6205.c:401:20: note: Calling function 'control_message', 1st argument 'pao' value is 0 control_message(pao, phm, phr); ^
Set phr->error like many functions doing, and don't call _HPI_6205() with NULL.
--- sound/pci/asihpi/hpi6205.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/asihpi/hpi6205.c +1 -1
@@ -430,7 +430,7 @@ void HPI_6205(struct hpi_message *phm, struct hpi_response *phr) pao =hpi_find_adapter (phm->adapter_index); }else {/* subsys messages don't address an adapter */ -_HPI_6205 (NULL , phm, phr); + phr->error =HPI_ERROR_INVALID_OBJ_INDEX ;return ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 116/173 ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()
In reply to Greg Kroah-HartmanFrom: Kuninori Morimoto <[email protected]>
[ Upstream commit 98e5eb110095ec77cb6d775051d181edbf9cd3cf ]
tuning_ctl_set() might have buffer overrun at (X) if it didn't break from loop by matching (A).
static int tuning_ctl_set(...)
{
for (i = 0; i < TUNING_CTLS_COUNT; i++)
(A) if (nid == ca0132_tuning_ctls[i].nid)
break;
snd_hda_power_up(...);
(X) dspio_set_param(..., ca0132_tuning_ctls[i].mid, ...);
snd_hda_power_down(...); ^
return 1;
}We will get below error by cppcheck
sound/pci/hda/patch_ca0132.c:4229:2: note: After for loop, i has value 12 for (i = 0; i < TUNING_CTLS_COUNT; i++) ^ sound/pci/hda/patch_ca0132.c:4234:43: note: Array index out of bounds dspio_set_param(codec, ca0132_tuning_ctls[i].mid, 0x20, ^
This patch cares non match case.
--- sound/pci/hda/patch_ca0132.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
sound/pci/hda/patch_ca0132.c +3 -1
@@ -4108,8 +4108,10 @@ static int tuning_ctl_set(struct hda_codec *codec, hda_nid_t nid,for (i =0 ; i <TUNING_CTLS_COUNT ; i++)if (nid == ca0132_tuning_ctls[i].nid) -break ; + goto found; +return -EINVAL ; +found:snd_hda_power_up (codec); dspio_set_param(codec, ca0132_tuning_ctls[i].mid, 0x20, ca0132_tuning_ctls[i].req,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 117/173 fbdev: tgafb: Fix potential divide by zero
In reply to Greg Kroah-HartmanFrom: Wei Chen <[email protected]>
[ Upstream commit f90bd245de82c095187d8c2cabb8b488a39eaecc ]
fb_set_var would by called when user invokes ioctl with cmd FBIOPUT_VSCREENINFO. User-provided data would finally reach tgafb_check_var. In case var->pixclock is assigned to zero, divide by zero would occur when checking whether reciprocal of var->pixclock is too high.
Similar crashes have happened in other fbdev drivers. There is no check and modification on var->pixclock along the call chain to tgafb_check_var. We believe it could also be triggered in driver tgafb from user site.
--- drivers/video/fbdev/tgafb.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/video/fbdev/tgafb.c +3 -0
@@ -166,6 +166,9 @@ tgafb_check_var(struct fb_var_screeninfo *var, struct fb_info *info) {struct tga_par *par = (struct tga_par *)info->par; +if (!var->pixclock) +return -EINVAL ; +if (par->tga_type ==TGA_TYPE_8PLANE ) {if (var->bits_per_pixel !=8 )return -EINVAL ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 118/173 sched_getaffinity: dont assume cpumask_size() is fully initialized
In reply to Greg Kroah-HartmanFrom: Linus Torvalds <[email protected]>
[ Upstream commit 6015b1aca1a233379625385feb01dd014aca60b5 ]
The getaffinity() system call uses 'cpumask_size()' to decide how big the CPU mask is - so far so good. It is indeed the allocation size of a cpumask.
But the code also assumes that the whole allocation is initialized without actually doing so itself. That's wrong, because we might have fixed-size allocations (making copying and clearing more efficient), but not all of it is then necessarily used if 'nr_cpu_ids' is smaller.
Having checked other users of 'cpumask_size()', they all seem to be ok, either using it purely for the allocation size, or explicitly zeroing the cpumask before using the size in bytes to copy it.
See for example the ublk_ctrl_get_queue_affinity() function that uses the proper 'zalloc_cpumask_var()' to make sure that the whole mask is cleared, whether the storage is on the stack or if it was an external allocation.
Fix this by just zeroing the allocation before using it. Do the same for the compat version of sched_getaffinity(), which had the same logic.
Also, for consistency, make sched_getaffinity() use 'cpumask_bits()' to access the bits. For a cpumask_var_t, it ends up being a pointer to the same data either way, but it's just a good idea to treat it like you would a 'cpumask_t'. The compat case already did that.
--- kernel/compat.c | 2 +- kernel/sched/core.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
kernel/compat.c +1 -1
@@ -152,7 +152,7 @@ COMPAT_SYSCALL_DEFINE3(sched_getaffinity, compat_pid_t, pid, unsigned int, len,if (len & (sizeof (compat_ulong_t)-1 ))return -EINVAL ; -if (!alloc_cpumask_var (&mask,GFP_KERNEL )) +if (!zalloc_cpumask_var (&mask,GFP_KERNEL ))return -ENOMEM ; ret =sched_getaffinity (pid, mask);
kernel/sched/core.c +2 -2
@@ -6067,14 +6067,14 @@ SYSCALL_DEFINE3(sched_getaffinity, pid_t, pid, unsigned int, len,if (len & (sizeof (unsigned long )-1 ))return -EINVAL ; -if (!alloc_cpumask_var (&mask,GFP_KERNEL )) +if (!zalloc_cpumask_var (&mask,GFP_KERNEL ))return -ENOMEM ; ret =sched_getaffinity (pid, mask);if (ret ==0 ) {unsigned int retlen =min (len,cpumask_size ()); -if (copy_to_user (user_mask_ptr, mask, retlen)) +if (copy_to_user (user_mask_ptr,cpumask_bits (mask), retlen)) ret = -EFAULT ;else ret = retlen;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 119/173 fbdev: nvidia: Fix potential divide by zero
In reply to Greg Kroah-HartmanFrom: Wei Chen <[email protected]>
[ Upstream commit 92e2a00f2987483e1f9253625828622edd442e61 ]
variable var->pixclock can be set by user. In case it equals to zero, divide by zero would occur in nvidiafb_set_par.
Similar crashes have happened in other fbdev drivers. There is no check and modification on var->pixclock along the call chain to nvidia_check_var and nvidiafb_set_par. We believe it could also be triggered in driver nvidia from user site.
--- drivers/video/fbdev/nvidia/nvidia.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/video/fbdev/nvidia/nvidia.c +2 -0
@@ -763,6 +763,8 @@ static int nvidiafb_check_var(struct fb_var_screeninfo *var,int pitch, err =0 ;NVTRACE_ENTER (); +if (!var->pixclock) +return -EINVAL ; var->transp.offset =0 ; var->transp.length =0 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 120/173 fbdev: intelfb: Fix potential divide by zero
In reply to Greg Kroah-HartmanFrom: Wei Chen <[email protected]>
[ Upstream commit d823685486a3446d061fed7c7d2f80af984f119a ]
Variable var->pixclock is controlled by user and can be assigned to zero. Without proper check, divide by zero would occur in intelfbhw_validate_mode and intelfbhw_mode_to_hw.
Error out if var->pixclock is zero.
--- drivers/video/fbdev/intelfb/intelfbdrv.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/video/fbdev/intelfb/intelfbdrv.c +3 -0
@@ -1214,6 +1214,9 @@ static int intelfb_check_var(struct fb_var_screeninfo *var, dinfo =GET_DINFO (info); +if (!var->pixclock) +return -EINVAL ; +/* update the pitch */ if (intelfbhw_validate_mode (dinfo, var) !=0 )return -EINVAL ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 121/173 fbdev: lxfb: Fix potential divide by zero
In reply to Greg Kroah-HartmanFrom: Wei Chen <[email protected]>
[ Upstream commit 61ac4b86a4c047c20d5cb423ddd87496f14d9868 ]
var->pixclock can be assigned to zero by user. Without proper check, divide by zero would occur in lx_set_clock.
Error out if var->pixclock is zero.
--- drivers/video/fbdev/geode/lxfb_core.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/video/fbdev/geode/lxfb_core.c +3 -0
@@ -234,6 +234,9 @@ static void get_modedb(struct fb_videomode **modedb, unsigned int *size)static int lxfb_check_var (struct fb_var_screeninfo *var,struct fb_info *info) { +if (!var->pixclock) +return -EINVAL ; +if (var->xres >1920 || var->yres >1440 )return -EINVAL ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 122/173 fbdev: au1200fb: Fix potential divide by zero
In reply to Greg Kroah-HartmanFrom: Wei Chen <[email protected]>
[ Upstream commit 44a3b36b42acfc433aaaf526191dd12fbb919fdb ]
var->pixclock can be assigned to zero by user. Without proper check, divide by zero would occur when invoking macro PICOS2KHZ in au1200fb_fb_check_var.
Error out if var->pixclock is zero.
--- drivers/video/fbdev/au1200fb.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/video/fbdev/au1200fb.c +3 -0
@@ -1040,6 +1040,9 @@ static int au1200fb_fb_check_var(struct fb_var_screeninfo *var,u32 pixclock;int screen_size, plane; +if (!var->pixclock) +return -EINVAL ; + plane = fbdev->plane;/* Make sure that the mode respect all LCD controller and
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 123/173 tools/power turbostat: Fix /dev/cpu_dma_latency warnings
In reply to Greg Kroah-HartmanFrom: Prarit Bhargava <[email protected]>
[ Upstream commit 40aafc7d58d3544f152a863a0e9863014b6d5d8c ]
When running as non-root the following error is seen in turbostat:
turbostat: fopen /dev/cpu_dma_latency
: Permission denied
turbostat and the man page have information on how to avoid other permission errors, so these can be fixed the same way.
Provide better /dev/cpu_dma_latency warnings that provide instructions on how to avoid the error, and update the man page.
--- tools/power/x86/turbostat/turbostat.8 | 2 ++ tools/power/x86/turbostat/turbostat.c | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-)
tools/power/x86/turbostat/turbostat.8 +2 -0
@@ -294,6 +294,8 @@ Alternatively, non-root users can be enabled to run turbostat this way: # chmod +r /dev/cpu/*/msr +# chmod +r /dev/cpu_dma_latency + .B "turbostat " reads hardware counters, but doesn't write them. So it will not interfere with the OS or other programs, including
tools/power/x86/turbostat/turbostat.c +1 -1
@@ -5004,7 +5004,7 @@ void print_dev_latency(void) retval =read (fd, (void *)&value,sizeof (int ));if (retval !=sizeof (int )) { -warn ("read %s\n" , path); +warn ("read failed %s\n" , path);close (fd);return ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 124/173 tracing: Fix wrong return in kprobe_event_gen_test.c
In reply to Greg Kroah-HartmanFrom: Anton Gusev <[email protected]>
[ Upstream commit bc4f359b3b607daac0290d0038561237a86b38cb ]
Overwriting the error code with the deletion result may cause the function to return 0 despite encountering an error. Commit b111545d26c0 ("tracing: Remove the useless value assignment in test_create_synth_event()") solves a similar issue by returning the original error code, so this patch does the same.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- kernel/trace/kprobe_event_gen_test.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/trace/kprobe_event_gen_test.c +2 -2
@@ -146,7 +146,7 @@ static int __init test_gen_kprobe_cmd(void)if (trace_event_file_is_valid (gen_kprobe_test)) gen_kprobe_test =NULL ;/* We got an error after creating the event, delete it */ - ret =kprobe_event_delete ("gen_kprobe_test" ); +kprobe_event_delete ("gen_kprobe_test" ); goto out; }
@@ -211,7 +211,7 @@ static int __init test_gen_kretprobe_cmd(void)if (trace_event_file_is_valid (gen_kretprobe_test)) gen_kretprobe_test =NULL ;/* We got an error after creating the event, delete it */ - ret =kprobe_event_delete ("gen_kretprobe_test" ); +kprobe_event_delete ("gen_kretprobe_test" ); goto out; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 125/173 ca8210: Fix unsigned mac_len comparison with zero in ca8210_skb_tx()
In reply to Greg Kroah-HartmanFrom: Harshit Mogalapalli <[email protected]>
[ Upstream commit 748b2f5e82d17480404b3e2895388fc2925f7caf ]
mac_len is of type unsigned, which can never be less than zero.
mac_len = ieee802154_hdr_peek_addrs(skb, &header); if (mac_len < 0) return mac_len;
Change this to type int as ieee802154_hdr_peek_addrs() can return negative integers, this is found by static analysis with smatch.
--- drivers/net/ieee802154/ca8210.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/ieee802154/ca8210.c +1 -2
@@ -1945,10 +1945,9 @@ static int ca8210_skb_tx(struct ca8210_priv *priv ) { -int status;struct ieee802154_hdr header = { };struct secspec secspec; -unsigned int mac_len; +int mac_len, status;dev_dbg (&priv->spi->dev,"%s called\n" , __func__);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 126/173 mips: bmips: BCM6358: disable RAC flush for TP1
In reply to Greg Kroah-HartmanFrom: Álvaro Fernández Rojas <[email protected]>
[ Upstream commit ab327f8acdf8d06601fbf058859a539a9422afff ]
RAC flush causes kernel panics on BCM6358 with EHCI/OHCI when booting from TP1:
[ 3.881739] usb 1-1: new high-speed USB device number 2 using ehci-platform [ 3.895011] Reserved instruction in kernel code[#1]: [ 3.900113] CPU: 0 PID: 1 Comm: init Not tainted 5.10.16 #0 [ 3.905829] $ 0 : 00000000 10008700 00000000 77d94060 [ 3.911238] $ 4 : 7fd1f088 00000000 81431cac 81431ca0 [ 3.916641] $ 8 : 00000000 ffffefff 8075cd34 00000000 [ 3.922043] $12 : 806f8d40 f3e812b7 00000000 000d9aaa [ 3.927446] $16 : 7fd1f068 7fd1f080 7ff559b8 81428470 [ 3.932848] $20 : 00000000 00000000 55590000 77d70000 [ 3.938251] $24 : 00000018 00000010 [ 3.943655] $28 : 81430000 81431e60 81431f28 800157fc [ 3.949058] Hi : 00000000 [ 3.952013] Lo : 00000000 [ 3.955019] epc : 80015808 setup_sigcontext+0x54/0x24c [ 3.960464] ra : 800157fc setup_sigcontext+0x48/0x24c [ 3.965913] Status: 10008703 KERNEL EXL IE [ 3.970216] Cause : 00800028 (ExcCode 0a) [ 3.974340] PrId : 0002a010 (Broadcom BMIPS4350) [ 3.979170] Modules linked in: ohci_platform ohci_hcd fsl_mph_dr_of ehci_platform ehci_fsl ehci_hcd gpio_button_hotplug usbcore nls_base usb_common [ 3.992907] Process init (pid: 1, threadinfo=(ptrval), task=(ptrval), tls=77e22ec8) [ 4.000776] Stack : 81431ef4 7fd1f080 81431f28 81428470 7fd1f068 81431edc 7ff559b8 81428470 [ 4.009467] 81431f28 7fd1f080 55590000 77d70000 77d5498c 80015c70 806f0000 8063ae74 [ 4.018149] 08100002 81431f28 0000000a 08100002 81431f28 0000000a 77d6b418 00000003 [ 4.026831] ffffffff 80016414 80080734 81431ecc 81431ecc 00000001 00000000 04000000 [ 4.035512] 77d54874 00000000 00000000 00000000 00000000 00000012 00000002 00000000 [ 4.044196] ... [ 4.046706] Call Trace: [ 4.049238] [<80015808>] setup_sigcontext+0x54/0x24c [ 4.054356] [<80015c70>] setup_frame+0xdc/0x124 [ 4.059015] [<80016414>] do_notify_resume+0x1dc/0x288 [ 4.064207] [<80011b50>] work_notifysig+0x10/0x18 [ 4.069036] [ 4.070538] Code: 8fc300b4 00001025 26240008 <ac820000> ac830004 3c048063 0c0228aa 24846a00 26240010 [ 4.080686] [ 4.082517] ---[ end trace 22a8edb41f5f983b ]--- [ 4.087374] Kernel panic - not syncing: Fatal exception [ 4.092753] Rebooting in 1 seconds..
Because the bootloader (CFE) is not initializing the Read-ahead cache properly on the second thread (TP1). Since the RAC was not initialized properly, we should avoid flushing it at the risk of corrupting the instruction stream as seen in the trace above.
--- arch/mips/bmips/dma.c | 5 +++++ arch/mips/bmips/setup.c | 8 ++++++++ 2 files changed, 13 insertions(+)
arch/mips/bmips/dma.c +5 -0
@@ -64,6 +64,8 @@ phys_addr_t dma_to_phys(struct device *dev, dma_addr_t dma_addr)return dma_addr; } +bool bmips_rac_flush_disable; +void arch_sync_dma_for_cpu_all (void ) {void __iomem *cbr =BMIPS_GET_CBR ();
@@ -74,6 +76,9 @@ void arch_sync_dma_for_cpu_all(void) boot_cpu_type() != CPU_BMIPS4380)return ; +if (unlikely (bmips_rac_flush_disable)) +return ; +/* Flush stale data out of the readahead cache */ cfg =__raw_readl (cbr +BMIPS_RAC_CONFIG );__raw_writel (cfg |0x100 , cbr +BMIPS_RAC_CONFIG );
arch/mips/bmips/setup.c +8 -0
@@ -34,6 +34,8 @@#define REG_BCM6328_OTP ((void __iomem *)CKSEG1ADDR(0x1000062c))#define BCM6328_TP1_DISABLED BIT(9) +extern bool bmips_rac_flush_disable; +static const unsigned long kbase =VMLINUX_LOAD_ADDRESS &0xfff00000 ;struct bmips_quirk {
@@ -103,6 +105,12 @@ static void bcm6358_quirks(void)* disable SMP for now */ bmips_smp_enabled =0 ; + +/* +* RAC flush causes kernel panics on BCM6358 when booting from TP1 +* because the bootloader is not initializing it properly. +*/ + bmips_rac_flush_disable = !!(read_c0_brcm_cmt_local () & (1 <<31 )); }static void bcm6368_quirks (void )
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 127/173 mtd: rawnand: meson: invalidate cache on polling ECC bit
In reply to Greg Kroah-HartmanFrom: Arseniy Krasnov <[email protected]>
[ Upstream commit e732e39ed9929c05fd219035bc9653ba4100d4fa ]
'info_buf' memory is cached and driver polls ECC bit in it. This bit is set by the NAND controller. If 'usleep_range()' returns before device sets this bit, 'info_buf' will be cached and driver won't see update of this bit and will loop forever.
--- drivers/mtd/nand/raw/meson_nand.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/mtd/nand/raw/meson_nand.c +7 -1
@@ -172,6 +172,7 @@ struct meson_nfc {dma_addr_t daddr;dma_addr_t iaddr; +u32 info_bytes;unsigned long assigned_cs; };
@@ -499,6 +500,7 @@ static int meson_nfc_dma_buffer_setup(struct nand_chip *nand, void *databuf, nfc->daddr, datalen, dir);return ret; } + nfc->info_bytes = infolen; cmd =GENCMDIADDRL (NFC_CMD_AIL , nfc->iaddr);writel (cmd, nfc->reg_base +NFC_REG_CMD );
@@ -516,8 +518,10 @@ static void meson_nfc_dma_buffer_release(struct nand_chip *nand,struct meson_nfc *nfc =nand_get_controller_data (nand);dma_unmap_single (nfc->dev, nfc->daddr, datalen, dir); -if (infolen) +if (infolen) {dma_unmap_single (nfc->dev, nfc->iaddr, infolen, dir); + nfc->info_bytes =0 ; + } }static int meson_nfc_read_buf (struct nand_chip *nand,u8 *buf,int len)
@@ -706,6 +710,8 @@ static void meson_nfc_check_ecc_pages_valid(struct meson_nfc *nfc,usleep_range (10 ,15 );/* info is updated by nfc dma engine*/ smp_rmb (); +dma_sync_single_for_cpu (nfc->dev, nfc->iaddr, nfc->info_bytes, +DMA_FROM_DEVICE ); ret = *info &ECC_COMPLETE ; }while (!ret); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 128/173 sfc: ef10: dont overwrite offload features at NIC reset
In reply to Greg Kroah-HartmanFrom: Íñigo Huguet <[email protected]>
[ Upstream commit ca4a80e4bb7e87daf33b27d2ab9e4f5311018a89 ]
At NIC reset, some offload features related to encapsulated traffic might have changed (this mainly happens if the firmware-variant is changed with the sfboot userspace tool). Because of this, features are checked and set again at reset time.
However, this was not done right, and some features were improperly overwritten at NIC reset:
- Tunneled IPv6 segmentation was always disabled
- Features disabled with ethtool were reenabled
- Features that becomes unsupported after the reset were not disabled
Also, checking if the device supports IPV6_CSUM to enable TSO6 is no longer necessary because all currently supported devices support it. Additionally, move the assignment of some other features to the EF10_OFFLOAD_FEATURES macro, like it is done in ef100, leaving the selection of features in efx_pci_probe_post_io a bit cleaner.
--- drivers/net/ethernet/sfc/ef10.c | 38 ++++++++++++++++++++++----------- drivers/net/ethernet/sfc/efx.c | 17 ++++++--------- 2 files changed, 33 insertions(+), 22 deletions(-)
drivers/net/ethernet/sfc/ef10.c +26 -12
@@ -1304,7 +1304,8 @@ static void efx_ef10_fini_nic(struct efx_nic *efx)static int efx_ef10_init_nic (struct efx_nic *efx) {struct efx_ef10_nic_data *nic_data = efx->nic_data; -netdev_features_t hw_enc_features =0 ; +struct net_device *net_dev = efx->net_dev; +netdev_features_t tun_feats, tso_feats;int rc;if (nic_data->must_check_datapath_caps) {
@@ -1349,20 +1350,30 @@ static int efx_ef10_init_nic(struct efx_nic *efx) nic_data->must_restore_piobufs = false; } -/* add encapsulated checksum offload features */ +/* encap features might change during reset if fw variant changed */ if (efx_has_cap (efx,VXLAN_NVGRE ) && !efx_ef10_is_vf (efx)) - hw_enc_features |=NETIF_F_IP_CSUM |NETIF_F_IPV6_CSUM ; -/* add encapsulated TSO features */ -if (efx_has_cap (efx,TX_TSO_V2_ENCAP )) { -netdev_features_t encap_tso_features; + net_dev->hw_enc_features |=NETIF_F_IP_CSUM |NETIF_F_IPV6_CSUM ; +else + net_dev->hw_enc_features &= ~(NETIF_F_IP_CSUM |NETIF_F_IPV6_CSUM ); - encap_tso_features =NETIF_F_GSO_UDP_TUNNEL |NETIF_F_GSO_GRE | -NETIF_F_GSO_UDP_TUNNEL_CSUM |NETIF_F_GSO_GRE_CSUM ; + tun_feats =NETIF_F_GSO_UDP_TUNNEL |NETIF_F_GSO_GRE | +NETIF_F_GSO_UDP_TUNNEL_CSUM |NETIF_F_GSO_GRE_CSUM ; + tso_feats =NETIF_F_TSO |NETIF_F_TSO6 ; - hw_enc_features |= encap_tso_features |NETIF_F_TSO ; - efx->net_dev->features |= encap_tso_features; +if (efx_has_cap (efx,TX_TSO_V2_ENCAP )) { +/* If this is first nic_init, or if it is a reset and a new fw +* variant has added new features, enable them by default. +* If the features are not new, maintain their current value. +*/ +if (!(net_dev->hw_features & tun_feats)) + net_dev->features |= tun_feats; + net_dev->hw_enc_features |= tun_feats | tso_feats; + net_dev->hw_features |= tun_feats; + }else { + net_dev->hw_enc_features &= ~(tun_feats | tso_feats); + net_dev->hw_features &= ~tun_feats; + net_dev->features &= ~tun_feats; } - efx->net_dev->hw_enc_features = hw_enc_features;/* don't fail init if RSS setup doesn't work */ rc = efx->type->rx_push_rss_config(efx, false,
@@ -3977,7 +3988,10 @@ static unsigned int ef10_check_caps(const struct efx_nic *efx, NETIF_F_HW_VLAN_CTAG_FILTER | \ NETIF_F_IPV6_CSUM | \ NETIF_F_RXHASH | \ - NETIF_F_NTUPLE) + NETIF_F_NTUPLE | \ + NETIF_F_SG | \ + NETIF_F_RXCSUM | \ + NETIF_F_RXALL)const struct efx_nic_type efx_hunt_a0_vf_nic_type = { .is_vf = true,
drivers/net/ethernet/sfc/efx.c +7 -10
@@ -1045,21 +1045,18 @@ static int efx_pci_probe_post_io(struct efx_nic *efx) }/* Determine netdevice features */ - net_dev->features |= (efx->type->offload_features |NETIF_F_SG | -NETIF_F_TSO |NETIF_F_RXCSUM |NETIF_F_RXALL ); -if (efx->type->offload_features & (NETIF_F_IPV6_CSUM |NETIF_F_HW_CSUM )) { - net_dev->features |=NETIF_F_TSO6 ; -if (efx_has_cap (efx,TX_TSO_V2_ENCAP )) - net_dev->hw_enc_features |=NETIF_F_TSO6 ; - } -/* Check whether device supports TSO */ -if (!efx->type->tso_versions || !efx->type->tso_versions (efx)) - net_dev->features &= ~NETIF_F_ALL_TSO ; + net_dev->features |= efx->type->offload_features; + +/* Add TSO features */ +if (efx->type->tso_versions && efx->type->tso_versions (efx)) + net_dev->features |=NETIF_F_TSO |NETIF_F_TSO6 ; +/* Mask for features that also apply to VLAN devices */ net_dev->vlan_features |= (NETIF_F_HW_CSUM |NETIF_F_SG |NETIF_F_HIGHDMA |NETIF_F_ALL_TSO |NETIF_F_RXCSUM ); +/* Determine user configurable features */ net_dev->hw_features |= net_dev->features & ~efx->fixed_features;/* Disable receiving frames with bad FCS, by default. */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 129/173 scsi: megaraid_sas: Fix crash after a double completion
In reply to Greg Kroah-HartmanFrom: Tomas Henzl <[email protected]>
[ Upstream commit 2309df27111a51734cb9240b4d3c25f2f3c6ab06 ]
When a physical disk is attached directly "without JBOD MAP support" (see megasas_get_tm_devhandle()) then there is no real error handling in the driver. Return FAILED instead of SUCCESS.
--- drivers/scsi/megaraid/megaraid_sas_fusion.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/megaraid/megaraid_sas_fusion.c +2 -2
@@ -4656,7 +4656,7 @@ int megasas_task_abort_fusion(struct scsi_cmnd *scmd) devhandle =megasas_get_tm_devhandle (scmd->device);if (devhandle == (u16 )ULONG_MAX ) { - ret =SUCCESS ; + ret =FAILED ;sdev_printk (KERN_INFO , scmd->device,"task abort issued for invalid devhandle\n" );mutex_unlock (&instance->reset_mutex);
@@ -4726,7 +4726,7 @@ int megasas_reset_target_fusion(struct scsi_cmnd *scmd) devhandle =megasas_get_tm_devhandle (scmd->device);if (devhandle == (u16 )ULONG_MAX ) { - ret =SUCCESS ; + ret =FAILED ;sdev_printk (KERN_INFO , scmd->device,"target reset issued for invalid devhandle\n" );mutex_unlock (&instance->reset_mutex);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 130/173 ptp_qoriq: fix memory leak in probe()
In reply to Greg Kroah-HartmanFrom: SongJingyi <[email protected]>
[ Upstream commit f33642224e38d7e0d59336e10e7b4e370b1c4506 ]
Smatch complains that:drivers/ptp/ptp_qoriq.c ptp_qoriq_probe()
warn: 'base' from ioremap() not released.
Fix this by revising the parameter from 'ptp_qoriq->base' to 'base'. This is only a bug if ptp_qoriq_init() returns on the first -ENODEV error path.
For other error paths ptp_qoriq->base and base are the same. And this change makes the code more readable.
--- drivers/ptp/ptp_qoriq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ptp/ptp_qoriq.c +1 -1
@@ -601,7 +601,7 @@ static int ptp_qoriq_probe(struct platform_device *dev)return 0 ; no_clock: -iounmap (ptp_qoriq->base); +iounmap (base); no_ioremap:release_resource (ptp_qoriq->rsrc); no_resource:
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 131/173 r8169: fix RTL8168H and RTL8107E rx crc error
In reply to Greg Kroah-HartmanFrom: ChunHao Lin <[email protected]>
[ Upstream commit 33189f0a94b9639c058781fcf82e4ea3803b1682 ]
When link speed is 10 Mbps and temperature is under -20°C, RTL8168H and RTL8107E may have rx crc error. Disable phy 10 Mbps pll off to fix this issue.
--- drivers/net/ethernet/realtek/r8169_phy_config.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/realtek/r8169_phy_config.c +3 -0
@@ -970,6 +970,9 @@ static void rtl8168h_2_hw_phy_config(struct rtl8169_private *tp,/* disable phy pfm mode */ phy_modify_paged (phydev,0x0a44 ,0x11 ,BIT (7 ),0 ); +/* disable 10m pll off */ +phy_modify_paged (phydev,0x0a43 ,0x10 ,BIT (0 ),0 ); +rtl8168g_disable_aldps (phydev);rtl8168g_config_eee_phy (phydev); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 132/173 regulator: Handle deferred clk
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 02bcba0b9f9da706d5bd1e8cbeb83493863e17b5 ]
devm_clk_get() can return -EPROBE_DEFER. So it is better to return the error code from devm_clk_get(), instead of a hard coded -ENOENT.
This gives more opportunities to successfully probe the driver.
--- drivers/regulator/fixed.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/regulator/fixed.c +1 -1
@@ -175,7 +175,7 @@ static int reg_fixed_voltage_probe(struct platform_device *pdev) drvdata->enable_clock =devm_clk_get (dev,NULL );if (IS_ERR (drvdata->enable_clock)) {dev_err (dev,"Can't get enable-clock from devicetree\n" ); -return -ENOENT ; +return PTR_ERR (drvdata->enable_clock); } }else { drvdata->desc.ops = &fixed_voltage_ops;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 133/173 net/net_failover: fix txq exceeding warning
In reply to Greg Kroah-HartmanFrom: Faicker Mo <[email protected]>
[ Upstream commit e3cbdcb0fbb61045ef3ce0e072927cc41737f787 ]
The failover txq is inited as 16 queues.
when a packet is transmitted from the failover device firstly, the failover device will select the queue which is returned from the primary device if the primary device is UP and running. If the primary device txq is bigger than the default 16, it can lead to the following warning:
eth0 selects TX queue 18, but real number of TX queues is 16
The warning backtrace is:
[ 32.146376] CPU: 18 PID: 9134 Comm: chronyd Tainted: G E 6.2.8-1.el7.centos.x86_64 #1 [ 32.147175] Hardware name: Red Hat KVM, BIOS 1.10.2-3.el7_4.1 04/01/2014 [ 32.147730] Call Trace: [ 32.147971] <TASK> [ 32.148183] dump_stack_lvl+0x48/0x70 [ 32.148514] dump_stack+0x10/0x20 [ 32.148820] netdev_core_pick_tx+0xb1/0xe0 [ 32.149180] __dev_queue_xmit+0x529/0xcf0 [ 32.149533] ? __check_object_size.part.0+0x21c/0x2c0 [ 32.149967] ip_finish_output2+0x278/0x560 [ 32.150327] __ip_finish_output+0x1fe/0x2f0 [ 32.150690] ip_finish_output+0x2a/0xd0 [ 32.151032] ip_output+0x7a/0x110 [ 32.151337] ? __pfx_ip_finish_output+0x10/0x10 [ 32.151733] ip_local_out+0x5e/0x70 [ 32.152054] ip_send_skb+0x19/0x50 [ 32.152366] udp_send_skb.isra.0+0x163/0x3a0 [ 32.152736] udp_sendmsg+0xba8/0xec0 [ 32.153060] ? __folio_memcg_unlock+0x25/0x60 [ 32.153445] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 32.153854] ? sock_has_perm+0x85/0xa0 [ 32.154190] inet_sendmsg+0x6d/0x80 [ 32.154508] ? inet_sendmsg+0x6d/0x80 [ 32.154838] sock_sendmsg+0x62/0x70 [ 32.155152] ____sys_sendmsg+0x134/0x290 [ 32.155499] ___sys_sendmsg+0x81/0xc0 [ 32.155828] ? _get_random_bytes.part.0+0x79/0x1a0 [ 32.156240] ? ip4_datagram_release_cb+0x5f/0x1e0 [ 32.156649] ? get_random_u16+0x69/0xf0 [ 32.156989] ? __fget_light+0xcf/0x110 [ 32.157326] __sys_sendmmsg+0xc4/0x210 [ 32.157657] ? __sys_connect+0xb7/0xe0 [ 32.157995] ? __audit_syscall_entry+0xce/0x140 [ 32.158388] ? syscall_trace_enter.isra.0+0x12c/0x1a0 [ 32.158820] __x64_sys_sendmmsg+0x24/0x30 [ 32.159171] do_syscall_64+0x38/0x90 [ 32.159493] entry_SYSCALL_64_after_hwframe+0x72/0xdc
Fix that by reducing txq number as the non-existent primary-dev does.
--- drivers/net/net_failover.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/net/net_failover.c +2 -6
@@ -130,14 +130,10 @@ static u16 net_failover_select_queue(struct net_device *dev, txq = ops->ndo_select_queue (primary_dev, skb, sb_dev); else txq =netdev_pick_tx (primary_dev, skb,NULL ); - -qdisc_skb_cb (skb)->slave_dev_queue_mapping = skb->queue_mapping; - -return txq; + }else { + txq =skb_rx_queue_recorded (skb) ?skb_get_rx_queue (skb) :0 ; } - txq =skb_rx_queue_recorded (skb) ?skb_get_rx_queue (skb) :0 ; -/* Save the original txq to restore before passing to the driver */ qdisc_skb_cb (skb)->slave_dev_queue_mapping = skb->queue_mapping;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 134/173 net: stmmac: dont reject VLANs when IFF_PROMISC is set
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit a7602e7332b97cfbec7bacb0f1ade99a575fe104 ]
The blamed commit has introduced the following tests to dwmac4_add_hw_vlan_rx_fltr(), called from stmmac_vlan_rx_add_vid():
if (hw->promisc) {
netdev_err(dev,
"Adding VLAN in promisc mode not supported\n");
return -EPERM;
}"VLAN promiscuous" mode is keyed in this driver to IFF_PROMISC, and so, vlan_vid_add() and vlan_vid_del() calls cannot take place in IFF_PROMISC mode. I have the following 2 arguments that this restriction is.... hm, how shall I put it nicely... unproductive :)
First, take the case of a Linux bridge. If the kernel is compiled with CONFIG_BRIDGE_VLAN_FILTERING=y, then this bridge shall have a VLAN database. The bridge shall try to call vlan_add_vid() on its bridge ports for each VLAN in the VLAN table. It will do this irrespectively of whether that port is *currently* VLAN-aware or not. So it will do this even when the bridge was created with vlan_filtering 0.
But the Linux bridge, in VLAN-unaware mode, configures its ports in promiscuous (IFF_PROMISC) mode, so that they accept packets with any MAC DA (a switch must do this in order to forward those packets which are not directly targeted to its MAC address).
As a result, the stmmac driver does not work as a bridge port, when the kernel is compiled with CONFIG_BRIDGE_VLAN_FILTERING=y.
$ ip link add br0 type bridge && ip link set br0 up $ ip link set eth0 master br0 && ip link set eth0 up [ 2333.943296] br0: port 1(eth0) entered blocking state [ 2333.943381] br0: port 1(eth0) entered disabled state [ 2333.943782] device eth0 entered promiscuous mode [ 2333.944080] 4033c000.ethernet eth0: Adding VLAN in promisc mode not supported [ 2333.976509] 4033c000.ethernet eth0: failed to initialize vlan filtering on this port RTNETLINK answers: Operation not permitted
Secondly, take the case of stmmac as DSA master. Some switch tagging protocols are based on 802.1Q VLANs (tag_sja1105.c), and as such, tag_8021q.c uses vlan_vid_add() to work with VLAN-filtering DSA masters. But also, when a DSA port becomes promiscuous (for example when it joins a bridge), the DSA framework also makes the DSA master promiscuous.
Moreover, for every VLAN that a DSA switch sends to the CPU, DSA also programs a VLAN filter on the DSA master, because if the the DSA switch uses a tail tag, then the hardware frame parser of the DSA master will see VLAN as VLAN, and might filter them out, for being unknown.
Due to the above 2 reasons, my belief is that the stmmac driver does not get to choose to not accept vlan_vid_add() calls while IFF_PROMISC is enabled, because the 2 are completely independent and there are code paths in the network stack which directly lead to this situation occurring, without the user's direct input.
In fact, my belief is that "VLAN promiscuous" mode should have never been keyed on IFF_PROMISC in the first place, but rather, on the NETIF_F_HW_VLAN_CTAG_FILTER feature flag which can be toggled by the user through ethtool -k, when present in netdev->hw_features.
In the stmmac driver, NETIF_F_HW_VLAN_CTAG_FILTER is only present in "features", making this feature "on [fixed]".
I have this belief because I am unaware of any definition of promiscuity which implies having an effect on anything other than MAC DA (therefore not VLAN). However, I seem to be rather alone in having this opinion, looking back at the disagreements from this discussion:
https://lore.kernel.org/netdev/[email protected]/
In any case, to remove the vlan_vid_add() dependency on !IFF_PROMISC, one would need to remove the check and see what fails. I guess the test was there because of the way in which dwmac4_vlan_promisc_enable() is implemented.
For context, the dwmac4 supports Perfect Filtering for a limited number of VLANs - dwmac4_get_num_vlan(), priv->hw->num_vlan, with a fallback on Hash Filtering - priv->dma_cap.vlhash - see stmmac_vlan_update(), also visible in cat /sys/kernel/debug/stmmaceth/eth0/dma_cap | grep 'VLAN Hash Filtering'.
The perfect filtering is based on MAC_VLAN_Tag_Filter/MAC_VLAN_Tag_Data registers, accessed in the driver through dwmac4_write_vlan_filter().
The hash filtering is based on the MAC_VLAN_Hash_Table register, named GMAC_VLAN_HASH_TABLE in the driver and accessed by dwmac4_update_vlan_hash(). The control bit for enabling hash filtering is GMAC_VLAN_VTHM (MAC_VLAN_Tag_Ctrl bit VTHM: VLAN Tag Hash Table Match Enable).
Now, the description of dwmac4_vlan_promisc_enable() is that it iterates through the driver's cache of perfect filter entries (hw->vlan_filter[i], added by dwmac4_add_hw_vlan_rx_fltr()), and evicts them from hardware by unsetting their GMAC_VLAN_TAG_DATA_VEN (MAC_VLAN_Tag_Data bit VEN - VLAN Tag Enable) bit. Then it unsets the GMAC_VLAN_VTHM bit, which disables hash matching.
This leaves the MAC, according to table "VLAN Match Status" from the documentation, to always enter these data paths:
VID |VLAN Perfect Filter |VTHM Bit |VLAN Hash Filter |Final VLAN Match
|Match Result | |Match Result |Status
-------|--------------------|---------|-----------------|----------------
VID!=0 |Fail |0 |don't care |PassSo, dwmac4_vlan_promisc_enable() does its job, but by unsetting GMAC_VLAN_VTHM, it conflicts with the other code path which controls this bit: dwmac4_update_vlan_hash(), called through stmmac_update_vlan_hash() from stmmac_vlan_rx_add_vid() and from stmmac_vlan_rx_kill_vid(). This is, I guess, why dwmac4_add_hw_vlan_rx_fltr() is not allowed to run after dwmac4_vlan_promisc_enable() has unset GMAC_VLAN_VTHM: because if it did, then dwmac4_update_vlan_hash() would set GMAC_VLAN_VTHM again, breaking the "VLAN promiscuity".
It turns out that dwmac4_vlan_promisc_enable() is way too complicated for what needs to be done. The MAC_Packet_Filter register also has the VTFE bit (VLAN Tag Filter Enable), which simply controls whether VLAN tagged packets which don't match the filtering tables (either perfect or hash) are dropped or not. At the moment, this driver unconditionally sets GMAC_PACKET_FILTER_VTFE if NETIF_F_HW_VLAN_CTAG_FILTER was detected through the priv->dma_cap.vlhash capability bits of the device, in stmmac_dvr_probe().
I would suggest deleting the unnecessarily complex logic from dwmac4_vlan_promisc_enable(), and simply unsetting GMAC_PACKET_FILTER_VTFE when becoming IFF_PROMISC, which has the same effect of allowing packets with any VLAN tags, but has the additional benefit of being able to run concurrently with stmmac_vlan_rx_add_vid() and stmmac_vlan_rx_kill_vid().
As much as I believe that the VTFE bit should have been exclusively controlled by NETIF_F_HW_VLAN_CTAG_FILTER through ethtool, and not by IFF_PROMISC, changing that is not a punctual fix to the problem, and it would probably break the VFFQ feature added by the later commit e0f9956a3862 ("net: stmmac: Add option for VLAN filter fail queue enable"). From the commit description, VFFQ needs IFF_PROMISC=on and VTFE=off in order to work (and this change respects that). But if VTFE was changed to be controlled through ethtool -k, then a user-visible change would have been introduced in Intel's scripts (a need to run "ethtool -k eth0 rx-vlan-filter off" which did not exist before).
The patch was tested with this set of commands:
ip link set eth0 up
ip link add link eth0 name eth0.100 type vlan id 100
ip addr add 192.168.100.2/24 dev eth0.100 && ip link set eth0.100 up ip link set eth0 promisc on
ip link add link eth0 name eth0.101 type vlan id 101
ip addr add 192.168.101.2/24 dev eth0.101 && ip link set eth0.101 up ip link set eth0 promisc off
ping -c 5 192.168.100.1
ping -c 5 192.168.101.1
ip link set eth0 promisc on
ping -c 5 192.168.100.1
ping -c 5 192.168.101.1
ip link del eth0.100
ip link del eth0.101
# Wait for VLAN-tagged pings from the other end...
# Check with "tcpdump -i eth0 -e -n -p" and we should see them ip link set eth0 promisc off
# Wait for VLAN-tagged pings from the other end...
# Check with "tcpdump -i eth0 -e -n -p" and we shouldn't see them # anymore, but remove the "-p" argument from tcpdump and they're there.
--- drivers/net/ethernet/stmicro/stmmac/common.h | 1 - .../net/ethernet/stmicro/stmmac/dwmac4_core.c | 61 +------------------ 2 files changed, 3 insertions(+), 59 deletions(-)
drivers/net/ethernet/stmicro/stmmac/common.h +0 -1
@@ -480,7 +480,6 @@ struct mac_device_info {unsigned int xlgmac;unsigned int num_vlan;u32 vlan_filter[32 ]; -unsigned int promisc;bool vlan_fail_q_en;u8 vlan_fail_q; };
drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +3 -58
88 lines not on this page · raw message
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 135/173 can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write
In reply to Greg Kroah-HartmanFrom: Ivan Orlov <[email protected]>
[ Upstream commit 2b4c99f7d9a57ecd644eda9b1fb0a1072414959f ]
Syzkaller reported the following issue:
=====================================================
BUG: KMSAN: uninit-value in aio_rw_done fs/aio.c:1520 [inline] BUG: KMSAN: uninit-value in aio_write+0x899/0x950 fs/aio.c:1600 aio_rw_done fs/aio.c:1520 [inline] aio_write+0x899/0x950 fs/aio.c:1600 io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019 __do_sys_io_submit fs/aio.c:2078 [inline] __se_sys_io_submit+0x293/0x770 fs/aio.c:2048 __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Uninit was created at:
slab_post_alloc_hook mm/slab.h:766 [inline] slab_alloc_node mm/slub.c:3452 [inline] __kmem_cache_alloc_node+0x71f/0xce0 mm/slub.c:3491 __do_kmalloc_node mm/slab_common.c:967 [inline] __kmalloc+0x11d/0x3b0 mm/slab_common.c:981 kmalloc_array include/linux/slab.h:636 [inline] bcm_tx_setup+0x80e/0x29d0 net/can/bcm.c:930 bcm_sendmsg+0x3a2/0xce0 net/can/bcm.c:1351 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] sock_write_iter+0x495/0x5e0 net/socket.c:1108 call_write_iter include/linux/fs.h:2189 [inline] aio_write+0x63a/0x950 fs/aio.c:1600 io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019 __do_sys_io_submit fs/aio.c:2078 [inline] __se_sys_io_submit+0x293/0x770 fs/aio.c:2048 __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd CPU: 1 PID: 5034 Comm: syz-executor350 Not tainted 6.2.0-rc6-syzkaller-80422-geda666ff2276 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 =====================================================
We can follow the call chain and find that 'bcm_tx_setup' function calls 'memcpy_from_msg' to copy some content to the newly allocated frame of 'op->frames'. After that the 'len' field of copied structure being compared with some constant value (64 or 8). However, if 'memcpy_from_msg' returns an error, we will compare some uninitialized memory. This triggers 'uninit-value' issue.
This patch will add 'memcpy_from_msg' possible errors processing to avoid uninit-value issue.
Tested via syzkaller
--- net/can/bcm.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
net/can/bcm.c +10 -6
@@ -936,6 +936,8 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, cf = op->frames + op->cfsiz * i; err =memcpy_from_msg ((u8 *)cf, msg, op->cfsiz); +if (err <0 ) + goto free_op;if (op->flags &CAN_FD_FRAME ) {if (cf->len >64 )
@@ -945,12 +947,8 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, err = -EINVAL ; } -if (err <0 ) { -if (op->frames != &op->sframe) -kfree (op->frames); -kfree (op); -return err; - } +if (err <0 ) + goto free_op;if (msg_head->flags &TX_CP_CAN_ID ) {/* copy can_id into frame */
@@ -1021,6 +1019,12 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,bcm_tx_start_timer (op);return msg_head->nframes * op->cfsiz +MHSIZ ; + +free_op: +if (op->frames != &op->sframe) +kfree (op->frames); +kfree (op); +return err; }/*
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 136/173 s390/vfio-ap: fix memory leak in vfio_ap device driver
In reply to Greg Kroah-HartmanFrom: Tony Krowiak <[email protected]>
[ Upstream commit 8f8cf767589f2131ae5d40f3758429095c701c84 ]
The device release callback function invoked to release the matrix device uses the dev_get_drvdata(device *dev) function to retrieve the pointer to the vfio_matrix_dev object in order to free its storage. The problem is, this object is not stored as drvdata with the device; since the kfree function will accept a NULL pointer, the memory for the vfio_matrix_dev object is never freed.
Since the device being released is contained within the vfio_matrix_dev object, the container_of macro will be used to retrieve its pointer.
--- drivers/s390/crypto/vfio_ap_drv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/s390/crypto/vfio_ap_drv.c +2 -1
@@ -82,8 +82,9 @@ static void vfio_ap_queue_dev_remove(struct ap_device *apdev)static void vfio_ap_matrix_dev_release (struct device *dev) { -struct ap_matrix_dev *matrix_dev =dev_get_drvdata (dev); +struct ap_matrix_dev *matrix_dev; + matrix_dev = container_of(dev, struct ap_matrix_dev, device);kfree (matrix_dev); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 137/173 ALSA: ymfpci: Fix assignment in if condition
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
[ Upstream commit e7daaeedb4f270126792ae216f406c1ba2b8f4d9 ]
PCI YMFPCI driver code contains lots of assignments in if condition, which is a bad coding style that may confuse readers and occasionally lead to bugs.
This patch is merely for coding-style fixes, no functional changes.
Stable-dep-of: 6be2e7522eb5 ("ALSA: ymfpci: Fix BUG_ON in probe function")
--- sound/pci/ymfpci/ymfpci.c | 71 +++++++++++++++++++-------------- sound/pci/ymfpci/ymfpci_main.c | 72 +++++++++++++++++++++++----------- 2 files changed, 91 insertions(+), 52 deletions(-)
sound/pci/ymfpci/ymfpci.c +42 -29
@@ -78,7 +78,8 @@ static int snd_ymfpci_create_gameport(struct snd_ymfpci *chip, int dev,if (io_port ==1 ) {/* auto-detect */ -if (!(io_port =pci_resource_start (chip->pci,2 ))) + io_port =pci_resource_start (chip->pci,2 ); +if (!io_port)return -ENODEV ; } }else {
@@ -87,7 +88,8 @@ static int snd_ymfpci_create_gameport(struct snd_ymfpci *chip, int dev,for (io_port =0x201 ; io_port <=0x205 ; io_port++) {if (io_port ==0x203 )continue ; -if ((r =request_region (io_port,1 ,"YMFPCI gameport" )) !=NULL ) + r =request_region (io_port,1 ,"YMFPCI gameport" ); +if (r)break ; }if (!r) {
@@ -108,10 +110,13 @@ static int snd_ymfpci_create_gameport(struct snd_ymfpci *chip, int dev, } } -if (!r && !(r =request_region (io_port,1 ,"YMFPCI gameport" ))) { -dev_err (chip->card->dev, -"joystick port %#x is in use.\n" , io_port); -return -EBUSY ; +if (!r) { + r =request_region (io_port,1 ,"YMFPCI gameport" ); +if (!r) { +dev_err (chip->card->dev, +"joystick port %#x is in use.\n" , io_port); +return -EBUSY ; + } } chip->gameport = gp =gameport_allocate_port ();
@@ -199,8 +204,9 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci,/* auto-detect */ fm_port[dev] =pci_resource_start (pci,1 ); } -if (fm_port[dev] >0 && - (fm_res =request_region (fm_port[dev],4 ,"YMFPCI OPL3" )) !=NULL ) { +if (fm_port[dev] >0 ) + fm_res =request_region (fm_port[dev],4 ,"YMFPCI OPL3" ); +if (fm_res) { legacy_ctrl |=YMFPCI_LEGACY_FMEN ;pci_write_config_word (pci,PCIR_DSXG_FMBASE , fm_port[dev]); }
@@ -208,8 +214,9 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci,/* auto-detect */ mpu_port[dev] =pci_resource_start (pci,1 ) +0x20 ; } -if (mpu_port[dev] >0 && - (mpu_res =request_region (mpu_port[dev],2 ,"YMFPCI MPU401" )) !=NULL ) { +if (mpu_port[dev] >0 ) + mpu_res =request_region (mpu_port[dev],2 ,"YMFPCI MPU401" ); +if (mpu_res) { legacy_ctrl |=YMFPCI_LEGACY_MEN ;pci_write_config_word (pci,PCIR_DSXG_MPU401BASE , mpu_port[dev]); }
@@ -221,8 +228,9 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci,case 0x3a8 : legacy_ctrl2 |=3 ;break ;default : fm_port[dev] =0 ;break ; } -if (fm_port[dev] >0 && - (fm_res =request_region (fm_port[dev],4 ,"YMFPCI OPL3" )) !=NULL ) { +if (fm_port[dev] >0 ) + fm_res =request_region (fm_port[dev],4 ,"YMFPCI OPL3" ); +if (fm_res) { legacy_ctrl |=YMFPCI_LEGACY_FMEN ; }else { legacy_ctrl2 &= ~YMFPCI_LEGACY2_FMIO ;
@@ -235,8 +243,9 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci,case 0x334 : legacy_ctrl2 |=3 <<4 ;break ;default : mpu_port[dev] =0 ;break ; } -if (mpu_port[dev] >0 && - (mpu_res =request_region (mpu_port[dev],2 ,"YMFPCI MPU401" )) !=NULL ) { +if (mpu_port[dev] >0 ) + mpu_res =request_region (mpu_port[dev],2 ,"YMFPCI MPU401" ); +if (mpu_res) { legacy_ctrl |=YMFPCI_LEGACY_MEN ; }else { legacy_ctrl2 &= ~YMFPCI_LEGACY2_MPUIO ;
@@ -250,9 +259,8 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci,pci_read_config_word (pci,PCIR_DSXG_LEGACY , &old_legacy_ctrl);pci_write_config_word (pci,PCIR_DSXG_LEGACY , legacy_ctrl);pci_write_config_word (pci,PCIR_DSXG_ELEGACY , legacy_ctrl2); -if ((err =snd_ymfpci_create (card, pci, - old_legacy_ctrl, - &chip)) <0 ) { + err =snd_ymfpci_create (card, pci, old_legacy_ctrl, &chip); +if (err <0 ) {release_and_free_resource (mpu_res);release_and_free_resource (fm_res); goto free_card;
@@ -293,11 +301,12 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci, goto free_card;if (chip->mpu_res) { -if ((err =snd_mpu401_uart_new (card,0 ,MPU401_HW_YMFPCI , - mpu_port[dev], -MPU401_INFO_INTEGRATED | -MPU401_INFO_IRQ_HOOK , --1 , &chip->rawmidi)) <0 ) { + err =snd_mpu401_uart_new (card,0 ,MPU401_HW_YMFPCI , + mpu_port[dev], +MPU401_INFO_INTEGRATED | +MPU401_INFO_IRQ_HOOK , +-1 , &chip->rawmidi); +if (err <0 ) {dev_warn (card->dev,"cannot initialize MPU401 at 0x%lx, skipping...\n" , mpu_port[dev]);
@@ -306,18 +315,22 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci, } }if (chip->fm_res) { -if ((err =snd_opl3_create (card, - fm_port[dev], - fm_port[dev] +2 , -OPL3_HW_OPL3 ,1 , &opl3)) <0 ) { + err =snd_opl3_create (card, + fm_port[dev], + fm_port[dev] +2 , +OPL3_HW_OPL3 ,1 , &opl3); +if (err <0 ) {dev_warn (card->dev,"cannot initialize FM OPL3 at 0x%lx, skipping...\n" , fm_port[dev]); legacy_ctrl &= ~YMFPCI_LEGACY_FMEN ;pci_write_config_word (pci,PCIR_DSXG_LEGACY , legacy_ctrl); - }else if ((err =snd_opl3_hwdep_new (opl3,0 ,1 ,NULL )) <0 ) { -dev_err (card->dev,"cannot create opl3 hwdep\n" ); - goto free_card; + }else { + err =snd_opl3_hwdep_new (opl3,0 ,1 ,NULL ); +if (err <0 ) { +dev_err (card->dev,"cannot create opl3 hwdep\n" ); + goto free_card; + } } }
sound/pci/ymfpci/ymfpci_main.c +49 -23
188 lines not on this page · raw message
Signature · 1 line
2.39.2
Re: [PATCH 5.10 137/173] ALSA: ymfpci: Fix assignment in if condition
Hi!
Quoted 5 lines
PCI YMFPCI driver code contains lots of assignments in if condition, which is a bad coding style that may confuse readers and occasionally lead to bugs.
This patch is merely for coding-style fixes, no functional changes.
I believe I see functional changes there.
sound/pci/ymfpci/ymfpci.c static int snd_card_ymfpci_probe(struct pci_dev *pci, · line 264
Quoted 10 lines
sound/pci/ymfpci/ymfpci.c +2
-3@@ -250,9 +259,8 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci,pci_read_config_word (pci,PCIR_DSXG_LEGACY , &old_legacy_ctrl);pci_write_config_word (pci,PCIR_DSXG_LEGACY , legacy_ctrl);pci_write_config_word (pci,PCIR_DSXG_ELEGACY , legacy_ctrl2); -if ((err =snd_ymfpci_create (card, pci, - old_legacy_ctrl, - &chip)) <0 ) { + err =snd_ymfpci_create (card, pci, old_legacy_ctrl, &chip); +if (err <0 ) {release_and_free_resource (mpu_res);
Whitespace could be fixed here.
sound/pci/ymfpci/ymfpci_main.c int snd_ymfpci_mixer(struct snd_ymfpci *chip, int rear_switch) · line 1832
Quoted 9 lines
sound/pci/ymfpci/ymfpci_main.c +3
-1@@ -1814,27 +1826,37 @@ int snd_ymfpci_mixer(struct snd_ymfpci *chip, int rear_switch)/* add S/PDIF control */ if (snd_BUG_ON (!chip->pcm_spdif))return -ENXIO ; -if ((err =snd_ctl_add (chip->card, kctl =snd_ctl_new1 (&snd_ymfpci_spdif_default, chip))) <0 ) + kctl =snd_ctl_new1 (&snd_ymfpci_spdif_default, chip); + err =snd_ctl_add (chip->card, kctl); +if (err <0 )return err;
Old code discarded err value and tested just kctl error. New code tests just err. I guess we should test both.
sound/pci/ymfpci/ymfpci_main.c int snd_ymfpci_mixer(struct snd_ymfpci *chip, int rear_switch) · line 1842
Quoted 12 lines
sound/pci/ymfpci/ymfpci_main.c +6
-2kctl->id.device = chip->pcm_spdif->device; -if ((err =snd_ctl_add (chip->card, kctl =snd_ctl_new1 (&snd_ymfpci_spdif_mask, chip))) <0 ) + kctl =snd_ctl_new1 (&snd_ymfpci_spdif_mask, chip); + err =snd_ctl_add (chip->card, kctl); +if (err <0 )return err; kctl->id.device = chip->pcm_spdif->device; -if ((err =snd_ctl_add (chip->card, kctl =snd_ctl_new1 (&snd_ymfpci_spdif_stream, chip))) <0 ) + kctl =snd_ctl_new1 (&snd_ymfpci_spdif_stream, chip); + err =snd_ctl_add (chip->card, kctl); +if (err <0 )return err;
Same here.
sound/pci/ymfpci/ymfpci_main.c int snd_ymfpci_mixer(struct snd_ymfpci *chip, int rear_switch) · line 1852
Quoted 11 lines
sound/pci/ymfpci/ymfpci_main.c +6
-3/* direct recording source */ -if (chip->device_id ==PCI_DEVICE_ID_YAMAHA_754 && - (err =snd_ctl_add (chip->card, kctl =snd_ctl_new1 (&snd_ymfpci_drec_source, chip))) <0 ) -return err; +if (chip->device_id ==PCI_DEVICE_ID_YAMAHA_754 ) { + kctl =snd_ctl_new1 (&snd_ymfpci_drec_source, chip); + err =snd_ctl_add (chip->card, kctl); +if (err <0 ) +return err; + }
And here.
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Erika Unter HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Re: [PATCH 5.10 137/173] ALSA: ymfpci: Fix assignment in if condition
Quoted 13 lines · Pavel Machek
sound/pci/ymfpci/ymfpci_main.c int snd_ymfpci_mixer(struct snd_ymfpci *chip, int rear_switch) · line 1832
Quoted 10 lines
sound/pci/ymfpci/ymfpci_main.c +3
-1@@ -1814,27 +1826,37 @@ int snd_ymfpci_mixer(struct snd_ymfpci *chip, int rear_switch)/* add S/PDIF control */ if (snd_BUG_ON (!chip->pcm_spdif))return -ENXIO ; -if ((err =snd_ctl_add (chip->card, kctl =snd_ctl_new1 (&snd_ymfpci_spdif_default, chip))) <0 ) + kctl =snd_ctl_new1 (&snd_ymfpci_spdif_default, chip); + err =snd_ctl_add (chip->card, kctl); +if (err <0 )return err;Old code discarded err value and tested just kctl error. New code tests just err. I guess we should test both.
In both cases, only the error from snd_ctl_add() is checked. And it's fine as designed; snd_ctl_add() returns -ENOMEM when NULL kctl is passed.
Takashi
Greg Kroah-Hartman
maintainerPATCH 138/173 ALSA: ymfpci: Fix BUG_ON in probe function
In reply to Greg Kroah-HartmanFrom: Tasos Sahanidis <[email protected]>
[ Upstream commit 6be2e7522eb529b41c16d459f33bbdbcddbf5c15 ]
The snd_dma_buffer.bytes field now contains the aligned size, which this snd_BUG_ON() did not account for, resulting in the following:
[ 9.625915] ------------[ cut here ]------------ [ 9.633440] WARNING: CPU: 0 PID: 126 at sound/pci/ymfpci/ymfpci_main.c:2168 snd_ymfpci_create+0x681/0x698 [snd_ymfpci] [ 9.648926] Modules linked in: snd_ymfpci(+) snd_intel_dspcfg kvm(+) snd_intel_sdw_acpi snd_ac97_codec snd_mpu401_uart snd_opl3_lib irqbypass snd_hda_codec gameport snd_rawmidi crct10dif_pclmul crc32_pclmul cfg80211 snd_hda_core polyval_clmulni polyval_generic gf128mul snd_seq_device ghash_clmulni_intel snd_hwdep ac97_bus sha512_ssse3 rfkill snd_pcm aesni_intel tg3 snd_timer crypto_simd snd mxm_wmi libphy cryptd k10temp fam15h_power pcspkr soundcore sp5100_tco wmi acpi_cpufreq mac_hid dm_multipath sg loop fuse dm_mod bpf_preload ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 sr_mod cdrom ata_generic pata_acpi firewire_ohci crc32c_intel firewire_core xhci_pci crc_itu_t pata_via xhci_pci_renesas floppy [ 9.711849] CPU: 0 PID: 126 Comm: kworker/0:2 Not tainted 6.1.21-1-lts #1 08d2e5ece03136efa7c6aeea9a9c40916b1bd8da [ 9.722200] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./990FX Extreme4, BIOS P2.70 06/05/2014 [ 9.732204] Workqueue: events work_for_cpu_fn [ 9.736580] RIP: 0010:snd_ymfpci_create+0x681/0x698 [snd_ymfpci] [ 9.742594] Code: 8c c0 4c 89 e2 48 89 df 48 c7 c6 92 c6 8c c0 e8 15 d0 e9 ff 48 83 c4 08 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f e9 d3 7a 33 e3 <0f> 0b e9 cb fd ff ff 41 bd fb ff ff ff eb db 41 bd f4 ff ff ff eb [ 9.761358] RSP: 0018:ffffab64804e7da0 EFLAGS: 00010287 [ 9.766594] RAX: ffff8fa2df06c400 RBX: ffff8fa3073a8000 RCX: ffff8fa303fbc4a8 [ 9.773734] RDX: ffff8fa2df06d000 RSI: 0000000000000010 RDI: 0000000000000020 [ 9.780876] RBP: ffff8fa300b5d0d0 R08: ffff8fa3073a8e50 R09: 00000000df06bf00 [ 9.788018] R10: ffff8fa2df06bf00 R11: 00000000df068200 R12: ffff8fa3073a8918 [ 9.795159] R13: 0000000000000000 R14: 0000000000000080 R15: ffff8fa2df068200 [ 9.802317] FS: 0000000000000000(0000) GS:ffff8fa9fec00000(0000) knlGS:0000000000000000 [ 9.810414] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 9.816158] CR2: 000055febaf66500 CR3: 0000000101a2e000 CR4: 00000000000406f0 [ 9.823301] Call Trace: [ 9.825747] <TASK> [ 9.827889] snd_card_ymfpci_probe+0x194/0x950 [snd_ymfpci b78a5fe64b5663a6390a909c67808567e3e73615] [ 9.837030] ? finish_task_switch.isra.0+0x90/0x2d0 [ 9.841918] local_pci_probe+0x45/0x80 [ 9.845680] work_for_cpu_fn+0x1a/0x30 [ 9.849431] process_one_work+0x1c7/0x380 [ 9.853464] worker_thread+0x1af/0x390 [ 9.857225] ? rescuer_thread+0x3b0/0x3b0 [ 9.861254] kthread+0xde/0x110 [ 9.864414] ? kthread_complete_and_exit+0x20/0x20 [ 9.869210] ret_from_fork+0x22/0x30 [ 9.872792] </TASK> [ 9.874985] ---[ end trace 0000000000000000 ]---
--- sound/pci/ymfpci/ymfpci_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/ymfpci/ymfpci_main.c +1 -1
@@ -2164,7 +2164,7 @@ static int snd_ymfpci_memalloc(struct snd_ymfpci *chip) chip->work_base = ptr; chip->work_base_addr = ptr_addr; -snd_BUG_ON (ptr + chip->work_size != +snd_BUG_ON (ptr +PAGE_ALIGN (chip->work_size) != chip->work_ptr.area + chip->work_ptr.bytes);snd_ymfpci_writel (chip,YDSXGR_PLAYCTRLBASE , chip->bank_base_playback_addr);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 139/173 net: ipa: compute DMA pool size properly
In reply to Greg Kroah-HartmanFrom: Alex Elder <[email protected]>
[ Upstream commit 6c75dc94f2b27fff57b305af9236eea181a00b6c ]
In gsi_trans_pool_init_dma(), the total size of a pool of memory used for DMA transactions is calculated. However the calculation is done incorrectly.
For 4KB pages, this total size is currently always more than one page, and as a result, the calculation produces a positive (though incorrect) total size. The code still works in this case; we just end up with fewer DMA pool entries than we intended.
Bjorn Andersson tested booting a kernel with 16KB pages, and hit a null pointer derereference in sg_alloc_append_table_from_pages(), descending from gsi_trans_pool_init_dma(). The cause of this was that a 16KB total size was going to be allocated, and with 16KB pages the order of that allocation is 0. The total_size calculation yielded 0, which eventually led to the crash.
Correcting the total_size calculation fixes the problem.
--- drivers/net/ipa/gsi_trans.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ipa/gsi_trans.c +1 -1
@@ -159,7 +159,7 @@ int gsi_trans_pool_init_dma(struct device *dev, struct gsi_trans_pool *pool,* gsi_trans_pool_exit_dma() can assume the total allocated * size is exactly (count * size). */ - total_size =get_order (total_size) <<PAGE_SHIFT ; + total_size =PAGE_SIZE <<get_order (total_size); virt =dma_alloc_coherent (dev, total_size, &addr,GFP_KERNEL );if (!virt)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 140/173 i40e: fix registers dump after run ethtool adapter self test
In reply to Greg Kroah-HartmanFrom: Radoslaw Tyl <[email protected]>
[ Upstream commit c5cff16f461a4a434a9915a7be7ac9ced861a8a4 ]
Fix invalid registers dump from ethtool -d ethX after adapter self test by ethtool -t ethY. It causes invalid data display.
The problem was caused by overwriting i40e_reg_list[].elements which is common for ethtool self test and dump.
--- drivers/net/ethernet/intel/i40e/i40e_diag.c | 11 ++++++----- drivers/net/ethernet/intel/i40e/i40e_diag.h | 2 +- 2 files changed, 7 insertions(+), 6 deletions(-)
drivers/net/ethernet/intel/i40e/i40e_diag.c +6 -5
@@ -44,7 +44,7 @@ static i40e_status i40e_diag_reg_pattern_test(struct i40e_hw *hw,return 0 ; } -struct i40e_diag_reg_test_info i40e_reg_list[] = { +const struct i40e_diag_reg_test_info i40e_reg_list[] = {/* offset mask elements stride */ {I40E_QTX_CTL (0 ),0x0000FFBF ,1 ,I40E_QTX_CTL (1 ) -I40E_QTX_CTL (0 )},
@@ -78,27 +78,28 @@ i40e_status i40e_diag_reg_test(struct i40e_hw *hw) {i40e_status ret_code =0 ;u32 reg, mask; +u32 elements;u32 i, j;for (i =0 ; i40e_reg_list[i].offset !=0 && !ret_code; i++) { + elements = i40e_reg_list[i].elements;/* set actual reg range for dynamically allocated resources */ if (i40e_reg_list[i].offset ==I40E_QTX_CTL (0 ) && hw->func_caps.num_tx_qp !=0 ) - i40e_reg_list[i].elements = hw->func_caps.num_tx_qp; + elements = hw->func_caps.num_tx_qp;if ((i40e_reg_list[i].offset ==I40E_PFINT_ITRN (0 ,0 ) || i40e_reg_list[i].offset ==I40E_PFINT_ITRN (1 ,0 ) || i40e_reg_list[i].offset ==I40E_PFINT_ITRN (2 ,0 ) || i40e_reg_list[i].offset ==I40E_QINT_TQCTL (0 ) || i40e_reg_list[i].offset ==I40E_QINT_RQCTL (0 )) && hw->func_caps.num_msix_vectors !=0 ) - i40e_reg_list[i].elements = - hw->func_caps.num_msix_vectors -1 ; + elements = hw->func_caps.num_msix_vectors -1 ;/* test register access */ mask = i40e_reg_list[i].mask; -for (j =0 ; j < i40e_reg_list[i].elements && !ret_code; j++) { +for (j =0 ; j < elements && !ret_code; j++) { reg = i40e_reg_list[i].offset + (j * i40e_reg_list[i].stride); ret_code =i40e_diag_reg_pattern_test (hw, reg, mask);
drivers/net/ethernet/intel/i40e/i40e_diag.h +1 -1
@@ -20,7 +20,7 @@ struct i40e_diag_reg_test_info {u32 stride;/* bytes between each element */ }; -extern struct i40e_diag_reg_test_info i40e_reg_list[]; +extern const struct i40e_diag_reg_test_info i40e_reg_list[];i40e_status i40e_diag_reg_test (struct i40e_hw *hw);i40e_status i40e_diag_eeprom_test (struct i40e_hw *hw);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 141/173 bnxt_en: Fix typo in PCI id to device description string mapping
In reply to Greg Kroah-HartmanFrom: Kalesh AP <[email protected]>
[ Upstream commit 62aad36ed31abc80f35db11e187e690448a79f7d ]
Fix 57502 and 57508 NPAR description string entries. The typos caused these devices to not match up with lspci output.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +4 -4
@@ -219,12 +219,12 @@ static const struct pci_device_id bnxt_pci_tbl[] = { { PCI_VDEVICE(BROADCOM, 0x1750), .driver_data = BCM57508 }, { PCI_VDEVICE(BROADCOM, 0x1751), .driver_data = BCM57504 }, { PCI_VDEVICE(BROADCOM, 0x1752), .driver_data = BCM57502 }, - { PCI_VDEVICE(BROADCOM, 0x1800), .driver_data = BCM57508_NPAR }, + { PCI_VDEVICE(BROADCOM, 0x1800), .driver_data = BCM57502_NPAR }, { PCI_VDEVICE(BROADCOM, 0x1801), .driver_data = BCM57504_NPAR }, - { PCI_VDEVICE(BROADCOM, 0x1802), .driver_data = BCM57502_NPAR }, - { PCI_VDEVICE(BROADCOM, 0x1803), .driver_data = BCM57508_NPAR }, + { PCI_VDEVICE(BROADCOM, 0x1802), .driver_data = BCM57508_NPAR }, + { PCI_VDEVICE(BROADCOM, 0x1803), .driver_data = BCM57502_NPAR }, { PCI_VDEVICE(BROADCOM, 0x1804), .driver_data = BCM57504_NPAR }, - { PCI_VDEVICE(BROADCOM, 0x1805), .driver_data = BCM57502_NPAR }, + { PCI_VDEVICE(BROADCOM, 0x1805), .driver_data = BCM57508_NPAR }, { PCI_VDEVICE(BROADCOM, 0xd802), .driver_data = BCM58802 }, { PCI_VDEVICE(BROADCOM, 0xd804), .driver_data = BCM58804 }, #ifdef CONFIG_BNXT_SRIOV
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 142/173 bnxt_en: Add missing 200G link speed reporting
In reply to Greg Kroah-HartmanFrom: Michael Chan <[email protected]>
[ Upstream commit 581bce7bcb7e7f100908728e7b292e266c76895b ]
bnxt_fw_to_ethtool_speed() is missing the case statement for 200G link speed reported by firmware. As a result, ethtool will report unknown speed when the firmware reports 200G link speed.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 ++ 2 files changed, 3 insertions(+)
drivers/net/ethernet/broadcom/bnxt/bnxt.h +1 -0
@@ -1198,6 +1198,7 @@ struct bnxt_link_info {#define BNXT_LINK_SPEED_40GB PORT_PHY_QCFG_RESP_LINK_SPEED_40GB#define BNXT_LINK_SPEED_50GB PORT_PHY_QCFG_RESP_LINK_SPEED_50GB#define BNXT_LINK_SPEED_100GB PORT_PHY_QCFG_RESP_LINK_SPEED_100GB +#define BNXT_LINK_SPEED_200GB PORT_PHY_QCFG_RESP_LINK_SPEED_200GBu16 support_speeds;u16 support_pam4_speeds;u16 auto_link_speeds;/* fw adv setting */
drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +2 -0
@@ -1653,6 +1653,8 @@ u32 bnxt_fw_to_ethtool_speed(u16 fw_link_speed)return SPEED_50000 ;case BNXT_LINK_SPEED_100GB :return SPEED_100000 ; +case BNXT_LINK_SPEED_200GB : +return SPEED_200000 ;default :return SPEED_UNKNOWN ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 143/173 net: dsa: mv88e6xxx: Enable IGMP snooping on user ports only
In reply to Greg Kroah-HartmanFrom: Steffen Bätz <[email protected]>
[ Upstream commit 7bcad0f0e6fbc1d613e49e0ee35c8e5f2e685bb0 ]
Do not set the MV88E6XXX_PORT_CTL0_IGMP_MLD_SNOOP bit on CPU or DSA ports.
This allows the host CPU port to be a regular IGMP listener by sending out IGMP Membership Reports, which would otherwise not be forwarded by the mv88exxx chip, but directly looped back to the CPU port itself.
--- drivers/net/dsa/mv88e6xxx/chip.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/net/dsa/mv88e6xxx/chip.c +7 -2
@@ -2611,9 +2611,14 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)* If this is the upstream port for this switch, enable * forwarding of unknown unicasts and multicasts. */ - reg =MV88E6XXX_PORT_CTL0_IGMP_MLD_SNOOP | -MV88E6185_PORT_CTL0_USE_TAG |MV88E6185_PORT_CTL0_USE_IP | + reg =MV88E6185_PORT_CTL0_USE_TAG |MV88E6185_PORT_CTL0_USE_IP |MV88E6XXX_PORT_CTL0_STATE_FORWARDING ; +/* Forward any IPv4 IGMP or IPv6 MLD frames received +* by a USER port to the CPU port to allow snooping. +*/ +if (dsa_is_user_port (ds, port)) + reg |=MV88E6XXX_PORT_CTL0_IGMP_MLD_SNOOP ; + err =mv88e6xxx_port_write (chip, port,MV88E6XXX_PORT_CTL0 , reg);if (err)return err;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 144/173 pinctrl: ocelot: Fix alt mode for ocelot
In reply to Greg Kroah-HartmanFrom: Horatiu Vultur <[email protected]>
[ Upstream commit 657fd9da2d4b4aa0a384105b236baa22fa0233bf ]
In case the driver was trying to set an alternate mode for gpio 0 or 32 then the mode was not set correctly. The reason is that there is computation error inside the function ocelot_pinmux_set_mux because in this case it was trying to shift to left by -1. Fix this by actually shifting the function bits and not the position.
--- drivers/pinctrl/pinctrl-ocelot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/pinctrl-ocelot.c +1 -1
@@ -575,7 +575,7 @@ static int ocelot_pinmux_set_mux(struct pinctrl_dev *pctldev,regmap_update_bits (info->map,REG_ALT (0 , info, pin->pin),BIT (p), f << p);regmap_update_bits (info->map,REG_ALT (1 , info, pin->pin), -BIT (p), f << (p -1 )); +BIT (p), (f >>1 ) << p);return 0 ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 145/173 Input: alps - fix compatibility with -funsigned-char
In reply to Greg Kroah-HartmanFrom: msizanoen <[email protected]>
commit 754ff5060daf5a1cf4474eff9b4edeb6c17ef7ab upstream.
The AlpsPS/2 code previously relied on the assumption that char is a signed type, which was true on x86 platforms (the only place where this driver is used) before kernel 6.2. However, on 6.2 and later, this assumption is broken due to the introduction of -funsigned-char as a new global compiler flag.
Fix this by explicitly specifying the signedness of char when sign extending the values received from the device.
--- drivers/input/mouse/alps.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/input/mouse/alps.c +8 -8
@@ -852,8 +852,8 @@ static void alps_process_packet_v6(struc x = y = z =0 ;/* Divide 4 since trackpoint's speed is too fast */ -input_report_rel (dev2,REL_X , (char )x /4 ); -input_report_rel (dev2,REL_Y , -((char )y /4 )); +input_report_rel (dev2,REL_X , (s8 )x /4 ); +input_report_rel (dev2,REL_Y , -((s8 )y /4 ));psmouse_report_standard_buttons (dev2, packet[3 ]);
@@ -1104,8 +1104,8 @@ static void alps_process_trackstick_pack ((packet[3 ] &0x20 ) <<1 ); z = (packet[5 ] &0x3f ) | ((packet[3 ] &0x80 ) >>1 ); -input_report_rel (dev2,REL_X , (char )x); -input_report_rel (dev2,REL_Y , -((char )y)); +input_report_rel (dev2,REL_X , (s8 )x); +input_report_rel (dev2,REL_Y , -((s8 )y));input_report_abs (dev2,ABS_PRESSURE , z);psmouse_report_standard_buttons (dev2, packet[1 ]);
@@ -2294,20 +2294,20 @@ static int alps_get_v3_v7_resolution(strif (reg <0 )return reg; - x_pitch = (char )(reg <<4 ) >>4 ;/* sign extend lower 4 bits */ + x_pitch = (s8)(reg <<4 ) >>4 ;/* sign extend lower 4 bits */ x_pitch =50 +2 * x_pitch;/* In 0.1 mm units */ - y_pitch = (char )reg >>4 ;/* sign extend upper 4 bits */ + y_pitch = (s8 )reg >>4 ;/* sign extend upper 4 bits */ y_pitch =36 +2 * y_pitch;/* In 0.1 mm units */ reg =alps_command_mode_read_reg (psmouse, reg_pitch +1 );if (reg <0 )return reg; - x_electrode = (char )(reg <<4 ) >>4 ;/* sign extend lower 4 bits */ + x_electrode = (s8)(reg <<4 ) >>4 ;/* sign extend lower 4 bits */ x_electrode =17 + x_electrode; - y_electrode = (char )reg >>4 ;/* sign extend upper 4 bits */ + y_electrode = (s8 )reg >>4 ;/* sign extend upper 4 bits */ y_electrode =13 + y_electrode; x_phys = x_pitch * (x_electrode -1 );/* In 0.1 mm units */
Greg Kroah-Hartman
maintainerPATCH 146/173 Input: focaltech - use explicitly signed char type
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
commit 8980f190947ba29f23110408e712444884b74251 upstream.
The recent change of -funsigned-char causes additions of negative numbers to become additions of large positive numbers, leading to wrong calculations of mouse movement. Change these casts to be explicitly signed, to take into account negative offsets.
--- drivers/input/mouse/focaltech.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/input/mouse/focaltech.c +4 -4
@@ -202,8 +202,8 @@ static void focaltech_process_rel_packet state->pressed = packet[0 ] >>7 ; finger1 = ((packet[0 ] >>4 ) &0x7 ) -1 ;if (finger1 <FOC_MAX_FINGERS ) { - state->fingers[finger1].x += (char )packet[1 ]; - state->fingers[finger1].y += (char )packet[2 ]; + state->fingers[finger1].x += (s8 )packet[1 ]; + state->fingers[finger1].y += (s8 )packet[2 ]; }else {psmouse_err (psmouse,"First finger in rel packet invalid: %d\n" , finger1);
@@ -218,8 +218,8 @@ static void focaltech_process_rel_packet*/ finger2 = ((packet[3 ] >>4 ) &0x7 ) -1 ;if (finger2 <FOC_MAX_FINGERS ) { - state->fingers[finger2].x += (char )packet[4 ]; - state->fingers[finger2].y += (char )packet[5 ]; + state->fingers[finger2].x += (s8 )packet[4 ]; + state->fingers[finger2].y += (s8 )packet[5 ]; } }
Greg Kroah-Hartman
maintainerPATCH 147/173 cifs: prevent infinite recursion in CIFSGetDFSRefer()
In reply to Greg Kroah-HartmanFrom: Paulo Alcantara <[email protected]>
commit 09ba47b44d26b475bbdf9c80db9e0193d2b58956 upstream.
We can't call smb_init() in CIFSGetDFSRefer() as cifs_reconnect_tcon() may end up calling CIFSGetDFSRefer() again to get new DFS referrals and thus causing an infinite recursion.
--- fs/cifs/cifssmb.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
fs/cifs/cifssmb.c +7 -2
@@ -4859,8 +4859,13 @@ CIFSGetDFSRefer(const unsigned int xid,return -ENODEV ; getDFSRetry: - rc =smb_init (SMB_COM_TRANSACTION2 ,15 , ses->tcon_ipc, (void **) &pSMB, - (void **) &pSMBr); +/* +* Use smb_init_no_reconnect() instead of smb_init() as +* CIFSGetDFSRefer() may be called from cifs_reconnect_tcon() and thus +* causing an infinite recursion. +*/ + rc =smb_init_no_reconnect (SMB_COM_TRANSACTION2 ,15 , ses->tcon_ipc, + (void **)&pSMB, (void **)&pSMBr);if (rc)return rc;
Greg Kroah-Hartman
maintainerPATCH 148/173 cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL
In reply to Greg Kroah-HartmanFrom: David Disseldorp <[email protected]>
commit 179a88a8558bbf42991d361595281f3e45d7edfc upstream.
When compiled with CONFIG_CIFS_DFS_UPCALL disabled, cifs_dfs_d_automount is NULL. cifs.ko logic for mapping CIFS_FATTR_DFS_REFERRAL attributes to S_AUTOMOUNT and corresponding dentry flags is retained regardless of CONFIG_CIFS_DFS_UPCALL, leading to a NULL pointer dereference in VFS follow_automount() when traversing a DFS referral link:
BUG: kernel NULL pointer dereference, address: 0000000000000000 ... Call Trace: <TASK> __traverse_mounts+0xb5/0x220 ? cifs_revalidate_mapping+0x65/0xc0 [cifs] step_into+0x195/0x610 ? lookup_fast+0xe2/0xf0 path_lookupat+0x64/0x140 filename_lookup+0xc2/0x140 ? __create_object+0x299/0x380 ? kmem_cache_alloc+0x119/0x220 ? user_path_at_empty+0x31/0x50 user_path_at_empty+0x31/0x50 __x64_sys_chdir+0x2a/0xd0 ? exit_to_user_mode_prepare+0xca/0x100 do_syscall_64+0x42/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc
This fix adds an inline cifs_dfs_d_automount() {return -EREMOTE} handler when CONFIG_CIFS_DFS_UPCALL is disabled. An alternative would be to avoid flagging S_AUTOMOUNT, etc. without CONFIG_CIFS_DFS_UPCALL. This approach was chosen as it provides more control over the error path.
--- fs/cifs/cifsfs.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/cifs/cifsfs.h +4 -1
@@ -126,7 +126,10 @@ extern const struct dentry_operations ci#ifdef CONFIG_CIFS_DFS_UPCALL extern struct vfsmount *cifs_dfs_d_automount (struct path *path);#else -#define cifs_dfs_d_automount NULL +static inline struct vfsmount *cifs_dfs_d_automount (struct path *path) +{ +return ERR_PTR (-EREMOTE ); +}#endif /* Functions related to symlinks */
Greg Kroah-Hartman
maintainerPATCH 149/173 Input: goodix - add Lenovo Yoga Book X90F to nine_bytes_report DMI table
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 8a0432bab6ea3203d220785da7ab3c7677f70ecb upstream.
The Android Lenovo Yoga Book X90F / X90L uses the same goodix touchscreen with 9 bytes touch reports for its touch keyboard as the already supported Windows Lenovo Yoga Book X91F/L, add a DMI match for this to the nine_bytes_report DMI table.
When the quirk for the X91F/L was initially added it was written to also apply to the X90F/L but this does not work because the Android version of the Yoga Book uses completely different DMI strings. Also adjust the X91F/L quirk to reflect that it only applies to the X91F/L models.
--- drivers/input/touchscreen/goodix.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/input/touchscreen/goodix.c +11 -3
@@ -183,10 +183,18 @@ static const unsigned long goodix_irq_flstatic const struct dmi_system_id nine_bytes_report[] = { #if defined(CONFIG_DMI) && defined(CONFIG_X86) { - .ident ="Lenovo YogaBook" , -/* YB1-X91L/F and YB1-X90L/F */ +/* Lenovo Yoga Book X90F / X90L */ .matches = { -DMI_MATCH (DMI_PRODUCT_NAME ,"Lenovo YB1-X9" ) +DMI_EXACT_MATCH (DMI_SYS_VENDOR ,"Intel Corporation" ), +DMI_EXACT_MATCH (DMI_PRODUCT_NAME ,"CHERRYVIEW D1 PLATFORM" ), +DMI_EXACT_MATCH (DMI_PRODUCT_VERSION ,"YETI-11" ), + } + }, + { +/* Lenovo Yoga Book X91F / X91L */ + .matches = { +/* Non exact match to match F + L versions */ +DMI_MATCH (DMI_PRODUCT_NAME ,"Lenovo YB1-X91" ), } }, #endif
Greg Kroah-Hartman
maintainerPATCH 150/173 btrfs: fix race between quota disable and quota assign ioctls
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 2f1a6be12ab6c8470d5776e68644726c94257c54 upstream.
The quota assign ioctl can currently run in parallel with a quota disable ioctl call. The assign ioctl uses the quota root, while the disable ioctl frees that root, and therefore we can have a use-after-free triggered in the assign ioctl, leading to a trace like the following when KASAN is enabled:
[672.723][T736] BUG: KASAN: slab-use-after-free in btrfs_search_slot+0x2962/0x2db0 [672.723][T736] Read of size 8 at addr ffff888022ec0208 by task btrfs_search_sl/27736 [672.724][T736] [672.725][T736] CPU: 1 PID: 27736 Comm: btrfs_search_sl Not tainted 6.3.0-rc3 #37 [672.723][T736] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [672.727][T736] Call Trace: [672.728][T736] <TASK> [672.728][T736] dump_stack_lvl+0xd9/0x150 [672.725][T736] print_report+0xc1/0x5e0 [672.720][T736] ? __virt_addr_valid+0x61/0x2e0 [672.727][T736] ? __phys_addr+0xc9/0x150 [672.725][T736] ? btrfs_search_slot+0x2962/0x2db0 [672.722][T736] kasan_report+0xc0/0xf0 [672.729][T736] ? btrfs_search_slot+0x2962/0x2db0 [672.724][T736] btrfs_search_slot+0x2962/0x2db0 [672.723][T736] ? fs_reclaim_acquire+0xba/0x160 [672.722][T736] ? split_leaf+0x13d0/0x13d0 [672.726][T736] ? rcu_is_watching+0x12/0xb0 [672.723][T736] ? kmem_cache_alloc+0x338/0x3c0 [672.722][T736] update_qgroup_status_item+0xf7/0x320 [672.724][T736] ? add_qgroup_rb+0x3d0/0x3d0 [672.739][T736] ? do_raw_spin_lock+0x12d/0x2b0 [672.730][T736] ? spin_bug+0x1d0/0x1d0 [672.737][T736] btrfs_run_qgroups+0x5de/0x840 [672.730][T736] ? btrfs_qgroup_rescan_worker+0xa70/0xa70 [672.738][T736] ? __del_qgroup_relation+0x4ba/0xe00 [672.738][T736] btrfs_ioctl+0x3d58/0x5d80 [672.735][T736] ? tomoyo_path_number_perm+0x16a/0x550 [672.737][T736] ? tomoyo_execute_permission+0x4a0/0x4a0 [672.731][T736] ? btrfs_ioctl_get_supported_features+0x50/0x50 [672.737][T736] ? __sanitizer_cov_trace_switch+0x54/0x90 [672.734][T736] ? do_vfs_ioctl+0x132/0x1660 [672.730][T736] ? vfs_fileattr_set+0xc40/0xc40 [672.730][T736] ? _raw_spin_unlock_irq+0x2e/0x50 [672.732][T736] ? sigprocmask+0xf2/0x340 [672.737][T736] ? __fget_files+0x26a/0x480 [672.732][T736] ? bpf_lsm_file_ioctl+0x9/0x10 [672.738][T736] ? btrfs_ioctl_get_supported_features+0x50/0x50 [672.736][T736] __x64_sys_ioctl+0x198/0x210 [672.736][T736] do_syscall_64+0x39/0xb0 [672.731][T736] entry_SYSCALL_64_after_hwframe+0x63/0xcd [672.739][T736] RIP: 0033:0x4556ad [672.742][T736] </TASK> [672.743][T736] [672.748][T736] Allocated by task 27677: [672.743][T736] kasan_save_stack+0x22/0x40 [672.741][T736] kasan_set_track+0x25/0x30 [672.741][T736] __kasan_kmalloc+0xa4/0xb0 [672.749][T736] btrfs_alloc_root+0x48/0x90 [672.746][T736] btrfs_create_tree+0x146/0xa20 [672.744][T736] btrfs_quota_enable+0x461/0x1d20 [672.743][T736] btrfs_ioctl+0x4a1c/0x5d80 [672.747][T736] __x64_sys_ioctl+0x198/0x210 [672.749][T736] do_syscall_64+0x39/0xb0 [672.744][T736] entry_SYSCALL_64_after_hwframe+0x63/0xcd [672.756][T736] [672.757][T736] Freed by task 27677: [672.759][T736] kasan_save_stack+0x22/0x40 [672.759][T736] kasan_set_track+0x25/0x30 [672.756][T736] kasan_save_free_info+0x2e/0x50 [672.751][T736] ____kasan_slab_free+0x162/0x1c0 [672.758][T736] slab_free_freelist_hook+0x89/0x1c0 [672.752][T736] __kmem_cache_free+0xaf/0x2e0 [672.752][T736] btrfs_put_root+0x1ff/0x2b0 [672.759][T736] btrfs_quota_disable+0x80a/0xbc0 [672.752][T736] btrfs_ioctl+0x3e5f/0x5d80 [672.756][T736] __x64_sys_ioctl+0x198/0x210 [672.753][T736] do_syscall_64+0x39/0xb0 [672.765][T736] entry_SYSCALL_64_after_hwframe+0x63/0xcd [672.769][T736] [672.768][T736] The buggy address belongs to the object at ffff888022ec0000 [672.768][T736] which belongs to the cache kmalloc-4k of size 4096 [672.769][T736] The buggy address is located 520 bytes inside of [672.769][T736] freed 4096-byte region [ffff888022ec0000, ffff888022ec1000) [672.760][T736] [672.764][T736] The buggy address belongs to the physical page: [672.761][T736] page:ffffea00008bb000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x22ec0 [672.766][T736] head:ffffea00008bb000 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [672.779][T736] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [672.770][T736] raw: 00fff00000010200 ffff888012842140 ffffea000054ba00 dead000000000002 [672.770][T736] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [672.771][T736] page dumped because: kasan: bad access detected [672.778][T736] page_owner tracks the page as allocated [672.777][T736] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 88 [672.779][T736] get_page_from_freelist+0x119c/0x2d50 [672.779][T736] __alloc_pages+0x1cb/0x4a0 [672.776][T736] alloc_pages+0x1aa/0x270 [672.773][T736] allocate_slab+0x260/0x390 [672.771][T736] ___slab_alloc+0xa9a/0x13e0 [672.778][T736] __slab_alloc.constprop.0+0x56/0xb0 [672.771][T736] __kmem_cache_alloc_node+0x136/0x320 [672.789][T736] __kmalloc+0x4e/0x1a0 [672.783][T736] tomoyo_realpath_from_path+0xc3/0x600 [672.781][T736] tomoyo_path_perm+0x22f/0x420 [672.782][T736] tomoyo_path_unlink+0x92/0xd0 [672.780][T736] security_path_unlink+0xdb/0x150 [672.788][T736] do_unlinkat+0x377/0x680 [672.788][T736] __x64_sys_unlink+0xca/0x110 [672.789][T736] do_syscall_64+0x39/0xb0 [672.783][T736] entry_SYSCALL_64_after_hwframe+0x63/0xcd [672.784][T736] page last free stack trace: [672.787][T736] free_pcp_prepare+0x4e5/0x920 [672.787][T736] free_unref_page+0x1d/0x4e0 [672.784][T736] __unfreeze_partials+0x17c/0x1a0 [672.797][T736] qlist_free_all+0x6a/0x180 [672.796][T736] kasan_quarantine_reduce+0x189/0x1d0 [672.797][T736] __kasan_slab_alloc+0x64/0x90 [672.793][T736] kmem_cache_alloc+0x17c/0x3c0 [672.799][T736] getname_flags.part.0+0x50/0x4e0 [672.799][T736] getname_flags+0x9e/0xe0 [672.792][T736] vfs_fstatat+0x77/0xb0 [672.791][T736] __do_sys_newlstat+0x84/0x100 [672.798][T736] do_syscall_64+0x39/0xb0 [672.796][T736] entry_SYSCALL_64_after_hwframe+0x63/0xcd [672.790][T736] [672.791][T736] Memory state around the buggy address: [672.799][T736] ffff888022ec0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [672.805][T736] ffff888022ec0180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [672.802][T736] >ffff888022ec0200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [672.809][T736] ^ [672.809][T736] ffff888022ec0280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [672.809][T736] ffff888022ec0300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
Fix this by having the qgroup assign ioctl take the qgroup ioctl mutex before calling btrfs_run_qgroups(), which is what all qgroup ioctls should call.
--- fs/btrfs/ioctl.c | 2 ++ fs/btrfs/qgroup.c | 11 ++++++++++- 2 files changed, 12 insertions(+), 1 deletion(-)
fs/btrfs/ioctl.c +2 -0
@@ -4254,7 +4254,9 @@ static long btrfs_ioctl_qgroup_assign(st }/* update qgroup status and info */ +mutex_lock (&fs_info->qgroup_ioctl_lock); err =btrfs_run_qgroups (trans); +mutex_unlock (&fs_info->qgroup_ioctl_lock);if (err <0 )btrfs_handle_fs_error (fs_info, err,"failed to update qgroup status and info" );
fs/btrfs/qgroup.c +10 -1
@@ -2762,13 +2762,22 @@ cleanup: }/* -* called from commit_transaction. Writes all changed qgroups to disk. +* Writes all changed qgroups to disk. +* Called by the transaction commit path and the qgroup assign ioctl. */ int btrfs_run_qgroups (struct btrfs_trans_handle *trans) {struct btrfs_fs_info *fs_info = trans->fs_info;int ret =0 ; +/* +* In case we are called from the qgroup assign ioctl, assert that we +* are holding the qgroup_ioctl_lock, otherwise we can race with a quota +* disable operation (ioctl) and access a freed quota root. +*/ +if (trans->transaction->state !=TRANS_STATE_COMMIT_DOING ) +lockdep_assert_held (&fs_info->qgroup_ioctl_lock); +if (!fs_info->quota_root)return ret;
Greg Kroah-Hartman
maintainerPATCH 151/173 xen/netback: dont do grant copy across page boundary
In reply to Greg Kroah-HartmanFrom: Juergen Gross <[email protected]>
commit 05310f31ca74673a96567fb14637b7d5d6c82ea5 upstream.
Fix xenvif_get_requests() not to do grant copy operations across local page boundaries. This requires to double the maximum number of copy operations per queue, as each copy could now be split into 2.
Make sure that struct xenvif_tx_cb doesn't grow too large.
--- drivers/net/xen-netback/common.h | 2 +- drivers/net/xen-netback/netback.c | 25 +++++++++++++++++++++++-- 2 files changed, 24 insertions(+), 3 deletions(-)
drivers/net/xen-netback/common.h +1 -1
@@ -166,7 +166,7 @@ struct xenvif_queue { /* Per-queue datastruct pending_tx_info pending_tx_info[MAX_PENDING_REQS ];grant_handle_t grant_tx_handle[MAX_PENDING_REQS ]; -struct gnttab_copy tx_copy_ops[MAX_PENDING_REQS ]; +struct gnttab_copy tx_copy_ops[2 *MAX_PENDING_REQS ];struct gnttab_map_grant_ref tx_map_ops[MAX_PENDING_REQS ];struct gnttab_unmap_grant_ref tx_unmap_ops[MAX_PENDING_REQS ];/* passed to gnttab_[un]map_refs with pages under (un)mapping */
drivers/net/xen-netback/netback.c +23 -2
@@ -334,6 +334,7 @@ static int xenvif_count_requests(structstruct xenvif_tx_cb {u16 copy_pending_idx[XEN_NETBK_LEGACY_SLOTS_MAX +1 ];u8 copy_count; +u32 split_mask; };#define XENVIF_TX_CB (skb) ((struct xenvif_tx_cb *)(skb)->cb)
@@ -361,6 +362,8 @@ static inline struct sk_buff *xenvif_allstruct sk_buff *skb =alloc_skb (size +NET_SKB_PAD +NET_IP_ALIGN ,GFP_ATOMIC | __GFP_NOWARN); + +BUILD_BUG_ON (sizeof (*XENVIF_TX_CB (skb)) >sizeof (skb->cb));if (unlikely (skb ==NULL ))return NULL ;
@@ -396,11 +399,13 @@ static void xenvif_get_requests(struct x nr_slots = shinfo->nr_frags +1 ;copy_count (skb) =0 ; +XENVIF_TX_CB (skb)->split_mask =0 ;/* Create copy ops for exactly data_len bytes into the skb head. */ __skb_put (skb, data_len);while (data_len >0 ) {int amount = data_len > txp->size ? txp->size : data_len; +bool split = false; cop->source.u.ref = txp->gref; cop->source.domid = queue->vif->domid;
@@ -413,6 +418,13 @@ static void xenvif_get_requests(struct x cop->dest.u.gmfn =virt_to_gfn (skb->data +skb_headlen (skb) - data_len); +/* Don't cross local page boundary! */ +if (cop->dest.offset + amount >XEN_PAGE_SIZE ) { + amount =XEN_PAGE_SIZE - cop->dest.offset; +XENVIF_TX_CB (skb)->split_mask |=1U <<copy_count (skb); + split = true; + } + cop->len = amount; cop->flags = GNTCOPY_source_gref;
@@ -420,7 +432,8 @@ static void xenvif_get_requests(struct x pending_idx = queue->pending_ring[index];callback_param (queue, pending_idx).ctx =NULL ;copy_pending_idx (skb,copy_count (skb)) = pending_idx; -copy_count (skb)++; +if (!split) +copy_count (skb)++; cop++; data_len -= amount;
@@ -441,7 +454,8 @@ static void xenvif_get_requests(struct x nr_slots--; }else {/* The copy op partially covered the tx_request. -* The remainder will be mapped. +* The remainder will be mapped or copied in the next +* iteration. */ txp->offset += amount; txp->size -= amount;
@@ -539,6 +553,13 @@ static int xenvif_tx_check_gop(struct xe pending_idx =copy_pending_idx (skb, i); newerr = (*gopp_copy)->status; + +/* Split copies need to be handled together. */ +if (XENVIF_TX_CB (skb)->split_mask & (1U << i)) { + (*gopp_copy)++; +if (!newerr) + newerr = (*gopp_copy)->status; + }if (likely (!newerr)) {/* The first frag might still have this slot mapped */ if (i <copy_count (skb) -1 || !sharedslot)
Greg Kroah-Hartman
maintainerPATCH 152/173 net: phy: dp83869: fix default value for tx-/rx-internal-delay
In reply to Greg Kroah-HartmanFrom: Josua Mayer <[email protected]>
commit 82e2c39f9ef78896e9b634dfd82dc042e6956bb7 upstream.
dp83869 internally uses a look-up table for mapping supported delays in nanoseconds to register values.
When specific delays are defined in device-tree, phy_get_internal_delay does the lookup automatically returning an index.
The default case wrongly assigns the nanoseconds value from the lookup table, resulting in numeric value 2000 applied to delay configuration register, rather than the expected index values 0-7 (7 for 2000). Ultimately this issue broke RX for 1Gbps links.
Fix default delay configuration by assigning the intended index value directly.
--- drivers/net/phy/dp83869.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/phy/dp83869.c +2 -4
@@ -553,15 +553,13 @@ static int dp83869_of_init(struct phy_de &dp83869_internal_delay[0 ], delay_size, true);if (dp83869->rx_int_delay <0 ) - dp83869->rx_int_delay = - dp83869_internal_delay[DP83869_CLK_DELAY_DEF ]; + dp83869->rx_int_delay =DP83869_CLK_DELAY_DEF ; dp83869->tx_int_delay =phy_get_internal_delay (phydev, dev, &dp83869_internal_delay[0 ], delay_size, false);if (dp83869->tx_int_delay <0 ) - dp83869->tx_int_delay = - dp83869_internal_delay[DP83869_CLK_DELAY_DEF ]; + dp83869->tx_int_delay =DP83869_CLK_DELAY_DEF ;return ret; }
Greg Kroah-Hartman
maintainerPATCH 153/173 pinctrl: amd: Disable and mask interrupts on resume
In reply to Greg Kroah-HartmanFrom: Kornel Dulęba <[email protected]>
commit b26cd9325be4c1fcd331b77f10acb627c560d4d7 upstream.
This fixes a similar problem to the one observed in:
commit 4e5a04be88fe ("pinctrl: amd: disable and mask interrupts on probe").
On some systems, during suspend/resume cycle firmware leaves an interrupt enabled on a pin that is not used by the kernel. This confuses the AMD pinctrl driver and causes spurious interrupts.
The driver already has logic to detect if a pin is used by the kernel. Leverage it to re-initialize interrupt fields of a pin only if it's not used by us.
--- drivers/pinctrl/pinctrl-amd.c | 36 ++++++++++++++++++++---------------- 1 file changed, 20 insertions(+), 16 deletions(-)
drivers/pinctrl/pinctrl-amd.c +20 -16
@@ -764,32 +764,34 @@ static const struct pinconf_ops amd_pinc .pin_config_group_set = amd_pinconf_group_set, }; -static void amd_gpio_irq_init (struct amd_gpio *gpio_dev) +static void amd_gpio_irq_init_pin (struct amd_gpio *gpio_dev,int pin) { -struct pinctrl_desc *desc = gpio_dev->pctrl->desc; +const struct pin_desc *pd;unsigned long flags;u32 pin_reg, mask; -int i; mask =BIT (WAKE_CNTRL_OFF_S0I3 ) |BIT (WAKE_CNTRL_OFF_S3 ) |BIT (INTERRUPT_MASK_OFF ) |BIT (INTERRUPT_ENABLE_OFF ) |BIT (WAKE_CNTRL_OFF_S4 ); -for (i =0 ; i < desc->npins; i++) { -int pin = desc->pins[i].number; -const struct pin_desc *pd =pin_desc_get (gpio_dev->pctrl, pin); - -if (!pd) -continue ; + pd =pin_desc_get (gpio_dev->pctrl, pin); +if (!pd) +return ; -raw_spin_lock_irqsave (&gpio_dev->lock, flags); +raw_spin_lock_irqsave (&gpio_dev->lock, flags); + pin_reg =readl (gpio_dev->base + pin *4 ); + pin_reg &= ~mask; +writel (pin_reg, gpio_dev->base + pin *4 ); +raw_spin_unlock_irqrestore (&gpio_dev->lock, flags); +} - pin_reg =readl (gpio_dev->base + i *4 ); - pin_reg &= ~mask; -writel (pin_reg, gpio_dev->base + i *4 ); +static void amd_gpio_irq_init (struct amd_gpio *gpio_dev) +{ +struct pinctrl_desc *desc = gpio_dev->pctrl->desc; +int i; -raw_spin_unlock_irqrestore (&gpio_dev->lock, flags); - } +for (i =0 ; i < desc->npins; i++) +amd_gpio_irq_init_pin (gpio_dev, i); }#ifdef CONFIG_PM_SLEEP
@@ -842,8 +844,10 @@ static int amd_gpio_resume(struct devicefor (i =0 ; i < desc->npins; i++) {int pin = desc->pins[i].number; -if (!amd_gpio_should_save (gpio_dev, pin)) +if (!amd_gpio_should_save (gpio_dev, pin)) { +amd_gpio_irq_init_pin (gpio_dev, pin);continue ; + }raw_spin_lock_irqsave (&gpio_dev->lock, flags); gpio_dev->saved_regs[i] |=readl (gpio_dev->base + pin *4 ) &PIN_IRQ_PENDING ;
Greg Kroah-Hartman
maintainerPATCH 154/173 pinctrl: at91-pio4: fix domain name assignment
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 7bb97e360acdd38b68ad0a1defb89c6e89c85596 upstream.
Since commit d59f6617eef0 ("genirq: Allow fwnode to carry name information only") an IRQ domain is always given a name during allocation (e.g. used for the debugfs entry).
Drop the no longer valid name assignment, which would lead to an attempt to free a string constant when removing the domain on late probe failures (e.g. probe deferral).
--- drivers/pinctrl/pinctrl-at91-pio4.c | 1 - 1 file changed, 1 deletion(-)
drivers/pinctrl/pinctrl-at91-pio4.c +0 -1
@@ -1139,7 +1139,6 @@ static int atmel_pinctrl_probe(struct pldev_err (dev,"can't add the irq domain\n" );return -ENODEV ; } - atmel_pioctrl->irq_domain->name ="atmel gpio" ;for (i =0 ; i < atmel_pioctrl->npins; i++) {int irq =irq_create_mapping (atmel_pioctrl->irq_domain, i);
Greg Kroah-Hartman
maintainerPATCH 155/173 powerpc: Dont try to copy PPR for task with NULL pt_regs
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
commit fd7276189450110ed835eb0a334e62d2f1c4e3be upstream.
powerpc sets up PF_KTHREAD and PF_IO_WORKER with a NULL pt_regs, which from my (arguably very short) checking is not commonly done for other archs. This is fine, except when PF_IO_WORKER's have been created and the task does something that causes a coredump to be generated. Then we get this crash:
Kernel attempted to read user page (160) - exploit attempt? (uid: 1000)
BUG: Kernel NULL pointer dereference on read at 0x00000160
Faulting instruction address: 0xc0000000000c3a60
Oops: Kernel access of bad area, sig: 11 [#1]
LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=32 NUMA pSeries
Modules linked in: bochs drm_vram_helper drm_kms_helper xts binfmt_misc ecb ctr syscopyarea sysfillrect cbc sysimgblt drm_ttm_helper aes_generic ttm sg libaes evdev joydev virtio_balloon vmx_crypto gf128mul drm dm_mod fuse loop configfs drm_panel_orientation_quirks ip_tables x_tables autofs4 hid_generic usbhid hid xhci_pci xhci_hcd usbcore usb_common sd_mod
CPU: 1 PID: 1982 Comm: ppc-crash Not tainted 6.3.0-rc2+ #88
Hardware name: IBM pSeries (emulated by qemu) POWER9 (raw) 0x4e1202 0xf000005 of:SLOF,HEAD hv:linux,kvm pSeries
NIP: c0000000000c3a60 LR: c000000000039944 CTR: c0000000000398e0
REGS: c0000000041833b0 TRAP: 0300 Not tainted (6.3.0-rc2+)
MSR: 800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 88082828 XER: 200400f8
...
NIP memcpy_power7+0x200/0x7d0
LR ppr_get+0x64/0xb0
Call Trace:
ppr_get+0x40/0xb0 (unreliable)
__regset_get+0x180/0x1f0
regset_get_alloc+0x64/0x90
elf_core_dump+0xb98/0x1b60
do_coredump+0x1c34/0x24a0
get_signal+0x71c/0x1410
do_notify_resume+0x140/0x6f0
interrupt_exit_user_prepare_main+0x29c/0x320
interrupt_exit_user_prepare+0x6c/0xa0
interrupt_return_srr_user+0x8/0x138Because ppr_get() is trying to copy from a PF_IO_WORKER with a NULL pt_regs.
Check for a valid pt_regs in both ppc_get/ppr_set, and return an error if not set. The actual error value doesn't seem to be important here, so just pick -EINVAL.
--- arch/powerpc/kernel/ptrace/ptrace-view.c | 6 ++++++ 1 file changed, 6 insertions(+)
arch/powerpc/kernel/ptrace/ptrace-view.c +6 -0
@@ -298,6 +298,9 @@ static int gpr_set(struct task_struct *tstatic int ppr_get (struct task_struct *target,const struct user_regset *regset,struct membuf to) { +if (!target->thread.regs) +return -EINVAL ; +return membuf_write (&to, &target->thread.regs->ppr,sizeof (u64)); }
@@ -305,6 +308,9 @@ static int ppr_set(struct task_struct *t unsigned int pos, unsigned int count, const void *kbuf, const void __user *ubuf) { + if (!target->thread.regs) + return -EINVAL; + return user_regset_copyin(&pos, &count, &kbuf, &ubuf, &target->thread.regs->ppr, 0, sizeof(u64)); }
Greg Kroah-Hartman
maintainerPATCH 156/173 NFSv4: Fix hangs when recovering open state after a server reboot
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
commit 6165a16a5ad9b237bb3131cff4d3c601ccb8f9a3 upstream.
When we're using a cached open stateid or a delegation in order to avoid sending a CLAIM_PREVIOUS open RPC call to the server, we don't have a new open stateid to present to update_open_stateid(). Instead rely on nfs4_try_open_cached(), just as if we were doing a normal open.
--- fs/nfs/nfs4proc.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
fs/nfs/nfs4proc.c +2 -3
@@ -1975,8 +1975,7 @@ _nfs4_opendata_reclaim_to_nfs4_state(strif (!data->rpc_done) {if (data->rpc_status)return ERR_PTR (data->rpc_status); -/* cached opens have already been processed */ - goto update; +return nfs4_try_open_cached (data); } ret =nfs_refresh_inode (inode, &data->f_attr);
@@ -1985,7 +1984,7 @@ _nfs4_opendata_reclaim_to_nfs4_state(strif (data->o_res.delegation_type !=0 )nfs4_opendata_check_deleg (data, state); -update: +if (!update_open_stateid (state, &data->o_res.stateid,NULL , data->o_arg.fmode))return ERR_PTR (-EAGAIN );
Greg Kroah-Hartman
maintainerPATCH 157/173 ALSA: hda/conexant: Partial revert of a quirk for Lenovo
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit b871cb971c683f7f212e7ca3c9a6709a75785116 upstream.
The recent commit f83bb2592482 ("ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model") introduced a quirk for the device with 17aa:3977, but this caused a regression on another model (Lenovo Ideadpad U31) with the very same PCI SSID. And, through skimming over the net, it seems that this PCI SSID is used for multiple different models, so it's no good idea to apply the quirk with the SSID.
Although we may take a different ID check (e.g. the codec SSID instead of the PCI SSID), unfortunately, the original patch author couldn't identify the hardware details any longer as the machine was returned, and we can't develop the further proper fix.
In this patch, instead, we partially revert the change so that the quirk won't be applied as default for addressing the regression. Meanwhile, the quirk function itself is kept, and it's now made to be applicable via the explicit model=lenovo-20149 option.
--- sound/pci/hda/patch_conexant.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
sound/pci/hda/patch_conexant.c +5 -1
@@ -973,7 +973,10 @@ static const struct snd_pci_quirk cxt506SND_PCI_QUIRK (0x17aa ,0x3905 ,"Lenovo G50-30" ,CXT_FIXUP_STEREO_DMIC ),SND_PCI_QUIRK (0x17aa ,0x390b ,"Lenovo G50-80" ,CXT_FIXUP_STEREO_DMIC ),SND_PCI_QUIRK (0x17aa ,0x3975 ,"Lenovo U300s" ,CXT_FIXUP_STEREO_DMIC ), -SND_PCI_QUIRK (0x17aa ,0x3977 ,"Lenovo IdeaPad U310" ,CXT_PINCFG_LENOVO_NOTEBOOK ), +/* NOTE: we'd need to extend the quirk for 17aa:3977 as the same +* PCI SSID is used on multiple Lenovo models +*/ +SND_PCI_QUIRK (0x17aa ,0x3977 ,"Lenovo IdeaPad U310" ,CXT_FIXUP_STEREO_DMIC ),SND_PCI_QUIRK (0x17aa ,0x3978 ,"Lenovo G50-70" ,CXT_FIXUP_STEREO_DMIC ),SND_PCI_QUIRK (0x17aa ,0x397b ,"Lenovo S205" ,CXT_FIXUP_STEREO_DMIC ), SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad", CXT_FIXUP_THINKPAD_ACPI),
@@ -996,6 +999,7 @@ static const struct hda_model_fixup cxt5 { .id = CXT_FIXUP_MUTE_LED_GPIO, .name = "mute-led-gpio" }, { .id = CXT_FIXUP_HP_ZBOOK_MUTE_LED, .name = "hp-zbook-mute-led" }, { .id = CXT_FIXUP_HP_MIC_NO_PRESENCE, .name = "hp-mic-fix" }, + { .id = CXT_PINCFG_LENOVO_NOTEBOOK, .name = "lenovo-20149" }, {} };
Greg Kroah-Hartman
maintainerPATCH 158/173 ALSA: usb-audio: Fix regression on detection of Roland VS-100
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit fa4e7a6fa12b1132340785e14bd439cbe95b7a5a upstream.
It's been reported that the recent kernel can't probe the PCM devices on Roland VS-100 properly, and it turned out to be a regression by the recent addition of the bit shift range check for the format bits. In the old code, we just did bit-shift and it resulted in zero, which is then corrected to the standard PCM format, while the new code explicitly returns an error in such a case.
For addressing the regression, relax the check and fallback to the standard PCM type (with the info output).
--- sound/usb/format.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
sound/usb/format.c +6 -2
@@ -40,8 +40,12 @@ static u64 parse_audio_format_i_type(strcase UAC_VERSION_1 :default : {struct uac_format_type_i_discrete_descriptor *fmt = _fmt; -if (format >=64 ) -return 0 ;/* invalid format */ +if (format >=64 ) { +usb_audio_info (chip, +"%u:%d: invalid format type 0x%llx is detected, processed as PCM\n" , + fp->iface, fp->altsetting, format); + format =UAC_FORMAT_TYPE_I_PCM ; + } sample_width = fmt->bBitResolution; sample_bytes = fmt->bSubframeSize; format =1ULL << format;
Greg Kroah-Hartman
maintainerPATCH 159/173 ALSA: hda/realtek: Add quirk for Lenovo ZhaoYang CF4620Z
In reply to Greg Kroah-HartmanFrom: huangwenhui <[email protected]>
commit 52aad39385e1bfdb34a1b405f699a8ef302c58b0 upstream.
Fix headset microphone detection on Lenovo ZhaoYang CF4620Z.
[ adjusted to be applicable to the latest tree -- tiwai ]
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -9253,6 +9253,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x17aa ,0x511e ,"Thinkpad" ,ALC298_FIXUP_TPT470_DOCK ),SND_PCI_QUIRK (0x17aa ,0x511f ,"Thinkpad" ,ALC298_FIXUP_TPT470_DOCK ),SND_PCI_QUIRK (0x17aa ,0x9e54 ,"LENOVO NB" ,ALC269_FIXUP_LENOVO_EAPD ), +SND_PCI_QUIRK (0x17aa ,0x9e56 ,"Lenovo ZhaoYang CF4620Z" ,ALC286_FIXUP_SONY_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1849 ,0x1233 ,"ASRock NUC Box 1100" ,ALC233_FIXUP_NO_AUDIO_JACK ),SND_PCI_QUIRK (0x1849 ,0xa233 ,"Positivo Master C6300" ,ALC269_FIXUP_HEADSET_MIC ), SND_PCI_QUIRK(0x19e5, 0x3204, "Huawei MACH-WX9", ALC256_FIXUP_HUAWEI_MACH_WX9_PINS),
Greg Kroah-Hartman
maintainerPATCH 160/173 xtensa: fix KASAN report for show_stack
In reply to Greg Kroah-HartmanFrom: Max Filippov <[email protected]>
commit 1d3b7a788ca7435156809a6bd5b20c95b2370d45 upstream.
show_stack dumps raw stack contents which may trigger an unnecessary KASAN report. Fix it by copying stack contents to a temporary buffer with __memcpy and then printing that buffer instead of passing stack pointer directly to the print_hex_dump.
--- arch/xtensa/kernel/traps.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
arch/xtensa/kernel/traps.c +12 -4
@@ -503,7 +503,7 @@ static size_t kstack_depth_to_print = COvoid show_stack (struct task_struct *task,unsigned long *sp,const char *loglvl) { -size_t len; +size_t len, off =0 ;if (!sp) sp =stack_pointer (task);
@@ -512,9 +512,17 @@ void show_stack(struct task_struct *task kstack_depth_to_print * STACK_DUMP_ENTRY_SIZE);printk ("%sStack:\n" , loglvl); -print_hex_dump (loglvl," " ,DUMP_PREFIX_NONE , -STACK_DUMP_LINE_SIZE ,STACK_DUMP_ENTRY_SIZE , - sp, len, false); +while (off < len) { +u8 line[STACK_DUMP_LINE_SIZE ]; +size_t line_len = len - off >STACK_DUMP_LINE_SIZE ? +STACK_DUMP_LINE_SIZE : len - off; + +__memcpy (line, (u8 *)sp + off, line_len); +print_hex_dump (loglvl," " ,DUMP_PREFIX_NONE , +STACK_DUMP_LINE_SIZE ,STACK_DUMP_ENTRY_SIZE , + line, line_len, false); + off +=STACK_DUMP_LINE_SIZE ; + }show_trace (task, sp, loglvl); }
Greg Kroah-Hartman
maintainerPATCH 161/173 rcu: Fix rcu_torture_read ftrace event
In reply to Greg Kroah-HartmanFrom: Douglas Raillard <[email protected]>
commit d18a04157fc171fd48075e3dc96471bd3b87f0dd upstream.
Fix the rcutorturename field so that its size is correctly reported in the text format embedded in trace.dat files. As it stands, it is reported as being of size 1:
field:char rcutorturename[8]; offset:8; size:1; signed:0;
--- include/trace/events/rcu.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/trace/events/rcu.h +1 -1
@@ -713,7 +713,7 @@ TRACE_EVENT_RCU(rcu_torture_read,TP_ARGS (rcutorturename, rhp, secs, c_old, c),TP_STRUCT__entry ( - __field(char, rcutorturename[RCUTORTURENAME_LEN]) + __array(char, rcutorturename, RCUTORTURENAME_LEN) __field(struct rcu_head *, rhp) __field(unsigned long, secs) __field(unsigned long, c_old)