5.15.109-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 5.15.109-rc1 review
This is the start of the stable review cycle for the 5.15.109 release. There are 73 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 26 Apr 2023 13:11:11 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.109-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.15.109-rc1
Yang Yingliang <[email protected]>
soc: sifive: l2_cache: fix missing of_node_put() in sifive_l2_init()
Yang Yingliang <[email protected]>
soc: sifive: l2_cache: fix missing free_irq() in error path in sifive_l2_init()
Yang Yingliang <[email protected]>
soc: sifive: l2_cache: fix missing iounmap() in error path in sifive_l2_init()
Ekaterina Orlova <[email protected]>
ASN.1: Fix check for strdup() success
Nikita Zhandarovich <[email protected]>
ASoC: fsl_asrc_dma: fix potential null-ptr-deref
Tetsuo Handa <[email protected]>
mm/page_alloc: fix potential deadlock on zonelist_update_seq seqlock
Dan Carpenter <[email protected]>
iio: adc: at91-sama5d2_adc: fix an error code in at91_adc_allocate_trigger()
William Breathitt Gray <[email protected]>
counter: 104-quad-8: Fix race condition between FLAG and CNTR reads
Uwe Kleine-König <[email protected]>
pwm: hibvt: Explicitly set .polarity in .get_state()
Uwe Kleine-König <[email protected]>
pwm: iqs620a: Explicitly set .polarity in .get_state()
Uwe Kleine-König <[email protected]>
pwm: meson: Explicitly set .polarity in .get_state()
Kuniyuki Iwashima <[email protected]>
sctp: Call inet6_destroy_sock() via sk->sk_destruct().
Kuniyuki Iwashima <[email protected]>
dccp: Call inet6_destroy_sock() via sk->sk_destruct().
Kuniyuki Iwashima <[email protected]>
inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().
Kuniyuki Iwashima <[email protected]>
tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().
Kuniyuki Iwashima <[email protected]>
udp: Call inet6_destroy_sock() in setsockopt(IPV6_ADDRFORM).
Miklos Szeredi <[email protected]>
fuse: fix deadlock between atomic O_TRUNC and page invalidation
Jiachen Zhang <[email protected]>
fuse: always revalidate rename target dentry
Miklos Szeredi <[email protected]>
fuse: fix attr version comparison in fuse_read_update_size()
Alyssa Ross <[email protected]>
purgatory: fix disabling debug info
Salvatore Bonaccorso <[email protected]>
docs: futex: Fix kernel-doc references after code split-up preparation
Jiaxun Yang <[email protected]>
MIPS: Define RUNTIME_DISCARD_EXIT in LD script
Qais Yousef <[email protected]>
sched/fair: Fixes for capacity inversion detection
Qais Yousef <[email protected]>
sched/uclamp: Fix a uninitialized variable warnings
Qais Yousef <[email protected]>
sched/fair: Consider capacity inversion in util_fits_cpu()
Qais Yousef <[email protected]>
sched/fair: Detect capacity inversion
Qais Yousef <[email protected]>
sched/uclamp: Cater for uclamp in find_energy_efficient_cpu()'s early exit condition
Qais Yousef <[email protected]>
sched/uclamp: Make cpu_overutilized() use util_fits_cpu()
Qais Yousef <[email protected]>
sched/uclamp: Fix fits_capacity() check in feec()
Mel Gorman <[email protected]>
mm: page_alloc: skip regions with hugetlbfs pages when allocating 1G pages
Peter Xu <[email protected]>
mm/khugepaged: check again on anon uffd-wp during isolation
Ville Syrjälä <[email protected]>
drm/i915: Fix fast wake AUX sync len
Bhavya Kapoor <[email protected]>
mmc: sdhci_am654: Set HIGH_SPEED_ENA for SDR12 and SDR25
Ondrej Mosnacek <[email protected]>
kernel/sys.c: fix and improve control flow in __sys_setres[ug]id()
Greg Kroah-Hartman <[email protected]>
memstick: fix memory leak if card device is never registered
Ryusuke Konishi <[email protected]>
nilfs2: initialize unused bytes in segment summary blocks
Brian Masney <[email protected]>
iio: light: tsl2772: fix reading proximity-diodes from device tree
Mel Gorman <[email protected]>
rtmutex: Add acquire semantics for rtmutex lock acquisition slow path
Hans de Goede <[email protected]>
platform/x86: gigabyte-wmi: add support for X570S AORUS ELITE
Juergen Gross <[email protected]>
xen/netback: use same error messages for same errors
Sagi Grimberg <[email protected]>
nvme-tcp: fix a possible UAF when failing to allocate an io queue
Heiko Carstens <[email protected]>
s390/ptrace: fix PTRACE_GET_LAST_BREAK error handling
Álvaro Fernández Rojas <[email protected]>
net: dsa: b53: mmap: add phy ops
Damien Le Moal <[email protected]>
scsi: core: Improve scsi_vpd_inquiry() checks
Tomas Henzl <[email protected]>
scsi: megaraid_sas: Fix fw_crash_buffer_show()
Nick Desaulniers <[email protected]>
selftests: sigaltstack: fix -Wuninitialized
Frank Crawford <[email protected]>
platform/x86 (gigabyte-wmi): Add support for A320M-S2H V2
Jonathan Denose <[email protected]>
Input: i8042 - add quirk for Fujitsu Lifebook A574/H
Douglas Raillard <[email protected]>
f2fs: Fix f2fs_truncate_partial_nodes ftrace event
Sebastian Basierski <[email protected]>
e1000e: Disable TSO on i219-LM card to increase speed
Daniel Borkmann <[email protected]>
bpf: Fix incorrect verifier pruning due to missing register precision taints
Li Lanzhe <[email protected]>
spi: spi-rockchip: Fix missing unwind goto in rockchip_sfc_probe()
Ido Schimmel <[email protected]>
mlxsw: pci: Fix possible crash during initialization
Alexander Aring <[email protected]>
net: rpl: fix rpl header size calculation
Ido Schimmel <[email protected]>
bonding: Fix memory leak when changing bond type to Ethernet
Nikita Zhandarovich <[email protected]>
mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next()
Michael Chan <[email protected]>
bnxt_en: Do not initialize PTP on older P3/P4 chips
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: tighten netlink attribute requirements for catch-all elements
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: validate catch-all set elements
Aleksandr Loktionov <[email protected]>
i40e: fix i40e_setup_misc_vector() error handling
Aleksandr Loktionov <[email protected]>
i40e: fix accessing vsi->active_filters without holding lock
Florian Westphal <[email protected]>
netfilter: nf_tables: fix ifdef to also consider nf_tables=m
Ding Hui <[email protected]>
sfc: Fix use-after-free due to selftest_work
Jonathan Cooper <[email protected]>
sfc: Split STATE_READY in to STATE_NET_DOWN and STATE_NET_UP.
Xuan Zhuo <[email protected]>
virtio_net: bugfix overflow inside xdp_linearize_page()
Gwangun Jung <[email protected]>
net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg
Cristian Ciocaltea <[email protected]>
regulator: fan53555: Fix wrong TCS_SLEW_MASK
Cristian Ciocaltea <[email protected]>
regulator: fan53555: Explicitly include bits header
Florian Westphal <[email protected]>
netfilter: br_netfilter: fix recent physdev match breakage
Peng Fan <[email protected]>
arm64: dts: imx8mm-evk: correct pmic clock source
Marc Gonzalez <[email protected]>
arm64: dts: meson-g12-common: specify full DMC range
Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: ipq8074-hk01: enable QMP device, not the PHY node
Jianqun Xu <[email protected]>
ARM: dts: rockchip: fix a typo error for rk3288 spdif node
-------------
Diffstat:
Documentation/kernel-hacking/locking.rst | 2 +- .../translations/it_IT/kernel-hacking/locking.rst | 2 +- Makefile | 4 +- arch/arm/boot/dts/rk3288.dtsi | 2 +- arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 3 +- arch/arm64/boot/dts/freescale/imx8mm-evk.dtsi | 2 +- arch/arm64/boot/dts/qcom/ipq8074-hk01.dts | 4 +- arch/mips/kernel/vmlinux.lds.S | 2 + arch/s390/kernel/ptrace.c | 8 +- arch/x86/purgatory/Makefile | 3 +- drivers/counter/104-quad-8.c | 29 ++--- drivers/gpu/drm/i915/display/intel_dp_aux.c | 2 +- drivers/iio/adc/at91-sama5d2_adc.c | 2 +- drivers/iio/light/tsl2772.c | 1 + drivers/input/serio/i8042-x86ia64io.h | 8 ++ drivers/memstick/core/memstick.c | 5 +- drivers/mmc/host/sdhci_am654.c | 2 - drivers/net/bonding/bond_main.c | 7 +- drivers/net/dsa/b53/b53_mmap.c | 14 +++ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- drivers/net/ethernet/intel/e1000e/netdev.c | 51 ++++---- drivers/net/ethernet/intel/i40e/i40e_main.c | 9 +- .../ethernet/mellanox/mlxfw/mlxfw_mfa2_tlv_multi.c | 2 + drivers/net/ethernet/mellanox/mlxsw/pci_hw.h | 2 +- drivers/net/ethernet/sfc/ef100_netdev.c | 6 +- drivers/net/ethernet/sfc/efx.c | 30 +++-- drivers/net/ethernet/sfc/efx_common.c | 12 +- drivers/net/ethernet/sfc/efx_common.h | 6 +- drivers/net/ethernet/sfc/ethtool_common.c | 2 +- drivers/net/ethernet/sfc/net_driver.h | 50 +++++++- drivers/net/virtio_net.c | 8 +- drivers/net/xen-netback/netback.c | 6 +- drivers/nvme/host/tcp.c | 46 ++++---- drivers/platform/x86/gigabyte-wmi.c | 2 + drivers/pwm/pwm-hibvt.c | 1 + drivers/pwm/pwm-iqs620a.c | 1 + drivers/pwm/pwm-meson.c | 7 ++ drivers/regulator/fan53555.c | 13 ++- drivers/scsi/megaraid/megaraid_sas_base.c | 2 +- drivers/scsi/scsi.c | 11 +- drivers/soc/sifive/sifive_l2_cache.c | 27 ++++- drivers/spi/spi-rockchip-sfc.c | 2 +- fs/fuse/dir.c | 9 +- fs/fuse/file.c | 31 ++--- fs/nilfs2/segment.c | 20 ++++ include/linux/skbuff.h | 5 +- include/net/ipv6.h | 2 + include/net/netfilter/nf_tables.h | 4 + include/net/udp.h | 2 +- include/net/udplite.h | 8 -- include/trace/events/f2fs.h | 2 +- kernel/bpf/verifier.c | 15 +++ kernel/locking/rtmutex.c | 55 +++++++-- kernel/locking/rtmutex_api.c | 6 +- kernel/sched/core.c | 10 +- kernel/sched/fair.c | 128 ++++++++++++++++++--- kernel/sched/sched.h | 61 +++++++++- kernel/sys.c | 69 ++++++----- mm/khugepaged.c | 4 + mm/page_alloc.c | 19 +++ net/bridge/br_netfilter_hooks.c | 17 ++- net/dccp/dccp.h | 1 + net/dccp/ipv6.c | 15 +-- net/dccp/proto.c | 8 +- net/ipv4/udp.c | 9 +- net/ipv4/udplite.c | 8 ++ net/ipv6/af_inet6.c | 15 ++- net/ipv6/ipv6_sockglue.c | 20 ++-- net/ipv6/ping.c | 6 - net/ipv6/raw.c | 2 - net/ipv6/rpl.c | 3 +- net/ipv6/tcp_ipv6.c | 8 +- net/ipv6/udp.c | 17 ++- net/ipv6/udp_impl.h | 1 + net/ipv6/udplite.c | 9 +- net/l2tp/l2tp_ip6.c | 2 - net/mptcp/protocol.c | 7 -- net/netfilter/nf_tables_api.c | 67 +++++++++-- net/netfilter/nft_lookup.c | 36 +----- net/sched/sch_qfq.c | 13 ++- net/sctp/socket.c | 29 +++-- scripts/asn1_compiler.c | 2 +- sound/soc/fsl/fsl_asrc_dma.c | 11 +- .../selftests/sigaltstack/current_stack_pointer.h | 23 ++++ tools/testing/selftests/sigaltstack/sas.c | 7 +- 85 files changed, 820 insertions(+), 366 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/73 ARM: dts: rockchip: fix a typo error for rk3288 spdif node
From: Jianqun Xu <[email protected]>
[ Upstream commit 02c84f91adb9a64b75ec97d772675c02a3e65ed7 ]
Fix the address in the spdif node name.
--- arch/arm/boot/dts/rk3288.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/rk3288.dtsi +1 -1
@@ -940,7 +940,7 @@ status = "disabled"; }; - spdif: sound@ff88b0000 { + spdif: sound@ff8b0000 { compatible = "rockchip,rk3288-spdif", "rockchip,rk3066-spdif"; reg = <0x0 0xff8b0000 0x0 0x10000>; #sound-dai-cells = <0>;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 2/73 arm64: dts: qcom: ipq8074-hk01: enable QMP device, not the PHY node
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit 72630ba422b70ea0874fc90d526353cf71c72488 ]
Correct PCIe PHY enablement to refer the QMP device nodes rather than PHY device nodes. QMP nodes have 'status = "disabled"' property in the ipq8074.dtsi, while PHY nodes do not correspond to the actual device and do not have the status property.
--- arch/arm64/boot/dts/qcom/ipq8074-hk01.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/qcom/ipq8074-hk01.dts +2 -2
@@ -60,11 +60,11 @@ perst-gpio = <&tlmm 58 0x1>; }; -&pcie_phy0 { +&pcie_qmp0 { status = "okay"; }; -&pcie_phy1 { +&pcie_qmp1 { status = "okay"; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 3/73 arm64: dts: meson-g12-common: specify full DMC range
In reply to Greg Kroah-HartmanFrom: Marc Gonzalez <[email protected]>
[ Upstream commit aec4353114a408b3a831a22ba34942d05943e462 ]
According to S905X2 Datasheet - Revision 07:
DRAM Memory Controller (DMC) register area spans ff638000-ff63a000.
According to DeviceTree Specification - Release v0.4-rc1:
simple-bus nodes do not require reg property.
--- arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi +1 -2
@@ -1610,10 +1610,9 @@ dmc: bus@38000 { compatible = "simple-bus"; - reg = <0x0 0x38000 0x0 0x400>; #address-cells = <2>; #size-cells = <2>; - ranges = <0x0 0x0 0x0 0x38000 0x0 0x400>; + ranges = <0x0 0x0 0x0 0x38000 0x0 0x2000>; canvas: video-lut@48 { compatible = "amlogic,canvas";
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 4/73 arm64: dts: imx8mm-evk: correct pmic clock source
In reply to Greg Kroah-HartmanFrom: Peng Fan <[email protected]>
[ Upstream commit 85af7ffd24da38e416a14bd6bf207154d94faa83 ]
The osc_32k supports #clock-cells as 0, using an id is wrong, drop it.
--- arch/arm64/boot/dts/freescale/imx8mm-evk.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/imx8mm-evk.dtsi +1 -1
@@ -136,7 +136,7 @@ rohm,reset-snvs-powered; #clock-cells = <0>; - clocks = <&osc_32k 0>; + clocks = <&osc_32k>; clock-output-names = "clk-32k-out"; regulators {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 5/73 netfilter: br_netfilter: fix recent physdev match breakage
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ Upstream commit 94623f579ce338b5fa61b5acaa5beb8aa657fb9e ]
Recent attempt to ensure PREROUTING hook is executed again when a decrypted ipsec packet received on a bridge passes through the network stack a second time broke the physdev match in INPUT hook.
We can't discard the nf_bridge info strct from sabotage_in hook, as this is needed by the physdev match.
Keep the struct around and handle this with another conditional instead.
--- include/linux/skbuff.h | 1 + net/bridge/br_netfilter_hooks.c | 17 +++++++++++------ 2 files changed, 12 insertions(+), 6 deletions(-)
include/linux/skbuff.h +1 -0
@@ -259,6 +259,7 @@ struct nf_bridge_info { u8 pkt_otherhost:1; u8 in_prerouting:1; u8 bridged_dnat:1; + u8 sabotage_in_done:1;__u16 frag_max_size;struct net_device *physindev;
net/bridge/br_netfilter_hooks.c +11 -6
@@ -868,12 +868,17 @@ static unsigned int ip_sabotage_in(void *priv, {struct nf_bridge_info *nf_bridge =nf_bridge_info_get (skb); -if (nf_bridge && !nf_bridge->in_prerouting && - !netif_is_l3_master (skb->dev) && - !netif_is_l3_slave (skb->dev)) { -nf_bridge_info_free (skb); - state->okfn (state->net, state->sk, skb); -return NF_STOLEN ; +if (nf_bridge) { +if (nf_bridge->sabotage_in_done) +return NF_ACCEPT ; + +if (!nf_bridge->in_prerouting && + !netif_is_l3_master (skb->dev) && + !netif_is_l3_slave (skb->dev)) { + nf_bridge->sabotage_in_done =1 ; + state->okfn (state->net, state->sk, skb); +return NF_STOLEN ; + } }return NF_ACCEPT ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 6/73 regulator: fan53555: Explicitly include bits header
In reply to Greg Kroah-HartmanFrom: Cristian Ciocaltea <[email protected]>
[ Upstream commit 4fb9a5060f73627303bc531ceaab1b19d0a24aef ]
Since commit f2a9eb975ab2 ("regulator: fan53555: Add support for FAN53526") the driver makes use of the BIT() macro, but relies on the bits header being implicitly included.
Explicitly pull the header in to avoid potential build failures in some configurations.
While here, reorder include directives alphabetically.
--- drivers/regulator/fan53555.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/regulator/fan53555.c +6 -5
@@ -8,18 +8,19 @@// Copyright (c) 2012 Marvell Technology Ltd. // Yunfan Zhang <[email protected]> +#include <linux/bits.h> +#include <linux/err.h> +#include <linux/i2c.h> #include <linux/module.h> +#include <linux/of_device.h> #include <linux/param.h> -#include <linux/err.h> #include <linux/platform_device.h> +#include <linux/regmap.h> #include <linux/regulator/driver.h> +#include <linux/regulator/fan53555.h> #include <linux/regulator/machine.h> #include <linux/regulator/of_regulator.h> -#include <linux/of_device.h> -#include <linux/i2c.h> #include <linux/slab.h> -#include <linux/regmap.h> -#include <linux/regulator/fan53555.h> /* Voltage setting */ #define FAN53555_VSEL0 0x00
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 7/73 regulator: fan53555: Fix wrong TCS_SLEW_MASK
In reply to Greg Kroah-HartmanFrom: Cristian Ciocaltea <[email protected]>
[ Upstream commit c5d5b55b3c1a314137a251efc1001dfd435c6242 ]
The support for TCS4525 regulator has been introduced with a wrong ramp-rate mask, which has been defined as a logical expression instead of a bit shift operation.
For clarity, fix it using GENMASK() macro.
--- drivers/regulator/fan53555.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/regulator/fan53555.c +1 -1
@@ -61,7 +61,7 @@#define TCS_VSEL1_MODE (1 << 6)#define TCS_SLEW_SHIFT 3 -#define TCS_SLEW_MASK (0x3 < 3) +#define TCS_SLEW_MASK GENMASK(4, 3)enum fan53555_vendor {FAN53526_VENDOR_FAIRCHILD =0 ,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 8/73 net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg
In reply to Greg Kroah-HartmanFrom: Gwangun Jung <[email protected]>
[ Upstream commit 3037933448f60f9acb705997eae62013ecb81e0d ]
If the TCA_QFQ_LMAX value is not offered through nlattr, lmax is determined by the MTU value of the network device. The MTU of the loopback device can be set up to 2^31-1.
As a result, it is possible to have an lmax value that exceeds QFQ_MIN_LMAX.
Due to the invalid lmax value, an index is generated that exceeds the QFQ_MAX_INDEX(=24) value, causing out-of-bounds read/write errors.
The following reports a oob access:
[ 84.582666] BUG: KASAN: slab-out-of-bounds in qfq_activate_agg.constprop.0 (net/sched/sch_qfq.c:1027 net/sched/sch_qfq.c:1060 net/sched/sch_qfq.c:1313) [ 84.583267] Read of size 4 at addr ffff88810f676948 by task ping/301 [ 84.583686] [ 84.583797] CPU: 3 PID: 301 Comm: ping Not tainted 6.3.0-rc5 #1 [ 84.584164] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [ 84.584644] Call Trace: [ 84.584787] <TASK> [ 84.584906] dump_stack_lvl (lib/dump_stack.c:107 (discriminator 1)) [ 84.585108] print_report (mm/kasan/report.c:320 mm/kasan/report.c:430) [ 84.585570] kasan_report (mm/kasan/report.c:538) [ 84.585988] qfq_activate_agg.constprop.0 (net/sched/sch_qfq.c:1027 net/sched/sch_qfq.c:1060 net/sched/sch_qfq.c:1313) [ 84.586599] qfq_enqueue (net/sched/sch_qfq.c:1255) [ 84.587607] dev_qdisc_enqueue (net/core/dev.c:3776) [ 84.587749] __dev_queue_xmit (./include/net/sch_generic.h:186 net/core/dev.c:3865 net/core/dev.c:4212) [ 84.588763] ip_finish_output2 (./include/net/neighbour.h:546 net/ipv4/ip_output.c:228) [ 84.589460] ip_output (net/ipv4/ip_output.c:430) [ 84.590132] ip_push_pending_frames (./include/net/dst.h:444 net/ipv4/ip_output.c:126 net/ipv4/ip_output.c:1586 net/ipv4/ip_output.c:1606) [ 84.590285] raw_sendmsg (net/ipv4/raw.c:649) [ 84.591960] sock_sendmsg (net/socket.c:724 net/socket.c:747) [ 84.592084] __sys_sendto (net/socket.c:2142) [ 84.593306] __x64_sys_sendto (net/socket.c:2150) [ 84.593779] do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) [ 84.593902] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) [ 84.594070] RIP: 0033:0x7fe568032066 [ 84.594192] Code: 0e 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 41 89 ca 64 8b 04 25 18 00 00 00 85 c09[ 84.594796] RSP: 002b:00007ffce388b4e8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
Code starting with the faulting instruction
===========================================
[ 84.595047] RAX: ffffffffffffffda RBX: 00007ffce388cc70 RCX: 00007fe568032066 [ 84.595281] RDX: 0000000000000040 RSI: 00005605fdad6d10 RDI: 0000000000000003 [ 84.595515] RBP: 00005605fdad6d10 R08: 00007ffce388eeec R09: 0000000000000010 [ 84.595749] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000040 [ 84.595984] R13: 00007ffce388cc30 R14: 00007ffce388b4f0 R15: 0000001d00000001 [ 84.596218] </TASK> [ 84.596295] [ 84.596351] Allocated by task 291: [ 84.596467] kasan_save_stack (mm/kasan/common.c:46) [ 84.596597] kasan_set_track (mm/kasan/common.c:52) [ 84.596725] __kasan_kmalloc (mm/kasan/common.c:384) [ 84.596852] __kmalloc_node (./include/linux/kasan.h:196 mm/slab_common.c:967 mm/slab_common.c:974) [ 84.596979] qdisc_alloc (./include/linux/slab.h:610 ./include/linux/slab.h:731 net/sched/sch_generic.c:938) [ 84.597100] qdisc_create (net/sched/sch_api.c:1244) [ 84.597222] tc_modify_qdisc (net/sched/sch_api.c:1680) [ 84.597357] rtnetlink_rcv_msg (net/core/rtnetlink.c:6174) [ 84.597495] netlink_rcv_skb (net/netlink/af_netlink.c:2574) [ 84.597627] netlink_unicast (net/netlink/af_netlink.c:1340 net/netlink/af_netlink.c:1365) [ 84.597759] netlink_sendmsg (net/netlink/af_netlink.c:1942) [ 84.597891] sock_sendmsg (net/socket.c:724 net/socket.c:747) [ 84.598016] ____sys_sendmsg (net/socket.c:2501) [ 84.598147] ___sys_sendmsg (net/socket.c:2557) [ 84.598275] __sys_sendmsg (./include/linux/file.h:31 net/socket.c:2586) [ 84.598399] do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) [ 84.598520] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) [ 84.598688] [ 84.598744] The buggy address belongs to the object at ffff88810f674000 [ 84.598744] which belongs to the cache kmalloc-8k of size 8192 [ 84.599135] The buggy address is located 2664 bytes to the right of [ 84.599135] allocated 7904-byte region [ffff88810f674000, ffff88810f675ee0) [ 84.599544] [ 84.599598] The buggy address belongs to the physical page: [ 84.599777] page:00000000e638567f refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10f670 [ 84.600074] head:00000000e638567f order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 84.600330] flags: 0x200000000010200(slab|head|node=0|zone=2) [ 84.600517] raw: 0200000000010200 ffff888100043180 dead000000000122 0000000000000000 [ 84.600764] raw: 0000000000000000 0000000080020002 00000001ffffffff 0000000000000000 [ 84.601009] page dumped because: kasan: bad access detected [ 84.601187] [ 84.601241] Memory state around the buggy address: [ 84.601396] ffff88810f676800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 84.601620] ffff88810f676880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 84.601845] >ffff88810f676900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 84.602069] ^ [ 84.602243] ffff88810f676980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 84.602468] ffff88810f676a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 84.602693] ================================================================== [ 84.602924] Disabling lock debugging due to kernel taint
--- net/sched/sch_qfq.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
net/sched/sch_qfq.c +7 -6
@@ -421,15 +421,16 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, }else weight =1 ; -if (tb[TCA_QFQ_LMAX ]) { +if (tb[TCA_QFQ_LMAX ]) lmax =nla_get_u32 (tb[TCA_QFQ_LMAX ]); -if (lmax <QFQ_MIN_LMAX || lmax > (1UL <<QFQ_MTU_SHIFT )) { -pr_notice ("qfq: invalid max length %u\n" , lmax); -return -EINVAL ; - } - }else +else lmax =psched_mtu (qdisc_dev (sch)); +if (lmax <QFQ_MIN_LMAX || lmax > (1UL <<QFQ_MTU_SHIFT )) { +pr_notice ("qfq: invalid max length %u\n" , lmax); +return -EINVAL ; + } + inv_w =ONE_FP / weight; weight =ONE_FP / inv_w;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 9/73 virtio_net: bugfix overflow inside xdp_linearize_page()
In reply to Greg Kroah-HartmanFrom: Xuan Zhuo <[email protected]>
[ Upstream commit 853618d5886bf94812f31228091cd37d308230f7 ]
Here we copy the data from the original buf to the new page. But we not check that it may be overflow.
As long as the size received(including vnethdr) is greater than 3840 (PAGE_SIZE -VIRTIO_XDP_HEADROOM). Then the memcpy will overflow.
And this is completely possible, as long as the MTU is large, such as 4096. In our test environment, this will cause crash. Since crash is caused by the written memory, it is meaningless, so I do not include it.
--- drivers/net/virtio_net.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/virtio_net.c +6 -2
@@ -679,8 +679,13 @@ static struct page *xdp_linearize_page(struct receive_queue *rq,int page_off, unsigned int *len) { - struct page *page = alloc_page(GFP_ATOMIC); + int tailroom = SKB_DATA_ALIGN(sizeof(struct skb_shared_info)); +struct page *page; +if (page_off + *len + tailroom >PAGE_SIZE ) +return NULL ; + + page =alloc_page (GFP_ATOMIC );if (!page)return NULL ;
@@ -688,7 +693,6 @@ static struct page *xdp_linearize_page(struct receive_queue *rq, page_off += *len;while (--*num_buf) { -int tailroom =SKB_DATA_ALIGN (sizeof (struct skb_shared_info ));unsigned int buflen;void *buf;int off;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 10/73 sfc: Split STATE_READY in to STATE_NET_DOWN and STATE_NET_UP.
In reply to Greg Kroah-HartmanFrom: Jonathan Cooper <[email protected]>
[ Upstream commit 813cf9d1e753e1e0a247d3d685212a06141b483e ]
This patch splits the READY state in to NET_UP and NET_DOWN. This is to prepare for future work to delay resource allocation until interface up so that we can use resources more efficiently in SRIOV environments, and also to lay the ground work for an extra PROBED state where we don't create a network interface, for VDPA operation.
Stable-dep-of: a80bb8e7233b ("sfc: Fix use-after-free due to selftest_work")
--- drivers/net/ethernet/sfc/ef100_netdev.c | 6 ++- drivers/net/ethernet/sfc/efx.c | 29 ++++++------- drivers/net/ethernet/sfc/efx_common.c | 10 ++--- drivers/net/ethernet/sfc/efx_common.h | 6 +-- drivers/net/ethernet/sfc/ethtool_common.c | 2 +- drivers/net/ethernet/sfc/net_driver.h | 50 +++++++++++++++++++++-- 6 files changed, 72 insertions(+), 31 deletions(-)
drivers/net/ethernet/sfc/ef100_netdev.c +5 -1
@@ -96,6 +96,8 @@ static int ef100_net_stop(struct net_device *net_dev)efx_mcdi_free_vis (efx);efx_remove_interrupts (efx); + efx->state =STATE_NET_DOWN ; +return 0 ; }
@@ -172,6 +174,8 @@ static int ef100_net_open(struct net_device *net_dev)efx_link_status_changed (efx);mutex_unlock (&efx->mac_lock); + efx->state =STATE_NET_UP ; +return 0 ; fail:
@@ -272,7 +276,7 @@ int ef100_register_netdev(struct efx_nic *efx)/* Always start with carrier off; PHY events will detect the link */ netif_carrier_off (net_dev); - efx->state =STATE_READY ; + efx->state =STATE_NET_DOWN ;rtnl_unlock ();efx_init_mcdi_logging (efx);
drivers/net/ethernet/sfc/efx.c +13 -16
@@ -105,14 +105,6 @@ static int efx_xdp(struct net_device *dev, struct netdev_bpf *xdp);static int efx_xdp_xmit (struct net_device *dev,int n,struct xdp_frame **xdpfs,u32 flags); -#define EFX_ASSERT_RESET_SERIALISED (efx) \ - do { \ - if ((efx->state == STATE_READY) || \ - (efx->state == STATE_RECOVERY) || \ - (efx->state == STATE_DISABLED)) \ - ASSERT_RTNL(); \ - } while (0) -/************************************************************************** * * Port handling
@@ -377,6 +369,8 @@ static int efx_probe_all(struct efx_nic *efx)if (rc) goto fail5; + efx->state =STATE_NET_DOWN ; +return 0 ; fail5:
@@ -543,6 +537,9 @@ int efx_net_open(struct net_device *net_dev)efx_start_all (efx);if (efx->state ==STATE_DISABLED || efx->reset_pending)netif_device_detach (efx->net_dev); +else + efx->state =STATE_NET_UP ; +efx_selftest_async_start (efx);return 0 ; }
@@ -719,8 +716,6 @@ static int efx_register_netdev(struct efx_nic *efx)* already requested. If so, the NIC is probably hosed so we * abort. */ - efx->state =STATE_READY ; -smp_mb ();/* ensure we change state before checking reset_pending */ if (efx->reset_pending) {pci_err (efx->pci_dev,"aborting probe due to scheduled reset\n" ); rc = -EIO ;
@@ -747,6 +742,8 @@ static int efx_register_netdev(struct efx_nic *efx)efx_associate (efx); + efx->state =STATE_NET_DOWN ; +rtnl_unlock (); rc =device_create_file (&efx->pci_dev->dev, &dev_attr_phy_type);
@@ -848,7 +845,7 @@ static void efx_pci_remove_main(struct efx_nic *efx)/* Flush reset_work. It can no longer be scheduled since we * are not READY. */ -BUG_ON (efx->state ==STATE_READY ); +WARN_ON (efx_net_active (efx->state));efx_flush_reset_workqueue (efx);efx_disable_interrupts (efx);
@@ -1153,13 +1150,13 @@ static int efx_pm_freeze(struct device *dev)rtnl_lock (); -if (efx->state !=STATE_DISABLED ) { - efx->state =STATE_UNINIT ; - +if (efx_net_active (efx->state)) {efx_device_detach_sync (efx);efx_stop_all (efx);efx_disable_interrupts (efx); + + efx->state =efx_freeze (efx->state); }rtnl_unlock ();
@@ -1174,7 +1171,7 @@ static int efx_pm_thaw(struct device *dev)rtnl_lock (); -if (efx->state !=STATE_DISABLED ) { +if (efx_frozen (efx->state)) { rc =efx_enable_interrupts (efx);if (rc) goto fail;
@@ -1187,7 +1184,7 @@ static int efx_pm_thaw(struct device *dev)efx_device_attach_if_not_resetting (efx); - efx->state =STATE_READY ; + efx->state =efx_thaw (efx->state); efx->type->resume_wol (efx); }
drivers/net/ethernet/sfc/efx_common.c +5 -5
@@ -897,7 +897,7 @@ static void efx_reset_work(struct work_struct *data)* have changed by now. Now that we have the RTNL lock, * it cannot change again. */ -if (efx->state ==STATE_READY ) +if (efx_net_active (efx->state)) (void )efx_reset (efx, method);rtnl_unlock ();
@@ -907,7 +907,7 @@ void efx_schedule_reset(struct efx_nic *efx, enum reset_type type) {enum reset_type method; -if (efx->state ==STATE_RECOVERY ) { +if (efx_recovering (efx->state)) {netif_dbg (efx, drv, efx->net_dev,"recovering: skip scheduling %s reset\n" ,RESET_TYPE (type));
@@ -942,7 +942,7 @@ void efx_schedule_reset(struct efx_nic *efx, enum reset_type type)/* If we're not READY then just leave the flags set as the cue * to abort probing or reschedule the reset later. */ -if (READ_ONCE (efx->state) !=STATE_READY ) +if (!efx_net_active (READ_ONCE (efx->state)))return ;/* efx_process_channel() will no longer read events once a
@@ -1216,7 +1216,7 @@ static pci_ers_result_t efx_io_error_detected(struct pci_dev *pdev,rtnl_lock ();if (efx->state !=STATE_DISABLED ) { - efx->state =STATE_RECOVERY ; + efx->state =efx_recover (efx->state); efx->reset_pending =0 ;efx_device_detach_sync (efx);
@@ -1270,7 +1270,7 @@ static void efx_io_resume(struct pci_dev *pdev)netif_err (efx, hw, efx->net_dev,"efx_reset failed after PCI error (%d)\n" , rc); }else { - efx->state =STATE_READY ; + efx->state =efx_recovered (efx->state);netif_dbg (efx, hw, efx->net_dev,"Done resetting and resuming IO after PCI error.\n" ); }
drivers/net/ethernet/sfc/efx_common.h +2 -4
@@ -45,9 +45,7 @@ int efx_reconfigure_port(struct efx_nic *efx);#define EFX_ASSERT_RESET_SERIALISED (efx) \ do { \ - if ((efx->state == STATE_READY) || \ - (efx->state == STATE_RECOVERY) || \ - (efx->state == STATE_DISABLED)) \ + if (efx->state != STATE_UNINIT) \ ASSERT_RTNL(); \ } while (0)
@@ -64,7 +62,7 @@ void efx_port_dummy_op_void(struct efx_nic *efx);static inline int efx_check_disabled (struct efx_nic *efx) { -if (efx->state ==STATE_DISABLED || efx->state ==STATE_RECOVERY ) { +if (efx->state ==STATE_DISABLED ||efx_recovering (efx->state)) {netif_err (efx, drv, efx->net_dev,"device is disabled due to earlier errors\n" );return -EIO ;
drivers/net/ethernet/sfc/ethtool_common.c +1 -1
@@ -137,7 +137,7 @@ void efx_ethtool_self_test(struct net_device *net_dev,if (!efx_tests) goto fail; -if (efx->state !=STATE_READY ) { +if (!efx_net_active (efx->state)) { rc = -EBUSY ; goto out; }
drivers/net/ethernet/sfc/net_driver.h +46 -4
58 lines not on this page · raw message
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 11/73 sfc: Fix use-after-free due to selftest_work
In reply to Greg Kroah-HartmanFrom: Ding Hui <[email protected]>
[ Upstream commit a80bb8e7233b2ad6ff119646b6e33fb3edcec37b ]
There is a use-after-free scenario that is:
When the NIC is down, user set mac address or vlan tag to VF, the xxx_set_vf_mac() or xxx_set_vf_vlan() will invoke efx_net_stop() and efx_net_open(), since netif_running() is false, the port will not start and keep port_enabled false, but selftest_work is scheduled in efx_net_open().
If we remove the device before selftest_work run, the efx_stop_port() will not be called since the NIC is down, and then efx is freed, we will soon get a UAF in run_timer_softirq() like this:
[ 1178.907941] ================================================================== [ 1178.907948] BUG: KASAN: use-after-free in run_timer_softirq+0xdea/0xe90 [ 1178.907950] Write of size 8 at addr ff11001f449cdc80 by task swapper/47/0 [ 1178.907950] [ 1178.907953] CPU: 47 PID: 0 Comm: swapper/47 Kdump: loaded Tainted: G O --------- -t - 4.18.0 #1 [ 1178.907954] Hardware name: SANGFOR X620G40/WI2HG-208T1061A, BIOS SPYH051032-U01 04/01/2022 [ 1178.907955] Call Trace: [ 1178.907956] <IRQ> [ 1178.907960] dump_stack+0x71/0xab [ 1178.907963] print_address_description+0x6b/0x290 [ 1178.907965] ? run_timer_softirq+0xdea/0xe90 [ 1178.907967] kasan_report+0x14a/0x2b0 [ 1178.907968] run_timer_softirq+0xdea/0xe90 [ 1178.907971] ? init_timer_key+0x170/0x170 [ 1178.907973] ? hrtimer_cancel+0x20/0x20 [ 1178.907976] ? sched_clock+0x5/0x10 [ 1178.907978] ? sched_clock_cpu+0x18/0x170 [ 1178.907981] __do_softirq+0x1c8/0x5fa [ 1178.907985] irq_exit+0x213/0x240 [ 1178.907987] smp_apic_timer_interrupt+0xd0/0x330 [ 1178.907989] apic_timer_interrupt+0xf/0x20 [ 1178.907990] </IRQ> [ 1178.907991] RIP: 0010:mwait_idle+0xae/0x370
If the NIC is not actually brought up, there is no need to schedule selftest_work, so let's move invoking efx_selftest_async_start() into efx_start_all(), and it will be canceled by broughting down.
--- drivers/net/ethernet/sfc/efx.c | 1 - drivers/net/ethernet/sfc/efx_common.c | 2 ++ 2 files changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/sfc/efx.c +0 -1
@@ -540,7 +540,6 @@ int efx_net_open(struct net_device *net_dev)else efx->state =STATE_NET_UP ; -efx_selftest_async_start (efx);return 0 ; }
drivers/net/ethernet/sfc/efx_common.c +2 -0
@@ -542,6 +542,8 @@ void efx_start_all(struct efx_nic *efx)/* Start the hardware monitor if there is one */ efx_start_monitor (efx); +efx_selftest_async_start (efx); +/* Link state detection is normally event-driven; we have * to poll now because we could have missed a change */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 12/73 netfilter: nf_tables: fix ifdef to also consider nf_tables=m
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ Upstream commit c55c0e91c813589dc55bea6bf9a9fbfaa10ae41d ]
nftables can be built as a module, so fix the preprocessor conditional accordingly.
--- include/linux/skbuff.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/skbuff.h +2 -2
@@ -4462,7 +4462,7 @@ static inline void nf_reset_ct(struct sk_buff *skb)static inline void nf_reset_trace (struct sk_buff *skb) { -#if IS_ENABLED (CONFIG_NETFILTER_XT_TARGET_TRACE ) || defined(CONFIG_NF_TABLES ) +#if IS_ENABLED (CONFIG_NETFILTER_XT_TARGET_TRACE ) ||IS_ENABLED (CONFIG_NF_TABLES ) skb->nf_trace =0 ;#endif }
@@ -4482,7 +4482,7 @@ static inline void __nf_copy(struct sk_buff *dst, const struct sk_buff *src, dst->_nfct = src->_nfct;nf_conntrack_get (skb_nfct (src));#endif -#if IS_ENABLED (CONFIG_NETFILTER_XT_TARGET_TRACE ) || defined(CONFIG_NF_TABLES ) +#if IS_ENABLED (CONFIG_NETFILTER_XT_TARGET_TRACE ) ||IS_ENABLED (CONFIG_NF_TABLES )if (copy) dst->nf_trace = src->nf_trace;#endif
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 13/73 i40e: fix accessing vsi->active_filters without holding lock
In reply to Greg Kroah-HartmanFrom: Aleksandr Loktionov <[email protected]>
[ Upstream commit 8485d093b076e59baff424552e8aecfc5bd2d261 ]
Fix accessing vsi->active_filters without holding the mac_filter_hash_lock. Move vsi->active_filters = 0 inside critical section and
move clear_bit(__I40E_VSI_OVERFLOW_PROMISC, vsi->state) after the critical section to ensure the new filters from other threads can be added only after filters cleaning in the critical section is finished.
--- drivers/net/ethernet/intel/i40e/i40e_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/i40e/i40e_main.c +2 -2
@@ -13945,15 +13945,15 @@ static int i40e_add_vsi(struct i40e_vsi *vsi) vsi->id = ctxt.vsi_number; } - vsi->active_filters =0 ; -clear_bit (__I40E_VSI_OVERFLOW_PROMISC, vsi->state);spin_lock_bh (&vsi->mac_filter_hash_lock); + vsi->active_filters =0 ;/* If macvlan filters already exist, force them to get loaded */ hash_for_each_safe (vsi->mac_filter_hash, bkt, h, f, hlist) { f->state =I40E_FILTER_NEW ; f_count++; }spin_unlock_bh (&vsi->mac_filter_hash_lock); +clear_bit (__I40E_VSI_OVERFLOW_PROMISC, vsi->state);if (f_count) { vsi->flags |=I40E_VSI_FLAG_FILTER_CHANGED ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 14/73 i40e: fix i40e_setup_misc_vector() error handling
In reply to Greg Kroah-HartmanFrom: Aleksandr Loktionov <[email protected]>
[ Upstream commit c86c00c6935505929cc9adb29ddb85e48c71f828 ]
Add error handling of i40e_setup_misc_vector() in i40e_rebuild(). In case interrupt vectors setup fails do not re-open vsi-s and do not bring up vf-s, we have no interrupts to serve a traffic anyway.
--- drivers/net/ethernet/intel/i40e/i40e_main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/i40e/i40e_main.c +4 -1
@@ -10923,8 +10923,11 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired) pf->hw.aq.asq_last_status)); }/* reinit the misc interrupt */ -if (pf->flags &I40E_FLAG_MSIX_ENABLED ) +if (pf->flags &I40E_FLAG_MSIX_ENABLED ) { ret =i40e_setup_misc_vector (pf); +if (ret) + goto end_unlock; + }/* Add a filter to drop all Flow control frames from any VSI from being * transmitted. By doing so we stop a malicious VF from sending out
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 15/73 netfilter: nf_tables: validate catch-all set elements
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit d46fc894147cf98dd6e8210aa99ed46854191840 ]
catch-all set element might jump/goto to chain that uses expressions that require validation.
--- include/net/netfilter/nf_tables.h | 4 ++ net/netfilter/nf_tables_api.c | 64 ++++++++++++++++++++++++++++--- net/netfilter/nft_lookup.c | 36 ++--------------- 3 files changed, 66 insertions(+), 38 deletions(-)
include/net/netfilter/nf_tables.h +4 -0
@@ -1030,6 +1030,10 @@ struct nft_chain { };int nft_chain_validate (const struct nft_ctx *ctx,const struct nft_chain *chain); +int nft_setelem_validate (const struct nft_ctx *ctx,struct nft_set *set, +const struct nft_set_iter *iter, +struct nft_set_elem *elem); +int nft_set_catchall_validate (const struct nft_ctx *ctx,struct nft_set *set);enum nft_chain_types {NFT_CHAIN_T_DEFAULT =0 ,
net/netfilter/nf_tables_api.c +58 -6
76 lines not on this page · raw message
net/netfilter/nft_lookup.c +4 -32
@@ -198,37 +198,6 @@ static int nft_lookup_dump(struct sk_buff *skb, const struct nft_expr *expr)return -1 ; } -static int nft_lookup_validate_setelem (const struct nft_ctx *ctx, -struct nft_set *set, -const struct nft_set_iter *iter, -struct nft_set_elem *elem) -{ -const struct nft_set_ext *ext =nft_set_elem_ext (set, elem->priv); -struct nft_ctx *pctx = (struct nft_ctx *)ctx; -const struct nft_data *data; -int err; - -if (nft_set_ext_exists (ext,NFT_SET_EXT_FLAGS ) && - *nft_set_ext_flags (ext) &NFT_SET_ELEM_INTERVAL_END ) -return 0 ; - - data =nft_set_ext_data (ext); -switch (data->verdict.code) { -case NFT_JUMP : -case NFT_GOTO : - pctx->level++; - err =nft_chain_validate (ctx, data->verdict.chain); -if (err <0 ) -return err; - pctx->level--; -break ; -default : -break ; - } - -return 0 ; -} -static int nft_lookup_validate (const struct nft_ctx *ctx,const struct nft_expr *expr,const struct nft_data **d)
@@ -244,9 +213,12 @@ static int nft_lookup_validate(const struct nft_ctx *ctx, iter.skip =0 ; iter.count =0 ; iter.err =0 ; - iter.fn = nft_lookup_validate_setelem; + iter.fn = nft_setelem_validate; priv->set->ops->walk (ctx, priv->set, &iter); +if (!iter.err) + iter.err =nft_set_catchall_validate (ctx, priv->set); +if (iter.err <0 )return iter.err;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 16/73 netfilter: nf_tables: tighten netlink attribute requirements for catch-all elements
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit d4eb7e39929a3b1ff30fb751b4859fc2410702a0 ]
If NFT_SET_ELEM_CATCHALL is set on, then userspace provides no set element key. Otherwise, bail out with -EINVAL.
--- net/netfilter/nf_tables_api.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +2 -1
@@ -5895,7 +5895,8 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set,if (err <0 )return err; -if (!nla[NFTA_SET_ELEM_KEY ] && !(flags &NFT_SET_ELEM_CATCHALL )) +if (((flags &NFT_SET_ELEM_CATCHALL ) && nla[NFTA_SET_ELEM_KEY ]) || + (!(flags &NFT_SET_ELEM_CATCHALL ) && !nla[NFTA_SET_ELEM_KEY ]))return -EINVAL ;if (flags !=0 ) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 17/73 bnxt_en: Do not initialize PTP on older P3/P4 chips
In reply to Greg Kroah-HartmanFrom: Michael Chan <[email protected]>
[ Upstream commit e8b51a1a15d5a3cce231e0669f6a161dc5bb9b75 ]
The driver does not support PTP on these older chips and it is assuming that firmware on these older chips will not return the PORT_MAC_PTP_QCFG_RESP_FLAGS_HWRM_ACCESS flag in __bnxt_hwrm_ptp_qcfg(), causing the function to abort quietly.
But newer firmware now sets this flag and so __bnxt_hwrm_ptp_qcfg() will proceed further. Eventually it will fail in bnxt_ptp_init() -> bnxt_map_ptp_regs() because there is no code to support the older chips. The driver will then complain:
"PTP initialization failed.\n"
Fix it so that we abort quietly earlier without going through the unnecessary steps and alarming the user with the warning log.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +1 -1
@@ -7437,7 +7437,7 @@ static int __bnxt_hwrm_ptp_qcfg(struct bnxt *bp)u8 flags;int rc; -if (bp->hwrm_spec_code <0x10801 ) { +if (bp->hwrm_spec_code <0x10801 || !BNXT_CHIP_P5_THOR (bp)) { rc = -ENODEV ; goto no_ptp; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 18/73 mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next()
In reply to Greg Kroah-HartmanFrom: Nikita Zhandarovich <[email protected]>
[ Upstream commit c0e73276f0fcbbd3d4736ba975d7dc7a48791b0c ]
Function mlxfw_mfa2_tlv_multi_get() returns NULL if 'tlv' in question does not pass checks in mlxfw_mfa2_tlv_payload_get(). This behaviour may lead to NULL pointer dereference in 'multi->total_len'. Fix this issue by testing mlxfw_mfa2_tlv_multi_get()'s return value against NULL.
Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.
--- drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2_tlv_multi.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2_tlv_multi.c +2 -0
@@ -31,6 +31,8 @@ mlxfw_mfa2_tlv_next(const struct mlxfw_mfa2_file *mfa2_file,if (tlv->type ==MLXFW_MFA2_TLV_MULTI_PART ) { multi =mlxfw_mfa2_tlv_multi_get (mfa2_file, tlv); +if (!multi) +return NULL ; tlv_len =NLA_ALIGN (tlv_len +be16_to_cpu (multi->total_len)); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 19/73 bonding: Fix memory leak when changing bond type to Ethernet
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
[ Upstream commit c484fcc058bada604d7e4e5228d4affb646ddbc2 ]
When a net device is put administratively up, its 'IFF_UP' flag is set (if not set already) and a 'NETDEV_UP' notification is emitted, which causes the 8021q driver to add VLAN ID 0 on the device. The reverse happens when a net device is put administratively down.
When changing the type of a bond to Ethernet, its 'IFF_UP' flag is incorrectly cleared, resulting in the kernel skipping the above process and VLAN ID 0 being leaked [1].
Fix by restoring the flag when changing the type to Ethernet, in a similar fashion to the restoration of the 'IFF_SLAVE' flag.
The issue can be reproduced using the script in [2], with example out before and after the fix in [3].
[1]
unreferenced object 0xffff888103479900 (size 256):
comm "ip", pid 329, jiffies 4294775225 (age 28.561s) hex dump (first 32 bytes):
00 a0 0c 15 81 88 ff ff 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff81a6051a>] kmalloc_trace+0x2a/0xe0
[<ffffffff8406426c>] vlan_vid_add+0x30c/0x790
[<ffffffff84068e21>] vlan_device_event+0x1491/0x21a0
[<ffffffff81440c8e>] notifier_call_chain+0xbe/0x1f0
[<ffffffff8372383a>] call_netdevice_notifiers_info+0xba/0x150
[<ffffffff837590f2>] __dev_notify_flags+0x132/0x2e0
[<ffffffff8375ad9f>] dev_change_flags+0x11f/0x180
[<ffffffff8379af36>] do_setlink+0xb96/0x4060
[<ffffffff837adf6a>] __rtnl_newlink+0xc0a/0x18a0
[<ffffffff837aec6c>] rtnl_newlink+0x6c/0xa0
[<ffffffff837ac64e>] rtnetlink_rcv_msg+0x43e/0xe00
[<ffffffff839a99e0>] netlink_rcv_skb+0x170/0x440
[<ffffffff839a738f>] netlink_unicast+0x53f/0x810
[<ffffffff839a7fcb>] netlink_sendmsg+0x96b/0xe90
[<ffffffff8369d12f>] ____sys_sendmsg+0x30f/0xa70
[<ffffffff836a6d7a>] ___sys_sendmsg+0x13a/0x1e0
unreferenced object 0xffff88810f6a83e0 (size 32):
comm "ip", pid 329, jiffies 4294775225 (age 28.561s)
hex dump (first 32 bytes):
a0 99 47 03 81 88 ff ff a0 99 47 03 81 88 ff ff ..G.......G.....
81 00 00 00 01 00 00 00 cc cc cc cc cc cc cc cc ................
backtrace:
[<ffffffff81a6051a>] kmalloc_trace+0x2a/0xe0
[<ffffffff84064369>] vlan_vid_add+0x409/0x790
[<ffffffff84068e21>] vlan_device_event+0x1491/0x21a0
[<ffffffff81440c8e>] notifier_call_chain+0xbe/0x1f0
[<ffffffff8372383a>] call_netdevice_notifiers_info+0xba/0x150
[<ffffffff837590f2>] __dev_notify_flags+0x132/0x2e0
[<ffffffff8375ad9f>] dev_change_flags+0x11f/0x180
[<ffffffff8379af36>] do_setlink+0xb96/0x4060
[<ffffffff837adf6a>] __rtnl_newlink+0xc0a/0x18a0
[<ffffffff837aec6c>] rtnl_newlink+0x6c/0xa0
[<ffffffff837ac64e>] rtnetlink_rcv_msg+0x43e/0xe00
[<ffffffff839a99e0>] netlink_rcv_skb+0x170/0x440
[<ffffffff839a738f>] netlink_unicast+0x53f/0x810
[<ffffffff839a7fcb>] netlink_sendmsg+0x96b/0xe90
[<ffffffff8369d12f>] ____sys_sendmsg+0x30f/0xa70
[<ffffffff836a6d7a>] ___sys_sendmsg+0x13a/0x1e0[2]
ip link add name t-nlmon type nlmon
ip link add name t-dummy type dummy
ip link add name t-bond type bond mode active-backup
ip link set dev t-bond up
ip link set dev t-nlmon master t-bond
ip link set dev t-nlmon nomaster
ip link show dev t-bond
ip link set dev t-dummy master t-bond
ip link show dev t-bond
ip link del dev t-bond
ip link del dev t-dummy
ip link del dev t-nlmon
[3]
Before:
12: t-bond: <NO-CARRIER,BROADCAST,MULTICAST,MASTER,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default qlen 1000
link/netlink
12: t-bond: <BROADCAST,MULTICAST,MASTER,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
link/ether 46:57:39:a4:46:a2 brd ff:ff:ff:ff:ff:ff
After:
12: t-bond: <NO-CARRIER,BROADCAST,MULTICAST,MASTER,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default qlen 1000
link/netlink
12: t-bond: <BROADCAST,MULTICAST,MASTER,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
link/ether 66:48:7b:74:b6:8a brd ff:ff:ff:ff:ff:ff
--- drivers/net/bonding/bond_main.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/bonding/bond_main.c +4 -3
@@ -1746,14 +1746,15 @@ void bond_lower_state_changed(struct slave *slave)/* The bonding driver uses ether_setup() to convert a master bond device * to ARPHRD_ETHER, that resets the target netdevice's flags so we always -* have to restore the IFF_MASTER flag, and only restore IFF_SLAVE if it was set +* have to restore the IFF_MASTER flag, and only restore IFF_SLAVE and IFF_UP +* if they were set */ static void bond_ether_setup (struct net_device *bond_dev) { -unsigned int slave_flag = bond_dev->flags &IFF_SLAVE ; +unsigned int flags = bond_dev->flags & (IFF_SLAVE |IFF_UP );ether_setup (bond_dev); - bond_dev->flags |=IFF_MASTER | slave_flag; + bond_dev->flags |=IFF_MASTER | flags; bond_dev->priv_flags &= ~IFF_TX_SKB_SHARING ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 20/73 net: rpl: fix rpl header size calculation
In reply to Greg Kroah-HartmanFrom: Alexander Aring <[email protected]>
[ Upstream commit 4e006c7a6dac0ead4c1bf606000aa90a372fc253 ]
This patch fixes a missing 8 byte for the header size calculation. The ipv6_rpl_srh_size() is used to check a skb_pull() on skb->data which points to skb_transport_header(). Currently we only check on the calculated addresses fields using CmprI and CmprE fields, see:
https://www.rfc-editor.org/rfc/rfc6554#section-3
there is however a missing 8 byte inside the calculation which stands for the fields before the addresses field. Those 8 bytes are represented by sizeof(struct ipv6_rpl_sr_hdr) expression.
--- net/ipv6/rpl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ipv6/rpl.c +2 -1
@@ -32,7 +32,8 @@ static void *ipv6_rpl_segdata_pos(const struct ipv6_rpl_sr_hdr *hdr, int i)size_t ipv6_rpl_srh_size (unsigned char n,unsigned char cmpri,unsigned char cmpre) { -return (n *IPV6_PFXTAIL_LEN (cmpri)) +IPV6_PFXTAIL_LEN (cmpre); +return sizeof (struct ipv6_rpl_sr_hdr ) + (n *IPV6_PFXTAIL_LEN (cmpri)) + +IPV6_PFXTAIL_LEN (cmpre); } void ipv6_rpl_srh_decompress(struct ipv6_rpl_sr_hdr *outhdr,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 21/73 mlxsw: pci: Fix possible crash during initialization
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
[ Upstream commit 1f64757ee2bb22a93ec89b4c71707297e8cca0ba ]
During initialization the driver issues a reset command via its command interface in order to remove previous configuration from the device.
After issuing the reset, the driver waits for 200ms before polling on the "system_status" register using memory-mapped IO until the device reaches a ready state (0x5E). The wait is necessary because the reset command only triggers the reset, but the reset itself happens asynchronously. If the driver starts polling too soon, the read of the "system_status" register will never return and the system will crash [1].
The issue was discovered when the device was flashed with a development firmware version where the reset routine took longer to complete. The issue was fixed in the firmware, but it exposed the fact that the current wait time is borderline.
Fix by increasing the wait time from 200ms to 400ms. With this patch and the buggy firmware version, the issue did not reproduce in 10 reboots whereas without the patch the issue is reproduced quite consistently.
[1]
mce: CPUs not responding to MCE broadcast (may include false positives): 0,4
mce: CPUs not responding to MCE broadcast (may include false positives): 0,4
Kernel panic - not syncing: Timeout: Not all CPUs entered broadcast exception handler
Shutting down cpus with NMI
Kernel Offset: 0x12000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
--- drivers/net/ethernet/mellanox/mlxsw/pci_hw.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlxsw/pci_hw.h +1 -1
@@ -26,7 +26,7 @@#define MLXSW_PCI_CIR_TIMEOUT_MSECS 1000#define MLXSW_PCI_SW_RESET_TIMEOUT_MSECS 900000 -#define MLXSW_PCI_SW_RESET_WAIT_MSECS 200 +#define MLXSW_PCI_SW_RESET_WAIT_MSECS 400#define MLXSW_PCI_FW_READY 0xA1844#define MLXSW_PCI_FW_READY_MASK 0xFFFF#define MLXSW_PCI_FW_READY_MAGIC 0x5E
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 22/73 spi: spi-rockchip: Fix missing unwind goto in rockchip_sfc_probe()
In reply to Greg Kroah-HartmanFrom: Li Lanzhe <[email protected]>
[ Upstream commit 359f5b0d4e26b7a7bcc574d6148b31a17cefe47d ]
If devm_request_irq() fails, then we are directly return 'ret' without clk_disable_unprepare(sfc->clk) and clk_disable_unprepare(sfc->hclk).
Fix this by changing direct return to a goto 'err_irq'.
--- drivers/spi/spi-rockchip-sfc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-rockchip-sfc.c +1 -1
@@ -634,7 +634,7 @@ static int rockchip_sfc_probe(struct platform_device *pdev)if (ret) {dev_err (dev,"Failed to request irq\n" ); -return ret; + goto err_irq; } ret =rockchip_sfc_init (sfc);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 23/73 bpf: Fix incorrect verifier pruning due to missing register precision taints
In reply to Greg Kroah-HartmanFrom: Daniel Borkmann <[email protected]>
[ Upstream commit 71b547f561247897a0a14f3082730156c0533fed ]
Juan Jose et al reported an issue found via fuzzing where the verifier's pruning logic prematurely marks a program path as safe.
Consider the following program:
0: (b7) r6 = 1024
1: (b7) r7 = 0
2: (b7) r8 = 0
3: (b7) r9 = -2147483648
4: (97) r6 %= 1025
5: (05) goto pc+0
6: (bd) if r6 <= r9 goto pc+2
7: (97) r6 %= 1
8: (b7) r9 = 0
9: (bd) if r6 <= r9 goto pc+1
10: (b7) r6 = 0
11: (b7) r0 = 0
12: (63) *(u32 *)(r10 -4) = r0
13: (18) r4 = 0xffff888103693400 // map_ptr(ks=4,vs=48) 15: (bf) r1 = r4
16: (bf) r2 = r10
17: (07) r2 += -4
18: (85) call bpf_map_lookup_elem#1
19: (55) if r0 != 0x0 goto pc+1
20: (95) exit
21: (77) r6 >>= 10
22: (27) r6 *= 8192
23: (bf) r1 = r0
24: (0f) r0 += r6
25: (79) r3 = *(u64 *)(r0 +0)
26: (7b) *(u64 *)(r1 +0) = r3
27: (95) exit
The verifier treats this as safe, leading to oob read/write access due to an incorrect verifier conclusion:
func#0 @0
0: R1=ctx(off=0,imm=0) R10=fp0
0: (b7) r6 = 1024 ; R6_w=1024 1: (b7) r7 = 0 ; R7_w=0 2: (b7) r8 = 0 ; R8_w=0 3: (b7) r9 = -2147483648 ; R9_w=-2147483648 4: (97) r6 %= 1025 ; R6_w=scalar() 5: (05) goto pc+0 6: (bd) if r6 <= r9 goto pc+2 ; R6_w=scalar(umin=18446744071562067969,var_off=(0xffffffff00000000; 0xffffffff)) R9_w=-2147483648 7: (97) r6 %= 1 ; R6_w=scalar() 8: (b7) r9 = 0 ; R9=0 9: (bd) if r6 <= r9 goto pc+1 ; R6=scalar(umin=1) R9=0 10: (b7) r6 = 0 ; R6_w=0 11: (b7) r0 = 0 ; R0_w=0 12: (63) *(u32 *)(r10 -4) = r0 last_idx 12 first_idx 9 regs=1 stack=0 before 11: (b7) r0 = 0 13: R0_w=0 R10=fp0 fp-8=0000???? 13: (18) r4 = 0xffff8ad3886c2a00 ; R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 15: (bf) r1 = r4 ; R1_w=map_ptr(off=0,ks=4,vs=48,imm=0) R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 16: (bf) r2 = r10 ; R2_w=fp0 R10=fp0 17: (07) r2 += -4 ; R2_w=fp-4 18: (85) call bpf_map_lookup_elem#1 ; R0=map_value_or_null(id=1,off=0,ks=4,vs=48,imm=0) 19: (55) if r0 != 0x0 goto pc+1 ; R0=0
20: (95) exit
from 19 to 21: R0=map_value(off=0,ks=4,vs=48,imm=0) R6=0 R7=0 R8=0 R9=0 R10=fp0 fp-8=mmmm????
21: (77) r6 >>= 10 ; R6_w=0 22: (27) r6 *= 8192 ; R6_w=0 23: (bf) r1 = r0 ; R0=map_value(off=0,ks=4,vs=48,imm=0) R1_w=map_value(off=0,ks=4,vs=48,imm=0)
24: (0f) r0 += r6
last_idx 24 first_idx 19
regs=40 stack=0 before 23: (bf) r1 = r0
regs=40 stack=0 before 22: (27) r6 *= 8192
regs=40 stack=0 before 21: (77) r6 >>= 10
regs=40 stack=0 before 19: (55) if r0 != 0x0 goto pc+1
parent didn't have regs=40 stack=0 marks: R0_rw=map_value_or_null(id=1,off=0,ks=4,vs=48,imm=0) R6_rw=P0 R7=0 R8=0 R9=0 R10=fp0 fp-8=mmmm???? last_idx 18 first_idx 9
regs=40 stack=0 before 18: (85) call bpf_map_lookup_elem#1
regs=40 stack=0 before 17: (07) r2 += -4
regs=40 stack=0 before 16: (bf) r2 = r10
regs=40 stack=0 before 15: (bf) r1 = r4
regs=40 stack=0 before 13: (18) r4 = 0xffff8ad3886c2a00
regs=40 stack=0 before 12: (63) *(u32 *)(r10 -4) = r0
regs=40 stack=0 before 11: (b7) r0 = 0
regs=40 stack=0 before 10: (b7) r6 = 0
25: (79) r3 = *(u64 *)(r0 +0) ; R0_w=map_value(off=0,ks=4,vs=48,imm=0) R3_w=scalar()
26: (7b) *(u64 *)(r1 +0) = r3 ; R1_w=map_value(off=0,ks=4,vs=48,imm=0) R3_w=scalar()
27: (95) exit
from 9 to 11: R1=ctx(off=0,imm=0) R6=0 R7=0 R8=0 R9=0 R10=fp0
11: (b7) r0 = 0 ; R0_w=0
12: (63) *(u32 *)(r10 -4) = r0
last_idx 12 first_idx 11
regs=1 stack=0 before 11: (b7) r0 = 0
13: R0_w=0 R10=fp0 fp-8=0000????
13: (18) r4 = 0xffff8ad3886c2a00 ; R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 15: (bf) r1 = r4 ; R1_w=map_ptr(off=0,ks=4,vs=48,imm=0) R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 16: (bf) r2 = r10 ; R2_w=fp0 R10=fp0 17: (07) r2 += -4 ; R2_w=fp-4
18: (85) call bpf_map_lookup_elem#1
frame 0: propagating r6
last_idx 19 first_idx 11
regs=40 stack=0 before 18: (85) call bpf_map_lookup_elem#1
regs=40 stack=0 before 17: (07) r2 += -4
regs=40 stack=0 before 16: (bf) r2 = r10
regs=40 stack=0 before 15: (bf) r1 = r4
regs=40 stack=0 before 13: (18) r4 = 0xffff8ad3886c2a00
regs=40 stack=0 before 12: (63) *(u32 *)(r10 -4) = r0
regs=40 stack=0 before 11: (b7) r0 = 0
parent didn't have regs=40 stack=0 marks: R1=ctx(off=0,imm=0) R6_r=P0 R7=0 R8=0 R9=0 R10=fp0 last_idx 9 first_idx 9
regs=40 stack=0 before 9: (bd) if r6 <= r9 goto pc+1
parent didn't have regs=40 stack=0 marks: R1=ctx(off=0,imm=0) R6_rw=Pscalar() R7_w=0 R8_w=0 R9_rw=0 R10=fp0 last_idx 8 first_idx 0
regs=40 stack=0 before 8: (b7) r9 = 0
regs=40 stack=0 before 7: (97) r6 %= 1
regs=40 stack=0 before 6: (bd) if r6 <= r9 goto pc+2
regs=40 stack=0 before 5: (05) goto pc+0
regs=40 stack=0 before 4: (97) r6 %= 1025
regs=40 stack=0 before 3: (b7) r9 = -2147483648
regs=40 stack=0 before 2: (b7) r8 = 0
regs=40 stack=0 before 1: (b7) r7 = 0
regs=40 stack=0 before 0: (b7) r6 = 1024
19: safe
frame 0: propagating r6
last_idx 9 first_idx 0
regs=40 stack=0 before 6: (bd) if r6 <= r9 goto pc+2
regs=40 stack=0 before 5: (05) goto pc+0
regs=40 stack=0 before 4: (97) r6 %= 1025
regs=40 stack=0 before 3: (b7) r9 = -2147483648
regs=40 stack=0 before 2: (b7) r8 = 0
regs=40 stack=0 before 1: (b7) r7 = 0
regs=40 stack=0 before 0: (b7) r6 = 1024
from 6 to 9: safe
verification time 110 usec
stack depth 4
processed 36 insns (limit 1000000) max_states_per_insn 0 total_states 3 peak_states 3 mark_read 2
The verifier considers this program as safe by mistakenly pruning unsafe code paths. In the above func#0, code lines 0-10 are of interest. In line 0-3 registers r6 to r9 are initialized with known scalar values. In line 4 the register r6 is reset to an unknown scalar given the verifier does not track modulo operations. Due to this, the verifier can also not determine precisely which branches in line 6 and 9 are taken, therefore it needs to explore them both.
As can be seen, the verifier starts with exploring the false/fall-through paths first. The 'from 19 to 21' path has both r6=0 and r9=0 and the pointer arithmetic on r0 += r6 is therefore considered safe. Given the arithmetic, r6 is correctly marked for precision tracking where backtracking kicks in where it walks back the current path all the way where r6 was set to 0 in the fall-through branch.
Next, the pruning logics pops the path 'from 9 to 11' from the stack. Also here, the state of the registers is the same, that is, r6=0 and r9=0, so that at line 19 the path can be pruned as it is considered safe. It is interesting to note that the conditional in line 9 turned r6 into a more precise state, that is, in the fall-through path at the beginning of line 10, it is R6=scalar(umin=1), and in the branch-taken path (which is analyzed here) at the beginning of line 11, r6 turned into a known const r6=0 as r9=0 prior to that and therefore (unsigned) r6 <= 0 concludes that r6 must be 0 (**):
[...] ; R6_w=scalar()
9: (bd) if r6 <= r9 goto pc+1 ; R6=scalar(umin=1) R9=0
[...]
from 9 to 11: R1=ctx(off=0,imm=0) R6=0 R7=0 R8=0 R9=0 R10=fp0 [...]
The next path is 'from 6 to 9'. The verifier considers the old and current state equivalent, and therefore prunes the search incorrectly. Looking into the two states which are being compared by the pruning logic at line 9, the old state consists of R6_rwD=Pscalar() R9_rwD=0 R10=fp0 and the new state consists of R1=ctx(off=0,imm=0) R6_w=scalar(umax=18446744071562067968) R7_w=0 R8_w=0 R9_w=-2147483648 R10=fp0. While r6 had the reg->precise flag correctly set in the old state, r9 did not. Both r6'es are considered as equivalent given the old one is a superset of the current, more precise one, however, r9's actual values (0 vs 0x80000000) mismatch. Given the old r9 did not have reg->precise flag set, the verifier does not consider the register as contributing to the precision state of r6, and therefore it considered both r9 states as equivalent. However, for this specific pruned path (which is also the actual path taken at runtime), register r6 will be 0x400 and r9 0x80000000 when reaching line 21, thus oob-accessing the map.
The purpose of precision tracking is to initially mark registers (including spilled ones) as imprecise to help verifier's pruning logic finding equivalent states it can then prune if they don't contribute to the program's safety aspects. For example, if registers are used for pointer arithmetic or to pass constant length to a helper, then the verifier sets reg->precise flag and backtracks the BPF program instruction sequence and chain of verifier states to ensure that the given register or stack slot including their dependencies are marked as precisely tracked scalar. This also includes any other registers and slots that contribute to a tracked state of given registers/stack slot. This backtracking relies on recorded jmp_history and is able to traverse entire chain of parent states. This process ends only when all the necessary registers/slots and their transitive dependencies are marked as precise.
The backtrack_insn() is called from the current instruction up to the first instruction, and its purpose is to compute a bitmask of registers and stack slots that need precision tracking in the parent's verifier state. For example, if a current instruction is r6 = r7, then r6 needs precision after this instruction and r7 needs precision before this instruction, that is, in the parent state. Hence for the latter r7 is marked and r6 unmarked.
For the class of jmp/jmp32 instructions, backtrack_insn() today only looks at call and exit instructions and for all other conditionals the masks remain as-is. However, in the given situation register r6 has a dependency on r9 (as described above in **), so also that one needs to be marked for precision tracking. In other words, if an imprecise register influences a precise one, then the imprecise register should also be marked precise. Meaning, in the parent state both dest and src register need to be tracked for precision and therefore the marking must be more conservative by setting reg->precise flag for both. The precision propagation needs to cover both for the conditional: if the src reg was marked but not the dst reg and vice versa.
After the fix the program is correctly rejected:
func#0 @0
0: R1=ctx(off=0,imm=0) R10=fp0
0: (b7) r6 = 1024 ; R6_w=1024 1: (b7) r7 = 0 ; R7_w=0 2: (b7) r8 = 0 ; R8_w=0 3: (b7) r9 = -2147483648 ; R9_w=-2147483648 4: (97) r6 %= 1025 ; R6_w=scalar() 5: (05) goto pc+0 6: (bd) if r6 <= r9 goto pc+2 ; R6_w=scalar(umin=18446744071562067969,var_off=(0xffffffff80000000; 0x7fffffff),u32_min=-2147483648) R9_w=-2147483648 7: (97) r6 %= 1 ; R6_w=scalar() 8: (b7) r9 = 0 ; R9=0 9: (bd) if r6 <= r9 goto pc+1 ; R6=scalar(umin=1) R9=0 10: (b7) r6 = 0 ; R6_w=0 11: (b7) r0 = 0 ; R0_w=0 12: (63) *(u32 *)(r10 -4) = r0 last_idx 12 first_idx 9 regs=1 stack=0 before 11: (b7) r0 = 0 13: R0_w=0 R10=fp0 fp-8=0000???? 13: (18) r4 = 0xffff9290dc5bfe00 ; R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 15: (bf) r1 = r4 ; R1_w=map_ptr(off=0,ks=4,vs=48,imm=0) R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 16: (bf) r2 = r10 ; R2_w=fp0 R10=fp0 17: (07) r2 += -4 ; R2_w=fp-4 18: (85) call bpf_map_lookup_elem#1 ; R0=map_value_or_null(id=1,off=0,ks=4,vs=48,imm=0) 19: (55) if r0 != 0x0 goto pc+1 ; R0=0
20: (95) exit
from 19 to 21: R0=map_value(off=0,ks=4,vs=48,imm=0) R6=0 R7=0 R8=0 R9=0 R10=fp0 fp-8=mmmm????
21: (77) r6 >>= 10 ; R6_w=0 22: (27) r6 *= 8192 ; R6_w=0 23: (bf) r1 = r0 ; R0=map_value(off=0,ks=4,vs=48,imm=0) R1_w=map_value(off=0,ks=4,vs=48,imm=0)
24: (0f) r0 += r6
last_idx 24 first_idx 19
regs=40 stack=0 before 23: (bf) r1 = r0
regs=40 stack=0 before 22: (27) r6 *= 8192
regs=40 stack=0 before 21: (77) r6 >>= 10
regs=40 stack=0 before 19: (55) if r0 != 0x0 goto pc+1
parent didn't have regs=40 stack=0 marks: R0_rw=map_value_or_null(id=1,off=0,ks=4,vs=48,imm=0) R6_rw=P0 R7=0 R8=0 R9=0 R10=fp0 fp-8=mmmm???? last_idx 18 first_idx 9
regs=40 stack=0 before 18: (85) call bpf_map_lookup_elem#1
regs=40 stack=0 before 17: (07) r2 += -4
regs=40 stack=0 before 16: (bf) r2 = r10
regs=40 stack=0 before 15: (bf) r1 = r4
regs=40 stack=0 before 13: (18) r4 = 0xffff9290dc5bfe00
regs=40 stack=0 before 12: (63) *(u32 *)(r10 -4) = r0
regs=40 stack=0 before 11: (b7) r0 = 0
regs=40 stack=0 before 10: (b7) r6 = 0
25: (79) r3 = *(u64 *)(r0 +0) ; R0_w=map_value(off=0,ks=4,vs=48,imm=0) R3_w=scalar()
26: (7b) *(u64 *)(r1 +0) = r3 ; R1_w=map_value(off=0,ks=4,vs=48,imm=0) R3_w=scalar()
27: (95) exit
from 9 to 11: R1=ctx(off=0,imm=0) R6=0 R7=0 R8=0 R9=0 R10=fp0
11: (b7) r0 = 0 ; R0_w=0
12: (63) *(u32 *)(r10 -4) = r0
last_idx 12 first_idx 11
regs=1 stack=0 before 11: (b7) r0 = 0
13: R0_w=0 R10=fp0 fp-8=0000????
13: (18) r4 = 0xffff9290dc5bfe00 ; R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 15: (bf) r1 = r4 ; R1_w=map_ptr(off=0,ks=4,vs=48,imm=0) R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 16: (bf) r2 = r10 ; R2_w=fp0 R10=fp0 17: (07) r2 += -4 ; R2_w=fp-4
18: (85) call bpf_map_lookup_elem#1
frame 0: propagating r6
last_idx 19 first_idx 11
regs=40 stack=0 before 18: (85) call bpf_map_lookup_elem#1
regs=40 stack=0 before 17: (07) r2 += -4
regs=40 stack=0 before 16: (bf) r2 = r10
regs=40 stack=0 before 15: (bf) r1 = r4
regs=40 stack=0 before 13: (18) r4 = 0xffff9290dc5bfe00
regs=40 stack=0 before 12: (63) *(u32 *)(r10 -4) = r0
regs=40 stack=0 before 11: (b7) r0 = 0
parent didn't have regs=40 stack=0 marks: R1=ctx(off=0,imm=0) R6_r=P0 R7=0 R8=0 R9=0 R10=fp0 last_idx 9 first_idx 9
regs=40 stack=0 before 9: (bd) if r6 <= r9 goto pc+1
parent didn't have regs=240 stack=0 marks: R1=ctx(off=0,imm=0) R6_rw=Pscalar() R7_w=0 R8_w=0 R9_rw=P0 R10=fp0 last_idx 8 first_idx 0
regs=240 stack=0 before 8: (b7) r9 = 0
regs=40 stack=0 before 7: (97) r6 %= 1
regs=40 stack=0 before 6: (bd) if r6 <= r9 goto pc+2
regs=240 stack=0 before 5: (05) goto pc+0
regs=240 stack=0 before 4: (97) r6 %= 1025
regs=240 stack=0 before 3: (b7) r9 = -2147483648
regs=40 stack=0 before 2: (b7) r8 = 0
regs=40 stack=0 before 1: (b7) r7 = 0
regs=40 stack=0 before 0: (b7) r6 = 1024
19: safe
from 6 to 9: R1=ctx(off=0,imm=0) R6_w=scalar(umax=18446744071562067968) R7_w=0 R8_w=0 R9_w=-2147483648 R10=fp0 9: (bd) if r6 <= r9 goto pc+1
last_idx 9 first_idx 0
regs=40 stack=0 before 6: (bd) if r6 <= r9 goto pc+2
regs=240 stack=0 before 5: (05) goto pc+0
regs=240 stack=0 before 4: (97) r6 %= 1025
regs=240 stack=0 before 3: (b7) r9 = -2147483648
regs=40 stack=0 before 2: (b7) r8 = 0
regs=40 stack=0 before 1: (b7) r7 = 0
regs=40 stack=0 before 0: (b7) r6 = 1024
last_idx 9 first_idx 0
regs=200 stack=0 before 6: (bd) if r6 <= r9 goto pc+2
regs=240 stack=0 before 5: (05) goto pc+0
regs=240 stack=0 before 4: (97) r6 %= 1025
regs=240 stack=0 before 3: (b7) r9 = -2147483648
regs=40 stack=0 before 2: (b7) r8 = 0
regs=40 stack=0 before 1: (b7) r7 = 0
regs=40 stack=0 before 0: (b7) r6 = 1024
11: R6=scalar(umax=18446744071562067968) R9=-2147483648
11: (b7) r0 = 0 ; R0_w=0
12: (63) *(u32 *)(r10 -4) = r0
last_idx 12 first_idx 11
regs=1 stack=0 before 11: (b7) r0 = 0
13: R0_w=0 R10=fp0 fp-8=0000????
13: (18) r4 = 0xffff9290dc5bfe00 ; R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 15: (bf) r1 = r4 ; R1_w=map_ptr(off=0,ks=4,vs=48,imm=0) R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 16: (bf) r2 = r10 ; R2_w=fp0 R10=fp0 17: (07) r2 += -4 ; R2_w=fp-4 18: (85) call bpf_map_lookup_elem#1 ; R0_w=map_value_or_null(id=3,off=0,ks=4,vs=48,imm=0) 19: (55) if r0 != 0x0 goto pc+1 ; R0_w=0
20: (95) exit
from 19 to 21: R0=map_value(off=0,ks=4,vs=48,imm=0) R6=scalar(umax=18446744071562067968) R7=0 R8=0 R9=-2147483648 R10=fp0 fp-8=mmmm????
21: (77) r6 >>= 10 ; R6_w=scalar(umax=18014398507384832,var_off=(0x0; 0x3fffffffffffff)) 22: (27) r6 *= 8192 ; R6_w=scalar(smax=9223372036854767616,umax=18446744073709543424,var_off=(0x0; 0xffffffffffffe000),s32_max=2147475456,u32_max=-8192) 23: (bf) r1 = r0 ; R0=map_value(off=0,ks=4,vs=48,imm=0) R1_w=map_value(off=0,ks=4,vs=48,imm=0)
24: (0f) r0 += r6
last_idx 24 first_idx 21
regs=40 stack=0 before 23: (bf) r1 = r0
regs=40 stack=0 before 22: (27) r6 *= 8192
regs=40 stack=0 before 21: (77) r6 >>= 10
parent didn't have regs=40 stack=0 marks: R0_rw=map_value(off=0,ks=4,vs=48,imm=0) R6_r=Pscalar(umax=18446744071562067968) R7=0 R8=0 R9=-2147483648 R10=fp0 fp-8=mmmm???? last_idx 19 first_idx 11
regs=40 stack=0 before 19: (55) if r0 != 0x0 goto pc+1
regs=40 stack=0 before 18: (85) call bpf_map_lookup_elem#1
regs=40 stack=0 before 17: (07) r2 += -4
regs=40 stack=0 before 16: (bf) r2 = r10
regs=40 stack=0 before 15: (bf) r1 = r4
regs=40 stack=0 before 13: (18) r4 = 0xffff9290dc5bfe00
regs=40 stack=0 before 12: (63) *(u32 *)(r10 -4) = r0
regs=40 stack=0 before 11: (b7) r0 = 0
parent didn't have regs=40 stack=0 marks: R1=ctx(off=0,imm=0) R6_rw=Pscalar(umax=18446744071562067968) R7_w=0 R8_w=0 R9_w=-2147483648 R10=fp0 last_idx 9 first_idx 0
regs=40 stack=0 before 9: (bd) if r6 <= r9 goto pc+1
regs=240 stack=0 before 6: (bd) if r6 <= r9 goto pc+2
regs=240 stack=0 before 5: (05) goto pc+0
regs=240 stack=0 before 4: (97) r6 %= 1025
regs=240 stack=0 before 3: (b7) r9 = -2147483648
regs=40 stack=0 before 2: (b7) r8 = 0
regs=40 stack=0 before 1: (b7) r7 = 0
regs=40 stack=0 before 0: (b7) r6 = 1024
math between map_value pointer and register with unbounded min value is not allowed
verification time 886 usec
stack depth 4
processed 49 insns (limit 1000000) max_states_per_insn 1 total_states 5 peak_states 5 mark_read 2
--- kernel/bpf/verifier.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
kernel/bpf/verifier.c +15 -0
@@ -2279,6 +2279,21 @@ static int backtrack_insn(struct bpf_verifier_env *env, int idx, } }else if (opcode ==BPF_EXIT ) {return -ENOTSUPP ; + }else if (BPF_SRC (insn->code) ==BPF_X ) { +if (!(*reg_mask & (dreg | sreg))) +return 0 ; +/* dreg <cond> sreg +* Both dreg and sreg need precision before +* this insn. If only sreg was marked precise +* before it would be equally necessary to +* propagate it to dreg. +*/ + *reg_mask |= (sreg | dreg); +/* else dreg <cond> K +* Only dreg still needs precision before +* this insn, so for the K-based conditional +* there is nothing new to be marked. +*/ } }else if (class ==BPF_LD ) {if (!(*reg_mask & dreg))
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 24/73 e1000e: Disable TSO on i219-LM card to increase speed
In reply to Greg Kroah-HartmanFrom: Sebastian Basierski <[email protected]>
[ Upstream commit 67d47b95119ad589b0a0b16b88b1dd9a04061ced ]
While using i219-LM card currently it was only possible to achieve about 60% of maximum speed due to regression introduced in Linux 5.8. This was caused by TSO not being disabled by default despite commit f29801030ac6 ("e1000e: Disable TSO for buffer overrun workaround"). Fix that by disabling TSO during driver probe.
--- drivers/net/ethernet/intel/e1000e/netdev.c | 51 +++++++++++----------- 1 file changed, 26 insertions(+), 25 deletions(-)
drivers/net/ethernet/intel/e1000e/netdev.c +26 -25
@@ -5298,31 +5298,6 @@ static void e1000_watchdog_task(struct work_struct *work)ew32 (TARC (0 ), tarc0); } -/* disable TSO for pcie and 10/100 speeds, to avoid -* some hardware issues -*/ -if (!(adapter->flags &FLAG_TSO_FORCE )) { -switch (adapter->link_speed) { -case SPEED_10 : -case SPEED_100 : -e_info ("10/100 speed: disabling TSO\n" ); - netdev->features &= ~NETIF_F_TSO ; - netdev->features &= ~NETIF_F_TSO6 ; -break ; -case SPEED_1000 : - netdev->features |=NETIF_F_TSO ; - netdev->features |=NETIF_F_TSO6 ; -break ; -default : -/* oops */ -break ; - } -if (hw->mac.type == e1000_pch_spt) { - netdev->features &= ~NETIF_F_TSO ; - netdev->features &= ~NETIF_F_TSO6 ; - } - } -/* enable transmits in the hardware, need to do this * after setting TARC(0) */
@@ -7543,6 +7518,32 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent)NETIF_F_RXCSUM | NETIF_F_HW_CSUM); +/* disable TSO for pcie and 10/100 speeds to avoid +* some hardware issues and for i219 to fix transfer +* speed being capped at 60% +*/ +if (!(adapter->flags &FLAG_TSO_FORCE )) { +switch (adapter->link_speed) { +case SPEED_10 : +case SPEED_100 : +e_info ("10/100 speed: disabling TSO\n" ); + netdev->features &= ~NETIF_F_TSO ; + netdev->features &= ~NETIF_F_TSO6 ; +break ; +case SPEED_1000 : + netdev->features |=NETIF_F_TSO ; + netdev->features |=NETIF_F_TSO6 ; +break ; +default : +/* oops */ +break ; + } +if (hw->mac.type == e1000_pch_spt) { + netdev->features &= ~NETIF_F_TSO ; + netdev->features &= ~NETIF_F_TSO6 ; + } + } +/* Set user-changeable features (subset of all device features) */ netdev->hw_features = netdev->features; netdev->hw_features |=NETIF_F_RXFCS ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 25/73 f2fs: Fix f2fs_truncate_partial_nodes ftrace event
In reply to Greg Kroah-HartmanFrom: Douglas Raillard <[email protected]>
[ Upstream commit 0b04d4c0542e8573a837b1d81b94209e48723b25 ]
Fix the nid_t field so that its size is correctly reported in the text format embedded in trace.dat files. As it stands, it is reported as being of size 4:
field:nid_t nid[3]; offset:24; size:4; signed:0;
Instead of 12:
field:nid_t nid[3]; offset:24; size:12; signed:0;
This also fixes the reported offset of subsequent fields so that they match with the actual struct layout.
--- include/trace/events/f2fs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/trace/events/f2fs.h +1 -1
@@ -513,7 +513,7 @@ TRACE_EVENT(f2fs_truncate_partial_nodes,TP_STRUCT__entry (__field (dev_t ,dev )__field (ino_t, ino) - __field(nid_t, nid[3]) +__array (nid_t, nid,3 )__field (int, depth)__field (int, err) ),
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 26/73 Input: i8042 - add quirk for Fujitsu Lifebook A574/H
In reply to Greg Kroah-HartmanFrom: Jonathan Denose <[email protected]>
[ Upstream commit f5bad62f9107b701a6def7cac1f5f65862219b83 ]
Fujitsu Lifebook A574/H requires the nomux option to properly probe the touchpad, especially when waking from sleep.
--- drivers/input/serio/i8042-x86ia64io.h | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/input/serio/i8042-x86ia64io.h +8 -0
@@ -601,6 +601,14 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { }, .driver_data = (void *)(SERIO_QUIRK_NOMUX) }, + { +/* Fujitsu Lifebook A574/H */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), + DMI_MATCH(DMI_PRODUCT_NAME, "FMVA0501PZ"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) + }, {/* Gigabyte M912 */ .matches = {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 27/73 platform/x86 (gigabyte-wmi): Add support for A320M-S2H V2
In reply to Greg Kroah-HartmanFrom: Frank Crawford <[email protected]>
[ Upstream commit b7c994f8c35e916e27c60803bb21457bc1373500 ]
Add support for A320M-S2H V2. Tested using module force_load option.
--- drivers/platform/x86/gigabyte-wmi.c | 1 + 1 file changed, 1 insertion(+)
drivers/platform/x86/gigabyte-wmi.c +1 -0
@@ -140,6 +140,7 @@ static u8 gigabyte_wmi_detect_sensor_usability(struct wmi_device *wdev) }}static const struct dmi_system_id gigabyte_wmi_known_working_platforms[] = { +DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME ("A320M-S2H V2-CF" ),DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME ("B450M DS3H-CF" ),DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME ("B450M DS3H WIFI-CF" ),DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME ("B450M S2H V2" ),
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 28/73 selftests: sigaltstack: fix -Wuninitialized
In reply to Greg Kroah-HartmanFrom: Nick Desaulniers <[email protected]>
[ Upstream commit 05107edc910135d27fe557267dc45be9630bf3dd ]
Building sigaltstack with clang via:
$ ARCH=x86 make LLVM=1 -C tools/testing/selftests/sigaltstack/
produces the following warning:
warning: variable 'sp' is uninitialized when used here [-Wuninitialized] if (sp < (unsigned long)sstack ||
^~
Clang expects these to be declared at global scope; we've fixed this in the kernel proper by using the macro current_stack_pointer. This is defined in different headers for different target architectures, so just create a new header that defines the arch-specific register names for the stack pointer register, and define it for more targets (at least the ones that support current_stack_pointer/ARCH_HAS_CURRENT_STACK_POINTER).
--- .../sigaltstack/current_stack_pointer.h | 23 +++++++++++++++++++ tools/testing/selftests/sigaltstack/sas.c | 7 +----- 2 files changed, 24 insertions(+), 6 deletions(-) create mode 100644 tools/testing/selftests/sigaltstack/current_stack_pointer.h
tools/testing/selftests/sigaltstack/current_stack_pointer.h new file +23 -0
@@ -0,0 +1,23 @@ +/* SPDX-License-Identifier: GPL-2.0 */ + +#if __alpha__ +registerunsigned long sp asm("$30" ); +#elif __arm__ || __aarch64__ || __csky__ || __m68k__ || __mips__ || __riscv +registerunsigned long sp asm("sp" ); +#elif __i386__ +registerunsigned long sp asm("esp" ); +#elif __loongarch64 +registerunsigned long sp asm("$sp" ); +#elif __ppc__ +registerunsigned long sp asm("r1" ); +#elif __s390x__ +registerunsigned long sp asm("%15" ); +#elif __sh__ +registerunsigned long sp asm("r15" ); +#elif __x86_64__ +registerunsigned long sp asm("rsp" ); +#elif __XTENSA__ +registerunsigned long sp asm("a1" ); +#else +#error "implement current_stack_pointer equivalent" +#endif
tools/testing/selftests/sigaltstack/sas.c +1 -6
@@ -20,6 +20,7 @@#include <sys/auxv.h> #include "../kselftest.h" +#include "current_stack_pointer.h" #ifndef SS_AUTODISARM #define SS_AUTODISARM (1U << 31)
@@ -46,12 +47,6 @@ void my_usr1(int sig, siginfo_t *si, void *u)stack_t stk;struct stk_data *p; -#if __s390x__ - registerunsigned long sp asm("%15" ); -#else - registerunsigned long sp asm("sp" ); -#endif -if (sp < (unsigned long )sstack || sp >= (unsigned long )sstack + stack_size) {ksft_exit_fail_msg ("SP is not on sigaltstack\n" );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 29/73 scsi: megaraid_sas: Fix fw_crash_buffer_show()
In reply to Greg Kroah-HartmanFrom: Tomas Henzl <[email protected]>
[ Upstream commit 0808ed6ebbc292222ca069d339744870f6d801da ]
If crash_dump_buf is not allocated then crash dump can't be available. Replace logical 'and' with 'or'.
--- drivers/scsi/megaraid/megaraid_sas_base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/megaraid/megaraid_sas_base.c +1 -1
@@ -3302,7 +3302,7 @@ fw_crash_buffer_show(struct device *cdev,spin_lock_irqsave (&instance->crashdump_lock, flags); buff_offset = instance->fw_crash_buffer_offset; -if (!instance->crash_dump_buf && +if (!instance->crash_dump_buf || !((instance->fw_crash_state ==AVAILABLE ) || (instance->fw_crash_state ==COPYING ))) { dev_err(&instance->pdev->dev,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 30/73 scsi: core: Improve scsi_vpd_inquiry() checks
In reply to Greg Kroah-HartmanFrom: Damien Le Moal <[email protected]>
[ Upstream commit f0aa59a33d2ac2267d260fe21eaf92500df8e7b4 ]
Some USB-SATA adapters have broken behavior when an unsupported VPD page is
probed: Depending on the VPD page number, a 4-byte header with a valid VPD page number but with a 0 length is returned. Currently, scsi_vpd_inquiry() only checks that the page number is valid to determine if the page is valid, which results in receiving only the 4-byte header for the non-existent page. This error manifests itself very often with page 0xb9 for the Concurrent Positioning Ranges detection done by sd_read_cpr(), resulting in the following error message:
sd 0:0:0:0: [sda] Invalid Concurrent Positioning Ranges VPD page
Prevent such misleading error message by adding a check in scsi_vpd_inquiry() to verify that the page length is not 0.
--- drivers/scsi/scsi.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/scsi/scsi.c +9 -2
@@ -323,11 +323,18 @@ static int scsi_vpd_inquiry(struct scsi_device *sdev, unsigned char *buffer,if (result)return -EIO ; -/* Sanity check that we got the page back that we asked for */ +/* +* Sanity check that we got the page back that we asked for and that +* the page size is not 0. +*/ if (buffer[1 ] != page)return -EIO ; -return get_unaligned_be16 (&buffer[2 ]) +4 ; + result =get_unaligned_be16 (&buffer[2 ]); +if (!result) +return -EIO ; + +return result +4 ; }/**
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 31/73 net: dsa: b53: mmap: add phy ops
In reply to Greg Kroah-HartmanFrom: Álvaro Fernández Rojas <[email protected]>
[ Upstream commit 45977e58ce65ed0459edc9a0466d9dfea09463f5 ]
Implement phy_read16() and phy_write16() ops for B53 MMAP to avoid accessing B53_PORT_MII_PAGE registers which hangs the device.
This access should be done through the MDIO Mux bus controller.
--- drivers/net/dsa/b53/b53_mmap.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/net/dsa/b53/b53_mmap.c +14 -0
@@ -216,6 +216,18 @@ static int b53_mmap_write64(struct b53_device *dev, u8 page, u8 reg,return 0 ; } +static int b53_mmap_phy_read16 (struct b53_device *dev,int addr,int reg, +u16 *value) +{ +return -EIO ; +} + +static int b53_mmap_phy_write16 (struct b53_device *dev,int addr,int reg, +u16 value) +{ +return -EIO ; +} +static const struct b53_io_ops b53_mmap_ops = { .read8 = b53_mmap_read8, .read16 = b53_mmap_read16,
@@ -227,6 +239,8 @@ static const struct b53_io_ops b53_mmap_ops = { .write32 = b53_mmap_write32, .write48 = b53_mmap_write48, .write64 = b53_mmap_write64, + .phy_read16 = b53_mmap_phy_read16, + .phy_write16 = b53_mmap_phy_write16, }; static int b53_mmap_probe_of(struct platform_device *pdev,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 32/73 s390/ptrace: fix PTRACE_GET_LAST_BREAK error handling
In reply to Greg Kroah-HartmanFrom: Heiko Carstens <[email protected]>
[ Upstream commit f9bbf25e7b2b74b52b2f269216a92657774f239c ]
Return -EFAULT if put_user() for the PTRACE_GET_LAST_BREAK request fails, instead of silently ignoring it.
--- arch/s390/kernel/ptrace.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
arch/s390/kernel/ptrace.c +2 -6
@@ -481,9 +481,7 @@ long arch_ptrace(struct task_struct *child, long request, }return 0 ;case PTRACE_GET_LAST_BREAK : -put_user (child->thread.last_break, - (unsigned long __user *) data); -return 0 ; +return put_user (child->thread.last_break, (unsigned long __user *)data);case PTRACE_ENABLE_TE :if (!MACHINE_HAS_TE )return -EIO ;
@@ -837,9 +835,7 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request, }return 0 ;case PTRACE_GET_LAST_BREAK : -put_user (child->thread.last_break, - (unsigned int __user *) data); -return 0 ; +return put_user (child->thread.last_break, (unsigned int __user *)data); }return compat_ptrace_request (child, request, addr, data); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 33/73 nvme-tcp: fix a possible UAF when failing to allocate an io queue
In reply to Greg Kroah-HartmanFrom: Sagi Grimberg <[email protected]>
[ Upstream commit 88eaba80328b31ef81813a1207b4056efd7006a6 ]
When we allocate a nvme-tcp queue, we set the data_ready callback before we actually need to use it. This creates the potential that if a stray controller sends us data on the socket before we connect, we can trigger the io_work and start consuming the socket.
In this case reported: we failed to allocate one of the io queues, and as we start releasing the queues that we already allocated, we get a UAF [1] from the io_work which is running before it should really.
Fix this by setting the socket ops callbacks only before we start the queue, so that we can't accidentally schedule the io_work in the initialization phase before the queue started. While we are at it, rename nvme_tcp_restore_sock_calls to pair with nvme_tcp_setup_sock_ops.
[1]:
[16802.107284] nvme nvme4: starting error recovery [16802.109166] nvme nvme4: Reconnecting in 10 seconds... [16812.173535] nvme nvme4: failed to connect socket: -111 [16812.173745] nvme nvme4: Failed reconnect attempt 1 [16812.173747] nvme nvme4: Reconnecting in 10 seconds... [16822.413555] nvme nvme4: failed to connect socket: -111 [16822.413762] nvme nvme4: Failed reconnect attempt 2 [16822.413765] nvme nvme4: Reconnecting in 10 seconds... [16832.661274] nvme nvme4: creating 32 I/O queues. [16833.919887] BUG: kernel NULL pointer dereference, address: 0000000000000088 [16833.920068] nvme nvme4: Failed reconnect attempt 3 [16833.920094] #PF: supervisor write access in kernel mode [16833.920261] nvme nvme4: Reconnecting in 10 seconds... [16833.920368] #PF: error_code(0x0002) - not-present page [16833.921086] Workqueue: nvme_tcp_wq nvme_tcp_io_work [nvme_tcp] [16833.921191] RIP: 0010:_raw_spin_lock_bh+0x17/0x30 ... [16833.923138] Call Trace: [16833.923271] <TASK> [16833.923402] lock_sock_nested+0x1e/0x50 [16833.923545] nvme_tcp_try_recv+0x40/0xa0 [nvme_tcp] [16833.923685] nvme_tcp_io_work+0x68/0xa0 [nvme_tcp] [16833.923824] process_one_work+0x1e8/0x390 [16833.923969] worker_thread+0x53/0x3d0 [16833.924104] ? process_one_work+0x390/0x390 [16833.924240] kthread+0x124/0x150 [16833.924376] ? set_kthread_struct+0x50/0x50 [16833.924518] ret_from_fork+0x1f/0x30 [16833.924655] </TASK>
--- drivers/nvme/host/tcp.c | 46 +++++++++++++++++++++++------------------ 1 file changed, 26 insertions(+), 20 deletions(-)
drivers/nvme/host/tcp.c +26 -20
@@ -1563,22 +1563,7 @@ static int nvme_tcp_alloc_queue(struct nvme_ctrl *nctrl,if (ret) goto err_init_connect; - queue->rd_enabled = true;set_bit (NVME_TCP_Q_ALLOCATED , &queue->flags); -nvme_tcp_init_recv_ctx (queue); - -write_lock_bh (&queue->sock->sk->sk_callback_lock); - queue->sock->sk->sk_user_data = queue; - queue->state_change = queue->sock->sk->sk_state_change; - queue->data_ready = queue->sock->sk->sk_data_ready; - queue->write_space = queue->sock->sk->sk_write_space; - queue->sock->sk->sk_data_ready = nvme_tcp_data_ready; - queue->sock->sk->sk_state_change = nvme_tcp_state_change; - queue->sock->sk->sk_write_space = nvme_tcp_write_space; -#ifdef CONFIG_NET_RX_BUSY_POLL - queue->sock->sk->sk_ll_usec =1 ; -#endif -write_unlock_bh (&queue->sock->sk->sk_callback_lock);return 0 ;
@@ -1598,7 +1583,7 @@ static int nvme_tcp_alloc_queue(struct nvme_ctrl *nctrl,return ret; } -static void nvme_tcp_restore_sock_calls (struct nvme_tcp_queue *queue) +static void nvme_tcp_restore_sock_ops (struct nvme_tcp_queue *queue) {struct socket *sock = queue->sock;
@@ -1613,7 +1598,7 @@ static void nvme_tcp_restore_sock_calls(struct nvme_tcp_queue *queue)static void __nvme_tcp_stop_queue (struct nvme_tcp_queue *queue) {kernel_sock_shutdown (queue->sock,SHUT_RDWR ); -nvme_tcp_restore_sock_calls (queue); +nvme_tcp_restore_sock_ops (queue);cancel_work_sync (&queue->io_work); }
@@ -1628,21 +1613,42 @@ static void nvme_tcp_stop_queue(struct nvme_ctrl *nctrl, int qid)mutex_unlock (&queue->queue_lock); } +static void nvme_tcp_setup_sock_ops (struct nvme_tcp_queue *queue) +{ +write_lock_bh (&queue->sock->sk->sk_callback_lock); + queue->sock->sk->sk_user_data = queue; + queue->state_change = queue->sock->sk->sk_state_change; + queue->data_ready = queue->sock->sk->sk_data_ready; + queue->write_space = queue->sock->sk->sk_write_space; + queue->sock->sk->sk_data_ready = nvme_tcp_data_ready; + queue->sock->sk->sk_state_change = nvme_tcp_state_change; + queue->sock->sk->sk_write_space = nvme_tcp_write_space; +#ifdef CONFIG_NET_RX_BUSY_POLL + queue->sock->sk->sk_ll_usec =1 ; +#endif +write_unlock_bh (&queue->sock->sk->sk_callback_lock); +} +static int nvme_tcp_start_queue (struct nvme_ctrl *nctrl,int idx) {struct nvme_tcp_ctrl *ctrl =to_tcp_ctrl (nctrl); +struct nvme_tcp_queue *queue = &ctrl->queues[idx];int ret; + queue->rd_enabled = true; +nvme_tcp_init_recv_ctx (queue); +nvme_tcp_setup_sock_ops (queue); +if (idx) ret =nvmf_connect_io_queue (nctrl, idx);else ret =nvmf_connect_admin_queue (nctrl);if (!ret) { -set_bit (NVME_TCP_Q_LIVE , &ctrl->queues[idx].flags); +set_bit (NVME_TCP_Q_LIVE , &queue->flags); }else { -if (test_bit (NVME_TCP_Q_ALLOCATED , &ctrl->queues[idx].flags)) -__nvme_tcp_stop_queue (&ctrl->queues[idx]); +if (test_bit (NVME_TCP_Q_ALLOCATED , &queue->flags)) +__nvme_tcp_stop_queue (queue);dev_err (nctrl->device,"failed to connect queue: %d ret=%d\n" , idx, ret); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 34/73 xen/netback: use same error messages for same errors
In reply to Greg Kroah-HartmanFrom: Juergen Gross <[email protected]>
[ Upstream commit 2eca98e5b24d01c02b46c67be05a5f98cc9789b1 ]
Issue the same error message in case an illegal page boundary crossing has been detected in both cases where this is tested.
--- drivers/net/xen-netback/netback.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/xen-netback/netback.c +2 -4
@@ -996,10 +996,8 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,/* No crossing a page as the payload mustn't fragment. */ if (unlikely ((txreq.offset + txreq.size) >XEN_PAGE_SIZE )) { -netdev_err (queue->vif->dev, -"txreq.offset: %u, size: %u, end: %lu\n" , - txreq.offset, txreq.size, - (unsigned long )(txreq.offset&~XEN_PAGE_MASK ) + txreq.size); +netdev_err (queue->vif->dev,"Cross page boundary, txreq.offset: %u, size: %u\n" , + txreq.offset, txreq.size);xenvif_fatal_tx_err (queue->vif);break ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 35/73 platform/x86: gigabyte-wmi: add support for X570S AORUS ELITE
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 52f91e51944808d83dfe2d5582601b5e84e472cc ]
Add "X570S AORUS ELITE" to known working boards
--- drivers/platform/x86/gigabyte-wmi.c | 1 + 1 file changed, 1 insertion(+)
drivers/platform/x86/gigabyte-wmi.c +1 -0
@@ -156,6 +156,7 @@ static const struct dmi_system_id gigabyte_wmi_known_working_platforms[] = {DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME ("X570 GAMING X" ),DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME ("X570 I AORUS PRO WIFI" ),DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME ("X570 UD" ), +DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME ("X570S AORUS ELITE" ), DMI_EXACT_MATCH_GIGABYTE_BOARD_NAME("Z690M AORUS ELITE AX DDR4"), { } };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 36/73 rtmutex: Add acquire semantics for rtmutex lock acquisition slow path
In reply to Greg Kroah-HartmanFrom: Mel Gorman <[email protected]>
commit 1c0908d8e441631f5b8ba433523cf39339ee2ba0 upstream.
Jan Kara reported the following bug triggering on 6.0.5-rt14 running dbench on XFS on arm64.
kernel BUG at fs/inode.c:625!
Internal error: Oops - BUG: 0 [#1] PREEMPT_RT SMP CPU: 11 PID: 6611 Comm: dbench Tainted: G E 6.0.0-rt14-rt+ #1 pc : clear_inode+0xa0/0xc0 lr : clear_inode+0x38/0xc0 Call trace: clear_inode+0xa0/0xc0 evict+0x160/0x180 iput+0x154/0x240 do_unlinkat+0x184/0x300 __arm64_sys_unlinkat+0x48/0xc0 el0_svc_common.constprop.4+0xe4/0x2c0 do_el0_svc+0xac/0x100 el0_svc+0x78/0x200 el0t_64_sync_handler+0x9c/0xc0 el0t_64_sync+0x19c/0x1a0
It also affects 6.1-rc7-rt5 and affects a preempt-rt fork of 5.14 so this is likely a bug that existed forever and only became visible when ARM support was added to preempt-rt. The same problem does not occur on x86-64 and he also reported that converting sb->s_inode_wblist_lock to raw_spinlock_t makes the problem disappear indicating that the RT spinlock variant is the problem.
Which in turn means that RT mutexes on ARM64 and any other weakly ordered architecture are affected by this independent of RT.
Will Deacon observed:
"I'd be more inclined to be suspicious of the slowpath tbh, as we need to
make sure that we have acquire semantics on all paths where the lock can be taken. Looking at the rtmutex code, this really isn't obvious to me -- for example, try_to_take_rt_mutex() appears to be able to return via the 'takeit' label without acquire semantics and it looks like we might be relying on the caller's subsequent _unlock_ of the wait_lock for ordering, but that will give us release semantics which aren't correct."
Sebastian Andrzej Siewior prototyped a fix that does work based on that comment but it was a little bit overkill and added some fences that should not be necessary.
The lock owner is updated with an IRQ-safe raw spinlock held, but the spin_unlock does not provide acquire semantics which are needed when acquiring a mutex.
Adds the necessary acquire semantics for lock owner updates in the slow path acquisition and the waiter bit logic.
It successfully completed 10 iterations of the dbench workload while the vanilla kernel fails on the first iteration.
[ [email protected]: Initial prototype fix ]
--- kernel/locking/rtmutex.c | 55 +++++++++++++++++++++++++++++++++++-------- kernel/locking/rtmutex_api.c | 6 ++-- 2 files changed, 49 insertions(+), 12 deletions(-)
kernel/locking/rtmutex.c +46 -9
@@ -87,15 +87,31 @@ static inline int __ww_mutex_check_kill(* set this bit before looking at the lock. */ -static __always_inline void -rt_mutex_set_owner (struct rt_mutex_base *lock,struct task_struct *owner) +static __always_inline struct task_struct * +rt_mutex_owner_encode (struct rt_mutex_base *lock,struct task_struct *owner) {unsigned long val = (unsigned long )owner;if (rt_mutex_has_waiters (lock)) val |=RT_MUTEX_HAS_WAITERS ; -WRITE_ONCE (lock->owner, (struct task_struct *)val); +return (struct task_struct *)val; +} + +static __always_inline void +rt_mutex_set_owner (struct rt_mutex_base *lock,struct task_struct *owner) +{ +/* +* lock->wait_lock is held but explicit acquire semantics are needed +* for a new lock owner so WRITE_ONCE is insufficient. +*/ +xchg_acquire (&lock->owner,rt_mutex_owner_encode (lock, owner)); +} + +static __always_inline void rt_mutex_clear_owner(struct rt_mutex_base *lock) +{ +/* lock->wait_lock is held so the unlock provides release semantics. */ +WRITE_ONCE (lock->owner,rt_mutex_owner_encode (lock,NULL )); } static __always_inline void clear_rt_mutex_waiters(struct rt_mutex_base *lock)
@@ -104,7 +120,8 @@ static __always_inline void clear_rt_mut ((unsigned long )lock->owner & ~RT_MUTEX_HAS_WAITERS ); } -static __always_inline void fixup_rt_mutex_waiters(struct rt_mutex_base *lock) +static __always_inline void +fixup_rt_mutex_waiters (struct rt_mutex_base *lock,bool acquire_lock) {unsigned long owner, *p = (unsigned long *) &lock->owner;
@@ -170,8 +187,21 @@ static __always_inline void fixup_rt_mut* still set. */ owner =READ_ONCE (*p); -if (owner &RT_MUTEX_HAS_WAITERS ) -WRITE_ONCE (*p, owner & ~RT_MUTEX_HAS_WAITERS ); +if (owner &RT_MUTEX_HAS_WAITERS ) { +/* +* See rt_mutex_set_owner() and rt_mutex_clear_owner() on +* why xchg_acquire() is used for updating owner for +* locking and WRITE_ONCE() for unlocking. +* +* WRITE_ONCE() would work for the acquire case too, but +* in case that the lock acquisition failed it might +* force other lockers into the slow path unnecessarily. +*/ +if (acquire_lock) +xchg_acquire (p, owner & ~RT_MUTEX_HAS_WAITERS ); +else +WRITE_ONCE (*p, owner & ~RT_MUTEX_HAS_WAITERS ); + } }/*
@@ -206,6 +236,13 @@ static __always_inline void mark_rt_mute owner = *p; }while (cmpxchg_relaxed (p, owner, owner |RT_MUTEX_HAS_WAITERS ) != owner); + +/* +* The cmpxchg loop above is relaxed to avoid back-to-back ACQUIRE +* operations in the event of contention. Ensure the successful +* cmpxchg is visible. +*/ +smp_mb__after_atomic (); }/*
@@ -1232,7 +1269,7 @@ static int __sched __rt_mutex_slowtryloc* try_to_take_rt_mutex() sets the lock waiters bit * unconditionally. Clean this up. */ -fixup_rt_mutex_waiters (lock); +fixup_rt_mutex_waiters (lock, true);return ret; }
@@ -1592,7 +1629,7 @@ static int __sched __rt_mutex_slowlock(s* try_to_take_rt_mutex() sets the waiter bit * unconditionally. We might have to fix that up. */ -fixup_rt_mutex_waiters (lock); +fixup_rt_mutex_waiters (lock, true);return ret; }
@@ -1702,7 +1739,7 @@ static void __sched rtlock_slowlock_lock* try_to_take_rt_mutex() sets the waiter bit unconditionally. * We might have to fix that up: */ -fixup_rt_mutex_waiters (lock); +fixup_rt_mutex_waiters (lock, true);debug_rt_mutex_free_waiter (&waiter); }
kernel/locking/rtmutex_api.c +3 -3
@@ -245,7 +245,7 @@ void __sched rt_mutex_init_proxy_locked( void __sched rt_mutex_proxy_unlock(struct rt_mutex_base *lock) {debug_rt_mutex_proxy_unlock (lock); -rt_mutex_set_owner (lock,NULL ); +rt_mutex_clear_owner (lock); }/**
@@ -360,7 +360,7 @@ int __sched rt_mutex_wait_proxy_lock(str* try_to_take_rt_mutex() sets the waiter bit unconditionally. We might * have to fix that up. */ -fixup_rt_mutex_waiters (lock); +fixup_rt_mutex_waiters (lock, true);raw_spin_unlock_irq (&lock->wait_lock);return ret;
@@ -416,7 +416,7 @@ bool __sched rt_mutex_cleanup_proxy_lock* try_to_take_rt_mutex() sets the waiter bit unconditionally. We might * have to fix that up. */ -fixup_rt_mutex_waiters (lock); +fixup_rt_mutex_waiters (lock, false);raw_spin_unlock_irq (&lock->wait_lock);
Greg Kroah-Hartman
maintainerPATCH 37/73 iio: light: tsl2772: fix reading proximity-diodes from device tree
In reply to Greg Kroah-HartmanFrom: Brian Masney <[email protected]>
commit b1cb00d51e361cf5af93649917d9790e1623647e upstream.
tsl2772_read_prox_diodes() will correctly parse the properties from device tree to determine which proximity diode(s) to read from, however it didn't actually set this value on the struct tsl2772_settings. Let's go ahead and fix that.
--- drivers/iio/light/tsl2772.c | 1 + 1 file changed, 1 insertion(+)
drivers/iio/light/tsl2772.c +1 -0
@@ -606,6 +606,7 @@ static int tsl2772_read_prox_diodes(strureturn -EINVAL ; } } + chip->settings.prox_diode = prox_diode_mask;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 38/73 nilfs2: initialize unused bytes in segment summary blocks
In reply to Greg Kroah-HartmanFrom: Ryusuke Konishi <[email protected]>
commit ef832747a82dfbc22a3702219cc716f449b24e4a upstream.
Syzbot still reports uninit-value in nilfs_add_checksums_on_logs() for KMSAN enabled kernels after applying commit 7397031622e0 ("nilfs2:
initialize "struct nilfs_binfo_dat"->bi_pad field").
This is because the unused bytes at the end of each block in segment summaries are not initialized. So this fixes the issue by padding the unused bytes with null bytes.
--- fs/nilfs2/segment.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
fs/nilfs2/segment.c +20 -0
@@ -430,6 +430,23 @@ static int nilfs_segctor_reset_segment_breturn 0 ; } +/** +* nilfs_segctor_zeropad_segsum - zero pad the rest of the segment summary area +* @sci: segment constructor object +* +* nilfs_segctor_zeropad_segsum() zero-fills unallocated space at the end of +* the current segment summary block. +*/ +static void nilfs_segctor_zeropad_segsum (struct nilfs_sc_info *sci) +{ +struct nilfs_segsum_pointer *ssp; + + ssp = sci->sc_blk_cnt >0 ? &sci->sc_binfo_ptr : &sci->sc_finfo_ptr; +if (ssp->offset < ssp->bh->b_size) +memset (ssp->bh->b_data + ssp->offset,0 , + ssp->bh->b_size - ssp->offset); +} +static int nilfs_segctor_feed_segment (struct nilfs_sc_info *sci) { sci->sc_nblk_this_inc += sci->sc_curseg->sb_sum.nblocks;
@@ -438,6 +455,7 @@ static int nilfs_segctor_feed_segment(st* The current segment is filled up * (internal code) */ +nilfs_segctor_zeropad_segsum (sci); sci->sc_curseg =NILFS_NEXT_SEGBUF (sci->sc_curseg);return nilfs_segctor_reset_segment_buffer (sci); }
@@ -542,6 +560,7 @@ static int nilfs_segctor_add_file_block( goto retry; }if (unlikely (required)) { +nilfs_segctor_zeropad_segsum (sci); err =nilfs_segbuf_extend_segsum (segbuf);if (unlikely (err)) goto failed;
@@ -1531,6 +1550,7 @@ static int nilfs_segctor_collect(struct nadd =min_t (int, nadd <<1 ,SC_MAX_SEGDELTA ); sci->sc_stage = prev_stage; } +nilfs_segctor_zeropad_segsum (sci);nilfs_segctor_truncate_segments (sci, sci->sc_curseg, nilfs->ns_sufile);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 39/73 memstick: fix memory leak if card device is never registered
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
commit 4b6d621c9d859ff89e68cebf6178652592676013 upstream.
When calling dev_set_name() memory is allocated for the name for the struct device. Once that structure device is registered, or attempted to be registerd, with the driver core, the driver core will handle cleaning up that memory when the device is removed from the system.
Unfortunatly for the memstick code, there is an error path that causes the struct device to never be registered, and so the memory allocated in dev_set_name will be leaked. Fix that leak by manually freeing it right before the memory for the device is freed.
--- drivers/memstick/core/memstick.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/memstick/core/memstick.c +4 -1
@@ -410,6 +410,7 @@ static struct memstick_dev *memstick_allreturn card; err_out: host->card = old_card; +kfree_const (card->dev.kobj.name);kfree (card);return NULL ; }
@@ -468,8 +469,10 @@ static void memstick_check(struct work_sput_device (&card->dev); host->card =NULL ; } - }else + }else { +kfree_const (card->dev.kobj.name);kfree (card); + } } out_power_off:
Greg Kroah-Hartman
maintainerPATCH 40/73 kernel/sys.c: fix and improve control flow in __sys_setres[ug]id()
In reply to Greg Kroah-HartmanFrom: Ondrej Mosnacek <[email protected]>
commit 659c0ce1cb9efc7f58d380ca4bb2a51ae9e30553 upstream.
Linux Security Modules (LSMs) that implement the "capable" hook will usually emit an access denial message to the audit log whenever they "block" the current task from using the given capability based on their security policy.
The occurrence of a denial is used as an indication that the given task has attempted an operation that requires the given access permission, so the callers of functions that perform LSM permission checks must take care to avoid calling them too early (before it is decided if the permission is actually needed to perform the requested operation).
The __sys_setres[ug]id() functions violate this convention by first calling ns_capable_setid() and only then checking if the operation requires the capability or not. It means that any caller that has the capability granted by DAC (task's capability set) but not by MAC (LSMs) will generate a "denied" audit record, even if is doing an operation for which the capability is not required.
Fix this by reordering the checks such that ns_capable_setid() is checked last and -EPERM is returned immediately if it returns false.
While there, also do two small optimizations:
* move the capability check before prepare_creds() and
* bail out early in case of a no-op.
--- kernel/sys.c | 69 ++++++++++++++++++++++++++++++++++------------------------- 1 file changed, 40 insertions(+), 29 deletions(-)
kernel/sys.c +40 -29
@@ -656,6 +656,7 @@ long __sys_setresuid(uid_t ruid, uid_t estruct cred *new;int retval;kuid_t kruid, keuid, ksuid; +bool ruid_new, euid_new, suid_new; kruid =make_kuid (ns, ruid); keuid =make_kuid (ns, euid);
@@ -670,25 +671,29 @@ long __sys_setresuid(uid_t ruid, uid_t eif ((suid != (uid_t) -1 ) && !uid_valid (ksuid))return -EINVAL ; + old =current_cred (); + +/* check for no-op */ +if ((ruid == (uid_t) -1 ||uid_eq (kruid, old->uid)) && + (euid == (uid_t) -1 || (uid_eq (keuid, old->euid) && +uid_eq (keuid, old->fsuid))) && + (suid == (uid_t) -1 ||uid_eq (ksuid, old->suid))) +return 0 ; + + ruid_new = ruid != (uid_t) -1 && !uid_eq (kruid, old->uid) && + !uid_eq (kruid, old->euid) && !uid_eq (kruid, old->suid); + euid_new = euid != (uid_t) -1 && !uid_eq (keuid, old->uid) && + !uid_eq (keuid, old->euid) && !uid_eq (keuid, old->suid); + suid_new = suid != (uid_t) -1 && !uid_eq (ksuid, old->uid) && + !uid_eq (ksuid, old->euid) && !uid_eq (ksuid, old->suid); +if ((ruid_new || euid_new || suid_new) && + !ns_capable_setid (old->user_ns,CAP_SETUID )) +return -EPERM ; + new =prepare_creds ();if (!new)return -ENOMEM ; - old =current_cred (); - - retval = -EPERM ; -if (!ns_capable_setid (old->user_ns,CAP_SETUID )) { -if (ruid != (uid_t) -1 && !uid_eq (kruid, old->uid) && - !uid_eq (kruid, old->euid) && !uid_eq (kruid, old->suid)) - goto error; -if (euid != (uid_t) -1 && !uid_eq (keuid, old->uid) && - !uid_eq (keuid, old->euid) && !uid_eq (keuid, old->suid)) - goto error; -if (suid != (uid_t) -1 && !uid_eq (ksuid, old->uid) && - !uid_eq (ksuid, old->euid) && !uid_eq (ksuid, old->suid)) - goto error; - } -if (ruid != (uid_t) -1 ) { new->uid = kruid;if (!uid_eq (kruid, old->uid)) {
@@ -753,6 +758,7 @@ long __sys_setresgid(gid_t rgid, gid_t estruct cred *new;int retval;kgid_t krgid, kegid, ksgid; +bool rgid_new, egid_new, sgid_new; krgid =make_kgid (ns, rgid); kegid =make_kgid (ns, egid);
@@ -765,23 +771,28 @@ long __sys_setresgid(gid_t rgid, gid_t eif ((sgid != (gid_t) -1 ) && !gid_valid (ksgid))return -EINVAL ; + old =current_cred (); + +/* check for no-op */ +if ((rgid == (gid_t) -1 ||gid_eq (krgid, old->gid)) && + (egid == (gid_t) -1 || (gid_eq (kegid, old->egid) && +gid_eq (kegid, old->fsgid))) && + (sgid == (gid_t) -1 ||gid_eq (ksgid, old->sgid))) +return 0 ; + + rgid_new = rgid != (gid_t) -1 && !gid_eq (krgid, old->gid) && + !gid_eq (krgid, old->egid) && !gid_eq (krgid, old->sgid); + egid_new = egid != (gid_t) -1 && !gid_eq (kegid, old->gid) && + !gid_eq (kegid, old->egid) && !gid_eq (kegid, old->sgid); + sgid_new = sgid != (gid_t) -1 && !gid_eq (ksgid, old->gid) && + !gid_eq (ksgid, old->egid) && !gid_eq (ksgid, old->sgid); +if ((rgid_new || egid_new || sgid_new) && + !ns_capable_setid (old->user_ns,CAP_SETGID )) +return -EPERM ; + new =prepare_creds ();if (!new)return -ENOMEM ; - old =current_cred (); - - retval = -EPERM ; -if (!ns_capable_setid (old->user_ns,CAP_SETGID )) { -if (rgid != (gid_t) -1 && !gid_eq (krgid, old->gid) && - !gid_eq (krgid, old->egid) && !gid_eq (krgid, old->sgid)) - goto error; -if (egid != (gid_t) -1 && !gid_eq (kegid, old->gid) && - !gid_eq (kegid, old->egid) && !gid_eq (kegid, old->sgid)) - goto error; -if (sgid != (gid_t) -1 && !gid_eq (ksgid, old->gid) && - !gid_eq (ksgid, old->egid) && !gid_eq (ksgid, old->sgid)) - goto error; - }if (rgid != (gid_t) -1 ) new->gid = krgid;
Greg Kroah-Hartman
maintainerPATCH 41/73 mmc: sdhci_am654: Set HIGH_SPEED_ENA for SDR12 and SDR25
In reply to Greg Kroah-HartmanFrom: Bhavya Kapoor <[email protected]>
commit 2265098fd6a6272fde3fd1be5761f2f5895bd99a upstream.
Timing Information in Datasheet assumes that HIGH_SPEED_ENA=1 should be set for SDR12 and SDR25 modes. But sdhci_am654 driver clears HIGH_SPEED_ENA register. Thus, Modify sdhci_am654 to not clear HIGH_SPEED_ENA (HOST_CONTROL[2]) bit for SDR12 and SDR25 speed modes.
--- drivers/mmc/host/sdhci_am654.c | 2 -- 1 file changed, 2 deletions(-)
drivers/mmc/host/sdhci_am654.c +0 -2
@@ -351,8 +351,6 @@ static void sdhci_am654_write_b(struct s*/ case MMC_TIMING_SD_HS :case MMC_TIMING_MMC_HS : -case MMC_TIMING_UHS_SDR12 : -case MMC_TIMING_UHS_SDR25 : val &= ~SDHCI_CTRL_HISPD ; } }
Greg Kroah-Hartman
maintainerPATCH 42/73 drm/i915: Fix fast wake AUX sync len
In reply to Greg Kroah-HartmanFrom: Ville Syrjälä <[email protected]>
commit e1c71f8f918047ce822dc19b42ab1261ed259fd1 upstream.
Fast wake should use 8 SYNC pulses for the preamble and 10-16 SYNC pulses for the precharge. Reduce our fast wake SYNC count to match the maximum value. We also use the maximum precharge length for normal AUX transactions.
--- drivers/gpu/drm/i915/display/intel_dp_aux.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/i915/display/intel_dp_aux.c +1 -1
@@ -167,7 +167,7 @@ static u32 skl_get_aux_send_ctl(struct iDP_AUX_CH_CTL_TIME_OUT_MAX |DP_AUX_CH_CTL_RECEIVE_ERROR | (send_bytes <<DP_AUX_CH_CTL_MESSAGE_SIZE_SHIFT ) | -DP_AUX_CH_CTL_FW_SYNC_PULSE_SKL (32 ) | +DP_AUX_CH_CTL_FW_SYNC_PULSE_SKL (24 ) |DP_AUX_CH_CTL_SYNC_PULSE_SKL (32 ); if (intel_phy_is_tc(i915, phy) &&
Greg Kroah-Hartman
maintainerPATCH 43/73 mm/khugepaged: check again on anon uffd-wp during isolation
In reply to Greg Kroah-HartmanFrom: Peter Xu <[email protected]>
commit dd47ac428c3f5f3bcabe845f36be870fe6c20784 upstream.
Khugepaged collapse an anonymous thp in two rounds of scans. The 2nd round done in __collapse_huge_page_isolate() after hpage_collapse_scan_pmd(), during which all the locks will be released temporarily. It means the pgtable can change during this phase before 2nd round starts.
It's logically possible some ptes got wr-protected during this phase, and we can errornously collapse a thp without noticing some ptes are wr-protected by userfault. e1e267c7928f wanted to avoid it but it only did that for the 1st phase, not the 2nd phase.
Since __collapse_huge_page_isolate() happens after a round of small page swapins, we don't need to worry on any !present ptes - if it existed khugepaged will already bail out. So we only need to check present ptes with uffd-wp bit set there.
This is something I found only but never had a reproducer, I thought it was one caused a bug in Muhammad's recent pagemap new ioctl work, but it turns out it's not the cause of that but an userspace bug. However this seems to still be a real bug even with a very small race window, still worth to have it fixed and copy stable.
--- mm/khugepaged.c | 4 ++++ 1 file changed, 4 insertions(+)
mm/khugepaged.c +4 -0
@@ -625,6 +625,10 @@ static int __collapse_huge_page_isolate( result =SCAN_PTE_NON_PRESENT ; goto out; } +if (pte_uffd_wp (pteval)) { + result =SCAN_PTE_UFFD_WP ; + goto out; + } page =vm_normal_page (vma, address, pteval);if (unlikely (!page)) { result =SCAN_PAGE_NULL ;
Greg Kroah-Hartman
maintainerPATCH 44/73 mm: page_alloc: skip regions with hugetlbfs pages when allocating 1G pages
In reply to Greg Kroah-HartmanFrom: Mel Gorman <[email protected]>
commit 4d73ba5fa710fe7d432e0b271e6fecd252aef66e upstream.
A bug was reported by Yuanxi Liu where allocating 1G pages at runtime is taking an excessive amount of time for large amounts of memory. Further testing allocating huge pages that the cost is linear i.e. if allocating 1G pages in batches of 10 then the time to allocate nr_hugepages from 10->20->30->etc increases linearly even though 10 pages are allocated at each step. Profiles indicated that much of the time is spent checking the validity within already existing huge pages and then attempting a migration that fails after isolating the range, draining pages and a whole lot of other useless work.
Commit eb14d4eefdc4 ("mm,page_alloc: drop unnecessary checks from pfn_range_valid_contig") removed two checks, one which ignored huge pages for contiguous allocations as huge pages can sometimes migrate. While there may be value on migrating a 2M page to satisfy a 1G allocation, it's potentially expensive if the 1G allocation fails and it's pointless to try moving a 1G page for a new 1G allocation or scan the tail pages for valid PFNs.
Reintroduce the PageHuge check and assume any contiguous region with hugetlbfs pages is unsuitable for a new 1G allocation.
The hpagealloc test allocates huge pages in batches and reports the average latency per page over time. This test happens just after boot when fragmentation is not an issue. Units are in milliseconds.
hpagealloc
6.3.0-rc6 6.3.0-rc6 6.3.0-rc6
vanilla hugeallocrevert-v1r1 hugeallocsimple-v1r2
Min Latency 26.42 ( 0.00%) 5.07 ( 80.82%) 18.94 ( 28.30%) 1st-qrtle Latency 356.61 ( 0.00%) 5.34 ( 98.50%) 19.85 ( 94.43%) 2nd-qrtle Latency 697.26 ( 0.00%) 5.47 ( 99.22%) 20.44 ( 97.07%) 3rd-qrtle Latency 972.94 ( 0.00%) 5.50 ( 99.43%) 20.81 ( 97.86%) Max-1 Latency 26.42 ( 0.00%) 5.07 ( 80.82%) 18.94 ( 28.30%) Max-5 Latency 82.14 ( 0.00%) 5.11 ( 93.78%) 19.31 ( 76.49%) Max-10 Latency 150.54 ( 0.00%) 5.20 ( 96.55%) 19.43 ( 87.09%) Max-90 Latency 1164.45 ( 0.00%) 5.53 ( 99.52%) 20.97 ( 98.20%) Max-95 Latency 1223.06 ( 0.00%) 5.55 ( 99.55%) 21.06 ( 98.28%) Max-99 Latency 1278.67 ( 0.00%) 5.57 ( 99.56%) 22.56 ( 98.24%) Max Latency 1310.90 ( 0.00%) 8.06 ( 99.39%) 26.62 ( 97.97%) Amean Latency 678.36 ( 0.00%) 5.44 * 99.20%* 20.44 * 96.99%*
6.3.0-rc6 6.3.0-rc6 6.3.0-rc6
vanilla revert-v1 hugeallocfix-v2
Duration User 0.28 0.27 0.30
Duration System 808.66 17.77 35.99
Duration Elapsed 830.87 18.08 36.33The vanilla kernel is poor, taking up to 1.3 second to allocate a huge page and almost 10 minutes in total to run the test. Reverting the problematic commit reduces it to 8ms at worst and the patch takes 26ms. This patch fixes the main issue with skipping huge pages but leaves the page_count() out because a page with an elevated count potentially can migrate.
--- mm/page_alloc.c | 3 +++ 1 file changed, 3 insertions(+)
mm/page_alloc.c +3 -0
@@ -9239,6 +9239,9 @@ static bool pfn_range_valid_contig(strucif (PageReserved (page))return false; + +if (PageHuge (page)) +return false; }return true; }
Greg Kroah-Hartman
maintainerPATCH 45/73 sched/uclamp: Fix fits_capacity() check in feec()
In reply to Greg Kroah-HartmanFrom: Qais Yousef <[email protected]>
commit 244226035a1f9b2b6c326e55ae5188fab4f428cb upstream.
As reported by Yun Hsiang [1], if a task has its uclamp_min >= 0.8 * 1024, it'll always pick the previous CPU because fits_capacity() will always return false in this case.
The new util_fits_cpu() logic should handle this correctly for us beside more corner cases where similar failures could occur, like when using UCLAMP_MAX.
We open code uclamp_rq_util_with() except for the clamp() part, util_fits_cpu() needs the 'raw' values to be passed to it.
Also introduce uclamp_rq_{set, get}() shorthand accessors to get uclamp value for the rq. Makes the code more readable and ensures the right rules (use READ_ONCE/WRITE_ONCE) are respected transparently.
[1] https://lists.linaro.org/pipermail/eas-dev/2020-July/001488.html
[Conflict in kernel/sched/fair.c mainly due to new automatic variables being added on master vs 5.15]
--- kernel/sched/core.c | 10 +++++----- kernel/sched/fair.c | 26 ++++++++++++++++++++++++-- kernel/sched/sched.h | 42 +++++++++++++++++++++++++++++++++++++++--- 3 files changed, 68 insertions(+), 10 deletions(-)
kernel/sched/core.c +5 -5
@@ -1335,7 +1335,7 @@ static inline void uclamp_idle_reset(strif (!(rq->uclamp_flags &UCLAMP_FLAG_IDLE ))return ; -WRITE_ONCE (rq->uclamp[clamp_id].value, clamp_value); +uclamp_rq_set (rq, clamp_id, clamp_value); } static inline
@@ -1513,8 +1513,8 @@ static inline void uclamp_rq_inc_id(struif (bucket->tasks ==1 || uc_se->value > bucket->value) bucket->value = uc_se->value; -if (uc_se->value >READ_ONCE (uc_rq->value)) -WRITE_ONCE (uc_rq->value, uc_se->value); +if (uc_se->value >uclamp_rq_get (rq, clamp_id)) +uclamp_rq_set (rq, clamp_id, uc_se->value); }/*
@@ -1580,7 +1580,7 @@ static inline void uclamp_rq_dec_id(struif (likely (bucket->tasks))return ; - rq_clamp =READ_ONCE (uc_rq->value); + rq_clamp =uclamp_rq_get (rq, clamp_id);/* * Defensive programming: this should never happen. If it happens, * e.g. due to future modification, warn and fixup the expected value.
@@ -1588,7 +1588,7 @@ static inline void uclamp_rq_dec_id(struSCHED_WARN_ON (bucket->value > rq_clamp);if (bucket->value >= rq_clamp) { bkt_clamp =uclamp_rq_max_value (rq, clamp_id, uc_se->value); -WRITE_ONCE (uc_rq->value, bkt_clamp); +uclamp_rq_set (rq, clamp_id, bkt_clamp); } }
kernel/sched/fair.c +24 -2
@@ -6985,6 +6985,8 @@ compute_energy(struct task_struct *p, instatic int find_energy_efficient_cpu (struct task_struct *p,int prev_cpu) {unsigned long prev_delta =ULONG_MAX , best_delta =ULONG_MAX ; +unsigned long p_util_min =uclamp_is_used () ?uclamp_eff_value (p,UCLAMP_MIN ) :0 ; +unsigned long p_util_max =uclamp_is_used () ?uclamp_eff_value (p,UCLAMP_MAX ) :1024 ;struct root_domain *rd =cpu_rq (smp_processor_id ())->rd;int cpu, best_energy_cpu = prev_cpu, target =-1 ;unsigned long cpu_cap, util, base_energy =0 ;
@@ -7014,6 +7016,8 @@ static int find_energy_efficient_cpu(strfor (; pd; pd = pd->next) {unsigned long cur_delta, spare_cap, max_spare_cap =0 ; +unsigned long rq_util_min, rq_util_max; +unsigned long util_min, util_max;bool compute_prev_delta = false;unsigned long base_energy_pd;int max_spare_cap_cpu =-1 ;
@@ -7034,8 +7038,26 @@ static int find_energy_efficient_cpu(str* much capacity we can get out of the CPU; this is * aligned with sched_cpu_util(). */ - util =uclamp_rq_util_with (cpu_rq (cpu), util, p); -if (!fits_capacity (util, cpu_cap)) +if (uclamp_is_used ()) { +if (uclamp_rq_is_idle (cpu_rq (cpu))) { + util_min = p_util_min; + util_max = p_util_max; + }else { +/* +* Open code uclamp_rq_util_with() except for +* the clamp() part. Ie: apply max aggregation +* only. util_fits_cpu() logic requires to +* operate on non clamped util but must use the +* max-aggregated uclamp_{min, max}. +*/ + rq_util_min =uclamp_rq_get (cpu_rq (cpu),UCLAMP_MIN ); + rq_util_max =uclamp_rq_get (cpu_rq (cpu),UCLAMP_MAX ); + + util_min =max (rq_util_min, p_util_min); + util_max =max (rq_util_max, p_util_max); + } + } +if (!util_fits_cpu (util, util_min, util_max, cpu))continue ;if (cpu == prev_cpu) {
kernel/sched/sched.h +39 -3
63 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 46/73 sched/uclamp: Make cpu_overutilized() use util_fits_cpu()
In reply to Greg Kroah-HartmanFrom: Qais Yousef <[email protected]>
commit c56ab1b3506ba0e7a872509964b100912bde165d upstream.
So that it is now uclamp aware.
This fixes a major problem of busy tasks capped with UCLAMP_MAX keeping the system in overutilized state which disables EAS and leads to wasting energy in the long run.
Without this patch running a busy background activity like JIT compilation on Pixel 6 causes the system to be in overutilized state 74.5% of the time.
With this patch this goes down to 9.79%.
It also fixes another problem when long running tasks that have their UCLAMP_MIN changed while running such that they need to upmigrate to honour the new UCLAMP_MIN value. The upmigration doesn't get triggered because overutilized state never gets set in this state, hence misfit migration never happens at tick in this case until the task wakes up again.
[Fixed trivial conflict in cpu_overutilized() - use cpu_util() instead of cpu_util_cfs()]
--- kernel/sched/fair.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
kernel/sched/fair.c +4 -1
@@ -5739,7 +5739,10 @@ static inline unsigned long cpu_util(intstatic inline bool cpu_overutilized (int cpu) { -return !fits_capacity (cpu_util (cpu),capacity_of (cpu)); +unsigned long rq_util_min =uclamp_rq_get (cpu_rq (cpu),UCLAMP_MIN ); +unsigned long rq_util_max =uclamp_rq_get (cpu_rq (cpu),UCLAMP_MAX ); + +return !util_fits_cpu (cpu_util (cpu), rq_util_min, rq_util_max, cpu); }static inline void update_overutilized_status (struct rq *rq)
Greg Kroah-Hartman
maintainerPATCH 47/73 sched/uclamp: Cater for uclamp in find_energy_efficient_cpu()s early exit condition
In reply to Greg Kroah-HartmanFrom: Qais Yousef <[email protected]>
commit d81304bc6193554014d4372a01debdf65e1e9a4d upstream.
If the utilization of the woken up task is 0, we skip the energy calculation because it has no impact.
But if the task is boosted (uclamp_min != 0) will have an impact on task placement and frequency selection. Only skip if the util is truly 0 after applying uclamp values.
Change uclamp_task_cpu() signature to avoid unnecessary additional calls to uclamp_eff_get(). feec() is the only user now.
--- kernel/sched/fair.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
kernel/sched/fair.c +8 -6
@@ -3974,14 +3974,16 @@ static inline unsigned long task_util_es }#ifdef CONFIG_UCLAMP_TASK -static inline unsigned long uclamp_task_util (struct task_struct *p) +static inline unsigned long uclamp_task_util (struct task_struct *p, +unsigned long uclamp_min, +unsigned long uclamp_max) { -return clamp (task_util_est (p), -uclamp_eff_value (p,UCLAMP_MIN ), -uclamp_eff_value (p,UCLAMP_MAX )); +return clamp (task_util_est (p), uclamp_min, uclamp_max); }#else -static inline unsigned long uclamp_task_util (struct task_struct *p) +static inline unsigned long uclamp_task_util (struct task_struct *p, +unsigned long uclamp_min, +unsigned long uclamp_max) {return task_util_est (p); }
@@ -7014,7 +7016,7 @@ static int find_energy_efficient_cpu(str target = prev_cpu;sync_entity_load_avg (&p->se); -if (!task_util_est (p)) +if (!uclamp_task_util (p, p_util_min, p_util_max)) goto unlock;for (; pd; pd = pd->next) {
Greg Kroah-Hartman
maintainerPATCH 48/73 sched/fair: Detect capacity inversion
In reply to Greg Kroah-HartmanFrom: Qais Yousef <[email protected]>
commit 44c7b80bffc3a657a36857098d5d9c49d94e652b upstream.
Check each performance domain to see if thermal pressure is causing its capacity to be lower than another performance domain.
We assume that each performance domain has CPUs with the same capacities, which is similar to an assumption made in energy_model.c
We also assume that thermal pressure impacts all CPUs in a performance domain equally.
If there're multiple performance domains with the same capacity_orig, we will trigger a capacity inversion if the domain is under thermal pressure.
The new cpu_in_capacity_inversion() should help users to know when information about capacity_orig are not reliable and can opt in to use the inverted capacity as the 'actual' capacity_orig.
--- kernel/sched/fair.c | 63 ++++++++++++++++++++++++++++++++++++++++++++++++--- kernel/sched/sched.h | 19 +++++++++++++++ 2 files changed, 79 insertions(+), 3 deletions(-)
kernel/sched/fair.c +60 -3
@@ -8618,16 +8618,73 @@ static unsigned long scale_rt_capacity(istatic void update_cpu_capacity (struct sched_domain *sd,int cpu) { +unsigned long capacity_orig =arch_scale_cpu_capacity (cpu);unsigned long capacity =scale_rt_capacity (cpu);struct sched_group *sdg = sd->groups; +struct rq *rq =cpu_rq (cpu); -cpu_rq (cpu)->cpu_capacity_orig =arch_scale_cpu_capacity (cpu); + rq->cpu_capacity_orig = capacity_orig;if (!capacity) capacity =1 ; -cpu_rq (cpu)->cpu_capacity = capacity; -trace_sched_cpu_capacity_tp (cpu_rq (cpu)); + rq->cpu_capacity = capacity; + +/* +* Detect if the performance domain is in capacity inversion state. +* +* Capacity inversion happens when another perf domain with equal or +* lower capacity_orig_of() ends up having higher capacity than this +* domain after subtracting thermal pressure. +* +* We only take into account thermal pressure in this detection as it's +* the only metric that actually results in *real* reduction of +* capacity due to performance points (OPPs) being dropped/become +* unreachable due to thermal throttling. +* +* We assume: +* * That all cpus in a perf domain have the same capacity_orig +* (same uArch). +* * Thermal pressure will impact all cpus in this perf domain +* equally. +*/ +if (static_branch_unlikely (&sched_asym_cpucapacity)) { +unsigned long inv_cap = capacity_orig -thermal_load_avg (rq); +struct perf_domain *pd =rcu_dereference (rq->rd->pd); + + rq->cpu_capacity_inverted =0 ; + +for (; pd; pd = pd->next) { +struct cpumask *pd_span =perf_domain_span (pd); +unsigned long pd_cap_orig, pd_cap; + + cpu =cpumask_any (pd_span); + pd_cap_orig =arch_scale_cpu_capacity (cpu); + +if (capacity_orig < pd_cap_orig) +continue ; + +/* +* handle the case of multiple perf domains have the +* same capacity_orig but one of them is under higher +* thermal pressure. We record it as capacity +* inversion. +*/ +if (capacity_orig == pd_cap_orig) { + pd_cap = pd_cap_orig -thermal_load_avg (cpu_rq (cpu)); + +if (pd_cap > inv_cap) { + rq->cpu_capacity_inverted = inv_cap; +break ; + } + }else if (pd_cap_orig > inv_cap) { + rq->cpu_capacity_inverted = inv_cap; +break ; + } + } + } + +trace_sched_cpu_capacity_tp (rq); sdg->sgc->capacity = capacity; sdg->sgc->min_capacity = capacity;
kernel/sched/sched.h +19 -0
@@ -1003,6 +1003,7 @@ struct rq {unsigned long cpu_capacity;unsigned long cpu_capacity_orig; +unsigned long cpu_capacity_inverted;struct callback_head *balance_callback;
@@ -2993,6 +2994,24 @@ static inline unsigned long capacity_orireturn cpu_rq (cpu)->cpu_capacity_orig; } +/* +* Returns inverted capacity if the CPU is in capacity inversion state. +* 0 otherwise. +* +* Capacity inversion detection only considers thermal impact where actual +* performance points (OPPs) gets dropped. +* +* Capacity inversion state happens when another performance domain that has +* equal or lower capacity_orig_of() becomes effectively larger than the perf +* domain this CPU belongs to due to thermal pressure throttling it hard. +* +* See comment in update_cpu_capacity(). +*/ +static inline unsigned long cpu_in_capacity_inversion (int cpu) +{ +return cpu_rq (cpu)->cpu_capacity_inverted; +} +/** * enum cpu_util_type - CPU utilization type * @FREQUENCY_UTIL: Utilization used to select frequency
Greg Kroah-Hartman
maintainerPATCH 49/73 sched/fair: Consider capacity inversion in util_fits_cpu()
In reply to Greg Kroah-HartmanFrom: Qais Yousef <[email protected]>
commit aa69c36f31aadc1669bfa8a3de6a47b5e6c98ee8 upstream.
We do consider thermal pressure in util_fits_cpu() for uclamp_min only. With the exception of the biggest cores which by definition are the max performance point of the system and all tasks by definition should fit.
Even under thermal pressure, the capacity of the biggest CPU is the highest in the system and should still fit every task. Except when it reaches capacity inversion point, then this is no longer true.
We can handle this by using the inverted capacity as capacity_orig in util_fits_cpu(). Which not only addresses the problem above, but also ensure uclamp_max now considers the inverted capacity. Force fitting a task when a CPU is in this adverse state will contribute to making the thermal throttling last longer.
--- kernel/sched/fair.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
kernel/sched/fair.c +9 -5
@@ -4159,12 +4159,16 @@ static inline int util_fits_cpu(unsigned* For uclamp_max, we can tolerate a drop in performance level as the * goal is to cap the task. So it's okay if it's getting less. * -* In case of capacity inversion, which is not handled yet, we should -* honour the inverted capacity for both uclamp_min and uclamp_max all -* the time. +* In case of capacity inversion we should honour the inverted capacity +* for both uclamp_min and uclamp_max all the time. */ - capacity_orig =capacity_orig_of (cpu); - capacity_orig_thermal = capacity_orig -arch_scale_thermal_pressure (cpu); + capacity_orig =cpu_in_capacity_inversion (cpu); +if (capacity_orig) { + capacity_orig_thermal = capacity_orig; + }else { + capacity_orig =capacity_orig_of (cpu); + capacity_orig_thermal = capacity_orig -arch_scale_thermal_pressure (cpu); + }/* * We want to force a task to fit a cpu as implied by uclamp_max.
Greg Kroah-Hartman
maintainerPATCH 50/73 sched/uclamp: Fix a uninitialized variable warnings
In reply to Greg Kroah-HartmanFrom: Qais Yousef <[email protected]>
commit e26fd28db82899be71b4b949527373d0a6be1e65 upstream.
Addresses the following warnings:
Quoted 6 lines
config: riscv-randconfig-m031-20221111
compiler: riscv64-linux-gcc (GCC) 12.1.0smatch warnings:
kernel/sched/fair.c:7263find_energy_efficient_cpu()error: uninitialized symbol 'util_min'.kernel/sched/fair.c:7263find_energy_efficient_cpu()error: uninitialized symbol 'util_max'.
[Conflict in kernel/sched/fair.c due to new automatic variables being added on master vs 5.15]
--- kernel/sched/fair.c | 35 ++++++++++++++++------------------- 1 file changed, 16 insertions(+), 19 deletions(-)
kernel/sched/fair.c +16 -19
@@ -7024,14 +7024,16 @@ static int find_energy_efficient_cpu(str goto unlock;for (; pd; pd = pd->next) { +unsigned long util_min = p_util_min, util_max = p_util_max;unsigned long cur_delta, spare_cap, max_spare_cap =0 ;unsigned long rq_util_min, rq_util_max; -unsigned long util_min, util_max;bool compute_prev_delta = false;unsigned long base_energy_pd;int max_spare_cap_cpu =-1 ;for_each_cpu_and (cpu,perf_domain_span (pd),sched_domain_span (sd)) { +struct rq *rq =cpu_rq (cpu); +if (!cpumask_test_cpu (cpu, p->cpus_ptr))continue ;
@@ -7047,24 +7049,19 @@ static int find_energy_efficient_cpu(str* much capacity we can get out of the CPU; this is * aligned with sched_cpu_util(). */ -if (uclamp_is_used ()) { -if (uclamp_rq_is_idle (cpu_rq (cpu))) { - util_min = p_util_min; - util_max = p_util_max; - }else { -/* -* Open code uclamp_rq_util_with() except for -* the clamp() part. Ie: apply max aggregation -* only. util_fits_cpu() logic requires to -* operate on non clamped util but must use the -* max-aggregated uclamp_{min, max}. -*/ - rq_util_min =uclamp_rq_get (cpu_rq (cpu),UCLAMP_MIN ); - rq_util_max =uclamp_rq_get (cpu_rq (cpu),UCLAMP_MAX ); - - util_min =max (rq_util_min, p_util_min); - util_max =max (rq_util_max, p_util_max); - } +if (uclamp_is_used () && !uclamp_rq_is_idle (rq)) { +/* +* Open code uclamp_rq_util_with() except for +* the clamp() part. Ie: apply max aggregation +* only. util_fits_cpu() logic requires to +* operate on non clamped util but must use the +* max-aggregated uclamp_{min, max}. +*/ + rq_util_min =uclamp_rq_get (rq,UCLAMP_MIN ); + rq_util_max =uclamp_rq_get (rq,UCLAMP_MAX ); + + util_min =max (rq_util_min, p_util_min); + util_max =max (rq_util_max, p_util_max); }if (!util_fits_cpu (util, util_min, util_max, cpu))continue ;
Greg Kroah-Hartman
maintainerPATCH 51/73 sched/fair: Fixes for capacity inversion detection
In reply to Greg Kroah-HartmanFrom: Qais Yousef <[email protected]>
commit da07d2f9c153e457e845d4dcfdd13568d71d18a4 upstream.
Traversing the Perf Domains requires rcu_read_lock() to be held and is conditional on sched_energy_enabled(). Ensure right protections applied.
Also skip capacity inversion detection for our own pd; which was an error.
--- kernel/sched/fair.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
kernel/sched/fair.c +11 -2
@@ -8649,16 +8649,23 @@ static void update_cpu_capacity(struct s* * Thermal pressure will impact all cpus in this perf domain * equally. */ -if (static_branch_unlikely (&sched_asym_cpucapacity)) { +if (sched_energy_enabled ()) {unsigned long inv_cap = capacity_orig -thermal_load_avg (rq); -struct perf_domain *pd =rcu_dereference (rq->rd->pd); +struct perf_domain *pd; +rcu_read_lock (); + + pd =rcu_dereference (rq->rd->pd); rq->cpu_capacity_inverted =0 ;for (; pd; pd = pd->next) {struct cpumask *pd_span =perf_domain_span (pd);unsigned long pd_cap_orig, pd_cap; +/* We can't be inverted against our own pd */ +if (cpumask_test_cpu (cpu_of (rq), pd_span)) +continue ; + cpu =cpumask_any (pd_span); pd_cap_orig =arch_scale_cpu_capacity (cpu);
@@ -8683,6 +8690,8 @@ static void update_cpu_capacity(struct sbreak ; } } + +rcu_read_unlock (); }trace_sched_cpu_capacity_tp (rq);
Greg Kroah-Hartman
maintainerPATCH 52/73 MIPS: Define RUNTIME_DISCARD_EXIT in LD script
In reply to Greg Kroah-HartmanFrom: Jiaxun Yang <[email protected]>
commit 6dcbd0a69c84a8ae7a442840a8cf6b1379dc8f16 upstream.
MIPS's exit sections are discarded at runtime as well.
Fixes link error:.exit.text' referenced in section __jump_table' of fs/fuse/inode.o:
defined in discarded section `.exit.text' of fs/fuse/inode.o
--- arch/mips/kernel/vmlinux.lds.S | 2 ++ 1 file changed, 2 insertions(+)
arch/mips/kernel/vmlinux.lds.S +2 -0
@@ -15,6 +15,8 @@ #define EMITS_PT_NOTE #endif +#define RUNTIME_DISCARD_EXIT + #include <asm-generic/vmlinux.lds.h> #undef mips
Greg Kroah-Hartman
maintainerPATCH 54/73 purgatory: fix disabling debug info
In reply to Greg Kroah-HartmanFrom: Alyssa Ross <[email protected]>
commit d83806c4c0cccc0d6d3c3581a11983a9c186a138 upstream.
Since 32ef9e5054ec, -Wa,-gdwarf-2 is no longer used in KBUILD_AFLAGS. Instead, it includes -g, the appropriate -gdwarf-* flag, and also the -Wa versions of both of those if building with Clang and GNU as. As a result, debug info was being generated for the purgatory objects, even though the intention was that it not be.
--- arch/x86/purgatory/Makefile | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/x86/purgatory/Makefile +1 -2
@@ -64,8 +64,7 @@ CFLAGS_sha256.o += $(PURGATORY_CFLAGS) CFLAGS_REMOVE_string.o += $(PURGATORY_CFLAGS_REMOVE) CFLAGS_string.o += $(PURGATORY_CFLAGS) -AFLAGS_REMOVE_setup-x86_$(BITS).o += -Wa,-gdwarf-2 -AFLAGS_REMOVE_entry64.o += -Wa,-gdwarf-2 +asflags-remove-y += -g -Wa,-gdwarf-2 $(obj)/purgatory.ro: $(PURGATORY_OBJS) FORCE $(call if_changed,ld)
Greg Kroah-Hartman
maintainerPATCH 55/73 fuse: fix attr version comparison in fuse_read_update_size()
In reply to Greg Kroah-HartmanFrom: Miklos Szeredi <[email protected]>
commit 484ce65715b06aead8c4901f01ca32c5a240bc71 upstream.
A READ request returning a short count is taken as indication of EOF, and the cached file size is modified accordingly.
Fix the attribute version checking to allow for changes to fc->attr_version on other inodes.
--- fs/fuse/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/fuse/file.c +1 -1
@@ -793,7 +793,7 @@ static void fuse_read_update_size(structstruct fuse_inode *fi =get_fuse_inode (inode);spin_lock (&fi->lock); -if (attr_ver == fi->attr_version && size < inode->i_size && +if (attr_ver >= fi->attr_version && size < inode->i_size && !test_bit (FUSE_I_SIZE_UNSTABLE , &fi->state)) { fi->attr_version =atomic64_inc_return (&fc->attr_version);i_size_write (inode, size);
Greg Kroah-Hartman
maintainerPATCH 56/73 fuse: always revalidate rename target dentry
In reply to Greg Kroah-HartmanFrom: Jiachen Zhang <[email protected]>
commit ccc031e26afe60d2a5a3d93dabd9c978210825fb upstream.
The previous commit df8629af2934 ("fuse: always revalidate if exclusive create") ensures that the dentries are revalidated on O_EXCL creates. This commit complements it by also performing revalidation for rename target dentries. Otherwise, a rename target file that only exists in kernel dentry cache but not in the filesystem will result in EEXIST if RENAME_NOREPLACE flag is used.
--- fs/fuse/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/fuse/dir.c +1 -1
@@ -205,7 +205,7 @@ static int fuse_dentry_revalidate(structif (inode &&fuse_is_bad (inode)) goto invalid;else if (time_before64 (fuse_dentry_time (entry),get_jiffies_64 ()) || - (flags & (LOOKUP_EXCL |LOOKUP_REVAL ))) { + (flags & (LOOKUP_EXCL |LOOKUP_REVAL |LOOKUP_RENAME_TARGET ))) {struct fuse_entry_out outarg;FUSE_ARGS (args);struct fuse_forget_link *forget;
Greg Kroah-Hartman
maintainerPATCH 57/73 fuse: fix deadlock between atomic O_TRUNC and page invalidation
In reply to Greg Kroah-HartmanFrom: Miklos Szeredi <[email protected]>
commit 2fdbb8dd01556e1501132b5ad3826e8f71e24a8b upstream.
fuse_finish_open() will be called with FUSE_NOWRITE set in case of atomic O_TRUNC open(), so commit 76224355db75 ("fuse: truncate pagecache on atomic_o_trunc") replaced invalidate_inode_pages2() by truncate_pagecache() in such a case to avoid the A-A deadlock. However, we found another A-B-B-A deadlock related to the case above, which will cause the xfstests generic/464 testcase hung in our virtio-fs test environment.
For example, consider two processes concurrently open one same file, one with O_TRUNC and another without O_TRUNC. The deadlock case is described below, if open(O_TRUNC) is already set_nowrite(acquired A), and is trying to lock a page (acquiring B), open() could have held the page lock (acquired B), and waiting on the page writeback (acquiring A). This would lead to deadlocks.
open(O_TRUNC)
----------------------------------------------------------------fuse_open_common
inode_lock [C acquire]
fuse_set_nowrite [A acquire]
fuse_finish_open
truncate_pagecache
lock_page [B acquire]
truncate_inode_page
unlock_page [B release]
fuse_release_nowrite [A release]
inode_unlock [C release]
----------------------------------------------------------------
open()
----------------------------------------------------------------fuse_open_common
fuse_finish_open
invalidate_inode_pages2
lock_page [B acquire]
fuse_launder_page
fuse_wait_on_page_writeback [A acquire & release]
unlock_page [B release]
----------------------------------------------------------------
Besides this case, all calls of invalidate_inode_pages2() and invalidate_inode_pages2_range() in fuse code also can deadlock with open(O_TRUNC).
Fix by moving the truncate_pagecache() call outside the nowrite protected region. The nowrite protection is only for delayed writeback (writeback_cache) case, where inode lock does not protect against truncation racing with writes on the server. Write syscalls racing with page cache truncation still get the inode lock protection.
This patch also changes the order of filemap_invalidate_lock() vs. fuse_set_nowrite() in fuse_open_common(). This new order matches the order found in fuse_file_fallocate() and fuse_do_setattr().
--- fs/fuse/dir.c | 7 ++++++- fs/fuse/file.c | 29 +++++++++++++++++------------ 2 files changed, 23 insertions(+), 13 deletions(-)
fs/fuse/dir.c +6 -1
@@ -476,6 +476,7 @@ static int fuse_create_open(struct inodestruct fuse_entry_out outentry;struct fuse_inode *fi;struct fuse_file *ff; +bool trunc = flags &O_TRUNC ;/* Userspace expects S_IFREG in create mode */ BUG_ON ((mode &S_IFMT ) !=S_IFREG );
@@ -500,7 +501,7 @@ static int fuse_create_open(struct inode inarg.mode = mode; inarg.umask =current_umask (); -if (fm->fc->handle_killpriv_v2 && (flags &O_TRUNC ) && +if (fm->fc->handle_killpriv_v2 && trunc && !(flags &O_EXCL ) && !capable (CAP_FSETID )) { inarg.open_flags |=FUSE_OPEN_KILL_SUIDGID ; }
@@ -549,6 +550,10 @@ static int fuse_create_open(struct inode }else { file->private_data = ff;fuse_finish_open (inode, file); +if (fm->fc->atomic_o_trunc && trunc) +truncate_pagecache (inode,0 ); +else if (!(ff->open_flags &FOPEN_KEEP_CACHE )) +invalidate_inode_pages2 (inode->i_mapping); }return err;
fs/fuse/file.c +17 -12
@@ -210,12 +210,9 @@ void fuse_finish_open(struct inode *inod fi->attr_version =atomic64_inc_return (&fc->attr_version);i_size_write (inode,0 );spin_unlock (&fi->lock); -truncate_pagecache (inode,0 );fuse_invalidate_attr (inode);if (fc->writeback_cache)file_update_time (file); - }else if (!(ff->open_flags &FOPEN_KEEP_CACHE )) { -invalidate_inode_pages2 (inode->i_mapping); }if ((file->f_mode &FMODE_WRITE ) && fc->writeback_cache)
@@ -240,30 +237,38 @@ int fuse_open_common(struct inode *inodeif (err)return err; -if (is_wb_truncate || dax_truncate) { +if (is_wb_truncate || dax_truncate)inode_lock (inode); -fuse_set_nowrite (inode); - }if (dax_truncate) {filemap_invalidate_lock (inode->i_mapping); err =fuse_dax_break_layouts (inode,0 ,0 );if (err) - goto out; + goto out_inode_unlock; } +if (is_wb_truncate || dax_truncate) +fuse_set_nowrite (inode); + err =fuse_do_open (fm,get_node_id (inode), file, isdir);if (!err)fuse_finish_open (inode, file); -out: +if (is_wb_truncate || dax_truncate) +fuse_release_nowrite (inode); +if (!err) { +struct fuse_file *ff = file->private_data; + +if (fc->atomic_o_trunc && (file->f_flags &O_TRUNC )) +truncate_pagecache (inode,0 ); +else if (!(ff->open_flags &FOPEN_KEEP_CACHE )) +invalidate_inode_pages2 (inode->i_mapping); + }if (dax_truncate)filemap_invalidate_unlock (inode->i_mapping); - -if (is_wb_truncate | dax_truncate) { -fuse_release_nowrite (inode); +out_inode_unlock: +if (is_wb_truncate || dax_truncate)inode_unlock (inode); - }return err; }
Greg Kroah-Hartman
maintainerPATCH 58/73 udp: Call inet6_destroy_sock() in setsockopt(IPV6_ADDRFORM).
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
commit 21985f43376cee092702d6cb963ff97a9d2ede68 upstream.
Commit 4b340ae20d0e ("IPv6: Complete IPV6_DONTFRAG support") forgot to add a change to free inet6_sk(sk)->rxpmtu while converting an IPv6 socket into IPv4 with IPV6_ADDRFORM. After conversion, sk_prot is changed to udp_prot and ->destroy() never cleans it up, resulting in a memory leak.
This is due to the discrepancy between inet6_destroy_sock() and IPV6_ADDRFORM, so let's call inet6_destroy_sock() from IPV6_ADDRFORM to remove the difference.
However, this is not enough for now because rxpmtu can be changed without lock_sock() after commit 03485f2adcde ("udpv6: Add lockless sendmsg() support"). We will fix this case in the following patch.
Note we will rename inet6_destroy_sock() to inet6_cleanup_sock() and remove unnecessary inet6_destroy_sock() calls in sk_prot->destroy() in the future.
--- include/net/ipv6.h | 1 + net/ipv6/af_inet6.c | 6 ++++++ net/ipv6/ipv6_sockglue.c | 20 ++++++++------------ 3 files changed, 15 insertions(+), 12 deletions(-)
include/net/ipv6.h +1 -0
@@ -1118,6 +1118,7 @@ void ipv6_icmp_error(struct sock *sk, stvoid ipv6_local_error (struct sock *sk,int err,struct flowi6 *fl6,u32 info);void ipv6_local_rxpmtu (struct sock *sk,struct flowi6 *fl6,u32 mtu); +void inet6_cleanup_sock (struct sock *sk);int inet6_release (struct socket *sock);int inet6_bind (struct socket *sock,struct sockaddr *uaddr,int addr_len); int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
net/ipv6/af_inet6.c +6 -0
@@ -507,6 +507,12 @@ void inet6_destroy_sock(struct sock *sk) }EXPORT_SYMBOL_GPL (inet6_destroy_sock); +void inet6_cleanup_sock (struct sock *sk) +{ +inet6_destroy_sock (sk); +} +EXPORT_SYMBOL_GPL (inet6_cleanup_sock); +/* * This does both peername and sockname. */
net/ipv6/ipv6_sockglue.c +8 -12
@@ -429,9 +429,6 @@ static int do_ipv6_setsockopt(struct socif (optlen <sizeof (int )) goto e_inval;if (val ==PF_INET ) { -struct ipv6_txoptions *opt; -struct sk_buff *pktopt; -if (sk->sk_type ==SOCK_RAW )break ;
@@ -462,7 +459,6 @@ static int do_ipv6_setsockopt(struct socbreak ; } -fl6_free_socklist (sk);__ipv6_sock_mc_close (sk);__ipv6_sock_ac_close (sk);
@@ -497,14 +493,14 @@ static int do_ipv6_setsockopt(struct soc sk->sk_socket->ops = &inet_dgram_ops; sk->sk_family =PF_INET ; } - opt =xchg ((__force struct ipv6_txoptions **)&np->opt, -NULL ); -if (opt) { -atomic_sub (opt->tot_len, &sk->sk_omem_alloc); -txopt_put (opt); - } - pktopt =xchg (&np->pktoptions,NULL ); -kfree_skb (pktopt); + +/* Disable all options not to allocate memory anymore, +* but there is still a race. See the lockless path +* in udpv6_sendmsg() and ipv6_local_rxpmtu(). +*/ + np->rxopt.all =0 ; + +inet6_cleanup_sock (sk);/* * ... and add it to the refcnt debug socks count
Greg Kroah-Hartman
maintainerPATCH 59/73 tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
commit d38afeec26ed4739c640bf286c270559aab2ba5f upstream.
Originally, inet6_sk(sk)->XXX were changed under lock_sock(), so we were able to clean them up by calling inet6_destroy_sock() during the IPv6 -> IPv4 conversion by IPV6_ADDRFORM. However, commit 03485f2adcde ("udpv6:
Add lockless sendmsg() support") added a lockless memory allocation path, which could cause a memory leak:
setsockopt(IPV6_ADDRFORM) sendmsg() +-----------------------+ +-------+ - do_ipv6_setsockopt(sk, ...) - udpv6_sendmsg(sk, ...)
- sockopt_lock_sock(sk) ^._ called via udpv6_prot
- lock_sock(sk) before WRITE_ONCE()
- WRITE_ONCE(sk->sk_prot, &tcp_prot)
- inet6_destroy_sock() - if (!corkreq)
- sockopt_release_sock(sk) - ip6_make_skb(sk, ...)
- release_sock(sk) ^._ lockless fast path for
the non-corking case
- __ip6_append_data(sk, ...)
- ipv6_local_rxpmtu(sk, ...)
- xchg(&np->rxpmtu, skb) ^._ rxpmtu is never freed.
- goto out_no_dst;
- lock_sock(sk)
For now, rxpmtu is only the case, but not to miss the future change and a similar bug fixed in commit e27326009a3d ("net: ping6: Fix memleak in ipv6_renew_options()."), let's set a new function to IPv6 sk->sk_destruct() and call inet6_cleanup_sock() there. Since the conversion does not change sk->sk_destruct(), we can guarantee that we can clean up IPv6 resources finally.
We can now remove all inet6_destroy_sock() calls from IPv6 protocol specific ->destroy() functions, but such changes are invasive to backport. So they can be posted as a follow-up later for net-next.
--- include/net/ipv6.h | 1 + include/net/udp.h | 2 +- include/net/udplite.h | 8 -------- net/ipv4/udp.c | 9 ++++++--- net/ipv4/udplite.c | 8 ++++++++ net/ipv6/af_inet6.c | 8 +++++++- net/ipv6/udp.c | 15 ++++++++++++++- net/ipv6/udp_impl.h | 1 + net/ipv6/udplite.c | 9 ++++++++- 9 files changed, 46 insertions(+), 15 deletions(-)
include/net/ipv6.h +1 -0
@@ -1119,6 +1119,7 @@ void ipv6_local_error(struct sock *sk, ivoid ipv6_local_rxpmtu (struct sock *sk,struct flowi6 *fl6,u32 mtu);void inet6_cleanup_sock (struct sock *sk); +void inet6_sock_destruct (struct sock *sk);int inet6_release (struct socket *sock);int inet6_bind (struct socket *sock,struct sockaddr *uaddr,int addr_len); int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
include/net/udp.h +1 -1
@@ -270,7 +270,7 @@ static inline bool udp_sk_bound_dev_eq(s }/* net/ipv4/udp.c */ -void udp_destruct_sock (struct sock *sk); +void udp_destruct_common (struct sock *sk);void skb_consume_udp (struct sock *sk,struct sk_buff *skb,int len);int __udp_enqueue_schedule_skb (struct sock *sk,struct sk_buff *skb);void udp_skb_destructor (struct sock *sk,struct sk_buff *skb);
include/net/udplite.h +0 -8
@@ -24,14 +24,6 @@ static __inline__ int udplite_getfrag(voreturn copy_from_iter_full (to, len, &msg->msg_iter) ?0 : -EFAULT ; } -/* Designate sk as UDP-Lite socket */ -static inline int udplite_sk_init (struct sock *sk) -{ -udp_init_sock (sk); -udp_sk (sk)->pcflag =UDPLITE_BIT ; -return 0 ; -} -/* * Checksumming routines */
net/ipv4/udp.c +6 -3
@@ -1596,7 +1596,7 @@ drop: }EXPORT_SYMBOL_GPL (__udp_enqueue_schedule_skb); -void udp_destruct_sock (struct sock *sk) +void udp_destruct_common (struct sock *sk) {/* reclaim completely the forward allocated memory */ struct udp_sock *up =udp_sk (sk);
@@ -1609,10 +1609,14 @@ void udp_destruct_sock(struct sock *sk)kfree_skb (skb); }udp_rmem_release (sk, total,0 , true); +} +EXPORT_SYMBOL_GPL (udp_destruct_common); +static void udp_destruct_sock (struct sock *sk) +{ +udp_destruct_common (sk);inet_sock_destruct (sk); } -EXPORT_SYMBOL_GPL (udp_destruct_sock);int udp_init_sock (struct sock *sk) {
@@ -1620,7 +1624,6 @@ int udp_init_sock(struct sock *sk) sk->sk_destruct = udp_destruct_sock;return 0 ; } -EXPORT_SYMBOL_GPL (udp_init_sock);void skb_consume_udp (struct sock *sk,struct sk_buff *skb,int len) {
net/ipv4/udplite.c +8 -0
@@ -17,6 +17,14 @@struct udp_table udplite_table__read_mostly ;EXPORT_SYMBOL (udplite_table); +/* Designate sk as UDP-Lite socket */ +static int udplite_sk_init (struct sock *sk) +{ +udp_init_sock (sk); +udp_sk (sk)->pcflag =UDPLITE_BIT ; +return 0 ; +} +static int udplite_rcv (struct sk_buff *skb) {return __udp4_lib_rcv (skb, &udplite_table,IPPROTO_UDPLITE );
net/ipv6/af_inet6.c +7 -1
@@ -108,6 +108,12 @@ static __inline__ struct ipv6_pinfo *inereturn (struct ipv6_pinfo *)(((u8 *)sk) + offset); } +void inet6_sock_destruct (struct sock *sk) +{ +inet6_cleanup_sock (sk); +inet_sock_destruct (sk); +} +static int inet6_create (struct net *net,struct socket *sock,int protocol,int kern) {
@@ -200,7 +206,7 @@ lookup_protocol: inet->hdrincl =1 ; } - sk->sk_destruct = inet_sock_destruct; + sk->sk_destruct = inet6_sock_destruct; sk->sk_family =PF_INET6 ; sk->sk_protocol = protocol;
net/ipv6/udp.c +14 -1
@@ -55,6 +55,19 @@#include <trace/events/skb.h> #include "udp_impl.h" +static void udpv6_destruct_sock (struct sock *sk) +{ +udp_destruct_common (sk); +inet6_sock_destruct (sk); +} + +int udpv6_init_sock (struct sock *sk) +{ +skb_queue_head_init (&udp_sk (sk)->reader_queue); + sk->sk_destruct = udpv6_destruct_sock; +return 0 ; +} + static u32 udp6_ehashfn(const struct net *net, const struct in6_addr *laddr, const u16 lport,
@@ -1721,7 +1734,7 @@ struct proto udpv6_prot = { .connect = ip6_datagram_connect, .disconnect = udp_disconnect, .ioctl = udp_ioctl, - .init = udp_init_sock, + .init = udpv6_init_sock, .destroy = udpv6_destroy_sock, .setsockopt = udpv6_setsockopt, .getsockopt = udpv6_getsockopt,
net/ipv6/udp_impl.h +1 -0
@@ -12,6 +12,7 @@ int __udp6_lib_rcv(struct sk_buff *, strint __udp6_lib_err (struct sk_buff *,struct inet6_skb_parm *,u8 ,u8 ,int ,__be32 ,struct udp_table *); +int udpv6_init_sock (struct sock *sk);int udp_v6_get_port (struct sock *sk,unsigned short snum);void udp_v6_rehash (struct sock *sk);
net/ipv6/udplite.c +8 -1
@@ -12,6 +12,13 @@#include <linux/proc_fs.h> #include "udp_impl.h" +static int udplitev6_sk_init (struct sock *sk) +{ +udpv6_init_sock (sk); +udp_sk (sk)->pcflag =UDPLITE_BIT ; +return 0 ; +} +static int udplitev6_rcv (struct sk_buff *skb) {return __udp6_lib_rcv (skb, &udplite_table,IPPROTO_UDPLITE );
@@ -38,7 +45,7 @@ struct proto udplitev6_prot = { .connect = ip6_datagram_connect, .disconnect = udp_disconnect, .ioctl = udp_ioctl, - .init = udplite_sk_init, + .init = udplitev6_sk_init, .destroy = udpv6_destroy_sock, .setsockopt = udpv6_setsockopt, .getsockopt = udpv6_getsockopt,
Greg Kroah-Hartman
maintainerPATCH 60/73 inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
commit b5fc29233d28be7a3322848ebe73ac327559cdb9 upstream.
After commit d38afeec26ed ("tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct()."), we call inet6_destroy_sock() in sk->sk_destruct() by setting inet6_sock_destruct() to it to make sure we do not leak inet6-specific resources.
Now we can remove unnecessary inet6_destroy_sock() calls in sk->sk_prot->destroy().
DCCP and SCTP have their own sk->sk_destruct() function, so we change them separately in the following patches.
--- net/ipv6/ping.c | 6 ------ net/ipv6/raw.c | 2 -- net/ipv6/tcp_ipv6.c | 8 +------- net/ipv6/udp.c | 2 -- net/l2tp/l2tp_ip6.c | 2 -- net/mptcp/protocol.c | 7 ------- 6 files changed, 1 insertion(+), 26 deletions(-)
net/ipv6/ping.c +0 -6
@@ -22,11 +22,6 @@#include <linux/proc_fs.h> #include <net/ping.h> -static void ping_v6_destroy (struct sock *sk) -{ -inet6_destroy_sock (sk); -} -/* Compatibility glue so we can support IPv6 when it's compiled as a module */ static int dummy_ipv6_recv_error (struct sock *sk,struct msghdr *msg,int len,int *addr_len)
@@ -171,7 +166,6 @@ struct proto pingv6_prot = { .owner = THIS_MODULE, .init = ping_init_sock, .close = ping_close, - .destroy = ping_v6_destroy, .connect = ip6_datagram_connect_v6_only, .disconnect = __udp_disconnect, .setsockopt = ipv6_setsockopt,
net/ipv6/raw.c +0 -2
@@ -1211,8 +1211,6 @@ static void raw6_destroy(struct sock *sklock_sock (sk);ip6_flush_pending_frames (sk);release_sock (sk); - -inet6_destroy_sock (sk); }static int rawv6_init_sk (struct sock *sk)
net/ipv6/tcp_ipv6.c +1 -7
@@ -1972,12 +1972,6 @@ static int tcp_v6_init_sock(struct sockreturn 0 ; } -static void tcp_v6_destroy_sock (struct sock *sk) -{ -tcp_v4_destroy_sock (sk); -inet6_destroy_sock (sk); -} -#ifdef CONFIG_PROC_FS /* Proc filesystem TCPv6 sock list dumping. */ static void get_openreq6(struct seq_file *seq,
@@ -2170,7 +2164,7 @@ struct proto tcpv6_prot = { .accept = inet_csk_accept, .ioctl = tcp_ioctl, .init = tcp_v6_init_sock, - .destroy = tcp_v6_destroy_sock, + .destroy = tcp_v4_destroy_sock, .shutdown = tcp_shutdown, .setsockopt = tcp_setsockopt, .getsockopt = tcp_getsockopt,
net/ipv6/udp.c +0 -2
@@ -1649,8 +1649,6 @@ void udpv6_destroy_sock(struct sock *sk)udp_encap_disable (); } } - -inet6_destroy_sock (sk); }/*
net/l2tp/l2tp_ip6.c +0 -2
@@ -255,8 +255,6 @@ static void l2tp_ip6_destroy_sock(structif (tunnel)l2tp_tunnel_delete (tunnel); - -inet6_destroy_sock (sk); }static int l2tp_ip6_bind (struct sock *sk,struct sockaddr *uaddr,int addr_len)
net/mptcp/protocol.c +0 -7
@@ -3621,12 +3621,6 @@ static const struct proto_ops mptcp_v6_sstatic struct proto mptcp_v6_prot; -static void mptcp_v6_destroy (struct sock *sk) -{ -mptcp_destroy (sk); -inet6_destroy_sock (sk); -} -static struct inet_protosw mptcp_v6_protosw = { .type =SOCK_STREAM , .protocol =IPPROTO_MPTCP ,
@@ -3642,7 +3636,6 @@ int __init mptcp_proto_v6_init(void) mptcp_v6_prot = mptcp_prot;strcpy (mptcp_v6_prot.name,"MPTCPv6" ); mptcp_v6_prot.slab =NULL ; - mptcp_v6_prot.destroy = mptcp_v6_destroy; mptcp_v6_prot.obj_size =sizeof (struct mptcp6_sock ); err =proto_register (&mptcp_v6_prot,1 );
Greg Kroah-Hartman
maintainerPATCH 61/73 dccp: Call inet6_destroy_sock() via sk->sk_destruct().
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
commit 1651951ebea54970e0bda60c638fc2eee7a6218f upstream.
After commit d38afeec26ed ("tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct()."), we call inet6_destroy_sock() in sk->sk_destruct() by setting inet6_sock_destruct() to it to make sure we do not leak inet6-specific resources.
DCCP sets its own sk->sk_destruct() in the dccp_init_sock(), and DCCPv6 socket shares it by calling the same init function via dccp_v6_init_sock().
To call inet6_sock_destruct() from DCCPv6 sk->sk_destruct(), we export it and set dccp_v6_sk_destruct() in the init function.
--- net/dccp/dccp.h | 1 + net/dccp/ipv6.c | 15 ++++++++------- net/dccp/proto.c | 8 +++++++- net/ipv6/af_inet6.c | 1 + 4 files changed, 17 insertions(+), 8 deletions(-)
net/dccp/dccp.h +1 -0
@@ -283,6 +283,7 @@ int dccp_rcv_state_process(struct sock *int dccp_rcv_established (struct sock *sk,struct sk_buff *skb,const struct dccp_hdr *dh,const unsigned int len); +void dccp_destruct_common (struct sock *sk);int dccp_init_sock (struct sock *sk,const __u8 ctl_sock_initialized);void dccp_destroy_sock (struct sock *sk);
net/dccp/ipv6.c +8 -7
@@ -1002,6 +1002,12 @@ static const struct inet_connection_sock .sockaddr_len = sizeof(struct sockaddr_in6), }; +static void dccp_v6_sk_destruct (struct sock *sk) +{ +dccp_destruct_common (sk); +inet6_sock_destruct (sk); +} +/* NOTE: A lot of things set to zero explicitly by call to * sk_alloc() so need not be done here. */
@@ -1014,17 +1020,12 @@ static int dccp_v6_init_sock(struct sockif (unlikely (!dccp_v6_ctl_sock_initialized)) dccp_v6_ctl_sock_initialized =1 ;inet_csk (sk)->icsk_af_ops = &dccp_ipv6_af_ops; + sk->sk_destruct = dccp_v6_sk_destruct; }return err; } -static void dccp_v6_destroy_sock (struct sock *sk) -{ -dccp_destroy_sock (sk); -inet6_destroy_sock (sk); -} -static struct timewait_sock_ops dccp6_timewait_sock_ops = { .twsk_obj_size =sizeof (struct dccp6_timewait_sock ), };
@@ -1047,7 +1048,7 @@ static struct proto dccp_v6_prot = { .accept = inet_csk_accept, .get_port = inet_csk_get_port, .shutdown = dccp_shutdown, - .destroy = dccp_v6_destroy_sock, + .destroy = dccp_destroy_sock, .orphan_count = &dccp_orphan_count, .max_header = MAX_DCCP_HEADER, .obj_size = sizeof(struct dccp6_sock),
net/dccp/proto.c +7 -1
@@ -171,12 +171,18 @@ const char *dccp_packet_name(const int tEXPORT_SYMBOL_GPL (dccp_packet_name); -static void dccp_sk_destruct (struct sock *sk) +void dccp_destruct_common (struct sock *sk) {struct dccp_sock *dp =dccp_sk (sk);ccid_hc_tx_delete (dp->dccps_hc_tx_ccid, sk); dp->dccps_hc_tx_ccid =NULL ; +} +EXPORT_SYMBOL_GPL (dccp_destruct_common); + +static void dccp_sk_destruct (struct sock *sk) +{ +dccp_destruct_common (sk);inet_sock_destruct (sk); }
net/ipv6/af_inet6.c +1 -0
@@ -113,6 +113,7 @@ void inet6_sock_destruct(struct sock *skinet6_cleanup_sock (sk);inet_sock_destruct (sk); } +EXPORT_SYMBOL_GPL (inet6_sock_destruct);static int inet6_create (struct net *net,struct socket *sock,int protocol,int kern)
Greg Kroah-Hartman
maintainerPATCH 62/73 sctp: Call inet6_destroy_sock() via sk->sk_destruct().
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
commit 6431b0f6ff1633ae598667e4cdd93830074a03e8 upstream.
After commit d38afeec26ed ("tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct()."), we call inet6_destroy_sock() in sk->sk_destruct() by setting inet6_sock_destruct() to it to make sure we do not leak inet6-specific resources.
SCTP sets its own sk->sk_destruct() in the sctp_init_sock(), and SCTPv6 socket reuses it as the init function.
To call inet6_sock_destruct() from SCTPv6 sk->sk_destruct(), we set sctp_v6_destruct_sock() in a new init function.
--- net/sctp/socket.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-)
net/sctp/socket.c +21 -8
@@ -5110,13 +5110,17 @@ static void sctp_destroy_sock(struct soc }/* Triggered when there are no references on the socket anymore */ -static void sctp_destruct_sock (struct sock *sk) +static void sctp_destruct_common (struct sock *sk) {struct sctp_sock *sp =sctp_sk (sk);/* Free up the HMAC transform. */ crypto_free_shash (sp->hmac); +} +static void sctp_destruct_sock (struct sock *sk) +{ +sctp_destruct_common (sk);inet_sock_destruct (sk); }
@@ -9443,7 +9447,7 @@ void sctp_copy_sock(struct sock *newsk,sctp_sk (newsk)->reuse = sp->reuse; newsk->sk_shutdown = sk->sk_shutdown; - newsk->sk_destruct = sctp_destruct_sock; + newsk->sk_destruct = sk->sk_destruct; newsk->sk_family = sk->sk_family; newsk->sk_protocol =IPPROTO_SCTP ; newsk->sk_backlog_rcv = sk->sk_prot->backlog_rcv;
@@ -9675,11 +9679,20 @@ struct proto sctp_prot = {#if IS_ENABLED (CONFIG_IPV6 ) -#include <net/transp_v6.h> -static void sctp_v6_destroy_sock (struct sock *sk) +static void sctp_v6_destruct_sock (struct sock *sk) +{ +sctp_destruct_common (sk); +inet6_sock_destruct (sk); +} + +static int sctp_v6_init_sock (struct sock *sk) { -sctp_destroy_sock (sk); -inet6_destroy_sock (sk); +int ret =sctp_init_sock (sk); + +if (!ret) + sk->sk_destruct = sctp_v6_destruct_sock; + +return ret; } struct proto sctpv6_prot = {
@@ -9689,8 +9702,8 @@ struct proto sctpv6_prot = { .disconnect = sctp_disconnect, .accept = sctp_accept, .ioctl = sctp_ioctl, - .init = sctp_init_sock, - .destroy = sctp_v6_destroy_sock, + .init = sctp_v6_init_sock, + .destroy = sctp_destroy_sock, .shutdown = sctp_shutdown, .setsockopt = sctp_setsockopt, .getsockopt = sctp_getsockopt,
Greg Kroah-Hartman
maintainerPATCH 63/73 pwm: meson: Explicitly set .polarity in .get_state()
In reply to Greg Kroah-HartmanFrom: Uwe Kleine-König <[email protected]>
commit 8caa81eb950cb2e9d2d6959b37d853162d197f57 upstream.
The driver only supports normal polarity. Complete the implementation of .get_state() by setting .polarity accordingly.
This fixes a regression that was possible since commit c73a3107624d ("pwm: Handle .get_state() failures") which stopped to zero-initialize the state passed to the .get_state() callback. This was reported at
https://forum.odroid.com/viewtopic.php?f=177&t=46360 . While this was an unintended side effect, the real issue is the driver's callback not setting the polarity.
There is a complicating fact, that the .apply() callback fakes support for inversed polarity. This is not (and cannot) be matched by .get_state(). As fixing this isn't easy, only point it out in a comment to prevent authors of other drivers from copying that approach.
--- drivers/pwm/pwm-meson.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/pwm/pwm-meson.c +7 -0
@@ -168,6 +168,12 @@ static int meson_pwm_calc(struct meson_p duty = state->duty_cycle; period = state->period; +/* +* Note this is wrong. The result is an output wave that isn't really +* inverted and so is wrongly identified by .get_state as normal. +* Fixing this needs some care however as some machines might rely on +* this. +*/ if (state->polarity ==PWM_POLARITY_INVERSED ) duty = period - duty;
@@ -366,6 +372,7 @@ static void meson_pwm_get_state(struct p state->period =0 ; state->duty_cycle =0 ; } + state->polarity =PWM_POLARITY_NORMAL ; }static const struct pwm_ops meson_pwm_ops = {
Greg Kroah-Hartman
maintainerPATCH 64/73 pwm: iqs620a: Explicitly set .polarity in .get_state()
In reply to Greg Kroah-HartmanFrom: "Uwe Kleine-K�nig" <[email protected]>
[ Upstream commit b20b097128d9145fadcea1cbb45c4d186cb57466 ]
The driver only supports normal polarity. Complete the implementation of .get_state() by setting .polarity accordingly.
--- drivers/pwm/pwm-iqs620a.c | 1 + 1 file changed, 1 insertion(+)
drivers/pwm/pwm-iqs620a.c +1 -0
@@ -126,6 +126,7 @@ static void iqs620_pwm_get_state(structmutex_unlock (&iqs620_pwm->lock); state->period =IQS620_PWM_PERIOD_NS ; + state->polarity =PWM_POLARITY_NORMAL ; } static int iqs620_pwm_notifier(struct notifier_block *notifier,
Greg Kroah-Hartman
maintainerPATCH 65/73 pwm: hibvt: Explicitly set .polarity in .get_state()
In reply to Greg Kroah-HartmanFrom: "Uwe Kleine-K�nig" <[email protected]>
[ Upstream commit 6f57937980142715e927697a6ffd2050f38ed6f6 ]
The driver only both polarities. Complete the implementation of .get_state() by setting .polarity according to the configured hardware state.
--- drivers/pwm/pwm-hibvt.c | 1 + 1 file changed, 1 insertion(+)
drivers/pwm/pwm-hibvt.c +1 -0
@@ -146,6 +146,7 @@ static void hibvt_pwm_get_state(struct p value =readl (base +PWM_CTRL_ADDR (pwm->hwpwm)); state->enabled = (PWM_ENABLE_MASK & value); + state->polarity = (PWM_POLARITY_MASK & value) ?PWM_POLARITY_INVERSED :PWM_POLARITY_NORMAL ; } static int hibvt_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm,
Greg Kroah-Hartman
maintainerPATCH 66/73 counter: 104-quad-8: Fix race condition between FLAG and CNTR reads
In reply to Greg Kroah-HartmanFrom: William Breathitt Gray <[email protected]>
commit 4aa3b75c74603c3374877d5fd18ad9cc3a9a62ed upstream.
The Counter (CNTR) register is 24 bits wide, but we can have an effective 25-bit count value by setting bit 24 to the XOR of the Borrow flag and Carry flag. The flags can be read from the FLAG register, but a race condition exists: the Borrow flag and Carry flag are instantaneous and could change by the time the count value is read from the CNTR register.
Since the race condition could result in an incorrect 25-bit count value, remove support for 25-bit count values from this driver; hard-coded maximum count values are replaced by a LS7267_CNTR_MAX define for consistency and clarity.
--- drivers/counter/104-quad-8.c | 29 ++++++++--------------------- 1 file changed, 8 insertions(+), 21 deletions(-)
drivers/counter/104-quad-8.c +8 -21
@@ -61,10 +61,6 @@ struct quad8 {#define QUAD8_REG_CHAN_OP 0x11#define QUAD8_REG_INDEX_INPUT_LEVELS 0x16#define QUAD8_DIFF_ENCODER_CABLE_STATUS 0x17 -/* Borrow Toggle flip-flop */ -#define QUAD8_FLAG_BT BIT(0) -/* Carry Toggle flip-flop */ -#define QUAD8_FLAG_CT BIT(1)/* Error flag */ #define QUAD8_FLAG_E BIT(4)/* Up/Down flag */
@@ -97,6 +93,9 @@ struct quad8 {#define QUAD8_CMR_QUADRATURE_X2 0x10#define QUAD8_CMR_QUADRATURE_X4 0x18 +/* Each Counter is 24 bits wide */ +#define LS7267_CNTR_MAX GENMASK(23, 0) +static int quad8_signal_read (struct counter_device *counter,struct counter_signal *signal,enum counter_signal_level *level)
@@ -121,17 +120,9 @@ static int quad8_count_read(struct count {struct quad8 *const priv = counter->priv;const int base_offset = priv->base +2 * count->id; -unsigned int flags; -unsigned int borrow; -unsigned int carry;int i; - flags =inb (base_offset +1 ); - borrow = flags &QUAD8_FLAG_BT ; - carry = !!(flags &QUAD8_FLAG_CT ); - -/* Borrow XOR Carry effectively doubles count range */ - *val = (unsigned long )(borrow ^ carry) <<24 ; + *val =0 ;mutex_lock (&priv->lock);
@@ -154,8 +145,7 @@ static int quad8_count_write(struct counconst int base_offset = priv->base +2 * count->id;int i; -/* Only 24-bit values are supported */ -if (val >0xFFFFFF ) +if (val >LS7267_CNTR_MAX )return -ERANGE ;mutex_lock (&priv->lock);
@@ -627,8 +617,7 @@ static int quad8_count_preset_write(stru {struct quad8 *const priv = counter->priv; -/* Only 24-bit values are supported */ -if (preset >0xFFFFFF ) +if (preset >LS7267_CNTR_MAX )return -ERANGE ;mutex_lock (&priv->lock);
@@ -654,8 +643,7 @@ static int quad8_count_ceiling_read(stru *ceiling = priv->preset[count->id];break ;default : -/* By default 0x1FFFFFF (25 bits unsigned) is maximum count */ - *ceiling =0x1FFFFFF ; + *ceiling =LS7267_CNTR_MAX ;break ; }
@@ -669,8 +657,7 @@ static int quad8_count_ceiling_write(str {struct quad8 *const priv = counter->priv; -/* Only 24-bit values are supported */ -if (ceiling >0xFFFFFF ) +if (ceiling >LS7267_CNTR_MAX )return -ERANGE ;mutex_lock (&priv->lock);
Greg Kroah-Hartman
maintainerPATCH 67/73 iio: adc: at91-sama5d2_adc: fix an error code in at91_adc_allocate_trigger()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit 73a428b37b9b538f8f8fe61caa45e7f243bab87c upstream.
The at91_adc_allocate_trigger() function is supposed to return error pointers. Returning a NULL will cause an Oops.
--- drivers/iio/adc/at91-sama5d2_adc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/at91-sama5d2_adc.c +1 -1
@@ -1000,7 +1000,7 @@ static struct iio_trigger *at91_adc_allo trig =devm_iio_trigger_alloc (&indio->dev,"%s-dev%d-%s" , indio->name,iio_device_id (indio), trigger_name);if (!trig) -return NULL ; +return ERR_PTR (-ENOMEM ); trig->dev.parent = indio->dev.parent;iio_trigger_set_drvdata (trig, indio);
Greg Kroah-Hartman
maintainerPATCH 68/73 mm/page_alloc: fix potential deadlock on zonelist_update_seq seqlock
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
commit 1007843a91909a4995ee78a538f62d8665705b66 upstream.
syzbot is reporting circular locking dependency which involves zonelist_update_seq seqlock [1], for this lock is checked by memory allocation requests which do not need to be retried.
One deadlock scenario is kmalloc(GFP_ATOMIC) from an interrupt handler.
CPU0
----
__build_all_zonelists() {
write_seqlock(&zonelist_update_seq); // makes zonelist_update_seq.seqcount odd
// e.g. timer interrupt handler runs at this moment
some_timer_func() {
kmalloc(GFP_ATOMIC) {
__alloc_pages_slowpath() {
read_seqbegin(&zonelist_update_seq) {
// spins forever because zonelist_update_seq.seqcount is odd
}
}
}
}
// e.g. timer interrupt handler finishes
write_sequnlock(&zonelist_update_seq); // makes zonelist_update_seq.seqcount even
}This deadlock scenario can be easily eliminated by not calling read_seqbegin(&zonelist_update_seq) from !__GFP_DIRECT_RECLAIM allocation requests, for retry is applicable to only __GFP_DIRECT_RECLAIM allocation requests. But Michal Hocko does not know whether we should go with this approach.
Another deadlock scenario which syzbot is reporting is a race between kmalloc(GFP_ATOMIC) from tty_insert_flip_string_and_push_buffer() with port->lock held and printk() from __build_all_zonelists() with zonelist_update_seq held.
CPU0 CPU1
---- ----
pty_write() {
tty_insert_flip_string_and_push_buffer() {
__build_all_zonelists() {
write_seqlock(&zonelist_update_seq);
build_zonelists() {
printk() {
vprintk() {
vprintk_default() {
vprintk_emit() {
console_unlock() {
console_flush_all() {
console_emit_next_record() {
con->write() = serial8250_console_write() {
spin_lock_irqsave(&port->lock, flags);
tty_insert_flip_string() {
tty_insert_flip_string_fixed_flag() {
__tty_buffer_request_room() {
tty_buffer_alloc() {
kmalloc(GFP_ATOMIC | __GFP_NOWARN) {
__alloc_pages_slowpath() {
zonelist_iter_begin() {
read_seqbegin(&zonelist_update_seq); // spins forever because zonelist_update_seq.seqcount is odd
spin_lock_irqsave(&port->lock, flags); // spins forever because port->lock is held
}
}
}
}
}
}
}
}
spin_unlock_irqrestore(&port->lock, flags);
// message is printed to console
spin_unlock_irqrestore(&port->lock, flags);
}
}
}
}
}
}
}
}
}
write_sequnlock(&zonelist_update_seq);
}
}
}This deadlock scenario can be eliminated by
preventing interrupt context from calling kmalloc(GFP_ATOMIC)
and
preventing printk() from calling console_flush_all()
while zonelist_update_seq.seqcount is odd.
Since Petr Mladek thinks that __build_all_zonelists() can become a candidate for deferring printk() [2], let's address this problem by
disabling local interrupts in order to avoid kmalloc(GFP_ATOMIC)
and
disabling synchronous printk() in order to avoid console_flush_all()
.
As a side effect of minimizing duration of zonelist_update_seq.seqcount being odd by disabling synchronous printk(), latency at read_seqbegin(&zonelist_update_seq) for both !__GFP_DIRECT_RECLAIM and __GFP_DIRECT_RECLAIM allocation requests will be reduced. Although, from lockdep perspective, not calling read_seqbegin(&zonelist_update_seq) (i.e. do not record unnecessary locking dependency) from interrupt context is still preferable, even if we don't allow calling kmalloc(GFP_ATOMIC) inside write_seqlock(&zonelist_update_seq)/write_sequnlock(&zonelist_update_seq) section...
--- mm/page_alloc.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
mm/page_alloc.c +16 -0
@@ -6416,7 +6416,21 @@ static void __build_all_zonelists(void *int nid;int __maybe_unused cpu;pg_data_t *self = data; +unsigned long flags; +/* +* Explicitly disable this CPU's interrupts before taking seqlock +* to prevent any IRQ handler from calling into the page allocator +* (e.g. GFP_ATOMIC) that could hit zonelist_iter_begin and livelock. +*/ +local_irq_save (flags); +/* +* Explicitly disable this CPU's synchronous printk() before taking +* seqlock to prevent any printk() from trying to hold port->lock, for +* tty_insert_flip_string_and_push_buffer() on other CPU might be +* calling kmalloc(GFP_ATOMIC | __GFP_NOWARN) with port->lock held. +*/ +printk_deferred_enter ();write_seqlock (&zonelist_update_seq);#ifdef CONFIG_NUMA
@@ -6451,6 +6465,8 @@ static void __build_all_zonelists(void * }write_sequnlock (&zonelist_update_seq); +printk_deferred_exit (); +local_irq_restore (flags); }static noinline void__init
Greg Kroah-Hartman
maintainerPATCH 69/73 ASoC: fsl_asrc_dma: fix potential null-ptr-deref
In reply to Greg Kroah-HartmanFrom: Nikita Zhandarovich <[email protected]>
commit 86a24e99c97234f87d9f70b528a691150e145197 upstream.
dma_request_slave_channel() may return NULL which will lead to NULL pointer dereference error in 'tmp_chan->private'.
Correct this behaviour by, first, switching from deprecated function dma_request_slave_channel() to dma_request_chan(). Secondly, enable sanity check for the resuling value of dma_request_chan(). Also, fix description that follows the enacted changes and that concerns the use of dma_request_slave_channel().
--- sound/soc/fsl/fsl_asrc_dma.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
sound/soc/fsl/fsl_asrc_dma.c +8 -3
@@ -208,14 +208,19 @@ static int fsl_asrc_dma_hw_params(struct be_chan =soc_component_to_pcm (component_be)->chan[substream->stream]; tmp_chan = be_chan; } -if (!tmp_chan) - tmp_chan =dma_request_slave_channel (dev_be, tx ?"tx" :"rx" ); +if (!tmp_chan) { + tmp_chan =dma_request_chan (dev_be, tx ?"tx" :"rx" ); +if (IS_ERR (tmp_chan)) { +dev_err (dev,"failed to request DMA channel for Back-End\n" ); +return -EINVAL ; + } + }/* * An EDMA DEV_TO_DEV channel is fixed and bound with DMA event of each * peripheral, unlike SDMA channel that is allocated dynamically. So no * need to configure dma_request and dma_request2, but get dma_chan of -* Back-End device directly via dma_request_slave_channel. +* Back-End device directly via dma_request_chan. */ if (!asrc->use_edma) {/* Get DMA request of Back-End */
Greg Kroah-Hartman
maintainerPATCH 70/73 ASN.1: Fix check for strdup() success
In reply to Greg Kroah-HartmanFrom: Ekaterina Orlova <[email protected]>
commit 5a43001c01691dcbd396541e6faa2c0077378f48 upstream.
It seems there is a misprint in the check of strdup() return code that can lead to NULL pointer dereference.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- scripts/asn1_compiler.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/asn1_compiler.c +1 -1
@@ -625,7 +625,7 @@ int main(int argc, char **argv) p =strrchr (argv[1 ],'/' ); p = p ? p +1 : argv[1 ]; grammar_name =strdup (p); -if (!p) { +if (!grammar_name) {perror (NULL );exit (1 ); }
Greg Kroah-Hartman
maintainerPATCH 71/73 soc: sifive: l2_cache: fix missing iounmap() in error path in sifive_l2_init()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
commit 73e770f085023da327dc9ffeb6cd96b0bb22d97e upstream.
Add missing iounmap() before return error from sifive_l2_init().
--- drivers/soc/sifive/sifive_l2_cache.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/soc/sifive/sifive_l2_cache.c +7 -2
@@ -212,7 +212,8 @@ static int __init sifive_l2_init(void) intr_num =of_property_count_u32_elems (np,"interrupts" );if (!intr_num) {pr_err ("L2CACHE: no interrupts property\n" ); -return -ENODEV ; + rc = -ENODEV ; + goto err_unmap; }for (i =0 ; i < intr_num; i++) {
@@ -220,7 +221,7 @@ static int __init sifive_l2_init(void) rc =request_irq (g_irq[i], l2_int_handler,0 ,"l2_ecc" ,NULL );if (rc) {pr_err ("L2CACHE: Could not request IRQ %d\n" , g_irq[i]); -return rc; + goto err_unmap; } }
@@ -233,5 +234,9 @@ static int __init sifive_l2_init(void)setup_sifive_debug ();#endif return 0 ; + +err_unmap: +iounmap (l2_base); +return rc; }device_initcall (sifive_l2_init);
Greg Kroah-Hartman
maintainerPATCH v2 53/73 docs: futex: Fix kernel-doc references after code split-up preparation
In reply to Greg Kroah-HartmanFrom: Salvatore Bonaccorso <[email protected]>
In upstream commit 77e52ae35463 ("futex: Move to kernel/futex/") the futex code from kernel/futex.c was moved into kernel/futex/core.c in preparation of the split-up of the implementation in various files.
Point kernel-doc references to the new files as otherwise the documentation shows errors on build:
[...]
Error: Cannot open file ./kernel/futex.c
Error: Cannot open file ./kernel/futex.c
[...]
WARNING: kernel-doc './scripts/kernel-doc -rst -enable-lineno -sphinx-version 3.4.3 -internal ./kernel/futex.c' failed with return code 2
There is no direct upstream commit for this change. It is made in analogy to commit bc67f1c454fb ("docs: futex: Fix kernel-doc references") applied as consequence of the restructuring of the futex code.
--- Documentation/kernel-hacking/locking.rst | 2 +- Documentation/translations/it_IT/kernel-hacking/locking.rst | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
Documentation/kernel-hacking/locking.rst +1 -1
@@ -1352,7 +1352,7 @@ Mutex API reference Futex API reference =================== -.. kernel-doc:: kernel/futex.c +.. kernel-doc:: kernel/futex/core.c :internal: Further reading
Documentation/translations/it_IT/kernel-hacking/locking.rst +1 -1
@@ -1396,7 +1396,7 @@ Riferimento per l'API dei Mutex Riferimento per l'API dei Futex =============================== -.. kernel-doc:: kernel/futex.c +.. kernel-doc:: kernel/futex/core.c :internal: Approfondimenti
Greg Kroah-Hartman
maintainerPATCH 72/73 soc: sifive: l2_cache: fix missing free_irq() in error path in sifive_l2_init()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
commit 756344e7cb1afbb87da8705c20384dddd0dea233 upstream.
Add missing free_irq() before return error from sifive_l2_init().
--- drivers/soc/sifive/sifive_l2_cache.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/soc/sifive/sifive_l2_cache.c +4 -1
@@ -221,7 +221,7 @@ static int __init sifive_l2_init(void) rc =request_irq (g_irq[i], l2_int_handler,0 ,"l2_ecc" ,NULL );if (rc) {pr_err ("L2CACHE: Could not request IRQ %d\n" , g_irq[i]); - goto err_unmap; + goto err_free_irq; } }
@@ -235,6 +235,9 @@ static int __init sifive_l2_init(void)#endif return 0 ; +err_free_irq: +while (--i >=0 ) +free_irq (g_irq[i],NULL ); err_unmap:iounmap (l2_base);return rc;
Greg Kroah-Hartman
maintainerPATCH 73/73 soc: sifive: l2_cache: fix missing of_node_put() in sifive_l2_init()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
commit 8fbf94fea0b4e187ca9100936c5429f96b8a4e44 upstream.
The device_node pointer returned by of_find_matching_node() with refcount incremented, when finish using it, the refcount need be decreased.
--- drivers/soc/sifive/sifive_l2_cache.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/soc/sifive/sifive_l2_cache.c +11 -4
@@ -202,12 +202,16 @@ static int __init sifive_l2_init(void)if (!np)return -ENODEV ; -if (of_address_to_resource (np,0 , &res)) -return -ENODEV ; +if (of_address_to_resource (np,0 , &res)) { + rc = -ENODEV ; + goto err_node_put; + } l2_base =ioremap (res.start,resource_size (&res)); -if (!l2_base) -return -ENOMEM ; +if (!l2_base) { + rc = -ENOMEM ; + goto err_node_put; + } intr_num =of_property_count_u32_elems (np,"interrupts" );if (!intr_num) {
@@ -224,6 +228,7 @@ static int __init sifive_l2_init(void) goto err_free_irq; } } +of_node_put (np);l2_config_read ();
@@ -240,6 +245,8 @@ err_free_irq:free_irq (g_irq[i],NULL ); err_unmap:iounmap (l2_base); +err_node_put: +of_node_put (np);return rc; }device_initcall (sifive_l2_init);
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.109 release. There are 73 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 26 Apr 2023 13:11:11 +0000. Anything received after that time might be too late.
Build results:
total: 155 pass: 155 fail: 0 Qemu test results: total: 499 pass: 499 fail: 0
Guenter
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.109 release. There are 73 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Successfully cross-compiled for arm64 (bcm2711_defconfig, GCC 10.2.0) and powerpc (ps3_defconfig, GCC 12.2.0).
Signature · 1 line
An old man doll... just what I always wanted! - Clara
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.109 release. There are 73 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 26 Apr 2023 13:11:11 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.109-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v5.15:
11 builds: 11 pass, 0 fail
28 boots: 28 pass, 0 fail
114 tests: 114 pass, 0 failLinux version: 5.15.109-rc1-g579deb859f24
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04Jon
Hello Greg,
Quoted 10 lines
From: Greg Kroah-Hartman <[email protected]>
Sent: Monday, April 24, 2023 2:16 PMThis is the start of the stable review cycle for the 5.15.109 release. There are 73 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 26 Apr 2023 13:11:11 +0000. Anything received after that time might be too late.
CIP configurations built and booted with Linux 5.15.109-rc1 (579deb859f24):
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/847553283/test_report
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/commits/linux-5.15.y
Kind regards, Chris
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.109 release. There are 73 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 26 Apr 2023 13:11:11 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.109-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 5.15.109-rc1
* git: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
* git branch: linux-5.15.y
* git commit: 579deb859f242ad9458861ca39034d5dbd3b885b
* git describe: v5.15.105-347-g579deb859f24
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.15.y/build/v5.15.105-347-g579deb859f24
## Test Regressions (compared to v5.15.105-273-gdf26c2ac7eda)
## Metric Regressions (compared to v5.15.105-273-gdf26c2ac7eda)
## Test Fixes (compared to v5.15.105-273-gdf26c2ac7eda)
## Metric Fixes (compared to v5.15.105-273-gdf26c2ac7eda)
## Test result summary
total: 131539, pass: 105712, fail: 3771, skip: 21809, xfail: 247
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 115 total, 114 passed, 1 failed
* arm64: 43 total, 41 passed, 2 failed
* i386: 33 total, 30 passed, 3 failed
* mips: 27 total, 26 passed, 1 failed
* parisc: 8 total, 8 passed, 0 failed
* powerpc: 27 total, 26 passed, 1 failed
* riscv: 11 total, 11 passed, 0 failed
* s390: 12 total, 11 passed, 1 failed
* sh: 14 total, 12 passed, 2 failed
* sparc: 8 total, 8 passed, 0 failed
* x86_64: 36 total, 34 passed, 2 failed
## Test suites summary
* boot
* fwts
* igt-gpu-tools
* kselftest-android
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers-dma-buf
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-firmware
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-net-forwarding
* kselftest-net-mptcp
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-tc-testing
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-vm
* kselftest-x86
* kselftest-zram
* kunit
* kvm-unit-tests
* libhugetlbfs
* log-parser-boot
* log-parser-test
* ltp-cap_bounds
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-filecaps
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-fsx
* ltp-hugetlb
* ltp-io
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-securebits
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* network-basic-tests
* perf
* rcutorture
* v4l2-compliance
* vdso
--
Linaro LKFT
https://lkft.linaro.org
Hi Greg,
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.109 release. There are 73 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
No problems seen on x86_64 and aarch64.
Thanks,
Harshit
Quoted 12 lines
Responses should be made by Wed, 26 Apr 2023 13:11:11 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.109-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.109 release. There are 73 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 26 Apr 2023 13:11:11 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.109-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.109 release. There are 73 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 26 Apr 2023 13:11:11 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.109-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.15.109 release. There are 73 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 26 Apr 2023 13:11:11 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.109-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.15.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah