6.1.33-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainerPATCH 160/225 misc: fastrpc: return -EPIPE to invocations on device removal
In reply to Greg Kroah-HartmanFrom: Richard Acayan <[email protected]>
commit b6a062853ddf6b4f653af2d8b75ba45bb9a036ad upstream.
The return value is initialized as -1, or -EPERM. The completion of an invocation implies that the return value is set appropriately, but "Permission denied" does not accurately describe the outcome of the invocation. Set the invocation's return value to a more appropriate "Broken pipe", as the cleanup breaks the driver's connection with rpmsg.
--- drivers/misc/fastrpc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/misc/fastrpc.c +3 -1
@@ -2149,8 +2149,10 @@ static void fastrpc_notify_users(structstruct fastrpc_invoke_ctx *ctx;spin_lock (&user->lock); -list_for_each_entry (ctx, &user->pending, node) +list_for_each_entry (ctx, &user->pending, node) { + ctx->retval = -EPIPE ;complete (&ctx->work); + }spin_unlock (&user->lock); }
Greg Kroah-Hartman
maintainerPATCH 161/225 misc: fastrpc: reject new invocations during device removal
In reply to Greg Kroah-HartmanFrom: Richard Acayan <[email protected]>
commit 46248400d81e2aa0b65cd659d6f40188192a58b6 upstream.
The channel's rpmsg object allows new invocations to be made. After old invocations are already interrupted, the driver shouldn't try to invoke anymore. Invalidating the rpmsg at the end of the driver removal function makes it easy to cause a race condition in userspace. Even closing a file descriptor before the driver finishes its cleanup can cause an invocation via fastrpc_release_current_dsp_process() and subsequent timeout.
Invalidate the channel before the invocations are interrupted to make sure that no invocations can be created to hang after the device closes.
--- drivers/misc/fastrpc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/misc/fastrpc.c +2 -1
@@ -2162,7 +2162,9 @@ static void fastrpc_rpmsg_remove(structstruct fastrpc_user *user;unsigned long flags; +/* No invocations past this point */ spin_lock_irqsave (&cctx->lock, flags); + cctx->rpdev =NULL ;list_for_each_entry (user, &cctx->users, user)fastrpc_notify_users (user);spin_unlock_irqrestore (&cctx->lock, flags);
@@ -2175,7 +2177,6 @@ static void fastrpc_rpmsg_remove(structof_platform_depopulate (&rpdev->dev); - cctx->rpdev =NULL ;fastrpc_channel_ctx_put (cctx); }
Greg Kroah-Hartman
maintainerPATCH 162/225 scsi: stex: Fix gcc 13 warnings
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
commit 6d074ce231772c66e648a61f6bd2245e7129d1f5 upstream.
gcc 13 may assign another type to enumeration constants than gcc 12. Split the large enum at the top of source file stex.c such that the type of the constants used in time expressions is changed back to the same type chosen by gcc 12. This patch suppresses compiler warnings like this one:
In file included from ./include/linux/bitops.h:7,
from ./include/linux/kernel.h:22,
from drivers/scsi/stex.c:13:drivers/scsi/stex.c: In function ‘stex_common_handshake’:./include/linux/typecheck.h:12:25: error: comparison of distinct pointer types lacks a cast [-Werror]
12 | (void)(&__dummy == &__dummy2); \
| ^~./include/linux/jiffies.h:106:10: note: in expansion of macro ‘typecheck’
106 | typecheck(unsigned long, b) && \
| ^~~~~~~~~
drivers/scsi/stex.c:1035:29: note: in expansion of macro ‘time_after’
1035 | if (time_after(jiffies, before + MU_MAX_DELAY * HZ)) {
| ^~~~~~~~~~See also https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107405.
--- drivers/scsi/stex.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/scsi/stex.c +4 -0
@@ -109,7 +109,9 @@ enum {TASK_ATTRIBUTE_HEADOFQUEUE =0x1 ,TASK_ATTRIBUTE_ORDERED =0x2 , TASK_ATTRIBUTE_ACA = 0x4, +}; +enum {SS_STS_NORMAL =0x80000000 ,SS_STS_DONE =0x40000000 , SS_STS_HANDSHAKE = 0x20000000,
@@ -121,7 +123,9 @@ enum {SS_I2H_REQUEST_RESET =0x2000 , SS_MU_OPERATIONAL = 0x80000000, +}; +enum {STEX_CDB_LENGTH =16 , STATUS_VAR_LEN = 128,
Greg Kroah-Hartman
maintainerPATCH 163/225 ata: libata-scsi: Use correct device no in ata_find_dev()
In reply to Greg Kroah-HartmanFrom: Damien Le Moal <[email protected]>
commit 7f875850f20a42f488840c9df7af91ef7db2d576 upstream.
For devices not attached to a port multiplier and managed directly by libata, the device number passed to ata_find_dev() must always be lower than the maximum number of devices returned by ata_link_max_devices(). That is 1 for SATA devices or 2 for an IDE link with master+slave devices. This device number is the SCSI device ID which matches these constraints as the IDs are generated per port and so never exceed the maximum number of devices for the link being used.
However, for libsas managed devices, SCSI device IDs are assigned per struct scsi_host, leading to device IDs for SATA devices that can be well in excess of libata per-link maximum number of devices. This results in ata_find_dev() to always return NULL for libsas managed devices except for the first device of the target scsi_host with ID (device number) equal to 0. This issue is visible by executing the hdparm utility, which fails. E.g.:
hdparm -i /dev/sdX/dev/sdX:
HDIO_GET_IDENTITY failed: No message of desired type
Fix this by rewriting ata_find_dev() to ignore the device number for non-PMP attached devices with a link with at most 1 device, that is SATA devices. For these, the device number 0 is always used to return the correct pointer to the struct ata_device of the port link. This change excludes IDE master/slave setups (maximum number of devices per link is 2) and port-multiplier attached devices. Also, to be consistant with the fact that SCSI device IDs and channel numbers used as device numbers are both unsigned int, change the devno argument of ata_find_dev() to unsigned int.
--- drivers/ata/libata-scsi.c | 34 ++++++++++++++++++++++++++-------- 1 file changed, 26 insertions(+), 8 deletions(-)
drivers/ata/libata-scsi.c +26 -8
@@ -2699,18 +2699,36 @@ static unsigned int atapi_xlat(struct atreturn 0 ; } -static struct ata_device *ata_find_dev (struct ata_port *ap,int devno) +static struct ata_device *ata_find_dev (struct ata_port *ap,unsigned int devno) { -if (!sata_pmp_attached (ap)) { -if (likely (devno >=0 && - devno <ata_link_max_devices (&ap->link))) +/* +* For the non-PMP case, ata_link_max_devices() returns 1 (SATA case), +* or 2 (IDE master + slave case). However, the former case includes +* libsas hosted devices which are numbered per scsi host, leading +* to devno potentially being larger than 0 but with each struct +* ata_device having its own struct ata_port and struct ata_link. +* To accommodate these, ignore devno and always use device number 0. +*/ +if (likely (!sata_pmp_attached (ap))) { +int link_max_devices =ata_link_max_devices (&ap->link); + +if (link_max_devices ==1 ) +return &ap->link.device[0 ]; + +if (devno < link_max_devices)return &ap->link.device[devno]; - }else { -if (likely (devno >=0 && - devno < ap->nr_pmp_links)) -return &ap->pmp_link[devno].device[0 ]; + +return NULL ; } +/* +* For PMP-attached devices, the device number corresponds to C +* (channel) of SCSI [H:C:I:L], indicating the port pmp link +* for the device. +*/ +if (devno < ap->nr_pmp_links) +return &ap->pmp_link[devno].device[0 ]; +return NULL ; }
Greg Kroah-Hartman
maintainerPATCH 164/225 drm/amdgpu: enable tmz by default for GC 11.0.1
In reply to Greg Kroah-HartmanFrom: Ikshwaku Chauhan <[email protected]>
commit 663b930e24842f3d3bb79418bb5cd8d01b40c559 upstream.
Add IP GC 11.0.1 in the list of target to have tmz enabled by default.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c +2 -1
@@ -526,6 +526,8 @@ void amdgpu_gmc_tmz_set(struct amdgpu_decase IP_VERSION (9 ,3 ,0 ):/* GC 10.3.7 */ case IP_VERSION (10 ,3 ,7 ): +/* GC 11.0.1 */ +case IP_VERSION (11 ,0 ,1 ):if (amdgpu_tmz ==0 ) { adev->gmc.tmz_enabled = false; dev_info(adev->dev,
@@ -548,7 +550,6 @@ void amdgpu_gmc_tmz_set(struct amdgpu_decase IP_VERSION (10 ,3 ,1 ):/* YELLOW_CARP*/ case IP_VERSION (10 ,3 ,3 ): -case IP_VERSION (11 ,0 ,1 ):case IP_VERSION (11 ,0 ,4 ):/* Don't enable it by default yet. */
Greg Kroah-Hartman
maintainerPATCH 165/225 drm/amd/pm: reverse mclk and fclk clocks levels for SMU v13.0.4
In reply to Greg Kroah-HartmanFrom: Tim Huang <[email protected]>
commit 6a07826f2057b5fa1c479ba56460195882464270 upstream.
This patch reverses the DPM clocks levels output of pp_dpm_mclk and pp_dpm_fclk.
On dGPUs and older APUs we expose the levels from lowest clocks to highest clocks. But for some APUs, the clocks levels that from the DFPstateTable are given the reversed orders by PMFW. Like the memory DPM clocks that are exposed by pp_dpm_mclk.
It's not intuitive that they are reversed on these APUs. All tools and software that talks to the driver then has to know different ways to interpret the data depending on the asic.
So we need to reverse them to expose the clocks levels from the driver consistently.
--- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c +3 -2
@@ -478,7 +478,7 @@ static int smu_v13_0_4_get_dpm_level_coustatic int smu_v13_0_4_print_clk_levels (struct smu_context *smu,enum smu_clk_type clk_type,char *buf) { -int i, size =0 , ret =0 ; +int i, idx, size =0 , ret =0 ;uint32_t cur_value =0 , value =0 , count =0 ;uint32_t min, max;
@@ -512,7 +512,8 @@ static int smu_v13_0_4_print_clk_levels(break ;for (i =0 ; i < count; i++) { - ret =smu_v13_0_4_get_dpm_freq_by_index (smu, clk_type, i, &value); + idx = (clk_type ==SMU_FCLK || clk_type ==SMU_MCLK ) ? (count - i -1 ) : i; + ret =smu_v13_0_4_get_dpm_freq_by_index (smu, clk_type, idx, &value);if (ret)break ;
Greg Kroah-Hartman
maintainerPATCH 166/225 drm/amd/pm: reverse mclk and fclk clocks levels for vangogh
In reply to Greg Kroah-HartmanFrom: Tim Huang <[email protected]>
commit bfc03568d9d81332382c73a1985a90c4506bd36c upstream.
This patch reverses the DPM clocks levels output of pp_dpm_mclk and pp_dpm_fclk.
On dGPUs and older APUs we expose the levels from lowest clocks to highest clocks. But for some APUs, the clocks levels that from the DFPstateTable are given the reversed orders by PMFW. Like the memory DPM clocks that are exposed by pp_dpm_mclk.
It's not intuitive that they are reversed on these APUs. All tools and software that talks to the driver then has to know different ways to interpret the data depending on the asic.
So we need to reverse them to expose the clocks levels from the driver consistently.
--- drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c +6 -4
@@ -580,7 +580,7 @@ static int vangogh_print_legacy_clk_leveDpmClocks_t *clk_table = smu->smu_table.clocks_table;SmuMetrics_legacy_t metrics;struct smu_dpm_context *smu_dpm_ctx = &(smu->smu_dpm); -int i, size =0 , ret =0 ; +int i, idx, size =0 , ret =0 ;uint32_t cur_value =0 , value =0 , count =0 ;bool cur_value_match_level = false;
@@ -654,7 +654,8 @@ static int vangogh_print_legacy_clk_levecase SMU_MCLK :case SMU_FCLK :for (i =0 ; i < count; i++) { - ret =vangogh_get_dpm_clk_limited (smu, clk_type, i, &value); + idx = (clk_type ==SMU_FCLK || clk_type ==SMU_MCLK ) ? (count - i -1 ) : i; + ret =vangogh_get_dpm_clk_limited (smu, clk_type, idx, &value);if (ret)return ret;if (!value)
@@ -681,7 +682,7 @@ static int vangogh_print_clk_levels(struDpmClocks_t *clk_table = smu->smu_table.clocks_table;SmuMetrics_t metrics;struct smu_dpm_context *smu_dpm_ctx = &(smu->smu_dpm); -int i, size =0 , ret =0 ; +int i, idx, size =0 , ret =0 ;uint32_t cur_value =0 , value =0 , count =0 ;bool cur_value_match_level = false;uint32_t min, max;
@@ -763,7 +764,8 @@ static int vangogh_print_clk_levels(strucase SMU_MCLK :case SMU_FCLK :for (i =0 ; i < count; i++) { - ret =vangogh_get_dpm_clk_limited (smu, clk_type, i, &value); + idx = (clk_type ==SMU_FCLK || clk_type ==SMU_MCLK ) ? (count - i -1 ) : i; + ret =vangogh_get_dpm_clk_limited (smu, clk_type, idx, &value);if (ret)return ret;if (!value)
Greg Kroah-Hartman
maintainerPATCH 167/225 drm/amd/pm: resolve reboot exception for si oland
In reply to Greg Kroah-HartmanFrom: Guchun Chen <[email protected]>
commit e490d60a2f76bff636c68ce4fe34c1b6c34bbd86 upstream.
During reboot test on arm64 platform, it may failure on boot.
The error message are as follows:
[ 1.706570][ 3] [ T273] [drm:si_thermal_enable_alert [amdgpu]] *ERROR* Could not enable thermal interrupts. [ 1.716547][ 3] [ T273] [drm:amdgpu_device_ip_late_init [amdgpu]] *ERROR* late_init of IP block <si_dpm> failed -22 [ 1.727064][ 3] [ T273] amdgpu 0000:02:00.0: amdgpu_device_ip_late_init failed [ 1.734367][ 3] [ T273] amdgpu 0000:02:00.0: Fatal error during GPU init
v2: squash in built warning fix (Alex)
--- drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 29 ----------------------------- 1 file changed, 29 deletions(-)
drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c +0 -29
@@ -6925,23 +6925,6 @@ static int si_dpm_enable(struct amdgpu_dreturn 0 ; } -static int si_set_temperature_range (struct amdgpu_device *adev) -{ -int ret; - - ret =si_thermal_enable_alert (adev, false); -if (ret) -return ret; - ret =si_thermal_set_temperature_range (adev,R600_TEMP_RANGE_MIN ,R600_TEMP_RANGE_MAX ); -if (ret) -return ret; - ret =si_thermal_enable_alert (adev, true); -if (ret) -return ret; - -return ret; -} -static void si_dpm_disable (struct amdgpu_device *adev) {struct rv7xx_power_info *pi =rv770_get_pi (adev);
@@ -7626,18 +7609,6 @@ static int si_dpm_process_interrupt(strustatic int si_dpm_late_init (void *handle) { -int ret; -struct amdgpu_device *adev = (struct amdgpu_device *)handle; - -if (!adev->pm.dpm_enabled) -return 0 ; - - ret =si_set_temperature_range (adev); -if (ret) -return ret; -#if 0 //TODO ? -si_dpm_powergate_uvd (adev, true); -#endif return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 168/225 drm/amd/pm: reverse mclk clocks levels for SMU v13.0.5
In reply to Greg Kroah-HartmanFrom: Tim Huang <[email protected]>
commit c1d35412b3e826ae8119e3fb5f51dd0fa5b6b567 upstream.
This patch reverses the DPM clocks levels output of pp_dpm_mclk.
On dGPUs and older APUs we expose the levels from lowest clocks to highest clocks. But for some APUs, the clocks levels that from the DFPstateTable are given the reversed orders by PMFW. Like the memory DPM clocks that are exposed by pp_dpm_mclk.
It's not intuitive that they are reversed on these APUs. All tools and software that talks to the driver then has to know different ways to interpret the data depending on the asic.
So we need to reverse them to expose the clocks levels from the driver consistently.
--- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_5_ppt.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_5_ppt.c +3 -2
@@ -866,7 +866,7 @@ out:static int smu_v13_0_5_print_clk_levels (struct smu_context *smu,enum smu_clk_type clk_type,char *buf) { -int i, size =0 , ret =0 ; +int i, idx, size =0 , ret =0 ;uint32_t cur_value =0 , value =0 , count =0 ;uint32_t min =0 , max =0 ;
@@ -898,7 +898,8 @@ static int smu_v13_0_5_print_clk_levels( goto print_clk_out;for (i =0 ; i < count; i++) { - ret =smu_v13_0_5_get_dpm_freq_by_index (smu, clk_type, i, &value); + idx = (clk_type ==SMU_MCLK ) ? (count - i -1 ) : i; + ret =smu_v13_0_5_get_dpm_freq_by_index (smu, clk_type, idx, &value);if (ret) goto print_clk_out;
Greg Kroah-Hartman
maintainerPATCH 169/225 drm/amd/pm: reverse mclk and fclk clocks levels for yellow carp
In reply to Greg Kroah-HartmanFrom: Tim Huang <[email protected]>
commit f1373a97a41f429e0095d4be388092ffa3c1a157 upstream.
This patch reverses the DPM clocks levels output of pp_dpm_mclk and pp_dpm_fclk.
On dGPUs and older APUs we expose the levels from lowest clocks to highest clocks. But for some APUs, the clocks levels that from the DFPstateTable are given the reversed orders by PMFW. Like the memory DPM clocks that are exposed by pp_dpm_mclk.
It's not intuitive that they are reversed on these APUs. All tools and software that talks to the driver then has to know different ways to interpret the data depending on the asic.
So we need to reverse them to expose the clocks levels from the driver consistently.
--- drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c +3 -2
@@ -1000,7 +1000,7 @@ out:static int yellow_carp_print_clk_levels (struct smu_context *smu,enum smu_clk_type clk_type,char *buf) { -int i, size =0 , ret =0 ; +int i, idx, size =0 , ret =0 ;uint32_t cur_value =0 , value =0 , count =0 ;uint32_t min, max;
@@ -1033,7 +1033,8 @@ static int yellow_carp_print_clk_levels( goto print_clk_out;for (i =0 ; i < count; i++) { - ret =yellow_carp_get_dpm_freq_by_index (smu, clk_type, i, &value); + idx = (clk_type ==SMU_FCLK || clk_type ==SMU_MCLK ) ? (count - i -1 ) : i; + ret =yellow_carp_get_dpm_freq_by_index (smu, clk_type, idx, &value);if (ret) goto print_clk_out;
Greg Kroah-Hartman
maintainerPATCH 170/225 drm/amd/pm: reverse mclk and fclk clocks levels for renoir
In reply to Greg Kroah-HartmanFrom: Tim Huang <[email protected]>
commit 55e02c14f9b5fd973ba32a16a715baa42617f9c6 upstream.
This patch reverses the DPM clocks levels output of pp_dpm_mclk and pp_dpm_fclk for renoir.
On dGPUs and older APUs we expose the levels from lowest clocks to highest clocks. But for some APUs, the clocks levels are given the reversed orders by PMFW. Like the memory DPM clocks that are exposed by pp_dpm_mclk.
It's not intuitive that they are reversed on these APUs. All tools and software that talks to the driver then has to know different ways to interpret the data depending on the asic.
So we need to reverse them to expose the clocks levels from the driver consistently.
--- drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c +3 -2
@@ -494,7 +494,7 @@ static int renoir_set_fine_grain_gfx_frestatic int renoir_print_clk_levels (struct smu_context *smu,enum smu_clk_type clk_type,char *buf) { -int i, size =0 , ret =0 ; +int i, idx, size =0 , ret =0 ;uint32_t cur_value =0 , value =0 , count =0 , min =0 , max =0 ;SmuMetrics_t metrics;struct smu_dpm_context *smu_dpm_ctx = &(smu->smu_dpm);
@@ -594,7 +594,8 @@ static int renoir_print_clk_levels(struccase SMU_VCLK :case SMU_DCLK :for (i =0 ; i < count; i++) { - ret =renoir_get_dpm_clk_limited (smu, clk_type, i, &value); + idx = (clk_type ==SMU_FCLK || clk_type ==SMU_MCLK ) ? (count - i -1 ) : i; + ret =renoir_get_dpm_clk_limited (smu, clk_type, idx, &value);if (ret)return ret;if (!value)
Greg Kroah-Hartman
maintainerPATCH 171/225 x86/mtrr: Revert 90b926e68f50 ("x86/pat: Fix pat_x_mtrr_type() for MTRR disabled case")
In reply to Greg Kroah-HartmanFrom: Juergen Gross <[email protected]>
commit f9f57da2c2d119dbf109e3f6e1ceab7659294046 upstream.
Commit
90b926e68f50 ("x86/pat: Fix pat_x_mtrr_type() for MTRR disabled case")
broke the use case of running Xen dom0 kernels on machines with an external disk enclosure attached via USB, see Link tag.
What this commit was originally fixing - SEV-SNP guests on Hyper-V - is a more specialized situation which has other issues at the moment anyway so reverting this now and addressing the issue properly later is the prudent thing to do.
So revert it in time for the 6.2 proper release.
[ bp: Rewrite commit message. ]
--- arch/x86/mm/pat/memtype.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/x86/mm/pat/memtype.c +1 -2
@@ -434,8 +434,7 @@ static unsigned long pat_x_mtrr_type(u64u8 mtrr_type, uniform; mtrr_type =mtrr_type_lookup (start, end, &uniform); -if (mtrr_type !=MTRR_TYPE_WRBACK && - mtrr_type !=MTRR_TYPE_INVALID ) +if (mtrr_type !=MTRR_TYPE_WRBACK )return _PAGE_CACHE_MODE_UC_MINUS;return _PAGE_CACHE_MODE_WB;
Greg Kroah-Hartman
maintainerPATCH 172/225 mmc: vub300: fix invalid response handling
In reply to Greg Kroah-HartmanFrom: Deren Wu <[email protected]>
commit a99d21cefd351c8aaa20b83a3c942340e5789d45 upstream.
We may get an empty response with zero length at the beginning of the driver start and get following UBSAN error. Since there is no content(SDRT_NONE) for the response, just return and skip the response handling to avoid this problem.
Test pass : SDIO wifi throughput test with this patch
[ 126.980684] UBSAN: array-index-out-of-bounds in drivers/mmc/host/vub300.c:1719:12 [ 126.980709] index -1 is out of range for type 'u32 [4]' [ 126.980729] CPU: 4 PID: 9 Comm: kworker/u16:0 Tainted: G E 6.3.0-rc4-mtk-local-202304272142 #1 [ 126.980754] Hardware name: Intel(R) Client Systems NUC8i7BEH/NUC8BEB, BIOS BECFL357.86A.0081.2020.0504.1834 05/04/2020 [ 126.980770] Workqueue: kvub300c vub300_cmndwork_thread [vub300] [ 126.980833] Call Trace: [ 126.980845] <TASK> [ 126.980860] dump_stack_lvl+0x48/0x70 [ 126.980895] dump_stack+0x10/0x20 [ 126.980916] ubsan_epilogue+0x9/0x40 [ 126.980944] __ubsan_handle_out_of_bounds+0x70/0x90 [ 126.980979] vub300_cmndwork_thread+0x58e7/0x5e10 [vub300] [ 126.981018] ? _raw_spin_unlock+0x18/0x40 [ 126.981042] ? finish_task_switch+0x175/0x6f0 [ 126.981070] ? __switch_to+0x42e/0xda0 [ 126.981089] ? __switch_to_asm+0x3a/0x80 [ 126.981129] ? __pfx_vub300_cmndwork_thread+0x10/0x10 [vub300] [ 126.981174] ? __kasan_check_read+0x11/0x20 [ 126.981204] process_one_work+0x7ee/0x13d0 [ 126.981246] worker_thread+0x53c/0x1240 [ 126.981291] kthread+0x2b8/0x370 [ 126.981312] ? __pfx_worker_thread+0x10/0x10 [ 126.981336] ? __pfx_kthread+0x10/0x10 [ 126.981359] ret_from_fork+0x29/0x50 [ 126.981400] </TASK>
--- drivers/mmc/host/vub300.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/mmc/host/vub300.c +3 -0
@@ -1715,6 +1715,9 @@ static void construct_request_response(sint bytes =3 & less_cmd;int words = less_cmd >>2 ;u8 *r = vub300->resp.response.command_response; + +if (!resp_len) +return ;if (bytes ==3 ) { cmd->resp[words] = (r[1 + (words <<2 )] <<24 ) | (r[2 + (words <<2 )] <<16 )
Greg Kroah-Hartman
maintainerPATCH 173/225 mmc: pwrseq: sd8787: Fix WILC CHIP_EN and RESETN toggling order
In reply to Greg Kroah-HartmanFrom: Marek Vasut <[email protected]>
commit 0b5d5c436a5c572a45f976cfd34a6741e143e5d9 upstream.
Chapter "5.3 Power-Up/Down Sequence" of WILC1000 [1] and WILC3000 [2] states that CHIP_EN must be pulled HIGH first, RESETN second. Fix the order of these signals in the driver.
Use the mmc_pwrseq_ops as driver data as the delay between signals is specific to SDIO card type anyway.
[1] https://ww1.microchip.com/downloads/aemDocuments/documents/WSG/ProductDocuments/DataSheets/ATWILC1000-MR110XB-IEEE-802.11-b-g-n-Link-Controller-Module-DS70005326E.pdf
[2] https://ww1.microchip.com/downloads/aemDocuments/documents/OTH/ProductDocuments/DataSheets/IEEE-802.11-b-g-n-Link-Controller-Module-with-Integrated-Bluetooth-5.0-DS70005327B.pdf
--- drivers/mmc/core/pwrseq_sd8787.c | 34 ++++++++++++++++++++++++++-------- 1 file changed, 26 insertions(+), 8 deletions(-)
drivers/mmc/core/pwrseq_sd8787.c +26 -8
@@ -28,7 +28,6 @@ struct mmc_pwrseq_sd8787 {struct mmc_pwrseq pwrseq;struct gpio_desc *reset_gpio;struct gpio_desc *pwrdn_gpio; -u32 reset_pwrdwn_delay_ms; };#define to_pwrseq_sd8787 (p) container_of(p, struct mmc_pwrseq_sd8787, pwrseq)
@@ -39,7 +38,7 @@ static void mmc_pwrseq_sd8787_pre_power_gpiod_set_value_cansleep (pwrseq->reset_gpio,1 ); -msleep (pwrseq->reset_pwrdwn_delay_ms); +msleep (300 );gpiod_set_value_cansleep (pwrseq->pwrdn_gpio,1 ); }
@@ -51,17 +50,37 @@ static void mmc_pwrseq_sd8787_power_off(gpiod_set_value_cansleep (pwrseq->reset_gpio,0 ); } +static void mmc_pwrseq_wilc1000_pre_power_on (struct mmc_host *host) +{ +struct mmc_pwrseq_sd8787 *pwrseq =to_pwrseq_sd8787 (host->pwrseq); + +/* The pwrdn_gpio is really CHIP_EN, reset_gpio is RESETN */ +gpiod_set_value_cansleep (pwrseq->pwrdn_gpio,1 ); +msleep (5 ); +gpiod_set_value_cansleep (pwrseq->reset_gpio,1 ); +} + +static void mmc_pwrseq_wilc1000_power_off (struct mmc_host *host) +{ +struct mmc_pwrseq_sd8787 *pwrseq =to_pwrseq_sd8787 (host->pwrseq); + +gpiod_set_value_cansleep (pwrseq->reset_gpio,0 ); +gpiod_set_value_cansleep (pwrseq->pwrdn_gpio,0 ); +} +static const struct mmc_pwrseq_ops mmc_pwrseq_sd8787_ops = { .pre_power_on = mmc_pwrseq_sd8787_pre_power_on, .power_off = mmc_pwrseq_sd8787_power_off, }; -static const u32 sd8787_delay_ms =300 ; -static const u32 wilc1000_delay_ms =5 ; +static const struct mmc_pwrseq_ops mmc_pwrseq_wilc1000_ops = { + .pre_power_on = mmc_pwrseq_wilc1000_pre_power_on, + .power_off = mmc_pwrseq_wilc1000_power_off, +};static const struct of_device_id mmc_pwrseq_sd8787_of_match[] = { - { .compatible ="mmc-pwrseq-sd8787" , .data = &sd8787_delay_ms }, - { .compatible ="mmc-pwrseq-wilc1000" , .data = &wilc1000_delay_ms }, + { .compatible ="mmc-pwrseq-sd8787" , .data = &mmc_pwrseq_sd8787_ops }, + { .compatible ="mmc-pwrseq-wilc1000" , .data = &mmc_pwrseq_wilc1000_ops }, {/* sentinel */ }, };MODULE_DEVICE_TABLE (of, mmc_pwrseq_sd8787_of_match);
@@ -77,7 +96,6 @@ static int mmc_pwrseq_sd8787_probe(strucreturn -ENOMEM ; match =of_match_node (mmc_pwrseq_sd8787_of_match, pdev->dev.of_node); - pwrseq->reset_pwrdwn_delay_ms = *(u32 *)match->data; pwrseq->pwrdn_gpio =devm_gpiod_get (dev,"powerdown" ,GPIOD_OUT_LOW );if (IS_ERR (pwrseq->pwrdn_gpio))
@@ -88,7 +106,7 @@ static int mmc_pwrseq_sd8787_probe(strucreturn PTR_ERR (pwrseq->reset_gpio); pwrseq->pwrseq.dev = dev; - pwrseq->pwrseq.ops = &mmc_pwrseq_sd8787_ops; + pwrseq->pwrseq.ops = match->data; pwrseq->pwrseq.owner =THIS_MODULE ;platform_set_drvdata (pdev, pwrseq);
Greg Kroah-Hartman
maintainerPATCH 174/225 tty: serial: fsl_lpuart: use UARTCTRL_TXINV to send break instead of UARTCTRL_SBK
In reply to Greg Kroah-HartmanFrom: Sherry Sun <[email protected]>
commit 2474e05467c00f7d51af3039b664de6886325257 upstream.
LPUART IP now has two known bugs, one is that CTS has higher priority than the break signal, which causes the break signal sending through UARTCTRL_SBK may impacted by the CTS input if the HW flow control is enabled. It exists on all platforms we support in this driver. So we add a workaround patch for this issue: commit c4c81db5cf8b ("tty: serial: fsl_lpuart: disable the CTS when send break signal").
Another IP bug is i.MX8QM LPUART may have an additional break character being sent after SBK was cleared. It may need to add some delay between clearing SBK and re-enabling CTS to ensure that the SBK latch are completely cleared.
But we found that during the delay period before CTS is enabled, there is still a risk that Bluetooth data in TX FIFO may be sent out during this period because of break off and CTS disabled(even if BT sets CTS line deasserted, data is still sent to BT).
Due to this risk, we have to drop the CTS-disabling workaround for SBK bugs, use TXINV seems to be a better way to replace SBK feature and avoid above risk. Also need to disable the transmitter to prevent any data from being sent out during break, then invert the TX line to send break. Then disable the TXINV when turn off break and re-enable transmitter.
--- drivers/tty/serial/fsl_lpuart.c | 44 ++++++++++++++++++++-------------------- 1 file changed, 23 insertions(+), 21 deletions(-)
drivers/tty/serial/fsl_lpuart.c +23 -21
@@ -1475,34 +1475,36 @@ static void lpuart_break_ctl(struct uartstatic void lpuart32_break_ctl (struct uart_port *port,int break_state) { -unsigned long temp, modem; -struct tty_struct *tty; -unsigned int cflag =0 ; +unsigned long temp; - tty =tty_port_tty_get (&port->state->port); -if (tty) { - cflag = tty->termios.c_cflag; -tty_kref_put (tty); - } - - temp =lpuart32_read (port,UARTCTRL ) & ~UARTCTRL_SBK ; - modem =lpuart32_read (port,UARTMODIR ); + temp =lpuart32_read (port,UARTCTRL ); +/* +* LPUART IP now has two known bugs, one is CTS has higher priority than the +* break signal, which causes the break signal sending through UARTCTRL_SBK +* may impacted by the CTS input if the HW flow control is enabled. It +* exists on all platforms we support in this driver. +* Another bug is i.MX8QM LPUART may have an additional break character +* being sent after SBK was cleared. +* To avoid above two bugs, we use Transmit Data Inversion function to send +* the break signal instead of UARTCTRL_SBK. +*/ if (break_state !=0 ) { - temp |=UARTCTRL_SBK ;/* -* LPUART CTS has higher priority than SBK, need to disable CTS before -* asserting SBK to avoid any interference if flow control is enabled. +* Disable the transmitter to prevent any data from being sent out +* during break, then invert the TX line to send break. */ -if (cflag &CRTSCTS && modem &UARTMODIR_TXCTSE ) -lpuart32_write (port, modem & ~UARTMODIR_TXCTSE ,UARTMODIR ); + temp &= ~UARTCTRL_TE ; +lpuart32_write (port, temp,UARTCTRL ); + temp |=UARTCTRL_TXINV ; +lpuart32_write (port, temp,UARTCTRL ); }else { -/* Re-enable the CTS when break off. */ -if (cflag &CRTSCTS && !(modem &UARTMODIR_TXCTSE )) -lpuart32_write (port, modem |UARTMODIR_TXCTSE ,UARTMODIR ); +/* Disable the TXINV to turn off break and re-enable transmitter. */ + temp &= ~UARTCTRL_TXINV ; +lpuart32_write (port, temp,UARTCTRL ); + temp |=UARTCTRL_TE ; +lpuart32_write (port, temp,UARTCTRL ); } - -lpuart32_write (port, temp,UARTCTRL ); }static void lpuart_setup_watermark (struct lpuart_port *sport)
Greg Kroah-Hartman
maintainerPATCH 175/225 btrfs: fix csum_tree_block page iteration to avoid tripping on -Werror=array-bounds
In reply to Greg Kroah-HartmanFrom: pengfuyuan <[email protected]>
commit 5ad9b4719fc9bc4715c7e19875a962095b0577e7 upstream.
When compiling on a MIPS 64-bit machine we get these warnings:
In file included from ./arch/mips/include/asm/cacheflush.h:13,
from ./include/linux/cacheflush.h:5,
from ./include/linux/highmem.h:8,
from ./include/linux/bvec.h:10,
from ./include/linux/blk_types.h:10,
from ./include/linux/blkdev.h:9,
from fs/btrfs/disk-io.c:7:
fs/btrfs/disk-io.c: In function ‘csum_tree_block’:
fs/btrfs/disk-io.c:100:34: error: array subscript 1 is above array bounds of ‘struct page *[1]’ [-Werror=array-bounds]
100 | kaddr = page_address(buf->pages[i]);
| ~~~~~~~~~~^~~
./include/linux/mm.h:2135:48: note: in definition of macro ‘page_address’
2135 | #define page_address(page) lowmem_page_address(page)
| ^~~~
cc1: all warnings being treated as errors
We can check if i overflows to solve the problem. However, this doesn't make much sense, since i == 1 and num_pages == 1 doesn't execute the body of the loop. In addition, i < num_pages can also ensure that buf->pages[i] will not cross the boundary. Unfortunately, this doesn't help with the problem observed here:
gcc still complains.
To fix this add a compile-time condition for the extent buffer page array size limit, which would eventually lead to eliminating the whole for loop.
--- fs/btrfs/disk-io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/disk-io.c +1 -1
@@ -104,7 +104,7 @@ static void csum_tree_block(struct extencrypto_shash_update (shash, kaddr +BTRFS_CSUM_SIZE , first_page_part -BTRFS_CSUM_SIZE ); -for (i =1 ; i < num_pages; i++) { +for (i =1 ; i < num_pages &&INLINE_EXTENT_BUFFER_PAGES >1 ; i++) { kaddr =page_address (buf->pages[i]);crypto_shash_update (shash, kaddr,PAGE_SIZE ); }
Greg Kroah-Hartman
maintainerPATCH 176/225 phy: qcom-qmp-combo: fix init-count imbalance
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 9bf03a0cbd80a256bc1e1c4bcc80bc2b06b8b2b9 upstream.
The init counter is not decremented on initialisation errors, which prevents retrying initialisation and can lead to the runtime suspend callback attempting to disable resources that have never been enabled.
Add the missing decrement on initialisation errors so that the counter reflects the state of the device.
--- drivers/phy/qualcomm/phy-qcom-qmp-combo.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/phy/qualcomm/phy-qcom-qmp-combo.c +3 -2
@@ -1993,7 +1993,7 @@ static int qmp_combo_com_init(struct qmp ret =regulator_bulk_enable (cfg->num_vregs, qmp->vregs);if (ret) {dev_err (qmp->dev,"failed to enable regulators, err=%d\n" , ret); - goto err_unlock; + goto err_decrement_count; } ret =reset_control_bulk_assert (cfg->num_resets, qmp->resets);
@@ -2048,7 +2048,8 @@ err_assert_reset:reset_control_bulk_assert (cfg->num_resets, qmp->resets); err_disable_regulators:regulator_bulk_disable (cfg->num_vregs, qmp->vregs); -err_unlock: +err_decrement_count: + qmp->init_count--;mutex_unlock (&qmp->phy_mutex);return ret;
Greg Kroah-Hartman
maintainerPATCH 177/225 phy: qcom-qmp-pcie-msm8996: fix init-count imbalance
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit e42f110700ed7293700c26145e1ed07ea05ac3f6 upstream.
The init counter is not decremented on initialisation errors, which prevents retrying initialisation.
Add the missing decrement on initialisation errors so that the counter reflects the state of the device.
--- drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c +3 -2
@@ -425,7 +425,7 @@ static int qmp_pcie_msm8996_com_init(str ret =regulator_bulk_enable (cfg->num_vregs, qmp->vregs);if (ret) {dev_err (qmp->dev,"failed to enable regulators, err=%d\n" , ret); - goto err_unlock; + goto err_decrement_count; } ret =reset_control_bulk_assert (cfg->num_resets, qmp->resets);
@@ -455,7 +455,8 @@ err_assert_reset:reset_control_bulk_assert (cfg->num_resets, qmp->resets); err_disable_regulators:regulator_bulk_disable (cfg->num_vregs, qmp->vregs); -err_unlock: +err_decrement_count: + qmp->init_count--;mutex_unlock (&qmp->phy_mutex);return ret;
Greg Kroah-Hartman
maintainerPATCH 178/225 block: fix revalidate performance regression
In reply to Greg Kroah-HartmanFrom: Damien Le Moal <[email protected]>
commit 47fe1c3064c6bc1bfa3c032ff78e603e5dd6e5bc upstream.
The scsi driver function sd_read_block_characteristics() always calls disk_set_zoned() to a disk zoned model correctly, in case the device model changed. This is done even for regular disks to set the zoned model to BLK_ZONED_NONE and free any zone related resources if the drive previously was zoned.
This behavior significantly impact the time it takes to revalidate disks on a large system as the call to disk_clear_zone_settings() done from disk_set_zoned() for the BLK_ZONED_NONE case results in the device request queued to be frozen, even if there are no zone resources to free.
Avoid this overhead for non-zoned devices by not calling disk_clear_zone_settings() in disk_set_zoned() if the device model was already set to BLK_ZONED_NONE, which is always the case for regular devices.
Reported by: Brian Bunker <[email protected]>
--- block/blk-settings.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
block/blk-settings.c +2 -1
@@ -909,6 +909,7 @@ static bool disk_has_partitions(struct gvoid disk_set_zoned (struct gendisk *disk,enum blk_zoned_model model) {struct request_queue *q = disk->queue; +unsigned int old_model = q->limits.zoned;switch (model) {case BLK_ZONED_HM :
@@ -946,7 +947,7 @@ void disk_set_zoned(struct gendisk *disk*/ blk_queue_zone_write_granularity (q,queue_logical_block_size (q)); - }else { + }else if (old_model !=BLK_ZONED_NONE ) {disk_clear_zone_settings (disk); } }
Greg Kroah-Hartman
maintainerPATCH 179/225 powerpc/iommu: Limit number of TCEs to 512 for H_STUFF_TCE hcall
In reply to Greg Kroah-HartmanFrom: Gaurav Batra <[email protected]>
commit 9d2ccf00bddc268045e3d65a8108d61ada0e4b4e upstream.
Currently in tce_freemulti_pSeriesLP() there is no limit on how many TCEs are passed to the H_STUFF_TCE hcall. This has not caused an issue until now, but newer firmware releases have started enforcing a limit of 512 TCEs per call.
The limit is correct per the specification (PAPR v2.12 § 14.5.4.2.3).
The code has been in it's current form since it was initially merged.
--- arch/powerpc/platforms/pseries/iommu.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
arch/powerpc/platforms/pseries/iommu.c +11 -2
@@ -311,13 +311,22 @@ static void tce_free_pSeriesLP(unsignedstatic void tce_freemulti_pSeriesLP (struct iommu_table *tbl,long tcenum,long npages) {u64 rc; +long rpages = npages; +unsigned long limit;if (!firmware_has_feature (FW_FEATURE_STUFF_TCE ))return tce_free_pSeriesLP (tbl->it_index, tcenum, tbl->it_page_shift, npages); - rc =plpar_tce_stuff ((u64 )tbl->it_index, - (u64 )tcenum << tbl->it_page_shift,0 , npages); +do { + limit = min_t(unsigned long, rpages, 512); + + rc =plpar_tce_stuff ((u64 )tbl->it_index, + (u64 )tcenum << tbl->it_page_shift,0 , limit); + + rpages -= limit; + tcenum += limit; + }while (rpages >0 && !rc);if (rc &&printk_ratelimit ()) {printk ("tce_freemulti_pSeriesLP: plpar_tce_stuff failed\n" );
Greg Kroah-Hartman
maintainerPATCH 180/225 iommu/amd: Fix domain flush size when syncing iotlb
In reply to Greg Kroah-HartmanFrom: Jon Pan-Doh <[email protected]>
commit 2212fc2acf3f6ee690ea36506fb882a19d1bfcab upstream.
When running on an AMD vIOMMU, we observed multiple invalidations (of decreasing power of 2 aligned sizes) when unmapping a single page.
Domain flush takes gather bounds (end-start) as size param. However, gather->end is defined as the last inclusive address (start + size - 1). This leads to an off by 1 error.
With this patch, verified that 1 invalidation occurs when unmapping a single page.
--- drivers/iommu/amd/iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iommu/amd/iommu.c +1 -1
@@ -2396,7 +2396,7 @@ static void amd_iommu_iotlb_sync(structunsigned long flags;spin_lock_irqsave (&dom->lock, flags); -domain_flush_pages (dom, gather->start, gather->end - gather->start,1 ); +domain_flush_pages (dom, gather->start, gather->end - gather->start +1 ,1 );amd_iommu_domain_flush_complete (dom);spin_unlock_irqrestore (&dom->lock, flags); }
Greg Kroah-Hartman
maintainerPATCH 181/225 tpm, tpm_tis: correct tpm_tis_flags enumeration values
In reply to Greg Kroah-HartmanFrom: Lino Sanfilippo <[email protected]>
commit 4ecd704a4c51fd95973fcc3a60444e0e24eb9439 upstream.
With commit 858e8b792d06 ("tpm, tpm_tis: Avoid cache incoherency in test for interrupts") bit accessor functions are used to access flags in tpm_tis_data->flags.
However these functions expect bit numbers, while the flags are defined as bit masks in enum tpm_tis_flag.
Fix this inconsistency by using numbers instead of masks also for the flags in the enum.
--- drivers/char/tpm/tpm_tis_core.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/char/tpm/tpm_tis_core.h +4 -4
@@ -84,10 +84,10 @@ enum tis_defaults {#define ILB_REMAP_SIZE 0x100enum tpm_tis_flags { -TPM_TIS_ITPM_WORKAROUND =BIT (0 ), -TPM_TIS_INVALID_STATUS =BIT (1 ), -TPM_TIS_DEFAULT_CANCELLATION =BIT (2 ), -TPM_TIS_IRQ_TESTED =BIT (3 ), +TPM_TIS_ITPM_WORKAROUND =0 , +TPM_TIS_INVALID_STATUS =1 , +TPM_TIS_DEFAULT_CANCELLATION =2 , +TPM_TIS_IRQ_TESTED =3 , };struct tpm_tis_data {
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 182/225 riscv: perf: Fix callchain parse error with kernel tracepoint events
In reply to Greg Kroah-HartmanFrom: Ism Hong <[email protected]>
commit 9a7e8ec0d4cc64870ea449b4fce5779b77496cbb upstream.
For RISC-V, when tracing with tracepoint events, the IP and status are set to 0, preventing the perf code parsing the callchain and resolving the symbols correctly.
./ply 'tracepoint:kmem/kmem_cache_alloc { @[stack]=count(); }' @:
{ <STACKID4294967282> }: 1
The fix is to implement perf_arch_fetch_caller_regs for riscv, which fills several necessary registers used for callchain unwinding, including epc, sp, s0 and status. It's similar to commit b3eac0265bf6 ("arm: perf: Fix callchain parse error with kernel tracepoint events") and commit 5b09a094f2fb ("arm64: perf: Fix callchain parse error with kernel tracepoint events").
With this patch, callchain can be parsed correctly as:
./ply 'tracepoint:kmem/kmem_cache_alloc { @[stack]=count(); }' @:
{
__traceiter_kmem_cache_alloc+68
__traceiter_kmem_cache_alloc+68
kmem_cache_alloc+354
__sigqueue_alloc+94
__send_signal_locked+646
send_signal_locked+154
do_send_sig_info+84
__kill_pgrp_info+130
kill_pgrp+60
isig+150
n_tty_receive_signal_char+36
n_tty_receive_buf_standard+2214
n_tty_receive_buf_common+280
n_tty_receive_buf2+26
tty_ldisc_receive_buf+34
tty_port_default_receive_buf+62
flush_to_ldisc+158
process_one_work+458
worker_thread+138
kthread+178
riscv_cpufeature_patch_func+832}: 1
--- arch/riscv/include/asm/perf_event.h | 7 +++++++ 1 file changed, 7 insertions(+)
arch/riscv/include/asm/perf_event.h +7 -0
@@ -10,4 +10,11 @@#include <linux/perf_event.h> #define perf_arch_bpf_user_pt_regs (regs) (struct user_regs_struct *)regs + +#define perf_arch_fetch_caller_regs (regs, __ip) { \ + (regs)->epc = (__ip); \ + (regs)->s0 = (unsigned long) __builtin_frame_address(0); \ + (regs)->sp = current_stack_pointer; \ + (regs)->status = SR_PP; \ +}#endif /* _ASM_RISCV_PERF_EVENT_H */
Greg Kroah-Hartman
maintainerPATCH 183/225 io_uring: undeprecate epoll_ctl support
In reply to Greg Kroah-HartmanFrom: Ben Noordhuis <[email protected]>
commit 4ea0bf4b98d66a7a790abb285539f395596bae92 upstream.
Libuv recently started using it so there is at least one consumer now.
--- io_uring/epoll.c | 4 ---- 1 file changed, 4 deletions(-)
io_uring/epoll.c +0 -4
@@ -25,10 +25,6 @@ int io_epoll_ctl_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe) { struct io_epoll *epoll = io_kiocb_to_cmd(req, struct io_epoll); -pr_warn_once ("%s: epoll_ctl support in io_uring is deprecated and will " -"be removed in a future Linux kernel version.\n" , - current->comm); -if (sqe->buf_index || sqe->splice_fd_in)return -EINVAL ;
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 184/225 selinux: dont use makes grouped targets feature yet
In reply to Greg Kroah-HartmanFrom: Paul Moore <[email protected]>
commit 42c4e97e06a839b07d834f640a10911ad84ec8b3 upstream.
The Linux Kernel currently only requires make v3.82 while the grouped target functionality requires make v4.3. Removed the grouped target introduced in 4ce1f694eb5d ("selinux: ensure av_permissions.h is built when needed") as well as the multiple header file targets in the make rule. This effectively reverts the problem commit.
We will revisit this change when make >= 4.3 is required by the rest of the kernel.
--- security/selinux/Makefile | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
security/selinux/Makefile +5 -1
@@ -26,5 +26,9 @@ quiet_cmd_flask = GEN $(obj)/flask.h cmd_flask = $< $(obj)/flask.h $(obj)/av_permissions.h targets += flask.h av_permissions.h -$(obj)/flask.h $(obj)/av_permissions.h &: scripts/selinux/genheaders/genheaders FORCE +# once make >= 4.3 is required, we can use grouped targets in the rule below, +# which basically involves adding both headers and a '&' before the colon, see +# the example below: +# $(obj)/flask.h $(obj)/av_permissions.h &: scripts/selinux/... +$(obj)/flask.h: scripts/selinux/genheaders/genheaders FORCE $(call if_changed,flask)
Greg Kroah-Hartman
maintainerPATCH 185/225 mtdchar: mark bits of ioctl handler noinline
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit 0ea923f443350c8c5cca6eef5b748d52b903f46c upstream.
The addition of the mtdchar_read_ioctl() function caused the stack usage of mtdchar_ioctl() to grow beyond the warning limit on 32-bit architectures with gcc-13:
drivers/mtd/mtdchar.c: In function 'mtdchar_ioctl':drivers/mtd/mtdchar.c:1229:1: error: the frame size of 1488 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
Mark both the read and write portions as noinline_for_stack to ensure they don't get inlined and use separate stack slots to reduce the maximum usage, both in the mtdchar_ioctl() and combined with any of its callees.
--- drivers/mtd/mtdchar.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/mtd/mtdchar.c +4 -4
@@ -590,8 +590,8 @@ static void adjust_oob_length(struct mtd (end_page - start_page + 1) * oob_per_page); } -static int mtdchar_write_ioctl (struct mtd_info *mtd, -struct mtd_write_req __user *argp) +static noinline_for_stack int +mtdchar_write_ioctl (struct mtd_info *mtd,struct mtd_write_req __user *argp) {struct mtd_info *master =mtd_get_master (mtd);struct mtd_write_req req;
@@ -688,8 +688,8 @@ static int mtdchar_write_ioctl(struct mtreturn ret; } -static int mtdchar_read_ioctl (struct mtd_info *mtd, -struct mtd_read_req __user *argp) +static noinline_for_stack int +mtdchar_read_ioctl (struct mtd_info *mtd,struct mtd_read_req __user *argp) {struct mtd_info *master =mtd_get_master (mtd);struct mtd_read_req req;
Greg Kroah-Hartman
maintainerPATCH 186/225 tracing/timerlat: Always wakeup the timerlat thread
In reply to Greg Kroah-HartmanFrom: Daniel Bristot de Oliveira <[email protected]>
commit 632478a05821bc1c9b55c3a1dd0fb1be7bfa1acc upstream.
While testing rtla timerlat auto analysis, I reach a condition where the interface was not receiving tracing data. I was able to manually reproduce the problem with these steps:
# echo 0 > tracing_on # disable trace
# echo 1 > osnoise/stop_tracing_us # stop trace if timerlat irq > 1 us
# echo timerlat > current_tracer # enable timerlat tracer
# sleep 1 # wait... that is the time when rtla
# apply configs like prio or cgroup
# echo 1 > tracing_on # start tracing
# cat trace
# tracer: timerlat
#
# _-----=> irqs-off
# / _----=> need-resched
# | / _---=> hardirq/softirq
# || / _--=> preempt-depth
# ||| / _-=> migrate-disable
# |||| / delay
# ||||| ACTIVATION
# TASK-PID CPU# ||||| TIMESTAMP ID CONTEXT LATENCY
# | | | ||||| | | | |
NOTHING!Then, trying to enable tracing again with echo 1 > tracing_on resulted in no change: the trace was still not tracing.
This problem happens because the timerlat IRQ hits the stop tracing condition while tracing is off, and do not wake up the timerlat thread, so the timerlat threads are kept sleeping forever, resulting in no trace, even after re-enabling the tracer.
Avoid this condition by always waking up the threads, even after stopping tracing, allowing the tracer to return to its normal operating after a new tracing on.
--- kernel/trace/trace_osnoise.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/trace/trace_osnoise.c +2 -0
@@ -1595,6 +1595,8 @@ static enum hrtimer_restart timerlat_irqosnoise_stop_tracing ();notify_new_max_latency (diff); +wake_up_process (tlat->kthread); +return HRTIMER_NORESTART ; } }
Greg Kroah-Hartman
maintainerPATCH 187/225 tracing/histograms: Allow variables to have some modifiers
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (Google) <[email protected]>
commit e30fbc618e97b38dbb49f1d44dcd0778d3f23b8c upstream.
Modifiers are used to change the behavior of keys. For instance, they can grouped into buckets, converted to syscall names (from the syscall identifier), show task->comm of the current pid, be an array of longs that represent a stacktrace, and more.
It was found that nothing stopped a value from taking a modifier. As values are simple counters. If this happened, it would call code that was not expecting a modifier and crash the kernel. This was fixed by having the ___create_val_field() function test if a modifier was present and fail if one was. This fixed the crash.
Now there's a problem with variables. Variables are used to pass fields from one event to another. Variables are allowed to have some modifiers, as the processing may need to happen at the time of the event (like stacktraces and comm names of the current pid). The issue is that it too uses __create_val_field(). Now that fails on modifiers, variables can no longer use them (this is a regression).
As not all modifiers are for variables, have them use a separate check.
--- kernel/trace/trace_events_hist.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-)
kernel/trace/trace_events_hist.c +16 -7
@@ -4193,13 +4193,19 @@ static int __create_val_field(struct his goto out; } -/* Some types cannot be a value */ -if (hist_field->flags & (HIST_FIELD_FL_GRAPH |HIST_FIELD_FL_PERCENT | -HIST_FIELD_FL_BUCKET |HIST_FIELD_FL_LOG2 | -HIST_FIELD_FL_SYM |HIST_FIELD_FL_SYM_OFFSET | -HIST_FIELD_FL_SYSCALL |HIST_FIELD_FL_STACKTRACE )) { -hist_err (file->tr,HIST_ERR_BAD_FIELD_MODIFIER ,errpos (field_str)); - ret = -EINVAL ; +/* values and variables should not have some modifiers */ +if (hist_field->flags &HIST_FIELD_FL_VAR ) { +/* Variable */ +if (hist_field->flags & (HIST_FIELD_FL_GRAPH |HIST_FIELD_FL_PERCENT | +HIST_FIELD_FL_BUCKET |HIST_FIELD_FL_LOG2 )) + goto err; + }else { +/* Value */ +if (hist_field->flags & (HIST_FIELD_FL_GRAPH |HIST_FIELD_FL_PERCENT | +HIST_FIELD_FL_BUCKET |HIST_FIELD_FL_LOG2 | +HIST_FIELD_FL_SYM |HIST_FIELD_FL_SYM_OFFSET | +HIST_FIELD_FL_SYSCALL |HIST_FIELD_FL_STACKTRACE )) + goto err; } hist_data->fields[val_idx] = hist_field;
@@ -4211,6 +4217,9 @@ static int __create_val_field(struct his ret = -EINVAL ; out:return ret; + err: +hist_err (file->tr,HIST_ERR_BAD_FIELD_MODIFIER ,errpos (field_str)); +return -EINVAL ; } static int create_val_field(struct hist_trigger_data *hist_data,
Greg Kroah-Hartman
maintainerPATCH 188/225 tracing/probe: trace_probe_primary_from_call(): checked list_first_entry
In reply to Greg Kroah-HartmanFrom: Pietro Borrello <[email protected]>
commit 81d0fa4cb4fc0e1a49c2b22f92c43d9fe972ebcf upstream.
All callers of trace_probe_primary_from_call() check the return value to be non NULL. However, the function returns list_first_entry(&tpe->probes, ...) which can never be NULL. Additionally, it does not check for the list being possibly empty, possibly causing a type confusion on empty lists.
Use list_first_entry_or_null() which solves both problems.
--- kernel/trace/trace_probe.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/trace_probe.h +1 -1
@@ -302,7 +302,7 @@ trace_probe_primary_from_call(struct tra {struct trace_probe_event *tpe =trace_probe_event_from_call (call); - return list_first_entry(&tpe->probes, struct trace_probe, list); + return list_first_entry_or_null(&tpe->probes, struct trace_probe, list); }static inline struct list_head *trace_probe_probe_list (struct trace_probe *tp)
Greg Kroah-Hartman
maintainerPATCH 189/225 selftests: mptcp: connect: skip if MPTCP is not supported
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit d83013bdf90a7994a474b0e650a7fc94b0d4ded6 upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting MPTCP.
A new check is then added to make sure MPTCP is supported. If not, the test stops and is marked as "skipped". Note that this check can also mark the test as failed if 'SELFTESTS_MPTCP_LIB_EXPECT_ALL_FEATURES' env var is set to 1: by doing that, we can make sure a test is not being skipped by mistake.
A new shared file is added here to be able to re-used the same check in the different selftests we have.
--- tools/testing/selftests/net/mptcp/Makefile | 2 - tools/testing/selftests/net/mptcp/mptcp_connect.sh | 4 ++ tools/testing/selftests/net/mptcp/mptcp_lib.sh | 40 +++++++++++++++++++++ 3 files changed, 45 insertions(+), 1 deletion(-) create mode 100644 tools/testing/selftests/net/mptcp/mptcp_lib.sh
tools/testing/selftests/net/mptcp/Makefile +1 -1
@@ -9,7 +9,7 @@ TEST_PROGS := mptcp_connect.sh pm_netlin TEST_GEN_FILES = mptcp_connect pm_nl_ctl mptcp_sockopt mptcp_inq -TEST_FILES := settings +TEST_FILES := mptcp_lib.sh settings EXTRA_CLEAN := *.pcap
tools/testing/selftests/net/mptcp/mptcp_connect.sh +4 -0
@@ -1,6 +1,8 @@ #!/bin/bash # SPDX-License-Identifier: GPL-2.0 +. "$(dirname "${0}")/mptcp_lib.sh" + time_start=$(date +%s) optstring="S:R:d:e:l:r:h4cm:f:tC"
@@ -141,6 +143,8 @@ cleanup() done } +mptcp_lib_check_mptcp + ip -Version > /dev/null 2>&1 if [ $? -ne 0 ];then echo "SKIP: Could not run test without ip tool"
tools/testing/selftests/net/mptcp/mptcp_lib.sh new file +40 -0
@@ -0,0 +1,40 @@ +#! /bin/bash +# SPDX-License-Identifier: GPL-2.0 + +readonly KSFT_FAIL=1 +readonly KSFT_SKIP=4 + +# SELFTESTS_MPTCP_LIB_EXPECT_ALL_FEATURES env var can be set when validating all +# features using the last version of the kernel and the selftests to make sure +# a test is not being skipped by mistake. +mptcp_lib_expect_all_features() { + [ "${SELFTESTS_MPTCP_LIB_EXPECT_ALL_FEATURES:-}" = "1" ] +} + +# $1: msg +mptcp_lib_fail_if_expected_feature() { + if mptcp_lib_expect_all_features; then + echo "ERROR: missing feature: ${*}" + exit ${KSFT_FAIL} + fi + + return 1 +} + +# $1: file +mptcp_lib_has_file() { + local f="${1}" + + if [ -f "${f}" ]; then + return 0 + fi + + mptcp_lib_fail_if_expected_feature "${f} file not found" +} + +mptcp_lib_check_mptcp() { + if ! mptcp_lib_has_file "/proc/sys/net/mptcp/enabled"; then + echo "SKIP: MPTCP support is not available" + exit ${KSFT_SKIP} + fi +}
Greg Kroah-Hartman
maintainerPATCH 190/225 selftests: mptcp: pm nl: skip if MPTCP is not supported
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit 0f4955a40dafe18a1122e3714d8173e4b018e869 upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting MPTCP.
A new check is then added to make sure MPTCP is supported. If not, the test stops and is marked as "skipped".
--- tools/testing/selftests/net/mptcp/pm_netlink.sh | 4 ++++ 1 file changed, 4 insertions(+)
tools/testing/selftests/net/mptcp/pm_netlink.sh +4 -0
@@ -1,6 +1,8 @@ #!/bin/bash # SPDX-License-Identifier: GPL-2.0 +. "$(dirname "${0}")/mptcp_lib.sh" + ksft_skip=4 ret=0
@@ -34,6 +36,8 @@ cleanup() ip netns del $ns1 } +mptcp_lib_check_mptcp + ip -Version > /dev/null 2>&1 if [ $? -ne 0 ];then echo "SKIP: Could not run test without ip tool"
Greg Kroah-Hartman
maintainerPATCH 191/225 selftests: mptcp: join: skip if MPTCP is not supported
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit 715c78a82e00f848f99ef76e6f6b89216ccba268 upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting MPTCP.
A new check is then added to make sure MPTCP is supported. If not, the test stops and is marked as "skipped".
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 ++++ 1 file changed, 4 insertions(+)
tools/testing/selftests/net/mptcp/mptcp_join.sh +4 -0
@@ -6,6 +6,8 @@ # address all other issues detected by shellcheck. #shellcheck disable=SC2086 +. "$(dirname "${0}")/mptcp_lib.sh" + ret=0 sin="" sinfail=""
@@ -127,6 +129,8 @@ cleanup_partial() check_tools() { + mptcp_lib_check_mptcp + if ! ip -Version &> /dev/null; then echo "SKIP: Could not run test without ip tool" exit $ksft_skip
Greg Kroah-Hartman
maintainerPATCH 192/225 selftests: mptcp: sockopt: skip if MPTCP is not supported
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit cf6f0fda7af7e8e016070bfee6b189e671a0c776 upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting MPTCP.
A new check is then added to make sure MPTCP is supported. If not, the test stops and is marked as "skipped".
--- tools/testing/selftests/net/mptcp/mptcp_sockopt.sh | 4 ++++ 1 file changed, 4 insertions(+)
tools/testing/selftests/net/mptcp/mptcp_sockopt.sh +4 -0
@@ -1,6 +1,8 @@ #!/bin/bash # SPDX-License-Identifier: GPL-2.0 +. "$(dirname "${0}")/mptcp_lib.sh" + ret=0 sin="" sout=""
@@ -81,6 +83,8 @@ cleanup() rm -f "$sin" "$sout" } +mptcp_lib_check_mptcp + ip -Version > /dev/null 2>&1 if [ $? -ne 0 ];then echo "SKIP: Could not run test without ip tool"
Greg Kroah-Hartman
maintainerPATCH 193/225 selftests: mptcp: userspace pm: skip if MPTCP is not supported
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit 63212608a92a1ff10ae56dbb14e9fb685f7e4ffa upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting MPTCP.
A new check is then added to make sure MPTCP is supported. If not, the test stops and is marked as "skipped".
--- tools/testing/selftests/net/mptcp/userspace_pm.sh | 4 ++++ 1 file changed, 4 insertions(+)
tools/testing/selftests/net/mptcp/userspace_pm.sh +4 -0
@@ -1,6 +1,10 @@ #!/bin/bash # SPDX-License-Identifier: GPL-2.0 +. "$(dirname "${0}")/mptcp_lib.sh" + +mptcp_lib_check_mptcp + ip -Version > /dev/null 2>&1 if [ $? -ne 0 ];then echo "SKIP: Cannot not run test without ip tool"
Greg Kroah-Hartman
maintainerPATCH 194/225 mptcp: fix connect timeout handling
In reply to Greg Kroah-HartmanFrom: Paolo Abeni <[email protected]>
commit 786fc12457268cc9b555dde6c22ae7300d4b40e1 upstream.
Ondrej reported a functional issue WRT timeout handling on connect with a nice reproducer.
The problem is that the current mptcp connect waits for both the MPTCP socket level timeout, and the first subflow socket timeout. The latter is not influenced/touched by the exposed setsockopt().
Overall the above makes the SO_SNDTIMEO a no-op on connect.
Since mptcp_connect is invoked via inet_stream_connect and the latter properly handle the MPTCP level timeout, we can address the issue making the nested subflow level connect always unblocking.
This also allow simplifying a bit the code, dropping an ugly hack to handle the fastopen and custom proto_ops connect.
The issues predates the blamed commit below, but the current resolution requires the infrastructure introduced there.
--- net/mptcp/protocol.c | 29 +++++++---------------------- net/mptcp/protocol.h | 1 - 2 files changed, 7 insertions(+), 23 deletions(-)
net/mptcp/protocol.c +7 -22
@@ -1683,7 +1683,6 @@ static int mptcp_sendmsg_fastopen(structlock_sock (ssk); msg->msg_flags |=MSG_DONTWAIT ; - msk->connect_flags =O_NONBLOCK ; msk->fastopening =1 ; ret =tcp_sendmsg_fastopen (ssk, msg, copied_syn, len,NULL ); msk->fastopening =0 ;
@@ -3638,9 +3637,9 @@ static int mptcp_connect(struct sock *sk* acquired the subflow socket lock, too. */ if (msk->fastopening) - err =__inet_stream_connect (ssock, uaddr, addr_len, msk->connect_flags,1 ); + err =__inet_stream_connect (ssock, uaddr, addr_len,O_NONBLOCK ,1 );else - err =inet_stream_connect (ssock, uaddr, addr_len, msk->connect_flags); + err =inet_stream_connect (ssock, uaddr, addr_len,O_NONBLOCK );inet_sk (sk)->defer_connect =inet_sk (ssock->sk)->defer_connect;/* on successful connect, the msk state will be moved to established by
@@ -3653,12 +3652,10 @@ static int mptcp_connect(struct sock *skmptcp_copy_inaddrs (sk, ssock->sk); -/* unblocking connect, mptcp-level inet_stream_connect will error out -* without changing the socket state, update it here. +/* silence EINPROGRESS and let the caller inet_stream_connect +* handle the connection in progress */ -if (err == -EINPROGRESS ) - sk->sk_socket->state = ssock->state; -return err; +return 0 ; }static struct proto mptcp_prot = {
@@ -3717,18 +3714,6 @@ unlock:return err; } -static int mptcp_stream_connect (struct socket *sock,struct sockaddr *uaddr, -int addr_len,int flags) -{ -int ret; - -lock_sock (sock->sk); -mptcp_sk (sock->sk)->connect_flags = flags; - ret =__inet_stream_connect (sock, uaddr, addr_len, flags,0 ); -release_sock (sock->sk); -return ret; -} -static int mptcp_listen (struct socket *sock,int backlog) {struct mptcp_sock *msk =mptcp_sk (sock->sk);
@@ -3879,7 +3864,7 @@ static const struct proto_ops mptcp_stre .owner = THIS_MODULE, .release = inet_release, .bind = mptcp_bind, - .connect = mptcp_stream_connect, + .connect = inet_stream_connect, .socketpair = sock_no_socketpair, .accept = mptcp_stream_accept, .getname = inet_getname,
@@ -3974,7 +3959,7 @@ static const struct proto_ops mptcp_v6_s .owner = THIS_MODULE, .release = inet6_release, .bind = mptcp_bind, - .connect = mptcp_stream_connect, + .connect = inet_stream_connect, .socketpair = sock_no_socketpair, .accept = mptcp_stream_accept, .getname = inet6_getname,
net/mptcp/protocol.h +0 -1
@@ -288,7 +288,6 @@ struct mptcp_sock { nodelay:1, fastopening:1, in_accept_queue:1; -int connect_flags;struct work_struct work;struct sk_buff *ooo_last_skb;struct rb_root out_of_order_queue;
Greg Kroah-Hartman
maintainerPATCH 195/225 mptcp: fix active subflow finalization
In reply to Greg Kroah-HartmanFrom: Paolo Abeni <[email protected]>
commit 55b47ca7d80814ceb63d64e032e96cd6777811e5 upstream.
Active subflow are inserted into the connection list at creation time. When the MPJ handshake completes successfully, a new subflow creation netlink event is generated correctly, but the current code wrongly avoid initializing a couple of subflow data.
The above will cause misbehavior on a few exceptional events: unneeded mptcp-level retransmission on msk-level sequence wrap-around and infinite mapping fallback even when a MPJ socket is present.
Address the issue factoring out the needed initialization in a new helper and invoking the latter from __mptcp_finish_join() time for passive subflow and from mptcp_finish_join() for active ones.
--- net/mptcp/protocol.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)
net/mptcp/protocol.c +14 -9
@@ -821,6 +821,13 @@ void mptcp_data_ready(struct sock *sk, smptcp_data_unlock (sk); } +static void mptcp_subflow_joined (struct mptcp_sock *msk,struct sock *ssk) +{ +mptcp_subflow_ctx (ssk)->map_seq =READ_ONCE (msk->ack_seq); +WRITE_ONCE (msk->allow_infinite_fallback, false); +mptcp_event (MPTCP_EVENT_SUB_ESTABLISHED , msk, ssk,GFP_ATOMIC ); +} +static bool __mptcp_finish_join (struct mptcp_sock *msk,struct sock *ssk) {struct sock *sk = (struct sock *)msk;
@@ -835,6 +842,7 @@ static bool __mptcp_finish_join(struct mmptcp_sock_graft (ssk, sk->sk_socket);mptcp_sockopt_sync_locked (msk, ssk); +mptcp_subflow_joined (msk, ssk);return true; }
@@ -3485,14 +3493,16 @@ bool mptcp_finish_join(struct sock *ssk)return false; } -if (!list_empty (&subflow->node)) - goto out; +/* active subflow, already present inside the conn_list */ +if (!list_empty (&subflow->node)) { +mptcp_subflow_joined (msk, ssk); +return true; + }if (!mptcp_pm_allow_new_subflow (msk)) goto err_prohibited; -/* active connections are already on conn_list. -* If we can't acquire msk socket lock here, let the release callback +/* If we can't acquire msk socket lock here, let the release callback * handle it */ mptcp_data_lock (parent);
@@ -3515,11 +3525,6 @@ err_prohibited:return false; } - subflow->map_seq =READ_ONCE (msk->ack_seq); -WRITE_ONCE (msk->allow_infinite_fallback, false); - -out: -mptcp_event (MPTCP_EVENT_SUB_ESTABLISHED , msk, ssk,GFP_ATOMIC );return true; }
Greg Kroah-Hartman
maintainerPATCH 196/225 ext4: add EA_INODE checking to ext4_iget()
In reply to Greg Kroah-HartmanFrom: Theodore Ts'o <[email protected]>
commit b3e6bcb94590dea45396b9481e47b809b1be4afa upstream.
Add a new flag, EXT4_IGET_EA_INODE which indicates whether the inode is expected to have the EA_INODE flag or not. If the flag is not set/clear as expected, then fail the iget() operation and mark the file system as corrupted.
This commit also makes the ext4_iget() always perform the is_bad_inode() check even when the inode is already inode cache. This allows us to remove the is_bad_inode() check from the callers of ext4_iget() in the ea_inode code.
--- fs/ext4/ext4.h | 3 ++- fs/ext4/inode.c | 31 ++++++++++++++++++++++++++----- fs/ext4/xattr.c | 36 +++++++----------------------------- 3 files changed, 35 insertions(+), 35 deletions(-)
fs/ext4/ext4.h +2 -1
@@ -2968,7 +2968,8 @@ typedef enum {EXT4_IGET_NORMAL =0 ,EXT4_IGET_SPECIAL =0x0001 ,/* OK to iget a system inode */ EXT4_IGET_HANDLE =0x0002 ,/* Inode # is from a handle */ - EXT4_IGET_BAD = 0x0004 /* Allow to iget a bad inode */ +EXT4_IGET_BAD =0x0004 ,/* Allow to iget a bad inode */ + EXT4_IGET_EA_INODE = 0x0008 /* Inode should contain an EA value */ } ext4_iget_flags; extern struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
fs/ext4/inode.c +26 -5
@@ -4763,6 +4763,21 @@ static inline void ext4_inode_set_iversiinode_set_iversion_queried (inode, val); } +static const char *check_igot_inode (struct inode *inode,ext4_iget_flags flags) + +{ +if (flags &EXT4_IGET_EA_INODE ) { +if (!(EXT4_I (inode)->i_flags &EXT4_EA_INODE_FL )) +return "missing EA_INODE flag" ; + }else { +if ((EXT4_I (inode)->i_flags &EXT4_EA_INODE_FL )) +return "unexpected EA_INODE flag" ; + } +if (is_bad_inode (inode) && !(flags &EXT4_IGET_BAD )) +return "unexpected bad inode w/o EXT4_IGET_BAD" ; +return NULL ; +} +struct inode *__ext4_iget (struct super_block *sb,unsigned long ino,ext4_iget_flags flags,const char *function,unsigned int line)
@@ -4772,6 +4787,7 @@ struct inode *__ext4_iget(struct super_bstruct ext4_inode_info *ei;struct ext4_super_block *es =EXT4_SB (sb)->s_es;struct inode *inode; +const char *err_str;journal_t *journal =EXT4_SB (sb)->s_journal;long ret;loff_t size;
@@ -4799,8 +4815,14 @@ struct inode *__ext4_iget(struct super_b inode =iget_locked (sb, ino);if (!inode)return ERR_PTR (-ENOMEM ); -if (!(inode->i_state &I_NEW )) +if (!(inode->i_state &I_NEW )) { +if ((err_str =check_igot_inode (inode, flags)) !=NULL ) { +ext4_error_inode (inode, function, line,0 , err_str); +iput (inode); +return ERR_PTR (-EFSCORRUPTED ); + }return inode; + } ei =EXT4_I (inode); iloc.bh =NULL ;
@@ -5066,10 +5088,9 @@ struct inode *__ext4_iget(struct super_bif (IS_CASEFOLDED (inode) && !ext4_has_feature_casefold (inode->i_sb))ext4_error_inode (inode, function, line,0 ,"casefold flag without casefold feature" ); -if (is_bad_inode (inode) && !(flags &EXT4_IGET_BAD )) { -ext4_error_inode (inode, function, line,0 , -"bad inode without EXT4_IGET_BAD flag" ); - ret = -EUCLEAN ; +if ((err_str =check_igot_inode (inode, flags)) !=NULL ) { +ext4_error_inode (inode, function, line,0 , err_str); + ret = -EFSCORRUPTED ; goto bad_inode; }
fs/ext4/xattr.c +7 -29
@@ -397,7 +397,7 @@ static int ext4_xattr_inode_iget(structreturn -EFSCORRUPTED ; } - inode =ext4_iget (parent->i_sb, ea_ino,EXT4_IGET_NORMAL ); + inode =ext4_iget (parent->i_sb, ea_ino,EXT4_IGET_EA_INODE );if (IS_ERR (inode)) { err =PTR_ERR (inode); ext4_error(parent->i_sb,
@@ -405,23 +405,6 @@ static int ext4_xattr_inode_iget(struct err);return err; } - -if (is_bad_inode (inode)) { -ext4_error (parent->i_sb, -"error while reading EA inode %lu is_bad_inode" , - ea_ino); - err = -EIO ; - goto error; - } - -if (!(EXT4_I (inode)->i_flags &EXT4_EA_INODE_FL )) { -ext4_error (parent->i_sb, -"EA inode %lu does not have EXT4_EA_INODE_FL flag" , - ea_ino); - err = -EINVAL ; - goto error; - } -ext4_xattr_inode_set_class (inode);/*
@@ -442,9 +425,6 @@ static int ext4_xattr_inode_iget(struct *ea_inode = inode;return 0 ; -error: -iput (inode); -return err; }/* Remove entry from mbcache when EA inode is getting evicted */
@@ -1507,11 +1487,10 @@ ext4_xattr_inode_cache_find(struct inodewhile (ce) { ea_inode =ext4_iget (inode->i_sb, ce->e_value, -EXT4_IGET_NORMAL ); - if (!IS_ERR(ea_inode) && - !is_bad_inode(ea_inode) && - (EXT4_I(ea_inode)->i_flags & EXT4_EA_INODE_FL) && - i_size_read(ea_inode) == value_len && +EXT4_IGET_EA_INODE ); +if (IS_ERR (ea_inode)) + goto next_entry; + if (i_size_read(ea_inode) == value_len && !ext4_xattr_inode_read(ea_inode, ea_data, value_len) && !ext4_xattr_inode_verify_hashes(ea_inode, NULL, ea_data, value_len) &&
@@ -1521,9 +1500,8 @@ ext4_xattr_inode_cache_find(struct inodekvfree (ea_data);return ea_inode; } - -if (!IS_ERR (ea_inode)) -iput (ea_inode); +iput (ea_inode); + next_entry: ce =mb_cache_entry_find_next (ea_inode_cache, ce); }kvfree (ea_data);
Greg Kroah-Hartman
maintainerPATCH 197/225 ext4: set lockdep subclass for the ea_inode in ext4_xattr_inode_cache_find()
In reply to Greg Kroah-HartmanFrom: Theodore Ts'o <[email protected]>
commit b928dfdcb27d8fa59917b794cfba53052a2f050f upstream.
If the ea_inode has been pushed out of the inode cache while there is still a reference in the mb_cache, the lockdep subclass will not be set on the inode, which can lead to some lockdep false positives.
--- fs/ext4/xattr.c | 1 + 1 file changed, 1 insertion(+)
fs/ext4/xattr.c +1 -0
@@ -1490,6 +1490,7 @@ ext4_xattr_inode_cache_find(struct inode EXT4_IGET_EA_INODE);if (IS_ERR (ea_inode)) goto next_entry; +ext4_xattr_inode_set_class (ea_inode);if (i_size_read (ea_inode) == value_len && !ext4_xattr_inode_read (ea_inode, ea_data, value_len) && !ext4_xattr_inode_verify_hashes(ea_inode, NULL, ea_data,
Greg Kroah-Hartman
maintainerPATCH 198/225 ext4: disallow ea_inodes with extended attributes
In reply to Greg Kroah-HartmanFrom: Theodore Ts'o <[email protected]>
commit 2bc7e7c1a3bc9bd0cbf0f71006f6fe7ef24a00c2 upstream.
An ea_inode stores the value of an extended attribute; it can not have extended attributes itself, or this will cause recursive nightmares. Add a check in ext4_iget() to make sure this is the case.
--- fs/ext4/inode.c | 3 +++ 1 file changed, 3 insertions(+)
fs/ext4/inode.c +3 -0
@@ -4769,6 +4769,9 @@ static const char *check_igot_inode(struif (flags &EXT4_IGET_EA_INODE ) {if (!(EXT4_I (inode)->i_flags &EXT4_EA_INODE_FL ))return "missing EA_INODE flag" ; +if (ext4_test_inode_state (inode,EXT4_STATE_XATTR ) || +EXT4_I (inode)->i_file_acl) +return "ea_inode with extended attributes" ; }else {if ((EXT4_I (inode)->i_flags &EXT4_EA_INODE_FL ))return "unexpected EA_INODE flag" ;
Greg Kroah-Hartman
maintainerPATCH 199/225 ext4: add lockdep annotations for i_data_sem for ea_inodes
In reply to Greg Kroah-HartmanFrom: Theodore Ts'o <[email protected]>
commit aff3bea95388299eec63440389b4545c8041b357 upstream.
Treat i_data_sem for ea_inodes as being in their own lockdep class to avoid lockdep complaints about ext4_setattr's use of inode_lock() on normal inodes potentially causing lock ordering with i_data_sem on ea_inodes in ext4_xattr_inode_write(). However, ea_inodes will be operated on by ext4_setattr(), so this isn't a problem.
--- fs/ext4/ext4.h | 2 ++ fs/ext4/xattr.c | 4 ++++ 2 files changed, 6 insertions(+)
fs/ext4/ext4.h +2 -0
@@ -1007,11 +1007,13 @@ do { \* where the second inode has larger inode number * than the first * I_DATA_SEM_QUOTA - Used for quota inodes only +* I_DATA_SEM_EA - Used for ea_inodes only */ enum {I_DATA_SEM_NORMAL =0 ,I_DATA_SEM_OTHER ,I_DATA_SEM_QUOTA , +I_DATA_SEM_EA };
fs/ext4/xattr.c +4 -0
@@ -123,7 +123,11 @@ ext4_expand_inode_array(struct ext4_xatt#ifdef CONFIG_LOCKDEP void ext4_xattr_inode_set_class (struct inode *ea_inode) { +struct ext4_inode_info *ei =EXT4_I (ea_inode); +lockdep_set_subclass (&ea_inode->i_rwsem,1 ); + (void ) ei;/* shut up clang warning if !CONFIG_LOCKDEP */ +lockdep_set_subclass (&ei->i_data_sem,I_DATA_SEM_EA ); }#endif
Greg Kroah-Hartman
maintainerPATCH 200/225 fbcon: Fix null-ptr-deref in soft_cursor
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
commit d78bd6cc68276bd57f766f7cb98bfe32c23ab327 upstream.
syzbot repored this bug in the softcursor code:
BUG: KASAN: null-ptr-deref in soft_cursor+0x384/0x6b4 drivers/video/fbdev/core/softcursor.c:70 Read of size 16 at addr 0000000000000200 by task kworker/u4:1/12 CPU: 0 PID: 12 Comm: kworker/u4:1 Not tainted 6.4.0-rc3-syzkaller-geb0f1697d729 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023 Workqueue: events_power_efficient fb_flashcursor Call trace: dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:233 show_stack+0x2c/0x44 arch/arm64/kernel/stacktrace.c:240 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106 print_report+0xe4/0x514 mm/kasan/report.c:465 kasan_report+0xd4/0x130 mm/kasan/report.c:572 kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:187 __asan_memcpy+0x3c/0x84 mm/kasan/shadow.c:105 soft_cursor+0x384/0x6b4 drivers/video/fbdev/core/softcursor.c:70 bit_cursor+0x113c/0x1a64 drivers/video/fbdev/core/bitblit.c:377 fb_flashcursor+0x35c/0x54c drivers/video/fbdev/core/fbcon.c:380 process_one_work+0x788/0x12d4 kernel/workqueue.c:2405 worker_thread+0x8e0/0xfe8 kernel/workqueue.c:2552 kthread+0x288/0x310 kernel/kthread.c:379 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:853
This fix let bit_cursor() bail out early when a font bitmap isn't available yet.
--- drivers/video/fbdev/core/bitblit.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/video/fbdev/core/bitblit.c +3 -0
@@ -247,6 +247,9 @@ static void bit_cursor(struct vc_data *v cursor.set =0 ; +if (!vc->vc_font.data) +return ; + c =scr_readw ((u16 *) vc->vc_pos); attribute =get_attribute (info, c); src = vc->vc_font.data + ((c & charmask) * (w * vc->vc_font.height));
Greg Kroah-Hartman
maintainerPATCH 201/225 serial: 8250_tegra: Fix an error handling path in tegra_uart_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
commit 134f49dec0b6aca3259cd8259de4c572048bd207 upstream.
If an error occurs after reset_control_deassert(), it must be re-asserted, as already done in the .remove() function.
--- drivers/tty/serial/8250/8250_tegra.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/tty/serial/8250/8250_tegra.c +3 -1
@@ -112,13 +112,15 @@ static int tegra_uart_probe(struct platf ret =serial8250_register_8250_port (&port8250);if (ret <0 ) - goto err_clkdisable; + goto err_ctrl_assert;platform_set_drvdata (pdev, uart); uart->line = ret;return 0 ; +err_ctrl_assert: +reset_control_assert (uart->rst); err_clkdisable:clk_disable_unprepare (uart->clk);
Greg Kroah-Hartman
maintainerPATCH 202/225 serial: cpm_uart: Fix a COMPILE_TEST dependency
In reply to Greg Kroah-HartmanFrom: Herve Codina <[email protected]>
commit 7183c37fd53eee1e795206e625da12a5d7ec1e1a upstream.
In a COMPILE_TEST configuration, the cpm_uart driver uses symbols from the cpm_uart_cpm2.c file. This file is compiled only when CONFIG_CPM2 is set.
Without this dependency, the linker fails with some missing symbols for COMPILE_TEST configuration that needs SERIAL_CPM without enabling CPM2.
This lead to:
depends on CPM2 || CPM1 || (PPC32 && CPM2 && COMPILE_TEST)
This dependency does not make sense anymore and can be simplified removing all the COMPILE_TEST part.
--- drivers/tty/serial/Kconfig | 2 +- drivers/tty/serial/cpm_uart/cpm_uart.h | 2 -- 2 files changed, 1 insertion(+), 3 deletions(-)
drivers/tty/serial/Kconfig +1 -1
@@ -769,7 +769,7 @@ config SERIAL_PMACZILOG_CONSOLE config SERIAL_CPM tristate "CPM SCC/SMC serial port support" - depends on CPM2 || CPM1 || (PPC32 && COMPILE_TEST) + depends on CPM2 || CPM1 select SERIAL_CORE help This driver supports the SCC and SMC serial ports on Motorola
drivers/tty/serial/cpm_uart/cpm_uart.h +0 -2
@@ -19,8 +19,6 @@ struct gpio_desc;#include "cpm_uart_cpm2.h" #elif defined(CONFIG_CPM1 )#include "cpm_uart_cpm1.h" -#elif defined(CONFIG_COMPILE_TEST ) -#include "cpm_uart_cpm2.h" #endif #define SERIAL_CPM_MAJOR 204
Greg Kroah-Hartman
maintainerPATCH 203/225 powerpc/xmon: Use KSYM_NAME_LEN in array size
In reply to Greg Kroah-HartmanFrom: Maninder Singh <[email protected]>
commit 719dfd5925e186e09a2a6f23016936ac436f3d78 upstream.
kallsyms_lookup() which in turn calls kallsyms_lookup_buildid() writes to index "KSYM_NAME_LEN - 1".
Thus the array passed as namebuf to kallsyms_lookup() should be KSYM_NAME_LEN in size.
In xmon.c the array was defined to be "128" bytes directly, without using KSYM_NAME_LEN. Commit b8a94bfb3395 ("kallsyms: increase maximum kernel symbol length to 512") changed the value to 512, but missed updating the xmon code.
--- arch/powerpc/xmon/xmon.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/xmon/xmon.c +1 -1
@@ -91,7 +91,7 @@ static unsigned long ndump = 64;static unsigned long nidump =16 ;static unsigned long ncsum =4096 ;static int termch; -static char tmpstr[128 ]; +static char tmpstr[KSYM_NAME_LEN ];static int tracing_enabled;static long bus_error_jmp[JMP_BUF_LEN ];
Greg Kroah-Hartman
maintainerPATCH 204/225 test_firmware: fix a memory leak with reqs buffer
In reply to Greg Kroah-HartmanFrom: Mirsad Goran Todorovac <[email protected]>
commit be37bed754ed90b2655382f93f9724b3c1aae847 upstream.
Dan Carpenter spotted that test_fw_config->reqs will be leaked if trigger_batched_requests_store() is called two or more times. The same appears with trigger_batched_requests_async_store().
This bug wasn't trigger by the tests, but observed by Dan's visual inspection of the code.
The recommended workaround was to return -EBUSY if test_fw_config->reqs is already allocated.
--- lib/test_firmware.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
lib/test_firmware.c +10 -0
@@ -894,6 +894,11 @@ static ssize_t trigger_batched_requests_mutex_lock (&test_fw_mutex); +if (test_fw_config->reqs) { + rc = -EBUSY ; + goto out_bail; + } + test_fw_config->reqs =vzalloc (array3_size (sizeof (struct test_batched_req ), test_fw_config->num_requests,2 ));
@@ -992,6 +997,11 @@ ssize_t trigger_batched_requests_async_smutex_lock (&test_fw_mutex); +if (test_fw_config->reqs) { + rc = -EBUSY ; + goto out_bail; + } + test_fw_config->reqs =vzalloc (array3_size (sizeof (struct test_batched_req ), test_fw_config->num_requests,2 ));
Greg Kroah-Hartman
maintainerPATCH 205/225 test_firmware: fix the memory leak of the allocated firmware buffer
In reply to Greg Kroah-HartmanFrom: Mirsad Goran Todorovac <[email protected]>
commit 48e156023059e57a8fc68b498439832f7600ffff upstream.
The following kernel memory leak was noticed after running tools/testing/selftests/firmware/fw_run_tests.sh:
[root@pc-mtodorov firmware]# cat /sys/kernel/debug/kmemleak .
.
.
unreferenced object 0xffff955389bc3400 (size 1024):
comm "test_firmware-0", pid 5451, jiffies 4294944822 (age 65.652s) hex dump (first 32 bytes):
47 48 34 35 36 37 0a 00 00 00 00 00 00 00 00 00 GH4567..........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff962f5dec>] slab_post_alloc_hook+0x8c/0x3c0
[<ffffffff962fcca4>] __kmem_cache_alloc_node+0x184/0x240
[<ffffffff962704de>] kmalloc_trace+0x2e/0xc0
[<ffffffff9665b42d>] test_fw_run_batch_request+0x9d/0x180
[<ffffffff95fd813b>] kthread+0x10b/0x140
[<ffffffff95e033e9>] ret_from_fork+0x29/0x50
unreferenced object 0xffff9553c334b400 (size 1024):
comm "test_firmware-1", pid 5452, jiffies 4294944822 (age 65.652s)
hex dump (first 32 bytes):
47 48 34 35 36 37 0a 00 00 00 00 00 00 00 00 00 GH4567..........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff962f5dec>] slab_post_alloc_hook+0x8c/0x3c0
[<ffffffff962fcca4>] __kmem_cache_alloc_node+0x184/0x240
[<ffffffff962704de>] kmalloc_trace+0x2e/0xc0
[<ffffffff9665b42d>] test_fw_run_batch_request+0x9d/0x180
[<ffffffff95fd813b>] kthread+0x10b/0x140
[<ffffffff95e033e9>] ret_from_fork+0x29/0x50
unreferenced object 0xffff9553c334f000 (size 1024):
comm "test_firmware-2", pid 5453, jiffies 4294944822 (age 65.652s)
hex dump (first 32 bytes):
47 48 34 35 36 37 0a 00 00 00 00 00 00 00 00 00 GH4567..........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff962f5dec>] slab_post_alloc_hook+0x8c/0x3c0
[<ffffffff962fcca4>] __kmem_cache_alloc_node+0x184/0x240
[<ffffffff962704de>] kmalloc_trace+0x2e/0xc0
[<ffffffff9665b42d>] test_fw_run_batch_request+0x9d/0x180
[<ffffffff95fd813b>] kthread+0x10b/0x140
[<ffffffff95e033e9>] ret_from_fork+0x29/0x50
unreferenced object 0xffff9553c3348400 (size 1024):
comm "test_firmware-3", pid 5454, jiffies 4294944822 (age 65.652s)
hex dump (first 32 bytes):
47 48 34 35 36 37 0a 00 00 00 00 00 00 00 00 00 GH4567..........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff962f5dec>] slab_post_alloc_hook+0x8c/0x3c0
[<ffffffff962fcca4>] __kmem_cache_alloc_node+0x184/0x240
[<ffffffff962704de>] kmalloc_trace+0x2e/0xc0
[<ffffffff9665b42d>] test_fw_run_batch_request+0x9d/0x180
[<ffffffff95fd813b>] kthread+0x10b/0x140
[<ffffffff95e033e9>] ret_from_fork+0x29/0x50[root@pc-mtodorov firmware]#
Note that the size 1024 corresponds to the size of the test firmware buffer. The actual number of the buffers leaked is around 70-110, depending on the test run.
The cause of the leak is the following:
request_partial_firmware_into_buf() and request_firmware_into_buf() provided firmware buffer isn't released on release_firmware(), we have allocated it and we are responsible for deallocating it manually. This is introduced in a number of context where previously only release_firmware() was called, which was insufficient.
--- lib/test_firmware.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-)
lib/test_firmware.c +18 -1
@@ -44,6 +44,7 @@ struct test_batched_req {bool sent;const struct firmware *fw;const char *name; +const char *fw_buf;struct completion completion;struct task_struct *task;struct device *dev;
@@ -174,8 +175,14 @@ static void __test_release_all_firmware(for (i =0 ; i < test_fw_config->num_requests; i++) { req = &test_fw_config->reqs[i]; -if (req->fw) +if (req->fw) { +if (req->fw_buf) { +kfree_const (req->fw_buf); + req->fw_buf =NULL ; + }release_firmware (req->fw); + req->fw =NULL ; + } }vfree (test_fw_config->reqs);
@@ -651,6 +658,8 @@ static ssize_t trigger_request_store(strmutex_lock (&test_fw_mutex);release_firmware (test_firmware); +if (test_fw_config->reqs) +__test_release_all_firmware (); test_firmware =NULL ; rc =request_firmware (&test_firmware, name, dev);if (rc) {
@@ -751,6 +760,8 @@ static ssize_t trigger_async_request_stomutex_lock (&test_fw_mutex);release_firmware (test_firmware); test_firmware =NULL ; +if (test_fw_config->reqs) +__test_release_all_firmware (); rc =request_firmware_nowait (THIS_MODULE ,1 , name, dev,GFP_KERNEL ,NULL , trigger_async_request_cb);if (rc) {
@@ -793,6 +804,8 @@ static ssize_t trigger_custom_fallback_smutex_lock (&test_fw_mutex);release_firmware (test_firmware); +if (test_fw_config->reqs) +__test_release_all_firmware (); test_firmware =NULL ; rc = request_firmware_nowait(THIS_MODULE, FW_ACTION_NOUEVENT, name, dev, GFP_KERNEL, NULL,
@@ -855,6 +868,8 @@ static int test_fw_run_batch_request(voi test_fw_config->buf_size);if (!req->fw)kfree (test_buf); +else + req->fw_buf = test_buf; }else { req->rc = test_fw_config->req_firmware(&req->fw, req->name,
@@ -915,6 +930,7 @@ static ssize_t trigger_batched_requests_ req->fw =NULL ; req->idx = i; req->name = test_fw_config->name; + req->fw_buf =NULL ; req->dev = dev;init_completion (&req->completion); req->task = kthread_run(test_fw_run_batch_request, req,
@@ -1019,6 +1035,7 @@ ssize_t trigger_batched_requests_async_sfor (i =0 ; i < test_fw_config->num_requests; i++) { req = &test_fw_config->reqs[i]; req->name = test_fw_config->name; + req->fw_buf =NULL ; req->fw =NULL ; req->idx = i;init_completion (&req->completion);
Greg Kroah-Hartman
maintainerPATCH 206/225 KVM: arm64: Populate fault info for watchpoint
In reply to Greg Kroah-HartmanFrom: Akihiko Odaki <[email protected]>
commit 811154e234db72f0a11557a84ba9640f8b3bc823 upstream.
When handling ESR_ELx_EC_WATCHPT_LOW, far_el2 member of struct kvm_vcpu_fault_info will be copied to far member of struct kvm_debug_exit_arch and exposed to the userspace. The userspace will see stale values from older faults if the fault info does not get populated.
--- arch/arm64/kvm/hyp/include/hyp/switch.h | 8 ++++++-- arch/arm64/kvm/hyp/nvhe/switch.c | 2 ++ arch/arm64/kvm/hyp/vhe/switch.c | 1 + 3 files changed, 9 insertions(+), 2 deletions(-)
arch/arm64/kvm/hyp/include/hyp/switch.h +6 -2
@@ -351,17 +351,21 @@ static bool kvm_hyp_handle_cp15_32(strucreturn false; } -static bool kvm_hyp_handle_iabt_low (struct kvm_vcpu *vcpu,u64 *exit_code) +static bool kvm_hyp_handle_memory_fault (struct kvm_vcpu *vcpu,u64 *exit_code) {if (!__populate_fault_info (vcpu))return true;return false; } +static bool kvm_hyp_handle_iabt_low(struct kvm_vcpu *vcpu, u64 *exit_code) + __alias(kvm_hyp_handle_memory_fault); +static bool kvm_hyp_handle_watchpt_low(struct kvm_vcpu *vcpu, u64 *exit_code) + __alias(kvm_hyp_handle_memory_fault);static bool kvm_hyp_handle_dabt_low (struct kvm_vcpu *vcpu,u64 *exit_code) { -if (!__populate_fault_info (vcpu)) +if (kvm_hyp_handle_memory_fault (vcpu, exit_code))return true;if (static_branch_unlikely (&vgic_v2_cpuif_trap)) {
arch/arm64/kvm/hyp/nvhe/switch.c +2 -0
@@ -186,6 +186,7 @@ static const exit_handler_fn hyp_exit_ha [ESR_ELx_EC_FP_ASIMD] = kvm_hyp_handle_fpsimd, [ESR_ELx_EC_IABT_LOW] = kvm_hyp_handle_iabt_low, [ESR_ELx_EC_DABT_LOW] = kvm_hyp_handle_dabt_low, + [ESR_ELx_EC_WATCHPT_LOW] = kvm_hyp_handle_watchpt_low, [ESR_ELx_EC_PAC] = kvm_hyp_handle_ptrauth, };
@@ -196,6 +197,7 @@ static const exit_handler_fn pvm_exit_ha [ESR_ELx_EC_FP_ASIMD] = kvm_hyp_handle_fpsimd, [ESR_ELx_EC_IABT_LOW] = kvm_hyp_handle_iabt_low, [ESR_ELx_EC_DABT_LOW] = kvm_hyp_handle_dabt_low, + [ESR_ELx_EC_WATCHPT_LOW] = kvm_hyp_handle_watchpt_low, [ESR_ELx_EC_PAC] = kvm_hyp_handle_ptrauth, };
arch/arm64/kvm/hyp/vhe/switch.c +1 -0
@@ -110,6 +110,7 @@ static const exit_handler_fn hyp_exit_ha [ESR_ELx_EC_FP_ASIMD] = kvm_hyp_handle_fpsimd, [ESR_ELx_EC_IABT_LOW] = kvm_hyp_handle_iabt_low, [ESR_ELx_EC_DABT_LOW] = kvm_hyp_handle_dabt_low, + [ESR_ELx_EC_WATCHPT_LOW] = kvm_hyp_handle_watchpt_low, [ESR_ELx_EC_PAC] = kvm_hyp_handle_ptrauth, };
Greg Kroah-Hartman
maintainerPATCH 207/225 KVM: x86: Account fastpath-only VM-Exits in vCPU stats
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 8b703a49c9df5e74870381ad7ba9c85d8a74ed2c upstream.
Increment vcpu->stat.exits when handling a fastpath VM-Exit without going through any part of the "slow" path. Not bumping the exits stat can result in wildly misleading exit counts, e.g. if the primary reason the guest is exiting is to program the TSC deadline timer.
--- arch/x86/kvm/x86.c | 3 +++ 1 file changed, 3 insertions(+)
arch/x86/kvm/x86.c +3 -0
@@ -10829,6 +10829,9 @@ static int vcpu_enter_guest(struct kvm_v exit_fastpath =EXIT_FASTPATH_EXIT_HANDLED ;break ; } + +/* Note, VM-Exits that go down the "slow" path are accounted below. */ + ++vcpu->stat.exits; }/*
Greg Kroah-Hartman
maintainerPATCH 208/225 ksmbd: fix credit count leakage
In reply to Greg Kroah-HartmanFrom: Namjae Jeon <[email protected]>
commit 84c5aa47925a1f40d698b6a6a2bf67e99617433d upstream.
This patch fix the failure from smb2.credits.single_req_credits_granted test. When client send 8192 credit request, ksmbd return 8191 credit granted. ksmbd should give maximum possible credits that must be granted within the range of not exceeding the max credit to client.
--- fs/ksmbd/smb2pdu.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
fs/ksmbd/smb2pdu.c +1 -5
@@ -326,13 +326,9 @@ int smb2_set_rsp_credits(struct ksmbd_woif (hdr->Command ==SMB2_NEGOTIATE ) aux_max =1 ;else - aux_max = conn->vals->max_credits - credit_charge; + aux_max = conn->vals->max_credits - conn->total_credits; credits_granted = min_t(unsigned short, credits_requested, aux_max); -if (conn->vals->max_credits - conn->total_credits < credits_granted) - credits_granted = conn->vals->max_credits - - conn->total_credits; - conn->total_credits += credits_granted; work->credits_granted += credits_granted;
Greg Kroah-Hartman
maintainerPATCH 209/225 ksmbd: fix UAF issue from opinfo->conn
In reply to Greg Kroah-HartmanFrom: Namjae Jeon <[email protected]>
commit 36322523dddb11107e9f7f528675a0dec2536103 upstream.
If opinfo->conn is another connection and while ksmbd send oplock break request to cient on current connection, The connection for opinfo->conn can be disconnect and conn could be freed. When sending oplock break request, this ksmbd_conn can be used and cause user-after-free issue. When getting opinfo from the list, ksmbd check connection is being released. If it is not released, Increase ->r_count to wait that connection is freed.
--- fs/ksmbd/oplock.c | 72 +++++++++++++++++++++++++++++++++++------------------- 1 file changed, 47 insertions(+), 25 deletions(-)
fs/ksmbd/oplock.c +47 -25
@@ -157,13 +157,42 @@ static struct oplock_info *opinfo_get_lircu_read_lock (); opinfo = list_first_or_null_rcu(&ci->m_op_list, struct oplock_info, op_entry); -if (opinfo && !atomic_inc_not_zero (&opinfo->refcount)) - opinfo =NULL ; +if (opinfo) { +if (!atomic_inc_not_zero (&opinfo->refcount)) + opinfo =NULL ; +else { +atomic_inc (&opinfo->conn->r_count); +if (ksmbd_conn_releasing (opinfo->conn)) { +atomic_dec (&opinfo->conn->r_count); +atomic_dec (&opinfo->refcount); + opinfo =NULL ; + } + } + } +rcu_read_unlock ();return opinfo; } +static void opinfo_conn_put (struct oplock_info *opinfo) +{ +struct ksmbd_conn *conn; + +if (!opinfo) +return ; + + conn = opinfo->conn; +/* +* Checking waitqueue to dropping pending requests on +* disconnection. waitqueue_active is safe because it +* uses atomic operation for condition. +*/ +if (!atomic_dec_return (&conn->r_count) &&waitqueue_active (&conn->r_count_q)) +wake_up (&conn->r_count_q); +opinfo_put (opinfo); +} +void opinfo_put (struct oplock_info *opinfo) {if (!atomic_dec_and_test (&opinfo->refcount))
@@ -666,13 +695,6 @@ static void __smb2_oplock_break_noti(str out:ksmbd_free_work_struct (work); -/* -* Checking waitqueue to dropping pending requests on -* disconnection. waitqueue_active is safe because it -* uses atomic operation for condition. -*/ -if (!atomic_dec_return (&conn->r_count) &&waitqueue_active (&conn->r_count_q)) -wake_up (&conn->r_count_q); }/**
@@ -706,7 +728,6 @@ static int smb2_oplock_break_noti(struct work->conn = conn; work->sess = opinfo->sess; -atomic_inc (&conn->r_count);if (opinfo->op_state ==OPLOCK_ACK_WAIT ) {INIT_WORK (&work->work, __smb2_oplock_break_noti);ksmbd_queue_work (work);
@@ -776,13 +797,6 @@ static void __smb2_lease_break_noti(stru out:ksmbd_free_work_struct (work); -/* -* Checking waitqueue to dropping pending requests on -* disconnection. waitqueue_active is safe because it -* uses atomic operation for condition. -*/ -if (!atomic_dec_return (&conn->r_count) &&waitqueue_active (&conn->r_count_q)) -wake_up (&conn->r_count_q); }/**
@@ -822,7 +836,6 @@ static int smb2_lease_break_noti(struct work->conn = conn; work->sess = opinfo->sess; -atomic_inc (&conn->r_count);if (opinfo->op_state ==OPLOCK_ACK_WAIT ) {list_for_each_safe (tmp, t, &opinfo->interim_list) {struct ksmbd_work *in_work;
@@ -1144,8 +1157,10 @@ int smb_grant_oplock(struct ksmbd_work * } prev_opinfo =opinfo_get_list (ci);if (!prev_opinfo || - (prev_opinfo->level ==SMB2_OPLOCK_LEVEL_NONE && lctx)) + (prev_opinfo->level ==SMB2_OPLOCK_LEVEL_NONE && lctx)) { +opinfo_conn_put (prev_opinfo); goto set_lev; + } prev_op_has_lease = prev_opinfo->is_lease;if (prev_op_has_lease) prev_op_state = prev_opinfo->o_lease->state;
@@ -1153,19 +1168,19 @@ int smb_grant_oplock(struct ksmbd_work *if (share_ret <0 && prev_opinfo->level ==SMB2_OPLOCK_LEVEL_EXCLUSIVE ) { err = share_ret; -opinfo_put (prev_opinfo); +opinfo_conn_put (prev_opinfo); goto err_out; }if (prev_opinfo->level !=SMB2_OPLOCK_LEVEL_BATCH && prev_opinfo->level !=SMB2_OPLOCK_LEVEL_EXCLUSIVE ) { -opinfo_put (prev_opinfo); +opinfo_conn_put (prev_opinfo); goto op_break_not_needed; }list_add (&work->interim_entry, &prev_opinfo->interim_list); err =oplock_break (prev_opinfo,SMB2_OPLOCK_LEVEL_II ); -opinfo_put (prev_opinfo); +opinfo_conn_put (prev_opinfo);if (err == -ENOENT ) goto set_lev;/* Check all oplock was freed by close */
@@ -1228,14 +1243,14 @@ static void smb_break_all_write_oplock(sreturn ;if (brk_opinfo->level !=SMB2_OPLOCK_LEVEL_BATCH && brk_opinfo->level !=SMB2_OPLOCK_LEVEL_EXCLUSIVE ) { -opinfo_put (brk_opinfo); +opinfo_conn_put (brk_opinfo);return ; } brk_opinfo->open_trunc = is_trunc;list_add (&work->interim_entry, &brk_opinfo->interim_list);oplock_break (brk_opinfo,SMB2_OPLOCK_LEVEL_II ); -opinfo_put (brk_opinfo); +opinfo_conn_put (brk_opinfo); }/**
@@ -1263,6 +1278,13 @@ void smb_break_all_levII_oplock(struct klist_for_each_entry_rcu (brk_op, &ci->m_op_list, op_entry) {if (!atomic_inc_not_zero (&brk_op->refcount))continue ; + +atomic_inc (&brk_op->conn->r_count); +if (ksmbd_conn_releasing (brk_op->conn)) { +atomic_dec (&brk_op->conn->r_count); +continue ; + } +rcu_read_unlock (); if (brk_op->is_lease && (brk_op->o_lease->state & (~(SMB2_LEASE_READ_CACHING_LE |
@@ -1292,7 +1314,7 @@ void smb_break_all_levII_oplock(struct k brk_op->open_trunc = is_trunc;oplock_break (brk_op,SMB2_OPLOCK_LEVEL_NONE ); next: -opinfo_put (brk_op); +opinfo_conn_put (brk_op);rcu_read_lock (); }rcu_read_unlock ();
Greg Kroah-Hartman
maintainerPATCH 210/225 ksmbd: fix incorrect AllocationSize set in smb2_get_info
In reply to Greg Kroah-HartmanFrom: Namjae Jeon <[email protected]>
commit 6cc2268f5647cbfde3d4fc2e4ee005070ea3a8d2 upstream.
If filesystem support sparse file, ksmbd should return allocated size using ->i_blocks instead of stat->size. This fix generic/694 xfstests.
--- fs/ksmbd/smb2pdu.c | 21 +++------------------ 1 file changed, 3 insertions(+), 18 deletions(-)
fs/ksmbd/smb2pdu.c +3 -18
@@ -4367,21 +4367,6 @@ static int get_file_basic_info(struct smreturn 0 ; } -static unsigned long long get_allocation_size (struct inode *inode, -struct kstat *stat) -{ -unsigned long long alloc_size =0 ; - -if (!S_ISDIR (stat->mode)) { -if ((inode->i_blocks <<9 ) <= stat->size) - alloc_size = stat->size; -else - alloc_size = inode->i_blocks <<9 ; - } - -return alloc_size; -} -static void get_file_standard_info (struct smb2_query_info_rsp *rsp,struct ksmbd_file *fp,void *rsp_org) {
@@ -4396,7 +4381,7 @@ static void get_file_standard_info(struc sinfo = (struct smb2_file_standard_info *)rsp->Buffer; delete_pending =ksmbd_inode_pending_delete (fp); - sinfo->AllocationSize =cpu_to_le64 (get_allocation_size (inode, &stat)); + sinfo->AllocationSize =cpu_to_le64 (inode->i_blocks <<9 ); sinfo->EndOfFile =S_ISDIR (stat.mode) ?0 :cpu_to_le64 (stat.size); sinfo->NumberOfLinks =cpu_to_le32 (get_nlink (&stat) - delete_pending); sinfo->DeletePending = delete_pending;
@@ -4461,7 +4446,7 @@ static int get_file_all_info(struct ksmb file_info->Attributes = fp->f_ci->m_fattr; file_info->Pad1 =0 ; file_info->AllocationSize = -cpu_to_le64 (get_allocation_size (inode, &stat)); +cpu_to_le64 (inode->i_blocks <<9 ); file_info->EndOfFile =S_ISDIR (stat.mode) ?0 :cpu_to_le64 (stat.size); file_info->NumberOfLinks =cpu_to_le32 (get_nlink (&stat) - delete_pending);
@@ -4650,7 +4635,7 @@ static int get_file_network_open_info(st file_info->ChangeTime =cpu_to_le64 (time); file_info->Attributes = fp->f_ci->m_fattr; file_info->AllocationSize = -cpu_to_le64 (get_allocation_size (inode, &stat)); +cpu_to_le64 (inode->i_blocks <<9 ); file_info->EndOfFile =S_ISDIR (stat.mode) ?0 :cpu_to_le64 (stat.size); file_info->Reserved =cpu_to_le32 (0 ); rsp->OutputBufferLength =
Greg Kroah-Hartman
maintainerPATCH 211/225 ksmbd: fix slab-out-of-bounds read in smb2_handle_negotiate
In reply to Greg Kroah-HartmanFrom: Kuan-Ting Chen <[email protected]>
commit d738950f112c8f40f0515fe967db998e8235a175 upstream.
Check request_buf length first to avoid out-of-bounds read by req->DialectCount.
[ 3350.990282] BUG: KASAN: slab-out-of-bounds in smb2_handle_negotiate+0x35d7/0x3e60 [ 3350.990282] Read of size 2 at addr ffff88810ad61346 by task kworker/5:0/276 [ 3351.000406] Workqueue: ksmbd-io handle_ksmbd_work [ 3351.003499] Call Trace: [ 3351.006473] <TASK> [ 3351.006473] dump_stack_lvl+0x8d/0xe0 [ 3351.006473] print_report+0xcc/0x620 [ 3351.006473] kasan_report+0x92/0xc0 [ 3351.006473] smb2_handle_negotiate+0x35d7/0x3e60 [ 3351.014760] ksmbd_smb_negotiate_common+0x7a7/0xf00 [ 3351.014760] handle_ksmbd_work+0x3f7/0x12d0 [ 3351.014760] process_one_work+0xa85/0x1780
--- fs/ksmbd/smb2pdu.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
fs/ksmbd/smb2pdu.c +5 -5
@@ -1069,16 +1069,16 @@ int smb2_handle_negotiate(struct ksmbd_wreturn rc; } -if (req->DialectCount ==0 ) { -pr_err ("malformed packet\n" ); + smb2_buf_len =get_rfc1002_len (work->request_buf); + smb2_neg_size = offsetof(struct smb2_negotiate_req , Dialects); +if (smb2_neg_size > smb2_buf_len) { rsp->hdr.Status =STATUS_INVALID_PARAMETER ; rc = -EINVAL ; goto err_out; } - smb2_buf_len =get_rfc1002_len (work->request_buf); - smb2_neg_size = offsetof(struct smb2_negotiate_req , Dialects); -if (smb2_neg_size > smb2_buf_len) { +if (req->DialectCount ==0 ) { +pr_err ("malformed packet\n" ); rsp->hdr.Status =STATUS_INVALID_PARAMETER ; rc = -EINVAL ; goto err_out;
Greg Kroah-Hartman
maintainerPATCH 212/225 ksmbd: fix multiple out-of-bounds read during context decoding
In reply to Greg Kroah-HartmanFrom: Kuan-Ting Chen <[email protected]>
commit 0512a5f89e1fae74251fde6893ff634f1c96c6fb upstream.
Check the remaining data length before accessing the context structure to ensure that the entire structure is contained within the packet. Additionally, since the context data length ctxt_len has already been checked against the total packet length len_of_ctxts, update the comparison to use ctxt_len.
--- fs/ksmbd/smb2pdu.c | 53 ++++++++++++++++++++++++++++++++++------------------- 1 file changed, 34 insertions(+), 19 deletions(-)
fs/ksmbd/smb2pdu.c +34 -19
@@ -861,13 +861,14 @@ static void assemble_neg_contexts(structstatic __le32 decode_preauth_ctxt (struct ksmbd_conn *conn,struct smb2_preauth_neg_context *pneg_ctxt, -int len_of_ctxts) +int ctxt_len) {/* * sizeof(smb2_preauth_neg_context) assumes SMB311_SALT_SIZE Salt, * which may not be present. Only check for used HashAlgorithms[1]. */ -if (len_of_ctxts <MIN_PREAUTH_CTXT_DATA_LEN ) +if (ctxt_len < +sizeof (struct smb2_neg_context ) +MIN_PREAUTH_CTXT_DATA_LEN )return STATUS_INVALID_PARAMETER ;if (pneg_ctxt->HashAlgorithms !=SMB2_PREAUTH_INTEGRITY_SHA512 )
@@ -879,15 +880,23 @@ static __le32 decode_preauth_ctxt(structstatic void decode_encrypt_ctxt (struct ksmbd_conn *conn,struct smb2_encryption_neg_context *pneg_ctxt, -int len_of_ctxts) +int ctxt_len) { -int cph_cnt =le16_to_cpu (pneg_ctxt->CipherCount); -int i, cphs_size = cph_cnt *sizeof (__le16); +int cph_cnt; +int i, cphs_size; + +if (sizeof (struct smb2_encryption_neg_context ) > ctxt_len) { +pr_err ("Invalid SMB2_ENCRYPTION_CAPABILITIES context size\n" ); +return ; + } conn->cipher_type =0 ; + cph_cnt =le16_to_cpu (pneg_ctxt->CipherCount); + cphs_size = cph_cnt *sizeof (__le16); +if (sizeof (struct smb2_encryption_neg_context ) + cphs_size > - len_of_ctxts) { + ctxt_len) {pr_err ("Invalid cipher count(%d)\n" , cph_cnt);return ; }
@@ -935,15 +944,22 @@ static void decode_compress_ctxt(structstatic void decode_sign_cap_ctxt (struct ksmbd_conn *conn,struct smb2_signing_capabilities *pneg_ctxt, -int len_of_ctxts) +int ctxt_len) { -int sign_algo_cnt =le16_to_cpu (pneg_ctxt->SigningAlgorithmCount); -int i, sign_alos_size = sign_algo_cnt *sizeof (__le16); +int sign_algo_cnt; +int i, sign_alos_size; + +if (sizeof (struct smb2_signing_capabilities ) > ctxt_len) { +pr_err ("Invalid SMB2_SIGNING_CAPABILITIES context length\n" ); +return ; + } conn->signing_negotiated = false; + sign_algo_cnt =le16_to_cpu (pneg_ctxt->SigningAlgorithmCount); + sign_alos_size = sign_algo_cnt *sizeof (__le16);if (sizeof (struct smb2_signing_capabilities ) + sign_alos_size > - len_of_ctxts) { + ctxt_len) {pr_err ("Invalid signing algorithm count(%d)\n" , sign_algo_cnt);return ; }
@@ -981,18 +997,16 @@ static __le32 deassemble_neg_contexts(st len_of_ctxts = len_of_smb - offset;while (i++ < neg_ctxt_cnt) { -int clen; - -/* check that offset is not beyond end of SMB */ -if (len_of_ctxts ==0 ) -break ; +int clen, ctxt_len;if (len_of_ctxts <sizeof (struct smb2_neg_context ))break ; pctx = (struct smb2_neg_context *)((char *)pctx + offset); clen =le16_to_cpu (pctx->DataLength); -if (clen +sizeof (struct smb2_neg_context ) > len_of_ctxts) + ctxt_len = clen +sizeof (struct smb2_neg_context ); + +if (ctxt_len > len_of_ctxts)break ;if (pctx->ContextType ==SMB2_PREAUTH_INTEGRITY_CAPABILITIES ) {
@@ -1003,7 +1017,7 @@ static __le32 deassemble_neg_contexts(st status =decode_preauth_ctxt (conn, (struct smb2_preauth_neg_context *)pctx, - len_of_ctxts); + ctxt_len);if (status !=STATUS_SUCCESS )break ; }else if (pctx->ContextType ==SMB2_ENCRYPTION_CAPABILITIES ) {
@@ -1014,7 +1028,7 @@ static __le32 deassemble_neg_contexts(stdecode_encrypt_ctxt (conn, (struct smb2_encryption_neg_context *)pctx, - len_of_ctxts); + ctxt_len); }else if (pctx->ContextType ==SMB2_COMPRESSION_CAPABILITIES ) {ksmbd_debug (SMB ,"deassemble SMB2_COMPRESSION_CAPABILITIES context\n" );
@@ -1033,9 +1047,10 @@ static __le32 deassemble_neg_contexts(st }else if (pctx->ContextType ==SMB2_SIGNING_CAPABILITIES ) {ksmbd_debug (SMB ,"deassemble SMB2_SIGNING_CAPABILITIES context\n" ); +decode_sign_cap_ctxt (conn, (struct smb2_signing_capabilities *)pctx, - len_of_ctxts); + ctxt_len); }/* offsets must be 8 byte aligned */
Greg Kroah-Hartman
maintainerPATCH 213/225 KEYS: asymmetric: Copy sig and digest in public_key_verify_signature()
In reply to Greg Kroah-HartmanFrom: Roberto Sassu <[email protected]>
commit c3d03e8e35e005e1a614e51bb59053eeb5857f76 upstream.
Commit ac4e97abce9b8 ("scatterlist: sg_set_buf() argument must be in linear mapping") checks that both the signature and the digest reside in the linear mapping area.
However, more recently commit ba14a194a434c ("fork: Add generic vmalloced stack support") made it possible to move the stack in the vmalloc area, which is not contiguous, and thus not suitable for sg_set_buf() which needs adjacent pages.
Always make a copy of the signature and digest in the same buffer used to store the key and its parameters, and pass them to sg_init_one(). Prefer it to conditionally doing the copy if necessary, to keep the code simple. The buffer allocated with kmalloc() is in the linear mapping area.
--- crypto/asymmetric_keys/public_key.c | 38 +++++++++++++++++++----------------- 1 file changed, 21 insertions(+), 17 deletions(-)
crypto/asymmetric_keys/public_key.c +21 -17
@@ -380,9 +380,10 @@ int public_key_verify_signature(const ststruct crypto_wait cwait;struct crypto_akcipher *tfm;struct akcipher_request *req; -struct scatterlist src_sg[2 ]; +struct scatterlist src_sg;char alg_name[CRYPTO_MAX_ALG_NAME ]; -char *key, *ptr; +char *buf, *ptr; +size_t buf_len;int ret;pr_devel ("==>%s()\n" , __func__);
@@ -420,34 +421,37 @@ int public_key_verify_signature(const stif (!req) goto error_free_tfm; - key =kmalloc (pkey->keylen +sizeof (u32) *2 + pkey->paramlen, -GFP_KERNEL ); -if (!key) + buf_len =max_t (size_t, pkey->keylen +sizeof (u32) *2 + pkey->paramlen, + sig->s_size + sig->digest_size); + + buf =kmalloc (buf_len,GFP_KERNEL ); +if (!buf) goto error_free_req; -memcpy (key, pkey->key, pkey->keylen); - ptr = key + pkey->keylen; +memcpy (buf, pkey->key, pkey->keylen); + ptr = buf + pkey->keylen; ptr =pkey_pack_u32 (ptr, pkey->algo); ptr =pkey_pack_u32 (ptr, pkey->paramlen);memcpy (ptr, pkey->params, pkey->paramlen);if (pkey->key_is_private) - ret =crypto_akcipher_set_priv_key (tfm, key, pkey->keylen); + ret =crypto_akcipher_set_priv_key (tfm, buf, pkey->keylen);else - ret =crypto_akcipher_set_pub_key (tfm, key, pkey->keylen); + ret =crypto_akcipher_set_pub_key (tfm, buf, pkey->keylen);if (ret) - goto error_free_key; + goto error_free_buf;if (strcmp (pkey->pkey_algo,"sm2" ) ==0 && sig->data_size) { ret =cert_sig_digest_update (sig, tfm);if (ret) - goto error_free_key; + goto error_free_buf; } -sg_init_table (src_sg,2 ); -sg_set_buf (&src_sg[0 ], sig->s, sig->s_size); -sg_set_buf (&src_sg[1 ], sig->digest, sig->digest_size); -akcipher_request_set_crypt (req, src_sg,NULL , sig->s_size, +memcpy (buf, sig->s, sig->s_size); +memcpy (buf + sig->s_size, sig->digest, sig->digest_size); + +sg_init_one (&src_sg, buf, sig->s_size + sig->digest_size); +akcipher_request_set_crypt (req, &src_sg,NULL , sig->s_size, sig->digest_size);crypto_init_wait (&cwait); akcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG |
@@ -455,8 +459,8 @@ int public_key_verify_signature(const st crypto_req_done, &cwait); ret =crypto_wait_req (crypto_akcipher_verify (req), &cwait); -error_free_key: -kfree (key); +error_free_buf: +kfree (buf); error_free_req:akcipher_request_free (req); error_free_tfm:
Greg Kroah-Hartman
maintainerPATCH 214/225 fs/ntfs3: Validate MFT flags before replaying logs
In reply to Greg Kroah-HartmanFrom: Edward Lo <[email protected]>
commit 98bea253aa28ad8be2ce565a9ca21beb4a9419e5 upstream.
Log load and replay is part of the metadata handle flow during mount operation. The $MFT record will be loaded and used while replaying logs. However, a malformed $MFT record, say, has RECORD_FLAG_DIR flag set and contains an ATTR_ROOT attribute will misguide kernel to treat it as a directory, and try to free the allocated resources when the corresponding inode is freed, which will cause an invalid kfree because the memory hasn't actually been allocated.
[ 101.368647] BUG: KASAN: invalid-free in kvfree+0x2c/0x40 [ 101.369457] [ 101.369986] CPU: 0 PID: 198 Comm: mount Not tainted 6.0.0-rc7+ #5 [ 101.370529] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 101.371362] Call Trace: [ 101.371795] <TASK> [ 101.372157] dump_stack_lvl+0x49/0x63 [ 101.372658] print_report.cold+0xf5/0x689 [ 101.373022] ? ni_write_inode+0x754/0xd90 [ 101.373378] ? kvfree+0x2c/0x40 [ 101.373698] kasan_report_invalid_free+0x77/0xf0 [ 101.374058] ? kvfree+0x2c/0x40 [ 101.374352] ? kvfree+0x2c/0x40 [ 101.374668] __kasan_slab_free+0x189/0x1b0 [ 101.374992] ? kvfree+0x2c/0x40 [ 101.375271] kfree+0x168/0x3b0 [ 101.375717] kvfree+0x2c/0x40 [ 101.376002] indx_clear+0x26/0x60 [ 101.376316] ni_clear+0xc5/0x290 [ 101.376661] ntfs_evict_inode+0x45/0x70 [ 101.377001] evict+0x199/0x280 [ 101.377432] iput.part.0+0x286/0x320 [ 101.377819] iput+0x32/0x50 [ 101.378166] ntfs_loadlog_and_replay+0x143/0x320 [ 101.378656] ? ntfs_bio_fill_1+0x510/0x510 [ 101.378968] ? iput.part.0+0x286/0x320 [ 101.379367] ntfs_fill_super+0xecb/0x1ba0 [ 101.379729] ? put_ntfs+0x1d0/0x1d0 [ 101.380046] ? vsprintf+0x20/0x20 [ 101.380542] ? mutex_unlock+0x81/0xd0 [ 101.380914] ? set_blocksize+0x95/0x150 [ 101.381597] get_tree_bdev+0x232/0x370 [ 101.382254] ? put_ntfs+0x1d0/0x1d0 [ 101.382699] ntfs_fs_get_tree+0x15/0x20 [ 101.383094] vfs_get_tree+0x4c/0x130 [ 101.383675] path_mount+0x654/0xfe0 [ 101.384203] ? putname+0x80/0xa0 [ 101.384540] ? finish_automount+0x2e0/0x2e0 [ 101.384943] ? putname+0x80/0xa0 [ 101.385362] ? kmem_cache_free+0x1c4/0x440 [ 101.385968] ? putname+0x80/0xa0 [ 101.386666] do_mount+0xd6/0xf0 [ 101.387228] ? path_mount+0xfe0/0xfe0 [ 101.387585] ? __kasan_check_write+0x14/0x20 [ 101.387979] __x64_sys_mount+0xca/0x110 [ 101.388436] do_syscall_64+0x3b/0x90 [ 101.388757] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 101.389289] RIP: 0033:0x7fa0f70e948a [ 101.390048] Code: 48 8b 0d 11 fa 2a 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 008 [ 101.391297] RSP: 002b:00007ffc24fdecc8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 [ 101.391988] RAX: ffffffffffffffda RBX: 000055932c183060 RCX: 00007fa0f70e948a [ 101.392494] RDX: 000055932c183260 RSI: 000055932c1832e0 RDI: 000055932c18bce0 [ 101.393053] RBP: 0000000000000000 R08: 000055932c183280 R09: 0000000000000020 [ 101.393577] R10: 00000000c0ed0000 R11: 0000000000000202 R12: 000055932c18bce0 [ 101.394044] R13: 000055932c183260 R14: 0000000000000000 R15: 00000000ffffffff [ 101.394747] </TASK> [ 101.395402] [ 101.396047] Allocated by task 198: [ 101.396724] kasan_save_stack+0x26/0x50 [ 101.397400] __kasan_slab_alloc+0x6d/0x90 [ 101.397974] kmem_cache_alloc_lru+0x192/0x5a0 [ 101.398524] ntfs_alloc_inode+0x23/0x70 [ 101.399137] alloc_inode+0x3b/0xf0 [ 101.399534] iget5_locked+0x54/0xa0 [ 101.400026] ntfs_iget5+0xaf/0x1780 [ 101.400414] ntfs_loadlog_and_replay+0xe5/0x320 [ 101.400883] ntfs_fill_super+0xecb/0x1ba0 [ 101.401313] get_tree_bdev+0x232/0x370 [ 101.401774] ntfs_fs_get_tree+0x15/0x20 [ 101.402224] vfs_get_tree+0x4c/0x130 [ 101.402673] path_mount+0x654/0xfe0 [ 101.403160] do_mount+0xd6/0xf0 [ 101.403537] __x64_sys_mount+0xca/0x110 [ 101.404058] do_syscall_64+0x3b/0x90 [ 101.404333] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 101.404816] [ 101.405067] The buggy address belongs to the object at ffff888008cc9ea0 [ 101.405067] which belongs to the cache ntfs_inode_cache of size 992 [ 101.406171] The buggy address is located 232 bytes inside of [ 101.406171] 992-byte region [ffff888008cc9ea0, ffff888008cca280) [ 101.406995] [ 101.408559] The buggy address belongs to the physical page: [ 101.409320] page:00000000dccf19dd refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8cc8 [ 101.410654] head:00000000dccf19dd order:2 compound_mapcount:0 compound_pincount:0 [ 101.411533] flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) [ 101.412665] raw: 000fffffc0010200 0000000000000000 dead000000000122 ffff888003695140 [ 101.413209] raw: 0000000000000000 00000000800e000e 00000001ffffffff 0000000000000000 [ 101.413799] page dumped because: kasan: bad access detected [ 101.414213] [ 101.414427] Memory state around the buggy address: [ 101.414991] ffff888008cc9e80: fc fc fc fc 00 00 00 00 00 00 00 00 00 00 00 00 [ 101.415785] ffff888008cc9f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 101.416933] >ffff888008cc9f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 101.417857] ^ [ 101.418566] ffff888008cca000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 101.419704] ffff888008cca080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
--- fs/ntfs3/inode.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/ntfs3/inode.c +6 -0
@@ -98,6 +98,12 @@ static struct inode *ntfs_read_mft(struc/* Record should contain $I30 root. */ is_dir = rec->flags &RECORD_FLAG_DIR ; +/* MFT_REC_MFT is not a dir */ +if (is_dir && ino ==MFT_REC_MFT ) { + err = -EINVAL ; + goto out; + } + inode->i_generation =le16_to_cpu (rec->seq);/* Enumerate all struct Attributes MFT. */
Greg Kroah-Hartman
maintainerPATCH 215/225 regmap: Account for register length when chunking
In reply to Greg Kroah-HartmanFrom: Jim Wylder <[email protected]>
commit 3981514180c987a79ea98f0ae06a7cbf58a9ac0f upstream.
Currently, when regmap_raw_write() splits the data, it uses the max_raw_write value defined for the bus. For any bus that includes the target register address in the max_raw_write value, the chunked transmission will always exceed the maximum transmission length. To avoid this problem, subtract the length of the register and the padding from the maximum transmission.
--- drivers/base/regmap/regmap.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/base/regmap/regmap.c +4 -2
@@ -2064,6 +2064,8 @@ int _regmap_raw_write(struct regmap *mapsize_t val_count = val_len / val_bytes;size_t chunk_count, chunk_bytes;size_t chunk_regs = val_count; +size_t max_data = map->max_raw_write - map->format.reg_bytes - + map->format.pad_bytes;int ret, i;if (!val_count)
@@ -2071,8 +2073,8 @@ int _regmap_raw_write(struct regmap *mapif (map->use_single_write) chunk_regs =1 ; -else if (map->max_raw_write && val_len > map->max_raw_write) - chunk_regs = map->max_raw_write / val_bytes; +else if (map->max_raw_write && val_len > max_data) + chunk_regs = max_data / val_bytes; chunk_count = val_count / chunk_regs; chunk_bytes = chunk_regs * val_bytes;
Greg Kroah-Hartman
maintainerPATCH 216/225 tpm, tpm_tis: Request threaded interrupt handler
In reply to Greg Kroah-HartmanFrom: Lino Sanfilippo <[email protected]>
commit 0c7e66e5fd69bf21034c9a9b081d7de7c3eb2cea upstream.
The TIS interrupt handler at least has to read and write the interrupt status register. In case of SPI both operations result in a call to tpm_tis_spi_transfer() which uses the bus_lock_mutex of the spi device and thus must only be called from a sleepable context.
To ensure this request a threaded interrupt handler.
--- drivers/char/tpm/tpm_tis_core.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/char/tpm/tpm_tis_core.c +5 -2
@@ -805,8 +805,11 @@ static int tpm_tis_probe_irq_single(struint rc;u32 int_status; -if (devm_request_irq (chip->dev.parent, irq, tis_int_handler, flags, -dev_name (&chip->dev), chip) !=0 ) { + + rc =devm_request_threaded_irq (chip->dev.parent, irq,NULL , + tis_int_handler,IRQF_ONESHOT | flags, +dev_name (&chip->dev), chip); +if (rc) {dev_info (&chip->dev,"Unable to request irq: %d for probe\n" , irq);return -1 ;
Greg Kroah-Hartman
maintainerPATCH 217/225 iommu/amd/pgtbl_v2: Fix domain max address
In reply to Greg Kroah-HartmanFrom: Vasant Hegde <[email protected]>
commit 11c439a19466e7feaccdbce148a75372fddaf4e9 upstream.
IOMMU v2 page table supports 4 level (47 bit) or 5 level (56 bit) virtual address space. Current code assumes it can support 64bit IOVA address space. If IOVA allocator allocates virtual address > 47/56 bit (depending on page table level) then it will do wrong mapping and cause invalid translation.
Hence adjust aperture size to use max address supported by the page table.
--- drivers/iommu/amd/iommu.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/iommu/amd/iommu.c +10 -1
@@ -2101,6 +2101,15 @@ out_err:return NULL ; } +static inline u64 dma_max_address (void ) +{ +if (amd_iommu_pgtable ==AMD_IOMMU_V1 ) +return ~0ULL ; + +/* V2 with 4 level page table */ +return ((1ULL <<PM_LEVEL_SHIFT (PAGE_MODE_4_LEVEL )) -1 ); +} +static struct iommu_domain *amd_iommu_domain_alloc (unsigned type) {struct protection_domain *domain;
@@ -2117,7 +2126,7 @@ static struct iommu_domain *amd_iommu_doreturn NULL ; domain->domain.geometry.aperture_start =0 ; - domain->domain.geometry.aperture_end = ~0ULL ; + domain->domain.geometry.aperture_end =dma_max_address (); domain->domain.geometry.force_aperture = true;return &domain->domain;
Greg Kroah-Hartman
maintainerPATCH 218/225 drm/amd/display: Have Payload Properly Created After Resume
In reply to Greg Kroah-HartmanFrom: Fangzhi Zuo <[email protected]>
commit 482e6ad9adde69d9da08864b4ccf4dfd53edb2f0 upstream.
At drm suspend sequence, MST dc_sink is removed. When commit cached MST stream back in drm resume sequence, the MST stream payload is not properly created and added into the payload table. After resume, topology change is reprobed by removing existing streams first. That leads to no payload is found in the existing payload table as below error "[drm] ERROR No payload for [MST PORT:] found in mst state"
1. In encoder .atomic_check routine, remove check existance of dc_sink
2. Bypass MST by checking existence of MST root port. dc_link_type cannot differentiate MST port before topology is rediscovered.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +2 -2
@@ -2763,7 +2763,7 @@ static int dm_resume(void *handle)* this is the case when traversing through already created * MST connectors, should be skipped */ -if (aconnector->dc_link->type == dc_connection_mst_branch) +if (aconnector && aconnector->mst_port)continue ;mutex_lock (&aconnector->hpd_lock);
@@ -6492,7 +6492,7 @@ static int dm_encoder_helper_atomic_checint clock, bpp =0 ;bool is_y420 = false; -if (!aconnector->port || !aconnector->dc_sink) +if (!aconnector->port)return 0 ; mst_port = aconnector->port;
Greg Kroah-Hartman
maintainerPATCH 219/225 xfs: verify buffer contents when we skip log replay
In reply to Greg Kroah-HartmanFrom: Darrick J. Wong <[email protected]>
commit 22ed903eee23a5b174e240f1cdfa9acf393a5210 upstream.
syzbot detected a crash during log recovery:
XFS (loop0): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
XFS (loop0): Torn write (CRC failure) detected at log block 0x180. Truncating head block from 0x200. XFS (loop0): Starting recovery (logdev: internal)
==================================================================
BUG: KASAN: slab-out-of-bounds in xfs_btree_lookup_get_block+0x15c/0x6d0 fs/xfs/libxfs/xfs_btree.c:1813 Read of size 8 at addr ffff88807e89f258 by task syz-executor132/5074 CPU: 0 PID: 5074 Comm: syz-executor132 Not tainted 6.2.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:306 print_report+0x107/0x1f0 mm/kasan/report.c:417 kasan_report+0xcd/0x100 mm/kasan/report.c:517 xfs_btree_lookup_get_block+0x15c/0x6d0 fs/xfs/libxfs/xfs_btree.c:1813 xfs_btree_lookup+0x346/0x12c0 fs/xfs/libxfs/xfs_btree.c:1913 xfs_btree_simple_query_range+0xde/0x6a0 fs/xfs/libxfs/xfs_btree.c:4713 xfs_btree_query_range+0x2db/0x380 fs/xfs/libxfs/xfs_btree.c:4953 xfs_refcount_recover_cow_leftovers+0x2d1/0xa60 fs/xfs/libxfs/xfs_refcount.c:1946 xfs_reflink_recover_cow+0xab/0x1b0 fs/xfs/xfs_reflink.c:930 xlog_recover_finish+0x824/0x920 fs/xfs/xfs_log_recover.c:3493 xfs_log_mount_finish+0x1ec/0x3d0 fs/xfs/xfs_log.c:829 xfs_mountfs+0x146a/0x1ef0 fs/xfs/xfs_mount.c:933 xfs_fs_fill_super+0xf95/0x11f0 fs/xfs/xfs_super.c:1666 get_tree_bdev+0x400/0x620 fs/super.c:1282 vfs_get_tree+0x88/0x270 fs/super.c:1489 do_new_mount+0x289/0xad0 fs/namespace.c:3145 do_mount fs/namespace.c:3488 [inline] __do_sys_mount fs/namespace.c:3697 [inline] __se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3674 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f89fa3f4aca Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fffd5fb5ef8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00646975756f6e2c RCX: 00007f89fa3f4aca RDX: 0000000020000100 RSI: 0000000020009640 RDI: 00007fffd5fb5f10 RBP: 00007fffd5fb5f10 R08: 00007fffd5fb5f50 R09: 000000000000970d R10: 0000000000200800 R11: 0000000000000206 R12: 0000000000000004 R13: 0000555556c6b2c0 R14: 0000000000200800 R15: 00007fffd5fb5f50 </TASK>
The fuzzed image contains an AGF with an obviously garbage agf_refcount_level value of 32, and a dirty log with a buffer log item for that AGF. The ondisk AGF has a higher LSN than the recovered log item. xlog_recover_buf_commit_pass2 reads the buffer, compares the LSNs, and decides to skip replay because the ondisk buffer appears to be newer.
Unfortunately, the ondisk buffer is corrupt, but recovery just read the buffer with no buffer ops specified:
error = xfs_buf_read(mp->m_ddev_targp, buf_f->blf_blkno, buf_f->blf_len, buf_flags, &bp, NULL);
Skipping the buffer leaves its contents in memory unverified. This sets us up for a kernel crash because xfs_refcount_recover_cow_leftovers reads the buffer (which is still around in XBF_DONE state, so no read verification) and creates a refcountbt cursor of height 32. This is impossible so we run off the end of the cursor object and crash.
Fix this by invoking the verifier on all skipped buffers and aborting log recovery if the ondisk buffer is corrupt. It might be smarter to force replay the log item atop the buffer and then see if it'll pass the write verifier (like ext4 does) but for now let's go with the conservative option where we stop immediately.
--- fs/xfs/xfs_buf_item_recover.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
fs/xfs/xfs_buf_item_recover.c +10 -0
@@ -943,6 +943,16 @@ xlog_recover_buf_commit_pass2(if (lsn && lsn !=-1 &&XFS_LSN_CMP (lsn, current_lsn) >=0 ) {trace_xfs_log_recover_buf_skip (log, buf_f);xlog_recover_validate_buf_type (mp, bp, buf_f,NULLCOMMITLSN ); + +/* +* We're skipping replay of this buffer log item due to the log +* item LSN being behind the ondisk buffer. Verify the buffer +* contents since we aren't going to run the write verifier. +*/ +if (bp->b_ops) { + bp->b_ops->verify_read (bp); + error = bp->b_error; + } goto out_release; }
Greg Kroah-Hartman
maintainerPATCH 220/225 tls: rx: strp: dont use GFP_KERNEL in softirq context
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
commit 74836ec828fe17b63f2006fdbf53311d691396bf upstream.
When receive buffer is small, or the TCP rx queue looks too complicated to bother using it directly - we allocate a new skb and copy data into it.
We already use sk->sk_allocation... but nothing actually sets it to GFP_ATOMIC on the ->sk_data_ready() path.
Users of HW offload are far more likely to experience problems due to scheduling while atomic. "Copy mode" is very rarely triggered with SW crypto.
--- net/tls/tls_sw.c | 4 ++++ 1 file changed, 4 insertions(+)
net/tls/tls_sw.c +4 -0
@@ -2289,8 +2289,12 @@ static void tls_data_ready(struct sock *struct tls_context *tls_ctx =tls_get_ctx (sk);struct tls_sw_context_rx *ctx =tls_sw_ctx_rx (tls_ctx);struct sk_psock *psock; +gfp_t alloc_save; + alloc_save = sk->sk_allocation; + sk->sk_allocation =GFP_ATOMIC ;tls_strp_data_ready (&ctx->strp); + sk->sk_allocation = alloc_save; psock =sk_psock_get (sk);if (psock) {
Greg Kroah-Hartman
maintainerPATCH 221/225 arm64: efi: Use SMBIOS processor version to key off Ampere quirk
In reply to Greg Kroah-HartmanFrom: Ard Biesheuvel <[email protected]>
commit eb684408f3ea4856639675d6465f0024e498e4b1 upstream.
Instead of using the SMBIOS type 1 record 'family' field, which is often modified by OEMs, use the type 4 'processor ID' and 'processor version' fields, which are set to a small set of probe-able values on all known Ampere EFI systems in the field.
--- drivers/firmware/efi/libstub/arm64-stub.c | 39 ++++++++++++++++++++++------ drivers/firmware/efi/libstub/efistub.h | 41 +++++++++++++++++++++++++++--- drivers/firmware/efi/libstub/smbios.c | 13 ++++++++- 3 files changed, 80 insertions(+), 13 deletions(-)
drivers/firmware/efi/libstub/arm64-stub.c +31 -8
@@ -17,20 +17,43 @@static bool system_needs_vamap (void ) { -const u8 *type1_family =efi_get_smbios_string (1 , family); +const struct efi_smbios_type4_record *record; +const u32 __aligned(1) *socid; +const u8 *version;/* * Ampere eMAG, Altra, and Altra Max machines crash in SetTime() if -* SetVirtualAddressMap() has not been called prior. +* SetVirtualAddressMap() has not been called prior. Most Altra systems +* can be identified by the SMCCC soc ID, which is conveniently exposed +* via the type 4 SMBIOS records. Otherwise, test the processor version +* field. eMAG systems all appear to have the processor version field +* set to "eMAG". */ -if (!type1_family || ( -strcmp (type1_family,"eMAG" ) && -strcmp (type1_family,"Altra" ) && -strcmp (type1_family,"Altra Max" ))) + record = (struct efi_smbios_type4_record *)efi_get_smbios_record (4 ); +if (!record)return false; -efi_warn ("Working around broken SetVirtualAddressMap()\n" ); -return true; + socid = (u32 *)record->processor_id; +switch (*socid &0xffff000f ) { +static char const altra[] ="Ampere(TM) Altra(TM) Processor" ; +static char const emag[] ="eMAG" ; + +default : + version =efi_get_smbios_string (&record->header,4 , + processor_version); +if (!version || (strncmp (version, altra,sizeof (altra) -1 ) && +strncmp (version, emag,sizeof (emag) -1 ))) +break ; + + fallthrough; + +case 0x0a160001 :// Altra +case 0x0a160002 :// Altra Max +efi_warn ("Working around broken SetVirtualAddressMap()\n" ); +return true; + } + +return false; }efi_status_t check_platform_features (void )
drivers/firmware/efi/libstub/efistub.h +38 -3
57 lines not on this page · raw message
drivers/firmware/efi/libstub/smbios.c +11 -2
@@ -22,19 +22,28 @@ struct efi_smbios_protocol {u8 minor_version; }; -const u8 *__efi_get_smbios_string (u8 type,int offset,int recsize) +const struct efi_smbios_record *efi_get_smbios_record (u8 type) {struct efi_smbios_record *record;efi_smbios_protocol_t *smbios;efi_status_t status;u16 handle =0xfffe ; -const u8 *strtable; status =efi_bs_call (locate_protocol, &EFI_SMBIOS_PROTOCOL_GUID ,NULL , (void **)&smbios) ?:efi_call_proto (smbios, get_next, &handle, &type, &record,NULL );if (status !=EFI_SUCCESS )return NULL ; +return record; +} + +const u8 *__efi_get_smbios_string (const struct efi_smbios_record *record, +u8 type,int offset,int recsize) +{ +const u8 *strtable; + +if (!record) +return NULL ; strtable = (u8 *)record + record->length;for (int i =1 ; i < ((u8 *)record)[offset]; i++) {
Greg Kroah-Hartman
maintainerPATCH 222/225 selftests: mptcp: diag: skip if MPTCP is not supported
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit 46565acdd29facbf418a11e4a3791b3c8967308d upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting MPTCP.
A new check is then added to make sure MPTCP is supported. If not, the test stops and is marked as "skipped".
--- tools/testing/selftests/net/mptcp/diag.sh | 4 ++++ 1 file changed, 4 insertions(+)
tools/testing/selftests/net/mptcp/diag.sh +4 -0
@@ -1,6 +1,8 @@ #!/bin/bash # SPDX-License-Identifier: GPL-2.0 +. "$(dirname "${0}")/mptcp_lib.sh" + rndh=$(printf %x $sec)-$(mktemp -u XXXXXX) ns="ns1-$rndh" ksft_skip=4
@@ -25,6 +27,8 @@ cleanup() ip netns del $ns } +mptcp_lib_check_mptcp + ip -Version > /dev/null 2>&1 if [ $? -ne 0 ];then echo "SKIP: Could not run test without ip tool"
Greg Kroah-Hartman
maintainerPATCH 223/225 selftests: mptcp: simult flows: skip if MPTCP is not supported
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit 9161f21c74a1a0e7bb39eb84ea0c86b23c92fc87 upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting MPTCP.
A new check is then added to make sure MPTCP is supported. If not, the test stops and is marked as "skipped".
--- tools/testing/selftests/net/mptcp/simult_flows.sh | 4 ++++ 1 file changed, 4 insertions(+)
tools/testing/selftests/net/mptcp/simult_flows.sh +4 -0
@@ -1,6 +1,8 @@ #!/bin/bash # SPDX-License-Identifier: GPL-2.0 +. "$(dirname "${0}")/mptcp_lib.sh" + rndh=$(printf %x $sec)-$(mktemp -u XXXXXX) ns1="ns1-$rndh" ns2="ns2-$rndh"
@@ -33,6 +35,8 @@ cleanup() done } +mptcp_lib_check_mptcp + ip -Version > /dev/null 2>&1 if [ $? -ne 0 ];then echo "SKIP: Could not run test without ip tool"
Greg Kroah-Hartman
maintainerPATCH 224/225 selftests: mptcp: join: avoid using cmp --bytes
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit d328fe87067480cf2bd0b58dab428a98d31dbb7e upstream.
BusyBox's 'cmp' command doesn't support the '--bytes' parameter.
Some CIs -- i.e. LKFT -- use BusyBox and have the mptcp_join.sh test failing [1] because their 'cmp' command doesn't support this '--bytes' option:
cmp: unrecognized option '--bytes=1024'
BusyBox v1.35.0 () multi-call binary.
Usage: cmp [-ls] [-n NUM] FILE1 [FILE2]Instead, 'head --bytes' can be used as this option is supported by BusyBox. A temporary file is needed for this operation.
Because it is apparently quite common to use BusyBox, it is certainly better to backport this fix to impacted kernels.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +11 -2
@@ -15,6 +15,7 @@ sout="" cin="" cinfail="" cinsent="" +tmpfile="" cout="" capout="" ns1=""
@@ -168,6 +169,7 @@ cleanup() { rm -f "$cin" "$cout" "$sinfail" rm -f "$sin" "$sout" "$cinsent" "$cinfail" + rm -f "$tmpfile" cleanup_partial }
@@ -362,9 +364,16 @@ check_transfer() fail_test return 1 fi - bytes="--bytes=${bytes}" + + # note: BusyBox's "cmp" command doesn't support --bytes + tmpfile=$(mktemp) + head --bytes="$bytes" "$in" > "$tmpfile" + mv "$tmpfile" "$in" + head --bytes="$bytes" "$out" > "$tmpfile" + mv "$tmpfile" "$out" + tmpfile="" fi - cmp -l "$in" "$out" ${bytes} | while read -r i a b; do + cmp -l "$in" "$out" | while read -r i a b; do local sum=$((0${a} + 0${b})) if [ $check_invert -eq 0 ] || [ $sum -ne $((0xff)) ]; then echo "[ FAIL ] $what does not match (in, out):"
Greg Kroah-Hartman
maintainerPATCH 225/225 ext4: enable the lazy init thread when remounting read/write
In reply to Greg Kroah-HartmanFrom: Theodore Ts'o <[email protected]>
commit eb1f822c76beeaa76ab8b6737ab9dc9f9798408c upstream.
In commit a44be64bbecb ("ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled") we defer clearing tyhe SB_RDONLY flag in struct super. However, we didn't defer when we checked sb_rdonly() to determine the lazy itable init thread should be enabled, with the next result that the lazy inode table initialization would not be properly started. This can cause generic/231 to fail in ext4's nojournal mode.
Fix this by moving when we decide to start or stop the lazy itable init thread to after we clear the SB_RDONLY flag when we are remounting the file system read/write.
Fixes a44be64bbecb ("ext4: don't clear SB_RDONLY when remounting r/w until...")
--- fs/ext4/super.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
fs/ext4/super.c +12 -12
@@ -6542,18 +6542,6 @@ static int __ext4_remount(struct fs_cont }/* -* Reinitialize lazy itable initialization thread based on -* current settings -*/ -if (sb_rdonly (sb) || !test_opt (sb,INIT_INODE_TABLE )) -ext4_unregister_li_request (sb); -else { -ext4_group_t first_not_zeroed; - first_not_zeroed =ext4_has_uninit_itable (sb); -ext4_register_li_request (sb, first_not_zeroed); - } - -/* * Handle creation of system zone data early because it can fail. * Releasing of existing data is done when we are sure remount will * succeed.
@@ -6590,6 +6578,18 @@ static int __ext4_remount(struct fs_contif (enable_rw) sb->s_flags &= ~SB_RDONLY ; +/* +* Reinitialize lazy itable initialization thread based on +* current settings +*/ +if (sb_rdonly (sb) || !test_opt (sb,INIT_INODE_TABLE )) +ext4_unregister_li_request (sb); +else { +ext4_group_t first_not_zeroed; + first_not_zeroed =ext4_has_uninit_itable (sb); +ext4_register_li_request (sb, first_not_zeroed); + } +if (!ext4_has_feature_mmp (sb) ||sb_rdonly (sb))ext4_stop_mmpd (sbi);
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.33 release. There are 225 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 09 Jun 2023 20:07:31 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.33-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.33 release. There are 225 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 09 Jun 2023 20:07:31 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.33-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tseted on BMIPS_GENERIC:
Signature · 1 line
Florian
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.33 release. There are 225 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 09 Jun 2023 20:07:31 +0000. Anything received after that time might be too late.
Hi Greg
6.1.33-rc1
compiles, boots and runs here on x86_64
(AMD Ryzen 5 PRO 4650G, Slackware64-15.0)
Hello Greg,
Quoted 10 lines
From: Greg Kroah-Hartman <[email protected]>
Sent: Wednesday, June 7, 2023 9:13 PMThis is the start of the stable review cycle for the 6.1.33 release. There are 225 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 09 Jun 2023 20:07:31 +0000. Anything received after that time might be too late.
CIP configurations built and booted okay with Linux 6.1.33-rc1 (8f4f686e321c):
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/893074084
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/commits/linux-6.1.y
Kind regards, Chris
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.33 release. There are 225 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
LGTM chief,
Thanks,
Conor.
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.33 release. There are 225 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 09 Jun 2023 20:07:31 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.33-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 6.1.33-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git branch: linux-6.1.y
* git commit: 8f4f686e321cfb99dd17774b45f93d96a16c2073
* git describe: v6.1.31-266-g8f4f686e321c
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.1.y/build/v6.1.31-266-g8f4f686e321c
## Test Regressions (compared to v6.1.31)
## Metric Regressions (compared to v6.1.31)
## Test Fixes (compared to v6.1.31)
## Metric Fixes (compared to v6.1.31)
## Test result summary
total: 111194, pass: 97858, fail: 1305, skip: 11824, xfail: 207
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 142 total, 141 passed, 1 failed
* arm64: 49 total, 49 passed, 0 failed
* i386: 37 total, 36 passed, 1 failed
* mips: 25 total, 25 passed, 0 failed
* parisc: 3 total, 3 passed, 0 failed
* powerpc: 34 total, 34 passed, 0 failed
* riscv: 12 total, 12 passed, 0 failed
* s390: 12 total, 12 passed, 0 failed
* sh: 12 total, 12 passed, 0 failed
* sparc: 6 total, 6 passed, 0 failed
* x86_64: 42 total, 42 passed, 0 failed
## Test suites summary
* boot
* kselftest-android
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-drivers-dma-buf
* kselftest-efivarfs
* kselftest-exec
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-firmware
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-kcmp
* kselftest-lib
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-tc-testing
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user_events
* kselftest-vDSO
* kselftest-watchdog
* kselftest-x86
* kunit
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-test
* ltp-cap_bounds
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-crypto
* ltp-cve
* ltp-fcntl-locktests
* ltp-filecaps
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-fsx
* ltp-hugetlb
* ltp-io
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-securebits
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* perf
* rcutorture
* v4l2-compliance
--
Linaro LKFT
https://lkft.linaro.org
Hi Greg
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.33 release. There are 225 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 09 Jun 2023 20:07:31 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.33-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
6.1.33-rc1 tested.
Build successfully completed.
Boot successfully completed.
No dmesg regressions.
Video output normal.
Sound output normal.
Lenovo ThinkPad X1 Carbon Gen10(Intel i7-1260P(x86_64), arch linux)
Thanks
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.33 release. There are 225 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Successfully compiled and installed bindeb-pkgs on my computer (Acer Aspire E15, Intel Core i3 Haswell). No noticeable regressions.
Signature · 1 line
An old man doll... just what I always wanted! - Clara
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.33 release. There are 225 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 09 Jun 2023 20:07:31 +0000. Anything received after that time might be too late.
Failed builds:
loongarch:defconfig
loongarch:allnoconfig
loongarch:tinyconfig
loongarch:allmodconfig
arch/loongarch/kernel/traps.c: In function 'trap_init':arch/loongarch/kernel/traps.c:815:21: error: 'EXCCODE_BCE' undeclared
EXCCODE_BCE is indeed undeclared in v6.1.y.
Commit 'LoongArch: Relay BCE exceptions to userland as SIGSEGV with si_code=SEGV_BNDERR' is not marked Fixes: or stable: and should arguably not have been backported.
The same problem affects 6.3.
Guenter
Greg Kroah-Hartman
maintainerQuoted 19 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.33 release. There are 225 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 09 Jun 2023 20:07:31 +0000. Anything received after that time might be too late.
Failed builds:
loongarch:defconfig
loongarch:allnoconfig
loongarch:tinyconfig
loongarch:allmodconfig
arch/loongarch/kernel/traps.c: In function 'trap_init':arch/loongarch/kernel/traps.c:815:21: error: 'EXCCODE_BCE' undeclared
Quoted 6 lines
EXCCODE_BCEis indeed undeclared in v6.1.y.Commit 'LoongArch: Relay BCE exceptions to userland as SIGSEGV with si_code=SEGV_BNDERR' is not marked Fixes: or stable: and should arguably not have been backported.
The same problem affects 6.3.
Thanks, I'll go drop this from both trees and push out -rc2 releases.
greg k-h