6.3.8-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 6.3.8-rc1 review
This is the start of the stable review cycle for the 6.3.8 release. There are 160 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 14 Jun 2023 10:16:41 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.3.8-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.3.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.3.8-rc1
Greg Kroah-Hartman <[email protected]>
Revert "staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE"
Ping-Ke Shih <[email protected]>
wifi: rtw88: correct PS calculation for SUPPORTS_DYNAMIC_PS
Ping-Ke Shih <[email protected]>
wifi: rtw89: correct PS calculation for SUPPORTS_DYNAMIC_PS
Theodore Ts'o <[email protected]>
ext4: only check dquot_initialize_needed() when debugging
Theodore Ts'o <[email protected]>
Revert "ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled"
Ruihan Li <[email protected]>
Bluetooth: Fix UAF in hci_conn_hash_flush again
Ruihan Li <[email protected]>
Bluetooth: Refcnt drop must be placed last in hci_conn_unlink
Ruihan Li <[email protected]>
Bluetooth: Fix potential double free caused by hci_conn_unlink
Namjae Jeon <[email protected]>
ksmbd: check the validation of pdu_size in ksmbd_conn_handler_loop
Namjae Jeon <[email protected]>
ksmbd: fix posix_acls and acls dereferencing possible ERR_PTR()
Namjae Jeon <[email protected]>
ksmbd: fix out-of-bound read in parse_lease_state()
Namjae Jeon <[email protected]>
ksmbd: fix out-of-bound read in deassemble_neg_contexts()
Shannon Nelson <[email protected]>
vhost_vdpa: support PACKED when setting-getting vring_base
Shannon Nelson <[email protected]>
vhost: support PACKED when setting-getting vring_base
Dragos Tatulea <[email protected]>
vdpa/mlx5: Fix hang when cvq commands are triggered during device unregister
Sheng Zhao <[email protected]>
vduse: avoid empty string for dev name
Ruan Jinjie <[email protected]>
riscv: fix kprobe __user string arg print fault issue
Charles Keepax <[email protected]>
soundwire: stream: Add missing clear of alloc_slave_rt
Randy Dunlap <[email protected]>
eeprom: at24: also select REGMAP
Hsieh-Tseng Shen <[email protected]>
riscv: mm: Ensure prot of VM_WRITE and VM_EXEC must be readable
Uwe Kleine-König <[email protected]>
i2c: sprd: Delete i2c adapter in .remove's error path
Kent Gibson <[email protected]>
gpio: sim: fix memory corruption when adding named lines and unnamed hogs
Balint Dobszay <[email protected]>
firmware: arm_ffa: Set handle field to zero in memory descriptor
Marek Behún <[email protected]>
i2c: mv64xxx: Fix reading invalid status value in atomic mode
Adam Ford <[email protected]>
arm64: dts: imx8mn-beacon: Fix SPI CS pinmux
Tian Lan <[email protected]>
blk-mq: fix blk_mq_hw_ctx active request accounting
Robert Hancock <[email protected]>
ASoC: simple-card-utils: fix PCM constraint error check
Trevor Wu <[email protected]>
ASoC: mediatek: mt8195: fix use-after-free in driver remove path
Uwe Kleine-König <[email protected]>
ASoC: mediatek: mt8195-afe-pcm: Convert to platform remove callback returning void
Trevor Wu <[email protected]>
ASoC: mediatek: mt8188: fix use-after-free in driver remove path
Vijendar Mukunda <[email protected]>
ASoC: amd: ps: fix for acp_lock access in pdm driver
Shenwei Wang <[email protected]>
arm64: dts: imx8-ss-dma: assign default clock rate for lpuarts
Shenwei Wang <[email protected]>
arm64: dts: imx8qm-mek: correct GPIOs for USDHC2 CD and WP signals
Douglas Anderson <[email protected]>
arm64: dts: qcom: sc7180-lite: Fix SDRAM freq for misidentified sc7180-lite boards
Dan Carpenter <[email protected]>
soc: qcom: rmtfs: Fix error code in probe()
Christophe JAILLET <[email protected]>
soc: qcom: ramp_controller: Fix an error handling path in qcom_ramp_controller_probe()
Srinivas Kandagatla <[email protected]>
ASoC: codecs: wsa881x: do not set can_multi_write flag
Srinivas Kandagatla <[email protected]>
ASoC: codecs: wsa883x: do not set can_multi_write flag
Claudiu Beznea <[email protected]>
ARM: dts: at91: sama7g5ek: fix debounce delay property for shdwc
Claudiu Beznea <[email protected]>
ARM: at91: pm: fix imbalanced reference counter for ethernet devices
Konrad Dybcio <[email protected]>
arm64: dts: qcom: sm6375-pdx225: Fix remoteproc firmware paths
Bjorn Andersson <[email protected]>
arm64: dts: qcom: sc8280xp: Flush RSC sleep & wake votes
Krzysztof Kozlowski <[email protected]>
soc: qcom: rpmh-rsc: drop redundant unsigned >=0 comparision
Ruihan Li <[email protected]>
mm: page_table_check: Ensure user pages are not slab pages
Ruihan Li <[email protected]>
mm: page_table_check: Make it dependent on EXCLUSIVE_SYSTEM_RAM
Ruihan Li <[email protected]>
usb: usbfs: Use consistent mmap functions
Ruihan Li <[email protected]>
usb: usbfs: Enforce page requirements for mmap
Martin Hundebøll <[email protected]>
pinctrl: meson-axg: add missing GPIOA_18 gpio group
Krzysztof Kozlowski <[email protected]>
soc: qcom: icc-bwmon: fix incorrect error code passed to dev_err_probe()
Brett Creeley <[email protected]>
virtio_net: use control_buf for coalesce params
Ilya Dryomov <[email protected]>
rbd: get snapshot context after exclusive lock is ensured to be held
Ilya Dryomov <[email protected]>
rbd: move RBD_OBJ_FLAG_COPYUP_ENABLED flag setting
Rijo Thomas <[email protected]>
tee: amdtee: Add return_origin to 'struct tee_cmd_load_ta'
Johan Hovold <[email protected]>
Bluetooth: hci_qca: fix debugfs registration
Johan Hovold <[email protected]>
Bluetooth: fix debugfs registration
Luiz Augusto von Dentz <[email protected]>
Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk
Jan Höppner <[email protected]>
s390/dasd: Use correct lock while counting channel queue length
Andrzej Kacprowski <[email protected]>
accel/ivpu: Fix sporadic VPU boot failure
Andrzej Kacprowski <[email protected]>
accel/ivpu: Do not trigger extra VPU reset if the VPU is idle
Xiubo Li <[email protected]>
ceph: fix use-after-free bug for inodes when flushing capsnaps
Geliang Tang <[email protected]>
selftests: mptcp: update userspace pm subflow tests
Geliang Tang <[email protected]>
selftests: mptcp: update userspace pm addr tests
Geliang Tang <[email protected]>
mptcp: update userspace pm infos
Geliang Tang <[email protected]>
mptcp: add address into userspace pm list
Geliang Tang <[email protected]>
mptcp: only send RM_ADDR in nl_cmd_remove
Fedor Pchelkin <[email protected]>
can: j1939: avoid possible use-after-free when j1939_can_rx_register fails
Fedor Pchelkin <[email protected]>
can: j1939: change j1939_netdev_lock type to mutex
Oleksij Rempel <[email protected]>
can: j1939: j1939_sk_send_loop_abort(): improved error queue handling in J1939 Socket
Gustavo A. R. Silva <[email protected]>
wifi: iwlwifi: mvm: Fix -Warray-bounds bug in iwl_mvm_wait_d3_notif()
Samson Tam <[email protected]>
drm/amd/display: add ODM case when looking for first split pipe
Alvin Lee <[email protected]>
drm/amd/display: Reduce sdp bw after urgent to 90%
Lijo Lazar <[email protected]>
drm/amd/pm: Fix power context allocation in SMU13
Mario Limonciello <[email protected]>
drm/amd: Disallow s0ix without BIOS support again
YiPeng Chai <[email protected]>
drm/amdgpu: change reserved vram info print
Chia-I Wu <[email protected]>
drm/amdgpu: fix xclk freq on CHIP_STONEY
Evan Quan <[email protected]>
drm/amd/pm: conditionally disable pcie lane switching for some sienna_cichlid SKUs
Andi Shyti <[email protected]>
drm/i915/gt: Use the correct error value when kernel_context() fails
Stefan Binding <[email protected]>
ALSA: hda/realtek: Add quirks for Asus ROG 2024 laptops using CS35L41
RenHai <[email protected]>
ALSA: hda/realtek: Add Lenovo P3 Tower platform
Ai Chao <[email protected]>
ALSA: hda/realtek: Add a quirk for HP Slim Desktop S01
Jaroslav Kysela <[email protected]>
ALSA: ice1712,ice1724: fix the kcontrol->id initialization
Tim Crawford <[email protected]>
ALSA: hda/realtek: Add quirk for Clevo NS50AU
Takashi Iwai <[email protected]>
ALSA: cmipci: Fix kctl->id initialization
Takashi Iwai <[email protected]>
ALSA: gus: Fix kctl->id initialization
Takashi Iwai <[email protected]>
ALSA: ymfpci: Fix kctl->id initialization
Takashi Iwai <[email protected]>
ALSA: hda: Fix kctl->id initialization
Dmitry Torokhov <[email protected]>
Input: fix open count when closing inhibited device
Dmitry Torokhov <[email protected]>
Input: psmouse - fix OOB access in Elantech protocol
Maximilian Weigand <[email protected]>
Input: cyttsp5 - fix array length
Ismael Ferreras Morezuelas <[email protected]>
Input: xpad - delete a Razer DeathAdder mouse VID/PID entry
Vladislav Efanov <[email protected]>
batman-adv: Broken sync while rescheduling delayed work
Dmitry Baryshkov <[email protected]>
drm/msm/a6xx: initialize GMU mutex earlier
Somnath Kotur <[email protected]>
bnxt_en: Implement .set_port / .unset_port UDP tunnel callbacks
Pavan Chebbi <[email protected]>
bnxt_en: Prevent kernel panic when receiving unexpected PHC_UPDATE event
Vikas Gupta <[email protected]>
bnxt_en: Skip firmware fatal error recovery if chip is not accessible
Somnath Kotur <[email protected]>
bnxt_en: Query default VLAN before VNIC setup on a VF
Sreekanth Reddy <[email protected]>
bnxt_en: Don't issue AP reset during ethtool's reset operation
Pavan Chebbi <[email protected]>
bnxt_en: Fix bnxt_hwrm_update_rss_hash_cfg()
Stanislaw Gruszka <[email protected]>
accel/ivpu: Do not use mutex_lock_interruptible
Florian Fainelli <[email protected]>
net: bcmgenet: Fix EEE implementation
Ben Hutchings <[email protected]>
lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release()
Horatio Zhang <[email protected]>
drm/amdgpu: fix Null pointer dereference error in amdgpu_device_recover_vram
Jiri Olsa <[email protected]>
bpf: Add extra path pointer check to d_path helper
Hangyu Hua <[email protected]>
net: sched: fix possible refcount leak in tc_chain_tmplt_add()
Eric Dumazet <[email protected]>
net: sched: act_police: fix sparse errors in tcf_police_dump()
Eelco Chaudron <[email protected]>
net: openvswitch: fix upcall counter access before allocation
Eric Dumazet <[email protected]>
net: sched: move rtm_tca_policy declaration to include file
Michal Schmidt <[email protected]>
ice: make writes to /dev/gnssX synchronous
Tvrtko Ursulin <[email protected]>
drm/i915/selftests: Add some missing error propagation
Eric Dumazet <[email protected]>
net: sched: add rcu annotations around qdisc->qdisc_sleeping
Eric Dumazet <[email protected]>
rfs: annotate lockless accesses to RFS sock flow table
Eric Dumazet <[email protected]>
rfs: annotate lockless accesses to sk->sk_rxhash
Eric Dumazet <[email protected]>
tcp: gso: really support BIG TCP
Kuniyuki Iwashima <[email protected]>
ipv6: rpl: Fix Route of Death.
Erico Nunes <[email protected]>
drm/lima: fix sched context destroy
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: out-of-bound check in chain blob
Kuniyuki Iwashima <[email protected]>
netfilter: ipset: Add schedule point in call_ad().
Tijs Van Buggenhout <[email protected]>
netfilter: conntrack: fix NULL pointer dereference in nf_confirm_cthelper
Jeremy Sowden <[email protected]>
netfilter: nft_bitwise: fix register tracking
Gavrilov Ilia <[email protected]>
netfilter: nf_tables: Add null check for nla_nest_start_noflag() in nft_dump_basechain_hook()
Yonghong Song <[email protected]>
selftests/bpf: Fix sockopt_sk selftest
Stanislav Fomichev <[email protected]>
selftests/bpf: Verify optval=NULL case
Johannes Berg <[email protected]>
wifi: cfg80211: fix locking in regulatory disconnect
Johannes Berg <[email protected]>
wifi: cfg80211: fix locking in sched scan stop work
Stanislaw Gruszka <[email protected]>
accel/ivpu: Reserve all non-command bo's using DMA_RESV_USAGE_BOOKKEEP
Randy Dunlap <[email protected]>
accel/ivpu: ivpu_ipc needs GENERIC_ALLOCATOR
Manish Chopra <[email protected]>
qed/qede: Fix scheduling while atomic
Johannes Berg <[email protected]>
wifi: mac80211: don't translate beacon/presp addrs
Johannes Berg <[email protected]>
wifi: mac80211: mlme: fix non-inheritence element
Johannes Berg <[email protected]>
wifi: cfg80211: reject bad AP MLD address
Johannes Berg <[email protected]>
wifi: mac80211: use correct iftype HE cap
Sungwoo Kim <[email protected]>
Bluetooth: L2CAP: Add missing checks for invalid DCID
Pauli Virtanen <[email protected]>
Bluetooth: ISO: use correct CIS order in Set CIG Parameters event
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_conn: Fix not matching by CIS ID
Luiz Augusto von Dentz <[email protected]>
Bluetooth: hci_conn: Add support for linking multiple hcon
Pauli Virtanen <[email protected]>
Bluetooth: ISO: don't try to remove CIG if there are bound CIS left
Ying Hsu <[email protected]>
Bluetooth: Fix l2cap_disconnect_req deadlock
Zhengping Jiang <[email protected]>
Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER
Pauli Virtanen <[email protected]>
Bluetooth: ISO: Fix CIG auto-allocation to select configurable CIG
Pauli Virtanen <[email protected]>
Bluetooth: ISO: consider right CIS when removing CIG at cleanup
Iulia Tanasescu <[email protected]>
Bluetooth: Split bt_iso_qos into dedicated structures
Jouni Högander <[email protected]>
drm/i915: Use 18 fast wake AUX sync len
Ville Syrjälä <[email protected]>
drm/i915: Explain the magic numbers for AUX SYNC/precharge length
Eric Dumazet <[email protected]>
net/sched: fq_pie: ensure reasonable TCA_FQ_PIE_QUANTUM values
Wei Fang <[email protected]>
net: enetc: correct rx_bytes statistics of XDP
Wei Fang <[email protected]>
net: enetc: correct the statistics of rx bytes
Wen Gu <[email protected]>
net/smc: Avoid to access invalid RMBs' MRs in SMCRv1 ADD LINK CONT
Eric Dumazet <[email protected]>
net/ipv6: fix bool/int mismatch for skip_notify_on_dev_down
Rhys Rustad-Elliott <[email protected]>
bpf: Fix elem_size not being set for inner maps
KP Singh <[email protected]>
bpf: Fix UAF in task local storage
Akihiro Suda <[email protected]>
net/ipv4: ping_group_range: allow GID from 2147483648 to 4294967294
Alexander Sverdlin <[email protected]>
net: dsa: lan9303: allow vid != 0 in port_fdb_{add|del} methodsQingfang DENG <[email protected]>
neighbour: fix unaligned access to pneigh_entry
Eric Dumazet <[email protected]>
bpf, sockmap: Avoid potential NULL dereference in sk_psock_verdict_data_ready()
Lorenzo Bianconi <[email protected]>
wifi: mt76: mt7615: fix possible race in mt7615_mac_sta_poll
David Howells <[email protected]>
afs: Fix setting of mtime when creating a file/dir/symlink
Stephan Gerhold <[email protected]>
spi: qup: Request DMA before enabling clocks
Maximilian Luz <[email protected]>
platform/surface: aggregator_tabletsw: Add support for book mode in KIP subsystem
Maximilian Luz <[email protected]>
platform/surface: aggregator: Allow completion work-items to be executed in parallel
Daniel Golle <[email protected]>
spi: mt65xx: make sure operations completed before unloading
-------------
Diffstat:
Documentation/mm/page_table_check.rst | 19 ++ Documentation/networking/ip-sysctl.rst | 4 +- Makefile | 4 +- arch/arm/boot/dts/at91-sama7g5ek.dts | 2 +- arch/arm/mach-at91/pm.c | 20 +- arch/arm64/boot/dts/freescale/imx8-ss-dma.dtsi | 8 + .../dts/freescale/imx8mn-beacon-baseboard.dtsi | 4 +- arch/arm64/boot/dts/freescale/imx8qm-mek.dts | 4 +- arch/arm64/boot/dts/qcom/sc7180-lite.dtsi | 8 + arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 1 + .../dts/qcom/sm6375-sony-xperia-murray-pdx225.dts | 4 +- arch/riscv/Kconfig | 1 + arch/riscv/include/asm/pgtable.h | 3 +- arch/riscv/mm/init.c | 2 +- block/blk-mq.c | 8 +- drivers/accel/ivpu/Kconfig | 1 + drivers/accel/ivpu/ivpu_hw_mtl.c | 22 +- drivers/accel/ivpu/ivpu_hw_mtl_reg.h | 1 + drivers/accel/ivpu/ivpu_ipc.c | 4 +- drivers/accel/ivpu/ivpu_job.c | 21 +- drivers/accel/ivpu/ivpu_mmu.c | 22 +- drivers/block/rbd.c | 62 +++- drivers/bluetooth/hci_qca.c | 6 +- drivers/firmware/arm_ffa/driver.c | 1 + drivers/gpio/gpio-sim.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c | 1 - drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 7 +- drivers/gpu/drm/amd/amdgpu/vi.c | 11 +- drivers/gpu/drm/amd/display/dc/core/dc.c | 36 +- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 20 ++ .../gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 2 +- .../drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 92 ++++- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 4 +- drivers/gpu/drm/i915/display/intel_dp_aux.c | 32 +- .../gpu/drm/i915/gem/selftests/i915_gem_context.c | 14 +- drivers/gpu/drm/i915/gt/selftest_execlists.c | 12 +- drivers/gpu/drm/lima/lima_sched.c | 2 +- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 2 - drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 2 + drivers/i2c/busses/i2c-mv64xxx.c | 11 + drivers/i2c/busses/i2c-sprd.c | 8 +- drivers/input/input.c | 2 +- drivers/input/joystick/xpad.c | 1 - drivers/input/mouse/elantech.c | 9 +- drivers/input/touchscreen/cyttsp5.c | 2 +- drivers/misc/eeprom/Kconfig | 1 + drivers/net/dsa/lan9303-core.c | 4 - drivers/net/ethernet/broadcom/bnxt/bnxt.c | 40 ++- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 1 + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 22 +- drivers/net/ethernet/broadcom/genet/bcmgenet.h | 3 + drivers/net/ethernet/broadcom/genet/bcmmii.c | 5 + drivers/net/ethernet/freescale/enetc/enetc.c | 16 +- drivers/net/ethernet/intel/ice/ice_common.c | 2 +- drivers/net/ethernet/intel/ice/ice_common.h | 2 +- drivers/net/ethernet/intel/ice/ice_gnss.c | 64 +--- drivers/net/ethernet/intel/ice/ice_gnss.h | 10 - drivers/net/ethernet/qlogic/qed/qed_l2.c | 2 +- drivers/net/ethernet/qlogic/qede/qede.h | 4 + drivers/net/ethernet/qlogic/qede/qede_ethtool.c | 24 +- drivers/net/ethernet/qlogic/qede/qede_main.c | 34 +- drivers/net/virtio_net.c | 16 +- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 8 +- drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 3 + drivers/net/wireless/realtek/rtw88/mac80211.c | 14 +- drivers/net/wireless/realtek/rtw88/main.c | 4 +- drivers/net/wireless/realtek/rtw88/ps.c | 43 +++ drivers/net/wireless/realtek/rtw88/ps.h | 2 + drivers/net/wireless/realtek/rtw89/mac80211.c | 16 +- drivers/net/wireless/realtek/rtw89/ps.c | 26 ++ drivers/net/wireless/realtek/rtw89/ps.h | 1 + drivers/pinctrl/meson/pinctrl-meson-axg.c | 1 + drivers/platform/surface/aggregator/controller.c | 2 +- .../platform/surface/surface_aggregator_tabletsw.c | 5 + drivers/s390/block/dasd_ioctl.c | 4 +- drivers/soc/qcom/icc-bwmon.c | 4 +- drivers/soc/qcom/ramp_controller.c | 2 +- drivers/soc/qcom/rmtfs_mem.c | 1 + drivers/soc/qcom/rpmh-rsc.c | 2 +- drivers/soundwire/stream.c | 4 +- drivers/spi/spi-mt65xx.c | 3 + drivers/spi/spi-qup.c | 37 +- drivers/staging/rtl8192e/rtl8192e/rtl_core.c | 6 +- drivers/staging/rtl8192e/rtl8192e/rtl_core.h | 5 + drivers/tee/amdtee/amdtee_if.h | 10 +- drivers/tee/amdtee/call.c | 28 +- drivers/usb/core/buffer.c | 41 +++ drivers/usb/core/devio.c | 20 +- drivers/vdpa/mlx5/net/mlx5_vnet.c | 2 +- drivers/vdpa/vdpa_user/vduse_dev.c | 3 + drivers/vhost/vdpa.c | 21 +- drivers/vhost/vhost.c | 18 +- drivers/vhost/vhost.h | 8 +- fs/afs/dir.c | 3 + fs/ceph/caps.c | 6 + fs/ceph/snap.c | 4 +- fs/ext4/super.c | 6 +- fs/ext4/xattr.c | 6 +- fs/ksmbd/connection.c | 12 + fs/ksmbd/oplock.c | 66 ++-- fs/ksmbd/smb2pdu.c | 13 +- fs/ksmbd/smbacl.c | 4 +- fs/ksmbd/vfs.c | 4 +- include/linux/netdevice.h | 9 +- include/linux/page-flags.h | 6 + include/linux/usb/hcd.h | 5 + include/net/bluetooth/bluetooth.h | 43 ++- include/net/bluetooth/hci.h | 1 + include/net/bluetooth/hci_core.h | 41 ++- include/net/neighbour.h | 2 +- include/net/netns/ipv6.h | 2 +- include/net/ping.h | 6 +- include/net/pkt_sched.h | 2 + include/net/rpl.h | 3 - include/net/sch_generic.h | 6 +- include/net/sock.h | 18 +- kernel/bpf/map_in_map.c | 8 +- kernel/fork.c | 2 +- kernel/trace/bpf_trace.c | 12 +- lib/cpu_rmap.c | 2 +- mm/Kconfig.debug | 1 + mm/page_table_check.c | 6 + net/batman-adv/distributed-arp-table.c | 2 +- net/bluetooth/hci_conn.c | 378 +++++++++++++-------- net/bluetooth/hci_core.c | 10 +- net/bluetooth/hci_event.c | 165 +++++---- net/bluetooth/hci_sync.c | 23 +- net/bluetooth/iso.c | 133 ++++++-- net/bluetooth/l2cap_core.c | 13 + net/can/j1939/main.c | 24 +- net/can/j1939/socket.c | 5 + net/core/dev.c | 8 +- net/core/skmsg.c | 3 +- net/ipv4/sysctl_net_ipv4.c | 8 +- net/ipv4/tcp_offload.c | 19 +- net/ipv6/exthdrs.c | 29 +- net/mac80211/he.c | 15 +- net/mac80211/mlme.c | 8 +- net/mac80211/rx.c | 4 +- net/mptcp/pm.c | 23 +- net/mptcp/pm_netlink.c | 18 + net/mptcp/pm_userspace.c | 48 ++- net/mptcp/protocol.h | 1 + net/netfilter/ipset/ip_set_core.c | 8 + net/netfilter/nf_conntrack_core.c | 3 + net/netfilter/nf_tables_api.c | 4 +- net/netfilter/nft_bitwise.c | 2 +- net/openvswitch/datapath.c | 19 -- net/openvswitch/vport.c | 18 +- net/sched/act_police.c | 10 +- net/sched/cls_api.c | 3 +- net/sched/sch_api.c | 26 +- net/sched/sch_fq_pie.c | 10 +- net/sched/sch_generic.c | 30 +- net/sched/sch_mq.c | 8 +- net/sched/sch_mqprio.c | 8 +- net/sched/sch_pie.c | 5 +- net/sched/sch_red.c | 5 +- net/sched/sch_sfq.c | 5 +- net/sched/sch_taprio.c | 6 +- net/sched/sch_teql.c | 2 +- net/smc/smc_llc.c | 4 +- net/wireless/core.c | 4 +- net/wireless/nl80211.c | 2 + net/wireless/reg.c | 4 +- sound/isa/gus/gus_pcm.c | 2 +- sound/pci/cmipci.c | 6 +- sound/pci/hda/hda_codec.c | 6 +- sound/pci/hda/patch_realtek.c | 9 + sound/pci/ice1712/aureon.c | 7 +- sound/pci/ice1712/ice1712.c | 14 +- sound/pci/ice1712/ice1724.c | 16 +- sound/pci/ymfpci/ymfpci_main.c | 6 +- sound/soc/amd/ps/pci-ps.c | 3 +- sound/soc/amd/ps/ps-pdm-dma.c | 10 +- sound/soc/codecs/wsa881x.c | 1 - sound/soc/codecs/wsa883x.c | 1 - sound/soc/generic/simple-card-utils.c | 2 +- sound/soc/mediatek/mt8188/mt8188-afe-clk.c | 7 - sound/soc/mediatek/mt8188/mt8188-afe-clk.h | 1 - sound/soc/mediatek/mt8188/mt8188-afe-pcm.c | 4 - sound/soc/mediatek/mt8188/mt8188-audsys-clk.c | 47 +-- sound/soc/mediatek/mt8188/mt8188-audsys-clk.h | 1 - sound/soc/mediatek/mt8195/mt8195-afe-clk.c | 5 - sound/soc/mediatek/mt8195/mt8195-afe-clk.h | 1 - sound/soc/mediatek/mt8195/mt8195-afe-pcm.c | 9 +- sound/soc/mediatek/mt8195/mt8195-audsys-clk.c | 47 +-- sound/soc/mediatek/mt8195/mt8195-audsys-clk.h | 1 - .../testing/selftests/bpf/prog_tests/sockopt_sk.c | 28 ++ tools/testing/selftests/bpf/progs/sockopt_sk.c | 12 + tools/testing/selftests/net/mptcp/mptcp_join.sh | 11 +- 194 files changed, 1846 insertions(+), 955 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/160 spi: mt65xx: make sure operations completed before unloading
From: Daniel Golle <[email protected]>
[ Upstream commit 4be47a5d59cbc9396a6ffd327913eb4c8d67a32f ]
When unloading the spi-mt65xx kernel module during an ongoing spi-mem operation the kernel will Oops shortly after unloading the module. This is because wait_for_completion_timeout was still running and returning into the no longer loaded module:
Internal error: Oops: 0000000096000005 [#1] SMP Modules linked in: [many, but spi-mt65xx is no longer there] CPU: 0 PID: 2578 Comm: block Tainted: G W O 6.3.0-next-20230428+ #0 Hardware name: Bananapi BPI-R3 (DT) pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __lock_acquire+0x18c/0x20e8 lr : __lock_acquire+0x9b8/0x20e8
sp : ffffffc009ec3400
x29: ffffffc009ec3400 x28: 0000000000000001 x27: 0000000000000004
x26: ffffff80082888c8 x25: 0000000000000000 x24: 0000000000000000
x23: ffffffc009609da8 x22: ffffff8008288000 x21: ffffff8008288968
x20: 00000000000003c2 x19: ffffff8008be7990 x18: 00000000000002af
x17: 0000000000000000 x16: 0000000000000000 x15: ffffffc008d78970
x14: 000000000000080d x13: 00000000000002af x12: 00000000ffffffea
x11: 00000000ffffefff x10: ffffffc008dd0970 x9 : ffffffc008d78918 x8 : 0000000000017fe8 x7 : 0000000000000001 x6 : 0000000000000000 x5 : ffffff807fb53910 x4 : 0000000000000000 x3 : 0000000000000027 x2 : 0000000000000027 x1 : 0000000000000000 x0 : 00000000000c03c2
Call trace: __lock_acquire+0x18c/0x20e8 lock_acquire+0x100/0x2a4 _raw_spin_lock_irq+0x58/0x74 __wait_for_common+0xe0/0x1b4 wait_for_completion_timeout+0x1c/0x24 0xffffffc000acc8a4 <--- used to be mtk_spi_transfer_wait spi_mem_exec_op+0x390/0x3ec spi_mem_no_dirmap_read+0x6c/0x88 spi_mem_dirmap_read+0xcc/0x12c spinand_read_page+0xf8/0x1dc spinand_mtd_read+0x1b4/0x2fc mtd_read_oob_std+0x58/0x7c mtd_read_oob+0x8c/0x148 mtd_read+0x50/0x6c ...
Prevent this by completing in mtk_spi_remove if needed.
--- drivers/spi/spi-mt65xx.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/spi/spi-mt65xx.c +3 -0
@@ -1275,6 +1275,9 @@ static int mtk_spi_remove(struct platform_device *pdev)struct mtk_spi *mdata =spi_master_get_devdata (master);int ret; +if (mdata->use_spimem && !completion_done (&mdata->spimem_done)) +complete (&mdata->spimem_done); + ret =pm_runtime_resume_and_get (&pdev->dev);if (ret <0 )return ret;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 2/160 platform/surface: aggregator: Allow completion work-items to be executed in parallel
In reply to Greg Kroah-HartmanFrom: Maximilian Luz <[email protected]>
[ Upstream commit 539e0a7f9105d19c00629c3f4da00330488e8c60 ]
Currently, event completion work-items are restricted to be run strictly in non-parallel fashion by the respective workqueue. However, this has lead to some problems:
In some instances, the event notifier function called inside this completion workqueue takes a non-negligible amount of time to execute. One such example is the battery event handling code (surface_battery.c), which can result in a full battery information refresh, involving further synchronous communication with the EC inside the event handler. This is made worse if the communication fails spuriously, generally incurring a multi-second timeout.
Since the event completions are run strictly non-parallel, this blocks other events from being propagated to the respective subsystems. This becomes especially noticeable for keyboard and touchpad input, which also funnel their events through this system. Here, users have reported occasional multi-second "freezes".
Note, however, that the event handling system was never intended to run purely sequentially. Instead, we have one work struct per EC/SAM subsystem, processing the event queue for that subsystem. These work structs were intended to run in parallel, allowing sequential processing of work items for each subsystem but parallel processing of work items across subsystems.
The only restriction to this is the way the workqueue is created. Therefore, replace create_workqueue() with alloc_workqueue() and do not restrict the maximum number of parallel work items to be executed on that queue, resolving any cross-subsystem blockage.
--- drivers/platform/surface/aggregator/controller.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/surface/aggregator/controller.c +1 -1
@@ -825,7 +825,7 @@ static int ssam_cplt_init(struct ssam_cplt *cplt, struct device *dev) cplt->dev = dev; - cplt->wq =create_workqueue (SSAM_CPLT_WQ_NAME ); + cplt->wq =alloc_workqueue (SSAM_CPLT_WQ_NAME ,WQ_UNBOUND |WQ_MEM_RECLAIM ,0 );if (!cplt->wq)return -ENOMEM ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 3/160 platform/surface: aggregator_tabletsw: Add support for book mode in KIP subsystem
In reply to Greg Kroah-HartmanFrom: Maximilian Luz <[email protected]>
[ Upstream commit 9bed667033e66083d363a11e9414ad401ecc242c ]
Devices with a type-cover have an additional "book" mode, deactivating type-cover input and turning off its backlight. This is currently unsupported, leading to the warning
surface_aggregator_tablet_mode_switch 01:0e:01:00:01: unknown KIP cover state: 6
Therefore, add support for this state and map it to enable tablet-mode.
--- drivers/platform/surface/surface_aggregator_tabletsw.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/platform/surface/surface_aggregator_tabletsw.c +5 -0
@@ -201,6 +201,7 @@ enum ssam_kip_cover_state {SSAM_KIP_COVER_STATE_LAPTOP =0x03 ,SSAM_KIP_COVER_STATE_FOLDED_CANVAS =0x04 ,SSAM_KIP_COVER_STATE_FOLDED_BACK =0x05 , + SSAM_KIP_COVER_STATE_BOOK = 0x06, };static const char *ssam_kip_cover_state_name (struct ssam_tablet_sw *sw,u32 state)
@@ -221,6 +222,9 @@ static const char *ssam_kip_cover_state_name(struct ssam_tablet_sw *sw, u32 statcase SSAM_KIP_COVER_STATE_FOLDED_BACK :return "folded-back" ; +case SSAM_KIP_COVER_STATE_BOOK : +return "book" ; +default :dev_warn (&sw->sdev->dev,"unknown KIP cover state: %u\n" , state);return "<unknown>" ;
@@ -233,6 +237,7 @@ static bool ssam_kip_cover_state_is_tablet_mode(struct ssam_tablet_sw *sw, u32 scase SSAM_KIP_COVER_STATE_DISCONNECTED :case SSAM_KIP_COVER_STATE_FOLDED_CANVAS :case SSAM_KIP_COVER_STATE_FOLDED_BACK : +case SSAM_KIP_COVER_STATE_BOOK :return true;case SSAM_KIP_COVER_STATE_CLOSED :
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 4/160 spi: qup: Request DMA before enabling clocks
In reply to Greg Kroah-HartmanFrom: Stephan Gerhold <[email protected]>
[ Upstream commit 0c331fd1dccfba657129380ee084b95c1cedfbef ]
It is usually better to request all necessary resources (clocks, regulators, ...) before starting to make use of them. That way they do not change state in case one of the resources is not available yet and probe deferral (-EPROBE_DEFER) is necessary. This is particularly important for DMA channels and IOMMUs which are not enforced by fw_devlink yet (unless you use fw_devlink.strict=1).
spi-qup does this in the wrong order, the clocks are enabled and disabled again when the DMA channels are not available yet.
This causes issues in some cases: On most SoCs one of the SPI QUP clocks is shared with the UART controller. When using earlycon UART is actively used during boot but might not have probed yet, usually for the same reason (waiting for the DMA controller). In this case, the brief enable/disable cycle ends up gating the clock and further UART console output will halt the system completely.
Avoid this by requesting the DMA channels before changing the clock state.
--- drivers/spi/spi-qup.c | 37 ++++++++++++++++++------------------- 1 file changed, 18 insertions(+), 19 deletions(-)
drivers/spi/spi-qup.c +18 -19
@@ -1029,23 +1029,8 @@ static int spi_qup_probe(struct platform_device *pdev)return -ENXIO ; } - ret =clk_prepare_enable (cclk); -if (ret) { -dev_err (dev,"cannot enable core clock\n" ); -return ret; - } - - ret =clk_prepare_enable (iclk); -if (ret) { -clk_disable_unprepare (cclk); -dev_err (dev,"cannot enable iface clock\n" ); -return ret; - } - master =spi_alloc_master (dev,sizeof (struct spi_qup ));if (!master) { -clk_disable_unprepare (cclk); -clk_disable_unprepare (iclk);dev_err (dev,"cannot allocate master\n" );return -ENOMEM ; }
@@ -1093,6 +1078,19 @@ static int spi_qup_probe(struct platform_device *pdev)spin_lock_init (&controller->lock);init_completion (&controller->done); + ret =clk_prepare_enable (cclk); +if (ret) { +dev_err (dev,"cannot enable core clock\n" ); + goto error_dma; + } + + ret =clk_prepare_enable (iclk); +if (ret) { +clk_disable_unprepare (cclk); +dev_err (dev,"cannot enable iface clock\n" ); + goto error_dma; + } + iomode =readl_relaxed (base +QUP_IO_M_MODES ); size =QUP_IO_M_OUTPUT_BLOCK_SIZE (iomode);
@@ -1122,7 +1120,7 @@ static int spi_qup_probe(struct platform_device *pdev) ret =spi_qup_set_state (controller,QUP_STATE_RESET );if (ret) {dev_err (dev,"cannot set RESET state\n" ); - goto error_dma; + goto error_clk; }writel_relaxed (0 , base +QUP_OPERATIONAL );
@@ -1146,7 +1144,7 @@ static int spi_qup_probe(struct platform_device *pdev) ret =devm_request_irq (dev, irq, spi_qup_qup_irq,IRQF_TRIGGER_HIGH , pdev->name, controller);if (ret) - goto error_dma; + goto error_clk;pm_runtime_set_autosuspend_delay (dev,MSEC_PER_SEC );pm_runtime_use_autosuspend (dev);
@@ -1161,11 +1159,12 @@ static int spi_qup_probe(struct platform_device *pdev) disable_pm:pm_runtime_disable (&pdev->dev); +error_clk: +clk_disable_unprepare (cclk); +clk_disable_unprepare (iclk); error_dma:spi_qup_release_dma (master); error: -clk_disable_unprepare (cclk); -clk_disable_unprepare (iclk);spi_master_put (master);return ret; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 5/160 afs: Fix setting of mtime when creating a file/dir/symlink
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit a27648c742104a833a01c54becc24429898d85bf ]
kafs incorrectly passes a zero mtime (ie. 1st Jan 1970) to the server when creating a file, dir or symlink because the mtime recorded in the afs_operation struct gets passed to the server by the marshalling routines, but the afs_mkdir(), afs_create() and afs_symlink() functions don't set it.
This gets masked if a file or directory is subsequently modified.
Fix this by filling in op->mtime before calling the create op.
--- fs/afs/dir.c | 3 +++ 1 file changed, 3 insertions(+)
fs/afs/dir.c +3 -0
@@ -1358,6 +1358,7 @@ static int afs_mkdir(struct mnt_idmap *idmap, struct inode *dir, op->dentry = dentry; op->create.mode =S_IFDIR | mode; op->create.reason = afs_edit_dir_for_mkdir; + op->mtime =current_time (dir); op->ops = &afs_mkdir_operation;return afs_do_sync_operation (op); }
@@ -1661,6 +1662,7 @@ static int afs_create(struct mnt_idmap *idmap, struct inode *dir, op->dentry = dentry; op->create.mode =S_IFREG | mode; op->create.reason = afs_edit_dir_for_create; + op->mtime =current_time (dir); op->ops = &afs_create_operation;return afs_do_sync_operation (op);
@@ -1796,6 +1798,7 @@ static int afs_symlink(struct mnt_idmap *idmap, struct inode *dir, op->ops = &afs_symlink_operation; op->create.reason = afs_edit_dir_for_symlink; op->create.symlink = content; + op->mtime =current_time (dir);return afs_do_sync_operation (op); error:
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 6/160 wifi: mt76: mt7615: fix possible race in mt7615_mac_sta_poll
In reply to Greg Kroah-HartmanFrom: Lorenzo Bianconi <[email protected]>
[ Upstream commit 30bc32c7c1f975cc3c14e1c7dc437266311282cf ]
Grab sta_poll_lock spinlock in mt7615_mac_sta_poll routine in order to avoid possible races with mt7615_mac_add_txs() or mt7615_mac_fill_rx() removing msta pointer from sta_poll_list.
--- drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wireless/mediatek/mt76/mt7615/mac.c +3 -0
@@ -919,7 +919,10 @@ void mt7615_mac_sta_poll(struct mt7615_dev *dev) msta = list_first_entry(&sta_poll_list, struct mt7615_sta, poll_list); + +spin_lock_bh (&dev->sta_poll_lock);list_del_init (&msta->poll_list); +spin_unlock_bh (&dev->sta_poll_lock); addr =mt7615_mac_wtbl_addr (dev, msta->wcid.idx) +19 *4 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 7/160 bpf, sockmap: Avoid potential NULL dereference in sk_psock_verdict_data_ready()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit b320a45638296b63be8d9a901ca8bc43716b1ae1 ]
syzbot found sk_psock(sk) could return NULL when called from sk_psock_verdict_data_ready().
Just make sure to handle this case.
[1]
general protection fault, probably for non-canonical address 0xdffffc000000005c: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x00000000000002e0-0x00000000000002e7] CPU: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 6.4.0-rc3-syzkaller-00588-g4781e965e655 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/16/2023 RIP: 0010:sk_psock_verdict_data_ready+0x19f/0x3c0 net/core/skmsg.c:1213 Code: 4c 89 e6 e8 63 70 5e f9 4d 85 e4 75 75 e8 19 74 5e f9 48 8d bb e0 02 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 07 02 00 00 48 89 ef ff 93 e0 02 00 00 e8 29 fd RSP: 0018:ffffc90000147688 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000100 RDX: 000000000000005c RSI: ffffffff8825ceb7 RDI: 00000000000002e0 RBP: ffff888076518c40 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000008000 R15: ffff888076518c40 FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f901375bab0 CR3: 000000004bf26000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> tcp_data_ready+0x10a/0x520 net/ipv4/tcp_input.c:5006 tcp_data_queue+0x25d3/0x4c50 net/ipv4/tcp_input.c:5080 tcp_rcv_established+0x829/0x1f90 net/ipv4/tcp_input.c:6019 tcp_v4_do_rcv+0x65a/0x9c0 net/ipv4/tcp_ipv4.c:1726 tcp_v4_rcv+0x2cbf/0x3340 net/ipv4/tcp_ipv4.c:2148 ip_protocol_deliver_rcu+0x9f/0x480 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2ec/0x520 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:303 [inline] NF_HOOK include/linux/netfilter.h:297 [inline] ip_local_deliver+0x1ae/0x200 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:468 [inline] ip_rcv_finish+0x1cf/0x2f0 net/ipv4/ip_input.c:449 NF_HOOK include/linux/netfilter.h:303 [inline] NF_HOOK include/linux/netfilter.h:297 [inline] ip_rcv+0xae/0xd0 net/ipv4/ip_input.c:569 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5491 __netif_receive_skb+0x1f/0x1c0 net/core/dev.c:5605 process_backlog+0x101/0x670 net/core/dev.c:5933 __napi_poll+0xb7/0x6f0 net/core/dev.c:6499 napi_poll net/core/dev.c:6566 [inline] net_rx_action+0x8a9/0xcb0 net/core/dev.c:6699 __do_softirq+0x1d4/0x905 kernel/softirq.c:571 run_ksoftirqd kernel/softirq.c:939 [inline] run_ksoftirqd+0x31/0x60 kernel/softirq.c:931 smpboot_thread_fn+0x659/0x9e0 kernel/smpboot.c:164 kthread+0x344/0x440 kernel/kthread.c:379 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 </TASK>
--- net/core/skmsg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/core/skmsg.c +2 -1
@@ -1210,7 +1210,8 @@ static void sk_psock_verdict_data_ready(struct sock *sk)rcu_read_lock (); psock =sk_psock (sk); - psock->saved_data_ready (sk); +if (psock) + psock->saved_data_ready (sk);rcu_read_unlock (); } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 8/160 neighbour: fix unaligned access to pneigh_entry
In reply to Greg Kroah-HartmanFrom: Qingfang DENG <[email protected]>
[ Upstream commit ed779fe4c9b5a20b4ab4fd6f3e19807445bb78c7 ]
After the blamed commit, the member key is longer 4-byte aligned. On platforms that do not support unaligned access, e.g., MIPS32R2 with unaligned_action set to 1, this will trigger a crash when accessing an IPv6 pneigh_entry, as the key is cast to an in6_addr pointer.
Change the type of the key to u32 to make it aligned.
--- include/net/neighbour.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/neighbour.h +1 -1
@@ -180,7 +180,7 @@ struct pneigh_entry {netdevice_tracker dev_tracker;u32 flags;u8 protocol; -u8 key[]; +u32 key[]; };/*
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 9/160 net: dsa: lan9303: allow vid != 0 in port_fdb_{add|del} methods
In reply to Greg Kroah-HartmanFrom: Alexander Sverdlin <[email protected]>
[ Upstream commit 5a59a58ec25d44f853c26bdbfda47d73b3067435 ]
LAN9303 doesn't associate FDB (ALR) entries with VLANs, it has just one global Address Logic Resolution table [1].
Ignore VID in port_fdb_{add|del} methods, go on with the global table. This is the same semantics as hellcreek or RZ/N1 implement.
Visible symptoms:LAN9303_MDIO 5b050000.ethernet-1:00: port 2 failed to delete 00:xx:xx:xx:xx:cf vid 1 from fdb: -2 LAN9303_MDIO 5b050000.ethernet-1:00: port 2 failed to add 00:xx:xx:xx:xx:cf vid 1 to fdb: -95
[1] https://ww1.microchip.com/downloads/en/DeviceDoc/00002308A.pdf
--- drivers/net/dsa/lan9303-core.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/net/dsa/lan9303-core.c +0 -4
@@ -1188,8 +1188,6 @@ static int lan9303_port_fdb_add(struct dsa_switch *ds, int port,struct lan9303 *chip = ds->priv;dev_dbg (chip->dev,"%s(%d, %pM, %d)\n" , __func__, port, addr, vid); -if (vid) -return -EOPNOTSUPP ;return lan9303_alr_add_port (chip, addr, port, false); }
@@ -1201,8 +1199,6 @@ static int lan9303_port_fdb_del(struct dsa_switch *ds, int port,struct lan9303 *chip = ds->priv;dev_dbg (chip->dev,"%s(%d, %pM, %d)\n" , __func__, port, addr, vid); -if (vid) -return -EOPNOTSUPP ;lan9303_alr_del_port (chip, addr, port);return 0 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 10/160 net/ipv4: ping_group_range: allow GID from 2147483648 to 4294967294
In reply to Greg Kroah-HartmanFrom: Akihiro Suda <[email protected]>
[ Upstream commit e209fee4118fe9a449d4d805361eb2de6796be39 ]
With this commit, all the GIDs ("0 4294967294") can be written to the "net.ipv4.ping_group_range" sysctl.
Note that 4294967295 (0xffffffff) is an invalid GID (see gid_valid() in include/linux/uidgid.h), and an attempt to register this number will cause -EINVAL.
Prior to this commit, only up to GID 2147483647 could be covered. Documentation/networking/ip-sysctl.rst had "0 4294967295" as an example value, but this example was wrong and causing -EINVAL.
--- Documentation/networking/ip-sysctl.rst | 4 ++-- include/net/ping.h | 6 +----- net/ipv4/sysctl_net_ipv4.c | 8 ++++---- 3 files changed, 7 insertions(+), 11 deletions(-)
Documentation/networking/ip-sysctl.rst +2 -2
@@ -1352,8 +1352,8 @@ ping_group_range - 2 INTEGERS Restrict ICMP_PROTO datagram sockets to users in the group range. The default is "1 0", meaning, that nobody (not even root) may create ping sockets. Setting it to "100 100" would grant permissions - to the single group. "0 4294967295" would enable it for the world, "100 - 4294967295" would enable it for the users, but not daemons. + to the single group. "0 4294967294" would enable it for the world, "100 + 4294967294" would enable it for the users, but not daemons. tcp_early_demux - BOOLEAN Enable early demux for established TCP sockets.
include/net/ping.h +1 -5
@@ -16,11 +16,7 @@#define PING_HTABLE_SIZE 64#define PING_HTABLE_MASK (PING_HTABLE_SIZE-1) -/* -* gid_t is either uint or ushort. We want to pass it to -* proc_dointvec_minmax(), so it must not be larger than MAX_INT -*/ -#define GID_T_MAX (((gid_t)~0U) >> 1) +#define GID_T_MAX (((gid_t)~0U) - 1)/* Compatibility glue so we can support IPv6 when it's compiled as a module */ struct pingv6_ops {
net/ipv4/sysctl_net_ipv4.c +4 -4
@@ -34,8 +34,8 @@ static int ip_ttl_min = 1;static int ip_ttl_max =255 ;static int tcp_syn_retries_min =1 ;static int tcp_syn_retries_max =MAX_TCP_SYNCNT ; -static int ip_ping_group_range_min[] = {0 ,0 }; -static int ip_ping_group_range_max[] = {GID_T_MAX ,GID_T_MAX }; +static unsigned long ip_ping_group_range_min[] = {0 ,0 }; +static unsigned long ip_ping_group_range_max[] = {GID_T_MAX ,GID_T_MAX };static u32 u32_max_div_HZ =UINT_MAX /HZ ;static int one_day_secs =24 *3600 ; static u32 fib_multipath_hash_fields_all_mask __maybe_unused =
@@ -165,7 +165,7 @@ static int ipv4_ping_group_range(struct ctl_table *table, int write, {struct user_namespace *user_ns =current_user_ns ();int ret; -gid_t urange[2 ]; +unsigned long urange[2 ];kgid_t low, high;struct ctl_table tmp = { .data = &urange,
@@ -178,7 +178,7 @@ static int ipv4_ping_group_range(struct ctl_table *table, int write,inet_get_ping_group_range_table (table, &low, &high); urange[0 ] =from_kgid_munged (user_ns, low); urange[1 ] =from_kgid_munged (user_ns, high); - ret =proc_dointvec_minmax (&tmp, write, buffer, lenp, ppos); + ret =proc_doulongvec_minmax (&tmp, write, buffer, lenp, ppos);if (write && ret ==0 ) { low =make_kgid (user_ns, urange[0 ]);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 11/160 bpf: Fix UAF in task local storage
In reply to Greg Kroah-HartmanFrom: KP Singh <[email protected]>
[ Upstream commit b0fd1852bcc21accca6260ef245356d5c141ff66 ]
When task local storage was generalized for tracing programs, the bpf_task_local_storage callback was moved from a BPF LSM hook callback for security_task_free LSM hook to it's own callback. But a failure case in bad_fork_cleanup_security was missed which, when triggered, led to a dangling task owner pointer and a subsequent use-after-free. Move the bpf_task_storage_free to the very end of free_task to handle all failure cases.
This issue was noticed when a BPF LSM program was attached to the task_alloc hook on a kernel with KASAN enabled. The program used bpf_task_storage_get to copy the task local storage from the current task to the new task being created.
--- kernel/fork.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/fork.c +1 -1
@@ -559,6 +559,7 @@ void free_task(struct task_struct *tsk)arch_release_task_struct (tsk);if (tsk->flags &PF_KTHREAD )free_kthread_struct (tsk); +bpf_task_storage_free (tsk);free_task_struct (tsk); }EXPORT_SYMBOL (free_task);
@@ -845,7 +846,6 @@ void __put_task_struct(struct task_struct *tsk)cgroup_free (tsk);task_numa_free (tsk, true);security_task_free (tsk); -bpf_task_storage_free (tsk);exit_creds (tsk);delayacct_tsk_free (tsk);put_signal_struct (tsk->signal);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 12/160 bpf: Fix elem_size not being set for inner maps
In reply to Greg Kroah-HartmanFrom: Rhys Rustad-Elliott <[email protected]>
[ Upstream commit cba41bb78d70aad98d8e61e019fd48c561f7f396 ]
Commit d937bc3449fa ("bpf: make uniform use of array->elem_size everywhere in arraymap.c") changed array_map_gen_lookup to use array->elem_size instead of round_up(map->value_size, 8) as the element size when generating code to access a value in an array map.
array->elem_size, however, is not set by bpf_map_meta_alloc when initializing an BPF_MAP_TYPE_ARRAY_OF_MAPS or BPF_MAP_TYPE_HASH_OF_MAPS. This results in array_map_gen_lookup incorrectly outputting code that always accesses index 0 in the array (as the index will be calculated via a multiplication with the element size, which is incorrectly set to 0).
Set elem_size on the bpf_array object when allocating an array or hash of maps to fix this.
--- kernel/bpf/map_in_map.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
kernel/bpf/map_in_map.c +6 -2
@@ -81,9 +81,13 @@ struct bpf_map *bpf_map_meta_alloc(int inner_map_ufd)/* Misc members not needed in bpf_map_meta_equal() check. */ inner_map_meta->ops = inner_map->ops;if (inner_map->ops == &array_map_ops) { +struct bpf_array *inner_array_meta = + container_of(inner_map_meta, struct bpf_array, map); + struct bpf_array *inner_array = container_of(inner_map, struct bpf_array, map); + + inner_array_meta->index_mask = inner_array->index_mask; + inner_array_meta->elem_size = inner_array->elem_size; inner_map_meta->bypass_spec_v1 = inner_map->bypass_spec_v1; - container_of(inner_map_meta, struct bpf_array, map)->index_mask = - container_of(inner_map, struct bpf_array, map)->index_mask; }fdput (f);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 13/160 net/ipv6: fix bool/int mismatch for skip_notify_on_dev_down
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit edf2e1d2019b2730d6076dbe4c040d37d7c10bbe ]
skip_notify_on_dev_down ctl table expects this field to be an int (4 bytes), not a bool (1 byte).
Because proc_dou8vec_minmax() was added in 5.13, this patch converts skip_notify_on_dev_down to an int.
Following patch then converts the field to u8 and use proc_dou8vec_minmax().
--- include/net/netns/ipv6.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/netns/ipv6.h +1 -1
@@ -53,7 +53,7 @@ struct netns_sysctl_ipv6 {int seg6_flowlabel;u32 ioam6_id;u64 ioam6_id_wide; -bool skip_notify_on_dev_down; +int skip_notify_on_dev_down;u8 fib_notify_on_flag_change; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 14/160 net/smc: Avoid to access invalid RMBs MRs in SMCRv1 ADD LINK CONT
In reply to Greg Kroah-HartmanFrom: Wen Gu <[email protected]>
[ Upstream commit c308e9ec004721a656c193243eab61a8be324657 ]
SMCRv1 has a similar issue to SMCRv2 (see link below) that may access invalid MRs of RMBs when construct LLC ADD LINK CONT messages.
BUG: kernel NULL pointer dereference, address: 0000000000000014 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 5 PID: 48 Comm: kworker/5:0 Kdump: loaded Tainted: G W E 6.4.0-rc3+ #49 Workqueue: events smc_llc_add_link_work [smc] RIP: 0010:smc_llc_add_link_cont+0x160/0x270 [smc] RSP: 0018:ffffa737801d3d50 EFLAGS: 00010286 RAX: ffff964f82144000 RBX: ffffa737801d3dd8 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff964f81370c30 RBP: ffffa737801d3dd4 R08: ffff964f81370000 R09: ffffa737801d3db0 R10: 0000000000000001 R11: 0000000000000060 R12: ffff964f82e70000 R13: ffff964f81370c38 R14: ffffa737801d3dd3 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff9652bfd40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000014 CR3: 000000008fa20004 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> smc_llc_srv_rkey_exchange+0xa7/0x190 [smc] smc_llc_srv_add_link+0x3ae/0x5a0 [smc] smc_llc_add_link_work+0xb8/0x140 [smc] process_one_work+0x1e5/0x3f0 worker_thread+0x4d/0x2f0 ? __pfx_worker_thread+0x10/0x10 kthread+0xe5/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 </TASK>
When an alernate RNIC is available in system, SMC will try to add a new link based on the RNIC for resilience. All the RMBs in use will be mapped to the new link. Then the RMBs' MRs corresponding to the new link will be filled into LLC messages. For SMCRv1, they are ADD LINK CONT messages.
However smc_llc_add_link_cont() may mistakenly access to unused RMBs which haven't been mapped to the new link and have no valid MRs, thus causing a crash. So this patch fixes it.
--- net/smc/smc_llc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/smc/smc_llc.c +2 -2
@@ -851,6 +851,8 @@ static int smc_llc_add_link_cont(struct smc_link *link, addc_llc->num_rkeys = *num_rkeys_todo; n = *num_rkeys_todo;for (i =0 ; i <min_t (u8, n,SMC_LLC_RKEYS_PER_CONT_MSG ); i++) { +while (*buf_pos && !(*buf_pos)->used) + *buf_pos =smc_llc_get_next_rmb (lgr, buf_lst, *buf_pos);if (!*buf_pos) { addc_llc->num_rkeys = addc_llc->num_rkeys - *num_rkeys_todo;
@@ -867,8 +869,6 @@ static int smc_llc_add_link_cont(struct smc_link *link, (*num_rkeys_todo)--; *buf_pos =smc_llc_get_next_rmb (lgr, buf_lst, *buf_pos); -while (*buf_pos && !(*buf_pos)->used) - *buf_pos =smc_llc_get_next_rmb (lgr, buf_lst, *buf_pos); } addc_llc->hd.common.llc_type =SMC_LLC_ADD_LINK_CONT ; addc_llc->hd.length =sizeof (struct smc_llc_msg_add_link_cont );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 15/160 net: enetc: correct the statistics of rx bytes
In reply to Greg Kroah-HartmanFrom: Wei Fang <[email protected]>
[ Upstream commit 7190d0ff0e17690a9b1279d84a06473600ba2060 ]
The rx_bytes of struct net_device_stats should count the length of ethernet frames excluding the FCS. However, there are two problems with the rx_bytes statistics of the current enetc driver. one is that the length of VLAN header is not counted if the VLAN extraction feature is enabled. The other is that the length of L2 header is not counted, because eth_type_trans() is invoked before updating rx_bytes which will subtract the length of L2 header from skb->len. BTW, the rx_bytes statistics of XDP path also have similar problem, I will fix it in another patch.
--- drivers/net/ethernet/freescale/enetc/enetc.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/net/ethernet/freescale/enetc/enetc.c +7 -1
@@ -1222,7 +1222,13 @@ static int enetc_clean_rx_ring(struct enetc_bdr *rx_ring,if (!skb)break ; - rx_byte_cnt += skb->len; +/* When set, the outer VLAN header is extracted and reported +* in the receive buffer descriptor. So rx_byte_cnt should +* add the length of the extracted VLAN header. +*/ +if (bd_status &ENETC_RXBD_FLAG_VLAN ) + rx_byte_cnt +=VLAN_HLEN ; + rx_byte_cnt += skb->len +ETH_HLEN ; rx_frm_cnt++;napi_gro_receive (napi, skb);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 16/160 net: enetc: correct rx_bytes statistics of XDP
In reply to Greg Kroah-HartmanFrom: Wei Fang <[email protected]>
[ Upstream commit fdebd850cc065495abf1d64756496050bb22db67 ]
The rx_bytes statistics of XDP are always zero, because rx_byte_cnt is not updated after it is initialized to 0. So fix it.
--- drivers/net/ethernet/freescale/enetc/enetc.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/net/ethernet/freescale/enetc/enetc.c +8 -0
@@ -1564,6 +1564,14 @@ static int enetc_clean_rx_ring_xdp(struct enetc_bdr *rx_ring,enetc_build_xdp_buff (rx_ring, bd_status, &rxbd, &i, &cleaned_cnt, &xdp_buff); +/* When set, the outer VLAN header is extracted and reported +* in the receive buffer descriptor. So rx_byte_cnt should +* add the length of the extracted VLAN header. +*/ +if (bd_status &ENETC_RXBD_FLAG_VLAN ) + rx_byte_cnt +=VLAN_HLEN ; + rx_byte_cnt +=xdp_get_buff_len (&xdp_buff); + xdp_act =bpf_prog_run_xdp (prog, &xdp_buff);switch (xdp_act) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 17/160 net/sched: fq_pie: ensure reasonable TCA_FQ_PIE_QUANTUM values
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit cd2b8113c2e8b9f5a88a942e1eaca61eba401b85 ]
We got multiple syzbot reports, all duplicates of the following [1]
syzbot managed to install fq_pie with a zero TCA_FQ_PIE_QUANTUM, thus triggering infinite loops.
Use limits similar to sch_fq, with commits3725a269815b ("pkt_sched: fq: avoid hang when quantum 0") and d9e15a273306 ("pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM")
[1]
watchdog: BUG: soft lockup - CPU#0 stuck for 26s! [swapper/0:0] Modules linked in: irq event stamp: 172817 hardirqs last enabled at (172816): [<ffff80001242fde4>] __el1_irq arch/arm64/kernel/entry-common.c:476 [inline] hardirqs last enabled at (172816): [<ffff80001242fde4>] el1_interrupt+0x58/0x68 arch/arm64/kernel/entry-common.c:486 hardirqs last disabled at (172817): [<ffff80001242fdb0>] __el1_irq arch/arm64/kernel/entry-common.c:468 [inline] hardirqs last disabled at (172817): [<ffff80001242fdb0>] el1_interrupt+0x24/0x68 arch/arm64/kernel/entry-common.c:486 softirqs last enabled at (167634): [<ffff800008020c1c>] softirq_handle_end kernel/softirq.c:414 [inline] softirqs last enabled at (167634): [<ffff800008020c1c>] __do_softirq+0xac0/0xd54 kernel/softirq.c:600 softirqs last disabled at (167701): [<ffff80000802a660>] ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.4.0-rc3-syzkaller-geb0f1697d729 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : fq_pie_qdisc_dequeue+0x10c/0x8ac net/sched/sch_fq_pie.c:246 lr : fq_pie_qdisc_dequeue+0xe4/0x8ac net/sched/sch_fq_pie.c:240
sp : ffff800008007210
x29: ffff800008007280 x28: ffff0000c86f7890 x27: ffff0000cb20c2e8
x26: ffff0000cb20c2f0 x25: dfff800000000000 x24: ffff0000cb20c2e0
x23: ffff0000c86f7880 x22: 0000000000000040 x21: 1fffe000190def10
x20: ffff0000cb20c2e0 x19: ffff0000cb20c2e0 x18: ffff800008006e60
x17: 0000000000000000 x16: ffff80000850af6c x15: 0000000000000302
x14: 0000000000000100 x13: 0000000000000000 x12: 0000000000000001
x11: 0000000000000302 x10: 0000000000000100 x9 : 0000000000000000 x8 : 0000000000000000 x7 : ffff80000841c468 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000001 x3 : 0000000000000000 x2 : ffff0000cb20c2e0 x1 : ffff0000cb20c2e0 x0 : 0000000000000001
Call trace: fq_pie_qdisc_dequeue+0x10c/0x8ac net/sched/sch_fq_pie.c:246 dequeue_skb net/sched/sch_generic.c:292 [inline] qdisc_restart net/sched/sch_generic.c:397 [inline] __qdisc_run+0x1fc/0x231c net/sched/sch_generic.c:415 __dev_xmit_skb net/core/dev.c:3868 [inline] __dev_queue_xmit+0xc80/0x3318 net/core/dev.c:4210 dev_queue_xmit include/linux/netdevice.h:3085 [inline] neigh_connected_output+0x2f8/0x38c net/core/neighbour.c:1581 neigh_output include/net/neighbour.h:544 [inline] ip6_finish_output2+0xd60/0x1a1c net/ipv6/ip6_output.c:134 __ip6_finish_output net/ipv6/ip6_output.c:195 [inline] ip6_finish_output+0x538/0x8c8 net/ipv6/ip6_output.c:206 NF_HOOK_COND include/linux/netfilter.h:292 [inline] ip6_output+0x270/0x594 net/ipv6/ip6_output.c:227 dst_output include/net/dst.h:458 [inline] NF_HOOK include/linux/netfilter.h:303 [inline] ndisc_send_skb+0xc30/0x1790 net/ipv6/ndisc.c:508 ndisc_send_rs+0x47c/0x5d4 net/ipv6/ndisc.c:718 addrconf_rs_timer+0x300/0x58c net/ipv6/addrconf.c:3936 call_timer_fn+0x19c/0x8cc kernel/time/timer.c:1700 expire_timers kernel/time/timer.c:1751 [inline] __run_timers+0x55c/0x734 kernel/time/timer.c:2022 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2035 __do_softirq+0x2d0/0xd54 kernel/softirq.c:571 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:882 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85 invoke_softirq kernel/softirq.c:452 [inline] __irq_exit_rcu+0x28c/0x534 kernel/softirq.c:650 irq_exit_rcu+0x14/0x84 kernel/softirq.c:662 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline] el1_interrupt+0x38/0x68 arch/arm64/kernel/entry-common.c:486 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:587 __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:33 [inline] arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:55 cpuidle_idle_call kernel/sched/idle.c:170 [inline] do_idle+0x1f0/0x4e8 kernel/sched/idle.c:282 cpu_startup_entry+0x24/0x28 kernel/sched/idle.c:379 rest_init+0x2dc/0x2f4 init/main.c:735 start_kernel+0x0/0x55c init/main.c:834 start_kernel+0x3f0/0x55c init/main.c:1088 __primary_switched+0xb8/0xc0 arch/arm64/kernel/head.S:523
--- net/sched/sch_fq_pie.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
net/sched/sch_fq_pie.c +7 -1
@@ -201,6 +201,11 @@ static int fq_pie_qdisc_enqueue(struct sk_buff *skb, struct Qdisc *sch,return NET_XMIT_CN ; } +static struct netlink_range_validation fq_pie_q_range = { + .min =1 , + .max =1 <<20 , +}; +static const struct nla_policy fq_pie_policy[TCA_FQ_PIE_MAX +1 ] = { [TCA_FQ_PIE_LIMIT ] = {.type =NLA_U32 }, [TCA_FQ_PIE_FLOWS ] = {.type =NLA_U32 },
@@ -208,7 +213,8 @@ static const struct nla_policy fq_pie_policy[TCA_FQ_PIE_MAX + 1] = { [TCA_FQ_PIE_TUPDATE] = {.type = NLA_U32}, [TCA_FQ_PIE_ALPHA] = {.type = NLA_U32}, [TCA_FQ_PIE_BETA] = {.type = NLA_U32}, - [TCA_FQ_PIE_QUANTUM] = {.type = NLA_U32}, + [TCA_FQ_PIE_QUANTUM ] = + NLA_POLICY_FULL_RANGE(NLA_U32, &fq_pie_q_range), [TCA_FQ_PIE_MEMORY_LIMIT] = {.type = NLA_U32}, [TCA_FQ_PIE_ECN_PROB] = {.type = NLA_U32}, [TCA_FQ_PIE_ECN] = {.type = NLA_U32},
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 18/160 drm/i915: Explain the magic numbers for AUX SYNC/precharge length
In reply to Greg Kroah-HartmanFrom: Ville Syrjälä <[email protected]>
[ Upstream commit 26bfc3f36f2104c174dfc72415547d5c28ef3f1c ]
Replace the hardcoded final numbers in the AUX SYNC/precharge setup, and derive those from numbers from the (e)DP specs.
The new functions can serve as the single point of truth for the number of SYNC pulses we use.
Stable-dep-of: 2d6f2f79e065 ("drm/i915: Use 18 fast wake AUX sync len")
--- drivers/gpu/drm/i915/display/intel_dp_aux.c | 32 +++++++++++++++++++-- 1 file changed, 29 insertions(+), 3 deletions(-)
drivers/gpu/drm/i915/display/intel_dp_aux.c +29 -3
@@ -117,6 +117,32 @@ static u32 skl_get_aux_clock_divider(struct intel_dp *intel_dp, int index)return index ?0 :1 ; } +static int intel_dp_aux_sync_len (void ) +{ +int precharge =16 ;/* 10-16 */ +int preamble =16 ; + +return precharge + preamble; +} + +static int intel_dp_aux_fw_sync_len (void ) +{ +int precharge =16 ;/* 10-16 */ +int preamble =8 ; + +return precharge + preamble; +} + +static int g4x_dp_aux_precharge_len (void ) +{ +int precharge_min =10 ; +int preamble =16 ; + +/* HW wants the length of the extra precharge in 2us units */ +return (intel_dp_aux_sync_len () - + precharge_min - preamble) /2 ; +} +static u32 g4x_get_aux_send_ctl (struct intel_dp *intel_dp,int send_bytes,u32 aux_clock_divider)
@@ -139,7 +165,7 @@ static u32 g4x_get_aux_send_ctl(struct intel_dp *intel_dp, timeout |DP_AUX_CH_CTL_RECEIVE_ERROR | (send_bytes <<DP_AUX_CH_CTL_MESSAGE_SIZE_SHIFT ) | - (3 <<DP_AUX_CH_CTL_PRECHARGE_2US_SHIFT ) | + (g4x_dp_aux_precharge_len () <<DP_AUX_CH_CTL_PRECHARGE_2US_SHIFT ) | (aux_clock_divider <<DP_AUX_CH_CTL_BIT_CLOCK_2X_SHIFT ); }
@@ -163,8 +189,8 @@ static u32 skl_get_aux_send_ctl(struct intel_dp *intel_dp,DP_AUX_CH_CTL_TIME_OUT_MAX |DP_AUX_CH_CTL_RECEIVE_ERROR | (send_bytes <<DP_AUX_CH_CTL_MESSAGE_SIZE_SHIFT ) | -DP_AUX_CH_CTL_FW_SYNC_PULSE_SKL (24 ) | -DP_AUX_CH_CTL_SYNC_PULSE_SKL (32 ); +DP_AUX_CH_CTL_FW_SYNC_PULSE_SKL (intel_dp_aux_fw_sync_len ()) | +DP_AUX_CH_CTL_SYNC_PULSE_SKL (intel_dp_aux_sync_len ());if (intel_tc_port_in_tbt_alt_mode (dig_port)) ret |=DP_AUX_CH_CTL_TBT_IO ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 19/160 drm/i915: Use 18 fast wake AUX sync len
In reply to Greg Kroah-HartmanFrom: Jouni Högander <[email protected]>
[ Upstream commit 2d6f2f79e06571d41eb1223abebe9097511c9544 ]
HW default for wake sync pulses is 18. 10 precharge and 8 preamble. There is no reason to change this especially as it is causing problems with certain eDP panels.
v3: Change "Fixes:" commit
v2: Remove "fast wake" repeat from subject
--- drivers/gpu/drm/i915/display/intel_dp_aux.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/i915/display/intel_dp_aux.c +1 -1
@@ -127,7 +127,7 @@ static int intel_dp_aux_sync_len(void)static int intel_dp_aux_fw_sync_len (void ) { -int precharge =16 ;/* 10-16 */ +int precharge =10 ;/* 10-16 */ int preamble =8 ;return precharge + preamble;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 20/160 Bluetooth: Split bt_iso_qos into dedicated structures
In reply to Greg Kroah-HartmanFrom: Iulia Tanasescu <[email protected]>
[ Upstream commit 0fe8c8d071343fa9278980ce4b6f8e6ea24a2ed1 ]
Split bt_iso_qos into dedicated unicast and broadcast structures and add additional broadcast parameters.
Stable-dep-of: 31c5f9164949 ("Bluetooth: ISO: consider right CIS when removing CIG at cleanup")
--- include/net/bluetooth/bluetooth.h | 43 +++++--- include/net/bluetooth/hci_core.h | 9 +- net/bluetooth/hci_conn.c | 162 ++++++++++++++++-------------- net/bluetooth/hci_event.c | 33 +++--- net/bluetooth/iso.c | 125 ++++++++++++++++++----- 5 files changed, 237 insertions(+), 135 deletions(-)
include/net/bluetooth/bluetooth.h +30 -13
@@ -1,6 +1,7 @@/* BlueZ - Bluetooth protocol stack for Linux Copyright (C) 2000-2001 Qualcomm Incorporated +Copyright 2023 NXP Written 2000,2001 by Maxim Krasnyansky <[email protected]>
@@ -171,23 +172,39 @@ struct bt_iso_io_qos {__u8 rtn; }; -struct bt_iso_qos { -union { -__u8 cig; -__u8 big; - }; -union { -__u8 cis; -__u8 bis; - }; -union { -__u8 sca; -__u8 sync_interval; - }; +struct bt_iso_ucast_qos { +__u8 cig; +__u8 cis; +__u8 sca; +__u8 packing; +__u8 framing; +struct bt_iso_io_qos in; +struct bt_iso_io_qos out; +}; + +struct bt_iso_bcast_qos { +__u8 big; +__u8 bis; +__u8 sync_interval;__u8 packing;__u8 framing;struct bt_iso_io_qos in;struct bt_iso_io_qos out; +__u8 encryption; +__u8 bcode[16 ]; +__u8 options; +__u16 skip; +__u16 sync_timeout; +__u8 sync_cte_type; +__u8 mse; +__u16 timeout; +}; + +struct bt_iso_qos { +union { +struct bt_iso_ucast_qos ucast; +struct bt_iso_bcast_qos bcast; + }; };#define BT_ISO_PHY_1M 0x01
include/net/bluetooth/hci_core.h +5 -4
@@ -1,6 +1,7 @@/* BlueZ - Bluetooth protocol stack for Linux Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved. +Copyright 2023 NXP Written 2000,2001 by Maxim Krasnyansky <[email protected]>
@@ -1091,7 +1092,7 @@ static inline struct hci_conn *hci_conn_hash_lookup_bis(struct hci_dev *hdev,if (bacmp (&c->dst, ba) || c->type !=ISO_LINK )continue ; -if (c->iso_qos.big == big && c->iso_qos.bis == bis) { +if (c->iso_qos.bcast.big == big && c->iso_qos.bcast.bis == bis) {rcu_read_unlock ();return c; }
@@ -1200,7 +1201,7 @@ static inline struct hci_conn *hci_conn_hash_lookup_cig(struct hci_dev *hdev,if (c->type !=ISO_LINK )continue ; -if (handle == c->iso_qos.cig) { +if (handle == c->iso_qos.ucast.cig) {rcu_read_unlock ();return c; }
@@ -1223,7 +1224,7 @@ static inline struct hci_conn *hci_conn_hash_lookup_big(struct hci_dev *hdev,if (bacmp (&c->dst,BDADDR_ANY ) || c->type !=ISO_LINK )continue ; -if (handle == c->iso_qos.big) { +if (handle == c->iso_qos.bcast.big) {rcu_read_unlock ();return c; }
@@ -1332,7 +1333,7 @@ struct hci_conn *hci_connect_bis(struct hci_dev *hdev, bdaddr_t *dst, __u8 dst_type, struct bt_iso_qos *qos, __u8 data_len, __u8 *data);int hci_pa_create_sync (struct hci_dev *hdev,bdaddr_t *dst,__u8 dst_type, -__u8 sid); +__u8 sid,struct bt_iso_qos *qos);int hci_le_big_create_sync (struct hci_dev *hdev,struct bt_iso_qos *qos,__u16 sync_handle,__u8 num_bis,__u8 bis[]);int hci_conn_check_link_mode (struct hci_conn *conn);
net/bluetooth/hci_conn.c +86 -76
379 lines not on this page · raw message
net/bluetooth/hci_event.c +17 -16
@@ -1,6 +1,7 @@/* BlueZ - Bluetooth protocol stack for Linux Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved. +Copyright 2023 NXP Written 2000,2001 by Maxim Krasnyansky <[email protected]>
@@ -3833,7 +3834,7 @@ static u8 hci_cc_le_set_cig_params(struct hci_dev *hdev, void *data,rcu_read_lock ();list_for_each_entry_rcu (conn, &hdev->conn_hash.list, list) { -if (conn->type !=ISO_LINK || conn->iso_qos.cig != rp->cig_id || +if (conn->type !=ISO_LINK || conn->iso_qos.ucast.cig != rp->cig_id || conn->state ==BT_CONNECTED )continue ;
@@ -3890,7 +3891,7 @@ static u8 hci_cc_le_setup_iso_path(struct hci_dev *hdev, void *data,/* Input (Host to Controller) */ case 0x00 :/* Only confirm connection if output only */ -if (conn->iso_qos.out.sdu && !conn->iso_qos.in.sdu) +if (conn->iso_qos.ucast.out.sdu && !conn->iso_qos.ucast.in.sdu)hci_connect_cfm (conn, rp->status);break ;/* Output (Controller to Host) */
@@ -6818,15 +6819,15 @@ static void hci_le_cis_estabilished_evt(struct hci_dev *hdev, void *data,memset (&interval,0 ,sizeof (interval));memcpy (&interval, ev->c_latency,sizeof (ev->c_latency)); - conn->iso_qos.in.interval =le32_to_cpu (interval); + conn->iso_qos.ucast.in.interval =le32_to_cpu (interval);memcpy (&interval, ev->p_latency,sizeof (ev->p_latency)); - conn->iso_qos.out.interval =le32_to_cpu (interval); - conn->iso_qos.in.latency =le16_to_cpu (ev->interval); - conn->iso_qos.out.latency =le16_to_cpu (ev->interval); - conn->iso_qos.in.sdu =le16_to_cpu (ev->c_mtu); - conn->iso_qos.out.sdu =le16_to_cpu (ev->p_mtu); - conn->iso_qos.in.phy = ev->c_phy; - conn->iso_qos.out.phy = ev->p_phy; + conn->iso_qos.ucast.out.interval =le32_to_cpu (interval); + conn->iso_qos.ucast.in.latency =le16_to_cpu (ev->interval); + conn->iso_qos.ucast.out.latency =le16_to_cpu (ev->interval); + conn->iso_qos.ucast.in.sdu =le16_to_cpu (ev->c_mtu); + conn->iso_qos.ucast.out.sdu =le16_to_cpu (ev->p_mtu); + conn->iso_qos.ucast.in.phy = ev->c_phy; + conn->iso_qos.ucast.out.phy = ev->p_phy; }if (!ev->status) {
@@ -6900,8 +6901,8 @@ static void hci_le_cis_req_evt(struct hci_dev *hdev, void *data, cis->handle = cis_handle; } - cis->iso_qos.cig = ev->cig_id; - cis->iso_qos.cis = ev->cis_id; + cis->iso_qos.ucast.cig = ev->cig_id; + cis->iso_qos.ucast.cis = ev->cis_id;if (!(flags &HCI_PROTO_DEFER )) {hci_le_accept_cis (hdev, ev->cis_handle);
@@ -6988,13 +6989,13 @@ static void hci_le_big_sync_established_evt(struct hci_dev *hdev, void *data, bis->handle = handle; } - bis->iso_qos.big = ev->handle; + bis->iso_qos.bcast.big = ev->handle;memset (&interval,0 ,sizeof (interval));memcpy (&interval, ev->latency,sizeof (ev->latency)); - bis->iso_qos.in.interval =le32_to_cpu (interval); + bis->iso_qos.bcast.in.interval =le32_to_cpu (interval);/* Convert ISO Interval (1.25 ms slots) to latency (ms) */ - bis->iso_qos.in.latency =le16_to_cpu (ev->interval) *125 /100 ; - bis->iso_qos.in.sdu =le16_to_cpu (ev->max_pdu); + bis->iso_qos.bcast.in.latency =le16_to_cpu (ev->interval) *125 /100 ; + bis->iso_qos.bcast.in.sdu =le16_to_cpu (ev->max_pdu);hci_iso_setup_path (bis); }
net/bluetooth/iso.c +99 -26
220 lines not on this page · raw message
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 21/160 Bluetooth: ISO: consider right CIS when removing CIG at cleanup
In reply to Greg Kroah-HartmanFrom: Pauli Virtanen <[email protected]>
[ Upstream commit 31c5f9164949347c9cb34f041a7e04fdc08b1b85 ]
When looking for CIS blocking CIG removal, consider only the CIS with the right CIG ID. Don't try to remove CIG with unset CIG ID.
--- net/bluetooth/hci_conn.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
net/bluetooth/hci_conn.c +5 -2
@@ -943,8 +943,8 @@ static void find_cis(struct hci_conn *conn, void *data) {struct iso_list_data *d = data; -/* Ignore broadcast */ -if (!bacmp (&conn->dst,BDADDR_ANY )) +/* Ignore broadcast or if CIG don't match */ +if (!bacmp (&conn->dst,BDADDR_ANY ) || d->cig != conn->iso_qos.ucast.cig)return ; d->count++;
@@ -959,6 +959,9 @@ static void cis_cleanup(struct hci_conn *conn)struct hci_dev *hdev = conn->hdev;struct iso_list_data d; +if (conn->iso_qos.ucast.cig ==BT_ISO_QOS_CIG_UNSET ) +return ; +memset (&d,0 ,sizeof (d)); d.cig = conn->iso_qos.ucast.cig;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 22/160 Bluetooth: ISO: Fix CIG auto-allocation to select configurable CIG
In reply to Greg Kroah-HartmanFrom: Pauli Virtanen <[email protected]>
[ Upstream commit e6a7a46b8636efe95c75bed63a57fc05c13feba4 ]
Make CIG auto-allocation to select the first CIG_ID that is still configurable. Also use correct CIG_ID range (see Core v5.3 Vol 4 Part E Sec 7.8.97 p.2553).
Previously, it would always select CIG_ID 0 regardless of anything, because cis_list with data.cis == 0xff (BT_ISO_QOS_CIS_UNSET) would not count any CIS. Since we are not adding CIS here, use find_cis instead.
--- net/bluetooth/hci_conn.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
net/bluetooth/hci_conn.c +6 -7
@@ -1715,24 +1715,23 @@ static bool hci_le_set_cig_params(struct hci_conn *conn, struct bt_iso_qos *qos)memset (&data,0 ,sizeof (data)); -/* Allocate a CIG if not set */ +/* Allocate first still reconfigurable CIG if not set */ if (qos->ucast.cig ==BT_ISO_QOS_CIG_UNSET ) { -for (data.cig =0x00 ; data.cig <0xff ; data.cig++) { +for (data.cig =0x00 ; data.cig <0xf0 ; data.cig++) { data.count =0 ; - data.cis =0xff ; -hci_conn_hash_list_state (hdev, cis_list,ISO_LINK , -BT_BOUND , &data); +hci_conn_hash_list_state (hdev, find_cis,ISO_LINK , +BT_CONNECT , &data);if (data.count)continue ; -hci_conn_hash_list_state (hdev, cis_list,ISO_LINK , +hci_conn_hash_list_state (hdev, find_cis,ISO_LINK ,BT_CONNECTED , &data);if (!data.count)break ; } -if (data.cig ==0xff ) +if (data.cig ==0xf0 )return false;/* Update CIG */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 23/160 Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER
In reply to Greg Kroah-HartmanFrom: Zhengping Jiang <[email protected]>
[ Upstream commit 1857c19941c87eb36ad47f22a406be5dfe5eff9f ]
When the HCI_UNREGISTER flag is set, no jobs should be scheduled. Fix potential race when HCI_UNREGISTER is set after the flag is tested in hci_cmd_sync_queue.
--- include/net/bluetooth/hci_core.h | 1 + net/bluetooth/hci_core.c | 2 ++ net/bluetooth/hci_sync.c | 20 ++++++++++++++------ 3 files changed, 17 insertions(+), 6 deletions(-)
include/net/bluetooth/hci_core.h +1 -0
@@ -514,6 +514,7 @@ struct hci_dev {struct work_struct cmd_sync_work;struct list_head cmd_sync_work_list;struct mutex cmd_sync_work_lock; +struct mutex unregister_lock;struct work_struct cmd_sync_cancel_work;struct work_struct reenable_adv_work;
net/bluetooth/hci_core.c +2 -0
@@ -2685,7 +2685,9 @@ void hci_unregister_dev(struct hci_dev *hdev) {BT_DBG ("%p name %s bus %d" , hdev, hdev->name, hdev->bus); +mutex_lock (&hdev->unregister_lock);hci_dev_set_flag (hdev,HCI_UNREGISTER ); +mutex_unlock (&hdev->unregister_lock);write_lock (&hci_dev_list_lock);list_del (&hdev->list);
net/bluetooth/hci_sync.c +14 -6
@@ -629,6 +629,7 @@ void hci_cmd_sync_init(struct hci_dev *hdev)INIT_WORK (&hdev->cmd_sync_work, hci_cmd_sync_work);INIT_LIST_HEAD (&hdev->cmd_sync_work_list);mutex_init (&hdev->cmd_sync_work_lock); +mutex_init (&hdev->unregister_lock);INIT_WORK (&hdev->cmd_sync_cancel_work, hci_cmd_sync_cancel_work);INIT_WORK (&hdev->reenable_adv_work, reenable_adv);
@@ -688,14 +689,19 @@ int hci_cmd_sync_queue(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, void *data, hci_cmd_sync_work_destroy_t destroy) {struct hci_cmd_sync_work_entry *entry; +int err =0 ; -if (hci_dev_test_flag (hdev,HCI_UNREGISTER )) -return -ENODEV ; +mutex_lock (&hdev->unregister_lock); +if (hci_dev_test_flag (hdev,HCI_UNREGISTER )) { + err = -ENODEV ; + goto unlock; + } entry =kmalloc (sizeof (*entry),GFP_KERNEL ); -if (!entry) -return -ENOMEM ; - +if (!entry) { + err = -ENOMEM ; + goto unlock; + } entry->func = func; entry->data = data; entry->destroy = destroy;
@@ -706,7 +712,9 @@ int hci_cmd_sync_queue(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,queue_work (hdev->req_workqueue, &hdev->cmd_sync_work); -return 0 ; +unlock: +mutex_unlock (&hdev->unregister_lock); +return err; }EXPORT_SYMBOL (hci_cmd_sync_queue);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 24/160 Bluetooth: Fix l2cap_disconnect_req deadlock
In reply to Greg Kroah-HartmanFrom: Ying Hsu <[email protected]>
[ Upstream commit 02c5ea5246a44d6ffde0fddebfc1d56188052976 ]
L2CAP assumes that the locks conn->chan_lock and chan->lock are acquired in the order conn->chan_lock, chan->lock to avoid potential deadlock.
For example, l2sock_shutdown acquires these locks in the order:
mutex_lock(&conn->chan_lock)
l2cap_chan_lock(chan)
However, l2cap_disconnect_req acquires chan->lock in l2cap_get_chan_by_scid first and then acquires conn->chan_lock before calling l2cap_chan_del. This means that these locks are acquired in unexpected order, which leads to potential deadlock:
l2cap_chan_lock(c)
mutex_lock(&conn->chan_lock)
This patch releases chan->lock before acquiring the conn_chan_lock to avoid the potential deadlock.
--- net/bluetooth/l2cap_core.c | 4 ++++ 1 file changed, 4 insertions(+)
net/bluetooth/l2cap_core.c +4 -0
@@ -4664,7 +4664,9 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn, chan->ops->set_shutdown (chan); +l2cap_chan_unlock (chan);mutex_lock (&conn->chan_lock); +l2cap_chan_lock (chan);l2cap_chan_del (chan,ECONNRESET );mutex_unlock (&conn->chan_lock);
@@ -4703,7 +4705,9 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,return 0 ; } +l2cap_chan_unlock (chan);mutex_lock (&conn->chan_lock); +l2cap_chan_lock (chan);l2cap_chan_del (chan,0 );mutex_unlock (&conn->chan_lock);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 25/160 Bluetooth: ISO: dont try to remove CIG if there are bound CIS left
In reply to Greg Kroah-HartmanFrom: Pauli Virtanen <[email protected]>
[ Upstream commit 6c242c64a09e78349fb0a5f0a6f8076a3d7c0bb4 ]
Consider existing BOUND & CONNECT state CIS to block CIG removal. Otherwise, under suitable timing conditions we may attempt to remove CIG while Create CIS is pending, which fails.
--- net/bluetooth/hci_conn.c | 2 ++ 1 file changed, 2 insertions(+)
net/bluetooth/hci_conn.c +2 -0
@@ -968,6 +968,8 @@ static void cis_cleanup(struct hci_conn *conn)/* Check if ISO connection is a CIS and remove CIG if there are * no other connections using it. */ +hci_conn_hash_list_state (hdev, find_cis,ISO_LINK ,BT_BOUND , &d); +hci_conn_hash_list_state (hdev, find_cis,ISO_LINK ,BT_CONNECT , &d);hci_conn_hash_list_state (hdev, find_cis,ISO_LINK ,BT_CONNECTED , &d);if (d.count)return ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 26/160 Bluetooth: hci_conn: Add support for linking multiple hcon
In reply to Greg Kroah-HartmanFrom: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 06149746e7203d5ffe2d6faf9799ee36203aa8b8 ]
Since it is required for some configurations to have multiple CIS with the same peer which is now covered by iso-tester in the following test cases:
ISO AC 6(i) - Success
ISO AC 7(i) - Success
ISO AC 8(i) - Success
ISO AC 9(i) - Success
ISO AC 11(i) - Success
Stable-dep-of: 71e9588435c3 ("Bluetooth: ISO: use correct CIS order in Set CIG Parameters event")
--- include/net/bluetooth/hci_core.h | 14 ++- net/bluetooth/hci_conn.c | 155 ++++++++++++++++++++++--------- net/bluetooth/hci_event.c | 92 ++++++++---------- net/bluetooth/iso.c | 8 +- 4 files changed, 172 insertions(+), 97 deletions(-)
include/net/bluetooth/hci_core.h +12 -2
@@ -766,7 +766,10 @@ struct hci_conn {void *iso_data;struct amp_mgr *amp_mgr; -struct hci_conn *link; +struct list_head link_list; +struct hci_conn *parent; +struct hci_link *link; +struct bt_codec codec;void (*connect_cfm_cb) (struct hci_conn *conn,u8 status);
@@ -776,6 +779,11 @@ struct hci_conn {void (*cleanup)(struct hci_conn *conn); }; +struct hci_link { +struct list_head list; +struct hci_conn *conn; +}; +struct hci_chan {struct list_head list;__u16 handle;
@@ -1379,12 +1387,14 @@ static inline void hci_conn_put(struct hci_conn *conn)put_device (&conn->dev); } -static inline void hci_conn_hold (struct hci_conn *conn) +static inline struct hci_conn *hci_conn_hold (struct hci_conn *conn) {BT_DBG ("hcon %p orig refcnt %d" , conn,atomic_read (&conn->refcnt));atomic_inc (&conn->refcnt);cancel_delayed_work (&conn->disc_work); + +return conn; }static inline void hci_conn_drop (struct hci_conn *conn)
net/bluetooth/hci_conn.c +113 -42
285 lines not on this page · raw message
net/bluetooth/hci_event.c +41 -51
160 lines not on this page · raw message
net/bluetooth/iso.c +6 -2
@@ -1657,8 +1657,12 @@ static void iso_connect_cfm(struct hci_conn *hcon, __u8 status)/* Check if LE link has failed */ if (status) { -if (hcon->link) -iso_conn_del (hcon->link,bt_to_errno (status)); +struct hci_link *link, *t; + +list_for_each_entry_safe (link, t, &hcon->link_list, + list) +iso_conn_del (link->conn,bt_to_errno (status)); +return ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 27/160 Bluetooth: hci_conn: Fix not matching by CIS ID
In reply to Greg Kroah-HartmanFrom: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit c14516faede33c2c31da45cf950d55dbff42962e ]
This fixes only matching CIS by address which prevents creating new hcon if upper layer is requesting a specific CIS ID.
Stable-dep-of: 71e9588435c3 ("Bluetooth: ISO: use correct CIS order in Set CIG Parameters event")
--- include/net/bluetooth/hci_core.h | 12 +++++++++++- net/bluetooth/hci_conn.c | 3 ++- 2 files changed, 13 insertions(+), 2 deletions(-)
include/net/bluetooth/hci_core.h +11 -1
@@ -1176,7 +1176,9 @@ static inline struct hci_conn *hci_conn_hash_lookup_le(struct hci_dev *hdev,static inline struct hci_conn *hci_conn_hash_lookup_cis (struct hci_dev *hdev,bdaddr_t *ba, -__u8 ba_type) +__u8 ba_type, +__u8 cig, +__u8 id) {struct hci_conn_hash *h = &hdev->conn_hash;struct hci_conn *c;
@@ -1187,6 +1189,14 @@ static inline struct hci_conn *hci_conn_hash_lookup_cis(struct hci_dev *hdev,if (c->type !=ISO_LINK )continue ; +/* Match CIG ID if set */ +if (cig !=BT_ISO_QOS_CIG_UNSET && cig != c->iso_qos.ucast.cig) +continue ; + +/* Match CIS ID if set */ +if (id !=BT_ISO_QOS_CIS_UNSET && id != c->iso_qos.ucast.cis) +continue ; +if (ba_type == c->dst_type && !bacmp (&c->dst, ba)) {rcu_read_unlock ();return c;
net/bluetooth/hci_conn.c +2 -1
@@ -1846,7 +1846,8 @@ struct hci_conn *hci_bind_cis(struct hci_dev *hdev, bdaddr_t *dst, {struct hci_conn *cis; - cis =hci_conn_hash_lookup_cis (hdev, dst, dst_type); + cis =hci_conn_hash_lookup_cis (hdev, dst, dst_type, qos->ucast.cig, + qos->ucast.cis);if (!cis) { cis =hci_conn_add (hdev,ISO_LINK , dst,HCI_ROLE_MASTER );if (!cis)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 28/160 Bluetooth: ISO: use correct CIS order in Set CIG Parameters event
In reply to Greg Kroah-HartmanFrom: Pauli Virtanen <[email protected]>
[ Upstream commit 71e9588435c38112d6a8686d3d8e7cc1de8fe22c ]
The order of CIS handle array in Set CIG Parameters response shall match the order of the CIS_ID array in the command (Core v5.3 Vol 4 Part E Sec 7.8.97). We send CIS_IDs mainly in the order of increasing CIS_ID (but with "last" CIS first if it has fixed CIG_ID). In handling of the reply, we currently assume this is also the same as the order of hci_conn in hdev->conn_hash, but that is not true.
Match the correct hci_conn to the correct handle by matching them based on the CIG+CIS combination. The CIG+CIS combination shall be unique for ISO_LINK hci_conn at state >= BT_BOUND, which we maintain in hci_le_set_cig_params.
--- include/net/bluetooth/hci_core.h | 3 ++- net/bluetooth/hci_event.c | 44 +++++++++++++++++++------------- 2 files changed, 28 insertions(+), 19 deletions(-)
include/net/bluetooth/hci_core.h +2 -1
@@ -1197,7 +1197,8 @@ static inline struct hci_conn *hci_conn_hash_lookup_cis(struct hci_dev *hdev,if (id !=BT_ISO_QOS_CIS_UNSET && id != c->iso_qos.ucast.cis)continue ; -if (ba_type == c->dst_type && !bacmp (&c->dst, ba)) { +/* Match destination address if set */ +if (!ba || (ba_type == c->dst_type && !bacmp (&c->dst, ba))) {rcu_read_unlock ();return c; }
net/bluetooth/hci_event.c +26 -18
74 lines not on this page · raw message
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 29/160 Bluetooth: L2CAP: Add missing checks for invalid DCID
In reply to Greg Kroah-HartmanFrom: Sungwoo Kim <[email protected]>
[ Upstream commit 75767213f3d9b97f63694d02260b6a49a2271876 ]
When receiving a connect response we should make sure that the DCID is within the valid range and that we don't already have another channel allocated for the same DCID.
Missing checks may violate the specification (BLUETOOTH CORE SPECIFICATION Version 5.4 | Vol 3, Part A, Page 1046).
--- net/bluetooth/l2cap_core.c | 9 +++++++++ 1 file changed, 9 insertions(+)
net/bluetooth/l2cap_core.c +9 -0
@@ -4307,6 +4307,10 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn, result =__le16_to_cpu (rsp->result); status =__le16_to_cpu (rsp->status); +if (result ==L2CAP_CR_SUCCESS && (dcid <L2CAP_CID_DYN_START || + dcid >L2CAP_CID_DYN_END )) +return -EPROTO ; +BT_DBG ("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x" , dcid, scid, result, status);
@@ -4338,6 +4342,11 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn,switch (result) {case L2CAP_CR_SUCCESS : +if (__l2cap_get_chan_by_dcid (conn, dcid)) { + err = -EBADSLT ; +break ; + } +l2cap_state_change (chan,BT_CONFIG ); chan->ident =0 ; chan->dcid = dcid;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 30/160 wifi: mac80211: use correct iftype HE cap
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit c37ab22bb1a43cdca8bf69cc0a22f1ccfc449e68 ]
We already check that the right iftype capa exists, but then don't use it. Assign it to a variable so we can actually use it, and then do that.
--- net/mac80211/he.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
net/mac80211/he.c +10 -5
@@ -3,7 +3,7 @@* HE handling * * Copyright(c) 2017 Intel Deutschland GmbH -* Copyright(c) 2019 - 2022 Intel Corporation +* Copyright(c) 2019 - 2023 Intel Corporation */ #include "ieee80211_i.h"
@@ -114,6 +114,7 @@ ieee80211_he_cap_ie_to_sta_he_cap(struct ieee80211_sub_if_data *sdata, struct link_sta_info *link_sta) {struct ieee80211_sta_he_cap *he_cap = &link_sta->pub->he_cap; +const struct ieee80211_sta_he_cap *own_he_cap_ptr;struct ieee80211_sta_he_cap own_he_cap;struct ieee80211_he_cap_elem *he_cap_ie_elem = (void *)he_cap_ie;u8 he_ppe_size;
@@ -123,12 +124,16 @@ ieee80211_he_cap_ie_to_sta_he_cap(struct ieee80211_sub_if_data *sdata,memset (he_cap,0 ,sizeof (*he_cap)); -if (!he_cap_ie || - !ieee80211_get_he_iftype_cap (sband, -ieee80211_vif_type_p2p (&sdata->vif))) +if (!he_cap_ie)return ; - own_he_cap = sband->iftype_data->he_cap; + own_he_cap_ptr = +ieee80211_get_he_iftype_cap (sband, +ieee80211_vif_type_p2p (&sdata->vif)); +if (!own_he_cap_ptr) +return ; + + own_he_cap = *own_he_cap_ptr;/* Make sure size is OK */ mcs_nss_size =ieee80211_he_mcs_nss_size (he_cap_ie_elem);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 31/160 wifi: cfg80211: reject bad AP MLD address
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit 727073ca5e55ab6a07df316250be8a12606e8677 ]
When trying to authenticate, if the AP MLD address isn't a valid address, mac80211 can throw a warning. Avoid that by rejecting such addresses.
--- net/wireless/nl80211.c | 2 ++ 1 file changed, 2 insertions(+)
net/wireless/nl80211.c +2 -0
@@ -10642,6 +10642,8 @@ static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)if (!info->attrs[NL80211_ATTR_MLD_ADDR ])return -EINVAL ; req.ap_mld_addr =nla_data (info->attrs[NL80211_ATTR_MLD_ADDR ]); +if (!is_valid_ether_addr (req.ap_mld_addr)) +return -EINVAL ; } req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 32/160 wifi: mac80211: mlme: fix non-inheritence element
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit 68c228557d52616cf040651abefda9839de7086a ]
There were two bugs when creating the non-inheritence element:
1) 'at_extension' needs to be declared outside the loop, otherwise the value resets every iteration and we can never really switch properly
2) 'added' never got set to true, so we always cut off the extension element again at the end of the function
This shows another issue that we might add a list but no extension list, but we need to make the extension list a zero-length one in that case.
Fix all these issues. While at it, add a comment explaining the trim.
--- net/mac80211/mlme.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
net/mac80211/mlme.c +7 -1
@@ -1217,6 +1217,7 @@ static void ieee80211_add_non_inheritance_elem(struct sk_buff *skb, const u16 *inner) {unsigned int skb_len = skb->len; +bool at_extension = false;bool added = false;int i, j;u8 *len, *list_len =NULL ;
@@ -1228,7 +1229,6 @@ static void ieee80211_add_non_inheritance_elem(struct sk_buff *skb,for (i =0 ; i <PRESENT_ELEMS_MAX && outer[i]; i++) {u16 elem = outer[i];bool have_inner = false; -bool at_extension = false;/* should at least be sorted in the sense of normal -> ext */ WARN_ON (at_extension && elem <PRESENT_ELEM_EXT_OFFS );
@@ -1257,8 +1257,14 @@ static void ieee80211_add_non_inheritance_elem(struct sk_buff *skb, } *list_len +=1 ;skb_put_u8 (skb, (u8 )elem); + added = true; } +/* if we added a list but no extension list, make a zero-len one */ +if (added && (!at_extension || !list_len)) +skb_put_u8 (skb,0 ); + +/* if nothing added remove extension element completely */ if (!added)skb_trim (skb, skb_len);else
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 33/160 wifi: mac80211: dont translate beacon/presp addrs
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit 47c171a426e305f2225b92ed7b5e0a990c95f6d4 ]
Don't do link address translation for beacons and probe responses, this leads to reporting multiple scan list entries for the same AP (one with the MLD address) which just breaks things.
We might need to extend this in the future for some other (action) frames that aren't MLD addressed.
--- net/mac80211/rx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/mac80211/rx.c +3 -1
@@ -4884,7 +4884,9 @@ static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx, }if (unlikely (rx->sta && rx->sta->sta.mlo) && -is_unicast_ether_addr (hdr->addr1)) { +is_unicast_ether_addr (hdr->addr1) && + !ieee80211_is_probe_resp (hdr->frame_control) && + !ieee80211_is_beacon (hdr->frame_control)) {/* translate to MLD addresses */ if (ether_addr_equal (link->conf->addr, hdr->addr1))ether_addr_copy (hdr->addr1, rx->sdata->vif.addr);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 34/160 qed/qede: Fix scheduling while atomic
In reply to Greg Kroah-HartmanFrom: Manish Chopra <[email protected]>
[ Upstream commit 42510dffd0e2c27046905f742172ed6662af5557 ]
Statistics read through bond interface via sysfs causes below bug and traces as it triggers the bonding module to collect the slave device statistics while holding the spinlock, beneath that qede->qed driver statistics flow gets scheduled out due to usleep_range() used in PTT acquire logic
[ 3673.988874] Hardware name: HPE ProLiant DL365 Gen10 Plus/ProLiant DL365 Gen10 Plus, BIOS A42 10/29/2021 [ 3673.988878] Call Trace: [ 3673.988891] dump_stack_lvl+0x34/0x44 [ 3673.988908] __schedule_bug.cold+0x47/0x53 [ 3673.988918] __schedule+0x3fb/0x560 [ 3673.988929] schedule+0x43/0xb0 [ 3673.988932] schedule_hrtimeout_range_clock+0xbf/0x1b0 [ 3673.988937] ? __hrtimer_init+0xc0/0xc0 [ 3673.988950] usleep_range+0x5e/0x80 [ 3673.988955] qed_ptt_acquire+0x2b/0xd0 [qed] [ 3673.988981] _qed_get_vport_stats+0x141/0x240 [qed] [ 3673.989001] qed_get_vport_stats+0x18/0x80 [qed] [ 3673.989016] qede_fill_by_demand_stats+0x37/0x400 [qede] [ 3673.989028] qede_get_stats64+0x19/0xe0 [qede] [ 3673.989034] dev_get_stats+0x5c/0xc0 [ 3673.989045] netstat_show.constprop.0+0x52/0xb0 [ 3673.989055] dev_attr_show+0x19/0x40 [ 3673.989065] sysfs_kf_seq_show+0x9b/0xf0 [ 3673.989076] seq_read_iter+0x120/0x4b0 [ 3673.989087] new_sync_read+0x118/0x1a0 [ 3673.989095] vfs_read+0xf3/0x180 [ 3673.989099] ksys_read+0x5f/0xe0 [ 3673.989102] do_syscall_64+0x3b/0x90 [ 3673.989109] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 3673.989115] RIP: 0033:0x7f8467d0b082 [ 3673.989119] Code: c0 e9 b2 fe ff ff 50 48 8d 3d ca 05 08 00 e8 35 e7 01 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24 [ 3673.989121] RSP: 002b:00007ffffb21fd08 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 3673.989127] RAX: ffffffffffffffda RBX: 000000000100eca0 RCX: 00007f8467d0b082 [ 3673.989128] RDX: 00000000000003ff RSI: 00007ffffb21fdc0 RDI: 0000000000000003 [ 3673.989130] RBP: 00007f8467b96028 R08: 0000000000000010 R09: 00007ffffb21ec00 [ 3673.989132] R10: 00007ffffb27b170 R11: 0000000000000246 R12: 00000000000000f0 [ 3673.989134] R13: 0000000000000003 R14: 00007f8467b92000 R15: 0000000000045a05 [ 3673.989139] CPU: 30 PID: 285188 Comm: read_all Kdump: loaded Tainted: G W OE
Fix this by collecting the statistics asynchronously from a periodic delayed work scheduled at default stats coalescing interval and return the recent copy of statisitcs from .ndo_get_stats64(), also add ability to configure/retrieve stats coalescing interval using below commands -
ethtool -C ethx stats-block-usecs <val>
ethtool -c ethx
--- drivers/net/ethernet/qlogic/qed/qed_l2.c | 2 +- drivers/net/ethernet/qlogic/qede/qede.h | 4 +++ .../net/ethernet/qlogic/qede/qede_ethtool.c | 24 +++++++++++-- drivers/net/ethernet/qlogic/qede/qede_main.c | 34 ++++++++++++++++++- 4 files changed, 60 insertions(+), 4 deletions(-)
drivers/net/ethernet/qlogic/qed/qed_l2.c +1 -1
@@ -1903,7 +1903,7 @@ void qed_get_vport_stats(struct qed_dev *cdev, struct qed_eth_stats *stats) {u32 i; -if (!cdev) { +if (!cdev || cdev->recov_in_prog) {memset (stats,0 ,sizeof (*stats));return ; }
drivers/net/ethernet/qlogic/qede/qede.h +4 -0
@@ -271,6 +271,10 @@ struct qede_dev {#define QEDE_ERR_WARN 3struct qede_dump_info dump_info; +struct delayed_work periodic_task; +unsigned long stats_coal_ticks; +u32 stats_coal_usecs; +spinlock_t stats_lock;/* lock for vport stats access */ };enum QEDE_STATE {
drivers/net/ethernet/qlogic/qede/qede_ethtool.c +22 -2
@@ -430,6 +430,8 @@ static void qede_get_ethtool_stats(struct net_device *dev, } } +spin_lock (&edev->stats_lock); +for (i =0 ; i <QEDE_NUM_STATS ; i++) {if (qede_is_irrelevant_stat (edev, i))continue ;
@@ -439,6 +441,8 @@ static void qede_get_ethtool_stats(struct net_device *dev, buf++; } +spin_unlock (&edev->stats_lock); +__qede_unlock (edev); }
@@ -830,6 +834,7 @@ static int qede_get_coalesce(struct net_device *dev, coal->rx_coalesce_usecs = rx_coal; coal->tx_coalesce_usecs = tx_coal; + coal->stats_block_coalesce_usecs = edev->stats_coal_usecs;return rc; }
@@ -843,6 +848,19 @@ int qede_set_coalesce(struct net_device *dev, struct ethtool_coalesce *coal,int i, rc =0 ;u16 rxc, txc; +if (edev->stats_coal_usecs != coal->stats_block_coalesce_usecs) { + edev->stats_coal_usecs = coal->stats_block_coalesce_usecs; +if (edev->stats_coal_usecs) { + edev->stats_coal_ticks =usecs_to_jiffies (edev->stats_coal_usecs); +schedule_delayed_work (&edev->periodic_task,0 ); + +DP_INFO (edev,"Configured stats coal ticks=%lu jiffies\n" , + edev->stats_coal_ticks); + }else { +cancel_delayed_work_sync (&edev->periodic_task); + } + } +if (!netif_running (dev)) {DP_INFO (edev,"Interface is down\n" );return -EINVAL ;
@@ -2253,7 +2271,8 @@ static int qede_get_per_coalesce(struct net_device *dev, }static const struct ethtool_ops qede_ethtool_ops = { - .supported_coalesce_params =ETHTOOL_COALESCE_USECS , + .supported_coalesce_params =ETHTOOL_COALESCE_USECS | +ETHTOOL_COALESCE_STATS_BLOCK_USECS , .get_link_ksettings = qede_get_link_ksettings, .set_link_ksettings = qede_set_link_ksettings, .get_drvinfo = qede_get_drvinfo,
@@ -2304,7 +2323,8 @@ static const struct ethtool_ops qede_ethtool_ops = { };static const struct ethtool_ops qede_vf_ethtool_ops = { - .supported_coalesce_params =ETHTOOL_COALESCE_USECS , + .supported_coalesce_params =ETHTOOL_COALESCE_USECS | +ETHTOOL_COALESCE_STATS_BLOCK_USECS , .get_link_ksettings = qede_get_link_ksettings, .get_drvinfo = qede_get_drvinfo, .get_msglevel = qede_get_msglevel,
drivers/net/ethernet/qlogic/qede/qede_main.c +33 -1
@@ -308,6 +308,8 @@ void qede_fill_by_demand_stats(struct qede_dev *edev) edev->ops->get_vport_stats (edev->cdev, &stats); +spin_lock (&edev->stats_lock); + p_common->no_buff_discards = stats.common.no_buff_discards; p_common->packet_too_big_discard = stats.common.packet_too_big_discard; p_common->ttl0_discard = stats.common.ttl0_discard;
@@ -405,6 +407,8 @@ void qede_fill_by_demand_stats(struct qede_dev *edev) p_ah->tx_1519_to_max_byte_packets = stats.ah.tx_1519_to_max_byte_packets; } + +spin_unlock (&edev->stats_lock); } static void qede_get_stats64(struct net_device *dev,
@@ -413,9 +417,10 @@ static void qede_get_stats64(struct net_device *dev,struct qede_dev *edev =netdev_priv (dev);struct qede_stats_common *p_common; -qede_fill_by_demand_stats (edev); p_common = &edev->stats.common; +spin_lock (&edev->stats_lock); + stats->rx_packets = p_common->rx_ucast_pkts + p_common->rx_mcast_pkts + p_common->rx_bcast_pkts; stats->tx_packets = p_common->tx_ucast_pkts + p_common->tx_mcast_pkts +
@@ -435,6 +440,8 @@ static void qede_get_stats64(struct net_device *dev, stats->collisions = edev->stats.bb.tx_total_collisions; stats->rx_crc_errors = p_common->rx_crc_errors; stats->rx_frame_errors = p_common->rx_align_errors; + +spin_unlock (&edev->stats_lock); }#ifdef CONFIG_QED_SRIOV
@@ -1064,6 +1071,23 @@ static void qede_unlock(struct qede_dev *edev)rtnl_unlock (); } +static void qede_periodic_task (struct work_struct *work) +{ + struct qede_dev *edev = container_of(work, struct qede_dev, + periodic_task.work); + +qede_fill_by_demand_stats (edev); +schedule_delayed_work (&edev->periodic_task, edev->stats_coal_ticks); +} + +static void qede_init_periodic_task (struct qede_dev *edev) +{ +INIT_DELAYED_WORK (&edev->periodic_task, qede_periodic_task); +spin_lock_init (&edev->stats_lock); + edev->stats_coal_usecs =USEC_PER_SEC ; + edev->stats_coal_ticks =usecs_to_jiffies (USEC_PER_SEC ); +} +static void qede_sp_task (struct work_struct *work) { struct qede_dev *edev = container_of(work, struct qede_dev,
@@ -1083,6 +1107,7 @@ static void qede_sp_task(struct work_struct *work)*/ if (test_and_clear_bit (QEDE_SP_RECOVERY , &edev->sp_flags)) { +cancel_delayed_work_sync (&edev->periodic_task);#ifdef CONFIG_QED_SRIOV /* SRIOV must be disabled outside the lock to avoid a deadlock. * The recovery of the active VFs is currently not supported.
@@ -1273,6 +1298,7 @@ static int __qede_probe(struct pci_dev *pdev, u32 dp_module, u8 dp_level,*/ INIT_DELAYED_WORK (&edev->sp_task, qede_sp_task);mutex_init (&edev->qede_lock); +qede_init_periodic_task (edev); rc =register_netdev (edev->ndev);if (rc) {
@@ -1297,6 +1323,11 @@ static int __qede_probe(struct pci_dev *pdev, u32 dp_module, u8 dp_level, edev->rx_copybreak =QEDE_RX_HDR_SIZE ;qede_log_probe (edev); + +/* retain user config (for example - after recovery) */ +if (edev->stats_coal_usecs) +schedule_delayed_work (&edev->periodic_task,0 ); +return 0 ; err4:
@@ -1365,6 +1396,7 @@ static void __qede_remove(struct pci_dev *pdev, enum qede_remove_mode mode)unregister_netdev (ndev);cancel_delayed_work_sync (&edev->sp_task); +cancel_delayed_work_sync (&edev->periodic_task); edev->ops->common->set_power_state (cdev,PCI_D0 );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 35/160 accel/ivpu: ivpu_ipc needs GENERIC_ALLOCATOR
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 50d30040eb856ff6b0382b4d9dc332dc15597729 ]
Drivers that use the gen_pool*() family of functions should select GENERIC_ALLOCATOR to prevent build errors like these:
ld: drivers/accel/ivpu/ivpu_ipc.o: in function `gen_pool_free':include/linux/genalloc.h:172: undefined reference to `gen_pool_free_owner'
ld: drivers/accel/ivpu/ivpu_ipc.o: in function `gen_pool_alloc_algo':include/linux/genalloc.h:138: undefined reference to `gen_pool_alloc_algo_owner'
ld: drivers/accel/ivpu/ivpu_ipc.o: in function `gen_pool_free':include/linux/genalloc.h:172: undefined reference to `gen_pool_free_owner'
ld: drivers/accel/ivpu/ivpu_ipc.o: in function `ivpu_ipc_init':drivers/accel/ivpu/ivpu_ipc.c:441: undefined reference to `devm_gen_pool_create'
ld: drivers/accel/ivpu/ivpu_ipc.o: in function `gen_pool_add_virt':include/linux/genalloc.h:104: undefined reference to `gen_pool_add_owner'
--- drivers/accel/ivpu/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/accel/ivpu/Kconfig +1 -0
@@ -7,6 +7,7 @@ config DRM_ACCEL_IVPU depends on PCI && PCI_MSI select FW_LOADER select SHMEM + select GENERIC_ALLOCATOR help Choose this option if you have a system that has an 14th generation Intel CPU or newer. VPU stands for Versatile Processing Unit and it's a CPU-integrated
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 36/160 accel/ivpu: Reserve all non-command bos using DMA_RESV_USAGE_BOOKKEEP
In reply to Greg Kroah-HartmanFrom: Stanislaw Gruszka <[email protected]>
[ Upstream commit 411360257c1f4fccaa20143098b6d3fcc9d4e4dc ]
Use DMA_RESV_USAGE_BOOKKEEP reservation for buffer objects, except for command buffers for which we use DMA_RESV_USAGE_WRITE (since VPU can write to command buffer context save area).
--- drivers/accel/ivpu/ivpu_job.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-)
drivers/accel/ivpu/ivpu_job.c +14 -7
@@ -431,6 +431,7 @@ ivpu_job_prepare_bos_for_submit(struct drm_file *file, struct ivpu_job *job, u32struct ivpu_file_priv *file_priv = file->driver_priv;struct ivpu_device *vdev = file_priv->vdev;struct ww_acquire_ctx acquire_ctx; +enum dma_resv_usage usage;struct ivpu_bo *bo;int ret;u32 i;
@@ -461,22 +462,28 @@ ivpu_job_prepare_bos_for_submit(struct drm_file *file, struct ivpu_job *job, u32 job->cmd_buf_vpu_addr = bo->vpu_addr + commands_offset; - ret =drm_gem_lock_reservations ((struct drm_gem_object **)job->bos,1 , &acquire_ctx); + ret =drm_gem_lock_reservations ((struct drm_gem_object **)job->bos, buf_count, + &acquire_ctx);if (ret) {ivpu_warn (vdev,"Failed to lock reservations: %d\n" , ret);return ret; } - ret =dma_resv_reserve_fences (bo->base.resv,1 ); -if (ret) { -ivpu_warn (vdev,"Failed to reserve fences: %d\n" , ret); - goto unlock_reservations; +for (i =0 ; i < buf_count; i++) { + ret =dma_resv_reserve_fences (job->bos[i]->base.resv,1 ); +if (ret) { +ivpu_warn (vdev,"Failed to reserve fences: %d\n" , ret); + goto unlock_reservations; + } } -dma_resv_add_fence (bo->base.resv, job->done_fence,DMA_RESV_USAGE_WRITE ); +for (i =0 ; i < buf_count; i++) { + usage = (i ==CMD_BUF_IDX ) ?DMA_RESV_USAGE_WRITE :DMA_RESV_USAGE_BOOKKEEP ; +dma_resv_add_fence (job->bos[i]->base.resv, job->done_fence, usage); + } unlock_reservations: -drm_gem_unlock_reservations ((struct drm_gem_object **)job->bos,1 , &acquire_ctx); +drm_gem_unlock_reservations ((struct drm_gem_object **)job->bos, buf_count, &acquire_ctx);wmb ();/* Flush write combining buffers */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 37/160 wifi: cfg80211: fix locking in sched scan stop work
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit 3e54ed8247c94c8bdf370bd872bd9dfe72b1b12b ]
This should use wiphy_lock() now instead of acquiring the RTNL, since cfg80211_stop_sched_scan_req() now needs that.
--- net/wireless/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/wireless/core.c +2 -2
@@ -368,12 +368,12 @@ static void cfg80211_sched_scan_stop_wk(struct work_struct *work) rdev = container_of(work, struct cfg80211_registered_device, sched_scan_stop_wk); -rtnl_lock (); +wiphy_lock (&rdev->wiphy);list_for_each_entry_safe (req, tmp, &rdev->sched_scan_req_list, list) {if (req->nl_owner_dead)cfg80211_stop_sched_scan_req (rdev, req, false); } -rtnl_unlock (); +wiphy_unlock (&rdev->wiphy); }static void cfg80211_propagate_radar_detect_wk (struct work_struct *work)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 38/160 wifi: cfg80211: fix locking in regulatory disconnect
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit f7e60032c6618dfd643c7210d5cba2789e2de2e2 ]
This should use wiphy_lock() now instead of requiring the RTNL, since __cfg80211_leave() via cfg80211_leave() is now requiring that lock to be held.
--- net/wireless/reg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/wireless/reg.c +2 -2
@@ -2440,11 +2440,11 @@ static void reg_leave_invalid_chans(struct wiphy *wiphy)struct wireless_dev *wdev;struct cfg80211_registered_device *rdev =wiphy_to_rdev (wiphy); -ASSERT_RTNL (); - +wiphy_lock (wiphy);list_for_each_entry (wdev, &rdev->wiphy.wdev_list, list)if (!reg_wdev_chan_valid (wiphy, wdev))cfg80211_leave (rdev, wdev); +wiphy_unlock (wiphy); }static void reg_check_chans_work (struct work_struct *work)
Signature · 1 line
2.39.2
Re: [PATCH 6.3 038/160] wifi: cfg80211: fix locking in regulatory disconnect
Quoted 7 lines · Greg Kroah-Hartman
From: Johannes Berg <[email protected]>
[ Upstream commit
f7e60032c6618dfd643c7210d5cba2789e2de2e2]This should use
wiphy_lock()now instead of requiring the RTNL, since__cfg80211_leave()viacfg80211_leave()is now requiring that lock to be held.
You should perhaps hold off on this. While all this is correct, I missed something that Dan found later:
I'll have this in the next pull request.
I suppose _both_ should go to stable, and nobody ever seems to run into this patch (at least lockdep would loudly complain), but stills seems better in the short term to have missing locking than a deadlock.
johannes
Greg Kroah-Hartman
maintainerRe: [PATCH 6.3 038/160] wifi: cfg80211: fix locking in regulatory disconnect
Quoted 12 lines · Johannes Berg
Quoted 7 lines · Greg Kroah-Hartman
From: Johannes Berg <[email protected]>
[ Upstream commit
f7e60032c6618dfd643c7210d5cba2789e2de2e2]This should use
wiphy_lock()now instead of requiring the RTNL, since__cfg80211_leave()viacfg80211_leave()is now requiring that lock to be held.You should perhaps hold off on this. While all this is correct, I missed something that Dan found later:
Quoted 7 lines
I'll have this in the next pull request.
I suppose _both_ should go to stable, and nobody ever seems to run into this patch (at least lockdep would loudly complain), but stills seems better in the short term to have missing locking than a deadlock.
Thanks for letting me know, I've dropped this from all queues now.
greg k-h
Re: [PATCH 6.3 038/160] wifi: cfg80211: fix locking in regulatory disconnect
Quoted 15 lines · Greg Kroah-Hartman
Quoted 14 lines · Johannes Berg
Quoted 7 lines · Greg Kroah-Hartman
From: Johannes Berg <[email protected]>
[ Upstream commit
f7e60032c6618dfd643c7210d5cba2789e2de2e2]This should use
wiphy_lock()now instead of requiring the RTNL, since__cfg80211_leave()viacfg80211_leave()is now requiring that lock to be held.You should perhaps hold off on this. While all this is correct, I missed something that Dan found later:
Quoted 8 lines
Quoted 5 lines
I'll have this in the next pull request.
I suppose _both_ should go to stable, and nobody ever seems to run into this patch (at least lockdep would loudly complain), but stills seems better in the short term to have missing locking than a deadlock.
Thanks for letting me know, I've dropped this from all queues now.
The above commit has landed in Linus's tree, and I think you actually should pick up both of these now - there's a lockdep assertion there and locking issues triggered that I (if erroneously) fixed. Seems that we hardly ever get to that code though.
Should I send those patches individually?
johannes
Greg Kroah-Hartman
maintainerRe: [PATCH 6.3 038/160] wifi: cfg80211: fix locking in regulatory disconnect
Quoted 25 lines · Johannes Berg
Quoted 15 lines · Greg Kroah-Hartman
Quoted 14 lines · Johannes Berg
Quoted 7 lines · Greg Kroah-Hartman
From: Johannes Berg <[email protected]>
[ Upstream commit
f7e60032c6618dfd643c7210d5cba2789e2de2e2]This should use
wiphy_lock()now instead of requiring the RTNL, since__cfg80211_leave()viacfg80211_leave()is now requiring that lock to be held.You should perhaps hold off on this. While all this is correct, I missed something that Dan found later:
Quoted 8 lines
Quoted 5 lines
I'll have this in the next pull request.
I suppose _both_ should go to stable, and nobody ever seems to run into this patch (at least lockdep would loudly complain), but stills seems better in the short term to have missing locking than a deadlock.
Thanks for letting me know, I've dropped this from all queues now.
Quoted 6 lines
The above commit has landed in Linus's tree, and I think you actually should pick up both of these now - there's a lockdep assertion there and locking issues triggered that I (if erroneously) fixed. Seems that we hardly ever get to that code though.
Should I send those patches individually?
I can pick them up from here, as the git ids are present and that's all I need, right?
thanks,
greg k-h
Re: [PATCH 6.3 038/160] wifi: cfg80211: fix locking in regulatory disconnect
Quoted 4 lines · Greg Kroah-Hartman
Quoted 3 lines · Johannes Berg
Quoted 2 lines · Greg Kroah-Hartman
Quoted 1 line · Johannes Berg
On Mon, 2023-06-12 at 10:26 +0000, Greg Kroah-Hartman wrote:
Quoted 8 lines
Quoted 5 lines
Quoted 5 lines
Quoted 5 lines
Quoted 3 lines
From: Johannes Berg <[email protected]>
[ Upstream commit
f7e60032c6618dfd643c7210d5cba2789e2de2e2]I can pick them up from here, as the git ids are present and that's all I need, right?
Correct, thanks!
Note that in 6.0 the indentation for the second patch changed, but otherwise the logic is the same (just additional indentation due to multi-link support.) But I can also just send a fixed version when you bounce it back due to not applying.
Also, FWIW, I did verify all this in the meantime, and in fact there's an additional bug here since 6.0, I'll send a separate fix. Also another problem with OCB iftype ... oh well. More fixes to come later, I guess, though that's probably not that interesting for stable.
Thanks,
johannes
Greg Kroah-Hartman
maintainerRe: [PATCH 6.3 038/160] wifi: cfg80211: fix locking in regulatory disconnect
Quoted 14 lines · Johannes Berg
Quoted 4 lines · Greg Kroah-Hartman
Quoted 3 lines · Johannes Berg
Quoted 2 lines · Greg Kroah-Hartman
Quoted 1 line · Johannes Berg
On Mon, 2023-06-12 at 10:26 +0000, Greg Kroah-Hartman wrote:
Quoted 8 lines
Quoted 5 lines
Quoted 5 lines
Quoted 5 lines
Quoted 3 lines
From: Johannes Berg <[email protected]>
[ Upstream commit
f7e60032c6618dfd643c7210d5cba2789e2de2e2]I can pick them up from here, as the git ids are present and that's all I need, right?
Quoted 6 lines
Correct, thanks!
Note that in 6.0 the indentation for the second patch changed, but otherwise the logic is the same (just additional indentation due to multi-link support.) But I can also just send a fixed version when you bounce it back due to not applying.
I fixed it up by hand, thanks.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 39/160 selftests/bpf: Verify optval=NULL case
In reply to Greg Kroah-HartmanFrom: Stanislav Fomichev <[email protected]>
[ Upstream commit 833d67ecdc5f35f1ebf59d0fccc1ce771434be9c ]
Make sure we get optlen exported instead of getting EFAULT.
Stable-dep-of: 69844e335d8c ("selftests/bpf: Fix sockopt_sk selftest")
--- .../selftests/bpf/prog_tests/sockopt_sk.c | 28 +++++++++++++++++++ .../testing/selftests/bpf/progs/sockopt_sk.c | 12 ++++++++ 2 files changed, 40 insertions(+)
tools/testing/selftests/bpf/prog_tests/sockopt_sk.c +28 -0
@@ -3,6 +3,7 @@#include "cgroup_helpers.h" #include <linux/tcp.h> +#include <linux/netlink.h> #include "sockopt_sk.skel.h" #ifndef SOL_TCP
@@ -183,6 +184,33 @@ static int getsetsockopt(void) goto err; } +/* optval=NULL case is handled correctly */ + +close (fd); + fd =socket (AF_NETLINK ,SOCK_RAW ,0 ); +if (fd <0 ) { +log_err ("Failed to create AF_NETLINK socket" ); +return -1 ; + } + + buf.u32 =1 ; + optlen =sizeof (__u32); + err =setsockopt (fd,SOL_NETLINK ,NETLINK_ADD_MEMBERSHIP , &buf, optlen); +if (err) { +log_err ("Unexpected getsockopt(NETLINK_ADD_MEMBERSHIP) err=%d errno=%d" , + err, errno); + goto err; + } + + optlen =0 ; + err =getsockopt (fd,SOL_NETLINK ,NETLINK_LIST_MEMBERSHIPS ,NULL , &optlen); +if (err) { +log_err ("Unexpected getsockopt(NETLINK_LIST_MEMBERSHIPS) err=%d errno=%d" , + err, errno); + goto err; + } +ASSERT_EQ (optlen,4 ,"Unexpected NETLINK_LIST_MEMBERSHIPS value" ); +free (big_buf);close (fd);return 0 ;
tools/testing/selftests/bpf/progs/sockopt_sk.c +12 -0
@@ -32,6 +32,12 @@ int _getsockopt(struct bpf_sockopt *ctx)__u8 *optval_end = ctx->optval_end;__u8 *optval = ctx->optval;struct sockopt_sk *storage; +struct bpf_sock *sk; + +/* Bypass AF_NETLINK. */ + sk = ctx->sk; +if (sk && sk->family ==AF_NETLINK ) +return 1 ;/* Make sure bpf_get_netns_cookie is callable. */
@@ -131,6 +137,12 @@ int _setsockopt(struct bpf_sockopt *ctx)__u8 *optval_end = ctx->optval_end;__u8 *optval = ctx->optval;struct sockopt_sk *storage; +struct bpf_sock *sk; + +/* Bypass AF_NETLINK. */ + sk = ctx->sk; +if (sk && sk->family ==AF_NETLINK ) +return 1 ;/* Make sure bpf_get_netns_cookie is callable. */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 40/160 selftests/bpf: Fix sockopt_sk selftest
In reply to Greg Kroah-HartmanFrom: Yonghong Song <[email protected]>
[ Upstream commit 69844e335d8c22454746c7903776533d8b4ab8fa ]
Commit f4e4534850a9 ("net/netlink: fix NETLINK_LIST_MEMBERSHIPS length report") fixed NETLINK_LIST_MEMBERSHIPS length report which caused
selftest sockopt_sk failure. The failure log looks like
test_sockopt_sk:PASS:join_cgroup /sockopt_sk 0 nsec
run_test:PASS:skel_load 0 nsec
run_test:PASS:setsockopt_link 0 nsec
run_test:PASS:getsockopt_link 0 nsec
getsetsockopt:FAIL:Unexpected NETLINK_LIST_MEMBERSHIPS value unexpected Unexpected NETLINK_LIST_MEMBERSHIPS value: actual 8 != expected 4 run_test:PASS:getsetsockopt 0 nsec
#201 sockopt_sk:FAIL
In net/netlink/af_netlink.c, function netlink_getsockopt(), for NETLINK_LIST_MEMBERSHIPS, nlk->ngroups equals to 36. Before Commit f4e4534850a9, the optlen is calculated as
ALIGN(nlk->ngroups / 8, sizeof(u32)) = 4
After that commit, the optlen is
ALIGN(BITS_TO_BYTES(nlk->ngroups), sizeof(u32)) = 8
Fix the test by setting the expected optlen to be 8.
--- tools/testing/selftests/bpf/prog_tests/sockopt_sk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/bpf/prog_tests/sockopt_sk.c +1 -1
@@ -209,7 +209,7 @@ static int getsetsockopt(void) err, errno); goto err; } -ASSERT_EQ (optlen,4 ,"Unexpected NETLINK_LIST_MEMBERSHIPS value" ); +ASSERT_EQ (optlen,8 ,"Unexpected NETLINK_LIST_MEMBERSHIPS value" );free (big_buf);close (fd);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 41/160 netfilter: nf_tables: Add null check for nla_nest_start_noflag() in nft_dump_basechain_hook()
In reply to Greg Kroah-HartmanFrom: Gavrilov Ilia <[email protected]>
[ Upstream commit bd058763a624a1fb5c20f3c46e632d623c043676 ]
The nla_nest_start_noflag() function may fail and return NULL; the return value needs to be checked.
Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE.
--- net/netfilter/nf_tables_api.c | 2 ++ 1 file changed, 2 insertions(+)
net/netfilter/nf_tables_api.c +2 -0
@@ -1593,6 +1593,8 @@ static int nft_dump_basechain_hook(struct sk_buff *skb, int family,if (nft_base_chain_netdev (family, ops->hooknum)) { nest_devs =nla_nest_start_noflag (skb,NFTA_HOOK_DEVS ); +if (!nest_devs) + goto nla_put_failure;if (!hook_list) hook_list = &basechain->hook_list;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 42/160 netfilter: nft_bitwise: fix register tracking
In reply to Greg Kroah-HartmanFrom: Jeremy Sowden <[email protected]>
[ Upstream commit 14e8b293903785590a0ef168745ac84250cb1f4c ]
At the end of nft_bitwise_reduce, there is a loop which is intended to update the bitwise expression associated with each tracked destination register. However, currently, it just updates the first register repeatedly. Fix it.
--- net/netfilter/nft_bitwise.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nft_bitwise.c +1 -1
@@ -323,7 +323,7 @@ static bool nft_bitwise_reduce(struct nft_regs_track *track, dreg = priv->dreg; regcount =DIV_ROUND_UP (priv->len,NFT_REG32_SIZE );for (i =0 ; i < regcount; i++, dreg++) - track->regs[priv->dreg].bitwise = expr; + track->regs[dreg].bitwise = expr;return false; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 43/160 netfilter: conntrack: fix NULL pointer dereference in nf_confirm_cthelper
In reply to Greg Kroah-HartmanFrom: Tijs Van Buggenhout <[email protected]>
[ Upstream commit e1f543dc660b44618a1bd72ddb4ca0828a95f7ad ]
An nf_conntrack_helper from nf_conn_help may become NULL after DNAT.
Observed when TCP port 1720 (Q931_PORT), associated with h323 conntrack helper, is DNAT'ed to another destination port (e.g. 1730), while nfqueue is being used for final acceptance (e.g. snort).
This happenned after transition from kernel 4.14 to 5.10.161.
Workarounds:
* keep the same port (1720) in DNAT
* disable nfqueue
* disable/unload h323 NAT helper
$ linux-5.10/scripts/decode_stacktrace.sh vmlinux < /tmp/kernel.log BUG: kernel NULL pointer dereference, address: 0000000000000084 [..] RIP: 0010:nf_conntrack_update (net/netfilter/nf_conntrack_core.c:2080 net/netfilter/nf_conntrack_core.c:2134) nf_conntrack [..] nfqnl_reinject (net/netfilter/nfnetlink_queue.c:237) nfnetlink_queue nfqnl_recv_verdict (net/netfilter/nfnetlink_queue.c:1230) nfnetlink_queue nfnetlink_rcv_msg (net/netfilter/nfnetlink.c:241) nfnetlink [..]
--- net/netfilter/nf_conntrack_core.c | 3 +++ 1 file changed, 3 insertions(+)
net/netfilter/nf_conntrack_core.c +3 -0
@@ -2260,6 +2260,9 @@ static int nf_confirm_cthelper(struct sk_buff *skb, struct nf_conn *ct,return 0 ; helper =rcu_dereference (help->helper); +if (!helper) +return 0 ; +if (!(helper->flags &NF_CT_HELPER_F_USERSPACE ))return 0 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 44/160 netfilter: ipset: Add schedule point in call_ad().
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 24e227896bbf003165e006732dccb3516f87f88e ]
syzkaller found a repro that causes Hung Task [0] with ipset. The repro first creates an ipset and then tries to delete a large number of IPs from the ipset concurrently:
IPSET_ATTR_IPADDR_IPV4 : 172.20.20.187
IPSET_ATTR_CIDR : 2
The first deleting thread hogs a CPU with nfnl_lock(NFNL_SUBSYS_IPSET) held, and other threads wait for it to be released.
Previously, the same issue existed in set->variant->uadt() that could run so long under ip_set_lock(set). Commit 5e29dc36bd5e ("netfilter: ipset:
Rework long task execution when adding/deleting entries") tried to fix it, but the issue still exists in the caller with another mutex.
While adding/deleting many IPs, we should release the CPU periodically to prevent someone from abusing ipset to hang the system.
Note we need to increment the ipset's refcnt to prevent the ipset from being destroyed while rescheduling.
[0]:
INFO: task syz-executor174:268 blocked for more than 143 seconds.
Not tainted 6.4.0-rc1-00145-gba79e9a73284 #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor174 state:D stack:0 pid:268 ppid:260 flags:0x0000000d
Call trace:
__switch_to+0x308/0x714 arch/arm64/kernel/process.c:556
context_switch kernel/sched/core.c:5343 [inline]
__schedule+0xd84/0x1648 kernel/sched/core.c:6669
schedule+0xf0/0x214 kernel/sched/core.c:6745
schedule_preempt_disabled+0x58/0xf0 kernel/sched/core.c:6804
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x6fc/0xdb0 kernel/locking/mutex.c:747
__mutex_lock_slowpath+0x14/0x20 kernel/locking/mutex.c:1035
mutex_lock+0x98/0xf0 kernel/locking/mutex.c:286
nfnl_lock net/netfilter/nfnetlink.c:98 [inline]
nfnetlink_rcv_msg+0x480/0x70c net/netfilter/nfnetlink.c:295
netlink_rcv_skb+0x1c0/0x350 net/netlink/af_netlink.c:2546
nfnetlink_rcv+0x18c/0x199c net/netfilter/nfnetlink.c:658
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0x664/0x8cc net/netlink/af_netlink.c:1365
netlink_sendmsg+0x6d0/0xa4c net/netlink/af_netlink.c:1913
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg net/socket.c:747 [inline]
____sys_sendmsg+0x4b8/0x810 net/socket.c:2503
___sys_sendmsg net/socket.c:2557 [inline]
__sys_sendmsg+0x1f8/0x2a4 net/socket.c:2586
__do_sys_sendmsg net/socket.c:2595 [inline]
__se_sys_sendmsg net/socket.c:2593 [inline]
__arm64_sys_sendmsg+0x80/0x94 net/socket.c:2593
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x84/0x270 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x134/0x24c arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:193
el0_svc+0x2c/0x7c arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591--- net/netfilter/ipset/ip_set_core.c | 8 ++++++++ 1 file changed, 8 insertions(+)
net/netfilter/ipset/ip_set_core.c +8 -0
@@ -1694,6 +1694,14 @@ call_ad(struct net *net, struct sock *ctnl, struct sk_buff *skb,bool eexist = flags &IPSET_FLAG_EXIST , retried = false; do { + if (retried) { + __ip_set_get(set); + nfnl_unlock(NFNL_SUBSYS_IPSET); + cond_resched(); + nfnl_lock(NFNL_SUBSYS_IPSET); + __ip_set_put(set); + } + ip_set_lock(set); ret = set->variant->uadt(set, tb, adt, &lineno, flags, retried); ip_set_unlock(set);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 45/160 netfilter: nf_tables: out-of-bound check in chain blob
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 08e42a0d3ad30f276f9597b591f975971a1b0fcf ]
Add current size of rule expressions to the boundary check.
--- net/netfilter/nf_tables_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +1 -1
@@ -8921,7 +8921,7 @@ static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *chacontinue ; } -if (WARN_ON_ONCE (data + expr->ops->size > data_boundary)) +if (WARN_ON_ONCE (data + size + expr->ops->size > data_boundary))return -ENOMEM ;memcpy (data + size, expr, expr->ops->size);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 46/160 drm/lima: fix sched context destroy
In reply to Greg Kroah-HartmanFrom: Erico Nunes <[email protected]>
[ Upstream commit 6eea63c7090b20ee41032d3e478e617b219d69aa ]
The drm sched entity must be flushed before finishing, to account for jobs potentially still in flight at that time.
Lima did not do this flush until now, so switch the destroy call to the drm_sched_entity_destroy() wrapper which will take care of that.
This fixes a regression on lima which started since the rework in commit 2fdb8a8f07c2 ("drm/scheduler: rework entity flush, kill and fini") where some specific types of applications may hang indefinitely.
--- drivers/gpu/drm/lima/lima_sched.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/lima/lima_sched.c +1 -1
@@ -165,7 +165,7 @@ int lima_sched_context_init(struct lima_sched_pipe *pipe,void lima_sched_context_fini (struct lima_sched_pipe *pipe,struct lima_sched_context *context) { -drm_sched_entity_fini (&context->base); +drm_sched_entity_destroy (&context->base); }struct dma_fence *lima_sched_context_queue_task (struct lima_sched_task *task)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 47/160 ipv6: rpl: Fix Route of Death.
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
[ Upstream commit a2f4c143d76b1a47c91ef9bc46907116b111da0b ]
A remote DoS vulnerability of RPL Source Routing is assigned CVE-2023-2156.
The Source Routing Header (SRH) has the following format:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Next Header | Hdr Ext Len | Routing Type | Segments Left | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | CmprI | CmprE | Pad | Reserved | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | . . . Addresses[1..n] . . . | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
The originator of an SRH places the first hop's IPv6 address in the IPv6 header's IPv6 Destination Address and the second hop's IPv6 address as the first address in Addresses[1..n].
The CmprI and CmprE fields indicate the number of prefix octets that are shared with the IPv6 Destination Address. When CmprI or CmprE is not 0, Addresses[1..n] are compressed as follows:
1..n-1 : (16 - CmprI) bytes
n : (16 - CmprE) bytes
Segments Left indicates the number of route segments remaining. When the value is not zero, the SRH is forwarded to the next hop. Its address is extracted from Addresses[n - Segment Left + 1] and swapped with IPv6 Destination Address.
When Segment Left is greater than or equal to 2, the size of SRH is not changed because Addresses[1..n-1] are decompressed and recompressed with CmprI.
OTOH, when Segment Left changes from 1 to 0, the new SRH could have a different size because Addresses[1..n-1] are decompressed with CmprI and recompressed with CmprE.
Let's say CmprI is 15 and CmprE is 0. When we receive SRH with Segment Left >= 2, Addresses[1..n-1] have 1 byte for each, and Addresses[n] has 16 bytes. When Segment Left is 1, Addresses[1..n-1] is decompressed to 16 bytes and not recompressed. Finally, the new SRH will need more room in the header, and the size is (16 - 1) * (n - 1) bytes.
Here the max value of n is 255 as Segment Left is u8, so in the worst case, we have to allocate 3825 bytes in the skb headroom. However, now we only allocate a small fixed buffer that is IPV6_RPL_SRH_WORST_SWAP_SIZE (16 + 7 bytes). If the decompressed size overflows the room, skb_push() hits BUG() below [0].
Instead of allocating the fixed buffer for every packet, let's allocate enough headroom only when we receive SRH with Segment Left 1.
[0]:
skbuff: skb_under_panic: text:ffffffff81c9f6e2 len:576 put:576 head:ffff8880070b5180 data:ffff8880070b4fb0 tail:0x70 end:0x140 dev:lo kernel BUG at net/core/skbuff.c:200!
invalid opcode: 0000 [#1] PREEMPT SMP PTI
CPU: 0 PID: 154 Comm: python3 Not tainted 6.4.0-rc4-00190-gc308e9ec0047 #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:skb_panic (net/core/skbuff.c:200) Code: 4f 70 50 8b 87 bc 00 00 00 50 8b 87 b8 00 00 00 50 ff b7 c8 00 00 00 4c 8b 8f c0 00 00 00 48 c7 c7 80 6e 77 82 e8 ad 8b 60 ff <0f> 0b 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffc90000003da0 EFLAGS: 00000246 RAX: 0000000000000085 RBX: ffff8880058a6600 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff88807dc1c540 RDI: ffff88807dc1c540 RBP: ffffc90000003e48 R08: ffffffff82b392c8 R09: 00000000ffffdfff R10: ffffffff82a592e0 R11: ffffffff82b092e0 R12: ffff888005b1c800 R13: ffff8880070b51b8 R14: ffff888005b1ca18 R15: ffff8880070b5190 FS: 00007f4539f0b740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055670baf3000 CR3: 0000000005b0e000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <IRQ> skb_push (net/core/skbuff.c:210) ipv6_rthdr_rcv (./include/linux/skbuff.h:2880 net/ipv6/exthdrs.c:634 net/ipv6/exthdrs.c:718) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:437 (discriminator 5)) ip6_input_finish (./include/linux/rcupdate.h:805 net/ipv6/ip6_input.c:483) __netif_receive_skb_one_core (net/core/dev.c:5494) process_backlog (./include/linux/rcupdate.h:805 net/core/dev.c:5934) __napi_poll (net/core/dev.c:6496) net_rx_action (net/core/dev.c:6565 net/core/dev.c:6696) __do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/irq.h:142 kernel/softirq.c:572) do_softirq (kernel/softirq.c:472 kernel/softirq.c:459) </IRQ> <TASK> __local_bh_enable_ip (kernel/softirq.c:396) __dev_queue_xmit (net/core/dev.c:4272) ip6_finish_output2 (./include/net/neighbour.h:544 net/ipv6/ip6_output.c:134) rawv6_sendmsg (./include/net/dst.h:458 ./include/linux/netfilter.h:303 net/ipv6/raw.c:656 net/ipv6/raw.c:914) sock_sendmsg (net/socket.c:724 net/socket.c:747) __sys_sendto (net/socket.c:2144) __x64_sys_sendto (net/socket.c:2156 net/socket.c:2152 net/socket.c:2152) do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) RIP: 0033:0x7f453a138aea Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89 RSP: 002b:00007ffcc212a1c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007ffcc212a288 RCX: 00007f453a138aea RDX: 0000000000000060 RSI: 00007f4539084c20 RDI: 0000000000000003 RBP: 00007f4538308e80 R08: 00007ffcc212a300 R09: 000000000000001c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: ffffffffc4653600 R14: 0000000000000001 R15: 00007f4539712d1b </TASK> Modules linked in:
--- include/net/rpl.h | 3 --- net/ipv6/exthdrs.c | 29 +++++++++++------------------ 2 files changed, 11 insertions(+), 21 deletions(-)
include/net/rpl.h +0 -3
@@ -23,9 +23,6 @@ static inline int rpl_init(void)static inline void rpl_exit (void ) {}#endif -/* Worst decompression memory usage ipv6 address (16) + pad 7 */ -#define IPV6_RPL_SRH_WORST_SWAP_SIZE (sizeof(struct in6_addr) + 7) -size_t ipv6_rpl_srh_size (unsigned char n,unsigned char cmpri,unsigned char cmpre);
net/ipv6/exthdrs.c +11 -18
@@ -569,24 +569,6 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb)return -1 ; } -if (skb_cloned (skb)) { -if (pskb_expand_head (skb,IPV6_RPL_SRH_WORST_SWAP_SIZE ,0 , -GFP_ATOMIC )) { -__IP6_INC_STATS (net,ip6_dst_idev (skb_dst (skb)), -IPSTATS_MIB_OUTDISCARDS ); -kfree_skb (skb); -return -1 ; - } - }else { - err =skb_cow_head (skb,IPV6_RPL_SRH_WORST_SWAP_SIZE ); -if (unlikely (err)) { -kfree_skb (skb); -return -1 ; - } - } - - hdr = (struct ipv6_rpl_sr_hdr *)skb_transport_header (skb); -if (!pskb_may_pull (skb,ipv6_rpl_srh_size (n, hdr->cmpri, hdr->cmpre))) {kfree_skb (skb);
@@ -630,6 +612,17 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb)skb_pull (skb, ((hdr->hdrlen +1 ) <<3 ));skb_postpull_rcsum (skb, oldhdr,sizeof (struct ipv6hdr ) + ((hdr->hdrlen +1 ) <<3 )); +if (unlikely (!hdr->segments_left)) { +if (pskb_expand_head (skb,sizeof (struct ipv6hdr ) + ((chdr->hdrlen +1 ) <<3 ),0 , +GFP_ATOMIC )) { +__IP6_INC_STATS (net,ip6_dst_idev (skb_dst (skb)),IPSTATS_MIB_OUTDISCARDS ); +kfree_skb (skb); +kfree (buf); +return -1 ; + } + + oldhdr =ipv6_hdr (skb); + }skb_push (skb, ((chdr->hdrlen +1 ) <<3 ) +sizeof (struct ipv6hdr ));skb_reset_network_header (skb);skb_mac_header_rebuild (skb);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 48/160 tcp: gso: really support BIG TCP
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 82a01ab35bd02ba4b0b4e12bc95c5b69240eb7b0 ]
We missed that tcp_gso_segment() was assuming skb->len was smaller than 65535 :
oldlen = (u16)~skb->len;
This part came with commit 0718bcc09b35 ("[NET]: Fix CHECKSUM_HW GSO problems.")
This leads to wrong TCP checksum.
Adapt the code to accept arbitrary packet length.
v2:
- use two csum_add() instead of csum_fold() (Alexander Duyck)
- Change delta type to __wsum to reduce casts (Alexander Duyck)
--- net/ipv4/tcp_offload.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-)
net/ipv4/tcp_offload.c +9 -10
@@ -60,12 +60,12 @@ struct sk_buff *tcp_gso_segment(struct sk_buff *skb,struct tcphdr *th;unsigned int thlen;unsigned int seq; -__be32 delta;unsigned int oldlen;unsigned int mss;struct sk_buff *gso_skb = skb;__sum16 newcheck;bool ooo_okay, copy_destructor; +__wsum delta; th =tcp_hdr (skb); thlen = th->doff *4 ;
@@ -75,7 +75,7 @@ struct sk_buff *tcp_gso_segment(struct sk_buff *skb,if (!pskb_may_pull (skb, thlen)) goto out; - oldlen = (u16 )~skb->len; + oldlen = ~skb->len;__skb_pull (skb, thlen); mss =skb_shinfo (skb)->gso_size;
@@ -110,7 +110,7 @@ struct sk_buff *tcp_gso_segment(struct sk_buff *skb,if (skb_is_gso (segs)) mss *=skb_shinfo (segs)->gso_segs; - delta =htonl (oldlen + (thlen + mss)); + delta = (__force __wsum )htonl (oldlen + thlen + mss); skb = segs; th =tcp_hdr (skb);
@@ -119,8 +119,7 @@ struct sk_buff *tcp_gso_segment(struct sk_buff *skb,if (unlikely (skb_shinfo (gso_skb)->tx_flags &SKBTX_SW_TSTAMP ))tcp_gso_tstamp (segs,skb_shinfo (gso_skb)->tskey, seq, mss); - newcheck = ~csum_fold ((__force __wsum)((__force u32 )th->check + - (__force u32 )delta)); + newcheck = ~csum_fold (csum_add (csum_unfold (th->check), delta));while (skb->next) { th->fin = th->psh =0 ;
@@ -165,11 +164,11 @@ struct sk_buff *tcp_gso_segment(struct sk_buff *skb,WARN_ON_ONCE (refcount_sub_and_test (-delta, &skb->sk->sk_wmem_alloc)); } - delta =htonl (oldlen + (skb_tail_pointer (skb) - -skb_transport_header (skb)) + - skb->data_len); - th->check = ~csum_fold ((__force __wsum)((__force u32 )th->check + - (__force u32 )delta)); + delta = (__force __wsum )htonl (oldlen + + (skb_tail_pointer (skb) - +skb_transport_header (skb)) + + skb->data_len); + th->check = ~csum_fold (csum_add (csum_unfold (th->check), delta));if (skb->ip_summed ==CHECKSUM_PARTIAL )gso_reset_checksum (skb, ~th->check);else
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 49/160 rfs: annotate lockless accesses to sk->sk_rxhash
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 1e5c647c3f6d4f8497dedcd226204e1880e0ffb3 ]
Add READ_ONCE()/WRITE_ONCE() on accesses to sk->sk_rxhash.
This also prevents a (smart ?) compiler to remove the condition in:
if (sk->sk_rxhash != newval)
sk->sk_rxhash = newval;
We need the condition to avoid dirtying a shared cache line.
--- include/net/sock.h | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
include/net/sock.h +13 -5
@@ -1152,8 +1152,12 @@ static inline void sock_rps_record_flow(const struct sock *sk)* OR an additional socket flag * [1] : sk_state and sk_prot are in the same cache line. */ -if (sk->sk_state ==TCP_ESTABLISHED ) - sock_rps_record_flow_hash(sk->sk_rxhash); +if (sk->sk_state ==TCP_ESTABLISHED ) { +/* This READ_ONCE() is paired with the WRITE_ONCE() +* from sock_rps_save_rxhash() and sock_rps_reset_rxhash(). +*/ +sock_rps_record_flow_hash (READ_ONCE (sk->sk_rxhash)); + } }#endif }
@@ -1162,15 +1166,19 @@ static inline void sock_rps_save_rxhash(struct sock *sk, const struct sk_buff *skb) {#ifdef CONFIG_RPS -if (unlikely (sk->sk_rxhash != skb->hash)) - sk->sk_rxhash = skb->hash; +/* The following WRITE_ONCE() is paired with the READ_ONCE() +* here, and another one in sock_rps_record_flow(). +*/ +if (unlikely (READ_ONCE (sk->sk_rxhash) != skb->hash)) +WRITE_ONCE (sk->sk_rxhash, skb->hash);#endif }static inline void sock_rps_reset_rxhash (struct sock *sk) {#ifdef CONFIG_RPS - sk->sk_rxhash =0 ; +/* Paired with READ_ONCE() in sock_rps_record_flow() */ +WRITE_ONCE (sk->sk_rxhash,0 );#endif }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 50/160 rfs: annotate lockless accesses to RFS sock flow table
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 5c3b74a92aa285a3df722bf6329ba7ccf70346d6 ]
Add READ_ONCE()/WRITE_ONCE() on accesses to the sock flow table.
This also prevents a (smart ?) compiler to remove the condition in:
if (table->ents[index] != newval)
table->ents[index] = newval;
We need the condition to avoid dirtying a shared cache line.
--- include/linux/netdevice.h | 7 +++++-- net/core/dev.c | 6 ++++-- 2 files changed, 9 insertions(+), 4 deletions(-)
include/linux/netdevice.h +5 -2
@@ -760,8 +760,11 @@ static inline void rps_record_sock_flow(struct rps_sock_flow_table *table,/* We only give a hint, preemption can change CPU under us */ val |=raw_smp_processor_id (); -if (table->ents[index] != val) - table->ents[index] = val; +/* The following WRITE_ONCE() is paired with the READ_ONCE() +* here, and another one in get_rps_cpu(). +*/ +if (READ_ONCE (table->ents[index]) != val) +WRITE_ONCE (table->ents[index], val); } }
net/core/dev.c +4 -2
@@ -4471,8 +4471,10 @@ static int get_rps_cpu(struct net_device *dev, struct sk_buff *skb,u32 next_cpu;u32 ident; -/* First check into global flow table if there is a match */ - ident = sock_flow_table->ents[hash & sock_flow_table->mask]; +/* First check into global flow table if there is a match. +* This READ_ONCE() pairs with WRITE_ONCE() from rps_record_sock_flow(). +*/ + ident =READ_ONCE (sock_flow_table->ents[hash & sock_flow_table->mask]);if ((ident ^ hash) & ~rps_cpu_mask) goto try_rps;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 51/160 net: sched: add rcu annotations around qdisc->qdisc_sleeping
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit d636fc5dd692c8f4e00ae6e0359c0eceeb5d9bdb ]
syzbot reported a race around qdisc->qdisc_sleeping [1]
It is time we add proper annotations to reads and writes to/from qdisc->qdisc_sleeping.
[1]
BUG: KCSAN: data-race in dev_graft_qdisc / qdisc_lookup_rcu
read to 0xffff8881286fc618 of 8 bytes by task 6928 on cpu 1:
qdisc_lookup_rcu+0x192/0x2c0 net/sched/sch_api.c:331 __tcf_qdisc_find+0x74/0x3c0 net/sched/cls_api.c:1174 tc_get_tfilter+0x18f/0x990 net/sched/cls_api.c:2547 rtnetlink_rcv_msg+0x7af/0x8c0 net/core/rtnetlink.c:6386 netlink_rcv_skb+0x126/0x220 net/netlink/af_netlink.c:2546 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:6413 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0x56f/0x640 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x665/0x770 net/netlink/af_netlink.c:1913 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] ____sys_sendmsg+0x375/0x4c0 net/socket.c:2503 ___sys_sendmsg net/socket.c:2557 [inline] __sys_sendmsg+0x1e3/0x270 net/socket.c:2586 __do_sys_sendmsg net/socket.c:2595 [inline] __se_sys_sendmsg net/socket.c:2593 [inline] __x64_sys_sendmsg+0x46/0x50 net/socket.c:2593 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
write to 0xffff8881286fc618 of 8 bytes by task 6912 on cpu 0:
dev_graft_qdisc+0x4f/0x80 net/sched/sch_generic.c:1115 qdisc_graft+0x7d0/0xb60 net/sched/sch_api.c:1103 tc_modify_qdisc+0x712/0xf10 net/sched/sch_api.c:1693 rtnetlink_rcv_msg+0x807/0x8c0 net/core/rtnetlink.c:6395 netlink_rcv_skb+0x126/0x220 net/netlink/af_netlink.c:2546 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:6413 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0x56f/0x640 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x665/0x770 net/netlink/af_netlink.c:1913 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg net/socket.c:747 [inline] ____sys_sendmsg+0x375/0x4c0 net/socket.c:2503 ___sys_sendmsg net/socket.c:2557 [inline] __sys_sendmsg+0x1e3/0x270 net/socket.c:2586 __do_sys_sendmsg net/socket.c:2595 [inline] __se_sys_sendmsg net/socket.c:2593 [inline] __x64_sys_sendmsg+0x46/0x50 net/socket.c:2593 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 6912 Comm: syz-executor.5 Not tainted 6.4.0-rc3-syzkaller-00190-g0d85b27b0cc6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/16/2023
--- include/linux/netdevice.h | 2 +- include/net/sch_generic.h | 6 ++++-- net/core/dev.c | 2 +- net/sched/sch_api.c | 26 ++++++++++++++++---------- net/sched/sch_fq_pie.c | 2 ++ net/sched/sch_generic.c | 30 +++++++++++++++--------------- net/sched/sch_mq.c | 8 ++++---- net/sched/sch_mqprio.c | 8 ++++---- net/sched/sch_pie.c | 5 ++++- net/sched/sch_red.c | 5 ++++- net/sched/sch_sfq.c | 5 ++++- net/sched/sch_taprio.c | 6 +++--- net/sched/sch_teql.c | 2 +- 13 files changed, 63 insertions(+), 44 deletions(-)
include/linux/netdevice.h +1 -1
@@ -612,7 +612,7 @@ struct netdev_queue {netdevice_tracker dev_tracker;struct Qdisc __rcu *qdisc; -struct Qdisc *qdisc_sleeping; +struct Qdisc __rcu *qdisc_sleeping;#ifdef CONFIG_SYSFS struct kobject kobj;#endif
include/net/sch_generic.h +4 -2
@@ -545,7 +545,7 @@ static inline struct Qdisc *qdisc_root_bh(const struct Qdisc *qdisc)static inline struct Qdisc *qdisc_root_sleeping (const struct Qdisc *qdisc) { -return qdisc->dev_queue->qdisc_sleeping; +return rcu_dereference_rtnl (qdisc->dev_queue->qdisc_sleeping); }static inline spinlock_t *qdisc_root_sleeping_lock (const struct Qdisc *qdisc)
@@ -754,7 +754,9 @@ static inline bool qdisc_tx_changing(const struct net_device *dev)for (i =0 ; i < dev->num_tx_queues; i++) {struct netdev_queue *txq =netdev_get_tx_queue (dev, i); -if (rcu_access_pointer (txq->qdisc) != txq->qdisc_sleeping) + +if (rcu_access_pointer (txq->qdisc) != +rcu_access_pointer (txq->qdisc_sleeping))return true; }return false;
net/core/dev.c +1 -1
@@ -10507,7 +10507,7 @@ struct netdev_queue *dev_ingress_queue_create(struct net_device *dev)return NULL ;netdev_init_one_queue (dev, queue,NULL );RCU_INIT_POINTER (queue->qdisc, &noop_qdisc); - queue->qdisc_sleeping = &noop_qdisc; +RCU_INIT_POINTER (queue->qdisc_sleeping, &noop_qdisc);rcu_assign_pointer (dev->ingress_queue, queue);#endif return queue;
net/sched/sch_api.c +16 -10
@@ -309,7 +309,7 @@ struct Qdisc *qdisc_lookup(struct net_device *dev, u32 handle)if (dev_ingress_queue (dev)) q =qdisc_match_from_root ( -dev_ingress_queue (dev)->qdisc_sleeping, +rtnl_dereference (dev_ingress_queue (dev)->qdisc_sleeping), handle); out:return q;
@@ -328,7 +328,8 @@ struct Qdisc *qdisc_lookup_rcu(struct net_device *dev, u32 handle) nq =dev_ingress_queue_rcu (dev);if (nq) - q =qdisc_match_from_root (nq->qdisc_sleeping, handle); + q =qdisc_match_from_root (rcu_dereference (nq->qdisc_sleeping), + handle); out:return q; }
@@ -634,8 +635,13 @@ EXPORT_SYMBOL(qdisc_watchdog_init);void qdisc_watchdog_schedule_range_ns (struct qdisc_watchdog *wd,u64 expires,u64 delta_ns) { -if (test_bit (__QDISC_STATE_DEACTIVATED, - &qdisc_root_sleeping (wd->qdisc)->state)) +bool deactivated; + +rcu_read_lock (); + deactivated =test_bit (__QDISC_STATE_DEACTIVATED, + &qdisc_root_sleeping (wd->qdisc)->state); +rcu_read_unlock (); +if (deactivated)return ;if (hrtimer_is_queued (&wd->timer)) {
@@ -1476,7 +1482,7 @@ static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n, } q =qdisc_leaf (p, clid); }else if (dev_ingress_queue (dev)) { - q =dev_ingress_queue (dev)->qdisc_sleeping; + q =rtnl_dereference (dev_ingress_queue (dev)->qdisc_sleeping); } }else { q =rtnl_dereference (dev->qdisc);
@@ -1562,7 +1568,7 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n, } q =qdisc_leaf (p, clid); }else if (dev_ingress_queue_create (dev)) { - q =dev_ingress_queue (dev)->qdisc_sleeping; + q =rtnl_dereference (dev_ingress_queue (dev)->qdisc_sleeping); } }else { q =rtnl_dereference (dev->qdisc);
@@ -1803,8 +1809,8 @@ static int tc_dump_qdisc(struct sk_buff *skb, struct netlink_callback *cb) dev_queue =dev_ingress_queue (dev);if (dev_queue && -tc_dump_qdisc_root (dev_queue->qdisc_sleeping, skb, cb, - &q_idx, s_q_idx, false, +tc_dump_qdisc_root (rtnl_dereference (dev_queue->qdisc_sleeping), + skb, cb, &q_idx, s_q_idx, false, tca[TCA_DUMP_INVISIBLE ]) <0 ) goto done;
@@ -2247,8 +2253,8 @@ static int tc_dump_tclass(struct sk_buff *skb, struct netlink_callback *cb) dev_queue =dev_ingress_queue (dev);if (dev_queue && -tc_dump_tclass_root (dev_queue->qdisc_sleeping, skb, tcm, cb, - &t, s_t, false) <0 ) +tc_dump_tclass_root (rtnl_dereference (dev_queue->qdisc_sleeping), + skb, tcm, cb, &t, s_t, false) <0 ) goto done; done:
net/sched/sch_fq_pie.c +2 -0
@@ -379,6 +379,7 @@ static void fq_pie_timer(struct timer_list *t)spinlock_t *root_lock;/* to lock qdisc for probability calculations */ u32 idx; +rcu_read_lock (); root_lock =qdisc_lock (qdisc_root_sleeping (sch));spin_lock (root_lock);
@@ -391,6 +392,7 @@ static void fq_pie_timer(struct timer_list *t)mod_timer (&q->adapt_timer, jiffies + q->p_params.tupdate);spin_unlock (root_lock); +rcu_read_unlock (); } static int fq_pie_init(struct Qdisc *sch, struct nlattr *opt,
net/sched/sch_generic.c +15 -15
@@ -648,7 +648,7 @@ struct Qdisc_ops noop_qdisc_ops __read_mostly = {static struct netdev_queue noop_netdev_queue = {RCU_POINTER_INITIALIZER (qdisc, &noop_qdisc), - .qdisc_sleeping = &noop_qdisc, +RCU_POINTER_INITIALIZER (qdisc_sleeping, &noop_qdisc), };struct Qdisc noop_qdisc = {
@@ -1103,7 +1103,7 @@ EXPORT_SYMBOL(qdisc_put_unlocked);struct Qdisc *dev_graft_qdisc (struct netdev_queue *dev_queue,struct Qdisc *qdisc) { -struct Qdisc *oqdisc = dev_queue->qdisc_sleeping; +struct Qdisc *oqdisc =rtnl_dereference (dev_queue->qdisc_sleeping);spinlock_t *root_lock; root_lock =qdisc_lock (oqdisc);
@@ -1112,7 +1112,7 @@ struct Qdisc *dev_graft_qdisc(struct netdev_queue *dev_queue,/* ... and graft new one */ if (qdisc ==NULL ) qdisc = &noop_qdisc; - dev_queue->qdisc_sleeping = qdisc; +rcu_assign_pointer (dev_queue->qdisc_sleeping, qdisc);rcu_assign_pointer (dev_queue->qdisc, &noop_qdisc);spin_unlock_bh (root_lock);
@@ -1125,12 +1125,12 @@ static void shutdown_scheduler_queue(struct net_device *dev,struct netdev_queue *dev_queue, void *_qdisc_default) { - struct Qdisc *qdisc = dev_queue->qdisc_sleeping; + struct Qdisc *qdisc = rtnl_dereference(dev_queue->qdisc_sleeping);struct Qdisc *qdisc_default = _qdisc_default;if (qdisc) {rcu_assign_pointer (dev_queue->qdisc, qdisc_default); - dev_queue->qdisc_sleeping = qdisc_default; +rcu_assign_pointer (dev_queue->qdisc_sleeping, qdisc_default);qdisc_put (qdisc); }
@@ -1154,7 +1154,7 @@ static void attach_one_default_qdisc(struct net_device *dev,if (!netif_is_multiqueue (dev)) qdisc->flags |=TCQ_F_ONETXQUEUE |TCQ_F_NOPARENT ; - dev_queue->qdisc_sleeping = qdisc; +rcu_assign_pointer (dev_queue->qdisc_sleeping, qdisc); }static void attach_default_qdiscs (struct net_device *dev)
@@ -1167,7 +1167,7 @@ static void attach_default_qdiscs(struct net_device *dev)if (!netif_is_multiqueue (dev) || dev->priv_flags &IFF_NO_QUEUE ) {netdev_for_each_tx_queue (dev, attach_one_default_qdisc,NULL ); - qdisc = txq->qdisc_sleeping; + qdisc =rtnl_dereference (txq->qdisc_sleeping);rcu_assign_pointer (dev->qdisc, qdisc);qdisc_refcount_inc (qdisc); }else {
@@ -1186,7 +1186,7 @@ static void attach_default_qdiscs(struct net_device *dev)netdev_for_each_tx_queue (dev, shutdown_scheduler_queue, &noop_qdisc); dev->priv_flags |=IFF_NO_QUEUE ;netdev_for_each_tx_queue (dev, attach_one_default_qdisc,NULL ); - qdisc = txq->qdisc_sleeping; + qdisc =rtnl_dereference (txq->qdisc_sleeping);rcu_assign_pointer (dev->qdisc, qdisc);qdisc_refcount_inc (qdisc); dev->priv_flags ^=IFF_NO_QUEUE ;
@@ -1202,7 +1202,7 @@ static void transition_one_qdisc(struct net_device *dev,struct netdev_queue *dev_queue, void *_need_watchdog) { - struct Qdisc *new_qdisc = dev_queue->qdisc_sleeping; + struct Qdisc *new_qdisc = rtnl_dereference(dev_queue->qdisc_sleeping);int *need_watchdog_p = _need_watchdog;if (!(new_qdisc->flags &TCQ_F_BUILTIN ))
@@ -1272,7 +1272,7 @@ static void dev_reset_queue(struct net_device *dev,struct Qdisc *qdisc;bool nolock; - qdisc = dev_queue->qdisc_sleeping; + qdisc =rtnl_dereference (dev_queue->qdisc_sleeping);if (!qdisc)return ;
@@ -1303,7 +1303,7 @@ static bool some_qdisc_is_busy(struct net_device *dev)int val; dev_queue =netdev_get_tx_queue (dev, i); - q = dev_queue->qdisc_sleeping; + q =rtnl_dereference (dev_queue->qdisc_sleeping); root_lock =qdisc_lock (q);spin_lock_bh (root_lock);
@@ -1379,7 +1379,7 @@ EXPORT_SYMBOL(dev_deactivate);static int qdisc_change_tx_queue_len (struct net_device *dev,struct netdev_queue *dev_queue) { -struct Qdisc *qdisc = dev_queue->qdisc_sleeping; +struct Qdisc *qdisc =rtnl_dereference (dev_queue->qdisc_sleeping);const struct Qdisc_ops *ops = qdisc->ops;if (ops->change_tx_queue_len)
@@ -1404,7 +1404,7 @@ void mq_change_real_num_tx(struct Qdisc *sch, unsigned int new_real_tx)unsigned int i;for (i = new_real_tx; i < dev->real_num_tx_queues; i++) { - qdisc =netdev_get_tx_queue (dev, i)->qdisc_sleeping; + qdisc =rtnl_dereference (netdev_get_tx_queue (dev, i)->qdisc_sleeping);/* Only update the default qdiscs we created, * qdiscs with handles are always hashed. */
@@ -1412,7 +1412,7 @@ void mq_change_real_num_tx(struct Qdisc *sch, unsigned int new_real_tx)qdisc_hash_del (qdisc); }for (i = dev->real_num_tx_queues; i < new_real_tx; i++) { - qdisc =netdev_get_tx_queue (dev, i)->qdisc_sleeping; + qdisc =rtnl_dereference (netdev_get_tx_queue (dev, i)->qdisc_sleeping);if (qdisc != &noop_qdisc && !qdisc->handle)qdisc_hash_add (qdisc, false); }
@@ -1449,7 +1449,7 @@ static void dev_init_scheduler_queue(struct net_device *dev,struct Qdisc *qdisc = _qdisc;rcu_assign_pointer (dev_queue->qdisc, qdisc); - dev_queue->qdisc_sleeping = qdisc; +rcu_assign_pointer (dev_queue->qdisc_sleeping, qdisc); }void dev_init_scheduler (struct net_device *dev)
net/sched/sch_mq.c +4 -4
@@ -141,7 +141,7 @@ static int mq_dump(struct Qdisc *sch, struct sk_buff *skb)* qdisc totals are added at end. */ for (ntx =0 ; ntx < dev->num_tx_queues; ntx++) { - qdisc =netdev_get_tx_queue (dev, ntx)->qdisc_sleeping; + qdisc =rtnl_dereference (netdev_get_tx_queue (dev, ntx)->qdisc_sleeping);spin_lock_bh (qdisc_lock (qdisc)); gnet_stats_add_basic(&sch->bstats, qdisc->cpu_bstats,
@@ -202,7 +202,7 @@ static struct Qdisc *mq_leaf(struct Qdisc *sch, unsigned long cl) {struct netdev_queue *dev_queue =mq_queue_get (sch, cl); -return dev_queue->qdisc_sleeping; +return rtnl_dereference (dev_queue->qdisc_sleeping); }static unsigned long mq_find (struct Qdisc *sch,u32 classid)
@@ -221,7 +221,7 @@ static int mq_dump_class(struct Qdisc *sch, unsigned long cl, tcm->tcm_parent =TC_H_ROOT ; tcm->tcm_handle |=TC_H_MIN (cl); - tcm->tcm_info = dev_queue->qdisc_sleeping->handle; + tcm->tcm_info =rtnl_dereference (dev_queue->qdisc_sleeping)->handle;return 0 ; }
@@ -230,7 +230,7 @@ static int mq_dump_class_stats(struct Qdisc *sch, unsigned long cl, {struct netdev_queue *dev_queue =mq_queue_get (sch, cl); - sch = dev_queue->qdisc_sleeping; + sch =rtnl_dereference (dev_queue->qdisc_sleeping);if (gnet_stats_copy_basic (d, sch->cpu_bstats, &sch->bstats, true) <0 ||qdisc_qstats_copy (d, sch) <0 )return -1 ;
net/sched/sch_mqprio.c +4 -4
@@ -421,7 +421,7 @@ static int mqprio_dump(struct Qdisc *sch, struct sk_buff *skb)* qdisc totals are added at end. */ for (ntx =0 ; ntx < dev->num_tx_queues; ntx++) { - qdisc =netdev_get_tx_queue (dev, ntx)->qdisc_sleeping; + qdisc =rtnl_dereference (netdev_get_tx_queue (dev, ntx)->qdisc_sleeping);spin_lock_bh (qdisc_lock (qdisc)); gnet_stats_add_basic(&sch->bstats, qdisc->cpu_bstats,
@@ -465,7 +465,7 @@ static struct Qdisc *mqprio_leaf(struct Qdisc *sch, unsigned long cl)if (!dev_queue)return NULL ; -return dev_queue->qdisc_sleeping; +return rtnl_dereference (dev_queue->qdisc_sleeping); }static unsigned long mqprio_find (struct Qdisc *sch,u32 classid)
@@ -498,7 +498,7 @@ static int mqprio_dump_class(struct Qdisc *sch, unsigned long cl, tcm->tcm_parent = (tc <0 ) ?0 :TC_H_MAKE (TC_H_MAJ (sch->handle),TC_H_MIN (tc +TC_H_MIN_PRIORITY )); - tcm->tcm_info = dev_queue->qdisc_sleeping->handle; + tcm->tcm_info =rtnl_dereference (dev_queue->qdisc_sleeping)->handle; }else { tcm->tcm_parent =TC_H_ROOT ; tcm->tcm_info =0 ;
@@ -554,7 +554,7 @@ static int mqprio_dump_class_stats(struct Qdisc *sch, unsigned long cl, }else {struct netdev_queue *dev_queue =mqprio_queue_get (sch, cl); - sch = dev_queue->qdisc_sleeping; + sch =rtnl_dereference (dev_queue->qdisc_sleeping);if (gnet_stats_copy_basic (d, sch->cpu_bstats, &sch->bstats, true) <0 ||qdisc_qstats_copy (d, sch) <0 )
net/sched/sch_pie.c +4 -1
@@ -421,8 +421,10 @@ static void pie_timer(struct timer_list *t) {struct pie_sched_data *q =from_timer (q, t, adapt_timer);struct Qdisc *sch = q->sch; -spinlock_t *root_lock =qdisc_lock (qdisc_root_sleeping (sch)); +spinlock_t *root_lock; +rcu_read_lock (); + root_lock =qdisc_lock (qdisc_root_sleeping (sch));spin_lock (root_lock);pie_calculate_probability (&q->params, &q->vars, sch->qstats.backlog);
@@ -430,6 +432,7 @@ static void pie_timer(struct timer_list *t)if (q->params.tupdate)mod_timer (&q->adapt_timer, jiffies + q->params.tupdate);spin_unlock (root_lock); +rcu_read_unlock (); } static int pie_init(struct Qdisc *sch, struct nlattr *opt,
net/sched/sch_red.c +4 -1
@@ -321,12 +321,15 @@ static inline void red_adaptative_timer(struct timer_list *t) {struct red_sched_data *q =from_timer (q, t, adapt_timer);struct Qdisc *sch = q->sch; -spinlock_t *root_lock =qdisc_lock (qdisc_root_sleeping (sch)); +spinlock_t *root_lock; +rcu_read_lock (); + root_lock =qdisc_lock (qdisc_root_sleeping (sch));spin_lock (root_lock);red_adaptative_algo (&q->parms, &q->vars);mod_timer (&q->adapt_timer, jiffies +HZ /2 );spin_unlock (root_lock); +rcu_read_unlock (); } static int red_init(struct Qdisc *sch, struct nlattr *opt,
net/sched/sch_sfq.c +4 -1
@@ -606,10 +606,12 @@ static void sfq_perturbation(struct timer_list *t) {struct sfq_sched_data *q =from_timer (q, t, perturb_timer);struct Qdisc *sch = q->sch; -spinlock_t *root_lock =qdisc_lock (qdisc_root_sleeping (sch)); +spinlock_t *root_lock;siphash_key_t nkey;get_random_bytes (&nkey,sizeof (nkey)); +rcu_read_lock (); + root_lock =qdisc_lock (qdisc_root_sleeping (sch));spin_lock (root_lock); q->perturbation = nkey;if (!q->filter_list && q->tail)
@@ -618,6 +620,7 @@ static void sfq_perturbation(struct timer_list *t)if (q->perturb_period)mod_timer (&q->perturb_timer, jiffies + q->perturb_period); +rcu_read_unlock (); }static int sfq_change (struct Qdisc *sch,struct nlattr *opt)
net/sched/sch_taprio.c +3 -3
@@ -2319,7 +2319,7 @@ static struct Qdisc *taprio_leaf(struct Qdisc *sch, unsigned long cl)if (!dev_queue)return NULL ; -return dev_queue->qdisc_sleeping; +return rtnl_dereference (dev_queue->qdisc_sleeping); }static unsigned long taprio_find (struct Qdisc *sch,u32 classid)
@@ -2338,7 +2338,7 @@ static int taprio_dump_class(struct Qdisc *sch, unsigned long cl, tcm->tcm_parent =TC_H_ROOT ; tcm->tcm_handle |=TC_H_MIN (cl); - tcm->tcm_info = dev_queue->qdisc_sleeping->handle; + tcm->tcm_info =rtnl_dereference (dev_queue->qdisc_sleeping)->handle;return 0 ; }
@@ -2350,7 +2350,7 @@ static int taprio_dump_class_stats(struct Qdisc *sch, unsigned long cl, {struct netdev_queue *dev_queue =taprio_queue_get (sch, cl); - sch = dev_queue->qdisc_sleeping; + sch =rtnl_dereference (dev_queue->qdisc_sleeping);if (gnet_stats_copy_basic (d,NULL , &sch->bstats, true) <0 ||qdisc_qstats_copy (d, sch) <0 )return -1 ;
net/sched/sch_teql.c +1 -1
@@ -297,7 +297,7 @@ static netdev_tx_t teql_master_xmit(struct sk_buff *skb, struct net_device *dev)struct net_device *slave =qdisc_dev (q);struct netdev_queue *slave_txq =netdev_get_tx_queue (slave,0 ); -if (slave_txq->qdisc_sleeping != q) +if (rcu_access_pointer (slave_txq->qdisc_sleeping) != q)continue ;if (netif_xmit_stopped (netdev_get_tx_queue (slave, subq)) || !netif_running (slave)) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 52/160 drm/i915/selftests: Add some missing error propagation
In reply to Greg Kroah-HartmanFrom: Tvrtko Ursulin <[email protected]>
[ Upstream commit 79d0150d2d983a4f6efee676cea06027f586fcd0 ]
Add some missing error propagation in live_parallel_switch.
To avoid needlessly burdening the various backport processes, note I am not marking it as a fix against any patches and not copying stable since it is debug/selftests only code.
--- .../gpu/drm/i915/gem/selftests/i915_gem_context.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/gpu/drm/i915/gem/selftests/i915_gem_context.c +10 -4
@@ -346,8 +346,10 @@ static int live_parallel_switch(void *arg)continue ; ce =intel_context_create (data[m].ce[0 ]->engine); -if (IS_ERR (ce)) +if (IS_ERR (ce)) { + err =PTR_ERR (ce); goto out; + } err =intel_context_pin (ce);if (err) {
@@ -367,8 +369,10 @@ static int live_parallel_switch(void *arg) worker =kthread_create_worker (0 ,"igt/parallel:%s" , data[n].ce[0 ]->engine->name); -if (IS_ERR (worker)) +if (IS_ERR (worker)) { + err =PTR_ERR (worker); goto out; + } data[n].worker = worker; }
@@ -397,8 +401,10 @@ static int live_parallel_switch(void *arg) } } -if (igt_live_test_end (&t)) - err = -EIO ; +if (igt_live_test_end (&t)) { + err = err ?: -EIO ; +break ; + } } out:
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 53/160 ice: make writes to /dev/gnssX synchronous
In reply to Greg Kroah-HartmanFrom: Michal Schmidt <[email protected]>
[ Upstream commit bf15bb38ec7f4ff522da5c20e1673dbda7159938 ]
The current ice driver's GNSS write implementation buffers writes and works through them asynchronously in a kthread. That's bad because:
- The GNSS write_raw operation is supposed to be synchronous[1][2].
- There is no upper bound on the number of pending writes. Userspace can submit writes much faster than the driver can process, consuming unlimited amounts of kernel memory.
A patch that's currently on review[3] ("[v3,net] ice: Write all GNSS buffers instead of first one") would add one more problem:
- The possibility of waiting for a very long time to flush the write work when doing rmmod, softlockups.
To fix these issues, simplify the implementation: Drop the buffering, the write_work, and make the writes synchronous.
I tested this with gpsd and ubxtool.
[1] https://events19.linuxfoundation.org/wp-content/uploads/2017/12/The-GNSS-Subsystem-Johan-Hovold-Hovold-Consulting-AB.pdf
"User interface" slide.
[2] A comment in drivers/gnss/core.c:gnss_write():
/* Ignoring O_NONBLOCK, write_raw() is synchronous. */
[3] https://patchwork.ozlabs.org/project/intel-wired-lan/patch/[email protected]/
--- drivers/net/ethernet/intel/ice/ice_common.c | 2 +- drivers/net/ethernet/intel/ice/ice_common.h | 2 +- drivers/net/ethernet/intel/ice/ice_gnss.c | 64 ++------------------- drivers/net/ethernet/intel/ice/ice_gnss.h | 10 ---- 4 files changed, 6 insertions(+), 72 deletions(-)
drivers/net/ethernet/intel/ice/ice_common.c +1 -1
@@ -5169,7 +5169,7 @@ ice_aq_read_i2c(struct ice_hw *hw, struct ice_aqc_link_topo_addr topo_addr,*/ int ice_aq_write_i2c (struct ice_hw *hw,struct ice_aqc_link_topo_addr topo_addr, -u16 bus_addr,__le16 addr,u8 params,u8 *data, +u16 bus_addr,__le16 addr,u8 params,const u8 *data,struct ice_sq_cd *cd) {struct ice_aq_desc desc = {0 };
drivers/net/ethernet/intel/ice/ice_common.h +1 -1
@@ -229,7 +229,7 @@ ice_aq_read_i2c(struct ice_hw *hw, struct ice_aqc_link_topo_addr topo_addr, struct ice_sq_cd *cd);int ice_aq_write_i2c (struct ice_hw *hw,struct ice_aqc_link_topo_addr topo_addr, -u16 bus_addr,__le16 addr,u8 params,u8 *data, +u16 bus_addr,__le16 addr,u8 params,const u8 *data,struct ice_sq_cd *cd);bool ice_fw_supports_report_dflt_cfg (struct ice_hw *hw);#endif /* _ICE_COMMON_H_ */
drivers/net/ethernet/intel/ice/ice_gnss.c +4 -60
107 lines not on this page · raw message
drivers/net/ethernet/intel/ice/ice_gnss.h +0 -10
@@ -23,26 +23,16 @@#define ICE_MAX_UBX_READ_TRIES 255#define ICE_MAX_UBX_ACK_READ_TRIES 4095 -struct gnss_write_buf { -struct list_head queue; -unsigned int size; -unsigned char *buf; -}; -/** * struct gnss_serial - data used to initialize GNSS TTY port * @back: back pointer to PF * @kworker: kwork thread for handling periodic work * @read_work: read_work function for handling GNSS reads -* @write_work: write_work function for handling GNSS writes -* @queue: write buffers queue */ struct gnss_serial {struct ice_pf *back;struct kthread_worker *kworker;struct kthread_delayed_work read_work; -struct kthread_work write_work; -struct list_head queue; };#if IS_ENABLED (CONFIG_GNSS )
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 54/160 net: sched: move rtm_tca_policy declaration to include file
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 886bc7d6ed3357975c5f1d3c784da96000d4bbb4 ]
rtm_tca_policy is used from net/sched/sch_api.c and net/sched/cls_api.c, thus should be declared in an include file.
This fixes the following sparse warning:net/sched/sch_api.c:1434:25: warning: symbol 'rtm_tca_policy' was not declared. Should it be static?
--- include/net/pkt_sched.h | 2 ++ net/sched/cls_api.c | 2 -- 2 files changed, 2 insertions(+), 2 deletions(-)
include/net/pkt_sched.h +2 -0
@@ -128,6 +128,8 @@ static inline void qdisc_run(struct Qdisc *q) } } +extern const struct nla_policy rtm_tca_policy[TCA_MAX +1 ]; +/* Calculate maximal size of packet seen by hard_start_xmit routine of this device. */
net/sched/cls_api.c +0 -2
@@ -43,8 +43,6 @@#include <net/flow_offload.h> #include <net/tc_wrapper.h> -extern const struct nla_policy rtm_tca_policy[TCA_MAX +1 ]; -/* The list of all installed classifier types */ static LIST_HEAD (tcf_proto_base);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 55/160 net: openvswitch: fix upcall counter access before allocation
In reply to Greg Kroah-HartmanFrom: Eelco Chaudron <[email protected]>
[ Upstream commit de9df6c6b27e22d7bdd20107947ef3a20e687de5 ]
Currently, the per cpu upcall counters are allocated after the vport is created and inserted into the system. This could lead to the datapath accessing the counters before they are allocated resulting in a kernel Oops.
Here is an example:
PID: 59693 TASK: ffff0005f4f51500 CPU: 0 COMMAND: "ovs-vswitchd"
#0 [ffff80000a39b5b0] __switch_to at ffffb70f0629f2f4
#1 [ffff80000a39b5d0] __schedule at ffffb70f0629f5cc
#2 [ffff80000a39b650] preempt_schedule_common at ffffb70f0629fa60 #3 [ffff80000a39b670] dynamic_might_resched at ffffb70f0629fb58 #4 [ffff80000a39b680] mutex_lock_killable at ffffb70f062a1388 #5 [ffff80000a39b6a0] pcpu_alloc at ffffb70f0594460c
#6 [ffff80000a39b750] __alloc_percpu_gfp at ffffb70f05944e68 #7 [ffff80000a39b760] ovs_vport_cmd_new at ffffb70ee6961b90 [openvswitch]
...
PID: 58682 TASK: ffff0005b2f0bf00 CPU: 0 COMMAND: "kworker/0:3"
#0 [ffff80000a5d2f40] machine_kexec at ffffb70f056a0758
#1 [ffff80000a5d2f70] __crash_kexec at ffffb70f057e2994
#2 [ffff80000a5d3100] crash_kexec at ffffb70f057e2ad8
#3 [ffff80000a5d3120] die at ffffb70f0628234c
#4 [ffff80000a5d31e0] die_kernel_fault at ffffb70f062828a8
#5 [ffff80000a5d3210] __do_kernel_fault at ffffb70f056a31f4
#6 [ffff80000a5d3240] do_bad_area at ffffb70f056a32a4
#7 [ffff80000a5d3260] do_translation_fault at ffffb70f062a9710
#8 [ffff80000a5d3270] do_mem_abort at ffffb70f056a2f74
#9 [ffff80000a5d32a0] el1_abort at ffffb70f06297dac
#10 [ffff80000a5d32d0] el1h_64_sync_handler at ffffb70f06299b24 #11 [ffff80000a5d3410] el1h_64_sync at ffffb70f056812dc
#12 [ffff80000a5d3430] ovs_dp_upcall at ffffb70ee6963c84 [openvswitch] #13 [ffff80000a5d3470] ovs_dp_process_packet at ffffb70ee6963fdc [openvswitch] #14 [ffff80000a5d34f0] ovs_vport_receive at ffffb70ee6972c78 [openvswitch] #15 [ffff80000a5d36f0] netdev_port_receive at ffffb70ee6973948 [openvswitch] #16 [ffff80000a5d3720] netdev_frame_hook at ffffb70ee6973a28 [openvswitch] #17 [ffff80000a5d3730] __netif_receive_skb_core.constprop.0 at ffffb70f06079f90
We moved the per cpu upcall counter allocation to the existing vport alloc and free functions to solve this.
--- net/openvswitch/datapath.c | 19 ------------------- net/openvswitch/vport.c | 18 ++++++++++++++++-- 2 files changed, 16 insertions(+), 21 deletions(-)
net/openvswitch/datapath.c +0 -19
@@ -236,9 +236,6 @@ void ovs_dp_detach_port(struct vport *p)/* First drop references to device. */ hlist_del_rcu (&p->dp_hash_node); -/* Free percpu memory */ -free_percpu (p->upcall_stats); -/* Then destroy it. */ ovs_vport_del (p); }
@@ -1858,12 +1855,6 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info) goto err_destroy_portids; } - vport->upcall_stats = netdev_alloc_pcpu_stats(struct vport_upcall_stats_percpu); -if (!vport->upcall_stats) { - err = -ENOMEM ; - goto err_destroy_vport; - } - err =ovs_dp_cmd_fill_info (dp, reply, info->snd_portid, info->snd_seq,0 ,OVS_DP_CMD_NEW );BUG_ON (err <0 );
@@ -1876,8 +1867,6 @@ static int ovs_dp_cmd_new(struct sk_buff *skb, struct genl_info *info)ovs_notify (&dp_datapath_genl_family, reply, info);return 0 ; -err_destroy_vport: -ovs_dp_detach_port (vport); err_destroy_portids:kfree (rcu_dereference_raw (dp->upcall_portids)); err_unlock_and_destroy_meters:
@@ -2322,12 +2311,6 @@ static int ovs_vport_cmd_new(struct sk_buff *skb, struct genl_info *info) goto exit_unlock_free; } - vport->upcall_stats = netdev_alloc_pcpu_stats(struct vport_upcall_stats_percpu); -if (!vport->upcall_stats) { - err = -ENOMEM ; - goto exit_unlock_free_vport; - } - err =ovs_vport_cmd_fill_info (vport, reply,genl_info_net (info), info->snd_portid, info->snd_seq,0 ,OVS_VPORT_CMD_NEW ,GFP_KERNEL );
@@ -2345,8 +2328,6 @@ static int ovs_vport_cmd_new(struct sk_buff *skb, struct genl_info *info)ovs_notify (&dp_vport_genl_family, reply, info);return 0 ; -exit_unlock_free_vport: -ovs_dp_detach_port (vport); exit_unlock_free:ovs_unlock ();kfree_skb (reply);
net/openvswitch/vport.c +16 -2
@@ -124,6 +124,7 @@ struct vport *ovs_vport_alloc(int priv_size, const struct vport_ops *ops, {struct vport *vport;size_t alloc_size; +int err; alloc_size =sizeof (struct vport );if (priv_size) {
@@ -135,17 +136,29 @@ struct vport *ovs_vport_alloc(int priv_size, const struct vport_ops *ops,if (!vport)return ERR_PTR (-ENOMEM ); + vport->upcall_stats = netdev_alloc_pcpu_stats(struct vport_upcall_stats_percpu); +if (!vport->upcall_stats) { + err = -ENOMEM ; + goto err_kfree_vport; + } + vport->dp = parms->dp; vport->port_no = parms->port_no; vport->ops = ops;INIT_HLIST_NODE (&vport->dp_hash_node);if (ovs_vport_set_upcall_portids (vport, parms->upcall_portids)) { -kfree (vport); -return ERR_PTR (-EINVAL ); + err = -EINVAL ; + goto err_free_percpu; }return vport; + +err_free_percpu: +free_percpu (vport->upcall_stats); +err_kfree_vport: +kfree (vport); +return ERR_PTR (err); }EXPORT_SYMBOL_GPL (ovs_vport_alloc);
@@ -165,6 +178,7 @@ void ovs_vport_free(struct vport *vport)* it is safe to use raw dereference. */ kfree (rcu_dereference_raw (vport->upcall_portids)); +free_percpu (vport->upcall_stats);kfree (vport); }EXPORT_SYMBOL_GPL (ovs_vport_free);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 56/160 net: sched: act_police: fix sparse errors in tcf_police_dump()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 682881ee45c81daa883dcd4fe613b0b0d988bb22 ]
Fixes following sparse errors:
net/sched/act_police.c:360:28: warning: dereference of noderef expression net/sched/act_police.c:362:45: warning: dereference of noderef expression net/sched/act_police.c:362:45: warning: dereference of noderef expression net/sched/act_police.c:368:28: warning: dereference of noderef expression net/sched/act_police.c:370:45: warning: dereference of noderef expression net/sched/act_police.c:370:45: warning: dereference of noderef expression net/sched/act_police.c:376:45: warning: dereference of noderef expression net/sched/act_police.c:376:45: warning: dereference of noderef expression
--- net/sched/act_police.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
net/sched/act_police.c +5 -5
@@ -357,23 +357,23 @@ static int tcf_police_dump(struct sk_buff *skb, struct tc_action *a, opt.burst =PSCHED_NS2TICKS (p->tcfp_burst);if (p->rate_present) {psched_ratecfg_getrate (&opt.rate, &p->rate); -if ((police->params->rate.rate_bytes_ps >= (1ULL <<32 )) && +if ((p->rate.rate_bytes_ps >= (1ULL <<32 )) &&nla_put_u64_64bit (skb,TCA_POLICE_RATE64 , - police->params->rate.rate_bytes_ps, + p->rate.rate_bytes_ps,TCA_POLICE_PAD )) goto nla_put_failure; }if (p->peak_present) {psched_ratecfg_getrate (&opt.peakrate, &p->peak); -if ((police->params->peak.rate_bytes_ps >= (1ULL <<32 )) && +if ((p->peak.rate_bytes_ps >= (1ULL <<32 )) &&nla_put_u64_64bit (skb,TCA_POLICE_PEAKRATE64 , - police->params->peak.rate_bytes_ps, + p->peak.rate_bytes_ps,TCA_POLICE_PAD )) goto nla_put_failure; }if (p->pps_present) {if (nla_put_u64_64bit (skb,TCA_POLICE_PKTRATE64 , - police->params->ppsrate.rate_pkts_ps, + p->ppsrate.rate_pkts_ps,TCA_POLICE_PAD )) goto nla_put_failure; if (nla_put_u64_64bit(skb, TCA_POLICE_PKTBURST64,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 57/160 net: sched: fix possible refcount leak in tc_chain_tmplt_add()
In reply to Greg Kroah-HartmanFrom: Hangyu Hua <[email protected]>
[ Upstream commit 44f8baaf230c655c249467ca415b570deca8df77 ]
try_module_get will be called in tcf_proto_lookup_ops. So module_put needs to be called to drop the refcount if ops don't implement the required function.
--- net/sched/cls_api.c | 1 + 1 file changed, 1 insertion(+)
net/sched/cls_api.c +1 -0
@@ -2950,6 +2950,7 @@ static int tc_chain_tmplt_add(struct tcf_chain *chain, struct net *net,return PTR_ERR (ops);if (!ops->tmplt_create || !ops->tmplt_destroy || !ops->tmplt_dump) {NL_SET_ERR_MSG (extack,"Chain templates are not supported with specified classifier" ); +module_put (ops->owner);return -EOPNOTSUPP ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 58/160 bpf: Add extra path pointer check to d_path helper
In reply to Greg Kroah-HartmanFrom: Jiri Olsa <[email protected]>
[ Upstream commit f46fab0e36e611a2389d3843f34658c849b6bd60 ]
Anastasios reported crash on stable 5.15 kernel with following BPF attached to lsm hook:
SEC("lsm.s/bprm_creds_for_exec")
int BPF_PROG(bprm_creds_for_exec, struct linux_binprm *bprm)
{
struct path *path = &bprm->executable->f_path;
char p[128] = { 0 }; bpf_d_path(path, p, 128);
return 0;}
But bprm->executable can be NULL, so bpf_d_path call will crash:
BUG: kernel NULL pointer dereference, address: 0000000000000018 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC NOPTI ... RIP: 0010:d_path+0x22/0x280 ... Call Trace: <TASK> bpf_d_path+0x21/0x60 bpf_prog_db9cf176e84498d9_bprm_creds_for_exec+0x94/0x99 bpf_trampoline_6442506293_0+0x55/0x1000 bpf_lsm_bprm_creds_for_exec+0x5/0x10 security_bprm_creds_for_exec+0x29/0x40 bprm_execve+0x1c1/0x900 do_execveat_common.isra.0+0x1af/0x260 __x64_sys_execve+0x32/0x40
It's problem for all stable trees with bpf_d_path helper, which was added in 5.9.
This issue is fixed in current bpf code, where we identify and mark trusted pointers, so the above code would fail even to load.
For the sake of the stable trees and to workaround potentially broken verifier in the future, adding the code that reads the path object from the passed pointer and verifies it's valid in kernel space.
--- kernel/trace/bpf_trace.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
kernel/trace/bpf_trace.c +11 -1
@@ -900,13 +900,23 @@ static const struct bpf_func_proto bpf_send_signal_thread_proto = { BPF_CALL_3(bpf_d_path, struct path *, path, char *, buf, u32, sz) { +struct path copy;long len;char *p;if (!sz)return 0 ; - p =d_path (path, buf, sz); +/* +* The path pointer is verified as trusted and safe to use, +* but let's double check it's valid anyway to workaround +* potentially broken verifier. +*/ + len =copy_from_kernel_nofault (©, path,sizeof (*path)); +if (len <0 ) +return len; + + p =d_path (©, buf, sz);if (IS_ERR (p)) { len =PTR_ERR (p); }else {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 59/160 drm/amdgpu: fix Null pointer dereference error in amdgpu_device_recover_vram
In reply to Greg Kroah-HartmanFrom: Horatio Zhang <[email protected]>
[ Upstream commit 2a1eb1a343208ce7d6839b73d62aece343e693ff ]
Use the function of amdgpu_bo_vm_destroy to handle the resource release of shadow bo. During the amdgpu_mes_self_test, shadow bo released, but vmbo->shadow_list was not, which caused a null pointer reference error in amdgpu_device_recover_vram when GPU reset.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 10 ++++------ drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c | 1 - 2 files changed, 4 insertions(+), 7 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +4 -6
@@ -79,9 +79,10 @@ static void amdgpu_bo_user_destroy(struct ttm_buffer_object *tbo)static void amdgpu_bo_vm_destroy (struct ttm_buffer_object *tbo) {struct amdgpu_device *adev =amdgpu_ttm_adev (tbo->bdev); -struct amdgpu_bo *bo =ttm_to_amdgpu_bo (tbo); +struct amdgpu_bo *shadow_bo =ttm_to_amdgpu_bo (tbo), *bo;struct amdgpu_bo_vm *vmbo; + bo = shadow_bo->parent; vmbo =to_amdgpu_bo_vm (bo);/* in case amdgpu_device_recover_vram got NULL of bo->parent */ if (!list_empty (&vmbo->shadow_list)) {
@@ -694,11 +695,6 @@ int amdgpu_bo_create_vm(struct amdgpu_device *adev,return r; *vmbo_ptr =to_amdgpu_bo_vm (bo_ptr); -INIT_LIST_HEAD (&(*vmbo_ptr)->shadow_list); -/* Set destroy callback to amdgpu_bo_vm_destroy after vmbo->shadow_list -* is initialized. -*/ - bo_ptr->tbo.destroy = &amdgpu_bo_vm_destroy;return r; }
@@ -715,6 +711,8 @@ void amdgpu_bo_add_to_shadow_list(struct amdgpu_bo_vm *vmbo)mutex_lock (&adev->shadow_list_lock);list_add_tail (&vmbo->shadow_list, &adev->shadow_list); + vmbo->shadow->parent =amdgpu_bo_ref (&vmbo->bo); + vmbo->shadow->tbo.destroy = &amdgpu_bo_vm_destroy;mutex_unlock (&adev->shadow_list_lock); }
drivers/gpu/drm/amd/amdgpu/amdgpu_vm_pt.c +0 -1
@@ -564,7 +564,6 @@ int amdgpu_vm_pt_create(struct amdgpu_device *adev, struct amdgpu_vm *vm,return r; } - (*vmbo)->shadow->parent =amdgpu_bo_ref (bo);amdgpu_bo_add_to_shadow_list (*vmbo);return 0 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 60/160 lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release()
In reply to Greg Kroah-HartmanFrom: Ben Hutchings <[email protected]>
[ Upstream commit 7c5d4801ecf0564c860033d89726b99723c55146 ]
irq_cpu_rmap_release() calls cpu_rmap_put(), which may free the rmap. So we need to clear the pointer to our glue structure in rmap before doing that, not after.
--- lib/cpu_rmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/cpu_rmap.c +1 -1
@@ -268,8 +268,8 @@ static void irq_cpu_rmap_release(struct kref *ref)struct irq_glue *glue = container_of(ref, struct irq_glue, notify.kref); -cpu_rmap_put (glue->rmap); glue->rmap->obj[glue->index] =NULL ; +cpu_rmap_put (glue->rmap);kfree (glue); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 61/160 net: bcmgenet: Fix EEE implementation
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit a9f31047baca57d47440c879cf259b86f900260c ]
We had a number of short comings:
- EEE must be re-evaluated whenever the state machine detects a link change as wight be switching from a link partner with EEE enabled/disabled
- tx_lpi_enabled controls whether EEE should be enabled/disabled for the transmit path, which applies to the TBUF block
- We do not need to forcibly enable EEE upon system resume, as the PHY state machine will trigger a link event that will do that, too
--- .../net/ethernet/broadcom/genet/bcmgenet.c | 22 +++++++------------ .../net/ethernet/broadcom/genet/bcmgenet.h | 3 +++ drivers/net/ethernet/broadcom/genet/bcmmii.c | 5 +++++ 3 files changed, 16 insertions(+), 14 deletions(-)
drivers/net/ethernet/broadcom/genet/bcmgenet.c +8 -14
@@ -1272,7 +1272,8 @@ static void bcmgenet_get_ethtool_stats(struct net_device *dev, } } -static void bcmgenet_eee_enable_set (struct net_device *dev,bool enable) +void bcmgenet_eee_enable_set (struct net_device *dev,bool enable, +bool tx_lpi_enabled) {struct bcmgenet_priv *priv =netdev_priv (dev);u32 off = priv->hw_params->tbuf_offset +TBUF_ENERGY_CTRL ;
@@ -1292,7 +1293,7 @@ static void bcmgenet_eee_enable_set(struct net_device *dev, bool enable)/* Enable EEE and switch to a 27Mhz clock automatically */ reg =bcmgenet_readl (priv->base + off); -if (enable) +if (tx_lpi_enabled) reg |=TBUF_EEE_EN |TBUF_PM_EN ;else reg &= ~(TBUF_EEE_EN |TBUF_PM_EN );
@@ -1313,6 +1314,7 @@ static void bcmgenet_eee_enable_set(struct net_device *dev, bool enable) priv->eee.eee_enabled = enable; priv->eee.eee_active = enable; + priv->eee.tx_lpi_enabled = tx_lpi_enabled; }static int bcmgenet_get_eee (struct net_device *dev,struct ethtool_eee *e)
@@ -1328,6 +1330,7 @@ static int bcmgenet_get_eee(struct net_device *dev, struct ethtool_eee *e) e->eee_enabled = p->eee_enabled; e->eee_active = p->eee_active; + e->tx_lpi_enabled = p->tx_lpi_enabled; e->tx_lpi_timer =bcmgenet_umac_readl (priv,UMAC_EEE_LPI_TIMER );return phy_ethtool_get_eee (dev->phydev, e);
@@ -1337,7 +1340,6 @@ static int bcmgenet_set_eee(struct net_device *dev, struct ethtool_eee *e) {struct bcmgenet_priv *priv =netdev_priv (dev);struct ethtool_eee *p = &priv->eee; -int ret =0 ;if (GENET_IS_V1 (priv))return -EOPNOTSUPP ;
@@ -1348,16 +1350,11 @@ static int bcmgenet_set_eee(struct net_device *dev, struct ethtool_eee *e) p->eee_enabled = e->eee_enabled;if (!p->eee_enabled) { -bcmgenet_eee_enable_set (dev, false); +bcmgenet_eee_enable_set (dev, false, false); }else { - ret =phy_init_eee (dev->phydev, false); -if (ret) { -netif_err (priv, hw, dev,"EEE initialization failed\n" ); -return ret; - } - + p->eee_active =phy_init_eee (dev->phydev, false) >=0 ;bcmgenet_umac_writel (priv, e->tx_lpi_timer,UMAC_EEE_LPI_TIMER ); -bcmgenet_eee_enable_set (dev, true); +bcmgenet_eee_enable_set (dev, p->eee_active, e->tx_lpi_enabled); }return phy_ethtool_set_eee (dev->phydev, e);
@@ -4279,9 +4276,6 @@ static int bcmgenet_resume(struct device *d)if (!device_may_wakeup (d))phy_resume (dev->phydev); -if (priv->eee.eee_enabled) -bcmgenet_eee_enable_set (dev, true); -bcmgenet_netif_start (dev);netif_device_attach (dev);
drivers/net/ethernet/broadcom/genet/bcmgenet.h +3 -0
@@ -703,4 +703,7 @@ int bcmgenet_wol_power_down_cfg(struct bcmgenet_priv *priv,void bcmgenet_wol_power_up_cfg (struct bcmgenet_priv *priv,enum bcmgenet_power_mode mode); +void bcmgenet_eee_enable_set (struct net_device *dev,bool enable, +bool tx_lpi_enabled); +#endif /* __BCMGENET_H__ */
drivers/net/ethernet/broadcom/genet/bcmmii.c +5 -0
@@ -87,6 +87,11 @@ static void bcmgenet_mac_config(struct net_device *dev) reg |=CMD_TX_EN |CMD_RX_EN ; }bcmgenet_umac_writel (priv, reg,UMAC_CMD ); + + priv->eee.eee_active =phy_init_eee (phydev,0 ) >=0 ; +bcmgenet_eee_enable_set (dev, + priv->eee.eee_enabled && priv->eee.eee_active, + priv->eee.tx_lpi_enabled); }/* setup netdev link state when PHY link status change and
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 62/160 accel/ivpu: Do not use mutex_lock_interruptible
In reply to Greg Kroah-HartmanFrom: Stanislaw Gruszka <[email protected]>
[ Upstream commit b563e47957af4ff71736c5cc4120a59b055ab583 ]
If we get signal when waiting for the mmu->lock we do not invalidate current MMU configuration that might result in undefined behavior.
Additionally there is little or no benefit on break waiting for ipc->lock. In current code base, we keep this lock for short periods.
--- drivers/accel/ivpu/ivpu_ipc.c | 4 +--- drivers/accel/ivpu/ivpu_mmu.c | 22 ++++++---------------- 2 files changed, 7 insertions(+), 19 deletions(-)
drivers/accel/ivpu/ivpu_ipc.c +1 -3
@@ -183,9 +183,7 @@ ivpu_ipc_send(struct ivpu_device *vdev, struct ivpu_ipc_consumer *cons, struct vstruct ivpu_ipc_info *ipc = vdev->ipc;int ret; - ret =mutex_lock_interruptible (&ipc->lock); -if (ret) -return ret; +mutex_lock (&ipc->lock);if (!ipc->on) { ret = -EAGAIN ;
drivers/accel/ivpu/ivpu_mmu.c +6 -16
@@ -587,16 +587,11 @@ static int ivpu_mmu_strtab_init(struct ivpu_device *vdev)int ivpu_mmu_invalidate_tlb (struct ivpu_device *vdev,u16 ssid) {struct ivpu_mmu_info *mmu = vdev->mmu; -int ret; - - ret =mutex_lock_interruptible (&mmu->lock); -if (ret) -return ret; +int ret =0 ; -if (!mmu->on) { - ret =0 ; +mutex_lock (&mmu->lock); +if (!mmu->on) goto unlock; - } ret =ivpu_mmu_cmdq_write_tlbi_nh_asid (vdev, ssid);if (ret)
@@ -614,7 +609,7 @@ static int ivpu_mmu_cd_add(struct ivpu_device *vdev, u32 ssid, u64 cd_dma)struct ivpu_mmu_cdtab *cdtab = &mmu->cdtab;u64 *entry;u64 cd[4 ]; -int ret; +int ret =0 ;if (ssid >IVPU_MMU_CDTAB_ENT_COUNT )return -EINVAL ;
@@ -655,14 +650,9 @@ static int ivpu_mmu_cd_add(struct ivpu_device *vdev, u32 ssid, u64 cd_dma)ivpu_dbg (vdev,MMU ,"CDTAB %s entry (SSID=%u, dma=%pad): 0x%llx, 0x%llx, 0x%llx, 0x%llx\n" , cd_dma ?"write" :"clear" , ssid, &cd_dma, cd[0 ], cd[1 ], cd[2 ], cd[3 ]); - ret =mutex_lock_interruptible (&mmu->lock); -if (ret) -return ret; - -if (!mmu->on) { - ret =0 ; +mutex_lock (&mmu->lock); +if (!mmu->on) goto unlock; - } ret =ivpu_mmu_cmdq_write_cfgi_all (vdev);if (ret)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 63/160 bnxt_en: Fix bnxt_hwrm_update_rss_hash_cfg()
In reply to Greg Kroah-HartmanFrom: Pavan Chebbi <[email protected]>
[ Upstream commit 095d5dc0c1d9f3284e3c575ccf4c0e8b04b548f8 ]
We must specify the vnic id of the vnic in the input structure of this firmware message. Otherwise we will get an error from the firmware.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +1 -0
@@ -5376,6 +5376,7 @@ static void bnxt_hwrm_update_rss_hash_cfg(struct bnxt *bp)if (hwrm_req_init (bp, req,HWRM_VNIC_RSS_QCFG ))return ; + req->vnic_id =cpu_to_le16 (vnic->fw_vnic_id);/* all contexts configured to same hash_type, zero always exists */ req->rss_ctx_idx =cpu_to_le16 (vnic->fw_rss_cos_lb_ctx[0 ]); resp =hwrm_req_hold (bp, req);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 64/160 bnxt_en: Dont issue AP reset during ethtools reset operation
In reply to Greg Kroah-HartmanFrom: Sreekanth Reddy <[email protected]>
[ Upstream commit 1d997801c7cc6a7f542e46d5a6bf16f893ad3fe9 ]
Only older NIC controller's firmware uses the PROC AP reset type. Firmware on 5731X/5741X and newer chips does not support this reset type. When bnxt_reset() issues a series of resets, this PROC AP reset may actually fail on these newer chips because the firmware is not ready to accept this unsupported command yet. Avoid this unnecessary error by skipping this reset type on chips that don't support it.
--- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +1 -1
@@ -3831,7 +3831,7 @@ static int bnxt_reset(struct net_device *dev, u32 *flags) } } -if (req &BNXT_FW_RESET_AP ) { +if (!BNXT_CHIP_P4_PLUS (bp) && (req &BNXT_FW_RESET_AP )) {/* This feature is not supported in older firmware versions */ if (bp->hwrm_spec_code >=0x10803 ) {if (!bnxt_firmware_reset_ap (dev)) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 65/160 bnxt_en: Query default VLAN before VNIC setup on a VF
In reply to Greg Kroah-HartmanFrom: Somnath Kotur <[email protected]>
[ Upstream commit 1a9e4f501bc6ff1b6ecb60df54fbf2b54db43bfe ]
We need to call bnxt_hwrm_func_qcfg() on a VF to query the default VLAN that may be setup by the PF. If a default VLAN is enabled, the VF cannot support VLAN acceleration on the receive side and the VNIC must be setup to strip out the default VLAN tag. If a default VLAN is not enabled, the VF can support VLAN acceleration on the receive side. The VNIC should be set up to strip or not strip the VLAN based on the RX VLAN acceleration setting.
Without this call to determine the default VLAN before calling bnxt_setup_vnic(), the VNIC may not be set up correctly. For example, bnxt_setup_vnic() may set up to strip the VLAN tag based on stale default VLAN information. If RX VLAN acceleration is not enabled, the VLAN tag will be incorrectly stripped and the RX data path will not work correctly.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +3 -0
@@ -8839,6 +8839,9 @@ static int bnxt_init_chip(struct bnxt *bp, bool irq_re_init) goto err_out; } +if (BNXT_VF (bp)) +bnxt_hwrm_func_qcfg (bp); + rc =bnxt_setup_vnic (bp,0 );if (rc) goto err_out;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 66/160 bnxt_en: Skip firmware fatal error recovery if chip is not accessible
In reply to Greg Kroah-HartmanFrom: Vikas Gupta <[email protected]>
[ Upstream commit 83474a9b252ab23e6003865c2775024344cb9c09 ]
Driver starts firmware fatal error recovery by detecting heartbeat failure or fw reset count register changing. But these checks are not reliable if the device is not accessible. This can happen while DPC (Downstream Port containment) is in progress. Skip firmware fatal recovery if pci_device_is_present() returns false.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +3 -2
@@ -11628,6 +11628,7 @@ static void bnxt_tx_timeout(struct net_device *dev, unsigned int txqueue)static void bnxt_fw_health_check (struct bnxt *bp) {struct bnxt_fw_health *fw_health = bp->fw_health; +struct pci_dev *pdev = bp->pdev;u32 val;if (!fw_health->enabled ||test_bit (BNXT_STATE_IN_FW_RESET , &bp->state))
@@ -11641,7 +11642,7 @@ static void bnxt_fw_health_check(struct bnxt *bp) } val =bnxt_fw_health_readl (bp,BNXT_FW_HEARTBEAT_REG ); -if (val == fw_health->last_fw_heartbeat) { +if (val == fw_health->last_fw_heartbeat &&pci_device_is_present (pdev)) { fw_health->arrests++; goto fw_reset; }
@@ -11649,7 +11650,7 @@ static void bnxt_fw_health_check(struct bnxt *bp) fw_health->last_fw_heartbeat = val; val =bnxt_fw_health_readl (bp,BNXT_FW_RESET_CNT_REG ); -if (val != fw_health->last_fw_reset_cnt) { +if (val != fw_health->last_fw_reset_cnt &&pci_device_is_present (pdev)) { fw_health->discoveries++; goto fw_reset; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 67/160 bnxt_en: Prevent kernel panic when receiving unexpected PHC_UPDATE event
In reply to Greg Kroah-HartmanFrom: Pavan Chebbi <[email protected]>
[ Upstream commit 319a7827df9784048abe072afe6b4fb4501d8de4 ]
The firmware can send PHC_RTC_UPDATE async event on a PF that may not have PTP registered. In such a case, there will be a null pointer deference for bp->ptp_cfg when we try to handle the event.
Fix it by not registering for this event with the firmware if !bp->ptp_cfg. Also, check that bp->ptp_cfg is valid before proceeding when we receive the event.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 ++++++ drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 1 + 2 files changed, 7 insertions(+)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +6 -0
@@ -2392,6 +2392,9 @@ static int bnxt_async_event_process(struct bnxt *bp,struct bnxt_ptp_cfg *ptp = bp->ptp_cfg;u64 ns; +if (!ptp) + goto async_event_process_exit; +spin_lock_bh (&ptp->ptp_lock);bnxt_ptp_update_current_time (bp); ns = (((u64)BNXT_EVENT_PHC_RTC_UPDATE(data1) <<
@@ -4789,6 +4792,9 @@ int bnxt_hwrm_func_drv_rgtr(struct bnxt *bp, unsigned long *bmap, int bmap_size,if (event_id ==ASYNC_EVENT_CMPL_EVENT_ID_ERROR_RECOVERY && !(bp->fw_cap &BNXT_FW_CAP_ERROR_RECOVERY ))continue ; +if (event_id ==ASYNC_EVENT_CMPL_EVENT_ID_PHC_UPDATE && + !bp->ptp_cfg) +continue ;__set_bit (bnxt_async_events_arr[i], async_events_bmap); }if (bmap && bmap_size) {
drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c +1 -0
@@ -946,6 +946,7 @@ int bnxt_ptp_init(struct bnxt *bp, bool phc_cfg)bnxt_ptp_timecounter_init (bp, true);bnxt_ptp_adjfine_rtc (bp,0 ); } +bnxt_hwrm_func_drv_rgtr (bp,NULL ,0 , true); ptp->ptp_info = bnxt_ptp_caps;if ((bp->fw_cap &BNXT_FW_CAP_PTP_PPS )) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 68/160 bnxt_en: Implement .set_port / .unset_port UDP tunnel callbacks
In reply to Greg Kroah-HartmanFrom: Somnath Kotur <[email protected]>
[ Upstream commit 1eb4ef12591348c440ac9d6efcf7521e73cf2b10 ]
As per the new udp tunnel framework, drivers which need to know the details of a port entry (i.e. port type) when it gets deleted should use the .set_port / .unset_port callbacks.
Implementing the current .udp_tunnel_sync callback would mean that the deleted tunnel port entry would be all zeros. This used to work on older firmware because it would not check the input when deleting a tunnel port. With newer firmware, the delete will now fail and subsequent tunnel port allocation will fail as a result.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 25 ++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +18 -7
@@ -13062,26 +13062,37 @@ static void bnxt_cfg_ntp_filters(struct bnxt *bp)#endif /* CONFIG_RFS_ACCEL */ -static int bnxt_udp_tunnel_sync (struct net_device *netdev,unsigned int table) +static int bnxt_udp_tunnel_set_port (struct net_device *netdev,unsigned int table, +unsigned int entry,struct udp_tunnel_info *ti) {struct bnxt *bp =netdev_priv (netdev); -struct udp_tunnel_info ti;unsigned int cmd; -udp_tunnel_nic_get_port (netdev, table,0 , &ti); -if (ti.type ==UDP_TUNNEL_TYPE_VXLAN ) +if (ti->type ==UDP_TUNNEL_TYPE_VXLAN ) cmd =TUNNEL_DST_PORT_FREE_REQ_TUNNEL_TYPE_VXLAN ;else cmd =TUNNEL_DST_PORT_FREE_REQ_TUNNEL_TYPE_GENEVE ; -if (ti.port) -return bnxt_hwrm_tunnel_dst_port_alloc (bp, ti.port, cmd); +return bnxt_hwrm_tunnel_dst_port_alloc (bp, ti->port, cmd); +} + +static int bnxt_udp_tunnel_unset_port (struct net_device *netdev,unsigned int table, +unsigned int entry,struct udp_tunnel_info *ti) +{ +struct bnxt *bp =netdev_priv (netdev); +unsigned int cmd; + +if (ti->type ==UDP_TUNNEL_TYPE_VXLAN ) + cmd =TUNNEL_DST_PORT_FREE_REQ_TUNNEL_TYPE_VXLAN ; +else + cmd =TUNNEL_DST_PORT_FREE_REQ_TUNNEL_TYPE_GENEVE ;return bnxt_hwrm_tunnel_dst_port_free (bp, cmd); }static const struct udp_tunnel_nic_info bnxt_udp_tunnels = { - .sync_table = bnxt_udp_tunnel_sync, + .set_port = bnxt_udp_tunnel_set_port, + .unset_port = bnxt_udp_tunnel_unset_port, .flags =UDP_TUNNEL_NIC_INFO_MAY_SLEEP |UDP_TUNNEL_NIC_INFO_OPEN_ONLY , .tables = {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 69/160 drm/msm/a6xx: initialize GMU mutex earlier
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit 12abd735f0300600bfc01b2a3832b966312df205 ]
Move GMU mutex initialization earlier to make sure that it is always initialized. a6xx_destroy can be called from ther failure path before GMU initialization.
This fixes the following backtrace:
------------[ cut here ]------------ DEBUG_LOCKS_WARN_ON(lock->magic != lock) WARNING: CPU: 0 PID: 58 at kernel/locking/mutex.c:582 __mutex_lock+0x1ec/0x3d0 Modules linked in: CPU: 0 PID: 58 Comm: kworker/u16:1 Not tainted 6.3.0-rc5-00155-g187c06436519 #565 Hardware name: Qualcomm Technologies, Inc. SM8350 HDK (DT) Workqueue: events_unbound deferred_probe_work_func pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __mutex_lock+0x1ec/0x3d0 lr : __mutex_lock+0x1ec/0x3d0
sp : ffff800008993620
x29: ffff800008993620 x28: 0000000000000002 x27: ffff47b253c52800
x26: 0000000001000606 x25: ffff47b240bb2810 x24: fffffffffffffff4
x23: 0000000000000000 x22: ffffc38bba15ac14 x21: 0000000000000002
x20: ffff800008993690 x19: ffff47b2430cc668 x18: fffffffffffe98f0
x17: 6f74616c75676572 x16: 20796d6d75642067 x15: 0000000000000038
x14: 0000000000000000 x13: ffffc38bbba050b8 x12: 0000000000000666
x11: 0000000000000222 x10: ffffc38bbba603e8 x9 : ffffc38bbba050b8 x8 : 00000000ffffefff x7 : ffffc38bbba5d0b8 x6 : 0000000000000222 x5 : 000000000000bff4 x4 : 40000000fffff222 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff47b240cb1880
Call trace: __mutex_lock+0x1ec/0x3d0 mutex_lock_nested+0x2c/0x38 a6xx_destroy+0xa0/0x138 a6xx_gpu_init+0x41c/0x618 adreno_bind+0x188/0x290 component_bind_all+0x118/0x248 msm_drm_bind+0x1c0/0x670 try_to_bring_up_aggregate_device+0x164/0x1d0 __component_add+0xa8/0x16c component_add+0x14/0x20 dsi_dev_attach+0x20/0x2c dsi_host_attach+0x9c/0x144 devm_mipi_dsi_attach+0x34/0xac lt9611uxc_attach_dsi.isra.0+0x84/0xfc lt9611uxc_probe+0x5b8/0x67c i2c_device_probe+0x1ac/0x358 really_probe+0x148/0x2ac __driver_probe_device+0x78/0xe0 driver_probe_device+0x3c/0x160 __device_attach_driver+0xb8/0x138 bus_for_each_drv+0x84/0xe0 __device_attach+0x9c/0x188 device_initial_probe+0x14/0x20 bus_probe_device+0xac/0xb0 deferred_probe_work_func+0x8c/0xc8 process_one_work+0x2bc/0x594 worker_thread+0x228/0x438 kthread+0x108/0x10c ret_from_fork+0x10/0x20 irq event stamp: 299345 hardirqs last enabled at (299345): [<ffffc38bb9ba61e4>] put_cpu_partial+0x1c8/0x22c hardirqs last disabled at (299344): [<ffffc38bb9ba61dc>] put_cpu_partial+0x1c0/0x22c softirqs last enabled at (296752): [<ffffc38bb9890434>] _stext+0x434/0x4e8 softirqs last disabled at (296741): [<ffffc38bb989669c>] ____do_softirq+0x10/0x1c ---[ end trace 0000000000000000 ]---
Patchwork: https://patchwork.freedesktop.org/patch/531540/
--- drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 2 -- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 2 ++ 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/msm/adreno/a6xx_gmu.c +0 -2
@@ -1514,8 +1514,6 @@ int a6xx_gmu_init(struct a6xx_gpu *a6xx_gpu, struct device_node *node)if (!pdev)return -ENODEV ; -mutex_init (&gmu->lock); - gmu->dev = &pdev->dev;of_dma_configure (gmu->dev, node, true);
drivers/gpu/drm/msm/adreno/a6xx_gpu.c +2 -0
@@ -1998,6 +1998,8 @@ struct msm_gpu *a6xx_gpu_init(struct drm_device *dev) adreno_gpu = &a6xx_gpu->base; gpu = &adreno_gpu->base; +mutex_init (&a6xx_gpu->gmu.lock); + adreno_gpu->registers =NULL ;/*
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 70/160 batman-adv: Broken sync while rescheduling delayed work
In reply to Greg Kroah-HartmanFrom: Vladislav Efanov <[email protected]>
commit abac3ac97fe8734b620e7322a116450d7f90aa43 upstream.
Syzkaller got a lot of crashes like:
KASAN: use-after-free Write in *_timers*
All of these crashes point to the same memory area:
The buggy address belongs to the object at ffff88801f870000 which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 5320 bytes inside of
8192-byte region [ffff88801f870000, ffff88801f872000)
This area belongs to :
batadv_priv->batadv_priv_dat->delayed_work->timer_list
The reason for these issues is the lack of synchronization. Delayed work (batadv_dat_purge) schedules new timer/work while the device is being deleted. As the result new timer/delayed work is set after cancel_delayed_work_sync() was called. So after the device is freed the timer list contains pointer to already freed memory.
Found by Linux Verification Center (linuxtesting.org) with syzkaller.
--- net/batman-adv/distributed-arp-table.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/batman-adv/distributed-arp-table.c +1 -1
@@ -101,7 +101,6 @@ static void batadv_dat_purge(struct work*/ static void batadv_dat_start_timer (struct batadv_priv *bat_priv) { -INIT_DELAYED_WORK (&bat_priv->dat.work, batadv_dat_purge);queue_delayed_work (batadv_event_workqueue, &bat_priv->dat.work,msecs_to_jiffies (10000 )); }
@@ -819,6 +818,7 @@ int batadv_dat_init(struct batadv_priv *if (!bat_priv->dat.hash)return -ENOMEM ; +INIT_DELAYED_WORK (&bat_priv->dat.work, batadv_dat_purge);batadv_dat_start_timer (bat_priv); batadv_tvlv_handler_register(bat_priv, batadv_dat_tvlv_ogm_handler_v1,
Greg Kroah-Hartman
maintainerPATCH 71/160 Input: xpad - delete a Razer DeathAdder mouse VID/PID entry
In reply to Greg Kroah-HartmanFrom: Ismael Ferreras Morezuelas <[email protected]>
commit feee70f4568650cf44c573488798ffc0a2faeea3 upstream.
While doing my research to improve the xpad device names I noticed that the 1532:0037 VID/PID seems to be used by the DeathAdder 2013, so that Razer Sabertooth instance looked wrong and very suspect to me. I didn't see any mention in the official drivers, either.
After doing more research, it turns out that the xpad list is used by many other projects (like Steam) as-is [1], this issue was reported [2] and Valve/Sam Lantinga fixed it [3]:
[1]: https://github.com/libsdl-org/SDL/blob/dcc5eef0e2395854b254ea2873a4899edab347c6/src/joystick/controller_type.h#L251
[2]: https://steamcommunity.com/app/353380/discussions/0/1743392486228754770/
[3]: https://hg.libsdl.org/SDL/rev/29809f6f0271
(With multiple Internet users reporting similar issues, not linked here)
After not being able to find the correct VID/PID combination anywhere on the Internet and not receiving any reply from Razer support I did some additional detective work, it seems like it presents itself as "Razer Sabertooth Gaming Controller (XBOX360)", code 1689:FE00.
Leaving us with this:
* Razer Sabertooth (1689:fe00)
* Razer Sabertooth Elite (24c6:5d04)
* Razer DeathAdder 2013 (1532:0037) [note: not a gamepad]
So, to sum things up; remove this conflicting/duplicate entry:
{ 0x1532, 0x0037, "Razer Sabertooth", 0, XTYPE_XBOX360 },
As the real/correct one is already present there, even if the Internet as a whole insists on presenting it as the Razer Sabertooth Elite, which (by all accounts) is not:
{ 0x1689, 0xfe00, "Razer Sabertooth", 0, XTYPE_XBOX360 },
Actual change in SDL2 referencing this kernel issue:
https://github.com/libsdl-org/SDL/commit/e5e54169754ca5d3e86339d968b20126d9da0a15
For more information of the device, take a look here:
https://github.com/xboxdrv/xboxdrv/pull/59
You can see a lsusb dump here: https://github.com/xboxdrv/xboxdrv/files/76581/Qa6dBcrv.txt
--- drivers/input/joystick/xpad.c | 1 - 1 file changed, 1 deletion(-)
drivers/input/joystick/xpad.c +0 -1
@@ -282,7 +282,6 @@ static const struct xpad_device { { 0x1430, 0xf801, "RedOctane Controller", 0, XTYPE_XBOX360 }, { 0x146b, 0x0601, "BigBen Interactive XBOX 360 Controller", 0, XTYPE_XBOX360 }, { 0x146b, 0x0604, "Bigben Interactive DAIJA Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, - { 0x1532, 0x0037, "Razer Sabertooth", 0, XTYPE_XBOX360 }, { 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE }, { 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 },
Greg Kroah-Hartman
maintainerPATCH 72/160 Input: cyttsp5 - fix array length
In reply to Greg Kroah-HartmanFrom: Maximilian Weigand <[email protected]>
commit 529de2f1ca3f0898c0d905b7d355a43dce1de7dc upstream.
The cmd array should be initialized with the proper command size and not with the actual command value that is sent to the touchscreen.
--- drivers/input/touchscreen/cyttsp5.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/input/touchscreen/cyttsp5.c +1 -1
@@ -560,7 +560,7 @@ static int cyttsp5_hid_output_get_sysinfo(struct cyttsp5 *ts)static int cyttsp5_hid_output_bl_launch_app (struct cyttsp5 *ts) {int rc; -u8 cmd[HID_OUTPUT_BL_LAUNCH_APP ]; +u8 cmd[HID_OUTPUT_BL_LAUNCH_APP_SIZE ];u16 crc;put_unaligned_le16 (HID_OUTPUT_BL_LAUNCH_APP_SIZE , cmd);
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 73/160 Input: psmouse - fix OOB access in Elantech protocol
In reply to Greg Kroah-HartmanFrom: Dmitry Torokhov <[email protected]>
commit 7b63a88bb62ba2ddf5fcd956be85fe46624628b9 upstream.
The kernel only allocate 5 MT slots; check that transmitted slot ID falls within the acceptable range.
--- drivers/input/mouse/elantech.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/input/mouse/elantech.c +5 -4
@@ -674,10 +674,11 @@ static void process_packet_head_v4(strucstruct input_dev *dev = psmouse->dev;struct elantech_data *etd = psmouse->private;unsigned char *packet = psmouse->packet; -int id = ((packet[3 ] &0xe0 ) >>5 ) -1 ; +int id;int pres, traces; -if (id <0 ) + id = ((packet[3 ] &0xe0 ) >>5 ) -1 ; +if (id <0 || id >=ETP_MAX_FINGERS )return ; etd->mt[id].x = ((packet[1 ] &0x0f ) <<8 ) | packet[2 ];
@@ -707,7 +708,7 @@ static void process_packet_motion_v4(strint id, sid; id = ((packet[0 ] &0xe0 ) >>5 ) -1 ; -if (id <0 ) +if (id <0 || id >=ETP_MAX_FINGERS )return ; sid = ((packet[3 ] &0xe0 ) >>5 ) -1 ;
@@ -728,7 +729,7 @@ static void process_packet_motion_v4(strinput_report_abs (dev,ABS_MT_POSITION_X , etd->mt[id].x);input_report_abs (dev,ABS_MT_POSITION_Y , etd->mt[id].y); -if (sid >=0 ) { +if (sid >=0 && sid <ETP_MAX_FINGERS ) { etd->mt[sid].x += delta_x2 * weight; etd->mt[sid].y -= delta_y2 * weight;input_mt_slot (dev, sid);
Greg Kroah-Hartman
maintainerPATCH 74/160 Input: fix open count when closing inhibited device
In reply to Greg Kroah-HartmanFrom: Dmitry Torokhov <[email protected]>
commit 978134c4b192ed04ecf699be3e1b4d23b5d20457 upstream.
Because the kernel increments device's open count in input_open_device() even if device is inhibited, the counter should always be decremented in input_close_device() to keep it balanced.
--- drivers/input/input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/input/input.c +1 -1
@@ -703,7 +703,7 @@ void input_close_device(struct input_han__input_release_device (handle); -if (!dev->inhibited && !--dev->users) { +if (!--dev->users && !dev->inhibited) {if (dev->poller)input_dev_poller_stop (dev->poller);if (dev->close)
Greg Kroah-Hartman
maintainerPATCH 75/160 ALSA: hda: Fix kctl->id initialization
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 5c219a340850233aecbb444af964653ecd3d1370 upstream.
HD-audio core code replaces the kctl->id.index of SPDIF-related controls after assigning via snd_ctl_add(). This doesn't work any longer with the new Xarray lookup change. The change of the kctl->id content has to be done via snd_ctl_rename_id() helper, instead.
--- sound/pci/hda/hda_codec.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
sound/pci/hda/hda_codec.c +5 -1
@@ -2458,10 +2458,14 @@ int snd_hda_create_dig_out_ctls(struct h type == HDA_PCM_TYPE_HDMI) {/* suppose a single SPDIF device */ for (dig_mix = dig_mixes; dig_mix->name; dig_mix++) { +struct snd_ctl_elem_id id; + kctl =find_mixer_ctl (codec, dig_mix->name,0 ,0 );if (!kctl)break ; - kctl->id.index = spdif_index; + id = kctl->id; + id.index = spdif_index; +snd_ctl_rename_id (codec->card, &kctl->id, &id); } bus->primary_dig_out_type =HDA_PCM_TYPE_HDMI ; }
Greg Kroah-Hartman
maintainerPATCH 76/160 ALSA: ymfpci: Fix kctl->id initialization
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit c9b83ae4a1609b1914ba7fc70826a3f3a8b234db upstream.
ymfpci driver replaces the kctl->id.device after assigning the kctl via snd_ctl_add(). This doesn't work any longer with the new Xarray lookup change. It has to be set before snd_ctl_add() call instead.
--- sound/pci/ymfpci/ymfpci_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/pci/ymfpci/ymfpci_main.c +3 -3
@@ -1827,20 +1827,20 @@ int snd_ymfpci_mixer(struct snd_ymfpci *if (snd_BUG_ON (!chip->pcm_spdif))return -ENXIO ; kctl =snd_ctl_new1 (&snd_ymfpci_spdif_default, chip); + kctl->id.device = chip->pcm_spdif->device; err =snd_ctl_add (chip->card, kctl);if (err <0 )return err; - kctl->id.device = chip->pcm_spdif->device; kctl =snd_ctl_new1 (&snd_ymfpci_spdif_mask, chip); + kctl->id.device = chip->pcm_spdif->device; err =snd_ctl_add (chip->card, kctl);if (err <0 )return err; - kctl->id.device = chip->pcm_spdif->device; kctl =snd_ctl_new1 (&snd_ymfpci_spdif_stream, chip); + kctl->id.device = chip->pcm_spdif->device; err =snd_ctl_add (chip->card, kctl);if (err <0 )return err; - kctl->id.device = chip->pcm_spdif->device; chip->spdif_pcm_ctl = kctl;/* direct recording source */
Greg Kroah-Hartman
maintainerPATCH 77/160 ALSA: gus: Fix kctl->id initialization
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit c5ae57b1bb99bd6f50b90428fabde397c2aeba0f upstream.
GUS driver replaces the kctl->id.index after assigning the kctl via snd_ctl_add(). This doesn't work any longer with the new Xarray lookup change. It has to be set before snd_ctl_add() call instead.
--- sound/isa/gus/gus_pcm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/isa/gus/gus_pcm.c +1 -1
@@ -892,10 +892,10 @@ int snd_gf1_pcm_new(struct snd_gus_card kctl =snd_ctl_new1 (&snd_gf1_pcm_volume_control1, gus); else kctl =snd_ctl_new1 (&snd_gf1_pcm_volume_control, gus); + kctl->id.index = control_index; err =snd_ctl_add (card, kctl);if (err <0 )return err; - kctl->id.index = control_index;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 78/160 ALSA: cmipci: Fix kctl->id initialization
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit f2f312ad88c68a7f4a7789b9269ae33af3c7c7e9 upstream.
cmipci driver replaces the kctl->id.device after assigning the kctl via snd_ctl_add(). This doesn't work any longer with the new Xarray lookup change. It has to be set before snd_ctl_add() call instead.
--- sound/pci/cmipci.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/pci/cmipci.c +3 -3
@@ -2688,20 +2688,20 @@ static int snd_cmipci_mixer_new(struct c }if (cm->can_ac3_hw) { kctl =snd_ctl_new1 (&snd_cmipci_spdif_default, cm); + kctl->id.device = pcm_spdif_device; err =snd_ctl_add (card, kctl);if (err <0 )return err; - kctl->id.device = pcm_spdif_device; kctl =snd_ctl_new1 (&snd_cmipci_spdif_mask, cm); + kctl->id.device = pcm_spdif_device; err =snd_ctl_add (card, kctl);if (err <0 )return err; - kctl->id.device = pcm_spdif_device; kctl =snd_ctl_new1 (&snd_cmipci_spdif_stream, cm); + kctl->id.device = pcm_spdif_device; err =snd_ctl_add (card, kctl);if (err <0 )return err; - kctl->id.device = pcm_spdif_device; }if (cm->chip_version <=37 ) { sw = snd_cmipci_old_mixer_switches;
Greg Kroah-Hartman
maintainerPATCH 79/160 ALSA: hda/realtek: Add quirk for Clevo NS50AU
In reply to Greg Kroah-HartmanFrom: Tim Crawford <[email protected]>
commit da209f7a80dd633a32cbcbafe9e9f778933119c1 upstream.
Fixes headset detection on Clevo NS50AU.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -9636,6 +9636,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1558 ,0x5101 ,"Clevo S510WU" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0x5157 ,"Clevo W517GU1" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0x51a1 ,"Clevo NS50MU" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ), +SND_PCI_QUIRK (0x1558 ,0x51b1 ,"Clevo NS50AU" ,ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0x5630 ,"Clevo NP50RNJS" ,ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0x70a1 ,"Clevo NB70T[HJK]" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ), SND_PCI_QUIRK(0x1558, 0x70b3, "Clevo NK70SB", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
Greg Kroah-Hartman
maintainerPATCH 80/160 ALSA: ice1712,ice1724: fix the kcontrol->id initialization
In reply to Greg Kroah-HartmanFrom: Jaroslav Kysela <[email protected]>
commit b9a4efd61b6b9f62f83752959e75a5dae20624fa upstream.
The new xarray lookup code requires to know complete kcontrol->id before snd_ctl_add() call. Reorder the code to make the initialization properly.
--- sound/pci/ice1712/aureon.c | 7 ++++--- sound/pci/ice1712/ice1712.c | 14 +++++++++----- sound/pci/ice1712/ice1724.c | 16 ++++++++++------ 3 files changed, 23 insertions(+), 14 deletions(-)
sound/pci/ice1712/aureon.c +4 -3
@@ -1899,11 +1899,12 @@ static int aureon_add_controls(struct snelse {for (i =0 ; i <ARRAY_SIZE (cs8415_controls); i++) {struct snd_kcontrol *kctl; - err =snd_ctl_add (ice->card, (kctl =snd_ctl_new1 (&cs8415_controls[i], ice))); -if (err <0 ) -return err; + kctl =snd_ctl_new1 (&cs8415_controls[i], ice);if (i >1 ) kctl->id.device = ice->pcm->device; + err =snd_ctl_add (ice->card, kctl); +if (err <0 ) +return err; } } }
sound/pci/ice1712/ice1712.c +9 -5
@@ -2371,22 +2371,26 @@ int snd_ice1712_spdif_build_controls(strif (snd_BUG_ON (!ice->pcm_pro))return -EIO ; - err =snd_ctl_add (ice->card, kctl =snd_ctl_new1 (&snd_ice1712_spdif_default, ice)); + kctl =snd_ctl_new1 (&snd_ice1712_spdif_default, ice); + kctl->id.device = ice->pcm_pro->device; + err =snd_ctl_add (ice->card, kctl);if (err <0 )return err; + kctl =snd_ctl_new1 (&snd_ice1712_spdif_maskc, ice); kctl->id.device = ice->pcm_pro->device; - err =snd_ctl_add (ice->card, kctl =snd_ctl_new1 (&snd_ice1712_spdif_maskc, ice)); + err =snd_ctl_add (ice->card, kctl);if (err <0 )return err; + kctl =snd_ctl_new1 (&snd_ice1712_spdif_maskp, ice); kctl->id.device = ice->pcm_pro->device; - err =snd_ctl_add (ice->card, kctl =snd_ctl_new1 (&snd_ice1712_spdif_maskp, ice)); + err =snd_ctl_add (ice->card, kctl);if (err <0 )return err; + kctl =snd_ctl_new1 (&snd_ice1712_spdif_stream, ice); kctl->id.device = ice->pcm_pro->device; - err =snd_ctl_add (ice->card, kctl =snd_ctl_new1 (&snd_ice1712_spdif_stream, ice)); + err =snd_ctl_add (ice->card, kctl);if (err <0 )return err; - kctl->id.device = ice->pcm_pro->device; ice->spdif.stream_ctl = kctl;return 0 ; }
sound/pci/ice1712/ice1724.c +10 -6
@@ -2392,23 +2392,27 @@ static int snd_vt1724_spdif_build_controif (err <0 )return err; - err =snd_ctl_add (ice->card, kctl =snd_ctl_new1 (&snd_vt1724_spdif_default, ice)); + kctl =snd_ctl_new1 (&snd_vt1724_spdif_default, ice); + kctl->id.device = ice->pcm->device; + err =snd_ctl_add (ice->card, kctl);if (err <0 )return err; + kctl =snd_ctl_new1 (&snd_vt1724_spdif_maskc, ice); kctl->id.device = ice->pcm->device; - err =snd_ctl_add (ice->card, kctl =snd_ctl_new1 (&snd_vt1724_spdif_maskc, ice)); + err =snd_ctl_add (ice->card, kctl);if (err <0 )return err; + kctl =snd_ctl_new1 (&snd_vt1724_spdif_maskp, ice); kctl->id.device = ice->pcm->device; - err =snd_ctl_add (ice->card, kctl =snd_ctl_new1 (&snd_vt1724_spdif_maskp, ice)); + err =snd_ctl_add (ice->card, kctl);if (err <0 )return err; - kctl->id.device = ice->pcm->device;#if 0 /* use default only */ - err =snd_ctl_add (ice->card, kctl =snd_ctl_new1 (&snd_vt1724_spdif_stream, ice)); + kctl =snd_ctl_new1 (&snd_vt1724_spdif_stream, ice); + kctl->id.device = ice->pcm->device; + err =snd_ctl_add (ice->card, kctl);if (err <0 )return err; - kctl->id.device = ice->pcm->device; ice->spdif.stream_ctl = kctl;#endif return 0 ;
Greg Kroah-Hartman
maintainerPATCH 81/160 ALSA: hda/realtek: Add a quirk for HP Slim Desktop S01
In reply to Greg Kroah-HartmanFrom: Ai Chao <[email protected]>
commit 527c356b51f3ddee02c9ed5277538f85e30a2cdc upstream.
Add a quirk for HP Slim Desktop S01 to fixup headset MIC no presence.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -11695,6 +11695,7 @@ static const struct snd_pci_quirk alc662SND_PCI_QUIRK (0x103c ,0x8719 ,"HP" ,ALC897_FIXUP_HP_HSMIC_VERB ),SND_PCI_QUIRK (0x103c ,0x872b ,"HP" ,ALC897_FIXUP_HP_HSMIC_VERB ),SND_PCI_QUIRK (0x103c ,0x873e ,"HP" ,ALC671_FIXUP_HP_HEADSET_MIC2 ), +SND_PCI_QUIRK (0x103c ,0x8768 ,"HP Slim Desktop S01" ,ALC671_FIXUP_HP_HEADSET_MIC2 ),SND_PCI_QUIRK (0x103c ,0x877e ,"HP 288 Pro G6" ,ALC671_FIXUP_HP_HEADSET_MIC2 ),SND_PCI_QUIRK (0x103c ,0x885f ,"HP 288 Pro G8" ,ALC671_FIXUP_HP_HEADSET_MIC2 ), SND_PCI_QUIRK(0x1043, 0x1080, "Asus UX501VW", ALC668_FIXUP_HEADSET_MODE),
Greg Kroah-Hartman
maintainerPATCH 82/160 ALSA: hda/realtek: Add Lenovo P3 Tower platform
In reply to Greg Kroah-HartmanFrom: RenHai <[email protected]>
commit 7ca4c8d4d3f41c2cd9b4cf22bb829bf03dac0956 upstream.
Headset microphone on this platform does not work without ALC897_FIXUP_HEADSET_MIC_PIN fixup.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -11717,6 +11717,7 @@ static const struct snd_pci_quirk alc662SND_PCI_QUIRK (0x14cd ,0x5003 ,"USI" ,ALC662_FIXUP_USI_HEADSET_MODE ),SND_PCI_QUIRK (0x17aa ,0x1036 ,"Lenovo P520" ,ALC662_FIXUP_LENOVO_MULTI_CODECS ),SND_PCI_QUIRK (0x17aa ,0x1057 ,"Lenovo P360" ,ALC897_FIXUP_HEADSET_MIC_PIN ), +SND_PCI_QUIRK (0x17aa ,0x1064 ,"Lenovo P3 Tower" ,ALC897_FIXUP_HEADSET_MIC_PIN ),SND_PCI_QUIRK (0x17aa ,0x32ca ,"Lenovo ThinkCentre M80" ,ALC897_FIXUP_HEADSET_MIC_PIN ),SND_PCI_QUIRK (0x17aa ,0x32cb ,"Lenovo ThinkCentre M70" ,ALC897_FIXUP_HEADSET_MIC_PIN ), SND_PCI_QUIRK(0x17aa, 0x32cf, "Lenovo ThinkCentre M950", ALC897_FIXUP_HEADSET_MIC_PIN),
Greg Kroah-Hartman
maintainerPATCH 83/160 ALSA: hda/realtek: Add quirks for Asus ROG 2024 laptops using CS35L41
In reply to Greg Kroah-HartmanFrom: Stefan Binding <[email protected]>
commit 811dd426a9b16cf61a86fdb12d5f5b983cbfb130 upstream.
Add support for Asus ROG 2024 models using CS35L41 SPI with Internal Boost.
--- sound/pci/hda/patch_realtek.c | 6 ++++++ 1 file changed, 6 insertions(+)
sound/pci/hda/patch_realtek.c +6 -0
@@ -9547,6 +9547,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1043 ,0x1a8f ,"ASUS UX582ZS" ,ALC245_FIXUP_CS35L41_SPI_2 ),SND_PCI_QUIRK (0x1043 ,0x1b11 ,"ASUS UX431DA" ,ALC294_FIXUP_ASUS_COEF_1B ),SND_PCI_QUIRK (0x1043 ,0x1b13 ,"Asus U41SV" ,ALC269_FIXUP_INV_DMIC ), +SND_PCI_QUIRK (0x1043 ,0x1b93 ,"ASUS G614JVR/JIR" ,ALC245_FIXUP_CS35L41_SPI_2 ),SND_PCI_QUIRK (0x1043 ,0x1bbd ,"ASUS Z550MA" ,ALC255_FIXUP_ASUS_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1043 ,0x1c23 ,"Asus X55U" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ), SND_PCI_QUIRK(0x1043, 0x1c62, "ASUS GU603", ALC289_FIXUP_ASUS_GA401),
@@ -9565,6 +9566,11 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1043 ,0x1f12 ,"ASUS UM5302" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x1043 ,0x1f92 ,"ASUS ROG Flow X16" ,ALC289_FIXUP_ASUS_GA401 ),SND_PCI_QUIRK (0x1043 ,0x3030 ,"ASUS ZN270IE" ,ALC256_FIXUP_ASUS_AIO_GPIO2 ), +SND_PCI_QUIRK (0x1043 ,0x3a20 ,"ASUS G614JZR" ,ALC245_FIXUP_CS35L41_SPI_2 ), +SND_PCI_QUIRK (0x1043 ,0x3a30 ,"ASUS G814JVR/JIR" ,ALC245_FIXUP_CS35L41_SPI_2 ), +SND_PCI_QUIRK (0x1043 ,0x3a40 ,"ASUS G814JZR" ,ALC245_FIXUP_CS35L41_SPI_2 ), +SND_PCI_QUIRK (0x1043 ,0x3a50 ,"ASUS G834JYR/JZR" ,ALC245_FIXUP_CS35L41_SPI_2 ), +SND_PCI_QUIRK (0x1043 ,0x3a60 ,"ASUS G634JYR/JZR" ,ALC245_FIXUP_CS35L41_SPI_2 ),SND_PCI_QUIRK (0x1043 ,0x831a ,"ASUS P901" ,ALC269_FIXUP_STEREO_DMIC ),SND_PCI_QUIRK (0x1043 ,0x834a ,"ASUS S101" ,ALC269_FIXUP_STEREO_DMIC ), SND_PCI_QUIRK(0x1043, 0x8398, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC),
Greg Kroah-Hartman
maintainerPATCH 84/160 drm/i915/gt: Use the correct error value when kernel_context() fails
In reply to Greg Kroah-HartmanFrom: Andi Shyti <[email protected]>
commit 40023959dbab3c6ad56fa7213770e63d197b69fb upstream.
kernel_context() returns an error pointer. Use pointer-error conversion functions to evaluate its return value, rather than checking for a '0' return.
--- drivers/gpu/drm/i915/gt/selftest_execlists.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/gpu/drm/i915/gt/selftest_execlists.c +8 -4
@@ -1530,8 +1530,8 @@ static int live_busywait_preempt(void *astruct drm_i915_gem_object *obj;struct i915_vma *vma;enum intel_engine_id id; -int err = -ENOMEM ;u32 *map; +int err;/* * Verify that even without HAS_LOGICAL_RING_PREEMPTION, we can
@@ -1539,13 +1539,17 @@ static int live_busywait_preempt(void *a*/ ctx_hi =kernel_context (gt->i915,NULL ); -if (!ctx_hi) -return -ENOMEM ; +if (IS_ERR (ctx_hi)) +return PTR_ERR (ctx_hi); + ctx_hi->sched.priority =I915_CONTEXT_MAX_USER_PRIORITY ; ctx_lo =kernel_context (gt->i915,NULL ); -if (!ctx_lo) +if (IS_ERR (ctx_lo)) { + err =PTR_ERR (ctx_lo); goto err_ctx_hi; + } + ctx_lo->sched.priority =I915_CONTEXT_MIN_USER_PRIORITY ; obj =i915_gem_object_create_internal (gt->i915,PAGE_SIZE );
Greg Kroah-Hartman
maintainerPATCH 85/160 drm/amd/pm: conditionally disable pcie lane switching for some sienna_cichlid SKUs
In reply to Greg Kroah-HartmanFrom: Evan Quan <[email protected]>
commit 38e4ced804796c5725e2a52ec3601951552c4a97 upstream.
Disable the pcie lane switching for some sienna_cichlid SKUs since it might not work well on some platforms.
--- drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 92 ++++++++++++---- 1 file changed, 74 insertions(+), 18 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c +74 -18
@@ -2067,33 +2067,94 @@ static int sienna_cichlid_display_disablreturn ret; } +static void sienna_cichlid_get_override_pcie_settings (struct smu_context *smu, +uint32_t *gen_speed_override, +uint32_t *lane_width_override) +{ +struct amdgpu_device *adev = smu->adev; + + *gen_speed_override =0xff ; + *lane_width_override =0xff ; + +switch (adev->pdev->device) { +case 0x73A0 : +case 0x73A1 : +case 0x73A2 : +case 0x73A3 : +case 0x73AB : +case 0x73AE : +/* Bit 7:0: PCIE lane width, 1 to 7 corresponds is x1 to x32 */ + *lane_width_override =6 ; +break ; +case 0x73E0 : +case 0x73E1 : +case 0x73E3 : + *lane_width_override =4 ; +break ; +case 0x7420 : +case 0x7421 : +case 0x7422 : +case 0x7423 : +case 0x7424 : + *lane_width_override =3 ; +break ; +default : +break ; + } +} + +#define MAX (a, b) ((a) > (b) ? (a) : (b)) +static int sienna_cichlid_update_pcie_parameters (struct smu_context *smu,uint32_t pcie_gen_cap,uint32_t pcie_width_cap) {struct smu_11_0_dpm_context *dpm_context = smu->smu_dpm.dpm_context; - -uint32_t smu_pcie_arg; +struct smu_11_0_pcie_table *pcie_table = &dpm_context->dpm_tables.pcie_table; +uint32_t gen_speed_override, lane_width_override;uint8_t *table_member1, *table_member2; +uint32_t min_gen_speed, max_gen_speed; +uint32_t min_lane_width, max_lane_width; +uint32_t smu_pcie_arg;int ret, i;GET_PPTABLE_MEMBER (PcieGenSpeed, &table_member1);GET_PPTABLE_MEMBER (PcieLaneCount, &table_member2); -/* lclk dpm table setup */ -for (i =0 ; i <MAX_PCIE_CONF ; i++) { - dpm_context->dpm_tables.pcie_table.pcie_gen[i] = table_member1[i]; - dpm_context->dpm_tables.pcie_table.pcie_lane[i] = table_member2[i]; +sienna_cichlid_get_override_pcie_settings (smu, + &gen_speed_override, + &lane_width_override); + +/* PCIE gen speed override */ +if (gen_speed_override !=0xff ) { + min_gen_speed =MIN (pcie_gen_cap, gen_speed_override); + max_gen_speed =MIN (pcie_gen_cap, gen_speed_override); + }else { + min_gen_speed =MAX (0 , table_member1[0 ]); + max_gen_speed =MIN (pcie_gen_cap, table_member1[1 ]); + min_gen_speed = min_gen_speed > max_gen_speed ? + max_gen_speed : min_gen_speed; } + pcie_table->pcie_gen[0 ] = min_gen_speed; + pcie_table->pcie_gen[1 ] = max_gen_speed; + +/* PCIE lane width override */ +if (lane_width_override !=0xff ) { + min_lane_width =MIN (pcie_width_cap, lane_width_override); + max_lane_width =MIN (pcie_width_cap, lane_width_override); + }else { + min_lane_width =MAX (1 , table_member2[0 ]); + max_lane_width =MIN (pcie_width_cap, table_member2[1 ]); + min_lane_width = min_lane_width > max_lane_width ? + max_lane_width : min_lane_width; + } + pcie_table->pcie_lane[0 ] = min_lane_width; + pcie_table->pcie_lane[1 ] = max_lane_width;for (i =0 ; i <NUM_LINK_LEVELS ; i++) { - smu_pcie_arg = (i <<16 ) | - ((table_member1[i] <= pcie_gen_cap) ? - (table_member1[i] <<8 ) : - (pcie_gen_cap <<8 )) | - ((table_member2[i] <= pcie_width_cap) ? - table_member2[i] : - pcie_width_cap); + smu_pcie_arg = (i <<16 | + pcie_table->pcie_gen[i] <<8 | + pcie_table->pcie_lane[i]); ret = smu_cmn_send_smc_msg_with_param(smu, SMU_MSG_OverridePcieParameters,
@@ -2101,11 +2162,6 @@ static int sienna_cichlid_update_pcie_pa NULL);if (ret)return ret; - -if (table_member1[i] > pcie_gen_cap) - dpm_context->dpm_tables.pcie_table.pcie_gen[i] = pcie_gen_cap; -if (table_member2[i] > pcie_width_cap) - dpm_context->dpm_tables.pcie_table.pcie_lane[i] = pcie_width_cap; }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 86/160 drm/amdgpu: fix xclk freq on CHIP_STONEY
In reply to Greg Kroah-HartmanFrom: Chia-I Wu <[email protected]>
commit b447b079cf3a9971ea4d31301e673f49612ccc18 upstream.
According to Alex, most APUs from that time seem to have the same issue (vbios says 48Mhz, actual is 100Mhz). I only have a CHIP_STONEY so I limit the fixup to CHIP_STONEY
--- drivers/gpu/drm/amd/amdgpu/vi.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/vi.c +9 -2
@@ -542,8 +542,15 @@ static u32 vi_get_xclk(struct amdgpu_devu32 reference_clock = adev->clock.spll.reference_freq;u32 tmp; -if (adev->flags &AMD_IS_APU ) -return reference_clock; +if (adev->flags &AMD_IS_APU ) { +switch (adev->asic_type) { +case CHIP_STONEY : +/* vbios says 48Mhz, but the actual freq is 100Mhz */ +return 10000 ; +default : +return reference_clock; + } + } tmp =RREG32_SMC (ixCG_CLKPIN_CNTL_2);if (REG_GET_FIELD (tmp,CG_CLKPIN_CNTL_2 ,MUX_TCLK_TO_XCLK ))
Greg Kroah-Hartman
maintainerPATCH 87/160 drm/amdgpu: change reserved vram info print
In reply to Greg Kroah-HartmanFrom: YiPeng Chai <[email protected]>
commit dac652220ba0e5a2ef2da2a47a60b60aea333fdb upstream.
The link object of mgr->reserved_pages is the blocks variable in struct amdgpu_vram_reservation, not the link variable in struct drm_buddy_block.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c +4 -3
@@ -800,7 +800,7 @@ static void amdgpu_vram_mgr_debug(struct {struct amdgpu_vram_mgr *mgr =to_vram_mgr (man);struct drm_buddy *mm = &mgr->mm; -struct drm_buddy_block *block; +struct amdgpu_vram_reservation *rsv;drm_printf (printer," vis usage:%llu\n" ,amdgpu_vram_mgr_vis_usage (mgr));
@@ -812,8 +812,9 @@ static void amdgpu_vram_mgr_debug(structdrm_buddy_print (mm, printer);drm_printf (printer,"reserved:\n" ); -list_for_each_entry (block, &mgr->reserved_pages, link) -drm_buddy_block_print (mm, block, printer); +list_for_each_entry (rsv, &mgr->reserved_pages, blocks) +drm_printf (printer,"%#018llx-%#018llx: %llu\n" , + rsv->start, rsv->start + rsv->size, rsv->size);mutex_unlock (&mgr->lock); }
Greg Kroah-Hartman
maintainerPATCH 88/160 drm/amd: Disallow s0ix without BIOS support again
In reply to Greg Kroah-HartmanFrom: Mario Limonciello <[email protected]>
commit 30c3d3b70aba2464ee8c91025e91428f92464077 upstream.
commit cf488dcd0ab7 ("drm/amd: Allow s0ix without BIOS support") showed improvements to power consumption over suspend when s0ix wasn't enabled in BIOS and the system didn't support S3.
This patch however was misguided because the reason the system didn't support S3 was because SMT was disabled in OEM BIOS setup. This prevented the BIOS from allowing S3.
Also allowing GPUs to use the s2idle path actually causes problems if they're invoked on systems that may not support s2idle in the platform firmware. systemd has a tendency to try to use s2idle if deep fails for any reason, which could lead to unexpected flows.
The original commit also fixed a problem during resume from suspend to idle without hardware support, but this is no longer necessary with commit ca4751866397 ("drm/amd: Don't allow s0ix on APUs older than Raven")
Revert commit cf488dcd0ab7 ("drm/amd: Allow s0ix without BIOS support") to make it match the expected behavior again.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +6 -2
@@ -1092,16 +1092,20 @@ bool amdgpu_acpi_is_s0ix_active(struct a* S0ix even though the system is suspending to idle, so return false * in that case. */ -if (!(acpi_gbl_FADT.flags &ACPI_FADT_LOW_POWER_S0 )) +if (!(acpi_gbl_FADT.flags &ACPI_FADT_LOW_POWER_S0 )) {dev_warn_once (adev->dev,"Power consumption will be higher as BIOS has not been configured for suspend-to-idle.\n" "To use suspend-to-idle change the sleep mode in BIOS setup.\n" ); +return false; + }#if !IS_ENABLED (CONFIG_AMD_PMC )dev_warn_once (adev->dev,"Power consumption will be higher as the kernel has not been compiled with CONFIG_AMD_PMC.\n" ); -#endif /* CONFIG_AMD_PMC */ +return false; +#else return true; +#endif /* CONFIG_AMD_PMC */ }#endif /* CONFIG_SUSPEND */
Greg Kroah-Hartman
maintainerPATCH 89/160 drm/amd/pm: Fix power context allocation in SMU13
In reply to Greg Kroah-HartmanFrom: Lijo Lazar <[email protected]>
commit 1d13c49cf4e246b218d71873f1bb1bbd376aa10e upstream.
Use the right data structure for allocation.
--- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c +2 -2
@@ -566,11 +566,11 @@ int smu_v13_0_init_power(struct smu_contif (smu_power->power_context || smu_power->power_context_size !=0 )return -EINVAL ; - smu_power->power_context =kzalloc (sizeof (struct smu_13_0_dpm_context ), + smu_power->power_context =kzalloc (sizeof (struct smu_13_0_power_context ),GFP_KERNEL );if (!smu_power->power_context)return -ENOMEM ; - smu_power->power_context_size =sizeof (struct smu_13_0_dpm_context ); + smu_power->power_context_size =sizeof (struct smu_13_0_power_context );return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 90/160 drm/amd/display: Reduce sdp bw after urgent to 90%
In reply to Greg Kroah-HartmanFrom: Alvin Lee <[email protected]>
commit e1a600208286c197c2696e51fc313e49889315bd upstream.
[Description]
Reduce expected SDP bandwidth due to poor QoS and arbitration issues on high bandwidth configs
--- drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +1 -1
@@ -138,7 +138,7 @@ struct _vcs_dpi_soc_bounding_box_st dcn3 .urgent_out_of_order_return_per_channel_pixel_only_bytes = 4096, .urgent_out_of_order_return_per_channel_pixel_and_vm_bytes = 4096, .urgent_out_of_order_return_per_channel_vm_only_bytes = 4096, - .pct_ideal_sdp_bw_after_urgent = 100.0, + .pct_ideal_sdp_bw_after_urgent = 90.0, .pct_ideal_fabric_bw_after_urgent = 67.0, .pct_ideal_dram_sdp_bw_after_urgent_pixel_only = 20.0, .pct_ideal_dram_sdp_bw_after_urgent_pixel_and_vm = 60.0, // N/A, for now keep as is until DML implemented
Greg Kroah-Hartman
maintainerPATCH 91/160 drm/amd/display: add ODM case when looking for first split pipe
In reply to Greg Kroah-HartmanFrom: Samson Tam <[email protected]>
commit 59de751e3845d699e02dc4da47322b92d83a41e2 upstream.
[Why]
When going from ODM 2:1 single display case to max displays, second odm pipe needs to be repurposed for one of the new single displays. However, acquire_first_split_pipe() only handles MPC case and not ODM case
[How]
Add ODM conditions in acquire_first_split_pipe()
Add commit_minimal_transition_state() in commit_streams() to handle odm 2:1 exit first, and then process new streams
Handle ODM condition in commit_minimal_transition_state()
--- drivers/gpu/drm/amd/display/dc/core/dc.c | 36 +++++++++++++++++++++- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 20 ++++++++++++ 2 files changed, 55 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/core/dc.c +35 -1
@@ -1962,6 +1962,9 @@ static enum dc_status dc_commit_state_noreturn result; } +static bool commit_minimal_transition_state (struct dc *dc, +struct dc_state *transition_base_context); +/** * dc_commit_streams - Commit current stream state *
@@ -1983,6 +1986,8 @@ enum dc_status dc_commit_streams(structstruct dc_state *context;enum dc_status res =DC_OK ;struct dc_validation_set set[MAX_STREAMS ] = {0 }; +struct pipe_ctx *pipe; +bool handle_exit_odm2to1 = false;if (dc->ctx->dce_environment ==DCE_ENV_VIRTUAL_HW )return res;
@@ -2007,6 +2012,22 @@ enum dc_status dc_commit_streams(struct } } +/* Check for case where we are going from odm 2:1 to max +* pipe scenario. For these cases, we will call +* commit_minimal_transition_state() to exit out of odm 2:1 +* first before processing new streams +*/ +if (stream_count == dc->res_pool->pipe_count) { +for (i =0 ; i < dc->res_pool->pipe_count; i++) { + pipe = &dc->current_state->res_ctx.pipe_ctx[i]; +if (pipe->next_odm_pipe) + handle_exit_odm2to1 = true; + } + } + +if (handle_exit_odm2to1) + res =commit_minimal_transition_state (dc, dc->current_state); + context =dc_create_state (dc);if (!context) goto context_alloc_fail;
@@ -3915,6 +3936,7 @@ static bool commit_minimal_transition_stunsigned int i, j;unsigned int pipe_in_use =0 ;bool subvp_in_use = false; +bool odm_in_use = false;if (!transition_context)return false;
@@ -3943,6 +3965,18 @@ static bool commit_minimal_transition_st } } +/* If ODM is enabled and we are adding or removing planes from any ODM +* pipe, we must use the minimal transition. +*/ +for (i =0 ; i < dc->res_pool->pipe_count; i++) { +struct pipe_ctx *pipe = &dc->current_state->res_ctx.pipe_ctx[i]; + +if (pipe->stream && pipe->next_odm_pipe) { + odm_in_use = true; +break ; + } + } +/* When the OS add a new surface if we have been used all of pipes with odm combine * and mpc split feature, it need use commit_minimal_transition_state to transition safely. * After OS exit MPO, it will back to use odm and mpc split with all of pipes, we need
@@ -3951,7 +3985,7 @@ static bool commit_minimal_transition_st* Reduce the scenarios to use dc_commit_state_no_check in the stage of flip. Especially * enter/exit MPO when DCN still have enough resources. */ -if (pipe_in_use != dc->res_pool->pipe_count && !subvp_in_use) { +if (pipe_in_use != dc->res_pool->pipe_count && !subvp_in_use && !odm_in_use) {dc_release_state (transition_context);return true; }
drivers/gpu/drm/amd/display/dc/core/dc_resource.c +20 -0
@@ -1446,6 +1446,26 @@ static int acquire_first_split_pipe( split_pipe->stream = stream;return i; + }else if (split_pipe->prev_odm_pipe && + split_pipe->prev_odm_pipe->plane_state == split_pipe->plane_state) { + split_pipe->prev_odm_pipe->next_odm_pipe = split_pipe->next_odm_pipe; +if (split_pipe->next_odm_pipe) + split_pipe->next_odm_pipe->prev_odm_pipe = split_pipe->prev_odm_pipe; + +if (split_pipe->prev_odm_pipe->plane_state) +resource_build_scaling_params (split_pipe->prev_odm_pipe); + +memset (split_pipe,0 ,sizeof (*split_pipe)); + split_pipe->stream_res.tg = pool->timing_generators[i]; + split_pipe->plane_res.hubp = pool->hubps[i]; + split_pipe->plane_res.ipp = pool->ipps[i]; + split_pipe->plane_res.dpp = pool->dpps[i]; + split_pipe->stream_res.opp = pool->opps[i]; + split_pipe->plane_res.mpcc_inst = pool->dpps[i]->inst; + split_pipe->pipe_idx = i; + + split_pipe->stream = stream; +return i; } }return -1 ;
Greg Kroah-Hartman
maintainerPATCH 92/160 wifi: iwlwifi: mvm: Fix -Warray-bounds bug in iwl_mvm_wait_d3_notif()
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
commit 7a4615b9a9da5225b22b36a20508555dd133ac24 upstream.
kmemdup() at line 2735 is not duplicating enough memory for notif->tid_tear_down and notif->station_id. As it only duplicates 612 bytes: up to offsetofend(struct iwl_wowlan_info_notif, received_beacons), this is the range of [0, 612) bytes.
2735 notif = kmemdup(notif_v1,
2736 offsetofend(struct iwl_wowlan_info_notif,
2737 received_beacons),
2738 GFP_ATOMIC);
which evidently does not cover bytes 612 and 613 for members tid_tear_down and station_id in struct iwl_wowlan_info_notif. See below:
$ pahole -C iwl_wowlan_info_notif drivers/net/wireless/intel/iwlwifi/mvm/d3.o
struct iwl_wowlan_info_notif {
struct iwl_wowlan_gtk_status_v3 gtk[2]; /* 0 488 */
/* --- cacheline 7 boundary (448 bytes) was 40 bytes ago --- */
struct iwl_wowlan_igtk_status igtk[2]; /* 488 80 */
/* --- cacheline 8 boundary (512 bytes) was 56 bytes ago --- */
__le64 replay_ctr; /* 568 8 */
/* --- cacheline 9 boundary (576 bytes) --- */
__le16 pattern_number; /* 576 2 */
__le16 reserved1; /* 578 2 */
__le16 qos_seq_ctr[8]; /* 580 16 */
__le32 wakeup_reasons; /* 596 4 */
__le32 num_of_gtk_rekeys; /* 600 4 */
__le32 transmitted_ndps; /* 604 4 */
__le32 received_beacons; /* 608 4 */
u8 tid_tear_down; /* 612 1 */
u8 station_id; /* 613 1 */
u8 reserved2[2]; /* 614 2 *//* size: 616, cachelines: 10, members: 13 */ /* last cacheline: 40 bytes */ };
Therefore, when the following assignments take place, actually no memory has been allocated for those objects:
2743 notif->tid_tear_down = notif_v1->tid_tear_down;
2744 notif->station_id = notif_v1->station_id;
Fix this by allocating space for the whole notif object and zero out the remaining space in memory after member station_id.
This also fixes the following -Warray-bounds issues:
CC drivers/net/wireless/intel/iwlwifi/mvm/d3.odrivers/net/wireless/intel/iwlwifi/mvm/d3.c: In function ‘iwl_mvm_wait_d3_notif’:drivers/net/wireless/intel/iwlwifi/mvm/d3.c:2743:30: warning: array subscript ‘struct iwl_wowlan_info_notif[0]’ is partly outside array bounds of ‘unsigned char[612]’ [-Warray-bounds=]
2743 | notif->tid_tear_down = notif_v1->tid_tear_down;
|
from drivers/net/wireless/intel/iwlwifi/mvm/d3.c:7:
In function ‘kmemdup’,
inlined from ‘iwl_mvm_wait_d3_notif’ at drivers/net/wireless/intel/iwlwifi/mvm/d3.c:2735:12:
include/linux/fortify-string.h:765:16: note: object of size 612 allocated by ‘__real_kmemdup’
765 | return __real_kmemdup(p, size, gfp);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~drivers/net/wireless/intel/iwlwifi/mvm/d3.c: In function ‘iwl_mvm_wait_d3_notif’:drivers/net/wireless/intel/iwlwifi/mvm/d3.c:2744:30: warning: array subscript ‘struct iwl_wowlan_info_notif[0]’ is partly outside array bounds of ‘unsigned char[612]’ [-Warray-bounds=]
2744 | notif->station_id = notif_v1->station_id;
| ^~
In function ‘kmemdup’,
inlined from ‘iwl_mvm_wait_d3_notif’ at drivers/net/wireless/intel/iwlwifi/mvm/d3.c:2735:12:include/linux/fortify-string.h:765:16: note: object of size 612 allocated by ‘__real_kmemdup’
765 | return __real_kmemdup(p, size, gfp);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~--- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/d3.c +2 -6
@@ -2729,17 +2729,13 @@ static bool iwl_mvm_wait_d3_notif(structif (wowlan_info_ver <2 ) {struct iwl_wowlan_info_notif_v1 *notif_v1 = (void *)pkt->data; - notif =kmemdup (notif_v1, - offsetofend(struct iwl_wowlan_info_notif, - received_beacons), -GFP_ATOMIC ); - + notif =kmemdup (notif_v1,sizeof (*notif),GFP_ATOMIC );if (!notif)return false; notif->tid_tear_down = notif_v1->tid_tear_down; notif->station_id = notif_v1->station_id; - +memset_after (notif,0 , station_id); }else { notif = (void *)pkt->data; }
Greg Kroah-Hartman
maintainerPATCH 93/160 can: j1939: j1939_sk_send_loop_abort(): improved error queue handling in J1939 Socket
In reply to Greg Kroah-HartmanFrom: Oleksij Rempel <[email protected]>
commit 2a84aea80e925ecba6349090559754f8e8eb68ef upstream.
This patch addresses an issue within the j1939_sk_send_loop_abort() function in the j1939/socket.c file, specifically in the context of Transport Protocol (TP) sessions.
Without this patch, when a TP session is initiated and a Clear To Send (CTS) frame is received from the remote side requesting one data packet, the kernel dispatches the first Data Transport (DT) frame and then waits for the next CTS. If the remote side doesn't respond with another CTS, the kernel aborts due to a timeout. This leads to the user-space receiving an EPOLLERR on the socket, and the socket becomes active.
However, when trying to read the error queue from the socket with sock.recvmsg(, , socket.MSG_ERRQUEUE), it returns -EAGAIN, given that the socket is non-blocking. This situation results in an infinite loop: the user-space repeatedly calls epoll(), epoll() returns the socket file descriptor with EPOLLERR, but the socket then blocks on the recv() of ERRQUEUE.
This patch introduces an additional check for the J1939_SOCK_ERRQUEUE flag within the j1939_sk_send_loop_abort() function. If the flag is set, it indicates that the application has subscribed to receive error queue messages. In such cases, the kernel can communicate the current transfer state via the error queue. This allows for the function to return early, preventing the unnecessary setting of the socket into an error state, and breaking the infinite loop. It is crucial to note that a socket error is only needed if the application isn't using the error queue, as, without it, the application wouldn't be aware of transfer issues.
--- net/can/j1939/socket.c | 5 +++++ 1 file changed, 5 insertions(+)
net/can/j1939/socket.c +5 -0
@@ -1088,6 +1088,11 @@ void j1939_sk_errqueue(struct j1939_sessvoid j1939_sk_send_loop_abort (struct sock *sk,int err) { +struct j1939_sock *jsk =j1939_sk (sk); + +if (jsk->state &J1939_SOCK_ERRQUEUE ) +return ; + sk->sk_err = err;sk_error_report (sk);
Greg Kroah-Hartman
maintainerPATCH 94/160 can: j1939: change j1939_netdev_lock type to mutex
In reply to Greg Kroah-HartmanFrom: Fedor Pchelkin <[email protected]>
commit cd9c790de2088b0d797dc4d244b4f174f9962554 upstream.
It turns out access to j1939_can_rx_register() needs to be serialized, otherwise j1939_priv can be corrupted when parallel threads call j1939_netdev_start() and j1939_can_rx_register() fails. This issue is thoroughly covered in other commit which serializes access to j1939_can_rx_register().
Change j1939_netdev_lock type to mutex so that we do not need to remove GFP_KERNEL from can_rx_register().
j1939_netdev_lock seems to be used in normal contexts where mutex usage is not prohibited.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- net/can/j1939/main.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-)
net/can/j1939/main.c +11 -11
@@ -126,7 +126,7 @@ static void j1939_can_recv(struct sk_buf#define J1939_CAN_ID CAN_EFF_FLAG#define J1939_CAN_MASK (CAN_EFF_FLAG | CAN_RTR_FLAG) -static DEFINE_SPINLOCK (j1939_netdev_lock); +static DEFINE_MUTEX (j1939_netdev_lock);static struct j1939_priv *j1939_priv_create (struct net_device *ndev) {
@@ -220,7 +220,7 @@ static void __j1939_rx_release(struct krj1939_can_rx_unregister (priv);j1939_ecu_unmap_all (priv);j1939_priv_set (priv->ndev,NULL ); -spin_unlock (&j1939_netdev_lock); +mutex_unlock (&j1939_netdev_lock); }/* get pointer to priv without increasing ref counter */
@@ -248,9 +248,9 @@ static struct j1939_priv *j1939_priv_get {struct j1939_priv *priv; -spin_lock (&j1939_netdev_lock); +mutex_lock (&j1939_netdev_lock); priv =j1939_priv_get_by_ndev_locked (ndev); -spin_unlock (&j1939_netdev_lock); +mutex_unlock (&j1939_netdev_lock);return priv; }
@@ -260,14 +260,14 @@ struct j1939_priv *j1939_netdev_start(ststruct j1939_priv *priv, *priv_new;int ret; -spin_lock (&j1939_netdev_lock); +mutex_lock (&j1939_netdev_lock); priv =j1939_priv_get_by_ndev_locked (ndev);if (priv) {kref_get (&priv->rx_kref); -spin_unlock (&j1939_netdev_lock); +mutex_unlock (&j1939_netdev_lock);return priv; } -spin_unlock (&j1939_netdev_lock); +mutex_unlock (&j1939_netdev_lock); priv =j1939_priv_create (ndev);if (!priv)
@@ -277,20 +277,20 @@ struct j1939_priv *j1939_netdev_start(stspin_lock_init (&priv->j1939_socks_lock);INIT_LIST_HEAD (&priv->j1939_socks); -spin_lock (&j1939_netdev_lock); +mutex_lock (&j1939_netdev_lock); priv_new =j1939_priv_get_by_ndev_locked (ndev);if (priv_new) {/* Someone was faster than us, use their priv and roll * back our's. */ kref_get (&priv_new->rx_kref); -spin_unlock (&j1939_netdev_lock); +mutex_unlock (&j1939_netdev_lock);dev_put (ndev);kfree (priv);return priv_new; }j1939_priv_set (ndev, priv); -spin_unlock (&j1939_netdev_lock); +mutex_unlock (&j1939_netdev_lock); ret =j1939_can_rx_register (priv);if (ret <0 )
@@ -308,7 +308,7 @@ struct j1939_priv *j1939_netdev_start(stvoid j1939_netdev_stop (struct j1939_priv *priv) { -kref_put_lock (&priv->rx_kref, __j1939_rx_release, &j1939_netdev_lock); +kref_put_mutex (&priv->rx_kref, __j1939_rx_release, &j1939_netdev_lock);j1939_priv_put (priv); }
Greg Kroah-Hartman
maintainerPATCH 95/160 can: j1939: avoid possible use-after-free when j1939_can_rx_register fails
In reply to Greg Kroah-HartmanFrom: Fedor Pchelkin <[email protected]>
commit 9f16eb106aa5fce15904625661312623ec783ed3 upstream.
Syzkaller reports the following failure:
BUG: KASAN: use-after-free in kref_put include/linux/kref.h:64 [inline] BUG: KASAN: use-after-free in j1939_priv_put+0x25/0xa0 net/can/j1939/main.c:172 Write of size 4 at addr ffff888141c15058 by task swapper/3/0 CPU: 3 PID: 0 Comm: swapper/3 Not tainted 5.10.144-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x107/0x167 lib/dump_stack.c:118 print_address_description.constprop.0+0x1c/0x220 mm/kasan/report.c:385 __kasan_report mm/kasan/report.c:545 [inline] kasan_report.cold+0x1f/0x37 mm/kasan/report.c:562 check_memory_region_inline mm/kasan/generic.c:186 [inline] check_memory_region+0x145/0x190 mm/kasan/generic.c:192 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic_fetch_sub_release include/asm-generic/atomic-instrumented.h:220 [inline] __refcount_sub_and_test include/linux/refcount.h:272 [inline] __refcount_dec_and_test include/linux/refcount.h:315 [inline] refcount_dec_and_test include/linux/refcount.h:333 [inline] kref_put include/linux/kref.h:64 [inline] j1939_priv_put+0x25/0xa0 net/can/j1939/main.c:172 j1939_sk_sock_destruct+0x44/0x90 net/can/j1939/socket.c:374 __sk_destruct+0x4e/0x820 net/core/sock.c:1784 rcu_do_batch kernel/rcu/tree.c:2485 [inline] rcu_core+0xb35/0x1a30 kernel/rcu/tree.c:2726 __do_softirq+0x289/0x9a3 kernel/softirq.c:298 asm_call_irq_on_stack+0x12/0x20 </IRQ> __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] do_softirq_own_stack+0xaa/0xe0 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:393 [inline] __irq_exit_rcu kernel/softirq.c:423 [inline] irq_exit_rcu+0x136/0x200 kernel/softirq.c:435 sysvec_apic_timer_interrupt+0x4d/0x100 arch/x86/kernel/apic/apic.c:1095 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635 Allocated by task 1141: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_set_track mm/kasan/common.c:56 [inline] __kasan_kmalloc.constprop.0+0xc9/0xd0 mm/kasan/common.c:461 kmalloc include/linux/slab.h:552 [inline] kzalloc include/linux/slab.h:664 [inline] j1939_priv_create net/can/j1939/main.c:131 [inline] j1939_netdev_start+0x111/0x860 net/can/j1939/main.c:268 j1939_sk_bind+0x8ea/0xd30 net/can/j1939/socket.c:485 __sys_bind+0x1f2/0x260 net/socket.c:1645 __do_sys_bind net/socket.c:1656 [inline] __se_sys_bind net/socket.c:1654 [inline] __x64_sys_bind+0x6f/0xb0 net/socket.c:1654 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xc6 Freed by task 1141: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_set_track+0x1c/0x30 mm/kasan/common.c:56 kasan_set_free_info+0x1b/0x30 mm/kasan/generic.c:355 __kasan_slab_free+0x112/0x170 mm/kasan/common.c:422 slab_free_hook mm/slub.c:1542 [inline] slab_free_freelist_hook+0xad/0x190 mm/slub.c:1576 slab_free mm/slub.c:3149 [inline] kfree+0xd9/0x3b0 mm/slub.c:4125 j1939_netdev_start+0x5ee/0x860 net/can/j1939/main.c:300 j1939_sk_bind+0x8ea/0xd30 net/can/j1939/socket.c:485 __sys_bind+0x1f2/0x260 net/socket.c:1645 __do_sys_bind net/socket.c:1656 [inline] __se_sys_bind net/socket.c:1654 [inline] __x64_sys_bind+0x6f/0xb0 net/socket.c:1654 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xc6
It can be caused by this scenario:
CPU0 CPU1j1939_sk_bind(socket0, ndev0, ...)
j1939_netdev_start()
j1939_sk_bind(socket1, ndev0, ...)
j1939_netdev_start()
mutex_lock(&j1939_netdev_lock)
j1939_priv_set(ndev0, priv)
mutex_unlock(&j1939_netdev_lock)
if (priv_new)
kref_get(&priv_new->rx_kref)
return priv_new;
/* inside j1939_sk_bind() */
jsk->priv = priv
j1939_can_rx_register(priv) // fails
j1939_priv_set(ndev, NULL)
kfree(priv)
j1939_sk_sock_destruct()
j1939_priv_put() // <- uafTo avoid this, call j1939_can_rx_register() under j1939_netdev_lock so that a concurrent thread cannot process j1939_priv before j1939_can_rx_register() returns.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- net/can/j1939/main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/can/j1939/main.c +3 -1
@@ -290,16 +290,18 @@ struct j1939_priv *j1939_netdev_start(streturn priv_new; }j1939_priv_set (ndev, priv); -mutex_unlock (&j1939_netdev_lock); ret =j1939_can_rx_register (priv);if (ret <0 ) goto out_priv_put; +mutex_unlock (&j1939_netdev_lock);return priv; out_priv_put:j1939_priv_set (ndev,NULL ); +mutex_unlock (&j1939_netdev_lock); +dev_put (ndev);kfree (priv);
Greg Kroah-Hartman
maintainerPATCH 96/160 mptcp: only send RM_ADDR in nl_cmd_remove
In reply to Greg Kroah-HartmanFrom: Geliang Tang <[email protected]>
commit 8b1c94da1e481090f24127b2c420b0c0b0421ce3 upstream.
The specifications from [1] about the "REMOVE" command say:
Announce that an address has been lost to the peer
It was then only supposed to send a RM_ADDR and not trying to delete associated subflows.
A new helper mptcp_pm_remove_addrs() is then introduced to do just that, compared to mptcp_pm_remove_addrs_and_subflows() also removing subflows.
To delete a subflow, the userspace daemon can use the "SUB_DESTROY" command, see mptcp_nl_cmd_sf_destroy().
--- net/mptcp/pm_netlink.c | 18 ++++++++++++++++++ net/mptcp/pm_userspace.c | 2 +- net/mptcp/protocol.h | 1 + 3 files changed, 20 insertions(+), 1 deletion(-)
net/mptcp/pm_netlink.c +18 -0
@@ -1558,6 +1558,24 @@ static int mptcp_nl_cmd_del_addr(structreturn ret; } +void mptcp_pm_remove_addrs (struct mptcp_sock *msk,struct list_head *rm_list) +{ +struct mptcp_rm_list alist = { .nr =0 }; +struct mptcp_pm_addr_entry *entry; + +list_for_each_entry (entry, rm_list, list) { +remove_anno_list_by_saddr (msk, &entry->addr); +if (alist.nr <MPTCP_RM_IDS_MAX ) + alist.ids[alist.nr++] = entry->addr.id; + } + +if (alist.nr) { +spin_lock_bh (&msk->pm.lock); +mptcp_pm_remove_addr (msk, &alist); +spin_unlock_bh (&msk->pm.lock); + } +} +void mptcp_pm_remove_addrs_and_subflows (struct mptcp_sock *msk,struct list_head *rm_list) {
net/mptcp/pm_userspace.c +1 -1
@@ -232,7 +232,7 @@ int mptcp_nl_cmd_remove(struct sk_buff *list_move (&match->list, &free_list); -mptcp_pm_remove_addrs_and_subflows (msk, &free_list); +mptcp_pm_remove_addrs (msk, &free_list);release_sock ((struct sock *)msk);
net/mptcp/protocol.h +1 -0
@@ -835,6 +835,7 @@ int mptcp_pm_announce_addr(struct mptcp_ bool echo);int mptcp_pm_remove_addr (struct mptcp_sock *msk,const struct mptcp_rm_list *rm_list);int mptcp_pm_remove_subflow (struct mptcp_sock *msk,const struct mptcp_rm_list *rm_list); +void mptcp_pm_remove_addrs (struct mptcp_sock *msk,struct list_head *rm_list);void mptcp_pm_remove_addrs_and_subflows (struct mptcp_sock *msk,struct list_head *rm_list);
Greg Kroah-Hartman
maintainerPATCH 97/160 mptcp: add address into userspace pm list
In reply to Greg Kroah-HartmanFrom: Geliang Tang <[email protected]>
commit 24430f8bf51655c5ab7ddc2fafe939dd3cd0dd47 upstream.
Add the address into userspace_pm_local_addr_list when the subflow is created. Make sure it can be found in mptcp_nl_cmd_remove(). And delete it in the new helper mptcp_userspace_pm_delete_local_addr().
By doing this, the "REMOVE" command also works with subflows that have been created via the "SUB_CREATE" command instead of restricting to the addresses that have been announced via the "ANNOUNCE" command.
--- net/mptcp/pm_userspace.c | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+)
net/mptcp/pm_userspace.c +41 -0
@@ -79,6 +79,30 @@ append_err:return ret; } +/* If the subflow is closed from the other peer (not via a +* subflow destroy command then), we want to keep the entry +* not to assign the same ID to another address and to be +* able to send RM_ADDR after the removal of the subflow. +*/ +static int mptcp_userspace_pm_delete_local_addr (struct mptcp_sock *msk, +struct mptcp_pm_addr_entry *addr) +{ +struct mptcp_pm_addr_entry *entry, *tmp; + +list_for_each_entry_safe (entry, tmp, &msk->pm.userspace_pm_local_addr_list, list) { +if (mptcp_addresses_equal (&entry->addr, &addr->addr, false)) { +/* TODO: a refcount is needed because the entry can +* be used multiple times (e.g. fullmesh mode). +*/ +list_del_rcu (&entry->list); +kfree (entry); +return 0 ; + } + } + +return -EINVAL ; +} +int mptcp_userspace_pm_get_flags_and_ifindex_by_id (struct mptcp_sock *msk,unsigned int id,u8 *flags,int *ifindex)
@@ -251,6 +275,7 @@ int mptcp_nl_cmd_sf_create(struct sk_bufstruct nlattr *raddr = info->attrs[MPTCP_PM_ATTR_ADDR_REMOTE ];struct nlattr *token = info->attrs[MPTCP_PM_ATTR_TOKEN ];struct nlattr *laddr = info->attrs[MPTCP_PM_ATTR_ADDR ]; +struct mptcp_pm_addr_entry local = {0 };struct mptcp_addr_info addr_r;struct mptcp_addr_info addr_l;struct mptcp_sock *msk;
@@ -302,12 +327,24 @@ int mptcp_nl_cmd_sf_create(struct sk_buf goto create_err; } + local.addr = addr_l; + err =mptcp_userspace_pm_append_new_local_addr (msk, &local); +if (err <0 ) { +GENL_SET_ERR_MSG (info,"did not match address and id" ); + goto create_err; + } +lock_sock (sk); err =__mptcp_subflow_connect (sk, &addr_l, &addr_r);release_sock (sk); +spin_lock_bh (&msk->pm.lock); +if (err) +mptcp_userspace_pm_delete_local_addr (msk, &local); +spin_unlock_bh (&msk->pm.lock); + create_err:sock_put ((struct sock *)msk);return err;
@@ -420,7 +457,11 @@ int mptcp_nl_cmd_sf_destroy(struct sk_bu ssk =mptcp_nl_find_ssk (msk, &addr_l, &addr_r);if (ssk) {struct mptcp_subflow_context *subflow =mptcp_subflow_ctx (ssk); +struct mptcp_pm_addr_entry entry = { .addr = addr_l }; +spin_lock_bh (&msk->pm.lock); +mptcp_userspace_pm_delete_local_addr (msk, &entry); +spin_unlock_bh (&msk->pm.lock);mptcp_subflow_shutdown (sk, ssk,RCV_SHUTDOWN |SEND_SHUTDOWN );mptcp_close_ssk (sk, ssk, subflow);MPTCP_INC_STATS (sock_net (sk),MPTCP_MIB_RMSUBFLOW );
Greg Kroah-Hartman
maintainerPATCH 98/160 mptcp: update userspace pm infos
In reply to Greg Kroah-HartmanFrom: Geliang Tang <[email protected]>
commit 77e4b94a3de692a09b79945ecac5b8e6b77f10c1 upstream.
Increase pm subflows counter on both server side and client side when userspace pm creates a new subflow, and decrease the counter when it closes a subflow.
Increase add_addr_signaled counter in mptcp_nl_cmd_announce() when the address is announced by userspace PM.
This modification is similar to how the in-kernel PM is updating the
counter: when additional subflows are created/removed.
--- net/mptcp/pm.c | 23 +++++++++++++++++++---- net/mptcp/pm_userspace.c | 5 +++++ 2 files changed, 24 insertions(+), 4 deletions(-)
net/mptcp/pm.c +19 -4
@@ -87,8 +87,15 @@ bool mptcp_pm_allow_new_subflow(struct munsigned int subflows_max;int ret =0 ; -if (mptcp_pm_is_userspace (msk)) -return mptcp_userspace_pm_active (msk); +if (mptcp_pm_is_userspace (msk)) { +if (mptcp_userspace_pm_active (msk)) { +spin_lock_bh (&pm->lock); + pm->subflows++; +spin_unlock_bh (&pm->lock); +return true; + } +return false; + } subflows_max =mptcp_pm_get_subflows_max (msk);
@@ -181,8 +188,16 @@ void mptcp_pm_subflow_check_next(structstruct mptcp_pm_data *pm = &msk->pm;bool update_subflows; - update_subflows = (subflow->request_join || subflow->mp_join) && -mptcp_pm_is_kernel (msk); + update_subflows = subflow->request_join || subflow->mp_join; +if (mptcp_pm_is_userspace (msk)) { +if (update_subflows) { +spin_lock_bh (&pm->lock); + pm->subflows--; +spin_unlock_bh (&pm->lock); + } +return ; + } +if (!READ_ONCE (pm->work_pending) && !update_subflows)return ;
net/mptcp/pm_userspace.c +5 -0
@@ -69,6 +69,7 @@ int mptcp_userspace_pm_append_new_local_MPTCP_PM_MAX_ADDR_ID +1 , 1);list_add_tail_rcu (&e->list, &msk->pm.userspace_pm_local_addr_list); + msk->pm.local_addr_used++; ret = e->addr.id; }else if (match) { ret = entry->addr.id;
@@ -96,6 +97,7 @@ static int mptcp_userspace_pm_delete_loc*/ list_del_rcu (&entry->list);kfree (entry); + msk->pm.local_addr_used--;return 0 ; } }
@@ -195,6 +197,7 @@ int mptcp_nl_cmd_announce(struct sk_buffspin_lock_bh (&msk->pm.lock);if (mptcp_pm_alloc_anno_list (msk, &addr_val)) { + msk->pm.add_addr_signaled++;mptcp_pm_announce_addr (msk, &addr_val.addr, false);mptcp_pm_nl_addr_send_ack (msk); }
@@ -343,6 +346,8 @@ int mptcp_nl_cmd_sf_create(struct sk_bufspin_lock_bh (&msk->pm.lock);if (err)mptcp_userspace_pm_delete_local_addr (msk, &local); +else + msk->pm.subflows++;spin_unlock_bh (&msk->pm.lock); create_err:
Greg Kroah-Hartman
maintainerPATCH 99/160 selftests: mptcp: update userspace pm addr tests
In reply to Greg Kroah-HartmanFrom: Geliang Tang <[email protected]>
commit 48d73f609dcceeb563b0d960e59bf0362581e39c upstream.
This patch is linked to the previous commit ("mptcp: only send RM_ADDR in nl_cmd_remove").
To align with what is done by the in-kernel PM, update userspace pm addr selftests, by sending a remove_subflows command together after the remove_addrs command.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 8 ++++++++ 1 file changed, 8 insertions(+)
tools/testing/selftests/net/mptcp/mptcp_join.sh +8 -0
@@ -856,7 +856,15 @@ do_transfer() sed -n 's/.*\(token:\)\([[:digit:]]*\).*$/\2/p;q') ip netns exec ${listener_ns} ./pm_nl_ctl ann $addr token $tk id $id sleep 1 + sp=$(grep "type:10" "$evts_ns1" | + sed -n 's/.*\(sport:\)\([[:digit:]]*\).*$/\2/p;q') + da=$(grep "type:10" "$evts_ns1" | + sed -n 's/.*\(daddr6:\)\([0-9a-f:.]*\).*$/\2/p;q') + dp=$(grep "type:10" "$evts_ns1" | + sed -n 's/.*\(dport:\)\([[:digit:]]*\).*$/\2/p;q') ip netns exec ${listener_ns} ./pm_nl_ctl rem token $tk id $id + ip netns exec ${listener_ns} ./pm_nl_ctl dsf lip "::ffff:$addr" \ + lport $sp rip $da rport $dp token $tk fi counter=$((counter + 1))
Greg Kroah-Hartman
maintainerPATCH 100/160 selftests: mptcp: update userspace pm subflow tests
In reply to Greg Kroah-HartmanFrom: Geliang Tang <[email protected]>
commit 6c160b636c91e71e50c39134f78257cc35305ff0 upstream.
To align with what is done by the in-kernel PM, update userspace pm subflow selftests, by sending the a remove_addrs command together before the remove_subflows command. This will get a RM_ADDR in chk_rm_nr().
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +2 -1
@@ -930,6 +930,7 @@ do_transfer() sleep 1 sp=$(grep "type:10" "$evts_ns2" | sed -n 's/.*\(sport:\)\([[:digit:]]*\).*$/\2/p;q') + ip netns exec ${connector_ns} ./pm_nl_ctl rem token $tk id $id ip netns exec ${connector_ns} ./pm_nl_ctl dsf lip $addr lport $sp \ rip $da rport $dp token $tk fi
@@ -3104,7 +3105,7 @@ userspace_tests() pm_nl_set_limits $ns1 0 1 run_tests $ns1 $ns2 10.0.1.1 0 0 userspace_1 slow chk_join_nr 1 1 1 - chk_rm_nr 0 1 + chk_rm_nr 1 1 kill_events_pids fi }
Greg Kroah-Hartman
maintainerPATCH 101/160 ceph: fix use-after-free bug for inodes when flushing capsnaps
In reply to Greg Kroah-HartmanFrom: Xiubo Li <[email protected]>
commit 409e873ea3c1fd3079909718bbeb06ac1ec7f38b upstream.
There is a race between capsnaps flush and removing the inode from 'mdsc->snap_flush_list' list:
== Thread A == == Thread B ==ceph_queue_cap_snap()
-> allocate 'capsnapA'
->ihold('&ci->vfs_inode')
->add 'capsnapA' to 'ci->i_cap_snaps'
->add 'ci' to 'mdsc->snap_flush_list'
...
== Thread C ==ceph_flush_snaps()
->__ceph_flush_snaps()
->__send_flush_snap()
handle_cap_flushsnap_ack()
->iput('&ci->vfs_inode')
this also will release 'ci'
...
== Thread D ==
ceph_handle_snap()
->flush_snaps()
->iterate 'mdsc->snap_flush_list'
->get the stale 'ci' ->remove 'ci' from ->ihold(&ci->vfs_inode) this
'mdsc->snap_flush_list' will WARNING
To fix this we will increase the inode's i_count ref when adding 'ci' to the 'mdsc->snap_flush_list' list.
[ idryomov: need_put int -> bool ]
--- fs/ceph/caps.c | 6 ++++++ fs/ceph/snap.c | 4 +++- 2 files changed, 9 insertions(+), 1 deletion(-)
fs/ceph/caps.c +6 -0
@@ -1627,6 +1627,7 @@ void ceph_flush_snaps(struct ceph_inode_struct inode *inode = &ci->netfs.inode;struct ceph_mds_client *mdsc =ceph_inode_to_client (inode)->mdsc;struct ceph_mds_session *session =NULL ; +bool need_put = false;int mds;dout ("ceph_flush_snaps %p\n" , inode);
@@ -1671,8 +1672,13 @@ out:ceph_put_mds_session (session);/* we flushed them all; remove this inode from the queue */ spin_lock (&mdsc->snap_flush_lock); +if (!list_empty (&ci->i_snap_flush_item)) + need_put = true;list_del_init (&ci->i_snap_flush_item);spin_unlock (&mdsc->snap_flush_lock); + +if (need_put) +iput (inode); }/*
fs/ceph/snap.c +3 -1
@@ -693,8 +693,10 @@ int __ceph_finish_cap_snap(struct ceph_i capsnap->size);spin_lock (&mdsc->snap_flush_lock); -if (list_empty (&ci->i_snap_flush_item)) +if (list_empty (&ci->i_snap_flush_item)) { +ihold (inode);list_add_tail (&ci->i_snap_flush_item, &mdsc->snap_flush_list); + }spin_unlock (&mdsc->snap_flush_lock);return 1 ;/* caller may want to ceph_flush_snaps */ }
Greg Kroah-Hartman
maintainerPATCH 102/160 accel/ivpu: Do not trigger extra VPU reset if the VPU is idle
In reply to Greg Kroah-HartmanFrom: Andrzej Kacprowski <[email protected]>
commit 9f7e3611f6c828fcb6001c39d8e7a523a4f31525 upstream.
Turning off the PLL and entering D0i3 will reset the VPU so an explicit IP reset is redundant.
But if the VPU is active, it may interfere with PLL disabling and to avoid that, we have to issue an additional IP reset to silence the VPU before turning off the PLL.
--- drivers/accel/ivpu/ivpu_hw_mtl.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/accel/ivpu/ivpu_hw_mtl.c +5 -4
@@ -754,9 +754,8 @@ static int ivpu_hw_mtl_power_down(struct ivpu_device *vdev) {int ret =0 ; -if (ivpu_hw_mtl_reset (vdev)) { +if (!ivpu_hw_mtl_is_idle (vdev) &&ivpu_hw_mtl_reset (vdev)) {ivpu_err (vdev,"Failed to reset the VPU\n" ); - ret = -EIO ; }if (ivpu_pll_disable (vdev)) {
@@ -764,8 +763,10 @@ static int ivpu_hw_mtl_power_down(struct ivpu_device *vdev) ret = -EIO ; } -if (ivpu_hw_mtl_d0i3_enable (vdev)) -ivpu_warn (vdev,"Failed to enable D0I3\n" ); +if (ivpu_hw_mtl_d0i3_enable (vdev)) { +ivpu_err (vdev,"Failed to enter D0I3\n" ); + ret = -EIO ; + }return ret; }
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 103/160 accel/ivpu: Fix sporadic VPU boot failure
In reply to Greg Kroah-HartmanFrom: Andrzej Kacprowski <[email protected]>
commit a3efabee5878b8d7b1863debb78cb7129d07a346 upstream.
Wait for AON bit in HOST_SS_CPR_RST_CLR to return 0 before starting VPUIP power up sequence, otherwise the VPU device may sporadically fail to boot.
An error in power up sequence is propagated to the runtime power management - the device will be in an error state until the VPU driver is reloaded.
--- drivers/accel/ivpu/ivpu_hw_mtl.c | 13 ++++++++++++- drivers/accel/ivpu/ivpu_hw_mtl_reg.h | 1 + 2 files changed, 13 insertions(+), 1 deletion(-)
drivers/accel/ivpu/ivpu_hw_mtl.c +12 -1
@@ -197,6 +197,11 @@ static void ivpu_pll_init_frequency_ratios(struct ivpu_device *vdev) hw->pll.pn_ratio =clamp_t (u8, fuse_pn_ratio, hw->pll.min_ratio, hw->pll.max_ratio); } +static int ivpu_hw_mtl_wait_for_vpuip_bar (struct ivpu_device *vdev) +{ +return REGV_POLL_FLD (MTL_VPU_HOST_SS_CPR_RST_CLR ,AON ,0 ,100 ); +} +static int ivpu_pll_drive (struct ivpu_device *vdev,bool enable) {struct ivpu_hw_info *hw = vdev->hw;
@@ -239,6 +244,12 @@ static int ivpu_pll_drive(struct ivpu_device *vdev, bool enable)ivpu_err (vdev,"Timed out waiting for PLL ready status\n" );return ret; } + + ret =ivpu_hw_mtl_wait_for_vpuip_bar (vdev); +if (ret) { +ivpu_err (vdev,"Timed out waiting for VPUIP bar\n" ); +return ret; + } }return 0 ;
@@ -256,7 +267,7 @@ static int ivpu_pll_disable(struct ivpu_device *vdev)static void ivpu_boot_host_ss_rst_clr_assert (struct ivpu_device *vdev) { -u32 val =REGV_RD32 (MTL_VPU_HOST_SS_CPR_RST_CLR ); +u32 val =0 ; val =REG_SET_FLD (MTL_VPU_HOST_SS_CPR_RST_CLR ,TOP_NOC , val); val =REG_SET_FLD (MTL_VPU_HOST_SS_CPR_RST_CLR ,DSS_MAS , val);
drivers/accel/ivpu/ivpu_hw_mtl_reg.h +1 -0
@@ -91,6 +91,7 @@#define MTL_VPU_HOST_SS_CPR_RST_SET_MSS_MAS_MASK BIT_MASK(11)#define MTL_VPU_HOST_SS_CPR_RST_CLR 0x00000098u +#define MTL_VPU_HOST_SS_CPR_RST_CLR_AON_MASK BIT_MASK(0)#define MTL_VPU_HOST_SS_CPR_RST_CLR_TOP_NOC_MASK BIT_MASK(1)#define MTL_VPU_HOST_SS_CPR_RST_CLR_DSS_MAS_MASK BIT_MASK(10)#define MTL_VPU_HOST_SS_CPR_RST_CLR_MSS_MAS_MASK BIT_MASK(11)
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 104/160 s390/dasd: Use correct lock while counting channel queue length
In reply to Greg Kroah-HartmanFrom: Jan Höppner <[email protected]>
commit ccc45cb4e7271c74dbb27776ae8f73d84557f5c6 upstream.
The lock around counting the channel queue length in the BIODASDINFO ioctl was incorrectly changed to the dasd_block->queue_lock with commit 583d6535cb9d ("dasd: remove dead code"). This can lead to endless list iterations and a subsequent crash.
The queue_lock is supposed to be used only for queue lists belonging to dasd_block. For dasd_device related queue lists the ccwdev lock must be used.
Fix the mentioned issues by correctly using the ccwdev lock instead of the queue lock.
--- drivers/s390/block/dasd_ioctl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/s390/block/dasd_ioctl.c +2 -2
@@ -552,10 +552,10 @@ static int __dasd_ioctl_information(strumemcpy (dasd_info->type, base->discipline->name,4 ); -spin_lock_irqsave (&block->queue_lock, flags); +spin_lock_irqsave (get_ccwdev_lock (base->cdev), flags);list_for_each (l, &base->ccw_queue) dasd_info->chanq_len++; -spin_unlock_irqrestore (&block->queue_lock, flags); +spin_unlock_irqrestore (get_ccwdev_lock (base->cdev), flags);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 105/160 Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk
In reply to Greg Kroah-HartmanFrom: Luiz Augusto von Dentz <[email protected]>
commit c5d2b6fa26b5b8386a9cc902cdece3a46bef2bd2 upstream.
Similar to commit 0f7d9b31ce7a ("netfilter: nf_tables: fix use-after-free in nft_set_catchall_destroy()"). We can not access k after kfree_rcu() call.
--- net/bluetooth/hci_core.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/bluetooth/hci_core.c +4 -4
@@ -1416,10 +1416,10 @@ int hci_remove_link_key(struct hci_dev *int hci_remove_ltk (struct hci_dev *hdev,bdaddr_t *bdaddr,u8 bdaddr_type) { -struct smp_ltk *k; +struct smp_ltk *k, *tmp;int removed =0 ; -list_for_each_entry_rcu (k, &hdev->long_term_keys, list) { +list_for_each_entry_safe (k, tmp, &hdev->long_term_keys, list) {if (bacmp (bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)continue ;
@@ -1435,9 +1435,9 @@ int hci_remove_ltk(struct hci_dev *hdev,void hci_remove_irk (struct hci_dev *hdev,bdaddr_t *bdaddr,u8 addr_type) { -struct smp_irk *k; +struct smp_irk *k, *tmp; -list_for_each_entry_rcu (k, &hdev->identity_resolving_keys, list) { +list_for_each_entry_safe (k, tmp, &hdev->identity_resolving_keys, list) {if (bacmp (bdaddr, &k->bdaddr) || k->addr_type != addr_type)continue ;
Greg Kroah-Hartman
maintainerPATCH 106/160 Bluetooth: fix debugfs registration
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit fe2ccc6c29d53e14d3c8b3ddf8ad965a92e074ee upstream.
Since commit ec6cef9cd98d ("Bluetooth: Fix SMP channel registration for unconfigured controllers") the debugfs interface for unconfigured controllers will be created when the controller is configured.
There is however currently nothing preventing a controller from being configured multiple time (e.g. setting the device address using btmgmt) which results in failed attempts to register the already registered debugfs entries:
debugfs: File 'features' in directory 'hci0' already present!
debugfs: File 'manufacturer' in directory 'hci0' already present!
debugfs: File 'hci_version' in directory 'hci0' already present!
...
debugfs: File 'quirk_simultaneous_discovery' in directory 'hci0' already present!
Add a controller flag to avoid trying to register the debugfs interface more than once.
--- include/net/bluetooth/hci.h | 1 + net/bluetooth/hci_sync.c | 3 +++ 2 files changed, 4 insertions(+)
include/net/bluetooth/hci.h +1 -0
@@ -350,6 +350,7 @@ enum {enum {HCI_SETUP ,HCI_CONFIG , +HCI_DEBUGFS_CREATED ,HCI_AUTO_OFF ,HCI_RFKILLED ,HCI_MGMT ,
net/bluetooth/hci_sync.c +3 -0
@@ -4510,6 +4510,9 @@ static int hci_init_sync(struct hci_dev !hci_dev_test_flag(hdev, HCI_CONFIG))return 0 ; +if (hci_dev_test_and_set_flag (hdev,HCI_DEBUGFS_CREATED )) +return 0 ; +hci_debugfs_create_common (hdev);if (lmp_bredr_capable (hdev))
Greg Kroah-Hartman
maintainerPATCH 107/160 Bluetooth: hci_qca: fix debugfs registration
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 47c5d829a3e326b7395352a10fc8a6effe7afa15 upstream.
Since commit 3e4be65eb82c ("Bluetooth: hci_qca: Add poweroff support during hci down for wcn3990"), the setup callback which registers the debugfs interface can be called multiple times.
This specifically leads to the following error when powering on the controller:
debugfs: Directory 'ibs' with parent 'hci0' already present!
Add a driver flag to avoid trying to register the debugfs interface more than once.
--- drivers/bluetooth/hci_qca.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/bluetooth/hci_qca.c +5 -1
@@ -78,7 +78,8 @@ enum qca_flags {QCA_HW_ERROR_EVENT ,QCA_SSR_TRIGGERED ,QCA_BT_OFF , -QCA_ROM_FW +QCA_ROM_FW , + QCA_DEBUGFS_CREATED, }; enum qca_capabilities {
@@ -635,6 +636,9 @@ static void qca_debugfs_init(struct hci_if (!hdev->debugfs)return ; +if (test_and_set_bit (QCA_DEBUGFS_CREATED , &qca->flags)) +return ; + ibs_dir =debugfs_create_dir ("ibs" , hdev->debugfs);/* read only */
Greg Kroah-Hartman
maintainerPATCH 108/160 tee: amdtee: Add return_origin to struct tee_cmd_load_ta
In reply to Greg Kroah-HartmanFrom: Rijo Thomas <[email protected]>
commit 436eeae0411acdfc54521ddea80ee76d4ae8a7ea upstream.
After TEE has completed processing of TEE_CMD_ID_LOAD_TA, set proper value in 'return_origin' argument passed by open_session() call. To do so, add 'return_origin' field to the structure tee_cmd_load_ta. The Trusted OS shall update return_origin as part of TEE processing.
This change to 'struct tee_cmd_load_ta' interface requires a similar update in AMD-TEE Trusted OS's TEE_CMD_ID_LOAD_TA interface.
This patch has been verified on Phoenix Birman setup. On older APUs, return_origin value will be 0.
--- drivers/tee/amdtee/amdtee_if.h | 10 ++++++---- drivers/tee/amdtee/call.c | 28 ++++++++++++++++------------ 2 files changed, 22 insertions(+), 16 deletions(-)
drivers/tee/amdtee/amdtee_if.h +6 -4
@@ -118,16 +118,18 @@ struct tee_cmd_unmap_shared_mem {/** * struct tee_cmd_load_ta - load Trusted Application (TA) binary into TEE -* @low_addr: [in] bits [31:0] of the physical address of the TA binary -* @hi_addr: [in] bits [63:32] of the physical address of the TA binary -* @size: [in] size of TA binary in bytes -* @ta_handle: [out] return handle of the loaded TA +* @low_addr: [in] bits [31:0] of the physical address of the TA binary +* @hi_addr: [in] bits [63:32] of the physical address of the TA binary +* @size: [in] size of TA binary in bytes +* @ta_handle: [out] return handle of the loaded TA +* @return_origin: [out] origin of return code after TEE processing */ struct tee_cmd_load_ta {u32 low_addr;u32 hi_addr;u32 size;u32 ta_handle; +u32 return_origin; };/**
drivers/tee/amdtee/call.c +16 -12
@@ -423,19 +423,23 @@ int handle_load_ta(void *data, u32 size,if (ret) { arg->ret_origin =TEEC_ORIGIN_COMMS ; arg->ret =TEEC_ERROR_COMMUNICATION ; - }else if (arg->ret ==TEEC_SUCCESS ) { - ret =get_ta_refcount (load_cmd.ta_handle); -if (!ret) { - arg->ret_origin =TEEC_ORIGIN_COMMS ; - arg->ret =TEEC_ERROR_OUT_OF_MEMORY ; + }else { + arg->ret_origin = load_cmd.return_origin; -/* Unload the TA on error */ - unload_cmd.ta_handle = load_cmd.ta_handle; -psp_tee_process_cmd (TEE_CMD_ID_UNLOAD_TA , - (void *)&unload_cmd, -sizeof (unload_cmd), &ret); - }else { -set_session_id (load_cmd.ta_handle,0 , &arg->session); +if (arg->ret ==TEEC_SUCCESS ) { + ret =get_ta_refcount (load_cmd.ta_handle); +if (!ret) { + arg->ret_origin =TEEC_ORIGIN_COMMS ; + arg->ret =TEEC_ERROR_OUT_OF_MEMORY ; + +/* Unload the TA on error */ + unload_cmd.ta_handle = load_cmd.ta_handle; +psp_tee_process_cmd (TEE_CMD_ID_UNLOAD_TA , + (void *)&unload_cmd, +sizeof (unload_cmd), &ret); + }else { +set_session_id (load_cmd.ta_handle,0 , &arg->session); + } } }mutex_unlock (&ta_refcount_mutex);
Greg Kroah-Hartman
maintainerPATCH 109/160 rbd: move RBD_OBJ_FLAG_COPYUP_ENABLED flag setting
In reply to Greg Kroah-HartmanFrom: Ilya Dryomov <[email protected]>
commit 09fe05c57b5aaf23e2c35036c98ea9f282b19a77 upstream.
Move RBD_OBJ_FLAG_COPYUP_ENABLED flag setting into the object request state machine to allow for the snapshot context to be captured in the image request state machine rather than in rbd_queue_workfn().
--- drivers/block/rbd.c | 32 +++++++++++++++++++++----------- 1 file changed, 21 insertions(+), 11 deletions(-)
drivers/block/rbd.c +21 -11
@@ -1334,14 +1334,28 @@ static bool rbd_obj_is_tail(struct rbd_o/* * Must be called after rbd_obj_calc_img_extents(). */ -static bool rbd_obj_copyup_enabled (struct rbd_obj_request *obj_req) +static void rbd_obj_set_copyup_enabled (struct rbd_obj_request *obj_req) { -if (!obj_req->num_img_extents || - (rbd_obj_is_entire (obj_req) && - !obj_req->img_request->snapc->num_snaps)) -return false; +if (obj_req->img_request->op_type ==OBJ_OP_DISCARD ) { +dout ("%s %p objno %llu discard\n" , __func__, obj_req, + obj_req->ex.oe_objno); +return ; + } -return true; +if (!obj_req->num_img_extents) { +dout ("%s %p objno %llu not overlapping\n" , __func__, obj_req, + obj_req->ex.oe_objno); +return ; + } + +if (rbd_obj_is_entire (obj_req) && + !obj_req->img_request->snapc->num_snaps) { +dout ("%s %p objno %llu entire\n" , __func__, obj_req, + obj_req->ex.oe_objno); +return ; + } + + obj_req->flags |=RBD_OBJ_FLAG_COPYUP_ENABLED ; }static u64 rbd_obj_img_extents_bytes (struct rbd_obj_request *obj_req)
@@ -2233,9 +2247,6 @@ static int rbd_obj_init_write(struct rbdif (ret)return ret; -if (rbd_obj_copyup_enabled (obj_req)) - obj_req->flags |=RBD_OBJ_FLAG_COPYUP_ENABLED ; - obj_req->write_state =RBD_OBJ_WRITE_START ;return 0 ; }
@@ -2341,8 +2352,6 @@ static int rbd_obj_init_zeroout(struct rif (ret)return ret; -if (rbd_obj_copyup_enabled (obj_req)) - obj_req->flags |=RBD_OBJ_FLAG_COPYUP_ENABLED ;if (!obj_req->num_img_extents) { obj_req->flags |=RBD_OBJ_FLAG_NOOP_FOR_NONEXISTENT ;if (rbd_obj_is_entire (obj_req))
@@ -3286,6 +3295,7 @@ again:case RBD_OBJ_WRITE_START :rbd_assert (!*result); +rbd_obj_set_copyup_enabled (obj_req);if (rbd_obj_write_is_noop (obj_req))return true;
Greg Kroah-Hartman
maintainerPATCH 110/160 rbd: get snapshot context after exclusive lock is ensured to be held
In reply to Greg Kroah-HartmanFrom: Ilya Dryomov <[email protected]>
commit 870611e4877eff1e8413c3fb92a585e45d5291f6 upstream.
Move capturing the snapshot context into the image request state machine, after exclusive lock is ensured to be held for the duration of dealing with the image request. This is needed to ensure correctness of fast-diff states (OBJECT_EXISTS vs OBJECT_EXISTS_CLEAN) and object deltas computed based off of them. Otherwise the object map that is forked for the snapshot isn't guaranteed to accurately reflect the contents of the snapshot when the snapshot is taken under I/O. This breaks differential backup and snapshot-based mirroring use cases with fast-diff enabled: since some object deltas may be incomplete, the destination image may get corrupted.
--- drivers/block/rbd.c | 30 +++++++++++++++++++++++------- 1 file changed, 23 insertions(+), 7 deletions(-)
drivers/block/rbd.c +23 -7
@@ -1336,6 +1336,8 @@ static bool rbd_obj_is_tail(struct rbd_o*/ static void rbd_obj_set_copyup_enabled (struct rbd_obj_request *obj_req) { +rbd_assert (obj_req->img_request->snapc); +if (obj_req->img_request->op_type ==OBJ_OP_DISCARD ) {dout ("%s %p objno %llu discard\n" , __func__, obj_req, obj_req->ex.oe_objno);
@@ -1456,6 +1458,7 @@ __rbd_obj_add_osd_request(struct rbd_objstatic struct ceph_osd_request *rbd_obj_add_osd_request (struct rbd_obj_request *obj_req,int num_ops) { +rbd_assert (obj_req->img_request->snapc);return __rbd_obj_add_osd_request (obj_req, obj_req->img_request->snapc, num_ops); }
@@ -1592,15 +1595,18 @@ static void rbd_img_request_init(structmutex_init (&img_request->state_mutex); } +/* +* Only snap_id is captured here, for reads. For writes, snapshot +* context is captured in rbd_img_object_requests() after exclusive +* lock is ensured to be held. +*/ static void rbd_img_capture_header (struct rbd_img_request *img_req) {struct rbd_device *rbd_dev = img_req->rbd_dev;lockdep_assert_held (&rbd_dev->header_rwsem); -if (rbd_img_is_write (img_req)) - img_req->snapc =ceph_get_snap_context (rbd_dev->header.snapc); -else +if (!rbd_img_is_write (img_req)) img_req->snap_id = rbd_dev->spec->snap_id;if (rbd_dev_parent_get (rbd_dev))
@@ -3482,9 +3488,19 @@ static int rbd_img_exclusive_lock(structstatic void rbd_img_object_requests (struct rbd_img_request *img_req) { +struct rbd_device *rbd_dev = img_req->rbd_dev;struct rbd_obj_request *obj_req;rbd_assert (!img_req->pending.result && !img_req->pending.num_pending); +rbd_assert (!need_exclusive_lock (img_req) || +__rbd_is_lock_owner (rbd_dev)); + +if (rbd_img_is_write (img_req)) { +rbd_assert (!img_req->snapc); +down_read (&rbd_dev->header_rwsem); + img_req->snapc =ceph_get_snap_context (rbd_dev->header.snapc); +up_read (&rbd_dev->header_rwsem); + }for_each_obj_request (img_req, obj_req) {int result =0 ;
@@ -3502,7 +3518,6 @@ static void rbd_img_object_requests(strustatic bool rbd_img_advance (struct rbd_img_request *img_req,int *result) { -struct rbd_device *rbd_dev = img_req->rbd_dev;int ret; again:
@@ -3523,9 +3538,6 @@ again:if (*result)return true; -rbd_assert (!need_exclusive_lock (img_req) || -__rbd_is_lock_owner (rbd_dev)); -rbd_img_object_requests (img_req);if (!img_req->pending.num_pending) { *result = img_req->pending.result;
@@ -3987,6 +3999,10 @@ static int rbd_post_acquire_action(struc {int ret; + ret =rbd_dev_refresh (rbd_dev); +if (ret) +return ret; +if (rbd_dev->header.features &RBD_FEATURE_OBJECT_MAP ) { ret =rbd_object_map_open (rbd_dev);if (ret)
Greg Kroah-Hartman
maintainerPATCH 111/160 virtio_net: use control_buf for coalesce params
In reply to Greg Kroah-HartmanFrom: Brett Creeley <[email protected]>
commit accc1bf23068c1cdc4c2b015320ba856e210dd98 upstream.
Commit 699b045a8e43 ("net: virtio_net: notifications coalescing support") added coalescing command support for virtio_net. However, the coalesce commands are using buffers on the stack, which is causing the device to see DMA errors. There should also be a complaint from check_for_stack() in debug_dma_map_xyz(). Fix this by adding and using coalesce params from the control_buf struct, which aligns with other commands.
--- drivers/net/virtio_net.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/net/virtio_net.c +8 -8
@@ -204,6 +204,8 @@ struct control_buf {__virtio16 vid;__virtio64 offloads;struct virtio_net_ctrl_rss rss; +struct virtio_net_ctrl_coal_tx coal_tx; +struct virtio_net_ctrl_coal_rx coal_rx; };struct virtnet_info {
@@ -2933,12 +2935,10 @@ static int virtnet_send_notf_coal_cmds(s struct ethtool_coalesce *ec) { struct scatterlist sgs_tx, sgs_rx; - struct virtio_net_ctrl_coal_tx coal_tx; - struct virtio_net_ctrl_coal_rx coal_rx; - coal_tx.tx_usecs = cpu_to_le32(ec->tx_coalesce_usecs); - coal_tx.tx_max_packets = cpu_to_le32(ec->tx_max_coalesced_frames); - sg_init_one(&sgs_tx, &coal_tx, sizeof(coal_tx)); + vi->ctrl->coal_tx.tx_usecs = cpu_to_le32(ec->tx_coalesce_usecs); + vi->ctrl->coal_tx.tx_max_packets = cpu_to_le32(ec->tx_max_coalesced_frames); + sg_init_one(&sgs_tx, &vi->ctrl->coal_tx, sizeof(vi->ctrl->coal_tx)); if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_NOTF_COAL, VIRTIO_NET_CTRL_NOTF_COAL_TX_SET,
@@ -2949,9 +2949,9 @@ static int virtnet_send_notf_coal_cmds(s vi->tx_usecs = ec->tx_coalesce_usecs; vi->tx_max_packets = ec->tx_max_coalesced_frames; - coal_rx.rx_usecs =cpu_to_le32 (ec->rx_coalesce_usecs); - coal_rx.rx_max_packets =cpu_to_le32 (ec->rx_max_coalesced_frames); -sg_init_one (&sgs_rx, &coal_rx,sizeof (coal_rx)); + vi->ctrl->coal_rx.rx_usecs =cpu_to_le32 (ec->rx_coalesce_usecs); + vi->ctrl->coal_rx.rx_max_packets =cpu_to_le32 (ec->rx_max_coalesced_frames); +sg_init_one (&sgs_rx, &vi->ctrl->coal_rx,sizeof (vi->ctrl->coal_rx)); if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_NOTF_COAL, VIRTIO_NET_CTRL_NOTF_COAL_RX_SET,
Greg Kroah-Hartman
maintainerPATCH 112/160 soc: qcom: icc-bwmon: fix incorrect error code passed to dev_err_probe()
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
commit 3530167c6fe8001de6c026a3058eaca4c8a5329f upstream.
Pass to dev_err_probe() PTR_ERR from actual dev_pm_opp_find_bw_floor() call which failed, instead of previous ret which at this point is 0. Failure of dev_pm_opp_find_bw_floor() would result in prematurely ending the probe with success.
Fixes smatch warnings:
drivers/soc/qcom/icc-bwmon.c:776 bwmon_probe() warn: passing zero to 'dev_err_probe' drivers/soc/qcom/icc-bwmon.c:781 bwmon_probe() warn: passing zero to 'dev_err_probe'
--- drivers/soc/qcom/icc-bwmon.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/soc/qcom/icc-bwmon.c +2 -2
@@ -603,12 +603,12 @@ static int bwmon_probe(struct platform_d bwmon->max_bw_kbps =UINT_MAX ; opp =dev_pm_opp_find_bw_floor (dev, &bwmon->max_bw_kbps,0 );if (IS_ERR (opp)) -return dev_err_probe (dev, ret,"failed to find max peak bandwidth\n" ); +return dev_err_probe (dev,PTR_ERR (opp),"failed to find max peak bandwidth\n" ); bwmon->min_bw_kbps =0 ; opp =dev_pm_opp_find_bw_ceil (dev, &bwmon->min_bw_kbps,0 );if (IS_ERR (opp)) -return dev_err_probe (dev, ret,"failed to find min peak bandwidth\n" ); +return dev_err_probe (dev,PTR_ERR (opp),"failed to find min peak bandwidth\n" ); bwmon->dev = dev;
Greg Kroah-Hartman
maintainerPATCH 113/160 pinctrl: meson-axg: add missing GPIOA_18 gpio group
In reply to Greg Kroah-HartmanFrom: Martin Hundebøll <[email protected]>
commit 5b10ff013e8a57f8845615ac2cc37edf7f6eef05 upstream.
Without this, the gpio cannot be explicitly mux'ed to its gpio function.
--- drivers/pinctrl/meson/pinctrl-meson-axg.c | 1 + 1 file changed, 1 insertion(+)
drivers/pinctrl/meson/pinctrl-meson-axg.c +1 -0
@@ -400,6 +400,7 @@ static struct meson_pmx_group meson_axg_GPIO_GROUP (GPIOA_15 ),GPIO_GROUP (GPIOA_16 ),GPIO_GROUP (GPIOA_17 ), +GPIO_GROUP (GPIOA_18 ),GPIO_GROUP (GPIOA_19 ), GPIO_GROUP(GPIOA_20),
Greg Kroah-Hartman
maintainerPATCH 114/160 usb: usbfs: Enforce page requirements for mmap
In reply to Greg Kroah-HartmanFrom: Ruihan Li <[email protected]>
commit 0143d148d1e882fb1538dc9974c94d63961719b9 upstream.
The current implementation of usbdev_mmap uses usb_alloc_coherent to allocate memory pages that will later be mapped into the user space. Meanwhile, usb_alloc_coherent employs three different methods to allocate memory, as outlined below:
* If hcd->localmem_pool is non-null, it uses gen_pool_dma_alloc to allocate memory;
* If DMA is not available, it uses kmalloc to allocate memory;
* Otherwise, it uses dma_alloc_coherent.
However, it should be noted that gen_pool_dma_alloc does not guarantee that the resulting memory will be page-aligned. Furthermore, trying to map slab pages (i.e., memory allocated by kmalloc) into the user space is not resonable and can lead to problems, such as a type confusion bug when PAGE_TABLE_CHECK=y [1].
To address these issues, this patch introduces hcd_alloc_coherent_pages, which addresses the above two problems. Specifically, hcd_alloc_coherent_pages uses gen_pool_dma_alloc_align instead of gen_pool_dma_alloc to ensure that the memory is page-aligned. To replace kmalloc, hcd_alloc_coherent_pages directly allocates pages by calling __get_free_pages.
--- drivers/usb/core/buffer.c | 41 +++++++++++++++++++++++++++++++++++++++++ drivers/usb/core/devio.c | 9 +++++---- include/linux/usb/hcd.h | 5 +++++ 3 files changed, 51 insertions(+), 4 deletions(-)
drivers/usb/core/buffer.c +41 -0
@@ -172,3 +172,44 @@ void hcd_buffer_free( }dma_free_coherent (hcd->self.sysdev, size, addr, dma); } + +void *hcd_buffer_alloc_pages (struct usb_hcd *hcd, +size_t size,gfp_t mem_flags,dma_addr_t *dma) +{ +if (size ==0 ) +return NULL ; + +if (hcd->localmem_pool) +return gen_pool_dma_alloc_align (hcd->localmem_pool, + size, dma,PAGE_SIZE ); + +/* some USB hosts just use PIO */ +if (!hcd_uses_dma (hcd)) { + *dma =DMA_MAPPING_ERROR ; +return (void *)__get_free_pages (mem_flags, +get_order (size)); + } + +return dma_alloc_coherent (hcd->self.sysdev, + size, dma, mem_flags); +} + +void hcd_buffer_free_pages (struct usb_hcd *hcd, +size_t size,void *addr,dma_addr_t dma) +{ +if (!addr) +return ; + +if (hcd->localmem_pool) { +gen_pool_free (hcd->localmem_pool, + (unsigned long )addr, size); +return ; + } + +if (!hcd_uses_dma (hcd)) { +free_pages ((unsigned long )addr,get_order (size)); +return ; + } + +dma_free_coherent (hcd->self.sysdev, size, addr, dma); +}
drivers/usb/core/devio.c +5 -4
@@ -186,6 +186,7 @@ static int connected(struct usb_dev_statstatic void dec_usb_memory_use_count (struct usb_memory *usbm,int *count) {struct usb_dev_state *ps = usbm->ps; +struct usb_hcd *hcd =bus_to_hcd (ps->dev->bus);unsigned long flags;spin_lock_irqsave (&ps->lock, flags);
@@ -194,8 +195,8 @@ static void dec_usb_memory_use_count(strlist_del (&usbm->memlist);spin_unlock_irqrestore (&ps->lock, flags); -usb_free_coherent (ps->dev, usbm->size, usbm->mem, - usbm->dma_handle); +hcd_buffer_free_pages (hcd, usbm->size, + usbm->mem, usbm->dma_handle);usbfs_decrease_memory_usage ( usbm->size +sizeof (struct usb_memory ));kfree (usbm);
@@ -247,8 +248,8 @@ static int usbdev_mmap(struct file *file goto error_decrease_mem; } - mem =usb_alloc_coherent (ps->dev, size,GFP_USER | __GFP_NOWARN, - &dma_handle); + mem =hcd_buffer_alloc_pages (hcd, + size,GFP_USER | __GFP_NOWARN, &dma_handle);if (!mem) { ret = -ENOMEM ; goto error_free_usbm;
include/linux/usb/hcd.h +5 -0
@@ -503,6 +503,11 @@ void *hcd_buffer_alloc(struct usb_bus *bvoid hcd_buffer_free (struct usb_bus *bus,size_t size,void *addr,dma_addr_t dma); +void *hcd_buffer_alloc_pages (struct usb_hcd *hcd, +size_t size,gfp_t mem_flags,dma_addr_t *dma); +void hcd_buffer_free_pages (struct usb_hcd *hcd, +size_t size,void *addr,dma_addr_t dma); +/* generic bus glue, needed for host controllers that don't use PCI */ extern irqreturn_t usb_hcd_irq (int irq,void *__hcd);
Greg Kroah-Hartman
maintainerPATCH 115/160 usb: usbfs: Use consistent mmap functions
In reply to Greg Kroah-HartmanFrom: Ruihan Li <[email protected]>
commit d0b861653f8c16839c3035875b556afc4472f941 upstream.
When hcd->localmem_pool is non-null, localmem_pool is used to allocate DMA memory. In this case, the dma address will be properly returned (in dma_handle), and dma_mmap_coherent should be used to map this memory into the user space. However, the current implementation uses pfn_remap_range, which is supposed to map normal pages.
Instead of repeating the logic in the memory allocation function, this patch introduces a more robust solution. Here, the type of allocated memory is checked by testing whether dma_handle is properly set. If dma_handle is properly returned, it means some DMA pages are allocated and dma_mmap_coherent should be used to map them. Otherwise, normal pages are allocated and pfn_remap_range should be called. This ensures that the correct mmap functions are used consistently, independently with logic details that determine which type of memory gets allocated.
--- drivers/usb/core/devio.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/usb/core/devio.c +9 -2
@@ -235,7 +235,7 @@ static int usbdev_mmap(struct file *filesize_t size = vma->vm_end - vma->vm_start;void *mem;unsigned long flags; -dma_addr_t dma_handle; +dma_addr_t dma_handle =DMA_MAPPING_ERROR ;int ret; ret =usbfs_increase_memory_usage (size +sizeof (struct usb_memory ));
@@ -265,7 +265,14 @@ static int usbdev_mmap(struct file *file usbm->vma_use_count =1 ;INIT_LIST_HEAD (&usbm->memlist); -if (hcd->localmem_pool || !hcd_uses_dma (hcd)) { +/* +* In DMA-unavailable cases, hcd_buffer_alloc_pages allocates +* normal pages and assigns DMA_MAPPING_ERROR to dma_handle. Check +* whether we are in such cases, and then use remap_pfn_range (or +* dma_mmap_coherent) to map normal (or DMA) pages into the user +* space, respectively. +*/ +if (dma_handle ==DMA_MAPPING_ERROR ) {if (remap_pfn_range (vma, vma->vm_start,virt_to_phys (usbm->mem) >>PAGE_SHIFT , size, vma->vm_page_prot) <0 ) {
Greg Kroah-Hartman
maintainerPATCH 116/160 mm: page_table_check: Make it dependent on EXCLUSIVE_SYSTEM_RAM
In reply to Greg Kroah-HartmanFrom: Ruihan Li <[email protected]>
commit 81a31a860bb61d54eb688af2568d9332ed9b8942 upstream.
Without EXCLUSIVE_SYSTEM_RAM, users are allowed to map arbitrary physical memory regions into the userspace via /dev/mem. At the same time, pages may change their properties (e.g., from anonymous pages to named pages) while they are still being mapped in the userspace, leading to "corruption" detected by the page table check.
To avoid these false positives, this patch makes PAGE_TABLE_CHECK depends on EXCLUSIVE_SYSTEM_RAM. This dependency is understandable because PAGE_TABLE_CHECK is a hardening technique but /dev/mem without STRICT_DEVMEM (i.e., !EXCLUSIVE_SYSTEM_RAM) is itself a security problem.
Even with EXCLUSIVE_SYSTEM_RAM, I/O pages may be still allowed to be mapped via /dev/mem. However, these pages are always considered as named pages, so they won't break the logic used in the page table check.
--- Documentation/mm/page_table_check.rst | 19 +++++++++++++++++++ mm/Kconfig.debug | 1 + 2 files changed, 20 insertions(+)
Documentation/mm/page_table_check.rst +19 -0
@@ -52,3 +52,22 @@ Build kernel with: Optionally, build kernel with PAGE_TABLE_CHECK_ENFORCED in order to have page table support without extra kernel parameter. + +Implementation notes +==================== + +We specifically decided not to use VMA information in order to avoid relying on +MM states (except for limited "struct page" info). The page table check is a +separate from Linux-MM state machine that verifies that the user accessible +pages are not falsely shared. + +PAGE_TABLE_CHECK depends on EXCLUSIVE_SYSTEM_RAM. The reason is that without +EXCLUSIVE_SYSTEM_RAM, users are allowed to map arbitrary physical memory +regions into the userspace via /dev/mem. At the same time, pages may change +their properties (e.g., from anonymous pages to named pages) while they are +still being mapped in the userspace, leading to "corruption" detected by the +page table check. + +Even with EXCLUSIVE_SYSTEM_RAM, I/O pages may be still allowed to be mapped via +/dev/mem. However, these pages are always considered as named pages, so they +won't break the logic used in the page table check.
mm/Kconfig.debug +1 -0
@@ -98,6 +98,7 @@ config PAGE_OWNER config PAGE_TABLE_CHECK bool "Check for invalid mappings in user page tables" depends on ARCH_SUPPORTS_PAGE_TABLE_CHECK + depends on EXCLUSIVE_SYSTEM_RAM select PAGE_EXTENSION help Check that anonymous page is not being mapped twice with read write
Greg Kroah-Hartman
maintainerPATCH 117/160 mm: page_table_check: Ensure user pages are not slab pages
In reply to Greg Kroah-HartmanFrom: Ruihan Li <[email protected]>
commit 44d0fb387b53e56c8a050bac5c7d460e21eb226f upstream.
The current uses of PageAnon in page table check functions can lead to type confusion bugs between struct page and slab [1], if slab pages are accidentally mapped into the user space. This is because slab reuses the bits in struct page to store its internal states, which renders PageAnon ineffective on slab pages.
Since slab pages are not expected to be mapped into the user space, this patch adds BUG_ON(PageSlab(page)) checks to make sure that slab pages are not inadvertently mapped. Otherwise, there must be some bugs in the kernel.
--- include/linux/page-flags.h | 6 ++++++ mm/page_table_check.c | 6 ++++++ 2 files changed, 12 insertions(+)
include/linux/page-flags.h +6 -0
@@ -630,6 +630,12 @@ PAGEFLAG_FALSE(VmemmapSelfHosted, vmemma* Please note that, confusingly, "page_mapping" refers to the inode * address_space which maps the page from disk; whereas "page_mapped" * refers to user virtual address space into which the page is mapped. +* +* For slab pages, since slab reuses the bits in struct page to store its +* internal states, the page->mapping does not exist as such, nor do these +* flags below. So in order to avoid testing non-existent bits, please +* make sure that PageSlab(page) actually evaluates to false before calling +* the following functions (e.g., PageAnon). See mm/slab.h. */ #define PAGE_MAPPING_ANON 0x1#define PAGE_MAPPING_MOVABLE 0x2
mm/page_table_check.c +6 -0
@@ -71,6 +71,8 @@ static void page_table_check_clear(struc page =pfn_to_page (pfn); page_ext =page_ext_get (page); + +BUG_ON (PageSlab (page)); anon =PageAnon (page);for (i =0 ; i < pgcnt; i++) {
@@ -107,6 +109,8 @@ static void page_table_check_set(struct page =pfn_to_page (pfn); page_ext =page_ext_get (page); + +BUG_ON (PageSlab (page)); anon =PageAnon (page);for (i =0 ; i < pgcnt; i++) {
@@ -133,6 +137,8 @@ void __page_table_check_zero(struct pagestruct page_ext *page_ext;unsigned long i; +BUG_ON (PageSlab (page)); + page_ext =page_ext_get (page);BUG_ON (!page_ext);for (i =0 ; i < (1ul << order); i++) {
Greg Kroah-Hartman
maintainerPATCH 118/160 soc: qcom: rpmh-rsc: drop redundant unsigned >=0 comparision
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 3395d36e6805786c26d13188735bc796b9d7a7c9 ]
Unsigned int "minor" is always >= 0 as reported by Smatch:
drivers/soc/qcom/rpmh-rsc.c:1076 rpmh_rsc_probe() warn: always true condition '(drv->ver.minor >= 0) => (0-u32max >= 0)'
--- drivers/soc/qcom/rpmh-rsc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/qcom/rpmh-rsc.c +1 -1
@@ -1073,7 +1073,7 @@ static int rpmh_rsc_probe(struct platform_device *pdev) drv->ver.minor = rsc_id & (MINOR_VER_MASK <<MINOR_VER_SHIFT ); drv->ver.minor >>=MINOR_VER_SHIFT ; -if (drv->ver.major ==3 && drv->ver.minor >=0 ) +if (drv->ver.major ==3 ) drv->regs = rpmh_rsc_reg_offset_ver_3_0;else drv->regs = rpmh_rsc_reg_offset_ver_2_7;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 119/160 arm64: dts: qcom: sc8280xp: Flush RSC sleep & wake votes
In reply to Greg Kroah-HartmanFrom: Bjorn Andersson <[email protected]>
[ Upstream commit ce7c014937c442be677963848c7db62eccd94eac ]
The rpmh driver will cache sleep and wake votes until the cluster power-domain is about to enter idle, to avoid unnecessary writes. So associate the apps_rsc with the cluster pd, so that it can be notified about this event.
Without this, only AMC votes are being commited.
--- arch/arm64/boot/dts/qcom/sc8280xp.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/qcom/sc8280xp.dtsi +1 -0
@@ -3957,6 +3957,7 @@ apps_rsc: rsc@18200000 { qcom,tcs-config = <ACTIVE_TCS 2>, <SLEEP_TCS 3>, <WAKE_TCS 3>, <CONTROL_TCS 1>; label = "apps_rsc"; + power-domains = <&CLUSTER_PD>; apps_bcm_voter: bcm-voter { compatible = "qcom,bcm-voter";
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 120/160 arm64: dts: qcom: sm6375-pdx225: Fix remoteproc firmware paths
In reply to Greg Kroah-HartmanFrom: Konrad Dybcio <[email protected]>
[ Upstream commit a14da6144d16ef27e3022835fa282a3740b8ad7b ]
They were previously missing the SoC name. Fix it.
--- arch/arm64/boot/dts/qcom/sm6375-sony-xperia-murray-pdx225.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/qcom/sm6375-sony-xperia-murray-pdx225.dts +2 -2
@@ -151,12 +151,12 @@ &qupv3_id_1 { }; &remoteproc_adsp { - firmware-name = "qcom/Sony/murray/adsp.mbn"; + firmware-name = "qcom/sm6375/Sony/murray/adsp.mbn"; status = "okay"; }; &remoteproc_cdsp { - firmware-name = "qcom/Sony/murray/cdsp.mbn"; + firmware-name = "qcom/sm6375/Sony/murray/cdsp.mbn"; status = "okay"; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 121/160 ARM: at91: pm: fix imbalanced reference counter for ethernet devices
In reply to Greg Kroah-HartmanFrom: Claudiu Beznea <[email protected]>
[ Upstream commit ccd4923d18d5698a5910d516646ce125b9155d47 ]
The of_find_device_by_node() function is returning a struct platform_device object with the embedded struct device member's reference counter incremented. This needs to be dropped when done with the platform device returned by of_find_device_by_node().
at91_pm_eth_quirk_is_valid() calls of_find_device_by_node() on suspend and resume path. On suspend it calls of_find_device_by_node() and on resume and failure paths it drops the counter of
struct platform_device::dev.
In case ethernet device may not wakeup there is a put_device() on at91_pm_eth_quirk_is_valid() which is wrong as it colides with put_device() on resume path leading to the reference counter of struct device embedded in struct platform_device to be messed, stack trace to be displayed (after 5 consecutive suspend/resume cycles) and execution to hang.
Along with this the error path of at91_pm_config_quirks() had been also adapted to decrement propertly the reference counter of struct device embedded in struct platform_device.
--- arch/arm/mach-at91/pm.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-)
arch/arm/mach-at91/pm.c +9 -11
@@ -334,16 +334,14 @@ static bool at91_pm_eth_quirk_is_valid(struct at91_pm_quirk_eth *eth) pdev =of_find_device_by_node (eth->np);if (!pdev)return false; +/* put_device(eth->dev) is called at the end of suspend. */ eth->dev = &pdev->dev; }/* No quirks if device isn't a wakeup source. */ -if (!device_may_wakeup (eth->dev)) { -put_device (eth->dev); +if (!device_may_wakeup (eth->dev))return false; - } -/* put_device(eth->dev) is called at the end of suspend. */ return true; }
@@ -439,14 +437,14 @@ static int at91_pm_config_quirks(bool suspend)pr_err ("AT91: PM: failed to enable %s clocks\n" , j ==AT91_PM_G_ETH ?"geth" :"eth" ); } - }else { -/* -* Release the reference to eth->dev taken in -* at91_pm_eth_quirk_is_valid(). -*/ -put_device (eth->dev); - eth->dev =NULL ; } + +/* +* Release the reference to eth->dev taken in +* at91_pm_eth_quirk_is_valid(). +*/ +put_device (eth->dev); + eth->dev =NULL ; }return ret;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 122/160 ARM: dts: at91: sama7g5ek: fix debounce delay property for shdwc
In reply to Greg Kroah-HartmanFrom: Claudiu Beznea <[email protected]>
[ Upstream commit 6b0db163ff9200a55dc77a652dad1d4b0a853f63 ]
There is no atmel,shdwc-debouncer property for SHDWC. The right DT property is debounce-delay-us. Use it.
--- arch/arm/boot/dts/at91-sama7g5ek.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/at91-sama7g5ek.dts +1 -1
@@ -792,7 +792,7 @@ &sdmmc2 { }; &shdwc { - atmel,shdwc-debouncer = <976>; + debounce-delay-us = <976>; status = "okay"; input@0 {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 123/160 ASoC: codecs: wsa883x: do not set can_multi_write flag
In reply to Greg Kroah-HartmanFrom: Srinivas Kandagatla <[email protected]>
[ Upstream commit 40ba0411074485e2cf1bf8ee0f3db27bdff88394 ]
regmap-sdw does not support multi register writes, so there is no point in setting this flag. This also leads to incorrect programming of WSA codecs with regmap_multi_reg_write() call.
This invalid configuration should have been rejected by regmap-sdw.
--- sound/soc/codecs/wsa883x.c | 1 - 1 file changed, 1 deletion(-)
sound/soc/codecs/wsa883x.c +0 -1
@@ -946,7 +946,6 @@ static struct regmap_config wsa883x_regmap_config = { .writeable_reg = wsa883x_writeable_register, .reg_format_endian = REGMAP_ENDIAN_NATIVE, .val_format_endian = REGMAP_ENDIAN_NATIVE, - .can_multi_write = true, .use_single_read = true, };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 124/160 ASoC: codecs: wsa881x: do not set can_multi_write flag
In reply to Greg Kroah-HartmanFrom: Srinivas Kandagatla <[email protected]>
[ Upstream commit 6e7a6d4797ef521c0762914610ed682e102b9d36 ]
regmap-sdw does not support multi register writes, so there is no point in setting this flag. This also leads to incorrect programming of WSA codecs with regmap_multi_reg_write() call.
This invalid configuration should have been rejected by regmap-sdw.
--- sound/soc/codecs/wsa881x.c | 1 - 1 file changed, 1 deletion(-)
sound/soc/codecs/wsa881x.c +0 -1
@@ -645,7 +645,6 @@ static struct regmap_config wsa881x_regmap_config = { .readable_reg = wsa881x_readable_register, .reg_format_endian = REGMAP_ENDIAN_NATIVE, .val_format_endian = REGMAP_ENDIAN_NATIVE, - .can_multi_write = true, };enum {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 125/160 soc: qcom: ramp_controller: Fix an error handling path in qcom_ramp_controller_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit b3d0dcc8e359cf5d57fb6308bc9750af5da574b3 ]
'qrc' is known to be non-NULL at this point. Checking for 'qrc->desc' was expected instead, so use it.
--- drivers/soc/qcom/ramp_controller.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/qcom/ramp_controller.c +1 -1
@@ -296,7 +296,7 @@ static int qcom_ramp_controller_probe(struct platform_device *pdev)return -ENOMEM ; qrc->desc =device_get_match_data (&pdev->dev); -if (!qrc) +if (!qrc->desc)return -EINVAL ; qrc->regmap =devm_regmap_init_mmio (&pdev->dev, base, &qrc_regmap_config);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 126/160 soc: qcom: rmtfs: Fix error code in probe()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 7b374a2fc8665bfb8a0d93b617463cc0732f533a ]
Return an error code if of_property_count_u32_elems() fails. Don't return success.
--- drivers/soc/qcom/rmtfs_mem.c | 1 + 1 file changed, 1 insertion(+)
drivers/soc/qcom/rmtfs_mem.c +1 -0
@@ -234,6 +234,7 @@ static int qcom_rmtfs_mem_probe(struct platform_device *pdev) num_vmids =0 ; }else if (num_vmids <0 ) {dev_err (&pdev->dev,"failed to count qcom,vmid elements: %d\n" , num_vmids); + ret = num_vmids; goto remove_cdev; }else if (num_vmids >NUM_MAX_VMIDS ) { dev_warn(&pdev->dev,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 127/160 arm64: dts: qcom: sc7180-lite: Fix SDRAM freq for misidentified sc7180-lite boards
In reply to Greg Kroah-HartmanFrom: Douglas Anderson <[email protected]>
[ Upstream commit 3a735530c159b75e1402c08abe1ba4eb99a1f7a3 ]
In general, the three SKUs of sc7180 (lite, normal, and pro) are handled dynamically.
The cpufreq table in sc7180.dtsi includes the superset of all CPU frequencies. The "qcom-cpufreq-hw" driver in Linux shows that we can dynamically detect which frequencies are actually available on the currently running CPU and then we can just enable those ones.
The GPU is similarly dynamic. The nvmem has a fuse in it (see "gpu_speed_bin" in sc7180.dtsi) that the GPU driver can use to figure out which frequencies to enable.
There is one part, however, that is not so dynamic. The way SDRAM frequency works in sc7180 is that it's tied to cpufreq. At the busiest cpufreq operating points we'll pick the top supported SDRAM frequency. They ramp down together.
For the "pro" SKU of sc7180, we only enable one extra cpufreq step. That extra cpufreq step runs SDRAM at the same speed as the step below. Thus, for normal and pro things are OK. There is no sc7180-pro device tree snippet.
For the "lite" SKU if sc7180, however, things aren't so easy. The "lite" SKU drops 3 cpufreq entries but can still run SDRAM at max frequency. That messed things up with the whole scheme. This is why we added the "sc7180-lite" fragment in commit 8fd01e01fd6f ("arm64: dts:
qcom: sc7180-lite: Tweak DDR/L3 scaling on SC7180-lite").
When the lite scheme came about, it was agreed that the WiFi SKUs of lazor would _always_ be "lite" and would, in fact, be the only "lite" devices. Unfortunately, this decision changed and folks didn't realize that it would be a problem. Specifically, some later lazor WiFi-only devices were built with "pro" CPUs.
Building WiFi-only lazor with "pro" CPUs isn't the end of the world. The SDRAM will ramp up a little sooner than it otherwise would, but aside from a small power hit things work OK. One problem, though, is that the SDRAM scaling becomes a bit quirky. Specifically, with the current tables we'll max out SDRAM frequency at 2.1GHz but then _lower_ it at 2.2GHz / 2.3GHz only to raise it back to max for 2.4GHz and 2.55GHz.
Let's at least fix this so that the SDRAM frequency doesn't go down in that quirky way. On true "lite" SKUs this change will be a no-op because the operating points we're touching are disabled. This change is only useful when a board that thinks it has a "lite" CPU actually has a "normal" or "pro" one stuffed.
--- arch/arm64/boot/dts/qcom/sc7180-lite.dtsi | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/arm64/boot/dts/qcom/sc7180-lite.dtsi +8 -0
@@ -16,3 +16,11 @@ &cpu6_opp11 { &cpu6_opp12 { opp-peak-kBps = <8532000 23347200>; }; + +&cpu6_opp13 { + opp-peak-kBps = <8532000 23347200>; +}; + +&cpu6_opp14 { + opp-peak-kBps = <8532000 23347200>; +};
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 128/160 arm64: dts: imx8qm-mek: correct GPIOs for USDHC2 CD and WP signals
In reply to Greg Kroah-HartmanFrom: Shenwei Wang <[email protected]>
[ Upstream commit 2b28fc688cdff225c41cdd22857500e187453ed7 ]
The USDHC2 CD and WP sginal should be on LSIO_GPIO5.
--- arch/arm64/boot/dts/freescale/imx8qm-mek.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/freescale/imx8qm-mek.dts +2 -2
@@ -82,8 +82,8 @@ &usdhc2 { pinctrl-0 = <&pinctrl_usdhc2>; bus-width = <4>; vmmc-supply = <®_usdhc2_vmmc>; - cd-gpios = <&lsio_gpio4 22 GPIO_ACTIVE_LOW>; - wp-gpios = <&lsio_gpio4 21 GPIO_ACTIVE_HIGH>; + cd-gpios = <&lsio_gpio5 22 GPIO_ACTIVE_LOW>; + wp-gpios = <&lsio_gpio5 21 GPIO_ACTIVE_HIGH>; status = "okay"; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 129/160 arm64: dts: imx8-ss-dma: assign default clock rate for lpuarts
In reply to Greg Kroah-HartmanFrom: Shenwei Wang <[email protected]>
[ Upstream commit ca50d7765587fe0a8351a6e8d9742cfd4811d925 ]
Add the assigned-clocks and assigned-clock-rates properties for the LPUARTx nodes. Without these properties, the default clock rate used would be 0, which can cause the UART ports to fail when open.
--- arch/arm64/boot/dts/freescale/imx8-ss-dma.dtsi | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/arm64/boot/dts/freescale/imx8-ss-dma.dtsi +8 -0
@@ -90,6 +90,8 @@ lpuart0: serial@5a060000 { clocks = <&uart0_lpcg IMX_LPCG_CLK_4>, <&uart0_lpcg IMX_LPCG_CLK_0>; clock-names = "ipg", "baud"; + assigned-clocks = <&clk IMX_SC_R_UART_0 IMX_SC_PM_CLK_PER>; + assigned-clock-rates = <80000000>; power-domains = <&pd IMX_SC_R_UART_0>; status = "disabled"; };
@@ -100,6 +102,8 @@ lpuart1: serial@5a070000 { clocks = <&uart1_lpcg IMX_LPCG_CLK_4>, <&uart1_lpcg IMX_LPCG_CLK_0>; clock-names = "ipg", "baud"; + assigned-clocks = <&clk IMX_SC_R_UART_1 IMX_SC_PM_CLK_PER>; + assigned-clock-rates = <80000000>; power-domains = <&pd IMX_SC_R_UART_1>; status = "disabled"; };
@@ -110,6 +114,8 @@ lpuart2: serial@5a080000 { clocks = <&uart2_lpcg IMX_LPCG_CLK_4>, <&uart2_lpcg IMX_LPCG_CLK_0>; clock-names = "ipg", "baud"; + assigned-clocks = <&clk IMX_SC_R_UART_2 IMX_SC_PM_CLK_PER>; + assigned-clock-rates = <80000000>; power-domains = <&pd IMX_SC_R_UART_2>; status = "disabled"; };
@@ -120,6 +126,8 @@ lpuart3: serial@5a090000 { clocks = <&uart3_lpcg IMX_LPCG_CLK_4>, <&uart3_lpcg IMX_LPCG_CLK_0>; clock-names = "ipg", "baud"; + assigned-clocks = <&clk IMX_SC_R_UART_3 IMX_SC_PM_CLK_PER>; + assigned-clock-rates = <80000000>; power-domains = <&pd IMX_SC_R_UART_3>; status = "disabled"; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 130/160 ASoC: amd: ps: fix for acp_lock access in pdm driver
In reply to Greg Kroah-HartmanFrom: Vijendar Mukunda <[email protected]>
[ Upstream commit b6b5c6426efe27cbd954409a50604d99c79bd42b ]
Sending the mutex address(acp_lock) as platform data during ACP PDM platform driver register sequence, its creating copy of the platform data. Referencing this platform data in ACP PDM driver results incorrect reference to the common lock usage.
Instead of directly passing the lock address as platform data, retrieve it from parent driver data structure and use the same lock reference in ACP PDM driver.
--- sound/soc/amd/ps/pci-ps.c | 3 +-- sound/soc/amd/ps/ps-pdm-dma.c | 10 +++++----- 2 files changed, 6 insertions(+), 7 deletions(-)
sound/soc/amd/ps/pci-ps.c +1 -2
@@ -211,8 +211,7 @@ static int create_acp63_platform_devs(struct pci_dev *pci, struct acp63_dev_datacase ACP63_PDM_DEV_MASK : adata->pdm_dev_index =0 ;acp63_fill_platform_dev_info (&pdevinfo[0 ], parent,NULL ,"acp_ps_pdm_dma" , -0 , adata->res,1 , &adata->acp_lock, -sizeof (adata->acp_lock)); +0 , adata->res,1 ,NULL ,0 );acp63_fill_platform_dev_info (&pdevinfo[1 ], parent,NULL ,"dmic-codec" ,0 ,NULL ,0 ,NULL ,0 ); acp63_fill_platform_dev_info(&pdevinfo[2], parent, NULL, "acp_ps_mach",
sound/soc/amd/ps/ps-pdm-dma.c +5 -5
@@ -361,12 +361,12 @@ static int acp63_pdm_audio_probe(struct platform_device *pdev) {struct resource *res;struct pdm_dev_data *adata; +struct acp63_dev_data *acp_data; +struct device *parent;int status; -if (!pdev->dev.platform_data) { -dev_err (&pdev->dev,"platform_data not retrieved\n" ); -return -ENODEV ; - } + parent = pdev->dev.parent; + acp_data =dev_get_drvdata (parent); res =platform_get_resource (pdev,IORESOURCE_MEM ,0 );if (!res) {dev_err (&pdev->dev,"IORESOURCE_MEM FAILED\n" );
@@ -382,7 +382,7 @@ static int acp63_pdm_audio_probe(struct platform_device *pdev)return -ENOMEM ; adata->capture_stream =NULL ; - adata->acp_lock = pdev->dev.platform_data; + adata->acp_lock = &acp_data->acp_lock;dev_set_drvdata (&pdev->dev, adata); status = devm_snd_soc_register_component(&pdev->dev, &acp63_pdm_component,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 131/160 ASoC: mediatek: mt8188: fix use-after-free in driver remove path
In reply to Greg Kroah-HartmanFrom: Trevor Wu <[email protected]>
[ Upstream commit fd67a7a1a22ce47fcbc094c4b6e164c34c652cbe ]
During mt8188_afe_init_clock(), mt8188_audsys_clk_register() was called followed by several other devm functions. The caller of mt8188_afe_init_clock() utilized devm_add_action_or_reset() to call mt8188_afe_deinit_clock(). However, the order was incorrect, causing a use-after-free issue during remove time.
At probe time, the order of calls was:
1. mt8188_audsys_clk_register
2. afe_priv->clk = devm_kcalloc
3. afe_priv->clk[i] = devm_clk_get
At remove time, the order of calls was:
1. mt8188_audsys_clk_unregister
3. free afe_priv->clk[i]
2. free afe_priv->clk
To resolve the problem, it's necessary to move devm_add_action_or_reset() to the appropriate position so that the remove order can be 3->2->1.
--- sound/soc/mediatek/mt8188/mt8188-afe-clk.c | 7 --- sound/soc/mediatek/mt8188/mt8188-afe-clk.h | 1 - sound/soc/mediatek/mt8188/mt8188-afe-pcm.c | 4 -- sound/soc/mediatek/mt8188/mt8188-audsys-clk.c | 47 ++++++++++--------- sound/soc/mediatek/mt8188/mt8188-audsys-clk.h | 1 - 5 files changed, 24 insertions(+), 36 deletions(-)
sound/soc/mediatek/mt8188/mt8188-afe-clk.c +0 -7
@@ -418,13 +418,6 @@ int mt8188_afe_init_clock(struct mtk_base_afe *afe)return 0 ; } -void mt8188_afe_deinit_clock (void *priv) -{ -struct mtk_base_afe *afe = priv; - -mt8188_audsys_clk_unregister (afe); -} -int mt8188_afe_enable_clk (struct mtk_base_afe *afe,struct clk *clk) {int ret;
sound/soc/mediatek/mt8188/mt8188-afe-clk.h +0 -1
@@ -100,7 +100,6 @@ int mt8188_afe_get_mclk_source_clk_id(int sel);int mt8188_afe_get_mclk_source_rate (struct mtk_base_afe *afe,int apll);int mt8188_afe_get_default_mclk_source_by_rate (int rate);int mt8188_afe_init_clock (struct mtk_base_afe *afe); -void mt8188_afe_deinit_clock (void *priv);int mt8188_afe_enable_clk (struct mtk_base_afe *afe,struct clk *clk);void mt8188_afe_disable_clk (struct mtk_base_afe *afe,struct clk *clk); int mt8188_afe_set_clk_rate(struct mtk_base_afe *afe, struct clk *clk,
sound/soc/mediatek/mt8188/mt8188-afe-pcm.c +0 -4
@@ -3185,10 +3185,6 @@ static int mt8188_afe_pcm_dev_probe(struct platform_device *pdev)if (ret)return dev_err_probe (dev, ret,"init clock error" ); - ret =devm_add_action_or_reset (dev, mt8188_afe_deinit_clock, (void *)afe); -if (ret) -return ret; -spin_lock_init (&afe_priv->afe_ctrl_lock);mutex_init (&afe->irq_alloc_lock);
sound/soc/mediatek/mt8188/mt8188-audsys-clk.c +24 -23
57 lines not on this page · raw message
sound/soc/mediatek/mt8188/mt8188-audsys-clk.h +0 -1
@@ -10,6 +10,5 @@#define _MT8188_AUDSYS_CLK_H_int mt8188_audsys_clk_register (struct mtk_base_afe *afe); -void mt8188_audsys_clk_unregister (struct mtk_base_afe *afe);#endif
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 132/160 ASoC: mediatek: mt8195-afe-pcm: Convert to platform remove callback returning void
In reply to Greg Kroah-HartmanFrom: Uwe Kleine-König <[email protected]>
[ Upstream commit 6461fee68064ba970e3ba90241fe5f5e038aa9d4 ]
The .remove() callback for a platform driver returns an int which makes many driver authors wrongly assume it's possible to do error handling by returning an error code. However the value returned is (mostly) ignored and this typically results in resource leaks. To improve here there is a quest to make the remove callback return void. In the first step of this quest all drivers are converted to .remove_new() which already returns void.
Trivially convert this driver from always returning zero in the remove callback to the void returning variant.
Stable-dep-of: dc93f0dcb436 ("ASoC: mediatek: mt8195: fix use-after-free in driver remove path")
--- sound/soc/mediatek/mt8195/mt8195-afe-pcm.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
sound/soc/mediatek/mt8195/mt8195-afe-pcm.c +2 -3
@@ -3253,7 +3253,7 @@ static int mt8195_afe_pcm_dev_probe(struct platform_device *pdev)return ret; } -static int mt8195_afe_pcm_dev_remove (struct platform_device *pdev) +static void mt8195_afe_pcm_dev_remove (struct platform_device *pdev) {struct mtk_base_afe *afe =platform_get_drvdata (pdev);
@@ -3264,7 +3264,6 @@ static int mt8195_afe_pcm_dev_remove(struct platform_device *pdev)mt8195_afe_runtime_suspend (&pdev->dev);mt8195_afe_deinit_clock (afe); -return 0 ; }static const struct of_device_id mt8195_afe_pcm_dt_match[] = {
@@ -3285,7 +3284,7 @@ static struct platform_driver mt8195_afe_pcm_driver = { .pm = &mt8195_afe_pm_ops, }, .probe = mt8195_afe_pcm_dev_probe, - .remove = mt8195_afe_pcm_dev_remove, + .remove_new = mt8195_afe_pcm_dev_remove, };module_platform_driver (mt8195_afe_pcm_driver);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 133/160 ASoC: mediatek: mt8195: fix use-after-free in driver remove path
In reply to Greg Kroah-HartmanFrom: Trevor Wu <[email protected]>
[ Upstream commit dc93f0dcb436dfd24a06c5b3c0f4c5cd9296e8e5 ]
During mt8195_afe_init_clock(), mt8195_audsys_clk_register() was called followed by several other devm functions. At mt8195_afe_deinit_clock() located at mt8195_afe_pcm_dev_remove(), mt8195_audsys_clk_unregister() was called.
However, there was an issue with the order in which these functions were called. Specifically, the remove callback of platform_driver was called before devres released the resource, resulting in a use-after-free issue during remove time.
At probe time, the order of calls was:
1. mt8195_audsys_clk_register
2. afe_priv->clk = devm_kcalloc
3. afe_priv->clk[i] = devm_clk_get
At remove time, the order of calls was:
1. mt8195_audsys_clk_unregister
3. free afe_priv->clk[i]
2. free afe_priv->clk
To resolve the problem, we can utilize devm_add_action_or_reset() in mt8195_audsys_clk_register() so that the remove order can be changed to 3->2->1.
--- sound/soc/mediatek/mt8195/mt8195-afe-clk.c | 5 -- sound/soc/mediatek/mt8195/mt8195-afe-clk.h | 1 - sound/soc/mediatek/mt8195/mt8195-afe-pcm.c | 4 -- sound/soc/mediatek/mt8195/mt8195-audsys-clk.c | 47 ++++++++++--------- sound/soc/mediatek/mt8195/mt8195-audsys-clk.h | 1 - 5 files changed, 24 insertions(+), 34 deletions(-)
sound/soc/mediatek/mt8195/mt8195-afe-clk.c +0 -5
@@ -410,11 +410,6 @@ int mt8195_afe_init_clock(struct mtk_base_afe *afe)return 0 ; } -void mt8195_afe_deinit_clock (struct mtk_base_afe *afe) -{ -mt8195_audsys_clk_unregister (afe); -} -int mt8195_afe_enable_clk (struct mtk_base_afe *afe,struct clk *clk) {int ret;
sound/soc/mediatek/mt8195/mt8195-afe-clk.h +0 -1
@@ -101,7 +101,6 @@ int mt8195_afe_get_mclk_source_clk_id(int sel);int mt8195_afe_get_mclk_source_rate (struct mtk_base_afe *afe,int apll);int mt8195_afe_get_default_mclk_source_by_rate (int rate);int mt8195_afe_init_clock (struct mtk_base_afe *afe); -void mt8195_afe_deinit_clock (struct mtk_base_afe *afe);int mt8195_afe_enable_clk (struct mtk_base_afe *afe,struct clk *clk);void mt8195_afe_disable_clk (struct mtk_base_afe *afe,struct clk *clk);int mt8195_afe_prepare_clk (struct mtk_base_afe *afe,struct clk *clk);
sound/soc/mediatek/mt8195/mt8195-afe-pcm.c +0 -4
@@ -3255,15 +3255,11 @@ static int mt8195_afe_pcm_dev_probe(struct platform_device *pdev)static void mt8195_afe_pcm_dev_remove (struct platform_device *pdev) { -struct mtk_base_afe *afe =platform_get_drvdata (pdev); -snd_soc_unregister_component (&pdev->dev);pm_runtime_disable (&pdev->dev);if (!pm_runtime_status_suspended (&pdev->dev))mt8195_afe_runtime_suspend (&pdev->dev); - -mt8195_afe_deinit_clock (afe); }static const struct of_device_id mt8195_afe_pcm_dt_match[] = {
sound/soc/mediatek/mt8195/mt8195-audsys-clk.c +24 -23
57 lines not on this page · raw message
sound/soc/mediatek/mt8195/mt8195-audsys-clk.h +0 -1
@@ -10,6 +10,5 @@#define _MT8195_AUDSYS_CLK_H_int mt8195_audsys_clk_register (struct mtk_base_afe *afe); -void mt8195_audsys_clk_unregister (struct mtk_base_afe *afe);#endif
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 134/160 ASoC: simple-card-utils: fix PCM constraint error check
In reply to Greg Kroah-HartmanFrom: Robert Hancock <[email protected]>
[ Upstream commit 635071f5fee31550e921644b2becc42b3ff1036c ]
The code in asoc_simple_startup was treating any non-zero return from snd_pcm_hw_constraint_minmax as an error, when this can return 1 in some normal cases and only negative values indicate an error.
When this happened, it caused asoc_simple_startup to disable the clocks it just enabled and return 1, which was not treated as an error by the calling code which only checks for negative return values. Then when the PCM is eventually shut down, it causes the clock framework to complain about disabling clocks that were not enabled.
Fix the check for snd_pcm_hw_constraint_minmax return value to only treat negative values as an error.
--- sound/soc/generic/simple-card-utils.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/generic/simple-card-utils.c +1 -1
@@ -314,7 +314,7 @@ int asoc_simple_startup(struct snd_pcm_substream *substream) } ret =snd_pcm_hw_constraint_minmax (substream->runtime,SNDRV_PCM_HW_PARAM_RATE , fixed_rate, fixed_rate); -if (ret) +if (ret <0 ) goto codec_err; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 135/160 blk-mq: fix blk_mq_hw_ctx active request accounting
In reply to Greg Kroah-HartmanFrom: Tian Lan <[email protected]>
[ Upstream commit ddad59331a4e16088468ca0ad228a9fe32d7955a ]
The nr_active counter continues to increase over time which causes the blk_mq_get_tag to hang until the thread is rescheduled to a different core despite there are still tags available.
kernel-stack
INFO: task inboundIOReacto:3014879 blocked for more than 2 seconds
Not tainted 6.1.15-amd64 #1 Debian 6.1.15~debian11
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:inboundIOReacto state:D stack:0 pid:3014879 ppid:4557 flags:0x00000000
Call Trace:
<TASK>
__schedule+0x351/0xa20
scheduler+0x5d/0xe0
io_schedule+0x42/0x70
blk_mq_get_tag+0x11a/0x2a0
? dequeue_task_stop+0x70/0x70
__blk_mq_alloc_requests+0x191/0x2e0kprobe output showing RQF_MQ_INFLIGHT bit is not cleared before __blk_mq_free_request being called.
320 320 kworker/29:1H __blk_mq_free_request rq_flags 0x220c0 in-flight 1
b'__blk_mq_free_request+0x1 [kernel]'
b'bt_iter+0x50 [kernel]'
b'blk_mq_queue_tag_busy_iter+0x318 [kernel]'
b'blk_mq_timeout_work+0x7c [kernel]'
b'process_one_work+0x1c4 [kernel]'
b'worker_thread+0x4d [kernel]'
b'kthread+0xe6 [kernel]'
b'ret_from_fork+0x1f [kernel]'--- block/blk-mq.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
block/blk-mq.c +4 -4
@@ -717,6 +717,10 @@ static void __blk_mq_free_request(struct request *rq)blk_crypto_free_request (rq);blk_pm_mark_last_busy (rq); rq->mq_hctx =NULL ; + +if (rq->rq_flags &RQF_MQ_INFLIGHT ) +__blk_mq_dec_active_requests (hctx); +if (rq->tag !=BLK_MQ_NO_TAG )blk_mq_put_tag (hctx->tags, ctx, rq->tag);if (sched_tag !=BLK_MQ_NO_TAG )
@@ -728,15 +732,11 @@ static void __blk_mq_free_request(struct request *rq)void blk_mq_free_request (struct request *rq) {struct request_queue *q = rq->q; -struct blk_mq_hw_ctx *hctx = rq->mq_hctx;if ((rq->rq_flags &RQF_ELVPRIV ) && q->elevator->type->ops.finish_request) q->elevator->type->ops.finish_request (rq); -if (rq->rq_flags &RQF_MQ_INFLIGHT ) -__blk_mq_dec_active_requests (hctx); -if (unlikely (laptop_mode && !blk_rq_is_passthrough (rq)))laptop_io_completion (q->disk->bdi);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 136/160 arm64: dts: imx8mn-beacon: Fix SPI CS pinmux
In reply to Greg Kroah-HartmanFrom: Adam Ford <[email protected]>
[ Upstream commit 9bf2e534313fcf420367668cc1f30e10469901dc ]
The final production baseboard had a different chip select than earlier prototype boards. When the newer board was released, the SPI stopped working because the wrong pin was used in the device tree and conflicted with the UART RTS. Fix the pinmux for production boards.
--- arch/arm64/boot/dts/freescale/imx8mn-beacon-baseboard.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/freescale/imx8mn-beacon-baseboard.dtsi +2 -2
@@ -81,7 +81,7 @@ sound { &ecspi2 { pinctrl-names = "default"; pinctrl-0 = <&pinctrl_espi2>; - cs-gpios = <&gpio5 9 GPIO_ACTIVE_LOW>; + cs-gpios = <&gpio5 13 GPIO_ACTIVE_LOW>; status = "okay"; eeprom@0 {
@@ -202,7 +202,7 @@ pinctrl_espi2: espi2grp { MX8MN_IOMUXC_ECSPI2_SCLK_ECSPI2_SCLK 0x82 MX8MN_IOMUXC_ECSPI2_MOSI_ECSPI2_MOSI 0x82 MX8MN_IOMUXC_ECSPI2_MISO_ECSPI2_MISO 0x82 - MX8MN_IOMUXC_ECSPI1_SS0_GPIO5_IO9 0x41 + MX8MN_IOMUXC_ECSPI2_SS0_GPIO5_IO13 0x41 >; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 137/160 i2c: mv64xxx: Fix reading invalid status value in atomic mode
In reply to Greg Kroah-HartmanFrom: Marek Behún <[email protected]>
[ Upstream commit 5578d0a79b6430fa1543640dd6f2d397d0886ce7 ]
There seems to be a bug within the mv64xxx I2C controller, wherein the status register may not necessarily contain valid value immediately after the IFLG flag is set in the control register.
My theory is that the controller:
- first sets the IFLG in control register
- then updates the status register
- then raises an interrupt
This may sometime cause weird bugs when in atomic mode, since in this mode we do not wait for an interrupt, but instead we poll the control register for IFLG and read status register immediately after.
I encountered -ENXIO from mv64xxx_i2c_fsm() due to this issue when using this driver in atomic mode.
Note that I've only seen this issue on Armada 385, I don't know whether other SOCs with this controller are also affected. Also note that this fix has been in U-Boot for over 4 years [1] without anybody complaining, so it should not cause regressions.
[1] https://source.denx.de/u-boot/u-boot/-/commit/d50e29662f78
--- drivers/i2c/busses/i2c-mv64xxx.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/i2c/busses/i2c-mv64xxx.c +11 -0
@@ -520,6 +520,17 @@ mv64xxx_i2c_intr(int irq, void *dev_id)while (readl (drv_data->reg_base + drv_data->reg_offsets.control) &MV64XXX_I2C_REG_CONTROL_IFLG ) { +/* +* It seems that sometime the controller updates the status +* register only after it asserts IFLG in control register. +* This may result in weird bugs when in atomic mode. A delay +* of 100 ns before reading the status register solves this +* issue. This bug does not seem to appear when using +* interrupts. +*/ +if (drv_data->atomic) +ndelay (100 ); + status =readl (drv_data->reg_base + drv_data->reg_offsets.status);mv64xxx_i2c_fsm (drv_data, status);mv64xxx_i2c_do_action (drv_data);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 138/160 firmware: arm_ffa: Set handle field to zero in memory descriptor
In reply to Greg Kroah-HartmanFrom: Balint Dobszay <[email protected]>
[ Upstream commit 3aa0519a4780f1b8e11966bd879d4a2934ba455f ]
As described in the commit 111a833dc5cb ("firmware: arm_ffa: Set reserved/MBZ fields to zero in the memory descriptors") some fields in the memory descriptor have to be zeroed explicitly. The handle field is one of these, but it was left out from that change, fix this now.
--- drivers/firmware/arm_ffa/driver.c | 1 + 1 file changed, 1 insertion(+)
drivers/firmware/arm_ffa/driver.c +1 -0
@@ -424,6 +424,7 @@ ffa_setup_and_transmit(u32 func_id, void *buffer, u32 max_fragsize, ep_mem_access->flag =0 ; ep_mem_access->reserved =0 ; } + mem_region->handle =0 ; mem_region->reserved_0 =0 ; mem_region->reserved_1 =0 ; mem_region->ep_count = args->nattrs;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 139/160 gpio: sim: fix memory corruption when adding named lines and unnamed hogs
In reply to Greg Kroah-HartmanFrom: Kent Gibson <[email protected]>
[ Upstream commit 95ae9979bfe3174c2ee8d64409c44532f2881907 ]
When constructing the sim, gpio-sim constructs an array of named lines, sized based on the largest offset of any named line, and then initializes that array with the names of all lines, including unnamed hogs with higher offsets. In doing so it writes NULLs beyond the extent of the array.
Add a check that only named lines are used to initialize the array.
--- drivers/gpio/gpio-sim.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpio/gpio-sim.c +4 -2
@@ -721,8 +721,10 @@ static char **gpio_sim_make_line_names(struct gpio_sim_bank *bank,if (!line_names)return ERR_PTR (-ENOMEM ); -list_for_each_entry (line, &bank->line_list, siblings) - line_names[line->offset] = line->name; +list_for_each_entry (line, &bank->line_list, siblings) { +if (line->name && (line->offset <= max_offset)) + line_names[line->offset] = line->name; + }return line_names; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 140/160 i2c: sprd: Delete i2c adapter in .removes error path
In reply to Greg Kroah-HartmanFrom: Uwe Kleine-König <[email protected]>
[ Upstream commit ca0aa17f2db3468fd017038d23a78e17388e2f67 ]
If pm runtime resume fails the .remove callback used to exit early. This resulted in an error message by the driver core but the device gets removed anyhow. This lets the registered i2c adapter stay around with an unbound parent device.
So only skip clk disabling if resume failed, but do delete the adapter.
--- drivers/i2c/busses/i2c-sprd.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/i2c/busses/i2c-sprd.c +5 -3
@@ -576,12 +576,14 @@ static int sprd_i2c_remove(struct platform_device *pdev)struct sprd_i2c *i2c_dev =platform_get_drvdata (pdev);int ret; - ret =pm_runtime_resume_and_get (i2c_dev->dev); + ret =pm_runtime_get_sync (i2c_dev->dev);if (ret <0 ) -return ret; +dev_err (&pdev->dev,"Failed to resume device (%pe)\n" ,ERR_PTR (ret));i2c_del_adapter (&i2c_dev->adap); -clk_disable_unprepare (i2c_dev->clk); + +if (ret >=0 ) +clk_disable_unprepare (i2c_dev->clk);pm_runtime_put_noidle (i2c_dev->dev);pm_runtime_disable (i2c_dev->dev);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 141/160 riscv: mm: Ensure prot of VM_WRITE and VM_EXEC must be readable
In reply to Greg Kroah-HartmanFrom: Hsieh-Tseng Shen <[email protected]>
[ Upstream commit 6569fc12e442ea973d96db39e542aa19a7bc3a79 ]
Commit 8aeb7b17f04e ("RISC-V: Make mmap() with PROT_WRITE imply PROT_READ") allows riscv to use mmap with PROT_WRITE only, and meanwhile mmap with w+x is also permitted. However, when userspace tries to access this page with PROT_WRITE|PROT_EXEC, which causes infinite loop at load page fault as well as it triggers soft lockup. According to riscv privileged spec, "Writable pages must also be marked readable". The fix to drop the PAGE_COPY_READ_EXEC and then PAGE_COPY_EXEC would be just used instead. This aligns the other arches (i.e arm64) for protection_map.
--- arch/riscv/include/asm/pgtable.h | 3 +-- arch/riscv/mm/init.c | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-)
arch/riscv/include/asm/pgtable.h +1 -2
@@ -165,8 +165,7 @@ extern struct pt_alloc_ops pt_ops __initdata; _PAGE_EXEC | _PAGE_WRITE)#define PAGE_COPY PAGE_READ -#define PAGE_COPY_EXEC PAGE_EXEC -#define PAGE_COPY_READ_EXEC PAGE_READ_EXEC +#define PAGE_COPY_EXEC PAGE_READ_EXEC#define PAGE_SHARED PAGE_WRITE#define PAGE_SHARED_EXEC PAGE_WRITE_EXEC
arch/riscv/mm/init.c +1 -1
@@ -286,7 +286,7 @@ static const pgprot_t protection_map[16] = { [VM_EXEC] = PAGE_EXEC, [VM_EXEC | VM_READ] = PAGE_READ_EXEC, [VM_EXEC | VM_WRITE] = PAGE_COPY_EXEC, - [VM_EXEC | VM_WRITE | VM_READ] = PAGE_COPY_READ_EXEC, + [VM_EXEC | VM_WRITE | VM_READ] = PAGE_COPY_EXEC, [VM_SHARED] = PAGE_NONE, [VM_SHARED | VM_READ] = PAGE_READ, [VM_SHARED | VM_WRITE] = PAGE_SHARED,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 142/160 eeprom: at24: also select REGMAP
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 7f3c782b3914e510b646a77aedc3adeac2e4a63b ]
Selecting only REGMAP_I2C can leave REGMAP unset, causing build errors, so also select REGMAP to prevent the build errors.
../drivers/misc/eeprom/at24.c:540:42: warning: 'struct regmap_config' declared inside parameter list will not be visible outside of this definition or declaration
540 | struct regmap_config *regmap_config)../drivers/misc/eeprom/at24.c: In function 'at24_make_dummy_client':../drivers/misc/eeprom/at24.c:552:18: error: implicit declaration of function 'devm_regmap_init_i2c' [-Werror=implicit-function-declaration]
552 | regmap = devm_regmap_init_i2c(dummy_client, regmap_config);../drivers/misc/eeprom/at24.c:552:16: warning: assignment to 'struct regmap *' from 'int' makes pointer from integer without a cast [-Wint-conversion]
552 | regmap = devm_regmap_init_i2c(dummy_client, regmap_config);../drivers/misc/eeprom/at24.c: In function 'at24_probe':../drivers/misc/eeprom/at24.c:586:16: error: variable 'regmap_config' has initializer but incomplete type
586 | struct regmap_config regmap_config = { };../drivers/misc/eeprom/at24.c:586:30: error: storage size of 'regmap_config' isn't known
586 | struct regmap_config regmap_config = { };../drivers/misc/eeprom/at24.c:586:30: warning: unused variable 'regmap_config' [-Wunused-variable]
--- drivers/misc/eeprom/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/misc/eeprom/Kconfig +1 -0
@@ -6,6 +6,7 @@ config EEPROM_AT24 depends on I2C && SYSFS select NVMEM select NVMEM_SYSFS + select REGMAP select REGMAP_I2C help Enable this driver to get read/write support to most I2C EEPROMs
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 143/160 soundwire: stream: Add missing clear of alloc_slave_rt
In reply to Greg Kroah-HartmanFrom: Charles Keepax <[email protected]>
[ Upstream commit 58d95889f3c2064c6139ee94bb0e4d86e1ad4eab ]
The current path that skips allocating the slave runtime does not clear the alloc_slave_rt flag, this is clearly incorrect. Add the missing clear, so the runtime won't be erroneously cleaned up.
--- drivers/soundwire/stream.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/soundwire/stream.c +3 -1
@@ -2019,8 +2019,10 @@ int sdw_stream_add_slave(struct sdw_slave *slave, skip_alloc_master_rt: s_rt =sdw_slave_rt_find (slave, stream); -if (s_rt) +if (s_rt) { + alloc_slave_rt = false; goto skip_alloc_slave_rt; + } s_rt =sdw_slave_rt_alloc (slave, m_rt);if (!s_rt) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 144/160 riscv: fix kprobe __user string arg print fault issue
In reply to Greg Kroah-HartmanFrom: Ruan Jinjie <[email protected]>
[ Upstream commit 99a670b2069c725a7b50318aa681d9cae8f89325 ]
On riscv qemu platform, when add kprobe event on do_sys_open() to show filename string arg, it just print fault as follow:
echo 'p:myprobe do_sys_open dfd=$arg1 filename=+0($arg2):string flags=$arg3 mode=$arg4' > kprobe_events
bash-166 [000] ...1. 360.195367: myprobe: (do_sys_open+0x0/0x84)
dfd=0xffffffffffffff9c filename=(fault) flags=0x8241 mode=0x1b6
bash-166 [000] ...1. 360.219369: myprobe: (do_sys_open+0x0/0x84)
dfd=0xffffffffffffff9c filename=(fault) flags=0x8241 mode=0x1b6
bash-191 [000] ...1. 360.378827: myprobe: (do_sys_open+0x0/0x84)
dfd=0xffffffffffffff9c filename=(fault) flags=0x98800 mode=0x0
As riscv do not select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE, the +0($arg2) addr is processed as a kernel address though it is a userspace address, cause the above filename=(fault) print. So select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE to avoid the issue, after that the kprobe trace is ok as below:
bash-166 [000] ...1. 96.767641: myprobe: (do_sys_open+0x0/0x84)
dfd=0xffffffffffffff9c filename="/dev/null" flags=0x8241 mode=0x1b6
bash-166 [000] ...1. 96.793751: myprobe: (do_sys_open+0x0/0x84)
dfd=0xffffffffffffff9c filename="/dev/null" flags=0x8241 mode=0x1b6
bash-177 [000] ...1. 96.962354: myprobe: (do_sys_open+0x0/0x84)
dfd=0xffffffffffffff9c filename="/sys/kernel/debug/tracing/events/kprobes/" flags=0x98800 mode=0x0
--- arch/riscv/Kconfig | 1 + 1 file changed, 1 insertion(+)
arch/riscv/Kconfig +1 -0
@@ -25,6 +25,7 @@ config RISCV select ARCH_HAS_GIGANTIC_PAGE select ARCH_HAS_KCOV select ARCH_HAS_MMIOWB + select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE select ARCH_HAS_PMEM_API select ARCH_HAS_PTE_SPECIAL select ARCH_HAS_SET_DIRECT_MAP if MMU
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 145/160 vduse: avoid empty string for dev name
In reply to Greg Kroah-HartmanFrom: Sheng Zhao <[email protected]>
[ Upstream commit a90e8608eb0ed93d31ac0feb055f77ce59512542 ]
Syzkaller hits a kernel WARN when the first character of the dev name provided is NULL. Solution is to add a NULL check before calling cdev_device_add() in vduse_create_dev().
kobject: (0000000072042169): attempted to be registered with empty name!
WARNING: CPU: 0 PID: 112695 at lib/kobject.c:236 Call Trace: kobject_add_varg linux/src/lib/kobject.c:390 [inline] kobject_add+0xf6/0x150 linux/src/lib/kobject.c:442 device_add+0x28f/0xc20 linux/src/drivers/base/core.c:2167 cdev_device_add+0x83/0xc0 linux/src/fs/char_dev.c:546 vduse_create_dev linux/src/drivers/vdpa/vdpa_user/vduse_dev.c:2254 [inline] vduse_ioctl+0x7b5/0xf30 linux/src/drivers/vdpa/vdpa_user/vduse_dev.c:2316 vfs_ioctl linux/src/fs/ioctl.c:47 [inline] file_ioctl linux/src/fs/ioctl.c:510 [inline] do_vfs_ioctl+0x14b/0xa80 linux/src/fs/ioctl.c:697 ksys_ioctl+0x7c/0xa0 linux/src/fs/ioctl.c:714 __do_sys_ioctl linux/src/fs/ioctl.c:721 [inline] __se_sys_ioctl linux/src/fs/ioctl.c:719 [inline] __x64_sys_ioctl+0x42/0x50 linux/src/fs/ioctl.c:719 do_syscall_64+0x94/0x330 linux/src/arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x44/0xa9
Message-Id: <[email protected]>
--- drivers/vdpa/vdpa_user/vduse_dev.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/vdpa/vdpa_user/vduse_dev.c +3 -0
@@ -1443,6 +1443,9 @@ static bool vduse_validate_config(struct vduse_dev_config *config)if (config->vq_num >0xffff )return false; +if (!config->name[0 ]) +return false; +if (!device_is_allowed (config->device_id))return false;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 146/160 vdpa/mlx5: Fix hang when cvq commands are triggered during device unregister
In reply to Greg Kroah-HartmanFrom: Dragos Tatulea <[email protected]>
[ Upstream commit 73790bdfba076c0886f0f14fd46ff2c70ee31ce9 ]
Currently the vdpa device is unregistered after the workqueue that processes vq commands is disabled. However, the device unregister process can still send commands to the cvq (a vlan delete for example) which leads to a hang because the handing workqueue has been disabled and the command never finishes:
[ 2263.095764] rcu: INFO: rcu_sched self-detected stall on CPU [ 2263.096307] rcu: 9-....: (5250 ticks this GP) idle=dac4/1/0x4000000000000000 softirq=111009/111009 fqs=2544 [ 2263.097154] rcu: (t=5251 jiffies g=393549 q=347 ncpus=10) [ 2263.097648] CPU: 9 PID: 94300 Comm: kworker/u20:2 Not tainted 6.3.0-rc6_for_upstream_min_debug_2023_04_14_00_02 #1 [ 2263.098535] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 2263.099481] Workqueue: mlx5_events mlx5_vhca_state_work_handler [mlx5_core] [ 2263.100143] RIP: 0010:virtnet_send_command+0x109/0x170 [ 2263.100621] Code: 1d df f5 ff 85 c0 78 5c 48 8b 7b 08 e8 d0 c5 f5 ff 84 c0 75 11 eb 22 48 8b 7b 08 e8 01 b7 f5 ff 84 c0 75 15 f3 90 48 8b 7b 08 <48> 8d 74 24 04 e8 8d c5 f5 ff 48 85 c0 74 de 48 8b 83 f8 00 00 00 [ 2263.102148] RSP: 0018:ffff888139cf36e8 EFLAGS: 00000246 [ 2263.102624] RAX: 0000000000000000 RBX: ffff888166bea940 RCX: 0000000000000001 [ 2263.103244] RDX: 0000000000000000 RSI: ffff888139cf36ec RDI: ffff888146763800 [ 2263.103864] RBP: ffff888139cf3710 R08: ffff88810d201000 R09: 0000000000000000 [ 2263.104473] R10: 0000000000000002 R11: 0000000000000003 R12: 0000000000000002 [ 2263.105082] R13: 0000000000000002 R14: ffff888114528400 R15: ffff888166bea000 [ 2263.105689] FS: 0000000000000000(0000) GS:ffff88852cc80000(0000) knlGS:0000000000000000 [ 2263.106404] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2263.106925] CR2: 00007f31f394b000 CR3: 000000010615b006 CR4: 0000000000370ea0 [ 2263.107542] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 2263.108163] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 2263.108769] Call Trace: [ 2263.109059] <TASK> [ 2263.109320] ? check_preempt_wakeup+0x11f/0x230 [ 2263.109750] virtnet_vlan_rx_kill_vid+0x5a/0xa0 [ 2263.110180] vlan_vid_del+0x9c/0x170 [ 2263.110546] vlan_device_event+0x351/0x760 [8021q] [ 2263.111004] raw_notifier_call_chain+0x41/0x60 [ 2263.111426] dev_close_many+0xcb/0x120 [ 2263.111808] unregister_netdevice_many_notify+0x130/0x770 [ 2263.112297] ? wq_worker_running+0xa/0x30 [ 2263.112688] unregister_netdevice_queue+0x89/0xc0 [ 2263.113128] unregister_netdev+0x18/0x20 [ 2263.113512] virtnet_remove+0x4f/0x230 [ 2263.113885] virtio_dev_remove+0x31/0x70 [ 2263.114273] device_release_driver_internal+0x18f/0x1f0 [ 2263.114746] bus_remove_device+0xc6/0x130 [ 2263.115146] device_del+0x173/0x3c0 [ 2263.115502] ? kernfs_find_ns+0x35/0xd0 [ 2263.115895] device_unregister+0x1a/0x60 [ 2263.116279] unregister_virtio_device+0x11/0x20 [ 2263.116706] device_release_driver_internal+0x18f/0x1f0 [ 2263.117182] bus_remove_device+0xc6/0x130 [ 2263.117576] device_del+0x173/0x3c0 [ 2263.117929] ? vdpa_dev_remove+0x20/0x20 [vdpa] [ 2263.118364] device_unregister+0x1a/0x60 [ 2263.118752] mlx5_vdpa_dev_del+0x4c/0x80 [mlx5_vdpa] [ 2263.119232] vdpa_match_remove+0x21/0x30 [vdpa] [ 2263.119663] bus_for_each_dev+0x71/0xc0 [ 2263.120054] vdpa_mgmtdev_unregister+0x57/0x70 [vdpa] [ 2263.120520] mlx5v_remove+0x12/0x20 [mlx5_vdpa] [ 2263.120953] auxiliary_bus_remove+0x18/0x30 [ 2263.121356] device_release_driver_internal+0x18f/0x1f0 [ 2263.121830] bus_remove_device+0xc6/0x130 [ 2263.122223] device_del+0x173/0x3c0 [ 2263.122581] ? devl_param_driverinit_value_get+0x29/0x90 [ 2263.123070] mlx5_rescan_drivers_locked+0xc4/0x2d0 [mlx5_core] [ 2263.123633] mlx5_unregister_device+0x54/0x80 [mlx5_core] [ 2263.124169] mlx5_uninit_one+0x54/0x150 [mlx5_core] [ 2263.124656] mlx5_sf_dev_remove+0x45/0x90 [mlx5_core] [ 2263.125153] auxiliary_bus_remove+0x18/0x30 [ 2263.125560] device_release_driver_internal+0x18f/0x1f0 [ 2263.126052] bus_remove_device+0xc6/0x130 [ 2263.126451] device_del+0x173/0x3c0 [ 2263.126815] mlx5_sf_dev_remove+0x39/0xf0 [mlx5_core] [ 2263.127318] mlx5_sf_dev_state_change_handler+0x178/0x270 [mlx5_core] [ 2263.127920] blocking_notifier_call_chain+0x5a/0x80 [ 2263.128379] mlx5_vhca_state_work_handler+0x151/0x200 [mlx5_core] [ 2263.128951] process_one_work+0x1bb/0x3c0 [ 2263.129355] ? process_one_work+0x3c0/0x3c0 [ 2263.129766] worker_thread+0x4d/0x3c0 [ 2263.130140] ? process_one_work+0x3c0/0x3c0 [ 2263.130548] kthread+0xb9/0xe0 [ 2263.130895] ? kthread_complete_and_exit+0x20/0x20 [ 2263.131349] ret_from_fork+0x1f/0x30 [ 2263.131717] </TASK>
The fix is to disable and destroy the workqueue after the device unregister. It is expected that vhost will not trigger kicks after the unregister. But even if it would, the wq is disabled already by setting the pointer to NULL (done so in the referenced commit).
Message-Id: <[email protected]>
--- drivers/vdpa/mlx5/net/mlx5_vnet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/vdpa/mlx5/net/mlx5_vnet.c +1 -1
@@ -3323,10 +3323,10 @@ static void mlx5_vdpa_dev_del(struct vdpa_mgmt_dev *v_mdev, struct vdpa_device *mlx5_vdpa_remove_debugfs (ndev->debugfs); ndev->debugfs =NULL ;unregister_link_notifier (ndev); +_vdpa_unregister_device (dev); wq = mvdev->wq; mvdev->wq =NULL ;destroy_workqueue (wq); -_vdpa_unregister_device (dev); mgtdev->ndev =NULL ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 147/160 vhost: support PACKED when setting-getting vring_base
In reply to Greg Kroah-HartmanFrom: Shannon Nelson <[email protected]>
[ Upstream commit 55d8122f5cd62d5aaa225d7167dcd14a44c850b9 ]
Use the right structs for PACKED or split vqs when setting and getting the vring base.
Message-Id: <[email protected]>
--- drivers/vhost/vhost.c | 18 +++++++++++++----- drivers/vhost/vhost.h | 8 ++++++-- 2 files changed, 19 insertions(+), 7 deletions(-)
drivers/vhost/vhost.c +13 -5
@@ -1633,17 +1633,25 @@ long vhost_vring_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *arg r = -EFAULT ;break ; } -if (s.num >0xffff ) { - r = -EINVAL ; -break ; +if (vhost_has_feature (vq,VIRTIO_F_RING_PACKED )) { + vq->last_avail_idx = s.num &0xffff ; + vq->last_used_idx = (s.num >>16 ) &0xffff ; + }else { +if (s.num >0xffff ) { + r = -EINVAL ; +break ; + } + vq->last_avail_idx = s.num; } - vq->last_avail_idx = s.num;/* Forget the cached index value. */ vq->avail_idx = vq->last_avail_idx;break ;case VHOST_GET_VRING_BASE : s.index = idx; - s.num = vq->last_avail_idx; +if (vhost_has_feature (vq,VIRTIO_F_RING_PACKED )) + s.num = (u32 )vq->last_avail_idx | ((u32 )vq->last_used_idx <<16 ); +else + s.num = vq->last_avail_idx;if (copy_to_user (argp, &s,sizeof s)) r = -EFAULT ;break ;
drivers/vhost/vhost.h +6 -2
@@ -85,13 +85,17 @@ struct vhost_virtqueue {/* The routine to call when the Guest pings us, or timeout. */ vhost_work_fn_t handle_kick; -/* Last available index we saw. */ +/* Last available index we saw. +* Values are limited to 0x7fff, and the high bit is used as +* a wrap counter when using VIRTIO_F_RING_PACKED. */ u16 last_avail_idx;/* Caches available index value from user. */ u16 avail_idx; -/* Last index we used. */ +/* Last index we used. +* Values are limited to 0x7fff, and the high bit is used as +* a wrap counter when using VIRTIO_F_RING_PACKED. */ u16 last_used_idx;/* Used flags */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 148/160 vhost_vdpa: support PACKED when setting-getting vring_base
In reply to Greg Kroah-HartmanFrom: Shannon Nelson <[email protected]>
[ Upstream commit beee7fdb5b56a46415a4992d28dd4c2d06eb52df ]
Use the right structs for PACKED or split vqs when setting and getting the vring base.
Message-Id: <[email protected]>
--- drivers/vhost/vdpa.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-)
drivers/vhost/vdpa.c +17 -4
@@ -572,7 +572,14 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd,if (r)return r; - vq->last_avail_idx = vq_state.split.avail_index; +if (vhost_has_feature (vq,VIRTIO_F_RING_PACKED )) { + vq->last_avail_idx = vq_state.packed.last_avail_idx | + (vq_state.packed.last_avail_counter <<15 ); + vq->last_used_idx = vq_state.packed.last_used_idx | + (vq_state.packed.last_used_counter <<15 ); + }else { + vq->last_avail_idx = vq_state.split.avail_index; + }break ; }
@@ -590,9 +597,15 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd,break ;case VHOST_SET_VRING_BASE : - vq_state.split.avail_index = vq->last_avail_idx; -if (ops->set_vq_state (vdpa, idx, &vq_state)) - r = -EINVAL ; +if (vhost_has_feature (vq,VIRTIO_F_RING_PACKED )) { + vq_state.packed.last_avail_idx = vq->last_avail_idx &0x7fff ; + vq_state.packed.last_avail_counter = !!(vq->last_avail_idx &0x8000 ); + vq_state.packed.last_used_idx = vq->last_used_idx &0x7fff ; + vq_state.packed.last_used_counter = !!(vq->last_used_idx &0x8000 ); + }else { + vq_state.split.avail_index = vq->last_avail_idx; + } + r = ops->set_vq_state (vdpa, idx, &vq_state);break ;case VHOST_SET_VRING_CALL :
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 149/160 ksmbd: fix out-of-bound read in deassemble_neg_contexts()
In reply to Greg Kroah-HartmanFrom: Namjae Jeon <[email protected]>
commit f1a411873c85b642f13b01f21b534c2bab81fc1b upstream.
The check in the beginning isclen + sizeof(struct smb2_neg_context) <= len_of_ctxts, but in the end of loop, len_of_ctxts will subtract ((clen + 7) & ~0x7) + sizeof(struct smb2_neg_context), which causes integer underflow when clen does the 8 alignment. We should use (clen + 7) & ~0x7 in the check to avoid underflow from happening.
Then there are some variables that need to be declared unsigned instead of signed.
[ 11.671070] BUG: KASAN: slab-out-of-bounds in smb2_handle_negotiate+0x799/0x1610 [ 11.671533] Read of size 2 at addr ffff888005e86cf2 by task kworker/0:0/7 ... [ 11.673383] Call Trace: [ 11.673541] <TASK> [ 11.673679] dump_stack_lvl+0x33/0x50 [ 11.673913] print_report+0xcc/0x620 [ 11.674671] kasan_report+0xae/0xe0 [ 11.675171] kasan_check_range+0x35/0x1b0 [ 11.675412] smb2_handle_negotiate+0x799/0x1610 [ 11.676217] ksmbd_smb_negotiate_common+0x526/0x770 [ 11.676795] handle_ksmbd_work+0x274/0x810
...
--- fs/ksmbd/smb2pdu.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
fs/ksmbd/smb2pdu.c +6 -7
@@ -991,13 +991,13 @@ static void decode_sign_cap_ctxt(structstatic __le32 deassemble_neg_contexts (struct ksmbd_conn *conn,struct smb2_negotiate_req *req, -int len_of_smb) +unsigned int len_of_smb) {/* +4 is to account for the RFC1001 len field */ struct smb2_neg_context *pctx = (struct smb2_neg_context *)req;int i =0 , len_of_ctxts; -int offset =le32_to_cpu (req->NegotiateContextOffset); -int neg_ctxt_cnt =le16_to_cpu (req->NegotiateContextCount); +unsigned int offset =le32_to_cpu (req->NegotiateContextOffset); +unsigned int neg_ctxt_cnt =le16_to_cpu (req->NegotiateContextCount);__le32 status =STATUS_INVALID_PARAMETER ;ksmbd_debug (SMB ,"decoding %d negotiate contexts\n" , neg_ctxt_cnt);
@@ -1011,7 +1011,7 @@ static __le32 deassemble_neg_contexts(stwhile (i++ < neg_ctxt_cnt) {int clen, ctxt_len; -if (len_of_ctxts <sizeof (struct smb2_neg_context )) +if (len_of_ctxts < (int )sizeof (struct smb2_neg_context ))break ; pctx = (struct smb2_neg_context *)((char *)pctx + offset);
@@ -1066,9 +1066,8 @@ static __le32 deassemble_neg_contexts(st }/* offsets must be 8 byte aligned */ - clen = (clen +7 ) & ~0x7 ; - offset = clen +sizeof (struct smb2_neg_context ); - len_of_ctxts -= clen +sizeof (struct smb2_neg_context ); + offset = (ctxt_len +7 ) & ~0x7 ; + len_of_ctxts -= offset; }return status; }
Greg Kroah-Hartman
maintainerPATCH 150/160 ksmbd: fix out-of-bound read in parse_lease_state()
In reply to Greg Kroah-HartmanFrom: Namjae Jeon <[email protected]>
commit fc6c6a3c324c1b3e93a03d0cfa3749c781f23de0 upstream.
This bug is in parse_lease_state, and it is caused by the missing check of struct create_context. When the ksmbd traverses the create_contexts, it doesn't check if the field of NameOffset and Next is valid, The KASAN message is following:
[ 6.664323] BUG: KASAN: slab-out-of-bounds in parse_lease_state+0x7d/0x280 [ 6.664738] Read of size 2 at addr ffff888005c08988 by task kworker/0:3/103 ... [ 6.666644] Call Trace: [ 6.666796] <TASK> [ 6.666933] dump_stack_lvl+0x33/0x50 [ 6.667167] print_report+0xcc/0x620 [ 6.667903] kasan_report+0xae/0xe0 [ 6.668374] kasan_check_range+0x35/0x1b0 [ 6.668621] parse_lease_state+0x7d/0x280 [ 6.668868] smb2_open+0xbe8/0x4420 [ 6.675137] handle_ksmbd_work+0x282/0x820
Use smb2_find_context_vals() to find smb2 create request lease context. smb2_find_context_vals validate create context fields.
--- fs/ksmbd/oplock.c | 70 ++++++++++++++++++++---------------------------------- 1 file changed, 26 insertions(+), 44 deletions(-)
fs/ksmbd/oplock.c +26 -44
@@ -1415,56 +1415,38 @@ void create_lease_buf(u8 *rbuf, struct l*/ struct lease_ctx_info *parse_lease_state (void *open_req) { -char *data_offset;struct create_context *cc; -unsigned int next =0 ; -char *name; -bool found = false;struct smb2_create_req *req = (struct smb2_create_req *)open_req; -struct lease_ctx_info *lreq =kzalloc (sizeof (struct lease_ctx_info ), -GFP_KERNEL ); +struct lease_ctx_info *lreq; + + cc =smb2_find_context_vals (req,SMB2_CREATE_REQUEST_LEASE ,4 ); +if (IS_ERR_OR_NULL (cc)) +return NULL ; + + lreq =kzalloc (sizeof (struct lease_ctx_info ),GFP_KERNEL );if (!lreq)return NULL ; - data_offset = (char *)req +le32_to_cpu (req->CreateContextsOffset); - cc = (struct create_context *)data_offset; -do { - cc = (struct create_context *)((char *)cc + next); - name =le16_to_cpu (cc->NameOffset) + (char *)cc; -if (le16_to_cpu (cc->NameLength) !=4 || -strncmp (name,SMB2_CREATE_REQUEST_LEASE ,4 )) { - next =le32_to_cpu (cc->Next); -continue ; - } - found = true; -break ; - }while (next !=0 ); - -if (found) { -if (sizeof (struct lease_context_v2 ) ==le32_to_cpu (cc->DataLength)) { -struct create_lease_v2 *lc = (struct create_lease_v2 *)cc; - -memcpy (lreq->lease_key, lc->lcontext.LeaseKey,SMB2_LEASE_KEY_SIZE ); - lreq->req_state = lc->lcontext.LeaseState; - lreq->flags = lc->lcontext.LeaseFlags; - lreq->duration = lc->lcontext.LeaseDuration; -memcpy (lreq->parent_lease_key, lc->lcontext.ParentLeaseKey, -SMB2_LEASE_KEY_SIZE ); - lreq->version =2 ; - }else { -struct create_lease *lc = (struct create_lease *)cc; - -memcpy (lreq->lease_key, lc->lcontext.LeaseKey,SMB2_LEASE_KEY_SIZE ); - lreq->req_state = lc->lcontext.LeaseState; - lreq->flags = lc->lcontext.LeaseFlags; - lreq->duration = lc->lcontext.LeaseDuration; - lreq->version =1 ; - } -return lreq; - } +if (sizeof (struct lease_context_v2 ) ==le32_to_cpu (cc->DataLength)) { +struct create_lease_v2 *lc = (struct create_lease_v2 *)cc; -kfree (lreq); -return NULL ; +memcpy (lreq->lease_key, lc->lcontext.LeaseKey,SMB2_LEASE_KEY_SIZE ); + lreq->req_state = lc->lcontext.LeaseState; + lreq->flags = lc->lcontext.LeaseFlags; + lreq->duration = lc->lcontext.LeaseDuration; +memcpy (lreq->parent_lease_key, lc->lcontext.ParentLeaseKey, +SMB2_LEASE_KEY_SIZE ); + lreq->version =2 ; + }else { +struct create_lease *lc = (struct create_lease *)cc; + +memcpy (lreq->lease_key, lc->lcontext.LeaseKey,SMB2_LEASE_KEY_SIZE ); + lreq->req_state = lc->lcontext.LeaseState; + lreq->flags = lc->lcontext.LeaseFlags; + lreq->duration = lc->lcontext.LeaseDuration; + lreq->version =1 ; + } +return lreq; }/**
Greg Kroah-Hartman
maintainerPATCH 151/160 ksmbd: fix posix_acls and acls dereferencing possible ERR_PTR()
In reply to Greg Kroah-HartmanFrom: Namjae Jeon <[email protected]>
commit 25933573ef48f3586f559c2cac6c436c62dcf63f upstream.
Dan reported the following error message:
fs/smb/server/smbacl.c:1296 smb_check_perm_dacl()
error: 'posix_acls' dereferencing possible ERR_PTR()fs/smb/server/vfs.c:1323 ksmbd_vfs_make_xattr_posix_acl()
error: 'posix_acls' dereferencing possible ERR_PTR()fs/smb/server/vfs.c:1830 ksmbd_vfs_inherit_posix_acl()
error: 'acls' dereferencing possible ERR_PTR()
__get_acl() returns a mix of error pointers and NULL. This change it with IS_ERR_OR_NULL().
--- fs/ksmbd/smbacl.c | 4 ++-- fs/ksmbd/vfs.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
fs/ksmbd/smbacl.c +2 -2
@@ -1290,7 +1290,7 @@ int smb_check_perm_dacl(struct ksmbd_conif (IS_ENABLED (CONFIG_FS_POSIX_ACL )) { posix_acls =get_inode_acl (d_inode (path->dentry),ACL_TYPE_ACCESS ); -if (posix_acls && !found) { +if (!IS_ERR_OR_NULL (posix_acls) && !found) {unsigned int id =-1 ; pa_entry = posix_acls->a_entries;
@@ -1314,7 +1314,7 @@ int smb_check_perm_dacl(struct ksmbd_con } } } -if (posix_acls) +if (!IS_ERR_OR_NULL (posix_acls))posix_acl_release (posix_acls); }
fs/ksmbd/vfs.c +2 -2
@@ -1377,7 +1377,7 @@ static struct xattr_smb_acl *ksmbd_vfs_mreturn NULL ; posix_acls =get_inode_acl (inode, acl_type); -if (!posix_acls) +if (IS_ERR_OR_NULL (posix_acls))return NULL ; smb_acl = kzalloc(sizeof(struct xattr_smb_acl) +
@@ -1886,7 +1886,7 @@ int ksmbd_vfs_inherit_posix_acl(struct mreturn -EOPNOTSUPP ; acls =get_inode_acl (parent_inode,ACL_TYPE_DEFAULT ); -if (!acls) +if (IS_ERR_OR_NULL (acls))return -ENOENT ; pace = acls->a_entries;