6.1.35-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 6.1.35-rc1 review
This is the start of the stable review cycle for the 6.1.35 release. There are 166 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 21 Jun 2023 10:21:12 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.35-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.1.35-rc1
Nick Desaulniers <[email protected]>
kbuild: Update assembler calls to use proper flags and language target
Nathan Chancellor <[email protected]>
MIPS: Prefer cc-option for additions to cflags
Nathan Chancellor <[email protected]>
MIPS: Move '-Wa,-msoft-float' check from as-option to cc-option
Nick Desaulniers <[email protected]>
x86/boot/compressed: prefer cc-option for CFLAGS additions
Bob Pearson <[email protected]>
scsi: target: core: Fix error path in target_setup_session()
Leon Romanovsky <[email protected]>
neighbour: delete neigh_lookup_nodev as not used
Hangbin Liu <[email protected]>
net/sched: act_api: add specific EXT_WARN_MSG for tc action
Hangbin Liu <[email protected]>
Revert "net/sched: act_api: move TCA_EXT_WARN_MSG to the correct hierarchy"
Pedro Tammela <[email protected]>
net/sched: act_api: move TCA_EXT_WARN_MSG to the correct hierarchy
Thomas Zimmermann <[email protected]>
drm/amdgpu: Don't set struct drm_driver.output_poll_changed
Ziwei Dai <[email protected]>
rcu/kvfree: Avoid freeing new kfree_rcu() memory after old grace period
Ben Hutchings <[email protected]>
parisc: Delete redundant register definitions in <asm/assembly.h>
David Howells <[email protected]>
afs: Fix vlserver probe RTT handling
Jiasheng Jiang <[email protected]>
octeon_ep: Add missing check for ioremap
Alex Maftei <[email protected]>
selftests/ptp: Fix timestamp printf format for PTP_SYS_OFFSET
Lin Ma <[email protected]>
net: tipc: resize nlattr array to correct size
Li Lingfeng <[email protected]>
dm: don't lock fs when the map is NULL during suspend or resume
Íñigo Huguet <[email protected]>
sfc: fix XDP queues mode with legacy IRQ
Fedor Pchelkin <[email protected]>
net: macsec: fix double free of percpu stats
Eric Dumazet <[email protected]>
net: lapbether: only support ethernet devices
Vladimir Oltean <[email protected]>
net: dsa: felix: fix taprio guard band overflow at 10Mbps with jumbo frames
Vlad Buslov <[email protected]>
net/sched: cls_api: Fix lockup on flushing explicitly created chain
Fabio M. De Francesco <[email protected]>
ext4: drop the call to ext4_error() from ext4_get_group_info()
Steve French <[email protected]>
cifs: fix lease break oops in xfstest generic/098
Danielle Ratson <[email protected]>
selftests: forwarding: hw_stats_l3: Set addrgenmode in a separate step
Peilin Ye <[email protected]>
net/sched: qdisc_destroy() old ingress and clsact Qdiscs before grafting
Peilin Ye <[email protected]>
net/sched: Refactor qdisc_graft() for ingress and clsact Qdiscs
Hangbin Liu <[email protected]>
sched: add new attr TCA_EXT_WARN_MSG to report tc extact message
Vlad Buslov <[email protected]>
selftests/tc-testing: Fix SFB db test
Vlad Buslov <[email protected]>
selftests/tc-testing: Fix Error: failed to find target LOG
Vlad Buslov <[email protected]>
selftests/tc-testing: Fix Error: Specified qdisc kind is unknown.
Natalia Petrova <[email protected]>
drm/nouveau: add nv_encoder pointer check for NULL
Natalia Petrova <[email protected]>
drm/nouveau/dp: check for NULL nv_connector->native_mode
Su Hui <[email protected]>
drm/bridge: ti-sn65dsi86: Avoid possible buffer overflow
Ratchanan Srirattanamet <[email protected]>
drm/nouveau: don't detect DSM for non-NVIDIA device
Maxime Chevallier <[email protected]>
net: phylink: use a dedicated helper to parse usgmii control word
Maxime Chevallier <[email protected]>
net: phylink: report correct max speed for QUSGMII
Aleksandr Loktionov <[email protected]>
igb: fix nvm.ops.read() error handling
Vinicius Costa Gomes <[email protected]>
igc: Fix possible system crash when loading module
Muhammad Husaini Zulkifli <[email protected]>
igc: Clean the TX buffer and TX descriptor ring
Dan Carpenter <[email protected]>
sctp: fix an error code in sctp_sf_eat_auth()
Hangbin Liu <[email protected]>
ipvlan: fix bound dev checking for IPv6 l3s mode
Jakub Kicinski <[email protected]>
net: ethtool: correct MAX attribute value for stats
Saravanan Vajravel <[email protected]>
IB/isert: Fix incorrect release of isert connection
Saravanan Vajravel <[email protected]>
IB/isert: Fix possible list corruption in CMA handler
Saravanan Vajravel <[email protected]>
IB/isert: Fix dead lock in ib_isert
Mark Bloch <[email protected]>
RDMA/mlx5: Fix affinity assignment
Yishai Hadas <[email protected]>
IB/uverbs: Fix to consider event queue closing also upon non-blocking mode
Mark Zhang <[email protected]>
RDMA/cma: Always set static rate to 0 for RoCE
Mark Bloch <[email protected]>
RDMA/mlx5: Create an indirect flow table for steering anchor
Maher Sanalla <[email protected]>
RDMA/mlx5: Initiate dropless RQ for RAW Ethernet functions
Nithin Dabilpuram <[email protected]>
octeontx2-af: fix lbk link credits on cn10k
Satha Rao <[email protected]>
octeontx2-af: fixed resource availability check
Ahmed Zaki <[email protected]>
iavf: remove mask from iavf_irq_enable_queues()
Zhu Yanjun <[email protected]>
RDMA/rxe: Fix the use-before-initialization error of resp_pkts
Bob Pearson <[email protected]>
RDMA/rxe: Removed unused name from rxe_task struct
Benjamin Berg <[email protected]>
wifi: mac80211: take lock before setting vif links
Benjamin Berg <[email protected]>
wifi: cfg80211: fix link del callback to call correct handler
Johannes Berg <[email protected]>
wifi: mac80211: fix link activation settings order
Lee Jones <[email protected]>
net/sched: cls_u32: Fix reference counter leak leading to overflow
Ratheesh Kannoth <[email protected]>
octeontx2-af: Fix promiscuous mode
Max Tottenham <[email protected]>
net/sched: act_pedit: Parse L3 Header for L4 offset
Pedro Tammela <[email protected]>
net/sched: act_pedit: remove extra check for key type
Pedro Tammela <[email protected]>
net/sched: simplify tcf_pedit_act
Yuezhen Luan <[email protected]>
igb: Fix extts capture value format for 82580/i354/i350
Guillaume Nault <[email protected]>
ping6: Fix send to link-local addresses with VRF.
Wei Fang <[email protected]>
net: enetc: correct the indexes of highest and 2nd highest TCs
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
Kamil Maziarz <[email protected]>
ice: Fix XDP memory leak when NIC is brought up and down
Pablo Neira Ayuso <[email protected]>
netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: integrate pipapo into commit protocol
Vladimir Oltean <[email protected]>
spi: fsl-dspi: avoid SCK glitches with continuous transfers
Jiasheng Jiang <[email protected]>
spi: cadence-quadspi: Add missing check for dma_set_mask
Bob Pearson <[email protected]>
RDMA/rxe: Fix ref count error in check_rkey()
Bob Pearson <[email protected]>
RDMA/rxe: Fix packet length checks
Li Zhijian <[email protected]>
RDMA/rtrs: Fix rxe_dealloc_pd warning
Li Zhijian <[email protected]>
RDMA/rtrs: Fix the last iu->buf leak in err path
Elson Roy Serrao <[email protected]>
usb: dwc3: gadget: Reset num TRBs before giving back the request
Johan Hovold <[email protected]>
USB: dwc3: fix use-after-free on core driver unbind
Johan Hovold <[email protected]>
USB: dwc3: qcom: fix NULL-deref on suspend
Badhri Jagan Sridharan <[email protected]>
usb: gadget: udc: core: Prevent soft_connect_store() race
Badhri Jagan Sridharan <[email protected]>
usb: gadget: udc: core: Offload usb_udc_vbus_handler processing
Pavan Holla <[email protected]>
usb: typec: Fix fast_role_swap_current show function
Heikki Krogerus <[email protected]>
usb: typec: ucsi: Fix command cancellation
Bernhard Seibold <[email protected]>
serial: lantiq: add missing interrupt ack
Jerry Meng <[email protected]>
USB: serial: option: add Quectel EM061KGL series
Arnd Bergmann <[email protected]>
clk: pxa: fix NULL pointer dereference in pxa3xx_clk_update_accr
Mika Westerberg <[email protected]>
thunderbolt: Mask ring interrupt on Intel hardware as well
Mika Westerberg <[email protected]>
thunderbolt: dma_test: Use correct value for absent rings when creating paths
Mika Westerberg <[email protected]>
thunderbolt: Do not touch CL state configuration during discovery
Edson Juliano Drosdeck <[email protected]>
ALSA: hda/realtek: Add a quirk for Compaq N14JP6
Alex Deucher <[email protected]>
drm/amdgpu: add missing radeon secondary PCI ID
Kenneth Feng <[email protected]>
drm/amd/pm: workaround for compute workload type on some skus
Mario Limonciello <[email protected]>
drm/amd: Tighten permissions on VBIOS flashing attributes
Mario Limonciello <[email protected]>
drm/amd: Make sure image is written to trigger VBIOS image update flow
Hersen Wu <[email protected]>
drm/amd/display: edp do not add non-edid timings
Wes Huang <[email protected]>
net: usb: qmi_wwan: add support for Compal RXM-G1
Sonny Jiang <[email protected]>
drm/amdgpu: vcn_4_0 set instance 0 init sched score to 1
Edward Srouji <[email protected]>
RDMA/uverbs: Restrict usage of privileged QKEYs
Dave Airlie <[email protected]>
nouveau: fix client work fence deletion race
Christian Marangi <[email protected]>
net: ethernet: stmicro: stmmac: fix possible memory leak in __stmmac_open
Mike Snitzer <[email protected]>
dm thin: fix issue_discard to pass GFP_NOIO to __blkdev_issue_discard
Li Lingfeng <[email protected]>
dm thin metadata: check fail_io before using data_sm
Lukasz Tyl <[email protected]>
ALSA: usb-audio: Add quirk flag for HEM devices to enable native DSD playback
Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix broken resume due to UAC3 power state
Chris Mason <[email protected]>
btrfs: can_nocow_file_extent should pass down args->strict from callers
Christoph Hellwig <[email protected]>
btrfs: fix iomap_begin length for nocow writes
Qu Wenruo <[email protected]>
btrfs: do not ASSERT() on duplicated global roots
Ricardo Ribalda <[email protected]>
powerpc/purgatory: remove PGO flags
Ricardo Ribalda <[email protected]>
riscv/purgatory: remove PGO flags
Ricardo Ribalda <[email protected]>
x86/purgatory: remove PGO flags
Ricardo Ribalda <[email protected]>
kexec: support purgatories with .text.hot sections
Jens Axboe <[email protected]>
io_uring/net: save msghdr->msg_control for retries
Huacai Chen <[email protected]>
LoongArch: Fix perf event id calculation
Ryusuke Konishi <[email protected]>
nilfs2: reject devices with insufficient block count
Ryusuke Konishi <[email protected]>
nilfs2: fix possible out-of-bounds segment allocation in resize ioctl
Ryusuke Konishi <[email protected]>
nilfs2: fix incomplete buffer cleanup in nilfs_btnode_abort_change_key()
Janne Grunau <[email protected]>
nios2: dts: Fix tse_mac "max-frame-size" property
Nhat Pham <[email protected]>
zswap: do not shrink if cgroup may not zswap
Luís Henriques <[email protected]>
ocfs2: check new file size on fallocate call
Luís Henriques <[email protected]>
ocfs2: fix use-after-free when unmounting read-only filesystem
Benjamin Segall <[email protected]>
epoll: ep_autoremove_wake_function should use list_del_init_careful
Dan Carpenter <[email protected]>
wifi: cfg80211: fix double lock bug in reg_wdev_chan_valid()
Johannes Berg <[email protected]>
wifi: cfg80211: fix locking in regulatory disconnect
Marc Zyngier <[email protected]>
irqchip/gic: Correctly validate OF quirk descriptors
Tatsuki Sugiura <[email protected]>
NVMe: Add MAXIO 1602 to bogus nid list.
Wenwen Chen <[email protected]>
io_uring: unlock sqd->lock before sq thread release CPU
Sukrut Bellary <[email protected]>
drm:amd:amdgpu: Fix missing buffer object unlock in failure path
Ross Lagerwall <[email protected]>
xen/blkfront: Only check REQ_FUA for writes
Maxim Kochetkov <[email protected]>
ASoC: dwc: move DMA init to snd_soc_dai_driver probe()
Stefan Binding <[email protected]>
ASoC: cs35l41: Fix default regmap values for some registers
Liviu Dudau <[email protected]>
mips: Move initrd_start check after initrd address sanitisation.
Manuel Lauss <[email protected]>
MIPS: Alchemy: fix dbdma2
Manuel Lauss <[email protected]>
MIPS: Restore Au1300 support
Manuel Lauss <[email protected]>
MIPS: unhide PATA_PLATFORM
Helge Deller <[email protected]>
parisc: Flush gatt writes and adjust gatt mask in parisc_agp_mask_memory()
Helge Deller <[email protected]>
parisc: Improve cache flushing for PCXL in arch_sync_dma_for_cpu()
Amadeusz Sławiński <[email protected]>
ASoC: Intel: avs: Add missing checks on FE startup
Cezary Rojewski <[email protected]>
ASoC: Intel: avs: Account for UID of ACPI device
Ranjani Sridharan <[email protected]>
ASoC: soc-pcm: test if a BE can be prepared
Johannes Thumshirn <[email protected]>
btrfs: handle memory allocation failure in btrfs_csum_one_bio
Qu Wenruo <[email protected]>
btrfs: scrub: try harder to mark RAID56 block groups read-only
Maya Matuszczyk <[email protected]>
drm: panel-orientation-quirks: Change Air's quirk to support Air Plus
Mario Limonciello <[email protected]>
power: supply: Fix logic checking if system is running from battery
Krzysztof Kozlowski <[email protected]>
irqchip/meson-gpio: Mark OF related data as maybe unused
Douglas Anderson <[email protected]>
irqchip/gic-v3: Disable pseudo NMIs on Mediatek devices w/ firmware issues
Osama Muhammad <[email protected]>
regulator: Fix error checking for debugfs_create_dir
Alexandru Sorodoc <[email protected]>
platform/x86: asus-wmi: Ignore WMI events with codes 0x7B, 0xC0
Mika Westerberg <[email protected]>
PCI/DPC: Quirk PIO log size for Intel Ice Lake Root Ports
Marek Vasut <[email protected]>
power: supply: Ratelimit no data debug output
Mirsad Todorovac <[email protected]>
selftests: gpio: gpio-sim: Fix BUG: test FAILED due to recent change
Milo Spadacini <[email protected]>
tools: gpio: fix debounce_period_us output of lsgpio
Krzysztof Kozlowski <[email protected]>
ARM: dts: vexpress: add missing cache properties
Hans de Goede <[email protected]>
power: supply: bq27xxx: Use mod_delayed_work() instead of cancel() + schedule()
Hans de Goede <[email protected]>
power: supply: sc27xx: Fix external_power_changed race
Hans de Goede <[email protected]>
power: supply: ab8500: Fix external_power_changed race
Kunihiko Hayashi <[email protected]>
of: overlay: Fix missing of_node_put() in error case of init_overlay_changeset()
Namjae Jeon <[email protected]>
ksmbd: validate smb request protocol id
Manivannan Sadhasivam <[email protected]>
EDAC/qcom: Get rid of hardcoded register offsets
Manivannan Sadhasivam <[email protected]>
qcom: llcc/edac: Fix the base address used for accessing LLCC banks
Qi Zheng <[email protected]>
cgroup: fix missing cpus_read_{lock,unlock}() in cgroup_transfer_tasks()
John Sperbeck <[email protected]>
cgroup: always put cset in cgroup_css_set_put_fork
Kamalesh Babulal <[email protected]>
cgroup: bpf: use cgroup_lock()/cgroup_unlock() wrappers
Mirsad Goran Todorovac <[email protected]>
test_firmware: prevent race conditions by a correct implementation of locking
Christophe JAILLET <[email protected]>
test_firmware: Use kstrtobool() instead of strtobool()
Tom Lendacky <[email protected]>
x86/head/64: Switch to KERNEL_CS as soon as new GDT is installed
-------------
Diffstat:
Makefile | 4 +- arch/arm/boot/dts/vexpress-v2p-ca5s.dts | 1 + arch/loongarch/kernel/perf_event.c | 6 +- arch/mips/Kconfig | 1 + arch/mips/Makefile | 4 +- arch/mips/alchemy/common/dbdma.c | 27 +- arch/mips/kernel/cpu-probe.c | 5 + arch/mips/kernel/setup.c | 9 +- arch/mips/loongson2ef/Platform | 2 +- arch/nios2/boot/dts/10m50_devboard.dts | 2 +- arch/nios2/boot/dts/3c120_devboard.dts | 2 +- arch/parisc/include/asm/assembly.h | 4 - arch/parisc/kernel/pci-dma.c | 18 +- arch/powerpc/purgatory/Makefile | 5 + arch/riscv/purgatory/Makefile | 5 + arch/x86/boot/compressed/Makefile | 2 +- arch/x86/kernel/head_64.S | 18 +- arch/x86/purgatory/Makefile | 5 + drivers/block/xen-blkfront.c | 3 +- drivers/char/agp/parisc-agp.c | 15 +- drivers/clk/pxa/clk-pxa3xx.c | 2 +- drivers/edac/qcom_edac.c | 122 +++++---- drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 1 - drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 7 +- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 6 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 33 ++- drivers/gpu/drm/bridge/ti-sn65dsi86.c | 4 + drivers/gpu/drm/drm_panel_orientation_quirks.c | 2 +- drivers/gpu/drm/nouveau/nouveau_acpi.c | 3 + drivers/gpu/drm/nouveau/nouveau_connector.c | 7 +- drivers/gpu/drm/nouveau/nouveau_drm.c | 14 +- drivers/infiniband/core/cma.c | 4 +- drivers/infiniband/core/uverbs_cmd.c | 7 +- drivers/infiniband/core/uverbs_main.c | 12 +- drivers/infiniband/hw/mlx5/fs.c | 276 ++++++++++++++++++++- drivers/infiniband/hw/mlx5/fs.h | 16 ++ drivers/infiniband/hw/mlx5/main.c | 3 + drivers/infiniband/hw/mlx5/mlx5_ib.h | 14 ++ drivers/infiniband/hw/mlx5/qp.c | 3 + drivers/infiniband/sw/rxe/rxe_net.c | 6 + drivers/infiniband/sw/rxe/rxe_qp.c | 16 +- drivers/infiniband/sw/rxe/rxe_resp.c | 3 +- drivers/infiniband/sw/rxe/rxe_task.c | 4 +- drivers/infiniband/sw/rxe/rxe_task.h | 4 +- drivers/infiniband/ulp/isert/ib_isert.c | 16 +- drivers/infiniband/ulp/rtrs/rtrs-clt.c | 55 ++-- drivers/infiniband/ulp/rtrs/rtrs.c | 4 +- drivers/irqchip/irq-gic-common.c | 10 +- drivers/irqchip/irq-gic-common.h | 1 + drivers/irqchip/irq-gic-v3.c | 20 ++ drivers/irqchip/irq-meson-gpio.c | 2 +- drivers/md/dm-ioctl.c | 5 +- drivers/md/dm-thin-metadata.c | 20 +- drivers/md/dm-thin.c | 3 +- drivers/md/dm.c | 4 + drivers/net/dsa/ocelot/felix_vsc9959.c | 2 +- drivers/net/ethernet/freescale/enetc/enetc_qos.c | 4 +- drivers/net/ethernet/intel/iavf/iavf.h | 2 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 15 +- drivers/net/ethernet/intel/iavf/iavf_register.h | 2 +- drivers/net/ethernet/intel/ice/ice_main.c | 4 + drivers/net/ethernet/intel/igb/igb_ethtool.c | 3 + drivers/net/ethernet/intel/igb/igb_main.c | 8 +- drivers/net/ethernet/intel/igc/igc_main.c | 12 +- .../net/ethernet/marvell/octeon_ep/octep_main.c | 7 +- .../net/ethernet/marvell/octeontx2/af/rvu_nix.c | 7 +- .../ethernet/marvell/octeontx2/af/rvu_npc_hash.c | 29 +-- .../net/ethernet/mellanox/mlx5/core/mlx5_core.h | 12 - drivers/net/ethernet/sfc/efx_channels.c | 2 + drivers/net/ethernet/sfc/siena/efx_channels.c | 2 + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 9 +- drivers/net/ipvlan/ipvlan_l3s.c | 4 + drivers/net/macsec.c | 12 +- drivers/net/phy/phylink.c | 41 ++- drivers/net/usb/qmi_wwan.c | 2 + drivers/net/wan/lapbether.c | 3 + drivers/nvme/host/pci.c | 2 + drivers/of/overlay.c | 1 + drivers/pci/quirks.c | 9 +- drivers/platform/x86/asus-nb-wmi.c | 2 + drivers/power/supply/ab8500_btemp.c | 6 +- drivers/power/supply/ab8500_fg.c | 6 +- drivers/power/supply/bq27xxx_battery.c | 6 +- drivers/power/supply/power_supply_core.c | 8 +- drivers/power/supply/power_supply_sysfs.c | 3 +- drivers/power/supply/sc27xx_fuel_gauge.c | 9 +- drivers/regulator/core.c | 4 +- drivers/soc/qcom/llcc-qcom.c | 72 +++--- drivers/spi/spi-cadence-quadspi.c | 7 +- drivers/spi/spi-fsl-dspi.c | 15 ++ drivers/target/target_core_transport.c | 2 + drivers/thunderbolt/dma_test.c | 8 +- drivers/thunderbolt/nhi.c | 11 +- drivers/thunderbolt/tb.c | 17 +- drivers/tty/serial/lantiq.c | 1 + drivers/usb/dwc3/core.c | 5 + drivers/usb/dwc3/dwc3-qcom.c | 11 +- drivers/usb/dwc3/gadget.c | 1 + drivers/usb/gadget/udc/core.c | 180 ++++++++++---- drivers/usb/serial/option.c | 16 ++ drivers/usb/typec/pd.c | 2 +- drivers/usb/typec/ucsi/ucsi.c | 11 +- fs/afs/vl_probe.c | 4 +- fs/btrfs/block-group.c | 14 +- fs/btrfs/disk-io.c | 10 +- fs/btrfs/file-item.c | 4 +- fs/btrfs/inode.c | 20 +- fs/btrfs/scrub.c | 9 +- fs/cifs/file.c | 8 +- fs/eventpoll.c | 6 +- fs/ext4/balloc.c | 20 +- fs/ksmbd/connection.c | 5 +- fs/ksmbd/smb_common.c | 14 +- fs/nilfs2/btnode.c | 12 +- fs/nilfs2/sufile.c | 9 + fs/nilfs2/the_nilfs.c | 43 +++- fs/ocfs2/file.c | 8 +- fs/ocfs2/super.c | 6 +- include/linux/mlx5/driver.h | 12 + include/linux/soc/qcom/llcc-qcom.h | 12 +- include/net/neighbour.h | 2 - include/net/netfilter/nf_tables.h | 4 +- include/net/sch_generic.h | 8 + include/rdma/ib_addr.h | 23 -- include/sound/soc-acpi.h | 1 + include/sound/soc-dpcm.h | 4 + include/uapi/linux/ethtool_netlink.h | 2 +- include/uapi/linux/rtnetlink.h | 2 + io_uring/net.c | 8 +- io_uring/sqpoll.c | 6 +- kernel/bpf/cgroup.c | 38 +-- kernel/bpf/cgroup_iter.c | 4 +- kernel/bpf/local_storage.c | 4 +- kernel/cgroup/cgroup-v1.c | 20 +- kernel/cgroup/cgroup.c | 77 +++--- kernel/kexec_file.c | 14 +- kernel/rcu/tree.c | 27 +- lib/test_firmware.c | 55 ++-- mm/zswap.c | 11 +- net/core/neighbour.c | 31 --- net/ipv6/ping.c | 3 +- net/mac80211/cfg.c | 9 +- net/mac80211/link.c | 4 +- net/netfilter/nf_tables_api.c | 59 ++++- net/netfilter/nfnetlink.c | 3 +- net/netfilter/nft_set_pipapo.c | 55 ++-- net/sched/act_api.c | 15 +- net/sched/act_pedit.c | 176 +++++++------ net/sched/cls_api.c | 74 +++--- net/sched/cls_u32.c | 18 +- net/sched/sch_api.c | 97 +++++--- net/sched/sch_generic.c | 14 +- net/sctp/sm_statefuns.c | 2 +- net/tipc/bearer.c | 4 +- net/wireless/rdev-ops.h | 6 +- net/wireless/reg.c | 7 +- scripts/Kconfig.include | 2 +- scripts/Makefile.compiler | 8 +- scripts/as-version.sh | 2 +- sound/pci/hda/patch_realtek.c | 1 + sound/soc/codecs/cs35l41-lib.c | 6 +- sound/soc/dwc/dwc-i2s.c | 41 +-- sound/soc/intel/avs/board_selection.c | 2 +- sound/soc/intel/avs/pcm.c | 23 +- sound/soc/soc-pcm.c | 20 ++ sound/usb/pcm.c | 4 + sound/usb/quirks.c | 2 + tools/gpio/lsgpio.c | 2 +- tools/testing/selftests/gpio/gpio-sim.sh | 3 + .../selftests/net/forwarding/hw_stats_l3.sh | 11 +- tools/testing/selftests/ptp/testptp.c | 6 +- tools/testing/selftests/tc-testing/config | 1 + .../selftests/tc-testing/tc-tests/qdiscs/sfb.json | 4 +- tools/testing/selftests/tc-testing/tdc.sh | 1 + 178 files changed, 1838 insertions(+), 867 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/166 x86/head/64: Switch to KERNEL_CS as soon as new GDT is installed
From: Tom Lendacky <[email protected]>
[ Upstream commit a37f2699c36a7f6606ba3300f243227856c5ad6b ]
The call to startup_64_setup_env() will install a new GDT but does not actually switch to using the KERNEL_CS entry until returning from the function call.
Commit bcce82908333 ("x86/sev: Detect/setup SEV/SME features earlier in boot") moved the call to sme_enable() earlier in the boot process and in between the call to startup_64_setup_env() and the switch to KERNEL_CS. An SEV-ES or an SEV-SNP guest will trigger #VC exceptions during the call to sme_enable() and if the CS pushed on the stack as part of the exception and used by IRETQ is not mapped by the new GDT, then problems occur. Today, the current CS when entering startup_64 is the kernel CS value because it was set up by the decompressor code, so no issue is seen.
However, a recent patchset that looked to avoid using the legacy decompressor during an EFI boot exposed this bug. At entry to startup_64, the CS value is that of EFI and is not mapped in the new kernel GDT. So when a #VC exception occurs, the CS value used by IRETQ is not valid and the guest boot crashes.
Fix this issue by moving the block that switches to the KERNEL_CS value to be done immediately after returning from startup_64_setup_env().
--- arch/x86/kernel/head_64.S | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
arch/x86/kernel/head_64.S +9 -9
@@ -85,6 +85,15 @@ SYM_CODE_START_NOALIGN(startup_64) call startup_64_setup_env popq %rsi + /* Now switch to __KERNEL_CS so IRET works reliably */ + pushq $__KERNEL_CS + leaq .Lon_kernel_cs(%rip), %rax + pushq %rax + lretq + +.Lon_kernel_cs: + UNWIND_HINT_EMPTY + #ifdef CONFIG_AMD_MEM_ENCRYPT /* * Activate SEV/SME memory encryption if supported/enabled. This needs to
@@ -98,15 +107,6 @@ SYM_CODE_START_NOALIGN(startup_64) popq %rsi #endif - /* Now switch to __KERNEL_CS so IRET works reliably */ - pushq $__KERNEL_CS - leaq .Lon_kernel_cs(%rip), %rax - pushq %rax - lretq - -.Lon_kernel_cs: - UNWIND_HINT_EMPTY - /* Sanitize CPU configuration */ call verify_cpu
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 2/166 test_firmware: Use kstrtobool() instead of strtobool()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit f7d85515bd21902b218370a1a6301f76e4e636ff ]
strtobool() is the same as kstrtobool(). However, the latter is more used within the kernel.
In order to remove strtobool() and slightly simplify kstrtox.h, switch to the other function name.
While at it, include the corresponding header file (<linux/kstrtox.h>)
Stable-dep-of: 4acfe3dfde68 ("test_firmware: prevent race conditions by a correct implementation of locking")
--- lib/test_firmware.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
lib/test_firmware.c +2 -1
@@ -22,6 +22,7 @@#include <linux/slab.h> #include <linux/uaccess.h> #include <linux/delay.h> +#include <linux/kstrtox.h> #include <linux/kthread.h> #include <linux/vmalloc.h> #include <linux/efi_embedded_fw.h>
@@ -365,7 +366,7 @@ static int test_dev_config_update_bool(const char *buf, size_t size,int ret;mutex_lock (&test_fw_mutex); -if (strtobool (buf, cfg) <0 ) +if (kstrtobool (buf, cfg) <0 ) ret = -EINVAL ;else ret = size;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 3/166 test_firmware: prevent race conditions by a correct implementation of locking
In reply to Greg Kroah-HartmanFrom: Mirsad Goran Todorovac <[email protected]>
[ Upstream commit 4acfe3dfde685a5a9eaec5555351918e2d7266a1 ]
Dan Carpenter spotted a race condition in a couple of situations like these in the test_firmware driver:
static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
{
u8 val;
int ret;
ret = kstrtou8(buf, 10, &val);
if (ret)
return ret;
mutex_lock(&test_fw_mutex);
*(u8 *)cfg = val;
mutex_unlock(&test_fw_mutex);
/* Always return full write size even if we didn't consume all */
return size;
}static ssize_t config_num_requests_store(struct device *dev,
struct device_attribute *attr, const char *buf, size_t count)
{
int rc;
mutex_lock(&test_fw_mutex);
if (test_fw_config->reqs) {
pr_err("Must call release_all_firmware prior to changing config\n");
rc = -EINVAL;
mutex_unlock(&test_fw_mutex);
goto out;
}
mutex_unlock(&test_fw_mutex);
rc = test_dev_config_update_u8(buf, count,
&test_fw_config->num_requests);out:
return rc; }
static ssize_t config_read_fw_idx_store(struct device *dev,
struct device_attribute *attr, const char *buf, size_t count)
{
return test_dev_config_update_u8(buf, count,
&test_fw_config->read_fw_idx);
}
The function test_dev_config_update_u8() is called from both the locked and the unlocked context, function config_num_requests_store() and config_read_fw_idx_store() which can both be called asynchronously as they are driver's methods, while test_dev_config_update_u8() and siblings change their argument pointed to by u8 *cfg or similar pointer.
To avoid deadlock on test_fw_mutex, the lock is dropped before calling test_dev_config_update_u8() and re-acquired within test_dev_config_update_u8() itself, but alas this creates a race condition.
Having two locks wouldn't assure a race-proof mutual exclusion.
This situation is best avoided by the introduction of a new, unlocked function __test_dev_config_update_u8() which can be called from the locked context and reducing test_dev_config_update_u8() to:
static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
{
int ret;
mutex_lock(&test_fw_mutex);
ret = __test_dev_config_update_u8(buf, size, cfg);
mutex_unlock(&test_fw_mutex);
return ret;
}doing the locking and calling the unlocked primitive, which enables both locked and unlocked versions without duplication of code.
The similar approach was applied to all functions called from the locked and the unlocked context, which safely mitigates both deadlocks and race conditions in the driver.
__test_dev_config_update_bool(), __test_dev_config_update_u8() and __test_dev_config_update_size_t() unlocked versions of the functions were introduced to be called from the locked contexts as a workaround without releasing the main driver's lock and thereof causing a race condition.
The test_dev_config_update_bool(), test_dev_config_update_u8() and test_dev_config_update_size_t() locked versions of the functions are being called from driver methods without the unnecessary multiplying of the locking and unlocking code for each method, and complicating the code with saving of the return value across lock.
--- lib/test_firmware.c | 52 ++++++++++++++++++++++++++++++--------------- 1 file changed, 35 insertions(+), 17 deletions(-)
lib/test_firmware.c +35 -17
@@ -360,16 +360,26 @@ static ssize_t config_test_show_str(char *dst,return len; } -static int test_dev_config_update_bool (const char *buf,size_t size, +static inline int __test_dev_config_update_bool (const char *buf,size_t size,bool *cfg) {int ret; -mutex_lock (&test_fw_mutex);if (kstrtobool (buf, cfg) <0 ) ret = -EINVAL ;else ret = size; + +return ret; +} + +static int test_dev_config_update_bool (const char *buf,size_t size, +bool *cfg) +{ +int ret; + +mutex_lock (&test_fw_mutex); + ret =__test_dev_config_update_bool (buf, size, cfg);mutex_unlock (&test_fw_mutex);return ret;
@@ -380,7 +390,8 @@ static ssize_t test_dev_config_show_bool(char *buf, bool val)return snprintf (buf,PAGE_SIZE ,"%d\n" , val); } -static int test_dev_config_update_size_t (const char *buf, +static int __test_dev_config_update_size_t ( +const char *buf,size_t size,size_t *cfg) {
@@ -391,9 +402,7 @@ static int test_dev_config_update_size_t(const char *buf,if (ret)return ret; -mutex_lock (&test_fw_mutex); *(size_t *)cfg = new; -mutex_unlock (&test_fw_mutex);/* Always return full write size even if we didn't consume all */ return size;
@@ -409,7 +418,7 @@ static ssize_t test_dev_config_show_int(char *buf, int val)return snprintf (buf,PAGE_SIZE ,"%d\n" , val); } -static int test_dev_config_update_u8 (const char *buf,size_t size,u8 *cfg) +static int __test_dev_config_update_u8 (const char *buf,size_t size,u8 *cfg) {u8 val;int ret;
@@ -418,14 +427,23 @@ static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)if (ret)return ret; -mutex_lock (&test_fw_mutex); *(u8 *)cfg = val; -mutex_unlock (&test_fw_mutex);/* Always return full write size even if we didn't consume all */ return size; } +static int test_dev_config_update_u8 (const char *buf,size_t size,u8 *cfg) +{ +int ret; + +mutex_lock (&test_fw_mutex); + ret =__test_dev_config_update_u8 (buf, size, cfg); +mutex_unlock (&test_fw_mutex); + +return ret; +} +static ssize_t test_dev_config_show_u8 (char *buf,u8 val) {return snprintf (buf,PAGE_SIZE ,"%u\n" , val);
@@ -478,10 +496,10 @@ static ssize_t config_num_requests_store(struct device *dev,mutex_unlock (&test_fw_mutex); goto out; } -mutex_unlock (&test_fw_mutex); - rc =test_dev_config_update_u8 (buf, count, - &test_fw_config->num_requests); + rc =__test_dev_config_update_u8 (buf, count, + &test_fw_config->num_requests); +mutex_unlock (&test_fw_mutex); out:return rc;
@@ -525,10 +543,10 @@ static ssize_t config_buf_size_store(struct device *dev,mutex_unlock (&test_fw_mutex); goto out; } -mutex_unlock (&test_fw_mutex); - rc =test_dev_config_update_size_t (buf, count, - &test_fw_config->buf_size); + rc =__test_dev_config_update_size_t (buf, count, + &test_fw_config->buf_size); +mutex_unlock (&test_fw_mutex); out:return rc;
@@ -555,10 +573,10 @@ static ssize_t config_file_offset_store(struct device *dev,mutex_unlock (&test_fw_mutex); goto out; } -mutex_unlock (&test_fw_mutex); - rc =test_dev_config_update_size_t (buf, count, - &test_fw_config->file_offset); + rc =__test_dev_config_update_size_t (buf, count, + &test_fw_config->file_offset); +mutex_unlock (&test_fw_mutex); out:return rc;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 4/166 cgroup: bpf: use cgroup_lock()/cgroup_unlock() wrappers
In reply to Greg Kroah-HartmanFrom: Kamalesh Babulal <[email protected]>
[ Upstream commit 4cdb91b0dea7d7f59fa84a13c7753cd434fdedcf ]
Replace mutex_[un]lock() with cgroup_[un]lock() wrappers to stay consistent across cgroup core and other subsystem code, while operating on the cgroup_mutex.
Stable-dep-of: 2bd110339288 ("cgroup: always put cset in cgroup_css_set_put_fork")
--- kernel/bpf/cgroup.c | 38 ++++++++++++------------ kernel/bpf/cgroup_iter.c | 4 +-- kernel/bpf/local_storage.c | 4 +-- kernel/cgroup/cgroup-v1.c | 16 +++++----- kernel/cgroup/cgroup.c | 60 +++++++++++++++++++------------------- 5 files changed, 61 insertions(+), 61 deletions(-)
kernel/bpf/cgroup.c +19 -19
@@ -173,11 +173,11 @@ void bpf_cgroup_atype_put(int cgroup_atype) {int i = cgroup_atype -CGROUP_LSM_START ; -mutex_lock (&cgroup_mutex); +cgroup_lock ();if (--cgroup_lsm_atype[i].refcnt <=0 ) cgroup_lsm_atype[i].attach_btf_id =0 ;WARN_ON_ONCE (cgroup_lsm_atype[i].refcnt <0 ); -mutex_unlock (&cgroup_mutex); +cgroup_unlock (); }#else static enum cgroup_bpf_attach_type
@@ -282,7 +282,7 @@ static void cgroup_bpf_release(struct work_struct *work)unsigned int atype; -mutex_lock (&cgroup_mutex); +cgroup_lock ();for (atype =0 ; atype <ARRAY_SIZE (cgrp->bpf.progs); atype++) {struct hlist_head *progs = &cgrp->bpf.progs[atype];
@@ -315,7 +315,7 @@ static void cgroup_bpf_release(struct work_struct *work)bpf_cgroup_storage_free (storage); } -mutex_unlock (&cgroup_mutex); +cgroup_unlock ();for (p =cgroup_parent (cgrp); p; p =cgroup_parent (p))cgroup_bpf_put (p);
@@ -729,9 +729,9 @@ static int cgroup_bpf_attach(struct cgroup *cgrp, {int ret; -mutex_lock (&cgroup_mutex); +cgroup_lock (); ret =__cgroup_bpf_attach (cgrp, prog, replace_prog, link, type, flags); -mutex_unlock (&cgroup_mutex); +cgroup_unlock ();return ret; }
@@ -831,7 +831,7 @@ static int cgroup_bpf_replace(struct bpf_link *link, struct bpf_prog *new_prog, cg_link = container_of(link, struct bpf_cgroup_link, link); -mutex_lock (&cgroup_mutex); +cgroup_lock ();/* link might have been auto-released by dying cgroup, so fail */ if (!cg_link->cgroup) { ret = -ENOLINK ;
@@ -843,7 +843,7 @@ static int cgroup_bpf_replace(struct bpf_link *link, struct bpf_prog *new_prog, } ret =__cgroup_bpf_replace (cg_link->cgroup, cg_link, new_prog); out_unlock: -mutex_unlock (&cgroup_mutex); +cgroup_unlock ();return ret; }
@@ -1009,9 +1009,9 @@ static int cgroup_bpf_detach(struct cgroup *cgrp, struct bpf_prog *prog, {int ret; -mutex_lock (&cgroup_mutex); +cgroup_lock (); ret =__cgroup_bpf_detach (cgrp, prog,NULL , type); -mutex_unlock (&cgroup_mutex); +cgroup_unlock ();return ret; }
@@ -1120,9 +1120,9 @@ static int cgroup_bpf_query(struct cgroup *cgrp, const union bpf_attr *attr, {int ret; -mutex_lock (&cgroup_mutex); +cgroup_lock (); ret =__cgroup_bpf_query (cgrp, attr, uattr); -mutex_unlock (&cgroup_mutex); +cgroup_unlock ();return ret; }
@@ -1189,11 +1189,11 @@ static void bpf_cgroup_link_release(struct bpf_link *link)if (!cg_link->cgroup)return ; -mutex_lock (&cgroup_mutex); +cgroup_lock ();/* re-check cgroup under lock again */ if (!cg_link->cgroup) { -mutex_unlock (&cgroup_mutex); +cgroup_unlock ();return ; }
@@ -1205,7 +1205,7 @@ static void bpf_cgroup_link_release(struct bpf_link *link) cg = cg_link->cgroup; cg_link->cgroup =NULL ; -mutex_unlock (&cgroup_mutex); +cgroup_unlock ();cgroup_put (cg); }
@@ -1232,10 +1232,10 @@ static void bpf_cgroup_link_show_fdinfo(const struct bpf_link *link, container_of(link, struct bpf_cgroup_link, link);u64 cg_id =0 ; -mutex_lock (&cgroup_mutex); +cgroup_lock ();if (cg_link->cgroup) cg_id =cgroup_id (cg_link->cgroup); -mutex_unlock (&cgroup_mutex); +cgroup_unlock ();seq_printf (seq, "cgroup_id:\t%llu\n"
@@ -1251,10 +1251,10 @@ static int bpf_cgroup_link_fill_link_info(const struct bpf_link *link, container_of(link, struct bpf_cgroup_link, link);u64 cg_id =0 ; -mutex_lock (&cgroup_mutex); +cgroup_lock ();if (cg_link->cgroup) cg_id =cgroup_id (cg_link->cgroup); -mutex_unlock (&cgroup_mutex); +cgroup_unlock (); info->cgroup.cgroup_id = cg_id; info->cgroup.attach_type = cg_link->type;
kernel/bpf/cgroup_iter.c +2 -2
@@ -58,7 +58,7 @@ static void *cgroup_iter_seq_start(struct seq_file *seq, loff_t *pos) {struct cgroup_iter_priv *p = seq->private; -mutex_lock (&cgroup_mutex); +cgroup_lock ();/* cgroup_iter doesn't support read across multiple sessions. */ if (*pos >0 ) {
@@ -89,7 +89,7 @@ static void cgroup_iter_seq_stop(struct seq_file *seq, void *v) {struct cgroup_iter_priv *p = seq->private; -mutex_unlock (&cgroup_mutex); +cgroup_unlock ();/* pass NULL to the prog for post-processing */ if (!v) {
kernel/bpf/local_storage.c +2 -2
@@ -333,14 +333,14 @@ static void cgroup_storage_map_free(struct bpf_map *_map)struct list_head *storages = &map->list;struct bpf_cgroup_storage *storage, *stmp; -mutex_lock (&cgroup_mutex); +cgroup_lock ();list_for_each_entry_safe (storage, stmp, storages, list_map) {bpf_cgroup_storage_unlink (storage);bpf_cgroup_storage_free (storage); } -mutex_unlock (&cgroup_mutex); +cgroup_unlock ();WARN_ON (!RB_EMPTY_ROOT (&map->root));WARN_ON (!list_empty (&map->list));
kernel/cgroup/cgroup-v1.c +8 -8
@@ -58,7 +58,7 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk)struct cgroup_root *root;int retval =0 ; -mutex_lock (&cgroup_mutex); +cgroup_lock ();cgroup_attach_lock (true);for_each_root (root) {struct cgroup *from_cgrp;
@@ -72,7 +72,7 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk)break ; }cgroup_attach_unlock (true); -mutex_unlock (&cgroup_mutex); +cgroup_unlock ();return retval; }
@@ -106,7 +106,7 @@ int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from)if (ret)return ret; -mutex_lock (&cgroup_mutex); +cgroup_lock ();percpu_down_write (&cgroup_threadgroup_rwsem);
@@ -145,7 +145,7 @@ int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from) out_err:cgroup_migrate_finish (&mgctx);percpu_up_write (&cgroup_threadgroup_rwsem); -mutex_unlock (&cgroup_mutex); +cgroup_unlock ();return ret; }
@@ -847,13 +847,13 @@ static int cgroup1_rename(struct kernfs_node *kn, struct kernfs_node *new_parentkernfs_break_active_protection (new_parent);kernfs_break_active_protection (kn); -mutex_lock (&cgroup_mutex); +cgroup_lock (); ret =kernfs_rename (kn, new_parent, new_name_str);if (!ret)TRACE_CGROUP_PATH (rename, cgrp); -mutex_unlock (&cgroup_mutex); +cgroup_unlock ();kernfs_unbreak_active_protection (kn);kernfs_unbreak_active_protection (new_parent);
@@ -1119,7 +1119,7 @@ int cgroup1_reconfigure(struct fs_context *fc)trace_cgroup_remount (root); out_unlock: -mutex_unlock (&cgroup_mutex); +cgroup_unlock ();return ret; }
@@ -1246,7 +1246,7 @@ int cgroup1_get_tree(struct fs_context *fc)if (!ret && !percpu_ref_tryget_live (&ctx->root->cgrp.self.refcnt)) ret =1 ;/* restart */ -mutex_unlock (&cgroup_mutex); +cgroup_unlock ();if (!ret) ret =cgroup_do_get_tree (fc);
kernel/cgroup/cgroup.c +30 -30
228 lines not on this page · raw message
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 5/166 cgroup: always put cset in cgroup_css_set_put_fork
In reply to Greg Kroah-HartmanFrom: John Sperbeck <[email protected]>
[ Upstream commit 2bd110339288c18823dcace602b63b0d8627e520 ]
A successful call to cgroup_css_set_fork() will always have taken a ref on kargs->cset (regardless of CLONE_INTO_CGROUP), so always do a corresponding put in cgroup_css_set_put_fork().
Without this, a cset and its contained css structures will be leaked for some fork failures. The following script reproduces the leak for a fork failure due to exceeding pids.max in the pids controller. A similar thing can happen if we jump to the bad_fork_cancel_cgroup label in copy_process().
[ -z "$1" ] && echo "Usage $0 pids-root" && exit 1 PID_ROOT=$1
CGROUP=$PID_ROOT/foo
[ -e $CGROUP ] && rmdir -f $CGROUP
mkdir $CGROUP
echo 5 > $CGROUP/pids.max
echo $$ > $CGROUP/cgroup.procs
fork_bomb()
{
set -e
for i in $(seq 10); do
/bin/sleep 3600 &
done
}(fork_bomb) &
wait
echo $$ > $PID_ROOT/cgroup.procs
kill $(cat $CGROUP/cgroup.procs)
rmdir $CGROUP
--- kernel/cgroup/cgroup.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-)
kernel/cgroup/cgroup.c +8 -9
@@ -6471,19 +6471,18 @@ static int cgroup_css_set_fork(struct kernel_clone_args *kargs)static void cgroup_css_set_put_fork (struct kernel_clone_args *kargs) __releases(&cgroup_threadgroup_rwsem) __releases(&cgroup_mutex) { +struct cgroup *cgrp = kargs->cgrp; +struct css_set *cset = kargs->cset; +cgroup_threadgroup_change_end (current); -if (kargs->flags &CLONE_INTO_CGROUP ) { -struct cgroup *cgrp = kargs->cgrp; -struct css_set *cset = kargs->cset; +if (cset) { +put_css_set (cset); + kargs->cset =NULL ; + } +if (kargs->flags &CLONE_INTO_CGROUP ) {cgroup_unlock (); - -if (cset) { -put_css_set (cset); - kargs->cset =NULL ; - } -if (cgrp) {cgroup_put (cgrp); kargs->cgrp =NULL ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 6/166 cgroup: fix missing cpus_read_{lock,unlock}() in cgroup_transfer_tasks()
In reply to Greg Kroah-HartmanFrom: Qi Zheng <[email protected]>
[ Upstream commit ab1de7ead871ebe6d12a774c3c25de0388cde082 ]
The commit 4f7e7236435c ("cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock") fixed the deadlock between cgroup_threadgroup_rwsem and cpus_read_lock() by introducing cgroup_attach_{lock,unlock}() and removing cpus_read_{lock,unlock}() from cpuset_attach(). But cgroup_transfer_tasks() was missed and not handled, which will cause th following warning:
WARNING: CPU: 0 PID: 589 at kernel/cpu.c:526 lockdep_assert_cpus_held+0x32/0x40 CPU: 0 PID: 589 Comm: kworker/1:4 Not tainted 6.4.0-rc2-next-20230517 #50 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 Workqueue: events cpuset_hotplug_workfn RIP: 0010:lockdep_assert_cpus_held+0x32/0x40 <...> Call Trace: <TASK> cpuset_attach+0x40/0x240 cgroup_migrate_execute+0x452/0x5e0 ? _raw_spin_unlock_irq+0x28/0x40 cgroup_transfer_tasks+0x1f3/0x360 ? find_held_lock+0x32/0x90 ? cpuset_hotplug_workfn+0xc81/0xed0 cpuset_hotplug_workfn+0xcb1/0xed0 ? process_one_work+0x248/0x5b0 process_one_work+0x2b9/0x5b0 worker_thread+0x56/0x3b0 ? process_one_work+0x5b0/0x5b0 kthread+0xf1/0x120 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 </TASK>
So just use the cgroup_attach_{lock,unlock}() helper to fix it.
--- kernel/cgroup/cgroup-v1.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/cgroup/cgroup-v1.c +2 -2
@@ -108,7 +108,7 @@ int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from)cgroup_lock (); -percpu_down_write (&cgroup_threadgroup_rwsem); +cgroup_attach_lock (true);/* all tasks in @from are being moved, all csets are source */ spin_lock_irq (&css_set_lock);
@@ -144,7 +144,7 @@ int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from) }while (task && !ret); out_err:cgroup_migrate_finish (&mgctx); -percpu_up_write (&cgroup_threadgroup_rwsem); +cgroup_attach_unlock (true);cgroup_unlock ();return ret; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 7/166 qcom: llcc/edac: Fix the base address used for accessing LLCC banks
In reply to Greg Kroah-HartmanFrom: Manivannan Sadhasivam <[email protected]>
[ Upstream commit ee13b5008707948d3052c1b5aab485c6cd53658e ]
The Qualcomm LLCC/EDAC drivers were using a fixed register stride for accessing the (Control and Status Registers) CSRs of each LLCC bank. This stride only works for some SoCs like SDM845 for which driver support was initially added.
But the later SoCs use different register stride that vary between the banks with holes in-between. So it is not possible to use a single register stride for accessing the CSRs of each bank. By doing so could result in a crash.
For fixing this issue, let's obtain the base address of each LLCC bank from devicetree and get rid of the fixed stride. This also means, there is no need to rely on reg-names property and the base addresses can be obtained using the index.
First index is LLCC bank 0 and last index is LLCC broadcast. If the SoC supports more than one bank, then those need to be defined in devicetree for index from 1..N-1.
Stable-dep-of: cbd77119b635 ("EDAC/qcom: Get rid of hardcoded register offsets")
--- drivers/edac/qcom_edac.c | 14 +++--- drivers/soc/qcom/llcc-qcom.c | 72 +++++++++++++++++------------- include/linux/soc/qcom/llcc-qcom.h | 6 +-- 3 files changed, 48 insertions(+), 44 deletions(-)
drivers/edac/qcom_edac.c +5 -9
@@ -215,7 +215,7 @@ dump_syn_reg_values(struct llcc_drv_data *drv, u32 bank, int err_type)for (i =0 ; i < reg_data.reg_cnt; i++) { synd_reg = reg_data.synd_reg + (i *4 ); - ret =regmap_read (drv->regmap, drv->offsets[bank] + synd_reg, + ret =regmap_read (drv->regmaps[bank], synd_reg, &synd_val);if (ret) goto clear;
@@ -224,8 +224,7 @@ dump_syn_reg_values(struct llcc_drv_data *drv, u32 bank, int err_type) reg_data.name, i, synd_val); } - ret =regmap_read (drv->regmap, - drv->offsets[bank] + reg_data.count_status_reg, + ret =regmap_read (drv->regmaps[bank], reg_data.count_status_reg, &err_cnt);if (ret) goto clear;
@@ -235,8 +234,7 @@ dump_syn_reg_values(struct llcc_drv_data *drv, u32 bank, int err_type)edac_printk (KERN_CRIT ,EDAC_LLCC ,"%s: Error count: 0x%4x\n" , reg_data.name, err_cnt); - ret =regmap_read (drv->regmap, - drv->offsets[bank] + reg_data.ways_status_reg, + ret =regmap_read (drv->regmaps[bank], reg_data.ways_status_reg, &err_ways);if (ret) goto clear;
@@ -297,8 +295,7 @@ static irqreturn_t llcc_ecc_irq_handler(int irq, void *edev_ctl)/* Iterate over the banks and look for Tag RAM or Data RAM errors */ for (i =0 ; i < drv->num_banks; i++) { - ret =regmap_read (drv->regmap, - drv->offsets[i] +DRP_INTERRUPT_STATUS , + ret =regmap_read (drv->regmaps[i],DRP_INTERRUPT_STATUS , &drp_error);if (!ret && (drp_error &SB_ECC_ERROR )) {
@@ -313,8 +310,7 @@ static irqreturn_t llcc_ecc_irq_handler(int irq, void *edev_ctl)if (!ret) irq_rc =IRQ_HANDLED ; - ret =regmap_read (drv->regmap, - drv->offsets[i] +TRP_INTERRUPT_0_STATUS , + ret =regmap_read (drv->regmaps[i],TRP_INTERRUPT_0_STATUS , &trp_error);if (!ret && (trp_error &SB_ECC_ERROR )) {
drivers/soc/qcom/llcc-qcom.c +41 -31
122 lines not on this page · raw message
include/linux/soc/qcom/llcc-qcom.h +2 -4
@@ -108,7 +108,7 @@ struct llcc_edac_reg_offset {/** * struct llcc_drv_data - Data associated with the llcc driver -* @regmap: regmap associated with the llcc device +* @regmaps: regmaps associated with the llcc device * @bcast_regmap: regmap associated with llcc broadcast offset * @cfg: pointer to the data structure for slice configuration * @edac_reg_offset: Offset of the LLCC EDAC registers
@@ -117,12 +117,11 @@ struct llcc_edac_reg_offset {* @max_slices: max slices as read from device tree * @num_banks: Number of llcc banks * @bitmap: Bit map to track the active slice ids -* @offsets: Pointer to the bank offsets array * @ecc_irq: interrupt for llcc cache error detection and reporting * @version: Indicates the LLCC version */ struct llcc_drv_data { -struct regmap *regmap; +struct regmap **regmaps;struct regmap *bcast_regmap;const struct llcc_slice_config *cfg;const struct llcc_edac_reg_offset *edac_reg_offset;
@@ -131,7 +130,6 @@ struct llcc_drv_data {u32 max_slices;u32 num_banks;unsigned long *bitmap; -u32 *offsets;int ecc_irq;u32 version; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 8/166 EDAC/qcom: Get rid of hardcoded register offsets
In reply to Greg Kroah-HartmanFrom: Manivannan Sadhasivam <[email protected]>
[ Upstream commit cbd77119b6355872cd308a60e99f9ca678435d15 ]
The LLCC EDAC register offsets varies between each SoC. Hardcoding the register offsets won't work and will often result in crash due to accessing the wrong locations.
Hence, get the register offsets from the LLCC driver matching the individual SoCs.
--- drivers/edac/qcom_edac.c | 116 ++++++++++++++--------------- include/linux/soc/qcom/llcc-qcom.h | 6 -- 2 files changed, 58 insertions(+), 64 deletions(-)
drivers/edac/qcom_edac.c +58 -58
@@ -21,30 +21,9 @@#define TRP_SYN_REG_CNT 6#define DRP_SYN_REG_CNT 8 -#define LLCC_COMMON_STATUS0 0x0003000c#define LLCC_LB_CNT_MASK GENMASK(31, 28)#define LLCC_LB_CNT_SHIFT 28 -/* Single & double bit syndrome register offsets */ -#define TRP_ECC_SB_ERR_SYN0 0x0002304c -#define TRP_ECC_DB_ERR_SYN0 0x00020370 -#define DRP_ECC_SB_ERR_SYN0 0x0004204c -#define DRP_ECC_DB_ERR_SYN0 0x00042070 - -/* Error register offsets */ -#define TRP_ECC_ERROR_STATUS1 0x00020348 -#define TRP_ECC_ERROR_STATUS0 0x00020344 -#define DRP_ECC_ERROR_STATUS1 0x00042048 -#define DRP_ECC_ERROR_STATUS0 0x00042044 - -/* TRP, DRP interrupt register offsets */ -#define DRP_INTERRUPT_STATUS 0x00041000 -#define TRP_INTERRUPT_0_STATUS 0x00020480 -#define DRP_INTERRUPT_CLEAR 0x00041008 -#define DRP_ECC_ERROR_CNTR_CLEAR 0x00040004 -#define TRP_INTERRUPT_0_CLEAR 0x00020484 -#define TRP_ECC_ERROR_CNTR_CLEAR 0x00020440 -/* Mask and shift macros */ #define ECC_DB_ERR_COUNT_MASK GENMASK(4, 0)#define ECC_DB_ERR_WAYS_MASK GENMASK(31, 16)
@@ -60,15 +39,6 @@#define DRP_TRP_INT_CLEAR GENMASK(1, 0)#define DRP_TRP_CNT_CLEAR GENMASK(1, 0) -/* Config registers offsets*/ -#define DRP_ECC_ERROR_CFG 0x00040000 - -/* Tag RAM, Data RAM interrupt register offsets */ -#define CMN_INTERRUPT_0_ENABLE 0x0003001c -#define CMN_INTERRUPT_2_ENABLE 0x0003003c -#define TRP_INTERRUPT_0_ENABLE 0x00020488 -#define DRP_INTERRUPT_ENABLE 0x0004100c -#define SB_ERROR_THRESHOLD 0x1#define SB_ERROR_THRESHOLD_SHIFT 24#define SB_DB_TRP_INTERRUPT_ENABLE 0x3
@@ -88,9 +58,6 @@ enum {static const struct llcc_edac_reg_data edac_reg_data[] = { [LLCC_DRAM_CE ] = { .name ="DRAM Single-bit" , - .synd_reg =DRP_ECC_SB_ERR_SYN0 , - .count_status_reg =DRP_ECC_ERROR_STATUS1 , - .ways_status_reg =DRP_ECC_ERROR_STATUS0 , .reg_cnt =DRP_SYN_REG_CNT , .count_mask =ECC_SB_ERR_COUNT_MASK , .ways_mask =ECC_SB_ERR_WAYS_MASK ,
@@ -98,9 +65,6 @@ static const struct llcc_edac_reg_data edac_reg_data[] = { }, [LLCC_DRAM_UE] = { .name = "DRAM Double-bit", - .synd_reg = DRP_ECC_DB_ERR_SYN0, - .count_status_reg = DRP_ECC_ERROR_STATUS1, - .ways_status_reg = DRP_ECC_ERROR_STATUS0, .reg_cnt = DRP_SYN_REG_CNT, .count_mask = ECC_DB_ERR_COUNT_MASK, .ways_mask = ECC_DB_ERR_WAYS_MASK,
@@ -108,9 +72,6 @@ static const struct llcc_edac_reg_data edac_reg_data[] = { }, [LLCC_TRAM_CE] = { .name = "TRAM Single-bit", - .synd_reg = TRP_ECC_SB_ERR_SYN0, - .count_status_reg = TRP_ECC_ERROR_STATUS1, - .ways_status_reg = TRP_ECC_ERROR_STATUS0, .reg_cnt = TRP_SYN_REG_CNT, .count_mask = ECC_SB_ERR_COUNT_MASK, .ways_mask = ECC_SB_ERR_WAYS_MASK,
@@ -118,9 +79,6 @@ static const struct llcc_edac_reg_data edac_reg_data[] = { }, [LLCC_TRAM_UE] = { .name = "TRAM Double-bit", - .synd_reg = TRP_ECC_DB_ERR_SYN0, - .count_status_reg = TRP_ECC_ERROR_STATUS1, - .ways_status_reg = TRP_ECC_ERROR_STATUS0, .reg_cnt = TRP_SYN_REG_CNT, .count_mask = ECC_DB_ERR_COUNT_MASK, .ways_mask = ECC_DB_ERR_WAYS_MASK,
@@ -128,7 +86,7 @@ static const struct llcc_edac_reg_data edac_reg_data[] = { }, }; -static int qcom_llcc_core_setup (struct regmap *llcc_bcast_regmap) +static int qcom_llcc_core_setup (struct llcc_drv_data *drv,struct regmap *llcc_bcast_regmap) {u32 sb_err_threshold;int ret;
@@ -137,31 +95,31 @@ static int qcom_llcc_core_setup(struct regmap *llcc_bcast_regmap)* Configure interrupt enable registers such that Tag, Data RAM related * interrupts are propagated to interrupt controller for servicing */ - ret =regmap_update_bits (llcc_bcast_regmap,CMN_INTERRUPT_2_ENABLE , + ret =regmap_update_bits (llcc_bcast_regmap, drv->edac_reg_offset->cmn_interrupt_2_enable,TRP0_INTERRUPT_ENABLE ,TRP0_INTERRUPT_ENABLE );if (ret)return ret; - ret =regmap_update_bits (llcc_bcast_regmap,TRP_INTERRUPT_0_ENABLE , + ret =regmap_update_bits (llcc_bcast_regmap, drv->edac_reg_offset->trp_interrupt_0_enable,SB_DB_TRP_INTERRUPT_ENABLE ,SB_DB_TRP_INTERRUPT_ENABLE );if (ret)return ret; sb_err_threshold = (SB_ERROR_THRESHOLD <<SB_ERROR_THRESHOLD_SHIFT ); - ret =regmap_write (llcc_bcast_regmap,DRP_ECC_ERROR_CFG , + ret =regmap_write (llcc_bcast_regmap, drv->edac_reg_offset->drp_ecc_error_cfg, sb_err_threshold);if (ret)return ret; - ret =regmap_update_bits (llcc_bcast_regmap,CMN_INTERRUPT_2_ENABLE , + ret =regmap_update_bits (llcc_bcast_regmap, drv->edac_reg_offset->cmn_interrupt_2_enable,DRP0_INTERRUPT_ENABLE ,DRP0_INTERRUPT_ENABLE );if (ret)return ret; - ret =regmap_write (llcc_bcast_regmap,DRP_INTERRUPT_ENABLE , + ret =regmap_write (llcc_bcast_regmap, drv->edac_reg_offset->drp_interrupt_enable,SB_DB_DRP_INTERRUPT_ENABLE );return ret; }
@@ -175,24 +133,28 @@ qcom_llcc_clear_error_status(int err_type, struct llcc_drv_data *drv)switch (err_type) {case LLCC_DRAM_CE :case LLCC_DRAM_UE : - ret =regmap_write (drv->bcast_regmap,DRP_INTERRUPT_CLEAR , + ret =regmap_write (drv->bcast_regmap, + drv->edac_reg_offset->drp_interrupt_clear,DRP_TRP_INT_CLEAR );if (ret)return ret; - ret =regmap_write (drv->bcast_regmap,DRP_ECC_ERROR_CNTR_CLEAR , + ret =regmap_write (drv->bcast_regmap, + drv->edac_reg_offset->drp_ecc_error_cntr_clear,DRP_TRP_CNT_CLEAR );if (ret)return ret;break ;case LLCC_TRAM_CE :case LLCC_TRAM_UE : - ret =regmap_write (drv->bcast_regmap,TRP_INTERRUPT_0_CLEAR , + ret =regmap_write (drv->bcast_regmap, + drv->edac_reg_offset->trp_interrupt_0_clear,DRP_TRP_INT_CLEAR );if (ret)return ret; - ret =regmap_write (drv->bcast_regmap,TRP_ECC_ERROR_CNTR_CLEAR , + ret =regmap_write (drv->bcast_regmap, + drv->edac_reg_offset->trp_ecc_error_cntr_clear,DRP_TRP_CNT_CLEAR );if (ret)return ret;
@@ -205,16 +167,54 @@ qcom_llcc_clear_error_status(int err_type, struct llcc_drv_data *drv)return ret; } +struct qcom_llcc_syn_regs { +u32 synd_reg; +u32 count_status_reg; +u32 ways_status_reg; +}; + +static void get_reg_offsets (struct llcc_drv_data *drv,int err_type, +struct qcom_llcc_syn_regs *syn_regs) +{ +const struct llcc_edac_reg_offset *edac_reg_offset = drv->edac_reg_offset; + +switch (err_type) { +case LLCC_DRAM_CE : + syn_regs->synd_reg = edac_reg_offset->drp_ecc_sb_err_syn0; + syn_regs->count_status_reg = edac_reg_offset->drp_ecc_error_status1; + syn_regs->ways_status_reg = edac_reg_offset->drp_ecc_error_status0; +break ; +case LLCC_DRAM_UE : + syn_regs->synd_reg = edac_reg_offset->drp_ecc_db_err_syn0; + syn_regs->count_status_reg = edac_reg_offset->drp_ecc_error_status1; + syn_regs->ways_status_reg = edac_reg_offset->drp_ecc_error_status0; +break ; +case LLCC_TRAM_CE : + syn_regs->synd_reg = edac_reg_offset->trp_ecc_sb_err_syn0; + syn_regs->count_status_reg = edac_reg_offset->trp_ecc_error_status1; + syn_regs->ways_status_reg = edac_reg_offset->trp_ecc_error_status0; +break ; +case LLCC_TRAM_UE : + syn_regs->synd_reg = edac_reg_offset->trp_ecc_db_err_syn0; + syn_regs->count_status_reg = edac_reg_offset->trp_ecc_error_status1; + syn_regs->ways_status_reg = edac_reg_offset->trp_ecc_error_status0; +break ; + } +} +/* Dump Syndrome registers data for Tag RAM, Data RAM bit errors*/ static int dump_syn_reg_values (struct llcc_drv_data *drv,u32 bank,int err_type) {struct llcc_edac_reg_data reg_data = edac_reg_data[err_type]; +struct qcom_llcc_syn_regs regs = { };int err_cnt, err_ways, ret, i;u32 synd_reg, synd_val; +get_reg_offsets (drv, err_type, ®s); +for (i =0 ; i < reg_data.reg_cnt; i++) { - synd_reg = reg_data.synd_reg + (i *4 ); + synd_reg = regs.synd_reg + (i *4 ); ret =regmap_read (drv->regmaps[bank], synd_reg, &synd_val);if (ret)
@@ -224,7 +224,7 @@ dump_syn_reg_values(struct llcc_drv_data *drv, u32 bank, int err_type) reg_data.name, i, synd_val); } - ret =regmap_read (drv->regmaps[bank], reg_data.count_status_reg, + ret =regmap_read (drv->regmaps[bank], regs.count_status_reg, &err_cnt);if (ret) goto clear;
@@ -234,7 +234,7 @@ dump_syn_reg_values(struct llcc_drv_data *drv, u32 bank, int err_type)edac_printk (KERN_CRIT ,EDAC_LLCC ,"%s: Error count: 0x%4x\n" , reg_data.name, err_cnt); - ret =regmap_read (drv->regmaps[bank], reg_data.ways_status_reg, + ret =regmap_read (drv->regmaps[bank], regs.ways_status_reg, &err_ways);if (ret) goto clear;
@@ -295,7 +295,7 @@ static irqreturn_t llcc_ecc_irq_handler(int irq, void *edev_ctl)/* Iterate over the banks and look for Tag RAM or Data RAM errors */ for (i =0 ; i < drv->num_banks; i++) { - ret =regmap_read (drv->regmaps[i],DRP_INTERRUPT_STATUS , + ret =regmap_read (drv->regmaps[i], drv->edac_reg_offset->drp_interrupt_status, &drp_error);if (!ret && (drp_error &SB_ECC_ERROR )) {
@@ -310,7 +310,7 @@ static irqreturn_t llcc_ecc_irq_handler(int irq, void *edev_ctl)if (!ret) irq_rc =IRQ_HANDLED ; - ret =regmap_read (drv->regmaps[i],TRP_INTERRUPT_0_STATUS , + ret =regmap_read (drv->regmaps[i], drv->edac_reg_offset->trp_interrupt_0_status, &trp_error);if (!ret && (trp_error &SB_ECC_ERROR )) {
@@ -342,7 +342,7 @@ static int qcom_llcc_edac_probe(struct platform_device *pdev)int ecc_irq;int rc; - rc =qcom_llcc_core_setup (llcc_driv_data->bcast_regmap); + rc =qcom_llcc_core_setup (llcc_driv_data, llcc_driv_data->bcast_regmap);if (rc)return rc;
include/linux/soc/qcom/llcc-qcom.h +0 -6
@@ -57,9 +57,6 @@ struct llcc_slice_desc {/** * struct llcc_edac_reg_data - llcc edac registers data for each error type * @name: Name of the error -* @synd_reg: Syndrome register address -* @count_status_reg: Status register address to read the error count -* @ways_status_reg: Status register address to read the error ways * @reg_cnt: Number of registers * @count_mask: Mask value to get the error count * @ways_mask: Mask value to get the error ways
@@ -68,9 +65,6 @@ struct llcc_slice_desc {*/ struct llcc_edac_reg_data {char *name; -u64 synd_reg; -u64 count_status_reg; -u64 ways_status_reg;u32 reg_cnt;u32 count_mask;u32 ways_mask;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 9/166 ksmbd: validate smb request protocol id
In reply to Greg Kroah-HartmanFrom: Namjae Jeon <[email protected]>
[ Upstream commit 1c1bcf2d3ea061613119b534f57507c377df20f9 ]
This patch add the validation for smb request protocol id. If it is not one of the four ids(SMB1_PROTO_NUMBER, SMB2_PROTO_NUMBER, SMB2_TRANSFORM_PROTO_NUM, SMB2_COMPRESSION_TRANSFORM_ID), don't allow processing the request. And this will fix the following KASAN warning also.
[ 13.905265] BUG: KASAN: slab-out-of-bounds in init_smb2_rsp_hdr+0x1b9/0x1f0 [ 13.905900] Read of size 16 at addr ffff888005fd2f34 by task kworker/0:2/44 ... [ 13.908553] Call Trace: [ 13.908793] <TASK> [ 13.908995] dump_stack_lvl+0x33/0x50 [ 13.909369] print_report+0xcc/0x620 [ 13.910870] kasan_report+0xae/0xe0 [ 13.911519] kasan_check_range+0x35/0x1b0 [ 13.911796] init_smb2_rsp_hdr+0x1b9/0x1f0 [ 13.912492] handle_ksmbd_work+0xe5/0x820
--- fs/ksmbd/connection.c | 5 +++-- fs/ksmbd/smb_common.c | 14 +++++++++++++- 2 files changed, 16 insertions(+), 3 deletions(-)
fs/ksmbd/connection.c +3 -2
@@ -366,8 +366,6 @@ int ksmbd_conn_handler_loop(void *p)break ;memcpy (conn->request_buf, hdr_buf,sizeof (hdr_buf)); -if (!ksmbd_smb_request (conn)) -break ;/* * We already read 4 bytes to find out PDU size, now
@@ -385,6 +383,9 @@ int ksmbd_conn_handler_loop(void *p)continue ; } +if (!ksmbd_smb_request (conn)) +break ; +if (((struct smb2_hdr *)smb2_get_msg (conn->request_buf))->ProtocolId ==SMB2_PROTO_NUMBER ) {if (pdu_size <SMB2_MIN_SUPPORTED_HEADER_SIZE )
fs/ksmbd/smb_common.c +13 -1
@@ -158,7 +158,19 @@ int ksmbd_verify_smb_message(struct ksmbd_work *work)*/ bool ksmbd_smb_request (struct ksmbd_conn *conn) { -return conn->request_buf[0 ] ==0 ; +__le32 *proto = (__le32 *)smb2_get_msg (conn->request_buf); + +if (*proto ==SMB2_COMPRESSION_TRANSFORM_ID ) { +pr_err_ratelimited ("smb2 compression not support yet" ); +return false; + } + +if (*proto !=SMB1_PROTO_NUMBER && + *proto !=SMB2_PROTO_NUMBER && + *proto !=SMB2_TRANSFORM_PROTO_NUM ) +return false; + +return true; }static bool supported_protocol (int idx)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 10/166 of: overlay: Fix missing of_node_put() in error case of init_overlay_changeset()
In reply to Greg Kroah-HartmanFrom: Kunihiko Hayashi <[email protected]>
[ Upstream commit 39affd1fdf65983904fafc07cf607cff737eaf30 ]
In init_overlay_changeset(), the variable "node" is from of_get_child_by_name(), and the "node" should be discarded in error case.
--- drivers/of/overlay.c | 1 + 1 file changed, 1 insertion(+)
drivers/of/overlay.c +1 -0
@@ -811,6 +811,7 @@ static int init_overlay_changeset(struct overlay_changeset *ovcs)if (!fragment->target) {pr_err ("symbols in overlay, but not in live tree\n" ); ret = -EINVAL ; +of_node_put (node); goto err_out; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 11/166 power: supply: ab8500: Fix external_power_changed race
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit a5299ce4e96f3e8930e9c051b28d8093ada87b08 ]
ab8500_btemp_external_power_changed() dereferences di->btemp_psy, which gets sets in ab8500_btemp_probe() like this:
di->btemp_psy = devm_power_supply_register(dev, &ab8500_btemp_desc,
&psy_cfg);As soon as devm_power_supply_register() has called device_add() the external_power_changed callback can get called. So there is a window where ab8500_btemp_external_power_changed() may get called while di->btemp_psy has not been set yet leading to a NULL pointer dereference.
Fixing this is easy. The external_power_changed callback gets passed the power_supply which will eventually get stored in di->btemp_psy, so ab8500_btemp_external_power_changed() can simply directly use the passed in psy argument which is always valid.
And the same applies to ab8500_fg_external_power_changed().
--- drivers/power/supply/ab8500_btemp.c | 6 ++---- drivers/power/supply/ab8500_fg.c | 6 ++---- 2 files changed, 4 insertions(+), 8 deletions(-)
drivers/power/supply/ab8500_btemp.c +2 -4
@@ -624,10 +624,8 @@ static int ab8500_btemp_get_ext_psy_data(struct device *dev, void *data)*/ static void ab8500_btemp_external_power_changed (struct power_supply *psy) { -struct ab8500_btemp *di =power_supply_get_drvdata (psy); - -class_for_each_device (power_supply_class,NULL , - di->btemp_psy, ab8500_btemp_get_ext_psy_data); +class_for_each_device (power_supply_class,NULL , psy, + ab8500_btemp_get_ext_psy_data); }/* ab8500 btemp driver interrupts and their respective isr */
drivers/power/supply/ab8500_fg.c +2 -4
@@ -2407,10 +2407,8 @@ static int ab8500_fg_init_hw_registers(struct ab8500_fg *di)*/ static void ab8500_fg_external_power_changed (struct power_supply *psy) { -struct ab8500_fg *di =power_supply_get_drvdata (psy); - -class_for_each_device (power_supply_class,NULL , - di->fg_psy, ab8500_fg_get_ext_psy_data); +class_for_each_device (power_supply_class,NULL , psy, + ab8500_fg_get_ext_psy_data); }/**
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 12/166 power: supply: sc27xx: Fix external_power_changed race
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 4d5c129d6c8993fe96e9ae712141eedcb9ca68c2 ]
sc27xx_fgu_external_power_changed() dereferences data->battery, which gets sets in ab8500_btemp_probe() like this:
data->battery = devm_power_supply_register(dev, &sc27xx_fgu_desc,
&fgu_cfg);As soon as devm_power_supply_register() has called device_add() the external_power_changed callback can get called. So there is a window where sc27xx_fgu_external_power_changed() may get called while data->battery has not been set yet leading to a NULL pointer dereference.
Fixing this is easy. The external_power_changed callback gets passed the power_supply which will eventually get stored in data->battery, so sc27xx_fgu_external_power_changed() can simply directly use the passed in psy argument which is always valid.
After this change sc27xx_fgu_external_power_changed() is reduced to just "power_supply_changed(psy);" and it has the same prototype. While at it simply replace it with making the external_power_changed callback directly point to power_supply_changed.
--- drivers/power/supply/sc27xx_fuel_gauge.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-)
drivers/power/supply/sc27xx_fuel_gauge.c +1 -8
@@ -733,13 +733,6 @@ static int sc27xx_fgu_set_property(struct power_supply *psy,return ret; } -static void sc27xx_fgu_external_power_changed (struct power_supply *psy) -{ -struct sc27xx_fgu_data *data =power_supply_get_drvdata (psy); - -power_supply_changed (data->battery); -} -static int sc27xx_fgu_property_is_writeable (struct power_supply *psy,enum power_supply_property psp) {
@@ -774,7 +767,7 @@ static const struct power_supply_desc sc27xx_fgu_desc = { .num_properties = ARRAY_SIZE(sc27xx_fgu_props), .get_property = sc27xx_fgu_get_property, .set_property = sc27xx_fgu_set_property, - .external_power_changed = sc27xx_fgu_external_power_changed, + .external_power_changed = power_supply_changed, .property_is_writeable = sc27xx_fgu_property_is_writeable, .no_thermal = true, };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 13/166 power: supply: bq27xxx: Use mod_delayed_work() instead of cancel() + schedule()
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 59dddea9879713423c7b2ade43c423bb71e0d216 ]
Use mod_delayed_work() instead of separate cancel_delayed_work_sync() + schedule_delayed_work() calls.
--- drivers/power/supply/bq27xxx_battery.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/power/supply/bq27xxx_battery.c +2 -4
@@ -1083,10 +1083,8 @@ static int poll_interval_param_set(const char *val, const struct kernel_param *kreturn ret;mutex_lock (&bq27xxx_list_lock); -list_for_each_entry (di, &bq27xxx_battery_devices, list) { -cancel_delayed_work_sync (&di->work); -schedule_delayed_work (&di->work,0 ); - } +list_for_each_entry (di, &bq27xxx_battery_devices, list) +mod_delayed_work (system_wq, &di->work,0 );mutex_unlock (&bq27xxx_list_lock);return ret;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 14/166 ARM: dts: vexpress: add missing cache properties
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 328acc5657c6197753238d7ce0a6924ead829347 ]
As all level 2 and level 3 caches are unified, add required cache-unified property to fix warnings like:
vexpress-v2p-ca5s.dtb: cache-controller@2c0f0000: 'cache-unified' is a required property
--- arch/arm/boot/dts/vexpress-v2p-ca5s.dts | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/dts/vexpress-v2p-ca5s.dts +1 -0
@@ -132,6 +132,7 @@ L2: cache-controller@2c0f0000 { reg = <0x2c0f0000 0x1000>; interrupts = <0 84 4>; cache-level = <2>; + cache-unified; }; pmu {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 15/166 tools: gpio: fix debounce_period_us output of lsgpio
In reply to Greg Kroah-HartmanFrom: Milo Spadacini <[email protected]>
[ Upstream commit eb4b8eca1bad98f4b8574558a74f041f9acb5a54 ]
Fix incorrect output that could occur when more attributes are used and GPIO_V2_LINE_ATTR_ID_DEBOUNCE is not the first one.
--- tools/gpio/lsgpio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/gpio/lsgpio.c +1 -1
@@ -94,7 +94,7 @@ static void print_attributes(struct gpio_v2_line_info *info)for (i =0 ; i < info->num_attrs; i++) {if (info->attrs[i].id ==GPIO_V2_LINE_ATTR_ID_DEBOUNCE )fprintf (stdout,", debounce_period=%dusec" , - info->attrs[0 ].debounce_period_us); + info->attrs[i].debounce_period_us); } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 16/166 selftests: gpio: gpio-sim: Fix BUG: test FAILED due to recent change
In reply to Greg Kroah-HartmanFrom: Mirsad Todorovac <[email protected]>
[ Upstream commit 976d3c6778e99390c6d854d140b746d12ea18a51 ]
According to Mirsad the gpio-sim.sh test appears to FAIL in a wrong way due to missing initialisation of shell variables:
4.2. Bias settings work correctly
cat: /sys/devices/platform/gpio-sim.0/gpiochip18/sim_gpio0/value: No such file or directory ./gpio-sim.sh: line 393: test: =: unary operator expected
bias setting does not work
GPIO gpio-sim test FAIL
After this change the test passed:
4.2. Bias settings work correctly
GPIO gpio-sim test PASS
His testing environment is AlmaLinux 8.7 on Lenovo desktop box with the latest Linux kernel based on v6.2:
Linux 6.2.0-mglru-kmlk-andy-09238-gd2980d8d8265 x86_64
--- tools/testing/selftests/gpio/gpio-sim.sh | 3 +++ 1 file changed, 3 insertions(+)
tools/testing/selftests/gpio/gpio-sim.sh +3 -0
@@ -389,6 +389,9 @@ create_chip chip create_bank chip bank set_num_lines chip bank 8 enable_chip chip +DEVNAME=`configfs_dev_name chip` +CHIPNAME=`configfs_chip_name chip bank` +SYSFS_PATH="/sys/devices/platform/$DEVNAME/$CHIPNAME/sim_gpio0/value" $BASE_DIR/gpio-mockup-cdev -b pull-up /dev/`configfs_chip_name chip bank` 0 test `cat $SYSFS_PATH` = "1" || fail "bias setting does not work" remove_chip chip
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 17/166 power: supply: Ratelimit no data debug output
In reply to Greg Kroah-HartmanFrom: Marek Vasut <[email protected]>
[ Upstream commit 155c45a25679f571c2ae57d10db843a9dfc63430 ]
Reduce the amount of output this dev_dbg() statement emits into logs, otherwise if system software polls the sysfs entry for data and keeps getting -ENODATA, it could end up filling the logs up.
This does in fact make systemd journald choke, since during boot the sysfs power supply entries are polled and if journald starts at the same time, the journal is just being repeatedly filled up, and the system stops on trying to start journald without booting any further.
--- drivers/power/supply/power_supply_sysfs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/power/supply/power_supply_sysfs.c +2 -1
@@ -285,7 +285,8 @@ static ssize_t power_supply_show_property(struct device *dev,if (ret <0 ) {if (ret == -ENODATA ) -dev_dbg (dev,"driver has no data for `%s' property\n" , +dev_dbg_ratelimited (dev, +"driver has no data for `%s' property\n" , attr->attr.name);else if (ret != -ENODEV && ret != -EAGAIN ) dev_err_ratelimited(dev,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 18/166 PCI/DPC: Quirk PIO log size for Intel Ice Lake Root Ports
In reply to Greg Kroah-HartmanFrom: Mika Westerberg <[email protected]>
[ Upstream commit 3b8803494a0612acdeee714cb72aa142b1e05ce5 ]
Commit 5459c0b70467 ("PCI/DPC: Quirk PIO log size for certain Intel Root Ports") added quirks for Tiger and Alder Lake Root Ports but missed that the same issue exists also in the previous generation, Ice Lake.
Apply the quirk for Ice Lake Root Ports as well. This prevents kernel complaints like:
DPC: RP PIO log size 0 is invalid
and also enables the DPC driver to dump the RP PIO Log registers when DPC is triggered.
--- drivers/pci/quirks.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/pci/quirks.c +7 -2
@@ -5995,8 +5995,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x56c1, aspm_l1_acceptable_latency#ifdef CONFIG_PCIE_DPC /* -* Intel Tiger Lake and Alder Lake BIOS has a bug that clears the DPC -* RP PIO Log Size of the integrated Thunderbolt PCIe Root Ports. +* Intel Ice Lake, Tiger Lake and Alder Lake BIOS has a bug that clears +* the DPC RP PIO Log Size of the integrated Thunderbolt PCIe Root +* Ports. */ static void dpc_log_size (struct pci_dev *dev) {
@@ -6019,6 +6020,10 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x461f, dpc_log_size);DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x462f , dpc_log_size);DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x463f , dpc_log_size);DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x466e , dpc_log_size); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x8a1d , dpc_log_size); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x8a1f , dpc_log_size); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x8a21 , dpc_log_size); +DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x8a23 , dpc_log_size);DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x9a23 , dpc_log_size);DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x9a25 , dpc_log_size);DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_INTEL ,0x9a27 , dpc_log_size);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 19/166 platform/x86: asus-wmi: Ignore WMI events with codes 0x7B, 0xC0
In reply to Greg Kroah-HartmanFrom: Alexandru Sorodoc <[email protected]>
[ Upstream commit 362c1f2ec82cb65940e1c73e15a395a7a891fc6f ]
On ASUS GU604V the key 0x7B is issued when the charger is connected or disconnected, and key 0xC0 is issued when an external display is connected or disconnected.
This commit maps them to KE_IGNORE to slience kernel messages about unknown keys, such as:
kernel: asus_wmi: Unknown key code 0x7b
--- drivers/platform/x86/asus-nb-wmi.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/platform/x86/asus-nb-wmi.c +2 -0
@@ -555,6 +555,7 @@ static const struct key_entry asus_nb_wmi_keymap[] = { { KE_KEY, 0x71, { KEY_F13 } }, /* General-purpose button */ { KE_IGNORE, 0x79, }, /* Charger type dectection notification */ { KE_KEY, 0x7a, { KEY_ALS_TOGGLE } }, /* Ambient Light Sensor Toggle */ + { KE_IGNORE, 0x7B, }, /* Charger connect/disconnect notification */ { KE_KEY, 0x7c, { KEY_MICMUTE } }, { KE_KEY, 0x7D, { KEY_BLUETOOTH } }, /* Bluetooth Enable */ { KE_KEY, 0x7E, { KEY_BLUETOOTH } }, /* Bluetooth Disable */
@@ -584,6 +585,7 @@ static const struct key_entry asus_nb_wmi_keymap[] = { { KE_KEY, 0xAE, { KEY_FN_F5 } }, /* Fn+F5 fan mode on 2020+ */ { KE_KEY, 0xB3, { KEY_PROG4 } }, /* AURA */ { KE_KEY, 0xB5, { KEY_CALC } }, + { KE_IGNORE, 0xC0, }, /* External display connect/disconnect notification */ { KE_KEY, 0xC4, { KEY_KBDILLUMUP } }, { KE_KEY, 0xC5, { KEY_KBDILLUMDOWN } }, { KE_IGNORE, 0xC6, }, /* Ambient Light Sensor notification */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 20/166 regulator: Fix error checking for debugfs_create_dir
In reply to Greg Kroah-HartmanFrom: Osama Muhammad <[email protected]>
[ Upstream commit 2bf1c45be3b8f3a3f898d0756c1282f09719debd ]
This patch fixes the error checking in core.c in debugfs_create_dir. The correct way to check if an error occurred is 'IS_ERR' inline function.
--- drivers/regulator/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/regulator/core.c +2 -2
@@ -5257,7 +5257,7 @@ static void rdev_init_debugfs(struct regulator_dev *rdev) } rdev->debugfs =debugfs_create_dir (rname, debugfs_root); -if (!rdev->debugfs) { +if (IS_ERR (rdev->debugfs)) {rdev_warn (rdev,"Failed to create debugfs directory\n" );return ; }
@@ -6179,7 +6179,7 @@ static int __init regulator_init(void) ret =class_register (®ulator_class); debugfs_root =debugfs_create_dir ("regulator" ,NULL ); -if (!debugfs_root) +if (IS_ERR (debugfs_root))pr_warn ("regulator: Failed to create debugfs directory\n" );#ifdef CONFIG_DEBUG_FS
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 21/166 irqchip/gic-v3: Disable pseudo NMIs on Mediatek devices w/ firmware issues
In reply to Greg Kroah-HartmanFrom: Douglas Anderson <[email protected]>
[ Upstream commit 44bd78dd2b8897f59b7e3963f088caadb7e4f047 ]
Some Chromebooks with Mediatek SoCs have a problem where the firmware doesn't properly save/restore certain GICR registers. Newer Chromebooks should fix this issue and we may be able to do firmware updates for old Chromebooks. At the moment, the only known issue with these Chromebooks is that we can't enable "pseudo NMIs" since the priority register can be lost. Enabling "pseudo NMIs" on Chromebooks with the problematic firmware causes crashes and freezes.
Let's detect devices with this problem and then disable "pseudo NMIs" on them. We'll detect the problem by looking for the presence of the "mediatek,broken-save-restore-fw" property in the GIC device tree node. Any devices with fixed firmware will not have this property.
Our detection plan works because we never bake a Chromebook's device tree into firmware. Instead, device trees are always bundled with the kernel. We'll update the device trees of all affected Chromebooks and then we'll never enable "pseudo NMI" on a kernel that is bundled with old device trees. When a firmware update is shipped that fixes this issue it will know to patch the device tree to remove the property.
In order to make this work, the quick detection mechanism of the GICv3 code is extended to be able to look for properties in addition to looking at "compatible".
--- drivers/irqchip/irq-gic-common.c | 8 ++++++-- drivers/irqchip/irq-gic-common.h | 1 + drivers/irqchip/irq-gic-v3.c | 20 ++++++++++++++++++++ 3 files changed, 27 insertions(+), 2 deletions(-)
drivers/irqchip/irq-gic-common.c +6 -2
@@ -16,7 +16,11 @@ void gic_enable_of_quirks(const struct device_node *np, const struct gic_quirk *quirks, void *data) {for (; quirks->desc; quirks++) { -if (!of_device_is_compatible (np, quirks->compatible)) +if (quirks->compatible && + !of_device_is_compatible (np, quirks->compatible)) +continue ; +if (quirks->property && + !of_property_read_bool (np, quirks->property))continue ;if (quirks->init (data)) pr_info("GIC: enabling workaround for %s\n",
@@ -28,7 +32,7 @@ void gic_enable_quirks(u32 iidr, const struct gic_quirk *quirks, void *data) {for (; quirks->desc; quirks++) { -if (quirks->compatible) +if (quirks->compatible || quirks->property)continue ;if (quirks->iidr != (quirks->mask & iidr))continue ;
drivers/irqchip/irq-gic-common.h +1 -0
@@ -13,6 +13,7 @@struct gic_quirk {const char *desc;const char *compatible; +const char *property;bool (*init)(void *data);u32 iidr;u32 mask;
drivers/irqchip/irq-gic-v3.c +20 -0
@@ -38,6 +38,7 @@#define FLAGS_WORKAROUND_GICR_WAKER_MSM8996 (1ULL << 0)#define FLAGS_WORKAROUND_CAVIUM_ERRATUM_38539 (1ULL << 1) +#define FLAGS_WORKAROUND_MTK_GICR_SAVE (1ULL << 2)#define GIC_IRQ_TYPE_PARTITION (GIC_IRQ_TYPE_LPI + 1)
@@ -1730,6 +1731,15 @@ static bool gic_enable_quirk_msm8996(void *data)return true; } +static bool gic_enable_quirk_mtk_gicr (void *data) +{ +struct gic_chip_data *d = data; + + d->flags |=FLAGS_WORKAROUND_MTK_GICR_SAVE ; + +return true; +} +static bool gic_enable_quirk_cavium_38539 (void *data) {struct gic_chip_data *d = data;
@@ -1802,6 +1812,11 @@ static const struct gic_quirk gic_quirks[] = { .compatible = "qcom,msm8996-gic-v3", .init = gic_enable_quirk_msm8996, }, + { + .desc = "GICv3: Mediatek Chromebook GICR save problem", + .property = "mediatek,broken-save-restore-fw", + .init = gic_enable_quirk_mtk_gicr, + }, { .desc = "GICv3: HIP06 erratum 161010803", .iidr = 0x0204043b,
@@ -1844,6 +1859,11 @@ static void gic_enable_nmi_support(void)if (!gic_prio_masking_enabled ())return ; +if (gic_data.flags &FLAGS_WORKAROUND_MTK_GICR_SAVE ) { +pr_warn ("Skipping NMI enable due to firmware issues\n" ); +return ; + } + ppi_nmi_refs =kcalloc (gic_data.ppi_nr,sizeof (*ppi_nmi_refs),GFP_KERNEL );if (!ppi_nmi_refs)return ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 22/166 irqchip/meson-gpio: Mark OF related data as maybe unused
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 14130211be5366a91ec07c3284c183b75d8fba17 ]
The driver can be compile tested with !CONFIG_OF making certain data unused:
drivers/irqchip/irq-meson-gpio.c:153:34: error: ‘meson_irq_gpio_matches’ defined but not used [-Werror=unused-const-variable=]
--- drivers/irqchip/irq-meson-gpio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/irqchip/irq-meson-gpio.c +1 -1
@@ -150,7 +150,7 @@ static const struct meson_gpio_irq_params s4_params = {INIT_MESON_S4_COMMON_DATA (82 ) }; -static const struct of_device_id meson_irq_gpio_matches[] = { +static const struct of_device_id meson_irq_gpio_matches[]__maybe_unused = { { .compatible ="amlogic,meson8-gpio-intc" , .data = &meson8_params }, { .compatible ="amlogic,meson8b-gpio-intc" , .data = &meson8b_params }, { .compatible ="amlogic,meson-gxbb-gpio-intc" , .data = &gxbb_params },
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 23/166 power: supply: Fix logic checking if system is running from battery
In reply to Greg Kroah-HartmanFrom: Mario Limonciello <[email protected]>
[ Upstream commit 95339f40a8b652b5b1773def31e63fc53c26378a ]
The logic used for power_supply_is_system_supplied() counts all power supplies and assumes that the system is running from AC if there is either a non-battery power-supply reporting to be online or if no power-supplies exist at all.
The second rule is for desktop systems, that don't have any battery/charger devices. These systems will incorrectly report to be powered from battery once a device scope power-supply is registered (e.g. a HID device), since these power-supplies increase the counter.
Apart from HID devices, recent dGPUs provide UCSI power supplies on a desktop systems. The dGPU by default doesn't have anything plugged in so it's 'offline'. This makes power_supply_is_system_supplied() return 0 with a count of 1 meaning all drivers that use this get a wrong judgement.
To fix this case adjust the logic to also examine the scope of the power supply. If the power supply is deemed a device power supply, then don't count it.
--- drivers/power/supply/power_supply_core.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/power/supply/power_supply_core.c +6 -2
@@ -348,6 +348,10 @@ static int __power_supply_is_system_supplied(struct device *dev, void *data)struct power_supply *psy =dev_get_drvdata (dev);unsigned int *count = data; +if (!psy->desc->get_property (psy,POWER_SUPPLY_PROP_SCOPE , &ret)) +if (ret.intval ==POWER_SUPPLY_SCOPE_DEVICE ) +return 0 ; + (*count)++;if (psy->desc->type !=POWER_SUPPLY_TYPE_BATTERY ) if (!psy->desc->get_property(psy, POWER_SUPPLY_PROP_ONLINE,
@@ -366,8 +370,8 @@ int power_supply_is_system_supplied(void) __power_supply_is_system_supplied);/* -* If no power class device was found at all, most probably we are -* running on a desktop system, so assume we are on mains power. +* If no system scope power class device was found at all, most probably we +* are running on a desktop system, so assume we are on mains power. */ if (count ==0 )return 1 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 24/166 drm: panel-orientation-quirks: Change Airs quirk to support Air Plus
In reply to Greg Kroah-HartmanFrom: Maya Matuszczyk <[email protected]>
[ Upstream commit 1aa7f416175619e0286fddc5fc44e968b06bf2aa ]
It turned out that Aya Neo Air Plus had a different board name than expected.
This patch changes Aya Neo Air's quirk to account for that, as both devices share "Air" in DMI product name.
Tested on Air claiming to be an Air Pro, and on Air Plus.
--- drivers/gpu/drm/drm_panel_orientation_quirks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/drm_panel_orientation_quirks.c +1 -1
@@ -179,7 +179,7 @@ static const struct dmi_system_id orientation_data[] = { }, { /* AYA NEO AIR */ .matches = {DMI_EXACT_MATCH (DMI_SYS_VENDOR ,"AYANEO" ), - DMI_MATCH(DMI_BOARD_NAME, "AIR"), + DMI_MATCH(DMI_PRODUCT_NAME, "AIR"), }, .driver_data = (void *)&lcd1080x1920_leftside_up, }, { /* AYA NEO NEXT */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 25/166 btrfs: scrub: try harder to mark RAID56 block groups read-only
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
[ Upstream commit 7561551e7ba870b9659083b95feb520fb2dacce3 ]
Currently we allow a block group not to be marked read-only for scrub.
But for RAID56 block groups if we require the block group to be read-only, then we're allowed to use cached content from scrub stripe to reduce unnecessary RAID56 reads.
So this patch would:
- Make btrfs_inc_block_group_ro() try harder
During my tests, for cases like btrfs/061 and btrfs/064, we can hit ENOSPC from btrfs_inc_block_group_ro() calls during scrub.
The reason is if we only have one single data chunk, and trying to scrub it, we won't have any space left for any newer data writes.
But this check should be done by the caller, especially for scrub cases we only temporarily mark the chunk read-only.
And newer data writes would always try to allocate a new data chunk when needed.
- Return error for scrub if we failed to mark a RAID56 chunk read-only
--- fs/btrfs/block-group.c | 14 ++++++++++++-- fs/btrfs/scrub.c | 9 ++++++++- 2 files changed, 20 insertions(+), 3 deletions(-)
fs/btrfs/block-group.c +12 -2
@@ -2621,10 +2621,20 @@ int btrfs_inc_block_group_ro(struct btrfs_block_group *cache, } ret =inc_block_group_ro (cache,0 ); -if (!do_chunk_alloc || ret == -ETXTBSY ) - goto unlock_out;if (!ret) goto out; +if (ret == -ETXTBSY ) + goto unlock_out; + +/* +* Skip chunk alloction if the bg is SYSTEM, this is to avoid system +* chunk allocation storm to exhaust the system chunk array. Otherwise +* we still want to try our best to mark the block group read-only. +*/ +if (!do_chunk_alloc && ret == -ENOSPC && + (cache->flags &BTRFS_BLOCK_GROUP_SYSTEM )) + goto unlock_out; + alloc_flags =btrfs_get_alloc_profile (fs_info, cache->space_info->flags); ret =btrfs_chunk_alloc (trans, alloc_flags,CHUNK_ALLOC_FORCE );if (ret <0 )
fs/btrfs/scrub.c +8 -1
@@ -4017,13 +4017,20 @@ int scrub_enumerate_chunks(struct scrub_ctx *sctx,if (ret ==0 ) { ro_set =1 ; - }else if (ret == -ENOSPC && !sctx->is_dev_replace) { + }else if (ret == -ENOSPC && !sctx->is_dev_replace && + !(cache->flags &BTRFS_BLOCK_GROUP_RAID56_MASK )) {/* * btrfs_inc_block_group_ro return -ENOSPC when it * failed in creating new chunk for metadata. * It is not a problem for scrub, because * metadata are always cowed, and our scrub paused * commit_transactions. +* +* For RAID56 chunks, we have to mark them read-only +* for scrub, as later we would use our own cache +* out of RAID56 realm. +* Thus we want the RAID56 bg to be marked RO to +* prevent RMW from screwing up out cache. */ ro_set =0 ; }else if (ret == -ETXTBSY ) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 26/166 btrfs: handle memory allocation failure in btrfs_csum_one_bio
In reply to Greg Kroah-HartmanFrom: Johannes Thumshirn <[email protected]>
[ Upstream commit 806570c0bb7b4847828c22c4934fcf2dc8fc572f ]
Since f8a53bb58ec7 ("btrfs: handle checksum generation in the storage layer") the failures of btrfs_csum_one_bio() are handled via bio_end_io().
This means, we can return BLK_STS_RESOURCE from btrfs_csum_one_bio() in case the allocation of the ordered sums fails.
This also fixes a syzkaller report, where injecting a failure into the kvzalloc() call results in a BUG_ON().
--- fs/btrfs/file-item.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/btrfs/file-item.c +3 -1
@@ -717,7 +717,9 @@ blk_status_t btrfs_csum_one_bio(struct btrfs_inode *inode, struct bio *bio, sums =kvzalloc (btrfs_ordered_sum_size (fs_info, bytes_left),GFP_KERNEL );memalloc_nofs_restore (nofs_flag); -BUG_ON (!sums);/* -ENOMEM */ +if (!sums) +return BLK_STS_RESOURCE ; + sums->len = bytes_left; ordered =btrfs_lookup_ordered_extent (inode, offset);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 27/166 ASoC: soc-pcm: test if a BE can be prepared
In reply to Greg Kroah-HartmanFrom: Ranjani Sridharan <[email protected]>
[ Upstream commit e123036be377ddf628226a7c6d4f9af5efd113d3 ]
In the BE hw_params configuration, the existing code checks if any of the existing FEs are prepared, running, paused or suspended - and skips the configuration in those cases. This allows multiple calls of hw_params which the ALSA state machine supports.
This check is not handled for the prepare stage, which can lead to the same BE being prepared multiple times. This patch adds a check similar to that of the hw_params, with the main difference being that the suspended state is allowed: the ALSA state machine allows a transition from suspended to prepared with hw_params skipped.
This problem was detected on Intel IPC4/SoundWire devices, where the BE dailink .prepare stage is used to configure the SoundWire stream with a bank switch. Multiple .prepare calls lead to conflicts with the .trigger operation with IPC4 configurations. This problem was not detected earlier on Intel devices, HDaudio BE dailinks detect that the link is already prepared and skip the configuration, and for IPC3 devices there is no BE trigger.
--- include/sound/soc-dpcm.h | 4 ++++ sound/soc/soc-pcm.c | 20 ++++++++++++++++++++ 2 files changed, 24 insertions(+)
include/sound/soc-dpcm.h +4 -0
@@ -125,6 +125,10 @@ int snd_soc_dpcm_can_be_free_stop(struct snd_soc_pcm_runtime *fe,int snd_soc_dpcm_can_be_params (struct snd_soc_pcm_runtime *fe,struct snd_soc_pcm_runtime *be,int stream); +/* can this BE perform prepare */ +int snd_soc_dpcm_can_be_prepared (struct snd_soc_pcm_runtime *fe, +struct snd_soc_pcm_runtime *be,int stream); +/* is the current PCM operation for this FE ? */ int snd_soc_dpcm_fe_can_update (struct snd_soc_pcm_runtime *fe,int stream);
sound/soc/soc-pcm.c +20 -0
@@ -2403,6 +2403,9 @@ int dpcm_be_dai_prepare(struct snd_soc_pcm_runtime *fe, int stream)if (!snd_soc_dpcm_be_can_update (fe, be, stream))continue ; +if (!snd_soc_dpcm_can_be_prepared (fe, be, stream)) +continue ; + if ((be->dpcm[stream].state != SND_SOC_DPCM_STATE_HW_PARAMS) && (be->dpcm[stream].state != SND_SOC_DPCM_STATE_STOP) && (be->dpcm[stream].state != SND_SOC_DPCM_STATE_SUSPEND) &&
@@ -3043,3 +3046,20 @@ int snd_soc_dpcm_can_be_params(struct snd_soc_pcm_runtime *fe,return snd_soc_dpcm_check_state (fe, be, stream, state,ARRAY_SIZE (state)); }EXPORT_SYMBOL_GPL (snd_soc_dpcm_can_be_params); + +/* +* We can only prepare a BE DAI if any of it's FE are not prepared, +* running or paused for the specified stream direction. +*/ +int snd_soc_dpcm_can_be_prepared (struct snd_soc_pcm_runtime *fe, +struct snd_soc_pcm_runtime *be,int stream) +{ +const enum snd_soc_dpcm_state state[] = { +SND_SOC_DPCM_STATE_START , +SND_SOC_DPCM_STATE_PAUSED , +SND_SOC_DPCM_STATE_PREPARE , + }; + +return snd_soc_dpcm_check_state (fe, be, stream, state,ARRAY_SIZE (state)); +} +EXPORT_SYMBOL_GPL (snd_soc_dpcm_can_be_prepared);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 28/166 ASoC: Intel: avs: Account for UID of ACPI device
In reply to Greg Kroah-HartmanFrom: Cezary Rojewski <[email protected]>
[ Upstream commit 836855100b87b4dd7a82546131779dc255c18b67 ]
Configurations with multiple codecs attached to the platform are supported but only if each from the set is different. Add new field representing the 'Unique ID' so that codecs that share Vendor and Part IDs can be differentiated and thus enabling support for such configurations.
--- include/sound/soc-acpi.h | 1 + sound/soc/intel/avs/board_selection.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-)
include/sound/soc-acpi.h +1 -0
@@ -170,6 +170,7 @@ struct snd_soc_acpi_link_adr {/* Descriptor for SST ASoC machine driver */ struct snd_soc_acpi_mach {u8 id[ACPI_ID_LEN ]; +const char *uid;const struct snd_soc_acpi_codecs *comp_ids;const u32 link_mask;const struct snd_soc_acpi_link_adr *links;
sound/soc/intel/avs/board_selection.c +1 -1
@@ -394,7 +394,7 @@ static int avs_register_i2s_boards(struct avs_dev *adev) }for (mach = boards->machs; mach->id[0 ]; mach++) { -if (!acpi_dev_present (mach->id,NULL ,-1 )) +if (!acpi_dev_present (mach->id, mach->uid,-1 ))continue ;if (mach->machine_quirk)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 29/166 ASoC: Intel: avs: Add missing checks on FE startup
In reply to Greg Kroah-HartmanFrom: Amadeusz Sławiński <[email protected]>
[ Upstream commit 25148f57a2a6d157779bae494852e172952ba980 ]
Constraint functions have return values, they should be checked for potential errors.
--- sound/soc/intel/avs/pcm.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-)
sound/soc/intel/avs/pcm.c +18 -5
@@ -424,21 +424,34 @@ static int avs_dai_fe_startup(struct snd_pcm_substream *substream, struct snd_so host_stream =snd_hdac_ext_stream_assign (bus, substream,HDAC_EXT_STREAM_TYPE_HOST );if (!host_stream) { -kfree (data); -return -EBUSY ; + ret = -EBUSY ; + goto err; } data->host_stream = host_stream; -snd_pcm_hw_constraint_integer (runtime,SNDRV_PCM_HW_PARAM_PERIODS ); + ret =snd_pcm_hw_constraint_integer (runtime,SNDRV_PCM_HW_PARAM_PERIODS ); +if (ret <0 ) + goto err; +/* avoid wrap-around with wall-clock */ -snd_pcm_hw_constraint_minmax (runtime,SNDRV_PCM_HW_PARAM_BUFFER_TIME ,20 ,178000000 ); -snd_pcm_hw_constraint_list (runtime,0 ,SNDRV_PCM_HW_PARAM_RATE , &hw_rates); + ret =snd_pcm_hw_constraint_minmax (runtime,SNDRV_PCM_HW_PARAM_BUFFER_TIME ,20 ,178000000 ); +if (ret <0 ) + goto err; + + ret =snd_pcm_hw_constraint_list (runtime,0 ,SNDRV_PCM_HW_PARAM_RATE , &hw_rates); +if (ret <0 ) + goto err; +snd_pcm_set_sync (substream);dev_dbg (dai->dev,"%s fe STARTUP tag %d str %p" , __func__,hdac_stream (host_stream)->stream_tag, substream);return 0 ; + +err: +kfree (data); +return ret; }static void avs_dai_fe_shutdown (struct snd_pcm_substream *substream,struct snd_soc_dai *dai)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 30/166 parisc: Improve cache flushing for PCXL in arch_sync_dma_for_cpu()
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
[ Upstream commit 59fa12646d9f56c842b4d5b6418ed77af625c588 ]
Add comment in arch_sync_dma_for_device() and handle the direction flag in arch_sync_dma_for_cpu().
When receiving data from the device (DMA_FROM_DEVICE) unconditionally purge the data cache in arch_sync_dma_for_cpu().
--- arch/parisc/kernel/pci-dma.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
arch/parisc/kernel/pci-dma.c +17 -1
@@ -446,11 +446,27 @@ void arch_dma_free(struct device *dev, size_t size, void *vaddr,void arch_sync_dma_for_device (phys_addr_t paddr,size_t size,enum dma_data_direction dir) { +/* +* fdc: The data cache line is written back to memory, if and only if +* it is dirty, and then invalidated from the data cache. +*/ flush_kernel_dcache_range ((unsigned long )phys_to_virt (paddr), size); }void arch_sync_dma_for_cpu (phys_addr_t paddr,size_t size,enum dma_data_direction dir) { -flush_kernel_dcache_range ((unsigned long )phys_to_virt (paddr), size); +unsigned long addr = (unsigned long )phys_to_virt (paddr); + +switch (dir) { +case DMA_TO_DEVICE : +case DMA_BIDIRECTIONAL : +flush_kernel_dcache_range (addr, size); +return ; +case DMA_FROM_DEVICE : +purge_kernel_dcache_range_asm (addr, addr + size); +return ; +default : +BUG (); + } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 31/166 parisc: Flush gatt writes and adjust gatt mask in parisc_agp_mask_memory()
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
[ Upstream commit d703797380c540bbeac03f104ebcfc364eaf47cc ]
Flush caches after changing gatt entries and calculate entry according to SBA requirements.
--- drivers/char/agp/parisc-agp.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
drivers/char/agp/parisc-agp.c +14 -1
@@ -90,6 +90,9 @@ parisc_agp_tlbflush(struct agp_memory *mem) {struct _parisc_agp_info *info = &parisc_agp_info; +/* force fdc ops to be visible to IOMMU */ +asm_io_sync (); +writeq (info->gart_base |ilog2 (info->gart_size), info->ioc_regs+IOC_PCOM );readq (info->ioc_regs+IOC_PCOM );/* flush */ }
@@ -158,6 +161,7 @@ parisc_agp_insert_memory(struct agp_memory *mem, off_t pg_start, int type) info->gatt[j] =parisc_agp_mask_memory (agp_bridge, paddr, type); +asm_io_fdc (&info->gatt[j]); } }
@@ -191,7 +195,16 @@ static unsigned long parisc_agp_mask_memory(struct agp_bridge_data *bridge, dma_addr_t addr, int type) { - return SBA_PDIR_VALID_BIT | addr; + unsigned ci; /* coherent index */ +dma_addr_t pa; + + pa = addr &IOVP_MASK ; + asm("lci 0(%1), %0" :"=r" (ci) :"r" (phys_to_virt (pa))); + + pa |= (ci >>PAGE_SHIFT ) &0xff ;/* move CI (8 bits) into lowest byte */ + pa |=SBA_PDIR_VALID_BIT ;/* set "valid" bit */ + +return cpu_to_le64 (pa); } static void
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 32/166 MIPS: unhide PATA_PLATFORM
In reply to Greg Kroah-HartmanFrom: Manuel Lauss <[email protected]>
[ Upstream commit 75b18aac6fa39a1720677970cfcb52ecea1eb44c ]
Alchemy DB1200/DB1300 boards can use the pata_platform driver. Unhide the config entry in all of MIPS.
--- arch/mips/Kconfig | 1 + 1 file changed, 1 insertion(+)
arch/mips/Kconfig +1 -0
@@ -82,6 +82,7 @@ config MIPS select HAVE_LD_DEAD_CODE_DATA_ELIMINATION select HAVE_MOD_ARCH_SPECIFIC select HAVE_NMI + select HAVE_PATA_PLATFORM select HAVE_PERF_EVENTS select HAVE_PERF_REGS select HAVE_PERF_USER_STACK_DUMP
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 33/166 MIPS: Restore Au1300 support
In reply to Greg Kroah-HartmanFrom: Manuel Lauss <[email protected]>
[ Upstream commit f2041708dee30a3425f680265c337acd28293782 ]
The Au1300, at least the one I have to test, uses the NetLogic vendor ID, but commit 95b8a5e0111a ("MIPS: Remove NETLOGIC support") also dropped Au1300 detection. Restore Au1300 detection.
Tested on DB1300 with Au1380 chip.
--- arch/mips/kernel/cpu-probe.c | 5 +++++ 1 file changed, 5 insertions(+)
arch/mips/kernel/cpu-probe.c +5 -0
@@ -1502,6 +1502,10 @@ static inline void cpu_probe_alchemy(struct cpuinfo_mips *c, unsigned int cpu)break ; }break ; +case PRID_IMP_NETLOGIC_AU13XX : + c->cputype =CPU_ALCHEMY ; + __cpu_name[cpu] ="Au1300" ; +break ; } }
@@ -1861,6 +1865,7 @@ void cpu_probe(void)cpu_probe_mips (c, cpu);break ;case PRID_COMP_ALCHEMY : +case PRID_COMP_NETLOGIC :cpu_probe_alchemy (c, cpu);break ;case PRID_COMP_SIBYTE :
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 34/166 MIPS: Alchemy: fix dbdma2
In reply to Greg Kroah-HartmanFrom: Manuel Lauss <[email protected]>
[ Upstream commit 2d645604f69f3a772d58ead702f9a8e84ab2b342 ]
Various fixes for the Au1200/Au1550/Au1300 DBDMA2 code:
- skip cache invalidation if chip has working coherency circuitry.
- invalidate KSEG0-portion of the (physical) data address.
- force the dma channel doorbell write out to bus immediately with a sync.
--- arch/mips/alchemy/common/dbdma.c | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-)
arch/mips/alchemy/common/dbdma.c +15 -12
@@ -30,6 +30,7 @@* */ +#include <linux/dma-map-ops.h> /* for dma_default_coherent */ #include <linux/init.h> #include <linux/kernel.h> #include <linux/slab.h>
@@ -623,17 +624,18 @@ u32 au1xxx_dbdma_put_source(u32 chanid, dma_addr_t buf, int nbytes, u32 flags) dp->dscr_cmd0 &= ~DSCR_CMD0_IE ;/* -* There is an errata on the Au1200/Au1550 parts that could result -* in "stale" data being DMA'ed. It has to do with the snoop logic on -* the cache eviction buffer. DMA_NONCOHERENT is on by default for -* these parts. If it is fixed in the future, these dma_cache_inv will -* just be nothing more than empty macros. See io.h. +* There is an erratum on certain Au1200/Au1550 revisions that could +* result in "stale" data being DMA'ed. It has to do with the snoop +* logic on the cache eviction buffer. dma_default_coherent is set +* to false on these parts. */ -dma_cache_wback_inv ((unsigned long )buf, nbytes); +if (!dma_default_coherent) +dma_cache_wback_inv (KSEG0ADDR (buf), nbytes); dp->dscr_cmd0 |=DSCR_CMD0_V ;/* Let it rip */ wmb ();/* drain writebuffer */ dma_cache_wback_inv ((unsigned long )dp,sizeof (*dp)); ctp->chan_ptr->ddma_dbell =0 ; +wmb ();/* force doorbell write out to dma engine */ /* Get next descriptor pointer. */ ctp->put_ptr =phys_to_virt (DSCR_GET_NXTPTR (dp->dscr_nxtptr));
@@ -685,17 +687,18 @@ u32 au1xxx_dbdma_put_dest(u32 chanid, dma_addr_t buf, int nbytes, u32 flags) dp->dscr_source1, dp->dscr_dest0, dp->dscr_dest1);#endif /* -* There is an errata on the Au1200/Au1550 parts that could result in -* "stale" data being DMA'ed. It has to do with the snoop logic on the -* cache eviction buffer. DMA_NONCOHERENT is on by default for these -* parts. If it is fixed in the future, these dma_cache_inv will just -* be nothing more than empty macros. See io.h. +* There is an erratum on certain Au1200/Au1550 revisions that could +* result in "stale" data being DMA'ed. It has to do with the snoop +* logic on the cache eviction buffer. dma_default_coherent is set +* to false on these parts. */ -dma_cache_inv ((unsigned long )buf, nbytes); +if (!dma_default_coherent) +dma_cache_inv (KSEG0ADDR (buf), nbytes); dp->dscr_cmd0 |=DSCR_CMD0_V ;/* Let it rip */ wmb ();/* drain writebuffer */ dma_cache_wback_inv ((unsigned long )dp,sizeof (*dp)); ctp->chan_ptr->ddma_dbell =0 ; +wmb ();/* force doorbell write out to dma engine */ /* Get next descriptor pointer. */ ctp->put_ptr =phys_to_virt (DSCR_GET_NXTPTR (dp->dscr_nxtptr));
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 35/166 mips: Move initrd_start check after initrd address sanitisation.
In reply to Greg Kroah-HartmanFrom: Liviu Dudau <[email protected]>
[ Upstream commit 4897a898a216058dec55e5e5902534e6e224fcdf ]
PAGE_OFFSET is technically a virtual address so when checking the value of initrd_start against it we should make sure that it has been sanitised from the values passed by the bootloader. Without this change, even with a bootloader that passes correct addresses for an initrd, we are failing to load it on MT7621 boards, for example.
--- arch/mips/kernel/setup.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
arch/mips/kernel/setup.c +5 -4
@@ -158,10 +158,6 @@ static unsigned long __init init_initrd(void)pr_err ("initrd start must be page aligned\n" ); goto disable; } -if (initrd_start <PAGE_OFFSET ) { -pr_err ("initrd start < PAGE_OFFSET\n" ); - goto disable; - }/* * Sanitize initrd addresses. For example firmware
@@ -174,6 +170,11 @@ static unsigned long __init init_initrd(void) initrd_end = (unsigned long )__va (end); initrd_start = (unsigned long )__va (__pa (initrd_start)); +if (initrd_start <PAGE_OFFSET ) { +pr_err ("initrd start < PAGE_OFFSET\n" ); + goto disable; + } +ROOT_DEV = Root_RAM0;return PFN_UP (end); disable:
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 36/166 ASoC: cs35l41: Fix default regmap values for some registers
In reply to Greg Kroah-HartmanFrom: Stefan Binding <[email protected]>
[ Upstream commit e2d035f5a7d597bbabc268e236ec6c0408c4af0e ]
Several values do not match the defaults of CS35L41, fix them.
--- sound/soc/codecs/cs35l41-lib.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/soc/codecs/cs35l41-lib.c +3 -3
@@ -46,7 +46,7 @@ static const struct reg_default cs35l41_reg[] = { { CS35L41_DSP1_RX5_SRC, 0x00000020 }, { CS35L41_DSP1_RX6_SRC, 0x00000021 }, { CS35L41_DSP1_RX7_SRC, 0x0000003A }, - { CS35L41_DSP1_RX8_SRC, 0x00000001 }, + { CS35L41_DSP1_RX8_SRC, 0x0000003B }, { CS35L41_NGATE1_SRC, 0x00000008 }, { CS35L41_NGATE2_SRC, 0x00000009 }, { CS35L41_AMP_DIG_VOL_CTRL, 0x00008000 },
@@ -58,8 +58,8 @@ static const struct reg_default cs35l41_reg[] = { { CS35L41_IRQ1_MASK2, 0xFFFFFFFF }, { CS35L41_IRQ1_MASK3, 0xFFFF87FF }, { CS35L41_IRQ1_MASK4, 0xFEFFFFFF }, - { CS35L41_GPIO1_CTRL1, 0xE1000001 }, - { CS35L41_GPIO2_CTRL1, 0xE1000001 }, + { CS35L41_GPIO1_CTRL1, 0x81000001 }, + { CS35L41_GPIO2_CTRL1, 0x81000001 }, { CS35L41_MIXER_NGATE_CFG, 0x00000000 }, { CS35L41_MIXER_NGATE_CH1_CFG, 0x00000303 }, { CS35L41_MIXER_NGATE_CH2_CFG, 0x00000303 },
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 37/166 ASoC: dwc: move DMA init to snd_soc_dai_driver probe()
In reply to Greg Kroah-HartmanFrom: Maxim Kochetkov <[email protected]>
[ Upstream commit 011a8719d6105dcb48077ea7a6a88ac019d4aa50 ]
When using DMA mode we are facing with Oops:
[ 396.458157] Unable to handle kernel access to user memory without uaccess routines at virtual address 000000000000000c [ 396.469374] Oops [#1] [ 396.471839] Modules linked in: [ 396.475144] CPU: 0 PID: 114 Comm: arecord Not tainted 6.0.0-00164-g9a8eccdaf2be-dirty #68 [ 396.483619] Hardware name: YMP ELCT FPGA (DT) [ 396.488156] epc : dmaengine_pcm_open+0x1d2/0x342 [ 396.493227] ra : dmaengine_pcm_open+0x1d2/0x342 [ 396.498140] epc : ffffffff807fe346 ra : ffffffff807fe346 sp : ffffffc804e138f0 [ 396.505602] gp : ffffffff817bf730 tp : ffffffd8042c8ac0 t0 : 6500000000000000 [ 396.513045] t1 : 0000000000000064 t2 : 656e69676e65616d s0 : ffffffc804e13990 [ 396.520477] s1 : ffffffd801b86a18 a0 : 0000000000000026 a1 : ffffffff816920f8 [ 396.527897] a2 : 0000000000000010 a3 : fffffffffffffffe a4 : 0000000000000000 [ 396.535319] a5 : 0000000000000000 a6 : ffffffd801b87040 a7 : 0000000000000038 [ 396.542740] s2 : ffffffd801b94a00 s3 : 0000000000000000 s4 : ffffffd80427f5e8 [ 396.550153] s5 : ffffffd80427f5e8 s6 : ffffffd801b44410 s7 : fffffffffffffff5 [ 396.557569] s8 : 0000000000000800 s9 : 0000000000000001 s10: ffffffff8066d254 [ 396.564978] s11: ffffffd8059cf768 t3 : ffffffff817d5577 t4 : ffffffff817d5577 [ 396.572391] t5 : ffffffff817d5578 t6 : ffffffc804e136e8 [ 396.577876] status: 0000000200000120 badaddr: 000000000000000c cause: 000000000000000d [ 396.586007] [<ffffffff806839f4>] snd_soc_component_open+0x1a/0x68 [ 396.592439] [<ffffffff807fdd62>] __soc_pcm_open+0xf0/0x502 [ 396.598217] [<ffffffff80685d86>] soc_pcm_open+0x2e/0x4e [ 396.603741] [<ffffffff8066cea4>] snd_pcm_open_substream+0x442/0x68e [ 396.610313] [<ffffffff8066d1ea>] snd_pcm_open+0xfa/0x212 [ 396.615868] [<ffffffff8066d39c>] snd_pcm_capture_open+0x3a/0x60 [ 396.622048] [<ffffffff8065b35a>] snd_open+0xa8/0x17a [ 396.627421] [<ffffffff801ae036>] chrdev_open+0xa0/0x218 [ 396.632893] [<ffffffff801a5a28>] do_dentry_open+0x17c/0x2a6 [ 396.638713] [<ffffffff801a6d9a>] vfs_open+0x1e/0x26 [ 396.643850] [<ffffffff801b8544>] path_openat+0x96e/0xc96 [ 396.649518] [<ffffffff801b9390>] do_filp_open+0x7c/0xf6 [ 396.655034] [<ffffffff801a6ff2>] do_sys_openat2+0x8a/0x11e [ 396.660765] [<ffffffff801a735a>] sys_openat+0x50/0x7c [ 396.666068] [<ffffffff80003aca>] ret_from_syscall+0x0/0x2 [ 396.674964] ---[ end trace 0000000000000000 ]---
It happens because of play_dma_data/capture_dma_data pointers are NULL. Current implementation assigns these pointers at snd_soc_dai_driver startup() callback and reset them back to NULL at shutdown(). But soc_pcm_open() sequence uses DMA pointers in dmaengine_pcm_open() before snd_soc_dai_driver startup().
Most generic DMA capable I2S drivers use snd_soc_dai_driver probe() callback to init DMA pointers only once at probe. So move DMA init to dw_i2s_dai_probe and drop shutdown() and startup() callbacks.
--- sound/soc/dwc/dwc-i2s.c | 41 +++++++++-------------------------------- 1 file changed, 9 insertions(+), 32 deletions(-)
sound/soc/dwc/dwc-i2s.c +9 -32
@@ -183,30 +183,6 @@ static void i2s_stop(struct dw_i2s_dev *dev, } } -static int dw_i2s_startup (struct snd_pcm_substream *substream, -struct snd_soc_dai *cpu_dai) -{ -struct dw_i2s_dev *dev =snd_soc_dai_get_drvdata (cpu_dai); -union dw_i2s_snd_dma_data *dma_data =NULL ; - -if (!(dev->capability &DWC_I2S_RECORD ) && - (substream->stream ==SNDRV_PCM_STREAM_CAPTURE )) -return -EINVAL ; - -if (!(dev->capability &DWC_I2S_PLAY ) && - (substream->stream ==SNDRV_PCM_STREAM_PLAYBACK )) -return -EINVAL ; - -if (substream->stream ==SNDRV_PCM_STREAM_PLAYBACK ) - dma_data = &dev->play_dma_data; -else if (substream->stream ==SNDRV_PCM_STREAM_CAPTURE ) - dma_data = &dev->capture_dma_data; - -snd_soc_dai_set_dma_data (cpu_dai, substream, (void *)dma_data); - -return 0 ; -} -static void dw_i2s_config (struct dw_i2s_dev *dev,int stream) {u32 ch_reg;
@@ -305,12 +281,6 @@ static int dw_i2s_hw_params(struct snd_pcm_substream *substream,return 0 ; } -static void dw_i2s_shutdown (struct snd_pcm_substream *substream, -struct snd_soc_dai *dai) -{ -snd_soc_dai_set_dma_data (dai, substream,NULL ); -} -static int dw_i2s_prepare (struct snd_pcm_substream *substream,struct snd_soc_dai *dai) {
@@ -382,8 +352,6 @@ static int dw_i2s_set_fmt(struct snd_soc_dai *cpu_dai, unsigned int fmt) }static const struct snd_soc_dai_ops dw_i2s_dai_ops = { - .startup = dw_i2s_startup, - .shutdown = dw_i2s_shutdown, .hw_params = dw_i2s_hw_params, .prepare = dw_i2s_prepare, .trigger = dw_i2s_trigger,
@@ -625,6 +593,14 @@ static int dw_configure_dai_by_dt(struct dw_i2s_dev *dev, } +static int dw_i2s_dai_probe (struct snd_soc_dai *dai) +{ +struct dw_i2s_dev *dev =snd_soc_dai_get_drvdata (dai); + +snd_soc_dai_init_dma_data (dai, &dev->play_dma_data, &dev->capture_dma_data); +return 0 ; +} +static int dw_i2s_probe (struct platform_device *pdev) {const struct i2s_platform_data *pdata = pdev->dev.platform_data;
@@ -643,6 +619,7 @@ static int dw_i2s_probe(struct platform_device *pdev)return -ENOMEM ; dw_i2s_dai->ops = &dw_i2s_dai_ops; + dw_i2s_dai->probe = dw_i2s_dai_probe; dev->i2s_base =devm_platform_get_and_ioremap_resource (pdev,0 , &res);if (IS_ERR (dev->i2s_base))
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 38/166 xen/blkfront: Only check REQ_FUA for writes
In reply to Greg Kroah-HartmanFrom: Ross Lagerwall <[email protected]>
[ Upstream commit b6ebaa8100090092aa602530d7e8316816d0c98d ]
The existing code silently converts read operations with the REQ_FUA bit set into write-barrier operations. This results in data loss as the backend scribbles zeroes over the data instead of returning it.
While the REQ_FUA bit doesn't make sense on a read operation, at least one well-known out-of-tree kernel module does set it and since it results in data loss, let's be safe here and only look at REQ_FUA for writes.
--- drivers/block/xen-blkfront.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/block/xen-blkfront.c +2 -1
@@ -780,7 +780,8 @@ static int blkif_queue_rw_req(struct request *req, struct blkfront_ring_info *ri ring_req->u.rw.handle = info->handle; ring_req->operation =rq_data_dir (req) ?BLKIF_OP_WRITE :BLKIF_OP_READ ; -if (req_op (req) ==REQ_OP_FLUSH || req->cmd_flags &REQ_FUA ) { +if (req_op (req) ==REQ_OP_FLUSH || + (req_op (req) ==REQ_OP_WRITE && (req->cmd_flags &REQ_FUA ))) {/* * Ideally we can do an unordered flush-to-disk. * In case the backend onlysupports barriers, use that.
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 39/166 drm:amd:amdgpu: Fix missing buffer object unlock in failure path
In reply to Greg Kroah-HartmanFrom: Sukrut Bellary <[email protected]>
[ Upstream commit 60ecaaf54886b0642d5c4744f7fbf1ff0d6b3e42 ]
smatch warning -
1) drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c:3615 gfx_v9_0_kiq_resume()
warn: inconsistent returns 'ring->mqd_obj->tbo.base.resv'.
2) drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c:6901 gfx_v10_0_kiq_resume()
warn: inconsistent returns 'ring->mqd_obj->tbo.base.resv'.
--- drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 4 +++- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +3 -1
@@ -6969,8 +6969,10 @@ static int gfx_v10_0_kiq_resume(struct amdgpu_device *adev)return r; r =amdgpu_bo_kmap (ring->mqd_obj, (void **)&ring->mqd_ptr); -if (unlikely (r !=0 )) +if (unlikely (r !=0 )) { +amdgpu_bo_unreserve (ring->mqd_obj);return r; + }gfx_v10_0_kiq_init_queue (ring);amdgpu_bo_kunmap (ring->mqd_obj);
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +3 -1
@@ -3650,8 +3650,10 @@ static int gfx_v9_0_kiq_resume(struct amdgpu_device *adev)return r; r =amdgpu_bo_kmap (ring->mqd_obj, (void **)&ring->mqd_ptr); -if (unlikely (r !=0 )) +if (unlikely (r !=0 )) { +amdgpu_bo_unreserve (ring->mqd_obj);return r; + }gfx_v9_0_kiq_init_queue (ring);amdgpu_bo_kunmap (ring->mqd_obj);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 40/166 io_uring: unlock sqd->lock before sq thread release CPU
In reply to Greg Kroah-HartmanFrom: Wenwen Chen <[email protected]>
[ Upstream commit 533ab73f5b5c95dcb4152b52d5482abcc824c690 ]
The sq thread actively releases CPU resources by calling the cond_resched() and schedule() interfaces when it is idle. Therefore, more resources are available for other threads to run.
There exists a problem in sq thread: it does not unlock sqd->lock before releasing CPU resources every time. This makes other threads pending on sqd->lock for a long time. For example, the following interfaces all require sqd->lock: io_sq_offload_create(), io_register_iowq_max_workers() and io_ring_exit_work().
Before the sq thread releases CPU resources, unlocking sqd->lock will provide the user a better experience because it can respond quickly to user requests.
--- io_uring/sqpoll.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
io_uring/sqpoll.c +5 -1
@@ -256,9 +256,13 @@ static int io_sq_thread(void *data) sqt_spin = true;if (sqt_spin || !time_after (jiffies, timeout)) { -cond_resched ();if (sqt_spin) timeout = jiffies + sqd->sq_thread_idle; +if (unlikely (need_resched ())) { +mutex_unlock (&sqd->lock); +cond_resched (); +mutex_lock (&sqd->lock); + }continue ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 41/166 NVMe: Add MAXIO 1602 to bogus nid list.
In reply to Greg Kroah-HartmanFrom: Tatsuki Sugiura <[email protected]>
[ Upstream commit a3a9d63dcd15535e7fdf4c7c1b32bfaed762973a ]
HIKSEMI FUTURE M.2 SSD uses the same dummy nguid and eui64. I confirmed it with my two devices.
This patch marks the controller as NVME_QUIRK_BOGUS_NID.
---------------------------------------------------------
sugi@tempest:~% sudo nvme id-ctrl /dev/nvme0
NVME Identify Controller:
vid : 0x1e4b
ssvid : 0x1e4b
sn : 30096022612
mn : HS-SSD-FUTURE 2048G
fr : SN10542
rab : 0
ieee : 000000
cmic : 0
mdts : 7
cntlid : 0
ver : 0x10400
rtd3r : 0x7a120
rtd3e : 0x1e8480
oaes : 0x200
ctratt : 0x2
rrls : 0
cntrltype : 1
fguid : 00000000-0000-0000-0000-000000000000
<snip...>
---------------------------------------------------------
---------------------------------------------------------
sugi@tempest:~% sudo nvme id-ns /dev/nvme0n1
NVME Identify Namespace 1:
<snip...>
nguid : 00000000000000000000000000000000
eui64 : 0000000000000002
lbaf 0 : ms:0 lbads:9 rp:0 (in use)
---------------------------------------------------------
--- drivers/nvme/host/pci.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/nvme/host/pci.c +2 -0
@@ -3537,6 +3537,8 @@ static const struct pci_device_id nvme_id_table[] = { .driver_data = NVME_QUIRK_BOGUS_NID, }, { PCI_DEVICE(0x1e4B, 0x1202), /* MAXIO MAP1202 */ .driver_data = NVME_QUIRK_BOGUS_NID, }, + { PCI_DEVICE(0x1e4B, 0x1602), /* MAXIO MAP1602 */ + .driver_data = NVME_QUIRK_BOGUS_NID, }, { PCI_DEVICE(0x1cc1, 0x5350), /* ADATA XPG GAMMIX S50 */ .driver_data = NVME_QUIRK_BOGUS_NID, }, { PCI_DEVICE(0x1dbe, 0x5236), /* ADATA XPG GAMMIX S70 */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 42/166 irqchip/gic: Correctly validate OF quirk descriptors
In reply to Greg Kroah-HartmanFrom: Marc Zyngier <[email protected]>
[ Upstream commit 91539341a3b6e9c868024a4292455dae36e6f58c ]
When checking for OF quirks, make sure either 'compatible' or 'property' is set, and give up otherwise.
This avoids non-OF quirks being randomly applied as they don't have any of the OF data that need checking.
--- drivers/irqchip/irq-gic-common.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/irqchip/irq-gic-common.c +2 -0
@@ -16,6 +16,8 @@ void gic_enable_of_quirks(const struct device_node *np, const struct gic_quirk *quirks, void *data) {for (; quirks->desc; quirks++) { +if (!quirks->compatible && !quirks->property) +continue ;if (quirks->compatible && !of_device_is_compatible (np, quirks->compatible))continue ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 43/166 wifi: cfg80211: fix locking in regulatory disconnect
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
commit f7e60032c6618dfd643c7210d5cba2789e2de2e2 upstream.
This should use wiphy_lock() now instead of requiring the RTNL, since __cfg80211_leave() via cfg80211_leave() is now requiring that lock to be held.
--- net/wireless/reg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/wireless/reg.c +2 -2
@@ -2478,11 +2478,11 @@ static void reg_leave_invalid_chans(strustruct wireless_dev *wdev;struct cfg80211_registered_device *rdev =wiphy_to_rdev (wiphy); -ASSERT_RTNL (); - +wiphy_lock (wiphy);list_for_each_entry (wdev, &rdev->wiphy.wdev_list, list)if (!reg_wdev_chan_valid (wiphy, wdev))cfg80211_leave (rdev, wdev); +wiphy_unlock (wiphy); }static void reg_check_chans_work (struct work_struct *work)
Greg Kroah-Hartman
maintainerPATCH 44/166 wifi: cfg80211: fix double lock bug in reg_wdev_chan_valid()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit 996c3117dae4c02b38a3cb68e5c2aec9d907ec15 upstream.
The locking was changed recently so now the caller holds the wiphy_lock() lock. Taking the lock inside the reg_wdev_chan_valid() function will lead to a deadlock.
--- net/wireless/reg.c | 3 --- 1 file changed, 3 deletions(-)
net/wireless/reg.c +0 -3
@@ -2442,11 +2442,8 @@ static bool reg_wdev_chan_valid(struct wcase NL80211_IFTYPE_P2P_GO :case NL80211_IFTYPE_ADHOC :case NL80211_IFTYPE_MESH_POINT : -wiphy_lock (wiphy); ret =cfg80211_reg_can_beacon_relax (wiphy, &chandef, iftype); -wiphy_unlock (wiphy); -if (!ret)return ret;break ;
Greg Kroah-Hartman
maintainerPATCH 45/166 epoll: ep_autoremove_wake_function should use list_del_init_careful
In reply to Greg Kroah-HartmanFrom: Benjamin Segall <[email protected]>
commit 2192bba03d80f829233bfa34506b428f71e531e7 upstream.
autoremove_wake_function uses list_del_init_careful, so should epoll's more aggressive variant. It only doesn't because it was copied from an older wait.c rather than the most recent.
--- fs/eventpoll.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/eventpoll.c +5 -1
@@ -1760,7 +1760,11 @@ static int ep_autoremove_wake_function(s {int ret =default_wake_function (wq_entry, mode, sync, key); -list_del_init (&wq_entry->entry); +/* +* Pairs with list_empty_careful in ep_poll, and ensures future loop +* iterations see the cause of this wakeup. +*/ +list_del_init_careful (&wq_entry->entry);return ret; }
Greg Kroah-Hartman
maintainerPATCH 46/166 ocfs2: fix use-after-free when unmounting read-only filesystem
In reply to Greg Kroah-HartmanFrom: Luís Henriques <[email protected]>
commit 50d927880e0f90d5cb25e897e9d03e5edacc79a8 upstream.
It's trivial to trigger a use-after-free bug in the ocfs2 quotas code using fstest generic/452. After a read-only remount, quotas are suspended and ocfs2_mem_dqinfo is freed through ->ocfs2_local_free_info(). When unmounting the filesystem, an UAF access to the oinfo will eventually cause a crash.
BUG: KASAN: slab-use-after-free in timer_delete+0x54/0xc0 Read of size 8 at addr ffff8880389a8208 by task umount/669 ... Call Trace: <TASK> ... timer_delete+0x54/0xc0 try_to_grab_pending+0x31/0x230 __cancel_work_timer+0x6c/0x270 ocfs2_disable_quotas.isra.0+0x3e/0xf0 [ocfs2] ocfs2_dismount_volume+0xdd/0x450 [ocfs2] generic_shutdown_super+0xaa/0x280 kill_block_super+0x46/0x70 deactivate_locked_super+0x4d/0xb0 cleanup_mnt+0x135/0x1f0 ... </TASK> Allocated by task 632: kasan_save_stack+0x1c/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0x8b/0x90 ocfs2_local_read_info+0xe3/0x9a0 [ocfs2] dquot_load_quota_sb+0x34b/0x680 dquot_load_quota_inode+0xfe/0x1a0 ocfs2_enable_quotas+0x190/0x2f0 [ocfs2] ocfs2_fill_super+0x14ef/0x2120 [ocfs2] mount_bdev+0x1be/0x200 legacy_get_tree+0x6c/0xb0 vfs_get_tree+0x3e/0x110 path_mount+0xa90/0xe10 __x64_sys_mount+0x16f/0x1a0 do_syscall_64+0x43/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc Freed by task 650: kasan_save_stack+0x1c/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x50 __kasan_slab_free+0xf9/0x150 __kmem_cache_free+0x89/0x180 ocfs2_local_free_info+0x2ba/0x3f0 [ocfs2] dquot_disable+0x35f/0xa70 ocfs2_susp_quotas.isra.0+0x159/0x1a0 [ocfs2] ocfs2_remount+0x150/0x580 [ocfs2] reconfigure_super+0x1a5/0x3a0 path_mount+0xc8a/0xe10 __x64_sys_mount+0x16f/0x1a0 do_syscall_64+0x43/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc
--- fs/ocfs2/super.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/ocfs2/super.c +4 -2
@@ -952,8 +952,10 @@ static void ocfs2_disable_quotas(structfor (type =0 ; type <OCFS2_MAXQUOTAS ; type++) {if (!sb_has_quota_loaded (sb, type))continue ; - oinfo =sb_dqinfo (sb, type)->dqi_priv; -cancel_delayed_work_sync (&oinfo->dqi_sync_work); +if (!sb_has_quota_suspended (sb, type)) { + oinfo =sb_dqinfo (sb, type)->dqi_priv; +cancel_delayed_work_sync (&oinfo->dqi_sync_work); + } inode =igrab (sb->s_dquot.files[type]);/* Turn off quotas. This will remove all dquot structures from * memory and so they will be automatically synced to global
Greg Kroah-Hartman
maintainerPATCH 47/166 ocfs2: check new file size on fallocate call
In reply to Greg Kroah-HartmanFrom: Luís Henriques <[email protected]>
commit 26a6ffff7de5dd369cdb12e38ba11db682f1dec0 upstream.
When changing a file size with fallocate() the new size isn't being checked. In particular, the FSIZE ulimit isn't being checked, which makes fstest generic/228 fail. Simply adding a call to inode_newsize_ok() fixes this issue.
--- fs/ocfs2/file.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/ocfs2/file.c +7 -1
@@ -2100,14 +2100,20 @@ static long ocfs2_fallocate(struct filestruct ocfs2_space_resv sr;int change_size =1 ;int cmd =OCFS2_IOC_RESVSP64 ; +int ret =0 ;if (mode & ~(FALLOC_FL_KEEP_SIZE |FALLOC_FL_PUNCH_HOLE ))return -EOPNOTSUPP ;if (!ocfs2_writes_unwritten_extents (osb))return -EOPNOTSUPP ; -if (mode &FALLOC_FL_KEEP_SIZE ) +if (mode &FALLOC_FL_KEEP_SIZE ) { change_size =0 ; + }else { + ret =inode_newsize_ok (inode, offset + len); +if (ret) +return ret; + }if (mode &FALLOC_FL_PUNCH_HOLE ) cmd =OCFS2_IOC_UNRESVSP64 ;
Greg Kroah-Hartman
maintainerPATCH 48/166 zswap: do not shrink if cgroup may not zswap
In reply to Greg Kroah-HartmanFrom: Nhat Pham <[email protected]>
commit 0bdf0efa180a9cb1361cbded4e2260a49306ac89 upstream.
Before storing a page, zswap first checks if the number of stored pages exceeds the limit specified by memory.zswap.max, for each cgroup in the hierarchy. If this limit is reached or exceeded, then zswap shrinking is triggered and short-circuits the store attempt.
However, since the zswap's LRU is not memcg-aware, this can create the following pathological behavior: the cgroup whose zswap limit is 0 will evict pages from other cgroups continually, without lowering its own zswap usage. This means the shrinking will continue until the need for swap ceases or the pool becomes empty.
As a result of this, we observe a disproportionate amount of zswap writeback and a perpetually small zswap pool in our experiments, even though the pool limit is never hit.
More generally, a cgroup might unnecessarily evict pages from other cgroups before we drive the memcg back below its limit.
This patch fixes the issue by rejecting zswap store attempt without shrinking the pool when obj_cgroup_may_zswap() returns false.
--- mm/zswap.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
mm/zswap.c +9 -2
@@ -1138,9 +1138,16 @@ static int zswap_frontswap_store(unsigne goto reject; } +/* +* XXX: zswap reclaim does not work with cgroups yet. Without a +* cgroup-aware entry LRU, we will push out entries system-wide based on +* local cgroup limits. +*/ objcg =get_obj_cgroup_from_page (page); -if (objcg && !obj_cgroup_may_zswap (objcg)) - goto shrink; +if (objcg && !obj_cgroup_may_zswap (objcg)) { + ret = -ENOMEM ; + goto reject; + }/* reclaim space if needed */ if (zswap_is_full ()) {
Greg Kroah-Hartman
maintainerPATCH 49/166 nios2: dts: Fix tse_mac "max-frame-size" property
In reply to Greg Kroah-HartmanFrom: Janne Grunau <[email protected]>
commit 85041e12418fd0c08ff972b7729f7971afb361f8 upstream.
The given value of 1518 seems to refer to the layer 2 ethernet frame size without 802.1Q tag. Actual use of the "max-frame-size" including in the consumer of the "altr,tse-1.0" compatible is the MTU.
--- arch/nios2/boot/dts/10m50_devboard.dts | 2 +- arch/nios2/boot/dts/3c120_devboard.dts | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/nios2/boot/dts/10m50_devboard.dts +1 -1
@@ -97,7 +97,7 @@ rx-fifo-depth = <8192>; tx-fifo-depth = <8192>; address-bits = <48>; - max-frame-size = <1518>; + max-frame-size = <1500>; local-mac-address = [00 00 00 00 00 00]; altr,has-supplementary-unicast; altr,enable-sup-addr = <1>;
arch/nios2/boot/dts/3c120_devboard.dts +1 -1
@@ -106,7 +106,7 @@ interrupt-names = "rx_irq", "tx_irq"; rx-fifo-depth = <8192>; tx-fifo-depth = <8192>; - max-frame-size = <1518>; + max-frame-size = <1500>; local-mac-address = [ 00 00 00 00 00 00 ]; phy-mode = "rgmii-id"; phy-handle = <&phy0>;
Greg Kroah-Hartman
maintainerPATCH 50/166 nilfs2: fix incomplete buffer cleanup in nilfs_btnode_abort_change_key()
In reply to Greg Kroah-HartmanFrom: Ryusuke Konishi <[email protected]>
commit 2f012f2baca140c488e43d27a374029c1e59098d upstream.
A syzbot fault injection test reported that nilfs_btnode_create_block, a helper function that allocates a new node block for b-trees, causes a kernel BUG for disk images where the file system block size is smaller than the page size.
This was due to unexpected flags on the newly allocated buffer head, and it turned out to be because the buffer flags were not cleared by nilfs_btnode_abort_change_key() after an error occurred during a b-tree update operation and the buffer was later reused in that state.
Fix this issue by using nilfs_btnode_delete() to abandon the unused preallocated buffer in nilfs_btnode_abort_change_key().
--- fs/nilfs2/btnode.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
fs/nilfs2/btnode.c +10 -2
@@ -285,6 +285,14 @@ void nilfs_btnode_abort_change_key(strucif (nbh ==NULL ) {/* blocksize == pagesize */ xa_erase_irq (&btnc->i_pages, newkey);unlock_page (ctxt->bh->b_page); - }else -brelse (nbh); + }else { +/* +* When canceling a buffer that a prepare operation has +* allocated to copy a node block to another location, use +* nilfs_btnode_delete() to initialize and release the buffer +* so that the buffer flags will not be in an inconsistent +* state when it is reallocated. +*/ +nilfs_btnode_delete (nbh); + } }
Greg Kroah-Hartman
maintainerPATCH 51/166 nilfs2: fix possible out-of-bounds segment allocation in resize ioctl
In reply to Greg Kroah-HartmanFrom: Ryusuke Konishi <[email protected]>
commit fee5eaecca86afa544355569b831c1f90f334b85 upstream.
Syzbot reports that in its stress test for resize ioctl, the log writing function nilfs_segctor_do_construct hits a WARN_ON in nilfs_segctor_truncate_segments().
It turned out that there is a problem with the current implementation of the resize ioctl, which changes the writable range on the device (the range of allocatable segments) at the end of the resize process.
This order is necessary for file system expansion to avoid corrupting the superblock at trailing edge. However, in the case of a file system shrink, if log writes occur after truncating out-of-bounds trailing segments and before the resize is complete, segments may be allocated from the truncated space.
The userspace resize tool was fine as it limits the range of allocatable segments before performing the resize, but it can run into this issue if the resize ioctl is called alone.
Fix this issue by changing nilfs_sufile_resize() to update the range of allocatable segments immediately after successful truncation of segment space in case of file system shrink.
--- fs/nilfs2/sufile.c | 9 +++++++++ 1 file changed, 9 insertions(+)
fs/nilfs2/sufile.c +9 -0
@@ -779,6 +779,15 @@ int nilfs_sufile_resize(struct inode *su goto out_header; sui->ncleansegs -= nsegs - newnsegs; + +/* +* If the sufile is successfully truncated, immediately adjust +* the segment allocation space while locking the semaphore +* "mi_sem" so that nilfs_sufile_alloc() never allocates +* segments in the truncated space. +*/ + sui->allocmax = newnsegs -1 ; + sui->allocmin =0 ; } kaddr =kmap_atomic (header_bh->b_page);
Greg Kroah-Hartman
maintainerPATCH 52/166 nilfs2: reject devices with insufficient block count
In reply to Greg Kroah-HartmanFrom: Ryusuke Konishi <[email protected]>
commit 92c5d1b860e9581d64baca76779576c0ab0d943d upstream.
The current sanity check for nilfs2 geometry information lacks checks for the number of segments stored in superblocks, so even for device images that have been destructively truncated or have an unusually high number of segments, the mount operation may succeed.
This causes out-of-bounds block I/O on file system block reads or log writes to the segments, the latter in particular causing "a_ops->writepages" to repeatedly fail, resulting in sync_inodes_sb() to hang.
Fix this issue by checking the number of segments stored in the superblock and avoiding mounting devices that can cause out-of-bounds accesses. To eliminate the possibility of overflow when calculating the number of blocks required for the device from the number of segments, this also adds a helper function to calculate the upper bound on the number of segments and inserts a check using it.
--- fs/nilfs2/the_nilfs.c | 43 ++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 42 insertions(+), 1 deletion(-)
fs/nilfs2/the_nilfs.c +42 -1
@@ -405,6 +405,18 @@ unsigned long nilfs_nrsvsegs(struct the_ 100)); } +/** +* nilfs_max_segment_count - calculate the maximum number of segments +* @nilfs: nilfs object +*/ +static u64 nilfs_max_segment_count (struct the_nilfs *nilfs) +{ +u64 max_count =U64_MAX ; + +do_div (max_count, nilfs->ns_blocks_per_segment); +return min_t (u64, max_count,ULONG_MAX ); +} +void nilfs_set_nsegments (struct the_nilfs *nilfs,unsigned long nsegs) { nilfs->ns_nsegments = nsegs;
@@ -414,6 +426,8 @@ void nilfs_set_nsegments(struct the_nilfstatic int nilfs_store_disk_layout (struct the_nilfs *nilfs,struct nilfs_super_block *sbp) { +u64 nsegments, nblocks; +if (le32_to_cpu (sbp->s_rev_level) <NILFS_MIN_SUPP_REV ) { nilfs_err(nilfs->ns_sb, "unsupported revision (superblock rev.=%d.%d, current rev.=%d.%d). Please check the version of mkfs.nilfs(2).",
@@ -457,7 +471,34 @@ static int nilfs_store_disk_layout(strucreturn -EINVAL ; } -nilfs_set_nsegments (nilfs,le64_to_cpu (sbp->s_nsegments)); + nsegments =le64_to_cpu (sbp->s_nsegments); +if (nsegments >nilfs_max_segment_count (nilfs)) { +nilfs_err (nilfs->ns_sb, +"segment count %llu exceeds upper limit (%llu segments)" , + (unsigned long long )nsegments, + (unsigned long long )nilfs_max_segment_count (nilfs)); +return -EINVAL ; + } + + nblocks =sb_bdev_nr_blocks (nilfs->ns_sb); +if (nblocks) { +u64 min_block_count = nsegments * nilfs->ns_blocks_per_segment; +/* +* To avoid failing to mount early device images without a +* second superblock, exclude that block count from the +* "min_block_count" calculation. +*/ + +if (nblocks < min_block_count) { +nilfs_err (nilfs->ns_sb, +"total number of segment blocks %llu exceeds device size (%llu blocks)" , + (unsigned long long )min_block_count, + (unsigned long long )nblocks); +return -EINVAL ; + } + } + +nilfs_set_nsegments (nilfs, nsegments); nilfs->ns_crc_seed =le32_to_cpu (sbp->s_crc_seed);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 53/166 LoongArch: Fix perf event id calculation
In reply to Greg Kroah-HartmanFrom: Huacai Chen <[email protected]>
commit 962369120d750cbc9c4dc492f32b4304669ff6aa upstream.
LoongArch PMCFG has 10bit event id rather than 8 bit, so fix it.
--- arch/loongarch/kernel/perf_event.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/loongarch/kernel/perf_event.c +3 -3
@@ -271,7 +271,7 @@ static void loongarch_pmu_enable_event(sWARN_ON (idx <0 || idx >= loongarch_pmu.num_counters);/* Make sure interrupt enabled. */ - cpuc->saved_ctrl[idx] =M_PERFCTL_EVENT (evt->event_base &0xff ) | + cpuc->saved_ctrl[idx] =M_PERFCTL_EVENT (evt->event_base) | (evt->config_base &M_PERFCTL_CONFIG_MASK ) |CSR_PERFCTRL_IE ; cpu = (event->cpu >=0 ) ? event->cpu :smp_processor_id ();
@@ -594,7 +594,7 @@ static struct pmu pmu = {static unsigned int loongarch_pmu_perf_event_encode (const struct loongarch_perf_event *pev) { -return (pev->event_id &0xff ); +return M_PERFCTL_EVENT (pev->event_id); }static const struct loongarch_perf_event *loongarch_pmu_map_general_event (int idx)
@@ -849,7 +849,7 @@ static void resume_local_counters(void)static const struct loongarch_perf_event *loongarch_pmu_map_raw_event (u64 config) { - raw_event.event_id = config &0xff ; + raw_event.event_id =M_PERFCTL_EVENT (config);return &raw_event; }
Greg Kroah-Hartman
maintainerPATCH 54/166 io_uring/net: save msghdr->msg_control for retries
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
commit cac9e4418f4cbd548ccb065b3adcafe073f7f7d2 upstream.
If the application sets ->msg_control and we have to later retry this command, or if it got queued with IOSQE_ASYNC to begin with, then we need to retain the original msg_control value. This is due to the net stack overwriting this field with an in-kernel pointer, to copy it in. Hitting that path for the second time will now fail the copy from user, as it's attempting to copy from a non-user address.
--- io_uring/net.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
io_uring/net.c +7 -1
@@ -65,6 +65,7 @@ struct io_sr_msg {u16 addr_len;u16 buf_group;void __user *addr; +void __user *msg_control;/* used only for send zerocopy */ struct io_kiocb *notif; };
@@ -182,11 +183,15 @@ static int io_sendmsg_copy_hdr(struct io struct io_async_msghdr *iomsg) { struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg); +int ret; iomsg->msg.msg_name = &iomsg->addr; iomsg->free_iov = iomsg->fast_iov; -return sendmsg_copy_msghdr (&iomsg->msg, sr->umsg, sr->msg_flags, + ret =sendmsg_copy_msghdr (&iomsg->msg, sr->umsg, sr->msg_flags, &iomsg->free_iov); +/* save msg_control as sys_sendmsg() overwrites it */ + sr->msg_control = iomsg->msg.msg_control; +return ret; }int io_send_prep_async (struct io_kiocb *req)
@@ -284,6 +289,7 @@ int io_sendmsg(struct io_kiocb *req, unsif (req_has_async_data (req)) { kmsg = req->async_data; + kmsg->msg.msg_control = sr->msg_control; }else { ret =io_sendmsg_copy_hdr (req, &iomsg);if (ret)
Greg Kroah-Hartman
maintainerPATCH 55/166 kexec: support purgatories with .text.hot sections
In reply to Greg Kroah-HartmanFrom: Ricardo Ribalda <[email protected]>
commit 8652d44f466ad5772e7d1756e9457046189b0dfc upstream.
Patch series "kexec: Fix kexec_file_load for llvm16 with PGO", v7.
When upreving llvm I realised that kexec stopped working on my test platform.
The reason seems to be that due to PGO there are multiple .text sections on the purgatory, and kexec does not supports that.
This patch (of 4):
Clang16 links the purgatory text in two sections when PGO is in use:
[ 1] .text PROGBITS 0000000000000000 00000040
00000000000011a1 0000000000000000 AX 0 0 16
[ 2] .rela.text RELA 0000000000000000 00003498
0000000000000648 0000000000000018 I 24 1 8
...
[17] .text.hot. PROGBITS 0000000000000000 00003220
000000000000020b 0000000000000000 AX 0 0 1
[18] .rela.text.hot. RELA 0000000000000000 00004428
0000000000000078 0000000000000018 I 24 17 8And both of them have their range [sh_addr ... sh_addr+sh_size] on the area pointed by e_entry.
This causes that image->start is calculated twice, once for .text and another time for .text.hot. The second calculation leaves image->start in a random location.
Because of this, the system crashes immediately after:
kexec_core: Starting new kernel
--- kernel/kexec_file.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
kernel/kexec_file.c +13 -1
@@ -898,10 +898,22 @@ static int kexec_purgatory_setup_sechdrs } offset =ALIGN (offset, align); + +/* +* Check if the segment contains the entry point, if so, +* calculate the value of image->start based on it. +* If the compiler has produced more than one .text section +* (Eg: .text.hot), they are generally after the main .text +* section, and they shall not be used to calculate +* image->start. So do not re-calculate image->start if it +* is not set to the initial value, and warn the user so they +* have a chance to fix their purgatory's linker script. +*/ if (sechdrs[i].sh_flags &SHF_EXECINSTR && pi->ehdr->e_entry >= sechdrs[i].sh_addr && pi->ehdr->e_entry < (sechdrs[i].sh_addr - + sechdrs[i].sh_size)) { + + sechdrs[i].sh_size) && + !WARN_ON (kbuf->image->start != pi->ehdr->e_entry)) { kbuf->image->start -= sechdrs[i].sh_addr; kbuf->image->start += kbuf->mem + offset; }
Greg Kroah-Hartman
maintainerPATCH 56/166 x86/purgatory: remove PGO flags
In reply to Greg Kroah-HartmanFrom: Ricardo Ribalda <[email protected]>
commit 97b6b9cbba40a21c1d9a344d5c1991f8cfbf136e upstream.
If profile-guided optimization is enabled, the purgatory ends up with multiple .text sections. This is not supported by kexec and crashes the system.
--- arch/x86/purgatory/Makefile | 5 +++++ 1 file changed, 5 insertions(+)
arch/x86/purgatory/Makefile +5 -0
@@ -14,6 +14,11 @@ $(obj)/sha256.o: $(srctree)/lib/crypto/s CFLAGS_sha256.o := -D__DISABLE_EXPORTS +# When profile-guided optimization is enabled, llvm emits two different +# overlapping text sections, which is not supported by kexec. Remove profile +# optimization flags. +KBUILD_CFLAGS := $(filter-out -fprofile-sample-use=% -fprofile-use=%,$(KBUILD_CFLAGS)) + # When linking purgatory.ro with -r unresolved symbols are not checked, # also link a purgatory.chk binary without -r to check for unresolved symbols. PURGATORY_LDFLAGS := -e purgatory_start -z nodefaultlib
Greg Kroah-Hartman
maintainerPATCH 57/166 riscv/purgatory: remove PGO flags
In reply to Greg Kroah-HartmanFrom: Ricardo Ribalda <[email protected]>
commit 88ac3bbcf73853880a9b2a65c67e6854390741cc upstream.
If profile-guided optimization is enabled, the purgatory ends up with multiple .text sections. This is not supported by kexec and crashes the system.
--- arch/riscv/purgatory/Makefile | 5 +++++ 1 file changed, 5 insertions(+)
arch/riscv/purgatory/Makefile +5 -0
@@ -25,6 +25,11 @@ CFLAGS_sha256.o := -D__DISABLE_EXPORTS CFLAGS_string.o := -D__DISABLE_EXPORTS CFLAGS_ctype.o := -D__DISABLE_EXPORTS +# When profile-guided optimization is enabled, llvm emits two different +# overlapping text sections, which is not supported by kexec. Remove profile +# optimization flags. +KBUILD_CFLAGS := $(filter-out -fprofile-sample-use=% -fprofile-use=%,$(KBUILD_CFLAGS)) + # When linking purgatory.ro with -r unresolved symbols are not checked, # also link a purgatory.chk binary without -r to check for unresolved symbols. PURGATORY_LDFLAGS := -e purgatory_start -z nodefaultlib
Greg Kroah-Hartman
maintainerPATCH 58/166 powerpc/purgatory: remove PGO flags
In reply to Greg Kroah-HartmanFrom: Ricardo Ribalda <[email protected]>
commit 20188baceb7a1463dc0bcb0c8678b69c2f447df6 upstream.
If profile-guided optimization is enabled, the purgatory ends up with multiple .text sections. This is not supported by kexec and crashes the system.
--- arch/powerpc/purgatory/Makefile | 5 +++++ 1 file changed, 5 insertions(+)
arch/powerpc/purgatory/Makefile +5 -0
@@ -4,6 +4,11 @@ KASAN_SANITIZE := n targets += trampoline_$(BITS).o purgatory.ro +# When profile-guided optimization is enabled, llvm emits two different +# overlapping text sections, which is not supported by kexec. Remove profile +# optimization flags. +KBUILD_CFLAGS := $(filter-out -fprofile-sample-use=% -fprofile-use=%,$(KBUILD_CFLAGS)) + LDFLAGS_purgatory.ro := -e purgatory_start -r --no-undefined $(obj)/purgatory.ro: $(obj)/trampoline_$(BITS).o FORCE
Greg Kroah-Hartman
maintainerPATCH 59/166 btrfs: do not ASSERT() on duplicated global roots
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
commit 745806fb4554f334e6406fa82b328562aa48f08f upstream.
[BUG]
Syzbot reports a reproducible ASSERT() when using rescue=usebackuproot mount option on a corrupted fs.
The full report can be found here:
https://syzkaller.appspot.com/bug?extid=c4614eae20a166c25bf0
BTRFS error (device loop0: state C): failed to load root csum assertion failed: !tmp, in fs/btrfs/disk-io.c:1103
------------[ cut here ]------------ kernel BUG at fs/btrfs/ctree.h:3664! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 3608 Comm: syz-executor356 Not tainted 6.0.0-rc7-syzkaller-00029-g3800a713b607 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 RIP: 0010:assertfail+0x1a/0x1c fs/btrfs/ctree.h:3663 RSP: 0018:ffffc90003aaf250 EFLAGS: 00010246 RAX: 0000000000000032 RBX: 0000000000000000 RCX: f21c13f886638400 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: ffff888021c640a0 R08: ffffffff816bd38d R09: ffffed10173667f1 R10: ffffed10173667f1 R11: 1ffff110173667f0 R12: dffffc0000000000 R13: ffff8880229c21f7 R14: ffff888021c64060 R15: ffff8880226c0000 FS: 0000555556a73300(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055a2637d7a00 CR3: 00000000709c4000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> btrfs_global_root_insert+0x1a7/0x1b0 fs/btrfs/disk-io.c:1103 load_global_roots_objectid+0x482/0x8c0 fs/btrfs/disk-io.c:2467 load_global_roots fs/btrfs/disk-io.c:2501 [inline] btrfs_read_roots fs/btrfs/disk-io.c:2528 [inline] init_tree_roots+0xccb/0x203c fs/btrfs/disk-io.c:2939 open_ctree+0x1e53/0x33df fs/btrfs/disk-io.c:3574 btrfs_fill_super+0x1c6/0x2d0 fs/btrfs/super.c:1456 btrfs_mount_root+0x885/0x9a0 fs/btrfs/super.c:1824 legacy_get_tree+0xea/0x180 fs/fs_context.c:610 vfs_get_tree+0x88/0x270 fs/super.c:1530 fc_mount fs/namespace.c:1043 [inline] vfs_kern_mount+0xc9/0x160 fs/namespace.c:1073 btrfs_mount+0x3d3/0xbb0 fs/btrfs/super.c:1884
[CAUSE]
Since the introduction of global roots, we handle csum/extent/free-space-tree roots as global roots, even if no extent-tree-v2 feature is enabled.
So for regular csum/extent/fst roots, we load them into fs_info::global_root_tree rb tree.
And we should not expect any conflicts in that rb tree, thus we have an ASSERT() inside btrfs_global_root_insert().
But rescue=usebackuproot can break the assumption, as we will try to load those trees again and again as long as we have bad roots and have backup roots slot remaining.
So in that case we can have conflicting roots in the rb tree, and triggering the ASSERT() crash.
[FIX]
We can safely remove that ASSERT(), as the caller will properly put the offending root.
To make further debugging easier, also add two explicit error messages:
- Error message for conflicting global roots
- Error message when using backup roots slot
--- fs/btrfs/disk-io.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
fs/btrfs/disk-io.c +8 -2
@@ -1098,13 +1098,18 @@ int btrfs_global_root_insert(struct btrf {struct btrfs_fs_info *fs_info = root->fs_info;struct rb_node *tmp; +int ret =0 ;write_lock (&fs_info->global_root_lock); tmp =rb_find_add (&root->rb_node, &fs_info->global_root_tree, global_root_cmp);write_unlock (&fs_info->global_root_lock); -ASSERT (!tmp); -return tmp ? -EEXIST :0 ; +if (tmp) { + ret = -EEXIST ; +btrfs_warn (fs_info,"global root %llu %llu already exists" , + root->root_key.objectid, root->root_key.offset); + } +return ret; }void btrfs_global_root_delete (struct btrfs_root *root)
@@ -2934,6 +2939,7 @@ static int __cold init_tree_roots(struct/* We can't trust the free space cache either */ btrfs_set_opt (fs_info->mount_opt,CLEAR_CACHE ); +btrfs_warn (fs_info,"try to load backup roots slot %d" , i); ret =read_backup_root (fs_info, i); backup_index = ret;if (ret <0 )
Greg Kroah-Hartman
maintainerPATCH 60/166 btrfs: fix iomap_begin length for nocow writes
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
commit 7833b865953c8e62abc76a3261c04132b2fb69de upstream.
can_nocow_extent can reduce the len passed in, which needs to be propagated to btrfs_dio_iomap_begin so that iomap does not submit more data then is mapped.
This problems exists since the btrfs_get_blocks_direct helper was added in commit c5794e51784a ("btrfs: Factor out write portion of btrfs_get_blocks_direct"), but the ordered_extent splitting added in commit b73a6fd1b1ef ("btrfs: split partial dio bios before submit") added a WARN_ON that made a syzkaller test fail.
--- fs/btrfs/inode.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
fs/btrfs/inode.c +12 -6
@@ -7387,7 +7387,7 @@ static struct extent_map *create_io_em(sstatic int btrfs_get_blocks_direct_write (struct extent_map **map,struct inode *inode,struct btrfs_dio_data *dio_data, -u64 start,u64 len, +u64 start,u64 *lenp,unsigned int iomap_flags) {const bool nowait = (iomap_flags &IOMAP_NOWAIT );
@@ -7398,6 +7398,7 @@ static int btrfs_get_blocks_direct_writestruct btrfs_block_group *bg;bool can_nocow = false;bool space_reserved = false; +u64 len = *lenp;u64 prev_len;int ret =0 ;
@@ -7468,15 +7469,19 @@ static int btrfs_get_blocks_direct_writefree_extent_map (em); *map =NULL ; -if (nowait) -return -EAGAIN ; +if (nowait) { + ret = -EAGAIN ; + goto out; + }/* * If we could not allocate data space before locking the file * range and we can't do a NOCOW write, then we have to fail. */ -if (!dio_data->data_space_reserved) -return -ENOSPC ; +if (!dio_data->data_space_reserved) { + ret = -ENOSPC ; + goto out; + }/* * We have to COW and we have already reserved data space before,
@@ -7517,6 +7522,7 @@ out:btrfs_delalloc_release_extents (BTRFS_I (inode), len);btrfs_delalloc_release_metadata (BTRFS_I (inode), len, true); } + *lenp = len;return ret; }
@@ -7693,7 +7699,7 @@ static int btrfs_dio_iomap_begin(structif (write) { ret =btrfs_get_blocks_direct_write (&em, inode, dio_data, - start, len, flags); + start, &len, flags);if (ret <0 ) goto unlock_err; unlock_extents = true;
Greg Kroah-Hartman
maintainerPATCH 61/166 btrfs: can_nocow_file_extent should pass down args->strict from callers
In reply to Greg Kroah-HartmanFrom: Chris Mason <[email protected]>
commit deccae40e4b30f98837e44225194d80c8baf2233 upstream.
Commit 619104ba453ad0 ("btrfs: move common NOCOW checks against a file extent into a helper") changed our call to btrfs_cross_ref_exist() to always pass false for the 'strict' parameter. We're passing this down through the stack so that we can do a full check for cross references during swapfile activation.
With strict always false, this test fails:
btrfs subvol create swappy
chattr +C swappy
fallocate -l1G swappy/swapfile
chmod 600 swappy/swapfile
mkswap swappy/swapfile
btrfs subvol snap swappy swapsnap
btrfs subvol del -C swapsnap
btrfs fi sync /
sync;sync;sync
swapon swappy/swapfile
The fix is to just use args->strict, and everyone except swapfile activation is passing false.
--- fs/btrfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/inode.c +1 -1
@@ -1849,7 +1849,7 @@ static int can_nocow_file_extent(struct ret =btrfs_cross_ref_exist (root,btrfs_ino (inode), key->offset - args->extent_offset, - args->disk_bytenr, false, path); + args->disk_bytenr, args->strict, path);WARN_ON_ONCE (ret >0 && is_freespace_inode);if (ret !=0 ) goto out;
Greg Kroah-Hartman
maintainerPATCH 62/166 ALSA: usb-audio: Fix broken resume due to UAC3 power state
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 8ba61c9f6c9bdfbf9d197b0282641d24ae909778 upstream.
As reported in the bugzilla below, the PM resume of a UAC3 device may fail due to the incomplete power state change, stuck at D1. The reason is that the driver expects the full D0 power state change only at hw_params, while the normal PCM resume procedure doesn't call hw_params.
For fixing the bug, we add the same power state update to D0 at the prepare callback, which is certainly called by the resume procedure.
Note that, with this change, the power state change in the hw_params becomes almost redundant, since snd_usb_hw_params() doesn't touch the parameters (at least it tires so). But dropping it is still a bit risky (e.g. we have the media-driver binding), so I leave the D0 power state change in snd_usb_hw_params() as is for now.
--- sound/usb/pcm.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/usb/pcm.c +4 -0
@@ -650,6 +650,10 @@ static int snd_usb_pcm_prepare(struct sn goto unlock; } + ret =snd_usb_pcm_change_state (subs,UAC3_PD_STATE_D0 ); +if (ret <0 ) + goto unlock; + again:if (subs->sync_endpoint) { ret =snd_usb_endpoint_prepare (chip, subs->sync_endpoint);
Greg Kroah-Hartman
maintainerPATCH 63/166 ALSA: usb-audio: Add quirk flag for HEM devices to enable native DSD playback
In reply to Greg Kroah-HartmanFrom: Lukasz Tyl <[email protected]>
commit 122e2cb7e1a30438cc0e8bf70d4279db245d7d5b upstream.
This commit adds new DEVICE_FLG with QUIRK_FLAG_DSD_RAW and Vendor Id for HEM devices which supports native DSD. Prior to this change Linux kernel was not enabling native DSD playback for HEM devices, and as a result, DSD audio was being converted to PCM "on the fly". HEM devices, when connected to the system, would only play audio in PCM format, even if the source material was in DSD format. With the addition of new VENDOR_FLG in the quircks.c file, the devices are now correctly recognized, and raw DSD data is transmitted to the device, allowing for native DSD playback.
--- sound/usb/quirks.c | 2 ++ 1 file changed, 2 insertions(+)
sound/usb/quirks.c +2 -0
@@ -2191,6 +2191,8 @@ static const struct usb_audio_quirk_flag QUIRK_FLAG_DSD_RAW),VENDOR_FLG (0x2ab6 ,/* T+A devices */ QUIRK_FLAG_DSD_RAW ), +VENDOR_FLG (0x3336 ,/* HEM devices */ +QUIRK_FLAG_DSD_RAW ),VENDOR_FLG (0x3353 ,/* Khadas devices */ QUIRK_FLAG_DSD_RAW ), VENDOR_FLG(0x3842, /* EVGA */
Greg Kroah-Hartman
maintainerPATCH 64/166 dm thin metadata: check fail_io before using data_sm
In reply to Greg Kroah-HartmanFrom: Li Lingfeng <[email protected]>
commit cb65b282c9640c27d3129e2e04b711ce1b352838 upstream.
Must check pmd->fail_io before using pmd->data_sm since pmd->data_sm may be destroyed by other processes.
P1(kworker) P2(message)do_worker
process_prepared
process_prepared_discard_passdown_pt2
dm_pool_dec_data_range
pool_message
commit
dm_pool_commit_metadata
↓
// commit failed
metadata_operation_failed
abort_transaction
dm_pool_abort_metadata
__open_or_format_metadata
↓
dm_sm_disk_open
↓
// open failed
// pmd->data_sm is NULL
dm_sm_dec_blocks
↓
// try to access pmd->data_sm --> UAFAs shown above, if dm_pool_commit_metadata() and dm_pool_abort_metadata() fail in pool_message process, kworker may trigger UAF.
--- drivers/md/dm-thin-metadata.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-)
drivers/md/dm-thin-metadata.c +12 -8
@@ -1750,13 +1750,15 @@ int dm_thin_remove_range(struct dm_thin_int dm_pool_block_is_shared (struct dm_pool_metadata *pmd,dm_block_t b,bool *result) { -int r; +int r = -EINVAL ;uint32_t ref_count;down_read (&pmd->root_lock); - r =dm_sm_get_count (pmd->data_sm, b, &ref_count); -if (!r) - *result = (ref_count >1 ); +if (!pmd->fail_io) { + r =dm_sm_get_count (pmd->data_sm, b, &ref_count); +if (!r) + *result = (ref_count >1 ); + }up_read (&pmd->root_lock);return r;
@@ -1764,10 +1766,11 @@ int dm_pool_block_is_shared(struct dm_point dm_pool_inc_data_range (struct dm_pool_metadata *pmd,dm_block_t b,dm_block_t e) { -int r =0 ; +int r = -EINVAL ;pmd_write_lock (pmd); - r =dm_sm_inc_blocks (pmd->data_sm, b, e); +if (!pmd->fail_io) + r =dm_sm_inc_blocks (pmd->data_sm, b, e);pmd_write_unlock (pmd);return r;
@@ -1775,10 +1778,11 @@ int dm_pool_inc_data_range(struct dm_pooint dm_pool_dec_data_range (struct dm_pool_metadata *pmd,dm_block_t b,dm_block_t e) { -int r =0 ; +int r = -EINVAL ;pmd_write_lock (pmd); - r =dm_sm_dec_blocks (pmd->data_sm, b, e); +if (!pmd->fail_io) + r =dm_sm_dec_blocks (pmd->data_sm, b, e);pmd_write_unlock (pmd);return r;
Greg Kroah-Hartman
maintainerPATCH 65/166 dm thin: fix issue_discard to pass GFP_NOIO to __blkdev_issue_discard
In reply to Greg Kroah-HartmanFrom: Mike Snitzer <[email protected]>
commit 722d90822321497e2837cfc9000202e256e6b32f upstream.
issue_discard() passes GFP_NOWAIT to __blkdev_issue_discard() despite its code assuming bio_alloc() always succeeds.
Commit 3dba53a958a75 ("dm thin: use __blkdev_issue_discard for async discard support") clearly shows where things went bad:
Before commit 3dba53a958a75, dm-thin.c's open-coded __blkdev_issue_discard_async() properly handled using GFP_NOWAIT. Unfortunately __blkdev_issue_discard() doesn't and it was missed during review.
--- drivers/md/dm-thin.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/md/dm-thin.c +1 -2
@@ -398,8 +398,7 @@ static int issue_discard(struct discard_sector_t s =block_to_sectors (tc->pool, data_b);sector_t len =block_to_sectors (tc->pool, data_e - data_b); -return __blkdev_issue_discard (tc->pool_dev->bdev, s, len,GFP_NOWAIT , - &op->bio); +return __blkdev_issue_discard (tc->pool_dev->bdev, s, len,GFP_NOIO , &op->bio); }static void end_discard (struct discard_op *op,int r)
Greg Kroah-Hartman
maintainerPATCH 66/166 net: ethernet: stmicro: stmmac: fix possible memory leak in __stmmac_open
In reply to Greg Kroah-HartmanFrom: Christian Marangi <[email protected]>
commit 30134b7c47bd28fdb4db4d12aef824e0579cfee4 upstream.
Fix a possible memory leak in __stmmac_open when stmmac_init_phy fails. It's also needed to free everything allocated by stmmac_setup_dma_desc and not just the dma_conf struct.
Drop free_dma_desc_resources from __stmmac_open and correctly call free_dma_desc_resources on each user of __stmmac_open on error.
--- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +7 -2
@@ -3865,7 +3865,6 @@ irq_error:stmmac_hw_teardown (dev); init_error: -free_dma_desc_resources (priv, &priv->dma_conf);phylink_disconnect_phy (priv->phylink); init_phy_error:pm_runtime_put (priv->device);
@@ -3883,6 +3882,9 @@ static int stmmac_open(struct net_devicereturn PTR_ERR (dma_conf); ret =__stmmac_open (dev, dma_conf); +if (ret) +free_dma_desc_resources (priv, dma_conf); +kfree (dma_conf);return ret; }
@@ -5607,12 +5609,15 @@ static int stmmac_change_mtu(struct net_stmmac_release (dev); ret =__stmmac_open (dev, dma_conf); -kfree (dma_conf);if (ret) { +free_dma_desc_resources (priv, dma_conf); +kfree (dma_conf);netdev_err (priv->dev,"failed reopening the interface after MTU change\n" );return ret; } +kfree (dma_conf); +stmmac_set_rx_mode (dev); }
Greg Kroah-Hartman
maintainerPATCH 67/166 nouveau: fix client work fence deletion race
In reply to Greg Kroah-HartmanFrom: Dave Airlie <[email protected]>
commit c8a5d5ea3ba6a18958f8d76430e4cd68eea33943 upstream.
This seems to have existed for ever but is now more apparant after commit 9bff18d13473 ("drm/ttm: use per BO cleanup workers")
My analysis: two threads are running, one in the irq signalling the fence, in dma_fence_signal_timestamp_locked, it has done the DMA_FENCE_FLAG_SIGNALLED_BIT setting, but hasn't yet reached the callbacks.
The second thread in nouveau_cli_work_ready, where it sees the fence is signalled, so then puts the fence, cleanups the object and frees the work item, which contains the callback.
Thread one goes again and tries to call the callback and causes the use-after-free.
Proposed fix: lock the fence signalled check in nouveau_cli_work_ready, so either the callbacks are done or the memory is freed.
--- drivers/gpu/drm/nouveau/nouveau_drm.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
drivers/gpu/drm/nouveau/nouveau_drm.c +10 -4
@@ -139,10 +139,16 @@ nouveau_name(struct drm_device *dev)static inline bool nouveau_cli_work_ready (struct dma_fence *fence) { -if (!dma_fence_is_signaled (fence)) -return false; -dma_fence_put (fence); -return true; +bool ret = true; + +spin_lock_irq (fence->lock); +if (!dma_fence_is_signaled_locked (fence)) + ret = false; +spin_unlock_irq (fence->lock); + +if (ret == true) +dma_fence_put (fence); +return ret; } static void
Greg Kroah-Hartman
maintainerPATCH 68/166 RDMA/uverbs: Restrict usage of privileged QKEYs
In reply to Greg Kroah-HartmanFrom: Edward Srouji <[email protected]>
commit 0cadb4db79e1d9eea66711c4031e435c2191907e upstream.
According to the IB specification rel-1.6, section 3.5.3:
"QKEYs with the most significant bit set are considered controlled QKEYs, and a HCA does not allow a consumer to arbitrarily specify a controlled QKEY."
Thus, block non-privileged users from setting such a QKEY.
--- drivers/infiniband/core/uverbs_cmd.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/infiniband/core/uverbs_cmd.c +6 -1
@@ -1850,8 +1850,13 @@ static int modify_qp(struct uverbs_attr_ attr->path_mtu = cmd->base.path_mtu;if (cmd->base.attr_mask &IB_QP_PATH_MIG_STATE ) attr->path_mig_state = cmd->base.path_mig_state; -if (cmd->base.attr_mask &IB_QP_QKEY ) +if (cmd->base.attr_mask &IB_QP_QKEY ) { +if (cmd->base.qkey &IB_QP_SET_QKEY && !capable (CAP_NET_RAW )) { + ret = -EPERM ; + goto release_qp; + } attr->qkey = cmd->base.qkey; + }if (cmd->base.attr_mask &IB_QP_RQ_PSN ) attr->rq_psn = cmd->base.rq_psn;if (cmd->base.attr_mask &IB_QP_SQ_PSN )
Greg Kroah-Hartman
maintainerPATCH 69/166 drm/amdgpu: vcn_4_0 set instance 0 init sched score to 1
In reply to Greg Kroah-HartmanFrom: Sonny Jiang <[email protected]>
commit 9db5ec1ceb5303398ec4f899d691073d531257c3 upstream.
Only vcn0 can process AV1 codecx. In order to use both vcn0 and vcn1 in h264/265 transcode to AV1 cases, set vcn0 sched score to 1 at initialization time.
--- drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c +5 -1
@@ -117,7 +117,11 @@ static int vcn_v4_0_sw_init(void *handleif (adev->vcn.harvest_config & (1 << i))continue ; -atomic_set (&adev->vcn.inst[i].sched_score,0 ); +/* Init instance 0 sched_score to 1, so it's scheduled after other instances */ +if (i ==0 ) +atomic_set (&adev->vcn.inst[i].sched_score,1 ); +else +atomic_set (&adev->vcn.inst[i].sched_score,0 );/* VCN UNIFIED TRAP */ r = amdgpu_irq_add_id(adev, amdgpu_ih_clientid_vcns[i],
Greg Kroah-Hartman
maintainerPATCH 70/166 net: usb: qmi_wwan: add support for Compal RXM-G1
In reply to Greg Kroah-HartmanFrom: Wes Huang <[email protected]>
commit 863199199713908afaa47ba09332b87621c12496 upstream.
Add support for Compal RXM-G1 which is based on Qualcomm SDX55 chip. This patch adds support for two compositions:
0x9091: DIAG + MODEM + QMI_RMNET + ADB 0x90db: DIAG + DUN + RMNET + DPL + QDSS(Trace) + ADB
T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=05c6 ProdID=9091 Rev= 4.14 S: Manufacturer=QCOM S: Product=SDXPRAIRIE-MTP _SN:719AB680 S: SerialNumber=719ab680 C:* #Ifs= 4 Cfg#= 1 Atr=80 MxPwr=896mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=(none) E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=84(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0 D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1 P: Vendor=05c6 ProdID=90db Rev= 4.14 S: Manufacturer=QCOM S: Product=SDXPRAIRIE-MTP _SN:719AB680 S: SerialNumber=719ab680 C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=896mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=(none) E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=84(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
E: Ad=8f(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:* If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
--- drivers/net/usb/qmi_wwan.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/usb/qmi_wwan.c +2 -0
@@ -1219,7 +1219,9 @@ static const struct usb_device_id produc {QMI_FIXED_INTF(0x05c6, 0x9080, 8)}, {QMI_FIXED_INTF(0x05c6, 0x9083, 3)}, {QMI_FIXED_INTF(0x05c6, 0x9084, 4)}, + {QMI_QUIRK_SET_DTR(0x05c6, 0x9091, 2)}, /* Compal RXM-G1 */ {QMI_FIXED_INTF(0x05c6, 0x90b2, 3)}, /* ublox R410M */ + {QMI_QUIRK_SET_DTR(0x05c6, 0x90db, 2)}, /* Compal RXM-G1 */ {QMI_FIXED_INTF(0x05c6, 0x920d, 0)}, {QMI_FIXED_INTF(0x05c6, 0x920d, 5)}, {QMI_QUIRK_SET_DTR(0x05c6, 0x9625, 4)}, /* YUGA CLM920-NC5 */
Greg Kroah-Hartman
maintainerPATCH 71/166 drm/amd/display: edp do not add non-edid timings
In reply to Greg Kroah-HartmanFrom: Hersen Wu <[email protected]>
commit e749dd10e5f292061ad63d2b030194bf7d7d452c upstream.
[Why] most edp support only timings from edid. applying non-edid timings, especially those timings out of edp bandwidth, may damage edp.
[How] do not add non-edid timings for edp.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +7 -1
@@ -6942,7 +6942,13 @@ static int amdgpu_dm_connector_get_modesdrm_add_modes_noedid (connector,640 ,480 ); }else {amdgpu_dm_connector_ddc_get_modes (connector, edid); -amdgpu_dm_connector_add_common_modes (encoder, connector); +/* most eDP supports only timings from its edid, +* usually only detailed timings are available +* from eDP edid. timings which are not from edid +* may damage eDP +*/ +if (connector->connector_type != DRM_MODE_CONNECTOR_eDP) +amdgpu_dm_connector_add_common_modes (encoder, connector);amdgpu_dm_connector_add_freesync_modes (connector, edid); }amdgpu_dm_fbc_init (connector);
Greg Kroah-Hartman
maintainerPATCH 72/166 drm/amd: Make sure image is written to trigger VBIOS image update flow
In reply to Greg Kroah-HartmanFrom: Mario Limonciello <[email protected]>
commit 3eb1a3a04056ba3df3205e169b8acc9da0c65a94 upstream.
The VBIOS image update flow requires userspace to:
1) Write the image to psp_vbflash
2) Read psp_vbflash
3) Poll psp_vbflash_status to check for completion
If userspace reads psp_vbflash before writing an image, it's possible that it causes problems that can put the dGPU into an invalid state.
Explicitly check that an image has been written before letting a read succeed.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +3 -0
@@ -3550,6 +3550,9 @@ static ssize_t amdgpu_psp_vbflash_read(svoid *fw_pri_cpu_addr;int ret; +if (adev->psp.vbflash_image_size ==0 ) +return -EINVAL ; +dev_info (adev->dev,"VBIOS flash to PSP started" ); ret = amdgpu_bo_create_kernel(adev, adev->psp.vbflash_image_size,
Greg Kroah-Hartman
maintainerPATCH 73/166 drm/amd: Tighten permissions on VBIOS flashing attributes
In reply to Greg Kroah-HartmanFrom: Mario Limonciello <[email protected]>
commit 7ab1a4913d0051cf5196ef7987b5fa42c25e13b6 upstream.
Non-root users shouldn't be able to try to trigger a VBIOS flash or query the flashing status. This should be reserved for users with the appropriate permissions.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +2 -2
@@ -3604,13 +3604,13 @@ static ssize_t amdgpu_psp_vbflash_status }static const struct bin_attribute psp_vbflash_bin_attr = { - .attr = {.name ="psp_vbflash" , .mode =0664 }, + .attr = {.name ="psp_vbflash" , .mode =0660 }, .size =0 , .write = amdgpu_psp_vbflash_write, .read = amdgpu_psp_vbflash_read, }; -static DEVICE_ATTR(psp_vbflash_status, 0444, amdgpu_psp_vbflash_status, NULL); +static DEVICE_ATTR(psp_vbflash_status, 0440, amdgpu_psp_vbflash_status, NULL);int amdgpu_psp_sysfs_init (struct amdgpu_device *adev) {
Greg Kroah-Hartman
maintainerPATCH 74/166 drm/amd/pm: workaround for compute workload type on some skus
In reply to Greg Kroah-HartmanFrom: Kenneth Feng <[email protected]>
commit 7ca302d488f80cf4529620acc1c545f9022d8bb8 upstream.
On smu 13.0.0, the compute workload type cannot be set on all the skus due to some other problems. This workaround is to make sure compute workload type can also run on some specific skus.
v2: keep the variable consistent
--- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 33 +++++++++++++++++-- 1 file changed, 31 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c +31 -2
@@ -1675,10 +1675,39 @@ static int smu_v13_0_0_set_power_profile } } -/* conv PP_SMC_POWER_PROFILE* to WORKLOAD_PPLIB_*_BIT */ - workload_type =smu_cmn_to_asic_specific_index (smu, +if (smu->power_profile_mode ==PP_SMC_POWER_PROFILE_COMPUTE && + (((smu->adev->pdev->device ==0x744C ) && (smu->adev->pdev->revision ==0xC8 )) || + ((smu->adev->pdev->device ==0x744C ) && (smu->adev->pdev->revision ==0xCC )))) { + ret =smu_cmn_update_table (smu, +SMU_TABLE_ACTIVITY_MONITOR_COEFF , +WORKLOAD_PPLIB_COMPUTE_BIT , + (void *)(&activity_monitor_external), + false); +if (ret) { +dev_err (smu->adev->dev,"[%s] Failed to get activity monitor!" , __func__); +return ret; + } + + ret =smu_cmn_update_table (smu, +SMU_TABLE_ACTIVITY_MONITOR_COEFF , +WORKLOAD_PPLIB_CUSTOM_BIT , + (void *)(&activity_monitor_external), + true); +if (ret) { +dev_err (smu->adev->dev,"[%s] Failed to set activity monitor!" , __func__); +return ret; + } + + workload_type =smu_cmn_to_asic_specific_index (smu, +CMN2ASIC_MAPPING_WORKLOAD , +PP_SMC_POWER_PROFILE_CUSTOM ); + }else { +/* conv PP_SMC_POWER_PROFILE* to WORKLOAD_PPLIB_*_BIT */ + workload_type =smu_cmn_to_asic_specific_index (smu,CMN2ASIC_MAPPING_WORKLOAD , smu->power_profile_mode); + } +if (workload_type <0 )return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 75/166 drm/amdgpu: add missing radeon secondary PCI ID
In reply to Greg Kroah-HartmanFrom: Alex Deucher <[email protected]>
commit e61f67749b351c19455ce3085af2ae9af80023bc upstream.
0x5b70 is a missing RV370 secondary id. Add it so we don't try and probe it with amdgpu.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +1 -0
@@ -1605,6 +1605,7 @@ static const u16 amdgpu_unsupported_pcii0x5874 ,0x5940 ,0x5941 , +0x5b70 ,0x5b72 ,0x5b73 , 0x5b74,
Greg Kroah-Hartman
maintainerPATCH 76/166 ALSA: hda/realtek: Add a quirk for Compaq N14JP6
In reply to Greg Kroah-HartmanFrom: Edson Juliano Drosdeck <[email protected]>
commit a2a871483161014f1bcc4e9a04354b01aa77cedb upstream.
Add a quirk for Compaq N14JP6 to fixup ALC897 headset MIC no sound.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -11738,6 +11738,7 @@ static const struct snd_pci_quirk alc662SND_PCI_QUIRK (0x1b0a ,0x01b8 ,"ACER Veriton" ,ALC662_FIXUP_ACER_VERITON ),SND_PCI_QUIRK (0x1b35 ,0x1234 ,"CZC ET26" ,ALC662_FIXUP_CZC_ET26 ),SND_PCI_QUIRK (0x1b35 ,0x2206 ,"CZC P10T" ,ALC662_FIXUP_CZC_P10T ), +SND_PCI_QUIRK (0x1c6c ,0x1239 ,"Compaq N14JP6-V2" ,ALC897_FIXUP_HP_HSMIC_VERB ), #if 0/* Below is a quirk table taken from the old code.
Greg Kroah-Hartman
maintainerPATCH 77/166 thunderbolt: Do not touch CL state configuration during discovery
In reply to Greg Kroah-HartmanFrom: Mika Westerberg <[email protected]>
commit 3fe95742af29b8b4eccab2ba94bc521805c6e10c upstream.
If the boot firmware has already established tunnels, especially ones that have special requirements from the link such as DisplayPort, we should not blindly enable CL states (nor change the TMU configuration). Otherwise the existing tunnels may not work as expected.
For this reason, skip the CL state enabling when we go over the existing topology. This will also keep the TMU settings untouched because we do not change the TMU configuration when CL states are not enabled.
--- drivers/thunderbolt/tb.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
drivers/thunderbolt/tb.c +12 -5
@@ -607,6 +607,7 @@ static void tb_scan_port(struct tb_port {struct tb_cm *tcm =tb_priv (port->sw->tb);struct tb_port *upstream_port; +bool discovery = false;struct tb_switch *sw;int ret;
@@ -674,8 +675,10 @@ static void tb_scan_port(struct tb_port* tunnels and know which switches were authorized already by * the boot firmware. */ -if (!tcm->hotplug_active) +if (!tcm->hotplug_active) {dev_set_uevent_suppress (&sw->dev, true); + discovery = true; + }/* * At the moment Thunderbolt 2 and beyond (devices with LC) we
@@ -705,10 +708,14 @@ static void tb_scan_port(struct tb_port* CL0s and CL1 are enabled and supported together. * Silently ignore CLx enabling in case CLx is not supported. */ - ret =tb_switch_enable_clx (sw,TB_CL1 ); -if (ret && ret != -EOPNOTSUPP ) -tb_sw_warn (sw,"failed to enable %s on upstream port\n" , -tb_switch_clx_name (TB_CL1 )); +if (discovery) { +tb_sw_dbg (sw,"discovery, not touching CL states\n" ); + }else { + ret =tb_switch_enable_clx (sw,TB_CL1 ); +if (ret && ret != -EOPNOTSUPP ) +tb_sw_warn (sw,"failed to enable %s on upstream port\n" , +tb_switch_clx_name (TB_CL1 )); + }if (tb_switch_is_clx_enabled (sw,TB_CL1 ))/*
Greg Kroah-Hartman
maintainerPATCH 78/166 thunderbolt: dma_test: Use correct value for absent rings when creating paths
In reply to Greg Kroah-HartmanFrom: Mika Westerberg <[email protected]>
commit 70c2e03e9aaf17496c63f6e42333c012f5ae5307 upstream.
Both tb_xdomain_enable_paths() and tb_xdomain_disable_paths() expect -1, not 0, if the corresponding ring is not needed. For this reason change the driver to use correct value for the rings that are not needed.
--- drivers/thunderbolt/dma_test.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/thunderbolt/dma_test.c +4 -4
@@ -192,9 +192,9 @@ static int dma_test_start_rings(struct d } ret =tb_xdomain_enable_paths (dt->xd, dt->tx_hopid, - dt->tx_ring ? dt->tx_ring->hop :0 , + dt->tx_ring ? dt->tx_ring->hop :-1 , dt->rx_hopid, - dt->rx_ring ? dt->rx_ring->hop :0 ); + dt->rx_ring ? dt->rx_ring->hop :-1 );if (ret) {dma_test_free_rings (dt);return ret;
@@ -218,9 +218,9 @@ static void dma_test_stop_rings(struct dtb_ring_stop (dt->tx_ring); ret =tb_xdomain_disable_paths (dt->xd, dt->tx_hopid, - dt->tx_ring ? dt->tx_ring->hop :0 , + dt->tx_ring ? dt->tx_ring->hop :-1 , dt->rx_hopid, - dt->rx_ring ? dt->rx_ring->hop :0 ); + dt->rx_ring ? dt->rx_ring->hop :-1 );if (ret)dev_warn (&dt->svc->dev,"failed to disable DMA paths\n" );
Greg Kroah-Hartman
maintainerPATCH 79/166 thunderbolt: Mask ring interrupt on Intel hardware as well
In reply to Greg Kroah-HartmanFrom: Mika Westerberg <[email protected]>
commit 9f9666e65359d5047089aef97ac87c50f624ecb0 upstream.
When resuming from system sleep states the driver issues following warning on Intel hardware:
thunderbolt 0000:07:00.0: interrupt for TX ring 0 is already enabled
The reason for this is that the commit in question did not mask the ring interrupt on Intel hardware leaving the interrupt active. Fix this by masking it also in Intel hardware.
--- drivers/thunderbolt/nhi.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/thunderbolt/nhi.c +8 -3
@@ -56,9 +56,14 @@ static int ring_interrupt_index(const ststatic void nhi_mask_interrupt (struct tb_nhi *nhi,int mask,int ring) { -if (nhi->quirks &QUIRK_AUTO_CLEAR_INT ) -return ; -iowrite32 (mask, nhi->iobase +REG_RING_INTERRUPT_MASK_CLEAR_BASE + ring); +if (nhi->quirks &QUIRK_AUTO_CLEAR_INT ) { +u32 val; + + val =ioread32 (nhi->iobase +REG_RING_INTERRUPT_BASE + ring); +iowrite32 (val & ~mask, nhi->iobase +REG_RING_INTERRUPT_BASE + ring); + }else { +iowrite32 (mask, nhi->iobase +REG_RING_INTERRUPT_MASK_CLEAR_BASE + ring); + } }static void nhi_clear_interrupt (struct tb_nhi *nhi,int ring)
Greg Kroah-Hartman
maintainerPATCH 80/166 clk: pxa: fix NULL pointer dereference in pxa3xx_clk_update_accr
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit 23200a4c8ac284f8b4263d7cecaefecaa3ad6732 upstream.
sparse points out an embarrasing bug in an older patch of mine, which uses the register offset instead of an __iomem pointer:
drivers/clk/pxa/clk-pxa3xx.c:167:9: sparse: sparse: Using plain integer as NULL pointer
Unlike sparse, gcc and clang ignore this bug and fail to warn because a literal '0' is considered a valid representation of a NULL pointer.
--- drivers/clk/pxa/clk-pxa3xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/pxa/clk-pxa3xx.c +1 -1
@@ -164,7 +164,7 @@ void pxa3xx_clk_update_accr(u32 disable, accr &= ~disable; accr |= enable; -writel (accr,ACCR ); +writel (accr, clk_regs +ACCR );if (xclkcfg) __asm__("mcr p14, 0, %0, c6, c0, 0\n" : :"r" (xclkcfg));
Greg Kroah-Hartman
maintainerPATCH 81/166 USB: serial: option: add Quectel EM061KGL series
In reply to Greg Kroah-HartmanFrom: Jerry Meng <[email protected]>
commit f1832e2b5e498e258b090af3b065b85cf8cc5161 upstream.
Add support for Quectel EM061KGL series which are based on Qualcomm SDX12 chip:
EM061KGL_LTA(0x2c7c / 0x0123): MBIM + GNSS + DIAG + NMEA + AT + QDSS + DPL EM061KGL_LMS(0x2c7c / 0x0124): MBIM + GNSS + DIAG + NMEA + AT + QDSS + DPL EM061KGL_LWW(0x2c7c / 0x6008): MBIM + GNSS + DIAG + NMEA + AT + QDSS + DPL EM061KGL_LCN(0x2c7c / 0x6009): MBIM + GNSS + DIAG + NMEA + AT + QDSS + DPL
Above products use the exact same interface layout and option driver is for interfaces DIAG, NMEA and AT.
T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=6008 Rev= 5.04 S: Manufacturer=Quectel S: Product=Quectel EM061K-GL S: SerialNumber=f6fa08b6 C:* #Ifs= 8 Cfg#= 1 Atr=a0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none)
E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
E: Ad=8f(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/usb/serial/option.c +16 -0
@@ -248,6 +248,8 @@ static void option_instat_callback(struc#define QUECTEL_VENDOR_ID 0x2c7c/* These Quectel products use Quectel's vendor ID */ #define QUECTEL_PRODUCT_EC21 0x0121 +#define QUECTEL_PRODUCT_EM061K_LTA 0x0123 +#define QUECTEL_PRODUCT_EM061K_LMS 0x0124#define QUECTEL_PRODUCT_EC25 0x0125#define QUECTEL_PRODUCT_EG91 0x0191#define QUECTEL_PRODUCT_EG95 0x0195
@@ -266,6 +268,8 @@ static void option_instat_callback(struc#define QUECTEL_PRODUCT_RM520N 0x0801#define QUECTEL_PRODUCT_EC200U 0x0901#define QUECTEL_PRODUCT_EC200S_CN 0x6002 +#define QUECTEL_PRODUCT_EM061K_LWW 0x6008 +#define QUECTEL_PRODUCT_EM061K_LCN 0x6009#define QUECTEL_PRODUCT_EC200T 0x6026#define QUECTEL_PRODUCT_RM500K 0x7001
@@ -1189,6 +1193,18 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0x00, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0xff, 0x30) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LMS, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LMS, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LMS, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LTA, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LTA, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LTA, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LWW, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LWW, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LWW, 0xff, 0xff, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0xff, 0xff), .driver_info = RSVD(1) | RSVD(2) | RSVD(3) | RSVD(4) | NUMEP2 }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM12, 0xff, 0, 0) },
Greg Kroah-Hartman
maintainerPATCH 82/166 serial: lantiq: add missing interrupt ack
In reply to Greg Kroah-HartmanFrom: Bernhard Seibold <[email protected]>
commit 306320034e8fbe7ee1cc4f5269c55658b4612048 upstream.
Currently, the error interrupt is never acknowledged, so once active it will stay active indefinitely, causing the handler to be called in an infinite loop.
Message-ID: <[email protected]>
--- drivers/tty/serial/lantiq.c | 1 + 1 file changed, 1 insertion(+)
drivers/tty/serial/lantiq.c +1 -0
@@ -278,6 +278,7 @@ lqasc_err_int(int irq, void *_port)struct ltq_uart_port *ltq_port =to_ltq_uart_port (port);spin_lock_irqsave (<q_port->lock, flags); +__raw_writel (ASC_IRNCR_EIR , port->membase +LTQ_ASC_IRNCR );/* clear any pending interrupts */ asc_update_bits (0 ,ASCWHBSTATE_CLRPE |ASCWHBSTATE_CLRFE |ASCWHBSTATE_CLRROE , port->membase +LTQ_ASC_WHBSTATE );
Greg Kroah-Hartman
maintainerPATCH 83/166 usb: typec: ucsi: Fix command cancellation
In reply to Greg Kroah-HartmanFrom: Heikki Krogerus <[email protected]>
commit c4a8bfabefed706bb9150867db528ceefd5cb5fe upstream.
The Cancel command was passed to the write callback as the offset instead of as the actual command which caused NULL pointer dereference.
Message-ID: <[email protected]>
--- drivers/usb/typec/ucsi/ucsi.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/usb/typec/ucsi/ucsi.c +7 -4
@@ -132,10 +132,8 @@ static int ucsi_exec_command(struct ucsiif (ret)return ret; -if (cci &UCSI_CCI_BUSY ) { - ucsi->ops->async_write (ucsi,UCSI_CANCEL ,NULL ,0 ); -return -EBUSY ; - } +if (cmd !=UCSI_CANCEL && cci &UCSI_CCI_BUSY ) +return ucsi_exec_command (ucsi,UCSI_CANCEL );if (!(cci &UCSI_CCI_COMMAND_COMPLETE ))return -EIO ;
@@ -149,6 +147,11 @@ static int ucsi_exec_command(struct ucsireturn ucsi_read_error (ucsi); } +if (cmd ==UCSI_CANCEL && cci &UCSI_CCI_CANCEL_COMPLETE ) { + ret =ucsi_acknowledge_command (ucsi); +return ret ? ret : -EBUSY ; + } +return UCSI_CCI_LENGTH (cci); }
Greg Kroah-Hartman
maintainerPATCH 84/166 usb: typec: Fix fast_role_swap_current show function
In reply to Greg Kroah-HartmanFrom: Pavan Holla <[email protected]>
commit 92c9c3baad6b1fd584fbabeaa4756f9b77926cb5 upstream.
The current implementation mistakenly performs a & operation on the output of sysfs_emit. This patch performs the & operation before calling sysfs_emit.
Message-ID: <[email protected]>
--- drivers/usb/typec/pd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/typec/pd.c +1 -1
@@ -89,7 +89,7 @@ peak_current_show(struct device *dev, ststatic ssize_t fast_role_swap_current_show (struct device *dev,struct device_attribute *attr,char *buf) { -return sysfs_emit (buf,"%u\n" ,to_pdo (dev)->pdo >>PDO_FIXED_FRS_CURR_SHIFT ) &3 ; +return sysfs_emit (buf,"%u\n" , (to_pdo (dev)->pdo >>PDO_FIXED_FRS_CURR_SHIFT ) &3 ); }static DEVICE_ATTR_RO (fast_role_swap_current);
Greg Kroah-Hartman
maintainerPATCH 85/166 usb: gadget: udc: core: Offload usb_udc_vbus_handler processing
In reply to Greg Kroah-HartmanFrom: Badhri Jagan Sridharan <[email protected]>
commit 50966da807c81c5eb3bdfd392990fe0bba94d1ee upstream.
usb_udc_vbus_handler() can be invoked from interrupt context by irq handlers of the gadget drivers, however, usb_udc_connect_control() has to run in non-atomic context due to the following:
a. Some of the gadget driver implementations expect the ->pullup
callback to be invoked in non-atomic context.
b. usb_gadget_disconnect() acquires udc_lock which is a mutex.
Hence offload invocation of usb_udc_connect_control() to workqueue.
UDC should not be pulled up unless gadget driver is bound. The new flag "allow_connect" is now set by gadget_bind_driver() and cleared by gadget_unbind_driver(). This prevents work item to pull up the gadget even if queued when the gadget driver is already unbound.
Message-ID: <[email protected]>
--- drivers/usb/gadget/udc/core.c | 29 +++++++++++++++++++++++++++-- 1 file changed, 27 insertions(+), 2 deletions(-)
drivers/usb/gadget/udc/core.c +27 -2
@@ -37,6 +37,9 @@ static struct bus_type gadget_bus_type;* @vbus: for udcs who care about vbus status, this value is real vbus status; * for udcs who do not care about vbus status, this value is always true * @started: the UDC's started state. True if the UDC had started. +* @allow_connect: Indicates whether UDC is allowed to be pulled up. +* Set/cleared by gadget_(un)bind_driver() after gadget driver is bound or +* unbound. * * This represents the internal data structure which is used by the UDC-class * to hold information about udc driver and gadget together.
@@ -48,6 +51,8 @@ struct usb_udc {struct list_head list;bool vbus;bool started; +bool allow_connect; +struct work_struct vbus_work; };static struct class *udc_class;
@@ -679,7 +684,7 @@ int usb_gadget_connect(struct usb_gadget goto out; } -if (gadget->deactivated) { +if (gadget->deactivated || !gadget->udc->allow_connect) {/* * If gadget is deactivated we only save new state. * Gadget will be connected automatically after activation.
@@ -1059,6 +1064,13 @@ static void usb_udc_connect_control(struusb_gadget_disconnect (udc->gadget); } +static void vbus_event_work (struct work_struct *work) +{ + struct usb_udc *udc = container_of(work, struct usb_udc, vbus_work); + +usb_udc_connect_control (udc); +} +/** * usb_udc_vbus_handler - updates the udc core vbus status, and try to * connect or disconnect gadget
@@ -1067,6 +1079,14 @@ static void usb_udc_connect_control(stru* * The udc driver calls it when it wants to connect or disconnect gadget * according to vbus status. +* +* This function can be invoked from interrupt context by irq handlers of +* the gadget drivers, however, usb_udc_connect_control() has to run in +* non-atomic context due to the following: +* a. Some of the gadget driver implementations expect the ->pullup +* callback to be invoked in non-atomic context. +* b. usb_gadget_disconnect() acquires udc_lock which is a mutex. +* Hence offload invocation of usb_udc_connect_control() to workqueue. */ void usb_udc_vbus_handler (struct usb_gadget *gadget,bool status) {
@@ -1074,7 +1094,7 @@ void usb_udc_vbus_handler(struct usb_gadif (udc) { udc->vbus = status; -usb_udc_connect_control (udc); +schedule_work (&udc->vbus_work); } }EXPORT_SYMBOL_GPL (usb_udc_vbus_handler);
@@ -1301,6 +1321,7 @@ int usb_add_gadget(struct usb_gadget *gamutex_lock (&udc_lock);list_add_tail (&udc->list, &udc_list);mutex_unlock (&udc_lock); +INIT_WORK (&udc->vbus_work, vbus_event_work); ret =device_add (&udc->dev);if (ret)
@@ -1432,6 +1453,7 @@ void usb_del_gadget(struct usb_gadget *gflush_work (&gadget->work);device_del (&gadget->dev);ida_free (&gadget_id_numbers, gadget->id_number); +cancel_work_sync (&udc->vbus_work);device_unregister (&udc->dev); }EXPORT_SYMBOL_GPL (usb_del_gadget);
@@ -1500,6 +1522,7 @@ static int gadget_bind_driver(struct devif (ret) goto err_start;usb_gadget_enable_async_callbacks (udc); + udc->allow_connect = true;usb_udc_connect_control (udc);kobject_uevent (&udc->dev.kobj,KOBJ_CHANGE );
@@ -1531,6 +1554,8 @@ static void gadget_unbind_driver(structkobject_uevent (&udc->dev.kobj,KOBJ_CHANGE ); + udc->allow_connect = false; +cancel_work_sync (&udc->vbus_work);usb_gadget_disconnect (gadget);usb_gadget_disable_async_callbacks (udc);if (gadget->irq)
Greg Kroah-Hartman
maintainerPATCH 86/166 usb: gadget: udc: core: Prevent soft_connect_store() race
In reply to Greg Kroah-HartmanFrom: Badhri Jagan Sridharan <[email protected]>
commit 286d9975a838d0a54da049765fa1d1fb96b89682 upstream.
usb_udc_connect_control(), soft_connect_store() and usb_gadget_deactivate() can potentially race against each other to invoke usb_gadget_connect()/usb_gadget_disconnect(). To prevent this, guard udc->started, gadget->allow_connect, gadget->deactivate and gadget->connect with connect_lock so that ->pullup() is only invoked when the gadget is bound, started and not deactivated. The routines usb_gadget_connect_locked(), usb_gadget_disconnect_locked(), usb_udc_connect_control_locked(), usb_gadget_udc_start_locked(), usb_gadget_udc_stop_locked() are called with this lock held.
An earlier version of this commit was reverted due to the crash reported in
https://lore.kernel.org/all/[email protected]/.
commit 16737e78d190 ("usb: gadget: udc: core: Offload usb_udc_vbus_handler processing") addresses the crash reported.
Message-ID: <[email protected]>
--- drivers/usb/gadget/udc/core.c | 155 ++++++++++++++++++++++++++++-------------- 1 file changed, 106 insertions(+), 49 deletions(-)
drivers/usb/gadget/udc/core.c +106 -49
@@ -40,6 +40,11 @@ static struct bus_type gadget_bus_type;* @allow_connect: Indicates whether UDC is allowed to be pulled up. * Set/cleared by gadget_(un)bind_driver() after gadget driver is bound or * unbound. +* @connect_lock: protects udc->started, gadget->connect, +* gadget->allow_connect and gadget->deactivate. The routines +* usb_gadget_connect_locked(), usb_gadget_disconnect_locked(), +* usb_udc_connect_control_locked(), usb_gadget_udc_start_locked() and +* usb_gadget_udc_stop_locked() are called with this lock held. * * This represents the internal data structure which is used by the UDC-class * to hold information about udc driver and gadget together.
@@ -53,6 +58,7 @@ struct usb_udc {bool started;bool allow_connect;struct work_struct vbus_work; +struct mutex connect_lock; };static struct class *udc_class;
@@ -665,17 +671,8 @@ out: }EXPORT_SYMBOL_GPL (usb_gadget_vbus_disconnect); -/** -* usb_gadget_connect - software-controlled connect to USB host -* @gadget:the peripheral being connected -* -* Enables the D+ (or potentially D-) pullup. The host will start -* enumerating this gadget when the pullup is active and a VBUS session -* is active (the link is powered). -* -* Returns zero on success, else negative errno. -*/ -int usb_gadget_connect (struct usb_gadget *gadget) +static int usb_gadget_connect_locked (struct usb_gadget *gadget) + __must_hold(&gadget->udc->connect_lock) {int ret =0 ;
@@ -684,10 +681,12 @@ int usb_gadget_connect(struct usb_gadget goto out; } -if (gadget->deactivated || !gadget->udc->allow_connect) { +if (gadget->deactivated || !gadget->udc->allow_connect || !gadget->udc->started) {/* -* If gadget is deactivated we only save new state. -* Gadget will be connected automatically after activation. +* If the gadget isn't usable (because it is deactivated, +* unbound, or not yet started), we only save the new state. +* The gadget will be connected automatically when it is +* activated/bound/started. */ gadget->connected = true; goto out;
@@ -702,22 +701,31 @@ out:return ret; } -EXPORT_SYMBOL_GPL (usb_gadget_connect);/** -* usb_gadget_disconnect - software-controlled disconnect from USB host -* @gadget:the peripheral being disconnected -* -* Disables the D+ (or potentially D-) pullup, which the host may see -* as a disconnect (when a VBUS session is active). Not all systems -* support software pullup controls. +* usb_gadget_connect - software-controlled connect to USB host +* @gadget:the peripheral being connected * -* Following a successful disconnect, invoke the ->disconnect() callback -* for the current gadget driver so that UDC drivers don't need to. +* Enables the D+ (or potentially D-) pullup. The host will start +* enumerating this gadget when the pullup is active and a VBUS session +* is active (the link is powered). * * Returns zero on success, else negative errno. */ -int usb_gadget_disconnect (struct usb_gadget *gadget) +int usb_gadget_connect (struct usb_gadget *gadget) +{ +int ret; + +mutex_lock (&gadget->udc->connect_lock); + ret =usb_gadget_connect_locked (gadget); +mutex_unlock (&gadget->udc->connect_lock); + +return ret; +} +EXPORT_SYMBOL_GPL (usb_gadget_connect); + +static int usb_gadget_disconnect_locked (struct usb_gadget *gadget) + __must_hold(&gadget->udc->connect_lock) {int ret =0 ;
@@ -729,7 +737,7 @@ int usb_gadget_disconnect(struct usb_gadif (!gadget->connected) goto out; -if (gadget->deactivated) { +if (gadget->deactivated || !gadget->udc->started) {/* * If gadget is deactivated we only save new state. * Gadget will stay disconnected after activation.
@@ -752,6 +760,30 @@ out:return ret; } + +/** +* usb_gadget_disconnect - software-controlled disconnect from USB host +* @gadget:the peripheral being disconnected +* +* Disables the D+ (or potentially D-) pullup, which the host may see +* as a disconnect (when a VBUS session is active). Not all systems +* support software pullup controls. +* +* Following a successful disconnect, invoke the ->disconnect() callback +* for the current gadget driver so that UDC drivers don't need to. +* +* Returns zero on success, else negative errno. +*/ +int usb_gadget_disconnect (struct usb_gadget *gadget) +{ +int ret; + +mutex_lock (&gadget->udc->connect_lock); + ret =usb_gadget_disconnect_locked (gadget); +mutex_unlock (&gadget->udc->connect_lock); + +return ret; +}EXPORT_SYMBOL_GPL (usb_gadget_disconnect);/**
@@ -769,13 +801,14 @@ int usb_gadget_deactivate(struct usb_gad {int ret =0 ; +mutex_lock (&gadget->udc->connect_lock);if (gadget->deactivated) - goto out; + goto unlock;if (gadget->connected) { - ret =usb_gadget_disconnect (gadget); + ret =usb_gadget_disconnect_locked (gadget);if (ret) - goto out; + goto unlock;/* * If gadget was being connected before deactivation, we want
@@ -785,7 +818,8 @@ int usb_gadget_deactivate(struct usb_gad } gadget->deactivated = true; -out: +unlock: +mutex_unlock (&gadget->udc->connect_lock);trace_usb_gadget_deactivate (gadget, ret);return ret;
@@ -805,8 +839,9 @@ int usb_gadget_activate(struct usb_gadge {int ret =0 ; +mutex_lock (&gadget->udc->connect_lock);if (!gadget->deactivated) - goto out; + goto unlock; gadget->deactivated = false;
@@ -815,9 +850,11 @@ int usb_gadget_activate(struct usb_gadge* while it was being deactivated, we call usb_gadget_connect(). */ if (gadget->connected) - ret =usb_gadget_connect (gadget); + ret =usb_gadget_connect_locked (gadget); +mutex_unlock (&gadget->udc->connect_lock); -out: +unlock: +mutex_unlock (&gadget->udc->connect_lock);trace_usb_gadget_activate (gadget, ret);return ret;
@@ -1056,19 +1093,22 @@ EXPORT_SYMBOL_GPL(usb_gadget_set_state);/* ------------------------------------------------------------------------- */ -static void usb_udc_connect_control (struct usb_udc *udc) +/* Acquire connect_lock before calling this function. */ +static void usb_udc_connect_control_locked(struct usb_udc *udc) __must_hold(&udc->connect_lock) {if (udc->vbus) -usb_gadget_connect (udc->gadget); +usb_gadget_connect_locked (udc->gadget);else -usb_gadget_disconnect (udc->gadget); +usb_gadget_disconnect_locked (udc->gadget); }static void vbus_event_work (struct work_struct *work) { struct usb_udc *udc = container_of(work, struct usb_udc, vbus_work); -usb_udc_connect_control (udc); +mutex_lock (&udc->connect_lock); +usb_udc_connect_control_locked (udc); +mutex_unlock (&udc->connect_lock); }/**
@@ -1117,7 +1157,7 @@ void usb_gadget_udc_reset(struct usb_gadEXPORT_SYMBOL_GPL (usb_gadget_udc_reset);/** -* usb_gadget_udc_start - tells usb device controller to start up +* usb_gadget_udc_start_locked - tells usb device controller to start up * @udc: The UDC to be started * * This call is issued by the UDC Class driver when it's about
@@ -1128,8 +1168,11 @@ EXPORT_SYMBOL_GPL(usb_gadget_udc_reset);* necessary to have it powered on. * * Returns zero on success, else negative errno. +* +* Caller should acquire connect_lock before invoking this function. */ -static inline int usb_gadget_udc_start (struct usb_udc *udc) +static inline int usb_gadget_udc_start_locked (struct usb_udc *udc) + __must_hold(&udc->connect_lock) {int ret;
@@ -1146,7 +1189,7 @@ static inline int usb_gadget_udc_start(s }/** -* usb_gadget_udc_stop - tells usb device controller we don't need it anymore +* usb_gadget_udc_stop_locked - tells usb device controller we don't need it anymore * @udc: The UDC to be stopped * * This call is issued by the UDC Class driver after calling
@@ -1155,8 +1198,11 @@ static inline int usb_gadget_udc_start(s* The details are implementation specific, but it can go as * far as powering off UDC completely and disable its data * line pullups. +* +* Caller should acquire connect lock before invoking this function. */ -static inline void usb_gadget_udc_stop (struct usb_udc *udc) +static inline void usb_gadget_udc_stop_locked (struct usb_udc *udc) + __must_hold(&udc->connect_lock) {if (!udc->started) {dev_err (&udc->dev,"UDC had already stopped\n" );
@@ -1315,6 +1361,7 @@ int usb_add_gadget(struct usb_gadget *ga udc->gadget = gadget; gadget->udc = udc; +mutex_init (&udc->connect_lock); udc->started = false;
@@ -1518,12 +1565,16 @@ static int gadget_bind_driver(struct devif (ret) goto err_bind; - ret =usb_gadget_udc_start (udc); -if (ret) +mutex_lock (&udc->connect_lock); + ret =usb_gadget_udc_start_locked (udc); +if (ret) { +mutex_unlock (&udc->connect_lock); goto err_start; + }usb_gadget_enable_async_callbacks (udc); udc->allow_connect = true; -usb_udc_connect_control (udc); +usb_udc_connect_control_locked (udc); +mutex_unlock (&udc->connect_lock);kobject_uevent (&udc->dev.kobj,KOBJ_CHANGE );return 0 ;
@@ -1556,12 +1607,14 @@ static void gadget_unbind_driver(struct udc->allow_connect = false;cancel_work_sync (&udc->vbus_work); -usb_gadget_disconnect (gadget); +mutex_lock (&udc->connect_lock); +usb_gadget_disconnect_locked (gadget);usb_gadget_disable_async_callbacks (udc);if (gadget->irq)synchronize_irq (gadget->irq); udc->driver->unbind (gadget); -usb_gadget_udc_stop (udc); +usb_gadget_udc_stop_locked (udc); +mutex_unlock (&udc->connect_lock);mutex_lock (&udc_lock); driver->is_bound = false;
@@ -1647,11 +1700,15 @@ static ssize_t soft_connect_store(struct }if (sysfs_streq (buf,"connect" )) { -usb_gadget_udc_start (udc); -usb_gadget_connect (udc->gadget); +mutex_lock (&udc->connect_lock); +usb_gadget_udc_start_locked (udc); +usb_gadget_connect_locked (udc->gadget); +mutex_unlock (&udc->connect_lock); }else if (sysfs_streq (buf,"disconnect" )) { -usb_gadget_disconnect (udc->gadget); -usb_gadget_udc_stop (udc); +mutex_lock (&udc->connect_lock); +usb_gadget_disconnect_locked (udc->gadget); +usb_gadget_udc_stop_locked (udc); +mutex_unlock (&udc->connect_lock); }else {dev_err (dev,"unsupported command '%s'\n" , buf); ret = -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 87/166 USB: dwc3: qcom: fix NULL-deref on suspend
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit d2d69354226de0b333d4405981f3d9c41ba8430a upstream.
The Qualcomm dwc3 glue driver is currently accessing the driver data of the child core device during suspend and on wakeup interrupts. This is clearly a bad idea as the child may not have probed yet or could have been unbound from its driver.
The first such layering violation was part of the initial version of the driver, but this was later made worse when the hack that accesses the driver data of the grand child xhci device to configure the wakeup interrupts was added.
Fixing this properly is not that easily done, so add a sanity check to make sure that the child driver data is non-NULL before dereferencing it for now.
Note that this relies on subtleties like the fact that driver core is making sure that the parent is not suspended while the child is probing.
Message-ID: <[email protected]>
--- drivers/usb/dwc3/dwc3-qcom.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/usb/dwc3/dwc3-qcom.c +10 -1
@@ -308,7 +308,16 @@ static void dwc3_qcom_interconnect_exit(/* Only usable in contexts where the role can not change. */ static bool dwc3_qcom_is_host (struct dwc3_qcom *qcom) { -struct dwc3 *dwc =platform_get_drvdata (qcom->dwc3); +struct dwc3 *dwc; + +/* +* FIXME: Fix this layering violation. +*/ + dwc =platform_get_drvdata (qcom->dwc3); + +/* Core driver may not have probed yet. */ +if (!dwc) +return false;return dwc->xhci; }
Greg Kroah-Hartman
maintainerPATCH 88/166 USB: dwc3: fix use-after-free on core driver unbind
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit e3dbb657571509044be15184a13134fa7c1fdca1 upstream.
Some dwc3 glue drivers are currently accessing the driver data of the child core device directly, which is clearly a bad idea as the child may not have probed yet or may have been unbound from its driver.
As a workaround until the glue drivers have been fixed, clear the driver data pointer before allowing the glue parent device to runtime suspend to prevent its driver from accessing data that has been freed during unbind.
Message-ID: <[email protected]>
--- drivers/usb/dwc3/core.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/dwc3/core.c +5 -0
@@ -1982,6 +1982,11 @@ static int dwc3_remove(struct platform_dpm_runtime_allow (&pdev->dev);pm_runtime_disable (&pdev->dev);pm_runtime_put_noidle (&pdev->dev); +/* +* HACK: Clear the driver data, which is currently accessed by parent +* glue drivers, before allowing the parent to suspend. +*/ +platform_set_drvdata (pdev,NULL );pm_runtime_set_suspended (&pdev->dev);dwc3_free_event_buffers (dwc);
Greg Kroah-Hartman
maintainerPATCH 89/166 usb: dwc3: gadget: Reset num TRBs before giving back the request
In reply to Greg Kroah-HartmanFrom: Elson Roy Serrao <[email protected]>
commit 00f8205ffcf112dcef14f8151d78075d38d22c08 upstream.
Consider a scenario where cable disconnect happens when there is an active usb reqest queued to the UDC. As part of the disconnect we would issue an end transfer with no interrupt-on-completion before giving back this request. Since we are giving back the request without skipping TRBs the num_trbs field of dwc3_request still holds the stale value previously used. Function drivers re-use same request for a given bind-unbind session and hence their dwc3_request context gets preserved across cable disconnect/connect. When such a request gets re-queued after cable connect, we would increase the num_trbs field on top of the previous stale value thus incorrectly representing the number of TRBs used. Fix this by resetting num_trbs field before giving back the request.
Message-ID: <[email protected]>
--- drivers/usb/dwc3/gadget.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/dwc3/gadget.c +1 -0
@@ -180,6 +180,7 @@ static void dwc3_gadget_del_and_unmap_relist_del (&req->list); req->remaining =0 ; req->needs_extra_trb = false; + req->num_trbs =0 ;if (req->request.status == -EINPROGRESS ) req->request.status = status;
Greg Kroah-Hartman
maintainerPATCH 90/166 RDMA/rtrs: Fix the last iu->buf leak in err path
In reply to Greg Kroah-HartmanFrom: Li Zhijian <[email protected]>
[ Upstream commit 3bf3a7c6985c625f64e73baefdaa36f1c2045a29 ]
The last iu->buf will leak if ib_dma_mapping_error() fails.
--- drivers/infiniband/ulp/rtrs/rtrs.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/infiniband/ulp/rtrs/rtrs.c +3 -1
@@ -37,8 +37,10 @@ struct rtrs_iu *rtrs_iu_alloc(u32 iu_num, size_t size, gfp_t gfp_mask, goto err; iu->dma_addr =ib_dma_map_single (dma_dev, iu->buf, size, dir); -if (ib_dma_mapping_error (dma_dev, iu->dma_addr)) +if (ib_dma_mapping_error (dma_dev, iu->dma_addr)) { +kfree (iu->buf); goto err; + } iu->cqe.done = done; iu->size = size;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 91/166 RDMA/rtrs: Fix rxe_dealloc_pd warning
In reply to Greg Kroah-HartmanFrom: Li Zhijian <[email protected]>
[ Upstream commit 9c29c8c7df0688f358d2df5ddd16c97c2f7292b4 ]
In current design:
1. PD and clt_path->s.dev are shared among connections.
2. every con[n]'s cleanup phase will call destroy_con_cq_qp()
3. clt_path->s.dev will be always decreased in destroy_con_cq_qp(), and when clt_path->s.dev become zero, it will destroy PD.
4. when con[1] failed to create, con[1] will not take clt_path->s.dev, but it try to decreased clt_path->s.dev
So, in case create_cm(con[0]) succeeds but create_cm(con[1]) fails, destroy_con_cq_qp(con[1]) will be called first which will destroy the PD while this PD is still taken by con[0].
Here, we refactor the error path of create_cm() and init_conns(), so that we do the cleanup in the order they are created.
The warning occurs when destroying RXE PD whose reference count is not zero.
rnbd_client L597: Mapping device /dev/nvme0n1 on session client, (access_mode: rw, nr_poll_queues: 0)
------------[ cut here ]------------ WARNING: CPU: 0 PID: 26407 at drivers/infiniband/sw/rxe/rxe_pool.c:256 __rxe_cleanup+0x13a/0x170 [rdma_rxe] Modules linked in: rpcrdma rdma_ucm ib_iser rnbd_client libiscsi rtrs_client scsi_transport_iscsi rtrs_core rdma_cm iw_cm ib_cm crc32_generic rdma_rxe udp_tunnel ib_uverbs ib_core kmem device_dax nd_pmem dax_pmem nd_vme crc32c_intel fuse nvme_core nfit libnvdimm dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua dm_mirror dm_region_hash dm_log dm_mod CPU: 0 PID: 26407 Comm: rnbd-client.sh Kdump: loaded Not tainted 6.2.0-rc6-roce-flush+ #53 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:__rxe_cleanup+0x13a/0x170 [rdma_rxe] Code: 45 84 e4 0f 84 5a ff ff ff 48 89 ef e8 5f 18 71 f9 84 c0 75 90 be c8 00 00 00 48 89 ef e8 be 89 1f fa 85 c0 0f 85 7b ff ff ff <0f> 0b 41 bc ea ff ff ff e9 71 ff ff ff e8 84 7f 1f fa e9 d0 fe ff RSP: 0018:ffffb09880b6f5f0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff99401f15d6a8 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffffffffbac8234b RDI: 00000000ffffffff RBP: ffff99401f15d6d0 R08: 0000000000000001 R09: 0000000000000001 R10: 0000000000002d82 R11: 0000000000000000 R12: 0000000000000001 R13: ffff994101eff208 R14: ffffb09880b6f6a0 R15: 00000000fffffe00 FS: 00007fe113904740(0000) GS:ffff99413bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ff6cde656c8 CR3: 000000001f108004 CR4: 00000000001706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> rxe_dealloc_pd+0x16/0x20 [rdma_rxe] ib_dealloc_pd_user+0x4b/0x80 [ib_core] rtrs_ib_dev_put+0x79/0xd0 [rtrs_core] destroy_con_cq_qp+0x8a/0xa0 [rtrs_client] init_path+0x1e7/0x9a0 [rtrs_client] ? __pfx_autoremove_wake_function+0x10/0x10 ? lock_is_held_type+0xd7/0x130 ? rcu_read_lock_sched_held+0x43/0x80 ? pcpu_alloc+0x3dd/0x7d0 ? rtrs_clt_init_stats+0x18/0x40 [rtrs_client] rtrs_clt_open+0x24f/0x5a0 [rtrs_client] ? __pfx_rnbd_clt_link_ev+0x10/0x10 [rnbd_client] rnbd_clt_map_device+0x6a5/0xe10 [rnbd_client]
--- drivers/infiniband/ulp/rtrs/rtrs-clt.c | 55 +++++++++++--------------- 1 file changed, 23 insertions(+), 32 deletions(-)
drivers/infiniband/ulp/rtrs/rtrs-clt.c +23 -32
@@ -2042,6 +2042,7 @@ static int rtrs_clt_rdma_cm_handler(struct rdma_cm_id *cm_id,return 0 ; } +/* The caller should do the cleanup in case of error */ static int create_cm (struct rtrs_clt_con *con) {struct rtrs_path *s = con->c.path;
@@ -2064,14 +2065,14 @@ static int create_cm(struct rtrs_clt_con *con) err =rdma_set_reuseaddr (cm_id,1 );if (err !=0 ) {rtrs_err (s,"Set address reuse failed, err: %d\n" , err); - goto destroy_cm; +return err; } err =rdma_resolve_addr (cm_id, (struct sockaddr *)&clt_path->s.src_addr, (struct sockaddr *)&clt_path->s.dst_addr,RTRS_CONNECT_TIMEOUT_MS );if (err) {rtrs_err (s,"Failed to resolve address, err: %d\n" , err); - goto destroy_cm; +return err; }/* * Combine connection status and session events. This is needed
@@ -2086,29 +2087,15 @@ static int create_cm(struct rtrs_clt_con *con)if (err ==0 ) err = -ETIMEDOUT ;/* Timedout or interrupted */ - goto errr; - } -if (con->cm_err <0 ) { - err = con->cm_err; - goto errr; +return err; } -if (READ_ONCE (clt_path->state) !=RTRS_CLT_CONNECTING ) { +if (con->cm_err <0 ) +return con->cm_err; +if (READ_ONCE (clt_path->state) !=RTRS_CLT_CONNECTING )/* Device removal */ - err = -ECONNABORTED ; - goto errr; - } +return -ECONNABORTED ;return 0 ; - -errr: -stop_cm (con); -mutex_lock (&con->con_mutex); -destroy_con_cq_qp (con); -mutex_unlock (&con->con_mutex); -destroy_cm: -destroy_cm (con); - -return err; }static void rtrs_clt_path_up (struct rtrs_clt_path *clt_path)
@@ -2336,7 +2323,7 @@ static void rtrs_clt_close_work(struct work_struct *work)static int init_conns (struct rtrs_clt_path *clt_path) {unsigned int cid; -int err; +int err, i;/* * On every new session connections increase reconnect counter
@@ -2352,10 +2339,8 @@ static int init_conns(struct rtrs_clt_path *clt_path) goto destroy; err =create_cm (to_clt_con (clt_path->s.con[cid])); -if (err) { -destroy_con (to_clt_con (clt_path->s.con[cid])); +if (err) goto destroy; - } } err =alloc_path_reqs (clt_path);if (err)
@@ -2366,15 +2351,21 @@ static int init_conns(struct rtrs_clt_path *clt_path)return 0 ; destroy: -while (cid--) { -struct rtrs_clt_con *con =to_clt_con (clt_path->s.con[cid]); +/* Make sure we do the cleanup in the order they are created */ +for (i =0 ; i <= cid; i++) { +struct rtrs_clt_con *con; -stop_cm (con); +if (!clt_path->s.con[i]) +break ; -mutex_lock (&con->con_mutex); -destroy_con_cq_qp (con); -mutex_unlock (&con->con_mutex); -destroy_cm (con); + con =to_clt_con (clt_path->s.con[i]); +if (con->c.cm_id) { +stop_cm (con); +mutex_lock (&con->con_mutex); +destroy_con_cq_qp (con); +mutex_unlock (&con->con_mutex); +destroy_cm (con); + }destroy_con (con); }/*
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 92/166 RDMA/rxe: Fix packet length checks
In reply to Greg Kroah-HartmanFrom: Bob Pearson <[email protected]>
[ Upstream commit 9a3763e87379c97a78b7c6c6f40720b1e877174f ]
In rxe_net.c a received packet, from udp or loopback, is passed to rxe_rcv() in rxe_recv.c as a udp packet. I.e. skb->data is pointing at the udp header. But rxe_rcv() makes length checks to verify the packet is long enough to hold the roce headers as if it were a roce
packet. I.e. skb->data pointing at the bth header. A runt packet would appear to have 8 more bytes than it actually does which may lead to incorrect behavior.
This patch calls skb_pull() to adjust the skb to point at the bth header before calling rxe_rcv() which fixes this error.
--- drivers/infiniband/sw/rxe/rxe_net.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/infiniband/sw/rxe/rxe_net.c +6 -0
@@ -156,6 +156,9 @@ static int rxe_udp_encap_recv(struct sock *sk, struct sk_buff *skb) pkt->mask =RXE_GRH_MASK ; pkt->paylen =be16_to_cpu (udph->len) -sizeof (*udph); +/* remove udp header */ +skb_pull (skb,sizeof (struct udphdr )); +rxe_rcv (skb);return 0 ;
@@ -397,6 +400,9 @@ static int rxe_loopback(struct sk_buff *skb, struct rxe_pkt_info *pkt)return -EIO ; } +/* remove udp header */ +skb_pull (skb,sizeof (struct udphdr )); +rxe_rcv (skb);return 0 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 93/166 RDMA/rxe: Fix ref count error in check_rkey()
In reply to Greg Kroah-HartmanFrom: Bob Pearson <[email protected]>
[ Upstream commit b00683422fd79dd07c9b75efdce1660e5e19150e ]
There is a reference count error in error path code and a potential race in check_rkey() in rxe_resp.c. When looking up the rkey for a memory window the reference to the mw from rxe_lookup_mw() is dropped before a reference is taken on the mr referenced by the mw. If the mr is destroyed immediately after the call to rxe_put(mw) the mr pointer is unprotected and may end up pointing at freed memory. The rxe_get(mr) call should take place before the rxe_put(mw) call.
All errors in check_rkey() call rxe_put(mw) if mw is not NULL but it was already called after the above. The mw pointer should be set to NULL after the rxe_put(mw) call to prevent this from happening.
--- drivers/infiniband/sw/rxe/rxe_resp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/infiniband/sw/rxe/rxe_resp.c +2 -1
@@ -466,8 +466,9 @@ static enum resp_states check_rkey(struct rxe_qp *qp,if (mw->access &IB_ZERO_BASED ) qp->resp.offset = mw->addr; -rxe_put (mw);rxe_get (mr); +rxe_put (mw); + mw =NULL ; }else { mr =lookup_mr (qp->pd, access, rkey,RXE_LOOKUP_REMOTE );if (!mr) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 94/166 spi: cadence-quadspi: Add missing check for dma_set_mask
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 947c70a213769f60e9d5aca2bc88b50a1cfaf5a6 ]
Add check for dma_set_mask() and return the error if it fails.
--- drivers/spi/spi-cadence-quadspi.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/spi/spi-cadence-quadspi.c +5 -2
@@ -1697,8 +1697,11 @@ static int cqspi_probe(struct platform_device *pdev) cqspi->slow_sram = true;if (of_device_is_compatible (pdev->dev.of_node, -"xlnx,versal-ospi-1.0" )) -dma_set_mask (&pdev->dev,DMA_BIT_MASK (64 )); +"xlnx,versal-ospi-1.0" )) { + ret =dma_set_mask (&pdev->dev,DMA_BIT_MASK (64 )); +if (ret) + goto probe_reset_failed; + } } ret = devm_request_irq(dev, irq, cqspi_irq_handler, 0,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 95/166 spi: fsl-dspi: avoid SCK glitches with continuous transfers
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit c5c31fb71f16ba75bad4ade208abbae225305b65 ]
The DSPI controller has configurable timing for
(a) tCSC: the interval between the assertion of the chip select and the first clock edge
(b) tASC: the interval between the last clock edge and the deassertion of the chip select
What is a bit surprising, but is documented in the figure "Example of continuous transfer (CPHA=1, CONT=1)" in the datasheet, is that when the chip select stays asserted between multiple TX FIFO writes, the tCSC and tASC times still apply. With CONT=1, chip select remains asserted, but SCK takes a break and goes to the idle state for tASC + tCSC ns.
In other words, the default values (of 0 and 0 ns) result in SCK glitches where the SCK transition to the idle state, as well as the SCK transition from the idle state, will have no delay in between, and it may appear that a SCK cycle has simply gone missing. The resulting timing violation might cause data corruption in many peripherals, as their chip select is asserted.
The driver has device tree bindings for tCSC ("fsl,spi-cs-sck-delay") and tASC ("fsl,spi-sck-cs-delay"), but these are only specified to apply when the chip select toggles in the first place, and this timing characteristic depends on each peripheral. Many peripherals do not have explicit timing requirements, so many device trees do not have these properties present at all.
Nonetheless, the lack of SCK glitches is a common sense requirement, and since the SCK stays in the idle state during transfers for tCSC+tASC ns, and that in itself should look like half a cycle, then let's ensure that tCSC and tASC are at least a quarter of a SCK period, such that their sum is at least half of one.
--- drivers/spi/spi-fsl-dspi.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/spi/spi-fsl-dspi.c +15 -0
@@ -975,7 +975,9 @@ static int dspi_transfer_one_message(struct spi_controller *ctlr,static int dspi_setup (struct spi_device *spi) {struct fsl_dspi *dspi =spi_controller_get_devdata (spi->controller); +u32 period_ns =DIV_ROUND_UP (NSEC_PER_SEC , spi->max_speed_hz);unsigned char br =0 , pbr =0 , pcssck =0 , cssck =0 ; +u32 quarter_period_ns =DIV_ROUND_UP (period_ns,4 );u32 cs_sck_delay =0 , sck_cs_delay =0 ;struct fsl_dspi_platform_data *pdata;unsigned char pasc =0 , asc =0 ;
@@ -1003,6 +1005,19 @@ static int dspi_setup(struct spi_device *spi) sck_cs_delay = pdata->sck_cs_delay; } +/* Since tCSC and tASC apply to continuous transfers too, avoid SCK +* glitches of half a cycle by never allowing tCSC + tASC to go below +* half a SCK period. +*/ +if (cs_sck_delay < quarter_period_ns) + cs_sck_delay = quarter_period_ns; +if (sck_cs_delay < quarter_period_ns) + sck_cs_delay = quarter_period_ns; + +dev_dbg (&spi->dev, +"DSPI controller timing params: CS-to-SCK delay %u ns, SCK-to-CS delay %u ns\n" , + cs_sck_delay, sck_cs_delay); + clkrate =clk_get_rate (dspi->clk);hz_to_spi_baud (&pbr, &br, spi->max_speed_hz, clkrate);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 96/166 netfilter: nf_tables: integrate pipapo into commit protocol
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 212ed75dc5fb9d1423b3942c8f872a868cda3466 ]
The pipapo set backend follows copy-on-update approach, maintaining one clone of the existing datastructure that is being updated. The clone and current datastructures are swapped via rcu from the commit step.
The existing integration with the commit protocol is flawed because there is no operation to clean up the clone if the transaction is aborted. Moreover, the datastructure swap happens on set element activation.
This patch adds two new operations for sets: commit and abort, these new operations are invoked from the commit and abort steps, after the transactions have been digested, and it updates the pipapo set backend to use it.
This patch adds a new ->pending_update field to sets to maintain a list of sets that require this new commit and abort operations.
--- include/net/netfilter/nf_tables.h | 4 ++- net/netfilter/nf_tables_api.c | 56 +++++++++++++++++++++++++++++++ net/netfilter/nft_set_pipapo.c | 55 +++++++++++++++++++++--------- 3 files changed, 99 insertions(+), 16 deletions(-)
include/net/netfilter/nf_tables.h +3 -1
@@ -457,7 +457,8 @@ struct nft_set_ops {const struct nft_set *set, const struct nft_set_elem *elem, unsigned int flags); - +void (*commit)(const struct nft_set *set); +void (*abort)(const struct nft_set *set);u64 (*privsize)(const struct nlattr *const nla[],const struct nft_set_desc *desc); bool (*estimate)(const struct nft_set_desc *desc,
@@ -552,6 +553,7 @@ struct nft_set {u16 policy;u16 udlen;unsigned char *udata; +struct list_head pending_update;/* runtime data below here */ const struct nft_set_ops *ops____cacheline_aligned ; u16 flags:14,
net/netfilter/nf_tables_api.c +56 -0
118 lines not on this page · raw message
net/netfilter/nft_set_pipapo.c +40 -15
112 lines not on this page · raw message
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 97/166 netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit a1a64a151dae8ac3581c1cbde44b672045cb658b ]
If caller reports ENOMEM, then stop iterating over the batch and send a single netlink message to userspace to report OOM.
--- net/netfilter/nfnetlink.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/netfilter/nfnetlink.c +2 -1
@@ -533,7 +533,8 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,* processed, this avoids that the same error is * reported several times when replaying the batch. */ -if (nfnl_err_add (&err_list, nlh, err, &extack) <0 ) { +if (err == -ENOMEM || +nfnl_err_add (&err_list, nlh, err, &extack) <0 ) {/* We failed to enqueue an error, reset the * list of errors and send OOM to userspace * pointing to the batch header.
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 98/166 ice: Fix XDP memory leak when NIC is brought up and down
In reply to Greg Kroah-HartmanFrom: Kamil Maziarz <[email protected]>
[ Upstream commit 78c50d6961fc05491ebbc71c35d87324b1a4f49a ]
Fix the buffer leak that occurs while switching
the port up and down with traffic and XDP by
checking for an active XDP program and freeing all empty TX buffers.
--- drivers/net/ethernet/intel/ice/ice_main.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/intel/ice/ice_main.c +4 -0
@@ -6784,6 +6784,10 @@ int ice_down(struct ice_vsi *vsi)ice_for_each_txq (vsi, i)ice_clean_tx_ring (vsi->tx_rings[i]); +if (ice_is_xdp_ena_vsi (vsi)) +ice_for_each_xdp_txq (vsi, i) +ice_clean_tx_ring (vsi->xdp_rings[i]); +ice_for_each_rxq (vsi, i)ice_clean_rx_ring (vsi->rx_rings[i]);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 99/166 netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 1240eb93f0616b21c675416516ff3d74798fdc97 ]
In case of error when adding a new rule that refers to an anonymous set, deactivate expressions via NFT_TRANS_PREPARE state, not NFT_TRANS_RELEASE. Thus, the lookup expression marks anonymous sets as inactive in the next generation to ensure it is not reachable in this transaction anymore and decrement the set refcount as introduced by c1592a89942e ("netfilter:nf_tables: deactivate anonymous set from preparation phase"). The abort step takes care of undoing the anonymous set.
This is also consistent with rule deletion, where NFT_TRANS_PREPARE is used. Note that this error path is exercised in the preparation step of the commit protocol. This patch replaces nf_tables_rule_release() by the deactivate and destroy calls, this time with NFT_TRANS_PREPARE.
Due to this incorrect error handling, it is possible to access a dangling pointer to the anonymous set that remains in the transaction list.
[1009.379054] BUG: KASAN: use-after-free in nft_set_lookup_global+0x147/0x1a0 [nf_tables] [1009.379106] Read of size 8 at addr ffff88816c4c8020 by task nft-rule-add/137110 [1009.379116] CPU: 7 PID: 137110 Comm: nft-rule-add Not tainted 6.4.0-rc4+ #256 [1009.379128] Call Trace: [1009.379132] <TASK> [1009.379135] dump_stack_lvl+0x33/0x50 [1009.379146] ? nft_set_lookup_global+0x147/0x1a0 [nf_tables] [1009.379191] print_address_description.constprop.0+0x27/0x300 [1009.379201] kasan_report+0x107/0x120 [1009.379210] ? nft_set_lookup_global+0x147/0x1a0 [nf_tables] [1009.379255] nft_set_lookup_global+0x147/0x1a0 [nf_tables] [1009.379302] nft_lookup_init+0xa5/0x270 [nf_tables] [1009.379350] nf_tables_newrule+0x698/0xe50 [nf_tables] [1009.379397] ? nf_tables_rule_release+0xe0/0xe0 [nf_tables] [1009.379441] ? kasan_unpoison+0x23/0x50 [1009.379450] nfnetlink_rcv_batch+0x97c/0xd90 [nfnetlink] [1009.379470] ? nfnetlink_rcv_msg+0x480/0x480 [nfnetlink] [1009.379485] ? __alloc_skb+0xb8/0x1e0 [1009.379493] ? __alloc_skb+0xb8/0x1e0 [1009.379502] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0 [1009.379509] ? unwind_get_return_address+0x2a/0x40 [1009.379517] ? write_profile+0xc0/0xc0 [1009.379524] ? avc_lookup+0x8f/0xc0 [1009.379532] ? __rcu_read_unlock+0x43/0x60
--- net/netfilter/nf_tables_api.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +2 -1
@@ -3669,7 +3669,8 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info,if (flow)nft_flow_rule_destroy (flow); err_release_rule: -nf_tables_rule_release (&ctx, rule); +nft_rule_expr_deactivate (&ctx, rule,NFT_TRANS_PREPARE ); +nf_tables_rule_destroy (&ctx, rule); err_release_expr:for (i =0 ; i < n; i++) {if (expr_info[i].ops) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 100/166 net: enetc: correct the indexes of highest and 2nd highest TCs
In reply to Greg Kroah-HartmanFrom: Wei Fang <[email protected]>
[ Upstream commit 21225873be1472b7c59ed3650396af0e40578112 ]
For ENETC hardware, the TCs are numbered from 0 to N-1, where N is the number of TCs. Numerically higher TC has higher priority. It's obvious that the highest priority TC index should be N-1 and the 2nd highest priority TC index should be N-2.
However, the previous logic uses netdev_get_prio_tc_map() to get the indexes of highest priority and 2nd highest priority TCs, it does not make sense and is incorrect to give a "tc" argument to netdev_get_prio_tc_map(). So the driver may get the wrong indexes of the two highest priotiry TCs which would lead to failed to set the CBS for the two highest priotiry TCs.
e.g.
$ tc qdisc add dev eno0 parent root handle 100: mqprio num_tc 6 \ map 0 0 1 1 2 3 4 5 queues 1@0 1@1 1@2 1@3 2@4 2@6 hw 1 $ tc qdisc replace dev eno0 parent 100:6 cbs idleslope 100000 \ sendslope -900000 hicredit 12 locredit -113 offload 1 $ Error: Specified device failed to setup cbs hardware offload. ^^^^^
In this example, the previous logic deems the indexes of the two highest priotiry TCs should be 3 and 2. Actually, the indexes are 5 and 4, because the number of TCs is 6. So it would be failed to configure the CBS for the two highest priority TCs.
--- drivers/net/ethernet/freescale/enetc/enetc_qos.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/freescale/enetc/enetc_qos.c +2 -2
@@ -189,8 +189,8 @@ int enetc_setup_tc_cbs(struct net_device *ndev, void *type_data)int bw_sum =0 ;u8 bw; - prio_top =netdev_get_prio_tc_map (ndev, tc_nums -1 ); - prio_next =netdev_get_prio_tc_map (ndev, tc_nums -2 ); + prio_top = tc_nums -1 ; + prio_next = tc_nums -2 ;/* Support highest prio and second prio tc in cbs mode */ if (tc != prio_top && tc != prio_next)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 101/166 ping6: Fix send to link-local addresses with VRF.
In reply to Greg Kroah-HartmanFrom: Guillaume Nault <[email protected]>
[ Upstream commit 91ffd1bae1dafbb9e34b46813f5b058581d9144d ]
Ping sockets can't send packets when they're bound to a VRF master device and the output interface is set to a slave device.
For example, when net.ipv4.ping_group_range is properly set, so that ping6 can use ping sockets, the following kind of commands fails:
$ ip vrf exec red ping6 fe80::854:e7ff:fe88:4bf1%eth1
What happens is that sk->sk_bound_dev_if is set to the VRF master device, but 'oif' is set to the real output device. Since both are set but different, ping_v6_sendmsg() sees their value as inconsistent and fails.
Fix this by allowing 'oif' to be a slave device of ->sk_bound_dev_if.
This fixes the following kselftest failure:
$ ./fcnal-test.sh -t ipv6_ping [...] TEST: ping out, vrf device+address bind - ns-B IPv6 LLA [FAIL]
--- net/ipv6/ping.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ipv6/ping.c +2 -1
@@ -114,7 +114,8 @@ static int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) addr_type =ipv6_addr_type (daddr);if ((__ipv6_addr_needs_scope_id (addr_type) && !oif) || (addr_type &IPV6_ADDR_MAPPED ) || - (oif && sk->sk_bound_dev_if && oif != sk->sk_bound_dev_if)) + (oif && sk->sk_bound_dev_if && oif != sk->sk_bound_dev_if && +l3mdev_master_ifindex_by_index (sock_net (sk), oif) != sk->sk_bound_dev_if))return -EINVAL ;ipcm6_init_sk (&ipc6, np);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 102/166 igb: Fix extts capture value format for 82580/i354/i350
In reply to Greg Kroah-HartmanFrom: Yuezhen Luan <[email protected]>
[ Upstream commit 6292d7436cf2f0a2ea8800a1d2cbb155d237818a ]
82580/i354/i350 features circle-counter-like timestamp registers that are different with newer i210. The EXTTS capture value in AUXTSMPx should be converted from raw circle counter value to timestamp value in resolution of 1 nanosec by the driver.
This issue can be reproduced on i350 nics, connecting an 1PPS signal to a SDP pin, and run 'ts2phc' command to read external 1PPS timestamp value. On i210 this works fine, but on i350 the extts is not correctly converted.
The i350/i354/82580's SYSTIM and other timestamp registers are 40bit counters, presenting time range of 2^40 ns, that means these registers overflows every about 1099s. This causes all these regs can't be used directly in contrast to the newer i210/i211s.
The igb driver needs to convert these raw register values to valid time stamp format by using kernel timecounter apis for i350s families. Here the igb_extts() just forgot to do the convert.
--- drivers/net/ethernet/intel/igb/igb_main.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/igb/igb_main.c +6 -2
@@ -6893,6 +6893,7 @@ static void igb_extts(struct igb_adapter *adapter, int tsintr_tt)struct e1000_hw *hw = &adapter->hw;struct ptp_clock_event event;struct timespec64 ts; +unsigned long flags;if (pin <0 || pin >=IGB_N_SDP )return ;
@@ -6900,9 +6901,12 @@ static void igb_extts(struct igb_adapter *adapter, int tsintr_tt)if (hw->mac.type == e1000_82580 || hw->mac.type == e1000_i354 || hw->mac.type == e1000_i350) { -s64 ns =rd32 (auxstmpl); +u64 ns =rd32 (auxstmpl); - ns += ((s64)(rd32 (auxstmph) &0xFF )) <<32 ; + ns += ((u64)(rd32 (auxstmph) &0xFF )) <<32 ; +spin_lock_irqsave (&adapter->tmreg_lock, flags); + ns =timecounter_cyc2time (&adapter->tc, ns); +spin_unlock_irqrestore (&adapter->tmreg_lock, flags); ts =ns_to_timespec64 (ns); }else { ts.tv_nsec =rd32 (auxstmpl);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 103/166 net/sched: simplify tcf_pedit_act
In reply to Greg Kroah-HartmanFrom: Pedro Tammela <[email protected]>
[ Upstream commit 95b069382351826c0ae37938070aa82dbeaf288d ]
Remove the check for a negative number of keys as
this cannot ever happen
Stable-dep-of: 6c02568fd1ae ("net/sched: act_pedit: Parse L3 Header for L4 offset")
--- net/sched/act_pedit.c | 137 +++++++++++++++++++++--------------------- 1 file changed, 67 insertions(+), 70 deletions(-)
net/sched/act_pedit.c +67 -70
@@ -348,8 +348,12 @@ static int pedit_skb_hdr_offset(struct sk_buff *skb,static int tcf_pedit_act (struct sk_buff *skb,const struct tc_action *a,struct tcf_result *res) { +enum pedit_header_type htype =TCA_PEDIT_KEY_EX_HDR_TYPE_NETWORK ; +enum pedit_cmd cmd =TCA_PEDIT_KEY_EX_CMD_SET ;struct tcf_pedit *p =to_pedit (a); +struct tcf_pedit_key_ex *tkey_ex;struct tcf_pedit_parms *parms; +struct tc_pedit_key *tkey;u32 max_offset;int i;
@@ -365,88 +369,81 @@ static int tcf_pedit_act(struct sk_buff *skb, const struct tc_action *a,tcf_lastuse_update (&p->tcf_tm);tcf_action_update_bstats (&p->common, skb); -if (parms->tcfp_nkeys >0 ) { -struct tc_pedit_key *tkey = parms->tcfp_keys; -struct tcf_pedit_key_ex *tkey_ex = parms->tcfp_keys_ex; -enum pedit_header_type htype = -TCA_PEDIT_KEY_EX_HDR_TYPE_NETWORK ; -enum pedit_cmd cmd =TCA_PEDIT_KEY_EX_CMD_SET ; - -for (i = parms->tcfp_nkeys; i >0 ; i--, tkey++) { -u32 *ptr, hdata; -int offset = tkey->off; -int hoffset; -u32 val; -int rc; - -if (tkey_ex) { - htype = tkey_ex->htype; - cmd = tkey_ex->cmd; - - tkey_ex++; - } + tkey = parms->tcfp_keys; + tkey_ex = parms->tcfp_keys_ex; - rc =pedit_skb_hdr_offset (skb, htype, &hoffset); -if (rc) { -pr_info ("tc action pedit bad header type specified (0x%x)\n" , - htype); - goto bad; - } +for (i = parms->tcfp_nkeys; i >0 ; i--, tkey++) { +int offset = tkey->off; +u32 *ptr, hdata; +int hoffset; +u32 val; +int rc; -if (tkey->offmask) { -u8 *d, _d; - -if (!offset_valid (skb, hoffset + tkey->at)) { -pr_info ("tc action pedit 'at' offset %d out of bounds\n" , - hoffset + tkey->at); - goto bad; - } - d =skb_header_pointer (skb, hoffset + tkey->at, -sizeof (_d), &_d); -if (!d) - goto bad; - offset += (*d & tkey->offmask) >> tkey->shift; - } +if (tkey_ex) { + htype = tkey_ex->htype; + cmd = tkey_ex->cmd; -if (offset %4 ) { -pr_info ("tc action pedit offset must be on 32 bit boundaries\n" ); - goto bad; - } + tkey_ex++; + } -if (!offset_valid (skb, hoffset + offset)) { -pr_info ("tc action pedit offset %d out of bounds\n" , - hoffset + offset); - goto bad; - } + rc =pedit_skb_hdr_offset (skb, htype, &hoffset); +if (rc) { +pr_info ("tc action pedit bad header type specified (0x%x)\n" , + htype); + goto bad; + } - ptr =skb_header_pointer (skb, hoffset + offset, -sizeof (hdata), &hdata); -if (!ptr) - goto bad; -/* just do it, baby */ -switch (cmd) { -case TCA_PEDIT_KEY_EX_CMD_SET : - val = tkey->val; -break ; -case TCA_PEDIT_KEY_EX_CMD_ADD : - val = (*ptr + tkey->val) & ~tkey->mask; -break ; -default : -pr_info ("tc action pedit bad command (%d)\n" , - cmd); +if (tkey->offmask) { +u8 *d, _d; + +if (!offset_valid (skb, hoffset + tkey->at)) { +pr_info ("tc action pedit 'at' offset %d out of bounds\n" , + hoffset + tkey->at); goto bad; } + d =skb_header_pointer (skb, hoffset + tkey->at, +sizeof (_d), &_d); +if (!d) + goto bad; + offset += (*d & tkey->offmask) >> tkey->shift; + } - *ptr = ((*ptr & tkey->mask) ^ val); -if (ptr == &hdata) -skb_store_bits (skb, hoffset + offset, ptr,4 ); +if (offset %4 ) { +pr_info ("tc action pedit offset must be on 32 bit boundaries\n" ); + goto bad; } - goto done; - }else { -WARN (1 ,"pedit BUG: index %d\n" , p->tcf_index); +if (!offset_valid (skb, hoffset + offset)) { +pr_info ("tc action pedit offset %d out of bounds\n" , + hoffset + offset); + goto bad; + } + + ptr =skb_header_pointer (skb, hoffset + offset, +sizeof (hdata), &hdata); +if (!ptr) + goto bad; +/* just do it, baby */ +switch (cmd) { +case TCA_PEDIT_KEY_EX_CMD_SET : + val = tkey->val; +break ; +case TCA_PEDIT_KEY_EX_CMD_ADD : + val = (*ptr + tkey->val) & ~tkey->mask; +break ; +default : +pr_info ("tc action pedit bad command (%d)\n" , + cmd); + goto bad; + } + + *ptr = ((*ptr & tkey->mask) ^ val); +if (ptr == &hdata) +skb_store_bits (skb, hoffset + offset, ptr,4 ); } + goto done; + bad:spin_lock (&p->tcf_lock); p->tcf_qstats.overlimits++;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 104/166 net/sched: act_pedit: remove extra check for key type
In reply to Greg Kroah-HartmanFrom: Pedro Tammela <[email protected]>
[ Upstream commit 577140180ba28d0d37bc898c7bd6702c83aa106f ]
The netlink parsing already validates the key 'htype'. Remove the datapath check as it's redundant.
Stable-dep-of: 6c02568fd1ae ("net/sched: act_pedit: Parse L3 Header for L4 offset")
--- net/sched/act_pedit.c | 29 +++++++---------------------- 1 file changed, 7 insertions(+), 22 deletions(-)
net/sched/act_pedit.c +7 -22
@@ -312,37 +312,28 @@ static bool offset_valid(struct sk_buff *skb, int offset)return true; } -static int pedit_skb_hdr_offset (struct sk_buff *skb, -enum pedit_header_type htype,int *hoffset) +static void pedit_skb_hdr_offset (struct sk_buff *skb, +enum pedit_header_type htype,int *hoffset) { -int ret = -EINVAL ; - +/* 'htype' is validated in the netlink parsing */ switch (htype) {case TCA_PEDIT_KEY_EX_HDR_TYPE_ETH : -if (skb_mac_header_was_set (skb)) { +if (skb_mac_header_was_set (skb)) *hoffset =skb_mac_offset (skb); - ret =0 ; - }break ;case TCA_PEDIT_KEY_EX_HDR_TYPE_NETWORK :case TCA_PEDIT_KEY_EX_HDR_TYPE_IP4 :case TCA_PEDIT_KEY_EX_HDR_TYPE_IP6 : *hoffset =skb_network_offset (skb); - ret =0 ;break ;case TCA_PEDIT_KEY_EX_HDR_TYPE_TCP :case TCA_PEDIT_KEY_EX_HDR_TYPE_UDP : -if (skb_transport_header_was_set (skb)) { +if (skb_transport_header_was_set (skb)) *hoffset =skb_transport_offset (skb); - ret =0 ; - }break ;default : - ret = -EINVAL ;break ; } - -return ret; } static int tcf_pedit_act(struct sk_buff *skb, const struct tc_action *a,
@@ -374,10 +365,9 @@ static int tcf_pedit_act(struct sk_buff *skb, const struct tc_action *a,for (i = parms->tcfp_nkeys; i >0 ; i--, tkey++) {int offset = tkey->off; +int hoffset =0 ;u32 *ptr, hdata; -int hoffset;u32 val; -int rc;if (tkey_ex) { htype = tkey_ex->htype;
@@ -386,12 +376,7 @@ static int tcf_pedit_act(struct sk_buff *skb, const struct tc_action *a, tkey_ex++; } - rc =pedit_skb_hdr_offset (skb, htype, &hoffset); -if (rc) { -pr_info ("tc action pedit bad header type specified (0x%x)\n" , - htype); - goto bad; - } +pedit_skb_hdr_offset (skb, htype, &hoffset);if (tkey->offmask) {u8 *d, _d;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 105/166 net/sched: act_pedit: Parse L3 Header for L4 offset
In reply to Greg Kroah-HartmanFrom: Max Tottenham <[email protected]>
[ Upstream commit 6c02568fd1ae53099b4ab86365c5be1ff15f586b ]
Instead of relying on skb->transport_header being set correctly, opt instead to parse the L3 header length out of the L3 headers for both IPv4/IPv6 when the Extended Layer Op for tcp/udp is used. This fixes a bug if GRO is disabled, when GRO is disabled skb->transport_header is set by __netif_receive_skb_core() to point to the L3 header, it's later fixed by the upper protocol layers, but act_pedit will receive the SKB before the fixups are completed. The existing behavior causes the following to edit the L3 header if GRO is disabled instead of the UDP header:
tc filter add dev eth0 ingress protocol ip flower ip_proto udp \
dst_ip 192.168.1.3 action pedit ex munge udp set dport 18053
Also re-introduce a rate-limited warning if we were unable to extract the header offset when using the 'ex' interface.
the conventional network headers")
--- net/sched/act_pedit.c | 48 ++++++++++++++++++++++++++++++++++++++----- 1 file changed, 43 insertions(+), 5 deletions(-)
net/sched/act_pedit.c +43 -5
@@ -13,7 +13,10 @@#include <linux/rtnetlink.h> #include <linux/module.h> #include <linux/init.h> +#include <linux/ip.h> +#include <linux/ipv6.h> #include <linux/slab.h> +#include <net/ipv6.h> #include <net/netlink.h> #include <net/pkt_sched.h> #include <linux/tc_act/tc_pedit.h>
@@ -312,28 +315,58 @@ static bool offset_valid(struct sk_buff *skb, int offset)return true; } -static void pedit_skb_hdr_offset (struct sk_buff *skb, +static int pedit_l4_skb_offset (struct sk_buff *skb,int *hoffset,const int header_type) +{ +const int noff =skb_network_offset (skb); +int ret = -EINVAL ; +struct iphdr _iph; + +switch (skb->protocol) { +case htons (ETH_P_IP ): { +const struct iphdr *iph =skb_header_pointer (skb, noff,sizeof (_iph), &_iph); + +if (!iph) + goto out; + *hoffset = noff + iph->ihl *4 ; + ret =0 ; +break ; + } +case htons (ETH_P_IPV6 ): + ret =ipv6_find_hdr (skb, hoffset, header_type,NULL ,NULL ) == header_type ?0 : -EINVAL ; +break ; + } +out: +return ret; +} + +static int pedit_skb_hdr_offset (struct sk_buff *skb,enum pedit_header_type htype,int *hoffset) { +int ret = -EINVAL ;/* 'htype' is validated in the netlink parsing */ switch (htype) {case TCA_PEDIT_KEY_EX_HDR_TYPE_ETH : -if (skb_mac_header_was_set (skb)) +if (skb_mac_header_was_set (skb)) { *hoffset =skb_mac_offset (skb); + ret =0 ; + }break ;case TCA_PEDIT_KEY_EX_HDR_TYPE_NETWORK :case TCA_PEDIT_KEY_EX_HDR_TYPE_IP4 :case TCA_PEDIT_KEY_EX_HDR_TYPE_IP6 : *hoffset =skb_network_offset (skb); + ret =0 ;break ;case TCA_PEDIT_KEY_EX_HDR_TYPE_TCP : + ret =pedit_l4_skb_offset (skb, hoffset,IPPROTO_TCP ); +break ;case TCA_PEDIT_KEY_EX_HDR_TYPE_UDP : -if (skb_transport_header_was_set (skb)) - *hoffset =skb_transport_offset (skb); + ret =pedit_l4_skb_offset (skb, hoffset,IPPROTO_UDP );break ;default :break ; } +return ret; } static int tcf_pedit_act(struct sk_buff *skb, const struct tc_action *a,
@@ -368,6 +401,7 @@ static int tcf_pedit_act(struct sk_buff *skb, const struct tc_action *a,int hoffset =0 ;u32 *ptr, hdata;u32 val; +int rc;if (tkey_ex) { htype = tkey_ex->htype;
@@ -376,7 +410,11 @@ static int tcf_pedit_act(struct sk_buff *skb, const struct tc_action *a, tkey_ex++; } -pedit_skb_hdr_offset (skb, htype, &hoffset); + rc =pedit_skb_hdr_offset (skb, htype, &hoffset); +if (rc) { +pr_info_ratelimited ("tc action pedit unable to extract header offset for header type (0x%x)\n" , htype); + goto bad; + }if (tkey->offmask) {u8 *d, _d;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 106/166 octeontx2-af: Fix promiscuous mode
In reply to Greg Kroah-HartmanFrom: Ratheesh Kannoth <[email protected]>
[ Upstream commit c0e489372a294044feea650b38f38c888eff57a4 ]
CN10KB silicon introduced a new exact match feature, which is used for DMAC filtering. The state of installed DMAC filters in this exact match table is getting corrupted when promiscuous mode is toggled. Fix this by not touching Exact match related config when promiscuous mode is toggled.
--- .../marvell/octeontx2/af/rvu_npc_hash.c | 29 ++----------------- 1 file changed, 2 insertions(+), 27 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c +2 -27
@@ -1168,10 +1168,8 @@ static u16 __rvu_npc_exact_cmd_rules_cnt_update(struct rvu *rvu, int drop_mcam_i {struct npc_exact_table *table;u16 *cnt, old_cnt; -bool promisc; table = rvu->hw->table; - promisc = table->promisc_mode[drop_mcam_idx]; cnt = &table->cnt_cmd_rules[drop_mcam_idx]; old_cnt = *cnt;
@@ -1183,16 +1181,13 @@ static u16 __rvu_npc_exact_cmd_rules_cnt_update(struct rvu *rvu, int drop_mcam_i *enable_or_disable_cam = false; -if (promisc) - goto done; - -/* If all rules are deleted and not already in promisc mode; disable cam */ +/* If all rules are deleted, disable cam */ if (!*cnt && val <0 ) { *enable_or_disable_cam = true; goto done; } -/* If rule got added and not already in promisc mode; enable cam */ +/* If rule got added, enable cam */ if (!old_cnt && val >0 ) { *enable_or_disable_cam = true; goto done;
@@ -1447,7 +1442,6 @@ int rvu_npc_exact_promisc_disable(struct rvu *rvu, u16 pcifunc)u32 drop_mcam_idx;bool *promisc;bool rc; -u32 cnt; table = rvu->hw->table;
@@ -1470,17 +1464,8 @@ int rvu_npc_exact_promisc_disable(struct rvu *rvu, u16 pcifunc)return LMAC_AF_ERR_INVALID_PARAM ; } *promisc = false; - cnt =__rvu_npc_exact_cmd_rules_cnt_update (rvu, drop_mcam_idx,0 ,NULL );mutex_unlock (&table->lock); -/* If no dmac filter entries configured, disable drop rule */ -if (!cnt) -rvu_npc_enable_mcam_by_entry_index (rvu, drop_mcam_idx,NIX_INTF_RX , false); -else -rvu_npc_enable_mcam_by_entry_index (rvu, drop_mcam_idx,NIX_INTF_RX , !*promisc); - -dev_dbg (rvu->dev,"%s: disabled promisc mode (cgx=%d lmac=%d, cnt=%d)\n" , - __func__, cgx_id, lmac_id, cnt);return 0 ; }
@@ -1498,7 +1483,6 @@ int rvu_npc_exact_promisc_enable(struct rvu *rvu, u16 pcifunc)u32 drop_mcam_idx;bool *promisc;bool rc; -u32 cnt; table = rvu->hw->table;
@@ -1521,17 +1505,8 @@ int rvu_npc_exact_promisc_enable(struct rvu *rvu, u16 pcifunc)return LMAC_AF_ERR_INVALID_PARAM ; } *promisc = true; - cnt =__rvu_npc_exact_cmd_rules_cnt_update (rvu, drop_mcam_idx,0 ,NULL );mutex_unlock (&table->lock); -/* If no dmac filter entries configured, disable drop rule */ -if (!cnt) -rvu_npc_enable_mcam_by_entry_index (rvu, drop_mcam_idx,NIX_INTF_RX , false); -else -rvu_npc_enable_mcam_by_entry_index (rvu, drop_mcam_idx,NIX_INTF_RX , !*promisc); - -dev_dbg (rvu->dev,"%s: Enabled promisc mode (cgx=%d lmac=%d cnt=%d)\n" , - __func__, cgx_id, lmac_id, cnt);return 0 ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 107/166 net/sched: cls_u32: Fix reference counter leak leading to overflow
In reply to Greg Kroah-HartmanFrom: Lee Jones <[email protected]>
[ Upstream commit 04c55383fa5689357bcdd2c8036725a55ed632bc ]
In the event of a failure in tcf_change_indev(), u32_set_parms() will immediately return without decrementing the recently incremented reference counter. If this happens enough times, the counter will rollover and the reference freed, leading to a double free which can be used to do 'bad things'.
In order to prevent this, move the point of possible failure above the point where the reference counter is incremented. Also save any meaningful return values to be applied to the return data at the appropriate point in time.
This issue was caught with KASAN.
--- net/sched/cls_u32.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)
net/sched/cls_u32.c +10 -8
@@ -716,13 +716,19 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp, struct nlattr *est, u32 flags, u32 fl_flags, struct netlink_ext_ack *extack) { - int err; + int err, ifindex = -1; err =tcf_exts_validate_ex (net, tp, tb, est, &n->exts, flags, fl_flags, extack);if (err <0 )return err; +if (tb[TCA_U32_INDEV ]) { + ifindex =tcf_change_indev (net, tb[TCA_U32_INDEV ], extack); +if (ifindex <0 ) +return -EINVAL ; + } +if (tb[TCA_U32_LINK ]) {u32 handle =nla_get_u32 (tb[TCA_U32_LINK ]);struct tc_u_hnode *ht_down =NULL , *ht_old;
@@ -757,13 +763,9 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp,tcf_bind_filter (tp, &n->res, base); } -if (tb[TCA_U32_INDEV ]) { -int ret; - ret =tcf_change_indev (net, tb[TCA_U32_INDEV ], extack); -if (ret <0 ) -return -EINVAL ; - n->ifindex = ret; - } +if (ifindex >=0 ) + n->ifindex = ifindex; +return 0 ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 108/166 wifi: mac80211: fix link activation settings order
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit 01605ad6c3e8608d7e147c9b75d67eb8a3d27d88 ]
In the normal MLME code we always call ieee80211_mgd_set_link_qos_params() before ieee80211_link_info_change_notify() and some drivers, notably iwlwifi, rely on that as they don't do anything (but store the data) in their conf_tx.
Fix the order here to be the same as in the normal code paths, so this isn't broken.
--- net/mac80211/link.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/mac80211/link.c +2 -2
@@ -2,7 +2,7 @@/* * MLO link handling * -* Copyright (C) 2022 Intel Corporation +* Copyright (C) 2022-2023 Intel Corporation */ #include <linux/slab.h> #include <linux/kernel.h>
@@ -387,6 +387,7 @@ static int _ieee80211_set_active_links(struct ieee80211_sub_if_data *sdata, IEEE80211_CHANCTX_SHARED);WARN_ON_ONCE (ret); +ieee80211_mgd_set_link_qos_params (link); ieee80211_link_info_change_notify(sdata, link, BSS_CHANGED_ERP_CTS_PROT | BSS_CHANGED_ERP_PREAMBLE |
@@ -401,7 +402,6 @@ static int _ieee80211_set_active_links(struct ieee80211_sub_if_data *sdata,BSS_CHANGED_TWT |BSS_CHANGED_HE_OBSS_PD | BSS_CHANGED_HE_BSS_COLOR); -ieee80211_mgd_set_link_qos_params (link); } old_active = sdata->vif.active_links;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 109/166 wifi: cfg80211: fix link del callback to call correct handler
In reply to Greg Kroah-HartmanFrom: Benjamin Berg <[email protected]>
[ Upstream commit 1ff56684fa8682bdfbbce4e12cf67ab23cb1db05 ]
The wrapper function was incorrectly calling the add handler instead of the del handler. This had no negative side effect as the default handlers are essentially identical.
--- net/wireless/rdev-ops.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/wireless/rdev-ops.h +3 -3
@@ -2,7 +2,7 @@/* * Portions of this file * Copyright(c) 2016-2017 Intel Deutschland GmbH -* Copyright (C) 2018, 2021-2022 Intel Corporation +* Copyright (C) 2018, 2021-2023 Intel Corporation */ #ifndef __CFG80211_RDEV_OPS#define __CFG80211_RDEV_OPS
@@ -1441,8 +1441,8 @@ rdev_del_intf_link(struct cfg80211_registered_device *rdev, unsigned int link_id) {trace_rdev_del_intf_link (&rdev->wiphy, wdev, link_id); -if (rdev->ops->add_intf_link) - rdev->ops->add_intf_link (&rdev->wiphy, wdev, link_id); +if (rdev->ops->del_intf_link) + rdev->ops->del_intf_link (&rdev->wiphy, wdev, link_id);trace_rdev_return_void (&rdev->wiphy); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 110/166 wifi: mac80211: take lock before setting vif links
In reply to Greg Kroah-HartmanFrom: Benjamin Berg <[email protected]>
[ Upstream commit 15846f95ab01b71fdb1cef8df73680aad41edf70 ]
ieee80211_vif_set_links requires the sdata->local->mtx lock to be held. Add the appropriate locking around the calls in both the link add and remove handlers.
This causes a warning when e.g. ieee80211_link_release_channel is called via ieee80211_link_stop from ieee80211_vif_update_links.
--- net/mac80211/cfg.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
net/mac80211/cfg.c +8 -1
@@ -4732,11 +4732,16 @@ static int ieee80211_add_intf_link(struct wiphy *wiphy, unsigned int link_id) {struct ieee80211_sub_if_data *sdata =IEEE80211_WDEV_TO_SUB_IF (wdev); +int res;if (wdev->use_4addr)return -EOPNOTSUPP ; -return ieee80211_vif_set_links (sdata, wdev->valid_links); +mutex_lock (&sdata->local->mtx); + res =ieee80211_vif_set_links (sdata, wdev->valid_links); +mutex_unlock (&sdata->local->mtx); + +return res; } static void ieee80211_del_intf_link(struct wiphy *wiphy,
@@ -4745,7 +4750,9 @@ static void ieee80211_del_intf_link(struct wiphy *wiphy, {struct ieee80211_sub_if_data *sdata =IEEE80211_WDEV_TO_SUB_IF (wdev); +mutex_lock (&sdata->local->mtx);ieee80211_vif_set_links (sdata, wdev->valid_links); +mutex_unlock (&sdata->local->mtx); } static int sta_add_link_station(struct ieee80211_local *local,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 111/166 RDMA/rxe: Removed unused name from rxe_task struct
In reply to Greg Kroah-HartmanFrom: Bob Pearson <[email protected]>
[ Upstream commit de669ae8af49ceed0eed44f5b3d51dc62affc5e4 ]
The name field in struct rxe_task is never used. This patch removes it.
Stable-dep-of: 2a62b6210ce8 ("RDMA/rxe: Fix the use-before-initialization error of resp_pkts")
--- drivers/infiniband/sw/rxe/rxe_qp.c | 9 +++------ drivers/infiniband/sw/rxe/rxe_task.c | 4 +--- drivers/infiniband/sw/rxe/rxe_task.h | 4 +--- 3 files changed, 5 insertions(+), 12 deletions(-)
drivers/infiniband/sw/rxe/rxe_qp.c +3 -6
@@ -242,10 +242,8 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp,skb_queue_head_init (&qp->req_pkts); -rxe_init_task (&qp->req.task, qp, - rxe_requester,"req" ); -rxe_init_task (&qp->comp.task, qp, - rxe_completer,"comp" ); +rxe_init_task (&qp->req.task, qp, rxe_requester); +rxe_init_task (&qp->comp.task, qp, rxe_completer); qp->qp_timeout_jiffies =0 ;/* Can't be set for UD/UC in modify_qp */ if (init->qp_type ==IB_QPT_RC ) {
@@ -292,8 +290,7 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp,skb_queue_head_init (&qp->resp_pkts); -rxe_init_task (&qp->resp.task, qp, - rxe_responder,"resp" ); +rxe_init_task (&qp->resp.task, qp, rxe_responder); qp->resp.opcode =OPCODE_NONE ; qp->resp.msn =0 ;
drivers/infiniband/sw/rxe/rxe_task.c +1 -3
@@ -94,12 +94,10 @@ void rxe_do_task(struct tasklet_struct *t) task->ret = ret; } -int rxe_init_task (struct rxe_task *task, -void *arg,int (*func)(void *),char *name) +int rxe_init_task (struct rxe_task *task,void *arg,int (*func)(void *)) { task->arg = arg; task->func = func; -snprintf (task->name,sizeof (task->name),"%s" , name); task->destroyed = false;tasklet_setup (&task->tasklet, rxe_do_task);
drivers/infiniband/sw/rxe/rxe_task.h +1 -3
@@ -25,7 +25,6 @@ struct rxe_task {void *arg;int (*func)(void *arg);int ret; -char name[16 ];bool destroyed; };
@@ -34,8 +33,7 @@ struct rxe_task {* arg => parameter to pass to fcn * func => function to call until it returns != 0 */ -int rxe_init_task (struct rxe_task *task, -void *arg,int (*func)(void *),char *name); +int rxe_init_task (struct rxe_task *task,void *arg,int (*func)(void *));/* cleanup task */ void rxe_cleanup_task (struct rxe_task *task);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 112/166 RDMA/rxe: Fix the use-before-initialization error of resp_pkts
In reply to Greg Kroah-HartmanFrom: Zhu Yanjun <[email protected]>
[ Upstream commit 2a62b6210ce876c596086ab8fd4c8a0c3d10611a ]
In the following:
Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106 assign_lock_key kernel/locking/lockdep.c:982 [inline] register_lock_class+0xdb6/0x1120 kernel/locking/lockdep.c:1295 __lock_acquire+0x10a/0x5df0 kernel/locking/lockdep.c:4951 lock_acquire kernel/locking/lockdep.c:5691 [inline] lock_acquire+0x1b1/0x520 kernel/locking/lockdep.c:5656 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162 skb_dequeue+0x20/0x180 net/core/skbuff.c:3639 drain_resp_pkts drivers/infiniband/sw/rxe/rxe_comp.c:555 [inline] rxe_completer+0x250d/0x3cc0 drivers/infiniband/sw/rxe/rxe_comp.c:652 rxe_qp_do_cleanup+0x1be/0x820 drivers/infiniband/sw/rxe/rxe_qp.c:761 execute_in_process_context+0x3b/0x150 kernel/workqueue.c:3473 __rxe_cleanup+0x21e/0x370 drivers/infiniband/sw/rxe/rxe_pool.c:233 rxe_create_qp+0x3f6/0x5f0 drivers/infiniband/sw/rxe/rxe_verbs.c:583
This is a use-before-initialization problem.
It happens because rxe_qp_do_cleanup is called during error unwind before the struct has been fully initialized.
Move the initialization of the skb earlier.
--- drivers/infiniband/sw/rxe/rxe_qp.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/infiniband/sw/rxe/rxe_qp.c +3 -4
@@ -180,6 +180,9 @@ static void rxe_qp_init_misc(struct rxe_dev *rxe, struct rxe_qp *qp,spin_lock_init (&qp->rq.producer_lock);spin_lock_init (&qp->rq.consumer_lock); +skb_queue_head_init (&qp->req_pkts); +skb_queue_head_init (&qp->resp_pkts); +atomic_set (&qp->ssn,0 );atomic_set (&qp->skb_out,0 ); }
@@ -240,8 +243,6 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp, qp->req.opcode =-1 ; qp->comp.opcode =-1 ; -skb_queue_head_init (&qp->req_pkts); -rxe_init_task (&qp->req.task, qp, rxe_requester);rxe_init_task (&qp->comp.task, qp, rxe_completer);
@@ -288,8 +289,6 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp, } } -skb_queue_head_init (&qp->resp_pkts); -rxe_init_task (&qp->resp.task, qp, rxe_responder); qp->resp.opcode =OPCODE_NONE ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 113/166 iavf: remove mask from iavf_irq_enable_queues()
In reply to Greg Kroah-HartmanFrom: Ahmed Zaki <[email protected]>
[ Upstream commit c37cf54c12cfaa51e7aaf88708167b0d3259e64e ]
Enable more than 32 IRQs by removing the u32 bit mask in iavf_irq_enable_queues(). There is no need for the mask as there are no callers that select individual IRQs through the bitmask. Also, if the PF allocates more than 32 IRQs, this mask will prevent us from using all of them.
Modify the comment in iavf_register.h to show that the maximum number allowed for the IRQ index is 63 as per the iAVF standard 1.0 [1].
--- drivers/net/ethernet/intel/iavf/iavf.h | 2 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 15 ++++++--------- drivers/net/ethernet/intel/iavf/iavf_register.h | 2 +- 3 files changed, 8 insertions(+), 11 deletions(-)
drivers/net/ethernet/intel/iavf/iavf.h +1 -1
@@ -525,7 +525,7 @@ void iavf_set_ethtool_ops(struct net_device *netdev);void iavf_update_stats (struct iavf_adapter *adapter);void iavf_reset_interrupt_capability (struct iavf_adapter *adapter);int iavf_init_interrupt_scheme (struct iavf_adapter *adapter); -void iavf_irq_enable_queues (struct iavf_adapter *adapter,u32 mask); +void iavf_irq_enable_queues (struct iavf_adapter *adapter);void iavf_free_all_tx_resources (struct iavf_adapter *adapter);void iavf_free_all_rx_resources (struct iavf_adapter *adapter);
drivers/net/ethernet/intel/iavf/iavf_main.c +6 -9
@@ -359,21 +359,18 @@ static void iavf_irq_disable(struct iavf_adapter *adapter) }/** -* iavf_irq_enable_queues - Enable interrupt for specified queues +* iavf_irq_enable_queues - Enable interrupt for all queues * @adapter: board private structure -* @mask: bitmap of queues to enable **/ -void iavf_irq_enable_queues (struct iavf_adapter *adapter,u32 mask) +void iavf_irq_enable_queues (struct iavf_adapter *adapter) {struct iavf_hw *hw = &adapter->hw;int i;for (i =1 ; i < adapter->num_msix_vectors; i++) { -if (mask &BIT (i -1 )) { -wr32 (hw,IAVF_VFINT_DYN_CTLN1 (i -1 ), -IAVF_VFINT_DYN_CTLN1_INTENA_MASK | -IAVF_VFINT_DYN_CTLN1_ITR_INDX_MASK ); - } +wr32 (hw,IAVF_VFINT_DYN_CTLN1 (i -1 ), +IAVF_VFINT_DYN_CTLN1_INTENA_MASK | +IAVF_VFINT_DYN_CTLN1_ITR_INDX_MASK ); } }
@@ -387,7 +384,7 @@ void iavf_irq_enable(struct iavf_adapter *adapter, bool flush)struct iavf_hw *hw = &adapter->hw;iavf_misc_irq_enable (adapter); -iavf_irq_enable_queues (adapter, ~0 ); +iavf_irq_enable_queues (adapter);if (flush)iavf_flush (hw);
drivers/net/ethernet/intel/iavf/iavf_register.h +1 -1
@@ -40,7 +40,7 @@#define IAVF_VFINT_DYN_CTL01_INTENA_MASK IAVF_MASK(0x1, IAVF_VFINT_DYN_CTL01_INTENA_SHIFT)#define IAVF_VFINT_DYN_CTL01_ITR_INDX_SHIFT 3#define IAVF_VFINT_DYN_CTL01_ITR_INDX_MASK IAVF_MASK(0x3, IAVF_VFINT_DYN_CTL01_ITR_INDX_SHIFT) -#define IAVF_VFINT_DYN_CTLN1 (_INTVF) (0x00003800 + ((_INTVF) * 4))/* _i=0...15 */ /* Reset: VFR */ +#define IAVF_VFINT_DYN_CTLN1 (_INTVF) (0x00003800 + ((_INTVF) * 4))/* _i=0...63 */ /* Reset: VFR */ #define IAVF_VFINT_DYN_CTLN1_INTENA_SHIFT 0#define IAVF_VFINT_DYN_CTLN1_INTENA_MASK IAVF_MASK(0x1, IAVF_VFINT_DYN_CTLN1_INTENA_SHIFT)#define IAVF_VFINT_DYN_CTLN1_SWINT_TRIG_SHIFT 2
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 114/166 octeontx2-af: fixed resource availability check
In reply to Greg Kroah-HartmanFrom: Satha Rao <[email protected]>
[ Upstream commit 4e635f9d86165e47f5440196f2ebdb258efb8341 ]
txschq_alloc response have two different arrays to store continuous and non-continuous schedulers of each level. Requested count should be checked for each array separately.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +2 -1
@@ -1878,7 +1878,8 @@ static int nix_check_txschq_alloc_req(struct rvu *rvu, int lvl, u16 pcifunc, free_cnt =rvu_rsrc_free_count (&txsch->schq); } -if (free_cnt < req_schq || req_schq >MAX_TXSCHQ_PER_FUNC ) +if (free_cnt < req_schq || req->schq[lvl] >MAX_TXSCHQ_PER_FUNC || + req->schq_contig[lvl] >MAX_TXSCHQ_PER_FUNC )return NIX_AF_ERR_TLX_ALLOC_FAIL ;/* If contiguous queues are needed, check for availability */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 115/166 octeontx2-af: fix lbk link credits on cn10k
In reply to Greg Kroah-HartmanFrom: Nithin Dabilpuram <[email protected]>
[ Upstream commit 87e12a17eef476bbf768dc3a74419ad461f36fbc ]
Fix LBK link credits on CN10K to be same as CN9K i.e 16 * MAX_LBK_DATA_RATE instead of current scheme of calculation based on LBK buf length / FIFO size.
--- drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +0 -4
@@ -4070,10 +4070,6 @@ int rvu_mbox_handler_nix_set_rx_cfg(struct rvu *rvu, struct nix_rx_cfg *req,static u64 rvu_get_lbk_link_credits (struct rvu *rvu,u16 lbk_max_frs) { -/* CN10k supports 72KB FIFO size and max packet size of 64k */ -if (rvu->hw->lbk_bufsize ==0x12000 ) -return (rvu->hw->lbk_bufsize - lbk_max_frs) /16 ; -return 1600 ;/* 16 * max LBK datarate = 16 * 100Gbps */ }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 116/166 RDMA/mlx5: Initiate dropless RQ for RAW Ethernet functions
In reply to Greg Kroah-HartmanFrom: Maher Sanalla <[email protected]>
[ Upstream commit ee4d269eccfea6c17b18281bef482700d898e86f ]
Delay drop data is initiated for PFs that have the capability of rq_delay_drop and are in roce profile.
However, PFs with RAW ethernet profile do not initiate delay drop data on function load, causing kernel panic if delay drop struct members are accessed later on in case a dropless RQ is created.
Thus, stage the delay drop initialization as part of RAW ethernet PF loading process.
--- drivers/infiniband/hw/mlx5/main.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/infiniband/hw/mlx5/main.c +3 -0
@@ -4250,6 +4250,9 @@ const struct mlx5_ib_profile raw_eth_profile = {STAGE_CREATE (MLX5_IB_STAGE_POST_IB_REG_UMR , mlx5_ib_stage_post_ib_reg_umr_init,NULL ), +STAGE_CREATE (MLX5_IB_STAGE_DELAY_DROP , + mlx5_ib_stage_delay_drop_init, + mlx5_ib_stage_delay_drop_cleanup),STAGE_CREATE (MLX5_IB_STAGE_RESTRACK , mlx5_ib_restrack_init, NULL),
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 117/166 RDMA/mlx5: Create an indirect flow table for steering anchor
In reply to Greg Kroah-HartmanFrom: Mark Bloch <[email protected]>
[ Upstream commit e1f4a52ac171dd863fe89055e749ef5e0a0bc5ce ]
A misbehaved user can create a steering anchor that points to a kernel flow table and then destroy the anchor without freeing the associated STC. This creates a problem as the kernel can't destroy the flow table since there is still a reference to it. As a result, this can exhaust all available flow table resources, preventing other users from using the RDMA device.
To prevent this problem, a solution is implemented where a special flow table with two steering rules is created when a user creates a steering anchor for the first time. The rules include one that drops all traffic and another that points to the kernel flow table. If the steering anchor is destroyed, only the rule pointing to the kernel's flow table is removed. Any traffic reaching the special flow table after that is dropped.
Since the special flow table is not destroyed when the steering anchor is destroyed, any issues are prevented from occurring. The remaining resources are only destroyed when the RDMA device is destroyed, which happens after all DEVX objects are freed, including the STCs, thus mitigating the issue.
--- drivers/infiniband/hw/mlx5/fs.c | 276 ++++++++++++++++++++++++++- drivers/infiniband/hw/mlx5/fs.h | 16 ++ drivers/infiniband/hw/mlx5/mlx5_ib.h | 11 ++ 3 files changed, 296 insertions(+), 7 deletions(-)
drivers/infiniband/hw/mlx5/fs.c +269 -7
@@ -696,8 +696,6 @@ static struct mlx5_ib_flow_prio *_get_prio(struct mlx5_ib_dev *dev,struct mlx5_flow_table_attr ft_attr = {};struct mlx5_flow_table *ft; -if (mlx5_ib_shared_ft_allowed (&dev->ib_dev)) - ft_attr.uid =MLX5_SHARED_RESOURCE_UID ; ft_attr.prio = priority; ft_attr.max_fte = num_entries; ft_attr.flags = flags;
@@ -2026,6 +2024,237 @@ static int flow_matcher_cleanup(struct ib_uobject *uobject,return 0 ; } +static int steering_anchor_create_ft (struct mlx5_ib_dev *dev, +struct mlx5_ib_flow_prio *ft_prio, +enum mlx5_flow_namespace_type ns_type) +{ +struct mlx5_flow_table_attr ft_attr = {}; +struct mlx5_flow_namespace *ns; +struct mlx5_flow_table *ft; + +if (ft_prio->anchor.ft) +return 0 ; + + ns =mlx5_get_flow_namespace (dev->mdev, ns_type); +if (!ns) +return -EOPNOTSUPP ; + + ft_attr.flags =MLX5_FLOW_TABLE_UNMANAGED ; + ft_attr.uid =MLX5_SHARED_RESOURCE_UID ; + ft_attr.prio =0 ; + ft_attr.max_fte =2 ; + ft_attr.level =1 ; + + ft =mlx5_create_flow_table (ns, &ft_attr); +if (IS_ERR (ft)) +return PTR_ERR (ft); + + ft_prio->anchor.ft = ft; + +return 0 ; +} + +static void steering_anchor_destroy_ft (struct mlx5_ib_flow_prio *ft_prio) +{ +if (ft_prio->anchor.ft) { +mlx5_destroy_flow_table (ft_prio->anchor.ft); + ft_prio->anchor.ft =NULL ; + } +} + +static int +steering_anchor_create_fg_drop (struct mlx5_ib_flow_prio *ft_prio) +{ +int inlen =MLX5_ST_SZ_BYTES (create_flow_group_in); +struct mlx5_flow_group *fg; +void *flow_group_in; +int err =0 ; + +if (ft_prio->anchor.fg_drop) +return 0 ; + + flow_group_in =kvzalloc (inlen,GFP_KERNEL ); +if (!flow_group_in) +return -ENOMEM ; + +MLX5_SET (create_flow_group_in, flow_group_in, start_flow_index,1 ); +MLX5_SET (create_flow_group_in, flow_group_in, end_flow_index,1 ); + + fg =mlx5_create_flow_group (ft_prio->anchor.ft, flow_group_in); +if (IS_ERR (fg)) { + err =PTR_ERR (fg); + goto out; + } + + ft_prio->anchor.fg_drop = fg; + +out: +kvfree (flow_group_in); + +return err; +} + +static void +steering_anchor_destroy_fg_drop (struct mlx5_ib_flow_prio *ft_prio) +{ +if (ft_prio->anchor.fg_drop) { +mlx5_destroy_flow_group (ft_prio->anchor.fg_drop); + ft_prio->anchor.fg_drop =NULL ; + } +} + +static int +steering_anchor_create_fg_goto_table (struct mlx5_ib_flow_prio *ft_prio) +{ +int inlen =MLX5_ST_SZ_BYTES (create_flow_group_in); +struct mlx5_flow_group *fg; +void *flow_group_in; +int err =0 ; + +if (ft_prio->anchor.fg_goto_table) +return 0 ; + + flow_group_in =kvzalloc (inlen,GFP_KERNEL ); +if (!flow_group_in) +return -ENOMEM ; + + fg =mlx5_create_flow_group (ft_prio->anchor.ft, flow_group_in); +if (IS_ERR (fg)) { + err =PTR_ERR (fg); + goto out; + } + ft_prio->anchor.fg_goto_table = fg; + +out: +kvfree (flow_group_in); + +return err; +} + +static void +steering_anchor_destroy_fg_goto_table (struct mlx5_ib_flow_prio *ft_prio) +{ +if (ft_prio->anchor.fg_goto_table) { +mlx5_destroy_flow_group (ft_prio->anchor.fg_goto_table); + ft_prio->anchor.fg_goto_table =NULL ; + } +} + +static int +steering_anchor_create_rule_drop (struct mlx5_ib_flow_prio *ft_prio) +{ +struct mlx5_flow_act flow_act = {}; +struct mlx5_flow_handle *handle; + +if (ft_prio->anchor.rule_drop) +return 0 ; + + flow_act.fg = ft_prio->anchor.fg_drop; + flow_act.action =MLX5_FLOW_CONTEXT_ACTION_DROP ; + + handle =mlx5_add_flow_rules (ft_prio->anchor.ft,NULL , &flow_act, +NULL ,0 ); +if (IS_ERR (handle)) +return PTR_ERR (handle); + + ft_prio->anchor.rule_drop = handle; + +return 0 ; +} + +static void steering_anchor_destroy_rule_drop (struct mlx5_ib_flow_prio *ft_prio) +{ +if (ft_prio->anchor.rule_drop) { +mlx5_del_flow_rules (ft_prio->anchor.rule_drop); + ft_prio->anchor.rule_drop =NULL ; + } +} + +static int +steering_anchor_create_rule_goto_table (struct mlx5_ib_flow_prio *ft_prio) +{ +struct mlx5_flow_destination dest = {}; +struct mlx5_flow_act flow_act = {}; +struct mlx5_flow_handle *handle; + +if (ft_prio->anchor.rule_goto_table) +return 0 ; + + flow_act.action =MLX5_FLOW_CONTEXT_ACTION_FWD_DEST ; + flow_act.flags |=FLOW_ACT_IGNORE_FLOW_LEVEL ; + flow_act.fg = ft_prio->anchor.fg_goto_table; + + dest.type =MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE ; + dest.ft = ft_prio->flow_table; + + handle =mlx5_add_flow_rules (ft_prio->anchor.ft,NULL , &flow_act, + &dest,1 ); +if (IS_ERR (handle)) +return PTR_ERR (handle); + + ft_prio->anchor.rule_goto_table = handle; + +return 0 ; +} + +static void +steering_anchor_destroy_rule_goto_table (struct mlx5_ib_flow_prio *ft_prio) +{ +if (ft_prio->anchor.rule_goto_table) { +mlx5_del_flow_rules (ft_prio->anchor.rule_goto_table); + ft_prio->anchor.rule_goto_table =NULL ; + } +} + +static int steering_anchor_create_res (struct mlx5_ib_dev *dev, +struct mlx5_ib_flow_prio *ft_prio, +enum mlx5_flow_namespace_type ns_type) +{ +int err; + + err =steering_anchor_create_ft (dev, ft_prio, ns_type); +if (err) +return err; + + err =steering_anchor_create_fg_drop (ft_prio); +if (err) + goto destroy_ft; + + err =steering_anchor_create_fg_goto_table (ft_prio); +if (err) + goto destroy_fg_drop; + + err =steering_anchor_create_rule_drop (ft_prio); +if (err) + goto destroy_fg_goto_table; + + err =steering_anchor_create_rule_goto_table (ft_prio); +if (err) + goto destroy_rule_drop; + +return 0 ; + +destroy_rule_drop: +steering_anchor_destroy_rule_drop (ft_prio); +destroy_fg_goto_table: +steering_anchor_destroy_fg_goto_table (ft_prio); +destroy_fg_drop: +steering_anchor_destroy_fg_drop (ft_prio); +destroy_ft: +steering_anchor_destroy_ft (ft_prio); + +return err; +} + +static void mlx5_steering_anchor_destroy_res (struct mlx5_ib_flow_prio *ft_prio) +{ +steering_anchor_destroy_rule_goto_table (ft_prio); +steering_anchor_destroy_rule_drop (ft_prio); +steering_anchor_destroy_fg_goto_table (ft_prio); +steering_anchor_destroy_fg_drop (ft_prio); +steering_anchor_destroy_ft (ft_prio); +} +static int steering_anchor_cleanup (struct ib_uobject *uobject,enum rdma_remove_reason why,struct uverbs_attr_bundle *attrs)
@@ -2036,6 +2265,9 @@ static int steering_anchor_cleanup(struct ib_uobject *uobject,return -EBUSY ;mutex_lock (&obj->dev->flow_db->lock); +if (!--obj->ft_prio->anchor.rule_goto_table_ref) +steering_anchor_destroy_rule_goto_table (obj->ft_prio); +put_flow_table (obj->dev, obj->ft_prio, true);mutex_unlock (&obj->dev->flow_db->lock);
@@ -2043,6 +2275,24 @@ static int steering_anchor_cleanup(struct ib_uobject *uobject,return 0 ; } +static void fs_cleanup_anchor (struct mlx5_ib_flow_prio *prio, +int count) +{ +while (count--) +mlx5_steering_anchor_destroy_res (&prio[count]); +} + +void mlx5_ib_fs_cleanup_anchor (struct mlx5_ib_dev *dev) +{ +fs_cleanup_anchor (dev->flow_db->prios,MLX5_IB_NUM_FLOW_FT ); +fs_cleanup_anchor (dev->flow_db->egress_prios,MLX5_IB_NUM_FLOW_FT ); +fs_cleanup_anchor (dev->flow_db->sniffer,MLX5_IB_NUM_SNIFFER_FTS ); +fs_cleanup_anchor (dev->flow_db->egress,MLX5_IB_NUM_EGRESS_FTS ); +fs_cleanup_anchor (dev->flow_db->fdb,MLX5_IB_NUM_FDB_FTS ); +fs_cleanup_anchor (dev->flow_db->rdma_rx,MLX5_IB_NUM_FLOW_FT ); +fs_cleanup_anchor (dev->flow_db->rdma_tx,MLX5_IB_NUM_FLOW_FT ); +} +static int mlx5_ib_matcher_ns (struct uverbs_attr_bundle *attrs,struct mlx5_ib_flow_matcher *obj) {
@@ -2183,21 +2433,31 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_STEERING_ANCHOR_CREATE)(return -ENOMEM ;mutex_lock (&dev->flow_db->lock); + ft_prio =_get_flow_table (dev, priority, ns_type,0 );if (IS_ERR (ft_prio)) { -mutex_unlock (&dev->flow_db->lock); err =PTR_ERR (ft_prio); goto free_obj; } ft_prio->refcount++; - ft_id =mlx5_flow_table_id (ft_prio->flow_table); -mutex_unlock (&dev->flow_db->lock); + +if (!ft_prio->anchor.rule_goto_table_ref) { + err =steering_anchor_create_res (dev, ft_prio, ns_type); +if (err) + goto put_flow_table; + } + + ft_prio->anchor.rule_goto_table_ref++; + + ft_id =mlx5_flow_table_id (ft_prio->anchor.ft); err =uverbs_copy_to (attrs,MLX5_IB_ATTR_STEERING_ANCHOR_FT_ID , &ft_id,sizeof (ft_id));if (err) - goto put_flow_table; + goto destroy_res; + +mutex_unlock (&dev->flow_db->lock); uobj->object = obj; obj->dev = dev;
@@ -2206,8 +2466,10 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_STEERING_ANCHOR_CREATE)(return 0 ; +destroy_res: + --ft_prio->anchor.rule_goto_table_ref; +mlx5_steering_anchor_destroy_res (ft_prio); put_flow_table: -mutex_lock (&dev->flow_db->lock);put_flow_table (dev, ft_prio, true);mutex_unlock (&dev->flow_db->lock); free_obj:
drivers/infiniband/hw/mlx5/fs.h +16 -0
@@ -10,6 +10,7 @@#if IS_ENABLED (CONFIG_INFINIBAND_USER_ACCESS )int mlx5_ib_fs_init (struct mlx5_ib_dev *dev); +void mlx5_ib_fs_cleanup_anchor (struct mlx5_ib_dev *dev);#else static inline int mlx5_ib_fs_init (struct mlx5_ib_dev *dev) {
@@ -21,9 +22,24 @@ static inline int mlx5_ib_fs_init(struct mlx5_ib_dev *dev)mutex_init (&dev->flow_db->lock);return 0 ; } + +inline void mlx5_ib_fs_cleanup_anchor (struct mlx5_ib_dev *dev) {}#endif +static inline void mlx5_ib_fs_cleanup (struct mlx5_ib_dev *dev) { +/* When a steering anchor is created, a special flow table is also +* created for the user to reference. Since the user can reference it, +* the kernel cannot trust that when the user destroys the steering +* anchor, they no longer reference the flow table. +* +* To address this issue, when a user destroys a steering anchor, only +* the flow steering rule in the table is destroyed, but the table +* itself is kept to deal with the above scenario. The remaining +* resources are only removed when the RDMA device is destroyed, which +* is a safe assumption that all references are gone. +*/ +mlx5_ib_fs_cleanup_anchor (dev);kfree (dev->flow_db); }#endif /* _MLX5_IB_FS_H */
drivers/infiniband/hw/mlx5/mlx5_ib.h +11 -0
@@ -233,8 +233,19 @@ enum {#define MLX5_IB_NUM_SNIFFER_FTS 2#define MLX5_IB_NUM_EGRESS_FTS 1#define MLX5_IB_NUM_FDB_FTS MLX5_BY_PASS_NUM_REGULAR_PRIOS + +struct mlx5_ib_anchor { +struct mlx5_flow_table *ft; +struct mlx5_flow_group *fg_goto_table; +struct mlx5_flow_group *fg_drop; +struct mlx5_flow_handle *rule_goto_table; +struct mlx5_flow_handle *rule_drop; +unsigned int rule_goto_table_ref; +}; +struct mlx5_ib_flow_prio {struct mlx5_flow_table *flow_table; +struct mlx5_ib_anchor anchor;unsigned int refcount; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 118/166 RDMA/cma: Always set static rate to 0 for RoCE
In reply to Greg Kroah-HartmanFrom: Mark Zhang <[email protected]>
[ Upstream commit 58030c76cce473b6cfd630bbecb97215def0dff8 ]
Set static rate to 0 as it should be discovered by path query and has no meaning for RoCE.
This also avoid of using the rtnl lock and ethtool API, which is a bottleneck when try to setup many rdma-cm connections at the same time, especially with multiple processes.
--- drivers/infiniband/core/cma.c | 4 ++-- include/rdma/ib_addr.h | 23 ----------------------- 2 files changed, 2 insertions(+), 25 deletions(-)
drivers/infiniband/core/cma.c +2 -2
@@ -3293,7 +3293,7 @@ static int cma_resolve_iboe_route(struct rdma_id_private *id_priv) route->path_rec->traffic_class = tos; route->path_rec->mtu =iboe_get_mtu (ndev->mtu); route->path_rec->rate_selector =IB_SA_EQ ; - route->path_rec->rate =iboe_get_rate (ndev); + route->path_rec->rate =IB_RATE_PORT_CURRENT ;dev_put (ndev); route->path_rec->packet_life_time_selector =IB_SA_EQ ;/* In case ACK timeout is set, use this value to calculate
@@ -4955,7 +4955,7 @@ static int cma_iboe_join_multicast(struct rdma_id_private *id_priv,if (!ndev)return -ENODEV ; - ib.rec.rate =iboe_get_rate (ndev); + ib.rec.rate =IB_RATE_PORT_CURRENT ; ib.rec.hop_limit =1 ; ib.rec.mtu =iboe_get_mtu (ndev->mtu);
include/rdma/ib_addr.h +0 -23
@@ -194,29 +194,6 @@ static inline enum ib_mtu iboe_get_mtu(int mtu)return 0 ; } -static inline int iboe_get_rate (struct net_device *dev) -{ -struct ethtool_link_ksettings cmd; -int err; - -rtnl_lock (); - err =__ethtool_get_link_ksettings (dev, &cmd); -rtnl_unlock (); -if (err) -return IB_RATE_PORT_CURRENT ; - -if (cmd.base.speed >=40000 ) -return IB_RATE_40_GBPS ; -else if (cmd.base.speed >=30000 ) -return IB_RATE_30_GBPS ; -else if (cmd.base.speed >=20000 ) -return IB_RATE_20_GBPS ; -else if (cmd.base.speed >=10000 ) -return IB_RATE_10_GBPS ; -else -return IB_RATE_PORT_CURRENT ; -} -static inline int rdma_link_local_addr (struct in6_addr *addr) { if (addr->s6_addr32[0] == htonl(0xfe800000) &&
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 119/166 IB/uverbs: Fix to consider event queue closing also upon non-blocking mode
In reply to Greg Kroah-HartmanFrom: Yishai Hadas <[email protected]>
[ Upstream commit 62fab312fa1683e812e605db20d4f22de3e3fb2f ]
Fix ib_uverbs_event_read() to consider event queue closing also upon non-blocking mode.
Once the queue is closed (e.g. hot-plug flow) all the existing events are cleaned-up as part of ib_uverbs_free_event_queue().
An application that uses the non-blocking FD mode should get -EIO in that case to let it knows that the device was removed already.
Otherwise, it can loose the indication that the device was removed and won't recover.
As part of that, refactor the code to have a single flow with regards to 'is_closed' for both blocking and non-blocking modes.
--- drivers/infiniband/core/uverbs_main.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
drivers/infiniband/core/uverbs_main.c +5 -7
@@ -222,8 +222,12 @@ static ssize_t ib_uverbs_event_read(struct ib_uverbs_event_queue *ev_queue,spin_lock_irq (&ev_queue->lock);while (list_empty (&ev_queue->event_list)) { -spin_unlock_irq (&ev_queue->lock); +if (ev_queue->is_closed) { +spin_unlock_irq (&ev_queue->lock); +return -EIO ; + } +spin_unlock_irq (&ev_queue->lock);if (filp->f_flags &O_NONBLOCK )return -EAGAIN ;
@@ -233,12 +237,6 @@ static ssize_t ib_uverbs_event_read(struct ib_uverbs_event_queue *ev_queue,return -ERESTARTSYS ;spin_lock_irq (&ev_queue->lock); - -/* If device was disassociated and no event exists set an error */ -if (list_empty (&ev_queue->event_list) && ev_queue->is_closed) { -spin_unlock_irq (&ev_queue->lock); -return -EIO ; - } } event = list_entry(ev_queue->event_list.next, struct ib_uverbs_event, list);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 120/166 RDMA/mlx5: Fix affinity assignment
In reply to Greg Kroah-HartmanFrom: Mark Bloch <[email protected]>
[ Upstream commit 617f5db1a626f18d5cbb7c7faf7bf8f9ea12be78 ]
The cited commit aimed to ensure that Virtual Functions (VFs) assign a queue affinity to a Queue Pair (QP) to distribute traffic when the LAG master creates a hardware LAG. If the affinity was set while the hardware was not in LAG, the firmware would ignore the affinity value.
However, this commit unintentionally assigned an affinity to QPs on the LAG master's VPORT even if the RDMA device was not marked as LAG-enabled. In most cases, this was not an issue because when the hardware entered hardware LAG configuration, the RDMA device of the LAG master would be destroyed and a new one would be created, marked as LAG-enabled.
The problem arises when a user configures Equal-Cost Multipath (ECMP). In ECMP mode, traffic can be directed to different physical ports based on the queue affinity, which is intended for use by VPORTS other than the E-Switch manager. ECMP mode is supported only if both E-Switch managers are in switchdev mode and the appropriate route is configured via IP. In this configuration, the RDMA device is not destroyed, and we retain the RDMA device that is not marked as LAG-enabled.
To ensure correct behavior, Send Queues (SQs) opened by the E-Switch manager through verbs should be assigned strict affinity. This means they will only be able to communicate through the native physical port associated with the E-Switch manager. This will prevent the firmware from assigning affinity and will not allow the SQs to be remapped in case of failover.
--- drivers/infiniband/hw/mlx5/mlx5_ib.h | 3 +++ drivers/infiniband/hw/mlx5/qp.c | 3 +++ drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h | 12 ------------ include/linux/mlx5/driver.h | 12 ++++++++++++ 4 files changed, 18 insertions(+), 12 deletions(-)
drivers/infiniband/hw/mlx5/mlx5_ib.h +3 -0
@@ -1564,6 +1564,9 @@ static inline bool mlx5_ib_lag_should_assign_affinity(struct mlx5_ib_dev *dev) MLX5_CAP_PORT_SELECTION(dev->mdev, port_select_flow_table_bypass))return 0 ; +if (mlx5_lag_is_lacp_owner (dev->mdev) && !dev->lag_active) +return 0 ; +return dev->lag_active || (MLX5_CAP_GEN (dev->mdev, num_lag_ports) >1 &&MLX5_CAP_GEN (dev->mdev, lag_tx_port_affinity));
drivers/infiniband/hw/mlx5/qp.c +3 -0
@@ -1156,6 +1156,9 @@ static int create_raw_packet_qp_tis(struct mlx5_ib_dev *dev,MLX5_SET (create_tis_in, in, uid,to_mpd (pd)->uid);MLX5_SET (tisc, tisc, transport_domain, tdn); +if (!mlx5_ib_lag_should_assign_affinity (dev) && +mlx5_lag_is_lacp_owner (dev->mdev)) +MLX5_SET (tisc, tisc, strict_lag_tx_port_affinity,1 );if (qp->flags &IB_QP_CREATE_SOURCE_QPN )MLX5_SET (tisc, tisc, underlay_qpn, qp->underlay_qpn);
drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h +0 -12
@@ -275,18 +275,6 @@ static inline bool mlx5_sriov_is_enabled(struct mlx5_core_dev *dev)return pci_num_vf (dev->pdev) ? true : false; } -static inline int mlx5_lag_is_lacp_owner (struct mlx5_core_dev *dev) -{ -/* LACP owner conditions: -* 1) Function is physical. -* 2) LAG is supported by FW. -* 3) LAG is managed by driver (currently the only option). -*/ -return MLX5_CAP_GEN (dev, vport_group_manager) && - (MLX5_CAP_GEN (dev, num_lag_ports) >1 ) && -MLX5_CAP_GEN (dev, lag_master); -} -int mlx5_rescan_drivers_locked (struct mlx5_core_dev *dev);static inline int mlx5_rescan_drivers (struct mlx5_core_dev *dev) {
include/linux/mlx5/driver.h +12 -0
@@ -1230,6 +1230,18 @@ static inline u16 mlx5_core_max_vfs(const struct mlx5_core_dev *dev)return dev->priv.sriov.max_vfs; } +static inline int mlx5_lag_is_lacp_owner (struct mlx5_core_dev *dev) +{ +/* LACP owner conditions: +* 1) Function is physical. +* 2) LAG is supported by FW. +* 3) LAG is managed by driver (currently the only option). +*/ +return MLX5_CAP_GEN (dev, vport_group_manager) && + (MLX5_CAP_GEN (dev, num_lag_ports) >1 ) && +MLX5_CAP_GEN (dev, lag_master); +} +static inline int mlx5_get_gid_table_len (u16 param) {if (param >4 ) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 121/166 IB/isert: Fix dead lock in ib_isert
In reply to Greg Kroah-HartmanFrom: Saravanan Vajravel <[email protected]>
[ Upstream commit 691b0480933f0ce88a81ed1d1a0aff340ff6293a ]
- When a iSER session is released, ib_isert module is taking a mutex lock and releasing all pending connections. As part of this, ib_isert is destroying rdma cm_id. To destroy cm_id, rdma_cm module is sending CM events to CMA handler of ib_isert. This handler is taking same mutex lock. Hence it leads to deadlock between ib_isert & rdma_cm modules.
- For fix, created local list of pending connections and release the connection outside of mutex lock.
Calltrace:
---------
[ 1229.791410] INFO: task kworker/10:1:642 blocked for more than 120 seconds. [ 1229.791416] Tainted: G OE --------- - - 4.18.0-372.9.1.el8.x86_64 #1 [ 1229.791418] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1229.791419] task:kworker/10:1 state:D stack: 0 pid: 642 ppid: 2 flags:0x80004000 [ 1229.791424] Workqueue: ib_cm cm_work_handler [ib_cm] [ 1229.791436] Call Trace: [ 1229.791438] __schedule+0x2d1/0x830 [ 1229.791445] ? select_idle_sibling+0x23/0x6f0 [ 1229.791449] schedule+0x35/0xa0 [ 1229.791451] schedule_preempt_disabled+0xa/0x10 [ 1229.791453] __mutex_lock.isra.7+0x310/0x420 [ 1229.791456] ? select_task_rq_fair+0x351/0x990 [ 1229.791459] isert_cma_handler+0x224/0x330 [ib_isert] [ 1229.791463] ? ttwu_queue_wakelist+0x159/0x170 [ 1229.791466] cma_cm_event_handler+0x25/0xd0 [rdma_cm] [ 1229.791474] cma_ib_handler+0xa7/0x2e0 [rdma_cm] [ 1229.791478] cm_process_work+0x22/0xf0 [ib_cm] [ 1229.791483] cm_work_handler+0xf4/0xf30 [ib_cm] [ 1229.791487] ? move_linked_works+0x6e/0xa0 [ 1229.791490] process_one_work+0x1a7/0x360 [ 1229.791491] ? create_worker+0x1a0/0x1a0 [ 1229.791493] worker_thread+0x30/0x390 [ 1229.791494] ? create_worker+0x1a0/0x1a0 [ 1229.791495] kthread+0x10a/0x120 [ 1229.791497] ? set_kthread_struct+0x40/0x40 [ 1229.791499] ret_from_fork+0x1f/0x40
[ 1229.791739] INFO: task targetcli:28666 blocked for more than 120 seconds. [ 1229.791740] Tainted: G OE --------- - - 4.18.0-372.9.1.el8.x86_64 #1 [ 1229.791741] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1229.791742] task:targetcli state:D stack: 0 pid:28666 ppid: 5510 flags:0x00004080 [ 1229.791743] Call Trace: [ 1229.791744] __schedule+0x2d1/0x830 [ 1229.791746] schedule+0x35/0xa0 [ 1229.791748] schedule_preempt_disabled+0xa/0x10 [ 1229.791749] __mutex_lock.isra.7+0x310/0x420 [ 1229.791751] rdma_destroy_id+0x15/0x20 [rdma_cm] [ 1229.791755] isert_connect_release+0x115/0x130 [ib_isert] [ 1229.791757] isert_free_np+0x87/0x140 [ib_isert] [ 1229.791761] iscsit_del_np+0x74/0x120 [iscsi_target_mod] [ 1229.791776] lio_target_np_driver_store+0xe9/0x140 [iscsi_target_mod] [ 1229.791784] configfs_write_file+0xb2/0x110 [ 1229.791788] vfs_write+0xa5/0x1a0 [ 1229.791792] ksys_write+0x4f/0xb0 [ 1229.791794] do_syscall_64+0x5b/0x1a0 [ 1229.791798] entry_SYSCALL_64_after_hwframe+0x65/0xca
--- drivers/infiniband/ulp/isert/ib_isert.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/infiniband/ulp/isert/ib_isert.c +8 -2
@@ -2432,6 +2432,7 @@ isert_free_np(struct iscsi_np *np) {struct isert_np *isert_np = np->np_context;struct isert_conn *isert_conn, *n; +LIST_HEAD (drop_conn_list);if (isert_np->cm_id)rdma_destroy_id (isert_np->cm_id);
@@ -2451,7 +2452,7 @@ isert_free_np(struct iscsi_np *np) node) {isert_info ("cleaning isert_conn %p state (%d)\n" , isert_conn, isert_conn->state); -isert_connect_release (isert_conn); +list_move_tail (&isert_conn->node, &drop_conn_list); } }
@@ -2462,11 +2463,16 @@ isert_free_np(struct iscsi_np *np) node) {isert_info ("cleaning isert_conn %p state (%d)\n" , isert_conn, isert_conn->state); -isert_connect_release (isert_conn); +list_move_tail (&isert_conn->node, &drop_conn_list); } }mutex_unlock (&isert_np->mutex); +list_for_each_entry_safe (isert_conn, n, &drop_conn_list, node) { +list_del_init (&isert_conn->node); +isert_connect_release (isert_conn); + } + np->np_context =NULL ;kfree (isert_np); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 122/166 IB/isert: Fix possible list corruption in CMA handler
In reply to Greg Kroah-HartmanFrom: Saravanan Vajravel <[email protected]>
[ Upstream commit 7651e2d6c5b359a28c2d4c904fec6608d1021ca8 ]
When ib_isert module receives connection error event, it is releasing the isert session and removes corresponding list node but it doesn't take appropriate mutex lock to remove the list node. This can lead to linked list corruption
--- drivers/infiniband/ulp/isert/ib_isert.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/infiniband/ulp/isert/ib_isert.c +4 -0
@@ -657,9 +657,13 @@ static int isert_connect_error(struct rdma_cm_id *cma_id) {struct isert_conn *isert_conn = cma_id->qp->qp_context; +struct isert_np *isert_np = cma_id->context;ib_drain_qp (isert_conn->qp); + +mutex_lock (&isert_np->mutex);list_del_init (&isert_conn->node); +mutex_unlock (&isert_np->mutex); isert_conn->cm_id =NULL ;isert_put_conn (isert_conn);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 123/166 IB/isert: Fix incorrect release of isert connection
In reply to Greg Kroah-HartmanFrom: Saravanan Vajravel <[email protected]>
[ Upstream commit 699826f4e30ab76a62c238c86fbef7e826639c8d ]
The ib_isert module is releasing the isert connection both in isert_wait_conn() handler as well as isert_free_conn() handler. In isert_wait_conn() handler, it is expected to wait for iSCSI session logout operation to complete. It should free the isert connection only in isert_free_conn() handler.
When a bunch of iSER target is cleared, this issue can lead to use-after-free memory issue as isert conn is twice released
--- drivers/infiniband/ulp/isert/ib_isert.c | 2 -- 1 file changed, 2 deletions(-)
drivers/infiniband/ulp/isert/ib_isert.c +0 -2
@@ -2571,8 +2571,6 @@ static void isert_wait_conn(struct iscsit_conn *conn)isert_put_unsol_pending_cmds (conn);isert_wait4cmds (conn);isert_wait4logout (isert_conn); - -queue_work (isert_release_wq, &isert_conn->release_work); }static void isert_free_conn (struct iscsit_conn *conn)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 124/166 net: ethtool: correct MAX attribute value for stats
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
[ Upstream commit 52f79609c0c5b25fddb88e85f25ce08aa7e3fb42 ]
When compiling YNL generated code compiler complains about array-initializer-out-of-bounds. Turns out the MAX value for STATS_GRP uses the value for STATS.
This may lead to random corruptions in user space (kernel itself doesn't use this value as it never parses stats).
--- include/uapi/linux/ethtool_netlink.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/uapi/linux/ethtool_netlink.h +1 -1
@@ -761,7 +761,7 @@ enum {/* add new constants above here */ __ETHTOOL_A_STATS_GRP_CNT, -ETHTOOL_A_STATS_GRP_MAX = (__ETHTOOL_A_STATS_CNT -1 ) +ETHTOOL_A_STATS_GRP_MAX = (__ETHTOOL_A_STATS_GRP_CNT -1 ) }; enum {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 125/166 ipvlan: fix bound dev checking for IPv6 l3s mode
In reply to Greg Kroah-HartmanFrom: Hangbin Liu <[email protected]>
[ Upstream commit ce57adc222aba32431c42632b396e9213d0eb0b8 ]
The commit 59a0b022aa24 ("ipvlan: Make skb->skb_iif track skb->dev for l3s mode") fixed ipvlan bonded dev checking by updating skb skb_iif. This fix works for IPv4, as in raw_v4_input() the dif is from inet_iif(skb), which is skb->skb_iif when there is no route.
But for IPv6, the fix is not enough, because in ipv6_raw_deliver() -> raw_v6_match(), the dif is inet6_iif(skb), which is returns IP6CB(skb)->iif instead of skb->skb_iif if it's not a l3_slave. To fix the IPv6 part issue. Let's set IP6CB(skb)->iif to correct ifindex.
BTW, ipvlan handles NS/NA specifically. Since it works fine, I will not reset IP6CB(skb)->iif when addr->atype is IPVL_ICMPV6.
--- drivers/net/ipvlan/ipvlan_l3s.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ipvlan/ipvlan_l3s.c +4 -0
@@ -102,6 +102,10 @@ static unsigned int ipvlan_nf_input(void *priv, struct sk_buff *skb, skb->dev = addr->master->dev; skb->skb_iif = skb->dev->ifindex; +#if IS_ENABLED (CONFIG_IPV6 ) +if (addr->atype ==IPVL_IPV6 ) +IP6CB (skb)->iif = skb->dev->ifindex; +#endif len = skb->len +ETH_HLEN ;ipvlan_count_rx (addr->master, len, true, false); out:
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 126/166 sctp: fix an error code in sctp_sf_eat_auth()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 75e6def3b26736e7ff80639810098c9074229737 ]
The sctp_sf_eat_auth() function is supposed to enum sctp_disposition values and returning a kernel error code will cause issues in the caller. Change -ENOMEM to SCTP_DISPOSITION_NOMEM.
--- net/sctp/sm_statefuns.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sctp/sm_statefuns.c +1 -1
@@ -4484,7 +4484,7 @@ enum sctp_disposition sctp_sf_eat_auth(struct net *net, SCTP_AUTH_NEW_KEY, GFP_ATOMIC);if (!ev) -return -ENOMEM ; +return SCTP_DISPOSITION_NOMEM ;sctp_add_cmd_sf (commands,SCTP_CMD_EVENT_ULP ,SCTP_ULPEVENT (ev));
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 127/166 igc: Clean the TX buffer and TX descriptor ring
In reply to Greg Kroah-HartmanFrom: Muhammad Husaini Zulkifli <[email protected]>
[ Upstream commit e43516f5978d11d36511ce63d31d1da4db916510 ]
There could be a race condition during link down where interrupt being generated and igc_clean_tx_irq() been called to perform the TX completion. Properly clear the TX buffer/descriptor ring and disable the TX Queue ring in igc_free_tx_resources() to avoid that.
Kernel trace:
[ 108.237177] Hardware name: Intel Corporation Tiger Lake Client Platform/TigerLake U DDR4 SODIMM RVP, BIOS TGLIFUI1.R00.4204.A00.2105270302 05/27/2021 [ 108.237178] RIP: 0010:refcount_warn_saturate+0x55/0x110 [ 108.242143] RSP: 0018:ffff9e7980003db0 EFLAGS: 00010286 [ 108.245555] Code: 84 bc 00 00 00 c3 cc cc cc cc 85 f6 74 46 80 3d 20 8c 4d 01 00 75 ee 48 c7 c7 88 f4 03 ab c6 05 10 8c 4d 01 01 e8 0b 10 96 ff <0f> 0b c3 cc cc cc cc 80 3d fc 8b 4d 01 00 75 cb 48 c7 c7 b0 f4 03 [ 108.250434] [ 108.250434] RSP: 0018:ffff9e798125f910 EFLAGS: 00010286 [ 108.254358] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 108.259325] [ 108.259325] RAX: 0000000000000000 RBX: ffff8ddb935b8000 RCX: 0000000000000027 [ 108.261868] RDX: ffff8de250a28800 RSI: ffff8de250a1c580 RDI: ffff8de250a1c580 [ 108.265538] RDX: 0000000000000027 RSI: 0000000000000002 RDI: ffff8de250a9c588 [ 108.265539] RBP: ffff8ddb935b8000 R08: ffffffffab2655a0 R09: ffff9e798125f898 [ 108.267914] RBP: ffff8ddb8a5b8d80 R08: 0000005648eba354 R09: 0000000000000000 [ 108.270196] R10: 0000000000000001 R11: 000000002d2d2d2d R12: ffff9e798125f948 [ 108.270197] R13: ffff9e798125fa1c R14: ffff8ddb8a5b8d80 R15: 7fffffffffffffff [ 108.273001] R10: 000000002d2d2d2d R11: 000000002d2d2d2d R12: ffff8ddb8a5b8ed4 [ 108.276410] FS: 00007f605851b740(0000) GS:ffff8de250a80000(0000) knlGS:0000000000000000 [ 108.280597] R13: 00000000000002ac R14: 00000000ffffff99 R15: ffff8ddb92561b80 [ 108.282966] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 108.282967] CR2: 00007f053c039248 CR3: 0000000185850003 CR4: 0000000000f70ee0 [ 108.286206] FS: 0000000000000000(0000) GS:ffff8de250a00000(0000) knlGS:0000000000000000 [ 108.289701] PKRU: 55555554 [ 108.289702] Call Trace: [ 108.289704] <TASK> [ 108.293977] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 108.297562] sock_alloc_send_pskb+0x20c/0x240 [ 108.301494] CR2: 00007f053c03a168 CR3: 0000000184394002 CR4: 0000000000f70ef0 [ 108.301495] PKRU: 55555554 [ 108.306464] __ip_append_data.isra.0+0x96f/0x1040 [ 108.309441] Call Trace: [ 108.309443] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 108.314927] <IRQ> [ 108.314928] sock_wfree+0x1c7/0x1d0 [ 108.318078] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 108.320276] skb_release_head_state+0x32/0x90 [ 108.324812] ip_make_skb+0xf6/0x130 [ 108.327188] skb_release_all+0x16/0x40 [ 108.330775] ? udp_sendmsg+0x9f3/0xcb0 [ 108.332626] napi_consume_skb+0x48/0xf0 [ 108.334134] ? xfrm_lookup_route+0x23/0xb0 [ 108.344285] igc_poll+0x787/0x1620 [igc] [ 108.346659] udp_sendmsg+0x9f3/0xcb0 [ 108.360010] ? ttwu_do_activate+0x40/0x220 [ 108.365237] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 108.366744] ? try_to_wake_up+0x289/0x5e0 [ 108.376987] ? sock_sendmsg+0x81/0x90 [ 108.395698] ? __pfx_process_timeout+0x10/0x10 [ 108.395701] sock_sendmsg+0x81/0x90 [ 108.409052] __napi_poll+0x29/0x1c0 [ 108.414279] ____sys_sendmsg+0x284/0x310 [ 108.419507] net_rx_action+0x257/0x2d0 [ 108.438216] ___sys_sendmsg+0x7c/0xc0 [ 108.439723] __do_softirq+0xc1/0x2a8 [ 108.444950] ? finish_task_switch+0xb4/0x2f0 [ 108.452077] irq_exit_rcu+0xa9/0xd0 [ 108.453584] ? __schedule+0x372/0xd00 [ 108.460713] common_interrupt+0x84/0xa0 [ 108.467840] ? clockevents_program_event+0x95/0x100 [ 108.474968] </IRQ> [ 108.482096] ? do_nanosleep+0x88/0x130 [ 108.489224] <TASK> [ 108.489225] asm_common_interrupt+0x26/0x40 [ 108.496353] ? __rseq_handle_notify_resume+0xa9/0x4f0 [ 108.503478] RIP: 0010:cpu_idle_poll+0x2c/0x100 [ 108.510607] __sys_sendmsg+0x5d/0xb0 [ 108.518687] Code: 05 e1 d9 c8 00 65 8b 15 de 64 85 55 85 c0 7f 57 e8 b9 ef ff ff fb 65 48 8b 1c 25 00 cc 02 00 48 8b 03 a8 08 74 0b eb 1c f3 90 <48> 8b 03 a8 08 75 13 8b 05 77 63 cd 00 85 c0 75 ed e8 ce ec ff ff [ 108.525817] do_syscall_64+0x44/0xa0 [ 108.531563] RSP: 0018:ffffffffab203e70 EFLAGS: 00000202 [ 108.538693] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 108.546775] [ 108.546777] RIP: 0033:0x7f605862b7f7 [ 108.549495] RAX: 0000000000000001 RBX: ffffffffab20c940 RCX: 000000000000003b [ 108.551955] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 [ 108.554068] RDX: 4000000000000000 RSI: 000000002da97f6a RDI: 00000000002b8ff4 [ 108.559816] RSP: 002b:00007ffc99264058 EFLAGS: 00000246 [ 108.564178] RBP: 0000000000000000 R08: 00000000002b8ff4 R09: ffff8ddb01554c80 [ 108.571302] ORIG_RAX: 000000000000002e [ 108.571303] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f605862b7f7 [ 108.574023] R10: 000000000000015b R11: 000000000000000f R12: ffffffffab20c940 [ 108.574024] R13: 0000000000000000 R14: ffff8de26fbeef40 R15: ffffffffab20c940 [ 108.578727] RDX: 0000000000000000 RSI: 00007ffc992640a0 RDI: 0000000000000003 [ 108.578728] RBP: 00007ffc99264110 R08: 0000000000000000 R09: 175f48ad1c3a9c00 [ 108.581187] do_idle+0x62/0x230 [ 108.585890] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc992642d8 [ 108.585891] R13: 00005577814ab2ba R14: 00005577814addf0 R15: 00007f605876d000 [ 108.587920] cpu_startup_entry+0x1d/0x20 [ 108.591422] </TASK> [ 108.596127] rest_init+0xc5/0xd0 [ 108.600490] ---[ end trace 0000000000000000 ]---
Test Setup:
DUT:
- Change mac address on DUT Side. Ensure NIC not having same MAC Address
- Running udp_tai on DUT side. Let udp_tai running throughout the test
Example:
./udp_tai -i enp170s0 -P 100000 -p 90 -c 1 -t 0 -u 30004
Host:
- Perform link up/down every 5 second.
Result:
Kernel panic will happen on DUT Side.
--- drivers/net/ethernet/intel/igc/igc_main.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/igc/igc_main.c +8 -1
@@ -255,6 +255,13 @@ static void igc_clean_tx_ring(struct igc_ring *tx_ring)/* reset BQL for queue */ netdev_tx_reset_queue (txring_txq (tx_ring)); +/* Zero out the buffer ring */ +memset (tx_ring->tx_buffer_info,0 , +sizeof (*tx_ring->tx_buffer_info) * tx_ring->count); + +/* Zero out the descriptor ring */ +memset (tx_ring->desc,0 , tx_ring->size); +/* reset next_to_use and next_to_clean */ tx_ring->next_to_use =0 ; tx_ring->next_to_clean =0 ;
@@ -268,7 +275,7 @@ static void igc_clean_tx_ring(struct igc_ring *tx_ring)*/ void igc_free_tx_resources (struct igc_ring *tx_ring) { -igc_clean_tx_ring (tx_ring); +igc_disable_tx_ring (tx_ring);vfree (tx_ring->tx_buffer_info); tx_ring->tx_buffer_info =NULL ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 128/166 igc: Fix possible system crash when loading module
In reply to Greg Kroah-HartmanFrom: Vinicius Costa Gomes <[email protected]>
[ Upstream commit c080fe262f9e73a00934b70c16b1479cf40cd2bd ]
Guarantee that when probe() is run again, PTM and PCI busmaster will be in the same state as it was if the driver was never loaded.
Avoid an i225/i226 hardware issue that PTM requests can be made even though PCI bus mastering is not enabled. These unexpected PTM requests can crash some systems.
So, "force" disable PTM and busmastering before removing the driver, so they can be re-enabled in the right order during probe(). This is more like a workaround and should be applicable for i225 and i226, in any platform.
--- drivers/net/ethernet/intel/igc/igc_main.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/intel/igc/igc_main.c +3 -0
@@ -6685,6 +6685,9 @@ static void igc_remove(struct pci_dev *pdev)igc_ptp_stop (adapter); +pci_disable_ptm (pdev); +pci_clear_master (pdev); +set_bit (__IGC_DOWN, &adapter->state);del_timer_sync (&adapter->watchdog_timer);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 129/166 igb: fix nvm.ops.read() error handling
In reply to Greg Kroah-HartmanFrom: Aleksandr Loktionov <[email protected]>
[ Upstream commit 48a821fd58837800750ec1b3962f0f799630a844 ]
Add error handling into igb_set_eeprom() function, in case nvm.ops.read() fails just quit with error code asap.
--- drivers/net/ethernet/intel/igb/igb_ethtool.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/intel/igb/igb_ethtool.c +3 -0
@@ -822,6 +822,8 @@ static int igb_set_eeprom(struct net_device *netdev,*/ ret_val = hw->nvm.ops.read (hw, last_word,1 , &eeprom_buff[last_word - first_word]); +if (ret_val) + goto out; }/* Device's eeprom is always little-endian, word addressable */
@@ -841,6 +843,7 @@ static int igb_set_eeprom(struct net_device *netdev, hw->nvm.ops.update (hw);igb_set_fw_version (adapter); +out:kfree (eeprom_buff);return ret_val; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 130/166 net: phylink: report correct max speed for QUSGMII
In reply to Greg Kroah-HartmanFrom: Maxime Chevallier <[email protected]>
[ Upstream commit b9dc1046edfeb7d9dbc2272c8d9ad5a8c47f3199 ]
Q-USGMII is the quad port version of USGMII, and supports a max speed of 1Gbps on each line. Make so that phylink_interface_max_speed() reports this information correctly.
--- drivers/net/phy/phylink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/phy/phylink.c +1 -1
@@ -188,6 +188,7 @@ static int phylink_interface_max_speed(phy_interface_t interface)case PHY_INTERFACE_MODE_RGMII_ID :case PHY_INTERFACE_MODE_RGMII :case PHY_INTERFACE_MODE_QSGMII : +case PHY_INTERFACE_MODE_QUSGMII :case PHY_INTERFACE_MODE_SGMII :case PHY_INTERFACE_MODE_GMII :return SPEED_1000 ;
@@ -204,7 +205,6 @@ static int phylink_interface_max_speed(phy_interface_t interface)case PHY_INTERFACE_MODE_10GBASER :case PHY_INTERFACE_MODE_10GKR :case PHY_INTERFACE_MODE_USXGMII : -case PHY_INTERFACE_MODE_QUSGMII :return SPEED_10000 ;case PHY_INTERFACE_MODE_25GBASER :
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 131/166 net: phylink: use a dedicated helper to parse usgmii control word
In reply to Greg Kroah-HartmanFrom: Maxime Chevallier <[email protected]>
[ Upstream commit 923454c0368b8092e9d05c020f50abca577e7290 ]
Q-USGMII is a derivative of USGMII, that uses a specific formatting for the control word. The layout is close to the USXGMII control word, but doesn't support speeds over 1Gbps. Use a dedicated decoding logic for the USGMII control word, re-using USXGMII definitions but only considering 10/100/1000Mbps speeds
--- drivers/net/phy/phylink.c | 39 ++++++++++++++++++++++++++++++++++++++- 1 file changed, 38 insertions(+), 1 deletion(-)
drivers/net/phy/phylink.c +38 -1
@@ -3263,6 +3263,41 @@ void phylink_decode_usxgmii_word(struct phylink_link_state *state, }EXPORT_SYMBOL_GPL (phylink_decode_usxgmii_word); +/** +* phylink_decode_usgmii_word() - decode the USGMII word from a MAC PCS +* @state: a pointer to a struct phylink_link_state. +* @lpa: a 16 bit value which stores the USGMII auto-negotiation word +* +* Helper for MAC PCS supporting the USGMII protocol and the auto-negotiation +* code word. Decode the USGMII code word and populate the corresponding fields +* (speed, duplex) into the phylink_link_state structure. The structure for this +* word is the same as the USXGMII word, except it only supports speeds up to +* 1Gbps. +*/ +static void phylink_decode_usgmii_word (struct phylink_link_state *state, +uint16_t lpa) +{ +switch (lpa &MDIO_USXGMII_SPD_MASK ) { +case MDIO_USXGMII_10 : + state->speed =SPEED_10 ; +break ; +case MDIO_USXGMII_100 : + state->speed =SPEED_100 ; +break ; +case MDIO_USXGMII_1000 : + state->speed =SPEED_1000 ; +break ; +default : + state->link = false; +return ; + } + +if (lpa &MDIO_USXGMII_FULL_DUPLEX ) + state->duplex =DUPLEX_FULL ; +else + state->duplex =DUPLEX_HALF ; +} +/** * phylink_mii_c22_pcs_decode_state() - Decode MAC PCS state from MII registers * @state: a pointer to a &struct phylink_link_state.
@@ -3299,9 +3334,11 @@ void phylink_mii_c22_pcs_decode_state(struct phylink_link_state *state,case PHY_INTERFACE_MODE_SGMII :case PHY_INTERFACE_MODE_QSGMII : -case PHY_INTERFACE_MODE_QUSGMII :phylink_decode_sgmii_word (state, lpa);break ; +case PHY_INTERFACE_MODE_QUSGMII : +phylink_decode_usgmii_word (state, lpa); +break ;default : state->link = false;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 132/166 drm/nouveau: dont detect DSM for non-NVIDIA device
In reply to Greg Kroah-HartmanFrom: Ratchanan Srirattanamet <[email protected]>
[ Upstream commit 11d24327c2d7ad7f24fcc44fb00e1fa91ebf6525 ]
The call site of nouveau_dsm_pci_probe() uses single set of output variables for all invocations. So, we must not write anything to them unless it's an NVIDIA device. Otherwise, if we are called with another device after the NVIDIA device, we'll clober the result of the NVIDIA device.
For example, if the other device doesn't have _PR3 resources, the detection later would miss the presence of power resource support, and the rest of the code will keep using Optimus DSM, breaking power management for that machine.
Also, because we're detecting NVIDIA's DSM, it doesn't make sense to run this detection on a non-NVIDIA device anyway. Thus, check at the beginning of the detection code if this is an NVIDIA card, and just return if it isn't.
This, together with commit d22915d22ded ("drm/nouveau/devinit/tu102-:
wait for GFW_BOOT_PROGRESS == COMPLETED") developed independently and landed earlier, fixes runtime power management of the NVIDIA card in Lenovo Legion 5-15ARH05. Without this patch, the GPU resumption code will "timeout", sometimes hanging userspace.
As a bonus, we'll also stop preventing _PR3 usage from the bridge for unrelated devices, which is always nice, I guess.
--- drivers/gpu/drm/nouveau/nouveau_acpi.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/nouveau/nouveau_acpi.c +3 -0
@@ -220,6 +220,9 @@ static void nouveau_dsm_pci_probe(struct pci_dev *pdev, acpi_handle *dhandle_outint optimus_funcs;struct pci_dev *parent_pdev; +if (pdev->vendor !=PCI_VENDOR_ID_NVIDIA ) +return ; + *has_pr3 = false; parent_pdev =pci_upstream_bridge (pdev);if (parent_pdev) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 133/166 drm/bridge: ti-sn65dsi86: Avoid possible buffer overflow
In reply to Greg Kroah-HartmanFrom: Su Hui <[email protected]>
[ Upstream commit 95011f267c44a4d1f9ca1769e8a29ab2c559e004 ]
Smatch error:buffer overflow 'ti_sn_bridge_refclk_lut' 5 <= 5.
--- drivers/gpu/drm/bridge/ti-sn65dsi86.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/bridge/ti-sn65dsi86.c +4 -0
@@ -298,6 +298,10 @@ static void ti_sn_bridge_set_refclk_freq(struct ti_sn65dsi86 *pdata)if (refclk_lut[i] == refclk_rate)break ; +/* avoid buffer overflow and "1" is the default rate in the datasheet. */ +if (i >= refclk_lut_size) + i =1 ; +regmap_update_bits (pdata->regmap,SN_DPPLL_SRC_REG ,REFCLK_FREQ_MASK ,REFCLK_FREQ (i));
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 134/166 drm/nouveau/dp: check for NULL nv_connector->native_mode
In reply to Greg Kroah-HartmanFrom: Natalia Petrova <[email protected]>
[ Upstream commit 20a2ce87fbaf81e4c3dcb631d738e423959eb320 ]
Add checking for NULL before calling nouveau_connector_detect_depth() in nouveau_connector_get_modes() function because nv_connector->native_mode could be dereferenced there since connector pointer passed to nouveau_connector_detect_depth() and the same value of nv_connector->native_mode is used there.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/gpu/drm/nouveau/nouveau_connector.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/nouveau/nouveau_connector.c +2 -2
@@ -966,7 +966,7 @@ nouveau_connector_get_modes(struct drm_connector *connector)/* Determine display colour depth for everything except LVDS now, * DP requires this before mode_valid() is called. */ -if (connector->connector_type !=DRM_MODE_CONNECTOR_LVDS ) +if (connector->connector_type !=DRM_MODE_CONNECTOR_LVDS && nv_connector->native_mode)nouveau_connector_detect_depth (connector);/* Find the native mode if this is a digital panel, if we didn't
@@ -987,7 +987,7 @@ nouveau_connector_get_modes(struct drm_connector *connector)* "native" mode as some VBIOS tables require us to use the * pixel clock as part of the lookup... */ -if (connector->connector_type ==DRM_MODE_CONNECTOR_LVDS ) +if (connector->connector_type ==DRM_MODE_CONNECTOR_LVDS && nv_connector->native_mode)nouveau_connector_detect_depth (connector);if (nv_encoder->dcb->type ==DCB_OUTPUT_TV )
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 135/166 drm/nouveau: add nv_encoder pointer check for NULL
In reply to Greg Kroah-HartmanFrom: Natalia Petrova <[email protected]>
[ Upstream commit 55b94bb8c42464bad3d2217f6874aa1a85664eac ]
Pointer nv_encoder could be dereferenced at nouveau_connector.c in case it's equal to NULL by jumping to goto label. This patch adds a NULL-check to avoid it.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/gpu/drm/nouveau/nouveau_connector.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nouveau_connector.c +2 -1
@@ -730,7 +730,8 @@ nouveau_connector_detect_lvds(struct drm_connector *connector, bool force)#endif nouveau_connector_set_edid (nv_connector, edid); -nouveau_connector_set_encoder (connector, nv_encoder); +if (nv_encoder) +nouveau_connector_set_encoder (connector, nv_encoder);return status; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 136/166 selftests/tc-testing: Fix Error: Specified qdisc kind is unknown.
In reply to Greg Kroah-HartmanFrom: Vlad Buslov <[email protected]>
[ Upstream commit aef6e908b54200d04f2d77dab31509fcff2e60ae ]
All TEQL tests assume that sch_teql module is loaded. Load module in tdc.sh before running qdisc tests.
Fixes following example error when running tests via tdc.sh for all TEQL tests:
# $ sudo ./tdc.py -d eth2 -e 84a0
# -- ns/SubPlugin.__init__
# Test 84a0: Create TEQL with default setting
# exit: 2
# exit: 0
# Error: Specified qdisc kind is unknown.
#
# -----> teardown stage *** Could not execute: "$TC qdisc del dev $DUMMY handle 1: root" #
# -----> teardown stage *** Error message: "Error: Invalid handle.
# "
# returncode 2; expected [0]
#
# -----> teardown stage *** Aborting test run.
#
# <_io.BufferedReader name=3> *** stdout ***
#
# <_io.BufferedReader name=5> *** stderr ***
# "-----> teardown stage" did not complete successfully
# Exception <class '__main__.PluginMgrTestFail'> ('teardown', 'Error: Specified qdisc kind is unknown.\n', '"-----> teardown stage" did not complete successfully') (caught in test_runner, running test 2 84a0 Create TEQL with default setting stage teardown)
# ---------------
# traceback
# File "/images/src/linux/tools/testing/selftests/tc-testing/./tdc.py", line 495, in test_runner
# res = run_one_test(pm, args, index, tidx)
# File "/images/src/linux/tools/testing/selftests/tc-testing/./tdc.py", line 434, in run_one_test
# prepare_env(args, pm, 'teardown', '-----> teardown stage', tidx['teardown'], procout)
# File "/images/src/linux/tools/testing/selftests/tc-testing/./tdc.py", line 245, in prepare_env
# raise PluginMgrTestFail(
# ---------------
# accumulated output for this test:
# Error: Specified qdisc kind is unknown.
#
# ---------------
#
# All test results:
#
# 1..1
# ok 1 84a0 - Create TEQL with default setting # skipped - "-----> teardown stage" did not complete successfully--- tools/testing/selftests/tc-testing/tdc.sh | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/tc-testing/tdc.sh +1 -0
@@ -2,5 +2,6 @@ # SPDX-License-Identifier: GPL-2.0 modprobe netdevsim +modprobe sch_teql ./tdc.py -c actions --nobuildebpf ./tdc.py -c qdisc
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 137/166 selftests/tc-testing: Fix Error: failed to find target LOG
In reply to Greg Kroah-HartmanFrom: Vlad Buslov <[email protected]>
[ Upstream commit b849c566ee9c6ed78288a522278dcaf419f8e239 ]
Add missing netfilter config dependency.
Fixes following example error when running tests via tdc.sh for all XT tests:
# $ sudo ./tdc.py -d eth2 -e 2029
# Test 2029: Add xt action with log-prefix
# exit: 255
# exit: 0
# failed to find target LOG
#
# bad action parsing
# parse_action: bad value (7:xt)!
# Illegal "action"
#
# -----> teardown stage *** Could not execute: "$TC actions flush action xt"
#
# -----> teardown stage *** Error message: "Error: Cannot flush unknown TC action.
# We have an error flushing
# "
# returncode 1; expected [0]
#
# -----> teardown stage *** Aborting test run.
#
# <_io.BufferedReader name=3> *** stdout ***
#
# <_io.BufferedReader name=5> *** stderr ***
# "-----> teardown stage" did not complete successfully
# Exception <class '__main__.PluginMgrTestFail'> ('teardown', ' failed to find target LOG\n\nbad action parsing\nparse_action: bad value (7:xt)!\nIllegal "action"\n', '"-----> teardown stage" did not complete successfully') (caught in test_runner, running test 2 2029 Add xt action with log-prefix stage teardown)
# ---------------
# traceback
# File "/images/src/linux/tools/testing/selftests/tc-testing/./tdc.py", line 495, in test_runner
# res = run_one_test(pm, args, index, tidx)
# File "/images/src/linux/tools/testing/selftests/tc-testing/./tdc.py", line 434, in run_one_test
# prepare_env(args, pm, 'teardown', '-----> teardown stage', tidx['teardown'], procout)
# File "/images/src/linux/tools/testing/selftests/tc-testing/./tdc.py", line 245, in prepare_env
# raise PluginMgrTestFail(
# ---------------
# accumulated output for this test:
# failed to find target LOG
#
# bad action parsing
# parse_action: bad value (7:xt)!
# Illegal "action"
#
# ---------------
#
# All test results:
#
# 1..1
# ok 1 2029 - Add xt action with log-prefix # skipped - "-----> teardown stage" did not complete successfully--- tools/testing/selftests/tc-testing/config | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/tc-testing/config +1 -0
@@ -6,6 +6,7 @@ CONFIG_NF_CONNTRACK_MARK=y CONFIG_NF_CONNTRACK_ZONES=y CONFIG_NF_CONNTRACK_LABELS=y CONFIG_NF_NAT=m +CONFIG_NETFILTER_XT_TARGET_LOG=m CONFIG_NET_SCHED=y
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 138/166 selftests/tc-testing: Fix SFB db test
In reply to Greg Kroah-HartmanFrom: Vlad Buslov <[email protected]>
[ Upstream commit b39d8c41c7a8336ce85c376b5d4906089524a0ae ]
Setting very small value of db like 10ms introduces rounding errors when converting to/from jiffies on some kernel configs. For example, on 250hz the actual value will be set to 12ms which causes the test to fail:
# $ sudo ./tdc.py -d eth2 -e 3410
# -- ns/SubPlugin.__init__
# Test 3410: Create SFB with db setting
#
# All test results:
#
# 1..1
# not ok 1 3410 - Create SFB with db setting # Could not match regex pattern. Verify command output: # qdisc sfb 1: root refcnt 2 rehash 600s db 12ms limit 1000p max 25p target 20p increment 0.000503548 decrement 4.57771e-05 penalty_rate 10pps penalty_burst 20p
Set the value to 100ms instead which currently seem to work on 100hz, 250hz, 300hz and 1000hz kernel configs.
--- tools/testing/selftests/tc-testing/tc-tests/qdiscs/sfb.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/tc-testing/tc-tests/qdiscs/sfb.json +2 -2
@@ -58,10 +58,10 @@ "setup": [ "$IP link add dev $DUMMY type dummy || /bin/true" ], - "cmdUnderTest": "$TC qdisc add dev $DUMMY handle 1: root sfb db 10", + "cmdUnderTest": "$TC qdisc add dev $DUMMY handle 1: root sfb db 100", "expExitCode": "0", "verifyCmd": "$TC qdisc show dev $DUMMY", - "matchPattern": "qdisc sfb 1: root refcnt [0-9]+ rehash 600s db 10ms", + "matchPattern": "qdisc sfb 1: root refcnt [0-9]+ rehash 600s db 100ms", "matchCount": "1", "teardown": [ "$TC qdisc del dev $DUMMY handle 1: root",
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 139/166 sched: add new attr TCA_EXT_WARN_MSG to report tc extact message
In reply to Greg Kroah-HartmanFrom: Hangbin Liu <[email protected]>
[ Upstream commit 0349b8779cc949ad9e6aced32672ee48cf79b497 ]
We will report extack message if there is an error via netlink_ack(). But if the rule is not to be exclusively executed by the hardware, extack is not passed along and offloading failures don't get logged.
In commit 81c7288b170a ("sched: cls: enable verbose logging") Marcelo made cls could log verbose info for offloading failures, which helps improving Open vSwitch debuggability when using flower offloading.
It would also be helpful if userspace monitor tools, like "tc monitor", could log this kind of message, as it doesn't require vswitchd log level adjusment. Let's add a new tc attributes to report the extack message so the monitor program could receive the failures. e.g.
# tc monitor
added chain dev enp3s0f1np1 parent ffff: chain 0
added filter dev enp3s0f1np1 ingress protocol all pref 49152 flower chain 0 handle 0x1
ct_state +trk+new
not_in_hw
action order 1: gact action drop
random type none pass val 0
index 1 ref 1 bind 1 Warning: mlx5_core: matching on ct_state +new isn't supported.
In this patch I only report the extack message on add/del operations. It doesn't look like we need to report the extack message on get/dump operations.
Note this message not only reporte to multicast groups, it could also be reported unicast, which may affect the current usersapce tool's behaivor.
Stable-dep-of: 84ad0af0bccd ("net/sched: qdisc_destroy() old ingress and clsact Qdiscs before grafting")
--- include/uapi/linux/rtnetlink.h | 1 + net/sched/act_api.c | 15 +++++--- net/sched/cls_api.c | 62 +++++++++++++++++++++------------- net/sched/sch_api.c | 55 ++++++++++++++++++------------ 4 files changed, 84 insertions(+), 49 deletions(-)
include/uapi/linux/rtnetlink.h +1 -0
@@ -635,6 +635,7 @@ enum {TCA_INGRESS_BLOCK ,TCA_EGRESS_BLOCK ,TCA_DUMP_FLAGS , +TCA_EXT_WARN_MSG , __TCA_MAX };
net/sched/act_api.c +10 -5
@@ -1581,7 +1581,7 @@ int tcf_action_copy_stats(struct sk_buff *skb, struct tc_action *p,static int tca_get_fill (struct sk_buff *skb,struct tc_action *actions[],u32 portid,u32 seq,u16 flags,int event,int bind, -int ref) +int ref,struct netlink_ext_ack *extack) {struct tcamsg *t;struct nlmsghdr *nlh;
@@ -1605,7 +1605,12 @@ static int tca_get_fill(struct sk_buff *skb, struct tc_action *actions[],nla_nest_end (skb, nest); +if (extack && extack->_msg && +nla_put_string (skb,TCA_EXT_WARN_MSG , extack->_msg)) + goto out_nlmsg_trim; + nlh->nlmsg_len =skb_tail_pointer (skb) - b; +return skb->len; out_nlmsg_trim:
@@ -1624,7 +1629,7 @@ tcf_get_notify(struct net *net, u32 portid, struct nlmsghdr *n,if (!skb)return -ENOBUFS ;if (tca_get_fill (skb, actions, portid, n->nlmsg_seq,0 , event, -0 ,1 ) <=0 ) { +0 ,1 ,NULL ) <=0 ) {NL_SET_ERR_MSG (extack,"Failed to fill netlink attributes while adding TC action" );kfree_skb (skb);return -EINVAL ;
@@ -1798,7 +1803,7 @@ tcf_reoffload_del_notify(struct net *net, struct tc_action *action)if (!skb)return -ENOBUFS ; -if (tca_get_fill (skb, actions,0 ,0 ,0 ,RTM_DELACTION ,0 ,1 ) <=0 ) { +if (tca_get_fill (skb, actions,0 ,0 ,0 ,RTM_DELACTION ,0 ,1 ,NULL ) <=0 ) {kfree_skb (skb);return -EINVAL ; }
@@ -1885,7 +1890,7 @@ tcf_del_notify(struct net *net, struct nlmsghdr *n, struct tc_action *actions[],return -ENOBUFS ;if (tca_get_fill (skb, actions, portid, n->nlmsg_seq,0 ,RTM_DELACTION , -0 ,2 ) <=0 ) { +0 ,2 , extack) <=0 ) {NL_SET_ERR_MSG (extack,"Failed to fill netlink TC action attributes" );kfree_skb (skb);return -EINVAL ;
@@ -1964,7 +1969,7 @@ tcf_add_notify(struct net *net, struct nlmsghdr *n, struct tc_action *actions[],return -ENOBUFS ;if (tca_get_fill (skb, actions, portid, n->nlmsg_seq, n->nlmsg_flags, -RTM_NEWACTION ,0 ,0 ) <=0 ) { +RTM_NEWACTION ,0 ,0 , extack) <=0 ) {NL_SET_ERR_MSG (extack,"Failed to fill netlink attributes while adding TC action" );kfree_skb (skb);return -EINVAL ;
net/sched/cls_api.c +39 -23
204 lines not on this page · raw message
net/sched/sch_api.c +34 -21
181 lines not on this page · raw message
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 140/166 net/sched: Refactor qdisc_graft() for ingress and clsact Qdiscs
In reply to Greg Kroah-HartmanFrom: Peilin Ye <[email protected]>
[ Upstream commit 2d5f6a8d7aef7852a9ecc555f88c673a1c91754f ]
Grafting ingress and clsact Qdiscs does not need a for-loop in qdisc_graft(). Refactor it. No functional changes intended.
Stable-dep-of: 84ad0af0bccd ("net/sched: qdisc_destroy() old ingress and clsact Qdiscs before grafting")
--- net/sched/sch_api.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
net/sched/sch_api.c +10 -10
@@ -1076,12 +1076,12 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,if (parent ==NULL ) {unsigned int i, num_q, ingress; +struct netdev_queue *dev_queue; ingress =0 ; num_q = dev->num_tx_queues;if ((q && q->flags &TCQ_F_INGRESS ) || (new && new->flags &TCQ_F_INGRESS )) { - num_q =1 ; ingress =1 ;if (!dev_ingress_queue (dev)) {NL_SET_ERR_MSG (extack,"Device does not have an ingress queue" );
@@ -1097,18 +1097,18 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,if (new && new->ops->attach && !ingress) goto skip; -for (i =0 ; i < num_q; i++) { -struct netdev_queue *dev_queue =dev_ingress_queue (dev); - -if (!ingress) +if (!ingress) { +for (i =0 ; i < num_q; i++) { dev_queue =netdev_get_tx_queue (dev, i); + old =dev_graft_qdisc (dev_queue, new); - old =dev_graft_qdisc (dev_queue, new); -if (new && i >0 ) -qdisc_refcount_inc (new); - -if (!ingress) +if (new && i >0 ) +qdisc_refcount_inc (new);qdisc_put (old); + } + }else { + dev_queue =dev_ingress_queue (dev); + old =dev_graft_qdisc (dev_queue, new); } skip:
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 141/166 net/sched: qdisc_destroy() old ingress and clsact Qdiscs before grafting
In reply to Greg Kroah-HartmanFrom: Peilin Ye <[email protected]>
[ Upstream commit 84ad0af0bccd3691cb951c2974c5cb2c10594d4a ]
mini_Qdisc_pair::p_miniq is a double pointer to mini_Qdisc, initialized in ingress_init() to point to net_device::miniq_ingress. ingress Qdiscs access this per-net_device pointer in mini_qdisc_pair_swap(). Similar for clsact Qdiscs and miniq_egress.
Unfortunately, after introducing RTNL-unlocked RTM_{NEW,DEL,GET}TFILTER requests (thanks Hillf Danton for the hint), when replacing ingress or clsact Qdiscs, for example, the old Qdisc ("@old") could access the same miniq_{in,e}gress pointer(s) concurrently with the new Qdisc ("@new"), causing race conditions [1] including a use-after-free bug in mini_qdisc_pair_swap() reported by syzbot:
BUG: KASAN: slab-use-after-free in mini_qdisc_pair_swap+0x1c2/0x1f0 net/sched/sch_generic.c:1573 Write of size 8 at addr ffff888045b31308 by task syz-executor690/14901 ... Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106 print_address_description.constprop.0+0x2c/0x3c0 mm/kasan/report.c:319 print_report mm/kasan/report.c:430 [inline] kasan_report+0x11c/0x130 mm/kasan/report.c:536 mini_qdisc_pair_swap+0x1c2/0x1f0 net/sched/sch_generic.c:1573 tcf_chain_head_change_item net/sched/cls_api.c:495 [inline] tcf_chain0_head_change.isra.0+0xb9/0x120 net/sched/cls_api.c:509 tcf_chain_tp_insert net/sched/cls_api.c:1826 [inline] tcf_chain_tp_insert_unique net/sched/cls_api.c:1875 [inline] tc_new_tfilter+0x1de6/0x2290 net/sched/cls_api.c:2266
...
@old and @new should not affect each other. In other words, @old should never modify miniq_{in,e}gress after @new, and @new should not update @old's RCU state.
Fixing without changing sch_api.c turned out to be difficult (please refer to Closes: for discussions). Instead, make sure @new's first call always happen after @old's last call (in {ingress,clsact}_destroy()) has finished:
In qdisc_graft(), return -EBUSY if @old has any ongoing filter requests, and call qdisc_destroy() for @old before grafting @new.
Introduce qdisc_refcount_dec_if_one() as the counterpart of qdisc_refcount_inc_nz() used for filter requests. Introduce a non-static version of qdisc_destroy() that does a TCQ_F_BUILTIN check, just like qdisc_put() etc.
Depends on patch "net/sched: Refactor qdisc_graft() for ingress and clsact Qdiscs".
[1] To illustrate, the syzkaller reproducer adds ingress Qdiscs under TC_H_ROOT (no longer possible after commit c7cfbd115001 ("net/sched:sch_ingress: Only create under TC_H_INGRESS")) on eth0 that has 8 transmission queues:
Thread 1 creates ingress Qdisc A (containing mini Qdisc a1 and a2), then adds a flower filter X to A.
Thread 2 creates another ingress Qdisc B (containing mini Qdisc b1 and b2) to replace A, then adds a flower filter Y to B.
Thread 1 A's refcnt Thread 2
RTM_NEWQDISC (A, RTNL-locked)
qdisc_create(A) 1
qdisc_graft(A) 9
RTM_NEWTFILTER (X, RTNL-unlocked)
__tcf_qdisc_find(A) 10
tcf_chain0_head_change(A)
mini_qdisc_pair_swap(A) (1st)
|
| RTM_NEWQDISC (B, RTNL-locked)
RCU sync 2 qdisc_graft(B)
| 1 notify_and_destroy(A)
|
tcf_block_release(A) 0 RTM_NEWTFILTER (Y, RTNL-unlocked)
qdisc_destroy(A) tcf_chain0_head_change(B)
tcf_chain0_head_change_cb_del(A) mini_qdisc_pair_swap(B) (2nd)
mini_qdisc_pair_swap(A) (3rd) |
... ...
Here, B calls mini_qdisc_pair_swap(), pointing eth0->miniq_ingress to its mini Qdisc, b1. Then, A calls mini_qdisc_pair_swap() again during ingress_destroy(), setting eth0->miniq_ingress to NULL, so ingress packets on eth0 will not find filter Y in sch_handle_ingress().
This is just one of the possible consequences of concurrently accessing miniq_{in,e}gress pointers.
--- include/net/sch_generic.h | 8 ++++++++ net/sched/sch_api.c | 28 +++++++++++++++++++++++----- net/sched/sch_generic.c | 14 +++++++++++--- 3 files changed, 42 insertions(+), 8 deletions(-)
include/net/sch_generic.h +8 -0
@@ -137,6 +137,13 @@ static inline void qdisc_refcount_inc(struct Qdisc *qdisc)refcount_inc (&qdisc->refcnt); } +static inline bool qdisc_refcount_dec_if_one (struct Qdisc *qdisc) +{ +if (qdisc->flags &TCQ_F_BUILTIN ) +return true; +return refcount_dec_if_one (&qdisc->refcnt); +} +/* Intended to be used by unlocked users, when concurrent qdisc release is * possible. */
@@ -650,6 +657,7 @@ void dev_deactivate_many(struct list_head *head);struct Qdisc *dev_graft_qdisc (struct netdev_queue *dev_queue,struct Qdisc *qdisc);void qdisc_reset (struct Qdisc *qdisc); +void qdisc_destroy (struct Qdisc *qdisc);void qdisc_put (struct Qdisc *qdisc);void qdisc_put_unlocked (struct Qdisc *qdisc);void qdisc_tree_reduce_backlog (struct Qdisc *qdisc,int n,int len);
net/sched/sch_api.c +23 -5
@@ -1083,10 +1083,22 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,if ((q && q->flags &TCQ_F_INGRESS ) || (new && new->flags &TCQ_F_INGRESS )) { ingress =1 ; -if (!dev_ingress_queue (dev)) { + dev_queue =dev_ingress_queue (dev); +if (!dev_queue) {NL_SET_ERR_MSG (extack,"Device does not have an ingress queue" );return -ENOENT ; } + + q =rtnl_dereference (dev_queue->qdisc_sleeping); + +/* This is the counterpart of that qdisc_refcount_inc_nz() call in +* __tcf_qdisc_find() for filter requests. +*/ +if (!qdisc_refcount_dec_if_one (q)) { +NL_SET_ERR_MSG (extack, +"Current ingress or clsact Qdisc has ongoing filter requests" ); +return -EBUSY ; + } }if (dev->flags &IFF_UP )
@@ -1107,8 +1119,16 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,qdisc_put (old); } }else { - dev_queue =dev_ingress_queue (dev); - old =dev_graft_qdisc (dev_queue, new); + old =dev_graft_qdisc (dev_queue,NULL ); + +/* {ingress,clsact}_destroy() @old before grafting @new to avoid +* unprotected concurrent accesses to net_device::miniq_{in,e}gress +* pointer(s) in mini_qdisc_pair_swap(). +*/ +qdisc_notify (net, skb, n, classid, old, new, extack); +qdisc_destroy (old); + +dev_graft_qdisc (dev_queue, new); } skip:
@@ -1122,8 +1142,6 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,if (new && new->ops->attach) new->ops->attach (new); - }else { -notify_and_destroy (net, skb, n, classid, old, new, extack); }if (dev->flags &IFF_UP )
net/sched/sch_generic.c +11 -3
@@ -1046,7 +1046,7 @@ static void qdisc_free_cb(struct rcu_head *head)qdisc_free (q); } -static void qdisc_destroy (struct Qdisc *qdisc) +static void __qdisc_destroy (struct Qdisc *qdisc) {const struct Qdisc_ops *ops = qdisc->ops;
@@ -1070,6 +1070,14 @@ static void qdisc_destroy(struct Qdisc *qdisc)call_rcu (&qdisc->rcu, qdisc_free_cb); } +void qdisc_destroy (struct Qdisc *qdisc) +{ +if (qdisc->flags &TCQ_F_BUILTIN ) +return ; + +__qdisc_destroy (qdisc); +} +void qdisc_put (struct Qdisc *qdisc) {if (!qdisc)
@@ -1079,7 +1087,7 @@ void qdisc_put(struct Qdisc *qdisc) !refcount_dec_and_test(&qdisc->refcnt))return ; -qdisc_destroy (qdisc); +__qdisc_destroy (qdisc); }EXPORT_SYMBOL (qdisc_put);
@@ -1094,7 +1102,7 @@ void qdisc_put_unlocked(struct Qdisc *qdisc) !refcount_dec_and_rtnl_lock(&qdisc->refcnt)) return; -qdisc_destroy (qdisc); +__qdisc_destroy (qdisc);rtnl_unlock (); }EXPORT_SYMBOL (qdisc_put_unlocked);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 142/166 selftests: forwarding: hw_stats_l3: Set addrgenmode in a separate step
In reply to Greg Kroah-HartmanFrom: Danielle Ratson <[email protected]>
[ Upstream commit bef68e201e538eaa3a91f97aae8161eb2d0a8ed7 ]
Setting the IPv6 address generation mode of a net device during its creation never worked, but after commit b0ad3c179059 ("rtnetlink: call validate_linkmsg in rtnl_create_link") it explicitly fails [1]. The failure is caused by the fact that validate_linkmsg() is called before the net device is registered, when it still does not have an 'inet6_dev'.
Likewise, raising the net device before setting the address generation mode is meaningless, because by the time the mode is set, the address has already been generated.
Therefore, fix the test to first create the net device, then set its IPv6 address generation mode and finally bring it up.
[1]
# ip link add name mydev addrgenmode eui64 type dummy RTNETLINK answers: Address family not supported by protocol
--- tools/testing/selftests/net/forwarding/hw_stats_l3.sh | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
tools/testing/selftests/net/forwarding/hw_stats_l3.sh +7 -4
@@ -84,8 +84,9 @@ h2_destroy() router_rp1_200_create() { - ip link add name $rp1.200 up \ - link $rp1 addrgenmode eui64 type vlan id 200 + ip link add name $rp1.200 link $rp1 type vlan id 200 + ip link set dev $rp1.200 addrgenmode eui64 + ip link set dev $rp1.200 up ip address add dev $rp1.200 192.0.2.2/28 ip address add dev $rp1.200 2001:db8:1::2/64 ip stats set dev $rp1.200 l3_stats on
@@ -256,9 +257,11 @@ reapply_config() router_rp1_200_destroy - ip link add name $rp1.200 link $rp1 addrgenmode none type vlan id 200 + ip link add name $rp1.200 link $rp1 type vlan id 200 + ip link set dev $rp1.200 addrgenmode none ip stats set dev $rp1.200 l3_stats on - ip link set dev $rp1.200 up addrgenmode eui64 + ip link set dev $rp1.200 addrgenmode eui64 + ip link set dev $rp1.200 up ip address add dev $rp1.200 192.0.2.2/28 ip address add dev $rp1.200 2001:db8:1::2/64 }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 143/166 cifs: fix lease break oops in xfstest generic/098
In reply to Greg Kroah-HartmanFrom: Steve French <[email protected]>
[ Upstream commit c774e6779f38bf36f0cce65e30793704bab4b0d7 ]
umount can race with lease break so need to check if tcon->ses->server is still valid to send the lease break response.
--- fs/cifs/file.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
fs/cifs/file.c +6 -2
@@ -5146,9 +5146,13 @@ void cifs_oplock_break(struct work_struct *work)* disconnected since oplock already released by the server */ if (!oplock_break_cancelled) { - rc = tcon->ses->server->ops->oplock_response (tcon, persistent_fid, +/* check for server null since can race with kill_sb calling tree disconnect */ +if (tcon->ses && tcon->ses->server) { + rc = tcon->ses->server->ops->oplock_response (tcon, persistent_fid, volatile_fid, net_fid, cinode); -cifs_dbg (FYI ,"Oplock release rc = %d\n" , rc); +cifs_dbg (FYI ,"Oplock release rc = %d\n" , rc); + }else +pr_warn_once ("lease break not sent for unmounted share\n" ); }cifs_done_oplock_break (cinode);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 144/166 ext4: drop the call to ext4_error() from ext4_get_group_info()
In reply to Greg Kroah-HartmanFrom: Fabio M. De Francesco <[email protected]>
[ Upstream commit f451fd97dd2b78f286379203a47d9d295c467255 ]
A recent patch added a call to ext4_error() which is problematic since some callers of the ext4_get_group_info() function may be holding a spinlock, whereas ext4_error() must never be called in atomic context.
This triggered a report from Syzbot: "BUG: sleeping function called from invalid context in ext4_update_super" (see the link below).
Therefore, drop the call to ext4_error() from ext4_get_group_info(). In the meantime use eight characters tabs instead of nine characters ones.
--- fs/ext4/balloc.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-)
fs/ext4/balloc.c +9 -11
@@ -322,17 +322,15 @@ static ext4_fsblk_t ext4_valid_block_bitmap_padding(struct super_block *sb,struct ext4_group_info *ext4_get_group_info (struct super_block *sb,ext4_group_t group) { -struct ext4_group_info **grp_info; -long indexv, indexh; - -if (unlikely (group >=EXT4_SB (sb)->s_groups_count)) { -ext4_error (sb,"invalid group %u" , group); -return NULL ; - } - indexv = group >> (EXT4_DESC_PER_BLOCK_BITS (sb)); - indexh = group & ((EXT4_DESC_PER_BLOCK (sb)) -1 ); - grp_info =sbi_array_rcu_deref (EXT4_SB (sb), s_group_info, indexv); -return grp_info[indexh]; +struct ext4_group_info **grp_info; +long indexv, indexh; + +if (unlikely (group >=EXT4_SB (sb)->s_groups_count)) +return NULL ; + indexv = group >> (EXT4_DESC_PER_BLOCK_BITS (sb)); + indexh = group & ((EXT4_DESC_PER_BLOCK (sb)) -1 ); + grp_info =sbi_array_rcu_deref (EXT4_SB (sb), s_group_info, indexv); +return grp_info[indexh]; }/*
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 145/166 net/sched: cls_api: Fix lockup on flushing explicitly created chain
In reply to Greg Kroah-HartmanFrom: Vlad Buslov <[email protected]>
[ Upstream commit c9a82bec02c339cdda99b37c5e62b3b71fc4209c ]
Mingshuai Ren reports:
When a new chain is added by using tc, one soft lockup alarm will be
generated after delete the prio 0 filter of the chain. To reproduce the problem, perform the following steps:
(1) tc qdisc add dev eth0 root handle 1: htb default 1
(2) tc chain add dev eth0
(3) tc filter del dev eth0 chain 0 parent 1: prio 0
(4) tc filter add dev eth0 chain 0 parent 1:
Fix the issue by accounting for additional reference to chains that are explicitly created by RTM_NEWCHAIN message as opposed to implicitly by RTM_NEWTFILTER message.
--- net/sched/cls_api.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
net/sched/cls_api.c +7 -5
@@ -552,8 +552,8 @@ static void __tcf_chain_put(struct tcf_chain *chain, bool by_act, {struct tcf_block *block = chain->block;const struct tcf_proto_ops *tmplt_ops; +unsigned int refcnt, non_act_refcnt;bool free_block = false; -unsigned int refcnt;void *tmplt_priv;mutex_lock (&block->lock);
@@ -573,13 +573,15 @@ static void __tcf_chain_put(struct tcf_chain *chain, bool by_act,* save these to temporary variables. */ refcnt = --chain->refcnt; + non_act_refcnt = refcnt - chain->action_refcnt; tmplt_ops = chain->tmplt_ops; tmplt_priv = chain->tmplt_priv; -/* The last dropped non-action reference will trigger notification. */ -if (refcnt - chain->action_refcnt ==0 && !by_act) { -tc_chain_notify_delete (tmplt_ops, tmplt_priv, chain->index, - block,NULL ,0 ,0 , false); +if (non_act_refcnt == chain->explicitly_created && !by_act) { +if (non_act_refcnt ==0 ) +tc_chain_notify_delete (tmplt_ops, tmplt_priv, + chain->index, block,NULL ,0 ,0 , + false);/* Last reference to chain, no need to lock. */ chain->flushing = false; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 146/166 net: dsa: felix: fix taprio guard band overflow at 10Mbps with jumbo frames
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 6ac7a27a8b07588497ed53dfd885df9c72bc67e0 ]
The DEV_MAC_MAXLEN_CFG register contains a 16-bit value - up to 65535. Plus 2 * VLAN_HLEN (4), that is up to 65543.
The picos_per_byte variable is the largest when "speed" is lowest - SPEED_10 = 10. In that case it is (1000000L * 8) / 10 = 800000.
Their product - 52434400000 - exceeds 32 bits, which is a problem, because apparently, a multiplication between two 32-bit factors is evaluated as 32-bit before being assigned to a 64-bit variable. In fact it's a problem for any MTU value larger than 5368.
Cast one of the factors of the multiplication to u64 to force the multiplication to take place on 64 bits.
Issue found by Coverity.
--- drivers/net/dsa/ocelot/felix_vsc9959.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/ocelot/felix_vsc9959.c +1 -1
@@ -1253,7 +1253,7 @@ static void vsc9959_tas_guard_bands_update(struct ocelot *ocelot, int port)/* Consider the standard Ethernet overhead of 8 octets preamble+SFD, * 4 octets FCS, 12 octets IFG. */ - needed_bit_time_ps = (maxlen +24 ) * picos_per_byte; + needed_bit_time_ps = (u64)(maxlen +24 ) * picos_per_byte; dev_dbg(ocelot->dev, "port %d: max frame size %d needs %llu ps at speed %d\n",
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 147/166 net: lapbether: only support ethernet devices
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 9eed321cde22fc1afd76eac563ce19d899e0d6b2 ]
It probbaly makes no sense to support arbitrary network devices for lapbether.
syzbot reported:
skbuff: skb_under_panic: text:ffff80008934c100 len:44 put:40 head:ffff0000d18dd200 data:ffff0000d18dd1ea tail:0x16 end:0x140 dev:bond1 kernel BUG at net/core/skbuff.c:200 !
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 5643 Comm: dhcpcd Not tainted 6.4.0-rc5-syzkaller-g4641cff8e810 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : skb_panic net/core/skbuff.c:196 [inline] pc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:210 lr : skb_panic net/core/skbuff.c:196 [inline] lr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:210
sp : ffff8000973b7260
x29: ffff8000973b7270 x28: ffff8000973b7360 x27: dfff800000000000
x26: ffff0000d85d8150 x25: 0000000000000016 x24: ffff0000d18dd1ea
x23: ffff0000d18dd200 x22: 000000000000002c x21: 0000000000000140
x20: 0000000000000028 x19: ffff80008934c100 x18: ffff8000973b68a0
x17: 0000000000000000 x16: ffff80008a43bfbc x15: 0000000000000202
x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000001
x11: 0000000000000201 x10: 0000000000000000 x9 : f22f7eb937cced00 x8 : f22f7eb937cced00 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff8000973b6b78 x4 : ffff80008df9ee80 x3 : ffff8000805974f4 x2 : 0000000000000001 x1 : 0000000100000201 x0 : 0000000000000086
Call trace: skb_panic net/core/skbuff.c:196 [inline] skb_under_panic+0x13c/0x140 net/core/skbuff.c:210 skb_push+0xf0/0x108 net/core/skbuff.c:2409 ip6gre_header+0xbc/0x738 net/ipv6/ip6_gre.c:1383 dev_hard_header include/linux/netdevice.h:3137 [inline] lapbeth_data_transmit+0x1c4/0x298 drivers/net/wan/lapbether.c:257 lapb_data_transmit+0x8c/0xb0 net/lapb/lapb_iface.c:447 lapb_transmit_buffer+0x178/0x204 net/lapb/lapb_out.c:149 lapb_send_control+0x220/0x320 net/lapb/lapb_subr.c:251 lapb_establish_data_link+0x94/0xec lapb_device_event+0x348/0x4e0 notifier_call_chain+0x1a4/0x510 kernel/notifier.c:93 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461 __dev_notify_flags+0x2bc/0x544 dev_change_flags+0xd0/0x15c net/core/dev.c:8643 devinet_ioctl+0x858/0x17e4 net/ipv4/devinet.c:1150 inet_ioctl+0x2ac/0x4d8 net/ipv4/af_inet.c:979 sock_do_ioctl+0x134/0x2dc net/socket.c:1201 sock_ioctl+0x4ec/0x858 net/socket.c:1318 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:856 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x244 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:191 el0_svc+0x4c/0x160 arch/arm64/kernel/entry-common.c:647 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:665 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591 Code: aa1803e6 aa1903e7 a90023f5 947730f5 (d4210000)
--- drivers/net/wan/lapbether.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/wan/lapbether.c +3 -0
@@ -384,6 +384,9 @@ static int lapbeth_new_device(struct net_device *dev)ASSERT_RTNL (); +if (dev->type !=ARPHRD_ETHER ) +return -EINVAL ; + ndev =alloc_netdev (sizeof (*lapbeth),"lapb%d" ,NET_NAME_UNKNOWN , lapbeth_setup);if (!ndev)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 148/166 net: macsec: fix double free of percpu stats
In reply to Greg Kroah-HartmanFrom: Fedor Pchelkin <[email protected]>
[ Upstream commit 0c0cf3db83f8c7c9bb141c2771a34043bcf952ef ]
Inside macsec_add_dev() we free percpu macsec->secy.tx_sc.stats and macsec->stats on some of the memory allocation failure paths. However, the net_device is already registered to that moment: in macsec_newlink(), just before calling macsec_add_dev(). This means that during unregister process its priv_destructor - macsec_free_netdev() - will be called and will free the stats again.
Remove freeing percpu stats inside macsec_add_dev() because macsec_free_netdev() will correctly free the already allocated ones. The pointers to unallocated stats stay NULL, and free_percpu() treats that correctly.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
--- drivers/net/macsec.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
drivers/net/macsec.c +5 -7
@@ -3981,17 +3981,15 @@ static int macsec_add_dev(struct net_device *dev, sci_t sci, u8 icv_len)return -ENOMEM ; secy->tx_sc.stats = netdev_alloc_pcpu_stats(struct pcpu_tx_sc_stats); -if (!secy->tx_sc.stats) { -free_percpu (macsec->stats); +if (!secy->tx_sc.stats)return -ENOMEM ; - } secy->tx_sc.md_dst =metadata_dst_alloc (0 ,METADATA_MACSEC ,GFP_KERNEL ); -if (!secy->tx_sc.md_dst) { -free_percpu (secy->tx_sc.stats); -free_percpu (macsec->stats); +if (!secy->tx_sc.md_dst) +/* macsec and secy percpu stats will be freed when unregistering +* net_device in macsec_free_netdev() +*/ return -ENOMEM ; - }if (sci ==MACSEC_UNDEF_SCI ) sci =dev_to_sci (dev,MACSEC_PORT_ES );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 149/166 sfc: fix XDP queues mode with legacy IRQ
In reply to Greg Kroah-HartmanFrom: Íñigo Huguet <[email protected]>
[ Upstream commit e84a1e1e683f3558e30f437d7c99df35afb8b52c ]
In systems without MSI-X capabilities, xdp_txq_queues_mode is calculated in efx_allocate_msix_channels, but when enabling MSI-X fails, it was not changed to a proper default value. This was leading to the driver thinking that it has dedicated XDP queues, when it didn't.
Fix it by setting xdp_txq_queues_mode to the correct value if the driver fallbacks to MSI or legacy IRQ mode. The correct value is EFX_XDP_TX_QUEUES_BORROWED because there are no XDP dedicated queues.
The issue can be easily visible if the kernel is started with pci=nomsi, then a call trace is shown. It is not shown only with sfc's modparam interrupt_mode=2. Call trace example:
WARNING: CPU: 2 PID: 663 at drivers/net/ethernet/sfc/efx_channels.c:828 efx_set_xdp_channels+0x124/0x260 [sfc] [...skip...] Call Trace: <TASK> efx_set_channels+0x5c/0xc0 [sfc] efx_probe_nic+0x9b/0x15a [sfc] efx_probe_all+0x10/0x1a2 [sfc] efx_pci_probe_main+0x12/0x156 [sfc] efx_pci_probe_post_io+0x18/0x103 [sfc] efx_pci_probe.cold+0x154/0x257 [sfc] local_pci_probe+0x42/0x80
--- drivers/net/ethernet/sfc/efx_channels.c | 2 ++ drivers/net/ethernet/sfc/siena/efx_channels.c | 2 ++ 2 files changed, 4 insertions(+)
drivers/net/ethernet/sfc/efx_channels.c +2 -0
@@ -301,6 +301,7 @@ int efx_probe_interrupts(struct efx_nic *efx) efx->tx_channel_offset =0 ; efx->n_xdp_channels =0 ; efx->xdp_channel_offset = efx->n_channels; + efx->xdp_txq_queues_mode =EFX_XDP_TX_QUEUES_BORROWED ; rc =pci_enable_msi (efx->pci_dev);if (rc ==0 ) {efx_get_channel (efx,0 )->irq = efx->pci_dev->irq;
@@ -322,6 +323,7 @@ int efx_probe_interrupts(struct efx_nic *efx) efx->tx_channel_offset = efx_separate_tx_channels ?1 :0 ; efx->n_xdp_channels =0 ; efx->xdp_channel_offset = efx->n_channels; + efx->xdp_txq_queues_mode =EFX_XDP_TX_QUEUES_BORROWED ; efx->legacy_irq = efx->pci_dev->irq; }
drivers/net/ethernet/sfc/siena/efx_channels.c +2 -0
@@ -302,6 +302,7 @@ int efx_siena_probe_interrupts(struct efx_nic *efx) efx->tx_channel_offset =0 ; efx->n_xdp_channels =0 ; efx->xdp_channel_offset = efx->n_channels; + efx->xdp_txq_queues_mode =EFX_XDP_TX_QUEUES_BORROWED ; rc =pci_enable_msi (efx->pci_dev);if (rc ==0 ) {efx_get_channel (efx,0 )->irq = efx->pci_dev->irq;
@@ -323,6 +324,7 @@ int efx_siena_probe_interrupts(struct efx_nic *efx) efx->tx_channel_offset = efx_siena_separate_tx_channels ?1 :0 ; efx->n_xdp_channels =0 ; efx->xdp_channel_offset = efx->n_channels; + efx->xdp_txq_queues_mode =EFX_XDP_TX_QUEUES_BORROWED ; efx->legacy_irq = efx->pci_dev->irq; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 150/166 dm: dont lock fs when the map is NULL during suspend or resume
In reply to Greg Kroah-HartmanFrom: Li Lingfeng <[email protected]>
[ Upstream commit 2760904d895279f87196f0fa9ec570c79fe6a2e4 ]
As described in commit 38d11da522aa ("dm: don't lock fs when the map is NULL in process of resume"), a deadlock may be triggered between do_resume() and do_mount().
This commit preserves the fix from commit 38d11da522aa but moves it to where it also serves to fix a similar deadlock between do_suspend() and do_mount(). It does so, if the active map is NULL, by clearing DM_SUSPEND_LOCKFS_FLAG in dm_suspend() which is called by both do_suspend() and do_resume().
--- drivers/md/dm-ioctl.c | 5 +---- drivers/md/dm.c | 4 ++++ 2 files changed, 5 insertions(+), 4 deletions(-)
drivers/md/dm-ioctl.c +1 -4
@@ -1151,13 +1151,10 @@ static int do_resume(struct dm_ioctl *param)/* Do we need to load a new map ? */ if (new_map) {sector_t old_size, new_size; -int srcu_idx;/* Suspend if it isn't already suspended */ - old_map =dm_get_live_table (md, &srcu_idx); -if ((param->flags &DM_SKIP_LOCKFS_FLAG ) || !old_map) +if (param->flags &DM_SKIP_LOCKFS_FLAG ) suspend_flags &= ~DM_SUSPEND_LOCKFS_FLAG ; -dm_put_live_table (md, srcu_idx);if (param->flags &DM_NOFLUSH_FLAG ) suspend_flags |=DM_SUSPEND_NOFLUSH_FLAG ;if (!dm_suspended_md (md))
drivers/md/dm.c +4 -0
@@ -2801,6 +2801,10 @@ int dm_suspend(struct mapped_device *md, unsigned int suspend_flags) } map =rcu_dereference_protected (md->map,lockdep_is_held (&md->suspend_lock)); +if (!map) { +/* avoid deadlock with fs/namespace.c:do_mount() */ + suspend_flags &= ~DM_SUSPEND_LOCKFS_FLAG ; + } r =__dm_suspend (md, map, suspend_flags,TASK_INTERRUPTIBLE ,DMF_SUSPENDED );if (r)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 151/166 net: tipc: resize nlattr array to correct size
In reply to Greg Kroah-HartmanFrom: Lin Ma <[email protected]>
[ Upstream commit 44194cb1b6045dea33ae9a0d54fb7e7cd93a2e09 ]
According to nla_parse_nested_deprecated(), the tb[] is supposed to the destination array with maxtype+1 elements. In current tipc_nl_media_get() and __tipc_nl_media_set(), a larger array is used which is unnecessary. This patch resize them to a proper size.
--- net/tipc/bearer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/tipc/bearer.c +2 -2
@@ -1258,7 +1258,7 @@ int tipc_nl_media_get(struct sk_buff *skb, struct genl_info *info)struct tipc_nl_msg msg;struct tipc_media *media;struct sk_buff *rep; -struct nlattr *attrs[TIPC_NLA_BEARER_MAX +1 ]; +struct nlattr *attrs[TIPC_NLA_MEDIA_MAX +1 ];if (!info->attrs[TIPC_NLA_MEDIA ])return -EINVAL ;
@@ -1307,7 +1307,7 @@ int __tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info)int err;char *name;struct tipc_media *m; -struct nlattr *attrs[TIPC_NLA_BEARER_MAX +1 ]; +struct nlattr *attrs[TIPC_NLA_MEDIA_MAX +1 ];if (!info->attrs[TIPC_NLA_MEDIA ])return -EINVAL ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 152/166 selftests/ptp: Fix timestamp printf format for PTP_SYS_OFFSET
In reply to Greg Kroah-HartmanFrom: Alex Maftei <[email protected]>
[ Upstream commit 76a4c8b82938bc5020b67663db41f451684bf327 ]
Previously, timestamps were printed using "%lld.%u" which is incorrect for nanosecond values lower than 100,000,000 as they're fractional digits, therefore leading zeros are meaningful.
This patch changes the format strings to "%lld.%09u" in order to add leading zeros to the nanosecond value.
--- tools/testing/selftests/ptp/testptp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
tools/testing/selftests/ptp/testptp.c +3 -3
@@ -502,11 +502,11 @@ int main(int argc, char *argv[]) interval = t2 - t1; offset = (t2 + t1) /2 - tp; -printf ("system time: %lld.%u\n" , +printf ("system time: %lld.%09u\n" , (pct+2 *i)->sec, (pct+2 *i)->nsec); -printf ("phc time: %lld.%u\n" , +printf ("phc time: %lld.%09u\n" , (pct+2 *i+1 )->sec, (pct+2 *i+1 )->nsec); -printf ("system time: %lld.%u\n" , +printf ("system time: %lld.%09u\n" , (pct+2 *i+2 )->sec, (pct+2 *i+2 )->nsec); printf("system/phc clock time offset is %" PRId64 " ns\n" "system clock time delay is %" PRId64 " ns\n",
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 153/166 octeon_ep: Add missing check for ioremap
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 9a36e2d44d122fe73a2a76ba73f1d50a65cf8210 ]
Add check for ioremap() and return the error if it fails in order to guarantee the success of ioremap().
--- drivers/net/ethernet/marvell/octeon_ep/octep_main.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeon_ep/octep_main.c +6 -1
@@ -928,6 +928,9 @@ int octep_device_setup(struct octep_device *oct) oct->mmio[i].hw_addr =ioremap (pci_resource_start (oct->pdev, i *2 ),pci_resource_len (oct->pdev, i *2 )); +if (!oct->mmio[i].hw_addr) + goto unmap_prev; + oct->mmio[i].mapped =1 ; }
@@ -966,7 +969,9 @@ int octep_device_setup(struct octep_device *oct)return 0 ; unsupported_dev: -for (i =0 ; i <OCTEP_MMIO_REGIONS ; i++) + i =OCTEP_MMIO_REGIONS ; +unmap_prev: +while (i--)iounmap (oct->mmio[i].hw_addr);kfree (oct->conf);
Signature · 1 line
2.39.2