6.1.36-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 6.1.36-rc1 review
This is the start of the stable review cycle for the 6.1.36 release. There are 170 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 28 Jun 2023 18:07:23 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.36-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.1.36-rc1
Steve French <[email protected]>
smb: move client and server files to common directory fs/smb
Clark Wang <[email protected]>
i2c: imx-lpi2c: fix type char overflow issue when calculating the clock cycle
Dheeraj Kumar Srivastava <[email protected]>
x86/apic: Fix kernel panic when booting with intremap=off and x2apic_phys
Marc Zyngier <[email protected]>
KVM: arm64: Restore GICv2-on-GICv3 functionality
Andrey Smetanin <[email protected]>
vhost_net: revert upend_idx only on retriable error
Shannon Nelson <[email protected]>
vhost_vdpa: tell vqs about the negotiated
Min Li <[email protected]>
drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl
Min Li <[email protected]>
drm/exynos: fix race condition UAF in exynos_g2d_exec_ioctl
Inki Dae <[email protected]>
drm/exynos: vidi: fix a wrong error return
Nitesh Shetty <[email protected]>
null_blk: Fix: memory release when memory_backed=1
Linus Walleij <[email protected]>
ARM: dts: Fix erroneous ADS touchscreen polarities
Simon Horman <[email protected]>
i2c: mchp-pci1xxxx: Avoid cast to incompatible function type
Sayed, Karimuddin <[email protected]>
ALSA: hda/realtek: Add "Intel Reference board" and "NUC 13" SSID in the ALC256
Chancel Liu <[email protected]>
ASoC: fsl_sai: Enable BCI bit if SAI works on synchronous mode with BYP asserted
Alexander Gordeev <[email protected]>
s390/purgatory: disable branch profiling
Andreas Gruenbacher <[email protected]>
gfs2: Don't get stuck writing page onto itself under direct I/O
Sicong Jiang <[email protected]>
ASoC: amd: yc: Add Thinkpad Neo14 to quirks list for acp6x
Edson Juliano Drosdeck <[email protected]>
ASoC: nau8824: Add quirk to active-high jack-detect
Krzysztof Kozlowski <[email protected]>
soundwire: qcom: add proper error paths in qcom_swrm_startup()
Pierre-Louis Bossart <[email protected]>
soundwire: dmi-quirks: add new mapping for HP Spectre x360
Herve Codina <[email protected]>
ASoC: simple-card: Add missing of_node_put() in case of error
Srinivas Kandagatla <[email protected]>
ASoC: codecs: wcd938x-sdw: do not set can_multi_write flag
Clark Wang <[email protected]>
spi: lpspi: disable lpspi module irq in DMA mode
Vineeth Vijayan <[email protected]>
s390/cio: unregister device when the only path is gone
Krzysztof Kozlowski <[email protected]>
arm64: dts: qcom: sc7280-qcard: drop incorrect dai-cells from WCD938x SDW
Krzysztof Kozlowski <[email protected]>
arm64: dts: qcom: sc7280-idp: drop incorrect dai-cells from WCD938x SDW
Hans de Goede <[email protected]>
Input: soc_button_array - add invalid acpi_index DMI quirk handling
Uday Shankar <[email protected]>
nvme: improve handling of long keep alives
Uday Shankar <[email protected]>
nvme: check IO start time when deciding to defer KA
Uday Shankar <[email protected]>
nvme: double KA polling frequency to avoid KATO with TBKAS on
Dan Carpenter <[email protected]>
usb: gadget: udc: fix NULL dereference in remove()
Shida Zhang <[email protected]>
btrfs: fix an uninitialized variable warning in btrfs_log_inode
Osama Muhammad <[email protected]>
nfcsim.c: Fix error checking for debugfs_create_dir
Hans Verkuil <[email protected]>
media: cec: core: don't set last_initiator if tx in progress
Hans Verkuil <[email protected]>
media: cec: core: disable adapter in cec_devnode_unregister
Steve French <[email protected]>
smb3: missing null check in SMB2_change_notify
Marc Zyngier <[email protected]>
arm64: Add missing Set/Way CMO encodings
Denis Arefev <[email protected]>
HID: wacom: Add error check to wacom_parse_and_register()
Maurizio Lombardi <[email protected]>
scsi: target: iscsi: Prevent login threads from racing between each other
Michael Walle <[email protected]>
gpiolib: Fix irq_domain resource tracking for gpiochip_irqchip_add_domain()
Jiasheng Jiang <[email protected]>
gpio: sifive: add missing check for platform_get_irq
Jiawen Wu <[email protected]>
gpiolib: Fix GPIO chip IRQ initialization restriction
Nicolas Frattaroli <[email protected]>
arm64: dts: rockchip: fix nEXTRST on SOQuartz
Nicolas Frattaroli <[email protected]>
arm64: dts: rockchip: Enable GPU on SOQuartz CM4
Maciej Żenczykowski <[email protected]>
revert "net: align SO_RCVMARK required privileges with SO_MARK"
Eric Dumazet <[email protected]>
sch_netem: acquire qdisc lock in netem_change()
Shyam Sundar S K <[email protected]>
platform/x86/amd/pmf: Register notify handler only if SPS is enabled
Danielle Ratson <[email protected]>
selftests: forwarding: Fix race condition in mirror installation
Jens Axboe <[email protected]>
io_uring/net: use the correct msghdr union member in io_sendmsg_copy_hdr
Jiri Olsa <[email protected]>
bpf: Force kprobe multi expected_attach_type for kprobe_multi link
Florent Revest <[email protected]>
bpf/btf: Accept function names that contain dots
Francesco Dolcini <[email protected]>
Revert "net: phy: dp83867: perform soft reset and retain established link"
Pablo Neira Ayuso <[email protected]>
netfilter: nfnetlink_osf: fix module autoload
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: disallow updates of anonymous sets
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject unbound chain set before commit phase
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: reject unbound anonymous set before commit phase
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: disallow element updates of bound anonymous sets
Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_pipapo: .walk does not deal with generations
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: drop map element references from preparation phase
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: fix chain binding transaction logic
Ross Lagerwall <[email protected]>
be2net: Extend xmit workaround to BE3 chip
Arınç ÜNAL <[email protected]>
net: dsa: mt7530: fix handling of LLDP frames
Arınç ÜNAL <[email protected]>
net: dsa: mt7530: fix handling of BPDUs on MT7530 switch
Arınç ÜNAL <[email protected]>
net: dsa: mt7530: fix trapping frames on non-MT7621 SoC MT7530 switch
Terin Stock <[email protected]>
ipvs: align inner_mac_header for encapsulation
Sergey Shtylyov <[email protected]>
mmc: usdhi60rol0: fix deferred probing
Sergey Shtylyov <[email protected]>
mmc: sh_mmcif: fix deferred probing
Sergey Shtylyov <[email protected]>
mmc: sdhci-acpi: fix deferred probing
Sergey Shtylyov <[email protected]>
mmc: owl: fix deferred probing
Sergey Shtylyov <[email protected]>
mmc: omap_hsmmc: fix deferred probing
Sergey Shtylyov <[email protected]>
mmc: omap: fix deferred probing
Sergey Shtylyov <[email protected]>
mmc: mvsdio: fix deferred probing
Sergey Shtylyov <[email protected]>
mmc: mtk-sd: fix deferred probing
Stefan Wahren <[email protected]>
net: qca_spi: Avoid high load if QCA7000 is not available
Íñigo Huguet <[email protected]>
sfc: use budget for TX completions
Yevgeny Kliteynik <[email protected]>
net/mlx5: DR, Fix wrong action data allocation in decap action
Sebastian Andrzej Siewior <[email protected]>
xfrm: Linearize the skb after offloading if needed.
Magali Lemes <[email protected]>
selftests: net: fcnal-test: check if FIPS mode is enabled
Magali Lemes <[email protected]>
selftests: net: vrf-xfrm-tests: change authentication and encryption algos
Magali Lemes <[email protected]>
selftests: net: tls: check if FIPS mode is enabled
Yonghong Song <[email protected]>
bpf: Fix a bpf_jit_dump issue for x86_64 with sysctl bpf_jit_enable.
Maciej Żenczykowski <[email protected]>
xfrm: fix inbound ipv4/udp/esp packets to UDPv6 dualstack sockets
Maxim Mikityanskiy <[email protected]>
bpf: Fix verifier id tracking of scalars on spill
Eduard Zingerman <[email protected]>
bpf: track immediate values written to stack by BPF_ST instruction
Reiji Watanabe <[email protected]>
KVM: arm64: PMU: Restore the host's PMUSERENR_EL0
Benedict Wong <[email protected]>
xfrm: Ensure policies always checked on XFRM-I input path
Eyal Birger <[email protected]>
xfrm: interface: rename xfrm_interface.c to xfrm_interface_core.c
Benedict Wong <[email protected]>
xfrm: Treat already-verified secpath entries as optional
Chen Aotian <[email protected]>
ieee802154: hwsim: Fix possible memory leaks
Sergey Shtylyov <[email protected]>
mmc: meson-gx: fix deferred probing
Roberto Sassu <[email protected]>
memfd: check for non-NULL file_seals in memfd_create() syscall
Lee Jones <[email protected]>
x86/mm: Avoid using set_pgd() outside of real PGD pages
Ryusuke Konishi <[email protected]>
nilfs2: prevent general protection fault in nilfs_clear_dirty_page()
Jens Axboe <[email protected]>
io_uring/poll: serialize poll linked timer start with poll removal
Andrew Powers-Holmes <[email protected]>
arm64: dts: rockchip: Fix rk356x PCIe register and range mappings
Russ Weight <[email protected]>
regmap: spi-avmm: Fix regmap_bus max_raw_write
Teresa Remmet <[email protected]>
regulator: pca9450: Fix LDO3OUT and LDO4OUT MASK
Neil Armstrong <[email protected]>
spi: spi-geni-qcom: correctly handle -EPROBE_DEFER from dma_request_chan()
Mukesh Sisodiya <[email protected]>
wifi: iwlwifi: pcie: Handle SO-F device for PCI id 0x7AF0
Krister Johansen <[email protected]>
bpf: ensure main program has an extable
Sergey Shtylyov <[email protected]>
mmc: sunxi: fix deferred probing
Sergey Shtylyov <[email protected]>
mmc: bcm2835: fix deferred probing
Sergey Shtylyov <[email protected]>
mmc: sdhci-spear: fix deferred probing
Christophe Kerello <[email protected]>
mmc: mmci: stm32: fix max busy timeout calculation
Martin Hundebøll <[email protected]>
mmc: meson-gx: remove redundant mmc_request_done() call from irq context
Stephan Gerhold <[email protected]>
mmc: sdhci-msm: Disable broken 64-bit DMA on MSM8916
Jisheng Zhang <[email protected]>
mmc: litex_mmc: set PROBE_PREFER_ASYNCHRONOUS
Tetsuo Handa <[email protected]>
cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex in freezer_css_{online,offline}()
Xiu Jianfeng <[email protected]>
cgroup: Do not corrupt task iteration when rebinding subsystem
Paolo Abeni <[email protected]>
mptcp: consolidate fallback and non fallback state machine
Paolo Abeni <[email protected]>
mptcp: fix possible list corruption on passive MPJ
Paolo Abeni <[email protected]>
mptcp: fix possible divide by zero in recvmsg()
Paolo Abeni <[email protected]>
mptcp: handle correctly disconnect() failures
Jens Axboe <[email protected]>
io_uring/net: disable partial retries for recvmsg with cmsg
Jens Axboe <[email protected]>
io_uring/net: clear msg_controllen on partial sendmsg retry
Dexuan Cui <[email protected]>
PCI: hv: Add a per-bus mutex state_lock
Dexuan Cui <[email protected]>
PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic
Dexuan Cui <[email protected]>
PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev
Dexuan Cui <[email protected]>
Revert "PCI: hv: Fix a timing issue which causes kdump to fail occasionally"
Dexuan Cui <[email protected]>
PCI: hv: Fix a race condition bug in hv_pci_query_relations()
Michael Kelley <[email protected]>
Drivers: hv: vmbus: Fix vmbus_wait_for_unload() to scan present CPUs
Dexuan Cui <[email protected]>
Drivers: hv: vmbus: Call hv_synic_free() if hv_synic_alloc() fails
Gavin Shan <[email protected]>
KVM: Avoid illegal stage2 mapping on invalid memory slot
Rafael J. Wysocki <[email protected]>
ACPI: sleep: Avoid breaking S3 wakeup due to might_sleep()
Ryusuke Konishi <[email protected]>
nilfs2: fix buffer corruption due to concurrent device reads
Prathu Baronia <[email protected]>
scripts: fix the gfp flags header path in gfp-translate
Rafael Aquini <[email protected]>
writeback: fix dereferencing NULL mapping->host on writeback_page_template
Matthieu Baerts <[email protected]>
selftests: mptcp: join: fix "userspace pm add & remove address"
Matthieu Baerts <[email protected]>
selftests: mptcp: join: skip fail tests if not supported
Matthieu Baerts <[email protected]>
selftests: mptcp: join: skip userspace PM tests if not supported
Matthieu Baerts <[email protected]>
selftests: mptcp: join: skip test if iptables/tc cmds fail
Matthieu Baerts <[email protected]>
selftests: mptcp: sockopt: skip TCP_INQ checks if not supported
Matthieu Baerts <[email protected]>
selftests: mptcp: diag: skip listen tests if not supported
Shuah Khan <[email protected]>
selftests/mount_setattr: fix redefine struct mount_attr build error
Matthieu Baerts <[email protected]>
selftests: mptcp: join: skip MPC backups tests if not supported
Matthieu Baerts <[email protected]>
selftests: mptcp: join: skip fullmesh flag tests if not supported
Matthieu Baerts <[email protected]>
selftests: mptcp: join: skip backup if set flag on ID not supported
Matthieu Baerts <[email protected]>
selftests: mptcp: join: skip implicit tests if not supported
Matthieu Baerts <[email protected]>
selftests: mptcp: join: support RM_ADDR for used endpoints or not
Matthieu Baerts <[email protected]>
selftests: mptcp: join: skip Fastclose tests if not supported
Matthieu Baerts <[email protected]>
selftests: mptcp: join: support local endpoint being tracked or not
Matthieu Baerts <[email protected]>
selftests: mptcp: join: skip check if MIB counter not supported
Matthieu Baerts <[email protected]>
selftests: mptcp: join: helpers to skip tests
Matthieu Baerts <[email protected]>
selftests: mptcp: join: use 'iptables-legacy' if available
Matthieu Baerts <[email protected]>
selftests: mptcp: lib: skip if not below kernel version
Matthieu Baerts <[email protected]>
selftests: mptcp: userspace pm: skip if not supported
Matthieu Baerts <[email protected]>
selftests: mptcp: userspace pm: skip if 'ip' tool is unavailable
Matthieu Baerts <[email protected]>
selftests: mptcp: sockopt: skip getsockopt checks if not supported
Matthieu Baerts <[email protected]>
selftests: mptcp: sockopt: relax expected returned size
Matthieu Baerts <[email protected]>
selftests: mptcp: pm nl: skip fullmesh flag checks if not supported
Matthieu Baerts <[email protected]>
selftests: mptcp: pm nl: remove hardcoded default limits
Matthieu Baerts <[email protected]>
selftests: mptcp: connect: skip disconnect tests if not supported
Matthieu Baerts <[email protected]>
selftests: mptcp: connect: skip transp tests if not supported
Matthieu Baerts <[email protected]>
selftests: mptcp: lib: skip if missing symbol
Matthieu Baerts <[email protected]>
selftests: mptcp: join: fix ShellCheck warnings
Matthieu Baerts <[email protected]>
selftests: mptcp: remove duplicated entries in usage
Thomas Gleixner <[email protected]>
tick/common: Align tick period during sched_timer setup
Namjae Jeon <[email protected]>
ksmbd: validate session id and tree id in the compound request
Namjae Jeon <[email protected]>
ksmbd: fix out-of-bound read in smb2_write
Namjae Jeon <[email protected]>
ksmbd: validate command payload size
Matthew Garrett <[email protected]>
tpm_crb: Add support for CRB devices based on Pluton
Lino Sanfilippo <[email protected]>
tpm, tpm_tis: Claim locality in interrupt handler
Alexei Starovoitov <[email protected]>
mm: Fix copy_from_user_nofault().
Damien Le Moal <[email protected]>
ata: libata-scsi: Avoid deadlock on rescan after device resume
Robert Hodaszi <[email protected]>
tty: serial: fsl_lpuart: reduce RX watermark to 0 on LS1028A
Sherry Sun <[email protected]>
tty: serial: fsl_lpuart: make rx_watermark configurable for different platforms
Tom Chung <[email protected]>
drm/amd/display: fix the system hang while disable PSR
Rodrigo Siqueira <[email protected]>
drm/amd/display: Add wrapper to call planes and stream update
Rodrigo Siqueira <[email protected]>
drm/amd/display: Use dc_update_planes_and_stream
-------------
Diffstat:
MAINTAINERS | 8 +-
Makefile | 4 +-
arch/arm/boot/dts/am57xx-cl-som-am57x.dts | 2 +-
arch/arm/boot/dts/at91sam9261ek.dts | 2 +-
arch/arm/boot/dts/imx7d-pico-hobbit.dts | 2 +-
arch/arm/boot/dts/imx7d-sdb.dts | 2 +-
arch/arm/boot/dts/omap3-cm-t3x.dtsi | 2 +-
arch/arm/boot/dts/omap3-devkit8000-lcd-common.dtsi | 2 +-
arch/arm/boot/dts/omap3-lilly-a83x.dtsi | 2 +-
arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi | 2 +-
arch/arm/boot/dts/omap3-overo-common-lcd43.dtsi | 2 +-
arch/arm/boot/dts/omap3-pandora-common.dtsi | 2 +-
arch/arm/boot/dts/omap5-cm-t54.dts | 2 +-
arch/arm64/boot/dts/qcom/sc7280-idp.dtsi | 2 -
arch/arm64/boot/dts/qcom/sc7280-qcard.dtsi | 2 -
.../boot/dts/rockchip/rk3566-soquartz-cm4.dts | 18 +-
arch/arm64/boot/dts/rockchip/rk3566-soquartz.dtsi | 34 +-
arch/arm64/boot/dts/rockchip/rk3568.dtsi | 14 +-
arch/arm64/boot/dts/rockchip/rk356x.dtsi | 7 +-
arch/arm64/include/asm/sysreg.h | 6 +
arch/arm64/kvm/hyp/include/hyp/switch.h | 13 +-
arch/arm64/kvm/vgic/vgic-init.c | 11 +-
arch/s390/purgatory/Makefile | 1 +
arch/x86/kernel/apic/x2apic_phys.c | 5 +-
arch/x86/mm/kaslr.c | 8 +-
arch/x86/net/bpf_jit_comp.c | 2 +-
drivers/acpi/acpica/achware.h | 2 -
drivers/acpi/sleep.c | 16 +-
drivers/ata/libata-core.c | 3 +-
drivers/ata/libata-eh.c | 2 +-
drivers/ata/libata-scsi.c | 22 +-
drivers/base/regmap/regmap-spi-avmm.c | 2 +-
drivers/block/null_blk/main.c | 1 +
drivers/char/tpm/tpm_crb.c | 100 ++++-
drivers/char/tpm/tpm_tis_core.c | 2 +
drivers/gpio/gpio-sifive.c | 8 +-
drivers/gpio/gpiolib.c | 11 +-
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 73 +++-
drivers/gpu/drm/exynos/exynos_drm_g2d.c | 2 +-
drivers/gpu/drm/exynos/exynos_drm_vidi.c | 2 -
drivers/gpu/drm/radeon/radeon_gem.c | 4 +-
drivers/hid/wacom_sys.c | 7 +-
drivers/hv/channel_mgmt.c | 18 +-
drivers/hv/vmbus_drv.c | 5 +-
drivers/i2c/busses/i2c-imx-lpi2c.c | 4 +-
drivers/i2c/busses/i2c-mchp-pci1xxxx.c | 6 +-
drivers/input/misc/soc_button_array.c | 30 ++
drivers/media/cec/core/cec-adap.c | 8 +-
drivers/media/cec/core/cec-core.c | 2 +
drivers/media/cec/core/cec-priv.h | 1 +
drivers/mmc/host/bcm2835.c | 4 +-
drivers/mmc/host/litex_mmc.c | 1 +
drivers/mmc/host/meson-gx-mmc.c | 14 +-
drivers/mmc/host/mmci.c | 3 +-
drivers/mmc/host/mtk-sd.c | 2 +-
drivers/mmc/host/mvsdio.c | 2 +-
drivers/mmc/host/omap.c | 2 +-
drivers/mmc/host/omap_hsmmc.c | 6 +-
drivers/mmc/host/owl-mmc.c | 2 +-
drivers/mmc/host/sdhci-acpi.c | 2 +-
drivers/mmc/host/sdhci-msm.c | 3 +
drivers/mmc/host/sdhci-spear.c | 4 +-
drivers/mmc/host/sh_mmcif.c | 2 +-
drivers/mmc/host/sunxi-mmc.c | 4 +-
drivers/mmc/host/usdhi6rol0.c | 6 +-
drivers/net/dsa/mt7530.c | 20 +-
drivers/net/dsa/mt7530.h | 5 +
drivers/net/ethernet/emulex/benet/be_main.c | 4 +-
.../mellanox/mlx5/core/steering/dr_action.c | 9 +-
drivers/net/ethernet/qualcomm/qca_spi.c | 3 +-
drivers/net/ethernet/sfc/ef10.c | 25 +-
drivers/net/ethernet/sfc/ef100_nic.c | 7 +-
drivers/net/ethernet/sfc/ef100_tx.c | 4 +-
drivers/net/ethernet/sfc/ef100_tx.h | 2 +-
drivers/net/ethernet/sfc/tx_common.c | 4 +-
drivers/net/ethernet/sfc/tx_common.h | 2 +-
drivers/net/ieee802154/mac802154_hwsim.c | 6 +-
drivers/net/phy/dp83867.c | 2 +-
drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 2 +
drivers/nfc/nfcsim.c | 4 -
drivers/nvme/host/core.c | 48 +-
drivers/nvme/host/nvme.h | 1 +
drivers/pci/controller/pci-hyperv.c | 139 +++---
drivers/platform/x86/amd/pmf/core.c | 10 +-
drivers/s390/cio/device.c | 5 +-
drivers/soundwire/dmi-quirks.c | 7 +
drivers/soundwire/qcom.c | 17 +-
drivers/spi/spi-fsl-lpspi.c | 7 +-
drivers/spi/spi-geni-qcom.c | 2 +
drivers/target/iscsi/iscsi_target_nego.c | 4 +-
drivers/tty/serial/fsl_lpuart.c | 14 +-
drivers/usb/gadget/udc/amd5536udc_pci.c | 3 +
drivers/vhost/net.c | 11 +-
drivers/vhost/vdpa.c | 13 +
fs/Kconfig | 9 +-
fs/Makefile | 4 +-
fs/btrfs/tree-log.c | 2 +-
fs/gfs2/file.c | 17 +-
fs/nilfs2/page.c | 10 +-
fs/nilfs2/segbuf.c | 6 +
fs/nilfs2/segment.c | 7 +
fs/nilfs2/super.c | 25 +-
fs/smb/Kconfig | 11 +
fs/smb/Makefile | 5 +
fs/{cifs => smb/client}/Kconfig | 0
fs/{cifs => smb/client}/Makefile | 0
fs/{cifs => smb/client}/asn1.c | 0
fs/{cifs => smb/client}/cached_dir.c | 0
fs/{cifs => smb/client}/cached_dir.h | 0
fs/{cifs => smb/client}/cifs_debug.c | 0
fs/{cifs => smb/client}/cifs_debug.h | 0
fs/{cifs => smb/client}/cifs_dfs_ref.c | 0
fs/{cifs => smb/client}/cifs_fs_sb.h | 0
fs/{cifs => smb/client}/cifs_ioctl.h | 0
fs/{cifs => smb/client}/cifs_spnego.c | 0
fs/{cifs => smb/client}/cifs_spnego.h | 0
.../client}/cifs_spnego_negtokeninit.asn1 | 0
fs/{cifs => smb/client}/cifs_swn.c | 0
fs/{cifs => smb/client}/cifs_swn.h | 0
fs/{cifs => smb/client}/cifs_unicode.c | 0
fs/{cifs => smb/client}/cifs_unicode.h | 0
fs/{cifs => smb/client}/cifs_uniupr.h | 0
fs/{cifs => smb/client}/cifsacl.c | 0
fs/{cifs => smb/client}/cifsacl.h | 0
fs/{cifs => smb/client}/cifsencrypt.c | 2 +-
fs/{cifs => smb/client}/cifsfs.c | 0
fs/{cifs => smb/client}/cifsfs.h | 0
fs/{cifs => smb/client}/cifsglob.h | 2 +-
fs/{cifs => smb/client}/cifspdu.h | 2 +-
fs/{cifs => smb/client}/cifsproto.h | 0
fs/{cifs => smb/client}/cifsroot.c | 0
fs/{cifs => smb/client}/cifssmb.c | 0
fs/{cifs => smb/client}/connect.c | 0
fs/{cifs => smb/client}/dfs_cache.c | 0
fs/{cifs => smb/client}/dfs_cache.h | 0
fs/{cifs => smb/client}/dir.c | 0
fs/{cifs => smb/client}/dns_resolve.c | 0
fs/{cifs => smb/client}/dns_resolve.h | 0
fs/{cifs => smb/client}/export.c | 0
fs/{cifs => smb/client}/file.c | 0
fs/{cifs => smb/client}/fs_context.c | 0
fs/{cifs => smb/client}/fs_context.h | 0
fs/{cifs => smb/client}/fscache.c | 0
fs/{cifs => smb/client}/fscache.h | 0
fs/{cifs => smb/client}/inode.c | 2 +-
fs/{cifs => smb/client}/ioctl.c | 0
fs/{cifs => smb/client}/link.c | 0
fs/{cifs => smb/client}/misc.c | 0
fs/{cifs => smb/client}/netlink.c | 0
fs/{cifs => smb/client}/netlink.h | 0
fs/{cifs => smb/client}/netmisc.c | 0
fs/{cifs => smb/client}/nterr.c | 0
fs/{cifs => smb/client}/nterr.h | 0
fs/{cifs => smb/client}/ntlmssp.h | 0
fs/{cifs => smb/client}/readdir.c | 0
fs/{cifs => smb/client}/rfc1002pdu.h | 0
fs/{cifs => smb/client}/sess.c | 0
fs/{cifs => smb/client}/smb1ops.c | 0
fs/{cifs => smb/client}/smb2file.c | 0
fs/{cifs => smb/client}/smb2glob.h | 0
fs/{cifs => smb/client}/smb2inode.c | 0
fs/{cifs => smb/client}/smb2maperror.c | 0
fs/{cifs => smb/client}/smb2misc.c | 0
fs/{cifs => smb/client}/smb2ops.c | 0
fs/{cifs => smb/client}/smb2pdu.c | 2 +-
fs/{cifs => smb/client}/smb2pdu.h | 0
fs/{cifs => smb/client}/smb2proto.h | 0
fs/{cifs => smb/client}/smb2status.h | 0
fs/{cifs => smb/client}/smb2transport.c | 0
fs/{cifs => smb/client}/smbdirect.c | 0
fs/{cifs => smb/client}/smbdirect.h | 0
fs/{cifs => smb/client}/smbencrypt.c | 2 +-
fs/{cifs => smb/client}/smberr.h | 0
fs/{cifs => smb/client}/trace.c | 0
fs/{cifs => smb/client}/trace.h | 0
fs/{cifs => smb/client}/transport.c | 0
fs/{cifs => smb/client}/unc.c | 0
fs/{cifs => smb/client}/winucase.c | 0
fs/{cifs => smb/client}/xattr.c | 0
fs/{smbfs_common => smb/common}/Makefile | 4 +-
fs/{smbfs_common => smb/common}/arc4.h | 0
fs/{smbfs_common => smb/common}/cifs_arc4.c | 0
fs/{smbfs_common => smb/common}/cifs_md4.c | 0
fs/{smbfs_common => smb/common}/md4.h | 0
fs/{smbfs_common => smb/common}/smb2pdu.h | 0
fs/{smbfs_common => smb/common}/smbfsctl.h | 0
fs/{ksmbd => smb/server}/Kconfig | 0
fs/{ksmbd => smb/server}/Makefile | 0
fs/{ksmbd => smb/server}/asn1.c | 0
fs/{ksmbd => smb/server}/asn1.h | 0
fs/{ksmbd => smb/server}/auth.c | 2 +-
fs/{ksmbd => smb/server}/auth.h | 0
fs/{ksmbd => smb/server}/connection.c | 0
fs/{ksmbd => smb/server}/connection.h | 0
fs/{ksmbd => smb/server}/crypto_ctx.c | 0
fs/{ksmbd => smb/server}/crypto_ctx.h | 0
fs/{ksmbd => smb/server}/glob.h | 0
fs/{ksmbd => smb/server}/ksmbd_netlink.h | 0
.../server}/ksmbd_spnego_negtokeninit.asn1 | 0
.../server}/ksmbd_spnego_negtokentarg.asn1 | 0
fs/{ksmbd => smb/server}/ksmbd_work.c | 0
fs/{ksmbd => smb/server}/ksmbd_work.h | 0
fs/{ksmbd => smb/server}/mgmt/ksmbd_ida.c | 0
fs/{ksmbd => smb/server}/mgmt/ksmbd_ida.h | 0
fs/{ksmbd => smb/server}/mgmt/share_config.c | 0
fs/{ksmbd => smb/server}/mgmt/share_config.h | 0
fs/{ksmbd => smb/server}/mgmt/tree_connect.c | 0
fs/{ksmbd => smb/server}/mgmt/tree_connect.h | 0
fs/{ksmbd => smb/server}/mgmt/user_config.c | 0
fs/{ksmbd => smb/server}/mgmt/user_config.h | 0
fs/{ksmbd => smb/server}/mgmt/user_session.c | 0
fs/{ksmbd => smb/server}/mgmt/user_session.h | 0
fs/{ksmbd => smb/server}/misc.c | 0
fs/{ksmbd => smb/server}/misc.h | 0
fs/{ksmbd => smb/server}/ndr.c | 0
fs/{ksmbd => smb/server}/ndr.h | 0
fs/{ksmbd => smb/server}/nterr.h | 0
fs/{ksmbd => smb/server}/ntlmssp.h | 0
fs/{ksmbd => smb/server}/oplock.c | 0
fs/{ksmbd => smb/server}/oplock.h | 0
fs/{ksmbd => smb/server}/server.c | 33 +-
fs/{ksmbd => smb/server}/server.h | 0
fs/{ksmbd => smb/server}/smb2misc.c | 33 +-
fs/{ksmbd => smb/server}/smb2ops.c | 0
fs/{ksmbd => smb/server}/smb2pdu.c | 44 +-
fs/{ksmbd => smb/server}/smb2pdu.h | 0
fs/{ksmbd => smb/server}/smb_common.c | 0
fs/{ksmbd => smb/server}/smb_common.h | 2 +-
fs/{ksmbd => smb/server}/smbacl.c | 0
fs/{ksmbd => smb/server}/smbacl.h | 0
fs/{ksmbd => smb/server}/smbfsctl.h | 0
fs/{ksmbd => smb/server}/smbstatus.h | 0
fs/{ksmbd => smb/server}/transport_ipc.c | 0
fs/{ksmbd => smb/server}/transport_ipc.h | 0
fs/{ksmbd => smb/server}/transport_rdma.c | 0
fs/{ksmbd => smb/server}/transport_rdma.h | 0
fs/{ksmbd => smb/server}/transport_tcp.c | 0
fs/{ksmbd => smb/server}/transport_tcp.h | 0
fs/{ksmbd => smb/server}/unicode.c | 0
fs/{ksmbd => smb/server}/unicode.h | 0
fs/{ksmbd => smb/server}/uniupr.h | 0
fs/{ksmbd => smb/server}/vfs.c | 2 +-
fs/{ksmbd => smb/server}/vfs.h | 0
fs/{ksmbd => smb/server}/vfs_cache.c | 0
fs/{ksmbd => smb/server}/vfs_cache.h | 0
fs/{ksmbd => smb/server}/xattr.h | 0
include/acpi/acpixf.h | 1 +
include/acpi/actbl3.h | 1 +
include/linux/gpio/driver.h | 8 +
include/linux/libata.h | 2 +-
include/linux/regulator/pca9450.h | 4 +-
include/net/netfilter/nf_tables.h | 31 +-
include/net/xfrm.h | 1 +
include/trace/events/writeback.h | 2 +-
io_uring/net.c | 17 +-
io_uring/poll.c | 9 +-
kernel/bpf/btf.c | 20 +-
kernel/bpf/syscall.c | 5 +
kernel/bpf/verifier.c | 28 +-
kernel/cgroup/cgroup.c | 20 +-
kernel/cgroup/legacy_freezer.c | 8 +-
kernel/time/tick-common.c | 13 +-
kernel/time/tick-sched.c | 13 +-
mm/maccess.c | 16 +-
mm/memfd.c | 3 +-
mm/usercopy.c | 2 +-
net/core/sock.c | 6 -
net/ipv4/esp4_offload.c | 3 +
net/ipv4/xfrm4_input.c | 1 +
net/ipv6/esp6_offload.c | 3 +
net/ipv6/xfrm6_input.c | 3 +
net/mptcp/protocol.c | 80 ++--
net/mptcp/subflow.c | 17 +-
net/netfilter/ipvs/ip_vs_xmit.c | 2 +
net/netfilter/nf_tables_api.c | 328 +++++++++++---
net/netfilter/nfnetlink_osf.c | 1 +
net/netfilter/nft_immediate.c | 90 +++-
net/netfilter/nft_set_bitmap.c | 5 +-
net/netfilter/nft_set_hash.c | 23 +-
net/netfilter/nft_set_pipapo.c | 20 +-
net/netfilter/nft_set_rbtree.c | 5 +-
net/netfilter/xt_osf.c | 1 -
net/sched/sch_netem.c | 8 +-
net/xfrm/Makefile | 2 +
net/xfrm/xfrm_input.c | 1 +
.../{xfrm_interface.c => xfrm_interface_core.c} | 54 ++-
net/xfrm/xfrm_policy.c | 12 +
scripts/gfp-translate | 6 +-
sound/pci/hda/patch_realtek.c | 2 +
sound/soc/amd/yc/acp6x-mach.c | 7 +
sound/soc/codecs/nau8824.c | 24 +
sound/soc/codecs/wcd938x-sdw.c | 1 -
sound/soc/fsl/fsl_sai.c | 11 +-
sound/soc/fsl/fsl_sai.h | 1 +
sound/soc/generic/simple-card.c | 1 +
.../bpf/verifier/bounds_mix_sign_unsign.c | 110 +++--
.../selftests/mount_setattr/mount_setattr_test.c | 7 -
tools/testing/selftests/net/fcnal-test.sh | 27 +-
.../net/forwarding/mirror_gre_bridge_1d.sh | 4 +
.../net/forwarding/mirror_gre_bridge_1q.sh | 4 +
tools/testing/selftests/net/mptcp/config | 1 +
tools/testing/selftests/net/mptcp/diag.sh | 47 +-
tools/testing/selftests/net/mptcp/mptcp_connect.c | 8 +-
tools/testing/selftests/net/mptcp/mptcp_connect.sh | 15 +
tools/testing/selftests/net/mptcp/mptcp_join.sh | 481 +++++++++++++--------
tools/testing/selftests/net/mptcp/mptcp_lib.sh | 64 +++
tools/testing/selftests/net/mptcp/mptcp_sockopt.c | 18 +-
tools/testing/selftests/net/mptcp/mptcp_sockopt.sh | 20 +-
tools/testing/selftests/net/mptcp/pm_netlink.sh | 27 +-
tools/testing/selftests/net/mptcp/userspace_pm.sh | 7 +-
tools/testing/selftests/net/tls.c | 24 +-
tools/testing/selftests/net/vrf-xfrm-tests.sh | 32 +-
virt/kvm/kvm_main.c | 20 +-
313 files changed, 2180 insertions(+), 811 deletions(-)Greg Kroah-Hartman
maintainerPATCH 1/170 drm/amd/display: Use dc_update_planes_and_stream
From: Rodrigo Siqueira <[email protected]>
[ Upstream commit f7511289821ffccc07579406d6ab520aa11049f5 ]
[Why & How]
The old dc_commit_updates_for_stream lacks manipulation for many corner cases where the DC feature requires special attention; as a result, it starts to show its limitation (e.g., the SubVP feature is not supported by it, among other cases). To modernize and unify our internal API, this commit replaces the old dc_commit_updates_for_stream with dc_update_planes_and_stream, which has more features.
Stable-dep-of: ea2062dd1f03 ("drm/amd/display: fix the system hang while disable PSR")
--- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 30 +++++++++---------- 1 file changed, 15 insertions(+), 15 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +15 -15
@@ -2632,10 +2632,12 @@ static void dm_gpureset_commit_state(struct dc_state *dc_state, bundle->surface_updates[m].surface->force_full_update = true; } -dc_commit_updates_for_stream ( - dm->dc, bundle->surface_updates, + +dc_update_planes_and_stream (dm->dc, + bundle->surface_updates, dc_state->stream_status->plane_count, - dc_state->streams[k], &bundle->stream_update, dc_state); + dc_state->streams[k], + &bundle->stream_update); } cleanup:
@@ -7887,12 +7889,11 @@ static void amdgpu_dm_commit_planes(struct drm_atomic_state *state, acrtc_state->stream->link->psr_settings.psr_allow_active)amdgpu_dm_psr_disable (acrtc_state->stream); -dc_commit_updates_for_stream (dm->dc, - bundle->surface_updates, - planes_count, - acrtc_state->stream, - &bundle->stream_update, - dc_state); +dc_update_planes_and_stream (dm->dc, + bundle->surface_updates, + planes_count, + acrtc_state->stream, + &bundle->stream_update);/** * Enable or disable the interrupts on the backend.
@@ -8334,12 +8335,11 @@ static void amdgpu_dm_atomic_commit_tail(struct drm_atomic_state *state)mutex_lock (&dm->dc_lock); -dc_commit_updates_for_stream (dm->dc, - dummy_updates, - status->plane_count, - dm_new_crtc_state->stream, - &stream_update, - dc_state); +dc_update_planes_and_stream (dm->dc, + dummy_updates, + status->plane_count, + dm_new_crtc_state->stream, + &stream_update);mutex_unlock (&dm->dc_lock); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 2/170 drm/amd/display: Add wrapper to call planes and stream update
In reply to Greg Kroah-HartmanFrom: Rodrigo Siqueira <[email protected]>
[ Upstream commit 81f743a08f3b214638aa389e252ae5e6c3592e7c ]
[Why & How]
This commit is part of a sequence of changes that replaces the commit sequence used in the DC with a new one. As a result of this transition, we moved some specific parts from the commit sequence and brought them to amdgpu_dm. This commit adds a wrapper inside DM that enable our drivers to do any necessary preparation or change before we offload the plane/stream update to DC.
Stable-dep-of: ea2062dd1f03 ("drm/amd/display: fix the system hang while disable PSR")
--- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 51 +++++++++++++++---- 1 file changed, 41 insertions(+), 10 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +41 -10
@@ -348,6 +348,35 @@ static inline bool is_dc_timing_adjust_needed(struct dm_crtc_state *old_state,return false; } +/** +* update_planes_and_stream_adapter() - Send planes to be updated in DC +* +* DC has a generic way to update planes and stream via +* dc_update_planes_and_stream function; however, DM might need some +* adjustments and preparation before calling it. This function is a wrapper +* for the dc_update_planes_and_stream that does any required configuration +* before passing control to DC. +*/ +static inline bool update_planes_and_stream_adapter (struct dc *dc, +int update_type, +int planes_count, +struct dc_stream_state *stream, +struct dc_stream_update *stream_update, +struct dc_surface_update *array_of_surface_update) +{ +/* +* Previous frame finished and HW is ready for optimization. +*/ +if (update_type ==UPDATE_TYPE_FAST ) +dc_post_update_surfaces_to_stream (dc); + +return dc_update_planes_and_stream (dc, + array_of_surface_update, + planes_count, + stream, + stream_update); +} +/** * dm_pflip_high_irq() - Handle pageflip interrupt * @interrupt_params: ignored
@@ -2633,11 +2662,12 @@ static void dm_gpureset_commit_state(struct dc_state *dc_state, true; } -dc_update_planes_and_stream (dm->dc, - bundle->surface_updates, - dc_state->stream_status->plane_count, - dc_state->streams[k], - &bundle->stream_update); +update_planes_and_stream_adapter (dm->dc, +UPDATE_TYPE_FULL , + dc_state->stream_status->plane_count, + dc_state->streams[k], + &bundle->stream_update, + bundle->surface_updates); } cleanup:
@@ -7889,11 +7919,12 @@ static void amdgpu_dm_commit_planes(struct drm_atomic_state *state, acrtc_state->stream->link->psr_settings.psr_allow_active)amdgpu_dm_psr_disable (acrtc_state->stream); -dc_update_planes_and_stream (dm->dc, - bundle->surface_updates, - planes_count, - acrtc_state->stream, - &bundle->stream_update); +update_planes_and_stream_adapter (dm->dc, + acrtc_state->update_type, + planes_count, + acrtc_state->stream, + &bundle->stream_update, + bundle->surface_updates);/** * Enable or disable the interrupts on the backend.
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 3/170 drm/amd/display: fix the system hang while disable PSR
In reply to Greg Kroah-HartmanFrom: Tom Chung <[email protected]>
[ Upstream commit ea2062dd1f0384ae1b136d333ee4ced15bedae38 ]
[Why]
When the PSR enabled. If you try to adjust the timing parameters, it may cause system hang. Because the timing mismatch with the DMCUB settings.
[How]
Disable the PSR before adjusting timing parameters.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +6 -4
@@ -7902,6 +7902,12 @@ static void amdgpu_dm_commit_planes(struct drm_atomic_state *state,if (acrtc_state->abm_level != dm_old_crtc_state->abm_level) bundle->stream_update.abm_level = &acrtc_state->abm_level; +mutex_lock (&dm->dc_lock); +if ((acrtc_state->update_type >UPDATE_TYPE_FAST ) && + acrtc_state->stream->link->psr_settings.psr_allow_active) +amdgpu_dm_psr_disable (acrtc_state->stream); +mutex_unlock (&dm->dc_lock); +/* * If FreeSync state on the stream has changed then we need to * re-adjust the min/max bounds now that DC doesn't handle this
@@ -7915,10 +7921,6 @@ static void amdgpu_dm_commit_planes(struct drm_atomic_state *state,spin_unlock_irqrestore (&pcrtc->dev->event_lock, flags); }mutex_lock (&dm->dc_lock); -if ((acrtc_state->update_type >UPDATE_TYPE_FAST ) && - acrtc_state->stream->link->psr_settings.psr_allow_active) -amdgpu_dm_psr_disable (acrtc_state->stream); - update_planes_and_stream_adapter(dm->dc, acrtc_state->update_type, planes_count,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 4/170 tty: serial: fsl_lpuart: make rx_watermark configurable for different platforms
In reply to Greg Kroah-HartmanFrom: Sherry Sun <[email protected]>
[ Upstream commit 34ebb26f12a84b744f43c5c4869516f122a2dfaa ]
Add rx_watermark parameter for struct lpuart_port to make the receive watermark configurable for different platforms.
No function changed.
Stable-dep-of: a82c3df955f8 ("tty: serial: fsl_lpuart: reduce RX watermark to 0 on LS1028A")
--- drivers/tty/serial/fsl_lpuart.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/tty/serial/fsl_lpuart.c +12 -2
@@ -257,6 +257,7 @@ struct lpuart_port {unsigned int txfifo_size;unsigned int rxfifo_size; +u8 rx_watermark;bool lpuart_dma_tx_use;bool lpuart_dma_rx_use;struct dma_chan *dma_tx_chan;
@@ -283,38 +284,45 @@ struct lpuart_soc_data {enum lpuart_type devtype;char iotype;u8 reg_off; +u8 rx_watermark; };static const struct lpuart_soc_data vf_data = { .devtype =VF610_LPUART , .iotype =UPIO_MEM , + .rx_watermark =1 , };static const struct lpuart_soc_data ls1021a_data = { .devtype =LS1021A_LPUART , .iotype =UPIO_MEM32BE , + .rx_watermark =1 , };static const struct lpuart_soc_data ls1028a_data = { .devtype =LS1028A_LPUART , .iotype =UPIO_MEM32 , + .rx_watermark =1 , };static struct lpuart_soc_data imx7ulp_data = { .devtype =IMX7ULP_LPUART , .iotype =UPIO_MEM32 , .reg_off =IMX_REG_OFF , + .rx_watermark =1 , };static struct lpuart_soc_data imx8qxp_data = { .devtype =IMX8QXP_LPUART , .iotype =UPIO_MEM32 , .reg_off =IMX_REG_OFF , + .rx_watermark =1 , };static struct lpuart_soc_data imxrt1050_data = { .devtype =IMXRT1050_LPUART , .iotype =UPIO_MEM32 , .reg_off =IMX_REG_OFF , + .rx_watermark =1 , };static const struct of_device_id lpuart_dt_ids[] = {
@@ -1533,7 +1541,7 @@ static void lpuart_setup_watermark(struct lpuart_port *sport) }writeb (0 , sport->port.membase +UARTTWFIFO ); -writeb (1 , sport->port.membase +UARTRWFIFO ); +writeb (sport->rx_watermark, sport->port.membase +UARTRWFIFO );/* Restore cr2 */ writeb (cr2_saved, sport->port.membase +UARTCR2 );
@@ -1568,7 +1576,8 @@ static void lpuart32_setup_watermark(struct lpuart_port *sport)lpuart32_write (&sport->port, val,UARTFIFO );/* set the watermark */ - val = (0x1 <<UARTWATER_RXWATER_OFF ) | (0x0 <<UARTWATER_TXWATER_OFF ); + val = (sport->rx_watermark <<UARTWATER_RXWATER_OFF ) | + (0x0 <<UARTWATER_TXWATER_OFF );lpuart32_write (&sport->port, val,UARTWATER );/* Restore cr2 */
@@ -2714,6 +2723,7 @@ static int lpuart_probe(struct platform_device *pdev) sport->port.dev = &pdev->dev; sport->port.type =PORT_LPUART ; sport->devtype = sdata->devtype; + sport->rx_watermark = sdata->rx_watermark; ret =platform_get_irq (pdev,0 );if (ret <0 )return ret;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 5/170 tty: serial: fsl_lpuart: reduce RX watermark to 0 on LS1028A
In reply to Greg Kroah-HartmanFrom: Robert Hodaszi <[email protected]>
[ Upstream commit a82c3df955f8c1c726e4976527aa6ae924a67dd9 ]
LS1028A is using DMA with LPUART. Having RX watermark set to 1, means DMA transactions are started only after receiving the second character.
On other platforms with newer LPUART IP, Receiver Idle Empty function initiates the DMA request after the receiver is idling for 4 characters. But this feature is missing on LS1028A, which is causing a 1-character delay in the RX direction on this platform.
Set RX watermark to 0 to initiate RX DMA after each character.
Message-ID: <[email protected]>
--- drivers/tty/serial/fsl_lpuart.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/fsl_lpuart.c +1 -1
@@ -302,7 +302,7 @@ static const struct lpuart_soc_data ls1021a_data = {static const struct lpuart_soc_data ls1028a_data = { .devtype =LS1028A_LPUART , .iotype =UPIO_MEM32 , - .rx_watermark =1 , + .rx_watermark =0 , };static struct lpuart_soc_data imx7ulp_data = {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 6/170 ata: libata-scsi: Avoid deadlock on rescan after device resume
In reply to Greg Kroah-HartmanFrom: Damien Le Moal <[email protected]>
[ Upstream commit 6aa0365a3c8512587fffd42fe438768709ddef8e ]
When an ATA port is resumed from sleep, the port is reset and a power management request issued to libata EH to reset the port and rescanning the device(s) attached to the port. Device rescanning is done by scheduling an ata_scsi_dev_rescan() work, which will execute scsi_rescan_device().
However, scsi_rescan_device() takes the generic device lock, which is also taken by dpm_resume() when the SCSI device is resumed as well. If a device rescan execution starts before the completion of the SCSI device resume, the rcu locking used to refresh the cached VPD pages of the device, combined with the generic device locking from scsi_rescan_device() and from dpm_resume() can cause a deadlock.
Avoid this situation by changing struct ata_port scsi_rescan_task to be a delayed work instead of a simple work_struct. ata_scsi_dev_rescan() is modified to check if the SCSI device associated with the ATA device that must be rescanned is not suspended. If the SCSI device is still suspended, ata_scsi_dev_rescan() returns early and reschedule itself for execution after an arbitrary delay of 5ms.
--- drivers/ata/libata-core.c | 3 ++- drivers/ata/libata-eh.c | 2 +- drivers/ata/libata-scsi.c | 22 +++++++++++++++++++++- include/linux/libata.h | 2 +- 4 files changed, 25 insertions(+), 4 deletions(-)
drivers/ata/libata-core.c +2 -1
@@ -5313,7 +5313,7 @@ struct ata_port *ata_port_alloc(struct ata_host *host)mutex_init (&ap->scsi_scan_mutex);INIT_DELAYED_WORK (&ap->hotplug_task, ata_scsi_hotplug); -INIT_WORK (&ap->scsi_rescan_task, ata_scsi_dev_rescan); +INIT_DELAYED_WORK (&ap->scsi_rescan_task, ata_scsi_dev_rescan);INIT_LIST_HEAD (&ap->eh_done_q);init_waitqueue_head (&ap->eh_wait_q);init_completion (&ap->park_req_pending);
@@ -5919,6 +5919,7 @@ static void ata_port_detach(struct ata_port *ap)WARN_ON (!(ap->pflags &ATA_PFLAG_UNLOADED ));cancel_delayed_work_sync (&ap->hotplug_task); +cancel_delayed_work_sync (&ap->scsi_rescan_task); skip_eh:/* clean up zpodd on port removal */
drivers/ata/libata-eh.c +1 -1
@@ -2973,7 +2973,7 @@ static int ata_eh_revalidate_and_attach(struct ata_link *link, ehc->i.flags |=ATA_EHI_SETMODE ;/* schedule the scsi_rescan_device() here */ -schedule_work (&(ap->scsi_rescan_task)); +schedule_delayed_work (&ap->scsi_rescan_task,0 ); }else if (dev->class ==ATA_DEV_UNKNOWN && ehc->tries[dev->devno] &&ata_class_enabled (ehc->classes[dev->devno])) {
drivers/ata/libata-scsi.c +21 -1
@@ -4601,10 +4601,11 @@ int ata_scsi_user_scan(struct Scsi_Host *shost, unsigned int channel,void ata_scsi_dev_rescan (struct work_struct *work) {struct ata_port *ap = - container_of(work, struct ata_port, scsi_rescan_task); + container_of(work, struct ata_port, scsi_rescan_task.work);struct ata_link *link;struct ata_device *dev;unsigned long flags; +bool delay_rescan = false;mutex_lock (&ap->scsi_scan_mutex);spin_lock_irqsave (ap->lock, flags);
@@ -4618,6 +4619,21 @@ void ata_scsi_dev_rescan(struct work_struct *work)if (scsi_device_get (sdev))continue ; +/* +* If the rescan work was scheduled because of a resume +* event, the port is already fully resumed, but the +* SCSI device may not yet be fully resumed. In such +* case, executing scsi_rescan_device() may cause a +* deadlock with the PM code on device_lock(). Prevent +* this by giving up and retrying rescan after a short +* delay. +*/ + delay_rescan = sdev->sdev_gendev.power.is_suspended; +if (delay_rescan) { +scsi_device_put (sdev); +break ; + } +spin_unlock_irqrestore (ap->lock, flags);scsi_rescan_device (&(sdev->sdev_gendev));scsi_device_put (sdev);
@@ -4627,4 +4643,8 @@ void ata_scsi_dev_rescan(struct work_struct *work)spin_unlock_irqrestore (ap->lock, flags);mutex_unlock (&ap->scsi_scan_mutex); + +if (delay_rescan) +schedule_delayed_work (&ap->scsi_rescan_task, +msecs_to_jiffies (5 )); }
include/linux/libata.h +1 -1
@@ -834,7 +834,7 @@ struct ata_port {struct mutex scsi_scan_mutex;struct delayed_work hotplug_task; -struct work_struct scsi_rescan_task; +struct delayed_work scsi_rescan_task;unsigned int hsm_task_state;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 7/170 mm: Fix copy_from_user_nofault().
In reply to Greg Kroah-HartmanFrom: Alexei Starovoitov <[email protected]>
commit d319f344561de23e810515d109c7278919bff7b0 upstream.
There are several issues with copy_from_user_nofault():
- access_ok() is designed for user context only and for that reason it has WARN_ON_IN_IRQ() which triggers when bpf, kprobe, eprobe and perf on ppc are calling it from irq.
- it's missing nmi_uaccess_okay() which is a nop on all architectures except x86 where it's required.
The comment in arch/x86/mm/tlb.c explains the details why it's necessary. Calling copy_from_user_nofault() from bpf, [ke]probe without this check is not safe.
- __copy_from_user_inatomic() under CONFIG_HARDENED_USERCOPY is calling check_object_size()->__check_object_size()->check_heap_object()->find_vmap_area()->spin_lock() which is not safe to do from bpf, [ke]probe and perf due to potential deadlock.
Fix all three issues. At the end the copy_from_user_nofault() becomes equivalent to copy_from_user_nmi() from safety point of view with a difference in the return value.
--- mm/maccess.c | 16 +++++++++++----- mm/usercopy.c | 2 +- 2 files changed, 12 insertions(+), 6 deletions(-)
mm/maccess.c +11 -5
@@ -5,6 +5,7 @@#include <linux/export.h> #include <linux/mm.h> #include <linux/uaccess.h> +#include <asm/tlb.h> bool __weak copy_from_kernel_nofault_allowed (const void *unsafe_src,size_t size)
@@ -113,11 +114,16 @@ Efault:long copy_from_user_nofault (void *dst,const void __user *src,size_t size) {long ret = -EFAULT ; -if (access_ok (src, size)) { -pagefault_disable (); - ret =__copy_from_user_inatomic (dst, src, size); -pagefault_enable (); - } + +if (!__access_ok (src, size)) +return ret; + +if (!nmi_uaccess_okay ()) +return ret; + +pagefault_disable (); + ret =__copy_from_user_inatomic (dst, src, size); +pagefault_enable ();if (ret)return -EFAULT ;
mm/usercopy.c +1 -1
@@ -172,7 +172,7 @@ static inline void check_heap_object(conreturn ; } -if (is_vmalloc_addr (ptr)) { +if (is_vmalloc_addr (ptr) && !pagefault_disabled ()) {struct vmap_area *area =find_vmap_area (addr);if (!area)
Greg Kroah-Hartman
maintainerPATCH 8/170 tpm, tpm_tis: Claim locality in interrupt handler
In reply to Greg Kroah-HartmanFrom: Lino Sanfilippo <[email protected]>
commit 0e069265bce5a40c4eee52e2364bbbd4dabee94a upstream.
Writing the TPM_INT_STATUS register in the interrupt handler to clear the interrupts only has effect if a locality is held. Since this is not guaranteed at the time the interrupt is fired, claim the locality explicitly in the handler.
--- drivers/char/tpm/tpm_tis_core.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/char/tpm/tpm_tis_core.c +2 -0
@@ -772,7 +772,9 @@ static irqreturn_t tis_int_handler(int dwake_up_interruptible (&priv->int_queue);/* Clear interrupts handled with TPM_EOI */ +tpm_tis_request_locality (chip,0 ); rc =tpm_tis_write32 (priv,TPM_INT_STATUS (priv->locality), interrupt); +tpm_tis_relinquish_locality (chip,0 );if (rc <0 )return IRQ_NONE ;
Greg Kroah-Hartman
maintainerPATCH 9/170 tpm_crb: Add support for CRB devices based on Pluton
In reply to Greg Kroah-HartmanFrom: Matthew Garrett <[email protected]>
commit 4d2732882703791ea4b670df433f88fc4b40a5cb upstream.
Pluton is an integrated security processor present in some recent Ryzen parts. If it's enabled, it presents two devices - an MSFT0101 ACPI device that's broadly an implementation of a Command Response Buffer TPM2, and an MSFT0200 ACPI device whose functionality I haven't examined in detail yet. This patch only attempts to add support for the TPM device.
There's a few things that need to be handled here. The first is that the TPM2 ACPI table uses a previously undefined start method identifier. The table format appears to include 16 bytes of startup data, which corresponds to one 64-bit address for a start message and one 64-bit address for a completion response. The second is that the ACPI tables on the Thinkpad Z13 I'm testing this on don't define any memory windows in _CRS (or, more accurately, there are two empty memory windows). This check doesn't seem strictly necessary, so I've skipped that.
Finally, it seems like chip needs to be explicitly asked to transition into ready status on every command. Failing to do this means that if two commands are sent in succession without an idle/ready transition in between, everything will appear to work fine but the response is simply the original command. I'm working without any docs here, so I'm not sure if this is actually the required behaviour or if I'm missing something somewhere else, but doing this results in the chip working reliably.
--- drivers/char/tpm/tpm_crb.c | 100 ++++++++++++++++++++++++++++++++++++++++----- include/acpi/actbl3.h | 1 2 files changed, 91 insertions(+), 10 deletions(-)
drivers/char/tpm/tpm_crb.c +90 -10
@@ -98,6 +98,8 @@ struct crb_priv {u8 __iomem *rsp;u32 cmd_size;u32 smc_func_id; +u32 __iomem *pluton_start_addr; +u32 __iomem *pluton_reply_addr; };struct tpm2_crb_smc {
@@ -108,6 +110,11 @@ struct tpm2_crb_smc {u32 smc_func_id; }; +struct tpm2_crb_pluton { +u64 start_addr; +u64 reply_addr; +}; +static bool crb_wait_for_reg_32 (u32 __iomem *reg,u32 mask,u32 value,unsigned long timeout) {
@@ -127,6 +134,25 @@ static bool crb_wait_for_reg_32(u32 __ioreturn ((ioread32 (reg) & mask) == value); } +static int crb_try_pluton_doorbell (struct crb_priv *priv,bool wait_for_complete) +{ +if (priv->sm !=ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON ) +return 0 ; + +if (!crb_wait_for_reg_32 (priv->pluton_reply_addr, ~0 ,1 ,TPM2_TIMEOUT_C )) +return -ETIME ; + +iowrite32 (1 , priv->pluton_start_addr); +if (wait_for_complete == false) +return 0 ; + +if (!crb_wait_for_reg_32 (priv->pluton_start_addr, +0xffffffff ,0 ,200 )) +return -ETIME ; + +return 0 ; +} +/** * __crb_go_idle - request tpm crb device to go the idle state *
@@ -145,6 +171,8 @@ static bool crb_wait_for_reg_32(u32 __io*/ static int __crb_go_idle (struct device *dev,struct crb_priv *priv) { +int rc; +if ((priv->sm ==ACPI_TPM2_START_METHOD ) || (priv->sm ==ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD ) || (priv->sm ==ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC ))
@@ -152,6 +180,10 @@ static int __crb_go_idle(struct device *iowrite32 (CRB_CTRL_REQ_GO_IDLE , &priv->regs_t->ctrl_req); + rc =crb_try_pluton_doorbell (priv, true); +if (rc) +return rc; + if (!crb_wait_for_reg_32(&priv->regs_t->ctrl_req, CRB_CTRL_REQ_GO_IDLE/* mask */, 0, /* value */
@@ -188,12 +220,19 @@ static int crb_go_idle(struct tpm_chip **/ static int __crb_cmd_ready(struct device *dev, struct crb_priv *priv) { + int rc; + if ((priv->sm == ACPI_TPM2_START_METHOD) || (priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD) || (priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC)) return 0; iowrite32(CRB_CTRL_REQ_CMD_READY, &priv->regs_t->ctrl_req); + + rc = crb_try_pluton_doorbell(priv, true); + if (rc) + return rc; + if (!crb_wait_for_reg_32(&priv->regs_t->ctrl_req, CRB_CTRL_REQ_CMD_READY /* mask */, 0, /* value */
@@ -371,6 +410,10 @@ static int crb_send(struct tpm_chip *chireturn -E2BIG ; } +/* Seems to be necessary for every command */ +if (priv->sm ==ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON ) +__crb_cmd_ready (&chip->dev, priv); +memcpy_toio (priv->cmd, buf, len);/* Make sure that cmd is populated before issuing start. */
@@ -394,7 +437,10 @@ static int crb_send(struct tpm_chip *chi rc =tpm_crb_smc_start (&chip->dev, priv->smc_func_id); } -return rc; +if (rc) +return rc; + +return crb_try_pluton_doorbell (priv, false); }static void crb_cancel (struct tpm_chip *chip)
@@ -524,15 +570,18 @@ static int crb_map_io(struct acpi_devicereturn ret;acpi_dev_free_resource_list (&acpi_resource_list); -if (resource_type (iores_array) !=IORESOURCE_MEM ) { -dev_err (dev,FW_BUG "TPM2 ACPI table does not define a memory resource\n" ); -return -EINVAL ; - }else if (resource_type (iores_array +TPM_CRB_MAX_RESOURCES ) == -IORESOURCE_MEM ) { -dev_warn (dev,"TPM2 ACPI table defines too many memory resources\n" ); -memset (iores_array +TPM_CRB_MAX_RESOURCES , -0 ,sizeof (*iores_array)); - iores_array[TPM_CRB_MAX_RESOURCES ].flags =0 ; +/* Pluton doesn't appear to define ACPI memory regions */ +if (priv->sm !=ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON ) { +if (resource_type (iores_array) !=IORESOURCE_MEM ) { +dev_err (dev,FW_BUG "TPM2 ACPI table does not define a memory resource\n" ); +return -EINVAL ; + }else if (resource_type (iores_array +TPM_CRB_MAX_RESOURCES ) == +IORESOURCE_MEM ) { +dev_warn (dev,"TPM2 ACPI table defines too many memory resources\n" ); +memset (iores_array +TPM_CRB_MAX_RESOURCES , +0 ,sizeof (*iores_array)); + iores_array[TPM_CRB_MAX_RESOURCES ].flags =0 ; + } } iores =NULL ;
@@ -656,6 +705,22 @@ out_relinquish_locality:return ret; } +static int crb_map_pluton (struct device *dev,struct crb_priv *priv, +struct acpi_table_tpm2 *buf,struct tpm2_crb_pluton *crb_pluton) +{ + priv->pluton_start_addr =crb_map_res (dev,NULL ,NULL , + crb_pluton->start_addr,4 ); +if (IS_ERR (priv->pluton_start_addr)) +return PTR_ERR (priv->pluton_start_addr); + + priv->pluton_reply_addr =crb_map_res (dev,NULL ,NULL , + crb_pluton->reply_addr,4 ); +if (IS_ERR (priv->pluton_reply_addr)) +return PTR_ERR (priv->pluton_reply_addr); + +return 0 ; +} +static int crb_acpi_add (struct acpi_device *device) {struct acpi_table_tpm2 *buf;
@@ -663,6 +728,7 @@ static int crb_acpi_add(struct acpi_devistruct tpm_chip *chip;struct device *dev = &device->dev;struct tpm2_crb_smc *crb_smc; +struct tpm2_crb_pluton *crb_pluton;acpi_status status;u32 sm;int rc;
@@ -700,6 +766,20 @@ static int crb_acpi_add(struct acpi_devi priv->smc_func_id = crb_smc->smc_func_id; } +if (sm ==ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON ) { +if (buf->header.length < (sizeof (*buf) +sizeof (*crb_pluton))) { +dev_err (dev, +FW_BUG "TPM2 ACPI table has wrong size %u for start method type %d\n" , + buf->header.length, +ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON ); +return -EINVAL ; + } + crb_pluton = ACPI_ADD_PTR(struct tpm2_crb_pluton, buf, sizeof(*buf)); + rc =crb_map_pluton (dev, priv, buf, crb_pluton); +if (rc) +return rc; + } + priv->sm = sm; priv->hid =acpi_device_hid (device);
include/acpi/actbl3.h +1 -0
@@ -443,6 +443,7 @@ struct acpi_tpm2_phy {#define ACPI_TPM2_RESERVED10 10#define ACPI_TPM2_COMMAND_BUFFER_WITH_ARM_SMC 11/* V1.2 Rev 8 */ #define ACPI_TPM2_RESERVED 12 +#define ACPI_TPM2_COMMAND_BUFFER_WITH_PLUTON 13/* Optional trailer appears after any start_method subtables */
Greg Kroah-Hartman
maintainerPATCH 10/170 ksmbd: validate command payload size
In reply to Greg Kroah-HartmanFrom: Namjae Jeon <[email protected]>
commit 2b9b8f3b68edb3d67d79962f02e26dbb5ae3808d upstream.
->StructureSize2 indicates command payload size. ksmbd should validate this size with rfc1002 length before accessing it.
This patch remove unneeded check and add the validation for this.
[ 8.912583] BUG: KASAN: slab-out-of-bounds in ksmbd_smb2_check_message+0x12a/0xc50 [ 8.913051] Read of size 2 at addr ffff88800ac7d92c by task kworker/0:0/7 ... [ 8.914967] Call Trace: [ 8.915126] <TASK> [ 8.915267] dump_stack_lvl+0x33/0x50 [ 8.915506] print_report+0xcc/0x620 [ 8.916558] kasan_report+0xae/0xe0 [ 8.917080] kasan_check_range+0x35/0x1b0 [ 8.917334] ksmbd_smb2_check_message+0x12a/0xc50 [ 8.917935] ksmbd_verify_smb_message+0xae/0xd0 [ 8.918223] handle_ksmbd_work+0x192/0x820 [ 8.918478] process_one_work+0x419/0x760 [ 8.918727] worker_thread+0x2a2/0x6f0 [ 8.919222] kthread+0x187/0x1d0 [ 8.919723] ret_from_fork+0x1f/0x30 [ 8.919954] </TASK>
--- fs/ksmbd/smb2misc.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-)
fs/ksmbd/smb2misc.c +12 -11
@@ -351,6 +351,7 @@ int ksmbd_smb2_check_message(struct ksmbint command;__u32 clc_len;/* calculated length */ __u32 len =get_rfc1002_len (work->request_buf); +__u32 req_struct_size;if (le32_to_cpu (hdr->NextCommand) >0 ) len =le32_to_cpu (hdr->NextCommand);
@@ -373,17 +374,9 @@ int ksmbd_smb2_check_message(struct ksmb }if (smb2_req_struct_sizes[command] != pdu->StructureSize2) { -if (command !=SMB2_OPLOCK_BREAK_HE && - (hdr->Status ==0 || pdu->StructureSize2 !=SMB2_ERROR_STRUCTURE_SIZE2_LE )) { -/* error packets have 9 byte structure size */ -ksmbd_debug (SMB , -"Illegal request size %u for command %d\n" , -le16_to_cpu (pdu->StructureSize2), command); -return 1 ; - }else if (command ==SMB2_OPLOCK_BREAK_HE && - hdr->Status ==0 && -le16_to_cpu (pdu->StructureSize2) !=OP_BREAK_STRUCT_SIZE_20 && -le16_to_cpu (pdu->StructureSize2) !=OP_BREAK_STRUCT_SIZE_21 ) { +if (command ==SMB2_OPLOCK_BREAK_HE && +le16_to_cpu (pdu->StructureSize2) !=OP_BREAK_STRUCT_SIZE_20 && +le16_to_cpu (pdu->StructureSize2) !=OP_BREAK_STRUCT_SIZE_21 ) {/* special case for SMB2.1 lease break message */ ksmbd_debug(SMB, "Illegal request size %d for oplock break\n",
@@ -392,6 +385,14 @@ int ksmbd_smb2_check_message(struct ksmb } } + req_struct_size =le16_to_cpu (pdu->StructureSize2) + + __SMB2_HEADER_STRUCTURE_SIZE; +if (command ==SMB2_LOCK_HE ) + req_struct_size -=sizeof (struct smb2_lock_element ); + +if (req_struct_size > len +1 ) +return 1 ; +if (smb2_calc_size (hdr, &clc_len))return 1 ;
Greg Kroah-Hartman
maintainerPATCH 11/170 ksmbd: fix out-of-bound read in smb2_write
In reply to Greg Kroah-HartmanFrom: Namjae Jeon <[email protected]>
commit 5fe7f7b78290638806211046a99f031ff26164e1 upstream.
ksmbd_smb2_check_message doesn't validate hdr->NextCommand. If ->NextCommand is bigger than Offset + Length of smb2 write, It will allow oversized smb2 write length. It will cause OOB read in smb2_write.
--- fs/ksmbd/smb2misc.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
fs/ksmbd/smb2misc.c +9 -3
@@ -351,10 +351,16 @@ int ksmbd_smb2_check_message(struct ksmbint command;__u32 clc_len;/* calculated length */ __u32 len =get_rfc1002_len (work->request_buf); -__u32 req_struct_size; +__u32 req_struct_size, next_cmd =le32_to_cpu (hdr->NextCommand); -if (le32_to_cpu (hdr->NextCommand) >0 ) - len =le32_to_cpu (hdr->NextCommand); +if ((u64 )work->next_smb2_rcv_hdr_off + next_cmd > len) { +pr_err ("next command(%u) offset exceeds smb msg size\n" , + next_cmd); +return 1 ; + } + +if (next_cmd >0 ) + len = next_cmd;else if (work->next_smb2_rcv_hdr_off) len -= work->next_smb2_rcv_hdr_off;
Greg Kroah-Hartman
maintainerPATCH 12/170 ksmbd: validate session id and tree id in the compound request
In reply to Greg Kroah-HartmanFrom: Namjae Jeon <[email protected]>
commit 5005bcb4219156f1bf7587b185080ec1da08518e upstream.
This patch validate session id and tree id in compound request. If first operation in the compound is SMB2 ECHO request, ksmbd bypass session and tree validation. So work->sess and work->tcon could be NULL. If secound request in the compound access work->sess or tcon, It cause NULL pointer dereferecing error.
--- fs/ksmbd/server.c | 33 ++++++++++++++++++++------------- fs/ksmbd/smb2pdu.c | 44 +++++++++++++++++++++++++++++++++++++++----- 2 files changed, 59 insertions(+), 18 deletions(-)
fs/ksmbd/server.c +20 -13
@@ -185,24 +185,31 @@ static void __handle_ksmbd_work(struct k goto send; } -if (conn->ops->check_user_session) { - rc = conn->ops->check_user_session (work); -if (rc <0 ) { - command = conn->ops->get_cmd_val (work); - conn->ops->set_rsp_status (work, -STATUS_USER_SESSION_DELETED ); - goto send; - }else if (rc >0 ) { - rc = conn->ops->get_ksmbd_tcon (work); + do { + if (conn->ops->check_user_session) { + rc = conn->ops->check_user_session(work); if (rc < 0) { - conn->ops->set_rsp_status (work, -STATUS_NETWORK_NAME_DELETED ); + if (rc == -EINVAL) + conn->ops->set_rsp_status(work, + STATUS_INVALID_PARAMETER); + else + conn->ops->set_rsp_status(work, + STATUS_USER_SESSION_DELETED); goto send; + } else if (rc > 0) { + rc = conn->ops->get_ksmbd_tcon(work); + if (rc < 0) { + if (rc == -EINVAL) + conn->ops->set_rsp_status(work, + STATUS_INVALID_PARAMETER); + else + conn->ops->set_rsp_status(work, + STATUS_NETWORK_NAME_DELETED); + goto send; + } } } - } - do { rc = __process_request(work, conn, &command); if (rc == SERVER_HANDLER_ABORT) break;
fs/ksmbd/smb2pdu.c +39 -5
78 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 13/170 tick/common: Align tick period during sched_timer setup
In reply to Greg Kroah-HartmanFrom: Thomas Gleixner <[email protected]>
commit 13bb06f8dd42071cb9a49f6e21099eea05d4b856 upstream.
The tick period is aligned very early while the first clock_event_device is registered. At that point the system runs in periodic mode and switches later to one-shot mode if possible.
The next wake-up event is programmed based on the aligned value (tick_next_period) but the delta value, that is used to program the clock_event_device, is computed based on ktime_get().
With the subtracted offset, the device fires earlier than the exact time frame. With a large enough offset the system programs the timer for the next wake-up and the remaining time left is too small to make any boot progress. The system hangs.
Move the alignment later to the setup of tick_sched timer. At this point the system switches to oneshot mode and a high resolution clocksource is available. At this point it is safe to align tick_next_period because ktime_get() will now return accurate (not jiffies based) time.
[bigeasy: Patch description + testing].
--- kernel/time/tick-common.c | 13 +------------ kernel/time/tick-sched.c | 13 ++++++++++++- 2 files changed, 13 insertions(+), 13 deletions(-)
kernel/time/tick-common.c +1 -12
@@ -218,19 +218,8 @@ static void tick_setup_device(struct tic* this cpu: */ if (tick_do_timer_cpu ==TICK_DO_TIMER_BOOT ) { -ktime_t next_p; -u32 rem; - tick_do_timer_cpu = cpu; - - next_p =ktime_get (); -div_u64_rem (next_p,TICK_NSEC , &rem); -if (rem) { - next_p -= rem; - next_p +=TICK_NSEC ; - } - - tick_next_period = next_p; + tick_next_period =ktime_get ();#ifdef CONFIG_NO_HZ_FULL /* * The boot CPU may be nohz_full, in which case set
kernel/time/tick-sched.c +12 -1
@@ -161,8 +161,19 @@ static ktime_t tick_init_jiffy_update(voraw_spin_lock (&jiffies_lock);write_seqcount_begin (&jiffies_seq);/* Did we start the jiffies update yet ? */ -if (last_jiffies_update ==0 ) +if (last_jiffies_update ==0 ) { +u32 rem; + +/* +* Ensure that the tick is aligned to a multiple of +* TICK_NSEC. +*/ +div_u64_rem (tick_next_period,TICK_NSEC , &rem); +if (rem) + tick_next_period +=TICK_NSEC - rem; + last_jiffies_update = tick_next_period; + } period = last_jiffies_update;write_seqcount_end (&jiffies_seq);raw_spin_unlock (&jiffies_lock);
Greg Kroah-Hartman
maintainerPATCH 14/170 selftests: mptcp: remove duplicated entries in usage
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit 0a85264e48b642d360720589fdb837a3643fb9b0 upstream.
mptcp_connect tool was printing some duplicated entries when showing how to use it: -j -l -r
While at it, I also:
- moved the very few entries that were not sorted,
- added -R that was missing since
commit 8a4b910d005d ("mptcp: selftests: add rcvbuf set option"),
- removed the -u parameter that has been removed in
commit f730b65c9d85 ("selftests: mptcp: try to set mptcp ulp mode in different sk states").
No need to backport this, it is just an internal tool used by our selftests. The help menu is mainly useful for MPTCP kernel devs.
--- tools/testing/selftests/net/mptcp/mptcp_connect.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_connect.c +4 -4
@@ -98,8 +98,8 @@ static struct cfg_sockopt_types cfg_sockstatic void die_usage (void ) {fprintf (stderr,"Usage: mptcp_connect [-6] [-c cmsg] [-f offset] [-i file] [-I num] [-j] [-l] " -"[-m mode] [-M mark] [-o option] [-p port] [-P mode] [-j] [-l] [-r num] " -"[-s MPTCP|TCP] [-S num] [-r num] [-t num] [-T num] [-u] [-w sec] connect_address\n" ); +"[-m mode] [-M mark] [-o option] [-p port] [-P mode] [-r num] [-R num] " +"[-s MPTCP|TCP] [-S num] [-t num] [-T num] [-w sec] connect_address\n" );fprintf (stderr,"\t-6 use ipv6\n" );fprintf (stderr,"\t-c cmsg -- test cmsg type <cmsg>\n" ); fprintf(stderr, "\t-f offset -- stop the I/O after receiving and sending the specified amount "
@@ -118,13 +118,13 @@ static void die_usage(void)fprintf (stderr,"\t-p num -- use port num\n" );fprintf (stderr,"\t-P [saveWithPeek|saveAfterPeek] -- save data with/after MSG_PEEK form tcp socket\n" ); -fprintf (stderr,"\t-t num -- set poll timeout to num\n" ); -fprintf (stderr,"\t-T num -- set expected runtime to num ms\n" );fprintf (stderr,"\t-r num -- enable slow mode, limiting each write to num bytes " "-- for remove addr tests\n" );fprintf (stderr,"\t-R num -- set SO_RCVBUF to num\n" );fprintf (stderr,"\t-s [MPTCP|TCP] -- use mptcp(default) or tcp sockets\n" );fprintf (stderr,"\t-S num -- set SO_SNDBUF to num\n" ); +fprintf (stderr,"\t-t num -- set poll timeout to num\n" ); +fprintf (stderr,"\t-T num -- set expected runtime to num ms\n" );fprintf (stderr,"\t-w num -- wait num sec before closing the socket\n" );exit (1 ); }
Greg Kroah-Hartman
maintainerPATCH 15/170 selftests: mptcp: join: fix ShellCheck warnings
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit 0fcd72df8847d3a62eb34a084862157ce0564a94 upstream.
Most of the code had an issue according to ShellCheck.
That's mainly due to the fact it incorrectly believes most of the code was unreachable because it's invoked by variable name, see how the "tests" array is used.
Once SC2317 has been ignored, three small warnings were still visible:
- SC2155: Declare and assign separately to avoid masking return values.
- SC2046: Quote this to prevent word splitting: can be ignored because "ip netns pids" can display more than one pid.
- SC2166: Prefer [ p ] || [ q ] as [ p -o q ] is not well defined.
This probably didn't fix any actual issues but it might help spotting new interesting warnings reported by ShellCheck as just before, ShellCheck was reporting issues for most lines making it a bit useless.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +8 -2
@@ -8,6 +8,10 @@ . "$(dirname "${0}")/mptcp_lib.sh" +# ShellCheck incorrectly believes that most of the code here is unreachable +# because it's invoked by variable name, see how the "tests" array is used +#shellcheck disable=SC2317 + ret=0 sin="" sinfail=""
@@ -357,8 +361,9 @@ check_transfer() local line if [ -n "$bytes" ]; then + local out_size # when truncating we must check the size explicitly - local out_size=$(wc -c $out | awk '{print $1}') + out_size=$(wc -c $out | awk '{print $1}') if [ $out_size -ne $bytes ]; then echo "[ FAIL ] $what output file has wrong size ($out_size, $bytes)" fail_test
@@ -487,6 +492,7 @@ kill_wait() kill_tests_wait() { + #shellcheck disable=SC2046 kill -SIGUSR1 $(ip netns pids $ns2) $(ip netns pids $ns1) wait }
@@ -1726,7 +1732,7 @@ chk_subflow_nr() cnt1=$(ss -N $ns1 -tOni | grep -c token) cnt2=$(ss -N $ns2 -tOni | grep -c token) - if [ "$cnt1" != "$subflow_nr" -o "$cnt2" != "$subflow_nr" ]; then + if [ "$cnt1" != "$subflow_nr" ] || [ "$cnt2" != "$subflow_nr" ]; then echo "[fail] got $cnt1:$cnt2 subflows expected $subflow_nr" fail_test dump_stats=1
Greg Kroah-Hartman
maintainerPATCH 16/170 selftests: mptcp: lib: skip if missing symbol
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit 673004821ab98c6645bd21af56a290854e88f533 upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features.
New functions are now available to easily detect if a certain feature is missing by looking at kallsyms.
These new helpers are going to be used in the following commits. In order to ease the backport of such future patches, it would be good if this patch is backported up to the introduction of MPTCP selftests, hence the Fixes tag below: this type of check was supposed to be done from the beginning.
--- tools/testing/selftests/net/mptcp/config | 1 tools/testing/selftests/net/mptcp/mptcp_lib.sh | 38 +++++++++++++++++++++++++ 2 files changed, 39 insertions(+)
tools/testing/selftests/net/mptcp/config +1 -0
@@ -1,3 +1,4 @@ +CONFIG_KALLSYMS=y CONFIG_MPTCP=y CONFIG_IPV6=y CONFIG_MPTCP_IPV6=y
tools/testing/selftests/net/mptcp/mptcp_lib.sh +38 -0
@@ -38,3 +38,41 @@ mptcp_lib_check_mptcp() { exit ${KSFT_SKIP} fi } + +mptcp_lib_check_kallsyms() { + if ! mptcp_lib_has_file "/proc/kallsyms"; then + echo "SKIP: CONFIG_KALLSYMS is missing" + exit ${KSFT_SKIP} + fi +} + +# Internal: use mptcp_lib_kallsyms_has() instead +__mptcp_lib_kallsyms_has() { + local sym="${1}" + + mptcp_lib_check_kallsyms + + grep -q " ${sym}" /proc/kallsyms +} + +# $1: part of a symbol to look at, add '$' at the end for full name +mptcp_lib_kallsyms_has() { + local sym="${1}" + + if __mptcp_lib_kallsyms_has "${sym}"; then + return 0 + fi + + mptcp_lib_fail_if_expected_feature "${sym} symbol not found" +} + +# $1: part of a symbol to look at, add '$' at the end for full name +mptcp_lib_kallsyms_doesnt_have() { + local sym="${1}" + + if ! __mptcp_lib_kallsyms_has "${sym}"; then + return 0 + fi + + mptcp_lib_fail_if_expected_feature "${sym} symbol has been found" +}
Greg Kroah-Hartman
maintainerPATCH 17/170 selftests: mptcp: connect: skip transp tests if not supported
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit 07bf49401909264a38fa3427c3cce43e8304436a upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features.
One of them is the support of IP(V6)_TRANSPARENT socket option with MPTCP connections introduced by commit c9406a23c116 ("mptcp: sockopt:
add SOL_IP freebind & transparent options").
It is possible to look for "__ip_sock_set_tos" in kallsyms because IP(V6)_TRANSPARENT socket option support has been added after TOS support which came with the required infrastructure in MPTCP sockopt code. To support TOS, the following function has been exported (T). Not great but better than checking for a specific kernel version.
--- tools/testing/selftests/net/mptcp/mptcp_connect.sh | 10 ++++++++++ 1 file changed, 10 insertions(+)
tools/testing/selftests/net/mptcp/mptcp_connect.sh +10 -0
@@ -144,6 +144,7 @@ cleanup() } mptcp_lib_check_mptcp +mptcp_lib_check_kallsyms ip -Version > /dev/null 2>&1 if [ $? -ne 0 ];then
@@ -696,6 +697,15 @@ run_test_transparent() return 0 fi + # IP(V6)_TRANSPARENT has been added after TOS support which came with + # the required infrastructure in MPTCP sockopt code. To support TOS, the + # following function has been exported (T). Not great but better than + # checking for a specific kernel version. + if ! mptcp_lib_kallsyms_has "T __ip_sock_set_tos$"; then + echo "INFO: ${msg} not supported by the kernel: SKIP" + return + fi + ip netns exec "$listener_ns" nft -f /dev/stdin <<"EOF" flush ruleset table inet mangle {
Greg Kroah-Hartman
maintainerPATCH 18/170 selftests: mptcp: connect: skip disconnect tests if not supported
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit 4ad39a42da2e9770c8e4c37fe632ed8898419129 upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features.
One of them is the full support of disconnections from the userspace introduced by commit b29fcfb54cd7 ("mptcp: full disconnect implementation").
It is possible to look for "mptcp_pm_data_reset" in kallsyms because a preparation patch added it to ease the introduction of the mentioned feature.
--- tools/testing/selftests/net/mptcp/mptcp_connect.sh | 5 +++++ 1 file changed, 5 insertions(+)
tools/testing/selftests/net/mptcp/mptcp_connect.sh +5 -0
@@ -782,6 +782,11 @@ run_tests_disconnect() local old_cin=$cin local old_sin=$sin + if ! mptcp_lib_kallsyms_has "mptcp_pm_data_reset$"; then + echo "INFO: Full disconnect not supported: SKIP" + return + fi + cat $cin $cin $cin > "$cin".disconnect # force do_transfer to cope with the multiple tranmissions
Greg Kroah-Hartman
maintainerPATCH 19/170 selftests: mptcp: pm nl: remove hardcoded default limits
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit 2177d0b08e421971e035672b70f3228d9485c650 upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features.
One of them is the checks of the default limits returned by the MPTCP in-kernel path-manager. The default values have been modified by commit 72bcbc46a5c3 ("mptcp: increase default max additional subflows to 2"). Instead of comparing with hardcoded values, we can get the default one and compare with them.
Note that if we expect to have the latest version, we continue to check the hardcoded values to avoid unexpected behaviour changes.
--- tools/testing/selftests/net/mptcp/pm_netlink.sh | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
tools/testing/selftests/net/mptcp/pm_netlink.sh +7 -5
@@ -73,8 +73,12 @@ check() } check "ip netns exec $ns1 ./pm_nl_ctl dump" "" "defaults addr list" -check "ip netns exec $ns1 ./pm_nl_ctl limits" "accept 0 + +default_limits="$(ip netns exec $ns1 ./pm_nl_ctl limits)" +if mptcp_lib_expect_all_features; then + check "ip netns exec $ns1 ./pm_nl_ctl limits" "accept 0 subflows 2" "defaults limits" +fi ip netns exec $ns1 ./pm_nl_ctl add 10.0.1.1 ip netns exec $ns1 ./pm_nl_ctl add 10.0.1.2 flags subflow dev lo
@@ -121,12 +125,10 @@ ip netns exec $ns1 ./pm_nl_ctl flush check "ip netns exec $ns1 ./pm_nl_ctl dump" "" "flush addrs" ip netns exec $ns1 ./pm_nl_ctl limits 9 1 -check "ip netns exec $ns1 ./pm_nl_ctl limits" "accept 0 -subflows 2" "rcv addrs above hard limit" +check "ip netns exec $ns1 ./pm_nl_ctl limits" "$default_limits" "rcv addrs above hard limit" ip netns exec $ns1 ./pm_nl_ctl limits 1 9 -check "ip netns exec $ns1 ./pm_nl_ctl limits" "accept 0 -subflows 2" "subflows above hard limit" +check "ip netns exec $ns1 ./pm_nl_ctl limits" "$default_limits" "subflows above hard limit" ip netns exec $ns1 ./pm_nl_ctl limits 8 8 check "ip netns exec $ns1 ./pm_nl_ctl limits" "accept 8
Greg Kroah-Hartman
maintainerPATCH 20/170 selftests: mptcp: pm nl: skip fullmesh flag checks if not supported
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit f3761b50b8e4cb4807b5d41e02144c8c8a0f2512 upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features.
One of them is the fullmesh flag that can be given to the MPTCP in-kernel path-manager and introduced in commit 2843ff6f36db ("mptcp:
remote addresses fullmesh").
If the flag is not visible in the dump after having set it, we don't check the content. Note that if we expect to have this feature and SELFTESTS_MPTCP_LIB_EXPECT_ALL_FEATURES env var is set to 1, we always check the content to avoid regressions.
--- tools/testing/selftests/net/mptcp/pm_netlink.sh | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
tools/testing/selftests/net/mptcp/pm_netlink.sh +10 -5
@@ -178,14 +178,19 @@ subflow,backup 10.0.1.1" "set flags (backup)" ip netns exec $ns1 ./pm_nl_ctl set 10.0.1.1 flags nobackup check "ip netns exec $ns1 ./pm_nl_ctl dump" "id 1 flags \ subflow 10.0.1.1" " (nobackup)" + +# fullmesh support has been added later ip netns exec $ns1 ./pm_nl_ctl set id 1 flags fullmesh -check "ip netns exec $ns1 ./pm_nl_ctl dump" "id 1 flags \ +if ip netns exec $ns1 ./pm_nl_ctl dump | grep -q "fullmesh" || + mptcp_lib_expect_all_features; then + check "ip netns exec $ns1 ./pm_nl_ctl dump" "id 1 flags \ subflow,fullmesh 10.0.1.1" " (fullmesh)" -ip netns exec $ns1 ./pm_nl_ctl set id 1 flags nofullmesh -check "ip netns exec $ns1 ./pm_nl_ctl dump" "id 1 flags \ + ip netns exec $ns1 ./pm_nl_ctl set id 1 flags nofullmesh + check "ip netns exec $ns1 ./pm_nl_ctl dump" "id 1 flags \ subflow 10.0.1.1" " (nofullmesh)" -ip netns exec $ns1 ./pm_nl_ctl set id 1 flags backup,fullmesh -check "ip netns exec $ns1 ./pm_nl_ctl dump" "id 1 flags \ + ip netns exec $ns1 ./pm_nl_ctl set id 1 flags backup,fullmesh + check "ip netns exec $ns1 ./pm_nl_ctl dump" "id 1 flags \ subflow,backup,fullmesh 10.0.1.1" " (backup,fullmesh)" +fi exit $ret
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 21/170 selftests: mptcp: sockopt: relax expected returned size
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit 8dee6ca2ac1e5630a7bb6a98bc0b686916fc2000 upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features.
One of them is the getsockopt(SOL_MPTCP) to get info about the MPTCP connections introduced by commit 55c42fa7fa33 ("mptcp: add MPTCP_INFO getsockopt") and the following ones.
We cannot guess in advance which sizes the kernel will returned: older kernel can returned smaller sizes, e.g. recently the tcp_info structure has been modified in commit 71fc704768f6 ("tcp: add rcv_wnd and plb_rehash to TCP_INFO") where a new field has been added.
The userspace can also expect a smaller size if it is compiled with old uAPI kernel headers.
So for these sizes, we can only check if they are above a certain threshold, 0 for the moment. We can also only compared sizes with the ones set by the kernel.
--- .../selftests/net/mptcp/mptcp_sockopt.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_sockopt.c +12 -6
@@ -87,6 +87,10 @@ struct so_state {uint64_t tcpi_rcv_delta; }; +#ifndef MIN +#define MIN (a, b) ((a) < (b) ? (a) : (b)) +#endif +static void die_perror (const char *msg) {perror (msg);
@@ -349,13 +353,14 @@ static void do_getsockopt_tcp_info(struct so_state *s, int fd, size_t r, size_txerror ("getsockopt MPTCP_TCPINFO (tries %d, %m)" );assert (olen <=sizeof (ti)); -assert (ti.d.size_user == ti.d.size_kernel); -assert (ti.d.size_user ==sizeof (struct tcp_info )); +assert (ti.d.size_kernel >0 ); +assert (ti.d.size_user == +MIN (ti.d.size_kernel,sizeof (struct tcp_info )));assert (ti.d.num_subflows ==1 );assert (olen > (socklen_t )sizeof (struct mptcp_subflow_data )); olen -=sizeof (struct mptcp_subflow_data ); -assert (olen ==sizeof (struct tcp_info )); +assert (olen == ti.d.size_user);if (ti.ti[0 ].tcpi_bytes_sent == w && ti.ti[0 ].tcpi_bytes_received == r)
@@ -401,13 +406,14 @@ static void do_getsockopt_subflow_addrs(int fd)die_perror ("getsockopt MPTCP_SUBFLOW_ADDRS" );assert (olen <=sizeof (addrs)); -assert (addrs.d.size_user == addrs.d.size_kernel); -assert (addrs.d.size_user ==sizeof (struct mptcp_subflow_addrs )); +assert (addrs.d.size_kernel >0 ); +assert (addrs.d.size_user == +MIN (addrs.d.size_kernel,sizeof (struct mptcp_subflow_addrs )));assert (addrs.d.num_subflows ==1 );assert (olen > (socklen_t )sizeof (struct mptcp_subflow_data )); olen -=sizeof (struct mptcp_subflow_data ); -assert (olen ==sizeof (struct mptcp_subflow_addrs )); +assert (olen == addrs.d.size_user); llen =sizeof (local); ret =getsockname (fd, (struct sockaddr *)&local, &llen);
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 22/170 selftests: mptcp: sockopt: skip getsockopt checks if not supported
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit c6f7eccc519837ebde1d099d9610c4f1d5bd975e upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features.
One of them is the getsockopt(SOL_MPTCP) to get info about the MPTCP connections introduced by commit 55c42fa7fa33 ("mptcp: add MPTCP_INFO getsockopt") and the following ones.
It is possible to look for "mptcp_diag_fill_info" in kallsyms because it is introduced by the mentioned feature. So we can know in advance if the feature is supported and skip the sub-test if not.
--- tools/testing/selftests/net/mptcp/mptcp_sockopt.sh | 6 ++++++ 1 file changed, 6 insertions(+)
tools/testing/selftests/net/mptcp/mptcp_sockopt.sh +6 -0
@@ -84,6 +84,7 @@ cleanup() } mptcp_lib_check_mptcp +mptcp_lib_check_kallsyms ip -Version > /dev/null 2>&1 if [ $? -ne 0 ];then
@@ -248,6 +249,11 @@ do_mptcp_sockopt_tests() { local lret=0 + if ! mptcp_lib_kallsyms_has "mptcp_diag_fill_info$"; then + echo "INFO: MPTCP sockopt not supported: SKIP" + return + fi + ip netns exec "$ns_sbox" ./mptcp_sockopt lret=$?
Greg Kroah-Hartman
maintainerPATCH 23/170 selftests: mptcp: userspace pm: skip if ip tool is unavailable
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit 723d6b9b12338c1caf06bf6fe269962ef04e2c71 upstream.
When a required tool is missing, the return code 4 (SKIP) should be returned instead of 1 (FAIL).
--- tools/testing/selftests/net/mptcp/userspace_pm.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/mptcp/userspace_pm.sh +1 -1
@@ -8,7 +8,7 @@ mptcp_lib_check_mptcp ip -Version > /dev/null 2>&1 if [ $? -ne 0 ];then echo "SKIP: Cannot not run test without ip tool" - exit 1 + exit ${KSFT_SKIP} fi ANNOUNCED=6 # MPTCP_EVENT_ANNOUNCED
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 24/170 selftests: mptcp: userspace pm: skip if not supported
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit f90adb033891d418c5dafef34a9aa49f3c860991 upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features.
One of them is the MPTCP Userspace PM introduced by commit 4638de5aefe5 ("mptcp: handle local addrs announced by userspace PMs").
We can skip all these tests if the feature is not supported simply by looking for the MPTCP pm_type's sysctl knob.
--- tools/testing/selftests/net/mptcp/userspace_pm.sh | 5 +++++ 1 file changed, 5 insertions(+)
tools/testing/selftests/net/mptcp/userspace_pm.sh +5 -0
@@ -5,6 +5,11 @@ mptcp_lib_check_mptcp +if ! mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then + echo "userspace pm tests are not supported by the kernel: SKIP" + exit ${KSFT_SKIP} +fi + ip -Version > /dev/null 2>&1 if [ $? -ne 0 ];then echo "SKIP: Cannot not run test without ip tool"
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 25/170 selftests: mptcp: lib: skip if not below kernel version
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit b1a6a38ab8a633546cefae890da842f19e006c74 upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features.
A new function is now available to easily detect if a feature is missing by looking at the kernel version. That's clearly not ideal and this kind of check should be avoided as soon as possible. But sometimes, there are no external sign that a "feature" is available or not:
internal behaviours can change without modifying the uAPI and these selftests are verifying the internal behaviours. Sometimes, the only (easy) way to verify if the feature is present is to run the test but then the validation cannot determine if there is a failure with the feature or if the feature is missing. Then it looks better to check the kernel version instead of having tests that can never fail. In any case, we need a solution not to have a whole selftest being marked as failed just because one sub-test has failed.
Note that this env var car be set to 1 not to do such check and run the linked sub-test: SELFTESTS_MPTCP_LIB_NO_KVERSION_CHECK.
This new helper is going to be used in the following commits. In order to ease the backport of such future patches, it would be good if this patch is backported up to the introduction of MPTCP selftests, hence the Fixes tag below: this type of check was supposed to be done from the beginning.
--- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 26 +++++++++++++++++++++++++ 1 file changed, 26 insertions(+)
tools/testing/selftests/net/mptcp/mptcp_lib.sh +26 -0
@@ -76,3 +76,29 @@ mptcp_lib_kallsyms_doesnt_have() { mptcp_lib_fail_if_expected_feature "${sym} symbol has been found" } + +# !!!AVOID USING THIS!!! +# Features might not land in the expected version and features can be backported +# +# $1: kernel version, e.g. 6.3 +mptcp_lib_kversion_ge() { + local exp_maj="${1%.*}" + local exp_min="${1#*.}" + local v maj min + + # If the kernel has backported features, set this env var to 1: + if [ "${SELFTESTS_MPTCP_LIB_NO_KVERSION_CHECK:-}" = "1" ]; then + return 0 + fi + + v=$(uname -r | cut -d'.' -f1,2) + maj=${v%.*} + min=${v#*.} + + if [ "${maj}" -gt "${exp_maj}" ] || + { [ "${maj}" -eq "${exp_maj}" ] && [ "${min}" -ge "${exp_min}" ]; }; then + return 0 + fi + + mptcp_lib_fail_if_expected_feature "kernel version ${1} lower than ${v}" +}
Greg Kroah-Hartman
maintainerPATCH 26/170 selftests: mptcp: join: use iptables-legacy if available
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit 0c4cd3f86a40028845ad6f8af5b37165666404cd upstream.
IPTables commands using 'iptables-nft' fail on old kernels, at least 5.15 because it doesn't see the default IPTables chains:
$ iptables -L iptables/1.8.2 Failed to initialize nft: Protocol not supported
As a first step before switching to NFTables, we can use iptables-legacy if available.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +12 -6
@@ -25,6 +25,8 @@ capout="" ns1="" ns2="" ksft_skip=4 +iptables="iptables" +ip6tables="ip6tables" timeout_poll=30 timeout_test=$((timeout_poll * 2 + 1)) capture=0
@@ -141,7 +143,11 @@ check_tools() exit $ksft_skip fi - if ! iptables -V &> /dev/null; then + # Use the legacy version if available to support old kernel versions + if iptables-legacy -V &> /dev/null; then + iptables="iptables-legacy" + ip6tables="ip6tables-legacy" + elif ! iptables -V &> /dev/null; then echo "SKIP: Could not run all tests without iptables tool" exit $ksft_skip fi
@@ -239,9 +245,9 @@ reset_with_add_addr_timeout() reset "${1}" || return 1 - tables="iptables" + tables="${iptables}" if [ $ip -eq 6 ]; then - tables="ip6tables" + tables="${ip6tables}" fi ip netns exec $ns1 sysctl -q net.mptcp.add_addr_timeout=1
@@ -306,9 +312,9 @@ reset_with_fail() local ip="${3:-4}" local tables - tables="iptables" + tables="${iptables}" if [ $ip -eq 6 ]; then - tables="ip6tables" + tables="${ip6tables}" fi ip netns exec $ns2 $tables \
@@ -678,7 +684,7 @@ filter_tcp_from() local src="${2}" local target="${3}" - ip netns exec "${ns}" iptables -A INPUT -s "${src}" -p tcp -j "${target}" + ip netns exec "${ns}" ${iptables} -A INPUT -s "${src}" -p tcp -j "${target}" } do_transfer()
Greg Kroah-Hartman
maintainerPATCH 27/170 selftests: mptcp: join: helpers to skip tests
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit cdb50525345cf5a8359ee391032ef606a7826f08 upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features.
Here are some helpers that will be used to mark subtests as skipped if a feature is not supported. Marking as a fix for the commit introducing this selftest to help with the backports.
While at it, also check if kallsyms feature is available as it will also be used in the following commits to check if MPTCP features are available before starting a test.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 27 ++++++++++++++++++++++++ 1 file changed, 27 insertions(+)
tools/testing/selftests/net/mptcp/mptcp_join.sh +27 -0
@@ -137,6 +137,7 @@ cleanup_partial() check_tools() { mptcp_lib_check_mptcp + mptcp_lib_check_kallsyms if ! ip -Version &> /dev/null; then echo "SKIP: Could not run test without ip tool"
@@ -183,6 +184,32 @@ cleanup() cleanup_partial } +# $1: msg +print_title() +{ + printf "%03u %-36s %s" "${TEST_COUNT}" "${TEST_NAME}" "${1}" +} + +# [ $1: fail msg ] +mark_as_skipped() +{ + local msg="${1:-"Feature not supported"}" + + mptcp_lib_fail_if_expected_feature "${msg}" + + print_title "[ skip ] ${msg}" + printf "\n" +} + +# $@: condition +continue_if() +{ + if ! "${@}"; then + mark_as_skipped + return 1 + fi +} + skip_test() { if [ "${#only_tests_ids[@]}" -eq 0 ] && [ "${#only_tests_names[@]}" -eq 0 ]; then
Greg Kroah-Hartman
maintainerPATCH 28/170 selftests: mptcp: join: skip check if MIB counter not supported
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit 47867f0a7e831e24e5eab3330667ce9682d50fb1 upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features.
One of them is the MPTCP MIB counters introduced in commit fc518953bc9c ("mptcp: add and use MIB counter infrastructure") and more later. The MPTCP Join selftest heavily relies on these counters.
If a counter is not supported by the kernel, it is not displayed when using 'nstat -z'. We can then detect that and skip the verification. A new helper (get_counter()) has been added to do the required checks and return an error if the counter is not available.
Note that if we expect to have these features available and if SELFTESTS_MPTCP_LIB_EXPECT_ALL_FEATURES env var is set to 1, the tests will be marked as failed instead of skipped.
This new helper also makes sure we get the exact counter we want to avoid issues we had in the past, e.g. with MPTcpExtRmAddr and MPTcpExtRmAddrDrop sharing the same prefix. While at it, we uniform the way we fetch a MIB counter.
Note for the backports: we rarely change these modified blocks so if there is are conflicts, it is very likely because a counter is not used in the older kernels and we don't need that chunk.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 230 +++++++++++++----------- 1 file changed, 130 insertions(+), 100 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +130 -100
@@ -480,11 +480,25 @@ wait_local_port_listen() done } -rm_addr_count() +# $1: ns ; $2: counter +get_counter() { - local ns=${1} + local ns="${1}" + local counter="${2}" + local count + + count=$(ip netns exec ${ns} nstat -asz "${counter}" | awk 'NR==1 {next} {print $2}') + if [ -z "${count}" ]; then + mptcp_lib_fail_if_expected_feature "${counter} counter" + return 1 + fi - ip netns exec ${ns} nstat -as | grep MPTcpExtRmAddr | awk '{print $2}' + echo "${count}" +} + +rm_addr_count() +{ + get_counter "${1}" "MPTcpExtRmAddr" } # $1: ns, $2: old rm_addr counter in $ns
@@ -507,11 +521,11 @@ wait_mpj() local ns="${1}" local cnt old_cnt - old_cnt=$(ip netns exec ${ns} nstat -as | grep MPJoinAckRx | awk '{print $2}') + old_cnt=$(get_counter ${ns} "MPTcpExtMPJoinAckRx") local i for i in $(seq 10); do - cnt=$(ip netns exec ${ns} nstat -as | grep MPJoinAckRx | awk '{print $2}') + cnt=$(get_counter ${ns} "MPTcpExtMPJoinAckRx") [ "$cnt" = "${old_cnt}" ] || break sleep 0.1 done
@@ -1191,12 +1205,13 @@ chk_csum_nr() fi printf "%-${nr_blank}s %s" " " "sum" - count=$(ip netns exec $ns1 nstat -as | grep MPTcpExtDataCsumErr | awk '{print $2}') - [ -z "$count" ] && count=0 + count=$(get_counter ${ns1} "MPTcpExtDataCsumErr") if [ "$count" != "$csum_ns1" ]; then extra_msg="$extra_msg ns1=$count" fi - if { [ "$count" != $csum_ns1 ] && [ $allow_multi_errors_ns1 -eq 0 ]; } || + if [ -z "$count" ]; then + echo -n "[skip]" + elif { [ "$count" != $csum_ns1 ] && [ $allow_multi_errors_ns1 -eq 0 ]; } || { [ "$count" -lt $csum_ns1 ] && [ $allow_multi_errors_ns1 -eq 1 ]; }; then echo "[fail] got $count data checksum error[s] expected $csum_ns1" fail_test
@@ -1205,12 +1220,13 @@ chk_csum_nr() echo -n "[ ok ]" fi echo -n " - csum " - count=$(ip netns exec $ns2 nstat -as | grep MPTcpExtDataCsumErr | awk '{print $2}') - [ -z "$count" ] && count=0 + count=$(get_counter ${ns2} "MPTcpExtDataCsumErr") if [ "$count" != "$csum_ns2" ]; then extra_msg="$extra_msg ns2=$count" fi - if { [ "$count" != $csum_ns2 ] && [ $allow_multi_errors_ns2 -eq 0 ]; } || + if [ -z "$count" ]; then + echo -n "[skip]" + elif { [ "$count" != $csum_ns2 ] && [ $allow_multi_errors_ns2 -eq 0 ]; } || { [ "$count" -lt $csum_ns2 ] && [ $allow_multi_errors_ns2 -eq 1 ]; }; then echo "[fail] got $count data checksum error[s] expected $csum_ns2" fail_test
@@ -1252,12 +1268,13 @@ chk_fail_nr() fi printf "%-${nr_blank}s %s" " " "ftx" - count=$(ip netns exec $ns_tx nstat -as | grep MPTcpExtMPFailTx | awk '{print $2}') - [ -z "$count" ] && count=0 + count=$(get_counter ${ns_tx} "MPTcpExtMPFailTx") if [ "$count" != "$fail_tx" ]; then extra_msg="$extra_msg,tx=$count" fi - if { [ "$count" != "$fail_tx" ] && [ $allow_tx_lost -eq 0 ]; } || + if [ -z "$count" ]; then + echo -n "[skip]" + elif { [ "$count" != "$fail_tx" ] && [ $allow_tx_lost -eq 0 ]; } || { [ "$count" -gt "$fail_tx" ] && [ $allow_tx_lost -eq 1 ]; }; then echo "[fail] got $count MP_FAIL[s] TX expected $fail_tx" fail_test
@@ -1267,12 +1284,13 @@ chk_fail_nr() fi echo -n " - failrx" - count=$(ip netns exec $ns_rx nstat -as | grep MPTcpExtMPFailRx | awk '{print $2}') - [ -z "$count" ] && count=0 + count=$(get_counter ${ns_rx} "MPTcpExtMPFailRx") if [ "$count" != "$fail_rx" ]; then extra_msg="$extra_msg,rx=$count" fi - if { [ "$count" != "$fail_rx" ] && [ $allow_rx_lost -eq 0 ]; } || + if [ -z "$count" ]; then + echo -n "[skip]" + elif { [ "$count" != "$fail_rx" ] && [ $allow_rx_lost -eq 0 ]; } || { [ "$count" -gt "$fail_rx" ] && [ $allow_rx_lost -eq 1 ]; }; then echo "[fail] got $count MP_FAIL[s] RX expected $fail_rx" fail_test
@@ -1304,10 +1322,11 @@ chk_fclose_nr() fi printf "%-${nr_blank}s %s" " " "ctx" - count=$(ip netns exec $ns_tx nstat -as | grep MPTcpExtMPFastcloseTx | awk '{print $2}') - [ -z "$count" ] && count=0 - [ "$count" != "$fclose_tx" ] && extra_msg="$extra_msg,tx=$count" - if [ "$count" != "$fclose_tx" ]; then + count=$(get_counter ${ns_tx} "MPTcpExtMPFastcloseTx") + if [ -z "$count" ]; then + echo -n "[skip]" + elif [ "$count" != "$fclose_tx" ]; then + extra_msg="$extra_msg,tx=$count" echo "[fail] got $count MP_FASTCLOSE[s] TX expected $fclose_tx" fail_test dump_stats=1
@@ -1316,10 +1335,11 @@ chk_fclose_nr() fi echo -n " - fclzrx" - count=$(ip netns exec $ns_rx nstat -as | grep MPTcpExtMPFastcloseRx | awk '{print $2}') - [ -z "$count" ] && count=0 - [ "$count" != "$fclose_rx" ] && extra_msg="$extra_msg,rx=$count" - if [ "$count" != "$fclose_rx" ]; then + count=$(get_counter ${ns_rx} "MPTcpExtMPFastcloseRx") + if [ -z "$count" ]; then + echo -n "[skip]" + elif [ "$count" != "$fclose_rx" ]; then + extra_msg="$extra_msg,rx=$count" echo "[fail] got $count MP_FASTCLOSE[s] RX expected $fclose_rx" fail_test dump_stats=1
@@ -1350,9 +1370,10 @@ chk_rst_nr() fi printf "%-${nr_blank}s %s" " " "rtx" - count=$(ip netns exec $ns_tx nstat -as | grep MPTcpExtMPRstTx | awk '{print $2}') - [ -z "$count" ] && count=0 - if [ $count -lt $rst_tx ]; then + count=$(get_counter ${ns_tx} "MPTcpExtMPRstTx") + if [ -z "$count" ]; then + echo -n "[skip]" + elif [ $count -lt $rst_tx ]; then echo "[fail] got $count MP_RST[s] TX expected $rst_tx" fail_test dump_stats=1
@@ -1361,9 +1382,10 @@ chk_rst_nr() fi echo -n " - rstrx " - count=$(ip netns exec $ns_rx nstat -as | grep MPTcpExtMPRstRx | awk '{print $2}') - [ -z "$count" ] && count=0 - if [ "$count" -lt "$rst_rx" ]; then + count=$(get_counter ${ns_rx} "MPTcpExtMPRstRx") + if [ -z "$count" ]; then + echo -n "[skip]" + elif [ "$count" -lt "$rst_rx" ]; then echo "[fail] got $count MP_RST[s] RX expected $rst_rx" fail_test dump_stats=1
@@ -1384,9 +1406,10 @@ chk_infi_nr() local dump_stats printf "%-${nr_blank}s %s" " " "itx" - count=$(ip netns exec $ns2 nstat -as | grep InfiniteMapTx | awk '{print $2}') - [ -z "$count" ] && count=0 - if [ "$count" != "$infi_tx" ]; then + count=$(get_counter ${ns2} "MPTcpExtInfiniteMapTx") + if [ -z "$count" ]; then + echo -n "[skip]" + elif [ "$count" != "$infi_tx" ]; then echo "[fail] got $count infinite map[s] TX expected $infi_tx" fail_test dump_stats=1
@@ -1395,9 +1418,10 @@ chk_infi_nr() fi echo -n " - infirx" - count=$(ip netns exec $ns1 nstat -as | grep InfiniteMapRx | awk '{print $2}') - [ -z "$count" ] && count=0 - if [ "$count" != "$infi_rx" ]; then + count=$(get_counter ${ns1} "MPTcpExtInfiniteMapRx") + if [ -z "$count" ]; then + echo "[skip]" + elif [ "$count" != "$infi_rx" ]; then echo "[fail] got $count infinite map[s] RX expected $infi_rx" fail_test dump_stats=1
@@ -1429,9 +1453,10 @@ chk_join_nr() fi printf "%03u %-36s %s" "${TEST_COUNT}" "${title}" "syn" - count=$(ip netns exec $ns1 nstat -as | grep MPTcpExtMPJoinSynRx | awk '{print $2}') - [ -z "$count" ] && count=0 - if [ "$count" != "$syn_nr" ]; then + count=$(get_counter ${ns1} "MPTcpExtMPJoinSynRx") + if [ -z "$count" ]; then + echo -n "[skip]" + elif [ "$count" != "$syn_nr" ]; then echo "[fail] got $count JOIN[s] syn expected $syn_nr" fail_test dump_stats=1
@@ -1441,9 +1466,10 @@ chk_join_nr() echo -n " - synack" with_cookie=$(ip netns exec $ns2 sysctl -n net.ipv4.tcp_syncookies) - count=$(ip netns exec $ns2 nstat -as | grep MPTcpExtMPJoinSynAckRx | awk '{print $2}') - [ -z "$count" ] && count=0 - if [ "$count" != "$syn_ack_nr" ]; then + count=$(get_counter ${ns2} "MPTcpExtMPJoinSynAckRx") + if [ -z "$count" ]; then + echo -n "[skip]" + elif [ "$count" != "$syn_ack_nr" ]; then # simult connections exceeding the limit with cookie enabled could go up to # synack validation as the conn limit can be enforced reliably only after # the subflow creation
@@ -1459,9 +1485,10 @@ chk_join_nr() fi echo -n " - ack" - count=$(ip netns exec $ns1 nstat -as | grep MPTcpExtMPJoinAckRx | awk '{print $2}') - [ -z "$count" ] && count=0 - if [ "$count" != "$ack_nr" ]; then + count=$(get_counter ${ns1} "MPTcpExtMPJoinAckRx") + if [ -z "$count" ]; then + echo "[skip]" + elif [ "$count" != "$ack_nr" ]; then echo "[fail] got $count JOIN[s] ack expected $ack_nr" fail_test dump_stats=1
@@ -1493,12 +1520,12 @@ chk_stale_nr() local recover_nr printf "%-${nr_blank}s %-18s" " " "stale" - stale_nr=$(ip netns exec $ns nstat -as | grep MPTcpExtSubflowStale | awk '{print $2}') - [ -z "$stale_nr" ] && stale_nr=0 - recover_nr=$(ip netns exec $ns nstat -as | grep MPTcpExtSubflowRecover | awk '{print $2}') - [ -z "$recover_nr" ] && recover_nr=0 - if [ $stale_nr -lt $stale_min ] || + stale_nr=$(get_counter ${ns} "MPTcpExtSubflowStale") + recover_nr=$(get_counter ${ns} "MPTcpExtSubflowRecover") + if [ -z "$stale_nr" ] || [ -z "$recover_nr" ]; then + echo "[skip]" + elif [ $stale_nr -lt $stale_min ] || { [ $stale_max -gt 0 ] && [ $stale_nr -gt $stale_max ]; } || [ $((stale_nr - recover_nr)) -ne $stale_delta ]; then echo "[fail] got $stale_nr stale[s] $recover_nr recover[s], " \
@@ -1534,12 +1561,12 @@ chk_add_nr() timeout=$(ip netns exec $ns1 sysctl -n net.mptcp.add_addr_timeout) printf "%-${nr_blank}s %s" " " "add" - count=$(ip netns exec $ns2 nstat -as MPTcpExtAddAddr | grep MPTcpExtAddAddr | awk '{print $2}') - [ -z "$count" ] && count=0 - + count=$(get_counter ${ns2} "MPTcpExtAddAddr") + if [ -z "$count" ]; then + echo -n "[skip]" # if the test configured a short timeout tolerate greater then expected # add addrs options, due to retransmissions - if [ "$count" != "$add_nr" ] && { [ "$timeout" -gt 1 ] || [ "$count" -lt "$add_nr" ]; }; then + elif [ "$count" != "$add_nr" ] && { [ "$timeout" -gt 1 ] || [ "$count" -lt "$add_nr" ]; }; then echo "[fail] got $count ADD_ADDR[s] expected $add_nr" fail_test dump_stats=1
@@ -1548,9 +1575,10 @@ chk_add_nr() fi echo -n " - echo " - count=$(ip netns exec $ns1 nstat -as | grep MPTcpExtEchoAdd | awk '{print $2}') - [ -z "$count" ] && count=0 - if [ "$count" != "$echo_nr" ]; then + count=$(get_counter ${ns1} "MPTcpExtEchoAdd") + if [ -z "$count" ]; then + echo -n "[skip]" + elif [ "$count" != "$echo_nr" ]; then echo "[fail] got $count ADD_ADDR echo[s] expected $echo_nr" fail_test dump_stats=1
@@ -1560,9 +1588,10 @@ chk_add_nr() if [ $port_nr -gt 0 ]; then echo -n " - pt " - count=$(ip netns exec $ns2 nstat -as | grep MPTcpExtPortAdd | awk '{print $2}') - [ -z "$count" ] && count=0 - if [ "$count" != "$port_nr" ]; then + count=$(get_counter ${ns2} "MPTcpExtPortAdd") + if [ -z "$count" ]; then + echo "[skip]" + elif [ "$count" != "$port_nr" ]; then echo "[fail] got $count ADD_ADDR[s] with a port-number expected $port_nr" fail_test dump_stats=1
@@ -1571,10 +1600,10 @@ chk_add_nr() fi printf "%-${nr_blank}s %s" " " "syn" - count=$(ip netns exec $ns1 nstat -as | grep MPTcpExtMPJoinPortSynRx | - awk '{print $2}') - [ -z "$count" ] && count=0 - if [ "$count" != "$syn_nr" ]; then + count=$(get_counter ${ns1} "MPTcpExtMPJoinPortSynRx") + if [ -z "$count" ]; then + echo -n "[skip]" + elif [ "$count" != "$syn_nr" ]; then echo "[fail] got $count JOIN[s] syn with a different \ port-number expected $syn_nr" fail_test
@@ -1584,10 +1613,10 @@ chk_add_nr() fi echo -n " - synack" - count=$(ip netns exec $ns2 nstat -as | grep MPTcpExtMPJoinPortSynAckRx | - awk '{print $2}') - [ -z "$count" ] && count=0 - if [ "$count" != "$syn_ack_nr" ]; then + count=$(get_counter ${ns2} "MPTcpExtMPJoinPortSynAckRx") + if [ -z "$count" ]; then + echo -n "[skip]" + elif [ "$count" != "$syn_ack_nr" ]; then echo "[fail] got $count JOIN[s] synack with a different \ port-number expected $syn_ack_nr" fail_test
@@ -1597,10 +1626,10 @@ chk_add_nr() fi echo -n " - ack" - count=$(ip netns exec $ns1 nstat -as | grep MPTcpExtMPJoinPortAckRx | - awk '{print $2}') - [ -z "$count" ] && count=0 - if [ "$count" != "$ack_nr" ]; then + count=$(get_counter ${ns1} "MPTcpExtMPJoinPortAckRx") + if [ -z "$count" ]; then + echo "[skip]" + elif [ "$count" != "$ack_nr" ]; then echo "[fail] got $count JOIN[s] ack with a different \ port-number expected $ack_nr" fail_test
@@ -1610,10 +1639,10 @@ chk_add_nr() fi printf "%-${nr_blank}s %s" " " "syn" - count=$(ip netns exec $ns1 nstat -as | grep MPTcpExtMismatchPortSynRx | - awk '{print $2}') - [ -z "$count" ] && count=0 - if [ "$count" != "$mis_syn_nr" ]; then + count=$(get_counter ${ns1} "MPTcpExtMismatchPortSynRx") + if [ -z "$count" ]; then + echo -n "[skip]" + elif [ "$count" != "$mis_syn_nr" ]; then echo "[fail] got $count JOIN[s] syn with a mismatched \ port-number expected $mis_syn_nr" fail_test
@@ -1623,10 +1652,10 @@ chk_add_nr() fi echo -n " - ack " - count=$(ip netns exec $ns1 nstat -as | grep MPTcpExtMismatchPortAckRx | - awk '{print $2}') - [ -z "$count" ] && count=0 - if [ "$count" != "$mis_ack_nr" ]; then + count=$(get_counter ${ns1} "MPTcpExtMismatchPortAckRx") + if [ -z "$count" ]; then + echo "[skip]" + elif [ "$count" != "$mis_ack_nr" ]; then echo "[fail] got $count JOIN[s] ack with a mismatched \ port-number expected $mis_ack_nr" fail_test
@@ -1670,9 +1699,10 @@ chk_rm_nr() fi printf "%-${nr_blank}s %s" " " "rm " - count=$(ip netns exec $addr_ns nstat -as | grep MPTcpExtRmAddr | awk '{print $2}') - [ -z "$count" ] && count=0 - if [ "$count" != "$rm_addr_nr" ]; then + count=$(get_counter ${addr_ns} "MPTcpExtRmAddr") + if [ -z "$count" ]; then + echo -n "[skip]" + elif [ "$count" != "$rm_addr_nr" ]; then echo "[fail] got $count RM_ADDR[s] expected $rm_addr_nr" fail_test dump_stats=1
@@ -1681,29 +1711,27 @@ chk_rm_nr() fi echo -n " - rmsf " - count=$(ip netns exec $subflow_ns nstat -as | grep MPTcpExtRmSubflow | awk '{print $2}') - [ -z "$count" ] && count=0 - if [ -n "$simult" ]; then + count=$(get_counter ${subflow_ns} "MPTcpExtRmSubflow") + if [ -z "$count" ]; then + echo -n "[skip]" + elif [ -n "$simult" ]; then local cnt suffix - cnt=$(ip netns exec $addr_ns nstat -as | grep MPTcpExtRmSubflow | awk '{print $2}') + cnt=$(get_counter ${addr_ns} "MPTcpExtRmSubflow") # in case of simult flush, the subflow removal count on each side is # unreliable - [ -z "$cnt" ] && cnt=0 count=$((count + cnt)) [ "$count" != "$rm_subflow_nr" ] && suffix="$count in [$rm_subflow_nr:$((rm_subflow_nr*2))]" if [ $count -ge "$rm_subflow_nr" ] && \ [ "$count" -le "$((rm_subflow_nr *2 ))" ]; then - echo "[ ok ] $suffix" + echo -n "[ ok ] $suffix" else echo "[fail] got $count RM_SUBFLOW[s] expected in range [$rm_subflow_nr:$((rm_subflow_nr*2))]" fail_test dump_stats=1 fi - return - fi - if [ "$count" != "$rm_subflow_nr" ]; then + elif [ "$count" != "$rm_subflow_nr" ]; then echo "[fail] got $count RM_SUBFLOW[s] expected $rm_subflow_nr" fail_test dump_stats=1
@@ -1724,9 +1752,10 @@ chk_prio_nr() local dump_stats printf "%-${nr_blank}s %s" " " "ptx" - count=$(ip netns exec $ns1 nstat -as | grep MPTcpExtMPPrioTx | awk '{print $2}') - [ -z "$count" ] && count=0 - if [ "$count" != "$mp_prio_nr_tx" ]; then + count=$(get_counter ${ns1} "MPTcpExtMPPrioTx") + if [ -z "$count" ]; then + echo -n "[skip]" + elif [ "$count" != "$mp_prio_nr_tx" ]; then echo "[fail] got $count MP_PRIO[s] TX expected $mp_prio_nr_tx" fail_test dump_stats=1
@@ -1735,9 +1764,10 @@ chk_prio_nr() fi echo -n " - prx " - count=$(ip netns exec $ns1 nstat -as | grep MPTcpExtMPPrioRx | awk '{print $2}') - [ -z "$count" ] && count=0 - if [ "$count" != "$mp_prio_nr_rx" ]; then + count=$(get_counter ${ns1} "MPTcpExtMPPrioRx") + if [ -z "$count" ]; then + echo "[skip]" + elif [ "$count" != "$mp_prio_nr_rx" ]; then echo "[fail] got $count MP_PRIO[s] RX expected $mp_prio_nr_rx" fail_test dump_stats=1
@@ -1813,7 +1843,7 @@ wait_attempt_fail() while [ $time -lt $timeout_ms ]; do local cnt - cnt=$(ip netns exec $ns nstat -as TcpAttemptFails | grep TcpAttemptFails | awk '{print $2}') + cnt=$(get_counter ${ns} "TcpAttemptFails") [ "$cnt" = 1 ] && return 1 time=$((time + 100))
Greg Kroah-Hartman
maintainerPATCH 29/170 selftests: mptcp: join: support local endpoint being tracked or not
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit d4c81bbb8600257fd3076d0196cb08bd2e5bdf24 upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features.
At some points, a new feature caused internal behaviour changes we are verifying in the selftests, see the Fixes tag below. It was not a uAPI change but because in these selftests, we check some internal behaviours, it is normal we have to adapt them from time to time after having added some features.
It is possible to look for "mptcp_pm_subflow_check_next" in kallsyms because it was needed to introduce the mentioned feature. So we can know in advance what the behaviour we are expecting here instead of supporting the two behaviours.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +11 -4
@@ -2064,11 +2064,18 @@ signal_address_tests() # the peer could possibly miss some addr notification, allow retransmission ip netns exec $ns1 sysctl -q net.mptcp.add_addr_timeout=1 run_tests $ns1 $ns2 10.0.1.1 0 0 0 slow - chk_join_nr 3 3 3 - # the server will not signal the address terminating - # the MPC subflow - chk_add_nr 3 3 + # It is not directly linked to the commit introducing this + # symbol but for the parent one which is linked anyway. + if ! mptcp_lib_kallsyms_has "mptcp_pm_subflow_check_next$"; then + chk_join_nr 3 3 2 + chk_add_nr 4 4 + else + chk_join_nr 3 3 3 + # the server will not signal the address terminating + # the MPC subflow + chk_add_nr 3 3 + fi fi }
Greg Kroah-Hartman
maintainerPATCH 30/170 selftests: mptcp: join: skip Fastclose tests if not supported
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit ae947bb2c253ff5f395bb70cb9db8700543bf398 upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features.
One of them is the support of MP_FASTCLOSE introduced in commit f284c0c77321 ("mptcp: implement fastclose xmit path").
If the MIB counter is not available, the test cannot be verified and the behaviour will not be the expected one. So we can skip the test if the counter is missing.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +15 -2
@@ -253,6 +253,19 @@ reset() return 0 } +# $1: test name ; $2: counter to check +reset_check_counter() +{ + reset "${1}" || return 1 + + local counter="${2}" + + if ! nstat -asz "${counter}" | grep -wq "${counter}"; then + mark_as_skipped "counter '${counter}' is not available" + return 1 + fi +} + # $1: test name reset_with_cookies() {
@@ -2959,14 +2972,14 @@ fullmesh_tests() fastclose_tests() { - if reset "fastclose test"; then + if reset_check_counter "fastclose test" "MPTcpExtMPFastcloseTx"; then run_tests $ns1 $ns2 10.0.1.1 1024 0 fastclose_client chk_join_nr 0 0 0 chk_fclose_nr 1 1 chk_rst_nr 1 1 invert fi - if reset "fastclose server test"; then + if reset_check_counter "fastclose server test" "MPTcpExtMPFastcloseRx"; then run_tests $ns1 $ns2 10.0.1.1 1024 0 fastclose_server chk_join_nr 0 0 0 chk_fclose_nr 1 1 invert
Greg Kroah-Hartman
maintainerPATCH 31/170 selftests: mptcp: join: support RM_ADDR for used endpoints or not
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit 425ba803124b90cb9124d99f13b372a89dc151d9 upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features.
At some points, a new feature caused internal behaviour changes we are verifying in the selftests, see the Fixes tag below. It was not a UAPI change but because in these selftests, we check some internal behaviours, it is normal we have to adapt them from time to time after having added some features.
It looks like there is no external sign we can use to predict the expected behaviour. Instead of accepting different behaviours and thus not really checking for the expected behaviour, we are looking here for a specific kernel version. That's not ideal but it looks better than removing the test because it cannot support older kernel versions.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +6 -1
@@ -2329,7 +2329,12 @@ remove_tests() pm_nl_add_endpoint $ns2 10.0.4.2 flags subflow run_tests $ns1 $ns2 10.0.1.1 0 -8 -8 slow chk_join_nr 3 3 3 - chk_rm_nr 0 3 simult + + if mptcp_lib_kversion_ge 5.18; then + chk_rm_nr 0 3 simult + else + chk_rm_nr 3 3 + fi fi # addresses flush
Greg Kroah-Hartman
maintainerPATCH 32/170 selftests: mptcp: join: skip implicit tests if not supported
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit 36c4127ae8dd0ebac6d56d8a1b272dd483471c40 upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features.
One of them is the support of the implicit endpoints introduced by commit d045b9eb95a9 ("mptcp: introduce implicit endpoints").
It is possible to look for "mptcp_subflow_send_ack" in kallsyms because it was needed to introduce the mentioned feature. So we can know in advance if the feature is supported instead of trying and accepting any results.
Note that here and in the following commits, we re-do the same check for each sub-test of the same function for a few reasons. The main one is not to break the ID assign to each test in order to be able to easily compare results between different kernel versions. Also, we can still run a specific test even if it is skipped. Another reason is that it makes it clear during the review that a specific subtest will be skipped or not under certain conditions. At the end, it looks OK to call the exact same helper multiple times: it is not a critical path and it is the same code that is executed, not really more cases to maintain.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +5 -2
@@ -3108,8 +3108,10 @@ userspace_tests() endpoint_tests() { + # subflow_rebuild_header is needed to support the implicit flag # userspace pm type prevents add_addr - if reset "implicit EP"; then + if reset "implicit EP" && + mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then pm_nl_set_limits $ns1 2 2 pm_nl_set_limits $ns2 2 2 pm_nl_add_endpoint $ns1 10.0.2.1 flags signal
@@ -3129,7 +3131,8 @@ endpoint_tests() kill_tests_wait fi - if reset "delete and re-add"; then + if reset "delete and re-add" && + mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then pm_nl_set_limits $ns1 1 1 pm_nl_set_limits $ns2 1 1 pm_nl_add_endpoint $ns2 10.0.2.2 id 2 dev ns2eth2 flags subflow
Greg Kroah-Hartman
maintainerPATCH 33/170 selftests: mptcp: join: skip backup if set flag on ID not supported
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit 07216a3c5d926bf1b6b360a0073747228a1f9b7f upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features.
Commit bccefb762439 ("selftests: mptcp: simplify pm_nl_change_endpoint") has simplified the way the backup flag is set on an endpoint. Instead of doing:
./pm_nl_ctl set 10.0.2.1 flags backup
Now we do:
./pm_nl_ctl set id 1 flags backup
The new way is easier to maintain but it is also incompatible with older kernels not supporting the implicit endpoints putting in place the infrastructure to set flags per ID, hence the second Fixes tag.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +6 -3
@@ -2573,7 +2573,8 @@ v4mapped_tests() backup_tests() { # single subflow, backup - if reset "single subflow, backup"; then + if reset "single subflow, backup" && + continue_if mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then pm_nl_set_limits $ns1 0 1 pm_nl_set_limits $ns2 0 1 pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow,backup
@@ -2583,7 +2584,8 @@ backup_tests() fi # single address, backup - if reset "single address, backup"; then + if reset "single address, backup" && + continue_if mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then pm_nl_set_limits $ns1 0 1 pm_nl_add_endpoint $ns1 10.0.2.1 flags signal pm_nl_set_limits $ns2 1 1
@@ -2594,7 +2596,8 @@ backup_tests() fi # single address with port, backup - if reset "single address with port, backup"; then + if reset "single address with port, backup" && + continue_if mptcp_lib_kallsyms_has "subflow_rebuild_header$"; then pm_nl_set_limits $ns1 0 1 pm_nl_add_endpoint $ns1 10.0.2.1 flags signal port 10100 pm_nl_set_limits $ns2 1 1
Greg Kroah-Hartman
maintainerPATCH 34/170 selftests: mptcp: join: skip fullmesh flag tests if not supported
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit 9db34c4294af9999edc773d96744e2d2d4eb5060 upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features.
One of them is the support of the fullmesh flag for the in-kernel PM introduced by commit 2843ff6f36db ("mptcp: remote addresses fullmesh") and commit 1a0d6136c5f0 ("mptcp: local addresses fullmesh").
It looks like there is no easy external sign we can use to predict the expected behaviour. We could add the flag and then check if it has been added but for that, and for each fullmesh test, we would need to setup a new environment, do the checks, clean it and then only start the test from yet another clean environment. To keep it simple and avoid introducing new issues, we look for a specific kernel version. That's not ideal but an acceptable solution for this case.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +8 -4
@@ -2936,7 +2936,8 @@ fullmesh_tests() fi # set fullmesh flag - if reset "set fullmesh flag test"; then + if reset "set fullmesh flag test" && + continue_if mptcp_lib_kversion_ge 5.18; then pm_nl_set_limits $ns1 4 4 pm_nl_add_endpoint $ns1 10.0.2.1 flags subflow pm_nl_set_limits $ns2 4 4
@@ -2946,7 +2947,8 @@ fullmesh_tests() fi # set nofullmesh flag - if reset "set nofullmesh flag test"; then + if reset "set nofullmesh flag test" && + continue_if mptcp_lib_kversion_ge 5.18; then pm_nl_set_limits $ns1 4 4 pm_nl_add_endpoint $ns1 10.0.2.1 flags subflow,fullmesh pm_nl_set_limits $ns2 4 4
@@ -2956,7 +2958,8 @@ fullmesh_tests() fi # set backup,fullmesh flags - if reset "set backup,fullmesh flags test"; then + if reset "set backup,fullmesh flags test" && + continue_if mptcp_lib_kversion_ge 5.18; then pm_nl_set_limits $ns1 4 4 pm_nl_add_endpoint $ns1 10.0.2.1 flags subflow pm_nl_set_limits $ns2 4 4
@@ -2967,7 +2970,8 @@ fullmesh_tests() fi # set nobackup,nofullmesh flags - if reset "set nobackup,nofullmesh flags test"; then + if reset "set nobackup,nofullmesh flags test" && + continue_if mptcp_lib_kversion_ge 5.18; then pm_nl_set_limits $ns1 4 4 pm_nl_set_limits $ns2 4 4 pm_nl_add_endpoint $ns2 10.0.2.2 flags subflow,backup,fullmesh
Greg Kroah-Hartman
maintainerPATCH 35/170 selftests: mptcp: join: skip MPC backups tests if not supported
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit 632978f0a961b4591a05ba9e39eab24541d83e84 upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features.
One of them is the support of sending an MP_PRIO signal for the initial subflow, introduced by commit c157bbe776b7 ("mptcp: allow the in kernel PM to set MPC subflow priority").
It is possible to look for "mptcp_subflow_send_ack" in kallsyms because it was needed to introduce the mentioned feature. So we can know in advance if the feature is supported instead of trying and accepting any results.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +8 -4
@@ -2607,14 +2607,16 @@ backup_tests() chk_prio_nr 1 1 fi - if reset "mpc backup"; then + if reset "mpc backup" && + continue_if mptcp_lib_kallsyms_doesnt_have "mptcp_subflow_send_ack$"; then pm_nl_add_endpoint $ns2 10.0.1.2 flags subflow,backup run_tests $ns1 $ns2 10.0.1.1 0 0 0 slow chk_join_nr 0 0 0 chk_prio_nr 0 1 fi - if reset "mpc backup both sides"; then + if reset "mpc backup both sides" && + continue_if mptcp_lib_kallsyms_doesnt_have "mptcp_subflow_send_ack$"; then pm_nl_add_endpoint $ns1 10.0.1.1 flags subflow,backup pm_nl_add_endpoint $ns2 10.0.1.2 flags subflow,backup run_tests $ns1 $ns2 10.0.1.1 0 0 0 slow
@@ -2622,14 +2624,16 @@ backup_tests() chk_prio_nr 1 1 fi - if reset "mpc switch to backup"; then + if reset "mpc switch to backup" && + continue_if mptcp_lib_kallsyms_doesnt_have "mptcp_subflow_send_ack$"; then pm_nl_add_endpoint $ns2 10.0.1.2 flags subflow run_tests $ns1 $ns2 10.0.1.1 0 0 0 slow backup chk_join_nr 0 0 0 chk_prio_nr 0 1 fi - if reset "mpc switch to backup both sides"; then + if reset "mpc switch to backup both sides" && + continue_if mptcp_lib_kallsyms_doesnt_have "mptcp_subflow_send_ack$"; then pm_nl_add_endpoint $ns1 10.0.1.1 flags subflow pm_nl_add_endpoint $ns2 10.0.1.2 flags subflow run_tests $ns1 $ns2 10.0.1.1 0 0 0 slow backup
Greg Kroah-Hartman
maintainerPATCH 36/170 selftests/mount_setattr: fix redefine struct mount_attr build error
In reply to Greg Kroah-HartmanFrom: Shuah Khan <[email protected]>
commit d8e45bf1aed2e5fddd8985b5bb1aaf774a97aba8 upstream.
Fix the following build error due to redefining struct mount_attr by removing duplicate define from mount_setattr_test.c
gcc -g -isystem .../tools/testing/selftests/../../../usr/include -Wall -O2 -pthread mount_setattr_test.c -o .../tools/testing/selftests/mount_setattr/mount_setattr_test
mount_setattr_test.c:107:8: error: redefinition of ‘struct mount_attr’
107 | struct mount_attr {
| ^~~~~~~~~~
In file included from /usr/include/x86_64-linux-gnu/sys/mount.h:32,
from mount_setattr_test.c:10:
.../usr/include/linux/mount.h:129:8: note: originally defined here
129 | struct mount_attr {
| ^~~~~~~~~~make: *** [../lib.mk:145: .../tools/testing/selftests/mount_setattr/mount_setattr_test] Error 1
--- tools/testing/selftests/mount_setattr/mount_setattr_test.c | 7 ------- 1 file changed, 7 deletions(-)
tools/testing/selftests/mount_setattr/mount_setattr_test.c +0 -7
@@ -104,13 +104,6 @@#else #define __NR_mount_setattr 442#endif - -struct mount_attr { -__u64 attr_set; -__u64 attr_clr; -__u64 propagation; -__u64 userns_fd; -};#endif #ifndef __NR_open_tree
Greg Kroah-Hartman
maintainerPATCH 37/170 selftests: mptcp: diag: skip listen tests if not supported
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit dc97251bf0b70549c76ba261516c01b8096771c5 upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features.
One of them is the listen diag dump support introduced by commit 4fa39b701ce9 ("mptcp: listen diag dump support").
It looks like there is no good pre-check to do here, i.e. dedicated function available in kallsyms. Instead, we try to get info if nothing is returned, the test is marked as skipped.
That's not ideal because something could be wrong with the feature and instead of reporting an error, the test could be marked as skipped. If we know in advanced that the feature is supposed to be supported, the tester can set SELFTESTS_MPTCP_LIB_EXPECT_ALL_FEATURES env var to 1: in this case the test will report an error instead of marking the test as skipped if nothing is returned.
--- tools/testing/selftests/net/mptcp/diag.sh | 47 +++++++++++++++--------------- 1 file changed, 24 insertions(+), 23 deletions(-)
tools/testing/selftests/net/mptcp/diag.sh +24 -23
@@ -42,27 +42,39 @@ fi __chk_nr() { - local condition="$1" + local command="$1" local expected=$2 - local msg nr + local msg="$3" + local skip="${4:-SKIP}" + local nr - shift 2 - msg=$* - nr=$(ss -inmHMN $ns | $condition) + nr=$(eval $command) printf "%-50s" "$msg" if [ $nr != $expected ]; then - echo "[ fail ] expected $expected found $nr" - ret=$test_cnt + if [ $nr = "$skip" ] && ! mptcp_lib_expect_all_features; then + echo "[ skip ] Feature probably not supported" + else + echo "[ fail ] expected $expected found $nr" + ret=$test_cnt + fi else echo "[ ok ]" fi test_cnt=$((test_cnt+1)) } +__chk_msk_nr() +{ + local condition=$1 + shift 1 + + __chk_nr "ss -inmHMN $ns | $condition" "$@" +} + chk_msk_nr() { - __chk_nr "grep -c token:" $* + __chk_msk_nr "grep -c token:" "$@" } wait_msk_nr()
@@ -100,37 +112,26 @@ wait_msk_nr() chk_msk_fallback_nr() { - __chk_nr "grep -c fallback" $* + __chk_msk_nr "grep -c fallback" "$@" } chk_msk_remote_key_nr() { - __chk_nr "grep -c remote_key" $* + __chk_msk_nr "grep -c remote_key" "$@" } __chk_listen() { local filter="$1" local expected=$2 + local msg="$3" - shift 2 - msg=$* - - nr=$(ss -N $ns -Ml "$filter" | grep -c LISTEN) - printf "%-50s" "$msg" - - if [ $nr != $expected ]; then - echo "[ fail ] expected $expected found $nr" - ret=$test_cnt - else - echo "[ ok ]" - fi + __chk_nr "ss -N $ns -Ml '$filter' | grep -c LISTEN" "$expected" "$msg" 0 } chk_msk_listen() { lport=$1 - local msg="check for listen socket" # destination port search should always return empty list __chk_listen "dport $lport" 0 "listen match for dport $lport"
Greg Kroah-Hartman
maintainerPATCH 38/170 selftests: mptcp: sockopt: skip TCP_INQ checks if not supported
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit b631e3a4e94c77c9007d60b577a069c203ce9594 upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features.
One of them is TCP_INQ cmsg support introduced in commit 2c9e77659a0c ("mptcp: add TCP_INQ cmsg support").
It is possible to look for "mptcp_ioctl" in kallsyms because it was needed to introduce the mentioned feature. We can skip these tests and not set TCPINQ option if the feature is not supported.
--- tools/testing/selftests/net/mptcp/mptcp_sockopt.sh | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_sockopt.sh +12 -2
@@ -182,9 +182,14 @@ do_transfer() local_addr="0.0.0.0" fi + cmsg="TIMESTAMPNS" + if mptcp_lib_kallsyms_has "mptcp_ioctl$"; then + cmsg+=",TCPINQ" + fi + timeout ${timeout_test} \ ip netns exec ${listener_ns} \ - $mptcp_connect -t ${timeout_poll} -l -M 1 -p $port -s ${srv_proto} -c TIMESTAMPNS,TCPINQ \ + $mptcp_connect -t ${timeout_poll} -l -M 1 -p $port -s ${srv_proto} -c "${cmsg}" \ ${local_addr} < "$sin" > "$sout" & spid=$!
@@ -192,7 +197,7 @@ do_transfer() timeout ${timeout_test} \ ip netns exec ${connector_ns} \ - $mptcp_connect -t ${timeout_poll} -M 2 -p $port -s ${cl_proto} -c TIMESTAMPNS,TCPINQ \ + $mptcp_connect -t ${timeout_poll} -M 2 -p $port -s ${cl_proto} -c "${cmsg}" \ $connect_addr < "$cin" > "$cout" & cpid=$!
@@ -311,6 +316,11 @@ do_tcpinq_tests() ip netns exec "$ns1" iptables -F ip netns exec "$ns1" ip6tables -F + if ! mptcp_lib_kallsyms_has "mptcp_ioctl$"; then + echo "INFO: TCP_INQ not supported: SKIP" + return + fi + for args in "-t tcp" "-r tcp"; do do_tcpinq_test $args lret=$?
Greg Kroah-Hartman
maintainerPATCH 39/170 selftests: mptcp: join: skip test if iptables/tc cmds fail
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit 4a0b866a3f7d3c22033f40e93e94befc6fe51bce upstream
Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features.
Some tests are using IPTables and/or TC commands to force some behaviours. If one of these commands fails -- likely because some features are not available due to missing kernel config -- we should intercept the error and skip the tests requiring these features.
Note that if we expect to have these features available and if SELFTESTS_MPTCP_LIB_EXPECT_ALL_FEATURES env var is set to 1, the tests will be marked as failed instead of skipped.
This patch also replaces the 'exit 1' by 'return 1' not to stop the selftest in the middle without the conclusion if there is an issue with NF or TC.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 88 +++++++++++++++--------- 1 file changed, 57 insertions(+), 31 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +57 -31
@@ -291,11 +291,15 @@ reset_with_add_addr_timeout() fi ip netns exec $ns1 sysctl -q net.mptcp.add_addr_timeout=1 - ip netns exec $ns2 $tables -A OUTPUT -p tcp \ - -m tcp --tcp-option 30 \ - -m bpf --bytecode \ - "$CBPF_MPTCP_SUBOPTION_ADD_ADDR" \ - -j DROP + + if ! ip netns exec $ns2 $tables -A OUTPUT -p tcp \ + -m tcp --tcp-option 30 \ + -m bpf --bytecode \ + "$CBPF_MPTCP_SUBOPTION_ADD_ADDR" \ + -j DROP; then + mark_as_skipped "unable to set the 'add addr' rule" + return 1 + fi } # $1: test name
@@ -339,17 +343,12 @@ reset_with_allow_join_id0() # tc action pedit offset 162 out of bounds # # Netfilter is used to mark packets with enough data. -reset_with_fail() +setup_fail_rules() { - reset "${1}" || return 1 - - ip netns exec $ns1 sysctl -q net.mptcp.checksum_enabled=1 - ip netns exec $ns2 sysctl -q net.mptcp.checksum_enabled=1 - check_invert=1 validate_checksum=1 - local i="$2" - local ip="${3:-4}" + local i="$1" + local ip="${2:-4}" local tables tables="${iptables}"
@@ -364,15 +363,51 @@ reset_with_fail() -p tcp \ -m length --length 150:9999 \ -m statistic --mode nth --packet 1 --every 99999 \ - -j MARK --set-mark 42 || exit 1 + -j MARK --set-mark 42 || return ${ksft_skip} - tc -n $ns2 qdisc add dev ns2eth$i clsact || exit 1 + tc -n $ns2 qdisc add dev ns2eth$i clsact || return ${ksft_skip} tc -n $ns2 filter add dev ns2eth$i egress \ protocol ip prio 1000 \ handle 42 fw \ action pedit munge offset 148 u8 invert \ pipe csum tcp \ - index 100 || exit 1 + index 100 || return ${ksft_skip} +} + +reset_with_fail() +{ + reset "${1}" || return 1 + shift + + ip netns exec $ns1 sysctl -q net.mptcp.checksum_enabled=1 + ip netns exec $ns2 sysctl -q net.mptcp.checksum_enabled=1 + + local rc=0 + setup_fail_rules "${@}" || rc=$? + + if [ ${rc} -eq ${ksft_skip} ]; then + mark_as_skipped "unable to set the 'fail' rules" + return 1 + fi +} + +reset_with_tcp_filter() +{ + reset "${1}" || return 1 + shift + + local ns="${!1}" + local src="${2}" + local target="${3}" + + if ! ip netns exec "${ns}" ${iptables} \ + -A INPUT \ + -s "${src}" \ + -p tcp \ + -j "${target}"; then + mark_as_skipped "unable to set the filter rules" + return 1 + fi } fail_test()
@@ -732,15 +767,6 @@ pm_nl_check_endpoint() fi } -filter_tcp_from() -{ - local ns="${1}" - local src="${2}" - local target="${3}" - - ip netns exec "${ns}" ${iptables} -A INPUT -s "${src}" -p tcp -j "${target}" -} - do_transfer() { local listener_ns="$1"
@@ -1949,23 +1975,23 @@ subflows_error_tests() fi # multiple subflows, with subflow creation error - if reset "multi subflows, with failing subflow"; then + if reset_with_tcp_filter "multi subflows, with failing subflow" ns1 10.0.3.2 REJECT && + continue_if mptcp_lib_kallsyms_has "mptcp_pm_subflow_check_next$"; then pm_nl_set_limits $ns1 0 2 pm_nl_set_limits $ns2 0 2 pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow pm_nl_add_endpoint $ns2 10.0.2.2 flags subflow - filter_tcp_from $ns1 10.0.3.2 REJECT run_tests $ns1 $ns2 10.0.1.1 0 0 0 slow chk_join_nr 1 1 1 fi # multiple subflows, with subflow timeout on MPJ - if reset "multi subflows, with subflow timeout"; then + if reset_with_tcp_filter "multi subflows, with subflow timeout" ns1 10.0.3.2 DROP && + continue_if mptcp_lib_kallsyms_has "mptcp_pm_subflow_check_next$"; then pm_nl_set_limits $ns1 0 2 pm_nl_set_limits $ns2 0 2 pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow pm_nl_add_endpoint $ns2 10.0.2.2 flags subflow - filter_tcp_from $ns1 10.0.3.2 DROP run_tests $ns1 $ns2 10.0.1.1 0 0 0 slow chk_join_nr 1 1 1 fi
@@ -1973,11 +1999,11 @@ subflows_error_tests() # multiple subflows, check that the endpoint corresponding to # closed subflow (due to reset) is not reused if additional # subflows are added later - if reset "multi subflows, fair usage on close"; then + if reset_with_tcp_filter "multi subflows, fair usage on close" ns1 10.0.3.2 REJECT && + continue_if mptcp_lib_kallsyms_has "mptcp_pm_subflow_check_next$"; then pm_nl_set_limits $ns1 0 1 pm_nl_set_limits $ns2 0 1 pm_nl_add_endpoint $ns2 10.0.3.2 flags subflow - filter_tcp_from $ns1 10.0.3.2 REJECT run_tests $ns1 $ns2 10.0.1.1 0 0 0 slow & # mpj subflow will be in TW after the reset
Greg Kroah-Hartman
maintainerPATCH 40/170 selftests: mptcp: join: skip userspace PM tests if not supported
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit f2b492b04a167261e1c38eb76f78fb4294473a49 upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features.
One of them is the support of the userspace PM introduced by commit 4638de5aefe5 ("mptcp: handle local addrs announced by userspace PMs") and the following ones.
It is possible to look for the MPTCP pm_type's sysctl knob to know in advance if the userspace PM is available.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 26 +++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +17 -9
@@ -79,7 +79,7 @@ init_partial() ip netns add $netns || exit $ksft_skip ip -net $netns link set lo up ip netns exec $netns sysctl -q net.mptcp.enabled=1 - ip netns exec $netns sysctl -q net.mptcp.pm_type=0 + ip netns exec $netns sysctl -q net.mptcp.pm_type=0 2>/dev/null || true ip netns exec $netns sysctl -q net.ipv4.conf.all.rp_filter=0 ip netns exec $netns sysctl -q net.ipv4.conf.default.rp_filter=0 if [ $checksum -eq 1 ]; then
@@ -3059,7 +3059,8 @@ fail_tests() userspace_tests() { # userspace pm type prevents add_addr - if reset "userspace pm type prevents add_addr"; then + if reset "userspace pm type prevents add_addr" && + continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then set_userspace_pm $ns1 pm_nl_set_limits $ns1 0 2 pm_nl_set_limits $ns2 0 2
@@ -3070,7 +3071,8 @@ userspace_tests() fi # userspace pm type does not echo add_addr without daemon - if reset "userspace pm no echo w/o daemon"; then + if reset "userspace pm no echo w/o daemon" && + continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then set_userspace_pm $ns2 pm_nl_set_limits $ns1 0 2 pm_nl_set_limits $ns2 0 2
@@ -3081,7 +3083,8 @@ userspace_tests() fi # userspace pm type rejects join - if reset "userspace pm type rejects join"; then + if reset "userspace pm type rejects join" && + continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then set_userspace_pm $ns1 pm_nl_set_limits $ns1 1 1 pm_nl_set_limits $ns2 1 1
@@ -3091,7 +3094,8 @@ userspace_tests() fi # userspace pm type does not send join - if reset "userspace pm type does not send join"; then + if reset "userspace pm type does not send join" && + continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then set_userspace_pm $ns2 pm_nl_set_limits $ns1 1 1 pm_nl_set_limits $ns2 1 1
@@ -3101,7 +3105,8 @@ userspace_tests() fi # userspace pm type prevents mp_prio - if reset "userspace pm type prevents mp_prio"; then + if reset "userspace pm type prevents mp_prio" && + continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then set_userspace_pm $ns1 pm_nl_set_limits $ns1 1 1 pm_nl_set_limits $ns2 1 1
@@ -3112,7 +3117,8 @@ userspace_tests() fi # userspace pm type prevents rm_addr - if reset "userspace pm type prevents rm_addr"; then + if reset "userspace pm type prevents rm_addr" && + continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then set_userspace_pm $ns1 set_userspace_pm $ns2 pm_nl_set_limits $ns1 0 1
@@ -3124,7 +3130,8 @@ userspace_tests() fi # userspace pm add & remove address - if reset "userspace pm add & remove address"; then + if reset "userspace pm add & remove address" && + continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then set_userspace_pm $ns1 pm_nl_set_limits $ns2 1 1 run_tests $ns1 $ns2 10.0.1.1 0 userspace_1 0 slow
@@ -3134,7 +3141,8 @@ userspace_tests() fi # userspace pm create destroy subflow - if reset "userspace pm create destroy subflow"; then + if reset "userspace pm create destroy subflow" && + continue_if mptcp_lib_has_file '/proc/sys/net/mptcp/pm_type'; then set_userspace_pm $ns2 pm_nl_set_limits $ns1 0 1 run_tests $ns1 $ns2 10.0.1.1 0 0 userspace_1 slow
Greg Kroah-Hartman
maintainerPATCH 41/170 selftests: mptcp: join: skip fail tests if not supported
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit ff8897b5189495b47895ca247b860a29dc04b36b upstream.
Selftests are supposed to run on any kernels, including the old ones not supporting all MPTCP features.
One of them is the support of the MP_FAIL / infinite mapping introduced by commit 1e39e5a32ad7 ("mptcp: infinite mapping sending") and the following ones.
It is possible to look for one of the infinite mapping counters to know in advance if the this feature is available.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +1 -1
@@ -376,7 +376,7 @@ setup_fail_rules() reset_with_fail() { - reset "${1}" || return 1 + reset_check_counter "${1}" "MPTcpExtInfiniteMapTx" || return 1 shift ip netns exec $ns1 sysctl -q net.mptcp.checksum_enabled=1
Greg Kroah-Hartman
maintainerPATCH 42/170 selftests: mptcp: join: fix "userspace pm add & remove address"
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
It looks like this test was broken in v6.1 after the backport of commit 48d73f609dcc ("selftests: mptcp: update userspace pm addr tests").
It was not working because the commit ad3493746ebe ("selftests: mptcp:
add test-cases for mixed v4/v6 subflows") is not in v6.1. This commit changes how the connections are being created in mptcp_join.sh selftest:
with IPv6 support always enabled. But then in v6.1, the server still create IPv4 only connections, so without the v4-mapped-v6 format with the "::ffff:" prefix like we have in v6.3.
The modification here adds a support for connections created in v4 as well so it fixes the issue in v6.1. This patch is not needed for the selftests in v6.3 because only IPv6 listening sockets are being created.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +3 -2
@@ -946,11 +946,12 @@ do_transfer() sp=$(grep "type:10" "$evts_ns1" | sed -n 's/.*\(sport:\)\([[:digit:]]*\).*$/\2/p;q') da=$(grep "type:10" "$evts_ns1" | - sed -n 's/.*\(daddr6:\)\([0-9a-f:.]*\).*$/\2/p;q') + sed -n 's/.*\(daddr[46]:\)\([0-9a-f:.]*\).*$/\2/p;q') + echo "$da" | grep -q ":" && addr="::ffff:$addr" dp=$(grep "type:10" "$evts_ns1" | sed -n 's/.*\(dport:\)\([[:digit:]]*\).*$/\2/p;q') ip netns exec ${listener_ns} ./pm_nl_ctl rem token $tk id $id - ip netns exec ${listener_ns} ./pm_nl_ctl dsf lip "::ffff:$addr" \ + ip netns exec ${listener_ns} ./pm_nl_ctl dsf lip "$addr" \ lport $sp rip $da rport $dp token $tk fi
Greg Kroah-Hartman
maintainerPATCH 43/170 writeback: fix dereferencing NULL mapping->host on writeback_page_template
In reply to Greg Kroah-HartmanFrom: Rafael Aquini <[email protected]>
commit 54abe19e00cfcc5a72773d15cd00ed19ab763439 upstream.
When commit 19343b5bdd16 ("mm/page-writeback: introduce tracepoint for wait_on_page_writeback()") repurposed the writeback_dirty_page trace event as a template to create its new wait_on_page_writeback trace event, it ended up opening a window to NULL pointer dereference crashes due to the (infrequent) occurrence of a race where an access to a page in the swap-cache happens concurrently with the moment this page is being written to disk and the tracepoint is enabled:
BUG: kernel NULL pointer dereference, address: 0000000000000040
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 800000010ec0a067 P4D 800000010ec0a067 PUD 102353067 PMD 0
Oops: 0000 [#1] PREEMPT SMP PTI
CPU: 1 PID: 1320 Comm: shmem-worker Kdump: loaded Not tainted 6.4.0-rc5+ #13
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20230301gitf80f052277c8-1.fc37 03/01/2023
RIP: 0010:trace_event_raw_event_writeback_folio_template+0x76/0xf0
Code: 4d 85 e4 74 5c 49 8b 3c 24 e8 06 98 ee ff 48 89 c7 e8 9e 8b ee ff ba 20 00 00 00 48 89 ef 48 89 c6 e8 fe d4 1a 00 49 8b 04 24 <48> 8b 40 40 48 89 43 28 49 8b 45 20 48 89 e7 48 89 43 30 e8 a2 4d
RSP: 0000:ffffaad580b6fb60 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff90e38035c01c RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff90e38035c044
RBP: ffff90e38035c024 R08: 0000000000000002 R09: 0000000000000006
R10: ffff90e38035c02e R11: 0000000000000020 R12: ffff90e380bac000
R13: ffffe3a7456d9200 R14: 0000000000001b81 R15: ffffe3a7456d9200
FS: 00007f2e4e8a15c0(0000) GS:ffff90e3fbc80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000040 CR3: 00000001150c6003 CR4: 0000000000170ee0
Call Trace:
<TASK>
? __die+0x20/0x70
? page_fault_oops+0x76/0x170
? kernelmode_fixup_or_oops+0x84/0x110
? exc_page_fault+0x65/0x150
? asm_exc_page_fault+0x22/0x30
? trace_event_raw_event_writeback_folio_template+0x76/0xf0
folio_wait_writeback+0x6b/0x80
shmem_swapin_folio+0x24a/0x500
? filemap_get_entry+0xe3/0x140
shmem_get_folio_gfp+0x36e/0x7c0
? find_busiest_group+0x43/0x1a0
shmem_fault+0x76/0x2a0
? __update_load_avg_cfs_rq+0x281/0x2f0
__do_fault+0x33/0x130
do_read_fault+0x118/0x160
do_pte_missing+0x1ed/0x2a0
__handle_mm_fault+0x566/0x630
handle_mm_fault+0x91/0x210
do_user_addr_fault+0x22c/0x740
exc_page_fault+0x65/0x150
asm_exc_page_fault+0x22/0x30This problem arises from the fact that the repurposed writeback_dirty_page trace event code was written assuming that every pointer to mapping (struct address_space) would come from a file-mapped page-cache object, thus mapping->host would always be populated, and that was a valid case before commit 19343b5bdd16. The swap-cache address space (swapper_spaces), however, doesn't populate its ->host (struct inode) pointer, thus leading to the crashes in the corner-case aforementioned.
commit 19343b5bdd16 ended up breaking the assignment of __entry->name and __entry->ino for the wait_on_page_writeback tracepoint -- both dependent on mapping->host carrying a pointer to a valid inode. The assignment of __entry->name was fixed by commit 68f23b89067f ("memcg: fix a crash in wb_workfn when a device disappears"), and this commit fixes the remaining case, for __entry->ino.
--- include/trace/events/writeback.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/trace/events/writeback.h +1 -1
@@ -68,7 +68,7 @@ DECLARE_EVENT_CLASS(writeback_folio_tempstrscpy_pad (__entry->name,bdi_dev_name (mapping ?inode_to_bdi (mapping->host) :NULL ),32 ); - __entry->ino = mapping ? mapping->host->i_ino :0 ; + __entry->ino = (mapping && mapping->host) ? mapping->host->i_ino :0 ; __entry->index = folio->index; ),
Greg Kroah-Hartman
maintainerPATCH 44/170 scripts: fix the gfp flags header path in gfp-translate
In reply to Greg Kroah-HartmanFrom: Prathu Baronia <[email protected]>
commit 2049a7d0cbc6ac8e370e836ed68597be04a7dc49 upstream.
Since gfp flags have been shifted to gfp_types.h so update the path in the gfp-translate script.
--- scripts/gfp-translate | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
scripts/gfp-translate +3 -3
@@ -63,11 +63,11 @@ fi # Extract GFP flags from the kernel source TMPFILE=`mktemp -t gfptranslate-XXXXXX` || exit 1 -grep -q ___GFP $SOURCE/include/linux/gfp.h +grep -q ___GFP $SOURCE/include/linux/gfp_types.h if [ $? -eq 0 ]; then - grep "^#define ___GFP" $SOURCE/include/linux/gfp.h | sed -e 's/u$//' | grep -v GFP_BITS > $TMPFILE + grep "^#define ___GFP" $SOURCE/include/linux/gfp_types.h | sed -e 's/u$//' | grep -v GFP_BITS > $TMPFILE else - grep "^#define __GFP" $SOURCE/include/linux/gfp.h | sed -e 's/(__force gfp_t)//' | sed -e 's/u)/)/' | grep -v GFP_BITS | sed -e 's/)\//) \//' > $TMPFILE + grep "^#define __GFP" $SOURCE/include/linux/gfp_types.h | sed -e 's/(__force gfp_t)//' | sed -e 's/u)/)/' | grep -v GFP_BITS | sed -e 's/)\//) \//' > $TMPFILE fi # Parse the flags
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 45/170 nilfs2: fix buffer corruption due to concurrent device reads
In reply to Greg Kroah-HartmanFrom: Ryusuke Konishi <[email protected]>
commit 679bd7ebdd315bf457a4740b306ae99f1d0a403d upstream.
As a result of analysis of a syzbot report, it turned out that in three cases where nilfs2 allocates block device buffers directly via sb_getblk, concurrent reads to the device can corrupt the allocated buffers.
Nilfs2 uses sb_getblk for segment summary blocks, that make up a log header, and the super root block, that is the trailer, and when moving and writing the second super block after fs resize.
In any of these, since the uptodate flag is not set when storing metadata to be written in the allocated buffers, the stored metadata will be overwritten if a device read of the same block occurs concurrently before the write. This causes metadata corruption and misbehavior in the log write itself, causing warnings in nilfs_btree_assign() as reported.
Fix these issues by setting an uptodate flag on the buffer head on the first or before modifying each buffer obtained with sb_getblk, and clearing the flag on failure.
When setting the uptodate flag, the lock_buffer/unlock_buffer pair is used to perform necessary exclusive control, and the buffer is filled to ensure that uninitialized bytes are not mixed into the data read from others. As for buffers for segment summary blocks, they are filled incrementally, so if the uptodate flag was unset on their allocation, set the flag and zero fill the buffer once at that point.
Also, regarding the superblock move routine, the starting point of the memset call to zerofill the block is incorrectly specified, which can cause a buffer overflow on file systems with block sizes greater than 4KiB. In addition, if the superblock is moved within a large block, it is necessary to assume the possibility that the data in the superblock will be destroyed by zero-filling before copying. So fix these potential issues as well.
--- fs/nilfs2/segbuf.c | 6 ++++++ fs/nilfs2/segment.c | 7 +++++++ fs/nilfs2/super.c | 23 ++++++++++++++++++++++- 3 files changed, 35 insertions(+), 1 deletion(-)
fs/nilfs2/segbuf.c +6 -0
@@ -101,6 +101,12 @@ int nilfs_segbuf_extend_segsum(struct niif (unlikely (!bh))return -ENOMEM ; +lock_buffer (bh); +if (!buffer_uptodate (bh)) { +memset (bh->b_data,0 , bh->b_size); +set_buffer_uptodate (bh); + } +unlock_buffer (bh);nilfs_segbuf_add_segsum_buffer (segbuf, bh);return 0 ; }
fs/nilfs2/segment.c +7 -0
@@ -979,10 +979,13 @@ static void nilfs_segctor_fill_in_super_unsigned int isz, srsz; bh_sr =NILFS_LAST_SEGBUF (&sci->sc_segbufs)->sb_super_root; + +lock_buffer (bh_sr); raw_sr = (struct nilfs_super_root *)bh_sr->b_data; isz = nilfs->ns_inode_size; srsz =NILFS_SR_BYTES (isz); + raw_sr->sr_sum =0 ;/* Ensure initialization within this update */ raw_sr->sr_bytes =cpu_to_le16 (srsz); raw_sr->sr_nongc_ctime = cpu_to_le64(nilfs_doing_gc() ?
@@ -996,6 +999,8 @@ static void nilfs_segctor_fill_in_super_nilfs_write_inode_common (nilfs->ns_sufile, (void *)raw_sr +NILFS_SR_SUFILE_OFFSET (isz),1 );memset ((void *)raw_sr + srsz,0 , nilfs->ns_blocksize - srsz); +set_buffer_uptodate (bh_sr); +unlock_buffer (bh_sr); }static void nilfs_redirty_inodes (struct list_head *head)
@@ -1778,6 +1783,7 @@ static void nilfs_abort_logs(struct listlist_for_each_entry (segbuf, logs, sb_list) {list_for_each_entry (bh, &segbuf->sb_segsum_buffers, b_assoc_buffers) { +clear_buffer_uptodate (bh);if (bh->b_page != bd_page) {if (bd_page)end_page_writeback (bd_page);
@@ -1789,6 +1795,7 @@ static void nilfs_abort_logs(struct list b_assoc_buffers) {clear_buffer_async_write (bh);if (bh == segbuf->sb_super_root) { +clear_buffer_uptodate (bh);if (bh->b_page != bd_page) {end_page_writeback (bd_page); bd_page = bh->b_page;
fs/nilfs2/super.c +22 -1
@@ -372,10 +372,31 @@ static int nilfs_move_2nd_super(struct s goto out; } nsbp = (void *)nsbh->b_data + offset; -memset (nsbp,0 , nilfs->ns_blocksize); +lock_buffer (nsbh);if (sb2i >=0 ) { +/* +* The position of the second superblock only changes by 4KiB, +* which is larger than the maximum superblock data size +* (= 1KiB), so there is no need to use memmove() to allow +* overlap between source and destination. +*/ memcpy (nsbp, nilfs->ns_sbp[sb2i], nilfs->ns_sbsize); + +/* +* Zero fill after copy to avoid overwriting in case of move +* within the same block. +*/ +memset (nsbh->b_data,0 , offset); +memset ((void *)nsbp + nilfs->ns_sbsize,0 , + nsbh->b_size - offset - nilfs->ns_sbsize); + }else { +memset (nsbh->b_data,0 , nsbh->b_size); + } +set_buffer_uptodate (nsbh); +unlock_buffer (nsbh); + +if (sb2i >=0 ) {brelse (nilfs->ns_sbh[sb2i]); nilfs->ns_sbh[sb2i] = nsbh; nilfs->ns_sbp[sb2i] = nsbp;
Greg Kroah-Hartman
maintainerPATCH 46/170 ACPI: sleep: Avoid breaking S3 wakeup due to might_sleep()
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
commit 22db06337f590d01d79f60f181d8dfe5a9ef9085 upstream.
The addition of might_sleep() to down_timeout() caused the latter to enable interrupts unconditionally in some cases, which in turn broke the ACPI S3 wakeup path in acpi_suspend_enter(), where down_timeout() is called by acpi_disable_all_gpes() via acpi_ut_acquire_mutex().
Namely, if CONFIG_DEBUG_ATOMIC_SLEEP is set, might_sleep() causes might_resched() to be used and if CONFIG_PREEMPT_VOLUNTARY is set, this triggers __cond_resched() which may call preempt_schedule_common(), so __schedule() gets invoked and it ends up with enabled interrupts (in the prev == next case).
Now, enabling interrupts early in the S3 wakeup path causes the kernel to crash.
Address this by modifying acpi_suspend_enter() to disable GPEs without attempting to acquire the sleeping lock which is not needed in that code path anyway.
--- drivers/acpi/acpica/achware.h | 2 -- drivers/acpi/sleep.c | 16 ++++++++++++---- include/acpi/acpixf.h | 1 + 3 files changed, 13 insertions(+), 6 deletions(-)
drivers/acpi/acpica/achware.h +0 -2
@@ -101,8 +101,6 @@ acpi_status acpi_hw_get_gpe_status(struct acpi_gpe_event_info *gpe_event_info, acpi_event_status *event_status); -acpi_status acpi_hw_disable_all_gpes (void ); -acpi_status acpi_hw_enable_all_runtime_gpes (void );acpi_status acpi_hw_enable_all_wakeup_gpes (void );
drivers/acpi/sleep.c +12 -4
@@ -636,11 +636,19 @@ static int acpi_suspend_enter(suspend_st }/* -* Disable and clear GPE status before interrupt is enabled. Some GPEs -* (like wakeup GPE) haven't handler, this can avoid such GPE misfire. -* acpi_leave_sleep_state will reenable specific GPEs later +* Disable all GPE and clear their status bits before interrupts are +* enabled. Some GPEs (like wakeup GPEs) have no handlers and this can +* prevent them from producing spurious interrups. +* +* acpi_leave_sleep_state() will reenable specific GPEs later. +* +* Because this code runs on one CPU with disabled interrupts (all of +* the other CPUs are offline at this time), it need not acquire any +* sleeping locks which may trigger an implicit preemption point even +* if there is no contention, so avoid doing that by using a low-level +* library routine here. */ -acpi_disable_all_gpes (); +acpi_hw_disable_all_gpes ();/* Allow EC transactions to happen. */ acpi_ec_unblock_transactions ();
include/acpi/acpixf.h +1 -0
@@ -751,6 +751,7 @@ ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_sta acpi_event_status *event_status)) ACPI_HW_DEPENDENT_RETURN_UINT32(u32 acpi_dispatch_gpe(acpi_handle gpe_device, u32 gpe_number)) +ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_hw_disable_all_gpes(void)) ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_disable_all_gpes(void)) ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_enable_all_runtime_gpes(void)) ACPI_HW_DEPENDENT_RETURN_STATUS(acpi_status acpi_enable_all_wakeup_gpes(void))
Greg Kroah-Hartman
maintainerPATCH 47/170 KVM: Avoid illegal stage2 mapping on invalid memory slot
In reply to Greg Kroah-HartmanFrom: Gavin Shan <[email protected]>
commit 2230f9e1171a2e9731422a14d1bbc313c0b719d1 upstream.
We run into guest hang in edk2 firmware when KSM is kept as running on the host. The edk2 firmware is waiting for status 0x80 from QEMU's pflash device (TYPE_PFLASH_CFI01) during the operation of sector erasing or buffered write. The status is returned by reading the memory region of the pflash device and the read request should have been forwarded to QEMU and emulated by it. Unfortunately, the read request is covered by an illegal stage2 mapping when the guest hang issue occurs. The read request is completed with QEMU bypassed and wrong status is fetched. The edk2 firmware runs into an infinite loop with the wrong status.
The illegal stage2 mapping is populated due to same page sharing by KSM at (C) even the associated memory slot has been marked as invalid at (B) when the memory slot is requested to be deleted. It's notable that the active and inactive memory slots can't be swapped when we're in the middle of kvm_mmu_notifier_change_pte() because kvm->mn_active_invalidate_count is elevated, and kvm_swap_active_memslots() will busy loop until it reaches to zero again. Besides, the swapping from the active to the inactive memory slots is also avoided by holding &kvm->srcu in __kvm_handle_hva_range(), corresponding to synchronize_srcu_expedited() in kvm_swap_active_memslots().
CPU-A CPU-B
----- -----
ioctl(kvm_fd, KVM_SET_USER_MEMORY_REGION) kvm_vm_ioctl_set_memory_region kvm_set_memory_region __kvm_set_memory_region kvm_set_memslot(kvm, old, NULL, KVM_MR_DELETE)
kvm_invalidate_memslot
kvm_copy_memslot kvm_replace_memslot
kvm_swap_active_memslots (A)
kvm_arch_flush_shadow_memslot (B)
same page sharing by KSM kvm_mmu_notifier_invalidate_range_start
:
kvm_mmu_notifier_change_pte
kvm_handle_hva_range
__kvm_handle_hva_range
kvm_set_spte_gfn (C)
: kvm_mmu_notifier_invalidate_range_end
Fix the issue by skipping the invalid memory slot at (C) to avoid the illegal stage2 mapping so that the read request for the pflash's status is forwarded to QEMU and emulated by it. In this way, the correct pflash's status can be returned from QEMU to break the infinite loop in the edk2 firmware.
We tried a git-bisect and the first problematic commit is cd4c71835228 ("
KVM: arm64: Convert to the gfn-based MMU notifier callbacks"). With this, clean_dcache_guest_page() is called after the memory slots are iterated in kvm_mmu_notifier_change_pte(). clean_dcache_guest_page() is called before the iteration on the memory slots before this commit. This change literally enlarges the racy window between kvm_mmu_notifier_change_pte() and memory slot removal so that we're able to reproduce the issue in a practical test case. However, the issue exists since commit d5d8184d35c9 ("KVM: ARM: Memory virtualization setup").
Message-Id: <[email protected]>
--- virt/kvm/kvm_main.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-)
virt/kvm/kvm_main.c +19 -1
@@ -691,6 +691,24 @@ static __always_inline int kvm_handle_hvreturn __kvm_handle_hva_range (kvm, &range); } + +static bool kvm_change_spte_gfn (struct kvm *kvm,struct kvm_gfn_range *range) +{ +/* +* Skipping invalid memslots is correct if and only change_pte() is +* surrounded by invalidate_range_{start,end}(), which is currently +* guaranteed by the primary MMU. If that ever changes, KVM needs to +* unmap the memslot instead of skipping the memslot to ensure that KVM +* doesn't hold references to the old PFN. +*/ +WARN_ON_ONCE (!READ_ONCE (kvm->mn_active_invalidate_count)); + +if (range->slot->flags &KVM_MEMSLOT_INVALID ) +return false; + +return kvm_set_spte_gfn (kvm, range); +} + static void kvm_mmu_notifier_change_pte(struct mmu_notifier *mn, struct mm_struct *mm, unsigned long address,
@@ -712,7 +730,7 @@ static void kvm_mmu_notifier_change_pte(if (!READ_ONCE (kvm->mmu_invalidate_in_progress))return ; -kvm_handle_hva_range (mn, address, address +1 , pte, kvm_set_spte_gfn); +kvm_handle_hva_range (mn, address, address +1 , pte, kvm_change_spte_gfn); } void kvm_mmu_invalidate_begin(struct kvm *kvm, unsigned long start,
Greg Kroah-Hartman
maintainerPATCH 48/170 Drivers: hv: vmbus: Call hv_synic_free() if hv_synic_alloc() fails
In reply to Greg Kroah-HartmanFrom: Dexuan Cui <[email protected]>
commit ec97e112985c2581ee61854a4b74f080f6cdfc2c upstream.
Commit 572086325ce9 ("Drivers: hv: vmbus: Cleanup synic memory free path") says "Any memory allocations that succeeded will be freed when the caller cleans up by calling hv_synic_free()", but if the get_zeroed_page() in hv_synic_alloc() fails, currently hv_synic_free() is not really called in vmbus_bus_init(), consequently there will be a memory leak, e.g. hv_context.hv_numa_map is not freed in the error path. Fix this by updating the goto labels.
--- drivers/hv/vmbus_drv.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/hv/vmbus_drv.c +2 -3
@@ -1504,7 +1504,7 @@ static int vmbus_bus_init(void) ret =cpuhp_setup_state (CPUHP_AP_ONLINE_DYN ,"hyperv/vmbus:online" , hv_synic_init, hv_synic_cleanup);if (ret <0 ) - goto err_cpuhp; + goto err_alloc; hyperv_cpuhp_online = ret; ret =vmbus_connect ();
@@ -1555,9 +1555,8 @@ static int vmbus_bus_init(void) err_connect:cpuhp_remove_state (hyperv_cpuhp_online); -err_cpuhp: -hv_synic_free (); err_alloc: +hv_synic_free ();if (vmbus_irq ==-1 ) {hv_remove_vmbus_handler (); }else {
Greg Kroah-Hartman
maintainerPATCH 49/170 Drivers: hv: vmbus: Fix vmbus_wait_for_unload() to scan present CPUs
In reply to Greg Kroah-HartmanFrom: Michael Kelley <[email protected]>
commit 320805ab61e5f1e2a5729ae266e16bec2904050c upstream.
vmbus_wait_for_unload() may be called in the panic path after other CPUs are stopped. vmbus_wait_for_unload() currently loops through online CPUs looking for the UNLOAD response message. But the values of CONFIG_KEXEC_CORE and crash_kexec_post_notifiers affect the path used to stop the other CPUs, and in one of the paths the stopped CPUs are removed from cpu_online_mask. This removal happens in both x86/x64 and arm64 architectures. In such a case, vmbus_wait_for_unload() only checks the panic'ing CPU, and misses the UNLOAD response message except when the panic'ing CPU is CPU 0. vmbus_wait_for_unload() eventually times out, but only after waiting 100 seconds.
Fix this by looping through *present* CPUs in vmbus_wait_for_unload(). The cpu_present_mask is not modified by stopping the other CPUs in the panic path, nor should it be.
Also, in a CoCo VM the synic_message_page is not allocated in hv_synic_alloc(), but is set and cleared in hv_synic_enable_regs() and hv_synic_disable_regs() such that it is set only when the CPU is online. If not all present CPUs are online when vmbus_wait_for_unload() is called, the synic_message_page might be NULL. Add a check for this.
--- drivers/hv/channel_mgmt.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
drivers/hv/channel_mgmt.c +16 -2
@@ -829,11 +829,22 @@ static void vmbus_wait_for_unload(void)if (completion_done (&vmbus_connection.unload_event)) goto completed; -for_each_online_cpu (cpu) { +for_each_present_cpu (cpu) {struct hv_per_cpu_context *hv_cpu =per_cpu_ptr (hv_context.cpu_context, cpu); +/* +* In a CoCo VM the synic_message_page is not allocated +* in hv_synic_alloc(). Instead it is set/cleared in +* hv_synic_enable_regs() and hv_synic_disable_regs() +* such that it is set only when the CPU is online. If +* not all present CPUs are online, the message page +* might be NULL, so skip such CPUs. +*/ page_addr = hv_cpu->synic_message_page; +if (!page_addr) +continue ; + msg = (struct hv_message *)page_addr +VMBUS_MESSAGE_SINT ;
@@ -867,11 +878,14 @@ completed:* maybe-pending messages on all CPUs to be able to receive new * messages after we reconnect. */ -for_each_online_cpu (cpu) { +for_each_present_cpu (cpu) {struct hv_per_cpu_context *hv_cpu =per_cpu_ptr (hv_context.cpu_context, cpu); page_addr = hv_cpu->synic_message_page; +if (!page_addr) +continue ; + msg = (struct hv_message *)page_addr +VMBUS_MESSAGE_SINT ; msg->header.message_type =HVMSG_NONE ; }
Greg Kroah-Hartman
maintainerPATCH 50/170 PCI: hv: Fix a race condition bug in hv_pci_query_relations()
In reply to Greg Kroah-HartmanFrom: Dexuan Cui <[email protected]>
commit 440b5e3663271b0ffbd4908115044a6a51fb938b upstream.
Since day 1 of the driver, there has been a race between hv_pci_query_relations() and survey_child_resources(): during fast device hotplug, hv_pci_query_relations() may error out due to device-remove and the stack variable 'comp' is no longer valid; however, pci_devices_present_work() -> survey_child_resources() -> complete() may be running on another CPU and accessing the no-longer-valid 'comp'. Fix the race by flushing the workqueue before we exit from hv_pci_query_relations().
--- drivers/pci/controller/pci-hyperv.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/pci/controller/pci-hyperv.c +18 -0
@@ -3321,6 +3321,24 @@ static int hv_pci_query_relations(structif (!ret) ret =wait_for_response (hdev, &comp); +/* +* In the case of fast device addition/removal, it's possible that +* vmbus_sendpacket() or wait_for_response() returns -ENODEV but we +* already got a PCI_BUS_RELATIONS* message from the host and the +* channel callback already scheduled a work to hbus->wq, which can be +* running pci_devices_present_work() -> survey_child_resources() -> +* complete(&hbus->survey_event), even after hv_pci_query_relations() +* exits and the stack variable 'comp' is no longer valid; as a result, +* a hang or a page fault may happen when the complete() calls +* raw_spin_lock_irqsave(). Flush hbus->wq before we exit from +* hv_pci_query_relations() to avoid the issues. Note: if 'ret' is +* -ENODEV, there can't be any more work item scheduled to hbus->wq +* after the flush_workqueue(): see vmbus_onoffer_rescind() -> +* vmbus_reset_channel_cb(), vmbus_rescind_cleanup() -> +* channel->rescind = true. +*/ +flush_workqueue (hbus->wq); +return ret; }
Greg Kroah-Hartman
maintainerPATCH 51/170 Revert "PCI: hv: Fix a timing issue which causes kdump to fail occasionally"
In reply to Greg Kroah-HartmanFrom: Dexuan Cui <[email protected]>
commit a847234e24d03d01a9566d1d9dcce018cc018d67 upstream.
This reverts commit d6af2ed29c7c1c311b96dac989dcb991e90ee195.
The statement "the hv_pci_bus_exit() call releases structures of all its child devices" in commit d6af2ed29c7c is not true: in the path hv_pci_probe() -> hv_pci_enter_d0() -> hv_pci_bus_exit(hdev, true): the parameter "keep_devs" is true, so hv_pci_bus_exit() does *not* release the child "struct hv_pci_dev *hpdev" that is created earlier in pci_devices_present_work() -> new_pcichild_device().
The commit d6af2ed29c7c was originally made in July 2020 for RHEL 7.7, where the old version of hv_pci_bus_exit() was used; when the commit was rebased and merged into the upstream, people didn't notice that it's not really necessary. The commit itself doesn't cause any issue, but it makes hv_pci_probe() more complicated. Revert it to facilitate some upcoming changes to hv_pci_probe().
--- drivers/pci/controller/pci-hyperv.c | 71 +++++++++++++++++------------------- 1 file changed, 34 insertions(+), 37 deletions(-)
drivers/pci/controller/pci-hyperv.c +34 -37
@@ -3251,8 +3251,10 @@ static int hv_pci_enter_d0(struct hv_devstruct pci_bus_d0_entry *d0_entry;struct hv_pci_compl comp_pkt;struct pci_packet *pkt; +bool retry = true;int ret; +enter_d0_retry:/* * Tell the host that the bus is ready to use, and moved into the * powered-on state. This includes telling the host which region
@@ -3279,6 +3281,38 @@ static int hv_pci_enter_d0(struct hv_devif (ret) goto exit; +/* +* In certain case (Kdump) the pci device of interest was +* not cleanly shut down and resource is still held on host +* side, the host could return invalid device status. +* We need to explicitly request host to release the resource +* and try to enter D0 again. +*/ +if (comp_pkt.completion_status <0 && retry) { + retry = false; + +dev_err (&hdev->device,"Retrying D0 Entry\n" ); + +/* +* Hv_pci_bus_exit() calls hv_send_resource_released() +* to free up resources of its child devices. +* In the kdump kernel we need to set the +* wslot_res_allocated to 255 so it scans all child +* devices to release resources allocated in the +* normal kernel before panic happened. +*/ + hbus->wslot_res_allocated =255 ; + + ret =hv_pci_bus_exit (hdev, true); + +if (ret ==0 ) { +kfree (pkt); + goto enter_d0_retry; + } +dev_err (&hdev->device, +"Retrying D0 failed with ret %d\n" , ret); + } +if (comp_pkt.completion_status <0 ) { dev_err(&hdev->device, "PCI Pass-through VSP failed D0 Entry with status %x\n",
@@ -3524,7 +3558,6 @@ static int hv_pci_probe(struct hv_devicestruct hv_pcibus_device *hbus;u16 dom_req, dom;char *name; -bool enter_d0_retry = true;int ret;/*
@@ -3664,47 +3697,11 @@ static int hv_pci_probe(struct hv_deviceif (ret) goto free_fwnode; -retry: ret =hv_pci_query_relations (hdev);if (ret) goto free_irq_domain; ret =hv_pci_enter_d0 (hdev); -/* -* In certain case (Kdump) the pci device of interest was -* not cleanly shut down and resource is still held on host -* side, the host could return invalid device status. -* We need to explicitly request host to release the resource -* and try to enter D0 again. -* Since the hv_pci_bus_exit() call releases structures -* of all its child devices, we need to start the retry from -* hv_pci_query_relations() call, requesting host to send -* the synchronous child device relations message before this -* information is needed in hv_send_resources_allocated() -* call later. -*/ -if (ret == -EPROTO && enter_d0_retry) { - enter_d0_retry = false; - -dev_err (&hdev->device,"Retrying D0 Entry\n" ); - -/* -* Hv_pci_bus_exit() calls hv_send_resources_released() -* to free up resources of its child devices. -* In the kdump kernel we need to set the -* wslot_res_allocated to 255 so it scans all child -* devices to release resources allocated in the -* normal kernel before panic happened. -*/ - hbus->wslot_res_allocated =255 ; - ret =hv_pci_bus_exit (hdev, true); - -if (ret ==0 ) - goto retry; - -dev_err (&hdev->device, -"Retrying D0 failed with ret %d\n" , ret); - }if (ret) goto free_irq_domain;
Greg Kroah-Hartman
maintainerPATCH 52/170 PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev
In reply to Greg Kroah-HartmanFrom: Dexuan Cui <[email protected]>
commit add9195e69c94b32e96f78c2f9cea68f0e850b3f upstream.
The hpdev->state is never really useful. The only use in hv_pci_eject_device() and hv_eject_device_work() is not really necessary.
--- drivers/pci/controller/pci-hyperv.c | 12 ------------ 1 file changed, 12 deletions(-)
drivers/pci/controller/pci-hyperv.c +0 -12
@@ -553,19 +553,10 @@ struct hv_dr_state {struct hv_pcidev_description func[]; }; -enum hv_pcichild_state { - hv_pcichild_init =0 , - hv_pcichild_requirements, - hv_pcichild_resourced, - hv_pcichild_ejecting, - hv_pcichild_maximum -}; -struct hv_pci_dev {/* List protected by pci_rescan_remove_lock */ struct list_head list_entry;refcount_t refs; -enum hv_pcichild_state state;struct pci_slot *pci_slot;struct hv_pcidev_description desc;bool reported_missing;
@@ -2764,8 +2755,6 @@ static void hv_eject_device_work(struct hpdev = container_of(work, struct hv_pci_dev, wrk); hbus = hpdev->hbus; -WARN_ON (hpdev->state != hv_pcichild_ejecting); -/* * Ejection can come before or after the PCI bus has been set up, so * attempt to find it and tear down the bus state, if it exists. This
@@ -2822,7 +2811,6 @@ static void hv_pci_eject_device(struct hreturn ; } - hpdev->state = hv_pcichild_ejecting;get_pcichild (hpdev);INIT_WORK (&hpdev->wrk, hv_eject_device_work);queue_work (hbus->wq, &hpdev->wrk);
Greg Kroah-Hartman
maintainerPATCH 53/170 PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic
In reply to Greg Kroah-HartmanFrom: Dexuan Cui <[email protected]>
commit 2738d5ab7929a845b654cd171a1e275c37eb428e upstream.
When the host tries to remove a PCI device, the host first sends a PCI_EJECT message to the guest, and the guest is supposed to gracefully remove the PCI device and send a PCI_EJECTION_COMPLETE message to the host; the host then sends a VMBus message CHANNELMSG_RESCIND_CHANNELOFFER to the guest (when the guest receives this message, the device is already unassigned from the guest) and the guest can do some final cleanup work; if the guest fails to respond to the PCI_EJECT message within one minute, the host sends the VMBus message CHANNELMSG_RESCIND_CHANNELOFFER and removes the PCI device forcibly.
In the case of fast device addition/removal, it's possible that the PCI device driver is still configuring MSI-X interrupts when the guest receives the PCI_EJECT message; the channel callback calls hv_pci_eject_device(), which sets hpdev->state to hv_pcichild_ejecting, and schedules a work hv_eject_device_work(); if the PCI device driver is calling pci_alloc_irq_vectors() -> ... -> hv_compose_msi_msg(), we can break the while loop in hv_compose_msi_msg() due to the updated hpdev->state, and leave data->chip_data with its default value of NULL; later, when the PCI device driver calls request_irq() -> ... -> hv_irq_unmask(), the guest crashes in hv_arch_irq_unmask() due to data->chip_data being NULL.
Fix the issue by not testing hpdev->state in the while loop: when the guest receives PCI_EJECT, the device is still assigned to the guest, and the guest has one minute to finish the device removal gracefully. We don't really need to (and we should not) test hpdev->state in the loop.
--- drivers/pci/controller/pci-hyperv.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
drivers/pci/controller/pci-hyperv.c +5 -6
@@ -647,6 +647,11 @@ static void hv_arch_irq_unmask(struct ir pbus = pdev->bus; hbus = container_of(pbus->sysdata, struct hv_pcibus_device, sysdata); int_desc = data->chip_data; +if (!int_desc) { +dev_warn (&hbus->hdev->device,"%s() can not unmask irq %u\n" , + __func__, data->irq); +return ; + }spin_lock_irqsave (&hbus->retarget_msi_interrupt_lock, flags);
@@ -1915,12 +1920,6 @@ static void hv_compose_msi_msg(struct irhv_pci_onchannelcallback (hbus);spin_unlock_irqrestore (&channel->sched_lock, flags); -if (hpdev->state == hv_pcichild_ejecting) { -dev_err_once (&hbus->hdev->device, -"the device is being ejected\n" ); - goto enable_tasklet; - } -udelay (100 ); }
Greg Kroah-Hartman
maintainerPATCH 54/170 PCI: hv: Add a per-bus mutex state_lock
In reply to Greg Kroah-HartmanFrom: Dexuan Cui <[email protected]>
commit 067d6ec7ed5b49380688e06c1e5f883a71bef4fe upstream.
In the case of fast device addition/removal, it's possible that hv_eject_device_work() can start to run before create_root_hv_pci_bus() starts to run; as a result, the pci_get_domain_bus_and_slot() in hv_eject_device_work() can return a 'pdev' of NULL, and hv_eject_device_work() can remove the 'hpdev', and immediately send a message PCI_EJECTION_COMPLETE to the host, and the host immediately unassigns the PCI device from the guest; meanwhile, create_root_hv_pci_bus() and the PCI device driver can be probing the dead PCI device and reporting timeout errors.
Fix the issue by adding a per-bus mutex 'state_lock' and grabbing the mutex before powering on the PCI bus in hv_pci_enter_d0(): when hv_eject_device_work() starts to run, it's able to find the 'pdev' and call pci_stop_and_remove_bus_device(pdev): if the PCI device driver has loaded, the PCI device driver's probe() function is already called in create_root_hv_pci_bus() -> pci_bus_add_devices(), and now hv_eject_device_work() -> pci_stop_and_remove_bus_device() is able to call the PCI device driver's remove() function and remove the device reliably; if the PCI device driver hasn't loaded yet, the function call hv_eject_device_work() -> pci_stop_and_remove_bus_device() is able to remove the PCI device reliably and the PCI device driver's probe() function won't be called; if the PCI device driver's probe() is already running (e.g., systemd-udev is loading the PCI device driver), it must be holding the per-device lock, and after the probe() finishes and releases the lock, hv_eject_device_work() -> pci_stop_and_remove_bus_device() is able to proceed to remove the device reliably.
--- drivers/pci/controller/pci-hyperv.c | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-)
drivers/pci/controller/pci-hyperv.c +26 -3
@@ -489,7 +489,10 @@ struct hv_pcibus_device {struct fwnode_handle *fwnode;/* Protocol version negotiated with the host */ enum pci_protocol_version_t protocol_version; + +struct mutex state_lock;enum hv_pcibus_state state; +struct hv_device *hdev;resource_size_t low_mmio_space;resource_size_t high_mmio_space;
@@ -2525,6 +2528,8 @@ static void pci_devices_present_work(strif (!dr)return ; +mutex_lock (&hbus->state_lock); +/* First, mark all existing children as reported missing. */ spin_lock_irqsave (&hbus->device_list_lock, flags);list_for_each_entry (hpdev, &hbus->children, list_entry) {
@@ -2606,6 +2611,8 @@ static void pci_devices_present_work(strbreak ; } +mutex_unlock (&hbus->state_lock); +kfree (dr); }
@@ -2754,6 +2761,8 @@ static void hv_eject_device_work(struct hpdev = container_of(work, struct hv_pci_dev, wrk); hbus = hpdev->hbus; +mutex_lock (&hbus->state_lock); +/* * Ejection can come before or after the PCI bus has been set up, so * attempt to find it and tear down the bus state, if it exists. This
@@ -2790,6 +2799,8 @@ static void hv_eject_device_work(structput_pcichild (hpdev);put_pcichild (hpdev);/* hpdev has been freed. Do not use it any more. */ + +mutex_unlock (&hbus->state_lock); }/**
@@ -3580,6 +3591,7 @@ static int hv_pci_probe(struct hv_devicereturn -ENOMEM ; hbus->bridge = bridge; +mutex_init (&hbus->state_lock); hbus->state = hv_pcibus_init; hbus->wslot_res_allocated =-1 ;
@@ -3688,9 +3700,11 @@ static int hv_pci_probe(struct hv_deviceif (ret) goto free_irq_domain; +mutex_lock (&hbus->state_lock); + ret =hv_pci_enter_d0 (hdev);if (ret) - goto free_irq_domain; + goto release_state_lock; ret =hv_pci_allocate_bridge_windows (hbus);if (ret)
@@ -3708,12 +3722,15 @@ static int hv_pci_probe(struct hv_deviceif (ret) goto free_windows; +mutex_unlock (&hbus->state_lock);return 0 ; free_windows:hv_pci_free_bridge_windows (hbus); exit_d0: (void )hv_pci_bus_exit (hdev, true); +release_state_lock: +mutex_unlock (&hbus->state_lock); free_irq_domain:irq_domain_remove (hbus->irq_domain); free_fwnode:
@@ -3967,20 +3984,26 @@ static int hv_pci_resume(struct hv_devicif (ret) goto out; +mutex_lock (&hbus->state_lock); + ret =hv_pci_enter_d0 (hdev);if (ret) - goto out; + goto release_state_lock; ret =hv_send_resources_allocated (hdev);if (ret) - goto out; + goto release_state_lock;prepopulate_bars (hbus);hv_pci_restore_msi_state (hbus); hbus->state = hv_pcibus_installed; +mutex_unlock (&hbus->state_lock);return 0 ; + +release_state_lock: +mutex_unlock (&hbus->state_lock); out:vmbus_close (hdev->channel);return ret;
Greg Kroah-Hartman
maintainerPATCH 55/170 io_uring/net: clear msg_controllen on partial sendmsg retry
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
commit b1dc492087db0f2e5a45f1072a743d04618dd6be upstream.
If we have cmsg attached AND we transferred partial data at least, clear msg_controllen on retry so we don't attempt to send that again.
--- io_uring/net.c | 2 ++ 1 file changed, 2 insertions(+)
io_uring/net.c +2 -0
@@ -313,6 +313,8 @@ int io_sendmsg(struct io_kiocb *req, unsif (ret == -EAGAIN && (issue_flags &IO_URING_F_NONBLOCK ))return io_setup_async_msg (req, kmsg, issue_flags);if (ret >0 &&io_net_retry (sock, flags)) { + kmsg->msg.msg_controllen =0 ; + kmsg->msg.msg_control =NULL ; sr->done_io += ret; req->flags |=REQ_F_PARTIAL_IO ;return io_setup_async_msg (req, kmsg, issue_flags);
Greg Kroah-Hartman
maintainerPATCH 56/170 io_uring/net: disable partial retries for recvmsg with cmsg
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
commit 78d0d2063bab954d19a1696feae4c7706a626d48 upstream.
We cannot sanely handle partial retries for recvmsg if we have cmsg attached. If we don't, then we'd just be overwriting the initial cmsg header on retries. Alternatively we could increment and handle this appropriately, but it doesn't seem worth the complication.
Move the MSG_WAITALL check into the non-multishot case while at it, since MSG_WAITALL is explicitly disabled for multishot anyway.
--- io_uring/net.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
io_uring/net.c +7 -4
@@ -781,16 +781,19 @@ retry_multishot: flags = sr->msg_flags;if (force_nonblock) flags |=MSG_DONTWAIT ; -if (flags &MSG_WAITALL ) - min_ret =iov_iter_count (&kmsg->msg.msg_iter); kmsg->msg.msg_get_inq =1 ; -if (req->flags &REQ_F_APOLL_MULTISHOT ) +if (req->flags &REQ_F_APOLL_MULTISHOT ) { ret =io_recvmsg_multishot (sock, sr, kmsg, flags, &mshot_finished); -else + }else { +/* disable partial retry for recvmsg with cmsg attached */ +if (flags &MSG_WAITALL && !kmsg->msg.msg_controllen) + min_ret =iov_iter_count (&kmsg->msg.msg_iter); + ret =__sys_recvmsg_sock (sock, &kmsg->msg, sr->umsg, kmsg->uaddr, flags); + }if (ret < min_ret) {if (ret == -EAGAIN && force_nonblock) {
Greg Kroah-Hartman
maintainerPATCH 57/170 mptcp: handle correctly disconnect() failures
In reply to Greg Kroah-HartmanFrom: Paolo Abeni <[email protected]>
commit c2b2ae3925b65070adb27d5a31a31c376f26dec7 upstream.
Currently the mptcp code has assumes that disconnect() can fail only at mptcp_sendmsg_fastopen() time - to avoid a deadlock scenario - and don't even bother returning an error code.
Soon mptcp_disconnect() will handle more error conditions: let's track them explicitly.
As a bonus, explicitly annotate TCP-level disconnect as not failing:
the mptcp code never blocks for event on the subflows.
--- net/mptcp/protocol.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)
net/mptcp/protocol.c +14 -6
@@ -1708,7 +1708,13 @@ static int mptcp_sendmsg_fastopen(structif (ret && ret != -EINPROGRESS && ret != -ERESTARTSYS && ret != -EINTR ) *copied_syn =0 ; }else if (ret && ret != -EINPROGRESS ) { -mptcp_disconnect (sk,0 ); +/* The disconnect() op called by tcp_sendmsg_fastopen()/ +* __inet_stream_connect() can fail, due to looking check, +* see mptcp_disconnect(). +* Attempt it again outside the problematic scope. +*/ +if (!mptcp_disconnect (sk,0 )) + sk->sk_socket->state =SS_UNCONNECTED ; }return ret;
@@ -2375,7 +2381,10 @@ static void __mptcp_close_ssk(struct soc need_push = (flags &MPTCP_CF_PUSH ) &&__mptcp_retransmit_pending_data (sk);if (!dispose_it) { -tcp_disconnect (ssk,0 ); +/* The MPTCP code never wait on the subflow sockets, TCP-level +* disconnect should never fail +*/ +WARN_ON_ONCE (tcp_disconnect (ssk,0 )); msk->subflow->state =SS_UNCONNECTED ;mptcp_subflow_ctx_reset (subflow);release_sock (ssk);
@@ -2799,7 +2808,7 @@ void mptcp_subflow_shutdown(struct sockbreak ; fallthrough;case TCP_SYN_SENT : -tcp_disconnect (ssk,O_NONBLOCK ); +WARN_ON_ONCE (tcp_disconnect (ssk,O_NONBLOCK ));break ;default :if (__mptcp_check_fallback (mptcp_sk (sk))) {
@@ -3053,11 +3062,10 @@ static int mptcp_disconnect(struct sock/* We are on the fastopen error path. We can't call straight into the * subflows cleanup code due to lock nesting (we are already under -* msk->firstsocket lock). Do nothing and leave the cleanup to the -* caller. +* msk->firstsocket lock). */ if (msk->fastopening) -return 0 ; +return -EBUSY ;inet_sk_state_store (sk,TCP_CLOSE );
Greg Kroah-Hartman
maintainerPATCH 58/170 mptcp: fix possible divide by zero in recvmsg()
In reply to Greg Kroah-HartmanFrom: Paolo Abeni <[email protected]>
commit 0ad529d9fd2bfa3fc619552a8d2fb2f2ef0bce2e upstream.
Christoph reported a divide by zero bug in mptcp_recvmsg():
divide error: 0000 [#1] PREEMPT SMP
CPU: 1 PID: 19978 Comm: syz-executor.6 Not tainted 6.4.0-rc2-gffcc7899081b #20 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 RIP: 0010:__tcp_select_window+0x30e/0x420 net/ipv4/tcp_output.c:3018 Code: 11 ff 0f b7 cd c1 e9 0c b8 ff ff ff ff d3 e0 89 c1 f7 d1 01 cb 21 c3 eb 17 e8 2e 83 11 ff 31 db eb 0e e8 25 83 11 ff 89 d8 99 <f7> 7c 24 04 29 d3 65 48 8b 04 25 28 00 00 00 48 3b 44 24 10 75 60 RSP: 0018:ffffc90000a07a18 EFLAGS: 00010246 RAX: 000000000000ffd7 RBX: 000000000000ffd7 RCX: 0000000000040000 RDX: 0000000000000000 RSI: 000000000003ffff RDI: 0000000000040000 RBP: 000000000000ffd7 R08: ffffffff820cf297 R09: 0000000000000001 R10: 0000000000000000 R11: ffffffff8103d1a0 R12: 0000000000003f00 R13: 0000000000300000 R14: ffff888101cf3540 R15: 0000000000180000 FS: 00007f9af4c09640(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b33824000 CR3: 000000012f241001 CR4: 0000000000170ee0 Call Trace: <TASK> __tcp_cleanup_rbuf+0x138/0x1d0 net/ipv4/tcp.c:1611 mptcp_recvmsg+0xcb8/0xdd0 net/mptcp/protocol.c:2034 inet_recvmsg+0x127/0x1f0 net/ipv4/af_inet.c:861 ____sys_recvmsg+0x269/0x2b0 net/socket.c:1019 ___sys_recvmsg+0xe6/0x260 net/socket.c:2764 do_recvmmsg+0x1a5/0x470 net/socket.c:2858 __do_sys_recvmmsg net/socket.c:2937 [inline] __se_sys_recvmmsg net/socket.c:2953 [inline] __x64_sys_recvmmsg+0xa6/0x130 net/socket.c:2953 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x47/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f9af58fc6a9 Code: 5c c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 4f 37 0d 00 f7 d8 64 89 01 48 RSP: 002b:00007f9af4c08cd8 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 00000000006bc050 RCX: 00007f9af58fc6a9 RDX: 0000000000000001 RSI: 0000000020000140 RDI: 0000000000000004 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000f00 R11: 0000000000000246 R12: 00000000006bc05c R13: fffffffffffffea8 R14: 00000000006bc050 R15: 000000000001fe40 </TASK>
mptcp_recvmsg is allowed to release the msk socket lock when blocking, and before re-acquiring it another thread could have switched the sock to TCP_LISTEN status - with a prior connect(AF_UNSPEC) - also clearing icsk_ack.rcv_mss.
Address the issue preventing the disconnect if some other process is concurrently performing a blocking syscall on the same socket, alike commit 4faeee0cf8a5 ("tcp: deny tcp_disconnect() when threads are waiting").
--- net/mptcp/protocol.c | 7 +++++++ 1 file changed, 7 insertions(+)
net/mptcp/protocol.c +7 -0
@@ -3060,6 +3060,12 @@ static int mptcp_disconnect(struct sock {struct mptcp_sock *msk =mptcp_sk (sk); +/* Deny disconnect if other threads are blocked in sk_wait_event() +* or inet_wait_for_connect(). +*/ +if (sk->sk_wait_pending) +return -EBUSY ; +/* We are on the fastopen error path. We can't call straight into the * subflows cleanup code due to lock nesting (we are already under * msk->firstsocket lock).
@@ -3126,6 +3132,7 @@ struct sock *mptcp_sk_clone_init(const sinet_sk (nsk)->pinet6 =mptcp_inet6_sk (nsk);#endif + nsk->sk_wait_pending =0 ;__mptcp_init_sock (nsk); msk =mptcp_sk (nsk);
Greg Kroah-Hartman
maintainerPATCH 59/170 mptcp: fix possible list corruption on passive MPJ
In reply to Greg Kroah-HartmanFrom: Paolo Abeni <[email protected]>
commit 56a666c48b038e91b76471289e2cf60c79d326b9 upstream.
At passive MPJ time, if the msk socket lock is held by the user, the new subflow is appended to the msk->join_list under the msk data lock.
In mptcp_release_cb()/__mptcp_flush_join_list(), the subflows in that list are moved from the join_list into the conn_list under the msk socket lock.
Append and removal could race, possibly corrupting such list. Address the issue splicing the join list into a temporary one while still under the msk data lock.
Found by code inspection, the race itself should be almost impossible to trigger in practice.
--- net/mptcp/protocol.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
net/mptcp/protocol.c +9 -3
@@ -846,12 +846,12 @@ static bool __mptcp_finish_join(struct mreturn true; } -static void __mptcp_flush_join_list (struct sock *sk) +static void __mptcp_flush_join_list (struct sock *sk,struct list_head *join_list) {struct mptcp_subflow_context *tmp, *subflow;struct mptcp_sock *msk =mptcp_sk (sk); -list_for_each_entry_safe (subflow, tmp, &msk->join_list, node) { +list_for_each_entry_safe (subflow, tmp, join_list, node) {struct sock *ssk =mptcp_subflow_tcp_sock (subflow);bool slow =lock_sock_fast (ssk);
@@ -3335,9 +3335,14 @@ static void mptcp_release_cb(struct sockfor (;;) {unsigned long flags = (msk->cb_flags &MPTCP_FLAGS_PROCESS_CTX_NEED ) | msk->push_pending; +struct list_head join_list; +if (!flags)break ; +INIT_LIST_HEAD (&join_list); +list_splice_init (&msk->join_list, &join_list); +/* the following actions acquire the subflow socket lock * * 1) can't be invoked in atomic scope
@@ -3348,8 +3353,9 @@ static void mptcp_release_cb(struct sock msk->push_pending =0 ; msk->cb_flags &= ~flags;spin_unlock_bh (&sk->sk_lock.slock); +if (flags &BIT (MPTCP_FLUSH_JOIN_LIST )) -__mptcp_flush_join_list (sk); +__mptcp_flush_join_list (sk, &join_list);if (flags &BIT (MPTCP_PUSH_PENDING ))__mptcp_push_pending (sk,0 );if (flags &BIT (MPTCP_RETRANSMIT ))
Greg Kroah-Hartman
maintainerPATCH 60/170 mptcp: consolidate fallback and non fallback state machine
In reply to Greg Kroah-HartmanFrom: Paolo Abeni <[email protected]>
commit 81c1d029016001f994ce1c46849c5e9900d8eab8 upstream.
An orphaned msk releases the used resources via the worker, when the latter first see the msk in CLOSED status.
If the msk status transitions to TCP_CLOSE in the release callback invoked by the worker's final release_sock(), such instance of the workqueue will not take any action.
Additionally the MPTCP code prevents scheduling the worker once the socket reaches the CLOSE status: such msk resources will be leaked.
The only code path that can trigger the above scenario is the __mptcp_check_send_data_fin() in fallback mode.
Address the issue removing the special handling of fallback socket in __mptcp_check_send_data_fin(), consolidating the state machine for fallback and non fallback socket.
Since non-fallback sockets do not send and do not receive data_fin, the mptcp code can update the msk internal status to match the next step in the SM every time data fin (ack) should be generated or received.
As a consequence we can remove a bunch of checks for fallback from the fastpath.
--- net/mptcp/protocol.c | 41 +++++++++++++++-------------------------- net/mptcp/subflow.c | 17 ++++++++++------- 2 files changed, 25 insertions(+), 33 deletions(-)
net/mptcp/protocol.c +15 -26
@@ -53,7 +53,7 @@ enum {static struct percpu_counter mptcp_sockets_allocated____cacheline_aligned_in_smp ;static void __mptcp_destroy_sock (struct sock *sk); -static void __mptcp_check_send_data_fin (struct sock *sk); +static void mptcp_check_send_data_fin (struct sock *sk); DEFINE_PER_CPU(struct mptcp_delegated_action, mptcp_delegated_actions);static struct net_device mptcp_napi_dev;
@@ -420,8 +420,7 @@ static bool mptcp_pending_data_fin_ack(s {struct mptcp_sock *msk =mptcp_sk (sk); -return !__mptcp_check_fallback (msk) && - ((1 << sk->sk_state) & +return ((1 << sk->sk_state) & (TCPF_FIN_WAIT1 |TCPF_CLOSING |TCPF_LAST_ACK )) && msk->write_seq ==READ_ONCE (msk->snd_una); }
@@ -579,9 +578,6 @@ static bool mptcp_check_data_fin(structu64 rcv_data_fin_seq;bool ret = false; -if (__mptcp_check_fallback (msk)) -return ret; -/* Need to ack a DATA_FIN received from a peer while this side * of the connection is in ESTABLISHED, FIN_WAIT1, or FIN_WAIT2. * msk->rcv_data_fin was set when parsing the incoming options
@@ -619,7 +615,8 @@ static bool mptcp_check_data_fin(struct } ret = true; -mptcp_send_ack (msk); +if (!__mptcp_check_fallback (msk)) +mptcp_send_ack (msk);mptcp_close_wake_up (sk); }return ret;
@@ -1606,7 +1603,7 @@ out:if (!mptcp_timer_pending (sk))mptcp_reset_timer (sk);if (do_check_data_fin) -__mptcp_check_send_data_fin (sk); +mptcp_check_send_data_fin (sk); }static void __mptcp_subflow_push_pending (struct sock *sk,struct sock *ssk)
@@ -2665,8 +2662,6 @@ static void mptcp_worker(struct work_strif (unlikely ((1 << state) & (TCPF_CLOSE |TCPF_LISTEN ))) goto unlock; -mptcp_check_data_fin_ack (sk); -mptcp_check_fastclose (msk);mptcp_pm_nl_work (msk);
@@ -2674,7 +2669,8 @@ static void mptcp_worker(struct work_strif (test_and_clear_bit (MPTCP_WORK_EOF , &msk->flags))mptcp_check_for_eof (msk); -__mptcp_check_send_data_fin (sk); +mptcp_check_send_data_fin (sk); +mptcp_check_data_fin_ack (sk);mptcp_check_data_fin (sk);if (test_and_clear_bit (MPTCP_WORK_CLOSE_SUBFLOW , &msk->flags))
@@ -2815,6 +2811,12 @@ void mptcp_subflow_shutdown(struct sockpr_debug ("Fallback" ); ssk->sk_shutdown |= how;tcp_shutdown (ssk, how); + +/* simulate the data_fin ack reception to let the state +* machine move forward +*/ +WRITE_ONCE (mptcp_sk (sk)->snd_una,mptcp_sk (sk)->snd_nxt); +mptcp_schedule_work (sk); }else {pr_debug ("Sending DATA_FIN on subflow %p" , ssk);tcp_send_ack (ssk);
@@ -2854,7 +2856,7 @@ static int mptcp_close_state(struct sockreturn next &TCP_ACTION_FIN ; } -static void __mptcp_check_send_data_fin (struct sock *sk) +static void mptcp_check_send_data_fin (struct sock *sk) {struct mptcp_subflow_context *subflow;struct mptcp_sock *msk =mptcp_sk (sk);
@@ -2872,19 +2874,6 @@ static void __mptcp_check_send_data_fin(WRITE_ONCE (msk->snd_nxt, msk->write_seq); -/* fallback socket will not get data_fin/ack, can move to the next -* state now -*/ -if (__mptcp_check_fallback (msk)) { -WRITE_ONCE (msk->snd_una, msk->write_seq); -if ((1 << sk->sk_state) & (TCPF_CLOSING |TCPF_LAST_ACK )) { -inet_sk_state_store (sk,TCP_CLOSE ); -mptcp_close_wake_up (sk); - }else if (sk->sk_state ==TCP_FIN_WAIT1 ) { -inet_sk_state_store (sk,TCP_FIN_WAIT2 ); - } - } -mptcp_for_each_subflow (msk, subflow) {struct sock *tcp_sk =mptcp_subflow_tcp_sock (subflow);
@@ -2904,7 +2893,7 @@ static void __mptcp_wr_shutdown(struct sWRITE_ONCE (msk->write_seq, msk->write_seq +1 );WRITE_ONCE (msk->snd_data_fin_enable,1 ); -__mptcp_check_send_data_fin (sk); +mptcp_check_send_data_fin (sk); }static void __mptcp_destroy_sock (struct sock *sk)
net/mptcp/subflow.c +10 -7
@@ -1688,14 +1688,16 @@ static void subflow_state_change(struct {struct mptcp_subflow_context *subflow =mptcp_subflow_ctx (sk);struct sock *parent = subflow->conn; +struct mptcp_sock *msk;__subflow_state_change (sk); + msk =mptcp_sk (parent);if (subflow_simultaneous_connect (sk)) {mptcp_propagate_sndbuf (parent, sk);mptcp_do_fallback (sk); -mptcp_rcv_space_init (mptcp_sk (parent), sk); -pr_fallback (mptcp_sk (parent)); +mptcp_rcv_space_init (msk, sk); +pr_fallback (msk); subflow->conn_finished =1 ;mptcp_set_connected (parent); }
@@ -1711,11 +1713,12 @@ static void subflow_state_change(structsubflow_sched_work_if_closed (mptcp_sk (parent), sk); -if (__mptcp_check_fallback (mptcp_sk (parent)) && - !subflow->rx_eof &&subflow_is_done (sk)) { - subflow->rx_eof =1 ; -mptcp_subflow_eof (parent); - } +/* when the fallback subflow closes the rx side, trigger a 'dummy' +* ingress data fin, so that the msk state will follow along +*/ +if (__mptcp_check_fallback (msk) &&subflow_is_done (sk) && msk->first == sk && +mptcp_update_rcv_data_fin (msk,READ_ONCE (msk->ack_seq), true)) +mptcp_schedule_work (parent); }void mptcp_subflow_queue_clean (struct sock *listener_sk,struct sock *listener_ssk)
Greg Kroah-Hartman
maintainerPATCH 61/170 cgroup: Do not corrupt task iteration when rebinding subsystem
In reply to Greg Kroah-HartmanFrom: Xiu Jianfeng <[email protected]>
commit 6f363f5aa845561f7ea496d8b1175e3204470486 upstream.
We found a refcount UAF bug as follows:
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 1 PID: 342 at lib/refcount.c:25 refcount_warn_saturate+0xa0/0x148 Workqueue: events cpuset_hotplug_workfn Call trace: refcount_warn_saturate+0xa0/0x148 __refcount_add.constprop.0+0x5c/0x80 css_task_iter_advance_css_set+0xd8/0x210 css_task_iter_advance+0xa8/0x120 css_task_iter_next+0x94/0x158 update_tasks_root_domain+0x58/0x98 rebuild_root_domains+0xa0/0x1b0 rebuild_sched_domains_locked+0x144/0x188 cpuset_hotplug_workfn+0x138/0x5a0 process_one_work+0x1e8/0x448 worker_thread+0x228/0x3e0 kthread+0xe0/0xf0 ret_from_fork+0x10/0x20
then a kernel panic will be triggered as below:
Unable to handle kernel paging request at virtual address 00000000c0000010 Call trace: cgroup_apply_control_disable+0xa4/0x16c rebind_subsystems+0x224/0x590 cgroup_destroy_root+0x64/0x2e0 css_free_rwork_fn+0x198/0x2a0 process_one_work+0x1d4/0x4bc worker_thread+0x158/0x410 kthread+0x108/0x13c ret_from_fork+0x10/0x18
The race that cause this bug can be shown as below:
(hotplug cpu) | (umount cpuset) mutex_lock(&cpuset_mutex) | mutex_lock(&cgroup_mutex) cpuset_hotplug_workfn | rebuild_root_domains | rebind_subsystems update_tasks_root_domain | spin_lock_irq(&css_set_lock) css_task_iter_start | list_move_tail(&cset->e_cset_node[ss->id] while(css_task_iter_next) | &dcgrp->e_csets[ss->id]); css_task_iter_end | spin_unlock_irq(&css_set_lock) mutex_unlock(&cpuset_mutex) | mutex_unlock(&cgroup_mutex)
Inside css_task_iter_start/next/end, css_set_lock is hold and then released, so when iterating task(left side), the css_set may be moved to another list(right side), then it->cset_head points to the old list head and it->cset_pos->next points to the head node of new list, which can't be used as struct css_set.
To fix this issue, switch from all css_sets to only scgrp's css_sets to patch in-flight iterators to preserve correct iteration, and then update it->cset_head as well.
--- kernel/cgroup/cgroup.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-)
kernel/cgroup/cgroup.c +17 -3
@@ -1782,7 +1782,7 @@ int rebind_subsystems(struct cgroup_root {struct cgroup *dcgrp = &dst_root->cgrp;struct cgroup_subsys *ss; -int ssid, i, ret; +int ssid, ret;u16 dfl_disable_ss_mask =0 ;lockdep_assert_held (&cgroup_mutex);
@@ -1826,7 +1826,8 @@ int rebind_subsystems(struct cgroup_rootstruct cgroup_root *src_root = ss->root;struct cgroup *scgrp = &src_root->cgrp;struct cgroup_subsys_state *css =cgroup_css (scgrp, ss); -struct css_set *cset; +struct css_set *cset, *cset_pos; +struct css_task_iter *it;WARN_ON (!css ||cgroup_css (dcgrp, ss));
@@ -1844,9 +1845,22 @@ int rebind_subsystems(struct cgroup_root css->cgroup = dcgrp;spin_lock_irq (&css_set_lock); -hash_for_each (css_set_table, i, cset, hlist) +WARN_ON (!list_empty (&dcgrp->e_csets[ss->id])); +list_for_each_entry_safe (cset, cset_pos, &scgrp->e_csets[ss->id], + e_cset_node[ss->id]) {list_move_tail (&cset->e_cset_node[ss->id], &dcgrp->e_csets[ss->id]); +/* +* all css_sets of scgrp together in same order to dcgrp, +* patch in-flight iterators to preserve correct iteration. +* since the iterator is always advanced right away and +* finished when it->cset_pos meets it->cset_head, so only +* update it->cset_head is enough here. +*/ +list_for_each_entry (it, &cset->task_iters, iters_node) +if (it->cset_head == &scgrp->e_csets[ss->id]) + it->cset_head = &dcgrp->e_csets[ss->id]; + }spin_unlock_irq (&css_set_lock);if (ss->css_rstat_flush) {
Greg Kroah-Hartman
maintainerPATCH 62/170 cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex in freezer_css_{online,offline}()
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
commit f0cc749254d12c78e93dae3b27b21dc9546843d0 upstream.
syzbot is again reporting circular locking dependency between cpu_hotplug_lock and freezer_mutex. Do like what we did with commit 57dcd64c7e036299 ("cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex").
--- kernel/cgroup/legacy_freezer.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
kernel/cgroup/legacy_freezer.c +6 -2
@@ -108,16 +108,18 @@ static int freezer_css_online(struct cgrstruct freezer *freezer =css_freezer (css);struct freezer *parent =parent_freezer (freezer); +cpus_read_lock ();mutex_lock (&freezer_mutex); freezer->state |=CGROUP_FREEZER_ONLINE ;if (parent && (parent->state &CGROUP_FREEZING )) { freezer->state |=CGROUP_FREEZING_PARENT |CGROUP_FROZEN ; -static_branch_inc (&freezer_active); +static_branch_inc_cpuslocked (&freezer_active); }mutex_unlock (&freezer_mutex); +cpus_read_unlock ();return 0 ; }
@@ -132,14 +134,16 @@ static void freezer_css_offline(struct c {struct freezer *freezer =css_freezer (css); +cpus_read_lock ();mutex_lock (&freezer_mutex);if (freezer->state &CGROUP_FREEZING ) -static_branch_dec (&freezer_active); +static_branch_dec_cpuslocked (&freezer_active); freezer->state =0 ;mutex_unlock (&freezer_mutex); +cpus_read_unlock (); }static void freezer_css_free (struct cgroup_subsys_state *css)
Greg Kroah-Hartman
maintainerPATCH 63/170 mmc: litex_mmc: set PROBE_PREFER_ASYNCHRONOUS
In reply to Greg Kroah-HartmanFrom: Jisheng Zhang <[email protected]>
commit f334ad47683606b682b4166b800d8b372d315436 upstream.
mmc host drivers should have enabled the asynchronous probe option, but it seems like we didn't set it for litex_mmc when introducing litex mmc support, so let's set it now.
Tested with linux-on-litex-vexriscv on sipeed tang nano 20K fpga.
--- drivers/mmc/host/litex_mmc.c | 1 + 1 file changed, 1 insertion(+)
drivers/mmc/host/litex_mmc.c +1 -0
@@ -649,6 +649,7 @@ static struct platform_driver litex_mmc_ .driver = { .name = "litex-mmc", .of_match_table = litex_match, + .probe_type = PROBE_PREFER_ASYNCHRONOUS, }, };module_platform_driver (litex_mmc_driver);
Greg Kroah-Hartman
maintainerPATCH 64/170 mmc: sdhci-msm: Disable broken 64-bit DMA on MSM8916
In reply to Greg Kroah-HartmanFrom: Stephan Gerhold <[email protected]>
commit e6f9e590b72e12bbb86b1b8be7e1981f357392ad upstream.
While SDHCI claims to support 64-bit DMA on MSM8916 it does not seem to be properly functional. It is not immediately obvious because SDHCI is usually used with IOMMU bypassed on this SoC, and all physical memory has 32-bit addresses. But when trying to enable the IOMMU it quickly fails with an error such as the following:
arm-smmu 1e00000.iommu: Unhandled context fault:
fsr=0x402, iova=0xfffff200, fsynr=0xe0000, cbfrsynra=0x140, cb=3 mmc1: ADMA error: 0x02000000 mmc1: sdhci: ============ SDHCI REGISTER DUMP =========== mmc1: sdhci: Sys addr: 0x00000000 | Version: 0x00002e02 mmc1: sdhci: Blk size: 0x00000008 | Blk cnt: 0x00000000 mmc1: sdhci: Argument: 0x00000000 | Trn mode: 0x00000013 mmc1: sdhci: Present: 0x03f80206 | Host ctl: 0x00000019 mmc1: sdhci: Power: 0x0000000f | Blk gap: 0x00000000 mmc1: sdhci: Wake-up: 0x00000000 | Clock: 0x00000007 mmc1: sdhci: Timeout: 0x0000000a | Int stat: 0x00000001 mmc1: sdhci: Int enab: 0x03ff900b | Sig enab: 0x03ff100b mmc1: sdhci: ACmd stat: 0x00000000 | Slot int: 0x00000000 mmc1: sdhci: Caps: 0x322dc8b2 | Caps_1: 0x00008007 mmc1: sdhci: Cmd: 0x0000333a | Max curr: 0x00000000 mmc1: sdhci: Resp[0]: 0x00000920 | Resp[1]: 0x5b590000 mmc1: sdhci: Resp[2]: 0xe6487f80 | Resp[3]: 0x0a404094
mmc1: sdhci: Host ctl2: 0x00000008
mmc1: sdhci: ADMA Err: 0x00000001 | ADMA Ptr: 0x0000000ffffff224
mmc1: sdhci_msm: ----------- VENDOR REGISTER DUMP -----------
mmc1: sdhci_msm: DLL sts: 0x00000000 | DLL cfg: 0x60006400 | DLL cfg2: 0x00000000
mmc1: sdhci_msm: DLL cfg3: 0x00000000 | DLL usr ctl: 0x00000000 | DDR cfg: 0x00000000
mmc1: sdhci_msm: Vndr func: 0x00018a9c | Vndr func2 : 0xf88018a8 Vndr func3: 0x00000000
mmc1: sdhci: ============================================
mmc1: sdhci: fffffffff200: DMA 0x0000ffffffffe100, LEN 0x0008, Attr=0x21
mmc1: sdhci: fffffffff20c: DMA 0x0000000000000000, LEN 0x0000, Attr=0x03
Looking closely it's obvious that only the 32-bit part of the address (0xfffff200) arrives at the SMMU, the higher 16-bit (0xffff...) get lost somewhere. This might not be a limitation of the SDHCI itself but perhaps the bus/interconnect it is connected to, or even the connection to the SMMU.
Work around this by setting SDHCI_QUIRK2_BROKEN_64_BIT_DMA to avoid using 64-bit addresses.
--- drivers/mmc/host/sdhci-msm.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/mmc/host/sdhci-msm.c +3 -0
@@ -2486,6 +2486,9 @@ static inline void sdhci_msm_get_of_prop msm_host->ddr_config =DDR_CONFIG_POR_VAL ;of_property_read_u32 (node,"qcom,dll-config" , &msm_host->dll_config); + +if (of_device_is_compatible (node,"qcom,msm8916-sdhci" )) + host->quirks2 |=SDHCI_QUIRK2_BROKEN_64_BIT_DMA ; }static int sdhci_msm_gcc_reset (struct device *dev,struct sdhci_host *host)
Greg Kroah-Hartman
maintainerPATCH 65/170 mmc: meson-gx: remove redundant mmc_request_done() call from irq context
In reply to Greg Kroah-HartmanFrom: Martin Hundebøll <[email protected]>
commit 3c40eb8145325b0f5b93b8a169146078cb2c49d6 upstream.
The call to mmc_request_done() can schedule, so it must not be called from irq context. Wake the irq thread if it needs to be called, and let its existing logic do its work.
Fixes the following kernel bug, which appears when running an RT patched kernel on the AmLogic Meson AXG A113X SoC:
[ 11.111407] BUG: scheduling while atomic: kworker/0:1H/75/0x00010001 [ 11.111438] Modules linked in: [ 11.111451] CPU: 0 PID: 75 Comm: kworker/0:1H Not tainted 6.4.0-rc3-rt2-rtx-00081-gfd07f41ed6b4-dirty #1 [ 11.111461] Hardware name: RTX AXG A113X Linux Platform Board (DT) [ 11.111469] Workqueue: kblockd blk_mq_run_work_fn [ 11.111492] Call trace: [ 11.111497] dump_backtrace+0xac/0xe8 [ 11.111510] show_stack+0x18/0x28 [ 11.111518] dump_stack_lvl+0x48/0x60 [ 11.111530] dump_stack+0x18/0x24 [ 11.111537] __schedule_bug+0x4c/0x68 [ 11.111548] __schedule+0x80/0x574 [ 11.111558] schedule_loop+0x2c/0x50 [ 11.111567] schedule_rtlock+0x14/0x20 [ 11.111576] rtlock_slowlock_locked+0x468/0x730 [ 11.111587] rt_spin_lock+0x40/0x64 [ 11.111596] __wake_up_common_lock+0x5c/0xc4 [ 11.111610] __wake_up+0x18/0x24 [ 11.111620] mmc_blk_mq_req_done+0x68/0x138 [ 11.111633] mmc_request_done+0x104/0x118 [ 11.111644] meson_mmc_request_done+0x38/0x48 [ 11.111654] meson_mmc_irq+0x128/0x1f0 [ 11.111663] __handle_irq_event_percpu+0x70/0x114 [ 11.111674] handle_irq_event_percpu+0x18/0x4c [ 11.111683] handle_irq_event+0x80/0xb8 [ 11.111691] handle_fasteoi_irq+0xa4/0x120 [ 11.111704] handle_irq_desc+0x20/0x38 [ 11.111712] generic_handle_domain_irq+0x1c/0x28 [ 11.111721] gic_handle_irq+0x8c/0xa8 [ 11.111735] call_on_irq_stack+0x24/0x4c [ 11.111746] do_interrupt_handler+0x88/0x94 [ 11.111757] el1_interrupt+0x34/0x64 [ 11.111769] el1h_64_irq_handler+0x18/0x24 [ 11.111779] el1h_64_irq+0x64/0x68 [ 11.111786] __add_wait_queue+0x0/0x4c [ 11.111795] mmc_blk_rw_wait+0x84/0x118 [ 11.111804] mmc_blk_mq_issue_rq+0x5c4/0x654 [ 11.111814] mmc_mq_queue_rq+0x194/0x214 [ 11.111822] blk_mq_dispatch_rq_list+0x3ac/0x528 [ 11.111834] __blk_mq_sched_dispatch_requests+0x340/0x4d0 [ 11.111847] blk_mq_sched_dispatch_requests+0x38/0x70 [ 11.111858] blk_mq_run_work_fn+0x3c/0x70 [ 11.111865] process_one_work+0x17c/0x1f0 [ 11.111876] worker_thread+0x1d4/0x26c [ 11.111885] kthread+0xe4/0xf4 [ 11.111894] ret_from_fork+0x10/0x20
--- drivers/mmc/host/meson-gx-mmc.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-)
drivers/mmc/host/meson-gx-mmc.c +2 -8
@@ -1007,11 +1007,8 @@ static irqreturn_t meson_mmc_irq(int irqif (data && !cmd->error) data->bytes_xfered = data->blksz * data->blocks; -if (meson_mmc_bounce_buf_read (data) || -meson_mmc_get_next_command (cmd)) - ret =IRQ_WAKE_THREAD ; -else - ret =IRQ_HANDLED ; + +return IRQ_WAKE_THREAD ; } out:
@@ -1023,9 +1020,6 @@ out:writel (start, host->regs +SD_EMMC_START ); } -if (ret ==IRQ_HANDLED ) -meson_mmc_request_done (host->mmc, cmd->mrq); -return ret; }
Greg Kroah-Hartman
maintainerPATCH 66/170 mmc: mmci: stm32: fix max busy timeout calculation
In reply to Greg Kroah-HartmanFrom: Christophe Kerello <[email protected]>
commit 47b3ad6b7842f49d374a01b054a4b1461a621bdc upstream.
The way that the timeout is currently calculated could lead to a u64 timeout value in mmci_start_command(). This value is then cast in a u32 register that leads to mmc erase failed issue with some SD cards.
--- drivers/mmc/host/mmci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/mmc/host/mmci.c +2 -1
@@ -1735,7 +1735,8 @@ static void mmci_set_max_busy_timeout(streturn ;if (host->variant->busy_timeout && mmc->actual_clock) - max_busy_timeout = ~0UL / (mmc->actual_clock /MSEC_PER_SEC ); + max_busy_timeout =U32_MAX /DIV_ROUND_UP (mmc->actual_clock, +MSEC_PER_SEC ); mmc->max_busy_timeout = max_busy_timeout; }
Greg Kroah-Hartman
maintainerPATCH 67/170 mmc: sdhci-spear: fix deferred probing
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
commit 8d0caeedcd05a721f3cc2537b0ea212ec4027307 upstream.
The driver overrides the error codes and IRQ0 returned by platform_get_irq() to -EINVAL, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the error codes upstream. Since commit ce753ad1549c ("platform: finally disallow IRQ0 in platform_get_irq() and its ilk") IRQ0 is no longer returned by those APIs, so we now can safely ignore it...
--- drivers/mmc/host/sdhci-spear.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mmc/host/sdhci-spear.c +2 -2
@@ -65,8 +65,8 @@ static int sdhci_probe(struct platform_d host->hw_name ="sdhci" ; host->ops = &sdhci_pltfm_ops; host->irq =platform_get_irq (pdev,0 ); -if (host->irq <=0 ) { - ret = -EINVAL ; +if (host->irq <0 ) { + ret = host->irq; goto err_host; } host->quirks =SDHCI_QUIRK_BROKEN_ADMA ;
Greg Kroah-Hartman
maintainerPATCH 68/170 mmc: bcm2835: fix deferred probing
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
commit 71150ac12558bcd9d75e6e24cf7c872c2efd80f3 upstream.
The driver overrides the error codes and IRQ0 returned by platform_get_irq() to -EINVAL, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the error codes upstream. Since commit ce753ad1549c ("platform: finally disallow IRQ0 in platform_get_irq() and its ilk") IRQ0 is no longer returned by those APIs, so we now can safely ignore it...
--- drivers/mmc/host/bcm2835.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mmc/host/bcm2835.c +2 -2
@@ -1411,8 +1411,8 @@ static int bcm2835_probe(struct platform host->max_clk =clk_get_rate (clk); host->irq =platform_get_irq (pdev,0 ); -if (host->irq <=0 ) { - ret = -EINVAL ; +if (host->irq <0 ) { + ret = host->irq; goto err; }
Greg Kroah-Hartman
maintainerPATCH 69/170 mmc: sunxi: fix deferred probing
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
commit c2df53c5806cfd746dae08e07bc8c4ad247c3b70 upstream.
The driver overrides the error codes and IRQ0 returned by platform_get_irq() to -EINVAL, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the error codes upstream. Since commit ce753ad1549c ("platform: finally disallow IRQ0 in platform_get_irq() and its ilk") IRQ0 is no longer returned by those APIs, so we now can safely ignore it...
--- drivers/mmc/host/sunxi-mmc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mmc/host/sunxi-mmc.c +2 -2
@@ -1350,8 +1350,8 @@ static int sunxi_mmc_resource_request(struct sunxi_mmc_host *host,return ret; host->irq =platform_get_irq (pdev,0 ); -if (host->irq <=0 ) { - ret = -EINVAL ; +if (host->irq <0 ) { + ret = host->irq; goto error_disable_mmc; }
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 70/170 bpf: ensure main program has an extable
In reply to Greg Kroah-HartmanFrom: Krister Johansen <[email protected]>
commit 0108a4e9f3584a7a2c026d1601b0682ff7335d95 upstream.
When subprograms are in use, the main program is not jit'd after the subprograms because jit_subprogs sets a value for prog->bpf_func upon success. Subsequent calls to the JIT are bypassed when this value is non-NULL. This leads to a situation where the main program and its func[0] counterpart are both in the bpf kallsyms tree, but only func[0] has an extable. Extables are only created during JIT. Now there are two nearly identical program ksym entries in the tree, but only one has an extable. Depending upon how the entries are placed, there's a chance that a fault will call search_extable on the aux with the NULL entry.
Since jit_subprogs already copies state from func[0] to the main program, include the extable pointer in this state duplication. Additionally, ensure that the copy of the main program in func[0] is not added to the bpf_prog_kallsyms table. Instead, let the main program get added later in bpf_prog_load(). This ensures there is only a single copy of the main program in the kallsyms table, and that its tag matches the tag observed by tooling like bpftool.
--- kernel/bpf/verifier.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
kernel/bpf/verifier.c +5 -2
@@ -13819,9 +13819,10 @@ static int jit_subprogs(struct bpf_verif }/* finally lock prog and jit images for all functions and -* populate kallsysm +* populate kallsysm. Begin at the first subprogram, since +* bpf_prog_load will add the kallsyms for the main program. */ -for (i =0 ; i < env->subprog_cnt; i++) { +for (i =1 ; i < env->subprog_cnt; i++) {bpf_prog_lock_ro (func[i]);bpf_prog_kallsyms_add (func[i]); }
@@ -13847,6 +13848,8 @@ static int jit_subprogs(struct bpf_verif prog->jited =1 ; prog->bpf_func = func[0 ]->bpf_func; prog->jited_len = func[0 ]->jited_len; + prog->aux->extable = func[0 ]->aux->extable; + prog->aux->num_exentries = func[0 ]->aux->num_exentries; prog->aux->func = func; prog->aux->func_cnt = env->subprog_cnt;bpf_prog_jit_attempt_done (prog);
Greg Kroah-Hartman
maintainerPATCH 71/170 wifi: iwlwifi: pcie: Handle SO-F device for PCI id 0x7AF0
In reply to Greg Kroah-HartmanFrom: Mukesh Sisodiya <[email protected]>
commit 4e9f0ec38852c18faa9689322e758575af33e5d4 upstream.
Add support for AX1690i and AX1690s devices with
PCIE id 0x7AF0.
--- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/intel/iwlwifi/pcie/drv.c +2 -0
@@ -547,6 +547,8 @@ static const struct iwl_dev_info iwl_devIWL_DEV_INFO (0x54F0 ,0x1692 , iwlax411_2ax_cfg_so_gf4_a0, iwl_ax411_killer_1690i_name),IWL_DEV_INFO (0x7A70 ,0x1691 , iwlax411_2ax_cfg_so_gf4_a0, iwl_ax411_killer_1690s_name),IWL_DEV_INFO (0x7A70 ,0x1692 , iwlax411_2ax_cfg_so_gf4_a0, iwl_ax411_killer_1690i_name), +IWL_DEV_INFO (0x7AF0 ,0x1691 , iwlax411_2ax_cfg_so_gf4_a0, iwl_ax411_killer_1690s_name), +IWL_DEV_INFO (0x7AF0 ,0x1692 , iwlax411_2ax_cfg_so_gf4_a0, iwl_ax411_killer_1690i_name),IWL_DEV_INFO (0x271C ,0x0214 , iwl9260_2ac_cfg, iwl9260_1_name), IWL_DEV_INFO(0x7E40, 0x1691, iwl_cfg_ma_a0_gf4_a0, iwl_ax411_killer_1690s_name),
Greg Kroah-Hartman
maintainerPATCH 72/170 spi: spi-geni-qcom: correctly handle -EPROBE_DEFER from dma_request_chan()
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
[ Upstream commit 9d7054fb3ac2e8d252aae1268f20623f244e644f ]
Now spi_geni_grab_gpi_chan() errors are correctly reported, the -EPROBE_DEFER error should be returned from probe in case the GPI dma driver is built as module and/or not probed yet.
--- drivers/spi/spi-geni-qcom.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/spi/spi-geni-qcom.c +2 -0
@@ -595,6 +595,8 @@ static int spi_geni_init(struct spi_geni_master *mas)geni_se_select_mode (se,GENI_GPI_DMA );dev_dbg (mas->dev,"Using GPI DMA mode for SPI\n" );break ; + }else if (ret == -EPROBE_DEFER ) { + goto out_pm; }/* * in case of failure to get dma channel, we can still do the
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 73/170 regulator: pca9450: Fix LDO3OUT and LDO4OUT MASK
In reply to Greg Kroah-HartmanFrom: Teresa Remmet <[email protected]>
[ Upstream commit 7257d930aadcd62d1c7971ab14f3b1126356abdc ]
L3_OUT and L4_OUT Bit fields range from Bit 0:4 and thus the mask should be 0x1F instead of 0x0F.
--- include/linux/regulator/pca9450.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/regulator/pca9450.h +2 -2
@@ -196,11 +196,11 @@ enum {/* PCA9450_REG_LDO3_VOLT bits */ #define LDO3_EN_MASK 0xC0 -#define LDO3OUT_MASK 0x0F +#define LDO3OUT_MASK 0x1F/* PCA9450_REG_LDO4_VOLT bits */ #define LDO4_EN_MASK 0xC0 -#define LDO4OUT_MASK 0x0F +#define LDO4OUT_MASK 0x1F/* PCA9450_REG_LDO5_VOLT bits */ #define LDO5L_EN_MASK 0xC0
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 74/170 regmap: spi-avmm: Fix regmap_bus max_raw_write
In reply to Greg Kroah-HartmanFrom: Russ Weight <[email protected]>
[ Upstream commit c8e796895e2310b6130e7577248da1d771431a77 ]
The max_raw_write member of the regmap_spi_avmm_bus structure is defined as:
.max_raw_write = SPI_AVMM_VAL_SIZE * MAX_WRITE_CNT
SPI_AVMM_VAL_SIZE == 4 and MAX_WRITE_CNT == 1 so this results in a maximum write transfer size of 4 bytes which provides only enough space to transfer the address of the target register. It provides no space for the value to be transferred. This bug became an issue (divide-by-zero in _regmap_raw_write()) after the following was accepted into mainline:
commit 3981514180c9 ("regmap: Account for register length when chunking")
Change max_raw_write to include space (4 additional bytes) for both the register address and value:
.max_raw_write = SPI_AVMM_REG_SIZE + SPI_AVMM_VAL_SIZE * MAX_WRITE_CNT
--- drivers/base/regmap/regmap-spi-avmm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/regmap/regmap-spi-avmm.c +1 -1
@@ -660,7 +660,7 @@ static const struct regmap_bus regmap_spi_avmm_bus = { .reg_format_endian_default = REGMAP_ENDIAN_NATIVE, .val_format_endian_default = REGMAP_ENDIAN_NATIVE, .max_raw_read = SPI_AVMM_VAL_SIZE * MAX_READ_CNT, - .max_raw_write = SPI_AVMM_VAL_SIZE * MAX_WRITE_CNT, + .max_raw_write = SPI_AVMM_REG_SIZE + SPI_AVMM_VAL_SIZE * MAX_WRITE_CNT, .free_context = spi_avmm_bridge_ctx_free, };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 75/170 arm64: dts: rockchip: Fix rk356x PCIe register and range mappings
In reply to Greg Kroah-HartmanFrom: Andrew Powers-Holmes <[email protected]>
commit 568a67e742dfa90b19a23305317164c5c350b71e upstream.
The register and range mappings for the PCIe controller in Rockchip's RK356x SoCs are incorrect. Replace them with corrected values from the vendor BSP sources, updated to match current DT schema.
These values are also used in u-boot.
--- arch/arm64/boot/dts/rockchip/rk3568.dtsi | 14 ++++++++------ arch/arm64/boot/dts/rockchip/rk356x.dtsi | 7 ++++--- 2 files changed, 12 insertions(+), 9 deletions(-)
arch/arm64/boot/dts/rockchip/rk3568.dtsi +8 -6
@@ -94,9 +94,10 @@ power-domains = <&power RK3568_PD_PIPE>; reg = <0x3 0xc0400000 0x0 0x00400000>, <0x0 0xfe270000 0x0 0x00010000>, - <0x3 0x7f000000 0x0 0x01000000>; - ranges = <0x01000000 0x0 0x3ef00000 0x3 0x7ef00000 0x0 0x00100000>, - <0x02000000 0x0 0x00000000 0x3 0x40000000 0x0 0x3ef00000>; + <0x0 0xf2000000 0x0 0x00100000>; + ranges = <0x01000000 0x0 0xf2100000 0x0 0xf2100000 0x0 0x00100000>, + <0x02000000 0x0 0xf2200000 0x0 0xf2200000 0x0 0x01e00000>, + <0x03000000 0x0 0x40000000 0x3 0x40000000 0x0 0x40000000>; reg-names = "dbi", "apb", "config"; resets = <&cru SRST_PCIE30X1_POWERUP>; reset-names = "pipe";
@@ -146,9 +147,10 @@ power-domains = <&power RK3568_PD_PIPE>; reg = <0x3 0xc0800000 0x0 0x00400000>, <0x0 0xfe280000 0x0 0x00010000>, - <0x3 0xbf000000 0x0 0x01000000>; - ranges = <0x01000000 0x0 0x3ef00000 0x3 0xbef00000 0x0 0x00100000>, - <0x02000000 0x0 0x00000000 0x3 0x80000000 0x0 0x3ef00000>; + <0x0 0xf0000000 0x0 0x00100000>; + ranges = <0x01000000 0x0 0xf0100000 0x0 0xf0100000 0x0 0x00100000>, + <0x02000000 0x0 0xf0200000 0x0 0xf0200000 0x0 0x01e00000>, + <0x03000000 0x0 0x40000000 0x3 0x80000000 0x0 0x40000000>; reg-names = "dbi", "apb", "config"; resets = <&cru SRST_PCIE30X2_POWERUP>; reset-names = "pipe";
arch/arm64/boot/dts/rockchip/rk356x.dtsi +4 -3
@@ -951,7 +951,7 @@ compatible = "rockchip,rk3568-pcie"; reg = <0x3 0xc0000000 0x0 0x00400000>, <0x0 0xfe260000 0x0 0x00010000>, - <0x3 0x3f000000 0x0 0x01000000>; + <0x0 0xf4000000 0x0 0x00100000>; reg-names = "dbi", "apb", "config"; interrupts = <GIC_SPI 75 IRQ_TYPE_LEVEL_HIGH>, <GIC_SPI 74 IRQ_TYPE_LEVEL_HIGH>,
@@ -981,8 +981,9 @@ phys = <&combphy2 PHY_TYPE_PCIE>; phy-names = "pcie-phy"; power-domains = <&power RK3568_PD_PIPE>; - ranges = <0x01000000 0x0 0x3ef00000 0x3 0x3ef00000 0x0 0x00100000 - 0x02000000 0x0 0x00000000 0x3 0x00000000 0x0 0x3ef00000>; + ranges = <0x01000000 0x0 0xf4100000 0x0 0xf4100000 0x0 0x00100000>, + <0x02000000 0x0 0xf4200000 0x0 0xf4200000 0x0 0x01e00000>, + <0x03000000 0x0 0x40000000 0x3 0x00000000 0x0 0x40000000>; resets = <&cru SRST_PCIE20_POWERUP>; reset-names = "pipe"; #address-cells = <3>;
Greg Kroah-Hartman
maintainerPATCH 76/170 io_uring/poll: serialize poll linked timer start with poll removal
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
Commit ef7dfac51d8ed961b742218f526bd589f3900a59 upstream.
We selectively grab the ctx->uring_lock for poll update/removal, but we really should grab it from the start to fully synchronize with linked timeouts. Normally this is indeed the case, but if requests are forced async by the application, we don't fully cover removal and timer disarm within the uring_lock.
Make this simpler by having consistent locking state for poll removal.
--- io_uring/poll.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
io_uring/poll.c +4 -5
@@ -993,8 +993,9 @@ int io_poll_remove(struct io_kiocb *req,struct io_hash_bucket *bucket;struct io_kiocb *preq;int ret2, ret =0 ; -bool locked; +bool locked = true; +io_ring_submit_lock (ctx, issue_flags); preq =io_poll_find (ctx, true, &cd, &ctx->cancel_table, &bucket); ret2 =io_poll_disarm (preq);if (bucket)
@@ -1006,12 +1007,10 @@ int io_poll_remove(struct io_kiocb *req, goto out; } -io_ring_submit_lock (ctx, issue_flags); preq =io_poll_find (ctx, true, &cd, &ctx->cancel_table_locked, &bucket); ret2 =io_poll_disarm (preq);if (bucket)spin_unlock (&bucket->lock); -io_ring_submit_unlock (ctx, issue_flags);if (ret2) { ret = ret2; goto out;
@@ -1035,7 +1034,7 @@ found:if (poll_update->update_user_data) preq->cqe.user_data = poll_update->new_user_data; - ret2 =io_poll_add (preq, issue_flags); + ret2 =io_poll_add (preq, issue_flags & ~IO_URING_F_UNLOCKED );/* successfully updated, don't complete poll request */ if (!ret2 || ret2 == -EIOCBQUEUED ) goto out;
@@ -1043,9 +1042,9 @@ found:req_set_fail (preq);io_req_set_res (preq, -ECANCELED ,0 ); - locked = !(issue_flags &IO_URING_F_UNLOCKED );io_req_task_complete (preq, &locked); out: +io_ring_submit_unlock (ctx, issue_flags);if (ret <0 ) {req_set_fail (req);return ret;
Greg Kroah-Hartman
maintainerPATCH 77/170 nilfs2: prevent general protection fault in nilfs_clear_dirty_page()
In reply to Greg Kroah-HartmanFrom: Ryusuke Konishi <[email protected]>
commit 782e53d0c14420858dbf0f8f797973c150d3b6d7 upstream.
In a syzbot stress test that deliberately causes file system errors on nilfs2 with a corrupted disk image, it has been reported that nilfs_clear_dirty_page() called from nilfs_clear_dirty_pages() can cause a
general protection fault.
In nilfs_clear_dirty_pages(), when looking up dirty pages from the page cache and calling nilfs_clear_dirty_page() for each dirty page/folio retrieved, the back reference from the argument page to "mapping" may have been changed to NULL (and possibly others). It is necessary to check this after locking the page/folio.
So, fix this issue by not calling nilfs_clear_dirty_page() on a page/folio after locking it in nilfs_clear_dirty_pages() if the back reference "mapping" from the page/folio is different from the "mapping" that held the page/folio just before.
--- fs/nilfs2/page.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
fs/nilfs2/page.c +9 -1
@@ -369,7 +369,15 @@ void nilfs_clear_dirty_pages(struct addrstruct page *page = pvec.pages[i];lock_page (page); -nilfs_clear_dirty_page (page, silent); + +/* +* This page may have been removed from the address +* space by truncation or invalidation when the lock +* was acquired. Skip processing in that case. +*/ +if (likely (page->mapping == mapping)) +nilfs_clear_dirty_page (page, silent); +unlock_page (page); }pagevec_release (&pvec);
Greg Kroah-Hartman
maintainerPATCH 78/170 x86/mm: Avoid using set_pgd() outside of real PGD pages
In reply to Greg Kroah-HartmanFrom: Lee Jones <[email protected]>
commit d082d48737c75d2b3cc1f972b8c8674c25131534 upstream.
KPTI keeps around two PGDs: one for userspace and another for the kernel. Among other things, set_pgd() contains infrastructure to ensure that updates to the kernel PGD are reflected in the user PGD as well.
One side-effect of this is that set_pgd() expects to be passed whole pages. Unfortunately, init_trampoline_kaslr() passes in a single entry:
'trampoline_pgd_entry'.
When KPTI is on, set_pgd() will update 'trampoline_pgd_entry' (an 8-Byte globally stored [.bss] variable) and will then proceed to replicate that value into the non-existent neighboring user page (located +4k away), leading to the corruption of other global [.bss] stored variables.
Fix it by directly assigning 'trampoline_pgd_entry' and avoiding set_pgd().
[ dhansen: tweak subject and changelog ]
--- arch/x86/mm/kaslr.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/x86/mm/kaslr.c +4 -4
@@ -172,10 +172,10 @@ void __meminit init_trampoline_kaslr(voiset_p4d (p4d_tramp,__p4d (_KERNPG_TABLE |__pa (pud_page_tramp))); -set_pgd (&trampoline_pgd_entry, -__pgd (_KERNPG_TABLE |__pa (p4d_page_tramp))); + trampoline_pgd_entry = +__pgd (_KERNPG_TABLE |__pa (p4d_page_tramp)); }else { -set_pgd (&trampoline_pgd_entry, -__pgd (_KERNPG_TABLE |__pa (pud_page_tramp))); + trampoline_pgd_entry = +__pgd (_KERNPG_TABLE |__pa (pud_page_tramp)); } }
Greg Kroah-Hartman
maintainerPATCH 79/170 memfd: check for non-NULL file_seals in memfd_create() syscall
In reply to Greg Kroah-HartmanFrom: Roberto Sassu <[email protected]>
[ Upstream commit 935d44acf621aa0688fef8312dec3e5940f38f4e ]
Ensure that file_seals is non-NULL before using it in the memfd_create() syscall. One situation in which memfd_file_seals_ptr() could return a NULL pointer when CONFIG_SHMEM=n, oopsing the kernel.
--- mm/memfd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
mm/memfd.c +2 -1
@@ -328,7 +328,8 @@ SYSCALL_DEFINE2(memfd_create,if (flags &MFD_ALLOW_SEALING ) { file_seals =memfd_file_seals_ptr (file); - *file_seals &= ~F_SEAL_SEAL ; +if (file_seals) + *file_seals &= ~F_SEAL_SEAL ; }fd_install (fd, file);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 80/170 mmc: meson-gx: fix deferred probing
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit b8ada54fa1b83f3b6480d4cced71354301750153 ]
The driver overrides the error codes and IRQ0 returned by platform_get_irq() to -EINVAL, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the error codes upstream. Since commit ce753ad1549c ("platform: finally disallow IRQ0 in platform_get_irq() and its ilk") IRQ0 is no longer returned by those APIs, so we now can safely ignore it...
--- drivers/mmc/host/meson-gx-mmc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mmc/host/meson-gx-mmc.c +2 -2
@@ -1227,8 +1227,8 @@ static int meson_mmc_probe(struct platform_device *pdev) } host->irq =platform_get_irq (pdev,0 ); -if (host->irq <=0 ) { - ret = -EINVAL ; +if (host->irq <0 ) { + ret = host->irq; goto free_host; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 81/170 ieee802154: hwsim: Fix possible memory leaks
In reply to Greg Kroah-HartmanFrom: Chen Aotian <[email protected]>
[ Upstream commit a61675294735570daca3779bd1dbb3715f7232bd ]
After replacing e->info, it is necessary to free the old einfo.
--- drivers/net/ieee802154/mac802154_hwsim.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ieee802154/mac802154_hwsim.c +4 -2
@@ -522,7 +522,7 @@ static int hwsim_del_edge_nl(struct sk_buff *msg, struct genl_info *info)static int hwsim_set_edge_lqi (struct sk_buff *msg,struct genl_info *info) {struct nlattr *edge_attrs[MAC802154_HWSIM_EDGE_ATTR_MAX +1 ]; -struct hwsim_edge_info *einfo; +struct hwsim_edge_info *einfo, *einfo_old;struct hwsim_phy *phy_v0;struct hwsim_edge *e;u32 v0, v1;
@@ -560,8 +560,10 @@ static int hwsim_set_edge_lqi(struct sk_buff *msg, struct genl_info *info)list_for_each_entry_rcu (e, &phy_v0->edges, list) {if (e->endpoint->idx == v1) { einfo->lqi = lqi; -rcu_assign_pointer (e->info, einfo); + einfo_old =rcu_replace_pointer (e->info, einfo, +lockdep_is_held (&hwsim_phys_lock));rcu_read_unlock (); +kfree_rcu (einfo_old, rcu);mutex_unlock (&hwsim_phys_lock);return 0 ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 82/170 xfrm: Treat already-verified secpath entries as optional
In reply to Greg Kroah-HartmanFrom: Benedict Wong <[email protected]>
[ Upstream commit 1f8b6df6a997a430b0c48b504638154b520781ad ]
This change allows inbound traffic through nested IPsec tunnels to successfully match policies and templates, while retaining the secpath stack trace as necessary for netfilter policies.
Specifically, this patch marks secpath entries that have already matched against a relevant policy as having been verified, allowing it to be treated as optional and skipped after a tunnel decapsulation (during which the src/dst/proto/etc may have changed, and the correct policy chain no long be resolvable).
This approach is taken as opposed to the iteration in b0355dbbf13c, where the secpath was cleared, since that breaks subsequent validations that rely on the existence of the secpath entries (netfilter policies, or transport-in-tunnel mode, where policies remain resolvable).
Test: Tested against Android Kernel Unit Tests
Test: Tested against Android CTS
--- include/net/xfrm.h | 1 + net/xfrm/xfrm_input.c | 1 + net/xfrm/xfrm_policy.c | 12 ++++++++++++ 3 files changed, 14 insertions(+)
include/net/xfrm.h +1 -0
@@ -1039,6 +1039,7 @@ struct xfrm_offload {struct sec_path {int len;int olen; +int verified_cnt;struct xfrm_state *xvec[XFRM_MAX_DEPTH ];struct xfrm_offload ovec[XFRM_MAX_OFFLOAD_DEPTH ];
net/xfrm/xfrm_input.c +1 -0
@@ -131,6 +131,7 @@ struct sec_path *secpath_set(struct sk_buff *skb)memset (sp->ovec,0 ,sizeof (sp->ovec)); sp->olen =0 ; sp->len =0 ; + sp->verified_cnt =0 ;return sp; }
net/xfrm/xfrm_policy.c +12 -0
@@ -3274,6 +3274,13 @@ xfrm_policy_ok(const struct xfrm_tmpl *tmpl, const struct sec_path *sp, int starif (xfrm_state_ok (tmpl, sp->xvec[idx], family, if_id))return ++idx;if (sp->xvec[idx]->props.mode !=XFRM_MODE_TRANSPORT ) { +if (idx < sp->verified_cnt) { +/* Secpath entry previously verified, consider optional and +* continue searching +*/ +continue ; + } +if (start ==-1 ) start =-2 -idx;break ;
@@ -3648,6 +3655,9 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,* Order is _important_. Later we will implement * some barriers, but at the moment barriers * are implied between each two transformations. +* Upon success, marks secpath entries as having been +* verified to allow them to be skipped in future policy +* checks (e.g. nested tunnels). */ for (i = xfrm_nr-1 , k =0 ; i >=0 ; i--) { k =xfrm_policy_ok (tpp[i], sp, k, family, if_id);
@@ -3666,6 +3676,8 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, }xfrm_pols_put (pols, npols); + sp->verified_cnt = k; +return 1 ; }XFRM_INC_STATS (net,LINUX_MIB_XFRMINPOLBLOCK );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 83/170 xfrm: interface: rename xfrm_interface.c to xfrm_interface_core.c
In reply to Greg Kroah-HartmanFrom: Eyal Birger <[email protected]>
[ Upstream commit ee9a113ab63468137802898bcd2c598998c96938 ]
This change allows adding additional files to the xfrm_interface module.
Stable-dep-of: a287f5b0cfc6 ("xfrm: Ensure policies always checked on XFRM-I input path")
---
net/xfrm/Makefile | 2 ++
net/xfrm/{xfrm_interface.c => xfrm_interface_core.c} | 0
2 files changed, 2 insertions(+)
rename net/xfrm/{xfrm_interface.c => xfrm_interface_core.c} (100%)net/xfrm/Makefile +2 -0
@@ -3,6 +3,8 @@ # Makefile for the XFRM subsystem. # +xfrm_interface-$(CONFIG_XFRM_INTERFACE) += xfrm_interface_core.o + obj-$(CONFIG_XFRM) := xfrm_policy.o xfrm_state.o xfrm_hash.o \ xfrm_input.o xfrm_output.o \ xfrm_sysctl.o xfrm_replay.o xfrm_device.o
net/xfrm/xfrm_interface_core.c renamed from net/xfrm/xfrm_interface.c +0 -0
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 84/170 xfrm: Ensure policies always checked on XFRM-I input path
In reply to Greg Kroah-HartmanFrom: Benedict Wong <[email protected]>
[ Upstream commit a287f5b0cfc6804c5b12a4be13c7c9fe27869e90 ]
This change adds methods in the XFRM-I input path that ensures that policies are checked prior to processing of the subsequent decapsulated packet, after which the relevant policies may no longer be resolvable (due to changing src/dst/proto/etc).
Notably, raw ESP/AH packets did not perform policy checks inherently, whereas all other encapsulated packets (UDP, TCP encapsulated) do policy checks after calling xfrm_input handling in the respective encapsulation layer.
Test: Verified with additional Android Kernel Unit tests
Test: Verified against Android CTS
--- net/xfrm/xfrm_interface_core.c | 54 +++++++++++++++++++++++++++++++--- 1 file changed, 50 insertions(+), 4 deletions(-)
net/xfrm/xfrm_interface_core.c +50 -4
@@ -310,6 +310,52 @@ static void xfrmi_scrub_packet(struct sk_buff *skb, bool xnet) skb->mark =0 ; } +static int xfrmi_input (struct sk_buff *skb,int nexthdr,__be32 spi, +int encap_type,unsigned short family) +{ +struct sec_path *sp; + + sp =skb_sec_path (skb); +if (sp && (sp->len || sp->olen) && + !xfrm_policy_check (NULL ,XFRM_POLICY_IN , skb, family)) + goto discard; + +XFRM_SPI_SKB_CB (skb)->family = family; +if (family ==AF_INET ) { +XFRM_SPI_SKB_CB (skb)->daddroff = offsetof(struct iphdr , daddr); +XFRM_TUNNEL_SKB_CB (skb)->tunnel.ip4 =NULL ; + }else { +XFRM_SPI_SKB_CB (skb)->daddroff = offsetof(struct ipv6hdr , daddr); +XFRM_TUNNEL_SKB_CB (skb)->tunnel.ip6 =NULL ; + } + +return xfrm_input (skb, nexthdr, spi, encap_type); +discard: +kfree_skb (skb); +return 0 ; +} + +static int xfrmi4_rcv (struct sk_buff *skb) +{ +return xfrmi_input (skb,ip_hdr (skb)->protocol,0 ,0 ,AF_INET ); +} + +static int xfrmi6_rcv (struct sk_buff *skb) +{ +return xfrmi_input (skb,skb_network_header (skb)[IP6CB (skb)->nhoff], +0 ,0 ,AF_INET6 ); +} + +static int xfrmi4_input (struct sk_buff *skb,int nexthdr,__be32 spi,int encap_type) +{ +return xfrmi_input (skb, nexthdr, spi, encap_type,AF_INET ); +} + +static int xfrmi6_input (struct sk_buff *skb,int nexthdr,__be32 spi,int encap_type) +{ +return xfrmi_input (skb, nexthdr, spi, encap_type,AF_INET6 ); +} +static int xfrmi_rcv_cb (struct sk_buff *skb,int err) {const struct xfrm_mode *inner_mode;
@@ -937,8 +983,8 @@ static struct pernet_operations xfrmi_net_ops = { };static struct xfrm6_protocol xfrmi_esp6_protocol__read_mostly = { - .handler = xfrm6_rcv, - .input_handler = xfrm_input, + .handler = xfrmi6_rcv, + .input_handler = xfrmi6_input, .cb_handler = xfrmi_rcv_cb, .err_handler = xfrmi6_err, .priority =10 ,
@@ -988,8 +1034,8 @@ static struct xfrm6_tunnel xfrmi_ip6ip_handler __read_mostly = {#endif static struct xfrm4_protocol xfrmi_esp4_protocol__read_mostly = { - .handler = xfrm4_rcv, - .input_handler = xfrm_input, + .handler = xfrmi4_rcv, + .input_handler = xfrmi4_input, .cb_handler = xfrmi_rcv_cb, .err_handler = xfrmi4_err, .priority =10 ,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 85/170 KVM: arm64: PMU: Restore the hosts PMUSERENR_EL0
In reply to Greg Kroah-HartmanFrom: Reiji Watanabe <[email protected]>
[ Upstream commit 8681f71759010503892f9e3ddb05f65c0f21b690 ]
Restore the host's PMUSERENR_EL0 value instead of clearing it, before returning back to userspace, as the host's EL0 might have a direct access to PMU registers (some bits of PMUSERENR_EL0 for might not be zero for the host EL0).
--- arch/arm64/kvm/hyp/include/hyp/switch.h | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
arch/arm64/kvm/hyp/include/hyp/switch.h +11 -2
@@ -81,7 +81,12 @@ static inline void __activate_traps_common(struct kvm_vcpu *vcpu)* EL1 instead of being trapped to EL2. */ if (kvm_arm_support_pmu_v3 ()) { +struct kvm_cpu_context *hctxt; +write_sysreg (0 , pmselr_el0); + + hctxt = &this_cpu_ptr (&kvm_host_data)->host_ctxt; +ctxt_sys_reg (hctxt,PMUSERENR_EL0 ) =read_sysreg (pmuserenr_el0);write_sysreg (ARMV8_PMU_USERENR_MASK , pmuserenr_el0); }
@@ -105,8 +110,12 @@ static inline void __deactivate_traps_common(struct kvm_vcpu *vcpu)write_sysreg (vcpu->arch.mdcr_el2_host, mdcr_el2);write_sysreg (0 , hstr_el2); -if (kvm_arm_support_pmu_v3 ()) -write_sysreg (0 , pmuserenr_el0); +if (kvm_arm_support_pmu_v3 ()) { +struct kvm_cpu_context *hctxt; + + hctxt = &this_cpu_ptr (&kvm_host_data)->host_ctxt; +write_sysreg (ctxt_sys_reg (hctxt,PMUSERENR_EL0 ), pmuserenr_el0); + }if (cpus_have_final_cap (ARM64_SME )) { sysreg_clear_set_s(SYS_HFGRTR_EL2, 0,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 86/170 bpf: track immediate values written to stack by BPF_ST instruction
In reply to Greg Kroah-HartmanFrom: Eduard Zingerman <[email protected]>
[ Upstream commit ecdf985d7615356b78241fdb159c091830ed0380 ]
For aligned stack writes using BPF_ST instruction track stored values in a same way BPF_STX is handled, e.g. make sure that the following commands produce similar verifier knowledge:
fp[-8] = 42; r1 = 42;
fp[-8] = r1;This covers two cases:
- non-null values written to stack are stored as spill of fake registers;
- null values written to stack are stored as STACK_ZERO marks.
Previously both cases above used STACK_MISC marks instead.
Some verifier test cases relied on the old logic to obtain STACK_MISC marks for some stack values. These test cases are updated in the same commit to avoid failures during bisect.
Stable-dep-of: 713274f1f2c8 ("bpf: Fix verifier id tracking of scalars on spill")
--- kernel/bpf/verifier.c | 18 ++- .../bpf/verifier/bounds_mix_sign_unsign.c | 110 ++++++++++-------- 2 files changed, 80 insertions(+), 48 deletions(-)
kernel/bpf/verifier.c +16 -2
@@ -3061,6 +3061,11 @@ static void save_register_state(struct bpf_func_state *state,scrub_spilled_slot (&state->stack[spi].slot_type[i -1 ]); } +static bool is_bpf_st_mem (struct bpf_insn *insn) +{ +return BPF_CLASS (insn->code) ==BPF_ST &&BPF_MODE (insn->code) ==BPF_MEM ; +} +/* check_stack_{read,write}_fixed_off functions track spill/fill of registers, * stack boundary and alignment are checked in check_mem_access() */
@@ -3072,8 +3077,9 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env, {struct bpf_func_state *cur;/* state of the current function */ int i, slot = -off -1 , spi = slot /BPF_REG_SIZE , err; -u32 dst_reg = env->prog->insnsi[insn_idx].dst_reg; +struct bpf_insn *insn = &env->prog->insnsi[insn_idx];struct bpf_reg_state *reg =NULL ; +u32 dst_reg = insn->dst_reg; err =grow_stack_state (state,round_up (slot +1 ,BPF_REG_SIZE ));if (err)
@@ -3122,6 +3128,13 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env,return err; }save_register_state (state, spi, reg, size); + }else if (!reg && !(off %BPF_REG_SIZE ) &&is_bpf_st_mem (insn) && + insn->imm !=0 && env->bpf_capable) { +struct bpf_reg_state fake_reg = {}; + +__mark_reg_known (&fake_reg, (u32 )insn->imm); + fake_reg.type =SCALAR_VALUE ; +save_register_state (state, spi, &fake_reg, size); }else if (reg &&is_spillable_regtype (reg->type)) {/* register containing pointer is being spilled into stack */ if (size !=BPF_REG_SIZE ) {
@@ -3156,7 +3169,8 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env, state->stack[spi].spilled_ptr.live |=REG_LIVE_WRITTEN ;/* when we zero initialize stack slots mark them as such */ -if (reg &®ister_is_null (reg)) { +if ((reg &®ister_is_null (reg)) || + (!reg &&is_bpf_st_mem (insn) && insn->imm ==0 )) {/* backtracking doesn't work for STACK_ZERO yet. */ err =mark_chain_precision (env, value_regno);if (err)
tools/testing/selftests/bpf/verifier/bounds_mix_sign_unsign.c +64 -46
371 lines not on this page · raw message
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 87/170 bpf: Fix verifier id tracking of scalars on spill
In reply to Greg Kroah-HartmanFrom: Maxim Mikityanskiy <[email protected]>
[ Upstream commit 713274f1f2c896d37017efee333fd44149710119 ]
The following scenario describes a bug in the verifier where it incorrectly concludes about equivalent scalar IDs which could lead to verifier bypass in privileged mode:
1. Prepare a 32-bit rogue number.
2. Put the rogue number into the upper half of a 64-bit register, and roll a random (unknown to the verifier) bit in the lower half. The rest of the bits should be zero (although variations are possible).
3. Assign an ID to the register by MOVing it to another arbitrary register.
4. Perform a 32-bit spill of the register, then perform a 32-bit fill to another register. Due to a bug in the verifier, the ID will be preserved, although the new register will contain only the lower 32 bits, i.e. all zeros except one random bit.
At this point there are two registers with different values but the same ID, which means the integrity of the verifier state has been corrupted.
5. Compare the new 32-bit register with 0. In the branch where it's equal to 0, the verifier will believe that the original 64-bit register is also 0, because it has the same ID, but its actual value still contains the rogue number in the upper half.
Some optimizations of the verifier prevent the actual bypass, so extra care is needed: the comparison must be between two registers, and both branches must be reachable (this is why one random bit is needed). Both branches are still suitable for the bypass.
6. Right shift the original register by 32 bits to pop the rogue number.
7. Use the rogue number as an offset with any pointer. The verifier will believe that the offset is 0, while in reality it's the given number.
The fix is similar to the 32-bit BPF_MOV handling in check_alu_op for SCALAR_VALUE. If the spill is narrowing the actual register value, don't keep the ID, make sure it's reset to 0.
--- kernel/bpf/verifier.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/bpf/verifier.c +3 -0
@@ -3128,6 +3128,9 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env,return err; }save_register_state (state, spi, reg, size); +/* Break the relation on a narrowing spill. */ +if (fls64 (reg->umax_value) >BITS_PER_BYTE * size) + state->stack[spi].spilled_ptr.id =0 ; }else if (!reg && !(off %BPF_REG_SIZE ) &&is_bpf_st_mem (insn) && insn->imm !=0 && env->bpf_capable) {struct bpf_reg_state fake_reg = {};
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 88/170 xfrm: fix inbound ipv4/udp/esp packets to UDPv6 dualstack sockets
In reply to Greg Kroah-HartmanFrom: Maciej Żenczykowski <[email protected]>
[ Upstream commit 1166a530a84758bb9e6b448fc8c195ed413f5ded ]
Before Linux v5.8 an AF_INET6 SOCK_DGRAM (udp/udplite) socket with SOL_UDP, UDP_ENCAP, UDP_ENCAP_ESPINUDP{,_NON_IKE} enabled would just unconditionally use xfrm4_udp_encap_rcv(), afterwards such a socket would use the newly added xfrm6_udp_encap_rcv() which only handles IPv6 packets.
--- net/ipv4/xfrm4_input.c | 1 + net/ipv6/xfrm6_input.c | 3 +++ 2 files changed, 4 insertions(+)
net/ipv4/xfrm4_input.c +1 -0
@@ -164,6 +164,7 @@ int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb)kfree_skb (skb);return 0 ; } +EXPORT_SYMBOL (xfrm4_udp_encap_rcv);int xfrm4_rcv (struct sk_buff *skb) {
net/ipv6/xfrm6_input.c +3 -0
@@ -86,6 +86,9 @@ int xfrm6_udp_encap_rcv(struct sock *sk, struct sk_buff *skb)__be32 *udpdata32;__u16 encap_type = up->encap_type; +if (skb->protocol ==htons (ETH_P_IP )) +return xfrm4_udp_encap_rcv (sk, skb); +/* if this is not encapsulated socket, then just return now */ if (!encap_type)return 1 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 89/170 bpf: Fix a bpf_jit_dump issue for x86_64 with sysctl bpf_jit_enable.
In reply to Greg Kroah-HartmanFrom: Yonghong Song <[email protected]>
[ Upstream commit ad96f1c9138e0897bee7f7c5e54b3e24f8b62f57 ]
The sysctl net/core/bpf_jit_enable does not work now due to commit 1022a5498f6f ("bpf, x86_64: Use bpf_jit_binary_pack_alloc"). The commit saved the jitted insns into 'rw_image' instead of 'image' which caused bpf_jit_dump not dumping proper content.
With 'echo 2 > /proc/sys/net/core/bpf_jit_enable', run './test_progs -t fentry_test'. Without this patch, one of jitted image for one particular prog is:
flen=17 proglen=92 pass=4 image=0000000014c64883 from=test_progs pid=1807 00000000: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 00000010: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 00000020: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 00000030: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 00000040: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 00000050: cc cc cc cc cc cc cc cc cc cc cc cc
With this patch, the jitte image for the same prog is:
flen=17 proglen=92 pass=4 image=00000000b90254b7 from=test_progs pid=1809 00000000: f3 0f 1e fa 0f 1f 44 00 00 66 90 55 48 89 e5 f3 00000010: 0f 1e fa 31 f6 48 8b 57 00 48 83 fa 07 75 2b 48 00000020: 8b 57 10 83 fa 09 75 22 48 8b 57 08 48 81 e2 ff 00000030: 00 00 00 48 83 fa 08 75 11 48 8b 7f 18 be 01 00 00000040: 00 00 48 83 ff 0a 74 02 31 f6 48 bf 18 d0 14 00 00000050: 00 c9 ff ff 48 89 77 00 31 c0 c9 c3
--- arch/x86/net/bpf_jit_comp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/net/bpf_jit_comp.c +1 -1
@@ -2478,7 +2478,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) }if (bpf_jit_enable >1 ) -bpf_jit_dump (prog->len, proglen, pass +1 , image); +bpf_jit_dump (prog->len, proglen, pass +1 , rw_image);if (image) {if (!prog->is_func || extra_pass) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 90/170 selftests: net: tls: check if FIPS mode is enabled
In reply to Greg Kroah-HartmanFrom: Magali Lemes <[email protected]>
[ Upstream commit d113c395c67b62fc0d3f2004c0afc406aca0a2b7 ]
TLS selftests use the ChaCha20-Poly1305 and SM4 algorithms, which are not FIPS compliant. When fips=1, this set of tests fails. Add a check and only run these tests if not in FIPS mode.
--- tools/testing/selftests/net/tls.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-)
tools/testing/selftests/net/tls.c +23 -1
@@ -25,6 +25,8 @@#define TLS_PAYLOAD_MAX_LEN 16384#define SOL_TLS 282 +static int fips_enabled; +struct tls_crypto_info_keys {union {struct tls12_crypto_info_aes_gcm_128 aes128;
@@ -235,7 +237,7 @@ FIXTURE_VARIANT(tls) {uint16_t tls_version;uint16_t cipher_type; -bool nopad; +bool nopad, fips_non_compliant; }; FIXTURE_VARIANT_ADD(tls, 12_aes_gcm)
@@ -254,24 +256,28 @@ FIXTURE_VARIANT_ADD(tls, 12_chacha) { .tls_version = TLS_1_2_VERSION, .cipher_type = TLS_CIPHER_CHACHA20_POLY1305, + .fips_non_compliant = true, }; FIXTURE_VARIANT_ADD(tls, 13_chacha) { .tls_version = TLS_1_3_VERSION, .cipher_type = TLS_CIPHER_CHACHA20_POLY1305, + .fips_non_compliant = true, }; FIXTURE_VARIANT_ADD(tls, 13_sm4_gcm) { .tls_version =TLS_1_3_VERSION , .cipher_type = TLS_CIPHER_SM4_GCM, + .fips_non_compliant = true, }; FIXTURE_VARIANT_ADD(tls, 13_sm4_ccm) { .tls_version =TLS_1_3_VERSION , .cipher_type = TLS_CIPHER_SM4_CCM, + .fips_non_compliant = true, }; FIXTURE_VARIANT_ADD(tls, 12_aes_ccm)
@@ -311,6 +317,9 @@ FIXTURE_SETUP(tls)int one =1 ;int ret; +if (fips_enabled && variant->fips_non_compliant) +SKIP (return,"Unsupported cipher in FIPS mode" ); +tls_crypto_info_init (variant->tls_version, variant->cipher_type, &tls12);
@@ -1820,4 +1829,17 @@ TEST(tls_v6ops) {close (sfd); } +static void __attribute__((constructor))fips_check (void ) { +int res; +FILE *f; + + f =fopen ("/proc/sys/crypto/fips_enabled" ,"r" ); +if (f) { + res =fscanf (f,"%d" , &fips_enabled); +if (res !=1 ) +ksft_print_msg ("ERROR: Couldn't read /proc/sys/crypto/fips_enabled\n" ); +fclose (f); + } +} +TEST_HARNESS_MAIN
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 91/170 selftests: net: vrf-xfrm-tests: change authentication and encryption algos
In reply to Greg Kroah-HartmanFrom: Magali Lemes <[email protected]>
[ Upstream commit cb43c60e64ca67fcc9d23bd08f51d2ab8209d9d7 ]
The vrf-xfrm-tests tests use the hmac(md5) and cbc(des3_ede) algorithms for performing authentication and encryption, respectively. This causes the tests to fail when fips=1 is set, since these algorithms are not allowed in FIPS mode. Therefore, switch from hmac(md5) and cbc(des3_ede) to hmac(sha1) and cbc(aes), which are FIPS compliant.
--- tools/testing/selftests/net/vrf-xfrm-tests.sh | 32 +++++++++---------- 1 file changed, 16 insertions(+), 16 deletions(-)
tools/testing/selftests/net/vrf-xfrm-tests.sh +16 -16
@@ -264,60 +264,60 @@ setup_xfrm() ip -netns host1 xfrm state add src ${HOST1_4} dst ${HOST2_4} \ proto esp spi ${SPI_1} reqid 0 mode tunnel \ replay-window 4 replay-oseq 0x4 \ - auth-trunc 'hmac(md5)' ${AUTH_1} 96 \ - enc 'cbc(des3_ede)' ${ENC_1} \ + auth-trunc 'hmac(sha1)' ${AUTH_1} 96 \ + enc 'cbc(aes)' ${ENC_1} \ sel src ${h1_4} dst ${h2_4} ${devarg} ip -netns host2 xfrm state add src ${HOST1_4} dst ${HOST2_4} \ proto esp spi ${SPI_1} reqid 0 mode tunnel \ replay-window 4 replay-oseq 0x4 \ - auth-trunc 'hmac(md5)' ${AUTH_1} 96 \ - enc 'cbc(des3_ede)' ${ENC_1} \ + auth-trunc 'hmac(sha1)' ${AUTH_1} 96 \ + enc 'cbc(aes)' ${ENC_1} \ sel src ${h1_4} dst ${h2_4} ip -netns host1 xfrm state add src ${HOST2_4} dst ${HOST1_4} \ proto esp spi ${SPI_2} reqid 0 mode tunnel \ replay-window 4 replay-oseq 0x4 \ - auth-trunc 'hmac(md5)' ${AUTH_2} 96 \ - enc 'cbc(des3_ede)' ${ENC_2} \ + auth-trunc 'hmac(sha1)' ${AUTH_2} 96 \ + enc 'cbc(aes)' ${ENC_2} \ sel src ${h2_4} dst ${h1_4} ${devarg} ip -netns host2 xfrm state add src ${HOST2_4} dst ${HOST1_4} \ proto esp spi ${SPI_2} reqid 0 mode tunnel \ replay-window 4 replay-oseq 0x4 \ - auth-trunc 'hmac(md5)' ${AUTH_2} 96 \ - enc 'cbc(des3_ede)' ${ENC_2} \ + auth-trunc 'hmac(sha1)' ${AUTH_2} 96 \ + enc 'cbc(aes)' ${ENC_2} \ sel src ${h2_4} dst ${h1_4} ip -6 -netns host1 xfrm state add src ${HOST1_6} dst ${HOST2_6} \ proto esp spi ${SPI_1} reqid 0 mode tunnel \ replay-window 4 replay-oseq 0x4 \ - auth-trunc 'hmac(md5)' ${AUTH_1} 96 \ - enc 'cbc(des3_ede)' ${ENC_1} \ + auth-trunc 'hmac(sha1)' ${AUTH_1} 96 \ + enc 'cbc(aes)' ${ENC_1} \ sel src ${h1_6} dst ${h2_6} ${devarg} ip -6 -netns host2 xfrm state add src ${HOST1_6} dst ${HOST2_6} \ proto esp spi ${SPI_1} reqid 0 mode tunnel \ replay-window 4 replay-oseq 0x4 \ - auth-trunc 'hmac(md5)' ${AUTH_1} 96 \ - enc 'cbc(des3_ede)' ${ENC_1} \ + auth-trunc 'hmac(sha1)' ${AUTH_1} 96 \ + enc 'cbc(aes)' ${ENC_1} \ sel src ${h1_6} dst ${h2_6} ip -6 -netns host1 xfrm state add src ${HOST2_6} dst ${HOST1_6} \ proto esp spi ${SPI_2} reqid 0 mode tunnel \ replay-window 4 replay-oseq 0x4 \ - auth-trunc 'hmac(md5)' ${AUTH_2} 96 \ - enc 'cbc(des3_ede)' ${ENC_2} \ + auth-trunc 'hmac(sha1)' ${AUTH_2} 96 \ + enc 'cbc(aes)' ${ENC_2} \ sel src ${h2_6} dst ${h1_6} ${devarg} ip -6 -netns host2 xfrm state add src ${HOST2_6} dst ${HOST1_6} \ proto esp spi ${SPI_2} reqid 0 mode tunnel \ replay-window 4 replay-oseq 0x4 \ - auth-trunc 'hmac(md5)' ${AUTH_2} 96 \ - enc 'cbc(des3_ede)' ${ENC_2} \ + auth-trunc 'hmac(sha1)' ${AUTH_2} 96 \ + enc 'cbc(aes)' ${ENC_2} \ sel src ${h2_6} dst ${h1_6} }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 92/170 selftests: net: fcnal-test: check if FIPS mode is enabled
In reply to Greg Kroah-HartmanFrom: Magali Lemes <[email protected]>
[ Upstream commit d7a2fc1437f71cb058c7b11bc33dfc19e4bf277a ]
There are some MD5 tests which fail when the kernel is in FIPS mode, since MD5 is not FIPS compliant. Add a check and only run those tests if FIPS mode is not enabled.
--- tools/testing/selftests/net/fcnal-test.sh | 27 ++++++++++++++++------- 1 file changed, 19 insertions(+), 8 deletions(-)
tools/testing/selftests/net/fcnal-test.sh +19 -8
@@ -92,6 +92,13 @@ NSC_CMD="ip netns exec ${NSC}" which ping6 > /dev/null 2>&1 && ping6=$(which ping6) || ping6=$(which ping) +# Check if FIPS mode is enabled +if [ -f /proc/sys/crypto/fips_enabled ]; then + fips_enabled=`cat /proc/sys/crypto/fips_enabled` +else + fips_enabled=0 +fi + ################################################################################ # utilities
@@ -1216,7 +1223,7 @@ ipv4_tcp_novrf() run_cmd nettest -d ${NSA_DEV} -r ${a} log_test_addr ${a} $? 1 "No server, device client, local conn" - ipv4_tcp_md5_novrf + [ "$fips_enabled" = "1" ] || ipv4_tcp_md5_novrf } ipv4_tcp_vrf()
@@ -1270,9 +1277,11 @@ ipv4_tcp_vrf() log_test_addr ${a} $? 1 "Global server, local connection" # run MD5 tests - setup_vrf_dup - ipv4_tcp_md5 - cleanup_vrf_dup + if [ "$fips_enabled" = "0" ]; then + setup_vrf_dup + ipv4_tcp_md5 + cleanup_vrf_dup + fi # # enable VRF global server
@@ -2772,7 +2781,7 @@ ipv6_tcp_novrf() log_test_addr ${a} $? 1 "No server, device client, local conn" done - ipv6_tcp_md5_novrf + [ "$fips_enabled" = "1" ] || ipv6_tcp_md5_novrf } ipv6_tcp_vrf()
@@ -2842,9 +2851,11 @@ ipv6_tcp_vrf() log_test_addr ${a} $? 1 "Global server, local connection" # run MD5 tests - setup_vrf_dup - ipv6_tcp_md5 - cleanup_vrf_dup + if [ "$fips_enabled" = "0" ]; then + setup_vrf_dup + ipv6_tcp_md5 + cleanup_vrf_dup + fi # # enable VRF global server
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 93/170 xfrm: Linearize the skb after offloading if needed.
In reply to Greg Kroah-HartmanFrom: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit f015b900bc3285322029b4a7d132d6aeb0e51857 ]
With offloading enabled, esp_xmit() gets invoked very late, from within validate_xmit_xfrm() which is after validate_xmit_skb() validates and linearizes the skb if the underlying device does not support fragments.
esp_output_tail() may add a fragment to the skb while adding the auth tag/ IV. Devices without the proper support will then send skb->data points to with the correct length so the packet will have garbage at the end. A pcap sniffer will claim that the proper data has been sent since it parses the skb properly.
It is not affected with INET_ESP_OFFLOAD disabled.
Linearize the skb after offloading if the sending hardware requires it. It was tested on v4, v6 has been adopted.
--- net/ipv4/esp4_offload.c | 3 +++ net/ipv6/esp6_offload.c | 3 +++ 2 files changed, 6 insertions(+)
net/ipv4/esp4_offload.c +3 -0
@@ -340,6 +340,9 @@ static int esp_xmit(struct xfrm_state *x, struct sk_buff *skb, netdev_features_secpath_reset (skb); +if (skb_needs_linearize (skb, skb->dev->features) && +__skb_linearize (skb)) +return -ENOMEM ;return 0 ; }
net/ipv6/esp6_offload.c +3 -0
@@ -375,6 +375,9 @@ static int esp6_xmit(struct xfrm_state *x, struct sk_buff *skb, netdev_featuressecpath_reset (skb); +if (skb_needs_linearize (skb, skb->dev->features) && +__skb_linearize (skb)) +return -ENOMEM ;return 0 ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 94/170 net/mlx5: DR, Fix wrong action data allocation in decap action
In reply to Greg Kroah-HartmanFrom: Yevgeny Kliteynik <[email protected]>
[ Upstream commit ef4c5afc783dc3d47640270a9b94713229c697e8 ]
When TUNNEL_L3_TO_L2 decap action was created, a pointer to a local variable was passed as its HW action data, resulting in attempt to free invalid address:
BUG: KASAN: invalid-free in mlx5dr_action_destroy+0x318/0x410 [mlx5_core]
--- .../net/ethernet/mellanox/mlx5/core/steering/dr_action.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/steering/dr_action.c +8 -1
@@ -1200,9 +1200,13 @@ dr_action_create_reformat_action(struct mlx5dr_domain *dmn, }case DR_ACTION_TYP_TNL_L3_TO_L2 : { -u8 hw_actions[ACTION_CACHE_LINE_SIZE ] = {}; +u8 *hw_actions;int ret; + hw_actions =kzalloc (ACTION_CACHE_LINE_SIZE ,GFP_KERNEL ); +if (!hw_actions) +return -ENOMEM ; + ret = mlx5dr_ste_set_action_decap_l3_list(dmn->ste_ctx, data, data_sz, hw_actions,
@@ -1210,6 +1214,7 @@ dr_action_create_reformat_action(struct mlx5dr_domain *dmn, &action->rewrite->num_of_actions);if (ret) {mlx5dr_dbg (dmn,"Failed creating decap l3 action list\n" ); +kfree (hw_actions);return ret; }
@@ -1217,6 +1222,7 @@ dr_action_create_reformat_action(struct mlx5dr_domain *dmn, DR_CHUNK_SIZE_8);if (!action->rewrite->chunk) {mlx5dr_dbg (dmn,"Failed allocating modify header chunk\n" ); +kfree (hw_actions);return -ENOMEM ; }
@@ -1230,6 +1236,7 @@ dr_action_create_reformat_action(struct mlx5dr_domain *dmn,if (ret) {mlx5dr_dbg (dmn,"Writing decap l3 actions to ICM failed\n" );mlx5dr_icm_free_chunk (action->rewrite->chunk); +kfree (hw_actions);return ret; }return 0 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 95/170 sfc: use budget for TX completions
In reply to Greg Kroah-HartmanFrom: Íñigo Huguet <[email protected]>
[ Upstream commit 4aaf2c52834b7f95acdf9fb0211a1b60adbf421b ]
When running workloads heavy unbalanced towards TX (high TX, low RX traffic), sfc driver can retain the CPU during too long times. Although in many cases this is not enough to be visible, it can affect performance and system responsiveness.
A way to reproduce it is to use a debug kernel and run some parallel netperf TX tests. In some systems, this will lead to this message being logged:
kernel:watchdog: BUG: soft lockup - CPU#12 stuck for 22s!
The reason is that sfc driver doesn't account any NAPI budget for the TX completion events work. With high-TX/low-RX traffic, this makes that the CPU is held for long time for NAPI poll.
Documentations says "drivers can process completions for any number of Tx packets but should only process up to budget number of Rx packets". However, many drivers do limit the amount of TX completions that they process in a single NAPI poll.
In the same way, this patch adds a limit for the TX work in sfc. With the patch applied, the watchdog warning never appears.
Tested with netperf in different combinations: single process / parallel processes, TCP / UDP and different sizes of UDP messages. Repeated the tests before and after the patch, without any noticeable difference in network or CPU performance.
Test hardware:
Intel(R) Xeon(R) CPU E5-1620 v4 @ 3.50GHz (4 cores, 2 threads/core) Solarflare Communications XtremeScale X2522-25G Network Adapter
--- drivers/net/ethernet/sfc/ef10.c | 25 ++++++++++++++++++------- drivers/net/ethernet/sfc/ef100_nic.c | 7 ++++++- drivers/net/ethernet/sfc/ef100_tx.c | 4 ++-- drivers/net/ethernet/sfc/ef100_tx.h | 2 +- drivers/net/ethernet/sfc/tx_common.c | 4 +++- drivers/net/ethernet/sfc/tx_common.h | 2 +- 6 files changed, 31 insertions(+), 13 deletions(-)
drivers/net/ethernet/sfc/ef10.c +18 -7
@@ -2950,7 +2950,7 @@ static u32 efx_ef10_extract_event_ts(efx_qword_t *event)return tstamp; } -static void +static int efx_ef10_handle_tx_event (struct efx_channel *channel,efx_qword_t *event) {struct efx_nic *efx = channel->efx;
@@ -2958,13 +2958,14 @@ efx_ef10_handle_tx_event(struct efx_channel *channel, efx_qword_t *event)unsigned int tx_ev_desc_ptr;unsigned int tx_ev_q_label;unsigned int tx_ev_type; +int work_done;u64 ts_part;if (unlikely (READ_ONCE (efx->reset_pending))) -return ; +return 0 ;if (unlikely (EFX_QWORD_FIELD (*event,ESF_DZ_TX_DROP_EVENT ))) -return ; +return 0 ;/* Get the transmit queue */ tx_ev_q_label =EFX_QWORD_FIELD (*event,ESF_DZ_TX_QLABEL );
@@ -2973,8 +2974,7 @@ efx_ef10_handle_tx_event(struct efx_channel *channel, efx_qword_t *event)if (!tx_queue->timestamping) {/* Transmit completion */ tx_ev_desc_ptr =EFX_QWORD_FIELD (*event,ESF_DZ_TX_DESCR_INDX ); -efx_xmit_done (tx_queue, tx_ev_desc_ptr & tx_queue->ptr_mask); -return ; +return efx_xmit_done (tx_queue, tx_ev_desc_ptr & tx_queue->ptr_mask); }/* Transmit timestamps are only available for 8XXX series. They result
@@ -3000,6 +3000,7 @@ efx_ef10_handle_tx_event(struct efx_channel *channel, efx_qword_t *event)* fields in the event. */ tx_ev_type =EFX_QWORD_FIELD (*event,ESF_EZ_TX_SOFT1 ); + work_done =0 ;switch (tx_ev_type) {case TX_TIMESTAMP_EVENT_TX_EV_COMPLETION :
@@ -3016,6 +3017,7 @@ efx_ef10_handle_tx_event(struct efx_channel *channel, efx_qword_t *event) tx_queue->completed_timestamp_major = ts_part;efx_xmit_done_single (tx_queue); + work_done =1 ;break ;default :
@@ -3026,6 +3028,8 @@ efx_ef10_handle_tx_event(struct efx_channel *channel, efx_qword_t *event) EFX_QWORD_VAL(*event));break ; } + +return work_done; } static void
@@ -3081,13 +3085,16 @@ static void efx_ef10_handle_driver_generated_event(struct efx_channel *channel, } } +#define EFX_NAPI_MAX_TX 512 +static int efx_ef10_ev_process (struct efx_channel *channel,int quota) {struct efx_nic *efx = channel->efx;efx_qword_t event, *p_event;unsigned int read_ptr; -int ev_code; +int spent_tx =0 ;int spent =0 ; +int ev_code;if (quota <=0 )return spent;
@@ -3126,7 +3133,11 @@ static int efx_ef10_ev_process(struct efx_channel *channel, int quota) }break ;case ESE_DZ_EV_CODE_TX_EV : -efx_ef10_handle_tx_event (channel, &event); + spent_tx +=efx_ef10_handle_tx_event (channel, &event); +if (spent_tx >=EFX_NAPI_MAX_TX ) { + spent = quota; + goto out; + }break ;case ESE_DZ_EV_CODE_DRIVER_EV :efx_ef10_handle_driver_event (channel, &event);
drivers/net/ethernet/sfc/ef100_nic.c +6 -1
@@ -242,6 +242,8 @@ static void ef100_ev_read_ack(struct efx_channel *channel) efx_reg(channel->efx, ER_GZ_EVQ_INT_PRIME)); } +#define EFX_NAPI_MAX_TX 512 +static int ef100_ev_process (struct efx_channel *channel,int quota) {struct efx_nic *efx = channel->efx;
@@ -249,6 +251,7 @@ static int ef100_ev_process(struct efx_channel *channel, int quota)bool evq_phase, old_evq_phase;unsigned int read_ptr;efx_qword_t *p_event; +int spent_tx =0 ;int spent =0 ;bool ev_phase;int ev_type;
@@ -284,7 +287,9 @@ static int ef100_ev_process(struct efx_channel *channel, int quota)efx_mcdi_process_event (channel, p_event);break ;case ESE_GZ_EF100_EV_TX_COMPLETION : -ef100_ev_tx (channel, p_event); + spent_tx +=ef100_ev_tx (channel, p_event); +if (spent_tx >=EFX_NAPI_MAX_TX ) + spent = quota;break ;case ESE_GZ_EF100_EV_DRIVER : netif_info(efx, drv, efx->net_dev,
drivers/net/ethernet/sfc/ef100_tx.c +2 -2
@@ -346,7 +346,7 @@ void ef100_tx_write(struct efx_tx_queue *tx_queue)ef100_tx_push_buffers (tx_queue); } -void ef100_ev_tx (struct efx_channel *channel,const efx_qword_t *p_event) +int ef100_ev_tx (struct efx_channel *channel,const efx_qword_t *p_event) {unsigned int tx_done =EFX_QWORD_FIELD (*p_event,ESF_GZ_EV_TXCMPL_NUM_DESC );
@@ -357,7 +357,7 @@ void ef100_ev_tx(struct efx_channel *channel, const efx_qword_t *p_event)unsigned int tx_index = (tx_queue->read_count + tx_done -1 ) & tx_queue->ptr_mask; -efx_xmit_done (tx_queue, tx_index); +return efx_xmit_done (tx_queue, tx_index); }/* Add a socket buffer to a TX queue
drivers/net/ethernet/sfc/ef100_tx.h +1 -1
@@ -20,7 +20,7 @@ void ef100_tx_init(struct efx_tx_queue *tx_queue);void ef100_tx_write (struct efx_tx_queue *tx_queue);unsigned int ef100_tx_max_skb_descs (struct efx_nic *efx); -void ef100_ev_tx (struct efx_channel *channel,const efx_qword_t *p_event); +int ef100_ev_tx (struct efx_channel *channel,const efx_qword_t *p_event);netdev_tx_t ef100_enqueue_skb (struct efx_tx_queue *tx_queue,struct sk_buff *skb); int __ef100_enqueue_skb(struct efx_tx_queue *tx_queue, struct sk_buff *skb,
drivers/net/ethernet/sfc/tx_common.c +3 -1
@@ -249,7 +249,7 @@ void efx_xmit_done_check_empty(struct efx_tx_queue *tx_queue) } } -void efx_xmit_done (struct efx_tx_queue *tx_queue,unsigned int index) +int efx_xmit_done (struct efx_tx_queue *tx_queue,unsigned int index) {unsigned int fill_level, pkts_compl =0 , bytes_compl =0 ;unsigned int efv_pkts_compl =0 ;
@@ -279,6 +279,8 @@ void efx_xmit_done(struct efx_tx_queue *tx_queue, unsigned int index) }efx_xmit_done_check_empty (tx_queue); + +return pkts_compl + efv_pkts_compl; }/* Remove buffers put into a tx_queue for the current packet.
drivers/net/ethernet/sfc/tx_common.h +1 -1
@@ -28,7 +28,7 @@ static inline bool efx_tx_buffer_in_use(struct efx_tx_buffer *buffer) }void efx_xmit_done_check_empty (struct efx_tx_queue *tx_queue); -void efx_xmit_done (struct efx_tx_queue *tx_queue,unsigned int index); +int efx_xmit_done (struct efx_tx_queue *tx_queue,unsigned int index);void efx_enqueue_unwind (struct efx_tx_queue *tx_queue,unsigned int insert_count);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 96/170 net: qca_spi: Avoid high load if QCA7000 is not available
In reply to Greg Kroah-HartmanFrom: Stefan Wahren <[email protected]>
[ Upstream commit 92717c2356cb62c89e8a3dc37cbbab2502562524 ]
In case the QCA7000 is not available via SPI (e.g. in reset), the driver will cause a high load. The reason for this is that the synchronization is never finished and schedule() is never called. Since the synchronization is not timing critical, it's safe to drop this from the scheduling condition.
--- drivers/net/ethernet/qualcomm/qca_spi.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/ethernet/qualcomm/qca_spi.c +1 -2
@@ -582,8 +582,7 @@ qcaspi_spi_thread(void *data)while (!kthread_should_stop ()) {set_current_state (TASK_INTERRUPTIBLE );if ((qca->intr_req == qca->intr_svc) && - (qca->txr.skb[qca->txr.head] ==NULL ) && - (qca->sync ==QCASPI_SYNC_READY )) + !qca->txr.skb[qca->txr.head])schedule ();set_current_state (TASK_RUNNING );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 97/170 mmc: mtk-sd: fix deferred probing
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 0c4dc0f054891a2cbde0426b0c0fdf232d89f47f ]
The driver overrides the error codes returned by platform_get_irq() to -EINVAL, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the error codes upstream.
--- drivers/mmc/host/mtk-sd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/host/mtk-sd.c +1 -1
@@ -2658,7 +2658,7 @@ static int msdc_drv_probe(struct platform_device *pdev) host->irq =platform_get_irq (pdev,0 );if (host->irq <0 ) { - ret = -EINVAL ; + ret = host->irq; goto host_free; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 98/170 mmc: mvsdio: fix deferred probing
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 8d84064da0d4672e74f984e8710f27881137472c ]
The driver overrides the error codes returned by platform_get_irq() to -ENXIO, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the error codes upstream.
--- drivers/mmc/host/mvsdio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/host/mvsdio.c +1 -1
@@ -704,7 +704,7 @@ static int mvsd_probe(struct platform_device *pdev) } irq =platform_get_irq (pdev,0 );if (irq <0 ) -return -ENXIO ; +return irq; mmc =mmc_alloc_host (sizeof (struct mvsd_host ), &pdev->dev);if (!mmc) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 99/170 mmc: omap: fix deferred probing
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit aedf4ba1ad00aaa94c1b66c73ecaae95e2564b95 ]
The driver overrides the error codes returned by platform_get_irq() to -ENXIO, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the error codes upstream.
--- drivers/mmc/host/omap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/host/omap.c +1 -1
@@ -1343,7 +1343,7 @@ static int mmc_omap_probe(struct platform_device *pdev) irq =platform_get_irq (pdev,0 );if (irq <0 ) -return -ENXIO ; +return irq; res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); host->virt_base =devm_ioremap_resource (&pdev->dev, res);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 100/170 mmc: omap_hsmmc: fix deferred probing
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit fb51b74a57859b707c3e8055ed0c25a7ca4f6a29 ]
The driver overrides the error codes returned by platform_get_irq() to -ENXIO, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the error codes upstream.
--- drivers/mmc/host/omap_hsmmc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/mmc/host/omap_hsmmc.c +4 -2
@@ -1791,9 +1791,11 @@ static int omap_hsmmc_probe(struct platform_device *pdev) } res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); - irq =platform_get_irq (pdev,0 ); -if (res ==NULL || irq <0 ) +if (!res)return -ENXIO ; + irq =platform_get_irq (pdev,0 ); +if (irq <0 ) +return irq; base =devm_ioremap_resource (&pdev->dev, res);if (IS_ERR (base))
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 101/170 mmc: owl: fix deferred probing
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 3c482e1e830d79b9be8afb900a965135c01f7893 ]
The driver overrides the error codes returned by platform_get_irq() to -EINVAL, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the error codes upstream.
--- drivers/mmc/host/owl-mmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/host/owl-mmc.c +1 -1
@@ -638,7 +638,7 @@ static int owl_mmc_probe(struct platform_device *pdev) owl_host->irq =platform_get_irq (pdev,0 );if (owl_host->irq <0 ) { - ret = -EINVAL ; + ret = owl_host->irq; goto err_release_channel; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 102/170 mmc: sdhci-acpi: fix deferred probing
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit b465dea5e1540c7d7b5211adaf94926980d3014b ]
The driver overrides the error codes returned by platform_get_irq() to -EINVAL, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the error codes upstream.
--- drivers/mmc/host/sdhci-acpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/host/sdhci-acpi.c +1 -1
@@ -829,7 +829,7 @@ static int sdhci_acpi_probe(struct platform_device *pdev) host->ops = &sdhci_acpi_ops_dflt; host->irq =platform_get_irq (pdev,0 );if (host->irq <0 ) { - err = -EINVAL ; + err = host->irq; goto err_free; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 103/170 mmc: sh_mmcif: fix deferred probing
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 5b067d7f855c61df7f8e2e8ccbcee133c282415e ]
The driver overrides the error codes returned by platform_get_irq() to -ENXIO, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the error codes upstream.
--- drivers/mmc/host/sh_mmcif.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/host/sh_mmcif.c +1 -1
@@ -1400,7 +1400,7 @@ static int sh_mmcif_probe(struct platform_device *pdev) irq[0 ] =platform_get_irq (pdev,0 ); irq[1 ] =platform_get_irq_optional (pdev,1 );if (irq[0 ] <0 ) -return -ENXIO ; +return irq[0 ]; reg =devm_platform_ioremap_resource (pdev,0 );if (IS_ERR (reg))
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 104/170 mmc: usdhi60rol0: fix deferred probing
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 413db499730248431c1005b392e8ed82c4fa19bf ]
The driver overrides the error codes returned by platform_get_irq_byname() to -ENODEV, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating error codes upstream.
--- drivers/mmc/host/usdhi6rol0.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/mmc/host/usdhi6rol0.c +4 -2
@@ -1757,8 +1757,10 @@ static int usdhi6_probe(struct platform_device *pdev) irq_cd =platform_get_irq_byname (pdev,"card detect" ); irq_sd =platform_get_irq_byname (pdev,"data" ); irq_sdio =platform_get_irq_byname (pdev,"SDIO" ); -if (irq_sd <0 || irq_sdio <0 ) -return -ENODEV ; +if (irq_sd <0 ) +return irq_sd; +if (irq_sdio <0 ) +return irq_sdio; mmc =mmc_alloc_host (sizeof (struct usdhi6_host ), dev);if (!mmc)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 105/170 ipvs: align inner_mac_header for encapsulation
In reply to Greg Kroah-HartmanFrom: Terin Stock <[email protected]>
[ Upstream commit d7fce52fdf96663ddc2eb21afecff3775588612a ]
When using encapsulation the original packet's headers are copied to the inner headers. This preserves the space for an inner mac header, which is not used by the inner payloads for the encapsulation types supported by IPVS. If a packet is using GUE or GRE encapsulation and needs to be segmented, flow can be passed to __skb_udp_tunnel_segment() which calculates a negative tunnel header length. A negative tunnel header length causes pskb_may_pull() to fail, dropping the packet.
This can be observed by attaching probes to ip_vs_in_hook(), __dev_queue_xmit(), and __skb_udp_tunnel_segment():
perf probe --add '__dev_queue_xmit skb->inner_mac_header \
skb->inner_network_header skb->mac_header skb->network_header'
perf probe --add '__skb_udp_tunnel_segment:7 tnl_hlen'
perf probe -m ip_vs --add 'ip_vs_in_hook skb->inner_mac_header \
skb->inner_network_header skb->mac_header skb->network_header'These probes the headers and tunnel header length for packets which traverse the IPVS encapsulation path. A TCP packet can be forced into the segmentation path by being smaller than a calculated clamped MSS, but larger than the advertised MSS.
probe:ip_vs_in_hook: inner_mac_header=0x0 inner_network_header=0x0 mac_header=0x44 network_header=0x52
probe:ip_vs_in_hook: inner_mac_header=0x44 inner_network_header=0x52 mac_header=0x44 network_header=0x32
probe:dev_queue_xmit: inner_mac_header=0x44 inner_network_header=0x52 mac_header=0x44 network_header=0x32
probe:__skb_udp_tunnel_segment_L7: tnl_hlen=-2When using veth-based encapsulation, the interfaces are set to be mac-less, which does not preserve space for an inner mac header. This prevents this issue from occurring.
In our real-world testing of sending a 32KB file we observed operation time increasing from ~75ms for veth-based encapsulation to over 1.5s using IPVS encapsulation due to retries from dropped packets.
This changeset modifies the packet on the encapsulation path in ip_vs_tunnel_xmit() and ip_vs_tunnel_xmit_v6() to remove the inner mac header offset. This fixes UDP segmentation for both encapsulation types, and corrects the inner headers for any IPIP flows that may use it.
--- net/netfilter/ipvs/ip_vs_xmit.c | 2 ++ 1 file changed, 2 insertions(+)
net/netfilter/ipvs/ip_vs_xmit.c +2 -0
@@ -1225,6 +1225,7 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp, skb->transport_header = skb->network_header;skb_set_inner_ipproto (skb, next_protocol); +skb_set_inner_mac_header (skb,skb_inner_network_offset (skb));if (tun_type ==IP_VS_CONN_F_TUNNEL_TYPE_GUE ) {bool check = false;
@@ -1373,6 +1374,7 @@ ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp, skb->transport_header = skb->network_header;skb_set_inner_ipproto (skb, next_protocol); +skb_set_inner_mac_header (skb,skb_inner_network_offset (skb));if (tun_type ==IP_VS_CONN_F_TUNNEL_TYPE_GUE ) {bool check = false;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 106/170 net: dsa: mt7530: fix trapping frames on non-MT7621 SoC MT7530 switch
In reply to Greg Kroah-HartmanFrom: Arınç ÜNAL <[email protected]>
[ Upstream commit 4ae90f90e4909e3014e2dc6a0627964617a7b824 ]
All MT7530 switch IP variants share the MT7530_MFC register, but the current driver only writes it for the switch variant that is integrated in the MT7621 SoC. Modify the code to include all MT7530 derivatives.
--- drivers/net/dsa/mt7530.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/mt7530.c +1 -1
@@ -1020,7 +1020,7 @@ mt753x_cpu_port_enable(struct dsa_switch *ds, int port) UNU_FFP(BIT(port)));/* Set CPU port number */ -if (priv->id ==ID_MT7621 ) +if (priv->id ==ID_MT7530 || priv->id ==ID_MT7621 )mt7530_rmw (priv,MT7530_MFC ,CPU_MASK ,CPU_EN |CPU_PORT (port));/* CPU port gets connected to all user ports of
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 107/170 net: dsa: mt7530: fix handling of BPDUs on MT7530 switch
In reply to Greg Kroah-HartmanFrom: Arınç ÜNAL <[email protected]>
[ Upstream commit d7c66073559386b836bded7cdc8b66ee5c049129 ]
BPDUs are link-local frames, therefore they must be trapped to the CPU port. Currently, the MT7530 switch treats BPDUs as regular multicast frames, therefore flooding them to user ports. To fix this, set BPDUs to be trapped to the CPU port. Group this on mt7530_setup() and mt7531_setup_common() into mt753x_trap_frames() and call that.
--- drivers/net/dsa/mt7530.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/net/dsa/mt7530.c +12 -2
@@ -998,6 +998,14 @@ static void mt7530_setup_port5(struct dsa_switch *ds, phy_interface_t interface)mutex_unlock (&priv->reg_mutex); } +static void +mt753x_trap_frames (struct mt7530_priv *priv) +{ +/* Trap BPDUs to the CPU port(s) */ +mt7530_rmw (priv,MT753X_BPC ,MT753X_BPDU_PORT_FW_MASK , +MT753X_BPDU_CPU_ONLY ); +} +static int mt753x_cpu_port_enable (struct dsa_switch *ds,int port) {
@@ -2219,6 +2227,8 @@ mt7530_setup(struct dsa_switch *ds) priv->p6_interface =PHY_INTERFACE_MODE_NA ; +mt753x_trap_frames (priv); +/* Enable and reset MIB counters */ mt7530_mib_reset (ds);
@@ -2325,8 +2335,8 @@ mt7531_setup_common(struct dsa_switch *ds) BIT(cpu_dp->index));break ; } -mt7530_rmw (priv,MT753X_BPC ,MT753X_BPDU_PORT_FW_MASK , -MT753X_BPDU_CPU_ONLY ); + +mt753x_trap_frames (priv);/* Enable and reset MIB counters */ mt7530_mib_reset (ds);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 108/170 net: dsa: mt7530: fix handling of LLDP frames
In reply to Greg Kroah-HartmanFrom: Arınç ÜNAL <[email protected]>
[ Upstream commit 8332cf6fd7c7087dbc2067115b33979c9851bbc4 ]
LLDP frames are link-local frames, therefore they must be trapped to the CPU port. Currently, the MT753X switches treat LLDP frames as regular multicast frames, therefore flooding them to user ports. To fix this, set LLDP frames to be trapped to the CPU port(s).
--- drivers/net/dsa/mt7530.c | 4 ++++ drivers/net/dsa/mt7530.h | 5 +++++ 2 files changed, 9 insertions(+)
drivers/net/dsa/mt7530.c +4 -0
@@ -1004,6 +1004,10 @@ mt753x_trap_frames(struct mt7530_priv *priv)/* Trap BPDUs to the CPU port(s) */ mt7530_rmw (priv,MT753X_BPC ,MT753X_BPDU_PORT_FW_MASK ,MT753X_BPDU_CPU_ONLY ); + +/* Trap LLDP frames with :0E MAC DA to the CPU port(s) */ +mt7530_rmw (priv,MT753X_RGAC2 ,MT753X_R0E_PORT_FW_MASK , +MT753X_R0E_PORT_FW (MT753X_BPDU_CPU_ONLY )); } static int
drivers/net/dsa/mt7530.h +5 -0
@@ -65,6 +65,11 @@ enum mt753x_id {#define MT753X_BPC 0x24#define MT753X_BPDU_PORT_FW_MASK GENMASK(2, 0) +/* Register for :03 and :0E MAC DA frame control */ +#define MT753X_RGAC2 0x2c +#define MT753X_R0E_PORT_FW_MASK GENMASK(18, 16) +#define MT753X_R0E_PORT_FW (x) FIELD_PREP(MT753X_R0E_PORT_FW_MASK, x) +enum mt753x_bpdu_port_fw {MT753X_BPDU_FOLLOW_MFC ,MT753X_BPDU_CPU_EXCLUDE =4 ,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 109/170 be2net: Extend xmit workaround to BE3 chip
In reply to Greg Kroah-HartmanFrom: Ross Lagerwall <[email protected]>
[ Upstream commit 7580e0a78eb29e7bb1a772eba4088250bbb70d41 ]
We have seen a bug where the NIC incorrectly changes the length in the IP header of a padded packet to include the padding bytes. The driver already has a workaround for this so do the workaround for this NIC too. This resolves the issue.
The NIC in question identifies itself as follows:
[ 8.828494] be2net 0000:02:00.0: FW version is 10.7.110.31 [ 8.834759] be2net 0000:02:00.0: Emulex OneConnect(be3): PF FLEX10 port 1
02:00.0 Ethernet controller: Emulex Corporation OneConnect 10Gb NIC (be3) (rev 01)
--- drivers/net/ethernet/emulex/benet/be_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/emulex/benet/be_main.c +2 -2
@@ -1136,8 +1136,8 @@ static struct sk_buff *be_lancer_xmit_workarounds(struct be_adapter *adapter, eth_hdr_len =ntohs (skb->protocol) ==ETH_P_8021Q ?VLAN_ETH_HLEN :ETH_HLEN ;if (skb->len <=60 && - (lancer_chip (adapter) ||skb_vlan_tag_present (skb)) && -is_ipv4_pkt (skb)) { + (lancer_chip (adapter) ||BE3_chip (adapter) || +skb_vlan_tag_present (skb)) &&is_ipv4_pkt (skb)) { ip = (struct iphdr *)ip_hdr (skb);pskb_trim (skb, eth_hdr_len +ntohs (ip->tot_len)); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 110/170 netfilter: nf_tables: fix chain binding transaction logic
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 4bedf9eee016286c835e3d8fa981ddece5338795 ]
Add bound flag to rule and chain transactions as in 6a0a8d10a366 ("netfilter: nf_tables: use-after-free in failing rule with bound set") to skip them in case that the chain is already bound from the abort path.
This patch fixes an imbalance in the chain use refcnt that triggers a WARN_ON on the table and chain destroy path.
This patch also disallows nested chain bindings, which is not supported from userspace.
The logic to deal with chain binding in nft_data_hold() and nft_data_release() is not correct. The NFT_TRANS_PREPARE state needs a special handling in case a chain is bound but next expressions in the same rule fail to initialize as described by 1240eb93f061 ("netfilter:nf_tables: incorrect error path handling with NFT_MSG_NEWRULE").
The chain is left bound if rule construction fails, so the objects stored in this chain (and the chain itself) are released by the transaction records from the abort path, follow up patch ("netfilter:nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain") completes this error handling.
When deleting an existing rule, chain bound flag is set off so the rule expression .destroy path releases the objects.
--- include/net/netfilter/nf_tables.h | 21 +++++++- net/netfilter/nf_tables_api.c | 86 +++++++++++++++++++----------- net/netfilter/nft_immediate.c | 87 +++++++++++++++++++++++++++---- 3 files changed, 153 insertions(+), 41 deletions(-)
include/net/netfilter/nf_tables.h +20 -1
@@ -1002,7 +1002,10 @@ static inline struct nft_userdata *nft_userdata(const struct nft_rule *rule)return (void *)&rule->data[rule->dlen]; } -void nf_tables_rule_release (const struct nft_ctx *ctx,struct nft_rule *rule); +void nft_rule_expr_activate (const struct nft_ctx *ctx,struct nft_rule *rule); +void nft_rule_expr_deactivate (const struct nft_ctx *ctx,struct nft_rule *rule, +enum nft_trans_phase phase); +void nf_tables_rule_destroy (const struct nft_ctx *ctx,struct nft_rule *rule); static inline void nft_set_elem_update_expr(const struct nft_set_ext *ext, struct nft_regs *regs,
@@ -1085,6 +1088,7 @@ int nft_setelem_validate(const struct nft_ctx *ctx, struct nft_set *set,const struct nft_set_iter *iter, struct nft_set_elem *elem);int nft_set_catchall_validate (const struct nft_ctx *ctx,struct nft_set *set); +int nf_tables_bind_chain (const struct nft_ctx *ctx,struct nft_chain *chain);enum nft_chain_types {NFT_CHAIN_T_DEFAULT =0 ,
@@ -1121,11 +1125,17 @@ int nft_chain_validate_dependency(const struct nft_chain *chain,int nft_chain_validate_hooks (const struct nft_chain *chain,unsigned int hook_flags); +static inline bool nft_chain_binding (const struct nft_chain *chain) +{ +return chain->flags &NFT_CHAIN_BINDING ; +} +static inline bool nft_chain_is_bound (struct nft_chain *chain) {return (chain->flags &NFT_CHAIN_BINDING ) && chain->bound; } +int nft_chain_add (struct nft_table *table,struct nft_chain *chain);void nft_chain_del (struct nft_chain *chain);void nf_tables_chain_destroy (struct nft_ctx *ctx);
@@ -1560,6 +1570,7 @@ struct nft_trans_rule {struct nft_rule *rule;struct nft_flow_rule *flow;u32 rule_id; +bool bound; };#define nft_trans_rule (trans) \
@@ -1568,6 +1579,8 @@ struct nft_trans_rule { (((struct nft_trans_rule *)trans->data)->flow)#define nft_trans_rule_id (trans) \ (((struct nft_trans_rule *)trans->data)->rule_id) +#define nft_trans_rule_bound (trans) \ + (((struct nft_trans_rule *)trans->data)->bound)struct nft_trans_set {struct nft_set *set;
@@ -1592,13 +1605,17 @@ struct nft_trans_set { (((struct nft_trans_set *)trans->data)->gc_int)struct nft_trans_chain { +struct nft_chain *chain;bool update;char *name;struct nft_stats __percpu *stats;u8 policy; +bool bound;u32 chain_id; }; +#define nft_trans_chain (trans) \ + (((struct nft_trans_chain *)trans->data)->chain)#define nft_trans_chain_update (trans) \ (((struct nft_trans_chain *)trans->data)->update)#define nft_trans_chain_name (trans) \
@@ -1607,6 +1624,8 @@ struct nft_trans_chain { (((struct nft_trans_chain *)trans->data)->stats)#define nft_trans_chain_policy (trans) \ (((struct nft_trans_chain *)trans->data)->policy) +#define nft_trans_chain_bound (trans) \ + (((struct nft_trans_chain *)trans->data)->bound)#define nft_trans_chain_id (trans) \ (((struct nft_trans_chain *)trans->data)->chain_id)
net/netfilter/nf_tables_api.c +55 -31
165 lines not on this page · raw message
net/netfilter/nft_immediate.c +78 -9
116 lines not on this page · raw message
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 111/170 netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 26b5a5712eb85e253724e56a54c17f8519bd8e4e ]
Add a new state to deal with rule expressions deactivation from the newrule error path, otherwise the anonymous set remains in the list in inactive state for the next generation. Mark the set/chain transaction as unbound so the abort path releases this object, set it as inactive in the next generation so it is not reachable anymore from this transaction and reference counter is dropped.
--- include/net/netfilter/nf_tables.h | 2 ++ net/netfilter/nf_tables_api.c | 45 ++++++++++++++++++++++++++----- net/netfilter/nft_immediate.c | 3 +++ 3 files changed, 43 insertions(+), 7 deletions(-)
include/net/netfilter/nf_tables.h +2 -0
@@ -895,6 +895,7 @@ struct nft_expr_type {enum nft_trans_phase {NFT_TRANS_PREPARE , +NFT_TRANS_PREPARE_ERROR ,NFT_TRANS_ABORT ,NFT_TRANS_COMMIT ,NFT_TRANS_RELEASE
@@ -1089,6 +1090,7 @@ int nft_setelem_validate(const struct nft_ctx *ctx, struct nft_set *set, struct nft_set_elem *elem);int nft_set_catchall_validate (const struct nft_ctx *ctx,struct nft_set *set);int nf_tables_bind_chain (const struct nft_ctx *ctx,struct nft_chain *chain); +void nf_tables_unbind_chain (const struct nft_ctx *ctx,struct nft_chain *chain);enum nft_chain_types {NFT_CHAIN_T_DEFAULT =0 ,
net/netfilter/nf_tables_api.c +38 -7
103 lines not on this page · raw message
net/netfilter/nft_immediate.c +3 -0
@@ -150,6 +150,9 @@ static void nft_immediate_deactivate(const struct nft_ctx *ctx,nft_rule_expr_deactivate (&chain_ctx, rule, phase);switch (phase) { +case NFT_TRANS_PREPARE_ERROR : +nf_tables_unbind_chain (ctx, chain); + fallthrough;case NFT_TRANS_PREPARE :nft_deactivate_next (ctx->net, chain);break ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 112/170 netfilter: nf_tables: drop map element references from preparation phase
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 628bd3e49cba1c066228e23d71a852c23e26da73 ]
set .destroy callback releases the references to other objects in maps. This is very late and it results in spurious EBUSY errors. Drop refcount from the preparation phase instead, update set backend not to drop reference counter from set .destroy path.
Exceptions: NFT_TRANS_PREPARE_ERROR does not require to drop the reference counter because the transaction abort path releases the map references for each element since the set is unbound. The abort path also deals with releasing reference counter for new elements added to unbound sets.
--- include/net/netfilter/nf_tables.h | 5 +- net/netfilter/nf_tables_api.c | 147 ++++++++++++++++++++++++++---- net/netfilter/nft_set_bitmap.c | 5 +- net/netfilter/nft_set_hash.c | 23 ++++- net/netfilter/nft_set_pipapo.c | 14 ++- net/netfilter/nft_set_rbtree.c | 5 +- 6 files changed, 167 insertions(+), 32 deletions(-)
include/net/netfilter/nf_tables.h +4 -1
@@ -467,7 +467,8 @@ struct nft_set_ops {int (*init)(const struct nft_set *set,const struct nft_set_desc *desc,const struct nlattr *const nla[]); -void (*destroy)(const struct nft_set *set); +void (*destroy)(const struct nft_ctx *ctx, +const struct nft_set *set);void (*gc_init)(const struct nft_set *set);unsigned int elemsize;
@@ -804,6 +805,8 @@ int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set, struct nft_expr *expr_array[]);void nft_set_elem_destroy (const struct nft_set *set,void *elem,bool destroy_expr); +void nf_tables_set_elem_destroy (const struct nft_ctx *ctx, +const struct nft_set *set,void *elem);/** * struct nft_set_gc_batch_head - nf_tables set garbage collection batch
net/netfilter/nf_tables_api.c +130 -17
234 lines not on this page · raw message
net/netfilter/nft_set_bitmap.c +3 -2
@@ -271,13 +271,14 @@ static int nft_bitmap_init(const struct nft_set *set,return 0 ; } -static void nft_bitmap_destroy (const struct nft_set *set) +static void nft_bitmap_destroy (const struct nft_ctx *ctx, +const struct nft_set *set) {struct nft_bitmap *priv =nft_set_priv (set);struct nft_bitmap_elem *be, *n;list_for_each_entry_safe (be, n, &priv->list, head) -nft_set_elem_destroy (set, be, true); +nf_tables_set_elem_destroy (ctx, set, be); } static bool nft_bitmap_estimate(const struct nft_set_desc *desc, u32 features,
net/netfilter/nft_set_hash.c +18 -5
@@ -400,19 +400,31 @@ static int nft_rhash_init(const struct nft_set *set,return 0 ; } +struct nft_rhash_ctx { +const struct nft_ctx ctx; +const struct nft_set *set; +}; +static void nft_rhash_elem_destroy (void *ptr,void *arg) { -nft_set_elem_destroy (arg, ptr, true); +struct nft_rhash_ctx *rhash_ctx = arg; + +nf_tables_set_elem_destroy (&rhash_ctx->ctx, rhash_ctx->set, ptr); } -static void nft_rhash_destroy (const struct nft_set *set) +static void nft_rhash_destroy (const struct nft_ctx *ctx, +const struct nft_set *set) {struct nft_rhash *priv =nft_set_priv (set); +struct nft_rhash_ctx rhash_ctx = { + .ctx = *ctx, + .set = set, + };cancel_delayed_work_sync (&priv->gc_work);rcu_barrier ();rhashtable_free_and_destroy (&priv->ht, nft_rhash_elem_destroy, - (void *)set); + (void *)&rhash_ctx); }/* Number of buckets is stored in u32, so cap our result to 1U<<31 */
@@ -643,7 +655,8 @@ static int nft_hash_init(const struct nft_set *set,return 0 ; } -static void nft_hash_destroy (const struct nft_set *set) +static void nft_hash_destroy (const struct nft_ctx *ctx, +const struct nft_set *set) {struct nft_hash *priv =nft_set_priv (set);struct nft_hash_elem *he;
@@ -653,7 +666,7 @@ static void nft_hash_destroy(const struct nft_set *set)for (i =0 ; i < priv->buckets; i++) {hlist_for_each_entry_safe (he, next, &priv->table[i], node) {hlist_del_rcu (&he->node); -nft_set_elem_destroy (set, he, true); +nf_tables_set_elem_destroy (ctx, set, he); } } }
net/netfilter/nft_set_pipapo.c +9 -5
@@ -2148,10 +2148,12 @@ static int nft_pipapo_init(const struct nft_set *set,/** * nft_set_pipapo_match_destroy() - Destroy elements from key mapping array +* @ctx: context * @set: nftables API set representation * @m: matching data pointing to key mapping array */ -static void nft_set_pipapo_match_destroy (const struct nft_set *set, +static void nft_set_pipapo_match_destroy (const struct nft_ctx *ctx, +const struct nft_set *set,struct nft_pipapo_match *m) {struct nft_pipapo_field *f;
@@ -2168,15 +2170,17 @@ static void nft_set_pipapo_match_destroy(const struct nft_set *set, e = f->mt[r].e; -nft_set_elem_destroy (set, e, true); +nf_tables_set_elem_destroy (ctx, set, e); } }/** * nft_pipapo_destroy() - Free private data for set and all committed elements +* @ctx: context * @set: nftables API set representation */ -static void nft_pipapo_destroy (const struct nft_set *set) +static void nft_pipapo_destroy (const struct nft_ctx *ctx, +const struct nft_set *set) {struct nft_pipapo *priv =nft_set_priv (set);struct nft_pipapo_match *m;
@@ -2186,7 +2190,7 @@ static void nft_pipapo_destroy(const struct nft_set *set)if (m) {rcu_barrier (); -nft_set_pipapo_match_destroy (set, m); +nft_set_pipapo_match_destroy (ctx, set, m);#ifdef NFT_PIPAPO_ALIGN free_percpu (m->scratch_aligned);
@@ -2203,7 +2207,7 @@ static void nft_pipapo_destroy(const struct nft_set *set) m = priv->clone;if (priv->dirty) -nft_set_pipapo_match_destroy (set, m); +nft_set_pipapo_match_destroy (ctx, set, m);#ifdef NFT_PIPAPO_ALIGN free_percpu (priv->clone->scratch_aligned);
net/netfilter/nft_set_rbtree.c +3 -2
@@ -664,7 +664,8 @@ static int nft_rbtree_init(const struct nft_set *set,return 0 ; } -static void nft_rbtree_destroy (const struct nft_set *set) +static void nft_rbtree_destroy (const struct nft_ctx *ctx, +const struct nft_set *set) {struct nft_rbtree *priv =nft_set_priv (set);struct nft_rbtree_elem *rbe;
@@ -675,7 +676,7 @@ static void nft_rbtree_destroy(const struct nft_set *set)while ((node = priv->root.rb_node) !=NULL ) {rb_erase (node, &priv->root); rbe = rb_entry(node, struct nft_rbtree_elem, node); -nft_set_elem_destroy (set, rbe, true); +nf_tables_set_elem_destroy (ctx, set, rbe); } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 113/170 netfilter: nft_set_pipapo: .walk does not deal with generations
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 2b84e215f87443c74ac0aa7f76bb172d43a87033 ]
The .walk callback iterates over the current active set, but it might be useful to iterate over the next generation set. Use the generation mask to determine what set view (either current or next generation) is use for the walk iteration.
--- net/netfilter/nft_set_pipapo.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/netfilter/nft_set_pipapo.c +5 -1
@@ -1974,12 +1974,16 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, struct nft_set_iter *iter) {struct nft_pipapo *priv =nft_set_priv (set); +struct net *net =read_pnet (&set->net);struct nft_pipapo_match *m;struct nft_pipapo_field *f;int i, r;rcu_read_lock (); - m =rcu_dereference (priv->match); +if (iter->genmask ==nft_genmask_cur (net)) + m =rcu_dereference (priv->match); +else + m = priv->clone;if (unlikely (!m)) goto out;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 114/170 netfilter: nf_tables: disallow element updates of bound anonymous sets
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit c88c535b592d3baeee74009f3eceeeaf0fdd5e1b ]
Anonymous sets come with NFT_SET_CONSTANT from userspace. Although API allows to create anonymous sets without NFT_SET_CONSTANT, it makes no sense to allow to add and to delete elements for bound anonymous sets.
--- net/netfilter/nf_tables_api.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
net/netfilter/nf_tables_api.c +5 -2
@@ -6590,7 +6590,8 @@ static int nf_tables_newsetelem(struct sk_buff *skb,if (IS_ERR (set))return PTR_ERR (set); -if (!list_empty (&set->bindings) && set->flags &NFT_SET_CONSTANT ) +if (!list_empty (&set->bindings) && + (set->flags & (NFT_SET_CONSTANT |NFT_SET_ANONYMOUS )))return -EBUSY ;nft_ctx_init (&ctx, net, skb, info->nlh, family, table,NULL , nla);
@@ -6864,7 +6865,9 @@ static int nf_tables_delsetelem(struct sk_buff *skb, set =nft_set_lookup (table, nla[NFTA_SET_ELEM_LIST_SET ], genmask);if (IS_ERR (set))return PTR_ERR (set); -if (!list_empty (&set->bindings) && set->flags &NFT_SET_CONSTANT ) + +if (!list_empty (&set->bindings) && + (set->flags & (NFT_SET_CONSTANT |NFT_SET_ANONYMOUS )))return -EBUSY ;nft_ctx_init (&ctx, net, skb, info->nlh, family, table,NULL , nla);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 115/170 netfilter: nf_tables: reject unbound anonymous set before commit phase
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 938154b93be8cd611ddfd7bafc1849f3c4355201 ]
Add a new list to track set transaction and to check for unbound anonymous sets before entering the commit phase.
Bail out at the end of the transaction handling if an anonymous set remains unbound.
--- include/net/netfilter/nf_tables.h | 3 +++ net/netfilter/nf_tables_api.c | 35 ++++++++++++++++++++++++++++--- 2 files changed, 35 insertions(+), 3 deletions(-)
include/net/netfilter/nf_tables.h +3 -0
@@ -1558,6 +1558,7 @@ static inline void nft_set_elem_clear_busy(struct nft_set_ext *ext)* struct nft_trans - nf_tables object update in transaction * * @list: used internally +* @binding_list: list of objects with possible bindings * @msg_type: message type * @put_net: ctx->net needs to be put * @ctx: transaction context
@@ -1565,6 +1566,7 @@ static inline void nft_set_elem_clear_busy(struct nft_set_ext *ext)*/ struct nft_trans {struct list_head list; +struct list_head binding_list;int msg_type;bool put_net;struct nft_ctx ctx;
@@ -1703,6 +1705,7 @@ static inline int nft_request_module(struct net *net, const char *fmt, ...) { restruct nftables_pernet {struct list_head tables;struct list_head commit_list; +struct list_head binding_list;struct list_head module_list;struct list_head notify_list;struct mutex commit_mutex;
net/netfilter/nf_tables_api.c +32 -3
@@ -153,6 +153,7 @@ static struct nft_trans *nft_trans_alloc_gfp(const struct nft_ctx *ctx,return NULL ;INIT_LIST_HEAD (&trans->list); +INIT_LIST_HEAD (&trans->binding_list); trans->msg_type = msg_type; trans->ctx = *ctx;
@@ -165,9 +166,15 @@ static struct nft_trans *nft_trans_alloc(const struct nft_ctx *ctx,return nft_trans_alloc_gfp (ctx, msg_type, size,GFP_KERNEL ); } -static void nft_trans_destroy (struct nft_trans *trans) +static void nft_trans_list_del (struct nft_trans *trans) {list_del (&trans->list); +list_del (&trans->binding_list); +} + +static void nft_trans_destroy (struct nft_trans *trans) +{ +nft_trans_list_del (trans);kfree (trans); }
@@ -359,6 +366,14 @@ static void nft_trans_commit_list_add_tail(struct net *net, struct nft_trans *tr {struct nftables_pernet *nft_net =nft_pernet (net); +switch (trans->msg_type) { +case NFT_MSG_NEWSET : +if (!nft_trans_set_update (trans) && +nft_set_is_anonymous (nft_trans_set (trans))) +list_add_tail (&trans->binding_list, &nft_net->binding_list); +break ; + } +list_add_tail (&trans->list, &nft_net->commit_list); }
@@ -8829,7 +8844,7 @@ static void nf_tables_trans_destroy_work(struct work_struct *w)synchronize_rcu ();list_for_each_entry_safe (trans, next, &head, list) { -list_del (&trans->list); +nft_trans_list_del (trans);nft_commit_release (trans); } }
@@ -9196,6 +9211,19 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)return 0 ; } +list_for_each_entry (trans, &nft_net->binding_list, binding_list) { +switch (trans->msg_type) { +case NFT_MSG_NEWSET : +if (!nft_trans_set_update (trans) && +nft_set_is_anonymous (nft_trans_set (trans)) && + !nft_trans_set_bound (trans)) { +pr_warn_once ("nftables ruleset with unbound set\n" ); +return -EINVAL ; + } +break ; + } + } +/* 0. Validate ruleset, otherwise roll back for error reporting. */ if (nf_tables_validate (net) <0 )return -EAGAIN ;
@@ -9672,7 +9700,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)list_for_each_entry_safe_reverse (trans, next, &nft_net->commit_list, list) { -list_del (&trans->list); +nft_trans_list_del (trans);nf_tables_abort_release (trans); }
@@ -10448,6 +10476,7 @@ static int __net_init nf_tables_init_net(struct net *net)INIT_LIST_HEAD (&nft_net->tables);INIT_LIST_HEAD (&nft_net->commit_list); +INIT_LIST_HEAD (&nft_net->binding_list);INIT_LIST_HEAD (&nft_net->module_list);INIT_LIST_HEAD (&nft_net->notify_list);mutex_init (&nft_net->commit_mutex);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 116/170 netfilter: nf_tables: reject unbound chain set before commit phase
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 62e1e94b246e685d89c3163aaef4b160e42ceb02 ]
Use binding list to track set transaction and to check for unbound chains before entering the commit phase.
Bail out if chain binding remain unused before entering the commit step.
--- net/netfilter/nf_tables_api.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
net/netfilter/nf_tables_api.c +13 -0
@@ -372,6 +372,11 @@ static void nft_trans_commit_list_add_tail(struct net *net, struct nft_trans *tr nft_set_is_anonymous(nft_trans_set(trans)))list_add_tail (&trans->binding_list, &nft_net->binding_list);break ; +case NFT_MSG_NEWCHAIN : +if (!nft_trans_chain_update (trans) && +nft_chain_binding (nft_trans_chain (trans))) +list_add_tail (&trans->binding_list, &nft_net->binding_list); +break ; }list_add_tail (&trans->list, &nft_net->commit_list);
@@ -9221,6 +9226,14 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)return -EINVAL ; }break ; +case NFT_MSG_NEWCHAIN : +if (!nft_trans_chain_update (trans) && +nft_chain_binding (nft_trans_chain (trans)) && + !nft_trans_chain_bound (trans)) { +pr_warn_once ("nftables ruleset with unbound chain\n" ); +return -EINVAL ; + } +break ; } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 117/170 netfilter: nf_tables: disallow updates of anonymous sets
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit b770283c98e0eee9133c47bc03b6cc625dc94723 ]
Disallow updates of set timeout and garbage collection parameters for anonymous sets.
--- net/netfilter/nf_tables_api.c | 3 +++ 1 file changed, 3 insertions(+)
net/netfilter/nf_tables_api.c +3 -0
@@ -4774,6 +4774,9 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info,if (info->nlh->nlmsg_flags &NLM_F_REPLACE )return -EOPNOTSUPP ; +if (nft_set_is_anonymous (set)) +return -EOPNOTSUPP ; + err =nft_set_expr_alloc (&ctx, set, nla, exprs, &num_exprs, flags);if (err <0 )return err;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 118/170 netfilter: nfnetlink_osf: fix module autoload
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 62f9a68a36d4441a6c412b81faed102594bc6670 ]
Move the alias from xt_osf to nfnetlink_osf.
--- net/netfilter/nfnetlink_osf.c | 1 + net/netfilter/xt_osf.c | 1 - 2 files changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nfnetlink_osf.c +1 -0
@@ -439,3 +439,4 @@ module_init(nfnl_osf_init);module_exit (nfnl_osf_fini);MODULE_LICENSE ("GPL" ); +MODULE_ALIAS_NFNL_SUBSYS (NFNL_SUBSYS_OSF );
net/netfilter/xt_osf.c +0 -1
@@ -71,4 +71,3 @@ MODULE_AUTHOR("Evgeniy Polyakov <[email protected]>");MODULE_DESCRIPTION ("Passive OS fingerprint matching." );MODULE_ALIAS ("ipt_osf" );MODULE_ALIAS ("ip6t_osf" ); -MODULE_ALIAS_NFNL_SUBSYS (NFNL_SUBSYS_OSF );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 119/170 Revert "net: phy: dp83867: perform soft reset and retain established link"
In reply to Greg Kroah-HartmanFrom: Francesco Dolcini <[email protected]>
[ Upstream commit a129b41fe0a8b4da828c46b10f5244ca07a3fec3 ]
This reverts commit da9ef50f545f86ffe6ff786174d26500c4db737a.
This fixes a regression in which the link would come up, but no communication was possible.
The reverted commit was also removing a comment about DP83867_PHYCR_FORCE_LINK_GOOD, this is not added back in this commits since it seems that this is unrelated to the original code change.
--- drivers/net/phy/dp83867.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/phy/dp83867.c +1 -1
@@ -905,7 +905,7 @@ static int dp83867_phy_reset(struct phy_device *phydev) {int err; - err =phy_write (phydev,DP83867_CTRL ,DP83867_SW_RESTART ); + err =phy_write (phydev,DP83867_CTRL ,DP83867_SW_RESET );if (err <0 )return err;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 120/170 bpf/btf: Accept function names that contain dots
In reply to Greg Kroah-HartmanFrom: Florent Revest <[email protected]>
[ Upstream commit 9724160b3942b0a967b91a59f81da5593f28b8ba ]
When building a kernel with LLVM=1, LLVM_IAS=0 and CONFIG_KASAN=y, LLVM leaves DWARF tags for the "asan.module_ctor" & co symbols. In turn, pahole creates BTF_KIND_FUNC entries for these and this makes the BTF metadata validation fail because they contain a dot.
In a dramatic turn of event, this BTF verification failure can cause the netfilter_bpf initialization to fail, causing netfilter_core to free the netfilter_helper hashmap and netfilter_ftp to trigger a use-after-free. The risk of u-a-f in netfilter will be addressed separately but the existence of "asan.module_ctor" debug info under some build conditions sounds like a good enough reason to accept functions that contain dots in BTF.
Although using only LLVM=1 is the recommended way to compile clang-based kernels, users can certainly do LLVM=1, LLVM_IAS=0 as well and we still try to support that combination according to Nick. To clarify:
- > v5.10 kernel, LLVM=1 (LLVM_IAS=0 is not the default) is recommended, but user can still have LLVM=1, LLVM_IAS=0 to trigger the issue
- <= 5.10 kernel, LLVM=1 (LLVM_IAS=0 is the default) is recommended in which case GNU as will be used
--- kernel/bpf/btf.c | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-)
kernel/bpf/btf.c +8 -12
@@ -735,13 +735,12 @@ static bool btf_name_offset_valid(const struct btf *btf, u32 offset)return offset < btf->hdr.str_len; } -static bool __btf_name_char_ok (char c,bool first,bool dot_ok) +static bool __btf_name_char_ok (char c,bool first) {if ((first ? !isalpha (c) : !isalnum (c)) && c !='_' && - ((c =='.' && !dot_ok) || - c !='.' )) + c !='.' )return false;return true; }
@@ -758,20 +757,20 @@ static const char *btf_str_by_offset(const struct btf *btf, u32 offset)return NULL ; } -static bool __btf_name_valid (const struct btf *btf,u32 offset,bool dot_ok) +static bool __btf_name_valid (const struct btf *btf,u32 offset) {/* offset must be valid */ const char *src =btf_str_by_offset (btf, offset);const char *src_limit; -if (!__btf_name_char_ok (*src, true, dot_ok)) +if (!__btf_name_char_ok (*src, true))return false;/* set a limit on identifier length */ src_limit = src +KSYM_NAME_LEN ; src++;while (*src && src < src_limit) { -if (!__btf_name_char_ok (*src, false, dot_ok)) +if (!__btf_name_char_ok (*src, false))return false; src++; }
@@ -779,17 +778,14 @@ static bool __btf_name_valid(const struct btf *btf, u32 offset, bool dot_ok)return !*src; } -/* Only C-style identifier is permitted. This can be relaxed if -* necessary. -*/ static bool btf_name_valid_identifier (const struct btf *btf,u32 offset) { -return __btf_name_valid (btf, offset, false); +return __btf_name_valid (btf, offset); }static bool btf_name_valid_section (const struct btf *btf,u32 offset) { -return __btf_name_valid (btf, offset, true); +return __btf_name_valid (btf, offset); }static const char *__btf_name_by_offset (const struct btf *btf,u32 offset)
@@ -4044,7 +4040,7 @@ static s32 btf_var_check_meta(struct btf_verifier_env *env, }if (!t->name_off || - !__btf_name_valid (env->btf, t->name_off, true)) { + !__btf_name_valid (env->btf, t->name_off)) {btf_verifier_log_type (env, t,"Invalid name" );return -EINVAL ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 121/170 bpf: Force kprobe multi expected_attach_type for kprobe_multi link
In reply to Greg Kroah-HartmanFrom: Jiri Olsa <[email protected]>
[ Upstream commit db8eae6bc5c702d8e3ab2d0c6bb5976c131576eb ]
We currently allow to create perf link for program with expected_attach_type == BPF_TRACE_KPROBE_MULTI.
This will cause crash when we call helpers like get_attach_cookie or get_func_ip in such program, because it will call the kprobe_multi's version (current->bpf_ctx context setup) of those helpers while it expects perf_link's current->bpf_ctx context setup.
Making sure that we use BPF_TRACE_KPROBE_MULTI expected_attach_type only for programs attaching through kprobe_multi link.
--- kernel/bpf/syscall.c | 5 +++++ 1 file changed, 5 insertions(+)
kernel/bpf/syscall.c +5 -0
@@ -3383,6 +3383,11 @@ static int bpf_prog_attach_check_attach_type(const struct bpf_prog *prog,return prog->enforce_expected_attach_type && prog->expected_attach_type != attach_type ? -EINVAL :0 ; +case BPF_PROG_TYPE_KPROBE : +if (prog->expected_attach_type ==BPF_TRACE_KPROBE_MULTI && + attach_type !=BPF_TRACE_KPROBE_MULTI ) +return -EINVAL ; +return 0 ;default :return 0 ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 122/170 io_uring/net: use the correct msghdr union member in io_sendmsg_copy_hdr
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
[ Upstream commit 26fed83653d0154704cadb7afc418f315c7ac1f0 ]
Rather than assign the user pointer to msghdr->msg_control, assign it to msghdr->msg_control_user to make sparse happy. They are in a union so the end result is the same, but let's avoid new sparse warnings and squash this one.
--- io_uring/net.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
io_uring/net.c +2 -2
@@ -190,7 +190,7 @@ static int io_sendmsg_copy_hdr(struct io_kiocb *req, ret =sendmsg_copy_msghdr (&iomsg->msg, sr->umsg, sr->msg_flags, &iomsg->free_iov);/* save msg_control as sys_sendmsg() overwrites it */ - sr->msg_control = iomsg->msg.msg_control; + sr->msg_control = iomsg->msg.msg_control_user;return ret; }
@@ -289,7 +289,7 @@ int io_sendmsg(struct io_kiocb *req, unsigned int issue_flags)if (req_has_async_data (req)) { kmsg = req->async_data; - kmsg->msg.msg_control = sr->msg_control; + kmsg->msg.msg_control_user = sr->msg_control; }else { ret =io_sendmsg_copy_hdr (req, &iomsg);if (ret)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 123/170 selftests: forwarding: Fix race condition in mirror installation
In reply to Greg Kroah-HartmanFrom: Danielle Ratson <[email protected]>
[ Upstream commit c7c059fba6fb19c3bc924925c984772e733cb594 ]
When mirroring to a gretap in hardware the device expects to be programmed with the egress port and all the encapsulating headers. This requires the driver to resolve the path the packet will take in the software data path and program the device accordingly.
If the path cannot be resolved (in this case because of an unresolved neighbor), then mirror installation fails until the path is resolved. This results in a race that causes the test to sometimes fail.
Fix this by setting the neighbor's state to permanent in a couple of tests, so that it is always valid.
--- .../testing/selftests/net/forwarding/mirror_gre_bridge_1d.sh | 4 ++++ .../testing/selftests/net/forwarding/mirror_gre_bridge_1q.sh | 4 ++++ 2 files changed, 8 insertions(+)
tools/testing/selftests/net/forwarding/mirror_gre_bridge_1d.sh +4 -0
@@ -93,12 +93,16 @@ cleanup() test_gretap() { + ip neigh replace 192.0.2.130 lladdr $(mac_get $h3) \ + nud permanent dev br2 full_test_span_gre_dir gt4 ingress 8 0 "mirror to gretap" full_test_span_gre_dir gt4 egress 0 8 "mirror to gretap" } test_ip6gretap() { + ip neigh replace 2001:db8:2::2 lladdr $(mac_get $h3) \ + nud permanent dev br2 full_test_span_gre_dir gt6 ingress 8 0 "mirror to ip6gretap" full_test_span_gre_dir gt6 egress 0 8 "mirror to ip6gretap" }
tools/testing/selftests/net/forwarding/mirror_gre_bridge_1q.sh +4 -0
@@ -90,12 +90,16 @@ cleanup() test_gretap() { + ip neigh replace 192.0.2.130 lladdr $(mac_get $h3) \ + nud permanent dev br1 full_test_span_gre_dir gt4 ingress 8 0 "mirror to gretap" full_test_span_gre_dir gt4 egress 0 8 "mirror to gretap" } test_ip6gretap() { + ip neigh replace 2001:db8:2::2 lladdr $(mac_get $h3) \ + nud permanent dev br1 full_test_span_gre_dir gt6 ingress 8 0 "mirror to ip6gretap" full_test_span_gre_dir gt6 egress 0 8 "mirror to ip6gretap" }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 124/170 platform/x86/amd/pmf: Register notify handler only if SPS is enabled
In reply to Greg Kroah-HartmanFrom: Shyam Sundar S K <[email protected]>
[ Upstream commit 146b6f6855e7656e8329910606595220c761daac ]
Power source notify handler is getting registered even when none of the PMF feature in enabled leading to a crash.
...
[ 22.592162] Call Trace: [ 22.592164] <TASK> [ 22.592164] ? rcu_note_context_switch+0x5e0/0x660 [ 22.592166] ? __warn+0x81/0x130 [ 22.592171] ? rcu_note_context_switch+0x5e0/0x660 [ 22.592172] ? report_bug+0x171/0x1a0 [ 22.592175] ? prb_read_valid+0x1b/0x30 [ 22.592177] ? handle_bug+0x3c/0x80 [ 22.592178] ? exc_invalid_op+0x17/0x70 [ 22.592179] ? asm_exc_invalid_op+0x1a/0x20 [ 22.592182] ? rcu_note_context_switch+0x5e0/0x660 [ 22.592183] ? acpi_ut_delete_object_desc+0x86/0xb0 [ 22.592186] ? acpi_ut_update_ref_count.part.0+0x22d/0x930 [ 22.592187] __schedule+0xc0/0x1410 [ 22.592189] ? ktime_get+0x3c/0xa0 [ 22.592191] ? lapic_next_event+0x1d/0x30 [ 22.592193] ? hrtimer_start_range_ns+0x25b/0x350 [ 22.592196] schedule+0x5e/0xd0 [ 22.592197] schedule_hrtimeout_range_clock+0xbe/0x140 [ 22.592199] ? __pfx_hrtimer_wakeup+0x10/0x10 [ 22.592200] usleep_range_state+0x64/0x90 [ 22.592203] amd_pmf_send_cmd+0x106/0x2a0 [amd_pmf bddfe0fe3712aaa99acce3d5487405c5213c6616] [ 22.592207] amd_pmf_update_slider+0x56/0x1b0 [amd_pmf bddfe0fe3712aaa99acce3d5487405c5213c6616] [ 22.592210] amd_pmf_set_sps_power_limits+0x72/0x80 [amd_pmf bddfe0fe3712aaa99acce3d5487405c5213c6616] [ 22.592213] amd_pmf_pwr_src_notify_call+0x49/0x90 [amd_pmf bddfe0fe3712aaa99acce3d5487405c5213c6616] [ 22.592216] notifier_call_chain+0x5a/0xd0 [ 22.592218] atomic_notifier_call_chain+0x32/0x50
...
Fix this by moving the registration of source change notify handler only when SPS(Static Slider) is advertised as supported.
--- drivers/platform/x86/amd/pmf/core.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/platform/x86/amd/pmf/core.c +5 -5
@@ -297,6 +297,8 @@ static void amd_pmf_init_features(struct amd_pmf_dev *dev)/* Enable Static Slider */ if (is_apmf_func_supported (dev,APMF_FUNC_STATIC_SLIDER_GRANULAR )) {amd_pmf_init_sps (dev); + dev->pwr_src_notifier.notifier_call = amd_pmf_pwr_src_notify_call; +power_supply_reg_notifier (&dev->pwr_src_notifier);dev_dbg (dev->dev,"SPS enabled and Platform Profiles registered\n" ); }
@@ -315,8 +317,10 @@ static void amd_pmf_init_features(struct amd_pmf_dev *dev)static void amd_pmf_deinit_features (struct amd_pmf_dev *dev) { -if (is_apmf_func_supported (dev,APMF_FUNC_STATIC_SLIDER_GRANULAR )) +if (is_apmf_func_supported (dev,APMF_FUNC_STATIC_SLIDER_GRANULAR )) { +power_supply_unreg_notifier (&dev->pwr_src_notifier);amd_pmf_deinit_sps (dev); + }if (is_apmf_func_supported (dev,APMF_FUNC_AUTO_MODE )) {amd_pmf_deinit_auto_mode (dev);
@@ -399,9 +403,6 @@ static int amd_pmf_probe(struct platform_device *pdev)apmf_install_handler (dev);amd_pmf_dbgfs_register (dev); - dev->pwr_src_notifier.notifier_call = amd_pmf_pwr_src_notify_call; -power_supply_reg_notifier (&dev->pwr_src_notifier); -dev_info (dev->dev,"registered PMF device successfully\n" );return 0 ;
@@ -411,7 +412,6 @@ static int amd_pmf_remove(struct platform_device *pdev) {struct amd_pmf_dev *dev =platform_get_drvdata (pdev); -power_supply_unreg_notifier (&dev->pwr_src_notifier);amd_pmf_deinit_features (dev);apmf_acpi_deinit (dev);amd_pmf_dbgfs_unregister (dev);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 125/170 sch_netem: acquire qdisc lock in netem_change()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 2174a08db80d1efeea382e25ac41c4e7511eb6d6 ]
syzbot managed to trigger a divide error [1] in netem.
It could happen if q->rate changes while netem_enqueue() is running, since q->rate is read twice.
It turns out netem_change() always lacked proper synchronization.
[1]
divide error: 0000 [#1] SMP KASAN
CPU: 1 PID: 7867 Comm: syz-executor.1 Not tainted 6.1.30-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 RIP: 0010:div64_u64 include/linux/math64.h:69 [inline] RIP: 0010:packet_time_ns net/sched/sch_netem.c:357 [inline] RIP: 0010:netem_enqueue+0x2067/0x36d0 net/sched/sch_netem.c:576 Code: 89 e2 48 69 da 00 ca 9a 3b 42 80 3c 28 00 4c 8b a4 24 88 00 00 00 74 0d 4c 89 e7 e8 c3 4f 3b fd 48 8b 4c 24 18 48 89 d8 31 d2 <49> f7 34 24 49 01 c7 4c 8b 64 24 48 4d 01 f7 4c 89 e3 48 c1 eb 03 RSP: 0018:ffffc9000dccea60 EFLAGS: 00010246 RAX: 000001a442624200 RBX: 000001a442624200 RCX: ffff888108a4f000 RDX: 0000000000000000 RSI: 000000000000070d RDI: 000000000000070d RBP: ffffc9000dcceb90 R08: ffffffff849c5e26 R09: fffffbfff10e1297 R10: 0000000000000000 R11: dffffc0000000001 R12: ffff888108a4f358 R13: dffffc0000000000 R14: 0000001a8cd9a7ec R15: 0000000000000000 FS: 00007fa73fe18700(0000) GS:ffff8881f6b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa73fdf7718 CR3: 000000011d36e000 CR4: 0000000000350ee0 Call Trace: <TASK> [<ffffffff84714385>] __dev_xmit_skb net/core/dev.c:3931 [inline] [<ffffffff84714385>] __dev_queue_xmit+0xcf5/0x3370 net/core/dev.c:4290 [<ffffffff84d22df2>] dev_queue_xmit include/linux/netdevice.h:3030 [inline] [<ffffffff84d22df2>] neigh_hh_output include/net/neighbour.h:531 [inline] [<ffffffff84d22df2>] neigh_output include/net/neighbour.h:545 [inline] [<ffffffff84d22df2>] ip_finish_output2+0xb92/0x10d0 net/ipv4/ip_output.c:235 [<ffffffff84d21e63>] __ip_finish_output+0xc3/0x2b0 [<ffffffff84d10a81>] ip_finish_output+0x31/0x2a0 net/ipv4/ip_output.c:323 [<ffffffff84d10f14>] NF_HOOK_COND include/linux/netfilter.h:298 [inline] [<ffffffff84d10f14>] ip_output+0x224/0x2a0 net/ipv4/ip_output.c:437 [<ffffffff84d123b5>] dst_output include/net/dst.h:444 [inline] [<ffffffff84d123b5>] ip_local_out net/ipv4/ip_output.c:127 [inline] [<ffffffff84d123b5>] __ip_queue_xmit+0x1425/0x2000 net/ipv4/ip_output.c:542 [<ffffffff84d12fdc>] ip_queue_xmit+0x4c/0x70 net/ipv4/ip_output.c:556
--- net/sched/sch_netem.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/sched/sch_netem.c +6 -2
@@ -966,6 +966,7 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt,if (ret <0 )return ret; +sch_tree_lock (sch);/* backup q->clg and q->loss_model */ old_clg = q->clg; old_loss_model = q->loss_model;
@@ -974,7 +975,7 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt, ret =get_loss_clg (q, tb[TCA_NETEM_LOSS ]);if (ret) { q->loss_model = old_loss_model; -return ret; + goto unlock; } }else { q->loss_model =CLG_RANDOM ;
@@ -1041,6 +1042,8 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt,/* capping jitter to the range acceptable by tabledist() */ q->jitter =min_t (s64,abs (q->jitter),INT_MAX ); +unlock: +sch_tree_unlock (sch);return ret; get_table_failure:
@@ -1050,7 +1053,8 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt,*/ q->clg = old_clg; q->loss_model = old_loss_model; -return ret; + + goto unlock; } static int netem_init(struct Qdisc *sch, struct nlattr *opt,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 126/170 revert "net: align SO_RCVMARK required privileges with SO_MARK"
In reply to Greg Kroah-HartmanFrom: Maciej Żenczykowski <[email protected]>
[ Upstream commit a9628e88776eb7d045cf46467f1afdd0f7fe72ea ]
This reverts commit 1f86123b9749 ("net: align SO_RCVMARK required privileges with SO_MARK") because the reasoning in the commit message is not really correct:
SO_RCVMARK is used for 'reading' incoming skb mark (via cmsg), as such it is more equivalent to 'getsockopt(SO_MARK)' which has no priv check and retrieves the socket mark, rather than 'setsockopt(SO_MARK) which sets the socket mark and does require privs.
Additionally incoming skb->mark may already be visible if sysctl_fwmark_reflect and/or sysctl_tcp_fwmark_accept are enabled.
Furthermore, it is easier to block the getsockopt via bpf (either cgroup setsockopt hook, or via syscall filters) then to unblock it if it requires CAP_NET_RAW/ADMIN.
On Android the socket mark is (among other things) used to store the network identifier a socket is bound to. Setting it is privileged, but retrieving it is not. We'd like unprivileged userspace to be able to read the network id of incoming packets (where mark is set via iptables [to be moved to bpf])...
An alternative would be to add another sysctl to control whether setting SO_RCVMARK is privilged or not.
(or even a MASK of which bits in the mark can be exposed) But this seems like over-engineering...
Note: This is a non-trivial revert, due to later merged commit e42c7beee71d ("bpf: net: Consider has_current_bpf_ctx() when testing capable() in sk_setsockopt()") which changed both 'ns_capable' into 'sockopt_ns_capable' calls.
--- net/core/sock.c | 6 ------ 1 file changed, 6 deletions(-)
net/core/sock.c +0 -6
@@ -1355,12 +1355,6 @@ int sk_setsockopt(struct sock *sk, int level, int optname,__sock_set_mark (sk, val);break ;case SO_RCVMARK : -if (!sockopt_ns_capable (sock_net (sk)->user_ns,CAP_NET_RAW ) && - !sockopt_ns_capable (sock_net (sk)->user_ns,CAP_NET_ADMIN )) { - ret = -EPERM ; -break ; - } -sock_valbool_flag (sk,SOCK_RCVMARK , valbool);break ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 127/170 arm64: dts: rockchip: Enable GPU on SOQuartz CM4
In reply to Greg Kroah-HartmanFrom: Nicolas Frattaroli <[email protected]>
[ Upstream commit e48824e8a03e5bc3666e9f5461f68d440d9acba0 ]
This enables the Mali-G52 GPU on the SOQuartz CM4 module.
Stable-dep-of: cf9ae4a00774 ("arm64: dts: rockchip: fix nEXTRST on SOQuartz")
--- arch/arm64/boot/dts/rockchip/rk3566-soquartz.dtsi | 5 +++++ 1 file changed, 5 insertions(+)
arch/arm64/boot/dts/rockchip/rk3566-soquartz.dtsi +5 -0
@@ -143,6 +143,11 @@ status = "disabled"; }; +&gpu { + mali-supply = <&vdd_gpu>; + status = "okay"; +}; + &i2c0 { status = "okay";
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 128/170 arm64: dts: rockchip: fix nEXTRST on SOQuartz
In reply to Greg Kroah-HartmanFrom: Nicolas Frattaroli <[email protected]>
[ Upstream commit cf9ae4a0077496e8224d68fc88e3df13dd7e5f37 ]
In pre-production prototypes (of which I only know one person having one, Peter Geis), GPIO0 pin A5 was tied to the SDMMC power enable pin on the CM4 connector. On all production models, this is not the case; instead, this pin is used for the nEXTRST signal, and the SDMMC power enable pin is always pulled high.
Since everyone currently using the SOQuartz device trees will want this change, it is made to the tree without splitting the trees into two separate ones of which users will then inevitably choose the wrong one.
This fixes USB and PCIe on a wide variety of CM4IO-compatible boards which use the nEXTRST signal.
--- .../boot/dts/rockchip/rk3566-soquartz-cm4.dts | 18 +++++++----- .../boot/dts/rockchip/rk3566-soquartz.dtsi | 29 +++++++++---------- 2 files changed, 24 insertions(+), 23 deletions(-)
arch/arm64/boot/dts/rockchip/rk3566-soquartz-cm4.dts +11 -7
@@ -28,6 +28,16 @@ regulator-max-microvolt = <5000000>; vin-supply = <&vcc12v_dcin>; }; + + vcc_sd_pwr: vcc-sd-pwr-regulator { + compatible = "regulator-fixed"; + regulator-name = "vcc_sd_pwr"; + regulator-always-on; + regulator-boot-on; + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; + vin-supply = <&vcc3v3_sys>; + }; }; &gmac1 {
@@ -119,13 +129,7 @@ }; &sdmmc0 { - vmmc-supply = <&sdmmc_pwr>; - status = "okay"; -}; - -&sdmmc_pwr { - regulator-min-microvolt = <3300000>; - regulator-max-microvolt = <3300000>; + vmmc-supply = <&vcc_sd_pwr>; status = "okay"; };
arch/arm64/boot/dts/rockchip/rk3566-soquartz.dtsi +13 -16
@@ -92,16 +92,6 @@ regulator-max-microvolt = <3300000>; vin-supply = <&vcc5v0_sys>; }; - - sdmmc_pwr: sdmmc-pwr-regulator { - compatible = "regulator-fixed"; - enable-active-high; - gpio = <&gpio0 RK_PA5 GPIO_ACTIVE_HIGH>; - pinctrl-names = "default"; - pinctrl-0 = <&sdmmc_pwr_h>; - regulator-name = "sdmmc_pwr"; - status = "disabled"; - }; }; &cpu0 {
@@ -143,6 +133,19 @@ status = "disabled"; }; +&gpio0 { + nextrst-hog { + gpio-hog; + /* + * GPIO_ACTIVE_LOW + output-low here means that the pin is set + * to high, because output-low decides the value pre-inversion. + */ + gpios = <RK_PA5 GPIO_ACTIVE_LOW>; + line-name = "nEXTRST"; + output-low; + }; +}; + &gpu { mali-supply = <&vdd_gpu>; status = "okay";
@@ -485,12 +488,6 @@ rockchip,pins = <2 RK_PC2 RK_FUNC_GPIO &pcfg_pull_none>; }; }; - - sdmmc-pwr { - sdmmc_pwr_h: sdmmc-pwr-h { - rockchip,pins = <0 RK_PA5 RK_FUNC_GPIO &pcfg_pull_none>; - }; - }; }; &pmu_io_domains {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 129/170 gpiolib: Fix GPIO chip IRQ initialization restriction
In reply to Greg Kroah-HartmanFrom: Jiawen Wu <[email protected]>
[ Upstream commit 8c00914e5438e3636f26b4f814b3297ae2a1b9ee ]
In case of gpio-regmap, IRQ chip is added by regmap-irq and associated with GPIO chip by gpiochip_irqchip_add_domain(). The initialization flag was not added in gpiochip_irqchip_add_domain(), causing gpiochip_to_irq() to return -EPROBE_DEFER.
--- drivers/gpio/gpiolib.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpio/gpiolib.c +8 -0
@@ -1697,6 +1697,14 @@ int gpiochip_irqchip_add_domain(struct gpio_chip *gc, gc->to_irq = gpiochip_to_irq; gc->irq.domain = domain; +/* +* Using barrier() here to prevent compiler from reordering +* gc->irq.initialized before adding irqdomain. +*/ +barrier (); + + gc->irq.initialized = true; +return 0 ; }EXPORT_SYMBOL_GPL (gpiochip_irqchip_add_domain);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 130/170 gpio: sifive: add missing check for platform_get_irq
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit c1bcb976d8feb107ff2c12caaf12ac5e70f44d5f ]
Add the missing check for platform_get_irq() and return error code if it fails.
The returned error code will be dealed with in builtin_platform_driver(sifive_gpio_driver) and the driver will not be registered.
--- drivers/gpio/gpio-sifive.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/gpio/gpio-sifive.c +6 -2
@@ -221,8 +221,12 @@ static int sifive_gpio_probe(struct platform_device *pdev)return -ENODEV ; } -for (i =0 ; i < ngpio; i++) - chip->irq_number[i] =platform_get_irq (pdev, i); +for (i =0 ; i < ngpio; i++) { + ret =platform_get_irq (pdev, i); +if (ret <0 ) +return ret; + chip->irq_number[i] = ret; + } ret = bgpio_init(&chip->gc, dev, 4, chip->base + SIFIVE_GPIO_INPUT_VAL,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 131/170 gpiolib: Fix irq_domain resource tracking for gpiochip_irqchip_add_domain()
In reply to Greg Kroah-HartmanFrom: Michael Walle <[email protected]>
[ Upstream commit ff7a1790fbf92f1bdd0966d3f0da3ea808ede876 ]
Up until commit 6a45b0e2589f ("gpiolib: Introduce gpiochip_irqchip_add_domain()") all irq_domains were allocated by gpiolib itself and thus gpiolib also takes care of freeing it.
With gpiochip_irqchip_add_domain() a user of gpiolib can associate an irq_domain with the gpio_chip. This irq_domain is not managed by gpiolib and therefore must not be freed by gpiolib.
--- drivers/gpio/gpiolib.c | 3 ++- include/linux/gpio/driver.h | 8 ++++++++ 2 files changed, 10 insertions(+), 1 deletion(-)
drivers/gpio/gpiolib.c +2 -1
@@ -1650,7 +1650,7 @@ static void gpiochip_irqchip_remove(struct gpio_chip *gc) }/* Remove all IRQ mappings and delete the domain */ -if (gc->irq.domain) { +if (!gc->irq.domain_is_allocated_externally && gc->irq.domain) {unsigned int irq;for (offset =0 ; offset < gc->ngpio; offset++) {
@@ -1696,6 +1696,7 @@ int gpiochip_irqchip_add_domain(struct gpio_chip *gc, gc->to_irq = gpiochip_to_irq; gc->irq.domain = domain; + gc->irq.domain_is_allocated_externally = true;/* * Using barrier() here to prevent compiler from reordering
include/linux/gpio/driver.h +8 -0
@@ -244,6 +244,14 @@ struct gpio_irq_chip {*/ bool initialized; +/** +* @domain_is_allocated_externally: +* +* True it the irq_domain was allocated outside of gpiolib, in which +* case gpiolib won't free the irq_domain itself. +*/ +bool domain_is_allocated_externally; +/** * @init_hw: optional routine to initialize hardware before * an IRQ chip will be added. This is quite useful when
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 132/170 scsi: target: iscsi: Prevent login threads from racing between each other
In reply to Greg Kroah-HartmanFrom: Maurizio Lombardi <[email protected]>
[ Upstream commit 2a737d3b8c792400118d6cf94958f559de9c5e59 ]
The tpg->np_login_sem is a semaphore that is used to serialize the login process when multiple login threads run concurrently against the same target portal group.
The iscsi_target_locate_portal() function finds the tpg, calls iscsit_access_np() against the np_login_sem semaphore and saves the tpg pointer in conn->tpg;
If iscsi_target_locate_portal() fails, the caller will check for the conn->tpg pointer and, if it's not NULL, then it will assume that iscsi_target_locate_portal() called iscsit_access_np() on the semaphore.
Make sure that conn->tpg gets initialized only if iscsit_access_np() was successful, otherwise iscsit_deaccess_np() may end up being called against a semaphore we never took, allowing more than one thread to access the same tpg.
--- drivers/target/iscsi/iscsi_target_nego.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/target/iscsi/iscsi_target_nego.c +3 -1
@@ -1128,6 +1128,7 @@ int iscsi_target_locate_portal(iscsi_target_set_sock_callbacks (conn); login->np = np; + conn->tpg =NULL ; login_req = (struct iscsi_login_req *) login->req; payload_length =ntoh24 (login_req->dlength);
@@ -1195,7 +1196,6 @@ int iscsi_target_locate_portal(*/ sessiontype =strncmp (s_buf,DISCOVERY ,9 );if (!sessiontype) { - conn->tpg = iscsit_global->discovery_tpg;if (!login->leading_connection) goto get_target;
@@ -1212,9 +1212,11 @@ int iscsi_target_locate_portal(* Serialize access across the discovery struct iscsi_portal_group to * process login attempt. */ + conn->tpg = iscsit_global->discovery_tpg;if (iscsit_access_np (np, conn->tpg) <0 ) {iscsit_tx_login_rsp (conn,ISCSI_STATUS_CLS_TARGET_ERR ,ISCSI_LOGIN_STATUS_SVC_UNAVAILABLE ); + conn->tpg =NULL ; ret =-1 ; goto out; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 133/170 HID: wacom: Add error check to wacom_parse_and_register()
In reply to Greg Kroah-HartmanFrom: Denis Arefev <[email protected]>
[ Upstream commit 16a9c24f24fbe4564284eb575b18cc20586b9270 ]
Added a variable check and
transition in case of an error
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/hid/wacom_sys.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/hid/wacom_sys.c +6 -1
@@ -2417,8 +2417,13 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless) goto fail_quirks; } -if (features->device_type &WACOM_DEVICETYPE_WL_MONITOR ) +if (features->device_type &WACOM_DEVICETYPE_WL_MONITOR ) { error =hid_hw_open (hdev); +if (error) { +hid_err (hdev,"hw open failed\n" ); + goto fail_quirks; + } + }wacom_set_shared_values (wacom_wac);devres_close_group (&hdev->dev, wacom);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 134/170 arm64: Add missing Set/Way CMO encodings
In reply to Greg Kroah-HartmanFrom: Marc Zyngier <[email protected]>
[ Upstream commit 8d0f019e4c4f2ee2de81efd9bf1c27e9fb3c0460 ]
Add the missing Set/Way CMOs that apply to tagged memory.
--- arch/arm64/include/asm/sysreg.h | 6 ++++++ 1 file changed, 6 insertions(+)
arch/arm64/include/asm/sysreg.h +6 -0
@@ -111,8 +111,14 @@#define SB_BARRIER_INSN __SYS_BARRIER_INSN(0, 7, 31)#define SYS_DC_ISW sys_insn(1, 0, 7, 6, 2) +#define SYS_DC_IGSW sys_insn(1, 0, 7, 6, 4) +#define SYS_DC_IGDSW sys_insn(1, 0, 7, 6, 6)#define SYS_DC_CSW sys_insn(1, 0, 7, 10, 2) +#define SYS_DC_CGSW sys_insn(1, 0, 7, 10, 4) +#define SYS_DC_CGDSW sys_insn(1, 0, 7, 10, 6)#define SYS_DC_CISW sys_insn(1, 0, 7, 14, 2) +#define SYS_DC_CIGSW sys_insn(1, 0, 7, 14, 4) +#define SYS_DC_CIGDSW sys_insn(1, 0, 7, 14, 6)/* * Automatically generated definitions for system registers, the
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 135/170 smb3: missing null check in SMB2_change_notify
In reply to Greg Kroah-HartmanFrom: Steve French <[email protected]>
[ Upstream commit b535cc796a4b4942cd189652588e8d37c1f5925a ]
If plen is null when passed in, we only checked for null in one of the two places where it could be used. Although plen is always valid (not null) for current callers of the SMB2_change_notify function, this change makes it more consistent.
--- fs/cifs/smb2pdu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/cifs/smb2pdu.c +1 -1
@@ -3779,7 +3779,7 @@ SMB2_change_notify(const unsigned int xid, struct cifs_tcon *tcon,if (*out_data ==NULL ) { rc = -ENOMEM ; goto cnotify_exit; - }else + }else if (plen) *plen =le32_to_cpu (smb_rsp->OutputBufferLength); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 136/170 media: cec: core: disable adapter in cec_devnode_unregister
In reply to Greg Kroah-HartmanFrom: Hans Verkuil <[email protected]>
[ Upstream commit fe4526d99e2e06b08bb80316c3a596ea6a807b75 ]
Explicitly disable the CEC adapter in cec_devnode_unregister()
Usually this does not really do anything important, but for drivers that use the CEC pin framework this is needed to properly stop the hrtimer. Without this a crash would happen when such a driver is unloaded with rmmod.
--- drivers/media/cec/core/cec-adap.c | 5 ++++- drivers/media/cec/core/cec-core.c | 2 ++ drivers/media/cec/core/cec-priv.h | 1 + 3 files changed, 7 insertions(+), 1 deletion(-)
drivers/media/cec/core/cec-adap.c +4 -1
@@ -1582,7 +1582,7 @@ static void cec_claim_log_addrs(struct cec_adapter *adap, bool block)* * This function is called with adap->lock held. */ -static int cec_adap_enable (struct cec_adapter *adap) +int cec_adap_enable (struct cec_adapter *adap) {bool enable;int ret =0 ;
@@ -1592,6 +1592,9 @@ static int cec_adap_enable(struct cec_adapter *adap)if (adap->needs_hpd) enable = enable && adap->phys_addr !=CEC_PHYS_ADDR_INVALID ; +if (adap->devnode.unregistered) + enable = false; +if (enable == adap->is_enabled)return 0 ;
drivers/media/cec/core/cec-core.c +2 -0
@@ -191,6 +191,8 @@ static void cec_devnode_unregister(struct cec_adapter *adap)mutex_lock (&adap->lock);__cec_s_phys_addr (adap,CEC_PHYS_ADDR_INVALID , false);__cec_s_log_addrs (adap,NULL , false); +// Disable the adapter (since adap->devnode.unregistered is true) +cec_adap_enable (adap);mutex_unlock (&adap->lock);cdev_device_del (&devnode->cdev, &devnode->dev);
drivers/media/cec/core/cec-priv.h +1 -0
@@ -47,6 +47,7 @@ int cec_monitor_pin_cnt_inc(struct cec_adapter *adap);void cec_monitor_pin_cnt_dec (struct cec_adapter *adap);int cec_adap_status (struct seq_file *file,void *priv);int cec_thread_func (void *_adap); +int cec_adap_enable (struct cec_adapter *adap);void __cec_s_phys_addr (struct cec_adapter *adap,u16 phys_addr,bool block);int __cec_s_log_addrs (struct cec_adapter *adap,struct cec_log_addrs *log_addrs,bool block);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 137/170 media: cec: core: dont set last_initiator if tx in progress
In reply to Greg Kroah-HartmanFrom: Hans Verkuil <[email protected]>
[ Upstream commit 73af6c7511038249cad3d5f3b44bf8d78ac0f499 ]
When a message was received the last_initiator is set to 0xff. This will force the signal free time for the next transmit to that for a new initiator. However, if a new transmit is already in progress, then don't set last_initiator, since that's the initiator of the current transmit. Overwriting this would cause the signal free time of a following transmit to be that of the new initiator instead of a next transmit.
--- drivers/media/cec/core/cec-adap.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/media/cec/core/cec-adap.c +2 -1
@@ -1090,7 +1090,8 @@ void cec_received_msg_ts(struct cec_adapter *adap,mutex_lock (&adap->lock);dprintk (2 ,"%s: %*ph\n" , __func__, msg->len, msg->msg); - adap->last_initiator =0xff ; +if (!adap->transmit_in_progress) + adap->last_initiator =0xff ;/* Check if this message was for us (directed or broadcast). */ if (!cec_msg_is_broadcast (msg))
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 138/170 nfcsim.c: Fix error checking for debugfs_create_dir
In reply to Greg Kroah-HartmanFrom: Osama Muhammad <[email protected]>
[ Upstream commit 9b9e46aa07273ceb96866b2e812b46f1ee0b8d2f ]
This patch fixes the error checking in nfcsim.c. The DebugFS kernel API is developed in
a way that the caller can safely ignore the errors that occur during the creation of DebugFS nodes.
--- drivers/nfc/nfcsim.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/nfc/nfcsim.c +0 -4
@@ -336,10 +336,6 @@ static struct dentry *nfcsim_debugfs_root;static void nfcsim_debugfs_init (void ) { nfcsim_debugfs_root =debugfs_create_dir ("nfcsim" ,NULL ); - -if (!nfcsim_debugfs_root) -pr_err ("Could not create debugfs entry\n" ); - }static void nfcsim_debugfs_remove (void )
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 139/170 btrfs: fix an uninitialized variable warning in btrfs_log_inode
In reply to Greg Kroah-HartmanFrom: Shida Zhang <[email protected]>
[ Upstream commit 8fd9f4232d8152c650fd15127f533a0f6d0a4b2b ]
This fixes the following warning reported by gcc 10.2.1 under x86_64:
../fs/btrfs/tree-log.c: In function ‘btrfs_log_inode’:../fs/btrfs/tree-log.c:6211:9: error: ‘last_range_start’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
6211 | ret = insert_dir_log_key(trans, log, path, key.objectid,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
6212 | first_dir_index, last_dir_index);
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../fs/btrfs/tree-log.c:6161:6: note: ‘last_range_start’ was declared here
6161 | u64 last_range_start;
| ^~~~~~~~~~~~~~~~This might be a false positive fixed in later compiler versions but we want to have it fixed.
--- fs/btrfs/tree-log.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/tree-log.c +1 -1
@@ -6205,7 +6205,7 @@ static int log_delayed_deletions_incremental(struct btrfs_trans_handle *trans, {struct btrfs_root *log = inode->root->log_root;const struct btrfs_delayed_item *curr; -u64 last_range_start; +u64 last_range_start =0 ;u64 last_range_end =0 ;struct btrfs_key key;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 140/170 usb: gadget: udc: fix NULL dereference in remove()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 016da9c65fec9f0e78c4909ed9a0f2d567af6775 ]
The "udc" pointer was never set in the probe() function so it will lead to a NULL dereference in udc_pci_remove() when we do:
usb_del_gadget_udc(&udc->gadget);
--- drivers/usb/gadget/udc/amd5536udc_pci.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/gadget/udc/amd5536udc_pci.c +3 -0
@@ -170,6 +170,9 @@ static int udc_pci_probe( retval = -ENODEV ; goto err_probe; } + + udc = dev; +return 0 ; err_probe:
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 141/170 nvme: double KA polling frequency to avoid KATO with TBKAS on
In reply to Greg Kroah-HartmanFrom: Uday Shankar <[email protected]>
[ Upstream commit ea4d453b9ec9ea279c39744cd0ecb47ef48ede35 ]
With TBKAS on, the completion of one command can defer sending a keep alive for up to twice the delay between successive runs of nvme_keep_alive_work. The current delay of KATO / 2 thus makes it possible for one command to defer sending a keep alive for up to KATO, which can result in the controller detecting a KATO. The following trace demonstrates the issue, taking KATO = 8 for simplicity:
1. t = 0: run nvme_keep_alive_work, no keep-alive sent
2. t = ε: I/O completion seen, set comp_seen = true
3. t = 4: run nvme_keep_alive_work, see comp_seen == true, skip sending keep-alive, set comp_seen = false
4. t = 8: run nvme_keep_alive_work, see comp_seen == false, send a keep-alive command.
Here, there is a delay of 8 - ε between receiving a command completion and sending the next command. With ε small, the controller is likely to detect a keep alive timeout.
Fix this by running nvme_keep_alive_work with a delay of KATO / 4 whenever TBKAS is on. Going through the above trace now gives us a worst-case delay of 4 - ε, which is in line with the recommendation of sending a command every KATO / 2 in the NVMe specification.
--- drivers/nvme/host/core.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
drivers/nvme/host/core.c +17 -1
@@ -1198,9 +1198,25 @@ EXPORT_SYMBOL_NS_GPL(nvme_execute_passthru_rq, NVME_TARGET_PASSTHRU);* The host should send Keep Alive commands at half of the Keep Alive Timeout * accounting for transport roundtrip times [..]. */ +static unsigned long nvme_keep_alive_work_period (struct nvme_ctrl *ctrl) +{ +unsigned long delay = ctrl->kato *HZ /2 ; + +/* +* When using Traffic Based Keep Alive, we need to run +* nvme_keep_alive_work at twice the normal frequency, as one +* command completion can postpone sending a keep alive command +* by up to twice the delay between runs. +*/ +if (ctrl->ctratt &NVME_CTRL_ATTR_TBKAS ) + delay /=2 ; +return delay; +} +static void nvme_queue_keep_alive_work (struct nvme_ctrl *ctrl) { -queue_delayed_work (nvme_wq, &ctrl->ka_work, ctrl->kato *HZ /2 ); +queue_delayed_work (nvme_wq, &ctrl->ka_work, +nvme_keep_alive_work_period (ctrl)); } static enum rq_end_io_ret nvme_keep_alive_end_io(struct request *rq,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 142/170 nvme: check IO start time when deciding to defer KA
In reply to Greg Kroah-HartmanFrom: Uday Shankar <[email protected]>
[ Upstream commit 774a9636514764ddc0d072ae0d1d1c01a47e6ddd ]
When a command completes, we set a flag which will skip sending a keep alive at the next run of nvme_keep_alive_work when TBKAS is on. However, if the command was submitted long ago, it's possible that the controller may have also restarted its keep alive timer (as a result of receiving the command) long ago. The following trace demonstrates the issue, assuming TBKAS is on and KATO = 8 for simplicity:
1. t = 0: submit I/O commands A, B, C, D, E
2. t = 0.5: commands A, B, C, D, E reach controller, restart its keep alive timer
3. t = 1: A completes
4. t = 2: run nvme_keep_alive_work, see recent completion, do nothing
5. t = 3: B completes
6. t = 4: run nvme_keep_alive_work, see recent completion, do nothing
7. t = 5: C completes
8. t = 6: run nvme_keep_alive_work, see recent completion, do nothing
9. t = 7: D completes
10. t = 8: run nvme_keep_alive_work, see recent completion, do nothing
11. t = 9: E completes
At this point, 8.5 seconds have passed without restarting the controller's keep alive timer, so the controller will detect a keep alive timeout.
Fix this by checking the IO start time when deciding to defer sending a keep alive command. Only set comp_seen if the command started after the most recent run of nvme_keep_alive_work. With this change, the completions of B, C, and D will not set comp_seen and the run of nvme_keep_alive_work at t = 4 will send a keep alive.
--- drivers/nvme/host/core.c | 14 +++++++++++++- drivers/nvme/host/nvme.h | 1 + 2 files changed, 14 insertions(+), 1 deletion(-)
drivers/nvme/host/core.c +13 -1
@@ -395,7 +395,16 @@ void nvme_complete_rq(struct request *req)trace_nvme_complete_rq (req);nvme_cleanup_cmd (req); -if (ctrl->kas) +/* +* Completions of long-running commands should not be able to +* defer sending of periodic keep alives, since the controller +* may have completed processing such commands a long time ago +* (arbitrarily close to command submission time). +* req->deadline - req->timeout is the command submission time +* in jiffies. +*/ +if (ctrl->kas && + req->deadline - req->timeout >= ctrl->ka_last_check_time) ctrl->comp_seen = true;switch (nvme_decide_disposition (req)) {
@@ -1235,6 +1244,7 @@ static enum rq_end_io_ret nvme_keep_alive_end_io(struct request *rq,return RQ_END_IO_NONE ; } + ctrl->ka_last_check_time = jiffies; ctrl->comp_seen = false;spin_lock_irqsave (&ctrl->lock, flags); if (ctrl->state == NVME_CTRL_LIVE ||
@@ -1253,6 +1263,8 @@ static void nvme_keep_alive_work(struct work_struct *work)bool comp_seen = ctrl->comp_seen;struct request *rq; + ctrl->ka_last_check_time = jiffies; +if ((ctrl->ctratt &NVME_CTRL_ATTR_TBKAS ) && comp_seen) {dev_dbg (ctrl->device,"reschedule traffic based keep-alive timer\n" );
drivers/nvme/host/nvme.h +1 -0
@@ -323,6 +323,7 @@ struct nvme_ctrl {struct delayed_work ka_work;struct delayed_work failfast_work;struct nvme_command ka_cmd; +unsigned long ka_last_check_time;struct work_struct fw_act_work;unsigned long events;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 143/170 nvme: improve handling of long keep alives
In reply to Greg Kroah-HartmanFrom: Uday Shankar <[email protected]>
[ Upstream commit c7275ce6a5fd32ca9f5a6294ed89cf0523181af9 ]
Upon keep alive completion, nvme_keep_alive_work is scheduled with the same delay every time. If keep alive commands are completing slowly, this may cause a keep alive timeout. The following trace illustrates the issue, taking KATO = 8 and TBKAS off for simplicity:
1. t = 0: run nvme_keep_alive_work, send keep alive
2. t = ε: keep alive reaches controller, controller restarts its keep alive timer
3. t = 4: host receives keep alive completion, schedules nvme_keep_alive_work with delay 4
4. t = 8: run nvme_keep_alive_work, send keep alive
Here, a keep alive having RTT of 4 causes a delay of at least 8 - ε between the controller receiving successive keep alives. With ε small, the controller is likely to detect a keep alive timeout.
Fix this by calculating the RTT of the keep alive command, and adjusting the scheduling delay of the next keep alive work accordingly.
--- drivers/nvme/host/core.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
drivers/nvme/host/core.c +15 -1
@@ -1234,6 +1234,20 @@ static enum rq_end_io_ret nvme_keep_alive_end_io(struct request *rq,struct nvme_ctrl *ctrl = rq->end_io_data;unsigned long flags;bool startka = false; +unsigned long rtt = jiffies - (rq->deadline - rq->timeout); +unsigned long delay =nvme_keep_alive_work_period (ctrl); + +/* +* Subtract off the keepalive RTT so nvme_keep_alive_work runs +* at the desired frequency. +*/ +if (rtt <= delay) { + delay -= rtt; + }else { +dev_warn (ctrl->device,"long keepalive RTT (%u ms)\n" , +jiffies_to_msecs (rtt)); + delay =0 ; + }blk_mq_free_request (rq);
@@ -1252,7 +1266,7 @@ static enum rq_end_io_ret nvme_keep_alive_end_io(struct request *rq, startka = true;spin_unlock_irqrestore (&ctrl->lock, flags);if (startka) -nvme_queue_keep_alive_work (ctrl); +queue_delayed_work (nvme_wq, &ctrl->ka_work, delay);return RQ_END_IO_NONE ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 144/170 Input: soc_button_array - add invalid acpi_index DMI quirk handling
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 20a99a291d564a559cc2fd013b4824a3bb3f1db7 ]
Some devices have a wrong entry in their button array which points to a GPIO which is required in another driver, so soc_button_array must not claim it.
A specific example of this is the Lenovo Yoga Book X90F / X90L, where the PNP0C40 home button entry points to a GPIO which is not a home button and which is required by the lenovo-yogabook driver.
Add a DMI quirk table which can specify an ACPI GPIO resource index which should be skipped; and add an entry for the Lenovo Yoga Book X90F / X90L to this new DMI quirk table.
--- drivers/input/misc/soc_button_array.c | 30 +++++++++++++++++++++++++++ 1 file changed, 30 insertions(+)
drivers/input/misc/soc_button_array.c +30 -0
@@ -108,6 +108,27 @@ static const struct dmi_system_id dmi_use_low_level_irq[] = { {}/* Terminating entry */ }; +/* +* Some devices have a wrong entry which points to a GPIO which is +* required in another driver, so this driver must not claim it. +*/ +static const struct dmi_system_id dmi_invalid_acpi_index[] = { + { +/* +* Lenovo Yoga Book X90F / X90L, the PNP0C40 home button entry +* points to a GPIO which is not a home button and which is +* required by the lenovo-yogabook driver. +*/ + .matches = { +DMI_EXACT_MATCH (DMI_SYS_VENDOR ,"Intel Corporation" ), +DMI_EXACT_MATCH (DMI_PRODUCT_NAME ,"CHERRYVIEW D1 PLATFORM" ), +DMI_EXACT_MATCH (DMI_PRODUCT_VERSION ,"YETI-11" ), + }, + .driver_data = (void *)1l , + }, + {}/* Terminating entry */ +}; +/* * Get the Nth GPIO number from the ACPI object. */
@@ -137,6 +158,8 @@ soc_button_device_create(struct platform_device *pdev,struct platform_device *pd;struct gpio_keys_button *gpio_keys;struct gpio_keys_platform_data *gpio_keys_pdata; +const struct dmi_system_id *dmi_id; +int invalid_acpi_index =-1 ;int error, gpio, irq;int n_buttons =0 ;
@@ -154,10 +177,17 @@ soc_button_device_create(struct platform_device *pdev, gpio_keys = (void *)(gpio_keys_pdata +1 ); n_buttons =0 ; + dmi_id =dmi_first_match (dmi_invalid_acpi_index); +if (dmi_id) + invalid_acpi_index = (long )dmi_id->driver_data; +for (info = button_info; info->name; info++) {if (info->autorepeat != autorepeat)continue ; +if (info->acpi_index == invalid_acpi_index) +continue ; + error =soc_button_lookup_gpio (&pdev->dev, info->acpi_index, &gpio, &irq);if (error || irq <0 ) {/*
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 145/170 arm64: dts: qcom: sc7280-idp: drop incorrect dai-cells from WCD938x SDW
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit ca8fc6814844d8787e7fec61b2544a871ea8b675 ]
The WCD938x audio codec Soundwire interface part is not a DAI and does not allow sound-dai-cells:
sc7280-idp.dtb: codec@0,4: '#sound-dai-cells' does not match any of the regexes: 'pinctrl-[0-9]+'
--- arch/arm64/boot/dts/qcom/sc7280-idp.dtsi | 2 -- 1 file changed, 2 deletions(-)
arch/arm64/boot/dts/qcom/sc7280-idp.dtsi +0 -2
@@ -488,7 +488,6 @@ wcd_rx: codec@0,4 { compatible = "sdw20217010d00"; reg = <0 4>; - #sound-dai-cells = <1>; qcom,rx-port-mapping = <1 2 3 4 5>; }; };
@@ -499,7 +498,6 @@ wcd_tx: codec@0,3 { compatible = "sdw20217010d00"; reg = <0 3>; - #sound-dai-cells = <1>; qcom,tx-port-mapping = <1 2 3 4>; }; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 146/170 arm64: dts: qcom: sc7280-qcard: drop incorrect dai-cells from WCD938x SDW
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 16bd455d0897d1b8b7a9aee2ed51d75b14a34563 ]
The WCD938x audio codec Soundwire interface part is not a DAI and does not allow sound-dai-cells:
sc7280-herobrine-crd.dtb: codec@0,4: '#sound-dai-cells' does not match any of the regexes: 'pinctrl-[0-9]+'
--- arch/arm64/boot/dts/qcom/sc7280-qcard.dtsi | 2 -- 1 file changed, 2 deletions(-)
arch/arm64/boot/dts/qcom/sc7280-qcard.dtsi +0 -2
@@ -418,7 +418,6 @@ wcd_rx: codec@0,4 { compatible = "sdw20217010d00"; reg = <0 4>; - #sound-dai-cells = <1>; qcom,rx-port-mapping = <1 2 3 4 5>; }; };
@@ -427,7 +426,6 @@ wcd_tx: codec@0,3 { compatible = "sdw20217010d00"; reg = <0 3>; - #sound-dai-cells = <1>; qcom,tx-port-mapping = <1 2 3 4>; }; };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 147/170 s390/cio: unregister device when the only path is gone
In reply to Greg Kroah-HartmanFrom: Vineeth Vijayan <[email protected]>
[ Upstream commit 89c0c62e947a01e7a36b54582fd9c9e346170255 ]
Currently, if the device is offline and all the channel paths are either configured or varied offline, the associated subchannel gets unregistered. Don't unregister the subchannel, instead unregister offline device.
--- drivers/s390/cio/device.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/s390/cio/device.c +4 -1
@@ -1367,6 +1367,7 @@ void ccw_device_set_notoper(struct ccw_device *cdev)enum io_sch_action {IO_SCH_UNREG ,IO_SCH_ORPH_UNREG , +IO_SCH_UNREG_CDEV ,IO_SCH_ATTACH ,IO_SCH_UNREG_ATTACH ,IO_SCH_ORPH_ATTACH ,
@@ -1399,7 +1400,7 @@ static enum io_sch_action sch_get_action(struct subchannel *sch) }if ((sch->schib.pmcw.pam & sch->opm) ==0 ) {if (ccw_device_notify (cdev,CIO_NO_PATH ) !=NOTIFY_OK ) -return IO_SCH_UNREG ; +return IO_SCH_UNREG_CDEV ;return IO_SCH_DISC ; }if (device_is_disconnected (cdev))
@@ -1461,6 +1462,7 @@ static int io_subchannel_sch_event(struct subchannel *sch, int process)case IO_SCH_ORPH_ATTACH :ccw_device_set_disconnected (cdev);break ; +case IO_SCH_UNREG_CDEV :case IO_SCH_UNREG_ATTACH :case IO_SCH_UNREG :if (!cdev)
@@ -1494,6 +1496,7 @@ static int io_subchannel_sch_event(struct subchannel *sch, int process)if (rc) goto out;break ; +case IO_SCH_UNREG_CDEV :case IO_SCH_UNREG_ATTACH :spin_lock_irqsave (sch->lock, flags);sch_set_cdev (sch,NULL );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 148/170 spi: lpspi: disable lpspi module irq in DMA mode
In reply to Greg Kroah-HartmanFrom: Clark Wang <[email protected]>
[ Upstream commit 9728fb3ce11729aa8c276825ddf504edeb00611d ]
When all bits of IER are set to 0, we still can observe the lpspi irq events when using DMA mode to transfer data.
So disable irq to avoid the too much irq events.
--- drivers/spi/spi-fsl-lpspi.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/spi/spi-fsl-lpspi.c +6 -1
@@ -905,9 +905,14 @@ static int fsl_lpspi_probe(struct platform_device *pdev) ret =fsl_lpspi_dma_init (&pdev->dev, fsl_lpspi, controller);if (ret == -EPROBE_DEFER ) goto out_pm_get; -if (ret <0 )dev_err (&pdev->dev,"dma setup error %d, use pio\n" , ret); +else +/* +* disable LPSPI module IRQ when enable DMA mode successfully, +* to prevent the unexpected LPSPI module IRQ events. +*/ +disable_irq (irq); ret =devm_spi_register_controller (&pdev->dev, controller);if (ret <0 ) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 149/170 ASoC: codecs: wcd938x-sdw: do not set can_multi_write flag
In reply to Greg Kroah-HartmanFrom: Srinivas Kandagatla <[email protected]>
[ Upstream commit 2d7c2f9272de6347a9cec0fc07708913692c0ae3 ]
regmap-sdw does not support multi register writes, so there is no point in setting this flag. This also leads to incorrect programming of WSA codecs with regmap_multi_reg_write() call.
This invalid configuration should have been rejected by regmap-sdw.
--- sound/soc/codecs/wcd938x-sdw.c | 1 - 1 file changed, 1 deletion(-)
sound/soc/codecs/wcd938x-sdw.c +0 -1
@@ -1190,7 +1190,6 @@ static const struct regmap_config wcd938x_regmap_config = { .readable_reg = wcd938x_readable_register, .writeable_reg = wcd938x_writeable_register, .volatile_reg = wcd938x_volatile_register, - .can_multi_write = true, };static const struct sdw_slave_ops wcd9380_slave_ops = {
Signature · 1 line
2.39.2