6.4.7-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 6.4.7-rc1 review
This is the start of the stable review cycle for the 6.4.7 release. There are 227 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 27 Jul 2023 10:44:26 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.4.7-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.4.7-rc1
Wayne Lin <[email protected]>
drm/amd/display: Add polling method to handle MST reply packet
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Clean up errors & warnings in amdgpu_dm.c
Yu Kuai <[email protected]>
scsi: sg: Fix checking return value of blk_get_queue()
Yu Kuai <[email protected]>
scsi/sg: don't grab scsi host module reference
Abe Kohandel <[email protected]>
spi: dw: Remove misleading comment for Mount Evans SoC
Yunxiang Li <[email protected]>
drm/ttm: fix bulk_move corruption when adding a entry
Mohamed Khalfella <[email protected]>
tracing/histograms: Return an error if we fail to add histogram to hist_vars list
Miguel Ojeda <[email protected]>
kbuild: rust: avoid creating temporary files
Zhang Yi <[email protected]>
jbd2: recheck chechpointing non-dirty buffer
Vladimir Oltean <[email protected]>
net: phy: prevent stale pointer dereference in phy_init()
Eric Dumazet <[email protected]>
tcp: annotate data-races around fastopenq.max_qlen
Eric Dumazet <[email protected]>
tcp: annotate data-races around icsk->icsk_user_timeout
Eric Dumazet <[email protected]>
tcp: annotate data-races around tp->notsent_lowat
Eric Dumazet <[email protected]>
tcp: annotate data-races around rskq_defer_accept
Eric Dumazet <[email protected]>
tcp: annotate data-races around tp->linger2
Eric Dumazet <[email protected]>
tcp: annotate data-races around icsk->icsk_syn_retries
Eric Dumazet <[email protected]>
tcp: annotate data-races around tp->keepalive_probes
Eric Dumazet <[email protected]>
tcp: annotate data-races around tp->keepalive_intvl
Eric Dumazet <[email protected]>
tcp: annotate data-races around tp->keepalive_time
Eric Dumazet <[email protected]>
tcp: annotate data-races around tp->tsoffset
Eric Dumazet <[email protected]>
tcp: annotate data-races around tp->tcp_tx_delay
Tomasz Moń <[email protected]>
Bluetooth: btusb: Fix bluetooth on Intel Macbook 2014
Pauli Virtanen <[email protected]>
Bluetooth: SCO: fix sco_conn related locking and validity issues
Siddh Raman Pant <[email protected]>
Bluetooth: hci_conn: return ERR_PTR instead of NULL when there is no link
Douglas Anderson <[email protected]>
Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor()
Pauli Virtanen <[email protected]>
Bluetooth: ISO: fix iso_conn related locking and validity issues
Pauli Virtanen <[email protected]>
Bluetooth: hci_event: call disconnect callback before deleting conn
Pauli Virtanen <[email protected]>
Bluetooth: use RCU for hci_conn_params and iterate safely in hci_sync
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: skip bound chain on rule flush
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: skip bound chain in netns release path
Florian Westphal <[email protected]>
netfilter: nft_set_pipapo: fix improper element removal
Florian Westphal <[email protected]>
netfilter: nf_tables: can't schedule in nft_chain_validate
Florian Westphal <[email protected]>
netfilter: nf_tables: fix spurious set element insertion failure
Vitaly Rodionov <[email protected]>
ALSA: hda/realtek: Fix generic fixup definition for cs35l41 amp
Kuniyuki Iwashima <[email protected]>
llc: Don't drop packet from non-root netns.
Zhang Shurong <[email protected]>
fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe
Daniel Golle <[email protected]>
net: ethernet: mtk_eth_soc: always mtk_get_ib1_pkt_type
Kuniyuki Iwashima <[email protected]>
Revert "tcp: avoid the lookup process failing to get sk in ehash table"
Yuanjun Gong <[email protected]>
net:ipv6: check return value of pskb_trim()
Wang Ming <[email protected]>
net: ipv4: Use kfree_sensitive instead of kfree
Eric Dumazet <[email protected]>
tcp: annotate data-races around tcp_rsk(req)->ts_recent
Eric Dumazet <[email protected]>
tcp: annotate data-races around tcp_rsk(req)->txhash
Antoine Tenart <[email protected]>
net: ipv4: use consistent txhash in TIME_WAIT and SYN_RECV
Florian Kauer <[email protected]>
igc: Prevent garbled TX queue with XDP ZEROCOPY
Kurt Kanzenbach <[email protected]>
igc: Avoid transmit queue timeout for XDP
Alexander Duyck <[email protected]>
bpf, arm64: Fix BTI type used for freplace attached functions
Kumar Kartikeya Dwivedi <[email protected]>
bpf: Repeat check_max_stack_depth for async callbacks
Kumar Kartikeya Dwivedi <[email protected]>
bpf: Fix subprog idx logic in check_max_stack_depth
Geetha sowjanya <[email protected]>
octeontx2-pf: Dont allocate BPIDs for LBK interfaces
Ido Schimmel <[email protected]>
vrf: Fix lockdep splat in output path
Jiapeng Chong <[email protected]>
security: keys: Modify mismatched function name
Ahmed Zaki <[email protected]>
iavf: fix reset task race with iavf_remove()
Ahmed Zaki <[email protected]>
iavf: fix a deadlock caused by rtnl and driver's lock circular dependencies
Marcin Szycik <[email protected]>
iavf: Wait for reset in callbacks which trigger it
Przemek Kitszel <[email protected]>
iavf: make functions static where possible
Ahmed Zaki <[email protected]>
iavf: use internal state to free traffic IRQs
Ding Hui <[email protected]>
iavf: Fix out-of-bounds when setting channels on remove
Ding Hui <[email protected]>
iavf: Fix use-after-free in free_netdev
Andrzej Hajda <[email protected]>
drm/i915/perf: add sentinel to xehp_oa_b_counters
Heiner Kallweit <[email protected]>
r8169: fix ASPM-related problem for chip version 42 and 43
Tristram Ha <[email protected]>
net: dsa: microchip: correct KSZ8795 static MAC table access
Victor Nogueira <[email protected]>
net: sched: cls_bpf: Undo tcf_bind_filter in case of an error
Victor Nogueira <[email protected]>
net: sched: cls_u32: Undo refcount decrement in case update failed
Victor Nogueira <[email protected]>
net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode
Victor Nogueira <[email protected]>
net: sched: cls_matchall: Undo tcf_bind_filter in case of failure after mall_set_parms
Martin Fuzzey <[email protected]>
regulator: da9063: fix null pointer deref with partial DT config
Dan Carpenter <[email protected]>
ASoC: SOF: ipc3-dtrace: uninitialized data in dfsentry_trace_filter_write()
Michal Swiatkowski <[email protected]>
ice: prevent NULL pointer deref during reload
Petr Oros <[email protected]>
ice: Unregister netdev and devlink_port only once
Shyam Prasad N <[email protected]>
cifs: fix mid leak during reconnection after timeout threshold
Dan Carpenter <[email protected]>
iommu/sva: Fix signedness bug in iommu_sva_alloc_pasid()
Yan Zhai <[email protected]>
gso: fix dodgy bit handling for GSO_UDP_L4
Daniel Golle <[email protected]>
net: ethernet: mtk_eth_soc: handle probe deferral
Kuniyuki Iwashima <[email protected]>
bridge: Add extack warning when enabling STP in netns.
Tanmay Patil <[email protected]>
net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()/cpsw_ale_set_field()
Linus Walleij <[email protected]>
dsa: mv88e6xxx: Do a final check before timing out
Marc Zyngier <[email protected]>
arm64: Fix HFGxTR_EL2 field naming
Paulo Alcantara <[email protected]>
smb: client: fix missed ses refcounting
Yonghong Song <[email protected]>
kallsyms: strip LTO-only suffixes from promoted global functions
Jaewon Kim <[email protected]>
spi: s3c64xx: clear loopback bit after loopback test
Christoph Hellwig <[email protected]>
btrfs: be a bit more careful when setting mirror_num_ret in btrfs_map_block
James Clark <[email protected]>
perf build: Fix library not found error when using CSLIBS
Yangtao Li <[email protected]>
fbdev: imxfb: Removed unneeded release_mem_region
Martin Kaiser <[email protected]>
fbdev: imxfb: warn about invalid left/right margin
Jonas Gorski <[email protected]>
spi: bcm63xx: fix max prepend length
Biju Das <[email protected]>
pinctrl: renesas: rzg2l: Handle non-unique subnode names
Geert Uytterhoeven <[email protected]>
pinctrl: renesas: rzv2m: Handle non-unique subnode names
Suren Baghdasaryan <[email protected]>
sched/psi: use kernfs polling functions for PSI trigger polling
Miaohe Lin <[email protected]>
sched/fair: Use recent_used_cpu to test p->cpus_ptr
Peter Zijlstra <[email protected]>
iov_iter: Mark copy_iovec_from_user() noclone
Srinivas Kandagatla <[email protected]>
ASoC: qcom: q6apm: do not close GPR port before closing graph
Srinivas Kandagatla <[email protected]>
ASoC: codecs: wcd938x: fix dB range for HPHL and HPHR
Johan Hovold <[email protected]>
ASoC: codecs: wcd938x: fix mbhc impedance loglevel
Vijendar Mukunda <[email protected]>
ASoC: amd: acp: fix for invalid dai id handling in acp_get_byte_count()
Hao Chen <[email protected]>
net: hns3: fix strncpy() not using dest-buf length as length issue
Ying Hsu <[email protected]>
igb: Fix igb_down hung on surprise removal
Yi Kuo <[email protected]>
wifi: iwlwifi: pcie: add device id 51F1 for killer 1675
Johannes Berg <[email protected]>
wifi: iwlwifi: mvm: avoid baid size integer overflow
Mukesh Sisodiya <[email protected]>
wifi: iwlwifi: Add support for new PCI Id
Gustavo A. R. Silva <[email protected]>
wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point()
Mukesh Sisodiya <[email protected]>
wifi: iwlwifi: mvm: Add NULL check before dereferencing the pointer
Petr Oros <[email protected]>
devlink: report devlink_port_type_warn source device
Jisheng Zhang <[email protected]>
net: ethernet: litex: add support for 64 bit stats
Gregory Greenman <[email protected]>
wifi: iwlwifi: mvm: fix potential array out of bounds access
P Praneesh <[email protected]>
wifi: ath11k: fix memory leak in WMI firmware stats
Balamurugan S <[email protected]>
wifi: ath12k: Avoid NULL pointer access during management transmit cleanup
Abe Kohandel <[email protected]>
spi: dw: Add compatible for Intel Mount Evans SoC
Ilan Peer <[email protected]>
wifi: mac80211_hwsim: Fix possible NULL dereference
Wen Gong <[email protected]>
wifi: ath11k: add support default regdb while searching board-2.bin for WCN6855
Jakub Kicinski <[email protected]>
devlink: make health report on unregistered instance warn just once
Yonghong Song <[email protected]>
bpf: Silence a warning in btf_type_id_size()
Martin Blumenstingl <[email protected]>
wifi: rtw88: sdio: Check the HISR RX_REQUEST bit in rtw_sdio_rx_isr()
Aditi Ghag <[email protected]>
bpf: tcp: Avoid taking fast sock lock in iterator
Andrii Nakryiko <[email protected]>
bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log
Brad Larson <[email protected]>
spi: cadence-quadspi: Add compatible for AMD Pensando Elba SoC
Martin KaFai Lau <[email protected]>
bpf: Address KCSAN report on bpf_lru_list
Kui-Feng Lee <[email protected]>
bpf: Print a warning only if writing to unprivileged_bpf_disabled.
Maxime Bizon <[email protected]>
wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range
Yicong Yang <[email protected]>
sched/fair: Don't balance task to its current running CPU
Thomas Weißschuh <[email protected]>
tools/nolibc: ensure stack protector guard is never zero
Paul E. McKenney <[email protected]>
rcu: Mark additional concurrent load from ->cpu_no_qs.b.exp
Shigeru Yoshida <[email protected]>
rcu-tasks: Avoid pr_info() with spin lock in cblist_init_generic()
Hans de Goede <[email protected]>
ACPI: video: Add backlight=native DMI quirk for Dell Studio 1569
Mark Rutland <[email protected]>
arm64: mm: fix VA-range sanity check
Youngmin Nam <[email protected]>
arm64: set __exception_irq_entry with __irq_entry as a default
Mario Limonciello <[email protected]>
ACPI: resource: Remove "Zen" specific match and quirks
Hans de Goede <[email protected]>
ACPI: video: Add backlight=native DMI quirk for Lenovo ThinkPad X131e (3371 AMD version)
Hans de Goede <[email protected]>
ACPI: video: Add backlight=native DMI quirk for Apple iMac11,3
Hans de Goede <[email protected]>
ACPI: x86: Add ACPI_QUIRK_UART1_SKIP for Lenovo Yoga Book yb1-x90f/l
Hans de Goede <[email protected]>
ACPI: button: Add lid disable DMI quirk for Nextbook Ares 8A
Hans de Goede <[email protected]>
ACPI: x86: Add skip i2c clients quirk for Nextbook Ares 8A
Sandeep Dhavale <[email protected]>
erofs: Fix detection of atomic context
Filipe Manana <[email protected]>
btrfs: abort transaction at update_ref_for_cow() when ref count is zero
Christoph Hellwig <[email protected]>
btrfs: don't check PageError in __extent_writepage
David Sterba <[email protected]>
btrfs: add xxhash to fast checksum implementations
Thomas Gleixner <[email protected]>
posix-timers: Ensure timer ID search-loop limit is valid
Ming Lei <[email protected]>
blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none
Yu Kuai <[email protected]>
scsi: sg: fix blktrace debugfs entries leakage
Yu Kuai <[email protected]>
md/raid10: prevent soft lockup while flush writes
Yu Kuai <[email protected]>
md: fix data corruption for raid456 when reshape restart while grow up
Immad Mir <[email protected]>
FS: JFS: Check for read-only mounted filesystem in txBegin
Immad Mir <[email protected]>
FS: JFS: Fix null-ptr-deref Read in txBegin
Gustavo A. R. Silva <[email protected]>
MIPS: dec: prom: Address -Warray-bounds warning
Yogesh <[email protected]>
fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev
Matthew Anderson <[email protected]>
ALSA: hda/realtek: Add quirks for ROG ALLY CS35l41 audio
Jan Kara <[email protected]>
udf: Fix uninitialized array access for some pathnames
Christian Brauner <[email protected]>
ovl: check type and offset of struct vfsmount in ovl_entry
Marco Morandini <[email protected]>
HID: add quirk for 03f0:464a HP Elite Presenter Mouse
Ye Bin <[email protected]>
quota: fix warning in dqgrab()
Jan Kara <[email protected]>
quota: Properly disable quotas when add_dquot_ref() fails
Oswald Buddenhagen <[email protected]>
ALSA: emu10k1: roll up loops in DSP setup code for Audigy
hackyzh002 <[email protected]>
drm/radeon: Fix integer overflow in radeon_cs_parser_init
Eric Whitney <[email protected]>
ext4: correct inline offset when handling xattrs in inode body
Marc Zyngier <[email protected]>
KVM: arm64: vgic-v4: Make the doorbell request robust w.r.t preemption
Marc Zyngier <[email protected]>
KVM: arm64: Disable preemption in kvm_arch_hardware_enable()
Oliver Upton <[email protected]>
KVM: arm64: Correctly handle page aging notifiers for unaligned memslot
Marc Zyngier <[email protected]>
KVM: arm64: timers: Use CNTHCTL_EL2 when setting non-CNTKCTL_EL1 bits
Johan Hovold <[email protected]>
ASoC: codecs: wcd938x: fix soundwire initialisation race
Johan Hovold <[email protected]>
ASoC: codecs: wcd938x: fix codec initialisation race
Johan Hovold <[email protected]>
ASoC: codecs: wcd934x: fix resource leaks on component remove
Johan Hovold <[email protected]>
ASoC: codecs: wcd938x: fix missing mbhc init error handling
Johan Hovold <[email protected]>
ASoC: codecs: wcd938x: fix resource leaks on component remove
Sheetal <[email protected]>
ASoC: tegra: Fix AMX byte map
Johan Hovold <[email protected]>
ASoC: qdsp6: audioreach: fix topology probe deferral
Johan Hovold <[email protected]>
ASoC: codecs: wcd-mbhc-v2: fix resource leaks on component remove
Nathan Chancellor <[email protected]>
ASoC: cs35l45: Select REGMAP_IRQ
Johan Hovold <[email protected]>
ASoC: codecs: wcd938x: fix missing clsh ctrl error handling
Thomas Petazzoni <[email protected]>
ASoC: cs42l51: fix driver to properly autoload with automatic module loading
Sameer Pujar <[email protected]>
ASoC: rt5640: Fix sleep in atomic context
Sheetal <[email protected]>
ASoC: tegra: Fix ADX byte map
Fabio Estevam <[email protected]>
ASoC: fsl_sai: Revert "ASoC: fsl_sai: Enable MCTL_MCLK_EN bit for master mode"
Matus Gajdos <[email protected]>
ASoC: fsl_sai: Disable bit clock with transmitter
Nicholas Kazlauskas <[email protected]>
drm/amd/display: Keep PHY active for DP displays on DCN31
Taimur Hassan <[email protected]>
drm/amd/display: check TG is non-null before checking if enabled
Zhikai Zhai <[email protected]>
drm/amd/display: Disable MPC split by default on special asic
Simon Ser <[email protected]>
drm/amd/display: only accept async flips for fast updates
Jocelyn Falempe <[email protected]>
drm/client: Fix memory leak in drm_client_modeset_probe
Jocelyn Falempe <[email protected]>
drm/client: Fix memory leak in drm_client_target_cloned
Ben Skeggs <[email protected]>
drm/nouveau/i2c: fix number of aux event slots
Ben Skeggs <[email protected]>
drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP
Ben Skeggs <[email protected]>
drm/nouveau/disp: PIOR DP uses GPIO for HPD, not PMGR AUX interrupts
Alex Deucher <[email protected]>
drm/amdgpu/pm: make mclk consistent for smu 13.0.7
Alex Deucher <[email protected]>
drm/amdgpu/pm: make gfxclock consistent for sienna cichlid
Guchun Chen <[email protected]>
drm/amdgpu/vkms: relax timer deactivation by hrtimer_try_to_cancel
Ville Syrjälä <[email protected]>
dma-buf/dma-resv: Stop leaking on krealloc() failure
Dan Carpenter <[email protected]>
accel/qaic: Add consistent integer overflow checks
Dan Carpenter <[email protected]>
accel/qaic: tighten bounds checking in decode_message()
Dan Carpenter <[email protected]>
accel/qaic: tighten bounds checking in encode_message()
Matthieu Baerts <[email protected]>
selftests: tc: add ConnTrack procfs kconfig
Heiner Kallweit <[email protected]>
Revert "r8169: disable ASPM during NAPI poll"
Marc Kleine-Budde <[email protected]>
can: gs_usb: fix time stamp counter initialization
Marc Kleine-Budde <[email protected]>
can: gs_usb: gs_can_open(): improve error handling
YueHaibing <[email protected]>
can: bcm: Fix UAF in bcm_proc_show()
Fedor Ross <[email protected]>
can: mcp251xfd: __mcp251xfd_chip_set_mode(): increase poll timeout
Mark Brown <[email protected]>
arm64/fpsimd: Ensure SME storage is allocated after SVE VL changes
Helge Deller <[email protected]>
ia64: mmap: Consider pgoff when searching for free mapping
Mark Brown <[email protected]>
regmap: Account for register length in SMBus I/O limits
Rob Herring <[email protected]>
of: Preserve "of-display" device name for compatibility
Harald Freudenberger <[email protected]>
s390/zcrypt: fix reply buffer calculations for CCA replies
Mark Brown <[email protected]>
regmap: Drop initial version of maximum transfer length fixes
Matthieu Baerts <[email protected]>
selftests: tc: add 'ct' action kconfig dep
Dan Carpenter <[email protected]>
accel/qaic: Fix a leak in map_user_pages()
Matthieu Baerts <[email protected]>
selftests: tc: set timeout to 15 minutes
Josef Bacik <[email protected]>
btrfs: fix race between balance and cancel/pause
Miklos Szeredi <[email protected]>
fuse: ioctl: translate ENOSYS in outarg
Filipe Manana <[email protected]>
btrfs: zoned: fix memory leak after finding block group with super blocks
Filipe Manana <[email protected]>
btrfs: fix double iput() on inode after an error during orphan cleanup
Josef Bacik <[email protected]>
btrfs: set_page_extent_mapped after read_folio in btrfs_cont_expand
Qu Wenruo <[email protected]>
btrfs: raid56: always verify the P/Q contents for scrub
Bernd Schubert <[email protected]>
fuse: Apply flags2 only when userspace set the FUSE_INIT_EXT
Miklos Szeredi <[email protected]>
fuse: add feature flag for expire-only
Miklos Szeredi <[email protected]>
fuse: revalidate: don't invalidate if interrupted
Filipe Manana <[email protected]>
btrfs: fix warning when putting transaction with qgroups enabled after abort
Filipe Manana <[email protected]>
btrfs: fix iput() on error pointer after error during orphan cleanup
Georg Müller <[email protected]>
perf probe: Read DWARF files from the correct CU
Georg Müller <[email protected]>
perf probe: Add test for regression introduced by switch to die_get_decl_file()
Miguel Ojeda <[email protected]>
prctl: move PR_GET_AUXV out of PR_MCE_KILL
Petr Pavlu <[email protected]>
keys: Fix linking a duplicate key to a keyring's assoc_array
Colin Ian King <[email protected]>
selftests/mm: mkdirty: fix incorrect position of #endif
Liam R. Howlett <[email protected]>
maple_tree: fix node allocation testing on 32 bit
Liam R. Howlett <[email protected]>
mm/mlock: fix vma iterator conversion of apply_vma_lock_flags()
Peng Zhang <[email protected]>
maple_tree: set the node limit when creating a new root node
Luka Guzenko <[email protected]>
ALSA: hda/realtek: Enable Mute LED on HP Laptop 15s-eq2xxx
Christoffer Sandberg <[email protected]>
ALSA: hda/realtek: Add quirk for Clevo NS70AU
Kailang Yang <[email protected]>
ALSA: hda/realtek - remove 3k pull low procedure
Helge Deller <[email protected]>
io_uring: Fix io_uring mmap() by using architecture-provided get_unmapped_area()
Jens Axboe <[email protected]>
io_uring: treat -EAGAIN for REQ_F_NOWAIT as final for io-wq
-------------
Diffstat:
Makefile | 4 +- arch/arm64/include/asm/exception.h | 5 - arch/arm64/include/asm/kvm_host.h | 2 + arch/arm64/include/asm/kvm_pgtable.h | 26 +-- arch/arm64/kernel/fpsimd.c | 33 ++- arch/arm64/kvm/arch_timer.c | 6 +- arch/arm64/kvm/arm.c | 19 +- arch/arm64/kvm/hyp/pgtable.c | 47 +++- arch/arm64/kvm/mmu.c | 18 +- arch/arm64/kvm/vgic/vgic-v3.c | 2 +- arch/arm64/kvm/vgic/vgic-v4.c | 7 +- arch/arm64/mm/mmu.c | 4 +- arch/arm64/net/bpf_jit_comp.c | 8 +- arch/arm64/tools/sysreg | 12 +- arch/ia64/kernel/sys_ia64.c | 2 +- arch/mips/include/asm/dec/prom.h | 2 +- arch/parisc/kernel/sys_parisc.c | 15 +- block/blk-mq.c | 10 +- drivers/accel/qaic/qaic_control.c | 39 ++-- drivers/acpi/button.c | 9 + drivers/acpi/resource.c | 60 ----- drivers/acpi/video_detect.c | 24 ++ drivers/acpi/x86/utils.c | 26 ++- drivers/base/regmap/regmap-i2c.c | 8 +- drivers/base/regmap/regmap-spi-avmm.c | 2 +- drivers/base/regmap/regmap.c | 6 +- drivers/bluetooth/btusb.c | 1 + drivers/dma-buf/dma-resv.c | 13 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c | 5 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 256 +++++++++------------ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 7 + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 12 + .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 110 +++++++++ .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.h | 11 + .../amd/display/dc/clk_mgr/dcn31/dcn31_clk_mgr.c | 5 + .../drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 3 +- .../drm/amd/display/dc/dcn303/dcn303_resource.c | 2 +- .../drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 8 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 2 +- drivers/gpu/drm/drm_client_modeset.c | 6 + drivers/gpu/drm/i915/i915_perf.c | 1 + drivers/gpu/drm/nouveau/dispnv50/disp.c | 4 + drivers/gpu/drm/nouveau/include/nvkm/subdev/i2c.h | 4 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/uconn.c | 27 ++- drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c | 11 +- drivers/gpu/drm/radeon/radeon_cs.c | 3 +- drivers/gpu/drm/ttm/ttm_resource.c | 5 +- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-quirks.c | 1 + drivers/iommu/iommu-sva.c | 3 +- drivers/md/md.c | 14 +- drivers/md/raid10.c | 2 + drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 10 +- drivers/net/can/spi/mcp251xfd/mcp251xfd.h | 1 + drivers/net/can/usb/gs_usb.c | 130 ++++++----- drivers/net/dsa/microchip/ksz8795.c | 8 +- drivers/net/dsa/microchip/ksz_common.c | 8 +- drivers/net/dsa/microchip/ksz_common.h | 7 + drivers/net/dsa/mv88e6xxx/chip.c | 7 + drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c | 33 ++- .../ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c | 29 ++- drivers/net/ethernet/intel/iavf/iavf.h | 16 +- drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 39 ++-- drivers/net/ethernet/intel/iavf/iavf_main.c | 223 ++++++++++++------ drivers/net/ethernet/intel/iavf/iavf_txrx.c | 43 ++-- drivers/net/ethernet/intel/iavf/iavf_txrx.h | 4 - drivers/net/ethernet/intel/iavf/iavf_virtchnl.c | 5 +- drivers/net/ethernet/intel/ice/ice_base.c | 2 + drivers/net/ethernet/intel/ice/ice_ethtool.c | 13 +- drivers/net/ethernet/intel/ice/ice_lib.c | 27 --- drivers/net/ethernet/intel/ice/ice_main.c | 10 +- drivers/net/ethernet/intel/igb/igb_main.c | 5 + drivers/net/ethernet/intel/igc/igc_main.c | 12 +- drivers/net/ethernet/litex/litex_liteeth.c | 19 +- .../net/ethernet/marvell/octeontx2/nic/otx2_pf.c | 5 +- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 29 +-- drivers/net/ethernet/mediatek/mtk_ppe_debugfs.c | 2 +- drivers/net/ethernet/realtek/r8169_main.c | 18 +- drivers/net/ethernet/ti/cpsw_ale.c | 24 +- drivers/net/phy/phy_device.c | 21 +- drivers/net/vrf.c | 12 +- drivers/net/wireless/ath/ath11k/core.c | 53 +++-- drivers/net/wireless/ath/ath11k/mac.c | 3 +- drivers/net/wireless/ath/ath11k/wmi.c | 5 + drivers/net/wireless/ath/ath12k/mac.c | 1 + drivers/net/wireless/intel/iwlwifi/mvm/mld-key.c | 9 +- drivers/net/wireless/intel/iwlwifi/mvm/power.c | 14 +- drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 2 +- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 4 + drivers/net/wireless/realtek/rtw88/sdio.c | 24 +- drivers/net/wireless/virtual/mac80211_hwsim.c | 4 +- drivers/of/platform.c | 2 +- drivers/pinctrl/renesas/pinctrl-rzg2l.c | 28 ++- drivers/pinctrl/renesas/pinctrl-rzv2m.c | 28 ++- drivers/regulator/da9063-regulator.c | 3 + drivers/s390/crypto/zcrypt_msgtype6.c | 33 ++- drivers/scsi/sg.c | 10 + drivers/spi/spi-bcm63xx.c | 2 +- drivers/spi/spi-cadence-quadspi.c | 19 ++ drivers/spi/spi-dw-mmio.c | 22 ++ drivers/spi/spi-s3c64xx.c | 2 + drivers/video/fbdev/au1200fb.c | 3 + drivers/video/fbdev/imxfb.c | 5 +- fs/btrfs/block-group.c | 1 + fs/btrfs/ctree.c | 10 +- fs/btrfs/disk-io.c | 3 + fs/btrfs/extent_io.c | 33 +-- fs/btrfs/inode.c | 35 +-- fs/btrfs/qgroup.c | 1 + fs/btrfs/raid56.c | 11 +- fs/btrfs/volumes.c | 17 +- fs/erofs/zdata.c | 2 +- fs/ext4/xattr.c | 14 ++ fs/fuse/dir.c | 2 +- fs/fuse/inode.c | 8 +- fs/fuse/ioctl.c | 21 +- fs/jbd2/checkpoint.c | 102 +++----- fs/jfs/jfs_dmap.c | 3 + fs/jfs/jfs_txnmgr.c | 5 + fs/jfs/namei.c | 5 + fs/overlayfs/ovl_entry.h | 9 + fs/quota/dquot.c | 5 +- fs/smb/client/connect.c | 19 +- fs/smb/client/dfs.c | 26 +-- fs/smb/client/smb2transport.c | 2 +- fs/udf/unicode.c | 2 +- include/kvm/arm_vgic.h | 2 +- include/linux/psi.h | 5 +- include/linux/psi_types.h | 3 + include/linux/sched/signal.h | 2 +- include/linux/tcp.h | 2 +- include/net/bluetooth/hci_core.h | 5 + include/net/ip.h | 2 +- include/net/tcp.h | 31 ++- include/uapi/linux/fuse.h | 3 + io_uring/io_uring.c | 52 ++--- kernel/bpf/bpf_lru_list.c | 21 +- kernel/bpf/bpf_lru_list.h | 7 +- kernel/bpf/btf.c | 23 +- kernel/bpf/log.c | 3 - kernel/bpf/syscall.c | 3 +- kernel/bpf/verifier.c | 32 ++- kernel/cgroup/cgroup.c | 2 +- kernel/kallsyms.c | 5 +- kernel/rcu/tasks.h | 5 +- kernel/rcu/tree_exp.h | 2 +- kernel/rcu/tree_plugin.h | 4 +- kernel/sched/fair.c | 4 +- kernel/sched/psi.c | 29 ++- kernel/sys.c | 10 +- kernel/time/posix-timers.c | 31 +-- kernel/trace/trace_events_hist.c | 3 +- lib/iov_iter.c | 2 +- lib/maple_tree.c | 3 +- mm/mlock.c | 9 +- net/bluetooth/hci_conn.c | 14 +- net/bluetooth/hci_core.c | 42 +++- net/bluetooth/hci_event.c | 15 +- net/bluetooth/hci_sync.c | 121 ++++++++-- net/bluetooth/iso.c | 55 +++-- net/bluetooth/mgmt.c | 26 +-- net/bluetooth/sco.c | 23 +- net/bridge/br_stp_if.c | 3 + net/can/bcm.c | 12 +- net/devlink/health.c | 2 +- net/devlink/leftover.c | 5 +- net/ipv4/esp4.c | 2 +- net/ipv4/inet_connection_sock.c | 2 +- net/ipv4/inet_hashtables.c | 17 +- net/ipv4/inet_timewait_sock.c | 8 +- net/ipv4/ip_output.c | 4 +- net/ipv4/tcp.c | 57 ++--- net/ipv4/tcp_fastopen.c | 6 +- net/ipv4/tcp_ipv4.c | 27 ++- net/ipv4/tcp_minisocks.c | 11 +- net/ipv4/tcp_output.c | 6 +- net/ipv4/udp_offload.c | 16 +- net/ipv6/ip6_gre.c | 3 +- net/ipv6/tcp_ipv6.c | 4 +- net/ipv6/udp_offload.c | 3 +- net/llc/llc_input.c | 3 - net/netfilter/nf_tables_api.c | 12 +- net/netfilter/nft_set_pipapo.c | 6 +- net/sched/cls_bpf.c | 99 ++++---- net/sched/cls_matchall.c | 35 +-- net/sched/cls_u32.c | 48 +++- net/wireless/wext-core.c | 6 + scripts/Makefile.build | 5 +- scripts/Makefile.host | 6 +- scripts/kallsyms.c | 6 +- security/keys/request_key.c | 35 ++- security/keys/trusted-keys/trusted_tpm2.c | 2 +- sound/pci/emu10k1/emufx.c | 112 +-------- sound/pci/hda/patch_realtek.c | 100 +++++++- sound/soc/amd/acp/amd.h | 7 +- sound/soc/codecs/Kconfig | 1 + sound/soc/codecs/cs42l51-i2c.c | 6 + sound/soc/codecs/cs42l51.c | 7 - sound/soc/codecs/cs42l51.h | 1 - sound/soc/codecs/rt5640.c | 12 +- sound/soc/codecs/wcd-mbhc-v2.c | 57 +++-- sound/soc/codecs/wcd934x.c | 12 + sound/soc/codecs/wcd938x.c | 86 ++++++- sound/soc/fsl/fsl_sai.c | 8 +- sound/soc/fsl/fsl_sai.h | 1 + sound/soc/qcom/qdsp6/q6apm.c | 7 +- sound/soc/qcom/qdsp6/topology.c | 4 +- sound/soc/sof/ipc3-dtrace.c | 9 +- sound/soc/tegra/tegra210_adx.c | 34 ++- sound/soc/tegra/tegra210_amx.c | 40 ++-- tools/include/nolibc/stackprotector.h | 5 +- tools/perf/Makefile.config | 4 +- .../tests/shell/test_uprobe_from_different_cu.sh | 77 +++++++ tools/perf/util/dwarf-aux.c | 4 +- tools/testing/radix-tree/maple.c | 6 +- tools/testing/selftests/mm/mkdirty.c | 2 +- tools/testing/selftests/tc-testing/config | 2 + tools/testing/selftests/tc-testing/settings | 1 + 218 files changed, 2462 insertions(+), 1482 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/227 io_uring: treat -EAGAIN for REQ_F_NOWAIT as final for io-wq
From: Jens Axboe <[email protected]>
commit a9be202269580ca611c6cebac90eaf1795497800 upstream.
io-wq assumes that an issue is blocking, but it may not be if the request type has asked for a non-blocking attempt. If we get -EAGAIN for that case, then we need to treat it as a final result and not retry or arm poll for it.
--- io_uring/io_uring.c | 8 ++++++++ 1 file changed, 8 insertions(+)
io_uring/io_uring.c +8 -0
@@ -2032,6 +2032,14 @@ fail: ret =io_issue_sqe (req, issue_flags);if (ret != -EAGAIN )break ; + +/* +* If REQ_F_NOWAIT is set, then don't wait or retry with +* poll. -EAGAIN is final for that case. +*/ +if (req->flags &REQ_F_NOWAIT ) +break ; +/* * We can get EAGAIN for iopolled IO even though we're * forcing a sync submission from here, since we can't
Greg Kroah-Hartman
maintainerPATCH 2/227 io_uring: Fix io_uring mmap() by using architecture-provided get_unmapped_area()
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
commit 32832a407a7178eec3215fad9b1a3298c14b0d69 upstream.
The io_uring testcase is broken on IA-64 since commit d808459b2e31 ("io_uring: Adjust mapping wrt architecture aliasing requirements").
The reason is, that this commit introduced an own architecture independend get_unmapped_area() search algorithm which finds on IA-64 a memory region which is outside of the regular memory region used for shared userspace mappings and which can't be used on that platform due to aliasing.
To avoid similar problems on IA-64 and other platforms in the future, it's better to switch back to the architecture-provided get_unmapped_area() function and adjust the needed input parameters before the call. Beside fixing the issue, the function now becomes easier to understand and maintain.
This patch has been successfully tested with the io_uring testcase on physical x86-64, ppc64le, IA-64 and PA-RISC machines. On PA-RISC the LTP mmmap testcases did not report any regressions.
--- arch/parisc/kernel/sys_parisc.c | 15 +++++++++----- io_uring/io_uring.c | 42 ++++++++++++++++------------------------ 2 files changed, 27 insertions(+), 30 deletions(-)
arch/parisc/kernel/sys_parisc.c +10 -5
@@ -26,12 +26,17 @@#include <linux/compat.h> /* -* Construct an artificial page offset for the mapping based on the physical +* Construct an artificial page offset for the mapping based on the virtual * address of the kernel file mapping variable. +* If filp is zero the calculated pgoff value aliases the memory of the given +* address. This is useful for io_uring where the mapping shall alias a kernel +* address and a userspace adress where both the kernel and the userspace +* access the same memory region. */ -#define GET_FILP_PGOFF (filp) \ - (filp ? (((unsigned long) filp->f_mapping) >> 8) \ - & ((SHM_COLOUR-1) >> PAGE_SHIFT) : 0UL) +#define GET_FILP_PGOFF (filp, addr) \ + ((filp ? (((unsigned long) filp->f_mapping) >> 8) \ + & ((SHM_COLOUR-1) >> PAGE_SHIFT) : 0UL) \ + + (addr >> PAGE_SHIFT))static unsigned long shared_align_offset (unsigned long filp_pgoff,unsigned long pgoff)
@@ -111,7 +116,7 @@ static unsigned long arch_get_unmapped_a do_color_align =0 ;if (filp || (flags &MAP_SHARED )) do_color_align =1 ; - filp_pgoff =GET_FILP_PGOFF (filp); + filp_pgoff =GET_FILP_PGOFF (filp, addr);if (flags &MAP_FIXED ) {/* Even MAP_FIXED mappings must reside within TASK_SIZE */
io_uring/io_uring.c +17 -25
57 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 3/227 ALSA: hda/realtek - remove 3k pull low procedure
In reply to Greg Kroah-HartmanFrom: Kailang Yang <[email protected]>
commit 69ea4c9d02b7947cdd612335a61cc1a02e544ccd upstream.
This was the ALC283 depop procedure.
Maybe this procedure wasn't suitable with new codec.
So, let us remove it. But HP 15z-fc000 must do 3k pull low. If it reboot with plugged headset,
it will have errors show don't find codec error messages. Run 3k pull low will solve issues.
So, let AMD chipset will run this for workarround.
--- sound/pci/hda/patch_realtek.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
sound/pci/hda/patch_realtek.c +5 -2
@@ -122,6 +122,7 @@ struct alc_spec { unsigned int ultra_low_power:1; unsigned int has_hs_key:1; unsigned int no_internal_mic_pin:1; + unsigned int en_3kpull_low:1;/* for PLL fix */ hda_nid_t pll_nid;
@@ -3622,6 +3623,7 @@ static void alc256_shutup(struct hda_codif (!hp_pin) hp_pin =0x21 ; +alc_update_coefex_idx (codec,0x57 ,0x04 ,0x0007 ,0x1 );/* Low power */ hp_pin_sense =snd_hda_jack_detect (codec, hp_pin);if (hp_pin_sense)
@@ -3638,8 +3640,7 @@ static void alc256_shutup(struct hda_cod/* If disable 3k pulldown control for alc257, the Mic detection will not work correctly * when booting with headset plugged. So skip setting it for the codec alc257 */ -if (codec->core.vendor_id !=0x10ec0236 && - codec->core.vendor_id !=0x10ec0257 ) +if (spec->en_3kpull_low)alc_update_coef_idx (codec,0x46 ,0 ,3 <<12 );if (!spec->no_shutup_pins)
@@ -10601,6 +10602,8 @@ static int patch_alc269(struct hda_codec spec->shutup = alc256_shutup; spec->init_hook = alc256_init; spec->gen.mixer_nid =0 ;/* ALC256 does not have any loopback mixer path */ +if (codec->bus->pci->vendor ==PCI_VENDOR_ID_AMD ) + spec->en_3kpull_low = true;break ;case 0x10ec0257 : spec->codec_variant =ALC269_TYPE_ALC257 ;
Greg Kroah-Hartman
maintainerPATCH 4/227 ALSA: hda/realtek: Add quirk for Clevo NS70AU
In reply to Greg Kroah-HartmanFrom: Christoffer Sandberg <[email protected]>
commit c250ef8954eda2024c8861c36e9fc1b589481fe7 upstream.
Fixes headset detection on Clevo NS70AU.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -9647,6 +9647,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1558 ,0x5157 ,"Clevo W517GU1" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0x51a1 ,"Clevo NS50MU" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0x51b1 ,"Clevo NS50AU" ,ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE ), +SND_PCI_QUIRK (0x1558 ,0x51b3 ,"Clevo NS70AU" ,ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0x5630 ,"Clevo NP50RNJS" ,ALC256_FIXUP_SYSTEM76_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1558 ,0x70a1 ,"Clevo NB70T[HJK]" ,ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE ), SND_PCI_QUIRK(0x1558, 0x70b3, "Clevo NK70SB", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
Greg Kroah-Hartman
maintainerPATCH 5/227 ALSA: hda/realtek: Enable Mute LED on HP Laptop 15s-eq2xxx
In reply to Greg Kroah-HartmanFrom: Luka Guzenko <[email protected]>
commit 0659400f18c0e6c0c69d74fe5d09e7f6fbbd52a2 upstream.
The HP Laptop 15s-eq2xxx uses ALC236 codec and controls the mute LED using COEF 0x07 index 1. No existing quirk covers this configuration. Adds a new quirk and enables it for the device.
--- sound/pci/hda/patch_realtek.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
sound/pci/hda/patch_realtek.c +21 -0
@@ -4624,6 +4624,21 @@ static void alc236_fixup_hp_mute_led_coe } } +static void alc236_fixup_hp_mute_led_coefbit2 (struct hda_codec *codec, +const struct hda_fixup *fix,int action) +{ +struct alc_spec *spec = codec->spec; + +if (action ==HDA_FIXUP_ACT_PRE_PROBE ) { + spec->mute_led_polarity =0 ; + spec->mute_led_coef.idx =0x07 ; + spec->mute_led_coef.mask =1 ; + spec->mute_led_coef.on =1 ; + spec->mute_led_coef.off =0 ; +snd_hda_gen_add_mute_led_cdev (codec, coef_mute_led_set); + } +} +/* turn on/off mic-mute LED per capture hook by coef bit */ static int coef_micmute_led_set (struct led_classdev *led_cdev,enum led_brightness brightness)
@@ -7134,6 +7149,7 @@ enum {ALC285_FIXUP_HP_GPIO_LED ,ALC285_FIXUP_HP_MUTE_LED ,ALC285_FIXUP_HP_SPECTRE_X360_MUTE_LED , +ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 ,ALC236_FIXUP_HP_GPIO_LED ,ALC236_FIXUP_HP_MUTE_LED , ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF,
@@ -8557,6 +8573,10 @@ static const struct hda_fixup alc269_fix .type = HDA_FIXUP_FUNC, .v.func = alc285_fixup_hp_spectre_x360_mute_led, }, + [ALC236_FIXUP_HP_MUTE_LED_COEFBIT2] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc236_fixup_hp_mute_led_coefbit2, + }, [ALC236_FIXUP_HP_GPIO_LED] = { .type = HDA_FIXUP_FUNC, .v.func = alc236_fixup_hp_gpio_led,
@@ -9441,6 +9461,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x103c ,0x886d ,"HP ZBook Fury 17.3 Inch G8 Mobile Workstation PC" ,ALC285_FIXUP_HP_GPIO_AMP_INIT ),SND_PCI_QUIRK (0x103c ,0x8870 ,"HP ZBook Fury 15.6 Inch G8 Mobile Workstation PC" ,ALC285_FIXUP_HP_GPIO_AMP_INIT ),SND_PCI_QUIRK (0x103c ,0x8873 ,"HP ZBook Studio 15.6 Inch G8 Mobile Workstation PC" ,ALC285_FIXUP_HP_GPIO_AMP_INIT ), +SND_PCI_QUIRK (0x103c ,0x887a ,"HP Laptop 15s-eq2xxx" ,ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 ),SND_PCI_QUIRK (0x103c ,0x888d ,"HP ZBook Power 15.6 inch G8 Mobile Workstation PC" ,ALC236_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8895 ,"HP EliteBook 855 G8 Notebook PC" ,ALC285_FIXUP_HP_SPEAKERS_MICMUTE_LED ), SND_PCI_QUIRK(0x103c, 0x8896, "HP EliteBook 855 G8 Notebook PC", ALC285_FIXUP_HP_MUTE_LED),
Greg Kroah-Hartman
maintainerPATCH 6/227 maple_tree: set the node limit when creating a new root node
In reply to Greg Kroah-HartmanFrom: Peng Zhang <[email protected]>
commit 3c769fd88b9742954763a968e84de09f7ad78cfe upstream.
Set the node limit of the root node so that the last pivot of all nodes is the node limit (if the node is not full).
This patch also fixes a bug in mas_rev_awalk(). Effectively, always setting a maximum makes mas_logical_pivot() behave as mas_safe_pivot(). Without this fix, it is possible that very small tasks would fail to find the correct gap. Although this has not been observed with real tasks, it has been reported to happen in m68k nommu running the maple tree tests.
--- lib/maple_tree.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
lib/maple_tree.c +2 -1
@@ -3693,7 +3693,8 @@ static inline int mas_root_expand(struct mas->offset = slot; pivots[slot] = mas->last;if (mas->last !=ULONG_MAX ) - slot++; + pivots[++slot] =ULONG_MAX ; + mas->depth =1 ;mas_set_height (mas);ma_set_meta (node, maple_leaf_64,0 , slot);
Greg Kroah-Hartman
maintainerPATCH 7/227 mm/mlock: fix vma iterator conversion of apply_vma_lock_flags()
In reply to Greg Kroah-HartmanFrom: Liam R. Howlett <[email protected]>
commit 2658f94d679243209889cdfa8de3743cde1abea9 upstream.
apply_vma_lock_flags() calls mlock_fixup(), which could merge the VMA after where the vma iterator is located. Although this is not an issue, the next iteration of the loop will check the start of the vma to be equal to the locally saved 'tmp' variable and cause an incorrect failure scenario. Fix the error by setting tmp to the end of the vma iterator value before restarting the loop.
There is also a potential of the error code being overwritten when the loop terminates early. Fix the return issue by directly returning when an error is encountered since there is nothing to undo after the loop.
--- mm/mlock.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
mm/mlock.c +5 -4
@@ -471,7 +471,6 @@ static int apply_vma_lock_flags(unsigned {unsigned long nstart, end, tmp;struct vm_area_struct *vma, *prev; -int error;VMA_ITERATOR (vmi, current->mm, start);VM_BUG_ON (offset_in_page (start));
@@ -492,6 +491,7 @@ static int apply_vma_lock_flags(unsigned nstart = start; tmp = vma->vm_start;for_each_vma_range (vmi, vma, end) { +int error;vm_flags_t newflags;if (vma->vm_start != tmp)
@@ -505,14 +505,15 @@ static int apply_vma_lock_flags(unsigned tmp = end; error =mlock_fixup (&vmi, vma, &prev, nstart, tmp, newflags);if (error) -break ; +return error; + tmp =vma_iter_end (&vmi); nstart = tmp; } -if (vma_iter_end (&vmi) < end) +if (tmp < end)return -ENOMEM ; -return error; +return 0 ; }/*
Greg Kroah-Hartman
maintainerPATCH 8/227 maple_tree: fix node allocation testing on 32 bit
In reply to Greg Kroah-HartmanFrom: Liam R. Howlett <[email protected]>
commit ef5c3de5211b5a3a8102b25aa83eb4cde65ac2fd upstream.
Internal node counting was altered and the 64 bit test was updated, however the 32bit test was missed.
Restore the 32bit test to a functional state.
--- tools/testing/radix-tree/maple.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
tools/testing/radix-tree/maple.c +3 -3
@@ -206,9 +206,9 @@ static noinline void check_new_node(stru e = i -1 ; }else {if (i >=4 ) - e = i -4 ; -else if (i ==3 ) - e = i -2 ; + e = i -3 ; +else if (i >=1 ) + e = i -1 ;else e =0 ; }
Greg Kroah-Hartman
maintainerPATCH 9/227 selftests/mm: mkdirty: fix incorrect position of #endif
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
commit 25b5949c30938c7f26dbadc948b491e0e0811c78 upstream.
The #endif is the wrong side of a } causing a build failure when __NR_userfaultfd is not defined. Fix this by moving the #end to enclose the }
--- tools/testing/selftests/mm/mkdirty.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/mm/mkdirty.c +1 -1
@@ -321,8 +321,8 @@ close_uffd: munmap:munmap (dst, pagesize); free(src); -#endif /* __NR_userfaultfd */ } +#endif /* __NR_userfaultfd */ int main (void ) {
Greg Kroah-Hartman
maintainerPATCH 10/227 keys: Fix linking a duplicate key to a keyrings assoc_array
In reply to Greg Kroah-HartmanFrom: Petr Pavlu <[email protected]>
commit d55901522f96082a43b9842d34867363c0cdbac5 upstream.
When making a DNS query inside the kernel using dns_query(), the request code can in rare cases end up creating a duplicate index key in the assoc_array of the destination keyring. It is eventually found by a BUG_ON() check in the assoc_array implementation and results in a crash.
Example report:
[2158499.700025] kernel BUG at ../lib/assoc_array.c:652! [2158499.700039] invalid opcode: 0000 [#1] SMP PTI [2158499.700065] CPU: 3 PID: 31985 Comm: kworker/3:1 Kdump: loaded Not tainted 5.3.18-150300.59.90-default #1 SLE15-SP3 [2158499.700096] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 [2158499.700351] Workqueue: cifsiod cifs_resolve_server [cifs] [2158499.700380] RIP: 0010:assoc_array_insert+0x85f/0xa40 [2158499.700401] Code: ff 74 2b 48 8b 3b 49 8b 45 18 4c 89 e6 48 83 e7 fe e8 95 ec 74 00 3b 45 88 7d db 85 c0 79 d4 0f 0b 0f 0b 0f 0b e8 41 f2 be ff <0f> 0b 0f 0b 81 7d 88 ff ff ff 7f 4c 89 eb 4c 8b ad 58 ff ff ff 0f [2158499.700448] RSP: 0018:ffffc0bd6187faf0 EFLAGS: 00010282 [2158499.700470] RAX: ffff9f1ea7da2fe8 RBX: ffff9f1ea7da2fc1 RCX: 0000000000000005 [2158499.700492] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000000 [2158499.700515] RBP: ffffc0bd6187fbb0 R08: ffff9f185faf1100 R09: 0000000000000000 [2158499.700538] R10: ffff9f1ea7da2cc0 R11: 000000005ed8cec8 R12: ffffc0bd6187fc28 [2158499.700561] R13: ffff9f15feb8d000 R14: ffff9f1ea7da2fc0 R15: ffff9f168dc0d740 [2158499.700585] FS: 0000000000000000(0000) GS:ffff9f185fac0000(0000) knlGS:0000000000000000 [2158499.700610] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [2158499.700630] CR2: 00007fdd94fca238 CR3: 0000000809d8c006 CR4: 00000000003706e0 [2158499.700702] Call Trace: [2158499.700741] ? key_alloc+0x447/0x4b0 [2158499.700768] ? __key_link_begin+0x43/0xa0 [2158499.700790] __key_link_begin+0x43/0xa0 [2158499.700814] request_key_and_link+0x2c7/0x730 [2158499.700847] ? dns_resolver_read+0x20/0x20 [dns_resolver] [2158499.700873] ? key_default_cmp+0x20/0x20 [2158499.700898] request_key_tag+0x43/0xa0 [2158499.700926] dns_query+0x114/0x2ca [dns_resolver] [2158499.701127] dns_resolve_server_name_to_ip+0x194/0x310 [cifs] [2158499.701164] ? scnprintf+0x49/0x90 [2158499.701190] ? __switch_to_asm+0x40/0x70 [2158499.701211] ? __switch_to_asm+0x34/0x70 [2158499.701405] reconn_set_ipaddr_from_hostname+0x81/0x2a0 [cifs] [2158499.701603] cifs_resolve_server+0x4b/0xd0 [cifs] [2158499.701632] process_one_work+0x1f8/0x3e0 [2158499.701658] worker_thread+0x2d/0x3f0 [2158499.701682] ? process_one_work+0x3e0/0x3e0 [2158499.701703] kthread+0x10d/0x130 [2158499.701723] ? kthread_park+0xb0/0xb0 [2158499.701746] ret_from_fork+0x1f/0x40
The situation occurs as follows:
* Some kernel facility invokes dns_query() to resolve a hostname, for example, "abcdef". The function registers its global DNS resolver cache as current->cred.thread_keyring and passes the query to request_key_net() -> request_key_tag() -> request_key_and_link().
* Function request_key_and_link() creates a keyring_search_context object. Its match_data.cmp method gets set via a call to type->match_preparse() (resolves to dns_resolver_match_preparse()) to dns_resolver_cmp().
* Function request_key_and_link() continues and invokes search_process_keyrings_rcu() which returns that a given key was not found. The control is then passed to request_key_and_link() -> construct_alloc_key().
* Concurrently to that, a second task similarly makes a DNS query for "abcdef." and its result gets inserted into the DNS resolver cache.
* Back on the first task, function construct_alloc_key() first runs __key_link_begin() to determine an assoc_array_edit operation to insert a new key. Index keys in the array are compared exactly as-is, using keyring_compare_object(). The operation finds that "abcdef" is not yet present in the destination keyring.
* Function construct_alloc_key() continues and checks if a given key is already present on some keyring by again calling search_process_keyrings_rcu(). This search is done using dns_resolver_cmp() and "abcdef" gets matched with now present key "abcdef.".
* The found key is linked on the destination keyring by calling __key_link() and using the previously calculated assoc_array_edit operation. This inserts the "abcdef." key in the array but creates a duplicity because the same index key is already present.
Fix the problem by postponing __key_link_begin() in construct_alloc_key() until an actual key which should be linked into the destination keyring is determined.
--- security/keys/request_key.c | 35 ++++++++++++++++++++++++----------- 1 file changed, 24 insertions(+), 11 deletions(-)
security/keys/request_key.c +24 -11
@@ -401,17 +401,21 @@ static int construct_alloc_key(struct keset_bit (KEY_FLAG_USER_CONSTRUCT , &key->flags);if (dest_keyring) { - ret =__key_link_lock (dest_keyring, &ctx->index_key); + ret =__key_link_lock (dest_keyring, &key->index_key);if (ret <0 ) goto link_lock_failed; - ret =__key_link_begin (dest_keyring, &ctx->index_key, &edit); -if (ret <0 ) - goto link_prealloc_failed; } -/* attach the key to the destination keyring under lock, but we do need +/* +* Attach the key to the destination keyring under lock, but we do need * to do another check just in case someone beat us to it whilst we -* waited for locks */ +* waited for locks. +* +* The caller might specify a comparison function which looks for keys +* that do not exactly match but are still equivalent from the caller's +* perspective. The __key_link_begin() operation must be done only after +* an actual key is determined. +*/ mutex_lock (&key_construction_mutex);rcu_read_lock ();
@@ -420,12 +424,16 @@ static int construct_alloc_key(struct keif (!IS_ERR (key_ref)) goto key_already_present; -if (dest_keyring) +if (dest_keyring) { + ret =__key_link_begin (dest_keyring, &key->index_key, &edit); +if (ret <0 ) + goto link_alloc_failed;__key_link (dest_keyring, key, &edit); + }mutex_unlock (&key_construction_mutex);if (dest_keyring) -__key_link_end (dest_keyring, &ctx->index_key, edit); +__key_link_end (dest_keyring, &key->index_key, edit);mutex_unlock (&user->cons_lock); *_key = key;kleave (" = 0 [%d]" ,key_serial (key));
@@ -438,10 +446,13 @@ key_already_present:mutex_unlock (&key_construction_mutex); key =key_ref_to_ptr (key_ref);if (dest_keyring) { + ret =__key_link_begin (dest_keyring, &key->index_key, &edit); +if (ret <0 ) + goto link_alloc_failed_unlocked; ret =__key_link_check_live_key (dest_keyring, key);if (ret ==0 )__key_link (dest_keyring, key, &edit); -__key_link_end (dest_keyring, &ctx->index_key, edit); +__key_link_end (dest_keyring, &key->index_key, edit);if (ret <0 ) goto link_check_failed; }
@@ -456,8 +467,10 @@ link_check_failed:kleave (" = %d [linkcheck]" , ret);return ret; -link_prealloc_failed: -__key_link_end (dest_keyring, &ctx->index_key, edit); +link_alloc_failed: +mutex_unlock (&key_construction_mutex); +link_alloc_failed_unlocked: +__key_link_end (dest_keyring, &key->index_key, edit); link_lock_failed:mutex_unlock (&user->cons_lock);key_put (key);
Greg Kroah-Hartman
maintainerPATCH 11/227 prctl: move PR_GET_AUXV out of PR_MCE_KILL
In reply to Greg Kroah-HartmanFrom: Miguel Ojeda <[email protected]>
commit 636e348353a7cc52609fdba5ff3270065da140d5 upstream.
Somehow PR_GET_AUXV got added into PR_MCE_KILL's switch when the patch was applied [1].
Thus move it out of the switch, to the place the patch added it.
In the recently released v6.4 kernel some user could, in principle, be already using this feature by mapping the right page and passing the PR_GET_AUXV constant as a pointer:
prctl(PR_MCE_KILL, PR_GET_AUXV, ...)
So this does change the behavior for users. We could keep the bug since the other subcases in PR_MCE_KILL (PR_MCE_KILL_CLEAR and PR_MCE_KILL_SET) do not overlap.
However, v6.4 may be recent enough (2 weeks old) that moving the lines (rather than just adding a new case) does not break anybody? Moreover, the documentation in man-pages was just committed today [2].
--- kernel/sys.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
kernel/sys.c +5 -5
@@ -2529,11 +2529,6 @@ SYSCALL_DEFINE5(prctl, int, option, unsielse return -EINVAL ;break ; -case PR_GET_AUXV : -if (arg4 || arg5) -return -EINVAL ; - error =prctl_get_auxv ((void __user *)arg2, arg3); -break ;default :return -EINVAL ; }
@@ -2688,6 +2683,11 @@ SYSCALL_DEFINE5(prctl, int, option, unsicase PR_SET_VMA : error =prctl_set_vma (arg2, arg3, arg4, arg5);break ; +case PR_GET_AUXV : +if (arg4 || arg5) +return -EINVAL ; + error =prctl_get_auxv ((void __user *)arg2, arg3); +break ;#ifdef CONFIG_KSM case PR_SET_MEMORY_MERGE :if (arg3 || arg4 || arg5)
Greg Kroah-Hartman
maintainerPATCH 12/227 perf probe: Add test for regression introduced by switch to die_get_decl_file()
In reply to Greg Kroah-HartmanFrom: Georg Müller <[email protected]>
commit 56cbeacf143530576905623ac72ae0964f3293a6 upstream.
This patch adds a test to validate that 'perf probe' works for binaries where DWARF info is split into multiple CUs
--- tools/perf/tests/shell/test_uprobe_from_different_cu.sh | 77 ++++++++++++++++ 1 file changed, 77 insertions(+) create mode 100755 tools/perf/tests/shell/test_uprobe_from_different_cu.sh
tools/perf/tests/shell/test_uprobe_from_different_cu.sh new file +77 -0
@@ -0,0 +1,77 @@ +#!/bin/bash +# test perf probe of function from different CU +# SPDX-License-Identifier: GPL-2.0 + +set -e + +temp_dir=$(mktemp -d /tmp/perf-uprobe-different-cu-sh.XXXXXXXXXX) + +cleanup() +{ + trap - EXIT TERM INT + if [[ "${temp_dir}" =~ ^/tmp/perf-uprobe-different-cu-sh.*$ ]]; then + echo "--- Cleaning up ---" + perf probe -x ${temp_dir}/testfile -d foo + rm -f "${temp_dir}/"* + rmdir "${temp_dir}" + fi +} + +trap_cleanup() +{ + cleanup + exit 1 +} + +trap trap_cleanup EXIT TERM INT + +cat > ${temp_dir}/testfile-foo.h << EOF +struct t +{ + int *p; + int c; +}; + +extern int foo (int i, struct t *t); +EOF + +cat > ${temp_dir}/testfile-foo.c << EOF +#include "testfile-foo.h" + +int +foo (int i, struct t *t) +{ + int j, res = 0; + for (j = 0; j < i && j < t->c; j++) + res += t->p[j]; + + return res; +} +EOF + +cat > ${temp_dir}/testfile-main.c << EOF +#include "testfile-foo.h" + +static struct t g; + +int +main (int argc, char **argv) +{ + int i; + int j[argc]; + g.c = argc; + g.p = j; + for (i = 0; i < argc; i++) + j[i] = (int) argv[i][0]; + return foo (3, &g); +} +EOF + +gcc -g -Og -flto -c ${temp_dir}/testfile-foo.c -o ${temp_dir}/testfile-foo.o +gcc -g -Og -c ${temp_dir}/testfile-main.c -o ${temp_dir}/testfile-main.o +gcc -g -Og -o ${temp_dir}/testfile ${temp_dir}/testfile-foo.o ${temp_dir}/testfile-main.o + +perf probe -x ${temp_dir}/testfile --funcs foo +perf probe -x ${temp_dir}/testfile foo + +cleanup
Greg Kroah-Hartman
maintainerPATCH 13/227 perf probe: Read DWARF files from the correct CU
In reply to Greg Kroah-HartmanFrom: Georg Müller <[email protected]>
commit c66e1c68c13b872505f25ab641c44b77313ee7fe upstream.
After switching from dwarf_decl_file() to die_get_decl_file(), it is not possible to add probes for certain functions:
$ perf probe -x /usr/lib/systemd/systemd-logind match_unit_removed
A function DIE doesn't have decl_line. Maybe broken DWARF?
A function DIE doesn't have decl_line. Maybe broken DWARF?
Probe point 'match_unit_removed' not found.
Error: Failed to add events.The problem is that die_get_decl_file() uses the wrong CU to search for the file. elfutils commit e1db5cdc9f has some good explanation for this:
dwarf_decl_file uses dwarf_attr_integrate to get the DW_AT_decl_file attribute. This means the attribute might come from a different DIE in a different CU. If so, we need to use the CU associated with the attribute, not the original DIE, to resolve the file name.
This patch uses the same source of information as elfutils: use attribute DW_AT_decl_file and use this CU to search for the file.
--- tools/perf/util/dwarf-aux.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
tools/perf/util/dwarf-aux.c +3 -1
@@ -478,8 +478,10 @@ static const char *die_get_file_name(Dwa {Dwarf_Die cu_die;Dwarf_Files *files; +Dwarf_Attribute attr_mem; -if (idx <0 || !dwarf_diecu (dw_die, &cu_die,NULL ,NULL ) || +if (idx <0 || !dwarf_attr_integrate (dw_die, DW_AT_decl_file, &attr_mem) || + !dwarf_cu_die (attr_mem.cu, &cu_die,NULL ,NULL ,NULL ,NULL ,NULL ,NULL ) ||dwarf_getsrcfiles (&cu_die, &files,NULL ) !=0 )return NULL ;
Greg Kroah-Hartman
maintainerPATCH 14/227 btrfs: fix iput() on error pointer after error during orphan cleanup
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit cbaee87f2ef628c10331b69a2f3def6bc32402d7 upstream.
At btrfs_orphan_cleanup(), if we can't find an inode (btrfs_iget() returns an -ENOENT error pointer), we proceed with 'ret' set to -ENOENT and the inode pointer set to ERR_PTR(-ENOENT). Later when we proceed to the body of the following if statement:
if (ret == -ENOENT || inode->i_nlink) {
(...)
trans = btrfs_start_transaction(root, 1);
if (IS_ERR(trans)) {
ret = PTR_ERR(trans);
iput(inode);
goto out;
}
(...)
ret = btrfs_del_orphan_item(trans, root,
found_key.objectid);
btrfs_end_transaction(trans);
if (ret) {
iput(inode);
goto out;
}
continue;
}If we get an error from btrfs_start_transaction() or from the call to btrfs_del_orphan_item() we end calling iput() against an inode pointer that has a value of ERR_PTR(-ENOENT), resulting in a crash with the following trace:
[876.667] BUG: kernel NULL pointer dereference, address: 0000000000000096 [876.667] #PF: supervisor read access in kernel mode [876.667] #PF: error_code(0x0000) - not-present page [876.667] PGD 0 P4D 0 [876.668] Oops: 0000 [#1] PREEMPT SMP PTI [876.668] CPU: 0 PID: 2356187 Comm: mount Tainted: G W 6.4.0-rc6-btrfs-next-134+ #1 [876.668] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [876.668] RIP: 0010:iput+0xa/0x20 [876.668] Code: ff ff ff 66 (...) [876.669] RSP: 0018:ffffafa9c0c9f9d0 EFLAGS: 00010282 [876.669] RAX: ffffffffffffffe4 RBX: 000000000009453b RCX: 0000000000000000 [876.669] RDX: 0000000000000001 RSI: ffffafa9c0c9f930 RDI: fffffffffffffffe [876.669] RBP: ffff95c612f3b800 R08: 0000000000000001 R09: ffffffffffffffe4 [876.670] R10: 00018f2a71010000 R11: 000000000ead96e3 R12: ffff95cb7d6909a0 [876.670] R13: fffffffffffffffe R14: ffff95c60f477000 R15: 00000000ffffffe4 [876.670] FS: 00007f5fbe30a840(0000) GS:ffff95ccdfa00000(0000) knlGS:0000000000000000 [876.670] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [876.671] CR2: 0000000000000096 CR3: 000000055e9f6004 CR4: 0000000000370ef0 [876.671] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [876.671] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [876.672] Call Trace: [876.744] <TASK> [876.744] ? __die_body+0x1b/0x60 [876.744] ? page_fault_oops+0x15d/0x450 [876.745] ? __kmem_cache_alloc_node+0x47/0x410 [876.745] ? do_user_addr_fault+0x65/0x8a0 [876.745] ? exc_page_fault+0x74/0x170 [876.746] ? asm_exc_page_fault+0x22/0x30 [876.746] ? iput+0xa/0x20 [876.746] btrfs_orphan_cleanup+0x221/0x330 [btrfs] [876.746] btrfs_lookup_dentry+0x58f/0x5f0 [btrfs] [876.747] btrfs_lookup+0xe/0x30 [btrfs] [876.747] __lookup_slow+0x82/0x130 [876.785] walk_component+0xe5/0x160 [876.786] path_lookupat.isra.0+0x6e/0x150 [876.786] filename_lookup+0xcf/0x1a0 [876.786] ? mod_objcg_state+0xd2/0x360 [876.786] ? obj_cgroup_charge+0xf5/0x110 [876.787] ? should_failslab+0xa/0x20 [876.787] ? kmem_cache_alloc+0x47/0x450 [876.787] vfs_path_lookup+0x51/0x90 [876.788] mount_subtree+0x8d/0x130 [876.788] btrfs_mount+0x149/0x410 [btrfs] [876.788] ? __kmem_cache_alloc_node+0x47/0x410 [876.788] ? vfs_parse_fs_param+0xc0/0x110 [876.789] legacy_get_tree+0x24/0x50 [876.834] vfs_get_tree+0x22/0xd0 [876.852] path_mount+0x2d8/0x9c0 [876.852] do_mount+0x79/0x90 [876.852] __x64_sys_mount+0x8e/0xd0 [876.853] do_syscall_64+0x38/0x90 [876.899] entry_SYSCALL_64_after_hwframe+0x72/0xdc [876.958] RIP: 0033:0x7f5fbe50b76a [876.959] Code: 48 8b 0d a9 (...) [876.959] RSP: 002b:00007fff01925798 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [876.959] RAX: ffffffffffffffda RBX: 00007f5fbe694264 RCX: 00007f5fbe50b76a [876.960] RDX: 0000561bde6c8720 RSI: 0000561bde6bdec0 RDI: 0000561bde6c31a0 [876.960] RBP: 0000561bde6bdc70 R08: 0000000000000000 R09: 0000000000000001 [876.960] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [876.960] R13: 0000561bde6c31a0 R14: 0000561bde6c8720 R15: 0000561bde6bdc70 [876.960] </TASK>
So fix this by setting 'inode' to NULL whenever we get an error from btrfs_iget(), and to make the code simpler, stop testing for 'ret' being -ENOENT to check if we have an inode - instead test for 'inode' being NULL or not. Having a NULL 'inode' prevents any iput() call from crashing, as iput() ignores NULL inode pointers. Also, stop testing for a NULL return value from btrfs_iget() with PTR_ERR_OR_ZERO(), because btrfs_iget() never returns NULL - in case an inode is not found, it returns ERR_PTR(-ENOENT), and in case of memory allocation failure, it returns ERR_PTR(-ENOMEM). We also don't need the extra iput() calls on the error branches for the btrfs_start_transaction() and btrfs_del_orphan_item() calls, as we have already called iput() before, so remove them.
--- fs/btrfs/inode.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
fs/btrfs/inode.c +10 -10
@@ -3546,11 +3546,14 @@ int btrfs_orphan_cleanup(struct btrfs_ro found_key.type =BTRFS_INODE_ITEM_KEY ; found_key.offset =0 ; inode =btrfs_iget (fs_info->sb, last_objectid, root); - ret =PTR_ERR_OR_ZERO (inode); -if (ret && ret != -ENOENT ) - goto out; +if (IS_ERR (inode)) { + ret =PTR_ERR (inode); + inode =NULL ; +if (ret != -ENOENT ) + goto out; + } -if (ret == -ENOENT && root == fs_info->tree_root) { +if (!inode && root == fs_info->tree_root) {struct btrfs_root *dead_root;int is_dead_root =0 ;
@@ -3611,8 +3614,8 @@ int btrfs_orphan_cleanup(struct btrfs_ro* deleted but wasn't. The inode number may have been reused, * but either way, we can delete the orphan item. */ -if (ret == -ENOENT || inode->i_nlink) { -if (!ret) { +if (!inode || inode->i_nlink) { +if (inode) { ret =btrfs_drop_verity_items (BTRFS_I (inode));iput (inode);if (ret)
@@ -3621,7 +3624,6 @@ int btrfs_orphan_cleanup(struct btrfs_ro trans =btrfs_start_transaction (root,1 );if (IS_ERR (trans)) { ret =PTR_ERR (trans); -iput (inode); goto out; } btrfs_debug(fs_info, "auto deleting %Lu",
@@ -3629,10 +3631,8 @@ int btrfs_orphan_cleanup(struct btrfs_ro ret =btrfs_del_orphan_item (trans, root, found_key.objectid);btrfs_end_transaction (trans); -if (ret) { -iput (inode); +if (ret) goto out; - }continue ; }
Greg Kroah-Hartman
maintainerPATCH 15/227 btrfs: fix warning when putting transaction with qgroups enabled after abort
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit aa84ce8a78a1a5c10cdf9c7a5fb0c999fbc2c8d6 upstream.
If we have a transaction abort with qgroups enabled we get a warning triggered when doing the final put on the transaction, like this:
[552.6789] ------------[ cut here ]------------ [552.6815] WARNING: CPU: 4 PID: 81745 at fs/btrfs/transaction.c:144 btrfs_put_transaction+0x123/0x130 [btrfs] [552.6817] Modules linked in: btrfs blake2b_generic xor (...) [552.6819] CPU: 4 PID: 81745 Comm: btrfs-transacti Tainted: G W 6.4.0-rc6-btrfs-next-134+ #1 [552.6819] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [552.6819] RIP: 0010:btrfs_put_transaction+0x123/0x130 [btrfs] [552.6821] Code: bd a0 01 00 (...) [552.6821] RSP: 0018:ffffa168c0527e28 EFLAGS: 00010286 [552.6821] RAX: ffff936042caed00 RBX: ffff93604a3eb448 RCX: 0000000000000000 [552.6821] RDX: ffff93606421b028 RSI: ffffffff92ff0878 RDI: ffff93606421b010 [552.6821] RBP: ffff93606421b000 R08: 0000000000000000 R09: ffffa168c0d07c20 [552.6821] R10: 0000000000000000 R11: ffff93608dc52950 R12: ffffa168c0527e70 [552.6821] R13: ffff93606421b000 R14: ffff93604a3eb420 R15: ffff93606421b028 [552.6821] FS: 0000000000000000(0000) GS:ffff93675fb00000(0000) knlGS:0000000000000000 [552.6821] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [552.6821] CR2: 0000558ad262b000 CR3: 000000014feda005 CR4: 0000000000370ee0 [552.6822] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [552.6822] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [552.6822] Call Trace: [552.6822] <TASK> [552.6822] ? __warn+0x80/0x130 [552.6822] ? btrfs_put_transaction+0x123/0x130 [btrfs] [552.6824] ? report_bug+0x1f4/0x200 [552.6824] ? handle_bug+0x42/0x70 [552.6824] ? exc_invalid_op+0x14/0x70 [552.6824] ? asm_exc_invalid_op+0x16/0x20 [552.6824] ? btrfs_put_transaction+0x123/0x130 [btrfs] [552.6826] btrfs_cleanup_transaction+0xe7/0x5e0 [btrfs] [552.6828] ? _raw_spin_unlock_irqrestore+0x23/0x40 [552.6828] ? try_to_wake_up+0x94/0x5e0 [552.6828] ? __pfx_process_timeout+0x10/0x10 [552.6828] transaction_kthread+0x103/0x1d0 [btrfs] [552.6830] ? __pfx_transaction_kthread+0x10/0x10 [btrfs] [552.6832] kthread+0xee/0x120 [552.6832] ? __pfx_kthread+0x10/0x10 [552.6832] ret_from_fork+0x29/0x50 [552.6832] </TASK> [552.6832] ---[ end trace 0000000000000000 ]---
This corresponds to this line of code:
void btrfs_put_transaction(struct btrfs_transaction *transaction)
{
(...)
WARN_ON(!RB_EMPTY_ROOT(
&transaction->delayed_refs.dirty_extent_root));
(...)
}The warning happens because btrfs_qgroup_destroy_extent_records(), called in the transaction abort path, we free all entries from the rbtree "dirty_extent_root" with rbtree_postorder_for_each_entry_safe(), but we don't actually empty the rbtree - it's still pointing to nodes that were freed.
So set the rbtree's root node to NULL to avoid this warning (assign RB_ROOT).
--- fs/btrfs/qgroup.c | 1 + 1 file changed, 1 insertion(+)
fs/btrfs/qgroup.c +1 -0
@@ -4433,4 +4433,5 @@ void btrfs_qgroup_destroy_extent_recordsulist_free (entry->old_roots);kfree (entry); } + *root =RB_ROOT ; }
Greg Kroah-Hartman
maintainerPATCH 16/227 fuse: revalidate: dont invalidate if interrupted
In reply to Greg Kroah-HartmanFrom: Miklos Szeredi <[email protected]>
commit a9d1c4c6df0e568207907c04aed9e7beb1294c42 upstream.
If the LOOKUP request triggered from fuse_dentry_revalidate() is interrupted, then the dentry will be invalidated, possibly resulting in submounts being unmounted.
--- fs/fuse/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/fuse/dir.c +1 -1
@@ -258,7 +258,7 @@ static int fuse_dentry_revalidate(structspin_unlock (&fi->lock); }kfree (forget); -if (ret == -ENOMEM ) +if (ret == -ENOMEM || ret == -EINTR ) goto out;if (ret ||fuse_invalid_attr (&outarg.attr) ||fuse_stale_inode (inode, outarg.generation, &outarg.attr))
Greg Kroah-Hartman
maintainerPATCH 17/227 fuse: add feature flag for expire-only
In reply to Greg Kroah-HartmanFrom: Miklos Szeredi <[email protected]>
commit 5cadfbd5a11e5495cac217534c5f788168b1afd7 upstream.
Add an init flag idicating whether the FUSE_EXPIRE_ONLY flag of FUSE_NOTIFY_INVAL_ENTRY is effective.
This is needed for backports of this feature, otherwise the server could just check the protocol version.
--- fs/fuse/inode.c | 3 ++- include/uapi/linux/fuse.h | 3 +++ 2 files changed, 5 insertions(+), 1 deletion(-)
fs/fuse/inode.c +2 -1
@@ -1254,7 +1254,8 @@ void fuse_send_init(struct fuse_mount *fFUSE_ABORT_ERROR |FUSE_MAX_PAGES |FUSE_CACHE_SYMLINKS |FUSE_NO_OPENDIR_SUPPORT |FUSE_EXPLICIT_INVAL_DATA |FUSE_HANDLE_KILLPRIV_V2 |FUSE_SETXATTR_EXT |FUSE_INIT_EXT | -FUSE_SECURITY_CTX |FUSE_CREATE_SUPP_GROUP ; +FUSE_SECURITY_CTX |FUSE_CREATE_SUPP_GROUP | +FUSE_HAS_EXPIRE_ONLY ;#ifdef CONFIG_FUSE_DAX if (fm->fc->dax) flags |=FUSE_MAP_ALIGNMENT ;
include/uapi/linux/fuse.h +3 -0
@@ -206,6 +206,7 @@* - add extension header * - add FUSE_EXT_GROUPS * - add FUSE_CREATE_SUPP_GROUP +* - add FUSE_HAS_EXPIRE_ONLY */ #ifndef _LINUX_FUSE_H
@@ -369,6 +370,7 @@ struct fuse_file_lock {* FUSE_HAS_INODE_DAX: use per inode DAX * FUSE_CREATE_SUPP_GROUP: add supplementary group info to create, mkdir, * symlink and mknod (single group that matches parent) +* FUSE_HAS_EXPIRE_ONLY: kernel supports expiry-only entry invalidation */ #define FUSE_ASYNC_READ (1 << 0)#define FUSE_POSIX_LOCKS (1 << 1)
@@ -406,6 +408,7 @@ struct fuse_file_lock {#define FUSE_SECURITY_CTX (1ULL << 32)#define FUSE_HAS_INODE_DAX (1ULL << 33)#define FUSE_CREATE_SUPP_GROUP (1ULL << 34) +#define FUSE_HAS_EXPIRE_ONLY (1ULL << 35)/** * CUSE INIT request/reply flags
Greg Kroah-Hartman
maintainerPATCH 18/227 fuse: Apply flags2 only when userspace set the FUSE_INIT_EXT
In reply to Greg Kroah-HartmanFrom: Bernd Schubert <[email protected]>
commit 3066ff93476c35679cb07a97cce37d9bb07632ff upstream.
This is just a safety precaution to avoid checking flags on memory that was initialized on the user space side. libfuse zeroes struct fuse_init_out outarg, but this is not guranteed to be done in all implementations. Better is to act on flags and to only apply flags2 when FUSE_INIT_EXT is set.
There is a risk with this change, though - it might break existing user space libraries, which are already using flags2 without setting FUSE_INIT_EXT.
The corresponding libfuse patch is here
https://github.com/libfuse/libfuse/pull/662
--- fs/fuse/inode.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/fuse/inode.c +4 -1
@@ -1134,7 +1134,10 @@ static void process_init_reply(struct fuprocess_init_limits (fc, arg);if (arg->minor >=6 ) { -u64 flags = arg->flags | (u64 ) arg->flags2 <<32 ; +u64 flags = arg->flags; + +if (flags &FUSE_INIT_EXT ) + flags |= (u64 ) arg->flags2 <<32 ; ra_pages = arg->max_readahead /PAGE_SIZE ;if (flags &FUSE_ASYNC_READ )
Greg Kroah-Hartman
maintainerPATCH 19/227 btrfs: raid56: always verify the P/Q contents for scrub
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
commit 486c737f7fdc0c3f6464cf27ede811daec2769a1 upstream.
[REGRESSION]
Commit 75b470332965 ("btrfs: raid56: migrate recovery and scrub recovery path to use error_bitmap") changed the behavior of scrub_rbio().
Initially if we have no error reading the raid bio, we will assign @need_check to true, then finish_parity_scrub() would later verify the content of P/Q stripes before writeback.
But after that commit we never verify the content of P/Q stripes and just writeback them.
This can lead to unrepaired P/Q stripes during scrub, or already corrupted P/Q copied to the dev-replace target.
[FIX]
The situation is more complex than the regression, in fact the initial behavior is not 100% correct either.
If we have the following rare case, it can still lead to the same problem using the old behavior:
0 16K 32K 48K 64K Data 1: |IIIIIII| | Data 2: | | Parity: | |CCCCCCC| |
Where "I" means IO error, "C" means corruption.
In the above case, we're scrubbing the parity stripe, then read out all the contents of Data 1, Data 2, Parity stripes.
But found IO error in Data 1, which leads to rebuild using Data 2 and Parity and got the correct data.
In that case, we would not verify if the Parity is correct for range [16K, 32K).
So here we have to always verify the content of Parity no matter if we did recovery or not.
This patch would remove the @need_check parameter of finish_parity_scrub() completely, and would always do the P/Q verification before writeback.
--- fs/btrfs/raid56.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-)
fs/btrfs/raid56.c +3 -8
@@ -71,7 +71,7 @@ static void rmw_rbio_work_locked(structstatic void index_rbio_pages (struct btrfs_raid_bio *rbio);static int alloc_rbio_pages (struct btrfs_raid_bio *rbio); -static int finish_parity_scrub (struct btrfs_raid_bio *rbio,int need_check); +static int finish_parity_scrub (struct btrfs_raid_bio *rbio);static void scrub_rbio_work_locked (struct work_struct *work);static void free_raid_bio_pointers (struct btrfs_raid_bio *rbio)
@@ -2404,7 +2404,7 @@ static int alloc_rbio_essential_pages(streturn 0 ; } -static int finish_parity_scrub (struct btrfs_raid_bio *rbio,int need_check) +static int finish_parity_scrub (struct btrfs_raid_bio *rbio) {struct btrfs_io_context *bioc = rbio->bioc;const u32 sectorsize = bioc->fs_info->sectorsize;
@@ -2445,9 +2445,6 @@ static int finish_parity_scrub(struct bt*/ clear_bit (RBIO_CACHE_READY_BIT , &rbio->flags); -if (!need_check) - goto writeback; - p_sector.page =alloc_page (GFP_NOFS );if (!p_sector.page)return -ENOMEM ;
@@ -2516,7 +2513,6 @@ static int finish_parity_scrub(struct bt q_sector.page =NULL ; } -writeback:/* * time to start writing. Make bios for everything from the * higher layers (the bio_list in our rbio) and our p/q. Ignore
@@ -2699,7 +2695,6 @@ static int scrub_assemble_read_bios(strustatic void scrub_rbio (struct btrfs_raid_bio *rbio) { -bool need_check = false;int sector_nr;int ret;
@@ -2722,7 +2717,7 @@ static void scrub_rbio(struct btrfs_raid* We have every sector properly prepared. Can finish the scrub * and writeback the good content. */ - ret =finish_parity_scrub (rbio, need_check); + ret =finish_parity_scrub (rbio);wait_event (rbio->io_wait,atomic_read (&rbio->stripes_pending) ==0 );for (sector_nr =0 ; sector_nr < rbio->stripe_nsectors; sector_nr++) {int found_errors;
Greg Kroah-Hartman
maintainerPATCH 20/227 btrfs: set_page_extent_mapped after read_folio in btrfs_cont_expand
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit 17b17fcd6d446b95904a6929c40012ee7f0afc0c upstream.
While trying to get the subpage blocksize tests running, I hit the following panic on generic/476
assertion failed: PagePrivate(page) && page->private, in fs/btrfs/subpage.c:229 kernel BUG at fs/btrfs/subpage.c:229!
Internal error: Oops - BUG: 00000000f2000800 [#1] SMP CPU: 1 PID: 1453 Comm: fsstress Not tainted 6.4.0-rc7+ #12 Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20230301gitf80f052277c8-26.fc38 03/01/2023 pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : btrfs_subpage_assert+0xbc/0xf0 lr : btrfs_subpage_assert+0xbc/0xf0 Call trace: btrfs_subpage_assert+0xbc/0xf0 btrfs_subpage_clear_checked+0x38/0xc0 btrfs_page_clear_checked+0x48/0x98 btrfs_truncate_block+0x5d0/0x6a8 btrfs_cont_expand+0x5c/0x528 btrfs_write_check.isra.0+0xf8/0x150 btrfs_buffered_write+0xb4/0x760 btrfs_do_write_iter+0x2f8/0x4b0 btrfs_file_write_iter+0x1c/0x30 do_iter_readv_writev+0xc8/0x158 do_iter_write+0x9c/0x210 vfs_iter_write+0x24/0x40 iter_file_splice_write+0x224/0x390 direct_splice_actor+0x38/0x68 splice_direct_to_actor+0x12c/0x260 do_splice_direct+0x90/0xe8 generic_copy_file_range+0x50/0x90 vfs_copy_file_range+0x29c/0x470 __arm64_sys_copy_file_range+0xcc/0x498 invoke_syscall.constprop.0+0x80/0xd8 do_el0_svc+0x6c/0x168 el0_svc+0x50/0x1b0 el0t_64_sync_handler+0x114/0x120 el0t_64_sync+0x194/0x198
This happens because during btrfs_cont_expand we'll get a page, set it as mapped, and if it's not Uptodate we'll read it. However between the read and re-locking the page we could have called release_folio() on the page, but left the page in the file mapping. release_folio() can clear the page private, and thus further down we blow up when we go to modify the subpage bits.
Fix this by putting the set_page_extent_mapped() after the read. This is safe because read_folio() will call set_page_extent_mapped() before it does the read, and then if we clear page private but leave it on the mapping we're completely safe re-setting set_page_extent_mapped(). With this patch I can now run generic/476 without panicing.
--- fs/btrfs/inode.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
fs/btrfs/inode.c +11 -3
@@ -4734,9 +4734,6 @@ again: ret = -ENOMEM ; goto out; } - ret =set_page_extent_mapped (page); -if (ret <0 ) - goto out_unlock;if (!PageUptodate (page)) { ret =btrfs_read_folio (NULL ,page_folio (page));
@@ -4751,6 +4748,17 @@ again: goto out_unlock; } } + +/* +* We unlock the page after the io is completed and then re-lock it +* above. release_folio() could have come in between that and cleared +* PagePrivate(), but left the page in the mapping. Set the page mapped +* here to make sure it's properly set for the subpage stuff. +*/ + ret =set_page_extent_mapped (page); +if (ret <0 ) + goto out_unlock; +wait_on_page_writeback (page);lock_extent (io_tree, block_start, block_end, &cached_state);
Greg Kroah-Hartman
maintainerPATCH 21/227 btrfs: fix double iput() on inode after an error during orphan cleanup
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit b777d279ff31979add57e8a3f810bceb7ef0cfb7 upstream.
At btrfs_orphan_cleanup(), if we were able to find the inode, we do an iput() on the inode, then if btrfs_drop_verity_items() succeeds and then either btrfs_start_transaction() or btrfs_del_orphan_item() fail, we do another iput() in the respective error paths, resulting in an extra iput() on the inode.
Fix this by setting inode to NULL after the first iput(), as iput() ignores a NULL inode pointer argument.
--- fs/btrfs/inode.c | 1 + 1 file changed, 1 insertion(+)
fs/btrfs/inode.c +1 -0
@@ -3618,6 +3618,7 @@ int btrfs_orphan_cleanup(struct btrfs_roif (inode) { ret =btrfs_drop_verity_items (BTRFS_I (inode));iput (inode); + inode =NULL ;if (ret) goto out; }
Greg Kroah-Hartman
maintainerPATCH 22/227 btrfs: zoned: fix memory leak after finding block group with super blocks
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit f1a07c2b4e2c473ec322b8b9ece071b8c88a3512 upstream.
At exclude_super_stripes(), if we happen to find a block group that has super blocks mapped to it and we are on a zoned filesystem, we error out as this is not supposed to happen, indicating either a bug or maybe some memory corruption for example. However we are exiting the function without freeing the memory allocated for the logical address of the super blocks. Fix this by freeing the logical address.
--- fs/btrfs/block-group.c | 1 + 1 file changed, 1 insertion(+)
fs/btrfs/block-group.c +1 -0
@@ -2084,6 +2084,7 @@ static int exclude_super_stripes(struct/* Shouldn't have super stripes in sequential zones */ if (zoned && nr) { +kfree (logical);btrfs_err (fs_info,"zoned: block group %llu must not contain super block" , cache->start);
Greg Kroah-Hartman
maintainerPATCH 23/227 fuse: ioctl: translate ENOSYS in outarg
In reply to Greg Kroah-HartmanFrom: Miklos Szeredi <[email protected]>
commit 6a567e920fd0451bf29abc418df96c3365925770 upstream.
Fuse shouldn't return ENOSYS from its ioctl implementation. If userspace responds with ENOSYS it should be translated to ENOTTY.
There are two ways to return an error from the IOCTL request:
- fuse_out_header.error
- fuse_ioctl_out.result
Commit 02c0cab8e734 ("fuse: ioctl: translate ENOSYS") already fixed this issue for the first case, but missed the second case. This patch fixes the second case.
--- fs/fuse/ioctl.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-)
fs/fuse/ioctl.c +13 -8
@@ -9,14 +9,23 @@#include <linux/compat.h> #include <linux/fileattr.h> -static ssize_t fuse_send_ioctl (struct fuse_mount *fm,struct fuse_args *args) +static ssize_t fuse_send_ioctl (struct fuse_mount *fm,struct fuse_args *args, +struct fuse_ioctl_out *outarg) { -ssize_t ret =fuse_simple_request (fm, args); +ssize_t ret; + + args->out_args[0 ].size =sizeof (*outarg); + args->out_args[0 ].value = outarg; + + ret =fuse_simple_request (fm, args);/* Translate ENOSYS, which shouldn't be returned from fs */ if (ret == -ENOSYS ) ret = -ENOTTY ; +if (ret >=0 && outarg->result == -ENOSYS ) + outarg->result = -ENOTTY ; +return ret; }
@@ -264,13 +273,11 @@ long fuse_do_ioctl(struct file *file, un } ap.args.out_numargs =2 ; - ap.args.out_args[0 ].size =sizeof (outarg); - ap.args.out_args[0 ].value = &outarg; ap.args.out_args[1 ].size = out_size; ap.args.out_pages = true; ap.args.out_argvar = true; - transferred =fuse_send_ioctl (fm, &ap.args); + transferred =fuse_send_ioctl (fm, &ap.args, &outarg); err = transferred;if (transferred <0 ) goto out;
@@ -399,12 +406,10 @@ static int fuse_priv_ioctl(struct inode args.in_args[1 ].size = inarg.in_size; args.in_args[1 ].value = ptr; args.out_numargs =2 ; - args.out_args[0 ].size =sizeof (outarg); - args.out_args[0 ].value = &outarg; args.out_args[1 ].size = inarg.out_size; args.out_args[1 ].value = ptr; - err =fuse_send_ioctl (fm, &args); + err =fuse_send_ioctl (fm, &args, &outarg);if (!err) {if (outarg.result <0 ) err = outarg.result;
Greg Kroah-Hartman
maintainerPATCH 24/227 btrfs: fix race between balance and cancel/pause
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit b19c98f237cd76981aaded52c258ce93f7daa8cb upstream.
Syzbot reported a panic that looks like this:
assertion failed: fs_info->exclusive_operation == BTRFS_EXCLOP_BALANCE_PAUSED, in fs/btrfs/ioctl.c:465
------------[ cut here ]------------ kernel BUG at fs/btrfs/messages.c:259! RIP: 0010:btrfs_assertfail+0x2c/0x30 fs/btrfs/messages.c:259 Call Trace: <TASK> btrfs_exclop_balance fs/btrfs/ioctl.c:465 [inline] btrfs_ioctl_balance fs/btrfs/ioctl.c:3564 [inline] btrfs_ioctl+0x531e/0x5b30 fs/btrfs/ioctl.c:4632 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x197/0x210 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
The reproducer is running a balance and a cancel or pause in parallel. The way balance finishes is a bit wonky, if we were paused we need to save the balance_ctl in the fs_info, but clear it otherwise and cleanup. However we rely on the return values being specific errors, or having a cancel request or no pause request. If balance completes and returns 0, but we have a pause or cancel request we won't do the appropriate cleanup, and then the next time we try to start a balance we'll trip this ASSERT.
The error handling is just wrong here, we always want to clean up, unless we got -ECANCELLED and we set the appropriate pause flag in the exclusive op. With this patch the reproducer ran for an hour without tripping, previously it would trip in less than a few minutes.
--- fs/btrfs/volumes.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-)
fs/btrfs/volumes.c +4 -10
@@ -4071,14 +4071,6 @@ static int alloc_profile_is_valid(u64 flreturn has_single_bit_set (flags); } -static inline int balance_need_close (struct btrfs_fs_info *fs_info) -{ -/* cancel requested || normal exit path */ -return atomic_read (&fs_info->balance_cancel_req) || - (atomic_read (&fs_info->balance_pause_req) ==0 && -atomic_read (&fs_info->balance_cancel_req) ==0 ); -} -/* * Validate target profile against allowed profiles and return true if it's OK. * Otherwise print the error message and return false.
@@ -4268,6 +4260,7 @@ int btrfs_balance(struct btrfs_fs_info *u64 num_devices;unsigned seq;bool reducing_redundancy; +bool paused = false;int i; if (btrfs_fs_closing(fs_info) ||
@@ -4398,6 +4391,7 @@ int btrfs_balance(struct btrfs_fs_info *if (ret == -ECANCELED &&atomic_read (&fs_info->balance_pause_req)) {btrfs_info (fs_info,"balance: paused" );btrfs_exclop_balance (fs_info,BTRFS_EXCLOP_BALANCE_PAUSED ); + paused = true; }/* * Balance can be canceled by:
@@ -4426,8 +4420,8 @@ int btrfs_balance(struct btrfs_fs_info *btrfs_update_ioctl_balance_args (fs_info, bargs); } -if ((ret && ret != -ECANCELED && ret != -ENOSPC ) || -balance_need_close (fs_info)) { +/* We didn't pause, we can clean everything up. */ +if (!paused) {reset_balance_state (fs_info);btrfs_exclop_finish (fs_info); }
Greg Kroah-Hartman
maintainerPATCH 25/227 selftests: tc: set timeout to 15 minutes
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit fda05798c22a354efde09a76bdfc276b2d591829 upstream.
When looking for something else in LKFT reports [1], I noticed that the TC selftest ended with a timeout error:
not ok 1 selftests: tc-testing: tdc.sh # TIMEOUT 45 seconds
The timeout had been introduced 3 years ago, see the Fixes commit below.
This timeout is only in place when executing the selftests via the kselftests runner scripts. I guess this is not what most TC devs are using and nobody noticed the issue before.
The new timeout is set to 15 minutes as suggested by Pedro [2]. It looks like it is plenty more time than what it takes in "normal" conditions.
--- tools/testing/selftests/tc-testing/settings | 1 + 1 file changed, 1 insertion(+) create mode 100644 tools/testing/selftests/tc-testing/settings
tools/testing/selftests/tc-testing/settings new file +1 -0
@@ -0,0 +1 @@ +timeout=900
Greg Kroah-Hartman
maintainerPATCH 26/227 accel/qaic: Fix a leak in map_user_pages()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit 73274c33d961f4aa0f968f763e2c9f4210b4f4a3 upstream.
If get_user_pages_fast() allocates some pages but not as many as we wanted, then the current code leaks those pages. Call put_page() on the pages before returning.
--- drivers/accel/qaic/qaic_control.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/accel/qaic/qaic_control.c +5 -2
@@ -418,9 +418,12 @@ static int find_and_map_user_pages(struc } ret =get_user_pages_fast (xfer_start_addr, nr_pages,0 , page_list); -if (ret <0 || ret != nr_pages) { - ret = -EFAULT ; +if (ret <0 ) goto free_page_list; +if (ret != nr_pages) { + nr_pages = ret; + ret = -EFAULT ; + goto put_pages; } sgt =kmalloc (sizeof (*sgt),GFP_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 27/227 selftests: tc: add ct action kconfig dep
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit 719b4774a8cb1a501e2d22a5a4a3a0a870e427d5 upstream.
When looking for something else in LKFT reports [1], I noticed most of the tests were skipped because the "teardown stage" did not complete successfully.
Pedro found out this is due to the fact CONFIG_NF_FLOW_TABLE is required but not listed in the 'config' file. Adding it to the list fixes the issues on LKFT side. CONFIG_NET_ACT_CT is now set to 'm' in the final kconfig.
--- tools/testing/selftests/tc-testing/config | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/tc-testing/config +1 -0
@@ -5,6 +5,7 @@ CONFIG_NF_CONNTRACK=m CONFIG_NF_CONNTRACK_MARK=y CONFIG_NF_CONNTRACK_ZONES=y CONFIG_NF_CONNTRACK_LABELS=y +CONFIG_NF_FLOW_TABLE=m CONFIG_NF_NAT=m CONFIG_NETFILTER_XT_TARGET_LOG=m
Greg Kroah-Hartman
maintainerPATCH 28/227 regmap: Drop initial version of maximum transfer length fixes
In reply to Greg Kroah-HartmanFrom: Mark Brown <[email protected]>
commit bc64734825c59e18a27ac266b07e14944c111fd8 upstream.
When problems were noticed with the register address not being taken into account when limiting raw transfers with I2C devices we fixed this in the core. Unfortunately it has subsequently been realised that a lot of buses were relying on the prior behaviour, partly due to unclear documentation not making it obvious what was intended in the core. This is all more involved to fix than is sensible for a fix commit so let's just drop the original fixes, a separate commit will fix the originally observed problem in an I2C specific way
--- drivers/base/regmap/regmap-spi-avmm.c | 2 +- drivers/base/regmap/regmap.c | 6 ++---- 2 files changed, 3 insertions(+), 5 deletions(-)
drivers/base/regmap/regmap-spi-avmm.c +1 -1
@@ -660,7 +660,7 @@ static const struct regmap_bus regmap_sp .reg_format_endian_default = REGMAP_ENDIAN_NATIVE, .val_format_endian_default = REGMAP_ENDIAN_NATIVE, .max_raw_read = SPI_AVMM_VAL_SIZE * MAX_READ_CNT, - .max_raw_write = SPI_AVMM_REG_SIZE + SPI_AVMM_VAL_SIZE * MAX_WRITE_CNT, + .max_raw_write = SPI_AVMM_VAL_SIZE * MAX_WRITE_CNT, .free_context = spi_avmm_bridge_ctx_free, };
drivers/base/regmap/regmap.c +2 -4
@@ -2082,8 +2082,6 @@ int _regmap_raw_write(struct regmap *mapsize_t val_count = val_len / val_bytes;size_t chunk_count, chunk_bytes;size_t chunk_regs = val_count; -size_t max_data = map->max_raw_write - map->format.reg_bytes - - map->format.pad_bytes;int ret, i;if (!val_count)
@@ -2091,8 +2089,8 @@ int _regmap_raw_write(struct regmap *mapif (map->use_single_write) chunk_regs =1 ; -else if (map->max_raw_write && val_len > max_data) - chunk_regs = max_data / val_bytes; +else if (map->max_raw_write && val_len > map->max_raw_write) + chunk_regs = map->max_raw_write / val_bytes; chunk_count = val_count / chunk_regs; chunk_bytes = chunk_regs * val_bytes;
Greg Kroah-Hartman
maintainerPATCH 29/227 s390/zcrypt: fix reply buffer calculations for CCA replies
In reply to Greg Kroah-HartmanFrom: Harald Freudenberger <[email protected]>
commit 4cfca532ddc3474b3fc42592d0e4237544344b1a upstream.
The length information for available buffer space for CCA replies is covered with two fields in the T6 header prepended on each CCA reply: fromcardlen1 and fromcardlen2. The sum of these both values must not exceed the AP bus limit for this card (24KB for CEX8, 12KB CEX7 and older) minus the always present headers.
The current code adjusted the fromcardlen2 value in case of exceeding the AP bus limit when there was a non-zero value given from userspace. Some tests now showed that this was the wrong assumption. Instead the userspace value given for this field should always be trusted and if the sum of the two fields exceeds the AP bus limit for this card the first field fromcardlen1 should be adjusted instead.
So now the calculation is done with this new insight in mind. Also some additional checks for overflow have been introduced and some comments to provide some documentation for future maintainers of this complicated calculation code.
Furthermore the 128 bytes of fix overhead which is used in the current code is not correct. Investigations showed that for a reply always the same two header structs are prepended before a possible payload. So this is also fixed with this patch.
--- drivers/s390/crypto/zcrypt_msgtype6.c | 33 +++++++++++++++++++++++---------- 1 file changed, 23 insertions(+), 10 deletions(-)
drivers/s390/crypto/zcrypt_msgtype6.c +23 -10
@@ -1111,23 +1111,36 @@ static long zcrypt_msgtype6_send_cprb(bostruct ica_xcRB *xcrb, struct ap_message *ap_msg) { - int rc; struct response_type *rtype = ap_msg->private;struct {struct type6_hdr hdr;struct CPRBX cprbx;/* ... more data blocks ... */ } __packed * msg = ap_msg->msg; +unsigned int max_payload_size; +int rc, delta; -/* -* Set the queue's reply buffer length minus 128 byte padding -* as reply limit for the card firmware. -*/ - msg->hdr.fromcardlen1 = min_t(unsigned int, msg->hdr.fromcardlen1, - zq->reply.bufsize -128 ); -if (msg->hdr.fromcardlen2) - msg->hdr.fromcardlen2 = - zq->reply.bufsize - msg->hdr.fromcardlen1 -128 ; +/* calculate maximum payload for this card and msg type */ + max_payload_size = zq->reply.bufsize -sizeof (struct type86_fmt2_msg ); + +/* limit each of the two from fields to the maximum payload size */ + msg->hdr.fromcardlen1 =min (msg->hdr.fromcardlen1, max_payload_size); + msg->hdr.fromcardlen2 =min (msg->hdr.fromcardlen2, max_payload_size); + +/* calculate delta if the sum of both exceeds max payload size */ + delta = msg->hdr.fromcardlen1 + msg->hdr.fromcardlen2 + - max_payload_size; +if (delta >0 ) { +/* +* Sum exceeds maximum payload size, prune fromcardlen1 +* (always trust fromcardlen2) +*/ +if (delta > msg->hdr.fromcardlen1) { + rc = -EINVAL ; + goto out; + } + msg->hdr.fromcardlen1 -= delta; + }init_completion (&rtype->work); rc =ap_queue_message (zq->queue, ap_msg);
Greg Kroah-Hartman
maintainerPATCH 30/227 of: Preserve "of-display" device name for compatibility
In reply to Greg Kroah-HartmanFrom: Rob Herring <[email protected]>
commit 0bb8f49cd2cc8cb32ac51189ff9fcbe7ec3d9d65 upstream.
Since commit 241d2fb56a18 ("of: Make OF framebuffer device names unique"), as spotted by Frédéric Bonnard, the historical "of-display" device is
gone: the updated logic creates "of-display.0" instead, then as many "of-display.N" as required.
This means that offb no longer finds the expected device, which prevents the Debian Installer from setting up its interface, at least on ppc64el.
Fix this by keeping "of-display" for the first device and "of-display.N" for subsequent devices.
--- drivers/of/platform.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/of/platform.c +1 -1
@@ -553,7 +553,7 @@ static int __init of_platform_default_poif (!of_get_property (node,"linux,opened" ,NULL ) || !of_get_property (node,"linux,boot-display" ,NULL ))continue ; - dev =of_platform_device_create (node,"of-display.0" ,NULL ); + dev =of_platform_device_create (node,"of-display" ,NULL );of_node_put (node);if (WARN_ON (!dev))return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 31/227 regmap: Account for register length in SMBus I/O limits
In reply to Greg Kroah-HartmanFrom: Mark Brown <[email protected]>
commit 0c9d2eb5e94792fe64019008a04d4df5e57625af upstream.
The SMBus I2C buses have limits on the size of transfers they can do but do not factor in the register length meaning we may try to do a transfer longer than our length limit, the core will not take care of this. Future changes will factor this out into the core but there are a number of users that assume current behaviour so let's just do something conservative here.
This does not take account padding bits but practically speaking these are very rarely if ever used on I2C buses given that they generally run slowly enough to mean there's no issue.
--- drivers/base/regmap/regmap-i2c.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/base/regmap/regmap-i2c.c +4 -4
@@ -242,8 +242,8 @@ static int regmap_i2c_smbus_i2c_read(voistatic const struct regmap_bus regmap_i2c_smbus_i2c_block = { .write = regmap_i2c_smbus_i2c_write, .read = regmap_i2c_smbus_i2c_read, - .max_raw_read =I2C_SMBUS_BLOCK_MAX , - .max_raw_write =I2C_SMBUS_BLOCK_MAX , + .max_raw_read =I2C_SMBUS_BLOCK_MAX -1 , + .max_raw_write =I2C_SMBUS_BLOCK_MAX -1 , }; static int regmap_i2c_smbus_i2c_write_reg16(void *context, const void *data,
@@ -299,8 +299,8 @@ static int regmap_i2c_smbus_i2c_read_regstatic const struct regmap_bus regmap_i2c_smbus_i2c_block_reg16 = { .write = regmap_i2c_smbus_i2c_write_reg16, .read = regmap_i2c_smbus_i2c_read_reg16, - .max_raw_read =I2C_SMBUS_BLOCK_MAX , - .max_raw_write =I2C_SMBUS_BLOCK_MAX , + .max_raw_read =I2C_SMBUS_BLOCK_MAX -2 , + .max_raw_write =I2C_SMBUS_BLOCK_MAX -2 , }; static const struct regmap_bus *regmap_get_i2c_bus(struct i2c_client *i2c,
Greg Kroah-Hartman
maintainerPATCH 32/227 ia64: mmap: Consider pgoff when searching for free mapping
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
commit 07e981137f17e5275b6fa5fd0c28b0ddb4519702 upstream.
IA64 is the only architecture which does not consider the pgoff value when searching for a possible free memory region with vm_unmapped_area(). Adding this seems to have no negative side effect on IA64, so add it now to make IA64 consistent with all other architectures.
--- arch/ia64/kernel/sys_ia64.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/ia64/kernel/sys_ia64.c +1 -1
@@ -63,7 +63,7 @@ arch_get_unmapped_area (struct file *filp, unsigned long addr, unsigned long len info.low_limit = addr; info.high_limit =TASK_SIZE ; info.align_mask = align_mask; - info.align_offset =0 ; + info.align_offset = pgoff <<PAGE_SHIFT ;return vm_unmapped_area (&info); }
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 33/227 arm64/fpsimd: Ensure SME storage is allocated after SVE VL changes
In reply to Greg Kroah-HartmanFrom: Mark Brown <[email protected]>
commit d4d5be94a87872421ea2569044092535aff0b886 upstream.
When we reconfigure the SVE vector length we discard the backing storage for the SVE vectors and then reallocate on next SVE use, leaving the SME specific state alone. This means that we do not enable SME traps if they were already disabled. That means that userspace code can enter streaming mode without trapping, putting the task in a state where if we try to save the state of the task we will fault.
Since the ABI does not specify that changing the SVE vector length disturbs SME state, and since SVE code may not be aware of SME code in the process, we shouldn't simply discard any ZA state. Instead immediately reallocate the storage for SVE, and disable SME if we change the SVE vector length while there is no SME state active.
Disabling SME traps on SVE vector length changes would make the overall code more complex since we would have a state where we have valid SME state stored but might get a SME trap.
--- arch/arm64/kernel/fpsimd.c | 33 +++++++++++++++++++++++++-------- 1 file changed, 25 insertions(+), 8 deletions(-)
arch/arm64/kernel/fpsimd.c +25 -8
@@ -847,6 +847,8 @@ void sve_sync_from_fpsimd_zeropad(structint vec_set_vector_length (struct task_struct *task,enum vec_type type,unsigned long vl,unsigned long flags) { +bool free_sme = false; +if (flags & ~(unsigned long )(PR_SVE_VL_INHERIT |PR_SVE_SET_VL_ONEXEC ))return -EINVAL ;
@@ -897,21 +899,36 @@ int vec_set_vector_length(struct task_st task->thread.fp_type =FP_STATE_FPSIMD ; } -if (system_supports_sme () && type ==ARM64_VEC_SME ) { - task->thread.svcr &= ~(SVCR_SM_MASK | -SVCR_ZA_MASK ); -clear_thread_flag (TIF_SME ); +if (system_supports_sme ()) { +if (type ==ARM64_VEC_SME || + !(task->thread.svcr & (SVCR_SM_MASK |SVCR_ZA_MASK ))) { +/* +* We are changing the SME VL or weren't using +* SME anyway, discard the state and force a +* reallocation. +*/ + task->thread.svcr &= ~(SVCR_SM_MASK | +SVCR_ZA_MASK ); +clear_thread_flag (TIF_SME ); + free_sme = true; + } }if (task == current)put_cpu_fpsimd_context ();/* -* Force reallocation of task SVE and SME state to the correct -* size on next use: +* Free the changed states if they are not in use, SME will be +* reallocated to the correct size on next use and we just +* allocate SVE now in case it is needed for use in streaming +* mode. */ -sve_free (task); -if (system_supports_sme () && type ==ARM64_VEC_SME ) +if (system_supports_sve ()) { +sve_free (task); +sve_alloc (task, true); + } + +if (free_sme)sme_free (task);task_set_vl (task, type, vl);
Greg Kroah-Hartman
maintainerPATCH 34/227 can: mcp251xfd: __mcp251xfd_chip_set_mode(): increase poll timeout
In reply to Greg Kroah-HartmanFrom: Fedor Ross <[email protected]>
commit 9efa1a5407e81265ea502cab83be4de503decc49 upstream.
The mcp251xfd controller needs an idle bus to enter 'Normal CAN 2.0 mode' or . The maximum length of a CAN frame is 736 bits (64 data bytes, CAN-FD, EFF mode, worst case bit stuffing and interframe spacing). For low bit rates like 10 kbit/s the arbitrarily chosen MCP251XFD_POLL_TIMEOUT_US of 1 ms is too small.
Otherwise during polling for the CAN controller to enter 'Normal CAN 2.0 mode' the timeout limit is exceeded and the configuration fails with:
| $ ip link set dev can1 up type can bitrate 10000 | [ 731.911072] mcp251xfd spi2.1 can1: Controller failed to enter mode CAN 2.0 Mode (6) and stays in Configuration Mode (4) (con=0x068b0760, osc=0x00000468). | [ 731.927192] mcp251xfd spi2.1 can1: CRC read error at address 0x0e0c (length=4, data=00 00 00 00, CRC=0x0000) retrying. | [ 731.938101] A link change request failed with some changes committed already. Interface can1 may have been left with an inconsistent configuration, please check. | RTNETLINK answers: Connection timed out
Make MCP251XFD_POLL_TIMEOUT_US timeout calculation dynamic. Use maximum of 1ms and bit time of 1 full 64 data bytes CAN-FD frame in EFF mode, worst case bit stuffing and interframe spacing at the current bit rate.
For easier backporting define the macro MCP251XFD_FRAME_LEN_MAX_BITS that holds the max frame length in bits, which is 736. This can be replaced by can_frame_bits(true, true, true, true, CANFD_MAX_DLEN) in a cleanup patch later.
--- drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c | 10 ++++++++-- drivers/net/can/spi/mcp251xfd/mcp251xfd.h | 1 + 2 files changed, 9 insertions(+), 2 deletions(-)
drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c +8 -2
@@ -227,6 +227,8 @@ static int __mcp251xfd_chip_set_mode(const struct mcp251xfd_priv *priv, const u8 mode_req, bool nowait) { + const struct can_bittiming *bt = &priv->can.bittiming; +unsigned long timeout_us =MCP251XFD_POLL_TIMEOUT_US ;u32 con =0 , con_reqop, osc =0 ;u8 mode;int err;
@@ -246,12 +248,16 @@ __mcp251xfd_chip_set_mode(const struct mif (mode_req ==MCP251XFD_REG_CON_MODE_SLEEP || nowait)return 0 ; +if (bt->bitrate) + timeout_us = max_t(unsigned long, timeout_us, +MCP251XFD_FRAME_LEN_MAX_BITS *USEC_PER_SEC / + bt->bitrate); + err =regmap_read_poll_timeout (priv->map_reg,MCP251XFD_REG_CON , con, !mcp251xfd_reg_invalid (con) &&FIELD_GET (MCP251XFD_REG_CON_OPMOD_MASK , con) == mode_req, -MCP251XFD_POLL_SLEEP_US , -MCP251XFD_POLL_TIMEOUT_US ); +MCP251XFD_POLL_SLEEP_US , timeout_us);if (err != -ETIMEDOUT && err != -EBADMSG )return err;
drivers/net/can/spi/mcp251xfd/mcp251xfd.h +1 -0
@@ -387,6 +387,7 @@ static_assert(MCP251XFD_TIMESTAMP_WORK_D#define MCP251XFD_OSC_STAB_TIMEOUT_US (10 * MCP251XFD_OSC_STAB_SLEEP_US)#define MCP251XFD_POLL_SLEEP_US (10)#define MCP251XFD_POLL_TIMEOUT_US (USEC_PER_MSEC) +#define MCP251XFD_FRAME_LEN_MAX_BITS (736)/* Misc */ #define MCP251XFD_NAPI_WEIGHT 32
Greg Kroah-Hartman
maintainerPATCH 35/227 can: bcm: Fix UAF in bcm_proc_show()
In reply to Greg Kroah-HartmanFrom: YueHaibing <[email protected]>
commit 55c3b96074f3f9b0aee19bf93cd71af7516582bb upstream.
BUG: KASAN: slab-use-after-free in bcm_proc_show+0x969/0xa80 Read of size 8 at addr ffff888155846230 by task cat/7862 CPU: 1 PID: 7862 Comm: cat Not tainted 6.5.0-rc1-00153-gc8746099c197 #230 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0xd5/0x150 print_report+0xc1/0x5e0 kasan_report+0xba/0xf0 bcm_proc_show+0x969/0xa80 seq_read_iter+0x4f6/0x1260 seq_read+0x165/0x210 proc_reg_read+0x227/0x300 vfs_read+0x1d5/0x8d0 ksys_read+0x11e/0x240 do_syscall_64+0x35/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd Allocated by task 7846: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0x9e/0xa0 bcm_sendmsg+0x264b/0x44e0 sock_sendmsg+0xda/0x180 ____sys_sendmsg+0x735/0x920 ___sys_sendmsg+0x11d/0x1b0 __sys_sendmsg+0xfa/0x1d0 do_syscall_64+0x35/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 7846: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x27/0x40 ____kasan_slab_free+0x161/0x1c0 slab_free_freelist_hook+0x119/0x220 __kmem_cache_free+0xb4/0x2e0 rcu_core+0x809/0x1bd0
bcm_op is freed before procfs entry be removed in bcm_release(), this lead to bcm_proc_show() may read the freed bcm_op.
--- net/can/bcm.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
net/can/bcm.c +6 -6
@@ -1526,6 +1526,12 @@ static int bcm_release(struct socket *solock_sock (sk); +#if IS_ENABLED (CONFIG_PROC_FS ) +/* remove procfs entry */ +if (net->can.bcmproc_dir && bo->bcm_proc_read) +remove_proc_entry (bo->procname, net->can.bcmproc_dir); +#endif /* CONFIG_PROC_FS */ +list_for_each_entry_safe (op, next, &bo->tx_ops, list)bcm_remove_op (op);
@@ -1561,12 +1567,6 @@ static int bcm_release(struct socket *solist_for_each_entry_safe (op, next, &bo->rx_ops, list)bcm_remove_op (op); -#if IS_ENABLED (CONFIG_PROC_FS ) -/* remove procfs entry */ -if (net->can.bcmproc_dir && bo->bcm_proc_read) -remove_proc_entry (bo->procname, net->can.bcmproc_dir); -#endif /* CONFIG_PROC_FS */ -/* remove device reference */ if (bo->bound) { bo->bound =0 ;
Greg Kroah-Hartman
maintainerPATCH 36/227 can: gs_usb: gs_can_open(): improve error handling
In reply to Greg Kroah-HartmanFrom: Marc Kleine-Budde <[email protected]>
commit 2603be9e8167ddc7bea95dcfab9ffc33414215aa upstream.
The gs_usb driver handles USB devices with more than 1 CAN channel. The RX path for all channels share the same bulk endpoint (the transmitted bulk data encodes the channel number). These per-device resources are allocated and submitted by the first opened channel.
During this allocation, the resources are either released immediately in case of a failure or the URBs are anchored. All anchored URBs are finally killed with gs_usb_disconnect().
Currently, gs_can_open() returns with an error if the allocation of a URB or a buffer fails. However, if usb_submit_urb() fails, the driver continues with the URBs submitted so far, even if no URBs were successfully submitted.
Treat every error as fatal and free all allocated resources immediately.
Switch to goto-style error handling, to prepare the driver for more per-device resource allocation.
--- drivers/net/can/usb/gs_usb.c | 31 ++++++++++++++++++++++--------- 1 file changed, 22 insertions(+), 9 deletions(-)
drivers/net/can/usb/gs_usb.c +22 -9
@@ -833,6 +833,7 @@ static int gs_can_open(struct net_device .mode = cpu_to_le32(GS_CAN_MODE_START), };struct gs_host_frame *hf; +struct urb *urb =NULL ;u32 ctrlmode;u32 flags =0 ;int rc, i;
@@ -856,13 +857,14 @@ static int gs_can_open(struct net_deviceif (!parent->active_channels) {for (i =0 ; i <GS_MAX_RX_URBS ; i++) { -struct urb *urb;u8 *buf;/* alloc rx urb */ urb =usb_alloc_urb (0 ,GFP_KERNEL ); -if (!urb) -return -ENOMEM ; +if (!urb) { + rc = -ENOMEM ; + goto out_usb_kill_anchored_urbs; + }/* alloc rx buffer */ buf = kmalloc(dev->parent->hf_size_rx,
@@ -870,8 +872,8 @@ static int gs_can_open(struct net_deviceif (!buf) {netdev_err (netdev,"No memory left for USB buffer\n" ); -usb_free_urb (urb); -return -ENOMEM ; + rc = -ENOMEM ; + goto out_usb_free_urb; }/* fill, anchor, and submit rx urb */
@@ -894,9 +896,7 @@ static int gs_can_open(struct net_devicenetdev_err (netdev,"usb_submit failed (err=%d)\n" , rc); -usb_unanchor_urb (urb); -usb_free_urb (urb); -break ; + goto out_usb_unanchor_urb; }/* Drop reference,
@@ -945,7 +945,8 @@ static int gs_can_open(struct net_deviceif (dev->feature &GS_CAN_FEATURE_HW_TIMESTAMP )gs_usb_timestamp_stop (dev); dev->can.state =CAN_STATE_STOPPED ; -return rc; + + goto out_usb_kill_anchored_urbs; } parent->active_channels++;
@@ -953,6 +954,18 @@ static int gs_can_open(struct net_devicenetif_start_queue (netdev);return 0 ; + +out_usb_unanchor_urb: +usb_unanchor_urb (urb); +out_usb_free_urb: +usb_free_urb (urb); +out_usb_kill_anchored_urbs: +if (!parent->active_channels) +usb_kill_anchored_urbs (&dev->tx_submitted); + +close_candev (netdev); + +return rc; } static int gs_usb_get_state(const struct net_device *netdev,
Greg Kroah-Hartman
maintainerPATCH 37/227 can: gs_usb: fix time stamp counter initialization
In reply to Greg Kroah-HartmanFrom: Marc Kleine-Budde <[email protected]>
commit 5886e4d5ecec3e22844efed90b2dd383ef804b3a upstream.
If the gs_usb device driver is unloaded (or unbound) before the interface is shut down, the USB stack first calls the struct usb_driver::disconnect and then the struct net_device_ops::ndo_stop callback.
In gs_usb_disconnect() all pending bulk URBs are killed, i.e. no more RX'ed CAN frames are send from the USB device to the host. Later in gs_can_close() a reset control message is send to each CAN channel to remove the controller from the CAN bus. In this race window the USB device can still receive CAN frames from the bus and internally queue them to be send to the host.
At least in the current version of the candlelight firmware, the queue of received CAN frames is not emptied during the reset command. After loading (or binding) the gs_usb driver, new URBs are submitted during the struct net_device_ops::ndo_open callback and the candlelight firmware starts sending its already queued CAN frames to the host.
However, this scenario was not considered when implementing the hardware timestamp function. The cycle counter/time counter infrastructure is set up (gs_usb_timestamp_init()) after the USBs are submitted, resulting in a NULL pointer dereference if timecounter_cyc2time() (via the call chain:gs_usb_receive_bulk_callback() -> gs_usb_set_timestamp() -> gs_usb_skb_set_timestamp()) is called too early.
Move the gs_usb_timestamp_init() function before the URBs are submitted to fix this problem.
For a comprehensive solution, we need to consider gs_usb devices with more than 1 channel. The cycle counter/time counter infrastructure is setup per channel, but the RX URBs are per device. Once gs_can_open() of _a_ channel has been called, and URBs have been submitted, the gs_usb_receive_bulk_callback() can be called for _all_ available channels, even for channels that are not running, yet. As cycle counter/time counter has not set up, this will again lead to a NULL pointer dereference.
Convert the cycle counter/time counter from a "per channel" to a "per device" functionality. Also set it up, before submitting any URBs to the device.
Further in gs_usb_receive_bulk_callback(), don't process any URBs for not started CAN channels, only resubmit the URB.
--- drivers/net/can/usb/gs_usb.c | 101 ++++++++++++++++++++++--------------------- 1 file changed, 53 insertions(+), 48 deletions(-)
drivers/net/can/usb/gs_usb.c +53 -48
@@ -303,12 +303,6 @@ struct gs_can {struct can_bittiming_const bt_const, data_bt_const;unsigned int channel;/* channel number */ -/* time counter for hardware timestamps */ -struct cyclecounter cc; -struct timecounter tc; -spinlock_t tc_lock;/* spinlock to guard access tc->cycle_last */ -struct delayed_work timestamp; -u32 feature;unsigned int hf_size_tx;
@@ -325,6 +319,13 @@ struct gs_usb {struct gs_can *canch[GS_MAX_INTF ];struct usb_anchor rx_submitted;struct usb_device *udev; + +/* time counter for hardware timestamps */ +struct cyclecounter cc; +struct timecounter tc; +spinlock_t tc_lock;/* spinlock to guard access tc->cycle_last */ +struct delayed_work timestamp; +unsigned int hf_size_rx;u8 active_channels; };
@@ -388,15 +389,15 @@ static int gs_cmd_reset(struct gs_can *d GFP_KERNEL); } -static inline int gs_usb_get_timestamp (const struct gs_can *dev, +static inline int gs_usb_get_timestamp (const struct gs_usb *parent,u32 *timestamp_p) {__le32 timestamp;int rc; - rc =usb_control_msg_recv (dev->udev,0 ,GS_USB_BREQ_TIMESTAMP , + rc =usb_control_msg_recv (parent->udev,0 ,GS_USB_BREQ_TIMESTAMP ,USB_DIR_IN |USB_TYPE_VENDOR |USB_RECIP_INTERFACE , - dev->channel,0 , +0 ,0 , ×tamp,sizeof (timestamp),USB_CTRL_GET_TIMEOUT ,GFP_KERNEL );
@@ -410,20 +411,20 @@ static inline int gs_usb_get_timestamp(c static u64 gs_usb_timestamp_read(const struct cyclecounter *cc) __must_hold(&dev->tc_lock) { - struct gs_can *dev = container_of(cc, struct gs_can, cc); + struct gs_usb *parent = container_of(cc, struct gs_usb, cc);u32 timestamp =0 ;int err; -lockdep_assert_held (&dev->tc_lock); +lockdep_assert_held (&parent->tc_lock);/* drop lock for synchronous USB transfer */ -spin_unlock_bh (&dev->tc_lock); - err =gs_usb_get_timestamp (dev, ×tamp); -spin_lock_bh (&dev->tc_lock); +spin_unlock_bh (&parent->tc_lock); + err =gs_usb_get_timestamp (parent, ×tamp); +spin_lock_bh (&parent->tc_lock);if (err) -netdev_err (dev->netdev, -"Error %d while reading timestamp. HW timestamps may be inaccurate." , - err); +dev_err (&parent->udev->dev, +"Error %d while reading timestamp. HW timestamps may be inaccurate." , + err);return timestamp; }
@@ -431,14 +432,14 @@ static u64 gs_usb_timestamp_read(const sstatic void gs_usb_timestamp_work (struct work_struct *work) {struct delayed_work *delayed_work =to_delayed_work (work); -struct gs_can *dev; +struct gs_usb *parent; - dev = container_of(delayed_work, struct gs_can, timestamp); -spin_lock_bh (&dev->tc_lock); -timecounter_read (&dev->tc); -spin_unlock_bh (&dev->tc_lock); + parent = container_of(delayed_work, struct gs_usb, timestamp); +spin_lock_bh (&parent->tc_lock); +timecounter_read (&parent->tc); +spin_unlock_bh (&parent->tc_lock); -schedule_delayed_work (&dev->timestamp, +schedule_delayed_work (&parent->timestamp,GS_USB_TIMESTAMP_WORK_DELAY_SEC *HZ ); }
@@ -446,37 +447,38 @@ static void gs_usb_skb_set_timestamp(str struct sk_buff *skb, u32 timestamp) {struct skb_shared_hwtstamps *hwtstamps =skb_hwtstamps (skb); +struct gs_usb *parent = dev->parent;u64 ns; -spin_lock_bh (&dev->tc_lock); - ns =timecounter_cyc2time (&dev->tc, timestamp); -spin_unlock_bh (&dev->tc_lock); +spin_lock_bh (&parent->tc_lock); + ns =timecounter_cyc2time (&parent->tc, timestamp); +spin_unlock_bh (&parent->tc_lock); hwtstamps->hwtstamp =ns_to_ktime (ns); } -static void gs_usb_timestamp_init (struct gs_can *dev) +static void gs_usb_timestamp_init (struct gs_usb *parent) { -struct cyclecounter *cc = &dev->cc; +struct cyclecounter *cc = &parent->cc; cc->read = gs_usb_timestamp_read; cc->mask =CYCLECOUNTER_MASK (32 ); cc->shift =32 -bits_per (NSEC_PER_SEC /GS_USB_TIMESTAMP_TIMER_HZ ); cc->mult =clocksource_hz2mult (GS_USB_TIMESTAMP_TIMER_HZ , cc->shift); -spin_lock_init (&dev->tc_lock); -spin_lock_bh (&dev->tc_lock); -timecounter_init (&dev->tc, &dev->cc,ktime_get_real_ns ()); -spin_unlock_bh (&dev->tc_lock); +spin_lock_init (&parent->tc_lock); +spin_lock_bh (&parent->tc_lock); +timecounter_init (&parent->tc, &parent->cc,ktime_get_real_ns ()); +spin_unlock_bh (&parent->tc_lock); -INIT_DELAYED_WORK (&dev->timestamp, gs_usb_timestamp_work); -schedule_delayed_work (&dev->timestamp, +INIT_DELAYED_WORK (&parent->timestamp, gs_usb_timestamp_work); +schedule_delayed_work (&parent->timestamp,GS_USB_TIMESTAMP_WORK_DELAY_SEC *HZ ); } -static void gs_usb_timestamp_stop (struct gs_can *dev) +static void gs_usb_timestamp_stop (struct gs_usb *parent) { -cancel_delayed_work_sync (&dev->timestamp); +cancel_delayed_work_sync (&parent->timestamp); }static void gs_update_state (struct gs_can *dev,struct can_frame *cf)
@@ -560,6 +562,9 @@ static void gs_usb_receive_bulk_callbackif (!netif_device_present (netdev))return ; +if (!netif_running (netdev)) + goto resubmit_urb; +if (hf->echo_id ==-1 ) {/* normal rx */ if (hf->flags &GS_CAN_FLAG_FD ) { skb =alloc_canfd_skb (dev->netdev, &cfd);
@@ -856,6 +861,9 @@ static int gs_can_open(struct net_device }if (!parent->active_channels) { +if (dev->feature &GS_CAN_FEATURE_HW_TIMESTAMP ) +gs_usb_timestamp_init (parent); +for (i =0 ; i <GS_MAX_RX_URBS ; i++) {u8 *buf;
@@ -926,13 +934,9 @@ static int gs_can_open(struct net_device flags |=GS_CAN_MODE_FD ;/* if hardware supports timestamps, enable it */ -if (dev->feature &GS_CAN_FEATURE_HW_TIMESTAMP ) { +if (dev->feature &GS_CAN_FEATURE_HW_TIMESTAMP ) flags |=GS_CAN_MODE_HW_TIMESTAMP ; -/* start polling timestamp */ -gs_usb_timestamp_init (dev); - } -/* finally start device */ dev->can.state =CAN_STATE_ERROR_ACTIVE ; dm.flags =cpu_to_le32 (flags);
@@ -942,8 +946,6 @@ static int gs_can_open(struct net_device GFP_KERNEL);if (rc) {netdev_err (netdev,"Couldn't start device (err=%d)\n" , rc); -if (dev->feature &GS_CAN_FEATURE_HW_TIMESTAMP ) -gs_usb_timestamp_stop (dev); dev->can.state =CAN_STATE_STOPPED ; goto out_usb_kill_anchored_urbs;
@@ -960,9 +962,13 @@ out_usb_unanchor_urb: out_usb_free_urb:usb_free_urb (urb); out_usb_kill_anchored_urbs: -if (!parent->active_channels) +if (!parent->active_channels) {usb_kill_anchored_urbs (&dev->tx_submitted); +if (dev->feature &GS_CAN_FEATURE_HW_TIMESTAMP ) +gs_usb_timestamp_stop (parent); + } +close_candev (netdev);return rc;
@@ -1011,14 +1017,13 @@ static int gs_can_close(struct net_devicnetif_stop_queue (netdev); -/* stop polling timestamp */ -if (dev->feature &GS_CAN_FEATURE_HW_TIMESTAMP ) -gs_usb_timestamp_stop (dev); -/* Stop polling */ parent->active_channels--;if (!parent->active_channels) {usb_kill_anchored_urbs (&parent->rx_submitted); + +if (dev->feature &GS_CAN_FEATURE_HW_TIMESTAMP ) +gs_usb_timestamp_stop (parent); }/* Stop sending URBs */
Greg Kroah-Hartman
maintainerPATCH 38/227 Revert "r8169: disable ASPM during NAPI poll"
In reply to Greg Kroah-HartmanFrom: Heiner Kallweit <[email protected]>
commit e31a9fedc7d8d80722b19628e66fcb5a36981780 upstream.
This reverts commit e1ed3e4d91112027b90c7ee61479141b3f948e6a.
Turned out the change causes a performance regression.
--- drivers/net/ethernet/realtek/r8169_main.c | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-)
drivers/net/ethernet/realtek/r8169_main.c +1 -10
@@ -4514,10 +4514,6 @@ static irqreturn_t rtl8169_interrupt(int }if (napi_schedule_prep (&tp->napi)) { -rtl_unlock_config_regs (tp); -rtl_hw_aspm_clkreq_enable (tp, false); -rtl_lock_config_regs (tp); -rtl_irq_disable (tp);__napi_schedule (&tp->napi); }
@@ -4577,14 +4573,9 @@ static int rtl8169_poll(struct napi_stru work_done =rtl_rx (dev, tp, budget); -if (work_done < budget &&napi_complete_done (napi, work_done)) { +if (work_done < budget &&napi_complete_done (napi, work_done))rtl_irq_enable (tp); -rtl_unlock_config_regs (tp); -rtl_hw_aspm_clkreq_enable (tp, true); -rtl_lock_config_regs (tp); - } -return work_done; }
Greg Kroah-Hartman
maintainerPATCH 39/227 selftests: tc: add ConnTrack procfs kconfig
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit 031c99e71fedcce93b6785d38b7d287bf59e3952 upstream.
When looking at the TC selftest reports, I noticed one test was failing because /proc/net/nf_conntrack was not available.
not ok 373 3992 - Add ct action triggering DNAT tuple conflict
Could not match regex pattern. Verify command output:
cat: /proc/net/nf_conntrack: No such file or directory
It is only available if NF_CONNTRACK_PROCFS kconfig is set. So the issue can be fixed simply by adding it to the list of required kconfig.
--- tools/testing/selftests/tc-testing/config | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/tc-testing/config +1 -0
@@ -5,6 +5,7 @@ CONFIG_NF_CONNTRACK=m CONFIG_NF_CONNTRACK_MARK=y CONFIG_NF_CONNTRACK_ZONES=y CONFIG_NF_CONNTRACK_LABELS=y +CONFIG_NF_CONNTRACK_PROCFS=y CONFIG_NF_FLOW_TABLE=m CONFIG_NF_NAT=m CONFIG_NETFILTER_XT_TARGET_LOG=m
Greg Kroah-Hartman
maintainerPATCH 40/227 accel/qaic: tighten bounds checking in encode_message()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit ea33cb6fc2788f9fe248d49e1c0b2553a58436ef upstream.
There are several issues in this code. The check at the start of the loop:
if (user_len >= user_msg->len) {This check does not ensure that we have enough space for the trans_hdr (8 bytes). Instead the check needs to be:
if (user_len > user_msg->len - sizeof(*trans_hdr)) {That subtraction is done as an unsigned long we want to avoid negatives. Add a lower bound to the start of the function.
if (user_msg->len < sizeof(*trans_hdr))
There is a second integer underflow which can happen if trans_hdr->len is zero inside the encode_passthrough() function.
memcpy(out_trans->data, in_trans->data, in_trans->hdr.len - sizeof(in_trans->hdr));
Instead of adding a check to encode_passthrough() it's better to check in this central place. Add that check:
if (trans_hdr->len < sizeof(trans_hdr)
The final concern is that the "user_len + trans_hdr->len" might have an integer overflow bug. Use size_add() to prevent that.
- if (user_len + trans_hdr->len > user_msg->len) {
+ if (size_add(user_len, trans_hdr->len) > user_msg->len) {
--- drivers/accel/qaic/qaic_control.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/accel/qaic/qaic_control.c +6 -3
@@ -14,6 +14,7 @@#include <linux/mm.h> #include <linux/moduleparam.h> #include <linux/mutex.h> +#include <linux/overflow.h> #include <linux/pci.h> #include <linux/scatterlist.h> #include <linux/types.h>
@@ -751,7 +752,8 @@ static int encode_message(struct qaic_deint ret;int i; -if (!user_msg->count) { +if (!user_msg->count || + user_msg->len <sizeof (*trans_hdr)) { ret = -EINVAL ; goto out; }
@@ -768,12 +770,13 @@ static int encode_message(struct qaic_de }for (i =0 ; i < user_msg->count; ++i) { -if (user_len >= user_msg->len) { +if (user_len > user_msg->len -sizeof (*trans_hdr)) { ret = -EINVAL ;break ; } trans_hdr = (struct qaic_manage_trans_hdr *)(user_msg->data + user_len); -if (user_len + trans_hdr->len > user_msg->len) { +if (trans_hdr->len <sizeof (trans_hdr) || +size_add (user_len, trans_hdr->len) > user_msg->len) { ret = -EINVAL ;break ; }
Greg Kroah-Hartman
maintainerPATCH 41/227 accel/qaic: tighten bounds checking in decode_message()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit 51b56382ed2a2b03347372272362b3baa623ed1e upstream.
Copy the bounds checking from encode_message() to decode_message().
This patch addresses the following concerns. Ensure that there is enough space for at least one header so that we don't have a negative size later.
if (msg_hdr_len < sizeof(*trans_hdr))
Ensure that we have enough space to read the next header from the msg->data.
if (msg_len > msg_hdr_len - sizeof(*trans_hdr)) return -EINVAL;
Check that the trans_hdr->len is not below the minimum size:
if (hdr_len < sizeof(*trans_hdr))
This minimum check ensures that we don't corrupt memory in decode_passthrough() when we do.
memcpy(out_trans->data, in_trans->data, len - sizeof(in_trans->hdr));
And finally, use size_add() to prevent an integer overflow:
if (size_add(msg_len, hdr_len) > msg_hdr_len)
--- drivers/accel/qaic/qaic_control.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
drivers/accel/qaic/qaic_control.c +10 -2
@@ -959,15 +959,23 @@ static int decode_message(struct qaic_deint ret;int i; -if (msg_hdr_len >QAIC_MANAGE_MAX_MSG_LENGTH ) +if (msg_hdr_len <sizeof (*trans_hdr) || + msg_hdr_len >QAIC_MANAGE_MAX_MSG_LENGTH )return -EINVAL ; user_msg->len =0 ; user_msg->count =le32_to_cpu (msg->hdr.count);for (i =0 ; i < user_msg->count; ++i) { +u32 hdr_len; + +if (msg_len > msg_hdr_len -sizeof (*trans_hdr)) +return -EINVAL ; + trans_hdr = (struct wire_trans_hdr *)(msg->data + msg_len); -if (msg_len +le32_to_cpu (trans_hdr->len) > msg_hdr_len) + hdr_len =le32_to_cpu (trans_hdr->len); +if (hdr_len <sizeof (*trans_hdr) || +size_add (msg_len, hdr_len) > msg_hdr_len)return -EINVAL ;switch (le32_to_cpu (trans_hdr->type)) {
Greg Kroah-Hartman
maintainerPATCH 42/227 accel/qaic: Add consistent integer overflow checks
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit 47d87f71d00b7091b43a56f608f7151b33e5772e upstream.
The encode_dma() function has integer overflow checks. The encode_passthrough(), encode_activate() and encode_status() functions did not. I added integer overflow checking everywhere. I also updated the integer overflow checking in encode_dma() to use size_add() so everything is consistent.
--- drivers/accel/qaic/qaic_control.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-)
drivers/accel/qaic/qaic_control.c +4 -7
@@ -367,7 +367,7 @@ static int encode_passthrough(struct qaiif (in_trans->hdr.len %8 !=0 )return -EINVAL ; -if (msg_hdr_len + in_trans->hdr.len >QAIC_MANAGE_EXT_MSG_LENGTH ) +if (size_add (msg_hdr_len, in_trans->hdr.len) >QAIC_MANAGE_EXT_MSG_LENGTH )return -ENOSPC ; trans_wrapper = add_wrapper(wrappers,
@@ -561,11 +561,8 @@ static int encode_dma(struct qaic_device msg = &wrapper->msg; msg_hdr_len =le32_to_cpu (msg->hdr.len); -if (msg_hdr_len > (UINT_MAX -QAIC_MANAGE_EXT_MSG_LENGTH )) -return -EINVAL ; -/* There should be enough space to hold at least one ASP entry. */ -if (msg_hdr_len +sizeof (*out_trans) +sizeof (struct wire_addr_size_pair ) > +if (size_add (msg_hdr_len,sizeof (*out_trans) +sizeof (struct wire_addr_size_pair )) >QAIC_MANAGE_EXT_MSG_LENGTH )return -ENOMEM ;
@@ -638,7 +635,7 @@ static int encode_activate(struct qaic_d msg = &wrapper->msg; msg_hdr_len =le32_to_cpu (msg->hdr.len); -if (msg_hdr_len +sizeof (*out_trans) >QAIC_MANAGE_MAX_MSG_LENGTH ) +if (size_add (msg_hdr_len,sizeof (*out_trans)) >QAIC_MANAGE_MAX_MSG_LENGTH )return -ENOSPC ;if (!in_trans->queue_size)
@@ -722,7 +719,7 @@ static int encode_status(struct qaic_dev msg = &wrapper->msg; msg_hdr_len =le32_to_cpu (msg->hdr.len); -if (msg_hdr_len + in_trans->hdr.len >QAIC_MANAGE_MAX_MSG_LENGTH ) +if (size_add (msg_hdr_len, in_trans->hdr.len) >QAIC_MANAGE_MAX_MSG_LENGTH )return -ENOSPC ; trans_wrapper =add_wrapper (wrappers,sizeof (*trans_wrapper));
Greg Kroah-Hartman
maintainerPATCH 43/227 dma-buf/dma-resv: Stop leaking on krealloc() failure
In reply to Greg Kroah-HartmanFrom: Ville Syrjälä <[email protected]>
commit 05abb3be91d8788328231ee02973ab3d47f5e3d2 upstream.
Currently dma_resv_get_fences() will leak the previously allocated array if the fence iteration got restarted and the krealloc_array() fails.
Free the old array by hand, and make sure we still clear the returned *fences so the caller won't end up accessing freed memory. Some (but not all) of the callers of dma_resv_get_fences() seem to still trawl through the array even when dma_resv_get_fences() failed. And let's zero out *num_fences as well for good measure.
--- drivers/dma-buf/dma-resv.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/dma-buf/dma-resv.c +9 -4
@@ -571,6 +571,7 @@ int dma_resv_get_fences(struct dma_resvdma_resv_for_each_fence_unlocked (&cursor, fence) {if (dma_resv_iter_is_restarted (&cursor)) { +struct dma_fence **new_fences;unsigned int count;while (*num_fences)
@@ -579,13 +580,17 @@ int dma_resv_get_fences(struct dma_resv count = cursor.num_fences +1 ;/* Eventually re-allocate the array */ - *fences =krealloc_array (*fences, count, -sizeof (void *), -GFP_KERNEL ); -if (count && !*fences) { + new_fences =krealloc_array (*fences, count, +sizeof (void *), +GFP_KERNEL ); +if (count && !new_fences) { +kfree (*fences); + *fences =NULL ; + *num_fences =0 ;dma_resv_iter_end (&cursor);return -ENOMEM ; } + *fences = new_fences; } (*fences)[(*num_fences)++] =dma_fence_get (fence);
Greg Kroah-Hartman
maintainerPATCH 44/227 drm/amdgpu/vkms: relax timer deactivation by hrtimer_try_to_cancel
In reply to Greg Kroah-HartmanFrom: Guchun Chen <[email protected]>
commit b42ae87a7b3878afaf4c3852ca66c025a5b996e0 upstream.
In below thousands of screen rotation loop tests with virtual display enabled, a CPU hard lockup issue may happen, leading system to unresponsive and crash.
do {
xrandr --output Virtual --rotate inverted
xrandr --output Virtual --rotate right
xrandr --output Virtual --rotate left
xrandr --output Virtual --rotate normal
} while (1);NMI watchdog: Watchdog detected hard LOCKUP on cpu 1
? hrtimer_run_softirq+0x140/0x140 ? store_vblank+0xe0/0xe0 [drm] hrtimer_cancel+0x15/0x30 amdgpu_vkms_disable_vblank+0x15/0x30 [amdgpu] drm_vblank_disable_and_save+0x185/0x1f0 [drm] drm_crtc_vblank_off+0x159/0x4c0 [drm] ? record_print_text.cold+0x11/0x11 ? wait_for_completion_timeout+0x232/0x280 ? drm_crtc_wait_one_vblank+0x40/0x40 [drm] ? bit_wait_io_timeout+0xe0/0xe0 ? wait_for_completion_interruptible+0x1d7/0x320 ? mutex_unlock+0x81/0xd0
amdgpu_vkms_crtc_atomic_disable
It's caused by a stuck in lock dependency in such scenario on different CPUs.
CPU1 CPU2drm_crtc_vblank_off hrtimer_interrupt
grab event_lock (irq disabled) __hrtimer_run_queues
grab vbl_lock/vblank_time_block amdgpu_vkms_vblank_simulate
amdgpu_vkms_disable_vblank drm_handle_vblank
hrtimer_cancel grab dev->event_lock
So CPU1 stucks in hrtimer_cancel as timer callback is running endless on current clock base, as that timer queue on CPU2 has no chance to finish it because of failing to hold the lock. So NMI watchdog will throw the errors after its threshold, and all later CPUs are impacted/blocked.
So use hrtimer_try_to_cancel to fix this, as disable_vblank callback does not need to wait the handler to finish. And also it's not necessary to check the return value of hrtimer_try_to_cancel, because even if it's -1 which means current timer callback is running, it will be reprogrammed in hrtimer_start with calling enable_vblank to make it works.
v2: only re-arm timer when vblank is enabled (Christian) and add a Fixes tag as well
v3: drop warn printing (Christian)
v4: drop superfluous check of blank->enabled in timer function, as it's guaranteed in drm_handle_vblank (Christian)
--- drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c +3 -2
@@ -55,8 +55,9 @@ static enum hrtimer_restart amdgpu_vkms_DRM_WARN ("%s: vblank timer overrun\n" , __func__); ret =drm_crtc_handle_vblank (crtc); +/* Don't queue timer again when vblank is disabled. */ if (!ret) -DRM_ERROR ("amdgpu_vkms failure on handling vblank" ); +return HRTIMER_NORESTART ;return HRTIMER_RESTART ; }
@@ -81,7 +82,7 @@ static void amdgpu_vkms_disable_vblank(s {struct amdgpu_crtc *amdgpu_crtc =to_amdgpu_crtc (crtc); -hrtimer_cancel (&amdgpu_crtc->vblank_timer); +hrtimer_try_to_cancel (&amdgpu_crtc->vblank_timer); } static bool amdgpu_vkms_get_vblank_timestamp(struct drm_crtc *crtc,
Greg Kroah-Hartman
maintainerPATCH 45/227 drm/amdgpu/pm: make gfxclock consistent for sienna cichlid
In reply to Greg Kroah-HartmanFrom: Alex Deucher <[email protected]>
commit a4eb11824170d742531998f4ebd1c6a18b63db47 upstream.
Use average gfxclock for consistency with other dGPUs.
--- drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c +6 -2
@@ -1927,12 +1927,16 @@ static int sienna_cichlid_read_sensor(st *size =4 ;break ;case AMDGPU_PP_SENSOR_GFX_MCLK : - ret =sienna_cichlid_get_current_clk_freq_by_table (smu,SMU_UCLK , (uint32_t *)data); + ret =sienna_cichlid_get_smu_metrics_data (smu, +METRICS_CURR_UCLK , + (uint32_t *)data); *(uint32_t *)data *=100 ; *size =4 ;break ;case AMDGPU_PP_SENSOR_GFX_SCLK : - ret =sienna_cichlid_get_current_clk_freq_by_table (smu,SMU_GFXCLK , (uint32_t *)data); + ret =sienna_cichlid_get_smu_metrics_data (smu, +METRICS_AVERAGE_GFXCLK , + (uint32_t *)data); *(uint32_t *)data *=100 ; *size =4 ;break ;
Greg Kroah-Hartman
maintainerPATCH 46/227 drm/amdgpu/pm: make mclk consistent for smu 13.0.7
In reply to Greg Kroah-HartmanFrom: Alex Deucher <[email protected]>
commit 068c8bb10f37bb84824625dbbda053a3a3e0d6e1 upstream.
Use current uclk to be consistent with other dGPUs.
--- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c +1 -1
@@ -940,7 +940,7 @@ static int smu_v13_0_7_read_sensor(strucbreak ;case AMDGPU_PP_SENSOR_GFX_MCLK : ret =smu_v13_0_7_get_smu_metrics_data (smu, -METRICS_AVERAGE_UCLK , +METRICS_CURR_UCLK , (uint32_t *)data); *(uint32_t *)data *=100 ; *size =4 ;
Greg Kroah-Hartman
maintainerPATCH 47/227 drm/nouveau/disp: PIOR DP uses GPIO for HPD, not PMGR AUX interrupts
In reply to Greg Kroah-HartmanFrom: Ben Skeggs <[email protected]>
commit 2b5d1c29f6c4cb19369ef92881465e5ede75f4ef upstream.
Fixes crash on boards with ANX9805 TMDS/DP encoders.
--- drivers/gpu/drm/nouveau/nvkm/engine/disp/uconn.c | 29 +++++++++++++++-------- 1 file changed, 19 insertions(+), 10 deletions(-)
drivers/gpu/drm/nouveau/nvkm/engine/disp/uconn.c +19 -10
@@ -81,20 +81,29 @@ nvkm_uconn_uevent(struct nvkm_object *obreturn -ENOSYS ;list_for_each_entry (outp, &conn->disp->outps, head) { -if (outp->info.connector == conn->index && outp->dp.aux) { -if (args->v0.types &NVIF_CONN_EVENT_V0_PLUG ) bits |=NVKM_I2C_PLUG ; -if (args->v0.types &NVIF_CONN_EVENT_V0_UNPLUG ) bits |=NVKM_I2C_UNPLUG ; -if (args->v0.types &NVIF_CONN_EVENT_V0_IRQ ) bits |=NVKM_I2C_IRQ ; - -return nvkm_uevent_add (uevent, &device->i2c->event, outp->dp.aux->id, bits, - nvkm_uconn_uevent_aux); - } +if (outp->info.connector == conn->index) +break ; + } + +if (&outp->head == &conn->disp->outps) +return -EINVAL ; + +if (outp->dp.aux && !outp->info.location) { +if (args->v0.types &NVIF_CONN_EVENT_V0_PLUG ) bits |=NVKM_I2C_PLUG ; +if (args->v0.types &NVIF_CONN_EVENT_V0_UNPLUG ) bits |=NVKM_I2C_UNPLUG ; +if (args->v0.types &NVIF_CONN_EVENT_V0_IRQ ) bits |=NVKM_I2C_IRQ ; + +return nvkm_uevent_add (uevent, &device->i2c->event, outp->dp.aux->id, bits, + nvkm_uconn_uevent_aux); }if (args->v0.types &NVIF_CONN_EVENT_V0_PLUG ) bits |=NVKM_GPIO_HI ;if (args->v0.types &NVIF_CONN_EVENT_V0_UNPLUG ) bits |=NVKM_GPIO_LO ; -if (args->v0.types &NVIF_CONN_EVENT_V0_IRQ ) -return -EINVAL ; +if (args->v0.types &NVIF_CONN_EVENT_V0_IRQ ) { +/* TODO: support DP IRQ on ANX9805 and remove this hack. */ +if (!outp->info.location) +return -EINVAL ; + }return nvkm_uevent_add (uevent, &device->gpio->event, conn->info.hpd, bits, nvkm_uconn_uevent_gpio);
Greg Kroah-Hartman
maintainerPATCH 48/227 drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP
In reply to Greg Kroah-HartmanFrom: Ben Skeggs <[email protected]>
commit ea293f823a8805735d9e00124df81a8f448ed1ae upstream.
Fixes OOPS on boards with ANX9805 DP encoders.
--- drivers/gpu/drm/nouveau/dispnv50/disp.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/nouveau/dispnv50/disp.c +4 -0
@@ -1873,6 +1873,8 @@ nv50_pior_destroy(struct drm_encoder *ennvif_outp_dtor (&nv_encoder->outp);drm_encoder_cleanup (encoder); + +mutex_destroy (&nv_encoder->dp.hpd_irq_lock);kfree (encoder); }
@@ -1917,6 +1919,8 @@ nv50_pior_create(struct drm_connector *c nv_encoder->i2c = ddc; nv_encoder->aux = aux; +mutex_init (&nv_encoder->dp.hpd_irq_lock); + encoder =to_drm_encoder (nv_encoder); encoder->possible_crtcs = dcbe->heads; encoder->possible_clones =0 ;
Greg Kroah-Hartman
maintainerPATCH 49/227 drm/nouveau/i2c: fix number of aux event slots
In reply to Greg Kroah-HartmanFrom: Ben Skeggs <[email protected]>
commit 752a281032b2d6f4564be827e082bde6f7d2fd4f upstream.
This was completely bogus before, using maximum DCB device index rather than maximum AUX ID to size the buffer that stores event refcounts.
*Pretty* unlikely to have been an actual problem on most configurations, that is, unless you've got one of the rare boards that have off-chip DP.
There, it'll likely crash.
--- drivers/gpu/drm/nouveau/include/nvkm/subdev/i2c.h | 4 ++-- drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c | 11 +++++++++-- 2 files changed, 11 insertions(+), 4 deletions(-)
drivers/gpu/drm/nouveau/include/nvkm/subdev/i2c.h +2 -2
@@ -16,7 +16,7 @@ struct nvkm_i2c_bus {const struct nvkm_i2c_bus_func *func;struct nvkm_i2c_pad *pad;#define NVKM_I2C_BUS_CCB (n)/* 'n' is ccb index */ (n) -#define NVKM_I2C_BUS_EXT (n)/* 'n' is dcb external encoder type */ ((n) + 0x100) +#define NVKM_I2C_BUS_EXT (n)/* 'n' is dcb external encoder type */ ((n) + 0x10)#define NVKM_I2C_BUS_PRI /* ccb primary comm. port */ -1#define NVKM_I2C_BUS_SEC /* ccb secondary comm. port */ -2int id;
@@ -38,7 +38,7 @@ struct nvkm_i2c_aux {const struct nvkm_i2c_aux_func *func;struct nvkm_i2c_pad *pad;#define NVKM_I2C_AUX_CCB (n)/* 'n' is ccb index */ (n) -#define NVKM_I2C_AUX_EXT (n)/* 'n' is dcb external encoder type */ ((n) + 0x100) +#define NVKM_I2C_AUX_EXT (n)/* 'n' is dcb external encoder type */ ((n) + 0x10)int id;struct mutex mutex;
drivers/gpu/drm/nouveau/nvkm/subdev/i2c/base.c +9 -2
@@ -260,10 +260,11 @@ nvkm_i2c_new_(const struct nvkm_i2c_func *func, struct nvkm_device *device, {struct nvkm_bios *bios = device->bios;struct nvkm_i2c *i2c; +struct nvkm_i2c_aux *aux;struct dcb_i2c_entry ccbE;struct dcb_output dcbE;u8 ver, hdr; -int ret, i; +int ret, i, ids;if (!(i2c = *pi2c =kzalloc (sizeof (*i2c),GFP_KERNEL )))return -ENOMEM ;
@@ -406,5 +407,11 @@ nvkm_i2c_new_(const struct nvkm_i2c_func *func, struct nvkm_device *device, } } -return nvkm_event_init (&nvkm_i2c_intr_func, &i2c->subdev,4 , i, &i2c->event); + ids =0 ; +list_for_each_entry (aux, &i2c->aux, head) + ids =max (ids, aux->id +1 ); +if (!ids) +return 0 ; + +return nvkm_event_init (&nvkm_i2c_intr_func, &i2c->subdev,4 , ids, &i2c->event); }
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 50/227 drm/client: Fix memory leak in drm_client_target_cloned
In reply to Greg Kroah-HartmanFrom: Jocelyn Falempe <[email protected]>
commit c2a88e8bdf5f6239948d75283d0ae7e0c7945b03 upstream.
dmt_mode is allocated and never freed in this function.
It was found with the ast driver, but most drivers using generic fbdev setup are probably affected.
This fixes the following kmemleak report:
backtrace:
[<00000000b391296d>] drm_mode_duplicate+0x45/0x220 [drm]
[<00000000e45bb5b3>] drm_client_target_cloned.constprop.0+0x27b/0x480 [drm]
[<00000000ed2d3a37>] drm_client_modeset_probe+0x6bd/0xf50 [drm]
[<0000000010e5cc9d>] __drm_fb_helper_initial_config_and_unlock+0xb4/0x2c0 [drm_kms_helper]
[<00000000909f82ca>] drm_fbdev_client_hotplug+0x2bc/0x4d0 [drm_kms_helper]
[<00000000063a69aa>] drm_client_register+0x169/0x240 [drm]
[<00000000a8c61525>] ast_pci_probe+0x142/0x190 [ast]
[<00000000987f19bb>] local_pci_probe+0xdc/0x180
[<000000004fca231b>] work_for_cpu_fn+0x4e/0xa0
[<0000000000b85301>] process_one_work+0x8b7/0x1540
[<000000003375b17c>] worker_thread+0x70a/0xed0
[<00000000b0d43cd9>] kthread+0x29f/0x340
[<000000008d770833>] ret_from_fork+0x1f/0x30unreferenced object 0xff11000333089a00 (size 128):
--- drivers/gpu/drm/drm_client_modeset.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/gpu/drm/drm_client_modeset.c +5 -0
@@ -311,6 +311,9 @@ static bool drm_client_target_cloned(str can_clone = true; dmt_mode =drm_mode_find_dmt (dev,1024 ,768 ,60 , false); +if (!dmt_mode) + goto fail; +for (i =0 ; i < connector_count; i++) {if (!enabled[i])continue ;
@@ -326,11 +329,13 @@ static bool drm_client_target_cloned(strif (!modes[i]) can_clone = false; } +kfree (dmt_mode);if (can_clone) {DRM_DEBUG_KMS ("can clone using 1024x768\n" );return true; } +fail:DRM_INFO ("kms: can't enable cloning when we probably wanted to.\n" );return false; }
Greg Kroah-Hartman
maintainerPATCH 51/227 drm/client: Fix memory leak in drm_client_modeset_probe
In reply to Greg Kroah-HartmanFrom: Jocelyn Falempe <[email protected]>
commit 2329cc7a101af1a844fbf706c0724c0baea38365 upstream.
When a new mode is set to modeset->mode, the previous mode should be freed. This fixes the following kmemleak report:
drm_mode_duplicate+0x45/0x220 [drm] drm_client_modeset_probe+0x944/0xf50 [drm] __drm_fb_helper_initial_config_and_unlock+0xb4/0x2c0 [drm_kms_helper] drm_fbdev_client_hotplug+0x2bc/0x4d0 [drm_kms_helper] drm_client_register+0x169/0x240 [drm] ast_pci_probe+0x142/0x190 [ast] local_pci_probe+0xdc/0x180 work_for_cpu_fn+0x4e/0xa0 process_one_work+0x8b7/0x1540 worker_thread+0x70a/0xed0 kthread+0x29f/0x340 ret_from_fork+0x1f/0x30
--- drivers/gpu/drm/drm_client_modeset.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/drm_client_modeset.c +1 -0
@@ -867,6 +867,7 @@ int drm_client_modeset_probe(struct drm_break ; } +kfree (modeset->mode); modeset->mode =drm_mode_duplicate (dev, mode);drm_connector_get (connector); modeset->connectors[modeset->num_connectors++] = connector;
Greg Kroah-Hartman
maintainerPATCH 52/227 drm/amd/display: only accept async flips for fast updates
In reply to Greg Kroah-HartmanFrom: Simon Ser <[email protected]>
commit 1ca67aba8d11c2849d395013e1fdce02918d5657 upstream.
Up until now, amdgpu was silently degrading to vsync when user-space requested an async flip but the hardware didn't support it.
The hardware doesn't support immediate flips when the update changes the FB pitch, the DCC state, the rotation, enables or disables CRTCs or planes, etc. This is reflected in the dm_crtc_state.update_type
field: UPDATE_TYPE_FAST means that immediate flip is supported.
Silently degrading async flips to vsync is not the expected behavior from a uAPI point-of-view. Xorg expects async flips to fail if unsupported, to be able to fall back to a blit. i915 already behaves this way.
This patch aligns amdgpu with uAPI expectations and returns a failure when an async flip is not possible.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 8 ++++++++ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c | 12 ++++++++++++ 2 files changed, 20 insertions(+)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +8 -0
@@ -8055,7 +8055,15 @@ static void amdgpu_dm_commit_planes(stru* Only allow immediate flips for fast updates that don't * change memory domain, FB pitch, DCC state, rotation or * mirroring. +* +* dm_crtc_helper_atomic_check() only accepts async flips with +* fast updates. */ +if (crtc->state->async_flip && + acrtc_state->update_type !=UPDATE_TYPE_FAST ) +drm_warn_once (state->dev, +"[PLANE:%d:%s] async flip with non-fast update\n" , + plane->base.id, plane->name); bundle->flip_addrs[planes_count].flip_immediate = crtc->state->async_flip && acrtc_state->update_type == UPDATE_TYPE_FAST &&
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crtc.c +12 -0
@@ -398,6 +398,18 @@ static int dm_crtc_helper_atomic_check(sreturn -EINVAL ; } +/* +* Only allow async flips for fast updates that don't change the FB +* pitch, the DCC state, rotation, etc. +*/ +if (crtc_state->async_flip && + dm_crtc_state->update_type !=UPDATE_TYPE_FAST ) { +drm_dbg_atomic (crtc->dev, +"[CRTC:%d:%s] async flips are only supported for fast updates\n" , + crtc->base.id, crtc->name); +return -EINVAL ; + } +/* In some use cases, like reset, no stream is attached */ if (!dm_crtc_state->stream)return 0 ;
Greg Kroah-Hartman
maintainerPATCH 53/227 drm/amd/display: Disable MPC split by default on special asic
In reply to Greg Kroah-HartmanFrom: Zhikai Zhai <[email protected]>
commit a460beefe77d780ac48f19d39333852a7f93ffc1 upstream.
[WHY]
All of pipes will be used when the MPC split enable on the dcn which just has 2 pipes. Then MPO enter will trigger the minimal transition which need programe dcn from 2 pipes MPC split to 2 pipes MPO. This action will cause lag if happen frequently.
[HOW]
Disable the MPC split for the platform which dcn resource is limited
--- drivers/gpu/drm/amd/display/dc/dcn303/dcn303_resource.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dcn303/dcn303_resource.c +1 -1
@@ -65,7 +65,7 @@ static const struct dc_debug_options deb .timing_trace = false, .clock_trace = true, .disable_pplib_clock_request = true, - .pipe_split_policy = MPC_SPLIT_DYNAMIC, + .pipe_split_policy = MPC_SPLIT_AVOID, .force_single_disp_pipe_split = false, .disable_dcc = DCC_ENABLE, .vsr_support = true,
Greg Kroah-Hartman
maintainerPATCH 54/227 drm/amd/display: check TG is non-null before checking if enabled
In reply to Greg Kroah-HartmanFrom: Taimur Hassan <[email protected]>
commit 5a25cefc0920088bb9afafeb80ad3dcd84fe278b upstream.
[Why & How]
If there is no TG allocation we can dereference a NULL pointer when checking if the TG is enabled.
--- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +2 -1
@@ -3309,7 +3309,8 @@ void dcn10_wait_for_mpcc_disconnect(if (pipe_ctx->stream_res.opp->mpcc_disconnect_pending[mpcc_inst]) {struct hubp *hubp =get_hubp_by_inst (res_pool, mpcc_inst); -if (pipe_ctx->stream_res.tg->funcs->is_tg_enabled (pipe_ctx->stream_res.tg)) +if (pipe_ctx->stream_res.tg && + pipe_ctx->stream_res.tg->funcs->is_tg_enabled (pipe_ctx->stream_res.tg)) res_pool->mpc->funcs->wait_for_idle (res_pool->mpc, mpcc_inst); pipe_ctx->stream_res.opp->mpcc_disconnect_pending[mpcc_inst] = false; hubp->funcs->set_blank (hubp, true);
Greg Kroah-Hartman
maintainerPATCH 55/227 drm/amd/display: Keep PHY active for DP displays on DCN31
In reply to Greg Kroah-HartmanFrom: Nicholas Kazlauskas <[email protected]>
commit 2387ccf43e3c6cb5dbd757c5ef410cca9f14b971 upstream.
[Why & How]
Port of a change that went into DCN314 to keep the PHY enabled when we have a connected and active DP display.
The PHY can hang if PHY refclk is disabled inadvertently.
--- drivers/gpu/drm/amd/display/dc/clk_mgr/dcn31/dcn31_clk_mgr.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn31/dcn31_clk_mgr.c +5 -0
@@ -87,6 +87,11 @@ static int dcn31_get_active_display_cnt_ stream->signal == SIGNAL_TYPE_DVI_SINGLE_LINK || stream->signal == SIGNAL_TYPE_DVI_DUAL_LINK) tmds_present = true; + +/* Checking stream / link detection ensuring that PHY is active*/ +if (dc_is_dp_signal (stream->signal) && !stream->dpms_off) + display_count++; + }for (i =0 ; i < dc->link_count; i++) {
Greg Kroah-Hartman
maintainerPATCH 56/227 ASoC: fsl_sai: Disable bit clock with transmitter
In reply to Greg Kroah-HartmanFrom: Matus Gajdos <[email protected]>
commit 269f399dc19f0e5c51711c3ba3bd06e0ef6ef403 upstream.
Otherwise bit clock remains running writing invalid data to the DAC.
--- sound/soc/fsl/fsl_sai.c | 2 +- sound/soc/fsl/fsl_sai.h | 1 + 2 files changed, 2 insertions(+), 1 deletion(-)
sound/soc/fsl/fsl_sai.c +1 -1
@@ -719,7 +719,7 @@ static void fsl_sai_config_disable(strucu32 xcsr, count =100 ;regmap_update_bits (sai->regmap,FSL_SAI_xCSR (tx, ofs), -FSL_SAI_CSR_TERE ,0 ); +FSL_SAI_CSR_TERE |FSL_SAI_CSR_BCE ,0 );/* TERE will remain set till the end of current frame */ do {
sound/soc/fsl/fsl_sai.h +1 -0
@@ -91,6 +91,7 @@/* SAI Transmit/Receive Control Register */ #define FSL_SAI_CSR_TERE BIT(31)#define FSL_SAI_CSR_SE BIT(30) +#define FSL_SAI_CSR_BCE BIT(28)#define FSL_SAI_CSR_FR BIT(25)#define FSL_SAI_CSR_SR BIT(24)#define FSL_SAI_CSR_xF_SHIFT 16
Greg Kroah-Hartman
maintainerPATCH 57/227 ASoC: fsl_sai: Revert "ASoC: fsl_sai: Enable MCTL_MCLK_EN bit for master mode"
In reply to Greg Kroah-HartmanFrom: Fabio Estevam <[email protected]>
commit 86867aca7330e4fbcfa2a117e20b48bbb6c758a9 upstream.
This reverts commit ff87d619ac180444db297f043962a5c325ded47b.
Andreas reports that on an i.MX8MP-based system where MCLK needs to be used as an input, the MCLK pin is actually an output, despite not having the 'fsl,sai-mclk-direction-output' property present in the devicetree.
This is caused by commit ff87d619ac18 ("ASoC: fsl_sai: Enable MCTL_MCLK_EN bit for master mode") that sets FSL_SAI_MCTL_MCLK_EN unconditionally for imx8mm/8mn/8mp/93, causing the MCLK to always be configured as output.
FSL_SAI_MCTL_MCLK_EN corresponds to the MOE (MCLK Output Enable) bit of register MCR and the drivers sets it when the 'fsl,sai-mclk-direction-output' devicetree property is present.
Revert the commit to allow SAI to use MCLK as input as well.
--- sound/soc/fsl/fsl_sai.c | 6 ------ 1 file changed, 6 deletions(-)
sound/soc/fsl/fsl_sai.c +0 -6
@@ -507,12 +507,6 @@ static int fsl_sai_set_bclk(struct snd_s savediv / 2 - 1); } -if (sai->soc_data->max_register >=FSL_SAI_MCTL ) { -/* SAI is in master mode at this point, so enable MCLK */ -regmap_update_bits (sai->regmap,FSL_SAI_MCTL , -FSL_SAI_MCTL_MCLK_EN ,FSL_SAI_MCTL_MCLK_EN ); - } -return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 58/227 ASoC: tegra: Fix ADX byte map
In reply to Greg Kroah-HartmanFrom: Sheetal <[email protected]>
commit 6dfe70be0b0dec0f9297811501bec26c05fd96ad upstream.
Byte mask for channel-1 of stream-1 is not getting enabled and this causes failures during ADX use cases. This happens because the byte map value 0 matches the byte map array and put() callback returns without enabling the corresponding bits in the byte mask.
ADX supports 4 output streams and each stream can have a maximum of 16 channels. Each byte in the input frame is uniquely mapped to a byte in one of these 4 outputs. This mapping is done with the help of byte map array via user space control setting. The byte map array size in the driver is 16 and each array element is of size 4 bytes. This corresponds to 64 byte map values.
Each byte in the byte map array can have any value between 0 to 255 to enable the corresponding bits in the byte mask. The value 256 is used as a way to disable the byte map. However the byte map array element cannot store this value. The put() callback disables the byte mask for 256 value and byte map value is reset to 0 for this case. This causes problems during subsequent runs since put() callback, for value of 0, just returns without enabling the byte mask. In short, the problem is coming because 0 and 256 control values are stored as 0 in the byte map array.
Right now fix the put() callback by actually looking at the byte mask array state to identify if any change is needed and update the fields accordingly. The get() callback needs an update as well to return the correct control value that user has set before. Note that when user set 256, the value is stored as 0 and byte mask is disabled. So byte mask state is used to either return 256 or the value from byte map array.
Given above, this looks bit complicated and all this happens because the byte map array is tightly packed and cannot actually store the 256 value. Right now the priority is to fix the existing failure and a TODO item is put to improve this logic.
--- sound/soc/tegra/tegra210_adx.c | 34 ++++++++++++++++++++++------------ 1 file changed, 22 insertions(+), 12 deletions(-)
sound/soc/tegra/tegra210_adx.c +22 -12
@@ -2,7 +2,7 @@// // tegra210_adx.c - Tegra210 ADX driver // -// Copyright (c) 2021 NVIDIA CORPORATION. All rights reserved. +// Copyright (c) 2021-2023 NVIDIA CORPORATION. All rights reserved. #include <linux/clk.h> #include <linux/device.h>
@@ -175,10 +175,20 @@ static int tegra210_adx_get_byte_map(str mc = (struct soc_mixer_control *)kcontrol->private_value; enabled = adx->byte_mask[mc->reg /32 ] & (1 << (mc->reg %32 )); +/* +* TODO: Simplify this logic to just return from bytes_map[] +* +* Presently below is required since bytes_map[] is +* tightly packed and cannot store the control value of 256. +* Byte mask state is used to know if 256 needs to be returned. +* Note that for control value of 256, the put() call stores 0 +* in the bytes_map[] and disables the corresponding bit in +* byte_mask[]. +*/ if (enabled) ucontrol->value.integer.value[0 ] = bytes_map[mc->reg];else - ucontrol->value.integer.value[0 ] =0 ; + ucontrol->value.integer.value[0 ] =256 ;return 0 ; }
@@ -192,19 +202,19 @@ static int tegra210_adx_put_byte_map(strint value = ucontrol->value.integer.value[0 ];struct soc_mixer_control *mc = (struct soc_mixer_control *)kcontrol->private_value; +unsigned int mask_val = adx->byte_mask[mc->reg /32 ]; -if (value == bytes_map[mc->reg]) +if (value >=0 && value <=255 ) + mask_val |= (1 << (mc->reg %32 )); +else + mask_val &= ~(1 << (mc->reg %32 )); + +if (mask_val == adx->byte_mask[mc->reg /32 ])return 0 ; -if (value >=0 && value <=255 ) { -/* update byte map and enable slot */ - bytes_map[mc->reg] = value; - adx->byte_mask[mc->reg /32 ] |= (1 << (mc->reg %32 )); - }else { -/* reset byte map and disable slot */ - bytes_map[mc->reg] =0 ; - adx->byte_mask[mc->reg /32 ] &= ~(1 << (mc->reg %32 )); - } +/* Update byte map and slot */ + bytes_map[mc->reg] = value %256 ; + adx->byte_mask[mc->reg /32 ] = mask_val;return 1 ; }
Greg Kroah-Hartman
maintainerPATCH 59/227 ASoC: rt5640: Fix sleep in atomic context
In reply to Greg Kroah-HartmanFrom: Sameer Pujar <[email protected]>
commit 70a6404ff610aa4889d98977da131c37f9ff9d1f upstream.
Following prints are observed while testing audio on Jetson AGX Orin which has onboard RT5640 audio codec:
BUG: sleeping function called from invalid context at kernel/workqueue.c:3027 in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 0, name: swapper/0 preempt_count: 10001, expected: 0 RCU nest depth: 0, expected: 0 ------------[ cut here ]------------ WARNING: CPU: 0 PID: 0 at kernel/irq/handle.c:159 __handle_irq_event_percpu+0x1e0/0x270 ---[ end trace ad1c64905aac14a6 ]-
The IRQ handler rt5640_irq() runs in interrupt context and can sleep during cancel_delayed_work_sync().
Fix this by running IRQ handler, rt5640_irq(), in thread context. Hence replace request_irq() calls with devm_request_threaded_irq().
--- sound/soc/codecs/rt5640.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
sound/soc/codecs/rt5640.c +7 -5
@@ -2567,9 +2567,10 @@ static void rt5640_enable_jack_detect(stif (jack_data && jack_data->use_platform_clock) rt5640->use_platform_clock = jack_data->use_platform_clock; - ret =request_irq (rt5640->irq, rt5640_irq, -IRQF_TRIGGER_RISING |IRQF_TRIGGER_FALLING |IRQF_ONESHOT , -"rt5640" , rt5640); + ret =devm_request_threaded_irq (component->dev, rt5640->irq, +NULL , rt5640_irq, +IRQF_TRIGGER_RISING |IRQF_TRIGGER_FALLING |IRQF_ONESHOT , +"rt5640" , rt5640);if (ret) {dev_warn (component->dev,"Failed to reguest IRQ %d: %d\n" , rt5640->irq, ret);rt5640_disable_jack_detect (component);
@@ -2622,8 +2623,9 @@ static void rt5640_enable_hda_jack_detec rt5640->jack = jack; - ret =request_irq (rt5640->irq, rt5640_irq, -IRQF_TRIGGER_RISING |IRQF_ONESHOT ,"rt5640" , rt5640); + ret =devm_request_threaded_irq (component->dev, rt5640->irq, +NULL , rt5640_irq,IRQF_TRIGGER_RISING |IRQF_ONESHOT , +"rt5640" , rt5640);if (ret) {dev_warn (component->dev,"Failed to reguest IRQ %d: %d\n" , rt5640->irq, ret); rt5640->irq = -ENXIO ;
Greg Kroah-Hartman
maintainerPATCH 60/227 ASoC: cs42l51: fix driver to properly autoload with automatic module loading
In reply to Greg Kroah-HartmanFrom: Thomas Petazzoni <[email protected]>
commit e51df4f81b02bcdd828a04de7c1eb6a92988b61e upstream.
In commit 2cb1e0259f50 ("ASoC: cs42l51: re-hook of_match_table pointer"), 9 years ago, some random guy fixed the cs42l51 after it was split into a core part and an I2C part to properly match based on a Device Tree compatible string.
However, the fix in this commit is wrong: the MODULE_DEVICE_TABLE(of, ....) is in the core part of the driver, not the I2C part. Therefore, automatic module loading based on module.alias, based on matching with the DT compatible string, loads the core part of the driver, but not the I2C part. And threfore, the i2c_driver is not registered, and the codec is not known to the system, nor matched with a DT node with the corresponding compatible string.
In order to fix that, we move the MODULE_DEVICE_TABLE(of, ...) into the I2C part of the driver. The cs42l51_of_match[] array is also moved as well, as it is not possible to have this definition in one file, and the MODULE_DEVICE_TABLE(of, ...) invocation in another file, due to how MODULE_DEVICE_TABLE works.
Thanks to this commit, the I2C part of the driver now properly autoloads, and thanks to its dependency on the core part, the core part gets autoloaded as well, resulting in a functional sound card without having to manually load kernel modules.
--- sound/soc/codecs/cs42l51-i2c.c | 6 ++++++ sound/soc/codecs/cs42l51.c | 7 ------- sound/soc/codecs/cs42l51.h | 1 - 3 files changed, 6 insertions(+), 8 deletions(-)
sound/soc/codecs/cs42l51-i2c.c +6 -0
@@ -19,6 +19,12 @@ static struct i2c_device_id cs42l51_i2c_ };MODULE_DEVICE_TABLE (i2c, cs42l51_i2c_id); +const struct of_device_id cs42l51_of_match[] = { + { .compatible ="cirrus,cs42l51" , }, + { } +}; +MODULE_DEVICE_TABLE (of, cs42l51_of_match); +static int cs42l51_i2c_probe (struct i2c_client *i2c) {struct regmap_config config;
sound/soc/codecs/cs42l51.c +0 -7
@@ -826,13 +826,6 @@ int __maybe_unused cs42l51_resume(struct }EXPORT_SYMBOL_GPL (cs42l51_resume); -const struct of_device_id cs42l51_of_match[] = { - { .compatible ="cirrus,cs42l51" , }, - { } -}; -MODULE_DEVICE_TABLE (of, cs42l51_of_match); -EXPORT_SYMBOL_GPL (cs42l51_of_match); -MODULE_AUTHOR ("Arnaud Patard <[email protected]>" );MODULE_DESCRIPTION ("Cirrus Logic CS42L51 ALSA SoC Codec Driver" );MODULE_LICENSE ("GPL" );
sound/soc/codecs/cs42l51.h +0 -1
@@ -16,7 +16,6 @@ int cs42l51_probe(struct device *dev, stvoid cs42l51_remove (struct device *dev);int __maybe_unused cs42l51_suspend (struct device *dev);int __maybe_unused cs42l51_resume (struct device *dev); -extern const struct of_device_id cs42l51_of_match[];#define CS42L51_CHIP_ID 0x1B#define CS42L51_CHIP_REV_A 0x00
Greg Kroah-Hartman
maintainerPATCH 61/227 ASoC: codecs: wcd938x: fix missing clsh ctrl error handling
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit ed0dd9205bf69593edb495cb4b086dbae96a3f05 upstream.
Allocation of the clash control structure may fail so add the missing error handling to avoid dereferencing an error pointer.
--- sound/soc/codecs/wcd938x.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/soc/codecs/wcd938x.c +4 -0
@@ -3090,6 +3090,10 @@ static int wcd938x_soc_codec_probe(struc WCD938X_ID_MASK); wcd938x->clsh_info =wcd_clsh_ctrl_alloc (component,WCD938X ); +if (IS_ERR (wcd938x->clsh_info)) { +pm_runtime_put (dev); +return PTR_ERR (wcd938x->clsh_info); + }wcd938x_io_init (wcd938x);/* Set all interrupts as edge triggered */
Greg Kroah-Hartman
maintainerPATCH 62/227 ASoC: cs35l45: Select REGMAP_IRQ
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit d9ba2975e98a4bec0a9f8d4be4c1de8883fccb71 upstream.
After commit 6085f9e6dc19 ("ASoC: cs35l45: IRQ support"), without any other configuration that selects CONFIG_REGMAP_IRQ, modpost errors out with:
ERROR: modpost: "regmap_irq_get_virq" [sound/soc/codecs/snd-soc-cs35l45.ko] undefined!
ERROR: modpost: "devm_regmap_add_irq_chip" [sound/soc/codecs/snd-soc-cs35l45.ko] undefined!
Add the Kconfig selection to ensure these functions get built and included, which resolves the build failure.
--- sound/soc/codecs/Kconfig | 1 + 1 file changed, 1 insertion(+)
sound/soc/codecs/Kconfig +1 -0
@@ -701,6 +701,7 @@ config SND_SOC_CS35L41_I2C config SND_SOC_CS35L45 tristate + select REGMAP_IRQ config SND_SOC_CS35L45_SPI tristate "Cirrus Logic CS35L45 CODEC (SPI)"
Greg Kroah-Hartman
maintainerPATCH 63/227 ASoC: codecs: wcd-mbhc-v2: fix resource leaks on component remove
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit a5475829adcc600bc69ee9ff7c9e3e43fb4f8d30 upstream.
The MBHC resources must be released on component probe failure and removal so can not be tied to the lifetime of the component device.
This is specifically needed to allow probe deferrals of the sound card which otherwise fails when reprobing the codec component:
snd-sc8280xp sound: ASoC: failed to instantiate card -517
genirq: Flags mismatch irq 299. 00002001 (mbhc sw intr) vs. 00002001 (mbhc sw intr) wcd938x_codec audio-codec: Failed to request mbhc interrupts -16 wcd938x_codec audio-codec: mbhc initialization failed
wcd938x_codec audio-codec: ASoC: error at snd_soc_component_probe on audio-codec: -16 snd-sc8280xp sound: ASoC: failed to instantiate card -16
--- sound/soc/codecs/wcd-mbhc-v2.c | 57 +++++++++++++++++++++++++++++------------ 1 file changed, 41 insertions(+), 16 deletions(-)
sound/soc/codecs/wcd-mbhc-v2.c +41 -16
@@ -1454,7 +1454,7 @@ struct wcd_mbhc *wcd_mbhc_init(struct snreturn ERR_PTR (-EINVAL ); } - mbhc =devm_kzalloc (dev,sizeof (*mbhc),GFP_KERNEL ); + mbhc =kzalloc (sizeof (*mbhc),GFP_KERNEL );if (!mbhc)return ERR_PTR (-ENOMEM );
@@ -1474,61 +1474,76 @@ struct wcd_mbhc *wcd_mbhc_init(struct snINIT_WORK (&mbhc->correct_plug_swch, wcd_correct_swch_plug); - ret =devm_request_threaded_irq (dev, mbhc->intr_ids->mbhc_sw_intr,NULL , + ret =request_threaded_irq (mbhc->intr_ids->mbhc_sw_intr,NULL , wcd_mbhc_mech_plug_detect_irq,IRQF_ONESHOT |IRQF_TRIGGER_RISING ,"mbhc sw intr" , mbhc);if (ret) - goto err; + goto err_free_mbhc; - ret =devm_request_threaded_irq (dev, mbhc->intr_ids->mbhc_btn_press_intr,NULL , + ret =request_threaded_irq (mbhc->intr_ids->mbhc_btn_press_intr,NULL , wcd_mbhc_btn_press_handler,IRQF_ONESHOT |IRQF_TRIGGER_RISING ,"Button Press detect" , mbhc);if (ret) - goto err; + goto err_free_sw_intr; - ret =devm_request_threaded_irq (dev, mbhc->intr_ids->mbhc_btn_release_intr,NULL , + ret =request_threaded_irq (mbhc->intr_ids->mbhc_btn_release_intr,NULL , wcd_mbhc_btn_release_handler,IRQF_ONESHOT |IRQF_TRIGGER_RISING ,"Button Release detect" , mbhc);if (ret) - goto err; + goto err_free_btn_press_intr; - ret =devm_request_threaded_irq (dev, mbhc->intr_ids->mbhc_hs_ins_intr,NULL , + ret =request_threaded_irq (mbhc->intr_ids->mbhc_hs_ins_intr,NULL , wcd_mbhc_adc_hs_ins_irq,IRQF_ONESHOT |IRQF_TRIGGER_RISING ,"Elect Insert" , mbhc);if (ret) - goto err; + goto err_free_btn_release_intr;disable_irq_nosync (mbhc->intr_ids->mbhc_hs_ins_intr); - ret =devm_request_threaded_irq (dev, mbhc->intr_ids->mbhc_hs_rem_intr,NULL , + ret =request_threaded_irq (mbhc->intr_ids->mbhc_hs_rem_intr,NULL , wcd_mbhc_adc_hs_rem_irq,IRQF_ONESHOT |IRQF_TRIGGER_RISING ,"Elect Remove" , mbhc);if (ret) - goto err; + goto err_free_hs_ins_intr;disable_irq_nosync (mbhc->intr_ids->mbhc_hs_rem_intr); - ret =devm_request_threaded_irq (dev, mbhc->intr_ids->hph_left_ocp,NULL , + ret =request_threaded_irq (mbhc->intr_ids->hph_left_ocp,NULL , wcd_mbhc_hphl_ocp_irq,IRQF_ONESHOT |IRQF_TRIGGER_RISING ,"HPH_L OCP detect" , mbhc);if (ret) - goto err; + goto err_free_hs_rem_intr; - ret =devm_request_threaded_irq (dev, mbhc->intr_ids->hph_right_ocp,NULL , + ret =request_threaded_irq (mbhc->intr_ids->hph_right_ocp,NULL , wcd_mbhc_hphr_ocp_irq,IRQF_ONESHOT |IRQF_TRIGGER_RISING ,"HPH_R OCP detect" , mbhc);if (ret) - goto err; + goto err_free_hph_left_ocp;return mbhc; -err: + +err_free_hph_left_ocp: +free_irq (mbhc->intr_ids->hph_left_ocp, mbhc); +err_free_hs_rem_intr: +free_irq (mbhc->intr_ids->mbhc_hs_rem_intr, mbhc); +err_free_hs_ins_intr: +free_irq (mbhc->intr_ids->mbhc_hs_ins_intr, mbhc); +err_free_btn_release_intr: +free_irq (mbhc->intr_ids->mbhc_btn_release_intr, mbhc); +err_free_btn_press_intr: +free_irq (mbhc->intr_ids->mbhc_btn_press_intr, mbhc); +err_free_sw_intr: +free_irq (mbhc->intr_ids->mbhc_sw_intr, mbhc); +err_free_mbhc: +kfree (mbhc); +dev_err (dev,"Failed to request mbhc interrupts %d\n" , ret);return ERR_PTR (ret);
@@ -1537,9 +1552,19 @@ EXPORT_SYMBOL(wcd_mbhc_init);void wcd_mbhc_deinit (struct wcd_mbhc *mbhc) { +free_irq (mbhc->intr_ids->hph_right_ocp, mbhc); +free_irq (mbhc->intr_ids->hph_left_ocp, mbhc); +free_irq (mbhc->intr_ids->mbhc_hs_rem_intr, mbhc); +free_irq (mbhc->intr_ids->mbhc_hs_ins_intr, mbhc); +free_irq (mbhc->intr_ids->mbhc_btn_release_intr, mbhc); +free_irq (mbhc->intr_ids->mbhc_btn_press_intr, mbhc); +free_irq (mbhc->intr_ids->mbhc_sw_intr, mbhc); +mutex_lock (&mbhc->lock);wcd_cancel_hs_detect_plug (mbhc, &mbhc->correct_plug_swch);mutex_unlock (&mbhc->lock); + +kfree (mbhc); }EXPORT_SYMBOL (wcd_mbhc_deinit);
Greg Kroah-Hartman
maintainerPATCH 64/227 ASoC: qdsp6: audioreach: fix topology probe deferral
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 46ec420573cefa1fc98025e7e6841bdafd6f1e20 upstream.
Propagate errors when failing to load the topology component so that probe deferrals can be handled.
--- sound/soc/qcom/qdsp6/topology.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/qcom/qdsp6/topology.c +2 -2
@@ -1277,8 +1277,8 @@ int audioreach_tplg_init(struct snd_soc_ ret =snd_soc_tplg_component_load (component, &audioreach_tplg_ops, fw);if (ret <0 ) { -dev_err (dev,"tplg component load failed%d\n" , ret); - ret = -EINVAL ; +if (ret != -EPROBE_DEFER ) +dev_err (dev,"tplg component load failed: %d\n" , ret); }release_firmware (fw);
Greg Kroah-Hartman
maintainerPATCH 65/227 ASoC: tegra: Fix AMX byte map
In reply to Greg Kroah-HartmanFrom: Sheetal <[email protected]>
commit 49bd7b08149417a30aa7d92c8c85b3518de44a76 upstream.
Byte mask for channel-1 of stream-1 is not getting enabled and this causes failures during AMX use cases. This happens because the byte map value 0 matches the byte map array and put() callback returns without enabling the corresponding bits in the byte mask.
AMX supports 4 input streams and each stream can take a maximum of 16 channels. Each byte in the output frame is uniquely mapped to a byte in one of these 4 inputs. This mapping is done with the help of byte map array via user space control setting. The byte map array size in the driver is 16 and each array element is of size 4 bytes. This corresponds to 64 byte map values.
Each byte in the byte map array can have any value between 0 to 255 to enable the corresponding bits in the byte mask. The value 256 is used as a way to disable the byte map. However the byte map array element cannot store this value. The put() callback disables the byte mask for 256 value and byte map value is reset to 0 for this case. This causes problems during subsequent runs since put() callback, for value of 0, just returns without enabling the byte mask. In short, the problem is coming because 0 and 256 control values are stored as 0 in the byte map array.
Right now fix the put() callback by actually looking at the byte mask array state to identify if any change is needed and update the fields accordingly. The get() callback needs an update as well to return the correct control value that user has set before. Note that when user sets 256, the value is stored as 0 and byte mask is disabled. So byte mask state is used to either return 256 or the value from byte map array.
Given above, this looks bit complicated and all this happens because the byte map array is tightly packed and cannot actually store the 256 value. Right now the priority is to fix the existing failure and a TODO item is put to improve this logic.
--- sound/soc/tegra/tegra210_amx.c | 40 ++++++++++++++++++++++------------------ 1 file changed, 22 insertions(+), 18 deletions(-)
sound/soc/tegra/tegra210_amx.c +22 -18
@@ -2,7 +2,7 @@// // tegra210_amx.c - Tegra210 AMX driver // -// Copyright (c) 2021 NVIDIA CORPORATION. All rights reserved. +// Copyright (c) 2021-2023 NVIDIA CORPORATION. All rights reserved. #include <linux/clk.h> #include <linux/device.h>
@@ -203,10 +203,20 @@ static int tegra210_amx_get_byte_map(strelse enabled = amx->byte_mask[0 ] & (1 << reg); +/* +* TODO: Simplify this logic to just return from bytes_map[] +* +* Presently below is required since bytes_map[] is +* tightly packed and cannot store the control value of 256. +* Byte mask state is used to know if 256 needs to be returned. +* Note that for control value of 256, the put() call stores 0 +* in the bytes_map[] and disables the corresponding bit in +* byte_mask[]. +*/ if (enabled) ucontrol->value.integer.value[0 ] = bytes_map[reg];else - ucontrol->value.integer.value[0 ] =0 ; + ucontrol->value.integer.value[0 ] =256 ;return 0 ; }
@@ -221,25 +231,19 @@ static int tegra210_amx_put_byte_map(strunsigned char *bytes_map = (unsigned char *)&amx->map;int reg = mc->reg;int value = ucontrol->value.integer.value[0 ]; +unsigned int mask_val = amx->byte_mask[reg /32 ]; -if (value == bytes_map[reg]) +if (value >=0 && value <=255 ) + mask_val |= (1 << (reg %32 )); +else + mask_val &= ~(1 << (reg %32 )); + +if (mask_val == amx->byte_mask[reg /32 ])return 0 ; -if (value >=0 && value <=255 ) { -/* Update byte map and enable slot */ - bytes_map[reg] = value; -if (reg >31 ) - amx->byte_mask[1 ] |= (1 << (reg -32 )); -else - amx->byte_mask[0 ] |= (1 << reg); - }else { -/* Reset byte map and disable slot */ - bytes_map[reg] =0 ; -if (reg >31 ) - amx->byte_mask[1 ] &= ~(1 << (reg -32 )); -else - amx->byte_mask[0 ] &= ~(1 << reg); - } +/* Update byte map and slot */ + bytes_map[reg] = value %256 ; + amx->byte_mask[reg /32 ] = mask_val;return 1 ; }
Greg Kroah-Hartman
maintainerPATCH 66/227 ASoC: codecs: wcd938x: fix resource leaks on component remove
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit a3406f87775fee986876e03f93a84385f54d5999 upstream.
Make sure to release allocated resources on component probe failure and on remove.
This is specifically needed to allow probe deferrals of the sound card which otherwise fails when reprobing the codec component:
snd-sc8280xp sound: ASoC: failed to instantiate card -517
genirq: Flags mismatch irq 289. 00002001 (HPHR PDM WD INT) vs. 00002001 (HPHR PDM WD INT)
wcd938x_codec audio-codec: Failed to request HPHR WD interrupt (-16)
genirq: Flags mismatch irq 290. 00002001 (HPHL PDM WD INT) vs. 00002001 (HPHL PDM WD INT)
wcd938x_codec audio-codec: Failed to request HPHL WD interrupt (-16)
genirq: Flags mismatch irq 291. 00002001 (AUX PDM WD INT) vs. 00002001 (AUX PDM WD INT)
wcd938x_codec audio-codec: Failed to request Aux WD interrupt (-16)
genirq: Flags mismatch irq 292. 00002001 (mbhc sw intr) vs. 00002001 (mbhc sw intr)
wcd938x_codec audio-codec: Failed to request mbhc interrupts -16--- sound/soc/codecs/wcd938x.c | 55 +++++++++++++++++++++++++++++++++++++++------ 1 file changed, 48 insertions(+), 7 deletions(-)
sound/soc/codecs/wcd938x.c +48 -7
@@ -2633,6 +2633,14 @@ static int wcd938x_mbhc_init(struct snd_return 0 ; } + +static void wcd938x_mbhc_deinit (struct snd_soc_component *component) +{ +struct wcd938x_priv *wcd938x =snd_soc_component_get_drvdata (component); + +wcd_mbhc_deinit (wcd938x->wcd_mbhc); +} +/* END MBHC */ static const struct snd_kcontrol_new wcd938x_snd_controls[] = {
@@ -3113,20 +3121,26 @@ static int wcd938x_soc_codec_probe(struc ret =request_threaded_irq (wcd938x->hphr_pdm_wd_int,NULL , wcd938x_wd_handle_irq,IRQF_ONESHOT |IRQF_TRIGGER_RISING ,"HPHR PDM WD INT" , wcd938x); -if (ret) +if (ret) {dev_err (dev,"Failed to request HPHR WD interrupt (%d)\n" , ret); + goto err_free_clsh_ctrl; + } ret =request_threaded_irq (wcd938x->hphl_pdm_wd_int,NULL , wcd938x_wd_handle_irq,IRQF_ONESHOT |IRQF_TRIGGER_RISING ,"HPHL PDM WD INT" , wcd938x); -if (ret) +if (ret) {dev_err (dev,"Failed to request HPHL WD interrupt (%d)\n" , ret); + goto err_free_hphr_pdm_wd_int; + } ret =request_threaded_irq (wcd938x->aux_pdm_wd_int,NULL , wcd938x_wd_handle_irq,IRQF_ONESHOT |IRQF_TRIGGER_RISING ,"AUX PDM WD INT" , wcd938x); -if (ret) +if (ret) {dev_err (dev,"Failed to request Aux WD interrupt (%d)\n" , ret); + goto err_free_hphl_pdm_wd_int; + }/* Disable watchdog interrupt for HPH and AUX */ disable_irq_nosync (wcd938x->hphr_pdm_wd_int);
@@ -3141,7 +3155,7 @@ static int wcd938x_soc_codec_probe(strucdev_err (component->dev,"%s: Failed to add snd ctrls for variant: %d\n" , __func__, wcd938x->variant); - goto err; + goto err_free_aux_pdm_wd_int; }break ;case WCD9385 :
@@ -3151,7 +3165,7 @@ static int wcd938x_soc_codec_probe(strucdev_err (component->dev,"%s: Failed to add snd ctrls for variant: %d\n" , __func__, wcd938x->variant); - goto err; + goto err_free_aux_pdm_wd_int; }break ;default :
@@ -3159,12 +3173,38 @@ static int wcd938x_soc_codec_probe(struc } ret =wcd938x_mbhc_init (component); -if (ret) +if (ret) {dev_err (component->dev,"mbhc initialization failed\n" ); -err: + goto err_free_aux_pdm_wd_int; + } + +return 0 ; + +err_free_aux_pdm_wd_int: +free_irq (wcd938x->aux_pdm_wd_int, wcd938x); +err_free_hphl_pdm_wd_int: +free_irq (wcd938x->hphl_pdm_wd_int, wcd938x); +err_free_hphr_pdm_wd_int: +free_irq (wcd938x->hphr_pdm_wd_int, wcd938x); +err_free_clsh_ctrl: +wcd_clsh_ctrl_free (wcd938x->clsh_info); +return ret; } +static void wcd938x_soc_codec_remove (struct snd_soc_component *component) +{ +struct wcd938x_priv *wcd938x =snd_soc_component_get_drvdata (component); + +wcd938x_mbhc_deinit (component); + +free_irq (wcd938x->aux_pdm_wd_int, wcd938x); +free_irq (wcd938x->hphl_pdm_wd_int, wcd938x); +free_irq (wcd938x->hphr_pdm_wd_int, wcd938x); + +wcd_clsh_ctrl_free (wcd938x->clsh_info); +} +static int wcd938x_codec_set_jack (struct snd_soc_component *comp,struct snd_soc_jack *jack,void *data) {
@@ -3181,6 +3221,7 @@ static int wcd938x_codec_set_jack(structstatic const struct snd_soc_component_driver soc_codec_dev_wcd938x = { .name ="wcd938x_codec" , .probe = wcd938x_soc_codec_probe, + .remove = wcd938x_soc_codec_remove, .controls = wcd938x_snd_controls, .num_controls =ARRAY_SIZE (wcd938x_snd_controls), .dapm_widgets = wcd938x_dapm_widgets,
Greg Kroah-Hartman
maintainerPATCH 1/12 drm/radeon: Fix integer overflow in radeon_cs_parser_init
In reply to Greg Kroah-Hartman[ Upstream commit f828b681d0cd566f86351c0b913e6cb6ed8c7b9c ]
The type of size is unsigned, if size is 0x40000000, there will be an integer overflow, size will be zero after size *= sizeof(uint32_t), will cause uninitialized memory to be referenced later
--- drivers/gpu/drm/radeon/radeon_cs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/radeon/radeon_cs.c +2 -1
@@ -270,7 +270,8 @@ int radeon_cs_parser_init(struct radeon_ {struct drm_radeon_cs *cs = data;uint64_t *chunk_array_ptr; -unsigned size, i; +u64 size; +unsigned i;u32 ring =RADEON_CS_RING_GFX ;s32 priority =0 ;
Greg Kroah-Hartman
maintainerPATCH 2/12 ALSA: emu10k1: roll up loops in DSP setup code for Audigy
In reply to Greg Kroah-Hartman[ Upstream commit 8cabf83c7aa54530e699be56249fb44f9505c4f3 ]
There is no apparent reason for the massive code duplication.
--- sound/pci/emu10k1/emufx.c | 112 +++------------------------------------------- 1 file changed, 9 insertions(+), 103 deletions(-)
sound/pci/emu10k1/emufx.c +9 -103
@@ -1559,14 +1559,8 @@ A_OP(icode, &ptr, iMAC0, A_GPR(var), A_G gpr +=2 ;/* Master volume (will be renamed later) */ -A_OP (icode, &ptr, iMAC0,A_GPR (playback+0 +SND_EMU10K1_PLAYBACK_CHANNELS ),A_C_00000000 ,A_GPR (gpr),A_GPR (playback+0 +SND_EMU10K1_PLAYBACK_CHANNELS )); -A_OP (icode, &ptr, iMAC0,A_GPR (playback+1 +SND_EMU10K1_PLAYBACK_CHANNELS ),A_C_00000000 ,A_GPR (gpr),A_GPR (playback+1 +SND_EMU10K1_PLAYBACK_CHANNELS )); -A_OP (icode, &ptr, iMAC0,A_GPR (playback+2 +SND_EMU10K1_PLAYBACK_CHANNELS ),A_C_00000000 ,A_GPR (gpr),A_GPR (playback+2 +SND_EMU10K1_PLAYBACK_CHANNELS )); -A_OP (icode, &ptr, iMAC0,A_GPR (playback+3 +SND_EMU10K1_PLAYBACK_CHANNELS ),A_C_00000000 ,A_GPR (gpr),A_GPR (playback+3 +SND_EMU10K1_PLAYBACK_CHANNELS )); -A_OP (icode, &ptr, iMAC0,A_GPR (playback+4 +SND_EMU10K1_PLAYBACK_CHANNELS ),A_C_00000000 ,A_GPR (gpr),A_GPR (playback+4 +SND_EMU10K1_PLAYBACK_CHANNELS )); -A_OP (icode, &ptr, iMAC0,A_GPR (playback+5 +SND_EMU10K1_PLAYBACK_CHANNELS ),A_C_00000000 ,A_GPR (gpr),A_GPR (playback+5 +SND_EMU10K1_PLAYBACK_CHANNELS )); -A_OP (icode, &ptr, iMAC0,A_GPR (playback+6 +SND_EMU10K1_PLAYBACK_CHANNELS ),A_C_00000000 ,A_GPR (gpr),A_GPR (playback+6 +SND_EMU10K1_PLAYBACK_CHANNELS )); -A_OP (icode, &ptr, iMAC0,A_GPR (playback+7 +SND_EMU10K1_PLAYBACK_CHANNELS ),A_C_00000000 ,A_GPR (gpr),A_GPR (playback+7 +SND_EMU10K1_PLAYBACK_CHANNELS )); +for (z =0 ; z <8 ; z++) +A_OP (icode, &ptr, iMAC0,A_GPR (playback+z+SND_EMU10K1_PLAYBACK_CHANNELS ),A_C_00000000 ,A_GPR (gpr),A_GPR (playback+z+SND_EMU10K1_PLAYBACK_CHANNELS ));snd_emu10k1_init_mono_control (&controls[nctl++],"Wave Master Playback Volume" , gpr,0 ); gpr +=2 ;
@@ -1653,102 +1647,14 @@ A_OP(icode, &ptr, iMAC0, A_GPR(var), A_Gdev_dbg(emu->card->dev, "emufx.c: gpr=0x%x, tmp=0x%x\n", gpr, tmp); */ -/* For the EMU1010: How to get 32bit values from the DSP. High 16bits into L, low 16bits into R. */ -/* A_P16VIN(0) is delayed by one sample, -* so all other A_P16VIN channels will need to also be delayed -*/ -/* Left ADC in. 1 of 2 */ snd_emu10k1_audigy_dsp_convert_32_to_2x16 ( icode, &ptr, tmp, bit_shifter16,A_P16VIN (0x0 ),A_FXBUS2 (0 ) ); -/* Right ADC in 1 of 2 */ - gpr_map[gpr++] =0x00000000 ; -/* Delaying by one sample: instead of copying the input -* value A_P16VIN to output A_FXBUS2 as in the first channel, -* we use an auxiliary register, delaying the value by one -* sample -*/ -snd_emu10k1_audigy_dsp_convert_32_to_2x16 ( icode, &ptr, tmp, bit_shifter16,A_GPR (gpr -1 ),A_FXBUS2 (2 ) ); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0x1 ),A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 ( icode, &ptr, tmp, bit_shifter16,A_GPR (gpr -1 ),A_FXBUS2 (4 ) ); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0x2 ),A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 ( icode, &ptr, tmp, bit_shifter16,A_GPR (gpr -1 ),A_FXBUS2 (6 ) ); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0x3 ),A_C_00000000 ,A_C_00000000 ); -/* For 96kHz mode */ -/* Left ADC in. 2 of 2 */ - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 ( icode, &ptr, tmp, bit_shifter16,A_GPR (gpr -1 ),A_FXBUS2 (0x8 ) ); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0x4 ),A_C_00000000 ,A_C_00000000 ); -/* Right ADC in 2 of 2 */ - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 ( icode, &ptr, tmp, bit_shifter16,A_GPR (gpr -1 ),A_FXBUS2 (0xa ) ); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0x5 ),A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 ( icode, &ptr, tmp, bit_shifter16,A_GPR (gpr -1 ),A_FXBUS2 (0xc ) ); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0x6 ),A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 ( icode, &ptr, tmp, bit_shifter16,A_GPR (gpr -1 ),A_FXBUS2 (0xe ) ); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0x7 ),A_C_00000000 ,A_C_00000000 ); -/* Pavel Hofman - we still have voices, A_FXBUS2s, and -* A_P16VINs available - -* let's add 8 more capture channels - total of 16 -*/ - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 (icode, &ptr, tmp, - bit_shifter16, -A_GPR (gpr -1 ), -A_FXBUS2 (0x10 )); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0x8 ), -A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 (icode, &ptr, tmp, - bit_shifter16, -A_GPR (gpr -1 ), -A_FXBUS2 (0x12 )); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0x9 ), -A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 (icode, &ptr, tmp, - bit_shifter16, -A_GPR (gpr -1 ), -A_FXBUS2 (0x14 )); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0xa ), -A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 (icode, &ptr, tmp, - bit_shifter16, -A_GPR (gpr -1 ), -A_FXBUS2 (0x16 )); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0xb ), -A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 (icode, &ptr, tmp, - bit_shifter16, -A_GPR (gpr -1 ), -A_FXBUS2 (0x18 )); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0xc ), -A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 (icode, &ptr, tmp, - bit_shifter16, -A_GPR (gpr -1 ), -A_FXBUS2 (0x1a )); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0xd ), -A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 (icode, &ptr, tmp, - bit_shifter16, -A_GPR (gpr -1 ), -A_FXBUS2 (0x1c )); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0xe ), -A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 (icode, &ptr, tmp, - bit_shifter16, -A_GPR (gpr -1 ), -A_FXBUS2 (0x1e )); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0xf ), -A_C_00000000 ,A_C_00000000 ); +/* A_P16VIN(0) is delayed by one sample, so all other A_P16VIN channels +* will need to also be delayed; we use an auxiliary register for that. */ +for (z =1 ; z <0x10 ; z++) { +snd_emu10k1_audigy_dsp_convert_32_to_2x16 ( icode, &ptr, tmp, bit_shifter16,A_GPR (gpr),A_FXBUS2 (z *2 ) ); +A_OP (icode, &ptr, iACC3,A_GPR (gpr),A_P16VIN (z),A_C_00000000 ,A_C_00000000 ); + gpr_map[gpr++] =0x00000000 ; + } }#if 0
Greg Kroah-Hartman
maintainerPATCH 3/12 quota: Properly disable quotas when add_dquot_ref() fails
In reply to Greg Kroah-Hartman[ Upstream commit 6a4e3363792e30177cc3965697e34ddcea8b900b ]
When add_dquot_ref() fails (usually due to IO error or ENOMEM), we want to disable quotas we are trying to enable. However dquot_disable() call was passed just the flags we are enabling so in case flags == DQUOT_USAGE_ENABLED dquot_disable() call will just fail with EINVAL instead of properly disabling quotas. Fix the problem by always passing DQUOT_LIMITS_ENABLED | DQUOT_USAGE_ENABLED to dquot_disable() in this case.
Message-Id: <[email protected]>
--- fs/quota/dquot.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/quota/dquot.c +2 -1
@@ -2420,7 +2420,8 @@ int dquot_load_quota_sb(struct super_blo error =add_dquot_ref (sb, type);if (error) -dquot_disable (sb, type, flags); +dquot_disable (sb, type, +DQUOT_USAGE_ENABLED |DQUOT_LIMITS_ENABLED );return error; out_fmt:
Greg Kroah-Hartman
maintainerPATCH 4/12 quota: fix warning in dqgrab()
In reply to Greg Kroah-Hartman[ Upstream commit d6a95db3c7ad160bc16b89e36449705309b52bcb ]
There's issue as follows when do fault injection:
WARNING: CPU: 1 PID: 14870 at include/linux/quotaops.h:51 dquot_disable+0x13b7/0x18c0 Modules linked in: CPU: 1 PID: 14870 Comm: fsconfig Not tainted 6.3.0-next-20230505-00006-g5107a9c821af-dirty #541 RIP: 0010:dquot_disable+0x13b7/0x18c0 RSP: 0018:ffffc9000acc79e0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88825e41b980 RDX: 0000000000000000 RSI: ffff88825e41b980 RDI: 0000000000000002 RBP: ffff888179f68000 R08: ffffffff82087ca7 R09: 0000000000000000 R10: 0000000000000001 R11: ffffed102f3ed026 R12: ffff888179f68130 R13: ffff888179f68110 R14: dffffc0000000000 R15: ffff888179f68118 FS: 00007f450a073740(0000) GS:ffff88882fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe96f2efd8 CR3: 000000025c8ad000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> dquot_load_quota_sb+0xd53/0x1060 dquot_resume+0x172/0x230 ext4_reconfigure+0x1dc6/0x27b0 reconfigure_super+0x515/0xa90 __x64_sys_fsconfig+0xb19/0xd20 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Above issue may happens as follows:
ProcessA ProcessB ProcessCsys_fsconfig
vfs_fsconfig_locked
reconfigure_super
ext4_remount
dquot_suspend -> suspend all type quota
sys_fsconfig
vfs_fsconfig_locked
reconfigure_super
ext4_remount
dquot_resume
ret = dquot_load_quota_sb
add_dquot_ref
do_open -> open file O_RDWR
vfs_open
do_dentry_open
get_write_access
atomic_inc_unless_negative(&inode->i_writecount)
ext4_file_open
dquot_file_open
dquot_initialize
__dquot_initialize
dqget
atomic_inc(&dquot->dq_count);
__dquot_initialize
__dquot_initialize
dqget
if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
ext4_acquire_dquot
-> Return error DQ_ACTIVE_B flag isn't set
dquot_disable
invalidate_dquots
if (atomic_read(&dquot->dq_count))
dqgrab
WARN_ON_ONCE(!test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
-> Trigger warningIn the above scenario, 'dquot->dq_flags' has no DQ_ACTIVE_B is normal when dqgrab().
To solve above issue just replace the dqgrab() use in invalidate_dquots() with atomic_inc(&dquot->dq_count).
Message-Id: <[email protected]>
--- fs/quota/dquot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/quota/dquot.c +1 -1
@@ -555,7 +555,7 @@ restart:continue ;/* Wait for dquot users */ if (atomic_read (&dquot->dq_count)) { -dqgrab (dquot); +atomic_inc (&dquot->dq_count);spin_unlock (&dq_list_lock);/* * Once dqput() wakes us up, we know it's time to free
Greg Kroah-Hartman
maintainerPATCH 5/12 HID: add quirk for 03f0:464a HP Elite Presenter Mouse
In reply to Greg Kroah-Hartman[ Upstream commit 0db117359e47750d8bd310d19f13e1c4ef7fc26a ]
HP Elite Presenter Mouse HID Record Descriptor shows two mouses (Repord ID 0x1 and 0x2), one keypad (Report ID 0x5), two Consumer Controls (Report IDs 0x6 and 0x3). Previous to this commit it registers one mouse, one keypad and one Consumer Control, and it was usable only as a digitl laser pointer (one of the two mouses). This patch defines the 464a USB device ID and enables the HID_QUIRK_MULTI_INPUT quirk for it, allowing to use the device both as a mouse and a digital laser pointer.
--- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-quirks.c | 1 + 2 files changed, 2 insertions(+)
drivers/hid/hid-ids.h +1 -0
@@ -620,6 +620,7 @@#define USB_DEVICE_ID_UGCI_FIGHTING 0x0030#define USB_VENDOR_ID_HP 0x03f0 +#define USB_PRODUCT_ID_HP_ELITE_PRESENTER_MOUSE_464A 0x464a#define USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0A4A 0x0a4a#define USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A 0x0b4a#define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE 0x134a
drivers/hid/hid-quirks.c +1 -0
@@ -96,6 +96,7 @@ static const struct hid_device_id hid_qu { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A096), HID_QUIRK_NO_INIT_REPORTS }, { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A293), HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0A4A), HID_QUIRK_ALWAYS_POLL }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_ELITE_PRESENTER_MOUSE_464A), HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A), HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A), HID_QUIRK_ALWAYS_POLL },
Greg Kroah-Hartman
maintainerPATCH 6/12 ovl: check type and offset of struct vfsmount in ovl_entry
In reply to Greg Kroah-Hartman[ Upstream commit f723edb8a532cd26e1ff0a2b271d73762d48f762 ]
Porting overlayfs to the new amount api I started experiencing random crashes that couldn't be explained easily. So after much debugging and reasoning it became clear that struct ovl_entry requires the point to struct vfsmount to be the first member and of type struct vfsmount.
During the port I added a new member at the beginning of struct ovl_entry which broke all over the place in the form of random crashes and cache corruptions. While there's a comment in ovl_free_fs() to the effect of "Hack! Reuse ofs->layers as a vfsmount array before freeing it" there's no such comment on struct ovl_entry which makes this easy to trip over.
Add a comment and two static asserts for both the offset and the type of pointer in struct ovl_entry.
--- fs/overlayfs/ovl_entry.h | 9 +++++++++ 1 file changed, 9 insertions(+)
fs/overlayfs/ovl_entry.h +9 -0
@@ -32,6 +32,7 @@ struct ovl_sb { };struct ovl_layer { +/* ovl_free_fs() relies on @mnt being the first member! */ struct vfsmount *mnt;/* Trap in ovl inode cache */ struct inode *trap;
@@ -42,6 +43,14 @@ struct ovl_layer {int fsid; }; +/* +* ovl_free_fs() relies on @mnt being the first member when unmounting +* the private mounts created for each layer. Let's check both the +* offset and type. +*/ +static_assert (offsetof(struct ovl_layer , mnt) ==0 ); +static_assert (__same_type(typeof_member (struct ovl_layer ,mnt ),struct vfsmount *)); +struct ovl_path {const struct ovl_layer *layer;struct dentry *dentry;
Greg Kroah-Hartman
maintainerPATCH 7/12 udf: Fix uninitialized array access for some pathnames
In reply to Greg Kroah-Hartman[ Upstream commit 028f6055c912588e6f72722d89c30b401bbcf013 ]
For filenames that begin with . and are between 2 and 5 characters long, UDF charset conversion code would read uninitialized memory in the output buffer. The only practical impact is that the name may be prepended a "unification hash" when it is not actually needed but still it is good to fix this.
--- fs/udf/unicode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/udf/unicode.c +1 -1
@@ -247,7 +247,7 @@ static int udf_name_from_CS0(struct super_block *sb, }if (translate) { -if (str_o_len <=2 && str_o[0 ] =='.' && +if (str_o_len >0 && str_o_len <=2 && str_o[0 ] =='.' && (str_o_len ==1 || str_o[1 ] =='.' )) needsCRC =1 ;if (needsCRC) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 67/227 ASoC: codecs: wcd938x: fix missing mbhc init error handling
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 7dfae2631bfbdebecd35fe7b472ab3cc95c9ed66 upstream.
MBHC initialisation can fail so add the missing error handling to avoid dereferencing an error pointer when later configuring the jack:
Unable to handle kernel paging request at virtual address fffffffffffffff8
pc : wcd_mbhc_start+0x28/0x380 [snd_soc_wcd_mbhc]
lr : wcd938x_codec_set_jack+0x28/0x48 [snd_soc_wcd938x]
Call trace:
wcd_mbhc_start+0x28/0x380 [snd_soc_wcd_mbhc]
wcd938x_codec_set_jack+0x28/0x48 [snd_soc_wcd938x]
snd_soc_component_set_jack+0x28/0x8c [snd_soc_core]
qcom_snd_wcd_jack_setup+0x7c/0x19c [snd_soc_qcom_common]
sc8280xp_snd_init+0x20/0x2c [snd_soc_sc8280xp]
snd_soc_link_init+0x28/0x90 [snd_soc_core]
snd_soc_bind_card+0x628/0xbfc [snd_soc_core]
snd_soc_register_card+0xec/0x104 [snd_soc_core]
devm_snd_soc_register_card+0x4c/0xa4 [snd_soc_core]
sc8280xp_platform_probe+0xf0/0x108 [snd_soc_sc8280xp]--- sound/soc/codecs/wcd938x.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/codecs/wcd938x.c +2 -0
@@ -2625,6 +2625,8 @@ static int wcd938x_mbhc_init(struct snd_ WCD938X_IRQ_HPHR_OCP_INT); wcd938x->wcd_mbhc =wcd_mbhc_init (component, &mbhc_cb, intr_ids, wcd_mbhc_fields, true); +if (IS_ERR (wcd938x->wcd_mbhc)) +return PTR_ERR (wcd938x->wcd_mbhc);snd_soc_add_component_controls (component, impedance_detect_controls,ARRAY_SIZE (impedance_detect_controls));
Greg Kroah-Hartman
maintainerPATCH 8/12 ALSA: hda/realtek: Add quirks for ROG ALLY CS35l41 audio
In reply to Greg Kroah-Hartman[ Upstream commit 724418b84e6248cd27599607b7e5fac365b8e3f5 ]
This requires a patched ACPI table or a firmware from ASUS to work because the system does not come with the _DSD field for the CSC3551.
--- sound/pci/hda/patch_realtek.c | 46 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+)
sound/pci/hda/patch_realtek.c +46 -0
@@ -7136,6 +7136,10 @@ enum {ALC294_FIXUP_ASUS_DUAL_SPK ,ALC285_FIXUP_THINKPAD_X1_GEN7 ,ALC285_FIXUP_THINKPAD_HEADSET_JACK , +ALC294_FIXUP_ASUS_ALLY , +ALC294_FIXUP_ASUS_ALLY_PINS , +ALC294_FIXUP_ASUS_ALLY_VERBS , +ALC294_FIXUP_ASUS_ALLY_SPEAKER ,ALC294_FIXUP_ASUS_HPE ,ALC294_FIXUP_ASUS_COEF_1B , ALC294_FIXUP_ASUS_GX502_HP,
@@ -8449,6 +8453,47 @@ static const struct hda_fixup alc269_fix .chained = true, .chain_id =ALC294_FIXUP_SPK2_TO_DAC1 }, + [ALC294_FIXUP_ASUS_ALLY] = { + .type = HDA_FIXUP_FUNC, + .v.func = cs35l41_fixup_i2c_two, + .chained = true, + .chain_id =ALC294_FIXUP_ASUS_ALLY_PINS + }, + [ALC294_FIXUP_ASUS_ALLY_PINS] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl []) { + {0x19 ,0x03a11050 }, + {0x1a ,0x03a11c30 }, + {0x21 ,0x03211420 }, + { } + }, + .chained = true, + .chain_id =ALC294_FIXUP_ASUS_ALLY_VERBS + }, + [ALC294_FIXUP_ASUS_ALLY_VERBS] = { + .type = HDA_FIXUP_VERBS, + .v.verbs = (const struct hda_verb []) { + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x45 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x5089 }, + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x46 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0004 }, + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x47 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xa47a }, + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x49 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0049 }, + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x4a }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x201b }, + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x6b }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x4278 }, + { } + }, + .chained = true, + .chain_id =ALC294_FIXUP_ASUS_ALLY_SPEAKER + }, + [ALC294_FIXUP_ASUS_ALLY_SPEAKER] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc285_fixup_speaker2_to_dac1, + }, [ALC285_FIXUP_THINKPAD_X1_GEN7] = { .type = HDA_FIXUP_FUNC, .v.func = alc285_fixup_thinkpad_x1_gen7,
@@ -9557,6 +9602,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x1043 ,0x16e3 ,"ASUS UX50" ,ALC269_FIXUP_STEREO_DMIC ),SND_PCI_QUIRK (0x1043 ,0x1740 ,"ASUS UX430UA" ,ALC295_FIXUP_ASUS_DACS ),SND_PCI_QUIRK (0x1043 ,0x17d1 ,"ASUS UX431FL" ,ALC294_FIXUP_ASUS_DUAL_SPK ), +SND_PCI_QUIRK (0x1043 ,0x17f3 ,"ROG Ally RC71L_RC71L" ,ALC294_FIXUP_ASUS_ALLY ),SND_PCI_QUIRK (0x1043 ,0x1881 ,"ASUS Zephyrus S/M" ,ALC294_FIXUP_ASUS_GX502_PINS ),SND_PCI_QUIRK (0x1043 ,0x18b1 ,"Asus MJ401TA" ,ALC256_FIXUP_ASUS_HEADSET_MIC ), SND_PCI_QUIRK(0x1043, 0x18f1, "Asus FX505DT", ALC256_FIXUP_ASUS_HEADSET_MIC),
Greg Kroah-Hartman
maintainerPATCH 9/12 fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev
In reply to Greg Kroah-Hartman[ Upstream commit 4e302336d5ca1767a06beee7596a72d3bdc8d983 ]
Syzkaller reported the following issue:
UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:1965:6 index -84 is out of range for type 's8[341]' (aka 'signed char[341]') CPU: 1 PID: 4995 Comm: syz-executor146 Not tainted 6.4.0-rc6-syzkaller-00037-gb6dad5178cea #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 dbAllocDmapLev+0x3e5/0x430 fs/jfs/jfs_dmap.c:1965 dbAllocCtl+0x113/0x920 fs/jfs/jfs_dmap.c:1809 dbAllocAG+0x28f/0x10b0 fs/jfs/jfs_dmap.c:1350 dbAlloc+0x658/0xca0 fs/jfs/jfs_dmap.c:874 dtSplitUp fs/jfs/jfs_dtree.c:974 [inline] dtInsert+0xda7/0x6b00 fs/jfs/jfs_dtree.c:863 jfs_create+0x7b6/0xbb0 fs/jfs/namei.c:137 lookup_open fs/namei.c:3492 [inline] open_last_lookups fs/namei.c:3560 [inline] path_openat+0x13df/0x3170 fs/namei.c:3788 do_filp_open+0x234/0x490 fs/namei.c:3818 do_sys_openat2+0x13f/0x500 fs/open.c:1356 do_sys_open fs/open.c:1372 [inline] __do_sys_openat fs/open.c:1388 [inline] __se_sys_openat fs/open.c:1383 [inline] __x64_sys_openat+0x247/0x290 fs/open.c:1383 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f1f4e33f7e9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc21129578 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1f4e33f7e9 RDX: 000000000000275a RSI: 0000000020000040 RDI: 00000000ffffff9c RBP: 00007f1f4e2ff080 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1f4e2ff110 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK>
The bug occurs when the dbAllocDmapLev()function attempts to access dp->tree.stree[leafidx + LEAFIND] while the leafidx value is negative.
To rectify this, the patch introduces a safeguard within the dbAllocDmapLev() function. A check has been added to verify if leafidx is negative. If it is, the function immediately returns an I/O error, preventing any further execution that could potentially cause harm.
Tested via syzbot.
--- fs/jfs/jfs_dmap.c | 3 +++ 1 file changed, 3 insertions(+)
fs/jfs/jfs_dmap.c +3 -0
@@ -1959,6 +1959,9 @@ dbAllocDmapLev(struct bmap * bmp,if (dbFindLeaf ((dmtree_t *) & dp->tree, l2nb, &leafidx))return -ENOSPC ; +if (leafidx <0 ) +return -EIO ; +/* determine the block number within the file system corresponding * to the leaf at which free space was found. */
Greg Kroah-Hartman
maintainerPATCH 10/12 MIPS: dec: prom: Address -Warray-bounds warning
In reply to Greg Kroah-Hartman[ Upstream commit 7b191b9b55df2a844bd32d1d380f47a7df1c2896 ]
Zero-length arrays are deprecated, and we are replacing them with flexible array members instead. So, replace zero-length array with flexible-array member in struct memmap.
Address the following warning found after building (with GCC-13) mips64
with decstation_64_defconfig:
In function 'rex_setup_memory_region',
inlined from 'prom_meminit' at arch/mips/dec/prom/memory.c:91:3:arch/mips/dec/prom/memory.c:72:31: error: array subscript i is outside array bounds of 'unsigned char[0]' [-Werror=array-bounds=]
72 | if (bm->bitmap[i] == 0xff)
| ~~~~~~~~~~^~~
In file included from arch/mips/dec/prom/memory.c:16:./arch/mips/include/asm/dec/prom.h: In function 'prom_meminit':./arch/mips/include/asm/dec/prom.h:73:23: note: while referencing 'bitmap'
73 | unsigned char bitmap[0];
This helps with the ongoing efforts to globally enable -Warray-bounds.
This results in no differences in binary output.
--- arch/mips/include/asm/dec/prom.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/include/asm/dec/prom.h +1 -1
@@ -70,7 +70,7 @@ static inline bool prom_is_rex(u32 magic)*/ typedef struct {int pagesize; -unsigned char bitmap[0 ]; +unsigned char bitmap[]; }memmap ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 11/12 FS: JFS: Fix null-ptr-deref Read in txBegin
In reply to Greg Kroah-Hartman[ Upstream commit 47cfdc338d674d38f4b2f22b7612cc6a2763ba27 ]
Syzkaller reported an issue where txBegin may be called on a superblock in a read-only mounted filesystem which leads to NULL pointer deref. This could be solved by checking if the filesystem is read-only before calling txBegin, and returning with appropiate error code.
--- fs/jfs/namei.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/jfs/namei.c +5 -0
@@ -799,6 +799,11 @@ static int jfs_link(struct dentry *old_dif (rc) goto out; +if (isReadOnly (ip)) { +jfs_error (ip->i_sb,"read-only filesystem\n" ); +return -EROFS ; + } + tid =txBegin (ip->i_sb,0 );mutex_lock_nested (&JFS_IP (dir)->commit_mutex,COMMIT_MUTEX_PARENT );
Greg Kroah-Hartman
maintainerPATCH 12/12 FS: JFS: Check for read-only mounted filesystem in txBegin
In reply to Greg Kroah-Hartman[ Upstream commit 95e2b352c03b0a86c5717ba1d24ea20969abcacc ]
This patch adds a check for read-only mounted filesystem in txBegin before starting a transaction potentially saving from NULL pointer deref.
--- fs/jfs/jfs_txnmgr.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/jfs/jfs_txnmgr.c +5 -0
@@ -354,6 +354,11 @@ tid_t txBegin(struct super_block *sb, int flag)jfs_info ("txBegin: flag = 0x%x" , flag); log =JFS_SBI (sb)->log; +if (!log) { +jfs_error (sb,"read-only filesystem\n" ); +return 0 ; + } +TXN_LOCK ();INCREMENT (TxStat.txBegin);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 68/227 ASoC: codecs: wcd934x: fix resource leaks on component remove
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 798590cc7d3c2b5f3a7548d96dd4d8a081c1bc39 upstream.
Make sure to release allocated MBHC resources also on component remove.
This is specifically needed to allow probe deferrals of the sound card which otherwise fails when reprobing the codec component.
--- sound/soc/codecs/wcd934x.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
sound/soc/codecs/wcd934x.c +12 -0
@@ -3044,6 +3044,17 @@ static int wcd934x_mbhc_init(struct snd_return 0 ; } + +static void wcd934x_mbhc_deinit (struct snd_soc_component *component) +{ +struct wcd934x_codec *wcd =snd_soc_component_get_drvdata (component); + +if (!wcd->mbhc) +return ; + +wcd_mbhc_deinit (wcd->mbhc); +} +static int wcd934x_comp_probe (struct snd_soc_component *component) {struct wcd934x_codec *wcd =dev_get_drvdata (component->dev);
@@ -3077,6 +3088,7 @@ static void wcd934x_comp_remove(struct s {struct wcd934x_codec *wcd =dev_get_drvdata (comp->dev); +wcd934x_mbhc_deinit (comp);wcd_clsh_ctrl_free (wcd->clsh_ctrl); }
Greg Kroah-Hartman
maintainerPATCH 69/227 ASoC: codecs: wcd938x: fix codec initialisation race
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 85a61b1ce461a3f62f1019e5e6423c393c542bff upstream.
Make sure to resume the codec and soundwire device before trying to read the codec variant and configure the device during component probe.
This specifically avoids interpreting (a masked and shifted) -EBUSY errno as the variant:
wcd938x_codec audio-codec: ASoC: error at soc_component_read_no_lock on audio-codec for register: [0x000034b0] -16
when the soundwire device happens to be suspended, which in turn prevents some headphone controls from being registered.
--- sound/soc/codecs/wcd938x.c | 6 ++++++ 1 file changed, 6 insertions(+)
sound/soc/codecs/wcd938x.c +6 -0
@@ -3095,6 +3095,10 @@ static int wcd938x_soc_codec_probe(strucsnd_soc_component_init_regmap (component, wcd938x->regmap); + ret =pm_runtime_resume_and_get (dev); +if (ret <0 ) +return ret; + wcd938x->variant =snd_soc_component_read_field (component,WCD938X_DIGITAL_EFUSE_REG_0 ,WCD938X_ID_MASK );
@@ -3112,6 +3116,8 @@ static int wcd938x_soc_codec_probe(struc (WCD938X_DIGITAL_INTR_LEVEL_0 + i), 0); } +pm_runtime_put (dev); + wcd938x->hphr_pdm_wd_int =regmap_irq_get_virq (wcd938x->irq_chip,WCD938X_IRQ_HPHR_PDM_WD_INT ); wcd938x->hphl_pdm_wd_int = regmap_irq_get_virq(wcd938x->irq_chip,
Greg Kroah-Hartman
maintainerPATCH 70/227 ASoC: codecs: wcd938x: fix soundwire initialisation race
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 6f49256897083848ce9a59651f6b53fc80462397 upstream.
Make sure that the soundwire device used for register accesses has been enumerated and initialised before trying to read the codec variant during component probe.
This specifically avoids interpreting (a masked and shifted) -EBUSY errno as the variant:
wcd938x_codec audio-codec: ASoC: error at soc_component_read_no_lock on audio-codec for register: [0x000034b0] -16
in case the soundwire device has not yet been initialised, which in turn prevents some headphone controls from being registered.
--- sound/soc/codecs/wcd938x.c | 9 +++++++++ 1 file changed, 9 insertions(+)
sound/soc/codecs/wcd938x.c +9 -0
@@ -3090,9 +3090,18 @@ static int wcd938x_irq_init(struct wcd93static int wcd938x_soc_codec_probe (struct snd_soc_component *component) {struct wcd938x_priv *wcd938x =snd_soc_component_get_drvdata (component); +struct sdw_slave *tx_sdw_dev = wcd938x->tx_sdw_dev;struct device *dev = component->dev; +unsigned long time_left;int ret, i; + time_left =wait_for_completion_timeout (&tx_sdw_dev->initialization_complete, +msecs_to_jiffies (2000 )); +if (!time_left) { +dev_err (dev,"soundwire device init timeout\n" ); +return -ETIMEDOUT ; + } +snd_soc_component_init_regmap (component, wcd938x->regmap); ret =pm_runtime_resume_and_get (dev);
Greg Kroah-Hartman
maintainerPATCH 71/227 KVM: arm64: timers: Use CNTHCTL_EL2 when setting non-CNTKCTL_EL1 bits
In reply to Greg Kroah-HartmanFrom: Marc Zyngier <[email protected]>
commit fe769e6c1f80f542d6f4e7f7c8c6bf20c1307f99 upstream.
It recently appeared that, when running VHE, there is a notable difference between using CNTKCTL_EL1 and CNTHCTL_EL2, despite what the architecture documents:
- When accessed from EL2, bits [19:18] and [16:10] of CNTKCTL_EL1 have the same assignment as CNTHCTL_EL2
- When accessed from EL1, bits [19:18] and [16:10] are RES0
It is all OK, until you factor in NV, where the EL2 guest runs at EL1. In this configuration, CNTKCTL_EL11 doesn't trap, nor ends up in the VNCR page. This means that any write from the guest affecting CNTHCTL_EL2 using CNTKCTL_EL1 ends up losing some state. Not good.
The fix it obvious: don't use CNTKCTL_EL1 if you want to change bits that are not part of the EL1 definition of CNTKCTL_EL1, and use CNTHCTL_EL2 instead. This doesn't change anything for a bare-metal OS, and fixes it when running under NV. The NV hypervisor will itself have to work harder to merge the two accessors.
Note that there is a pending update to the architecture to address this issue by making the affected bits UNKNOWN when CNTKCTL_EL1 is used from EL2 with VHE enabled.
--- arch/arm64/kvm/arch_timer.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm64/kvm/arch_timer.c +3 -3
@@ -827,8 +827,8 @@ static void timer_set_traps(struct kvm_vassign_clear_set_bit (tpt,CNTHCTL_EL1PCEN <<10 , set, clr);assign_clear_set_bit (tpc,CNTHCTL_EL1PCTEN <<10 , set, clr); -/* This only happens on VHE, so use the CNTKCTL_EL1 accessor */ -sysreg_clear_set (cntkctl_el1, clr, set); +/* This only happens on VHE, so use the CNTHCTL_EL2 accessor. */ +sysreg_clear_set (cnthctl_el2, clr, set); }void kvm_timer_vcpu_load (struct kvm_vcpu *vcpu)
@@ -1559,7 +1559,7 @@ no_vgic:void kvm_timer_init_vhe (void ) {if (cpus_have_final_cap (ARM64_HAS_ECV_CNTPOFF )) -sysreg_clear_set (cntkctl_el1,0 ,CNTHCTL_ECV ); +sysreg_clear_set (cnthctl_el2,0 ,CNTHCTL_ECV ); }int kvm_arm_timer_set_attr (struct kvm_vcpu *vcpu,struct kvm_device_attr *attr)
Greg Kroah-Hartman
maintainerPATCH 72/227 KVM: arm64: Correctly handle page aging notifiers for unaligned memslot
In reply to Greg Kroah-HartmanFrom: Oliver Upton <[email protected]>
commit df6556adf27b7372cfcd97e1c0afb0d516c8279f upstream.
Userspace is allowed to select any PAGE_SIZE aligned hva to back guest memory. This is even the case with hugepages, although it is a rather suboptimal configuration as PTE level mappings are used at stage-2.
The arm64 page aging handlers have an assumption that the specified range is exactly one page/block of memory, which in the aforementioned case is not necessarily true. All together this leads to the WARN() in kvm_age_gfn() firing.
However, the WARN is only part of the issue as the table walkers visit at most a single leaf PTE. For hugepage-backed memory in a memslot that isn't hugepage-aligned, page aging entirely misses accesses to the hugepage beyond the first page in the memslot.
Add a new walker dedicated to handling page aging MMU notifiers capable of walking a range of PTEs. Convert kvm(_test)_age_gfn() over to the new walker and drop the WARN that caught the issue in the first place. The implementation of this walker was inspired by the test_clear_young() implementation by Yu Zhao [*], but repurposed to address a bug in the existing aging implementation.
--- arch/arm64/include/asm/kvm_pgtable.h | 26 ++++++------------- arch/arm64/kvm/hyp/pgtable.c | 47 ++++++++++++++++++++++++++++------- arch/arm64/kvm/mmu.c | 18 +++++-------- 3 files changed, 55 insertions(+), 36 deletions(-)
arch/arm64/include/asm/kvm_pgtable.h +9 -17
@@ -556,22 +556,26 @@ int kvm_pgtable_stage2_wrprotect(structkvm_pte_t kvm_pgtable_stage2_mkyoung (struct kvm_pgtable *pgt,u64 addr);/** -* kvm_pgtable_stage2_mkold() - Clear the access flag in a page-table entry. +* kvm_pgtable_stage2_test_clear_young() - Test and optionally clear the access +* flag in a page-table entry. * @pgt: Page-table structure initialised by kvm_pgtable_stage2_init*(). * @addr: Intermediate physical address to identify the page-table entry. +* @size: Size of the address range to visit. +* @mkold: True if the access flag should be cleared. * * The offset of @addr within a page is ignored. * -* If there is a valid, leaf page-table entry used to translate @addr, then -* clear the access flag in that entry. +* Tests and conditionally clears the access flag for every valid, leaf +* page-table entry used to translate the range [@addr, @addr + @size). * * Note that it is the caller's responsibility to invalidate the TLB after * calling this function to ensure that the updated permissions are visible * to the CPUs. * -* Return: The old page-table entry prior to clearing the flag, 0 on failure. +* Return: True if any of the visited PTEs had the access flag set. */ -kvm_pte_t kvm_pgtable_stage2_mkold (struct kvm_pgtable *pgt,u64 addr); +bool kvm_pgtable_stage2_test_clear_young (struct kvm_pgtable *pgt,u64 addr, +u64 size,bool mkold);/** * kvm_pgtable_stage2_relax_perms() - Relax the permissions enforced by a
@@ -594,18 +598,6 @@ int kvm_pgtable_stage2_relax_perms(struc enum kvm_pgtable_prot prot);/** -* kvm_pgtable_stage2_is_young() - Test whether a page-table entry has the -* access flag set. -* @pgt: Page-table structure initialised by kvm_pgtable_stage2_init*(). -* @addr: Intermediate physical address to identify the page-table entry. -* -* The offset of @addr within a page is ignored. -* -* Return: True if the page-table entry has the access flag set, false otherwise. -*/ -bool kvm_pgtable_stage2_is_young (struct kvm_pgtable *pgt,u64 addr); - -/** * kvm_pgtable_stage2_flush_range() - Clean and invalidate data cache to Point * of Coherency for guest stage-2 address * range.
arch/arm64/kvm/hyp/pgtable.c +38 -9
63 lines not on this page · raw message
arch/arm64/kvm/mmu.c +8 -10
@@ -1639,27 +1639,25 @@ bool kvm_set_spte_gfn(struct kvm *kvm, sbool kvm_age_gfn (struct kvm *kvm,struct kvm_gfn_range *range) {u64 size = (range->end - range->start) <<PAGE_SHIFT ; -kvm_pte_t kpte; -pte_t pte;if (!kvm->arch.mmu.pgt)return false; -WARN_ON (size !=PAGE_SIZE && size !=PMD_SIZE && size !=PUD_SIZE ); - - kpte =kvm_pgtable_stage2_mkold (kvm->arch.mmu.pgt, - range->start <<PAGE_SHIFT ); - pte =__pte (kpte); -return pte_valid (pte) &&pte_young (pte); +return kvm_pgtable_stage2_test_clear_young (kvm->arch.mmu.pgt, + range->start <<PAGE_SHIFT , + size, true); }bool kvm_test_age_gfn (struct kvm *kvm,struct kvm_gfn_range *range) { +u64 size = (range->end - range->start) <<PAGE_SHIFT ; +if (!kvm->arch.mmu.pgt)return false; -return kvm_pgtable_stage2_is_young (kvm->arch.mmu.pgt, - range->start <<PAGE_SHIFT ); +return kvm_pgtable_stage2_test_clear_young (kvm->arch.mmu.pgt, + range->start <<PAGE_SHIFT , + size, false); }phys_addr_t kvm_mmu_get_httbr (void )
Greg Kroah-Hartman
maintainerPATCH 73/227 KVM: arm64: Disable preemption in kvm_arch_hardware_enable()
In reply to Greg Kroah-HartmanFrom: Marc Zyngier <[email protected]>
commit 970dee09b230895fe2230d2b32ad05a2826818c6 upstream.
Since 0bf50497f03b ("KVM: Drop kvm_count_lock and instead protect kvm_usage_count with kvm_lock"), hotplugging back a CPU whilst a guest is running results in a number of ugly splats as most of this code expects to run with preemption disabled, which isn't the case anymore.
While the context is preemptable, it isn't migratable, which should be enough. But we have plenty of preemptible() checks all over the place, and our per-CPU accessors also disable preemption.
Since this affects released versions, let's do the easy fix first, disabling preemption in kvm_arch_hardware_enable(). We can always revisit this with a more invasive fix in the future.
--- arch/arm64/kvm/arm.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
arch/arm64/kvm/arm.c +12 -1
@@ -1793,8 +1793,17 @@ static void _kvm_arch_hardware_enable(voint kvm_arch_hardware_enable (void ) { -int was_enabled =__this_cpu_read (kvm_arm_hardware_enabled); +int was_enabled; +/* +* Most calls to this function are made with migration +* disabled, but not with preemption disabled. The former is +* enough to ensure correctness, but most of the helpers +* expect the later and will throw a tantrum otherwise. +*/ +preempt_disable (); + + was_enabled =__this_cpu_read (kvm_arm_hardware_enabled);_kvm_arch_hardware_enable (NULL );if (!was_enabled) {
@@ -1802,6 +1811,8 @@ int kvm_arch_hardware_enable(void)kvm_timer_cpu_up (); } +preempt_enable (); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 74/227 KVM: arm64: vgic-v4: Make the doorbell request robust w.r.t preemption
In reply to Greg Kroah-HartmanFrom: Marc Zyngier <[email protected]>
commit b321c31c9b7b309dcde5e8854b741c8e6a9a05f0 upstream.
Xiang reports that VMs occasionally fail to boot on GICv4.1 systems when running a preemptible kernel, as it is possible that a vCPU is blocked without requesting a doorbell interrupt.
The issue is that any preemption that occurs between vgic_v4_put() and schedule() on the block path will mark the vPE as nonresident and *not* request a doorbell irq. This occurs because when the vcpu thread is resumed on its way to block, vcpu_load() will make the vPE resident again. Once the vcpu actually blocks, we don't request a doorbell anymore, and the vcpu won't be woken up on interrupt delivery.
Fix it by tracking that we're entering WFI, and key the doorbell request on that flag. This allows us not to make the vPE resident when going through a preempt/schedule cycle, meaning we don't lose any state.
--- arch/arm64/include/asm/kvm_host.h | 2 ++ arch/arm64/kvm/arm.c | 6 ++++-- arch/arm64/kvm/vgic/vgic-v3.c | 2 +- arch/arm64/kvm/vgic/vgic-v4.c | 7 +++++-- include/kvm/arm_vgic.h | 2 +- 5 files changed, 13 insertions(+), 6 deletions(-)
arch/arm64/include/asm/kvm_host.h +2 -0
@@ -701,6 +701,8 @@ struct kvm_vcpu_arch {#define DBG_SS_ACTIVE_PENDING __vcpu_single_flag(sflags, BIT(5))/* PMUSERENR for the guest EL0 is on physical CPU */ #define PMUSERENR_ON_CPU __vcpu_single_flag(sflags, BIT(6)) +/* WFI instruction trapped */ +#define IN_WFI __vcpu_single_flag(sflags, BIT(7))/* Pointer to the vcpu's SVE FFR for sve_{save,load}_state() */
arch/arm64/kvm/arm.c +4 -2
@@ -704,13 +704,15 @@ void kvm_vcpu_wfi(struct kvm_vcpu *vcpu)*/ preempt_disable ();kvm_vgic_vmcr_sync (vcpu); -vgic_v4_put (vcpu, true); +vcpu_set_flag (vcpu,IN_WFI ); +vgic_v4_put (vcpu);preempt_enable ();kvm_vcpu_halt (vcpu);vcpu_clear_flag (vcpu,IN_WFIT );preempt_disable (); +vcpu_clear_flag (vcpu,IN_WFI );vgic_v4_load (vcpu);preempt_enable (); }
@@ -778,7 +780,7 @@ static int check_vcpu_requests(struct kvif (kvm_check_request (KVM_REQ_RELOAD_GICv4, vcpu)) {/* The distributor enable bits were changed */ preempt_disable (); -vgic_v4_put (vcpu, false); +vgic_v4_put (vcpu);vgic_v4_load (vcpu);preempt_enable (); }
arch/arm64/kvm/vgic/vgic-v3.c +1 -1
@@ -749,7 +749,7 @@ void vgic_v3_put(struct kvm_vcpu *vcpu) {struct vgic_v3_cpu_if *cpu_if = &vcpu->arch.vgic_cpu.vgic_v3; -WARN_ON (vgic_v4_put (vcpu, false)); +WARN_ON (vgic_v4_put (vcpu));vgic_v3_vmcr_sync (vcpu);
arch/arm64/kvm/vgic/vgic-v4.c +5 -2
@@ -336,14 +336,14 @@ void vgic_v4_teardown(struct kvm *kvm) its_vm->vpes =NULL ; } -int vgic_v4_put (struct kvm_vcpu *vcpu,bool need_db) +int vgic_v4_put (struct kvm_vcpu *vcpu) {struct its_vpe *vpe = &vcpu->arch.vgic_cpu.vgic_v3.its_vpe;if (!vgic_supports_direct_msis (vcpu->kvm) || !vpe->resident)return 0 ; -return its_make_vpe_non_resident (vpe, need_db); +return its_make_vpe_non_resident (vpe, !!vcpu_get_flag (vcpu,IN_WFI )); }int vgic_v4_load (struct kvm_vcpu *vcpu)
@@ -354,6 +354,9 @@ int vgic_v4_load(struct kvm_vcpu *vcpu)if (!vgic_supports_direct_msis (vcpu->kvm) || vpe->resident)return 0 ; +if (vcpu_get_flag (vcpu,IN_WFI )) +return 0 ; +/* * Before making the VPE resident, make sure the redistributor * corresponding to our current CPU expects us here. See the
include/kvm/arm_vgic.h +1 -1
@@ -431,7 +431,7 @@ int kvm_vgic_v4_unset_forwarding(structint vgic_v4_load (struct kvm_vcpu *vcpu);void vgic_v4_commit (struct kvm_vcpu *vcpu); -int vgic_v4_put (struct kvm_vcpu *vcpu,bool need_db); +int vgic_v4_put (struct kvm_vcpu *vcpu);/* CPU HP callbacks */ void kvm_vgic_cpu_up (void );
Greg Kroah-Hartman
maintainerPATCH 75/227 ext4: correct inline offset when handling xattrs in inode body
In reply to Greg Kroah-HartmanFrom: Eric Whitney <[email protected]>
commit 6909cf5c4101214f4305a62d582a5b93c7e1eb9a upstream.
When run on a file system where the inline_data feature has been enabled, xfstests generic/269, generic/270, and generic/476 cause ext4 to emit error messages indicating that inline directory entries are corrupted. This occurs because the inline offset used to locate inline directory entries in the inode body is not updated when an xattr in that shared region is deleted and the region is shifted in memory to recover the space it occupied. If the deleted xattr precedes the system.data attribute, which points to the inline directory entries, that attribute will be moved further up in the region. The inline offset continues to point to whatever is located in system.data's former location, with unfortunate effects when used to access directory entries or (presumably) inline data in the inode body.
--- fs/ext4/xattr.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
fs/ext4/xattr.c +14 -0
@@ -1782,6 +1782,20 @@ static int ext4_xattr_set_entry(struct ememmove (here, (void *)here + size, (void *)last - (void *)here +sizeof (__u32));memset (last,0 , size); + +/* +* Update i_inline_off - moved ibody region might contain +* system.data attribute. Handling a failure here won't +* cause other complications for setting an xattr. +*/ +if (!is_block &&ext4_has_inline_data (inode)) { + ret =ext4_find_inline_data_nolock (inode); +if (ret) { +ext4_warning_inode (inode, +"unable to update i_inline_off" ); + goto out; + } + } }else if (s->not_found) {/* Insert new name. */ size_t size =EXT4_XATTR_LEN (name_len);
Greg Kroah-Hartman
maintainerPATCH 88/227 md: fix data corruption for raid456 when reshape restart while grow up
In reply to Greg Kroah-HartmanFrom: Yu Kuai <[email protected]>
[ Upstream commit 873f50ece41aad5c4f788a340960c53774b5526e ]
Currently, if reshape is interrupted, echo "reshape" to sync_action will restart reshape from scratch, for example:
echo frozen > sync_action
echo reshape > sync_action
This will corrupt data before reshape_position if the array is growing, fix the problem by continue reshape from reshape_position.
--- drivers/md/md.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/md/md.c +12 -2
@@ -4807,11 +4807,21 @@ action_store(struct mddev *mddev, const char *page, size_t len)return -EINVAL ; err =mddev_lock (mddev);if (!err) { -if (test_bit (MD_RECOVERY_RUNNING , &mddev->recovery)) +if (test_bit (MD_RECOVERY_RUNNING , &mddev->recovery)) { err = -EBUSY ; -else { + }else if (mddev->reshape_position == MaxSector || + mddev->pers->check_reshape ==NULL || + mddev->pers->check_reshape (mddev)) {clear_bit (MD_RECOVERY_FROZEN , &mddev->recovery); err = mddev->pers->start_reshape (mddev); + }else { +/* +* If reshape is still in progress, and +* md_check_recovery() can continue to reshape, +* don't restart reshape because data can be +* corrupted for raid456. +*/ +clear_bit (MD_RECOVERY_FROZEN , &mddev->recovery); }mddev_unlock (mddev); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 89/227 md/raid10: prevent soft lockup while flush writes
In reply to Greg Kroah-HartmanFrom: Yu Kuai <[email protected]>
[ Upstream commit 010444623e7f4da6b4a4dd603a7da7469981e293 ]
Currently, there is no limit for raid1/raid10 plugged bio. While flushing writes, raid1 has cond_resched() while raid10 doesn't, and too many writes can cause soft lockup.
Follow up soft lockup can be triggered easily with writeback test for raid10 with ramdisks:
watchdog: BUG: soft lockup - CPU#10 stuck for 27s! [md0_raid10:1293] Call Trace: <TASK> call_rcu+0x16/0x20 put_object+0x41/0x80 __delete_object+0x50/0x90 delete_object_full+0x2b/0x40 kmemleak_free+0x46/0xa0 slab_free_freelist_hook.constprop.0+0xed/0x1a0 kmem_cache_free+0xfd/0x300 mempool_free_slab+0x1f/0x30 mempool_free+0x3a/0x100 bio_free+0x59/0x80 bio_put+0xcf/0x2c0 free_r10bio+0xbf/0xf0 raid_end_bio_io+0x78/0xb0 one_write_done+0x8a/0xa0 raid10_end_write_request+0x1b4/0x430 bio_endio+0x175/0x320 brd_submit_bio+0x3b9/0x9b7 [brd] __submit_bio+0x69/0xe0 submit_bio_noacct_nocheck+0x1e6/0x5a0 submit_bio_noacct+0x38c/0x7e0 flush_pending_writes+0xf0/0x240 raid10d+0xac/0x1ed0
Fix the problem by adding cond_resched() to raid10 like what raid1 did.
Note that unlimited plugged bio still need to be optimized, for example, in the case of lots of dirty pages writeback, this will take lots of memory and io will spend a long time in plug, hence io latency is bad.
--- drivers/md/raid10.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/md/raid10.c +2 -0
@@ -920,6 +920,7 @@ static void flush_pending_writes(struct r10conf *conf)raid1_submit_write (bio); bio = next; +cond_resched (); }blk_finish_plug (&plug); }else
@@ -1132,6 +1133,7 @@ static void raid10_unplug(struct blk_plug_cb *cb, bool from_schedule)raid1_submit_write (bio); bio = next; +cond_resched (); }kfree (plug); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 90/227 scsi: sg: fix blktrace debugfs entries leakage
In reply to Greg Kroah-HartmanFrom: Yu Kuai <[email protected]>
[ Upstream commit db59133e927916d8a25ee1fd8264f2808040909d ]
sg_ioctl() support to enable blktrace, which will create debugfs entries "/sys/kernel/debug/block/sgx/", however, there is no guarantee that user will remove these entries through ioctl, and deleting sg device doesn't cleanup these blktrace entries.
This problem can be fixed by cleanup blktrace while releasing request_queue, however, it's not a good idea to do this special handling in common layer just for sg device.
Fix this problem by shutdown bltkrace in sg_device_destroy(), where the device is deleted and all the users close the device, also grab a scsi_device reference from sg_add_device() to prevent scsi_device to be freed before sg_device_destroy();
--- drivers/scsi/sg.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/scsi/sg.c +9 -0
@@ -1496,6 +1496,10 @@ sg_add_device(struct device *cl_dev)int error;unsigned long iflags; + error =scsi_device_get (scsidp); +if (error) +return error; + error = -ENOMEM ; cdev =cdev_alloc ();if (!cdev) {
@@ -1553,6 +1557,7 @@ sg_add_device(struct device *cl_dev) out:if (cdev)cdev_del (cdev); +scsi_device_put (scsidp);return error; }
@@ -1560,6 +1565,7 @@ static void sg_device_destroy(struct kref *kref) { struct sg_device *sdp = container_of(kref, struct sg_device, d_ref); +struct request_queue *q = sdp->device->request_queue;unsigned long flags;/* CAUTION! Note that the device can still be found via idr_find()
@@ -1567,6 +1573,9 @@ sg_device_destroy(struct kref *kref)* any other cleanup. */ +blk_trace_remove (q); +scsi_device_put (sdp->device); +write_lock_irqsave (&sg_index_lock, flags);idr_remove (&sg_index_idr, sdp->index);write_unlock_irqrestore (&sg_index_lock, flags);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 91/227 blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none
In reply to Greg Kroah-HartmanFrom: Ming Lei <[email protected]>
[ Upstream commit 245165658e1c9f95c0fecfe02b9b1ebd30a1198a ]
After grabbing q->sysfs_lock, q->elevator may become NULL because of elevator switch.
Fix the NULL dereference on q->elevator by checking it with lock.
--- block/blk-mq.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
block/blk-mq.c +7 -3
@@ -4617,9 +4617,6 @@ static bool blk_mq_elv_switch_none(struct list_head *head, {struct blk_mq_qe_pair *qe; -if (!q->elevator) -return true; - qe =kmalloc (sizeof (*qe),GFP_NOIO | __GFP_NOWARN | __GFP_NORETRY);if (!qe)return false;
@@ -4627,6 +4624,12 @@ static bool blk_mq_elv_switch_none(struct list_head *head,/* q->elevator needs protection from ->sysfs_lock */ mutex_lock (&q->sysfs_lock); +/* the check has to be done with holding sysfs_lock */ +if (!q->elevator) { +kfree (qe); + goto unlock; + } +INIT_LIST_HEAD (&qe->node); qe->q = q; qe->type = q->elevator->type;
@@ -4634,6 +4637,7 @@ static bool blk_mq_elv_switch_none(struct list_head *head,__elevator_get (qe->type);list_add (&qe->node, head);elevator_disable (q); +unlock:mutex_unlock (&q->sysfs_lock);return true;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 92/227 posix-timers: Ensure timer ID search-loop limit is valid
In reply to Greg Kroah-HartmanFrom: Thomas Gleixner <[email protected]>
[ Upstream commit 8ce8849dd1e78dadcee0ec9acbd259d239b7069f ]
posix_timer_add() tries to allocate a posix timer ID by starting from the cached ID which was stored by the last successful allocation.
This is done in a loop searching the ID space for a free slot one by one. The loop has to terminate when the search wrapped around to the starting point.
But that's racy vs. establishing the starting point. That is read out lockless, which leads to the following problem:
CPU0 CPU1posix_timer_add()
start = sig->posix_timer_id;
lock(hash_lock);
... posix_timer_add()
if (++sig->posix_timer_id < 0)
start = sig->posix_timer_id;
sig->posix_timer_id = 0;So CPU1 can observe a negative start value, i.e. -1, and the loop break never happens because the condition can never be true:
if (sig->posix_timer_id == start)
break;
While this is unlikely to ever turn into an endless loop as the ID space is huge (INT_MAX), the racy read of the start value caught the attention of KCSAN and Dmitry unearthed that incorrectness.
Rewrite it so that all id operations are under the hash lock.
--- include/linux/sched/signal.h | 2 +- kernel/time/posix-timers.c | 31 ++++++++++++++++++------------- 2 files changed, 19 insertions(+), 14 deletions(-)
include/linux/sched/signal.h +1 -1
@@ -135,7 +135,7 @@ struct signal_struct {#ifdef CONFIG_POSIX_TIMERS /* POSIX.1b Interval Timers */ -int posix_timer_id; +unsigned int next_posix_timer_id;struct list_head posix_timers;/* ITIMER_REAL timer for the process */
kernel/time/posix-timers.c +18 -13
@@ -140,25 +140,30 @@ static struct k_itimer *posix_timer_by_id(timer_t id)static int posix_timer_add (struct k_itimer *timer) {struct signal_struct *sig = current->signal; -int first_free_id = sig->posix_timer_id;struct hlist_head *head; -int ret = -ENOENT ; +unsigned int cnt, id; -do { +/* +* FIXME: Replace this by a per signal struct xarray once there is +* a plan to handle the resulting CRIU regression gracefully. +*/ +for (cnt =0 ; cnt <=INT_MAX ; cnt++) {spin_lock (&hash_lock); - head = &posix_timers_hashtable[hash (sig, sig->posix_timer_id)]; -if (!__posix_timers_find (head, sig, sig->posix_timer_id)) { + id = sig->next_posix_timer_id; + +/* Write the next ID back. Clamp it to the positive space */ + sig->next_posix_timer_id = (id +1 ) &INT_MAX ; + + head = &posix_timers_hashtable[hash (sig, id)]; +if (!__posix_timers_find (head, sig, id)) {hlist_add_head_rcu (&timer->t_hash, head); - ret = sig->posix_timer_id; +spin_unlock (&hash_lock); +return id; } -if (++sig->posix_timer_id <0 ) - sig->posix_timer_id =0 ; -if ((sig->posix_timer_id == first_free_id) && (ret == -ENOENT )) -/* Loop over all possible ids completed */ - ret = -EAGAIN ;spin_unlock (&hash_lock); - }while (ret == -ENOENT ); -return ret; + } +/* POSIX return code when no timer ID could be allocated */ +return -EAGAIN ; }static inline void unlock_timer (struct k_itimer *timr,unsigned long flags)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 93/227 btrfs: add xxhash to fast checksum implementations
In reply to Greg Kroah-HartmanFrom: David Sterba <[email protected]>
[ Upstream commit efcfcbc6a36195c42d98e0ee697baba36da94dc8 ]
The implementation of XXHASH is now CPU only but still fast enough to be considered for the synchronous checksumming, like non-generic crc32c.
A userspace benchmark comparing it to various implementations (patched hash-speedtest from btrfs-progs):
Block size: 4096
Iterations: 1000000
Implementation: builtin
Units: CPU cycles
NULL-NOP: cycles: 73384294, cycles/i 73
NULL-MEMCPY: cycles: 228033868, cycles/i 228, 61664.320 MiB/s
CRC32C-ref: cycles: 24758559416, cycles/i 24758, 567.950 MiB/s
CRC32C-NI: cycles: 1194350470, cycles/i 1194, 11773.433 MiB/s
CRC32C-ADLERSW: cycles: 6150186216, cycles/i 6150, 2286.372 MiB/s
CRC32C-ADLERHW: cycles: 626979180, cycles/i 626, 22427.453 MiB/s
CRC32C-PCL: cycles: 466746732, cycles/i 466, 30126.699 MiB/s
XXHASH: cycles: 860656400, cycles/i 860, 16338.188 MiB/sComparing purely software implementation (ref), current outdated
accelerated using crc32q instruction (NI), optimized implementations by
M. Adler (https://stackoverflow.com/questions/17645167/implementing-sse-4-2s-crc32c-in-software/17646775#17646775)
and the best one that was taken from kernel using the PCLMULQDQ
instruction (PCL).
--- fs/btrfs/disk-io.c | 3 +++ 1 file changed, 3 insertions(+)
fs/btrfs/disk-io.c +3 -0
@@ -2265,6 +2265,9 @@ static int btrfs_init_csum_hash(struct btrfs_fs_info *fs_info, u16 csum_type)if (!strstr (crypto_shash_driver_name (csum_shash),"generic" ))set_bit (BTRFS_FS_CSUM_IMPL_FAST , &fs_info->flags);break ; +case BTRFS_CSUM_TYPE_XXHASH : +set_bit (BTRFS_FS_CSUM_IMPL_FAST , &fs_info->flags); +break ;default :break ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 94/227 btrfs: dont check PageError in __extent_writepage
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 3e92499e3b004baffb479d61e191b41b604ece9a ]
__extent_writepage currenly sets PageError whenever any error happens, and the also checks for PageError to decide if to call error handling. This leads to very unclear responsibility for cleaning up on errors. In the VM and generic writeback helpers the basic idea is that once I/O is fired off all error handling responsibility is delegated to the end I/O handler. But if that end I/O handler sets the PageError bit, and the submitter checks it, the bit could in some cases leak into the submission context for fast enough I/O.
Fix this by simply not checking PageError and just using the local ret variable to check for submission errors. This also fundamentally solves the long problem documented in a comment in __extent_writepage by never leaking the error bit into the submission context.
--- fs/btrfs/extent_io.c | 33 +-------------------------------- 1 file changed, 1 insertion(+), 32 deletions(-)
fs/btrfs/extent_io.c +1 -32
@@ -1592,38 +1592,7 @@ static int __extent_writepage(struct page *page, struct btrfs_bio_ctrl *bio_ctrlset_page_writeback (page);end_page_writeback (page); } -/* -* Here we used to have a check for PageError() and then set @ret and -* call end_extent_writepage(). -* -* But in fact setting @ret here will cause different error paths -* between subpage and regular sectorsize. -* -* For regular page size, we never submit current page, but only add -* current page to current bio. -* The bio submission can only happen in next page. -* Thus if we hit the PageError() branch, @ret is already set to -* non-zero value and will not get updated for regular sectorsize. -* -* But for subpage case, it's possible we submit part of current page, -* thus can get PageError() set by submitted bio of the same page, -* while our @ret is still 0. -* -* So here we unify the behavior and don't set @ret. -* Error can still be properly passed to higher layer as page will -* be set error, here we just don't handle the IO failure. -* -* NOTE: This is just a hotfix for subpage. -* The root fix will be properly ending ordered extent when we hit -* an error during writeback. -* -* But that needs a bigger refactoring, as we not only need to grab the -* submitted OE, but also need to know exactly at which bytenr we hit -* the error. -* Currently the full page based __extent_writepage_io() is not -* capable of that. -*/ -if (PageError (page)) +if (ret)end_extent_writepage (page, ret, page_start, page_end);unlock_page (page);ASSERT (ret <=0 );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 95/227 btrfs: abort transaction at update_ref_for_cow() when ref count is zero
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
[ Upstream commit eced687e224eb3cc5a501cf53ad9291337c8dbc5 ]
At update_ref_for_cow() we are calling btrfs_handle_fs_error() if we find that the extent buffer has an unexpected ref count of zero, however we can simply use btrfs_abort_transaction(), which achieves the same purposes: to turn the fs to error state, abort the current transaction and turn the fs to RO mode as well. Besides that, btrfs_abort_transaction() also prints a stack trace which makes it more useful.
Also, as this is a very unexpected situation, indicating a serious corruption/inconsistency, tag the if branch as 'unlikely', set the error code to -EUCLEAN instead of -EROFS, and log an explicit message.
--- fs/btrfs/ctree.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
fs/btrfs/ctree.c +7 -3
@@ -417,9 +417,13 @@ static noinline int update_ref_for_cow(struct btrfs_trans_handle *trans, &refs, &flags);if (ret)return ret; -if (refs ==0 ) { - ret = -EROFS ; -btrfs_handle_fs_error (fs_info, ret,NULL ); +if (unlikely (refs ==0 )) { +btrfs_crit (fs_info, +"found 0 references for tree block at bytenr %llu level %d root %llu" , + buf->start,btrfs_header_level (buf), +btrfs_root_id (root)); + ret = -EUCLEAN ; +btrfs_abort_transaction (trans, ret);return ret; } }else {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 96/227 erofs: Fix detection of atomic context
In reply to Greg Kroah-HartmanFrom: Sandeep Dhavale <[email protected]>
[ Upstream commit 12d0a24afd9ea58e581ea64d64e066f2027b28d9 ]
Current check for atomic context is not sufficient as z_erofs_decompressqueue_endio can be called under rcu lock from blk_mq_flush_plug_list(). See the stacktrace [1]
In such case we should hand off the decompression work for async processing rather than trying to do sync decompression in current context. Patch fixes the detection by checking for rcu_read_lock_any_held() and while at it use more appropriate !in_task() check than in_atomic().
Background: Historically erofs would always schedule a kworker for decompression which would incur the scheduling cost regardless of the context. But z_erofs_decompressqueue_endio() may not always be in atomic context and we could actually benefit from doing the decompression in z_erofs_decompressqueue_endio() if we are in thread context, for example when running with dm-verity. This optimization was later added in patch [2] which has shown improvement in performance benchmarks.
==============================================
[1] Problem stacktrace
[name:core&]BUG: sleeping function called from invalid context at kernel/locking/mutex.c:291 [name:core&]in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 1615, name: CpuMonitorServi [name:core&]preempt_count: 0, expected: 0
[name:core&]RCU nest depth: 1, expected: 0
CPU: 7 PID: 1615 Comm: CpuMonitorServi Tainted: G S W OE 6.1.25-android14-5-maybe-dirty-mainline #1 Hardware name: MT6897 (DT) Call trace: dump_backtrace+0x108/0x15c show_stack+0x20/0x30 dump_stack_lvl+0x6c/0x8c dump_stack+0x20/0x48 __might_resched+0x1fc/0x308 __might_sleep+0x50/0x88 mutex_lock+0x2c/0x110 z_erofs_decompress_queue+0x11c/0xc10 z_erofs_decompress_kickoff+0x110/0x1a4 z_erofs_decompressqueue_endio+0x154/0x180 bio_endio+0x1b0/0x1d8 __dm_io_complete+0x22c/0x280 clone_endio+0xe4/0x280 bio_endio+0x1b0/0x1d8 blk_update_request+0x138/0x3a4 blk_mq_plug_issue_direct+0xd4/0x19c blk_mq_flush_plug_list+0x2b0/0x354 __blk_flush_plug+0x110/0x160 blk_finish_plug+0x30/0x4c read_pages+0x2fc/0x370 page_cache_ra_unbounded+0xa4/0x23c page_cache_ra_order+0x290/0x320 do_sync_mmap_readahead+0x108/0x2c0 filemap_fault+0x19c/0x52c __do_fault+0xc4/0x114 handle_mm_fault+0x5b4/0x1168 do_page_fault+0x338/0x4b4 do_translation_fault+0x40/0x60 do_mem_abort+0x60/0xc8 el0_da+0x4c/0xe0 el0t_64_sync_handler+0xd4/0xfc el0t_64_sync+0x1a0/0x1a4
[2] Link: https://lore.kernel.org/all/[email protected]/
--- fs/erofs/zdata.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/erofs/zdata.c +1 -1
@@ -1411,7 +1411,7 @@ static void z_erofs_decompress_kickoff(struct z_erofs_decompressqueue *io,if (atomic_add_return (bios, &io->pending_bios))return ;/* Use (kthread_)work and sync decompression for atomic contexts only */ -if (in_atomic () ||irqs_disabled ()) { +if (!in_task () ||irqs_disabled () ||rcu_read_lock_any_held ()) {#ifdef CONFIG_EROFS_FS_PCPU_KTHREAD struct kthread_worker *worker;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 97/227 ACPI: x86: Add skip i2c clients quirk for Nextbook Ares 8A
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 69d6b37695c1f2320cfa330e1e1636d50dd5040a ]
The Nextbook Ares 8A is a x86 ACPI tablet which ships with Android x86 as factory OS. Its DSDT contains a bunch of I2C devices which are not actually there (the Android x86 kernel fork ignores I2C devices described in the DSDT).
On this specific model this just not cause resource conflicts, one of the probe() calls for the non existing i2c_clients actually ends up toggling a GPIO or executing a _PS3 after a failed probe which turns the tablet off.
Add a ACPI_QUIRK_SKIP_I2C_CLIENTS for the Nextbook Ares 8 to the acpi_quirk_skip_dmi_ids table to avoid the bogus i2c_clients and to fix the tablet turning off during boot because of this.
Also add the "10EC5651" HID for the RealTek ALC5651 codec used in this tablet to the list of HIDs for which not to skipi2c_client instantiation, since the Intel SST sound driver relies on the codec being instantiated through ACPI.
--- drivers/acpi/x86/utils.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/acpi/x86/utils.c +12 -1
@@ -365,7 +365,7 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = { ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY), }, { -/* Nextbook Ares 8 */ +/* Nextbook Ares 8 (BYT version)*/ .matches = {DMI_MATCH (DMI_SYS_VENDOR ,"Insyde" ), DMI_MATCH(DMI_PRODUCT_NAME, "M890BAP"),
@@ -374,6 +374,16 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = {ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY | ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS), }, + { +/* Nextbook Ares 8A (CHT version)*/ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Insyde" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"CherryTrail" ), + DMI_MATCH(DMI_BIOS_VERSION, "M882"), + }, + .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS | + ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY), + }, {/* Whitelabel (sold as various brands) TM800A550L */ .matches = {
@@ -392,6 +402,7 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = {#if IS_ENABLED (CONFIG_X86_ANDROID_TABLETS )static const struct acpi_device_id i2c_acpi_known_good_ids[] = { {"10EC5640" ,0 },/* RealTek ALC5640 audio codec */ + {"10EC5651" ,0 },/* RealTek ALC5651 audio codec */ {"INT33F4" ,0 },/* X-Powers AXP288 PMIC */ {"INT33FD" ,0 },/* Intel Crystal Cove PMIC */ { "INT34D3", 0 }, /* Intel Whiskey Cove PMIC */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 98/227 ACPI: button: Add lid disable DMI quirk for Nextbook Ares 8A
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 4fd5556608bfa9c2bf276fc115ef04288331aded ]
The LID0 device on the Nextbook Ares 8A tablet always reports lid closed causing userspace to suspend the device as soon as booting is complete.
Add a DMI quirk to disable the broken lid functionality.
--- drivers/acpi/button.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/acpi/button.c +9 -0
@@ -77,6 +77,15 @@ static const struct dmi_system_id dmi_lid_quirks[] = { }, .driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_DISABLED, }, + { +/* Nextbook Ares 8A tablet, _LID device always reports lid closed */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Insyde" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"CherryTrail" ), + DMI_MATCH(DMI_BIOS_VERSION, "M882"), + }, + .driver_data = (void *)(long)ACPI_BUTTON_LID_INIT_DISABLED, + }, {/* * Lenovo Yoga 9 14ITL5, initial notification of the LID device
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 99/227 ACPI: x86: Add ACPI_QUIRK_UART1_SKIP for Lenovo Yoga Book yb1-x90f/l
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit f91280f35895d6dcb53f504968fafd1da0b00397 ]
The Lenovo Yoga Book yb1-x90f/l 2-in-1 which ships with Android as Factory OS has (another) bug in its DSDT where the UART resource for the BTH0 ACPI device contains "\\_SB.PCIO.URT1" as path to the UART.
Note that is with a letter 'O' instead of the number '0' which is wrong.
This causes Linux to instantiate a standard /dev/ttyS? device for the UART instead of a /sys/bus/serial device, which in turn causes bluetooth to not work.
Similar DSDT bugs have been encountered before and to work around those the acpi_quirk_skip_serdev_enumeration() helper exists.
Previous devices had the broken resource pointing to the first UART, while the BT HCI was on the second UART, which ACPI_QUIRK_UART1_TTY_UART2_SKIP deals with. Add a new ACPI_QUIRK_UART1_SKIP quirk for skipping enumeration of UART1 instead for the Yoga Book case and add this quirk to the existing DMI quirk table entry for the yb1-x90f/l .
This leaves the UART1 controller unbound allowing the x86-android-tablets module to manually instantiate a serdev for it fixing bluetooth.
--- drivers/acpi/x86/utils.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/acpi/x86/utils.c +9 -4
@@ -259,10 +259,11 @@ bool force_storage_d3(void)* drivers/platform/x86/x86-android-tablets.c kernel module. */ #define ACPI_QUIRK_SKIP_I2C_CLIENTS BIT(0) -#define ACPI_QUIRK_UART1_TTY_UART2_SKIP BIT(1) -#define ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY BIT(2) -#define ACPI_QUIRK_USE_ACPI_AC_AND_BATTERY BIT(3) -#define ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS BIT(4) +#define ACPI_QUIRK_UART1_SKIP BIT(1) +#define ACPI_QUIRK_UART1_TTY_UART2_SKIP BIT(2) +#define ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY BIT(3) +#define ACPI_QUIRK_USE_ACPI_AC_AND_BATTERY BIT(4) +#define ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS BIT(5)static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = {/*
@@ -319,6 +320,7 @@ static const struct dmi_system_id acpi_quirk_skip_dmi_ids[] = { DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "YETI-11"), }, .driver_data = (void *)(ACPI_QUIRK_SKIP_I2C_CLIENTS | +ACPI_QUIRK_UART1_SKIP |ACPI_QUIRK_SKIP_ACPI_AC_AND_BATTERY | ACPI_QUIRK_SKIP_GPIO_EVENT_HANDLERS), },
@@ -449,6 +451,9 @@ int acpi_quirk_skip_serdev_enumeration(struct device *controller_parent, bool *sif (dmi_id) quirks = (unsigned long )dmi_id->driver_data; +if ((quirks &ACPI_QUIRK_UART1_SKIP ) && uid ==1 ) + *skip = true; +if (quirks &ACPI_QUIRK_UART1_TTY_UART2_SKIP ) {if (uid ==1 )return -ENODEV ;/* Create tty cdev instead of serdev */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 100/227 ACPI: video: Add backlight=native DMI quirk for Apple iMac11,3
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 48436f2e9834b46b47b038b605c8142a1c07bc85 ]
Linux defaults to picking the non-working ACPI video backlight interface on the Apple iMac11,3 .
Add a DMI quirk to pick the working native radeon_bl0 interface instead.
--- drivers/acpi/video_detect.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/acpi/video_detect.c +8 -0
@@ -470,6 +470,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "82BK"), }, }, + { + .callback = video_detect_force_native, +/* Apple iMac11,3 */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Apple Inc." ), + DMI_MATCH(DMI_PRODUCT_NAME, "iMac11,3"), + }, + }, {/* https://bugzilla.redhat.com/show_bug.cgi?id=1217249 */ .callback = video_detect_force_native,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 101/227 ACPI: video: Add backlight=native DMI quirk for Lenovo ThinkPad X131e (3371 AMD version)
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit bd5d93df86a7ddf98a2a37e9c3751e3cb334a66c ]
Linux defaults to picking the non-working ACPI video backlight interface on the Lenovo ThinkPad X131e (3371 AMD version).
Add a DMI quirk to pick the working native radeon_bl0 interface instead.
--- drivers/acpi/video_detect.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/acpi/video_detect.c +8 -0
@@ -470,6 +470,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "82BK"), }, }, + { + .callback = video_detect_force_native, +/* Lenovo ThinkPad X131e (3371 AMD version) */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), + DMI_MATCH(DMI_PRODUCT_NAME, "3371"), + }, + }, { .callback = video_detect_force_native,/* Apple iMac11,3 */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 102/227 ACPI: resource: Remove "Zen" specific match and quirks
In reply to Greg Kroah-HartmanFrom: Mario Limonciello <[email protected]>
[ Upstream commit a9c4a912b7dc7ff922d4b9261160c001558f9755 ]
commit 9946e39fe8d0 ("ACPI: resource: skip IRQ override on AMD Zen platforms") attempted to overhaul the override logic so it didn't apply on X86 AMD Zen systems. This was intentional so that systems would prefer DSDT values instead of default MADT value for IRQ 1 on Ryzen 6000 systems which typically uses ActiveLow for IRQ1.
This turned out to be a bad assumption because several vendors add Interrupt Source Override but don't fix the DSDT. A pile of quirks was collecting that proved this wasn't sustaintable.
Furthermore some vendors have used ActiveHigh for IRQ1.
To solve this problem revert the following commits:
* commit 17bb7046e7ce ("ACPI: resource: Do IRQ override on all TongFang GMxRGxx")
* commit f3cb9b740869 ("ACPI: resource: do IRQ override on Lenovo 14ALC7")
* commit bfcdf58380b1 ("ACPI: resource: do IRQ override on LENOVO IdeaPad")
* commit 7592b79ba4a9 ("ACPI: resource: do IRQ override on XMG Core 15")
* commit 9946e39fe8d0 ("ACPI: resource: skip IRQ override on AMD Zen platforms")
--- drivers/acpi/resource.c | 60 ----------------------------------------- 1 file changed, 60 deletions(-)
drivers/acpi/resource.c +0 -60
@@ -470,52 +470,6 @@ static const struct dmi_system_id asus_laptop[] = { { } }; -static const struct dmi_system_id lenovo_laptop[] = { - { - .ident ="LENOVO IdeaPad Flex 5 14ALC7" , - .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"82R9" ), - }, - }, - { - .ident ="LENOVO IdeaPad Flex 5 16ALC7" , - .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"82RA" ), - }, - }, - { } -}; - -static const struct dmi_system_id tongfang_gm_rg[] = { - { - .ident ="TongFang GMxRGxx/XMG CORE 15 (M22)/TUXEDO Stellaris 15 Gen4 AMD" , - .matches = { -DMI_MATCH (DMI_BOARD_NAME ,"GMxRGxx" ), - }, - }, - { } -}; - -static const struct dmi_system_id maingear_laptop[] = { - { - .ident ="MAINGEAR Vector Pro 2 15" , - .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Micro Electronics Inc" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"MG-VCP2-15A3070T" ), - } - }, - { - .ident ="MAINGEAR Vector Pro 2 17" , - .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Micro Electronics Inc" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"MG-VCP2-17A3070T" ), - }, - }, - { } -}; -static const struct dmi_system_id lg_laptop[] = { { .ident ="LG Electronics 17U70P" ,
@@ -539,10 +493,6 @@ struct irq_override_cmp {static const struct irq_override_cmp override_table[] = { { medion_laptop,1 ,ACPI_LEVEL_SENSITIVE ,ACPI_ACTIVE_LOW ,0 , false }, { asus_laptop,1 ,ACPI_LEVEL_SENSITIVE ,ACPI_ACTIVE_LOW ,0 , false }, - { lenovo_laptop,6 ,ACPI_LEVEL_SENSITIVE ,ACPI_ACTIVE_LOW ,0 , true }, - { lenovo_laptop,10 ,ACPI_LEVEL_SENSITIVE ,ACPI_ACTIVE_LOW ,0 , true }, - { tongfang_gm_rg,1 ,ACPI_EDGE_SENSITIVE ,ACPI_ACTIVE_LOW ,1 , true }, - { maingear_laptop,1 ,ACPI_EDGE_SENSITIVE ,ACPI_ACTIVE_LOW ,1 , true }, { lg_laptop,1 ,ACPI_LEVEL_SENSITIVE ,ACPI_ACTIVE_LOW ,0 , false }, };
@@ -562,16 +512,6 @@ static bool acpi_dev_irq_override(u32 gsi, u8 triggering, u8 polarity,return entry->override; } -#ifdef CONFIG_X86 -/* -* IRQ override isn't needed on modern AMD Zen systems and -* this override breaks active low IRQs on AMD Ryzen 6000 and -* newer systems. Skip it. -*/ -if (boot_cpu_has (X86_FEATURE_ZEN )) -return false; -#endif -return true; }
Signature · 1 line
2.39.2
Re: [PATCH 6.4 102/227] ACPI: resource: Remove "Zen" specific match and quirks
Hi,
Quoted 14 lines · Greg Kroah-Hartman
From: Mario Limonciello <[email protected]>
[ Upstream commit
a9c4a912b7dc7ff922d4b9261160c001558f9755]commit
9946e39fe8d0("ACPI: resource: skip IRQ override on AMD Zen platforms") attempted to overhaul the override logic so it didn't apply on X86 AMD Zen systems. This was intentional so that systems would prefer DSDT values instead of default MADT value for IRQ 1 on Ryzen 6000 systems which typically uses ActiveLow for IRQ1.This turned out to be a bad assumption because several vendors add Interrupt Source Override but don't fix the DSDT. A pile of quirks was collecting that proved this wasn't sustaintable.
Quoted 9 lines
Furthermore some vendors have used ActiveHigh for IRQ1.
To solve this problem revert the following commits:
* commit17bb7046e7ce("ACPI: resource: Do IRQ override on all TongFang GMxRGxx")
* commitf3cb9b740869("ACPI: resource: do IRQ override on Lenovo 14ALC7")
* commitbfcdf58380b1("ACPI: resource: do IRQ override on LENOVO IdeaPad")
* commit7592b79ba4a9("ACPI: resource: do IRQ override on XMG Core 15")
* commit9946e39fe8d0("ACPI: resource: skip IRQ override on AMD Zen platforms")
Unfortunately this breaks the keyboard on Lenovo Yoga 7 14ARB7:
https://lore.kernel.org/all/[email protected]/
https://github.com/tomsom/yoga-linux/issues/47
Regards,
August Wikerfors
Greg Kroah-Hartman
maintainerRe: [PATCH 6.4 102/227] ACPI: resource: Remove "Zen" specific match and quirks
Quoted 27 lines · August Wikerfors
Hi,
Quoted 14 lines · Greg Kroah-Hartman
From: Mario Limonciello <[email protected]>
[ Upstream commit
a9c4a912b7dc7ff922d4b9261160c001558f9755]commit
9946e39fe8d0("ACPI: resource: skip IRQ override on AMD Zen platforms") attempted to overhaul the override logic so it didn't apply on X86 AMD Zen systems. This was intentional so that systems would prefer DSDT values instead of default MADT value for IRQ 1 on Ryzen 6000 systems which typically uses ActiveLow for IRQ1.This turned out to be a bad assumption because several vendors add Interrupt Source Override but don't fix the DSDT. A pile of quirks was collecting that proved this wasn't sustaintable.
Quoted 9 lines
Furthermore some vendors have used ActiveHigh for IRQ1.
To solve this problem revert the following commits:
* commit17bb7046e7ce("ACPI: resource: Do IRQ override on all TongFang GMxRGxx")
* commitf3cb9b740869("ACPI: resource: do IRQ override on Lenovo 14ALC7")
* commitbfcdf58380b1("ACPI: resource: do IRQ override on LENOVO IdeaPad")
* commit7592b79ba4a9("ACPI: resource: do IRQ override on XMG Core 15")
* commit9946e39fe8d0("ACPI: resource: skip IRQ override on AMD Zen platforms")
Quoted 3 lines
Unfortunately this breaks the keyboard on Lenovo Yoga 7 14ARB7:
https://lore.kernel.org/all/[email protected]/
https://github.com/tomsom/yoga-linux/issues/47
Help to fix it in Linus's tree and then we will be glad to take the fix into the stable trees as well.
thanks,
greg k-h
Greg Kroah-Hartman
maintainerPATCH 103/227 arm64: set __exception_irq_entry with __irq_entry as a default
In reply to Greg Kroah-HartmanFrom: Youngmin Nam <[email protected]>
[ Upstream commit f6794950f0e5ba37e3bbedda4d6ab0aad7395dd3 ]
filter_irq_stacks() is supposed to cut entries which are related irq entries from its call stack.
And in_irqentry_text() which is called by filter_irq_stacks() uses __irqentry_text_start/end symbol to find irq entries in callstack.
But it doesn't work correctly as without "CONFIG_FUNCTION_GRAPH_TRACER", arm64 kernel doesn't include gic_handle_irq which is entry point of arm64 irq between __irqentry_text_start and __irqentry_text_end as we discussed in below link.
https://lore.kernel.org/all/CACT4Y+aReMGLYua2rCLHgFpS9io5cZC04Q8GLs-uNmrn1ezxYQ@mail.gmail.com/#t
This problem can makes unintentional deep call stack entries especially in KASAN enabled situation as below.
[ 2479.383395]I[0:launcher-loader: 1719] Stack depot reached limit capacity [ 2479.383538]I[0:launcher-loader: 1719] WARNING: CPU: 0 PID: 1719 at lib/stackdepot.c:129 __stack_depot_save+0x464/0x46c [ 2479.385693]I[0:launcher-loader: 1719] pstate: 624000c5 (nZCv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 2479.385724]I[0:launcher-loader: 1719] pc : __stack_depot_save+0x464/0x46c [ 2479.385751]I[0:launcher-loader: 1719] lr : __stack_depot_save+0x460/0x46c [ 2479.385774]I[0:launcher-loader: 1719] sp : ffffffc0080073c0 [ 2479.385793]I[0:launcher-loader: 1719] x29: ffffffc0080073e0 x28: ffffffd00b78a000 x27: 0000000000000000 [ 2479.385839]I[0:launcher-loader: 1719] x26: 000000000004d1dd x25: ffffff891474f000 x24: 00000000ca64d1dd [ 2479.385882]I[0:launcher-loader: 1719] x23: 0000000000000200 x22: 0000000000000220 x21: 0000000000000040 [ 2479.385925]I[0:launcher-loader: 1719] x20: ffffffc008007440 x19: 0000000000000000 x18: 0000000000000000 [ 2479.385969]I[0:launcher-loader: 1719] x17: 2065726568207475 x16: 000000000000005e x15: 2d2d2d2d2d2d2d20 [ 2479.386013]I[0:launcher-loader: 1719] x14: 5d39313731203a72 x13: 00000000002f6b30 x12: 00000000002f6af8 [ 2479.386057]I[0:launcher-loader: 1719] x11: 00000000ffffffff x10: ffffffb90aacf000 x9 : e8a74a6c16008800 [ 2479.386101]I[0:launcher-loader: 1719] x8 : e8a74a6c16008800 x7 : 00000000002f6b30 x6 : 00000000002f6af8 [ 2479.386145]I[0:launcher-loader: 1719] x5 : ffffffc0080070c8 x4 : ffffffd00b192380 x3 : ffffffd0092b313c [ 2479.386189]I[0:launcher-loader: 1719] x2 : 0000000000000001 x1 : 0000000000000004 x0 : 0000000000000022 [ 2479.386231]I[0:launcher-loader: 1719] Call trace: [ 2479.386248]I[0:launcher-loader: 1719] __stack_depot_save+0x464/0x46c [ 2479.386273]I[0:launcher-loader: 1719] kasan_save_stack+0x58/0x70 [ 2479.386303]I[0:launcher-loader: 1719] save_stack_info+0x34/0x138 [ 2479.386331]I[0:launcher-loader: 1719] kasan_save_free_info+0x18/0x24 [ 2479.386358]I[0:launcher-loader: 1719] ____kasan_slab_free+0x16c/0x170 [ 2479.386385]I[0:launcher-loader: 1719] __kasan_slab_free+0x10/0x20 [ 2479.386410]I[0:launcher-loader: 1719] kmem_cache_free+0x238/0x53c [ 2479.386435]I[0:launcher-loader: 1719] mempool_free_slab+0x1c/0x28 [ 2479.386460]I[0:launcher-loader: 1719] mempool_free+0x7c/0x1a0 [ 2479.386484]I[0:launcher-loader: 1719] bvec_free+0x34/0x80 [ 2479.386514]I[0:launcher-loader: 1719] bio_free+0x60/0x98 [ 2479.386540]I[0:launcher-loader: 1719] bio_put+0x50/0x21c [ 2479.386567]I[0:launcher-loader: 1719] f2fs_write_end_io+0x4ac/0x4d0 [ 2479.386594]I[0:launcher-loader: 1719] bio_endio+0x2dc/0x300 [ 2479.386622]I[0:launcher-loader: 1719] __dm_io_complete+0x324/0x37c [ 2479.386650]I[0:launcher-loader: 1719] dm_io_dec_pending+0x60/0xa4 [ 2479.386676]I[0:launcher-loader: 1719] clone_endio+0xf8/0x2f0 [ 2479.386700]I[0:launcher-loader: 1719] bio_endio+0x2dc/0x300 [ 2479.386727]I[0:launcher-loader: 1719] blk_update_request+0x258/0x63c [ 2479.386754]I[0:launcher-loader: 1719] scsi_end_request+0x50/0x304 [ 2479.386782]I[0:launcher-loader: 1719] scsi_io_completion+0x88/0x160 [ 2479.386808]I[0:launcher-loader: 1719] scsi_finish_command+0x17c/0x194 [ 2479.386833]I[0:launcher-loader: 1719] scsi_complete+0xcc/0x158 [ 2479.386859]I[0:launcher-loader: 1719] blk_mq_complete_request+0x4c/0x5c [ 2479.386885]I[0:launcher-loader: 1719] scsi_done_internal+0xf4/0x1e0 [ 2479.386910]I[0:launcher-loader: 1719] scsi_done+0x14/0x20 [ 2479.386935]I[0:launcher-loader: 1719] ufshcd_compl_one_cqe+0x578/0x71c [ 2479.386963]I[0:launcher-loader: 1719] ufshcd_mcq_poll_cqe_nolock+0xc8/0x150 [ 2479.386991]I[0:launcher-loader: 1719] ufshcd_intr+0x868/0xc0c [ 2479.387017]I[0:launcher-loader: 1719] __handle_irq_event_percpu+0xd0/0x348 [ 2479.387044]I[0:launcher-loader: 1719] handle_irq_event_percpu+0x24/0x74 [ 2479.387068]I[0:launcher-loader: 1719] handle_irq_event+0x74/0xe0 [ 2479.387091]I[0:launcher-loader: 1719] handle_fasteoi_irq+0x174/0x240 [ 2479.387118]I[0:launcher-loader: 1719] handle_irq_desc+0x7c/0x2c0 [ 2479.387147]I[0:launcher-loader: 1719] generic_handle_domain_irq+0x1c/0x28 [ 2479.387174]I[0:launcher-loader: 1719] gic_handle_irq+0x64/0x158 [ 2479.387204]I[0:launcher-loader: 1719] call_on_irq_stack+0x2c/0x54 [ 2479.387231]I[0:launcher-loader: 1719] do_interrupt_handler+0x70/0xa0 [ 2479.387258]I[0:launcher-loader: 1719] el1_interrupt+0x34/0x68 [ 2479.387283]I[0:launcher-loader: 1719] el1h_64_irq_handler+0x18/0x24 [ 2479.387308]I[0:launcher-loader: 1719] el1h_64_irq+0x68/0x6c [ 2479.387332]I[0:launcher-loader: 1719] blk_attempt_bio_merge+0x8/0x170 [ 2479.387356]I[0:launcher-loader: 1719] blk_mq_attempt_bio_merge+0x78/0x98 [ 2479.387383]I[0:launcher-loader: 1719] blk_mq_submit_bio+0x324/0xa40 [ 2479.387409]I[0:launcher-loader: 1719] __submit_bio+0x104/0x138 [ 2479.387436]I[0:launcher-loader: 1719] submit_bio_noacct_nocheck+0x1d0/0x4a0 [ 2479.387462]I[0:launcher-loader: 1719] submit_bio_noacct+0x618/0x804 [ 2479.387487]I[0:launcher-loader: 1719] submit_bio+0x164/0x180 [ 2479.387511]I[0:launcher-loader: 1719] f2fs_submit_read_bio+0xe4/0x1c4 [ 2479.387537]I[0:launcher-loader: 1719] f2fs_mpage_readpages+0x888/0xa4c [ 2479.387563]I[0:launcher-loader: 1719] f2fs_readahead+0xd4/0x19c [ 2479.387587]I[0:launcher-loader: 1719] read_pages+0xb0/0x4ac [ 2479.387614]I[0:launcher-loader: 1719] page_cache_ra_unbounded+0x238/0x288 [ 2479.387642]I[0:launcher-loader: 1719] do_page_cache_ra+0x60/0x6c [ 2479.387669]I[0:launcher-loader: 1719] page_cache_ra_order+0x318/0x364 [ 2479.387695]I[0:launcher-loader: 1719] ondemand_readahead+0x30c/0x3d8 [ 2479.387722]I[0:launcher-loader: 1719] page_cache_sync_ra+0xb4/0xc8 [ 2479.387749]I[0:launcher-loader: 1719] filemap_read+0x268/0xd24 [ 2479.387777]I[0:launcher-loader: 1719] f2fs_file_read_iter+0x1a0/0x62c [ 2479.387806]I[0:launcher-loader: 1719] vfs_read+0x258/0x34c [ 2479.387831]I[0:launcher-loader: 1719] ksys_pread64+0x8c/0xd0 [ 2479.387857]I[0:launcher-loader: 1719] __arm64_sys_pread64+0x48/0x54 [ 2479.387881]I[0:launcher-loader: 1719] invoke_syscall+0x58/0x158 [ 2479.387909]I[0:launcher-loader: 1719] el0_svc_common+0xf0/0x134 [ 2479.387935]I[0:launcher-loader: 1719] do_el0_svc+0x44/0x114 [ 2479.387961]I[0:launcher-loader: 1719] el0_svc+0x2c/0x80 [ 2479.387985]I[0:launcher-loader: 1719] el0t_64_sync_handler+0x48/0x114 [ 2479.388010]I[0:launcher-loader: 1719] el0t_64_sync+0x190/0x194 [ 2479.388038]I[0:launcher-loader: 1719] Kernel panic - not syncing: kernel: panic_on_warn set ...
So let's set __exception_irq_entry with __irq_entry as a default. Applying this patch, we can see gic_hande_irq is included in Systemp.map as below.
* Beforeffffffc008010000 T __do_softirqffffffc008010000 T __irqentry_text_endffffffc008010000 T __irqentry_text_startffffffc008010000 T __softirqentry_text_startffffffc008010000 T _stextffffffc00801066c T __softirqentry_text_endffffffc008010670 T __entry_text_start
* Afterffffffc008010000 T __irqentry_text_startffffffc008010000 T _stextffffffc008010000 t gic_handle_irqffffffc00801013c t gic_handle_irqffffffc008010294 T __irqentry_text_endffffffc008010298 T __do_softirqffffffc008010298 T __softirqentry_text_startffffffc008010904 T __softirqentry_text_endffffffc008010908 T __entry_text_start
--- arch/arm64/include/asm/exception.h | 5 ----- 1 file changed, 5 deletions(-)
arch/arm64/include/asm/exception.h +0 -5
@@ -8,16 +8,11 @@#define __ASM_EXCEPTION_H#include <asm/esr.h> -#include <asm/kprobes.h> #include <asm/ptrace.h> #include <linux/interrupt.h> -#ifdef CONFIG_FUNCTION_GRAPH_TRACER #define __exception_irq_entry __irq_entry -#else -#define __exception_irq_entry __kprobes -#endif static inline unsigned long disr_to_esr (u64 disr) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 104/227 arm64: mm: fix VA-range sanity check
In reply to Greg Kroah-HartmanFrom: Mark Rutland <[email protected]>
[ Upstream commit ab9b4008092c86dc12497af155a0901cc1156999 ]
Both create_mapping_noalloc() and update_mapping_prot() sanity-check their 'virt' parameter, but the check itself doesn't make much sense. The condition used today appears to be a historical accident.
The sanity-check condition:
if ((virt >= PAGE_END) && (virt < VMALLOC_START)) {
[ ... warning here ... ]
return;
}... can only be true for the KASAN shadow region or the module region, and there's no reason to exclude these specifically for creating and updateing mappings.
When arm64 support was first upstreamed in commit:
c1cc1552616d0f35 ("arm64: MMU initialisation")
... the condition was:
if (virt < VMALLOC_START) {
[ ... warning here ... ]
return;
}At the time, VMALLOC_START was the lowest kernel address, and this was checking whether 'virt' would be translated via TTBR1.
Subsequently in commit:
14c127c957c1c607 ("arm64: mm: Flip kernel VA space")
... the condition was changed to:
if ((virt >= VA_START) && (virt < VMALLOC_START)) {
[ ... warning here ... ]
return;
}This appear to have been a thinko. The commit moved the linear map to the bottom of the kernel address space, with VMALLOC_START being at the halfway point. The old condition would warn for changes to the linear map below this, and at the time VA_START was the end of the linear map.
Subsequently we cleaned up the naming of VA_START in commit:
77ad4ce69321abbe ("arm64: memory: rename VA_START to PAGE_END")
... keeping the erroneous condition as:
if ((virt >= PAGE_END) && (virt < VMALLOC_START)) {
[ ... warning here ... ]
return;
}Correct the condition to check against the start of the TTBR1 address space, which is currently PAGE_OFFSET. This simplifies the logic, and more clearly matches the "outside kernel range" message in the warning.
--- arch/arm64/mm/mmu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/mm/mmu.c +2 -2
@@ -451,7 +451,7 @@ static phys_addr_t pgd_pgtable_alloc(int shift)void __init create_mapping_noalloc (phys_addr_t phys,unsigned long virt,phys_addr_t size,pgprot_t prot) { -if ((virt >=PAGE_END ) && (virt <VMALLOC_START )) { +if (virt <PAGE_OFFSET ) {pr_warn ("BUG: not creating mapping for %pa at 0x%016lx - outside kernel range\n" , &phys, virt);return ;
@@ -478,7 +478,7 @@ void __init create_pgd_mapping(struct mm_struct *mm, phys_addr_t phys,static void update_mapping_prot (phys_addr_t phys,unsigned long virt,phys_addr_t size,pgprot_t prot) { -if ((virt >=PAGE_END ) && (virt <VMALLOC_START )) { +if (virt <PAGE_OFFSET ) {pr_warn ("BUG: not updating mapping for %pa at 0x%016lx - outside kernel range\n" , &phys, virt);return ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 105/227 ACPI: video: Add backlight=native DMI quirk for Dell Studio 1569
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 23d28cc0444be3f694eb986cd653b6888b78431d ]
The Dell Studio 1569 predates Windows 8, so it defaults to using acpi_video# for backlight control, but this is non functional on this model.
Add a DMI quirk to use the native intel_backlight interface which does work properly.
--- drivers/acpi/video_detect.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/acpi/video_detect.c +8 -0
@@ -528,6 +528,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "Precision 7510"), }, }, + { + .callback = video_detect_force_native, +/* Dell Studio 1569 */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), + DMI_MATCH(DMI_PRODUCT_NAME, "Studio 1569"), + }, + }, { .callback = video_detect_force_native,/* Acer Aspire 3830TG */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 106/227 rcu-tasks: Avoid pr_info() with spin lock in cblist_init_generic()
In reply to Greg Kroah-HartmanFrom: Shigeru Yoshida <[email protected]>
[ Upstream commit 5fc8cbe4cf0fd34ded8045c385790c3bf04f6785 ]
pr_info() is called with rtp->cbs_gbl_lock spin lock locked. Because pr_info() calls printk() that might sleep, this will result in BUG like below:
[ 0.206455] cblist_init_generic: Setting adjustable number of callback queues.
[ 0.206463]
[ 0.206464] =============================
[ 0.206464] [ BUG: Invalid wait context ]
[ 0.206465] 5.19.0-00428-g9de1f9c8ca51 #5 Not tainted
[ 0.206466] -----------------------------
[ 0.206466] swapper/0/1 is trying to lock:
[ 0.206467] ffffffffa0167a58 (&port_lock_key){....}-{3:3}, at: serial8250_console_write+0x327/0x4a0
[ 0.206473] other info that might help us debug this:
[ 0.206473] context-{5:5}
[ 0.206474] 3 locks held by swapper/0/1:
[ 0.206474] #0: ffffffff9eb597e0 (rcu_tasks.cbs_gbl_lock){....}-{2:2}, at: cblist_init_generic.constprop.0+0x14/0x1f0
[ 0.206478] #1: ffffffff9eb579c0 (console_lock){+.+.}-{0:0}, at: _printk+0x63/0x7e
[ 0.206482] #2: ffffffff9ea77780 (console_owner){....}-{0:0}, at: console_emit_next_record.constprop.0+0x111/0x330
[ 0.206485] stack backtrace:
[ 0.206486] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-00428-g9de1f9c8ca51 #5
[ 0.206488] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.fc36 04/01/2014
[ 0.206489] Call Trace:
[ 0.206490] <TASK>
[ 0.206491] dump_stack_lvl+0x6a/0x9f
[ 0.206493] __lock_acquire.cold+0x2d7/0x2fe
[ 0.206496] ? stack_trace_save+0x46/0x70
[ 0.206497] lock_acquire+0xd1/0x2f0
[ 0.206499] ? serial8250_console_write+0x327/0x4a0
[ 0.206500] ? __lock_acquire+0x5c7/0x2720
[ 0.206502] _raw_spin_lock_irqsave+0x3d/0x90
[ 0.206504] ? serial8250_console_write+0x327/0x4a0
[ 0.206506] serial8250_console_write+0x327/0x4a0
[ 0.206508] console_emit_next_record.constprop.0+0x180/0x330
[ 0.206511] console_unlock+0xf7/0x1f0
[ 0.206512] vprintk_emit+0xf7/0x330
[ 0.206514] _printk+0x63/0x7e
[ 0.206516] cblist_init_generic.constprop.0.cold+0x24/0x32
[ 0.206518] rcu_init_tasks_generic+0x5/0xd9
[ 0.206522] kernel_init_freeable+0x15b/0x2a2
[ 0.206523] ? rest_init+0x160/0x160
[ 0.206526] kernel_init+0x11/0x120
[ 0.206527] ret_from_fork+0x1f/0x30
[ 0.206530] </TASK>
[ 0.207018] cblist_init_generic: Setting shift to 1 and lim to 1.This patch moves pr_info() so that it is called without rtp->cbs_gbl_lock locked.
--- kernel/rcu/tasks.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
kernel/rcu/tasks.h +4 -1
@@ -241,7 +241,6 @@ static void cblist_init_generic(struct rcu_tasks *rtp)if (rcu_task_enqueue_lim <0 ) { rcu_task_enqueue_lim =1 ; rcu_task_cb_adjust = true; -pr_info ("%s: Setting adjustable number of callback queues.\n" , __func__); }else if (rcu_task_enqueue_lim ==0 ) { rcu_task_enqueue_lim =1 ; }
@@ -272,6 +271,10 @@ static void cblist_init_generic(struct rcu_tasks *rtp)raw_spin_unlock_rcu_node (rtpcp);// irqs remain disabled. }raw_spin_unlock_irqrestore (&rtp->cbs_gbl_lock, flags); + +if (rcu_task_cb_adjust) +pr_info ("%s: Setting adjustable number of callback queues.\n" , __func__); +pr_info ("%s: Setting shift to %d and lim to %d.\n" , __func__,data_race (rtp->percpu_enqueue_shift),data_race (rtp->percpu_enqueue_lim)); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 107/227 rcu: Mark additional concurrent load from ->cpu_no_qs.b.exp
In reply to Greg Kroah-HartmanFrom: Paul E. McKenney <[email protected]>
[ Upstream commit 9146eb25495ea8bfb5010192e61e3ed5805ce9ef ]
The per-CPU rcu_data structure's ->cpu_no_qs.b.exp field is updated only on the instance corresponding to the current CPU, but can be read more widely. Unmarked accesses are OK from the corresponding CPU, but only if interrupts are disabled, given that interrupt handlers can and do modify this field.
Unfortunately, although the load from rcu_preempt_deferred_qs() is always carried out from the corresponding CPU, interrupts are not necessarily disabled. This commit therefore upgrades this load to READ_ONCE.
Similarly, the diagnostic access from synchronize_rcu_expedited_wait() might run with interrupts disabled and from some other CPU. This commit therefore marks this load with data_race().
Finally, the C-language access in rcu_preempt_ctxt_queue() is OK as is because interrupts are disabled and this load is always from the corresponding CPU. This commit adds a comment giving the rationale for this access being safe.
This data race was reported by KCSAN. Not appropriate for backporting due to failure being unlikely.
--- kernel/rcu/tree_exp.h | 2 +- kernel/rcu/tree_plugin.h | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-)
kernel/rcu/tree_exp.h +1 -1
@@ -643,7 +643,7 @@ static void synchronize_rcu_expedited_wait(void)"O." [!!cpu_online (cpu)],"o." [!!(rdp->grpmask & rnp->expmaskinit)],"N." [!!(rdp->grpmask & rnp->expmaskinitnext)], - "D."[!!(rdp->cpu_no_qs.b.exp)]); + "D."[!!data_race(rdp->cpu_no_qs.b.exp)]); } } pr_cont(" } %lu jiffies s: %lu root: %#lx/%c\n",
kernel/rcu/tree_plugin.h +3 -1
@@ -257,6 +257,8 @@ static void rcu_preempt_ctxt_queue(struct rcu_node *rnp, struct rcu_data *rdp)* GP should not be able to end until we report, so there should be * no need to check for a subsequent expedited GP. (Though we are * still in a quiescent state in any case.) +* +* Interrupts are disabled, so ->cpu_no_qs.b.exp cannot change. */ if (blkd_state &RCU_EXP_BLKD && rdp->cpu_no_qs.b.exp)rcu_report_exp_rdp (rdp);
@@ -941,7 +943,7 @@ notrace void rcu_preempt_deferred_qs(struct task_struct *t) {struct rcu_data *rdp =this_cpu_ptr (&rcu_data); -if (rdp->cpu_no_qs.b.exp) +if (READ_ONCE (rdp->cpu_no_qs.b.exp))rcu_report_exp_rdp (rdp); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 108/227 tools/nolibc: ensure stack protector guard is never zero
In reply to Greg Kroah-HartmanFrom: Thomas Weißschuh <[email protected]>
[ Upstream commit 88fc7eb54ecc6db8b773341ce39ad201066fa7da ]
The all-zero pattern is one of the more probable out-of-bound writes so add a special case to not accidentally accept it.
Also it enables the reliable detection of stack protector initialization during testing.
--- tools/include/nolibc/stackprotector.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
tools/include/nolibc/stackprotector.h +3 -2
@@ -45,8 +45,9 @@ __attribute__((weak,no_stack_protector,section(".text.nolibc_stack_chk")))void __stack_chk_init (void ) {my_syscall3 (__NR_getrandom, &__stack_chk_guard,sizeof (__stack_chk_guard),0 ); -/* a bit more randomness in case getrandom() fails */ - __stack_chk_guard ^= (uintptr_t ) &__stack_chk_guard; +/* a bit more randomness in case getrandom() fails, ensure the guard is never 0 */ +if (__stack_chk_guard != (uintptr_t ) &__stack_chk_guard) + __stack_chk_guard ^= (uintptr_t ) &__stack_chk_guard; }#endif // defined(NOLIBC_STACKPROTECTOR)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 109/227 sched/fair: Dont balance task to its current running CPU
In reply to Greg Kroah-HartmanFrom: Yicong Yang <[email protected]>
[ Upstream commit 0dd37d6dd33a9c23351e6115ae8cdac7863bc7de ]
We've run into the case that the balancer tries to balance a migration disabled task and trigger the warning in set_task_cpu() like below:
------------[ cut here ]------------ WARNING: CPU: 7 PID: 0 at kernel/sched/core.c:3115 set_task_cpu+0x188/0x240 Modules linked in: hclgevf xt_CHECKSUM ipt_REJECT nf_reject_ipv4 <...snip> CPU: 7 PID: 0 Comm: swapper/7 Kdump: loaded Tainted: G O 6.1.0-rc4+ #1 Hardware name: Huawei TaiShan 2280 V2/BC82AMDC, BIOS 2280-V2 CS V5.B221.01 12/09/2021 pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : set_task_cpu+0x188/0x240 lr : load_balance+0x5d0/0xc60 sp : ffff80000803bc70 x29: ffff80000803bc70 x28: ffff004089e190e8 x27: ffff004089e19040 x26: ffff007effcabc38 x25: 0000000000000000 x24: 0000000000000001 x23: ffff80000803be84 x22: 000000000000000c x21: ffffb093e79e2a78 x20: 000000000000000c x19: ffff004089e19040 x18: 0000000000000000 x17: 0000000000001fad x16: 0000000000000030 x15: 0000000000000000 x14: 0000000000000003 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000001 x10: 0000000000000400 x9 : ffffb093e4cee530 x8 : 00000000fffffffe x7 : 0000000000ce168a x6 : 000000000000013e x5 : 00000000ffffffe1 x4 : 0000000000000001 x3 : 0000000000000b2a x2 : 0000000000000b2a x1 : ffffb093e6d6c510 x0 : 0000000000000001 Call trace: set_task_cpu+0x188/0x240 load_balance+0x5d0/0xc60 rebalance_domains+0x26c/0x380 _nohz_idle_balance.isra.0+0x1e0/0x370 run_rebalance_domains+0x6c/0x80 __do_softirq+0x128/0x3d8 ____do_softirq+0x18/0x24 call_on_irq_stack+0x2c/0x38 do_softirq_own_stack+0x24/0x3c __irq_exit_rcu+0xcc/0xf4 irq_exit_rcu+0x18/0x24 el1_interrupt+0x4c/0xe4 el1h_64_irq_handler+0x18/0x2c el1h_64_irq+0x74/0x78 arch_cpu_idle+0x18/0x4c default_idle_call+0x58/0x194 do_idle+0x244/0x2b0 cpu_startup_entry+0x30/0x3c secondary_start_kernel+0x14c/0x190 __secondary_switched+0xb0/0xb4 ---[ end trace 0000000000000000 ]---
Further investigation shows that the warning is superfluous, the migration disabled task is just going to be migrated to its current running CPU. This is because that on load balance if the dst_cpu is not allowed by the task, we'll re-select a new_dst_cpu as a candidate. If no task can be balanced to dst_cpu we'll try to balance the task to the new_dst_cpu instead. In this case when the migration disabled task is not on CPU it only allows to run on its current CPU, load balance will select its current CPU as new_dst_cpu and later triggers the warning above.
The new_dst_cpu is chosen from the env->dst_grpmask. Currently it contains CPUs in sched_group_span() and if we have overlapped groups it's possible to run into this case. This patch makes env->dst_grpmask of group_balance_mask() which exclude any CPUs from the busiest group and solve the issue. For balancing in a domain with no overlapped groups the behaviour keeps same as before.
--- kernel/sched/fair.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/sched/fair.c +1 -1
@@ -10762,7 +10762,7 @@ static int load_balance(int this_cpu, struct rq *this_rq, .sd = sd, .dst_cpu = this_cpu, .dst_rq = this_rq, - .dst_grpmask = sched_group_span(sd->groups), + .dst_grpmask = group_balance_mask(sd->groups), .idle = idle, .loop_break = SCHED_NR_MIGRATE_BREAK, .cpus = cpus,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 110/227 wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range
In reply to Greg Kroah-HartmanFrom: Maxime Bizon <[email protected]>
[ Upstream commit e2ceb1de2f83aafd8003f0b72dfd4b7441e97d14 ]
Because of what seems to be a typo, a 6Ghz-only phy for which the BDF does not allow the 7115Mhz channel will fail to register:
WARNING: CPU: 2 PID: 106 at net/wireless/core.c:907 wiphy_register+0x914/0x954 Modules linked in: ath11k_pci sbsa_gwdt CPU: 2 PID: 106 Comm: kworker/u8:5 Not tainted 6.3.0-rc7-next-20230418-00549-g1e096a17625a-dirty #9 Hardware name: Freebox V7R Board (DT) Workqueue: ath11k_qmi_driver_event ath11k_qmi_driver_event_work pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : wiphy_register+0x914/0x954 lr : ieee80211_register_hw+0x67c/0xc10 sp : ffffff800b123aa0 x29: ffffff800b123aa0 x28: 0000000000000000 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000006 x24: ffffffc008d51418 x23: ffffffc008cb0838 x22: ffffff80176c2460 x21: 0000000000000168 x20: ffffff80176c0000 x19: ffffff80176c03e0 x18: 0000000000000014 x17: 00000000cbef338c x16: 00000000d2a26f21 x15: 00000000ad6bb85f x14: 0000000000000020 x13: 0000000000000020 x12: 00000000ffffffbd x11: 0000000000000208 x10: 00000000fffffdf7 x9 : ffffffc009394718 x8 : ffffff80176c0528 x7 : 000000007fffffff x6 : 0000000000000006 x5 : 0000000000000005 x4 : ffffff800b304284 x3 : ffffff800b304284 x2 : ffffff800b304d98 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: wiphy_register+0x914/0x954 ieee80211_register_hw+0x67c/0xc10 ath11k_mac_register+0x7c4/0xe10 ath11k_core_qmi_firmware_ready+0x1f4/0x570 ath11k_qmi_driver_event_work+0x198/0x590 process_one_work+0x1b8/0x328 worker_thread+0x6c/0x414 kthread+0x100/0x104 ret_from_fork+0x10/0x20 ---[ end trace 0000000000000000 ]--- ath11k_pci 0002:01:00.0: ieee80211 registration failed: -22 ath11k_pci 0002:01:00.0: failed register the radio with mac80211: -22 ath11k_pci 0002:01:00.0: failed to create pdev core: -22
--- drivers/net/wireless/ath/ath11k/mac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath11k/mac.c +1 -1
@@ -8892,7 +8892,7 @@ static int ath11k_mac_setup_channels_rates(struct ath11k *ar, }if (supported_bands &WMI_HOST_WLAN_5G_CAP ) { -if (reg_cap->high_5ghz_chan >=ATH11K_MAX_6G_FREQ ) { +if (reg_cap->high_5ghz_chan >=ATH11K_MIN_6G_FREQ ) { channels =kmemdup (ath11k_6ghz_channels,sizeof (ath11k_6ghz_channels),GFP_KERNEL );if (!channels) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 111/227 bpf: Print a warning only if writing to unprivileged_bpf_disabled.
In reply to Greg Kroah-HartmanFrom: Kui-Feng Lee <[email protected]>
[ Upstream commit fedf99200ab086c42a572fca1d7266b06cdc3e3f ]
Only print the warning message if you are writing to "/proc/sys/kernel/unprivileged_bpf_disabled".
The kernel may print an annoying warning when you read "/proc/sys/kernel/unprivileged_bpf_disabled" saying
WARNING: Unprivileged eBPF is enabled with eIBRS on, data leaks possible via Spectre v2 BHB attacks!
However, this message is only meaningful when the feature is disabled or enabled.
--- kernel/bpf/syscall.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/bpf/syscall.c +2 -1
@@ -5394,7 +5394,8 @@ static int bpf_unpriv_handler(struct ctl_table *table, int write, *(int *)table->data = unpriv_enable; } -unpriv_ebpf_notify (unpriv_enable); +if (write) +unpriv_ebpf_notify (unpriv_enable);return ret; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 112/227 bpf: Address KCSAN report on bpf_lru_list
In reply to Greg Kroah-HartmanFrom: Martin KaFai Lau <[email protected]>
[ Upstream commit ee9fd0ac3017c4313be91a220a9ac4c99dde7ad4 ]
KCSAN reported a data-race when accessing node->ref. Although node->ref does not have to be accurate,
take this chance to use a more common READ_ONCE() and WRITE_ONCE() pattern instead of data_race().
There is an existing bpf_lru_node_is_ref() and bpf_lru_node_set_ref(). This patch also adds bpf_lru_node_clear_ref() to do the WRITE_ONCE(node->ref, 0) also.
==================================================================
BUG: KCSAN: data-race in __bpf_lru_list_rotate / __htab_lru_percpu_map_update_elem
write to 0xffff888137038deb of 1 bytes by task 11240 on cpu 1:
__bpf_lru_node_move kernel/bpf/bpf_lru_list.c:113 [inline] __bpf_lru_list_rotate_active kernel/bpf/bpf_lru_list.c:149 [inline] __bpf_lru_list_rotate+0x1bf/0x750 kernel/bpf/bpf_lru_list.c:240 bpf_lru_list_pop_free_to_local kernel/bpf/bpf_lru_list.c:329 [inline] bpf_common_lru_pop_free kernel/bpf/bpf_lru_list.c:447 [inline] bpf_lru_pop_free+0x638/0xe20 kernel/bpf/bpf_lru_list.c:499 prealloc_lru_pop kernel/bpf/hashtab.c:290 [inline] __htab_lru_percpu_map_update_elem+0xe7/0x820 kernel/bpf/hashtab.c:1316 bpf_percpu_hash_update+0x5e/0x90 kernel/bpf/hashtab.c:2313 bpf_map_update_value+0x2a9/0x370 kernel/bpf/syscall.c:200 generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1687 bpf_map_do_batch+0x2d9/0x3d0 kernel/bpf/syscall.c:4534 __sys_bpf+0x338/0x810 __do_sys_bpf kernel/bpf/syscall.c:5096 [inline] __se_sys_bpf kernel/bpf/syscall.c:5094 [inline] __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5094 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
read to 0xffff888137038deb of 1 bytes by task 11241 on cpu 0:
bpf_lru_node_set_ref kernel/bpf/bpf_lru_list.h:70 [inline] __htab_lru_percpu_map_update_elem+0x2f1/0x820 kernel/bpf/hashtab.c:1332 bpf_percpu_hash_update+0x5e/0x90 kernel/bpf/hashtab.c:2313 bpf_map_update_value+0x2a9/0x370 kernel/bpf/syscall.c:200 generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1687 bpf_map_do_batch+0x2d9/0x3d0 kernel/bpf/syscall.c:4534 __sys_bpf+0x338/0x810 __do_sys_bpf kernel/bpf/syscall.c:5096 [inline] __se_sys_bpf kernel/bpf/syscall.c:5094 [inline] __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5094 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
value changed: 0x01 -> 0x00
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 11241 Comm: syz-executor.3 Not tainted 6.3.0-rc7-syzkaller-00136-g6a66fdd29ea1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023 ==================================================================
--- kernel/bpf/bpf_lru_list.c | 21 +++++++++++++-------- kernel/bpf/bpf_lru_list.h | 7 ++----- 2 files changed, 15 insertions(+), 13 deletions(-)
kernel/bpf/bpf_lru_list.c +13 -8
@@ -41,7 +41,12 @@ static struct list_head *local_pending_list(struct bpf_lru_locallist *loc_l)/* bpf_lru_node helpers */ static bool bpf_lru_node_is_ref (const struct bpf_lru_node *node) { -return node->ref; +return READ_ONCE (node->ref); +} + +static void bpf_lru_node_clear_ref (struct bpf_lru_node *node) +{ +WRITE_ONCE (node->ref,0 ); } static void bpf_lru_list_count_inc(struct bpf_lru_list *l,
@@ -89,7 +94,7 @@ static void __bpf_lru_node_move_in(struct bpf_lru_list *l,bpf_lru_list_count_inc (l, tgt_type); node->type = tgt_type; - node->ref =0 ; +bpf_lru_node_clear_ref (node);list_move (&node->list, &l->lists[tgt_type]); }
@@ -110,7 +115,7 @@ static void __bpf_lru_node_move(struct bpf_lru_list *l,bpf_lru_list_count_inc (l, tgt_type); node->type = tgt_type; } - node->ref =0 ; +bpf_lru_node_clear_ref (node);/* If the moving node is the next_inactive_rotation candidate, * move the next_inactive_rotation pointer also.
@@ -353,7 +358,7 @@ static void __local_list_add_pending(struct bpf_lru *lru, *(u32 *)((void *)node + lru->hash_offset) = hash; node->cpu = cpu; node->type =BPF_LRU_LOCAL_LIST_T_PENDING ; - node->ref =0 ; +bpf_lru_node_clear_ref (node);list_add (&node->list,local_pending_list (loc_l)); }
@@ -419,7 +424,7 @@ static struct bpf_lru_node *bpf_percpu_lru_pop_free(struct bpf_lru *lru,if (!list_empty (free_list)) { node = list_first_entry(free_list, struct bpf_lru_node, list); *(u32 *)((void *)node + lru->hash_offset) = hash; - node->ref =0 ; +bpf_lru_node_clear_ref (node);__bpf_lru_node_move (l, node,BPF_LRU_LIST_T_INACTIVE ); }
@@ -522,7 +527,7 @@ static void bpf_common_lru_push_free(struct bpf_lru *lru, } node->type =BPF_LRU_LOCAL_LIST_T_FREE ; - node->ref =0 ; +bpf_lru_node_clear_ref (node);list_move (&node->list,local_free_list (loc_l));raw_spin_unlock_irqrestore (&loc_l->lock, flags);
@@ -568,7 +573,7 @@ static void bpf_common_lru_populate(struct bpf_lru *lru, void *buf, node = (struct bpf_lru_node *)(buf + node_offset); node->type =BPF_LRU_LIST_T_FREE ; - node->ref =0 ; +bpf_lru_node_clear_ref (node);list_add (&node->list, &l->lists[BPF_LRU_LIST_T_FREE ]); buf += elem_size; }
@@ -594,7 +599,7 @@ static void bpf_percpu_lru_populate(struct bpf_lru *lru, void *buf, node = (struct bpf_lru_node *)(buf + node_offset); node->cpu = cpu; node->type =BPF_LRU_LIST_T_FREE ; - node->ref =0 ; +bpf_lru_node_clear_ref (node);list_add (&node->list, &l->lists[BPF_LRU_LIST_T_FREE ]); i++; buf += elem_size;
kernel/bpf/bpf_lru_list.h +2 -5
@@ -64,11 +64,8 @@ struct bpf_lru {static inline void bpf_lru_node_set_ref (struct bpf_lru_node *node) { -/* ref is an approximation on access frequency. It does not -* have to be very accurate. Hence, no protection is used. -*/ -if (!node->ref) - node->ref =1 ; +if (!READ_ONCE (node->ref)) +WRITE_ONCE (node->ref,1 ); } int bpf_lru_init(struct bpf_lru *lru, bool percpu, u32 hash_offset,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 113/227 spi: cadence-quadspi: Add compatible for AMD Pensando Elba SoC
In reply to Greg Kroah-HartmanFrom: Brad Larson <[email protected]>
[ Upstream commit f5c2f9f9584353bc816d76a65c97dd03dc61678c ]
The AMD Pensando Elba SoC has the Cadence QSPI controller integrated.
The quirk CQSPI_NEEDS_APB_AHB_HAZARD_WAR is added and if enabled a dummy readback from the controller is performed to ensure synchronization.
--- drivers/spi/spi-cadence-quadspi.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
drivers/spi/spi-cadence-quadspi.c +19 -0
@@ -40,6 +40,7 @@#define CQSPI_SUPPORT_EXTERNAL_DMA BIT(2)#define CQSPI_NO_SUPPORT_WR_COMPLETION BIT(3)#define CQSPI_SLOW_SRAM BIT(4) +#define CQSPI_NEEDS_APB_AHB_HAZARD_WAR BIT(5)/* Capabilities */ #define CQSPI_SUPPORTS_OCTAL BIT(0)
@@ -90,6 +91,7 @@ struct cqspi_st {u32 pd_dev_id;bool wr_completion;bool slow_sram; +bool apb_ahb_hazard; };struct cqspi_driver_platdata {
@@ -1027,6 +1029,13 @@ static int cqspi_indirect_write_execute(struct cqspi_flash_pdata *f_pdata,if (cqspi->wr_delay)ndelay (cqspi->wr_delay); +/* +* If a hazard exists between the APB and AHB interfaces, perform a +* dummy readback from the controller to ensure synchronization. +*/ +if (cqspi->apb_ahb_hazard) +readl (reg_base +CQSPI_REG_INDIRECTWR ); +while (remaining >0 ) {size_t write_words, mod_bytes;
@@ -1754,6 +1763,8 @@ static int cqspi_probe(struct platform_device *pdev) cqspi->wr_completion = false;if (ddata->quirks &CQSPI_SLOW_SRAM ) cqspi->slow_sram = true; +if (ddata->quirks &CQSPI_NEEDS_APB_AHB_HAZARD_WAR ) + cqspi->apb_ahb_hazard = true;if (of_device_is_compatible (pdev->dev.of_node,"xlnx,versal-ospi-1.0" )) {
@@ -1888,6 +1899,10 @@ static const struct cqspi_driver_platdata jh7110_qspi = { .quirks = CQSPI_DISABLE_DAC_MODE, }; +static const struct cqspi_driver_platdata pensando_cdns_qspi = { + .quirks =CQSPI_NEEDS_APB_AHB_HAZARD_WAR |CQSPI_DISABLE_DAC_MODE , +}; +static const struct of_device_id cqspi_dt_ids[] = { { .compatible ="cdns,qspi-nor" ,
@@ -1917,6 +1932,10 @@ static const struct of_device_id cqspi_dt_ids[] = { .compatible = "starfive,jh7110-qspi", .data = &jh7110_qspi, }, + { + .compatible = "amd,pensando-elba-qspi", + .data = &pensando_cdns_qspi, + }, {/* end of table */ } };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 114/227 bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
[ Upstream commit cff36398bd4c7d322d424433db437f3c3391c491 ]
It's trivial for user to trigger "verifier log line truncated" warning, as verifier has a fixed-sized buffer of 1024 bytes (as of now), and there are at least two pieces of user-provided information that can be output through this buffer, and both can be arbitrarily sized by user:
- BTF names;
- BTF.ext source code lines strings.
Verifier log buffer should be properly sized for typical verifier state output. But it's sort-of expected that this buffer won't be long enough in some circumstances. So let's drop the check. In any case code will work correctly, at worst truncating a part of a single line output.
--- kernel/bpf/log.c | 3 --- 1 file changed, 3 deletions(-)
kernel/bpf/log.c +0 -3
@@ -62,9 +62,6 @@ void bpf_verifier_vlog(struct bpf_verifier_log *log, const char *fmt, n =vscnprintf (log->kbuf,BPF_VERIFIER_TMP_LOG_SIZE , fmt, args); -WARN_ONCE (n >=BPF_VERIFIER_TMP_LOG_SIZE -1 , -"verifier log line truncated - local buffer too short\n" ); -if (log->level ==BPF_LOG_KERNEL ) {bool newline = n >0 && log->kbuf[n -1 ] =='\n' ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 115/227 bpf: tcp: Avoid taking fast sock lock in iterator
In reply to Greg Kroah-HartmanFrom: Aditi Ghag <[email protected]>
[ Upstream commit 9378096e8a656fb5c4099b26b1370c56f056eab9 ]
This is a preparatory commit to replace lock_sock_fast with lock_sock,and facilitate BPF programs executed from the TCP sockets iterator to be able to destroy TCP sockets using the bpf_sock_destroy kfunc (implemented in follow-up commits).
Previously, BPF TCP iterator was acquiring the sock lock with BH disabled. This led to scenarios where the sockets hash table bucket lock can be acquired with BH enabled in some path versus disabled in other. In such situation, kernel issued a warning since it thinks that in the BH enabled path the same bucket lock *might* be acquired again in the softirq context (BH disabled), which will lead to a potential dead lock. Since bpf_sock_destroy also happens in a process context, the potential deadlock warning is likely a false alarm.
Here is a snippet of annotated stack trace that motivated this change:
```
Possible interrupt unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&h->lhash2[i].lock);
local_bh_disable();
lock(&h->lhash2[i].lock);
kernel imagined possible scenario:
local_bh_disable(); /* Possible softirq */
lock(&h->lhash2[i].lock);
*** Potential Deadlock ***
process context:
lock_acquire+0xcd/0x330
_raw_spin_lock+0x33/0x40
------> Acquire (bucket) lhash2.lock with BH enabled
__inet_hash+0x4b/0x210
inet_csk_listen_start+0xe6/0x100
inet_listen+0x95/0x1d0
__sys_listen+0x69/0xb0
__x64_sys_listen+0x14/0x20
do_syscall_64+0x3c/0x90
entry_SYSCALL_64_after_hwframe+0x72/0xdc
bpf_sock_destroy run from iterator:
lock_acquire+0xcd/0x330
_raw_spin_lock+0x33/0x40
------> Acquire (bucket) lhash2.lock with BH disabled
inet_unhash+0x9a/0x110
tcp_set_state+0x6a/0x210
tcp_abort+0x10d/0x200
bpf_prog_6793c5ca50c43c0d_iter_tcp6_server+0xa4/0xa9
bpf_iter_run_prog+0x1ff/0x340
------> lock_sock_fast that acquires sock lock with BH disabled
bpf_iter_tcp_seq_show+0xca/0x190
bpf_seq_read+0x177/0x450
```Also, Yonghong reported a deadlock for non-listening TCP sockets that this change resolves. Previously, lock_sock_fast held the sock spin lock with BH which was again being acquired in tcp_abort:
```
watchdog: BUG: soft lockup - CPU#0 stuck for 86s! [test_progs:2331]
RIP: 0010:queued_spin_lock_slowpath+0xd8/0x500
Call Trace:
<TASK>
_raw_spin_lock+0x84/0x90
tcp_abort+0x13c/0x1f0
bpf_prog_88539c5453a9dd47_iter_tcp6_client+0x82/0x89
bpf_iter_run_prog+0x1aa/0x2c0
? preempt_count_sub+0x1c/0xd0
? from_kuid_munged+0x1c8/0x210
bpf_iter_tcp_seq_show+0x14e/0x1b0
bpf_seq_read+0x36c/0x6a0
bpf_iter_tcp_seq_show
lock_sock_fast
__lock_sock_fast
spin_lock_bh(&sk->sk_lock.slock);
/* * Fast path return with bottom halves disabled and * sock::sk_lock.slock held.* */
...
tcp_abort
local_bh_disable();
spin_lock(&((sk)->sk_lock.slock)); // from bh_lock_sock(sk)
```With the switch to lock_sock, it calls spin_unlock_bh before returning:
```
lock_sock
lock_sock_nested
spin_lock_bh(&sk->sk_lock.slock);
:
spin_unlock_bh(&sk->sk_lock.slock);
```--- net/ipv4/tcp_ipv4.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
net/ipv4/tcp_ipv4.c +2 -3
@@ -2963,7 +2963,6 @@ static int bpf_iter_tcp_seq_show(struct seq_file *seq, void *v)struct bpf_iter_meta meta;struct bpf_prog *prog;struct sock *sk = v; -bool slow;uid_t uid;int ret;
@@ -2971,7 +2970,7 @@ static int bpf_iter_tcp_seq_show(struct seq_file *seq, void *v)return 0 ;if (sk_fullsock (sk)) - slow =lock_sock_fast (sk); +lock_sock (sk);if (unlikely (sk_unhashed (sk))) { ret =SEQ_SKIP ;
@@ -2995,7 +2994,7 @@ static int bpf_iter_tcp_seq_show(struct seq_file *seq, void *v) unlock:if (sk_fullsock (sk)) -unlock_sock_fast (sk, slow); +release_sock (sk);return ret; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 116/227 wifi: rtw88: sdio: Check the HISR RX_REQUEST bit in rtw_sdio_rx_isr()
In reply to Greg Kroah-HartmanFrom: Martin Blumenstingl <[email protected]>
[ Upstream commit e967229ead0e6c5047a1cfd5a0db58ceb930800b ]
rtw_sdio_rx_isr() is responsible for receiving data from the wifi chip and is called from the SDIO interrupt handler when the interrupt status register (HISR) has the RX_REQUEST bit set. After the first batch of data has been processed by the driver the wifi chip may have more data ready to be read, which is managed by a loop in rtw_sdio_rx_isr().
It turns out that there are cases where the RX buffer length (from the REG_SDIO_RX0_REQ_LEN register) does not match the data we receive. The following two cases were observed with a RTL8723DS card:
- RX length is smaller than the total packet length including overhead and actual data bytes (whose length is part of the buffer we read from the wifi chip and is stored in rtw_rx_pkt_stat.pkt_len). This can result in errors like:
skbuff: skb_over_panic: text:ffff8000011924ac len:3341 put:3341
(one case observed was: RX buffer length = 1536 bytes but
rtw_rx_pkt_stat.pkt_len = 1546 bytes, this is not valid as it means we need to read beyond the end of the buffer)
- RX length looks valid but rtw_rx_pkt_stat.pkt_len is zero
Check if the RX_REQUEST is set in the HISR register for each iteration inside rtw_sdio_rx_isr(). This mimics what the RTL8723DS vendor driver does and makes the driver only read more data if the RX_REQUEST bit is set (which seems to be a way for the card's hardware or firmware to tell the host that data is ready to be processed).
For RTW_WCPU_11AC chips this check is not needed. The RTL8822BS vendor driver for example states that this check is unnecessary (but still uses it) and the RTL8822CS drops this check entirely.
--- drivers/net/wireless/realtek/rtw88/sdio.c | 24 ++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-)
drivers/net/wireless/realtek/rtw88/sdio.c +21 -3
@@ -998,9 +998,9 @@ static void rtw_sdio_rxfifo_recv(struct rtw_dev *rtwdev, u32 rx_len)static void rtw_sdio_rx_isr (struct rtw_dev *rtwdev) { -u32 rx_len, total_rx_bytes =0 ; +u32 rx_len, hisr, total_rx_bytes =0 ; -while (total_rx_bytes <SZ_64K ) { + do { if (rtw_chip_wcpu_11n(rtwdev)) rx_len = rtw_read16(rtwdev, REG_SDIO_RX0_REQ_LEN); else
@@ -1012,7 +1012,25 @@ static void rtw_sdio_rx_isr(struct rtw_dev *rtwdev)rtw_sdio_rxfifo_recv (rtwdev, rx_len); total_rx_bytes += rx_len; - } + +if (rtw_chip_wcpu_11n (rtwdev)) { +/* Stop if no more RX requests are pending, even if +* rx_len could be greater than zero in the next +* iteration. This is needed because the RX buffer may +* already contain data while either HW or FW are not +* done filling that buffer yet. Still reading the +* buffer can result in packets where +* rtw_rx_pkt_stat.pkt_len is zero or points beyond the +* end of the buffer. +*/ + hisr =rtw_read32 (rtwdev,REG_SDIO_HISR ); + }else { +/* RTW_WCPU_11AC chips have improved hardware or +* firmware and can use rx_len unconditionally. +*/ + hisr =REG_SDIO_HISR_RX_REQUEST ; + } + }while (total_rx_bytes <SZ_64K && hisr ®_SDIO_HISR_RX_REQUEST ); }static void rtw_sdio_handle_interrupt (struct sdio_func *sdio_func)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 117/227 bpf: Silence a warning in btf_type_id_size()
In reply to Greg Kroah-HartmanFrom: Yonghong Song <[email protected]>
[ Upstream commit e6c2f594ed961273479505b42040782820190305 ]
syzbot reported a warning in [1] with the following stacktrace:
WARNING: CPU: 0 PID: 5005 at kernel/bpf/btf.c:1988 btf_type_id_size+0x2d9/0x9d0 kernel/bpf/btf.c:1988 ... RIP: 0010:btf_type_id_size+0x2d9/0x9d0 kernel/bpf/btf.c:1988 ... Call Trace: <TASK> map_check_btf kernel/bpf/syscall.c:1024 [inline] map_create+0x1157/0x1860 kernel/bpf/syscall.c:1198 __sys_bpf+0x127f/0x5420 kernel/bpf/syscall.c:5040 __do_sys_bpf kernel/bpf/syscall.c:5162 [inline] __se_sys_bpf kernel/bpf/syscall.c:5160 [inline] __x64_sys_bpf+0x79/0xc0 kernel/bpf/syscall.c:5160 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
With the following btf
[1] DECL_TAG 'a' type_id=4 component_idx=-1
[2] PTR '(anon)' type_id=0
[3] TYPE_TAG 'a' type_id=2
[4] VAR 'a' type_id=3, linkage=static
and when the bpf_attr.btf_key_type_id = 1 (DECL_TAG), the following WARN_ON_ONCE in btf_type_id_size() is triggered:
if (WARN_ON_ONCE(!btf_type_is_modifier(size_type) &&
!btf_type_is_var(size_type)))
return NULL;Note that 'return NULL' is the correct behavior as we don't want a DECL_TAG type to be used as a btf_{key,value}_type_id even for the case like 'DECL_TAG -> STRUCT'. So there
is no correctness issue here, we just want to silence warning.
To silence the warning, I added DECL_TAG as one of kinds in btf_type_nosize() which will cause btf_type_id_size() returning NULL earlier without the warning.
[1] https://lore.kernel.org/bpf/[email protected]/
--- kernel/bpf/btf.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
kernel/bpf/btf.c +10 -9
@@ -485,25 +485,26 @@ static bool btf_type_is_fwd(const struct btf_type *t)return BTF_INFO_KIND (t->info) ==BTF_KIND_FWD ; } -static bool btf_type_nosize (const struct btf_type *t) +static bool btf_type_is_datasec (const struct btf_type *t) { -return btf_type_is_void (t) ||btf_type_is_fwd (t) || -btf_type_is_func (t) ||btf_type_is_func_proto (t); +return BTF_INFO_KIND (t->info) ==BTF_KIND_DATASEC ; } -static bool btf_type_nosize_or_null (const struct btf_type *t) +static bool btf_type_is_decl_tag (const struct btf_type *t) { -return !t ||btf_type_nosize (t); +return BTF_INFO_KIND (t->info) ==BTF_KIND_DECL_TAG ; } -static bool btf_type_is_datasec (const struct btf_type *t) +static bool btf_type_nosize (const struct btf_type *t) { -return BTF_INFO_KIND (t->info) ==BTF_KIND_DATASEC ; +return btf_type_is_void (t) ||btf_type_is_fwd (t) || +btf_type_is_func (t) ||btf_type_is_func_proto (t) || +btf_type_is_decl_tag (t); } -static bool btf_type_is_decl_tag (const struct btf_type *t) +static bool btf_type_nosize_or_null (const struct btf_type *t) { -return BTF_INFO_KIND (t->info) ==BTF_KIND_DECL_TAG ; +return !t ||btf_type_nosize (t); }static bool btf_type_is_decl_tag_target (const struct btf_type *t)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 118/227 devlink: make health report on unregistered instance warn just once
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
[ Upstream commit 6f4b98147b8dfcabacb19b5c6abd087af66d0049 ]
Devlink health is involved in error recovery. Machines in bad state tend to be fairly unreliable, and occasionally get stuck in error loops. Even with a reasonable grace period devlink health may get a thousand reports in an hour.
In case of reporting on an unregistered devlink instance the subsequent reports don't add much value. Switch to WARN_ON_ONCE() to avoid flooding dmesg and fleet monitoring dashboards.
--- net/devlink/health.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/devlink/health.c +1 -1
@@ -480,7 +480,7 @@ static void devlink_recover_notify(struct devlink_health_reporter *reporter,int err;WARN_ON (cmd !=DEVLINK_CMD_HEALTH_REPORTER_RECOVER ); -WARN_ON (!xa_get_mark (&devlinks, devlink->index,DEVLINK_REGISTERED )); +ASSERT_DEVLINK_REGISTERED (devlink); msg =nlmsg_new (NLMSG_DEFAULT_SIZE ,GFP_KERNEL );if (!msg)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 119/227 wifi: ath11k: add support default regdb while searching board-2.bin for WCN6855
In reply to Greg Kroah-HartmanFrom: Wen Gong <[email protected]>
[ Upstream commit 88ca89202f8e8afb5225eb5244d79cd67c15d744 ]
Sometimes board-2.bin does not have the regdb data which matched the parameters such as vendor, device, subsystem-vendor, subsystem-device and etc. Add default regdb data with 'bus=%s' into board-2.bin for WCN6855, then ath11k use 'bus=pci' to search regdb data in board-2.bin for WCN6855.
kernel: [ 122.515808] ath11k_pci 0000:03:00.0: boot using board name 'bus=pci,vendor=17cb,device=1103,subsystem-vendor=17cb,subsystem-device=3374,qmi-chip-id=2,qmi-board-id=262'
kernel: [ 122.517240] ath11k_pci 0000:03:00.0: boot firmware request ath11k/WCN6855/hw2.0/board-2.bin size 6179564
kernel: [ 122.517280] ath11k_pci 0000:03:00.0: failed to fetch regdb data for bus=pci,vendor=17cb,device=1103,subsystem-vendor=17cb,subsystem-device=3374,qmi-chip-id=2,qmi-board-id=262 from ath11k/WCN6855/hw2.0/board-2.bin
kernel: [ 122.517464] ath11k_pci 0000:03:00.0: boot using board name 'bus=pci'
kernel: [ 122.518901] ath11k_pci 0000:03:00.0: boot firmware request ath11k/WCN6855/hw2.0/board-2.bin size 6179564
kernel: [ 122.518915] ath11k_pci 0000:03:00.0: board name
kernel: [ 122.518917] ath11k_pci 0000:03:00.0: 00000000: 62 75 73 3d 70 63 69 bus=pci
kernel: [ 122.518918] ath11k_pci 0000:03:00.0: boot found match regdb data for name 'bus=pci'
kernel: [ 122.518920] ath11k_pci 0000:03:00.0: boot found regdb data for 'bus=pci'
kernel: [ 122.518921] ath11k_pci 0000:03:00.0: fetched regdb
Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3
--- drivers/net/wireless/ath/ath11k/core.c | 53 +++++++++++++++++++------- 1 file changed, 40 insertions(+), 13 deletions(-)
drivers/net/wireless/ath/ath11k/core.c +40 -13
@@ -962,7 +962,8 @@ int ath11k_core_check_dt(struct ath11k_base *ab) }static int __ath11k_core_create_board_name (struct ath11k_base *ab,char *name, -size_t name_len,bool with_variant) +size_t name_len,bool with_variant, +bool bus_type_mode) {/* strlen(',variant=') + strlen(ab->qmi.target.bdf_ext) */ char variant[9 +ATH11K_QMI_BDF_EXT_STR_LENGTH ] = {0 };
@@ -973,15 +974,20 @@ static int __ath11k_core_create_board_name(struct ath11k_base *ab, char *name,switch (ab->id.bdf_search) {case ATH11K_BDF_SEARCH_BUS_AND_BOARD : -scnprintf (name, name_len, -"bus=%s,vendor=%04x,device=%04x,subsystem-vendor=%04x,subsystem-device=%04x,qmi-chip-id=%d,qmi-board-id=%d%s" , -ath11k_bus_str (ab->hif.bus), - ab->id.vendor, ab->id.device, - ab->id.subsystem_vendor, - ab->id.subsystem_device, - ab->qmi.target.chip_id, - ab->qmi.target.board_id, - variant); +if (bus_type_mode) +scnprintf (name, name_len, +"bus=%s" , +ath11k_bus_str (ab->hif.bus)); +else +scnprintf (name, name_len, +"bus=%s,vendor=%04x,device=%04x,subsystem-vendor=%04x,subsystem-device=%04x,qmi-chip-id=%d,qmi-board-id=%d%s" , +ath11k_bus_str (ab->hif.bus), + ab->id.vendor, ab->id.device, + ab->id.subsystem_vendor, + ab->id.subsystem_device, + ab->qmi.target.chip_id, + ab->qmi.target.board_id, + variant);break ;default : scnprintf(name, name_len,
@@ -1000,13 +1006,19 @@ static int __ath11k_core_create_board_name(struct ath11k_base *ab, char *name,static int ath11k_core_create_board_name (struct ath11k_base *ab,char *name,size_t name_len) { -return __ath11k_core_create_board_name (ab, name, name_len, true); +return __ath11k_core_create_board_name (ab, name, name_len, true, false); }static int ath11k_core_create_fallback_board_name (struct ath11k_base *ab,char *name,size_t name_len) { -return __ath11k_core_create_board_name (ab, name, name_len, false); +return __ath11k_core_create_board_name (ab, name, name_len, false, false); +} + +static int ath11k_core_create_bus_type_board_name (struct ath11k_base *ab,char *name, +size_t name_len) +{ +return __ath11k_core_create_board_name (ab, name, name_len, false, true); } const struct firmware *ath11k_core_firmware_request(struct ath11k_base *ab,
@@ -1310,7 +1322,7 @@ int ath11k_core_fetch_bdf(struct ath11k_base *ab, struct ath11k_board_data *bd)int ath11k_core_fetch_regdb (struct ath11k_base *ab,struct ath11k_board_data *bd) { -char boardname[BOARD_NAME_SIZE ]; +char boardname[BOARD_NAME_SIZE ], default_boardname[BOARD_NAME_SIZE ];int ret; ret =ath11k_core_create_board_name (ab, boardname,BOARD_NAME_SIZE );
@@ -1327,6 +1339,21 @@ int ath11k_core_fetch_regdb(struct ath11k_base *ab, struct ath11k_board_data *bdif (!ret) goto exit; + ret =ath11k_core_create_bus_type_board_name (ab, default_boardname, +BOARD_NAME_SIZE ); +if (ret) { +ath11k_dbg (ab,ATH11K_DBG_BOOT , +"failed to create default board name for regdb: %d" , ret); + goto exit; + } + + ret =ath11k_core_fetch_board_data_api_n (ab, bd, default_boardname, +ATH11K_BD_IE_REGDB , +ATH11K_BD_IE_REGDB_NAME , +ATH11K_BD_IE_REGDB_DATA ); +if (!ret) + goto exit; + ret =ath11k_core_fetch_board_data_api_1 (ab, bd,ATH11K_REGDB_FILE_NAME );if (ret) ath11k_dbg(ab, ATH11K_DBG_BOOT, "failed to fetch %s from %s\n",
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 120/227 wifi: mac80211_hwsim: Fix possible NULL dereference
In reply to Greg Kroah-HartmanFrom: Ilan Peer <[email protected]>
[ Upstream commit 0cc80943ef518a1c51a1111e9346d1daf11dd545 ]
In a call to mac80211_hwsim_select_tx_link() the sta pointer might be NULL, thus need to check that it is not NULL before accessing it.
--- drivers/net/wireless/virtual/mac80211_hwsim.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/virtual/mac80211_hwsim.c +2 -2
@@ -4,7 +4,7 @@* Copyright (c) 2008, Jouni Malinen <[email protected]> * Copyright (c) 2011, Javier Lopez <[email protected]> * Copyright (c) 2016 - 2017 Intel Deutschland GmbH -* Copyright (C) 2018 - 2022 Intel Corporation +* Copyright (C) 2018 - 2023 Intel Corporation */ /*
@@ -1864,7 +1864,7 @@ mac80211_hwsim_select_tx_link(struct mac80211_hwsim_data *data,WARN_ON (is_multicast_ether_addr (hdr->addr1)); -if (WARN_ON_ONCE (!sta->valid_links)) +if (WARN_ON_ONCE (!sta || !sta->valid_links))return &vif->bss_conf;for (i =0 ; i <ARRAY_SIZE (vif->link_conf); i++) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 121/227 spi: dw: Add compatible for Intel Mount Evans SoC
In reply to Greg Kroah-HartmanFrom: Abe Kohandel <[email protected]>
[ Upstream commit 0760d5d0e9f0c0e2200a0323a61d1995bb745dee ]
The Intel Mount Evans SoC's Integrated Management Complex uses the SPI controller for access to a NOR SPI FLASH. However, the SoC doesn't provide a mechanism to override the native chip select signal.
This driver doesn't use DMA for memory operations when a chip select override is not provided due to the native chip select timing behavior. As a result no DMA configuration is done for the controller and this configuration is not tested.
The controller also has an errata where a full TX FIFO can result in data corruption. The suggested workaround is to never completely fill the FIFO. The TX FIFO has a size of 32 so the fifo_len is set to 31.
--- drivers/spi/spi-dw-mmio.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+)
drivers/spi/spi-dw-mmio.c +29 -0
@@ -236,6 +236,31 @@ static int dw_spi_intel_init(struct platform_device *pdev,return 0 ; } +/* +* The Intel Mount Evans SoC's Integrated Management Complex uses the +* SPI controller for access to a NOR SPI FLASH. However, the SoC doesn't +* provide a mechanism to override the native chip select signal. +* +* This driver doesn't use DMA for memory operations when a chip select +* override is not provided due to the native chip select timing behavior. +* As a result no DMA configuration is done for the controller and this +* configuration is not tested. +*/ +static int dw_spi_mountevans_imc_init (struct platform_device *pdev, +struct dw_spi_mmio *dwsmmio) +{ +/* +* The Intel Mount Evans SoC's Integrated Management Complex DW +* apb_ssi_v4.02a controller has an errata where a full TX FIFO can +* result in data corruption. The suggested workaround is to never +* completely fill the FIFO. The TX FIFO has a size of 32 so the +* fifo_len is set to 31. +*/ + dwsmmio->dws.fifo_len =31 ; + +return 0 ; +} +static int dw_spi_canaan_k210_init (struct platform_device *pdev,struct dw_spi_mmio *dwsmmio) {
@@ -405,6 +430,10 @@ static const struct of_device_id dw_spi_mmio_of_match[] = { { .compatible = "snps,dwc-ssi-1.01a", .data = dw_spi_hssi_init}, { .compatible = "intel,keembay-ssi", .data = dw_spi_intel_init}, { .compatible = "intel,thunderbay-ssi", .data = dw_spi_intel_init}, + { + .compatible = "intel,mountevans-imc-ssi", + .data = dw_spi_mountevans_imc_init, + }, { .compatible = "microchip,sparx5-spi", dw_spi_mscc_sparx5_init}, { .compatible = "canaan,k210-spi", dw_spi_canaan_k210_init}, { .compatible = "amd,pensando-elba-spi", .data = dw_spi_elba_init},
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 122/227 wifi: ath12k: Avoid NULL pointer access during management transmit cleanup
In reply to Greg Kroah-HartmanFrom: Balamurugan S <[email protected]>
[ Upstream commit 054b5580a36e435692c203c19abdcb9f7734320e ]
Currently 'ar' reference is not added in skb_cb.
Though this is generally not used during transmit completion callbacks, on interface removal the remaining idr cleanup callback uses the ar pointer from skb_cb from management txmgmt_idr. Hence fill them during transmit call for proper usage to avoid NULL pointer dereference.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath12k/mac.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/ath/ath12k/mac.c +1 -0
@@ -4425,6 +4425,7 @@ static int ath12k_mac_mgmt_tx_wmi(struct ath12k *ar, struct ath12k_vif *arvif,int buf_id;int ret; +ATH12K_SKB_CB (skb)->ar = ar;spin_lock_bh (&ar->txmgmt_idr_lock); buf_id =idr_alloc (&ar->txmgmt_idr, skb,0 ,ATH12K_TX_MGMT_NUM_PENDING_MAX ,GFP_ATOMIC );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 123/227 wifi: ath11k: fix memory leak in WMI firmware stats
In reply to Greg Kroah-HartmanFrom: P Praneesh <[email protected]>
[ Upstream commit 6aafa1c2d3e3fea2ebe84c018003f2a91722e607 ]
Memory allocated for firmware pdev, vdev and beacon statistics are not released during rmmod.
Fix it by calling ath11k_fw_stats_free() function before hardware unregister.
While at it, avoid calling ath11k_fw_stats_free() while processing the firmware stats received in the WMI event because the local list is getting spliced and reinitialised and hence there are no elements in the list after splicing.
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath11k/mac.c | 1 + drivers/net/wireless/ath/ath11k/wmi.c | 5 +++++ 2 files changed, 6 insertions(+)
drivers/net/wireless/ath/ath11k/mac.c +1 -0
@@ -9468,6 +9468,7 @@ void ath11k_mac_destroy(struct ath11k_base *ab)if (!ar)continue ; +ath11k_fw_stats_free (&ar->fw_stats);ieee80211_free_hw (ar->hw); pdev->ar =NULL ; }
drivers/net/wireless/ath/ath11k/wmi.c +5 -0
@@ -8103,6 +8103,11 @@ static void ath11k_update_stats_event(struct ath11k_base *ab, struct sk_buff *skrcu_read_unlock ();spin_unlock_bh (&ar->data_lock); +/* Since the stats's pdev, vdev and beacon list are spliced and reinitialised +* at this point, no need to free the individual list. +*/ +return ; + free:ath11k_fw_stats_free (&stats); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 124/227 wifi: iwlwifi: mvm: fix potential array out of bounds access
In reply to Greg Kroah-HartmanFrom: Gregory Greenman <[email protected]>
[ Upstream commit 637452360ecde9ac972d19416e9606529576b302 ]
Account for IWL_SEC_WEP_KEY_OFFSET when needed while verifying key_len size in iwl_mvm_sec_key_add().
--- drivers/net/wireless/intel/iwlwifi/mvm/mld-key.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/mld-key.c +7 -2
@@ -1,6 +1,6 @@// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause /* -* Copyright (C) 2022 Intel Corporation +* Copyright (C) 2022 - 2023 Intel Corporation */ #include <linux/kernel.h> #include <net/mac80211.h>
@@ -179,9 +179,14 @@ int iwl_mvm_sec_key_add(struct iwl_mvm *mvm, .u.add.key_flags = cpu_to_le32(key_flags), .u.add.tx_seq = cpu_to_le64(atomic64_read(&keyconf->tx_pn)), }; +int max_key_len =sizeof (cmd.u.add.key);int ret; -if (WARN_ON (keyconf->keylen >sizeof (cmd.u.add.key))) +if (keyconf->cipher ==WLAN_CIPHER_SUITE_WEP40 || + keyconf->cipher ==WLAN_CIPHER_SUITE_WEP104 ) + max_key_len -=IWL_SEC_WEP_KEY_OFFSET ; + +if (WARN_ON (keyconf->keylen > max_key_len))return -EINVAL ;if (WARN_ON (!sta_mask))
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 125/227 net: ethernet: litex: add support for 64 bit stats
In reply to Greg Kroah-HartmanFrom: Jisheng Zhang <[email protected]>
[ Upstream commit 18da174d865a87d47d2f33f5b0a322efcf067728 ]
Implement 64 bit per cpu stats to fix the overflow of netdev->stats on 32 bit platforms. To simplify the code, we use net core pcpu_sw_netstats infrastructure. One small drawback is some memory overhead because litex uses just one queue, but we allocate the counters per cpu.
--- drivers/net/ethernet/litex/litex_liteeth.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-)
drivers/net/ethernet/litex/litex_liteeth.c +15 -4
@@ -78,8 +78,7 @@ static int liteeth_rx(struct net_device *netdev)memcpy_fromio (data, priv->rx_base + rx_slot * priv->slot_size, len); skb->protocol =eth_type_trans (skb, netdev); - netdev->stats.rx_packets++; - netdev->stats.rx_bytes += len; +dev_sw_netstats_rx_add (netdev, len);return netif_rx (skb);
@@ -185,8 +184,7 @@ static netdev_tx_t liteeth_start_xmit(struct sk_buff *skb,litex_write16 (priv->base +LITEETH_READER_LENGTH , skb->len);litex_write8 (priv->base +LITEETH_READER_START ,1 ); - netdev->stats.tx_bytes += skb->len; - netdev->stats.tx_packets++; +dev_sw_netstats_tx_add (netdev,1 , skb->len); priv->tx_slot = (priv->tx_slot +1 ) % priv->num_tx_slots;dev_kfree_skb_any (skb);
@@ -194,9 +192,17 @@ static netdev_tx_t liteeth_start_xmit(struct sk_buff *skb,return NETDEV_TX_OK ; } +static void +liteeth_get_stats64 (struct net_device *netdev,struct rtnl_link_stats64 *stats) +{ +netdev_stats_to_stats64 (stats, &netdev->stats); +dev_fetch_sw_netstats (stats, netdev->tstats); +} +static const struct net_device_ops liteeth_netdev_ops = { .ndo_open = liteeth_open, .ndo_stop = liteeth_stop, + .ndo_get_stats64 = liteeth_get_stats64, .ndo_start_xmit = liteeth_start_xmit, };
@@ -242,6 +248,11 @@ static int liteeth_probe(struct platform_device *pdev) priv->netdev = netdev; priv->dev = &pdev->dev; + netdev->tstats =devm_netdev_alloc_pcpu_stats (&pdev->dev, + struct pcpu_sw_netstats); +if (!netdev->tstats) +return -ENOMEM ; + irq =platform_get_irq (pdev,0 );if (irq <0 )return irq;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 126/227 devlink: report devlink_port_type_warn source device
In reply to Greg Kroah-HartmanFrom: Petr Oros <[email protected]>
[ Upstream commit a52305a81d6bb74b90b400dfa56455d37872fe4b ]
devlink_port_type_warn is scheduled for port devlink and warning when the port type is not set. But from this warning it is not easy found out which device (driver) has no devlink port set.
[ 3709.975552] Type was not set for devlink port. [ 3709.975579] WARNING: CPU: 1 PID: 13092 at net/devlink/leftover.c:6775 devlink_port_type_warn+0x11/0x20 [ 3709.993967] Modules linked in: openvswitch nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nfnetlink bluetooth rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs vhost_net vhost vhost_iotlb tap tun bridge stp llc qrtr intel_rapl_msr intel_rapl_common i10nm_edac nfit libnvdimm x86_pkg_temp_thermal mlx5_ib intel_powerclamp coretemp dell_wmi ledtrig_audio sparse_keymap ipmi_ssif kvm_intel ib_uverbs rfkill ib_core video kvm iTCO_wdt acpi_ipmi intel_vsec irqbypass ipmi_si iTCO_vendor_support dcdbas ipmi_devintf mei_me ipmi_msghandler rapl mei intel_cstate isst_if_mmio isst_if_mbox_pci dell_smbios intel_uncore isst_if_common i2c_i801 dell_wmi_descriptor wmi_bmof i2c_smbus intel_pch_thermal pcspkr acpi_power_meter xfs libcrc32c sd_mod sg nvme_tcp mgag200 i2c_algo_bit nvme_fabrics drm_shmem_helper drm_kms_helper nvme syscopyarea ahci sysfillrect sysimgblt nvme_core fb_sys_fops crct10dif_pclmul libahci mlx5_core sfc crc32_pclmul nvme_common drm [ 3709.994030] crc32c_intel mtd t10_pi mlxfw libata tg3 mdio megaraid_sas psample ghash_clmulni_intel pci_hyperv_intf wmi dm_multipath sunrpc dm_mirror dm_region_hash dm_log dm_mod be2iscsi bnx2i cnic uio cxgb4i cxgb4 tls libcxgbi libcxgb qla4xxx iscsi_boot_sysfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi fuse [ 3710.108431] CPU: 1 PID: 13092 Comm: kworker/1:1 Kdump: loaded Not tainted 5.14.0-319.el9.x86_64 #1 [ 3710.108435] Hardware name: Dell Inc. PowerEdge R750/0PJ80M, BIOS 1.8.2 09/14/2022 [ 3710.108437] Workqueue: events devlink_port_type_warn [ 3710.108440] RIP: 0010:devlink_port_type_warn+0x11/0x20 [ 3710.108443] Code: 84 76 fe ff ff 48 c7 03 20 0e 1a ad 31 c0 e9 96 fd ff ff 66 0f 1f 44 00 00 0f 1f 44 00 00 48 c7 c7 18 24 4e ad e8 ef 71 62 ff <0f> 0b c3 cc cc cc cc 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 f6 87 [ 3710.108445] RSP: 0018:ff3b6d2e8b3c7e90 EFLAGS: 00010282 [ 3710.108447] RAX: 0000000000000000 RBX: ff366d6580127080 RCX: 0000000000000027 [ 3710.108448] RDX: 0000000000000027 RSI: 00000000ffff86de RDI: ff366d753f41f8c8 [ 3710.108449] RBP: ff366d658ff5a0c0 R08: ff366d753f41f8c0 R09: ff3b6d2e8b3c7e18 [ 3710.108450] R10: 0000000000000001 R11: 0000000000000023 R12: ff366d753f430600 [ 3710.108451] R13: ff366d753f436900 R14: 0000000000000000 R15: ff366d753f436905 [ 3710.108452] FS: 0000000000000000(0000) GS:ff366d753f400000(0000) knlGS:0000000000000000 [ 3710.108453] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3710.108454] CR2: 00007f1c57bc74e0 CR3: 000000111d26a001 CR4: 0000000000773ee0 [ 3710.108456] PKRU: 55555554 [ 3710.108457] Call Trace: [ 3710.108458] <TASK> [ 3710.108459] process_one_work+0x1e2/0x3b0 [ 3710.108466] ? rescuer_thread+0x390/0x390 [ 3710.108468] worker_thread+0x50/0x3a0 [ 3710.108471] ? rescuer_thread+0x390/0x390 [ 3710.108473] kthread+0xdd/0x100 [ 3710.108477] ? kthread_complete_and_exit+0x20/0x20 [ 3710.108479] ret_from_fork+0x1f/0x30 [ 3710.108485] </TASK> [ 3710.108486] ---[ end trace 1b4b23cd0c65d6a0 ]---
After patch:
[ 402.473064] ice 0000:41:00.0: Type was not set for devlink port. [ 402.473064] ice 0000:41:00.1: Type was not set for devlink port.
--- net/devlink/leftover.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/devlink/leftover.c +4 -1
@@ -6772,7 +6772,10 @@ void devlink_notify_unregister(struct devlink *devlink)static void devlink_port_type_warn (struct work_struct *work) { -WARN (true,"Type was not set for devlink port." ); +struct devlink_port *port =container_of (to_delayed_work (work), + struct devlink_port, + type_warn_dw); +dev_warn (port->devlink->dev,"Type was not set for devlink port." ); }static bool devlink_port_type_should_warn (struct devlink_port *devlink_port)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 127/227 wifi: iwlwifi: mvm: Add NULL check before dereferencing the pointer
In reply to Greg Kroah-HartmanFrom: Mukesh Sisodiya <[email protected]>
[ Upstream commit 7dd50fd5478056929a012c6bf8b3c6f87c7e9e87 ]
While vif pointers are protected by the corresponding "*active" fields, static checkers can get confused sometimes. Add an explicit check.
--- drivers/net/wireless/intel/iwlwifi/mvm/power.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/power.c +8 -6
@@ -647,30 +647,32 @@ static void iwl_mvm_power_set_pm(struct iwl_mvm *mvm,return ;/* enable PM on bss if bss stand alone */ -if (vifs->bss_active && !vifs->p2p_active && !vifs->ap_active) { +if (bss_mvmvif && vifs->bss_active && !vifs->p2p_active && + !vifs->ap_active) { bss_mvmvif->pm_enabled = true;return ; }/* enable PM on p2p if p2p stand alone */ -if (vifs->p2p_active && !vifs->bss_active && !vifs->ap_active) { +if (p2p_mvmvif && vifs->p2p_active && !vifs->bss_active && + !vifs->ap_active) { p2p_mvmvif->pm_enabled = true;return ; } -if (vifs->bss_active && vifs->p2p_active) +if (p2p_mvmvif && bss_mvmvif && vifs->bss_active && vifs->p2p_active) client_same_channel =iwl_mvm_have_links_same_channel (bss_mvmvif, p2p_mvmvif); -if (vifs->bss_active && vifs->ap_active) +if (bss_mvmvif && ap_mvmvif && vifs->bss_active && vifs->ap_active) ap_same_channel =iwl_mvm_have_links_same_channel (bss_mvmvif, ap_mvmvif);/* clients are not stand alone: enable PM if DCM */ if (!(client_same_channel || ap_same_channel)) { -if (vifs->bss_active) +if (bss_mvmvif && vifs->bss_active) bss_mvmvif->pm_enabled = true; -if (vifs->p2p_active) +if (p2p_mvmvif && vifs->p2p_active) p2p_mvmvif->pm_enabled = true;return ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 128/227 wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point()
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
[ Upstream commit 71e7552c90db2a2767f5c17c7ec72296b0d92061 ]
-Wstringop-overflow is legitimately warning us about extra_size pontentially being zero at some point, hence potenially ending up _allocating_ zero bytes of memory for extra pointer and then trying to access such object in a call to copy_from_user().
Fix this by adding a sanity check to ensure we never end up trying to allocate zero bytes of data for extra pointer, before continue executing the rest of the code in the function.
Address the following -Wstringop-overflow warning seen when built
m68k architecture with allyesconfig configuration:
from net/wireless/wext-core.c:11:
In function '_copy_from_user',
inlined from 'copy_from_user' at include/linux/uaccess.h:183:7,
inlined from 'ioctl_standard_iw_point' at net/wireless/wext-core.c:825:7:arch/m68k/include/asm/string.h:48:25: warning: '__builtin_memset' writing 1 or more bytes into a region of size 0 overflows the destination [-Wstringop-overflow=]
48 | #define memset(d, c, n) __builtin_memset(d, c, n)
| ^~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/uaccess.h:153:17: note: in expansion of macro 'memset'
153 | memset(to + (n - res), 0, res);
| ^~~~~~In function 'kmalloc',
inlined from 'kzalloc' at include/linux/slab.h:694:9,
inlined from 'ioctl_standard_iw_point' at net/wireless/wext-core.c:819:10:include/linux/slab.h:577:16: note: at offset 1 into destination object of size 0 allocated by '__kmalloc'
577 | return __kmalloc(size, flags);
| ^~~~~~~~~~~~~~~~~~~~~~This help with the ongoing efforts to globally enable -Wstringop-overflow.
--- net/wireless/wext-core.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/wireless/wext-core.c +6 -0
@@ -815,6 +815,12 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd, } } +/* Sanity-check to ensure we never end up _allocating_ zero +* bytes of data for extra. +*/ +if (extra_size <=0 ) +return -EFAULT ; +/* kzalloc() ensures NULL-termination for essid_compat. */ extra =kzalloc (extra_size,GFP_KERNEL );if (!extra)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 129/227 wifi: iwlwifi: Add support for new PCI Id
In reply to Greg Kroah-HartmanFrom: Mukesh Sisodiya <[email protected]>
[ Upstream commit 35bd6f1d043d089fcb60450e1287cc65f0095787 ]
Add support for the PCI Id 51F1 without IMR support.
--- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/intel/iwlwifi/pcie/drv.c +2 -0
@@ -495,6 +495,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = { {IWL_PCI_DEVICE(0x7AF0, PCI_ANY_ID, iwl_so_trans_cfg)}, {IWL_PCI_DEVICE(0x51F0, PCI_ANY_ID, iwl_so_long_latency_trans_cfg)}, {IWL_PCI_DEVICE(0x51F1, PCI_ANY_ID, iwl_so_long_latency_imr_trans_cfg)}, + {IWL_PCI_DEVICE(0x51F1, PCI_ANY_ID, iwl_so_long_latency_trans_cfg)}, {IWL_PCI_DEVICE(0x54F0, PCI_ANY_ID, iwl_so_long_latency_trans_cfg)}, {IWL_PCI_DEVICE(0x7F70, PCI_ANY_ID, iwl_so_trans_cfg)},
@@ -544,6 +545,7 @@ static const struct iwl_dev_info iwl_dev_info_table[] = {IWL_DEV_INFO (0x51F0 ,0x1551 , iwl9560_2ac_cfg_soc, iwl9560_killer_1550i_160_name),IWL_DEV_INFO (0x51F0 ,0x1691 , iwlax411_2ax_cfg_so_gf4_a0, iwl_ax411_killer_1690s_name),IWL_DEV_INFO (0x51F0 ,0x1692 , iwlax411_2ax_cfg_so_gf4_a0, iwl_ax411_killer_1690i_name), +IWL_DEV_INFO (0x51F1 ,0x1692 , iwlax411_2ax_cfg_so_gf4_a0, iwl_ax411_killer_1690i_name),IWL_DEV_INFO (0x54F0 ,0x1691 , iwlax411_2ax_cfg_so_gf4_a0, iwl_ax411_killer_1690s_name),IWL_DEV_INFO (0x54F0 ,0x1692 , iwlax411_2ax_cfg_so_gf4_a0, iwl_ax411_killer_1690i_name), IWL_DEV_INFO(0x7A70, 0x1691, iwlax411_2ax_cfg_so_gf4_a0, iwl_ax411_killer_1690s_name),
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 130/227 wifi: iwlwifi: mvm: avoid baid size integer overflow
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit 1a528ab1da324d078ec60283c34c17848580df24 ]
Roee reported various hard-to-debug crashes with pings in EHT aggregation scenarios. Enabling KASAN showed that we access the BAID allocation out of bounds, and looking at the code a bit shows that since the reorder buffer entry (struct iwl_mvm_reorder_buf_entry) is 128 bytes if debug such as lockdep is enabled, then staring from an agg size 512 we overflow the size calculation, and allocate a much smaller structure than we should, causing slab corruption once we initialize this.
Fix this by simply using u32 instead of u16.
--- drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/sta.c +1 -1
@@ -2884,7 +2884,7 @@ int iwl_mvm_sta_rx_agg(struct iwl_mvm *mvm, struct ieee80211_sta *sta, }if (iwl_mvm_has_new_rx_api (mvm) && start) { -u16 reorder_buf_size = buf_size *sizeof (baid_data->entries[0 ]); +u32 reorder_buf_size = buf_size *sizeof (baid_data->entries[0 ]);/* sparse doesn't like the __align() so don't check */ #ifndef __CHECKER__
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 131/227 wifi: iwlwifi: pcie: add device id 51F1 for killer 1675
In reply to Greg Kroah-HartmanFrom: Yi Kuo <[email protected]>
[ Upstream commit f4daceae4087bbb3e9a56044b44601d520d009d2 ]
Intel Killer AX1675i/s with device id 51f1 would show
"No config found for PCI dev 51f1/1672" in dmesg and refuse to work. Add the new device id 51F1 for 1675i/s to fix the issue.
--- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/wireless/intel/iwlwifi/pcie/drv.c +2 -0
@@ -684,6 +684,8 @@ static const struct iwl_dev_info iwl_dev_info_table[] = {IWL_DEV_INFO (0x2726 ,0x1672 , iwlax211_2ax_cfg_so_gf_a0, iwl_ax211_killer_1675i_name),IWL_DEV_INFO (0x51F0 ,0x1671 , iwlax211_2ax_cfg_so_gf_a0, iwl_ax211_killer_1675s_name),IWL_DEV_INFO (0x51F0 ,0x1672 , iwlax211_2ax_cfg_so_gf_a0, iwl_ax211_killer_1675i_name), +IWL_DEV_INFO (0x51F1 ,0x1671 , iwlax211_2ax_cfg_so_gf_a0, iwl_ax211_killer_1675s_name), +IWL_DEV_INFO (0x51F1 ,0x1672 , iwlax211_2ax_cfg_so_gf_a0, iwl_ax211_killer_1675i_name),IWL_DEV_INFO (0x54F0 ,0x1671 , iwlax211_2ax_cfg_so_gf_a0, iwl_ax211_killer_1675s_name),IWL_DEV_INFO (0x54F0 ,0x1672 , iwlax211_2ax_cfg_so_gf_a0, iwl_ax211_killer_1675i_name), IWL_DEV_INFO(0x7A70, 0x1671, iwlax211_2ax_cfg_so_gf_a0, iwl_ax211_killer_1675s_name),
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 132/227 igb: Fix igb_down hung on surprise removal
In reply to Greg Kroah-HartmanFrom: Ying Hsu <[email protected]>
[ Upstream commit 004d25060c78fc31f66da0fa439c544dda1ac9d5 ]
In a setup where a Thunderbolt hub connects to Ethernet and a display through USB Type-C, users may experience a hung task timeout when they remove the cable between the PC and the Thunderbolt hub. This is because the igb_down function is called multiple times when the Thunderbolt hub is unplugged. For example, the igb_io_error_detected triggers the first call, and the igb_remove triggers the second call. The second call to igb_down will block at napi_synchronize. Here's the call trace:
__schedule+0x3b0/0xddb
? __mod_timer+0x164/0x5d3
schedule+0x44/0xa8
schedule_timeout+0xb2/0x2a4
? run_local_timers+0x4e/0x4e
msleep+0x31/0x38
igb_down+0x12c/0x22a [igb 6615058754948bfde0bf01429257eb59f13030d4]
__igb_close+0x6f/0x9c [igb 6615058754948bfde0bf01429257eb59f13030d4]
igb_close+0x23/0x2b [igb 6615058754948bfde0bf01429257eb59f13030d4]
__dev_close_many+0x95/0xec
dev_close_many+0x6e/0x103
unregister_netdevice_many+0x105/0x5b1
unregister_netdevice_queue+0xc2/0x10d
unregister_netdev+0x1c/0x23
igb_remove+0xa7/0x11c [igb 6615058754948bfde0bf01429257eb59f13030d4]
pci_device_remove+0x3f/0x9c
device_release_driver_internal+0xfe/0x1b4
pci_stop_bus_device+0x5b/0x7f
pci_stop_bus_device+0x30/0x7f
pci_stop_bus_device+0x30/0x7f
pci_stop_and_remove_bus_device+0x12/0x19
pciehp_unconfigure_device+0x76/0xe9
pciehp_disable_slot+0x6e/0x131
pciehp_handle_presence_or_link_change+0x7a/0x3f7
pciehp_ist+0xbe/0x194
irq_thread_fn+0x22/0x4d
? irq_thread+0x1fd/0x1fd
irq_thread+0x17b/0x1fd
? irq_forced_thread_fn+0x5f/0x5f
kthread+0x142/0x153
? __irq_get_irqchip_state+0x46/0x46
? kthread_associate_blkcg+0x71/0x71
ret_from_fork+0x1f/0x30In this case, igb_io_error_detected detaches the network interface and requests a PCIE slot reset, however, the PCIE reset callback is not being invoked and thus the Ethernet connection breaks down. As the PCIE error in this case is a non-fatal one, requesting a slot reset can be avoided.
This patch fixes the task hung issue and preserves Ethernet connection by ignoring non-fatal PCIE errors.
--- drivers/net/ethernet/intel/igb/igb_main.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/intel/igb/igb_main.c +5 -0
@@ -9585,6 +9585,11 @@ static pci_ers_result_t igb_io_error_detected(struct pci_dev *pdev,struct net_device *netdev =pci_get_drvdata (pdev);struct igb_adapter *adapter =netdev_priv (netdev); +if (state == pci_channel_io_normal) { +dev_warn (&pdev->dev,"Non-correctable non-fatal error reported.\n" ); +return PCI_ERS_RESULT_CAN_RECOVER ; + } +netif_device_detach (netdev);if (state == pci_channel_io_perm_failure)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 133/227 net: hns3: fix strncpy() not using dest-buf length as length issue
In reply to Greg Kroah-HartmanFrom: Hao Chen <[email protected]>
[ Upstream commit 1cf3d5567f273a8746d1bade00633a93204f80f0 ]
Now, strncpy() in hns3_dbg_fill_content() use src-length as copy-length, it may result in dest-buf overflow.
This patch is to fix intel compile warning for csky-linux-gcc (GCC) 12.1.0 compiler.
The warning reports as below:
hclge_debugfs.c:92:25: warning: 'strncpy' specified bound depends on the length of the source argument [-Wstringop-truncation]
strncpy(pos, items[i].name, strlen(items[i].name));
hclge_debugfs.c:90:25: warning: 'strncpy' output truncated before terminating nul copying as many bytes from a string as its length [-Wstringop-truncation]
strncpy(pos, result[i], strlen(result[i]));
strncpy() use src-length as copy-length, it may result in dest-buf overflow.
So,this patch add some values check to avoid this issue.
--- .../ethernet/hisilicon/hns3/hns3_debugfs.c | 31 ++++++++++++++----- .../hisilicon/hns3/hns3pf/hclge_debugfs.c | 29 ++++++++++++++--- 2 files changed, 48 insertions(+), 12 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c +24 -7
@@ -438,19 +438,36 @@ static void hns3_dbg_fill_content(char *content, u16 len,const struct hns3_dbg_item *items, const char **result, u16 size) { +#define HNS3_DBG_LINE_END_LEN 2 char *pos = content; +u16 item_len;u16 i; +if (!len) { +return ; + }else if (len <=HNS3_DBG_LINE_END_LEN ) { + *pos++ ='\0' ; +return ; + } +memset (content,' ' , len); -for (i =0 ; i < size; i++) { -if (result) -strncpy (pos, result[i],strlen (result[i])); -else -strncpy (pos, items[i].name,strlen (items[i].name)); + len -=HNS3_DBG_LINE_END_LEN ; - pos +=strlen (items[i].name) + items[i].interval; +for (i =0 ; i < size; i++) { + item_len =strlen (items[i].name) + items[i].interval; +if (len < item_len) +break ; + +if (result) { +if (item_len <strlen (result[i])) +break ; +strscpy (pos, result[i],strlen (result[i])); + }else { +strscpy (pos, items[i].name,strlen (items[i].name)); + } + pos += item_len; + len -= item_len; } - *pos++ ='\n' ; *pos++ ='\0' ; }
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c +24 -5
@@ -88,16 +88,35 @@ static void hclge_dbg_fill_content(char *content, u16 len,const struct hclge_dbg_item *items, const char **result, u16 size) { +#define HCLGE_DBG_LINE_END_LEN 2 char *pos = content; +u16 item_len;u16 i; +if (!len) { +return ; + }else if (len <=HCLGE_DBG_LINE_END_LEN ) { + *pos++ ='\0' ; +return ; + } +memset (content,' ' , len); + len -=HCLGE_DBG_LINE_END_LEN ; +for (i =0 ; i < size; i++) { -if (result) -strncpy (pos, result[i],strlen (result[i])); -else -strncpy (pos, items[i].name,strlen (items[i].name)); - pos +=strlen (items[i].name) + items[i].interval; + item_len =strlen (items[i].name) + items[i].interval; +if (len < item_len) +break ; + +if (result) { +if (item_len <strlen (result[i])) +break ; +strscpy (pos, result[i],strlen (result[i])); + }else { +strscpy (pos, items[i].name,strlen (items[i].name)); + } + pos += item_len; + len -= item_len; } *pos++ ='\n' ; *pos++ ='\0' ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 134/227 ASoC: amd: acp: fix for invalid dai id handling in acp_get_byte_count()
In reply to Greg Kroah-HartmanFrom: Vijendar Mukunda <[email protected]>
[ Upstream commit 85aeab362201cf52c34cd429e4f6c75a0b42f9a3 ]
For invalid dai id, instead of returning -EINVAL return bytes count as zero in acp_get_byte_count() function.
--- sound/soc/amd/acp/amd.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
sound/soc/amd/acp/amd.h +4 -3
@@ -173,7 +173,7 @@ int snd_amd_acp_find_config(struct pci_dev *pci);static inline u64 acp_get_byte_count (struct acp_dev_data *adata,int dai_id,int direction) { -u64 byte_count, low =0 , high =0 ; +u64 byte_count =0 , low =0 , high =0 ;if (direction ==SNDRV_PCM_STREAM_PLAYBACK ) {switch (dai_id) {
@@ -191,7 +191,7 @@ static inline u64 acp_get_byte_count(struct acp_dev_data *adata, int dai_id, intbreak ;default :dev_err (adata->dev,"Invalid dai id %x\n" , dai_id); -return -EINVAL ; + goto POINTER_RETURN_BYTES; } }else {switch (dai_id) {
@@ -213,12 +213,13 @@ static inline u64 acp_get_byte_count(struct acp_dev_data *adata, int dai_id, intbreak ;default :dev_err (adata->dev,"Invalid dai id %x\n" , dai_id); -return -EINVAL ; + goto POINTER_RETURN_BYTES; } }/* Get 64 bit value from two 32 bit registers */ byte_count = (high <<32 ) | low; +POINTER_RETURN_BYTES:return byte_count; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 135/227 ASoC: codecs: wcd938x: fix mbhc impedance loglevel
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
[ Upstream commit e5ce198bd5c6923b6a51e1493b1401f84c24b26d ]
Demote the MBHC impedance measurement printk, which is not an error message, from error to debug level.
While at it, fix the capitalisation of "ohm" and add the missing space before the opening parenthesis.
--- sound/soc/codecs/wcd938x.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/codecs/wcd938x.c +2 -2
@@ -2165,8 +2165,8 @@ static inline void wcd938x_mbhc_get_result_params(struct wcd938x_priv *wcd938x,else if (x1 < minCode_param[noff]) *zdet =WCD938X_ZDET_FLOATING_IMPEDANCE ; -pr_err ("%s: d1=%d, c1=%d, x1=0x%x, z_val=%d(milliOhm)\n" , - __func__, d1, c1, x1, *zdet); +pr_debug ("%s: d1=%d, c1=%d, x1=0x%x, z_val=%d (milliohm)\n" , + __func__, d1, c1, x1, *zdet); ramp_down: i =0 ;while (x1) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 136/227 ASoC: codecs: wcd938x: fix dB range for HPHL and HPHR
In reply to Greg Kroah-HartmanFrom: Srinivas Kandagatla <[email protected]>
[ Upstream commit c03226ba15fe3c42d13907ec7d8536396602557b ]
dB range for HPHL and HPHR gains are from +6dB to -30dB in steps of 1.5dB with register values range from 0 to 24.
Current code maps these dB ranges incorrectly, fix them to allow proper volume setting.
--- sound/soc/codecs/wcd938x.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/soc/codecs/wcd938x.c +3 -3
@@ -210,7 +210,7 @@ struct wcd938x_priv { }; static const SNDRV_CTL_TLVD_DECLARE_DB_MINMAX(ear_pa_gain, 600, -1800); -static const SNDRV_CTL_TLVD_DECLARE_DB_MINMAX(line_gain, 600, -3000); +static const DECLARE_TLV_DB_SCALE(line_gain, -3000, 150, -3000); static const SNDRV_CTL_TLVD_DECLARE_DB_MINMAX(analog_gain, 0, 3000);struct wcd938x_mbhc_zdet_param {
@@ -2662,8 +2662,8 @@ static const struct snd_kcontrol_new wcd938x_snd_controls[] = { wcd938x_get_swr_port, wcd938x_set_swr_port),SOC_SINGLE_EXT ("DSD_R Switch" ,WCD938X_DSD_R ,0 ,1 ,0 , wcd938x_get_swr_port, wcd938x_set_swr_port), -SOC_SINGLE_TLV ("HPHL Volume" ,WCD938X_HPH_L_EN ,0 ,0x18 ,0 , line_gain), -SOC_SINGLE_TLV ("HPHR Volume" ,WCD938X_HPH_R_EN ,0 ,0x18 ,0 , line_gain), +SOC_SINGLE_TLV ("HPHL Volume" ,WCD938X_HPH_L_EN ,0 ,0x18 ,1 , line_gain), +SOC_SINGLE_TLV ("HPHR Volume" ,WCD938X_HPH_R_EN ,0 ,0x18 ,1 , line_gain),WCD938X_EAR_PA_GAIN_TLV ("EAR_PA Volume" ,WCD938X_ANA_EAR_COMPANDER_CTL ,2 ,0x10 ,0 , ear_pa_gain), SOC_SINGLE_EXT("ADC1 Switch", WCD938X_ADC1, 1, 1, 0,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 137/227 ASoC: qcom: q6apm: do not close GPR port before closing graph
In reply to Greg Kroah-HartmanFrom: Srinivas Kandagatla <[email protected]>
[ Upstream commit c1be62923d4d86e7c06b1224626e27eb8d9ab32e ]
Closing GPR port before graph close can result in un handled notifications from DSP, this results in spam of errors from GPR driver as there is no one to handle these notification at that point in time.
Fix this by closing GPR port after graph close is finished.
--- sound/soc/qcom/qdsp6/q6apm.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
sound/soc/qcom/qdsp6/q6apm.c +6 -1
@@ -446,6 +446,8 @@ static int graph_callback(struct gpr_resp_pkt *data, void *priv, int op)switch (hdr->opcode) {case DATA_CMD_RSP_WR_SH_MEM_EP_DATA_BUFFER_DONE_V2 : +if (!graph->ar_graph) +break ; client_event =APM_CLIENT_EVENT_DATA_WRITE_DONE ;mutex_lock (&graph->lock); token = hdr->token &APM_WRITE_TOKEN_MASK ;
@@ -479,6 +481,8 @@ static int graph_callback(struct gpr_resp_pkt *data, void *priv, int op)wake_up (&graph->cmd_wait);break ;case DATA_CMD_RSP_RD_SH_MEM_EP_DATA_BUFFER_V2 : +if (!graph->ar_graph) +break ; client_event =APM_CLIENT_EVENT_DATA_READ_DONE ;mutex_lock (&graph->lock); rd_done = data->payload;
@@ -581,8 +585,9 @@ int q6apm_graph_close(struct q6apm_graph *graph) {struct audioreach_graph *ar_graph = graph->ar_graph; -gpr_free_port (graph->port); + graph->ar_graph =NULL ;kref_put (&ar_graph->refcount, q6apm_put_audioreach_graph); +gpr_free_port (graph->port);kfree (graph);return 0 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 138/227 iov_iter: Mark copy_iovec_from_user() noclone
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
[ Upstream commit 719a937b7003933de1298ffa4b881dd6a234e244 ]
Extend commit 50f9a76ef127 ("iov_iter: Mark copy_compat_iovec_from_user() noinline") to also cover copy_iovec_from_user(). Different compiler versions cause the same problem on different functions.
lib/iov_iter.o: warning: objtool: .altinstr_replacement+0x1f: redundant UACCESS disable lib/iov_iter.o: warning: objtool: iovec_from_user+0x84: call to copy_iovec_from_user.part.0() with UACCESS enabled lib/iov_iter.o: warning: objtool: __import_iovec+0x143: call to copy_iovec_from_user.part.0() with UACCESS enabled
--- lib/iov_iter.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/iov_iter.c +1 -1
@@ -1795,7 +1795,7 @@ static __noclone int copy_compat_iovec_from_user(struct iovec *iov,return ret; } -static int copy_iovec_from_user (struct iovec *iov, +static __noclone int copy_iovec_from_user (struct iovec *iov,const struct iovec __user *uiov,unsigned long nr_segs) {int ret = -EFAULT ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 139/227 sched/fair: Use recent_used_cpu to test p->cpus_ptr
In reply to Greg Kroah-HartmanFrom: Miaohe Lin <[email protected]>
[ Upstream commit ae2ad293d6be143ad223f5f947cca07bcbe42595 ]
When checking whether a recently used CPU can be a potential idle candidate, recent_used_cpu should be used to test p->cpus_ptr as p->recent_used_cpu is not equal to recent_used_cpu and candidate decision is made based on recent_used_cpu here.
--- kernel/sched/fair.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/sched/fair.c +1 -1
@@ -7174,7 +7174,7 @@ static int select_idle_sibling(struct task_struct *p, int prev, int target) recent_used_cpu != target && cpus_share_cache(recent_used_cpu, target) && (available_idle_cpu(recent_used_cpu) || sched_idle_cpu(recent_used_cpu)) && - cpumask_test_cpu(p->recent_used_cpu, p->cpus_ptr) && + cpumask_test_cpu(recent_used_cpu, p->cpus_ptr) && asym_fits_cpu(task_util, util_min, util_max, recent_used_cpu)) {return recent_used_cpu; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 140/227 sched/psi: use kernfs polling functions for PSI trigger polling
In reply to Greg Kroah-HartmanFrom: Suren Baghdasaryan <[email protected]>
[ Upstream commit aff037078ecaecf34a7c2afab1341815f90fba5e ]
Destroying psi trigger in cgroup_file_release causes UAF issues when a cgroup is removed from under a polling process. This is happening because cgroup removal causes a call to cgroup_file_release while the actual file is still alive. Destroying the trigger at this point would also destroy its waitqueue head and if there is still a polling process on that file accessing the waitqueue, it will step on the freed pointer:
do_select
vfs_poll
do_rmdir
cgroup_rmdir
kernfs_drain_open_files
cgroup_file_release
cgroup_pressure_release
psi_trigger_destroy
wake_up_pollfree(&t->event_wait)// vfs_poll is unblocked
synchronize_rcu kfree(t)
poll_freewait -> UAF access to the trigger's waitqueue head
Patch [1] fixed this issue for epoll() case using wake_up_pollfree(), however the same issue exists for synchronous poll() case.
The root cause of this issue is that the lifecycles of the psi trigger's waitqueue and of the file associated with the trigger are different. Fix this by using kernfs_generic_poll function when polling on cgroup-specific psi triggers. It internally uses kernfs_open_node->poll waitqueue head with its lifecycle tied to the file's lifecycle. This also renders the fix in [1] obsolete, so revert it.
[1] commit c2dbe32d5db5 ("sched/psi: Fix use-after-free in ep_remove_wait_queue()")
--- include/linux/psi.h | 5 +++-- include/linux/psi_types.h | 3 +++ kernel/cgroup/cgroup.c | 2 +- kernel/sched/psi.c | 29 +++++++++++++++++++++-------- 4 files changed, 28 insertions(+), 11 deletions(-)
include/linux/psi.h +3 -2
@@ -23,8 +23,9 @@ void psi_memstall_enter(unsigned long *flags);void psi_memstall_leave (unsigned long *flags);int psi_show (struct seq_file *s,struct psi_group *group,enum psi_res res); -struct psi_trigger *psi_trigger_create (struct psi_group *group, -char *buf,enum psi_res res,struct file *file); +struct psi_trigger *psi_trigger_create (struct psi_group *group,char *buf, +enum psi_res res,struct file *file, +struct kernfs_open_file *of);void psi_trigger_destroy (struct psi_trigger *t); __poll_t psi_trigger_poll(void **trigger_ptr, struct file *file,
include/linux/psi_types.h +3 -0
@@ -137,6 +137,9 @@ struct psi_trigger {/* Wait queue for polling */ wait_queue_head_t event_wait; +/* Kernfs file for cgroup triggers */ +struct kernfs_open_file *of; +/* Pending event flag */ int event;
kernel/cgroup/cgroup.c +1 -1
@@ -3785,7 +3785,7 @@ static ssize_t pressure_write(struct kernfs_open_file *of, char *buf, } psi =cgroup_psi (cgrp); - new =psi_trigger_create (psi, buf, res, of->file); + new =psi_trigger_create (psi, buf, res, of->file, of);if (IS_ERR (new)) {cgroup_put (cgrp);return PTR_ERR (new);
kernel/sched/psi.c +21 -8
@@ -494,8 +494,12 @@ static u64 update_triggers(struct psi_group *group, u64 now, bool *update_total,continue ;/* Generate an event */ -if (cmpxchg (&t->event,0 ,1 ) ==0 ) -wake_up_interruptible (&t->event_wait); +if (cmpxchg (&t->event,0 ,1 ) ==0 ) { +if (t->of) +kernfs_notify (t->of->kn); +else +wake_up_interruptible (&t->event_wait); + } t->last_event_time = now;/* Reset threshold breach flag once event got generated */ t->pending_event = false;
@@ -1272,8 +1276,9 @@ int psi_show(struct seq_file *m, struct psi_group *group, enum psi_res res)return 0 ; } -struct psi_trigger *psi_trigger_create (struct psi_group *group, -char *buf,enum psi_res res,struct file *file) +struct psi_trigger *psi_trigger_create (struct psi_group *group,char *buf, +enum psi_res res,struct file *file, +struct kernfs_open_file *of) {struct psi_trigger *t;enum psi_states state;
@@ -1333,7 +1338,9 @@ struct psi_trigger *psi_trigger_create(struct psi_group *group, t->event =0 ; t->last_event_time =0 ; -init_waitqueue_head (&t->event_wait); + t->of = of; +if (!of) +init_waitqueue_head (&t->event_wait); t->pending_event = false; t->aggregator = privileged ?PSI_POLL :PSI_AVGS ;
@@ -1390,7 +1397,10 @@ void psi_trigger_destroy(struct psi_trigger *t)* being accessed later. Can happen if cgroup is deleted from under a * polling process. */ -wake_up_pollfree (&t->event_wait); +if (t->of) +kernfs_notify (t->of->kn); +else +wake_up_interruptible (&t->event_wait);if (t->aggregator ==PSI_AVGS ) {mutex_lock (&group->avgs_lock);
@@ -1462,7 +1472,10 @@ __poll_t psi_trigger_poll(void **trigger_ptr,if (!t)return DEFAULT_POLLMASK |EPOLLERR |EPOLLPRI ; -poll_wait (file, &t->event_wait, wait); +if (t->of) +kernfs_generic_poll (t->of, wait); +else +poll_wait (file, &t->event_wait, wait);if (cmpxchg (&t->event,1 ,0 ) ==1 ) ret |=EPOLLPRI ;
@@ -1532,7 +1545,7 @@ static ssize_t psi_write(struct file *file, const char __user *user_buf,return -EBUSY ; } - new =psi_trigger_create (&psi_system, buf, res, file); + new =psi_trigger_create (&psi_system, buf, res, file,NULL );if (IS_ERR (new)) {mutex_unlock (&seq->lock);return PTR_ERR (new);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 141/227 pinctrl: renesas: rzv2m: Handle non-unique subnode names
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit f46a0b47cc0829acd050213194c5a77351e619b2 ]
The eMMC and SDHI pin control configuration nodes in DT have subnodes with the same names ("data" and "ctrl"). As the RZ/V2M pin control driver considers only the names of the subnodes, this leads to conflicts:
pinctrl-rzv2m b6250000.pinctrl: pin P8_2 already requested by 85000000.mmc; cannot claim for 85020000.mmc
pinctrl-rzv2m b6250000.pinctrl: pin-130 (85020000.mmc) status -22
renesas_sdhi_internal_dmac 85020000.mmc: Error applying setting, reverse things backFix this by constructing unique names from the node names of both the pin control configuration node and its child node, where appropriate.
Reported by: Fabrizio Castro <[email protected]>
--- drivers/pinctrl/renesas/pinctrl-rzv2m.c | 28 ++++++++++++++++++------- 1 file changed, 20 insertions(+), 8 deletions(-)
drivers/pinctrl/renesas/pinctrl-rzv2m.c +20 -8
@@ -209,6 +209,7 @@ static int rzv2m_map_add_config(struct pinctrl_map *map,static int rzv2m_dt_subnode_to_map (struct pinctrl_dev *pctldev,struct device_node *np, +struct device_node *parent,struct pinctrl_map **map,unsigned int *num_maps,unsigned int *index)
@@ -226,6 +227,7 @@ static int rzv2m_dt_subnode_to_map(struct pinctrl_dev *pctldev,struct property *prop;int ret, gsel, fsel;const char **pin_fn; +const char *name;const char *pin; pinmux =of_find_property (np,"pinmux" ,NULL );
@@ -309,8 +311,19 @@ static int rzv2m_dt_subnode_to_map(struct pinctrl_dev *pctldev, psel_val[i] =MUX_FUNC (value); } +if (parent) { + name =devm_kasprintf (pctrl->dev,GFP_KERNEL ,"%pOFn.%pOFn" , + parent, np); +if (!name) { + ret = -ENOMEM ; + goto done; + } + }else { + name = np->name; + } +/* Register a single pin group listing all the pins we read from DT */ - gsel =pinctrl_generic_add_group (pctldev, np->name, pins, num_pinmux,NULL ); + gsel =pinctrl_generic_add_group (pctldev, name, pins, num_pinmux,NULL );if (gsel <0 ) { ret = gsel; goto done;
@@ -320,17 +333,16 @@ static int rzv2m_dt_subnode_to_map(struct pinctrl_dev *pctldev,* Register a single group function where the 'data' is an array PSEL * register values read from DT. */ - pin_fn[0 ] = np->name; - fsel =pinmux_generic_add_function (pctldev, np->name, pin_fn,1 , - psel_val); + pin_fn[0 ] = name; + fsel =pinmux_generic_add_function (pctldev, name, pin_fn,1 , psel_val);if (fsel <0 ) { ret = fsel; goto remove_group; } maps[idx].type =PIN_MAP_TYPE_MUX_GROUP ; - maps[idx].data.mux.group = np->name; - maps[idx].data.mux.function = np->name; + maps[idx].data.mux.group = name; + maps[idx].data.mux.function = name; idx++;dev_dbg (pctrl->dev,"Parsed %pOF with %d pins\n" , np, num_pinmux);
@@ -377,7 +389,7 @@ static int rzv2m_dt_node_to_map(struct pinctrl_dev *pctldev, index =0 ;for_each_child_of_node (np, child) { - ret =rzv2m_dt_subnode_to_map (pctldev, child, map, + ret =rzv2m_dt_subnode_to_map (pctldev, child, np, map, num_maps, &index);if (ret <0 ) {of_node_put (child);
@@ -386,7 +398,7 @@ static int rzv2m_dt_node_to_map(struct pinctrl_dev *pctldev, }if (*num_maps ==0 ) { - ret =rzv2m_dt_subnode_to_map (pctldev, np, map, + ret =rzv2m_dt_subnode_to_map (pctldev, np,NULL , map, num_maps, &index);if (ret <0 ) goto done;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 142/227 pinctrl: renesas: rzg2l: Handle non-unique subnode names
In reply to Greg Kroah-HartmanFrom: Biju Das <[email protected]>
[ Upstream commit bfc374a145ae133613e05b9b89be561f169cb58d ]
Currently, sd1 and sd0 have unique subnode names 'sd1_mux' and 'sd0_mux'. If we change these to non-unique subnode names such as 'mux' this can lead to the below conflict as the RZ/G2L pin control driver considers only the names of the subnodes.
pinctrl-rzg2l 11030000.pinctrl: pin P47_0 already requested by 11c00000.mmc; cannot claim for 11c10000.mmc pinctrl-rzg2l 11030000.pinctrl: pin-376 (11c10000.mmc) status -22
pinctrl-rzg2l 11030000.pinctrl: could not request pin 376 (P47_0) from group mux on device pinctrl-rzg2l renesas_sdhi_internal_dmac 11c10000.mmc: Error applying setting, reverse things back
Fix this by constructing unique names from the node names of both the pin control configuration node and its child node, where appropriate.
Based on the work done by Geert for the RZ/V2M pinctrl driver.
--- drivers/pinctrl/renesas/pinctrl-rzg2l.c | 28 ++++++++++++++++++------- 1 file changed, 20 insertions(+), 8 deletions(-)
drivers/pinctrl/renesas/pinctrl-rzg2l.c +20 -8
@@ -249,6 +249,7 @@ static int rzg2l_map_add_config(struct pinctrl_map *map,static int rzg2l_dt_subnode_to_map (struct pinctrl_dev *pctldev,struct device_node *np, +struct device_node *parent,struct pinctrl_map **map,unsigned int *num_maps,unsigned int *index)
@@ -266,6 +267,7 @@ static int rzg2l_dt_subnode_to_map(struct pinctrl_dev *pctldev,struct property *prop;int ret, gsel, fsel;const char **pin_fn; +const char *name;const char *pin; pinmux =of_find_property (np,"pinmux" ,NULL );
@@ -349,8 +351,19 @@ static int rzg2l_dt_subnode_to_map(struct pinctrl_dev *pctldev, psel_val[i] =MUX_FUNC (value); } +if (parent) { + name =devm_kasprintf (pctrl->dev,GFP_KERNEL ,"%pOFn.%pOFn" , + parent, np); +if (!name) { + ret = -ENOMEM ; + goto done; + } + }else { + name = np->name; + } +/* Register a single pin group listing all the pins we read from DT */ - gsel =pinctrl_generic_add_group (pctldev, np->name, pins, num_pinmux,NULL ); + gsel =pinctrl_generic_add_group (pctldev, name, pins, num_pinmux,NULL );if (gsel <0 ) { ret = gsel; goto done;
@@ -360,17 +373,16 @@ static int rzg2l_dt_subnode_to_map(struct pinctrl_dev *pctldev,* Register a single group function where the 'data' is an array PSEL * register values read from DT. */ - pin_fn[0 ] = np->name; - fsel =pinmux_generic_add_function (pctldev, np->name, pin_fn,1 , - psel_val); + pin_fn[0 ] = name; + fsel =pinmux_generic_add_function (pctldev, name, pin_fn,1 , psel_val);if (fsel <0 ) { ret = fsel; goto remove_group; } maps[idx].type =PIN_MAP_TYPE_MUX_GROUP ; - maps[idx].data.mux.group = np->name; - maps[idx].data.mux.function = np->name; + maps[idx].data.mux.group = name; + maps[idx].data.mux.function = name; idx++;dev_dbg (pctrl->dev,"Parsed %pOF with %d pins\n" , np, num_pinmux);
@@ -417,7 +429,7 @@ static int rzg2l_dt_node_to_map(struct pinctrl_dev *pctldev, index =0 ;for_each_child_of_node (np, child) { - ret =rzg2l_dt_subnode_to_map (pctldev, child, map, + ret =rzg2l_dt_subnode_to_map (pctldev, child, np, map, num_maps, &index);if (ret <0 ) {of_node_put (child);
@@ -426,7 +438,7 @@ static int rzg2l_dt_node_to_map(struct pinctrl_dev *pctldev, }if (*num_maps ==0 ) { - ret =rzg2l_dt_subnode_to_map (pctldev, np, map, + ret =rzg2l_dt_subnode_to_map (pctldev, np,NULL , map, num_maps, &index);if (ret <0 ) goto done;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 143/227 spi: bcm63xx: fix max prepend length
In reply to Greg Kroah-HartmanFrom: Jonas Gorski <[email protected]>
[ Upstream commit 5158814cbb37bbb38344b3ecddc24ba2ed0365f2 ]
The command word is defined as following:
/* Command */
#define SPI_CMD_COMMAND_SHIFT 0
#define SPI_CMD_DEVICE_ID_SHIFT 4
#define SPI_CMD_PREPEND_BYTE_CNT_SHIFT 8
#define SPI_CMD_ONE_BYTE_SHIFT 11
#define SPI_CMD_ONE_WIRE_SHIFT 12If the prepend byte count field starts at bit 8, and the next defined bit is SPI_CMD_ONE_BYTE at bit 11, it can be at most 3 bits wide, and thus the max value is 7, not 15.
--- drivers/spi/spi-bcm63xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-bcm63xx.c +1 -1
@@ -126,7 +126,7 @@ enum bcm63xx_regs_spi { SPI_MSG_DATA_SIZE, }; -#define BCM63XX_SPI_MAX_PREPEND 15 +#define BCM63XX_SPI_MAX_PREPEND 7#define BCM63XX_SPI_MAX_CS 8#define BCM63XX_SPI_BUS_NUM 0
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 144/227 fbdev: imxfb: warn about invalid left/right margin
In reply to Greg Kroah-HartmanFrom: Martin Kaiser <[email protected]>
[ Upstream commit 4e47382fbca916d7db95cbf9e2d7ca2e9d1ca3fe ]
Warn about invalid var->left_margin or var->right_margin. Their values are read from the device tree.
We store var->left_margin-3 and var->right_margin-1 in register fields. These fields should be >= 0.
--- drivers/video/fbdev/imxfb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/video/fbdev/imxfb.c +2 -2
@@ -613,10 +613,10 @@ static int imxfb_activate_var(struct fb_var_screeninfo *var, struct fb_info *infif (var->hsync_len <1 || var->hsync_len >64 )printk (KERN_ERR "%s: invalid hsync_len %d\n" , info->fix.id, var->hsync_len); -if (var->left_margin >255 ) +if (var->left_margin <3 || var->left_margin >255 )printk (KERN_ERR "%s: invalid left_margin %d\n" , info->fix.id, var->left_margin); -if (var->right_margin >255 ) +if (var->right_margin <1 || var->right_margin >255 )printk (KERN_ERR "%s: invalid right_margin %d\n" , info->fix.id, var->right_margin);if (var->yres <1 || var->yres > ymax_mask)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 145/227 fbdev: imxfb: Removed unneeded release_mem_region
In reply to Greg Kroah-HartmanFrom: Yangtao Li <[email protected]>
[ Upstream commit 45fcc058a75bf5d65cf4c32da44a252fbe873cd4 ]
Remove unnecessary release_mem_region from the error path to prevent mem region from being released twice, which could avoid resource leak or other unexpected issues.
--- drivers/video/fbdev/imxfb.c | 1 - 1 file changed, 1 deletion(-)
drivers/video/fbdev/imxfb.c +0 -1
@@ -1043,7 +1043,6 @@ static int imxfb_probe(struct platform_device *pdev) failed_map: failed_ioremap: failed_getclock: -release_mem_region (res->start,resource_size (res)); failed_of_parse:kfree (info->pseudo_palette); failed_init:
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 146/227 perf build: Fix library not found error when using CSLIBS
In reply to Greg Kroah-HartmanFrom: James Clark <[email protected]>
[ Upstream commit 1feece2780ac2f8de45177fe53979726cee4b3d1 ]
-L only specifies the search path for libraries directly provided in the link line with -l. Because -lopencsd isn't specified, it's only linked because it's a dependency of -lopencsd_c_api. Dependencies like this are resolved using the default system search paths or -rpath-link=... rather than -L. This means that compilation only works if OpenCSD is installed to the system rather than provided with the CSLIBS (-L) option.
This could be fixed by adding -Wl,-rpath-link=$(CSLIBS) but that is less conventional than just adding -lopencsd to the link line so that it uses -L. -lopencsd seems to have been removed in commit ed17b1914978eddb ("perf tools: Drop requirement for libstdc++.so for libopencsd check") because it was thought that there was a chance compilation would work even if it didn't exist, but I think that only applies to libstdc++ so there is no harm to add it back. libopencsd.so and libopencsd_c_api.so would always exist together.
Testing
=======
The following scenarios now all work:
* Cross build with OpenCSD installed
* Cross build using CSLIBS=...
* Native build with OpenCSD installed
* Native build using CSLIBS=...
* Static cross build with OpenCSD installed
* Static cross build with CSLIBS=...
Committer testing:
⬢[acme@toolbox perf-tools]$ alias m alias m='make -k BUILD_BPF_SKEL=1 CORESIGHT=1 O=/tmp/build/perf-tools -C tools/perf install-bin && git status && perf test python ; perf record -o /dev/null sleep 0.01 ; perf stat --null sleep 0.01' ⬢[acme@toolbox perf-tools]$ ldd ~/bin/perf | grep csd libopencsd_c_api.so.1 => /lib64/libopencsd_c_api.so.1 (0x00007fd49c44e000) libopencsd.so.1 => /lib64/libopencsd.so.1 (0x00007fd49bd56000) ⬢[acme@toolbox perf-tools]$ cat /etc/redhat-release Fedora release 36 (Thirty Six) ⬢[acme@toolbox perf-tools]$
--- tools/perf/Makefile.config | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/perf/Makefile.config +2 -2
@@ -155,9 +155,9 @@ FEATURE_CHECK_LDFLAGS-libcrypto = -lcrypto ifdef CSINCLUDES LIBOPENCSD_CFLAGS := -I$(CSINCLUDES) endif -OPENCSDLIBS := -lopencsd_c_api +OPENCSDLIBS := -lopencsd_c_api -lopencsd ifeq ($(findstring -static,${LDFLAGS}),-static) - OPENCSDLIBS += -lopencsd -lstdc++ + OPENCSDLIBS += -lstdc++ endif ifdef CSLIBS LIBOPENCSD_LDFLAGS := -L$(CSLIBS)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 147/227 btrfs: be a bit more careful when setting mirror_num_ret in btrfs_map_block
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 4e7de35eb7d1a1d4f2dda15f39fbedd4798a0b8d ]
The mirror_num_ret is allowed to be NULL, although it has to be set when smap is set. Unfortunately that is not a well enough specifiable invariant for static type checkers, so add a NULL check to make sure they are fine.
--- fs/btrfs/volumes.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/btrfs/volumes.c +2 -1
@@ -6399,7 +6399,8 @@ int __btrfs_map_block(struct btrfs_fs_info *fs_info, enum btrfs_map_op op, (!need_full_stripe(op) || !dev_replace_is_ongoing || !dev_replace->tgtdev)) {set_io_stripe (smap, map, stripe_index, stripe_offset, stripe_nr); - *mirror_num_ret = mirror_num; +if (mirror_num_ret) + *mirror_num_ret = mirror_num; *bioc_ret =NULL ; ret =0 ; goto out;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 148/227 spi: s3c64xx: clear loopback bit after loopback test
In reply to Greg Kroah-HartmanFrom: Jaewon Kim <[email protected]>
[ Upstream commit 9ec3c5517e22a12d2ff1b71e844f7913641460c6 ]
When SPI loopback transfer is performed, S3C64XX_SPI_MODE_SELF_LOOPBACK bit still remained. It works as loopback even if the next transfer is not spi loopback mode.
If not SPI_LOOP, needs to clear S3C64XX_SPI_MODE_SELF_LOOPBACK bit.
--- drivers/spi/spi-s3c64xx.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/spi/spi-s3c64xx.c +2 -0
@@ -668,6 +668,8 @@ static int s3c64xx_spi_config(struct s3c64xx_spi_driver_data *sdd)if ((sdd->cur_mode &SPI_LOOP ) && sdd->port_conf->has_loopback) val |=S3C64XX_SPI_MODE_SELF_LOOPBACK ; +else + val &= ~S3C64XX_SPI_MODE_SELF_LOOPBACK ;writel (val, regs +S3C64XX_SPI_MODE_CFG );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 149/227 kallsyms: strip LTO-only suffixes from promoted global functions
In reply to Greg Kroah-HartmanFrom: Yonghong Song <[email protected]>
[ Upstream commit 8cc32a9bbf2934d90762d9de0187adcb5ad46a11 ]
Commit 6eb4bd92c1ce ("kallsyms: strip LTO suffixes from static functions") stripped all function/variable suffixes started with '.' regardless of whether those suffixes are generated at LTO mode or not. In fact, as far as I know, in LTO mode, when a static function/variable is promoted to the global scope, '.llvm.<...>' suffix is added.
The existing mechanism breaks live patch for a LTO kernel even if no <symbol>.llvm.<...> symbols are involved. For example, for the following kernel symbols:
$ grep bpf_verifier_vlog /proc/kallsyms ffffffff81549f60 t bpf_verifier_vlog ffffffff8268b430 d bpf_verifier_vlog._entry ffffffff8282a958 d bpf_verifier_vlog._entry_ptr ffffffff82e12a1f d bpf_verifier_vlog.__already_done 'bpf_verifier_vlog' is a static function. '_entry', '_entry_ptr' and '__already_done' are static variables used inside 'bpf_verifier_vlog', so llvm promotes them to file-level static with prefix 'bpf_verifier_vlog.'. Note that the func-level to file-level static function promotion also happens without LTO.
Given a symbol name 'bpf_verifier_vlog', with LTO kernel, current mechanism will return 4 symbols to live patch subsystem which current live patching subsystem cannot handle it. With non-LTO kernel, only one symbol
is returned.
In [1], we have a lengthy discussion, the suggestion is to separate two cases:
(1). new symbols with suffix which are generated regardless of whether
LTO is enabled or not, and
(2). new symbols with suffix generated only when LTO is enabled.
The cleanup_symbol_name() should only remove suffixes for case (2). Case (1) should not be changed so it can work uniformly with or without LTO.
This patch removed LTO-only suffix '.llvm.<...>' so live patching and tracing should work the same way for non-LTO kernel.
The cleanup_symbol_name() in scripts/kallsyms.c is also changed to have the same filtering pattern so both kernel and kallsyms tool have the same expectation on the order of symbols.
[1] https://lore.kernel.org/live-patching/[email protected]/T/#u
--- kernel/kallsyms.c | 5 ++--- scripts/kallsyms.c | 6 +++--- 2 files changed, 5 insertions(+), 6 deletions(-)
kernel/kallsyms.c +2 -3
@@ -174,11 +174,10 @@ static bool cleanup_symbol_name(char *s)* LLVM appends various suffixes for local functions and variables that * must be promoted to global scope as part of LTO. This can break * hooking of static functions with kprobes. '.' is not a valid -* character in an identifier in C. Suffixes observed: +* character in an identifier in C. Suffixes only in LLVM LTO observed: * - foo.llvm.[0-9a-f]+ -* - foo.[0-9a-f]+ */ - res =strchr (s,'.' ); + res =strstr (s,".llvm." );if (res) { *res ='\0' ;return true;
scripts/kallsyms.c +3 -3
@@ -346,10 +346,10 @@ static void cleanup_symbol_name(char *s)* ASCII[_] = 5f * ASCII[a-z] = 61,7a * -* As above, replacing '.' with '\0' does not affect the main sorting, -* but it helps us with subsorting. +* As above, replacing the first '.' in ".llvm." with '\0' does not +* affect the main sorting, but it helps us with subsorting. */ - p =strchr (s,'.' ); + p =strstr (s,".llvm." );if (p) *p ='\0' ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 150/227 smb: client: fix missed ses refcounting
In reply to Greg Kroah-HartmanFrom: Paulo Alcantara <[email protected]>
[ Upstream commit bf99f6be2d20146942bce6f9e90a0ceef12cbc1e ]
Use new cifs_smb_ses_inc_refcount() helper to get an active reference of @ses and @ses->dfs_root_ses (if set). This will prevent @ses->dfs_root_ses of being put in the next call to cifs_put_smb_ses() and thus potentially causing an use-after-free bug.
--- fs/smb/client/dfs.c | 26 ++++++++++---------------- fs/smb/client/smb2transport.c | 2 +- 2 files changed, 11 insertions(+), 17 deletions(-)
fs/smb/client/dfs.c +10 -16
@@ -66,6 +66,12 @@ static int get_session(struct cifs_mount_ctx *mnt_ctx, const char *full_path)return rc; } +/* +* Track individual DFS referral servers used by new DFS mount. +* +* On success, their lifetime will be shared by final tcon (dfs_ses_list). +* Otherwise, they will be put by dfs_put_root_smb_sessions() in cifs_mount(). +*/ static int add_root_smb_session (struct cifs_mount_ctx *mnt_ctx) {struct smb3_fs_context *ctx = mnt_ctx->fs_ctx;
@@ -80,11 +86,12 @@ static int add_root_smb_session(struct cifs_mount_ctx *mnt_ctx)INIT_LIST_HEAD (&root_ses->list);spin_lock (&cifs_tcp_ses_lock); - ses->ses_count++; +cifs_smb_ses_inc_refcount (ses);spin_unlock (&cifs_tcp_ses_lock); root_ses->ses = ses;list_add_tail (&root_ses->list, &mnt_ctx->dfs_ses_list); } +/* Select new DFS referral server so that new referrals go through it */ ctx->dfs_root_ses = ses;return 0 ; }
@@ -244,7 +251,6 @@ static int __dfs_mount_share(struct cifs_mount_ctx *mnt_ctx)int dfs_mount_share (struct cifs_mount_ctx *mnt_ctx,bool *isdfs) {struct smb3_fs_context *ctx = mnt_ctx->fs_ctx; -struct cifs_ses *ses;bool nodfs = ctx->nodfs;int rc;
@@ -278,20 +284,8 @@ int dfs_mount_share(struct cifs_mount_ctx *mnt_ctx, bool *isdfs) } *isdfs = true; -/* -* Prevent DFS root session of being put in the first call to -* cifs_mount_put_conns(). If another DFS root server was not found -* while chasing the referrals (@ctx->dfs_root_ses == @ses), then we -* can safely put extra refcount of @ses. -*/ - ses = mnt_ctx->ses; - mnt_ctx->ses =NULL ; - mnt_ctx->server =NULL ; - rc =__dfs_mount_share (mnt_ctx); -if (ses == ctx->dfs_root_ses) -cifs_put_smb_ses (ses); - -return rc; +add_root_smb_session (mnt_ctx); +return __dfs_mount_share (mnt_ctx); }/* Update dfs referral path of superblock */
fs/smb/client/smb2transport.c +1 -1
@@ -159,7 +159,7 @@ smb2_find_smb_ses_unlocked(struct TCP_Server_Info *server, __u64 ses_id)spin_unlock (&ses->ses_lock);continue ; } - ++ses->ses_count; +cifs_smb_ses_inc_refcount (ses);spin_unlock (&ses->ses_lock);return ses; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 151/227 arm64: Fix HFGxTR_EL2 field naming
In reply to Greg Kroah-HartmanFrom: Marc Zyngier <[email protected]>
[ Upstream commit 55b87b74996383230586f4f9f801ae304c70e649 ]
The HFGxTR_EL2 fields do not always follow the naming described in the spec, nor do they match the name of the register they trap in the rest of the kernel.
It is a bit sad that they were written by hand despite the availability of a machine readable version...
--- arch/arm64/tools/sysreg | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
arch/arm64/tools/sysreg +6 -6
@@ -1890,7 +1890,7 @@ Field 0 SM EndSysreg SysregFields HFGxTR_EL2 -Field 63 nAMIAIR2_EL1 +Field 63 nAMAIR2_EL1 Field 62 nMAIR2_EL1 Field 61 nS2POR_EL1 Field 60 nPOR_EL1
@@ -1905,9 +1905,9 @@ Field 52 nGCS_EL0 Res0 51 Field 50 nACCDATA_EL1 Field 49 ERXADDR_EL1 -Field 48 EXRPFGCDN_EL1 -Field 47 EXPFGCTL_EL1 -Field 46 EXPFGF_EL1 +Field 48 ERXPFGCDN_EL1 +Field 47 ERXPFGCTL_EL1 +Field 46 ERXPFGF_EL1 Field 45 ERXMISCn_EL1 Field 44 ERXSTATUS_EL1 Field 43 ERXCTLR_EL1
@@ -1922,8 +1922,8 @@ Field 35 TPIDR_EL0 Field 34 TPIDRRO_EL0 Field 33 TPIDR_EL1 Field 32 TCR_EL1 -Field 31 SCTXNUM_EL0 -Field 30 SCTXNUM_EL1 +Field 31 SCXTNUM_EL0 +Field 30 SCXTNUM_EL1 Field 29 SCTLR_EL1 Field 28 REVIDR_EL1 Field 27 PAR_EL1
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 152/227 dsa: mv88e6xxx: Do a final check before timing out
In reply to Greg Kroah-HartmanFrom: Linus Walleij <[email protected]>
[ Upstream commit 95ce158b6c93b28842b54b42ad1cb221b9844062 ]
I get sporadic timeouts from the driver when using the MV88E6352. Reading the status again after the loop fixes the
problem: the operation is successful but goes undetected.
Some added prints show things like this:
[ 58.356209] mv88e6085 mdio_mux-0.1:00: Timeout while waiting
for switch, addr 1b reg 0b, mask 8000, val 0000, data c000
[ 58.367487] mv88e6085 mdio_mux-0.1:00: Timeout waiting for
ATU op 4000, fid 0001
(...)
[ 61.826293] mv88e6085 mdio_mux-0.1:00: Timeout while waiting
for switch, addr 1c reg 18, mask 8000, val 0000, data 9860
[ 61.837560] mv88e6085 mdio_mux-0.1:00: Timeout waiting
for PHY command 1860 to completeThe reason is probably not the commands: I think those are mostly fine with the 50+50ms timeout, but the problem appears when OpenWrt brings up several interfaces in parallel on a system with 7 populated ports: if one of them take more than 50 ms and waits one or more of the others can get stuck on the mutex for the switch and then this can easily multiply.
As we sleep and wait, the function loop needs a final check after exiting the loop if we were successful.
--- drivers/net/dsa/mv88e6xxx/chip.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/dsa/mv88e6xxx/chip.c +7 -0
@@ -109,6 +109,13 @@ int mv88e6xxx_wait_mask(struct mv88e6xxx_chip *chip, int addr, int reg,usleep_range (1000 ,2000 ); } + err =mv88e6xxx_read (chip, addr, reg, &data); +if (err) +return err; + +if ((data & mask) == val) +return 0 ; +dev_err (chip->dev,"Timeout while waiting for switch\n" );return -ETIMEDOUT ; }
Signature · 1 line
2.39.2