5.10.190-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 5.10.190-rc1 review
This is the start of the stable review cycle for the 5.10.190 release. There are 201 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 11 Aug 2023 10:36:10 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.190-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.10.190-rc1
Xu Yang <[email protected]>
ARM: dts: nxp/imx6sll: fix wrong property name in usbphy node
Andreas Kemnade <[email protected]>
ARM: dts: imx6sll: fixup of operating points
Peng Fan <[email protected]>
ARM: dts: imx: add usb alias
Paul Fertser <[email protected]>
wifi: mt76: mt7615: do not advertise 5 GHz on first phy of MT7615D (DBDC)
Gustavo A. R. Silva <[email protected]>
mt76: mt7615: Fix fall-through warnings for Clang
Lorenzo Bianconi <[email protected]>
mt76: move band capabilities in mt76_phy
Namjae Jeon <[email protected]>
exfat: check if filename entries exceeds max filename length
Yuezhang Mo <[email protected]>
exfat: support dynamic allocate bh for exfat_entry_set_cache
Hyeongseok Kim <[email protected]>
exfat: speed up iterate/lookup by fixing start point of traversing cluster chain
Johan Hovold <[email protected]>
PM: sleep: wakeirq: fix wake irq arming
Chunfeng Yun <[email protected]>
PM / wakeirq: support enabling wake-up irq after runtime_suspend called
Johan Hovold <[email protected]>
soundwire: fix enumeration completion
Pierre-Louis Bossart <[email protected]>
soundwire: bus: pm_runtime_request_resume on peripheral attachment
Pierre-Louis Bossart <[email protected]>
soundwire: bus: add better dev_dbg to track complete() calls
Sean Christopherson <[email protected]>
selftests/rseq: Play nice with binaries statically linked against glibc 2.35+
Michael Jeanson <[email protected]>
selftests/rseq: check if libc rseq support is registered
Aneesh Kumar K.V <[email protected]>
powerpc/mm/altmap: Fix altmap boundary check
Christophe JAILLET <[email protected]>
mtd: rawnand: fsl_upm: Fix an off-by one test in fun_exec_op()
Roger Quadros <[email protected]>
mtd: rawnand: omap_elm: Fix incorrect type in assignment
Jan Kara <[email protected]>
ext2: Drop fragment support
Jan Kara <[email protected]>
fs: Protect reconfiguration of sb read-write from racing writes
Alan Stern <[email protected]>
net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb
Sungwoo Kim <[email protected]>
Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
Prince Kumar Maurya <[email protected]>
fs/sysv: Null check to prevent null-ptr-deref bug
Douglas Anderson <[email protected]>
tracing: Fix sleeping while atomic in kdb ftdump
Linus Torvalds <[email protected]>
file: reinstate f_pos locking optimization for regular files
Guchun Chen <[email protected]>
drm/ttm: check null pointer before accessing when swapping
Aleksa Sarai <[email protected]>
open: make RESOLVE_CACHED correctly test for O_TMPFILE
Jiri Olsa <[email protected]>
bpf: Disable preemption in bpf_event_output
Laszlo Ersek <[email protected]>
net: tap_open(): set sk_uid from current_fsuid()
Laszlo Ersek <[email protected]>
net: tun_chr_open(): set sk_uid from current_fsuid()
Dinh Nguyen <[email protected]>
arm64: dts: stratix10: fix incorrect I2C property for SCL signal
Arseniy Krasnov <[email protected]>
mtd: rawnand: meson: fix OOB available bytes for ECC
Olivier Maignial <[email protected]>
mtd: spinand: toshiba: Fix ecc_get_status
Sungjong Seo <[email protected]>
exfat: release s_lock before calling dir_emit()
gaoming <[email protected]>
exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree
Xiubo Li <[email protected]>
ceph: defer stopping mdsc delayed_work
Ross Maynard <[email protected]>
USB: zaurus: Add ID for A-300/B-500/C-700
Ilya Dryomov <[email protected]>
libceph: fix potential hang in ceph_osdc_notify()
Steffen Maier <[email protected]>
scsi: zfcp: Defer fc_rport blocking until after ADISC response
Eric Dumazet <[email protected]>
tcp_metrics: fix data-race in tcpm_suck_dst() vs fastopen
Eric Dumazet <[email protected]>
tcp_metrics: annotate data-races around tm->tcpm_net
Eric Dumazet <[email protected]>
tcp_metrics: annotate data-races around tm->tcpm_vals[]
Eric Dumazet <[email protected]>
tcp_metrics: annotate data-races around tm->tcpm_lock
Eric Dumazet <[email protected]>
tcp_metrics: annotate data-races around tm->tcpm_stamp
Eric Dumazet <[email protected]>
tcp_metrics: fix addr_same() helper
Jianbo Liu <[email protected]>
net/mlx5: fs_core: Skip the FTs in the same FS_TYPE_PRIO_CHAINS fs_prio
Jianbo Liu <[email protected]>
net/mlx5: fs_core: Make find_closest_ft more generic
Benjamin Poirier <[email protected]>
vxlan: Fix nexthop hash size
Yue Haibing <[email protected]>
ip6mr: Fix skb_under_panic in ip6mr_cache_report()
Alexandra Winter <[email protected]>
s390/qeth: Don't call dev_close/dev_open (DOWN/UP)
Lin Ma <[email protected]>
net: dcb: choose correct policy to parse DCB_ATTR_BCN
Mark Brown <[email protected]>
net: netsec: Ignore 'phy-mode' on SynQuacer in DT mode
Dan Carpenter <[email protected]>
net: ll_temac: fix error checking of irq_of_parse_and_map()
Yang Yingliang <[email protected]>
net: ll_temac: Switch to use dev_err_probe() helper
Tomas Glozar <[email protected]>
bpf: sockmap: Remove preempt_disable in sock_map_sk_acquire
valis <[email protected]>
net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free
valis <[email protected]>
net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free
valis <[email protected]>
net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free
Eric Dumazet <[email protected]>
net: add missing data-race annotation for sk_ll_usec
Eric Dumazet <[email protected]>
net: add missing data-race annotations around sk->sk_peek_off
Eric Dumazet <[email protected]>
net: add missing READ_ONCE(sk->sk_rcvbuf) annotation
Eric Dumazet <[email protected]>
net: add missing READ_ONCE(sk->sk_sndbuf) annotation
Eric Dumazet <[email protected]>
net: add missing READ_ONCE(sk->sk_rcvlowat) annotation
Eric Dumazet <[email protected]>
net: annotate data-races around sk->sk_max_pacing_rate
Chengfeng Ye <[email protected]>
mISDN: hfcpci: Fix potential deadlock on &hc->lock
Jamal Hadi Salim <[email protected]>
net: sched: cls_u32: Fix match key mis-addressing
Georg Müller <[email protected]>
perf test uprobe_from_different_cu: Skip if there is no gcc
Yuanjun Gong <[email protected]>
net: dsa: fix value check in bcm_sf2_sw_probe()
Lin Ma <[email protected]>
rtnetlink: let rtnl_bridge_setlink checks IFLA_BRIDGE_MODE length
Lin Ma <[email protected]>
bpf: Add length check for SK_DIAG_BPF_STORAGE_REQ_MAP_FD parsing
Yuanjun Gong <[email protected]>
net/mlx5e: fix return value check in mlx5e_ipsec_remove_trailer()
Zhengchao Shao <[email protected]>
net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx
Ilan Peer <[email protected]>
wifi: cfg80211: Fix return value in scan logic
Heiko Carstens <[email protected]>
KVM: s390: fix sthyi error handling
[email protected] <[email protected]>
word-at-a-time: use the same return type for has_zero regardless of endianness
Hugo Villeneuve <[email protected]>
arm64: dts: imx8mn-var-som: add missing pull-up for onboard PHY reset pinmux
Bart Van Assche <[email protected]>
loop: Select I/O scheduler 'none' from inside add_disk()
Peter Zijlstra <[email protected]>
perf: Fix function pointer case
Jens Axboe <[email protected]>
io_uring: gate iowait schedule on having pending requests
Nadav Amit <[email protected]>
x86/kprobes: Fix JNG/JNLE emulation
Masami Hiramatsu (Google) <[email protected]>
x86/kprobes: Update kcb status flag after singlestepping
Wei Yongjun <[email protected]>
x86/kprobes: Move 'inline' to the beginning of the kprobe_is_ss() declaration
Masami Hiramatsu <[email protected]>
x86/kprobes: Fix to identify indirect jmp and others using range case
Masami Hiramatsu <[email protected]>
x86/kprobes: Use int3 instead of debug trap for single-step
Masami Hiramatsu <[email protected]>
x86/kprobes: Identify far indirect JMP correctly
Masami Hiramatsu <[email protected]>
x86/kprobes: Retrieve correct opcode for group instruction
Masami Hiramatsu <[email protected]>
x86/kprobes: Do not decode opcode in resume_execution()
Gustavo A. R. Silva <[email protected]>
kprobes/x86: Fix fall-through warnings for Clang
Thomas Petazzoni <[email protected]>
ASoC: cs42l51: fix driver to properly autoload with automatic module loading
Jens Axboe <[email protected]>
io_uring: treat -EAGAIN for REQ_F_NOWAIT as final for io-wq
Matthieu Baerts <[email protected]>
selftests: mptcp: depend on SYN_COOKIES
Rafael J. Wysocki <[email protected]>
cpufreq: intel_pstate: Drop ACPI _PSS states table patching
Rafael J. Wysocki <[email protected]>
ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily
Rafael J. Wysocki <[email protected]>
ACPI: processor: perflib: Use the "no limit" frequency QoS
Christian König <[email protected]>
drm/ttm: make ttm_bo_unpin more defensive
Joe Thornber <[email protected]>
dm cache policy smq: ensure IO doesn't prevent cleaner policy progress
Xiubo Li <[email protected]>
ceph: never send metrics if disable_send_metrics is set
Mark Brown <[email protected]>
ASoC: wm8904: Fill the cache for WM8904_ADC_TEST_0 register
Stefan Haberland <[email protected]>
s390/dasd: fix hanging device after quiesce/resume
Jason Wang <[email protected]>
virtio-net: fix race between set queues and probe
Filipe Manana <[email protected]>
btrfs: check if the transaction was aborted at btrfs_wait_for_commit()
Larry Finger <[email protected]>
staging: r8712: Fix memory leak in _r8712_init_xmit_priv()
Christophe JAILLET <[email protected]>
staging: rtl8712: Use constants from <linux/ieee80211.h>
Sean Christopherson <[email protected]>
KVM: VMX: Don't fudge CR0 and CR4 for restricted L2 guest
Sean Christopherson <[email protected]>
KVM: nVMX: Do not clear CR3 load/store exiting bits if L1 wants 'em
Sean Christopherson <[email protected]>
KVM: VMX: Fold ept_update_paging_mode_cr0() back into vmx_set_cr0()
Sean Christopherson <[email protected]>
KVM: VMX: Invert handling of CR0.WP for EPT without unrestricted guest
Marc Zyngier <[email protected]>
irqchip/gic-v4.1: Properly lock VPEs when doing a directLPI invalidation
Jonas Gorski <[email protected]>
irq-bcm6345-l1: Do not assume a fixed block to cpu mapping
Alexander Steffen <[email protected]>
tpm_tis: Explicitly check for error code
Trond Myklebust <[email protected]>
nfsd: Remove incorrect check in nfsd4_validate_stateid
Christian Brauner <[email protected]>
file: always lock position for FMODE_ATOMIC_POS
Filipe Manana <[email protected]>
btrfs: check for commit error at btrfs_attach_transaction_barrier()
Gilles Buloz <[email protected]>
hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled
Luka Guzenko <[email protected]>
ALSA: hda/relatek: Enable Mute LED on HP 250 G8
Chaoyuan Peng <[email protected]>
tty: n_gsm: fix UAF in gsm_cleanup_mux
Zhang Shurong <[email protected]>
staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext()
Greg Kroah-Hartman <[email protected]>
Documentation: security-bugs.rst: clarify CVE handling
Greg Kroah-Hartman <[email protected]>
Documentation: security-bugs.rst: update preferences when dealing with the linux-distros group
Dan Carpenter <[email protected]>
Revert "usb: xhci: tegra: Fix error check"
Ricardo Ribalda <[email protected]>
usb: xhci-mtk: set the dma max_seg_size
Łukasz Bartosik <[email protected]>
USB: quirks: add quirk for Focusrite Scarlett
Guiting Shen <[email protected]>
usb: ohci-at91: Fix the unhandle interrupt when resume
Jisheng Zhang <[email protected]>
usb: dwc3: don't reset device side if dwc3 was configured as host-only
Gratian Crisan <[email protected]>
usb: dwc3: pci: skip BYT GPIO lookup table for hardwired phy
Jakub Vanek <[email protected]>
Revert "usb: dwc3: core: Enable AutoRetry feature in the controller"
Marc Kleine-Budde <[email protected]>
can: gs_usb: gs_can_close(): add missing set of CAN state to CAN_STATE_STOPPED
Johan Hovold <[email protected]>
USB: serial: simple: sort driver entries
Oliver Neukum <[email protected]>
USB: serial: simple: add Kaufmann RKS+CAN VCP
Mohsen Tahmasebi <[email protected]>
USB: serial: option: add Quectel EC200A module support
Jerry Meng <[email protected]>
USB: serial: option: support Quectel EM060K_128
Samuel Holland <[email protected]>
serial: sifive: Fix sifive_serial_console_setup() section
Ruihong Luo <[email protected]>
serial: 8250_dw: Preserve original value of DLF register
Johan Hovold <[email protected]>
serial: qcom-geni: drop bogus runtime pm state update
Zqiang <[email protected]>
USB: gadget: Fix the memory leak in raw_gadget driver
Dan Carpenter <[email protected]>
Revert "usb: gadget: tegra-xudc: Fix error check in tegra_xudc_powerdomain_init()"
Zheng Yejian <[email protected]>
tracing: Fix warning in trace_buffered_event_disable()
Zheng Yejian <[email protected]>
ring-buffer: Fix wrong stat of cpu_buffer->read
Arnd Bergmann <[email protected]>
ata: pata_ns87415: mark ns87560_tf_read static
Yu Kuai <[email protected]>
dm raid: protect md_stop() with 'reconfig_mutex'
Yu Kuai <[email protected]>
dm raid: clean up four equivalent goto tags in raid_ctr()
Yu Kuai <[email protected]>
dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths
Bart Van Assche <[email protected]>
block: Fix a source code comment in include/uapi/linux/blkzoned.h
Matus Gajdos <[email protected]>
ASoC: fsl_spdif: Silence output on stop
Gaosheng Cui <[email protected]>
drm/msm: Fix IS_ERR_OR_NULL() vs NULL check in a5xx_submit_in_rb()
Thomas Bogendoerfer <[email protected]>
RDMA/mthca: Fix crash when polling CQ for shared QPs
Rob Clark <[email protected]>
drm/msm/adreno: Fix snapshot BINDLESS_DATA size
Dmitry Baryshkov <[email protected]>
drm/msm/dpu: drop enum dpu_core_perf_data_bus_id
Dan Carpenter <[email protected]>
RDMA/mlx4: Make check for invalid flags stricter
Fedor Pchelkin <[email protected]>
tipc: stop tipc crypto on failure in tipc_node_create
Yuanjun Gong <[email protected]>
tipc: check return value of pskb_trim()
Yuanjun Gong <[email protected]>
benet: fix return value check in be_lancer_xmit_workarounds()
Lin Ma <[email protected]>
net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64
Vladimir Oltean <[email protected]>
net/sched: mqprio: add extack to mqprio_parse_nlattr()
Vladimir Oltean <[email protected]>
net/sched: mqprio: refactor nlattr parsing to a separate function
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR
Pablo Neira Ayuso <[email protected]>
netfilter: nftables: add helper function to validate set element data
Florian Westphal <[email protected]>
netfilter: nft_set_rbtree: fix overlap expiration walk
Maxim Mikityanskiy <[email protected]>
platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100
Hangbin Liu <[email protected]>
team: reset team's flags when down link is P2P device
Hangbin Liu <[email protected]>
bonding: reset bond's flags when down link is P2P device
Jedrzej Jagielski <[email protected]>
ice: Fix memory management in ice_ethtool_fdir.c
Stewart Smith <[email protected]>
tcp: Reduce chance of collisions in inet6_hashfn().
Maciej Żenczykowski <[email protected]>
ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new temporary address
Yuanjun Gong <[email protected]>
ethernet: atheros: fix return value check in atl1e_tso_csum()
Harshit Mogalapalli <[email protected]>
phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe()
Jiri Benc <[email protected]>
vxlan: calculate correct header length for GPE
Roopa Prabhu <[email protected]>
vxlan: move to its own directory
Jijie Shao <[email protected]>
net: hns3: fix wrong bw weight of disabled tc issue
Guangbin Huang <[email protected]>
net: hns3: reconstruct function hclge_ets_validate()
Jiawen Wu <[email protected]>
net: phy: marvell10g: fix 88x3310 power up
Wang Ming <[email protected]>
i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir()
Sakari Ailus <[email protected]>
media: staging: atomisp: select V4L2_FWNODE
Adrien Thierry <[email protected]>
phy: qcom-snps-femto-v2: properly enable ref clock
Adrien Thierry <[email protected]>
phy: qcom-snps-femto-v2: keep cfg_ahb_clk enabled during runtime suspend
Krzysztof Kozlowski <[email protected]>
phy: qcom-snps: correct struct qcom_snps_hsphy kerneldoc
Yuan Can <[email protected]>
phy: qcom-snps: Use dev_err_probe() to simplify code
Chao Yu <[email protected]>
ext4: fix to check return value of freeze_bdev() in ext4_shutdown()
Heiner Kallweit <[email protected]>
pwm: meson: fix handling of period/duty if greater than UINT_MAX
Uwe Kleine-König <[email protected]>
pwm: meson: Simplify duplicated per-channel tracking
Masami Hiramatsu <[email protected]>
tracing: Show real address for trace event arguments
Christian König <[email protected]>
drm/ttm: never consider pinned BOs for eviction&swap
Christian König <[email protected]>
drm/ttm: add ttm_bo_pin()/ttm_bo_unpin() v2
Alexander Aring <[email protected]>
fs: dlm: interrupt posix locks only when process is killed
Alexander Aring <[email protected]>
dlm: rearrange async condition return
Alexander Aring <[email protected]>
dlm: cleanup plock_op vs plock_xop
Ilpo Järvinen <[email protected]>
PCI/ASPM: Avoid link retraining race
Ilpo Järvinen <[email protected]>
PCI/ASPM: Factor out pcie_wait_for_retrain()
Bjorn Helgaas <[email protected]>
PCI/ASPM: Return 0 or -ETIMEDOUT from pcie_retrain_link()
Christophe JAILLET <[email protected]>
i2c: nomadik: Remove a useless call in the remove function
Andi Shyti <[email protected]>
i2c: nomadik: Use devm_clk_get_enabled()
Andi Shyti <[email protected]>
i2c: nomadik: Remove unnecessary goto label
Markus Elfring <[email protected]>
i2c: Improve size determinations
Markus Elfring <[email protected]>
i2c: Delete error messages for failed memory allocations
Filipe Manana <[email protected]>
btrfs: fix extent buffer leak after tree mod log failure at split_node()
Filipe Manana <[email protected]>
btrfs: fix race between quota disable and relocation
Hans de Goede <[email protected]>
gpio: tps68470: Make tps68470_gpio_output() always set the initial value
Ondrej Mosnacek <[email protected]>
io_uring: don't audit the capability check in io_uring_create()
Claudio Imbrenda <[email protected]>
KVM: s390: pv: fix index value of replaced ASCE
-------------
Diffstat:
Documentation/admin-guide/security-bugs.rst | 37 +-
Makefile | 4 +-
arch/arm/boot/dts/imx6qdl.dtsi | 4 +
arch/arm/boot/dts/imx6sl.dtsi | 3 +
arch/arm/boot/dts/imx6sll.dtsi | 26 +-
arch/arm/boot/dts/imx6sx.dtsi | 3 +
arch/arm/boot/dts/imx6ul.dtsi | 2 +
arch/arm/boot/dts/imx7d.dtsi | 6 +
arch/arm/boot/dts/imx7s.dtsi | 2 +
.../boot/dts/altera/socfpga_stratix10_socdk.dts | 2 +-
.../dts/altera/socfpga_stratix10_socdk_nand.dts | 2 +-
arch/arm64/boot/dts/freescale/imx8mn-var-som.dtsi | 2 +-
arch/powerpc/include/asm/word-at-a-time.h | 2 +-
arch/powerpc/mm/init_64.c | 3 +-
arch/s390/kernel/sthyi.c | 6 +-
arch/s390/kvm/intercept.c | 9 +-
arch/s390/mm/gmap.c | 1 +
arch/x86/include/asm/kprobes.h | 24 +-
arch/x86/kernel/kprobes/core.c | 639 +++++++++++++--------
arch/x86/kernel/traps.c | 3 -
arch/x86/kvm/vmx/vmx.c | 87 +--
drivers/acpi/processor_perflib.c | 42 +-
drivers/ata/pata_ns87415.c | 2 +-
drivers/base/power/power.h | 8 +-
drivers/base/power/runtime.c | 6 +-
drivers/base/power/wakeirq.c | 111 +++-
drivers/block/loop.c | 3 +-
drivers/char/tpm/tpm_tis_core.c | 10 +-
drivers/cpufreq/intel_pstate.c | 14 -
drivers/gpio/gpio-tps68470.c | 6 +-
drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 2 +-
drivers/gpu/drm/msm/adreno/a6xx_gpu_state.h | 2 +-
drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.h | 13 -
drivers/gpu/drm/ttm/ttm_bo.c | 16 +-
drivers/gpu/drm/ttm/ttm_bo_util.c | 2 +-
drivers/hwmon/nct7802.c | 2 +-
drivers/i2c/busses/i2c-ibm_iic.c | 4 +-
drivers/i2c/busses/i2c-nomadik.c | 42 +-
drivers/i2c/busses/i2c-sh7760.c | 3 +-
drivers/i2c/busses/i2c-tiny-usb.c | 4 +-
drivers/infiniband/hw/mlx4/qp.c | 18 +-
drivers/infiniband/hw/mthca/mthca_qp.c | 2 +-
drivers/irqchip/irq-bcm6345-l1.c | 14 +-
drivers/irqchip/irq-gic-v3-its.c | 75 ++-
drivers/isdn/hardware/mISDN/hfcpci.c | 10 +-
drivers/md/dm-cache-policy-smq.c | 28 +-
drivers/md/dm-raid.c | 20 +-
drivers/md/md.c | 2 +
drivers/mtd/nand/raw/fsl_upm.c | 2 +-
drivers/mtd/nand/raw/meson_nand.c | 3 +-
drivers/mtd/nand/raw/omap_elm.c | 24 +-
drivers/mtd/nand/spi/toshiba.c | 4 +-
drivers/net/Makefile | 2 +-
drivers/net/bonding/bond_main.c | 5 +
drivers/net/can/usb/gs_usb.c | 2 +
drivers/net/dsa/bcm_sf2.c | 8 +-
drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 7 +-
drivers/net/ethernet/emulex/benet/be_main.c | 3 +-
.../net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c | 60 +-
.../net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 3 +-
drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 2 +-
drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c | 26 +-
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 2 +-
.../mellanox/mlx5/core/en_accel/ipsec_rxtx.c | 4 +-
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 105 +++-
.../ethernet/mellanox/mlx5/core/steering/dr_cmd.c | 5 +-
drivers/net/ethernet/socionext/netsec.c | 11 +
drivers/net/ethernet/xilinx/ll_temac_main.c | 16 +-
drivers/net/phy/marvell10g.c | 7 +
drivers/net/tap.c | 2 +-
drivers/net/team/team.c | 9 +
drivers/net/tun.c | 2 +-
drivers/net/usb/cdc_ether.c | 21 +
drivers/net/usb/usbnet.c | 6 +
drivers/net/usb/zaurus.c | 21 +
drivers/net/virtio_net.c | 4 +-
drivers/net/vxlan/Makefile | 7 +
drivers/net/{vxlan.c => vxlan/vxlan_core.c} | 23 +-
drivers/net/wireless/mediatek/mt76/mac80211.c | 8 +-
drivers/net/wireless/mediatek/mt76/mt76.h | 2 +-
drivers/net/wireless/mediatek/mt76/mt7603/eeprom.c | 2 +-
drivers/net/wireless/mediatek/mt76/mt7615/dma.c | 2 +-
drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c | 22 +-
drivers/net/wireless/mediatek/mt76/mt76x0/eeprom.c | 6 +-
drivers/net/wireless/mediatek/mt76/mt76x0/init.c | 4 +-
drivers/net/wireless/mediatek/mt76/mt76x0/phy.c | 4 +-
.../net/wireless/mediatek/mt76/mt76x02_eeprom.c | 8 +-
drivers/net/wireless/mediatek/mt76/mt7915/eeprom.c | 8 +-
drivers/net/wireless/mediatek/mt76/mt7915/init.c | 5 +-
drivers/pci/pcie/aspm.c | 55 +-
drivers/phy/hisilicon/phy-hisi-inno-usb2.c | 2 +-
drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 86 +--
drivers/platform/x86/msi-laptop.c | 8 +-
drivers/pwm/pwm-meson.c | 25 +-
drivers/s390/block/dasd_ioctl.c | 1 +
drivers/s390/net/qeth_core.h | 1 -
drivers/s390/net/qeth_core_main.c | 2 -
drivers/s390/net/qeth_l2_main.c | 9 +-
drivers/s390/net/qeth_l3_main.c | 8 +-
drivers/s390/scsi/zfcp_fc.c | 6 +-
drivers/soundwire/bus.c | 31 +-
drivers/staging/ks7010/ks_wlan_net.c | 6 +-
drivers/staging/media/atomisp/Kconfig | 1 +
drivers/staging/rtl8712/ieee80211.c | 12 +-
drivers/staging/rtl8712/rtl871x_ioctl_linux.c | 8 +-
drivers/staging/rtl8712/rtl871x_mlme.c | 10 +-
drivers/staging/rtl8712/rtl871x_xmit.c | 46 +-
drivers/staging/rtl8712/wifi.h | 15 -
drivers/staging/rtl8712/xmit_linux.c | 6 +
drivers/tty/n_gsm.c | 4 +-
drivers/tty/serial/8250/8250_dwlib.c | 6 +-
drivers/tty/serial/qcom_geni_serial.c | 7 -
drivers/tty/serial/sifive.c | 2 +-
drivers/usb/core/quirks.c | 4 +
drivers/usb/dwc3/core.c | 20 +-
drivers/usb/dwc3/core.h | 3 -
drivers/usb/dwc3/dwc3-pci.c | 6 +-
drivers/usb/gadget/legacy/raw_gadget.c | 12 +-
drivers/usb/gadget/udc/tegra-xudc.c | 8 +-
drivers/usb/host/ohci-at91.c | 8 +-
drivers/usb/host/xhci-mtk.c | 1 +
drivers/usb/host/xhci-tegra.c | 8 +-
drivers/usb/serial/option.c | 6 +
drivers/usb/serial/usb-serial-simple.c | 73 +--
fs/btrfs/ctree.c | 2 +
fs/btrfs/qgroup.c | 18 +-
fs/btrfs/transaction.c | 10 +-
fs/ceph/mds_client.c | 4 +-
fs/ceph/mds_client.h | 5 +
fs/ceph/metric.c | 2 +-
fs/ceph/super.c | 10 +
fs/dlm/plock.c | 100 ++--
fs/exfat/balloc.c | 6 +-
fs/exfat/dir.c | 70 ++-
fs/exfat/exfat_fs.h | 7 +-
fs/exfat/namei.c | 9 +-
fs/ext2/ext2.h | 12 -
fs/ext2/super.c | 23 +-
fs/ext4/ioctl.c | 5 +-
fs/file.c | 24 +-
fs/nfsd/nfs4state.c | 2 -
fs/open.c | 2 +-
fs/super.c | 11 +-
fs/sysv/itree.c | 4 +
include/asm-generic/word-at-a-time.h | 2 +-
include/drm/ttm/ttm_bo_api.h | 28 +
include/linux/pm_wakeirq.h | 9 +-
include/linux/trace_events.h | 4 +
include/net/ipv6.h | 8 +-
include/net/vxlan.h | 17 +-
include/trace/trace_events.h | 2 +-
include/uapi/linux/blkzoned.h | 10 +-
io_uring/io_uring.c | 33 +-
kernel/events/core.c | 8 +-
kernel/trace/bpf_trace.c | 6 +-
kernel/trace/ring_buffer.c | 22 +-
kernel/trace/trace.c | 76 ++-
kernel/trace/trace.h | 2 +
kernel/trace/trace_events.c | 14 +-
kernel/trace/trace_output.c | 12 +-
net/bluetooth/l2cap_sock.c | 2 +
net/ceph/osd_client.c | 20 +-
net/core/bpf_sk_storage.c | 5 +-
net/core/rtnetlink.c | 8 +-
net/core/sock.c | 21 +-
net/core/sock_map.c | 2 -
net/dcb/dcbnl.c | 2 +-
net/ipv4/tcp_metrics.c | 70 ++-
net/ipv6/addrconf.c | 14 +-
net/ipv6/ip6mr.c | 2 +-
net/netfilter/nf_tables_api.c | 20 +-
net/netfilter/nft_immediate.c | 27 +-
net/netfilter/nft_set_rbtree.c | 20 +-
net/sched/cls_fw.c | 1 -
net/sched/cls_route.c | 1 -
net/sched/cls_u32.c | 57 +-
net/sched/sch_mqprio.c | 144 +++--
net/tipc/crypto.c | 3 +-
net/tipc/node.c | 2 +-
net/unix/af_unix.c | 2 +-
net/wireless/scan.c | 2 +-
sound/pci/hda/patch_realtek.c | 1 +
sound/soc/codecs/cs42l51-i2c.c | 6 +
sound/soc/codecs/cs42l51.c | 7 -
sound/soc/codecs/cs42l51.h | 1 -
sound/soc/codecs/wm8904.c | 3 +
sound/soc/fsl/fsl_spdif.c | 2 +
.../tests/shell/test_uprobe_from_different_cu.sh | 8 +-
tools/testing/selftests/net/mptcp/config | 1 +
tools/testing/selftests/rseq/rseq.c | 31 +-
190 files changed, 2159 insertions(+), 1206 deletions(-)Greg Kroah-Hartman
maintainerPATCH 1/201 KVM: s390: pv: fix index value of replaced ASCE
From: Claudio Imbrenda <[email protected]>
[ Upstream commit c2fceb59bbda16468bda82b002383bff59de89ab ]
The index field of the struct page corresponding to a guest ASCE should be 0. When replacing the ASCE in s390_replace_asce(), the index of the new ASCE should also be set to 0.
Having the wrong index might lead to the wrong addresses being passed around when notifying pte invalidations, and eventually to validity intercepts (VM crash) if the prefix gets unmapped and the notifier gets called with the wrong address.
Message-ID: <[email protected]>
--- arch/s390/mm/gmap.c | 1 + 1 file changed, 1 insertion(+)
arch/s390/mm/gmap.c +1 -0
@@ -2786,6 +2786,7 @@ int s390_replace_asce(struct gmap *gmap) page =alloc_pages (GFP_KERNEL_ACCOUNT ,CRST_ALLOC_ORDER );if (!page)return -ENOMEM ; + page->index =0 ; table =page_to_virt (page);memcpy (table, gmap->table,1UL << (CRST_ALLOC_ORDER +PAGE_SHIFT ));
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 2/201 io_uring: dont audit the capability check in io_uring_create()
In reply to Greg Kroah-HartmanFrom: Ondrej Mosnacek <[email protected]>
[ Upstream commit 6adc2272aaaf84f34b652cf77f770c6fcc4b8336 ]
The check being unconditional may lead to unwanted denials reported by LSMs when a process has the capability granted by DAC, but denied by an LSM. In the case of SELinux such denials are a problem, since they can't be effectively filtered out via the policy and when not silenced, they produce noise that may hide a true problem or an attack.
Since not having the capability merely means that the created io_uring context will be accounted against the current user's RLIMIT_MEMLOCK limit, we can disable auditing of denials for this check by using ns_capable_noaudit() instead of capable().
--- io_uring/io_uring.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
io_uring/io_uring.c +1 -1
@@ -10431,7 +10431,7 @@ static int io_uring_create(unsigned entries, struct io_uring_params *p,if (!ctx)return -ENOMEM ; ctx->compat =in_compat_syscall (); -if (!capable (CAP_IPC_LOCK )) +if (!ns_capable_noaudit (&init_user_ns,CAP_IPC_LOCK )) ctx->user =get_uid (current_user ());/*
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 3/201 gpio: tps68470: Make tps68470_gpio_output() always set the initial value
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 5a7adc6c1069ce31ef4f606ae9c05592c80a6ab5 ]
Make tps68470_gpio_output() call tps68470_gpio_set() for output-only pins too, so that the initial value passed to gpiod_direction_output() is honored for these pins too.
--- drivers/gpio/gpio-tps68470.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpio/gpio-tps68470.c +3 -3
@@ -91,13 +91,13 @@ static int tps68470_gpio_output(struct gpio_chip *gc, unsigned int offset,struct tps68470_gpio_data *tps68470_gpio =gpiochip_get_data (gc);struct regmap *regmap = tps68470_gpio->tps68470_regmap; +/* Set the initial value */ +tps68470_gpio_set (gc, offset, value); +/* rest are always outputs */ if (offset >=TPS68470_N_REGULAR_GPIO )return 0 ; -/* Set the initial value */ -tps68470_gpio_set (gc, offset, value); -return regmap_update_bits (regmap,TPS68470_GPIO_CTL_REG_A (offset),TPS68470_GPIO_MODE_MASK ,TPS68470_GPIO_MODE_OUT_CMOS );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 4/201 btrfs: fix race between quota disable and relocation
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
[ Upstream commit 8a4a0b2a3eaf75ca8854f856ef29690c12b2f531 ]
If we disable quotas while we have a relocation of a metadata block group that has extents belonging to the quota root, we can cause the relocation to fail with -ENOENT. This is because relocation builds backref nodes for extents of the quota root and later needs to walk the backrefs and access the quota root - however if in between a task disables quotas, it results in deleting the quota root from the root tree (with btrfs_del_root(), called from btrfs_quota_disable().
This can be sporadically triggered by test case btrfs/255 from fstests:
$ ./check btrfs/255 FSTYP -- btrfs PLATFORM -- Linux/x86_64 debian0 6.4.0-rc6-btrfs-next-134+ #1 SMP PREEMPT_DYNAMIC Thu Jun 15 11:59:28 WEST 2023 MKFS_OPTIONS -- /dev/sdc MOUNT_OPTIONS -- /dev/sdc /home/fdmanana/btrfs-tests/scratch_1
btrfs/255 6s ... _check_dmesg: something found in dmesg (see /home/fdmanana/git/hub/xfstests/results//btrfs/255.dmesg)
- output mismatch (see /home/fdmanana/git/hub/xfstests/results//btrfs/255.out.bad)
# --- tests/btrfs/255.out 2023-03-02 21:47:53.876609426 +0000 # +++ /home/fdmanana/git/hub/xfstests/results//btrfs/255.out.bad 2023-06-16 10:20:39.267563212 +0100 # @@ -1,2 +1,4 @@
# QA output created by 255
# +ERROR: error during balancing '/home/fdmanana/btrfs-tests/scratch_1': No such file or directory
# +There may be more info in syslog - try dmesg | tail
# Silence is golden
# ...
(Run 'diff -u /home/fdmanana/git/hub/xfstests/tests/btrfs/255.out /home/fdmanana/git/hub/xfstests/results//btrfs/255.out.bad' to see the entire diff)
Ran: btrfs/255
Failures: btrfs/255
Failed 1 of 1 tests
To fix this make the quota disable operation take the cleaner mutex, as relocation of a block group also takes this mutex. This is also what we do when deleting a subvolume/snapshot, we take the cleaner mutex in the cleaner kthread (at cleaner_kthread()) and then we call btrfs_del_root() at btrfs_drop_snapshot() while under the protection of the cleaner mutex.
--- fs/btrfs/qgroup.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
fs/btrfs/qgroup.c +15 -3
@@ -1202,12 +1202,23 @@ int btrfs_quota_disable(struct btrfs_fs_info *fs_info)int ret =0 ;/* -* We need to have subvol_sem write locked, to prevent races between -* concurrent tasks trying to disable quotas, because we will unlock -* and relock qgroup_ioctl_lock across BTRFS_FS_QUOTA_ENABLED changes. +* We need to have subvol_sem write locked to prevent races with +* snapshot creation. */ lockdep_assert_held_write (&fs_info->subvol_sem); +/* +* Lock the cleaner mutex to prevent races with concurrent relocation, +* because relocation may be building backrefs for blocks of the quota +* root while we are deleting the root. This is like dropping fs roots +* of deleted snapshots/subvolumes, we need the same protection. +* +* This also prevents races between concurrent tasks trying to disable +* quotas, because we will unlock and relock qgroup_ioctl_lock across +* BTRFS_FS_QUOTA_ENABLED changes. +*/ +mutex_lock (&fs_info->cleaner_mutex); +mutex_lock (&fs_info->qgroup_ioctl_lock);if (!fs_info->quota_root) goto out;
@@ -1287,6 +1298,7 @@ int btrfs_quota_disable(struct btrfs_fs_info *fs_info)btrfs_end_transaction (trans); else if (trans) ret =btrfs_end_transaction (trans); +mutex_unlock (&fs_info->cleaner_mutex);return ret; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 5/201 btrfs: fix extent buffer leak after tree mod log failure at split_node()
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
[ Upstream commit ede600e497b1461d06d22a7d17703d9096868bc3 ]
At split_node(), if we fail to log the tree mod log copy operation, we return without unlocking the split extent buffer we just allocated and without decrementing the reference we own on it. Fix this by unlocking it and decrementing the ref count before returning.
--- fs/btrfs/ctree.c | 2 ++ 1 file changed, 2 insertions(+)
fs/btrfs/ctree.c +2 -0
@@ -3589,6 +3589,8 @@ static noinline int split_node(struct btrfs_trans_handle *trans, ret =tree_mod_log_eb_copy (split, c,0 , mid, c_nritems - mid);if (ret) { +btrfs_tree_unlock (split); +free_extent_buffer (split);btrfs_abort_transaction (trans, ret);return ret; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 6/201 i2c: Delete error messages for failed memory allocations
In reply to Greg Kroah-HartmanFrom: Markus Elfring <[email protected]>
[ Upstream commit 6b3b21a8542fd2fb6ffc61bc13b9419f0c58ebad ]
These issues were detected by using the Coccinelle software.
Stable-dep-of: 05f933d5f731 ("i2c: nomadik: Remove a useless call in the remove function")
--- drivers/i2c/busses/i2c-ibm_iic.c | 4 +--- drivers/i2c/busses/i2c-nomadik.c | 1 - drivers/i2c/busses/i2c-sh7760.c | 1 - drivers/i2c/busses/i2c-tiny-usb.c | 4 +--- 4 files changed, 2 insertions(+), 8 deletions(-)
drivers/i2c/busses/i2c-ibm_iic.c +1 -3
@@ -694,10 +694,8 @@ static int iic_probe(struct platform_device *ofdev)int ret; dev =kzalloc (sizeof (*dev),GFP_KERNEL ); -if (!dev) { -dev_err (&ofdev->dev,"failed to allocate device data\n" ); +if (!dev)return -ENOMEM ; - }platform_set_drvdata (ofdev, dev);
drivers/i2c/busses/i2c-nomadik.c +0 -1
@@ -972,7 +972,6 @@ static int nmk_i2c_probe(struct amba_device *adev, const struct amba_id *id) dev =devm_kzalloc (&adev->dev,sizeof (struct nmk_i2c_dev ),GFP_KERNEL );if (!dev) { -dev_err (&adev->dev,"cannot allocate memory\n" ); ret = -ENOMEM ; goto err_no_mem; }
drivers/i2c/busses/i2c-sh7760.c +0 -1
@@ -445,7 +445,6 @@ static int sh7760_i2c_probe(struct platform_device *pdev) id =kzalloc (sizeof (struct cami2c ),GFP_KERNEL );if (!id) { -dev_err (&pdev->dev,"no mem for private data\n" ); ret = -ENOMEM ; goto out0; }
drivers/i2c/busses/i2c-tiny-usb.c +1 -3
@@ -226,10 +226,8 @@ static int i2c_tiny_usb_probe(struct usb_interface *interface,/* allocate memory for our device state and initialize it */ dev =kzalloc (sizeof (*dev),GFP_KERNEL ); -if (dev ==NULL ) { -dev_err (&interface->dev,"Out of memory\n" ); +if (!dev) goto error; - } dev->usb_dev =usb_get_dev (interface_to_usbdev (interface)); dev->interface = interface;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 7/201 i2c: Improve size determinations
In reply to Greg Kroah-HartmanFrom: Markus Elfring <[email protected]>
[ Upstream commit 06e989578232da33a7fe96b04191b862af8b2cec ]
Replace the specification of a data structure by a pointer dereference as the parameter for the operator "sizeof" to make the corresponding size determination a bit safer according to the Linux coding style convention.
This issue was detected by using the Coccinelle software.
Stable-dep-of: 05f933d5f731 ("i2c: nomadik: Remove a useless call in the remove function")
--- drivers/i2c/busses/i2c-nomadik.c | 2 +- drivers/i2c/busses/i2c-sh7760.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-nomadik.c +1 -1
@@ -970,7 +970,7 @@ static int nmk_i2c_probe(struct amba_device *adev, const struct amba_id *id)struct i2c_vendor_data *vendor = id->data;u32 max_fifo_threshold = (vendor->fifodepth /2 ) -1 ; - dev =devm_kzalloc (&adev->dev,sizeof (struct nmk_i2c_dev ),GFP_KERNEL ); + dev =devm_kzalloc (&adev->dev,sizeof (*dev),GFP_KERNEL );if (!dev) { ret = -ENOMEM ; goto err_no_mem;
drivers/i2c/busses/i2c-sh7760.c +1 -1
@@ -443,7 +443,7 @@ static int sh7760_i2c_probe(struct platform_device *pdev) goto out0; } - id =kzalloc (sizeof (struct cami2c ),GFP_KERNEL ); + id =kzalloc (sizeof (*id),GFP_KERNEL );if (!id) { ret = -ENOMEM ; goto out0;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 8/201 i2c: nomadik: Remove unnecessary goto label
In reply to Greg Kroah-HartmanFrom: Andi Shyti <[email protected]>
[ Upstream commit 1c5d33fff0d375e4ab7c4261dc62a286babbb4c6 ]
The err_no_mem goto label doesn't do anything. Remove it.
Stable-dep-of: 05f933d5f731 ("i2c: nomadik: Remove a useless call in the remove function")
--- drivers/i2c/busses/i2c-nomadik.c | 21 ++++++++------------- 1 file changed, 8 insertions(+), 13 deletions(-)
drivers/i2c/busses/i2c-nomadik.c +8 -13
@@ -971,10 +971,9 @@ static int nmk_i2c_probe(struct amba_device *adev, const struct amba_id *id)u32 max_fifo_threshold = (vendor->fifodepth /2 ) -1 ; dev =devm_kzalloc (&adev->dev,sizeof (*dev),GFP_KERNEL ); -if (!dev) { - ret = -ENOMEM ; - goto err_no_mem; - } +if (!dev) +return -ENOMEM ; + dev->vendor = vendor; dev->adev = adev;nmk_i2c_of_probe (np, dev);
@@ -995,30 +994,27 @@ static int nmk_i2c_probe(struct amba_device *adev, const struct amba_id *id) dev->virtbase =devm_ioremap (&adev->dev, adev->res.start,resource_size (&adev->res)); -if (!dev->virtbase) { - ret = -ENOMEM ; - goto err_no_mem; - } +if (!dev->virtbase) +return -ENOMEM ; dev->irq = adev->irq[0 ]; ret =devm_request_irq (&adev->dev, dev->irq, i2c_irq_handler,0 ,DRIVER_NAME , dev);if (ret) {dev_err (&adev->dev,"cannot claim the irq %d\n" , dev->irq); - goto err_no_mem; +return ret; } dev->clk =devm_clk_get (&adev->dev,NULL );if (IS_ERR (dev->clk)) {dev_err (&adev->dev,"could not get i2c clock\n" ); - ret =PTR_ERR (dev->clk); - goto err_no_mem; +return PTR_ERR (dev->clk); } ret =clk_prepare_enable (dev->clk);if (ret) {dev_err (&adev->dev,"can't prepare_enable clock\n" ); - goto err_no_mem; +return ret; }init_hw (dev);
@@ -1049,7 +1045,6 @@ static int nmk_i2c_probe(struct amba_device *adev, const struct amba_id *id) err_no_adap:clk_disable_unprepare (dev->clk); - err_no_mem:return ret; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 9/201 i2c: nomadik: Use devm_clk_get_enabled()
In reply to Greg Kroah-HartmanFrom: Andi Shyti <[email protected]>
[ Upstream commit 9c7174db4cdd111e10d19eed5c36fd978a14c8a2 ]
Replace the pair of functions, devm_clk_get() andclk_prepare_enable(), with a single functiondevm_clk_get_enabled().
Stable-dep-of: 05f933d5f731 ("i2c: nomadik: Remove a useless call in the remove function")
--- drivers/i2c/busses/i2c-nomadik.c | 18 +++--------------- 1 file changed, 3 insertions(+), 15 deletions(-)
drivers/i2c/busses/i2c-nomadik.c +3 -15
@@ -1005,18 +1005,12 @@ static int nmk_i2c_probe(struct amba_device *adev, const struct amba_id *id)return ret; } - dev->clk =devm_clk_get (&adev->dev,NULL ); + dev->clk =devm_clk_get_enabled (&adev->dev,NULL );if (IS_ERR (dev->clk)) { -dev_err (&adev->dev,"could not get i2c clock\n" ); +dev_err (&adev->dev,"could enable i2c clock\n" );return PTR_ERR (dev->clk); } - ret =clk_prepare_enable (dev->clk); -if (ret) { -dev_err (&adev->dev,"can't prepare_enable clock\n" ); -return ret; - } -init_hw (dev); adap = &dev->adap;
@@ -1037,16 +1031,11 @@ static int nmk_i2c_probe(struct amba_device *adev, const struct amba_id *id) ret =i2c_add_adapter (adap);if (ret) - goto err_no_adap; +return ret;pm_runtime_put (&adev->dev);return 0 ; - - err_no_adap: -clk_disable_unprepare (dev->clk); - -return ret; }static void nmk_i2c_remove (struct amba_device *adev)
@@ -1060,7 +1049,6 @@ static void nmk_i2c_remove(struct amba_device *adev)clear_all_interrupts (dev);/* disable the controller */ i2c_clr_bit (dev->virtbase +I2C_CR ,I2C_CR_PE ); -clk_disable_unprepare (dev->clk);release_mem_region (res->start,resource_size (res)); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 10/201 i2c: nomadik: Remove a useless call in the remove function
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 05f933d5f7318b03ff2028c1704dc867ac16f2c7 ]
Since commit 235602146ec9 ("i2c-nomadik: turn the platform driver to an amba driver"), there is no more request_mem_region() call in this driver.
So remove the release_mem_region() call from the remove function which is likely a left over.
--- drivers/i2c/busses/i2c-nomadik.c | 2 -- 1 file changed, 2 deletions(-)
drivers/i2c/busses/i2c-nomadik.c +0 -2
@@ -1040,7 +1040,6 @@ static int nmk_i2c_probe(struct amba_device *adev, const struct amba_id *id)static void nmk_i2c_remove (struct amba_device *adev) { -struct resource *res = &adev->res;struct nmk_i2c_dev *dev =amba_get_drvdata (adev);i2c_del_adapter (&dev->adap);
@@ -1049,7 +1048,6 @@ static void nmk_i2c_remove(struct amba_device *adev)clear_all_interrupts (dev);/* disable the controller */ i2c_clr_bit (dev->virtbase +I2C_CR ,I2C_CR_PE ); -release_mem_region (res->start,resource_size (res)); }static struct i2c_vendor_data vendor_stn8815 = {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 11/201 PCI/ASPM: Return 0 or -ETIMEDOUT from pcie_retrain_link()
In reply to Greg Kroah-HartmanFrom: Bjorn Helgaas <[email protected]>
[ Upstream commit f5297a01ee805d7fa569d288ed65fc0f9ac9b03d ]
"pcie_retrain_link" is not a question with a true/false answer, so "bool" isn't quite the right return type. Return 0 for success or -ETIMEDOUT if the retrain failed. No functional change intended.
Stable-dep-of: e7e39756363a ("PCI/ASPM: Avoid link retraining race")
--- drivers/pci/pcie/aspm.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-)
drivers/pci/pcie/aspm.c +11 -9
@@ -192,7 +192,7 @@ static void pcie_clkpm_cap_init(struct pcie_link_state *link, int blacklist) link->clkpm_disable = blacklist ?1 :0 ; } -static bool pcie_retrain_link (struct pcie_link_state *link) +static int pcie_retrain_link (struct pcie_link_state *link) {struct pci_dev *parent = link->pdev;unsigned long end_jiffies;
@@ -219,7 +219,9 @@ static bool pcie_retrain_link(struct pcie_link_state *link)break ;msleep (1 ); }while (time_before (jiffies, end_jiffies)); -return !(reg16 &PCI_EXP_LNKSTA_LT ); +if (reg16 &PCI_EXP_LNKSTA_LT ) +return -ETIMEDOUT ; +return 0 ; }/*
@@ -288,15 +290,15 @@ static void pcie_aspm_configure_common_clock(struct pcie_link_state *link) reg16 &= ~PCI_EXP_LNKCTL_CCC ;pcie_capability_write_word (parent,PCI_EXP_LNKCTL , reg16); -if (pcie_retrain_link (link)) -return ; +if (pcie_retrain_link (link)) { -/* Training failed. Restore common clock configurations */ -pci_err (parent,"ASPM: Could not configure common clock\n" ); -list_for_each_entry (child, &linkbus->devices, bus_list) -pcie_capability_write_word (child,PCI_EXP_LNKCTL , +/* Training failed. Restore common clock configurations */ +pci_err (parent,"ASPM: Could not configure common clock\n" ); +list_for_each_entry (child, &linkbus->devices, bus_list) +pcie_capability_write_word (child,PCI_EXP_LNKCTL , child_reg[PCI_FUNC (child->devfn)]); -pcie_capability_write_word (parent,PCI_EXP_LNKCTL , parent_reg); +pcie_capability_write_word (parent,PCI_EXP_LNKCTL , parent_reg); + } }/* Convert L0s latency encoding to ns */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 12/201 PCI/ASPM: Factor out pcie_wait_for_retrain()
In reply to Greg Kroah-HartmanFrom: Ilpo Järvinen <[email protected]>
[ Upstream commit 9c7f136433d26592cb4d9cd00b4e15c33d9797c6 ]
Factor pcie_wait_for_retrain() out from pcie_retrain_link(). No functional change intended.
[bhelgaas: split out from
https: //lore.kernel.org/r/[email protected]]
Stable-dep-of: e7e39756363a ("PCI/ASPM: Avoid link retraining race")
--- drivers/pci/pcie/aspm.c | 30 ++++++++++++++++++------------ 1 file changed, 18 insertions(+), 12 deletions(-)
drivers/pci/pcie/aspm.c +18 -12
@@ -192,10 +192,26 @@ static void pcie_clkpm_cap_init(struct pcie_link_state *link, int blacklist) link->clkpm_disable = blacklist ?1 :0 ; } +static int pcie_wait_for_retrain (struct pci_dev *pdev) +{ +unsigned long end_jiffies; +u16 reg16; + +/* Wait for Link Training to be cleared by hardware */ + end_jiffies = jiffies +LINK_RETRAIN_TIMEOUT ; +do { +pcie_capability_read_word (pdev,PCI_EXP_LNKSTA , ®16); +if (!(reg16 &PCI_EXP_LNKSTA_LT )) +return 0 ; +msleep (1 ); + }while (time_before (jiffies, end_jiffies)); + +return -ETIMEDOUT ; +} +static int pcie_retrain_link (struct pcie_link_state *link) {struct pci_dev *parent = link->pdev; -unsigned long end_jiffies;u16 reg16;pcie_capability_read_word (parent,PCI_EXP_LNKCTL , ®16);
@@ -211,17 +227,7 @@ static int pcie_retrain_link(struct pcie_link_state *link)pcie_capability_write_word (parent,PCI_EXP_LNKCTL , reg16); } -/* Wait for link training end. Break out after waiting for timeout */ - end_jiffies = jiffies +LINK_RETRAIN_TIMEOUT ; -do { -pcie_capability_read_word (parent,PCI_EXP_LNKSTA , ®16); -if (!(reg16 &PCI_EXP_LNKSTA_LT )) -break ; -msleep (1 ); - }while (time_before (jiffies, end_jiffies)); -if (reg16 &PCI_EXP_LNKSTA_LT ) -return -ETIMEDOUT ; -return 0 ; +return pcie_wait_for_retrain (parent); }/*
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 13/201 PCI/ASPM: Avoid link retraining race
In reply to Greg Kroah-HartmanFrom: Ilpo Järvinen <[email protected]>
[ Upstream commit e7e39756363ad5bd83ddeae1063193d0f13870fd ]
PCIe r6.0.1, sec 7.5.3.7, recommends setting the link control parameters, then waiting for the Link Training bit to be clear before setting the Retrain Link bit.
This avoids a race where the LTSSM may not use the updated parameters if it is already in the midst of link training because of other normal link activity.
Wait for the Link Training bit to be clear before toggling the Retrain Link bit to ensure that the LTSSM uses the updated link control parameters.
[bhelgaas: commit log, return 0 (success)/-ETIMEDOUT instead of bool for both pcie_wait_for_retrain() and the existing pcie_retrain_link()]
--- drivers/pci/pcie/aspm.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/pci/pcie/aspm.c +11 -0
@@ -212,8 +212,19 @@ static int pcie_wait_for_retrain(struct pci_dev *pdev)static int pcie_retrain_link (struct pcie_link_state *link) {struct pci_dev *parent = link->pdev; +int rc;u16 reg16; +/* +* Ensure the updated LNKCTL parameters are used during link +* training by checking that there is no ongoing link training to +* avoid LTSSM race as recommended in Implementation Note at the +* end of PCIe r6.0.1 sec 7.5.3.7. +*/ + rc =pcie_wait_for_retrain (parent); +if (rc) +return rc; +pcie_capability_read_word (parent,PCI_EXP_LNKCTL , ®16); reg16 |=PCI_EXP_LNKCTL_RL ;pcie_capability_write_word (parent,PCI_EXP_LNKCTL , reg16);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 14/201 dlm: cleanup plock_op vs plock_xop
In reply to Greg Kroah-HartmanFrom: Alexander Aring <[email protected]>
[ Upstream commit bcbb4ba6c9ba81e6975b642a2cade68044cd8a66 ]
Lately the different casting between plock_op and plock_xop and list holders which was involved showed some issues which were hard to see. This patch removes the "plock_xop" structure and introduces a "struct plock_async_data". This structure will be set in "struct plock_op" in case of asynchronous lock handling as the original "plock_xop" was made for. There is no need anymore to cast pointers around for additional fields in case of asynchronous lock handling. As disadvantage another allocation was introduces but only needed in the asynchronous case which is currently only used in combination with nfs lockd.
Stable-dep-of: 59e45c758ca1 ("fs: dlm: interrupt posix locks only when process is killed")
--- fs/dlm/plock.c | 77 ++++++++++++++++++++++++++++++-------------------- 1 file changed, 46 insertions(+), 31 deletions(-)
fs/dlm/plock.c +46 -31
@@ -19,20 +19,20 @@ static struct list_head recv_list;static wait_queue_head_t send_wq;static wait_queue_head_t recv_wq; -struct plock_op { -struct list_head list; -int done; -struct dlm_plock_info info; -int (*callback)(struct file_lock *fl,int result); -}; - -struct plock_xop { -struct plock_op xop; +struct plock_async_data {void *fl;void *file;struct file_lock flc; +int (*callback)(struct file_lock *fl,int result); }; +struct plock_op { +struct list_head list; +int done; +struct dlm_plock_info info; +/* if set indicates async handling */ +struct plock_async_data *data; +};static inline void set_version (struct dlm_plock_info *info) {
@@ -58,6 +58,12 @@ static int check_version(struct dlm_plock_info *info)return 0 ; } +static void dlm_release_plock_op (struct plock_op *op) +{ +kfree (op->data); +kfree (op); +} +static void send_op (struct plock_op *op) {set_version (&op->info);
@@ -101,22 +107,21 @@ static void do_unlock_close(struct dlm_ls *ls, u64 number,int dlm_posix_lock (dlm_lockspace_t *lockspace,u64 number,struct file *file,int cmd,struct file_lock *fl) { +struct plock_async_data *op_data;struct dlm_ls *ls;struct plock_op *op; -struct plock_xop *xop;int rv; ls =dlm_find_lockspace_local (lockspace);if (!ls)return -EINVAL ; - xop =kzalloc (sizeof (*xop),GFP_NOFS ); -if (!xop) { + op =kzalloc (sizeof (*op),GFP_NOFS ); +if (!op) { rv = -ENOMEM ; goto out; } - op = &xop->xop; op->info.optype =DLM_PLOCK_OP_LOCK ; op->info.pid = fl->fl_pid; op->info.ex = (fl->fl_type ==F_WRLCK );
@@ -125,22 +130,32 @@ int dlm_posix_lock(dlm_lockspace_t *lockspace, u64 number, struct file *file, op->info.number = number; op->info.start = fl->fl_start; op->info.end = fl->fl_end; +/* async handling */ if (fl->fl_lmops && fl->fl_lmops->lm_grant) { + op_data =kzalloc (sizeof (*op_data),GFP_NOFS ); +if (!op_data) { +dlm_release_plock_op (op); + rv = -ENOMEM ; + goto out; + } +/* fl_owner is lockd which doesn't distinguish processes on the nfs client */ op->info.owner = (__u64 ) fl->fl_pid; - op->callback = fl->fl_lmops->lm_grant; -locks_init_lock (&xop->flc); -locks_copy_lock (&xop->flc, fl); - xop->fl = fl; - xop->file = file; + op_data->callback = fl->fl_lmops->lm_grant; +locks_init_lock (&op_data->flc); +locks_copy_lock (&op_data->flc, fl); + op_data->fl = fl; + op_data->file = file; + + op->data = op_data; }else { op->info.owner = (__u64 )(long ) fl->fl_owner; }send_op (op); -if (!op->callback) { +if (!op->data) { rv =wait_event_interruptible (recv_wq, (op->done !=0 ));if (rv == -ERESTARTSYS ) { log_debug(ls, "dlm_posix_lock: wait killed %llx",
@@ -148,7 +163,7 @@ int dlm_posix_lock(dlm_lockspace_t *lockspace, u64 number, struct file *file,spin_lock (&ops_lock);list_del (&op->list);spin_unlock (&ops_lock); -kfree (xop); +dlm_release_plock_op (op);do_unlock_close (ls, number, file, fl); goto out; }
@@ -173,7 +188,7 @@ int dlm_posix_lock(dlm_lockspace_t *lockspace, u64 number, struct file *file, (unsigned long long)number); } -kfree (xop); +dlm_release_plock_op (op); out:dlm_put_lockspace (ls);return rv;
@@ -183,11 +198,11 @@ EXPORT_SYMBOL_GPL(dlm_posix_lock);/* Returns failure iff a successful lock operation should be canceled */ static int dlm_plock_callback (struct plock_op *op) { +struct plock_async_data *op_data = op->data;struct file *file;struct file_lock *fl;struct file_lock *flc;int (*notify)(struct file_lock *fl,int result) =NULL ; -struct plock_xop *xop = (struct plock_xop *)op;int rv =0 ;spin_lock (&ops_lock);
@@ -199,10 +214,10 @@ static int dlm_plock_callback(struct plock_op *op)spin_unlock (&ops_lock);/* check if the following 2 are still valid or make a copy */ - file = xop->file; - flc = &xop->flc; - fl = xop->fl; - notify = op->callback; + file = op_data->file; + flc = &op_data->flc; + fl = op_data->fl; + notify = op_data->callback;if (op->info.rv) {notify (fl, op->info.rv);
@@ -233,7 +248,7 @@ static int dlm_plock_callback(struct plock_op *op) } out: -kfree (xop); +dlm_release_plock_op (op);return rv; }
@@ -303,7 +318,7 @@ int dlm_posix_unlock(dlm_lockspace_t *lockspace, u64 number, struct file *file, rv =0 ; out_free: -kfree (op); +dlm_release_plock_op (op); out:dlm_put_lockspace (ls); fl->fl_flags = fl_flags;
@@ -371,7 +386,7 @@ int dlm_posix_get(dlm_lockspace_t *lockspace, u64 number, struct file *file, rv =0 ; } -kfree (op); +dlm_release_plock_op (op); out:dlm_put_lockspace (ls);return rv;
@@ -407,7 +422,7 @@ static ssize_t dev_read(struct file *file, char __user *u, size_t count,(the process did not make an unlock call). */ if (op->info.flags &DLM_PLOCK_FL_CLOSE ) -kfree (op); +dlm_release_plock_op (op);if (copy_to_user (u, &info,sizeof (info)))return -EFAULT ;
@@ -439,7 +454,7 @@ static ssize_t dev_write(struct file *file, const char __user *u, size_t count, op->info.owner == info.owner) {list_del_init (&op->list);memcpy (&op->info, &info,sizeof (info)); -if (op->callback) +if (op->data) do_callback =1 ;else op->done =1 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 15/201 dlm: rearrange async condition return
In reply to Greg Kroah-HartmanFrom: Alexander Aring <[email protected]>
[ Upstream commit a800ba77fd285c6391a82819867ac64e9ab3af46 ]
This patch moves the return of FILE_LOCK_DEFERRED a little bit earlier than checking afterwards again if the request was an asynchronous request.
Stable-dep-of: 59e45c758ca1 ("fs: dlm: interrupt posix locks only when process is killed")
--- fs/dlm/plock.c | 27 +++++++++++++-------------- 1 file changed, 13 insertions(+), 14 deletions(-)
fs/dlm/plock.c +13 -14
@@ -149,26 +149,25 @@ int dlm_posix_lock(dlm_lockspace_t *lockspace, u64 number, struct file *file, op_data->file = file; op->data = op_data; + +send_op (op); + rv =FILE_LOCK_DEFERRED ; + goto out; }else { op->info.owner = (__u64 )(long ) fl->fl_owner; }send_op (op); -if (!op->data) { - rv =wait_event_interruptible (recv_wq, (op->done !=0 )); -if (rv == -ERESTARTSYS ) { -log_debug (ls,"dlm_posix_lock: wait killed %llx" , - (unsigned long long )number); -spin_lock (&ops_lock); -list_del (&op->list); -spin_unlock (&ops_lock); -dlm_release_plock_op (op); -do_unlock_close (ls, number, file, fl); - goto out; - } - }else { - rv =FILE_LOCK_DEFERRED ; + rv =wait_event_interruptible (recv_wq, (op->done !=0 )); +if (rv == -ERESTARTSYS ) { +log_debug (ls,"%s: wait killed %llx" , __func__, + (unsigned long long )number); +spin_lock (&ops_lock); +list_del (&op->list); +spin_unlock (&ops_lock); +dlm_release_plock_op (op); +do_unlock_close (ls, number, file, fl); goto out; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 16/201 fs: dlm: interrupt posix locks only when process is killed
In reply to Greg Kroah-HartmanFrom: Alexander Aring <[email protected]>
[ Upstream commit 59e45c758ca1b9893ac923dd63536da946ac333b ]
If a posix lock request is waiting for a result from user space (dlm_controld), do not let it be interrupted unless the process is killed. This reverts commit a6b1533e9a57 ("dlm: make posix locks interruptible"). The problem with the interruptible change is that all locks were cleared on any signal interrupt. If a signal was received that did not terminate the process, the process could continue running after all its dlm posix locks had been cleared. A future patch will add cancelation to allow proper interruption.
--- fs/dlm/plock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/dlm/plock.c +1 -1
@@ -159,7 +159,7 @@ int dlm_posix_lock(dlm_lockspace_t *lockspace, u64 number, struct file *file,send_op (op); - rv =wait_event_interruptible (recv_wq, (op->done !=0 )); + rv =wait_event_killable (recv_wq, (op->done !=0 ));if (rv == -ERESTARTSYS ) {log_debug (ls,"%s: wait killed %llx" , __func__, (unsigned long long )number);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 17/201 drm/ttm: add ttm_bo_pin()/ttm_bo_unpin() v2
In reply to Greg Kroah-HartmanFrom: Christian König <[email protected]>
[ Upstream commit deb0814b43f370a448a498409d949e38c9d8f02e ]
As an alternative to the placement flag add a
pin count to the ttm buffer object.
v2: add dma_resv_assert_help() calls
Stable-dep-of: a2848d08742c ("drm/ttm: never consider pinned BOs for eviction&swap")
--- drivers/gpu/drm/ttm/ttm_bo.c | 9 ++++++--- drivers/gpu/drm/ttm/ttm_bo_util.c | 2 +- include/drm/ttm/ttm_bo_api.h | 26 ++++++++++++++++++++++++++ 3 files changed, 33 insertions(+), 4 deletions(-)
drivers/gpu/drm/ttm/ttm_bo.c +6 -3
@@ -115,7 +115,7 @@ static void ttm_bo_add_mem_to_lru(struct ttm_buffer_object *bo,struct ttm_bo_device *bdev = bo->bdev;struct ttm_resource_manager *man; -if (!list_empty (&bo->lru)) +if (!list_empty (&bo->lru) || bo->pin_count)return ;if (mem->placement &TTM_PL_FLAG_NO_EVICT )
@@ -165,7 +165,8 @@ void ttm_bo_move_to_lru_tail(struct ttm_buffer_object *bo,ttm_bo_del_from_lru (bo);ttm_bo_add_mem_to_lru (bo, &bo->mem); -if (bulk && !(bo->mem.placement &TTM_PL_FLAG_NO_EVICT )) { +if (bulk && !(bo->mem.placement &TTM_PL_FLAG_NO_EVICT ) && + !bo->pin_count) {switch (bo->mem.mem_type) {case TTM_PL_TT :ttm_bo_bulk_move_set_pos (&bulk->tt[bo->priority], bo);
@@ -544,8 +545,9 @@ static void ttm_bo_release(struct kref *kref)* shrinkers, now that they are queued for * destruction. */ -if (bo->mem.placement &TTM_PL_FLAG_NO_EVICT ) { +if (bo->mem.placement &TTM_PL_FLAG_NO_EVICT || bo->pin_count) { bo->mem.placement &= ~TTM_PL_FLAG_NO_EVICT ; + bo->pin_count =0 ;ttm_bo_del_from_lru (bo);ttm_bo_add_mem_to_lru (bo, &bo->mem); }
@@ -1174,6 +1176,7 @@ int ttm_bo_init_reserved(struct ttm_bo_device *bdev, bo->moving =NULL ; bo->mem.placement =TTM_PL_FLAG_CACHED ; bo->acc_size = acc_size; + bo->pin_count =0 ; bo->sg = sg;if (resv) { bo->base.resv = resv;
drivers/gpu/drm/ttm/ttm_bo_util.c +1 -1
@@ -352,7 +352,6 @@ static int ttm_buffer_object_transfer(struct ttm_buffer_object *bo,return -ENOMEM ; fbo->base = *bo; - fbo->base.mem.placement |=TTM_PL_FLAG_NO_EVICT ;ttm_bo_get (bo); fbo->bo = bo;
@@ -372,6 +371,7 @@ static int ttm_buffer_object_transfer(struct ttm_buffer_object *bo,kref_init (&fbo->base.kref); fbo->base.destroy = &ttm_transfered_destroy; fbo->base.acc_size =0 ; + fbo->base.pin_count =1 ;if (bo->type != ttm_bo_type_sg) fbo->base.base.resv = &fbo->base.base._resv;
include/drm/ttm/ttm_bo_api.h +26 -0
@@ -157,6 +157,7 @@ struct ttm_buffer_object {struct dma_fence *moving;unsigned priority; +unsigned pin_count;/** * Special members that are protected by the reserve lock
@@ -606,6 +607,31 @@ static inline bool ttm_bo_uses_embedded_gem_object(struct ttm_buffer_object *bo)return bo->base.dev !=NULL ; } +/** +* ttm_bo_pin - Pin the buffer object. +* @bo: The buffer object to pin +* +* Make sure the buffer is not evicted any more during memory pressure. +*/ +static inline void ttm_bo_pin (struct ttm_buffer_object *bo) +{ +dma_resv_assert_held (bo->base.resv); + ++bo->pin_count; +} + +/** +* ttm_bo_unpin - Unpin the buffer object. +* @bo: The buffer object to unpin +* +* Allows the buffer object to be evicted again during memory pressure. +*/ +static inline void ttm_bo_unpin (struct ttm_buffer_object *bo) +{ +dma_resv_assert_held (bo->base.resv); +WARN_ON_ONCE (!bo->pin_count); + --bo->pin_count; +} + int ttm_mem_evict_first(struct ttm_bo_device *bdev, struct ttm_resource_manager *man, const struct ttm_place *place,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 18/201 drm/ttm: never consider pinned BOs for eviction&swap
In reply to Greg Kroah-HartmanFrom: Christian König <[email protected]>
[ Upstream commit a2848d08742c8e8494675892c02c0d22acbe3cf8 ]
There is a small window where we have already incremented the pin count but not yet moved the bo from the lru to the pinned list.
--- drivers/gpu/drm/ttm/ttm_bo.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/ttm/ttm_bo.c +6 -0
@@ -672,6 +672,12 @@ static bool ttm_bo_evict_swapout_allowable(struct ttm_buffer_object *bo, {bool ret = false; +if (bo->pin_count) { + *locked = false; + *busy = false; +return false; + } +if (bo->base.resv == ctx->resv) {dma_resv_assert_held (bo->base.resv);if (ctx->flags &TTM_OPT_FLAG_ALLOW_RES_EVICT )
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 19/201 tracing: Show real address for trace event arguments
In reply to Greg Kroah-HartmanFrom: Masami Hiramatsu <[email protected]>
[ Upstream commit efbbdaa22bb78761bff8dfdde027ad04bedd47ce ]
To help debugging kernel, show real address for trace event arguments in tracefs/trace{,pipe} instead of hashed pointer value.
Since ftrace human-readable format uses vsprintf(), all %p are translated to hash values instead of pointer address.
However, when debugging the kernel, raw address value gives a hint when comparing with the memory mapping in the kernel. (Those are sometimes used with crash log, which is not hashed too) So converting %p with %px when calling trace_seq_printf().
Moreover, this is not improving the security because the tracefs can be used only by root user and the raw address values are readable from tracefs/percpu/cpu*/trace_pipe_raw file.
Stable-dep-of: d5a821896360 ("tracing: Fix memory leak of iter->temp when reading trace_pipe")
--- include/linux/trace_events.h | 4 ++ include/trace/trace_events.h | 2 +- kernel/trace/trace.c | 71 +++++++++++++++++++++++++++++++++++- kernel/trace/trace.h | 2 + kernel/trace/trace_output.c | 12 +++++- 5 files changed, 88 insertions(+), 3 deletions(-)
include/linux/trace_events.h +4 -0
@@ -55,6 +55,8 @@ struct trace_event;int trace_raw_output_prep (struct trace_iterator *iter,struct trace_event *event); +extern __printf(2, 3) +void trace_event_printf(struct trace_iterator *iter, const char *fmt, ...); /* * The trace entry - the most basic unit of tracing. This is what
@@ -87,6 +89,8 @@ struct trace_iterator {unsigned long iter_flags;void *temp;/* temp holder */ unsigned int temp_size; +char *fmt;/* modified format holder */ +unsigned int fmt_size;/* trace_seq for __print_flags() and __print_symbolic() etc. */ struct trace_seq tmp_seq;
include/trace/trace_events.h +1 -1
@@ -364,7 +364,7 @@ trace_raw_output_##call(struct trace_iterator *iter, int flags, \if (ret !=TRACE_TYPE_HANDLED ) \return ret; \ \ -trace_seq_printf (s, print); \ +trace_event_printf (iter, print); \ \return trace_handle_return (s); \ } \
kernel/trace/trace.c +70 -1
97 lines not on this page · raw message
kernel/trace/trace.h +2 -0
@@ -758,6 +758,8 @@ struct trace_entry *trace_find_next_entry(struct trace_iterator *iter,void trace_buffer_unlock_commit_nostack (struct trace_buffer *buffer,struct ring_buffer_event *event); +const char *trace_event_format (struct trace_iterator *iter,const char *fmt); +int trace_empty (struct trace_iterator *iter);void *trace_find_next_entry_inc (struct trace_iterator *iter);
kernel/trace/trace_output.c +11 -1
@@ -312,13 +312,23 @@ int trace_raw_output_prep(struct trace_iterator *iter, }EXPORT_SYMBOL (trace_raw_output_prep); +void trace_event_printf (struct trace_iterator *iter,const char *fmt, ...) +{ +va_list ap; + +va_start (ap, fmt); +trace_seq_vprintf (&iter->seq,trace_event_format (iter, fmt), ap); +va_end (ap); +} +EXPORT_SYMBOL (trace_event_printf); +static int trace_output_raw (struct trace_iterator *iter,char *name,char *fmt,va_list ap) {struct trace_seq *s = &iter->seq;trace_seq_printf (s,"%s: " , name); -trace_seq_vprintf (s, fmt, ap); +trace_seq_vprintf (s,trace_event_format (iter, fmt), ap);return trace_handle_return (s); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 20/201 pwm: meson: Simplify duplicated per-channel tracking
In reply to Greg Kroah-HartmanFrom: Uwe Kleine-König <[email protected]>
[ Upstream commit 5f97f18feac9bd5a8163b108aee52d783114b36f ]
The driver tracks per-channel data via struct pwm_device::chip_data and struct meson_pwm::channels[]. The latter holds the actual data, the former is only a pointer to the latter. So simplify by using struct meson_pwm::channels[] consistently.
Stable-dep-of: 87a2cbf02d77 ("pwm: meson: fix handling of period/duty if greater than UINT_MAX")
--- drivers/pwm/pwm-meson.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/pwm/pwm-meson.c +6 -5
@@ -147,12 +147,13 @@ static int meson_pwm_request(struct pwm_chip *chip, struct pwm_device *pwm)return err; } -return pwm_set_chip_data (pwm, channel); +return 0 ; }static void meson_pwm_free (struct pwm_chip *chip,struct pwm_device *pwm) { -struct meson_pwm_channel *channel =pwm_get_chip_data (pwm); +struct meson_pwm *meson =to_meson_pwm (chip); +struct meson_pwm_channel *channel = &meson->channels[pwm->hwpwm];if (channel)clk_disable_unprepare (channel->clk);
@@ -161,7 +162,7 @@ static void meson_pwm_free(struct pwm_chip *chip, struct pwm_device *pwm)static int meson_pwm_calc (struct meson_pwm *meson,struct pwm_device *pwm,const struct pwm_state *state) { -struct meson_pwm_channel *channel =pwm_get_chip_data (pwm); +struct meson_pwm_channel *channel = &meson->channels[pwm->hwpwm];unsigned int duty, period, pre_div, cnt, duty_cnt;unsigned long fin_freq;
@@ -230,7 +231,7 @@ static int meson_pwm_calc(struct meson_pwm *meson, struct pwm_device *pwm,static void meson_pwm_enable (struct meson_pwm *meson,struct pwm_device *pwm) { -struct meson_pwm_channel *channel =pwm_get_chip_data (pwm); +struct meson_pwm_channel *channel = &meson->channels[pwm->hwpwm];struct meson_pwm_channel_data *channel_data;unsigned long flags;u32 value;
@@ -273,8 +274,8 @@ static void meson_pwm_disable(struct meson_pwm *meson, struct pwm_device *pwm)static int meson_pwm_apply (struct pwm_chip *chip,struct pwm_device *pwm,const struct pwm_state *state) { -struct meson_pwm_channel *channel =pwm_get_chip_data (pwm);struct meson_pwm *meson =to_meson_pwm (chip); +struct meson_pwm_channel *channel = &meson->channels[pwm->hwpwm];int err =0 ;if (!state)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 21/201 pwm: meson: fix handling of period/duty if greater than UINT_MAX
In reply to Greg Kroah-HartmanFrom: Heiner Kallweit <[email protected]>
[ Upstream commit 87a2cbf02d7701255f9fcca7e5bd864a7bb397cf ]
state->period/duty are of type u64, and if their value is greater than UINT_MAX, then the cast to uint will cause problems. Fix this by changing the type of the respective local variables to u64.
--- drivers/pwm/pwm-meson.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/pwm/pwm-meson.c +7 -7
@@ -163,8 +163,9 @@ static int meson_pwm_calc(struct meson_pwm *meson, struct pwm_device *pwm, const struct pwm_state *state) {struct meson_pwm_channel *channel = &meson->channels[pwm->hwpwm]; -unsigned int duty, period, pre_div, cnt, duty_cnt; +unsigned int pre_div, cnt, duty_cnt;unsigned long fin_freq; +u64 duty, period; duty = state->duty_cycle; period = state->period;
@@ -186,19 +187,19 @@ static int meson_pwm_calc(struct meson_pwm *meson, struct pwm_device *pwm,dev_dbg (meson->chip.dev,"fin_freq: %lu Hz\n" , fin_freq); - pre_div =div64_u64 (fin_freq * (u64 )period,NSEC_PER_SEC *0xffffLL ); + pre_div =div64_u64 (fin_freq * period,NSEC_PER_SEC *0xffffLL );if (pre_div >MISC_CLK_DIV_MASK ) {dev_err (meson->chip.dev,"unable to get period pre_div\n" );return -EINVAL ; } - cnt =div64_u64 (fin_freq * (u64 )period,NSEC_PER_SEC * (pre_div +1 )); + cnt =div64_u64 (fin_freq * period,NSEC_PER_SEC * (pre_div +1 ));if (cnt >0xffff ) {dev_err (meson->chip.dev,"unable to get period cnt\n" );return -EINVAL ; } -dev_dbg (meson->chip.dev,"period=%u pre_div=%u cnt=%u\n" , period, +dev_dbg (meson->chip.dev,"period=%llu pre_div=%u cnt=%u\n" , period, pre_div, cnt);if (duty == period) {
@@ -211,14 +212,13 @@ static int meson_pwm_calc(struct meson_pwm *meson, struct pwm_device *pwm, channel->lo = cnt; }else {/* Then check is we can have the duty with the same pre_div */ - duty_cnt =div64_u64 (fin_freq * (u64 )duty, -NSEC_PER_SEC * (pre_div +1 )); + duty_cnt =div64_u64 (fin_freq * duty,NSEC_PER_SEC * (pre_div +1 ));if (duty_cnt >0xffff ) {dev_err (meson->chip.dev,"unable to get duty cycle\n" );return -EINVAL ; } -dev_dbg (meson->chip.dev,"duty=%u pre_div=%u duty_cnt=%u\n" , +dev_dbg (meson->chip.dev,"duty=%llu pre_div=%u duty_cnt=%u\n" , duty, pre_div, duty_cnt); channel->pre_div = pre_div;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 22/201 ext4: fix to check return value of freeze_bdev() in ext4_shutdown()
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit c4d13222afd8a64bf11bc7ec68645496ee8b54b9 ]
freeze_bdev() can fail due to a lot of reasons, it needs to check its reason before later process.
--- fs/ext4/ioctl.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/ext4/ioctl.c +4 -1
@@ -612,6 +612,7 @@ static int ext4_shutdown(struct super_block *sb, unsigned long arg) {struct ext4_sb_info *sbi =EXT4_SB (sb);__u32 flags; +struct super_block *ret;if (!capable (CAP_SYS_ADMIN ))return -EPERM ;
@@ -630,7 +631,9 @@ static int ext4_shutdown(struct super_block *sb, unsigned long arg)switch (flags) {case EXT4_GOING_FLAGS_DEFAULT : -freeze_bdev (sb->s_bdev); + ret =freeze_bdev (sb->s_bdev); +if (IS_ERR (ret)) +return PTR_ERR (ret);set_bit (EXT4_FLAGS_SHUTDOWN , &sbi->s_ext4_flags);thaw_bdev (sb->s_bdev, sb);break ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 23/201 phy: qcom-snps: Use dev_err_probe() to simplify code
In reply to Greg Kroah-HartmanFrom: Yuan Can <[email protected]>
[ Upstream commit 668dc8afce43d4bc01feb3e929d6d5ffcb14f899 ]
In the probe path, dev_err() can be replaced with dev_err_probe() which will check if error code is -EPROBE_DEFER and prints the error name. It also sets the defer probe reason which can be checked later through debugfs.
Stable-dep-of: 8a0eb8f9b9a0 ("phy: qcom-snps-femto-v2: properly enable ref clock")
--- drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-)
drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c +6 -12
@@ -304,12 +304,9 @@ static int qcom_snps_hsphy_probe(struct platform_device *pdev)return PTR_ERR (hsphy->base); hsphy->ref_clk =devm_clk_get (dev,"ref" ); -if (IS_ERR (hsphy->ref_clk)) { - ret =PTR_ERR (hsphy->ref_clk); -if (ret != -EPROBE_DEFER ) -dev_err (dev,"failed to get ref clk, %d\n" , ret); -return ret; - } +if (IS_ERR (hsphy->ref_clk)) +return dev_err_probe (dev,PTR_ERR (hsphy->ref_clk), +"failed to get ref clk\n" ); hsphy->phy_reset =devm_reset_control_get_exclusive (&pdev->dev,NULL );if (IS_ERR (hsphy->phy_reset)) {
@@ -322,12 +319,9 @@ static int qcom_snps_hsphy_probe(struct platform_device *pdev) hsphy->vregs[i].supply = qcom_snps_hsphy_vreg_names[i]; ret =devm_regulator_bulk_get (dev, num, hsphy->vregs); -if (ret) { -if (ret != -EPROBE_DEFER ) -dev_err (dev,"failed to get regulator supplies: %d\n" , - ret); -return ret; - } +if (ret) +return dev_err_probe (dev, ret, +"failed to get regulator supplies\n" );pm_runtime_set_active (dev);pm_runtime_enable (dev);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 24/201 phy: qcom-snps: correct struct qcom_snps_hsphy kerneldoc
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 2a881183dc5ab2474ef602e48fe7af34db460d95 ]
Update kerneldoc of struct qcom_snps_hsphy to fix:
drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c:135: warning: Function parameter or member 'update_seq_cfg' not described in 'qcom_snps_hsphy'
Stable-dep-of: 8a0eb8f9b9a0 ("phy: qcom-snps-femto-v2: properly enable ref clock")
--- drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c +1 -1
@@ -73,11 +73,11 @@ static const char * const qcom_snps_hsphy_vreg_names[] = {* * @cfg_ahb_clk: AHB2PHY interface clock * @ref_clk: phy reference clock -* @iface_clk: phy interface clock * @phy_reset: phy reset control * @vregs: regulator supplies bulk data * @phy_initialized: if PHY has been initialized correctly * @mode: contains the current mode the PHY is in +* @update_seq_cfg: tuning parameters for phy init */ struct qcom_snps_hsphy {struct phy *phy;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 25/201 phy: qcom-snps-femto-v2: keep cfg_ahb_clk enabled during runtime suspend
In reply to Greg Kroah-HartmanFrom: Adrien Thierry <[email protected]>
[ Upstream commit 45d89a344eb46db9dce851c28e14f5e3c635c251 ]
In the dwc3 core, both system and runtime suspend end up calling dwc3_suspend_common(). From there, what happens for the PHYs depends on the USB mode and whether the controller is entering system or runtime suspend.
HOST mode:
(1) system suspend on a non-wakeup-capable controller
The [1] if branch is taken. dwc3_core_exit() is called, which ends up calling phy_power_off() and phy_exit(). Those two functions decrease the PM runtime count at some point, so they will trigger the PHY runtime sleep (assuming the count is right).
(2) runtime suspend / system suspend on a wakeup-capable controller
The [1] branch is not taken. dwc3_suspend_common() calls phy_pm_runtime_put_sync(). Assuming the ref count is right, the PHY runtime suspend op is called.
DEVICE mode:
dwc3_core_exit() is called on both runtime and system sleep unless the controller is already runtime suspended.
OTG mode:
(1) system suspend : dwc3_core_exit() is called
(2) runtime suspend : do nothing
In host mode, the code seems to make a distinction between 1) runtime sleep / system sleep for wakeup-capable controller, and 2) system sleep for non-wakeup-capable controller, where phy_power_off() and phy_exit() are only called for the latter. This suggests the PHY is not supposed to be in a fully powered-off state for runtime sleep and system sleep for wakeup-capable controller.
Moreover, downstream, cfg_ahb_clk only gets disabled for system suspend. The clocks are disabled by phy->set_suspend() [2] which is only called in the system sleep path through dwc3_core_exit() [3].
With that in mind, don't disable the clocks during the femto PHY runtime suspend callback. The clocks will only be disabled during system suspend for non-wakeup-capable controllers, through dwc3_core_exit().
[1] https://elixir.bootlin.com/linux/v6.4/source/drivers/usb/dwc3/core.c#L1988
[2] https://git.codelinaro.org/clo/la/kernel/msm-5.4/-/blob/LV.AU.1.2.1.r2-05300-gen3meta.0/drivers/usb/phy/phy-msm-snps-hs.c#L524
[3] https://git.codelinaro.org/clo/la/kernel/msm-5.4/-/blob/LV.AU.1.2.1.r2-05300-gen3meta.0/drivers/usb/dwc3/core.c#L1915
Stable-dep-of: 8a0eb8f9b9a0 ("phy: qcom-snps-femto-v2: properly enable ref clock")
--- drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 9 --------- 1 file changed, 9 deletions(-)
drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c +0 -9
@@ -122,22 +122,13 @@ static int qcom_snps_hsphy_suspend(struct qcom_snps_hsphy *hsphy) 0, USB2_AUTO_RESUME); } -clk_disable_unprepare (hsphy->cfg_ahb_clk);return 0 ; }static int qcom_snps_hsphy_resume (struct qcom_snps_hsphy *hsphy) { -int ret; -dev_dbg (&hsphy->phy->dev,"Resume QCOM SNPS PHY, mode\n" ); - ret =clk_prepare_enable (hsphy->cfg_ahb_clk); -if (ret) { -dev_err (&hsphy->phy->dev,"failed to enable cfg ahb clock\n" ); -return ret; - } -return 0 ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 26/201 phy: qcom-snps-femto-v2: properly enable ref clock
In reply to Greg Kroah-HartmanFrom: Adrien Thierry <[email protected]>
[ Upstream commit 8a0eb8f9b9a002291a3934acfd913660b905249e ]
The driver is not enabling the ref clock, which thus gets disabled by the clk_disable_unused() initcall. This leads to the dwc3 controller failing to initialize if probed after clk_disable_unused() is called, for instance when the driver is built as a module.
To fix this, switch to the clk_bulk API to handle both cfg_ahb and ref clocks at the proper places.
Note that the cfg_ahb clock is currently not used by any device tree instantiation of the PHY. Work needs to be done separately to fix this.
--- drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 63 ++++++++++++++----- 1 file changed, 48 insertions(+), 15 deletions(-)
drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c +48 -15
@@ -68,11 +68,13 @@ static const char * const qcom_snps_hsphy_vreg_names[] = {/** * struct qcom_snps_hsphy - snps hs phy attributes * +* @dev: device structure +* * @phy: generic phy * @base: iomapped memory space for snps hs phy * -* @cfg_ahb_clk: AHB2PHY interface clock -* @ref_clk: phy reference clock +* @num_clks: number of clocks +* @clks: array of clocks * @phy_reset: phy reset control * @vregs: regulator supplies bulk data * @phy_initialized: if PHY has been initialized correctly
@@ -80,11 +82,13 @@ static const char * const qcom_snps_hsphy_vreg_names[] = {* @update_seq_cfg: tuning parameters for phy init */ struct qcom_snps_hsphy { +struct device *dev; +struct phy *phy;void __iomem *base; -struct clk *cfg_ahb_clk; -struct clk *ref_clk; +int num_clks; +struct clk_bulk_data *clks;struct reset_control *phy_reset;struct regulator_bulk_data vregs[SNPS_HS_NUM_VREGS ];
@@ -92,6 +96,34 @@ struct qcom_snps_hsphy {enum phy_mode mode; }; +static int qcom_snps_hsphy_clk_init (struct qcom_snps_hsphy *hsphy) +{ +struct device *dev = hsphy->dev; + + hsphy->num_clks =2 ; + hsphy->clks =devm_kcalloc (dev, hsphy->num_clks,sizeof (*hsphy->clks),GFP_KERNEL ); +if (!hsphy->clks) +return -ENOMEM ; + +/* +* TODO: Currently no device tree instantiation of the PHY is using the clock. +* This needs to be fixed in order for this code to be able to use devm_clk_bulk_get(). +*/ + hsphy->clks[0 ].id ="cfg_ahb" ; + hsphy->clks[0 ].clk =devm_clk_get_optional (dev,"cfg_ahb" ); +if (IS_ERR (hsphy->clks[0 ].clk)) +return dev_err_probe (dev,PTR_ERR (hsphy->clks[0 ].clk), +"failed to get cfg_ahb clk\n" ); + + hsphy->clks[1 ].id ="ref" ; + hsphy->clks[1 ].clk =devm_clk_get (dev,"ref" ); +if (IS_ERR (hsphy->clks[1 ].clk)) +return dev_err_probe (dev,PTR_ERR (hsphy->clks[1 ].clk), +"failed to get ref clk\n" ); + +return 0 ; +} +static inline void qcom_snps_hsphy_write_mask (void __iomem *base,u32 offset,u32 mask,u32 val) {
@@ -174,16 +206,16 @@ static int qcom_snps_hsphy_init(struct phy *phy)if (ret)return ret; - ret =clk_prepare_enable (hsphy->cfg_ahb_clk); + ret =clk_bulk_prepare_enable (hsphy->num_clks, hsphy->clks);if (ret) { -dev_err (&phy->dev,"failed to enable cfg ahb clock, %d\n" , ret); +dev_err (&phy->dev,"failed to enable clocks, %d\n" , ret); goto poweroff_phy; } ret =reset_control_assert (hsphy->phy_reset);if (ret) {dev_err (&phy->dev,"failed to assert phy_reset, %d\n" , ret); - goto disable_ahb_clk; + goto disable_clks; }usleep_range (100 ,150 );
@@ -191,7 +223,7 @@ static int qcom_snps_hsphy_init(struct phy *phy) ret =reset_control_deassert (hsphy->phy_reset);if (ret) {dev_err (&phy->dev,"failed to de-assert phy_reset, %d\n" , ret); - goto disable_ahb_clk; + goto disable_clks; } qcom_snps_hsphy_write_mask(hsphy->base, USB2_PHY_USB_PHY_CFG0,
@@ -237,8 +269,8 @@ static int qcom_snps_hsphy_init(struct phy *phy)return 0 ; -disable_ahb_clk: -clk_disable_unprepare (hsphy->cfg_ahb_clk); +disable_clks: +clk_bulk_disable_unprepare (hsphy->num_clks, hsphy->clks); poweroff_phy:regulator_bulk_disable (ARRAY_SIZE (hsphy->vregs), hsphy->vregs);
@@ -250,7 +282,7 @@ static int qcom_snps_hsphy_exit(struct phy *phy)struct qcom_snps_hsphy *hsphy =phy_get_drvdata (phy);reset_control_assert (hsphy->phy_reset); -clk_disable_unprepare (hsphy->cfg_ahb_clk); +clk_bulk_disable_unprepare (hsphy->num_clks, hsphy->clks);regulator_bulk_disable (ARRAY_SIZE (hsphy->vregs), hsphy->vregs); hsphy->phy_initialized = false;
@@ -290,14 +322,15 @@ static int qcom_snps_hsphy_probe(struct platform_device *pdev)if (!hsphy)return -ENOMEM ; + hsphy->dev = dev; + hsphy->base =devm_platform_ioremap_resource (pdev,0 );if (IS_ERR (hsphy->base))return PTR_ERR (hsphy->base); - hsphy->ref_clk =devm_clk_get (dev,"ref" ); -if (IS_ERR (hsphy->ref_clk)) -return dev_err_probe (dev,PTR_ERR (hsphy->ref_clk), -"failed to get ref clk\n" ); + ret =qcom_snps_hsphy_clk_init (hsphy); +if (ret) +return dev_err_probe (dev, ret,"failed to initialize clocks\n" ); hsphy->phy_reset =devm_reset_control_get_exclusive (&pdev->dev,NULL );if (IS_ERR (hsphy->phy_reset)) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 27/201 media: staging: atomisp: select V4L2_FWNODE
In reply to Greg Kroah-HartmanFrom: Sakari Ailus <[email protected]>
[ Upstream commit bf4c985707d3168ebb7d87d15830de66949d979c ]
Select V4L2_FWNODE as the driver depends on it.
--- drivers/staging/media/atomisp/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/staging/media/atomisp/Kconfig +1 -0
@@ -13,6 +13,7 @@ config VIDEO_ATOMISP tristate "Intel Atom Image Signal Processor Driver" depends on VIDEO_V4L2 && INTEL_ATOMISP depends on PMIC_OPREGION + select V4L2_FWNODE select IOSF_MBI select VIDEOBUF_VMALLOC help
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 28/201 i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir()
In reply to Greg Kroah-HartmanFrom: Wang Ming <[email protected]>
[ Upstream commit 043b1f185fb0f3939b7427f634787706f45411c4 ]
The debugfs_create_dir() function returns error pointers. It never returns NULL. Most incorrect error checks were fixed, but the one in i40e_dbg_init() was forgotten.
Fix the remaining error check.
--- drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/i40e/i40e_debugfs.c +1 -1
@@ -1839,7 +1839,7 @@ void i40e_dbg_pf_exit(struct i40e_pf *pf)void i40e_dbg_init (void ) { i40e_dbg_root =debugfs_create_dir (i40e_driver_name,NULL ); -if (!i40e_dbg_root) +if (IS_ERR (i40e_dbg_root))pr_info ("init of debugfs failed\n" ); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 29/201 net: phy: marvell10g: fix 88x3310 power up
In reply to Greg Kroah-HartmanFrom: Jiawen Wu <[email protected]>
[ Upstream commit c7b75bea853daeb64fc831dbf39a6bbabcc402ac ]
Clear MV_V2_PORT_CTRL_PWRDOWN bit to set power up for 88x3310 PHY, it sometimes does not take effect immediately. And a read of this register causes the bit not to clear. This will cause mv3310_reset() to time out, which will fail the config initialization. So add a delay before the next access.
--- drivers/net/phy/marvell10g.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/phy/marvell10g.c +7 -0
@@ -263,6 +263,13 @@ static int mv3310_power_up(struct phy_device *phydev) ret =phy_clear_bits_mmd (phydev,MDIO_MMD_VEND2 ,MV_V2_PORT_CTRL ,MV_V2_PORT_CTRL_PWRDOWN ); +/* Sometimes, the power down bit doesn't clear immediately, and +* a read of this register causes the bit not to clear. Delay +* 100us to allow the PHY to come out of power down mode before +* the next access. +*/ +udelay (100 ); +if (phydev->drv->phy_id !=MARVELL_PHY_ID_88X3310 || priv->firmware_ver <0x00030000 )return ret;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 30/201 net: hns3: reconstruct function hclge_ets_validate()
In reply to Greg Kroah-HartmanFrom: Guangbin Huang <[email protected]>
[ Upstream commit 161ad669e6c23529415bffed5cb3bfa012e46cb4 ]
This patch reconstructs function hclge_ets_validate() to reduce the code cycle complexity and make code more concise.
Stable-dep-of: 882481b1c55f ("net: hns3: fix wrong bw weight of disabled tc issue")
--- .../hisilicon/hns3/hns3pf/hclge_dcb.c | 47 ++++++++++++++----- 1 file changed, 35 insertions(+), 12 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c +35 -12
@@ -105,26 +105,30 @@ static int hclge_dcb_common_validate(struct hclge_dev *hdev, u8 num_tc,return 0 ; } -static int hclge_ets_validate (struct hclge_dev *hdev,struct ieee_ets *ets, -u8 *tc,bool *changed) +static u8 hclge_ets_tc_changed (struct hclge_dev *hdev,struct ieee_ets *ets, +bool *changed) { -bool has_ets_tc = false; -u32 total_ets_bw =0 ; -u8 max_tc =0 ; -int ret; +u8 max_tc_id =0 ;u8 i;for (i =0 ; i <HNAE3_MAX_USER_PRIO ; i++) {if (ets->prio_tc[i] != hdev->tm_info.prio_tc[i]) *changed = true; -if (ets->prio_tc[i] > max_tc) - max_tc = ets->prio_tc[i]; +if (ets->prio_tc[i] > max_tc_id) + max_tc_id = ets->prio_tc[i]; } - ret =hclge_dcb_common_validate (hdev, max_tc +1 , ets->prio_tc); -if (ret) -return ret; +/* return max tc number, max tc id need to plus 1 */ +return max_tc_id +1 ; +} + +static int hclge_ets_sch_mode_validate (struct hclge_dev *hdev, +struct ieee_ets *ets,bool *changed) +{ +bool has_ets_tc = false; +u32 total_ets_bw =0 ; +u8 i;for (i =0 ; i <HNAE3_MAX_TC ; i++) {switch (ets->tc_tsa[i]) {
@@ -158,7 +162,26 @@ static int hclge_ets_validate(struct hclge_dev *hdev, struct ieee_ets *ets,if (has_ets_tc && total_ets_bw !=BW_PERCENT )return -EINVAL ; - *tc = max_tc +1 ; +return 0 ; +} + +static int hclge_ets_validate (struct hclge_dev *hdev,struct ieee_ets *ets, +u8 *tc,bool *changed) +{ +u8 tc_num; +int ret; + + tc_num =hclge_ets_tc_changed (hdev, ets, changed); + + ret =hclge_dcb_common_validate (hdev, tc_num, ets->prio_tc); +if (ret) +return ret; + + ret =hclge_ets_sch_mode_validate (hdev, ets, changed); +if (ret) +return ret; + + *tc = tc_num;if (*tc != hdev->tm_info.num_tc) *changed = true;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 31/201 net: hns3: fix wrong bw weight of disabled tc issue
In reply to Greg Kroah-HartmanFrom: Jijie Shao <[email protected]>
[ Upstream commit 882481b1c55fc44861d7e2d54b4e0936b1b39f2c ]
In dwrr mode, the default bandwidth weight of disabled tc is set to 0. If the bandwidth weight is 0, the mode will change to sp. Therefore, disabled tc default bandwidth weight need changed to 1, and 0 is returned when query the bandwidth weight of disabled tc. In addition, driver need stop configure bandwidth weight if tc is disabled.
--- .../ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c | 17 ++++++++++++++--- .../ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 3 ++- 2 files changed, 16 insertions(+), 4 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c +14 -3
@@ -53,7 +53,10 @@ static void hclge_tm_info_to_ieee_ets(struct hclge_dev *hdev,for (i =0 ; i <HNAE3_MAX_TC ; i++) { ets->prio_tc[i] = hdev->tm_info.prio_tc[i]; - ets->tc_tx_bw[i] = hdev->tm_info.pg_info[0 ].tc_dwrr[i]; +if (i < hdev->tm_info.num_tc) + ets->tc_tx_bw[i] = hdev->tm_info.pg_info[0 ].tc_dwrr[i]; +else + ets->tc_tx_bw[i] =0 ;if (hdev->tm_info.tc_info[i].tc_sch_mode ==HCLGE_SCH_MODE_SP )
@@ -124,7 +127,8 @@ static u8 hclge_ets_tc_changed(struct hclge_dev *hdev, struct ieee_ets *ets, }static int hclge_ets_sch_mode_validate (struct hclge_dev *hdev, -struct ieee_ets *ets,bool *changed) +struct ieee_ets *ets,bool *changed, +u8 tc_num) {bool has_ets_tc = false;u32 total_ets_bw =0 ;
@@ -138,6 +142,13 @@ static int hclge_ets_sch_mode_validate(struct hclge_dev *hdev, *changed = true;break ;case IEEE_8021QAZ_TSA_ETS : +if (i >= tc_num) { +dev_err (&hdev->pdev->dev, +"tc%u is disabled, cannot set ets bw\n" , + i); +return -EINVAL ; + } +/* The hardware will switch to sp mode if bandwidth is * 0, so limit ets bandwidth must be greater than 0. */
@@ -177,7 +188,7 @@ static int hclge_ets_validate(struct hclge_dev *hdev, struct ieee_ets *ets,if (ret)return ret; - ret =hclge_ets_sch_mode_validate (hdev, ets, changed); + ret =hclge_ets_sch_mode_validate (hdev, ets, changed, tc_num);if (ret)return ret;
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +2 -1
@@ -651,6 +651,7 @@ static void hclge_tm_tc_info_init(struct hclge_dev *hdev)static void hclge_tm_pg_info_init (struct hclge_dev *hdev) {#define BW_PERCENT 100 +#define DEFAULT_BW_WEIGHT 1u8 i;
@@ -672,7 +673,7 @@ static void hclge_tm_pg_info_init(struct hclge_dev *hdev)for (k =0 ; k < hdev->tm_info.num_tc; k++) hdev->tm_info.pg_info[i].tc_dwrr[k] =BW_PERCENT ;for (; k <HNAE3_MAX_TC ; k++) - hdev->tm_info.pg_info[i].tc_dwrr[k] =0 ; + hdev->tm_info.pg_info[i].tc_dwrr[k] =DEFAULT_BW_WEIGHT ; } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 32/201 vxlan: move to its own directory
In reply to Greg Kroah-HartmanFrom: Roopa Prabhu <[email protected]>
[ Upstream commit 6765393614ea8e2c0a7b953063513823f87c9115 ]
vxlan.c has grown too long. This patch moves it to its own directory. subsequent patches add new functionality in new files.
Stable-dep-of: 94d166c5318c ("vxlan: calculate correct header length for GPE")
---
drivers/net/Makefile | 2 +-
drivers/net/vxlan/Makefile | 7 +++++++
drivers/net/{vxlan.c => vxlan/vxlan_core.c} | 0
3 files changed, 8 insertions(+), 1 deletion(-)
create mode 100644 drivers/net/vxlan/Makefile
rename drivers/net/{vxlan.c => vxlan/vxlan_core.c} (100%)drivers/net/Makefile +1 -1
@@ -29,7 +29,7 @@ obj-$(CONFIG_TUN) += tun.o obj-$(CONFIG_TAP) += tap.o obj-$(CONFIG_VETH) += veth.o obj-$(CONFIG_VIRTIO_NET) += virtio_net.o -obj-$(CONFIG_VXLAN) += vxlan.o +obj-$(CONFIG_VXLAN) += vxlan/ obj-$(CONFIG_GENEVE) += geneve.o obj-$(CONFIG_BAREUDP) += bareudp.o obj-$(CONFIG_GTP) += gtp.o
drivers/net/vxlan/Makefile new file +7 -0
@@ -0,0 +1,7 @@ +# +# Makefile for the vxlan driver +# + +obj-$(CONFIG_VXLAN) += vxlan.o + +vxlan-objs := vxlan_core.o
drivers/net/vxlan/vxlan_core.c renamed from drivers/net/vxlan.c +0 -0
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 33/201 vxlan: calculate correct header length for GPE
In reply to Greg Kroah-HartmanFrom: Jiri Benc <[email protected]>
[ Upstream commit 94d166c5318c6edd1e079df8552233443e909c33 ]
VXLAN-GPE does not add an extra inner Ethernet header. Take that into account when calculating header length.
This causes problems in skb_tunnel_check_pmtu, where incorrect PMTU is cached.
In the collect_md mode (which is the only mode that VXLAN-GPE supports), there's no magic auto-setting of the tunnel interface MTU. It can't be, since the destination and thus the underlying interface may be different for each packet.
So, the administrator is responsible for setting the correct tunnel interface MTU. Apparently, the administrators are capable enough to calculate that the maximum MTU for VXLAN-GPE is (their_lower_MTU - 36). They set the tunnel interface MTU to 1464. If you run a TCP stream over such interface, it's then segmented according to the MTU 1464, i.e. producing 1514 bytes frames. Which is okay, this still fits the lower MTU.
However, skb_tunnel_check_pmtu (called from vxlan_xmit_one) uses 50 as the header size and thus incorrectly calculates the frame size to be 1528. This leads to ICMP too big message being generated (locally), PMTU of 1450 to be cached and the TCP stream to be resegmented.
The fix is to use the correct actual header size, especially for skb_tunnel_check_pmtu calculation.
--- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 2 +- drivers/net/vxlan/vxlan_core.c | 23 ++++++++----------- include/net/vxlan.h | 13 +++++++---- 3 files changed, 20 insertions(+), 18 deletions(-)
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +1 -1
@@ -8409,7 +8409,7 @@ static void ixgbe_atr(struct ixgbe_ring *ring,struct ixgbe_adapter *adapter = q_vector->adapter;if (unlikely (skb_tail_pointer (skb) < hdr.network + -VXLAN_HEADROOM )) +vxlan_headroom (0 )))return ;/* verify the port is recognized as VXLAN */
drivers/net/vxlan/vxlan_core.c +10 -13
@@ -2720,7 +2720,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, } ndst = &rt->dst; - err =skb_tunnel_check_pmtu (skb, ndst,VXLAN_HEADROOM , + err =skb_tunnel_check_pmtu (skb, ndst,vxlan_headroom (flags &VXLAN_F_GPE ),netif_is_any_bridge_port (dev));if (err <0 ) { goto tx_error;
@@ -2781,7 +2781,8 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, goto out_unlock; } - err =skb_tunnel_check_pmtu (skb, ndst,VXLAN6_HEADROOM , + err =skb_tunnel_check_pmtu (skb, ndst, +vxlan_headroom ((flags &VXLAN_F_GPE ) |VXLAN_F_IPV6 ),netif_is_any_bridge_port (dev));if (err <0 ) { goto tx_error;
@@ -3158,14 +3159,12 @@ static int vxlan_change_mtu(struct net_device *dev, int new_mtu)struct vxlan_rdst *dst = &vxlan->default_dst;struct net_device *lowerdev =__dev_get_by_index (vxlan->net, dst->remote_ifindex); -bool use_ipv6 = !!(vxlan->cfg.flags &VXLAN_F_IPV6 );/* This check is different than dev->max_mtu, because it looks at * the lowerdev->mtu, rather than the static dev->max_mtu */ if (lowerdev) { -int max_mtu = lowerdev->mtu - - (use_ipv6 ?VXLAN6_HEADROOM :VXLAN_HEADROOM ); +int max_mtu = lowerdev->mtu -vxlan_headroom (vxlan->cfg.flags);if (new_mtu > max_mtu)return -EINVAL ; }
@@ -3784,11 +3783,11 @@ static void vxlan_config_apply(struct net_device *dev,struct vxlan_dev *vxlan =netdev_priv (dev);struct vxlan_rdst *dst = &vxlan->default_dst;unsigned short needed_headroom =ETH_HLEN ; -bool use_ipv6 = !!(conf->flags &VXLAN_F_IPV6 );int max_mtu =ETH_MAX_MTU ; +u32 flags = conf->flags;if (!changelink) { -if (conf->flags &VXLAN_F_GPE ) +if (flags &VXLAN_F_GPE )vxlan_raw_setup (dev);else vxlan_ether_setup (dev);
@@ -3814,8 +3813,7 @@ static void vxlan_config_apply(struct net_device *dev, dev->needed_tailroom = lowerdev->needed_tailroom; - max_mtu = lowerdev->mtu - (use_ipv6 ?VXLAN6_HEADROOM : -VXLAN_HEADROOM ); + max_mtu = lowerdev->mtu -vxlan_headroom (flags);if (max_mtu <ETH_MIN_MTU ) max_mtu =ETH_MIN_MTU ;
@@ -3826,10 +3824,9 @@ static void vxlan_config_apply(struct net_device *dev,if (dev->mtu > max_mtu) dev->mtu = max_mtu; -if (use_ipv6 || conf->flags &VXLAN_F_COLLECT_METADATA ) - needed_headroom +=VXLAN6_HEADROOM ; -else - needed_headroom +=VXLAN_HEADROOM ; +if (flags &VXLAN_F_COLLECT_METADATA ) + flags |=VXLAN_F_IPV6 ; + needed_headroom +=vxlan_headroom (flags); dev->needed_headroom = needed_headroom;memcpy (&vxlan->cfg, conf,sizeof (*conf));
include/net/vxlan.h +9 -4
@@ -327,10 +327,15 @@ static inline netdev_features_t vxlan_features_check(struct sk_buff *skb,return features; } -/* IP header + UDP + VXLAN + Ethernet header */ -#define VXLAN_HEADROOM (20 + 8 + 8 + 14) -/* IPv6 header + UDP + VXLAN + Ethernet header */ -#define VXLAN6_HEADROOM (40 + 8 + 8 + 14) +static inline int vxlan_headroom (u32 flags) +{ +/* VXLAN: IP4/6 header + UDP + VXLAN + Ethernet header */ +/* VXLAN-GPE: IP4/6 header + UDP + VXLAN */ +return (flags &VXLAN_F_IPV6 ?sizeof (struct ipv6hdr ) : +sizeof (struct iphdr )) + +sizeof (struct udphdr ) +sizeof (struct vxlanhdr ) + + (flags &VXLAN_F_GPE ?0 :ETH_HLEN ); +}static inline struct vxlanhdr *vxlan_hdr (struct sk_buff *skb) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 34/201 phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe()
In reply to Greg Kroah-HartmanFrom: Harshit Mogalapalli <[email protected]>
[ Upstream commit 13c088cf3657d70893d75cf116be937f1509cc0f ]
The size of array 'priv->ports[]' is INNO_PHY_PORT_NUM.
In the for loop, 'i' is used as the index for array 'priv->ports[]' with a check (i > INNO_PHY_PORT_NUM) which indicates that INNO_PHY_PORT_NUM is allowed value for 'i' in the same loop.
This > comparison needs to be changed to >=, otherwise it potentially leads to an out of bounds write on the next iteration through the loop
--- drivers/phy/hisilicon/phy-hisi-inno-usb2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/phy/hisilicon/phy-hisi-inno-usb2.c +1 -1
@@ -153,7 +153,7 @@ static int hisi_inno_phy_probe(struct platform_device *pdev)phy_set_drvdata (phy, &priv->ports[i]); i++; -if (i >INNO_PHY_PORT_NUM ) { +if (i >=INNO_PHY_PORT_NUM ) {dev_warn (dev,"Support %d ports in maximum\n" , i);break ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 35/201 ethernet: atheros: fix return value check in atl1e_tso_csum()
In reply to Greg Kroah-HartmanFrom: Yuanjun Gong <[email protected]>
[ Upstream commit 69a184f7a372aac588babfb0bd681aaed9779f5b ]
in atl1e_tso_csum, it should check the return value of pskb_trim(), and return an error code if an unexpected value is returned by pskb_trim().
--- drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/ethernet/atheros/atl1e/atl1e_main.c +5 -2
@@ -1642,8 +1642,11 @@ static int atl1e_tso_csum(struct atl1e_adapter *adapter, real_len = (((unsigned char *)ip_hdr (skb) - skb->data) +ntohs (ip_hdr (skb)->tot_len)); -if (real_len < skb->len) -pskb_trim (skb, real_len); +if (real_len < skb->len) { + err =pskb_trim (skb, real_len); +if (err) +return err; + } hdr_len = (skb_transport_offset (skb) +tcp_hdrlen (skb));if (unlikely (skb->len == hdr_len)) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 36/201 ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new temporary address
In reply to Greg Kroah-HartmanFrom: Maciej Żenczykowski <[email protected]>
[ Upstream commit 69172f0bcb6a09110c5d2a6d792627f5095a9018 ]
currently on 6.4 net/main:
# ip link add dummy1 type dummy # echo 1 > /proc/sys/net/ipv6/conf/dummy1/use_tempaddr # ip link set dummy1 up # ip -6 addr add 2000::1/64 mngtmpaddr dev dummy1 # ip -6 addr show dev dummy1
11: dummy1: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
inet6 2000::44f3:581c:8ca:3983/64 scope global temporary dynamic
valid_lft 604800sec preferred_lft 86172sec
inet6 2000::1/64 scope global mngtmpaddr
valid_lft forever preferred_lft forever
inet6 fe80::e8a8:a6ff:fed5:56d4/64 scope link
valid_lft forever preferred_lft forever# ip -6 addr del 2000::44f3:581c:8ca:3983/64 dev dummy1
(can wait a few seconds if you want to, the above delete isn't [directly] the problem)
# ip -6 addr show dev dummy1
11: dummy1: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
inet6 2000::1/64 scope global mngtmpaddr
valid_lft forever preferred_lft forever
inet6 fe80::e8a8:a6ff:fed5:56d4/64 scope link
valid_lft forever preferred_lft forever
# ip -6 addr del 2000::1/64 mngtmpaddr dev dummy1 # ip -6 addr show dev dummy1
11: dummy1: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
inet6 2000::81c9:56b7:f51a:b98f/64 scope global temporary dynamic
valid_lft 604797sec preferred_lft 86169sec
inet6 fe80::e8a8:a6ff:fed5:56d4/64 scope link
valid_lft forever preferred_lft foreverThis patch prevents this new 'global temporary dynamic' address from being created by the deletion of the related (same subnet prefix) 'mngtmpaddr' (which is triggered by there already being no temporary addresses).
--- net/ipv6/addrconf.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
net/ipv6/addrconf.c +10 -4
@@ -2555,12 +2555,18 @@ static void manage_tempaddrs(struct inet6_dev *idev,ipv6_ifa_notify (0 , ift); } -if ((create ||list_empty (&idev->tempaddr_list)) && - idev->cnf.use_tempaddr >0 ) { +/* Also create a temporary address if it's enabled but no temporary +* address currently exists. +* However, we get called with valid_lft == 0, prefered_lft == 0, create == false +* as part of cleanup (ie. deleting the mngtmpaddr). +* We don't want that to result in creating a new temporary ip address. +*/ +if (list_empty (&idev->tempaddr_list) && (valid_lft || prefered_lft)) + create = true; + +if (create && idev->cnf.use_tempaddr >0 ) {/* When a new public address is created as described * in [ADDRCONF], also create a new temporary address. -* Also create a temporary address if it's enabled but -* no temporary address currently exists. */ read_unlock_bh (&idev->lock);ipv6_create_tempaddr (ifp, false);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 37/201 tcp: Reduce chance of collisions in inet6_hashfn().
In reply to Greg Kroah-HartmanFrom: Stewart Smith <[email protected]>
[ Upstream commit d11b0df7ddf1831f3e170972f43186dad520bfcc ]
For both IPv4 and IPv6 incoming TCP connections are tracked in a hash table with a hash over the source & destination addresses and ports. However, the IPv6 hash is insufficient and can lead to a high rate of collisions.
The IPv6 hash used an XOR to fit everything into the 96 bits for the fast jenkins hash, meaning it is possible for an external entity to ensure the hash collides, thus falling back to a linear search in the bucket, which is slow.
We take the approach of hash the full length of IPv6 address in __ipv6_addr_jhash() so that all users can benefit from a more secure version.
While this may look like it adds overhead, the reality of modern CPUs means that this is unmeasurable in real world scenarios.
In simulating with llvm-mca, the increase in cycles for the hashing code was ~16 cycles on Skylake (from a base of ~155), and an extra ~9 on Nehalem (base of ~173).
In commit dd6d2910c5e0 ("netfilter: conntrack: switch to siphash") netfilter switched from a jenkins hash to a siphash, but even the faster hsiphash is a more significant overhead (~20-30%) in some preliminary testing. So, in this patch, we keep to the more conservative approach to ensure we don't add much overhead per SYN.
In testing, this results in a consistently even spread across the connection buckets. In both testing and real-world scenarios, we have not found any measurable performance impact.
--- include/net/ipv6.h | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
include/net/ipv6.h +2 -6
@@ -663,12 +663,8 @@ static inline u32 ipv6_addr_hash(const struct in6_addr *a)/* more secured version of ipv6_addr_hash() */ static inline u32 __ipv6_addr_jhash (const struct in6_addr *a,const u32 initval) { -u32 v = (__force u32 )a->s6_addr32[0 ] ^ (__force u32 )a->s6_addr32[1 ]; - -return jhash_3words (v, - (__force u32 )a->s6_addr32[2 ], - (__force u32 )a->s6_addr32[3 ], - initval); +return jhash2 ((__force const u32 *)a->s6_addr32, +ARRAY_SIZE (a->s6_addr32), initval); }static inline bool ipv6_addr_loopback (const struct in6_addr *a)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 38/201 ice: Fix memory management in ice_ethtool_fdir.c
In reply to Greg Kroah-HartmanFrom: Jedrzej Jagielski <[email protected]>
[ Upstream commit a3336056504d780590ac6d6ac94fbba829994594 ]
Fix ethtool FDIR logic to not use memory after its release. In the ice_ethtool_fdir.c file there are 2 spots where code can refer to pointers which may be missing.
In the ice_cfg_fdir_xtrct_seq() function seg may be freed but even then may be still used by memcpy(&tun_seg[1], seg, sizeof(*seg)).
In the ice_add_fdir_ethtool() function struct ice_fdir_fltr *input may first fail to be added via ice_fdir_update_list_entry() but then may be deleted by ice_fdir_update_list_entry.
Terminate in both cases when the returned value of the previous operation is other than 0, free memory and don't use it anymore.
--- .../net/ethernet/intel/ice/ice_ethtool_fdir.c | 26 ++++++++++--------- 1 file changed, 14 insertions(+), 12 deletions(-)
drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c +14 -12
@@ -1135,16 +1135,21 @@ ice_cfg_fdir_xtrct_seq(struct ice_pf *pf, struct ethtool_rx_flow_spec *fsp, ICE_FLOW_FLD_OFF_INVAL); } -/* add filter for outer headers */ fltr_idx =ice_ethtool_flow_to_fltr (fsp->flow_type & ~FLOW_EXT ); + +assign_bit (fltr_idx, hw->fdir_perfect_fltr, perfect_filter); + +/* add filter for outer headers */ ret =ice_fdir_set_hw_fltr_rule (pf, seg, fltr_idx,ICE_FD_HW_SEG_NON_TUN ); -if (ret == -EEXIST ) -/* Rule already exists, free memory and continue */ -devm_kfree (dev, seg); -else if (ret) +if (ret == -EEXIST ) { +/* Rule already exists, free memory and count as success */ + ret =0 ; + goto err_exit; + }else if (ret) {/* could not write filter, free memory */ goto err_exit; + }/* make tunneled filter HW entries if possible */ memcpy (&tun_seg[1 ], seg,sizeof (*seg));
@@ -1159,18 +1164,13 @@ ice_cfg_fdir_xtrct_seq(struct ice_pf *pf, struct ethtool_rx_flow_spec *fsp,devm_kfree (dev, tun_seg); } -if (perfect_filter) -set_bit (fltr_idx, hw->fdir_perfect_fltr); -else -clear_bit (fltr_idx, hw->fdir_perfect_fltr); -return ret; err_exit:devm_kfree (dev, tun_seg);devm_kfree (dev, seg); -return -EOPNOTSUPP ; +return ret; }/**
@@ -1680,7 +1680,9 @@ int ice_add_fdir_ethtool(struct ice_vsi *vsi, struct ethtool_rxnfc *cmd) }/* input struct is added to the HW filter list */ -ice_fdir_update_list_entry (pf, input, fsp->location); + ret =ice_fdir_update_list_entry (pf, input, fsp->location); +if (ret) + goto release_lock; ret =ice_fdir_write_all_fltr (pf, input, true);if (ret)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 39/201 bonding: reset bonds flags when down link is P2P device
In reply to Greg Kroah-HartmanFrom: Hangbin Liu <[email protected]>
[ Upstream commit da19a2b967cf1e2c426f50d28550d1915214a81d ]
When adding a point to point downlink to the bond, we neglected to reset the bond's flags, which were still using flags like BROADCAST and MULTICAST. Consequently, this would initiate ARP/DAD for P2P downlink interfaces, such as when adding a GRE device to the bonding.
To address this issue, let's reset the bond's flags for P2P interfaces.
Before fix:
7: gre0@NONE: <POINTOPOINT,NOARP,SLAVE,UP,LOWER_UP> mtu 1500 qdisc noqueue master bond0 state UNKNOWN group default qlen 1000
link/gre6 2006:70:10::1 peer 2006:70:10::2 permaddr 167f:18:f188::
8: bond0: <BROADCAST,MULTICAST,MASTER,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/gre6 2006:70:10::1 brd 2006:70:10::2
inet6 fe80::200:ff:fe00:0/64 scope link
valid_lft forever preferred_lft foreverAfter fix:
7: gre0@NONE: <POINTOPOINT,NOARP,SLAVE,UP,LOWER_UP> mtu 1500 qdisc noqueue master bond2 state UNKNOWN group default qlen 1000
link/gre6 2006:70:10::1 peer 2006:70:10::2 permaddr c29e:557a:e9d9::
8: bond0: <POINTOPOINT,NOARP,MASTER,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/gre6 2006:70:10::1 peer 2006:70:10::2
inet6 fe80::1/64 scope link
valid_lft forever preferred_lft forever--- drivers/net/bonding/bond_main.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/bonding/bond_main.c +5 -0
@@ -1442,6 +1442,11 @@ static void bond_setup_by_slave(struct net_device *bond_dev,memcpy (bond_dev->broadcast, slave_dev->broadcast, slave_dev->addr_len); + +if (slave_dev->flags &IFF_POINTOPOINT ) { + bond_dev->flags &= ~(IFF_BROADCAST |IFF_MULTICAST ); + bond_dev->flags |= (IFF_POINTOPOINT |IFF_NOARP ); + } }/* On bonding slaves other than the currently active slave, suppress
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 40/201 team: reset teams flags when down link is P2P device
In reply to Greg Kroah-HartmanFrom: Hangbin Liu <[email protected]>
[ Upstream commit fa532bee17d15acf8bba4bc8e2062b7a093ba801 ]
When adding a point to point downlink to team device, we neglected to reset the team's flags, which were still using flags like BROADCAST and MULTICAST. Consequently, this would initiate ARP/DAD for P2P downlink interfaces, such as when adding a GRE device to team device. Fix this by remove multicast/broadcast flags and add p2p and noarp flags.
After removing the none ethernet interface and adding an ethernet interface to team, we need to reset team interface flags. Unlike bonding interface, team do not need restore IFF_MASTER, IFF_SLAVE flags.
--- drivers/net/team/team.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/net/team/team.c +9 -0
@@ -2130,6 +2130,15 @@ static void team_setup_by_port(struct net_device *dev, dev->mtu = port_dev->mtu;memcpy (dev->broadcast, port_dev->broadcast, port_dev->addr_len);eth_hw_addr_inherit (dev, port_dev); + +if (port_dev->flags &IFF_POINTOPOINT ) { + dev->flags &= ~(IFF_BROADCAST |IFF_MULTICAST ); + dev->flags |= (IFF_POINTOPOINT |IFF_NOARP ); + }else if ((port_dev->flags & (IFF_BROADCAST |IFF_MULTICAST )) == + (IFF_BROADCAST |IFF_MULTICAST )) { + dev->flags |= (IFF_BROADCAST |IFF_MULTICAST ); + dev->flags &= ~(IFF_POINTOPOINT |IFF_NOARP ); + } } static int team_dev_type_check_change(struct net_device *dev,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 41/201 platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100
In reply to Greg Kroah-HartmanFrom: Maxim Mikityanskiy <[email protected]>
[ Upstream commit ad084a6d99bc182bf109c190c808e2ea073ec57b ]
Only the HW rfkill state is toggled on laptops with quirks->ec_read_only (so far only MSI Wind U90/U100). There are, however, a few issues with the implementation:
1. The initial HW state is always unblocked, regardless of the actual state on boot, because msi_init_rfkill only sets the SW state, regardless of ec_read_only.
2. The initial SW state corresponds to the actual state on boot, but it can't be changed afterwards, because set_device_state returns -EOPNOTSUPP. It confuses the userspace, making Wi-Fi and/or Bluetooth unusable if it was blocked on boot, and breaking the airplane mode if the rfkill was unblocked on boot.
Address the above issues by properly initializing the HW state on ec_read_only laptops and by allowing the userspace to toggle the SW state. Don't set the SW state ourselves and let the userspace fully control it. Toggling the SW state is a no-op, however, it allows the userspace to properly toggle the airplane mode. The actual SW radio disablement is handled by the corresponding rtl818x_pci and btusb drivers that have their own rfkills.
Tested on MSI Wind U100 Plus, BIOS ver 1.0G, EC ver 130.
--- drivers/platform/x86/msi-laptop.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/platform/x86/msi-laptop.c +4 -4
@@ -210,7 +210,7 @@ static ssize_t set_device_state(const char *buf, size_t count, u8 mask)return -EINVAL ;if (quirks->ec_read_only) -return -EOPNOTSUPP ; +return 0 ;/* read current device state */ result =ec_read (MSI_STANDARD_EC_COMMAND_ADDRESS , &rdata);
@@ -841,15 +841,15 @@ static bool msi_laptop_i8042_filter(unsigned char data, unsigned char str,static void msi_init_rfkill (struct work_struct *ignored) {if (rfk_wlan) { -rfkill_set_sw_state (rfk_wlan, !wlan_s); +msi_rfkill_set_state (rfk_wlan, !wlan_s);rfkill_wlan_set (NULL , !wlan_s); }if (rfk_bluetooth) { -rfkill_set_sw_state (rfk_bluetooth, !bluetooth_s); +msi_rfkill_set_state (rfk_bluetooth, !bluetooth_s);rfkill_bluetooth_set (NULL , !bluetooth_s); }if (rfk_threeg) { -rfkill_set_sw_state (rfk_threeg, !threeg_s); +msi_rfkill_set_state (rfk_threeg, !threeg_s);rfkill_threeg_set (NULL , !threeg_s); } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 42/201 netfilter: nft_set_rbtree: fix overlap expiration walk
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ Upstream commit f718863aca469a109895cb855e6b81fff4827d71 ]
The lazy gc on insert that should remove timed-out entries fails to release the other half of the interval, if any.
Can be reproduced with tests/shell/testcases/sets/0044interval_overlap_0 in nftables.git and kmemleak enabled kernel.
Second bug is the use of rbe_prev vs. prev pointer.
If rbe_prev() returns NULL after at least one iteration, rbe_prev points to element that is not an end interval, hence it should not be removed.
Lastly, check the genmask of the end interval if this is active in the current generation.
--- net/netfilter/nft_set_rbtree.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)
net/netfilter/nft_set_rbtree.c +14 -6
@@ -216,29 +216,37 @@ static void *nft_rbtree_get(const struct net *net, const struct nft_set *set,static int nft_rbtree_gc_elem (const struct nft_set *__set,struct nft_rbtree *priv, -struct nft_rbtree_elem *rbe) +struct nft_rbtree_elem *rbe, +u8 genmask) {struct nft_set *set = (struct nft_set *)__set;struct rb_node *prev =rb_prev (&rbe->node); -struct nft_rbtree_elem *rbe_prev =NULL ; +struct nft_rbtree_elem *rbe_prev;struct nft_set_gc_batch *gcb; gcb =nft_set_gc_batch_check (set,NULL ,GFP_ATOMIC );if (!gcb)return -ENOMEM ; -/* search for expired end interval coming before this element. */ +/* search for end interval coming before this element. +* end intervals don't carry a timeout extension, they +* are coupled with the interval start element. +*/ while (prev) { rbe_prev = rb_entry(prev, struct nft_rbtree_elem, node); -if (nft_rbtree_interval_end (rbe_prev)) +if (nft_rbtree_interval_end (rbe_prev) && +nft_set_elem_active (&rbe_prev->ext, genmask))break ; prev =rb_prev (prev); } -if (rbe_prev) { +if (prev) { + rbe_prev = rb_entry(prev, struct nft_rbtree_elem, node); +rb_erase (&rbe_prev->node, &priv->root);atomic_dec (&set->nelems); +nft_set_gc_batch_add (gcb, rbe_prev); }rb_erase (&rbe->node, &priv->root);
@@ -320,7 +328,7 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,/* perform garbage collection to avoid bogus overlap reports. */ if (nft_set_elem_expired (&rbe->ext)) { - err =nft_rbtree_gc_elem (set, priv, rbe); + err =nft_rbtree_gc_elem (set, priv, rbe, genmask);if (err <0 )return err;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 43/201 netfilter: nftables: add helper function to validate set element data
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 97c976d662fb9080a6a5d1e1a108c7a1f5c9484d ]
When binding sets to rule, validate set element data according to set definition. This patch adds a helper function to be reused by the catch-all set element support.
Stable-dep-of: 0a771f7b266b ("netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR")
--- net/netfilter/nf_tables_api.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
net/netfilter/nf_tables_api.c +11 -4
@@ -4576,10 +4576,9 @@ static int nft_validate_register_store(const struct nft_ctx *ctx,enum nft_data_types type, unsigned int len); -static int nf_tables_bind_check_setelem (const struct nft_ctx *ctx, -struct nft_set *set, -const struct nft_set_iter *iter, -struct nft_set_elem *elem) +static int nft_setelem_data_validate (const struct nft_ctx *ctx, +struct nft_set *set, +struct nft_set_elem *elem) {const struct nft_set_ext *ext =nft_set_elem_ext (set, elem->priv);enum nft_registers dreg;
@@ -4591,6 +4590,14 @@ static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx, set->dlen); } +static int nf_tables_bind_check_setelem (const struct nft_ctx *ctx, +struct nft_set *set, +const struct nft_set_iter *iter, +struct nft_set_elem *elem) +{ +return nft_setelem_data_validate (ctx, set, elem); +} +int nf_tables_bind_set (const struct nft_ctx *ctx,struct nft_set *set,struct nft_set_binding *binding) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 44/201 netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 0a771f7b266b02d262900c75f1e175c7fe76fec2 ]
On error when building the rule, the immediate expression unbinds the chain, hence objects can be deactivated by the transaction records.
Otherwise, it is possible to trigger the following warning:
WARNING: CPU: 3 PID: 915 at net/netfilter/nf_tables_api.c:2013 nf_tables_chain_destroy+0x1f7/0x210 [nf_tables] CPU: 3 PID: 915 Comm: chain-bind-err- Not tainted 6.1.39 #1 RIP: 0010:nf_tables_chain_destroy+0x1f7/0x210 [nf_tables]
--- net/netfilter/nft_immediate.c | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-)
net/netfilter/nft_immediate.c +18 -9
@@ -125,15 +125,27 @@ static void nft_immediate_activate(const struct nft_ctx *ctx,return nft_data_hold (&priv->data,nft_dreg_to_type (priv->dreg)); } +static void nft_immediate_chain_deactivate (const struct nft_ctx *ctx, +struct nft_chain *chain, +enum nft_trans_phase phase) +{ +struct nft_ctx chain_ctx; +struct nft_rule *rule; + + chain_ctx = *ctx; + chain_ctx.chain = chain; + +list_for_each_entry (rule, &chain->rules, list) +nft_rule_expr_deactivate (&chain_ctx, rule, phase); +} +static void nft_immediate_deactivate (const struct nft_ctx *ctx,const struct nft_expr *expr,enum nft_trans_phase phase) {const struct nft_immediate_expr *priv =nft_expr_priv (expr);const struct nft_data *data = &priv->data; -struct nft_ctx chain_ctx;struct nft_chain *chain; -struct nft_rule *rule;if (priv->dreg ==NFT_REG_VERDICT ) {switch (data->verdict.code) {
@@ -143,20 +155,17 @@ static void nft_immediate_deactivate(const struct nft_ctx *ctx,if (!nft_chain_binding (chain))break ; - chain_ctx = *ctx; - chain_ctx.chain = chain; - -list_for_each_entry (rule, &chain->rules, list) -nft_rule_expr_deactivate (&chain_ctx, rule, phase); -switch (phase) {case NFT_TRANS_PREPARE_ERROR :nf_tables_unbind_chain (ctx, chain); - fallthrough; +nft_deactivate_next (ctx->net, chain); +break ;case NFT_TRANS_PREPARE : +nft_immediate_chain_deactivate (ctx, chain, phase);nft_deactivate_next (ctx->net, chain);break ;default : +nft_immediate_chain_deactivate (ctx, chain, phase);nft_chain_del (chain); chain->bound = false; chain->table->use--;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 45/201 netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 0ebc1064e4874d5987722a2ddbc18f94aa53b211 ]
Bail out with EOPNOTSUPP when adding rule to bound chain via NFTA_RULE_CHAIN_ID. The following warning splat is shown when adding a rule to a deleted bound chain:
WARNING: CPU: 2 PID: 13692 at net/netfilter/nf_tables_api.c:2013 nf_tables_chain_destroy+0x1f7/0x210 [nf_tables] CPU: 2 PID: 13692 Comm: chain-bound-rul Not tainted 6.1.39 #1 RIP: 0010:nf_tables_chain_destroy+0x1f7/0x210 [nf_tables]
--- net/netfilter/nf_tables_api.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/netfilter/nf_tables_api.c +3 -2
@@ -3350,8 +3350,6 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,NL_SET_BAD_ATTR (extack, nla[NFTA_RULE_CHAIN ]);return PTR_ERR (chain); } -if (nft_chain_is_bound (chain)) -return -EOPNOTSUPP ; }else if (nla[NFTA_RULE_CHAIN_ID ]) { chain = nft_chain_lookup_byid(net, table, nla[NFTA_RULE_CHAIN_ID],
@@ -3364,6 +3362,9 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk,return -EINVAL ; } +if (nft_chain_is_bound (chain)) +return -EOPNOTSUPP ; +if (nla[NFTA_RULE_HANDLE ]) { handle =be64_to_cpu (nla_get_be64 (nla[NFTA_RULE_HANDLE ])); rule =__nft_rule_lookup (chain, handle);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 46/201 net/sched: mqprio: refactor nlattr parsing to a separate function
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit feb2cf3dcfb930aec2ca65c66d1365543d5ba943 ]
mqprio_init() is quite large and unwieldy to add more code to. Split the netlink attribute parsing to a dedicated function.
Stable-dep-of: 6c58c8816abb ("net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64")
--- net/sched/sch_mqprio.c | 114 +++++++++++++++++++++++------------------ 1 file changed, 63 insertions(+), 51 deletions(-)
net/sched/sch_mqprio.c +63 -51
@@ -130,6 +130,67 @@ static int parse_attr(struct nlattr *tb[], int maxtype, struct nlattr *nla,return 0 ; } +static int mqprio_parse_nlattr (struct Qdisc *sch,struct tc_mqprio_qopt *qopt, +struct nlattr *opt) +{ +struct mqprio_sched *priv =qdisc_priv (sch); +struct nlattr *tb[TCA_MQPRIO_MAX +1 ]; +struct nlattr *attr; +int i, rem, err; + + err =parse_attr (tb,TCA_MQPRIO_MAX , opt, mqprio_policy, +sizeof (*qopt)); +if (err <0 ) +return err; + +if (!qopt->hw) +return -EINVAL ; + +if (tb[TCA_MQPRIO_MODE ]) { + priv->flags |=TC_MQPRIO_F_MODE ; + priv->mode = *(u16 *)nla_data (tb[TCA_MQPRIO_MODE ]); + } + +if (tb[TCA_MQPRIO_SHAPER ]) { + priv->flags |=TC_MQPRIO_F_SHAPER ; + priv->shaper = *(u16 *)nla_data (tb[TCA_MQPRIO_SHAPER ]); + } + +if (tb[TCA_MQPRIO_MIN_RATE64 ]) { +if (priv->shaper !=TC_MQPRIO_SHAPER_BW_RATE ) +return -EINVAL ; + i =0 ; +nla_for_each_nested (attr, tb[TCA_MQPRIO_MIN_RATE64 ], + rem) { +if (nla_type (attr) !=TCA_MQPRIO_MIN_RATE64 ) +return -EINVAL ; +if (i >= qopt->num_tc) +break ; + priv->min_rate[i] = *(u64 *)nla_data (attr); + i++; + } + priv->flags |=TC_MQPRIO_F_MIN_RATE ; + } + +if (tb[TCA_MQPRIO_MAX_RATE64 ]) { +if (priv->shaper !=TC_MQPRIO_SHAPER_BW_RATE ) +return -EINVAL ; + i =0 ; +nla_for_each_nested (attr, tb[TCA_MQPRIO_MAX_RATE64 ], + rem) { +if (nla_type (attr) !=TCA_MQPRIO_MAX_RATE64 ) +return -EINVAL ; +if (i >= qopt->num_tc) +break ; + priv->max_rate[i] = *(u64 *)nla_data (attr); + i++; + } + priv->flags |=TC_MQPRIO_F_MAX_RATE ; + } + +return 0 ; +} +static int mqprio_init (struct Qdisc *sch,struct nlattr *opt,struct netlink_ext_ack *extack) {
@@ -139,9 +200,6 @@ static int mqprio_init(struct Qdisc *sch, struct nlattr *opt,struct Qdisc *qdisc;int i, err = -EOPNOTSUPP ;struct tc_mqprio_qopt *qopt =NULL ; -struct nlattr *tb[TCA_MQPRIO_MAX +1 ]; -struct nlattr *attr; -int rem;int len;BUILD_BUG_ON (TC_MAX_QUEUE !=TC_QOPT_MAX_QUEUE );
@@ -166,55 +224,9 @@ static int mqprio_init(struct Qdisc *sch, struct nlattr *opt, len =nla_len (opt) -NLA_ALIGN (sizeof (*qopt));if (len >0 ) { - err =parse_attr (tb,TCA_MQPRIO_MAX , opt, mqprio_policy, -sizeof (*qopt)); -if (err <0 ) + err =mqprio_parse_nlattr (sch, qopt, opt); +if (err)return err; - -if (!qopt->hw) -return -EINVAL ; - -if (tb[TCA_MQPRIO_MODE ]) { - priv->flags |=TC_MQPRIO_F_MODE ; - priv->mode = *(u16 *)nla_data (tb[TCA_MQPRIO_MODE ]); - } - -if (tb[TCA_MQPRIO_SHAPER ]) { - priv->flags |=TC_MQPRIO_F_SHAPER ; - priv->shaper = *(u16 *)nla_data (tb[TCA_MQPRIO_SHAPER ]); - } - -if (tb[TCA_MQPRIO_MIN_RATE64 ]) { -if (priv->shaper !=TC_MQPRIO_SHAPER_BW_RATE ) -return -EINVAL ; - i =0 ; -nla_for_each_nested (attr, tb[TCA_MQPRIO_MIN_RATE64 ], - rem) { -if (nla_type (attr) !=TCA_MQPRIO_MIN_RATE64 ) -return -EINVAL ; -if (i >= qopt->num_tc) -break ; - priv->min_rate[i] = *(u64 *)nla_data (attr); - i++; - } - priv->flags |=TC_MQPRIO_F_MIN_RATE ; - } - -if (tb[TCA_MQPRIO_MAX_RATE64 ]) { -if (priv->shaper !=TC_MQPRIO_SHAPER_BW_RATE ) -return -EINVAL ; - i =0 ; -nla_for_each_nested (attr, tb[TCA_MQPRIO_MAX_RATE64 ], - rem) { -if (nla_type (attr) !=TCA_MQPRIO_MAX_RATE64 ) -return -EINVAL ; -if (i >= qopt->num_tc) -break ; - priv->max_rate[i] = *(u64 *)nla_data (attr); - i++; - } - priv->flags |=TC_MQPRIO_F_MAX_RATE ; - } }/* pre-allocate qdisc, attachment can't fail */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 47/201 net/sched: mqprio: add extack to mqprio_parse_nlattr()
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 57f21bf85400abadac0cb2a4db5de1d663f8863f ]
Netlink attribute parsing in mqprio is a minesweeper game, with many options having the possibility of being passed incorrectly and the user being none the wiser.
Try to make errors less sour by giving user space some information regarding what went wrong.
Stable-dep-of: 6c58c8816abb ("net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64")
--- net/sched/sch_mqprio.c | 30 +++++++++++++++++++++++------- 1 file changed, 23 insertions(+), 7 deletions(-)
net/sched/sch_mqprio.c +23 -7
@@ -131,7 +131,8 @@ static int parse_attr(struct nlattr *tb[], int maxtype, struct nlattr *nla, }static int mqprio_parse_nlattr (struct Qdisc *sch,struct tc_mqprio_qopt *qopt, -struct nlattr *opt) +struct nlattr *opt, +struct netlink_ext_ack *extack) {struct mqprio_sched *priv =qdisc_priv (sch);struct nlattr *tb[TCA_MQPRIO_MAX +1 ];
@@ -143,8 +144,11 @@ static int mqprio_parse_nlattr(struct Qdisc *sch, struct tc_mqprio_qopt *qopt,if (err <0 )return err; -if (!qopt->hw) +if (!qopt->hw) { +NL_SET_ERR_MSG (extack, +"mqprio TCA_OPTIONS can only contain netlink attributes in hardware mode" );return -EINVAL ; + }if (tb[TCA_MQPRIO_MODE ]) { priv->flags |=TC_MQPRIO_F_MODE ;
@@ -157,13 +161,19 @@ static int mqprio_parse_nlattr(struct Qdisc *sch, struct tc_mqprio_qopt *qopt, }if (tb[TCA_MQPRIO_MIN_RATE64 ]) { -if (priv->shaper !=TC_MQPRIO_SHAPER_BW_RATE ) +if (priv->shaper !=TC_MQPRIO_SHAPER_BW_RATE ) { +NL_SET_ERR_MSG_ATTR (extack, tb[TCA_MQPRIO_MIN_RATE64 ], +"min_rate accepted only when shaper is in bw_rlimit mode" );return -EINVAL ; + } i =0 ;nla_for_each_nested (attr, tb[TCA_MQPRIO_MIN_RATE64 ], rem) { -if (nla_type (attr) !=TCA_MQPRIO_MIN_RATE64 ) +if (nla_type (attr) !=TCA_MQPRIO_MIN_RATE64 ) { +NL_SET_ERR_MSG_ATTR (extack, attr, +"Attribute type expected to be TCA_MQPRIO_MIN_RATE64" );return -EINVAL ; + }if (i >= qopt->num_tc)break ; priv->min_rate[i] = *(u64 *)nla_data (attr);
@@ -173,13 +183,19 @@ static int mqprio_parse_nlattr(struct Qdisc *sch, struct tc_mqprio_qopt *qopt, }if (tb[TCA_MQPRIO_MAX_RATE64 ]) { -if (priv->shaper !=TC_MQPRIO_SHAPER_BW_RATE ) +if (priv->shaper !=TC_MQPRIO_SHAPER_BW_RATE ) { +NL_SET_ERR_MSG_ATTR (extack, tb[TCA_MQPRIO_MAX_RATE64 ], +"max_rate accepted only when shaper is in bw_rlimit mode" );return -EINVAL ; + } i =0 ;nla_for_each_nested (attr, tb[TCA_MQPRIO_MAX_RATE64 ], rem) { -if (nla_type (attr) !=TCA_MQPRIO_MAX_RATE64 ) +if (nla_type (attr) !=TCA_MQPRIO_MAX_RATE64 ) { +NL_SET_ERR_MSG_ATTR (extack, attr, +"Attribute type expected to be TCA_MQPRIO_MAX_RATE64" );return -EINVAL ; + }if (i >= qopt->num_tc)break ; priv->max_rate[i] = *(u64 *)nla_data (attr);
@@ -224,7 +240,7 @@ static int mqprio_init(struct Qdisc *sch, struct nlattr *opt, len =nla_len (opt) -NLA_ALIGN (sizeof (*qopt));if (len >0 ) { - err =mqprio_parse_nlattr (sch, qopt, opt); + err =mqprio_parse_nlattr (sch, qopt, opt, extack);if (err)return err; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 48/201 net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64
In reply to Greg Kroah-HartmanFrom: Lin Ma <[email protected]>
[ Upstream commit 6c58c8816abb7b93b21fa3b1d0c1726402e5e568 ]
The nla_for_each_nested parsing in function mqprio_parse_nlattr() does not check the length of the nested attribute. This can lead to an out-of-attribute read and allow a malformed nlattr (e.g., length 0) to be viewed as 8 byte integer and passed to priv->max_rate/min_rate.
This patch adds the check based on nla_len() when check the nla_type(), which ensures that the length of these two attribute must equals sizeof(u64).
--- net/sched/sch_mqprio.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
net/sched/sch_mqprio.c +14 -0
@@ -174,6 +174,13 @@ static int mqprio_parse_nlattr(struct Qdisc *sch, struct tc_mqprio_qopt *qopt, "Attribute type expected to be TCA_MQPRIO_MIN_RATE64");return -EINVAL ; } + +if (nla_len (attr) !=sizeof (u64)) { +NL_SET_ERR_MSG_ATTR (extack, attr, +"Attribute TCA_MQPRIO_MIN_RATE64 expected to have 8 bytes length" ); +return -EINVAL ; + } +if (i >= qopt->num_tc)break ; priv->min_rate[i] = *(u64 *)nla_data (attr);
@@ -196,6 +203,13 @@ static int mqprio_parse_nlattr(struct Qdisc *sch, struct tc_mqprio_qopt *qopt, "Attribute type expected to be TCA_MQPRIO_MAX_RATE64");return -EINVAL ; } + +if (nla_len (attr) !=sizeof (u64)) { +NL_SET_ERR_MSG_ATTR (extack, attr, +"Attribute TCA_MQPRIO_MAX_RATE64 expected to have 8 bytes length" ); +return -EINVAL ; + } +if (i >= qopt->num_tc)break ; priv->max_rate[i] = *(u64 *)nla_data (attr);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 49/201 benet: fix return value check in be_lancer_xmit_workarounds()
In reply to Greg Kroah-HartmanFrom: Yuanjun Gong <[email protected]>
[ Upstream commit 5c85f7065718a949902b238a6abd8fc907c5d3e0 ]
in be_lancer_xmit_workarounds(), it should go to label 'tx_drop' if an unexpected value is returned by pskb_trim().
--- drivers/net/ethernet/emulex/benet/be_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/emulex/benet/be_main.c +2 -1
@@ -1139,7 +1139,8 @@ static struct sk_buff *be_lancer_xmit_workarounds(struct be_adapter *adapter, (lancer_chip(adapter) || BE3_chip(adapter) || skb_vlan_tag_present(skb)) && is_ipv4_pkt(skb)) { ip = (struct iphdr *)ip_hdr (skb); -pskb_trim (skb, eth_hdr_len +ntohs (ip->tot_len)); +if (unlikely (pskb_trim (skb, eth_hdr_len +ntohs (ip->tot_len)))) + goto tx_drop; }/* If vlan tag is already inlined in the packet, skip HW VLAN
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 50/201 tipc: check return value of pskb_trim()
In reply to Greg Kroah-HartmanFrom: Yuanjun Gong <[email protected]>
[ Upstream commit e46e06ffc6d667a89b979701288e2264f45e6a7b ]
goto free_skb if an unexpected result is returned by pskb_tirm() in tipc_crypto_rcv_complete().
--- net/tipc/crypto.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/tipc/crypto.c +2 -1
@@ -1964,7 +1964,8 @@ static void tipc_crypto_rcv_complete(struct net *net, struct tipc_aead *aead,skb_reset_network_header (*skb);skb_pull (*skb,tipc_ehdr_size (ehdr)); -pskb_trim (*skb, (*skb)->len - aead->authsize); +if (pskb_trim (*skb, (*skb)->len - aead->authsize)) + goto free_skb;/* Validate TIPCv2 message */ if (unlikely (!tipc_msg_validate (skb))) {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 51/201 tipc: stop tipc crypto on failure in tipc_node_create
In reply to Greg Kroah-HartmanFrom: Fedor Pchelkin <[email protected]>
[ Upstream commit de52e17326c3e9a719c9ead4adb03467b8fae0ef ]
If tipc_link_bc_create() fails inside tipc_node_create() for a newly allocated tipc node then we should stop its tipc crypto and free the resources allocated with a call to tipc_crypto_start().
As the node ref is initialized to one to that point, just put the ref on tipc_link_bc_create() error case that would lead to tipc_node_free() be eventually executed and properly clean the node and its crypto resources.
Found by Linux Verification Center (linuxtesting.org).
--- net/tipc/node.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tipc/node.c +1 -1
@@ -567,7 +567,7 @@ struct tipc_node *tipc_node_create(struct net *net, u32 addr, u8 *peer_id, n->capabilities, &n->bc_entry.inputq1, &n->bc_entry.namedq, snd_l, &n->bc_entry.link)) {pr_warn ("Broadcast rcv link creation failed, no memory\n" ); -kfree (n); +tipc_node_put (n); n =NULL ; goto exit; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 52/201 RDMA/mlx4: Make check for invalid flags stricter
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit d64b1ee12a168030fbb3e0aebf7bce49e9a07589 ]
This code is trying to ensure that only the flags specified in the list are allowed. The problem is that ucmd->rx_hash_fields_mask is a u64 and the flags are an enum which is treated as a u32 in this context. That means the test doesn't check whether the highest 32 bits are zero.
--- drivers/infiniband/hw/mlx4/qp.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/infiniband/hw/mlx4/qp.c +9 -9
@@ -530,15 +530,15 @@ static int set_qp_rss(struct mlx4_ib_dev *dev, struct mlx4_ib_rss *rss_ctx,return (-EOPNOTSUPP ); } -if (ucmd->rx_hash_fields_mask & ~(MLX4_IB_RX_HASH_SRC_IPV4 | -MLX4_IB_RX_HASH_DST_IPV4 | -MLX4_IB_RX_HASH_SRC_IPV6 | -MLX4_IB_RX_HASH_DST_IPV6 | -MLX4_IB_RX_HASH_SRC_PORT_TCP | -MLX4_IB_RX_HASH_DST_PORT_TCP | -MLX4_IB_RX_HASH_SRC_PORT_UDP | -MLX4_IB_RX_HASH_DST_PORT_UDP | -MLX4_IB_RX_HASH_INNER )) { +if (ucmd->rx_hash_fields_mask & ~(u64)(MLX4_IB_RX_HASH_SRC_IPV4 | +MLX4_IB_RX_HASH_DST_IPV4 | +MLX4_IB_RX_HASH_SRC_IPV6 | +MLX4_IB_RX_HASH_DST_IPV6 | +MLX4_IB_RX_HASH_SRC_PORT_TCP | +MLX4_IB_RX_HASH_DST_PORT_TCP | +MLX4_IB_RX_HASH_SRC_PORT_UDP | +MLX4_IB_RX_HASH_DST_PORT_UDP | +MLX4_IB_RX_HASH_INNER )) {pr_debug ("RX Hash fields_mask has unsupported mask (0x%llx)\n" , ucmd->rx_hash_fields_mask);return (-EOPNOTSUPP );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 53/201 drm/msm/dpu: drop enum dpu_core_perf_data_bus_id
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit e8383f5cf1b3573ce140a80bfbfd809278ab16d6 ]
Drop the leftover of bus-client -> interconnect conversion, the enum dpu_core_perf_data_bus_id.
Patchwork: https://patchwork.freedesktop.org/patch/546048/
--- drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.h | 13 ------------- 1 file changed, 13 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_core_perf.h +0 -13
@@ -14,19 +14,6 @@#define DPU_PERF_DEFAULT_MAX_CORE_CLK_RATE 412500000 -/** -* enum dpu_core_perf_data_bus_id - data bus identifier -* @DPU_CORE_PERF_DATA_BUS_ID_MNOC: DPU/MNOC data bus -* @DPU_CORE_PERF_DATA_BUS_ID_LLCC: MNOC/LLCC data bus -* @DPU_CORE_PERF_DATA_BUS_ID_EBI: LLCC/EBI data bus -*/ -enum dpu_core_perf_data_bus_id { -DPU_CORE_PERF_DATA_BUS_ID_MNOC , -DPU_CORE_PERF_DATA_BUS_ID_LLCC , -DPU_CORE_PERF_DATA_BUS_ID_EBI , -DPU_CORE_PERF_DATA_BUS_ID_MAX , -}; -/** * struct dpu_core_perf_params - definition of performance parameters * @max_per_pipe_ib: maximum instantaneous bandwidth request
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 54/201 drm/msm/adreno: Fix snapshot BINDLESS_DATA size
In reply to Greg Kroah-HartmanFrom: Rob Clark <[email protected]>
[ Upstream commit bd846ceee9c478d0397428f02696602ba5eb264a ]
The incorrect size was causing "CP | AHB bus error" when snapshotting the GPU state on a6xx gen4 (a660 family).
Patchwork: https://patchwork.freedesktop.org/patch/546763/
--- drivers/gpu/drm/msm/adreno/a6xx_gpu_state.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/adreno/a6xx_gpu_state.h +1 -1
@@ -200,7 +200,7 @@ static const struct a6xx_shader_block {SHADER (A6XX_SP_LB_3_DATA ,0x800 ),SHADER (A6XX_SP_LB_4_DATA ,0x800 ),SHADER (A6XX_SP_LB_5_DATA ,0x200 ), -SHADER (A6XX_SP_CB_BINDLESS_DATA ,0x2000 ), +SHADER (A6XX_SP_CB_BINDLESS_DATA ,0x800 ),SHADER (A6XX_SP_CB_LEGACY_DATA ,0x280 ),SHADER (A6XX_SP_UAV_DATA ,0x80 ), SHADER(A6XX_SP_INST_TAG, 0x80),
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 55/201 RDMA/mthca: Fix crash when polling CQ for shared QPs
In reply to Greg Kroah-HartmanFrom: Thomas Bogendoerfer <[email protected]>
[ Upstream commit dc52aadbc1849cbe3fcf6bc54d35f6baa396e0a1 ]
Commit 21c2fe94abb2 ("RDMA/mthca: Combine special QP struct with mthca QP") introduced a new struct mthca_sqp which doesn't contain struct mthca_qp any longer. Placing a pointer of this new struct into qptable leads to crashes, because mthca_poll_one() expects a qp pointer. Fix this by putting the correct pointer into qptable.
--- drivers/infiniband/hw/mthca/mthca_qp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/mthca/mthca_qp.c +1 -1
@@ -1390,7 +1390,7 @@ int mthca_alloc_sqp(struct mthca_dev *dev,if (mthca_array_get (&dev->qp_table.qp, mqpn)) err = -EBUSY ;else -mthca_array_set (&dev->qp_table.qp, mqpn, qp->sqp); +mthca_array_set (&dev->qp_table.qp, mqpn, qp);spin_unlock_irq (&dev->qp_table.lock);if (err)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 56/201 drm/msm: Fix IS_ERR_OR_NULL() vs NULL check in a5xx_submit_in_rb()
In reply to Greg Kroah-HartmanFrom: Gaosheng Cui <[email protected]>
[ Upstream commit 6e8a996563ecbe68e49c49abd4aaeef69f11f2dc ]
The msm_gem_get_vaddr() returns an ERR_PTR() on failure, and a null is catastrophic here, so we should use IS_ERR_OR_NULL() to check the return value.
Patchwork: https://patchwork.freedesktop.org/patch/547712/
--- drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/adreno/a5xx_gpu.c +1 -1
@@ -81,7 +81,7 @@ static void a5xx_submit_in_rb(struct msm_gpu *gpu, struct msm_gem_submit *submit* since we've already mapped it once in * submit_reloc() */ -if (WARN_ON (!ptr)) +if (WARN_ON (IS_ERR_OR_NULL (ptr)))return ;for (i =0 ; i < dwords; i++) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 57/201 ASoC: fsl_spdif: Silence output on stop
In reply to Greg Kroah-HartmanFrom: Matus Gajdos <[email protected]>
[ Upstream commit 0e4c2b6b0c4a4b4014d9424c27e5e79d185229c5 ]
Clear TX registers on stop to prevent the SPDIF interface from sending last written word over and over again.
--- sound/soc/fsl/fsl_spdif.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/fsl/fsl_spdif.c +2 -0
@@ -612,6 +612,8 @@ static int fsl_spdif_trigger(struct snd_pcm_substream *substream,case SNDRV_PCM_TRIGGER_PAUSE_PUSH :regmap_update_bits (regmap,REG_SPDIF_SCR , dmaen,0 );regmap_update_bits (regmap,REG_SPDIF_SIE , intr,0 ); +regmap_write (regmap,REG_SPDIF_STL ,0x0 ); +regmap_write (regmap,REG_SPDIF_STR ,0x0 );break ;default :return -EINVAL ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 58/201 block: Fix a source code comment in include/uapi/linux/blkzoned.h
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
[ Upstream commit e0933b526fbfd937c4a8f4e35fcdd49f0e22d411 ]
Fix the symbolic names for zone conditions in the blkzoned.h header file.
--- include/uapi/linux/blkzoned.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
include/uapi/linux/blkzoned.h +5 -5
@@ -51,13 +51,13 @@ enum blk_zone_type {* * The Zone Condition state machine in the ZBC/ZAC standards maps the above * deinitions as: -* - ZC1: Empty | BLK_ZONE_EMPTY +* - ZC1: Empty | BLK_ZONE_COND_EMPTY * - ZC2: Implicit Open | BLK_ZONE_COND_IMP_OPEN * - ZC3: Explicit Open | BLK_ZONE_COND_EXP_OPEN -* - ZC4: Closed | BLK_ZONE_CLOSED -* - ZC5: Full | BLK_ZONE_FULL -* - ZC6: Read Only | BLK_ZONE_READONLY -* - ZC7: Offline | BLK_ZONE_OFFLINE +* - ZC4: Closed | BLK_ZONE_COND_CLOSED +* - ZC5: Full | BLK_ZONE_COND_FULL +* - ZC6: Read Only | BLK_ZONE_COND_READONLY +* - ZC7: Offline | BLK_ZONE_COND_OFFLINE * * Conditions 0x5 to 0xC are reserved by the current ZBC/ZAC spec and should * be considered invalid.
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 59/201 dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths
In reply to Greg Kroah-HartmanFrom: Yu Kuai <[email protected]>
[ Upstream commit bae3028799dc4f1109acc4df37c8ff06f2d8f1a0 ]
In the error paths 'bad_stripe_cache' and 'bad_check_reshape', 'reconfig_mutex' is still held after raid_ctr() returns.
--- drivers/md/dm-raid.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/md/dm-raid.c +7 -2
@@ -3278,15 +3278,19 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv)/* Try to adjust the raid4/5/6 stripe cache size to the stripe size */ if (rs_is_raid456 (rs)) { r =rs_set_raid456_stripe_cache (rs); -if (r) +if (r) { +mddev_unlock (&rs->md); goto bad_stripe_cache; + } }/* Now do an early reshape check */ if (test_bit (RT_FLAG_RESHAPE_RS , &rs->runtime_flags)) { r =rs_check_reshape (rs); -if (r) +if (r) { +mddev_unlock (&rs->md); goto bad_check_reshape; + }/* Restore new, ctr requested layout to perform check */ rs_config_restore (rs, &rs_layout);
@@ -3295,6 +3299,7 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv) r = rs->md.pers->check_reshape (&rs->md);if (r) { ti->error ="Reshape check failed" ; +mddev_unlock (&rs->md); goto bad_check_reshape; } }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 60/201 dm raid: clean up four equivalent goto tags in raid_ctr()
In reply to Greg Kroah-HartmanFrom: Yu Kuai <[email protected]>
[ Upstream commit e74c874eabe2e9173a8fbdad616cd89c70eb8ffd ]
There are four equivalent goto tags in raid_ctr(), clean them up to use just one.
There is no functional change and this is preparation to fix raid_ctr()'s unprotected md_stop().
Stable-dep-of: 7d5fff8982a2 ("dm raid: protect md_stop() with 'reconfig_mutex'")
--- drivers/md/dm-raid.c | 27 +++++++++------------------ 1 file changed, 9 insertions(+), 18 deletions(-)
drivers/md/dm-raid.c +9 -18
@@ -3258,8 +3258,7 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv) r =md_start (&rs->md);if (r) { ti->error ="Failed to start raid array" ; -mddev_unlock (&rs->md); - goto bad_md_start; + goto bad_unlock; }/* If raid4/5/6 journal mode explicitly requested (only possible with journal dev) -> set it */
@@ -3267,8 +3266,7 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv) r =r5c_journal_mode_set (&rs->md, rs->journal_dev.mode);if (r) { ti->error ="Failed to set raid4/5/6 journal mode" ; -mddev_unlock (&rs->md); - goto bad_journal_mode_set; + goto bad_unlock; } }
@@ -3278,19 +3276,15 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv)/* Try to adjust the raid4/5/6 stripe cache size to the stripe size */ if (rs_is_raid456 (rs)) { r =rs_set_raid456_stripe_cache (rs); -if (r) { -mddev_unlock (&rs->md); - goto bad_stripe_cache; - } +if (r) + goto bad_unlock; }/* Now do an early reshape check */ if (test_bit (RT_FLAG_RESHAPE_RS , &rs->runtime_flags)) { r =rs_check_reshape (rs); -if (r) { -mddev_unlock (&rs->md); - goto bad_check_reshape; - } +if (r) + goto bad_unlock;/* Restore new, ctr requested layout to perform check */ rs_config_restore (rs, &rs_layout);
@@ -3299,8 +3293,7 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv) r = rs->md.pers->check_reshape (&rs->md);if (r) { ti->error ="Reshape check failed" ; -mddev_unlock (&rs->md); - goto bad_check_reshape; + goto bad_unlock; } } }
@@ -3311,10 +3304,8 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv)mddev_unlock (&rs->md);return 0 ; -bad_md_start: -bad_journal_mode_set: -bad_stripe_cache: -bad_check_reshape: +bad_unlock: +mddev_unlock (&rs->md);md_stop (&rs->md); bad:raid_set_free (rs);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 61/201 dm raid: protect md_stop() with reconfig_mutex
In reply to Greg Kroah-HartmanFrom: Yu Kuai <[email protected]>
[ Upstream commit 7d5fff8982a2199d49ec067818af7d84d4f95ca0 ]
__md_stop_writes() and __md_stop() will modify many fields that are protected by 'reconfig_mutex', and all the callers will grab 'reconfig_mutex' except for md_stop().
Also, update md_stop() to make certain 'reconfig_mutex' is held using lockdep_assert_held().
--- drivers/md/dm-raid.c | 4 +++- drivers/md/md.c | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-)
drivers/md/dm-raid.c +3 -1
@@ -3305,8 +3305,8 @@ static int raid_ctr(struct dm_target *ti, unsigned int argc, char **argv)return 0 ; bad_unlock: -mddev_unlock (&rs->md);md_stop (&rs->md); +mddev_unlock (&rs->md); bad:raid_set_free (rs);
@@ -3317,7 +3317,9 @@ static void raid_dtr(struct dm_target *ti) {struct raid_set *rs = ti->private; +mddev_lock_nointr (&rs->md);md_stop (&rs->md); +mddev_unlock (&rs->md);raid_set_free (rs); }
drivers/md/md.c +2 -0
@@ -6316,6 +6316,8 @@ static void __md_stop(struct mddev *mddev)void md_stop (struct mddev *mddev) { +lockdep_assert_held (&mddev->reconfig_mutex); +/* stop the array and free an attached data structures. * This is called from dm-raid */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 62/201 ata: pata_ns87415: mark ns87560_tf_read static
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 3fc2febb0f8ffae354820c1772ec008733237cfa ]
The global function triggers a warning because of the missing prototype
drivers/ata/pata_ns87415.c:263:6: warning: no previous prototype for 'ns87560_tf_read' [-Wmissing-prototypes]
263 | void ns87560_tf_read(struct ata_port *ap, struct ata_taskfile *tf)
There are no other references to this, so just make it static.
--- drivers/ata/pata_ns87415.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ata/pata_ns87415.c +1 -1
@@ -260,7 +260,7 @@ static u8 ns87560_check_status(struct ata_port *ap)* LOCKING: * Inherited from caller. */ -void ns87560_tf_read (struct ata_port *ap,struct ata_taskfile *tf) +static void ns87560_tf_read (struct ata_port *ap,struct ata_taskfile *tf) {struct ata_ioports *ioaddr = &ap->ioaddr;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 63/201 ring-buffer: Fix wrong stat of cpu_buffer->read
In reply to Greg Kroah-HartmanFrom: Zheng Yejian <[email protected]>
[ Upstream commit 2d093282b0d4357373497f65db6a05eb0c28b7c8 ]
When pages are removed in rb_remove_pages(), 'cpu_buffer->read' is set to 0 in order to make sure any read iterators reset themselves. However, this will mess 'entries' stating, see following steps:
# cd /sys/kernel/tracing/
# 1. Enlarge ring buffer prepare for later reducing:
# echo 20 > per_cpu/cpu0/buffer_size_kb
# 2. Write a log into ring buffer of cpu0:
# taskset -c 0 echo "hello1" > trace_marker
# 3. Read the log:
# cat per_cpu/cpu0/trace_pipe
<...>-332 [000] ..... 62.406844: tracing_mark_write: hello1
# 4. Stop reading and see the stats, now 0 entries, and 1 event readed:
# cat per_cpu/cpu0/stats
entries: 0
[...]
read events: 1
# 5. Reduce the ring buffer
# echo 7 > per_cpu/cpu0/buffer_size_kb
# 6. Now entries became unexpected 1 because actually no entries!!!
# cat per_cpu/cpu0/stats
entries: 1
[...]
read events: 0To fix it, introduce 'page_removed' field to count total removed pages since last reset, then use it to let read iterators reset themselves instead of changing the 'read' pointer.
--- kernel/trace/ring_buffer.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-)
kernel/trace/ring_buffer.c +12 -10
@@ -526,6 +526,8 @@ struct ring_buffer_per_cpu {rb_time_t write_stamp;rb_time_t before_stamp;u64 read_stamp; +/* pages removed since last reset */ +unsigned long pages_removed;/* ring buffer pages to update, > 0 to add, < 0 to remove */ long nr_pages_to_update;struct list_head new_pages;/* new pages to add */
@@ -561,6 +563,7 @@ struct ring_buffer_iter {struct buffer_page *head_page;struct buffer_page *cache_reader_page;unsigned long cache_read; +unsigned long cache_pages_removed;u64 read_stamp;u64 page_stamp;struct ring_buffer_event *event;
@@ -1833,6 +1836,8 @@ rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned long nr_pages) to_remove =rb_list_head (to_remove)->next; head_bit |= (unsigned long )to_remove &RB_PAGE_HEAD ; } +/* Read iterators need to reset themselves when some pages removed */ + cpu_buffer->pages_removed += nr_removed; next_page =rb_list_head (to_remove)->next;
@@ -1854,12 +1859,6 @@ rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned long nr_pages) cpu_buffer->head_page =list_entry (next_page, struct buffer_page, list); -/* -* change read pointer to make sure any read iterators reset -* themselves -*/ - cpu_buffer->read =0 ; -/* pages are removed, resume tracing and then free the pages */ atomic_dec (&cpu_buffer->record_disabled);raw_spin_unlock_irq (&cpu_buffer->reader_lock);
@@ -4105,6 +4104,7 @@ static void rb_iter_reset(struct ring_buffer_iter *iter) iter->cache_reader_page = iter->head_page; iter->cache_read = cpu_buffer->read; + iter->cache_pages_removed = cpu_buffer->pages_removed;if (iter->head) { iter->read_stamp = cpu_buffer->read_stamp;
@@ -4558,12 +4558,13 @@ rb_iter_peek(struct ring_buffer_iter *iter, u64 *ts) buffer = cpu_buffer->buffer;/* -* Check if someone performed a consuming read to -* the buffer. A consuming read invalidates the iterator -* and we need to reset the iterator in this case. +* Check if someone performed a consuming read to the buffer +* or removed some pages from the buffer. In these cases, +* iterator was invalidated and we need to reset it. */ if (unlikely (iter->cache_read != cpu_buffer->read || - iter->cache_reader_page != cpu_buffer->reader_page)) + iter->cache_reader_page != cpu_buffer->reader_page || + iter->cache_pages_removed != cpu_buffer->pages_removed))rb_iter_reset (iter); again:
@@ -5005,6 +5006,7 @@ rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer) cpu_buffer->last_overrun =0 ;rb_head_page_activate (cpu_buffer); + cpu_buffer->pages_removed =0 ; }/* Must have disabled the cpu buffer then done a synchronize_rcu */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 64/201 tracing: Fix warning in trace_buffered_event_disable()
In reply to Greg Kroah-HartmanFrom: Zheng Yejian <[email protected]>
[ Upstream commit dea499781a1150d285c62b26659f62fb00824fce ]
Warning happened in trace_buffered_event_disable() at
WARN_ON_ONCE(!trace_buffered_event_ref)
Call Trace: ? __warn+0xa5/0x1b0 ? trace_buffered_event_disable+0x189/0x1b0 __ftrace_event_enable_disable+0x19e/0x3e0 free_probe_data+0x3b/0xa0 unregister_ftrace_function_probe_func+0x6b8/0x800 event_enable_func+0x2f0/0x3d0 ftrace_process_regex.isra.0+0x12d/0x1b0 ftrace_filter_write+0xe6/0x140 vfs_write+0x1c9/0x6f0 [...]
The cause of the warning is in __ftrace_event_enable_disable(), trace_buffered_event_enable() was called once while trace_buffered_event_disable() was called twice. Reproduction script show as below, for analysis, see the comments:
```
#!/bin/bash
cd /sys/kernel/tracing/
# 1. Register a 'disable_event' command, then:
# 1) SOFT_DISABLED_BIT was set;
# 2) trace_buffered_event_enable() was called first time;
echo 'cmdline_proc_show:disable_event:initcall:initcall_finish' > \
set_ftrace_filter
# 2. Enable the event registered, then:
# 1) SOFT_DISABLED_BIT was cleared;
# 2) trace_buffered_event_disable() was called first time;
echo 1 > events/initcall/initcall_finish/enable
# 3. Try to call into cmdline_proc_show(), then SOFT_DISABLED_BIT was
# set again!!!
cat /proc/cmdline
# 4. Unregister the 'disable_event' command, then:
# 1) SOFT_DISABLED_BIT was cleared again;
# 2) trace_buffered_event_disable() was called second time!!!
echo '!cmdline_proc_show:disable_event:initcall:initcall_finish' > \
set_ftrace_filter
```To fix it, IIUC, we can change to call trace_buffered_event_enable() at fist time soft-mode enabled, and call trace_buffered_event_disable() at last time soft-mode disabled.
--- kernel/trace/trace_events.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-)
kernel/trace/trace_events.c +4 -10
@@ -371,7 +371,6 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file, {struct trace_event_call *call = file->event_call;struct trace_array *tr = file->tr; -unsigned long file_flags = file->flags;int ret =0 ;int disable;
@@ -395,6 +394,8 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file,break ; disable = file->flags &EVENT_FILE_FL_SOFT_DISABLED ;clear_bit (EVENT_FILE_FL_SOFT_MODE_BIT , &file->flags); +/* Disable use of trace_buffered_event */ +trace_buffered_event_disable (); }else disable = !(file->flags &EVENT_FILE_FL_SOFT_MODE );
@@ -433,6 +434,8 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file,if (atomic_inc_return (&file->sm_ref) >1 )break ;set_bit (EVENT_FILE_FL_SOFT_MODE_BIT , &file->flags); +/* Enable use of trace_buffered_event */ +trace_buffered_event_enable (); }if (!(file->flags &EVENT_FILE_FL_ENABLED )) {
@@ -472,15 +475,6 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file,break ; } -/* Enable or disable use of trace_buffered_event */ -if ((file_flags &EVENT_FILE_FL_SOFT_DISABLED ) != - (file->flags &EVENT_FILE_FL_SOFT_DISABLED )) { -if (file->flags &EVENT_FILE_FL_SOFT_DISABLED ) -trace_buffered_event_enable (); -else -trace_buffered_event_disable (); - } -return ret; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 65/201 Revert "usb: gadget: tegra-xudc: Fix error check in tegra_xudc_powerdomain_init()"
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit a8291be6b5dd465c22af229483dbac543a91e24e upstream.
This reverts commit f08aa7c80dac27ee00fa6827f447597d2fba5465.
The reverted commit was based on static analysis and a misunderstanding of how PTR_ERR() and NULLs are supposed to work. When a function returns both pointer errors and NULL then normally the NULL means "continue operating without a feature because it was deliberately turned off". The NULL should not be treated as a failure. If a driver cannot work when that feature is disabled then the KConfig should enforce that the function cannot return NULL. We should not need to test for it.
In this driver, the bug means that probe cannot succeed when CONFIG_PM is disabled.
--- drivers/usb/gadget/udc/tegra-xudc.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/usb/gadget/udc/tegra-xudc.c +4 -4
@@ -3693,15 +3693,15 @@ static int tegra_xudc_powerdomain_init(sint err; xudc->genpd_dev_device =dev_pm_domain_attach_by_name (dev,"dev" ); -if (IS_ERR_OR_NULL (xudc->genpd_dev_device)) { - err =PTR_ERR (xudc->genpd_dev_device) ? : -ENODATA ; +if (IS_ERR (xudc->genpd_dev_device)) { + err =PTR_ERR (xudc->genpd_dev_device);dev_err (dev,"failed to get device power domain: %d\n" , err);return err; } xudc->genpd_dev_ss =dev_pm_domain_attach_by_name (dev,"ss" ); -if (IS_ERR_OR_NULL (xudc->genpd_dev_ss)) { - err =PTR_ERR (xudc->genpd_dev_ss) ? : -ENODATA ; +if (IS_ERR (xudc->genpd_dev_ss)) { + err =PTR_ERR (xudc->genpd_dev_ss);dev_err (dev,"failed to get SuperSpeed power domain: %d\n" , err);return err; }
Greg Kroah-Hartman
maintainerPATCH 66/201 USB: gadget: Fix the memory leak in raw_gadget driver
In reply to Greg Kroah-HartmanFrom: Zqiang <[email protected]>
commit 83e30f2bf86ef7c38fbd476ed81a88522b620628 upstream.
Currently, increasing raw_dev->count happens before invoke the raw_queue_event(), if the raw_queue_event() return error, invoke raw_release() will not trigger the dev_free() to be called.
[ 268.905865][ T5067] raw-gadget.0 gadget.0: failed to queue event [ 268.912053][ T5067] udc dummy_udc.0: failed to start USB Raw Gadget: -12 [ 268.918885][ T5067] raw-gadget.0: probe of gadget.0 failed with error -12 [ 268.925956][ T5067] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 268.934657][ T5067] misc raw-gadget: fail, usb_gadget_register_driver returned -16
BUG: memory leak [<ffffffff8154bf94>] kmalloc_trace+0x24/0x90 mm/slab_common.c:1076 [<ffffffff8347eb55>] kmalloc include/linux/slab.h:582 [inline] [<ffffffff8347eb55>] kzalloc include/linux/slab.h:703 [inline] [<ffffffff8347eb55>] dev_new drivers/usb/gadget/legacy/raw_gadget.c:191 [inline] [<ffffffff8347eb55>] raw_open+0x45/0x110 drivers/usb/gadget/legacy/raw_gadget.c:385 [<ffffffff827d1d09>] misc_open+0x1a9/0x1f0 drivers/char/misc.c:165 [<ffffffff8154bf94>] kmalloc_trace+0x24/0x90 mm/slab_common.c:1076 [<ffffffff8347cd2f>] kmalloc include/linux/slab.h:582 [inline] [<ffffffff8347cd2f>] raw_ioctl_init+0xdf/0x410 drivers/usb/gadget/legacy/raw_gadget.c:460 [<ffffffff8347dfe9>] raw_ioctl+0x5f9/0x1120 drivers/usb/gadget/legacy/raw_gadget.c:1250 [<ffffffff81685173>] vfs_ioctl fs/ioctl.c:51 [inline] [<ffffffff8154bf94>] kmalloc_trace+0x24/0x90 mm/slab_common.c:1076 [<ffffffff833ecc6a>] kmalloc include/linux/slab.h:582 [inline] [<ffffffff833ecc6a>] kzalloc include/linux/slab.h:703 [inline] [<ffffffff833ecc6a>] dummy_alloc_request+0x5a/0xe0 drivers/usb/gadget/udc/dummy_hcd.c:665 [<ffffffff833e9132>] usb_ep_alloc_request+0x22/0xd0 drivers/usb/gadget/udc/core.c:196 [<ffffffff8347f13d>] gadget_bind+0x6d/0x370 drivers/usb/gadget/legacy/raw_gadget.c:292
This commit therefore invoke kref_get() under the condition that raw_queue_event() return success.
--- drivers/usb/gadget/legacy/raw_gadget.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/usb/gadget/legacy/raw_gadget.c +6 -4
@@ -309,13 +309,15 @@ static int gadget_bind(struct usb_gadget dev->eps_num = i;spin_unlock_irqrestore (&dev->lock, flags); -/* Matches kref_put() in gadget_unbind(). */ -kref_get (&dev->count); - ret =raw_queue_event (dev,USB_RAW_EVENT_CONNECT ,0 ,NULL ); -if (ret <0 ) +if (ret <0 ) {dev_err (&gadget->dev,"failed to queue event\n" ); +set_gadget_data (gadget,NULL ); +return ret; + } +/* Matches kref_put() in gadget_unbind(). */ +kref_get (&dev->count);return ret; }
Greg Kroah-Hartman
maintainerPATCH 67/201 serial: qcom-geni: drop bogus runtime pm state update
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 4dd8752a14ca0303fbdf0a6c68ff65f0a50bd2fa upstream.
The runtime PM state should not be changed by drivers that do not implement runtime PM even if it happens to work around a bug in PM core.
With the wake irq arming now fixed, drop the bogus runtime PM state update which left the device in active state (and could potentially prevent a parent device from suspending).
--- drivers/tty/serial/qcom_geni_serial.c | 7 ------- 1 file changed, 7 deletions(-)
drivers/tty/serial/qcom_geni_serial.c +0 -7
@@ -1468,13 +1468,6 @@ static int qcom_geni_serial_probe(struct goto err; } -/* -* Set pm_runtime status as ACTIVE so that wakeup_irq gets -* enabled/disabled from dev_pm_arm_wake_irq during system -* suspend/resume respectively. -*/ -pm_runtime_set_active (&pdev->dev); -if (port->wakeup_irq >0 ) {device_init_wakeup (&pdev->dev, true); ret = dev_pm_set_dedicated_wake_irq(&pdev->dev,
Greg Kroah-Hartman
maintainerPATCH 68/201 serial: 8250_dw: Preserve original value of DLF register
In reply to Greg Kroah-HartmanFrom: Ruihong Luo <[email protected]>
commit 748c5ea8b8796ae8ee80b8d3a3d940570b588d59 upstream.
Preserve the original value of the Divisor Latch Fraction (DLF) register. When the DLF register is modified without preservation, it can disrupt the baudrate settings established by firmware or bootloader, leading to data corruption and the generation of unreadable or distorted characters.
--- drivers/tty/serial/8250/8250_dwlib.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/tty/serial/8250/8250_dwlib.c +4 -2
@@ -80,7 +80,7 @@ static void dw8250_set_divisor(struct uavoid dw8250_setup_port (struct uart_port *p) {struct uart_8250_port *up =up_to_u8250p (p); -u32 reg; +u32 reg, old_dlf;/* * If the Component Version Register returns zero, we know that
@@ -93,9 +93,11 @@ void dw8250_setup_port(struct uart_portdev_dbg (p->dev,"Designware UART version %c.%c%c\n" , (reg >>24 ) &0xff , (reg >>16 ) &0xff , (reg >>8 ) &0xff ); +/* Preserve value written by firmware or bootloader */ + old_dlf =dw8250_readl_ext (p,DW_UART_DLF );dw8250_writel_ext (p,DW_UART_DLF , ~0U ); reg =dw8250_readl_ext (p,DW_UART_DLF ); -dw8250_writel_ext (p,DW_UART_DLF ,0 ); +dw8250_writel_ext (p,DW_UART_DLF , old_dlf);if (reg) {struct dw8250_port_data *d = p->private_data;
Greg Kroah-Hartman
maintainerPATCH 69/201 serial: sifive: Fix sifive_serial_console_setup() section
In reply to Greg Kroah-HartmanFrom: Samuel Holland <[email protected]>
commit 9b8fef6345d5487137d4193bb0a0eae2203c284e upstream.
This function is called indirectly from the platform driver probe function. Even if the driver is built in, it may be probed after free_initmem() due to deferral or unbinding/binding via sysfs. Thus the function cannot be marked as __init.
--- drivers/tty/serial/sifive.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/sifive.c +1 -1
@@ -844,7 +844,7 @@ static void sifive_serial_console_write(local_irq_restore (flags); } -static int __init sifive_serial_console_setup (struct console *co,char *options) +static int sifive_serial_console_setup (struct console *co,char *options) {struct sifive_serial_port *ssp;int baud =SIFIVE_DEFAULT_BAUD_RATE ;
Greg Kroah-Hartman
maintainerPATCH 70/201 USB: serial: option: support Quectel EM060K_128
In reply to Greg Kroah-HartmanFrom: Jerry Meng <[email protected]>
commit 4f7cab49cecee16120d27c1734cfdf3d6c0e5329 upstream.
EM060K_128 is EM060K's sub-model, having the same name "Quectel EM060K-GL"
MBIM + GNSS + DIAG + NMEA + AT + QDSS + DPL
T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0128 Rev= 5.04 S: Manufacturer=Quectel S: Product=Quectel EM060K-GL S: SerialNumber=f6fa08b6 C:* #Ifs= 8 Cfg#= 1 Atr=a0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00 I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I:* If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 6 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=70 Driver=(none)
E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 7 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
E: Ad=8f(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/serial/option.c +4 -0
@@ -251,6 +251,7 @@ static void option_instat_callback(struc#define QUECTEL_PRODUCT_EM061K_LTA 0x0123#define QUECTEL_PRODUCT_EM061K_LMS 0x0124#define QUECTEL_PRODUCT_EC25 0x0125 +#define QUECTEL_PRODUCT_EM060K_128 0x0128#define QUECTEL_PRODUCT_EG91 0x0191#define QUECTEL_PRODUCT_EG95 0x0195#define QUECTEL_PRODUCT_BG96 0x0296
@@ -1197,6 +1198,9 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0x00, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0xff, 0x30) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K, 0xff, 0xff, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0xff, 0x30) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0x00, 0x40) }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0xff, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0xff, 0x30) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0x00, 0x40) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0xff, 0x40) },
Greg Kroah-Hartman
maintainerPATCH 71/201 USB: serial: option: add Quectel EC200A module support
In reply to Greg Kroah-HartmanFrom: Mohsen Tahmasebi <[email protected]>
commit 857ea9005806e2a458016880278f98715873e977 upstream.
Add Quectel EC200A "DIAG, AT, MODEM":
0x6005: ECM / RNDIS + DIAG + AT + MODEM
T: Bus=01 Lev=01 Prnt=02 Port=05 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=6005 Rev=03.18 S: Manufacturer=Android S: Product=Android S: SerialNumber=0000 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether E: Ad=87(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether E: Ad=0c(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -269,6 +269,7 @@ static void option_instat_callback(struc#define QUECTEL_PRODUCT_RM520N 0x0801#define QUECTEL_PRODUCT_EC200U 0x0901#define QUECTEL_PRODUCT_EC200S_CN 0x6002 +#define QUECTEL_PRODUCT_EC200A 0x6005#define QUECTEL_PRODUCT_EM061K_LWW 0x6008#define QUECTEL_PRODUCT_EM061K_LCN 0x6009#define QUECTEL_PRODUCT_EC200T 0x6026
@@ -1229,6 +1230,7 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM520N, 0xff, 0, 0) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, 0x0900, 0xff, 0, 0), /* RM500U-CN */ .driver_info = ZLP }, + { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200A, 0xff, 0, 0) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200U, 0xff, 0, 0) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200S_CN, 0xff, 0, 0) }, { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) },
Greg Kroah-Hartman
maintainerPATCH 72/201 USB: serial: simple: add Kaufmann RKS+CAN VCP
In reply to Greg Kroah-HartmanFrom: Oliver Neukum <[email protected]>
commit dd92c8a1f99bcd166204ffc219ea5a23dd65d64f upstream.
Add the device and product ID for this CAN bus interface / license dongle. The device is usable either directly from user space or can be attached to a kernel CAN interface with slcan_attach.
--- drivers/usb/serial/usb-serial-simple.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/usb/serial/usb-serial-simple.c +7 -0
@@ -63,6 +63,11 @@ DEVICE(flashloader, FLASHLOADER_IDS); 0x01) }DEVICE (google,GOOGLE_IDS ); +/* KAUFMANN RKS+CAN VCP */ +#define KAUFMANN_IDS () \ + { USB_DEVICE(0x16d0, 0x0870) } +DEVICE (kaufmann,KAUFMANN_IDS ); +/* Libtransistor USB console */ #define LIBTRANSISTOR_IDS () \ { USB_DEVICE(0x1209, 0x8b00) }
@@ -124,6 +129,7 @@ static struct usb_serial_driver * const &funsoft_device, &flashloader_device, &google_device, + &kaufmann_device, &libtransistor_device, &vivopay_device, &moto_modem_device,
@@ -142,6 +148,7 @@ static const struct usb_device_id id_tabFUNSOFT_IDS (),FLASHLOADER_IDS (),GOOGLE_IDS (), +KAUFMANN_IDS (),LIBTRANSISTOR_IDS (),VIVOPAY_IDS (), MOTO_IDS(),
Greg Kroah-Hartman
maintainerPATCH 73/201 USB: serial: simple: sort driver entries
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit d245aedc00775c4d7265a9f4522cc4e1fd34d102 upstream.
Sort the driver symbols alphabetically in order to make it more obvious where new driver entries should be added.
--- drivers/usb/serial/usb-serial-simple.c | 66 ++++++++++++++++----------------- 1 file changed, 33 insertions(+), 33 deletions(-)
drivers/usb/serial/usb-serial-simple.c +33 -33
@@ -38,16 +38,6 @@ static struct usb_serial_driver vendor## { USB_DEVICE(0x0a21, 0x8001) } /* MMT-7305WW */DEVICE (carelink,CARELINK_IDS ); -/* ZIO Motherboard USB driver */ -#define ZIO_IDS () \ - { USB_DEVICE(0x1CBE, 0x0103) } -DEVICE (zio,ZIO_IDS ); - -/* Funsoft Serial USB driver */ -#define FUNSOFT_IDS () \ - { USB_DEVICE(0x1404, 0xcddc) } -DEVICE (funsoft,FUNSOFT_IDS ); -/* Infineon Flashloader driver */ #define FLASHLOADER_IDS () \ { USB_DEVICE_INTERFACE_CLASS(0x058b, 0x0041, USB_CLASS_CDC_DATA) }, \
@@ -55,6 +45,11 @@ DEVICE(funsoft, FUNSOFT_IDS); { USB_DEVICE(0x8087, 0x0801) }DEVICE (flashloader,FLASHLOADER_IDS ); +/* Funsoft Serial USB driver */ +#define FUNSOFT_IDS () \ + { USB_DEVICE(0x1404, 0xcddc) } +DEVICE (funsoft,FUNSOFT_IDS ); +/* Google Serial USB SubClass */ #define GOOGLE_IDS () \ { USB_VENDOR_AND_INTERFACE_INFO(0x18d1, \
@@ -63,6 +58,11 @@ DEVICE(flashloader, FLASHLOADER_IDS); 0x01) }DEVICE (google,GOOGLE_IDS ); +/* HP4x (48/49) Generic Serial driver */ +#define HP4X_IDS () \ + { USB_DEVICE(0x03f0, 0x0121) } +DEVICE (hp4x,HP4X_IDS ); +/* KAUFMANN RKS+CAN VCP */ #define KAUFMANN_IDS () \ { USB_DEVICE(0x16d0, 0x0870) }
@@ -73,11 +73,6 @@ DEVICE(kaufmann, KAUFMANN_IDS); { USB_DEVICE(0x1209, 0x8b00) }DEVICE (libtransistor,LIBTRANSISTOR_IDS ); -/* ViVOpay USB Serial Driver */ -#define VIVOPAY_IDS () \ - { USB_DEVICE(0x1d5f, 0x1004) }/* ViVOpay 8800 */ -DEVICE (vivopay,VIVOPAY_IDS ); -/* Motorola USB Phone driver */ #define MOTO_IDS () \ { USB_DEVICE(0x05c6, 0x3197) },/* unknown Motorola phone */ \
@@ -106,10 +101,10 @@ DEVICE(nokia, NOKIA_IDS); { USB_DEVICE(0x09d7, 0x0100) } /* NovAtel FlexPack GPS */DEVICE_N (novatel_gps,NOVATEL_IDS ,3 ); -/* HP4x (48/49) Generic Serial driver */ -#define HP4X_IDS () \ - { USB_DEVICE(0x03f0, 0x0121) } -DEVICE (hp4x,HP4X_IDS ); +/* Siemens USB/MPI adapter */ +#define SIEMENS_IDS () \ + { USB_DEVICE(0x908, 0x0004) } +DEVICE (siemens_mpi,SIEMENS_IDS );/* Suunto ANT+ USB Driver */ #define SUUNTO_IDS () \
@@ -117,47 +112,52 @@ DEVICE(hp4x, HP4X_IDS); { USB_DEVICE(0x0fcf, 0x1009) } /* Dynastream ANT USB-m Stick */DEVICE (suunto,SUUNTO_IDS ); -/* Siemens USB/MPI adapter */ -#define SIEMENS_IDS () \ - { USB_DEVICE(0x908, 0x0004) } -DEVICE (siemens_mpi,SIEMENS_IDS ); +/* ViVOpay USB Serial Driver */ +#define VIVOPAY_IDS () \ + { USB_DEVICE(0x1d5f, 0x1004) }/* ViVOpay 8800 */ +DEVICE (vivopay,VIVOPAY_IDS ); + +/* ZIO Motherboard USB driver */ +#define ZIO_IDS () \ + { USB_DEVICE(0x1CBE, 0x0103) } +DEVICE (zio,ZIO_IDS );/* All of the above structures mushed into two lists */ static struct usb_serial_driver *const serial_drivers[] = { &carelink_device, - &zio_device, - &funsoft_device, &flashloader_device, + &funsoft_device, &google_device, + &hp4x_device, &kaufmann_device, &libtransistor_device, - &vivopay_device, &moto_modem_device, &motorola_tetra_device, &nokia_device, &novatel_gps_device, - &hp4x_device, - &suunto_device, &siemens_mpi_device, + &suunto_device, + &vivopay_device, + &zio_device,NULL };static const struct usb_device_id id_table[] = {CARELINK_IDS (), -ZIO_IDS (), -FUNSOFT_IDS (),FLASHLOADER_IDS (), +FUNSOFT_IDS (),GOOGLE_IDS (), +HP4X_IDS (),KAUFMANN_IDS (),LIBTRANSISTOR_IDS (), -VIVOPAY_IDS (),MOTO_IDS (),MOTOROLA_TETRA_IDS (),NOKIA_IDS (),NOVATEL_IDS (), -HP4X_IDS (), -SUUNTO_IDS (),SIEMENS_IDS (), +SUUNTO_IDS (), +VIVOPAY_IDS (), +ZIO_IDS (), { }, };MODULE_DEVICE_TABLE (usb, id_table);
Greg Kroah-Hartman
maintainerPATCH 74/201 can: gs_usb: gs_can_close(): add missing set of CAN state to CAN_STATE_STOPPED
In reply to Greg Kroah-HartmanFrom: Marc Kleine-Budde <[email protected]>
commit f8a2da6ec2417cca169fa85a8ab15817bccbb109 upstream.
After an initial link up the CAN device is in ERROR-ACTIVE mode. Due to a missing CAN_STATE_STOPPED in gs_can_close() it doesn't change to STOPPED after a link down:
| ip link set dev can0 up | ip link set dev can0 down | ip --details link show can0 | 13: can0: <NOARP,ECHO> mtu 16 qdisc pfifo_fast state DOWN mode DEFAULT group default qlen 10 | link/can promiscuity 0 allmulti 0 minmtu 0 maxmtu 0 | can state ERROR-ACTIVE restart-ms 1000
Add missing assignment of CAN_STATE_STOPPED in gs_can_close().
--- drivers/net/can/usb/gs_usb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/can/usb/gs_usb.c +2 -0
@@ -732,6 +732,8 @@ static int gs_can_close(struct net_devicusb_kill_anchored_urbs (&dev->tx_submitted);atomic_set (&dev->active_tx_urbs,0 ); + dev->can.state =CAN_STATE_STOPPED ; +/* reset the device */ rc =gs_cmd_reset (dev);if (rc <0 )
Greg Kroah-Hartman
maintainerPATCH 75/201 Revert "usb: dwc3: core: Enable AutoRetry feature in the controller"
In reply to Greg Kroah-HartmanFrom: Jakub Vanek <[email protected]>
commit 734ae15ab95a18d3d425fc9cb38b7a627d786f08 upstream.
This reverts commit b138e23d3dff90c0494925b4c1874227b81bddf7.
AutoRetry has been found to sometimes cause controller freezes when communicating with buggy USB devices.
This controller feature allows the controller in host mode to send non-terminating/burst retry ACKs instead of terminating retry ACKs to devices when a transaction error (CRC error or overflow) occurs.
Unfortunately, if the USB device continues to respond with a CRC error, the controller will not complete endpoint-related commands while it keeps trying to auto-retry. [3] The xHCI driver will notice this once it tries to abort the transfer using a Stop Endpoint command and does not receive a completion in time. [1]
This situation is reported to dmesg:
[sda] tag#29 uas_eh_abort_handler 0 uas-tag 1 inflight: CMD IN [sda] tag#29 CDB: opcode=0x28 28 00 00 69 42 80 00 00 48 00
xhci-hcd: xHCI host not responding to stop endpoint command
xhci-hcd: xHCI host controller not responding, assume dead
xhci-hcd: HC died; cleaning up
Some users observed this problem on an Odroid HC2 with the JMS578 USB3-to-SATA bridge. The issue can be triggered by starting a read-heavy workload on an attached SSD. After a while, the host controller would die and the SSD would disappear from the system. [1]
Further analysis by Synopsys determined that controller revisions other than the one in Odroid HC2 are also affected by this. The recommended solution was to disable AutoRetry altogether. This change does not have a noticeable performance impact. [2]
Revert the enablement commit. This will keep the AutoRetry bit in the default state configured during SoC design [2].
--- drivers/usb/dwc3/core.c | 16 ---------------- drivers/usb/dwc3/core.h | 3 --- 2 files changed, 19 deletions(-)
drivers/usb/dwc3/core.c +0 -16
@@ -1066,22 +1066,6 @@ static int dwc3_core_init(struct dwc3 *ddwc3_writel (dwc->regs,DWC3_GUCTL1 , reg); } -if (dwc->dr_mode ==USB_DR_MODE_HOST || - dwc->dr_mode ==USB_DR_MODE_OTG ) { - reg =dwc3_readl (dwc->regs,DWC3_GUCTL ); - -/* -* Enable Auto retry Feature to make the controller operating in -* Host mode on seeing transaction errors(CRC errors or internal -* overrun scenerios) on IN transfers to reply to the device -* with a non-terminating retry ACK (i.e, an ACK transcation -* packet with Retry=1 & Nump != 0) -*/ - reg |=DWC3_GUCTL_HSTINAUTORETRY ; - -dwc3_writel (dwc->regs,DWC3_GUCTL , reg); - } -/* * Must config both number of packets and max burst settings to enable * RX and/or TX threshold.
drivers/usb/dwc3/core.h +0 -3
@@ -249,9 +249,6 @@#define DWC3_GCTL_GBLHIBERNATIONEN BIT(1)#define DWC3_GCTL_DSBLCLKGTNG BIT(0) -/* Global User Control Register */ -#define DWC3_GUCTL_HSTINAUTORETRY BIT(14) -/* Global User Control 1 Register */ #define DWC3_GUCTL1_PARKMODE_DISABLE_SS BIT(17)#define DWC3_GUCTL1_TX_IPGAP_LINECHECK_DIS BIT(28)
Greg Kroah-Hartman
maintainerPATCH 76/201 usb: dwc3: pci: skip BYT GPIO lookup table for hardwired phy
In reply to Greg Kroah-HartmanFrom: Gratian Crisan <[email protected]>
commit b32b8f2b9542d8039f5468303a6ca78c1b5611a5 upstream.
Hardware based on the Bay Trail / BYT SoCs require an external ULPI phy for USB device-mode. The phy chip usually has its 'reset' and 'chip select' lines connected to GPIOs described by ACPI fwnodes in the DSDT table.
Because of hardware with missing ACPI resources for the 'reset' and 'chip select' GPIOs commit 5741022cbdf3 ("usb: dwc3: pci: Add GPIO lookup table on platforms without ACPI GPIO resources") introduced a fallback gpiod_lookup_table with hard-coded mappings for Bay Trail devices.
However there are existing Bay Trail based devices, like the National Instruments cRIO-903x series, where the phy chip has its 'reset' and 'chip-select' lines always asserted in hardware via resistor pull-ups. On this hardware the phy chip is always enabled and the ACPI dsdt table is missing information not only for the 'chip-select' and 'reset' lines but also for the BYT GPIO controller itself "INT33FC".
With the introduction of the gpiod_lookup_table initializing the USB device-mode on these hardware now errors out. The error comes from the gpiod_get_optional() calls in dwc3_pci_quirks() which will now return an -ENOENT error due to the missing ACPI entry for the INT33FC gpio controller used in the aforementioned table.
This hardware used to work before because gpiod_get_optional() will return NULL instead of -ENOENT if no GPIO has been assigned to the requested function. The dwc3_pci_quirks() code for setting the 'cs' and 'reset' GPIOs was then skipped (due to the NULL return). This is the correct behavior in cases where the phy chip is hardwired and there are no GPIOs to control.
Since the gpiod_lookup_table relies on the presence of INT33FC fwnode in ACPI tables only add the table if we know the entry for the INT33FC gpio controller is present. This allows Bay Trail based devices with hardwired dwc3 ULPI phys to continue working.
--- drivers/usb/dwc3/dwc3-pci.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/usb/dwc3/dwc3-pci.c +4 -2
@@ -173,10 +173,12 @@ static int dwc3_pci_quirks(struct dwc3_p/* * A lot of BYT devices lack ACPI resource entries for -* the GPIOs, add a fallback mapping to the reference +* the GPIOs. If the ACPI entry for the GPIO controller +* is present add a fallback mapping to the reference * design GPIOs which all boards seem to use. */ -gpiod_add_lookup_table (&platform_bytcr_gpios); +if (acpi_dev_present ("INT33FC" ,NULL ,-1 )) +gpiod_add_lookup_table (&platform_bytcr_gpios);/* * These GPIOs will turn on the USB2 PHY. Note that we have to
Greg Kroah-Hartman
maintainerPATCH 77/201 usb: dwc3: dont reset device side if dwc3 was configured as host-only
In reply to Greg Kroah-HartmanFrom: Jisheng Zhang <[email protected]>
commit e835c0a4e23c38531dcee5ef77e8d1cf462658c7 upstream.
Commit c4a5153e87fd ("usb: dwc3: core: Power-off core/PHYs on system_suspend in host mode") replaces check for HOST only dr_mode with current_dr_role. But during booting, the current_dr_role isn't initialized, thus the device side reset is always issued even if dwc3 was configured as host-only. What's more, on some platforms with host only dwc3, aways issuing device side reset by accessing device register block can cause kernel panic.
--- drivers/usb/dwc3/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/dwc3/core.c +2 -2
@@ -275,9 +275,9 @@ int dwc3_core_soft_reset(struct dwc3 *dw/* * We're resetting only the device side because, if we're in host mode, * XHCI driver will reset the host block. If dwc3 was configured for -* host-only mode, then we can return early. +* host-only mode or current role is host, then we can return early. */ -if (dwc->current_dr_role ==DWC3_GCTL_PRTCAP_HOST ) +if (dwc->dr_mode ==USB_DR_MODE_HOST || dwc->current_dr_role ==DWC3_GCTL_PRTCAP_HOST )return 0 ; reg =dwc3_readl (dwc->regs,DWC3_DCTL );
Greg Kroah-Hartman
maintainerPATCH 78/201 usb: ohci-at91: Fix the unhandle interrupt when resume
In reply to Greg Kroah-HartmanFrom: Guiting Shen <[email protected]>
commit c55afcbeaa7a6f4fffdbc999a9bf3f0b29a5186f upstream.
The ohci_hcd_at91_drv_suspend() sets ohci->rh_state to OHCI_RH_HALTED when suspend which will let the ohci_irq() skip the interrupt after resume. And nobody to handle this interrupt.
According to the comment in ohci_hcd_at91_drv_suspend(), it need to reset when resume from suspend(MEM) to fix by setting "hibernated" argument of ohci_resume().
--- drivers/usb/host/ohci-at91.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/usb/host/ohci-at91.c +7 -1
@@ -647,7 +647,13 @@ ohci_hcd_at91_drv_resume(struct device *else at91_start_clock (ohci_at91); -ohci_resume (hcd, false); +/* +* According to the comment in ohci_hcd_at91_drv_suspend() +* we need to do a reset if the 48Mhz clock was stopped, +* that is, if ohci_at91->wakeup is clear. Tell ohci_resume() +* to reset in this case by setting its "hibernated" flag. +*/ +ohci_resume (hcd, !ohci_at91->wakeup);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 79/201 USB: quirks: add quirk for Focusrite Scarlett
In reply to Greg Kroah-HartmanFrom: Łukasz Bartosik <[email protected]>
commit 9dc162e22387080e2d06de708b89920c0e158c9a upstream.
The Focusrite Scarlett audio device does not behave correctly during resumes. Below is what happens during every resume (captured with Beagle 5000):
<Suspend>
<Resume>
<Reset>/<Chirp J>/<Tiny J>
<Reset/Target disconnected>
<High Speed>
The Scarlett disconnects and is enumerated again.
However from time to time it drops completely off the USB bus during resume. Below is captured occurrence of such an event:
<Suspend>
<Resume>
<Reset>/<Chirp J>/<Tiny J>
<Reset>/<Chirp K>/<Tiny K>
<High Speed>
<Corrupted packet>
<Reset/Target disconnected>
To fix the condition a user has to unplug and plug the device again.
With USB_QUIRK_RESET_RESUME applied ("usbcore.quirks=1235:8211:b") for the Scarlett audio device the issue still reproduces.
Applying USB_QUIRK_DISCONNECT_SUSPEND ("usbcore.quirks=1235:8211:m") fixed the issue and the Scarlett audio device didn't drop off the USB bus for ~5000 suspend/resume cycles where originally issue reproduced in ~100 or less suspend/resume cycles.
--- drivers/usb/core/quirks.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/core/quirks.c +4 -0
@@ -437,6 +437,10 @@ static const struct usb_device_id usb_qu/* novation SoundControl XL */ { USB_DEVICE(0x1235, 0x0061), .driver_info = USB_QUIRK_RESET_RESUME }, + /* Focusrite Scarlett Solo USB */ + { USB_DEVICE(0x1235, 0x8211), .driver_info = + USB_QUIRK_DISCONNECT_SUSPEND }, + /* Huawei 4G LTE module */ { USB_DEVICE(0x12d1, 0x15bb), .driver_info = USB_QUIRK_DISCONNECT_SUSPEND },
Greg Kroah-Hartman
maintainerPATCH 80/201 usb: xhci-mtk: set the dma max_seg_size
In reply to Greg Kroah-HartmanFrom: Ricardo Ribalda <[email protected]>
commit 9fd10829a9eb482e192a845675ecc5480e0bfa10 upstream.
Allow devices to have dma operations beyond 64K, and avoid warnings such as:
DMA-API: xhci-mtk 11200000.usb: mapping sg segment longer than device claims to support [len=98304] [max=65536]
--- drivers/usb/host/xhci-mtk.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/host/xhci-mtk.c +1 -0
@@ -535,6 +535,7 @@ static int xhci_mtk_probe(struct platfor }device_init_wakeup (dev, true); +dma_set_max_seg_size (dev,UINT_MAX ); xhci =hcd_to_xhci (hcd); xhci->main_hcd = hcd;
Greg Kroah-Hartman
maintainerPATCH 81/201 Revert "usb: xhci: tegra: Fix error check"
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit 288b4fa1798e3637a9304c6e90a93d900e02369c upstream.
This reverts commit 18fc7c435be3f17ea26a21b2e2312fcb9088e01f.
The reverted commit was based on static analysis and a misunderstanding of how PTR_ERR() and NULLs are supposed to work. When a function returns both pointer errors and NULL then normally the NULL means "continue operating without a feature because it was deliberately turned off". The NULL should not be treated as a failure. If a driver cannot work when that feature is disabled then the KConfig should enforce that the function cannot return NULL. We should not need to test for it.
In this code, the patch means that certain tegra_xusb_probe() will fail if the firmware supports power-domains but CONFIG_PM is disabled.
--- drivers/usb/host/xhci-tegra.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/usb/host/xhci-tegra.c +4 -4
@@ -1042,15 +1042,15 @@ static int tegra_xusb_powerdomain_init(sint err; tegra->genpd_dev_host =dev_pm_domain_attach_by_name (dev,"xusb_host" ); -if (IS_ERR_OR_NULL (tegra->genpd_dev_host)) { - err =PTR_ERR (tegra->genpd_dev_host) ? : -ENODATA ; +if (IS_ERR (tegra->genpd_dev_host)) { + err =PTR_ERR (tegra->genpd_dev_host);dev_err (dev,"failed to get host pm-domain: %d\n" , err);return err; } tegra->genpd_dev_ss =dev_pm_domain_attach_by_name (dev,"xusb_ss" ); -if (IS_ERR_OR_NULL (tegra->genpd_dev_ss)) { - err =PTR_ERR (tegra->genpd_dev_ss) ? : -ENODATA ; +if (IS_ERR (tegra->genpd_dev_ss)) { + err =PTR_ERR (tegra->genpd_dev_ss);dev_err (dev,"failed to get superspeed pm-domain: %d\n" , err);return err; }
Greg Kroah-Hartman
maintainerPATCH 82/201 Documentation: security-bugs.rst: update preferences when dealing with the linux-distros group
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
commit 4fee0915e649bd0cea56dece6d96f8f4643df33c upstream.
Because the linux-distros group forces reporters to release information about reported bugs, and they impose arbitrary deadlines in having those bugs fixed despite not actually being kernel developers, the kernel security team recommends not interacting with them at all as this just causes confusion and the early-release of reported security problems.
--- Documentation/admin-guide/security-bugs.rst | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-)
Documentation/admin-guide/security-bugs.rst +11 -13
@@ -63,20 +63,18 @@ information submitted to the security li of the report are treated confidentially even after the embargo has been lifted, in perpetuity. -Coordination ------------- +Coordination with other groups +------------------------------ -Fixes for sensitive bugs, such as those that might lead to privilege -escalations, may need to be coordinated with the private -<[email protected]> mailing list so that distribution vendors -are well prepared to issue a fixed kernel upon public disclosure of the -upstream fix. Distros will need some time to test the proposed patch and -will generally request at least a few days of embargo, and vendor update -publication prefers to happen Tuesday through Thursday. When appropriate, -the security team can assist with this coordination, or the reporter can -include linux-distros from the start. In this case, remember to prefix -the email Subject line with "[vs]" as described in the linux-distros wiki: -<http://oss-security.openwall.org/wiki/mailing-lists/distros#how-to-use-the-lists> +The kernel security team strongly recommends that reporters of potential +security issues NEVER contact the "linux-distros" mailing list until +AFTER discussing it with the kernel security team. Do not Cc: both +lists at once. You may contact the linux-distros mailing list after a +fix has been agreed on and you fully understand the requirements that +doing so will impose on you and the kernel community. + +The different lists have different goals and the linux-distros rules do +not contribute to actually fixing any potential security problems. CVE assignment --------------
Greg Kroah-Hartman
maintainerPATCH 83/201 Documentation: security-bugs.rst: clarify CVE handling
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
commit 3c1897ae4b6bc7cc586eda2feaa2cd68325ec29c upstream.
The kernel security team does NOT assign CVEs, so document that properly and provide the "if you want one, ask MITRE for it" response that we give on a weekly basis in the document, so we don't have to constantly say it to everyone who asks.
--- Documentation/admin-guide/security-bugs.rst | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
Documentation/admin-guide/security-bugs.rst +6 -7
@@ -79,13 +79,12 @@ not contribute to actually fixing any po CVE assignment -------------- -The security team does not normally assign CVEs, nor do we require them -for reports or fixes, as this can needlessly complicate the process and -may delay the bug handling. If a reporter wishes to have a CVE identifier -assigned ahead of public disclosure, they will need to contact the private -linux-distros list, described above. When such a CVE identifier is known -before a patch is provided, it is desirable to mention it in the commit -message if the reporter agrees. +The security team does not assign CVEs, nor do we require them for +reports or fixes, as this can needlessly complicate the process and may +delay the bug handling. If a reporter wishes to have a CVE identifier +assigned, they should find one by themselves, for example by contacting +MITRE directly. However under no circumstances will a patch inclusion +be delayed to wait for a CVE identifier to arrive. Non-disclosure agreements -------------------------
Greg Kroah-Hartman
maintainerPATCH 84/201 staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext()
In reply to Greg Kroah-HartmanFrom: Zhang Shurong <[email protected]>
commit 5f1c7031e044cb2fba82836d55cc235e2ad619dc upstream.
The "exc->key_len" is a u16 that comes from the user. If it's over IW_ENCODING_TOKEN_MAX (64) that could lead to memory corruption.
--- drivers/staging/ks7010/ks_wlan_net.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/staging/ks7010/ks_wlan_net.c +4 -2
@@ -1584,8 +1584,10 @@ static int ks_wlan_set_encode_ext(struct commit |=SME_WEP_FLAG ; }if (enc->key_len) { -memcpy (&key->key_val[0 ], &enc->key[0 ], enc->key_len); - key->key_len = enc->key_len; +int key_len =clamp_val (enc->key_len,0 ,IW_ENCODING_TOKEN_MAX ); + +memcpy (&key->key_val[0 ], &enc->key[0 ], key_len); + key->key_len = key_len; commit |= (SME_WEP_VAL1 << index); }break ;
Greg Kroah-Hartman
maintainerPATCH 85/201 tty: n_gsm: fix UAF in gsm_cleanup_mux
In reply to Greg Kroah-HartmanFrom: Chaoyuan Peng <[email protected]>
commit 9b9c8195f3f0d74a826077fc1c01b9ee74907239 upstream.
In gsm_cleanup_mux() the 'gsm->dlci' pointer was not cleaned properly, leaving it a dangling pointer after gsm_dlci_release.
This leads to use-after-free where 'gsm->dlci[0]' are freed and accessed by the subsequent gsm_cleanup_mux().
Such is the case in the following call trace:
<TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106 print_address_description+0x63/0x3b0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0x16b/0x1c0 mm/kasan/report.c:451 gsm_cleanup_mux+0x76a/0x850 drivers/tty/n_gsm.c:2397 gsm_config drivers/tty/n_gsm.c:2653 [inline] gsmld_ioctl+0xaae/0x15b0 drivers/tty/n_gsm.c:2986 tty_ioctl+0x8ff/0xc50 drivers/tty/tty_io.c:2816 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb </TASK> Allocated by task 3501: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] ____kasan_kmalloc+0xba/0xf0 mm/kasan/common.c:513 kasan_kmalloc include/linux/kasan.h:264 [inline] kmem_cache_alloc_trace+0x143/0x290 mm/slub.c:3247 kmalloc include/linux/slab.h:591 [inline] kzalloc include/linux/slab.h:721 [inline] gsm_dlci_alloc+0x53/0x3a0 drivers/tty/n_gsm.c:1932 gsm_activate_mux+0x1c/0x330 drivers/tty/n_gsm.c:2438 gsm_config drivers/tty/n_gsm.c:2677 [inline] gsmld_ioctl+0xd46/0x15b0 drivers/tty/n_gsm.c:2986 tty_ioctl+0x8ff/0xc50 drivers/tty/tty_io.c:2816 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb Freed by task 3501: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4b/0x80 mm/kasan/common.c:46 kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360 ____kasan_slab_free+0xd8/0x120 mm/kasan/common.c:366 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:1705 [inline] slab_free_freelist_hook+0xdd/0x160 mm/slub.c:1731 slab_free mm/slub.c:3499 [inline] kfree+0xf1/0x270 mm/slub.c:4559 dlci_put drivers/tty/n_gsm.c:1988 [inline] gsm_dlci_release drivers/tty/n_gsm.c:2021 [inline] gsm_cleanup_mux+0x574/0x850 drivers/tty/n_gsm.c:2415 gsm_config drivers/tty/n_gsm.c:2653 [inline] gsmld_ioctl+0xaae/0x15b0 drivers/tty/n_gsm.c:2986 tty_ioctl+0x8ff/0xc50 drivers/tty/tty_io.c:2816 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb
--- drivers/tty/n_gsm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/tty/n_gsm.c +3 -1
@@ -2178,8 +2178,10 @@ static void gsm_cleanup_mux(struct gsm_m/* Free up any link layer users and finally the control channel */ for (i =NUM_DLCI -1 ; i >=0 ; i--) -if (gsm->dlci[i]) +if (gsm->dlci[i]) {gsm_dlci_release (gsm->dlci[i]); + gsm->dlci[i] =NULL ; + }mutex_unlock (&gsm->mutex);/* Now wipe the queues */ tty_ldisc_flush (gsm->tty);
Greg Kroah-Hartman
maintainerPATCH 86/201 ALSA: hda/relatek: Enable Mute LED on HP 250 G8
In reply to Greg Kroah-HartmanFrom: Luka Guzenko <[email protected]>
commit d510acb610e6aa07a04b688236868b2a5fd60deb upstream.
This HP Notebook used ALC236 codec with COEF 0x07 idx 1 controlling the mute LED. Enable already existing quirk for this device.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -9015,6 +9015,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x103c ,0x880d ,"HP EliteBook 830 G8 Notebook PC" ,ALC285_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8811 ,"HP Spectre x360 15-eb1xxx" ,ALC285_FIXUP_HP_SPECTRE_X360_EB1 ),SND_PCI_QUIRK (0x103c ,0x8812 ,"HP Spectre x360 15-eb1xxx" ,ALC285_FIXUP_HP_SPECTRE_X360_EB1 ), +SND_PCI_QUIRK (0x103c ,0x881d ,"HP 250 G8 Notebook PC" ,ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 ),SND_PCI_QUIRK (0x103c ,0x8846 ,"HP EliteBook 850 G8 Notebook PC" ,ALC285_FIXUP_HP_GPIO_LED ),SND_PCI_QUIRK (0x103c ,0x8847 ,"HP EliteBook x360 830 G8 Notebook PC" ,ALC285_FIXUP_HP_GPIO_LED ), SND_PCI_QUIRK(0x103c, 0x884b, "HP EliteBook 840 Aero G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED),
Greg Kroah-Hartman
maintainerPATCH 87/201 hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled
In reply to Greg Kroah-HartmanFrom: Gilles Buloz <[email protected]>
commit 54685abe660a59402344d5045ce08c43c6a5ac42 upstream.
Because of hex value 0x46 used instead of decimal 46, the temp6 (PECI1) temperature is always declared visible and then displayed even if disabled in the chip
--- drivers/hwmon/nct7802.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/nct7802.c +1 -1
@@ -708,7 +708,7 @@ static umode_t nct7802_temp_is_visible(sif (index >=38 && index <46 && !(reg &0x01 ))/* PECI 0 */ return 0 ; -if (index >=0x46 && (!(reg &0x02 )))/* PECI 1 */ +if (index >=46 && !(reg &0x02 ))/* PECI 1 */ return 0 ;return attr->mode;
Greg Kroah-Hartman
maintainerPATCH 88/201 btrfs: check for commit error at btrfs_attach_transaction_barrier()
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit b28ff3a7d7e97456fd86b68d24caa32e1cfa7064 upstream.
btrfs_attach_transaction_barrier() is used to get a handle pointing to the current running transaction if the transaction has not started its commit yet (its state is < TRANS_STATE_COMMIT_START). If the transaction commit has started, then we wait for the transaction to commit and finish before returning - however we completely ignore if the transaction was aborted due to some error during its commit, we simply return ERR_PT(-ENOENT), which makes the caller assume everything is fine and no errors happened.
This could make an fsync return success (0) to user space when in fact we had a transaction abort and the target inode changes were therefore not persisted.
Fix this by checking for the return value from btrfs_wait_for_commit(), and if it returned an error, return it back to the caller.
--- fs/btrfs/transaction.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
fs/btrfs/transaction.c +7 -2
@@ -821,8 +821,13 @@ btrfs_attach_transaction_barrier(struct trans =start_transaction (root,0 ,TRANS_ATTACH ,BTRFS_RESERVE_NO_FLUSH , true); -if (trans ==ERR_PTR (-ENOENT )) -btrfs_wait_for_commit (root->fs_info,0 ); +if (trans ==ERR_PTR (-ENOENT )) { +int ret; + + ret =btrfs_wait_for_commit (root->fs_info,0 ); +if (ret) +return ERR_PTR (ret); + }return trans; }
Greg Kroah-Hartman
maintainerPATCH 89/201 file: always lock position for FMODE_ATOMIC_POS
In reply to Greg Kroah-HartmanFrom: Christian Brauner <[email protected]>
commit 20ea1e7d13c1b544fe67c4a8dc3943bb1ab33e6f upstream.
The pidfd_getfd() system call allows a caller with ptrace_may_access() abilities on another process to steal a file descriptor from this process. This system call is used by debuggers, container runtimes, system call supervisors, networking proxies etc. So while it is a special interest system call it is used in common tools.
That ability ends up breaking our long-time optimization in fdget_pos(), which "knew" that if we had exclusive access to the file descriptor nobody else could access it, and we didn't need the lock for the file position.
That check for file_count(file) was always fairly subtle - it depended on __fdget() not incrementing the file count for single-threaded processes and thus included that as part of the rule - but it did mean that we didn't need to take the lock in all those traditional unix process contexts.
So it's sad to see this go, and I'd love to have some way to re-instate the optimization. At the same time, the lock obviously isn't ever contended in the case we optimized, so all we were optimizing away is the atomics and the cacheline dirtying. Let's see if anybody even notices that the optimization is gone.
--- fs/file.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
fs/file.c +2 -4
@@ -1013,10 +1013,8 @@ unsigned long __fdget_pos(unsigned int fstruct file *file = (struct file *)(v & ~3 );if (file && (file->f_mode &FMODE_ATOMIC_POS )) { -if (file_count (file) >1 ) { - v |=FDPUT_POS_UNLOCK ; -mutex_lock (&file->f_pos_lock); - } + v |=FDPUT_POS_UNLOCK ; +mutex_lock (&file->f_pos_lock); }return v; }
Greg Kroah-Hartman
maintainerPATCH 90/201 nfsd: Remove incorrect check in nfsd4_validate_stateid
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
commit f75546f58a70da5cfdcec5a45ffc377885ccbee8 upstream.
If the client is calling TEST_STATEID, then it is because some event occurred that requires it to check all the stateids for validity and call FREE_STATEID on the ones that have been revoked. In this case, either the stateid exists in the list of stateids associated with that nfs4_client, in which case it should be tested, or it does not. There are no additional conditions to be considered.
--- fs/nfsd/nfs4state.c | 2 -- 1 file changed, 2 deletions(-)
fs/nfsd/nfs4state.c +0 -2
@@ -5656,8 +5656,6 @@ static __be32 nfsd4_validate_stateid(strif (ZERO_STATEID (stateid) ||ONE_STATEID (stateid) ||CLOSE_STATEID (stateid))return status; -if (!same_clid (&stateid->si_opaque.so_clid, &cl->cl_clientid)) -return status;spin_lock (&cl->cl_lock); s =find_stateid_locked (cl, stateid);if (!s)
Greg Kroah-Hartman
maintainerPATCH 91/201 tpm_tis: Explicitly check for error code
In reply to Greg Kroah-HartmanFrom: Alexander Steffen <[email protected]>
commit 513253f8c293c0c8bd46d09d337fc892bf8f9f48 upstream.
recv_data either returns the number of received bytes, or a negative value representing an error code. Adding the return value directly to the total number of received bytes therefore looks a little weird, since it might add a negative error code to a sum of bytes.
The following check for size < expected usually makes the function return ETIME in that case, so it does not cause too many problems in practice. But to make the code look cleaner and because the caller might still be interested in the original error code, explicitly check for the presence of an error code and pass that through.
--- drivers/char/tpm/tpm_tis_core.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/char/tpm/tpm_tis_core.c +8 -2
@@ -314,6 +314,7 @@ static int tpm_tis_recv(struct tpm_chipint size =0 ;int status;u32 expected; +int rc;if (count <TPM_HEADER_SIZE ) { size = -EIO ;
@@ -333,8 +334,13 @@ static int tpm_tis_recv(struct tpm_chip goto out; } - size +=recv_data (chip, &buf[TPM_HEADER_SIZE ], - expected -TPM_HEADER_SIZE ); + rc =recv_data (chip, &buf[TPM_HEADER_SIZE ], + expected -TPM_HEADER_SIZE ); +if (rc <0 ) { + size = rc; + goto out; + } + size += rc;if (size < expected) {dev_err (&chip->dev,"Unable to read remainder of result\n" ); size = -ETIME ;
Greg Kroah-Hartman
maintainerPATCH 92/201 irq-bcm6345-l1: Do not assume a fixed block to cpu mapping
In reply to Greg Kroah-HartmanFrom: Jonas Gorski <[email protected]>
[ Upstream commit 55ad24857341c36616ecc1d9580af5626c226cf1 ]
The irq to block mapping is fixed, and interrupts from the first block will always be routed to the first parent IRQ. But the parent interrupts themselves can be routed to any available CPU.
This is used by the bootloader to map the first parent interrupt to the boot CPU, regardless wether the boot CPU is the first one or the second one.
When booting from the second CPU, the assumption that the first block's IRQ is mapped to the first CPU breaks, and the system hangs because interrupts do not get routed correctly.
Fix this by passing the appropriate bcm6434_l1_cpu to the interrupt handler instead of the chip itself, so the handler always has the right block.
--- drivers/irqchip/irq-bcm6345-l1.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-)
drivers/irqchip/irq-bcm6345-l1.c +5 -9
@@ -82,6 +82,7 @@ struct bcm6345_l1_chip { };struct bcm6345_l1_cpu { +struct bcm6345_l1_chip *intc;void __iomem *map_base;unsigned int parent_irq;u32 enable_cache[];
@@ -115,17 +116,11 @@ static inline unsigned int cpu_for_irq(struct bcm6345_l1_chip *intc,static void bcm6345_l1_irq_handle (struct irq_desc *desc) { -struct bcm6345_l1_chip *intc =irq_desc_get_handler_data (desc); -struct bcm6345_l1_cpu *cpu; +struct bcm6345_l1_cpu *cpu =irq_desc_get_handler_data (desc); +struct bcm6345_l1_chip *intc = cpu->intc;struct irq_chip *chip =irq_desc_get_chip (desc);unsigned int idx; -#ifdef CONFIG_SMP - cpu = intc->cpus[cpu_logical_map (smp_processor_id ())]; -#else - cpu = intc->cpus[0 ]; -#endif -chained_irq_enter (chip, desc);for (idx =0 ; idx < intc->n_words; idx++) {
@@ -257,6 +252,7 @@ static int __init bcm6345_l1_init_one(struct device_node *dn,if (!cpu)return -ENOMEM ; + cpu->intc = intc; cpu->map_base =ioremap (res.start, sz);if (!cpu->map_base)return -ENOMEM ;
@@ -272,7 +268,7 @@ static int __init bcm6345_l1_init_one(struct device_node *dn,return -EINVAL ; }irq_set_chained_handler_and_data (cpu->parent_irq, - bcm6345_l1_irq_handle, intc); + bcm6345_l1_irq_handle, cpu);return 0 ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 93/201 irqchip/gic-v4.1: Properly lock VPEs when doing a directLPI invalidation
In reply to Greg Kroah-HartmanFrom: Marc Zyngier <[email protected]>
[ Upstream commit 926846a703cbf5d0635cc06e67d34b228746554b ]
We normally rely on the irq_to_cpuid_[un]lock() primitives to make sure nothing will change col->idx while performing a LPI invalidation.
However, these primitives do not cover VPE doorbells, and we have some open-coded locking for that. Unfortunately, this locking is pretty bogus.
Instead, extend the above primitives to cover VPE doorbells and convert the whole thing to it.
--- drivers/irqchip/irq-gic-v3-its.c | 75 ++++++++++++++++++++------------ 1 file changed, 46 insertions(+), 29 deletions(-)
drivers/irqchip/irq-gic-v3-its.c +46 -29
@@ -267,13 +267,23 @@ static void vpe_to_cpuid_unlock(struct its_vpe *vpe, unsigned long flags)raw_spin_unlock_irqrestore (&vpe->vpe_lock, flags); } +static struct irq_chip its_vpe_irq_chip; +static int irq_to_cpuid_lock (struct irq_data *d,unsigned long *flags) { -struct its_vlpi_map *map =get_vlpi_map (d); +struct its_vpe *vpe =NULL ;int cpu; -if (map) { - cpu =vpe_to_cpuid_lock (map->vpe, flags); +if (d->chip == &its_vpe_irq_chip) { + vpe =irq_data_get_irq_chip_data (d); + }else { +struct its_vlpi_map *map =get_vlpi_map (d); +if (map) + vpe = map->vpe; + } + +if (vpe) { + cpu =vpe_to_cpuid_lock (vpe, flags); }else {/* Physical LPIs are already locked via the irq_desc lock */ struct its_device *its_dev =irq_data_get_irq_chip_data (d);
@@ -287,10 +297,18 @@ static int irq_to_cpuid_lock(struct irq_data *d, unsigned long *flags)static void irq_to_cpuid_unlock (struct irq_data *d,unsigned long flags) { -struct its_vlpi_map *map =get_vlpi_map (d); +struct its_vpe *vpe =NULL ; + +if (d->chip == &its_vpe_irq_chip) { + vpe =irq_data_get_irq_chip_data (d); + }else { +struct its_vlpi_map *map =get_vlpi_map (d); +if (map) + vpe = map->vpe; + } -if (map) -vpe_to_cpuid_unlock (map->vpe, flags); +if (vpe) +vpe_to_cpuid_unlock (vpe, flags); }static struct its_collection *valid_col (struct its_collection *col)
@@ -1422,14 +1440,29 @@ static void wait_for_syncr(void __iomem *rdbase)cpu_relax (); } -static void direct_lpi_inv (struct irq_data *d) +static void __direct_lpi_inv (struct irq_data *d,u64 val) { -struct its_vlpi_map *map =get_vlpi_map (d);void __iomem *rdbase;unsigned long flags; -u64 val;int cpu; +/* Target the redistributor this LPI is currently routed to */ + cpu =irq_to_cpuid_lock (d, &flags); +raw_spin_lock (&gic_data_rdist_cpu (cpu)->rd_lock); + + rdbase =per_cpu_ptr (gic_rdists->rdist, cpu)->rd_base; +gic_write_lpir (val, rdbase +GICR_INVLPIR ); +wait_for_syncr (rdbase); + +raw_spin_unlock (&gic_data_rdist_cpu (cpu)->rd_lock); +irq_to_cpuid_unlock (d, flags); +} + +static void direct_lpi_inv (struct irq_data *d) +{ +struct its_vlpi_map *map =get_vlpi_map (d); +u64 val; +if (map) {struct its_device *its_dev =irq_data_get_irq_chip_data (d);
@@ -1442,15 +1475,7 @@ static void direct_lpi_inv(struct irq_data *d) val = d->hwirq; } -/* Target the redistributor this LPI is currently routed to */ - cpu =irq_to_cpuid_lock (d, &flags); -raw_spin_lock (&gic_data_rdist_cpu (cpu)->rd_lock); - rdbase =per_cpu_ptr (gic_rdists->rdist, cpu)->rd_base; -gic_write_lpir (val, rdbase +GICR_INVLPIR ); - -wait_for_syncr (rdbase); -raw_spin_unlock (&gic_data_rdist_cpu (cpu)->rd_lock); -irq_to_cpuid_unlock (d, flags); +__direct_lpi_inv (d, val); }static void lpi_update_config (struct irq_data *d,u8 clr,u8 set)
@@ -3916,18 +3941,10 @@ static void its_vpe_send_inv(struct irq_data *d) {struct its_vpe *vpe =irq_data_get_irq_chip_data (d); -if (gic_rdists->has_direct_lpi) { -void __iomem *rdbase; - -/* Target the redistributor this VPE is currently known on */ -raw_spin_lock (&gic_data_rdist_cpu (vpe->col_idx)->rd_lock); - rdbase =per_cpu_ptr (gic_rdists->rdist, vpe->col_idx)->rd_base; -gic_write_lpir (d->parent_data->hwirq, rdbase +GICR_INVLPIR ); -wait_for_syncr (rdbase); -raw_spin_unlock (&gic_data_rdist_cpu (vpe->col_idx)->rd_lock); - }else { +if (gic_rdists->has_direct_lpi) +__direct_lpi_inv (d, d->parent_data->hwirq); +else its_vpe_send_cmd (vpe, its_send_inv); - } }static void its_vpe_mask_irq (struct irq_data *d)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 94/201 KVM: VMX: Invert handling of CR0.WP for EPT without unrestricted guest
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit ee5a5584cba316bc90bc2fad0c6d10b71f1791cb ]
Opt-in to forcing CR0.WP=1 for shadow paging, and stop lying about WP being "always on" for unrestricted guest. In addition to making KVM a wee bit more honest, this paves the way for additional cleanup.
No functional change intended.
Message-Id: <[email protected]>
Stable-dep-of: c4abd7352023 ("KVM: VMX: Don't fudge CR0 and CR4 for restricted L2 guest")
--- arch/x86/kvm/vmx/vmx.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-)
arch/x86/kvm/vmx/vmx.c +5 -9
@@ -135,8 +135,7 @@ module_param(allow_smaller_maxphyaddr, bool, S_IRUGO);#define KVM_VM_CR0_ALWAYS_OFF (X86_CR0_NW | X86_CR0_CD)#define KVM_VM_CR0_ALWAYS_ON_UNRESTRICTED_GUEST X86_CR0_NE#define KVM_VM_CR0_ALWAYS_ON \ - (KVM_VM_CR0_ALWAYS_ON_UNRESTRICTED_GUEST | \ - X86_CR0_WP | X86_CR0_PG | X86_CR0_PE) + (KVM_VM_CR0_ALWAYS_ON_UNRESTRICTED_GUEST | X86_CR0_PG | X86_CR0_PE)#define KVM_VM_CR4_ALWAYS_ON_UNRESTRICTED_GUEST X86_CR4_VMXE#define KVM_PMODE_VM_CR4_ALWAYS_ON (X86_CR4_PAE | X86_CR4_VMXE)
@@ -3064,9 +3063,7 @@ void ept_save_pdptrs(struct kvm_vcpu *vcpu)kvm_register_mark_dirty (vcpu,VCPU_EXREG_PDPTR ); } -static void ept_update_paging_mode_cr0 (unsigned long *hw_cr0, -unsigned long cr0, -struct kvm_vcpu *vcpu) +static void ept_update_paging_mode_cr0 (unsigned long cr0,struct kvm_vcpu *vcpu) {struct vcpu_vmx *vmx =to_vmx (vcpu);
@@ -3085,9 +3082,6 @@ static void ept_update_paging_mode_cr0(unsigned long *hw_cr0, vcpu->arch.cr0 = cr0;vmx_set_cr4 (vcpu,kvm_read_cr4 (vcpu)); } - -if (!(cr0 &X86_CR0_WP )) - *hw_cr0 &= ~X86_CR0_WP ; }void vmx_set_cr0 (struct kvm_vcpu *vcpu,unsigned long cr0)
@@ -3100,6 +3094,8 @@ void vmx_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0) hw_cr0 |=KVM_VM_CR0_ALWAYS_ON_UNRESTRICTED_GUEST ; else { hw_cr0 |=KVM_VM_CR0_ALWAYS_ON ; +if (!enable_ept) + hw_cr0 |=X86_CR0_WP ;if (vmx->rmode.vm86_active && (cr0 &X86_CR0_PE ))enter_pmode (vcpu);
@@ -3118,7 +3114,7 @@ void vmx_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)#endif if (enable_ept && !is_unrestricted_guest (vcpu)) -ept_update_paging_mode_cr0 (&hw_cr0, cr0, vcpu); +ept_update_paging_mode_cr0 (cr0, vcpu);vmcs_writel (CR0_READ_SHADOW , cr0);vmcs_writel (GUEST_CR0 , hw_cr0);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 95/201 KVM: VMX: Fold ept_update_paging_mode_cr0() back into vmx_set_cr0()
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit c834fd7fc1308a0e0429d203a6c3af528cd902fa ]
Move the CR0/CR3/CR4 shenanigans for EPT without unrestricted guest back into vmx_set_cr0(). This will allow a future patch to eliminate the rather gross stuffing of vcpu->arch.cr0 in the paging transition cases by snapshotting the old CR0.
No functional change intended.
Message-Id: <[email protected]>
Stable-dep-of: c4abd7352023 ("KVM: VMX: Don't fudge CR0 and CR4 for restricted L2 guest")
--- arch/x86/kvm/vmx/vmx.c | 40 +++++++++++++++++----------------------- 1 file changed, 17 insertions(+), 23 deletions(-)
arch/x86/kvm/vmx/vmx.c +17 -23
@@ -3063,27 +3063,6 @@ void ept_save_pdptrs(struct kvm_vcpu *vcpu)kvm_register_mark_dirty (vcpu,VCPU_EXREG_PDPTR ); } -static void ept_update_paging_mode_cr0 (unsigned long cr0,struct kvm_vcpu *vcpu) -{ -struct vcpu_vmx *vmx =to_vmx (vcpu); - -if (!kvm_register_is_available (vcpu,VCPU_EXREG_CR3 )) -vmx_cache_reg (vcpu,VCPU_EXREG_CR3 ); -if (!(cr0 &X86_CR0_PG )) { -/* From paging/starting to nonpaging */ -exec_controls_setbit (vmx,CPU_BASED_CR3_LOAD_EXITING | -CPU_BASED_CR3_STORE_EXITING ); - vcpu->arch.cr0 = cr0; -vmx_set_cr4 (vcpu,kvm_read_cr4 (vcpu)); - }else if (!is_paging (vcpu)) { -/* From nonpaging to paging */ -exec_controls_clearbit (vmx,CPU_BASED_CR3_LOAD_EXITING | -CPU_BASED_CR3_STORE_EXITING ); - vcpu->arch.cr0 = cr0; -vmx_set_cr4 (vcpu,kvm_read_cr4 (vcpu)); - } -} -void vmx_set_cr0 (struct kvm_vcpu *vcpu,unsigned long cr0) {struct vcpu_vmx *vmx =to_vmx (vcpu);
@@ -3113,8 +3092,23 @@ void vmx_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0) }#endif -if (enable_ept && !is_unrestricted_guest (vcpu)) -ept_update_paging_mode_cr0 (cr0, vcpu); +if (enable_ept && !is_unrestricted_guest (vcpu)) { +if (!kvm_register_is_available (vcpu,VCPU_EXREG_CR3 )) +vmx_cache_reg (vcpu,VCPU_EXREG_CR3 ); +if (!(cr0 &X86_CR0_PG )) { +/* From paging/starting to nonpaging */ +exec_controls_setbit (vmx,CPU_BASED_CR3_LOAD_EXITING | +CPU_BASED_CR3_STORE_EXITING ); + vcpu->arch.cr0 = cr0; +vmx_set_cr4 (vcpu,kvm_read_cr4 (vcpu)); + }else if (!is_paging (vcpu)) { +/* From nonpaging to paging */ +exec_controls_clearbit (vmx,CPU_BASED_CR3_LOAD_EXITING | +CPU_BASED_CR3_STORE_EXITING ); + vcpu->arch.cr0 = cr0; +vmx_set_cr4 (vcpu,kvm_read_cr4 (vcpu)); + } + }vmcs_writel (CR0_READ_SHADOW , cr0);vmcs_writel (GUEST_CR0 , hw_cr0);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 96/201 KVM: nVMX: Do not clear CR3 load/store exiting bits if L1 wants em
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit 470750b3425513b9f63f176e564e63e0e7998afc ]
Keep CR3 load/store exiting enable as needed when running L2 in order to honor L1's desires. This fixes a largely theoretical bug where L1 could intercept CR3 but not CR0.PG and end up not getting the desired CR3 exits when L2 enables paging. In other words, the existing !is_paging() check inadvertantly handles the normal case for L2 where vmx_set_cr0() is called during VM-Enter, which is guaranteed to run with paging enabled, and thus will never clear the bits.
Removing the !is_paging() check will also allow future consolidation and cleanup of the related code. From a performance perspective, this is all a nop, as the VMCS controls shadow will optimize away the VMWRITE when the controls are in the desired state.
Add a comment explaining why CR3 is intercepted, with a big disclaimer about not querying the old CR3. Because vmx_set_cr0() is used for flows that are not directly tied to MOV CR3, e.g. vCPU RESET/INIT and nested VM-Enter, it's possible that is_paging() is not synchronized with CR3 load/store exiting. This is actually guaranteed in the current code, as KVM starts with CR3 interception disabled. Obviously that can be fixed, but there's no good reason to play whack-a-mole, and it tends to end poorly, e.g. descriptor table exiting for UMIP emulation attempted to be precise in the past and ended up botching the interception toggling.
Message-Id: <[email protected]>
Stable-dep-of: c4abd7352023 ("KVM: VMX: Don't fudge CR0 and CR4 for restricted L2 guest")
--- arch/x86/kvm/vmx/vmx.c | 46 +++++++++++++++++++++++++++++++++--------- 1 file changed, 37 insertions(+), 9 deletions(-)
arch/x86/kvm/vmx/vmx.c +37 -9
@@ -3063,10 +3063,14 @@ void ept_save_pdptrs(struct kvm_vcpu *vcpu)kvm_register_mark_dirty (vcpu,VCPU_EXREG_PDPTR ); } +#define CR3_EXITING_BITS (CPU_BASED_CR3_LOAD_EXITING | \ + CPU_BASED_CR3_STORE_EXITING) +void vmx_set_cr0 (struct kvm_vcpu *vcpu,unsigned long cr0) {struct vcpu_vmx *vmx =to_vmx (vcpu);unsigned long hw_cr0; +u32 tmp; hw_cr0 = (cr0 & ~KVM_VM_CR0_ALWAYS_OFF );if (is_unrestricted_guest (vcpu))
@@ -3093,18 +3097,42 @@ void vmx_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)#endif if (enable_ept && !is_unrestricted_guest (vcpu)) { +/* +* Ensure KVM has an up-to-date snapshot of the guest's CR3. If +* the below code _enables_ CR3 exiting, vmx_cache_reg() will +* (correctly) stop reading vmcs.GUEST_CR3 because it thinks +* KVM's CR3 is installed. +*/ if (!kvm_register_is_available (vcpu,VCPU_EXREG_CR3 ))vmx_cache_reg (vcpu,VCPU_EXREG_CR3 ); + +/* +* When running with EPT but not unrestricted guest, KVM must +* intercept CR3 accesses when paging is _disabled_. This is +* necessary because restricted guests can't actually run with +* paging disabled, and so KVM stuffs its own CR3 in order to +* run the guest when identity mapped page tables. +* +* Do _NOT_ check the old CR0.PG, e.g. to optimize away the +* update, it may be stale with respect to CR3 interception, +* e.g. after nested VM-Enter. +* +* Lastly, honor L1's desires, i.e. intercept CR3 loads and/or +* stores to forward them to L1, even if KVM does not need to +* intercept them to preserve its identity mapped page tables. +*/ if (!(cr0 &X86_CR0_PG )) { -/* From paging/starting to nonpaging */ -exec_controls_setbit (vmx,CPU_BASED_CR3_LOAD_EXITING | -CPU_BASED_CR3_STORE_EXITING ); - vcpu->arch.cr0 = cr0; -vmx_set_cr4 (vcpu,kvm_read_cr4 (vcpu)); - }else if (!is_paging (vcpu)) { -/* From nonpaging to paging */ -exec_controls_clearbit (vmx,CPU_BASED_CR3_LOAD_EXITING | -CPU_BASED_CR3_STORE_EXITING ); +exec_controls_setbit (vmx,CR3_EXITING_BITS ); + }else if (!is_guest_mode (vcpu)) { +exec_controls_clearbit (vmx,CR3_EXITING_BITS ); + }else { + tmp =exec_controls_get (vmx); + tmp &= ~CR3_EXITING_BITS ; + tmp |=get_vmcs12 (vcpu)->cpu_based_vm_exec_control &CR3_EXITING_BITS ; +exec_controls_set (vmx, tmp); + } + +if (!is_paging (vcpu) != !(cr0 &X86_CR0_PG )) { vcpu->arch.cr0 = cr0;vmx_set_cr4 (vcpu,kvm_read_cr4 (vcpu)); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 97/201 KVM: VMX: Dont fudge CR0 and CR4 for restricted L2 guest
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
[ Upstream commit c4abd7352023aa96114915a0bb2b88016a425cda ]
Stuff CR0 and/or CR4 to be compliant with a restricted guest if and only if KVM itself is not configured to utilize unrestricted guests, i.e. don't stuff CR0/CR4 for a restricted L2 that is running as the guest of an unrestricted L1. Any attempt to VM-Enter a restricted guest with invalid CR0/CR4 values should fail, i.e. in a nested scenario, KVM (as L0) should never observe a restricted L2 with incompatible CR0/CR4, since nested VM-Enter from L1 should have failed.
And if KVM does observe an active, restricted L2 with incompatible state, e.g. due to a KVM bug, fudging CR0/CR4 instead of letting VM-Enter fail does more harm than good, as KVM will often neglect to undo the side effects, e.g. won't clear rmode.vm86_active on nested VM-Exit, and thus the damage can easily spill over to L1. On the other hand, letting VM-Enter fail due to bad guest state is more likely to contain the damage to L2 as KVM relies on hardware to perform most guest state consistency checks, i.e. KVM needs to be able to reflect a failed nested VM-Enter into L1 irrespective of (un)restricted guest behavior.
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/vmx.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
arch/x86/kvm/vmx/vmx.c +9 -4
@@ -1519,6 +1519,11 @@ void vmx_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags)struct vcpu_vmx *vmx =to_vmx (vcpu);unsigned long old_rflags; +/* +* Unlike CR0 and CR4, RFLAGS handling requires checking if the vCPU +* is an unrestricted guest in order to mark L2 as needing emulation +* if L1 runs L2 as a restricted guest. +*/ if (is_unrestricted_guest (vcpu)) {kvm_register_mark_available (vcpu,VCPU_EXREG_RFLAGS ); vmx->rflags = rflags;
@@ -3073,7 +3078,7 @@ void vmx_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0)u32 tmp; hw_cr0 = (cr0 & ~KVM_VM_CR0_ALWAYS_OFF ); -if (is_unrestricted_guest (vcpu)) +if (enable_unrestricted_guest) hw_cr0 |=KVM_VM_CR0_ALWAYS_ON_UNRESTRICTED_GUEST ;else { hw_cr0 |=KVM_VM_CR0_ALWAYS_ON ;
@@ -3096,7 +3101,7 @@ void vmx_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0) }#endif -if (enable_ept && !is_unrestricted_guest (vcpu)) { +if (enable_ept && !enable_unrestricted_guest) {/* * Ensure KVM has an up-to-date snapshot of the guest's CR3. If * the below code _enables_ CR3 exiting, vmx_cache_reg() will
@@ -3231,7 +3236,7 @@ void vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)unsigned long hw_cr4; hw_cr4 = (cr4_read_shadow () &X86_CR4_MCE ) | (cr4 & ~X86_CR4_MCE ); -if (is_unrestricted_guest (vcpu)) +if (enable_unrestricted_guest) hw_cr4 |=KVM_VM_CR4_ALWAYS_ON_UNRESTRICTED_GUEST ;else if (vmx->rmode.vm86_active) hw_cr4 |=KVM_RMODE_VM_CR4_ALWAYS_ON ;
@@ -3251,7 +3256,7 @@ void vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4) vcpu->arch.cr4 = cr4;kvm_register_mark_available (vcpu,VCPU_EXREG_CR4 ); -if (!is_unrestricted_guest (vcpu)) { +if (!enable_unrestricted_guest) {if (enable_ept) {if (!is_paging (vcpu)) { hw_cr4 &= ~X86_CR4_PAE ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 98/201 staging: rtl8712: Use constants from <linux/ieee80211.h>
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit f179515da9780c4cd37bee76c3cbb6f7364451d6 ]
Some constants defined in wifi.h are already defined in <linux/ieee80211.h> with some other (but similar) names.
Be consistent and use the ones from <linux/ieee80211.h>.
The conversions made are:
_SSID_IE_ --> WLAN_EID_SSID _SUPPORTEDRATES_IE_ --> WLAN_EID_SUPP_RATES _DSSET_IE_ --> WLAN_EID_DS_PARAMS _IBSS_PARA_IE_ --> WLAN_EID_IBSS_PARAMS _ERPINFO_IE_ --> WLAN_EID_ERP_INFO _EXT_SUPPORTEDRATES_IE_ --> WLAN_EID_EXT_SUPP_RATES
_HT_CAPABILITY_IE_ --> WLAN_EID_HT_CAPABILITY _HT_EXTRA_INFO_IE_ --> WLAN_EID_HT_OPERATION (not used) _HT_ADD_INFO_IE_ --> WLAN_EID_HT_OPERATION
_VENDOR_SPECIFIC_IE_ --> WLAN_EID_VENDOR_SPECIFIC
_RESERVED47_ --> (not used)
Stable-dep-of: ac83631230f7 ("staging: r8712: Fix memory leak in _r8712_init_xmit_priv()")
--- drivers/staging/rtl8712/ieee80211.c | 12 ++++++------ drivers/staging/rtl8712/rtl871x_ioctl_linux.c | 8 ++++---- drivers/staging/rtl8712/rtl871x_mlme.c | 10 +++++----- drivers/staging/rtl8712/rtl871x_xmit.c | 3 ++- drivers/staging/rtl8712/wifi.h | 15 --------------- 5 files changed, 17 insertions(+), 31 deletions(-)
drivers/staging/rtl8712/ieee80211.c +6 -6
@@ -181,25 +181,25 @@ int r8712_generate_ie(struct registry_priv *registrypriv) sz +=2 ; ie +=2 ;/*SSID*/ - ie =r8712_set_ie (ie, _SSID_IE_, dev_network->Ssid.SsidLength, + ie =r8712_set_ie (ie,WLAN_EID_SSID , dev_network->Ssid.SsidLength, dev_network->Ssid.Ssid, &sz);/*supported rates*/ set_supported_rate (dev_network->rates, registrypriv->wireless_mode); rate_len =r8712_get_rateset_len (dev_network->rates);if (rate_len >8 ) { - ie =r8712_set_ie (ie, _SUPPORTEDRATES_IE_,8 , + ie =r8712_set_ie (ie,WLAN_EID_SUPP_RATES ,8 , dev_network->rates, &sz); - ie =r8712_set_ie (ie, _EXT_SUPPORTEDRATES_IE_, (rate_len -8 ), + ie =r8712_set_ie (ie,WLAN_EID_EXT_SUPP_RATES , (rate_len -8 ), (dev_network->rates +8 ), &sz); }else { - ie =r8712_set_ie (ie, _SUPPORTEDRATES_IE_, + ie =r8712_set_ie (ie,WLAN_EID_SUPP_RATES , rate_len, dev_network->rates, &sz); }/*DS parameter set*/ - ie =r8712_set_ie (ie, _DSSET_IE_,1 , + ie =r8712_set_ie (ie,WLAN_EID_DS_PARAMS ,1 , (u8 *)&dev_network->Configuration.DSConfig, &sz);/*IBSS Parameter Set*/ - ie =r8712_set_ie (ie, _IBSS_PARA_IE_,2 , + ie =r8712_set_ie (ie,WLAN_EID_IBSS_PARAMS ,2 , (u8 *)&dev_network->Configuration.ATIMWindow, &sz);return sz; }
drivers/staging/rtl8712/rtl871x_ioctl_linux.c +4 -4
@@ -236,7 +236,7 @@ static char *translate_scan(struct _adapter *padapter, start =iwe_stream_add_point (info, start, stop, &iwe, pnetwork->network.Ssid.Ssid);/* parsing HT_CAP_IE */ - p =r8712_get_ie (&pnetwork->network.IEs[12 ], _HT_CAPABILITY_IE_, + p =r8712_get_ie (&pnetwork->network.IEs[12 ],WLAN_EID_HT_CAPABILITY , &ht_ielen, pnetwork->network.IELength -12 );if (p && ht_ielen >0 ) ht_cap = true;
@@ -567,7 +567,7 @@ static int r871x_set_wpa_ie(struct _adapter *padapter, char *pie,while (cnt < ielen) { eid = buf[cnt]; -if ((eid == _VENDOR_SPECIFIC_IE_) && +if ((eid ==WLAN_EID_VENDOR_SPECIFIC ) && (!memcmp (&buf[cnt +2 ], wps_oui,4 ))) {netdev_info (padapter->pnetdev,"r8712u: SET WPS_IE\n" ); padapter->securitypriv.wps_ie_len =
@@ -609,7 +609,7 @@ static int r8711_wx_get_name(struct net_device *dev,if (check_fwstate (pmlmepriv, _FW_LINKED |WIFI_ADHOC_MASTER_STATE ) == true) {/* parsing HT_CAP_IE */ - p =r8712_get_ie (&pcur_bss->IEs[12 ], _HT_CAPABILITY_IE_, + p =r8712_get_ie (&pcur_bss->IEs[12 ],WLAN_EID_HT_CAPABILITY , &ht_ielen, pcur_bss->IELength -12 );if (p && ht_ielen >0 ) ht_cap = true;
@@ -1403,7 +1403,7 @@ static int r8711_wx_get_rate(struct net_device *dev, i =0 ;if (!check_fwstate (pmlmepriv, _FW_LINKED |WIFI_ADHOC_MASTER_STATE ))return -ENOLINK ; - p =r8712_get_ie (&pcur_bss->IEs[12 ], _HT_CAPABILITY_IE_, &ht_ielen, + p =r8712_get_ie (&pcur_bss->IEs[12 ],WLAN_EID_HT_CAPABILITY , &ht_ielen, pcur_bss->IELength -12 );if (p && ht_ielen >0 ) { ht_cap = true;
drivers/staging/rtl8712/rtl871x_mlme.c +5 -5
@@ -1649,11 +1649,11 @@ unsigned int r8712_restructure_ht_ie(struct _adapter *padapter, u8 *in_ie,struct ht_priv *phtpriv = &pmlmepriv->htpriv; phtpriv->ht_option =0 ; - p =r8712_get_ie (in_ie +12 , _HT_CAPABILITY_IE_, &ielen, in_len -12 ); + p =r8712_get_ie (in_ie +12 ,WLAN_EID_HT_CAPABILITY , &ielen, in_len -12 );if (p && (ielen >0 )) {if (pqospriv->qos_option ==0 ) { out_len = *pout_len; -r8712_set_ie (out_ie + out_len, _VENDOR_SPECIFIC_IE_, +r8712_set_ie (out_ie + out_len,WLAN_EID_VENDOR_SPECIFIC , _WMM_IE_Length_,WMM_IE , pout_len); pqospriv->qos_option =1 ; }
@@ -1667,7 +1667,7 @@ unsigned int r8712_restructure_ht_ie(struct _adapter *padapter, u8 *in_ie, IEEE80211_HT_CAP_DSSSCCK40); ht_capie.ampdu_params_info = (IEEE80211_HT_AMPDU_PARM_FACTOR &0x03 ) | (IEEE80211_HT_AMPDU_PARM_DENSITY &0x00 ); -r8712_set_ie (out_ie + out_len, _HT_CAPABILITY_IE_, +r8712_set_ie (out_ie + out_len,WLAN_EID_HT_CAPABILITY ,sizeof (struct rtl_ieee80211_ht_cap ), (unsigned char *)&ht_capie, pout_len); phtpriv->ht_option =1 ;
@@ -1698,7 +1698,7 @@ static void update_ht_cap(struct _adapter *padapter, u8 *pie, uint ie_len)/*check Max Rx A-MPDU Size*/ len =0 ; p =r8712_get_ie (pie +sizeof (struct NDIS_802_11_FIXED_IEs ), - _HT_CAPABILITY_IE_, +WLAN_EID_HT_CAPABILITY , &len, ie_len -sizeof (struct NDIS_802_11_FIXED_IEs ));if (p && len >0 ) {
@@ -1733,7 +1733,7 @@ static void update_ht_cap(struct _adapter *padapter, u8 *pie, uint ie_len) } len =0 ; p =r8712_get_ie (pie +sizeof (struct NDIS_802_11_FIXED_IEs ), - _HT_ADD_INFO_IE_, &len, +WLAN_EID_HT_OPERATION , &len, ie_len -sizeof (struct NDIS_802_11_FIXED_IEs )); }
drivers/staging/rtl8712/rtl871x_xmit.c +2 -1
@@ -22,6 +22,7 @@#include "osdep_intf.h" #include "usb_ops.h" +#include <linux/ieee80211.h> static const u8 P802_1H_OUI [P80211_OUI_LEN ] = {0x00 ,0x00 ,0xf8 };static const u8 RFC1042_OUI [P80211_OUI_LEN ] = {0x00 ,0x00 ,0x00 };
@@ -709,7 +710,7 @@ void r8712_update_protection(struct _adapter *padapter, u8 *ie, uint ie_len)break ;case AUTO_VCS :default : - perp =r8712_get_ie (ie, _ERPINFO_IE_, &erp_len, ie_len); + perp =r8712_get_ie (ie,WLAN_EID_ERP_INFO , &erp_len, ie_len);if (!perp) { pxmitpriv->vcs =NONE_VCS ; }else {
drivers/staging/rtl8712/wifi.h +0 -15
@@ -374,21 +374,6 @@ static inline unsigned char *get_hdr_bssid(unsigned char *pframe)#define _FIXED_IE_LENGTH_ _BEACON_IE_OFFSET_ -#define _SSID_IE_ 0 -#define _SUPPORTEDRATES_IE_ 1 -#define _DSSET_IE_ 3 -#define _IBSS_PARA_IE_ 6 -#define _ERPINFO_IE_ 42 -#define _EXT_SUPPORTEDRATES_IE_ 50 - -#define _HT_CAPABILITY_IE_ 45 -#define _HT_EXTRA_INFO_IE_ 61 -#define _HT_ADD_INFO_IE_ 61/* _HT_EXTRA_INFO_IE_ */ - -#define _VENDOR_SPECIFIC_IE_ 221 - -#define _RESERVED47_ 47 -/* --------------------------------------------------------------------------- * Below is the fixed elements... * ---------------------------------------------------------------------------
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 99/201 staging: r8712: Fix memory leak in _r8712_init_xmit_priv()
In reply to Greg Kroah-HartmanFrom: Larry Finger <[email protected]>
[ Upstream commit ac83631230f77dda94154ed0ebfd368fc81c70a3 ]
In the above mentioned routine, memory is allocated in several places. If the first succeeds and a later one fails, the routine will leak memory. This patch fixes commit 2865d42c78a9 ("staging: r8712u: Add the new driver to the mainline kernel"). A potential memory leak in r8712_xmit_resource_alloc() is also addressed.
--- drivers/staging/rtl8712/rtl871x_xmit.c | 43 ++++++++++++++++++++------ drivers/staging/rtl8712/xmit_linux.c | 6 ++++ 2 files changed, 40 insertions(+), 9 deletions(-)
drivers/staging/rtl8712/rtl871x_xmit.c +34 -9
@@ -22,6 +22,7 @@#include "osdep_intf.h" #include "usb_ops.h" +#include <linux/usb.h> #include <linux/ieee80211.h> static const u8 P802_1H_OUI [P80211_OUI_LEN ] = {0x00 ,0x00 ,0xf8 };
@@ -56,6 +57,7 @@ int _r8712_init_xmit_priv(struct xmit_priv *pxmitpriv,sint i;struct xmit_buf *pxmitbuf;struct xmit_frame *pxframe; +int j;memset ((unsigned char *)pxmitpriv,0 ,sizeof (struct xmit_priv ));spin_lock_init (&pxmitpriv->lock);
@@ -118,11 +120,8 @@ int _r8712_init_xmit_priv(struct xmit_priv *pxmitpriv,_init_queue (&pxmitpriv->pending_xmitbuf_queue); pxmitpriv->pallocated_xmitbuf =kmalloc (NR_XMITBUFF *sizeof (struct xmit_buf ) +4 ,GFP_ATOMIC ); -if (!pxmitpriv->pallocated_xmitbuf) { -kfree (pxmitpriv->pallocated_frame_buf); - pxmitpriv->pallocated_frame_buf =NULL ; -return -ENOMEM ; - } +if (!pxmitpriv->pallocated_xmitbuf) + goto clean_up_frame_buf; pxmitpriv->pxmitbuf = pxmitpriv->pallocated_xmitbuf +4 - ((addr_t)(pxmitpriv->pallocated_xmitbuf) &3 ); pxmitbuf = (struct xmit_buf *)pxmitpriv->pxmitbuf;
@@ -130,13 +129,17 @@ int _r8712_init_xmit_priv(struct xmit_priv *pxmitpriv,INIT_LIST_HEAD (&pxmitbuf->list); pxmitbuf->pallocated_buf =kmalloc (MAX_XMITBUF_SZ +XMITBUF_ALIGN_SZ ,GFP_ATOMIC ); -if (!pxmitbuf->pallocated_buf) -return -ENOMEM ; +if (!pxmitbuf->pallocated_buf) { + j =0 ; + goto clean_up_alloc_buf; + } pxmitbuf->pbuf = pxmitbuf->pallocated_buf +XMITBUF_ALIGN_SZ - ((addr_t) (pxmitbuf->pallocated_buf) & (XMITBUF_ALIGN_SZ -1 )); -if (r8712_xmit_resource_alloc (padapter, pxmitbuf)) -return -ENOMEM ; +if (r8712_xmit_resource_alloc (padapter, pxmitbuf)) { + j =1 ; + goto clean_up_alloc_buf; + }list_add_tail (&pxmitbuf->list, &(pxmitpriv->free_xmitbuf_queue.queue)); pxmitbuf++;
@@ -147,6 +150,28 @@ int _r8712_init_xmit_priv(struct xmit_priv *pxmitpriv,init_hwxmits (pxmitpriv->hwxmits, pxmitpriv->hwxmit_entry);tasklet_setup (&pxmitpriv->xmit_tasklet, r8712_xmit_bh);return 0 ; + +clean_up_alloc_buf: +if (j) { +/* failure happened in r8712_xmit_resource_alloc() +* delete extra pxmitbuf->pallocated_buf +*/ +kfree (pxmitbuf->pallocated_buf); + } +for (j =0 ; j < i; j++) { +int k; + + pxmitbuf--;/* reset pointer */ +kfree (pxmitbuf->pallocated_buf); +for (k =0 ; k <8 ; k++)/* delete xmit urb's */ +usb_free_urb (pxmitbuf->pxmit_urb[k]); + } +kfree (pxmitpriv->pallocated_xmitbuf); + pxmitpriv->pallocated_xmitbuf =NULL ; +clean_up_frame_buf: +kfree (pxmitpriv->pallocated_frame_buf); + pxmitpriv->pallocated_frame_buf =NULL ; +return -ENOMEM ; }void _free_xmit_priv (struct xmit_priv *pxmitpriv)
drivers/staging/rtl8712/xmit_linux.c +6 -0
@@ -119,6 +119,12 @@ int r8712_xmit_resource_alloc(struct _adapter *padapter,for (i =0 ; i <8 ; i++) { pxmitbuf->pxmit_urb[i] =usb_alloc_urb (0 ,GFP_KERNEL );if (!pxmitbuf->pxmit_urb[i]) { +int k; + +for (k = i -1 ; k >=0 ; k--) { +/* handle allocation errors part way through loop */ +usb_free_urb (pxmitbuf->pxmit_urb[k]); + }netdev_err (padapter->pnetdev,"pxmitbuf->pxmit_urb[i] == NULL\n" );return -ENOMEM ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 100/201 btrfs: check if the transaction was aborted at btrfs_wait_for_commit()
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
[ Upstream commit bf7ecbe9875061bf3fce1883e3b26b77f847d1e8 ]
At btrfs_wait_for_commit() we wait for a transaction to finish and then always return 0 (success) without checking if it was aborted, in which case the transaction didn't happen due to some critical error. Fix this by checking if the transaction was aborted.
--- fs/btrfs/transaction.c | 1 + 1 file changed, 1 insertion(+)
fs/btrfs/transaction.c +1 -0
@@ -891,6 +891,7 @@ int btrfs_wait_for_commit(struct btrfs_fs_info *fs_info, u64 transid) }wait_for_commit (cur_trans); + ret = cur_trans->aborted;btrfs_put_transaction (cur_trans); out:return ret;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 101/201 virtio-net: fix race between set queues and probe
In reply to Greg Kroah-HartmanFrom: Jason Wang <[email protected]>
commit 25266128fe16d5632d43ada34c847d7b8daba539 upstream.
A race were found where set_channels could be called after registering but before virtnet_set_queues() in virtnet_probe(). Fixing this by moving the virtnet_set_queues() before netdevice registering. While at it, use _virtnet_set_queues() to avoid holding rtnl as the device is not even registered at that time.
--- drivers/net/virtio_net.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/virtio_net.c +2 -2
@@ -3220,6 +3220,8 @@ static int virtnet_probe(struct virtio_d } } +_virtnet_set_queues (vi, vi->curr_queue_pairs); +/* serialize netdev register + virtio_device_ready() with ndo_open() */ rtnl_lock ();
@@ -3240,8 +3242,6 @@ static int virtnet_probe(struct virtio_d goto free_unregister_netdev; } -virtnet_set_queues (vi, vi->curr_queue_pairs); -/* Assume link up if device can't report link status, otherwise get link status from config. */ netif_carrier_off (dev);
Greg Kroah-Hartman
maintainerPATCH 102/201 s390/dasd: fix hanging device after quiesce/resume
In reply to Greg Kroah-HartmanFrom: Stefan Haberland <[email protected]>
commit 05f1d8ed03f547054efbc4d29bb7991c958ede95 upstream.
Quiesce and resume are functions that tell the DASD driver to stop/resume issuing I/Os to a specific DASD.
On resume dasd_schedule_block_bh() is called to kick handling of IO requests again. This does unfortunately not cover internal requests which are used for path verification for example.
This could lead to a hanging device when a path event or anything else that triggers internal requests occurs on a quiesced device.
Fix by also calling dasd_schedule_device_bh() which triggers handling of internal requests on resume.
--- drivers/s390/block/dasd_ioctl.c | 1 + 1 file changed, 1 insertion(+)
drivers/s390/block/dasd_ioctl.c +1 -0
@@ -133,6 +133,7 @@ static int dasd_ioctl_resume(struct dasdspin_unlock_irqrestore (get_ccwdev_lock (base->cdev), flags);dasd_schedule_block_bh (block); +dasd_schedule_device_bh (base);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 103/201 ASoC: wm8904: Fill the cache for WM8904_ADC_TEST_0 register
In reply to Greg Kroah-HartmanFrom: Mark Brown <[email protected]>
commit f061e2be8689057cb4ec0dbffa9f03e1a23cdcb2 upstream.
The WM8904_ADC_TEST_0 register is modified as part of updating the OSR controls but does not have a cache default, leading to errors when we try to modify these controls in cache only mode with no prior read:
wm8904 3-001a: ASoC: error at snd_soc_component_update_bits on wm8904.3-001a for register: [0x000000c6] -16
Add a read of the register to probe() to fill the cache and avoid both the error messages and the misconfiguration of the chip which will result.
--- sound/soc/codecs/wm8904.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/codecs/wm8904.c +3 -0
@@ -2306,6 +2306,9 @@ static int wm8904_i2c_probe(struct i2c_cregmap_update_bits (wm8904->regmap,WM8904_BIAS_CONTROL_0 ,WM8904_POBCTRL ,0 ); +/* Fill the cache for the ADC test register */ +regmap_read (wm8904->regmap,WM8904_ADC_TEST_0 , &val); +/* Can leave the device powered off until we need it */ regcache_cache_only (wm8904->regmap, true);regulator_bulk_disable (ARRAY_SIZE (wm8904->supplies), wm8904->supplies);
Greg Kroah-Hartman
maintainerPATCH 104/201 ceph: never send metrics if disable_send_metrics is set
In reply to Greg Kroah-HartmanFrom: Xiubo Li <[email protected]>
commit 50164507f6b7b7ed85d8c3ac0266849fbd908db7 upstream.
Even the 'disable_send_metrics' is true so when the session is being opened it will always trigger to send the metric for the first time.
--- fs/ceph/metric.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ceph/metric.c +1 -1
@@ -130,7 +130,7 @@ static void metric_delayed_work(struct wstruct ceph_mds_client *mdsc = container_of(m, struct ceph_mds_client, metric); -if (mdsc->stopping) +if (mdsc->stopping || disable_send_metrics)return ;if (!m->session || !check_session_state (m->session)) {
Greg Kroah-Hartman
maintainerPATCH 105/201 dm cache policy smq: ensure IO doesnt prevent cleaner policy progress
In reply to Greg Kroah-HartmanFrom: Joe Thornber <[email protected]>
commit 1e4ab7b4c881cf26c1c72b3f56519e03475486fb upstream.
When using the cleaner policy to decommission the cache, there is never any writeback started from the cache as it is constantly delayed due to normal I/O keeping the device busy. Meaning @idle=false was always being passed to clean_target_met()
Fix this by adding a specific 'cleaner' flag that is set when the cleaner policy is configured. This flag serves to always allow the cleaner's writeback work to be queued until the cache is decommissioned (even if the cache isn't idle).
--- drivers/md/dm-cache-policy-smq.c | 28 ++++++++++++++++++---------- 1 file changed, 18 insertions(+), 10 deletions(-)
drivers/md/dm-cache-policy-smq.c +18 -10
@@ -854,7 +854,13 @@ struct smq_policy {struct background_tracker *bg_work; -bool migrations_allowed; + bool migrations_allowed:1; + +/* +* If this is set the policy will try and clean the whole cache +* even if the device is not idle. +*/ + bool cleaner:1; };/*----------------------------------------------------------------*/
@@ -1133,7 +1139,7 @@ static bool clean_target_met(struct smq_* Cache entries may not be populated. So we cannot rely on the * size of the clean queue. */ -if (idle) { +if (idle || mq->cleaner) {/* * We'd like to clean everything. */
@@ -1716,11 +1722,9 @@ static void calc_hotspot_params(sector_t *hotspot_block_size /=2u ; } -static struct dm_cache_policy *__smq_create (dm_cblock_t cache_size, -sector_t origin_size, -sector_t cache_block_size, -bool mimic_mq, -bool migrations_allowed) +static struct dm_cache_policy * +__smq_create (dm_cblock_t cache_size,sector_t origin_size,sector_t cache_block_size, +bool mimic_mq,bool migrations_allowed,bool cleaner) {unsigned i;unsigned nr_sentinels_per_queue =2u *NR_CACHE_LEVELS ;
@@ -1807,6 +1811,7 @@ static struct dm_cache_policy *__smq_cre goto bad_btracker; mq->migrations_allowed = migrations_allowed; + mq->cleaner = cleaner;return &mq->policy;
@@ -1830,21 +1835,24 @@ static struct dm_cache_policy *smq_creatsector_t origin_size, sector_t cache_block_size) { - return __smq_create(cache_size, origin_size, cache_block_size, false, true); + return __smq_create(cache_size, origin_size, cache_block_size, +false ,true ,false ); }static struct dm_cache_policy *mq_create (dm_cblock_t cache_size,sector_t origin_size,sector_t cache_block_size) { -return __smq_create (cache_size, origin_size, cache_block_size, true, true); +return __smq_create (cache_size, origin_size, cache_block_size, + true, true, false); }static struct dm_cache_policy *cleaner_create (dm_cblock_t cache_size,sector_t origin_size,sector_t cache_block_size) { -return __smq_create (cache_size, origin_size, cache_block_size, false, false); +return __smq_create (cache_size, origin_size, cache_block_size, + false, false, true); }/*----------------------------------------------------------------*/
Greg Kroah-Hartman
maintainerPATCH 106/201 drm/ttm: make ttm_bo_unpin more defensive
In reply to Greg Kroah-HartmanFrom: Christian König <[email protected]>
commit 6c5403173a13a08ff61dbdafa4c0ed4a9dedbfe0 upstream.
We seem to have some more driver bugs than thought.
--- include/drm/ttm/ttm_bo_api.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
include/drm/ttm/ttm_bo_api.h +4 -2
@@ -628,8 +628,10 @@ static inline void ttm_bo_pin(struct ttmstatic inline void ttm_bo_unpin (struct ttm_buffer_object *bo) {dma_resv_assert_held (bo->base.resv); -WARN_ON_ONCE (!bo->pin_count); - --bo->pin_count; +if (bo->pin_count) + --bo->pin_count; +else +WARN_ON_ONCE (true); } int ttm_mem_evict_first(struct ttm_bo_device *bdev,
Greg Kroah-Hartman
maintainerPATCH 107/201 ACPI: processor: perflib: Use the "no limit" frequency QoS
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
commit c02d5feb6e2f60affc6ba8606d8d614c071e2ba6 upstream.
When _PPC returns 0, it means that the CPU frequency is not limited by the platform firmware, so make acpi_processor_get_platform_limit() update the frequency QoS request used by it to "no limit" in that case.
This addresses a problem with limiting CPU frequency artificially on some systems after CPU offline/online to the frequency that corresponds to the first entry in the _PSS return package.
--- drivers/acpi/processor_perflib.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
drivers/acpi/processor_perflib.c +16 -4
@@ -56,6 +56,8 @@ static int acpi_processor_get_platform_l {acpi_status status =0 ;unsigned long long ppc =0 ; +s32 qos_value; +int index;int ret;if (!pr)
@@ -75,17 +77,27 @@ static int acpi_processor_get_platform_lreturn -ENODEV ; } + index = ppc; +pr_debug ("CPU %d: _PPC is %d - frequency %s limited\n" , pr->id, - (int )ppc, ppc ?"" :"not" ); + index, index ?"is" :"is not" ); - pr->performance_platform_limit = (int )ppc; + pr->performance_platform_limit = index;if (ppc >= pr->performance->state_count ||unlikely (!freq_qos_request_active (&pr->perflib_req)))return 0 ; - ret =freq_qos_update_request (&pr->perflib_req, - pr->performance->states[ppc].core_frequency *1000 ); +/* +* If _PPC returns 0, it means that all of the available states can be +* used ("no limit"). +*/ +if (index ==0 ) + qos_value =FREQ_QOS_MAX_DEFAULT_VALUE ; +else + qos_value = pr->performance->states[index].core_frequency *1000 ; + + ret =freq_qos_update_request (&pr->perflib_req, qos_value);if (ret <0 ) {pr_warn ("Failed to update perflib freq constraint: CPU%d (%d)\n" , pr->id, ret);
Greg Kroah-Hartman
maintainerPATCH 108/201 ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
commit 99387b016022c29234c4ebf9abd34358c6e56532 upstream.
Modify acpi_processor_get_platform_limit() to avoid updating its frequency QoS request when the _PPC return value has not changed by comparing that value to the previous _PPC return value stored in the performance_platform_limit field of the struct acpi_processor corresponding to the given CPU.
While at it, do the _PPC return value check against the state count earlier, to avoid setting performance_platform_limit to an invalid value, and make acpi_processor_ppc_init() use FREQ_QOS_MAX_DEFAULT_VALUE as the "no limit" frequency QoS for consistency.
--- drivers/acpi/processor_perflib.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
drivers/acpi/processor_perflib.c +14 -4
@@ -79,13 +79,16 @@ static int acpi_processor_get_platform_l index = ppc; +if (pr->performance_platform_limit == index || + ppc >= pr->performance->state_count) +return 0 ; +pr_debug ("CPU %d: _PPC is %d - frequency %s limited\n" , pr->id, index, index ?"is" :"is not" ); pr->performance_platform_limit = index; -if (ppc >= pr->performance->state_count || -unlikely (!freq_qos_request_active (&pr->perflib_req))) +if (unlikely (!freq_qos_request_active (&pr->perflib_req)))return 0 ;/*
@@ -180,9 +183,16 @@ void acpi_processor_ppc_init(struct cpufif (!pr)continue ; +/* +* Reset performance_platform_limit in case there is a stale +* value in it, so as to make it match the "no limit" QoS value +* below. +*/ + pr->performance_platform_limit =0 ; + ret =freq_qos_add_request (&policy->constraints, - &pr->perflib_req, -FREQ_QOS_MAX ,INT_MAX ); + &pr->perflib_req,FREQ_QOS_MAX , +FREQ_QOS_MAX_DEFAULT_VALUE );if (ret <0 )pr_err ("Failed to add freq constraint for CPU%d (%d)\n" , cpu, ret);
Greg Kroah-Hartman
maintainerPATCH 109/201 cpufreq: intel_pstate: Drop ACPI _PSS states table patching
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
commit e8a0e30b742f76ebd0f3b196973df4bf65d8fbbb upstream.
After making acpi_processor_get_platform_limit() use the "no limit" value for its frequency QoS request when _PPC returns 0, it is not necessary to replace the frequency corresponding to the first _PSS return package entry with the maximum turbo frequency of the given CPU in intel_pstate_init_acpi_perf_limits() any more, so drop the code doing that along with the comment explaining it.
--- drivers/cpufreq/intel_pstate.c | 14 -------------- 1 file changed, 14 deletions(-)
drivers/cpufreq/intel_pstate.c +0 -14
@@ -443,20 +443,6 @@ static void intel_pstate_init_acpi_perf_ (u32) cpu->acpi_perf_data.states[i].control); } -/* -* The _PSS table doesn't contain whole turbo frequency range. -* This just contains +1 MHZ above the max non turbo frequency, -* with control value corresponding to max turbo ratio. But -* when cpufreq set policy is called, it will call with this -* max frequency, which will cause a reduced performance as -* this driver uses real max turbo frequency as the max -* frequency. So correct this frequency in _PSS table to -* correct max turbo frequency based on the turbo state. -* Also need to convert to MHz as _PSS freq is in MHz. -*/ -if (!global.turbo_disabled) - cpu->acpi_perf_data.states[0 ].core_frequency = - policy->cpuinfo.max_freq /1000 ; cpu->valid_pss_table = true;pr_debug ("_PPC limits will be enforced\n" );
Greg Kroah-Hartman
maintainerPATCH 110/201 selftests: mptcp: depend on SYN_COOKIES
In reply to Greg Kroah-HartmanFrom: Matthieu Baerts <[email protected]>
commit 6c8880fcaa5c45355179b759c1d11737775e31fc upstream.
MPTCP selftests are using TCP SYN Cookies for quite a while now, since v5.9.
Some CIs don't have this config option enabled and this is causing issues in the tests:
# ns1 MPTCP -> ns1 (10.0.1.1:10000 ) MPTCP (duration 167ms) sysctl: cannot stat /proc/sys/net/ipv4/tcp_syncookies: No such file or directory # [ OK ]./mptcp_connect.sh: line 554: [: -eq: unary operator expected
There is no impact in the results but the test is not doing what it is supposed to do.
--- tools/testing/selftests/net/mptcp/config | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/net/mptcp/config +1 -0
@@ -6,3 +6,4 @@ CONFIG_INET_DIAG=m CONFIG_INET_MPTCP_DIAG=m CONFIG_VETH=y CONFIG_NET_SCH_NETEM=m +CONFIG_SYN_COOKIES=y
Greg Kroah-Hartman
maintainerPATCH 111/201 io_uring: treat -EAGAIN for REQ_F_NOWAIT as final for io-wq
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
commit a9be202269580ca611c6cebac90eaf1795497800 upstream.
io-wq assumes that an issue is blocking, but it may not be if the request type has asked for a non-blocking attempt. If we get -EAGAIN for that case, then we need to treat it as a final result and not retry or arm poll for it.
--- io_uring/io_uring.c | 8 ++++++++ 1 file changed, 8 insertions(+)
io_uring/io_uring.c +8 -0
@@ -6895,6 +6895,14 @@ static void io_wq_submit_work(struct io_*/ if (ret != -EAGAIN || !(req->ctx->flags &IORING_SETUP_IOPOLL ))break ; + +/* +* If REQ_F_NOWAIT is set, then don't wait or retry with +* poll. -EAGAIN is final for that case. +*/ +if (req->flags &REQ_F_NOWAIT ) +break ; +cond_resched (); }while (1 ); }
Greg Kroah-Hartman
maintainerPATCH 112/201 ASoC: cs42l51: fix driver to properly autoload with automatic module loading
In reply to Greg Kroah-HartmanFrom: Thomas Petazzoni <[email protected]>
commit e51df4f81b02bcdd828a04de7c1eb6a92988b61e upstream.
In commit 2cb1e0259f50 ("ASoC: cs42l51: re-hook of_match_table pointer"), 9 years ago, some random guy fixed the cs42l51 after it was split into a core part and an I2C part to properly match based on a Device Tree compatible string.
However, the fix in this commit is wrong: the MODULE_DEVICE_TABLE(of, ....) is in the core part of the driver, not the I2C part. Therefore, automatic module loading based on module.alias, based on matching with the DT compatible string, loads the core part of the driver, but not the I2C part. And threfore, the i2c_driver is not registered, and the codec is not known to the system, nor matched with a DT node with the corresponding compatible string.
In order to fix that, we move the MODULE_DEVICE_TABLE(of, ...) into the I2C part of the driver. The cs42l51_of_match[] array is also moved as well, as it is not possible to have this definition in one file, and the MODULE_DEVICE_TABLE(of, ...) invocation in another file, due to how MODULE_DEVICE_TABLE works.
Thanks to this commit, the I2C part of the driver now properly autoloads, and thanks to its dependency on the core part, the core part gets autoloaded as well, resulting in a functional sound card without having to manually load kernel modules.
--- sound/soc/codecs/cs42l51-i2c.c | 6 ++++++ sound/soc/codecs/cs42l51.c | 7 ------- sound/soc/codecs/cs42l51.h | 1 - 3 files changed, 6 insertions(+), 8 deletions(-)
sound/soc/codecs/cs42l51-i2c.c +6 -0
@@ -19,6 +19,12 @@ static struct i2c_device_id cs42l51_i2c_ };MODULE_DEVICE_TABLE (i2c, cs42l51_i2c_id); +const struct of_device_id cs42l51_of_match[] = { + { .compatible ="cirrus,cs42l51" , }, + { } +}; +MODULE_DEVICE_TABLE (of, cs42l51_of_match); +static int cs42l51_i2c_probe (struct i2c_client *i2c,const struct i2c_device_id *id) {
sound/soc/codecs/cs42l51.c +0 -7
@@ -825,13 +825,6 @@ int __maybe_unused cs42l51_resume(struct }EXPORT_SYMBOL_GPL (cs42l51_resume); -const struct of_device_id cs42l51_of_match[] = { - { .compatible ="cirrus,cs42l51" , }, - { } -}; -MODULE_DEVICE_TABLE (of, cs42l51_of_match); -EXPORT_SYMBOL_GPL (cs42l51_of_match); -MODULE_AUTHOR ("Arnaud Patard <[email protected]>" );MODULE_DESCRIPTION ("Cirrus Logic CS42L51 ALSA SoC Codec Driver" );MODULE_LICENSE ("GPL" );
sound/soc/codecs/cs42l51.h +0 -1
@@ -16,7 +16,6 @@ int cs42l51_probe(struct device *dev, stint cs42l51_remove (struct device *dev);int __maybe_unused cs42l51_suspend (struct device *dev);int __maybe_unused cs42l51_resume (struct device *dev); -extern const struct of_device_id cs42l51_of_match[];#define CS42L51_CHIP_ID 0x1B#define CS42L51_CHIP_REV_A 0x00
Greg Kroah-Hartman
maintainerPATCH 113/201 kprobes/x86: Fix fall-through warnings for Clang
In reply to Greg Kroah-HartmanFrom: "Gustavo A. R. Silva" <[email protected]>
[ Upstream commit e689b300c99ca2dd80d3f662e19499bba27cda09 ]
In preparation to enable -Wimplicit-fallthrough for Clang, fix a warning by explicitly adding a break statement instead of just letting the code fall through to the next case.
--- arch/x86/kernel/kprobes/core.c | 1 + 1 file changed, 1 insertion(+)
arch/x86/kernel/kprobes/core.c +1 -0
@@ -880,6 +880,7 @@ static void resume_execution(struct kpro p->ainsn.boostable = true; goto no_change; } +break ;default :break ; }
Greg Kroah-Hartman
maintainerPATCH 114/201 x86/kprobes: Do not decode opcode in resume_execution()
In reply to Greg Kroah-HartmanFrom: Masami Hiramatsu <[email protected]>
[ Upstream commit abd82e533d88df1521e3da6799b83ce88852ab88 ]
Currently, kprobes decodes the opcode right after single-stepping in resume_execution(). But the opcode was already decoded while preparing arch_specific_insn in arch_copy_kprobe().
Decode the opcode in arch_copy_kprobe() instead of in resume_execution() and set some flags which classify the opcode for the resuming process.
[ bp: Massage commit message. ]
--- arch/x86/include/asm/kprobes.h | 11 +- arch/x86/kernel/kprobes/core.c | 168 ++++++++++++++++++----------------------- 2 files changed, 81 insertions(+), 98 deletions(-)
arch/x86/include/asm/kprobes.h +7 -4
@@ -58,14 +58,17 @@ struct arch_specific_insn {/* copy of the original instruction */ kprobe_opcode_t *insn;/* -* boostable = false: This instruction type is not boostable. -* boostable = true: This instruction has been boosted: we have +* boostable = 0: This instruction type is not boostable. +* boostable = 1: This instruction has been boosted: we have * added a relative jump after the instruction copy in insn, * so no single-step and fixup are needed (unless there's * a post_handler). */ -bool boostable; -bool if_modifier; + unsigned boostable:1; + unsigned if_modifier:1; + unsigned is_call:1; + unsigned is_pushf:1; + unsigned is_abs_ip:1;/* Number of bytes of text poked */ int tp_len; };
arch/x86/kernel/kprobes/core.c +74 -94
225 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 115/201 x86/kprobes: Retrieve correct opcode for group instruction
In reply to Greg Kroah-HartmanFrom: Masami Hiramatsu <[email protected]>
[ Upstream commit d60ad3d46f1d04a282c56159f1deb675c12733fd ]
Since the opcodes start from 0xff are group5 instruction group which is not 2 bytes opcode but the extended opcode determined by the MOD/RM byte.
The commit abd82e533d88 ("x86/kprobes: Do not decode opcode in resume_execution()") used insn->opcode.bytes[1], but that is not correct. We have to refer the insn->modrm.bytes[1] instead.
--- arch/x86/kernel/kprobes/core.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/x86/kernel/kprobes/core.c +5 -1
@@ -464,7 +464,11 @@ static void set_resume_flags(struct kprobreak ;#endif case 0xff : - opcode = insn->opcode.bytes[1 ]; +/* +* Since the 0xff is an extended group opcode, the instruction +* is determined by the MOD/RM byte. +*/ + opcode = insn->modrm.bytes[0 ];if ((opcode &0x30 ) ==0x10 ) {/* * call absolute, indirect
Greg Kroah-Hartman
maintainerPATCH 116/201 x86/kprobes: Identify far indirect JMP correctly
In reply to Greg Kroah-HartmanFrom: Masami Hiramatsu <[email protected]>
[ Upstream commit a194acd316f93f3435a64de3b37dca2b5a77b338 ]
Since Grp5 far indirect JMP is FF "mod 101 r/m", it should be (modrm & 0x38) == 0x28, and near indirect JMP is also 0x38 == 0x20. So we can mask modrm with 0x30 and check 0x20.
This is actually what the original code does, it also doesn't care the last bit. So the result code is same.
Thus, I think this is just a cosmetic cleanup.
--- arch/x86/kernel/kprobes/core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/x86/kernel/kprobes/core.c +1 -2
@@ -478,8 +478,7 @@ static void set_resume_flags(struct kpro p->ainsn.is_call =1 ; p->ainsn.is_abs_ip =1 ;break ; - }else if (((opcode &0x31 ) ==0x20 ) || - ((opcode &0x31 ) ==0x21 )) { + }else if ((opcode &0x30 ) ==0x20 ) {/* * jmp near and far, absolute indirect * ip is correct.
Greg Kroah-Hartman
maintainerPATCH 117/201 x86/kprobes: Use int3 instead of debug trap for single-step
In reply to Greg Kroah-HartmanFrom: Masami Hiramatsu <[email protected]>
[ Upstream commit 6256e668b7af9d81472e03c6a171630c08f8858a ]
Use int3 instead of debug trap exception for single-stepping the probed instructions. Some instructions which change the ip registers or modify IF flags are emulated because those are not able to be single-stepped by int3 or may allow the interrupt while single-stepping.
This actually changes the kprobes behavior.
- kprobes can not probe following instructions; int3, iret, far jmp/call which get absolute address as immediate, indirect far jmp/call, indirect near jmp/call with addressing by memory (register-based indirect jmp/call are OK), and vmcall/vmlaunch/vmresume/vmxoff.
- If the kprobe post_handler doesn't set before registering, it may not be called in some case even if you set it afterwards. (IOW, kprobe booster is enabled at registration, user can not change it)
But both are rare issue, unsupported instructions will not be used in the kernel (or rarely used), and post_handlers are rarely used (I don't see it except for the test code).
[Huafei: Fix trivial conflict in arch/x86/kernel/kprobes/core.c due to the previously backported commit 6dd3b8c9f5881]
--- arch/x86/include/asm/kprobes.h | 21 + arch/x86/kernel/kprobes/core.c | 517 ++++++++++++++++++++++++++--------------- arch/x86/kernel/traps.c | 3 3 files changed, 353 insertions(+), 188 deletions(-)
arch/x86/include/asm/kprobes.h +16 -5
@@ -65,10 +65,22 @@ struct arch_specific_insn {* a post_handler). */ unsigned boostable:1; - unsigned if_modifier:1; - unsigned is_call:1; - unsigned is_pushf:1; - unsigned is_abs_ip:1; +unsigned char size;/* The size of insn */ +union { +unsigned char opcode; +struct { +unsigned char type; + } jcc; +struct { +unsigned char type; +unsigned char asize; + } loop; +struct { +unsigned char reg; + } indirect; + }; +s32 rel32;/* relative offset must be s32, s16, or s8 */ +void (*emulate_op)(struct kprobe *p,struct pt_regs *regs);/* Number of bytes of text poked */ int tp_len; };
@@ -107,7 +119,6 @@ extern int kprobe_fault_handler(struct pextern int kprobe_exceptions_notify (struct notifier_block *self,unsigned long val,void *data);extern int kprobe_int3_handler (struct pt_regs *regs); -extern int kprobe_debug_handler (struct pt_regs *regs);#else
arch/x86/kernel/kprobes/core.c +337 -180
636 lines not on this page · raw message
arch/x86/kernel/traps.c +0 -3
@@ -917,9 +917,6 @@ static __always_inline void exc_debug_keif ((dr6 &DR_STEP ) &&is_sysenter_singlestep (regs)) dr6 &= ~DR_STEP ; -if (kprobe_debug_handler (regs)) - goto out; -/* * The kernel doesn't use INT1 */
Greg Kroah-Hartman
maintainerPATCH 118/201 x86/kprobes: Fix to identify indirect jmp and others using range case
In reply to Greg Kroah-HartmanFrom: Masami Hiramatsu <[email protected]>
[ Upstream commit 2f706e0e5e263c0d204e37ea496cbb0e98aac2d2 ]
Fix can_boost() to identify indirect jmp and others using range case correctly.
Since the condition in switch statement is opcode & 0xf0, it can not evaluate to 0xff case. This should be under the 0xf0 case. However, there is no reason to use the conbinations of the bit-masked condition and lower bit checking.
Use range case to clean up the switch statement too.
--- arch/x86/kernel/kprobes/core.c | 44 ++++++++++++++++++----------------------- 1 file changed, 20 insertions(+), 24 deletions(-)
arch/x86/kernel/kprobes/core.c +20 -24
@@ -165,32 +165,28 @@ int can_boost(struct insn *insn, void *a opcode = insn->opcode.bytes[0 ]; -switch (opcode &0xf0 ) { -case 0x60 : -/* can't boost "bound" */ -return (opcode !=0x62 ); -case 0x70 : -return 0 ;/* can't boost conditional jump */ -case 0x90 : -return opcode !=0x9a ;/* can't boost call far */ -case 0xc0 : -/* can't boost software-interruptions */ -return (0xc1 < opcode && opcode <0xcc ) || opcode ==0xcf ; -case 0xd0 : -/* can boost AA* and XLAT */ -return (opcode ==0xd4 || opcode ==0xd5 || opcode ==0xd7 ); -case 0xe0 : -/* can boost in/out and absolute jmps */ -return ((opcode &0x04 ) || opcode ==0xea ); -case 0xf0 : -/* clear and set flags are boostable */ -return (opcode ==0xf5 || (0xf7 < opcode && opcode <0xfe )); -case 0xff : -/* indirect jmp is boostable */ +switch (opcode) { +case 0x62 :/* bound */ + case 0x70 ... 0x7f: /* Conditional jumps */ +case 0x9a :/* Call far */ + case 0xc0 ... 0xc1: /* Grp2 */ + case 0xcc ... 0xce: /* software exceptions */ + case 0xd0 ... 0xd3: /* Grp2 */ +case 0xd6 :/* (UD) */ + case 0xd8 ... 0xdf: /* ESC */ + case 0xe0 ... 0xe3: /* LOOP*, JCXZ */ + case 0xe8 ... 0xe9: /* near Call, JMP */ +case 0xeb :/* Short JMP */ + case 0xf0 ... 0xf4: /* LOCK/REP, HLT */ + case 0xf6 ... 0xf7: /* Grp3 */ +case 0xfe :/* Grp4 */ +/* ... are not boostable */ +return 0 ; +case 0xff :/* Grp5 */ +/* Only indirect jmp is boostable */ return X86_MODRM_REG (insn->modrm.bytes[0 ]) ==4 ;default : -/* call is not boostable */ -return opcode !=0x9a ; +return 1 ; } }
Greg Kroah-Hartman
maintainerPATCH 119/201 x86/kprobes: Move inline to the beginning of the kprobe_is_ss() declaration
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
[ Upstream commit 2304d14db6595bea5292bece06c4c625b12d8f89 ]
Address this GCC warning:
arch/x86/kernel/kprobes/core.c:940:1:
warning: 'inline' is not at beginning of declaration [-Wold-style-declaration]
940 | static int nokprobe_inline kprobe_is_ss(struct kprobe_ctlblk *kcb)
| ^~~~~~
[ mingo: Tidied up the changelog. ]
--- arch/x86/kernel/kprobes/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/kprobes/core.c +1 -1
@@ -944,7 +944,7 @@ static int reenter_kprobe(struct kprobe }NOKPROBE_SYMBOL (reenter_kprobe); -static int nokprobe_inline kprobe_is_ss(struct kprobe_ctlblk *kcb) +static nokprobe_inline int kprobe_is_ss(struct kprobe_ctlblk *kcb) {return (kcb->kprobe_status ==KPROBE_HIT_SS || kcb->kprobe_status ==KPROBE_REENTER );
Greg Kroah-Hartman
maintainerPATCH 120/201 x86/kprobes: Update kcb status flag after singlestepping
In reply to Greg Kroah-HartmanFrom: "Masami Hiramatsu (Google)" <[email protected]>
[ Upstream commit dec8784c9088b131a1523f582c2194cfc8107dc0 ]
Fix kprobes to update kcb (kprobes control block) status flag to KPROBE_HIT_SSDONE even if the kp->post_handler is not set.
This bug may cause a kernel panic if another INT3 user runs right after kprobes because kprobe_int3_handler() misunderstands the INT3 is kprobe's single stepping INT3.
--- arch/x86/kernel/kprobes/core.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)
arch/x86/kernel/kprobes/core.c +11 -7
@@ -826,16 +826,20 @@ NOKPROBE_SYMBOL(arch_prepare_kretprobe);static void kprobe_post_process (struct kprobe *cur,struct pt_regs *regs,struct kprobe_ctlblk *kcb) { -if ((kcb->kprobe_status !=KPROBE_REENTER ) && cur->post_handler) { - kcb->kprobe_status =KPROBE_HIT_SSDONE ; - cur->post_handler (cur, regs,0 ); - } -/* Restore back the original saved kprobes variables and continue. */ -if (kcb->kprobe_status ==KPROBE_REENTER ) +if (kcb->kprobe_status ==KPROBE_REENTER ) { +/* This will restore both kcb and current_kprobe */ restore_previous_kprobe (kcb); -else + }else { +/* +* Always update the kcb status because +* reset_curent_kprobe() doesn't update kcb. +*/ + kcb->kprobe_status =KPROBE_HIT_SSDONE ; +if (cur->post_handler) + cur->post_handler (cur, regs,0 );reset_current_kprobe (); + } }NOKPROBE_SYMBOL (kprobe_post_process);
Greg Kroah-Hartman
maintainerPATCH 121/201 x86/kprobes: Fix JNG/JNLE emulation
In reply to Greg Kroah-HartmanFrom: Nadav Amit <[email protected]>
[ Upstream commit 8924779df820c53875abaeb10c648e9cb75b46d4 ]
When kprobes emulates JNG/JNLE instructions on x86 it uses the wrong condition. For JNG (opcode: 0F 8E), according to Intel SDM, the jump is performed if (ZF == 1 or SF != OF). However the kernel emulation currently uses 'and' instead of 'or'.
As a result, setting a kprobe on JNG/JNLE might cause the kernel to behave incorrectly whenever the kprobe is hit.
Fix by changing the 'and' to 'or'.
--- arch/x86/kernel/kprobes/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/kprobes/core.c +1 -1
@@ -505,7 +505,7 @@ static void kprobe_emulate_jcc(struct kp match = ((regs->flags &X86_EFLAGS_SF ) >>X86_EFLAGS_SF_BIT ) ^ ((regs->flags &X86_EFLAGS_OF ) >>X86_EFLAGS_OF_BIT );if (p->ainsn.jcc.type >=0xe ) - match = match && (regs->flags &X86_EFLAGS_ZF ); + match = match || (regs->flags &X86_EFLAGS_ZF ); }__kprobe_emulate_jmp (p, regs, (match && !invert) || (!match && invert)); }
Greg Kroah-Hartman
maintainerPATCH 122/201 io_uring: gate iowait schedule on having pending requests
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
Commit 7b72d661f1f2f950ab8c12de7e2bc48bdac8ed69 upstream.
A previous commit made all cqring waits marked as iowait, as a way to improve performance for short schedules with pending IO. However, for use cases that have a special reaper thread that does nothing but wait on events on the ring, this causes a cosmetic issue where we know have one core marked as being "busy" with 100% iowait.
While this isn't a grave issue, it is confusing to users. Rather than always mark us as being in iowait, gate setting of current->in_iowait to 1 by whether or not the waiting task has pending requests.
--- io_uring/io_uring.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-)
io_uring/io_uring.c +17 -6
@@ -7631,12 +7631,21 @@ static int io_run_task_work_sig(void)return -EINTR ; } +static bool current_pending_io (void ) +{ +struct io_uring_task *tctx = current->io_uring; + +if (!tctx) +return false; +return percpu_counter_read_positive (&tctx->inflight); +} +/* when returns >0, the caller should retry */ static inline int io_cqring_wait_schedule (struct io_ring_ctx *ctx,struct io_wait_queue *iowq,ktime_t *timeout) { -int token, ret; +int io_wait, ret;/* make sure we run task_work before checking for signals */ ret =io_run_task_work_sig ();
@@ -7647,15 +7656,17 @@ static inline int io_cqring_wait_schedulreturn 1 ;/* -* Use io_schedule_prepare/finish, so cpufreq can take into account -* that the task is waiting for IO - turns out to be important for low -* QD IO. +* Mark us as being in io_wait if we have pending requests, so cpufreq +* can take into account that the task is waiting for IO - turns out +* to be important for low QD IO. */ - token =io_schedule_prepare (); + io_wait = current->in_iowait; +if (current_pending_io ()) + current->in_iowait =1 ; ret =1 ;if (!schedule_hrtimeout (timeout,HRTIMER_MODE_ABS )) ret = -ETIME ; -io_schedule_finish (token); + current->in_iowait = io_wait;return ret; }
Greg Kroah-Hartman
maintainerPATCH 123/201 perf: Fix function pointer case
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
commit 1af6239d1d3e61d33fd2f0ba53d3d1a67cc50574 upstream.
With the advent of CFI it is no longer acceptible to cast function pointers.
The robot complains thusly:
kernel-events-core.c:warning:cast-from-int-(-)(struct-perf_cpu_pmu_context-)-to-remote_function_f-(aka-int-(-)(void-)-)-converts-to-incompatible-function-type
--- kernel/events/core.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
kernel/events/core.c +6 -2
@@ -1222,6 +1222,11 @@ static int perf_mux_hrtimer_restart(strureturn 0 ; } +static int perf_mux_hrtimer_restart_ipi (void *arg) +{ +return perf_mux_hrtimer_restart (arg); +} +void perf_pmu_disable (struct pmu *pmu) {int *count =this_cpu_ptr (pmu->pmu_disable_count);
@@ -10772,8 +10777,7 @@ perf_event_mux_interval_ms_store(struct cpuctx =per_cpu_ptr (pmu->pmu_cpu_context, cpu); cpuctx->hrtimer_interval =ns_to_ktime (NSEC_PER_MSEC * timer); -cpu_function_call (cpu, - (remote_function_f )perf_mux_hrtimer_restart, cpuctx); +cpu_function_call (cpu, perf_mux_hrtimer_restart_ipi, cpuctx); }cpus_read_unlock ();mutex_unlock (&mux_interval_mutex);
Greg Kroah-Hartman
maintainerPATCH 124/201 loop: Select I/O scheduler none from inside add_disk()
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
commit 2112f5c1330a671fa852051d85cb9eadc05d7eb7 upstream.
We noticed that the user interface of Android devices becomes very slow under memory pressure. This is because Android uses the zram driver on top of the loop driver for swapping, because under memory pressure the swap code alternates reads and writes quickly, because mq-deadline is the default scheduler for loop devices and because mq-deadline delays writes by five seconds for such a workload with default settings. Fix this by making the kernel select I/O scheduler 'none' from inside add_disk() for loop devices. This default can be overridden at any time from user space, e.g. via a udev rule. This approach has an advantage compared to changing the I/O scheduler from userspace from 'mq-deadline' into 'none', namely that synchronize_rcu() does not get called.
This patch changes the default I/O scheduler for loop devices from 'mq-deadline' into 'none'.
Additionally, this patch reduces the Android boot time on my test setup with 0.5 seconds compared to configuring the loop I/O scheduler from user space.
--- drivers/block/loop.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/block/loop.c +2 -1
@@ -2109,7 +2109,8 @@ static int loop_add(struct loop_device * lo->tag_set.queue_depth =128 ; lo->tag_set.numa_node =NUMA_NO_NODE ; lo->tag_set.cmd_size =sizeof (struct loop_cmd ); - lo->tag_set.flags =BLK_MQ_F_SHOULD_MERGE |BLK_MQ_F_STACKING ; + lo->tag_set.flags =BLK_MQ_F_SHOULD_MERGE |BLK_MQ_F_STACKING | +BLK_MQ_F_NO_SCHED ; lo->tag_set.driver_data = lo; err =blk_mq_alloc_tag_set (&lo->tag_set);
Greg Kroah-Hartman
maintainerPATCH 125/201 arm64: dts: imx8mn-var-som: add missing pull-up for onboard PHY reset pinmux
In reply to Greg Kroah-HartmanFrom: Hugo Villeneuve <[email protected]>
[ Upstream commit 253be5b53c2792fb4384f8005b05421e6f040ee3 ]
For SOMs with an onboard PHY, the RESET_N pull-up resistor is currently deactivated in the pinmux configuration. When the pinmux code selects the GPIO function for this pin, with a default direction of input, this prevents the RESET_N pin from being taken to the proper 3.3V level (deasserted), and this results in the PHY being not detected since it is held in reset.
Taken from RESET_N pin description in ADIN13000 datasheet:
This pin requires a 1K pull-up resistor to AVDD_3P3.
Activate the pull-up resistor to fix the issue.
--- arch/arm64/boot/dts/freescale/imx8mn-var-som.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/freescale/imx8mn-var-som.dtsi +1 -1
@@ -351,7 +351,7 @@ MX8MN_IOMUXC_ENET_RXC_ENET1_RGMII_RXC 0x91 MX8MN_IOMUXC_ENET_RX_CTL_ENET1_RGMII_RX_CTL 0x91 MX8MN_IOMUXC_ENET_TX_CTL_ENET1_RGMII_TX_CTL 0x1f - MX8MN_IOMUXC_GPIO1_IO09_GPIO1_IO9 0x19 + MX8MN_IOMUXC_GPIO1_IO09_GPIO1_IO9 0x159 >; };
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 126/201 word-at-a-time: use the same return type for has_zero regardless of endianness
In reply to Greg Kroah-HartmanFrom: [email protected] <[email protected]>
[ Upstream commit 79e8328e5acbe691bbde029a52c89d70dcbc22f3 ]
Compiling big-endian targets with Clang produces the diagnostic:
fs/namei.c:2173:13: warning: use of bitwise '|' with boolean operands [-Wbitwise-instead-of-logical]
} while (!(has_zero(a, &adata, &constants) | has_zero(b, &bdata, &constants)));
~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|| fs/namei.c:2173:13: note: cast one or both operands to int to silence this warning
It appears that when has_zero was introduced, two definitions were produced with different signatures (in particular different return types).
Looking at the usage in hash_name() in fs/namei.c, I suspect that has_zero() is meant to be invoked twice per while loop iteration; using logical-or would not update bdata when a did not have zeros. So I think it's preferred to always return an unsigned long rather than a bool than update the while loop in hash_name() to use a logical-or rather than bitwise-or.
[ Also changed powerpc version to do the same - Linus ]
--- arch/powerpc/include/asm/word-at-a-time.h | 2 +- include/asm-generic/word-at-a-time.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/include/asm/word-at-a-time.h +1 -1
@@ -34,7 +34,7 @@ static inline long find_zero(unsigned long mask)return leading_zero_bits >>3 ; } -static inline bool has_zero (unsigned long val,unsigned long *data,const struct word_at_a_time *c) +static inline unsigned long has_zero (unsigned long val,unsigned long *data,const struct word_at_a_time *c) {unsigned long rhs = val | c->low_bits; *data = rhs;
include/asm-generic/word-at-a-time.h +1 -1
@@ -38,7 +38,7 @@ static inline long find_zero(unsigned long mask)return (mask >>8 ) ? byte : byte +1 ; } -static inline bool has_zero (unsigned long val,unsigned long *data,const struct word_at_a_time *c) +static inline unsigned long has_zero (unsigned long val,unsigned long *data,const struct word_at_a_time *c) {unsigned long rhs = val | c->low_bits; *data = rhs;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 127/201 KVM: s390: fix sthyi error handling
In reply to Greg Kroah-HartmanFrom: Heiko Carstens <[email protected]>
[ Upstream commit 0c02cc576eac161601927b41634f80bfd55bfa9e ]
Commit 9fb6c9b3fea1 ("s390/sthyi: add cache to store hypervisor info") added cache handling for store hypervisor info. This also changed the possible return code for sthyi_fill().
Instead of only returning a condition code like the sthyi instruction would do, it can now also return a negative error value (-ENOMEM). handle_styhi() was not changed accordingly. In case of an error, the negative error value would incorrectly injected into the guest PSW.
Add proper error handling to prevent this, and update the comment which describes the possible return values of sthyi_fill().
--- arch/s390/kernel/sthyi.c | 6 +++--- arch/s390/kvm/intercept.c | 9 ++++++--- 2 files changed, 9 insertions(+), 6 deletions(-)
arch/s390/kernel/sthyi.c +3 -3
@@ -460,9 +460,9 @@ static int sthyi_update_cache(u64 *rc)* * Fills the destination with system information returned by the STHYI * instruction. The data is generated by emulation or execution of STHYI, -* if available. The return value is the condition code that would be -* returned, the rc parameter is the return code which is passed in -* register R2 + 1. +* if available. The return value is either a negative error value or +* the condition code that would be returned, the rc parameter is the +* return code which is passed in register R2 + 1. */ int sthyi_fill (void *dst,u64 *rc) {
arch/s390/kvm/intercept.c +6 -3
@@ -387,8 +387,8 @@ static int handle_partial_execution(struct kvm_vcpu *vcpu)*/ int handle_sthyi (struct kvm_vcpu *vcpu) { -int reg1, reg2, r =0 ; -u64 code, addr, cc =0 , rc =0 ; +int reg1, reg2, cc =0 , r =0 ; +u64 code, addr, rc =0 ;struct sthyi_sctns *sctns =NULL ;if (!test_kvm_facility (vcpu->kvm,74 ))
@@ -419,7 +419,10 @@ int handle_sthyi(struct kvm_vcpu *vcpu)return -ENOMEM ; cc =sthyi_fill (sctns, &rc); - +if (cc <0 ) { +free_page ((unsigned long )sctns); +return cc; + } out:if (!cc) {if (kvm_s390_pv_cpu_is_protected (vcpu)) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 128/201 wifi: cfg80211: Fix return value in scan logic
In reply to Greg Kroah-HartmanFrom: Ilan Peer <[email protected]>
[ Upstream commit fd7f08d92fcd7cc3eca0dd6c853f722a4c6176df ]
The reporter noticed a warning when running iwlwifi:
WARNING: CPU: 8 PID: 659 at mm/page_alloc.c:4453 __alloc_pages+0x329/0x340
As cfg80211_parse_colocated_ap() is not expected to return a negative value return 0 and not a negative value if cfg80211_calc_short_ssid() fails.
--- net/wireless/scan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/wireless/scan.c +1 -1
@@ -641,7 +641,7 @@ static int cfg80211_parse_colocated_ap(const struct cfg80211_bss_ies *ies, ret =cfg80211_calc_short_ssid (ies, &ssid_elem, &s_ssid_tmp);if (ret) -return ret; +return 0 ;/* RNR IE may contain more than one NEIGHBOR_AP_INFO */ while (pos +sizeof (*ap_info) <= end) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 129/201 net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx
In reply to Greg Kroah-HartmanFrom: Zhengchao Shao <[email protected]>
[ Upstream commit 5dd77585dd9d0e03dd1bceb95f0269a7eaf6b936 ]
when mlx5_cmd_exec failed in mlx5dr_cmd_create_reformat_ctx, the memory pointed by 'in' is not released, which will cause memory leak. Move memory release after mlx5_cmd_exec.
--- drivers/net/ethernet/mellanox/mlx5/core/steering/dr_cmd.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/steering/dr_cmd.c +3 -2
@@ -425,11 +425,12 @@ int mlx5dr_cmd_create_reformat_ctx(struct mlx5_core_dev *mdev, err =mlx5_cmd_exec (mdev, in, inlen, out,sizeof (out));if (err) -return err; + goto err_free_in; *reformat_id =MLX5_GET (alloc_packet_reformat_context_out, out, packet_reformat_id); -kvfree (in); +err_free_in: +kvfree (in);return err; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 130/201 net/mlx5e: fix return value check in mlx5e_ipsec_remove_trailer()
In reply to Greg Kroah-HartmanFrom: Yuanjun Gong <[email protected]>
[ Upstream commit e5bcb7564d3bd0c88613c76963c5349be9c511c5 ]
mlx5e_ipsec_remove_trailer() should return an error code if function pskb_trim() returns an unexpected value.
--- drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c +3 -1
@@ -121,7 +121,9 @@ static int mlx5e_ipsec_remove_trailer(struct sk_buff *skb, struct xfrm_state *x) trailer_len = alen + plen +2 ; -pskb_trim (skb, skb->len - trailer_len); + ret =pskb_trim (skb, skb->len - trailer_len); +if (unlikely (ret)) +return ret;if (skb->protocol ==htons (ETH_P_IP )) { ipv4hdr->tot_len =htons (ntohs (ipv4hdr->tot_len) - trailer_len);ip_send_check (ipv4hdr);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 131/201 bpf: Add length check for SK_DIAG_BPF_STORAGE_REQ_MAP_FD parsing
In reply to Greg Kroah-HartmanFrom: Lin Ma <[email protected]>
[ Upstream commit bcc29b7f5af6797702c2306a7aacb831fc5ce9cb ]
The nla_for_each_nested parsing in function bpf_sk_storage_diag_alloc does not check the length of the nested attribute. This can lead to an out-of-attribute read and allow a malformed nlattr (e.g., length 0) to be viewed as a 4 byte integer.
This patch adds an additional check when the nlattr is getting counted. This makes sure the latter nla_get_u32 can access the attributes with the correct length.
--- net/core/bpf_sk_storage.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/core/bpf_sk_storage.c +4 -1
@@ -446,8 +446,11 @@ bpf_sk_storage_diag_alloc(const struct nlattr *nla_stgs)return ERR_PTR (-EPERM );nla_for_each_nested (nla, nla_stgs, rem) { -if (nla_type (nla) ==SK_DIAG_BPF_STORAGE_REQ_MAP_FD ) +if (nla_type (nla) ==SK_DIAG_BPF_STORAGE_REQ_MAP_FD ) { +if (nla_len (nla) !=sizeof (u32)) +return ERR_PTR (-EINVAL ); nr_maps++; + } } diag = kzalloc(sizeof(*diag) + sizeof(diag->maps[0]) * nr_maps,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 132/201 rtnetlink: let rtnl_bridge_setlink checks IFLA_BRIDGE_MODE length
In reply to Greg Kroah-HartmanFrom: Lin Ma <[email protected]>
[ Upstream commit d73ef2d69c0dba5f5a1cb9600045c873bab1fb7f ]
There are totally 9 ndo_bridge_setlink handlers in the current kernel, which are 1) bnxt_bridge_setlink, 2) be_ndo_bridge_setlink 3) i40e_ndo_bridge_setlink 4) ice_bridge_setlink 5) ixgbe_ndo_bridge_setlink 6) mlx5e_bridge_setlink 7) nfp_net_bridge_setlink 8) qeth_l2_bridge_setlink 9) br_setlink.
By investigating the code, we find that 1-7 parse and use nlattr IFLA_BRIDGE_MODE but 3 and 4 forget to do the nla_len check. This can lead to an out-of-attribute read and allow a malformed nlattr (e.g., length 0) to be viewed as a 2 byte integer.
To avoid such issues, also for other ndo_bridge_setlink handlers in the future. This patch adds the nla_len check in rtnl_bridge_setlink and does an early error return if length mismatches. To make it works, the break is removed from the parsing for IFLA_BRIDGE_FLAGS to make sure this nla_for_each_nested iterates every attribute.
--- net/core/rtnetlink.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/core/rtnetlink.c +6 -2
@@ -4897,13 +4897,17 @@ static int rtnl_bridge_setlink(struct sk_buff *skb, struct nlmsghdr *nlh, br_spec =nlmsg_find_attr (nlh,sizeof (struct ifinfomsg ),IFLA_AF_SPEC );if (br_spec) {nla_for_each_nested (attr, br_spec, rem) { -if (nla_type (attr) ==IFLA_BRIDGE_FLAGS ) { +if (nla_type (attr) ==IFLA_BRIDGE_FLAGS && !have_flags) {if (nla_len (attr) <sizeof (flags))return -EINVAL ; have_flags = true; flags =nla_get_u16 (attr); -break ; + } + +if (nla_type (attr) ==IFLA_BRIDGE_MODE ) { +if (nla_len (attr) <sizeof (u16)) +return -EINVAL ; } } }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 133/201 net: dsa: fix value check in bcm_sf2_sw_probe()
In reply to Greg Kroah-HartmanFrom: Yuanjun Gong <[email protected]>
[ Upstream commit dadc5b86cc9459581f37fe755b431adc399ea393 ]
in bcm_sf2_sw_probe(), check the return value of clk_prepare_enable() and return the error code if clk_prepare_enable() returns an unexpected value.
--- drivers/net/dsa/bcm_sf2.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/dsa/bcm_sf2.c +6 -2
@@ -1301,7 +1301,9 @@ static int bcm_sf2_sw_probe(struct platform_device *pdev)if (IS_ERR (priv->clk))return PTR_ERR (priv->clk); -clk_prepare_enable (priv->clk); + ret =clk_prepare_enable (priv->clk); +if (ret) +return ret; priv->clk_mdiv =devm_clk_get_optional (&pdev->dev,"sw_switch_mdiv" );if (IS_ERR (priv->clk_mdiv)) {
@@ -1309,7 +1311,9 @@ static int bcm_sf2_sw_probe(struct platform_device *pdev) goto out_clk; } -clk_prepare_enable (priv->clk_mdiv); + ret =clk_prepare_enable (priv->clk_mdiv); +if (ret) + goto out_clk; ret =bcm_sf2_sw_rst (priv);if (ret) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 134/201 perf test uprobe_from_different_cu: Skip if there is no gcc
In reply to Greg Kroah-HartmanFrom: Georg Müller <[email protected]>
[ Upstream commit 98ce8e4a9dcfb448b30a2d7a16190f4a00382377 ]
Without gcc, the test will fail.
On cleanup, ignore probe removal errors. Otherwise, in case of an error adding the probe, the temporary directory is not removed.
--- tools/perf/tests/shell/test_uprobe_from_different_cu.sh | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
tools/perf/tests/shell/test_uprobe_from_different_cu.sh +7 -1
@@ -4,6 +4,12 @@ set -e +# skip if there's no gcc +if ! [ -x "$(command -v gcc)" ]; then + echo "failed: no gcc compiler" + exit 2 +fi + temp_dir=$(mktemp -d /tmp/perf-uprobe-different-cu-sh.XXXXXXXXXX) cleanup()
@@ -11,7 +17,7 @@ cleanup() trap - EXIT TERM INT if [[ "${temp_dir}" =~ ^/tmp/perf-uprobe-different-cu-sh.*$ ]]; then echo "--- Cleaning up ---" - perf probe -x ${temp_dir}/testfile -d foo + perf probe -x ${temp_dir}/testfile -d foo || true rm -f "${temp_dir}/"* rmdir "${temp_dir}" fi
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 135/201 net: sched: cls_u32: Fix match key mis-addressing
In reply to Greg Kroah-HartmanFrom: Jamal Hadi Salim <[email protected]>
[ Upstream commit e68409db995380d1badacba41ff24996bd396171 ]
A match entry is uniquely identified with an "address" or "path" in the form of: hashtable ID(12b):bucketid(8b):nodeid(12b).
When creating table match entries all of hash table id, bucket id and node (match entry id) are needed to be either specified by the user or reasonable in-kernel defaults are used. The in-kernel default for a table id is 0x800(omnipresent root table); for bucketid it is 0x0. Prior to this fix there was none for a nodeid i.e. the code assumed that the user passed the correct nodeid and if the user passes a nodeid of 0 (as Mingi Cho did) then that is what was used. But nodeid of 0 is reserved for identifying the table. This is not a problem until we dump. The dump code notices that the nodeid is zero and assumes it is referencing a table and therefore references table struct tc_u_hnode instead of what was created i.e match entry struct tc_u_knode.
Ming does an equivalent of:
tc filter add dev dummy0 parent 10: prio 1 handle 0x1000 \
protocol ip u32 match ip src 10.0.0.1/32 classid 10:1 action ok
Essentially specifying a table id 0, bucketid 1 and nodeid of zero Tableid 0 is remapped to the default of 0x800.
Bucketid 1 is ignored and defaults to 0x00.
Nodeid was assumed to be what Ming passed - 0x000
dumping before fix shows:
~$ tc filter ls dev dummy0 parent 10:
filter protocol ip pref 1 u32 chain 0
filter protocol ip pref 1 u32 chain 0 fh 800: ht divisor 1 filter protocol ip pref 1 u32 chain 0 fh 800: ht divisor -30591
Note that the last line reports a table instead of a match entry (you can tell this because it says "ht divisor...").
As a result of reporting the wrong data type (misinterpretting of struct tc_u_knode as being struct tc_u_hnode) the divisor is reported with value of -30591. Ming identified this as part of the heap address (physmap_base is 0xffff8880 (-30591 - 1)).
The fix is to ensure that when table entry matches are added and no nodeid is specified (i.e nodeid == 0) then we get the next available nodeid from the table's pool.
After the fix, this is what the dump shows:
$ tc filter ls dev dummy0 parent 10: filter protocol ip pref 1 u32 chain 0 filter protocol ip pref 1 u32 chain 0 fh 800: ht divisor 1 filter protocol ip pref 1 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 flowid 10:1 not_in_hw match 0a000001/ffffffff at 12 action order 1: gact action pass random type none pass val 0 index 1 ref 1 bind 1
--- net/sched/cls_u32.c | 56 ++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 50 insertions(+), 6 deletions(-)
net/sched/cls_u32.c +50 -6
@@ -999,18 +999,62 @@ static int u32_change(struct net *net, struct sk_buff *in_skb,return -EINVAL ; } +/* At this point, we need to derive the new handle that will be used to +* uniquely map the identity of this table match entry. The +* identity of the entry that we need to construct is 32 bits made of: +* htid(12b):bucketid(8b):node/entryid(12b) +* +* At this point _we have the table(ht)_ in which we will insert this +* entry. We carry the table's id in variable "htid". +* Note that earlier code picked the ht selection either by a) the user +* providing the htid specified via TCA_U32_HASH attribute or b) when +* no such attribute is passed then the root ht, is default to at ID +* 0x[800][00][000]. Rule: the root table has a single bucket with ID 0. +* If OTOH the user passed us the htid, they may also pass a bucketid of +* choice. 0 is fine. For example a user htid is 0x[600][01][000] it is +* indicating hash bucketid of 1. Rule: the entry/node ID _cannot_ be +* passed via the htid, so even if it was non-zero it will be ignored. +* +* We may also have a handle, if the user passed one. The handle also +* carries the same addressing of htid(12b):bucketid(8b):node/entryid(12b). +* Rule: the bucketid on the handle is ignored even if one was passed; +* rather the value on "htid" is always assumed to be the bucketid. +*/ if (handle) { +/* Rule: The htid from handle and tableid from htid must match */ if (TC_U32_HTID (handle) &&TC_U32_HTID (handle ^ htid)) {NL_SET_ERR_MSG_MOD (extack,"Handle specified hash table address mismatch" );return -EINVAL ; } - handle = htid |TC_U32_NODE (handle); - err =idr_alloc_u32 (&ht->handle_idr,NULL , &handle, handle, -GFP_KERNEL ); -if (err) -return err; - }else +/* Ok, so far we have a valid htid(12b):bucketid(8b) but we +* need to finalize the table entry identification with the last +* part - the node/entryid(12b)). Rule: Nodeid _cannot be 0_ for +* entries. Rule: nodeid of 0 is reserved only for tables(see +* earlier code which processes TC_U32_DIVISOR attribute). +* Rule: The nodeid can only be derived from the handle (and not +* htid). +* Rule: if the handle specified zero for the node id example +* 0x60000000, then pick a new nodeid from the pool of IDs +* this hash table has been allocating from. +* If OTOH it is specified (i.e for example the user passed a +* handle such as 0x60000123), then we use it generate our final +* handle which is used to uniquely identify the match entry. +*/ +if (!TC_U32_NODE (handle)) { + handle =gen_new_kid (ht, htid); + }else { + handle = htid |TC_U32_NODE (handle); + err =idr_alloc_u32 (&ht->handle_idr,NULL , &handle, + handle,GFP_KERNEL ); +if (err) +return err; + } + }else { +/* The user did not give us a handle; lets just generate one +* from the table's pool of nodeids. +*/ handle =gen_new_kid (ht, htid); + }if (tb[TCA_U32_SEL ] ==NULL ) {NL_SET_ERR_MSG_MOD (extack,"Selector not specified" );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 136/201 mISDN: hfcpci: Fix potential deadlock on &hc->lock
In reply to Greg Kroah-HartmanFrom: Chengfeng Ye <[email protected]>
[ Upstream commit 56c6be35fcbed54279df0a2c9e60480a61841d6f ]
As &hc->lock is acquired by both timer _hfcpci_softirq() and hardirq hfcpci_int(), the timer should disable irq before lock acquisition otherwise deadlock could happen if the timmer is preemtped by the hadr irq.
Possible deadlock scenario:hfcpci_softirq() (timer)
-> _hfcpci_softirq()
-> spin_lock(&hc->lock);
<irq interruption>
-> hfcpci_int()
-> spin_lock(&hc->lock); (deadlock here)This flaw was found by an experimental static analysis tool I am developing for irq-related deadlock.
The tentative patch fixes the potential deadlock by spin_lock_irq() in timer.
--- drivers/isdn/hardware/mISDN/hfcpci.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/isdn/hardware/mISDN/hfcpci.c +5 -5
@@ -839,7 +839,7 @@ hfcpci_fill_fifo(struct bchannel *bch) *z1t =cpu_to_le16 (new_z1);/* now send data */ if (bch->tx_idx < bch->tx_skb->len)return ; -dev_kfree_skb (bch->tx_skb); +dev_kfree_skb_any (bch->tx_skb);if (get_next_bframe (bch)) goto next_t_frame;return ;
@@ -895,7 +895,7 @@ hfcpci_fill_fifo(struct bchannel *bch) } bz->za[new_f1].z1 =cpu_to_le16 (new_z1);/* for next buffer */ bz->f1 = new_f1;/* next frame */ -dev_kfree_skb (bch->tx_skb); +dev_kfree_skb_any (bch->tx_skb);get_next_bframe (bch); }
@@ -1119,7 +1119,7 @@ tx_birq(struct bchannel *bch)if (bch->tx_skb && bch->tx_idx < bch->tx_skb->len)hfcpci_fill_fifo (bch);else { -dev_kfree_skb (bch->tx_skb); +dev_kfree_skb_any (bch->tx_skb);if (get_next_bframe (bch))hfcpci_fill_fifo (bch); }
@@ -2277,7 +2277,7 @@ _hfcpci_softirq(struct device *dev, void *unused)return 0 ;if (hc->hw.int_m2 &HFCPCI_IRQ_ENABLE ) { -spin_lock (&hc->lock); +spin_lock_irq (&hc->lock); bch =Sel_BCS (hc, hc->hw.bswapped ?2 :1 );if (bch && bch->state ==ISDN_P_B_RAW ) {/* B1 rx&tx */ main_rec_hfcpci (bch);
@@ -2288,7 +2288,7 @@ _hfcpci_softirq(struct device *dev, void *unused)main_rec_hfcpci (bch);tx_birq (bch); } -spin_unlock (&hc->lock); +spin_unlock_irq (&hc->lock); }return 0 ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 137/201 net: annotate data-races around sk->sk_max_pacing_rate
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit ea7f45ef77b39e72244d282e47f6cb1ef4135cd2 ]
sk_getsockopt() runs locklessly. This means sk->sk_max_pacing_rate can be read while other threads are changing its value.
--- net/core/sock.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
net/core/sock.c +6 -3
@@ -1183,7 +1183,8 @@ int sock_setsockopt(struct socket *sock, int level, int optname,cmpxchg (&sk->sk_pacing_status,SK_PACING_NONE ,SK_PACING_NEEDED ); - sk->sk_max_pacing_rate = ulval; +/* Pairs with READ_ONCE() from sk_getsockopt() */ +WRITE_ONCE (sk->sk_max_pacing_rate, ulval); sk->sk_pacing_rate =min (sk->sk_pacing_rate, ulval);break ; }
@@ -1551,12 +1552,14 @@ int sock_getsockopt(struct socket *sock, int level, int optname,#endif case SO_MAX_PACING_RATE : +/* The READ_ONCE() pair with the WRITE_ONCE() in sk_setsockopt() */ if (sizeof (v.ulval) !=sizeof (v.val) && len >=sizeof (v.ulval)) { lv =sizeof (v.ulval); - v.ulval = sk->sk_max_pacing_rate; + v.ulval =READ_ONCE (sk->sk_max_pacing_rate); }else {/* 32bit version */ - v.val = min_t(unsigned long, sk->sk_max_pacing_rate, ~0U); + v.val = min_t(unsigned long, ~0U, +READ_ONCE (sk->sk_max_pacing_rate)); }break ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 138/201 net: add missing READ_ONCE(sk->sk_rcvlowat) annotation
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit e6d12bdb435d23ff6c1890c852d85408a2f496ee ]
In a prior commit, I forgot to change sk_getsockopt() when reading sk->sk_rcvlowat locklessly.
--- net/core/sock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/core/sock.c +1 -1
@@ -1423,7 +1423,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,break ;case SO_RCVLOWAT : - v.val = sk->sk_rcvlowat; + v.val =READ_ONCE (sk->sk_rcvlowat);break ;case SO_SNDLOWAT :
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 139/201 net: add missing READ_ONCE(sk->sk_sndbuf) annotation
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 74bc084327c643499474ba75df485607da37dd6e ]
In a prior commit, I forgot to change sk_getsockopt() when reading sk->sk_sndbuf locklessly.
--- net/core/sock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/core/sock.c +1 -1
@@ -1332,7 +1332,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,break ;case SO_SNDBUF : - v.val = sk->sk_sndbuf; + v.val =READ_ONCE (sk->sk_sndbuf);break ;case SO_RCVBUF :
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 140/201 net: add missing READ_ONCE(sk->sk_rcvbuf) annotation
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit b4b553253091cafe9ec38994acf42795e073bef5 ]
In a prior commit, I forgot to change sk_getsockopt() when reading sk->sk_rcvbuf locklessly.
--- net/core/sock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/core/sock.c +1 -1
@@ -1336,7 +1336,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,break ;case SO_RCVBUF : - v.val = sk->sk_rcvbuf; + v.val =READ_ONCE (sk->sk_rcvbuf);break ;case SO_REUSEADDR :
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 141/201 net: add missing data-race annotations around sk->sk_peek_off
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 11695c6e966b0ec7ed1d16777d294cef865a5c91 ]
sk_getsockopt() runs locklessly, thus we need to annotate the read of sk->sk_peek_off.
While we are at it, add corresponding annotations to sk_set_peek_off() and unix_set_peek_off().
--- net/core/sock.c | 4 ++-- net/unix/af_unix.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
net/core/sock.c +2 -2
@@ -1517,7 +1517,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,if (!sock->ops->set_peek_off)return -EOPNOTSUPP ; - v.val = sk->sk_peek_off; + v.val =READ_ONCE (sk->sk_peek_off);break ;case SO_NOFCS : v.val =sock_flag (sk,SOCK_NOFCS );
@@ -2745,7 +2745,7 @@ EXPORT_SYMBOL(__sk_mem_reclaim);int sk_set_peek_off (struct sock *sk,int val) { - sk->sk_peek_off = val; +WRITE_ONCE (sk->sk_peek_off, val);return 0 ; }EXPORT_SYMBOL_GPL (sk_set_peek_off);
net/unix/af_unix.c +1 -1
@@ -697,7 +697,7 @@ static int unix_set_peek_off(struct sock *sk, int val)if (mutex_lock_interruptible (&u->iolock))return -EINTR ; - sk->sk_peek_off = val; +WRITE_ONCE (sk->sk_peek_off, val);mutex_unlock (&u->iolock);return 0 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 142/201 net: add missing data-race annotation for sk_ll_usec
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit e5f0d2dd3c2faa671711dac6d3ff3cef307bcfe3 ]
In a prior commit I forgot that sk_getsockopt() reads sk->sk_ll_usec without holding a lock.
--- net/core/sock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/core/sock.c +1 -1
@@ -1547,7 +1547,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,#ifdef CONFIG_NET_RX_BUSY_POLL case SO_BUSY_POLL : - v.val = sk->sk_ll_usec; + v.val =READ_ONCE (sk->sk_ll_usec);break ;#endif
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 143/201 net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free
In reply to Greg Kroah-HartmanFrom: valis <[email protected]>
[ Upstream commit 3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81 ]
When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter.
This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.
Fix this by no longer copying the tcf_result struct from the old filter.
--- net/sched/cls_u32.c | 1 - 1 file changed, 1 deletion(-)
net/sched/cls_u32.c +0 -1
@@ -812,7 +812,6 @@ static struct tc_u_knode *u32_init_knode(struct net *net, struct tcf_proto *tp, new->ifindex = n->ifindex; new->fshift = n->fshift; - new->res = n->res; new->flags = n->flags;RCU_INIT_POINTER (new->ht_down, ht);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 144/201 net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free
In reply to Greg Kroah-HartmanFrom: valis <[email protected]>
[ Upstream commit 76e42ae831991c828cffa8c37736ebfb831ad5ec ]
When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter.
This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.
Fix this by no longer copying the tcf_result struct from the old filter.
--- net/sched/cls_fw.c | 1 - 1 file changed, 1 deletion(-)
net/sched/cls_fw.c +0 -1
@@ -266,7 +266,6 @@ static int fw_change(struct net *net, struct sk_buff *in_skb,return -ENOBUFS ; fnew->id = f->id; - fnew->res = f->res; fnew->ifindex = f->ifindex; fnew->tp = f->tp;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 145/201 net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free
In reply to Greg Kroah-HartmanFrom: valis <[email protected]>
[ Upstream commit b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8 ]
When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter.
This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.
Fix this by no longer copying the tcf_result struct from the old filter.
--- net/sched/cls_route.c | 1 - 1 file changed, 1 deletion(-)
net/sched/cls_route.c +0 -1
@@ -511,7 +511,6 @@ static int route4_change(struct net *net, struct sk_buff *in_skb,if (fold) { f->id = fold->id; f->iif = fold->iif; - f->res = fold->res; f->handle = fold->handle; f->tp = fold->tp;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 146/201 bpf: sockmap: Remove preempt_disable in sock_map_sk_acquire
In reply to Greg Kroah-HartmanFrom: Tomas Glozar <[email protected]>
[ Upstream commit 13d2618b48f15966d1adfe1ff6a1985f5eef40ba ]
Disabling preemption in sock_map_sk_acquire conflicts with GFP_ATOMIC allocation later in sk_psock_init_link on PREEMPT_RT kernels, since GFP_ATOMIC might sleep on RT (see bpf: Make BPF and PREEMPT_RT co-exist patchset notes for details).
This causes calling bpf_map_update_elem on BPF_MAP_TYPE_SOCKMAP maps to BUG (sleeping function called from invalid context) on RT kernels.
preempt_disable was introduced together with lock_sk and rcu_read_lock in commit 99ba2b5aba24e ("bpf: sockhash, disallow bpf_tcp_close and update in parallel"), probably to match disabled migration of BPF programs, and is no longer necessary.
Remove preempt_disable to fix BUG in sock_map_update_common on RT.
--- net/core/sock_map.c | 2 -- 1 file changed, 2 deletions(-)
net/core/sock_map.c +0 -2
@@ -122,7 +122,6 @@ static void sock_map_sk_acquire(struct sock *sk) __acquires(&sk->sk_lock.slock) {lock_sock (sk); -preempt_disable ();rcu_read_lock (); }
@@ -130,7 +129,6 @@ static void sock_map_sk_release(struct sock *sk) __releases(&sk->sk_lock.slock) {rcu_read_unlock (); -preempt_enable ();release_sock (sk); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 147/201 net: ll_temac: Switch to use dev_err_probe() helper
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
[ Upstream commit 75ae8c284c00dc3584b7c173f6fcf96ee15bd02c ]
dev_err() can be replace with dev_err_probe() which will check if error code is -EPROBE_DEFER.
Stable-dep-of: ef45e8400f5b ("net: ll_temac: fix error checking of irq_of_parse_and_map()")
--- drivers/net/ethernet/xilinx/ll_temac_main.c | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-)
drivers/net/ethernet/xilinx/ll_temac_main.c +6 -10
@@ -1550,16 +1550,12 @@ static int temac_probe(struct platform_device *pdev) }/* Error handle returned DMA RX and TX interrupts */ -if (lp->rx_irq <0 ) { -if (lp->rx_irq != -EPROBE_DEFER ) -dev_err (&pdev->dev,"could not get DMA RX irq\n" ); -return lp->rx_irq; - } -if (lp->tx_irq <0 ) { -if (lp->tx_irq != -EPROBE_DEFER ) -dev_err (&pdev->dev,"could not get DMA TX irq\n" ); -return lp->tx_irq; - } +if (lp->rx_irq <0 ) +return dev_err_probe (&pdev->dev, lp->rx_irq, +"could not get DMA RX irq\n" ); +if (lp->tx_irq <0 ) +return dev_err_probe (&pdev->dev, lp->tx_irq, +"could not get DMA TX irq\n" );if (temac_np) {/* Retrieve the MAC address */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 148/201 net: ll_temac: fix error checking of irq_of_parse_and_map()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit ef45e8400f5bb66b03cc949f76c80e2a118447de ]
Most kernel functions return negative error codes but some irq functions return zero on error. In this code irq_of_parse_and_map(), returns zero and platform_get_irq() returns negative error codes. We need to handle both cases appropriately.
--- drivers/net/ethernet/xilinx/ll_temac_main.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/net/ethernet/xilinx/ll_temac_main.c +8 -4
@@ -1550,12 +1550,16 @@ static int temac_probe(struct platform_device *pdev) }/* Error handle returned DMA RX and TX interrupts */ -if (lp->rx_irq <0 ) -return dev_err_probe (&pdev->dev, lp->rx_irq, +if (lp->rx_irq <=0 ) { + rc = lp->rx_irq ?: -EINVAL ; +return dev_err_probe (&pdev->dev, rc,"could not get DMA RX irq\n" ); -if (lp->tx_irq <0 ) -return dev_err_probe (&pdev->dev, lp->tx_irq, + } +if (lp->tx_irq <=0 ) { + rc = lp->tx_irq ?: -EINVAL ; +return dev_err_probe (&pdev->dev, rc,"could not get DMA TX irq\n" ); + }if (temac_np) {/* Retrieve the MAC address */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 149/201 net: netsec: Ignore phy-mode on SynQuacer in DT mode
In reply to Greg Kroah-HartmanFrom: Mark Brown <[email protected]>
[ Upstream commit f3bb7759a924713bc54d15f6d0d70733b5935fad ]
As documented in acd7aaf51b20 ("netsec: ignore 'phy-mode' device property on ACPI systems") the SocioNext SynQuacer platform ships with firmware defining the PHY mode as RGMII even though the physical configuration of the PHY is for TX and RX delays. Since bbc4d71d63549bc ("net: phy: realtek: fix rtl8211e rx/tx delay config") this has caused misconfiguration of the PHY, rendering the network unusable.
This was worked around for ACPI by ignoring the phy-mode property but the system is also used with DT. For DT instead if we're running on a SynQuacer force a working PHY mode, as well as the standard EDK2 firmware with DT there are also some of these systems that use u-boot and might not initialise the PHY if not netbooting. Newer firmware imagaes for at least EDK2 are available from Linaro so print a warning when doing this.
--- drivers/net/ethernet/socionext/netsec.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/net/ethernet/socionext/netsec.c +11 -0
@@ -1845,6 +1845,17 @@ static int netsec_of_probe(struct platform_device *pdev,return err; } +/* +* SynQuacer is physically configured with TX and RX delays +* but the standard firmware claimed otherwise for a long +* time, ignore it. +*/ +if (of_machine_is_compatible ("socionext,developer-box" ) && + priv->phy_interface !=PHY_INTERFACE_MODE_RGMII_ID ) { +dev_warn (&pdev->dev,"Outdated firmware reports incorrect PHY mode, overriding\n" ); + priv->phy_interface =PHY_INTERFACE_MODE_RGMII_ID ; + } + priv->phy_np =of_parse_phandle (pdev->dev.of_node,"phy-handle" ,0 );if (!priv->phy_np) {dev_err (&pdev->dev,"missing required property 'phy-handle'\n" );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 150/201 net: dcb: choose correct policy to parse DCB_ATTR_BCN
In reply to Greg Kroah-HartmanFrom: Lin Ma <[email protected]>
[ Upstream commit 31d49ba033095f6e8158c60f69714a500922e0c3 ]
The dcbnl_bcn_setcfg uses erroneous policy to parse tb[DCB_ATTR_BCN], which is introduced in commit 859ee3c43812 ("DCB: Add support for DCB BCN"). Please see the comment in below code
static int dcbnl_bcn_setcfg(...)
{
...
ret = nla_parse_nested_deprecated(..., dcbnl_pfc_up_nest, .. ) // !!! dcbnl_pfc_up_nest for attributes
// DCB_PFC_UP_ATTR_0 to DCB_PFC_UP_ATTR_ALL in enum dcbnl_pfc_up_attrs
...
for (i = DCB_BCN_ATTR_RP_0; i <= DCB_BCN_ATTR_RP_7; i++) { // !!! DCB_BCN_ATTR_RP_0 to DCB_BCN_ATTR_RP_7 in enum dcbnl_bcn_attrs
...
value_byte = nla_get_u8(data[i]);
...
}
...
for (i = DCB_BCN_ATTR_BCNA_0; i <= DCB_BCN_ATTR_RI; i++) {
// !!! DCB_BCN_ATTR_BCNA_0 to DCB_BCN_ATTR_RI in enum dcbnl_bcn_attrs
...
value_int = nla_get_u32(data[i]); ...
}
...
}
That is, the nla_parse_nested_deprecated uses dcbnl_pfc_up_nest attributes to parse nlattr defined in dcbnl_pfc_up_attrs. But the following access code fetch each nlattr as dcbnl_bcn_attrs attributes. By looking up the associated nla_policy for dcbnl_bcn_attrs. We can find the beginning part of these two policies are "same".
static const struct nla_policy dcbnl_pfc_up_nest[...] = {
[DCB_PFC_UP_ATTR_0] = {.type = NLA_U8},
[DCB_PFC_UP_ATTR_1] = {.type = NLA_U8},
[DCB_PFC_UP_ATTR_2] = {.type = NLA_U8},
[DCB_PFC_UP_ATTR_3] = {.type = NLA_U8},
[DCB_PFC_UP_ATTR_4] = {.type = NLA_U8},
[DCB_PFC_UP_ATTR_5] = {.type = NLA_U8},
[DCB_PFC_UP_ATTR_6] = {.type = NLA_U8},
[DCB_PFC_UP_ATTR_7] = {.type = NLA_U8},
[DCB_PFC_UP_ATTR_ALL] = {.type = NLA_FLAG},
};static const struct nla_policy dcbnl_bcn_nest[...] = {
[DCB_BCN_ATTR_RP_0] = {.type = NLA_U8},
[DCB_BCN_ATTR_RP_1] = {.type = NLA_U8},
[DCB_BCN_ATTR_RP_2] = {.type = NLA_U8},
[DCB_BCN_ATTR_RP_3] = {.type = NLA_U8},
[DCB_BCN_ATTR_RP_4] = {.type = NLA_U8},
[DCB_BCN_ATTR_RP_5] = {.type = NLA_U8},
[DCB_BCN_ATTR_RP_6] = {.type = NLA_U8},
[DCB_BCN_ATTR_RP_7] = {.type = NLA_U8},
[DCB_BCN_ATTR_RP_ALL] = {.type = NLA_FLAG},
// from here is somewhat different
[DCB_BCN_ATTR_BCNA_0] = {.type = NLA_U32},
...
[DCB_BCN_ATTR_ALL] = {.type = NLA_FLAG},
};Therefore, the current code is buggy and this nla_parse_nested_deprecated could overflow the dcbnl_pfc_up_nest and use the adjacent nla_policy to parse attributes from DCB_BCN_ATTR_BCNA_0.
Hence use the correct policy dcbnl_bcn_nest to parse the nested tb[DCB_ATTR_BCN] TLV.
--- net/dcb/dcbnl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/dcb/dcbnl.c +1 -1
@@ -946,7 +946,7 @@ static int dcbnl_bcn_setcfg(struct net_device *netdev, struct nlmsghdr *nlh,return -EOPNOTSUPP ; ret =nla_parse_nested_deprecated (data,DCB_BCN_ATTR_MAX , - tb[DCB_ATTR_BCN ], dcbnl_pfc_up_nest, + tb[DCB_ATTR_BCN ], dcbnl_bcn_nest,NULL );if (ret)return ret;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 151/201 s390/qeth: Dont call dev_close/dev_open (DOWN/UP)
In reply to Greg Kroah-HartmanFrom: Alexandra Winter <[email protected]>
[ Upstream commit 1cfef80d4c2b2c599189f36f36320b205d9447d9 ]
dev_close() and dev_open() are issued to change the interface state to DOWN or UP (dev->flags IFF_UP). When the netdev is set DOWN it loses e.g its Ipv6 addresses and routes. We don't want this in cases of device recovery (triggered by hardware or software) or when the qeth device is set offline.
Setting a qeth device offline or online and device recovery actions call netif_device_detach() and/or netif_device_attach(). That will reset or set the LOWER_UP indication i.e. change the dev->state Bit __LINK_STATE_PRESENT. That is enough to e.g. cause bond failovers, and still preserves the interface settings that are handled by the network stack.
Don't call dev_open() nor dev_close() from the qeth device driver. Let the network stack handle this.
--- drivers/s390/net/qeth_core.h | 1 - drivers/s390/net/qeth_core_main.c | 2 -- drivers/s390/net/qeth_l2_main.c | 9 ++++++--- drivers/s390/net/qeth_l3_main.c | 8 +++++--- 4 files changed, 11 insertions(+), 9 deletions(-)
drivers/s390/net/qeth_core.h +0 -1
@@ -719,7 +719,6 @@ struct qeth_card_info {u16 chid; u8 ids_valid:1; /* cssid,iid,chid */ u8 dev_addr_is_registered:1; - u8 open_when_online:1; u8 promisc_mode:1; u8 use_v1_blkt:1; u8 is_vm_nic:1;
drivers/s390/net/qeth_core_main.c +0 -2
@@ -5351,8 +5351,6 @@ int qeth_set_offline(struct qeth_card *card, const struct qeth_discipline *disc,qeth_clear_ipacmd_list (card);rtnl_lock (); - card->info.open_when_online = card->dev->flags &IFF_UP ; -dev_close (card->dev);netif_device_detach (card->dev);netif_carrier_off (card->dev);rtnl_unlock ();
drivers/s390/net/qeth_l2_main.c +6 -3
@@ -2270,9 +2270,12 @@ static int qeth_l2_set_online(struct qeth_card *card, bool carrier_ok)qeth_enable_hw_features (dev);qeth_l2_enable_brport_features (card); -if (card->info.open_when_online) { - card->info.open_when_online =0 ; -dev_open (dev,NULL ); +if (netif_running (dev)) { +local_bh_disable (); +napi_schedule (&card->napi); +/* kick-start the NAPI softirq: */ +local_bh_enable (); +qeth_l2_set_rx_mode (dev); }rtnl_unlock (); }
drivers/s390/net/qeth_l3_main.c +5 -3
@@ -2037,9 +2037,11 @@ static int qeth_l3_set_online(struct qeth_card *card, bool carrier_ok)netif_device_attach (dev);qeth_enable_hw_features (dev); -if (card->info.open_when_online) { - card->info.open_when_online =0 ; -dev_open (dev,NULL ); +if (netif_running (dev)) { +local_bh_disable (); +napi_schedule (&card->napi); +/* kick-start the NAPI softirq: */ +local_bh_enable (); }rtnl_unlock (); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 152/201 ip6mr: Fix skb_under_panic in ip6mr_cache_report()
In reply to Greg Kroah-HartmanFrom: Yue Haibing <[email protected]>
[ Upstream commit 30e0191b16e8a58e4620fa3e2839ddc7b9d4281c ]
skbuff: skb_under_panic: text:ffffffff88771f69 len:56 put:-4
head:ffff88805f86a800 data:ffff887f5f86a850 tail:0x88 end:0x2c0 dev:pim6reg
------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:192! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 2 PID: 22968 Comm: kworker/2:11 Not tainted 6.5.0-rc3-00044-g0a8db05b571a #236 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:skb_panic+0x152/0x1d0 Call Trace: <TASK> skb_push+0xc4/0xe0 ip6mr_cache_report+0xd69/0x19b0 reg_vif_xmit+0x406/0x690 dev_hard_start_xmit+0x17e/0x6e0 __dev_queue_xmit+0x2d6a/0x3d20 vlan_dev_hard_start_xmit+0x3ab/0x5c0 dev_hard_start_xmit+0x17e/0x6e0 __dev_queue_xmit+0x2d6a/0x3d20 neigh_connected_output+0x3ed/0x570 ip6_finish_output2+0x5b5/0x1950 ip6_finish_output+0x693/0x11c0 ip6_output+0x24b/0x880 NF_HOOK.constprop.0+0xfd/0x530 ndisc_send_skb+0x9db/0x1400 ndisc_send_rs+0x12a/0x6c0 addrconf_dad_completed+0x3c9/0xea0 addrconf_dad_work+0x849/0x1420 process_one_work+0xa22/0x16e0 worker_thread+0x679/0x10c0 ret_from_fork+0x28/0x60 ret_from_fork_asm+0x11/0x20
When setup a vlan device on dev pim6reg, DAD ns packet may sent on reg_vif_xmit(). reg_vif_xmit()
ip6mr_cache_report()
skb_push(skb, -skb_network_offset(pkt));//skb_network_offset(pkt) is 4
And skb_push declared as:
void *skb_push(struct sk_buff *skb, unsigned int len); skb->data -= len; //0xffff88805f86a84c - 0xfffffffc = 0xffff887f5f86a850
skb->data is set to 0xffff887f5f86a850, which is invalid mem addr, lead to skb_push() fails.
--- net/ipv6/ip6mr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/ip6mr.c +1 -1
@@ -1069,7 +1069,7 @@ static int ip6mr_cache_report(struct mr_table *mrt, struct sk_buff *pkt,And all this only to mangle msg->im6_msgtype and to set msg->im6_mbz to "mbz" :-) */ -skb_push (skb, -skb_network_offset (pkt)); +__skb_pull (skb,skb_network_offset (pkt));skb_push (skb,sizeof (*msg));skb_reset_transport_header (skb);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 153/201 vxlan: Fix nexthop hash size
In reply to Greg Kroah-HartmanFrom: Benjamin Poirier <[email protected]>
[ Upstream commit 0756384fb1bd38adb2ebcfd1307422f433a1d772 ]
The nexthop code expects a 31 bit hash, such as what is returned by fib_multipath_hash() and rt6_multipath_hash(). Passing the 32 bit hash returned by skb_get_hash() can lead to problems related to the fact that 'int hash' is a negative number when the MSB is set.
In the case of hash threshold nexthop groups, nexthop_select_path_hthr() will disproportionately select the first nexthop group entry. In the case of resilient nexthop groups, nexthop_select_path_res() may do an out of bounds access in nh_buckets[], for example:
hash = -912054133
num_nh_buckets = 2
bucket_index = 65535which leads to the following panic:
BUG: unable to handle page fault for address: ffffc900025910c8 PGD 100000067 P4D 100000067 PUD 10026b067 PMD 0 Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI CPU: 4 PID: 856 Comm: kworker/4:3 Not tainted 6.5.0-rc2+ #34 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:nexthop_select_path+0x197/0xbf0 Code: c1 e4 05 be 08 00 00 00 4c 8b 35 a4 14 7e 01 4e 8d 6c 25 00 4a 8d 7c 25 08 48 01 dd e8 c2 25 15 ff 49 8d 7d 08 e8 39 13 15 ff <4d> 89 75 08 48 89 ef e8 7d 12 15 ff 48 8b 5d 00 e8 14 55 2f 00 85 RSP: 0018:ffff88810c36f260 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 00000000002000c0 RCX: ffffffffaf02dd77 RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffffc900025910c8 RBP: ffffc900025910c0 R08: 0000000000000001 R09: fffff520004b2219 R10: ffffc900025910cf R11: 31392d2068736168 R12: 00000000002000c0 R13: ffffc900025910c0 R14: 00000000fffef608 R15: ffff88811840e900 FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc900025910c8 CR3: 0000000129d00000 CR4: 0000000000750ee0 PKRU: 55555554 Call Trace: <TASK> ? __die+0x23/0x70 ? page_fault_oops+0x1ee/0x5c0 ? __pfx_is_prefetch.constprop.0+0x10/0x10 ? __pfx_page_fault_oops+0x10/0x10 ? search_bpf_extables+0xfe/0x1c0 ? fixup_exception+0x3b/0x470 ? exc_page_fault+0xf6/0x110 ? asm_exc_page_fault+0x26/0x30 ? nexthop_select_path+0x197/0xbf0 ? nexthop_select_path+0x197/0xbf0 ? lock_is_held_type+0xe7/0x140 vxlan_xmit+0x5b2/0x2340 ? __lock_acquire+0x92b/0x3370 ? __pfx_vxlan_xmit+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 ? __pfx_register_lock_class+0x10/0x10 ? skb_network_protocol+0xce/0x2d0 ? dev_hard_start_xmit+0xca/0x350 ? __pfx_vxlan_xmit+0x10/0x10 dev_hard_start_xmit+0xca/0x350 __dev_queue_xmit+0x513/0x1e20 ? __pfx___dev_queue_xmit+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? mark_held_locks+0x44/0x90 ? skb_push+0x4c/0x80 ? eth_header+0x81/0xe0 ? __pfx_eth_header+0x10/0x10 ? neigh_resolve_output+0x215/0x310 ? ip6_finish_output2+0x2ba/0xc90 ip6_finish_output2+0x2ba/0xc90 ? lock_release+0x236/0x3e0 ? ip6_mtu+0xbb/0x240 ? __pfx_ip6_finish_output2+0x10/0x10 ? find_held_lock+0x83/0xa0 ? lock_is_held_type+0xe7/0x140 ip6_finish_output+0x1ee/0x780 ip6_output+0x138/0x460 ? __pfx_ip6_output+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 ? __pfx_ip6_finish_output+0x10/0x10 NF_HOOK.constprop.0+0xc0/0x420 ? __pfx_NF_HOOK.constprop.0+0x10/0x10 ? ndisc_send_skb+0x2c0/0x960 ? __pfx_lock_release+0x10/0x10 ? __local_bh_enable_ip+0x93/0x110 ? lock_is_held_type+0xe7/0x140 ndisc_send_skb+0x4be/0x960 ? __pfx_ndisc_send_skb+0x10/0x10 ? mark_held_locks+0x65/0x90 ? find_held_lock+0x83/0xa0 ndisc_send_ns+0xb0/0x110 ? __pfx_ndisc_send_ns+0x10/0x10 addrconf_dad_work+0x631/0x8e0 ? lock_acquire+0x180/0x3f0 ? __pfx_addrconf_dad_work+0x10/0x10 ? mark_held_locks+0x24/0x90 process_one_work+0x582/0x9c0 ? __pfx_process_one_work+0x10/0x10 ? __pfx_do_raw_spin_lock+0x10/0x10 ? mark_held_locks+0x24/0x90 worker_thread+0x93/0x630 ? __kthread_parkme+0xdc/0x100 ? __pfx_worker_thread+0x10/0x10 kthread+0x1a5/0x1e0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x60 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30 RIP: 0000:0x0 Code: Unable to access opcode bytes at 0xffffffffffffffd6. RSP: 0000:0000000000000000 EFLAGS: 00000000 ORIG_RAX: 0000000000000000 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK> Modules linked in: CR2: ffffc900025910c8 ---[ end trace 0000000000000000 ]--- RIP: 0010:nexthop_select_path+0x197/0xbf0 Code: c1 e4 05 be 08 00 00 00 4c 8b 35 a4 14 7e 01 4e 8d 6c 25 00 4a 8d 7c 25 08 48 01 dd e8 c2 25 15 ff 49 8d 7d 08 e8 39 13 15 ff <4d> 89 75 08 48 89 ef e8 7d 12 15 ff 48 8b 5d 00 e8 14 55 2f 00 85 RSP: 0018:ffff88810c36f260 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 00000000002000c0 RCX: ffffffffaf02dd77 RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffffc900025910c8 RBP: ffffc900025910c0 R08: 0000000000000001 R09: fffff520004b2219 R10: ffffc900025910cf R11: 31392d2068736168 R12: 00000000002000c0 R13: ffffc900025910c0 R14: 00000000fffef608 R15: ffff88811840e900 FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 0000000129d00000 CR4: 0000000000750ee0 PKRU: 55555554 Kernel panic - not syncing: Fatal exception in interrupt Kernel Offset: 0x2ca00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
Fix this problem by ensuring the MSB of hash is 0 using a right shift - the same approach used in fib_multipath_hash() and rt6_multipath_hash().
--- include/net/vxlan.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/net/vxlan.h +2 -2
@@ -497,12 +497,12 @@ static inline void vxlan_flag_attr_error(int attrtype, }static inline bool vxlan_fdb_nh_path_select (struct nexthop *nh, -int hash, +u32 hash,struct vxlan_rdst *rdst) {struct fib_nh_common *nhc; - nhc =nexthop_path_fdb_result (nh, hash); + nhc =nexthop_path_fdb_result (nh, hash >>1 );if (unlikely (!nhc))return false;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 154/201 net/mlx5: fs_core: Make find_closest_ft more generic
In reply to Greg Kroah-HartmanFrom: Jianbo Liu <[email protected]>
[ Upstream commit 618d28a535a0582617465d14e05f3881736a2962 ]
As find_closest_ft_recursive is called to find the closest FT, the first parameter of find_closest_ft can be changed from fs_prio to fs_node. Thus this function is extended to find the closest FT for the nodes of any type, not only prios, but also the sub namespaces.
Stable-dep-of: c635ca45a7a2 ("net/mlx5: fs_core: Skip the FTs in the same FS_TYPE_PRIO_CHAINS fs_prio")
--- .../net/ethernet/mellanox/mlx5/core/fs_core.c | 29 +++++++++---------- 1 file changed, 14 insertions(+), 15 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +14 -15
@@ -818,18 +818,17 @@ static struct mlx5_flow_table *find_closest_ft_recursive(struct fs_node *root,return ft; } -/* If reverse is false then return the first flow table in next priority of -* prio in the tree, else return the last flow table in the previous priority -* of prio in the tree. +/* If reverse is false then return the first flow table next to the passed node +* in the tree, else return the last flow table before the node in the tree. */ -static struct mlx5_flow_table *find_closest_ft (struct fs_prio *prio,bool reverse) +static struct mlx5_flow_table *find_closest_ft (struct fs_node *node,bool reverse) {struct mlx5_flow_table *ft =NULL ;struct fs_node *curr_node;struct fs_node *parent; - parent = prio->node.parent; - curr_node = &prio->node; + parent = node->parent; + curr_node = node;while (!ft && parent) { ft =find_closest_ft_recursive (parent, &curr_node->list, reverse); curr_node = parent;
@@ -839,15 +838,15 @@ static struct mlx5_flow_table *find_closest_ft(struct fs_prio *prio, bool revers }/* Assuming all the tree is locked by mutex chain lock */ -static struct mlx5_flow_table *find_next_chained_ft (struct fs_prio *prio) +static struct mlx5_flow_table *find_next_chained_ft (struct fs_node *node) { -return find_closest_ft (prio, false); +return find_closest_ft (node, false); }/* Assuming all the tree is locked by mutex chain lock */ -static struct mlx5_flow_table *find_prev_chained_ft (struct fs_prio *prio) +static struct mlx5_flow_table *find_prev_chained_ft (struct fs_node *node) { -return find_closest_ft (prio, true); +return find_closest_ft (node, true); } static struct mlx5_flow_table *find_next_fwd_ft(struct mlx5_flow_table *ft,
@@ -859,7 +858,7 @@ static struct mlx5_flow_table *find_next_fwd_ft(struct mlx5_flow_table *ft, next_ns = flow_act->action &MLX5_FLOW_CONTEXT_ACTION_FWD_NEXT_NS ;fs_get_obj (prio, next_ns ? ft->ns->node.parent : ft->node.parent); -return find_next_chained_ft (prio); +return find_next_chained_ft (&prio->node); } static int connect_fts_in_prio(struct mlx5_core_dev *dev,
@@ -890,7 +889,7 @@ static int connect_prev_fts(struct mlx5_core_dev *dev, {struct mlx5_flow_table *prev_ft; - prev_ft =find_prev_chained_ft (prio); + prev_ft =find_prev_chained_ft (&prio->node);if (prev_ft) {struct fs_prio *prev_prio;
@@ -1036,7 +1035,7 @@ static int connect_flow_table(struct mlx5_core_dev *dev, struct mlx5_flow_tableif (err)return err; - next_ft = first_ft ? first_ft :find_next_chained_ft (prio); + next_ft = first_ft ? first_ft :find_next_chained_ft (&prio->node); err =connect_fwd_rules (dev, ft, next_ft);if (err)return err;
@@ -1114,7 +1113,7 @@ static struct mlx5_flow_table *__mlx5_create_flow_table(struct mlx5_flow_namespatree_init_node (&ft->node, del_hw_flow_table, del_sw_flow_table); log_table_sz = ft->max_fte ?ilog2 (ft->max_fte) :0 ; next_ft = unmanaged ? ft_attr->next_ft : -find_next_chained_ft (fs_prio); +find_next_chained_ft (&fs_prio->node); ft->def_miss_action = ns->def_miss_action; ft->ns = ns; err = root->cmds->create_flow_table (root, ft, log_table_sz, next_ft);
@@ -2079,7 +2078,7 @@ static struct mlx5_flow_table *find_next_ft(struct mlx5_flow_table *ft)if (!list_is_last (&ft->node.list, &prio->node.children))return list_next_entry (ft, node.list); -return find_next_chained_ft (prio); +return find_next_chained_ft (&prio->node); }static int update_root_ft_destroy (struct mlx5_flow_table *ft)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 155/201 net/mlx5: fs_core: Skip the FTs in the same FS_TYPE_PRIO_CHAINS fs_prio
In reply to Greg Kroah-HartmanFrom: Jianbo Liu <[email protected]>
[ Upstream commit c635ca45a7a2023904a1f851e99319af7b87017d ]
In the cited commit, new type of FS_TYPE_PRIO_CHAINS fs_prio was added to support multiple parallel namespaces for multi-chains. And we skip all the flow tables under the fs_node of this type unconditionally, when searching for the next or previous flow table to connect for a new table.
As this search function is also used for find new root table when the old one is being deleted, it will skip the entire FS_TYPE_PRIO_CHAINS fs_node next to the old root. However, new root table should be chosen from it if there is any table in it. Fix it by skipping only the flow tables in the same FS_TYPE_PRIO_CHAINS fs_node when finding the closest FT for a fs_node.
Besides, complete the connecting from FTs of previous priority of prio because there should be multiple prevs after this fs_prio type is introduced. And also the next FT should be chosen from the first flow table next to the prio in the same FS_TYPE_PRIO_CHAINS fs_prio, if this prio is the first child.
--- .../net/ethernet/mellanox/mlx5/core/fs_core.c | 80 +++++++++++++++++-- 1 file changed, 72 insertions(+), 8 deletions(-)
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +72 -8
@@ -802,7 +802,7 @@ static struct mlx5_flow_table *find_closest_ft_recursive(struct fs_node *root, struct fs_node *iter = list_entry(start, struct fs_node, list);struct mlx5_flow_table *ft =NULL ; -if (!root || root->type ==FS_TYPE_PRIO_CHAINS ) +if (!root)return NULL ;list_for_each_advance_continue (iter, &root->children, reverse) {
@@ -818,19 +818,42 @@ static struct mlx5_flow_table *find_closest_ft_recursive(struct fs_node *root,return ft; } +static struct fs_node *find_prio_chains_parent (struct fs_node *parent, +struct fs_node **child) +{ +struct fs_node *node =NULL ; + +while (parent && parent->type !=FS_TYPE_PRIO_CHAINS ) { + node = parent; + parent = parent->parent; + } + +if (child) + *child = node; + +return parent; +} +/* If reverse is false then return the first flow table next to the passed node * in the tree, else return the last flow table before the node in the tree. +* If skip is true, skip the flow tables in the same prio_chains prio. */ -static struct mlx5_flow_table *find_closest_ft (struct fs_node *node,bool reverse) +static struct mlx5_flow_table *find_closest_ft (struct fs_node *node,bool reverse, +bool skip) { +struct fs_node *prio_chains_parent =NULL ;struct mlx5_flow_table *ft =NULL ;struct fs_node *curr_node;struct fs_node *parent; +if (skip) + prio_chains_parent =find_prio_chains_parent (node,NULL ); parent = node->parent; curr_node = node;while (!ft && parent) { - ft =find_closest_ft_recursive (parent, &curr_node->list, reverse); +if (parent != prio_chains_parent) + ft =find_closest_ft_recursive (parent, &curr_node->list, + reverse); curr_node = parent; parent = curr_node->parent; }
@@ -840,13 +863,13 @@ static struct mlx5_flow_table *find_closest_ft(struct fs_node *node, bool revers/* Assuming all the tree is locked by mutex chain lock */ static struct mlx5_flow_table *find_next_chained_ft (struct fs_node *node) { -return find_closest_ft (node, false); +return find_closest_ft (node, false, true); }/* Assuming all the tree is locked by mutex chain lock */ static struct mlx5_flow_table *find_prev_chained_ft (struct fs_node *node) { -return find_closest_ft (node, true); +return find_closest_ft (node, true, true); } static struct mlx5_flow_table *find_next_fwd_ft(struct mlx5_flow_table *ft,
@@ -882,21 +905,55 @@ static int connect_fts_in_prio(struct mlx5_core_dev *dev,return 0 ; } +static struct mlx5_flow_table *find_closet_ft_prio_chains (struct fs_node *node, +struct fs_node *parent, +struct fs_node **child, +bool reverse) +{ +struct mlx5_flow_table *ft; + + ft =find_closest_ft (node, reverse, false); + +if (ft && parent ==find_prio_chains_parent (&ft->node, child)) +return ft; + +return NULL ; +} +/* Connect flow tables from previous priority of prio to ft */ static int connect_prev_fts (struct mlx5_core_dev *dev,struct mlx5_flow_table *ft,struct fs_prio *prio) { +struct fs_node *prio_parent, *parent =NULL , *child, *node;struct mlx5_flow_table *prev_ft; +int err =0 ; + + prio_parent =find_prio_chains_parent (&prio->node, &child); + +/* return directly if not under the first sub ns of prio_chains prio */ +if (prio_parent && !list_is_first (&child->list, &prio_parent->children)) +return 0 ; prev_ft =find_prev_chained_ft (&prio->node); -if (prev_ft) { +while (prev_ft) {struct fs_prio *prev_prio;fs_get_obj (prev_prio, prev_ft->node.parent); -return connect_fts_in_prio (dev, prev_prio, ft); + err =connect_fts_in_prio (dev, prev_prio, ft); +if (err) +break ; + +if (!parent) { + parent =find_prio_chains_parent (&prev_prio->node, &child); +if (!parent) +break ; + } + + node = child; + prev_ft =find_closet_ft_prio_chains (node, parent, &child, true); } -return 0 ; +return err; } static int update_root_ft_create(struct mlx5_flow_table *ft, struct fs_prio
@@ -2072,12 +2129,19 @@ EXPORT_SYMBOL(mlx5_del_flow_rules);/* Assuming prio->node.children(flow tables) is sorted by level */ static struct mlx5_flow_table *find_next_ft (struct mlx5_flow_table *ft) { +struct fs_node *prio_parent, *child;struct fs_prio *prio;fs_get_obj (prio, ft->node.parent);if (!list_is_last (&ft->node.list, &prio->node.children))return list_next_entry (ft, node.list); + + prio_parent =find_prio_chains_parent (&prio->node, &child); + +if (prio_parent &&list_is_first (&child->list, &prio_parent->children)) +return find_closest_ft (&prio->node, false, false); +return find_next_chained_ft (&prio->node); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 156/201 tcp_metrics: fix addr_same() helper
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit e6638094d7af6c7b9dcca05ad009e79e31b4f670 ]
Because v4 and v6 families use separate inetpeer trees (respectively net->ipv4.peers and net->ipv6.peers), inetpeer_addr_cmp(a, b) assumes a & b share the same family.
tcp_metrics use a common hash table, where entries can have different families.
We must therefore make sure to not call inetpeer_addr_cmp() if the families do not match.
--- net/ipv4/tcp_metrics.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/tcp_metrics.c +1 -1
@@ -78,7 +78,7 @@ static void tcp_metric_set(struct tcp_metrics_block *tm,static bool addr_same (const struct inetpeer_addr *a,const struct inetpeer_addr *b) { -return inetpeer_addr_cmp (a, b) ==0 ; +return (a->family == b->family) && !inetpeer_addr_cmp (a, b); }struct tcpm_hash_bucket {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 157/201 tcp_metrics: annotate data-races around tm->tcpm_stamp
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 949ad62a5d5311d36fce2e14fe5fed3f936da51c ]
tm->tcpm_stamp can be read or written locklessly.
Add needed READ_ONCE()/WRITE_ONCE() to document this.
Also constify tcpm_check_stamp() dst argument.
--- net/ipv4/tcp_metrics.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
net/ipv4/tcp_metrics.c +13 -6
@@ -97,7 +97,7 @@ static void tcpm_suck_dst(struct tcp_metrics_block *tm,u32 msval;u32 val; - tm->tcpm_stamp = jiffies; +WRITE_ONCE (tm->tcpm_stamp, jiffies); val =0 ;if (dst_metric_locked (dst,RTAX_RTT ))
@@ -131,9 +131,15 @@ static void tcpm_suck_dst(struct tcp_metrics_block *tm,#define TCP_METRICS_TIMEOUT (60 * 60 * HZ) -static void tcpm_check_stamp (struct tcp_metrics_block *tm,struct dst_entry *dst) +static void tcpm_check_stamp (struct tcp_metrics_block *tm, +const struct dst_entry *dst) { -if (tm &&unlikely (time_after (jiffies, tm->tcpm_stamp +TCP_METRICS_TIMEOUT ))) +unsigned long limit; + +if (!tm) +return ; + limit =READ_ONCE (tm->tcpm_stamp) +TCP_METRICS_TIMEOUT ; +if (unlikely (time_after (jiffies, limit)))tcpm_suck_dst (tm, dst, false); }
@@ -174,7 +180,8 @@ static struct tcp_metrics_block *tcpm_new(struct dst_entry *dst, oldest =deref_locked (tcp_metrics_hash[hash].chain);for (tm =deref_locked (oldest->tcpm_next); tm; tm =deref_locked (tm->tcpm_next)) { -if (time_before (tm->tcpm_stamp, oldest->tcpm_stamp)) +if (time_before (READ_ONCE (tm->tcpm_stamp), +READ_ONCE (oldest->tcpm_stamp))) oldest = tm; } tm = oldest;
@@ -434,7 +441,7 @@ void tcp_update_metrics(struct sock *sk) tp->reordering); } } - tm->tcpm_stamp = jiffies; +WRITE_ONCE (tm->tcpm_stamp, jiffies); out_unlock:rcu_read_unlock (); }
@@ -647,7 +654,7 @@ static int tcp_metrics_fill_info(struct sk_buff *msg, }if (nla_put_msecs (msg,TCP_METRICS_ATTR_AGE , - jiffies - tm->tcpm_stamp, + jiffies -READ_ONCE (tm->tcpm_stamp),TCP_METRICS_ATTR_PAD ) <0 ) goto nla_put_failure;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 158/201 tcp_metrics: annotate data-races around tm->tcpm_lock
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 285ce119a3c6c4502585936650143e54c8692788 ]
tm->tcpm_lock can be read or written locklessly.
Add needed READ_ONCE()/WRITE_ONCE() to document this.
--- net/ipv4/tcp_metrics.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/ipv4/tcp_metrics.c +4 -2
@@ -59,7 +59,8 @@ static inline struct net *tm_net(struct tcp_metrics_block *tm)static bool tcp_metric_locked (struct tcp_metrics_block *tm,enum tcp_metric_index idx) { -return tm->tcpm_lock & (1 << idx); +/* Paired with WRITE_ONCE() in tcpm_suck_dst() */ +return READ_ONCE (tm->tcpm_lock) & (1 << idx); } static u32 tcp_metric_get(struct tcp_metrics_block *tm,
@@ -110,7 +111,8 @@ static void tcpm_suck_dst(struct tcp_metrics_block *tm, val |=1 <<TCP_METRIC_CWND ;if (dst_metric_locked (dst,RTAX_REORDERING )) val |=1 <<TCP_METRIC_REORDERING ; - tm->tcpm_lock = val; +/* Paired with READ_ONCE() in tcp_metric_locked() */ +WRITE_ONCE (tm->tcpm_lock, val); msval =dst_metric_raw (dst,RTAX_RTT ); tm->tcpm_vals[TCP_METRIC_RTT ] = msval *USEC_PER_MSEC ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 159/201 tcp_metrics: annotate data-races around tm->tcpm_vals[]
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 8c4d04f6b443869d25e59822f7cec88d647028a9 ]
tm->tcpm_vals[] values can be read or written locklessly.
Add needed READ_ONCE()/WRITE_ONCE() to document this, and force use of tcp_metric_get() and tcp_metric_set()
--- net/ipv4/tcp_metrics.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-)
net/ipv4/tcp_metrics.c +14 -9
@@ -63,17 +63,19 @@ static bool tcp_metric_locked(struct tcp_metrics_block *tm,return READ_ONCE (tm->tcpm_lock) & (1 << idx); } -static u32 tcp_metric_get (struct tcp_metrics_block *tm, +static u32 tcp_metric_get (const struct tcp_metrics_block *tm,enum tcp_metric_index idx) { -return tm->tcpm_vals[idx]; +/* Paired with WRITE_ONCE() in tcp_metric_set() */ +return READ_ONCE (tm->tcpm_vals[idx]); }static void tcp_metric_set (struct tcp_metrics_block *tm,enum tcp_metric_index idx,u32 val) { - tm->tcpm_vals[idx] = val; +/* Paired with READ_ONCE() in tcp_metric_get() */ +WRITE_ONCE (tm->tcpm_vals[idx], val); } static bool addr_same(const struct inetpeer_addr *a,
@@ -115,13 +117,16 @@ static void tcpm_suck_dst(struct tcp_metrics_block *tm,WRITE_ONCE (tm->tcpm_lock, val); msval =dst_metric_raw (dst,RTAX_RTT ); - tm->tcpm_vals[TCP_METRIC_RTT ] = msval *USEC_PER_MSEC ; +tcp_metric_set (tm,TCP_METRIC_RTT , msval *USEC_PER_MSEC ); msval =dst_metric_raw (dst,RTAX_RTTVAR ); - tm->tcpm_vals[TCP_METRIC_RTTVAR ] = msval *USEC_PER_MSEC ; - tm->tcpm_vals[TCP_METRIC_SSTHRESH ] =dst_metric_raw (dst,RTAX_SSTHRESH ); - tm->tcpm_vals[TCP_METRIC_CWND ] =dst_metric_raw (dst,RTAX_CWND ); - tm->tcpm_vals[TCP_METRIC_REORDERING ] =dst_metric_raw (dst,RTAX_REORDERING ); +tcp_metric_set (tm,TCP_METRIC_RTTVAR , msval *USEC_PER_MSEC ); +tcp_metric_set (tm,TCP_METRIC_SSTHRESH , +dst_metric_raw (dst,RTAX_SSTHRESH )); +tcp_metric_set (tm,TCP_METRIC_CWND , +dst_metric_raw (dst,RTAX_CWND )); +tcp_metric_set (tm,TCP_METRIC_REORDERING , +dst_metric_raw (dst,RTAX_REORDERING ));if (fastopen_clear) { tm->tcpm_fastopen.mss =0 ; tm->tcpm_fastopen.syn_loss =0 ;
@@ -667,7 +672,7 @@ static int tcp_metrics_fill_info(struct sk_buff *msg,if (!nest) goto nla_put_failure;for (i =0 ; i <TCP_METRIC_MAX_KERNEL +1 ; i++) { -u32 val = tm->tcpm_vals[i]; +u32 val =tcp_metric_get (tm, i);if (!val)continue ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 160/201 tcp_metrics: annotate data-races around tm->tcpm_net
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit d5d986ce42c71a7562d32c4e21e026b0f87befec ]
tm->tcpm_net can be read or written locklessly.
Instead of changing write_pnet() and read_pnet() and potentially hurt performance, add the needed READ_ONCE()/WRITE_ONCE() in tm_net() and tcpm_new().
--- net/ipv4/tcp_metrics.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
net/ipv4/tcp_metrics.c +7 -4
@@ -40,7 +40,7 @@ struct tcp_fastopen_metrics {struct tcp_metrics_block {struct tcp_metrics_block __rcu *tcpm_next; -possible_net_t tcpm_net; +struct net *tcpm_net;struct inetpeer_addr tcpm_saddr;struct inetpeer_addr tcpm_daddr;unsigned long tcpm_stamp;
@@ -51,9 +51,10 @@ struct tcp_metrics_block {struct rcu_head rcu_head; }; -static inline struct net *tm_net (struct tcp_metrics_block *tm) +static inline struct net *tm_net (const struct tcp_metrics_block *tm) { -return read_pnet (&tm->tcpm_net); +/* Paired with the WRITE_ONCE() in tcpm_new() */ +return READ_ONCE (tm->tcpm_net); } static bool tcp_metric_locked(struct tcp_metrics_block *tm,
@@ -197,7 +198,9 @@ static struct tcp_metrics_block *tcpm_new(struct dst_entry *dst,if (!tm) goto out_unlock; } -write_pnet (&tm->tcpm_net, net); +/* Paired with the READ_ONCE() in tm_net() */ +WRITE_ONCE (tm->tcpm_net, net); + tm->tcpm_saddr = *saddr; tm->tcpm_daddr = *daddr;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 161/201 tcp_metrics: fix data-race in tcpm_suck_dst() vs fastopen
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit ddf251fa2bc1d3699eec0bae6ed0bc373b8fda79 ]
Whenever tcpm_new() reclaims an old entry, tcpm_suck_dst() would overwrite data that could be read from tcp_fastopen_cache_get() or tcp_metrics_fill_info().
We need to acquire fastopen_seqlock to maintain consistency.
For newly allocated objects, tcpm_new() can switch to kzalloc() to avoid an extra fastopen_seqlock acquisition.
--- net/ipv4/tcp_metrics.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
net/ipv4/tcp_metrics.c +5 -4
@@ -93,6 +93,7 @@ static struct tcpm_hash_bucket *tcp_metrics_hash __read_mostly;static unsigned int tcp_metrics_hash_log__read_mostly ;static DEFINE_SPINLOCK (tcp_metrics_lock); +static DEFINE_SEQLOCK (fastopen_seqlock); static void tcpm_suck_dst(struct tcp_metrics_block *tm, const struct dst_entry *dst,
@@ -129,11 +130,13 @@ static void tcpm_suck_dst(struct tcp_metrics_block *tm,tcp_metric_set (tm,TCP_METRIC_REORDERING ,dst_metric_raw (dst,RTAX_REORDERING ));if (fastopen_clear) { +write_seqlock (&fastopen_seqlock); tm->tcpm_fastopen.mss =0 ; tm->tcpm_fastopen.syn_loss =0 ; tm->tcpm_fastopen.try_exp =0 ; tm->tcpm_fastopen.cookie.exp = false; tm->tcpm_fastopen.cookie.len =0 ; +write_sequnlock (&fastopen_seqlock); } }
@@ -194,7 +197,7 @@ static struct tcp_metrics_block *tcpm_new(struct dst_entry *dst, } tm = oldest; }else { - tm =kmalloc (sizeof (*tm),GFP_ATOMIC ); + tm =kzalloc (sizeof (*tm),GFP_ATOMIC );if (!tm) goto out_unlock; }
@@ -204,7 +207,7 @@ static struct tcp_metrics_block *tcpm_new(struct dst_entry *dst, tm->tcpm_saddr = *saddr; tm->tcpm_daddr = *daddr; -tcpm_suck_dst (tm, dst, true); +tcpm_suck_dst (tm, dst, reclaim);if (likely (!reclaim)) { tm->tcpm_next = tcp_metrics_hash[hash].chain;
@@ -556,8 +559,6 @@ bool tcp_peer_is_proven(struct request_sock *req, struct dst_entry *dst)return ret; } -static DEFINE_SEQLOCK (fastopen_seqlock); -void tcp_fastopen_cache_get (struct sock *sk,u16 *mss,struct tcp_fastopen_cookie *cookie) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 162/201 scsi: zfcp: Defer fc_rport blocking until after ADISC response
In reply to Greg Kroah-HartmanFrom: Steffen Maier <[email protected]>
commit e65851989001c0c9ba9177564b13b38201c0854c upstream.
Storage devices are free to send RSCNs, e.g. for internal state changes. If this happens on all connected paths, zfcp risks temporarily losing all paths at the same time. This has strong requirements on multipath configuration such as "no_path_retry queue".
Avoid such situations by deferring fc_rport blocking until after the ADISC response, when any actual state change of the remote port became clear. The already existing port recovery triggers explicitly block the fc_rport. The triggers are: on ADISC reject or timeout (typical cable pull case), and on ADISC indicating that the remote port has changed its WWPN or the port is meanwhile no longer open.
As a side effect, this also removes a confusing direct function call to another work item function zfcp_scsi_rport_work() instead of scheduling that other work item. It was probably done that way to have the rport block side effect immediate and synchronous to the caller.
--- drivers/s390/scsi/zfcp_fc.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/s390/scsi/zfcp_fc.c +1 -5
@@ -534,8 +534,7 @@ static void zfcp_fc_adisc_handler(void */* re-init to undo drop from zfcp_fc_adisc() */ port->d_id =ntoh24 (adisc_resp->adisc_port_id); -/* port is good, unblock rport without going through erp */ -zfcp_scsi_schedule_rport_register (port); +/* port is still good, nothing to do */ out:atomic_andnot (ZFCP_STATUS_PORT_LINK_TEST , &port->status);put_device (&port->dev);
@@ -595,9 +594,6 @@ void zfcp_fc_link_test_work(struct work_int retval;set_worker_desc ("zadisc%16llx" , port->wwpn);/* < WORKER_DESC_LEN=24 */ -get_device (&port->dev); - port->rport_task =RPORT_DEL ; -zfcp_scsi_rport_work (&port->rport_work);/* only issue one test command at one time per port */ if (atomic_read (&port->status) &ZFCP_STATUS_PORT_LINK_TEST )