6.4.11-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 6.4.11-rc1 review
This is the start of the stable review cycle for the 6.4.11 release. There are 206 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue, 15 Aug 2023 21:16:53 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.4.11-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.4.11-rc1
Masahiro Yamada <[email protected]>
alpha: remove __init annotation from exported page_is_ram()
Simon Trimmer <[email protected]>
ACPI: scan: Create platform device for CS35L56
David Xu <[email protected]>
platform/x86: serial-multi-instantiate: Auto detect IRQ resource for CSC3551
Vadim Pasternak <[email protected]>
platform: mellanox: Fix order in exit flow
Vadim Pasternak <[email protected]>
platform: mellanox: mlx-platform: Modify graceful shutdown callback and power down mask
Vadim Pasternak <[email protected]>
platform: mellanox: mlx-platform: Fix signals polarity and latch mask
Vadim Pasternak <[email protected]>
platform: mellanox: Change register offset addresses
Hans de Goede <[email protected]>
platform/x86: lenovo-ymc: Only bind on machines with a convertible DMI chassis-type
Jean Delvare <[email protected]>
platform/x86: msi-ec: Fix the build
Nilesh Javali <[email protected]>
scsi: qedf: Fix firmware halt over suspend and resume
Nilesh Javali <[email protected]>
scsi: qedi: Fix firmware halt over suspend and resume
Karan Tilak Kumar <[email protected]>
scsi: fnic: Replace return codes in fnic_clean_pending_aborts()
Zhu Wang <[email protected]>
scsi: core: Fix possible memory leak if device_add() fails
Zhu Wang <[email protected]>
scsi: snic: Fix possible memory leak if device_add() fails
Alexandra Diupina <[email protected]>
scsi: 53c700: Check that command slot is not NULL
Yoshihiro Shimoda <[email protected]>
scsi: ufs: renesas: Fix private allocation
Michael Kelley <[email protected]>
scsi: storvsc: Fix handling of virtual Fibre Channel timeouts
Tony Battersby <[email protected]>
scsi: core: Fix legacy /proc parsing buffer overflow
Josef Bacik <[email protected]>
btrfs: set cache_block_group_error if we find an error
Qu Wenruo <[email protected]>
btrfs: reject invalid reloc tree root keys with stack dump
Qu Wenruo <[email protected]>
btrfs: exit gracefully if reloc roots don't match
Christoph Hellwig <[email protected]>
btrfs: properly clear end of the unreserved range in cow_file_range
Christoph Hellwig <[email protected]>
btrfs: don't wait for writeback on clean pages in extent_write_cache_pages
Christoph Hellwig <[email protected]>
btrfs: don't stop integrity writeback too early
Josef Bacik <[email protected]>
btrfs: wait for actual caching progress during allocation
Bartosz Golaszewski <[email protected]>
gpio: sim: mark the GPIO chip as a one that can sleep
William Breathitt Gray <[email protected]>
gpio: ws16c48: Fix off-by-one error in WS16C48 resource region extent
Nick Child <[email protected]>
ibmvnic: Ensure login failure recovery is safe from other resets
Nick Child <[email protected]>
ibmvnic: Do partial reset on login failure
Nick Child <[email protected]>
ibmvnic: Handle DMA unmapping of login buffs in release functions
Nick Child <[email protected]>
ibmvnic: Unmap DMA login rsp buffer on send login fail
Nick Child <[email protected]>
ibmvnic: Enforce stronger sanity checks on login response
Moshe Shemesh <[email protected]>
net/mlx5: Reload auxiliary devices in pci error handlers
Moshe Shemesh <[email protected]>
net/mlx5: Skip clock update work when device is in error state
Shay Drory <[email protected]>
net/mlx5: LAG, Check correct bucket when modifying LAG
Chris Mi <[email protected]>
net/mlx5e: Unoffload post act rule when handling FIB events
Daniel Jurgens <[email protected]>
net/mlx5: Allow 0 for total host VFs
Yevgeny Kliteynik <[email protected]>
net/mlx5: DR, Fix wrong allocation of modify hdr pattern
Jianbo Liu <[email protected]>
net/mlx5e: TC, Fix internal port memory leak
Gal Pressman <[email protected]>
net/mlx5e: Take RTNL lock when needed before calling xdp_set_features()
Zhang Jianhua <[email protected]>
dmaengine: owl-dma: Modify mismatched function name
Fenghua Yu <[email protected]>
dmaengine: idxd: Clear PRS disable flag when disabling IDXD device
Christophe JAILLET <[email protected]>
dmaengine: mcf-edma: Fix a potential un-allocated memory access
Hao Chen <[email protected]>
net: hns3: fix strscpy causing content truncation issue
Ido Schimmel <[email protected]>
nexthop: Fix infinite nexthop bucket dump when using maximum nexthop ID
Ido Schimmel <[email protected]>
nexthop: Make nexthop bucket dump more efficient
Ido Schimmel <[email protected]>
nexthop: Fix infinite nexthop dump when using maximum nexthop ID
Vladimir Oltean <[email protected]>
net: enetc: reimplement RFS/RSS memory clearing as PCI quirk
Yonglong Liu <[email protected]>
net: hns3: fix deadlock issue when externel_lb and reset are executed together
Jie Wang <[email protected]>
net: hns3: add wait until mac link down
Jie Wang <[email protected]>
net: hns3: refactor hclge_mac_link_status_wait for interface reuse
Vladimir Oltean <[email protected]>
net: dsa: ocelot: call dsa_tag_8021q_unregister() under rtnl_lock() on driver remove
Li Yang <[email protected]>
net: phy: at803x: remove set/get wol callbacks for AR8032
Jonas Gorski <[email protected]>
net: marvell: prestera: fix handling IPv4 routes with nhid
Jakub Kicinski <[email protected]>
net: tls: avoid discarding data on record close
Kalesh AP <[email protected]>
RDMA/bnxt_re: Fix error handling in probe failure path
Selvin Xavier <[email protected]>
RDMA/bnxt_re: Properly order ib_device_unalloc() to avoid UAF
Michael Guralnik <[email protected]>
RDMA/umem: Set iova in ODP flow
Felix Fietkau <[email protected]>
wifi: cfg80211: fix sband iftype data lookup for AP_VLAN
Petr Tesarik <[email protected]>
wifi: brcm80211: handle params_v1 allocation failure
Daniel Stone <[email protected]>
drm/rockchip: Don't spam logs in atomic check
Arnd Bergmann <[email protected]>
drm/nouveau: remove unused tu102_gr_load() function
Pin-yen Lin <[email protected]>
drm/bridge: it6505: Check power state with it6505->powered in IRQ handler
Mario Limonciello <[email protected]>
drm/amd/display: Don't show stack trace for missing eDP
Douglas Miller <[email protected]>
IB/hfi1: Fix possible panic during hotplug remove
Piotr Gardocki <[email protected]>
iavf: fix potential races for FDIR filters
Fedor Pchelkin <[email protected]>
drivers: vxlan: vnifilter: free percpu vni stats on error path
Andrew Kanner <[email protected]>
drivers: net: prevent tun_build_skb() to exceed the packet size limit
Eric Dumazet <[email protected]>
dccp: fix data-race around dp->dccps_mss_cache
Ziyang Xuan <[email protected]>
bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
Magnus Karlsson <[email protected]>
xsk: fix refcount underflow in error path
Florian Westphal <[email protected]>
tunnels: fix kasan splat when generating ipv4 pmtu error
Eric Dumazet <[email protected]>
tcp: add missing family to tcp_set_ca_state() tracepoint
Vladimir Oltean <[email protected]>
PCI: move OF status = "disabled" detection to dev->match_driver
Gerd Bayer <[email protected]>
net/smc: Use correct buffer sizes when switching between TCP and SMC
Gerd Bayer <[email protected]>
net/smc: Fix setsockopt and sysctl to specify same buffer size again
Eric Dumazet <[email protected]>
net/packet: annotate data-races around tp->status
Nitya Sunkad <[email protected]>
ionic: Add missing err handling for queue reconfig
Muhammad Husaini Zulkifli <[email protected]>
igc: Add lock to safeguard global Qbv variables
Xiang Yang <[email protected]>
mptcp: fix the incorrect judgment for msk->cb_flags
Eric Dumazet <[email protected]>
macsec: use DEV_STATS_INC()
Nathan Chancellor <[email protected]>
mISDN: Update parameter type of dsp_cmx_send()
Aleksa Savic <[email protected]>
hwmon: (aquacomputer_d5next) Add selective 200ms delay after sending ctrl report
Xu Kuohai <[email protected]>
bpf, sockmap: Fix bug that strp_done cannot be called
Xu Kuohai <[email protected]>
bpf, sockmap: Fix map type error in sock_map_del_link
Andrew Kanner <[email protected]>
net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail()
Ido Schimmel <[email protected]>
selftests: forwarding: bridge_mdb: Make test more robust
Ido Schimmel <[email protected]>
selftests: forwarding: bridge_mdb: Fix failing test with old libnet
Ido Schimmel <[email protected]>
selftests: forwarding: bridge_mdb_max: Fix failing test with old libnet
Ido Schimmel <[email protected]>
selftests: forwarding: tc_flower: Relax success criterion
Ido Schimmel <[email protected]>
selftests: forwarding: tc_actions: Use ncat instead of nc
Ido Schimmel <[email protected]>
selftests: forwarding: Switch off timeout
Ido Schimmel <[email protected]>
selftests: forwarding: Skip test when no interfaces are specified
Ido Schimmel <[email protected]>
selftests: forwarding: hw_stats_l3_gre: Skip when using veth pairs
Ido Schimmel <[email protected]>
selftests: forwarding: ethtool_extended_state: Skip when using veth pairs
Ido Schimmel <[email protected]>
selftests: forwarding: ethtool: Skip when using veth pairs
Ido Schimmel <[email protected]>
selftests: forwarding: Add a helper to skip test when using veth pairs
Mark Brown <[email protected]>
selftests/rseq: Fix build with undefined __weak
Xu Kuohai <[email protected]>
selftests/bpf: fix a CI failure caused by vsock sockmap test
Minjie Du <[email protected]>
dmaengine: xilinx: xdma: Fix Judgment of the return value
Miquel Raynal <[email protected]>
dmaengine: xilinx: xdma: Fix typo
Raghavendra Rao Ananta <[email protected]>
KVM: arm64: Fix hardware enable/disable flows for pKVM
Ido Schimmel <[email protected]>
selftests: forwarding: bridge_mdb: Check iproute2 version
Ido Schimmel <[email protected]>
selftests: forwarding: bridge_mdb_max: Check iproute2 version
Ido Schimmel <[email protected]>
selftests: forwarding: ethtool_mm: Skip when MAC Merge is not supported
Ido Schimmel <[email protected]>
selftests: forwarding: tc_tunnel_key: Make filters more specific
Neil Armstrong <[email protected]>
interconnect: qcom: sm8550: add enable_mask for bcm nodes
Neil Armstrong <[email protected]>
interconnect: qcom: sm8450: add enable_mask for bcm nodes
Neil Armstrong <[email protected]>
interconnect: qcom: sa8775p: add enable_mask for bcm nodes
Mike Tipton <[email protected]>
interconnect: qcom: Add support for mask-based BCMs
Matti Vaittinen <[email protected]>
iio: light: bu27034: Fix scale format
Milan Zamazal <[email protected]>
iio: core: Prevent invalid memory access when there is no parent
Alejandro Tafalla <[email protected]>
iio: imu: lsm6dsx: Fix mount matrix retrieval
Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_hash: mark set element as dead when deleting from packet path
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: adapt set backend to use GC transaction API
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: GC transaction API to avoid race with control plane
Florian Westphal <[email protected]>
netfilter: nf_tables: don't skip expired elements during walk
Karol Herbst <[email protected]>
drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes
Bjorn Helgaas <[email protected]>
Revert "PCI: mvebu: Mark driver as BROKEN"
Arnd Bergmann <[email protected]>
x86: Move gds_ucode_mitigated() declaration to header
Arnd Bergmann <[email protected]>
x86/speculation: Add cpu_show_gds() prototype
Jinghao Jia <[email protected]>
x86/linkage: Fix typo of BUILD_VDSO in asm/linkage.h
Borislav Petkov (AMD) <[email protected]>
x86/sev: Do not try to parse for the CC blob on non-AMD hardware
Kirill A. Shutemov <[email protected]>
x86/mm: Fix VDSO and VVAR placement on 5-level paging machines
Cristian Ciocaltea <[email protected]>
x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405
Xin Li <[email protected]>
x86/vdso: Choose the right GDT_ENTRY_CPUNODE for 32-bit getcpu() on 64-bit kernel
Nick Desaulniers <[email protected]>
x86/srso: Fix build breakage with the LLVM linker
RD Babiera <[email protected]>
usb: typec: altmodes/displayport: Signal hpd when configuring pin assignment
Badhri Jagan Sridharan <[email protected]>
usb: typec: tcpm: Fix response to vsafe0V event
Prashanth K <[email protected]>
usb: common: usb-conn-gpio: Prevent bailing out if initial role is none
Alan Stern <[email protected]>
USB: Gadget: core: Help prevent panic during UVC unconfigure
Elson Roy Serrao <[email protected]>
usb: dwc3: Properly handle processing of pending events
Alan Stern <[email protected]>
usb-storage: alauda: Fix uninit-value in alauda_check_media()
Mika Westerberg <[email protected]>
thunderbolt: Fix memory leak in tb_handle_dp_bandwidth_request()
Ricky WU <[email protected]>
misc: rtsx: judge ASPM Mode to set PETXCFG Reg
Qi Zheng <[email protected]>
binder: fix memory leak in binder_init()
Alvin Šipraga <[email protected]>
iio: adc: ina2xx: avoid NULL pointer dereference on OF device match
George Stark <[email protected]>
iio: adc: meson: fix core clock enable/disable moment
Alisa Roman <[email protected]>
iio: adc: ad7192: Fix ac excitation feature
Dan Carpenter <[email protected]>
iio: frequency: admv1013: propagate errors from regulator_get_voltage()
Yiyuan Guo <[email protected]>
iio: cros_ec: Fix the allocation size for cros_ec_command
Evan Quan <[email protected]>
drm/amd/pm: avoid unintentional shutdown due to temperature momentary fluctuation
Evan Quan <[email protected]>
drm/amd/pm: expose swctf threshold setting for legacy powerplay
Miaohe Lin <[email protected]>
mm: memory-failure: avoid false hwpoison page mapped error info
Miaohe Lin <[email protected]>
mm: memory-failure: fix potential unexpected return value from unpoison_memory()
Ayush Jain <[email protected]>
selftests: mm: ksm: fix incorrect evaluation of parameter
SeongJae Park <[email protected]>
mm/damon/core: initialize damo_filter->list from damos_new_filter()
Mike Kravetz <[email protected]>
hugetlb: do not clear hugetlb dtor until allocating vmemmap
Karol Wachowski <[email protected]>
accel/ivpu: Add set_pages_array_wc/uc for internal buffers
Ryusuke Konishi <[email protected]>
nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput
Lorenzo Stoakes <[email protected]>
fs/proc/kcore: reinstate bounce buffer for KCORE_TEXT regions
Thomas Weißschuh <[email protected]>
cpufreq: amd-pstate: fix global sysfs attribute type
Colin Ian King <[email protected]>
radix tree test suite: fix incorrect allocation size for pthreads
Tao Ren <[email protected]>
hwmon: (pmbus/bel-pfe) Enable PMBUS_SKIP_STATUS_CHECK for pfe1100
Andrew Yang <[email protected]>
zsmalloc: fix races between modifications of fullness and isolated
Aleksa Sarai <[email protected]>
io_uring: correct check for O_TMPFILE
Maulik Shah <[email protected]>
cpuidle: psci: Move enabling OSI mode after power domains creation
Maulik Shah <[email protected]>
cpuidle: dt_idle_genpd: Add helper function to remove genpd topology
Jarkko Sakkinen <[email protected]>
tpm_tis: Opt-in interrupts
Peter Ujfalusi <[email protected]>
tpm: tpm_tis: Fix UPX-i11 DMI_MATCH condition
Mario Limonciello <[email protected]>
drm/amd: Disable S/G for APUs when 64GB or more host memory
Melissa Wen <[email protected]>
drm/amd/display: check attr flag before set cursor degamma on DCN3+
Mario Limonciello <[email protected]>
drm/amd/display: Fix a regression on Polaris cards
Kenneth Feng <[email protected]>
drm/amd/pm: correct the pcie width for smu 13.0.0
Alex Deucher <[email protected]>
drm/amdgpu: fix possible UAF in amdgpu_cs_pass1()
Boris Brezillon <[email protected]>
drm/shmem-helper: Reset vma->vm_ops before calling dma_buf_mmap()
Lyude Paul <[email protected]>
drm/nouveau/nvkm/dp: Add workaround to fix DP 1.3+ DPCD issues
Karol Herbst <[email protected]>
drm/nouveau/gr: enable memory loads on helper invocation on all channels
August Wikerfors <[email protected]>
nvme-pci: add NVME_QUIRK_BOGUS_NID for Samsung PM9B1 256G and 512G
Ming Lei <[email protected]>
nvme-rdma: fix potential unbalanced freeze & unfreeze
Ming Lei <[email protected]>
nvme-tcp: fix potential unbalanced freeze & unfreeze
Ming Lei <[email protected]>
nvme: fix possible hang when removing a controller during error recovery
Nick Desaulniers <[email protected]>
riscv: mm: fix 2 instances of -Wmissing-variable-declarations
Torsten Duwe <[email protected]>
riscv/kexec: handle R_RISCV_CALL_PLT relocation type
Andrea Parri <[email protected]>
riscv,mmio: Fix readX()-to-delay() ordering
Torsten Duwe <[email protected]>
riscv/kexec: load initrd high in available memory
Alexandre Ghiti <[email protected]>
riscv: Start of DRAM should at least be aligned on PMD size for the direct mapping
Helge Deller <[email protected]>
parisc: Fix lightweight spinlock checks to not break futexes
Helge Deller <[email protected]>
io_uring/parisc: Adjust pgoff in io_uring mmap() for parisc
Christoph Hellwig <[email protected]>
zram: take device and not only bvec offset into account
Hans de Goede <[email protected]>
ACPI: resource: Add IRQ override quirk for PCSpecialist Elimina Pro 16 M
Hans de Goede <[email protected]>
ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen
Hans de Goede <[email protected]>
ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs
Hans de Goede <[email protected]>
ACPI: resource: revert "Remove "Zen" specific match and quirks"
Souradeep Chakrabarti <[email protected]>
net: mana: Fix MANA VF unload when hardware is unresponsive
Miquel Raynal <[email protected]>
dmaengine: xilinx: xdma: Fix interrupt vector setting
Ilpo Järvinen <[email protected]>
dmaengine: pl330: Return DMA_PAUSED when transaction is paused
Paolo Abeni <[email protected]>
mptcp: fix disconnect vs accept race
Paolo Abeni <[email protected]>
mptcp: avoid bogus reset on fallback close
Andrea Claudi <[email protected]>
selftests: mptcp: join: fix 'implicit EP' test
Andrea Claudi <[email protected]>
selftests: mptcp: join: fix 'delete and re-add' test
Maciej Żenczykowski <[email protected]>
ipv6: adjust ndisc_is_useropt() to also return true for PIO
Kunihiko Hayashi <[email protected]>
mmc: sdhci-f-sdh30: Replace with sdhci_pltfm
Sergei Antonov <[email protected]>
mmc: moxart: read scr register without changing byte order
Jason A. Donenfeld <[email protected]>
wireguard: allowedips: expand maximum node depth
Ido Schimmel <[email protected]>
selftests: forwarding: Set default IPv6 traceroute utility
Ping-Ke Shih <[email protected]>
wifi: rtw89: fix 8852AE disconnection caused by RX full flags
Keith Yeo <[email protected]>
wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems()
Paolo Bonzini <[email protected]>
KVM: SEV: only access GHCB fields once
Paolo Bonzini <[email protected]>
KVM: SEV: snapshot the GHCB before accessing it
Namjae Jeon <[email protected]>
ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea()
Long Li <[email protected]>
ksmbd: validate command request size
Mario Limonciello <[email protected]>
tpm: Add a helper for checking hwrng enabled
Jonathan McDowell <[email protected]>
tpm/tpm_tis: Disable interrupts for Lenovo P620 devices
Mario Limonciello <[email protected]>
tpm: Disable RNG for all AMD fTPMs
Takashi Iwai <[email protected]>
tpm/tpm_tis: Disable interrupts for TUXEDO InfinityBook S 15/17 Gen7
-------------
Diffstat:
Makefile | 4 +- arch/alpha/kernel/setup.c | 3 +- arch/arm64/kvm/arm.c | 15 +- arch/parisc/Kconfig.debug | 2 +- arch/parisc/include/asm/spinlock.h | 2 - arch/parisc/include/asm/spinlock_types.h | 6 + arch/parisc/kernel/sys_parisc.c | 15 +- arch/parisc/kernel/syscall.S | 23 +- arch/riscv/include/asm/mmio.h | 16 +- arch/riscv/include/asm/pgtable.h | 2 + arch/riscv/kernel/elf_kexec.c | 3 +- arch/riscv/mm/init.c | 16 +- arch/riscv/mm/kasan_init.c | 1 - arch/x86/boot/compressed/idt_64.c | 9 +- arch/x86/boot/compressed/sev.c | 37 ++- arch/x86/entry/vdso/vma.c | 4 +- arch/x86/include/asm/acpi.h | 2 + arch/x86/include/asm/linkage.h | 2 +- arch/x86/include/asm/processor.h | 2 + arch/x86/include/asm/segment.h | 2 +- arch/x86/kernel/acpi/boot.c | 4 + arch/x86/kernel/cpu/amd.c | 1 + arch/x86/kernel/vmlinux.lds.S | 12 +- arch/x86/kvm/svm/sev.c | 94 ++++---- arch/x86/kvm/svm/svm.h | 26 +++ arch/x86/kvm/x86.c | 2 - drivers/accel/ivpu/ivpu_gem.c | 8 + drivers/acpi/resource.c | 64 +++++ drivers/acpi/scan.c | 1 + drivers/android/binder.c | 1 + drivers/android/binder_alloc.c | 6 + drivers/android/binder_alloc.h | 1 + drivers/block/zram/zram_drv.c | 32 ++- drivers/char/tpm/tpm-chip.c | 83 ++----- drivers/char/tpm/tpm_crb.c | 30 +++ drivers/char/tpm/tpm_tis.c | 20 +- drivers/cpufreq/amd-pstate.c | 10 +- drivers/cpuidle/cpuidle-psci-domain.c | 39 ++-- drivers/cpuidle/dt_idle_genpd.c | 24 ++ drivers/cpuidle/dt_idle_genpd.h | 7 + drivers/dma/idxd/device.c | 4 +- drivers/dma/mcf-edma.c | 13 +- drivers/dma/owl-dma.c | 2 +- drivers/dma/pl330.c | 18 +- drivers/dma/xilinx/xdma.c | 6 +- drivers/gpio/gpio-sim.c | 1 + drivers/gpio/gpio-ws16c48.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 26 +++ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 +- .../amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 2 +- .../amd/display/dc/dce110/dce110_hw_sequencer.c | 3 +- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp.c | 7 +- drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h | 2 + drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c | 48 ++++ .../drm/amd/pm/powerplay/hwmgr/hardwaremanager.c | 4 +- .../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 2 + .../gpu/drm/amd/pm/powerplay/hwmgr/smu_helper.c | 27 +-- .../gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 10 + .../gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c | 4 + .../gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c | 4 + drivers/gpu/drm/amd/pm/powerplay/inc/hwmgr.h | 2 + drivers/gpu/drm/amd/pm/powerplay/inc/power_state.h | 1 + drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 34 +++ drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h | 2 + drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | 9 +- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 9 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 3 +- drivers/gpu/drm/bridge/ite-it6505.c | 4 +- drivers/gpu/drm/drm_gem_shmem_helper.c | 6 + drivers/gpu/drm/nouveau/nouveau_connector.c | 2 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c | 48 +++- drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.h | 1 + drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c | 4 +- drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110.c | 10 + drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110b.c | 1 + drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk208.c | 1 + drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c | 1 + drivers/gpu/drm/nouveau/nvkm/engine/gr/tu102.c | 13 -- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 17 +- drivers/hwmon/aquacomputer_d5next.c | 37 ++- drivers/hwmon/pmbus/bel-pfe.c | 16 +- drivers/iio/adc/ad7192.c | 16 +- drivers/iio/adc/ina2xx-adc.c | 9 +- drivers/iio/adc/meson_saradc.c | 23 +- .../common/cros_ec_sensors/cros_ec_sensors_core.c | 2 +- drivers/iio/frequency/admv1013.c | 5 +- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 2 +- drivers/iio/industrialio-core.c | 5 +- drivers/iio/light/rohm-bu27034.c | 22 +- drivers/infiniband/core/umem.c | 3 +- drivers/infiniband/hw/bnxt_re/main.c | 4 +- drivers/infiniband/hw/hfi1/chip.c | 1 + drivers/interconnect/qcom/bcm-voter.c | 5 + drivers/interconnect/qcom/icc-rpmh.h | 2 + drivers/interconnect/qcom/sa8775p.c | 1 + drivers/interconnect/qcom/sm8450.c | 9 + drivers/interconnect/qcom/sm8550.c | 17 ++ drivers/isdn/mISDN/dsp.h | 2 +- drivers/isdn/mISDN/dsp_cmx.c | 2 +- drivers/isdn/mISDN/dsp_core.c | 2 +- drivers/misc/cardreader/rts5227.c | 2 +- drivers/misc/cardreader/rts5228.c | 18 -- drivers/misc/cardreader/rts5249.c | 3 +- drivers/misc/cardreader/rts5260.c | 18 -- drivers/misc/cardreader/rts5261.c | 18 -- drivers/misc/cardreader/rtsx_pcr.c | 5 +- drivers/mmc/host/moxart-mmc.c | 8 +- drivers/mmc/host/sdhci_f_sdh30.c | 60 +++-- drivers/net/bonding/bond_main.c | 4 +- drivers/net/dsa/ocelot/felix.c | 2 + drivers/net/ethernet/freescale/enetc/enetc_pf.c | 103 +++++--- drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c | 4 +- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 14 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c | 4 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 24 +- drivers/net/ethernet/ibm/ibmvnic.c | 112 +++++++-- drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 5 +- drivers/net/ethernet/intel/iavf/iavf_fdir.c | 11 +- drivers/net/ethernet/intel/igc/igc.h | 4 + drivers/net/ethernet/intel/igc/igc_main.c | 34 ++- .../ethernet/marvell/prestera/prestera_router.c | 14 +- .../ethernet/mellanox/mlx5/core/en/tc_tun_encap.c | 6 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 11 + drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 21 +- .../net/ethernet/mellanox/mlx5/core/lag/port_sel.c | 2 +- .../net/ethernet/mellanox/mlx5/core/lib/clock.c | 5 + drivers/net/ethernet/mellanox/mlx5/core/main.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/sriov.c | 3 +- .../ethernet/mellanox/mlx5/core/steering/dr_ptrn.c | 2 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 37 ++- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 23 +- drivers/net/macsec.c | 28 +-- drivers/net/phy/at803x.c | 2 - drivers/net/tun.c | 2 +- drivers/net/vxlan/vxlan_vnifilter.c | 11 +- drivers/net/wireguard/allowedips.c | 8 +- drivers/net/wireguard/selftest/allowedips.c | 16 +- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 5 + drivers/net/wireless/realtek/rtw89/mac.c | 2 +- drivers/nvme/host/core.c | 10 +- drivers/nvme/host/pci.c | 3 +- drivers/nvme/host/rdma.c | 3 +- drivers/nvme/host/tcp.c | 3 +- drivers/pci/bus.c | 4 +- drivers/pci/controller/Kconfig | 1 - drivers/pci/of.c | 5 - drivers/platform/x86/lenovo-ymc.c | 25 ++ drivers/platform/x86/mlx-platform.c | 23 +- drivers/platform/x86/msi-ec.c | 18 +- drivers/platform/x86/serial-multi-instantiate.c | 35 ++- drivers/scsi/53c700.c | 2 +- drivers/scsi/fnic/fnic.h | 2 +- drivers/scsi/fnic/fnic_scsi.c | 6 +- drivers/scsi/qedf/qedf_main.c | 18 ++ drivers/scsi/qedi/qedi_main.c | 18 ++ drivers/scsi/raid_class.c | 1 + drivers/scsi/scsi_proc.c | 30 +-- drivers/scsi/snic/snic_disc.c | 1 + drivers/scsi/storvsc_drv.c | 4 - drivers/thunderbolt/tb.c | 2 + drivers/ufs/host/ufs-renesas.c | 2 +- drivers/usb/common/usb-conn-gpio.c | 6 +- drivers/usb/dwc3/gadget.c | 9 +- drivers/usb/gadget/udc/core.c | 9 + drivers/usb/storage/alauda.c | 12 +- drivers/usb/typec/altmodes/displayport.c | 18 +- drivers/usb/typec/tcpm/tcpm.c | 7 + fs/btrfs/block-group.c | 17 +- fs/btrfs/block-group.h | 2 + fs/btrfs/disk-io.c | 3 +- fs/btrfs/extent-tree.c | 5 +- fs/btrfs/extent_io.c | 13 +- fs/btrfs/inode.c | 10 +- fs/btrfs/relocation.c | 45 +++- fs/btrfs/tree-checker.c | 14 ++ fs/nilfs2/inode.c | 8 + fs/nilfs2/segment.c | 2 + fs/nilfs2/the_nilfs.h | 2 + fs/proc/kcore.c | 30 ++- fs/smb/server/smb2misc.c | 10 +- fs/smb/server/smb2pdu.c | 9 +- include/linux/cpu.h | 2 + include/linux/skmsg.h | 1 + include/linux/tpm.h | 1 + include/net/cfg80211.h | 3 + include/net/netfilter/nf_tables.h | 64 ++++- include/trace/events/tcp.h | 5 +- io_uring/io_uring.c | 3 + io_uring/openclose.c | 6 +- mm/damon/core.c | 1 + mm/hugetlb.c | 75 ++++-- mm/memory-failure.c | 29 +-- mm/zsmalloc.c | 14 +- net/core/filter.c | 6 - net/core/skmsg.c | 10 +- net/core/sock_map.c | 10 +- net/dccp/output.c | 2 +- net/dccp/proto.c | 10 +- net/ipv4/ip_tunnel_core.c | 2 +- net/ipv4/nexthop.c | 28 +-- net/ipv6/ndisc.c | 3 +- net/mptcp/protocol.c | 4 +- net/mptcp/protocol.h | 1 - net/mptcp/subflow.c | 58 ++--- net/netfilter/nf_tables_api.c | 259 +++++++++++++++++++-- net/netfilter/nft_set_hash.c | 85 ++++--- net/netfilter/nft_set_pipapo.c | 66 ++++-- net/netfilter/nft_set_rbtree.c | 146 +++++++----- net/packet/af_packet.c | 16 +- net/smc/af_smc.c | 77 ++++-- net/smc/smc.h | 2 +- net/smc/smc_clc.c | 4 +- net/smc/smc_core.c | 25 +- net/smc/smc_sysctl.c | 10 +- net/tls/tls_device.c | 64 ++--- net/wireless/nl80211.c | 5 +- net/xdp/xsk.c | 1 + tools/testing/radix-tree/regression1.c | 2 +- .../selftests/bpf/prog_tests/sockmap_listen.c | 2 +- tools/testing/selftests/mm/ksm_tests.c | 1 + tools/testing/selftests/net/fib_nexthops.sh | 10 + .../testing/selftests/net/forwarding/bridge_mdb.sh | 59 ++--- .../selftests/net/forwarding/bridge_mdb_max.sh | 19 +- tools/testing/selftests/net/forwarding/ethtool.sh | 2 + .../net/forwarding/ethtool_extended_state.sh | 2 + .../testing/selftests/net/forwarding/ethtool_mm.sh | 18 +- .../selftests/net/forwarding/hw_stats_l3_gre.sh | 2 + .../net/forwarding/ip6_forward_instats_vrf.sh | 2 + tools/testing/selftests/net/forwarding/lib.sh | 17 ++ tools/testing/selftests/net/forwarding/settings | 1 + .../testing/selftests/net/forwarding/tc_actions.sh | 6 +- .../testing/selftests/net/forwarding/tc_flower.sh | 8 +- .../selftests/net/forwarding/tc_tunnel_key.sh | 9 +- tools/testing/selftests/net/mptcp/mptcp_join.sh | 6 +- tools/testing/selftests/rseq/Makefile | 4 +- tools/testing/selftests/rseq/rseq.c | 2 + 238 files changed, 2516 insertions(+), 1034 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/206 tpm/tpm_tis: Disable interrupts for TUXEDO InfinityBook S 15/17 Gen7
From: Takashi Iwai <[email protected]>
commit 0b15afc9038146bb2009e7924b1ead2e919b2a56 upstream.
TUXEDO InfinityBook S 15/17 Gen7 suffers from an IRQ problem on tpm_tis like a few other laptops. Add an entry for the workaround.
--- drivers/char/tpm/tpm_tis.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/char/tpm/tpm_tis.c +8 -0
@@ -162,6 +162,14 @@ static const struct dmi_system_id tpm_tis_dmi_table[] = { DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L590"), }, }, + { + .callback = tpm_tis_disable_irq, + .ident = "TUXEDO InfinityBook S 15/17 Gen7", + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"TUXEDO" ), + DMI_MATCH(DMI_PRODUCT_NAME, "TUXEDO InfinityBook S 15/17 Gen7"), + }, + }, { .callback = tpm_tis_disable_irq, .ident = "UPX-TGL",
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 2/206 tpm: Disable RNG for all AMD fTPMs
In reply to Greg Kroah-HartmanFrom: Mario Limonciello <[email protected]>
commit 554b841d470338a3b1d6335b14ee1cd0c8f5d754 upstream.
The TPM RNG functionality is not necessary for entropy when the CPU already supports the RDRAND instruction. The TPM RNG functionality was previously disabled on a subset of AMD fTPM series, but reports continue to show problems on some systems causing stutter root caused to TPM RNG functionality.
Expand disabling TPM RNG use for all AMD fTPMs whether they have versions that claim to have fixed or not. To accomplish this, move the detection into part of the TPM CRB registration and add a flag indicating that the TPM should opt-out of registration to hwrng.
--- drivers/char/tpm/tpm-chip.c | 68 +------------------------------------------- drivers/char/tpm/tpm_crb.c | 30 +++++++++++++++++++ include/linux/tpm.h | 1 3 files changed, 33 insertions(+), 66 deletions(-)
drivers/char/tpm/tpm-chip.c +2 -66
@@ -510,70 +510,6 @@ static int tpm_add_legacy_sysfs(struct treturn 0 ; } -/* -* Some AMD fTPM versions may cause stutter -* https://www.amd.com/en/support/kb/faq/pa-410 -* -* Fixes are available in two series of fTPM firmware: -* 6.x.y.z series: 6.0.18.6 + -* 3.x.y.z series: 3.57.y.5 + -*/ -#ifdef CONFIG_X86 -static bool tpm_amd_is_rng_defective (struct tpm_chip *chip) -{ -u32 val1, val2; -u64 version; -int ret; - -if (!(chip->flags &TPM_CHIP_FLAG_TPM2 )) -return false; - - ret =tpm_request_locality (chip); -if (ret) -return false; - - ret =tpm2_get_tpm_pt (chip,TPM2_PT_MANUFACTURER , &val1,NULL ); -if (ret) - goto release; -if (val1 !=0x414D4400U /* AMD */ ) { - ret = -ENODEV ; - goto release; - } - ret =tpm2_get_tpm_pt (chip,TPM2_PT_FIRMWARE_VERSION_1 , &val1,NULL ); -if (ret) - goto release; - ret =tpm2_get_tpm_pt (chip,TPM2_PT_FIRMWARE_VERSION_2 , &val2,NULL ); - -release: -tpm_relinquish_locality (chip); - -if (ret) -return false; - - version = ((u64 )val1 <<32 ) | val2; -if ((version >>48 ) ==6 ) { -if (version >=0x0006000000180006ULL ) -return false; - }else if ((version >>48 ) ==3 ) { -if (version >=0x0003005700000005ULL ) -return false; - }else { -return false; - } - -dev_warn (&chip->dev, -"AMD fTPM version 0x%llx causes system stutter; hwrng disabled\n" , - version); - -return true; -} -#else -static inline bool tpm_amd_is_rng_defective (struct tpm_chip *chip) -{ -return false; -} -#endif /* CONFIG_X86 */ -static int tpm_hwrng_read (struct hwrng *rng,void *data,size_t max,bool wait) { struct tpm_chip *chip = container_of(rng, struct tpm_chip, hwrng);
@@ -588,7 +524,7 @@ static int tpm_hwrng_read(struct hwrng *static int tpm_add_hwrng (struct tpm_chip *chip) {if (!IS_ENABLED (CONFIG_HW_RANDOM_TPM ) ||tpm_is_firmware_upgrade (chip) || -tpm_amd_is_rng_defective (chip)) + chip->flags &TPM_CHIP_FLAG_HWRNG_DISABLED )return 0 ; snprintf(chip->hwrng_name, sizeof(chip->hwrng_name),
@@ -719,7 +655,7 @@ void tpm_chip_unregister(struct tpm_chip {tpm_del_legacy_sysfs (chip);if (IS_ENABLED (CONFIG_HW_RANDOM_TPM ) && !tpm_is_firmware_upgrade (chip) && - !tpm_amd_is_rng_defective (chip)) + !(chip->flags &TPM_CHIP_FLAG_HWRNG_DISABLED ))hwrng_unregister (&chip->hwrng);tpm_bios_log_teardown (chip);if (chip->flags &TPM_CHIP_FLAG_TPM2 && !tpm_is_firmware_upgrade (chip))
drivers/char/tpm/tpm_crb.c +30 -0
@@ -463,6 +463,28 @@ static bool crb_req_canceled(struct tpm_return (cancel &CRB_CANCEL_INVOKE ) ==CRB_CANCEL_INVOKE ; } +static int crb_check_flags (struct tpm_chip *chip) +{ +u32 val; +int ret; + + ret =crb_request_locality (chip,0 ); +if (ret) +return ret; + + ret =tpm2_get_tpm_pt (chip,TPM2_PT_MANUFACTURER , &val,NULL ); +if (ret) + goto release; + +if (val ==0x414D4400U /* AMD */ ) + chip->flags |=TPM_CHIP_FLAG_HWRNG_DISABLED ; + +release: +crb_relinquish_locality (chip,0 ); + +return ret; +} +static const struct tpm_class_ops tpm_crb = { .flags =TPM_OPS_AUTO_STARTUP , .status = crb_status,
@@ -800,6 +822,14 @@ static int crb_acpi_add(struct acpi_devi chip->acpi_dev_handle = device->handle; chip->flags =TPM_CHIP_FLAG_TPM2 ; + rc =tpm_chip_bootstrap (chip); +if (rc) + goto out; + + rc =crb_check_flags (chip); +if (rc) + goto out; + rc =tpm_chip_register (chip); out:
include/linux/tpm.h +1 -0
@@ -283,6 +283,7 @@ enum tpm_chip_flags {TPM_CHIP_FLAG_FIRMWARE_POWER_MANAGED =BIT (6 ),TPM_CHIP_FLAG_FIRMWARE_UPGRADE =BIT (7 ),TPM_CHIP_FLAG_SUSPENDED =BIT (8 ), + TPM_CHIP_FLAG_HWRNG_DISABLED = BIT(9), };#define to_tpm_chip (d) container_of(d, struct tpm_chip, dev)
Greg Kroah-Hartman
maintainerPATCH 3/206 tpm/tpm_tis: Disable interrupts for Lenovo P620 devices
In reply to Greg Kroah-HartmanFrom: Jonathan McDowell <[email protected]>
commit e117e7adc637e364b599dc766f1d740698e7e027 upstream.
The Lenovo ThinkStation P620 suffers from an irq storm issue like various other Lenovo machines, so add an entry for it to tpm_tis_dmi_table and force polling.
It is worth noting that 481c2d14627d (tpm,tpm_tis: Disable interrupts after 1000 unhandled IRQs) does not seem to fix the problem on this machine, but setting 'tpm_tis.interrupts=0' on the kernel command line does.
[[email protected]: truncated the commit ID in the description to 12 characters]
--- drivers/char/tpm/tpm_tis.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/char/tpm/tpm_tis.c +8 -0
@@ -164,6 +164,14 @@ static const struct dmi_system_id tpm_ti }, { .callback = tpm_tis_disable_irq, + .ident = "ThinkStation P620", + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), + DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkStation P620"), + }, + }, + { + .callback = tpm_tis_disable_irq, .ident = "TUXEDO InfinityBook S 15/17 Gen7", .matches = { DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"),
Greg Kroah-Hartman
maintainerPATCH 4/206 tpm: Add a helper for checking hwrng enabled
In reply to Greg Kroah-HartmanFrom: Mario Limonciello <[email protected]>
commit cacc6e22932f373a91d7be55a9b992dc77f4c59b upstream.
The same checks are repeated in three places to decide whether to use hwrng. Consolidate these into a helper.
Also this fixes a case that one of them was missing a check in the cleanup path.
--- drivers/char/tpm/tpm-chip.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
drivers/char/tpm/tpm-chip.c +14 -5
@@ -521,10 +521,20 @@ static int tpm_hwrng_read(struct hwrng *return tpm_get_random (chip, data, max); } +static bool tpm_is_hwrng_enabled (struct tpm_chip *chip) +{ +if (!IS_ENABLED (CONFIG_HW_RANDOM_TPM )) +return false; +if (tpm_is_firmware_upgrade (chip)) +return false; +if (chip->flags &TPM_CHIP_FLAG_HWRNG_DISABLED ) +return false; +return true; +} +static int tpm_add_hwrng (struct tpm_chip *chip) { -if (!IS_ENABLED (CONFIG_HW_RANDOM_TPM ) ||tpm_is_firmware_upgrade (chip) || - chip->flags &TPM_CHIP_FLAG_HWRNG_DISABLED ) +if (!tpm_is_hwrng_enabled (chip))return 0 ; snprintf(chip->hwrng_name, sizeof(chip->hwrng_name),
@@ -629,7 +639,7 @@ int tpm_chip_register(struct tpm_chip *creturn 0 ; out_hwrng: -if (IS_ENABLED (CONFIG_HW_RANDOM_TPM ) && !tpm_is_firmware_upgrade (chip)) +if (tpm_is_hwrng_enabled (chip))hwrng_unregister (&chip->hwrng); out_ppi:tpm_bios_log_teardown (chip);
@@ -654,8 +664,7 @@ EXPORT_SYMBOL_GPL(tpm_chip_register);void tpm_chip_unregister (struct tpm_chip *chip) {tpm_del_legacy_sysfs (chip); -if (IS_ENABLED (CONFIG_HW_RANDOM_TPM ) && !tpm_is_firmware_upgrade (chip) && - !(chip->flags &TPM_CHIP_FLAG_HWRNG_DISABLED )) +if (tpm_is_hwrng_enabled (chip))hwrng_unregister (&chip->hwrng);tpm_bios_log_teardown (chip);if (chip->flags &TPM_CHIP_FLAG_TPM2 && !tpm_is_firmware_upgrade (chip))
Greg Kroah-Hartman
maintainerPATCH 5/206 ksmbd: validate command request size
In reply to Greg Kroah-HartmanFrom: Long Li <[email protected]>
commit 5aa4fda5aa9c2a5a7bac67b4a12b089ab81fee3c upstream.
In commit 2b9b8f3b68ed ("ksmbd: validate command payload size"), except for SMB2_OPLOCK_BREAK_HE command, the request size of other commands is not checked, it's not expected. Fix it by add check for request size of other commands.
--- fs/smb/server/smb2misc.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
fs/smb/server/smb2misc.c +5 -5
@@ -380,13 +380,13 @@ int ksmbd_smb2_check_message(struct ksmb }if (smb2_req_struct_sizes[command] != pdu->StructureSize2) { -if (command ==SMB2_OPLOCK_BREAK_HE && -le16_to_cpu (pdu->StructureSize2) !=OP_BREAK_STRUCT_SIZE_20 && -le16_to_cpu (pdu->StructureSize2) !=OP_BREAK_STRUCT_SIZE_21 ) { +if (!(command ==SMB2_OPLOCK_BREAK_HE && + (le16_to_cpu (pdu->StructureSize2) ==OP_BREAK_STRUCT_SIZE_20 || +le16_to_cpu (pdu->StructureSize2) ==OP_BREAK_STRUCT_SIZE_21 ))) {/* special case for SMB2.1 lease break message */ ksmbd_debug (SMB , -"Illegal request size %d for oplock break\n" , -le16_to_cpu (pdu->StructureSize2)); +"Illegal request size %u for command %d\n" , +le16_to_cpu (pdu->StructureSize2), command);return 1 ; } }
Greg Kroah-Hartman
maintainerPATCH 6/206 ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea()
In reply to Greg Kroah-HartmanFrom: Namjae Jeon <[email protected]>
commit 79ed288cef201f1f212dfb934bcaac75572fb8f6 upstream.
There are multiple smb2_ea_info buffers in FILE_FULL_EA_INFORMATION request from client. ksmbd find next smb2_ea_info using ->NextEntryOffset of current smb2_ea_info. ksmbd need to validate buffer length Before accessing the next ea. ksmbd should check buffer length using buf_len, not next variable. next is the start offset of current ea that got from previous ea.
--- fs/smb/server/smb2pdu.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
fs/smb/server/smb2pdu.c +8 -1
@@ -2324,9 +2324,16 @@ next:break ; buf_len -= next; eabuf = (struct smb2_ea_info *)((char *)eabuf + next); -if (next < (u32 )eabuf->EaNameLength +le16_to_cpu (eabuf->EaValueLength)) +if (buf_len <sizeof (struct smb2_ea_info )) { + rc = -EINVAL ;break ; + } +if (buf_len <sizeof (struct smb2_ea_info ) + eabuf->EaNameLength + +le16_to_cpu (eabuf->EaValueLength)) { + rc = -EINVAL ; +break ; + } }while (next !=0 );kfree (attr_name);
Greg Kroah-Hartman
maintainerPATCH 7/206 KVM: SEV: snapshot the GHCB before accessing it
In reply to Greg Kroah-HartmanFrom: Paolo Bonzini <[email protected]>
commit 4e15a0ddc3ff40e8ea84032213976ecf774d7f77 upstream.
Validation of the GHCB is susceptible to time-of-check/time-of-use vulnerabilities. To avoid them, we would like to always snapshot the fields that are read in sev_es_validate_vmgexit(), and not use the GHCB anymore after it returns.
This means:
- invoking sev_es_sync_from_ghcb() before any GHCB access, including before sev_es_validate_vmgexit()
- snapshotting all fields including the valid bitmap and the sw_scratch field, which are currently not caching anywhere.
The valid bitmap is the first thing to be copied out of the GHCB; then, further accesses will use the copy in svm->sev_es.
--- arch/x86/kvm/svm/sev.c | 69 ++++++++++++++++++++++++------------------------- arch/x86/kvm/svm/svm.h | 26 ++++++++++++++++++ 2 files changed, 61 insertions(+), 34 deletions(-)
arch/x86/kvm/svm/sev.c +35 -34
@@ -2414,15 +2414,18 @@ static void sev_es_sync_from_ghcb(struct*/ memset (vcpu->arch.regs,0 ,sizeof (vcpu->arch.regs)); - vcpu->arch.regs[VCPU_REGS_RAX ] =ghcb_get_rax_if_valid (ghcb); - vcpu->arch.regs[VCPU_REGS_RBX ] =ghcb_get_rbx_if_valid (ghcb); - vcpu->arch.regs[VCPU_REGS_RCX ] =ghcb_get_rcx_if_valid (ghcb); - vcpu->arch.regs[VCPU_REGS_RDX ] =ghcb_get_rdx_if_valid (ghcb); - vcpu->arch.regs[VCPU_REGS_RSI ] =ghcb_get_rsi_if_valid (ghcb); +BUILD_BUG_ON (sizeof (svm->sev_es.valid_bitmap) !=sizeof (ghcb->save.valid_bitmap)); +memcpy (&svm->sev_es.valid_bitmap, &ghcb->save.valid_bitmap,sizeof (ghcb->save.valid_bitmap)); - svm->vmcb->save.cpl =ghcb_get_cpl_if_valid (ghcb); + vcpu->arch.regs[VCPU_REGS_RAX ] =kvm_ghcb_get_rax_if_valid (svm, ghcb); + vcpu->arch.regs[VCPU_REGS_RBX ] =kvm_ghcb_get_rbx_if_valid (svm, ghcb); + vcpu->arch.regs[VCPU_REGS_RCX ] =kvm_ghcb_get_rcx_if_valid (svm, ghcb); + vcpu->arch.regs[VCPU_REGS_RDX ] =kvm_ghcb_get_rdx_if_valid (svm, ghcb); + vcpu->arch.regs[VCPU_REGS_RSI ] =kvm_ghcb_get_rsi_if_valid (svm, ghcb); -if (ghcb_xcr0_is_valid (ghcb)) { + svm->vmcb->save.cpl =kvm_ghcb_get_cpl_if_valid (svm, ghcb); + +if (kvm_ghcb_xcr0_is_valid (svm)) { vcpu->arch.xcr0 =ghcb_get_xcr0 (ghcb);kvm_update_cpuid_runtime (vcpu); }
@@ -2433,6 +2436,7 @@ static void sev_es_sync_from_ghcb(struct control->exit_code_hi =upper_32_bits (exit_code); control->exit_info_1 =ghcb_get_sw_exit_info_1 (ghcb); control->exit_info_2 =ghcb_get_sw_exit_info_2 (ghcb); + svm->sev_es.sw_scratch =kvm_ghcb_get_sw_scratch_if_valid (svm, ghcb);/* Clear the valid entries fields */ memset (ghcb->save.valid_bitmap,0 ,sizeof (ghcb->save.valid_bitmap));
@@ -2461,56 +2465,56 @@ static int sev_es_validate_vmgexit(struc reason =GHCB_ERR_MISSING_INPUT ; -if (!ghcb_sw_exit_code_is_valid (ghcb) || - !ghcb_sw_exit_info_1_is_valid (ghcb) || - !ghcb_sw_exit_info_2_is_valid (ghcb)) +if (!kvm_ghcb_sw_exit_code_is_valid (svm) || + !kvm_ghcb_sw_exit_info_1_is_valid (svm) || + !kvm_ghcb_sw_exit_info_2_is_valid (svm)) goto vmgexit_err;switch (ghcb_get_sw_exit_code (ghcb)) {case SVM_EXIT_READ_DR7 :break ;case SVM_EXIT_WRITE_DR7 : -if (!ghcb_rax_is_valid (ghcb)) +if (!kvm_ghcb_rax_is_valid (svm)) goto vmgexit_err;break ;case SVM_EXIT_RDTSC :break ;case SVM_EXIT_RDPMC : -if (!ghcb_rcx_is_valid (ghcb)) +if (!kvm_ghcb_rcx_is_valid (svm)) goto vmgexit_err;break ;case SVM_EXIT_CPUID : -if (!ghcb_rax_is_valid (ghcb) || - !ghcb_rcx_is_valid (ghcb)) +if (!kvm_ghcb_rax_is_valid (svm) || + !kvm_ghcb_rcx_is_valid (svm)) goto vmgexit_err;if (ghcb_get_rax (ghcb) ==0xd ) -if (!ghcb_xcr0_is_valid (ghcb)) +if (!kvm_ghcb_xcr0_is_valid (svm)) goto vmgexit_err;break ;case SVM_EXIT_INVD :break ;case SVM_EXIT_IOIO :if (ghcb_get_sw_exit_info_1 (ghcb) &SVM_IOIO_STR_MASK ) { -if (!ghcb_sw_scratch_is_valid (ghcb)) +if (!kvm_ghcb_sw_scratch_is_valid (svm)) goto vmgexit_err; }else {if (!(ghcb_get_sw_exit_info_1 (ghcb) &SVM_IOIO_TYPE_MASK )) -if (!ghcb_rax_is_valid (ghcb)) +if (!kvm_ghcb_rax_is_valid (svm)) goto vmgexit_err; }break ;case SVM_EXIT_MSR : -if (!ghcb_rcx_is_valid (ghcb)) +if (!kvm_ghcb_rcx_is_valid (svm)) goto vmgexit_err;if (ghcb_get_sw_exit_info_1 (ghcb)) { -if (!ghcb_rax_is_valid (ghcb) || - !ghcb_rdx_is_valid (ghcb)) +if (!kvm_ghcb_rax_is_valid (svm) || + !kvm_ghcb_rdx_is_valid (svm)) goto vmgexit_err; }break ;case SVM_EXIT_VMMCALL : -if (!ghcb_rax_is_valid (ghcb) || - !ghcb_cpl_is_valid (ghcb)) +if (!kvm_ghcb_rax_is_valid (svm) || + !kvm_ghcb_cpl_is_valid (svm)) goto vmgexit_err;break ;case SVM_EXIT_RDTSCP :
@@ -2518,19 +2522,19 @@ static int sev_es_validate_vmgexit(struccase SVM_EXIT_WBINVD :break ;case SVM_EXIT_MONITOR : -if (!ghcb_rax_is_valid (ghcb) || - !ghcb_rcx_is_valid (ghcb) || - !ghcb_rdx_is_valid (ghcb)) +if (!kvm_ghcb_rax_is_valid (svm) || + !kvm_ghcb_rcx_is_valid (svm) || + !kvm_ghcb_rdx_is_valid (svm)) goto vmgexit_err;break ;case SVM_EXIT_MWAIT : -if (!ghcb_rax_is_valid (ghcb) || - !ghcb_rcx_is_valid (ghcb)) +if (!kvm_ghcb_rax_is_valid (svm) || + !kvm_ghcb_rcx_is_valid (svm)) goto vmgexit_err;break ;case SVM_VMGEXIT_MMIO_READ :case SVM_VMGEXIT_MMIO_WRITE : -if (!ghcb_sw_scratch_is_valid (ghcb)) +if (!kvm_ghcb_sw_scratch_is_valid (svm)) goto vmgexit_err;break ;case SVM_VMGEXIT_NMI_COMPLETE :
@@ -2560,9 +2564,6 @@ vmgexit_err:dump_ghcb (svm); } -/* Clear the valid entries fields */ -memset (ghcb->save.valid_bitmap,0 ,sizeof (ghcb->save.valid_bitmap)); -ghcb_set_sw_exit_info_1 (ghcb,2 );ghcb_set_sw_exit_info_2 (ghcb, reason);
@@ -2583,7 +2584,7 @@ void sev_es_unmap_ghcb(struct vcpu_svm **/ if (svm->sev_es.ghcb_sa_sync) {kvm_write_guest (svm->vcpu.kvm, -ghcb_get_sw_scratch (svm->sev_es.ghcb), + svm->sev_es.sw_scratch, svm->sev_es.ghcb_sa, svm->sev_es.ghcb_sa_len); svm->sev_es.ghcb_sa_sync = false;
@@ -2634,7 +2635,7 @@ static int setup_vmgexit_scratch(structu64 scratch_gpa_beg, scratch_gpa_end;void *scratch_va; - scratch_gpa_beg =ghcb_get_sw_scratch (ghcb); + scratch_gpa_beg = svm->sev_es.sw_scratch;if (!scratch_gpa_beg) {pr_err ("vmgexit: scratch gpa not provided\n" ); goto e_scratch;
@@ -2850,11 +2851,11 @@ int sev_handle_vmgexit(struct kvm_vcpu * exit_code =ghcb_get_sw_exit_code (ghcb); +sev_es_sync_from_ghcb (svm); ret =sev_es_validate_vmgexit (svm);if (ret)return ret; -sev_es_sync_from_ghcb (svm);ghcb_set_sw_exit_info_1 (ghcb,0 );ghcb_set_sw_exit_info_2 (ghcb,0 );
arch/x86/kvm/svm/svm.h +26 -0
@@ -190,10 +190,12 @@ struct vcpu_sev_es_state {/* SEV-ES support */ struct sev_es_save_area *vmsa;struct ghcb *ghcb; +u8 valid_bitmap[16 ];struct kvm_host_map ghcb_map;bool received_first_sipi;/* SEV-ES scratch area support */ +u64 sw_scratch;void *ghcb_sa;u32 ghcb_sa_len;bool ghcb_sa_sync;
@@ -745,4 +747,28 @@ void sev_es_unmap_ghcb(struct vcpu_svm *void __svm_sev_es_vcpu_run (struct vcpu_svm *svm,bool spec_ctrl_intercepted);void __svm_vcpu_run (struct vcpu_svm *svm,bool spec_ctrl_intercepted); +#define DEFINE_KVM_GHCB_ACCESSORS (field) \ + static __always_inline bool kvm_ghcb_##field##_is_valid(const struct vcpu_svm *svm) \ + { \ + return test_bit(GHCB_BITMAP_IDX(field), \ + (unsigned long *)&svm->sev_es.valid_bitmap); \ + } \ + \ + static __always_inline u64 kvm_ghcb_get_##field##_if_valid(struct vcpu_svm *svm, struct ghcb *ghcb) \ + { \ + return kvm_ghcb_##field##_is_valid(svm) ? ghcb->save.field : 0; \ + } \ + +DEFINE_KVM_GHCB_ACCESSORS(cpl) +DEFINE_KVM_GHCB_ACCESSORS(rax) +DEFINE_KVM_GHCB_ACCESSORS(rcx) +DEFINE_KVM_GHCB_ACCESSORS(rdx) +DEFINE_KVM_GHCB_ACCESSORS(rbx) +DEFINE_KVM_GHCB_ACCESSORS(rsi) +DEFINE_KVM_GHCB_ACCESSORS(sw_exit_code) +DEFINE_KVM_GHCB_ACCESSORS(sw_exit_info_1) +DEFINE_KVM_GHCB_ACCESSORS(sw_exit_info_2) +DEFINE_KVM_GHCB_ACCESSORS(sw_scratch) +DEFINE_KVM_GHCB_ACCESSORS(xcr0) +#endif
Greg Kroah-Hartman
maintainerPATCH 8/206 KVM: SEV: only access GHCB fields once
In reply to Greg Kroah-HartmanFrom: Paolo Bonzini <[email protected]>
commit 7588dbcebcbf0193ab5b76987396d0254270b04a upstream.
A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race condition vulnerability and invoke the VMGEXIT handler recursively.
sev_handle_vmgexit() maps the GHCB page using kvm_vcpu_map() and then fetches the exit code using ghcb_get_sw_exit_code(). Soon after, sev_es_validate_vmgexit() fetches the exit code again. Since the GHCB page is shared with the guest, the guest is able to quickly swap the values with another vCPU and hence bypass the validation. One vmexit code that can be rejected by sev_es_validate_vmgexit() is SVM_EXIT_VMGEXIT; if sev_handle_vmgexit() observes it in the second fetch, the call to svm_invoke_exit_handler() will invoke sev_handle_vmgexit() again recursively.
To avoid the race, always fetch the GHCB data from the places where sev_es_sync_from_ghcb stores it.
Exploiting recursions on linux kernel has been proven feasible in the past, but the impact is mitigated by stack guard pages (CONFIG_VMAP_STACK). Still, if an attacker manages to call the handler multiple times, they can theoretically trigger a stack overflow and cause a denial-of-service, or potentially guest-to-host escape in kernel configurations without stack guard pages.
Note that winning the race reliably in every iteration is very tricky due to the very tight window of the fetches; depending on the compiler settings, they are often consecutive because of optimization and inlining.
Tested by booting an SEV-ES RHEL9 guest.
--- arch/x86/kvm/svm/sev.c | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-)
arch/x86/kvm/svm/sev.c +14 -11
@@ -2442,9 +2442,15 @@ static void sev_es_sync_from_ghcb(structmemset (ghcb->save.valid_bitmap,0 ,sizeof (ghcb->save.valid_bitmap)); } +static u64 kvm_ghcb_get_sw_exit_code (struct vmcb_control_area *control) +{ +return (((u64 )control->exit_code_hi) <<32 ) | control->exit_code; +} +static int sev_es_validate_vmgexit (struct vcpu_svm *svm) { -struct kvm_vcpu *vcpu; +struct vmcb_control_area *control = &svm->vmcb->control; +struct kvm_vcpu *vcpu = &svm->vcpu;struct ghcb *ghcb;u64 exit_code;u64 reason;
@@ -2455,7 +2461,7 @@ static int sev_es_validate_vmgexit(struc* Retrieve the exit code now even though it may not be marked valid * as it could help with debugging. */ - exit_code =ghcb_get_sw_exit_code (ghcb); + exit_code =kvm_ghcb_get_sw_exit_code (control);/* Only GHCB Usage code 0 is supported */ if (ghcb->ghcb_usage) {
@@ -2470,7 +2476,7 @@ static int sev_es_validate_vmgexit(struc !kvm_ghcb_sw_exit_info_2_is_valid(svm)) goto vmgexit_err; -switch (ghcb_get_sw_exit_code (ghcb)) { +switch (exit_code) {case SVM_EXIT_READ_DR7 :break ;case SVM_EXIT_WRITE_DR7 :
@@ -2487,18 +2493,18 @@ static int sev_es_validate_vmgexit(strucif (!kvm_ghcb_rax_is_valid (svm) || !kvm_ghcb_rcx_is_valid (svm)) goto vmgexit_err; -if (ghcb_get_rax (ghcb) ==0xd ) +if (vcpu->arch.regs[VCPU_REGS_RAX ] ==0xd )if (!kvm_ghcb_xcr0_is_valid (svm)) goto vmgexit_err;break ;case SVM_EXIT_INVD :break ;case SVM_EXIT_IOIO : -if (ghcb_get_sw_exit_info_1 (ghcb) &SVM_IOIO_STR_MASK ) { +if (control->exit_info_1 &SVM_IOIO_STR_MASK ) {if (!kvm_ghcb_sw_scratch_is_valid (svm)) goto vmgexit_err; }else { -if (!(ghcb_get_sw_exit_info_1 (ghcb) &SVM_IOIO_TYPE_MASK )) +if (!(control->exit_info_1 &SVM_IOIO_TYPE_MASK ))if (!kvm_ghcb_rax_is_valid (svm)) goto vmgexit_err; }
@@ -2506,7 +2512,7 @@ static int sev_es_validate_vmgexit(struccase SVM_EXIT_MSR :if (!kvm_ghcb_rcx_is_valid (svm)) goto vmgexit_err; -if (ghcb_get_sw_exit_info_1 (ghcb)) { +if (control->exit_info_1) {if (!kvm_ghcb_rax_is_valid (svm) || !kvm_ghcb_rdx_is_valid (svm)) goto vmgexit_err;
@@ -2550,8 +2556,6 @@ static int sev_es_validate_vmgexit(strucreturn 0 ; vmgexit_err: - vcpu = &svm->vcpu; -if (reason ==GHCB_ERR_INVALID_USAGE ) {vcpu_unimpl (vcpu,"vmgexit: ghcb usage %#x is not valid\n" , ghcb->ghcb_usage);
@@ -2849,8 +2853,6 @@ int sev_handle_vmgexit(struct kvm_vcpu *trace_kvm_vmgexit_enter (vcpu->vcpu_id, ghcb); - exit_code =ghcb_get_sw_exit_code (ghcb); -sev_es_sync_from_ghcb (svm); ret =sev_es_validate_vmgexit (svm);if (ret)
@@ -2859,6 +2861,7 @@ int sev_handle_vmgexit(struct kvm_vcpu *ghcb_set_sw_exit_info_1 (ghcb,0 );ghcb_set_sw_exit_info_2 (ghcb,0 ); + exit_code =kvm_ghcb_get_sw_exit_code (control);switch (exit_code) {case SVM_VMGEXIT_MMIO_READ : ret =setup_vmgexit_scratch (svm, true, control->exit_info_2);
Greg Kroah-Hartman
maintainerPATCH 9/206 wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems()
In reply to Greg Kroah-HartmanFrom: Keith Yeo <[email protected]>
commit 6311071a056272e1e761de8d0305e87cc566f734 upstream.
nl80211_parse_mbssid_elems() uses a u8 variable num_elems to count the number of MBSSID elements in the nested netlink attribute attrs, which can lead to an integer overflow if a user of the nl80211 interface specifies 256 or more elements in the corresponding attribute in userspace. The integer overflow can lead to a heap buffer overflow as num_elems determines the size of the trailing array in elems, and this array is thereafter written to for each element in attrs.
Note that this vulnerability only affects devices with the wiphy->mbssid_max_interfaces member set for the wireless physical device struct in the device driver, and can only be triggered by a process with CAP_NET_ADMIN capabilities.
Fix this by checking for a maximum of 255 elements in attrs.
--- net/wireless/nl80211.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/wireless/nl80211.c +4 -1
@@ -5426,8 +5426,11 @@ nl80211_parse_mbssid_elems(struct wiphyif (!wiphy->mbssid_max_interfaces)return ERR_PTR (-EINVAL ); -nla_for_each_nested (nl_elems, attrs, rem_elems) +nla_for_each_nested (nl_elems, attrs, rem_elems) { +if (num_elems >=255 ) +return ERR_PTR (-EINVAL ); num_elems++; + } elems =kzalloc (struct_size (elems, elem, num_elems),GFP_KERNEL );if (!elems)
Greg Kroah-Hartman
maintainerPATCH 10/206 wifi: rtw89: fix 8852AE disconnection caused by RX full flags
In reply to Greg Kroah-HartmanFrom: Ping-Ke Shih <[email protected]>
commit b74bb07cdab6859e1a3fc9fe7351052176322ddf upstream.
RX full flags are raised if certain types of RX FIFO are full, and then drop all following MPDU of AMPDU. In order to resume to receive MPDU when RX FIFO becomes available, we clear the register bits by the commit a0d99ebb3ecd ("wifi: rtw89: initialize DMA of CMAC"). But, 8852AE needs more settings to support this. To quickly fix disconnection problem, revert the behavior as before.
--- drivers/net/wireless/realtek/rtw89/mac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/realtek/rtw89/mac.c +1 -1
@@ -2484,7 +2484,7 @@ static int cmac_dma_init(struct rtw89_deu32 reg;int ret; -if (chip_id !=RTL8852A && chip_id !=RTL8852B ) +if (chip_id !=RTL8852B )return 0 ; ret =rtw89_mac_check_mac_en (rtwdev, mac_idx,RTW89_CMAC_SEL );
Greg Kroah-Hartman
maintainerPATCH 11/206 selftests: forwarding: Set default IPv6 traceroute utility
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit 38f7c44d6e760a8513557e27340d61b820c91b8f upstream.
The test uses the 'TROUTE6' environment variable to encode the name of the IPv6 traceroute utility. By default (without a configuration file), this variable is not set, resulting in failures:
# ./ip6_forward_instats_vrf.sh TEST: ping6 [ OK ] TEST: Ip6InTooBigErrors [ OK ] TEST: Ip6InHdrErrors [FAIL] TEST: Ip6InAddrErrors [ OK ] TEST: Ip6InDiscards [ OK ]
Fix by setting a default utility name and skip the test if the utility is not present.
--- tools/testing/selftests/net/forwarding/ip6_forward_instats_vrf.sh | 2 ++ tools/testing/selftests/net/forwarding/lib.sh | 1 + 2 files changed, 3 insertions(+)
tools/testing/selftests/net/forwarding/ip6_forward_instats_vrf.sh +2 -0
@@ -14,6 +14,8 @@ ALL_TESTS=" NUM_NETIFS=4 source lib.sh +require_command $TROUTE6 + h1_create() { simple_if_init $h1 2001:1:1::2/64
tools/testing/selftests/net/forwarding/lib.sh +1 -0
@@ -30,6 +30,7 @@ REQUIRE_MZ=${REQUIRE_MZ:=yes} REQUIRE_MTOOLS=${REQUIRE_MTOOLS:=no} STABLE_MAC_ADDRS=${STABLE_MAC_ADDRS:=no} TCPDUMP_EXTRA_FLAGS=${TCPDUMP_EXTRA_FLAGS:=} +TROUTE6=${TROUTE6:=traceroute6} relative_path="${BASH_SOURCE%/*}" if [[ "$relative_path" == "${BASH_SOURCE}" ]]; then
Greg Kroah-Hartman
maintainerPATCH 12/206 wireguard: allowedips: expand maximum node depth
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
commit 46622219aae2b67813fe31a7b8cb7da5baff5c8a upstream.
In the allowedips self-test, nodes are inserted into the tree, but it generated an even amount of nodes, but for checking maximum node depth, there is of course the root node, which makes the total number necessarily odd. With two few nodes added, it never triggered the maximum depth check like it should have. So, add 129 nodes instead of 128 nodes, and do so with a more straightforward scheme, starting with all the bits set, and shifting over one each time. Then increase the maximum depth to 129, and choose a better name for that variable to make it clear that it represents depth as opposed to bits.
--- drivers/net/wireguard/allowedips.c | 8 ++++---- drivers/net/wireguard/selftest/allowedips.c | 16 ++++++++++------ 2 files changed, 14 insertions(+), 10 deletions(-)
drivers/net/wireguard/allowedips.c +4 -4
@@ -6,7 +6,7 @@#include "allowedips.h" #include "peer.h" -enum {MAX_ALLOWEDIPS_BITS =128 }; +enum {MAX_ALLOWEDIPS_DEPTH =129 };static struct kmem_cache *node_cache;
@@ -42,7 +42,7 @@ static void push_rcu(struct allowedips_n struct allowedips_node __rcu *p, unsigned int *len) { if (rcu_access_pointer(p)) { - if (WARN_ON(IS_ENABLED(DEBUG) && *len >= MAX_ALLOWEDIPS_BITS)) + if (WARN_ON(IS_ENABLED(DEBUG) && *len >= MAX_ALLOWEDIPS_DEPTH)) return; stack[(*len)++] =rcu_dereference_raw (p); }
@@ -55,7 +55,7 @@ static void node_free_rcu(struct rcu_heastatic void root_free_rcu (struct rcu_head *rcu) { -struct allowedips_node *node, *stack[MAX_ALLOWEDIPS_BITS ] = { +struct allowedips_node *node, *stack[MAX_ALLOWEDIPS_DEPTH ] = { container_of(rcu, struct allowedips_node, rcu) };unsigned int len =1 ;
@@ -68,7 +68,7 @@ static void root_free_rcu(struct rcu_heastatic void root_remove_peer_lists (struct allowedips_node *root) { -struct allowedips_node *node, *stack[MAX_ALLOWEDIPS_BITS ] = { root }; +struct allowedips_node *node, *stack[MAX_ALLOWEDIPS_DEPTH ] = { root };unsigned int len =1 ;while (len >0 && (node = stack[--len])) {
drivers/net/wireguard/selftest/allowedips.c +10 -6
@@ -593,16 +593,20 @@ bool __init wg_allowedips_selftest(void)wg_allowedips_remove_by_peer (&t, a, &mutex);test_negative (4 , a,192 ,168 ,0 ,1 ); -/* These will hit the WARN_ON(len >= MAX_ALLOWEDIPS_BITS) in free_node +/* These will hit the WARN_ON(len >= MAX_ALLOWEDIPS_DEPTH) in free_node * if something goes wrong. */ -for (i =0 ; i <MAX_ALLOWEDIPS_BITS ; ++i) { - part =cpu_to_be64 (~(1LLU << (i %64 ))); -memset (&ip,0xff ,16 ); -memcpy ((u8 *)&ip + (i <64 ) *8 , &part,8 ); +for (i =0 ; i <64 ; ++i) { + part =cpu_to_be64 (~0LLU << i); +memset (&ip,0xff ,8 ); +memcpy ((u8 *)&ip +8 , &part,8 ); +wg_allowedips_insert_v6 (&t, &ip,128 , a, &mutex); +memcpy (&ip, &part,8 ); +memset ((u8 *)&ip +8 ,0 ,8 );wg_allowedips_insert_v6 (&t, &ip,128 , a, &mutex); } - +memset (&ip,0 ,16 ); +wg_allowedips_insert_v6 (&t, &ip,128 , a, &mutex);wg_allowedips_free (&t, &mutex);wg_allowedips_init (&t);
Greg Kroah-Hartman
maintainerPATCH 13/206 mmc: moxart: read scr register without changing byte order
In reply to Greg Kroah-HartmanFrom: Sergei Antonov <[email protected]>
commit d44263222134b5635932974c6177a5cba65a07e8 upstream.
Conversion from big-endian to native is done in a common function mmc_app_send_scr(). Converting in moxart_transfer_pio() is extra. Double conversion on a LE system returns an incorrect SCR value, leads to errors:
mmc0: unrecognised SCR structure version 8
--- drivers/mmc/host/moxart-mmc.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
drivers/mmc/host/moxart-mmc.c +1 -7
@@ -338,13 +338,7 @@ static void moxart_transfer_pio(struct mreturn ; }for (len =0 ; len < remain && len < host->fifo_width;) { -/* SCR data must be read in big endian. */ -if (data->mrq->cmd->opcode ==SD_APP_SEND_SCR ) - *sgp =ioread32be (host->base + -REG_DATA_WINDOW ); -else - *sgp =ioread32 (host->base + -REG_DATA_WINDOW ); + *sgp =ioread32 (host->base +REG_DATA_WINDOW ); sgp++; len +=4 ; }
Greg Kroah-Hartman
maintainerPATCH 14/206 mmc: sdhci-f-sdh30: Replace with sdhci_pltfm
In reply to Greg Kroah-HartmanFrom: Kunihiko Hayashi <[email protected]>
commit 5def5c1c15bf22934ee227af85c1716762f3829f upstream.
Even if sdhci_pltfm_pmops is specified for PM, this driver doesn't apply sdhci_pltfm, so the structure is not correctly referenced in PM functions. This applies sdhci_pltfm to this driver to fix this issue.
- Call sdhci_pltfm_init() instead of sdhci_alloc_host() and other functions that covered by sdhci_pltfm.
- Move ops and quirks to sdhci_pltfm_data
- Replace sdhci_priv() with own private function sdhci_f_sdh30_priv().
--- drivers/mmc/host/sdhci_f_sdh30.c | 60 +++++++++++++++++---------------------- 1 file changed, 27 insertions(+), 33 deletions(-)
drivers/mmc/host/sdhci_f_sdh30.c +27 -33
@@ -29,9 +29,16 @@ struct f_sdhost_priv {bool enable_cmd_dat_delay; }; +static void *sdhci_f_sdhost_priv (struct sdhci_host *host) +{ +struct sdhci_pltfm_host *pltfm_host =sdhci_priv (host); + +return sdhci_pltfm_priv (pltfm_host); +} +static void sdhci_f_sdh30_soft_voltage_switch (struct sdhci_host *host) { -struct f_sdhost_priv *priv =sdhci_priv (host); +struct f_sdhost_priv *priv =sdhci_f_sdhost_priv (host);u32 ctrl =0 ;usleep_range (2500 ,3000 );
@@ -64,7 +71,7 @@ static unsigned int sdhci_f_sdh30_get_mistatic void sdhci_f_sdh30_reset (struct sdhci_host *host,u8 mask) { -struct f_sdhost_priv *priv =sdhci_priv (host); +struct f_sdhost_priv *priv =sdhci_f_sdhost_priv (host);u32 ctl;if (sdhci_readw (host,SDHCI_CLOCK_CONTROL ) ==0 )
@@ -95,30 +102,32 @@ static const struct sdhci_ops sdhci_f_sd .set_uhs_signaling = sdhci_set_uhs_signaling, }; +static const struct sdhci_pltfm_data sdhci_f_sdh30_pltfm_data = { + .ops = &sdhci_f_sdh30_ops, + .quirks =SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC + |SDHCI_QUIRK_INVERTED_WRITE_PROTECT , + .quirks2 =SDHCI_QUIRK2_SUPPORT_SINGLE + |SDHCI_QUIRK2_TUNING_WORK_AROUND , +}; +static int sdhci_f_sdh30_probe (struct platform_device *pdev) {struct sdhci_host *host;struct device *dev = &pdev->dev; -int irq, ctrl =0 , ret =0 ; +int ctrl =0 , ret =0 ;struct f_sdhost_priv *priv; +struct sdhci_pltfm_host *pltfm_host;u32 reg =0 ; - irq =platform_get_irq (pdev,0 ); -if (irq <0 ) -return irq; - - host =sdhci_alloc_host (dev,sizeof (struct f_sdhost_priv )); + host =sdhci_pltfm_init (pdev, &sdhci_f_sdh30_pltfm_data, +sizeof (struct f_sdhost_priv ));if (IS_ERR (host))return PTR_ERR (host); - priv =sdhci_priv (host); + pltfm_host =sdhci_priv (host); + priv =sdhci_pltfm_priv (pltfm_host); priv->dev = dev; - host->quirks =SDHCI_QUIRK_NO_ENDATTR_IN_NOPDESC | -SDHCI_QUIRK_INVERTED_WRITE_PROTECT ; - host->quirks2 =SDHCI_QUIRK2_SUPPORT_SINGLE | -SDHCI_QUIRK2_TUNING_WORK_AROUND ; - priv->enable_cmd_dat_delay =device_property_read_bool (dev,"fujitsu,cmd-dat-delay-select" );
@@ -126,18 +135,6 @@ static int sdhci_f_sdh30_probe(struct plif (ret) goto err; -platform_set_drvdata (pdev, host); - - host->hw_name ="f_sdh30" ; - host->ops = &sdhci_f_sdh30_ops; - host->irq = irq; - - host->ioaddr =devm_platform_ioremap_resource (pdev,0 ); -if (IS_ERR (host->ioaddr)) { - ret =PTR_ERR (host->ioaddr); - goto err; - } -if (dev_of_node (dev)) {sdhci_get_of_property (pdev);
@@ -204,24 +201,21 @@ err_rst: err_clk:clk_disable_unprepare (priv->clk_iface); err: -sdhci_free_host (host); +sdhci_pltfm_free (pdev); +return ret; }static int sdhci_f_sdh30_remove (struct platform_device *pdev) {struct sdhci_host *host =platform_get_drvdata (pdev); -struct f_sdhost_priv *priv =sdhci_priv (host); - -sdhci_remove_host (host,readl (host->ioaddr +SDHCI_INT_STATUS ) == -0xffffffff ); +struct f_sdhost_priv *priv =sdhci_f_sdhost_priv (host);reset_control_assert (priv->rst);clk_disable_unprepare (priv->clk);clk_disable_unprepare (priv->clk_iface); -sdhci_free_host (host); -platform_set_drvdata (pdev,NULL ); +sdhci_pltfm_unregister (pdev);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 15/206 ipv6: adjust ndisc_is_useropt() to also return true for PIO
In reply to Greg Kroah-HartmanFrom: Maciej Żenczykowski <[email protected]>
commit 048c796beb6eb4fa3a5a647ee1c81f5c6f0f6a2a upstream.
The upcoming (and nearly finalized):
https://datatracker.ietf.org/doc/draft-collink-6man-pio-pflag/
will update the IPv6 RA to include a new flag in the PIO field, which will serve as a hint to perform DHCPv6-PD.
As we don't want DHCPv6 related logic inside the kernel, this piece of information needs to be exposed to userspace. The simplest option is to simply expose the entire PIO through the already existing mechanism.
Even without this new flag, the already existing PIO R (router address) flag (from RFC6275) cannot AFAICT be handled entirely in kernel, and provides useful information that should be exposed to userspace (the router's global address, for use by Mobile IPv6).
Also cc'ing stable@ for inclusion in LTS, as while technically this is not quite a bugfix, and instead more of a feature, it is absolutely trivial and the alternative is manually cherrypicking into all Android Common Kernel trees - and I know Greg will ask for it to be sent in via LTS instead...
--- net/ipv6/ndisc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ipv6/ndisc.c +2 -1
@@ -197,7 +197,8 @@ static struct nd_opt_hdr *ndisc_next_optstatic inline int ndisc_is_useropt (const struct net_device *dev,struct nd_opt_hdr *opt) { -return opt->nd_opt_type ==ND_OPT_RDNSS || +return opt->nd_opt_type ==ND_OPT_PREFIX_INFO || + opt->nd_opt_type ==ND_OPT_RDNSS || opt->nd_opt_type ==ND_OPT_DNSSL || opt->nd_opt_type ==ND_OPT_CAPTIVE_PORTAL || opt->nd_opt_type == ND_OPT_PREF64 ||
Greg Kroah-Hartman
maintainerPATCH 16/206 selftests: mptcp: join: fix delete and re-add test
In reply to Greg Kroah-HartmanFrom: Andrea Claudi <[email protected]>
commit aaf2123a5cf46dbd97f84b6eee80269758064d93 upstream.
mptcp_join 'delete and re-add' test fails when using ip mptcp:
$ ./mptcp_join.sh -iI
<snip>
002 delete and re-add before delete[ ok ]
mptcp_info subflows=1 [ ok ]
Error: argument "ADDRESS" is wrong: invalid for non-zero id address
after delete[fail] got 2:2 subflows expected 1This happens because endpoint delete includes an ip address while id is not 0, contrary to what is indicated in the ip mptcp man page:
"When used with the delete id operation, an IFADDR is only included when the ID is 0."
This fixes the issue using the $addr variable in pm_nl_del_endpoint() only when id is 0.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/net/mptcp/mptcp_join.sh +1 -0
@@ -676,6 +676,7 @@ pm_nl_del_endpoint() local addr=$3 if [ $ip_mptcp -eq 1 ]; then + [ $id -ne 0 ] && addr='' ip -n $ns mptcp endpoint delete id $id $addr else ip netns exec $ns ./pm_nl_ctl del $id $addr
Greg Kroah-Hartman
maintainerPATCH 17/206 selftests: mptcp: join: fix implicit EP test
In reply to Greg Kroah-HartmanFrom: Andrea Claudi <[email protected]>
commit c8c101ae390a3e817369e94a6f12a1ddea420702 upstream.
mptcp_join 'implicit EP' test currently fails when using ip mptcp:
$ ./mptcp_join.sh -iI
<snip>
001 implicit EP creation[fail] expected '10.0.2.2 10.0.2.2 id 1 implicit' found '10.0.2.2 id 1 rawflags 10 '
Error: too many addresses or duplicate one: -22.
ID change is prevented[fail] expected '10.0.2.2 10.0.2.2 id 1 implicit' found '10.0.2.2 id 1 rawflags 10 '
modif is allowed[fail] expected '10.0.2.2 10.0.2.2 id 1 signal' found '10.0.2.2 id 1 signal 'This happens because of two reasons:
- iproute v6.3.0 does not support the implicit flag, fixed with iproute2-next commit 3a2535a41854 ("mptcp: add support for implicit flag")
- pm_nl_check_endpoint wrongly expects the ip address to be repeated two times in iproute output, and does not account for a final whitespace in it.
This fixes the issue trimming the whitespace in the output string and removing the double address in the expected string.
--- tools/testing/selftests/net/mptcp/mptcp_join.sh | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
tools/testing/selftests/net/mptcp/mptcp_join.sh +3 -2
@@ -767,10 +767,11 @@ pm_nl_check_endpoint() fi if [ $ip_mptcp -eq 1 ]; then + # get line and trim trailing whitespace line=$(ip -n $ns mptcp endpoint show $id) + line="${line% }" # the dump order is: address id flags port dev - expected_line="$addr" - [ -n "$addr" ] && expected_line="$expected_line $addr" + [ -n "$addr" ] && expected_line="$addr" expected_line="$expected_line $id" [ -n "$_flags" ] && expected_line="$expected_line ${_flags//","/" "}" [ -n "$dev" ] && expected_line="$expected_line $dev"
Greg Kroah-Hartman
maintainerPATCH 18/206 mptcp: avoid bogus reset on fallback close
In reply to Greg Kroah-HartmanFrom: Paolo Abeni <[email protected]>
commit ff18f9ef30ee87740f741b964375d0cfb84e1ec2 upstream.
Since the blamed commit, the MPTCP protocol unconditionally sends TCP resets on all the subflows on disconnect().
That fits full-blown MPTCP sockets - to implement the fastclose mechanism - but causes unexpected corruption of the data stream, caught as sporadic self-tests failures.
--- net/mptcp/protocol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/mptcp/protocol.c +1 -1
@@ -2335,7 +2335,7 @@ static void __mptcp_close_ssk(struct soclock_sock_nested (ssk,SINGLE_DEPTH_NESTING ); -if (flags &MPTCP_CF_FASTCLOSE ) { +if ((flags &MPTCP_CF_FASTCLOSE ) && !__mptcp_check_fallback (msk)) {/* be sure to force the tcp_disconnect() path, * to generate the egress reset */
Greg Kroah-Hartman
maintainerPATCH 19/206 mptcp: fix disconnect vs accept race
In reply to Greg Kroah-HartmanFrom: Paolo Abeni <[email protected]>
commit 511b90e39250135a7f900f1c3afbce25543018a2 upstream.
Despite commit 0ad529d9fd2b ("mptcp: fix possible divide by zero in recvmsg()"), the mptcp protocol is still prone to a race between disconnect() (or shutdown) and accept.
The root cause is that the mentioned commit checks the msk-level flag, but mptcp_stream_accept() does acquire the msk-level lock, as it can rely directly on the first subflow lock.
As reported by Christoph than can lead to a race where an msk socket is accepted after that mptcp_subflow_queue_clean() releases the listener socket lock and just before it takes destructive actions leading to the following splat:
BUG: kernel NULL pointer dereference, address: 0000000000000012 PGD 5a4ca067 P4D 5a4ca067 PUD 37d4c067 PMD 0 Oops: 0000 [#1] PREEMPT SMP CPU: 2 PID: 10955 Comm: syz-executor.5 Not tainted 6.5.0-rc1-gdc7b257ee5dd #37 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 RIP: 0010:mptcp_stream_accept+0x1ee/0x2f0 include/net/inet_sock.h:330 Code: 0a 09 00 48 8b 1b 4c 39 e3 74 07 e8 bc 7c 7f fe eb a1 e8 b5 7c 7f fe 4c 8b 6c 24 08 eb 05 e8 a9 7c 7f fe 49 8b 85 d8 09 00 00 <0f> b6 40 12 88 44 24 07 0f b6 6c 24 07 bf 07 00 00 00 89 ee e8 89 RSP: 0018:ffffc90000d07dc0 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff888037e8d020 RCX: ffff88803b093300 RDX: 0000000000000000 RSI: ffffffff833822c5 RDI: ffffffff8333896a RBP: 0000607f82031520 R08: ffff88803b093300 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000003e83 R12: ffff888037e8d020 R13: ffff888037e8c680 R14: ffff888009af7900 R15: ffff888009af6880 FS: 00007fc26d708640(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000012 CR3: 0000000066bc5001 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> do_accept+0x1ae/0x260 net/socket.c:1872 __sys_accept4+0x9b/0x110 net/socket.c:1913 __do_sys_accept4 net/socket.c:1954 [inline] __se_sys_accept4 net/socket.c:1951 [inline] __x64_sys_accept4+0x20/0x30 net/socket.c:1951 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x47/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x6e/0xd8
Address the issue by temporary removing the pending request socket from the accept queue, so that racing accept() can't touch them.
After depleting the msk - the ssk still exists, as plain TCP sockets, re-insert them into the accept queue, so that later inet_csk_listen_stop() will complete the tcp socket disposal.
--- net/mptcp/protocol.h | 1 net/mptcp/subflow.c | 60 +++++++++++++++++++++++++-------------------------- 2 files changed, 30 insertions(+), 31 deletions(-)
net/mptcp/protocol.h +0 -1
@@ -320,7 +320,6 @@ struct mptcp_sock {u32 setsockopt_seq;char ca_name[TCP_CA_NAME_MAX ]; -struct mptcp_sock *dl_next; };#define mptcp_data_lock (sk) spin_lock_bh(&(sk)->sk_lock.slock)
net/mptcp/subflow.c +30 -30
84 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 20/206 dmaengine: pl330: Return DMA_PAUSED when transaction is paused
In reply to Greg Kroah-HartmanFrom: Ilpo Järvinen <[email protected]>
commit 8cda3ececf07d374774f6a13e5a94bc2dc04c26c upstream.
pl330_pause() does not set anything to indicate paused condition which causes pl330_tx_status() to return DMA_IN_PROGRESS. This breaks 8250 DMA flush after the fix in commit 57e9af7831dc ("serial: 8250_dma: Fix DMA Rx rearm race"). The function comment for pl330_pause() claims pause is supported but resume is not which is enough for 8250 DMA flush to work as long as DMA status reports DMA_PAUSED when appropriate.
Add PAUSED state for descriptor and mark BUSY descriptors with PAUSED in pl330_pause(). Return DMA_PAUSED from pl330_tx_status() when the descriptor is PAUSED.
--- drivers/dma/pl330.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
drivers/dma/pl330.c +16 -2
@@ -404,6 +404,12 @@ enum desc_status {*/ BUSY ,/* +* Pause was called while descriptor was BUSY. Due to hardware +* limitations, only termination is possible for descriptors +* that have been paused. +*/ + PAUSED, +/* * Sitting on the channel work_list but xfer done * by PL330 core */
@@ -2041,7 +2047,7 @@ static inline void fill_queue(struct dmalist_for_each_entry (desc, &pch->work_list, node) {/* If already submitted */ -if (desc->status ==BUSY ) +if (desc->status ==BUSY || desc->status ==PAUSED )continue ; ret =pl330_submit_req (pch->thread, desc);
@@ -2326,6 +2332,7 @@ static int pl330_pause(struct dma_chan * {struct dma_pl330_chan *pch =to_pchan (chan);struct pl330_dmac *pl330 = pch->dmac; +struct dma_pl330_desc *desc;unsigned long flags;pm_runtime_get_sync (pl330->ddma.dev);
@@ -2335,6 +2342,10 @@ static int pl330_pause(struct dma_chan *_stop (pch->thread);spin_unlock (&pl330->lock); +list_for_each_entry (desc, &pch->work_list, node) { +if (desc->status ==BUSY ) + desc->status =PAUSED ; + }spin_unlock_irqrestore (&pch->lock, flags);pm_runtime_mark_last_busy (pl330->ddma.dev);pm_runtime_put_autosuspend (pl330->ddma.dev);
@@ -2425,7 +2436,7 @@ pl330_tx_status(struct dma_chan *chan, delse if (running && desc == running) transferred =pl330_get_current_xferred_count (pch, desc); -else if (desc->status ==BUSY ) +else if (desc->status ==BUSY || desc->status ==PAUSED )/* * Busy but not running means either just enqueued, * or finished and not yet marked done
@@ -2442,6 +2453,9 @@ pl330_tx_status(struct dma_chan *chan, dcase DONE : ret =DMA_COMPLETE ;break ; +case PAUSED : + ret =DMA_PAUSED ; +break ;case PREP :case BUSY : ret =DMA_IN_PROGRESS ;
Greg Kroah-Hartman
maintainerPATCH 21/206 dmaengine: xilinx: xdma: Fix interrupt vector setting
In reply to Greg Kroah-HartmanFrom: Miquel Raynal <[email protected]>
commit 96891e90d1256b569b1c183e7c9a0cfc568fa3b0 upstream.
A couple of hardware registers need to be set to reflect which interrupts have been allocated to the device. Each register is 32-bit wide and can receive four 8-bit values. If we provide any other interrupt number than four, the irq_num variable will never be 0 within the while check and the while block will loop forever.
There is an easy way to prevent this: just break the for loop when we reach "irq_num == 0", which anyway means all interrupts have been processed.
--- drivers/dma/xilinx/xdma.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/dma/xilinx/xdma.c +2 -0
@@ -668,6 +668,8 @@ static int xdma_set_vector_reg(struct xdma_device *xdev, u32 vec_tbl_start, val |= irq_start << shift; irq_start++; irq_num--; +if (!irq_num) +break ; }/* write IRQ register */
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 22/206 net: mana: Fix MANA VF unload when hardware is unresponsive
In reply to Greg Kroah-HartmanFrom: Souradeep Chakrabarti <[email protected]>
commit a7dfeda6fdeccab4c7c3dce9a72c4262b9530c80 upstream.
When unloading the MANA driver, mana_dealloc_queues() waits for the MANA hardware to complete any inflight packets and set the pending send count to zero. But if the hardware has failed, mana_dealloc_queues() could wait forever.
Fix this by adding a timeout to the wait. Set the timeout to 120 seconds, which is a somewhat arbitrary value that is more than long enough for functional hardware to complete any sends.
--- drivers/net/ethernet/microsoft/mana/mana_en.c | 37 +++++++++++++++++++++++--- 1 file changed, 33 insertions(+), 4 deletions(-)
drivers/net/ethernet/microsoft/mana/mana_en.c +33 -4
@@ -8,6 +8,7 @@#include <linux/ethtool.h> #include <linux/filter.h> #include <linux/mm.h> +#include <linux/pci.h> #include <net/checksum.h> #include <net/ip6_checksum.h>
@@ -2328,9 +2329,12 @@ int mana_attach(struct net_device *ndev)static int mana_dealloc_queues (struct net_device *ndev) {struct mana_port_context *apc =netdev_priv (ndev); +unsigned long timeout = jiffies +120 *HZ ;struct gdma_dev *gd = apc->ac->gdma_dev;struct mana_txq *txq; +struct sk_buff *skb;int i, err; +u32 tsleep;if (apc->port_is_up)return -EINVAL ;
@@ -2346,15 +2350,40 @@ static int mana_dealloc_queues(struct ne* to false, but it doesn't matter since mana_start_xmit() drops any * new packets due to apc->port_is_up being false. * -* Drain all the in-flight TX packets +* Drain all the in-flight TX packets. +* A timeout of 120 seconds for all the queues is used. +* This will break the while loop when h/w is not responding. +* This value of 120 has been decided here considering max +* number of queues. */ +for (i =0 ; i < apc->num_queues; i++) { txq = &apc->tx_qp[i].txq; - -while (atomic_read (&txq->pending_sends) >0 ) -usleep_range (1000 ,2000 ); + tsleep =1000 ; +while (atomic_read (&txq->pending_sends) >0 && +time_before (jiffies, timeout)) { +usleep_range (tsleep, tsleep +1000 ); + tsleep <<=1 ; + } +if (atomic_read (&txq->pending_sends)) { + err =pcie_flr (to_pci_dev (gd->gdma_context->dev)); +if (err) { +netdev_err (ndev,"flr failed %d with %d pkts pending in txq %u\n" , + err,atomic_read (&txq->pending_sends), + txq->gdma_txq_id); + } +break ; + } } +for (i =0 ; i < apc->num_queues; i++) { + txq = &apc->tx_qp[i].txq; +while ((skb =skb_dequeue (&txq->pending_skbs))) { +mana_unmap_skb (skb, apc); +dev_kfree_skb_any (skb); + } +atomic_set (&txq->pending_sends,0 ); + }/* We're 100% sure the queues can no longer be woken up, because * we're sure now mana_poll_tx_cq() can't be running. */
Greg Kroah-Hartman
maintainerPATCH 23/206 ACPI: resource: revert "Remove "Zen" specific match and quirks"
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 2d331a6ac4815e2e2fe5f2d80d908566e57797cc upstream.
Commit a9c4a912b7dc ("ACPI: resource: Remove "Zen" specific match and quirks") is causing keyboard problems for quite a log of AMD based laptop users, leading to many bug reports.
Revert this change for now, until we can come up with a better fix for the PS/2 IRQ trigger-type/polarity problems on some x86 laptops.
--- drivers/acpi/resource.c | 60 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+)
drivers/acpi/resource.c +60 -0
@@ -470,6 +470,52 @@ static const struct dmi_system_id asus_laptop[] = { { } }; +static const struct dmi_system_id lenovo_laptop[] = { + { + .ident ="LENOVO IdeaPad Flex 5 14ALC7" , + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"82R9" ), + }, + }, + { + .ident ="LENOVO IdeaPad Flex 5 16ALC7" , + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"82RA" ), + }, + }, + { } +}; + +static const struct dmi_system_id tongfang_gm_rg[] = { + { + .ident ="TongFang GMxRGxx/XMG CORE 15 (M22)/TUXEDO Stellaris 15 Gen4 AMD" , + .matches = { +DMI_MATCH (DMI_BOARD_NAME ,"GMxRGxx" ), + }, + }, + { } +}; + +static const struct dmi_system_id maingear_laptop[] = { + { + .ident ="MAINGEAR Vector Pro 2 15" , + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Micro Electronics Inc" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"MG-VCP2-15A3070T" ), + } + }, + { + .ident ="MAINGEAR Vector Pro 2 17" , + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Micro Electronics Inc" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"MG-VCP2-17A3070T" ), + }, + }, + { } +}; +static const struct dmi_system_id lg_laptop[] = { { .ident ="LG Electronics 17U70P" ,
@@ -493,6 +539,10 @@ struct irq_override_cmp {static const struct irq_override_cmp override_table[] = { { medion_laptop,1 ,ACPI_LEVEL_SENSITIVE ,ACPI_ACTIVE_LOW ,0 , false }, { asus_laptop,1 ,ACPI_LEVEL_SENSITIVE ,ACPI_ACTIVE_LOW ,0 , false }, + { lenovo_laptop,6 ,ACPI_LEVEL_SENSITIVE ,ACPI_ACTIVE_LOW ,0 , true }, + { lenovo_laptop,10 ,ACPI_LEVEL_SENSITIVE ,ACPI_ACTIVE_LOW ,0 , true }, + { tongfang_gm_rg,1 ,ACPI_EDGE_SENSITIVE ,ACPI_ACTIVE_LOW ,1 , true }, + { maingear_laptop,1 ,ACPI_EDGE_SENSITIVE ,ACPI_ACTIVE_LOW ,1 , true }, { lg_laptop,1 ,ACPI_LEVEL_SENSITIVE ,ACPI_ACTIVE_LOW ,0 , false }, };
@@ -512,6 +562,16 @@ static bool acpi_dev_irq_override(u32 gsi, u8 triggering, u8 polarity,return entry->override; } +#ifdef CONFIG_X86 +/* +* IRQ override isn't needed on modern AMD Zen systems and +* this override breaks active low IRQs on AMD Ryzen 6000 and +* newer systems. Skip it. +*/ +if (boot_cpu_has (X86_FEATURE_ZEN )) +return false; +#endif +return true; }
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 24/206 ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 9728ac221160c5ea111879125a7694bb81364720 upstream.
All the cases, were the DSDT IRQ settings should be used instead of the MADT override, are for IRQ 1 or 12, the PS/2 kbd resp. mouse IRQs.
Simplify things by always honering the override for other legacy IRQs (for non DMI quirked cases).
This allows removing the DMI quirks to honor the override for some non i8042 IRQs on some AMD ZEN based Lenovo models.
--- drivers/acpi/resource.c | 28 ++++++++-------------------- 1 file changed, 8 insertions(+), 20 deletions(-)
drivers/acpi/resource.c +8 -20
@@ -470,24 +470,6 @@ static const struct dmi_system_id asus_l { } }; -static const struct dmi_system_id lenovo_laptop[] = { - { - .ident ="LENOVO IdeaPad Flex 5 14ALC7" , - .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"82R9" ), - }, - }, - { - .ident ="LENOVO IdeaPad Flex 5 16ALC7" , - .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), -DMI_MATCH (DMI_PRODUCT_NAME ,"82RA" ), - }, - }, - { } -}; -static const struct dmi_system_id tongfang_gm_rg[] = { { .ident ="TongFang GMxRGxx/XMG CORE 15 (M22)/TUXEDO Stellaris 15 Gen4 AMD" ,
@@ -539,8 +521,6 @@ struct irq_override_cmp {static const struct irq_override_cmp override_table[] = { { medion_laptop,1 ,ACPI_LEVEL_SENSITIVE ,ACPI_ACTIVE_LOW ,0 , false }, { asus_laptop,1 ,ACPI_LEVEL_SENSITIVE ,ACPI_ACTIVE_LOW ,0 , false }, - { lenovo_laptop,6 ,ACPI_LEVEL_SENSITIVE ,ACPI_ACTIVE_LOW ,0 , true }, - { lenovo_laptop,10 ,ACPI_LEVEL_SENSITIVE ,ACPI_ACTIVE_LOW ,0 , true }, { tongfang_gm_rg,1 ,ACPI_EDGE_SENSITIVE ,ACPI_ACTIVE_LOW ,1 , true }, { maingear_laptop,1 ,ACPI_EDGE_SENSITIVE ,ACPI_ACTIVE_LOW ,1 , true }, { lg_laptop,1 ,ACPI_LEVEL_SENSITIVE ,ACPI_ACTIVE_LOW ,0 , false },
@@ -564,6 +544,14 @@ static bool acpi_dev_irq_override(u32 gs#ifdef CONFIG_X86 /* +* Always use the MADT override info, except for the i8042 PS/2 ctrl +* IRQs (1 and 12). For these the DSDT IRQ settings should sometimes +* be used otherwise PS/2 keyboards / mice will not work. +*/ +if (gsi !=1 && gsi !=12 ) +return true; + +/* * IRQ override isn't needed on modern AMD Zen systems and * this override breaks active low IRQs on AMD Ryzen 6000 and * newer systems. Skip it.
Greg Kroah-Hartman
maintainerPATCH 25/206 ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit c6a1fd910d1bf8a0e3db7aebb229e3c81bc305c4 upstream.
On AMD Zen acpi_dev_irq_override() by default prefers the DSDT IRQ 1 settings over the MADT settings.
This causes the keyboard to malfunction on some laptop models (see Links), all models from the Links have an INT_SRC_OVR MADT entry for IRQ 1.
--- arch/x86/include/asm/acpi.h | 2 ++ arch/x86/kernel/acpi/boot.c | 4 ++++ drivers/acpi/resource.c | 4 ++++ 3 files changed, 10 insertions(+)
arch/x86/include/asm/acpi.h +2 -0
@@ -15,6 +15,7 @@#include <asm/mpspec.h> #include <asm/x86_init.h> #include <asm/cpufeature.h> +#include <asm/irq_vectors.h> #ifdef CONFIG_ACPI_APEI # include <asm/pgtable_types.h>
@@ -31,6 +32,7 @@ extern int acpi_skip_timer_override;extern int acpi_use_timer_override;extern int acpi_fix_pin2_polarity;extern int acpi_disable_cmcff; +extern bool acpi_int_src_ovr[NR_IRQS_LEGACY ];extern u8 acpi_sci_flags;extern u32 acpi_sci_override_gsi;
arch/x86/kernel/acpi/boot.c +4 -0
@@ -52,6 +52,7 @@ int acpi_lapic;int acpi_ioapic;int acpi_strict;int acpi_disable_cmcff; +bool acpi_int_src_ovr[NR_IRQS_LEGACY ];/* ACPI SCI override configuration */ u8 acpi_sci_flags__initdata ;
@@ -588,6 +589,9 @@ acpi_parse_int_src_ovr(union acpi_subtable_headers * header,acpi_table_print_madt_entry (&header->common); +if (intsrc->source_irq <NR_IRQS_LEGACY ) + acpi_int_src_ovr[intsrc->source_irq] = true; +if (intsrc->source_irq == acpi_gbl_FADT.sci_interrupt) { acpi_sci_ioapic_setup(intsrc->source_irq, intsrc->inti_flags & ACPI_MADT_POLARITY_MASK,
drivers/acpi/resource.c +4 -0
@@ -551,6 +551,10 @@ static bool acpi_dev_irq_override(u32 gsi, u8 triggering, u8 polarity,if (gsi !=1 && gsi !=12 )return true; +/* If the override comes from an INT_SRC_OVR MADT entry, honor it. */ +if (acpi_int_src_ovr[gsi]) +return true; +/* * IRQ override isn't needed on modern AMD Zen systems and * this override breaks active low IRQs on AMD Ryzen 6000 and
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 26/206 ACPI: resource: Add IRQ override quirk for PCSpecialist Elimina Pro 16 M
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 56fec0051a69ace182ca3fba47be9c13038b4e3f upstream.
The PCSpecialist Elimina Pro 16 M laptop model is a Zen laptop which needs to use the MADT IRQ settings override and which does not have an INT_SRC_OVR entry for IRQ 1 in its MADT.
So this model needs a DMI quirk to enable the MADT IRQ settings override to fix its keyboard not working.
--- drivers/acpi/resource.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/acpi/resource.c +12 -0
@@ -498,6 +498,17 @@ static const struct dmi_system_id maingear_laptop[] = { { } }; +static const struct dmi_system_id pcspecialist_laptop[] = { + { + .ident ="PCSpecialist Elimina Pro 16 M" , + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"PCSpecialist" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Elimina Pro 16 M" ), + }, + }, + { } +}; +static const struct dmi_system_id lg_laptop[] = { { .ident ="LG Electronics 17U70P" ,
@@ -523,6 +534,7 @@ static const struct irq_override_cmp override_table[] = { { asus_laptop, 1, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, false }, { tongfang_gm_rg, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true }, { maingear_laptop, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true }, + { pcspecialist_laptop, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true }, { lg_laptop, 1, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, false }, };
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 27/206 zram: take device and not only bvec offset into account
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
commit 95848dcb9d676738411a8ff70a9704039f1b3982 upstream.
Commit af8b04c63708 ("zram: simplify bvec iteration in __zram_make_request") changed the bio iteration in zram to rely on the implicit capping to page boundaries in bio_for_each_segment. But it failed to care for the fact zram not only care about the page alignment of the bio payload, but also the page alignment into the device. For buffered I/O and swap those are the same, but for direct I/O or kernel internal I/O like XFS log buffer writes they can differ.
Fix this by open coding bio_for_each_segment and limiting the bvec len so that it never crosses over a page alignment boundary in the device in addition to the payload boundary already taken care of by bio_iter_iovec.
--- drivers/block/zram/zram_drv.c | 32 ++++++++++++++++++++------------ 1 file changed, 20 insertions(+), 12 deletions(-)
drivers/block/zram/zram_drv.c +20 -12
@@ -1870,15 +1870,16 @@ static void zram_bio_discard(struct zramstatic void zram_bio_read (struct zram *zram,struct bio *bio) { -struct bvec_iter iter; -struct bio_vec bv; -unsigned long start_time; +unsigned long start_time =bio_start_io_acct (bio); +struct bvec_iter iter = bio->bi_iter; - start_time =bio_start_io_acct (bio); -bio_for_each_segment (bv, bio, iter) { + do { u32 index = iter.bi_sector >> SECTORS_PER_PAGE_SHIFT; u32 offset = (iter.bi_sector & (SECTORS_PER_PAGE - 1)) << SECTOR_SHIFT; + struct bio_vec bv = bio_iter_iovec(bio, iter); + + bv.bv_len = min_t(u32, bv.bv_len, PAGE_SIZE - offset); if (zram_bvec_read(zram, &bv, index, offset, bio) < 0) { atomic64_inc(&zram->stats.failed_reads);
@@ -1890,22 +1891,26 @@ static void zram_bio_read(struct zram *zzram_slot_lock (zram, index);zram_accessed (zram, index);zram_slot_unlock (zram, index); - } + +bio_advance_iter_single (bio, &iter, bv.bv_len); + }while (iter.bi_size); +bio_end_io_acct (bio, start_time);bio_endio (bio); }static void zram_bio_write (struct zram *zram,struct bio *bio) { -struct bvec_iter iter; -struct bio_vec bv; -unsigned long start_time; +unsigned long start_time =bio_start_io_acct (bio); +struct bvec_iter iter = bio->bi_iter; - start_time =bio_start_io_acct (bio); -bio_for_each_segment (bv, bio, iter) { + do { u32 index = iter.bi_sector >> SECTORS_PER_PAGE_SHIFT; u32 offset = (iter.bi_sector & (SECTORS_PER_PAGE - 1)) << SECTOR_SHIFT; + struct bio_vec bv = bio_iter_iovec(bio, iter); + + bv.bv_len = min_t(u32, bv.bv_len, PAGE_SIZE - offset); if (zram_bvec_write(zram, &bv, index, offset, bio) < 0) { atomic64_inc(&zram->stats.failed_writes);
@@ -1916,7 +1921,10 @@ static void zram_bio_write(struct zram *zram_slot_lock (zram, index);zram_accessed (zram, index);zram_slot_unlock (zram, index); - } + +bio_advance_iter_single (bio, &iter, bv.bv_len); + }while (iter.bi_size); +bio_end_io_acct (bio, start_time);bio_endio (bio); }
Greg Kroah-Hartman
maintainerPATCH 28/206 io_uring/parisc: Adjust pgoff in io_uring mmap() for parisc
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
commit 56675f8b9f9b15b024b8e3145fa289b004916ab7 upstream.
The changes from commit 32832a407a71 ("io_uring: Fix io_uring mmap() by using architecture-provided get_unmapped_area()") to the parisc implementation of get_unmapped_area() broke glibc's locale-gen executable when running on parisc.
This patch reverts those architecture-specific changes, and instead adjusts in io_uring_mmu_get_unmapped_area() the pgoff offset which is then given to parisc's get_unmapped_area() function. This is much cleaner than the previous approach, and we still will get a coherent addresss.
This patch has no effect on other architectures (SHM_COLOUR is only defined on parisc), and the liburing testcase stil passes on parisc.
--- arch/parisc/kernel/sys_parisc.c | 15 +++++---------- io_uring/io_uring.c | 3 +++ 2 files changed, 8 insertions(+), 10 deletions(-)
arch/parisc/kernel/sys_parisc.c +5 -10
@@ -26,17 +26,12 @@#include <linux/compat.h> /* -* Construct an artificial page offset for the mapping based on the virtual +* Construct an artificial page offset for the mapping based on the physical * address of the kernel file mapping variable. -* If filp is zero the calculated pgoff value aliases the memory of the given -* address. This is useful for io_uring where the mapping shall alias a kernel -* address and a userspace adress where both the kernel and the userspace -* access the same memory region. */ -#define GET_FILP_PGOFF (filp, addr) \ - ((filp ? (((unsigned long) filp->f_mapping) >> 8) \ - & ((SHM_COLOUR-1) >> PAGE_SHIFT) : 0UL) \ - + (addr >> PAGE_SHIFT)) +#define GET_FILP_PGOFF (filp) \ + (filp ? (((unsigned long) filp->f_mapping) >> 8) \ + & ((SHM_COLOUR-1) >> PAGE_SHIFT) : 0UL)static unsigned long shared_align_offset (unsigned long filp_pgoff,unsigned long pgoff)
@@ -116,7 +111,7 @@ static unsigned long arch_get_unmapped_a do_color_align =0 ;if (filp || (flags &MAP_SHARED )) do_color_align =1 ; - filp_pgoff =GET_FILP_PGOFF (filp, addr); + filp_pgoff =GET_FILP_PGOFF (filp);if (flags &MAP_FIXED ) {/* Even MAP_FIXED mappings must reside within TASK_SIZE */
io_uring/io_uring.c +3 -0
@@ -3466,6 +3466,8 @@ static unsigned long io_uring_mmu_get_un* - use the kernel virtual address of the shared io_uring context * (instead of the userspace-provided address, which has to be 0UL * anyway). +* - use the same pgoff which the get_unmapped_area() uses to +* calculate the page colouring. * For architectures without such aliasing requirements, the * architecture will return any suitable mapping because addr is 0. */
@@ -3474,6 +3476,7 @@ static unsigned long io_uring_mmu_get_un pgoff =0 ;/* has been translated to ptr above */ #ifdef SHM_COLOUR addr = (uintptr_t ) ptr; + pgoff = addr >>PAGE_SHIFT ;#else addr =0UL ;#endif
Re: [PATCH 6.4 028/206] io_uring/parisc: Adjust pgoff in io_uring mmap() for parisc
Greg Kroah-Hartman wrote...
Quoted 3 lines
From: Helge Deller <[email protected]>
commit
56675f8b9f9b15b024b8e3145fa289b004916ab7upstream.
(...)
Quoted 2 lines
This patch has no effect on other architectures (
SHM_COLOURis only defined on parisc), and the liburing testcase stil passes on parisc.
Confirmed: Both issues reported to linux-parisc earlier are fixed now.
Christoph (very busy fighting time thieves)
Greg Kroah-Hartman
maintainerPATCH 29/206 parisc: Fix lightweight spinlock checks to not break futexes
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
commit a0f4b7879f2e14986200747d1b545e5daac8c624 upstream.
The lightweight spinlock checks verify that a spinlock has either value 0 (spinlock locked) and that not any other bits than in __ARCH_SPIN_LOCK_UNLOCKED_VAL is set.
This breaks the current LWS code, which writes the address of the lock into the lock word to unlock it, which was an optimization to save one assembler instruction.
Fix it by making spinlock_types.h accessible for asm code, change the LWS spinlock-unlocking code to write __ARCH_SPIN_LOCK_UNLOCKED_VAL into the lock word, and add some missing lightweight spinlock checks to the LWS path. Finally, make the spinlock checks dependend on DEBUG_KERNEL.
--- arch/parisc/Kconfig.debug | 2 +- arch/parisc/include/asm/spinlock.h | 2 -- arch/parisc/include/asm/spinlock_types.h | 6 ++++++ arch/parisc/kernel/syscall.S | 23 ++++++++++++++++++++--- 4 files changed, 27 insertions(+), 6 deletions(-)
arch/parisc/Kconfig.debug +1 -1
@@ -2,7 +2,7 @@ # config LIGHTWEIGHT_SPINLOCK_CHECK bool "Enable lightweight spinlock checks" - depends on SMP && !DEBUG_SPINLOCK + depends on DEBUG_KERNEL && SMP && !DEBUG_SPINLOCK default y help Add checks with low performance impact to the spinlock functions
arch/parisc/include/asm/spinlock.h +0 -2
@@ -7,8 +7,6 @@#include <asm/processor.h> #include <asm/spinlock_types.h> -#define SPINLOCK_BREAK_INSN 0x0000c006/* break 6,6 */ -static inline void arch_spin_val_check (int lock_val) {if (IS_ENABLED (CONFIG_LIGHTWEIGHT_SPINLOCK_CHECK ))
arch/parisc/include/asm/spinlock_types.h +6 -0
@@ -4,6 +4,10 @@#define __ARCH_SPIN_LOCK_UNLOCKED_VAL 0x1a46 +#define SPINLOCK_BREAK_INSN 0x0000c006/* break 6,6 */ + +#ifndef __ASSEMBLY__ + typedef struct { #ifdef CONFIG_PA20 volatile unsigned int slock;
@@ -27,6 +31,8 @@ typedef struct { volatile unsigned int counter; } arch_rwlock_t; +#endif /* __ASSEMBLY__ */ +#define __ARCH_RW_LOCK_UNLOCKED__ 0x01000000#define __ARCH_RW_LOCK_UNLOCKED { .lock_mutex = __ARCH_SPIN_LOCK_UNLOCKED, \ .counter = __ARCH_RW_LOCK_UNLOCKED__ }
arch/parisc/kernel/syscall.S +20 -3
@@ -39,6 +39,7 @@ registers). #include <asm/assembly.h> #include <asm/processor.h> #include <asm/cache.h> +#include <asm/spinlock_types.h> #include <linux/linkage.h>
@@ -66,6 +67,16 @@ registers). stw \reg1, 0(%sr2,\reg2) .endm + /* raise exception if spinlock content is not zero or + * __ARCH_SPIN_LOCK_UNLOCKED_VAL */ + .macro spinlock_check spin_val,tmpreg +#ifdef CONFIG_LIGHTWEIGHT_SPINLOCK_CHECK + ldi __ARCH_SPIN_LOCK_UNLOCKED_VAL, \tmpreg + andcm,= \spin_val, \tmpreg, %r0 + .word SPINLOCK_BREAK_INSN +#endif + .endm + .text .import syscall_exit,code
@@ -508,7 +519,8 @@ lws_start: lws_exit_noerror: lws_pagefault_enable %r1,%r21 - stw,ma %r20, 0(%sr2,%r20) + ldi __ARCH_SPIN_LOCK_UNLOCKED_VAL, %r21 + stw,ma %r21, 0(%sr2,%r20) ssm PSW_SM_I, %r0 b lws_exit copy %r0, %r21
@@ -521,7 +533,8 @@ lws_wouldblock: lws_pagefault: lws_pagefault_enable %r1,%r21 - stw,ma %r20, 0(%sr2,%r20) + ldi __ARCH_SPIN_LOCK_UNLOCKED_VAL, %r21 + stw,ma %r21, 0(%sr2,%r20) ssm PSW_SM_I, %r0 ldo 3(%r0),%r28 b lws_exit
@@ -619,6 +632,7 @@ lws_compare_and_swap: /* Try to acquire the lock */ LDCW 0(%sr2,%r20), %r28 + spinlock_check %r28, %r21 comclr,<> %r0, %r28, %r0 b,n lws_wouldblock
@@ -772,6 +786,7 @@ cas2_lock_start: /* Try to acquire the lock */ LDCW 0(%sr2,%r20), %r28 + spinlock_check %r28, %r21 comclr,<> %r0, %r28, %r0 b,n lws_wouldblock
@@ -1001,6 +1016,7 @@ atomic_xchg_start: /* Try to acquire the lock */ LDCW 0(%sr2,%r20), %r28 + spinlock_check %r28, %r21 comclr,<> %r0, %r28, %r0 b,n lws_wouldblock
@@ -1199,6 +1215,7 @@ atomic_store_start: /* Try to acquire the lock */ LDCW 0(%sr2,%r20), %r28 + spinlock_check %r28, %r21 comclr,<> %r0, %r28, %r0 b,n lws_wouldblock
@@ -1330,7 +1347,7 @@ ENTRY(lws_lock_start) /* lws locks */ .rept 256 /* Keep locks aligned at 16-bytes */ - .word 1 + .word __ARCH_SPIN_LOCK_UNLOCKED_VAL .word 0 .word 0 .word 0
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 30/206 riscv: Start of DRAM should at least be aligned on PMD size for the direct mapping
In reply to Greg Kroah-HartmanFrom: Alexandre Ghiti <[email protected]>
commit c3bcc65d4d2e8292c435322cbc34c318d06b8b6c upstream.
So that we do not end up mapping the whole linear mapping using 4K pages, which is slow at boot time, and also very likely at runtime.
So make sure we align the start of DRAM on a PMD boundary.
--- arch/riscv/mm/init.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
arch/riscv/mm/init.c +6 -1
@@ -214,8 +214,13 @@ static void __init setup_bootmem(void)memblock_reserve (vmlinux_start, vmlinux_end - vmlinux_start); phys_ram_end =memblock_end_of_DRAM (); + +/* +* Make sure we align the start of the memory on a PMD boundary so that +* at worst, we map the linear mapping with PMD mappings. +*/ if (!IS_ENABLED (CONFIG_XIP_KERNEL )) - phys_ram_base =memblock_start_of_DRAM (); + phys_ram_base =memblock_start_of_DRAM () &PMD_MASK ;/* * In 64-bit, any use of __va/__pa before this point is wrong as we
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 31/206 riscv/kexec: load initrd high in available memory
In reply to Greg Kroah-HartmanFrom: Torsten Duwe <[email protected]>
commit 49af7a2cd5f678217b8b4f86a29411aebebf3e78 upstream.
When initrd is loaded low, the secondary kernel fails like this:
INITRD: 0xdc581000+0x00eef000 overlaps in-use memory region
This initrd load address corresponds to the _end symbol, but the reservation is aligned on PMD_SIZE, as explained by a comment in setup_bootmem().
It is technically possible to align the initrd load address accordingly, leaving a hole between the end of kernel and the initrd, but it is much simpler to allocate the initrd top-down.
--- arch/riscv/kernel/elf_kexec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/riscv/kernel/elf_kexec.c +1 -1
@@ -281,7 +281,7 @@ static void *elf_kexec_load(struct kimag kbuf.buffer = initrd; kbuf.bufsz = kbuf.memsz = initrd_len; kbuf.buf_align =PAGE_SIZE ; - kbuf.top_down = false; + kbuf.top_down = true; kbuf.mem =KEXEC_BUF_MEM_UNKNOWN ; ret =kexec_add_buffer (&kbuf);if (ret)
Greg Kroah-Hartman
maintainerPATCH 32/206 riscv,mmio: Fix readX()-to-delay() ordering
In reply to Greg Kroah-HartmanFrom: Andrea Parri <[email protected]>
commit 4eb2eb1b4c0eb07793c240744843498564a67b83 upstream.
Section 2.1 of the Platform Specification [1] states:
Unless otherwise specified by a given I/O device, I/O devices are on ordering channel 0 (i.e., they are point-to-point strongly ordered).
which is not sufficient to guarantee that a readX() by a hart completes before a subsequent delay() on the same hart (cf. memory-barriers.txt, "Kernel I/O barrier effects").
Set the I(nput) bit in __io_ar() to restore the ordering, align inline comments.
[1] https://github.com/riscv/riscv-platform-specs
--- arch/riscv/include/asm/mmio.h | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
arch/riscv/include/asm/mmio.h +8 -8
@@ -101,9 +101,9 @@ static inline u64 __raw_readq(const vola* Relaxed I/O memory access primitives. These follow the Device memory * ordering rules but do not guarantee any ordering relative to Normal memory * accesses. These are defined to order the indicated access (either a read or -* write) with all other I/O memory accesses. Since the platform specification -* defines that all I/O regions are strongly ordered on channel 2, no explicit -* fences are required to enforce this ordering. +* write) with all other I/O memory accesses to the same peripheral. Since the +* platform specification defines that all I/O regions are strongly ordered on +* channel 0, no explicit fences are required to enforce this ordering. */ /* FIXME: These are now the same as asm-generic */ #define __io_rbr () do {} while (0)
@@ -125,14 +125,14 @@ static inline u64 __raw_readq(const vola#endif /* -* I/O memory access primitives. Reads are ordered relative to any -* following Normal memory access. Writes are ordered relative to any prior -* Normal memory access. The memory barriers here are necessary as RISC-V +* I/O memory access primitives. Reads are ordered relative to any following +* Normal memory read and delay() loop. Writes are ordered relative to any +* prior Normal memory write. The memory barriers here are necessary as RISC-V * doesn't define any ordering between the memory space and the I/O space. */ #define __io_br () do {} while (0) -#define __io_ar (v) __asm__ __volatile__ ("fence i,r" : : : "memory") -#define __io_bw () __asm__ __volatile__ ("fence w,o" : : : "memory") +#define __io_ar (v) ({ __asm__ __volatile__ ("fence i,ir" : : : "memory"); }) +#define __io_bw () ({ __asm__ __volatile__ ("fence w,o" : : : "memory"); })#define __io_aw () mmiowb_set_pending()#define readb (c) ({ u8 __v; __io_br(); __v = readb_cpu(c); __io_ar(__v); __v; })
Greg Kroah-Hartman
maintainerPATCH 33/206 riscv/kexec: handle R_RISCV_CALL_PLT relocation type
In reply to Greg Kroah-HartmanFrom: Torsten Duwe <[email protected]>
commit d0b4f95a51038becce4bdab4789aa7ce59d4ea6e upstream.
R_RISCV_CALL has been deprecated and replaced by R_RISCV_CALL_PLT. See Enum 18-19 in Table 3. Relocation types here:
https://github.com/riscv-non-isa/riscv-elf-psabi-doc/blob/master/riscv-elf.adoc
It was deprecated in ("Deprecated R_RISCV_CALL, prefer R_RISCV_CALL_PLT"):
https://github.com/riscv-non-isa/riscv-elf-psabi-doc/commit/a0dced85018d7a0ec17023c9389cbd70b1dbc1b0
Recent tools (at least GNU binutils-2.40) already use R_RISCV_CALL_PLT. Kernels built with such binutils fail kexec_load_file(2) with:
kexec_image: Unknown rela relocation: 19
kexec_image: Error loading purgatory ret=-8
The binary code at the call site remains the same, so tell arch_kexec_apply_relocations_add() to handle _PLT alike.
--- arch/riscv/kernel/elf_kexec.c | 1 + 1 file changed, 1 insertion(+)
arch/riscv/kernel/elf_kexec.c +1 -0
@@ -425,6 +425,7 @@ int arch_kexec_apply_relocations_add(str* sym, instead of searching the whole relsec. */ case R_RISCV_PCREL_HI20 : +case R_RISCV_CALL_PLT :case R_RISCV_CALL : *(u64 *)loc =CLEAN_IMM (UITYPE , *(u64 *)loc) |ENCODE_UJTYPE_IMM (val - addr);
Greg Kroah-Hartman
maintainerPATCH 34/206 riscv: mm: fix 2 instances of -Wmissing-variable-declarations
In reply to Greg Kroah-HartmanFrom: Nick Desaulniers <[email protected]>
commit d2402048bc8a206a56fde4bc41dd01336c7b5a21 upstream.
I'm looking to enable -Wmissing-variable-declarations behind W=1. 0day bot spotted the following instance in ARCH=riscv builds:
arch/riscv/mm/init.c:276:7: warning: no previous extern declaration for non-static variable 'trampoline_pg_dir' [-Wmissing-variable-declarations]
276 | pgd_t trampoline_pg_dir[PTRS_PER_PGD] __page_aligned_bss;
| ^
arch/riscv/mm/init.c:276:1: note: declare 'static' if the variable is not intended to be used outside of this translation unit
276 | pgd_t trampoline_pg_dir[PTRS_PER_PGD] __page_aligned_bss;
| ^
arch/riscv/mm/init.c:279:7: warning: no previous extern declaration
for non-static variable 'early_pg_dir'
[-Wmissing-variable-declarations]
279 | pgd_t early_pg_dir[PTRS_PER_PGD] __initdata __aligned(PAGE_SIZE);
| ^
arch/riscv/mm/init.c:279:1: note: declare 'static' if the variable is
not intended to be used outside of this translation unit
279 | pgd_t early_pg_dir[PTRS_PER_PGD] __initdata __aligned(PAGE_SIZE);
| ^These symbols are referenced by more than one translation unit, so make sure they're both declared and include the correct header for their declarations. Finally, sort the list of includes to help keep them tidy.
--- arch/riscv/include/asm/pgtable.h | 2 ++ arch/riscv/mm/init.c | 9 +++++---- arch/riscv/mm/kasan_init.c | 1 - 3 files changed, 7 insertions(+), 5 deletions(-)
arch/riscv/include/asm/pgtable.h +2 -0
@@ -188,6 +188,8 @@ extern struct pt_alloc_ops pt_ops __init#define PAGE_KERNEL_IO __pgprot(_PAGE_IOREMAP)extern pgd_t swapper_pg_dir[]; +extern pgd_t trampoline_pg_dir[]; +extern pgd_t early_pg_dir[];#ifdef CONFIG_TRANSPARENT_HUGEPAGE static inline int pmd_present (pmd_t pmd)
arch/riscv/mm/init.c +5 -4
@@ -26,12 +26,13 @@#include <linux/kfence.h> #include <asm/fixmap.h> -#include <asm/tlbflush.h> -#include <asm/sections.h> -#include <asm/soc.h> #include <asm/io.h> -#include <asm/ptdump.h> #include <asm/numa.h> +#include <asm/pgtable.h> +#include <asm/ptdump.h> +#include <asm/sections.h> +#include <asm/soc.h> +#include <asm/tlbflush.h> #include "../kernel/head.h"
arch/riscv/mm/kasan_init.c +0 -1
@@ -22,7 +22,6 @@* region is not and then we have to go down to the PUD level. */ -extern pgd_t early_pg_dir[PTRS_PER_PGD ]; pgd_t tmp_pg_dir[PTRS_PER_PGD] __page_aligned_bss; p4d_t tmp_p4d[PTRS_PER_P4D] __page_aligned_bss; pud_t tmp_pud[PTRS_PER_PUD] __page_aligned_bss;
Greg Kroah-Hartman
maintainerPATCH 35/206 nvme: fix possible hang when removing a controller during error recovery
In reply to Greg Kroah-HartmanFrom: Ming Lei <[email protected]>
commit 1b95e817916069ec45a7f259d088fd1c091a8cc6 upstream.
Error recovery can be interrupted by controller removal, then the controller is left as quiesced, and IO hang can be caused.
Fix the issue by unquiescing controller unconditionally when removing namespaces.
This way is reasonable and safe given forward progress can be made when removing namespaces.
--- drivers/nvme/host/core.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/nvme/host/core.c +7 -3
@@ -4728,6 +4728,12 @@ void nvme_remove_namespaces(struct nvme_*/ nvme_mpath_clear_ctrl_paths (ctrl); +/* +* Unquiesce io queues so any pending IO won't hang, especially +* those submitted from scan work +*/ +nvme_unquiesce_io_queues (ctrl); +/* prevent racing with ns scanning */ flush_work (&ctrl->scan_work);
@@ -4737,10 +4743,8 @@ void nvme_remove_namespaces(struct nvme_* removing the namespaces' disks; fail all the queues now to avoid * potentially having to clean up the failed sync later. */ -if (ctrl->state ==NVME_CTRL_DEAD ) { +if (ctrl->state ==NVME_CTRL_DEAD )nvme_mark_namespaces_dead (ctrl); -nvme_unquiesce_io_queues (ctrl); - }/* this is a no-op when called from the controller reset handler */ nvme_change_ctrl_state (ctrl,NVME_CTRL_DELETING_NOIO );
Greg Kroah-Hartman
maintainerPATCH 36/206 nvme-tcp: fix potential unbalanced freeze & unfreeze
In reply to Greg Kroah-HartmanFrom: Ming Lei <[email protected]>
commit 99dc264014d5aed66ee37ddf136a38b5a2b1b529 upstream.
Move start_freeze into nvme_tcp_configure_io_queues(), and there is at least two benefits:
1) fix unbalanced freeze and unfreeze, since re-connection work may fail or be broken by removal
2) IO during error recovery can be failfast quickly because nvme fabrics unquiesces queues after teardown.
One side-effect is that !mpath request may timeout during connecting because of queue topo change, but that looks not one big deal:
1) same problem exists with current code base
2) compared with !mpath, mpath use case is dominant
--- drivers/nvme/host/tcp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/nvme/host/tcp.c +2 -1
@@ -1909,6 +1909,7 @@ static int nvme_tcp_configure_io_queues( goto out_cleanup_connect_q;if (!new) { +nvme_start_freeze (ctrl);nvme_unquiesce_io_queues (ctrl);if (!nvme_wait_freeze_timeout (ctrl,NVME_IO_TIMEOUT )) {/*
@@ -1917,6 +1918,7 @@ static int nvme_tcp_configure_io_queues(* to be safe. */ ret = -ENODEV ; +nvme_unfreeze (ctrl); goto out_wait_freeze_timed_out; } blk_mq_update_nr_hw_queues(ctrl->tagset,
@@ -2021,7 +2023,6 @@ static void nvme_tcp_teardown_io_queues(if (ctrl->queue_count <=1 )return ;nvme_quiesce_admin_queue (ctrl); -nvme_start_freeze (ctrl);nvme_quiesce_io_queues (ctrl);nvme_sync_io_queues (ctrl);nvme_tcp_stop_io_queues (ctrl);
Greg Kroah-Hartman
maintainerPATCH 37/206 nvme-rdma: fix potential unbalanced freeze & unfreeze
In reply to Greg Kroah-HartmanFrom: Ming Lei <[email protected]>
commit 29b434d1e49252b3ad56ad3197e47fafff5356a1 upstream.
Move start_freeze into nvme_rdma_configure_io_queues(), and there is at least two benefits:
1) fix unbalanced freeze and unfreeze, since re-connection work may fail or be broken by removal
2) IO during error recovery can be failfast quickly because nvme fabrics unquiesces queues after teardown.
One side-effect is that !mpath request may timeout during connecting because of queue topo change, but that looks not one big deal:
1) same problem exists with current code base
2) compared with !mpath, mpath use case is dominant
--- drivers/nvme/host/rdma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/nvme/host/rdma.c +2 -1
@@ -918,6 +918,7 @@ static int nvme_rdma_configure_io_queues goto out_cleanup_tagset;if (!new) { +nvme_start_freeze (&ctrl->ctrl);nvme_unquiesce_io_queues (&ctrl->ctrl);if (!nvme_wait_freeze_timeout (&ctrl->ctrl,NVME_IO_TIMEOUT )) {/*
@@ -926,6 +927,7 @@ static int nvme_rdma_configure_io_queues* to be safe. */ ret = -ENODEV ; +nvme_unfreeze (&ctrl->ctrl); goto out_wait_freeze_timed_out; } blk_mq_update_nr_hw_queues(ctrl->ctrl.tagset,
@@ -975,7 +977,6 @@ static void nvme_rdma_teardown_io_queues bool remove) {if (ctrl->ctrl.queue_count >1 ) { -nvme_start_freeze (&ctrl->ctrl);nvme_quiesce_io_queues (&ctrl->ctrl);nvme_sync_io_queues (&ctrl->ctrl);nvme_rdma_stop_io_queues (ctrl);
Greg Kroah-Hartman
maintainerPATCH 38/206 nvme-pci: add NVME_QUIRK_BOGUS_NID for Samsung PM9B1 256G and 512G
In reply to Greg Kroah-HartmanFrom: August Wikerfors <[email protected]>
commit 688b419c57c13637d95d7879e165fff3dec581eb upstream.
The Samsung PM9B1 512G SSD found in some Lenovo Yoga 7 14ARB7 laptop units reports eui as 0001000200030004 when resuming from s2idle, causing the device to be removed with this error in dmesg:
nvme nvme0: identifiers changed for nsid 1
To fix this, add a quirk to ignore namespace identifiers for this device.
--- drivers/nvme/host/pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/nvme/host/pci.c +2 -1
@@ -3391,7 +3391,8 @@ static const struct pci_device_id nvme_i { PCI_DEVICE(0x1d97, 0x2263), /* SPCC */ .driver_data = NVME_QUIRK_DISABLE_WRITE_ZEROES, }, { PCI_DEVICE(0x144d, 0xa80b), /* Samsung PM9B1 256G and 512G */ - .driver_data = NVME_QUIRK_DISABLE_WRITE_ZEROES, }, + .driver_data = NVME_QUIRK_DISABLE_WRITE_ZEROES | + NVME_QUIRK_BOGUS_NID, }, { PCI_DEVICE(0x144d, 0xa809), /* Samsung MZALQ256HBJD 256G */ .driver_data = NVME_QUIRK_DISABLE_WRITE_ZEROES, }, { PCI_DEVICE(0x1cc4, 0x6303), /* UMIS RPJTJ512MGE1QDY 512G */
Greg Kroah-Hartman
maintainerPATCH 39/206 drm/nouveau/gr: enable memory loads on helper invocation on all channels
In reply to Greg Kroah-HartmanFrom: Karol Herbst <[email protected]>
commit 1cb9e2ef66d53b020842b18762e30d0eb4384de8 upstream.
We have a lurking bug where Fragment Shader Helper Invocations can't load from memory. But this is actually required in OpenGL and is causing random hangs or failures in random shaders.
It is unknown how widespread this issue is, but shaders hitting this can end up with infinite loops.
We enable those only on all Kepler and newer GPUs where we use our own Firmware.
Nvidia's firmware provides a way to set a kernelspace controlled list of mmio registers in the gr space from push buffers via MME macros.
v2: drop code for gm200 and newer.
--- drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.h | 1 + drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c | 4 +++- drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110.c | 10 ++++++++++ drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110b.c | 1 + drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk208.c | 1 + drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c | 1 + 6 files changed, 17 insertions(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgf100.h +1 -0
@@ -117,6 +117,7 @@ void gk104_grctx_generate_r418800(structextern const struct gf100_grctx_func gk110_grctx;void gk110_grctx_generate_r419eb0 (struct gf100_gr *); +void gk110_grctx_generate_r419f78 (struct gf100_gr *);extern const struct gf100_grctx_func gk110b_grctx;extern const struct gf100_grctx_func gk208_grctx;
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk104.c +3 -1
@@ -906,7 +906,9 @@ static void gk104_grctx_generate_r419f78(struct gf100_gr *gr) {struct nvkm_device *device = gr->base.engine.subdev.device; -nvkm_mask (device,0x419f78 ,0x00000001 ,0x00000000 ); + +/* bit 3 set disables loads in fp helper invocations, we need it enabled */ +nvkm_mask (device,0x419f78 ,0x00000009 ,0x00000000 ); }void
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110.c +10 -0
@@ -820,6 +820,15 @@ gk110_grctx_generate_r419eb0(struct gf10nvkm_mask (device,0x419eb0 ,0x00001000 ,0x00001000 ); } +void +gk110_grctx_generate_r419f78 (struct gf100_gr *gr) +{ +struct nvkm_device *device = gr->base.engine.subdev.device; + +/* bit 3 set disables loads in fp helper invocations, we need it enabled */ +nvkm_mask (device,0x419f78 ,0x00000008 ,0x00000000 ); +} +const struct gf100_grctx_func gk110_grctx = { .main = gf100_grctx_generate_main,
@@ -854,4 +863,5 @@ gk110_grctx = { .gpc_tpc_nr = gk104_grctx_generate_gpc_tpc_nr, .r418800 = gk104_grctx_generate_r418800, .r419eb0 = gk110_grctx_generate_r419eb0, + .r419f78 = gk110_grctx_generate_r419f78, };
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk110b.c +1 -0
@@ -103,4 +103,5 @@ gk110b_grctx = { .gpc_tpc_nr = gk104_grctx_generate_gpc_tpc_nr, .r418800 = gk104_grctx_generate_r418800, .r419eb0 = gk110_grctx_generate_r419eb0, + .r419f78 = gk110_grctx_generate_r419f78, };
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgk208.c +1 -0
@@ -568,4 +568,5 @@ gk208_grctx = { .dist_skip_table = gf117_grctx_generate_dist_skip_table, .gpc_tpc_nr = gk104_grctx_generate_gpc_tpc_nr, .r418800 = gk104_grctx_generate_r418800, + .r419f78 = gk110_grctx_generate_r419f78, };
drivers/gpu/drm/nouveau/nvkm/engine/gr/ctxgm107.c +1 -0
@@ -988,4 +988,5 @@ gm107_grctx = { .r406500 = gm107_grctx_generate_r406500, .gpc_tpc_nr = gk104_grctx_generate_gpc_tpc_nr, .r419e00 = gm107_grctx_generate_r419e00, + .r419f78 = gk110_grctx_generate_r419f78, };
Greg Kroah-Hartman
maintainerPATCH 40/206 drm/nouveau/nvkm/dp: Add workaround to fix DP 1.3+ DPCD issues
In reply to Greg Kroah-HartmanFrom: Lyude Paul <[email protected]>
commit e4060dad253352382b20420d8ef98daab24dbc17 upstream.
Currently we use the drm_dp_dpcd_read_caps() helper in the DRM side of nouveau in order to read the DPCD of a DP connector, which makes sure we do the right thing and also check for extended DPCD caps. However, it turns out we're not currently doing this on the nvkm side since we don't have access to the drm_dp_aux structure there - which means that the DRM side of the driver and the NVKM side can end up with different DPCD capabilities for the same connector.
Ideally in order to fix this, we just want to use the drm_dp_read_dpcd_caps() helper in nouveau. That's not currently possible though, and is going to depend on having a bunch of the DP code moved out of nvkm and into the DRM side of things as part of the GSP enablement work.
Until then however, let's workaround this problem by porting a copy of drm_dp_read_dpcd_caps() into NVKM - which should fix this issue.
--- drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c | 48 +++++++++++++++++++++++++- 1 file changed, 47 insertions(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c +47 -1
@@ -26,6 +26,8 @@#include "head.h" #include "ior.h" +#include <drm/display/drm_dp.h> +#include <subdev/bios.h> #include <subdev/bios/init.h> #include <subdev/gpio.h>
@@ -634,6 +636,50 @@ nvkm_dp_enable_supported_link_rates(strureturn outp->dp.rates !=0 ; } +/* XXX: This is a big fat hack, and this is just drm_dp_read_dpcd_caps() +* converted to work inside nvkm. This is a temporary holdover until we start +* passing the drm_dp_aux device through NVKM +*/ +static int +nvkm_dp_read_dpcd_caps (struct nvkm_outp *outp) +{ +struct nvkm_i2c_aux *aux = outp->dp.aux; +u8 dpcd_ext[DP_RECEIVER_CAP_SIZE ]; +int ret; + + ret =nvkm_rdaux (aux,DPCD_RC00_DPCD_REV , outp->dp.dpcd,DP_RECEIVER_CAP_SIZE ); +if (ret <0 ) +return ret; + +/* +* Prior to DP1.3 the bit represented by +* DP_EXTENDED_RECEIVER_CAP_FIELD_PRESENT was reserved. +* If it is set DP_DPCD_REV at 0000h could be at a value less than +* the true capability of the panel. The only way to check is to +* then compare 0000h and 2200h. +*/ +if (!(outp->dp.dpcd[DP_TRAINING_AUX_RD_INTERVAL ] & +DP_EXTENDED_RECEIVER_CAP_FIELD_PRESENT )) +return 0 ; + + ret =nvkm_rdaux (aux,DP_DP13_DPCD_REV , dpcd_ext,sizeof (dpcd_ext)); +if (ret <0 ) +return ret; + +if (outp->dp.dpcd[DP_DPCD_REV ] > dpcd_ext[DP_DPCD_REV ]) { +OUTP_DBG (outp,"Extended DPCD rev less than base DPCD rev (%d > %d)\n" , + outp->dp.dpcd[DP_DPCD_REV ], dpcd_ext[DP_DPCD_REV ]); +return 0 ; + } + +if (!memcmp (outp->dp.dpcd, dpcd_ext,sizeof (dpcd_ext))) +return 0 ; + +memcpy (outp->dp.dpcd, dpcd_ext,sizeof (dpcd_ext)); + +return 0 ; +} +void nvkm_dp_enable (struct nvkm_outp *outp,bool auxpwr) {
@@ -689,7 +735,7 @@ nvkm_dp_enable(struct nvkm_outp *outp, bmemset (outp->dp.lttpr,0x00 ,sizeof (outp->dp.lttpr)); } -if (!nvkm_rdaux (aux,DPCD_RC00_DPCD_REV , outp->dp.dpcd,sizeof (outp->dp.dpcd))) { +if (!nvkm_dp_read_dpcd_caps (outp)) {const u8 rates[] = {0x1e ,0x14 ,0x0a ,0x06 ,0 };const u8 *rate;int rate_max;
Greg Kroah-Hartman
maintainerPATCH 41/206 drm/shmem-helper: Reset vma->vm_ops before calling dma_buf_mmap()
In reply to Greg Kroah-HartmanFrom: Boris Brezillon <[email protected]>
commit 07dd476f6116966cb2006e25fdcf48f0715115ff upstream.
The dma-buf backend is supposed to provide its own vm_ops, but some implementation just have nothing special to do and leave vm_ops untouched, probably expecting this field to be zero initialized (this is the case with the system_heap implementation for instance). Let's reset vma->vm_ops to NULL to keep things working with these implementations.
--- drivers/gpu/drm/drm_gem_shmem_helper.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/drm_gem_shmem_helper.c +6 -0
@@ -623,7 +623,13 @@ int drm_gem_shmem_mmap(struct drm_gem_shint ret;if (obj->import_attach) { +/* Reset both vm_ops and vm_private_data, so we don't end up with +* vm_ops pointing to our implementation if the dma-buf backend +* doesn't set those fields. +*/ vma->vm_private_data =NULL ; + vma->vm_ops =NULL ; + ret =dma_buf_mmap (obj->dma_buf, vma,0 );/* Drop the reference drm_gem_mmap_obj() acquired.*/
Greg Kroah-Hartman
maintainerPATCH 42/206 drm/amdgpu: fix possible UAF in amdgpu_cs_pass1()
In reply to Greg Kroah-HartmanFrom: Alex Deucher <[email protected]>
commit 90e065677e0362a777b9db97ea21d43a39211399 upstream.
Since the gang_size check is outside of chunk parsing loop, we need to reset i before we free the chunk data.
Suggested by Ye Zhang (@VAR10CK) of Baidu Security.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +1 -1
@@ -291,7 +291,7 @@ static int amdgpu_cs_pass1(struct amdgpuif (!p->gang_size) { ret = -EINVAL ; - goto free_partial_kdata; + goto free_all_kdata; }for (i =0 ; i < p->gang_size; ++i) {
Greg Kroah-Hartman
maintainerPATCH 43/206 drm/amd/pm: correct the pcie width for smu 13.0.0
In reply to Greg Kroah-HartmanFrom: Kenneth Feng <[email protected]>
commit bd60e2eafd8fb053948b6e23e8167baf7a159750 upstream.
correct the pcie width value in pp_dpm_pcie for smu 13.0.0
--- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c +1 -2
@@ -1030,7 +1030,6 @@ static int smu_v13_0_0_print_clk_levels(struct smu_13_0_dpm_context *dpm_context = smu_dpm->dpm_context;struct smu_13_0_dpm_table *single_dpm_table;struct smu_13_0_pcie_table *pcie_table; -const int link_width[] = {0 ,1 ,2 ,4 ,8 ,12 ,16 };uint32_t gen_speed, lane_width;int i, curr_freq, size =0 ;int ret =0 ;
@@ -1145,7 +1144,7 @@ static int smu_v13_0_0_print_clk_levels( (pcie_table->pcie_lane[i] ==6 ) ?"x16" :"" , pcie_table->clk_freq[i], (gen_speed ==DECODE_GEN_SPEED (pcie_table->pcie_gen[i])) && - (lane_width ==DECODE_LANE_WIDTH (link_width[pcie_table->pcie_lane[i]])) ? + (lane_width ==DECODE_LANE_WIDTH (pcie_table->pcie_lane[i])) ? "*" : "");break ;
Greg Kroah-Hartman
maintainerPATCH 44/206 drm/amd/display: Fix a regression on Polaris cards
In reply to Greg Kroah-HartmanFrom: Mario Limonciello <[email protected]>
commit 3bb575572bf498a9d39e9d1ca5c06cc3152928a1 upstream.
DCE products don't define a remove_stream_from_ctx like DCN ones do. This means that when compute_mst_dsc_configs_for_state() is called it always returns -EINVAL which causes MST to fail to setup.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +1 -1
@@ -1320,7 +1320,7 @@ int compute_mst_dsc_configs_for_state(struct drm_atomic_state *state,if (computed_streams[i])continue ; -if (!res_pool->funcs->remove_stream_from_ctx || +if (res_pool->funcs->remove_stream_from_ctx && res_pool->funcs->remove_stream_from_ctx (stream->ctx->dc, dc_state, stream) !=DC_OK )return -EINVAL ;
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 45/206 drm/amd/display: check attr flag before set cursor degamma on DCN3+
In reply to Greg Kroah-HartmanFrom: Melissa Wen <[email protected]>
commit 96b020e2163fb2197266b2f71b1007495206e6bb upstream.
Don't set predefined degamma curve to cursor plane if the cursor attribute flag is not set. Applying a degamma curve to the cursor by default breaks userspace expectation. Checking the flag before performing any color transformation prevents too dark cursor gamma in DCN3+ on many Linux desktop environment (KDE Plasma, GNOME, wlroots-based, etc.) as reported at:
- https://gitlab.freedesktop.org/drm/amd/-/issues/1513
This is the same approach followed by DCN2 drivers where the issue is not present.
--- drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/dcn30/dcn30_dpp.c +5 -2
@@ -357,8 +357,11 @@ void dpp3_set_cursor_attributes(int cur_rom_en =0 ;if (color_format ==CURSOR_MODE_COLOR_PRE_MULTIPLIED_ALPHA || - color_format ==CURSOR_MODE_COLOR_UN_PRE_MULTIPLIED_ALPHA ) - cur_rom_en =1 ; + color_format ==CURSOR_MODE_COLOR_UN_PRE_MULTIPLIED_ALPHA ) { +if (cursor_attributes->attribute_flags.bits.ENABLE_CURSOR_DEGAMMA) { + cur_rom_en =1 ; + } + } REG_UPDATE_3(CURSOR0_CONTROL, CUR0_MODE, color_format,
Greg Kroah-Hartman
maintainerPATCH 46/206 drm/amd: Disable S/G for APUs when 64GB or more host memory
In reply to Greg Kroah-HartmanFrom: Mario Limonciello <[email protected]>
commit 08fffa74d9772d9538338be3f304006c94dde6f0 upstream.
Users report a white flickering screen on multiple systems that is tied to having 64GB or more memory. When S/G is enabled pages will get pinned to both VRAM carve out and system RAM leading to this.
Until it can be fixed properly, disable S/G when 64GB of memory or more is detected. This will force pages to be pinned into VRAM. This should fix white screen flickers but if VRAM pressure is encountered may lead to black screens. It's a trade-off for now.
--- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 26 ++++++++++++++++++++++ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 +--- 3 files changed, 29 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu.h +1 -0
@@ -1246,6 +1246,7 @@ int amdgpu_device_gpu_recover(struct amdvoid amdgpu_device_pci_config_reset (struct amdgpu_device *adev);int amdgpu_device_pci_reset (struct amdgpu_device *adev);bool amdgpu_device_need_post (struct amdgpu_device *adev); +bool amdgpu_sg_display_supported (struct amdgpu_device *adev);bool amdgpu_device_pcie_dynamic_switching_supported (void );bool amdgpu_device_should_use_aspm (struct amdgpu_device *adev);bool amdgpu_device_aspm_support_quirk (void );
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +26 -0
@@ -1353,6 +1353,32 @@ bool amdgpu_device_need_post(struct amdg }/* +* On APUs with >= 64GB white flickering has been observed w/ SG enabled. +* Disable S/G on such systems until we have a proper fix. +* https://gitlab.freedesktop.org/drm/amd/-/issues/2354 +* https://gitlab.freedesktop.org/drm/amd/-/issues/2735 +*/ +bool amdgpu_sg_display_supported (struct amdgpu_device *adev) +{ +switch (amdgpu_sg_display) { +case -1 : +break ; +case 0 : +return false; +case 1 : +return true; +default : +return false; + } +if ((totalram_pages () << (PAGE_SHIFT -10 )) + + (adev->gmc.real_vram_size /1024 ) >=64000000 ) { +DRM_WARN ("Disabling S/G due to >=64GB RAM\n" ); +return false; + } +return true; +} + +/* * Intel hosts such as Raptor Lake and Sapphire Rapids don't support dynamic * speed switching. Until we have confirmation from Intel that a specific host * supports it, it's safer that we keep it disabled for all.
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +2 -3
@@ -1630,9 +1630,8 @@ static int amdgpu_dm_init(struct amdgpu_ }break ; } -if (init_data.flags.gpu_vm_support && - (amdgpu_sg_display ==0 )) - init_data.flags.gpu_vm_support = false; +if (init_data.flags.gpu_vm_support) + init_data.flags.gpu_vm_support =amdgpu_sg_display_supported (adev);if (init_data.flags.gpu_vm_support) adev->mode_info.gpu_vm_support = true;
Greg Kroah-Hartman
maintainerPATCH 47/206 tpm: tpm_tis: Fix UPX-i11 DMI_MATCH condition
In reply to Greg Kroah-HartmanFrom: Peter Ujfalusi <[email protected]>
commit 51e5e551af53259e0274b0cd4ff83d8351fb8c40 upstream.
The patch which made it to the kernel somehow changed the match condition fromDMI_MATCH(DMI_PRODUCT_NAME, "UPX-TGL01")
toDMI_MATCH(DMI_PRODUCT_VERSION, "UPX-TGL")
Revert back to the correct match condition to disable the interrupt mode on the board.
--- drivers/char/tpm/tpm_tis.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/tpm/tpm_tis.c +1 -1
@@ -183,7 +183,7 @@ static const struct dmi_system_id tpm_tis_dmi_table[] = { .ident = "UPX-TGL", .matches = {DMI_MATCH (DMI_SYS_VENDOR ,"AAEON" ), - DMI_MATCH(DMI_PRODUCT_VERSION, "UPX-TGL"), + DMI_MATCH(DMI_PRODUCT_NAME, "UPX-TGL01"), }, }, {}
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 48/206 tpm_tis: Opt-in interrupts
In reply to Greg Kroah-HartmanFrom: Jarkko Sakkinen <[email protected]>
commit 6aaf663ee04a80b445f8f5abff53cb92cb583c88 upstream.
--- drivers/char/tpm/tpm_tis.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/tpm/tpm_tis.c +1 -1
@@ -89,7 +89,7 @@ static inline void tpm_tis_iowrite32(u32 b, void __iomem *iobase, u32 addr)tpm_tis_flush (iobase); } -static int interrupts =-1 ; +static int interrupts;module_param (interrupts, int,0444 );MODULE_PARM_DESC (interrupts,"Enable interrupts" );
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 49/206 cpuidle: dt_idle_genpd: Add helper function to remove genpd topology
In reply to Greg Kroah-HartmanFrom: Maulik Shah <[email protected]>
commit 9a8fa00dad3c7b260071f2f220cfb00505372c40 upstream.
Genpd parent and child domain topology created using dt_idle_pd_init_topology() needs to be removed during error cases.
Add new helper function dt_idle_pd_remove_topology() for same.
--- drivers/cpuidle/dt_idle_genpd.c | 24 ++++++++++++++++++++++++ drivers/cpuidle/dt_idle_genpd.h | 7 +++++++ 2 files changed, 31 insertions(+)
drivers/cpuidle/dt_idle_genpd.c +24 -0
@@ -152,6 +152,30 @@ int dt_idle_pd_init_topology(struct devireturn 0 ; } +int dt_idle_pd_remove_topology (struct device_node *np) +{ +struct device_node *node; +struct of_phandle_args child, parent; +int ret; + +for_each_child_of_node (np, node) { +if (of_parse_phandle_with_args (node,"power-domains" , +"#power-domain-cells" ,0 , &parent)) +continue ; + + child.np = node; + child.args_count =0 ; + ret =of_genpd_remove_subdomain (&parent, &child); +of_node_put (parent.np); +if (ret) { +of_node_put (node); +return ret; + } + } + +return 0 ; +} +struct device *dt_idle_attach_cpu (int cpu,const char *name) {struct device *dev;
drivers/cpuidle/dt_idle_genpd.h +7 -0
@@ -14,6 +14,8 @@ struct generic_pm_domain *dt_idle_pd_allint dt_idle_pd_init_topology (struct device_node *np); +int dt_idle_pd_remove_topology (struct device_node *np); +struct device *dt_idle_attach_cpu (int cpu,const char *name);void dt_idle_detach_cpu (struct device *dev);
@@ -35,6 +37,11 @@ static inline int dt_idle_pd_init_topolo {return 0 ; } + +static inline int dt_idle_pd_remove_topology (struct device_node *np) +{ +return 0 ; +}static inline struct device *dt_idle_attach_cpu (int cpu,const char *name) {
Greg Kroah-Hartman
maintainerPATCH 50/206 cpuidle: psci: Move enabling OSI mode after power domains creation
In reply to Greg Kroah-HartmanFrom: Maulik Shah <[email protected]>
commit 12acb348fa4528a4203edf1cce7a3be2c9af2279 upstream.
A switch from OSI to PC mode is only possible if all CPUs other than the calling one are OFF, either through a call to CPU_OFF or not yet booted.
Currently OSI mode is enabled before power domains are created. In cases where CPUidle states are not using hierarchical CPU topology the bail out path tries to switch back to PC mode which gets denied by firmware since other CPUs are online at this point and creates inconsistent state as firmware is in OSI mode and Linux in PC mode.
This change moves enabling OSI mode after power domains are created, this would makes sure that hierarchical CPU topology is used before switching firmware to OSI mode.
--- drivers/cpuidle/cpuidle-psci-domain.c | 39 +++++++++++----------------------- 1 file changed, 13 insertions(+), 26 deletions(-)
drivers/cpuidle/cpuidle-psci-domain.c +13 -26
@@ -120,20 +120,6 @@ static void psci_pd_remove(void) } } -static bool psci_pd_try_set_osi_mode (void ) -{ -int ret; - -if (!psci_has_osi_support ()) -return false; - - ret =psci_set_osi_mode (true); -if (ret) -return false; - -return true; -} -static void psci_cpuidle_domain_sync_state (struct device *dev) {/*
@@ -152,15 +138,12 @@ static int psci_cpuidle_domain_probe(str {struct device_node *np = pdev->dev.of_node;struct device_node *node; -bool use_osi; +bool use_osi =psci_has_osi_support ();int ret =0 , pd_count =0 ;if (!np)return -ENODEV ; -/* If OSI mode is supported, let's try to enable it. */ - use_osi =psci_pd_try_set_osi_mode (); -/* * Parse child nodes for the "#power-domain-cells" property and * initialize a genpd/genpd-of-provider pair when it's found.
@@ -170,33 +153,37 @@ static int psci_cpuidle_domain_probe(strcontinue ; ret =psci_pd_init (node, use_osi); -if (ret) - goto put_node; +if (ret) { +of_node_put (node); + goto exit; + } pd_count++; }/* Bail out if not using the hierarchical CPU topology. */ if (!pd_count) - goto no_pd; +return 0 ;/* Link genpd masters/subdomains to model the CPU topology. */ ret =dt_idle_pd_init_topology (np);if (ret) goto remove_pd; +/* let's try to enable OSI. */ + ret =psci_set_osi_mode (use_osi); +if (ret) + goto remove_pd; +pr_info ("Initialized CPU PM domain topology using %s mode\n" , use_osi ?"OSI" :"PC" );return 0 ; -put_node: -of_node_put (node); remove_pd: +dt_idle_pd_remove_topology (np);psci_pd_remove (); +exit:pr_err ("failed to create CPU PM domains ret=%d\n" , ret); -no_pd: -if (use_osi) -psci_set_osi_mode (false);return ret; }
Greg Kroah-Hartman
maintainerPATCH 51/206 io_uring: correct check for O_TMPFILE
In reply to Greg Kroah-HartmanFrom: Aleksa Sarai <[email protected]>
commit 72dbde0f2afbe4af8e8595a89c650ae6b9d9c36f upstream.
O_TMPFILE is actually __O_TMPFILE|O_DIRECTORY. This means that the old check for whether RESOLVE_CACHED can be used would incorrectly think that O_DIRECTORY could not be used with RESOLVE_CACHED.
--- io_uring/openclose.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
io_uring/openclose.c +4 -2
@@ -35,9 +35,11 @@ static bool io_openat_force_async(struct {/* * Don't bother trying for O_TRUNC, O_CREAT, or O_TMPFILE open, -* it'll always -EAGAIN +* it'll always -EAGAIN. Note that we test for __O_TMPFILE because +* O_TMPFILE includes O_DIRECTORY, which isn't a flag we need to force +* async for. */ -return open->how.flags & (O_TRUNC |O_CREAT |O_TMPFILE ); +return open->how.flags & (O_TRUNC |O_CREAT | __O_TMPFILE); }static int __io_openat_prep (struct io_kiocb *req,const struct io_uring_sqe *sqe)
Greg Kroah-Hartman
maintainerPATCH 52/206 zsmalloc: fix races between modifications of fullness and isolated
In reply to Greg Kroah-HartmanFrom: Andrew Yang <[email protected]>
commit 4b5d1e47b69426c0f7491d97d73ad0152d02d437 upstream.
We encountered many kernel exceptions of VM_BUG_ON(zspage->isolated ==
0) in dec_zspage_isolation() and BUG_ON(!pages[1]) in zs_unmap_object() lately. This issue only occurs when migration and reclamation occur at the same time.
With our memory stress test, we can reproduce this issue several times a day. We have no idea why no one else encountered this issue. BTW, we switched to the new kernel version with this defect a few months ago.
Since fullness and isolated share the same unsigned int, modifications of them should be protected by the same lock.
--- mm/zsmalloc.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
mm/zsmalloc.c +9 -5
@@ -1977,6 +1977,7 @@ static void replace_sub_page(struct sizestatic bool zs_page_isolate (struct page *page,isolate_mode_t mode) { +struct zs_pool *pool;struct zspage *zspage;/*
@@ -1986,9 +1987,10 @@ static bool zs_page_isolate(struct pageVM_BUG_ON_PAGE (PageIsolated (page), page); zspage =get_zspage (page); -migrate_write_lock (zspage); + pool = zspage->pool; +spin_lock (&pool->lock);inc_zspage_isolation (zspage); -migrate_write_unlock (zspage); +spin_unlock (&pool->lock);return true; }
@@ -2054,12 +2056,12 @@ static int zs_page_migrate(struct page *kunmap_atomic (s_addr);replace_sub_page (class, zspage, newpage, page); +dec_zspage_isolation (zspage);/* * Since we complete the data copy and set up new zspage structure, * it's okay to release the pool's lock. */ spin_unlock (&pool->lock); -dec_zspage_isolation (zspage);migrate_write_unlock (zspage);get_page (newpage);
@@ -2076,14 +2078,16 @@ static int zs_page_migrate(struct page *static void zs_page_putback (struct page *page) { +struct zs_pool *pool;struct zspage *zspage;VM_BUG_ON_PAGE (!PageIsolated (page), page); zspage =get_zspage (page); -migrate_write_lock (zspage); + pool = zspage->pool; +spin_lock (&pool->lock);dec_zspage_isolation (zspage); -migrate_write_unlock (zspage); +spin_unlock (&pool->lock); }static const struct movable_operations zsmalloc_mops = {
Greg Kroah-Hartman
maintainerPATCH 53/206 hwmon: (pmbus/bel-pfe) Enable PMBUS_SKIP_STATUS_CHECK for pfe1100
In reply to Greg Kroah-HartmanFrom: Tao Ren <[email protected]>
commit f38963b9cd0645a336cf30c5da2e89e34e34fec3 upstream.
Skip status check for both pfe1100 and pfe3000 because the communication error is also observed on pfe1100 devices.
--- drivers/hwmon/pmbus/bel-pfe.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/hwmon/pmbus/bel-pfe.c +8 -8
@@ -17,12 +17,13 @@enum chips {pfe1100, pfe3000};/* -* Disable status check for pfe3000 devices, because some devices report -* communication error (invalid command) for VOUT_MODE command (0x20) -* although correct VOUT_MODE (0x16) is returned: it leads to incorrect -* exponent in linear mode. +* Disable status check because some devices report communication error +* (invalid command) for VOUT_MODE command (0x20) although the correct +* VOUT_MODE (0x16) is returned: it leads to incorrect exponent in linear +* mode. +* This affects both pfe3000 and pfe1100. */ -static struct pmbus_platform_data pfe3000_plat_data = { +static struct pmbus_platform_data pfe_plat_data = { .flags =PMBUS_SKIP_STATUS_CHECK , };
@@ -94,16 +95,15 @@ static int pfe_pmbus_probe(struct i2c_clint model; model = (int )i2c_match_id (pfe_device_id, client)->driver_data; + client->dev.platform_data = &pfe_plat_data;/* * PFE3000-12-069RA devices may not stay in page 0 during device * probe which leads to probe failure (read status word failed). * So let's set the device to page 0 at the beginning. */ -if (model == pfe3000) { - client->dev.platform_data = &pfe3000_plat_data; +if (model == pfe3000)i2c_smbus_write_byte_data (client,PMBUS_PAGE ,0 ); - }return pmbus_do_probe (client, &pfe_driver_info[model]); }
Greg Kroah-Hartman
maintainerPATCH 54/206 radix tree test suite: fix incorrect allocation size for pthreads
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
commit cac7ea57a06016e4914848b707477fb07ee4ae1c upstream.
Currently the pthread allocation for each array item is based on the size of a pthread_t pointer and should be the size of the pthread_t structure, so the allocation is under-allocating the correct size. Fix this by using the size of each element in the pthreads array.
Static analysis cppcheck reported:tools/testing/radix-tree/regression1.c:180:2: warning: Size of pointer 'threads' used instead of size of its data. [pointerSize]
--- tools/testing/radix-tree/regression1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/radix-tree/regression1.c +1 -1
@@ -177,7 +177,7 @@ void regression1_test(void) nr_threads =2 ;pthread_barrier_init (&worker_barrier,NULL , nr_threads); - threads =malloc (nr_threads *sizeof (pthread_t *)); + threads =malloc (nr_threads *sizeof (*threads));for (i =0 ; i < nr_threads; i++) { arg = i;
Greg Kroah-Hartman
maintainerPATCH 55/206 cpufreq: amd-pstate: fix global sysfs attribute type
In reply to Greg Kroah-HartmanFrom: Thomas Weißschuh <[email protected]>
commit 5e720f8c8c9d959283c3908bbf32a91a01a86547 upstream.
In commit 3666062b87ec ("cpufreq: amd-pstate: move to use bus_get_dev_root()") the "amd_pstate" attributes where moved from a dedicated kobject to the cpu root kobject.
While the dedicated kobject expects to contain kobj_attributes the root kobject needs device_attributes.
As the changed arguments are not used by the callbacks it works most of the time.
However CFI will detect this issue:
[ 4947.849350] CFI failure at dev_attr_show+0x24/0x60 (target: show_status+0x0/0x70; expected type: 0x8651b1de) ... [ 4947.849409] Call Trace: [ 4947.849410] <TASK> [ 4947.849411] ? __warn+0xcf/0x1c0 [ 4947.849414] ? dev_attr_show+0x24/0x60 [ 4947.849415] ? report_cfi_failure+0x4e/0x60 [ 4947.849417] ? handle_cfi_failure+0x14c/0x1d0 [ 4947.849419] ? __cfi_show_status+0x10/0x10 [ 4947.849420] ? handle_bug+0x4f/0x90 [ 4947.849421] ? exc_invalid_op+0x1a/0x60 [ 4947.849422] ? asm_exc_invalid_op+0x1a/0x20 [ 4947.849424] ? __cfi_show_status+0x10/0x10 [ 4947.849425] ? dev_attr_show+0x24/0x60 [ 4947.849426] sysfs_kf_seq_show+0xa6/0x110 [ 4947.849433] seq_read_iter+0x16c/0x4b0 [ 4947.849436] vfs_read+0x272/0x2d0 [ 4947.849438] ksys_read+0x72/0xe0 [ 4947.849439] do_syscall_64+0x76/0xb0 [ 4947.849440] ? do_user_addr_fault+0x252/0x650 [ 4947.849442] ? exc_page_fault+0x7a/0x1b0 [ 4947.849443] entry_SYSCALL_64_after_hwframe+0x72/0xdc
--- drivers/cpufreq/amd-pstate.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/cpufreq/amd-pstate.c +5 -5
@@ -986,8 +986,8 @@ static int amd_pstate_update_status(consreturn 0 ; } -static ssize_t show_status (struct kobject *kobj, -struct kobj_attribute *attr,char *buf) +static ssize_t status_show (struct device *dev, +struct device_attribute *attr,char *buf) {ssize_t ret;
@@ -998,7 +998,7 @@ static ssize_t show_status(struct kobjecreturn ret; } -static ssize_t store_status (struct kobject *a,struct kobj_attribute *b, +static ssize_t status_store (struct device *a,struct device_attribute *b,const char *buf,size_t count) {char *p =memchr (buf,'\n' , count);
@@ -1017,7 +1017,7 @@ cpufreq_freq_attr_ro(amd_pstate_lowest_ncpufreq_freq_attr_ro (amd_pstate_highest_perf);cpufreq_freq_attr_rw (energy_performance_preference);cpufreq_freq_attr_ro (energy_performance_available_preferences); -define_one_global_rw (status); +static DEVICE_ATTR_RW (status);static struct freq_attr *amd_pstate_attr[] = { &amd_pstate_max_freq,
@@ -1036,7 +1036,7 @@ static struct freq_attr *amd_pstate_epp_ };static struct attribute *pstate_global_attributes[] = { - &status.attr, + &dev_attr_status.attr,NULL };
Greg Kroah-Hartman
maintainerPATCH 56/206 fs/proc/kcore: reinstate bounce buffer for KCORE_TEXT regions
In reply to Greg Kroah-HartmanFrom: Lorenzo Stoakes <[email protected]>
commit 17457784004c84178798432a029ab20e14f728b1 upstream.
Some architectures do not populate the entire range categorised by KCORE_TEXT, so we must ensure that the kernel address we read from is valid.
Unfortunately there is no solution currently available to do so with a purely iterator solution so reinstate the bounce buffer in this instance so we can use copy_from_kernel_nofault() in order to avoid page faults when regions are unmapped.
This change partly reverts commit 2e1c0170771e ("fs/proc/kcore: avoid bounce buffer for ktext data"), reinstating the bounce buffer, but adapts the code to continue to use an iterator.
--- fs/proc/kcore.c | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-)
fs/proc/kcore.c +27 -3
@@ -309,6 +309,8 @@ static void append_kcore_note(char *notes, size_t *i, const char *name,static ssize_t read_kcore_iter (struct kiocb *iocb,struct iov_iter *iter) { +struct file *file = iocb->ki_filp; +char *buf = file->private_data;loff_t *fpos = &iocb->ki_pos;size_t phdrs_offset, notes_offset, data_offset;size_t page_offline_frozen =1 ;
@@ -555,10 +557,21 @@ static ssize_t read_kcore_iter(struct kiocb *iocb, struct iov_iter *iter)case KCORE_VMEMMAP :case KCORE_TEXT :/* -* We use _copy_to_iter() to bypass usermode hardening -* which would otherwise prevent this operation. +* Sadly we must use a bounce buffer here to be able to +* make use of copy_from_kernel_nofault(), as these +* memory regions might not always be mapped on all +* architectures. */ -if (_copy_to_iter ((char *)start, tsz, iter) != tsz) { +if (copy_from_kernel_nofault (buf, (void *)start, tsz)) { +if (iov_iter_zero (tsz, iter) != tsz) { + ret = -EFAULT ; + goto out; + } +/* +* We know the bounce buffer is safe to copy from, so +* use _copy_to_iter() directly. +*/ + }else if (_copy_to_iter (buf, tsz, iter) != tsz) { ret = -EFAULT ; goto out; }
@@ -595,6 +608,10 @@ static int open_kcore(struct inode *inode, struct file *filp)if (ret)return ret; + filp->private_data =kmalloc (PAGE_SIZE ,GFP_KERNEL ); +if (!filp->private_data) +return -ENOMEM ; +if (kcore_need_update)kcore_update_ram ();if (i_size_read (inode) != proc_root_kcore->size) {
@@ -605,9 +622,16 @@ static int open_kcore(struct inode *inode, struct file *filp)return 0 ; } +static int release_kcore (struct inode *inode,struct file *file) +{ +kfree (file->private_data); +return 0 ; +} +static const struct proc_ops kcore_proc_ops = { .proc_read_iter = read_kcore_iter, .proc_open = open_kcore, + .proc_release = release_kcore, .proc_lseek = default_llseek, };
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 57/206 nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput
In reply to Greg Kroah-HartmanFrom: Ryusuke Konishi <[email protected]>
commit f8654743a0e6909dc634cbfad6db6816f10f3399 upstream.
During unmount process of nilfs2, nothing holds nilfs_root structure after nilfs2 detaches its writer in nilfs_detach_log_writer(). Previously, nilfs_evict_inode() could cause use-after-free read for nilfs_root if inodes are left in "garbage_list" and released by nilfs_dispose_list at the end of nilfs_detach_log_writer(), and this bug was fixed by commit 9b5a04ac3ad9 ("nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()").
However, it turned out that there is another possibility of UAF in the call path where mark_inode_dirty_sync() is called from iput():
nilfs_detach_log_writer()
nilfs_dispose_list()
iput()
mark_inode_dirty_sync()
__mark_inode_dirty()
nilfs_dirty_inode()
__nilfs_mark_inode_dirty()
nilfs_load_inode_block() --> causes UAF of nilfs_root structThis can happen after commit 0ae45f63d4ef ("vfs: add support for a lazytime mount option"), which changed iput() to call mark_inode_dirty_sync() on its final reference if i_state has I_DIRTY_TIME flag and i_nlink is non-zero.
This issue appears after commit 28a65b49eb53 ("nilfs2: do not write dirty data after degenerating to read-only") when using the syzbot reproducer, but the issue has potentially existed before.
Fix this issue by adding a "purging flag" to the nilfs structure, setting that flag while disposing the "garbage_list" and checking it in __nilfs_mark_inode_dirty().
Unlike commit 9b5a04ac3ad9 ("nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()"), this patch does not rely on ns_writer to determine whether to skip operations, so as not to break recovery on mount. The nilfs_salvage_orphan_logs routine dirties the buffer of salvaged data before attaching the log writer, so changing __nilfs_mark_inode_dirty() to skip the operation when ns_writer is NULL will cause recovery write to fail. The purpose of using the cleanup-only flag is to allow for narrowing of such conditions.
--- fs/nilfs2/inode.c | 8 ++++++++ fs/nilfs2/segment.c | 2 ++ fs/nilfs2/the_nilfs.h | 2 ++ 3 files changed, 12 insertions(+)
fs/nilfs2/inode.c +8 -0
@@ -1101,9 +1101,17 @@ int nilfs_set_file_dirty(struct inode *iint __nilfs_mark_inode_dirty (struct inode *inode,int flags) { +struct the_nilfs *nilfs = inode->i_sb->s_fs_info;struct buffer_head *ibh;int err; +/* +* Do not dirty inodes after the log writer has been detached +* and its nilfs_root struct has been freed. +*/ +if (unlikely (nilfs_purging (nilfs))) +return 0 ; + err =nilfs_load_inode_block (inode, &ibh);if (unlikely (err)) { nilfs_warn(inode->i_sb,
fs/nilfs2/segment.c +2 -0
@@ -2845,6 +2845,7 @@ void nilfs_detach_log_writer(struct supenilfs_segctor_destroy (nilfs->ns_writer); nilfs->ns_writer =NULL ; } +set_nilfs_purging (nilfs);/* Force to free the list of dirty files */ spin_lock (&nilfs->ns_inode_lock);
@@ -2857,4 +2858,5 @@ void nilfs_detach_log_writer(struct supeup_write (&nilfs->ns_segctor_sem);nilfs_dispose_list (nilfs, &garbage_list,1 ); +clear_nilfs_purging (nilfs); }
fs/nilfs2/the_nilfs.h +2 -0
@@ -29,6 +29,7 @@ enum {THE_NILFS_DISCONTINUED ,/* 'next' pointer chain has broken */ THE_NILFS_GC_RUNNING ,/* gc process is running */ THE_NILFS_SB_DIRTY ,/* super block is dirty */ + THE_NILFS_PURGING, /* disposing dirty files for cleanup */ };/**
@@ -208,6 +209,7 @@ THE_NILFS_FNS(INIT, init) THE_NILFS_FNS(DISCONTINUED, discontinued) THE_NILFS_FNS(GC_RUNNING, gc_running) THE_NILFS_FNS(SB_DIRTY, sb_dirty) +THE_NILFS_FNS (PURGING , purging)/* * Mount option operations
Greg Kroah-Hartman
maintainerPATCH 58/206 accel/ivpu: Add set_pages_array_wc/uc for internal buffers
In reply to Greg Kroah-HartmanFrom: Karol Wachowski <[email protected]>
commit 1963546390ed8b649f529993a755eba0fdeb7aaa upstream.
Buffers mapped with pgprot_writecombined() are not correctly flushed. This triggers issues on VPU access using random memory content such as MMU translation faults, invalid context descriptors being fetched and can lead to VPU FW crashes.
--- drivers/accel/ivpu/ivpu_gem.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/accel/ivpu/ivpu_gem.c +8 -0
@@ -173,6 +173,9 @@ static void internal_free_pages_locked(struct ivpu_bo *bo) {unsigned int i, npages = bo->base.size >>PAGE_SHIFT ; +if (ivpu_bo_cache_mode (bo) !=DRM_IVPU_BO_CACHED ) +set_pages_array_wb (bo->pages, bo->base.size >>PAGE_SHIFT ); +for (i =0 ; i < npages; i++)put_page (bo->pages[i]);
@@ -587,6 +590,11 @@ ivpu_bo_alloc_internal(struct ivpu_device *vdev, u64 vpu_addr, u64 size, u32 flaif (ivpu_bo_cache_mode (bo) !=DRM_IVPU_BO_CACHED )drm_clflush_pages (bo->pages, bo->base.size >>PAGE_SHIFT ); +if (bo->flags &DRM_IVPU_BO_WC ) +set_pages_array_wc (bo->pages, bo->base.size >>PAGE_SHIFT ); +else if (bo->flags &DRM_IVPU_BO_UNCACHED ) +set_pages_array_uc (bo->pages, bo->base.size >>PAGE_SHIFT ); + prot =ivpu_bo_pgprot (bo,PAGE_KERNEL ); bo->kvaddr =vmap (bo->pages, bo->base.size >>PAGE_SHIFT ,VM_MAP , prot);if (!bo->kvaddr) {
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 59/206 hugetlb: do not clear hugetlb dtor until allocating vmemmap
In reply to Greg Kroah-HartmanFrom: Mike Kravetz <[email protected]>
commit 32c877191e022b55fe3a374f3d7e9fb5741c514d upstream.
Patch series "Fix hugetlb free path race with memory errors".
In the discussion of Jiaqi Yan's series "Improve hugetlbfs read on HWPOISON hugepages" the race window was discovered.
https://lore.kernel.org/linux-mm/20230616233447.GB7371@monkey/
Freeing a hugetlb page back to low level memory allocators is performed in two steps.
1) Under hugetlb lock, remove page from hugetlb lists and clear destructor
2) Outside lock, allocate vmemmap if necessary and call low level free Between these two steps, the hugetlb page will appear as a normal compound page. However, vmemmap for tail pages could be missing. If a memory error occurs at this time, we could try to update page flags non-existant page structs.
A much more detailed description is in the first patch.
The first patch addresses the race window. However, it adds a hugetlb_lock lock/unlock cycle to every vmemmap optimized hugetlb page free operation. This could lead to slowdowns if one is freeing a large number of hugetlb pages.
The second path optimizes the update_and_free_pages_bulk routine to only take the lock once in bulk operations.
The second patch is technically not a bug fix, but includes a Fixes tag and Cc stable to avoid a performance regression. It can be combined with the first, but was done separately make reviewing easier.
This patch (of 2):
Freeing a hugetlb page and releasing base pages back to the underlying allocator such as buddy or cma is performed in two steps:
- remove_hugetlb_folio() is called to remove the folio from hugetlb lists, get a ref on the page and remove hugetlb destructor. This all must be done under the hugetlb lock. After this call, the page can be treated as a normal compound page or a collection of base size pages.
- update_and_free_hugetlb_folio() is called to allocate vmemmap if needed and the free routine of the underlying allocator is called on the resulting page. We can not hold the hugetlb lock here.
One issue with this scheme is that a memory error could occur between these two steps. In this case, the memory error handling code treats the old hugetlb page as a normal compound page or collection of base pages. It will then try to SetPageHWPoison(page) on the page with an error. If the page with error is a tail page without vmemmap, a write error will occur when trying to set the flag.
Address this issue by modifying remove_hugetlb_folio() and update_and_free_hugetlb_folio() such that the hugetlb destructor is not cleared until after allocating vmemmap. Since clearing the destructor requires holding the hugetlb lock, the clearing is done in remove_hugetlb_folio() if the vmemmap is present. This saves a lock/unlock cycle. Otherwise, destructor is cleared in update_and_free_hugetlb_folio() after allocating vmemmap.
Note that this will leave hugetlb pages in a state where they are marked free (by hugetlb specific page flag) and have a ref count. This is not a normal state. The only code that would notice is the memory error code, and it is set up to retry in such a case.
A subsequent patch will create a routine to do bulk processing of vmemmap allocation. This will eliminate a lock/unlock cycle for each hugetlb page in the case where we are freeing a large number of pages.
--- mm/hugetlb.c | 75 ++++++++++++++++++++++++++++++++++++++++------------------- 1 file changed, 51 insertions(+), 24 deletions(-)
mm/hugetlb.c +51 -24
@@ -1580,9 +1580,37 @@ static inline void destroy_compound_giga unsigned int order) { }#endif +static inline void __clear_hugetlb_destructor (struct hstate *h, +struct folio *folio) +{ +lockdep_assert_held (&hugetlb_lock); + +/* +* Very subtle +* +* For non-gigantic pages set the destructor to the normal compound +* page dtor. This is needed in case someone takes an additional +* temporary ref to the page, and freeing is delayed until they drop +* their reference. +* +* For gigantic pages set the destructor to the null dtor. This +* destructor will never be called. Before freeing the gigantic +* page destroy_compound_gigantic_folio will turn the folio into a +* simple group of pages. After this the destructor does not +* apply. +* +*/ +if (hstate_is_gigantic (h)) +folio_set_compound_dtor (folio,NULL_COMPOUND_DTOR ); +else +folio_set_compound_dtor (folio,COMPOUND_PAGE_DTOR ); +} +/* -* Remove hugetlb folio from lists, and update dtor so that the folio appears -* as just a compound page. +* Remove hugetlb folio from lists. +* If vmemmap exists for the folio, update dtor so that the folio appears +* as just a compound page. Otherwise, wait until after allocating vmemmap +* to update dtor. * * A reference is held on the folio, except in the case of demote. *
@@ -1613,31 +1641,19 @@ static void __remove_hugetlb_folio(struc }/* -* Very subtle -* -* For non-gigantic pages set the destructor to the normal compound -* page dtor. This is needed in case someone takes an additional -* temporary ref to the page, and freeing is delayed until they drop -* their reference. -* -* For gigantic pages set the destructor to the null dtor. This -* destructor will never be called. Before freeing the gigantic -* page destroy_compound_gigantic_folio will turn the folio into a -* simple group of pages. After this the destructor does not -* apply. -* -* This handles the case where more than one ref is held when and -* after update_and_free_hugetlb_folio is called. -* -* In the case of demote we do not ref count the page as it will soon -* be turned into a page of smaller size. +* We can only clear the hugetlb destructor after allocating vmemmap +* pages. Otherwise, someone (memory error handling) may try to write +* to tail struct pages. +*/ +if (!folio_test_hugetlb_vmemmap_optimized (folio)) +__clear_hugetlb_destructor (h, folio); + +/* +* In the case of demote we do not ref count the page as it will soon +* be turned into a page of smaller size. */ if (!demote)folio_ref_unfreeze (folio,1 ); -if (hstate_is_gigantic (h)) -folio_set_compound_dtor (folio,NULL_COMPOUND_DTOR ); -else -folio_set_compound_dtor (folio,COMPOUND_PAGE_DTOR ); h->nr_huge_pages--; h->nr_huge_pages_node[nid]--;
@@ -1706,6 +1722,7 @@ static void __update_and_free_hugetlb_fo {int i;struct page *subpage; +bool clear_dtor =folio_test_hugetlb_vmemmap_optimized (folio);if (hstate_is_gigantic (h) && !gigantic_page_runtime_supported ())return ;
@@ -1736,6 +1753,16 @@ static void __update_and_free_hugetlb_foif (unlikely (folio_test_hwpoison (folio)))folio_clear_hugetlb_hwpoison (folio); +/* +* If vmemmap pages were allocated above, then we need to clear the +* hugetlb destructor under the hugetlb lock. +*/ +if (clear_dtor) { +spin_lock_irq (&hugetlb_lock); +__clear_hugetlb_destructor (h, folio); +spin_unlock_irq (&hugetlb_lock); + } +for (i =0 ; i <pages_per_huge_page (h); i++) { subpage =folio_page (folio, i); subpage->flags &= ~(1 << PG_locked | 1 << PG_error |
Greg Kroah-Hartman
maintainerPATCH 60/206 mm/damon/core: initialize damo_filter->list from damos_new_filter()
In reply to Greg Kroah-HartmanFrom: SeongJae Park <[email protected]>
commit 5f1fc67f2cb8d3035d3acd273b48b97835af8afd upstream.
damos_new_filter() is not initializing the list field of newly allocated filter object. However, DAMON sysfs interface and DAMON_RECLAIM are not initializing it after calling damos_new_filter(). As a result, accessing uninitialized memory is possible. Actually, adding multiple DAMOS filters via DAMON sysfs interface caused NULL pointer dereferencing. Initialize the field just after the allocation from damos_new_filter().
--- mm/damon/core.c | 1 + 1 file changed, 1 insertion(+)
mm/damon/core.c +1 -0
@@ -273,6 +273,7 @@ struct damos_filter *damos_new_filter(enum damos_filter_type type,return NULL ; filter->type = type; filter->matching = matching; +INIT_LIST_HEAD (&filter->list);return filter; }
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 61/206 selftests: mm: ksm: fix incorrect evaluation of parameter
In reply to Greg Kroah-HartmanFrom: Ayush Jain <[email protected]>
commit 65294de30cb8bc7659e445f7be2846af9ed35499 upstream.
A missing break in kms_tests leads to kselftest hang when the parameter -s is used.
In current code flow because of missing break in -s, -t parses args spilled from -s and as -t accepts only valid values as 0,1 so any arg in -s >1 or <0, gets in ksm_test failure
This went undetected since, before the addition of option -t, the next case -M would immediately break out of the switch statement but that is no longer the case
Add the missing break statement.
----Before----
./ksm_tests -H -s 100
Invalid merge type
----After----
./ksm_tests -H -s 100
Number of normal pages: 0 Number of huge pages: 50 Total size: 100 MiB Total time: 0.401732682 s Average speed: 248.922 MiB/s
--- tools/testing/selftests/mm/ksm_tests.c | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/mm/ksm_tests.c +1 -0
@@ -831,6 +831,7 @@ int main(int argc, char *argv[])printf ("Size must be greater than 0\n" );return KSFT_FAIL ; } +break ;case 't' : {int tmp =atoi (optarg);
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 62/206 mm: memory-failure: fix potential unexpected return value from unpoison_memory()
In reply to Greg Kroah-HartmanFrom: Miaohe Lin <[email protected]>
commit f29623e4a599c295cc8f518c8e4bb7848581a14d upstream.
If unpoison_memory() fails to clear page hwpoisoned flag, return value ret is expected to be -EBUSY. But when get_hwpoison_page() returns 1 and fails to clear page hwpoisoned flag due to races, return value will be unexpected 1 leading to users being confused. And there's a code smell that the variable "ret" is used not only to save the return value of unpoison_memory(), but also the return value from get_hwpoison_page(). Make a further cleanup by using another auto-variable solely to save the return value of get_hwpoison_page() as suggested by Naoya.
--- mm/memory-failure.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-)
mm/memory-failure.c +9 -10
@@ -2469,7 +2469,7 @@ int unpoison_memory(unsigned long pfn) {struct folio *folio;struct page *p; -int ret = -EBUSY ; +int ret = -EBUSY , ghp;unsigned long count =1 ;bool huge = false; static DEFINE_RATELIMIT_STATE(unpoison_rs, DEFAULT_RATELIMIT_INTERVAL,
@@ -2517,29 +2517,28 @@ int unpoison_memory(unsigned long pfn)if (folio_test_slab (folio) ||PageTable (&folio->page) ||folio_test_reserved (folio)) goto unlock_mutex; - ret =get_hwpoison_page (p,MF_UNPOISON ); -if (!ret) { + ghp =get_hwpoison_page (p,MF_UNPOISON ); +if (!ghp) {if (PageHuge (p)) { huge = true; count =folio_free_raw_hwp (folio, false); -if (count ==0 ) { - ret = -EBUSY ; +if (count ==0 ) goto unlock_mutex; - } } ret =folio_test_clear_hwpoison (folio) ?0 : -EBUSY ; - }else if (ret <0 ) { -if (ret == -EHWPOISON ) { + }else if (ghp <0 ) { +if (ghp == -EHWPOISON ) { ret =put_page_back_buddy (p) ?0 : -EBUSY ; - }else + }else { + ret = ghp;unpoison_pr_info ("Unpoison: failed to grab page %#lx\n" , pfn, &unpoison_rs); + } }else {if (PageHuge (p)) { huge = true; count =folio_free_raw_hwp (folio, false);if (count ==0 ) { - ret = -EBUSY ;folio_put (folio); goto unlock_mutex; }
Greg Kroah-Hartman
maintainerPATCH 63/206 mm: memory-failure: avoid false hwpoison page mapped error info
In reply to Greg Kroah-HartmanFrom: Miaohe Lin <[email protected]>
commit faeb2ff2c1c5cb60ce0da193580b256c941f99ca upstream.
folio->_mapcount is overloaded in SLAB, so folio_mapped() has to be done after folio_test_slab() is checked. Otherwise slab folio might be treated as a mapped folio leading to false 'Someone maps the hwpoison page' error info.
--- mm/memory-failure.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
mm/memory-failure.c +7 -3
@@ -2502,6 +2502,13 @@ int unpoison_memory(unsigned long pfn) goto unlock_mutex; } +if (folio_test_slab (folio) ||PageTable (&folio->page) ||folio_test_reserved (folio)) + goto unlock_mutex; + +/* +* Note that folio->_mapcount is overloaded in SLAB, so the simple test +* in folio_mapped() has to be done after folio_test_slab() is checked. +*/ if (folio_mapped (folio)) {unpoison_pr_info ("Unpoison: Someone maps the hwpoison page %#lx\n" , pfn, &unpoison_rs);
@@ -2514,9 +2521,6 @@ int unpoison_memory(unsigned long pfn) goto unlock_mutex; } -if (folio_test_slab (folio) ||PageTable (&folio->page) ||folio_test_reserved (folio)) - goto unlock_mutex; - ghp =get_hwpoison_page (p,MF_UNPOISON );if (!ghp) {if (PageHuge (p)) {
Greg Kroah-Hartman
maintainerPATCH 64/206 drm/amd/pm: expose swctf threshold setting for legacy powerplay
In reply to Greg Kroah-HartmanFrom: Evan Quan <[email protected]>
commit 064329c595da56eff6d7a7e7760660c726433139 upstream.
Preparation for coming optimization which eliminates the influence of GPU temperature momentary fluctuation.
--- drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h | 2 ++ drivers/gpu/drm/amd/pm/powerplay/hwmgr/hardwaremanager.c | 4 +++- drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 2 ++ drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c | 10 ++++++++++ drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c | 4 ++++ drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c | 4 ++++ drivers/gpu/drm/amd/pm/powerplay/inc/power_state.h | 1 + 7 files changed, 26 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/pm/inc/amdgpu_dpm.h +2 -0
@@ -89,6 +89,8 @@ struct amdgpu_dpm_thermal {int max_mem_crit_temp;/* memory max emergency(shutdown) temp */ int max_mem_emergency_temp; +/* SWCTF threshold */ +int sw_ctf_threshold;/* was last interrupt low to high or high to low */ bool high_to_low;/* interrupt source */
drivers/gpu/drm/amd/pm/powerplay/hwmgr/hardwaremanager.c +3 -1
@@ -241,7 +241,8 @@ int phm_start_thermal_controller(structTEMP_RANGE_MAX ,TEMP_RANGE_MIN ,TEMP_RANGE_MAX , - TEMP_RANGE_MAX}; +TEMP_RANGE_MAX , + 0};struct amdgpu_device *adev = hwmgr->adev;if (!hwmgr->not_vf)
@@ -265,6 +266,7 @@ int phm_start_thermal_controller(struct adev->pm.dpm.thermal.min_mem_temp = range.mem_min; adev->pm.dpm.thermal.max_mem_crit_temp = range.mem_crit_max; adev->pm.dpm.thermal.max_mem_emergency_temp = range.mem_emergency_max; + adev->pm.dpm.thermal.sw_ctf_threshold = range.sw_ctf_threshold;return ret; }
drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c +2 -0
@@ -5432,6 +5432,8 @@ static int smu7_get_thermal_temperature_ thermal_data->max = data->thermal_temp_setting.temperature_shutdown *PP_TEMPERATURE_UNITS_PER_CENTIGRADES ; + thermal_data->sw_ctf_threshold = thermal_data->max; +return 0 ; }
drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_hwmgr.c +10 -0
@@ -5241,6 +5241,9 @@ static int vega10_get_thermal_temperatur {struct vega10_hwmgr *data = hwmgr->backend;PPTable_t *pp_table = &(data->smc_state_table.pp_table); +struct phm_ppt_v2_information *pp_table_info = + (struct phm_ppt_v2_information *)(hwmgr->pptable); +struct phm_tdp_table *tdp_table = pp_table_info->tdp_table;memcpy (thermal_data, &SMU7ThermalWithDelayPolicy[0 ],sizeof (struct PP_TemperatureRange ));
@@ -5257,6 +5260,13 @@ static int vega10_get_thermal_temperatur thermal_data->mem_emergency_max = (pp_table->ThbmLimit +CTF_OFFSET_HBM )*PP_TEMPERATURE_UNITS_PER_CENTIGRADES ; +if (tdp_table->usSoftwareShutdownTemp > pp_table->ThotspotLimit && + tdp_table->usSoftwareShutdownTemp <VEGA10_THERMAL_MAXIMUM_ALERT_TEMP ) + thermal_data->sw_ctf_threshold = tdp_table->usSoftwareShutdownTemp; +else + thermal_data->sw_ctf_threshold =VEGA10_THERMAL_MAXIMUM_ALERT_TEMP ; + thermal_data->sw_ctf_threshold *=PP_TEMPERATURE_UNITS_PER_CENTIGRADES ; +return 0 ; }
drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega12_hwmgr.c +4 -0
@@ -2763,6 +2763,8 @@ static int vega12_notify_cac_buffer_infostatic int vega12_get_thermal_temperature_range (struct pp_hwmgr *hwmgr,struct PP_TemperatureRange *thermal_data) { +struct phm_ppt_v3_information *pptable_information = + (struct phm_ppt_v3_information *)hwmgr->pptable;struct vega12_hwmgr *data = (struct vega12_hwmgr *)(hwmgr->backend);PPTable_t *pp_table = &(data->smc_state_table.pp_table);
@@ -2781,6 +2783,8 @@ static int vega12_get_thermal_temperaturPP_TEMPERATURE_UNITS_PER_CENTIGRADES ; thermal_data->mem_emergency_max = (pp_table->ThbmLimit +CTF_OFFSET_HBM )*PP_TEMPERATURE_UNITS_PER_CENTIGRADES ; + thermal_data->sw_ctf_threshold = pptable_information->us_software_shutdown_temp * +PP_TEMPERATURE_UNITS_PER_CENTIGRADES ;return 0 ; }
drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_hwmgr.c +4 -0
@@ -4206,6 +4206,8 @@ static int vega20_notify_cac_buffer_infostatic int vega20_get_thermal_temperature_range (struct pp_hwmgr *hwmgr,struct PP_TemperatureRange *thermal_data) { +struct phm_ppt_v3_information *pptable_information = + (struct phm_ppt_v3_information *)hwmgr->pptable;struct vega20_hwmgr *data = (struct vega20_hwmgr *)(hwmgr->backend);PPTable_t *pp_table = &(data->smc_state_table.pp_table);
@@ -4224,6 +4226,8 @@ static int vega20_get_thermal_temperaturPP_TEMPERATURE_UNITS_PER_CENTIGRADES ; thermal_data->mem_emergency_max = (pp_table->ThbmLimit +CTF_OFFSET_HBM )*PP_TEMPERATURE_UNITS_PER_CENTIGRADES ; + thermal_data->sw_ctf_threshold = pptable_information->us_software_shutdown_temp * +PP_TEMPERATURE_UNITS_PER_CENTIGRADES ;return 0 ; }
drivers/gpu/drm/amd/pm/powerplay/inc/power_state.h +1 -0
@@ -131,6 +131,7 @@ struct PP_TemperatureRange {int mem_min;int mem_crit_max;int mem_emergency_max; +int sw_ctf_threshold; };struct PP_StateValidationBlock {
Greg Kroah-Hartman
maintainerPATCH 65/206 drm/amd/pm: avoid unintentional shutdown due to temperature momentary fluctuation
In reply to Greg Kroah-HartmanFrom: Evan Quan <[email protected]>
commit b75efe88b20c2be28b67e2821a794cc183e32374 upstream.
An intentional delay is added on soft ctf triggered. Then there will be a double check for the GPU temperature before taking further action. This can avoid unintended shutdown due to temperature momentary fluctuation.
[ Hand-modified because XCP support added to amdgpu.h in kernel 6.5
and is not necessary for this fix. ]
--- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 3 + drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c | 48 ++++++++++++++++++++ drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu_helper.c | 27 +++-------- drivers/gpu/drm/amd/pm/powerplay/inc/hwmgr.h | 2 drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 34 ++++++++++++++ drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h | 2 drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c | 9 --- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 9 --- 8 files changed, 102 insertions(+), 32 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu.h +3 -0
@@ -282,6 +282,9 @@ extern int amdgpu_sg_display;#define AMDGPU_SMARTSHIFT_MAX_BIAS (100)#define AMDGPU_SMARTSHIFT_MIN_BIAS (-100) +/* Extra time delay(in ms) to eliminate the influence of temperature momentary fluctuation */ +#define AMDGPU_SWCTF_EXTRA_DELAY 50 +struct amdgpu_device ;struct amdgpu_irq_src ;struct amdgpu_fpriv ;
drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c +48 -0
78 lines not on this page · raw message
drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu_helper.c +9 -18
@@ -603,21 +603,17 @@ int phm_irq_process(struct amdgpu_devicestruct amdgpu_irq_src *source, struct amdgpu_iv_entry *entry) { + struct pp_hwmgr *hwmgr = adev->powerplay.pp_handle;uint32_t client_id = entry->client_id;uint32_t src_id = entry->src_id;if (client_id ==AMDGPU_IRQ_CLIENTID_LEGACY ) {if (src_id ==VISLANDS30_IV_SRCID_CG_TSS_THERMAL_LOW_TO_HIGH ) { -dev_emerg (adev->dev,"ERROR: GPU over temperature range(SW CTF) detected!\n" ); -/* -* SW CTF just occurred. -* Try to do a graceful shutdown to prevent further damage. -*/ -dev_emerg (adev->dev,"ERROR: System is going to shutdown due to GPU SW CTF!\n" ); -orderly_poweroff (true); - }else if (src_id ==VISLANDS30_IV_SRCID_CG_TSS_THERMAL_HIGH_TO_LOW ) +schedule_delayed_work (&hwmgr->swctf_delayed_work, +msecs_to_jiffies (AMDGPU_SWCTF_EXTRA_DELAY )); + }else if (src_id ==VISLANDS30_IV_SRCID_CG_TSS_THERMAL_HIGH_TO_LOW ) {dev_emerg (adev->dev,"ERROR: GPU under temperature range detected!\n" ); -else if (src_id ==VISLANDS30_IV_SRCID_GPIO_19 ) { + }else if (src_id ==VISLANDS30_IV_SRCID_GPIO_19 ) {dev_emerg (adev->dev,"ERROR: GPU HW Critical Temperature Fault(aka CTF) detected!\n" );/* * HW CTF just occurred. Shutdown to prevent further damage.
@@ -626,15 +622,10 @@ int phm_irq_process(struct amdgpu_deviceorderly_poweroff (true); } }else if (client_id ==SOC15_IH_CLIENTID_THM ) { -if (src_id ==0 ) { -dev_emerg (adev->dev,"ERROR: GPU over temperature range(SW CTF) detected!\n" ); -/* -* SW CTF just occurred. -* Try to do a graceful shutdown to prevent further damage. -*/ -dev_emerg (adev->dev,"ERROR: System is going to shutdown due to GPU SW CTF!\n" ); -orderly_poweroff (true); - }else +if (src_id ==0 ) +schedule_delayed_work (&hwmgr->swctf_delayed_work, +msecs_to_jiffies (AMDGPU_SWCTF_EXTRA_DELAY )); +else dev_emerg (adev->dev,"ERROR: GPU under temperature range detected!\n" ); }else if (client_id ==SOC15_IH_CLIENTID_ROM_SMUIO ) {dev_emerg (adev->dev,"ERROR: GPU HW Critical Temperature Fault(aka CTF) detected!\n" );
drivers/gpu/drm/amd/pm/powerplay/inc/hwmgr.h +2 -0
@@ -811,6 +811,8 @@ struct pp_hwmgr {bool gfxoff_state_changed_by_workload;uint32_t pstate_sclk_peak;uint32_t pstate_mclk_peak; + +struct delayed_work swctf_delayed_work; };int hwmgr_early_init (struct pp_hwmgr *hwmgr);
drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +34 -0
@@ -24,6 +24,7 @@#include <linux/firmware.h> #include <linux/pci.h> +#include <linux/reboot.h> #include "amdgpu.h" #include "amdgpu_smu.h"
@@ -1070,6 +1071,34 @@ static void smu_interrupt_work_fn(struct smu->ppt_funcs->interrupt_work (smu); } +static void smu_swctf_delayed_work_handler (struct work_struct *work) +{ +struct smu_context *smu = + container_of(work, struct smu_context, swctf_delayed_work.work); +struct smu_temperature_range *range = + &smu->thermal_range; +struct amdgpu_device *adev = smu->adev; +uint32_t hotspot_tmp, size; + +/* +* If the hotspot temperature is confirmed as below SW CTF setting point +* after the delay enforced, nothing will be done. +* Otherwise, a graceful shutdown will be performed to prevent further damage. +*/ +if (range->software_shutdown_temp && + smu->ppt_funcs->read_sensor && + !smu->ppt_funcs->read_sensor (smu, +AMDGPU_PP_SENSOR_HOTSPOT_TEMP , + &hotspot_tmp, + &size) && + hotspot_tmp /1000 < range->software_shutdown_temp) +return ; + +dev_emerg (adev->dev,"ERROR: GPU over temperature range(SW CTF) detected!\n" ); +dev_emerg (adev->dev,"ERROR: System is going to shutdown due to GPU SW CTF!\n" ); +orderly_poweroff (true); +} +static int smu_sw_init (void *handle) {struct amdgpu_device *adev = (struct amdgpu_device *)handle;
@@ -1112,6 +1141,9 @@ static int smu_sw_init(void *handle) smu->smu_dpm.dpm_level =AMD_DPM_FORCED_LEVEL_AUTO ; smu->smu_dpm.requested_dpm_level =AMD_DPM_FORCED_LEVEL_AUTO ; +INIT_DELAYED_WORK (&smu->swctf_delayed_work, + smu_swctf_delayed_work_handler); + ret =smu_smc_table_sw_init (smu);if (ret) {dev_err (adev->dev,"Failed to sw init smc table!\n" );
@@ -1592,6 +1624,8 @@ static int smu_smc_hw_cleanup(struct smureturn ret; } +cancel_delayed_work_sync (&smu->swctf_delayed_work); + ret =smu_disable_dpms (smu);if (ret) {dev_err (adev->dev,"Fail to disable dpm features!\n" );
drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h +2 -0
@@ -573,6 +573,8 @@ struct smu_contextu32 debug_param_reg;u32 debug_msg_reg;u32 debug_resp_reg; + +struct delayed_work swctf_delayed_work; };struct i2c_adapter ;
drivers/gpu/drm/amd/pm/swsmu/smu11/smu_v11_0.c +2 -7
@@ -1412,13 +1412,8 @@ static int smu_v11_0_irq_process(structif (client_id ==SOC15_IH_CLIENTID_THM ) {switch (src_id) {case THM_11_0__SRCID__THM_DIG_THERM_L2H : -dev_emerg (adev->dev,"ERROR: GPU over temperature range(SW CTF) detected!\n" ); -/* -* SW CTF just occurred. -* Try to do a graceful shutdown to prevent further damage. -*/ -dev_emerg (adev->dev,"ERROR: System is going to shutdown due to GPU SW CTF!\n" ); -orderly_poweroff (true); +schedule_delayed_work (&smu->swctf_delayed_work, +msecs_to_jiffies (AMDGPU_SWCTF_EXTRA_DELAY ));break ;case THM_11_0__SRCID__THM_DIG_THERM_H2L :dev_emerg (adev->dev,"ERROR: GPU under temperature range detected\n" );
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c +2 -7
@@ -1377,13 +1377,8 @@ static int smu_v13_0_irq_process(structif (client_id ==SOC15_IH_CLIENTID_THM ) {switch (src_id) {case THM_11_0__SRCID__THM_DIG_THERM_L2H : -dev_emerg (adev->dev,"ERROR: GPU over temperature range(SW CTF) detected!\n" ); -/* -* SW CTF just occurred. -* Try to do a graceful shutdown to prevent further damage. -*/ -dev_emerg (adev->dev,"ERROR: System is going to shutdown due to GPU SW CTF!\n" ); -orderly_poweroff (true); +schedule_delayed_work (&smu->swctf_delayed_work, +msecs_to_jiffies (AMDGPU_SWCTF_EXTRA_DELAY ));break ;case THM_11_0__SRCID__THM_DIG_THERM_H2L :dev_emerg (adev->dev,"ERROR: GPU under temperature range detected\n" );
Greg Kroah-Hartman
maintainerPATCH 66/206 iio: cros_ec: Fix the allocation size for cros_ec_command
In reply to Greg Kroah-HartmanFrom: Yiyuan Guo <[email protected]>
commit 8a4629055ef55177b5b63dab1ecce676bd8cccdd upstream.
The struct cros_ec_command contains several integer fields and a trailing array. An allocation size neglecting the integer fields can lead to buffer overrun.
--- drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.c +1 -1
@@ -253,7 +253,7 @@ int cros_ec_sensors_core_init(struct plaplatform_set_drvdata (pdev, indio_dev); state->ec = ec->ec_dev; - state->msg =devm_kzalloc (&pdev->dev, + state->msg =devm_kzalloc (&pdev->dev,sizeof (*state->msg) +max ((u16 )sizeof (struct ec_params_motion_sense ), state->ec->max_response),GFP_KERNEL );if (!state->msg)
Greg Kroah-Hartman
maintainerPATCH 67/206 iio: frequency: admv1013: propagate errors from regulator_get_voltage()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit 507397d19b5a296aa339f7a1bd16284f668a1906 upstream.
The regulator_get_voltage() function returns negative error codes. This function saves it to an unsigned int and then does some range checking and, since the error code falls outside the correct range, it returns -EINVAL.
Beyond the messiness, this is bad because the regulator_get_voltage() function can return -EPROBE_DEFER and it's important to propagate that back properly so it can be handled.
--- drivers/iio/frequency/admv1013.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/iio/frequency/admv1013.c +4 -1
@@ -344,9 +344,12 @@ static int admv1013_update_quad_filters(static int admv1013_update_mixer_vgate (struct admv1013_state *st) { -unsigned int vcm, mixer_vgate; +unsigned int mixer_vgate; +int vcm; vcm =regulator_get_voltage (st->reg); +if (vcm <0 ) +return vcm;if (vcm <1800000 ) mixer_vgate = (2389 * vcm /1000000 +8100 ) /100 ;
Greg Kroah-Hartman
maintainerPATCH 68/206 iio: adc: ad7192: Fix ac excitation feature
In reply to Greg Kroah-HartmanFrom: Alisa Roman <[email protected]>
commit 6bc471b6c3aeaa7b95d1b86a1bb8d91a3c341fa5 upstream.
AC excitation enable feature exposed to user on AD7192, allowing a bit which should be 0 to be set. This feature is specific only to AD7195. AC excitation attribute moved accordingly.
In the AD7195 documentation, the AC excitation enable bit is on position 22 in the Configuration register. ACX macro changed to match correct register and bit.
Note that the fix tag is for the commit that moved the driver out of staging.
--- drivers/iio/adc/ad7192.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/iio/adc/ad7192.c +8 -8
@@ -62,7 +62,6 @@#define AD7192_MODE_STA_MASK BIT(20)/* Status Register transmission Mask */ #define AD7192_MODE_CLKSRC (x) (((x) & 0x3) << 18)/* Clock Source Select */ #define AD7192_MODE_SINC3 BIT(15)/* SINC3 Filter Select */ -#define AD7192_MODE_ACX BIT(14)/* AC excitation enable(AD7195 only)*/ #define AD7192_MODE_ENPAR BIT(13)/* Parity Enable */ #define AD7192_MODE_CLKDIV BIT(12)/* Clock divide by 2 (AD7190/2 only)*/ #define AD7192_MODE_SCYCLE BIT(11)/* Single cycle conversion */
@@ -91,6 +90,7 @@/* Configuration Register Bit Designations (AD7192_REG_CONF) */ #define AD7192_CONF_CHOP BIT(23)/* CHOP enable */ +#define AD7192_CONF_ACX BIT(22)/* AC excitation enable(AD7195 only) */ #define AD7192_CONF_REFSEL BIT(20)/* REFIN1/REFIN2 Reference Select */ #define AD7192_CONF_CHAN (x) ((x) << 8)/* Channel select */ #define AD7192_CONF_CHAN_MASK (0x7FF << 8)/* Channel select mask */
@@ -472,7 +472,7 @@ static ssize_t ad7192_show_ac_excitationstruct iio_dev *indio_dev =dev_to_iio_dev (dev);struct ad7192_state *st =iio_priv (indio_dev); -return sysfs_emit (buf,"%d\n" , !!(st->mode &AD7192_MODE_ACX )); +return sysfs_emit (buf,"%d\n" , !!(st->conf &AD7192_CONF_ACX )); } static ssize_t ad7192_show_bridge_switch(struct device *dev,
@@ -513,13 +513,13 @@ static ssize_t ad7192_set(struct devicead_sd_write_reg (&st->sd,AD7192_REG_GPOCON ,1 , st->gpocon);break ; -case AD7192_REG_MODE : +case AD7192_REG_CONF :if (val) - st->mode |=AD7192_MODE_ACX ; + st->conf |=AD7192_CONF_ACX ;else - st->mode &= ~AD7192_MODE_ACX ; + st->conf &= ~AD7192_CONF_ACX ; -ad_sd_write_reg (&st->sd,AD7192_REG_MODE ,3 , st->mode); +ad_sd_write_reg (&st->sd,AD7192_REG_CONF ,3 , st->conf);break ;default : ret = -EINVAL ;
@@ -579,12 +579,11 @@ static IIO_DEVICE_ATTR(bridge_switch_en, static IIO_DEVICE_ATTR(ac_excitation_en, 0644, ad7192_show_ac_excitation, ad7192_set, - AD7192_REG_MODE); + AD7192_REG_CONF);static struct attribute *ad7192_attributes[] = { &iio_dev_attr_filter_low_pass_3db_frequency_available.dev_attr.attr, &iio_dev_attr_bridge_switch_en.dev_attr.attr, - &iio_dev_attr_ac_excitation_en.dev_attr.attr,NULL };
@@ -595,6 +594,7 @@ static const struct attribute_group ad71static struct attribute *ad7195_attributes[] = { &iio_dev_attr_filter_low_pass_3db_frequency_available.dev_attr.attr, &iio_dev_attr_bridge_switch_en.dev_attr.attr, + &iio_dev_attr_ac_excitation_en.dev_attr.attr,NULL };
Greg Kroah-Hartman
maintainerPATCH 69/206 iio: adc: meson: fix core clock enable/disable moment
In reply to Greg Kroah-HartmanFrom: George Stark <[email protected]>
commit 09738ccbc4148c62d6c8c4644ff4a099d57f49ad upstream.
Enable core clock at probe stage and disable it at remove stage. Core clock is responsible for turning on/off the entire SoC module so it should be on before the first module register is touched and be off at very last moment.
--- drivers/iio/adc/meson_saradc.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-)
drivers/iio/adc/meson_saradc.c +12 -11
@@ -916,12 +916,6 @@ static int meson_sar_adc_hw_enable(struc goto err_vref; } - ret =clk_prepare_enable (priv->core_clk); -if (ret) { -dev_err (dev,"failed to enable core clk\n" ); - goto err_core_clk; - } - regval =FIELD_PREP (MESON_SAR_ADC_REG0_FIFO_CNT_IRQ_MASK ,1 );regmap_update_bits (priv->regmap,MESON_SAR_ADC_REG0 ,MESON_SAR_ADC_REG0_FIFO_CNT_IRQ_MASK , regval);
@@ -948,8 +942,6 @@ err_adc_clk:regmap_update_bits (priv->regmap,MESON_SAR_ADC_REG3 ,MESON_SAR_ADC_REG3_ADC_EN ,0 );meson_sar_adc_set_bandgap (indio_dev, false); -clk_disable_unprepare (priv->core_clk); -err_core_clk:regulator_disable (priv->vref); err_vref:meson_sar_adc_unlock (indio_dev);
@@ -977,8 +969,6 @@ static void meson_sar_adc_hw_disable(strmeson_sar_adc_set_bandgap (indio_dev, false); -clk_disable_unprepare (priv->core_clk); -regulator_disable (priv->vref);if (!ret)
@@ -1211,7 +1201,7 @@ static int meson_sar_adc_probe(struct plif (IS_ERR (priv->clkin))return dev_err_probe (dev,PTR_ERR (priv->clkin),"failed to get clkin\n" ); - priv->core_clk =devm_clk_get (dev,"core" ); + priv->core_clk =devm_clk_get_enabled (dev,"core" );if (IS_ERR (priv->core_clk))return dev_err_probe (dev,PTR_ERR (priv->core_clk),"failed to get core clk\n" );
@@ -1294,15 +1284,26 @@ static int meson_sar_adc_remove(struct pstatic int meson_sar_adc_suspend (struct device *dev) {struct iio_dev *indio_dev =dev_get_drvdata (dev); +struct meson_sar_adc_priv *priv =iio_priv (indio_dev);meson_sar_adc_hw_disable (indio_dev); +clk_disable_unprepare (priv->core_clk); +return 0 ; }static int meson_sar_adc_resume (struct device *dev) {struct iio_dev *indio_dev =dev_get_drvdata (dev); +struct meson_sar_adc_priv *priv =iio_priv (indio_dev); +int ret; + + ret =clk_prepare_enable (priv->core_clk); +if (ret) { +dev_err (dev,"failed to enable core clk\n" ); +return ret; + }return meson_sar_adc_hw_enable (indio_dev); }
Greg Kroah-Hartman
maintainerPATCH 70/206 iio: adc: ina2xx: avoid NULL pointer dereference on OF device match
In reply to Greg Kroah-HartmanFrom: Alvin Šipraga <[email protected]>
commit a41e19cc0d6b6a445a4133170b90271e4a2553dc upstream.
The affected lines were resulting in a NULL pointer dereference on our platform because the device tree contained the following list of compatible strings:
power-sensor@40 {
compatible = "ti,ina232", "ti,ina231";
...
};Since the driver doesn't declare a compatible string "ti,ina232", the OF matching succeeds on "ti,ina231". But the I2C device ID info is populated via the first compatible string, cf. modalias population in of_i2c_get_board_info(). Since there is no "ina232" entry in the legacy I2C device ID table either, the struct i2c_device_id *id pointer in the probe function is NULL.
Fix this by using the already populated type variable instead, which points to the proper driver data. Since the name is also wanted, add a generic one to the ina2xx_config table.
--- drivers/iio/adc/ina2xx-adc.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/iio/adc/ina2xx-adc.c +6 -3
@@ -124,6 +124,7 @@ static const struct regmap_config ina2xxenum ina2xx_ids { ina219, ina226 };struct ina2xx_config { +const char *name;u16 config_default;int calibration_value;int shunt_voltage_lsb;/* nV */
@@ -155,6 +156,7 @@ struct ina2xx_chip_info {static const struct ina2xx_config ina2xx_config[] = { [ina219] = { + .name ="ina219" , .config_default =INA219_CONFIG_DEFAULT , .calibration_value =4096 , .shunt_voltage_lsb =10000 ,
@@ -164,6 +166,7 @@ static const struct ina2xx_config ina2xx .chip_id = ina219, }, [ina226] = { + .name = "ina226", .config_default = INA226_CONFIG_DEFAULT, .calibration_value = 2048, .shunt_voltage_lsb = 2500,
@@ -996,7 +999,7 @@ static int ina2xx_probe(struct i2c_clien/* Patch the current config register with default. */ val = chip->config->config_default; -if (id->driver_data == ina226) { +if (type == ina226) {ina226_set_average (chip,INA226_DEFAULT_AVG , &val);ina226_set_int_time_vbus (chip,INA226_DEFAULT_IT , &val);ina226_set_int_time_vshunt (chip,INA226_DEFAULT_IT , &val);
@@ -1015,7 +1018,7 @@ static int ina2xx_probe(struct i2c_clien } indio_dev->modes =INDIO_DIRECT_MODE ; -if (id->driver_data == ina226) { +if (type == ina226) { indio_dev->channels = ina226_channels; indio_dev->num_channels =ARRAY_SIZE (ina226_channels); indio_dev->info = &ina226_info;
@@ -1024,7 +1027,7 @@ static int ina2xx_probe(struct i2c_clien indio_dev->num_channels =ARRAY_SIZE (ina219_channels); indio_dev->info = &ina219_info; } - indio_dev->name = id->name; + indio_dev->name = id ? id->name : chip->config->name; ret =devm_iio_kfifo_buffer_setup (&client->dev, indio_dev, &ina2xx_setup_ops);
Greg Kroah-Hartman
maintainerPATCH 71/206 binder: fix memory leak in binder_init()
In reply to Greg Kroah-HartmanFrom: Qi Zheng <[email protected]>
commit adb9743d6a08778b78d62d16b4230346d3508986 upstream.
In binder_init(), the destruction of binder_alloc_shrinker_init() is not performed in the wrong path, which will cause memory leaks. So this commit introduces binder_alloc_shrinker_exit() and calls it in the wrong path to fix that.
--- drivers/android/binder.c | 1 + drivers/android/binder_alloc.c | 6 ++++++ drivers/android/binder_alloc.h | 1 + 3 files changed, 8 insertions(+)
drivers/android/binder.c +1 -0
@@ -6610,6 +6610,7 @@ err_init_binder_device_failed: err_alloc_device_names_failed:debugfs_remove_recursive (binder_debugfs_dir_entry_root); +binder_alloc_shrinker_exit ();return ret; }
drivers/android/binder_alloc.c +6 -0
@@ -1087,6 +1087,12 @@ int binder_alloc_shrinker_init(void)return ret; } +void binder_alloc_shrinker_exit (void ) +{ +unregister_shrinker (&binder_shrinker); +list_lru_destroy (&binder_alloc_lru); +} +/** * check_buffer() - verify that buffer/offset is safe to access * @alloc: binder_alloc for this proc
drivers/android/binder_alloc.h +1 -0
@@ -129,6 +129,7 @@ extern struct binder_buffer *binder_allo int pid);extern void binder_alloc_init (struct binder_alloc *alloc);extern int binder_alloc_shrinker_init (void ); +extern void binder_alloc_shrinker_exit (void );extern void binder_alloc_vma_close (struct binder_alloc *alloc);extern struct binder_buffer * binder_alloc_prepare_to_free(struct binder_alloc *alloc,
Greg Kroah-Hartman
maintainerPATCH 72/206 misc: rtsx: judge ASPM Mode to set PETXCFG Reg
In reply to Greg Kroah-HartmanFrom: Ricky WU <[email protected]>
commit 101bd907b4244a726980ee67f95ed9cafab6ff7a upstream.
ASPM Mode is ASPM_MODE_CFG need to judge the value of clkreq_0 to set HIGH or LOW, if the ASPM Mode is ASPM_MODE_REG always set to HIGH during the initialization.
--- drivers/misc/cardreader/rts5227.c | 2 +- drivers/misc/cardreader/rts5228.c | 18 ------------------ drivers/misc/cardreader/rts5249.c | 3 +-- drivers/misc/cardreader/rts5260.c | 18 ------------------ drivers/misc/cardreader/rts5261.c | 18 ------------------ drivers/misc/cardreader/rtsx_pcr.c | 5 ++++- 6 files changed, 6 insertions(+), 58 deletions(-)
drivers/misc/cardreader/rts5227.c +1 -1
@@ -195,7 +195,7 @@ static int rts5227_extra_init_hw(struct } } -if (option->force_clkreq_0) +if (option->force_clkreq_0 && pcr->aspm_mode ==ASPM_MODE_CFG )rtsx_pci_add_cmd (pcr,WRITE_REG_CMD ,PETXCFG ,FORCE_CLKREQ_DELINK_MASK ,FORCE_CLKREQ_LOW );else
drivers/misc/cardreader/rts5228.c +0 -18
@@ -435,17 +435,10 @@ static void rts5228_init_from_cfg(struct option->ltr_enabled = false; } } - -if (rtsx_check_dev_flag (pcr,ASPM_L1_1_EN |ASPM_L1_2_EN - |PM_L1_1_EN |PM_L1_2_EN )) - option->force_clkreq_0 = false; -else - option->force_clkreq_0 = true; }static int rts5228_extra_init_hw (struct rtsx_pcr *pcr) { -struct rtsx_cr_option *option = &pcr->option;rtsx_pci_write_register (pcr,RTS5228_AUTOLOAD_CFG1 ,CD_RESUME_EN_MASK ,CD_RESUME_EN_MASK );
@@ -476,17 +469,6 @@ static int rts5228_extra_init_hw(structelse rtsx_pci_write_register (pcr,PETXCFG ,0x30 ,0x00 ); -/* -* If u_force_clkreq_0 is enabled, CLKREQ# PIN will be forced -* to drive low, and we forcibly request clock. -*/ -if (option->force_clkreq_0) -rtsx_pci_write_register (pcr,PETXCFG , -FORCE_CLKREQ_DELINK_MASK ,FORCE_CLKREQ_LOW ); -else -rtsx_pci_write_register (pcr,PETXCFG , -FORCE_CLKREQ_DELINK_MASK ,FORCE_CLKREQ_HIGH ); -rtsx_pci_write_register (pcr,PWD_SUSPEND_EN ,0xFF ,0xFB );if (pcr->rtd3_en) {
drivers/misc/cardreader/rts5249.c +1 -2
@@ -327,12 +327,11 @@ static int rts5249_extra_init_hw(struct } } -/* * If u_force_clkreq_0 is enabled, CLKREQ# PIN will be forced * to drive low, and we forcibly request clock. */ -if (option->force_clkreq_0) +if (option->force_clkreq_0 && pcr->aspm_mode ==ASPM_MODE_CFG )rtsx_pci_write_register (pcr,PETXCFG ,FORCE_CLKREQ_DELINK_MASK ,FORCE_CLKREQ_LOW );else
drivers/misc/cardreader/rts5260.c +0 -18
@@ -517,17 +517,10 @@ static void rts5260_init_from_cfg(struct option->ltr_enabled = false; } } - -if (rtsx_check_dev_flag (pcr,ASPM_L1_1_EN |ASPM_L1_2_EN - |PM_L1_1_EN |PM_L1_2_EN )) - option->force_clkreq_0 = false; -else - option->force_clkreq_0 = true; }static int rts5260_extra_init_hw (struct rtsx_pcr *pcr) { -struct rtsx_cr_option *option = &pcr->option;/* Set mcu_cnt to 7 to ensure data can be sampled properly */ rtsx_pci_write_register (pcr,0xFC03 ,0x7F ,0x07 );
@@ -546,17 +539,6 @@ static int rts5260_extra_init_hw(structrts5260_init_hw (pcr); -/* -* If u_force_clkreq_0 is enabled, CLKREQ# PIN will be forced -* to drive low, and we forcibly request clock. -*/ -if (option->force_clkreq_0) -rtsx_pci_write_register (pcr,PETXCFG , -FORCE_CLKREQ_DELINK_MASK ,FORCE_CLKREQ_LOW ); -else -rtsx_pci_write_register (pcr,PETXCFG , -FORCE_CLKREQ_DELINK_MASK ,FORCE_CLKREQ_HIGH ); -rtsx_pci_write_register (pcr, pcr->reg_pm_ctrl3,0x10 ,0x00 );return 0 ;
drivers/misc/cardreader/rts5261.c +0 -18
@@ -498,17 +498,10 @@ static void rts5261_init_from_cfg(struct option->ltr_enabled = false; } } - -if (rtsx_check_dev_flag (pcr,ASPM_L1_1_EN |ASPM_L1_2_EN - |PM_L1_1_EN |PM_L1_2_EN )) - option->force_clkreq_0 = false; -else - option->force_clkreq_0 = true; }static int rts5261_extra_init_hw (struct rtsx_pcr *pcr) { -struct rtsx_cr_option *option = &pcr->option;u32 val; rtsx_pci_write_register(pcr, RTS5261_AUTOLOAD_CFG1,
@@ -554,17 +547,6 @@ static int rts5261_extra_init_hw(structelse rtsx_pci_write_register (pcr,PETXCFG ,0x30 ,0x00 ); -/* -* If u_force_clkreq_0 is enabled, CLKREQ# PIN will be forced -* to drive low, and we forcibly request clock. -*/ -if (option->force_clkreq_0) -rtsx_pci_write_register (pcr,PETXCFG , -FORCE_CLKREQ_DELINK_MASK ,FORCE_CLKREQ_LOW ); -else -rtsx_pci_write_register (pcr,PETXCFG , -FORCE_CLKREQ_DELINK_MASK ,FORCE_CLKREQ_HIGH ); -rtsx_pci_write_register (pcr,PWD_SUSPEND_EN ,0xFF ,0xFB );if (pcr->rtd3_en) {
drivers/misc/cardreader/rtsx_pcr.c +4 -1
@@ -1326,8 +1326,11 @@ static int rtsx_pci_init_hw(struct rtsx_return err; } -if (pcr->aspm_mode ==ASPM_MODE_REG ) +if (pcr->aspm_mode ==ASPM_MODE_REG ) {rtsx_pci_write_register (pcr,ASPM_FORCE_CTL ,0x30 ,0x30 ); +rtsx_pci_write_register (pcr,PETXCFG , +FORCE_CLKREQ_DELINK_MASK ,FORCE_CLKREQ_HIGH ); + }/* No CD interrupt if probing driver with card inserted. * So we need to initialize pcr->card_exist here.
Greg Kroah-Hartman
maintainerPATCH 73/206 thunderbolt: Fix memory leak in tb_handle_dp_bandwidth_request()
In reply to Greg Kroah-HartmanFrom: Mika Westerberg <[email protected]>
commit 596a5123cc782d458b057eb3837e66535cd0befa upstream.
The memory allocated in tb_queue_dp_bandwidth_request() needs to be released once the request is handled to avoid leaking it.
--- drivers/thunderbolt/tb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/thunderbolt/tb.c +2 -0
@@ -1810,6 +1810,8 @@ unlock:pm_runtime_mark_last_busy (&tb->dev);pm_runtime_put_autosuspend (&tb->dev); + +kfree (ev); }static void tb_queue_dp_bandwidth_request (struct tb *tb,u64 route,u8 port)
Greg Kroah-Hartman
maintainerPATCH 74/206 usb-storage: alauda: Fix uninit-value in alauda_check_media()
In reply to Greg Kroah-HartmanFrom: Alan Stern <[email protected]>
commit a6ff6e7a9dd69364547751db0f626a10a6d628d2 upstream.
Syzbot got KMSAN to complain about access to an uninitialized value in the alauda subdriver of usb-storage:
BUG: KMSAN: uninit-value in alauda_transport+0x462/0x57f0 drivers/usb/storage/alauda.c:1137 CPU: 0 PID: 12279 Comm: usb-storage Not tainted 5.3.0-rc7+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x191/0x1f0 lib/dump_stack.c:113 kmsan_report+0x13a/0x2b0 mm/kmsan/kmsan_report.c:108 __msan_warning+0x73/0xe0 mm/kmsan/kmsan_instr.c:250 alauda_check_media+0x344/0x3310 drivers/usb/storage/alauda.c:460
The problem is that alauda_check_media() doesn't verify that its USB transfer succeeded before trying to use the received data. What should happen if the transfer fails isn't entirely clear, but a reasonably conservative approach is to pretend that no media is present.
A similar problem exists in a usb_stor_dbg() call in alauda_get_media_status(). In this case, when an error occurs the call is redundant, because usb_stor_ctrl_transfer() already will print a debugging message.
Finally, unrelated to the uninitialized memory access, is the fact that alauda_check_media() performs DMA to a buffer on the stack. Fortunately usb-storage provides a general purpose DMA-able buffer for uses like this. We'll use it instead.
--- drivers/usb/storage/alauda.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/usb/storage/alauda.c +9 -3
@@ -318,7 +318,8 @@ static int alauda_get_media_status(struc rc =usb_stor_ctrl_transfer (us, us->recv_ctrl_pipe, command,0xc0 ,0 ,1 , data,2 ); -usb_stor_dbg (us,"Media status %02X %02X\n" , data[0 ], data[1 ]); +if (rc ==USB_STOR_XFER_GOOD ) +usb_stor_dbg (us,"Media status %02X %02X\n" , data[0 ], data[1 ]);return rc; }
@@ -454,9 +455,14 @@ static int alauda_init_media(struct us_dstatic int alauda_check_media (struct us_data *us) {struct alauda_info *info = (struct alauda_info *) us->extra; -unsigned char status[2 ]; +unsigned char *status = us->iobuf; +int rc; -alauda_get_media_status (us, status); + rc =alauda_get_media_status (us, status); +if (rc !=USB_STOR_XFER_GOOD ) { + status[0 ] =0xF0 ;/* Pretend there's no media */ + status[1 ] =0 ; + }/* Check for no media or door open */ if ((status[0] & 0x80) || ((status[0] & 0x1F) == 0x10)
Greg Kroah-Hartman
maintainerPATCH 75/206 usb: dwc3: Properly handle processing of pending events
In reply to Greg Kroah-HartmanFrom: Elson Roy Serrao <[email protected]>
commit 3ddaa6a274578e23745b7466346fc2650df8f959 upstream.
If dwc3 is runtime suspended we defer processing the event buffer until resume, by setting the pending_events flag. Set this flag before triggering resume to avoid race with the runtime resume callback.
While handling the pending events, in addition to checking the event buffer we also need to process it. Handle this by explicitly calling dwc3_thread_interrupt(). Also balance the runtime pm get() operation that triggered this processing.
--- drivers/usb/dwc3/gadget.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/usb/dwc3/gadget.c +8 -1
@@ -4448,9 +4448,14 @@ static irqreturn_t dwc3_check_event_buf(u32 count;if (pm_runtime_suspended (dwc->dev)) { + dwc->pending_events = true; +/* +* Trigger runtime resume. The get() function will be balanced +* after processing the pending events in dwc3_process_pending +* events(). +*/ pm_runtime_get (dwc->dev);disable_irq_nosync (dwc->irq_gadget); - dwc->pending_events = true;return IRQ_HANDLED ; }
@@ -4711,6 +4716,8 @@ void dwc3_gadget_process_pending_events( {if (dwc->pending_events) {dwc3_interrupt (dwc->irq_gadget, dwc->ev_buf); +dwc3_thread_interrupt (dwc->irq_gadget, dwc->ev_buf); +pm_runtime_put (dwc->dev); dwc->pending_events = false;enable_irq (dwc->irq_gadget); }
Greg Kroah-Hartman
maintainerPATCH 76/206 USB: Gadget: core: Help prevent panic during UVC unconfigure
In reply to Greg Kroah-HartmanFrom: Alan Stern <[email protected]>
commit 65dadb2beeb7360232b09ebc4585b54475dfee06 upstream.
Avichal Rakesh reported a kernel panic that occurred when the UVC gadget driver was removed from a gadget's configuration. The panic involves a somewhat complicated interaction between the kernel driver and a userspace component (as described in the Link tag below), but the analysis did make one thing clear: The Gadget core should accomodate gadget drivers calling usb_gadget_deactivate() as part of their unbind procedure.
Currently this doesn't work. gadget_unbind_driver() calls driver->unbind() while holding the udc->connect_lock mutex, and usb_gadget_deactivate() attempts to acquire that mutex, which will result in a deadlock.
The simple fix is for gadget_unbind_driver() to release the mutex when invoking the ->unbind() callback. There is no particular reason for it to be holding the mutex at that time, and the mutex isn't held while the ->bind() callback is invoked. So we'll drop the mutex before performing the unbind callback and reacquire it afterward.
We'll also add a couple of comments to usb_gadget_activate() and usb_gadget_deactivate(). Because they run in process context they must not be called from a gadget driver's ->disconnect() callback, which (according to the kerneldoc for struct usb_gadget_driver in include/linux/usb/gadget.h) may run in interrupt context. This may help prevent similar bugs from arising in the future.
--- drivers/usb/gadget/udc/core.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/usb/gadget/udc/core.c +9 -0
@@ -822,6 +822,9 @@ EXPORT_SYMBOL_GPL(usb_gadget_disconnect);* usb_gadget_activate() is called. For example, user mode components may * need to be activated before the system can talk to hosts. * +* This routine may sleep; it must not be called in interrupt context +* (such as from within a gadget driver's disconnect() callback). +* * Returns zero on success, else negative errno. */ int usb_gadget_deactivate (struct usb_gadget *gadget)
@@ -860,6 +863,8 @@ EXPORT_SYMBOL_GPL(usb_gadget_deactivate);* This routine activates gadget which was previously deactivated with * usb_gadget_deactivate() call. It calls usb_gadget_connect() if needed. * +* This routine may sleep; it must not be called in interrupt context. +* * Returns zero on success, else negative errno. */ int usb_gadget_activate (struct usb_gadget *gadget)
@@ -1638,7 +1643,11 @@ static void gadget_unbind_driver(struct device *dev)usb_gadget_disable_async_callbacks (udc);if (gadget->irq)synchronize_irq (gadget->irq); +mutex_unlock (&udc->connect_lock); + udc->driver->unbind (gadget); + +mutex_lock (&udc->connect_lock);usb_gadget_udc_stop_locked (udc);mutex_unlock (&udc->connect_lock);
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 77/206 usb: common: usb-conn-gpio: Prevent bailing out if initial role is none
In reply to Greg Kroah-HartmanFrom: Prashanth K <[email protected]>
commit 8e21a620c7e6e00347ade1a6ed4967b359eada5a upstream.
Currently if we bootup a device without cable connected, then usb-conn-gpio won't call set_role() because last_role is same as current role. This happens since last_role gets initialised to zero during the probe.
To avoid this, add a new flag initial_detection into struct usb_conn_info, which prevents bailing out during initial detection.
--- drivers/usb/common/usb-conn-gpio.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/usb/common/usb-conn-gpio.c +5 -1
@@ -42,6 +42,7 @@ struct usb_conn_info {struct power_supply_desc desc;struct power_supply *charger; +bool initial_detection; };/*
@@ -86,11 +87,13 @@ static void usb_conn_detect_cable(structdev_dbg (info->dev,"role %s -> %s, gpios: id %d, vbus %d\n" ,usb_role_string (info->last_role),usb_role_string (role), id, vbus); -if (info->last_role == role) { +if (!info->initial_detection && info->last_role == role) {dev_warn (info->dev,"repeated role: %s\n" ,usb_role_string (role));return ; } + info->initial_detection = false; +if (info->last_role ==USB_ROLE_HOST && info->vbus)regulator_disable (info->vbus);
@@ -258,6 +261,7 @@ static int usb_conn_probe(struct platfordevice_set_wakeup_capable (&pdev->dev, true);/* Perform initial detection */ + info->initial_detection = true;usb_conn_queue_dwork (info,0 );return 0 ;
Greg Kroah-Hartman
maintainerPATCH 78/206 usb: typec: tcpm: Fix response to vsafe0V event
In reply to Greg Kroah-HartmanFrom: Badhri Jagan Sridharan <[email protected]>
commit 4270d2b4845e820b274702bfc2a7140f69e4d19d upstream.
Do not transition to SNK_UNATTACHED state when receiving vsafe0v event while in SNK_HARD_RESET_WAIT_VBUS. Ignore VBUS off events as well as in some platforms VBUS off can be signalled more than once.
[143515.364753] Requesting mux state 1, usb-role 2, orientation 2 [143515.365520] pending state change SNK_HARD_RESET_SINK_OFF -> SNK_HARD_RESET_SINK_ON @ 650 ms [rev3 HARD_RESET] [143515.632281] CC1: 0 -> 0, CC2: 3 -> 0 [state SNK_HARD_RESET_SINK_OFF, polarity 1, disconnected] [143515.637214] VBUS on [143515.664985] VBUS off [143515.664992] state change SNK_HARD_RESET_SINK_OFF -> SNK_HARD_RESET_WAIT_VBUS [rev3 HARD_RESET] [143515.665564] VBUS VSAFE0V [143515.665566] state change SNK_HARD_RESET_WAIT_VBUS -> SNK_UNATTACHED [rev3 HARD_RESET]
--- drivers/usb/typec/tcpm/tcpm.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/usb/typec/tcpm/tcpm.c +7 -0
@@ -5348,6 +5348,10 @@ static void _tcpm_pd_vbus_off(struct tcp/* Do nothing, vbus drop expected */ break ; +case SNK_HARD_RESET_WAIT_VBUS : +/* Do nothing, its OK to receive vbus off events */ +break ; +default :if (port->pwr_role ==TYPEC_SINK && port->attached)tcpm_set_state (port,SNK_UNATTACHED ,tcpm_wait_for_discharge (port));
@@ -5394,6 +5398,9 @@ static void _tcpm_pd_vbus_vsafe0v(structcase SNK_DEBOUNCED :/*Do nothing, still waiting for VSAFE5V for connect */ break ; +case SNK_HARD_RESET_WAIT_VBUS : +/* Do nothing, its OK to receive vbus off events */ +break ;default :if (port->pwr_role ==TYPEC_SINK && port->auto_vbus_discharge_enabled)tcpm_set_state (port,SNK_UNATTACHED ,0 );
Greg Kroah-Hartman
maintainerPATCH 79/206 usb: typec: altmodes/displayport: Signal hpd when configuring pin assignment
In reply to Greg Kroah-HartmanFrom: RD Babiera <[email protected]>
commit 5a5ccd61cfd76156cb3e0373c300c509d05448ce upstream.
When connecting to some DisplayPort partners, the initial status update after entering DisplayPort Alt Mode notifies that the DFP_D/UFP_D is not in the connected state. This leads to sending a configure message that keeps the device in USB mode. The port partner then sets DFP_D/UFP_D to the connected state and HPD to high in the same Attention message. Currently, the HPD signal is dropped in order to handle configuration.
This patch saves changes to the HPD signal when the device chooses to configure during dp_altmode_status_update, and invokes sysfs_notify if necessary for HPD after configuring.
--- drivers/usb/typec/altmodes/displayport.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
drivers/usb/typec/altmodes/displayport.c +17 -1
@@ -60,6 +60,7 @@ struct dp_altmode {enum dp_state state;bool hpd; +bool pending_hpd;struct mutex lock;/* device lock */ struct work_struct work;
@@ -144,8 +145,13 @@ static int dp_altmode_status_update(stru dp->state =DP_STATE_EXIT ; }else if (!(con &DP_CONF_CURRENTLY (dp->data.conf))) { ret =dp_altmode_configure (dp, con); -if (!ret) +if (!ret) { dp->state =DP_STATE_CONFIGURE ; +if (dp->hpd != hpd) { + dp->hpd = hpd; + dp->pending_hpd = true; + } + } }else {if (dp->hpd != hpd) {drm_connector_oob_hotplug_event (dp->connector_fwnode);
@@ -161,6 +167,16 @@ static int dp_altmode_configured(struct {sysfs_notify (&dp->alt->dev.kobj,"displayport" ,"configuration" );sysfs_notify (&dp->alt->dev.kobj,"displayport" ,"pin_assignment" ); +/* +* If the DFP_D/UFP_D sends a change in HPD when first notifying the +* DisplayPort driver that it is connected, then we wait until +* configuration is complete to signal HPD. +*/ +if (dp->pending_hpd) { +drm_connector_oob_hotplug_event (dp->connector_fwnode); +sysfs_notify (&dp->alt->dev.kobj,"displayport" ,"hpd" ); + dp->pending_hpd = false; + }return dp_altmode_notify (dp); }
Greg Kroah-Hartman
maintainerPATCH 80/206 x86/srso: Fix build breakage with the LLVM linker
In reply to Greg Kroah-HartmanFrom: Nick Desaulniers <[email protected]>
commit cbe8ded48b939b9d55d2c5589ab56caa7b530709 upstream.
The assertion added to verify the difference in bits set of the addresses of srso_untrain_ret_alias() and srso_safe_ret_alias() would fail to link in LLVM's ld.lld linker with the following error:
ld.lld: error: ./arch/x86/kernel/vmlinux.lds:210: at least one side of the expression must be absolute
ld.lld: error: ./arch/x86/kernel/vmlinux.lds:211: at least one side of the expression must be absolute
Use ABSOLUTE to evaluate the expression referring to at least one of the symbols so that LLD can evaluate the linker script.
Also, add linker version info to the comment about XOR being unsupported in either ld.bfd or ld.lld until somewhat recently.
--- arch/x86/kernel/vmlinux.lds.S | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
arch/x86/kernel/vmlinux.lds.S +9 -3
@@ -529,11 +529,17 @@ INIT_PER_CPU(irq_stack_backing_store); #ifdef CONFIG_CPU_SRSO /* - * GNU ld cannot do XOR so do: (A | B) - (A & B) in order to compute the XOR + * GNU ld cannot do XOR until 2.41. + * https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=f6f78318fca803c4907fb8d7f6ded8295f1947b1 + * + * LLVM lld cannot do XOR until lld-17. + * https://github.com/llvm/llvm-project/commit/fae96104d4378166cbe5c875ef8ed808a356f3fb + * + * Instead do: (A | B) - (A & B) in order to compute the XOR * of the two function addresses: */ -. = ASSERT(((srso_untrain_ret_alias | srso_safe_ret_alias) - - (srso_untrain_ret_alias & srso_safe_ret_alias)) == ((1 << 2) | (1 << 8) | (1 << 14) | (1 << 20)), +. = ASSERT(((ABSOLUTE(srso_untrain_ret_alias) | srso_safe_ret_alias) - + (ABSOLUTE(srso_untrain_ret_alias) & srso_safe_ret_alias)) == ((1 << 2) | (1 << 8) | (1 << 14) | (1 << 20)), "SRSO function pair won't alias"); #endif
Greg Kroah-Hartman
maintainerPATCH 81/206 x86/vdso: Choose the right GDT_ENTRY_CPUNODE for 32-bit getcpu() on 64-bit kernel
In reply to Greg Kroah-HartmanFrom: Xin Li <[email protected]>
commit 39163d5479285a36522b6e8f9cc568cc4987db08 upstream.
The vDSO getcpu() reads CPU ID from the GDT_ENTRY_CPUNODE entry when the RDPID instruction is not available. And GDT_ENTRY_CPUNODE is defined as 28 on 32-bit Linux kernel and 15 on 64-bit. But the 32-bit getcpu() on 64-bit Linux kernel is compiled with 32-bit Linux kernel GDT_ENTRY_CPUNODE, i.e., 28, beyond the 64-bit Linux kernel GDT limit. Thus, it just fails _silently_.
When BUILD_VDSO32_64 is defined, choose the 64-bit Linux kernel GDT definitions to compile the 32-bit getcpu().
--- arch/x86/include/asm/segment.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/include/asm/segment.h +1 -1
@@ -56,7 +56,7 @@#define GDT_ENTRY_INVALID_SEG 0 -#ifdef CONFIG_X86_32 +#if defined(CONFIG_X86_32 ) && !defined(BUILD_VDSO32_64 )/* * The layout of the per-CPU GDT under Linux: *
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 82/206 x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405
In reply to Greg Kroah-HartmanFrom: Cristian Ciocaltea <[email protected]>
commit 6dbef74aeb090d6bee7d64ef3fa82ae6fa53f271 upstream.
Commit
522b1d69219d ("x86/cpu/amd: Add a Zenbleed fix")
provided a fix for the Zen2 VZEROUPPER data corruption bug affecting a range of CPU models, but the AMD Custom APU 0405 found on SteamDeck was not listed, although it is clearly affected by the vulnerability.
Add this CPU variant to the Zenbleed erratum list, in order to unconditionally enable the fallback fix until a proper microcode update is available.
--- arch/x86/kernel/cpu/amd.c | 1 + 1 file changed, 1 insertion(+)
arch/x86/kernel/cpu/amd.c +1 -0
@@ -73,6 +73,7 @@ static const int amd_erratum_1054[] =static const int amd_zenbleed[] =AMD_LEGACY_ERRATUM (AMD_MODEL_RANGE (0x17 ,0x30 ,0x0 ,0x4f ,0xf ),AMD_MODEL_RANGE (0x17 ,0x60 ,0x0 ,0x7f ,0xf ), +AMD_MODEL_RANGE (0x17 ,0x90 ,0x0 ,0x91 ,0xf ),AMD_MODEL_RANGE (0x17 ,0xa0 ,0x0 ,0xaf ,0xf )); static const int amd_div0[] =
Greg Kroah-Hartman
maintainerPATCH 83/206 x86/mm: Fix VDSO and VVAR placement on 5-level paging machines
In reply to Greg Kroah-HartmanFrom: Kirill A. Shutemov <[email protected]>
commit 1b8b1aa90c9c0e825b181b98b8d9e249dc395470 upstream.
Yingcong has noticed that on the 5-level paging machine, VDSO and VVAR VMAs are placed above the 47-bit border:
8000001a9000-8000001ad000 r--p 00000000 00:00 0 [vvar]
8000001ad000-8000001af000 r-xp 00000000 00:00 0 [vdso]
This might confuse users who are not aware of 5-level paging and expect all userspace addresses to be under the 47-bit border.
So far problem has only been triggered with ASLR disabled, although it may also occur with ASLR enabled if the layout is randomized in a just right way.
The problem happens due to custom placement for the VMAs in the VDSO
code: vdso_addr() tries to place them above the stack and checks the result against TASK_SIZE_MAX, which is wrong. TASK_SIZE_MAX is set to the 56-bit border on 5-level paging machines. Use DEFAULT_MAP_WINDOW instead.
--- arch/x86/entry/vdso/vma.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/entry/vdso/vma.c +2 -2
@@ -299,8 +299,8 @@ static unsigned long vdso_addr(unsigned/* Round the lowest possible end address up to a PMD boundary. */ end = (start + len +PMD_SIZE -1 ) &PMD_MASK ; -if (end >=TASK_SIZE_MAX ) - end =TASK_SIZE_MAX ; +if (end >=DEFAULT_MAP_WINDOW ) + end =DEFAULT_MAP_WINDOW ; end -= len;if (end > start) {
Greg Kroah-Hartman
maintainerPATCH 84/206 x86/sev: Do not try to parse for the CC blob on non-AMD hardware
In reply to Greg Kroah-HartmanFrom: Borislav Petkov (AMD) <[email protected]>
commit bee6cf1a80b54548a039e224c651bb15b644a480 upstream.
Tao Liu reported a boot hang on an Intel Atom machine due to an unmapped EFI config table. The reason being that the CC blob which contains the CPUID page for AMD SNP guests is parsed for before even checking whether the machine runs on AMD hardware.
Usually that's not a problem on !AMD hw - it simply won't find the CC blob's GUID and return. However, if any parts of the config table pointers array is not mapped, the kernel will #PF very early in the decompressor stage without any opportunity to recover.
Therefore, do a superficial CPUID check before poking for the CC blob. This will fix the current issue on real hardware. It would also work as a guest on a non-lying hypervisor.
For the lying hypervisor, the check is done again, *after* parsing the CC blob as the real CPUID page will be present then.
Clear the #VC handler in case SEV-{ES,SNP} hasn't been detected, as a precaution.
--- arch/x86/boot/compressed/idt_64.c | 9 ++++++++- arch/x86/boot/compressed/sev.c | 37 +++++++++++++++++++++++++++++++++++-- 2 files changed, 43 insertions(+), 3 deletions(-)
arch/x86/boot/compressed/idt_64.c +8 -1
@@ -63,7 +63,14 @@ void load_stage2_idt(void)set_idt_entry (X86_TRAP_PF , boot_page_fault);#ifdef CONFIG_AMD_MEM_ENCRYPT -set_idt_entry (X86_TRAP_VC , boot_stage2_vc); +/* +* Clear the second stage #VC handler in case guest types +* needing #VC have not been detected. +*/ +if (sev_status &BIT (1 )) +set_idt_entry (X86_TRAP_VC , boot_stage2_vc); +else +set_idt_entry (X86_TRAP_VC ,NULL );#endif load_boot_idt (&boot_idt_desc);
arch/x86/boot/compressed/sev.c +35 -2
@@ -353,12 +353,45 @@ void sev_enable(struct boot_params *bp) bp->cc_blob_address =0 ;/* +* Do an initial SEV capability check before snp_init() which +* loads the CPUID page and the same checks afterwards are done +* without the hypervisor and are trustworthy. +* +* If the HV fakes SEV support, the guest will crash'n'burn +* which is good enough. +*/ + +/* Check for the SME/SEV support leaf */ + eax =0x80000000 ; + ecx =0 ; +native_cpuid (&eax, &ebx, &ecx, &edx); +if (eax <0x8000001f ) +return ; + +/* +* Check for the SME/SEV feature: +* CPUID Fn8000_001F[EAX] +* - Bit 0 - Secure Memory Encryption support +* - Bit 1 - Secure Encrypted Virtualization support +* CPUID Fn8000_001F[EBX] +* - Bits 5:0 - Pagetable bit position used to indicate encryption +*/ + eax =0x8000001f ; + ecx =0 ; +native_cpuid (&eax, &ebx, &ecx, &edx); +/* Check whether SEV is supported */ +if (!(eax &BIT (1 ))) +return ; + +/* * Setup/preliminary detection of SNP. This will be sanity-checked * against CPUID/MSR values later. */ snp =snp_init (bp); -/* Check for the SME/SEV support leaf */ +/* Now repeat the checks with the SNP CPUID table. */ + +/* Recheck the SME/SEV support leaf */ eax =0x80000000 ; ecx =0 ;native_cpuid (&eax, &ebx, &ecx, &edx);
@@ -366,7 +399,7 @@ void sev_enable(struct boot_params *bp)return ;/* -* Check for the SME/SEV feature: +* Recheck for the SME/SEV feature: * CPUID Fn8000_001F[EAX] * - Bit 0 - Secure Memory Encryption support * - Bit 1 - Secure Encrypted Virtualization support
Greg Kroah-Hartman
maintainerPATCH 85/206 x86/linkage: Fix typo of BUILD_VDSO in asm/linkage.h
In reply to Greg Kroah-HartmanFrom: Jinghao Jia <[email protected]>
commit 7324f74d39531262b8e362f228b46512e6bee632 upstream.
The BUILD_VDSO macro was incorrectly spelled as BULID_VDSO in asm/linkage.h. This causes the !defined(BULID_VDSO) directive to always evaluate to true.
Correct the spelling to BUILD_VDSO.
--- arch/x86/include/asm/linkage.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/include/asm/linkage.h +1 -1
@@ -21,7 +21,7 @@#define FUNCTION_PADDING #endif -#if (CONFIG_FUNCTION_ALIGNMENT >8 ) && !defined(__DISABLE_EXPORTS) && !defined(BULID_VDSO ) +#if (CONFIG_FUNCTION_ALIGNMENT >8 ) && !defined(__DISABLE_EXPORTS) && !defined(BUILD_VDSO )# define __FUNC_ALIGN __ALIGN; FUNCTION_PADDING#else # define __FUNC_ALIGN __ALIGN
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 86/206 x86/speculation: Add cpu_show_gds() prototype
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit a57c27c7ad85c420b7de44c6ee56692d51709dda upstream.
The newly added function has two definitions but no prototypes:
drivers/base/cpu.c:605:16: error: no previous prototype for 'cpu_show_gds' [-Werror=missing-prototypes]
Add a declaration next to the other ones for this file to avoid the warning.
--- include/linux/cpu.h | 2 ++ 1 file changed, 2 insertions(+)
include/linux/cpu.h +2 -0
@@ -72,6 +72,8 @@ extern ssize_t cpu_show_retbleed(struct struct device_attribute *attr, char *buf);extern ssize_t cpu_show_spec_rstack_overflow (struct device *dev,struct device_attribute *attr,char *buf); +extern ssize_t cpu_show_gds (struct device *dev, +struct device_attribute *attr,char *buf); extern __printf(4, 5) struct device *cpu_device_create(struct device *parent, void *drvdata,
Greg Kroah-Hartman
maintainerPATCH 87/206 x86: Move gds_ucode_mitigated() declaration to header
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit eb3515dc99c7c85f4170b50838136b2a193f8012 upstream.
The declaration got placed in the .c file of the caller, but that causes a warning for the definition:
arch/x86/kernel/cpu/bugs.c:682:6: error: no previous prototype for 'gds_ucode_mitigated' [-Werror=missing-prototypes]
Move it to a header where both sides can observe it instead.
--- arch/x86/include/asm/processor.h | 2 ++ arch/x86/kvm/x86.c | 2 -- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/x86/include/asm/processor.h +2 -0
@@ -732,4 +732,6 @@ bool arch_is_platform_page(u64 paddr);#define arch_is_platform_page arch_is_platform_page#endif +extern bool gds_ucode_mitigated (void ); +#endif /* _ASM_X86_PROCESSOR_H */
arch/x86/kvm/x86.c +0 -2
@@ -314,8 +314,6 @@ u64 __read_mostly host_xcr0;static struct kmem_cache *x86_emulator_cache; -extern bool gds_ucode_mitigated (void ); -/* * When called, it means the previous get/set msr reached an invalid msr. * Return true if we want to ignore/silent this failed msr access.
Greg Kroah-Hartman
maintainerPATCH 88/206 Revert "PCI: mvebu: Mark driver as BROKEN"
In reply to Greg Kroah-HartmanFrom: Bjorn Helgaas <[email protected]>
commit 3bfc37d92687b4b19056998cebc02f94fbc81427 upstream.
b3574f579ece ("PCI: mvebu: Mark driver as BROKEN") made it impossible to enable the pci-mvebu driver. The driver does have known problems, but as Russell and Uwe reported, it does work in some configurations, so removing it broke some working setups.
Revert b3574f579ece so pci-mvebu is available.
--- drivers/pci/controller/Kconfig | 1 - 1 file changed, 1 deletion(-)
drivers/pci/controller/Kconfig +0 -1
@@ -179,7 +179,6 @@ config PCI_MVEBU depends on MVEBU_MBUS depends on ARM depends on OF - depends on BROKEN select PCI_BRIDGE_EMUL help Add support for Marvell EBU PCIe controller. This PCIe controller
Greg Kroah-Hartman
maintainerPATCH 89/206 drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes
In reply to Greg Kroah-HartmanFrom: Karol Herbst <[email protected]>
commit d5712cd22b9cf109fded1b7f178f4c1888c8b84b upstream.
The original commit adding that check tried to protect the kenrel against a potential invalid NULL pointer access.
However we call nouveau_connector_detect_depth once without a native_mode set on purpose for non LVDS connectors and this broke DP support in a few cases.
--- drivers/gpu/drm/nouveau/nouveau_connector.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nouveau_connector.c +1 -1
@@ -967,7 +967,7 @@ nouveau_connector_get_modes(struct drm_c/* Determine display colour depth for everything except LVDS now, * DP requires this before mode_valid() is called. */ -if (connector->connector_type !=DRM_MODE_CONNECTOR_LVDS && nv_connector->native_mode) +if (connector->connector_type !=DRM_MODE_CONNECTOR_LVDS )nouveau_connector_detect_depth (connector);/* Find the native mode if this is a digital panel, if we didn't
Greg Kroah-Hartman
maintainerPATCH 90/206 netfilter: nf_tables: dont skip expired elements during walk
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
commit 24138933b97b055d486e8064b4a1721702442a9b upstream.
There is an asymmetry between commit/abort and preparation phase if the following conditions are met:
1. set is a verdict map ("1.2.3.4 : jump foo")
2. timeouts are enabled
In this case, following sequence is problematic:
1. element E in set S refers to chain C
2. userspace requests removal of set S
3. kernel does a set walk to decrement chain->use count for all elements from preparation phase
4. kernel does another set walk to remove elements from the commit phase (or another walk to do a chain->use increment for all elements from abort phase)
If E has already expired in 1), it will be ignored during list walk, so its use count won't have been changed.
Then, when set is culled, ->destroy callback will zap the element via nf_tables_set_elem_destroy(), but this function is only safe for elements that have been deactivated earlier from the preparation phase:
lack of earlier deactivate removes the element but leaks the chain use count, which results in a WARN splat when the chain gets removed later, plus a leak of the nft_chain structure.
Update pipapo_get() not to skip expired elements, otherwise flush command reports bogus ENOENT errors.
--- net/netfilter/nf_tables_api.c | 4 ++++ net/netfilter/nft_set_hash.c | 2 -- net/netfilter/nft_set_pipapo.c | 18 ++++++++++++------ net/netfilter/nft_set_rbtree.c | 2 -- 4 files changed, 16 insertions(+), 10 deletions(-)
net/netfilter/nf_tables_api.c +4 -0
@@ -5590,8 +5590,12 @@ static int nf_tables_dump_setelem(constconst struct nft_set_iter *iter, struct nft_set_elem *elem) { + const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);struct nft_set_dump_args *args; +if (nft_set_elem_expired (ext)) +return 0 ; + args = container_of(iter, struct nft_set_dump_args, iter);return nf_tables_fill_setelem (args->skb, set, elem); }
net/netfilter/nft_set_hash.c +0 -2
@@ -278,8 +278,6 @@ static void nft_rhash_walk(const structif (iter->count < iter->skip) goto cont; -if (nft_set_elem_expired (&he->ext)) - goto cont;if (!nft_set_elem_active (&he->ext, iter->genmask)) goto cont;
net/netfilter/nft_set_pipapo.c +12 -6
@@ -566,8 +566,7 @@ next_match: goto out;if (last) { -if (nft_set_elem_expired (&f->mt[b].e->ext) || - (genmask && +if ((genmask && !nft_set_elem_active (&f->mt[b].e->ext, genmask))) goto next_match;
@@ -601,8 +600,17 @@ out:static void *nft_pipapo_get (const struct net *net,const struct nft_set *set,const struct nft_set_elem *elem,unsigned int flags) { -return pipapo_get (net, set, (const u8 *)elem->key.val.data, -nft_genmask_cur (net)); +struct nft_pipapo_elem *ret; + + ret =pipapo_get (net, set, (const u8 *)elem->key.val.data, +nft_genmask_cur (net)); +if (IS_ERR (ret)) +return ret; + +if (nft_set_elem_expired (&ret->ext)) +return ERR_PTR (-ENOENT ); + +return ret; }/**
@@ -2006,8 +2014,6 @@ static void nft_pipapo_walk(const struct goto cont; e = f->mt[r].e; -if (nft_set_elem_expired (&e->ext)) - goto cont; elem.priv = e;
net/netfilter/nft_set_rbtree.c +0 -2
@@ -552,8 +552,6 @@ static void nft_rbtree_walk(const structif (iter->count < iter->skip) goto cont; -if (nft_set_elem_expired (&rbe->ext)) - goto cont;if (!nft_set_elem_active (&rbe->ext, iter->genmask)) goto cont;
Re: [PATCH 6.4 090/206] netfilter: nf_tables: dont skip expired elements during walk
Quoted 3 lines · Greg Kroah-Hartman
From: Florian Westphal <[email protected]>
commit
24138933b97b055d486e8064b4a1721702442a9bupstream.
Just FYI, this change is not correct.
Quoted 5 lines
There is an asymmetry between commit/abort and preparation phase if the following conditions are met:
1. set is a verdict map ("1.2.3.4 : jump foo")
2. timeouts are enabled
[..]
net/netfilter/nft_set_pipapo.c next_match: · line 571
Quoted 11 lines
net/netfilter/nft_set_pipapo.c +1
-2@@ -566,8 +566,7 @@ next_match: goto out;if (last) { -if (nft_set_elem_expired (&f->mt[b].e->ext) || - (genmask && +if ((genmask && !nft_set_elem_active (&f->mt[b].e->ext, genmask))) goto next_match;
This part is bonkers, it papers over the real issue and introduces another bug while at it (insertions for key K will fail if we have a key K that is already expired).
A patch to resolve it is queued on the mailing list and I'll make sure it gets passed to the net tree by this wednesday.
Sorry for the inconvenience, I hope this doesn't interefere with -stable release plans and this is leaves enough time for the fix to make it to -stable too.
Greg Kroah-Hartman
maintainerRe: [PATCH 6.4 090/206] netfilter: nf_tables: dont skip expired elements during walk
Quoted 31 lines · Florian Westphal
Quoted 3 lines · Greg Kroah-Hartman
From: Florian Westphal <[email protected]>
commit
24138933b97b055d486e8064b4a1721702442a9bupstream.Just FYI, this change is not correct.
Quoted 5 lines
There is an asymmetry between commit/abort and preparation phase if the following conditions are met:
1. set is a verdict map ("1.2.3.4 : jump foo")
2. timeouts are enabled[..]
net/netfilter/nft_set_pipapo.c next_match: · line 571
Quoted 11 lines
net/netfilter/nft_set_pipapo.c +1
-2@@ -566,8 +566,7 @@ next_match: goto out;if (last) { -if (nft_set_elem_expired (&f->mt[b].e->ext) || - (genmask && +if ((genmask && !nft_set_elem_active (&f->mt[b].e->ext, genmask))) goto next_match;This part is bonkers, it papers over the real issue and introduces another bug while at it (insertions for key K will fail if we have a key K that is already expired).
Quoted 6 lines
A patch to resolve it is queued on the mailing list and I'll make sure it gets passed to the net tree by this wednesday.
Sorry for the inconvenience, I hope this doesn't interefere with -stable release plans and this is leaves enough time for the fix to make it to -stable too.
Is there an upstream fix for this yet? If so, I can pull it into the stable tree, or should I drop this one for now and wait for the real fix? It's your call.
thanks,
greg k-h
Re: [PATCH 6.4 090/206] netfilter: nf_tables: dont skip expired elements during walk
Quoted 35 lines · Greg Kroah-Hartman
Quoted 34 lines · Florian Westphal
Quoted 3 lines · Greg Kroah-Hartman
From: Florian Westphal <[email protected]>
commit
24138933b97b055d486e8064b4a1721702442a9bupstream.Just FYI, this change is not correct.
Quoted 5 lines
There is an asymmetry between commit/abort and preparation phase if the following conditions are met:
1. set is a verdict map ("1.2.3.4 : jump foo")
2. timeouts are enabled[..]
net/netfilter/nft_set_pipapo.c next_match: · line 571
Quoted 11 lines
net/netfilter/nft_set_pipapo.c +1
-2@@ -566,8 +566,7 @@ next_match: goto out;if (last) { -if (nft_set_elem_expired (&f->mt[b].e->ext) || - (genmask && +if ((genmask && !nft_set_elem_active (&f->mt[b].e->ext, genmask))) goto next_match;This part is bonkers, it papers over the real issue and introduces another bug while at it (insertions for key K will fail if we have a key K that is already expired).
A patch to resolve it is queued on the mailing list and I'll make sure it gets passed to the net tree by this wednesday.
Quoted 7 lines
Quoted 3 lines
Sorry for the inconvenience, I hope this doesn't interefere with -stable release plans and this is leaves enough time for the fix to make it to -stable too.
Is there an upstream fix for this yet? If so, I can pull it into the stable tree, or should I drop this one for now and wait for the real fix? It's your call.
I'd suggest: Drop it for 5.10, 5.15 and 6.1, because these versions are still missing the full series.
Keep it for 6.4 (this already have the full series with fixed) the incremental fix that is flying upstream will event amend this patch.
In summary:
- drop it for 5.10, 5.15 and 6.1
- keep it for 6.4
Thanks
Greg Kroah-Hartman
maintainerRe: [PATCH 6.4 090/206] netfilter: nf_tables: dont skip expired elements during walk
Quoted 47 lines · Pablo Neira Ayuso
Quoted 35 lines · Greg Kroah-Hartman
Quoted 34 lines · Florian Westphal
Quoted 3 lines · Greg Kroah-Hartman
From: Florian Westphal <[email protected]>
commit
24138933b97b055d486e8064b4a1721702442a9bupstream.Just FYI, this change is not correct.
Quoted 5 lines
There is an asymmetry between commit/abort and preparation phase if the following conditions are met:
1. set is a verdict map ("1.2.3.4 : jump foo")
2. timeouts are enabled[..]
net/netfilter/nft_set_pipapo.c next_match: · line 571
Quoted 11 lines
net/netfilter/nft_set_pipapo.c +1
-2@@ -566,8 +566,7 @@ next_match: goto out;if (last) { -if (nft_set_elem_expired (&f->mt[b].e->ext) || - (genmask && +if ((genmask && !nft_set_elem_active (&f->mt[b].e->ext, genmask))) goto next_match;This part is bonkers, it papers over the real issue and introduces another bug while at it (insertions for key K will fail if we have a key K that is already expired).
A patch to resolve it is queued on the mailing list and I'll make sure it gets passed to the net tree by this wednesday.
Quoted 7 lines
Quoted 3 lines
Sorry for the inconvenience, I hope this doesn't interefere with -stable release plans and this is leaves enough time for the fix to make it to -stable too.
Is there an upstream fix for this yet? If so, I can pull it into the stable tree, or should I drop this one for now and wait for the real fix? It's your call.
I'd suggest: Drop it for 5.10, 5.15 and 6.1, because these versions are still missing the full series.
Quoted 7 lines
Keep it for 6.4 (this already have the full series with fixed) the incremental fix that is flying upstream will event amend this patch.
In summary:
- drop it for 5.10, 5.15 and 6.1
- keep it for 6.4
Ok, thanks, now dropped for those trees.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 91/206 netfilter: nf_tables: GC transaction API to avoid race with control plane
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
commit 5f68718b34a531a556f2f50300ead2862278da26 upstream.
The set types rhashtable and rbtree use a GC worker to reclaim memory.
Quoted 1 line
From system work queue, in periodic intervals, a scan of the table is
done.
The major caveat here is that the nft transaction mutex is not held. This causes a race between control plane and GC when they attempt to delete the same element.
We cannot grab the netlink mutex from the work queue, because the control plane has to wait for the GC work queue in case the set is to be removed, so we get following deadlock:
cpu 1 cpu2
GC work transaction comes in , lock nft mutex
`acquire nft mutex // BLOCKS
transaction asks to remove the set set destruction calls cancel_work_sync()
cancel_work_sync will now block forever, because it is waiting for the mutex the caller already owns.
This patch adds a new API that deals with garbage collection in two steps:
1) Lockless GC of expired elements sets on the NFT_SET_ELEM_DEAD_BIT so they are not visible via lookup. Annotate current GC sequence in the GC transaction. Enqueue GC transaction work as soon as it is full. If ruleset is updated, then GC transaction is aborted and retried later.
2) GC work grabs the mutex. If GC sequence has changed then this GC transaction lost race with control plane, abort it as it contains stale references to objects and let GC try again later. If the ruleset is intact, then this GC transaction deactivates and removes the elements and it uses call_rcu() to destroy elements.
Note that no elements are removed from GC lockless path, the _DEAD bit is set and pointers are collected. GC catchall does not remove the elements anymore too. There is a new set->dead flag that is set on to abort the GC transaction to deal with set->ops->destroy() path which removes the remaining elements in the set from commit_release, where no mutex is held.
To deal with GC when mutex is held, which allows safe deactivate and removal, add sync GC API which releases the set element object via call_rcu(). This is used by rbtree and pipapo backends which also perform garbage collection from control plane path.
Since element removal from sets can happen from control plane and element garbage collection/timeout, it is necessary to keep the set structure alive until all elements have been deactivated and destroyed.
We cannot do a cancel_work_sync or flush_work in nft_set_destroy because its called with the transaction mutex held, but the aforementioned async work queue might be blocked on the very mutex that nft_set_destroy() callchain is sitting on.
This gives us the choice of ABBA deadlock or UaF.
To avoid both, add set->refs refcount_t member. The GC API can then increment the set refcount and release it once the elements have been free'd.
Set backends are adapted to use the GC transaction API in a follow up patch entitled:
("netfilter: nf_tables: use gc transaction API in set backends")
This is joint work with Florian Westphal.
--- include/net/netfilter/nf_tables.h | 64 +++++++++ net/netfilter/nf_tables_api.c | 248 ++++++++++++++++++++++++++++++++++++-- 2 files changed, 300 insertions(+), 12 deletions(-)
include/net/netfilter/nf_tables.h +63 -1
@@ -512,6 +512,7 @@ struct nft_set_elem_expr {* * @list: table set list node * @bindings: list of set bindings +* @refs: internal refcounting for async set destruction * @table: table this set belongs to * @net: netnamespace this set belongs to * @name: name of the set
@@ -541,6 +542,7 @@ struct nft_set_elem_expr {struct nft_set {struct list_head list;struct list_head bindings; +refcount_t refs;struct nft_table *table;possible_net_t net;char *name;
@@ -562,7 +564,8 @@ struct nft_set {struct list_head pending_update;/* runtime data below here */ const struct nft_set_ops *ops____cacheline_aligned ; - u16 flags:14, + u16 flags:13, + dead:1, genmask:2;u8 klen;u8 dlen;
@@ -1592,6 +1595,32 @@ static inline void nft_set_elem_clear_buclear_bit (NFT_SET_ELEM_BUSY_BIT , word); } +#define NFT_SET_ELEM_DEAD_MASK (1 << 3) + +#if defined(__LITTLE_ENDIAN_BITFIELD) +#define NFT_SET_ELEM_DEAD_BIT 3 +#elif defined(__BIG_ENDIAN_BITFIELD) +#define NFT_SET_ELEM_DEAD_BIT (BITS_PER_LONG - BITS_PER_BYTE + 3) +#else +#error +#endif + +static inline void nft_set_elem_dead (struct nft_set_ext *ext) +{ +unsigned long *word = (unsigned long *)ext; + +BUILD_BUG_ON (offsetof(struct nft_set_ext , genmask) !=0 ); +set_bit (NFT_SET_ELEM_DEAD_BIT , word); +} + +static inline int nft_set_elem_is_dead (const struct nft_set_ext *ext) +{ +unsigned long *word = (unsigned long *)ext; + +BUILD_BUG_ON (offsetof(struct nft_set_ext , genmask) !=0 ); +return test_bit (NFT_SET_ELEM_DEAD_BIT , word); +} +/** * struct nft_trans - nf_tables object update in transaction *
@@ -1729,6 +1758,38 @@ struct nft_trans_flowtable {#define nft_trans_flowtable_flags (trans) \ (((struct nft_trans_flowtable *)trans->data)->flags) +#define NFT_TRANS_GC_BATCHCOUNT 256 + +struct nft_trans_gc { +struct list_head list; +struct net *net; +struct nft_set *set; +u32 seq; +u8 count; +void *priv[NFT_TRANS_GC_BATCHCOUNT ]; +struct rcu_head rcu; +}; + +struct nft_trans_gc *nft_trans_gc_alloc (struct nft_set *set, +unsigned int gc_seq,gfp_t gfp); +void nft_trans_gc_destroy (struct nft_trans_gc *trans); + +struct nft_trans_gc *nft_trans_gc_queue_async (struct nft_trans_gc *gc, +unsigned int gc_seq,gfp_t gfp); +void nft_trans_gc_queue_async_done (struct nft_trans_gc *gc); + +struct nft_trans_gc *nft_trans_gc_queue_sync (struct nft_trans_gc *gc,gfp_t gfp); +void nft_trans_gc_queue_sync_done (struct nft_trans_gc *trans); + +void nft_trans_gc_elem_add (struct nft_trans_gc *gc,void *priv); + +struct nft_trans_gc *nft_trans_gc_catchall (struct nft_trans_gc *gc, +unsigned int gc_seq); + +void nft_setelem_data_deactivate (const struct net *net, +const struct nft_set *set, +struct nft_set_elem *elem); +int __init nft_chain_filter_init (void );void nft_chain_filter_fini (void );
@@ -1755,6 +1816,7 @@ struct nftables_pernet {struct mutex commit_mutex;u64 table_handle;unsigned int base_seq; +unsigned int gc_seq; };extern unsigned int nf_tables_net_id;
net/netfilter/nf_tables_api.c +237 -11
353 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 92/206 netfilter: nf_tables: adapt set backend to use GC transaction API
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
commit f6c383b8c31a93752a52697f8430a71dcbc46adf upstream.
Use the GC transaction API to replace the old and buggy gc API and the busy mark approach.
No set elements are removed from async garbage collection anymore, instead the _DEAD bit is set on so the set element is not visible from lookup path anymore. Async GC enqueues transaction work that might be aborted and retried later.
rbtree and pipapo set backends does not set on the _DEAD bit from the sync GC path since this runs in control plane path where mutex is held. In this case, set elements are deactivated, removed and then released via RCU callback, sync GC never fails.
--- net/netfilter/nf_tables_api.c | 7 - net/netfilter/nft_set_hash.c | 77 +++++++++++++-------- net/netfilter/nft_set_pipapo.c | 48 ++++++++++--- net/netfilter/nft_set_rbtree.c | 146 ++++++++++++++++++++++++----------------- 4 files changed, 174 insertions(+), 104 deletions(-)
net/netfilter/nf_tables_api.c +2 -5
@@ -6357,7 +6357,6 @@ static void nft_setelem_activate(structif (nft_setelem_is_catchall (set, elem)) {nft_set_elem_change_active (net, set, ext); -nft_set_elem_clear_busy (ext); }else { set->ops->activate (net, set, elem); }
@@ -6372,8 +6371,7 @@ static int nft_setelem_catchall_deactivalist_for_each_entry (catchall, &set->catchall_list, list) { ext =nft_set_elem_ext (set, catchall->elem); -if (!nft_is_active (net, ext) || -nft_set_elem_mark_busy (ext)) +if (!nft_is_active (net, ext))continue ;kfree (elem->priv);
@@ -7083,8 +7081,7 @@ static int nft_set_catchall_flush(constlist_for_each_entry_rcu (catchall, &set->catchall_list, list) { ext =nft_set_elem_ext (set, catchall->elem); -if (!nft_set_elem_active (ext, genmask) || -nft_set_elem_mark_busy (ext)) +if (!nft_set_elem_active (ext, genmask))continue ; elem.priv = catchall->elem;
net/netfilter/nft_set_hash.c +48 -29
140 lines not on this page · raw message
net/netfilter/nft_set_pipapo.c +36 -12
83 lines not on this page · raw message
net/netfilter/nft_set_rbtree.c +88 -58
233 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 93/206 netfilter: nft_set_hash: mark set element as dead when deleting from packet path
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
commit c92db3030492b8ad1d0faace7a93bbcf53850d0c upstream.
Set on the NFT_SET_ELEM_DEAD_BIT flag on this element, instead of performing element removal which might race with an ongoing transaction. Enable gc when dynamic flag is set on since dynset deletion requires garbage collection after this patch.
--- net/netfilter/nft_set_hash.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/netfilter/nft_set_hash.c +4 -2
@@ -249,7 +249,9 @@ static bool nft_rhash_delete(const strucif (he ==NULL )return false; -return rhashtable_remove_fast (&priv->ht, &he->node, nft_rhash_params) ==0 ; +nft_set_elem_dead (&he->ext); + +return true; } static void nft_rhash_walk(const struct nft_ctx *ctx, struct nft_set *set,
@@ -412,7 +414,7 @@ static int nft_rhash_init(const struct nreturn err;INIT_DEFERRABLE_WORK (&priv->gc_work, nft_rhash_gc); -if (set->flags &NFT_SET_TIMEOUT ) +if (set->flags & (NFT_SET_TIMEOUT |NFT_SET_EVAL ))nft_rhash_gc_init (set);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 94/206 iio: imu: lsm6dsx: Fix mount matrix retrieval
In reply to Greg Kroah-HartmanFrom: Alejandro Tafalla <[email protected]>
commit 6811694eb2f6b7a4e97be2029edc7dd6a39460f8 upstream.
The function lsm6dsx_get_acpi_mount_matrix should return an error when ACPI support is not enabled to allow executing iio_read_mount_matrix in the probe function.
--- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c +1 -1
@@ -2687,7 +2687,7 @@ static int lsm6dsx_get_acpi_mount_matrix(struct device *dev,static int lsm6dsx_get_acpi_mount_matrix (struct device *dev,struct iio_mount_matrix *orientation) { -return false; +return -EOPNOTSUPP ; }#endif
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 95/206 iio: core: Prevent invalid memory access when there is no parent
In reply to Greg Kroah-HartmanFrom: Milan Zamazal <[email protected]>
commit b2a69969908fcaf68596dfc04369af0fe2e1d2f7 upstream.
Commit 813665564b3d ("iio: core: Convert to use firmware node handle instead of OF node") switched the kind of nodes to use for label retrieval in device registration. Probably an unwanted change in that commit was that if the device has no parent then NULL pointer is accessed. This is what happens in the stock IIO dummy driver when a new entry is created in configfs:
# mkdir /sys/kernel/config/iio/devices/dummy/foo BUG: kernel NULL pointer dereference, address: ... ... Call Trace: __iio_device_register iio_dummy_probe
Since there seems to be no reason to make a parent device of an IIO dummy device mandatory, let’s prevent the invalid memory access in __iio_device_register when the parent device is NULL. With this change, the IIO dummy driver works fine with configfs.
--- drivers/iio/industrialio-core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/iio/industrialio-core.c +3 -2
@@ -1888,7 +1888,7 @@ static const struct iio_buffer_setup_opsint __iio_device_register (struct iio_dev *indio_dev,struct module *this_mod) {struct iio_dev_opaque *iio_dev_opaque =to_iio_dev_opaque (indio_dev); -struct fwnode_handle *fwnode; +struct fwnode_handle *fwnode =NULL ;int ret;if (!indio_dev->info)
@@ -1899,7 +1899,8 @@ int __iio_device_register(struct iio_dev/* If the calling driver did not initialize firmware node, do it here */ if (dev_fwnode (&indio_dev->dev)) fwnode =dev_fwnode (&indio_dev->dev); -else +/* The default dummy IIO device has no parent */ +else if (indio_dev->dev.parent) fwnode =dev_fwnode (indio_dev->dev.parent);device_set_node (&indio_dev->dev, fwnode);
Greg Kroah-Hartman
maintainerPATCH 96/206 iio: light: bu27034: Fix scale format
In reply to Greg Kroah-HartmanFrom: Matti Vaittinen <[email protected]>
commit d47b9b84292706784482a661324bbc178153781f upstream.
The driver is expecting accuracy of NANOs for intensity scale in raw_write. The IIO core is however defaulting to MICROs. This leads the raw-write of smallest scales to never succeed as correct selector(s) are not found.
Fix this by implementing the .write_raw_get_fmt callback to use NANO accuracy for writes of IIO_CHAN_INFO_SCALE.
--- drivers/iio/light/rohm-bu27034.c | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-)
drivers/iio/light/rohm-bu27034.c +19 -3
@@ -575,7 +575,7 @@ static int bu27034_set_scale(struct bu27034_data *data, int chan,return -EINVAL ;if (chan ==BU27034_CHAN_ALS ) { -if (val ==0 && val2 ==1000 ) +if (val ==0 && val2 ==1000000 )return 0 ;return -EINVAL ;
@@ -587,7 +587,7 @@ static int bu27034_set_scale(struct bu27034_data *data, int chan, goto unlock_out; ret =iio_gts_find_gain_sel_for_scale_using_time (&data->gts, time_sel, - val, val2 *1000 , &gain_sel); + val, val2, &gain_sel);if (ret) {/* * Could not support scale with given time. Need to change time.
@@ -624,7 +624,7 @@ static int bu27034_set_scale(struct bu27034_data *data, int chan,/* Can we provide requested scale with this time? */ ret =iio_gts_find_gain_sel_for_scale_using_time ( - &data->gts, new_time_sel, val, val2 *1000 , + &data->gts, new_time_sel, val, val2, &gain_sel);if (ret)continue ;
@@ -1217,6 +1217,21 @@ static int bu27034_read_raw(struct iio_dev *idev, } } +static int bu27034_write_raw_get_fmt (struct iio_dev *indio_dev, +struct iio_chan_spec const *chan, +long mask) +{ + +switch (mask) { +case IIO_CHAN_INFO_SCALE : +return IIO_VAL_INT_PLUS_NANO ; +case IIO_CHAN_INFO_INT_TIME : +return IIO_VAL_INT_PLUS_MICRO ; +default : +return -EINVAL ; + } +} +static int bu27034_write_raw (struct iio_dev *idev,struct iio_chan_spec const *chan,int val,int val2,long mask)
@@ -1267,6 +1282,7 @@ static int bu27034_read_avail(struct iio_dev *idev,static const struct iio_info bu27034_info = { .read_raw = &bu27034_read_raw, .write_raw = &bu27034_write_raw, + .write_raw_get_fmt = &bu27034_write_raw_get_fmt, .read_avail = &bu27034_read_avail, };
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 97/206 interconnect: qcom: Add support for mask-based BCMs
In reply to Greg Kroah-HartmanFrom: Mike Tipton <[email protected]>
commit d8630f050d3fd2079f8617dd6c00c6509109c755 upstream.
Some BCMs aren't directly associated with the data path (i.e. ACV) and therefore don't communicate using BW. Instead, they are simply enabled/disabled with a simple bit mask. Add support for these.
Origin commit retrieved from:
https://git.codelinaro.org/clo/la/kernel/msm-5.15/-/commit/2d1573e0206998151b342e6b52a4c0f7234d7e36
--- drivers/interconnect/qcom/bcm-voter.c | 5 +++++ drivers/interconnect/qcom/icc-rpmh.h | 2 ++ 2 files changed, 7 insertions(+)
drivers/interconnect/qcom/bcm-voter.c +5 -0
@@ -83,6 +83,11 @@ static void bcm_aggregate(struct qcom_ic temp = agg_peak[bucket] * bcm->vote_scale; bcm->vote_y[bucket] =bcm_div (temp, bcm->aux_data.unit); + +if (bcm->enable_mask && (bcm->vote_x[bucket] || bcm->vote_y[bucket])) { + bcm->vote_x[bucket] =0 ; + bcm->vote_y[bucket] = bcm->enable_mask; + } } if (bcm->keepalive && bcm->vote_x[QCOM_ICC_BUCKET_AMC] == 0 &&
drivers/interconnect/qcom/icc-rpmh.h +2 -0
@@ -81,6 +81,7 @@ struct qcom_icc_node {* @vote_x: aggregated threshold values, represents sum_bw when @type is bw bcm * @vote_y: aggregated threshold values, represents peak_bw when @type is bw bcm * @vote_scale: scaling factor for vote_x and vote_y +* @enable_mask: optional mask to send as vote instead of vote_x/vote_y * @dirty: flag used to indicate whether the bcm needs to be committed * @keepalive: flag used to indicate whether a keepalive is required * @aux_data: auxiliary data used when calculating threshold values and
@@ -97,6 +98,7 @@ struct qcom_icc_bcm {u64 vote_x[QCOM_ICC_NUM_BUCKETS ];u64 vote_y[QCOM_ICC_NUM_BUCKETS ];u64 vote_scale; +u32 enable_mask;bool dirty;bool keepalive;struct bcm_db aux_data;
Greg Kroah-Hartman
maintainerPATCH 98/206 interconnect: qcom: sa8775p: add enable_mask for bcm nodes
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
commit 3cb11fe244d516f757c1022cfa971528d525fe65 upstream.
Set the proper enable_mask the ACV node requiring such value to be used instead of a bandwidth when voting.
The masks was copied from the downstream implementation at [1].
--- drivers/interconnect/qcom/sa8775p.c | 1 + 1 file changed, 1 insertion(+)
drivers/interconnect/qcom/sa8775p.c +1 -0
@@ -1873,6 +1873,7 @@ static struct qcom_icc_node srvc_snoc =static struct qcom_icc_bcm bcm_acv = { .name ="ACV" , + .enable_mask =0x8 , .num_nodes =1 , .nodes = { &ebi }, };
Greg Kroah-Hartman
maintainerPATCH 99/206 interconnect: qcom: sm8450: add enable_mask for bcm nodes
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
commit be02db24cf840bc0fdfbecc78ad803619dd143e6 upstream.
Set the proper enable_mask to nodes requiring such value to be used instead of a bandwidth when voting.
The masks were copied from the downstream implementation at [1].
--- drivers/interconnect/qcom/sm8450.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/interconnect/qcom/sm8450.c +9 -0
@@ -1337,6 +1337,7 @@ static struct qcom_icc_node qns_mem_noc_static struct qcom_icc_bcm bcm_acv = { .name ="ACV" , + .enable_mask =0x8 , .num_nodes =1 , .nodes = { &ebi }, };
@@ -1349,6 +1350,7 @@ static struct qcom_icc_bcm bcm_ce0 = {static struct qcom_icc_bcm bcm_cn0 = { .name ="CN0" , + .enable_mask =0x1 , .keepalive = true, .num_nodes =55 , .nodes = { &qnm_gemnoc_cnoc, &qnm_gemnoc_pcie,
@@ -1383,6 +1385,7 @@ static struct qcom_icc_bcm bcm_cn0 = {static struct qcom_icc_bcm bcm_co0 = { .name ="CO0" , + .enable_mask =0x1 , .num_nodes =2 , .nodes = { &qxm_nsp, &qns_nsp_gemnoc }, };
@@ -1403,6 +1406,7 @@ static struct qcom_icc_bcm bcm_mm0 = {static struct qcom_icc_bcm bcm_mm1 = { .name ="MM1" , + .enable_mask =0x1 , .num_nodes =12 , .nodes = { &qnm_camnoc_hf, &qnm_camnoc_icp, &qnm_camnoc_sf, &qnm_mdp,
@@ -1445,6 +1449,7 @@ static struct qcom_icc_bcm bcm_sh0 = {static struct qcom_icc_bcm bcm_sh1 = { .name ="SH1" , + .enable_mask =0x1 , .num_nodes =7 , .nodes = { &alm_gpu_tcu, &alm_sys_tcu, &qnm_nsp_gemnoc, &qnm_pcie,
@@ -1461,6 +1466,7 @@ static struct qcom_icc_bcm bcm_sn0 = {static struct qcom_icc_bcm bcm_sn1 = { .name ="SN1" , + .enable_mask =0x1 , .num_nodes =4 , .nodes = { &qhm_gic, &qxm_pimem, &xm_gic, &qns_gemnoc_gc },
@@ -1492,6 +1498,7 @@ static struct qcom_icc_bcm bcm_sn7 = {static struct qcom_icc_bcm bcm_acv_disp = { .name ="ACV" , + .enable_mask =0x1 , .num_nodes =1 , .nodes = { &ebi_disp }, };
@@ -1510,6 +1517,7 @@ static struct qcom_icc_bcm bcm_mm0_dispstatic struct qcom_icc_bcm bcm_mm1_disp = { .name ="MM1" , + .enable_mask =0x1 , .num_nodes =3 , .nodes = { &qnm_mdp_disp, &qnm_rot_disp, &qns_mem_noc_sf_disp },
@@ -1523,6 +1531,7 @@ static struct qcom_icc_bcm bcm_sh0_dispstatic struct qcom_icc_bcm bcm_sh1_disp = { .name ="SH1" , + .enable_mask =0x1 , .num_nodes =1 , .nodes = { &qnm_pcie_disp }, };
Greg Kroah-Hartman
maintainerPATCH 100/206 interconnect: qcom: sm8550: add enable_mask for bcm nodes
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
commit 0dc82bd9e4627065dbc6ac8468296aa18f13c840 upstream.
Set the proper enable_mask to nodes requiring such value to be used instead of a bandwidth when voting.
The masks were copied from the downstream implementation at [1].
--- drivers/interconnect/qcom/sm8550.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
drivers/interconnect/qcom/sm8550.c +17 -0
@@ -1473,6 +1473,7 @@ static struct qcom_icc_node qns_mem_noc_sf_cam_ife_2 = {static struct qcom_icc_bcm bcm_acv = { .name ="ACV" , + .enable_mask =0x8 , .num_nodes =1 , .nodes = { &ebi }, };
@@ -1485,6 +1486,7 @@ static struct qcom_icc_bcm bcm_ce0 = {static struct qcom_icc_bcm bcm_cn0 = { .name ="CN0" , + .enable_mask =0x1 , .keepalive = true, .num_nodes =54 , .nodes = { &qsm_cfg, &qhs_ahb2phy0,
@@ -1524,6 +1526,7 @@ static struct qcom_icc_bcm bcm_cn1 = {static struct qcom_icc_bcm bcm_co0 = { .name ="CO0" , + .enable_mask =0x1 , .num_nodes =2 , .nodes = { &qxm_nsp, &qns_nsp_gemnoc }, };
@@ -1549,6 +1552,7 @@ static struct qcom_icc_bcm bcm_mm0 = {static struct qcom_icc_bcm bcm_mm1 = { .name ="MM1" , + .enable_mask =0x1 , .num_nodes =8 , .nodes = { &qnm_camnoc_hf, &qnm_camnoc_icp, &qnm_camnoc_sf, &qnm_vapss_hcp,
@@ -1589,6 +1593,7 @@ static struct qcom_icc_bcm bcm_sh0 = {static struct qcom_icc_bcm bcm_sh1 = { .name ="SH1" , + .enable_mask =0x1 , .num_nodes =13 , .nodes = { &alm_gpu_tcu, &alm_sys_tcu, &chm_apps, &qnm_gpu,
@@ -1608,6 +1613,7 @@ static struct qcom_icc_bcm bcm_sn0 = {static struct qcom_icc_bcm bcm_sn1 = { .name ="SN1" , + .enable_mask =0x1 , .num_nodes =3 , .nodes = { &qhm_gic, &xm_gic, &qns_gemnoc_gc },
@@ -1633,6 +1639,7 @@ static struct qcom_icc_bcm bcm_sn7 = {static struct qcom_icc_bcm bcm_acv_disp = { .name ="ACV" , + .enable_mask =0x1 , .num_nodes =1 , .nodes = { &ebi_disp }, };
@@ -1657,12 +1664,14 @@ static struct qcom_icc_bcm bcm_sh0_disp = {static struct qcom_icc_bcm bcm_sh1_disp = { .name ="SH1" , + .enable_mask =0x1 , .num_nodes =2 , .nodes = { &qnm_mnoc_hf_disp, &qnm_pcie_disp }, };static struct qcom_icc_bcm bcm_acv_cam_ife_0 = { .name ="ACV" , + .enable_mask =0x0 , .num_nodes =1 , .nodes = { &ebi_cam_ife_0 }, };
@@ -1681,6 +1690,7 @@ static struct qcom_icc_bcm bcm_mm0_cam_ife_0 = {static struct qcom_icc_bcm bcm_mm1_cam_ife_0 = { .name ="MM1" , + .enable_mask =0x1 , .num_nodes =4 , .nodes = { &qnm_camnoc_hf_cam_ife_0, &qnm_camnoc_icp_cam_ife_0, &qnm_camnoc_sf_cam_ife_0, &qns_mem_noc_sf_cam_ife_0 },
@@ -1694,6 +1704,7 @@ static struct qcom_icc_bcm bcm_sh0_cam_ife_0 = {static struct qcom_icc_bcm bcm_sh1_cam_ife_0 = { .name ="SH1" , + .enable_mask =0x1 , .num_nodes =3 , .nodes = { &qnm_mnoc_hf_cam_ife_0, &qnm_mnoc_sf_cam_ife_0, &qnm_pcie_cam_ife_0 },
@@ -1701,6 +1712,7 @@ static struct qcom_icc_bcm bcm_sh1_cam_ife_0 = {static struct qcom_icc_bcm bcm_acv_cam_ife_1 = { .name ="ACV" , + .enable_mask =0x0 , .num_nodes =1 , .nodes = { &ebi_cam_ife_1 }, };
@@ -1719,6 +1731,7 @@ static struct qcom_icc_bcm bcm_mm0_cam_ife_1 = {static struct qcom_icc_bcm bcm_mm1_cam_ife_1 = { .name ="MM1" , + .enable_mask =0x1 , .num_nodes =4 , .nodes = { &qnm_camnoc_hf_cam_ife_1, &qnm_camnoc_icp_cam_ife_1, &qnm_camnoc_sf_cam_ife_1, &qns_mem_noc_sf_cam_ife_1 },
@@ -1732,6 +1745,7 @@ static struct qcom_icc_bcm bcm_sh0_cam_ife_1 = {static struct qcom_icc_bcm bcm_sh1_cam_ife_1 = { .name ="SH1" , + .enable_mask =0x1 , .num_nodes =3 , .nodes = { &qnm_mnoc_hf_cam_ife_1, &qnm_mnoc_sf_cam_ife_1, &qnm_pcie_cam_ife_1 },
@@ -1739,6 +1753,7 @@ static struct qcom_icc_bcm bcm_sh1_cam_ife_1 = {static struct qcom_icc_bcm bcm_acv_cam_ife_2 = { .name ="ACV" , + .enable_mask =0x0 , .num_nodes =1 , .nodes = { &ebi_cam_ife_2 }, };
@@ -1757,6 +1772,7 @@ static struct qcom_icc_bcm bcm_mm0_cam_ife_2 = {static struct qcom_icc_bcm bcm_mm1_cam_ife_2 = { .name ="MM1" , + .enable_mask =0x1 , .num_nodes =4 , .nodes = { &qnm_camnoc_hf_cam_ife_2, &qnm_camnoc_icp_cam_ife_2, &qnm_camnoc_sf_cam_ife_2, &qns_mem_noc_sf_cam_ife_2 },
@@ -1770,6 +1786,7 @@ static struct qcom_icc_bcm bcm_sh0_cam_ife_2 = {static struct qcom_icc_bcm bcm_sh1_cam_ife_2 = { .name ="SH1" , + .enable_mask =0x1 , .num_nodes =3 , .nodes = { &qnm_mnoc_hf_cam_ife_2, &qnm_mnoc_sf_cam_ife_2, &qnm_pcie_cam_ife_2 },
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 101/206 selftests: forwarding: tc_tunnel_key: Make filters more specific
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit 11604178fdc3404d46518e5332f1fe865d30c4a1 upstream.
The test installs filters that match on various IP fragments (e.g., no fragment, first fragment) and expects a certain amount of packets to hit each filter. This is problematic as the filters are not specific enough and can match IP packets (e.g., IGMP) generated by the stack, resulting in failures [1].
Fix by making the filters more specific and match on more fields in the IP header: Source IP, destination IP and protocol.
[1]
# timeout set to 0 # selftests: net/forwarding: tc_tunnel_key.sh # TEST: tunnel_key nofrag (skip_hw) [FAIL] # packet smaller than MTU was not tunneled # INFO: Could not test offloaded functionality not ok 89 selftests: net/forwarding: tc_tunnel_key.sh # exit=1
--- tools/testing/selftests/net/forwarding/tc_tunnel_key.sh | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
tools/testing/selftests/net/forwarding/tc_tunnel_key.sh +6 -3
@@ -104,11 +104,14 @@ tunnel_key_nofrag_test() local i tc filter add dev $swp1 ingress protocol ip pref 100 handle 100 \ - flower ip_flags nofrag action drop + flower src_ip 192.0.2.1 dst_ip 192.0.2.2 ip_proto udp \ + ip_flags nofrag action drop tc filter add dev $swp1 ingress protocol ip pref 101 handle 101 \ - flower ip_flags firstfrag action drop + flower src_ip 192.0.2.1 dst_ip 192.0.2.2 ip_proto udp \ + ip_flags firstfrag action drop tc filter add dev $swp1 ingress protocol ip pref 102 handle 102 \ - flower ip_flags nofirstfrag action drop + flower src_ip 192.0.2.1 dst_ip 192.0.2.2 ip_proto udp \ + ip_flags nofirstfrag action drop # test 'nofrag' set tc filter add dev h1-et egress protocol all pref 1 handle 1 matchall $tcflags \
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 102/206 selftests: forwarding: ethtool_mm: Skip when MAC Merge is not supported
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit 23fb886a1ced6f885ddd541cc86d45c415ce705c upstream.
MAC Merge cannot be tested with veth pairs, resulting in failures:
# ./ethtool_mm.sh
[...]
TEST: Manual configuration with verification: swp1 to swp2 [FAIL]
Verification did not succeedFix by skipping the test when the interfaces do not support MAC Merge.
--- .../selftests/net/forwarding/ethtool_mm.sh | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
tools/testing/selftests/net/forwarding/ethtool_mm.sh +13 -5
@@ -258,11 +258,6 @@ h2_destroy() setup_prepare() { - check_ethtool_mm_support - check_tc_fp_support - require_command lldptool - bail_on_lldpad "autoconfigure the MAC Merge layer" "configure it manually" - h1=${NETIFS[p1]} h2=${NETIFS[p2]}
@@ -278,6 +273,19 @@ cleanup() h1_destroy } +check_ethtool_mm_support +check_tc_fp_support +require_command lldptool +bail_on_lldpad "autoconfigure the MAC Merge layer" "configure it manually" + +for netif in ${NETIFS[@]}; do + ethtool --show-mm $netif 2>&1 &> /dev/null + if [[ $? -ne 0 ]]; then + echo "SKIP: $netif does not support MAC Merge" + exit $ksft_skip + fi +done + trap cleanup EXIT setup_prepare
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 103/206 selftests: forwarding: bridge_mdb_max: Check iproute2 version
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit 6bdf3d9765f4e0eebfd919e70acc65bce5daa9b9 upstream.
The selftest relies on iproute2 changes present in version 6.3, but the test does not check for it, resulting in errors:
# ./bridge_mdb_max.sh
INFO: 802.1d tests
TEST: cfg4: port: ngroups reporting [FAIL]
Number of groups was null, now is null, but 5 expected
TEST: ctl4: port: ngroups reporting [FAIL]
Number of groups was null, now is null, but 5 expected
TEST: cfg6: port: ngroups reporting [FAIL]
Number of groups was null, now is null, but 5 expected
[...]Fix by skipping the test if iproute2 is too old.
--- tools/testing/selftests/net/forwarding/bridge_mdb_max.sh | 5 +++++ 1 file changed, 5 insertions(+)
tools/testing/selftests/net/forwarding/bridge_mdb_max.sh +5 -0
@@ -1328,6 +1328,11 @@ test_8021qvs() switch_destroy } +if ! bridge link help 2>&1 | grep -q "mcast_max_groups"; then + echo "SKIP: iproute2 too old, missing bridge \"mcast_max_groups\" support" + exit $ksft_skip +fi + trap cleanup EXIT setup_prepare
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 104/206 selftests: forwarding: bridge_mdb: Check iproute2 version
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit ab2eda04e2c2116910b9d77ccc82e727efa71d49 upstream.
The selftest relies on iproute2 changes present in version 6.3, but the test does not check for it, resulting in error:
# ./bridge_mdb.sh
INFO: # Host entries configuration tests
TEST: Common host entries configuration tests (IPv4) [FAIL]
Managed to add IPv4 host entry with a filter mode
TEST: Common host entries configuration tests (IPv6) [FAIL]
Managed to add IPv6 host entry with a filter mode
TEST: Common host entries configuration tests (L2) [FAIL]
Managed to add L2 host entry with a filter mode
INFO: # Port group entries configuration tests - (*, G) Command "replace" is unknown, try "bridge mdb help". [...]
Fix by skipping the test if iproute2 is too old.
--- tools/testing/selftests/net/forwarding/bridge_mdb.sh | 5 +++++ 1 file changed, 5 insertions(+)
tools/testing/selftests/net/forwarding/bridge_mdb.sh +5 -0
@@ -1206,6 +1206,11 @@ ctrl_test() ctrl_mldv2_is_in_test } +if ! bridge mdb help 2>&1 | grep -q "replace"; then + echo "SKIP: iproute2 too old, missing bridge mdb replace support" + exit $ksft_skip +fi + trap cleanup EXIT setup_prepare
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 105/206 KVM: arm64: Fix hardware enable/disable flows for pKVM
In reply to Greg Kroah-HartmanFrom: Raghavendra Rao Ananta <[email protected]>
commit c718ca0e99401d80d2480c08e1b02cf5f7cd7033 upstream.
When running in protected mode, the hyp stub is disabled after pKVM is initialized, meaning the host cannot enable/disable the hyp at runtime. As such, kvm_arm_hardware_enabled is always 1 after initialization, and kvm_arch_hardware_enable() never enables the vgic maintenance irq or timer irqs.
Unconditionally enable/disable the vgic + timer irqs in the respective calls, instead relying on the percpu bookkeeping in the generic code to keep track of which cpus have the interrupts unmasked.
--- arch/arm64/kvm/arm.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-)
arch/arm64/kvm/arm.c +4 -11
@@ -1800,8 +1800,6 @@ static void _kvm_arch_hardware_enable(voint kvm_arch_hardware_enable (void ) { -int was_enabled; -/* * Most calls to this function are made with migration * disabled, but not with preemption disabled. The former is
@@ -1810,13 +1808,10 @@ int kvm_arch_hardware_enable(void)*/ preempt_disable (); - was_enabled =__this_cpu_read (kvm_arm_hardware_enabled);_kvm_arch_hardware_enable (NULL ); -if (!was_enabled) { -kvm_vgic_cpu_up (); -kvm_timer_cpu_up (); - } +kvm_vgic_cpu_up (); +kvm_timer_cpu_up ();preempt_enable ();
@@ -1833,10 +1828,8 @@ static void _kvm_arch_hardware_disable(vvoid kvm_arch_hardware_disable (void ) { -if (__this_cpu_read (kvm_arm_hardware_enabled)) { -kvm_timer_cpu_down (); -kvm_vgic_cpu_down (); - } +kvm_timer_cpu_down (); +kvm_vgic_cpu_down ();if (!is_protected_kvm_enabled ())_kvm_arch_hardware_disable (NULL );
Greg Kroah-Hartman
maintainerPATCH 106/206 dmaengine: xilinx: xdma: Fix typo
In reply to Greg Kroah-HartmanFrom: Miquel Raynal <[email protected]>
commit 422dbc66b7702ae797326d5480c3c9b6467053da upstream.
Probably a copy/paste error with the previous block, here we are actually managing C2H IRQs.
--- drivers/dma/xilinx/xdma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dma/xilinx/xdma.c +1 -1
@@ -717,7 +717,7 @@ static int xdma_irq_init(struct xdma_dev ret =request_irq (irq, xdma_channel_isr,0 ,"xdma-c2h-channel" , &xdev->c2h_chans[j]);if (ret) { -xdma_err (xdev,"H2C channel%d request irq%d failed: %d" , +xdma_err (xdev,"C2H channel%d request irq%d failed: %d" , j, irq, ret); goto failed_init_c2h; }
Greg Kroah-Hartman
maintainerPATCH 107/206 dmaengine: xilinx: xdma: Fix Judgment of the return value
In reply to Greg Kroah-HartmanFrom: Minjie Du <[email protected]>
commit a68b48afc050a9456ed4ed19d8755e0f925b44e6 upstream.
Fix: make IS_ERR() judge the devm_ioremap_resource() function return.
--- drivers/dma/xilinx/xdma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dma/xilinx/xdma.c +1 -1
@@ -894,7 +894,7 @@ static int xdma_probe(struct platform_de } reg_base =devm_ioremap_resource (&pdev->dev, res); -if (!reg_base) { +if (IS_ERR (reg_base)) {xdma_err (xdev,"ioremap failed" ); goto failed; }
Greg Kroah-Hartman
maintainerPATCH 108/206 selftests/bpf: fix a CI failure caused by vsock sockmap test
In reply to Greg Kroah-HartmanFrom: Xu Kuohai <[email protected]>
commit 90f0074cd9f9a24b7b6c4d5afffa676aee48c0e9 upstream.
BPF CI has reported the following failure:
Error: #200/79 sockmap_listen/sockmap VSOCK test_vsock_redir
Error: #200/79 sockmap_listen/sockmap VSOCK test_vsock_redir ./test_progs:vsock_unix_redir_connectible:1506: egress: write: Transport endpoint is not connected vsock_unix_redir_connectible:FAIL:1506 ./test_progs:vsock_unix_redir_connectible:1506: ingress: write: Transport endpoint is not connected vsock_unix_redir_connectible:FAIL:1506 ./test_progs:vsock_unix_redir_connectible:1506: egress: write: Transport endpoint is not connected vsock_unix_redir_connectible:FAIL:1506 ./test_progs:vsock_unix_redir_connectible:1514: ingress: recv() err, errno=11 vsock_unix_redir_connectible:FAIL:1514 ./test_progs:vsock_unix_redir_connectible:1518: ingress: vsock socket map failed, a != b vsock_unix_redir_connectible:FAIL:1518 ./test_progs:vsock_unix_redir_connectible:1525: ingress: want pass count 1, have 0
It’s because the recv(... MSG_DONTWAIT) syscall in the test case is called before the queued work sk_psock_backlog() in the kernel finishes executing. So the data to be read is still queued in psock->ingress_skb and cannot be read by the user program. Therefore, the non-blocking recv() reads nothing and reports an EAGAIN error.
So replace recv(... MSG_DONTWAIT) with xrecv_nonblock(), which calls select() to wait for data to be readable or timeout before calls recv().
--- tools/testing/selftests/bpf/prog_tests/sockmap_listen.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/bpf/prog_tests/sockmap_listen.c +1 -1
@@ -1432,7 +1432,7 @@ static void vsock_unix_redir_connectible(int sock_mapfd, int verd_mapfd,if (n <1 ) goto out; - n =recv (mode ==REDIR_INGRESS ? u0 : u1, &b,sizeof (b),MSG_DONTWAIT ); + n =xrecv_nonblock (mode ==REDIR_INGRESS ? u0 : u1, &b,sizeof (b),0 );if (n <0 )FAIL ("%s: recv() err, errno=%d" , log_prefix, errno);if (n ==0 )
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 109/206 selftests/rseq: Fix build with undefined __weak
In reply to Greg Kroah-HartmanFrom: Mark Brown <[email protected]>
commit d5ad9aae13dcced333c1a7816ff0a4fbbb052466 upstream.
Commit 3bcbc20942db ("selftests/rseq: Play nice with binaries statically linked against glibc 2.35+") which is now in Linus' tree introduced uses of __weak but did nothing to ensure that a definition is provided for it resulting in build failures for the rseq tests:
rseq.c:41:1: error: unknown type name '__weak' __weak ptrdiff_t __rseq_offset;
^
rseq.c:41:17: error: expected ';' after top level declarator
__weak ptrdiff_t __rseq_offset;
^
;rseq.c:42:1: error: unknown type name '__weak'__weak unsigned int __rseq_size;
^
rseq.c:43:1: error: unknown type name '__weak'__weak unsigned int __rseq_flags;
Fix this by using the definition from tools/include compiler.h.
Message-Id: <[email protected]>
--- tools/testing/selftests/rseq/Makefile | 4 +++- tools/testing/selftests/rseq/rseq.c | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-)
tools/testing/selftests/rseq/Makefile +3 -1
@@ -4,8 +4,10 @@ ifneq ($(shell $(CC) --version 2>&1 | he CLANG_FLAGS += -no-integrated-as endif +top_srcdir = ../../../.. + CFLAGS += -O2 -Wall -g -I./ $(KHDR_INCLUDES) -L$(OUTPUT) -Wl,-rpath=./ \ - $(CLANG_FLAGS) + $(CLANG_FLAGS) -I$(top_srcdir)/tools/include LDLIBS += -lpthread -ldl # Own dependencies because we only want to build against 1st prerequisite, but
tools/testing/selftests/rseq/rseq.c +2 -0
@@ -31,6 +31,8 @@#include <sys/auxv.h> #include <linux/auxvec.h> +#include <linux/compiler.h> +#include "../kselftest.h" #include "rseq.h"
Greg Kroah-Hartman
maintainerPATCH 110/206 selftests: forwarding: Add a helper to skip test when using veth pairs
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit 66e131861ab7bf754b50813216f5c6885cd32d63 upstream.
A handful of tests require physical loopbacks to be used instead of veth pairs. Add a helper that these tests will invoke in order to be skipped when executed with veth pairs.
--- tools/testing/selftests/net/forwarding/lib.sh | 11 +++++++++++ 1 file changed, 11 insertions(+)
tools/testing/selftests/net/forwarding/lib.sh +11 -0
@@ -164,6 +164,17 @@ check_port_mab_support() fi } +skip_on_veth() +{ + local kind=$(ip -j -d link show dev ${NETIFS[p1]} | + jq -r '.[].linkinfo.info_kind') + + if [[ $kind == veth ]]; then + echo "SKIP: Test cannot be run with veth pairs" + exit $ksft_skip + fi +} + if [[ "$(id -u)" -ne 0 ]]; then echo "SKIP: need root privileges" exit $ksft_skip
Greg Kroah-Hartman
maintainerPATCH 111/206 selftests: forwarding: ethtool: Skip when using veth pairs
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit 60a36e21915c31c0375d9427be9406aa8ce2ec34 upstream.
Auto-negotiation cannot be tested with veth pairs, resulting in failures:
# ./ethtool.sh
TEST: force of same speed autoneg off [FAIL]
error in configuration. swp1 speed Not autoneg off
[...]Fix by skipping the test when used with veth pairs.
--- tools/testing/selftests/net/forwarding/ethtool.sh | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/net/forwarding/ethtool.sh +2 -0
@@ -286,6 +286,8 @@ different_speeds_autoneg_on() ethtool -s $h1 autoneg on } +skip_on_veth + trap cleanup EXIT setup_prepare
Greg Kroah-Hartman
maintainerPATCH 112/206 selftests: forwarding: ethtool_extended_state: Skip when using veth pairs
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit b3d9305e60d121dac20a77b6847c4cf14a4c0001 upstream.
Ethtool extended state cannot be tested with veth pairs, resulting in failures:
# ./ethtool_extended_state.sh
TEST: Autoneg, No partner detected [FAIL]
Expected "Autoneg", got "Link detected: no"
[...]Fix by skipping the test when used with veth pairs.
--- tools/testing/selftests/net/forwarding/ethtool_extended_state.sh | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/net/forwarding/ethtool_extended_state.sh +2 -0
@@ -108,6 +108,8 @@ no_cable() ip link set dev $swp3 down } +skip_on_veth + setup_prepare tests_run
Greg Kroah-Hartman
maintainerPATCH 113/206 selftests: forwarding: hw_stats_l3_gre: Skip when using veth pairs
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit 9a711cde07c245a163d95eee5b42ed1871e73236 upstream.
Layer 3 hardware stats cannot be used when the underlying interfaces are veth pairs, resulting in failures:
# ./hw_stats_l3_gre.sh
TEST: ping gre flat [ OK ]
TEST: Test rx packets: [FAIL]
Traffic not reflected in the counter: 0 -> 0
TEST: Test tx packets: [FAIL]
Traffic not reflected in the counter: 0 -> 0Fix by skipping the test when used with veth pairs.
--- tools/testing/selftests/net/forwarding/hw_stats_l3_gre.sh | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/net/forwarding/hw_stats_l3_gre.sh +2 -0
@@ -99,6 +99,8 @@ test_stats_rx() test_stats g2a rx } +skip_on_veth + trap cleanup EXIT setup_prepare
Greg Kroah-Hartman
maintainerPATCH 114/206 selftests: forwarding: Skip test when no interfaces are specified
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit d72c83b1e4b4a36a38269c77a85ff52f95eb0d08 upstream.
As explained in [1], the forwarding selftests are meant to be run with either physical loopbacks or veth pairs. The interfaces are expected to be specified in a user-provided forwarding.config file or as command line arguments. By default, this file is not present and the tests fail:
# make -C tools/testing/selftests TARGETS=net/forwarding run_tests [...] TAP version 13 1..102 # timeout set to 45 # selftests: net/forwarding: bridge_igmp.sh # Command line is not complete. Try option "help" # Failed to create netif not ok 1 selftests: net/forwarding: bridge_igmp.sh # exit=1 [...]
Fix by skipping a test if interfaces are not provided either via the configuration file or command line arguments.
# make -C tools/testing/selftests TARGETS=net/forwarding run_tests [...] TAP version 13 1..102 # timeout set to 45 # selftests: net/forwarding: bridge_igmp.sh # SKIP: Cannot create interface. Name not specified ok 1 selftests: net/forwarding: bridge_igmp.sh # SKIP
[1] tools/testing/selftests/net/forwarding/README
--- tools/testing/selftests/net/forwarding/lib.sh | 5 +++++ 1 file changed, 5 insertions(+)
tools/testing/selftests/net/forwarding/lib.sh +5 -0
@@ -237,6 +237,11 @@ create_netif_veth() for ((i = 1; i <= NUM_NETIFS; ++i)); do local j=$((i+1)) + if [ -z ${NETIFS[p$i]} ]; then + echo "SKIP: Cannot create interface. Name not specified" + exit $ksft_skip + fi + ip link show dev ${NETIFS[p$i]} &> /dev/null if [[ $? -ne 0 ]]; then ip link add ${NETIFS[p$i]} type veth \
Greg Kroah-Hartman
maintainerPATCH 115/206 selftests: forwarding: Switch off timeout
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit 0529883ad102f6c04e19fb7018f31e1bda575bbe upstream.
The default timeout for selftests is 45 seconds, but it is not enough for forwarding selftests which can takes minutes to finish depending on the number of tests cases:
# make -C tools/testing/selftests TARGETS=net/forwarding run_tests TAP version 13 1..102 # timeout set to 45 # selftests: net/forwarding: bridge_igmp.sh # TEST: IGMPv2 report 239.10.10.10 [ OK ] # TEST: IGMPv2 leave 239.10.10.10 [ OK ] # TEST: IGMPv3 report 239.10.10.10 is_include [ OK ] # TEST: IGMPv3 report 239.10.10.10 include -> allow [ OK ] # not ok 1 selftests: net/forwarding: bridge_igmp.sh # TIMEOUT 45 seconds
Fix by switching off the timeout and setting it to 0. A similar change was done for BPF selftests in commit 6fc5916cc256 ("selftests: bpf:
Switch off timeout").
--- tools/testing/selftests/net/forwarding/settings | 1 + 1 file changed, 1 insertion(+) create mode 100644 tools/testing/selftests/net/forwarding/settings
tools/testing/selftests/net/forwarding/settings new file +1 -0
@@ -0,0 +1 @@ +timeout=0
Greg Kroah-Hartman
maintainerPATCH 116/206 selftests: forwarding: tc_actions: Use ncat instead of nc
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit 5e8670610b93158ffacc3241f835454ff26a3469 upstream.
The test relies on 'nc' being the netcat version from the nmap project. While this seems to be the case on Fedora, it is not the case on Ubuntu, resulting in failures such as [1].
Fix by explicitly using the 'ncat' utility from the nmap project and the skip the test in case it is not installed.
[1]
# timeout set to 0 # selftests: net/forwarding: tc_actions.sh # TEST: gact drop and ok (skip_hw) [ OK ] # TEST: mirred egress flower redirect (skip_hw) [ OK ] # TEST: mirred egress flower mirror (skip_hw) [ OK ] # TEST: mirred egress matchall mirror (skip_hw) [ OK ] # TEST: mirred_egress_to_ingress (skip_hw) [ OK ] # nc: invalid option -- '-' # usage: nc [-46CDdFhklNnrStUuvZz] [-I length] [-i interval] [-M ttl] # [-m minttl] [-O length] [-P proxy_username] [-p source_port] # [-q seconds] [-s sourceaddr] [-T keyword] [-V rtable] [-W recvlimit] # [-w timeout] [-X proxy_protocol] [-x proxy_address[:port]] # [destination] [port] # nc: invalid option -- '-' # usage: nc [-46CDdFhklNnrStUuvZz] [-I length] [-i interval] [-M ttl] # [-m minttl] [-O length] [-P proxy_username] [-p source_port] # [-q seconds] [-s sourceaddr] [-T keyword] [-V rtable] [-W recvlimit] # [-w timeout] [-X proxy_protocol] [-x proxy_address[:port]] # [destination] [port] # TEST: mirred_egress_to_ingress_tcp (skip_hw) [FAIL] # server output check failed # INFO: Could not test offloaded functionality not ok 80 selftests: net/forwarding: tc_actions.sh # exit=1
--- tools/testing/selftests/net/forwarding/tc_actions.sh | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
tools/testing/selftests/net/forwarding/tc_actions.sh +4 -2
@@ -9,6 +9,8 @@ NUM_NETIFS=4 source tc_common.sh source lib.sh +require_command ncat + tcflags="skip_hw" h1_create()
@@ -220,9 +222,9 @@ mirred_egress_to_ingress_tcp_test() ip_proto icmp \ action drop - ip vrf exec v$h1 nc --recv-only -w10 -l -p 12345 -o $mirred_e2i_tf2 & + ip vrf exec v$h1 ncat --recv-only -w10 -l -p 12345 -o $mirred_e2i_tf2 & local rpid=$! - ip vrf exec v$h1 nc -w1 --send-only 192.0.2.2 12345 <$mirred_e2i_tf1 + ip vrf exec v$h1 ncat -w1 --send-only 192.0.2.2 12345 <$mirred_e2i_tf1 wait -n $rpid cmp -s $mirred_e2i_tf1 $mirred_e2i_tf2 check_err $? "server output check failed"
Greg Kroah-Hartman
maintainerPATCH 117/206 selftests: forwarding: tc_flower: Relax success criterion
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit 9ee37e53e7687654b487fc94e82569377272a7a8 upstream.
The test checks that filters that match on source or destination MAC were only hit once. A host can send more than one packet with a given source or destination MAC, resulting in failures.
Fix by relaxing the success criterion and instead check that the filters were not hit zero times. Using tc_check_at_least_x_packets() is also an option, but it is not available in older kernels.
--- tools/testing/selftests/net/forwarding/tc_flower.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
tools/testing/selftests/net/forwarding/tc_flower.sh +4 -4
@@ -52,8 +52,8 @@ match_dst_mac_test() tc_check_packets "dev $h2 ingress" 101 1 check_fail $? "Matched on a wrong filter" - tc_check_packets "dev $h2 ingress" 102 1 - check_err $? "Did not match on correct filter" + tc_check_packets "dev $h2 ingress" 102 0 + check_fail $? "Did not match on correct filter" tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
@@ -78,8 +78,8 @@ match_src_mac_test() tc_check_packets "dev $h2 ingress" 101 1 check_fail $? "Matched on a wrong filter" - tc_check_packets "dev $h2 ingress" 102 1 - check_err $? "Did not match on correct filter" + tc_check_packets "dev $h2 ingress" 102 0 + check_fail $? "Did not match on correct filter" tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
Greg Kroah-Hartman
maintainerPATCH 118/206 selftests: forwarding: bridge_mdb_max: Fix failing test with old libnet
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit cb034948ac292da82cc0e6bc1340f81be36e117d upstream.
As explained in commit 8bcfb4ae4d97 ("selftests: forwarding: Fix failing tests with old libnet"), old versions of libnet (used by mausezahn) do not use the "SO_BINDTODEVICE" socket option. For IP unicast packets, this can be solved by prefixing mausezahn invocations with "ip vrf exec". However, IP multicast packets do not perform routing and simply egress the bound device, which does not exist in this case.
Fix by specifying the source and destination MAC of the packet which will cause mausezahn to use a packet socket instead of an IP socket.
--- .../selftests/net/forwarding/bridge_mdb_max.sh | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
tools/testing/selftests/net/forwarding/bridge_mdb_max.sh +10 -4
@@ -252,7 +252,8 @@ ctl4_entries_add() local IPs=$(seq -f 192.0.2.%g 1 $((n - 1))) local peer=$(locus_dev_peer $locus) local GRP=239.1.1.${grp} - $MZ $peer -c 1 -A 192.0.2.1 -B $GRP \ + local dmac=01:00:5e:01:01:$(printf "%02x" $grp) + $MZ $peer -a own -b $dmac -c 1 -A 192.0.2.1 -B $GRP \ -t ip proto=2,p=$(igmpv3_is_in_get $GRP $IPs) -q sleep 1
@@ -272,7 +273,8 @@ ctl4_entries_del() local peer=$(locus_dev_peer $locus) local GRP=239.1.1.${grp} - $MZ $peer -c 1 -A 192.0.2.1 -B 224.0.0.2 \ + local dmac=01:00:5e:00:00:02 + $MZ $peer -a own -b $dmac -c 1 -A 192.0.2.1 -B 224.0.0.2 \ -t ip proto=2,p=$(igmpv2_leave_get $GRP) -q sleep 1 ! bridge mdb show dev br0 | grep -q $GRP
@@ -289,8 +291,10 @@ ctl6_entries_add() local peer=$(locus_dev_peer $locus) local SIP=fe80::1 local GRP=ff0e::${grp} + local dmac=33:33:00:00:00:$(printf "%02x" $grp) local p=$(mldv2_is_in_get $SIP $GRP $IPs) - $MZ -6 $peer -c 1 -A $SIP -B $GRP -t ip hop=1,next=0,p="$p" -q + $MZ -6 $peer -a own -b $dmac -c 1 -A $SIP -B $GRP \ + -t ip hop=1,next=0,p="$p" -q sleep 1 local nn=$(bridge mdb show dev br0 | grep $GRP | wc -l)
@@ -310,8 +314,10 @@ ctl6_entries_del() local peer=$(locus_dev_peer $locus) local SIP=fe80::1 local GRP=ff0e::${grp} + local dmac=33:33:00:00:00:$(printf "%02x" $grp) local p=$(mldv1_done_get $SIP $GRP) - $MZ -6 $peer -c 1 -A $SIP -B $GRP -t ip hop=1,next=0,p="$p" -q + $MZ -6 $peer -a own -b $dmac -c 1 -A $SIP -B $GRP \ + -t ip hop=1,next=0,p="$p" -q sleep 1 ! bridge mdb show dev br0 | grep -q $GRP }
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 119/206 selftests: forwarding: bridge_mdb: Fix failing test with old libnet
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit e98e195d90cc93b1bf2ad762c7c274a40dab7173 upstream.
As explained in commit 8bcfb4ae4d97 ("selftests: forwarding: Fix failing tests with old libnet"), old versions of libnet (used by mausezahn) do not use the "SO_BINDTODEVICE" socket option. For IP unicast packets, this can be solved by prefixing mausezahn invocations with "ip vrf exec". However, IP multicast packets do not perform routing and simply egress the bound device, which does not exist in this case.
Fix by specifying the source and destination MAC of the packet which will cause mausezahn to use a packet socket instead of an IP socket.
--- .../selftests/net/forwarding/bridge_mdb.sh | 46 ++++++++++--------- 1 file changed, 24 insertions(+), 22 deletions(-)
tools/testing/selftests/net/forwarding/bridge_mdb.sh +24 -22
@@ -850,6 +850,7 @@ cfg_test() __fwd_test_host_ip() { local grp=$1; shift + local dmac=$1; shift local src=$1; shift local mode=$1; shift local name
@@ -872,27 +873,27 @@ __fwd_test_host_ip() # Packet should only be flooded to multicast router ports when there is # no matching MDB entry. The bridge is not configured as a multicast # router port. - $MZ $mode $h1.10 -c 1 -p 128 -A $src -B $grp -t udp -q + $MZ $mode $h1.10 -a own -b $dmac -c 1 -p 128 -A $src -B $grp -t udp -q tc_check_packets "dev br0 ingress" 1 0 check_err $? "Packet locally received after flood" # Install a regular port group entry and expect the packet to not be # locally received. bridge mdb add dev br0 port $swp2 grp $grp temp vid 10 - $MZ $mode $h1.10 -c 1 -p 128 -A $src -B $grp -t udp -q + $MZ $mode $h1.10 -a own -b $dmac -c 1 -p 128 -A $src -B $grp -t udp -q tc_check_packets "dev br0 ingress" 1 0 check_err $? "Packet locally received after installing a regular entry" # Add a host entry and expect the packet to be locally received. bridge mdb add dev br0 port br0 grp $grp temp vid 10 - $MZ $mode $h1.10 -c 1 -p 128 -A $src -B $grp -t udp -q + $MZ $mode $h1.10 -a own -b $dmac -c 1 -p 128 -A $src -B $grp -t udp -q tc_check_packets "dev br0 ingress" 1 1 check_err $? "Packet not locally received after adding a host entry" # Remove the host entry and expect the packet to not be locally # received. bridge mdb del dev br0 port br0 grp $grp vid 10 - $MZ $mode $h1.10 -c 1 -p 128 -A $src -B $grp -t udp -q + $MZ $mode $h1.10 -a own -b $dmac -c 1 -p 128 -A $src -B $grp -t udp -q tc_check_packets "dev br0 ingress" 1 1 check_err $? "Packet locally received after removing a host entry"
@@ -905,8 +906,8 @@ __fwd_test_host_ip() fwd_test_host_ip() { - __fwd_test_host_ip "239.1.1.1" "192.0.2.1" "-4" - __fwd_test_host_ip "ff0e::1" "2001:db8:1::1" "-6" + __fwd_test_host_ip "239.1.1.1" "01:00:5e:01:01:01" "192.0.2.1" "-4" + __fwd_test_host_ip "ff0e::1" "33:33:00:00:00:01" "2001:db8:1::1" "-6" } fwd_test_host_l2()
@@ -966,6 +967,7 @@ fwd_test_host() __fwd_test_port_ip() { local grp=$1; shift + local dmac=$1; shift local valid_src=$1; shift local invalid_src=$1; shift local mode=$1; shift
@@ -999,43 +1001,43 @@ __fwd_test_port_ip() vlan_ethtype $eth_type vlan_id 10 dst_ip $grp \ src_ip $invalid_src action drop - $MZ $mode $h1.10 -c 1 -p 128 -A $valid_src -B $grp -t udp -q + $MZ $mode $h1.10 -a own -b $dmac -c 1 -p 128 -A $valid_src -B $grp -t udp -q tc_check_packets "dev $h2 ingress" 1 0 check_err $? "Packet from valid source received on H2 before adding entry" - $MZ $mode $h1.10 -c 1 -p 128 -A $invalid_src -B $grp -t udp -q + $MZ $mode $h1.10 -a own -b $dmac -c 1 -p 128 -A $invalid_src -B $grp -t udp -q tc_check_packets "dev $h2 ingress" 2 0 check_err $? "Packet from invalid source received on H2 before adding entry" bridge mdb add dev br0 port $swp2 grp $grp vid 10 \ filter_mode $filter_mode source_list $src_list - $MZ $mode $h1.10 -c 1 -p 128 -A $valid_src -B $grp -t udp -q + $MZ $mode $h1.10 -a own -b $dmac -c 1 -p 128 -A $valid_src -B $grp -t udp -q tc_check_packets "dev $h2 ingress" 1 1 check_err $? "Packet from valid source not received on H2 after adding entry" - $MZ $mode $h1.10 -c 1 -p 128 -A $invalid_src -B $grp -t udp -q + $MZ $mode $h1.10 -a own -b $dmac -c 1 -p 128 -A $invalid_src -B $grp -t udp -q tc_check_packets "dev $h2 ingress" 2 0 check_err $? "Packet from invalid source received on H2 after adding entry" bridge mdb replace dev br0 port $swp2 grp $grp vid 10 \ filter_mode exclude - $MZ $mode $h1.10 -c 1 -p 128 -A $valid_src -B $grp -t udp -q + $MZ $mode $h1.10 -a own -b $dmac -c 1 -p 128 -A $valid_src -B $grp -t udp -q tc_check_packets "dev $h2 ingress" 1 2 check_err $? "Packet from valid source not received on H2 after allowing all sources" - $MZ $mode $h1.10 -c 1 -p 128 -A $invalid_src -B $grp -t udp -q + $MZ $mode $h1.10 -a own -b $dmac -c 1 -p 128 -A $invalid_src -B $grp -t udp -q tc_check_packets "dev $h2 ingress" 2 1 check_err $? "Packet from invalid source not received on H2 after allowing all sources" bridge mdb del dev br0 port $swp2 grp $grp vid 10 - $MZ $mode $h1.10 -c 1 -p 128 -A $valid_src -B $grp -t udp -q + $MZ $mode $h1.10 -a own -b $dmac -c 1 -p 128 -A $valid_src -B $grp -t udp -q tc_check_packets "dev $h2 ingress" 1 2 check_err $? "Packet from valid source received on H2 after deleting entry" - $MZ $mode $h1.10 -c 1 -p 128 -A $invalid_src -B $grp -t udp -q + $MZ $mode $h1.10 -a own -b $dmac -c 1 -p 128 -A $invalid_src -B $grp -t udp -q tc_check_packets "dev $h2 ingress" 2 1 check_err $? "Packet from invalid source received on H2 after deleting entry"
@@ -1047,11 +1049,11 @@ __fwd_test_port_ip() fwd_test_port_ip() { - __fwd_test_port_ip "239.1.1.1" "192.0.2.1" "192.0.2.2" "-4" "exclude" - __fwd_test_port_ip "ff0e::1" "2001:db8:1::1" "2001:db8:1::2" "-6" \ + __fwd_test_port_ip "239.1.1.1" "01:00:5e:01:01:01" "192.0.2.1" "192.0.2.2" "-4" "exclude" + __fwd_test_port_ip "ff0e::1" "33:33:00:00:00:01" "2001:db8:1::1" "2001:db8:1::2" "-6" \ "exclude" - __fwd_test_port_ip "239.1.1.1" "192.0.2.1" "192.0.2.2" "-4" "include" - __fwd_test_port_ip "ff0e::1" "2001:db8:1::1" "2001:db8:1::2" "-6" \ + __fwd_test_port_ip "239.1.1.1" "01:00:5e:01:01:01" "192.0.2.1" "192.0.2.2" "-4" "include" + __fwd_test_port_ip "ff0e::1" "33:33:00:00:00:01" "2001:db8:1::1" "2001:db8:1::2" "-6" \ "include" }
@@ -1127,7 +1129,7 @@ ctrl_igmpv3_is_in_test() filter_mode include source_list 192.0.2.1 # IS_IN ( 192.0.2.2 ) - $MZ $h1.10 -c 1 -A 192.0.2.1 -B 239.1.1.1 \ + $MZ $h1.10 -c 1 -a own -b 01:00:5e:01:01:01 -A 192.0.2.1 -B 239.1.1.1 \ -t ip proto=2,p=$(igmpv3_is_in_get 239.1.1.1 192.0.2.2) -q bridge -d mdb show dev br0 vid 10 | grep 239.1.1.1 | grep -q 192.0.2.2
@@ -1140,7 +1142,7 @@ ctrl_igmpv3_is_in_test() filter_mode include source_list 192.0.2.1 # IS_IN ( 192.0.2.2 ) - $MZ $h1.10 -c 1 -A 192.0.2.1 -B 239.1.1.1 \ + $MZ $h1.10 -a own -b 01:00:5e:01:01:01 -c 1 -A 192.0.2.1 -B 239.1.1.1 \ -t ip proto=2,p=$(igmpv3_is_in_get 239.1.1.1 192.0.2.2) -q bridge -d mdb show dev br0 vid 10 | grep 239.1.1.1 | grep -v "src" | \
@@ -1167,7 +1169,7 @@ ctrl_mldv2_is_in_test() # IS_IN ( 2001:db8:1::2 ) local p=$(mldv2_is_in_get fe80::1 ff0e::1 2001:db8:1::2) - $MZ -6 $h1.10 -c 1 -A fe80::1 -B ff0e::1 \ + $MZ -6 $h1.10 -a own -b 33:33:00:00:00:01 -c 1 -A fe80::1 -B ff0e::1 \ -t ip hop=1,next=0,p="$p" -q bridge -d mdb show dev br0 vid 10 | grep ff0e::1 | \
@@ -1181,7 +1183,7 @@ ctrl_mldv2_is_in_test() filter_mode include source_list 2001:db8:1::1 # IS_IN ( 2001:db8:1::2 ) - $MZ -6 $h1.10 -c 1 -A fe80::1 -B ff0e::1 \ + $MZ -6 $h1.10 -a own -b 33:33:00:00:00:01 -c 1 -A fe80::1 -B ff0e::1 \ -t ip hop=1,next=0,p="$p" -q bridge -d mdb show dev br0 vid 10 | grep ff0e::1 | grep -v "src" | \
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 120/206 selftests: forwarding: bridge_mdb: Make test more robust
In reply to Greg Kroah-HartmanFrom: Ido Schimmel <[email protected]>
commit 8b5ff37097775cdbd447442603957066dd2e4d02 upstream.
Some test cases check that the group timer is (or isn't) 0. Instead of grepping for "0.00" grep for " 0.00" as the former can also match "260.00" which is the default group membership interval.
--- tools/testing/selftests/net/forwarding/bridge_mdb.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
tools/testing/selftests/net/forwarding/bridge_mdb.sh +4 -4
@@ -617,7 +617,7 @@ __cfg_test_port_ip_sg() grep -q "permanent" check_err $? "Entry not added as \"permanent\" when should" bridge -d -s mdb show dev br0 vid 10 | grep "$grp_key" | \ - grep -q "0.00" + grep -q " 0.00" check_err $? "\"permanent\" entry has a pending group timer" bridge mdb del dev br0 port $swp1 $grp_key vid 10
@@ -626,7 +626,7 @@ __cfg_test_port_ip_sg() grep -q "temp" check_err $? "Entry not added as \"temp\" when should" bridge -d -s mdb show dev br0 vid 10 | grep "$grp_key" | \ - grep -q "0.00" + grep -q " 0.00" check_fail $? "\"temp\" entry has an unpending group timer" bridge mdb del dev br0 port $swp1 $grp_key vid 10
@@ -659,7 +659,7 @@ __cfg_test_port_ip_sg() grep -q "permanent" check_err $? "Entry not marked as \"permanent\" after replace" bridge -d -s mdb show dev br0 vid 10 | grep "$grp_key" | \ - grep -q "0.00" + grep -q " 0.00" check_err $? "Entry has a pending group timer after replace" bridge mdb replace dev br0 port $swp1 $grp_key vid 10 temp
@@ -667,7 +667,7 @@ __cfg_test_port_ip_sg() grep -q "temp" check_err $? "Entry not marked as \"temp\" after replace" bridge -d -s mdb show dev br0 vid 10 | grep "$grp_key" | \ - grep -q "0.00" + grep -q " 0.00" check_fail $? "Entry has an unpending group timer after replace" bridge mdb del dev br0 port $swp1 $grp_key vid 10
Greg Kroah-Hartman
maintainerPATCH 121/206 net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail()
In reply to Greg Kroah-HartmanFrom: Andrew Kanner <[email protected]>
commit d14eea09edf427fa36bd446f4a3271f99164202f upstream.
Syzkaller reported the following issue:
=======================================
Too BIG xdp->frame_sz = 131072
WARNING: CPU: 0 PID: 5020 at net/core/filter.c:4121 ____bpf_xdp_adjust_tail net/core/filter.c:4121 [inline] WARNING: CPU: 0 PID: 5020 at net/core/filter.c:4121 bpf_xdp_adjust_tail+0x466/0xa10 net/core/filter.c:4103 ... Call Trace: <TASK> bpf_prog_4add87e5301a4105+0x1a/0x1c __bpf_prog_run include/linux/filter.h:600 [inline] bpf_prog_run_xdp include/linux/filter.h:775 [inline] bpf_prog_run_generic_xdp+0x57e/0x11e0 net/core/dev.c:4721 netif_receive_generic_xdp net/core/dev.c:4807 [inline] do_xdp_generic+0x35c/0x770 net/core/dev.c:4866 tun_get_user+0x2340/0x3ca0 drivers/net/tun.c:1919 tun_chr_write_iter+0xe8/0x210 drivers/net/tun.c:2043 call_write_iter include/linux/fs.h:1871 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x650/0xe40 fs/read_write.c:584 ksys_write+0x12f/0x250 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
xdp->frame_sz > PAGE_SIZE check was introduced in commit c8741e2bfe87 ("xdp: Allow bpf_xdp_adjust_tail() to grow packet size"). But Jesper Dangaard Brouer <[email protected]> noted that after introducing the xdp_init_buff() which all XDP driver use - it's safe to remove this check. The original intend was to catch cases where XDP drivers have not been updated to use xdp.frame_sz, but that is not longer a concern (since xdp_init_buff).
Running the initial syzkaller repro it was discovered that the contiguous physical memory allocation is used for both xdp paths in tun_get_user(), e.g. tun_build_skb() and tun_alloc_skb(). It was also stated by Jesper Dangaard Brouer <[email protected]> that XDP can work on higher order pages, as long as this is contiguous physical memory (e.g. a page).
--- net/core/filter.c | 6 ------ 1 file changed, 6 deletions(-)
net/core/filter.c +0 -6
@@ -4115,12 +4115,6 @@ BPF_CALL_2(bpf_xdp_adjust_tail, struct xif (unlikely (data_end > data_hard_end))return -EINVAL ; -/* ALL drivers MUST init xdp->frame_sz, chicken check below */ -if (unlikely (xdp->frame_sz >PAGE_SIZE )) { -WARN_ONCE (1 ,"Too BIG xdp->frame_sz = %d\n" , xdp->frame_sz); -return -EINVAL ; - } -if (unlikely (data_end < xdp->data +ETH_HLEN ))return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 122/206 bpf, sockmap: Fix map type error in sock_map_del_link
In reply to Greg Kroah-HartmanFrom: Xu Kuohai <[email protected]>
commit 7e96ec0e6605b69bb21bbf6c0ff9051e656ec2b1 upstream.
sock_map_del_link() operates on both SOCKMAP and SOCKHASH, although both types have member named "progs", the offset of "progs" member in these two types is different, so "progs" should be accessed with the real map type.
--- net/core/sock_map.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
net/core/sock_map.c +5 -5
@@ -146,13 +146,13 @@ static void sock_map_del_link(struct soclist_for_each_entry_safe (link, tmp, &psock->link, list) {if (link->link_raw == link_raw) {struct bpf_map *map = link->map; - struct bpf_stab *stab = container_of(map, struct bpf_stab, - map); -if (psock->saved_data_ready && stab->progs.stream_parser) +struct sk_psock_progs *progs =sock_map_progs (map); + +if (psock->saved_data_ready && progs->stream_parser) strp_stop = true; -if (psock->saved_data_ready && stab->progs.stream_verdict) +if (psock->saved_data_ready && progs->stream_verdict) verdict_stop = true; -if (psock->saved_data_ready && stab->progs.skb_verdict) +if (psock->saved_data_ready && progs->skb_verdict) verdict_stop = true;list_del (&link->list);sk_psock_free_link (link);
Greg Kroah-Hartman
maintainerPATCH 123/206 bpf, sockmap: Fix bug that strp_done cannot be called
In reply to Greg Kroah-HartmanFrom: Xu Kuohai <[email protected]>
commit 809e4dc71a0f2b8d2836035d98603694fff11d5d upstream.
strp_done is only called when psock->progs.stream_parser is not NULL, but stream_parser was set to NULL by sk_psock_stop_strp(), called by sk_psock_drop() earlier. So, strp_done can never be called.
Introduce SK_PSOCK_RX_ENABLED to mark whether there is strp on psock. Change the condition for calling strp_done from judging whether stream_parser is set to judging whether this flag is set. This flag is only set once when strp_init() succeeds, and will never be cleared later.
--- include/linux/skmsg.h | 1 + net/core/skmsg.c | 10 ++++++++-- 2 files changed, 9 insertions(+), 2 deletions(-)
include/linux/skmsg.h +1 -0
@@ -62,6 +62,7 @@ struct sk_psock_progs {enum sk_psock_state_bits {SK_PSOCK_TX_ENABLED , +SK_PSOCK_RX_STRP_ENABLED , };struct sk_psock_link {
net/core/skmsg.c +8 -2
@@ -1120,13 +1120,19 @@ static void sk_psock_strp_data_ready(strint sk_psock_init_strp (struct sock *sk,struct sk_psock *psock) { +int ret; +static const struct strp_callbacks cb = { .rcv_msg = sk_psock_strp_read, .read_sock_done = sk_psock_strp_read_done, .parse_msg = sk_psock_strp_parse, }; -return strp_init (&psock->strp, sk, &cb); + ret =strp_init (&psock->strp, sk, &cb); +if (!ret) +sk_psock_set_state (psock,SK_PSOCK_RX_STRP_ENABLED ); + +return ret; }void sk_psock_start_strp (struct sock *sk,struct sk_psock *psock)
@@ -1154,7 +1160,7 @@ void sk_psock_stop_strp(struct sock *sk,static void sk_psock_done_strp (struct sk_psock *psock) {/* Parser has been stopped */ -if (psock->progs.stream_parser) +if (sk_psock_test_state (psock,SK_PSOCK_RX_STRP_ENABLED ))strp_done (&psock->strp); }#else
Greg Kroah-Hartman
maintainerPATCH 124/206 hwmon: (aquacomputer_d5next) Add selective 200ms delay after sending ctrl report
In reply to Greg Kroah-HartmanFrom: Aleksa Savic <[email protected]>
commit 56b930dcd88c2adc261410501c402c790980bdb5 upstream.
Add a 200ms delay after sending a ctrl report to Quadro, Octo, D5 Next and Aquaero to give them enough time to process the request and save the data to memory. Otherwise, under heavier userspace loads where multiple sysfs entries are usually set in quick succession, a new ctrl report could be requested from the device while it's still processing the previous one and fail with -EPIPE. The delay is only applied if two ctrl report operations are near each other in time.
Reported by a user on Github [1] and tested by both of us.
[1] https://github.com/aleksamagicka/aquacomputer_d5next-hwmon/issues/82
--- drivers/hwmon/aquacomputer_d5next.c | 37 +++++++++++++++++++++++++++++++++++- 1 file changed, 36 insertions(+), 1 deletion(-)
drivers/hwmon/aquacomputer_d5next.c +36 -1
@@ -13,9 +13,11 @@#include <linux/crc16.h> #include <linux/debugfs.h> +#include <linux/delay.h> #include <linux/hid.h> #include <linux/hwmon.h> #include <linux/jiffies.h> +#include <linux/ktime.h> #include <linux/module.h> #include <linux/mutex.h> #include <linux/seq_file.h>
@@ -61,6 +63,8 @@ static const char *const aqc_device_name#define CTRL_REPORT_ID 0x03#define AQUAERO_CTRL_REPORT_ID 0x0b +#define CTRL_REPORT_DELAY 200/* ms */ +/* The HID report that the official software always sends * after writing values, currently same for all devices */
@@ -496,6 +500,9 @@ struct aqc_data {int secondary_ctrl_report_size;u8 *secondary_ctrl_report; +ktime_t last_ctrl_report_op; +int ctrl_report_delay;/* Delay between two ctrl report operations, in ms */ +int buffer_size;u8 *buffer;int checksum_start;
@@ -577,17 +584,35 @@ static int aqc_aquastreamxt_convert_fan_return 0 ; } +static void aqc_delay_ctrl_report (struct aqc_data *priv) +{ +/* +* If previous read or write is too close to this one, delay the current operation +* to give the device enough time to process the previous one. +*/ +if (priv->ctrl_report_delay) { +s64 delta =ktime_ms_delta (ktime_get (), priv->last_ctrl_report_op); + +if (delta < priv->ctrl_report_delay) +msleep (priv->ctrl_report_delay - delta); + } +} +/* Expects the mutex to be locked */ static int aqc_get_ctrl_data (struct aqc_data *priv) {int ret; +aqc_delay_ctrl_report (priv); +memset (priv->buffer,0x00 , priv->buffer_size); ret =hid_hw_raw_request (priv->hdev, priv->ctrl_report_id, priv->buffer, priv->buffer_size,HID_FEATURE_REPORT ,HID_REQ_GET_REPORT );if (ret <0 ) ret = -ENODATA ; + priv->last_ctrl_report_op =ktime_get (); +return ret; }
@@ -597,6 +622,8 @@ static int aqc_send_ctrl_data(struct aqcint ret;u16 checksum; +aqc_delay_ctrl_report (priv); +/* Checksum is not needed for Aquaero */ if (priv->kind != aquaero) {/* Init and xorout value for CRC-16/USB is 0xffff */
@@ -612,12 +639,16 @@ static int aqc_send_ctrl_data(struct aqc ret =hid_hw_raw_request (priv->hdev, priv->ctrl_report_id, priv->buffer, priv->buffer_size,HID_FEATURE_REPORT ,HID_REQ_SET_REPORT );if (ret <0 ) -return ret; + goto record_access_and_ret;/* The official software sends this report after every change, so do it here as well */ ret =hid_hw_raw_request (priv->hdev, priv->secondary_ctrl_report_id, priv->secondary_ctrl_report, priv->secondary_ctrl_report_size,HID_FEATURE_REPORT ,HID_REQ_SET_REPORT ); + +record_access_and_ret: + priv->last_ctrl_report_op =ktime_get (); +return ret; }
@@ -1443,6 +1474,7 @@ static int aqc_probe(struct hid_device * priv->buffer_size =AQUAERO_CTRL_REPORT_SIZE ; priv->temp_ctrl_offset =AQUAERO_TEMP_CTRL_OFFSET ; + priv->ctrl_report_delay =CTRL_REPORT_DELAY ; priv->temp_label = label_temp_sensors; priv->virtual_temp_label = label_virtual_temp_sensors;
@@ -1466,6 +1498,7 @@ static int aqc_probe(struct hid_device * priv->temp_ctrl_offset =D5NEXT_TEMP_CTRL_OFFSET ; priv->buffer_size =D5NEXT_CTRL_REPORT_SIZE ; + priv->ctrl_report_delay =CTRL_REPORT_DELAY ; priv->power_cycle_count_offset =D5NEXT_POWER_CYCLES ;
@@ -1516,6 +1549,7 @@ static int aqc_probe(struct hid_device * priv->temp_ctrl_offset =OCTO_TEMP_CTRL_OFFSET ; priv->buffer_size =OCTO_CTRL_REPORT_SIZE ; + priv->ctrl_report_delay =CTRL_REPORT_DELAY ; priv->power_cycle_count_offset =OCTO_POWER_CYCLES ;
@@ -1543,6 +1577,7 @@ static int aqc_probe(struct hid_device * priv->temp_ctrl_offset =QUADRO_TEMP_CTRL_OFFSET ; priv->buffer_size =QUADRO_CTRL_REPORT_SIZE ; + priv->ctrl_report_delay =CTRL_REPORT_DELAY ; priv->flow_pulses_ctrl_offset =QUADRO_FLOW_PULSES_CTRL_OFFSET ; priv->power_cycle_count_offset =QUADRO_POWER_CYCLES ;
Greg Kroah-Hartman
maintainerPATCH 125/206 mISDN: Update parameter type of dsp_cmx_send()
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit 1696ec8654016dad3b1baf6c024303e584400453 upstream.
When booting a kernel with CONFIG_MISDN_DSP=y and CONFIG_CFI_CLANG=y, there is a failure when dsp_cmx_send() is called indirectly from call_timer_fn():
[ 0.371412] CFI failure at call_timer_fn+0x2f/0x150 (target: dsp_cmx_send+0x0/0x530; expected type: 0x92ada1e9)
The function pointer prototype that call_timer_fn() expects is
void (*fn)(struct timer_list *)
whereas dsp_cmx_send() has a parameter type of 'void *', which causes the control flow integrity checks to fail because the parameter types do not match.
Change dsp_cmx_send()'s parameter type to be 'struct timer_list' to match the expected prototype. The argument is unused anyways, so this has no functional change, aside from avoiding the CFI failure.
--- drivers/isdn/mISDN/dsp.h | 2 +- drivers/isdn/mISDN/dsp_cmx.c | 2 +- drivers/isdn/mISDN/dsp_core.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
drivers/isdn/mISDN/dsp.h +1 -1
@@ -247,7 +247,7 @@ extern void dsp_cmx_hardware(struct dsp_extern int dsp_cmx_conf (struct dsp *dsp,u32 conf_id);extern void dsp_cmx_receive (struct dsp *dsp,struct sk_buff *skb);extern void dsp_cmx_hdlc (struct dsp *dsp,struct sk_buff *skb); -extern void dsp_cmx_send (void *arg); +extern void dsp_cmx_send (struct timer_list *arg);extern void dsp_cmx_transmit (struct dsp *dsp,struct sk_buff *skb);extern int dsp_cmx_del_conf_member (struct dsp *dsp);extern int dsp_cmx_del_conf (struct dsp_conf *conf);
drivers/isdn/mISDN/dsp_cmx.c +1 -1
@@ -1614,7 +1614,7 @@ static u16 dsp_count; /* last sample coustatic int dsp_count_valid;/* if we have last sample count */ void -dsp_cmx_send (void *arg) +dsp_cmx_send (struct timer_list *arg) {struct dsp_conf *conf;struct dsp_conf_member *member;
drivers/isdn/mISDN/dsp_core.c +1 -1
@@ -1195,7 +1195,7 @@ static int __init dsp_init(void) }/* set sample timer */ -timer_setup (&dsp_spl_tl, (void *)dsp_cmx_send,0 ); +timer_setup (&dsp_spl_tl, dsp_cmx_send,0 ); dsp_spl_tl.expires = jiffies + dsp_tics; dsp_spl_jiffies = dsp_spl_tl.expires;add_timer (&dsp_spl_tl);
Greg Kroah-Hartman
maintainerPATCH 126/206 macsec: use DEV_STATS_INC()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit 32d0a49d36a2a306c2e47fe5659361e424f0ed3f upstream.
syzbot/KCSAN reported data-races in macsec whenever dev->stats fields are updated.
It appears all of these updates can happen from multiple cpus.
Adopt SMP safe DEV_STATS_INC() to update dev->stats fields.
--- drivers/net/macsec.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-)
drivers/net/macsec.c +14 -14
@@ -743,7 +743,7 @@ static bool macsec_post_decrypt(struct su64_stats_update_begin (&rxsc_stats->syncp); rxsc_stats->stats.InPktsLate++;u64_stats_update_end (&rxsc_stats->syncp); - secy->netdev->stats.rx_dropped++; +DEV_STATS_INC (secy->netdev, rx_dropped);return false; }
@@ -767,7 +767,7 @@ static bool macsec_post_decrypt(struct s rxsc_stats->stats.InPktsNotValid++;u64_stats_update_end (&rxsc_stats->syncp);this_cpu_inc (rx_sa->stats->InPktsNotValid); - secy->netdev->stats.rx_errors++; +DEV_STATS_INC (secy->netdev, rx_errors);return false; }
@@ -1069,7 +1069,7 @@ static enum rx_handler_result handle_notu64_stats_update_begin (&secy_stats->syncp); secy_stats->stats.InPktsNoTag++;u64_stats_update_end (&secy_stats->syncp); - macsec->secy.netdev->stats.rx_dropped++; +DEV_STATS_INC (macsec->secy.netdev, rx_dropped);continue ; }
@@ -1179,7 +1179,7 @@ static rx_handler_result_t macsec_handleu64_stats_update_begin (&secy_stats->syncp); secy_stats->stats.InPktsBadTag++;u64_stats_update_end (&secy_stats->syncp); - secy->netdev->stats.rx_errors++; +DEV_STATS_INC (secy->netdev, rx_errors); goto drop_nosa; }
@@ -1196,7 +1196,7 @@ static rx_handler_result_t macsec_handleu64_stats_update_begin (&rxsc_stats->syncp); rxsc_stats->stats.InPktsNotUsingSA++;u64_stats_update_end (&rxsc_stats->syncp); - secy->netdev->stats.rx_errors++; +DEV_STATS_INC (secy->netdev, rx_errors);if (active_rx_sa)this_cpu_inc (active_rx_sa->stats->InPktsNotUsingSA); goto drop_nosa;
@@ -1230,7 +1230,7 @@ static rx_handler_result_t macsec_handleu64_stats_update_begin (&rxsc_stats->syncp); rxsc_stats->stats.InPktsLate++;u64_stats_update_end (&rxsc_stats->syncp); - macsec->secy.netdev->stats.rx_dropped++; +DEV_STATS_INC (macsec->secy.netdev, rx_dropped); goto drop; } }
@@ -1271,7 +1271,7 @@ deliver:if (ret ==NET_RX_SUCCESS )count_rx (dev, len);else - macsec->secy.netdev->stats.rx_dropped++; +DEV_STATS_INC (macsec->secy.netdev, rx_dropped);rcu_read_unlock ();
@@ -1308,7 +1308,7 @@ nosci:u64_stats_update_begin (&secy_stats->syncp); secy_stats->stats.InPktsNoSCI++;u64_stats_update_end (&secy_stats->syncp); - macsec->secy.netdev->stats.rx_errors++; +DEV_STATS_INC (macsec->secy.netdev, rx_errors);continue ; }
@@ -1327,7 +1327,7 @@ nosci: secy_stats->stats.InPktsUnknownSCI++;u64_stats_update_end (&secy_stats->syncp); }else { - macsec->secy.netdev->stats.rx_dropped++; +DEV_STATS_INC (macsec->secy.netdev, rx_dropped); } }
@@ -3422,7 +3422,7 @@ static netdev_tx_t macsec_start_xmit(strif (!secy->operational) {kfree_skb (skb); - dev->stats.tx_dropped++; +DEV_STATS_INC (dev, tx_dropped);return NETDEV_TX_OK ; }
@@ -3430,7 +3430,7 @@ static netdev_tx_t macsec_start_xmit(str skb =macsec_encrypt (skb, dev);if (IS_ERR (skb)) {if (PTR_ERR (skb) != -EINPROGRESS ) - dev->stats.tx_dropped++; +DEV_STATS_INC (dev, tx_dropped);return NETDEV_TX_OK ; }
@@ -3667,9 +3667,9 @@ static void macsec_get_stats64(struct nedev_fetch_sw_netstats (s, dev->tstats); - s->rx_dropped = dev->stats.rx_dropped; - s->tx_dropped = dev->stats.tx_dropped; - s->rx_errors = dev->stats.rx_errors; + s->rx_dropped =atomic_long_read (&dev->stats.__rx_dropped); + s->tx_dropped =atomic_long_read (&dev->stats.__tx_dropped); + s->rx_errors =atomic_long_read (&dev->stats.__rx_errors); }static int macsec_get_iflink (const struct net_device *dev)
Greg Kroah-Hartman
maintainerPATCH 127/206 mptcp: fix the incorrect judgment for msk->cb_flags
In reply to Greg Kroah-HartmanFrom: Xiang Yang <[email protected]>
commit 17ebf8a4c38b5481c29623f5e003fdf7583947f9 upstream.
Coccicheck reports the error below:
net/mptcp/protocol.c:3330:15-28: ERROR: test of a variable/field address
Since the address of msk->cb_flags is used in __test_and_clear_bit, the address should not be NULL. The judgment for if (unlikely(msk->cb_flags)) will always be true, we should check the real value of msk->cb_flags here.
--- net/mptcp/protocol.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/mptcp/protocol.c +1 -1
@@ -3321,7 +3321,7 @@ static void mptcp_release_cb(struct sockif (__test_and_clear_bit (MPTCP_CLEAN_UNA , &msk->cb_flags))__mptcp_clean_una_wakeup (sk); -if (unlikely (&msk->cb_flags)) { +if (unlikely (msk->cb_flags)) {/* be sure to set the current sk state before tacking actions * depending on sk_state, that is processing MPTCP_ERROR_REPORT */
Greg Kroah-Hartman
maintainerPATCH 128/206 igc: Add lock to safeguard global Qbv variables
In reply to Greg Kroah-HartmanFrom: Muhammad Husaini Zulkifli <[email protected]>
commit 06b412589eef780b792e73df131d35dc43cc4a49 upstream.
Access to shared variables through hrtimer requires locking in order to protect the variables because actions to write into these variables (oper_gate_closed, admin_gate_closed, and qbv_transition) might potentially occur simultaneously. This patch provides a locking mechanisms to avoid such scenarios.
--- drivers/net/ethernet/intel/igc/igc.h | 4 +++ drivers/net/ethernet/intel/igc/igc_main.c | 34 ++++++++++++++++++++++++++++-- 2 files changed, 36 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/igc/igc.h +4 -0
@@ -195,6 +195,10 @@ struct igc_adapter {u32 qbv_config_change_errors;bool qbv_transition;unsigned int qbv_count; +/* Access to oper_gate_closed, admin_gate_closed and qbv_transition +* are protected by the qbv_tx_lock. +*/ +spinlock_t qbv_tx_lock;/* OS defined structs */ struct pci_dev *pdev;
drivers/net/ethernet/intel/igc/igc_main.c +32 -2
@@ -4799,6 +4799,7 @@ static int igc_sw_init(struct igc_adapte adapter->nfc_rule_count =0 ;spin_lock_init (&adapter->stats64_lock); +spin_lock_init (&adapter->qbv_tx_lock);/* Assume MSI-X interrupts, will be checked during IRQ allocation */ adapter->flags |=IGC_FLAG_HAS_MSIX ;
@@ -6117,15 +6118,15 @@ static int igc_tsn_enable_launchtime(strreturn igc_tsn_offload_apply (adapter); } -static int igc_tsn_clear_schedule (struct igc_adapter *adapter) +static int igc_qbv_clear_schedule (struct igc_adapter *adapter) { +unsigned long flags;int i; adapter->base_time =0 ; adapter->cycle_time =NSEC_PER_SEC ; adapter->taprio_offload_enable = false; adapter->qbv_config_change_errors =0 ; - adapter->qbv_transition = false; adapter->qbv_count =0 ;for (i =0 ; i < adapter->num_tx_queues; i++) {
@@ -6134,10 +6135,28 @@ static int igc_tsn_clear_schedule(struct ring->start_time =0 ; ring->end_time =NSEC_PER_SEC ; ring->max_sdu =0 ; + } + +spin_lock_irqsave (&adapter->qbv_tx_lock, flags); + + adapter->qbv_transition = false; + +for (i =0 ; i < adapter->num_tx_queues; i++) { +struct igc_ring *ring = adapter->tx_ring[i]; + ring->oper_gate_closed = false; ring->admin_gate_closed = false; } +spin_unlock_irqrestore (&adapter->qbv_tx_lock, flags); + +return 0 ; +} + +static int igc_tsn_clear_schedule (struct igc_adapter *adapter) +{ +igc_qbv_clear_schedule (adapter); +return 0 ; }
@@ -6148,6 +6167,7 @@ static int igc_save_qbv_schedule(structstruct igc_hw *hw = &adapter->hw;u32 start_time =0 , end_time =0 ;struct timespec64 now; +unsigned long flags;size_t n;int i;
@@ -6215,6 +6235,8 @@ static int igc_save_qbv_schedule(struct start_time += e->interval; } +spin_lock_irqsave (&adapter->qbv_tx_lock, flags); +/* Check whether a queue gets configured. * If not, set the start and end time to be end time. */
@@ -6239,6 +6261,8 @@ static int igc_save_qbv_schedule(struct } } +spin_unlock_irqrestore (&adapter->qbv_tx_lock, flags); +for (i =0 ; i < adapter->num_tx_queues; i++) {struct igc_ring *ring = adapter->tx_ring[i];struct net_device *dev = adapter->netdev;
@@ -6603,8 +6627,11 @@ static enum hrtimer_restart igc_qbv_sche { struct igc_adapter *adapter = container_of(timer, struct igc_adapter, hrtimer); +unsigned long flags;unsigned int i; +spin_lock_irqsave (&adapter->qbv_tx_lock, flags); + adapter->qbv_transition = true;for (i =0 ; i < adapter->num_tx_queues; i++) {struct igc_ring *tx_ring = adapter->tx_ring[i];
@@ -6617,6 +6644,9 @@ static enum hrtimer_restart igc_qbv_sche } } adapter->qbv_transition = false; + +spin_unlock_irqrestore (&adapter->qbv_tx_lock, flags); +return HRTIMER_NORESTART ; }
Greg Kroah-Hartman
maintainerPATCH 129/206 ionic: Add missing err handling for queue reconfig
In reply to Greg Kroah-HartmanFrom: Nitya Sunkad <[email protected]>
commit 52417a95ff2d810dc31a68ae71102e741efea772 upstream.
ionic_start_queues_reconfig returns an error code if txrx_init fails. Handle this error code in the relevant places.
This fixes a corner case where the device could get left in a detached state if the CMB reconfig fails and the attempt to clean up the mess also fails. Note that calling netif_device_attach when the netdev is already attached does not lead to unexpected behavior.
Change goto name "errout" to "err_out" to maintain consistency across goto statements.
--- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-)
drivers/net/ethernet/pensando/ionic/ionic_lif.c +16 -7
@@ -1816,6 +1816,7 @@ static int ionic_change_mtu(struct net_dstatic void ionic_tx_timeout_work (struct work_struct *ws) { struct ionic_lif *lif = container_of(ws, struct ionic_lif, tx_timeout_work); +int err;if (test_bit (IONIC_LIF_F_FW_RESET , lif->state))return ;
@@ -1828,8 +1829,11 @@ static void ionic_tx_timeout_work(structmutex_lock (&lif->queue_lock);ionic_stop_queues_reconfig (lif); -ionic_start_queues_reconfig (lif); + err =ionic_start_queues_reconfig (lif);mutex_unlock (&lif->queue_lock); + +if (err) +dev_err (lif->ionic->dev,"%s: Restarting queues failed\n" , __func__); }static void ionic_tx_timeout (struct net_device *netdev,unsigned int txqueue)
@@ -2799,17 +2803,22 @@ static int ionic_cmb_reconfig(struct ionif (err) {dev_err (lif->ionic->dev,"CMB restore failed: %d\n" , err); - goto errout; + goto err_out; } } -ionic_start_queues_reconfig (lif); - }else { -/* This was detached in ionic_stop_queues_reconfig() */ -netif_device_attach (lif->netdev); + err =ionic_start_queues_reconfig (lif); +if (err) { +dev_err (lif->ionic->dev, +"CMB reconfig failed: %d\n" , err); + goto err_out; + } } -errout: +err_out: +/* This was detached in ionic_stop_queues_reconfig() */ +netif_device_attach (lif->netdev); +return err; }
Greg Kroah-Hartman
maintainerPATCH 130/206 net/packet: annotate data-races around tp->status
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit 8a9896177784063d01068293caea3f74f6830ff6 upstream.
Another syzbot report [1] is about tp->status lockless reads from __packet_get_status()
[1]
BUG: KCSAN: data-race in __packet_rcv_has_room / __packet_set_status
write to 0xffff888117d7c080 of 8 bytes by interrupt on cpu 0:
__packet_set_status+0x78/0xa0 net/packet/af_packet.c:407 tpacket_rcv+0x18bb/0x1a60 net/packet/af_packet.c:2483 deliver_skb net/core/dev.c:2173 [inline] __netif_receive_skb_core+0x408/0x1e80 net/core/dev.c:5337 __netif_receive_skb_one_core net/core/dev.c:5491 [inline] __netif_receive_skb+0x57/0x1b0 net/core/dev.c:5607 process_backlog+0x21f/0x380 net/core/dev.c:5935 __napi_poll+0x60/0x3b0 net/core/dev.c:6498 napi_poll net/core/dev.c:6565 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6698 __do_softirq+0xc1/0x265 kernel/softirq.c:571 invoke_softirq kernel/softirq.c:445 [inline] __irq_exit_rcu+0x57/0xa0 kernel/softirq.c:650 sysvec_apic_timer_interrupt+0x6d/0x80 arch/x86/kernel/apic/apic.c:1106 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645 smpboot_thread_fn+0x33c/0x4a0 kernel/smpboot.c:112 kthread+0x1d7/0x210 kernel/kthread.c:379 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
read to 0xffff888117d7c080 of 8 bytes by interrupt on cpu 1:
__packet_get_status net/packet/af_packet.c:436 [inline] packet_lookup_frame net/packet/af_packet.c:524 [inline] __tpacket_has_room net/packet/af_packet.c:1255 [inline] __packet_rcv_has_room+0x3f9/0x450 net/packet/af_packet.c:1298 tpacket_rcv+0x275/0x1a60 net/packet/af_packet.c:2285 deliver_skb net/core/dev.c:2173 [inline] dev_queue_xmit_nit+0x38a/0x5e0 net/core/dev.c:2243 xmit_one net/core/dev.c:3574 [inline] dev_hard_start_xmit+0xcf/0x3f0 net/core/dev.c:3594 __dev_queue_xmit+0xefb/0x1d10 net/core/dev.c:4244 dev_queue_xmit include/linux/netdevice.h:3088 [inline] can_send+0x4eb/0x5d0 net/can/af_can.c:276 bcm_can_tx+0x314/0x410 net/can/bcm.c:302 bcm_tx_timeout_handler+0xdb/0x260 __run_hrtimer kernel/time/hrtimer.c:1685 [inline] __hrtimer_run_queues+0x217/0x700 kernel/time/hrtimer.c:1749 hrtimer_run_softirq+0xd6/0x120 kernel/time/hrtimer.c:1766 __do_softirq+0xc1/0x265 kernel/softirq.c:571 run_ksoftirqd+0x17/0x20 kernel/softirq.c:939 smpboot_thread_fn+0x30a/0x4a0 kernel/smpboot.c:164 kthread+0x1d7/0x210 kernel/kthread.c:379 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
value changed: 0x0000000000000000 -> 0x0000000020000081
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 6.4.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
--- net/packet/af_packet.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
net/packet/af_packet.c +10 -6
@@ -401,18 +401,20 @@ static void __packet_set_status(struct p {union tpacket_uhdr h; +/* WRITE_ONCE() are paired with READ_ONCE() in __packet_get_status */ + h.raw = frame;switch (po->tp_version) {case TPACKET_V1 : - h.h1->tp_status = status; +WRITE_ONCE (h.h1->tp_status, status);flush_dcache_page (pgv_to_page (&h.h1->tp_status));break ;case TPACKET_V2 : - h.h2->tp_status = status; +WRITE_ONCE (h.h2->tp_status, status);flush_dcache_page (pgv_to_page (&h.h2->tp_status));break ;case TPACKET_V3 : - h.h3->tp_status = status; +WRITE_ONCE (h.h3->tp_status, status);flush_dcache_page (pgv_to_page (&h.h3->tp_status));break ;default :
@@ -429,17 +431,19 @@ static int __packet_get_status(const strsmp_rmb (); +/* READ_ONCE() are paired with WRITE_ONCE() in __packet_set_status */ + h.raw = frame;switch (po->tp_version) {case TPACKET_V1 :flush_dcache_page (pgv_to_page (&h.h1->tp_status)); -return h.h1->tp_status; +return READ_ONCE (h.h1->tp_status);case TPACKET_V2 :flush_dcache_page (pgv_to_page (&h.h2->tp_status)); -return h.h2->tp_status; +return READ_ONCE (h.h2->tp_status);case TPACKET_V3 :flush_dcache_page (pgv_to_page (&h.h3->tp_status)); -return h.h3->tp_status; +return READ_ONCE (h.h3->tp_status);default :WARN (1 ,"TPACKET version not supported.\n" );BUG ();
Greg Kroah-Hartman
maintainerPATCH 131/206 net/smc: Fix setsockopt and sysctl to specify same buffer size again
In reply to Greg Kroah-HartmanFrom: Gerd Bayer <[email protected]>
commit 833bac7ec392bf75053c8a4fa4c36d4148dac77d upstream.
Commit 0227f058aa29 ("net/smc: Unbind r/w buffer size from clcsock and make them tunable") introduced the net.smc.rmem and net.smc.wmem sysctls to specify the size of buffers to be used for SMC type connections. This created a regression for users that specified the buffer size via setsockopt() as the effective buffer size was now doubled.
Re-introduce the division by 2 in the SMC buffer create code and level this out by duplicating the net.smc.[rw]mem values used for initializing sk_rcvbuf/sk_sndbuf at socket creation time. This gives users of both methods (setsockopt or sysctl) the effective buffer size that they expect.
Initialize net.smc.[rw]mem from its own constant of 64kB, respectively. Internal performance tests show that this value is a good compromise between throughput/latency and memory consumption. Also, this decouples it from any tuning that was done to net.ipv4.tcp_[rw]mem[1] before the module for SMC protocol was loaded. Check that no more than INT_MAX / 2 is assigned to net.smc.[rw]mem, in order to avoid any overflow condition when that is doubled for use in sk_sndbuf or sk_rcvbuf.
While at it, drop the confusing sk_buf_size variable from __smc_buf_create and name "compressed" buffer size variables more consistently.
Background:
Before the commit mentioned above, SMC's buffer allocator in __smc_buf_create() always used half of the sockets' sk_rcvbuf/sk_sndbuf value as initial value to search for appropriate buffers. If the search resorted to using a bigger buffer when all buffers of the specified size were busy, the duplicate of the used effective buffer size is stored back to sk_rcvbuf/sk_sndbuf.
When available, buffers of exactly the size that a user had specified as input to setsockopt() were used, despite setsockopt()'s documentation in "man 7 socket" talking of a mandatory duplication:
[...]
SO_SNDBUF
Sets or gets the maximum socket send buffer in bytes. The kernel doubles this value (to allow space for book‐ keeping overhead) when it is set using setsockopt(2), and this doubled value is returned by getsockopt(2).
The default value is set by the
/proc/sys/net/core/wmem_default file and the maximum allowed value is set by the /proc/sys/net/core/wmem_max file. The minimum (doubled) value for this option is 2048.
[...]
--- net/smc/af_smc.c | 4 ++-- net/smc/smc.h | 2 +- net/smc/smc_clc.c | 4 ++-- net/smc/smc_core.c | 25 ++++++++++++------------- net/smc/smc_sysctl.c | 10 ++++++++-- 5 files changed, 25 insertions(+), 20 deletions(-)
net/smc/af_smc.c +2 -2
@@ -378,8 +378,8 @@ static struct sock *smc_sock_alloc(struc sk->sk_state =SMC_INIT ; sk->sk_destruct = smc_destruct; sk->sk_protocol = protocol; -WRITE_ONCE (sk->sk_sndbuf,READ_ONCE (net->smc.sysctl_wmem)); -WRITE_ONCE (sk->sk_rcvbuf,READ_ONCE (net->smc.sysctl_rmem)); +WRITE_ONCE (sk->sk_sndbuf,2 *READ_ONCE (net->smc.sysctl_wmem)); +WRITE_ONCE (sk->sk_rcvbuf,2 *READ_ONCE (net->smc.sysctl_rmem)); smc =smc_sk (sk);INIT_WORK (&smc->tcp_listen_work, smc_tcp_listen_work);INIT_WORK (&smc->connect_work, smc_connect_work);
net/smc/smc.h +1 -1
@@ -161,7 +161,7 @@ struct smc_connection {struct smc_buf_desc *sndbuf_desc;/* send buffer descriptor */ struct smc_buf_desc *rmb_desc;/* RMBE descriptor */ -int rmbe_size_short;/* compressed notation */ +int rmbe_size_comp;/* compressed notation */ int rmbe_update_limit;/* lower limit for consumer * cursor update
net/smc/smc_clc.c +2 -2
@@ -1007,7 +1007,7 @@ static int smc_clc_send_confirm_accept(s clc->d0.gid = conn->lgr->smcd->ops->get_local_gid (conn->lgr->smcd); clc->d0.token = conn->rmb_desc->token; - clc->d0.dmbe_size = conn->rmbe_size_short; + clc->d0.dmbe_size = conn->rmbe_size_comp; clc->d0.dmbe_idx =0 ;memcpy (&clc->d0.linkid, conn->lgr->id,SMC_LGR_ID_SIZE );if (version ==SMC_V1 ) {
@@ -1050,7 +1050,7 @@ static int smc_clc_send_confirm_accept(s clc->r0.qp_mtu =min (link->path_mtu, link->peer_mtu);break ; } - clc->r0.rmbe_size = conn->rmbe_size_short; + clc->r0.rmbe_size = conn->rmbe_size_comp; clc->r0.rmb_dma_addr = conn->rmb_desc->is_vm ?cpu_to_be64 ((uintptr_t )conn->rmb_desc->cpu_addr) : cpu_to_be64((u64)sg_dma_address
net/smc/smc_core.c +12 -13
@@ -2309,31 +2309,30 @@ static int __smc_buf_create(struct smc_sstruct smc_connection *conn = &smc->conn;struct smc_link_group *lgr = conn->lgr;struct list_head *buf_list; -int bufsize, bufsize_short; +int bufsize, bufsize_comp;struct rw_semaphore *lock;/* lock buffer list */ bool is_dgraded = false; -int sk_buf_size;if (is_rmb)/* use socket recv buffer size (w/o overhead) as start value */ - sk_buf_size = smc->sk.sk_rcvbuf; + bufsize = smc->sk.sk_rcvbuf /2 ;else /* use socket send buffer size (w/o overhead) as start value */ - sk_buf_size = smc->sk.sk_sndbuf; + bufsize = smc->sk.sk_sndbuf /2 ; -for (bufsize_short =smc_compress_bufsize (sk_buf_size, is_smcd, is_rmb); - bufsize_short >=0 ; bufsize_short--) { +for (bufsize_comp =smc_compress_bufsize (bufsize, is_smcd, is_rmb); + bufsize_comp >=0 ; bufsize_comp--) {if (is_rmb) { lock = &lgr->rmbs_lock; - buf_list = &lgr->rmbs[bufsize_short]; + buf_list = &lgr->rmbs[bufsize_comp]; }else { lock = &lgr->sndbufs_lock; - buf_list = &lgr->sndbufs[bufsize_short]; + buf_list = &lgr->sndbufs[bufsize_comp]; } - bufsize =smc_uncompress_bufsize (bufsize_short); + bufsize =smc_uncompress_bufsize (bufsize_comp);/* check for reusable slot in the link group */ - buf_desc =smc_buf_get_slot (bufsize_short, lock, buf_list); + buf_desc =smc_buf_get_slot (bufsize_comp, lock, buf_list);if (buf_desc) { buf_desc->is_dma_need_sync =0 ;SMC_STAT_RMB_SIZE (smc, is_smcd, is_rmb, bufsize);
@@ -2377,8 +2376,8 @@ static int __smc_buf_create(struct smc_sif (is_rmb) { conn->rmb_desc = buf_desc; - conn->rmbe_size_short = bufsize_short; - smc->sk.sk_rcvbuf = bufsize; + conn->rmbe_size_comp = bufsize_comp; + smc->sk.sk_rcvbuf = bufsize *2 ;atomic_set (&conn->bytes_to_rcv,0 ); conn->rmbe_update_limit =smc_rmb_wnd_update_limit (buf_desc->len);
@@ -2386,7 +2385,7 @@ static int __smc_buf_create(struct smc_ssmc_ism_set_conn (conn);/* map RMB/smcd_dev to conn */ }else { conn->sndbuf_desc = buf_desc; - smc->sk.sk_sndbuf = bufsize; + smc->sk.sk_sndbuf = bufsize *2 ;atomic_set (&conn->sndbuf_space, bufsize); }return 0 ;
net/smc/smc_sysctl.c +8 -2
@@ -21,6 +21,10 @@static int min_sndbuf =SMC_BUF_MIN_SIZE ;static int min_rcvbuf =SMC_BUF_MIN_SIZE ; +static int max_sndbuf =INT_MAX /2 ; +static int max_rcvbuf =INT_MAX /2 ; +static const int net_smc_wmem_init = (64 *1024 ); +static const int net_smc_rmem_init = (64 *1024 );static struct ctl_table smc_table[] = { {
@@ -53,6 +57,7 @@ static struct ctl_table smc_table[] = { .mode = 0644, .proc_handler = proc_dointvec_minmax, .extra1 = &min_sndbuf, + .extra2 = &max_sndbuf, }, { .procname = "rmem",
@@ -61,6 +66,7 @@ static struct ctl_table smc_table[] = { .mode = 0644, .proc_handler = proc_dointvec_minmax, .extra1 = &min_rcvbuf, + .extra2 = &max_rcvbuf, }, { } };
@@ -88,8 +94,8 @@ int __net_init smc_sysctl_net_init(struc net->smc.sysctl_autocorking_size =SMC_AUTOCORKING_DEFAULT_SIZE ; net->smc.sysctl_smcr_buf_type =SMCR_PHYS_CONT_BUFS ; net->smc.sysctl_smcr_testlink_time =SMC_LLC_TESTLINK_DEFAULT_TIME ; -WRITE_ONCE (net->smc.sysctl_wmem,READ_ONCE (net->ipv4.sysctl_tcp_wmem[1 ])); -WRITE_ONCE (net->smc.sysctl_rmem,READ_ONCE (net->ipv4.sysctl_tcp_rmem[1 ])); +WRITE_ONCE (net->smc.sysctl_wmem, net_smc_wmem_init); +WRITE_ONCE (net->smc.sysctl_rmem, net_smc_rmem_init);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 132/206 net/smc: Use correct buffer sizes when switching between TCP and SMC
In reply to Greg Kroah-HartmanFrom: Gerd Bayer <[email protected]>
commit 30c3c4a4497c3765bf6b298f5072c8165aeaf7cc upstream.
Tuning of the effective buffer size through setsockopts was working for SMC traffic only but not for TCP fall-back connections even before commit 0227f058aa29 ("net/smc: Unbind r/w buffer size from clcsock and make them tunable"). That change made it apparent that TCP fall-back connections would use net.smc.[rw]mem as buffer size instead of net.ipv4_tcp_[rw]mem.
Amend the code that copies attributes between the (TCP) clcsock and the SMC socket and adjust buffer sizes appropriately:
- Copy over sk_userlocks so that both sockets agree on whether tuning via setsockopt is active.
- When falling back to TCP use sk_sndbuf or sk_rcvbuf as specified with setsockopt. Otherwise, use the sysctl value for TCP/IPv4.
- Likewise, use either values from setsockopt or from sysctl for SMC (duplicated) on successful SMC connect.
In smc_tcp_listen_work() drop the explicit copy of buffer sizes as that is taken care of by the attribute copy.
--- net/smc/af_smc.c | 73 ++++++++++++++++++++++++++++++++++++++----------------- 1 file changed, 51 insertions(+), 22 deletions(-)
net/smc/af_smc.c +51 -22
@@ -436,13 +436,60 @@ out:return rc; } +/* copy only relevant settings and flags of SOL_SOCKET level from smc to +* clc socket (since smc is not called for these options from net/core) +*/ + +#define SK_FLAGS_SMC_TO_CLC ((1UL << SOCK_URGINLINE) | \ + (1UL << SOCK_KEEPOPEN) | \ + (1UL << SOCK_LINGER) | \ + (1UL << SOCK_BROADCAST) | \ + (1UL << SOCK_TIMESTAMP) | \ + (1UL << SOCK_DBG) | \ + (1UL << SOCK_RCVTSTAMP) | \ + (1UL << SOCK_RCVTSTAMPNS) | \ + (1UL << SOCK_LOCALROUTE) | \ + (1UL << SOCK_TIMESTAMPING_RX_SOFTWARE) | \ + (1UL << SOCK_RXQ_OVFL) | \ + (1UL << SOCK_WIFI_STATUS) | \ + (1UL << SOCK_NOFCS) | \ + (1UL << SOCK_FILTER_LOCKED) | \ + (1UL << SOCK_TSTAMP_NEW)) + +/* if set, use value set by setsockopt() - else use IPv4 or SMC sysctl value */ +static void smc_adjust_sock_bufsizes (struct sock *nsk,struct sock *osk, +unsigned long mask) +{ +struct net *nnet =sock_net (nsk); + + nsk->sk_userlocks = osk->sk_userlocks; +if (osk->sk_userlocks &SOCK_SNDBUF_LOCK ) { + nsk->sk_sndbuf = osk->sk_sndbuf; + }else { +if (mask ==SK_FLAGS_SMC_TO_CLC ) +WRITE_ONCE (nsk->sk_sndbuf, +READ_ONCE (nnet->ipv4.sysctl_tcp_wmem[1 ])); +else +WRITE_ONCE (nsk->sk_sndbuf, +2 *READ_ONCE (nnet->smc.sysctl_wmem)); + } +if (osk->sk_userlocks &SOCK_RCVBUF_LOCK ) { + nsk->sk_rcvbuf = osk->sk_rcvbuf; + }else { +if (mask ==SK_FLAGS_SMC_TO_CLC ) +WRITE_ONCE (nsk->sk_rcvbuf, +READ_ONCE (nnet->ipv4.sysctl_tcp_rmem[1 ])); +else +WRITE_ONCE (nsk->sk_rcvbuf, +2 *READ_ONCE (nnet->smc.sysctl_rmem)); + } +} +static void smc_copy_sock_settings (struct sock *nsk,struct sock *osk,unsigned long mask) {/* options we don't get control via setsockopt for */ nsk->sk_type = osk->sk_type; - nsk->sk_sndbuf = osk->sk_sndbuf; - nsk->sk_rcvbuf = osk->sk_rcvbuf; nsk->sk_sndtimeo = osk->sk_sndtimeo; nsk->sk_rcvtimeo = osk->sk_rcvtimeo; nsk->sk_mark =READ_ONCE (osk->sk_mark);
@@ -453,26 +500,10 @@ static void smc_copy_sock_settings(struc nsk->sk_flags &= ~mask; nsk->sk_flags |= osk->sk_flags & mask; + +smc_adjust_sock_bufsizes (nsk, osk, mask); } -#define SK_FLAGS_SMC_TO_CLC ((1UL << SOCK_URGINLINE) | \ - (1UL << SOCK_KEEPOPEN) | \ - (1UL << SOCK_LINGER) | \ - (1UL << SOCK_BROADCAST) | \ - (1UL << SOCK_TIMESTAMP) | \ - (1UL << SOCK_DBG) | \ - (1UL << SOCK_RCVTSTAMP) | \ - (1UL << SOCK_RCVTSTAMPNS) | \ - (1UL << SOCK_LOCALROUTE) | \ - (1UL << SOCK_TIMESTAMPING_RX_SOFTWARE) | \ - (1UL << SOCK_RXQ_OVFL) | \ - (1UL << SOCK_WIFI_STATUS) | \ - (1UL << SOCK_NOFCS) | \ - (1UL << SOCK_FILTER_LOCKED) | \ - (1UL << SOCK_TSTAMP_NEW)) -/* copy only relevant settings and flags of SOL_SOCKET level from smc to -* clc socket (since smc is not called for these options from net/core) -*/ static void smc_copy_sock_settings_to_clc (struct smc_sock *smc) {smc_copy_sock_settings (smc->clcsock->sk, &smc->sk,SK_FLAGS_SMC_TO_CLC );
@@ -2479,8 +2510,6 @@ static void smc_tcp_listen_work(struct wsock_hold (lsk);/* sock_put in smc_listen_work */ INIT_WORK (&new_smc->smc_listen_work, smc_listen_work);smc_copy_sock_settings_to_smc (new_smc); - new_smc->sk.sk_sndbuf = lsmc->sk.sk_sndbuf; - new_smc->sk.sk_rcvbuf = lsmc->sk.sk_rcvbuf;sock_hold (&new_smc->sk);/* sock_put in passive closing */ if (!queue_work (smc_hs_wq, &new_smc->smc_listen_work))sock_put (&new_smc->sk);
Greg Kroah-Hartman
maintainerPATCH 133/206 PCI: move OF status = "disabled" detection to dev->match_driver
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
commit 1a8c251cff2052b60009a070173308322e9600d3 upstream.
The blamed commit has broken probing on arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi when &enetc_port0 (PCI function 0) has status = "disabled".
Background: pci_scan_slot() has logic to say that if the function 0 of a device is absent, the entire device is absent and we can skip the other functions entirely. Traditionally, this has meant that pci_bus_read_dev_vendor_id() returns an error code for that function.
However, since the blamed commit, there is an extra confounding
condition: function 0 of the device exists and has a valid vendor id, but it is disabled in the device tree. In that case, pci_scan_slot() would incorrectly skip the entire device instead of just that function.
In the case of NXP LS1028A, status = "disabled" does not mean that the PCI function's config space is not available for reading. It is, but the Ethernet port is just not functionally useful with a particular SerDes protocol configuration (0x9999) due to pinmuxing constraints of the Soc. So, pci_scan_slot() skips all other functions on the ENETC ECAM (enetc_port1, enetc_port2, enetc_mdio_pf3 etc) when just enetc_port0 had to not be probed.
There is an additional regression introduced by the change, caused by its fundamental premise. The enetc driver needs to run code for all PCI functions, regardless of whether they're enabled or not in the device tree. That is no longer possible if the driver's probe function is no longer called. But Rob recommends that we move the of_device_is_available() detection to dev->match_driver, and this makes the PCI fixups still run on all functions, while just probing drivers for those functions that are enabled. So, a separate change in the enetc driver will have to move the workarounds to a PCI fixup.
--- drivers/pci/bus.c | 4 +++- drivers/pci/of.c | 5 ----- 2 files changed, 3 insertions(+), 6 deletions(-)
drivers/pci/bus.c +3 -1
@@ -11,6 +11,7 @@#include <linux/pci.h> #include <linux/errno.h> #include <linux/ioport.h> +#include <linux/of.h> #include <linux/proc_fs.h> #include <linux/slab.h>
@@ -332,6 +333,7 @@ void __weak pcibios_bus_add_device(struc*/ void pci_bus_add_device (struct pci_dev *dev) { +struct device_node *dn = dev->dev.of_node;int retval;/*
@@ -344,7 +346,7 @@ void pci_bus_add_device(struct pci_dev *pci_proc_attach_device (dev);pci_bridge_d3_update (dev); - dev->match_driver = true; + dev->match_driver = !dn ||of_device_is_available (dn); retval =device_attach (&dev->dev);if (retval <0 && retval != -EPROBE_DEFER )pci_warn (dev,"device attach failed (%d)\n" , retval);
drivers/pci/of.c +0 -5
@@ -34,11 +34,6 @@ int pci_set_of_node(struct pci_dev *dev)if (!node)return 0 ; -if (!of_device_is_available (node)) { -of_node_put (node); -return -ENODEV ; - } - dev->dev.of_node = node; dev->dev.fwnode = &node->fwnode;return 0 ;
Greg Kroah-Hartman
maintainerPATCH 134/206 tcp: add missing family to tcp_set_ca_state() tracepoint
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit 8a70ed9520c5fafaac91053cacdd44625c39e188 upstream.
Before this code is copied, add the missing family, as we did in commit 3dd344ea84e1 ("net: tracepoint: exposing sk_family in all tcp:tracepoints")
--- include/trace/events/tcp.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
include/trace/events/tcp.h +4 -1
@@ -381,6 +381,7 @@ TRACE_EVENT(tcp_cong_state_set, __field(const void *, skaddr) __field(__u16, sport) __field(__u16, dport) + __field(__u16, family) __array(__u8, saddr, 4) __array(__u8, daddr, 4) __array(__u8, saddr_v6, 16)
@@ -396,6 +397,7 @@ TRACE_EVENT(tcp_cong_state_set, __entry->sport =ntohs (inet->inet_sport); __entry->dport =ntohs (inet->inet_dport); + __entry->family = sk->sk_family; p32 = (__be32 *) __entry->saddr; *p32 = inet->inet_saddr;
@@ -409,7 +411,8 @@ TRACE_EVENT(tcp_cong_state_set, __entry->cong_state = ca_state; ), - TP_printk("sport=%hu dport=%hu saddr=%pI4 daddr=%pI4 saddrv6=%pI6c daddrv6=%pI6c cong_state=%u", + TP_printk("family=%s sport=%hu dport=%hu saddr=%pI4 daddr=%pI4 saddrv6=%pI6c daddrv6=%pI6c cong_state=%u", + show_family_name(__entry->family), __entry->sport, __entry->dport, __entry->saddr, __entry->daddr, __entry->saddr_v6, __entry->daddr_v6,
Greg Kroah-Hartman
maintainerPATCH 135/206 tunnels: fix kasan splat when generating ipv4 pmtu error
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
commit 6a7ac3d20593865209dceb554d8b3f094c6bd940 upstream.
If we try to emit an icmp error in response to a nonliner skb, we get
BUG: KASAN: slab-out-of-bounds in ip_compute_csum+0x134/0x220 Read of size 4 at addr ffff88811c50db00 by task iperf3/1691 CPU: 2 PID: 1691 Comm: iperf3 Not tainted 6.5.0-rc3+ #309 [..] kasan_report+0x105/0x140 ip_compute_csum+0x134/0x220 iptunnel_pmtud_build_icmp+0x554/0x1020 skb_tunnel_check_pmtu+0x513/0xb80 vxlan_xmit_one+0x139e/0x2ef0 vxlan_xmit+0x1867/0x2760 dev_hard_start_xmit+0x1ee/0x4f0 br_dev_queue_push_xmit+0x4d1/0x660 [..]
ip_compute_csum() cannot deal with nonlinear skbs, so avoid it. After this change, splat is gone and iperf3 is no longer stuck.
--- net/ipv4/ip_tunnel_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/ip_tunnel_core.c +1 -1
@@ -224,7 +224,7 @@ static int iptunnel_pmtud_build_icmp(str .un.frag.__unused = 0, .un.frag.mtu = htons(mtu), }; - icmph->checksum =ip_compute_csum (icmph, len); + icmph->checksum =csum_fold (skb_checksum (skb,0 , len,0 ));skb_reset_transport_header (skb); niph =skb_push (skb,sizeof (*niph));
Greg Kroah-Hartman
maintainerPATCH 136/206 xsk: fix refcount underflow in error path
In reply to Greg Kroah-HartmanFrom: Magnus Karlsson <[email protected]>
commit 85c2c79a07302fe68a1ad5cc449458cc559e314d upstream.
Fix a refcount underflow problem reported by syzbot that can happen when a system is running out of memory. If xp_alloc_tx_descs() fails, and it can only fail due to not having enough memory, then the error path is triggered. In this error path, the refcount of the pool is decremented as it has incremented before. However, the reference to the pool in the socket was not nulled. This means that when the socket is closed later, the socket teardown logic will think that there is a pool attached to the socket and try to decrease the refcount again, leading to a refcount underflow.
I chose this fix as it involved adding just a single line. Another option would have been to move xp_get_pool() and the assignment of xs->pool to after the if-statement and using xs_umem->pool instead of xs->pool in the whole if-statement resulting in somewhat simpler code, but this would have led to much more churn in the code base perhaps making it harder to backport.
--- net/xdp/xsk.c | 1 + 1 file changed, 1 insertion(+)
net/xdp/xsk.c +1 -0
@@ -994,6 +994,7 @@ static int xsk_bind(struct socket *sock, err =xp_alloc_tx_descs (xs->pool, xs);if (err) {xp_put_pool (xs->pool); + xs->pool =NULL ;sockfd_put (sock); goto out_unlock; }
Greg Kroah-Hartman
maintainerPATCH 137/206 bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
In reply to Greg Kroah-HartmanFrom: Ziyang Xuan <[email protected]>
commit 01f4fd27087078c90a0e22860d1dfa2cd0510791 upstream.
BUG_ON(!vlan_info) is triggered in unregister_vlan_dev() with following testcase:
# ip netns add ns1 # ip netns exec ns1 ip link add bond0 type bond mode 0 # ip netns exec ns1 ip link add bond_slave_1 type veth peer veth2 # ip netns exec ns1 ip link set bond_slave_1 master bond0 # ip netns exec ns1 ip link add link bond_slave_1 name vlan10 type vlan id 10 protocol 802.1ad # ip netns exec ns1 ip link add link bond0 name bond0_vlan10 type vlan id 10 protocol 802.1ad # ip netns exec ns1 ip link set bond_slave_1 nomaster # ip netns del ns1
The logical analysis of the problem is as follows:
1. create ETH_P_8021AD protocol vlan10 for bond_slave_1:register_vlan_dev()
vlan_vid_add()
vlan_info_alloc()
__vlan_vid_add() // add [ETH_P_8021AD, 10] vid to bond_slave_12. create ETH_P_8021AD protocol bond0_vlan10 for bond0:register_vlan_dev()
vlan_vid_add()
__vlan_vid_add()
vlan_add_rx_filter_info()
if (!vlan_hw_filter_capable(dev, proto)) // condition established because bond0 without NETIF_F_HW_VLAN_STAG_FILTER
return 0;
if (netif_device_present(dev))
return dev->netdev_ops->ndo_vlan_rx_add_vid(dev, proto, vid); // will be never called
// The slaves of bond0 will not refer to the [ETH_P_8021AD, 10] vid.3. detach bond_slave_1 from bond0:__bond_release_one()
vlan_vids_del_by_dev()
list_for_each_entry(vid_info, &vlan_info->vid_list, list)
vlan_vid_del(dev, vid_info->proto, vid_info->vid);
// bond_slave_1 [ETH_P_8021AD, 10] vid will be deleted.
// bond_slave_1->vlan_info will be assigned NULL.4. delete vlan10 during delete ns1:default_device_exit_batch()
dev->rtnl_link_ops->dellink() // unregister_vlan_dev() for vlan10
vlan_info = rtnl_dereference(real_dev->vlan_info); // real_dev of vlan10 is bond_slave_1 BUG_ON(!vlan_info); // bond_slave_1->vlan_info is NULL now, bug is triggered!!!
Add S-VLAN tag related features support to bond driver. So the bond driver will always propagate the VLAN info to its slaves.
--- drivers/net/bonding/bond_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/bonding/bond_main.c +3 -1
@@ -5898,7 +5898,9 @@ void bond_setup(struct net_device *bond_ bond_dev->hw_features =BOND_VLAN_FEATURES |NETIF_F_HW_VLAN_CTAG_RX | -NETIF_F_HW_VLAN_CTAG_FILTER ; +NETIF_F_HW_VLAN_CTAG_FILTER | +NETIF_F_HW_VLAN_STAG_RX | +NETIF_F_HW_VLAN_STAG_FILTER ; bond_dev->hw_features |=NETIF_F_GSO_ENCAP_ALL ; bond_dev->features |= bond_dev->hw_features;
Greg Kroah-Hartman
maintainerPATCH 138/206 dccp: fix data-race around dp->dccps_mss_cache
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit a47e598fbd8617967e49d85c49c22f9fc642704c upstream.
dccp_sendmsg() reads dp->dccps_mss_cache before locking the socket. Same thing in do_dccp_getsockopt().
Add READ_ONCE()/WRITE_ONCE() annotations,
and change dccp_sendmsg() to check again dccps_mss_cache after socket is locked.
--- net/dccp/output.c | 2 +- net/dccp/proto.c | 10 ++++++++-- 2 files changed, 9 insertions(+), 3 deletions(-)
net/dccp/output.c +1 -1
@@ -187,7 +187,7 @@ unsigned int dccp_sync_mss(struct sock */* And store cached results */ icsk->icsk_pmtu_cookie = pmtu; - dp->dccps_mss_cache = cur_mps; +WRITE_ONCE (dp->dccps_mss_cache, cur_mps);return cur_mps; }
net/dccp/proto.c +8 -2
@@ -630,7 +630,7 @@ static int do_dccp_getsockopt(struct socreturn dccp_getsockopt_service (sk, len, (__be32 __user *)optval, optlen);case DCCP_SOCKOPT_GET_CUR_MPS : - val = dp->dccps_mss_cache; + val =READ_ONCE (dp->dccps_mss_cache);break ;case DCCP_SOCKOPT_AVAILABLE_CCIDS :return ccid_getsockopt_builtin_ccids (sk, len, optval, optlen);
@@ -739,7 +739,7 @@ int dccp_sendmsg(struct sock *sk, structtrace_dccp_probe (sk, len); -if (len > dp->dccps_mss_cache) +if (len >READ_ONCE (dp->dccps_mss_cache))return -EMSGSIZE ;lock_sock (sk);
@@ -772,6 +772,12 @@ int dccp_sendmsg(struct sock *sk, struct goto out_discard; } +/* We need to check dccps_mss_cache after socket is locked. */ +if (len > dp->dccps_mss_cache) { + rc = -EMSGSIZE ; + goto out_discard; + } +skb_reserve (skb, sk->sk_prot->max_header); rc =memcpy_from_msg (skb_put (skb, len), msg, len);if (rc !=0 )