6.4.12-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 6.4.12-rc1 review
This is the start of the stable review cycle for the 6.4.12 release. There are 234 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 23 Aug 2023 19:40:45 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.4.12-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.4.12-rc1
Jason Xing <[email protected]>
net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled
Kuniyuki Iwashima <[email protected]>
af_unix: Fix null-ptr-deref in unix_stream_sendpage().
Ranjani Sridharan <[email protected]>
ASoC: SOF: intel: hda: Clean up link DMA for IPC3 during stop
Arnaldo Carvalho de Melo <[email protected]>
Revert "perf report: Append inlines to non-DWARF callchains"
Guchun Chen <[email protected]>
drm/amdgpu: keep irq count in amdgpu_irq_disable_all
Tim Huang <[email protected]>
drm/amd/pm: skip the RLC stop when S0i3 suspend for SMU v13.0.4/11
Daniel Miess <[email protected]>
drm/amd/display: disable RCO for DCN314
Arnd Bergmann <[email protected]>
ASoC: amd: vangogh: select CONFIG_SND_AMD_ACP_CONFIG
Umio Yasuno <[email protected]>
drm/amdgpu/pm: fix throttle_status for other than MP1 11.0.7
Tim Huang <[email protected]>
drm/amdgpu: skip fence GFX interrupts disable/enable for S0ix
Mario Limonciello <[email protected]>
drm/amd: flush any delayed gfxoff on suspend entry
Jani Nikula <[email protected]>
drm/i915/sdvo: fix panel_type initialization
Alex Deucher <[email protected]>
Revert "Revert "drm/amdgpu/display: change pipe policy for DCN 2.0""
Jani Nikula <[email protected]>
Revert "drm/edid: Fix csync detailed mode parsing"
Wander Lairson Costa <[email protected]>
drm/qxl: fix UAF on handle creation
Harshit Mogalapalli <[email protected]>
mmc: sunplus: Fix error handling in spmmc_drv_probe()
Wei Chen <[email protected]>
mmc: sunplus: fix return value check of mmc_add_host()
Yibin Ding <[email protected]>
mmc: block: Fix in_flight[issue_type] value error
Yang Yingliang <[email protected]>
mmc: wbsd: fix double mmc_free_host() in wbsd_init()
Yangtao Li <[email protected]>
mmc: f-sdh30: fix order of function calls in sdhci_f_sdh30_remove
Shazad Hussain <[email protected]>
dt-bindings: pinctrl: qcom,sa8775p-tlmm: add gpio function constant
Laurent Pinchart <[email protected]>
media: uvcvideo: Fix menu count handling for userspace XU mappings
Sweet Tea Dorminy <[email protected]>
blk-crypto: dynamically allocate fallback profile
Mark Brown <[email protected]>
arm64/ptrace: Ensure that the task sees ZT writes on first use
Mark Brown <[email protected]>
arm64/ptrace: Ensure that SME is set up for target when writing SSVE state
Yogesh Hegde <[email protected]>
arm64: dts: rockchip: Fix Wifi/Bluetooth on ROCK Pi 4 boards
Hawkins Jiawei <[email protected]>
virtio-net: Zero max_tx_vq field for VIRTIO_NET_CTRL_MQ_HASH_CONFIG case
Martin Fuzzey <[email protected]>
regulator: da9063: better fix null deref with partial DT
Scott Mayhew <[email protected]>
smb: client: fix null auth
Mingzheng Xing <[email protected]>
riscv: Handle zicsr/zifencei issue between gcc and binutils
Helge Deller <[email protected]>
parisc: Fix CONFIG_TLB_PTLOCK to work with lightweight spinlock checks
Russell Harmon via samba-technical <[email protected]>
cifs: Release folio lock on fscache read hit.
dengxiang <[email protected]>
ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces.
Tony Lindgren <[email protected]>
serial: 8250: Fix oops for port->pm on uart_change_pm()
Alexandre Ghiti <[email protected]>
riscv: uaccess: Return the number of bytes effectively not copied
Nam Cao <[email protected]>
riscv: correct riscv_insn_is_c_jr() and riscv_insn_is_c_jalr()
Celeste Liu <[email protected]>
riscv: entry: set a0 = -ENOSYS only when syscall != -1
Kailang Yang <[email protected]>
ALSA: hda/realtek - Remodified 3k pull low procedure
Jiasheng Jiang <[email protected]>
soc: aspeed: socinfo: Add kfree for kstrdup
Zev Weiss <[email protected]>
soc: aspeed: uart-routing: Use __sysfs_match_string
Ninad Naik <[email protected]>
pinctrl: qcom: Add intr_target_width field to support increased number of interrupt targets
Stefan Binding <[email protected]>
ALSA: hda/realtek: Add quirks for HP G11 Laptops
Jerome Brunet <[email protected]>
ASoC: meson: axg-tdm-formatter: fix channel slot allocation
Zhang Shurong <[email protected]>
ASoC: rt5665: add missed regulator_bulk_disable
Alexander Stein <[email protected]>
arm64: dts: imx93: Fix anatop node size
Bard Liao <[email protected]>
ASoC: max98363: don't return on success reading revision ID
Xiaolei Wang <[email protected]>
ARM: dts: imx: Set default tuning step for imx6sx usdhc
Fabio Estevam <[email protected]>
arm64: dts: imx8mm: Drop CSI1 PHY reference clock configuration
Xiaolei Wang <[email protected]>
ARM: dts: imx: Set default tuning step for imx7d usdhc
Stefan Wahren <[email protected]>
ARM: dts: imx: Adjust dma-apbh node name
Andrej Picej <[email protected]>
ARM: dts: imx6: phytec: fix RTC interrupt level
Christopher Obbard <[email protected]>
arm64: dts: rockchip: Disable HS400 for eMMC on ROCK 4C+
Christopher Obbard <[email protected]>
arm64: dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4
Dmitry Baryshkov <[email protected]>
arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict
Tony Lindgren <[email protected]>
bus: ti-sysc: Flush posted write on enable before reset
Marcin Szycik <[email protected]>
ice: Block switchdev mode when ADQ is active and vice versa
Manish Chopra <[email protected]>
qede: fix firmware halt over suspend and resume
Eric Dumazet <[email protected]>
net: do not allow gso_size to be set to GSO_BY_FRAGS
Abel Wu <[email protected]>
sock: Fix misuse of sk_under_memory_pressure()
Edward Cree <[email protected]>
sfc: don't fail probe if MAE/TC setup fails
Edward Cree <[email protected]>
sfc: don't unregister flow_indr if it was never registered
Edward Cree <[email protected]>
sfc: add fallback action-set-lists for TC offload
Alfred Lee <[email protected]>
net: dsa: mv88e6xxx: Wait for EEPROM done before HW reset
Karol Herbst <[email protected]>
drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create
Dragos Tatulea <[email protected]>
net/mlx5e: XDP, Fix fifo overrun on XDP_REDIRECT
Andrii Staikov <[email protected]>
i40e: fix misleading debug logs
Piotr Gardocki <[email protected]>
iavf: fix FDIR rule fields masks validation
Jakub Kicinski <[email protected]>
net: openvswitch: reject negative ifindex
Ziyang Xuan <[email protected]>
team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
Justin Chen <[email protected]>
net: phy: broadcom: stub c45 read/write for 54810
Pablo Neira Ayuso <[email protected]>
netfilter: nft_dynset: disallow object maps
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: GC transaction race with netns dismantle
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path
Sishuai Gong <[email protected]>
ipvs: fix racy memcpy in proc_do_sync_threshold
Xin Long <[email protected]>
netfilter: set default timeout to 3 secs for sctp shutdown send and recv state
Florian Westphal <[email protected]>
netfilter: nf_tables: don't fail inserts if duplicate has expired
Florian Westphal <[email protected]>
netfilter: nf_tables: deactivate catchall elements in next generation
Florian Westphal <[email protected]>
netfilter: nf_tables: fix false-positive lockdep splat
Dan Carpenter <[email protected]>
accel/qaic: Clean up integer overflow checking in map_user_pages()
Pranjal Ramajor Asha Kanojiya <[email protected]>
accel/qaic: Fix slicing memory leak
Liang Chen <[email protected]>
net: veth: Page pool creation error handling for existing pools only
Michal Schmidt <[email protected]>
octeon_ep: cancel queued works in probe error path
Michal Schmidt <[email protected]>
octeon_ep: cancel ctrl_mbox_task after intr_poll_task
Michal Schmidt <[email protected]>
octeon_ep: cancel tx_timeout_task later in remove sequence
Michal Schmidt <[email protected]>
octeon_ep: fix timeout value for waiting on mbox response
Radhey Shyam Pandey <[email protected]>
net: macb: In ZynqMP resume always configure PS GTR for non-wakeup source
Vinay Belgaumkar <[email protected]>
drm/i915/guc/slpc: Restore efficient freq earlier
Luca Ceresoli <[email protected]>
drm/panel: simple: Fix AUO G121EAN01 panel timings according to the docs
Petr Machata <[email protected]>
selftests: mirror_gre_changes: Tighten up the TTL test match
Russell King (Oracle) <[email protected]>
net: phy: fix IRQ-based wake-on-lan over hibernate / power off
Xiang Yang <[email protected]>
net: pcs: Add missing put_device call in miic_create
Jason Wang <[email protected]>
virtio-net: set queues after driver_ok
Leon Romanovsky <[email protected]>
xfrm: don't skip free of empty state in acquire policy
Leon Romanovsky <[email protected]>
xfrm: delete offloaded policy
Lin Ma <[email protected]>
xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH
Lin Ma <[email protected]>
xfrm: add NULL check in xfrm_update_ae_params
Zhengchao Shao <[email protected]>
ip_vti: fix potential slab-use-after-free in decode_session6
Zhengchao Shao <[email protected]>
ip6_vti: fix slab-use-after-free in decode_session6
Zhengchao Shao <[email protected]>
xfrm: fix slab-use-after-free in decode_session6
Herbert Xu <[email protected]>
xfrm: Silence warnings triggerable by bad packets
Lin Ma <[email protected]>
net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure
Lin Ma <[email protected]>
net: af_key: fix sadb_x_filter validation
Lin Ma <[email protected]>
net: xfrm: Fix xfrm_address_filter OOB read
Borislav Petkov (AMD) <[email protected]>
x86/srso: Correct the mitigation status when SMT is disabled
Petr Pavlu <[email protected]>
x86/retpoline,kprobes: Skip optprobe check for indirect jumps with retpolines and IBT
Petr Pavlu <[email protected]>
x86/retpoline,kprobes: Fix position of thunk sections with CONFIG_LTO_CLANG
Borislav Petkov (AMD) <[email protected]>
x86/srso: Disable the mitigation on unaffected configurations
Borislav Petkov (AMD) <[email protected]>
x86/CPU/AMD: Fix the DIV(0) initial fix attempt
Sean Christopherson <[email protected]>
x86/retpoline: Don't clobber RFLAGS during srso_safe_ret()
Peter Zijlstra <[email protected]>
x86/static_call: Fix __static_call_fixup()
Peter Zijlstra <[email protected]>
objtool/x86: Fixup frame-pointer vs rethunk
Borislav Petkov (AMD) <[email protected]>
x86/srso: Explain the untraining sequences a bit more
Peter Zijlstra <[email protected]>
x86/cpu/kvm: Provide UNTRAIN_RET_VM
Peter Zijlstra <[email protected]>
x86/cpu: Cleanup the untrain mess
Peter Zijlstra <[email protected]>
x86/cpu: Rename srso_(.*)_alias to srso_alias_\1
Peter Zijlstra <[email protected]>
x86/cpu: Rename original retbleed methods
Peter Zijlstra <[email protected]>
x86/cpu: Clean up SRSO return thunk mess
Peter Zijlstra <[email protected]>
x86/alternative: Make custom return thunk unconditional
Peter Zijlstra <[email protected]>
objtool/x86: Fix SRSO mess
Peter Zijlstra <[email protected]>
x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk()
Peter Zijlstra <[email protected]>
x86/cpu: Fix __x86_return_thunk symbol type
Tam Nguyen <[email protected]>
i2c: designware: Handle invalid SMBus block data response length value
Quan Nguyen <[email protected]>
i2c: designware: Correct length byte validation logic
Chris Mason <[email protected]>
btrfs: only subtract from len_to_oe_boundary when it is tracking an extent
Anand Jain <[email protected]>
btrfs: fix replace/scrub failure with metadata_uuid
xiaoshoukui <[email protected]>
btrfs: fix BUG_ON condition in btrfs_cancel_balance
Josef Bacik <[email protected]>
btrfs: fix incorrect splitting in btrfs_drop_extent_map_range
Filipe Manana <[email protected]>
btrfs: fix infinite directory reads
Sherry Sun <[email protected]>
tty: serial: fsl_lpuart: Clear the error flags by writing 1 for lpuart32 platforms
Yi Yang <[email protected]>
tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
Steve French <[email protected]>
smb3: display network namespace in debug information
Dragos Tatulea <[email protected]>
vdpa: Enable strict validation for netlinks ops
Lin Ma <[email protected]>
vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check
Lin Ma <[email protected]>
vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check
Lin Ma <[email protected]>
vdpa: Add features attr to vdpa_nl_policy for nlattr length check
Nathan Lynch <[email protected]>
powerpc/rtas_flash: allow user copy to flash block cache objects
Chen-Yu Tsai <[email protected]>
media: mtk-jpeg: Set platform driver data earlier
Yuanjun Gong <[email protected]>
fbdev: mmp: fix value check in mmphw_probe()
Ming Lei <[email protected]>
blk-cgroup: hold queue_lock when removing blkg->q_node
Parker Newman <[email protected]>
i2c: tegra: Fix i2c-tegra DMA config option processing
Yicong Yang <[email protected]>
i2c: hisi: Only handle the interrupt of the driver's transfer
Chengfeng Ye <[email protected]>
i2c: bcm-iproc: Fix bcm_iproc_i2c_isr deadlock issue
Qingsong Chen <[email protected]>
rust: macros: vtable: fix HAS_* redefinition (gen_const_name)
Steve French <[email protected]>
cifs: fix potential oops in cifs_oplock_break
Eugenio Pérez <[email protected]>
vdpa/mlx5: Delete control vq iotlb in destroy_mr only when necessary
Dragos Tatulea <[email protected]>
vdpa/mlx5: Fix mr->initialized semantics
Gal Pressman <[email protected]>
virtio-vdpa: Fix cpumask memory leak in virtio_vdpa_find_vqs()
Maxime Coquelin <[email protected]>
vduse: Use proper spinlock for IRQ injection
Wolfram Sang <[email protected]>
virtio-mmio: don't break lifecycle of vm_dev
Abel Vesa <[email protected]>
regulator: qcom-rpmh: Fix LDO 12 regulator for PM8550
Filipe Manana <[email protected]>
btrfs: fix use-after-free of new block group that became unused
Naohiro Aota <[email protected]>
btrfs: move out now unused BG from the reclaim list
Chen Lin <[email protected]>
ring-buffer: Do not swap cpu_buffer during resize process
Andy Shevchenko <[email protected]>
Bluetooth: MGMT: Use correct address for memcpy()
Benjamin Gray <[email protected]>
powerpc/kasan: Disable KCOV in KASAN code
Luke D. Jones <[email protected]>
ALSA: hda/realtek: Add quirk for ASUS ROG GZ301V
Luke D. Jones <[email protected]>
ALSA: hda/realtek: Add quirk for ASUS ROG G614Jx
Luke D. Jones <[email protected]>
ALSA: hda/realtek: Amend G634 quirk to enable rear speakers
Luke D. Jones <[email protected]>
ALSA: hda/realtek: Add quirk for ASUS ROG GA402X
Luke D. Jones <[email protected]>
ALSA: hda/realtek: Add quirk for ASUS ROG GX650P
Tuo Li <[email protected]>
ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
dengxiang <[email protected]>
ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760
Konstantin Komarov <[email protected]>
fs/ntfs3: Alternative boot if primary boot is corrupted
Konstantin Komarov <[email protected]>
fs/ntfs3: Mark ntfs dirty when on-disk struct is corrupted
Jia-Ju Bai <[email protected]>
fs: ntfs3: Fix possible null-pointer dereferences in mi_read()
Edward Lo <[email protected]>
fs/ntfs3: Return error for inconsistent extended attributes
Edward Lo <[email protected]>
fs/ntfs3: Enhance sanity check while generating attr_list
shanzhulig <[email protected]>
drm/amdgpu: Fix potential fence use-after-free v2
Xiubo Li <[email protected]>
ceph: try to dump the msgs when decoding fails
Matthew Anderson <[email protected]>
Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus Ally
Zhengping Jiang <[email protected]>
Bluetooth: L2CAP: Fix use-after-free
Yuechao Zhao <[email protected]>
watchdog: sp5100_tco: support Hygon FCH/SCH (Server Controller Hub)
Zhang Shurong <[email protected]>
firewire: net: fix use after free in fwnet_finish_incoming_packet()
Mika Westerberg <[email protected]>
thunderbolt: Limit Intel Barlow Ridge USB3 bandwidth
Mika Westerberg <[email protected]>
thunderbolt: Add Intel Barlow Ridge PCI ID
Armin Wolf <[email protected]>
pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db()
Tuo Li <[email protected]>
gfs2: Fix possible data races in gfs2_show_options()
Xu Yang <[email protected]>
usb: chipidea: imx: add missing USB PHY DPDM wakeup setting
Xu Yang <[email protected]>
usb: chipidea: imx: turn off vbus comparator when suspend
Xu Yang <[email protected]>
usb: chipidea: imx: don't request QoS for imx8ulp
Mathias Nyman <[email protected]>
xhci: get rid of XHCI_PLAT quirk that used to prevent MSI setup
Mika Westerberg <[email protected]>
thunderbolt: Read retimer NVM authentication status prior tb_retimer_set_inbound_sbtx()
Hans Verkuil <[email protected]>
media: platform: mediatek: vpu: fix NULL ptr dereference
Avichal Rakesh <[email protected]>
usb: gadget: uvc: queue empty isoc requests if no video buffer is available
Prashanth K <[email protected]>
usb: gadget: u_serial: Avoid spinlock recursion in __gs_console_push
Andrey Konovalov <[email protected]>
media: camss: set VFE bpl_alignment to 16 for sdm845 and sm8250
Yunfei Dong <[email protected]>
media: v4l2-mem2mem: add lock to protect parameter num_rdy
Lu Hongfei <[email protected]>
led: qcom-lpg: Fix resource leaks in for_each_available_child_of_node() loops
Uwe Kleine-König <[email protected]>
serial: stm32: Ignore return value of uart_remove_one_port() in .remove()
Winston Wen <[email protected]>
cifs: fix session state check in reconnect to avoid use-after-free issue
Paulo Alcantara <[email protected]>
smb: client: fix warning in cifs_smb3_do_mount()
Masahiro Yamada <[email protected]>
Revert "[PATCH] uml: export symbols added by GCC hardened"
Even Xu <[email protected]>
HID: intel-ish-hid: ipc: Add Arrow Lake PCI device ID
Peter Ujfalusi <[email protected]>
ASoC: SOF: core: Free the firmware trace before calling snd_sof_shutdown()
Daniel Miess <[email protected]>
drm/amd/display: Enable dcn314 DPP RCO
Nicholas Kazlauskas <[email protected]>
drm/amd/display: Skip DPP DTO update if root clock is gated
Kashyap Desai <[email protected]>
RDMA/bnxt_re: consider timeout of destroy ah as success.
Patrisious Haddad <[email protected]>
RDMA/mlx5: Return the firmware result upon destroying QP/RQ
Lang Yu <[email protected]>
drm/amdgpu: unmap and remove csa_va properly
Alvin Lee <[email protected]>
drm/amd/display: Apply 60us prefetch for DCFCLK <= 300Mhz
Daniel Miess <[email protected]>
drm/amd/display: Remove v_startup workaround for dcn3+
Lang Yu <[email protected]>
drm/amdgpu: install stub fence into potential unused fence pointers
Suravee Suthikulpanit <[email protected]>
iommu/amd: Introduce Disable IRTE Caching Support
stuarthayhurst <[email protected]>
HID: logitech-hidpp: Add USB and Bluetooth IDs for the Logitech G915 TKL Keyboard
Fei Shao <[email protected]>
HID: i2c-hid: goodix: Add support for "goodix,no-reset-during-suspend" property
Fei Shao <[email protected]>
dt-bindings: input: goodix: Add "goodix,no-reset-during-suspend" property
Moti Haimovski <[email protected]>
accel/habanalabs: fix mem leak in capture user mappings
Ofir Bitton <[email protected]>
accel/habanalabs: add pci health check during heartbeat
gaoxu <[email protected]>
dma-remap: use kvmalloc_array/kvfree for larger dma memory remap
Pierre-Louis Bossart <[email protected]>
ASoC: SOF: Intel: fix SoundWire/HDaudio mutual exclusion
Geert Uytterhoeven <[email protected]>
iopoll: Call cpu_relax() in busy loops
Uday M Bhat <[email protected]>
ASoC: Intel: sof_sdw: Add support for Rex soundwire
Pierre-Louis Bossart <[email protected]>
ASoC: Intel: sof_sdw: add quick for Dell SKU 0BDA
Bard Liao <[email protected]>
ASoC: Intel: sof_sdw_rt_sdca_jack_common: test SOF_JACK_JDSRC in _exit
Oleksij Rempel <[email protected]>
ARM: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related warnings
Long Li <[email protected]>
RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing
Venkata Prasad Potturu <[email protected]>
ASoC: amd: vangogh: Add check for acp config flags in vangogh platform
Wolfram Sang <[email protected]>
drm: rcar-du: remove R-Car H3 ES1.* workarounds
Kathiravan T <[email protected]>
arm64: dts: qcom: ipq5332: add QFPROM node
Raphael Gallais-Pou <[email protected]>
drm/stm: ltdc: fix late dereference check
Venkata Prasad Potturu <[email protected]>
ASoC: SOF: amd: Add pci revision id check
Simon Trimmer <[email protected]>
ASoC: cs35l56: Move DSP part string generation so that it is done only once
Sumit Gupta <[email protected]>
PCI: tegra194: Fix possible array out of bounds access
Peter Ujfalusi <[email protected]>
ASoC: Intel: sof_sdw: add quirk for LNL RVP
Bard Liao <[email protected]>
ASoC: Intel: sof_sdw: add quirk for MTL RVP
Aurabindo Pillai <[email protected]>
Revert "drm/amd/display: disable SubVP + DRR to prevent underflow"
Jack Xiao <[email protected]>
drm/amdgpu: fix memory leak in mes self test
hackyzh002 <[email protected]>
drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1
Longlong Yao <[email protected]>
drm/amdgpu: fix calltrace warning in amddrm_buddy_fini
Danilo Krummrich <[email protected]>
drm/scheduler: set entity to NULL in drm_sched_entity_pop_job()
Alvin Lee <[email protected]>
drm/amd/display: Update DTBCLK for DCN32
Li Yang <[email protected]>
net: phy: at803x: fix the wol setting functions
Christophe JAILLET <[email protected]>
net: phy: at803x: Use devm_regulator_get_enable_optional()
David Howells <[email protected]>
crypto, cifs: fix error handling in extract_iter_to_sg()
-------------
Diffstat:
Documentation/admin-guide/hw-vuln/srso.rst | 4 +- Documentation/admin-guide/kernel-parameters.txt | 1 + .../devicetree/bindings/input/goodix,gt7375p.yaml | 9 ++ .../bindings/pinctrl/qcom,sa8775p-tlmm.yaml | 2 +- Documentation/networking/nf_conntrack-sysctl.rst | 4 +- Makefile | 4 +- arch/arm/boot/dts/imx23.dtsi | 2 +- arch/arm/boot/dts/imx28.dtsi | 2 +- arch/arm/boot/dts/imx6dl-prtrvt.dts | 4 + arch/arm/boot/dts/imx6qdl-phytec-mira.dtsi | 2 +- arch/arm/boot/dts/imx6qdl-prti6q.dtsi | 11 +- arch/arm/boot/dts/imx6qdl.dtsi | 2 +- arch/arm/boot/dts/imx6sx.dtsi | 8 +- arch/arm/boot/dts/imx6ul.dtsi | 2 +- arch/arm/boot/dts/imx7s.dtsi | 8 +- arch/arm64/boot/dts/freescale/imx8mm.dtsi | 7 +- arch/arm64/boot/dts/freescale/imx93.dtsi | 2 +- arch/arm64/boot/dts/qcom/ipq5332.dtsi | 7 + arch/arm64/boot/dts/qcom/qrb5165-rb5.dts | 2 +- .../boot/dts/rockchip/rk3399-rock-4c-plus.dts | 3 +- arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi | 6 +- arch/arm64/include/asm/fpsimd.h | 4 +- arch/arm64/kernel/fpsimd.c | 6 +- arch/arm64/kernel/ptrace.c | 20 ++- arch/arm64/kernel/signal.c | 2 +- arch/parisc/kernel/entry.S | 47 ++++--- arch/powerpc/kernel/rtas_flash.c | 6 +- arch/powerpc/mm/kasan/Makefile | 1 + arch/riscv/Kconfig | 28 ++-- arch/riscv/include/asm/insn.h | 15 ++- arch/riscv/kernel/compat_vdso/Makefile | 8 +- arch/riscv/kernel/traps.c | 6 +- arch/riscv/lib/uaccess.S | 11 +- arch/um/os-Linux/user_syms.c | 7 - arch/x86/include/asm/entry-common.h | 1 + arch/x86/include/asm/nospec-branch.h | 49 +++---- arch/x86/kernel/alternative.c | 4 - arch/x86/kernel/cpu/amd.c | 1 + arch/x86/kernel/cpu/bugs.c | 29 ++++- arch/x86/kernel/kprobes/opt.c | 40 +++--- arch/x86/kernel/static_call.c | 13 ++ arch/x86/kernel/traps.c | 2 - arch/x86/kernel/vmlinux.lds.S | 22 ++-- arch/x86/kvm/svm/svm.c | 2 + arch/x86/kvm/svm/vmenter.S | 7 +- arch/x86/lib/retpoline.S | 141 ++++++++++++++------- block/blk-cgroup.c | 2 + block/blk-crypto-fallback.c | 36 ++++-- drivers/accel/habanalabs/common/device.c | 15 ++- drivers/accel/habanalabs/common/habanalabs.h | 2 + drivers/accel/habanalabs/common/habanalabs_drv.c | 4 +- drivers/accel/qaic/qaic_control.c | 26 ++-- drivers/accel/qaic/qaic_data.c | 1 + drivers/bluetooth/btusb.c | 3 + drivers/bus/ti-sysc.c | 2 + drivers/firewire/net.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 38 ++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_csa.h | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 41 +++++- drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 9 +- drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 1 - drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 + drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 - .../amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c | 27 ++++ .../gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 2 +- drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c | 8 ++ .../gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c | 5 + .../drm/amd/display/dc/dcn314/dcn314_resource.c | 20 +++ .../gpu/drm/amd/display/dc/dml/dcn20/dcn20_fpu.c | 24 +++- .../gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 4 - .../amd/display/dc/dml/dcn32/display_mode_vba_32.c | 4 +- .../amd/display/dc/dml/dcn32/display_mode_vba_32.h | 2 +- drivers/gpu/drm/amd/display/dc/inc/hw/dccg.h | 1 + drivers/gpu/drm/amd/include/amd_shared.h | 1 - drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 4 +- .../drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 14 +- drivers/gpu/drm/drm_edid.c | 29 ++--- drivers/gpu/drm/i915/display/intel_sdvo.c | 2 +- drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c | 22 ++-- drivers/gpu/drm/nouveau/nouveau_connector.c | 11 +- drivers/gpu/drm/panel/panel-simple.c | 24 ++-- drivers/gpu/drm/qxl/qxl_drv.h | 2 +- drivers/gpu/drm/qxl/qxl_dumb.c | 5 +- drivers/gpu/drm/qxl/qxl_gem.c | 25 ++-- drivers/gpu/drm/qxl/qxl_ioctl.c | 6 +- drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 37 +----- drivers/gpu/drm/rcar-du/rcar_du_drv.c | 48 ------- drivers/gpu/drm/rcar-du/rcar_du_drv.h | 2 - drivers/gpu/drm/rcar-du/rcar_du_regs.h | 3 +- drivers/gpu/drm/scheduler/sched_entity.c | 6 + drivers/gpu/drm/scheduler/sched_main.c | 4 + drivers/gpu/drm/stm/ltdc.c | 4 +- drivers/hid/hid-logitech-hidpp.c | 4 + drivers/hid/i2c-hid/i2c-hid-of-goodix.c | 16 ++- drivers/hid/intel-ish-hid/ipc/hw-ish.h | 1 + drivers/hid/intel-ish-hid/ipc/pci-ish.c | 1 + drivers/i2c/busses/i2c-bcm-iproc.c | 11 +- drivers/i2c/busses/i2c-designware-master.c | 16 ++- drivers/i2c/busses/i2c-hisi.c | 8 ++ drivers/i2c/busses/i2c-tegra.c | 2 +- drivers/infiniband/hw/bnxt_re/bnxt_re.h | 2 + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 16 ++- drivers/infiniband/hw/bnxt_re/qplib_sp.c | 8 +- drivers/infiniband/hw/bnxt_re/qplib_sp.h | 4 +- drivers/infiniband/hw/mana/qp.c | 5 +- drivers/infiniband/hw/mlx5/qpc.c | 10 +- drivers/iommu/amd/amd_iommu_types.h | 4 + drivers/iommu/amd/init.c | 36 ++++++ drivers/leds/rgb/leds-qcom-lpg.c | 8 +- .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 4 +- drivers/media/platform/mediatek/vpu/mtk_vpu.c | 6 +- drivers/media/platform/qcom/camss/camss-vfe.c | 6 +- drivers/media/usb/uvc/uvc_v4l2.c | 2 +- drivers/mmc/core/block.c | 7 +- drivers/mmc/host/sdhci_f_sdh30.c | 11 +- drivers/mmc/host/sunplus-mmc.c | 26 ++-- drivers/mmc/host/wbsd.c | 2 - drivers/net/dsa/mv88e6xxx/chip.c | 8 ++ drivers/net/ethernet/cadence/macb_main.c | 9 +- drivers/net/ethernet/intel/i40e/i40e_nvm.c | 16 +-- drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 10 ++ drivers/net/ethernet/intel/iavf/iavf_fdir.c | 77 ++++++++++- drivers/net/ethernet/intel/iavf/iavf_fdir.h | 2 + drivers/net/ethernet/intel/ice/ice_eswitch.c | 6 + drivers/net/ethernet/intel/ice/ice_main.c | 5 + .../ethernet/marvell/octeon_ep/octep_ctrl_net.c | 2 +- .../net/ethernet/marvell/octeon_ep/octep_main.c | 9 +- drivers/net/ethernet/mellanox/mlx5/core/en/xdp.h | 2 + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 8 +- drivers/net/ethernet/microsoft/mana/mana_en.c | 5 +- drivers/net/ethernet/qlogic/qede/qede_main.c | 10 ++ drivers/net/ethernet/sfc/ef100_nic.c | 2 +- drivers/net/ethernet/sfc/tc.c | 70 +++++++++- drivers/net/ethernet/sfc/tc.h | 9 ++ drivers/net/pcs/pcs-rzn1-miic.c | 10 +- drivers/net/phy/at803x.c | 89 +++++-------- drivers/net/phy/broadcom.c | 13 ++ drivers/net/phy/phy_device.c | 13 +- drivers/net/team/team.c | 4 +- drivers/net/veth.c | 3 +- drivers/net/virtio_net.c | 6 +- drivers/pci/controller/dwc/pcie-tegra194.c | 13 +- drivers/pcmcia/rsrc_nonstatic.c | 2 + drivers/pinctrl/qcom/pinctrl-msm.c | 9 +- drivers/pinctrl/qcom/pinctrl-msm.h | 2 + drivers/pinctrl/qcom/pinctrl-sa8775p.c | 1 + drivers/regulator/da9063-regulator.c | 12 +- drivers/regulator/qcom-rpmh-regulator.c | 2 +- drivers/soc/aspeed/aspeed-socinfo.c | 1 + drivers/soc/aspeed/aspeed-uart-routing.c | 2 +- drivers/thunderbolt/nhi.c | 2 + drivers/thunderbolt/nhi.h | 4 + drivers/thunderbolt/quirks.c | 8 ++ drivers/thunderbolt/retimer.c | 29 +++-- drivers/tty/n_gsm.c | 3 +- drivers/tty/serial/8250/8250_port.c | 1 + drivers/tty/serial/fsl_lpuart.c | 4 +- drivers/tty/serial/stm32-usart.c | 5 +- drivers/usb/chipidea/ci_hdrc_imx.c | 5 + drivers/usb/chipidea/usbmisc_imx.c | 37 +++++- drivers/usb/gadget/function/u_serial.c | 3 + drivers/usb/gadget/function/uvc_video.c | 32 +++-- drivers/usb/host/xhci-histb.c | 12 +- drivers/usb/host/xhci-mtk.c | 6 - drivers/usb/host/xhci-pci.c | 7 - drivers/usb/host/xhci-plat.c | 7 +- drivers/usb/host/xhci-tegra.c | 1 - drivers/usb/host/xhci.h | 2 +- drivers/vdpa/mlx5/core/mlx5_vdpa.h | 2 + drivers/vdpa/mlx5/core/mr.c | 105 ++++++++++----- drivers/vdpa/mlx5/net/mlx5_vnet.c | 4 +- drivers/vdpa/vdpa.c | 9 +- drivers/vdpa/vdpa_user/vduse_dev.c | 8 +- drivers/video/fbdev/mmp/hw/mmp_ctrl.c | 4 +- drivers/virtio/virtio_mmio.c | 5 +- drivers/virtio/virtio_vdpa.c | 2 + drivers/watchdog/sp5100_tco.c | 4 +- fs/btrfs/block-group.c | 12 ++ fs/btrfs/block-group.h | 5 + fs/btrfs/ctree.h | 1 + fs/btrfs/delayed-inode.c | 5 +- fs/btrfs/delayed-inode.h | 1 + fs/btrfs/extent_io.c | 25 +++- fs/btrfs/extent_map.c | 6 +- fs/btrfs/inode.c | 131 +++++++++++-------- fs/btrfs/scrub.c | 3 +- fs/btrfs/volumes.c | 3 +- fs/ceph/mds_client.c | 4 + fs/gfs2/super.c | 26 ++-- fs/netfs/iterator.c | 2 +- fs/ntfs3/frecord.c | 16 ++- fs/ntfs3/fsntfs.c | 2 +- fs/ntfs3/index.c | 6 + fs/ntfs3/ntfs_fs.h | 2 + fs/ntfs3/record.c | 10 +- fs/ntfs3/super.c | 98 ++++++++++---- fs/ntfs3/xattr.c | 1 + fs/smb/client/cifs_debug.c | 10 ++ fs/smb/client/cifsfs.c | 28 ++-- fs/smb/client/file.c | 25 ++-- fs/smb/client/fs_context.c | 4 + fs/smb/client/smb2pdu.c | 6 + include/drm/drm_edid.h | 12 +- include/linux/iopoll.h | 2 + include/linux/virtio_net.h | 4 + include/media/v4l2-mem2mem.h | 18 ++- include/net/mana/mana.h | 4 +- include/net/sock.h | 6 + include/net/xfrm.h | 1 + kernel/dma/remap.c | 4 +- kernel/trace/ring_buffer.c | 14 +- kernel/trace/trace.c | 3 +- net/bluetooth/l2cap_core.c | 5 + net/bluetooth/mgmt.c | 2 +- net/core/sock.c | 2 +- net/ipv4/ip_vti.c | 4 +- net/ipv4/tcp_timer.c | 4 +- net/ipv6/ip6_vti.c | 4 +- net/key/af_key.c | 4 +- net/netfilter/ipvs/ip_vs_ctl.c | 4 + net/netfilter/nf_conntrack_proto_sctp.c | 6 +- net/netfilter/nf_tables_api.c | 44 ++++++- net/netfilter/nft_dynset.c | 3 + net/netfilter/nft_set_pipapo.c | 36 +++--- net/openvswitch/datapath.c | 8 +- net/unix/af_unix.c | 9 +- net/xfrm/xfrm_compat.c | 2 +- net/xfrm/xfrm_input.c | 22 ++-- net/xfrm/xfrm_interface_core.c | 4 +- net/xfrm/xfrm_state.c | 8 +- net/xfrm/xfrm_user.c | 15 ++- rust/macros/vtable.rs | 1 + sound/hda/hdac_regmap.c | 7 +- sound/pci/hda/patch_realtek.c | 58 ++++++++- sound/soc/amd/Kconfig | 1 + sound/soc/amd/vangogh/acp5x.h | 2 + sound/soc/amd/vangogh/pci-acp5x.c | 7 +- sound/soc/codecs/cs35l56.c | 12 +- sound/soc/codecs/max98363.c | 9 +- sound/soc/codecs/rt5665.c | 2 + sound/soc/intel/boards/sof_sdw.c | 35 +++++ sound/soc/intel/boards/sof_sdw_rt711_sdca.c | 3 + sound/soc/meson/axg-tdm-formatter.c | 42 +++--- sound/soc/sof/amd/acp.h | 3 + sound/soc/sof/amd/pci-rmb.c | 3 + sound/soc/sof/amd/pci-rn.c | 3 + sound/soc/sof/core.c | 4 +- sound/soc/sof/intel/hda-dai-ops.c | 13 +- sound/soc/sof/intel/hda-dai.c | 8 +- sound/soc/sof/intel/hda.c | 12 +- sound/soc/sof/intel/hda.h | 2 + sound/usb/quirks-table.h | 29 +++++ tools/objtool/arch/x86/decode.c | 11 +- tools/objtool/check.c | 45 +++++-- tools/objtool/include/objtool/arch.h | 1 + tools/objtool/include/objtool/elf.h | 1 + tools/perf/util/machine.c | 5 - tools/perf/util/thread-stack.c | 4 +- .../selftests/net/forwarding/mirror_gre_changes.sh | 3 +- 264 files changed, 2116 insertions(+), 990 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/234 crypto, cifs: fix error handling in extract_iter_to_sg()
From: David Howells <[email protected]>
[ Upstream commit f443fd5af5dbd531f880d3645d5dd36976cf087f ]
Fix error handling in extract_iter_to_sg(). Pages need to be unpinned, not put in extract_user_to_sg() when handling IOVEC/UBUF sources.
The bug may result in a warning like the following:
WARNING: CPU: 1 PID: 20384 at mm/gup.c:229 __lse_atomic_add arch/arm64/include/asm/atomic_lse.h:27 [inline] WARNING: CPU: 1 PID: 20384 at mm/gup.c:229 arch_atomic_add arch/arm64/include/asm/atomic.h:28 [inline] WARNING: CPU: 1 PID: 20384 at mm/gup.c:229 raw_atomic_add include/linux/atomic/atomic-arch-fallback.h:537 [inline] WARNING: CPU: 1 PID: 20384 at mm/gup.c:229 atomic_add include/linux/atomic/atomic-instrumented.h:105 [inline] WARNING: CPU: 1 PID: 20384 at mm/gup.c:229 try_grab_page+0x108/0x160 mm/gup.c:252 ... pc : try_grab_page+0x108/0x160 mm/gup.c:229 lr : follow_page_pte+0x174/0x3e4 mm/gup.c:651 ... Call trace: __lse_atomic_add arch/arm64/include/asm/atomic_lse.h:27 [inline] arch_atomic_add arch/arm64/include/asm/atomic.h:28 [inline] raw_atomic_add include/linux/atomic/atomic-arch-fallback.h:537 [inline] atomic_add include/linux/atomic/atomic-instrumented.h:105 [inline] try_grab_page+0x108/0x160 mm/gup.c:252 follow_pmd_mask mm/gup.c:734 [inline] follow_pud_mask mm/gup.c:765 [inline] follow_p4d_mask mm/gup.c:782 [inline] follow_page_mask+0x12c/0x2e4 mm/gup.c:839 __get_user_pages+0x174/0x30c mm/gup.c:1217 __get_user_pages_locked mm/gup.c:1448 [inline] __gup_longterm_locked+0x94/0x8f4 mm/gup.c:2142 internal_get_user_pages_fast+0x970/0xb60 mm/gup.c:3140 pin_user_pages_fast+0x4c/0x60 mm/gup.c:3246 iov_iter_extract_user_pages lib/iov_iter.c:1768 [inline] iov_iter_extract_pages+0xc8/0x54c lib/iov_iter.c:1831 extract_user_to_sg lib/scatterlist.c:1123 [inline] extract_iter_to_sg lib/scatterlist.c:1349 [inline] extract_iter_to_sg+0x26c/0x6fc lib/scatterlist.c:1339 hash_sendmsg+0xc0/0x43c crypto/algif_hash.c:117 sock_sendmsg_nosec net/socket.c:725 [inline] sock_sendmsg+0x54/0x60 net/socket.c:748 ____sys_sendmsg+0x270/0x2ac net/socket.c:2494 ___sys_sendmsg+0x80/0xdc net/socket.c:2548 __sys_sendmsg+0x68/0xc4 net/socket.c:2577 __do_sys_sendmsg net/socket.c:2586 [inline] __se_sys_sendmsg net/socket.c:2584 [inline] __arm64_sys_sendmsg+0x24/0x30 net/socket.c:2584 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x48/0x114 arch/arm64/kernel/syscall.c:52 el0_svc_common.constprop.0+0x44/0xe4 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x38/0xa4 arch/arm64/kernel/syscall.c:191 el0_svc+0x2c/0xb0 arch/arm64/kernel/entry-common.c:647 el0t_64_sync_handler+0xc0/0xc4 arch/arm64/kernel/entry-common.c:665 el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:591
--- fs/netfs/iterator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/netfs/iterator.c +1 -1
@@ -151,7 +151,7 @@ static ssize_t netfs_extract_user_to_sg( failed:while (sgtable->nents > sgtable->orig_nents) -put_page (sg_page (&sgtable->sgl[--sgtable->nents])); +unpin_user_page (sg_page (&sgtable->sgl[--sgtable->nents]));return res; }
Greg Kroah-Hartman
maintainerPATCH 2/234 net: phy: at803x: Use devm_regulator_get_enable_optional()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 988e8d90b3dc482637532e61bc2d58bfc4af5167 ]
Use devm_regulator_get_enable_optional() instead of hand writing it. It saves some line of code.
Stable-dep-of: e58f30246c35 ("net: phy: at803x: fix the wol setting functions")
--- drivers/net/phy/at803x.c | 44 +++++++--------------------------------- 1 file changed, 7 insertions(+), 37 deletions(-)
drivers/net/phy/at803x.c +7 -37
@@ -304,7 +304,6 @@ struct at803x_priv {bool is_1000basex;struct regulator_dev *vddio_rdev;struct regulator_dev *vddh_rdev; -struct regulator *vddio;u64 stats[ARRAY_SIZE (at803x_hw_stats)]; };
@@ -824,11 +823,11 @@ static int at803x_parse_dt(struct phy_device *phydev)if (ret <0 )return ret; - priv->vddio =devm_regulator_get_optional (&phydev->mdio.dev, -"vddio" ); -if (IS_ERR (priv->vddio)) { + ret =devm_regulator_get_enable_optional (&phydev->mdio.dev, +"vddio" ); +if (ret) {phydev_err (phydev,"failed to get VDDIO regulator\n" ); -return PTR_ERR (priv->vddio); +return ret; }/* Only AR8031/8033 support 1000Base-X for SFP modules */
@@ -856,12 +855,6 @@ static int at803x_probe(struct phy_device *phydev)if (ret)return ret; -if (priv->vddio) { - ret =regulator_enable (priv->vddio); -if (ret <0 ) -return ret; - } -if (phydev->drv->phy_id ==ATH8031_PHY_ID ) {int ccr =phy_read (phydev,AT803X_REG_CHIP_CONFIG );int mode_cfg;
@@ -869,10 +862,8 @@ static int at803x_probe(struct phy_device *phydev) .wolopts = 0, }; -if (ccr <0 ) { - ret = ccr; - goto err; - } +if (ccr <0 ) +return ccr; mode_cfg = ccr &AT803X_MODE_CFG_MASK ;switch (mode_cfg) {
@@ -890,25 +881,11 @@ static int at803x_probe(struct phy_device *phydev) ret =at803x_set_wol (phydev, &wol);if (ret <0 ) {phydev_err (phydev,"failed to disable WOL on probe: %d\n" , ret); - goto err; +return ret; } }return 0 ; - -err: -if (priv->vddio) -regulator_disable (priv->vddio); - -return ret; -} - -static void at803x_remove (struct phy_device *phydev) -{ -struct at803x_priv *priv = phydev->priv; - -if (priv->vddio) -regulator_disable (priv->vddio); }static int at803x_get_features (struct phy_device *phydev)
@@ -2021,7 +1998,6 @@ static struct phy_driver at803x_driver[] = { .name = "Qualcomm Atheros AR8035", .flags = PHY_POLL_CABLE_TEST, .probe = at803x_probe, - .remove = at803x_remove, .config_aneg = at803x_config_aneg, .config_init = at803x_config_init, .soft_reset = genphy_soft_reset,
@@ -2043,7 +2019,6 @@ static struct phy_driver at803x_driver[] = { .name = "Qualcomm Atheros AR8030", .phy_id_mask = AT8030_PHY_ID_MASK, .probe = at803x_probe, - .remove = at803x_remove, .config_init = at803x_config_init, .link_change_notify = at803x_link_change_notify, .set_wol = at803x_set_wol,
@@ -2059,7 +2034,6 @@ static struct phy_driver at803x_driver[] = { .name = "Qualcomm Atheros AR8031/AR8033", .flags = PHY_POLL_CABLE_TEST, .probe = at803x_probe, - .remove = at803x_remove, .config_init = at803x_config_init, .config_aneg = at803x_config_aneg, .soft_reset = genphy_soft_reset,
@@ -2082,7 +2056,6 @@ static struct phy_driver at803x_driver[] = {PHY_ID_MATCH_EXACT (ATH8032_PHY_ID ), .name = "Qualcomm Atheros AR8032", .probe = at803x_probe, - .remove = at803x_remove, .flags = PHY_POLL_CABLE_TEST, .config_init = at803x_config_init, .link_change_notify = at803x_link_change_notify,
@@ -2098,7 +2071,6 @@ static struct phy_driver at803x_driver[] = {PHY_ID_MATCH_EXACT (ATH9331_PHY_ID ), .name = "Qualcomm Atheros AR9331 built-in PHY", .probe = at803x_probe, - .remove = at803x_remove, .suspend = at803x_suspend, .resume = at803x_resume, .flags = PHY_POLL_CABLE_TEST,
@@ -2115,7 +2087,6 @@ static struct phy_driver at803x_driver[] = {PHY_ID_MATCH_EXACT (QCA9561_PHY_ID ), .name = "Qualcomm Atheros QCA9561 built-in PHY", .probe = at803x_probe, - .remove = at803x_remove, .suspend = at803x_suspend, .resume = at803x_resume, .flags = PHY_POLL_CABLE_TEST,
@@ -2181,7 +2152,6 @@ static struct phy_driver at803x_driver[] = { .name = "Qualcomm QCA8081", .flags = PHY_POLL_CABLE_TEST, .probe = at803x_probe, - .remove = at803x_remove, .config_intr = at803x_config_intr, .handle_interrupt = at803x_handle_interrupt, .get_tunable = at803x_get_tunable,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 3/234 net: phy: at803x: fix the wol setting functions
In reply to Greg Kroah-HartmanFrom: Li Yang <[email protected]>
[ Upstream commit e58f30246c35c126c7571065b33bee4b3b1d2ef8 ]
In commit 7beecaf7d507 ("net: phy: at803x: improve the WOL feature"), it seems not correct to use a wol_en bit in a 1588 Control Register which is only available on AR8031/AR8033(share the same phy_id) to determine if WoL is enabled. Change it back to use AT803X_INTR_ENABLE_WOL for determining the WoL status which is applicable on all chips supporting wol. Also update the at803x_set_wol() function to only update the 1588 register on chips having it. After this change, disabling wol at probe from commit d7cd5e06c9dd ("net: phy: at803x: disable WOL at probe") is no longer needed. Change it to just disable the WoL bit in 1588 register for AR8031/AR8033 to be aligned with AT803X_INTR_ENABLE_WOL in probe.
--- drivers/net/phy/at803x.c | 45 ++++++++++++++++++++++------------------ 1 file changed, 25 insertions(+), 20 deletions(-)
drivers/net/phy/at803x.c +25 -20
@@ -459,21 +459,27 @@ static int at803x_set_wol(struct phy_device *phydev,phy_write_mmd (phydev,MDIO_MMD_PCS , offsets[i], mac[(i *2 ) +1 ] | (mac[(i *2 )] <<8 )); -/* Enable WOL function */ - ret =phy_modify_mmd (phydev,MDIO_MMD_PCS ,AT803X_PHY_MMD3_WOL_CTRL , -0 ,AT803X_WOL_EN ); -if (ret) -return ret; +/* Enable WOL function for 1588 */ +if (phydev->drv->phy_id ==ATH8031_PHY_ID ) { + ret =phy_modify_mmd (phydev,MDIO_MMD_PCS , +AT803X_PHY_MMD3_WOL_CTRL , +0 ,AT803X_WOL_EN ); +if (ret) +return ret; + }/* Enable WOL interrupt */ ret =phy_modify (phydev,AT803X_INTR_ENABLE ,0 ,AT803X_INTR_ENABLE_WOL );if (ret)return ret; }else { -/* Disable WoL function */ - ret =phy_modify_mmd (phydev,MDIO_MMD_PCS ,AT803X_PHY_MMD3_WOL_CTRL , -AT803X_WOL_EN ,0 ); -if (ret) -return ret; +/* Disable WoL function for 1588 */ +if (phydev->drv->phy_id ==ATH8031_PHY_ID ) { + ret =phy_modify_mmd (phydev,MDIO_MMD_PCS , +AT803X_PHY_MMD3_WOL_CTRL , +AT803X_WOL_EN ,0 ); +if (ret) +return ret; + }/* Disable WOL interrupt */ ret =phy_modify (phydev,AT803X_INTR_ENABLE ,AT803X_INTR_ENABLE_WOL ,0 );if (ret)
@@ -508,11 +514,11 @@ static void at803x_get_wol(struct phy_device *phydev, wol->supported =WAKE_MAGIC ; wol->wolopts =0 ; - value =phy_read_mmd (phydev,MDIO_MMD_PCS ,AT803X_PHY_MMD3_WOL_CTRL ); + value =phy_read (phydev,AT803X_INTR_ENABLE );if (value <0 )return ; -if (value &AT803X_WOL_EN ) +if (value &AT803X_INTR_ENABLE_WOL ) wol->wolopts |=WAKE_MAGIC ; }
@@ -858,9 +864,6 @@ static int at803x_probe(struct phy_device *phydev)if (phydev->drv->phy_id ==ATH8031_PHY_ID ) {int ccr =phy_read (phydev,AT803X_REG_CHIP_CONFIG );int mode_cfg; -struct ethtool_wolinfo wol = { - .wolopts =0 , - };if (ccr <0 )return ccr;
@@ -877,12 +880,14 @@ static int at803x_probe(struct phy_device *phydev)break ; } -/* Disable WOL by default */ - ret =at803x_set_wol (phydev, &wol); -if (ret <0 ) { -phydev_err (phydev,"failed to disable WOL on probe: %d\n" , ret); +/* Disable WoL in 1588 register which is enabled +* by default +*/ + ret =phy_modify_mmd (phydev,MDIO_MMD_PCS , +AT803X_PHY_MMD3_WOL_CTRL , +AT803X_WOL_EN ,0 ); +if (ret)return ret; - } }return 0 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 4/234 drm/amd/display: Update DTBCLK for DCN32
In reply to Greg Kroah-HartmanFrom: Alvin Lee <[email protected]>
[ Upstream commit 128c1ca0303fe764a4cde5f761e72810d9e40b6e ]
[Why&How]
- Implement interface to program DTBCLK DTO’s according to reference DTBCLK returned by PMFW
- This is required because DTO programming requires exact DTBCLK reference freq or it could result in underflow
--- .../display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+)
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c +27 -0
@@ -233,6 +233,32 @@ void dcn32_init_clocks(struct clk_mgr *clk_mgr_base)DC_FP_END (); } +static void dcn32_update_clocks_update_dtb_dto (struct clk_mgr_internal *clk_mgr, +struct dc_state *context, +int ref_dtbclk_khz) +{ +struct dccg *dccg = clk_mgr->dccg; +uint32_t tg_mask =0 ; +int i; + +for (i =0 ; i < clk_mgr->base.ctx->dc->res_pool->pipe_count; i++) { +struct pipe_ctx *pipe_ctx = &context->res_ctx.pipe_ctx[i]; +struct dtbclk_dto_params dto_params = {0 }; + +/* use mask to program DTO once per tg */ +if (pipe_ctx->stream_res.tg && + !(tg_mask & (1 << pipe_ctx->stream_res.tg->inst))) { + tg_mask |= (1 << pipe_ctx->stream_res.tg->inst); + + dto_params.otg_inst = pipe_ctx->stream_res.tg->inst; + dto_params.ref_dtbclk_khz = ref_dtbclk_khz; + + dccg->funcs->set_dtbclk_dto (clk_mgr->dccg, &dto_params); +//dccg->funcs->set_audio_dtbclk_dto(clk_mgr->dccg, &dto_params); + } + } +} +/* Since DPPCLK request to PMFW needs to be exact (due to DPP DTO programming), * update DPPCLK to be the exact frequency that will be set after the DPPCLK * divider is updated. This will prevent rounding issues that could cause DPP
@@ -570,6 +596,7 @@ static void dcn32_update_clocks(struct clk_mgr *clk_mgr_base,/* DCCG requires KHz precision for DTBCLK */ clk_mgr_base->clks.ref_dtbclk_khz =dcn32_smu_set_hard_min_by_freq (clk_mgr,PPCLK_DTBCLK ,khz_to_mhz_ceil (new_clocks->ref_dtbclk_khz)); +dcn32_update_clocks_update_dtb_dto (clk_mgr, context, clk_mgr_base->clks.ref_dtbclk_khz); }if (dc->config.forced_clocks == false || (force_reset && safe_to_lower)) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 5/234 drm/scheduler: set entity to NULL in drm_sched_entity_pop_job()
In reply to Greg Kroah-HartmanFrom: Danilo Krummrich <[email protected]>
[ Upstream commit 96c7c2f4d5bd94b15fe63448c087f01607b56f4a ]
It already happend a few times that patches slipped through which implemented access to an entity through a job that was already removed from the entities queue. Since jobs and entities might have different lifecycles, this can potentially cause UAF bugs.
In order to make it obvious that a jobs entity pointer shouldn't be accessed after drm_sched_entity_pop_job() was called successfully, set the jobs entity pointer to NULL once the job is removed from the entity queue.
Moreover, debugging a potential NULL pointer dereference is way easier than potentially corrupted memory through a UAF.
--- drivers/gpu/drm/scheduler/sched_entity.c | 6 ++++++ drivers/gpu/drm/scheduler/sched_main.c | 4 ++++ 2 files changed, 10 insertions(+)
drivers/gpu/drm/scheduler/sched_entity.c +6 -0
@@ -448,6 +448,12 @@ struct drm_sched_job *drm_sched_entity_pop_job(struct drm_sched_entity *entity)drm_sched_rq_update_fifo (entity, next->submit_ts); } +/* Jobs and entities might have different lifecycles. Since we're +* removing the job from the entities queue, set the jobs entity pointer +* to NULL to prevent any future access of the entity through this job. +*/ + sched_job->entity =NULL ; +return sched_job; }
drivers/gpu/drm/scheduler/sched_main.c +4 -0
@@ -42,6 +42,10 @@* the hardware. * * The jobs in a entity are always scheduled in the order that they were pushed. +* +* Note that once a job was taken from the entities queue and pushed to the +* hardware, i.e. the pending queue, the entity must not be referenced anymore +* through the jobs entity pointer. */ #include <linux/kthread.h>
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 6/234 drm/amdgpu: fix calltrace warning in amddrm_buddy_fini
In reply to Greg Kroah-HartmanFrom: Longlong Yao <[email protected]>
[ Upstream commit 01382501509871d0799bab6bd412c228486af5bf ]
The following call trace is observed when removing the amdgpu driver, which is caused by that BOs allocated for psp are not freed until removing.
[61811.450562] RIP: 0010:amddrm_buddy_fini.cold+0x29/0x47 [amddrm_buddy] [61811.450577] Call Trace: [61811.450577] <TASK> [61811.450579] amdgpu_vram_mgr_fini+0x135/0x1c0 [amdgpu] [61811.450728] amdgpu_ttm_fini+0x207/0x290 [amdgpu] [61811.450870] amdgpu_bo_fini+0x27/0xa0 [amdgpu] [61811.451012] gmc_v9_0_sw_fini+0x4a/0x60 [amdgpu] [61811.451166] amdgpu_device_fini_sw+0x117/0x520 [amdgpu] [61811.451306] amdgpu_driver_release_kms+0x16/0x30 [amdgpu] [61811.451447] devm_drm_dev_init_release+0x4d/0x80 [drm] [61811.451466] devm_action_release+0x15/0x20 [61811.451469] release_nodes+0x40/0xb0 [61811.451471] devres_release_all+0x9b/0xd0 [61811.451473] __device_release_driver+0x1bb/0x2a0 [61811.451476] driver_detach+0xf3/0x140 [61811.451479] bus_remove_driver+0x6c/0xf0 [61811.451481] driver_unregister+0x31/0x60 [61811.451483] pci_unregister_driver+0x40/0x90 [61811.451486] amdgpu_exit+0x15/0x447 [amdgpu]
For smu v13_0_2, if the GPU supports xgmi, refer to
commit f5c7e7797060 ("drm/amdgpu: Adjust removal control flow for smu v13_0_2"),
it will run gpu recover in AMDGPU_RESET_FOR_DEVICE_REMOVE mode when removing, which makes all devices in hive list have hw reset but no resume except the basic ip blocks, then other ip blocks will not call .hw_fini according to ip_block.status.hw.
Since psp_free_shared_bufs just includes some software operations, so move it to psp_sw_fini.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +2 -2
@@ -520,6 +520,8 @@ static int psp_sw_fini(void *handle)kfree (cmd); cmd =NULL ; +psp_free_shared_bufs (psp); +if (psp->km_ring.ring_mem) amdgpu_bo_free_kernel(&adev->firmware.rbuf, &psp->km_ring.ring_mem_mc_addr,
@@ -2657,8 +2659,6 @@ static int psp_hw_fini(void *handle)psp_ring_destroy (psp,PSP_RING_TYPE__KM ); -psp_free_shared_bufs (psp); -return 0 ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 7/234 drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1
In reply to Greg Kroah-HartmanFrom: hackyzh002 <[email protected]>
[ Upstream commit 87c2213e85bd81e4a9a4d0880c256568794ae388 ]
The type of size is unsigned int, if size is 0x40000000, there will be an integer overflow, size will be zero after size *= sizeof(uint32_t), will cause uninitialized memory to be referenced later.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +1 -1
@@ -189,7 +189,7 @@ static int amdgpu_cs_pass1(struct amdgpu_cs_parser *p,uint64_t *chunk_array_user;uint64_t *chunk_array;uint32_t uf_offset =0 ; -unsigned int size; +size_t size;int ret;int i;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 8/234 drm/amdgpu: fix memory leak in mes self test
In reply to Greg Kroah-HartmanFrom: Jack Xiao <[email protected]>
[ Upstream commit 31d7c3a4fc3d312a0646990767647925d5bde540 ]
The fences associated with mes queue have to be freed up during amdgpu_ring_fini.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_ring.c +2 -0
@@ -361,6 +361,8 @@ void amdgpu_ring_fini(struct amdgpu_ring *ring)amdgpu_bo_free_kernel (&ring->ring_obj, &ring->gpu_addr, (void **)&ring->ring); + }else { +kfree (ring->fence_drv.fences); }dma_fence_put (ring->vmid_wait);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 9/234 Revert "drm/amd/display: disable SubVP + DRR to prevent underflow"
In reply to Greg Kroah-HartmanFrom: Aurabindo Pillai <[email protected]>
[ Upstream commit f38129bb081758176dd78304faaee95007fb8838 ]
This reverts commit 80c6d6804f31451848a3956a70c2bcb1f07cfcb0. The orignal commit was intended as a workaround to prevent underflow and flickering when using one normal monitor and the other high refresh rate monitor (> 120Hz).
This patch is being reverted in favour of a software solution to enable SubVP+DRR
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 5 ----- drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c | 4 ---- drivers/gpu/drm/amd/include/amd_shared.h | 1 - 3 files changed, 10 deletions(-)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +0 -5
@@ -1653,11 +1653,6 @@ static int amdgpu_dm_init(struct amdgpu_device *adev)if (amdgpu_dc_feature_mask &DC_DISABLE_LTTPR_DP2_0 ) init_data.flags.allow_lttpr_non_transparent_mode.bits.DP2_0 = true; -/* Disable SubVP + DRR config by default */ - init_data.flags.disable_subvp_drr = true; -if (amdgpu_dc_feature_mask &DC_ENABLE_SUBVP_DRR ) - init_data.flags.disable_subvp_drr = false; - init_data.flags.seamless_boot_edp_requested = false;if (check_seamless_boot_capability (adev)) {
drivers/gpu/drm/amd/display/dc/dml/dcn32/dcn32_fpu.c +0 -4
@@ -880,10 +880,6 @@ static bool subvp_drr_schedulable(struct dc *dc, struct dc_state *context, strucint16_t stretched_drr_us =0 ;int16_t drr_stretched_vblank_us =0 ;int16_t max_vblank_mallregion =0 ; -const struct dc_config *config = &dc->config; - -if (config->disable_subvp_drr) -return false;// Find SubVP pipe for (i =0 ; i < dc->res_pool->pipe_count; i++) {
drivers/gpu/drm/amd/include/amd_shared.h +0 -1
@@ -240,7 +240,6 @@ enum DC_FEATURE_MASK {DC_DISABLE_LTTPR_DP2_0 = (1 <<6 ),//0x40, disabled by default DC_PSR_ALLOW_SMU_OPT = (1 <<7 ),//0x80, disabled by default DC_PSR_ALLOW_MULTI_DISP_OPT = (1 << 8), //0x100, disabled by default - DC_ENABLE_SUBVP_DRR = (1 << 9), // 0x200, disabled by default }; enum DC_DEBUG_MASK {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 10/234 ASoC: Intel: sof_sdw: add quirk for MTL RVP
In reply to Greg Kroah-HartmanFrom: Bard Liao <[email protected]>
[ Upstream commit 289e1df00e49a229a1c924c059242e759a552f01 ]
We should use RT711_JD2_100K for on board rt711.
--- sound/soc/intel/boards/sof_sdw.c | 8 ++++++++ 1 file changed, 8 insertions(+)
sound/soc/intel/boards/sof_sdw.c +8 -0
@@ -415,6 +415,14 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { }, .driver_data = (void *)(RT711_JD1), }, + { + .callback = sof_sdw_quirk_cb, + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"), + DMI_MATCH(DMI_PRODUCT_NAME, "Meteor Lake Client Platform"), + }, + .driver_data = (void *)(RT711_JD2_100K), + }, {} };
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 11/234 ASoC: Intel: sof_sdw: add quirk for LNL RVP
In reply to Greg Kroah-HartmanFrom: Peter Ujfalusi <[email protected]>
[ Upstream commit dfe25fea968dc4884e12d471c8263f0f611b380a ]
We should use RT711_JD2_100K for on board rt711
--- sound/soc/intel/boards/sof_sdw.c | 9 +++++++++ 1 file changed, 9 insertions(+)
sound/soc/intel/boards/sof_sdw.c +9 -0
@@ -423,6 +423,15 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { }, .driver_data = (void *)(RT711_JD2_100K), }, +/* LunarLake devices */ + { + .callback = sof_sdw_quirk_cb, + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"), + DMI_MATCH(DMI_PRODUCT_NAME, "Lunar Lake Client Platform"), + }, + .driver_data = (void *)(RT711_JD2_100K), + }, {} };
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 12/234 PCI: tegra194: Fix possible array out of bounds access
In reply to Greg Kroah-HartmanFrom: Sumit Gupta <[email protected]>
[ Upstream commit 205b3d02d57ce6dce96f6d2b9c230f56a9bf9817 ]
Add check to fix the possible array out of bounds violation by making speed equal to GEN1_CORE_CLK_FREQ when its value is more than the size of "pcie_gen_freq" array. This array has size of four but possible speed (CLS) values are from "0 to 0xF". So, "speed - 1" values are "-1 to 0xE".
--- drivers/pci/controller/dwc/pcie-tegra194.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/pci/controller/dwc/pcie-tegra194.c +11 -2
@@ -223,6 +223,7 @@#define EP_STATE_ENABLED 1static const unsigned int pcie_gen_freq[] = { +GEN1_CORE_CLK_FREQ ,/* PCI_EXP_LNKSTA_CLS == 0; undefined */ GEN1_CORE_CLK_FREQ ,GEN2_CORE_CLK_FREQ ,GEN3_CORE_CLK_FREQ ,
@@ -459,7 +460,11 @@ static irqreturn_t tegra_pcie_ep_irq_thread(int irq, void *arg) speed =dw_pcie_readw_dbi (pci, pcie->pcie_cap_base +PCI_EXP_LNKSTA ) &PCI_EXP_LNKSTA_CLS ; -clk_set_rate (pcie->core_clk, pcie_gen_freq[speed -1 ]); + +if (speed >=ARRAY_SIZE (pcie_gen_freq)) + speed =0 ; + +clk_set_rate (pcie->core_clk, pcie_gen_freq[speed]);if (pcie->of_data->has_ltr_req_fix)return IRQ_HANDLED ;
@@ -1020,7 +1025,11 @@ static int tegra_pcie_dw_start_link(struct dw_pcie *pci) speed =dw_pcie_readw_dbi (pci, pcie->pcie_cap_base +PCI_EXP_LNKSTA ) &PCI_EXP_LNKSTA_CLS ; -clk_set_rate (pcie->core_clk, pcie_gen_freq[speed -1 ]); + +if (speed >=ARRAY_SIZE (pcie_gen_freq)) + speed =0 ; + +clk_set_rate (pcie->core_clk, pcie_gen_freq[speed]);tegra_pcie_enable_interrupts (pp);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 13/234 ASoC: cs35l56: Move DSP part string generation so that it is done only once
In reply to Greg Kroah-HartmanFrom: Simon Trimmer <[email protected]>
[ Upstream commit 608f1b0dbddec6b2fd766c10bcce2b651995e936 ]
Each time we go through dsp_work() it does a devm_kasprintf() to allocate memory to hold the part name string. It's not strictly a memory leak because devm will free it all if the driver is removed. But we keep allocating more and more memory to hold the same string.
Move the allocation so that it is performed after the version and secured state information is gathered and handle allocation errors.
--- sound/soc/codecs/cs35l56.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
sound/soc/codecs/cs35l56.c +6 -6
@@ -834,12 +834,6 @@ static void cs35l56_dsp_work(struct work_struct *work)if (!cs35l56->init_done)return ; - cs35l56->dsp.part =devm_kasprintf (cs35l56->dev,GFP_KERNEL ,"cs35l56%s-%02x" , - cs35l56->secured ?"s" :"" , cs35l56->rev); - -if (!cs35l56->dsp.part) -return ; -pm_runtime_get_sync (cs35l56->dev);/*
@@ -1505,6 +1499,12 @@ int cs35l56_init(struct cs35l56_private *cs35l56)dev_info (cs35l56->dev,"Cirrus Logic CS35L56%s Rev %02X OTP%d\n" , cs35l56->secured ?"s" :"" , cs35l56->rev, otpid); +/* Populate the DSP information with the revision and security state */ + cs35l56->dsp.part =devm_kasprintf (cs35l56->dev,GFP_KERNEL ,"cs35l56%s-%02x" , + cs35l56->secured ?"s" :"" , cs35l56->rev); +if (!cs35l56->dsp.part) +return -ENOMEM ; +/* Wake source and *_BLOCKED interrupts default to unmasked, so mask them */ regmap_write (cs35l56->regmap,CS35L56_IRQ1_MASK_20 ,0xffffffff ); regmap_update_bits(cs35l56->regmap, CS35L56_IRQ1_MASK_1,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 14/234 ASoC: SOF: amd: Add pci revision id check
In reply to Greg Kroah-HartmanFrom: Venkata Prasad Potturu <[email protected]>
[ Upstream commit 1d4a84632b90d88316986b05bcdfe715399a33db ]
Add pci revision id check for renoir and rembrandt platforms.
--- sound/soc/sof/amd/acp.h | 3 +++ sound/soc/sof/amd/pci-rmb.c | 3 +++ sound/soc/sof/amd/pci-rn.c | 3 +++ 3 files changed, 9 insertions(+)
sound/soc/sof/amd/acp.h +3 -0
@@ -55,6 +55,9 @@#define ACP_DSP_TO_HOST_IRQ 0x04 +#define ACP_RN_PCI_ID 0x01 +#define ACP_RMB_PCI_ID 0x6F +#define HOST_BRIDGE_CZN 0x1630#define HOST_BRIDGE_RMB 0x14B5#define ACP_SHA_STAT 0x8000
sound/soc/sof/amd/pci-rmb.c +3 -0
@@ -65,6 +65,9 @@ static int acp_pci_rmb_probe(struct pci_dev *pci, const struct pci_device_id *pc {unsigned int flag; +if (pci->revision !=ACP_RMB_PCI_ID ) +return -ENODEV ; + flag =snd_amd_acp_find_config (pci);if (flag !=FLAG_AMD_SOF && flag !=FLAG_AMD_SOF_ONLY_DMIC )return -ENODEV ;
sound/soc/sof/amd/pci-rn.c +3 -0
@@ -65,6 +65,9 @@ static int acp_pci_rn_probe(struct pci_dev *pci, const struct pci_device_id *pci {unsigned int flag; +if (pci->revision !=ACP_RN_PCI_ID ) +return -ENODEV ; + flag =snd_amd_acp_find_config (pci);if (flag !=FLAG_AMD_SOF && flag !=FLAG_AMD_SOF_ONLY_DMIC )return -ENODEV ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 15/234 drm/stm: ltdc: fix late dereference check
In reply to Greg Kroah-HartmanFrom: Raphael Gallais-Pou <[email protected]>
[ Upstream commit 898a9e3f56db9860ab091d4bf41b6caa99aafc3d ]
In ltdc_crtc_set_crc_source(), struct drm_crtc was dereferenced in a container_of() before the pointer check. This could cause a kernel panic.
Fix this smatch warning:drivers/gpu/drm/stm/ltdc.c:1124 ltdc_crtc_set_crc_source() warn: variable dereferenced before check 'crtc' (see line 1119)
--- drivers/gpu/drm/stm/ltdc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/stm/ltdc.c +3 -1
@@ -1145,7 +1145,7 @@ static void ltdc_crtc_disable_vblank(struct drm_crtc *crtc)static int ltdc_crtc_set_crc_source (struct drm_crtc *crtc,const char *source) { -struct ltdc_device *ldev =crtc_to_ltdc (crtc); +struct ltdc_device *ldev;int ret;DRM_DEBUG_DRIVER ("\n" );
@@ -1153,6 +1153,8 @@ static int ltdc_crtc_set_crc_source(struct drm_crtc *crtc, const char *source)if (!crtc)return -ENODEV ; + ldev =crtc_to_ltdc (crtc); +if (source &&strcmp (source,"auto" ) ==0 ) { ldev->crc_active = true; ret =regmap_set_bits (ldev->regmap,LTDC_GCR ,GCR_CRCEN );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 16/234 arm64: dts: qcom: ipq5332: add QFPROM node
In reply to Greg Kroah-HartmanFrom: Kathiravan T <[email protected]>
[ Upstream commit 2f34a2aa4c88f4882e3c5df8c9b78f8bbd3f564f ]
IPQ5332 has efuse region to determine the various HW quirks. Lets add the initial support and the individual fuses will be added as they are required.
--- arch/arm64/boot/dts/qcom/ipq5332.dtsi | 7 +++++++ 1 file changed, 7 insertions(+)
arch/arm64/boot/dts/qcom/ipq5332.dtsi +7 -0
@@ -135,6 +135,13 @@ soc@0 { #size-cells = <1>; ranges = <0 0 0 0xffffffff>; + qfprom: efuse@a4000 { + compatible = "qcom,ipq5332-qfprom", "qcom,qfprom"; + reg = <0x000a4000 0x721>; + #address-cells = <1>; + #size-cells = <1>; + }; + rng: rng@e3000 { compatible = "qcom,prng-ee"; reg = <0x000e3000 0x1000>;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 17/234 drm: rcar-du: remove R-Car H3 ES1.* workarounds
In reply to Greg Kroah-HartmanFrom: Wolfram Sang <[email protected]>
[ Upstream commit 2da4b728f994a1f9189a8066b0be90b615768764 ]
R-Car H3 ES1.* was only available to an internal development group and needed a lot of quirks and workarounds. These become a maintenance burden now, so our development group decided to remove upstream support for this SoC and prevent booting it. Public users only have ES2 onwards.
--- drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 37 ++------------------ drivers/gpu/drm/rcar-du/rcar_du_drv.c | 48 -------------------------- drivers/gpu/drm/rcar-du/rcar_du_drv.h | 2 -- drivers/gpu/drm/rcar-du/rcar_du_regs.h | 3 +- 4 files changed, 4 insertions(+), 86 deletions(-)
drivers/gpu/drm/rcar-du/rcar_du_crtc.c +3 -34
@@ -223,20 +223,6 @@ static void rcar_du_crtc_set_display_timing(struct rcar_du_crtc *rcrtc)* DU channels that have a display PLL can't use the internal * system clock, and have no internal clock divider. */ - -/* -* The H3 ES1.x exhibits dot clock duty cycle stability issues. -* We can work around them by configuring the DPLL to twice the -* desired frequency, coupled with a /2 post-divider. Restrict -* the workaround to H3 ES1.x as ES2.0 and all other SoCs have -* no post-divider when a display PLL is present (as shown by -* the workaround breaking HDMI output on M3-W during testing). -*/ -if (rcdu->info->quirks &RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY ) { - target *=2 ; - div =1 ; - } - extclk =clk_get_rate (rcrtc->extclock);rcar_du_dpll_divider (rcrtc, &dpll, extclk, target);
@@ -245,30 +231,13 @@ static void rcar_du_crtc_set_display_timing(struct rcar_du_crtc *rcrtc) | DPLLCR_N(dpll.n) | DPLLCR_M(dpll.m) |DPLLCR_STBY ; -if (rcrtc->index ==1 ) { +if (rcrtc->index ==1 ) dpllcr |=DPLLCR_PLCS1 |DPLLCR_INCS_DOTCLKIN1 ; - }else { - dpllcr |=DPLLCR_PLCS0_PLL +else + dpllcr |=DPLLCR_PLCS0 |DPLLCR_INCS_DOTCLKIN0 ; -/* -* On ES2.x we have a single mux controlled via bit 21, -* which selects between DCLKIN source (bit 21 = 0) and -* a PLL source (bit 21 = 1), where the PLL is always -* PLL1. -* -* On ES1.x we have an additional mux, controlled -* via bit 20, for choosing between PLL0 (bit 20 = 0) -* and PLL1 (bit 20 = 1). We always want to use PLL1, -* so on ES1.x, in addition to setting bit 21, we need -* to set the bit 20. -*/ - -if (rcdu->info->quirks &RCAR_DU_QUIRK_H3_ES1_PLL ) - dpllcr |=DPLLCR_PLCS0_H3ES1X_PLL1 ; - } -rcar_du_group_write (rcrtc->group,DPLLCR , dpllcr); escr =ESCR_DCLKSEL_DCLKIN | div;
drivers/gpu/drm/rcar-du/rcar_du_drv.c +0 -48
78 lines not on this page · raw message
drivers/gpu/drm/rcar-du/rcar_du_drv.h +0 -2
@@ -34,8 +34,6 @@ struct rcar_du_device;#define RCAR_DU_FEATURE_NO_BLENDING BIT(5)/* PnMR.SPIM does not have ALP nor EOR bits */ #define RCAR_DU_QUIRK_ALIGN_128B BIT(0)/* Align pitches to 128 bytes */ -#define RCAR_DU_QUIRK_H3_ES1_PCLK_STABILITY BIT(1)/* H3 ES1 has pclk stability issue */ -#define RCAR_DU_QUIRK_H3_ES1_PLL BIT(2)/* H3 ES1 PLL setup differs from non-ES1 */ enum rcar_du_output {RCAR_DU_OUTPUT_DPAD0 ,
drivers/gpu/drm/rcar-du/rcar_du_regs.h +1 -2
@@ -283,8 +283,7 @@#define DPLLCR 0x20044#define DPLLCR_CODE (0x95 << 24)#define DPLLCR_PLCS1 (1 << 23) -#define DPLLCR_PLCS0_PLL (1 << 21) -#define DPLLCR_PLCS0_H3ES1X_PLL1 (1 << 20) +#define DPLLCR_PLCS0 (1 << 21)#define DPLLCR_CLKE (1 << 18)#define DPLLCR_FDPLL (n) ((n) << 12)#define DPLLCR_N (n) ((n) << 5)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 18/234 ASoC: amd: vangogh: Add check for acp config flags in vangogh platform
In reply to Greg Kroah-HartmanFrom: Venkata Prasad Potturu <[email protected]>
[ Upstream commit e89f45edb747ed88e97a5771dd6d3dd1eb517873 ]
We have SOF and generic ACP support enabled for Vangogh platform on some machines. Since we have same PCI id used for probing, add check for machine configuration flag to avoid conflict with newer pci drivers. Such machine flag has been initialized via dmi match on few Vangogh based machines. If no flag is specified probe and register older platform device.
--- sound/soc/amd/vangogh/acp5x.h | 2 ++ sound/soc/amd/vangogh/pci-acp5x.c | 7 ++++++- 2 files changed, 8 insertions(+), 1 deletion(-)
sound/soc/amd/vangogh/acp5x.h +2 -0
@@ -147,6 +147,8 @@ static inline void acp_writel(u32 val, void __iomem *base_addr)writel (val, base_addr - ACP5x_PHY_BASE_ADDRESS); } +int snd_amd_acp_find_config (struct pci_dev *pci); +static inline u64 acp_get_byte_count (struct i2s_stream_instance *rtd,int direction) {
sound/soc/amd/vangogh/pci-acp5x.c +6 -1
@@ -125,10 +125,15 @@ static int snd_acp5x_probe(struct pci_dev *pci, {struct acp5x_dev_data *adata;struct platform_device_info pdevinfo[ACP5x_DEVS]; -unsigned int irqflags; +unsigned int irqflags, flag;int ret, i;u32 addr, val; +/* Return if acp config flag is defined */ + flag =snd_amd_acp_find_config (pci); +if (flag) +return -ENODEV ; + irqflags =IRQF_SHARED ;if (pci->revision !=0x50 )return -ENODEV ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 19/234 RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing
In reply to Greg Kroah-HartmanFrom: Long Li <[email protected]>
[ Upstream commit 2145328515c8fa9b8a9f7889250bc6c032f2a0e6 ]
With RX coalescing, one CQE entry can be used to indicate multiple packets on the receive queue. This saves processing time and PCI bandwidth over the CQ.
The MANA Ethernet driver also uses the v2 version of the protocol. It doesn't use RX coalescing and its behavior is not changed.
--- drivers/infiniband/hw/mana/qp.c | 5 ++++- drivers/net/ethernet/microsoft/mana/mana_en.c | 5 ++++- include/net/mana/mana.h | 4 +++- 3 files changed, 11 insertions(+), 3 deletions(-)
drivers/infiniband/hw/mana/qp.c +4 -1
@@ -13,7 +13,7 @@ static int mana_ib_cfg_vport_steering(struct mana_ib_dev *dev, u8 *rx_hash_key) {struct mana_port_context *mpc =netdev_priv (ndev); -struct mana_cfg_rx_steer_req *req =NULL ; +struct mana_cfg_rx_steer_req_v2 *req;struct mana_cfg_rx_steer_resp resp = {};mana_handle_t *req_indir_tab;struct gdma_context *gc;
@@ -33,6 +33,8 @@ static int mana_ib_cfg_vport_steering(struct mana_ib_dev *dev,mana_gd_init_req_hdr (&req->hdr,MANA_CONFIG_VPORT_RX , req_buf_size,sizeof (resp)); + req->hdr.req.msg_version =GDMA_MESSAGE_V2 ; + req->vport = mpc->port_handle; req->rx_enable =1 ; req->update_default_rxobj =1 ;
@@ -46,6 +48,7 @@ static int mana_ib_cfg_vport_steering(struct mana_ib_dev *dev, req->num_indir_entries =MANA_INDIRECT_TABLE_SIZE ; req->indir_tab_offset =sizeof (*req); req->update_indir_tab = true; + req->cqe_coalescing_enable =1 ; req_indir_tab = (mana_handle_t *)(req +1 );/* The ind table passed to the hardware must have
drivers/net/ethernet/microsoft/mana/mana_en.c +4 -1
@@ -973,7 +973,7 @@ static int mana_cfg_vport_steering(struct mana_port_context *apc, bool update_tab) {u16 num_entries =MANA_INDIRECT_TABLE_SIZE ; -struct mana_cfg_rx_steer_req *req =NULL ; +struct mana_cfg_rx_steer_req_v2 *req;struct mana_cfg_rx_steer_resp resp = {};struct net_device *ndev = apc->ndev;mana_handle_t *req_indir_tab;
@@ -988,6 +988,8 @@ static int mana_cfg_vport_steering(struct mana_port_context *apc,mana_gd_init_req_hdr (&req->hdr,MANA_CONFIG_VPORT_RX , req_buf_size,sizeof (resp)); + req->hdr.req.msg_version =GDMA_MESSAGE_V2 ; + req->vport = apc->port_handle; req->num_indir_entries = num_entries; req->indir_tab_offset =sizeof (*req);
@@ -997,6 +999,7 @@ static int mana_cfg_vport_steering(struct mana_port_context *apc, req->update_hashkey = update_key; req->update_indir_tab = update_tab; req->default_rxobj = apc->default_rxobj; + req->cqe_coalescing_enable =0 ;if (update_key)memcpy (&req->hashkey, apc->hashkey,MANA_HASH_KEY_SIZE );
include/net/mana/mana.h +3 -1
@@ -579,7 +579,7 @@ struct mana_fence_rq_resp { };/* HW DATA */ /* Configure vPort Rx Steering */ -struct mana_cfg_rx_steer_req { +struct mana_cfg_rx_steer_req_v2 {struct gdma_req_hdr hdr;mana_handle_t vport;u16 num_indir_entries;
@@ -592,6 +592,8 @@ struct mana_cfg_rx_steer_req {u8 reserved;mana_handle_t default_rxobj;u8 hashkey[MANA_HASH_KEY_SIZE ]; +u8 cqe_coalescing_enable; +u8 reserved2[7 ]; };/* HW DATA */ struct mana_cfg_rx_steer_resp {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 20/234 ARM: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related warnings
In reply to Greg Kroah-HartmanFrom: Oleksij Rempel <[email protected]>
[ Upstream commit 1d14bd943fa2bbdfda1efbcc080b298fed5f1803 ]
Fix USB-related warnings in prtrvt, prtvt7, prti6q and prtwd2 device trees by disabling unused usbphynop1 and usbphynop2 USB PHYs and providing proper configuration for the over-current detection. This fixes the following warnings with the current kernel:
usb_phy_generic usbphynop1: dummy supplies not allowed for exclusive requests usb_phy_generic usbphynop2: dummy supplies not allowed for exclusive requests imx_usb 2184200.usb: No over current polarity defined
By the way, fix over-current detection on usbotg port for prtvt7, prti6q and prtwd2 boards. Only prtrvt do not have OC on USB OTG port.
--- arch/arm/boot/dts/imx6dl-prtrvt.dts | 4 ++++ arch/arm/boot/dts/imx6qdl-prti6q.dtsi | 11 ++++++++++- 2 files changed, 14 insertions(+), 1 deletion(-)
arch/arm/boot/dts/imx6dl-prtrvt.dts +4 -0
@@ -124,6 +124,10 @@ &usbh1 { status = "disabled"; }; +&usbotg { + disable-over-current; +}; + &vpu { status = "disabled"; };
arch/arm/boot/dts/imx6qdl-prti6q.dtsi +10 -1
@@ -69,6 +69,7 @@ &usbh1 { vbus-supply = <®_usb_h1_vbus>; phy_type = "utmi"; dr_mode = "host"; + disable-over-current; status = "okay"; };
@@ -78,10 +79,18 @@ &usbotg { pinctrl-0 = <&pinctrl_usbotg>; phy_type = "utmi"; dr_mode = "host"; - disable-over-current; + over-current-active-low; status = "okay"; }; +&usbphynop1 { + status = "disabled"; +}; + +&usbphynop2 { + status = "disabled"; +}; + &usdhc1 { pinctrl-names = "default"; pinctrl-0 = <&pinctrl_usdhc1>;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 21/234 ASoC: Intel: sof_sdw_rt_sdca_jack_common: test SOF_JACK_JDSRC in _exit
In reply to Greg Kroah-HartmanFrom: Bard Liao <[email protected]>
[ Upstream commit 526a1876fc48e2d0c0ea8ad63b58bdb2cc13047f ]
if (!SOF_RT711_JDSRC(sof_sdw_quirk)) is tested in rt711_sdca_add_codec_ device_props(), and we don't add software node to the device if jack source is not set. We need to do the same test in sof_sdw_rt711_sdca_exit(), and avoid removing software node if jack source is not set.
--- sound/soc/intel/boards/sof_sdw_rt711_sdca.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/intel/boards/sof_sdw_rt711_sdca.c +3 -0
@@ -143,6 +143,9 @@ int sof_sdw_rt711_sdca_exit(struct snd_soc_card *card, struct snd_soc_dai_link *if (!ctx->headset_codec_dev)return 0 ; +if (!SOF_RT711_JDSRC (sof_sdw_quirk)) +return 0 ; +device_remove_software_node (ctx->headset_codec_dev);put_device (ctx->headset_codec_dev);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 22/234 ASoC: Intel: sof_sdw: add quick for Dell SKU 0BDA
In reply to Greg Kroah-HartmanFrom: Pierre-Louis Bossart <[email protected]>
[ Upstream commit 3daf02819ac3fd8d7605804a00213cf123ac880d ]
The SKU numbering isn't quite consistent with the existing RaptorLake SKUs but the PCI ID is definitively RaptorLake.
--- sound/soc/intel/boards/sof_sdw.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
sound/soc/intel/boards/sof_sdw.c +10 -0
@@ -367,6 +367,16 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { RT711_JD2), },/* RaptorLake devices */ + { + .callback = sof_sdw_quirk_cb, + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc" ), +DMI_EXACT_MATCH (DMI_PRODUCT_SKU ,"0BDA" ) + }, + .driver_data = (void *)(SOF_SDW_TGL_HDMI | +RT711_JD2 | + SOF_SDW_FOUR_SPK), + }, { .callback = sof_sdw_quirk_cb, .matches = {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 23/234 ASoC: Intel: sof_sdw: Add support for Rex soundwire
In reply to Greg Kroah-HartmanFrom: Uday M Bhat <[email protected]>
[ Upstream commit 164e5dc17525181c05563f0a06796f1a363801d5 ]
Add rex entry in the soundwire quirk table
--- sound/soc/intel/boards/sof_sdw.c | 8 ++++++++ 1 file changed, 8 insertions(+)
sound/soc/intel/boards/sof_sdw.c +8 -0
@@ -433,6 +433,14 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { }, .driver_data = (void *)(RT711_JD2_100K), }, + { + .callback = sof_sdw_quirk_cb, + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Google" ), + DMI_MATCH(DMI_PRODUCT_NAME, "Rex"), + }, + .driver_data = (void *)(SOF_SDW_PCH_DMIC), + }, /* LunarLake devices */ { .callback = sof_sdw_quirk_cb,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 24/234 iopoll: Call cpu_relax() in busy loops
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit b407460ee99033503993ac7437d593451fcdfe44 ]
It is considered good practice to call cpu_relax() in busy loops, see Documentation/process/volatile-considered-harmful.rst. This can not only lower CPU power consumption or yield to a hyperthreaded twin processor, but also allows an architecture to mitigate hardware issues (e.g. ARM Erratum 754327 for Cortex-A9 prior to r2p0) in the architecture-specific cpu_relax() implementation.
In addition, cpu_relax() is also a compiler barrier. It is not immediately obvious that the @op argument "function" will result in an actual function call (e.g. in case of inlining).
Where a function call is a C sequence point, this is lost on inlining. Therefore, with agressive enough optimization it might be possible for the compiler to hoist the:
(val) = op(args);
"load" out of the loop because it doesn't see the value changing. The addition of cpu_relax() would inhibit this.
As the iopoll helpers lack calls to cpu_relax(), people are sometimes reluctant to use them, and may fall back to open-coded polling loops (including cpu_relax() calls) instead.
Fix this by adding calls to cpu_relax() to the iopoll helpers:
- For the non-atomic case, it is sufficient to call cpu_relax() in case of a zero sleep-between-reads value, as a call to usleep_range() is a safe barrier otherwise. However, it doesn't hurt to add the call regardless, for simplicity, and for similarity with the atomic case below.
- For the atomic case, cpu_relax() must be called regardless of the sleep-between-reads value, as there is no guarantee all architecture-specific implementations of udelay() handle this.
--- include/linux/iopoll.h | 2 ++ 1 file changed, 2 insertions(+)
include/linux/iopoll.h +2 -0
@@ -53,6 +53,7 @@ } \if (__sleep_us) \usleep_range ((__sleep_us >>2 ) +1 , __sleep_us); \ +cpu_relax (); \ } \ (cond) ?0 : -ETIMEDOUT ; \ })
@@ -95,6 +96,7 @@ } \if (__delay_us) \udelay (__delay_us); \ +cpu_relax (); \ } \ (cond) ?0 : -ETIMEDOUT ; \ })
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 25/234 ASoC: SOF: Intel: fix SoundWire/HDaudio mutual exclusion
In reply to Greg Kroah-HartmanFrom: Pierre-Louis Bossart <[email protected]>
[ Upstream commit f751b99255cacd9ffe8c4bbf99767ad670cee1f7 ]
The functionality described in Commit 61bef9e68dca ("ASoC: SOF: Intel: hda: enforce exclusion between HDaudio and SoundWire") does not seem to be properly implemented with two issues that need to
be corrected.
a) The test used is incorrect when DisplayAudio codecs are not supported.
b) Conversely when only Display Audio codecs can be found, we do want to start the SoundWire links, if any. That will help add the relevant topologies and machine descriptors, and identify cases where the SoundWire information in ACPI needs to be modified with a quirk.
--- sound/soc/sof/intel/hda.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
sound/soc/sof/intel/hda.c +11 -1
@@ -1343,12 +1343,22 @@ static void hda_generic_machine_select(struct snd_sof_dev *sdev, hda_mach->mach_params.dmic_num = dmic_num; pdata->tplg_filename = tplg_filename; -if (codec_num ==2 ) { +if (codec_num ==2 || + (codec_num ==1 && !HDA_IDISP_CODEC (bus->codec_mask))) {/* * Prevent SoundWire links from starting when an external * HDaudio codec is used */ hda_mach->mach_params.link_mask =0 ; + }else { +/* +* Allow SoundWire links to start when no external HDaudio codec +* was detected. This will not create a SoundWire card but +* will help detect if any SoundWire codec reports as ATTACHED. +*/ +struct sof_intel_hda_dev *hdev = sdev->pdata->hw_pdata; + + hda_mach->mach_params.link_mask = hdev->info.link_mask; } *mach = hda_mach;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 26/234 dma-remap: use kvmalloc_array/kvfree for larger dma memory remap
In reply to Greg Kroah-HartmanFrom: gaoxu <[email protected]>
[ Upstream commit 51ff97d54f02b4444dfc42e380ac4c058e12d5dd ]
If dma_direct_alloc() alloc memory in size of 64MB, the inner function dma_common_contiguous_remap() will allocate 128KB memory by invoking the function kmalloc_array(). and the kmalloc_array seems to fail to try to allocate 128KB mem.
Call trace: [14977.928623] qcrosvm: page allocation failure: order:5, mode:0x40cc0 [14977.928638] dump_backtrace.cfi_jt+0x0/0x8 [14977.928647] dump_stack_lvl+0x80/0xb8 [14977.928652] warn_alloc+0x164/0x200 [14977.928657] __alloc_pages_slowpath+0x9f0/0xb4c [14977.928660] __alloc_pages+0x21c/0x39c [14977.928662] kmalloc_order+0x48/0x108 [14977.928666] kmalloc_order_trace+0x34/0x154 [14977.928668] __kmalloc+0x548/0x7e4 [14977.928673] dma_direct_alloc+0x11c/0x4f8 [14977.928678] dma_alloc_attrs+0xf4/0x138 [14977.928680] gh_vm_ioctl_set_fw_name+0x3c4/0x610 [gunyah] [14977.928698] gh_vm_ioctl+0x90/0x14c [gunyah] [14977.928705] __arm64_sys_ioctl+0x184/0x210
work around by doing kvmalloc_array instead.
--- kernel/dma/remap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/dma/remap.c +2 -2
@@ -43,13 +43,13 @@ void *dma_common_contiguous_remap(struct page *page, size_t size,void *vaddr;int i; - pages =kmalloc_array (count,sizeof (struct page *),GFP_KERNEL ); + pages =kvmalloc_array (count,sizeof (struct page *),GFP_KERNEL );if (!pages)return NULL ;for (i =0 ; i < count; i++) pages[i] =nth_page (page, i); vaddr =vmap (pages, count,VM_DMA_COHERENT , prot); -kfree (pages); +kvfree (pages);return vaddr; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 27/234 accel/habanalabs: add pci health check during heartbeat
In reply to Greg Kroah-HartmanFrom: Ofir Bitton <[email protected]>
[ Upstream commit d8b9cea584661b30305cf341bf9f675dc0a25471 ]
Currently upon a heartbeat failure, we don't know if the failure is due to firmware hang or due to a bad PCI link. Hence, we are reading a PCI config space register with a known value (vendor ID) so we will know which of the two possibilities caused the heartbeat failure.
--- drivers/accel/habanalabs/common/device.c | 15 ++++++++++++++- drivers/accel/habanalabs/common/habanalabs.h | 2 ++ drivers/accel/habanalabs/common/habanalabs_drv.c | 2 -- 3 files changed, 16 insertions(+), 3 deletions(-)
drivers/accel/habanalabs/common/device.c +14 -1
@@ -981,6 +981,18 @@ static void device_early_fini(struct hl_device *hdev) hdev->asic_funcs->early_fini (hdev); } +static bool is_pci_link_healthy (struct hl_device *hdev) +{ +u16 vendor_id; + +if (!hdev->pdev) +return false; + +pci_read_config_word (hdev->pdev,PCI_VENDOR_ID , &vendor_id); + +return (vendor_id ==PCI_VENDOR_ID_HABANALABS ); +} +static void hl_device_heartbeat (struct work_struct *work) { struct hl_device *hdev = container_of(work, struct hl_device,
@@ -995,7 +1007,8 @@ static void hl_device_heartbeat(struct work_struct *work) goto reschedule;if (hl_device_operational (hdev,NULL )) -dev_err (hdev->dev,"Device heartbeat failed!\n" ); +dev_err (hdev->dev,"Device heartbeat failed! PCI link is %s\n" , +is_pci_link_healthy (hdev) ?"healthy" :"broken" ); info.err_type =HL_INFO_FW_HEARTBEAT_ERR ; info.event_mask = &event_mask;
drivers/accel/habanalabs/common/habanalabs.h +2 -0
@@ -36,6 +36,8 @@struct hl_device ;struct hl_fpriv ; +#define PCI_VENDOR_ID_HABANALABS 0x1da3 +/* Use upper bits of mmap offset to store habana driver specific information. * bits[63:59] - Encode mmap type * bits[45:0] - mmap offset value
drivers/accel/habanalabs/common/habanalabs_drv.c +0 -2
@@ -54,8 +54,6 @@ module_param(boot_error_status_mask, ulong, 0444);MODULE_PARM_DESC (boot_error_status_mask,"Mask of the error status during device CPU boot (If bitX is cleared then error X is masked. Default all 1's)" ); -#define PCI_VENDOR_ID_HABANALABS 0x1da3 -#define PCI_IDS_GOYA 0x0001#define PCI_IDS_GAUDI 0x1000#define PCI_IDS_GAUDI_SEC 0x1010
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 28/234 accel/habanalabs: fix mem leak in capture user mappings
In reply to Greg Kroah-HartmanFrom: Moti Haimovski <[email protected]>
[ Upstream commit 314a7ffd7c196b27eedd50cb7553029e17789b55 ]
This commit fixes a memory leak caused when clearing the user_mappings info when a new context is opened immediately after user_mapping is captured and a hard reset is performed.
--- drivers/accel/habanalabs/common/habanalabs_drv.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/accel/habanalabs/common/habanalabs_drv.c +2 -0
@@ -13,6 +13,7 @@#include <linux/pci.h> #include <linux/module.h> +#include <linux/vmalloc.h> #define CREATE_TRACE_POINTS #include <trace/events/habanalabs.h>
@@ -218,6 +219,7 @@ int hl_device_open(struct inode *inode, struct file *filp)hl_debugfs_add_file (hpriv); +vfree (hdev->captured_err_info.page_fault_info.user_mappings);memset (&hdev->captured_err_info,0 ,sizeof (hdev->captured_err_info));atomic_set (&hdev->captured_err_info.cs_timeout.write_enable,1 ); hdev->captured_err_info.undef_opcode.write_enable = true;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 29/234 dt-bindings: input: goodix: Add "goodix,no-reset-during-suspend" property
In reply to Greg Kroah-HartmanFrom: Fei Shao <[email protected]>
[ Upstream commit 359ed24a0dd3802e703ec8071dc3b6ed446de5f0 ]
We observed that on Chromebook device Steelix, if Goodix GT7375P touchscreen is powered in suspend (because, for example, it connects to an always-on regulator) and with the reset GPIO asserted, it will introduce about 14mW power leakage.
To address that, we add this property to skip reset during suspend. If it's set, the driver will stop asserting the reset GPIO during power-down. Refer to the comments in the driver for details.
--- .../devicetree/bindings/input/goodix,gt7375p.yaml | 9 +++++++++ 1 file changed, 9 insertions(+)
Documentation/devicetree/bindings/input/goodix,gt7375p.yaml +9 -0
@@ -43,6 +43,15 @@ properties: itself as long as it allows the main board to make signals compatible with what the touchscreen is expecting for its IO rails. + goodix,no-reset-during-suspend: + description: + Set this to true to enforce the driver to not assert the reset GPIO + during suspend. + Due to potential touchscreen hardware flaw, back-powering could happen in + suspend if the power supply is on and with active-low reset GPIO asserted. + This property is used to avoid the back-powering issue. + type: boolean + required: - compatible - reg
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 30/234 HID: i2c-hid: goodix: Add support for "goodix,no-reset-during-suspend" property
In reply to Greg Kroah-HartmanFrom: Fei Shao <[email protected]>
[ Upstream commit 7607f12ba735f04e0ef8718dabadf3a765c9a477 ]
In the beginning, commit 18eeef46d359 ("HID: i2c-hid: goodix: Tie the reset line to true state of the regulator") introduced a change to tie the reset line of the Goodix touchscreen to the state of the regulator to fix a power leakage issue in suspend.
After some time, the change was deemed unnecessary and was reverted in commit 557e05fa9fdd ("HID: i2c-hid: goodix: Stop tying the reset line to the regulator") due to difficulties in managing regulator notifiers for designs like Evoker, which provides a second power rail to touchscreen.
However, the revert caused a power regression on another Chromebook device Steelix in the field, which has a dedicated always-on regulator for touchscreen and was covered by the workaround in the first commit.
To address both cases, this patch adds the support for the new "goodix,no-reset-during-suspend" property in the driver:
- When set to true, the driver does not assert the reset GPIO during power-down.
Instead, the GPIO will be asserted during power-up to ensure the touchscreen always has a clean start and consistent behavior after resuming.
This is for designs with a dedicated always-on regulator.
- When set to false or unset, the driver uses the original control flow and asserts GPIO and disables regulators normally.
This is for the two-regulator and shared-regulator designs.
--- drivers/hid/i2c-hid/i2c-hid-of-goodix.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
drivers/hid/i2c-hid/i2c-hid-of-goodix.c +15 -1
@@ -28,6 +28,7 @@ struct i2c_hid_of_goodix {struct regulator *vdd;struct regulator *vddio;struct gpio_desc *reset_gpio; +bool no_reset_during_suspend;const struct goodix_i2c_hid_timing_data *timings; };
@@ -37,6 +38,14 @@ static int goodix_i2c_hid_power_up(struct i2chid_ops *ops) container_of(ops, struct i2c_hid_of_goodix, ops);int ret; +/* +* We assert reset GPIO here (instead of during power-down) to ensure +* the device will have a clean state after powering up, just like the +* normal scenarios will have. +*/ +if (ihid_goodix->no_reset_during_suspend) +gpiod_set_value_cansleep (ihid_goodix->reset_gpio,1 ); + ret =regulator_enable (ihid_goodix->vdd);if (ret)return ret;
@@ -60,7 +69,9 @@ static void goodix_i2c_hid_power_down(struct i2chid_ops *ops)struct i2c_hid_of_goodix *ihid_goodix = container_of(ops, struct i2c_hid_of_goodix, ops); -gpiod_set_value_cansleep (ihid_goodix->reset_gpio,1 ); +if (!ihid_goodix->no_reset_during_suspend) +gpiod_set_value_cansleep (ihid_goodix->reset_gpio,1 ); +regulator_disable (ihid_goodix->vddio);regulator_disable (ihid_goodix->vdd); }
@@ -91,6 +102,9 @@ static int i2c_hid_of_goodix_probe(struct i2c_client *client)if (IS_ERR (ihid_goodix->vddio))return PTR_ERR (ihid_goodix->vddio); + ihid_goodix->no_reset_during_suspend = +of_property_read_bool (client->dev.of_node,"goodix,no-reset-during-suspend" ); + ihid_goodix->timings =device_get_match_data (&client->dev);return i2c_hid_core_probe (client, &ihid_goodix->ops,0x0001 ,0 );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 31/234 HID: logitech-hidpp: Add USB and Bluetooth IDs for the Logitech G915 TKL Keyboard
In reply to Greg Kroah-HartmanFrom: stuarthayhurst <[email protected]>
[ Upstream commit 48aea8b445c422a372cf15915101035a47105421 ]
Adds the USB and Bluetooth IDs for the Logitech G915 TKL keyboard, for device detection For this device, this provides battery reporting on top of hid-generic
--- drivers/hid/hid-logitech-hidpp.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/hid/hid-logitech-hidpp.c +4 -0
@@ -4608,6 +4608,8 @@ static const struct hid_device_id hidpp_devices[] = { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC086) }, {/* Logitech G903 Hero Gaming Mouse over USB */ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC091) }, + { /* Logitech G915 TKL Keyboard over USB */ + HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC343) }, { /* Logitech G920 Wheel over USB */HID_USB_DEVICE (USB_VENDOR_ID_LOGITECH ,USB_DEVICE_ID_LOGITECH_G920_WHEEL ), .driver_data = HIDPP_QUIRK_CLASS_G920 | HIDPP_QUIRK_FORCE_OUTPUT_REPORTS},
@@ -4630,6 +4632,8 @@ static const struct hid_device_id hidpp_devices[] = { {/* MX5500 keyboard over Bluetooth */ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb30b), .driver_data = HIDPP_QUIRK_HIDPP_CONSUMER_VENDOR_KEYS }, + { /* Logitech G915 TKL keyboard over Bluetooth */ + HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb35f) }, { /* M-RCQ142 V470 Cordless Laser Mouse over Bluetooth */ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb008) }, { /* MX Master mouse over Bluetooth */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 32/234 iommu/amd: Introduce Disable IRTE Caching Support
In reply to Greg Kroah-HartmanFrom: Suravee Suthikulpanit <[email protected]>
[ Upstream commit 66419036f68a838c00cbccacd6cb2e99da6e5710 ]
An Interrupt Remapping Table (IRT) stores interrupt remapping configuration for each device. In a normal operation, the AMD IOMMU caches the table to optimize subsequent data accesses. This requires the IOMMU driver to invalidate IRT whenever it updates the table. The invalidation process includes issuing an INVALIDATE_INTERRUPT_TABLE command following by a COMPLETION_WAIT command.
However, there are cases in which the IRT is updated at a high rate. For example, for IOMMU AVIC, the IRTE[IsRun] bit is updated on every vcpu scheduling (i.e. amd_iommu_update_ga()). On system with large amount of vcpus and VFIO PCI pass-through devices, the invalidation process could potentially become a performance bottleneck.
Introducing a new kernel boot option:
amd_iommu=irtcachedis
which disables IRTE caching by setting the IRTCachedis bit in each IOMMU Control register, and bypass the IRT invalidation process.
--- .../admin-guide/kernel-parameters.txt | 1 + drivers/iommu/amd/amd_iommu_types.h | 4 +++ drivers/iommu/amd/init.c | 36 +++++++++++++++++++ 3 files changed, 41 insertions(+)
Documentation/admin-guide/kernel-parameters.txt +1 -0
@@ -323,6 +323,7 @@ option with care. pgtbl_v1 - Use v1 page table for DMA-API (Default). pgtbl_v2 - Use v2 page table for DMA-API. + irtcachedis - Disable Interrupt Remapping Table (IRT) caching. amd_iommu_dump= [HW,X86-64] Enable AMD IOMMU driver option to dump the ACPI table
drivers/iommu/amd/amd_iommu_types.h +4 -0
@@ -174,6 +174,7 @@#define CONTROL_GAINT_EN 29#define CONTROL_XT_EN 50#define CONTROL_INTCAPXT_EN 51 +#define CONTROL_IRTCACHEDIS 59#define CONTROL_SNPAVIC_EN 61#define CTRL_INV_TO_MASK (7 << CONTROL_INV_TIMEOUT)
@@ -716,6 +717,9 @@ struct amd_iommu {/* if one, we need to send a completion wait command */ bool need_sync; +/* true if disable irte caching */ +bool irtcachedis_enabled; +/* Handle for IOMMU core code */ struct iommu_device iommu;
drivers/iommu/amd/init.c +36 -0
@@ -162,6 +162,7 @@ static int amd_iommu_xt_mode = IRQ_REMAP_XAPIC_MODE;static bool amd_iommu_detected;static bool amd_iommu_disabled__initdata ;static bool amd_iommu_force_enable__initdata ; +static bool amd_iommu_irtcachedis;static int amd_iommu_target_ivhd_type;/* Global EFR and EFR2 registers */
@@ -484,6 +485,9 @@ static void iommu_disable(struct amd_iommu *iommu)/* Disable IOMMU hardware itself */ iommu_feature_disable (iommu,CONTROL_IOMMU_EN ); + +/* Clear IRTE cache disabling bit */ +iommu_feature_disable (iommu,CONTROL_IRTCACHEDIS ); }/*
@@ -2710,6 +2714,33 @@ static void iommu_enable_ga(struct amd_iommu *iommu)#endif } +static void iommu_disable_irtcachedis (struct amd_iommu *iommu) +{ +iommu_feature_disable (iommu,CONTROL_IRTCACHEDIS ); +} + +static void iommu_enable_irtcachedis (struct amd_iommu *iommu) +{ +u64 ctrl; + +if (!amd_iommu_irtcachedis) +return ; + +/* +* Note: +* The support for IRTCacheDis feature is dertermined by +* checking if the bit is writable. +*/ +iommu_feature_enable (iommu,CONTROL_IRTCACHEDIS ); + ctrl =readq (iommu->mmio_base +MMIO_CONTROL_OFFSET ); + ctrl &= (1ULL <<CONTROL_IRTCACHEDIS ); +if (ctrl) + iommu->irtcachedis_enabled = true; +pr_info ("iommu%d (%#06x) : IRT cache is %s\n" , + iommu->index, iommu->devid, + iommu->irtcachedis_enabled ?"disabled" :"enabled" ); +} +static void early_enable_iommu (struct amd_iommu *iommu) {iommu_disable (iommu);
@@ -2720,6 +2751,7 @@ static void early_enable_iommu(struct amd_iommu *iommu)iommu_set_exclusion_range (iommu);iommu_enable_ga (iommu);iommu_enable_xt (iommu); +iommu_enable_irtcachedis (iommu);iommu_enable (iommu);iommu_flush_all_caches (iommu); }
@@ -2770,10 +2802,12 @@ static void early_enable_iommus(void)for_each_iommu (iommu) {iommu_disable_command_buffer (iommu);iommu_disable_event_buffer (iommu); +iommu_disable_irtcachedis (iommu);iommu_enable_command_buffer (iommu);iommu_enable_event_buffer (iommu);iommu_enable_ga (iommu);iommu_enable_xt (iommu); +iommu_enable_irtcachedis (iommu);iommu_set_device_table (iommu);iommu_flush_all_caches (iommu); }
@@ -3426,6 +3460,8 @@ static int __init parse_amd_iommu_options(char *str) amd_iommu_pgtable =AMD_IOMMU_V1 ; }else if (strncmp (str,"pgtbl_v2" ,8 ) ==0 ) { amd_iommu_pgtable =AMD_IOMMU_V2 ; + }else if (strncmp (str,"irtcachedis" ,11 ) ==0 ) { + amd_iommu_irtcachedis = true; }else {pr_notice ("Unknown option - '%s'\n" , str); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 33/234 drm/amdgpu: install stub fence into potential unused fence pointers
In reply to Greg Kroah-HartmanFrom: Lang Yu <[email protected]>
[ Upstream commit 187916e6ed9d0c3b3abc27429f7a5f8c936bd1f0 ]
When using cpu to update page tables, vm update fences are unused. Install stub fence into these fence pointers instead of NULL to avoid NULL dereference when calling dma_fence_wait() on them.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +4 -2
@@ -1367,6 +1367,7 @@ struct amdgpu_bo_va *amdgpu_vm_bo_add(struct amdgpu_device *adev,amdgpu_vm_bo_base_init (&bo_va->base, vm, bo); bo_va->ref_count =1 ; + bo_va->last_pt_update =dma_fence_get_stub ();INIT_LIST_HEAD (&bo_va->valids);INIT_LIST_HEAD (&bo_va->invalids);
@@ -2088,7 +2089,8 @@ int amdgpu_vm_init(struct amdgpu_device *adev, struct amdgpu_vm *vm) vm->update_funcs = &amdgpu_vm_cpu_funcs; else vm->update_funcs = &amdgpu_vm_sdma_funcs; - vm->last_update =NULL ; + + vm->last_update =dma_fence_get_stub (); vm->last_unlocked =dma_fence_get_stub (); vm->last_tlb_flush =dma_fence_get_stub ();
@@ -2213,7 +2215,7 @@ int amdgpu_vm_make_compute(struct amdgpu_device *adev, struct amdgpu_vm *vm) goto unreserve_bo;dma_fence_put (vm->last_update); - vm->last_update =NULL ; + vm->last_update =dma_fence_get_stub (); vm->is_compute_context = true;/* Free the shadow bo for compute VM */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 34/234 drm/amd/display: Remove v_startup workaround for dcn3+
In reply to Greg Kroah-HartmanFrom: Daniel Miess <[email protected]>
[ Upstream commit 3a31e8b89b7240d9a17ace8a1ed050bdcb560f9e ]
[Why]
Calls to dcn20_adjust_freesync_v_startup are no longer needed as of dcn3+ and can cause underflow in some cases
[How]
Move calls to dcn20_adjust_freesync_v_startup up into validate_bandwidth for dcn2.x
--- .../drm/amd/display/dc/dml/dcn20/dcn20_fpu.c | 24 +++++++++++++++---- 1 file changed, 20 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/display/dc/dml/dcn20/dcn20_fpu.c +20 -4
@@ -1097,10 +1097,6 @@ void dcn20_calculate_dlg_params(struct dc *dc, context->res_ctx.pipe_ctx[i].plane_res.bw.dppclk_khz = pipes[pipe_idx].clks_cfg.dppclk_mhz *1000 ; context->res_ctx.pipe_ctx[i].pipe_dlg_param = pipes[pipe_idx].pipe.dest; -if (context->res_ctx.pipe_ctx[i].stream->adaptive_sync_infopacket.valid) -dcn20_adjust_freesync_v_startup ( - &context->res_ctx.pipe_ctx[i].stream->timing, - &context->res_ctx.pipe_ctx[i].pipe_dlg_param.vstartup_start); pipe_idx++; }
@@ -1914,6 +1910,7 @@ static bool dcn20_validate_bandwidth_internal(struct dc *dc, struct dc_state *coint vlevel =0 ;int pipe_split_from[MAX_PIPES ];int pipe_cnt =0 ; +int i =0 ;display_e2e_pipe_params_st *pipes =kzalloc (dc->res_pool->pipe_count *sizeof (display_e2e_pipe_params_st),GFP_ATOMIC );DC_LOGGER_INIT (dc->ctx->logger);
@@ -1937,6 +1934,15 @@ static bool dcn20_validate_bandwidth_internal(struct dc *dc, struct dc_state *codcn20_calculate_wm (dc, context, pipes, &pipe_cnt, pipe_split_from, vlevel, fast_validate);dcn20_calculate_dlg_params (dc, context, pipes, pipe_cnt, vlevel); +for (i =0 ; i < dc->res_pool->pipe_count; i++) { +if (!context->res_ctx.pipe_ctx[i].stream) +continue ; +if (context->res_ctx.pipe_ctx[i].stream->adaptive_sync_infopacket.valid) +dcn20_adjust_freesync_v_startup ( + &context->res_ctx.pipe_ctx[i].stream->timing, + &context->res_ctx.pipe_ctx[i].pipe_dlg_param.vstartup_start); + } +BW_VAL_TRACE_END_WATERMARKS (); goto validate_out;
@@ -2209,6 +2215,7 @@ bool dcn21_validate_bandwidth_fp(struct dc *dc,int vlevel =0 ;int pipe_split_from[MAX_PIPES ];int pipe_cnt =0 ; +int i =0 ;display_e2e_pipe_params_st *pipes =kzalloc (dc->res_pool->pipe_count *sizeof (display_e2e_pipe_params_st),GFP_ATOMIC );DC_LOGGER_INIT (dc->ctx->logger);
@@ -2237,6 +2244,15 @@ bool dcn21_validate_bandwidth_fp(struct dc *dc,dcn21_calculate_wm (dc, context, pipes, &pipe_cnt, pipe_split_from, vlevel, fast_validate);dcn20_calculate_dlg_params (dc, context, pipes, pipe_cnt, vlevel); +for (i =0 ; i < dc->res_pool->pipe_count; i++) { +if (!context->res_ctx.pipe_ctx[i].stream) +continue ; +if (context->res_ctx.pipe_ctx[i].stream->adaptive_sync_infopacket.valid) +dcn20_adjust_freesync_v_startup ( + &context->res_ctx.pipe_ctx[i].stream->timing, + &context->res_ctx.pipe_ctx[i].pipe_dlg_param.vstartup_start); + } +BW_VAL_TRACE_END_WATERMARKS (); goto validate_out;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 35/234 drm/amd/display: Apply 60us prefetch for DCFCLK <= 300Mhz
In reply to Greg Kroah-HartmanFrom: Alvin Lee <[email protected]>
[ Upstream commit 7e60ab4eb3e4ba2adac46d737fdbbc5732bebd58 ]
[Description]
- Previously we wanted to apply extra 60us of prefetch for min DCFCLK (200Mhz), but DCFCLK can be calculated to be 201Mhz which underflows also without the extra prefetch
- Instead, apply the the extra 60us prefetch for any DCFCLK freq <= 300Mhz
--- .../gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c | 4 ++-- .../gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.h | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c +2 -2
@@ -811,7 +811,7 @@ static void DISPCLKDPPCLKDCFCLKDeepSleepPrefetchParametersWatermarksAndPerforman v->SwathHeightC[k], TWait, (v->DRAMSpeedPerState[mode_lib->vba.VoltageLevel] <=MEM_STROBE_FREQ_MHZ || - v->DCFCLKPerState[mode_lib->vba.VoltageLevel] <=MIN_DCFCLK_FREQ_MHZ ) ? + v->DCFCLKPerState[mode_lib->vba.VoltageLevel] <=DCFCLK_FREQ_EXTRA_PREFETCH_REQ_MHZ ) ? mode_lib->vba.ip.min_prefetch_in_strobe_us :0 ,/* Output */ &v->DSTXAfterScaler[k],
@@ -3311,7 +3311,7 @@ void dml32_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l v->swath_width_chroma_ub_this_state[k], v->SwathHeightYThisState[k], v->SwathHeightCThisState[k], v->TWait, - (v->DRAMSpeedPerState[i] <=MEM_STROBE_FREQ_MHZ || v->DCFCLKState[i][j] <=MIN_DCFCLK_FREQ_MHZ ) ? + (v->DRAMSpeedPerState[i] <=MEM_STROBE_FREQ_MHZ || v->DCFCLKState[i][j] <=DCFCLK_FREQ_EXTRA_PREFETCH_REQ_MHZ ) ? mode_lib->vba.ip.min_prefetch_in_strobe_us : 0,/* Output */
drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.h +1 -1
@@ -53,7 +53,7 @@#define BPP_BLENDED_PIPE 0xffffffff#define MEM_STROBE_FREQ_MHZ 1600 -#define MIN_DCFCLK_FREQ_MHZ 200 +#define DCFCLK_FREQ_EXTRA_PREFETCH_REQ_MHZ 300#define MEM_STROBE_MAX_DELIVERY_TIME_US 60.0struct display_mode_lib ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 36/234 drm/amdgpu: unmap and remove csa_va properly
In reply to Greg Kroah-HartmanFrom: Lang Yu <[email protected]>
[ Upstream commit 5daff15cd013422bc6d1efcfe82b586800025384 ]
Root PD BO should be reserved before unmap and remove a bo_va from VM otherwise lockdep will complain.
v2: check fpriv->csa_va is not NULL instead of amdgpu_mcbp (christian)
[14616.936827] WARNING: CPU: 6 PID: 1711 at drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c:1762 amdgpu_vm_bo_del+0x399/0x3f0 [amdgpu] [14616.937096] Call Trace: [14616.937097] <TASK> [14616.937102] amdgpu_driver_postclose_kms+0x249/0x2f0 [amdgpu] [14616.937187] drm_file_free+0x1d6/0x300 [drm] [14616.937207] drm_close_helper.isra.0+0x62/0x70 [drm] [14616.937220] drm_release+0x5e/0x100 [drm] [14616.937234] __fput+0x9f/0x280 [14616.937239] ____fput+0xe/0x20 [14616.937241] task_work_run+0x61/0x90 [14616.937246] exit_to_user_mode_prepare+0x215/0x220 [14616.937251] syscall_exit_to_user_mode+0x2a/0x60 [14616.937254] do_syscall_64+0x48/0x90 [14616.937257] entry_SYSCALL_64_after_hwframe+0x63/0xcd
--- drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 38 +++++++++++++++++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_csa.h | 3 ++ drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 10 +++---- 3 files changed, 46 insertions(+), 5 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c +38 -0
@@ -106,3 +106,41 @@ int amdgpu_map_static_csa(struct amdgpu_device *adev, struct amdgpu_vm *vm,ttm_eu_backoff_reservation (&ticket, &list);return 0 ; } + +int amdgpu_unmap_static_csa (struct amdgpu_device *adev,struct amdgpu_vm *vm, +struct amdgpu_bo *bo,struct amdgpu_bo_va *bo_va, +uint64_t csa_addr) +{ +struct ww_acquire_ctx ticket; +struct list_head list; +struct amdgpu_bo_list_entry pd; +struct ttm_validate_buffer csa_tv; +int r; + +INIT_LIST_HEAD (&list); +INIT_LIST_HEAD (&csa_tv.head); + csa_tv.bo = &bo->tbo; + csa_tv.num_shared =1 ; + +list_add (&csa_tv.head, &list); +amdgpu_vm_get_pd_bo (vm, &list, &pd); + + r =ttm_eu_reserve_buffers (&ticket, &list, true,NULL ); +if (r) { +DRM_ERROR ("failed to reserve CSA,PD BOs: err=%d\n" , r); +return r; + } + + r =amdgpu_vm_bo_unmap (adev, bo_va, csa_addr); +if (r) { +DRM_ERROR ("failed to do bo_unmap on static CSA, err=%d\n" , r); +ttm_eu_backoff_reservation (&ticket, &list); +return r; + } + +amdgpu_vm_bo_del (adev, bo_va); + +ttm_eu_backoff_reservation (&ticket, &list); + +return 0 ; +}
drivers/gpu/drm/amd/amdgpu/amdgpu_csa.h +3 -0
@@ -34,6 +34,9 @@ int amdgpu_allocate_static_csa(struct amdgpu_device *adev, struct amdgpu_bo **boint amdgpu_map_static_csa (struct amdgpu_device *adev,struct amdgpu_vm *vm,struct amdgpu_bo *bo,struct amdgpu_bo_va **bo_va,uint64_t csa_addr,uint32_t size); +int amdgpu_unmap_static_csa (struct amdgpu_device *adev,struct amdgpu_vm *vm, +struct amdgpu_bo *bo,struct amdgpu_bo_va *bo_va, +uint64_t csa_addr);void amdgpu_free_static_csa (struct amdgpu_bo **bo);#endif
drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +5 -5
@@ -1284,12 +1284,12 @@ void amdgpu_driver_postclose_kms(struct drm_device *dev,if (amdgpu_device_ip_get_ip_block (adev,AMD_IP_BLOCK_TYPE_VCE ) !=NULL )amdgpu_vce_free_handles (adev, file_priv); -if (amdgpu_mcbp) { -/* TODO: how to handle reserve failure */ -BUG_ON (amdgpu_bo_reserve (adev->virt.csa_obj, true)); -amdgpu_vm_bo_del (adev, fpriv->csa_va); +if (fpriv->csa_va) { +uint64_t csa_addr =amdgpu_csa_vaddr (adev) &AMDGPU_GMC_HOLE_MASK ; + +WARN_ON (amdgpu_unmap_static_csa (adev, &fpriv->vm, adev->virt.csa_obj, + fpriv->csa_va, csa_addr)); fpriv->csa_va =NULL ; -amdgpu_bo_unreserve (adev->virt.csa_obj); } pasid = fpriv->vm.pasid;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 37/234 RDMA/mlx5: Return the firmware result upon destroying QP/RQ
In reply to Greg Kroah-HartmanFrom: Patrisious Haddad <[email protected]>
[ Upstream commit 22664c06e997087fe37f9ba208008c948571214a ]
Previously when destroying a QP/RQ, the result of the firmware destruction function was ignored and upper layers weren't informed about the failure.
Which in turn could lead to various problems since when upper layer isn't aware of the failure it continues its operation thinking that the related QP/RQ was successfully destroyed while it actually wasn't, which could lead to the below kernel WARN.
Currently, we return the correct firmware destruction status to upper layers which in case of the RQ would be mlx5_ib_destroy_wq() which was already capable of handling RQ destruction failure or in case of a QP to destroy_qp_common(), which now would actually warn upon qp destruction failure.
WARNING: CPU: 3 PID: 995 at drivers/infiniband/core/rdma_core.c:940 uverbs_destroy_ufile_hw+0xcb/0xe0 [ib_uverbs] Modules linked in: xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi rdma_cm ib_umad ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core overlay mlx5_core fuse CPU: 3 PID: 995 Comm: python3 Not tainted 5.16.0-rc5+ #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:uverbs_destroy_ufile_hw+0xcb/0xe0 [ib_uverbs] Code: 41 5c 41 5d 41 5e e9 44 34 f0 e0 48 89 df e8 4c 77 ff ff 49 8b 86 10 01 00 00 48 85 c0 74 a1 4c 89 e7 ff d0 eb 9a 0f 0b eb c1 <0f> 0b be 04 00 00 00 48 89 df e8 b6 f6 ff ff e9 75 ff ff ff 90 0f RSP: 0018:ffff8881533e3e78 EFLAGS: 00010287 RAX: ffff88811b2cf3e0 RBX: ffff888106209700 RCX: 0000000000000000 RDX: ffff888106209780 RSI: ffff8881533e3d30 RDI: ffff888109b101a0 RBP: 0000000000000001 R08: ffff888127cb381c R09: 0de9890000000009 R10: ffff888127cb3800 R11: 0000000000000000 R12: ffff888106209780 R13: ffff888106209750 R14: ffff888100f20660 R15: 0000000000000000 FS: 00007f8be353b740(0000) GS:ffff88852c980000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8bd5b117c0 CR3: 000000012cd8a004 CR4: 0000000000370ea0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ib_uverbs_close+0x1a/0x90 [ib_uverbs] __fput+0x82/0x230 task_work_run+0x59/0x90 exit_to_user_mode_prepare+0x138/0x140 syscall_exit_to_user_mode+0x1d/0x50 ? __x64_sys_close+0xe/0x40 do_syscall_64+0x4a/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f8be3ae0abb Code: 03 00 00 00 0f 05 48 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 83 43 f9 ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 c1 43 f9 ff 8b 44 RSP: 002b:00007ffdb51909c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000557bb7f7c020 RCX: 00007f8be3ae0abb RDX: 0000557bb7c74010 RSI: 0000557bb7f14ca0 RDI: 0000000000000005 RBP: 0000557bb7fbd598 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000293 R12: 0000557bb7fbd5b8 R13: 0000557bb7fbd5a8 R14: 0000000000001000 R15: 0000557bb7f7c020 </TASK>
--- drivers/infiniband/hw/mlx5/qpc.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/infiniband/hw/mlx5/qpc.c +4 -6
@@ -298,8 +298,7 @@ int mlx5_core_destroy_qp(struct mlx5_ib_dev *dev, struct mlx5_core_qp *qp)MLX5_SET (destroy_qp_in, in, opcode,MLX5_CMD_OP_DESTROY_QP );MLX5_SET (destroy_qp_in, in, qpn, qp->qpn);MLX5_SET (destroy_qp_in, in, uid, qp->uid); -mlx5_cmd_exec_in (dev->mdev, destroy_qp, in); -return 0 ; +return mlx5_cmd_exec_in (dev->mdev, destroy_qp, in); } int mlx5_core_set_delay_drop(struct mlx5_ib_dev *dev,
@@ -551,14 +550,14 @@ int mlx5_core_xrcd_dealloc(struct mlx5_ib_dev *dev, u32 xrcdn)return mlx5_cmd_exec_in (dev->mdev, dealloc_xrcd, in); } -static void destroy_rq_tracked (struct mlx5_ib_dev *dev,u32 rqn,u16 uid) +static int destroy_rq_tracked (struct mlx5_ib_dev *dev,u32 rqn,u16 uid) {u32 in[MLX5_ST_SZ_DW (destroy_rq_in)] = {};MLX5_SET (destroy_rq_in, in, opcode,MLX5_CMD_OP_DESTROY_RQ );MLX5_SET (destroy_rq_in, in, rqn, rqn);MLX5_SET (destroy_rq_in, in, uid, uid); -mlx5_cmd_exec_in (dev->mdev, destroy_rq, in); +return mlx5_cmd_exec_in (dev->mdev, destroy_rq, in); } int mlx5_core_create_rq_tracked(struct mlx5_ib_dev *dev, u32 *in, int inlen,
@@ -589,8 +588,7 @@ int mlx5_core_destroy_rq_tracked(struct mlx5_ib_dev *dev, struct mlx5_core_qp *rq) {destroy_resource_common (dev, rq); -destroy_rq_tracked (dev, rq->qpn, rq->uid); -return 0 ; +return destroy_rq_tracked (dev, rq->qpn, rq->uid); }static void destroy_sq_tracked (struct mlx5_ib_dev *dev,u32 sqn,u16 uid)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 38/234 RDMA/bnxt_re: consider timeout of destroy ah as success.
In reply to Greg Kroah-HartmanFrom: Kashyap Desai <[email protected]>
[ Upstream commit bb8c93618fb0b8567d309f1aebc6df0cd31da1a2 ]
If destroy_ah is timed out, it is likely to be destroyed by firmware but it is taking longer time due to temporary slowness
in processing the rcfw command. In worst case, there might be AH resource leak in firmware.
Sending timeout return value can dump warning message from ib_core which can be avoided if we map timeout of destroy_ah as success.
--- drivers/infiniband/hw/bnxt_re/bnxt_re.h | 2 ++ drivers/infiniband/hw/bnxt_re/ib_verbs.c | 16 ++++++++++++---- drivers/infiniband/hw/bnxt_re/qplib_sp.c | 8 +++++--- drivers/infiniband/hw/bnxt_re/qplib_sp.h | 4 ++-- 4 files changed, 21 insertions(+), 9 deletions(-)
drivers/infiniband/hw/bnxt_re/bnxt_re.h +2 -0
@@ -179,6 +179,8 @@ struct bnxt_re_dev {#define BNXT_RE_ROCEV2_IPV4_PACKET 2#define BNXT_RE_ROCEV2_IPV6_PACKET 3 +#define BNXT_RE_CHECK_RC (x) ((x) && ((x) != -ETIMEDOUT)) +static inline struct device *rdev_to_dev (struct bnxt_re_dev *rdev) {if (rdev)
drivers/infiniband/hw/bnxt_re/ib_verbs.c +12 -4
@@ -614,12 +614,20 @@ int bnxt_re_destroy_ah(struct ib_ah *ib_ah, u32 flags) { struct bnxt_re_ah *ah = container_of(ib_ah, struct bnxt_re_ah, ib_ah);struct bnxt_re_dev *rdev = ah->rdev; +bool block = true; +int rc =0 ; -bnxt_qplib_destroy_ah (&rdev->qplib_res, &ah->qplib_ah, - !(flags &RDMA_DESTROY_AH_SLEEPABLE )); + block = !(flags &RDMA_DESTROY_AH_SLEEPABLE ); + rc =bnxt_qplib_destroy_ah (&rdev->qplib_res, &ah->qplib_ah, block); +if (BNXT_RE_CHECK_RC (rc)) { +if (rc == -ETIMEDOUT ) + rc =0 ; +else + goto fail; + }atomic_dec (&rdev->ah_count); - -return 0 ; +fail: +return rc; }static u8 bnxt_re_stack_to_dev_nw_type (enum rdma_network_type ntype)
drivers/infiniband/hw/bnxt_re/qplib_sp.c +5 -3
@@ -468,13 +468,14 @@ int bnxt_qplib_create_ah(struct bnxt_qplib_res *res, struct bnxt_qplib_ah *ah,return 0 ; } -void bnxt_qplib_destroy_ah (struct bnxt_qplib_res *res,struct bnxt_qplib_ah *ah, -bool block) +int bnxt_qplib_destroy_ah (struct bnxt_qplib_res *res,struct bnxt_qplib_ah *ah, +bool block) {struct bnxt_qplib_rcfw *rcfw = res->rcfw;struct creq_destroy_ah_resp resp = {};struct bnxt_qplib_cmdqmsg msg = {};struct cmdq_destroy_ah req = {}; +int rc;/* Clean up the AH table in the device */ bnxt_qplib_rcfw_cmd_prep((struct cmdq_base *)&req,
@@ -485,7 +486,8 @@ void bnxt_qplib_destroy_ah(struct bnxt_qplib_res *res, struct bnxt_qplib_ah *ah,bnxt_qplib_fill_cmdqmsg (&msg, &req, &resp,NULL ,sizeof (req),sizeof (resp), block); -bnxt_qplib_rcfw_send_message (rcfw, &msg); + rc =bnxt_qplib_rcfw_send_message (rcfw, &msg); +return rc; }/* MRW */
drivers/infiniband/hw/bnxt_re/qplib_sp.h +2 -2
@@ -327,8 +327,8 @@ int bnxt_qplib_set_func_resources(struct bnxt_qplib_res *res, struct bnxt_qplib_ctx *ctx);int bnxt_qplib_create_ah (struct bnxt_qplib_res *res,struct bnxt_qplib_ah *ah,bool block); -void bnxt_qplib_destroy_ah (struct bnxt_qplib_res *res,struct bnxt_qplib_ah *ah, -bool block); +int bnxt_qplib_destroy_ah (struct bnxt_qplib_res *res,struct bnxt_qplib_ah *ah, +bool block);int bnxt_qplib_alloc_mrw (struct bnxt_qplib_res *res,struct bnxt_qplib_mrw *mrw); int bnxt_qplib_dereg_mrw(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mrw,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 39/234 drm/amd/display: Skip DPP DTO update if root clock is gated
In reply to Greg Kroah-HartmanFrom: Nicholas Kazlauskas <[email protected]>
[ Upstream commit 30f90f3c1c2c63c2fa44f61233737d27b72637c2 ]
[Why]
Hardware implements root clock gating by utilizing the DPP DTO registers with a special case of DTO enabled, phase = 0, modulo = 1. This conflicts with our policy to always update the DPPDTO for cases where it's expected to be disabled.
The pipes unexpectedly enter a higher power state than expected because of this programming flow.
[How]
Guard the upper layers of HWSS against this hardware quirk with programming the register with an internal state flag in DCCG.
While technically acting as global state for the DCCG, HWSS shouldn't be expected to understand the hardware quirk for having DTO disabled causing more power than DTO enabled with this specific setting.
This also prevents sequencing errors from occuring in the future if we have to program DPP DTO in multiple locations.
--- drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c | 8 ++++++++ drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c | 5 +++++ drivers/gpu/drm/amd/display/dc/inc/hw/dccg.h | 1 + 3 files changed, 14 insertions(+)
drivers/gpu/drm/amd/display/dc/dcn31/dcn31_dccg.c +8 -0
@@ -47,6 +47,14 @@ void dccg31_update_dpp_dto(struct dccg *dccg, int dpp_inst, int req_dppclk) {struct dcn_dccg *dccg_dcn =TO_DCN_DCCG (dccg); +if (dccg->dpp_clock_gated[dpp_inst]) { +/* +* Do not update the DPPCLK DTO if the clock is stopped. +* It is treated the same as if the pipe itself were in PG. +*/ +return ; + } +if (dccg->ref_dppclk && req_dppclk) {int ref_dppclk = dccg->ref_dppclk;int modulo, phase;
drivers/gpu/drm/amd/display/dc/dcn314/dcn314_dccg.c +5 -0
@@ -322,6 +322,9 @@ static void dccg314_dpp_root_clock_control( {struct dcn_dccg *dccg_dcn =TO_DCN_DCCG (dccg); +if (dccg->dpp_clock_gated[dpp_inst] == clock_on) +return ; +if (clock_on) {/* turn off the DTO and leave phase/modulo at max */ REG_UPDATE (DPPCLK_DTO_CTRL ,DPPCLK_DTO_ENABLE [dpp_inst],0 );
@@ -335,6 +338,8 @@ static void dccg314_dpp_root_clock_control(DPPCLK0_DTO_PHASE ,0 , DPPCLK0_DTO_MODULO, 1); } + + dccg->dpp_clock_gated[dpp_inst] = !clock_on; }static const struct dccg_funcs dccg314_funcs = {
drivers/gpu/drm/amd/display/dc/inc/hw/dccg.h +1 -0
@@ -68,6 +68,7 @@ struct dccg {const struct dccg_funcs *funcs;int pipe_dppclk_khz[MAX_PIPES ];int ref_dppclk; +bool dpp_clock_gated[MAX_PIPES ];//int dtbclk_khz[MAX_PIPES];/* TODO needs to be removed */ //int audio_dtbclk_khz;/* TODO needs to be removed */ //int ref_dtbclk_khz;/* TODO needs to be removed */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 40/234 drm/amd/display: Enable dcn314 DPP RCO
In reply to Greg Kroah-HartmanFrom: Daniel Miess <[email protected]>
[ Upstream commit 17fbdbda9cc87ff5a013898de506212d25323ed7 ]
[Why and How]
Add back debug bits enabling RCO for dcn314 as underflow associated with this change has been resolved
--- .../drm/amd/display/dc/dcn314/dcn314_resource.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c +16 -0
@@ -921,6 +921,22 @@ static const struct dc_debug_options debug_defaults_drv = { .afmt = true, } }, + + .root_clock_optimization = { + .bits = { + .dpp = true, + .dsc = false, + .hdmistream = false, + .hdmichar = false, + .dpstream = false, + .symclk32_se = false, + .symclk32_le = false, + .symclk_fe = false, + .physymclk = false, + .dpiasymclk = false, + } + }, + .seamless_boot_odm_combine = true };
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 41/234 ASoC: SOF: core: Free the firmware trace before calling snd_sof_shutdown()
In reply to Greg Kroah-HartmanFrom: Peter Ujfalusi <[email protected]>
[ Upstream commit d389dcb3a48cec4f03c16434c0bf98a4c635372a ]
The shutdown is called on reboot/shutdown of the machine.
At this point the firmware tracing cannot be used anymore but in case of IPC3 it is using and keeping a DMA channel active (dtrace).
For Tiger Lake platforms we have a quirk in place to fix rare reboot issues when a DMA was active before rebooting the system.
If the tracing is enabled this quirk will be always used and a print appears on the kernel log which might be misleading or not even correct.
Release the fw tracing before executing the shutdown to make sure that this known DMA user is cleared away.
--- sound/soc/sof/core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
sound/soc/sof/core.c +3 -1
@@ -504,8 +504,10 @@ int snd_sof_device_shutdown(struct device *dev)if (IS_ENABLED (CONFIG_SND_SOC_SOF_PROBE_WORK_QUEUE ))cancel_work_sync (&sdev->probe_work); -if (sdev->fw_state ==SOF_FW_BOOT_COMPLETE ) +if (sdev->fw_state ==SOF_FW_BOOT_COMPLETE ) { +sof_fw_trace_free (sdev);return snd_sof_shutdown (sdev); + }return 0 ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 42/234 HID: intel-ish-hid: ipc: Add Arrow Lake PCI device ID
In reply to Greg Kroah-HartmanFrom: Even Xu <[email protected]>
[ Upstream commit 4982126e3029cd59fbd1da0d9cc0365a0585fe64 ]
Add device ID of Arrow Lake-H into ishtp support list.
--- drivers/hid/intel-ish-hid/ipc/hw-ish.h | 1 + drivers/hid/intel-ish-hid/ipc/pci-ish.c | 1 + 2 files changed, 2 insertions(+)
drivers/hid/intel-ish-hid/ipc/hw-ish.h +1 -0
@@ -33,6 +33,7 @@#define ADL_N_DEVICE_ID 0x54FC#define RPL_S_DEVICE_ID 0x7A78#define MTL_P_DEVICE_ID 0x7E45 +#define ARL_H_DEVICE_ID 0x7745#define REVISION_ID_CHT_A0 0x6#define REVISION_ID_CHT_Ax_SI 0x0
drivers/hid/intel-ish-hid/ipc/pci-ish.c +1 -0
@@ -44,6 +44,7 @@ static const struct pci_device_id ish_pci_tbl[] = { {PCI_DEVICE(PCI_VENDOR_ID_INTEL, ADL_N_DEVICE_ID)}, {PCI_DEVICE(PCI_VENDOR_ID_INTEL, RPL_S_DEVICE_ID)}, {PCI_DEVICE(PCI_VENDOR_ID_INTEL, MTL_P_DEVICE_ID)}, + {PCI_DEVICE(PCI_VENDOR_ID_INTEL, ARL_H_DEVICE_ID)}, {0, } };MODULE_DEVICE_TABLE (pci, ish_pci_tbl);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 43/234 Revert "[PATCH] uml: export symbols added by GCC hardened"
In reply to Greg Kroah-HartmanFrom: Masahiro Yamada <[email protected]>
[ Upstream commit 8635e8df477bc77837886da206f4915576f88fec ]
This reverts commit cead61a6717a9873426b08d73a34a325e3546f5d.
It exported __stack_smash_handler and __guard, while they may not be defined by anyone.
The code *declares* __stack_smash_handler and __guard. It does not create weak symbols. If no external library is linked, they are left undefined, but yet exported.
If a loadable module tries to access non-existing symbols, bad things (a page fault, NULL pointer dereference, etc.) will happen. So, the current code is wrong and dangerous.
If the code were written as follows, it would *define* them as weak symbols so modules would be able to get access to them.
void (*__stack_smash_handler)(void *) __attribute__((weak)); EXPORT_SYMBOL(__stack_smash_handler); long __guard __attribute__((weak)); EXPORT_SYMBOL(__guard);
In fact, modpost forbids exporting undefined symbols. It shows an error message if it detects such a mistake.
ERROR: modpost: "..." [...] was exported without definition
Unfortunately, it is checked only when the code is built as modular. The problem described above has been unnoticed for a long time because arch/um/os-Linux/user_syms.c is always built-in.
With a planned change in Kbuild, exporting undefined symbols will always result in a build error instead of a run-time error. It is a good thing, but we need to fix the breakage in advance.
One fix is to define weak symbols as shown above. An alternative is to export them conditionally as follows:
#ifdef CONFIG_STACKPROTECTOR extern void __stack_smash_handler(void *); EXPORT_SYMBOL(__stack_smash_handler); external long __guard; EXPORT_SYMBOL(__guard); #endif
This is what other architectures do; EXPORT_SYMBOL(__stack_chk_guard) is guarded by #ifdef CONFIG_STACKPROTECTOR.
However, adding the #ifdef guard is not sensible because UML cannot enable the stack-protector in the first place! (Please note UML does not select HAVE_STACKPROTECTOR in Kconfig.)
So, the code is already broken (and unused) in multiple ways.
Just remove.
--- arch/um/os-Linux/user_syms.c | 7 ------- 1 file changed, 7 deletions(-)
arch/um/os-Linux/user_syms.c +0 -7
@@ -37,13 +37,6 @@ EXPORT_SYMBOL(vsyscall_ehdr);EXPORT_SYMBOL (vsyscall_end);#endif -/* Export symbols used by GCC for the stack protector. */ -extern void __stack_smash_handler (void *) __attribute__((weak)); -EXPORT_SYMBOL (__stack_smash_handler); - -extern long __guard __attribute__((weak)); -EXPORT_SYMBOL (__guard ); -#ifdef _FORTIFY_SOURCEextern int __sprintf_chk (char *str,int flag,size_t len,const char *format);EXPORT_SYMBOL (__sprintf_chk);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 44/234 smb: client: fix warning in cifs_smb3_do_mount()
In reply to Greg Kroah-HartmanFrom: Paulo Alcantara <[email protected]>
[ Upstream commit 12c30f33cc6769bf411088a2872843c4f9ea32f9 ]
This fixes the following warning reported by kernel test robot
fs/smb/client/cifsfs.c:982 cifs_smb3_do_mount() warn: possible memory leak of 'cifs_sb'
--- fs/smb/client/cifsfs.c | 28 ++++++++++------------------ 1 file changed, 10 insertions(+), 18 deletions(-)
fs/smb/client/cifsfs.c +10 -18
@@ -884,11 +884,11 @@ struct dentry * cifs_smb3_do_mount(struct file_system_type *fs_type, int flags, struct smb3_fs_context *old_ctx) { - int rc; -struct super_block *sb =NULL ; -struct cifs_sb_info *cifs_sb =NULL ; struct cifs_mnt_data mnt_data; +struct cifs_sb_info *cifs_sb; +struct super_block *sb;struct dentry *root; +int rc;if (cifsFYI) { cifs_dbg(FYI, "%s: devname=%s flags=0x%x\n", __func__,
@@ -897,11 +897,9 @@ cifs_smb3_do_mount(struct file_system_type *fs_type,cifs_info ("Attempting to mount %s\n" , old_ctx->source); } - cifs_sb =kzalloc (sizeof (struct cifs_sb_info ),GFP_KERNEL ); -if (cifs_sb ==NULL ) { - root =ERR_PTR (-ENOMEM ); - goto out; - } + cifs_sb =kzalloc (sizeof (*cifs_sb),GFP_KERNEL ); +if (!cifs_sb) +return ERR_PTR (-ENOMEM ); cifs_sb->ctx =kzalloc (sizeof (struct smb3_fs_context ),GFP_KERNEL );if (!cifs_sb->ctx) {
@@ -938,10 +936,8 @@ cifs_smb3_do_mount(struct file_system_type *fs_type, sb =sget (fs_type, cifs_match_super, cifs_set_super, flags, &mnt_data);if (IS_ERR (sb)) { - root =ERR_CAST (sb);cifs_umount (cifs_sb); - cifs_sb =NULL ; - goto out; +return ERR_CAST (sb); }if (sb->s_root) {
@@ -972,13 +968,9 @@ cifs_smb3_do_mount(struct file_system_type *fs_type,deactivate_locked_super (sb);return root; out: -if (cifs_sb) { -if (!sb ||IS_ERR (sb)) {/* otherwise kill_sb will handle */ -kfree (cifs_sb->prepath); -smb3_cleanup_fs_context (cifs_sb->ctx); -kfree (cifs_sb); - } - } +kfree (cifs_sb->prepath); +smb3_cleanup_fs_context (cifs_sb->ctx); +kfree (cifs_sb);return root; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 45/234 cifs: fix session state check in reconnect to avoid use-after-free issue
In reply to Greg Kroah-HartmanFrom: Winston Wen <[email protected]>
[ Upstream commit 99f280700b4cc02d5f141b8d15f8e9fad0418f65 ]
Don't collect exiting session in smb2_reconnect_server(), because it will be released soon.
Note that the exiting session will stay in server->smb_ses_list until it complete the cifs_free_ipc() and logoff() and then delete itself from the list.
--- fs/smb/client/smb2pdu.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/smb/client/smb2pdu.c +6 -0
@@ -3797,6 +3797,12 @@ void smb2_reconnect_server(struct work_struct *work)spin_lock (&cifs_tcp_ses_lock);list_for_each_entry (ses, &pserver->smb_ses_list, smb_ses_list) { +spin_lock (&ses->ses_lock); +if (ses->ses_status ==SES_EXITING ) { +spin_unlock (&ses->ses_lock); +continue ; + } +spin_unlock (&ses->ses_lock); tcon_selected = false;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 46/234 serial: stm32: Ignore return value of uart_remove_one_port() in .remove()
In reply to Greg Kroah-HartmanFrom: Uwe Kleine-König <[email protected]>
[ Upstream commit 6bd6cd29c92401a101993290051fa55078238a52 ]
Returning early from stm32_usart_serial_remove() results in a resource leak as several cleanup functions are not called. The driver core ignores the return value and there is no possibility to clean up later.
uart_remove_one_port() only returns non-zero if there is some inconsistency (i.e. stm32_usart_driver.state[port->line].uart_port == NULL). This should never happen, and even if it does it's a bad idea to exit early in the remove callback without cleaning up.
This prepares changing the prototype of struct platform_driver::remove to return void. See commit 5c5a7680e67b ("platform: Provide a remove callback that returns no value") for further details about this quest.
--- drivers/tty/serial/stm32-usart.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/tty/serial/stm32-usart.c +1 -4
@@ -1755,13 +1755,10 @@ static int stm32_usart_serial_remove(struct platform_device *pdev)struct uart_port *port =platform_get_drvdata (pdev);struct stm32_port *stm32_port =to_stm32_port (port);const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; -int err;u32 cr3;pm_runtime_get_sync (&pdev->dev); - err =uart_remove_one_port (&stm32_usart_driver, port); -if (err) -return (err); +uart_remove_one_port (&stm32_usart_driver, port);pm_runtime_disable (&pdev->dev);pm_runtime_set_suspended (&pdev->dev);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 47/234 led: qcom-lpg: Fix resource leaks in for_each_available_child_of_node() loops
In reply to Greg Kroah-HartmanFrom: Lu Hongfei <[email protected]>
[ Upstream commit 8f38f8fa7261819eb7d4fb369dc3bfab72259033 ]
Ensure child node references are decremented properly in the error path.
--- drivers/leds/rgb/leds-qcom-lpg.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/leds/rgb/leds-qcom-lpg.c +6 -2
@@ -1173,8 +1173,10 @@ static int lpg_add_led(struct lpg *lpg, struct device_node *np) i =0 ;for_each_available_child_of_node (np, child) { ret =lpg_parse_channel (lpg, child, &led->channels[i]); -if (ret <0 ) +if (ret <0 ) { +of_node_put (child);return ret; + } info[i].color_index = led->channels[i]->color; info[i].intensity =0 ;
@@ -1352,8 +1354,10 @@ static int lpg_probe(struct platform_device *pdev)for_each_available_child_of_node (pdev->dev.of_node, np) { ret =lpg_add_led (lpg, np); -if (ret) +if (ret) { +of_node_put (np);return ret; + } }for (i =0 ; i < lpg->num_channels; i++)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 48/234 media: v4l2-mem2mem: add lock to protect parameter num_rdy
In reply to Greg Kroah-HartmanFrom: Yunfei Dong <[email protected]>
[ Upstream commit 56b5c3e67b0f9af3f45cf393be048ee8d8a92694 ]
Getting below error when using KCSAN to check the driver. Adding lock to protect parameter num_rdy when getting the value with function:
v4l2_m2m_num_src_bufs_ready/v4l2_m2m_num_dst_bufs_ready.
kworker/u16:3: [name:report&]BUG: KCSAN: data-race in v4l2_m2m_buf_queue kworker/u16:3: [name:report&]
kworker/u16:3: [name:report&]read-write to 0xffffff8105f35b94 of 1 bytes by task 20865 on cpu 7:
kworker/u16:3: v4l2_m2m_buf_queue+0xd8/0x10c
--- include/media/v4l2-mem2mem.h | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
include/media/v4l2-mem2mem.h +16 -2
@@ -593,7 +593,14 @@ void v4l2_m2m_buf_queue(struct v4l2_m2m_ctx *m2m_ctx,static inline unsigned int v4l2_m2m_num_src_bufs_ready (struct v4l2_m2m_ctx *m2m_ctx) { -return m2m_ctx->out_q_ctx.num_rdy; +unsigned int num_buf_rdy; +unsigned long flags; + +spin_lock_irqsave (&m2m_ctx->out_q_ctx.rdy_spinlock, flags); + num_buf_rdy = m2m_ctx->out_q_ctx.num_rdy; +spin_unlock_irqrestore (&m2m_ctx->out_q_ctx.rdy_spinlock, flags); + +return num_buf_rdy; }/**
@@ -605,7 +612,14 @@ unsigned int v4l2_m2m_num_src_bufs_ready(struct v4l2_m2m_ctx *m2m_ctx)static inline unsigned int v4l2_m2m_num_dst_bufs_ready (struct v4l2_m2m_ctx *m2m_ctx) { -return m2m_ctx->cap_q_ctx.num_rdy; +unsigned int num_buf_rdy; +unsigned long flags; + +spin_lock_irqsave (&m2m_ctx->cap_q_ctx.rdy_spinlock, flags); + num_buf_rdy = m2m_ctx->cap_q_ctx.num_rdy; +spin_unlock_irqrestore (&m2m_ctx->cap_q_ctx.rdy_spinlock, flags); + +return num_buf_rdy; }/**
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 49/234 media: camss: set VFE bpl_alignment to 16 for sdm845 and sm8250
In reply to Greg Kroah-HartmanFrom: Andrey Konovalov <[email protected]>
[ Upstream commit d5b7eb477c286f6ceccbb38704136eea0e6b09ca ]
Quoted 1 line
From the experiments with camera sensors using SGRBG10_1X10/3280x2464 and
SRGGB10_1X10/3280x2464 formats, it becomes clear that on sdm845 and sm8250 VFE outputs the lines padded to a length multiple of 16 bytes. As in the current driver the value of the bpl_alignment is set to 8 bytes, the frames captured in formats with the bytes-per-line value being not a multiple of 16 get corrupted.
Set the bpl_alignment of the camss video output device to 16 for sdm845 and sm8250 to fix that.
--- drivers/media/platform/qcom/camss/camss-vfe.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/media/platform/qcom/camss/camss-vfe.c +5 -1
@@ -1541,7 +1541,11 @@ int msm_vfe_register_entities(struct vfe_device *vfe, } video_out->ops = &vfe->video_ops; - video_out->bpl_alignment =8 ; +if (vfe->camss->version ==CAMSS_845 || + vfe->camss->version ==CAMSS_8250 ) + video_out->bpl_alignment =16 ; +else + video_out->bpl_alignment =8 ; video_out->line_based =0 ;if (i ==VFE_LINE_PIX ) { video_out->bpl_alignment =16 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 50/234 usb: gadget: u_serial: Avoid spinlock recursion in __gs_console_push
In reply to Greg Kroah-HartmanFrom: Prashanth K <[email protected]>
[ Upstream commit e5990469943c711cb00bfde6338d2add6c6d0bfe ]
When serial console over USB is enabled, gs_console_connect queues gs_console_work, where it acquires the spinlock and queues the usb request, and this request goes to gadget layer. Now consider a situation where gadget layer prints something to dmesg, this will eventually call gs_console_write() which requires cons->lock. And this causes spinlock recursion. Avoid this by excluding usb_ep_queue from the spinlock.
spin_lock_irqsave //needs cons->lock
gs_console_write
. . _printk __warn_printk dev_warn/pr_err . . [USB Gadget Layer] . .
usb_ep_queue
gs_console_work
__gs_console_push // acquires cons->lock
process_one_work
--- drivers/usb/gadget/function/u_serial.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/gadget/function/u_serial.c +3 -0
@@ -916,8 +916,11 @@ static void __gs_console_push(struct gs_console *cons) } req->length = size; + +spin_unlock_irq (&cons->lock);if (usb_ep_queue (ep, req,GFP_ATOMIC )) req->length =0 ; +spin_lock_irq (&cons->lock); }static void gs_console_work (struct work_struct *work)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 51/234 usb: gadget: uvc: queue empty isoc requests if no video buffer is available
In reply to Greg Kroah-HartmanFrom: Avichal Rakesh <[email protected]>
[ Upstream commit c3ff12a92bd7072170978b8b41c2fa41b038139a ]
ISOC transfers expect a certain cadence of requests being queued. Not keeping up with the expected rate of requests results in missed ISOC transfers (EXDEV). The application layer may or may not produce video frames to match this expectation, so uvc gadget driver must handle cases where the application is not queuing up buffers fast enough to fulfill ISOC requirements.
Currently, uvc gadget driver waits for new video buffer to become available before queuing up usb requests. With this patch the gadget driver queues up 0 length usb requests whenever there are no video buffers available. The USB controller's complete callback is used as the limiter for how quickly the 0 length packets will be queued. Video buffers are still queued as soon as they become available.
--- drivers/usb/gadget/function/uvc_video.c | 32 ++++++++++++++++++------- 1 file changed, 24 insertions(+), 8 deletions(-)
drivers/usb/gadget/function/uvc_video.c +24 -8
@@ -386,6 +386,9 @@ static void uvcg_video_pump(struct work_struct *work)struct uvc_buffer *buf;unsigned long flags;int ret; +bool buf_int; +/* video->max_payload_size is only set when using bulk transfer */ +bool is_bulk = video->max_payload_size;while (video->ep->enabled) {/*
@@ -408,20 +411,35 @@ static void uvcg_video_pump(struct work_struct *work)*/ spin_lock_irqsave (&queue->irqlock, flags); buf =uvcg_queue_head (queue); -if (buf ==NULL ) { + +if (buf !=NULL ) { + video->encode (req, video, buf); +/* Always interrupt for the last request of a video buffer */ + buf_int = buf->state ==UVC_BUF_STATE_DONE ; + }else if (!(queue->flags &UVC_QUEUE_DISCONNECTED ) && !is_bulk) { +/* +* No video buffer available; the queue is still connected and +* we're traferring over ISOC. Queue a 0 length request to +* prevent missed ISOC transfers. +*/ + req->length =0 ; + buf_int = false; + }else { +/* +* Either queue has been disconnected or no video buffer +* available to bulk transfer. Either way, stop processing +* further. +*/ spin_unlock_irqrestore (&queue->irqlock, flags);break ; } - video->encode (req, video, buf); -/* * With usb3 we have more requests. This will decrease the * interrupt load to a quarter but also catches the corner * cases, which needs to be handled. */ -if (list_empty (&video->req_free) || - buf->state ==UVC_BUF_STATE_DONE || +if (list_empty (&video->req_free) || buf_int || !(video->req_int_count %DIV_ROUND_UP (video->uvc_num_requests,4 ))) { video->req_int_count =0 ;
@@ -441,8 +459,7 @@ static void uvcg_video_pump(struct work_struct *work)/* Endpoint now owns the request */ req =NULL ; -if (buf->state !=UVC_BUF_STATE_DONE ) - video->req_int_count++; + video->req_int_count++; }if (!req)
@@ -527,4 +544,3 @@ int uvcg_video_init(struct uvc_video *video, struct uvc_device *uvc) V4L2_BUF_TYPE_VIDEO_OUTPUT, &video->mutex);return 0 ; } -
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 52/234 media: platform: mediatek: vpu: fix NULL ptr dereference
In reply to Greg Kroah-HartmanFrom: Hans Verkuil <[email protected]>
[ Upstream commit 3df55cd773e8603b623425cc97b05e542854ad27 ]
If pdev is NULL, then it is still dereferenced.
This fixes this smatch warning:
drivers/media/platform/mediatek/vpu/mtk_vpu.c:570 vpu_load_firmware() warn: address of NULL pointer 'pdev'
--- drivers/media/platform/mediatek/vpu/mtk_vpu.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/media/platform/mediatek/vpu/mtk_vpu.c +4 -2
@@ -562,15 +562,17 @@ static int load_requested_vpu(struct mtk_vpu *vpu,int vpu_load_firmware (struct platform_device *pdev) {struct mtk_vpu *vpu; -struct device *dev = &pdev->dev; +struct device *dev;struct vpu_run *run;int ret;if (!pdev) { -dev_err (dev,"VPU platform device is invalid\n" ); +pr_err ("VPU platform device is invalid\n" );return -EINVAL ; } + dev = &pdev->dev; + vpu =platform_get_drvdata (pdev); run = &vpu->run;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 53/234 thunderbolt: Read retimer NVM authentication status prior tb_retimer_set_inbound_sbtx()
In reply to Greg Kroah-HartmanFrom: Mika Westerberg <[email protected]>
[ Upstream commit 1402ba08abae5cfa583ff1a40b99c098a0532d41 ]
According to the USB4 retimer guide the correct order is immediately after sending ENUMERATE_RETIMERS so update the code to follow this.
--- drivers/thunderbolt/retimer.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-)
drivers/thunderbolt/retimer.c +21 -8
@@ -187,6 +187,21 @@ static ssize_t nvm_authenticate_show(struct device *dev,return ret; } +static void tb_retimer_nvm_authenticate_status (struct tb_port *port,u32 *status) +{ +int i; + +tb_port_dbg (port,"reading NVM authentication status of retimers\n" ); + +/* +* Before doing anything else, read the authentication status. +* If the retimer has it set, store it for the new retimer +* device instance. +*/ +for (i =1 ; i <=TB_MAX_RETIMER_INDEX ; i++) +usb4_port_retimer_nvm_authenticate_status (port, i, &status[i]); +} +static void tb_retimer_set_inbound_sbtx (struct tb_port *port) {int i;
@@ -455,18 +470,16 @@ int tb_retimer_scan(struct tb_port *port, bool add)return ret;/* -* Enable sideband channel for each retimer. We can do this -* regardless whether there is device connected or not. +* Immediately after sending enumerate retimers read the +* authentication status of each retimer. */ -tb_retimer_set_inbound_sbtx (port); +tb_retimer_nvm_authenticate_status (port, status);/* -* Before doing anything else, read the authentication status. -* If the retimer has it set, store it for the new retimer -* device instance. +* Enable sideband channel for each retimer. We can do this +* regardless whether there is device connected or not. */ -for (i =1 ; i <=TB_MAX_RETIMER_INDEX ; i++) -usb4_port_retimer_nvm_authenticate_status (port, i, &status[i]); +tb_retimer_set_inbound_sbtx (port);for (i =1 ; i <=TB_MAX_RETIMER_INDEX ; i++) {/*
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 54/234 xhci: get rid of XHCI_PLAT quirk that used to prevent MSI setup
In reply to Greg Kroah-HartmanFrom: Mathias Nyman <[email protected]>
[ Upstream commit 0a4776205b16d038ec6fedef2094951fcb6f441b ]
The XHCI_PLAT quirk was only needed to ensure non-PCI xHC host avoided setting up MSI interrupts in generic xhci codepaths.
The MSI setup code is now moved to PCI specific xhci-pci.c file so the quirk is no longer needed.
Remove setting the XHCI_PLAT quirk for HiSilocon SoC xHC, NVIDIA Tegra xHC, MediaTek xHC, the generic xhci-plat driver, and the checks for XHCI_PLAT in xhci-pci.c MSI setup code.
Message-ID: <[email protected]>
--- drivers/usb/host/xhci-histb.c | 12 +----------- drivers/usb/host/xhci-mtk.c | 6 ------ drivers/usb/host/xhci-pci.c | 7 ------- drivers/usb/host/xhci-plat.c | 7 +------ drivers/usb/host/xhci-tegra.c | 1 - drivers/usb/host/xhci.h | 2 +- 6 files changed, 3 insertions(+), 32 deletions(-)
drivers/usb/host/xhci-histb.c +1 -11
@@ -164,16 +164,6 @@ static void xhci_histb_host_disable(struct xhci_hcd_histb *histb)clk_disable_unprepare (histb->bus_clk); } -static void xhci_histb_quirks (struct device *dev,struct xhci_hcd *xhci) -{ -/* -* As of now platform drivers don't provide MSI support so we ensure -* here that the generic code does not try to make a pci_dev from our -* dev struct in order to setup MSI -*/ - xhci->quirks |=XHCI_PLAT ; -} -/* called during probe() after chip reset completes */ static int xhci_histb_setup (struct usb_hcd *hcd) {
@@ -186,7 +176,7 @@ static int xhci_histb_setup(struct usb_hcd *hcd)return ret; } -return xhci_gen_setup (hcd, xhci_histb_quirks); +return xhci_gen_setup (hcd,NULL ); }static const struct xhci_driver_overrides xhci_histb_overrides__initconst = {
drivers/usb/host/xhci-mtk.c +0 -6
@@ -418,12 +418,6 @@ static void xhci_mtk_quirks(struct device *dev, struct xhci_hcd *xhci)struct usb_hcd *hcd =xhci_to_hcd (xhci);struct xhci_hcd_mtk *mtk =hcd_to_mtk (hcd); -/* -* As of now platform drivers don't provide MSI support so we ensure -* here that the generic code does not try to make a pci_dev from our -* dev struct in order to setup MSI -*/ - xhci->quirks |=XHCI_PLAT ; xhci->quirks |=XHCI_MTK_HOST ;/* * MTK host controller gives a spurious successful event after a
drivers/usb/host/xhci-pci.c +0 -7
@@ -108,9 +108,6 @@ static void xhci_cleanup_msix(struct xhci_hcd *xhci)struct usb_hcd *hcd =xhci_to_hcd (xhci);struct pci_dev *pdev =to_pci_dev (hcd->self.controller); -if (xhci->quirks &XHCI_PLAT ) -return ; -/* return if using legacy interrupt */ if (hcd->irq >0 )return ;
@@ -208,10 +205,6 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd)struct pci_dev *pdev;int ret; -/* The xhci platform device has set up IRQs through usb_add_hcd. */ -if (xhci->quirks &XHCI_PLAT ) -return 0 ; - pdev =to_pci_dev (xhci_to_hcd (xhci)->self.controller);/* * Some Fresco Logic host controllers advertise MSI, but fail to
drivers/usb/host/xhci-plat.c +1 -6
@@ -78,12 +78,7 @@ static void xhci_plat_quirks(struct device *dev, struct xhci_hcd *xhci) {struct xhci_plat_priv *priv =xhci_to_priv (xhci); -/* -* As of now platform drivers don't provide MSI support so we ensure -* here that the generic code does not try to make a pci_dev from our -* dev struct in order to setup MSI -*/ - xhci->quirks |=XHCI_PLAT | priv->quirks; + xhci->quirks |= priv->quirks; }/* called during probe() after chip reset completes */
drivers/usb/host/xhci-tegra.c +0 -1
@@ -2662,7 +2662,6 @@ static void tegra_xhci_quirks(struct device *dev, struct xhci_hcd *xhci) {struct tegra_xusb *tegra =dev_get_drvdata (dev); - xhci->quirks |=XHCI_PLAT ;if (tegra && tegra->soc->lpm_support) xhci->quirks |=XHCI_LPM_SUPPORT ; }
drivers/usb/host/xhci.h +1 -1
@@ -1874,7 +1874,7 @@ struct xhci_hcd {#define XHCI_SPURIOUS_REBOOT BIT_ULL(13)#define XHCI_COMP_MODE_QUIRK BIT_ULL(14)#define XHCI_AVOID_BEI BIT_ULL(15) -#define XHCI_PLAT BIT_ULL(16) +#define XHCI_PLAT BIT_ULL(16)/* Deprecated */ #define XHCI_SLOW_SUSPEND BIT_ULL(17)#define XHCI_SPURIOUS_WAKEUP BIT_ULL(18)/* For controllers with a broken beyond repair streams implementation */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 55/234 usb: chipidea: imx: dont request QoS for imx8ulp
In reply to Greg Kroah-HartmanFrom: Xu Yang <[email protected]>
[ Upstream commit 9a070e8e208995a9d638b538ed7abf28bd6ea6f0 ]
Use dedicated imx8ulp usb compatible to remove QoS request since imx8ulp has no such limitation of imx7ulp: DMA will not work if system enters idle.
Message-ID: <[email protected]>
--- drivers/usb/chipidea/ci_hdrc_imx.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/chipidea/ci_hdrc_imx.c +5 -0
@@ -70,6 +70,10 @@ static const struct ci_hdrc_imx_platform_flag imx7ulp_usb_data = { CI_HDRC_PMQOS, }; +static const struct ci_hdrc_imx_platform_flag imx8ulp_usb_data = { + .flags =CI_HDRC_SUPPORTS_RUNTIME_PM , +}; +static const struct of_device_id ci_hdrc_imx_dt_ids[] = { { .compatible ="fsl,imx23-usb" , .data = &imx23_usb_data}, { .compatible ="fsl,imx28-usb" , .data = &imx28_usb_data},
@@ -80,6 +84,7 @@ static const struct of_device_id ci_hdrc_imx_dt_ids[] = { { .compatible = "fsl,imx6ul-usb", .data = &imx6ul_usb_data}, { .compatible = "fsl,imx7d-usb", .data = &imx7d_usb_data}, { .compatible = "fsl,imx7ulp-usb", .data = &imx7ulp_usb_data}, + { .compatible = "fsl,imx8ulp-usb", .data = &imx8ulp_usb_data}, {/* sentinel */ } };MODULE_DEVICE_TABLE (of, ci_hdrc_imx_dt_ids);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 56/234 usb: chipidea: imx: turn off vbus comparator when suspend
In reply to Greg Kroah-HartmanFrom: Xu Yang <[email protected]>
[ Upstream commit 0ac37fbdad7087bbcbbe246a602c248ccfd954ea ]
As we use bvalid for vbus wakeup source, to save power when suspend, turn off the vbus comparator for imx7d and imx8mm.
Below is this bit description from RM of iMX8MM
"VBUS Valid Comparator Enable:
This signal controls the USB OTG PHY VBUS Valid comparator which indicates whether the voltage on the USB_OTG*_VBUS pin is below the VBUS Valid threshold. The VBUS Valid threshold is nominally 4.75V on this USB PHY. The VBUS Valid threshold can be adjusted using the USBNC_OTGn_PHY_CFG1[OTGTUNE0] bit field. Status of the VBUS Valid comparator, when it is enabled, is reported on the USBNC_OTGn_PHY_STATUS[VBUS_VLD] bit.
When OTGDISABLE0 (USBNC_USB_OTGx_PHY_CFG2[10])is set to 1'b0 and DRVVBUS0 is set to 1'b1, the Bandgap circuitry and VBUS Valid comparator are powered, even in Suspend or Sleep mode. DRVVBUS0 should be reset to 1'b0 when the internal VBUS Valid comparator is not required, to reduce quiescent current in Suspend or Sleep mode.
- 0 The VBUS Valid comparator is disabled
- 1 The VBUS Valid comparator is enabled"
Message-ID: <[email protected]>
--- drivers/usb/chipidea/usbmisc_imx.c | 35 ++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+)
drivers/usb/chipidea/usbmisc_imx.c +35 -0
@@ -152,6 +152,7 @@ struct usbmisc_ops {int (*charger_detection)(struct imx_usbmisc_data *data);/* It's called when system resume from usb power lost */ int (*power_lost_check)(struct imx_usbmisc_data *data); +void (*vbus_comparator_on)(struct imx_usbmisc_data *data,bool on); };struct imx_usbmisc {
@@ -875,6 +876,33 @@ static int imx7d_charger_detection(struct imx_usbmisc_data *data)return ret; } +static void usbmisc_imx7d_vbus_comparator_on (struct imx_usbmisc_data *data, +bool on) +{ +unsigned long flags; +struct imx_usbmisc *usbmisc =dev_get_drvdata (data->dev); +u32 val; + +if (data->hsic) +return ; + +spin_lock_irqsave (&usbmisc->lock, flags); +/* +* Disable VBUS valid comparator when in suspend mode, +* when OTG is disabled and DRVVBUS0 is asserted case +* the Bandgap circuitry and VBUS Valid comparator are +* still powered, even in Suspend or Sleep mode. +*/ + val =readl (usbmisc->base +MX7D_USB_OTG_PHY_CFG2 ); +if (on) + val |=MX7D_USB_OTG_PHY_CFG2_DRVVBUS0 ; +else + val &= ~MX7D_USB_OTG_PHY_CFG2_DRVVBUS0 ; + +writel (val, usbmisc->base +MX7D_USB_OTG_PHY_CFG2 ); +spin_unlock_irqrestore (&usbmisc->lock, flags); +} +static int usbmisc_imx7ulp_init (struct imx_usbmisc_data *data) {struct imx_usbmisc *usbmisc =dev_get_drvdata (data->dev);
@@ -1018,6 +1046,7 @@ static const struct usbmisc_ops imx7d_usbmisc_ops = { .set_wakeup = usbmisc_imx7d_set_wakeup, .charger_detection = imx7d_charger_detection, .power_lost_check = usbmisc_imx7d_power_lost_check, + .vbus_comparator_on = usbmisc_imx7d_vbus_comparator_on, };static const struct usbmisc_ops imx7ulp_usbmisc_ops = {
@@ -1132,6 +1161,9 @@ int imx_usbmisc_suspend(struct imx_usbmisc_data *data, bool wakeup) usbmisc =dev_get_drvdata (data->dev); +if (usbmisc->ops->vbus_comparator_on) + usbmisc->ops->vbus_comparator_on (data, false); +if (wakeup && usbmisc->ops->set_wakeup) ret = usbmisc->ops->set_wakeup (data, true);if (ret) {
@@ -1185,6 +1217,9 @@ int imx_usbmisc_resume(struct imx_usbmisc_data *data, bool wakeup) goto hsic_set_clk_fail; } +if (usbmisc->ops->vbus_comparator_on) + usbmisc->ops->vbus_comparator_on (data, true); +return 0 ; hsic_set_clk_fail:
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 57/234 usb: chipidea: imx: add missing USB PHY DPDM wakeup setting
In reply to Greg Kroah-HartmanFrom: Xu Yang <[email protected]>
[ Upstream commit 53d061c19dc4cb68409df6dc11c40389c8c42a75 ]
USB PHY DPDM wakeup bit is enabled by default, when USB wakeup is not required(/sys/.../wakeup is disabled), this bit should be disabled, otherwise we will have unexpected wakeup if do USB device connect/disconnect while system sleep.
This bit can be enabled for both host and device mode.
Message-ID: <[email protected]>
--- drivers/usb/chipidea/usbmisc_imx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/chipidea/usbmisc_imx.c +1 -1
@@ -135,7 +135,7 @@#define TXVREFTUNE0_MASK (0xf << 20)#define MX6_USB_OTG_WAKEUP_BITS (MX6_BM_WAKEUP_ENABLE | MX6_BM_VBUS_WAKEUP | \ - MX6_BM_ID_WAKEUP) + MX6_BM_ID_WAKEUP | MX6SX_BM_DPDM_WAKEUP_EN)struct usbmisc_ops {/* It's called once when probe a usb device */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 58/234 gfs2: Fix possible data races in gfs2_show_options()
In reply to Greg Kroah-HartmanFrom: Tuo Li <[email protected]>
[ Upstream commit 6fa0a72cbbe45db4ed967a51f9e6f4e3afe61d20 ]
Some fields such as gt_logd_secs of the struct gfs2_tune are accessed without holding the lock gt_spin in gfs2_show_options():
val = sdp->sd_tune.gt_logd_secs;
if (val != 30)
seq_printf(s, ",commit=%d", val);And thus can cause data races when gfs2_show_options() and other functions such as gfs2_reconfigure() are concurrently executed:
spin_lock(>->gt_spin); gt->gt_logd_secs = newargs->ar_commit;
To fix these possible data races, the lock sdp->sd_tune.gt_spin is acquired before accessing the fields of gfs2_tune and released after these accesses.
Further changes by Andreas:
- Don't hold the spin lock over the seq_printf operations.
--- fs/gfs2/super.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-)
fs/gfs2/super.c +15 -11
@@ -1004,7 +1004,14 @@ static int gfs2_show_options(struct seq_file *s, struct dentry *root) {struct gfs2_sbd *sdp = root->d_sb->s_fs_info;struct gfs2_args *args = &sdp->sd_args; -int val; +unsigned int logd_secs, statfs_slow, statfs_quantum, quota_quantum; + +spin_lock (&sdp->sd_tune.gt_spin); + logd_secs = sdp->sd_tune.gt_logd_secs; + quota_quantum = sdp->sd_tune.gt_quota_quantum; + statfs_quantum = sdp->sd_tune.gt_statfs_quantum; + statfs_slow = sdp->sd_tune.gt_statfs_slow; +spin_unlock (&sdp->sd_tune.gt_spin);if (is_ancestor (root, sdp->sd_master_dir))seq_puts (s,",meta" );
@@ -1059,17 +1066,14 @@ static int gfs2_show_options(struct seq_file *s, struct dentry *root) }if (args->ar_discard)seq_puts (s,",discard" ); - val = sdp->sd_tune.gt_logd_secs; -if (val !=30 ) -seq_printf (s,",commit=%d" , val); - val = sdp->sd_tune.gt_statfs_quantum; -if (val !=30 ) -seq_printf (s,",statfs_quantum=%d" , val); -else if (sdp->sd_tune.gt_statfs_slow) +if (logd_secs !=30 ) +seq_printf (s,",commit=%d" , logd_secs); +if (statfs_quantum !=30 ) +seq_printf (s,",statfs_quantum=%d" , statfs_quantum); +else if (statfs_slow)seq_puts (s,",statfs_quantum=0" ); - val = sdp->sd_tune.gt_quota_quantum; -if (val !=60 ) -seq_printf (s,",quota_quantum=%d" , val); +if (quota_quantum !=60 ) +seq_printf (s,",quota_quantum=%d" , quota_quantum);if (args->ar_statfs_percent)seq_printf (s,",statfs_percent=%d" , args->ar_statfs_percent);if (args->ar_errors !=GFS2_ERRORS_DEFAULT ) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 59/234 pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db()
In reply to Greg Kroah-HartmanFrom: Armin Wolf <[email protected]>
[ Upstream commit c85fd9422fe0f5d667305efb27f56d09eab120b0 ]
When nonstatic_release_resource_db() frees all resources associated with an PCMCIA socket, it forgets to free socket_data too, causing a memory leak observable with kmemleak:
unreferenced object 0xc28d1000 (size 64):
comm "systemd-udevd", pid 297, jiffies 4294898478 (age 194.484s) hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 f0 85 0e c3 00 00 00 00 ................
00 00 00 00 0c 10 8d c2 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffda4245>] __kmem_cache_alloc_node+0x2d7/0x4a0
[<7e51f0c8>] kmalloc_trace+0x31/0xa4
[<d52b4ca0>] nonstatic_init+0x24/0x1a4 [pcmcia_rsrc]
[<a2f13e08>] pcmcia_register_socket+0x200/0x35c [pcmcia_core]
[<a728be1b>] yenta_probe+0x4d8/0xa70 [yenta_socket]
[<c48fac39>] pci_device_probe+0x99/0x194
[<84b7c690>] really_probe+0x181/0x45c
[<8060fe6e>] __driver_probe_device+0x75/0x1f4
[<b9b76f43>] driver_probe_device+0x28/0xac
[<648b766f>] __driver_attach+0xeb/0x1e4
[<6e9659eb>] bus_for_each_dev+0x61/0xb4
[<25a669f3>] driver_attach+0x1e/0x28
[<d8671d6b>] bus_add_driver+0x102/0x20c
[<df0d323c>] driver_register+0x5b/0x120
[<942cd8a4>] __pci_register_driver+0x44/0x4c
[<e536027e>] __UNIQUE_ID___addressable_cleanup_module188+0x1c/0xfffff000 [iTCO_vendor_support]Fix this by freeing socket_data too.
Tested on a Acer Travelmate 4002WLMi by manually binding/unbinding the yenta_cardbus driver (yenta_socket).
Message-ID: <[email protected]>
--- drivers/pcmcia/rsrc_nonstatic.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pcmcia/rsrc_nonstatic.c +2 -0
@@ -1053,6 +1053,8 @@ static void nonstatic_release_resource_db(struct pcmcia_socket *s) q = p->next;kfree (p); } + +kfree (data); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 60/234 thunderbolt: Add Intel Barlow Ridge PCI ID
In reply to Greg Kroah-HartmanFrom: Mika Westerberg <[email protected]>
[ Upstream commit 6f14a210661ce03988ef4ed3c8402037c8e06539 ]
Intel Barlow Ridge is the first USB4 v2 controller from Intel. The controller exposes standard USB4 PCI class ID in typical configurations, however there is a way to configure it so that it uses a special class ID to allow using s different driver than the Windows inbox one. For this reason add the Barlow Ridge PCI ID to the Linux driver too so that the driver can attach regardless of the class ID.
--- drivers/thunderbolt/nhi.c | 2 ++ drivers/thunderbolt/nhi.h | 2 ++ 2 files changed, 4 insertions(+)
drivers/thunderbolt/nhi.c +2 -0
@@ -1480,6 +1480,8 @@ static struct pci_device_id nhi_ids[] = { .driver_data = (kernel_ulong_t)&icl_nhi_ops }, { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_MTL_P_NHI1), .driver_data = (kernel_ulong_t)&icl_nhi_ops }, + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI) }, + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI) },/* Any USB4 compliant host */ { PCI_DEVICE_CLASS(PCI_CLASS_SERIAL_USB_USB4, ~0) },
drivers/thunderbolt/nhi.h +2 -0
@@ -75,6 +75,8 @@ extern const struct tb_nhi_ops icl_nhi_ops;#define PCI_DEVICE_ID_INTEL_TITAN_RIDGE_DD_BRIDGE 0x15ef#define PCI_DEVICE_ID_INTEL_ADL_NHI0 0x463e#define PCI_DEVICE_ID_INTEL_ADL_NHI1 0x466d +#define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI 0x5781 +#define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI 0x5784#define PCI_DEVICE_ID_INTEL_MTL_M_NHI0 0x7eb2#define PCI_DEVICE_ID_INTEL_MTL_P_NHI0 0x7ec2#define PCI_DEVICE_ID_INTEL_MTL_P_NHI1 0x7ec3
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 61/234 thunderbolt: Limit Intel Barlow Ridge USB3 bandwidth
In reply to Greg Kroah-HartmanFrom: Mika Westerberg <[email protected]>
[ Upstream commit f2bfa944080dcbb8eb56259dfd2c07204cbee17e ]
Intel Barlow Ridge discrete USB4 host router has the same limitation as the previous generations so make sure the USB3 bandwidth limitation quirk is applied to Barlow Ridge too.
--- drivers/thunderbolt/nhi.h | 2 ++ drivers/thunderbolt/quirks.c | 8 ++++++++ 2 files changed, 10 insertions(+)
drivers/thunderbolt/nhi.h +2 -0
@@ -77,6 +77,8 @@ extern const struct tb_nhi_ops icl_nhi_ops;#define PCI_DEVICE_ID_INTEL_ADL_NHI1 0x466d#define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI 0x5781#define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI 0x5784 +#define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HUB_80G_BRIDGE 0x5786 +#define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HUB_40G_BRIDGE 0x57a4#define PCI_DEVICE_ID_INTEL_MTL_M_NHI0 0x7eb2#define PCI_DEVICE_ID_INTEL_MTL_P_NHI0 0x7ec2#define PCI_DEVICE_ID_INTEL_MTL_P_NHI1 0x7ec3
drivers/thunderbolt/quirks.c +8 -0
@@ -74,6 +74,14 @@ static const struct tb_quirk tb_quirks[] = { quirk_usb3_maximum_bandwidth }, {0x8087 ,PCI_DEVICE_ID_INTEL_MTL_P_NHI1 ,0x0000 ,0x0000 , quirk_usb3_maximum_bandwidth }, + { 0x8087, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI, 0x0000, 0x0000, + quirk_usb3_maximum_bandwidth }, + { 0x8087, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI, 0x0000, 0x0000, + quirk_usb3_maximum_bandwidth }, + { 0x8087, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HUB_80G_BRIDGE, 0x0000, 0x0000, + quirk_usb3_maximum_bandwidth }, + { 0x8087, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HUB_40G_BRIDGE, 0x0000, 0x0000, + quirk_usb3_maximum_bandwidth },/* * CLx is not supported on AMD USB4 Yellow Carp and Pink Sardine platforms. */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 62/234 firewire: net: fix use after free in fwnet_finish_incoming_packet()
In reply to Greg Kroah-HartmanFrom: Zhang Shurong <[email protected]>
[ Upstream commit 3ff256751a2853e1ffaa36958ff933ccc98c6cb5 ]
The netif_rx() function frees the skb so we can't dereference it to save the skb->len.
--- drivers/firewire/net.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/firewire/net.c +4 -2
@@ -479,7 +479,7 @@ static int fwnet_finish_incoming_packet(struct net_device *net, struct sk_buff *skb, u16 source_node_id, bool is_broadcast, u16 ether_type) { - int status; + int status, len;switch (ether_type) {case ETH_P_ARP :
@@ -533,13 +533,15 @@ static int fwnet_finish_incoming_packet(struct net_device *net, } skb->protocol = protocol; } + + len = skb->len; status =netif_rx (skb);if (status ==NET_RX_DROP ) { net->stats.rx_errors++; net->stats.rx_dropped++; }else { net->stats.rx_packets++; - net->stats.rx_bytes += skb->len; + net->stats.rx_bytes += len; }return 0 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 63/234 watchdog: sp5100_tco: support Hygon FCH/SCH (Server Controller Hub)
In reply to Greg Kroah-HartmanFrom: Yuechao Zhao <[email protected]>
[ Upstream commit 009637de1f65cff452ad49554d1e8ef9fda99e43 ]
Add PCI_VENDOR_ID_HYGON(Hygon vendor id [0x1d94]) in this driver
--- drivers/watchdog/sp5100_tco.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/watchdog/sp5100_tco.c +3 -1
@@ -96,7 +96,7 @@ static enum tco_reg_layout tco_reg_layout(struct pci_dev *dev) sp5100_tco_pci->device == PCI_DEVICE_ID_AMD_KERNCZ_SMBUS && sp5100_tco_pci->revision >= AMD_ZEN_SMBUS_PCI_REV) {return efch_mmio; - } else if (dev->vendor == PCI_VENDOR_ID_AMD && + } else if ((dev->vendor == PCI_VENDOR_ID_AMD || dev->vendor == PCI_VENDOR_ID_HYGON) && ((dev->device == PCI_DEVICE_ID_AMD_HUDSON2_SMBUS && dev->revision >= 0x41) || (dev->device == PCI_DEVICE_ID_AMD_KERNCZ_SMBUS &&
@@ -579,6 +579,8 @@ static const struct pci_device_id sp5100_tco_pci_tbl[] = { PCI_ANY_ID, }, {PCI_VENDOR_ID_AMD ,PCI_DEVICE_ID_AMD_KERNCZ_SMBUS ,PCI_ANY_ID , PCI_ANY_ID, }, + { PCI_VENDOR_ID_HYGON, PCI_DEVICE_ID_AMD_KERNCZ_SMBUS, PCI_ANY_ID, + PCI_ANY_ID, }, { 0, }, /* End of list */ };MODULE_DEVICE_TABLE (pci, sp5100_tco_pci_tbl);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 64/234 Bluetooth: L2CAP: Fix use-after-free
In reply to Greg Kroah-HartmanFrom: Zhengping Jiang <[email protected]>
[ Upstream commit f752a0b334bb95fe9b42ecb511e0864e2768046f ]
Fix potential use-after-free in l2cap_le_command_rej.
--- net/bluetooth/l2cap_core.c | 5 +++++ 1 file changed, 5 insertions(+)
net/bluetooth/l2cap_core.c +5 -0
@@ -6374,9 +6374,14 @@ static inline int l2cap_le_command_rej(struct l2cap_conn *conn,if (!chan) goto done; + chan =l2cap_chan_hold_unless_zero (chan); +if (!chan) + goto done; +l2cap_chan_lock (chan);l2cap_chan_del (chan,ECONNREFUSED );l2cap_chan_unlock (chan); +l2cap_chan_put (chan); done:mutex_unlock (&conn->chan_lock);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 65/234 Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus Ally
In reply to Greg Kroah-HartmanFrom: Matthew Anderson <[email protected]>
[ Upstream commit fa01eba11f0e57c767a5eab5291c7a01407a00be ]
Adding the device ID from the Asus Ally gets the bluetooth working on the device.
--- drivers/bluetooth/btusb.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/bluetooth/btusb.c +3 -0
@@ -613,6 +613,9 @@ static const struct usb_device_id blacklist_table[] = { { USB_DEVICE(0x0489, 0xe0d9), .driver_info = BTUSB_MEDIATEK |BTUSB_WIDEBAND_SPEECH | BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x0489, 0xe0f5), .driver_info = BTUSB_MEDIATEK | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, { USB_DEVICE(0x13d3, 0x3568), .driver_info = BTUSB_MEDIATEK |BTUSB_WIDEBAND_SPEECH | BTUSB_VALID_LE_STATES },
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 66/234 ceph: try to dump the msgs when decoding fails
In reply to Greg Kroah-HartmanFrom: Xiubo Li <[email protected]>
[ Upstream commit 8b0da5c549ae63ba1debd92a350f90773cb4bfe7 ]
When the msgs are corrupted we need to dump them and then it will be easier to dig what has happened and where the issue is.
--- fs/ceph/mds_client.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/ceph/mds_client.c +4 -0
@@ -645,6 +645,7 @@ static int parse_reply_info(struct ceph_mds_session *s, struct ceph_msg *msg, err = -EIO ; out_bad:pr_err ("mds parse_reply err %d\n" , err); +ceph_msg_dump (msg);return err; }
@@ -3538,6 +3539,7 @@ static void handle_forward(struct ceph_mds_client *mdsc, bad:pr_err ("mdsc_handle_forward decode error err=%d\n" , err); +ceph_msg_dump (msg); } static int __decode_session_metadata(void **p, void *end,
@@ -5258,6 +5260,7 @@ void ceph_mdsc_handle_fsmap(struct ceph_mds_client *mdsc, struct ceph_msg *msg) bad:pr_err ("error decoding fsmap %d. Shutting down mount.\n" , err);ceph_umount_begin (mdsc->fsc->sb); +ceph_msg_dump (msg); err_out:mutex_lock (&mdsc->mutex); mdsc->mdsmap_err = err;
@@ -5326,6 +5329,7 @@ void ceph_mdsc_handle_mdsmap(struct ceph_mds_client *mdsc, struct ceph_msg *msg) bad:pr_err ("error decoding mdsmap %d. Shutting down mount.\n" , err);ceph_umount_begin (mdsc->fsc->sb); +ceph_msg_dump (msg);return ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 67/234 drm/amdgpu: Fix potential fence use-after-free v2
In reply to Greg Kroah-HartmanFrom: shanzhulig <[email protected]>
[ Upstream commit 2e54154b9f27262efd0cb4f903cc7d5ad1fe9628 ]
fence Decrements the reference count before exiting. Avoid Race Vulnerabilities for fence use-after-free.
v2 (chk): actually fix the use after free and not just move it.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +3 -3
@@ -1625,15 +1625,15 @@ static int amdgpu_cs_wait_all_fences(struct amdgpu_device *adev,continue ; r =dma_fence_wait_timeout (fence, true, timeout); +if (r >0 && fence->error) + r = fence->error; +dma_fence_put (fence);if (r <0 )return r;if (r ==0 )break ; - -if (fence->error) -return fence->error; }memset (wait,0 ,sizeof (*wait));
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 68/234 fs/ntfs3: Enhance sanity check while generating attr_list
In reply to Greg Kroah-HartmanFrom: Edward Lo <[email protected]>
[ Upstream commit fdec309c7672cbee4dc0229ee4cbb33c948a1bdd ]
ni_create_attr_list uses WARN_ON to catch error cases while generating attribute list, which only prints out stack trace and may not be enough. This repalces them with more proper error handling flow.
[ 59.666332] BUG: kernel NULL pointer dereference, address: 000000000000000e [ 59.673268] #PF: supervisor read access in kernel mode [ 59.678354] #PF: error_code(0x0000) - not-present page [ 59.682831] PGD 8000000005ff1067 P4D 8000000005ff1067 PUD 7dee067 PMD 0 [ 59.688556] Oops: 0000 [#1] PREEMPT SMP KASAN PTI [ 59.692642] CPU: 0 PID: 198 Comm: poc Tainted: G B W 6.2.0-rc1+ #4 [ 59.698868] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 [ 59.708795] RIP: 0010:ni_create_attr_list+0x505/0x860 [ 59.713657] Code: 7e 10 e8 5e d0 d0 ff 45 0f b7 76 10 48 8d 7b 16 e8 00 d1 d0 ff 66 44 89 73 16 4d 8d 75 0e 4c 89 f7 e8 3f d0 d0 ff 4c 8d8 [ 59.731559] RSP: 0018:ffff88800a56f1e0 EFLAGS: 00010282 [ 59.735691] RAX: 0000000000000001 RBX: ffff88800b7b5088 RCX: ffffffffb83079fe [ 59.741792] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffffbb7f9fc0 [ 59.748423] RBP: ffff88800a56f3a8 R08: ffff88800b7b50a0 R09: fffffbfff76ff3f9 [ 59.754654] R10: ffffffffbb7f9fc7 R11: fffffbfff76ff3f8 R12: ffff88800b756180 [ 59.761552] R13: 0000000000000000 R14: 000000000000000e R15: 0000000000000050 [ 59.768323] FS: 00007feaa8c96440(0000) GS:ffff88806d400000(0000) knlGS:0000000000000000 [ 59.776027] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 59.781395] CR2: 00007f3a2e0b1000 CR3: 000000000a5bc000 CR4: 00000000000006f0 [ 59.787607] Call Trace: [ 59.790271] <TASK> [ 59.792488] ? __pfx_ni_create_attr_list+0x10/0x10 [ 59.797235] ? kernel_text_address+0xd3/0xe0 [ 59.800856] ? unwind_get_return_address+0x3e/0x60 [ 59.805101] ? __kasan_check_write+0x18/0x20 [ 59.809296] ? preempt_count_sub+0x1c/0xd0 [ 59.813421] ni_ins_attr_ext+0x52c/0x5c0 [ 59.817034] ? __pfx_ni_ins_attr_ext+0x10/0x10 [ 59.821926] ? __vfs_setxattr+0x121/0x170 [ 59.825718] ? __vfs_setxattr_noperm+0x97/0x300 [ 59.829562] ? __vfs_setxattr_locked+0x145/0x170 [ 59.833987] ? vfs_setxattr+0x137/0x2a0 [ 59.836732] ? do_setxattr+0xce/0x150 [ 59.839807] ? setxattr+0x126/0x140 [ 59.842353] ? path_setxattr+0x164/0x180 [ 59.845275] ? __x64_sys_setxattr+0x71/0x90 [ 59.848838] ? do_syscall_64+0x3f/0x90 [ 59.851898] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 59.857046] ? stack_depot_save+0x17/0x20 [ 59.860299] ni_insert_attr+0x1ba/0x420 [ 59.863104] ? __pfx_ni_insert_attr+0x10/0x10 [ 59.867069] ? preempt_count_sub+0x1c/0xd0 [ 59.869897] ? _raw_spin_unlock_irqrestore+0x2b/0x50 [ 59.874088] ? __create_object+0x3ae/0x5d0 [ 59.877865] ni_insert_resident+0xc4/0x1c0 [ 59.881430] ? __pfx_ni_insert_resident+0x10/0x10 [ 59.886355] ? kasan_save_alloc_info+0x1f/0x30 [ 59.891117] ? __kasan_kmalloc+0x8b/0xa0 [ 59.894383] ntfs_set_ea+0x90d/0xbf0 [ 59.897703] ? __pfx_ntfs_set_ea+0x10/0x10 [ 59.901011] ? kernel_text_address+0xd3/0xe0 [ 59.905308] ? __kernel_text_address+0x16/0x50 [ 59.909811] ? unwind_get_return_address+0x3e/0x60 [ 59.914898] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 59.920250] ? arch_stack_walk+0xa2/0x100 [ 59.924560] ? filter_irq_stacks+0x27/0x80 [ 59.928722] ntfs_setxattr+0x405/0x440 [ 59.932512] ? __pfx_ntfs_setxattr+0x10/0x10 [ 59.936634] ? kvmalloc_node+0x2d/0x120 [ 59.940378] ? kasan_save_stack+0x41/0x60 [ 59.943870] ? kasan_save_stack+0x2a/0x60 [ 59.947719] ? kasan_set_track+0x29/0x40 [ 59.951417] ? kasan_save_alloc_info+0x1f/0x30 [ 59.955733] ? __kasan_kmalloc+0x8b/0xa0 [ 59.959598] ? __kmalloc_node+0x68/0x150 [ 59.963163] ? kvmalloc_node+0x2d/0x120 [ 59.966490] ? vmemdup_user+0x2b/0xa0 [ 59.969060] __vfs_setxattr+0x121/0x170 [ 59.972456] ? __pfx___vfs_setxattr+0x10/0x10 [ 59.976008] __vfs_setxattr_noperm+0x97/0x300 [ 59.981562] __vfs_setxattr_locked+0x145/0x170 [ 59.986100] vfs_setxattr+0x137/0x2a0 [ 59.989964] ? __pfx_vfs_setxattr+0x10/0x10 [ 59.993616] ? __kasan_check_write+0x18/0x20 [ 59.997425] do_setxattr+0xce/0x150 [ 60.000304] setxattr+0x126/0x140 [ 60.002967] ? __pfx_setxattr+0x10/0x10 [ 60.006471] ? __virt_addr_valid+0xcb/0x140 [ 60.010461] ? __call_rcu_common.constprop.0+0x1c7/0x330 [ 60.016037] ? debug_smp_processor_id+0x1b/0x30 [ 60.021008] ? kasan_quarantine_put+0x5b/0x190 [ 60.025545] ? putname+0x84/0xa0 [ 60.027910] ? __kasan_slab_free+0x11e/0x1b0 [ 60.031483] ? putname+0x84/0xa0 [ 60.033986] ? preempt_count_sub+0x1c/0xd0 [ 60.036876] ? __mnt_want_write+0xae/0x100 [ 60.040738] ? mnt_want_write+0x8f/0x150 [ 60.044317] path_setxattr+0x164/0x180 [ 60.048096] ? __pfx_path_setxattr+0x10/0x10 [ 60.052096] ? strncpy_from_user+0x175/0x1c0 [ 60.056482] ? debug_smp_processor_id+0x1b/0x30 [ 60.059848] ? fpregs_assert_state_consistent+0x6b/0x80 [ 60.064557] __x64_sys_setxattr+0x71/0x90 [ 60.068892] do_syscall_64+0x3f/0x90 [ 60.072868] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 60.077523] RIP: 0033:0x7feaa86e4469 [ 60.080915] Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 088 [ 60.097353] RSP: 002b:00007ffdbd8311e8 EFLAGS: 00000286 ORIG_RAX: 00000000000000bc [ 60.103386] RAX: ffffffffffffffda RBX: 9461c5e290baac00 RCX: 00007feaa86e4469 [ 60.110322] RDX: 00007ffdbd831fe0 RSI: 00007ffdbd831305 RDI: 00007ffdbd831263 [ 60.116808] RBP: 00007ffdbd836180 R08: 0000000000000001 R09: 00007ffdbd836268 [ 60.123879] R10: 000000000000007d R11: 0000000000000286 R12: 0000000000400500 [ 60.130540] R13: 00007ffdbd836260 R14: 0000000000000000 R15: 0000000000000000 [ 60.136553] </TASK> [ 60.138818] Modules linked in: [ 60.141839] CR2: 000000000000000e [ 60.144831] ---[ end trace 0000000000000000 ]--- [ 60.149058] RIP: 0010:ni_create_attr_list+0x505/0x860 [ 60.153975] Code: 7e 10 e8 5e d0 d0 ff 45 0f b7 76 10 48 8d 7b 16 e8 00 d1 d0 ff 66 44 89 73 16 4d 8d 75 0e 4c 89 f7 e8 3f d0 d0 ff 4c 8d8 [ 60.172443] RSP: 0018:ffff88800a56f1e0 EFLAGS: 00010282 [ 60.176246] RAX: 0000000000000001 RBX: ffff88800b7b5088 RCX: ffffffffb83079fe [ 60.182752] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffffbb7f9fc0 [ 60.189949] RBP: ffff88800a56f3a8 R08: ffff88800b7b50a0 R09: fffffbfff76ff3f9 [ 60.196950] R10: ffffffffbb7f9fc7 R11: fffffbfff76ff3f8 R12: ffff88800b756180 [ 60.203671] R13: 0000000000000000 R14: 000000000000000e R15: 0000000000000050 [ 60.209595] FS: 00007feaa8c96440(0000) GS:ffff88806d400000(0000) knlGS:0000000000000000 [ 60.216299] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 60.222276] CR2: 00007f3a2e0b1000 CR3: 000000000a5bc000 CR4: 00000000000006f0
--- fs/ntfs3/frecord.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
fs/ntfs3/frecord.c +11 -5
@@ -874,6 +874,7 @@ int ni_create_attr_list(struct ntfs_inode *ni)if (err) goto out1; + err = -EINVAL ;/* Call mi_remove_attr() in reverse order to keep pointers 'arr_move' valid. */ while (to_free >0 ) {struct ATTRIB *b = arr_move[--nb];
@@ -882,7 +883,8 @@ int ni_create_attr_list(struct ntfs_inode *ni) attr =mi_insert_attr (mi, b->type,Add2Ptr (b, name_off), b->name_len, asize, name_off); -WARN_ON (!attr); +if (!attr) + goto out1;mi_get_ref (mi, &le_b[nb]->ref); le_b[nb]->id = attr->id;
@@ -892,17 +894,20 @@ int ni_create_attr_list(struct ntfs_inode *ni) attr->id = le_b[nb]->id;/* Remove from primary record. */ -WARN_ON (!mi_remove_attr (NULL , &ni->mi, b)); +if (!mi_remove_attr (NULL , &ni->mi, b)) + goto out1;if (to_free <= asize)break ; to_free -= asize; -WARN_ON (!nb); +if (!nb) + goto out1; } attr =mi_insert_attr (&ni->mi,ATTR_LIST ,NULL ,0 , lsize +SIZEOF_RESIDENT ,SIZEOF_RESIDENT ); -WARN_ON (!attr); +if (!attr) + goto out1; attr->non_res =0 ; attr->flags =0 ;
@@ -922,9 +927,10 @@ int ni_create_attr_list(struct ntfs_inode *ni)kfree (ni->attr_list.le); ni->attr_list.le =NULL ; ni->attr_list.size =0 ; +return err; out: -return err; +return 0 ; }/*
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 69/234 fs/ntfs3: Return error for inconsistent extended attributes
In reply to Greg Kroah-HartmanFrom: Edward Lo <[email protected]>
[ Upstream commit c9db0ff04649aa0b45f497183c957fe260f229f6 ]
ntfs_read_ea is called when we want to read extended attributes. There are some sanity checks for the validity of the EAs. However, it fails to return a proper error code for the inconsistent attributes, which might lead to unpredicted memory accesses after return.
[ 138.916927] BUG: KASAN: use-after-free in ntfs_set_ea+0x453/0xbf0 [ 138.923876] Write of size 4 at addr ffff88800205cfac by task poc/199 [ 138.931132] [ 138.933016] CPU: 0 PID: 199 Comm: poc Not tainted 6.2.0-rc1+ #4 [ 138.938070] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 [ 138.947327] Call Trace: [ 138.949557] <TASK> [ 138.951539] dump_stack_lvl+0x4d/0x67 [ 138.956834] print_report+0x16f/0x4a6 [ 138.960798] ? ntfs_set_ea+0x453/0xbf0 [ 138.964437] ? kasan_complete_mode_report_info+0x7d/0x200 [ 138.969793] ? ntfs_set_ea+0x453/0xbf0 [ 138.973523] kasan_report+0xb8/0x140 [ 138.976740] ? ntfs_set_ea+0x453/0xbf0 [ 138.980578] __asan_store4+0x76/0xa0 [ 138.984669] ntfs_set_ea+0x453/0xbf0 [ 138.988115] ? __pfx_ntfs_set_ea+0x10/0x10 [ 138.993390] ? kernel_text_address+0xd3/0xe0 [ 138.998270] ? __kernel_text_address+0x16/0x50 [ 139.002121] ? unwind_get_return_address+0x3e/0x60 [ 139.005659] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 139.010177] ? arch_stack_walk+0xa2/0x100 [ 139.013657] ? filter_irq_stacks+0x27/0x80 [ 139.017018] ntfs_setxattr+0x405/0x440 [ 139.022151] ? __pfx_ntfs_setxattr+0x10/0x10 [ 139.026569] ? kvmalloc_node+0x2d/0x120 [ 139.030329] ? kasan_save_stack+0x41/0x60 [ 139.033883] ? kasan_save_stack+0x2a/0x60 [ 139.037338] ? kasan_set_track+0x29/0x40 [ 139.040163] ? kasan_save_alloc_info+0x1f/0x30 [ 139.043588] ? __kasan_kmalloc+0x8b/0xa0 [ 139.047255] ? __kmalloc_node+0x68/0x150 [ 139.051264] ? kvmalloc_node+0x2d/0x120 [ 139.055301] ? vmemdup_user+0x2b/0xa0 [ 139.058584] __vfs_setxattr+0x121/0x170 [ 139.062617] ? __pfx___vfs_setxattr+0x10/0x10 [ 139.066282] __vfs_setxattr_noperm+0x97/0x300 [ 139.070061] __vfs_setxattr_locked+0x145/0x170 [ 139.073580] vfs_setxattr+0x137/0x2a0 [ 139.076641] ? __pfx_vfs_setxattr+0x10/0x10 [ 139.080223] ? __kasan_check_write+0x18/0x20 [ 139.084234] do_setxattr+0xce/0x150 [ 139.087768] setxattr+0x126/0x140 [ 139.091250] ? __pfx_setxattr+0x10/0x10 [ 139.094948] ? __virt_addr_valid+0xcb/0x140 [ 139.097838] ? __call_rcu_common.constprop.0+0x1c7/0x330 [ 139.102688] ? debug_smp_processor_id+0x1b/0x30 [ 139.105985] ? kasan_quarantine_put+0x5b/0x190 [ 139.109980] ? putname+0x84/0xa0 [ 139.113886] ? __kasan_slab_free+0x11e/0x1b0 [ 139.117961] ? putname+0x84/0xa0 [ 139.121316] ? preempt_count_sub+0x1c/0xd0 [ 139.124427] ? __mnt_want_write+0xae/0x100 [ 139.127836] ? mnt_want_write+0x8f/0x150 [ 139.130954] path_setxattr+0x164/0x180 [ 139.133998] ? __pfx_path_setxattr+0x10/0x10 [ 139.137853] ? __pfx_ksys_pwrite64+0x10/0x10 [ 139.141299] ? debug_smp_processor_id+0x1b/0x30 [ 139.145714] ? fpregs_assert_state_consistent+0x6b/0x80 [ 139.150796] __x64_sys_setxattr+0x71/0x90 [ 139.155407] do_syscall_64+0x3f/0x90 [ 139.159035] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 139.163843] RIP: 0033:0x7f108cae4469 [ 139.166481] Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 088 [ 139.183764] RSP: 002b:00007fff87588388 EFLAGS: 00000286 ORIG_RAX: 00000000000000bc [ 139.190657] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f108cae4469 [ 139.196586] RDX: 00007fff875883b0 RSI: 00007fff875883d1 RDI: 00007fff875883b6 [ 139.201716] RBP: 00007fff8758c530 R08: 0000000000000001 R09: 00007fff8758c618 [ 139.207940] R10: 0000000000000006 R11: 0000000000000286 R12: 00000000004004c0 [ 139.214007] R13: 00007fff8758c610 R14: 0000000000000000 R15: 0000000000000000
--- fs/ntfs3/xattr.c | 1 + 1 file changed, 1 insertion(+)
fs/ntfs3/xattr.c +1 -0
@@ -141,6 +141,7 @@ static int ntfs_read_ea(struct ntfs_inode *ni, struct EA_FULL **ea,memset (Add2Ptr (ea_p, size),0 , add_bytes); + err = -EINVAL ;/* Check all attributes for consistency. */ for (off =0 ; off < size; off += ea_size) {const struct EA_FULL *ef =Add2Ptr (ea_p, off);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 70/234 fs: ntfs3: Fix possible null-pointer dereferences in mi_read()
In reply to Greg Kroah-HartmanFrom: Jia-Ju Bai <[email protected]>
[ Upstream commit 97498cd610c0d030a7bd49a7efad974790661162 ]
In a previous commit 2681631c2973 ("fs/ntfs3: Add null pointer check to attr_load_runs_vcn"), ni can be NULL in attr_load_runs_vcn(), and thus it should be checked before being used.
However, in the call stack of this commit, mft_ni in mi_read() is aliased with ni in attr_load_runs_vcn(), and it is also used in mi_read() at two places:
mi_read()
rw_lock = &mft_ni->file.run_lock -> No check attr_load_runs_vcn(mft_ni, ...)
ni (namely mft_ni) is checked in the previous commit
attr_load_runs_vcn(..., &mft_ni->file.run) -> No check
Thus, to avoid possible null-pointer dereferences, the related checks should be added.
These bugs are reported by a static analysis tool implemented by myself, and they are found by extending a known bug fixed in the previous commit. Thus, they could be theoretical bugs.
--- fs/ntfs3/record.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/ntfs3/record.c +2 -2
@@ -124,7 +124,7 @@ int mi_read(struct mft_inode *mi, bool is_mft)struct rw_semaphore *rw_lock =NULL ;if (is_mounted (sbi)) { -if (!is_mft) { +if (!is_mft && mft_ni) { rw_lock = &mft_ni->file.run_lock;down_read (rw_lock); }
@@ -148,7 +148,7 @@ int mi_read(struct mft_inode *mi, bool is_mft)ni_lock (mft_ni);down_write (rw_lock); } - err =attr_load_runs_vcn (mft_ni,ATTR_DATA ,NULL ,0 , &mft_ni->file.run, + err =attr_load_runs_vcn (mft_ni,ATTR_DATA ,NULL ,0 , run, vbo >> sbi->cluster_bits);if (rw_lock) {up_write (rw_lock);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 71/234 fs/ntfs3: Mark ntfs dirty when on-disk struct is corrupted
In reply to Greg Kroah-HartmanFrom: Konstantin Komarov <[email protected]>
[ Upstream commit e0f363a98830e8d7d70fbaf91c07ae0b7c57aafe ]
--- fs/ntfs3/fsntfs.c | 2 +- fs/ntfs3/index.c | 6 ++++++ fs/ntfs3/ntfs_fs.h | 2 ++ fs/ntfs3/record.c | 6 ++++++ 4 files changed, 15 insertions(+), 1 deletion(-)
fs/ntfs3/fsntfs.c +1 -1
@@ -178,7 +178,7 @@ int ntfs_fix_post_read(struct NTFS_RECORD_HEADER *rhdr, size_t bytes,/* Check errors. */ if ((fo &1 ) || fo + fn *sizeof (short ) >SECTOR_SIZE || !fn-- || fn *SECTOR_SIZE > bytes) { -return -EINVAL ;/* Native chkntfs returns ok! */ +return -E_NTFS_CORRUPT ; }/* Get fixup pointer. */
fs/ntfs3/index.c +6 -0
@@ -1113,6 +1113,12 @@ int indx_read(struct ntfs_index *indx, struct ntfs_inode *ni, CLST vbn, *node = in; out: +if (err == -E_NTFS_CORRUPT ) { +ntfs_inode_err (&ni->vfs_inode,"directory corrupted" ); +ntfs_set_state (ni->mi.sbi,NTFS_DIRTY_ERROR ); + err = -EINVAL ; + } +if (ib != in->index)kfree (ib);
fs/ntfs3/ntfs_fs.h +2 -0
@@ -53,6 +53,8 @@ enum utf16_endian;#define E_NTFS_NONRESIDENT 556/* NTFS specific error code about punch hole. */ #define E_NTFS_NOTALIGNED 557 +/* NTFS specific error code when on-disk struct is corrupted. */ +#define E_NTFS_CORRUPT 558/* sbi->flags */
fs/ntfs3/record.c +6 -0
@@ -180,6 +180,12 @@ int mi_read(struct mft_inode *mi, bool is_mft)return 0 ; out: +if (err == -E_NTFS_CORRUPT ) { +ntfs_err (sbi->sb,"mft corrupted" ); +ntfs_set_state (sbi,NTFS_DIRTY_ERROR ); + err = -EINVAL ; + } +return err; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 72/234 fs/ntfs3: Alternative boot if primary boot is corrupted
In reply to Greg Kroah-HartmanFrom: Konstantin Komarov <[email protected]>
[ Upstream commit 6a4cd3ea7d771be17177d95ff67d22cfa2a38b50 ]
Some code refactoring added also.
--- fs/ntfs3/super.c | 98 +++++++++++++++++++++++++++++++++++------------- 1 file changed, 71 insertions(+), 27 deletions(-)
fs/ntfs3/super.c +71 -27
@@ -724,6 +724,8 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,struct MFT_REC *rec;u16 fn, ao;u8 cluster_bits; +u32 boot_off =0 ; +const char *hint ="Primary boot" ; sbi->volume.blocks = dev_size >>PAGE_SHIFT ;
@@ -731,11 +733,12 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,if (!bh)return -EIO ; +check_boot: err = -EINVAL ; - boot = (struct NTFS_BOOT *)bh->b_data; + boot = (struct NTFS_BOOT *)Add2Ptr (bh->b_data, boot_off);if (memcmp (boot->system_id,"NTFS " ,sizeof ("NTFS " ) -1 )) { -ntfs_err (sb,"Boot's signature is not NTFS." ); +ntfs_err (sb,"%s signature is not NTFS." , hint); goto out; }
@@ -748,14 +751,16 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, boot->bytes_per_sector[0 ];if (boot_sector_size <SECTOR_SIZE || !is_power_of_2 (boot_sector_size)) { -ntfs_err (sb,"Invalid bytes per sector %u." , boot_sector_size); +ntfs_err (sb,"%s: invalid bytes per sector %u." , hint, + boot_sector_size); goto out; }/* cluster size: 512, 1K, 2K, 4K, ... 2M */ sct_per_clst =true_sectors_per_clst (boot);if ((int )sct_per_clst <0 || !is_power_of_2 (sct_per_clst)) { -ntfs_err (sb,"Invalid sectors per cluster %u." , sct_per_clst); +ntfs_err (sb,"%s: invalid sectors per cluster %u." , hint, + sct_per_clst); goto out; }
@@ -771,8 +776,8 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,if (mlcn * sct_per_clst >= sectors || mlcn2 * sct_per_clst >= sectors) {ntfs_err ( sb, -"Start of MFT 0x%llx (0x%llx) is out of volume 0x%llx." , - mlcn, mlcn2, sectors); +"%s: start of MFT 0x%llx (0x%llx) is out of volume 0x%llx." , + hint, mlcn, mlcn2, sectors); goto out; }
@@ -784,7 +789,7 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,/* Check MFT record size. */ if (record_size <SECTOR_SIZE || !is_power_of_2 (record_size)) { -ntfs_err (sb,"Invalid bytes per MFT record %u (%d)." , +ntfs_err (sb,"%s: invalid bytes per MFT record %u (%d)." , hint, record_size, boot->record_size); goto out; }
@@ -801,13 +806,13 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,/* Check index record size. */ if (sbi->index_size <SECTOR_SIZE || !is_power_of_2 (sbi->index_size)) { -ntfs_err (sb,"Invalid bytes per index %u(%d)." , sbi->index_size, - boot->index_size); +ntfs_err (sb,"%s: invalid bytes per index %u(%d)." , hint, + sbi->index_size, boot->index_size); goto out; }if (sbi->index_size >MAXIMUM_BYTES_PER_INDEX ) { -ntfs_err (sb,"Unsupported bytes per index %u." , +ntfs_err (sb,"%s: unsupported bytes per index %u." , hint, sbi->index_size); goto out; }
@@ -834,7 +839,7 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size,/* Compare boot's cluster and sector. */ if (sbi->cluster_size < boot_sector_size) { -ntfs_err (sb,"Invalid bytes per cluster (%u)." , +ntfs_err (sb,"%s: invalid bytes per cluster (%u)." , hint, sbi->cluster_size); goto out; }
@@ -930,7 +935,46 @@ static int ntfs_init_from_boot(struct super_block *sb, u32 sector_size, err =0 ; +if (bh->b_blocknr && !sb_rdonly (sb)) { +/* +* Alternative boot is ok but primary is not ok. +* Update primary boot. +*/ +struct buffer_head *bh0 =sb_getblk (sb,0 ); +if (bh0) { +if (buffer_locked (bh0)) +__wait_on_buffer (bh0); + +lock_buffer (bh0); +memcpy (bh0->b_data, boot,sizeof (*boot)); +set_buffer_uptodate (bh0); +mark_buffer_dirty (bh0); +unlock_buffer (bh0); +if (!sync_dirty_buffer (bh0)) +ntfs_warn (sb,"primary boot is updated" ); +put_bh (bh0); + } + } + out: +if (err == -EINVAL && !bh->b_blocknr && dev_size >PAGE_SHIFT ) { +u32 block_size =min_t (u32, sector_size,PAGE_SIZE ); +u64 lbo = dev_size -sizeof (*boot); + +/* +* Try alternative boot (last sector) +*/ +brelse (bh); + +sb_set_blocksize (sb, block_size); + bh =ntfs_bread (sb, lbo >>blksize_bits (block_size)); +if (!bh) +return -EINVAL ; + + boot_off = lbo & (block_size -1 ); + hint ="Alternative boot" ; + goto check_boot; + }brelse (bh);return err;
@@ -955,6 +999,7 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc)struct ATTR_DEF_ENTRY *t;u16 *shared;struct MFT_REF ref; +bool ro =sb_rdonly (sb); ref.high =0 ;
@@ -1035,6 +1080,10 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc) sbi->volume.minor_ver = info->minor_ver; sbi->volume.flags = info->flags; sbi->volume.ni = ni; +if (info->flags &VOLUME_FLAG_DIRTY ) { + sbi->volume.real_dirty = true; +ntfs_info (sb,"It is recommened to use chkdsk." ); + }/* Load $MFTMirr to estimate recs_mirr. */ ref.low =cpu_to_le32 (MFT_REC_MIRR );
@@ -1069,21 +1118,16 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc)iput (inode); -if (sbi->flags &NTFS_FLAGS_NEED_REPLAY ) { -if (!sb_rdonly (sb)) { -ntfs_warn (sb, -"failed to replay log file. Can't mount rw!" ); - err = -EINVAL ; - goto out; - } - }else if (sbi->volume.flags &VOLUME_FLAG_DIRTY ) { -if (!sb_rdonly (sb) && !options->force) { -ntfs_warn ( - sb, -"volume is dirty and \"force\" flag is not set!" ); - err = -EINVAL ; - goto out; - } +if ((sbi->flags &NTFS_FLAGS_NEED_REPLAY ) && !ro) { +ntfs_warn (sb,"failed to replay log file. Can't mount rw!" ); + err = -EINVAL ; + goto out; + } + +if ((sbi->volume.flags &VOLUME_FLAG_DIRTY ) && !ro && !options->force) { +ntfs_warn (sb,"volume is dirty and \"force\" flag is not set!" ); + err = -EINVAL ; + goto out; }/* Load $MFT. */
@@ -1173,7 +1217,7 @@ static int ntfs_fill_super(struct super_block *sb, struct fs_context *fc) bad_len += len; bad_frags +=1 ; -if (sb_rdonly (sb)) +if (ro)continue ;if (wnd_set_used_safe (&sbi->used.bitmap, lcn, len, &tt) || tt) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 73/234 ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760
In reply to Greg Kroah-HartmanFrom: dengxiang <[email protected]>
[ Upstream commit 73f1c75d5e6bd8ce2a887ef493a66ad1b16ed704 ]
These models use NSIWAY amplifiers for internal speaker, but cannot put sound outside from these amplifiers. So eapd verbs are needed to initialize the amplifiers. They can be added during boot to get working sound out of internal speaker.
--- sound/pci/hda/patch_realtek.c | 9 +++++++++ 1 file changed, 9 insertions(+)
sound/pci/hda/patch_realtek.c +9 -0
@@ -11316,6 +11316,7 @@ enum {ALC897_FIXUP_HP_HSMIC_VERB ,ALC897_FIXUP_LENOVO_HEADSET_MODE ,ALC897_FIXUP_HEADSET_MIC_PIN2 , + ALC897_FIXUP_UNIS_H3C_X500S, }; static const struct hda_fixup alc662_fixups[] = {
@@ -11755,6 +11756,13 @@ static const struct hda_fixup alc662_fixups[] = { .chained = true, .chain_id =ALC897_FIXUP_LENOVO_HEADSET_MODE }, + [ALC897_FIXUP_UNIS_H3C_X500S] = { + .type = HDA_FIXUP_VERBS, + .v.verbs = (const struct hda_verb []) { + {0x14 ,AC_VERB_SET_EAPD_BTLENABLE ,0 }, + {} + }, + }, };static const struct snd_pci_quirk alc662_fixup_tbl[] = {
@@ -11916,6 +11924,7 @@ static const struct hda_model_fixup alc662_fixup_models[] = { {.id = ALC662_FIXUP_USI_HEADSET_MODE, .name = "usi-headset"}, {.id = ALC662_FIXUP_LENOVO_MULTI_CODECS, .name = "dual-codecs"}, {.id = ALC669_FIXUP_ACER_ASPIRE_ETHOS, .name = "aspire-ethos"}, + {.id = ALC897_FIXUP_UNIS_H3C_X500S, .name = "unis-h3c-x500s"}, {} };
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 74/234 ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
In reply to Greg Kroah-HartmanFrom: Tuo Li <[email protected]>
[ Upstream commit 1f4a08fed450db87fbb5ff5105354158bdbe1a22 ]
The variable codec->regmap is often protected by the lock codec->regmap_lock when is accessed. However, it is accessed without holding the lock when is accessed in snd_hdac_regmap_sync():
if (codec->regmap)
In my opinion, this may be a harmful race, because if codec->regmap is set to NULL right after the condition is checked, a null-pointer dereference can occur in the called function regcache_sync():
map->lock(map->lock_arg); --> Line 360 in drivers/base/regmap/regcache.c
To fix this possible null-pointer dereference caused by data race, the mutex_lock coverage is extended to protect the if statement as well as the function call to regcache_sync().
[ Note: the lack of the regmap_lock itself is harmless for the current
codec driver implementations, as snd_hdac_regmap_sync() is only for PM runtime resume that is prohibited during the codec probe. But the change makes the whole code more consistent, so it's merged as is -- tiwai ]
--- sound/hda/hdac_regmap.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
sound/hda/hdac_regmap.c +3 -4
@@ -597,10 +597,9 @@ EXPORT_SYMBOL_GPL(snd_hdac_regmap_update_raw_once);*/ void snd_hdac_regmap_sync (struct hdac_device *codec) { -if (codec->regmap) { -mutex_lock (&codec->regmap_lock); +mutex_lock (&codec->regmap_lock); +if (codec->regmap)regcache_sync (codec->regmap); -mutex_unlock (&codec->regmap_lock); - } +mutex_unlock (&codec->regmap_lock); }EXPORT_SYMBOL_GPL (snd_hdac_regmap_sync);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 75/234 ALSA: hda/realtek: Add quirk for ASUS ROG GX650P
In reply to Greg Kroah-HartmanFrom: Luke D. Jones <[email protected]>
[ Upstream commit 8cc87c055d28320e5fa5457922f43bc07dec58bd ]
Adds the required quirk to enable the Cirrus amp and correct pins on the ASUS ROG GV601V series which uses an I2C connected Cirrus amp.
While this works if the related _DSD properties are made available, these aren't included in the ACPI of these laptops (yet).
--- sound/pci/hda/patch_realtek.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
sound/pci/hda/patch_realtek.c +19 -0
@@ -7081,6 +7081,8 @@ enum {ALC285_FIXUP_SPEAKER2_TO_DAC1 ,ALC285_FIXUP_ASUS_SPEAKER2_TO_DAC1 ,ALC285_FIXUP_ASUS_HEADSET_MIC , +ALC285_FIXUP_ASUS_I2C_SPEAKER2_TO_DAC1 , +ALC285_FIXUP_ASUS_I2C_HEADSET_MIC ,ALC280_FIXUP_HP_HEADSET_MIC ,ALC221_FIXUP_HP_FRONT_MIC , ALC292_FIXUP_TPT460,
@@ -8073,6 +8075,22 @@ static const struct hda_fixup alc269_fixups[] = { .chained = true, .chain_id =ALC285_FIXUP_ASUS_SPEAKER2_TO_DAC1 }, + [ALC285_FIXUP_ASUS_I2C_SPEAKER2_TO_DAC1] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc285_fixup_speaker2_to_dac1, + .chained = true, + .chain_id =ALC287_FIXUP_CS35L41_I2C_2 + }, + [ALC285_FIXUP_ASUS_I2C_HEADSET_MIC] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl []) { + {0x19 ,0x03a11050 }, + {0x1b ,0x03a11c30 }, + { } + }, + .chained = true, + .chain_id =ALC285_FIXUP_ASUS_I2C_SPEAKER2_TO_DAC1 + }, [ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = { .type = HDA_FIXUP_PINS, .v.pins = (const struct hda_pintbl []) {
@@ -9598,6 +9616,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1043 ,0x1313 ,"Asus K42JZ" ,ALC269VB_FIXUP_ASUS_MIC_NO_PRESENCE ),SND_PCI_QUIRK (0x1043 ,0x13b0 ,"ASUS Z550SA" ,ALC256_FIXUP_ASUS_MIC ),SND_PCI_QUIRK (0x1043 ,0x1427 ,"Asus Zenbook UX31E" ,ALC269VB_FIXUP_ASUS_ZENBOOK ), +SND_PCI_QUIRK (0x1043 ,0x1433 ,"ASUS GX650P" ,ALC285_FIXUP_ASUS_I2C_HEADSET_MIC ),SND_PCI_QUIRK (0x1043 ,0x1473 ,"ASUS GU604V" ,ALC285_FIXUP_ASUS_HEADSET_MIC ),SND_PCI_QUIRK (0x1043 ,0x1483 ,"ASUS GU603V" ,ALC285_FIXUP_ASUS_HEADSET_MIC ), SND_PCI_QUIRK(0x1043, 0x1493, "ASUS GV601V", ALC285_FIXUP_ASUS_HEADSET_MIC),
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 76/234 ALSA: hda/realtek: Add quirk for ASUS ROG GA402X
In reply to Greg Kroah-HartmanFrom: Luke D. Jones <[email protected]>
[ Upstream commit 9abc77fb144fe916fd2f592dc4b8c7bade02e58a ]
Adds the required quirk to enable the Cirrus amp and correct pins on the ASUS ROG GA402X series which uses an I2C connected Cirrus amp.
While this works if the related _DSD properties are made available, these aren't included in the ACPI of these laptops (yet).
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -9617,6 +9617,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1043 ,0x13b0 ,"ASUS Z550SA" ,ALC256_FIXUP_ASUS_MIC ),SND_PCI_QUIRK (0x1043 ,0x1427 ,"Asus Zenbook UX31E" ,ALC269VB_FIXUP_ASUS_ZENBOOK ),SND_PCI_QUIRK (0x1043 ,0x1433 ,"ASUS GX650P" ,ALC285_FIXUP_ASUS_I2C_HEADSET_MIC ), +SND_PCI_QUIRK (0x1043 ,0x1463 ,"Asus GA402X" ,ALC285_FIXUP_ASUS_I2C_HEADSET_MIC ),SND_PCI_QUIRK (0x1043 ,0x1473 ,"ASUS GU604V" ,ALC285_FIXUP_ASUS_HEADSET_MIC ),SND_PCI_QUIRK (0x1043 ,0x1483 ,"ASUS GU603V" ,ALC285_FIXUP_ASUS_HEADSET_MIC ), SND_PCI_QUIRK(0x1043, 0x1493, "ASUS GV601V", ALC285_FIXUP_ASUS_HEADSET_MIC),
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 77/234 ALSA: hda/realtek: Amend G634 quirk to enable rear speakers
In reply to Greg Kroah-HartmanFrom: Luke D. Jones <[email protected]>
[ Upstream commit b759a5f097cd42c666f1ebca8da50ff507435fbe ]
Amends the last quirk for the G634 with 0x1caf subsys to enable the rear speakers via pincfg.
--- sound/pci/hda/patch_realtek.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
sound/pci/hda/patch_realtek.c +11 -1
@@ -7081,6 +7081,7 @@ enum {ALC285_FIXUP_SPEAKER2_TO_DAC1 ,ALC285_FIXUP_ASUS_SPEAKER2_TO_DAC1 ,ALC285_FIXUP_ASUS_HEADSET_MIC , +ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS ,ALC285_FIXUP_ASUS_I2C_SPEAKER2_TO_DAC1 ,ALC285_FIXUP_ASUS_I2C_HEADSET_MIC , ALC280_FIXUP_HP_HEADSET_MIC,
@@ -8075,6 +8076,15 @@ static const struct hda_fixup alc269_fixups[] = { .chained = true, .chain_id =ALC285_FIXUP_ASUS_SPEAKER2_TO_DAC1 }, + [ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl []) { + {0x14 ,0x90170120 }, + { } + }, + .chained = true, + .chain_id =ALC285_FIXUP_ASUS_HEADSET_MIC + }, [ALC285_FIXUP_ASUS_I2C_SPEAKER2_TO_DAC1] = { .type = HDA_FIXUP_FUNC, .v.func = alc285_fixup_speaker2_to_dac1,
@@ -9647,7 +9657,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1043 ,0x1c23 ,"Asus X55U" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ),SND_PCI_QUIRK (0x1043 ,0x1c62 ,"ASUS GU603" ,ALC289_FIXUP_ASUS_GA401 ),SND_PCI_QUIRK (0x1043 ,0x1c92 ,"ASUS ROG Strix G15" ,ALC285_FIXUP_ASUS_G533Z_PINS ), -SND_PCI_QUIRK (0x1043 ,0x1caf ,"ASUS G634JYR/JZR" ,ALC285_FIXUP_ASUS_HEADSET_MIC ), +SND_PCI_QUIRK (0x1043 ,0x1caf ,"ASUS G634JYR/JZR" ,ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS ),SND_PCI_QUIRK (0x1043 ,0x1ccd ,"ASUS X555UB" ,ALC256_FIXUP_ASUS_MIC ),SND_PCI_QUIRK (0x1043 ,0x1d1f ,"ASUS ROG Strix G17 2023 (G713PV)" ,ALC287_FIXUP_CS35L41_I2C_2 ), SND_PCI_QUIRK(0x1043, 0x1d42, "ASUS Zephyrus G14 2022", ALC289_FIXUP_ASUS_GA401),
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 78/234 ALSA: hda/realtek: Add quirk for ASUS ROG G614Jx
In reply to Greg Kroah-HartmanFrom: Luke D. Jones <[email protected]>
[ Upstream commit 33d7c9c3bf70ed91191a2bedbbc03783b824b5de ]
Adds the required quirk to enable the Cirrus amp and correct pins on the ASUS ROG G614J series which uses an SPI connected Cirrus amp.
While this works if the related _DSD properties are made available, these aren't included in the ACPI of these laptops (yet).
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -9657,6 +9657,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1043 ,0x1c23 ,"Asus X55U" ,ALC269_FIXUP_LIMIT_INT_MIC_BOOST ),SND_PCI_QUIRK (0x1043 ,0x1c62 ,"ASUS GU603" ,ALC289_FIXUP_ASUS_GA401 ),SND_PCI_QUIRK (0x1043 ,0x1c92 ,"ASUS ROG Strix G15" ,ALC285_FIXUP_ASUS_G533Z_PINS ), +SND_PCI_QUIRK (0x1043 ,0x1c9f ,"ASUS G614JI" ,ALC285_FIXUP_ASUS_HEADSET_MIC ),SND_PCI_QUIRK (0x1043 ,0x1caf ,"ASUS G634JYR/JZR" ,ALC285_FIXUP_ASUS_SPI_REAR_SPEAKERS ),SND_PCI_QUIRK (0x1043 ,0x1ccd ,"ASUS X555UB" ,ALC256_FIXUP_ASUS_MIC ), SND_PCI_QUIRK(0x1043, 0x1d1f, "ASUS ROG Strix G17 2023 (G713PV)", ALC287_FIXUP_CS35L41_I2C_2),
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 79/234 ALSA: hda/realtek: Add quirk for ASUS ROG GZ301V
In reply to Greg Kroah-HartmanFrom: Luke D. Jones <[email protected]>
[ Upstream commit 5251605f4d297a0eb5d3b7f39f9dcee9e4d0115a ]
Adds the required quirk to enable the Cirrus amp and correct pins on the ASUS ROG GZ301V series which uses an SPI connected Cirrus amp.
While this works if the related _DSD properties are made available, these aren't included in the ACPI of these laptops (yet).
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -9632,6 +9632,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1043 ,0x1483 ,"ASUS GU603V" ,ALC285_FIXUP_ASUS_HEADSET_MIC ),SND_PCI_QUIRK (0x1043 ,0x1493 ,"ASUS GV601V" ,ALC285_FIXUP_ASUS_HEADSET_MIC ),SND_PCI_QUIRK (0x1043 ,0x1517 ,"Asus Zenbook UX31A" ,ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A ), +SND_PCI_QUIRK (0x1043 ,0x1573 ,"ASUS GZ301V" ,ALC285_FIXUP_ASUS_HEADSET_MIC ),SND_PCI_QUIRK (0x1043 ,0x1662 ,"ASUS GV301QH" ,ALC294_FIXUP_ASUS_DUAL_SPK ),SND_PCI_QUIRK (0x1043 ,0x1683 ,"ASUS UM3402YAR" ,ALC287_FIXUP_CS35L41_I2C_2 ), SND_PCI_QUIRK(0x1043, 0x16b2, "ASUS GU603", ALC289_FIXUP_ASUS_GA401),
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 80/234 powerpc/kasan: Disable KCOV in KASAN code
In reply to Greg Kroah-HartmanFrom: Benjamin Gray <[email protected]>
[ Upstream commit ccb381e1af1ace292153c88eb1fffa5683d16a20 ]
As per the generic KASAN code in mm/kasan, disable KCOV with KCOV_INSTRUMENT := n in the makefile.
This fixes a ppc64 boot hang when KCOV and KASAN are enabled. kasan_early_init() gets called before a PACA is initialised, but the KCOV hook expects a valid PACA.
--- arch/powerpc/mm/kasan/Makefile | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/mm/kasan/Makefile +1 -0
@@ -1,6 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 KASAN_SANITIZE := n +KCOV_INSTRUMENT := n obj-$(CONFIG_PPC32) += init_32.o obj-$(CONFIG_PPC_8xx) += 8xx.o
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 81/234 Bluetooth: MGMT: Use correct address for memcpy()
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit d1f0a9816f5fbc1316355ec1aa4ddfb9b624cca5 ]
In function ‘fortify_memcpy_chk’,
inlined from ‘get_conn_info_complete’ at net/bluetooth/mgmt.c:7281:2:include/linux/fortify-string.h:592:25: error: call to ‘__read_overflow2_field’ declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Werror=attribute-warning]
592 | __read_overflow2_field(q_size_field, size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~cc1: all warnings being treated as errors
This is due to the wrong member is used for memcpy(). Use correct one.
--- net/bluetooth/mgmt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bluetooth/mgmt.c +1 -1
@@ -7285,7 +7285,7 @@ static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err)bt_dev_dbg (hdev,"err %d" , err); -memcpy (&rp.addr, &cp->addr.bdaddr,sizeof (rp.addr)); +memcpy (&rp.addr, &cp->addr,sizeof (rp.addr)); status =mgmt_status (err);if (status ==MGMT_STATUS_SUCCESS ) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 82/234 ring-buffer: Do not swap cpu_buffer during resize process
In reply to Greg Kroah-HartmanFrom: Chen Lin <[email protected]>
[ Upstream commit 8a96c0288d0737ad77882024974c075345c72011 ]
When ring_buffer_swap_cpu was called during resize process, the cpu buffer was swapped in the middle, resulting in incorrect state. Continuing to run in the wrong state will result in oops.
This issue can be easily reproduced using the following two scripts:
/tmp # cat test1.sh
//#! /bin/sh
for i in seq 0 100000
do
echo 2000 > /sys/kernel/debug/tracing/buffer_size_kb sleep 0.5
echo 5000 > /sys/kernel/debug/tracing/buffer_size_kb sleep 0.5
done
/tmp # cat test2.sh
//#! /bin/sh
for i in seq 0 100000
do
echo irqsoff > /sys/kernel/debug/tracing/current_tracer sleep 1
echo nop > /sys/kernel/debug/tracing/current_tracer sleep 1
done
/tmp # ./test1.sh &
/tmp # ./test2.sh &
A typical oops log is as follows, sometimes with other different oops logs.
[ 231.711293] WARNING: CPU: 0 PID: 9 at kernel/trace/ring_buffer.c:2026 rb_update_pages+0x378/0x3f8 [ 231.713375] Modules linked in: [ 231.714735] CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.5.0-rc1-00276-g20edcec23f92 #15 [ 231.716750] Hardware name: linux,dummy-virt (DT) [ 231.718152] Workqueue: events update_pages_handler [ 231.719714] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 231.721171] pc : rb_update_pages+0x378/0x3f8 [ 231.722212] lr : rb_update_pages+0x25c/0x3f8 [ 231.723248] sp : ffff800082b9bd50 [ 231.724169] x29: ffff800082b9bd50 x28: ffff8000825f7000 x27: 0000000000000000 [ 231.726102] x26: 0000000000000001 x25: fffffffffffff010 x24: 0000000000000ff0 [ 231.728122] x23: ffff0000c3a0b600 x22: ffff0000c3a0b5c0 x21: fffffffffffffe0a [ 231.730203] x20: ffff0000c3a0b600 x19: ffff0000c0102400 x18: 0000000000000000 [ 231.732329] x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffffe7aa8510 [ 231.734212] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000002 [ 231.736291] x11: ffff8000826998a8 x10: ffff800082b9baf0 x9 : ffff800081137558 [ 231.738195] x8 : fffffc00030e82c8 x7 : 0000000000000000 x6 : 0000000000000001 [ 231.740192] x5 : ffff0000ffbafe00 x4 : 0000000000000000 x3 : 0000000000000000 [ 231.742118] x2 : 00000000000006aa x1 : 0000000000000001 x0 : ffff0000c0007208 [ 231.744196] Call trace: [ 231.744892] rb_update_pages+0x378/0x3f8 [ 231.745893] update_pages_handler+0x1c/0x38 [ 231.746893] process_one_work+0x1f0/0x468 [ 231.747852] worker_thread+0x54/0x410 [ 231.748737] kthread+0x124/0x138 [ 231.749549] ret_from_fork+0x10/0x20 [ 231.750434] ---[ end trace 0000000000000000 ]--- [ 233.720486] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 233.721696] Mem abort info: [ 233.721935] ESR = 0x0000000096000004 [ 233.722283] EC = 0x25: DABT (current EL), IL = 32 bits [ 233.722596] SET = 0, FnV = 0 [ 233.722805] EA = 0, S1PTW = 0 [ 233.723026] FSC = 0x04: level 0 translation fault [ 233.723458] Data abort info: [ 233.723734] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 233.724176] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 233.724589] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 233.725075] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000104943000 [ 233.725592] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 233.726231] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 233.726720] Modules linked in: [ 233.727007] CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.5.0-rc1-00276-g20edcec23f92 #15 [ 233.727777] Hardware name: linux,dummy-virt (DT) [ 233.728225] Workqueue: events update_pages_handler [ 233.728655] pstate: 200000c5 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 233.729054] pc : rb_update_pages+0x1a8/0x3f8 [ 233.729334] lr : rb_update_pages+0x154/0x3f8 [ 233.729592] sp : ffff800082b9bd50 [ 233.729792] x29: ffff800082b9bd50 x28: ffff8000825f7000 x27: 0000000000000000 [ 233.730220] x26: 0000000000000000 x25: ffff800082a8b840 x24: ffff0000c0102418 [ 233.730653] x23: 0000000000000000 x22: fffffc000304c880 x21: 0000000000000003 [ 233.731105] x20: 00000000000001f4 x19: ffff0000c0102400 x18: ffff800082fcbc58 [ 233.731727] x17: 0000000000000000 x16: 0000000000000001 x15: 0000000000000001 [ 233.732282] x14: ffff8000825fe0c8 x13: 0000000000000001 x12: 0000000000000000 [ 233.732709] x11: ffff8000826998a8 x10: 0000000000000ae0 x9 : ffff8000801b760c [ 233.733148] x8 : fefefefefefefeff x7 : 0000000000000018 x6 : ffff0000c03298c0 [ 233.733553] x5 : 0000000000000002 x4 : 0000000000000000 x3 : 0000000000000000 [ 233.733972] x2 : ffff0000c3a0b600 x1 : 0000000000000000 x0 : 0000000000000000 [ 233.734418] Call trace: [ 233.734593] rb_update_pages+0x1a8/0x3f8 [ 233.734853] update_pages_handler+0x1c/0x38 [ 233.735148] process_one_work+0x1f0/0x468 [ 233.735525] worker_thread+0x54/0x410 [ 233.735852] kthread+0x124/0x138 [ 233.736064] ret_from_fork+0x10/0x20 [ 233.736387] Code: 92400000 910006b5 aa000021 aa0303f7 (f9400060) [ 233.736959] ---[ end trace 0000000000000000 ]---
After analysis, the seq of the error is as follows [1-5]:
int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size,
int cpu_id)
{
for_each_buffer_cpu(buffer, cpu) {
cpu_buffer = buffer->buffers[cpu];
//1. get cpu_buffer, aka cpu_buffer(A)
...
...
schedule_work_on(cpu,
&cpu_buffer->update_pages_work);
//2. 'update_pages_work' is queue on 'cpu', cpu_buffer(A) is passed to
// update_pages_handler, do the update process, set 'update_done' in
// complete(&cpu_buffer->update_done) and to wakeup resize process.
//---->
//3. Just at this moment, ring_buffer_swap_cpu is triggered,
//cpu_buffer(A) be swaped to cpu_buffer(B), the max_buffer.
//ring_buffer_swap_cpu is called as the 'Call trace' below.
Call trace:
dump_backtrace+0x0/0x2f8
show_stack+0x18/0x28
dump_stack+0x12c/0x188
ring_buffer_swap_cpu+0x2f8/0x328
update_max_tr_single+0x180/0x210
check_critical_timing+0x2b4/0x2c8
tracer_hardirqs_on+0x1c0/0x200
trace_hardirqs_on+0xec/0x378
el0_svc_common+0x64/0x260
do_el0_svc+0x90/0xf8
el0_svc+0x20/0x30
el0_sync_handler+0xb0/0xb8
el0_sync+0x180/0x1c0
//<----
/* wait for all the updates to complete */
for_each_buffer_cpu(buffer, cpu) {
cpu_buffer = buffer->buffers[cpu];
//4. get cpu_buffer, cpu_buffer(B) is used in the following process,
//the state of cpu_buffer(A) and cpu_buffer(B) is totally wrong.
//for example, cpu_buffer(A)->update_done will leave be set 1, and will
//not 'wait_for_completion' at the next resize round.
if (!cpu_buffer->nr_pages_to_update)
continue;
if (cpu_online(cpu))
wait_for_completion(&cpu_buffer->update_done);
cpu_buffer->nr_pages_to_update = 0;
}
...
}
//5. the state of cpu_buffer(A) and cpu_buffer(B) is totally wrong,
//Continuing to run in the wrong state, then oops occurs.--- kernel/trace/ring_buffer.c | 14 +++++++++++++- kernel/trace/trace.c | 3 ++- 2 files changed, 15 insertions(+), 2 deletions(-)
kernel/trace/ring_buffer.c +13 -1
@@ -538,6 +538,7 @@ struct trace_buffer {unsigned flags;int cpus;atomic_t record_disabled; +atomic_t resizing;cpumask_var_t cpumask;struct lock_class_key *reader_lock_key;
@@ -2166,7 +2167,7 @@ int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size,/* prevent another thread from changing buffer sizes */ mutex_lock (&buffer->mutex); - +atomic_inc (&buffer->resizing);if (cpu_id ==RING_BUFFER_ALL_CPUS ) {/*
@@ -2321,6 +2322,7 @@ int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size,atomic_dec (&buffer->record_disabled); } +atomic_dec (&buffer->resizing);mutex_unlock (&buffer->mutex);return 0 ;
@@ -2341,6 +2343,7 @@ int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size, } } out_err_unlock: +atomic_dec (&buffer->resizing);mutex_unlock (&buffer->mutex);return err; }
@@ -5543,6 +5546,15 @@ int ring_buffer_swap_cpu(struct trace_buffer *buffer_a,if (local_read (&cpu_buffer_b->committing)) goto out_dec; +/* +* When resize is in progress, we cannot swap it because +* it will mess the state of the cpu buffer. +*/ +if (atomic_read (&buffer_a->resizing)) + goto out_dec; +if (atomic_read (&buffer_b->resizing)) + goto out_dec; + buffer_a->buffers[cpu] = cpu_buffer_b; buffer_b->buffers[cpu] = cpu_buffer_a;
kernel/trace/trace.c +2 -1
@@ -1928,9 +1928,10 @@ update_max_tr_single(struct trace_array *tr, struct task_struct *tsk, int cpu)* place on this CPU. We fail to record, but we reset * the max trace buffer (no one writes directly to it) * and flag that it failed. +* Another reason is resize is in progress. */ trace_array_printk_buf (tr->max_buffer.buffer, _THIS_IP_, -"Failed to swap buffers due to commit in progress\n" ); +"Failed to swap buffers due to commit or resize in progress\n" ); }WARN_ON_ONCE (ret && ret != -EAGAIN && ret != -EBUSY );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 83/234 btrfs: move out now unused BG from the reclaim list
In reply to Greg Kroah-HartmanFrom: Naohiro Aota <[email protected]>
[ Upstream commit a9f189716cf15913c453299d72f69c51a9b0f86b ]
An unused block group is easy to remove to free up space and should be reclaimed fast. Such block group can often already be a target of the reclaim process. As we check list_empty(&bg->bg_list), we keep it in the reclaim list. That block group is never reclaimed until the file system is filled e.g. up to 75%.
Instead, we can move unused block group to the unused list and delete it fast.
--- fs/btrfs/block-group.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/btrfs/block-group.c +4 -1
@@ -1665,11 +1665,14 @@ void btrfs_mark_bg_unused(struct btrfs_block_group *bg) {struct btrfs_fs_info *fs_info = bg->fs_info; +trace_btrfs_add_unused_block_group (bg);spin_lock (&fs_info->unused_bgs_lock);if (list_empty (&bg->bg_list)) {btrfs_get_block_group (bg); -trace_btrfs_add_unused_block_group (bg);list_add_tail (&bg->bg_list, &fs_info->unused_bgs); + }else { +/* Pull out the block group from the reclaim_bgs list. */ +list_move_tail (&bg->bg_list, &fs_info->unused_bgs); }spin_unlock (&fs_info->unused_bgs_lock); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 84/234 btrfs: fix use-after-free of new block group that became unused
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
[ Upstream commit 0657b20c5a76c938612f8409735a8830d257866e ]
If a task creates a new block group and that block group becomes unused before we finish its creation, at btrfs_create_pending_block_groups(), then when btrfs_mark_bg_unused() is called against the block group, we assume that the block group is currently in the list of block groups to reclaim, and we move it out of the list of new block groups and into the list of unused block groups. This has two consequences:
1) We move it out of the list of new block groups associated to the current transaction. So the block group creation is not finished and if we attempt to delete the bg because it's unused, we will not find the block group item in the extent tree (or the new block group tree), its device extent items in the device tree etc, resulting in the deletion to fail due to the missing items;
2) We don't increment the reference count on the block group when we move it to the list of unused block groups, because we assumed the block group was on the list of block groups to reclaim, and in that case it already has the correct reference count. However the block group was on the list of new block groups, in which case no extra reference was taken because it's local to the current task. This later results in doing an extra reference count decrement when removing the block group from the unused list, eventually leading the reference count to 0.
This second case was caught when running generic/297 from fstests, which produced the following assertion failure and stack trace:
[589.559] assertion failed: refcount_read(&block_group->refs) == 1, in fs/btrfs/block-group.c:4299 [589.559] ------------[ cut here ]------------ [589.559] kernel BUG at fs/btrfs/block-group.c:4299! [589.560] invalid opcode: 0000 [#1] PREEMPT SMP PTI [589.560] CPU: 8 PID: 2819134 Comm: umount Tainted: G W 6.4.0-rc6-btrfs-next-134+ #1 [589.560] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [589.560] RIP: 0010:btrfs_free_block_groups+0x449/0x4a0 [btrfs] [589.561] Code: 68 62 da c0 (...) [589.561] RSP: 0018:ffffa55a8c3b3d98 EFLAGS: 00010246 [589.561] RAX: 0000000000000058 RBX: ffff8f030d7f2000 RCX: 0000000000000000 [589.562] RDX: 0000000000000000 RSI: ffffffff953f0878 RDI: 00000000ffffffff [589.562] RBP: ffff8f030d7f2088 R08: 0000000000000000 R09: ffffa55a8c3b3c50 [589.562] R10: 0000000000000001 R11: 0000000000000001 R12: ffff8f05850b4c00 [589.562] R13: ffff8f030d7f2090 R14: ffff8f05850b4cd8 R15: dead000000000100 [589.563] FS: 00007f497fd2e840(0000) GS:ffff8f09dfc00000(0000) knlGS:0000000000000000 [589.563] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [589.563] CR2: 00007f497ff8ec10 CR3: 0000000271472006 CR4: 0000000000370ee0 [589.563] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [589.564] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [589.564] Call Trace: [589.564] <TASK> [589.565] ? __die_body+0x1b/0x60 [589.565] ? die+0x39/0x60 [589.565] ? do_trap+0xeb/0x110 [589.565] ? btrfs_free_block_groups+0x449/0x4a0 [btrfs] [589.566] ? do_error_trap+0x6a/0x90 [589.566] ? btrfs_free_block_groups+0x449/0x4a0 [btrfs] [589.566] ? exc_invalid_op+0x4e/0x70 [589.566] ? btrfs_free_block_groups+0x449/0x4a0 [btrfs] [589.567] ? asm_exc_invalid_op+0x16/0x20 [589.567] ? btrfs_free_block_groups+0x449/0x4a0 [btrfs] [589.567] ? btrfs_free_block_groups+0x449/0x4a0 [btrfs] [589.567] close_ctree+0x35d/0x560 [btrfs] [589.568] ? fsnotify_sb_delete+0x13e/0x1d0 [589.568] ? dispose_list+0x3a/0x50 [589.568] ? evict_inodes+0x151/0x1a0 [589.568] generic_shutdown_super+0x73/0x1a0 [589.569] kill_anon_super+0x14/0x30 [589.569] btrfs_kill_super+0x12/0x20 [btrfs] [589.569] deactivate_locked_super+0x2e/0x70 [589.569] cleanup_mnt+0x104/0x160 [589.570] task_work_run+0x56/0x90 [589.570] exit_to_user_mode_prepare+0x160/0x170 [589.570] syscall_exit_to_user_mode+0x22/0x50 [589.570] ? __x64_sys_umount+0x12/0x20 [589.571] do_syscall_64+0x48/0x90 [589.571] entry_SYSCALL_64_after_hwframe+0x72/0xdc [589.571] RIP: 0033:0x7f497ff0a567 [589.571] Code: af 98 0e (...) [589.572] RSP: 002b:00007ffc98347358 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [589.572] RAX: 0000000000000000 RBX: 00007f49800b8264 RCX: 00007f497ff0a567 [589.572] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000557f558abfa0 [589.573] RBP: 0000557f558a6ba0 R08: 0000000000000000 R09: 00007ffc98346100 [589.573] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [589.573] R13: 0000557f558abfa0 R14: 0000557f558a6cb0 R15: 0000557f558a6dd0 [589.573] </TASK> [589.574] Modules linked in: dm_snapshot dm_thin_pool (...) [589.576] ---[ end trace 0000000000000000 ]---
Fix this by adding a runtime flag to the block group to tell that the block group is still in the list of new block groups, and therefore it should not be moved to the list of unused block groups, at btrfs_mark_bg_unused(), until the flag is cleared, when we finish the creation of the block group at btrfs_create_pending_block_groups().
--- fs/btrfs/block-group.c | 13 +++++++++++-- fs/btrfs/block-group.h | 5 +++++ 2 files changed, 16 insertions(+), 2 deletions(-)
fs/btrfs/block-group.c +11 -2
@@ -1665,13 +1665,14 @@ void btrfs_mark_bg_unused(struct btrfs_block_group *bg) {struct btrfs_fs_info *fs_info = bg->fs_info; -trace_btrfs_add_unused_block_group (bg);spin_lock (&fs_info->unused_bgs_lock);if (list_empty (&bg->bg_list)) {btrfs_get_block_group (bg); +trace_btrfs_add_unused_block_group (bg);list_add_tail (&bg->bg_list, &fs_info->unused_bgs); - }else { + }else if (!test_bit (BLOCK_GROUP_FLAG_NEW , &bg->runtime_flags)) {/* Pull out the block group from the reclaim_bgs list. */ +trace_btrfs_add_unused_block_group (bg);list_move_tail (&bg->bg_list, &fs_info->unused_bgs); }spin_unlock (&fs_info->unused_bgs_lock);
@@ -2696,6 +2697,7 @@ void btrfs_create_pending_block_groups(struct btrfs_trans_handle *trans) next:btrfs_delayed_refs_rsv_release (fs_info,1 );list_del_init (&block_group->bg_list); +clear_bit (BLOCK_GROUP_FLAG_NEW , &block_group->runtime_flags); }btrfs_trans_release_chunk_metadata (trans); }
@@ -2735,6 +2737,13 @@ struct btrfs_block_group *btrfs_make_block_group(struct btrfs_trans_handle *tranif (!cache)return ERR_PTR (-ENOMEM ); +/* +* Mark it as new before adding it to the rbtree of block groups or any +* list, so that no other task finds it and calls btrfs_mark_bg_unused() +* before the new flag is set. +*/ +set_bit (BLOCK_GROUP_FLAG_NEW , &cache->runtime_flags); + cache->length = size;set_free_space_tree_thresholds (cache); cache->flags = type;
fs/btrfs/block-group.h +5 -0
@@ -70,6 +70,11 @@ enum btrfs_block_group_flags {BLOCK_GROUP_FLAG_NEEDS_FREE_SPACE ,/* Indicate that the block group is placed on a sequential zone */ BLOCK_GROUP_FLAG_SEQUENTIAL_ZONE , +/* +* Indicate that block group is in the list of new block groups of a +* transaction. +*/ + BLOCK_GROUP_FLAG_NEW, }; enum btrfs_caching_type {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 85/234 regulator: qcom-rpmh: Fix LDO 12 regulator for PM8550
In reply to Greg Kroah-HartmanFrom: Abel Vesa <[email protected]>
[ Upstream commit 7cdf55462c5533a1c78ae13ab8563558e30e4130 ]
The LDO 12 is NLDO 515 low voltage type, so fix accordingly.
--- drivers/regulator/qcom-rpmh-regulator.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/regulator/qcom-rpmh-regulator.c +1 -1
@@ -1068,7 +1068,7 @@ static const struct rpmh_vreg_init_data pm8550_vreg_data[] = {RPMH_VREG ("ldo9" ,"ldo%s9" , &pmic5_pldo,"vdd-l8-l9" ),RPMH_VREG ("ldo10" ,"ldo%s10" , &pmic5_nldo515,"vdd-l1-l4-l10" ),RPMH_VREG ("ldo11" ,"ldo%s11" , &pmic5_nldo515,"vdd-l11" ), -RPMH_VREG ("ldo12" ,"ldo%s12" , &pmic5_pldo,"vdd-l12" ), +RPMH_VREG ("ldo12" ,"ldo%s12" , &pmic5_nldo515,"vdd-l12" ),RPMH_VREG ("ldo13" ,"ldo%s13" , &pmic5_pldo,"vdd-l2-l13-l14" ),RPMH_VREG ("ldo14" ,"ldo%s14" , &pmic5_pldo,"vdd-l2-l13-l14" ), RPMH_VREG("ldo15", "ldo%s15", &pmic5_nldo515, "vdd-l15"),
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 86/234 virtio-mmio: dont break lifecycle of vm_dev
In reply to Greg Kroah-HartmanFrom: Wolfram Sang <[email protected]>
[ Upstream commit 55c91fedd03d7b9cf0c5199b2eb12b9b8e95281a ]
vm_dev has a separate lifecycle because it has a 'struct device' embedded. Thus, having a release callback for it is correct.
Allocating the vm_dev struct with devres totally breaks this protection, though. Instead of waiting for the vm_dev release callback, the memory is freed when the platform_device is removed. Resulting in a use-after-free when finally the callback is to be called.
To easily see the problem, compile the kernel with CONFIG_DEBUG_KOBJECT_RELEASE and unbind with sysfs.
The fix is easy, don't use devres in this case.
Found during my research about object lifetime problems.
Message-Id: <[email protected]>
--- drivers/virtio/virtio_mmio.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/virtio/virtio_mmio.c +2 -3
@@ -607,9 +607,8 @@ static void virtio_mmio_release_dev(struct device *_d)struct virtio_device *vdev = container_of(_d, struct virtio_device, dev);struct virtio_mmio_device *vm_dev =to_virtio_mmio_device (vdev); -struct platform_device *pdev = vm_dev->pdev; -devm_kfree (&pdev->dev, vm_dev); +kfree (vm_dev); }/* Platform device */
@@ -620,7 +619,7 @@ static int virtio_mmio_probe(struct platform_device *pdev)unsigned long magic;int rc; - vm_dev =devm_kzalloc (&pdev->dev,sizeof (*vm_dev),GFP_KERNEL ); + vm_dev =kzalloc (sizeof (*vm_dev),GFP_KERNEL );if (!vm_dev)return -ENOMEM ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 87/234 vduse: Use proper spinlock for IRQ injection
In reply to Greg Kroah-HartmanFrom: Maxime Coquelin <[email protected]>
[ Upstream commit 7ca26efb09a1543fddb29308ea3b63b66cb5d3ee ]
The IRQ injection work used spin_lock_irq() to protect the scheduling of the softirq, but spin_lock_bh() should be used.
With spin_lock_irq(), we noticed delay of more than 6 seconds between the time a NAPI polling work is scheduled and the time it is executed.
Message-Id: <[email protected]>
--- drivers/vdpa/vdpa_user/vduse_dev.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/vdpa/vdpa_user/vduse_dev.c +4 -4
@@ -935,10 +935,10 @@ static void vduse_dev_irq_inject(struct work_struct *work) { struct vduse_dev *dev = container_of(work, struct vduse_dev, inject); -spin_lock_irq (&dev->irq_lock); +spin_lock_bh (&dev->irq_lock);if (dev->config_cb.callback) dev->config_cb.callback (dev->config_cb.private); -spin_unlock_irq (&dev->irq_lock); +spin_unlock_bh (&dev->irq_lock); }static void vduse_vq_irq_inject (struct work_struct *work)
@@ -946,10 +946,10 @@ static void vduse_vq_irq_inject(struct work_struct *work)struct vduse_virtqueue *vq =container_of (work, struct vduse_virtqueue, inject); -spin_lock_irq (&vq->irq_lock); +spin_lock_bh (&vq->irq_lock);if (vq->ready && vq->cb.callback) vq->cb.callback (vq->cb.private); -spin_unlock_irq (&vq->irq_lock); +spin_unlock_bh (&vq->irq_lock); }static bool vduse_vq_signal_irqfd (struct vduse_virtqueue *vq)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 88/234 virtio-vdpa: Fix cpumask memory leak in virtio_vdpa_find_vqs()
In reply to Greg Kroah-HartmanFrom: Gal Pressman <[email protected]>
[ Upstream commit df9557046440b0a62250fee3169a8f6a139f55a6 ]
Free the cpumask allocated by create_affinity_masks() before returning from the function.
Message-Id: <[email protected]>
--- drivers/virtio/virtio_vdpa.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/virtio/virtio_vdpa.c +2 -0
@@ -393,11 +393,13 @@ static int virtio_vdpa_find_vqs(struct virtio_device *vdev, unsigned int nvqs, cb.callback = virtio_vdpa_config_cb; cb.private = vd_dev; ops->set_config_cb (vdpa, &cb); +kfree (masks);return 0 ; err_setup_vq:virtio_vdpa_del_vqs (vdev); +kfree (masks);return err; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 89/234 vdpa/mlx5: Fix mr->initialized semantics
In reply to Greg Kroah-HartmanFrom: Dragos Tatulea <[email protected]>
[ Upstream commit 9ee811009ad8f87982b69e61d07447d12233ad01 ]
The mr->initialized flag is shared between the control vq and data vq part of the mr init/uninit. But if the control vq and data vq get placed in different ASIDs, it can happen that initializing the control vq will prevent the data vq mr from being initialized.
This patch consolidates the control and data vq init parts into their own init functions. The mr->initialized will now be used for the data vq only. The control vq currently doesn't need a flag.
The uninitializing part is also taken care of: mlx5_vdpa_destroy_mr got split into data and control vq functions which are now also ASID aware.
Message-Id: <[email protected]>
--- drivers/vdpa/mlx5/core/mlx5_vdpa.h | 1 + drivers/vdpa/mlx5/core/mr.c | 97 +++++++++++++++++++++--------- 2 files changed, 71 insertions(+), 27 deletions(-)
drivers/vdpa/mlx5/core/mlx5_vdpa.h +1 -0
@@ -31,6 +31,7 @@ struct mlx5_vdpa_mr {struct list_head head;unsigned long num_directs;unsigned long num_klms; +/* state of dvq mr */ bool initialized;/* serialize mkey creation and destruction */
drivers/vdpa/mlx5/core/mr.c +70 -27
130 lines not on this page · raw message
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 90/234 vdpa/mlx5: Delete control vq iotlb in destroy_mr only when necessary
In reply to Greg Kroah-HartmanFrom: Eugenio Pérez <[email protected]>
[ Upstream commit ad03a0f44cdb97b46e5c84ed353dac9b8ae2c276 ]
mlx5_vdpa_destroy_mr can be called from .set_map with data ASID after the control virtqueue ASID iotlb has been populated. The control vq iotlb must not be cleared, since it will not be populated again.
So call the ASID aware destroy function which makes sure that the right vq resource is destroyed.
Message-Id: <[email protected]>
--- drivers/vdpa/mlx5/core/mlx5_vdpa.h | 1 + drivers/vdpa/mlx5/core/mr.c | 2 +- drivers/vdpa/mlx5/net/mlx5_vnet.c | 4 ++-- 3 files changed, 4 insertions(+), 3 deletions(-)
drivers/vdpa/mlx5/core/mlx5_vdpa.h +1 -0
@@ -122,6 +122,7 @@ int mlx5_vdpa_handle_set_map(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *ioint mlx5_vdpa_create_mr (struct mlx5_vdpa_dev *mvdev,struct vhost_iotlb *iotlb,unsigned int asid);void mlx5_vdpa_destroy_mr (struct mlx5_vdpa_dev *mvdev); +void mlx5_vdpa_destroy_mr_asid (struct mlx5_vdpa_dev *mvdev,unsigned int asid);#define mlx5_vdpa_warn (__dev, format, ...) \ dev_warn((__dev)->mdev->device, "%s:%d:(pid %d) warning: " format, __func__, __LINE__, \
drivers/vdpa/mlx5/core/mr.c +1 -1
@@ -515,7 +515,7 @@ static void _mlx5_vdpa_destroy_dvq_mr(struct mlx5_vdpa_dev *mvdev, unsigned int mr->initialized = false; } -static void mlx5_vdpa_destroy_mr_asid (struct mlx5_vdpa_dev *mvdev,unsigned int asid) +void mlx5_vdpa_destroy_mr_asid (struct mlx5_vdpa_dev *mvdev,unsigned int asid) {struct mlx5_vdpa_mr *mr = &mvdev->mr;
drivers/vdpa/mlx5/net/mlx5_vnet.c +2 -2
@@ -2564,7 +2564,7 @@ static int mlx5_vdpa_change_map(struct mlx5_vdpa_dev *mvdev, goto err_mr;teardown_driver (ndev); -mlx5_vdpa_destroy_mr (mvdev); +mlx5_vdpa_destroy_mr_asid (mvdev, asid); err =mlx5_vdpa_create_mr (mvdev, iotlb, asid);if (err) goto err_mr;
@@ -2580,7 +2580,7 @@ static int mlx5_vdpa_change_map(struct mlx5_vdpa_dev *mvdev,return 0 ; err_setup: -mlx5_vdpa_destroy_mr (mvdev); +mlx5_vdpa_destroy_mr_asid (mvdev, asid); err_mr:return err; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 91/234 cifs: fix potential oops in cifs_oplock_break
In reply to Greg Kroah-HartmanFrom: Steve French <[email protected]>
[ Upstream commit e8f5f849ffce24490eb9449e98312b66c0dba76f ]
With deferred close we can have closes that race with lease breaks, and so with the current checks for whether to send the lease response, oplock_response(), this can mean that an unmount (kill_sb) can occur just before we were checking if the tcon->ses is valid. See below:
[Fri Aug 4 04:12:50 2023] RIP: 0010:cifs_oplock_break+0x1f7/0x5b0 [cifs] [Fri Aug 4 04:12:50 2023] Code: 7d a8 48 8b 7d c0 c0 e9 02 48 89 45 b8 41 89 cf e8 3e f5 ff ff 4c 89 f7 41 83 e7 01 e8 82 b3 03 f2 49 8b 45 50 48 85 c0 74 5e <48> 83 78 60 00 74 57 45 84 ff 75 52 48 8b 43 98 48 83 eb 68 48 39 [Fri Aug 4 04:12:50 2023] RSP: 0018:ffffb30607ddbdf8 EFLAGS: 00010206 [Fri Aug 4 04:12:50 2023] RAX: 632d223d32612022 RBX: ffff97136944b1e0 RCX: 0000000080100009 [Fri Aug 4 04:12:50 2023] RDX: 0000000000000001 RSI: 0000000080100009 RDI: ffff97136944b188 [Fri Aug 4 04:12:50 2023] RBP: ffffb30607ddbe58 R08: 0000000000000001 R09: ffffffffc08e0900 [Fri Aug 4 04:12:50 2023] R10: 0000000000000001 R11: 000000000000000f R12: ffff97136944b138 [Fri Aug 4 04:12:50 2023] R13: ffff97149147c000 R14: ffff97136944b188 R15: 0000000000000000 [Fri Aug 4 04:12:50 2023] FS: 0000000000000000(0000) GS:ffff9714f7c00000(0000) knlGS:0000000000000000 [Fri Aug 4 04:12:50 2023] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [Fri Aug 4 04:12:50 2023] CR2: 00007fd8de9c7590 CR3: 000000011228e000 CR4: 0000000000350ef0 [Fri Aug 4 04:12:50 2023] Call Trace: [Fri Aug 4 04:12:50 2023] <TASK> [Fri Aug 4 04:12:50 2023] process_one_work+0x225/0x3d0 [Fri Aug 4 04:12:50 2023] worker_thread+0x4d/0x3e0 [Fri Aug 4 04:12:50 2023] ? process_one_work+0x3d0/0x3d0 [Fri Aug 4 04:12:50 2023] kthread+0x12a/0x150 [Fri Aug 4 04:12:50 2023] ? set_kthread_struct+0x50/0x50 [Fri Aug 4 04:12:50 2023] ret_from_fork+0x22/0x30 [Fri Aug 4 04:12:50 2023] </TASK>
To fix this change the ordering of the checks before sending the oplock_response to first check if the openFileList is empty.
--- fs/smb/client/file.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-)
fs/smb/client/file.c +16 -7
@@ -4878,9 +4878,11 @@ void cifs_oplock_break(struct work_struct *work) struct cifsFileInfo *cfile = container_of(work, struct cifsFileInfo, oplock_break);struct inode *inode =d_inode (cfile->dentry); +struct cifs_sb_info *cifs_sb =CIFS_SB (inode->i_sb);struct cifsInodeInfo *cinode =CIFS_I (inode); -struct cifs_tcon *tcon =tlink_tcon (cfile->tlink); -struct TCP_Server_Info *server = tcon->ses->server; +struct cifs_tcon *tcon; +struct TCP_Server_Info *server; +struct tcon_link *tlink;int rc =0 ;bool purge_cache = false, oplock_break_cancelled;__u64 persistent_fid, volatile_fid;
@@ -4889,6 +4891,12 @@ void cifs_oplock_break(struct work_struct *work)wait_on_bit (&cinode->flags,CIFS_INODE_PENDING_WRITERS ,TASK_UNINTERRUPTIBLE ); + tlink =cifs_sb_tlink (cifs_sb); +if (IS_ERR (tlink)) + goto out; + tcon =tlink_tcon (tlink); + server = tcon->ses->server; + server->ops->downgrade_oplock (server, cinode, cfile->oplock_level, cfile->oplock_epoch, &purge_cache);
@@ -4938,18 +4946,19 @@ void cifs_oplock_break(struct work_struct *work)/* * MS-SMB2 3.2.5.19.1 and 3.2.5.19.2 (and MS-CIFS 3.2.5.42) do not require * an acknowledgment to be sent when the file has already been closed. -* check for server null, since can race with kill_sb calling tree disconnect. */ spin_lock (&cinode->open_file_lock); -if (tcon->ses && tcon->ses->server && !oplock_break_cancelled && - !list_empty (&cinode->openFileList)) { +/* check list empty since can race with kill_sb calling tree disconnect */ +if (!oplock_break_cancelled && !list_empty (&cinode->openFileList)) {spin_unlock (&cinode->open_file_lock); - rc = tcon->ses->server->ops->oplock_response (tcon, persistent_fid, - volatile_fid, net_fid, cinode); + rc = server->ops->oplock_response (tcon, persistent_fid, + volatile_fid, net_fid, cinode);cifs_dbg (FYI ,"Oplock release rc = %d\n" , rc); }else spin_unlock (&cinode->open_file_lock); +cifs_put_tlink (tlink); +out:cifs_done_oplock_break (cinode); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 92/234 rust: macros: vtable: fix `HAS_*` redefinition (`gen_const_name`)
In reply to Greg Kroah-HartmanFrom: Qingsong Chen <[email protected]>
commit 3fa7187eceee11998f756481e45ce8c4f9d9dc48 upstream.
If we define the same function name twice in a trait (using #[cfg]), the vtable macro will redefine its gen_const_name, e.g. this will define HAS_BAR twice:
#[vtable]
pub trait Foo {
#[cfg(CONFIG_X)]
fn bar();
#[cfg(not(CONFIG_X))]
fn bar(x: usize);
}--- rust/macros/vtable.rs | 1 + 1 file changed, 1 insertion(+)
rust/macros/vtable.rs +1 -0
@@ -74,6 +74,7 @@ pub(crate) fn vtable(_attr: TokenStream, ts: TokenStream) -> TokenStream { const {gen_const_name}: bool = false;",) .unwrap(); +consts.insert(gen_const_name); } } else { const_items = "const USE_VTABLE_ATTR: () = ();".to_owned();
Signature · 1 line
2.41.0
Greg Kroah-Hartman
maintainerPATCH 93/234 i2c: bcm-iproc: Fix bcm_iproc_i2c_isr deadlock issue
In reply to Greg Kroah-HartmanFrom: Chengfeng Ye <[email protected]>
commit 4caf4cb1eaed469742ef719f2cc024b1ec3fa9e6 upstream.
iproc_i2c_rd_reg() and iproc_i2c_wr_reg() are called from both interrupt context (e.g. bcm_iproc_i2c_isr) and process context (e.g. bcm_iproc_i2c_suspend). Therefore, interrupts should be disabled to avoid potential deadlock. To prevent this scenario, use spin_lock_irqsave().
--- drivers/i2c/busses/i2c-bcm-iproc.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/i2c/busses/i2c-bcm-iproc.c +7 -4
@@ -233,13 +233,14 @@ static inline u32 iproc_i2c_rd_reg(struc u32 offset) {u32 val; +unsigned long flags;if (iproc_i2c->idm_base) { -spin_lock (&iproc_i2c->idm_lock); +spin_lock_irqsave (&iproc_i2c->idm_lock, flags);writel (iproc_i2c->ape_addr_mask, iproc_i2c->idm_base +IDM_CTRL_DIRECT_OFFSET ); val =readl (iproc_i2c->base + offset); -spin_unlock (&iproc_i2c->idm_lock); +spin_unlock_irqrestore (&iproc_i2c->idm_lock, flags); }else { val =readl (iproc_i2c->base + offset); }
@@ -250,12 +251,14 @@ static inline u32 iproc_i2c_rd_reg(strucstatic inline void iproc_i2c_wr_reg (struct bcm_iproc_i2c_dev *iproc_i2c,u32 offset,u32 val) { +unsigned long flags; +if (iproc_i2c->idm_base) { -spin_lock (&iproc_i2c->idm_lock); +spin_lock_irqsave (&iproc_i2c->idm_lock, flags);writel (iproc_i2c->ape_addr_mask, iproc_i2c->idm_base +IDM_CTRL_DIRECT_OFFSET );writel (val, iproc_i2c->base + offset); -spin_unlock (&iproc_i2c->idm_lock); +spin_unlock_irqrestore (&iproc_i2c->idm_lock, flags); }else {writel (val, iproc_i2c->base + offset); }
Greg Kroah-Hartman
maintainerPATCH 94/234 i2c: hisi: Only handle the interrupt of the drivers transfer
In reply to Greg Kroah-HartmanFrom: Yicong Yang <[email protected]>
commit fff67c1b17ee093947bdcbac6f64d072e644159a upstream.
The controller may be shared with other port, for example the firmware. Handle the interrupt from other sources will cause crash since some data are not initialized. So only handle the interrupt of the driver's transfer and discard others.
--- drivers/i2c/busses/i2c-hisi.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/i2c/busses/i2c-hisi.c +8 -0
@@ -330,6 +330,14 @@ static irqreturn_t hisi_i2c_irq(int irq,struct hisi_i2c_controller *ctlr = context;u32 int_stat; +/* +* Don't handle the interrupt if cltr->completion is NULL. We may +* reach here because the interrupt is spurious or the transfer is +* started by another port (e.g. firmware) rather than us. +*/ +if (!ctlr->completion) +return IRQ_NONE ; + int_stat =readl (ctlr->iobase +HISI_I2C_INT_MSTAT );hisi_i2c_clear_int (ctlr, int_stat);if (!(int_stat &HISI_I2C_INT_ALL ))
Greg Kroah-Hartman
maintainerPATCH 95/234 i2c: tegra: Fix i2c-tegra DMA config option processing
In reply to Greg Kroah-HartmanFrom: Parker Newman <[email protected]>
commit 27ec43c77b5db780a56fc3a6d6de6bf2f74614f7 upstream.
Tegra processors prior to Tegra186 used APB DMA for I2C requiring CONFIG_TEGRA20_APB_DMA=y while Tegra186 and later use GPC DMA requiring CONFIG_TEGRA186_GPC_DMA=y.
The check for if the processor uses APB DMA is inverted and so the wrong DMA config options are checked.
This means if CONFIG_TEGRA20_APB_DMA=y but CONFIG_TEGRA186_GPC_DMA=n with a Tegra186 or later processor the driver will incorrectly think DMA is enabled and attempt to request DMA channels that will never be availible, leaving the driver in a perpetual EPROBE_DEFER state.
--- drivers/i2c/busses/i2c-tegra.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-tegra.c +1 -1
@@ -449,7 +449,7 @@ static int tegra_i2c_init_dma(struct tegif (i2c_dev->is_vi)return 0 ; -if (!i2c_dev->hw->has_apb_dma) { +if (i2c_dev->hw->has_apb_dma) {if (!IS_ENABLED (CONFIG_TEGRA20_APB_DMA )) {dev_dbg (i2c_dev->dev,"APB DMA support not enabled\n" );return 0 ;
Greg Kroah-Hartman
maintainerPATCH 96/234 blk-cgroup: hold queue_lock when removing blkg->q_node
In reply to Greg Kroah-HartmanFrom: Ming Lei <[email protected]>
commit c164c7bc9775be7bcc68754bb3431fce5823822e upstream.
When blkg is removed from q->blkg_list from blkg_free_workfn(), queue_lock has to be held, otherwise, all kinds of bugs(list corruption, hard lockup, ..) can be triggered from blkg_destroy_all().
--- block/blk-cgroup.c | 2 ++ 1 file changed, 2 insertions(+)
block/blk-cgroup.c +2 -0
@@ -136,7 +136,9 @@ static void blkg_free_workfn(struct work blkcg_policy[i]->pd_free_fn (blkg->pd[i]);if (blkg->parent)blkg_put (blkg->parent); +spin_lock_irq (&q->queue_lock);list_del_init (&blkg->q_node); +spin_unlock_irq (&q->queue_lock);mutex_unlock (&q->blkcg_mutex);blk_put_queue (q);
Greg Kroah-Hartman
maintainerPATCH 97/234 fbdev: mmp: fix value check in mmphw_probe()
In reply to Greg Kroah-HartmanFrom: Yuanjun Gong <[email protected]>
commit 0872b2c0abc0e84ac82472959c8e14e35277549c upstream.
in mmphw_probe(), check the return value of clk_prepare_enable() and return the error code if clk_prepare_enable() returns an unexpected value.
--- drivers/video/fbdev/mmp/hw/mmp_ctrl.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/video/fbdev/mmp/hw/mmp_ctrl.c +3 -1
@@ -519,7 +519,9 @@ static int mmphw_probe(struct platform_d "unable to get clk %s\n", mi->clk_name); goto failed; } -clk_prepare_enable (ctrl->clk); + ret =clk_prepare_enable (ctrl->clk); +if (ret) + goto failed;/* init global regs */ ctrl_set_default (ctrl);
Greg Kroah-Hartman
maintainerPATCH 98/234 media: mtk-jpeg: Set platform driver data earlier
In reply to Greg Kroah-HartmanFrom: Chen-Yu Tsai <[email protected]>
commit 8329d0c7355bfb7237baf09ec979c3e8144d2781 upstream.
In the multi-core JPEG encoder/decoder setup, the driver for the individual cores references the parent device's platform driver data. However, in the parent driver, this is only set at the end of the probe function, way later than devm_of_platform_populate(), which triggers the probe of the cores. This causes a kernel splat in the sub-device probe function.
Move platform_set_drvdata() to before devm_of_platform_populate() to fix this.
--- drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c +2 -2
@@ -1310,6 +1310,8 @@ static int mtk_jpeg_probe(struct platfor jpeg->dev = &pdev->dev; jpeg->variant =of_device_get_match_data (jpeg->dev); +platform_set_drvdata (pdev, jpeg); + ret =devm_of_platform_populate (&pdev->dev);if (ret) {v4l2_err (&jpeg->v4l2_dev,"Master of platform populate failed." );
@@ -1381,8 +1383,6 @@ static int mtk_jpeg_probe(struct platfor jpeg->variant->dev_name, jpeg->vdev->num, VIDEO_MAJOR, jpeg->vdev->minor); -platform_set_drvdata (pdev, jpeg); -pm_runtime_enable (&pdev->dev);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 99/234 powerpc/rtas_flash: allow user copy to flash block cache objects
In reply to Greg Kroah-HartmanFrom: Nathan Lynch <[email protected]>
commit 4f3175979e62de3b929bfa54a0db4b87d36257a7 upstream.
With hardened usercopy enabled (CONFIG_HARDENED_USERCOPY=y), using the /proc/powerpc/rtas/firmware_update interface to prepare a system firmware update yields a BUG():
kernel BUG at mm/usercopy.c:102!
Oops: Exception in kernel mode, sig: 5 [#1]
LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
Modules linked in:
CPU: 0 PID: 2232 Comm: dd Not tainted 6.5.0-rc3+ #2
Hardware name: IBM,8408-E8E POWER8E (raw) 0x4b0201 0xf000004 of:IBM,FW860.50 (SV860_146) hv:phyp pSeries
NIP: c0000000005991d0 LR: c0000000005991cc CTR: 0000000000000000
REGS: c0000000148c76a0 TRAP: 0700 Not tainted (6.5.0-rc3+)
MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 24002242 XER: 0000000c
CFAR: c0000000001fbd34 IRQMASK: 0
[ ... GPRs omitted ... ]
NIP usercopy_abort+0xa0/0xb0
LR usercopy_abort+0x9c/0xb0
Call Trace:
usercopy_abort+0x9c/0xb0 (unreliable)
__check_heap_object+0x1b4/0x1d0
__check_object_size+0x2d0/0x380
rtas_flash_write+0xe4/0x250
proc_reg_write+0xfc/0x160
vfs_write+0xfc/0x4e0
ksys_write+0x90/0x160
system_call_exception+0x178/0x320
system_call_common+0x160/0x2c4The blocks of the firmware image are copied directly from user memory to objects allocated from flash_block_cache, so flash_block_cache must be created using kmem_cache_create_usercopy() to mark it safe for user access.
--- arch/powerpc/kernel/rtas_flash.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/powerpc/kernel/rtas_flash.c +3 -3
@@ -709,9 +709,9 @@ static int __init rtas_flash_init(void)if (!rtas_validate_flash_data.buf)return -ENOMEM ; - flash_block_cache =kmem_cache_create ("rtas_flash_cache" , -RTAS_BLK_SIZE ,RTAS_BLK_SIZE ,0 , -NULL ); + flash_block_cache =kmem_cache_create_usercopy ("rtas_flash_cache" , +RTAS_BLK_SIZE ,RTAS_BLK_SIZE , +0 ,0 ,RTAS_BLK_SIZE ,NULL );if (!flash_block_cache) {printk (KERN_ERR "%s: failed to create block cache\n" , __func__);
Greg Kroah-Hartman
maintainerPATCH 100/234 vdpa: Add features attr to vdpa_nl_policy for nlattr length check
In reply to Greg Kroah-HartmanFrom: Lin Ma <[email protected]>
commit 79c8651587504ba263d2fd67fd4406240fb21f69 upstream.
The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute being described produces a valid nlattr pointer in info->attrs before entering into each handler in vdpa_nl_ops.
That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.
This patch adds the missing nla_policy for vdpa features attr to avoid such bugs.
Message-Id: <[email protected]>
--- drivers/vdpa/vdpa.c | 1 + 1 file changed, 1 insertion(+)
drivers/vdpa/vdpa.c +1 -0
@@ -1249,6 +1249,7 @@ static const struct nla_policy vdpa_nl_p [VDPA_ATTR_DEV_NET_CFG_MACADDR ] =NLA_POLICY_ETH_ADDR , /* virtio spec 1.1 section 5.1.4.1 for valid MTU range */ [VDPA_ATTR_DEV_NET_CFG_MTU] = NLA_POLICY_MIN(NLA_U16, 68), + [VDPA_ATTR_DEV_FEATURES] = { .type = NLA_U64 }, };static const struct genl_ops vdpa_nl_ops[] = {
Greg Kroah-Hartman
maintainerPATCH 101/234 vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check
In reply to Greg Kroah-HartmanFrom: Lin Ma <[email protected]>
commit b3003e1b54e057f5f3124e437b80c3bef26ed3fe upstream.
The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute being described produces a valid nlattr pointer in info->attrs before entering into each handler in vdpa_nl_ops.
That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.
This patch adds the missing nla_policy for vdpa queue index attr to avoid such bugs.
Message-Id: <[email protected]>
--- drivers/vdpa/vdpa.c | 1 + 1 file changed, 1 insertion(+)
drivers/vdpa/vdpa.c +1 -0
@@ -1249,6 +1249,7 @@ static const struct nla_policy vdpa_nl_p [VDPA_ATTR_DEV_NET_CFG_MACADDR] = NLA_POLICY_ETH_ADDR,/* virtio spec 1.1 section 5.1.4.1 for valid MTU range */ [VDPA_ATTR_DEV_NET_CFG_MTU] = NLA_POLICY_MIN(NLA_U16, 68), + [VDPA_ATTR_DEV_QUEUE_INDEX] = { .type = NLA_U32 }, [VDPA_ATTR_DEV_FEATURES] = { .type = NLA_U64 }, };
Greg Kroah-Hartman
maintainerPATCH 102/234 vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check
In reply to Greg Kroah-HartmanFrom: Lin Ma <[email protected]>
commit 5d6ba607d6cb5c58a4ddf33381e18c83dbb4098f upstream.
The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute being described produces a valid nlattr pointer in info->attrs before entering into each handler in vdpa_nl_ops.
That is to say, the missing part in vdpa_nl_policy may lead to illegal nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.
This patch adds the missing nla_policy for vdpa max vqp attr to avoid such bugs.
Message-Id: <[email protected]>
--- drivers/vdpa/vdpa.c | 1 + 1 file changed, 1 insertion(+)
drivers/vdpa/vdpa.c +1 -0
@@ -1247,6 +1247,7 @@ static const struct nla_policy vdpa_nl_p [VDPA_ATTR_MGMTDEV_DEV_NAME] = { .type = NLA_STRING }, [VDPA_ATTR_DEV_NAME] = { .type = NLA_STRING }, [VDPA_ATTR_DEV_NET_CFG_MACADDR] = NLA_POLICY_ETH_ADDR, + [VDPA_ATTR_DEV_NET_CFG_MAX_VQP] = { .type = NLA_U16 },/* virtio spec 1.1 section 5.1.4.1 for valid MTU range */ [VDPA_ATTR_DEV_NET_CFG_MTU] = NLA_POLICY_MIN(NLA_U16, 68), [VDPA_ATTR_DEV_QUEUE_INDEX] = { .type = NLA_U32 },
Greg Kroah-Hartman
maintainerPATCH 103/234 vdpa: Enable strict validation for netlinks ops
In reply to Greg Kroah-HartmanFrom: Dragos Tatulea <[email protected]>
commit f46c1e1620c6bbc9aad5693082efd1b80822e97c upstream.
The previous patches added the missing nla policies that were required for validation to work.
Now strict validation on netlink ops can be enabled. This patch does it.
Message-Id: <[email protected]>
--- drivers/vdpa/vdpa.c | 6 ------ 1 file changed, 6 deletions(-)
drivers/vdpa/vdpa.c +0 -6
@@ -1257,37 +1257,31 @@ static const struct nla_policy vdpa_nl_pstatic const struct genl_ops vdpa_nl_ops[] = { { .cmd =VDPA_CMD_MGMTDEV_GET , - .validate =GENL_DONT_VALIDATE_STRICT |GENL_DONT_VALIDATE_DUMP , .doit = vdpa_nl_cmd_mgmtdev_get_doit, .dumpit = vdpa_nl_cmd_mgmtdev_get_dumpit, }, { .cmd =VDPA_CMD_DEV_NEW , - .validate =GENL_DONT_VALIDATE_STRICT |GENL_DONT_VALIDATE_DUMP , .doit = vdpa_nl_cmd_dev_add_set_doit, .flags =GENL_ADMIN_PERM , }, { .cmd =VDPA_CMD_DEV_DEL , - .validate =GENL_DONT_VALIDATE_STRICT |GENL_DONT_VALIDATE_DUMP , .doit = vdpa_nl_cmd_dev_del_set_doit, .flags =GENL_ADMIN_PERM , }, { .cmd =VDPA_CMD_DEV_GET , - .validate =GENL_DONT_VALIDATE_STRICT |GENL_DONT_VALIDATE_DUMP , .doit = vdpa_nl_cmd_dev_get_doit, .dumpit = vdpa_nl_cmd_dev_get_dumpit, }, { .cmd =VDPA_CMD_DEV_CONFIG_GET , - .validate =GENL_DONT_VALIDATE_STRICT |GENL_DONT_VALIDATE_DUMP , .doit = vdpa_nl_cmd_dev_config_get_doit, .dumpit = vdpa_nl_cmd_dev_config_get_dumpit, }, { .cmd =VDPA_CMD_DEV_VSTATS_GET , - .validate =GENL_DONT_VALIDATE_STRICT |GENL_DONT_VALIDATE_DUMP , .doit = vdpa_nl_cmd_dev_stats_get_doit, .flags =GENL_ADMIN_PERM , },
Greg Kroah-Hartman
maintainerPATCH 104/234 smb3: display network namespace in debug information
In reply to Greg Kroah-HartmanFrom: Steve French <[email protected]>
commit 7b38f6ddc97bf572c3422d3175e8678dd95502fa upstream.
We recently had problems where a network namespace was deleted causing hard to debug reconnect problems. To help deal with configuration issues like this it is useful to dump the network namespace to better debug what happened.
So add this to information displayed in /proc/fs/cifs/DebugData for the server (and channels if mounted with multichannel). For example:
Local Users To Server: 1 SecMode: 0x1 Req On Wire: 0 Net namespace: 4026531840
This can be easily compared with what is displayed for the processes on the system. For example /proc/1/ns/net in this case showed the same thing (see below), and we can see that the namespace is still valid in this example.
'net:[4026531840]'
--- fs/smb/client/cifs_debug.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
fs/smb/client/cifs_debug.c +10 -0
@@ -153,6 +153,11 @@ cifs_dump_channel(struct seq_file *m, inin_flight (server),atomic_read (&server->in_send), atomic_read(&server->num_waiters)); +#ifdef CONFIG_NET_NS +if (server->net) +seq_printf (m," Net namespace: %u " , server->net->ns.inum); +#endif /* NET_NS */ + }static inline const char *smb_speed_to_str (size_t bps)
@@ -429,10 +434,15 @@ skip_rdma: server->reconnect_instance, server->srv_count, server->sec_mode, in_flight(server)); +#ifdef CONFIG_NET_NS +if (server->net) +seq_printf (m," Net namespace: %u " , server->net->ns.inum); +#endif /* NET_NS */ seq_printf (m,"\nIn Send: %d In MaxReq Wait: %d" ,atomic_read (&server->in_send),atomic_read (&server->num_waiters)); +if (server->leaf_fullpath) {seq_printf (m,"\nDFS leaf full path: %s" , server->leaf_fullpath);
Greg Kroah-Hartman
maintainerPATCH 105/234 tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
In reply to Greg Kroah-HartmanFrom: Yi Yang <[email protected]>
commit 3c4f8333b582487a2d1e02171f1465531cde53e3 upstream.
In commit 9b9c8195f3f0 ("tty: n_gsm: fix UAF in gsm_cleanup_mux"), the UAF problem is not completely fixed. There is a race condition in gsm_cleanup_mux(), which caused this UAF.
The UAF problem is triggered by the following race:
task[5046] task[5054]
----------------------- -----------------------gsm_cleanup_mux();
dlci = gsm->dlci[0];
mutex_lock(&gsm->mutex);
gsm_cleanup_mux();
dlci = gsm->dlci[0]; //Didn't take the lock
gsm_dlci_release(gsm->dlci[i]);
gsm->dlci[i] = NULL;
mutex_unlock(&gsm->mutex);
mutex_lock(&gsm->mutex);
dlci->dead = true; //UAFFix it by assigning values after mutex_lock().
--- drivers/tty/n_gsm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/tty/n_gsm.c +2 -1
@@ -3042,12 +3042,13 @@ static void gsm_error(struct gsm_mux *gsstatic void gsm_cleanup_mux (struct gsm_mux *gsm,bool disc) {int i; -struct gsm_dlci *dlci = gsm->dlci[0 ]; +struct gsm_dlci *dlci;struct gsm_msg *txq, *ntxq; gsm->dead = true;mutex_lock (&gsm->mutex); + dlci = gsm->dlci[0 ];if (dlci) {if (disc && dlci->state !=DLCI_CLOSED ) {gsm_dlci_begin_close (dlci);
Greg Kroah-Hartman
maintainerPATCH 106/234 tty: serial: fsl_lpuart: Clear the error flags by writing 1 for lpuart32 platforms
In reply to Greg Kroah-HartmanFrom: Sherry Sun <[email protected]>
commit 282069845af388b08d622ad192b831dcd0549c62 upstream.
Do not read the data register to clear the error flags for lpuart32 platforms, the additional read may cause the receive FIFO underflow since the DMA has already read the data register. Actually all lpuart32 platforms support write 1 to clear those error bits, let's use this method to better clear the error flags.
--- drivers/tty/serial/fsl_lpuart.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/tty/serial/fsl_lpuart.c +2 -2
@@ -1137,8 +1137,8 @@ static void lpuart_copy_rx_to_tty(structunsigned long sr =lpuart32_read (&sport->port,UARTSTAT );if (sr & (UARTSTAT_PE |UARTSTAT_FE )) { -/* Read DR to clear the error flags */ -lpuart32_read (&sport->port,UARTDATA ); +/* Clear the error flags */ +lpuart32_write (&sport->port, sr,UARTSTAT );if (sr &UARTSTAT_PE ) sport->port.icount.parity++;
Greg Kroah-Hartman
maintainerPATCH 107/234 btrfs: fix infinite directory reads
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 9b378f6ad48cfa195ed868db9123c09ee7ec5ea2 upstream.
The readdir implementation currently processes always up to the last index it finds. This however can result in an infinite loop if the directory has a large number of entries such that they won't all fit in the given buffer passed to the readdir callback, that is, dir_emit() returns a non-zero value. Because in that case readdir() will be called again and if in the meanwhile new directory entries were added and we still can't put all the remaining entries in the buffer, we keep repeating this over and over.
The following C program and test script reproduce the problem:
$ cat /mnt/readdir_prog.c #include <sys/types.h> #include <dirent.h> #include <stdio.h>
int main(int argc, char *argv[])
{
DIR *dir = opendir(".");
struct dirent *dd; while ((dd = readdir(dir))) {
printf("%s\n", dd->d_name);
rename(dd->d_name, "TEMPFILE");
rename("TEMPFILE", dd->d_name);
}
closedir(dir);}
$ gcc -o /mnt/readdir_prog /mnt/readdir_prog.c
$ cat test.sh #!/bin/bash
DEV=/dev/sdi
MNT=/mnt/sdi
mkfs.btrfs -f $DEV &> /dev/null
#mkfs.xfs -f $DEV &> /dev/null
#mkfs.ext4 -F $DEV &> /dev/null
mount $DEV $MNT
mkdir $MNT/testdir
for ((i = 1; i <= 2000; i++)); do
echo -n > $MNT/testdir/file_$i
done
cd $MNT/testdir
/mnt/readdir_prog
cd /mnt
umount $MNT
This behaviour is surprising to applications and it's unlike ext4, xfs, tmpfs, vfat and other filesystems, which always finish. In this case where new entries were added due to renames, some file names may be reported more than once, but this varies according to each filesystem - for example ext4 never reported the same file more than once while xfs reports the first 13 file names twice.
So change our readdir implementation to track the last index number when opendir() is called and then make readdir() never process beyond that index number. This gives the same behaviour as ext4.
--- fs/btrfs/ctree.h | 1 fs/btrfs/delayed-inode.c | 5 + fs/btrfs/delayed-inode.h | 1 fs/btrfs/inode.c | 131 ++++++++++++++++++++++++++++------------------- 4 files changed, 84 insertions(+), 54 deletions(-)
fs/btrfs/ctree.h +1 -0
@@ -443,6 +443,7 @@ struct btrfs_drop_extents_args {struct btrfs_file_private {void *filldir_buf; +u64 last_index;struct extent_state *llseek_cached_state; };
fs/btrfs/delayed-inode.c +3 -2
@@ -1632,6 +1632,7 @@ int btrfs_inode_delayed_dir_index_count( }bool btrfs_readdir_get_delayed_items (struct inode *inode, +u64 last_index,struct list_head *ins_list,struct list_head *del_list) {
@@ -1651,14 +1652,14 @@ bool btrfs_readdir_get_delayed_items(strmutex_lock (&delayed_node->mutex); item =__btrfs_first_delayed_insertion_item (delayed_node); -while (item) { +while (item && item->index <= last_index) {refcount_inc (&item->refs);list_add_tail (&item->readdir_list, ins_list); item =__btrfs_next_delayed_item (item); } item =__btrfs_first_delayed_deletion_item (delayed_node); -while (item) { +while (item && item->index <= last_index) {refcount_inc (&item->refs);list_add_tail (&item->readdir_list, del_list); item =__btrfs_next_delayed_item (item);
fs/btrfs/delayed-inode.h +1 -0
@@ -148,6 +148,7 @@ void btrfs_destroy_delayed_inodes(struct/* Used for readdir() */ bool btrfs_readdir_get_delayed_items (struct inode *inode, +u64 last_index,struct list_head *ins_list,struct list_head *del_list); void btrfs_readdir_put_delayed_items(struct inode *inode,
fs/btrfs/inode.c +79 -52
165 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 108/234 btrfs: fix incorrect splitting in btrfs_drop_extent_map_range
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit c962098ca4af146f2625ed64399926a098752c9c upstream.
In production we were seeing a variety of WARN_ON()'s in the extent_map code, specifically in btrfs_drop_extent_map_range() when we have to call add_extent_mapping() for our second split.
Consider the following extent map layout
PINNED [0 16K) [32K, 48K)
and then we call btrfs_drop_extent_map_range for [0, 36K), with skip_pinned == true. The initial loop will have
start = 0 end = 36K len = 36K
we will find the [0, 16k) extent, but since we are pinned we will skip it, which has this code
start = em_end; if (end != (u64)-1) len = start + len - em_end;
em_end here is 16K, so now the values are
start = 16K len = 16K + 36K - 16K = 36K
len should instead be 20K. This is a problem when we find the next extent at [32K, 48K), we need to split this extent to leave [36K, 48k), however the code for the split looks like this
split->start = start + len; split->len = em_end - (start + len);
In this case we have
em_end = 48K split->start = 16K + 36K // this should be 16K + 20K split->len = 48K - (16K + 36K) // this overflows as 16K + 36K is 52K
and now we have an invalid extent_map in the tree that potentially overlaps other entries in the extent map. Even in the non-overlapping case we will have split->start set improperly, which will cause problems with any block related calculations.
We don't actually need len in this loop, we can simply use end as our end point, and only adjust start up when we find a pinned extent we need to skip.
Adjust the logic to do this, which keeps us from inserting an invalid extent map.
We only skip_pinned in the relocation case, so this is relatively rare, except in the case where you are running relocation a lot, which can happen with auto relocation on.
--- fs/btrfs/extent_map.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
fs/btrfs/extent_map.c +2 -4
@@ -758,8 +758,6 @@ void btrfs_drop_extent_map_range(structif (skip_pinned &&test_bit (EXTENT_FLAG_PINNED , &em->flags)) { start = em_end; -if (end != (u64)-1 ) - len = start + len - em_end; goto next; }
@@ -827,8 +825,8 @@ void btrfs_drop_extent_map_range(structif (!split) goto remove_em; } - split->start = start + len; - split->len = em_end - (start + len); + split->start = end; + split->len = em_end - end; split->block_start = em->block_start; split->flags = flags; split->compress_type = em->compress_type;
Greg Kroah-Hartman
maintainerPATCH 109/234 btrfs: fix BUG_ON condition in btrfs_cancel_balance
In reply to Greg Kroah-HartmanFrom: xiaoshoukui <[email protected]>
commit 29eefa6d0d07e185f7bfe9576f91e6dba98189c2 upstream.
Pausing and canceling balance can race to interrupt balance lead to BUG_ON panic in btrfs_cancel_balance. The BUG_ON condition in btrfs_cancel_balance does not take this race scenario into account.
However, the race condition has no other side effects. We can fix that.
Reproducing it with panic trace like this:
kernel BUG at fs/btrfs/volumes.c:4618!
RIP: 0010:btrfs_cancel_balance+0x5cf/0x6a0 Call Trace: <TASK> ? do_nanosleep+0x60/0x120 ? hrtimer_nanosleep+0xb7/0x1a0 ? sched_core_clone_cookie+0x70/0x70 btrfs_ioctl_balance_ctl+0x55/0x70 btrfs_ioctl+0xa46/0xd20 __x64_sys_ioctl+0x7d/0xa0 do_syscall_64+0x38/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Race scenario as follows:
> mutex_unlock(&fs_info->balance_mutex);
> --------------------
> .......issue pause and cancel req in another thread
> --------------------
> ret = __btrfs_balance(fs_info);
>
> mutex_lock(&fs_info->balance_mutex);
> if (ret == -ECANCELED && atomic_read(&fs_info->balance_pause_req)) {
> btrfs_info(fs_info, "balance: paused");
> btrfs_exclop_balance(fs_info, BTRFS_EXCLOP_BALANCE_PAUSED);
> }--- fs/btrfs/volumes.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/btrfs/volumes.c +1 -2
@@ -4631,8 +4631,7 @@ int btrfs_cancel_balance(struct btrfs_fs } } -BUG_ON (fs_info->balance_ctl || -test_bit (BTRFS_FS_BALANCE_RUNNING , &fs_info->flags)); +ASSERT (!test_bit (BTRFS_FS_BALANCE_RUNNING , &fs_info->flags));atomic_dec (&fs_info->balance_cancel_req);mutex_unlock (&fs_info->balance_mutex);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 110/234 btrfs: fix replace/scrub failure with metadata_uuid
In reply to Greg Kroah-HartmanFrom: Anand Jain <[email protected]>
commit b471965fdb2daa225850e5972d86600992fa398e upstream.
Fstests with POST_MKFS_CMD="btrfstune -m" (as in the mailing list) reported a few of the test cases failing.
The failure scenario can be summarized and simplified as follows:
$ mkfs.btrfs -fq -draid1 -mraid1 /dev/sdb1 /dev/sdb2 :0
$ btrfstune -m /dev/sdb1 :0
$ wipefs -a /dev/sdb1 :0
$ mount -o degraded /dev/sdb2 /btrfs :0
$ btrfs replace start -B -f -r 1 /dev/sdb1 /btrfs :1
STDERR:
ERROR: ioctl(DEV_REPLACE_START) failed on "/btrfs": Input/output error[11290.583502] BTRFS warning (device sdb2): tree block 22036480 mirror 2 has bad fsid, has 99835c32-49f0-4668-9e66-dc277a96b4a6 want da40350c-33ac-4872-92a8-4948ed8c04d0 [11290.586580] BTRFS error (device sdb2): unable to fix up (regular) error at logical 22020096 on dev /dev/sdb8 physical 1048576
As above, the replace is failing because we are verifying the header with fs_devices::fsid instead of fs_devices::metadata_uuid, despite the metadata_uuid actually being present.
To fix this, use fs_devices::metadata_uuid. We copy fsid into fs_devices::metadata_uuid if there is no metadata_uuid, so its fine.
--- fs/btrfs/scrub.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/btrfs/scrub.c +2 -1
@@ -655,7 +655,8 @@ static void scrub_verify_one_metadata(st btrfs_stack_header_bytenr(header), logical);return ; } -if (memcmp (header->fsid, fs_info->fs_devices->fsid,BTRFS_FSID_SIZE ) !=0 ) { +if (memcmp (header->fsid, fs_info->fs_devices->metadata_uuid, +BTRFS_FSID_SIZE ) !=0 ) {bitmap_set (&stripe->meta_error_bitmap, sector_nr, sectors_per_tree);bitmap_set (&stripe->error_bitmap, sector_nr, sectors_per_tree); btrfs_warn_rl(fs_info,
Greg Kroah-Hartman
maintainerPATCH 111/234 btrfs: only subtract from len_to_oe_boundary when it is tracking an extent
In reply to Greg Kroah-HartmanFrom: Chris Mason <[email protected]>
commit 09c3717c3a60e3ef599bc17c70cd3ae2b979ad41 upstream.
bio_ctrl->len_to_oe_boundary is used to make sure we stay inside a zone as we submit bios for writes. Every time we add a page to the bio, we decrement those bytes from len_to_oe_boundary, and then we submit the bio if we happen to hit zero.
Most of the time, len_to_oe_boundary gets set to U32_MAX. submit_extent_page() adds pages into our bio, and the size of the bio ends up limited by:
- Are we contiguous on disk?
- Does bio_add_page() allow us to stuff more in?
- is len_to_oe_boundary > 0?
The len_to_oe_boundary math starts with U32_MAX, which isn't page or sector aligned, and subtracts from it until it hits zero. In the non-zoned case, the last IO we submit before we hit zero is going to be unaligned, triggering BUGs.
This is hard to trigger because bio_add_page() isn't going to make a bio of U32_MAX size unless you give it a perfect set of pages and fully contiguous extents on disk. We can hit it pretty reliably while making large swapfiles during provisioning because the machine is freshly booted, mostly idle, and the disk is freshly formatted. It's also possible to trigger with reads when read_ahead_kb is set to 4GB.
The code has been clean up and shifted around a few times, but this flaw has been lurking since the counter was added. I think the commit 24e6c8082208 ("btrfs: simplify main loop in submit_extent_page") ended up exposing the bug.
The fix used here is to skip doing math on len_to_oe_boundary unless we've changed it from the default U32_MAX value. bio_add_page() is the real limit we want, and there's no reason to do extra math when block layer is doing it for us.
Sample reproducer, note you'll need to change the path to the bdi and device:
SUBVOL=/btrfs/swapvol
SWAPFILE=$SUBVOL/swapfile
SZMB=8192
mkfs.btrfs -f /dev/vdb
mount /dev/vdb /btrfs
btrfs subvol create $SUBVOL
chattr +C $SUBVOL
dd if=/dev/zero of=$SWAPFILE bs=1M count=$SZMB
sync
echo 4 > /proc/sys/vm/drop_caches
echo 4194304 > /sys/class/bdi/btrfs-2/read_ahead_kb
while true; do
echo 1 > /proc/sys/vm/drop_caches
echo 1 > /proc/sys/vm/drop_caches
dd of=/dev/zero if=$SWAPFILE bs=4096M count=2 iflag=fullblock
done
--- fs/btrfs/extent_io.c | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-)
fs/btrfs/extent_io.c +24 -1
@@ -962,7 +962,30 @@ static void submit_extent_page(struct bt size -= len; pg_offset += len; disk_bytenr += len; - bio_ctrl->len_to_oe_boundary -= len; + +/* +* len_to_oe_boundary defaults to U32_MAX, which isn't page or +* sector aligned. alloc_new_bio() then sets it to the end of +* our ordered extent for writes into zoned devices. +* +* When len_to_oe_boundary is tracking an ordered extent, we +* trust the ordered extent code to align things properly, and +* the check above to cap our write to the ordered extent +* boundary is correct. +* +* When len_to_oe_boundary is U32_MAX, the cap above would +* result in a 4095 byte IO for the last page right before +* we hit the bio limit of UINT_MAX. bio_add_page() has all +* the checks required to make sure we don't overflow the bio, +* and we should just ignore len_to_oe_boundary completely +* unless we're using it to track an ordered extent. +* +* It's pretty hard to make a bio sized U32_MAX, but it can +* happen when the page cache is able to feed us contiguous +* pages for large extents. +*/ +if (bio_ctrl->len_to_oe_boundary !=U32_MAX ) + bio_ctrl->len_to_oe_boundary -= len;/* Ordered extent boundary: move on to a new bio. */ if (bio_ctrl->len_to_oe_boundary ==0 )
Greg Kroah-Hartman
maintainerPATCH 112/234 i2c: designware: Correct length byte validation logic
In reply to Greg Kroah-HartmanFrom: Quan Nguyen <[email protected]>
commit 49d4db3953cb9004ff94efc0c176e026c820af5a upstream.
Commit 0daede80f870 ("i2c: designware: Convert driver to using regmap API") changes the logic to validate the whole 32-bit return value of DW_IC_DATA_CMD register instead of 8-bit LSB without reason.
Later, commit f53f15ba5a85 ("i2c: designware: Get right data length"), introduced partial fix but not enough because the "tmp > 0" still test tmp as 32-bit value and is wrong in case the IC_DATA_CMD[11] is set.
Revert the logic to just before commit 0daede80f870 ("i2c: designware: Convert driver to using regmap API").
--- drivers/i2c/busses/i2c-designware-master.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-designware-master.c +2 -1
@@ -526,9 +526,10 @@ i2c_dw_read(struct dw_i2c_dev *dev)u32 flags = msgs[dev->msg_read_idx].flags;regmap_read (dev->map,DW_IC_DATA_CMD , &tmp); + tmp &=DW_IC_DATA_CMD_DAT ;/* Ensure length byte is a valid value */ if (flags &I2C_M_RECV_LEN && - (tmp &DW_IC_DATA_CMD_DAT ) <=I2C_SMBUS_BLOCK_MAX && tmp >0 ) { + tmp <=I2C_SMBUS_BLOCK_MAX && tmp >0 ) { len =i2c_dw_recv_len (dev, tmp); } *buf++ = tmp;
Greg Kroah-Hartman
maintainerPATCH 113/234 i2c: designware: Handle invalid SMBus block data response length value
In reply to Greg Kroah-HartmanFrom: Tam Nguyen <[email protected]>
commit 69f035c480d76f12bf061148ccfd578e1099e5fc upstream.
In the I2C_FUNC_SMBUS_BLOCK_DATA case, the invalid length byte value (outside of 1-32) of the SMBus block data response from the Slave device is not correctly handled by the I2C Designware driver.
In case IC_EMPTYFIFO_HOLD_MASTER_EN==1, which cannot be detected from the registers, the Master can be disabled only if the STOP bit is set. Without STOP bit set, the Master remains active, holding the bus until receiving a block data response length. This hangs the bus and is unrecoverable.
Avoid this by issuing another dump read to reach the stop condition when an invalid length byte is received.
--- drivers/i2c/busses/i2c-designware-master.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-designware-master.c +13 -2
@@ -528,8 +528,19 @@ i2c_dw_read(struct dw_i2c_dev *dev)regmap_read (dev->map,DW_IC_DATA_CMD , &tmp); tmp &=DW_IC_DATA_CMD_DAT ;/* Ensure length byte is a valid value */ -if (flags &I2C_M_RECV_LEN && - tmp <=I2C_SMBUS_BLOCK_MAX && tmp >0 ) { +if (flags &I2C_M_RECV_LEN ) { +/* +* if IC_EMPTYFIFO_HOLD_MASTER_EN is set, which cannot be +* detected from the registers, the controller can be +* disabled if the STOP bit is set. But it is only set +* after receiving block data response length in +* I2C_FUNC_SMBUS_BLOCK_DATA case. That needs to read +* another byte with STOP bit set when the block data +* response length is invalid to complete the transaction. +*/ +if (!tmp || tmp >I2C_SMBUS_BLOCK_MAX ) + tmp =1 ; + len =i2c_dw_recv_len (dev, tmp); } *buf++ = tmp;
Greg Kroah-Hartman
maintainerPATCH 114/234 x86/cpu: Fix __x86_return_thunk symbol type
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
commit 77f67119004296a9b2503b377d610e08b08afc2a upstream.
Commit
fb3bd914b3ec ("x86/srso: Add a Speculative RAS Overflow mitigation")
reimplemented __x86_return_thunk with a mix of SYM_FUNC_START and SYM_CODE_END, this is not a sane combination.
Since nothing should ever actually 'CALL' this, make it consistently CODE.
--- arch/x86/lib/retpoline.S | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/x86/lib/retpoline.S +3 -1
@@ -264,7 +264,9 @@ SYM_CODE_END(srso_safe_ret) SYM_FUNC_END(srso_untrain_ret) __EXPORT_THUNK(srso_untrain_ret) -SYM_FUNC_START(__x86_return_thunk) +SYM_CODE_START(__x86_return_thunk) + UNWIND_HINT_FUNC + ANNOTATE_NOENDBR ALTERNATIVE_2 "jmp __ret", "call srso_safe_ret", X86_FEATURE_SRSO, \ "call srso_safe_ret_alias", X86_FEATURE_SRSO_ALIAS int3
Greg Kroah-Hartman
maintainerPATCH 115/234 x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk()
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
commit af023ef335f13c8b579298fc432daeef609a9e60 upstream.
vmlinux.o: warning: objtool: srso_untrain_ret() falls through to next function __x86_return_skl() vmlinux.o: warning: objtool: __x86_return_thunk() falls through to next function __x86_return_skl()
This is because these functions (can) end with CALL, which objtool does not consider a terminating instruction. Therefore, replace the INT3 instruction (which is a non-fatal trap) with UD2 (which is a fatal-trap).
This indicates execution will not continue past this point.
--- arch/x86/lib/retpoline.S | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/lib/retpoline.S +2 -2
@@ -259,7 +259,7 @@ SYM_INNER_LABEL(srso_safe_ret, SYM_L_GLO int3 lfence call srso_safe_ret - int3 + ud2 SYM_CODE_END(srso_safe_ret) SYM_FUNC_END(srso_untrain_ret) __EXPORT_THUNK(srso_untrain_ret)
@@ -269,7 +269,7 @@ SYM_CODE_START(__x86_return_thunk) ANNOTATE_NOENDBR ALTERNATIVE_2 "jmp __ret", "call srso_safe_ret", X86_FEATURE_SRSO, \ "call srso_safe_ret_alias", X86_FEATURE_SRSO_ALIAS - int3 + ud2 SYM_CODE_END(__x86_return_thunk) EXPORT_SYMBOL(__x86_return_thunk)
Greg Kroah-Hartman
maintainerPATCH 116/234 objtool/x86: Fix SRSO mess
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
commit 4ae68b26c3ab5a82aa271e6e9fc9b1a06e1d6b40 upstream.
Objtool --rethunk does two things:
- it collects all (tail) call's of __x86_return_thunk and places them into .return_sites. These are typically compiler generated, but RET also emits this same.
- it fudges the validation of the __x86_return_thunk symbol; because this symbol is inside another instruction, it can't actually find the instruction pointed to by the symbol offset and gets upset.
Because these two things pertained to the same symbol, there was no pressing need to separate these two separate things.
However, alas, along comes SRSO and more crazy things to deal with appeared.
The SRSO patch itself added the following symbol names to identify as rethunk:
'srso_untrain_ret', 'srso_safe_ret' and '__ret'
Where '__ret' is the old retbleed return thunk, 'srso_safe_ret' is a new similarly embedded return thunk, and 'srso_untrain_ret' is completely unrelated to anything the above does (and was only included because of that INT3 vs UD2 issue fixed previous).
Clear things up by adding a second category for the embedded instruction thing.
--- tools/objtool/arch/x86/decode.c | 11 +++++++---- tools/objtool/check.c | 24 ++++++++++++++++++++++-- tools/objtool/include/objtool/arch.h | 1 + tools/objtool/include/objtool/elf.h | 1 + 4 files changed, 31 insertions(+), 6 deletions(-)
tools/objtool/arch/x86/decode.c +7 -4
@@ -824,8 +824,11 @@ bool arch_is_retpoline(struct symbol *sybool arch_is_rethunk (struct symbol *sym) { -return !strcmp (sym->name,"__x86_return_thunk" ) || - !strcmp (sym->name,"srso_untrain_ret" ) || - !strcmp (sym->name,"srso_safe_ret" ) || - !strcmp (sym->name,"__ret" ); +return !strcmp (sym->name,"__x86_return_thunk" ); +} + +bool arch_is_embedded_insn (struct symbol *sym) +{ +return !strcmp (sym->name,"__ret" ) || + !strcmp (sym->name,"srso_safe_ret" ); }
tools/objtool/check.c +22 -2
@@ -495,7 +495,7 @@ static int decode_instructions(struct obreturn -1 ; } -if (func->return_thunk || func->alias != func) +if (func->embedded_insn || func->alias != func)continue ;if (!find_insn (file, sec, func->offset)) {
@@ -1346,16 +1346,33 @@ static int add_ignore_alternatives(strucreturn 0 ; } +/* +* Symbols that replace INSN_CALL_DYNAMIC, every (tail) call to such a symbol +* will be added to the .retpoline_sites section. +*/ __weak bool arch_is_retpoline (struct symbol *sym) {return false; } +/* +* Symbols that replace INSN_RETURN, every (tail) call to such a symbol +* will be added to the .return_sites section. +*/ __weak bool arch_is_rethunk (struct symbol *sym) {return false; } +/* +* Symbols that are embedded inside other instructions, because sometimes crazy +* code exists. These are mostly ignored for validation purposes. +*/ +__weak bool arch_is_embedded_insn (struct symbol *sym) +{ +return false; +} +static struct reloc *insn_reloc (struct objtool_file *file,struct instruction *insn) {struct reloc *reloc;
@@ -1645,7 +1662,7 @@ static int add_jump_destinations(struct* middle of another instruction. Objtool only * knows about the outer instruction. */ -if (sym && sym->return_thunk) { +if (sym && sym->embedded_insn) {add_return_call (file, insn, false);continue ; }
@@ -2550,6 +2567,9 @@ static int classify_symbols(struct objtoif (arch_is_rethunk (func)) func->return_thunk = true; +if (arch_is_embedded_insn (func)) + func->embedded_insn = true; +if (arch_ftrace_match (func->name)) func->fentry = true;
tools/objtool/include/objtool/arch.h +1 -0
@@ -90,6 +90,7 @@ int arch_decode_hint_reg(u8 sp_reg, intbool arch_is_retpoline (struct symbol *sym);bool arch_is_rethunk (struct symbol *sym); +bool arch_is_embedded_insn (struct symbol *sym);int arch_rewrite_retpolines (struct objtool_file *file);
tools/objtool/include/objtool/elf.h +1 -0
@@ -61,6 +61,7 @@ struct symbol { u8 return_thunk : 1; u8 fentry : 1; u8 profiling_func : 1; + u8 embedded_insn : 1;struct list_head pv_target;struct list_head reloc_list; };
Greg Kroah-Hartman
maintainerPATCH 117/234 x86/alternative: Make custom return thunk unconditional
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
commit 095b8303f3835c68ac4a8b6d754ca1c3b6230711 upstream.
There is infrastructure to rewrite return thunks to point to any random thunk one desires, unwrap that from CALL_THUNKS, which up to now was the sole user of that.
[ bp: Make the thunks visible on 32-bit and add ifdeffery for the
32-bit builds. ]
--- arch/x86/include/asm/nospec-branch.h | 9 +++++---- arch/x86/kernel/alternative.c | 4 ---- arch/x86/kernel/cpu/bugs.c | 2 ++ 3 files changed, 7 insertions(+), 8 deletions(-)
arch/x86/include/asm/nospec-branch.h +5 -4
@@ -337,17 +337,18 @@ extern retpoline_thunk_t __x86_indirect_extern retpoline_thunk_t __x86_indirect_call_thunk_array[];extern retpoline_thunk_t __x86_indirect_jump_thunk_array[]; +#ifdef CONFIG_RETHUNK extern void __x86_return_thunk (void ); +#else +static inline void __x86_return_thunk (void ) {} +#endif +extern void zen_untrain_ret (void );extern void srso_untrain_ret (void );extern void srso_untrain_ret_alias (void );extern void entry_ibpb (void ); -#ifdef CONFIG_CALL_THUNKS extern void (*x86_return_thunk)(void ); -#else -#define x86_return_thunk (&__x86_return_thunk) -#endif #ifdef CONFIG_CALL_DEPTH_TRACKING extern void __x86_return_skl (void );
arch/x86/kernel/alternative.c +0 -4
@@ -571,10 +571,6 @@ void __init_or_module noinline apply_ret#ifdef CONFIG_RETHUNK -#ifdef CONFIG_CALL_THUNKS -void (*x86_return_thunk)(void )__ro_after_init = &__x86_return_thunk; -#endif -/* * Rewrite the compiler generated return thunk tail-calls. *
arch/x86/kernel/cpu/bugs.c +2 -0
@@ -63,6 +63,8 @@ EXPORT_SYMBOL_GPL(x86_pred_cmd);static DEFINE_MUTEX (spec_ctrl_mutex); +void (*x86_return_thunk)(void )__ro_after_init = &__x86_return_thunk; +/* Update SPEC_CTRL MSR and its cached copy unconditionally */ static void update_spec_ctrl (u64 val) {
Greg Kroah-Hartman
maintainerPATCH 118/234 x86/cpu: Clean up SRSO return thunk mess
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
commit d43490d0ab824023e11d0b57d0aeec17a6e0ca13 upstream.
Use the existing configurable return thunk. There is absolute no justification for having created this __x86_return_thunk alternative.
To clarify, the whole thing looks like:
Zen3/4 does:
srso_alias_untrain_ret:
nop2
lfence
jmp srso_alias_return_thunk
int3
srso_alias_safe_ret: // aliasses srso_alias_untrain_ret just so
add $8, %rsp ret int3
srso_alias_return_thunk:
call srso_alias_safe_ret ud2
While Zen1/2 does:
srso_untrain_ret:
movabs $foo, %rax
lfence
call srso_safe_ret (jmp srso_return_thunk ?)
int3
srso_safe_ret: // embedded in movabs instruction
add $8,%rsp
ret
int3 srso_return_thunk:
call srso_safe_ret ud2
While retbleed does:
zen_untrain_ret:
test $0xcc, %bl
lfence
jmp zen_return_thunk
int3 zen_return_thunk: // embedded in the test instruction
ret
int3
Where Zen1/2 flush the BTB entry using the instruction decoder trick (test,movabs) Zen3/4 use BTB aliasing. SRSO adds a return sequence (srso_safe_ret()) which forces the function return instruction to speculate into a trap (UD2). This RET will then mispredict and execution will continue at the return site read from the top of the stack.
Pick one of three options at boot (evey function can only ever return once).
[ bp: Fixup commit message uarch details and add them in a comment in
the code too. Add a comment about the srso_select_mitigation() dependency on retbleed_select_mitigation(). Add moar ifdeffery for 32-bit builds. Add a dummy srso_untrain_ret_alias() definition for 32-bit alternatives needing the symbol. ]
--- arch/x86/include/asm/nospec-branch.h | 5 +++ arch/x86/kernel/cpu/bugs.c | 17 ++++++++-- arch/x86/kernel/vmlinux.lds.S | 4 +- arch/x86/lib/retpoline.S | 58 +++++++++++++++++++++++++---------- tools/objtool/arch/x86/decode.c | 2 - 5 files changed, 64 insertions(+), 22 deletions(-)
arch/x86/include/asm/nospec-branch.h +5 -0
@@ -343,9 +343,14 @@ extern void __x86_return_thunk(void);static inline void __x86_return_thunk (void ) {}#endif +extern void zen_return_thunk (void ); +extern void srso_return_thunk (void ); +extern void srso_alias_return_thunk (void ); +extern void zen_untrain_ret (void );extern void srso_untrain_ret (void );extern void srso_untrain_ret_alias (void ); +extern void entry_ibpb (void );extern void (*x86_return_thunk)(void );
arch/x86/kernel/cpu/bugs.c +14 -3
@@ -167,8 +167,13 @@ void __init cpu_select_mitigations(void)md_clear_select_mitigation ();srbds_select_mitigation ();l1d_flush_select_mitigation (); -gds_select_mitigation (); + +/* +* srso_select_mitigation() depends and must run after +* retbleed_select_mitigation(). +*/ srso_select_mitigation (); +gds_select_mitigation (); }/*
@@ -1037,6 +1042,9 @@ do_cmd_auto:setup_force_cpu_cap (X86_FEATURE_RETHUNK );setup_force_cpu_cap (X86_FEATURE_UNRET ); +if (IS_ENABLED (CONFIG_RETHUNK )) + x86_return_thunk = zen_return_thunk; +if (boot_cpu_data.x86_vendor !=X86_VENDOR_AMD && boot_cpu_data.x86_vendor !=X86_VENDOR_HYGON )pr_err (RETBLEED_UNTRAIN_MSG );
@@ -2451,10 +2459,13 @@ static void __init srso_select_mitigatio*/ setup_force_cpu_cap (X86_FEATURE_RETHUNK ); -if (boot_cpu_data.x86 ==0x19 ) +if (boot_cpu_data.x86 ==0x19 ) {setup_force_cpu_cap (X86_FEATURE_SRSO_ALIAS ); -else + x86_return_thunk = srso_alias_return_thunk; + }else {setup_force_cpu_cap (X86_FEATURE_SRSO ); + x86_return_thunk = srso_return_thunk; + } srso_mitigation =SRSO_MITIGATION_SAFE_RET ; }else {pr_err ("WARNING: kernel not compiled with CPU_SRSO.\n" );
arch/x86/kernel/vmlinux.lds.S +2 -2
@@ -522,8 +522,8 @@ INIT_PER_CPU(irq_stack_backing_store); "fixed_percpu_data is not at start of per-cpu area"); #endif - #ifdef CONFIG_RETHUNK -. = ASSERT((__ret & 0x3f) == 0, "__ret not cacheline-aligned"); +#ifdef CONFIG_RETHUNK +. = ASSERT((zen_return_thunk & 0x3f) == 0, "zen_return_thunk not cacheline-aligned"); . = ASSERT((srso_safe_ret & 0x3f) == 0, "srso_safe_ret not cacheline-aligned"); #endif
arch/x86/lib/retpoline.S +42 -16
140 lines not on this page · raw message
tools/objtool/arch/x86/decode.c +1 -1
@@ -829,6 +829,6 @@ bool arch_is_rethunk(struct symbol *sym)bool arch_is_embedded_insn (struct symbol *sym) { -return !strcmp (sym->name,"__ret" ) || +return !strcmp (sym->name,"zen_return_thunk" ) || !strcmp (sym->name,"srso_safe_ret" ); }
Greg Kroah-Hartman
maintainerPATCH 119/234 x86/cpu: Rename original retbleed methods
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
commit d025b7bac07a6e90b6b98b487f88854ad9247c39 upstream.
Rename the original retbleed return thunk and untrain_ret to retbleed_return_thunk() and retbleed_untrain_ret().
No functional changes.
--- arch/x86/include/asm/nospec-branch.h | 8 ++++---- arch/x86/kernel/cpu/bugs.c | 2 +- arch/x86/kernel/vmlinux.lds.S | 2 +- arch/x86/lib/retpoline.S | 30 +++++++++++++++--------------- tools/objtool/arch/x86/decode.c | 2 +- tools/objtool/check.c | 2 +- 6 files changed, 23 insertions(+), 23 deletions(-)
arch/x86/include/asm/nospec-branch.h +4 -4
@@ -268,7 +268,7 @@ .endm#ifdef CONFIG_CPU_UNRET_ENTRY -#define CALL_ZEN_UNTRAIN_RET "call zen_untrain_ret" +#define CALL_ZEN_UNTRAIN_RET "call retbleed_untrain_ret"#else #define CALL_ZEN_UNTRAIN_RET ""#endif
@@ -278,7 +278,7 @@* return thunk isn't mapped into the userspace tables (then again, AMD * typically has NO_MELTDOWN). * -* While zen_untrain_ret() doesn't clobber anything but requires stack, +* While retbleed_untrain_ret() doesn't clobber anything but requires stack, * entry_ibpb() will clobber AX, CX, DX. * * As such, this must be placed after every *SWITCH_TO_KERNEL_CR3 at a point
@@ -343,11 +343,11 @@ extern void __x86_return_thunk(void);static inline void __x86_return_thunk (void ) {}#endif -extern void zen_return_thunk (void ); +extern void retbleed_return_thunk (void );extern void srso_return_thunk (void );extern void srso_alias_return_thunk (void ); -extern void zen_untrain_ret (void ); +extern void retbleed_untrain_ret (void );extern void srso_untrain_ret (void );extern void srso_untrain_ret_alias (void );
arch/x86/kernel/cpu/bugs.c +1 -1
@@ -1043,7 +1043,7 @@ do_cmd_auto:setup_force_cpu_cap (X86_FEATURE_UNRET );if (IS_ENABLED (CONFIG_RETHUNK )) - x86_return_thunk = zen_return_thunk; + x86_return_thunk = retbleed_return_thunk;if (boot_cpu_data.x86_vendor !=X86_VENDOR_AMD && boot_cpu_data.x86_vendor !=X86_VENDOR_HYGON )
arch/x86/kernel/vmlinux.lds.S +1 -1
@@ -523,7 +523,7 @@ INIT_PER_CPU(irq_stack_backing_store); #endif #ifdef CONFIG_RETHUNK -. = ASSERT((zen_return_thunk & 0x3f) == 0, "zen_return_thunk not cacheline-aligned"); +. = ASSERT((retbleed_return_thunk & 0x3f) == 0, "retbleed_return_thunk not cacheline-aligned"); . = ASSERT((srso_safe_ret & 0x3f) == 0, "srso_safe_ret not cacheline-aligned"); #endif
arch/x86/lib/retpoline.S +15 -15
@@ -188,32 +188,32 @@ SYM_CODE_END(srso_alias_return_thunk) /* * Safety details here pertain to the AMD Zen{1,2} microarchitecture: - * 1) The RET at zen_return_thunk must be on a 64 byte boundary, for + * 1) The RET at retbleed_return_thunk must be on a 64 byte boundary, for * alignment within the BTB. - * 2) The instruction at zen_untrain_ret must contain, and not + * 2) The instruction at retbleed_untrain_ret must contain, and not * end with, the 0xc3 byte of the RET. * 3) STIBP must be enabled, or SMT disabled, to prevent the sibling thread * from re-poisioning the BTB prediction. */ .align 64 - .skip 64 - (zen_return_thunk - zen_untrain_ret), 0xcc -SYM_START(zen_untrain_ret, SYM_L_GLOBAL, SYM_A_NONE) + .skip 64 - (retbleed_return_thunk - retbleed_untrain_ret), 0xcc +SYM_START(retbleed_untrain_ret, SYM_L_GLOBAL, SYM_A_NONE) ANNOTATE_NOENDBR /* - * As executed from zen_untrain_ret, this is: + * As executed from retbleed_untrain_ret, this is: * * TEST $0xcc, %bl * LFENCE - * JMP zen_return_thunk + * JMP retbleed_return_thunk * * Executing the TEST instruction has a side effect of evicting any BTB * prediction (potentially attacker controlled) attached to the RET, as - * zen_return_thunk + 1 isn't an instruction boundary at the moment. + * retbleed_return_thunk + 1 isn't an instruction boundary at the moment. */ .byte 0xf6 /* - * As executed from zen_return_thunk, this is a plain RET. + * As executed from retbleed_return_thunk, this is a plain RET. * * As part of the TEST above, RET is the ModRM byte, and INT3 the imm8. *
@@ -225,13 +225,13 @@ SYM_START(zen_untrain_ret, SYM_L_GLOBAL, * With SMT enabled and STIBP active, a sibling thread cannot poison * RET's prediction to a type of its choice, but can evict the * prediction due to competitive sharing. If the prediction is - * evicted, zen_return_thunk will suffer Straight Line Speculation + * evicted, retbleed_return_thunk will suffer Straight Line Speculation * which will be contained safely by the INT3. */ -SYM_INNER_LABEL(zen_return_thunk, SYM_L_GLOBAL) +SYM_INNER_LABEL(retbleed_return_thunk, SYM_L_GLOBAL) ret int3 -SYM_CODE_END(zen_return_thunk) +SYM_CODE_END(retbleed_return_thunk) /* * Ensure the TEST decoding / BTB invalidation is complete.
@@ -242,13 +242,13 @@ SYM_CODE_END(zen_return_thunk) * Jump back and execute the RET in the middle of the TEST instruction. * INT3 is for SLS protection. */ - jmp zen_return_thunk + jmp retbleed_return_thunk int3 -SYM_FUNC_END(zen_untrain_ret) -__EXPORT_THUNK(zen_untrain_ret) +SYM_FUNC_END(retbleed_untrain_ret) +__EXPORT_THUNK(retbleed_untrain_ret) /* - * SRSO untraining sequence for Zen1/2, similar to zen_untrain_ret() + * SRSO untraining sequence for Zen1/2, similar to retbleed_untrain_ret() * above. On kernel entry, srso_untrain_ret() is executed which is a * * movabs $0xccccccc308c48348,%rax
tools/objtool/arch/x86/decode.c +1 -1
@@ -829,6 +829,6 @@ bool arch_is_rethunk(struct symbol *sym)bool arch_is_embedded_insn (struct symbol *sym) { -return !strcmp (sym->name,"zen_return_thunk" ) || +return !strcmp (sym->name,"retbleed_return_thunk" ) || !strcmp (sym->name,"srso_safe_ret" ); }
tools/objtool/check.c +1 -1
@@ -1655,7 +1655,7 @@ static int add_jump_destinations(structstruct symbol *sym =find_symbol_by_offset (dest_sec, dest_off);/* -* This is a special case for zen_untrain_ret(). +* This is a special case for retbleed_untrain_ret(). * It jumps to __x86_return_thunk(), but objtool * can't find the thunk's starting RET * instruction, because the RET is also in the
Greg Kroah-Hartman
maintainerPATCH 120/234 x86/cpu: Rename srso_(.*)_alias to srso_alias_\1
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
commit 42be649dd1f2eee6b1fb185f1a231b9494cf095f upstream.
For a more consistent namespace.
[ bp: Fixup names in the doc too. ]
--- Documentation/admin-guide/hw-vuln/srso.rst | 4 ++-- arch/x86/include/asm/nospec-branch.h | 6 +++--- arch/x86/kernel/vmlinux.lds.S | 8 ++++---- arch/x86/lib/retpoline.S | 26 +++++++++++++------------- 4 files changed, 22 insertions(+), 22 deletions(-)
Documentation/admin-guide/hw-vuln/srso.rst +2 -2
@@ -124,8 +124,8 @@ sequence. To ensure the safety of this mitigation, the kernel must ensure that the safe return sequence is itself free from attacker interference. In Zen3 and Zen4, this is accomplished by creating a BTB alias between the -untraining function srso_untrain_ret_alias() and the safe return -function srso_safe_ret_alias() which results in evicting a potentially +untraining function srso_alias_untrain_ret() and the safe return +function srso_alias_safe_ret() which results in evicting a potentially poisoned BTB entry and using that safe one for all function returns. In older Zen1 and Zen2, this is accomplished using a reinterpretation
arch/x86/include/asm/nospec-branch.h +3 -3
@@ -296,7 +296,7 @@#ifdef CONFIG_CPU_SRSO ALTERNATIVE_2 "" ,"call srso_untrain_ret" ,X86_FEATURE_SRSO , \ -"call srso_untrain_ret_alias" ,X86_FEATURE_SRSO_ALIAS +"call srso_alias_untrain_ret" ,X86_FEATURE_SRSO_ALIAS #endif .endm
@@ -312,7 +312,7 @@#ifdef CONFIG_CPU_SRSO ALTERNATIVE_2 "" ,"call srso_untrain_ret" ,X86_FEATURE_SRSO , \ -"call srso_untrain_ret_alias" ,X86_FEATURE_SRSO_ALIAS +"call srso_alias_untrain_ret" ,X86_FEATURE_SRSO_ALIAS #endif .endm
@@ -349,7 +349,7 @@ extern void srso_alias_return_thunk(voidextern void retbleed_untrain_ret (void );extern void srso_untrain_ret (void ); -extern void srso_untrain_ret_alias (void ); +extern void srso_alias_untrain_ret (void );extern void entry_ibpb (void );
arch/x86/kernel/vmlinux.lds.S +4 -4
@@ -149,10 +149,10 @@ SECTIONS #ifdef CONFIG_CPU_SRSO /* - * See the comment above srso_untrain_ret_alias()'s + * See the comment above srso_alias_untrain_ret()'s * definition. */ - . = srso_untrain_ret_alias | (1 << 2) | (1 << 8) | (1 << 14) | (1 << 20); + . = srso_alias_untrain_ret | (1 << 2) | (1 << 8) | (1 << 14) | (1 << 20); *(.text.__x86.rethunk_safe) #endif ALIGN_ENTRY_TEXT_END
@@ -538,8 +538,8 @@ INIT_PER_CPU(irq_stack_backing_store); * Instead do: (A | B) - (A & B) in order to compute the XOR * of the two function addresses: */ -. = ASSERT(((ABSOLUTE(srso_untrain_ret_alias) | srso_safe_ret_alias) - - (ABSOLUTE(srso_untrain_ret_alias) & srso_safe_ret_alias)) == ((1 << 2) | (1 << 8) | (1 << 14) | (1 << 20)), +. = ASSERT(((ABSOLUTE(srso_alias_untrain_ret) | srso_alias_safe_ret) - + (ABSOLUTE(srso_alias_untrain_ret) & srso_alias_safe_ret)) == ((1 << 2) | (1 << 8) | (1 << 14) | (1 << 20)), "SRSO function pair won't alias"); #endif
arch/x86/lib/retpoline.S +13 -13
@@ -133,56 +133,56 @@ SYM_CODE_END(__x86_indirect_jump_thunk_a #ifdef CONFIG_RETHUNK /* - * srso_untrain_ret_alias() and srso_safe_ret_alias() are placed at + * srso_alias_untrain_ret() and srso_alias_safe_ret() are placed at * special addresses: * - * - srso_untrain_ret_alias() is 2M aligned - * - srso_safe_ret_alias() is also in the same 2M page but bits 2, 8, 14 + * - srso_alias_untrain_ret() is 2M aligned + * - srso_alias_safe_ret() is also in the same 2M page but bits 2, 8, 14 * and 20 in its virtual address are set (while those bits in the - * srso_untrain_ret_alias() function are cleared). + * srso_alias_untrain_ret() function are cleared). * * This guarantees that those two addresses will alias in the branch * target buffer of Zen3/4 generations, leading to any potential * poisoned entries at that BTB slot to get evicted. * - * As a result, srso_safe_ret_alias() becomes a safe return. + * As a result, srso_alias_safe_ret() becomes a safe return. */ #ifdef CONFIG_CPU_SRSO .section .text.__x86.rethunk_untrain -SYM_START(srso_untrain_ret_alias, SYM_L_GLOBAL, SYM_A_NONE) +SYM_START(srso_alias_untrain_ret, SYM_L_GLOBAL, SYM_A_NONE) UNWIND_HINT_FUNC ANNOTATE_NOENDBR ASM_NOP2 lfence jmp srso_alias_return_thunk -SYM_FUNC_END(srso_untrain_ret_alias) -__EXPORT_THUNK(srso_untrain_ret_alias) +SYM_FUNC_END(srso_alias_untrain_ret) +__EXPORT_THUNK(srso_alias_untrain_ret) .section .text.__x86.rethunk_safe #else /* dummy definition for alternatives */ -SYM_START(srso_untrain_ret_alias, SYM_L_GLOBAL, SYM_A_NONE) +SYM_START(srso_alias_untrain_ret, SYM_L_GLOBAL, SYM_A_NONE) ANNOTATE_UNRET_SAFE ret int3 -SYM_FUNC_END(srso_untrain_ret_alias) +SYM_FUNC_END(srso_alias_untrain_ret) #endif -SYM_START(srso_safe_ret_alias, SYM_L_GLOBAL, SYM_A_NONE) +SYM_START(srso_alias_safe_ret, SYM_L_GLOBAL, SYM_A_NONE) add $8, %_ASM_SP UNWIND_HINT_FUNC ANNOTATE_UNRET_SAFE ret int3 -SYM_FUNC_END(srso_safe_ret_alias) +SYM_FUNC_END(srso_alias_safe_ret) .section .text.__x86.return_thunk SYM_CODE_START(srso_alias_return_thunk) UNWIND_HINT_FUNC ANNOTATE_NOENDBR - call srso_safe_ret_alias + call srso_alias_safe_ret ud2 SYM_CODE_END(srso_alias_return_thunk)
Greg Kroah-Hartman
maintainerPATCH 121/234 x86/cpu: Cleanup the untrain mess
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
commit e7c25c441e9e0fa75b4c83e0b26306b702cfe90d upstream.
Since there can only be one active return_thunk, there only needs be one (matching) untrain_ret. It fundamentally doesn't make sense to allow multiple untrain_ret at the same time.
Fold all the 3 different untrain methods into a single (temporary) helper stub.
--- arch/x86/include/asm/nospec-branch.h | 19 +++++-------------- arch/x86/kernel/cpu/bugs.c | 1 + arch/x86/lib/retpoline.S | 7 +++++++ 3 files changed, 13 insertions(+), 14 deletions(-)
arch/x86/include/asm/nospec-branch.h +5 -14
@@ -268,9 +268,9 @@ .endm#ifdef CONFIG_CPU_UNRET_ENTRY -#define CALL_ZEN_UNTRAIN_RET "call retbleed_untrain_ret" +#define CALL_UNTRAIN_RET "call entry_untrain_ret"#else -#define CALL_ZEN_UNTRAIN_RET "" +#define CALL_UNTRAIN_RET ""#endif /*
@@ -289,15 +289,10 @@ defined(CONFIG_CALL_DEPTH_TRACKING) || defined(CONFIG_CPU_SRSO) VALIDATE_UNRET_ENDALTERNATIVE_3 "" , \ -CALL_ZEN_UNTRAIN_RET ,X86_FEATURE_UNRET , \ +CALL_UNTRAIN_RET ,X86_FEATURE_UNRET , \"call entry_ibpb" ,X86_FEATURE_ENTRY_IBPB , \__stringify (RESET_CALL_DEPTH ),X86_FEATURE_CALL_DEPTH #endif - -#ifdef CONFIG_CPU_SRSO -ALTERNATIVE_2 "" ,"call srso_untrain_ret" ,X86_FEATURE_SRSO , \ -"call srso_alias_untrain_ret" ,X86_FEATURE_SRSO_ALIAS -#endif .endm .macro UNTRAIN_RET_FROM_CALL
@@ -305,15 +300,10 @@defined (CONFIG_CALL_DEPTH_TRACKING) VALIDATE_UNRET_ENDALTERNATIVE_3 "" , \ -CALL_ZEN_UNTRAIN_RET ,X86_FEATURE_UNRET , \ +CALL_UNTRAIN_RET ,X86_FEATURE_UNRET , \"call entry_ibpb" ,X86_FEATURE_ENTRY_IBPB , \__stringify (RESET_CALL_DEPTH_FROM_CALL ),X86_FEATURE_CALL_DEPTH #endif - -#ifdef CONFIG_CPU_SRSO -ALTERNATIVE_2 "" ,"call srso_untrain_ret" ,X86_FEATURE_SRSO , \ -"call srso_alias_untrain_ret" ,X86_FEATURE_SRSO_ALIAS -#endif .endm
@@ -351,6 +341,7 @@ extern void retbleed_untrain_ret(void);extern void srso_untrain_ret (void );extern void srso_alias_untrain_ret (void ); +extern void entry_untrain_ret (void );extern void entry_ibpb (void );extern void (*x86_return_thunk)(void );
arch/x86/kernel/cpu/bugs.c +1 -0
@@ -2458,6 +2458,7 @@ static void __init srso_select_mitigatio* like ftrace, static_call, etc. */ setup_force_cpu_cap (X86_FEATURE_RETHUNK ); +setup_force_cpu_cap (X86_FEATURE_UNRET );if (boot_cpu_data.x86 ==0x19 ) {setup_force_cpu_cap (X86_FEATURE_SRSO_ALIAS );
arch/x86/lib/retpoline.S +7 -0
@@ -290,6 +290,13 @@ SYM_CODE_START(srso_return_thunk) ud2 SYM_CODE_END(srso_return_thunk) +SYM_FUNC_START(entry_untrain_ret) + ALTERNATIVE_2 "jmp retbleed_untrain_ret", \ + "jmp srso_untrain_ret", X86_FEATURE_SRSO, \ + "jmp srso_alias_untrain_ret", X86_FEATURE_SRSO_ALIAS +SYM_FUNC_END(entry_untrain_ret) +__EXPORT_THUNK(entry_untrain_ret) + SYM_CODE_START(__x86_return_thunk) UNWIND_HINT_FUNC ANNOTATE_NOENDBR
Greg Kroah-Hartman
maintainerPATCH 122/234 x86/cpu/kvm: Provide UNTRAIN_RET_VM
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
commit 864bcaa38ee44ec6c0e43f79c2d2997b977e26b2 upstream.
Similar to how it doesn't make sense to have UNTRAIN_RET have two untrain calls, it also doesn't make sense for VMEXIT to have an extra IBPB call.
This cures VMEXIT doing potentially unret+IBPB or double IBPB. Also, the (SEV) VMEXIT case seems to have been overlooked.
Redefine the meaning of the synthetic IBPB flags to:
- ENTRY_IBPB -- issue IBPB on entry (was: entry + VMEXIT)
- IBPB_ON_VMEXIT -- issue IBPB on VMEXIT
And have 'retbleed=ibpb' set *BOTH* feature flags to ensure it retains the previous behaviour and issues IBPB on entry+VMEXIT.
The new 'srso=ibpb_vmexit' option only sets IBPB_ON_VMEXIT.
Create UNTRAIN_RET_VM specifically for the VMEXIT case, and have that check IBPB_ON_VMEXIT.
All this avoids having the VMEXIT case having to check both ENTRY_IBPB and IBPB_ON_VMEXIT and simplifies the alternatives.
--- arch/x86/include/asm/nospec-branch.h | 11 +++++++++++ arch/x86/kernel/cpu/bugs.c | 1 + arch/x86/kvm/svm/vmenter.S | 7 ++----- 3 files changed, 14 insertions(+), 5 deletions(-)
arch/x86/include/asm/nospec-branch.h +11 -0
@@ -295,6 +295,17 @@#endif .endm +.macro UNTRAIN_RET_VM +#if defined(CONFIG_CPU_UNRET_ENTRY ) || defined(CONFIG_CPU_IBPB_ENTRY ) || \ + defined(CONFIG_CALL_DEPTH_TRACKING ) || defined(CONFIG_CPU_SRSO ) +VALIDATE_UNRET_END + ALTERNATIVE_3 "", \ + CALL_UNTRAIN_RET, X86_FEATURE_UNRET, \ + "call entry_ibpb", X86_FEATURE_IBPB_ON_VMEXIT, \ + __stringify(RESET_CALL_DEPTH), X86_FEATURE_CALL_DEPTH +#endif +.endm + .macro UNTRAIN_RET_FROM_CALL#if defined(CONFIG_CPU_UNRET_ENTRY ) || defined(CONFIG_CPU_IBPB_ENTRY ) || \ defined(CONFIG_CALL_DEPTH_TRACKING )
arch/x86/kernel/cpu/bugs.c +1 -0
@@ -1054,6 +1054,7 @@ do_cmd_auto:case RETBLEED_MITIGATION_IBPB :setup_force_cpu_cap (X86_FEATURE_ENTRY_IBPB ); +setup_force_cpu_cap (X86_FEATURE_IBPB_ON_VMEXIT ); mitigate_smt = true;break ;
arch/x86/kvm/svm/vmenter.S +2 -5
@@ -222,10 +222,7 @@ SYM_FUNC_START(__svm_vcpu_run) * because interrupt handlers won't sanitize 'ret' if the return is * from the kernel. */ - UNTRAIN_RET - - /* SRSO */ - ALTERNATIVE "", "call entry_ibpb", X86_FEATURE_IBPB_ON_VMEXIT + UNTRAIN_RET_VM /* * Clear all general purpose registers except RSP and RAX to prevent
@@ -362,7 +359,7 @@ SYM_FUNC_START(__svm_sev_es_vcpu_run) * because interrupt handlers won't sanitize RET if the return is * from the kernel. */ - UNTRAIN_RET + UNTRAIN_RET_VM /* "Pop" @spec_ctrl_intercepted. */ pop %_ASM_BX
Greg Kroah-Hartman
maintainerPATCH 123/234 x86/srso: Explain the untraining sequences a bit more
In reply to Greg Kroah-HartmanFrom: Borislav Petkov (AMD) <[email protected]>
commit 9dbd23e42ff0b10c9b02c9e649c76e5228241a8e upstream.
The goal is to eventually have a proper documentation about all this.
--- arch/x86/lib/retpoline.S | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
arch/x86/lib/retpoline.S +19 -0
@@ -187,6 +187,25 @@ SYM_CODE_START(srso_alias_return_thunk) SYM_CODE_END(srso_alias_return_thunk) /* + * Some generic notes on the untraining sequences: + * + * They are interchangeable when it comes to flushing potentially wrong + * RET predictions from the BTB. + * + * The SRSO Zen1/2 (MOVABS) untraining sequence is longer than the + * Retbleed sequence because the return sequence done there + * (srso_safe_ret()) is longer and the return sequence must fully nest + * (end before) the untraining sequence. Therefore, the untraining + * sequence must fully overlap the return sequence. + * + * Regarding alignment - the instructions which need to be untrained, + * must all start at a cacheline boundary for Zen1/2 generations. That + * is, instruction sequences starting at srso_safe_ret() and + * the respective instruction sequences at retbleed_return_thunk() + * must start at a cacheline boundary. + */ + +/* * Safety details here pertain to the AMD Zen{1,2} microarchitecture: * 1) The RET at retbleed_return_thunk must be on a 64 byte boundary, for * alignment within the BTB.
Greg Kroah-Hartman
maintainerPATCH 124/234 objtool/x86: Fixup frame-pointer vs rethunk
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
commit dbf46008775516f7f25c95b7760041c286299783 upstream.
For stack-validation of a frame-pointer build, objtool validates that every CALL instruction is preceded by a frame-setup. The new SRSO return thunks violate this with their RSB stuffing trickery.
Extend the __fentry__ exception to also cover the embedded_insn case used for this. This cures:
vmlinux.o: warning: objtool: srso_untrain_ret+0xd: call without frame pointer save/setup
--- tools/objtool/check.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
tools/objtool/check.c +11 -6
@@ -2698,12 +2698,17 @@ static int decode_sections(struct objtooreturn 0 ; } -static bool is_fentry_call (struct instruction *insn) +static bool is_special_call (struct instruction *insn) { -if (insn->type ==INSN_CALL && -insn_call_dest (insn) && -insn_call_dest (insn)->fentry) -return true; +if (insn->type ==INSN_CALL ) { +struct symbol *dest =insn_call_dest (insn); + +if (!dest) +return false; + +if (dest->fentry || dest->embedded_insn) +return true; + }return false; }
@@ -3701,7 +3706,7 @@ static int validate_branch(struct objtooif (ret)return ret; -if (opts.stackval && func && !is_fentry_call (insn) && +if (opts.stackval && func && !is_special_call (insn) && !has_valid_stack_frame (&state)) {WARN_INSN (insn,"call without frame pointer save/setup" );return 1 ;
Greg Kroah-Hartman
maintainerPATCH 125/234 x86/static_call: Fix __static_call_fixup()
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
commit 54097309620ef0dc2d7083783dc521c6a5fef957 upstream.
Christian reported spurious module load crashes after some of Song's module memory layout patches.
Turns out that if the very last instruction on the very last page of the module is a 'JMP __x86_return_thunk' then __static_call_fixup() will trip a fault and die.
And while the module rework made this slightly more likely to happen, it's always been possible.
--- arch/x86/kernel/static_call.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
arch/x86/kernel/static_call.c +13 -0
@@ -186,6 +186,19 @@ EXPORT_SYMBOL_GPL(arch_static_call_trans*/ bool __static_call_fixup (void *tramp,u8 op,void *dest) { +unsigned long addr = (unsigned long )tramp; +/* +* Not all .return_sites are a static_call trampoline (most are not). +* Check if the 3 bytes after the return are still kernel text, if not, +* then this definitely is not a trampoline and we need not worry +* further. +* +* This avoids the memcmp() below tripping over pagefaults etc.. +*/ +if (((addr >>PAGE_SHIFT ) != ((addr +7 ) >>PAGE_SHIFT )) && + !kernel_text_address (addr +7 )) +return false; +if (memcmp (tramp+5 , tramp_ud,3 )) {/* Not a trampoline site, not our problem. */ return false;
Greg Kroah-Hartman
maintainerPATCH 126/234 x86/retpoline: Dont clobber RFLAGS during srso_safe_ret()
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit ba5ca5e5e6a1d55923e88b4a83da452166f5560e upstream.
Use LEA instead of ADD when adjusting %rsp in srso_safe_ret{,_alias}() so as to avoid clobbering flags. Drop one of the INT3 instructions to account for the LEA consuming one more byte than the ADD.
KVM's emulator makes indirect calls into a jump table of sorts, where the destination of each call is a small blob of code that performs fast emulation by executing the target instruction with fixed operands.
E.g. to emulate ADC, fastop() invokes adcb_al_dl():
adcb_al_dl:
<+0>: adc %dl,%al
<+2>: jmp <__x86_return_thunk>A major motivation for doing fast emulation is to leverage the CPU to handle consumption and manipulation of arithmetic flags, i.e. RFLAGS is both an input and output to the target of the call. fastop() collects the RFLAGS result by pushing RFLAGS onto the stack and popping them back into a variable (held in %rdi in this case):
asm("push %[flags]; popf; " CALL_NOSPEC " ; pushf; pop %[flags]\n"
<+71>: mov 0xc0(%r8),%rdx <+78>: mov 0x100(%r8),%rcx <+85>: push %rdi
<+86>: popf
<+87>: call *%rsi
<+89>: nop
<+90>: nop
<+91>: nop
<+92>: pushf
<+93>: pop %rdi
and then propagating the arithmetic flags into the vCPU's emulator state:
ctxt->eflags = (ctxt->eflags & ~EFLAGS_MASK) | (flags & EFLAGS_MASK);
<+64>: and $0xfffffffffffff72a,%r9 <+94>: and $0x8d5,%edi <+109>: or %rdi,%r9 <+122>: mov %r9,0x10(%r8)
The failures can be most easily reproduced by running the "emulator" test in KVM-Unit-Tests.
If you're feeling a bit of deja vu, see commit b63f20a778c8 ("x86/retpoline: Don't clobber RFLAGS during CALL_NOSPEC on i386").
In addition, this breaks booting of clang-compiled guest on a gcc-compiled host where the host contains the %rsp-modifying SRSO mitigations.
[ bp: Massage commit message, extend, remove addresses. ]
--- arch/x86/lib/retpoline.S | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
arch/x86/lib/retpoline.S +3 -4
@@ -170,7 +170,7 @@ SYM_FUNC_END(srso_alias_untrain_ret) #endif SYM_START(srso_alias_safe_ret, SYM_L_GLOBAL, SYM_A_NONE) - add $8, %_ASM_SP + lea 8(%_ASM_SP), %_ASM_SP UNWIND_HINT_FUNC ANNOTATE_UNRET_SAFE ret
@@ -270,7 +270,7 @@ __EXPORT_THUNK(retbleed_untrain_ret) * SRSO untraining sequence for Zen1/2, similar to retbleed_untrain_ret() * above. On kernel entry, srso_untrain_ret() is executed which is a * - * movabs $0xccccccc308c48348,%rax + * movabs $0xccccc30824648d48,%rax * * and when the return thunk executes the inner label srso_safe_ret() * later, it is a stack manipulation and a RET which is mispredicted and
@@ -289,11 +289,10 @@ SYM_START(srso_untrain_ret, SYM_L_GLOBAL * the stack. */ SYM_INNER_LABEL(srso_safe_ret, SYM_L_GLOBAL) - add $8, %_ASM_SP + lea 8(%_ASM_SP), %_ASM_SP ret int3 int3 - int3 /* end of movabs */ lfence call srso_safe_ret
Greg Kroah-Hartman
maintainerPATCH 127/234 x86/CPU/AMD: Fix the DIV(0) initial fix attempt
In reply to Greg Kroah-HartmanFrom: Borislav Petkov (AMD) <[email protected]>
commit f58d6fbcb7c848b7f2469be339bc571f2e9d245b upstream.
Initially, it was thought that doing an innocuous division in the #DE handler would take care to prevent any leaking of old data from the divider but by the time the fault is raised, the speculation has already advanced too far and such data could already have been used by younger operations.
Therefore, do the innocuous division on every exit to userspace so that userspace doesn't see any potentially old data from integer divisions in kernel space.
Do the same before VMRUN too, to protect host data from leaking into the guest too.
--- arch/x86/include/asm/entry-common.h | 1 + arch/x86/kernel/cpu/amd.c | 1 + arch/x86/kernel/traps.c | 2 -- arch/x86/kvm/svm/svm.c | 2 ++ 4 files changed, 4 insertions(+), 2 deletions(-)
arch/x86/include/asm/entry-common.h +1 -0
@@ -92,6 +92,7 @@ static inline void arch_exit_to_user_mod static __always_inline void arch_exit_to_user_mode(void) {mds_user_clear_cpu_buffers (); +amd_clear_divider (); }#define arch_exit_to_user_mode arch_exit_to_user_mode
arch/x86/kernel/cpu/amd.c +1 -0
@@ -1329,3 +1329,4 @@ void noinstr amd_clear_divider(void) asm volatile(ALTERNATIVE("", "div %2\n\t", X86_BUG_DIV0) :: "a" (0), "d" (0), "r" (1)); } +EXPORT_SYMBOL_GPL (amd_clear_divider);
arch/x86/kernel/traps.c +0 -2
@@ -206,8 +206,6 @@ DEFINE_IDTENTRY(exc_divide_error) {do_error_trap (regs,0 ,"divide error" ,X86_TRAP_DE ,SIGFPE ,FPE_INTDIV ,error_get_trap_addr (regs)); - -amd_clear_divider (); }DEFINE_IDTENTRY (exc_overflow)
arch/x86/kvm/svm/svm.c +2 -0
@@ -4034,6 +4034,8 @@ static noinstr void svm_vcpu_enter_exit(guest_state_enter_irqoff (); +amd_clear_divider (); +if (sev_es_guest (vcpu->kvm))__svm_sev_es_vcpu_run (svm, spec_ctrl_intercepted);else
Greg Kroah-Hartman
maintainerPATCH 128/234 x86/srso: Disable the mitigation on unaffected configurations
In reply to Greg Kroah-HartmanFrom: Borislav Petkov (AMD) <[email protected]>
commit e9fbc47b818b964ddff5df5b2d5c0f5f32f4a147 upstream.
Skip the srso cmd line parsing which is not needed on Zen1/2 with SMT disabled and with the proper microcode applied (latter should be the case anyway) as those are not affected.
--- arch/x86/kernel/cpu/bugs.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
arch/x86/kernel/cpu/bugs.c +6 -1
@@ -2429,8 +2429,10 @@ static void __init srso_select_mitigatio* IBPB microcode has been applied. */ if ((boot_cpu_data.x86 <0x19 ) && - (!cpu_smt_possible () || (cpu_smt_control ==CPU_SMT_DISABLED ))) + (!cpu_smt_possible () || (cpu_smt_control ==CPU_SMT_DISABLED ))) {setup_force_cpu_cap (X86_FEATURE_SRSO_NO ); +return ; + } }if (retbleed_mitigation ==RETBLEED_MITIGATION_IBPB ) {
@@ -2716,6 +2718,9 @@ static ssize_t gds_show_state(char *buf)static ssize_t srso_show_state (char *buf) { +if (boot_cpu_has (X86_FEATURE_SRSO_NO )) +return sysfs_emit (buf,"Not affected\n" ); +return sysfs_emit (buf,"%s%s\n" , srso_strings[srso_mitigation], (cpu_has_ibpb_brtype_microcode () ?"" :", no microcode" ));
Greg Kroah-Hartman
maintainerPATCH 129/234 x86/retpoline,kprobes: Fix position of thunk sections with CONFIG_LTO_CLANG
In reply to Greg Kroah-HartmanFrom: Petr Pavlu <[email protected]>
commit 79cd2a11224eab86d6673fe8a11d2046ae9d2757 upstream.
The linker script arch/x86/kernel/vmlinux.lds.S matches the thunk sections ".text.__x86.*" from arch/x86/lib/retpoline.S as follows:
.text {
[...]
TEXT_TEXT
[...]
__indirect_thunk_start = .;
*(.text.__x86.*)
__indirect_thunk_end = .;
[...]
}Macro TEXT_TEXT references TEXT_MAIN which normally expands to only ".text". However, with CONFIG_LTO_CLANG, TEXT_MAIN becomes ".text .text.[0-9a-zA-Z_]*" which wrongly matches also the thunk sections. The output layout is then different than expected. For instance, the currently defined range [__indirect_thunk_start, __indirect_thunk_end] becomes empty.
Prevent the problem by using ".." as the first separator, for example, ".text..__x86.indirect_thunk". This pattern is utilized by other explicit section names which start with one of the standard prefixes, such as ".text" or ".data", and that need to be individually selected in the linker script.
[ nathan: Fix conflicts with SRSO and fold in fix issue brought up by
Andrew Cooper in post-review:
https://lore.kernel.org/[email protected] ]
--- arch/x86/kernel/vmlinux.lds.S | 8 ++++---- arch/x86/lib/retpoline.S | 8 ++++---- tools/objtool/check.c | 2 +- 3 files changed, 9 insertions(+), 9 deletions(-)
arch/x86/kernel/vmlinux.lds.S +4 -4
@@ -134,15 +134,15 @@ SECTIONS SOFTIRQENTRY_TEXT #ifdef CONFIG_RETPOLINE __indirect_thunk_start = .; - *(.text.__x86.indirect_thunk) - *(.text.__x86.return_thunk) + *(.text..__x86.indirect_thunk) + *(.text..__x86.return_thunk) __indirect_thunk_end = .; #endif STATIC_CALL_TEXT ALIGN_ENTRY_TEXT_BEGIN #ifdef CONFIG_CPU_SRSO - *(.text.__x86.rethunk_untrain) + *(.text..__x86.rethunk_untrain) #endif ENTRY_TEXT
@@ -153,7 +153,7 @@ SECTIONS * definition. */ . = srso_alias_untrain_ret | (1 << 2) | (1 << 8) | (1 << 14) | (1 << 20); - *(.text.__x86.rethunk_safe) + *(.text..__x86.rethunk_safe) #endif ALIGN_ENTRY_TEXT_END *(.gnu.warning)
arch/x86/lib/retpoline.S +4 -4
@@ -13,7 +13,7 @@ #include <asm/frame.h> #include <asm/nops.h> - .section .text.__x86.indirect_thunk + .section .text..__x86.indirect_thunk .macro POLINE reg
@@ -148,7 +148,7 @@ SYM_CODE_END(__x86_indirect_jump_thunk_a * As a result, srso_alias_safe_ret() becomes a safe return. */ #ifdef CONFIG_CPU_SRSO - .section .text.__x86.rethunk_untrain + .section .text..__x86.rethunk_untrain SYM_START(srso_alias_untrain_ret, SYM_L_GLOBAL, SYM_A_NONE) UNWIND_HINT_FUNC
@@ -159,7 +159,7 @@ SYM_START(srso_alias_untrain_ret, SYM_L_ SYM_FUNC_END(srso_alias_untrain_ret) __EXPORT_THUNK(srso_alias_untrain_ret) - .section .text.__x86.rethunk_safe + .section .text..__x86.rethunk_safe #else /* dummy definition for alternatives */ SYM_START(srso_alias_untrain_ret, SYM_L_GLOBAL, SYM_A_NONE)
@@ -177,7 +177,7 @@ SYM_START(srso_alias_safe_ret, SYM_L_GLO int3 SYM_FUNC_END(srso_alias_safe_ret) - .section .text.__x86.return_thunk + .section .text..__x86.return_thunk SYM_CODE_START(srso_alias_return_thunk) UNWIND_HINT_FUNC
tools/objtool/check.c +1 -1
@@ -429,7 +429,7 @@ static int decode_instructions(struct obif (!strcmp (sec->name,".noinstr.text" ) || !strcmp (sec->name,".entry.text" ) || !strcmp (sec->name,".cpuidle.text" ) || - !strncmp (sec->name,".text.__x86." ,12 )) + !strncmp (sec->name,".text..__x86." ,13 )) sec->noinstr = true;/*
Greg Kroah-Hartman
maintainerPATCH 130/234 x86/retpoline,kprobes: Skip optprobe check for indirect jumps with retpolines and IBT
In reply to Greg Kroah-HartmanFrom: Petr Pavlu <[email protected]>
commit 833fd800bf56b74d39d71d3f5936dffb3e0409c6 upstream.
The kprobes optimization check can_optimize() calls insn_is_indirect_jump() to detect indirect jump instructions in a target function. If any is found, creating an optprobe is disallowed in the function because the jump could be from a jump table and could potentially land in the middle of the target optprobe.
With retpolines, insn_is_indirect_jump() additionally looks for calls to indirect thunks which the compiler potentially used to replace original jumps. This extra check is however unnecessary because jump tables are disabled when the kernel is built with retpolines. The same is currently the case with IBT.
Based on this observation, remove the logic to look for calls to indirect thunks and skip the check for indirect jumps altogether if the kernel is built with retpolines or IBT. Remove subsequently the symbols __indirect_thunk_start and __indirect_thunk_end which are no longer needed.
Dropping this logic indirectly fixes a problem where the range [__indirect_thunk_start, __indirect_thunk_end] wrongly included also the return thunk. It caused that machines which used the return thunk as a mitigation and didn't have it patched by any alternative ended up not being able to use optprobes in any regular function.
--- arch/x86/include/asm/nospec-branch.h | 3 -- arch/x86/kernel/kprobes/opt.c | 40 ++++++++++++++--------------------- arch/x86/kernel/vmlinux.lds.S | 2 - tools/perf/util/thread-stack.c | 4 --- 4 files changed, 17 insertions(+), 32 deletions(-)
arch/x86/include/asm/nospec-branch.h +0 -3
@@ -482,9 +482,6 @@ enum ssb_mitigation { SPEC_STORE_BYPASS_SECCOMP, }; -extern char __indirect_thunk_start[]; -extern char __indirect_thunk_end[]; -static __always_inline void alternative_msr_write(unsigned int msr, u64 val, unsigned int feature) {
arch/x86/kernel/kprobes/opt.c +16 -24
@@ -226,7 +226,7 @@ static int copy_optimized_instructions(u }/* Check whether insn is indirect jump */ -static int __insn_is_indirect_jump (struct insn *insn) +static int insn_is_indirect_jump (struct insn *insn) { return ((insn->opcode.bytes[0] == 0xff && (X86_MODRM_REG(insn->modrm.value) & 6) == 4) || /* Jump */
@@ -260,26 +260,6 @@ static int insn_jump_into_range(struct ireturn (start <= target && target <= start + len); } -static int insn_is_indirect_jump (struct insn *insn) -{ -int ret =__insn_is_indirect_jump (insn); - -#ifdef CONFIG_RETPOLINE -/* -* Jump to x86_indirect_thunk_* is treated as an indirect jump. -* Note that even with CONFIG_RETPOLINE=y, the kernel compiled with -* older gcc may use indirect jump. So we add this check instead of -* replace indirect-jump check. -*/ -if (!ret) - ret =insn_jump_into_range (insn, - (unsigned long )__indirect_thunk_start, - (unsigned long )__indirect_thunk_end - - (unsigned long )__indirect_thunk_start); -#endif -return ret; -} -/* Decode whole function to ensure any instructions don't jump into target */ static int can_optimize (unsigned long paddr) {
@@ -334,9 +314,21 @@ static int can_optimize(unsigned long pa/* Recover address */ insn.kaddr = (void *)addr; insn.next_byte = (void *)(addr + insn.length); -/* Check any instructions don't jump into target */ -if (insn_is_indirect_jump (&insn) || -insn_jump_into_range (&insn, paddr +INT3_INSN_SIZE , +/* +* Check any instructions don't jump into target, indirectly or +* directly. +* +* The indirect case is present to handle a code with jump +* tables. When the kernel uses retpolines, the check should in +* theory additionally look for jumps to indirect thunks. +* However, the kernel built with retpolines or IBT has jump +* tables disabled so the check can be skipped altogether. +*/ +if (!IS_ENABLED (CONFIG_RETPOLINE ) && + !IS_ENABLED (CONFIG_X86_KERNEL_IBT ) && +insn_is_indirect_jump (&insn)) +return 0 ; +if (insn_jump_into_range (&insn, paddr +INT3_INSN_SIZE ,DISP32_SIZE ))return 0 ; addr += insn.length;
arch/x86/kernel/vmlinux.lds.S +0 -2
@@ -133,10 +133,8 @@ SECTIONS KPROBES_TEXT SOFTIRQENTRY_TEXT #ifdef CONFIG_RETPOLINE - __indirect_thunk_start = .; *(.text..__x86.indirect_thunk) *(.text..__x86.return_thunk) - __indirect_thunk_end = .; #endif STATIC_CALL_TEXT
tools/perf/util/thread-stack.c +1 -3
@@ -1037,9 +1037,7 @@ static int thread_stack__trace_end(strucstatic bool is_x86_retpoline (const char *name) { -const char *p =strstr (name,"__x86_indirect_thunk_" ); - -return p == name || !strcmp (name,"__indirect_thunk_start" ); +return strstr (name,"__x86_indirect_thunk_" ) == name; }/*
Greg Kroah-Hartman
maintainerPATCH 131/234 x86/srso: Correct the mitigation status when SMT is disabled
In reply to Greg Kroah-HartmanFrom: Borislav Petkov (AMD) <[email protected]>
commit 6405b72e8d17bd1875a56ae52d23ec3cd51b9d66 upstream.
Specify how is SRSO mitigated when SMT is disabled. Also, correct the SMT check for that.
--- arch/x86/kernel/cpu/bugs.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
arch/x86/kernel/cpu/bugs.c +2 -3
@@ -2428,8 +2428,7 @@ static void __init srso_select_mitigatio* Zen1/2 with SMT off aren't vulnerable after the right * IBPB microcode has been applied. */ -if ((boot_cpu_data.x86 <0x19 ) && - (!cpu_smt_possible () || (cpu_smt_control ==CPU_SMT_DISABLED ))) { +if (boot_cpu_data.x86 <0x19 && !cpu_smt_possible ()) {setup_force_cpu_cap (X86_FEATURE_SRSO_NO );return ; }
@@ -2719,7 +2718,7 @@ static ssize_t gds_show_state(char *buf)static ssize_t srso_show_state (char *buf) {if (boot_cpu_has (X86_FEATURE_SRSO_NO )) -return sysfs_emit (buf,"Not affected\n" ); +return sysfs_emit (buf,"Mitigation: SMT disabled\n" ); return sysfs_emit(buf, "%s%s\n", srso_strings[srso_mitigation],
Greg Kroah-Hartman
maintainerPATCH 132/234 net: xfrm: Fix xfrm_address_filter OOB read
In reply to Greg Kroah-HartmanFrom: Lin Ma <[email protected]>
[ Upstream commit dfa73c17d55b921e1d4e154976de35317e43a93a ]
We found below OOB crash:
[ 44.211730] ================================================================== [ 44.212045] BUG: KASAN: slab-out-of-bounds in memcmp+0x8b/0xb0 [ 44.212045] Read of size 8 at addr ffff88800870f320 by task poc.xfrm/97 [ 44.212045] [ 44.212045] CPU: 0 PID: 97 Comm: poc.xfrm Not tainted 6.4.0-rc7-00072-gdad9774deaf1-dirty #4 [ 44.212045] Call Trace: [ 44.212045] <TASK> [ 44.212045] dump_stack_lvl+0x37/0x50 [ 44.212045] print_report+0xcc/0x620 [ 44.212045] ? __virt_addr_valid+0xf3/0x170 [ 44.212045] ? memcmp+0x8b/0xb0 [ 44.212045] kasan_report+0xb2/0xe0 [ 44.212045] ? memcmp+0x8b/0xb0 [ 44.212045] kasan_check_range+0x39/0x1c0 [ 44.212045] memcmp+0x8b/0xb0 [ 44.212045] xfrm_state_walk+0x21c/0x420 [ 44.212045] ? __pfx_dump_one_state+0x10/0x10 [ 44.212045] xfrm_dump_sa+0x1e2/0x290 [ 44.212045] ? __pfx_xfrm_dump_sa+0x10/0x10 [ 44.212045] ? __kernel_text_address+0xd/0x40 [ 44.212045] ? kasan_unpoison+0x27/0x60 [ 44.212045] ? mutex_lock+0x60/0xe0 [ 44.212045] ? __pfx_mutex_lock+0x10/0x10 [ 44.212045] ? kasan_save_stack+0x22/0x50 [ 44.212045] netlink_dump+0x322/0x6c0 [ 44.212045] ? __pfx_netlink_dump+0x10/0x10 [ 44.212045] ? mutex_unlock+0x7f/0xd0 [ 44.212045] ? __pfx_mutex_unlock+0x10/0x10 [ 44.212045] __netlink_dump_start+0x353/0x430 [ 44.212045] xfrm_user_rcv_msg+0x3a4/0x410 [ 44.212045] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 44.212045] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 44.212045] ? __pfx_xfrm_dump_sa+0x10/0x10 [ 44.212045] ? __pfx_xfrm_dump_sa_done+0x10/0x10 [ 44.212045] ? __stack_depot_save+0x382/0x4e0 [ 44.212045] ? filter_irq_stacks+0x1c/0x70 [ 44.212045] ? kasan_save_stack+0x32/0x50 [ 44.212045] ? kasan_save_stack+0x22/0x50 [ 44.212045] ? kasan_set_track+0x25/0x30 [ 44.212045] ? __kasan_slab_alloc+0x59/0x70 [ 44.212045] ? kmem_cache_alloc_node+0xf7/0x260 [ 44.212045] ? kmalloc_reserve+0xab/0x120 [ 44.212045] ? __alloc_skb+0xcf/0x210 [ 44.212045] ? netlink_sendmsg+0x509/0x700 [ 44.212045] ? sock_sendmsg+0xde/0xe0 [ 44.212045] ? __sys_sendto+0x18d/0x230 [ 44.212045] ? __x64_sys_sendto+0x71/0x90 [ 44.212045] ? do_syscall_64+0x3f/0x90 [ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] ? netlink_sendmsg+0x509/0x700 [ 44.212045] ? sock_sendmsg+0xde/0xe0 [ 44.212045] ? __sys_sendto+0x18d/0x230 [ 44.212045] ? __x64_sys_sendto+0x71/0x90 [ 44.212045] ? do_syscall_64+0x3f/0x90 [ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] ? kasan_save_stack+0x22/0x50 [ 44.212045] ? kasan_set_track+0x25/0x30 [ 44.212045] ? kasan_save_free_info+0x2e/0x50 [ 44.212045] ? __kasan_slab_free+0x10a/0x190 [ 44.212045] ? kmem_cache_free+0x9c/0x340 [ 44.212045] ? netlink_recvmsg+0x23c/0x660 [ 44.212045] ? sock_recvmsg+0xeb/0xf0 [ 44.212045] ? __sys_recvfrom+0x13c/0x1f0 [ 44.212045] ? __x64_sys_recvfrom+0x71/0x90 [ 44.212045] ? do_syscall_64+0x3f/0x90 [ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] ? copyout+0x3e/0x50 [ 44.212045] netlink_rcv_skb+0xd6/0x210 [ 44.212045] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 44.212045] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 44.212045] ? __pfx_sock_has_perm+0x10/0x10 [ 44.212045] ? mutex_lock+0x8d/0xe0 [ 44.212045] ? __pfx_mutex_lock+0x10/0x10 [ 44.212045] xfrm_netlink_rcv+0x44/0x50 [ 44.212045] netlink_unicast+0x36f/0x4c0 [ 44.212045] ? __pfx_netlink_unicast+0x10/0x10 [ 44.212045] ? netlink_recvmsg+0x500/0x660 [ 44.212045] netlink_sendmsg+0x3b7/0x700 [ 44.212045] ? __pfx_netlink_sendmsg+0x10/0x10 [ 44.212045] ? __pfx_netlink_sendmsg+0x10/0x10 [ 44.212045] sock_sendmsg+0xde/0xe0 [ 44.212045] __sys_sendto+0x18d/0x230 [ 44.212045] ? __pfx___sys_sendto+0x10/0x10 [ 44.212045] ? rcu_core+0x44a/0xe10 [ 44.212045] ? __rseq_handle_notify_resume+0x45b/0x740 [ 44.212045] ? _raw_spin_lock_irq+0x81/0xe0 [ 44.212045] ? __pfx___rseq_handle_notify_resume+0x10/0x10 [ 44.212045] ? __pfx_restore_fpregs_from_fpstate+0x10/0x10 [ 44.212045] ? __pfx_blkcg_maybe_throttle_current+0x10/0x10 [ 44.212045] ? __pfx_task_work_run+0x10/0x10 [ 44.212045] __x64_sys_sendto+0x71/0x90 [ 44.212045] do_syscall_64+0x3f/0x90 [ 44.212045] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] RIP: 0033:0x44b7da [ 44.212045] RSP: 002b:00007ffdc8838548 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 44.212045] RAX: ffffffffffffffda RBX: 00007ffdc8839978 RCX: 000000000044b7da [ 44.212045] RDX: 0000000000000038 RSI: 00007ffdc8838770 RDI: 0000000000000003 [ 44.212045] RBP: 00007ffdc88385b0 R08: 00007ffdc883858c R09: 000000000000000c [ 44.212045] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 44.212045] R13: 00007ffdc8839968 R14: 00000000004c37d0 R15: 0000000000000001 [ 44.212045] </TASK> [ 44.212045] [ 44.212045] Allocated by task 97: [ 44.212045] kasan_save_stack+0x22/0x50 [ 44.212045] kasan_set_track+0x25/0x30 [ 44.212045] __kasan_kmalloc+0x7f/0x90 [ 44.212045] __kmalloc_node_track_caller+0x5b/0x140 [ 44.212045] kmemdup+0x21/0x50 [ 44.212045] xfrm_dump_sa+0x17d/0x290 [ 44.212045] netlink_dump+0x322/0x6c0 [ 44.212045] __netlink_dump_start+0x353/0x430 [ 44.212045] xfrm_user_rcv_msg+0x3a4/0x410 [ 44.212045] netlink_rcv_skb+0xd6/0x210 [ 44.212045] xfrm_netlink_rcv+0x44/0x50 [ 44.212045] netlink_unicast+0x36f/0x4c0 [ 44.212045] netlink_sendmsg+0x3b7/0x700 [ 44.212045] sock_sendmsg+0xde/0xe0 [ 44.212045] __sys_sendto+0x18d/0x230 [ 44.212045] __x64_sys_sendto+0x71/0x90 [ 44.212045] do_syscall_64+0x3f/0x90 [ 44.212045] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] [ 44.212045] The buggy address belongs to the object at ffff88800870f300 [ 44.212045] which belongs to the cache kmalloc-64 of size 64 [ 44.212045] The buggy address is located 32 bytes inside of [ 44.212045] allocated 36-byte region [ffff88800870f300, ffff88800870f324) [ 44.212045] [ 44.212045] The buggy address belongs to the physical page: [ 44.212045] page:00000000e4de16ee refcount:1 mapcount:0 mapping:000000000 ... [ 44.212045] flags: 0x100000000000200(slab|node=0|zone=1) [ 44.212045] page_type: 0xffffffff() [ 44.212045] raw: 0100000000000200 ffff888004c41640 dead000000000122 0000000000000000 [ 44.212045] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 44.212045] page dumped because: kasan: bad access detected [ 44.212045] [ 44.212045] Memory state around the buggy address: [ 44.212045] ffff88800870f200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 44.212045] ffff88800870f280: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 44.212045] >ffff88800870f300: 00 00 00 00 04 fc fc fc fc fc fc fc fc fc fc fc [ 44.212045] ^ [ 44.212045] ffff88800870f380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.212045] ffff88800870f400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.212045] ==================================================================
By investigating the code, we find the root cause of this OOB is the lack of checks in xfrm_dump_sa(). The buggy code allows a malicious user to pass arbitrary value of filter->splen/dplen. Hence, with crafted xfrm states, the attacker can achieve 8 bytes heap OOB read, which causes info leak.
if (attrs[XFRMA_ADDRESS_FILTER]) {
filter = kmemdup(nla_data(attrs[XFRMA_ADDRESS_FILTER]),
sizeof(*filter), GFP_KERNEL);
if (filter == NULL)
return -ENOMEM;
// NO MORE CHECKS HERE !!!
}This patch fixes the OOB by adding necessary boundary checks, just like the code in pfkey_dump() function.
--- net/xfrm/xfrm_user.c | 9 +++++++++ 1 file changed, 9 insertions(+)
net/xfrm/xfrm_user.c +9 -0
@@ -1267,6 +1267,15 @@ static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb) sizeof(*filter), GFP_KERNEL);if (filter ==NULL )return -ENOMEM ; + +/* see addr_match(), (prefix length >> 5) << 2 +* will be used to compare xfrm_address_t +*/ +if (filter->splen > (sizeof (xfrm_address_t) <<3 ) || + filter->dplen > (sizeof (xfrm_address_t) <<3 )) { +kfree (filter); +return -EINVAL ; + } }if (attrs[XFRMA_PROTO ])
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 133/234 net: af_key: fix sadb_x_filter validation
In reply to Greg Kroah-HartmanFrom: Lin Ma <[email protected]>
[ Upstream commit 75065a8929069bc93181848818e23f147a73f83a ]
When running xfrm_state_walk_init(), the xfrm_address_filter being used is okay to have a splen/dplen that equals to sizeof(xfrm_address_t)<<3. This commit replaces >= to > to make sure the boundary checking is correct.
--- net/key/af_key.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/key/af_key.c +2 -2
@@ -1848,9 +1848,9 @@ static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_msif (ext_hdrs[SADB_X_EXT_FILTER -1 ]) {struct sadb_x_filter *xfilter = ext_hdrs[SADB_X_EXT_FILTER -1 ]; -if ((xfilter->sadb_x_filter_splen >= +if ((xfilter->sadb_x_filter_splen > (sizeof (xfrm_address_t) <<3 )) || - (xfilter->sadb_x_filter_dplen >= + (xfilter->sadb_x_filter_dplen > (sizeof (xfrm_address_t) <<3 ))) {mutex_unlock (&pfk->dump_lock);return -EINVAL ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 134/234 net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure
In reply to Greg Kroah-HartmanFrom: Lin Ma <[email protected]>
[ Upstream commit d1e0e61d617ba17aa516db707aa871387566bbf7 ]
According to all consumers code of attrs[XFRMA_SEC_CTX], like
* verify_sec_ctx_len(), convert to xfrm_user_sec_ctx*
* xfrm_state_construct(), call security_xfrm_state_alloc whose prototype is int security_xfrm_state_alloc(.., struct xfrm_user_sec_ctx *sec_ctx);
* copy_from_user_sec_ctx(), convert to xfrm_user_sec_ctx *
...
It seems that the expected parsing result for XFRMA_SEC_CTX should be structure xfrm_user_sec_ctx, and the current xfrm_sec_ctx is confusing and misleading (Luckily, they happen to have same size 8 bytes).
This commit amend the policy structure to xfrm_user_sec_ctx to avoid ambiguity.
--- net/xfrm/xfrm_compat.c | 2 +- net/xfrm/xfrm_user.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
net/xfrm/xfrm_compat.c +1 -1
@@ -108,7 +108,7 @@ static const struct nla_policy compat_policy[XFRMA_MAX+1] = { [XFRMA_ALG_COMP] = { .len = sizeof(struct xfrm_algo) }, [XFRMA_ENCAP] = { .len = sizeof(struct xfrm_encap_tmpl) }, [XFRMA_TMPL] = { .len = sizeof(struct xfrm_user_tmpl) }, - [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_sec_ctx) }, + [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_user_sec_ctx) }, [XFRMA_LTIME_VAL] = { .len = sizeof(struct xfrm_lifetime_cur) }, [XFRMA_REPLAY_VAL] = { .len = sizeof(struct xfrm_replay_state) }, [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 },
net/xfrm/xfrm_user.c +1 -1
@@ -3024,7 +3024,7 @@ const struct nla_policy xfrma_policy[XFRMA_MAX+1] = { [XFRMA_ALG_COMP] = { .len = sizeof(struct xfrm_algo) }, [XFRMA_ENCAP] = { .len = sizeof(struct xfrm_encap_tmpl) }, [XFRMA_TMPL] = { .len = sizeof(struct xfrm_user_tmpl) }, - [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_sec_ctx) }, + [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_user_sec_ctx) }, [XFRMA_LTIME_VAL] = { .len = sizeof(struct xfrm_lifetime_cur) }, [XFRMA_REPLAY_VAL] = { .len = sizeof(struct xfrm_replay_state) }, [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 },
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 135/234 xfrm: Silence warnings triggerable by bad packets
In reply to Greg Kroah-HartmanFrom: Herbert Xu <[email protected]>
[ Upstream commit 57010b8ece2821a1fdfdba2197d14a022f3769db ]
After the elimination of inner modes, a couple of warnings that were previously unreachable can now be triggered by malformed inbound packets.
Fix this by:
1. Moving the setting of skb->protocol into the decap functions.
2. Returning -EINVAL when unexpected protocol is seen.
--- net/xfrm/xfrm_input.c | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-)
net/xfrm/xfrm_input.c +9 -13
@@ -180,6 +180,8 @@ static int xfrm4_remove_beet_encap(struct xfrm_state *x, struct sk_buff *skb)int optlen =0 ;int err = -EINVAL ; + skb->protocol =htons (ETH_P_IP ); +if (unlikely (XFRM_MODE_SKB_CB (skb)->protocol ==IPPROTO_BEETPH )) {struct ip_beet_phdr *ph;int phlen;
@@ -232,6 +234,8 @@ static int xfrm4_remove_tunnel_encap(struct xfrm_state *x, struct sk_buff *skb) {int err = -EINVAL ; + skb->protocol =htons (ETH_P_IP ); +if (!pskb_may_pull (skb,sizeof (struct iphdr ))) goto out;
@@ -267,6 +271,8 @@ static int xfrm6_remove_tunnel_encap(struct xfrm_state *x, struct sk_buff *skb) {int err = -EINVAL ; + skb->protocol =htons (ETH_P_IPV6 ); +if (!pskb_may_pull (skb,sizeof (struct ipv6hdr ))) goto out;
@@ -296,6 +302,8 @@ static int xfrm6_remove_beet_encap(struct xfrm_state *x, struct sk_buff *skb)int size =sizeof (struct ipv6hdr );int err; + skb->protocol =htons (ETH_P_IPV6 ); + err =skb_cow_head (skb, size + skb->mac_len);if (err) goto out;
@@ -346,6 +354,7 @@ xfrm_inner_mode_encap_remove(struct xfrm_state *x,return xfrm6_remove_tunnel_encap (x, skb);break ; } +return -EINVAL ; }WARN_ON_ONCE (1 );
@@ -366,19 +375,6 @@ static int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb)return -EAFNOSUPPORT ; } -switch (XFRM_MODE_SKB_CB (skb)->protocol) { -case IPPROTO_IPIP : -case IPPROTO_BEETPH : - skb->protocol =htons (ETH_P_IP ); -break ; -case IPPROTO_IPV6 : - skb->protocol =htons (ETH_P_IPV6 ); -break ; -default : -WARN_ON_ONCE (1 ); -break ; - } -return xfrm_inner_mode_encap_remove (x, skb); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 136/234 xfrm: fix slab-use-after-free in decode_session6
In reply to Greg Kroah-HartmanFrom: Zhengchao Shao <[email protected]>
[ Upstream commit 53223f2ed1ef5c90dad814daaaefea4e68a933c8 ]
When the xfrm device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-free may occur when the xfrm device sends IPv6 packets.
The stack information is as follows:
BUG: KASAN: slab-use-after-free in decode_session6+0x103f/0x1890 Read of size 1 at addr ffff8881111458ef by task swapper/3/0 CPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.4.0-next-20230707 #409 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <IRQ> dump_stack_lvl+0xd9/0x150 print_address_description.constprop.0+0x2c/0x3c0 kasan_report+0x11d/0x130 decode_session6+0x103f/0x1890 __xfrm_decode_session+0x54/0xb0 xfrmi_xmit+0x173/0x1ca0 dev_hard_start_xmit+0x187/0x700 sch_direct_xmit+0x1a3/0xc30 __qdisc_run+0x510/0x17a0 __dev_queue_xmit+0x2215/0x3b10 neigh_connected_output+0x3c2/0x550 ip6_finish_output2+0x55a/0x1550 ip6_finish_output+0x6b9/0x1270 ip6_output+0x1f1/0x540 ndisc_send_skb+0xa63/0x1890 ndisc_send_rs+0x132/0x6f0 addrconf_rs_timer+0x3f1/0x870 call_timer_fn+0x1a0/0x580 expire_timers+0x29b/0x4b0 run_timer_softirq+0x326/0x910 __do_softirq+0x1d4/0x905 irq_exit_rcu+0xb7/0x120 sysvec_apic_timer_interrupt+0x97/0xc0 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:intel_idle_hlt+0x23/0x30 Code: 1f 84 00 00 00 00 00 f3 0f 1e fa 41 54 41 89 d4 0f 1f 44 00 00 66 90 0f 1f 44 00 00 0f 00 2d c4 9f ab 00 0f 1f 44 00 00 fb f4 <fa> 44 89 e0 41 5c c3 66 0f 1f 44 00 00 f3 0f 1e fa 41 54 41 89 d4 RSP: 0018:ffffc90000197d78 EFLAGS: 00000246 RAX: 00000000000a83c3 RBX: ffffe8ffffd09c50 RCX: ffffffff8a22d8e5 RDX: 0000000000000001 RSI: ffffffff8d3f8080 RDI: ffffe8ffffd09c50 RBP: ffffffff8d3f8080 R08: 0000000000000001 R09: ffffed1026ba6d9d R10: ffff888135d36ceb R11: 0000000000000001 R12: 0000000000000001 R13: ffffffff8d3f8100 R14: 0000000000000001 R15: 0000000000000000 cpuidle_enter_state+0xd3/0x6f0 cpuidle_enter+0x4e/0xa0 do_idle+0x2fe/0x3c0 cpu_startup_entry+0x18/0x20 start_secondary+0x200/0x290 secondary_startup_64_no_verify+0x167/0x16b </TASK> Allocated by task 939: kasan_save_stack+0x22/0x40 kasan_set_track+0x25/0x30 __kasan_slab_alloc+0x7f/0x90 kmem_cache_alloc_node+0x1cd/0x410 kmalloc_reserve+0x165/0x270 __alloc_skb+0x129/0x330 inet6_ifa_notify+0x118/0x230 __ipv6_ifa_notify+0x177/0xbe0 addrconf_dad_completed+0x133/0xe00 addrconf_dad_work+0x764/0x1390 process_one_work+0xa32/0x16f0 worker_thread+0x67d/0x10c0 kthread+0x344/0x440 ret_from_fork+0x1f/0x30 The buggy address belongs to the object at ffff888111145800
which belongs to the cache skbuff_small_head of size 640 The buggy address is located 239 bytes inside of freed 640-byte region [ffff888111145800, ffff888111145a80)
As commit f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") showed, xfrm_decode_session was originally intended only for the receive path. IP6CB(skb)->nhoff is not set during transmission. Therefore, set the cb field in the skb to 0 before sending packets.
--- net/xfrm/xfrm_interface_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/xfrm/xfrm_interface_core.c +2 -2
@@ -537,8 +537,8 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)switch (skb->protocol) {case htons (ETH_P_IPV6 ): -xfrm_decode_session (skb, &fl,AF_INET6 );memset (IP6CB (skb),0 ,sizeof (*IP6CB (skb))); +xfrm_decode_session (skb, &fl,AF_INET6 );if (!dst) { fl.u.ip6.flowi6_oif = dev->ifindex; fl.u.ip6.flowi6_flags |=FLOWI_FLAG_ANYSRC ;
@@ -552,8 +552,8 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev) }break ;case htons (ETH_P_IP ): -xfrm_decode_session (skb, &fl,AF_INET );memset (IPCB (skb),0 ,sizeof (*IPCB (skb))); +xfrm_decode_session (skb, &fl,AF_INET );if (!dst) {struct rtable *rt;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 137/234 ip6_vti: fix slab-use-after-free in decode_session6
In reply to Greg Kroah-HartmanFrom: Zhengchao Shao <[email protected]>
[ Upstream commit 9fd41f1ba638938c9a1195d09bc6fa3be2712f25 ]
When ipv6_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-free may occur when ipv6_vti device sends IPv6 packets.
The stack information is as follows:
BUG: KASAN: slab-use-after-free in decode_session6+0x103f/0x1890 Read of size 1 at addr ffff88802e08edc2 by task swapper/0/0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.4.0-next-20230707-00001-g84e2cad7f979 #410 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <IRQ> dump_stack_lvl+0xd9/0x150 print_address_description.constprop.0+0x2c/0x3c0 kasan_report+0x11d/0x130 decode_session6+0x103f/0x1890 __xfrm_decode_session+0x54/0xb0 vti6_tnl_xmit+0x3e6/0x1ee0 dev_hard_start_xmit+0x187/0x700 sch_direct_xmit+0x1a3/0xc30 __qdisc_run+0x510/0x17a0 __dev_queue_xmit+0x2215/0x3b10 neigh_connected_output+0x3c2/0x550 ip6_finish_output2+0x55a/0x1550 ip6_finish_output+0x6b9/0x1270 ip6_output+0x1f1/0x540 ndisc_send_skb+0xa63/0x1890 ndisc_send_rs+0x132/0x6f0 addrconf_rs_timer+0x3f1/0x870 call_timer_fn+0x1a0/0x580 expire_timers+0x29b/0x4b0 run_timer_softirq+0x326/0x910 __do_softirq+0x1d4/0x905 irq_exit_rcu+0xb7/0x120 sysvec_apic_timer_interrupt+0x97/0xc0 </IRQ> Allocated by task 9176: kasan_save_stack+0x22/0x40 kasan_set_track+0x25/0x30 __kasan_slab_alloc+0x7f/0x90 kmem_cache_alloc_node+0x1cd/0x410 kmalloc_reserve+0x165/0x270 __alloc_skb+0x129/0x330 netlink_sendmsg+0x9b1/0xe30 sock_sendmsg+0xde/0x190 ____sys_sendmsg+0x739/0x920 ___sys_sendmsg+0x110/0x1b0 __sys_sendmsg+0xf7/0x1c0 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 9176: kasan_save_stack+0x22/0x40 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2b/0x40 ____kasan_slab_free+0x160/0x1c0 slab_free_freelist_hook+0x11b/0x220 kmem_cache_free+0xf0/0x490 skb_free_head+0x17f/0x1b0 skb_release_data+0x59c/0x850 consume_skb+0xd2/0x170 netlink_unicast+0x54f/0x7f0 netlink_sendmsg+0x926/0xe30 sock_sendmsg+0xde/0x190 ____sys_sendmsg+0x739/0x920 ___sys_sendmsg+0x110/0x1b0 __sys_sendmsg+0xf7/0x1c0 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd The buggy address belongs to the object at ffff88802e08ed00
which belongs to the cache skbuff_small_head of size 640 The buggy address is located 194 bytes inside of freed 640-byte region [ffff88802e08ed00, ffff88802e08ef80)
As commit f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") showed, xfrm_decode_session was originally intended only for the receive path. IP6CB(skb)->nhoff is not set during transmission. Therefore, set the cb field in the skb to 0 before sending packets.
--- net/ipv6/ip6_vti.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/ipv6/ip6_vti.c +2 -2
@@ -568,12 +568,12 @@ vti6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) vti6_addr_conflict(t, ipv6_hdr(skb))) goto tx_err; -xfrm_decode_session (skb, &fl,AF_INET6 );memset (IP6CB (skb),0 ,sizeof (*IP6CB (skb))); +xfrm_decode_session (skb, &fl,AF_INET6 );break ;case htons (ETH_P_IP ): -xfrm_decode_session (skb, &fl,AF_INET );memset (IPCB (skb),0 ,sizeof (*IPCB (skb))); +xfrm_decode_session (skb, &fl,AF_INET );break ;default : goto tx_err;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 138/234 ip_vti: fix potential slab-use-after-free in decode_session6
In reply to Greg Kroah-HartmanFrom: Zhengchao Shao <[email protected]>
[ Upstream commit 6018a266279b1a75143c7c0804dd08a5fc4c3e0b ]
When ip_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-free may occur when ip_vti device sends IPv6 packets. As commit f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") showed, xfrm_decode_session was originally intended only for the receive path. IP6CB(skb)->nhoff is not set during transmission. Therefore, set the cb field in the skb to 0 before sending packets.
--- net/ipv4/ip_vti.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/ipv4/ip_vti.c +2 -2
@@ -287,12 +287,12 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)switch (skb->protocol) {case htons (ETH_P_IP ): -xfrm_decode_session (skb, &fl,AF_INET );memset (IPCB (skb),0 ,sizeof (*IPCB (skb))); +xfrm_decode_session (skb, &fl,AF_INET );break ;case htons (ETH_P_IPV6 ): -xfrm_decode_session (skb, &fl,AF_INET6 );memset (IP6CB (skb),0 ,sizeof (*IP6CB (skb))); +xfrm_decode_session (skb, &fl,AF_INET6 );break ;default : goto tx_err;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 139/234 xfrm: add NULL check in xfrm_update_ae_params
In reply to Greg Kroah-HartmanFrom: Lin Ma <[email protected]>
[ Upstream commit 00374d9b6d9f932802b55181be9831aa948e5b7c ]
Normally, x->replay_esn and x->preplay_esn should be allocated at xfrm_alloc_replay_state_esn(...) in xfrm_state_construct(...), hence the xfrm_update_ae_params(...) is okay to update them. However, the current implementation of xfrm_new_ae(...) allows a malicious user to directly dereference a NULL pointer and crash the kernel like below.
BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 8253067 P4D 8253067 PUD 8e0e067 PMD 0 Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 PID: 98 Comm: poc.npd Not tainted 6.4.0-rc7-00072-gdad9774deaf1 #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.o4 RIP: 0010:memcpy_orig+0xad/0x140 Code: e8 4c 89 5f e0 48 8d 7f e0 73 d2 83 c2 20 48 29 d6 48 29 d7 83 fa 10 72 34 4c 8b 06 4c 8b 4e 08 c RSP: 0018:ffff888008f57658 EFLAGS: 00000202 RAX: 0000000000000000 RBX: ffff888008bd0000 RCX: ffffffff8238e571 RDX: 0000000000000018 RSI: ffff888007f64844 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff888008f57818 R13: ffff888007f64aa4 R14: 0000000000000000 R15: 0000000000000000 FS: 00000000014013c0(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000054d8000 CR4: 00000000000006f0 Call Trace: <TASK> ? __die+0x1f/0x70 ? page_fault_oops+0x1e8/0x500 ? __pfx_is_prefetch.constprop.0+0x10/0x10 ? __pfx_page_fault_oops+0x10/0x10 ? _raw_spin_unlock_irqrestore+0x11/0x40 ? fixup_exception+0x36/0x460 ? _raw_spin_unlock_irqrestore+0x11/0x40 ? exc_page_fault+0x5e/0xc0 ? asm_exc_page_fault+0x26/0x30 ? xfrm_update_ae_params+0xd1/0x260 ? memcpy_orig+0xad/0x140 ? __pfx__raw_spin_lock_bh+0x10/0x10 xfrm_update_ae_params+0xe7/0x260 xfrm_new_ae+0x298/0x4e0 ? __pfx_xfrm_new_ae+0x10/0x10 ? __pfx_xfrm_new_ae+0x10/0x10 xfrm_user_rcv_msg+0x25a/0x410 ? __pfx_xfrm_user_rcv_msg+0x10/0x10 ? __alloc_skb+0xcf/0x210 ? stack_trace_save+0x90/0xd0 ? filter_irq_stacks+0x1c/0x70 ? __stack_depot_save+0x39/0x4e0 ? __kasan_slab_free+0x10a/0x190 ? kmem_cache_free+0x9c/0x340 ? netlink_recvmsg+0x23c/0x660 ? sock_recvmsg+0xeb/0xf0 ? __sys_recvfrom+0x13c/0x1f0 ? __x64_sys_recvfrom+0x71/0x90 ? do_syscall_64+0x3f/0x90 ? entry_SYSCALL_64_after_hwframe+0x72/0xdc ? copyout+0x3e/0x50 netlink_rcv_skb+0xd6/0x210 ? __pfx_xfrm_user_rcv_msg+0x10/0x10 ? __pfx_netlink_rcv_skb+0x10/0x10 ? __pfx_sock_has_perm+0x10/0x10 ? mutex_lock+0x8d/0xe0 ? __pfx_mutex_lock+0x10/0x10 xfrm_netlink_rcv+0x44/0x50 netlink_unicast+0x36f/0x4c0 ? __pfx_netlink_unicast+0x10/0x10 ? netlink_recvmsg+0x500/0x660 netlink_sendmsg+0x3b7/0x700
This Null-ptr-deref bug is assigned CVE-2023-3772. And this commit adds additional NULL check in xfrm_update_ae_params to fix the NPD.
--- net/xfrm/xfrm_user.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/xfrm/xfrm_user.c +1 -1
@@ -628,7 +628,7 @@ static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs,struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH ];struct nlattr *mt = attrs[XFRMA_MTIMER_THRESH ]; -if (re) { +if (re && x->replay_esn && x->preplay_esn) {struct xfrm_replay_state_esn *replay_esn; replay_esn =nla_data (re); memcpy(x->replay_esn, replay_esn,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 140/234 xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH
In reply to Greg Kroah-HartmanFrom: Lin Ma <[email protected]>
[ Upstream commit 5e2424708da7207087934c5c75211e8584d553a0 ]
The previous commit 4e484b3e969b ("xfrm: rate limit SA mapping change message to user space") added one additional attribute named XFRMA_MTIMER_THRESH and described its type at compat_policy (net/xfrm/xfrm_compat.c).
However, the author forgot to also describe the nla_policy at xfrma_policy (net/xfrm/xfrm_user.c). Hence, this suppose NLA_U32 (4 bytes) value can be faked as empty (0 bytes) by a malicious user, which leads to 4 bytes overflow read and heap information leak when parsing nlattrs.
To exploit this, one malicious user can spray the SLUB objects and then leverage this 4 bytes OOB read to leak the heap data into x->mapping_maxage (see xfrm_update_ae_params(...)), and leak it to userspace via copy_to_user_state_extra(...).
The above bug is assigned CVE-2023-3773. To fix it, this commit just completes the nla_policy description for XFRMA_MTIMER_THRESH, which enforces the length check and avoids such OOB read.
--- net/xfrm/xfrm_user.c | 1 + 1 file changed, 1 insertion(+)
net/xfrm/xfrm_user.c +1 -0
@@ -3044,6 +3044,7 @@ const struct nla_policy xfrma_policy[XFRMA_MAX+1] = { [XFRMA_SET_MARK] = { .type = NLA_U32 }, [XFRMA_SET_MARK_MASK] = { .type = NLA_U32 }, [XFRMA_IF_ID] = { .type = NLA_U32 }, + [XFRMA_MTIMER_THRESH ] = { .type =NLA_U32 }, };EXPORT_SYMBOL_GPL (xfrma_policy );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 141/234 xfrm: delete offloaded policy
In reply to Greg Kroah-HartmanFrom: Leon Romanovsky <[email protected]>
[ Upstream commit 982c3aca8bac8ae38acdc940e4f1ecec3bffc623 ]
The policy memory was released but not HW driver data. Add call to xfrm_dev_policy_delete(), so drivers will have a chance to release their resources.
--- net/xfrm/xfrm_user.c | 1 + 1 file changed, 1 insertion(+)
net/xfrm/xfrm_user.c +1 -0
@@ -2345,6 +2345,7 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, NETLINK_CB(skb).portid); } }else { +xfrm_dev_policy_delete (xp);xfrm_audit_policy_delete (xp, err ?0 :1 , true);if (err !=0 )
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 142/234 xfrm: dont skip free of empty state in acquire policy
In reply to Greg Kroah-HartmanFrom: Leon Romanovsky <[email protected]>
[ Upstream commit f3ec2b5d879ef5bbcb24678914641343cb6399a2 ]
In destruction flow, the assignment of NULL to xso->dev caused to skip of xfrm_dev_state_free() call, which was called in xfrm_state_put(to_put) routine.
Instead of open-coded variant of xfrm_dev_state_delete() and xfrm_dev_state_free(), let's use them directly.
--- include/net/xfrm.h | 1 + net/xfrm/xfrm_state.c | 8 ++------ 2 files changed, 3 insertions(+), 6 deletions(-)
include/net/xfrm.h +1 -0
@@ -1984,6 +1984,7 @@ static inline void xfrm_dev_state_free(struct xfrm_state *x)if (dev->xfrmdev_ops->xdo_dev_state_free) dev->xfrmdev_ops->xdo_dev_state_free (x); xso->dev =NULL ; + xso->type =XFRM_DEV_OFFLOAD_UNSPECIFIED ;netdev_put (dev, &xso->dev_tracker); } }
net/xfrm/xfrm_state.c +2 -6
@@ -1324,12 +1324,8 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,struct xfrm_dev_offload *xso = &x->xso;if (xso->type ==XFRM_DEV_OFFLOAD_PACKET ) { - xso->dev->xfrmdev_ops->xdo_dev_state_delete (x); - xso->dir =0 ; -netdev_put (xso->dev, &xso->dev_tracker); - xso->dev =NULL ; - xso->real_dev =NULL ; - xso->type =XFRM_DEV_OFFLOAD_UNSPECIFIED ; +xfrm_dev_state_delete (x); +xfrm_dev_state_free (x); }#endif x->km.state =XFRM_STATE_DEAD ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 143/234 virtio-net: set queues after driver_ok
In reply to Greg Kroah-HartmanFrom: Jason Wang <[email protected]>
[ Upstream commit 51b813176f098ff61bd2833f627f5319ead098a5 ]
Commit 25266128fe16 ("virtio-net: fix race between set queues and probe") tries to fix the race between set queues and probe by calling _virtnet_set_queues() before DRIVER_OK is set. This violates virtio spec. Fixing this by setting queues after virtio_device_ready().
Note that rtnl needs to be held for userspace requests to change the number of queues. So we are serialized in this way.
--- drivers/net/virtio_net.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/virtio_net.c +2 -2
@@ -4110,8 +4110,6 @@ static int virtnet_probe(struct virtio_device *vdev)if (vi->has_rss || vi->has_rss_hash_report)virtnet_init_default_rss (vi); -_virtnet_set_queues (vi, vi->curr_queue_pairs); -/* serialize netdev register + virtio_device_ready() with ndo_open() */ rtnl_lock ();
@@ -4124,6 +4122,8 @@ static int virtnet_probe(struct virtio_device *vdev)virtio_device_ready (vdev); +_virtnet_set_queues (vi, vi->curr_queue_pairs); +/* a random MAC address has been assigned, notify the device. * We don't fail probe if VIRTIO_NET_F_CTRL_MAC_ADDR is not there * because many devices work fine without getting MAC explicitly
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 144/234 net: pcs: Add missing put_device call in miic_create
In reply to Greg Kroah-HartmanFrom: Xiang Yang <[email protected]>
[ Upstream commit 829c6524d6729d05a82575dbcc16f99be5ee843d ]
The reference of pdev->dev is taken by of_find_device_by_node, so it should be released when not need anymore.
--- drivers/net/pcs/pcs-rzn1-miic.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/net/pcs/pcs-rzn1-miic.c +8 -2
@@ -313,15 +313,21 @@ struct phylink_pcs *miic_create(struct device *dev, struct device_node *np) pdev =of_find_device_by_node (pcs_np);of_node_put (pcs_np); -if (!pdev || !platform_get_drvdata (pdev)) +if (!pdev || !platform_get_drvdata (pdev)) { +if (pdev) +put_device (&pdev->dev);return ERR_PTR (-EPROBE_DEFER ); + } miic_port =kzalloc (sizeof (*miic_port),GFP_KERNEL ); -if (!miic_port) +if (!miic_port) { +put_device (&pdev->dev);return ERR_PTR (-ENOMEM ); + } miic =platform_get_drvdata (pdev);device_link_add (dev, miic->dev,DL_FLAG_AUTOREMOVE_CONSUMER ); +put_device (&pdev->dev); miic_port->miic = miic; miic_port->port = port -1 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 145/234 net: phy: fix IRQ-based wake-on-lan over hibernate / power off
In reply to Greg Kroah-HartmanFrom: Russell King (Oracle) <[email protected]>
[ Upstream commit cc941e548bffc01b5816b4edc5cb432a137a58b3 ]
Uwe reports:
"Most PHYs signal WoL using an interrupt. So disabling interrupts [at shutdown] breaks WoL at least on PHYs covered by the marvell driver."
Discussing with Ioana, the problem which was trying to be solved was:
"The board in question is a LS1021ATSN which has two AR8031 PHYs that share an interrupt line. In case only one of the PHYs is probed and there are pending interrupts on the PHY#2 an IRQ storm will happen since there is no entity to clear the interrupt from PHY#2's registers. PHY#1's driver will get stuck in .handle_interrupt() indefinitely."
Further confirmation that "the two AR8031 PHYs are on the same MDIO bus."
With WoL using interrupts to wake the system, in such a case, the system will begin booting with an asserted interrupt. Thus, we need to cope with an interrupt asserted during boot.
Solve this instead by disabling interrupts during PHY probe. This will ensure in Ioana's situation that both PHYs of the same type sharing an interrupt line on a common MDIO bus will have their interrupt outputs disabled when the driver probes the device, but before we hook in any interrupt handlers - thus avoiding the interrupt storm.
A better fix would be for platform firmware to disable the interrupting devices at source during boot, before control is handed to the kernel.
--- drivers/net/phy/phy_device.c | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-)
drivers/net/phy/phy_device.c +2 -11
@@ -3217,6 +3217,8 @@ static int phy_probe(struct device *dev) goto out; } +phy_disable_interrupts (phydev); +/* Start out supporting everything. Eventually, * a controller will attach, and may modify one * or both of these values
@@ -3334,16 +3336,6 @@ static int phy_remove(struct device *dev)return 0 ; } -static void phy_shutdown (struct device *dev) -{ -struct phy_device *phydev =to_phy_device (dev); - -if (phydev->state ==PHY_READY || !phydev->attached_dev) -return ; - -phy_disable_interrupts (phydev); -} -/** * phy_driver_register - register a phy_driver with the PHY layer * @new_driver: new phy_driver to register
@@ -3377,7 +3369,6 @@ int phy_driver_register(struct phy_driver *new_driver, struct module *owner) new_driver->mdiodrv.driver.bus = &mdio_bus_type; new_driver->mdiodrv.driver.probe = phy_probe; new_driver->mdiodrv.driver.remove = phy_remove; - new_driver->mdiodrv.driver.shutdown = phy_shutdown; new_driver->mdiodrv.driver.owner = owner; new_driver->mdiodrv.driver.probe_type =PROBE_FORCE_SYNCHRONOUS ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 146/234 selftests: mirror_gre_changes: Tighten up the TTL test match
In reply to Greg Kroah-HartmanFrom: Petr Machata <[email protected]>
[ Upstream commit 855067defa36b1f9effad8c219d9a85b655cf500 ]
This test verifies whether the encapsulated packets have the correct configured TTL. It does so by sending ICMP packets through the test topology and mirroring them to a gretap netdevice. On a busy host however, more than just the test ICMP packets may end up flowing through the topology, get mirrored, and counted. This leads to potential spurious failures as the test observes much more mirrored packets than the sent test packets, and assumes a bug.
Fix this by tightening up the mirror action match. Change it from matchall to a flower classifier matching on ICMP packets specifically.
--- tools/testing/selftests/net/forwarding/mirror_gre_changes.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/testing/selftests/net/forwarding/mirror_gre_changes.sh +2 -1
@@ -72,7 +72,8 @@ test_span_gre_ttl() RET=0 - mirror_install $swp1 ingress $tundev "matchall $tcflags" + mirror_install $swp1 ingress $tundev \ + "prot ip flower $tcflags ip_prot icmp" tc filter add dev $h3 ingress pref 77 prot $prot \ flower skip_hw ip_ttl 50 action pass
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 147/234 drm/panel: simple: Fix AUO G121EAN01 panel timings according to the docs
In reply to Greg Kroah-HartmanFrom: Luca Ceresoli <[email protected]>
[ Upstream commit e8470c0a7bcaa82f78ad34282d662dd7bd9630c2 ]
Commit 03e909acd95a ("drm/panel: simple: Add support for AUO G121EAN01.4 panel") added support for this panel model, but the timings it implements are very different from what the datasheet describes. I checked both the G121EAN01.0 datasheet from [0] and the G121EAN01.4 one from [1] and they all have the same timings: for example the LVDS clock typical value is 74.4 MHz, not 66.7 MHz as implemented.
Replace the timings with the ones from the documentation. These timings have been tested and the clock frequencies verified with an oscilloscope to ensure they are correct.
Also use struct display_timing instead of struct drm_display_mode in order to also specify the minimum and maximum values.
[0] https://embedded.avnet.com/product/g121ean01-0/
[1] https://embedded.avnet.com/product/g121ean01-4/
--- drivers/gpu/drm/panel/panel-simple.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
drivers/gpu/drm/panel/panel-simple.c +12 -12
@@ -969,21 +969,21 @@ static const struct panel_desc auo_g104sn02 = { .connector_type = DRM_MODE_CONNECTOR_LVDS, }; -static const struct drm_display_mode auo_g121ean01_mode = { - .clock =66700 , - .hdisplay =1280 , - .hsync_start =1280 +58 , - .hsync_end =1280 +58 +8 , - .htotal =1280 +58 +8 +70 , - .vdisplay =800 , - .vsync_start =800 +6 , - .vsync_end =800 +6 +4 , - .vtotal =800 +6 +4 +10 , +static const struct display_timing auo_g121ean01_timing = { + .pixelclock = {60000000 ,74400000 ,90000000 }, + .hactive = {1280 ,1280 ,1280 }, + .hfront_porch = {20 ,50 ,100 }, + .hback_porch = {20 ,50 ,100 }, + .hsync_len = {30 ,100 ,200 }, + .vactive = {800 ,800 ,800 }, + .vfront_porch = {2 ,10 ,25 }, + .vback_porch = {2 ,10 ,25 }, + .vsync_len = {4 ,18 ,50 }, };static const struct panel_desc auo_g121ean01 = { - .modes = &auo_g121ean01_mode, - .num_modes =1 , + .timings = &auo_g121ean01_timing, + .num_timings =1 , .bpc =8 , .size = { .width =261 ,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 148/234 drm/i915/guc/slpc: Restore efficient freq earlier
In reply to Greg Kroah-HartmanFrom: Vinay Belgaumkar <[email protected]>
[ Upstream commit 5598c9bfdb81f40f2f5d769b342d25bff74b07a6 ]
This should be done before the soft min/max frequencies are restored. When we disable the "Ignore efficient frequency" flag, GuC does not actually bring the requested freq down to RPn.
Specifically, this scenario-
- ignore efficient freq set to true
- reduce min to RPn (from efficient)
- suspend
- resume (includes GuC load, restore soft min/max, restore efficient freq)
- validate min freq has been resored to RPn
This will fail if we didn't first restore(disable, in this case) efficient freq flag before setting the soft min frequency.
v2: Bring the min freq down to RPn when we disable efficient freq (Rodrigo) Also made the change to set the min softlimit to RPn at init. Otherwise, we were storing RPe there.
--- drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c | 22 +++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-)
drivers/gpu/drm/i915/gt/uc/intel_guc_slpc.c +14 -8
@@ -470,12 +470,19 @@ int intel_guc_slpc_set_ignore_eff_freq(struct intel_guc_slpc *slpc, bool val) ret =slpc_set_param (slpc,SLPC_PARAM_IGNORE_EFFICIENT_FREQUENCY , val); -if (ret) +if (ret) {guc_probe_error (slpc_to_guc (slpc),"Failed to set efficient freq(%d): %pe\n" , val,ERR_PTR (ret)); -else + }else { slpc->ignore_eff_freq = val; +/* Set min to RPn when we disable efficient freq */ +if (val) + ret =slpc_set_param (slpc, +SLPC_PARAM_GLOBAL_MIN_GT_UNSLICE_FREQ_MHZ , + slpc->min_freq); + } +intel_runtime_pm_put (&i915->runtime_pm, wakeref);mutex_unlock (&slpc->lock);return ret;
@@ -602,9 +609,8 @@ static int slpc_set_softlimits(struct intel_guc_slpc *slpc)return ret;if (!slpc->min_freq_softlimit) { - ret =intel_guc_slpc_get_min_freq (slpc, &slpc->min_freq_softlimit); -if (unlikely (ret)) -return ret; +/* Min softlimit is initialized to RPn */ + slpc->min_freq_softlimit = slpc->min_freq;slpc_to_gt (slpc)->defaults.min_freq = slpc->min_freq_softlimit; }else { return intel_guc_slpc_set_min_freq(slpc,
@@ -755,6 +761,9 @@ int intel_guc_slpc_enable(struct intel_guc_slpc *slpc)return ret; } +/* Set cached value of ignore efficient freq */ +intel_guc_slpc_set_ignore_eff_freq (slpc, slpc->ignore_eff_freq); +/* Revert SLPC min/max to softlimits if necessary */ ret =slpc_set_softlimits (slpc);if (unlikely (ret)) {
@@ -765,9 +774,6 @@ int intel_guc_slpc_enable(struct intel_guc_slpc *slpc)/* Set cached media freq ratio mode */ intel_guc_slpc_set_media_ratio_mode (slpc, slpc->media_ratio_mode); -/* Set cached value of ignore efficient freq */ -intel_guc_slpc_set_ignore_eff_freq (slpc, slpc->ignore_eff_freq); -return 0 ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 149/234 net: macb: In ZynqMP resume always configure PS GTR for non-wakeup source
In reply to Greg Kroah-HartmanFrom: Radhey Shyam Pandey <[email protected]>
[ Upstream commit 6c461e394d11a981c662cc16cebfb05b602e23ba ]
On Zynq UltraScale+ MPSoC ubuntu platform when systemctl issues suspend, network manager bring down the interface and goes into suspend. When it wakes up it again enables the interface.
This leads to xilinx-psgtr "PLL lock timeout" on interface bringup, as the power management controller power down the entire FPD (including SERDES) if none of the FPD devices are in use and serdes is not initialized on resume.
$ sudo rtcwake -m no -s 120 -v $ sudo systemctl suspend <this does ifconfig eth1 down> $ ifconfig eth1 up xilinx-psgtr fd400000.phy: lane 0 (type 10, protocol 5): PLL lock timeout phy phy-fd400000.phy.0: phy poweron failed --> -110
macb driver is called in this way:
1. macb_close: Stop network interface. In this function, it reset MACB IP and disables PHY and network interface.
2. macb_suspend: It is called in kernel suspend flow. But because network interface has been disabled(netif_running(ndev) is false), it does nothing and returns directly;
3. System goes into suspend state. Some time later, system is waken up by RTC wakeup device;
4. macb_resume: It does nothing because network interface has been disabled;
5. macb_open: It is called to enable network interface again. ethernet interface is initialized in this API but serdes which is power-off by PMUFW during FPD-off suspend is not initialized again and so we hit GT PLL lock issue on open.
To resolve this PLL timeout issue always do PS GTR initialization when ethernet device is configured as non-wakeup source.
--- drivers/net/ethernet/cadence/macb_main.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/net/ethernet/cadence/macb_main.c +6 -3
@@ -5159,6 +5159,9 @@ static int __maybe_unused macb_suspend(struct device *dev)unsigned int q;int err; +if (!device_may_wakeup (&bp->dev->dev)) +phy_exit (bp->sgmii_phy); +if (!netif_running (netdev))return 0 ;
@@ -5219,7 +5222,6 @@ static int __maybe_unused macb_suspend(struct device *dev)if (!(bp->wol &MACB_WOL_ENABLED )) {rtnl_lock ();phylink_stop (bp->phylink); -phy_exit (bp->sgmii_phy);rtnl_unlock ();spin_lock_irqsave (&bp->lock, flags);macb_reset_hw (bp);
@@ -5249,6 +5251,9 @@ static int __maybe_unused macb_resume(struct device *dev)unsigned int q;int err; +if (!device_may_wakeup (&bp->dev->dev)) +phy_init (bp->sgmii_phy); +if (!netif_running (netdev))return 0 ;
@@ -5309,8 +5314,6 @@ static int __maybe_unused macb_resume(struct device *dev)macb_set_rx_mode (netdev);macb_restore_features (bp);rtnl_lock (); -if (!device_may_wakeup (&bp->dev->dev)) -phy_init (bp->sgmii_phy);phylink_start (bp->phylink);rtnl_unlock ();
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 150/234 octeon_ep: fix timeout value for waiting on mbox response
In reply to Greg Kroah-HartmanFrom: Michal Schmidt <[email protected]>
[ Upstream commit 519b227904f0e70d4a1d6cf41daa5392715f2d2f ]
The intention was to wait up to 500 ms for the mbox response. The third argument to wait_event_interruptible_timeout() is supposed to be the timeout duration. The driver mistakenly passed absolute time instead.
--- drivers/net/ethernet/marvell/octeon_ep/octep_ctrl_net.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeon_ep/octep_ctrl_net.c +1 -1
@@ -55,7 +55,7 @@ static int octep_send_mbox_req(struct octep_device *oct,list_add_tail (&d->list, &oct->ctrl_req_wait_list); ret =wait_event_interruptible_timeout (oct->ctrl_req_wait_q, (d->done !=0 ), - jiffies +msecs_to_jiffies (500 )); +msecs_to_jiffies (500 ));list_del (&d->list);if (ret ==0 || ret ==1 )return -EAGAIN ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 151/234 octeon_ep: cancel tx_timeout_task later in remove sequence
In reply to Greg Kroah-HartmanFrom: Michal Schmidt <[email protected]>
[ Upstream commit 28458c80006bb4e993a09fc094094a8578cad292 ]
tx_timeout_task is canceled too early when removing the driver. Nothing prevents .ndo_tx_timeout from triggering and queuing the work again.
Better cancel it after the netdev is unregistered.
It's harmless for octep_tx_timeout_task to run in the window between the unregistration and cancelation, because it checks netif_running.
--- drivers/net/ethernet/marvell/octeon_ep/octep_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeon_ep/octep_main.c +1 -1
@@ -1200,12 +1200,12 @@ static void octep_remove(struct pci_dev *pdev)if (!oct)return ; -cancel_work_sync (&oct->tx_timeout_task);cancel_work_sync (&oct->ctrl_mbox_task); netdev = oct->netdev;if (netdev->reg_state ==NETREG_REGISTERED )unregister_netdev (netdev); +cancel_work_sync (&oct->tx_timeout_task); oct->poll_non_ioq_intr = false;cancel_delayed_work_sync (&oct->intr_poll_task);octep_device_cleanup (oct);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 152/234 octeon_ep: cancel ctrl_mbox_task after intr_poll_task
In reply to Greg Kroah-HartmanFrom: Michal Schmidt <[email protected]>
[ Upstream commit 607a7a45cdf38c1901e0d81e4e00a2a88786330a ]
intr_poll_task may queue ctrl_mbox_task. The function octep_poll_non_ioq_interrupts_cn93_pf does this.
When removing the driver and canceling these two works, cancel ctrl_mbox_task last to guarantee it does not run anymore.
--- drivers/net/ethernet/marvell/octeon_ep/octep_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/marvell/octeon_ep/octep_main.c +1 -1
@@ -1200,7 +1200,6 @@ static void octep_remove(struct pci_dev *pdev)if (!oct)return ; -cancel_work_sync (&oct->ctrl_mbox_task); netdev = oct->netdev;if (netdev->reg_state ==NETREG_REGISTERED )unregister_netdev (netdev);
@@ -1208,6 +1207,7 @@ static void octep_remove(struct pci_dev *pdev)cancel_work_sync (&oct->tx_timeout_task); oct->poll_non_ioq_intr = false;cancel_delayed_work_sync (&oct->intr_poll_task); +cancel_work_sync (&oct->ctrl_mbox_task);octep_device_cleanup (oct);pci_release_mem_regions (pdev);free_netdev (netdev);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 153/234 octeon_ep: cancel queued works in probe error path
In reply to Greg Kroah-HartmanFrom: Michal Schmidt <[email protected]>
[ Upstream commit 758c91078165ae641b698750a72eafe7968b3756 ]
If it fails to get the devices's MAC address, octep_probe exits while leaving the delayed work intr_poll_task queued. When the work later runs, it's a use after free.
Move the cancelation of intr_poll_task from octep_remove into octep_device_cleanup. This does not change anything in the octep_remove flow, but octep_device_cleanup is called also in the octep_probe error path, where the cancelation is needed.
Note that the cancelation of ctrl_mbox_task has to follow intr_poll_task's, because the ctrl_mbox_task may be queued by intr_poll_task.
--- drivers/net/ethernet/marvell/octeon_ep/octep_main.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/ethernet/marvell/octeon_ep/octep_main.c +4 -3
@@ -1038,6 +1038,10 @@ static void octep_device_cleanup(struct octep_device *oct) {int i; + oct->poll_non_ioq_intr = false; +cancel_delayed_work_sync (&oct->intr_poll_task); +cancel_work_sync (&oct->ctrl_mbox_task); +dev_info (&oct->pdev->dev,"Cleaning up Octeon Device ...\n" );for (i =0 ; i <OCTEP_MAX_VF ; i++) {
@@ -1205,9 +1209,6 @@ static void octep_remove(struct pci_dev *pdev)unregister_netdev (netdev);cancel_work_sync (&oct->tx_timeout_task); - oct->poll_non_ioq_intr = false; -cancel_delayed_work_sync (&oct->intr_poll_task); -cancel_work_sync (&oct->ctrl_mbox_task);octep_device_cleanup (oct);pci_release_mem_regions (pdev);free_netdev (netdev);
Signature · 1 line
2.40.1