6.5.5-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 6.5.5-rc1 review
This is the start of the stable review cycle for the 6.5.5 release. There are 211 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 22 Sep 2023 11:28:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.5.5-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.5.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.5.5-rc1
Christian König <[email protected]>
drm/amdgpu: fix amdgpu_cs_p1_user_fence
Greg Kroah-Hartman <[email protected]>
Revert "memcg: drop kmem.limit_in_bytes"
Mustapha Ghaddar <[email protected]>
drm/amd/display: Fix 2nd DPIA encoder Assignment
Mustapha Ghaddar <[email protected]>
drm/amd/display: Add DPIA Link Encoder Assignment Fix
Yifan Zhang <[email protected]>
drm/amd/display: fix the white screen issue when >= 64GB DRAM
Wayne Lin <[email protected]>
drm/amd/display: Adjust the MST resume flow
Thomas Hellström <[email protected]>
drm/tests: helpers: Avoid a driver uaf
Harish Kasiviswanathan <[email protected]>
drm/amdkfd: Insert missing TLB flush on GFX10 and later
Ville Syrjälä <[email protected]>
drm/i915: Only check eDP HPD when AUX CH is shared
Alex Deucher <[email protected]>
drm/radeon: make fence wait in suballocator uninterrruptable
Shida Zhang <[email protected]>
ext4: fix rec_len verify error
Ian Abbott <[email protected]>
Revert "comedi: add HAS_IOPORT dependencies"
Damien Le Moal <[email protected]>
scsi: pm8001: Setup IRQs on resume
Nilesh Javali <[email protected]>
scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id()
Junxiao Bi <[email protected]>
scsi: megaraid_sas: Fix deadlock on firmware crashdump
Szuying Chen <[email protected]>
ata: libahci: clear pending interrupt status
Niklas Cassel <[email protected]>
ata: libata: disallow dev-initiated LPM transitions to unsupported states
Tommy Huang <[email protected]>
i2c: aspeed: Reset the i2c controller when timeout occurs
Steven Rostedt (Google) <[email protected]>
tracefs: Add missing lockdown check to tracefs_create_dir()
Jeff Layton <[email protected]>
nfsd: fix change_info in NFSv4 RENAME replies
Ondrej Mosnacek <[email protected]>
selinux: fix handling of empty opts in selinux_fs_context_submount()
Steven Rostedt (Google) <[email protected]>
tracing: Have option files inc the trace array ref count
Steven Rostedt (Google) <[email protected]>
tracing: Have current_trace inc the trace array ref count
Steven Rostedt (Google) <[email protected]>
tracing: Increase trace array ref count on enable and filter files
Tero Kristo <[email protected]>
tracing/synthetic: Print out u64 values properly
Steven Rostedt (Google) <[email protected]>
tracing: Have event inject files inc the trace array ref count
Steven Rostedt (Google) <[email protected]>
tracing: Have tracing_max_latency inc the trace array ref count
Steven Rostedt (Google) <[email protected]>
tracing/synthetic: Fix order of struct trace_dynamic_info
Josef Bacik <[email protected]>
btrfs: check for BTRFS_FS_ERROR in pending ordered assert
Filipe Manana <[email protected]>
btrfs: release path before inode lookup during the ino lookup ioctl
Filipe Manana <[email protected]>
btrfs: fix race between finishing block group creation and its item update
Qu Wenruo <[email protected]>
btrfs: fix a compilation error if DEBUG is defined in btree_dirty_folio
Filipe Manana <[email protected]>
btrfs: fix lockdep splat and potential deadlock after failure running delayed items
Mikulas Patocka <[email protected]>
dm: fix a race condition in retrieve_deps
Jens Axboe <[email protected]>
dm: don't attempt to queue IO under RCU protection
Hamza Mahfooz <[email protected]>
Revert "drm/amd: Disable S/G for APUs when 64GB or more host memory"
Simon Pilkington <[email protected]>
drm/amd: Make fence wait in suballocator uninterruptible
Mariusz Tkaczyk <[email protected]>
md: Put the right device in md_seq_next
Takashi Sakamoto <[email protected]>
Revert "firewire: core: obsolete usage of GFP_ATOMIC at building node tree"
Steve Wahl <[email protected]>
x86/platform/uv: Use alternate source for socket to node data
Keith Busch <[email protected]>
nvme: avoid bogus CRTO values
Pavel Begunkov <[email protected]>
io_uring/net: fix iter retargeting for selected buf
Amir Goldstein <[email protected]>
ovl: fix incorrect fdput() on aio completion
Amir Goldstein <[email protected]>
ovl: fix failed copyup of fileattr on a symlink
Christian Brauner <[email protected]>
attr: block mode changes of symlinks
Trond Myklebust <[email protected]>
Revert "SUNRPC: Fail faster on bad verifier"
Nigel Croxon <[email protected]>
md/raid1: fix error: ISO C90 forbids mixed declarations
Chengming Zhou <[email protected]>
blk-mq: fix tags UAF when shrinking q->nr_hw_queues
Chengming Zhou <[email protected]>
blk-mq: prealloc tags when increase tagset nr_hw_queues
Arnd Bergmann <[email protected]>
samples/hw_breakpoint: fix building without module unloading
Song Liu <[email protected]>
x86/purgatory: Remove LTO flags
Kirill A. Shutemov <[email protected]>
x86/boot/compressed: Reserve more memory for page tables
Niklas Cassel <[email protected]>
ata: libata-core: fetch sense data for successful commands iff CDL enabled
Hannes Reinecke <[email protected]>
ata: libata: remove references to non-existing error_handler()
Lukas Wunner <[email protected]>
panic: Reenable preemption in WARN slowpath
Jinjie Ruan <[email protected]>
scsi: lpfc: Fix the NULL vs IS_ERR() bug for debugfs_create_file()
David Disseldorp <[email protected]>
scsi: target: core: Fix target_cmd_counter leak
Ricardo Neri <[email protected]>
x86/sched: Restore the SD_ASYM_PACKING flag in the DIE domain
Song Shuai <[email protected]>
riscv: kexec: Align the kexeced kernel entry
Peter Zijlstra <[email protected]>
x86/ibt: Avoid duplicate ENDBR in __put_user_nocheck*()
Peter Zijlstra <[email protected]>
x86/ibt: Suppress spurious ENDBR
Masami Hiramatsu (Google) <[email protected]>
selftests: tracing: Fix to unmount tracefs for recovering environment
Chen Yu <[email protected]>
PM: hibernate: Fix the exclusive get block device in test_resume mode
Heinrich Schuchardt <[email protected]>
efivarfs: fix statfs() on efivarfs
Yu Kuai <[email protected]>
md: fix warning for holder mismatch from export_rdev()
Yu Kuai <[email protected]>
md: don't dereference mddev after export_rdev()
Jinjie Ruan <[email protected]>
scsi: qla2xxx: Fix NULL vs IS_ERR() bug for debugfs_create_dir()
Jinjie Ruan <[email protected]>
drm: gm12u320: Fix the timeout usage for usb_bulk_msg()
Varun Prakash <[email protected]>
nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page()
Anand Jain <[email protected]>
btrfs: compare the correct fsid/metadata_uuid in btrfs_validate_super
Anand Jain <[email protected]>
btrfs: add a helper to read the superblock metadata_uuid
Takahiro Kuwano <[email protected]>
mtd: spi-nor: spansion: preserve CFR2V[7] when writing MEMLAT
Takahiro Kuwano <[email protected]>
mtd: spi-nor: spansion: use CLPEF as an alternative to CLSR
Naohiro Aota <[email protected]>
btrfs: zoned: activate metadata block group on write time
Naohiro Aota <[email protected]>
btrfs: zoned: defer advancing meta write pointer
Naohiro Aota <[email protected]>
btrfs: zoned: return int from btrfs_check_meta_write_pointer
Naohiro Aota <[email protected]>
btrfs: zoned: introduce block group context to btrfs_eb_write_context
Naohiro Aota <[email protected]>
btrfs: introduce struct to consolidate extent buffer write context
Baokun Li <[email protected]>
ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow
John Ogness <[email protected]>
printk: Rename abandon_console_lock_in_panic() to other_cpu_in_panic()
John Ogness <[email protected]>
printk: Consolidate console deferred printing
John Ogness <[email protected]>
printk: Do not take console lock for console_flush_on_panic()
John Ogness <[email protected]>
printk: Keep non-panic-CPUs out of console lock
John Ogness <[email protected]>
printk: Reduce console_unblank() usage in unsafe scenarios
Dmitry Baryshkov <[email protected]>
usb: typec: qcom-pmic-typec: register drm_bridge
Rob Clark <[email protected]>
interconnect: Fix locking for runpm vs reclaim
Zhen Lei <[email protected]>
kobject: Add sanity check for kset->kobj.ktype in kset_register()
Sakari Ailus <[email protected]>
media: pci: ipu3-cio2: Initialise timing struct to avoid a compiler warning
Xu Yang <[email protected]>
usb: chipidea: add workaround for chipidea PEC bug
Xu Yang <[email protected]>
usb: ehci: add workaround for chipidea PORTSC.PEC bug
Ladislav Michl <[email protected]>
usb: dwc3: dwc3-octeon: Verify clock divider
Baoquan He <[email protected]>
misc: open-dice: make OPEN_DICE depend on HAS_IOMEM
Christophe Leroy <[email protected]>
serial: cpm_uart: Avoid suspicious locking
Konstantin Shelekhin <[email protected]>
scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()
Chenyuan Mi <[email protected]>
tools: iio: iio_generic_buffer: Fix some integer type and calculation
Ma Ke <[email protected]>
usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc
Madhu M <[email protected]>
usb: typec: intel_pmc_mux: Add new ACPI ID for Lunar Lake IOM device
Xiaolei Wang <[email protected]>
usb: cdns3: Put the cdns set active part outside the spin lock
Hans Verkuil <[email protected]>
media: pci: cx23885: replace BUG with error return
Hans Verkuil <[email protected]>
media: tuners: qt1010: replace BUG_ON with a regular error
Justin Tee <[email protected]>
scsi: lpfc: Abort outstanding ELS cmds when mailbox timeout error is detected
Zhang Shurong <[email protected]>
media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xfer
Zhang Shurong <[email protected]>
media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()
Zhang Shurong <[email protected]>
media: anysee: fix null-ptr-deref in anysee_master_xfer
Zhang Shurong <[email protected]>
media: af9005: Fix null-ptr-deref in af9005_i2c_xfer
Zhang Shurong <[email protected]>
media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
Zhang Shurong <[email protected]>
media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer
Lu Hongfei <[email protected]>
media: mdp3: Fix resource leaks in of_find_device_by_node
Yong-Xuan Wang <[email protected]>
PCI: fu740: Set the number of MSI vectors
Nirmal Patel <[email protected]>
PCI: vmd: Disable bridge window for domain reset
ruanjinjie <[email protected]>
powerpc/pseries: fix possible memory leak in ibmebus_bus_init()
Mårten Lindahl <[email protected]>
ARM: 9317/1: kexec: Make smp stop calls asynchronous
Mark Brown <[email protected]>
PCI: dwc: Provide deinit callback for i.MX
Baokun Li <[email protected]>
ext4: avoid overlapping preallocations due to overflow
Baokun Li <[email protected]>
ext4: add two helper functions extent_logical_end() and pa_logical_end()
Liu Shixin via Jfs-discussion <[email protected]>
jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount
Andrew Kanner <[email protected]>
fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount()
Mateusz Guzik <[email protected]>
x86: bring back rep movsq for user access on CPUs without ERMS
Vijendar Mukunda <[email protected]>
ASoC: SOF: amd: clear panic mask status when panic occurs
Chengming Zhou <[email protected]>
blk-mq: fix tags leak when shrink nr_hw_queues
Georg Ottinger <[email protected]>
ext2: fix datatype of block number in ext2_xattr_set2()
Zhang Shurong <[email protected]>
md: raid1: fix potential OOB in raid1_remove_disk()
Konrad Dybcio <[email protected]>
arm64: dts: qcom: sc8280xp-x13s: Add camera activity LED
Tony Lindgren <[email protected]>
bus: ti-sysc: Configure uart quirks for k3 SoC
AngeloGioacchino Del Regno <[email protected]>
drm/mediatek: dp: Change logging to dev for mtk_dp_aux_transfer()
Jens Axboe <[email protected]>
io_uring: annotate the struct io_kiocb slab for appropriate user copy
Tuo Li <[email protected]>
drm/exynos: fix a possible null-pointer dereference due to data race in exynos_drm_crtc_atomic_disable()
Rob Clark <[email protected]>
drm/msm/adreno: Use quirk to identify cached-coherent support
Rob Clark <[email protected]>
drm/msm/adreno: Use quirk identify hw_apriv
Alvin Lee <[email protected]>
drm/amd/display: Use max memclk variable when setting max memclk
Leo Chen <[email protected]>
drm/amd/display: Blocking invalid 420 modes on HDMI TMDS for DCN314
Leo Chen <[email protected]>
drm/amd/display: Blocking invalid 420 modes on HDMI TMDS for DCN31
Austin Zheng <[email protected]>
drm/amd/display: Use DTBCLK as refclk instead of DPREFCLK
Pierre-Louis Bossart <[email protected]>
ALSA: hda: intel-dsp-cfg: add LunarLake support
Uday M Bhat <[email protected]>
ASoC: Intel: sof_sdw: Update BT offload config for soundwire config
Pierre-Louis Bossart <[email protected]>
ASoC: SOF: topology: simplify code to prevent static analysis warnings
Leo Ma <[email protected]>
drm/amd/display: Fix underflow issue on 175hz timing
Lijo Lazar <[email protected]>
drm/amdgpu: Update ring scheduler info as needed
Rong Tao <[email protected]>
samples/hw_breakpoint: Fix kernel BUG 'invalid opcode: 0000'
Philip Yang <[email protected]>
drm/amdgpu: Increase soft IH ring size
Krzysztof Kozlowski <[email protected]>
arm64: dts: qcom: sm8250-edo: correct ramoops pmsg-size
Krzysztof Kozlowski <[email protected]>
arm64: dts: qcom: sm8150-kumano: correct ramoops pmsg-size
Krzysztof Kozlowski <[email protected]>
arm64: dts: qcom: sm6350: correct ramoops pmsg-size
Krzysztof Kozlowski <[email protected]>
arm64: dts: qcom: sm6125-sprout: correct ramoops pmsg-size
Krzysztof Kozlowski <[email protected]>
arm64: dts: qcom: sm6125-pdx201: correct ramoops pmsg-size
Marek Vasut <[email protected]>
drm: bridge: samsung-dsim: Drain command transfer FIFO before transfer
Ralph Campbell <[email protected]>
drm/edid: Add quirk for OSVR HDK 2.0
Marek Vasut <[email protected]>
drm/bridge: tc358762: Instruct DSI host to generate HSE packets
Dave Marchevsky <[email protected]>
bpf: Consider non-owning refs to refcounted nodes RCU protected
Dave Marchevsky <[email protected]>
bpf: Consider non-owning refs trusted
Alan Stern <[email protected]>
Fix nomenclature for USB and PCI wireless devices
Wen Gong <[email protected]>
wifi: ath12k: add check max message length while scanning with extraie
Rajat Soni <[email protected]>
wifi: ath12k: Fix memory leak in rx_desc and tx_desc
Hao Luo <[email protected]>
libbpf: Free btf_vmlinux when closing bpf_object
Johannes Berg <[email protected]>
Revert "wifi: mac80211_hwsim: check the return value of nla_put_u32"
Johannes Berg <[email protected]>
wifi: mac80211_hwsim: drop short frames
Johannes Berg <[email protected]>
wifi: mac80211: check for station first in client probe
Johannes Berg <[email protected]>
wifi: cfg80211: ocb: don't leave if not joined
Johannes Berg <[email protected]>
wifi: cfg80211: reject auth/assoc to AP with our address
GONG, Ruiqi <[email protected]>
netfilter: ebtables: fix fortify warnings in size_entry_mwt()
Johannes Berg <[email protected]>
wifi: mac80211: check S1G action frame size
Avraham Stern <[email protected]>
wifi: iwlwifi: pcie: avoid a warning in case prepare card failed
GONG, Ruiqi <[email protected]>
alx: fix OOB-read compiler warning
Giulio Benetti <[email protected]>
mmc: sdhci-esdhc-imx: improve ESDHC_FLAG_ERR010450
Alexander Steffen <[email protected]>
tpm_tis: Resend command to recover from data transfer errors
Eric Dumazet <[email protected]>
netlink: convert nlk->flags to atomic flags
Roger Gammans <[email protected]>
Bluetooth: btusb: Add support for another MediaTek 7922 VID/PID
Ying Hsu <[email protected]>
Bluetooth: Fix hci_suspend_sync crash
Chris Lu <[email protected]>
Bluetooth: btusb: Add new VID/PID 04ca/3804 for MT7922
Chris Lu <[email protected]>
Bluetooth: btusb: Add new VID/PID 0489/e102 for MT7922
Chris Lu <[email protected]>
Bluetooth: btusb: Add a new VID/PID 0489/e0f6 for MT7922
Valentin David <[email protected]>
Bluetooth: btusb: Add device 0489:e0f5 as MT7922 device
Mark O'Donovan <[email protected]>
crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()
xu xin <[email protected]>
net/ipv4: return the real errno instead of -EINVAL
Wen Gong <[email protected]>
wifi: ath12k: avoid array overflow of hw mode for preferred_hw_mode
Wen Gong <[email protected]>
wifi: ath12k: Fix a NULL pointer dereference in ath12k_mac_op_hw_scan()
Kuniyuki Iwashima <[email protected]>
net: Use sockaddr_storage for getsockopt(SO_PEERNAME).
John Watts <[email protected]>
can: sun4i_can: Add support for the Allwinner D1
John Watts <[email protected]>
can: sun4i_can: Add acceptance register quirk
Dmitry Antipov <[email protected]>
wifi: wil6210: fix fortify warnings
Matt Whitlock <[email protected]>
mt76: mt7921: don't assume adequate headroom for SDIO headers
Dmitry Antipov <[email protected]>
wifi: mwifiex: fix fortify warning
Dmitry Antipov <[email protected]>
wifi: rtw88: delete timer and free skb queue when unloading
Dongliang Mu <[email protected]>
wifi: ath9k: fix printk specifier
Dmitry Antipov <[email protected]>
wifi: ath9k: fix fortify warnings
Wojciech Drewek <[email protected]>
ice: Don't tx before switchdev is fully configured
Jisheng Zhang <[email protected]>
net: stmmac: use per-queue 64 bit statistics where necessary
Azeem Shaikh <[email protected]>
crypto: lrw,xts - Replace strlcpy with strscpy
Jiri Pirko <[email protected]>
devlink: remove reload failed checks in params get/set callbacks
Maksim Kiselev <[email protected]>
spi: sun6i: add quirk for dual and quad SPI modes support
Thomas Weißschuh <[email protected]>
selftests/nolibc: prevent out of bounds access in expect_vfprintf
Zhangjin Wu <[email protected]>
selftests/nolibc: fix up kernel parameters support
Mario Limonciello <[email protected]>
ACPI: x86: s2idle: Catch multiple ACPI_TYPE_PACKAGE objects
Tomislav Novak <[email protected]>
hw_breakpoint: fix single-stepping when using bpf_overflow_handler
Hans de Goede <[email protected]>
ACPI: video: Add backlight=native DMI quirk for Apple iMac12,1 and iMac12,2
Xu Yang <[email protected]>
perf/imx_ddr: speed up overflow frequency of cycle
Ding Xiang <[email protected]>
kselftest/arm64: fix a memleak in zt_regs_run()
Alexander Gordeev <[email protected]>
s390/boot: cleanup number of page table levels setup
Yicong Yang <[email protected]>
perf/smmuv3: Enable HiSilicon Erratum 162001900 quirk for HIP08/09
Avadhut Naik <[email protected]>
x86/amd_nb: Add PCI IDs for AMD Family 1Ah-based models
Rob Barnes <[email protected]>
platform/chrome: cros_ec_lpc: Remove EC panic shutdown timeout
Jiri Slaby (SUSE) <[email protected]>
ACPI: video: Add backlight=native DMI quirk for Lenovo Ideapad Z470
Paul E. McKenney <[email protected]>
scftorture: Forgive memory-allocation failure if KASAN
Zqiang <[email protected]>
rcuscale: Move rcu_scale_writer() schedule_timeout_uninterruptible() to _idle()
Wander Lairson Costa <[email protected]>
kernel/fork: beware of __put_task_struct() calling context
Abhishek Mainkar <[email protected]>
ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer
Will Shiu <[email protected]>
locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock
Qu Wenruo <[email protected]>
btrfs: output extra debug info if we failed to find an inline backref
Qu Wenruo <[email protected]>
btrfs: handle errors properly in update_inline_extent_backref()
Fedor Pchelkin <[email protected]>
autofs: fix memory leak of waitqueues in autofs_catatonic_mode
Ritesh Harjani (IBM) <[email protected]>
iomap: Fix possible overflow condition in iomap_write_delalloc_scan
-------------
Diffstat:
Documentation/admin-guide/cgroup-v1/memory.rst | 2 + Documentation/arch/arm64/silicon-errata.rst | 3 + Makefile | 4 +- arch/arm/kernel/hw_breakpoint.c | 8 +- arch/arm/kernel/machine_kexec.c | 14 +- .../dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts | 16 ++ .../dts/qcom/sm6125-sony-xperia-seine-pdx201.dts | 2 +- .../boot/dts/qcom/sm6125-xiaomi-laurel-sprout.dts | 2 +- arch/arm64/boot/dts/qcom/sm6350.dtsi | 2 +- .../boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi | 2 +- .../boot/dts/qcom/sm8250-sony-xperia-edo.dtsi | 2 +- arch/arm64/kernel/hw_breakpoint.c | 4 +- arch/mips/cavium-octeon/octeon-usb.c | 8 +- arch/powerpc/platforms/pseries/ibmebus.c | 1 + arch/riscv/kernel/elf_kexec.c | 8 +- arch/s390/boot/startup.c | 9 +- arch/x86/boot/compressed/ident_map_64.c | 8 + arch/x86/include/asm/boot.h | 45 +++-- arch/x86/include/asm/linkage.h | 8 + arch/x86/include/asm/uaccess_64.h | 2 +- arch/x86/kernel/amd_nb.c | 8 + arch/x86/kernel/apic/x2apic_uv_x.c | 11 +- arch/x86/kernel/smpboot.c | 12 +- arch/x86/lib/copy_user_64.S | 57 ++---- arch/x86/lib/putuser.S | 4 - arch/x86/purgatory/Makefile | 4 + block/blk-mq.c | 19 +- crypto/lrw.c | 6 +- crypto/xts.c | 6 +- drivers/acpi/acpica/psopcode.c | 2 +- drivers/acpi/arm64/iort.c | 5 +- drivers/acpi/video_detect.c | 27 +++ drivers/acpi/x86/s2idle.c | 6 + drivers/ata/ahci.c | 9 + drivers/ata/libahci.c | 35 ++-- drivers/ata/libata-core.c | 206 ++++++++------------- drivers/ata/libata-eh.c | 152 +++++++-------- drivers/ata/libata-sata.c | 26 ++- drivers/ata/libata-scsi.c | 161 ++-------------- drivers/ata/libata-sff.c | 30 +-- drivers/bluetooth/btusb.c | 15 ++ drivers/bus/ti-sysc.c | 2 + drivers/char/tpm/tpm_tis_core.c | 13 +- drivers/comedi/Kconfig | 103 ++++------- drivers/firewire/core-device.c | 2 +- drivers/firewire/core-topology.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 - drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 18 +- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 26 --- drivers/gpu/drm/amd/amdgpu/amdgpu_ih.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ih.h | 7 +- drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c | 2 +- .../gpu/drm/amd/amdgpu/aqua_vanjaram_reg_init.c | 2 +- drivers/gpu/drm/amd/amdgpu/ih_v6_0.c | 4 +- drivers/gpu/drm/amd/amdgpu/navi10_ih.c | 4 +- drivers/gpu/drm/amd/amdgpu/vega10_ih.c | 4 +- drivers/gpu/drm/amd/amdgpu/vega20_ih.c | 4 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 3 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 112 +++++++++-- .../amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c | 2 +- .../gpu/drm/amd/display/dc/core/dc_link_enc_cfg.c | 35 +++- drivers/gpu/drm/amd/display/dc/dc.h | 1 + .../drm/amd/display/dc/dcn314/dcn314_resource.c | 23 +++ drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dccg.c | 3 +- .../amd/display/dc/dml/dcn31/display_mode_vba_31.c | 4 +- .../display/dc/dml/dcn314/display_mode_vba_314.c | 4 +- .../dc/dml/dcn32/display_mode_vba_util_32.c | 7 +- drivers/gpu/drm/amd/display/dc/inc/core_types.h | 1 + drivers/gpu/drm/amd/display/dc/link/link_factory.c | 4 + drivers/gpu/drm/bridge/samsung-dsim.c | 2 +- drivers/gpu/drm/bridge/tc358762.c | 2 +- drivers/gpu/drm/drm_edid.c | 1 + drivers/gpu/drm/exynos/exynos_drm_crtc.c | 5 +- drivers/gpu/drm/i915/display/intel_bios.c | 21 +++ drivers/gpu/drm/i915/display/intel_bios.h | 1 + drivers/gpu/drm/i915/display/intel_dp.c | 7 +- drivers/gpu/drm/mediatek/mtk_dp.c | 6 +- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 3 +- drivers/gpu/drm/msm/adreno/adreno_device.c | 19 +- drivers/gpu/drm/msm/adreno/adreno_gpu.h | 2 + drivers/gpu/drm/radeon/radeon_sa.c | 2 +- drivers/gpu/drm/tiny/gm12u320.c | 10 +- drivers/i2c/busses/i2c-aspeed.c | 7 +- drivers/interconnect/core.c | 8 +- drivers/md/dm-core.h | 1 + drivers/md/dm-ioctl.c | 7 +- drivers/md/dm-table.c | 32 +++- drivers/md/dm.c | 23 +-- drivers/md/md.c | 23 ++- drivers/md/md.h | 3 + drivers/md/raid1.c | 3 + drivers/media/pci/cx23885/cx23885-video.c | 2 +- drivers/media/pci/intel/ipu3/ipu3-cio2-main.c | 2 +- .../media/platform/mediatek/mdp3/mtk-mdp3-comp.c | 2 + drivers/media/tuners/qt1010.c | 11 +- drivers/media/usb/dvb-usb-v2/af9035.c | 9 +- drivers/media/usb/dvb-usb-v2/anysee.c | 2 +- drivers/media/usb/dvb-usb-v2/az6007.c | 8 + drivers/media/usb/dvb-usb-v2/gl861.c | 2 +- drivers/media/usb/dvb-usb/af9005.c | 5 + drivers/media/usb/dvb-usb/dw2102.c | 24 +++ drivers/misc/Kconfig | 1 + drivers/mmc/host/sdhci-esdhc-imx.c | 7 +- drivers/mtd/spi-nor/atmel.c | 8 +- drivers/mtd/spi-nor/core.c | 23 ++- drivers/mtd/spi-nor/core.h | 4 +- drivers/mtd/spi-nor/issi.c | 4 +- drivers/mtd/spi-nor/macronix.c | 4 +- drivers/mtd/spi-nor/micron-st.c | 4 +- drivers/mtd/spi-nor/spansion.c | 86 +++++++-- drivers/mtd/spi-nor/sst.c | 8 +- drivers/mtd/spi-nor/winbond.c | 4 +- drivers/mtd/spi-nor/xilinx.c | 4 +- drivers/net/can/Kconfig | 4 +- drivers/net/can/sun4i_can.c | 22 ++- drivers/net/ethernet/atheros/alx/ethtool.c | 5 +- drivers/net/ethernet/intel/ice/ice_eswitch.c | 3 + drivers/net/ethernet/stmicro/stmmac/common.h | 39 ++-- drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 12 +- drivers/net/ethernet/stmicro/stmmac/dwmac100_dma.c | 7 +- drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c | 16 +- drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c | 15 +- drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c | 12 +- .../net/ethernet/stmicro/stmmac/dwxgmac2_descs.c | 6 +- drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 14 +- drivers/net/ethernet/stmicro/stmmac/enh_desc.c | 20 +- drivers/net/ethernet/stmicro/stmmac/hwif.h | 12 +- drivers/net/ethernet/stmicro/stmmac/norm_desc.c | 15 +- drivers/net/ethernet/stmicro/stmmac/stmmac.h | 2 + .../net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 123 +++++++++--- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 200 +++++++++++++++----- drivers/net/wireless/ath/ath10k/pci.c | 2 +- drivers/net/wireless/ath/ath10k/usb.c | 2 +- drivers/net/wireless/ath/ath11k/pci.c | 2 +- drivers/net/wireless/ath/ath12k/dp.c | 30 ++- drivers/net/wireless/ath/ath12k/dp.h | 2 + drivers/net/wireless/ath/ath12k/mac.c | 7 +- drivers/net/wireless/ath/ath12k/pci.c | 2 +- drivers/net/wireless/ath/ath12k/wmi.c | 24 ++- drivers/net/wireless/ath/ath9k/ahb.c | 4 +- drivers/net/wireless/ath/ath9k/mac.h | 6 +- drivers/net/wireless/ath/ath9k/pci.c | 4 +- drivers/net/wireless/ath/ath9k/xmit.c | 4 +- drivers/net/wireless/ath/wil6210/txrx.c | 2 +- drivers/net/wireless/ath/wil6210/txrx.h | 6 +- drivers/net/wireless/ath/wil6210/txrx_edma.c | 2 +- drivers/net/wireless/ath/wil6210/txrx_edma.h | 6 +- drivers/net/wireless/atmel/at76c50x-usb.c | 8 +- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 11 +- .../net/wireless/intersil/orinoco/orinoco_usb.c | 12 +- drivers/net/wireless/legacy/rndis_wlan.c | 2 +- drivers/net/wireless/marvell/mwifiex/tdls.c | 9 +- drivers/net/wireless/mediatek/mt76/mt7603/Kconfig | 2 +- drivers/net/wireless/mediatek/mt76/mt7615/Kconfig | 2 +- drivers/net/wireless/mediatek/mt76/mt76x0/Kconfig | 4 +- drivers/net/wireless/mediatek/mt76/mt76x2/Kconfig | 4 +- drivers/net/wireless/mediatek/mt76/mt7915/Kconfig | 2 +- drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 4 + drivers/net/wireless/mediatek/mt76/mt7996/Kconfig | 2 +- drivers/net/wireless/mediatek/mt7601u/Kconfig | 2 +- drivers/net/wireless/purelifi/plfxlc/Kconfig | 2 +- drivers/net/wireless/ralink/rt2x00/Kconfig | 2 +- drivers/net/wireless/realtek/rtw88/main.c | 4 +- drivers/net/wireless/realtek/rtw88/pci.c | 2 +- drivers/net/wireless/realtek/rtw88/usb.c | 2 +- drivers/net/wireless/realtek/rtw89/pci.c | 2 +- drivers/net/wireless/virtual/mac80211_hwsim.c | 12 +- drivers/net/wireless/zydas/zd1201.c | 6 +- drivers/nvme/host/core.c | 54 ++++-- drivers/nvme/target/tcp.c | 2 +- drivers/pci/controller/dwc/pci-imx6.c | 1 + drivers/pci/controller/dwc/pcie-fu740.c | 1 + drivers/pci/controller/vmd.c | 19 +- drivers/perf/arm_smmuv3_pmu.c | 46 ++++- drivers/perf/fsl_imx8_ddr_perf.c | 21 +++ drivers/platform/chrome/cros_ec_lpc.c | 4 +- drivers/platform/x86/eeepc-laptop.c | 2 +- drivers/scsi/lpfc/lpfc.h | 1 + drivers/scsi/lpfc/lpfc_debugfs.c | 14 +- drivers/scsi/lpfc/lpfc_els.c | 25 ++- drivers/scsi/lpfc/lpfc_init.c | 20 +- drivers/scsi/lpfc/lpfc_sli.c | 8 +- drivers/scsi/megaraid/megaraid_sas.h | 2 +- drivers/scsi/megaraid/megaraid_sas_base.c | 21 +-- drivers/scsi/pm8001/pm8001_init.c | 51 ++--- drivers/scsi/qla2xxx/qla_dfs.c | 6 +- drivers/scsi/qla2xxx/qla_inline.h | 2 +- drivers/scsi/qla2xxx/qla_isr.c | 6 +- drivers/scsi/qla2xxx/qla_target.c | 3 +- drivers/scsi/qla2xxx/tcm_qla2xxx.c | 4 +- drivers/spi/spi-sun6i.c | 29 ++- drivers/staging/wlan-ng/prism2usb.c | 48 ++--- drivers/target/iscsi/iscsi_target_configfs.c | 54 +++--- drivers/target/target_core_transport.c | 1 + drivers/tty/serial/cpm_uart/cpm_uart_core.c | 13 +- drivers/usb/cdns3/cdns3-plat.c | 3 +- drivers/usb/cdns3/cdnsp-pci.c | 3 +- drivers/usb/cdns3/core.c | 15 +- drivers/usb/cdns3/core.h | 7 +- drivers/usb/chipidea/ci.h | 1 + drivers/usb/chipidea/ci_hdrc_imx.c | 4 +- drivers/usb/chipidea/core.c | 2 + drivers/usb/chipidea/host.c | 1 + drivers/usb/gadget/udc/fsl_qe_udc.c | 2 + drivers/usb/host/ehci-hcd.c | 8 +- drivers/usb/host/ehci-hub.c | 10 +- drivers/usb/host/ehci.h | 10 + drivers/usb/typec/mux/intel_pmc_mux.c | 25 ++- drivers/usb/typec/tcpm/Kconfig | 1 + drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c | 37 ++++ fs/attr.c | 20 +- fs/autofs/waitq.c | 3 +- fs/btrfs/block-group.c | 23 ++- fs/btrfs/delayed-inode.c | 19 +- fs/btrfs/disk-io.c | 22 +-- fs/btrfs/extent-tree.c | 78 ++++++-- fs/btrfs/extent_io.c | 43 ++--- fs/btrfs/extent_io.h | 7 + fs/btrfs/fs.h | 3 + fs/btrfs/ioctl.c | 8 +- fs/btrfs/ordered-data.c | 2 +- fs/btrfs/volumes.c | 8 + fs/btrfs/volumes.h | 1 + fs/btrfs/zoned.c | 131 ++++++++++--- fs/btrfs/zoned.h | 20 +- fs/efivarfs/super.c | 14 +- fs/ext2/xattr.c | 4 +- fs/ext4/mballoc.c | 61 +++--- fs/ext4/mballoc.h | 14 ++ fs/ext4/namei.c | 26 +-- fs/iomap/buffered-io.c | 2 +- fs/jfs/jfs_dmap.c | 1 + fs/jfs/jfs_imap.c | 1 + fs/locks.c | 2 +- fs/nfsd/nfs4proc.c | 4 +- fs/overlayfs/copy_up.c | 3 +- fs/overlayfs/file.c | 9 +- fs/tracefs/inode.c | 3 + include/drm/drm_kunit_helpers.h | 4 +- include/linux/acpi_iort.h | 1 + include/linux/bpf.h | 3 +- include/linux/bpf_verifier.h | 2 +- include/linux/instruction_pointer.h | 5 + include/linux/libata.h | 6 +- include/linux/pci_ids.h | 2 + include/linux/perf_event.h | 22 ++- include/linux/sched/task.h | 28 ++- include/linux/trace_events.h | 6 +- include/linux/usb/chipidea.h | 1 + include/uapi/linux/netfilter_bridge/ebtables.h | 14 +- io_uring/io_uring.c | 16 +- io_uring/net.c | 5 + kernel/bpf/verifier.c | 13 +- kernel/fork.c | 8 + kernel/panic.c | 1 + kernel/power/hibernate.c | 12 +- kernel/printk/internal.h | 2 + kernel/printk/printk.c | 139 ++++++++++---- kernel/printk/printk_safe.c | 9 +- kernel/rcu/rcuscale.c | 2 +- kernel/scftorture.c | 6 +- kernel/trace/trace.c | 68 ++++++- kernel/trace/trace.h | 2 + kernel/trace/trace_events.c | 6 +- kernel/trace/trace_events_inject.c | 3 +- kernel/trace/trace_events_synth.c | 2 +- lib/kobject.c | 5 + lib/mpi/mpi-cmp.c | 8 +- mm/memcontrol.c | 10 + net/bluetooth/hci_core.c | 4 + net/bridge/netfilter/ebtables.c | 3 +- net/core/sock.c | 6 +- net/devlink/leftover.c | 4 +- net/ipv4/ip_output.c | 2 +- net/mac80211/cfg.c | 15 +- net/mac80211/rx.c | 4 + net/netlink/af_netlink.c | 90 +++------ net/netlink/af_netlink.h | 22 ++- net/netlink/diag.c | 10 +- net/sunrpc/clnt.c | 2 +- net/wireless/mlme.c | 13 ++ net/wireless/ocb.c | 3 + samples/hw_breakpoint/data_breakpoint.c | 4 +- security/selinux/hooks.c | 10 +- sound/hda/intel-dsp-config.c | 8 + sound/soc/intel/boards/sof_sdw.c | 4 +- sound/soc/sof/amd/acp-ipc.c | 4 + sound/soc/sof/topology.c | 5 +- tools/iio/iio_generic_buffer.c | 17 +- tools/lib/bpf/libbpf.c | 1 + .../selftests/arm64/signal/testcases/zt_regs.c | 1 + tools/testing/selftests/ftrace/ftracetest | 8 + tools/testing/selftests/nolibc/nolibc-test.c | 35 +++- 294 files changed, 2745 insertions(+), 1554 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/211 iomap: Fix possible overflow condition in iomap_write_delalloc_scan
6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ritesh Harjani (IBM) <[email protected]>
[ Upstream commit eee2d2e6ea5550118170dbd5bb1316ceb38455fb ]
folio_next_index() returns an unsigned long value which left shifted by PAGE_SHIFT could possibly cause an overflow on 32-bit system. Instead use folio_pos(folio) + folio_size(folio), which does this correctly.
--- fs/iomap/buffered-io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/iomap/buffered-io.c +1 -1
@@ -927,7 +927,7 @@ static int iomap_write_delalloc_scan(struct inode *inode,* the end of this data range, not the end of the folio. */ *punch_start_byte =min_t (loff_t, end_byte, -folio_next_index (folio) <<PAGE_SHIFT ); +folio_pos (folio) +folio_size (folio)); }/* move offset to start of next folio in range */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 2/211 autofs: fix memory leak of waitqueues in autofs_catatonic_mode
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
[ Upstream commit ccbe77f7e45dfb4420f7f531b650c00c6e9c7507 ]
Syzkaller reports a memory leak:
BUG: memory leak
unreferenced object 0xffff88810b279e00 (size 96):
comm "syz-executor399", pid 3631, jiffies 4294964921 (age 23.870s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 08 9e 27 0b 81 88 ff ff ..........'.....
08 9e 27 0b 81 88 ff ff 00 00 00 00 00 00 00 00 ..'.............
backtrace:
[<ffffffff814cfc90>] kmalloc_trace+0x20/0x90 mm/slab_common.c:1046
[<ffffffff81bb75ca>] kmalloc include/linux/slab.h:576 [inline]
[<ffffffff81bb75ca>] autofs_wait+0x3fa/0x9a0 fs/autofs/waitq.c:378
[<ffffffff81bb88a7>] autofs_do_expire_multi+0xa7/0x3e0 fs/autofs/expire.c:593
[<ffffffff81bb8c33>] autofs_expire_multi+0x53/0x80 fs/autofs/expire.c:619
[<ffffffff81bb6972>] autofs_root_ioctl_unlocked+0x322/0x3b0 fs/autofs/root.c:897
[<ffffffff81bb6a95>] autofs_root_ioctl+0x25/0x30 fs/autofs/root.c:910
[<ffffffff81602a9c>] vfs_ioctl fs/ioctl.c:51 [inline]
[<ffffffff81602a9c>] __do_sys_ioctl fs/ioctl.c:870 [inline]
[<ffffffff81602a9c>] __se_sys_ioctl fs/ioctl.c:856 [inline]
[<ffffffff81602a9c>] __x64_sys_ioctl+0xfc/0x140 fs/ioctl.c:856
[<ffffffff84608225>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff84608225>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84800087>] entry_SYSCALL_64_after_hwframe+0x63/0xcdautofs_wait_queue structs should be freed if their wait_ctr becomes zero. Otherwise they will be lost.
In this case an AUTOFS_IOC_EXPIRE_MULTI ioctl is done, then a new waitqueue struct is allocated in autofs_wait(), its initial wait_ctr equals 2. After that wait_event_killable() is interrupted (it returns -ERESTARTSYS), so that 'wq->name.name == NULL' condition may be not satisfied. Actually, this condition can be satisfied when autofs_wait_release() or autofs_catatonic_mode() is called and, what is also important, wait_ctr is decremented in those places. Upon the exit of autofs_wait(), wait_ctr is decremented to 1. Then the unmounting process
begins: kill_sb calls autofs_catatonic_mode(), which should have freed the waitqueues, but it only decrements its usage counter to zero which is not a correct behaviour.
edit:imk
This description is of course not correct. The umount performed as a result of an expire is a umount of a mount that has been automounted, it's not the autofs mount itself. They happen independently, usually after everything mounted within the autofs file system has been expired away. If everything hasn't been expired away the automount daemon can still exit leaving mounts in place. But expires done in both cases will result in a notification that calls autofs_wait_release() with a result status. The problem case is the summary execution of of the automount daemon. In this case any waiting processes won't be woken up until either they are terminated or the mount is umounted.
end edit: imk
So in catatonic mode we should free waitqueues which counter becomes zero.
edit: imk
Initially I was concerned that the calling of autofs_wait_release() and autofs_catatonic_mode() was not mutually exclusive but that can't be the case (obviously) because the queue entry (or entries) is removed from the list when either of these two functions are called. Consequently the wait entry will be freed by only one of these functions or by the woken process in autofs_wait() depending on the order of the calls.
end edit: imk
Message-Id: <[email protected]>
--- fs/autofs/waitq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/autofs/waitq.c +2 -1
@@ -32,8 +32,9 @@ void autofs_catatonic_mode(struct autofs_sb_info *sbi) wq->status = -ENOENT ;/* Magic is gone - report failure */ kfree (wq->name.name - wq->offset); wq->name.name =NULL ; - wq->wait_ctr--;wake_up_interruptible (&wq->queue); +if (!--wq->wait_ctr) +kfree (wq); wq = nwq; }fput (sbi->pipe);/* Close the pipe */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 3/211 btrfs: handle errors properly in update_inline_extent_backref()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <[email protected]>
[ Upstream commit 257614301a5db9f7b0548584ca207ad7785c8b89 ]
[PROBLEM]
Inside function update_inline_extent_backref(), we have several BUG_ON()s along with some ASSERT()s which can be triggered by corrupted filesystem.
[ANAYLYSE]
Most of those BUG_ON()s and ASSERT()s are just a way of handling unexpected on-disk data.
Although we have tree-checker to rule out obviously incorrect extent tree blocks, it's not enough for these ones. Thus we need proper error handling for them.
[FIX]
Thankfully all the callers of update_inline_extent_backref() would eventually handle the errror by aborting the current transaction. So this patch would do the proper error handling by:
- Make update_inline_extent_backref() to return int The return value would be either 0 or -EUCLEAN.
- Replace BUG_ON()s and ASSERT()s with proper error handling This includes:
* Dump the bad extent tree leaf
* Output an error message for the cause
This would include the extent bytenr, num_bytes (if needed), the bad values and expected good values.
* Return -EUCLEAN
Note here we remove all the WARN_ON()s, as eventually the transaction would be aborted, thus a backtrace would be triggered anyway.
- Better comments on why we expect refs == 1 and refs_to_mode == -1 for tree blocks
--- fs/btrfs/extent-tree.c | 73 +++++++++++++++++++++++++++++++++++------- 1 file changed, 61 insertions(+), 12 deletions(-)
fs/btrfs/extent-tree.c +61 -12
@@ -402,11 +402,11 @@ int btrfs_get_extent_inline_ref_type(const struct extent_buffer *eb, } } +WARN_ON (1 );btrfs_print_leaf (eb);btrfs_err (eb->fs_info,"eb %llu iref 0x%lx invalid extent inline ref type %d" , eb->start, (unsigned long )iref, type); -WARN_ON (1 );return BTRFS_REF_TYPE_INVALID ; }
@@ -1079,13 +1079,13 @@ static int lookup_extent_backref(struct btrfs_trans_handle *trans,/* * helper to update/remove inline back ref */ -static noinline_for_stack -void update_inline_extent_backref(struct btrfs_path *path, +static noinline_for_stack int update_inline_extent_backref(struct btrfs_path *path,struct btrfs_extent_inline_ref *iref,int refs_to_mod,struct btrfs_delayed_extent_op *extent_op) {struct extent_buffer *leaf = path->nodes[0 ]; +struct btrfs_fs_info *fs_info = leaf->fs_info;struct btrfs_extent_item *ei;struct btrfs_extent_data_ref *dref =NULL ;struct btrfs_shared_data_ref *sref =NULL ;
@@ -1098,18 +1098,33 @@ void update_inline_extent_backref(struct btrfs_path *path, ei = btrfs_item_ptr(leaf, path->slots[0], struct btrfs_extent_item); refs =btrfs_extent_refs (leaf, ei); -WARN_ON (refs_to_mod <0 && refs + refs_to_mod <=0 ); +if (unlikely (refs_to_mod <0 && refs + refs_to_mod <=0 )) { +struct btrfs_key key; +u32 extent_size; + +btrfs_item_key_to_cpu (leaf, &key, path->slots[0 ]); +if (key.type ==BTRFS_METADATA_ITEM_KEY ) + extent_size = fs_info->nodesize; +else + extent_size = key.offset; +btrfs_print_leaf (leaf); +btrfs_err (fs_info, +"invalid refs_to_mod for extent %llu num_bytes %u, has %d expect >= -%llu" , + key.objectid, extent_size, refs_to_mod, refs); +return -EUCLEAN ; + } refs += refs_to_mod;btrfs_set_extent_refs (leaf, ei, refs);if (extent_op)__run_delayed_extent_op (extent_op, leaf, ei); + type =btrfs_get_extent_inline_ref_type (leaf, iref,BTRFS_REF_TYPE_ANY );/* -* If type is invalid, we should have bailed out after -* lookup_inline_extent_backref(). +* Function btrfs_get_extent_inline_ref_type() has already printed +* error messages. */ - type =btrfs_get_extent_inline_ref_type (leaf, iref,BTRFS_REF_TYPE_ANY ); -ASSERT (type !=BTRFS_REF_TYPE_INVALID ); +if (unlikely (type ==BTRFS_REF_TYPE_INVALID )) +return -EUCLEAN ;if (type ==BTRFS_EXTENT_DATA_REF_KEY ) { dref = (struct btrfs_extent_data_ref *)(&iref->offset);
@@ -1119,10 +1134,43 @@ void update_inline_extent_backref(struct btrfs_path *path, refs =btrfs_shared_data_ref_count (leaf, sref); }else { refs =1 ; -BUG_ON (refs_to_mod !=-1 ); +/* +* For tree blocks we can only drop one ref for it, and tree +* blocks should not have refs > 1. +* +* Furthermore if we're inserting a new inline backref, we +* won't reach this path either. That would be +* setup_inline_extent_backref(). +*/ +if (unlikely (refs_to_mod !=-1 )) { +struct btrfs_key key; + +btrfs_item_key_to_cpu (leaf, &key, path->slots[0 ]); + +btrfs_print_leaf (leaf); +btrfs_err (fs_info, +"invalid refs_to_mod for tree block %llu, has %d expect -1" , + key.objectid, refs_to_mod); +return -EUCLEAN ; + } } -BUG_ON (refs_to_mod <0 && refs < -refs_to_mod); +if (unlikely (refs_to_mod <0 && refs < -refs_to_mod)) { +struct btrfs_key key; +u32 extent_size; + +btrfs_item_key_to_cpu (leaf, &key, path->slots[0 ]); +if (key.type ==BTRFS_METADATA_ITEM_KEY ) + extent_size = fs_info->nodesize; +else + extent_size = key.offset; +btrfs_print_leaf (leaf); +btrfs_err (fs_info, +"invalid refs_to_mod for backref entry, iref %lu extent %llu num_bytes %u, has %d expect >= -%llu" , + (unsigned long )iref, key.objectid, extent_size, + refs_to_mod, refs); +return -EUCLEAN ; + } refs += refs_to_mod;if (refs >0 ) {
@@ -1142,6 +1190,7 @@ void update_inline_extent_backref(struct btrfs_path *path,btrfs_truncate_item (path, item_size,1 ); }btrfs_mark_buffer_dirty (leaf); +return 0 ; } static noinline_for_stack
@@ -1170,7 +1219,7 @@ int insert_inline_extent_backref(struct btrfs_trans_handle *trans, bytenr, num_bytes, root_objectid, path->slots[0]);return -EUCLEAN ; } -update_inline_extent_backref (path, iref, refs_to_add, extent_op); + ret =update_inline_extent_backref (path, iref, refs_to_add, extent_op); }else if (ret == -ENOENT ) { setup_inline_extent_backref(trans->fs_info, path, iref, parent, root_objectid, owner, offset,
@@ -1190,7 +1239,7 @@ static int remove_extent_backref(struct btrfs_trans_handle *trans,BUG_ON (!is_data && refs_to_drop !=1 );if (iref) -update_inline_extent_backref (path, iref, -refs_to_drop,NULL ); + ret =update_inline_extent_backref (path, iref, -refs_to_drop,NULL );else if (is_data) ret =remove_extent_data_ref (trans, root, path, refs_to_drop);else
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 4/211 btrfs: output extra debug info if we failed to find an inline backref
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <[email protected]>
[ Upstream commit 7f72f50547b7af4ddf985b07fc56600a4deba281 ]
[BUG]
Syzbot reported several warning triggered insidelookup_inline_extent_backref().
[CAUSE]
As usual, the reproducer doesn't reliably trigger locally here, but at least we know the WARN_ON() is triggered when an inline backref can not be found, and it can only be triggered when @insert is true. (I.e. inserting a new inline backref, which means the backref should already exist)
[ENHANCEMENT]
After the WARN_ON(), dump all the parameters and the extent tree leaf to help debug.
--- fs/btrfs/extent-tree.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/btrfs/extent-tree.c +5 -0
@@ -869,6 +869,11 @@ int lookup_inline_extent_backref(struct btrfs_trans_handle *trans, err = -ENOENT ; goto out; }else if (WARN_ON (ret)) { +btrfs_print_leaf (path->nodes[0 ]); +btrfs_err (fs_info, +"extent item not found for insert, bytenr %llu num_bytes %llu parent %llu root_objectid %llu owner %llu offset %llu" , + bytenr, num_bytes, parent, root_objectid, owner, + offset); err = -EIO ; goto out; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 5/211 locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Shiu <[email protected]>
[ Upstream commit 74f6f5912693ce454384eaeec48705646a21c74f ]
As following backtrace, the struct file_lock request , in posix_lock_inode is free before ftrace function using.
Replace the ftrace function ahead free flow could fix the use-after-free issue.
[name:report&]=============================================== BUG:KASAN: use-after-free in trace_event_raw_event_filelock_lock+0x80/0x12c [name:report&]Read at addr f6ffff8025622620 by task NativeThread/16753 [name:report_hw_tags&]Pointer tag: [f6], memory tag: [fe] [name:report&]
BT:
Hardware name: MT6897 (DT) Call trace: dump_backtrace+0xf8/0x148 show_stack+0x18/0x24 dump_stack_lvl+0x60/0x7c print_report+0x2c8/0xa08 kasan_report+0xb0/0x120 __do_kernel_fault+0xc8/0x248 do_bad_area+0x30/0xdc do_tag_check_fault+0x1c/0x30 do_mem_abort+0x58/0xbc el1_abort+0x3c/0x5c el1h_64_sync_handler+0x54/0x90 el1h_64_sync+0x68/0x6c trace_event_raw_event_filelock_lock+0x80/0x12c posix_lock_inode+0xd0c/0xd60 do_lock_file_wait+0xb8/0x190 fcntl_setlk+0x2d8/0x440
...
[name:report&]
[name:report&]Allocated by task 16752:
...
slab_post_alloc_hook+0x74/0x340 kmem_cache_alloc+0x1b0/0x2f0 posix_lock_inode+0xb0/0xd60
...
[name:report&]
[name:report&]Freed by task 16752:
...
kmem_cache_free+0x274/0x5b0 locks_dispose_list+0x3c/0x148 posix_lock_inode+0xc40/0xd60 do_lock_file_wait+0xb8/0x190 fcntl_setlk+0x2d8/0x440 do_fcntl+0x150/0xc18
...
--- fs/locks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/locks.c +1 -1
@@ -1301,6 +1301,7 @@ static int posix_lock_inode(struct inode *inode, struct file_lock *request, out:spin_unlock (&ctx->flc_lock);percpu_up_read (&file_rwsem); +trace_posix_lock_inode (inode, request, error);/* * Free any unused locks. */
@@ -1309,7 +1310,6 @@ static int posix_lock_inode(struct inode *inode, struct file_lock *request,if (new_fl2)locks_free_lock (new_fl2);locks_dispose_list (&dispose); -trace_posix_lock_inode (inode, request, error);return error; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 6/211 ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abhishek Mainkar <[email protected]>
[ Upstream commit 3a21ffdbc825e0919db9da0e27ee5ff2cc8a863e ]
ACPICA commit 90310989a0790032f5a0140741ff09b545af4bc5
According to the ACPI specification 19.6.134, no argument is required to be passed for ASL Timer instruction. For taking care of no argument, AML_NO_OPERAND_RESOLVE flag is added to ASL Timer instruction opcode.
When ASL timer instruction interpreted by ACPI interpreter, getting error. After adding AML_NO_OPERAND_RESOLVE flag to ASL Timer instruction opcode, issue is not observed.
=============================================================
UBSAN: array-index-out-of-bounds in acpica/dswexec.c:401:12 index -1 is out of range for type 'union acpi_operand_object *[9]' CPU: 37 PID: 1678 Comm: cat Not tainted 6.0.0-dev-th500-6.0.y-1+bcf8c46459e407-generic-64k HW name: NVIDIA BIOS v1.1.1-d7acbfc-dirty 12/19/2022 Call trace: dump_backtrace+0xe0/0x130 show_stack+0x20/0x60 dump_stack_lvl+0x68/0x84 dump_stack+0x18/0x34 ubsan_epilogue+0x10/0x50 __ubsan_handle_out_of_bounds+0x80/0x90 acpi_ds_exec_end_op+0x1bc/0x6d8 acpi_ps_parse_loop+0x57c/0x618 acpi_ps_parse_aml+0x1e0/0x4b4 acpi_ps_execute_method+0x24c/0x2b8 acpi_ns_evaluate+0x3a8/0x4bc acpi_evaluate_object+0x15c/0x37c acpi_evaluate_integer+0x54/0x15c show_power+0x8c/0x12c [acpi_power_meter]
--- drivers/acpi/acpica/psopcode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/acpica/psopcode.c +1 -1
@@ -603,7 +603,7 @@ const struct acpi_opcode_info acpi_gbl_aml_op_info[AML_NUM_OPCODES] = {/* 7E */ ACPI_OP ("Timer" ,ARGP_TIMER_OP ,ARGI_TIMER_OP ,ACPI_TYPE_ANY ,AML_CLASS_EXECUTE ,AML_TYPE_EXEC_0A_0T_1R , - AML_FLAGS_EXEC_0A_0T_1R), + AML_FLAGS_EXEC_0A_0T_1R | AML_NO_OPERAND_RESOLVE),/* ACPI 5.0 opcodes */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 7/211 kernel/fork: beware of __put_task_struct() calling context
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wander Lairson Costa <[email protected]>
[ Upstream commit d243b34459cea30cfe5f3a9b2feb44e7daff9938 ]
Under PREEMPT_RT, __put_task_struct() indirectly acquires sleeping locks. Therefore, it can't be called from an non-preemptible context.
One practical example is splat inside inactive_task_timer(), which is called in a interrupt context:
CPU: 1 PID: 2848 Comm: life Kdump: loaded Tainted: G W --------- Hardware name: HP ProLiant DL388p Gen8, BIOS P70 07/15/2012 Call Trace: dump_stack_lvl+0x57/0x7d mark_lock_irq.cold+0x33/0xba mark_lock+0x1e7/0x400 mark_usage+0x11d/0x140 __lock_acquire+0x30d/0x930 lock_acquire.part.0+0x9c/0x210 rt_spin_lock+0x27/0xe0 refill_obj_stock+0x3d/0x3a0 kmem_cache_free+0x357/0x560 inactive_task_timer+0x1ad/0x340 __run_hrtimer+0x8a/0x1a0 __hrtimer_run_queues+0x91/0x130 hrtimer_interrupt+0x10f/0x220 __sysvec_apic_timer_interrupt+0x7b/0xd0 sysvec_apic_timer_interrupt+0x4f/0xd0 asm_sysvec_apic_timer_interrupt+0x12/0x20 RIP: 0033:0x7fff196bf6f5
Instead of calling __put_task_struct() directly, we defer it using call_rcu(). A more natural approach would use a workqueue, but since in PREEMPT_RT, we can't allocate dynamic memory from atomic context, the code would become more complex because we would need to put the work_struct instance in the task_struct and initialize it when we allocate a new task_struct.
The issue is reproducible with stress-ng:
while true; do
stress-ng --sched deadline --sched-period 1000000000 \ --sched-runtime 800000000 --sched-deadline \ 1000000000 --mmapfork 23 -t 20
done
--- include/linux/sched/task.h | 28 +++++++++++++++++++++++++++- kernel/fork.c | 8 ++++++++ 2 files changed, 35 insertions(+), 1 deletion(-)
include/linux/sched/task.h +27 -1
@@ -118,10 +118,36 @@ static inline struct task_struct *get_task_struct(struct task_struct *t) }extern void __put_task_struct (struct task_struct *t); +extern void __put_task_struct_rcu_cb (struct rcu_head *rhp);static inline void put_task_struct (struct task_struct *t) { -if (refcount_dec_and_test (&t->usage)) +if (!refcount_dec_and_test (&t->usage)) +return ; + +/* +* under PREEMPT_RT, we can't call put_task_struct +* in atomic context because it will indirectly +* acquire sleeping locks. +* +* call_rcu() will schedule delayed_put_task_struct_rcu() +* to be called in process context. +* +* __put_task_struct() is called when +* refcount_dec_and_test(&t->usage) succeeds. +* +* This means that it can't "conflict" with +* put_task_struct_rcu_user() which abuses ->rcu the same +* way; rcu_users has a reference so task->usage can't be +* zero after rcu_users 1 -> 0 transition. +* +* delayed_free_task() also uses ->rcu, but it is only called +* when it fails to fork a process. Therefore, there is no +* way it can conflict with put_task_struct(). +*/ +if (IS_ENABLED (CONFIG_PREEMPT_RT ) && !preemptible ()) +call_rcu (&t->rcu, __put_task_struct_rcu_cb); +else __put_task_struct (t); }
kernel/fork.c +8 -0
@@ -985,6 +985,14 @@ void __put_task_struct(struct task_struct *tsk) }EXPORT_SYMBOL_GPL (__put_task_struct); +void __put_task_struct_rcu_cb (struct rcu_head *rhp) +{ + struct task_struct *task = container_of(rhp, struct task_struct, rcu); + +__put_task_struct (task); +} +EXPORT_SYMBOL_GPL (__put_task_struct_rcu_cb); +void __init __weak arch_task_cache_init (void ) { }/*
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 8/211 rcuscale: Move rcu_scale_writer() schedule_timeout_uninterruptible() to _idle()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zqiang <[email protected]>
[ Upstream commit e60c122a1614b4f65b29a7bef9d83b9fd30e937a ]
The rcuscale.holdoff module parameter can be used to delay the start of rcu_scale_writer() kthread. However, the hung-task timeout will trigger when the timeout specified by rcuscale.holdoff is greater than hung_task_timeout_secs:
runqemu kvm nographic slirp qemuparams="-smp 4 -m 2048M" bootparams="rcuscale.shutdown=0 rcuscale.holdoff=300"
[ 247.071753] INFO: task rcu_scale_write:59 blocked for more than 122 seconds. [ 247.072529] Not tainted 6.4.0-rc1-00134-gb9ed6de8d4ff #7 [ 247.073400] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 247.074331] task:rcu_scale_write state:D stack:30144 pid:59 ppid:2 flags:0x00004000 [ 247.075346] Call Trace: [ 247.075660] <TASK> [ 247.075965] __schedule+0x635/0x1280 [ 247.076448] ? __pfx___schedule+0x10/0x10 [ 247.076967] ? schedule_timeout+0x2dc/0x4d0 [ 247.077471] ? __pfx_lock_release+0x10/0x10 [ 247.078018] ? enqueue_timer+0xe2/0x220 [ 247.078522] schedule+0x84/0x120 [ 247.078957] schedule_timeout+0x2e1/0x4d0 [ 247.079447] ? __pfx_schedule_timeout+0x10/0x10 [ 247.080032] ? __pfx_rcu_scale_writer+0x10/0x10 [ 247.080591] ? __pfx_process_timeout+0x10/0x10 [ 247.081163] ? __pfx_sched_set_fifo_low+0x10/0x10 [ 247.081760] ? __pfx_rcu_scale_writer+0x10/0x10 [ 247.082287] rcu_scale_writer+0x6b1/0x7f0 [ 247.082773] ? mark_held_locks+0x29/0xa0 [ 247.083252] ? __pfx_rcu_scale_writer+0x10/0x10 [ 247.083865] ? __pfx_rcu_scale_writer+0x10/0x10 [ 247.084412] kthread+0x179/0x1c0 [ 247.084759] ? __pfx_kthread+0x10/0x10 [ 247.085098] ret_from_fork+0x2c/0x50 [ 247.085433] </TASK>
This commit therefore replaces schedule_timeout_uninterruptible() with schedule_timeout_idle().
--- kernel/rcu/rcuscale.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/rcu/rcuscale.c +1 -1
@@ -424,7 +424,7 @@ rcu_scale_writer(void *arg)sched_set_fifo_low (current);if (holdoff) -schedule_timeout_uninterruptible (holdoff *HZ ); +schedule_timeout_idle (holdoff *HZ );/* * Wait until rcu_end_inkernel_boot() is called for normal GP tests
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 9/211 scftorture: Forgive memory-allocation failure if KASAN
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul E. McKenney <[email protected]>
[ Upstream commit 013608cd0812bdb21fc26d39ed8fdd2fc76e8b9b ]
Kernels built with CONFIG_KASAN=y quarantine newly freed memory in order to better detect use-after-free errors. However, this can exhaust memory more quickly in allocator-heavy tests, which can result in spurious scftorture failure. This commit therefore forgives memory-allocation failure in kernels built with CONFIG_KASAN=y, but continues counting the errors for use in detailed test-result analyses.
--- kernel/scftorture.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
kernel/scftorture.c +4 -2
@@ -171,7 +171,8 @@ static void scf_torture_stats_print(void) scfs.n_all_wait += scf_stats_p[i].n_all_wait; }if (atomic_read (&n_errs) ||atomic_read (&n_mb_in_errs) || -atomic_read (&n_mb_out_errs) ||atomic_read (&n_alloc_errs)) +atomic_read (&n_mb_out_errs) || + (!IS_ENABLED (CONFIG_KASAN ) &&atomic_read (&n_alloc_errs))) bangstr ="!!! " ; pr_alert("%s %sscf_invoked_count %s: %lld resched: %lld single: %lld/%lld single_ofl: %lld/%lld single_rpc: %lld single_rpc_ofl: %lld many: %lld/%lld all: %lld/%lld ", SCFTORT_FLAG, bangstr, isdone ? "VER" : "ver", invoked_count, scfs.n_resched,
@@ -323,7 +324,8 @@ static void scftorture_invoke_one(struct scf_statistics *scfp, struct torture_rapreempt_disable ();if (scfsp->scfs_prim ==SCF_PRIM_SINGLE || scfsp->scfs_wait) { scfcp =kmalloc (sizeof (*scfcp),GFP_ATOMIC ); -if (WARN_ON_ONCE (!scfcp)) { +if (!scfcp) { +WARN_ON_ONCE (!IS_ENABLED (CONFIG_KASAN ));atomic_inc (&n_alloc_errs); }else { scfcp->scfc_cpu =-1 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 10/211 ACPI: video: Add backlight=native DMI quirk for Lenovo Ideapad Z470
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby (SUSE) <[email protected]>
[ Upstream commit 96b709be183c56293933ef45b8b75f8af268c6de ]
The Lenovo Ideapad Z470 predates Windows 8, so it defaults to using acpi_video for backlight control. But this is not functional on this model.
Add a DMI quirk to use the native backlight interface which works.
--- drivers/acpi/video_detect.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/acpi/video_detect.c +9 -0
@@ -445,6 +445,15 @@ static const struct dmi_system_id video_detect_dmi_table[] = { DMI_MATCH(DMI_BOARD_NAME, "Lenovo IdeaPad S405"), }, }, + { +/* https://bugzilla.suse.com/show_bug.cgi?id=1208724 */ + .callback = video_detect_force_native, +/* Lenovo Ideapad Z470 */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), + DMI_MATCH(DMI_PRODUCT_VERSION, "IdeaPad Z470"), + }, + }, {/* https://bugzilla.redhat.com/show_bug.cgi?id=1187004 */ .callback = video_detect_force_native,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 11/211 platform/chrome: cros_ec_lpc: Remove EC panic shutdown timeout
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Barnes <[email protected]>
[ Upstream commit f2d4dced9a584612b25adb559c1350243d2bb544 ]
Remove the 1 second timeout applied to hw_protection_shutdown after an EC panic. On some platforms this 1 second timeout is insufficient to allow the filesystem to fully sync. Independently the EC will force a full system reset after a short period. So this backup timeout is unnecessary.
--- drivers/platform/chrome/cros_ec_lpc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/platform/chrome/cros_ec_lpc.c +2 -2
@@ -327,8 +327,8 @@ static void cros_ec_lpc_acpi_notify(acpi_handle device, u32 value, void *data)dev_emerg (ec_dev->dev,"CrOS EC Panic Reported. Shutdown is imminent!" );blocking_notifier_call_chain (&ec_dev->panic_notifier,0 , ec_dev);kobject_uevent_env (&ec_dev->dev->kobj,KOBJ_CHANGE , (char **)env); -/* Begin orderly shutdown. Force shutdown after 1 second. */ -hw_protection_shutdown ("CrOS EC Panic" ,1000 ); +/* Begin orderly shutdown. EC will force reset after a short period. */ +hw_protection_shutdown ("CrOS EC Panic" ,-1 );/* Do not query for other events after a panic is reported */ return ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 12/211 x86/amd_nb: Add PCI IDs for AMD Family 1Ah-based models
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avadhut Naik <[email protected]>
[ Upstream commit c64016609b6f66b753b5f37929a191477fa584c0 ]
Add new PCI Device IDs required to support AMD's new Family 1Ah-based models 00h-1Fh, 20h and 40h-4Fh.
[ bp: Zap a useless sentence. ]
--- arch/x86/kernel/amd_nb.c | 8 ++++++++ include/linux/pci_ids.h | 2 ++ 2 files changed, 10 insertions(+)
arch/x86/kernel/amd_nb.c +8 -0
@@ -24,6 +24,8 @@#define PCI_DEVICE_ID_AMD_19H_M40H_ROOT 0x14b5#define PCI_DEVICE_ID_AMD_19H_M60H_ROOT 0x14d8#define PCI_DEVICE_ID_AMD_19H_M70H_ROOT 0x14e8 +#define PCI_DEVICE_ID_AMD_1AH_M00H_ROOT 0x153a +#define PCI_DEVICE_ID_AMD_1AH_M20H_ROOT 0x1507#define PCI_DEVICE_ID_AMD_MI200_ROOT 0x14bb#define PCI_DEVICE_ID_AMD_17H_DF_F4 0x1464
@@ -39,6 +41,7 @@#define PCI_DEVICE_ID_AMD_19H_M60H_DF_F4 0x14e4#define PCI_DEVICE_ID_AMD_19H_M70H_DF_F4 0x14f4#define PCI_DEVICE_ID_AMD_19H_M78H_DF_F4 0x12fc +#define PCI_DEVICE_ID_AMD_1AH_M00H_DF_F4 0x12c4#define PCI_DEVICE_ID_AMD_MI200_DF_F4 0x14d4/* Protect the PCI config register pairs used for SMN. */
@@ -56,6 +59,8 @@ static const struct pci_device_id amd_root_ids[] = { { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_19H_M40H_ROOT) }, { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_19H_M60H_ROOT) }, { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_19H_M70H_ROOT) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M00H_ROOT) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M20H_ROOT) }, { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_MI200_ROOT) }, {} };
@@ -85,6 +90,8 @@ static const struct pci_device_id amd_nb_misc_ids[] = { { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_19H_M60H_DF_F3) }, { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_19H_M70H_DF_F3) }, { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_19H_M78H_DF_F3) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M00H_DF_F3) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M20H_DF_F3) }, { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_MI200_DF_F3) }, {} };
@@ -106,6 +113,7 @@ static const struct pci_device_id amd_nb_link_ids[] = { { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_19H_M40H_DF_F4) }, { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_19H_M50H_DF_F4) }, { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CNB17H_F4) }, + { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_1AH_M00H_DF_F4) }, { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_MI200_DF_F4) }, {} };
include/linux/pci_ids.h +2 -0
@@ -576,6 +576,8 @@#define PCI_DEVICE_ID_AMD_19H_M60H_DF_F3 0x14e3#define PCI_DEVICE_ID_AMD_19H_M70H_DF_F3 0x14f3#define PCI_DEVICE_ID_AMD_19H_M78H_DF_F3 0x12fb +#define PCI_DEVICE_ID_AMD_1AH_M00H_DF_F3 0x12c3 +#define PCI_DEVICE_ID_AMD_1AH_M20H_DF_F3 0x16fb#define PCI_DEVICE_ID_AMD_MI200_DF_F3 0x14d3#define PCI_DEVICE_ID_AMD_CNB17H_F3 0x1703#define PCI_DEVICE_ID_AMD_LANCE 0x2000
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 13/211 perf/smmuv3: Enable HiSilicon Erratum 162001900 quirk for HIP08/09
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yicong Yang <[email protected]>
[ Upstream commit 0242737dc4eb9f6e9a5ea594b3f93efa0b12f28d ]
Some HiSilicon SMMU PMCG suffers the erratum 162001900 that the PMU disable control sometimes fail to disable the counters. This will lead to error or inaccurate data since before we enable the counters the counter's still counting for the event used in last perf session.
This patch tries to fix this by hardening the global disable process. Before disable the PMU, writing an invalid event type (0xffff) to focibly stop the counters. Correspondingly restore each events on pmu::pmu_enable().
--- Documentation/arch/arm64/silicon-errata.rst | 3 ++ drivers/acpi/arm64/iort.c | 5 ++- drivers/perf/arm_smmuv3_pmu.c | 46 ++++++++++++++++++++- include/linux/acpi_iort.h | 1 + 4 files changed, 53 insertions(+), 2 deletions(-)
Documentation/arch/arm64/silicon-errata.rst +3 -0
@@ -198,6 +198,9 @@ stable kernels. +----------------+-----------------+-----------------+-----------------------------+ | Hisilicon | Hip08 SMMU PMCG | #162001800 | N/A | +----------------+-----------------+-----------------+-----------------------------+ +| Hisilicon | Hip08 SMMU PMCG | #162001900 | N/A | +| | Hip09 SMMU PMCG | | | ++----------------+-----------------+-----------------+-----------------------------+ +----------------+-----------------+-----------------+-----------------------------+ | Qualcomm Tech. | Kryo/Falkor v1 | E1003 | QCOM_FALKOR_ERRATUM_1003 | +----------------+-----------------+-----------------+-----------------------------+
drivers/acpi/arm64/iort.c +4 -1
@@ -1708,7 +1708,10 @@ static void __init arm_smmu_v3_pmcg_init_resources(struct resource *res,static struct acpi_platform_list pmcg_plat_info[]__initdata = {/* HiSilicon Hip08 Platform */ {"HISI " ,"HIP08 " ,0 ,ACPI_SIG_IORT , greater_than_or_equal, -"Erratum #162001800" ,IORT_SMMU_V3_PMCG_HISI_HIP08 }, +"Erratum #162001800, Erratum #162001900" ,IORT_SMMU_V3_PMCG_HISI_HIP08 }, +/* HiSilicon Hip09 Platform */ + {"HISI " ,"HIP09 " ,0 ,ACPI_SIG_IORT , greater_than_or_equal, +"Erratum #162001900" ,IORT_SMMU_V3_PMCG_HISI_HIP09 }, { } };
drivers/perf/arm_smmuv3_pmu.c +45 -1
76 lines not on this page · raw message
include/linux/acpi_iort.h +1 -0
@@ -21,6 +21,7 @@*/ #define IORT_SMMU_V3_PMCG_GENERIC 0x00000000/* Generic SMMUv3 PMCG */ #define IORT_SMMU_V3_PMCG_HISI_HIP08 0x00000001/* HiSilicon HIP08 PMCG */ +#define IORT_SMMU_V3_PMCG_HISI_HIP09 0x00000002/* HiSilicon HIP09 PMCG */ int iort_register_domain_token (int trans_id,phys_addr_t base,struct fwnode_handle *fw_node);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 14/211 s390/boot: cleanup number of page table levels setup
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Gordeev <[email protected]>
[ Upstream commit 8ddccc8a7d06f7ea4d8579970c95609d1b1de77b ]
The separate vmalloc area size check against _REGION2_SIZE is needed in case user provided insanely large value using vmalloc= kernel command line parameter. That could lead to overflow and selecting 3 page table levels instead of 4.
Use size_add() for the overflow check and get rid of the extra vmalloc area check.
With the current values of CONFIG_MAX_PHYSMEM_BITS and PAGES_PER_SECTION the sum of maximal possible size of identity mapping and vmemmap area (derived from these macros) plus modules area size MODULES_LEN can not overflow. Thus, that sum is used as first addend while vmalloc area size is second addend for size_add().
--- arch/s390/boot/startup.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
arch/s390/boot/startup.c +4 -5
@@ -176,6 +176,7 @@ static unsigned long setup_kernel_memory_layout(void)unsigned long asce_limit;unsigned long rte_size;unsigned long pages; +unsigned long vsize;unsigned long vmax; pages = ident_map_size /PAGE_SIZE ;
@@ -183,11 +184,9 @@ static unsigned long setup_kernel_memory_layout(void) vmemmap_size =SECTION_ALIGN_UP (pages) *sizeof (struct page );/* choose kernel address space layout: 4 or 3 levels. */ - vmemmap_start =round_up (ident_map_size, _REGION3_SIZE); -if (IS_ENABLED (CONFIG_KASAN ) || - vmalloc_size > _REGION2_SIZE || - vmemmap_start + vmemmap_size + vmalloc_size +MODULES_LEN > - _REGION2_SIZE) { + vsize =round_up (ident_map_size, _REGION3_SIZE) + vmemmap_size +MODULES_LEN ; + vsize =size_add (vsize, vmalloc_size); +if (IS_ENABLED (CONFIG_KASAN ) || (vsize > _REGION2_SIZE)) { asce_limit = _REGION1_SIZE; rte_size = _REGION2_SIZE; }else {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 15/211 kselftest/arm64: fix a memleak in zt_regs_run()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ding Xiang <[email protected]>
[ Upstream commit 46862da15e37efedb7d2d21e167f506c0b533772 ]
If memcmp() does not return 0, "zeros" need to be freed to prevent memleak
--- tools/testing/selftests/arm64/signal/testcases/zt_regs.c | 1 + 1 file changed, 1 insertion(+)
tools/testing/selftests/arm64/signal/testcases/zt_regs.c +1 -0
@@ -65,6 +65,7 @@ int zt_regs_run(struct tdescr *td, siginfo_t *si, ucontext_t *uc)if (memcmp (zeros, (char *)zt +ZT_SIG_REGS_OFFSET ,ZT_SIG_REGS_SIZE (zt->nregs)) !=0 ) {fprintf (stderr,"ZT data invalid\n" ); +free (zeros);return 1 ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 16/211 perf/imx_ddr: speed up overflow frequency of cycle
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
[ Upstream commit e89ecd8368860bf05437eabd07d292c316221cfc ]
For i.MX8MP, we cannot ensure that cycle counter overflow occurs at least 4 times as often as other events. Due to byte counters will count for any event configured, it will overflow more often. And if byte counters overflow that related counters would stop since they share the COUNTER_CNTL. We can speed up cycle counter overflow frequency by setting counter parameter (CP) field of cycle counter. In this way, we can avoid stop counting byte counters when interrupt didn't come and the byte counters can be fetched or updated from each cycle counter overflow interrupt.
Because we initialize CP filed to shorten counter0 overflow time, the cycle counter will start couting from a fixed/base value each time. We need to remove the base from the result too. Therefore, we could get precise result from cycle counter.
--- drivers/perf/fsl_imx8_ddr_perf.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
drivers/perf/fsl_imx8_ddr_perf.c +21 -0
@@ -28,6 +28,8 @@#define CNTL_CLEAR_MASK 0xFFFFFFFD#define CNTL_OVER_MASK 0xFFFFFFFE +#define CNTL_CP_SHIFT 16 +#define CNTL_CP_MASK (0xFF << CNTL_CP_SHIFT)#define CNTL_CSV_SHIFT 24#define CNTL_CSV_MASK (0xFFU << CNTL_CSV_SHIFT)
@@ -35,6 +37,8 @@#define EVENT_CYCLES_COUNTER 0#define NUM_COUNTERS 4 +/* For removing bias if cycle counter CNTL.CP is set to 0xf0 */ +#define CYCLES_COUNTER_MASK 0x0FFFFFFF#define AXI_MASKING_REVERT 0xffff0000/* AXI_MASKING(MSB 16bits) + AXI_ID(LSB 16bits) */ #define to_ddr_pmu (p) container_of(p, struct ddr_pmu, pmu)
@@ -428,6 +432,17 @@ static void ddr_perf_counter_enable(struct ddr_pmu *pmu, int config,writel (0 , pmu->base + reg); val =CNTL_EN |CNTL_CLEAR ; val |=FIELD_PREP (CNTL_CSV_MASK , config); + +/* +* On i.MX8MP we need to bias the cycle counter to overflow more often. +* We do this by initializing bits [23:16] of the counter value via the +* COUNTER_CTRL Counter Parameter (CP) field. +*/ +if (pmu->devtype_data->quirks &DDR_CAP_AXI_ID_FILTER_ENHANCED ) { +if (counter ==EVENT_CYCLES_COUNTER ) + val |=FIELD_PREP (CNTL_CP_MASK ,0xf0 ); + } +writel (val, pmu->base + reg); }else {/* Disable counter */
@@ -467,6 +482,12 @@ static void ddr_perf_event_update(struct perf_event *event)int ret; new_raw_count =ddr_perf_read_counter (pmu, counter); +/* Remove the bias applied in ddr_perf_counter_enable(). */ +if (pmu->devtype_data->quirks &DDR_CAP_AXI_ID_FILTER_ENHANCED ) { +if (counter ==EVENT_CYCLES_COUNTER ) + new_raw_count &=CYCLES_COUNTER_MASK ; + } +local64_add (new_raw_count, &event->count);/*
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 17/211 ACPI: video: Add backlight=native DMI quirk for Apple iMac12,1 and iMac12,2
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 8cf04bb321f036dd2e523e993897e0789bd5265c ]
Linux defaults to picking the non-working ACPI video backlight interface on the Apple iMac12,1 and iMac12,2.
Add a DMI quirk to pick the working native radeon_bl0 interface instead.
--- drivers/acpi/video_detect.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/acpi/video_detect.c +18 -0
@@ -495,6 +495,24 @@ static const struct dmi_system_id video_detect_dmi_table[] = { DMI_MATCH(DMI_PRODUCT_NAME, "iMac11,3"), }, }, + { +/* https://gitlab.freedesktop.org/drm/amd/-/issues/1838 */ + .callback = video_detect_force_native, +/* Apple iMac12,1 */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Apple Inc." ), + DMI_MATCH(DMI_PRODUCT_NAME, "iMac12,1"), + }, + }, + { +/* https://gitlab.freedesktop.org/drm/amd/-/issues/2753 */ + .callback = video_detect_force_native, +/* Apple iMac12,2 */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Apple Inc." ), + DMI_MATCH(DMI_PRODUCT_NAME, "iMac12,2"), + }, + }, {/* https://bugzilla.redhat.com/show_bug.cgi?id=1217249 */ .callback = video_detect_force_native,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 18/211 hw_breakpoint: fix single-stepping when using bpf_overflow_handler
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomislav Novak <[email protected]>
[ Upstream commit d11a69873d9a7435fe6a48531e165ab80a8b1221 ]
Arm platforms use is_default_overflow_handler() to determine if the hw_breakpoint code should single-step over the breakpoint trigger or let the custom handler deal with it.
Since bpf_overflow_handler() currently isn't recognized as a default handler, attaching a BPF program to a PERF_TYPE_BREAKPOINT event causes it to keep firing (the instruction triggering the data abort exception is never skipped). For example:
# bpftrace -e 'watchpoint:0x10000:4:w { print("hit") }' -c ./test
Attaching 1 probe...
hit
hit
[...]
^C(./test performs a single 4-byte store to 0x10000)
This patch replaces the check with uses_default_overflow_handler(), which accounts for the bpf_overflow_handler() case by also testing if one of the perf_event_output functions gets invoked indirectly, via orig_default_handler.
--- arch/arm/kernel/hw_breakpoint.c | 8 ++++---- arch/arm64/kernel/hw_breakpoint.c | 4 ++-- include/linux/perf_event.h | 22 +++++++++++++++++++--- 3 files changed, 25 insertions(+), 9 deletions(-)
arch/arm/kernel/hw_breakpoint.c +4 -4
@@ -626,7 +626,7 @@ int hw_breakpoint_arch_parse(struct perf_event *bp, hw->address &= ~alignment_mask; hw->ctrl.len <<= offset; -if (is_default_overflow_handler (bp)) { +if (uses_default_overflow_handler (bp)) {/* * Mismatch breakpoints are required for single-stepping * breakpoints.
@@ -798,7 +798,7 @@ static void watchpoint_handler(unsigned long addr, unsigned int fsr,* Otherwise, insert a temporary mismatch breakpoint so that * we can single-step over the watchpoint trigger. */ -if (!is_default_overflow_handler (wp)) +if (!uses_default_overflow_handler (wp))continue ; step:enable_single_step (wp,instruction_pointer (regs));
@@ -811,7 +811,7 @@ static void watchpoint_handler(unsigned long addr, unsigned int fsr, info->trigger = addr;pr_debug ("watchpoint fired: address = 0x%x\n" , info->trigger);perf_bp_event (wp, regs); -if (is_default_overflow_handler (wp)) +if (uses_default_overflow_handler (wp))enable_single_step (wp,instruction_pointer (regs)); }
@@ -886,7 +886,7 @@ static void breakpoint_handler(unsigned long unknown, struct pt_regs *regs) info->trigger = addr;pr_debug ("breakpoint fired: address = 0x%x\n" , addr);perf_bp_event (bp, regs); -if (is_default_overflow_handler (bp)) +if (uses_default_overflow_handler (bp))enable_single_step (bp, addr); goto unlock; }
arch/arm64/kernel/hw_breakpoint.c +2 -2
@@ -654,7 +654,7 @@ static int breakpoint_handler(unsigned long unused, unsigned long esr,perf_bp_event (bp, regs);/* Do we need to handle the stepping? */ -if (is_default_overflow_handler (bp)) +if (uses_default_overflow_handler (bp)) step =1 ; unlock:rcu_read_unlock ();
@@ -733,7 +733,7 @@ static u64 get_distance_from_watchpoint(unsigned long addr, u64 val,static int watchpoint_report (struct perf_event *wp,unsigned long addr,struct pt_regs *regs) { -int step =is_default_overflow_handler (wp); +int step =uses_default_overflow_handler (wp);struct arch_hw_breakpoint *info =counter_arch_bp (wp); info->trigger = addr;
include/linux/perf_event.h +19 -3
@@ -1316,15 +1316,31 @@ extern int perf_event_output(struct perf_event *event, struct pt_regs *regs);static inline bool -is_default_overflow_handler (struct perf_event *event) +__is_default_overflow_handler (perf_overflow_handler_t overflow_handler) { -if (likely (event->overflow_handler == perf_event_output_forward)) +if (likely (overflow_handler == perf_event_output_forward))return true; -if (unlikely (event->overflow_handler == perf_event_output_backward)) +if (unlikely (overflow_handler == perf_event_output_backward))return true;return false; } +#define is_default_overflow_handler (event) \ + __is_default_overflow_handler((event)->overflow_handler) + +#ifdef CONFIG_BPF_SYSCALL +static inline bool uses_default_overflow_handler (struct perf_event *event) +{ +if (likely (is_default_overflow_handler (event))) +return true; + +return __is_default_overflow_handler (event->orig_overflow_handler); +} +#else +#define uses_default_overflow_handler (event) \ + is_default_overflow_handler(event) +#endif + extern void perf_event_header__init_id(struct perf_event_header *header, struct perf_sample_data *data,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 19/211 ACPI: x86: s2idle: Catch multiple ACPI_TYPE_PACKAGE objects
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit 883cf0d4cf288313b71146ddebdf5d647b76c78b ]
If a badly constructed firmware includes multiple ACPI_TYPE_PACKAGE objects while evaluating the AMD LPS0 _DSM, there will be a memory leak. Explicitly guard against this.
--- drivers/acpi/x86/s2idle.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/acpi/x86/s2idle.c +6 -0
@@ -113,6 +113,12 @@ static void lpi_device_get_constraints_amd(void)union acpi_object *package = &out_obj->package.elements[i];if (package->type ==ACPI_TYPE_PACKAGE ) { +if (lpi_constraints_table) { +acpi_handle_err (lps0_device_handle, +"Duplicate constraints list\n" ); + goto free_acpi_buffer; + } + lpi_constraints_table =kcalloc (package->package.count,sizeof (*lpi_constraints_table),GFP_KERNEL );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 20/211 selftests/nolibc: fix up kernel parameters support
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhangjin Wu <[email protected]>
[ Upstream commit c388c9920da2679f62bec48d00ca9e80e9d0a364 ]
kernel parameters allow pass two types of strings, one type is like 'noapic', another type is like 'panic=5', the first type is passed as arguments of the init program, the second type is passed as environment variables of the init program.
when users pass kernel parameters like this:
noapic NOLIBC_TEST=syscall
our nolibc-test program will use the test setting from argv[1] and ignore the one from NOLIBC_TEST environment variable, and at last, it will print the following line and ignore the whole test setting.
Ignoring unknown test name 'noapic'
reversing the parsing order does solve the above issue:
test = getenv("NOLIBC_TEST");
if (test)
test = argv[1];but it still doesn't work with such kernel parameters (without NOLIBC_TEST environment variable):
noapic FOO=bar
To support all of the potential kernel parameters, let's verify the test setting from both of argv[1] and NOLIBC_TEST environment variable.
--- tools/testing/selftests/nolibc/nolibc-test.c | 33 ++++++++++++++++++-- 1 file changed, 31 insertions(+), 2 deletions(-)
tools/testing/selftests/nolibc/nolibc-test.c +31 -2
@@ -939,6 +939,35 @@ static const struct test test_names[] = { { 0 } }; +int is_setting_valid (char *test) +{ +int idx, len, test_len, valid =0 ; +char delimiter; + +if (!test) +return valid; + + test_len =strlen (test); + +for (idx =0 ; test_names[idx].name; idx++) { + len =strlen (test_names[idx].name); +if (test_len < len) +continue ; + +if (strncmp (test, test_names[idx].name, len) !=0 ) +continue ; + + delimiter = test[len]; +if (delimiter !=':' && delimiter !=',' && delimiter !='\0' ) +continue ; + + valid =1 ; +break ; + } + +return valid; +} +int main (int argc,char **argv,char **envp) {int min =0 ;
@@ -964,10 +993,10 @@ int main(int argc, char **argv, char **envp)* syscall:5-15[:.*],stdlib:8-10 */ test = argv[1 ]; -if (!test) +if (!is_setting_valid (test)) test =getenv ("NOLIBC_TEST" ); -if (test) { +if (is_setting_valid (test)) {char *comma, *colon, *dash, *value; do {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 21/211 selftests/nolibc: prevent out of bounds access in expect_vfprintf
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
[ Upstream commit 9c5e490093e83e165022e0311bd7df5aa06cc860 ]
If read() fails and returns -1 (or returns garbage for some other reason) buf would be accessed out of bounds.
Only use the return value of read() after it has been validated.
--- tools/testing/selftests/nolibc/nolibc-test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/nolibc/nolibc-test.c +1 -1
@@ -769,7 +769,6 @@ static int expect_vfprintf(int llen, size_t c, const char *expected, const charlseek (fd,0 ,SEEK_SET ); r =read (fd, buf,sizeof (buf) -1 ); - buf[r] ='\0' ;fclose (memfile);
@@ -779,6 +778,7 @@ static int expect_vfprintf(int llen, size_t c, const char *expected, const charreturn 1 ; } + buf[r] ='\0' ; llen +=printf (" \"%s\" = \"%s\"" , expected, buf); ret =strncmp (expected, buf, c);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 22/211 spi: sun6i: add quirk for dual and quad SPI modes support
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maksim Kiselev <[email protected]>
[ Upstream commit 0605d9fb411f3337482976842a3901d6c125d298 ]
New Allwinner's SPI controllers can support dual and quad SPI modes. To enable one of these modes, we should set the corresponding bit in the SUN6I_BURST_CTL_CNT_REG register. DRM (28 bits) for dual mode and Quad_EN (29 bits) for quad transmission.
--- drivers/spi/spi-sun6i.c | 29 +++++++++++++++++++++++++---- 1 file changed, 25 insertions(+), 4 deletions(-)
drivers/spi/spi-sun6i.c +25 -4
@@ -83,6 +83,9 @@#define SUN6I_XMIT_CNT_REG 0x34#define SUN6I_BURST_CTL_CNT_REG 0x38 +#define SUN6I_BURST_CTL_CNT_STC_MASK GENMASK(23, 0) +#define SUN6I_BURST_CTL_CNT_DRM BIT(28) +#define SUN6I_BURST_CTL_CNT_QUAD_EN BIT(29)#define SUN6I_TXDATA_REG 0x200#define SUN6I_RXDATA_REG 0x300
@@ -90,6 +93,7 @@struct sun6i_spi_cfg {unsigned long fifo_depth;bool has_clk_ctl; +u32 mode_bits; };struct sun6i_spi {
@@ -266,7 +270,7 @@ static int sun6i_spi_transfer_one(struct spi_master *master,unsigned int div, div_cdr1, div_cdr2, timeout;unsigned int start, end, tx_time;unsigned int trig_level; -unsigned int tx_len =0 , rx_len =0 ; +unsigned int tx_len =0 , rx_len =0 , nbits =0 ;bool use_dma;int ret =0 ;u32 reg;
@@ -418,13 +422,29 @@ static int sun6i_spi_transfer_one(struct spi_master *master,sun6i_spi_write (sspi,SUN6I_GBL_CTL_REG , reg);/* Setup the transfer now... */ -if (sspi->tx_buf) +if (sspi->tx_buf) { tx_len = tfr->len; + nbits = tfr->tx_nbits; + }else if (tfr->rx_buf) { + nbits = tfr->rx_nbits; + } + +switch (nbits) { +case SPI_NBITS_DUAL : + reg =SUN6I_BURST_CTL_CNT_DRM ; +break ; +case SPI_NBITS_QUAD : + reg =SUN6I_BURST_CTL_CNT_QUAD_EN ; +break ; +case SPI_NBITS_SINGLE : +default : + reg =FIELD_PREP (SUN6I_BURST_CTL_CNT_STC_MASK , tx_len); + }/* Setup the counters */ +sun6i_spi_write (sspi,SUN6I_BURST_CTL_CNT_REG , reg);sun6i_spi_write (sspi,SUN6I_BURST_CNT_REG , tfr->len);sun6i_spi_write (sspi,SUN6I_XMIT_CNT_REG , tx_len); -sun6i_spi_write (sspi,SUN6I_BURST_CTL_CNT_REG , tx_len);if (!use_dma) {/* Fill the TX FIFO */
@@ -623,7 +643,8 @@ static int sun6i_spi_probe(struct platform_device *pdev) master->set_cs = sun6i_spi_set_cs; master->transfer_one = sun6i_spi_transfer_one; master->num_chipselect =4 ; - master->mode_bits =SPI_CPOL |SPI_CPHA |SPI_CS_HIGH |SPI_LSB_FIRST ; + master->mode_bits =SPI_CPOL |SPI_CPHA |SPI_CS_HIGH |SPI_LSB_FIRST | + sspi->cfg->mode_bits; master->bits_per_word_mask =SPI_BPW_MASK (8 ); master->dev.of_node = pdev->dev.of_node; master->auto_runtime_pm = true;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 23/211 devlink: remove reload failed checks in params get/set callbacks
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Pirko <[email protected]>
[ Upstream commit 633d76ad01ad0321a1ace3e5cc4fed06753d7ac4 ]
The checks in question were introduced by:
commit 6b4db2e528f6 ("devlink: Fix use-after-free after a failed reload"). That fixed an issue of reload with mlxsw driver.
Back then, that was a valid fix, because there was a limitation in place that prevented drivers from registering/unregistering params when devlink instance was registered.
It was possible to do the fix differently by changing drivers to register/unregister params in appropriate places making sure the ops operate only on memory which is allocated and initialized. But that, as a dependency, would require to remove the limitation mentioned above.
Eventually, this limitation was lifted by:
commit 1d18bb1a4ddd ("devlink: allow registering parameters after the instance")
Also, the alternative fix (which also fixed another issue) was done by:
commit 74cbc3c03c82 ("mlxsw: spectrum_acl_tcam: Move devlink param to TCAM code").
Therefore, the checks are no longer relevant. Each driver should make sure to have the params registered only when the memory the ops are working with is allocated and initialized.
So remove the checks.
--- net/devlink/leftover.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/devlink/leftover.c +2 -2
@@ -3946,7 +3946,7 @@ static int devlink_param_get(struct devlink *devlink, const struct devlink_param *param, struct devlink_param_gset_ctx *ctx) { - if (!param->get || devlink->reload_failed) + if (!param->get) return -EOPNOTSUPP;return param->get (devlink, param->id, ctx); }
@@ -3955,7 +3955,7 @@ static int devlink_param_set(struct devlink *devlink, const struct devlink_param *param, struct devlink_param_gset_ctx *ctx) { - if (!param->set || devlink->reload_failed) + if (!param->set) return -EOPNOTSUPP;return param->set (devlink, param->id, ctx); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 24/211 crypto: lrw,xts - Replace strlcpy with strscpy
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Azeem Shaikh <[email protected]>
[ Upstream commit babb80b3ecc6f40c962e13c654ebcd27f25ee327 ]
strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy().
Direct replacement is safe here since return value of -errno is used to check for truncation instead of sizeof(dest).
[1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy
[2] https://github.com/KSPP/linux/issues/89
--- crypto/lrw.c | 6 +++--- crypto/xts.c | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-)
crypto/lrw.c +3 -3
@@ -357,10 +357,10 @@ static int lrw_create(struct crypto_template *tmpl, struct rtattr **tb)* cipher name. */ if (!strncmp (cipher_name,"ecb(" ,4 )) { -unsigned len; +int len; - len =strlcpy (ecb_name, cipher_name +4 ,sizeof (ecb_name)); -if (len <2 || len >=sizeof (ecb_name)) + len =strscpy (ecb_name, cipher_name +4 ,sizeof (ecb_name)); +if (len <2 ) goto err_free_inst;if (ecb_name[len -1 ] !=')' )
crypto/xts.c +3 -3
@@ -396,10 +396,10 @@ static int xts_create(struct crypto_template *tmpl, struct rtattr **tb)* cipher name. */ if (!strncmp (cipher_name,"ecb(" ,4 )) { -unsigned len; +int len; - len =strlcpy (ctx->name, cipher_name +4 ,sizeof (ctx->name)); -if (len <2 || len >=sizeof (ctx->name)) + len =strscpy (ctx->name, cipher_name +4 ,sizeof (ctx->name)); +if (len <2 ) goto err_free_inst;if (ctx->name[len -1 ] !=')' )
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 25/211 net: stmmac: use per-queue 64 bit statistics where necessary
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jisheng Zhang <[email protected]>
[ Upstream commit 133466c3bbe171f826294161db203f7670bb30c8 ]
Currently, there are two major issues with stmmac driver statistics First of all, statistics in stmmac_extra_stats, stmmac_rxq_stats and stmmac_txq_stats are 32 bit variables on 32 bit platforms. This can cause some stats to overflow after several minutes of high traffic, for example rx_pkt_n, tx_pkt_n and so on.
Secondly, if HW supports multiqueues, there are frequent cacheline ping pongs on some driver statistic vars, for example, normal_irq_n, tx_pkt_n and so on. What's more, frequent cacheline ping pongs on normal_irq_n happens in ISR, this makes the situation worse.
To improve the driver, we convert those statistics to 64 bit, implement ndo_get_stats64 and update .get_ethtool_stats implementation accordingly. We also use per-queue statistics where necessary to remove the cacheline ping pongs as much as possible to make multiqueue operations faster. Those statistics which are not possible to overflow and not frequently updated are kept as is.
--- drivers/net/ethernet/stmicro/stmmac/common.h | 39 ++-- .../net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 12 +- .../ethernet/stmicro/stmmac/dwmac100_dma.c | 7 +- .../ethernet/stmicro/stmmac/dwmac4_descs.c | 16 +- .../net/ethernet/stmicro/stmmac/dwmac4_lib.c | 15 +- .../net/ethernet/stmicro/stmmac/dwmac_lib.c | 12 +- .../ethernet/stmicro/stmmac/dwxgmac2_descs.c | 6 +- .../ethernet/stmicro/stmmac/dwxgmac2_dma.c | 14 +- .../net/ethernet/stmicro/stmmac/enh_desc.c | 20 +- drivers/net/ethernet/stmicro/stmmac/hwif.h | 12 +- .../net/ethernet/stmicro/stmmac/norm_desc.c | 15 +- drivers/net/ethernet/stmicro/stmmac/stmmac.h | 2 + .../ethernet/stmicro/stmmac/stmmac_ethtool.c | 123 ++++++++--- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 200 ++++++++++++++---- 14 files changed, 335 insertions(+), 158 deletions(-)
drivers/net/ethernet/stmicro/stmmac/common.h +21 -18
@@ -59,13 +59,25 @@/* #define FRAME_FILTER_DEBUG */ struct stmmac_txq_stats { -unsigned long tx_pkt_n; -unsigned long tx_normal_irq_n; +u64 tx_bytes; +u64 tx_packets; +u64 tx_pkt_n; +u64 tx_normal_irq_n; +u64 napi_poll; +u64 tx_clean; +u64 tx_set_ic_bit; +u64 tx_tso_frames; +u64 tx_tso_nfrags; +struct u64_stats_sync syncp; };struct stmmac_rxq_stats { -unsigned long rx_pkt_n; -unsigned long rx_normal_irq_n; +u64 rx_bytes; +u64 rx_packets; +u64 rx_pkt_n; +u64 rx_normal_irq_n; +u64 napi_poll; +struct u64_stats_sync syncp; };/* Extra statistic and debug information exposed by ethtool */
@@ -81,6 +93,7 @@ struct stmmac_extra_stats {unsigned long tx_frame_flushed;unsigned long tx_payload_error;unsigned long tx_ip_header_error; +unsigned long tx_collision;/* Receive errors */ unsigned long rx_desc;unsigned long sa_filter_fail;
@@ -113,14 +126,6 @@ struct stmmac_extra_stats {/* Tx/Rx IRQ Events */ unsigned long rx_early_irq;unsigned long threshold; -unsigned long tx_pkt_n; -unsigned long rx_pkt_n; -unsigned long normal_irq_n; -unsigned long rx_normal_irq_n; -unsigned long napi_poll; -unsigned long tx_normal_irq_n; -unsigned long tx_clean; -unsigned long tx_set_ic_bit;unsigned long irq_receive_pmt_irq_n;/* MMC info */ unsigned long mmc_tx_irq_n;
@@ -190,18 +195,16 @@ struct stmmac_extra_stats {unsigned long mtl_rx_fifo_ctrl_active;unsigned long mac_rx_frame_ctrl_fifo;unsigned long mac_gmii_rx_proto_engine; -/* TSO */ -unsigned long tx_tso_frames; -unsigned long tx_tso_nfrags;/* EST */ unsigned long mtl_est_cgce;unsigned long mtl_est_hlbs;unsigned long mtl_est_hlbf;unsigned long mtl_est_btre;unsigned long mtl_est_btrlm; -/* per queue statistics */ -struct stmmac_txq_stats txq_stats[MTL_MAX_TX_QUEUES ]; -struct stmmac_rxq_stats rxq_stats[MTL_MAX_RX_QUEUES ]; +unsigned long rx_dropped; +unsigned long rx_errors; +unsigned long tx_dropped; +unsigned long tx_errors; };/* Safety Feature statistics exposed by ethtool */
drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c +9 -3
@@ -440,8 +440,10 @@ static int sun8i_dwmac_dma_interrupt(struct stmmac_priv *priv, struct stmmac_extra_stats *x, u32 chan, u32 dir) { - u32 v; + struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[chan]; +struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[chan];int ret =0 ; +u32 v; v =readl (ioaddr +EMAC_INT_STA );
@@ -452,7 +454,9 @@ static int sun8i_dwmac_dma_interrupt(struct stmmac_priv *priv,if (v &EMAC_TX_INT ) { ret |= handle_tx; - x->tx_normal_irq_n++; +u64_stats_update_begin (&tx_q->txq_stats.syncp); + tx_q->txq_stats.tx_normal_irq_n++; +u64_stats_update_end (&tx_q->txq_stats.syncp); }if (v &EMAC_TX_DMA_STOP_INT )
@@ -474,7 +478,9 @@ static int sun8i_dwmac_dma_interrupt(struct stmmac_priv *priv,if (v &EMAC_RX_INT ) { ret |= handle_rx; - x->rx_normal_irq_n++; +u64_stats_update_begin (&rx_q->rxq_stats.syncp); + rx_q->rxq_stats.rx_normal_irq_n++; +u64_stats_update_end (&rx_q->rxq_stats.syncp); }if (v &EMAC_RX_BUF_UA_INT )
drivers/net/ethernet/stmicro/stmmac/dwmac100_dma.c +1 -6
@@ -82,29 +82,24 @@ static void dwmac100_dump_dma_regs(struct stmmac_priv *priv, }/* DMA controller has two counters to track the number of the missed frames. */ -static void dwmac100_dma_diagnostic_fr (struct net_device_stats *stats, -struct stmmac_extra_stats *x, +static void dwmac100_dma_diagnostic_fr (struct stmmac_extra_stats *x,void __iomem *ioaddr) {u32 csr8 =readl (ioaddr +DMA_MISSED_FRAME_CTR );if (unlikely (csr8)) {if (csr8 &DMA_MISSED_FRAME_OVE ) { - stats->rx_over_errors +=0x800 ; x->rx_overflow_cntr +=0x800 ; }else {unsigned int ove_cntr; ove_cntr = ((csr8 &DMA_MISSED_FRAME_OVE_CNTR ) >>17 ); - stats->rx_over_errors += ove_cntr; x->rx_overflow_cntr += ove_cntr; }if (csr8 &DMA_MISSED_FRAME_OVE_M ) { - stats->rx_missed_errors +=0xffff ; x->rx_missed_cntr +=0xffff ; }else {unsigned int miss_f = (csr8 &DMA_MISSED_FRAME_M_CNTR ); - stats->rx_missed_errors += miss_f; x->rx_missed_cntr += miss_f; } }
drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c +5 -11
@@ -13,8 +13,7 @@#include "dwmac4.h" #include "dwmac4_descs.h" -static int dwmac4_wrback_get_tx_status (struct net_device_stats *stats, -struct stmmac_extra_stats *x, +static int dwmac4_wrback_get_tx_status (struct stmmac_extra_stats *x,struct dma_desc *p,void __iomem *ioaddr) {
@@ -40,15 +39,13 @@ static int dwmac4_wrback_get_tx_status(struct net_device_stats *stats, x->tx_frame_flushed++;if (unlikely (tdes3 &TDES3_LOSS_CARRIER )) { x->tx_losscarrier++; - stats->tx_carrier_errors++; }if (unlikely (tdes3 &TDES3_NO_CARRIER )) { x->tx_carrier++; - stats->tx_carrier_errors++; }if (unlikely ((tdes3 &TDES3_LATE_COLLISION ) || (tdes3 &TDES3_EXCESSIVE_COLLISION ))) - stats->collisions += + x->tx_collision += (tdes3 &TDES3_COLLISION_COUNT_MASK ) >>TDES3_COLLISION_COUNT_SHIFT ;
@@ -73,8 +70,7 @@ static int dwmac4_wrback_get_tx_status(struct net_device_stats *stats,return ret; } -static int dwmac4_wrback_get_rx_status (struct net_device_stats *stats, -struct stmmac_extra_stats *x, +static int dwmac4_wrback_get_rx_status (struct stmmac_extra_stats *x,struct dma_desc *p) {unsigned int rdes1 =le32_to_cpu (p->des1);
@@ -93,7 +89,7 @@ static int dwmac4_wrback_get_rx_status(struct net_device_stats *stats,if (unlikely (rdes3 &RDES3_ERROR_SUMMARY )) {if (unlikely (rdes3 &RDES3_GIANT_PACKET )) - stats->rx_length_errors++; + x->rx_length++;if (unlikely (rdes3 &RDES3_OVERFLOW_ERROR )) x->rx_gmac_overflow++;
@@ -103,10 +99,8 @@ static int dwmac4_wrback_get_rx_status(struct net_device_stats *stats,if (unlikely (rdes3 &RDES3_RECEIVE_ERROR )) x->rx_mii++; -if (unlikely (rdes3 &RDES3_CRC_ERROR )) { +if (unlikely (rdes3 &RDES3_CRC_ERROR )) x->rx_crc_errors++; - stats->rx_crc_errors++; - }if (unlikely (rdes3 &RDES3_DRIBBLE_ERROR )) x->dribbling_bit++;
drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c +9 -6
@@ -171,6 +171,8 @@ int dwmac4_dma_interrupt(struct stmmac_priv *priv, void __iomem *ioaddr,const struct dwmac4_addrs *dwmac4_addrs = priv->plat->dwmac4_addrs;u32 intr_status =readl (ioaddr +DMA_CHAN_STATUS (dwmac4_addrs, chan));u32 intr_en =readl (ioaddr +DMA_CHAN_INTR_ENA (dwmac4_addrs, chan)); +struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[chan]; +struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[chan];int ret =0 ;if (dir ==DMA_DIR_RX )
@@ -198,18 +200,19 @@ int dwmac4_dma_interrupt(struct stmmac_priv *priv, void __iomem *ioaddr, } }/* TX/RX NORMAL interrupts */ -if (likely (intr_status &DMA_CHAN_STATUS_NIS )) - x->normal_irq_n++;if (likely (intr_status &DMA_CHAN_STATUS_RI )) { - x->rx_normal_irq_n++; - x->rxq_stats[chan].rx_normal_irq_n++; +u64_stats_update_begin (&rx_q->rxq_stats.syncp); + rx_q->rxq_stats.rx_normal_irq_n++; +u64_stats_update_end (&rx_q->rxq_stats.syncp); ret |= handle_rx; }if (likely (intr_status &DMA_CHAN_STATUS_TI )) { - x->tx_normal_irq_n++; - x->txq_stats[chan].tx_normal_irq_n++; +u64_stats_update_begin (&tx_q->txq_stats.syncp); + tx_q->txq_stats.tx_normal_irq_n++; +u64_stats_update_end (&tx_q->txq_stats.syncp); ret |= handle_tx; } +if (unlikely (intr_status &DMA_CHAN_STATUS_TBU )) ret |= handle_tx;if (unlikely (intr_status &DMA_CHAN_STATUS_ERI ))
drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c +9 -3
@@ -10,6 +10,7 @@#include <linux/iopoll.h> #include "common.h" #include "dwmac_dma.h" +#include "stmmac.h" #define GMAC_HI_REG_AE 0x80000000
@@ -161,6 +162,8 @@ static void show_rx_process_state(unsigned int status)int dwmac_dma_interrupt (struct stmmac_priv *priv,void __iomem *ioaddr,struct stmmac_extra_stats *x,u32 chan,u32 dir) { +struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[chan]; +struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[chan];int ret =0 ;/* read the status register (CSR5) */ u32 intr_status =readl (ioaddr +DMA_STATUS );
@@ -208,17 +211,20 @@ int dwmac_dma_interrupt(struct stmmac_priv *priv, void __iomem *ioaddr, }/* TX/RX NORMAL interrupts */ if (likely (intr_status &DMA_STATUS_NIS )) { - x->normal_irq_n++;if (likely (intr_status &DMA_STATUS_RI )) {u32 value =readl (ioaddr +DMA_INTR_ENA );/* to schedule NAPI on real RIE event. */ if (likely (value &DMA_INTR_ENA_RIE )) { - x->rx_normal_irq_n++; +u64_stats_update_begin (&rx_q->rxq_stats.syncp); + rx_q->rxq_stats.rx_normal_irq_n++; +u64_stats_update_end (&rx_q->rxq_stats.syncp); ret |= handle_rx; } }if (likely (intr_status &DMA_STATUS_TI )) { - x->tx_normal_irq_n++; +u64_stats_update_begin (&tx_q->txq_stats.syncp); + tx_q->txq_stats.tx_normal_irq_n++; +u64_stats_update_end (&tx_q->txq_stats.syncp); ret |= handle_tx; }if (unlikely (intr_status &DMA_STATUS_ERI ))
drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c +2 -4
@@ -8,8 +8,7 @@#include "common.h" #include "dwxgmac2.h" -static int dwxgmac2_get_tx_status (struct net_device_stats *stats, -struct stmmac_extra_stats *x, +static int dwxgmac2_get_tx_status (struct stmmac_extra_stats *x,struct dma_desc *p,void __iomem *ioaddr) {unsigned int tdes3 =le32_to_cpu (p->des3);
@@ -23,8 +22,7 @@ static int dwxgmac2_get_tx_status(struct net_device_stats *stats,return ret; } -static int dwxgmac2_get_rx_status (struct net_device_stats *stats, -struct stmmac_extra_stats *x, +static int dwxgmac2_get_rx_status (struct stmmac_extra_stats *x,struct dma_desc *p) {unsigned int rdes3 =le32_to_cpu (p->des3);
drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c +8 -6
@@ -337,6 +337,8 @@ static int dwxgmac2_dma_interrupt(struct stmmac_priv *priv, struct stmmac_extra_stats *x, u32 chan, u32 dir) { + struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[chan]; +struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[chan];u32 intr_status =readl (ioaddr +XGMAC_DMA_CH_STATUS (chan));u32 intr_en =readl (ioaddr +XGMAC_DMA_CH_INT_EN (chan));int ret =0 ;
@@ -364,16 +366,16 @@ static int dwxgmac2_dma_interrupt(struct stmmac_priv *priv,/* TX/RX NORMAL interrupts */ if (likely (intr_status &XGMAC_NIS )) { - x->normal_irq_n++; -if (likely (intr_status &XGMAC_RI )) { - x->rx_normal_irq_n++; - x->rxq_stats[chan].rx_normal_irq_n++; +u64_stats_update_begin (&rx_q->rxq_stats.syncp); + rx_q->rxq_stats.rx_normal_irq_n++; +u64_stats_update_end (&rx_q->rxq_stats.syncp); ret |= handle_rx; }if (likely (intr_status & (XGMAC_TI |XGMAC_TBU ))) { - x->tx_normal_irq_n++; - x->txq_stats[chan].tx_normal_irq_n++; +u64_stats_update_begin (&tx_q->txq_stats.syncp); + tx_q->txq_stats.tx_normal_irq_n++; +u64_stats_update_end (&tx_q->txq_stats.syncp); ret |= handle_tx; } }
drivers/net/ethernet/stmicro/stmmac/enh_desc.c +7 -13
@@ -12,8 +12,7 @@#include "common.h" #include "descs_com.h" -static int enh_desc_get_tx_status (struct net_device_stats *stats, -struct stmmac_extra_stats *x, +static int enh_desc_get_tx_status (struct stmmac_extra_stats *x,struct dma_desc *p,void __iomem *ioaddr) {unsigned int tdes0 =le32_to_cpu (p->des0);
@@ -38,15 +37,13 @@ static int enh_desc_get_tx_status(struct net_device_stats *stats,if (unlikely (tdes0 &ETDES0_LOSS_CARRIER )) { x->tx_losscarrier++; - stats->tx_carrier_errors++; }if (unlikely (tdes0 &ETDES0_NO_CARRIER )) { x->tx_carrier++; - stats->tx_carrier_errors++; }if (unlikely ((tdes0 &ETDES0_LATE_COLLISION ) || (tdes0 &ETDES0_EXCESSIVE_COLLISIONS ))) - stats->collisions += + x->tx_collision += (tdes0 &ETDES0_COLLISION_COUNT_MASK ) >>3 ;if (unlikely (tdes0 &ETDES0_EXCESSIVE_DEFERRAL ))
@@ -117,8 +114,7 @@ static int enh_desc_coe_rdes0(int ipc_err, int type, int payload_err)return ret; } -static void enh_desc_get_ext_status (struct net_device_stats *stats, -struct stmmac_extra_stats *x, +static void enh_desc_get_ext_status (struct stmmac_extra_stats *x,struct dma_extended_desc *p) {unsigned int rdes0 =le32_to_cpu (p->basic.des0);
@@ -182,8 +178,7 @@ static void enh_desc_get_ext_status(struct net_device_stats *stats, } } -static int enh_desc_get_rx_status (struct net_device_stats *stats, -struct stmmac_extra_stats *x, +static int enh_desc_get_rx_status (struct stmmac_extra_stats *x,struct dma_desc *p) {unsigned int rdes0 =le32_to_cpu (p->des0);
@@ -193,14 +188,14 @@ static int enh_desc_get_rx_status(struct net_device_stats *stats,return dma_own;if (unlikely (!(rdes0 &RDES0_LAST_DESCRIPTOR ))) { - stats->rx_length_errors++; + x->rx_length++;return discard_frame; }if (unlikely (rdes0 &RDES0_ERROR_SUMMARY )) {if (unlikely (rdes0 &RDES0_DESCRIPTOR_ERROR )) { x->rx_desc++; - stats->rx_length_errors++; + x->rx_length++; }if (unlikely (rdes0 &RDES0_OVERFLOW_ERROR )) x->rx_gmac_overflow++;
@@ -209,7 +204,7 @@ static int enh_desc_get_rx_status(struct net_device_stats *stats,pr_err ("\tIPC Csum Error/Giant frame\n" );if (unlikely (rdes0 &RDES0_COLLISION )) - stats->collisions++; + x->rx_collision++;if (unlikely (rdes0 &RDES0_RECEIVE_WATCHDOG )) x->rx_watchdog++;
@@ -218,7 +213,6 @@ static int enh_desc_get_rx_status(struct net_device_stats *stats,if (unlikely (rdes0 &RDES0_CRC_ERROR )) { x->rx_crc_errors++; - stats->rx_crc_errors++; } ret = discard_frame; }
drivers/net/ethernet/stmicro/stmmac/hwif.h +4 -8
@@ -57,8 +57,7 @@ struct stmmac_desc_ops {/* Last tx segment reports the transmit status */ int (*get_tx_ls)(struct dma_desc *p);/* Return the transmit status looking at the TDES1 */ -int (*tx_status)(struct net_device_stats *stats, -struct stmmac_extra_stats *x, +int (*tx_status)(struct stmmac_extra_stats *x,struct dma_desc *p,void __iomem *ioaddr);/* Get the buffer size from the descriptor */ int (*get_tx_len)(struct dma_desc *p);
@@ -67,11 +66,9 @@ struct stmmac_desc_ops {/* Get the receive frame size */ int (*get_rx_frame_len)(struct dma_desc *p,int rx_coe_type);/* Return the reception status looking at the RDES1 */ -int (*rx_status)(struct net_device_stats *stats, -struct stmmac_extra_stats *x, +int (*rx_status)(struct stmmac_extra_stats *x,struct dma_desc *p); -void (*rx_extended_status)(struct net_device_stats *stats, -struct stmmac_extra_stats *x, +void (*rx_extended_status)(struct stmmac_extra_stats *x,struct dma_extended_desc *p);/* Set tx timestamp enable bit */ void (*enable_tx_timestamp) (struct dma_desc *p);
@@ -191,8 +188,7 @@ struct stmmac_dma_ops {void (*dma_tx_mode)(struct stmmac_priv *priv,void __iomem *ioaddr,int mode,u32 channel,int fifosz,u8 qmode);/* To track extra statistic (if supported) */ -void (*dma_diagnostic_fr)(struct net_device_stats *stats, -struct stmmac_extra_stats *x, +void (*dma_diagnostic_fr)(struct stmmac_extra_stats *x,void __iomem *ioaddr);void (*enable_dma_transmission) (void __iomem *ioaddr); void (*enable_dma_irq)(struct stmmac_priv *priv, void __iomem *ioaddr,
drivers/net/ethernet/stmicro/stmmac/norm_desc.c +4 -11
@@ -12,8 +12,7 @@#include "common.h" #include "descs_com.h" -static int ndesc_get_tx_status (struct net_device_stats *stats, -struct stmmac_extra_stats *x, +static int ndesc_get_tx_status (struct stmmac_extra_stats *x,struct dma_desc *p,void __iomem *ioaddr) {unsigned int tdes0 =le32_to_cpu (p->des0);
@@ -31,15 +30,12 @@ static int ndesc_get_tx_status(struct net_device_stats *stats,if (unlikely (tdes0 &TDES0_ERROR_SUMMARY )) {if (unlikely (tdes0 &TDES0_UNDERFLOW_ERROR )) { x->tx_underflow++; - stats->tx_fifo_errors++; }if (unlikely (tdes0 &TDES0_NO_CARRIER )) { x->tx_carrier++; - stats->tx_carrier_errors++; }if (unlikely (tdes0 &TDES0_LOSS_CARRIER )) { x->tx_losscarrier++; - stats->tx_carrier_errors++; } if (unlikely((tdes0 & TDES0_EXCESSIVE_DEFERRAL) || (tdes0 & TDES0_EXCESSIVE_COLLISIONS) ||
@@ -47,7 +43,7 @@ static int ndesc_get_tx_status(struct net_device_stats *stats,unsigned int collisions; collisions = (tdes0 &TDES0_COLLISION_COUNT_MASK ) >>3 ; - stats->collisions += collisions; + x->tx_collision += collisions; } ret = tx_err; }
@@ -70,8 +66,7 @@ static int ndesc_get_tx_len(struct dma_desc *p)* and, if required, updates the multicast statistics. * In case of success, it returns good_frame because the GMAC device * is supposed to be able to compute the csum in HW. */ -static int ndesc_get_rx_status (struct net_device_stats *stats, -struct stmmac_extra_stats *x, +static int ndesc_get_rx_status (struct stmmac_extra_stats *x,struct dma_desc *p) {int ret = good_frame;
@@ -81,7 +76,7 @@ static int ndesc_get_rx_status(struct net_device_stats *stats,return dma_own;if (unlikely (!(rdes0 &RDES0_LAST_DESCRIPTOR ))) { - stats->rx_length_errors++; + x->rx_length++;return discard_frame; }
@@ -96,11 +91,9 @@ static int ndesc_get_rx_status(struct net_device_stats *stats, x->ipc_csum_error++;if (unlikely (rdes0 &RDES0_COLLISION )) { x->rx_collision++; - stats->collisions++; }if (unlikely (rdes0 &RDES0_CRC_ERROR )) { x->rx_crc_errors++; - stats->rx_crc_errors++; } ret = discard_frame; }
drivers/net/ethernet/stmicro/stmmac/stmmac.h +2 -0
@@ -77,6 +77,7 @@ struct stmmac_tx_queue {dma_addr_t dma_tx_phy;dma_addr_t tx_tail_addr;u32 mss; +struct stmmac_txq_stats txq_stats; };struct stmmac_rx_buffer {
@@ -121,6 +122,7 @@ struct stmmac_rx_queue {unsigned int len;unsigned int error; } state; +struct stmmac_rxq_stats rxq_stats; };struct stmmac_channel {
drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c +98 -25
187 lines not on this page · raw message
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +156 -44
467 lines not on this page · raw message
Signature · 1 line
2.40.1
Re: [PATCH 6.5 025/211] net: stmmac: use per-queue 64 bit statistics where necessary
Quoted 7 lines · Greg Kroah-Hartman
6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jisheng Zhang <[email protected]>
[ Upstream commit
133466c3bbe171f826294161db203f7670bb30c8]
This patch causes a regression in mainline:
https://lore.kernel.org/all/[email protected]/
A fix is heading towards mainline now:
https://lore.kernel.org/all/[email protected]/
Jisheng Zhang already mentioned this and also mentioned that the change depends on another commit not yet backported:
https://lore.kernel.org/all/ZQHKiU6SNtq7t1Fi@xhacker/
Something feels wrong here; not sure if it is or if I'm missing something.
Ciao, Thorsten (who only noticed this by chance)
Quoted 1,321 lines
Currently, there are two major issues with stmmac driver statistics First of all, statistics in
stmmac_extra_stats,stmmac_rxq_statsandstmmac_txq_statsare 32 bit variables on 32 bit platforms. This can cause some stats to overflow after several minutes of high traffic, for examplerx_pkt_n,tx_pkt_nand so on.Secondly, if HW supports multiqueues, there are frequent cacheline ping pongs on some driver statistic vars, for example,
normal_irq_n,tx_pkt_nand so on. What's more, frequent cacheline ping pongs onnormal_irq_nhappens in ISR, this makes the situation worse.To improve the driver, we convert those statistics to 64 bit, implement
ndo_get_stats64and update .get_ethtool_stats implementation accordingly. We also use per-queue statistics where necessary to remove the cacheline ping pongs as much as possible to make multiqueue operations faster. Those statistics which are not possible to overflow and not frequently updated are kept as is.Signed-off-by Jisheng Zhang <[email protected]>Signed-off-by Jakub Kicinski <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- drivers/net/ethernet/stmicro/stmmac/common.h | 39 ++-- .../net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 12 +- .../ethernet/stmicro/stmmac/dwmac100_dma.c | 7 +- .../ethernet/stmicro/stmmac/dwmac4_descs.c | 16 +- .../net/ethernet/stmicro/stmmac/dwmac4_lib.c | 15 +- .../net/ethernet/stmicro/stmmac/dwmac_lib.c | 12 +- .../ethernet/stmicro/stmmac/dwxgmac2_descs.c | 6 +- .../ethernet/stmicro/stmmac/dwxgmac2_dma.c | 14 +- .../net/ethernet/stmicro/stmmac/enh_desc.c | 20 +- drivers/net/ethernet/stmicro/stmmac/hwif.h | 12 +- .../net/ethernet/stmicro/stmmac/norm_desc.c | 15 +- drivers/net/ethernet/stmicro/stmmac/stmmac.h | 2 + .../ethernet/stmicro/stmmac/stmmac_ethtool.c | 123 ++++++++--- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 200 ++++++++++++++---- 14 files changed, 335 insertions(+), 158 deletions(-)drivers/net/ethernet/stmicro/stmmac/common.h +21
-18@@ -59,13 +59,25 @@/* #define FRAME_FILTER_DEBUG */ struct stmmac_txq_stats { -unsigned long tx_pkt_n; -unsigned long tx_normal_irq_n; +u64 tx_bytes; +u64 tx_packets; +u64 tx_pkt_n; +u64 tx_normal_irq_n; +u64 napi_poll; +u64 tx_clean; +u64 tx_set_ic_bit; +u64 tx_tso_frames; +u64 tx_tso_nfrags; +struct u64_stats_sync syncp; };struct stmmac_rxq_stats { -unsigned long rx_pkt_n; -unsigned long rx_normal_irq_n; +u64 rx_bytes; +u64 rx_packets; +u64 rx_pkt_n; +u64 rx_normal_irq_n; +u64 napi_poll; +struct u64_stats_sync syncp; };/* Extra statistic and debug information exposed by ethtool */ @@ -81,6 +93,7 @@ struct stmmac_extra_stats {unsigned long tx_frame_flushed;unsigned long tx_payload_error;unsigned long tx_ip_header_error; +unsigned long tx_collision;/* Receive errors */ unsigned long rx_desc;unsigned long sa_filter_fail;@@ -113,14 +126,6 @@ struct stmmac_extra_stats {/* Tx/Rx IRQ Events */ unsigned long rx_early_irq;unsigned long threshold; -unsigned long tx_pkt_n; -unsigned long rx_pkt_n; -unsigned long normal_irq_n; -unsigned long rx_normal_irq_n; -unsigned long napi_poll; -unsigned long tx_normal_irq_n; -unsigned long tx_clean; -unsigned long tx_set_ic_bit;unsigned long irq_receive_pmt_irq_n;/* MMC info */ unsigned long mmc_tx_irq_n;@@ -190,18 +195,16 @@ struct stmmac_extra_stats {unsigned long mtl_rx_fifo_ctrl_active;unsigned long mac_rx_frame_ctrl_fifo;unsigned long mac_gmii_rx_proto_engine; -/* TSO */ -unsigned long tx_tso_frames; -unsigned long tx_tso_nfrags;/* EST */ unsigned long mtl_est_cgce;unsigned long mtl_est_hlbs;unsigned long mtl_est_hlbf;unsigned long mtl_est_btre;unsigned long mtl_est_btrlm; -/* per queue statistics */ -struct stmmac_txq_stats txq_stats[MTL_MAX_TX_QUEUES ]; -struct stmmac_rxq_stats rxq_stats[MTL_MAX_RX_QUEUES ]; +unsigned long rx_dropped; +unsigned long rx_errors; +unsigned long tx_dropped; +unsigned long tx_errors; };/* Safety Feature statistics exposed by ethtool */ drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c +9
-3@@ -440,8 +440,10 @@ static int sun8i_dwmac_dma_interrupt(struct stmmac_priv *priv, struct stmmac_extra_stats *x, u32 chan, u32 dir) { - u32 v; + struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[chan]; +struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[chan];int ret =0 ; +u32 v; v =readl (ioaddr +EMAC_INT_STA );@@ -452,7 +454,9 @@ static int sun8i_dwmac_dma_interrupt(struct stmmac_priv *priv,if (v &EMAC_TX_INT ) { ret |= handle_tx; - x->tx_normal_irq_n++; +u64_stats_update_begin (&tx_q->txq_stats.syncp); + tx_q->txq_stats.tx_normal_irq_n++; +u64_stats_update_end (&tx_q->txq_stats.syncp); }if (v &EMAC_TX_DMA_STOP_INT )@@ -474,7 +478,9 @@ static int sun8i_dwmac_dma_interrupt(struct stmmac_priv *priv,if (v &EMAC_RX_INT ) { ret |= handle_rx; - x->rx_normal_irq_n++; +u64_stats_update_begin (&rx_q->rxq_stats.syncp); + rx_q->rxq_stats.rx_normal_irq_n++; +u64_stats_update_end (&rx_q->rxq_stats.syncp); }if (v &EMAC_RX_BUF_UA_INT )drivers/net/ethernet/stmicro/stmmac/dwmac100_dma.c +1
-6@@ -82,29 +82,24 @@ static void dwmac100_dump_dma_regs(struct stmmac_priv *priv, }/* DMA controller has two counters to track the number of the missed frames. */ -static void dwmac100_dma_diagnostic_fr (struct net_device_stats *stats, -struct stmmac_extra_stats *x, +static void dwmac100_dma_diagnostic_fr (struct stmmac_extra_stats *x,void __iomem *ioaddr) {u32 csr8 =readl (ioaddr +DMA_MISSED_FRAME_CTR );if (unlikely (csr8)) {if (csr8 &DMA_MISSED_FRAME_OVE ) { - stats->rx_over_errors +=0x800 ; x->rx_overflow_cntr +=0x800 ; }else {unsigned int ove_cntr; ove_cntr = ((csr8 &DMA_MISSED_FRAME_OVE_CNTR ) >>17 ); - stats->rx_over_errors += ove_cntr; x->rx_overflow_cntr += ove_cntr; }if (csr8 &DMA_MISSED_FRAME_OVE_M ) { - stats->rx_missed_errors +=0xffff ; x->rx_missed_cntr +=0xffff ; }else {unsigned int miss_f = (csr8 &DMA_MISSED_FRAME_M_CNTR ); - stats->rx_missed_errors += miss_f; x->rx_missed_cntr += miss_f; } }drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c +5
-11@@ -13,8 +13,7 @@#include "dwmac4.h" #include "dwmac4_descs.h" -static int dwmac4_wrback_get_tx_status (struct net_device_stats *stats, -struct stmmac_extra_stats *x, +static int dwmac4_wrback_get_tx_status (struct stmmac_extra_stats *x,struct dma_desc *p,void __iomem *ioaddr) {@@ -40,15 +39,13 @@ static int dwmac4_wrback_get_tx_status(struct net_device_stats *stats, x->tx_frame_flushed++;if (unlikely (tdes3 &TDES3_LOSS_CARRIER )) { x->tx_losscarrier++; - stats->tx_carrier_errors++; }if (unlikely (tdes3 &TDES3_NO_CARRIER )) { x->tx_carrier++; - stats->tx_carrier_errors++; }if (unlikely ((tdes3 &TDES3_LATE_COLLISION ) || (tdes3 &TDES3_EXCESSIVE_COLLISION ))) - stats->collisions += + x->tx_collision += (tdes3 &TDES3_COLLISION_COUNT_MASK ) >>TDES3_COLLISION_COUNT_SHIFT ;@@ -73,8 +70,7 @@ static int dwmac4_wrback_get_tx_status(struct net_device_stats *stats,return ret; } -static int dwmac4_wrback_get_rx_status (struct net_device_stats *stats, -struct stmmac_extra_stats *x, +static int dwmac4_wrback_get_rx_status (struct stmmac_extra_stats *x,struct dma_desc *p) {unsigned int rdes1 =le32_to_cpu (p->des1);@@ -93,7 +89,7 @@ static int dwmac4_wrback_get_rx_status(struct net_device_stats *stats,if (unlikely (rdes3 &RDES3_ERROR_SUMMARY )) {if (unlikely (rdes3 &RDES3_GIANT_PACKET )) - stats->rx_length_errors++; + x->rx_length++;if (unlikely (rdes3 &RDES3_OVERFLOW_ERROR )) x->rx_gmac_overflow++;@@ -103,10 +99,8 @@ static int dwmac4_wrback_get_rx_status(struct net_device_stats *stats,if (unlikely (rdes3 &RDES3_RECEIVE_ERROR )) x->rx_mii++; -if (unlikely (rdes3 &RDES3_CRC_ERROR )) { +if (unlikely (rdes3 &RDES3_CRC_ERROR )) x->rx_crc_errors++; - stats->rx_crc_errors++; - }if (unlikely (rdes3 &RDES3_DRIBBLE_ERROR )) x->dribbling_bit++;drivers/net/ethernet/stmicro/stmmac/dwmac4_lib.c +9
-6@@ -171,6 +171,8 @@ int dwmac4_dma_interrupt(struct stmmac_priv *priv, void __iomem *ioaddr,const struct dwmac4_addrs *dwmac4_addrs = priv->plat->dwmac4_addrs;u32 intr_status =readl (ioaddr +DMA_CHAN_STATUS (dwmac4_addrs, chan));u32 intr_en =readl (ioaddr +DMA_CHAN_INTR_ENA (dwmac4_addrs, chan)); +struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[chan]; +struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[chan];int ret =0 ;if (dir ==DMA_DIR_RX )@@ -198,18 +200,19 @@ int dwmac4_dma_interrupt(struct stmmac_priv *priv, void __iomem *ioaddr, } }/* TX/RX NORMAL interrupts */ -if (likely (intr_status &DMA_CHAN_STATUS_NIS )) - x->normal_irq_n++;if (likely (intr_status &DMA_CHAN_STATUS_RI )) { - x->rx_normal_irq_n++; - x->rxq_stats[chan].rx_normal_irq_n++; +u64_stats_update_begin (&rx_q->rxq_stats.syncp); + rx_q->rxq_stats.rx_normal_irq_n++; +u64_stats_update_end (&rx_q->rxq_stats.syncp); ret |= handle_rx; }if (likely (intr_status &DMA_CHAN_STATUS_TI )) { - x->tx_normal_irq_n++; - x->txq_stats[chan].tx_normal_irq_n++; +u64_stats_update_begin (&tx_q->txq_stats.syncp); + tx_q->txq_stats.tx_normal_irq_n++; +u64_stats_update_end (&tx_q->txq_stats.syncp); ret |= handle_tx; } +if (unlikely (intr_status &DMA_CHAN_STATUS_TBU )) ret |= handle_tx;if (unlikely (intr_status &DMA_CHAN_STATUS_ERI ))drivers/net/ethernet/stmicro/stmmac/dwmac_lib.c +9
-3@@ -10,6 +10,7 @@#include <linux/iopoll.h> #include "common.h" #include "dwmac_dma.h" +#include "stmmac.h" #define GMAC_HI_REG_AE 0x80000000@@ -161,6 +162,8 @@ static void show_rx_process_state(unsigned int status)int dwmac_dma_interrupt (struct stmmac_priv *priv,void __iomem *ioaddr,struct stmmac_extra_stats *x,u32 chan,u32 dir) { +struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[chan]; +struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[chan];int ret =0 ;/* read the status register (CSR5) */ u32 intr_status =readl (ioaddr +DMA_STATUS );@@ -208,17 +211,20 @@ int dwmac_dma_interrupt(struct stmmac_priv *priv, void __iomem *ioaddr, }/* TX/RX NORMAL interrupts */ if (likely (intr_status &DMA_STATUS_NIS )) { - x->normal_irq_n++;if (likely (intr_status &DMA_STATUS_RI )) {u32 value =readl (ioaddr +DMA_INTR_ENA );/* to schedule NAPI on real RIE event. */ if (likely (value &DMA_INTR_ENA_RIE )) { - x->rx_normal_irq_n++; +u64_stats_update_begin (&rx_q->rxq_stats.syncp); + rx_q->rxq_stats.rx_normal_irq_n++; +u64_stats_update_end (&rx_q->rxq_stats.syncp); ret |= handle_rx; } }if (likely (intr_status &DMA_STATUS_TI )) { - x->tx_normal_irq_n++; +u64_stats_update_begin (&tx_q->txq_stats.syncp); + tx_q->txq_stats.tx_normal_irq_n++; +u64_stats_update_end (&tx_q->txq_stats.syncp); ret |= handle_tx; }if (unlikely (intr_status &DMA_STATUS_ERI ))drivers/net/ethernet/stmicro/stmmac/dwxgmac2_descs.c +2
-4@@ -8,8 +8,7 @@#include "common.h" #include "dwxgmac2.h" -static int dwxgmac2_get_tx_status (struct net_device_stats *stats, -struct stmmac_extra_stats *x, +static int dwxgmac2_get_tx_status (struct stmmac_extra_stats *x,struct dma_desc *p,void __iomem *ioaddr) {unsigned int tdes3 =le32_to_cpu (p->des3);@@ -23,8 +22,7 @@ static int dwxgmac2_get_tx_status(struct net_device_stats *stats,return ret; } -static int dwxgmac2_get_rx_status (struct net_device_stats *stats, -struct stmmac_extra_stats *x, +static int dwxgmac2_get_rx_status (struct stmmac_extra_stats *x,struct dma_desc *p) {unsigned int rdes3 =le32_to_cpu (p->des3);drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c +8
-6@@ -337,6 +337,8 @@ static int dwxgmac2_dma_interrupt(struct stmmac_priv *priv, struct stmmac_extra_stats *x, u32 chan, u32 dir) { + struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[chan]; +struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[chan];u32 intr_status =readl (ioaddr +XGMAC_DMA_CH_STATUS (chan));u32 intr_en =readl (ioaddr +XGMAC_DMA_CH_INT_EN (chan));int ret =0 ;@@ -364,16 +366,16 @@ static int dwxgmac2_dma_interrupt(struct stmmac_priv *priv,/* TX/RX NORMAL interrupts */ if (likely (intr_status &XGMAC_NIS )) { - x->normal_irq_n++; -if (likely (intr_status &XGMAC_RI )) { - x->rx_normal_irq_n++; - x->rxq_stats[chan].rx_normal_irq_n++; +u64_stats_update_begin (&rx_q->rxq_stats.syncp); + rx_q->rxq_stats.rx_normal_irq_n++; +u64_stats_update_end (&rx_q->rxq_stats.syncp); ret |= handle_rx; }if (likely (intr_status & (XGMAC_TI |XGMAC_TBU ))) { - x->tx_normal_irq_n++; - x->txq_stats[chan].tx_normal_irq_n++; +u64_stats_update_begin (&tx_q->txq_stats.syncp); + tx_q->txq_stats.tx_normal_irq_n++; +u64_stats_update_end (&tx_q->txq_stats.syncp); ret |= handle_tx; } }drivers/net/ethernet/stmicro/stmmac/enh_desc.c +7
-13@@ -12,8 +12,7 @@#include "common.h" #include "descs_com.h" -static int enh_desc_get_tx_status (struct net_device_stats *stats, -struct stmmac_extra_stats *x, +static int enh_desc_get_tx_status (struct stmmac_extra_stats *x,struct dma_desc *p,void __iomem *ioaddr) {unsigned int tdes0 =le32_to_cpu (p->des0);@@ -38,15 +37,13 @@ static int enh_desc_get_tx_status(struct net_device_stats *stats,if (unlikely (tdes0 &ETDES0_LOSS_CARRIER )) { x->tx_losscarrier++; - stats->tx_carrier_errors++; }if (unlikely (tdes0 &ETDES0_NO_CARRIER )) { x->tx_carrier++; - stats->tx_carrier_errors++; }if (unlikely ((tdes0 &ETDES0_LATE_COLLISION ) || (tdes0 &ETDES0_EXCESSIVE_COLLISIONS ))) - stats->collisions += + x->tx_collision += (tdes0 &ETDES0_COLLISION_COUNT_MASK ) >>3 ;if (unlikely (tdes0 &ETDES0_EXCESSIVE_DEFERRAL ))@@ -117,8 +114,7 @@ static int enh_desc_coe_rdes0(int ipc_err, int type, int payload_err)return ret; } -static void enh_desc_get_ext_status (struct net_device_stats *stats, -struct stmmac_extra_stats *x, +static void enh_desc_get_ext_status (struct stmmac_extra_stats *x,struct dma_extended_desc *p) {unsigned int rdes0 =le32_to_cpu (p->basic.des0);@@ -182,8 +178,7 @@ static void enh_desc_get_ext_status(struct net_device_stats *stats, } } -static int enh_desc_get_rx_status (struct net_device_stats *stats, -struct stmmac_extra_stats *x, +static int enh_desc_get_rx_status (struct stmmac_extra_stats *x,struct dma_desc *p) {unsigned int rdes0 =le32_to_cpu (p->des0);@@ -193,14 +188,14 @@ static int enh_desc_get_rx_status(struct net_device_stats *stats,return dma_own;if (unlikely (!(rdes0 &RDES0_LAST_DESCRIPTOR ))) { - stats->rx_length_errors++; + x->rx_length++;return discard_frame; }if (unlikely (rdes0 &RDES0_ERROR_SUMMARY )) {if (unlikely (rdes0 &RDES0_DESCRIPTOR_ERROR )) { x->rx_desc++; - stats->rx_length_errors++; + x->rx_length++; }if (unlikely (rdes0 &RDES0_OVERFLOW_ERROR )) x->rx_gmac_overflow++;@@ -209,7 +204,7 @@ static int enh_desc_get_rx_status(struct net_device_stats *stats,pr_err ("\tIPC Csum Error/Giant frame\n" );if (unlikely (rdes0 &RDES0_COLLISION )) - stats->collisions++; + x->rx_collision++;if (unlikely (rdes0 &RDES0_RECEIVE_WATCHDOG )) x->rx_watchdog++;@@ -218,7 +213,6 @@ static int enh_desc_get_rx_status(struct net_device_stats *stats,if (unlikely (rdes0 &RDES0_CRC_ERROR )) { x->rx_crc_errors++; - stats->rx_crc_errors++; } ret = discard_frame; }drivers/net/ethernet/stmicro/stmmac/hwif.h +4
-8@@ -57,8 +57,7 @@ struct stmmac_desc_ops {/* Last tx segment reports the transmit status */ int (*get_tx_ls)(struct dma_desc *p);/* Return the transmit status looking at the TDES1 */ -int (*tx_status)(struct net_device_stats *stats, -struct stmmac_extra_stats *x, +int (*tx_status)(struct stmmac_extra_stats *x,struct dma_desc *p,void __iomem *ioaddr);/* Get the buffer size from the descriptor */ int (*get_tx_len)(struct dma_desc *p);@@ -67,11 +66,9 @@ struct stmmac_desc_ops {/* Get the receive frame size */ int (*get_rx_frame_len)(struct dma_desc *p,int rx_coe_type);/* Return the reception status looking at the RDES1 */ -int (*rx_status)(struct net_device_stats *stats, -struct stmmac_extra_stats *x, +int (*rx_status)(struct stmmac_extra_stats *x,struct dma_desc *p); -void (*rx_extended_status)(struct net_device_stats *stats, -struct stmmac_extra_stats *x, +void (*rx_extended_status)(struct stmmac_extra_stats *x,struct dma_extended_desc *p);/* Set tx timestamp enable bit */ void (*enable_tx_timestamp) (struct dma_desc *p);@@ -191,8 +188,7 @@ struct stmmac_dma_ops {void (*dma_tx_mode)(struct stmmac_priv *priv,void __iomem *ioaddr,int mode,u32 channel,int fifosz,u8 qmode);/* To track extra statistic (if supported) */ -void (*dma_diagnostic_fr)(struct net_device_stats *stats, -struct stmmac_extra_stats *x, +void (*dma_diagnostic_fr)(struct stmmac_extra_stats *x,void __iomem *ioaddr);void (*enable_dma_transmission) (void __iomem *ioaddr); void (*enable_dma_irq)(struct stmmac_priv *priv, void __iomem *ioaddr,drivers/net/ethernet/stmicro/stmmac/norm_desc.c +4
-11@@ -12,8 +12,7 @@#include "common.h" #include "descs_com.h" -static int ndesc_get_tx_status (struct net_device_stats *stats, -struct stmmac_extra_stats *x, +static int ndesc_get_tx_status (struct stmmac_extra_stats *x,struct dma_desc *p,void __iomem *ioaddr) {unsigned int tdes0 =le32_to_cpu (p->des0);@@ -31,15 +30,12 @@ static int ndesc_get_tx_status(struct net_device_stats *stats,if (unlikely (tdes0 &TDES0_ERROR_SUMMARY )) {if (unlikely (tdes0 &TDES0_UNDERFLOW_ERROR )) { x->tx_underflow++; - stats->tx_fifo_errors++; }if (unlikely (tdes0 &TDES0_NO_CARRIER )) { x->tx_carrier++; - stats->tx_carrier_errors++; }if (unlikely (tdes0 &TDES0_LOSS_CARRIER )) { x->tx_losscarrier++; - stats->tx_carrier_errors++; } if (unlikely((tdes0 & TDES0_EXCESSIVE_DEFERRAL) || (tdes0 & TDES0_EXCESSIVE_COLLISIONS) ||@@ -47,7 +43,7 @@ static int ndesc_get_tx_status(struct net_device_stats *stats,unsigned int collisions; collisions = (tdes0 &TDES0_COLLISION_COUNT_MASK ) >>3 ; - stats->collisions += collisions; + x->tx_collision += collisions; } ret = tx_err; }@@ -70,8 +66,7 @@ static int ndesc_get_tx_len(struct dma_desc *p)* and, if required, updates the multicast statistics. * In case of success, it returns good_frame because the GMAC device * is supposed to be able to compute the csum in HW. */ -static int ndesc_get_rx_status (struct net_device_stats *stats, -struct stmmac_extra_stats *x, +static int ndesc_get_rx_status (struct stmmac_extra_stats *x,struct dma_desc *p) {int ret = good_frame;@@ -81,7 +76,7 @@ static int ndesc_get_rx_status(struct net_device_stats *stats,return dma_own;if (unlikely (!(rdes0 &RDES0_LAST_DESCRIPTOR ))) { - stats->rx_length_errors++; + x->rx_length++;return discard_frame; }@@ -96,11 +91,9 @@ static int ndesc_get_rx_status(struct net_device_stats *stats, x->ipc_csum_error++;if (unlikely (rdes0 &RDES0_COLLISION )) { x->rx_collision++; - stats->collisions++; }if (unlikely (rdes0 &RDES0_CRC_ERROR )) { x->rx_crc_errors++; - stats->rx_crc_errors++; } ret = discard_frame; }drivers/net/ethernet/stmicro/stmmac/stmmac.h +2
-0@@ -77,6 +77,7 @@ struct stmmac_tx_queue {dma_addr_t dma_tx_phy;dma_addr_t tx_tail_addr;u32 mss; +struct stmmac_txq_stats txq_stats; };struct stmmac_rx_buffer {@@ -121,6 +122,7 @@ struct stmmac_rx_queue {unsigned int len;unsigned int error; } state; +struct stmmac_rxq_stats rxq_stats; };struct stmmac_channel {drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c +98
-25@@ -89,14 +89,6 @@ static const struct stmmac_stats stmmac_gstrings_stats[] = {/* Tx/Rx IRQ Events */ STMMAC_STAT (rx_early_irq),STMMAC_STAT (threshold), -STMMAC_STAT (tx_pkt_n), -STMMAC_STAT (rx_pkt_n), -STMMAC_STAT (normal_irq_n), -STMMAC_STAT (rx_normal_irq_n), -STMMAC_STAT (napi_poll), -STMMAC_STAT (tx_normal_irq_n), -STMMAC_STAT (tx_clean), -STMMAC_STAT (tx_set_ic_bit),STMMAC_STAT (irq_receive_pmt_irq_n),/* MMC info */ STMMAC_STAT(mmc_tx_irq_n),@@ -163,9 +155,6 @@ static const struct stmmac_stats stmmac_gstrings_stats[] = {STMMAC_STAT (mtl_rx_fifo_ctrl_active),STMMAC_STAT (mac_rx_frame_ctrl_fifo),STMMAC_STAT (mac_gmii_rx_proto_engine), -/* TSO */ -STMMAC_STAT (tx_tso_frames), -STMMAC_STAT (tx_tso_nfrags),/* EST */ STMMAC_STAT (mtl_est_cgce), STMMAC_STAT(mtl_est_hlbs),@@ -175,6 +164,23 @@ static const struct stmmac_stats stmmac_gstrings_stats[] = { };#define STMMAC_STATS_LEN ARRAY_SIZE(stmmac_gstrings_stats) +/* statistics collected in queue which will be summed up for all TX or RX +* queues, or summed up for both TX and RX queues(napi_poll, normal_irq_n). +*/ +static const char stmmac_qstats_string[][ETH_GSTRING_LEN ] = { +"rx_pkt_n" , +"rx_normal_irq_n" , +"tx_pkt_n" , +"tx_normal_irq_n" , +"tx_clean" , +"tx_set_ic_bit" , +"tx_tso_frames" , +"tx_tso_nfrags" , +"normal_irq_n" , +"napi_poll" , +}; +#define STMMAC_QSTATS ARRAY_SIZE(stmmac_qstats_string) +/* HW MAC Management counters (if supported) */ #define STMMAC_MMC_STAT (m) \ { #m, sizeof_field(struct stmmac_counters, m), \@@ -535,23 +541,44 @@ static void stmmac_get_per_qstats(struct stmmac_priv *priv, u64 *data) {u32 tx_cnt = priv->plat->tx_queues_to_use;u32 rx_cnt = priv->plat->rx_queues_to_use; +unsigned int start;int q, stat; +u64 *pos;char *p; + pos = data;for (q =0 ; q < tx_cnt; q++) { - p = (char *)priv + offsetof(struct stmmac_priv , - xstats.txq_stats[q].tx_pkt_n); +struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[q]; +struct stmmac_txq_stats snapshot; + + data = pos; +do { + start =u64_stats_fetch_begin (&tx_q->txq_stats.syncp); + snapshot = tx_q->txq_stats; + }while (u64_stats_fetch_retry (&tx_q->txq_stats.syncp, start)); + + p = (char *)&snapshot + offsetof(struct stmmac_txq_stats , tx_pkt_n);for (stat =0 ; stat <STMMAC_TXQ_STATS ; stat++) { - *data++ = (*(unsigned long *)p); - p +=sizeof (unsigned long ); + *data++ += (*(u64 *)p); + p +=sizeof (u64); } } + + pos = data;for (q =0 ; q < rx_cnt; q++) { - p = (char *)priv + offsetof(struct stmmac_priv , - xstats.rxq_stats[q].rx_pkt_n); +struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[q]; +struct stmmac_rxq_stats snapshot; + + data = pos; +do { + start =u64_stats_fetch_begin (&rx_q->rxq_stats.syncp); + snapshot = rx_q->rxq_stats; + }while (u64_stats_fetch_retry (&rx_q->rxq_stats.syncp, start)); + + p = (char *)&snapshot + offsetof(struct stmmac_rxq_stats , rx_pkt_n);for (stat =0 ; stat <STMMAC_RXQ_STATS ; stat++) { - *data++ = (*(unsigned long *)p); - p +=sizeof (unsigned long ); + *data++ += (*(u64 *)p); + p +=sizeof (u64); } } }@@ -562,8 +589,10 @@ static void stmmac_get_ethtool_stats(struct net_device *dev,struct stmmac_priv *priv =netdev_priv (dev);u32 rx_queues_count = priv->plat->rx_queues_to_use;u32 tx_queues_count = priv->plat->tx_queues_to_use; +u64 napi_poll =0 , normal_irq_n =0 ; +int i, j =0 , pos, ret;unsigned long count; -int i, j =0 , ret; +unsigned int start;if (priv->dma_cap.asp) {for (i =0 ; i <STMMAC_SAFETY_FEAT_SIZE ; i++) {@@ -574,8 +603,7 @@ static void stmmac_get_ethtool_stats(struct net_device *dev, }/* Update the DMA HW counters for dwmac10/100 */ - ret =stmmac_dma_diagnostic_fr (priv, &dev->stats, (void *) &priv->xstats, - priv->ioaddr); + ret =stmmac_dma_diagnostic_fr (priv, &priv->xstats, priv->ioaddr);if (ret) {/* If supported, for new GMAC chips expose the MMC counters */ if (priv->dma_cap.rmon) {@@ -606,6 +634,48 @@ static void stmmac_get_ethtool_stats(struct net_device *dev, data[j++] = (stmmac_gstrings_stats[i].sizeof_stat ==sizeof (u64)) ? (*(u64 *)p) : (*(u32 *)p); } + + pos = j; +for (i =0 ; i < rx_queues_count; i++) { +struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[i]; +struct stmmac_rxq_stats snapshot; + + j = pos; +do { + start =u64_stats_fetch_begin (&rx_q->rxq_stats.syncp); + snapshot = rx_q->rxq_stats; + }while (u64_stats_fetch_retry (&rx_q->rxq_stats.syncp, start)); + + data[j++] += snapshot.rx_pkt_n; + data[j++] += snapshot.rx_normal_irq_n; + normal_irq_n += snapshot.rx_normal_irq_n; + napi_poll += snapshot.napi_poll; + } + + pos = j; +for (i =0 ; i < tx_queues_count; i++) { +struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[i]; +struct stmmac_txq_stats snapshot; + + j = pos; +do { + start =u64_stats_fetch_begin (&tx_q->txq_stats.syncp); + snapshot = tx_q->txq_stats; + }while (u64_stats_fetch_retry (&tx_q->txq_stats.syncp, start)); + + data[j++] += snapshot.tx_pkt_n; + data[j++] += snapshot.tx_normal_irq_n; + normal_irq_n += snapshot.tx_normal_irq_n; + data[j++] += snapshot.tx_clean; + data[j++] += snapshot.tx_set_ic_bit; + data[j++] += snapshot.tx_tso_frames; + data[j++] += snapshot.tx_tso_nfrags; + napi_poll += snapshot.napi_poll; + } + normal_irq_n += priv->xstats.rx_early_irq; + data[j++] = normal_irq_n; + data[j++] = napi_poll; +stmmac_get_per_qstats (priv, &data[j]); }@@ -618,7 +688,7 @@ static int stmmac_get_sset_count(struct net_device *netdev, int sset)switch (sset) {case ETH_SS_STATS : - len =STMMAC_STATS_LEN + + len =STMMAC_STATS_LEN +STMMAC_QSTATS +STMMAC_TXQ_STATS * tx_cnt +STMMAC_RXQ_STATS * rx_cnt;@@ -691,8 +761,11 @@ static void stmmac_get_strings(struct net_device *dev, u32 stringset, u8 *data) p +=ETH_GSTRING_LEN ; }for (i =0 ; i <STMMAC_STATS_LEN ; i++) { -memcpy (p, stmmac_gstrings_stats[i].stat_string, -ETH_GSTRING_LEN ); +memcpy (p, stmmac_gstrings_stats[i].stat_string,ETH_GSTRING_LEN ); + p +=ETH_GSTRING_LEN ; + } +for (i =0 ; i <STMMAC_QSTATS ; i++) { +memcpy (p, stmmac_qstats_string[i],ETH_GSTRING_LEN ); p +=ETH_GSTRING_LEN ; }stmmac_get_qstats_string (priv, p);drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +156
-44@@ -2432,6 +2432,8 @@ static bool stmmac_xdp_xmit_zc(struct stmmac_priv *priv, u32 queue, u32 budget)struct dma_desc *tx_desc =NULL ;struct xdp_desc xdp_desc;bool work_done = true; +u32 tx_set_ic_bit =0 ; +unsigned long flags;/* Avoids TX time-out as we are sharing with slow path */ txq_trans_cond_update (nq);@@ -2492,7 +2494,7 @@ static bool stmmac_xdp_xmit_zc(struct stmmac_priv *priv, u32 queue, u32 budget)if (set_ic) { tx_q->tx_count_frames =0 ;stmmac_set_tx_ic (priv, tx_desc); - priv->xstats.tx_set_ic_bit++; + tx_set_ic_bit++; } stmmac_prepare_tx_desc(priv, tx_desc, 1, xdp_desc.len,@@ -2504,6 +2506,9 @@ static bool stmmac_xdp_xmit_zc(struct stmmac_priv *priv, u32 queue, u32 budget) tx_q->cur_tx =STMMAC_GET_ENTRY (tx_q->cur_tx, priv->dma_conf.dma_tx_size); entry = tx_q->cur_tx; } + flags =u64_stats_update_begin_irqsave (&tx_q->txq_stats.syncp); + tx_q->txq_stats.tx_set_ic_bit += tx_set_ic_bit; +u64_stats_update_end_irqrestore (&tx_q->txq_stats.syncp, flags);if (tx_desc) {stmmac_flush_tx_descriptors (priv, queue);@@ -2545,11 +2550,11 @@ static int stmmac_tx_clean(struct stmmac_priv *priv, int budget, u32 queue)struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];unsigned int bytes_compl =0 , pkts_compl =0 ;unsigned int entry, xmits =0 , count =0 ; +u32 tx_packets =0 , tx_errors =0 ; +unsigned long flags;__netif_tx_lock_bh (netdev_get_tx_queue (priv->dev, queue)); - priv->xstats.tx_clean++; - tx_q->xsk_frames_done =0 ; entry = tx_q->dirty_tx;@@ -2580,8 +2585,7 @@ static int stmmac_tx_clean(struct stmmac_priv *priv, int budget, u32 queue)else p = tx_q->dma_tx + entry; - status =stmmac_tx_status (priv, &priv->dev->stats, - &priv->xstats, p, priv->ioaddr); + status =stmmac_tx_status (priv, &priv->xstats, p, priv->ioaddr);/* Check if the descriptor is owned by the DMA */ if (unlikely (status & tx_dma_own))break ;@@ -2597,13 +2601,11 @@ static int stmmac_tx_clean(struct stmmac_priv *priv, int budget, u32 queue)if (likely (!(status & tx_not_ls))) {/* ... verify the status error condition */ if (unlikely (status & tx_err)) { - priv->dev->stats.tx_errors++; + tx_errors++;if (unlikely (status & tx_err_bump_tc))stmmac_bump_dma_threshold (priv, queue); }else { - priv->dev->stats.tx_packets++; - priv->xstats.tx_pkt_n++; - priv->xstats.txq_stats[queue].tx_pkt_n++; + tx_packets++; }if (skb)stmmac_get_tx_hwtstamp (priv, p, skb);@@ -2705,6 +2707,14 @@ static int stmmac_tx_clean(struct stmmac_priv *priv, int budget, u32 queue)if (tx_q->dirty_tx != tx_q->cur_tx)stmmac_tx_timer_arm (priv, queue); + flags =u64_stats_update_begin_irqsave (&tx_q->txq_stats.syncp); + tx_q->txq_stats.tx_packets += tx_packets; + tx_q->txq_stats.tx_pkt_n += tx_packets; + tx_q->txq_stats.tx_clean++; +u64_stats_update_end_irqrestore (&tx_q->txq_stats.syncp, flags); + + priv->xstats.tx_errors += tx_errors; +__netif_tx_unlock_bh (netdev_get_tx_queue (priv->dev, queue));/* Combine decisions from TX clean and XSK TX */ @@ -2732,7 +2742,7 @@ static void stmmac_tx_err(struct stmmac_priv *priv, u32 chan) tx_q->dma_tx_phy, chan);stmmac_start_tx_dma (priv, chan); - priv->dev->stats.tx_errors++; + priv->xstats.tx_errors++;netif_tx_wake_queue (netdev_get_tx_queue (priv->dev, chan)); }@@ -4112,6 +4122,7 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)struct stmmac_tx_queue *tx_q;bool has_vlan, set_ic;u8 proto_hdr_len, hdr; +unsigned long flags;u32 pay_len, mss;dma_addr_t des;int i;@@ -4260,7 +4271,6 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev) tx_q->tx_count_frames =0 ;stmmac_set_tx_ic (priv, desc); - priv->xstats.tx_set_ic_bit++; }/* We've used all descriptors we need for this skb, however, @@ -4276,9 +4286,13 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev)netif_tx_stop_queue (netdev_get_tx_queue (priv->dev, queue)); } - dev->stats.tx_bytes += skb->len; - priv->xstats.tx_tso_frames++; - priv->xstats.tx_tso_nfrags += nfrags; + flags =u64_stats_update_begin_irqsave (&tx_q->txq_stats.syncp); + tx_q->txq_stats.tx_bytes += skb->len; + tx_q->txq_stats.tx_tso_frames++; + tx_q->txq_stats.tx_tso_nfrags += nfrags; +if (set_ic) + tx_q->txq_stats.tx_set_ic_bit++; +u64_stats_update_end_irqrestore (&tx_q->txq_stats.syncp, flags);if (priv->sarc_type)stmmac_set_desc_sarc (priv, first, priv->sarc_type);@@ -4328,7 +4342,7 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev) dma_map_err:dev_err (priv->device,"Tx dma map failed\n" );dev_kfree_skb (skb); - priv->dev->stats.tx_dropped++; + priv->xstats.tx_dropped++;return NETDEV_TX_OK ; }@@ -4354,6 +4368,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)struct stmmac_tx_queue *tx_q;bool has_vlan, set_ic;int entry, first_tx; +unsigned long flags;dma_addr_t des; tx_q = &priv->dma_conf.tx_queue[queue];@@ -4482,7 +4497,6 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev) tx_q->tx_count_frames =0 ;stmmac_set_tx_ic (priv, desc); - priv->xstats.tx_set_ic_bit++; }/* We've used all descriptors we need for this skb, however, @@ -4509,7 +4523,11 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)netif_tx_stop_queue (netdev_get_tx_queue (priv->dev, queue)); } - dev->stats.tx_bytes += skb->len; + flags =u64_stats_update_begin_irqsave (&tx_q->txq_stats.syncp); + tx_q->txq_stats.tx_bytes += skb->len; +if (set_ic) + tx_q->txq_stats.tx_set_ic_bit++; +u64_stats_update_end_irqrestore (&tx_q->txq_stats.syncp, flags);if (priv->sarc_type)stmmac_set_desc_sarc (priv, first, priv->sarc_type);@@ -4571,7 +4589,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev) dma_map_err:netdev_err (priv->dev,"Tx DMA map failed\n" );dev_kfree_skb (skb); - priv->dev->stats.tx_dropped++; + priv->xstats.tx_dropped++;return NETDEV_TX_OK ; }@@ -4772,9 +4790,12 @@ static int stmmac_xdp_xmit_xdpf(struct stmmac_priv *priv, int queue, set_ic = false;if (set_ic) { +unsigned long flags; tx_q->tx_count_frames =0 ;stmmac_set_tx_ic (priv, tx_desc); - priv->xstats.tx_set_ic_bit++; + flags =u64_stats_update_begin_irqsave (&tx_q->txq_stats.syncp); + tx_q->txq_stats.tx_set_ic_bit++; +u64_stats_update_end_irqrestore (&tx_q->txq_stats.syncp, flags); }stmmac_enable_dma_transmission (priv, priv->ioaddr);@@ -4919,16 +4940,18 @@ static void stmmac_dispatch_skb_zc(struct stmmac_priv *priv, u32 queue, struct dma_desc *p, struct dma_desc *np, struct xdp_buff *xdp) { + struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];struct stmmac_channel *ch = &priv->channel[queue];unsigned int len = xdp->data_end - xdp->data;enum pkt_hash_types hash_type;int coe = priv->hw->rx_csum; +unsigned long flags;struct sk_buff *skb;u32 hash; skb =stmmac_construct_skb_zc (ch, xdp);if (!skb) { - priv->dev->stats.rx_dropped++; + priv->xstats.rx_dropped++;return ; }@@ -4947,8 +4970,10 @@ static void stmmac_dispatch_skb_zc(struct stmmac_priv *priv, u32 queue,skb_record_rx_queue (skb, queue);napi_gro_receive (&ch->rxtx_napi, skb); - priv->dev->stats.rx_packets++; - priv->dev->stats.rx_bytes += len; + flags =u64_stats_update_begin_irqsave (&rx_q->rxq_stats.syncp); + rx_q->rxq_stats.rx_pkt_n++; + rx_q->rxq_stats.rx_bytes += len; +u64_stats_update_end_irqrestore (&rx_q->rxq_stats.syncp, flags); }static bool stmmac_rx_refill_zc (struct stmmac_priv *priv,u32 queue,u32 budget)@@ -5025,9 +5050,11 @@ static int stmmac_rx_zc(struct stmmac_priv *priv, int limit, u32 queue)unsigned int count =0 , error =0 , len =0 ;int dirty =stmmac_rx_dirty (priv, queue);unsigned int next_entry = rx_q->cur_rx; +u32 rx_errors =0 , rx_dropped =0 ;unsigned int desc_size;struct bpf_prog *prog;bool failure = false; +unsigned long flags;int xdp_status =0 ;int status =0 ;@@ -5083,8 +5110,7 @@ static int stmmac_rx_zc(struct stmmac_priv *priv, int limit, u32 queue) p = rx_q->dma_rx + entry;/* read the status of the incoming frame */ - status =stmmac_rx_status (priv, &priv->dev->stats, - &priv->xstats, p); + status =stmmac_rx_status (priv, &priv->xstats, p);/* check if managed by the DMA otherwise go ahead */ if (unlikely (status & dma_own))break ;@@ -5106,8 +5132,7 @@ static int stmmac_rx_zc(struct stmmac_priv *priv, int limit, u32 queue)break ;if (priv->extend_desc) -stmmac_rx_extended_status (priv, &priv->dev->stats, - &priv->xstats, +stmmac_rx_extended_status (priv, &priv->xstats, rx_q->dma_erx + entry);if (unlikely (status == discard_frame)) {xsk_buff_free (buf->xdp);@@ -5115,7 +5140,7 @@ static int stmmac_rx_zc(struct stmmac_priv *priv, int limit, u32 queue) dirty++; error =1 ;if (!priv->hwts_rx_en) - priv->dev->stats.rx_errors++; + rx_errors++; }if (unlikely (error && (status & rx_not_ls)))@@ -5163,7 +5188,7 @@ static int stmmac_rx_zc(struct stmmac_priv *priv, int limit, u32 queue)break ;case STMMAC_XDP_CONSUMED :xsk_buff_free (buf->xdp); - priv->dev->stats.rx_dropped++; + rx_dropped++;break ;case STMMAC_XDP_TX :case STMMAC_XDP_REDIRECT :@@ -5184,8 +5209,12 @@ static int stmmac_rx_zc(struct stmmac_priv *priv, int limit, u32 queue)stmmac_finalize_xdp_rx (priv, xdp_status); - priv->xstats.rx_pkt_n += count; - priv->xstats.rxq_stats[queue].rx_pkt_n += count; + flags =u64_stats_update_begin_irqsave (&rx_q->rxq_stats.syncp); + rx_q->rxq_stats.rx_pkt_n += count; +u64_stats_update_end_irqrestore (&rx_q->rxq_stats.syncp, flags); + + priv->xstats.rx_dropped += rx_dropped; + priv->xstats.rx_errors += rx_errors;if (xsk_uses_need_wakeup (rx_q->xsk_pool)) {if (failure ||stmmac_rx_dirty (priv, queue) >0 )@@ -5209,6 +5238,7 @@ static int stmmac_rx_zc(struct stmmac_priv *priv, int limit, u32 queue)*/ static int stmmac_rx (struct stmmac_priv *priv,int limit,u32 queue) { +u32 rx_errors =0 , rx_dropped =0 , rx_bytes =0 , rx_packets =0 ;struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];struct stmmac_channel *ch = &priv->channel[queue];unsigned int count =0 , error =0 , len =0 ;@@ -5218,6 +5248,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)unsigned int desc_size;struct sk_buff *skb =NULL ;struct stmmac_xdp_buff ctx; +unsigned long flags;int xdp_status =0 ;int buf_sz;@@ -5273,8 +5304,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue) p = rx_q->dma_rx + entry;/* read the status of the incoming frame */ - status =stmmac_rx_status (priv, &priv->dev->stats, - &priv->xstats, p); + status =stmmac_rx_status (priv, &priv->xstats, p);/* check if managed by the DMA otherwise go ahead */ if (unlikely (status & dma_own))break ;@@ -5291,14 +5321,13 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)prefetch (np);if (priv->extend_desc) -stmmac_rx_extended_status (priv, &priv->dev->stats, - &priv->xstats, rx_q->dma_erx + entry); +stmmac_rx_extended_status (priv, &priv->xstats, rx_q->dma_erx + entry);if (unlikely (status == discard_frame)) {page_pool_recycle_direct (rx_q->page_pool, buf->page); buf->page =NULL ; error =1 ;if (!priv->hwts_rx_en) - priv->dev->stats.rx_errors++; + rx_errors++; }if (unlikely (error && (status & rx_not_ls)))@@ -5366,7 +5395,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)virt_to_head_page (ctx.xdp.data), sync_len, true); buf->page =NULL ; - priv->dev->stats.rx_dropped++; + rx_dropped++;/* Clear skb as it was set as * status by XDP program. @@ -5395,7 +5424,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue) skb =napi_alloc_skb (&ch->rx_napi, buf1_len);if (!skb) { - priv->dev->stats.rx_dropped++; + rx_dropped++; count++; goto drain_data; }@@ -5455,8 +5484,8 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)napi_gro_receive (&ch->rx_napi, skb); skb =NULL ; - priv->dev->stats.rx_packets++; - priv->dev->stats.rx_bytes += len; + rx_packets++; + rx_bytes += len; count++; }@@ -5471,8 +5500,14 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)stmmac_rx_refill (priv, queue); - priv->xstats.rx_pkt_n += count; - priv->xstats.rxq_stats[queue].rx_pkt_n += count; + flags =u64_stats_update_begin_irqsave (&rx_q->rxq_stats.syncp); + rx_q->rxq_stats.rx_packets += rx_packets; + rx_q->rxq_stats.rx_bytes += rx_bytes; + rx_q->rxq_stats.rx_pkt_n += count; +u64_stats_update_end_irqrestore (&rx_q->rxq_stats.syncp, flags); + + priv->xstats.rx_dropped += rx_dropped; + priv->xstats.rx_errors += rx_errors;return count; }@@ -5482,10 +5517,15 @@ static int stmmac_napi_poll_rx(struct napi_struct *napi, int budget)struct stmmac_channel *ch = container_of(napi, struct stmmac_channel, rx_napi);struct stmmac_priv *priv = ch->priv_data; +struct stmmac_rx_queue *rx_q;u32 chan = ch->index; +unsigned long flags;int work_done; - priv->xstats.napi_poll++; + rx_q = &priv->dma_conf.rx_queue[chan]; + flags =u64_stats_update_begin_irqsave (&rx_q->rxq_stats.syncp); + rx_q->rxq_stats.napi_poll++; +u64_stats_update_end_irqrestore (&rx_q->rxq_stats.syncp, flags); work_done =stmmac_rx (priv, budget, chan);if (work_done < budget &&napi_complete_done (napi, work_done)) {@@ -5504,10 +5544,15 @@ static int stmmac_napi_poll_tx(struct napi_struct *napi, int budget)struct stmmac_channel *ch = container_of(napi, struct stmmac_channel, tx_napi);struct stmmac_priv *priv = ch->priv_data; +struct stmmac_tx_queue *tx_q;u32 chan = ch->index; +unsigned long flags;int work_done; - priv->xstats.napi_poll++; + tx_q = &priv->dma_conf.tx_queue[chan]; + flags =u64_stats_update_begin_irqsave (&tx_q->txq_stats.syncp); + tx_q->txq_stats.napi_poll++; +u64_stats_update_end_irqrestore (&tx_q->txq_stats.syncp, flags); work_done =stmmac_tx_clean (priv, budget, chan); work_done =min (work_done, budget);@@ -5529,9 +5574,20 @@ static int stmmac_napi_poll_rxtx(struct napi_struct *napi, int budget) container_of(napi, struct stmmac_channel, rxtx_napi);struct stmmac_priv *priv = ch->priv_data;int rx_done, tx_done, rxtx_done; +struct stmmac_rx_queue *rx_q; +struct stmmac_tx_queue *tx_q;u32 chan = ch->index; +unsigned long flags; + + rx_q = &priv->dma_conf.rx_queue[chan]; + flags =u64_stats_update_begin_irqsave (&rx_q->rxq_stats.syncp); + rx_q->rxq_stats.napi_poll++; +u64_stats_update_end_irqrestore (&rx_q->rxq_stats.syncp, flags); - priv->xstats.napi_poll++; + tx_q = &priv->dma_conf.tx_queue[chan]; + flags =u64_stats_update_begin_irqsave (&tx_q->txq_stats.syncp); + tx_q->txq_stats.napi_poll++; +u64_stats_update_end_irqrestore (&tx_q->txq_stats.syncp, flags); tx_done =stmmac_tx_clean (priv, budget, chan); tx_done =min (tx_done, budget);@@ -6790,6 +6846,56 @@ int stmmac_xsk_wakeup(struct net_device *dev, u32 queue, u32 flags)return 0 ; } +static void stmmac_get_stats64 (struct net_device *dev,struct rtnl_link_stats64 *stats) +{ +struct stmmac_priv *priv =netdev_priv (dev); +u32 tx_cnt = priv->plat->tx_queues_to_use; +u32 rx_cnt = priv->plat->rx_queues_to_use; +unsigned int start; +int q; + +for (q =0 ; q < tx_cnt; q++) { +struct stmmac_txq_stats *txq_stats = &priv->dma_conf.tx_queue[q].txq_stats; +u64 tx_packets; +u64 tx_bytes; + +do { + start =u64_stats_fetch_begin (&txq_stats->syncp); + tx_packets = txq_stats->tx_packets; + tx_bytes = txq_stats->tx_bytes; + }while (u64_stats_fetch_retry (&txq_stats->syncp, start)); + + stats->tx_packets += tx_packets; + stats->tx_bytes += tx_bytes; + } + +for (q =0 ; q < rx_cnt; q++) { +struct stmmac_rxq_stats *rxq_stats = &priv->dma_conf.rx_queue[q].rxq_stats; +u64 rx_packets; +u64 rx_bytes; + +do { + start =u64_stats_fetch_begin (&rxq_stats->syncp); + rx_packets = rxq_stats->rx_packets; + rx_bytes = rxq_stats->rx_bytes; + }while (u64_stats_fetch_retry (&rxq_stats->syncp, start)); + + stats->rx_packets += rx_packets; + stats->rx_bytes += rx_bytes; + } + + stats->rx_dropped = priv->xstats.rx_dropped; + stats->rx_errors = priv->xstats.rx_errors; + stats->tx_dropped = priv->xstats.tx_dropped; + stats->tx_errors = priv->xstats.tx_errors; + stats->tx_carrier_errors = priv->xstats.tx_losscarrier + priv->xstats.tx_carrier; + stats->collisions = priv->xstats.tx_collision + priv->xstats.rx_collision; + stats->rx_length_errors = priv->xstats.rx_length; + stats->rx_crc_errors = priv->xstats.rx_crc_errors; + stats->rx_over_errors = priv->xstats.rx_overflow_cntr; + stats->rx_missed_errors = priv->xstats.rx_missed_cntr; +} +static const struct net_device_ops stmmac_netdev_ops = { .ndo_open = stmmac_open, .ndo_start_xmit = stmmac_xmit,@@ -6800,6 +6906,7 @@ static const struct net_device_ops stmmac_netdev_ops = { .ndo_set_rx_mode = stmmac_set_rx_mode, .ndo_tx_timeout = stmmac_tx_timeout, .ndo_eth_ioctl = stmmac_ioctl, + .ndo_get_stats64 = stmmac_get_stats64, .ndo_setup_tc = stmmac_setup_tc, .ndo_select_queue = stmmac_select_queue,#ifdef CONFIG_NET_POLL_CONTROLLER @@ -7162,6 +7269,11 @@ int stmmac_dvr_probe(struct device *device, priv->device = device; priv->dev = ndev; +for (i =0 ; i <MTL_MAX_RX_QUEUES ; i++) +u64_stats_init (&priv->dma_conf.rx_queue[i].rxq_stats.syncp); +for (i =0 ; i <MTL_MAX_TX_QUEUES ; i++) +u64_stats_init (&priv->dma_conf.tx_queue[i].txq_stats.syncp); +stmmac_set_ethtool_ops (ndev); priv->pause = pause; priv->plat = plat_dat;
Greg Kroah-Hartman
maintainerRe: [PATCH 6.5 025/211] net: stmmac: use per-queue 64 bit statistics where necessary
Quoted 15 lines · Thorsten Leemhuis
Quoted 7 lines · Greg Kroah-Hartman
6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jisheng Zhang <[email protected]>
[ Upstream commit
133466c3bbe171f826294161db203f7670bb30c8]This patch causes a regression in mainline:
https://lore.kernel.org/all/[email protected]/A fix is heading towards mainline now:
https://lore.kernel.org/all/[email protected]/
Quoted 7 lines
Jisheng Zhang already mentioned this and also mentioned that the change depends on another commit not yet backported:
https://lore.kernel.org/all/ZQHKiU6SNtq7t1Fi@xhacker/Something feels wrong here; not sure if it is or if I'm missing something.
Ciao, Thorsten (who only noticed this by chance)
Thanks, I've dropped this now from the 6.5.y queue.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 26/211 ice: Dont tx before switchdev is fully configured
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wojciech Drewek <[email protected]>
[ Upstream commit 7aa529a69e92b9aff585e569d5003f7c15d8d60b ]
There is possibility that ice_eswitch_port_start_xmit might be called while some resources are still not allocated which might cause NULL pointer dereference. Fix this by checking if switchdev configuration was finished.
--- drivers/net/ethernet/intel/ice/ice_eswitch.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/intel/ice/ice_eswitch.c +3 -0
@@ -331,6 +331,9 @@ ice_eswitch_port_start_xmit(struct sk_buff *skb, struct net_device *netdev) np =netdev_priv (netdev); vsi = np->vsi; +if (!vsi || !ice_is_switchdev_running (vsi->back)) +return NETDEV_TX_BUSY ; +if (ice_is_reset_in_progress (vsi->back->state) ||test_bit (ICE_VF_DIS , vsi->back->state))return NETDEV_TX_BUSY ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 27/211 wifi: ath9k: fix fortify warnings
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 810e41cebb6c6e394f2068f839e1a3fc745a5dcc ]
When compiling with gcc 13.1 and CONFIG_FORTIFY_SOURCE=y, I've noticed the following:
In function ‘fortify_memcpy_chk’,
inlined from ‘ath_tx_complete_aggr’ at drivers/net/wireless/ath/ath9k/xmit.c:556:4, inlined from ‘ath_tx_process_buffer’ at drivers/net/wireless/ath/ath9k/xmit.c:773:3:./include/linux/fortify-string.h:529:25: warning: call to ‘__read_overflow2_field’ declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Wattribute-warning]
529 | __read_overflow2_field(q_size_field, size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~In function ‘fortify_memcpy_chk’,
inlined from ‘ath_tx_count_frames’ at drivers/net/wireless/ath/ath9k/xmit.c:473:3, inlined from ‘ath_tx_complete_aggr’ at drivers/net/wireless/ath/ath9k/xmit.c:572:2, inlined from ‘ath_tx_process_buffer’ at drivers/net/wireless/ath/ath9k/xmit.c:773:3:./include/linux/fortify-string.h:529:25: warning: call to ‘__read_overflow2_field’ declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Wattribute-warning]
529 | __read_overflow2_field(q_size_field, size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~In both cases, the compiler complains on:
memcpy(ba, &ts->ba_low, WME_BA_BMP_SIZE >> 3);
which is the legal way to copy both 'ba_low' and following 'ba_high' members of 'struct ath_tx_status' at once (that is, issue one 8-byte 'memcpy()' for two 4-byte fields). Since the fortification logic seems interprets this trick as an attempt to overread 4-byte 'ba_low', silence relevant warnings by using the convenient 'struct_group()' quirk.
--- drivers/net/wireless/ath/ath9k/mac.h | 6 ++++-- drivers/net/wireless/ath/ath9k/xmit.c | 4 ++-- 2 files changed, 6 insertions(+), 4 deletions(-)
drivers/net/wireless/ath/ath9k/mac.h +4 -2
@@ -115,8 +115,10 @@ struct ath_tx_status {u8 qid;u16 desc_id;u8 tid; -u32 ba_low; -u32 ba_high; +struct_group (ba, + u32 ba_low; + u32 ba_high; + );u32 evm0;u32 evm1;u32 evm2;
drivers/net/wireless/ath/ath9k/xmit.c +2 -2
@@ -468,7 +468,7 @@ static void ath_tx_count_frames(struct ath_softc *sc, struct ath_buf *bf, isaggr =bf_isaggr (bf);if (isaggr) { seq_st = ts->ts_seqnum; -memcpy (ba, &ts->ba_low,WME_BA_BMP_SIZE >>3 ); +memcpy (ba, &ts->ba,WME_BA_BMP_SIZE >>3 ); }while (bf) {
@@ -551,7 +551,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,if (isaggr && txok) {if (ts->ts_flags &ATH9K_TX_BA ) { seq_st = ts->ts_seqnum; -memcpy (ba, &ts->ba_low,WME_BA_BMP_SIZE >>3 ); +memcpy (ba, &ts->ba,WME_BA_BMP_SIZE >>3 ); }else {/* * AR5416 can become deaf/mute when BA
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 28/211 wifi: ath9k: fix printk specifier
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dongliang Mu <[email protected]>
[ Upstream commit 061115fbfb2ce5870c9a004d68dc63138c07c782 ]
Smatch reports:
ath_pci_probe() warn: argument 4 to %lx specifier is cast from pointer ath_ahb_probe() warn: argument 4 to %lx specifier is cast from pointer
Fix it by modifying %lx to %p in the printk format string.
Note that with this change, the pointer address will be printed as a hashed value by default. This is appropriate because the kernel should not leak kernel pointers to user space in an informational message. If someone wants to see the real address for debugging purposes, this can be achieved with the no_hash_pointers kernel option.
--- drivers/net/wireless/ath/ath9k/ahb.c | 4 ++-- drivers/net/wireless/ath/ath9k/pci.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/net/wireless/ath/ath9k/ahb.c +2 -2
@@ -132,8 +132,8 @@ static int ath_ahb_probe(struct platform_device *pdev) ah = sc->sc_ah;ath9k_hw_name (ah, hw_name,sizeof (hw_name)); -wiphy_info (hw->wiphy,"%s mem=0x%lx, irq=%d\n" , - hw_name, (unsigned long )mem, irq); +wiphy_info (hw->wiphy,"%s mem=0x%p, irq=%d\n" , + hw_name, mem, irq);return 0 ;
drivers/net/wireless/ath/ath9k/pci.c +2 -2
@@ -988,8 +988,8 @@ static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) sc->sc_ah->msi_reg =0 ;ath9k_hw_name (sc->sc_ah, hw_name,sizeof (hw_name)); -wiphy_info (hw->wiphy,"%s mem=0x%lx, irq=%d\n" , - hw_name, (unsigned long )sc->mem, pdev->irq); +wiphy_info (hw->wiphy,"%s mem=0x%p, irq=%d\n" , + hw_name, sc->mem, pdev->irq);return 0 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 29/211 wifi: rtw88: delete timer and free skb queue when unloading
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 634fcbcaa4062db39aeb5ac6ed1bc1feb8dd5216 ]
Fix possible crash and memory leak on driver unload by deleting TX purge timer and freeing C2H queue in 'rtw_core_deinit()', shrink critical section in the latter by freeing COEX queue out of TX report lock scope.
--- drivers/net/wireless/realtek/rtw88/main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/realtek/rtw88/main.c +3 -1
@@ -2183,10 +2183,12 @@ void rtw_core_deinit(struct rtw_dev *rtwdev)release_firmware (wow_fw->firmware);destroy_workqueue (rtwdev->tx_wq); +timer_delete_sync (&rtwdev->tx_report.purge_timer);spin_lock_irqsave (&rtwdev->tx_report.q_lock, flags);skb_queue_purge (&rtwdev->tx_report.queue); -skb_queue_purge (&rtwdev->coex.queue);spin_unlock_irqrestore (&rtwdev->tx_report.q_lock, flags); +skb_queue_purge (&rtwdev->coex.queue); +skb_queue_purge (&rtwdev->c2h_queue);list_for_each_entry_safe (rsvd_pkt, tmp, &rtwdev->rsvd_page_list, build_list) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 30/211 wifi: mwifiex: fix fortify warning
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit dcce94b80a954a8968ff29fafcfb066d6197fa9a ]
When compiling with gcc 13.1 and CONFIG_FORTIFY_SOURCE=y, I've noticed the following:
In function ‘fortify_memcpy_chk’,
inlined from ‘mwifiex_construct_tdls_action_frame’ at drivers/net/wireless/marvell/mwifiex/tdls.c:765:3, inlined from ‘mwifiex_send_tdls_action_frame’ at drivers/net/wireless/marvell/mwifiex/tdls.c:856:6:./include/linux/fortify-string.h:529:25: warning: call to ‘__read_overflow2_field’ declared with attribute warning: detected read beyond size of field (2nd parameter);
maybe use struct_group()? [-Wattribute-warning]
529 | __read_overflow2_field(q_size_field, size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~The compiler actually complains on:
memmove(pos + ETH_ALEN, &mgmt->u.action.category,
sizeof(mgmt->u.action.u.tdls_discover_resp));
and it happens because the fortification logic interprets this as an attempt to overread 1-byte 'u.action.category' member of 'struct ieee80211_mgmt'. To silence this warning, it's enough to pass an address of 'u.action' itself instead of an address of its first member.
This also fixes an improper usage of 'sizeof()'. Since 'skb' is extended with 'sizeof(mgmt->u.action.u.tdls_discover_resp) + 1' bytes (where 1 is actually 'sizeof(mgmt->u.action.category)'), I assume that the same number of bytes should be copied.
--- drivers/net/wireless/marvell/mwifiex/tdls.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/net/wireless/marvell/mwifiex/tdls.c +6 -3
@@ -735,6 +735,7 @@ mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv,int ret;u16 capab;struct ieee80211_ht_cap *ht_cap; +unsigned int extra;u8 radio, *pos; capab = priv->curr_bss_params.bss_descriptor.cap_info_bitmap;
@@ -753,7 +754,10 @@ mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv,switch (action_code) {case WLAN_PUB_ACTION_TDLS_DISCOVER_RES : -skb_put (skb,sizeof (mgmt->u.action.u.tdls_discover_resp) +1 ); +/* See the layout of 'struct ieee80211_mgmt'. */ + extra =sizeof (mgmt->u.action.u.tdls_discover_resp) + +sizeof (mgmt->u.action.category); +skb_put (skb, extra); mgmt->u.action.category =WLAN_CATEGORY_PUBLIC ; mgmt->u.action.u.tdls_discover_resp.action_code =WLAN_PUB_ACTION_TDLS_DISCOVER_RES ;
@@ -762,8 +766,7 @@ mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv, mgmt->u.action.u.tdls_discover_resp.capability =cpu_to_le16 (capab);/* move back for addr4 */ -memmove (pos +ETH_ALEN , &mgmt->u.action.category, -sizeof (mgmt->u.action.u.tdls_discover_resp)); +memmove (pos +ETH_ALEN , &mgmt->u.action, extra);/* init address 4 */ eth_broadcast_addr (pos);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 31/211 mt76: mt7921: dont assume adequate headroom for SDIO headers
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Whitlock <[email protected]>
[ Upstream commit 98c4d0abf5c478db1ad126ff0c187dbb84c0803c ]
mt7921_usb_sdio_tx_prepare_skb() calls mt7921_usb_sdio_write_txwi() and mt7921_skb_add_usb_sdio_hdr(), both of which blindly assume that adequate headroom will be available in the passed skb. This assumption typically is satisfied when the skb was allocated in the net core for transmission via the mt7921 netdev (although even that is only an optimization and is not strictly guaranteed), but the assumption is sometimes not satisfied when the skb originated in the receive path of another netdev and was passed through to the mt7921, such as by the bridge layer. Blindly prepending bytes to an skb is always wrong.
This commit introduces a call to skb_cow_head() before the call to mt7921_usb_sdio_write_txwi() in mt7921_usb_sdio_tx_prepare_skb() to ensure that at least MT_SDIO_TXD_SIZE + MT_SDIO_HDR_SIZE bytes can be pushed onto the skb.
Without this fix, I can trivially cause kernel panics by bridging an MT7921AU-based USB 802.11ax interface with an Ethernet interface on an Intel Atom-based x86 system using its onboard RTL8169 PCI Ethernet adapter and also on an ARM-based Raspberry Pi 1 using its onboard SMSC9512 USB Ethernet adapter. Note that the panics do not occur in every system configuration, as they occur only if the receiving netdev leaves less headroom in its received skbs than the mt7921 needs for its SDIO headers.
Here is an example stack trace of this panic on Raspberry Pi OS Lite 2023-02-21 running kernel 6.1.24+ [1]:
skb_panic from skb_push+0x44/0x48
skb_push from mt7921_usb_sdio_tx_prepare_skb+0xd4/0x190 [mt7921_common] mt7921_usb_sdio_tx_prepare_skb [mt7921_common] from mt76u_tx_queue_skb+0x94/0x1d0 [mt76_usb] mt76u_tx_queue_skb [mt76_usb] from __mt76_tx_queue_skb+0x4c/0xc8 [mt76] __mt76_tx_queue_skb [mt76] from mt76_txq_schedule.part.0+0x13c/0x398 [mt76] mt76_txq_schedule.part.0 [mt76] from mt76_txq_schedule_all+0x24/0x30 [mt76] mt76_txq_schedule_all [mt76] from mt7921_tx_worker+0x58/0xf4 [mt7921_common] mt7921_tx_worker [mt7921_common] from __mt76_worker_fn+0x9c/0xec [mt76] __mt76_worker_fn [mt76] from kthread+0xbc/0xe0
kthread from ret_from_fork+0x14/0x34
After this fix, bridging the mt7921 interface works fine on both of my previously problematic systems.
[1] https://github.com/raspberrypi/firmware/tree/5c276f55a4b21345cd4d6200a504ee991851ff7a
--- drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/wireless/mediatek/mt76/mt7921/mac.c +4 -0
@@ -1180,6 +1180,10 @@ int mt7921_usb_sdio_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr,if (unlikely (tx_info->skb->len <=ETH_HLEN ))return -EINVAL ; + err =skb_cow_head (skb,MT_SDIO_TXD_SIZE +MT_SDIO_HDR_SIZE ); +if (err) +return err; +if (!wcid) wcid = &dev->mt76.global_wcid;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 32/211 wifi: wil6210: fix fortify warnings
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 1ad8237e971630c66a1a6194491e0837b64d00e0 ]
When compiling with gcc 13.1 and CONFIG_FORTIFY_SOURCE=y, I've noticed the following:
In function ‘fortify_memcpy_chk’,
inlined from ‘wil_rx_crypto_check_edma’ at drivers/net/wireless/ath/wil6210/txrx_edma.c:566:2:./include/linux/fortify-string.h:529:25: warning: call to ‘__read_overflow2_field’ declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Wattribute-warning]
529 | __read_overflow2_field(q_size_field, size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~where the compiler complains on:
const u8 *pn;
...
pn = (u8 *)&st->ext.pn_15_0;
...memcpy(cc->pn, pn, IEEE80211_GCMP_PN_LEN);
and:
In function ‘fortify_memcpy_chk’,
inlined from ‘wil_rx_crypto_check’ at drivers/net/wireless/ath/wil6210/txrx.c:684:2:./include/linux/fortify-string.h:529:25: warning: call to ‘__read_overflow2_field’ declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Wattribute-warning]
529 | __read_overflow2_field(q_size_field, size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~where the compiler complains on:
const u8 *pn = (u8 *)&d->mac.pn_15_0;
...memcpy(cc->pn, pn, IEEE80211_GCMP_PN_LEN);
In both cases, the fortification logic interprets 'memcpy()' as 6-byte overread of 2-byte field 'pn_15_0' of 'struct wil_rx_status_extension' and 'pn_15_0' of 'struct vring_rx_mac', respectively. To silence these warnings, last two fields of the aforementioned structures are grouped using 'struct_group_attr(pn, __packed' quirk.
--- drivers/net/wireless/ath/wil6210/txrx.c | 2 +- drivers/net/wireless/ath/wil6210/txrx.h | 6 ++++-- drivers/net/wireless/ath/wil6210/txrx_edma.c | 2 +- drivers/net/wireless/ath/wil6210/txrx_edma.h | 6 ++++-- 4 files changed, 10 insertions(+), 6 deletions(-)
drivers/net/wireless/ath/wil6210/txrx.c +1 -1
@@ -666,7 +666,7 @@ static int wil_rx_crypto_check(struct wil6210_priv *wil, struct sk_buff *skb)struct wil_tid_crypto_rx *c = mc ? &s->group_crypto_rx : &s->tid_crypto_rx[tid];struct wil_tid_crypto_rx_single *cc = &c->key_id[key_id]; -const u8 *pn = (u8 *)&d->mac.pn_15_0; +const u8 *pn = (u8 *)&d->mac.pn;if (!cc->key_set) { wil_err_ratelimited(wil,
drivers/net/wireless/ath/wil6210/txrx.h +4 -2
@@ -343,8 +343,10 @@ struct vring_rx_mac {u32 d0;u32 d1;u16 w4; -u16 pn_15_0; -u32 pn_47_16; +struct_group_attr (pn, __packed, + u16 pn_15_0; + u32 pn_47_16; + ); } __packed;/* Rx descriptor - DMA part
drivers/net/wireless/ath/wil6210/txrx_edma.c +1 -1
@@ -548,7 +548,7 @@ static int wil_rx_crypto_check_edma(struct wil6210_priv *wil, s = &wil->sta[cid]; c = mc ? &s->group_crypto_rx : &s->tid_crypto_rx[tid]; cc = &c->key_id[key_id]; - pn = (u8 *)&st->ext.pn_15_0; + pn = (u8 *)&st->ext.pn;if (!cc->key_set) { wil_err_ratelimited(wil,
drivers/net/wireless/ath/wil6210/txrx_edma.h +4 -2
@@ -330,8 +330,10 @@ struct wil_rx_status_extension {u32 d0;u32 d1;__le16 seq_num;/* only lower 12 bits */ -u16 pn_15_0; -u32 pn_47_16; +struct_group_attr (pn, __packed, + u16 pn_15_0; + u32 pn_47_16; + ); } __packed;struct wil_rx_status_extended {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 33/211 can: sun4i_can: Add acceptance register quirk
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Watts <[email protected]>
[ Upstream commit 8cda0c6dfd42ee6f2586e7dffb553aaf1fcb62ca ]
The Allwinner D1's CAN controllers have the ACPC and ACPM registers moved down. Compensate for this by adding an offset quirk for the acceptance registers.
--- drivers/net/can/sun4i_can.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/net/can/sun4i_can.c +8 -2
@@ -205,9 +205,11 @@* struct sun4ican_quirks - Differences between SoC variants. * * @has_reset: SoC needs reset deasserted. +* @acp_offset: Offset of ACPC and ACPM registers */ struct sun4ican_quirks {bool has_reset; +int acp_offset; };struct sun4ican_priv {
@@ -216,6 +218,7 @@ struct sun4ican_priv {struct clk *clk;struct reset_control *reset;spinlock_t cmdreg_lock;/* lock for concurrent cmd register writes */ +int acp_offset; };static const struct can_bittiming_const sun4ican_bittiming_const = {
@@ -338,8 +341,8 @@ static int sun4i_can_start(struct net_device *dev) }/* set filters - we accept all */ -writel (0x00000000 , priv->base +SUN4I_REG_ACPC_ADDR ); -writel (0xFFFFFFFF , priv->base +SUN4I_REG_ACPM_ADDR ); +writel (0x00000000 , priv->base +SUN4I_REG_ACPC_ADDR + priv->acp_offset); +writel (0xFFFFFFFF , priv->base +SUN4I_REG_ACPM_ADDR + priv->acp_offset);/* clear error counters and error code capture */ writel (0 , priv->base +SUN4I_REG_ERRC_ADDR );
@@ -768,10 +771,12 @@ static const struct ethtool_ops sun4ican_ethtool_ops = {static const struct sun4ican_quirks sun4ican_quirks_a10 = { .has_reset = false, + .acp_offset =0 , };static const struct sun4ican_quirks sun4ican_quirks_r40 = { .has_reset = true, + .acp_offset =0 , };static const struct of_device_id sun4ican_of_match[] = {
@@ -870,6 +875,7 @@ static int sun4ican_probe(struct platform_device *pdev) priv->base = addr; priv->clk = clk; priv->reset = reset; + priv->acp_offset = quirks->acp_offset;spin_lock_init (&priv->cmdreg_lock);platform_set_drvdata (pdev, dev);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 34/211 can: sun4i_can: Add support for the Allwinner D1
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Watts <[email protected]>
[ Upstream commit 8abb95250ae6af2d51993da8fcae18da2ce24cc4 ]
The controllers present in the D1 are extremely similar to the R40 and require the same reset quirks, but An extra quirk is needed to support receiving packets.
--- drivers/net/can/Kconfig | 4 ++-- drivers/net/can/sun4i_can.c | 12 +++++++++++- 2 files changed, 13 insertions(+), 3 deletions(-)
drivers/net/can/Kconfig +2 -2
@@ -185,10 +185,10 @@ config CAN_SLCAN config CAN_SUN4I tristate "Allwinner A10 CAN controller" - depends on MACH_SUN4I || MACH_SUN7I || COMPILE_TEST + depends on MACH_SUN4I || MACH_SUN7I || RISCV || COMPILE_TEST help Say Y here if you want to use CAN controller found on Allwinner - A10/A20 SoCs. + A10/A20/D1 SoCs. To compile this driver as a module, choose M here: the module will be called sun4i_can.
drivers/net/can/sun4i_can.c +11 -1
@@ -91,6 +91,8 @@#define SUN4I_REG_BUF12_ADDR 0x0070/* CAN Tx/Rx Buffer 12 */ #define SUN4I_REG_ACPC_ADDR 0x0040/* CAN Acceptance Code 0 */ #define SUN4I_REG_ACPM_ADDR 0x0044/* CAN Acceptance Mask 0 */ +#define SUN4I_REG_ACPC_ADDR_D1 0x0028/* CAN Acceptance Code 0 on the D1 */ +#define SUN4I_REG_ACPM_ADDR_D1 0x002C/* CAN Acceptance Mask 0 on the D1 */ #define SUN4I_REG_RBUF_RBACK_START_ADDR 0x0180/* CAN transmit buffer start */ #define SUN4I_REG_RBUF_RBACK_END_ADDR 0x01b0/* CAN transmit buffer end */
@@ -779,6 +781,11 @@ static const struct sun4ican_quirks sun4ican_quirks_r40 = { .acp_offset = 0, }; +static const struct sun4ican_quirks sun4ican_quirks_d1 = { + .has_reset = true, + .acp_offset = (SUN4I_REG_ACPC_ADDR_D1 -SUN4I_REG_ACPC_ADDR ), +}; +static const struct of_device_id sun4ican_of_match[] = { { .compatible ="allwinner,sun4i-a10-can" ,
@@ -789,6 +796,9 @@ static const struct of_device_id sun4ican_of_match[] = { }, { .compatible = "allwinner,sun8i-r40-can", .data = &sun4ican_quirks_r40 + }, { + .compatible = "allwinner,sun20i-d1-can", + .data = &sun4ican_quirks_d1 }, {/* sentinel */ },
@@ -913,4 +923,4 @@ module_platform_driver(sun4i_can_driver);MODULE_AUTHOR ("Peter Chen <[email protected]>" );MODULE_AUTHOR ("Gerhard Bertelsmann <[email protected]>" );MODULE_LICENSE ("Dual BSD/GPL" ); -MODULE_DESCRIPTION ("CAN driver for Allwinner SoCs (A10/A20)" ); +MODULE_DESCRIPTION ("CAN driver for Allwinner SoCs (A10/A20/D1)" );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 35/211 net: Use sockaddr_storage for getsockopt(SO_PEERNAME).
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 8936bf53a091ad6a34b480c22002f1cb2422ab38 ]
Commit df8fc4e934c1 ("kbuild: Enable -fstrict-flex-arrays=3") started applying strict rules to standard string functions.
It does not work well with conventional socket code around each protocol- specific sockaddr_XXX struct, which is cast from sockaddr_storage and has a bigger size than fortified functions expect. See these commits:
commit 06d4c8a80836 ("af_unix: Fix fortify_panic() in unix_bind_bsd().") commit ecb4534b6a1c ("af_unix: Terminate sun_path when bind()ing pathname socket.") commit a0ade8404c3b ("af_packet: Fix warning of fortified memcpy() in packet_getname().")
We must cast the protocol-specific address back to sockaddr_storage to call such functions.
However, in the case of getsockaddr(SO_PEERNAME), the rationale is a bit unclear as the buffer is defined by char[128] which is the same size as sockaddr_storage.
Let's use sockaddr_storage explicitly.
--- net/core/sock.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/core/sock.c +3 -3
@@ -1824,14 +1824,14 @@ int sk_getsockopt(struct sock *sk, int level, int optname,case SO_PEERNAME : { -char address[128 ]; +struct sockaddr_storage address; - lv = sock->ops->getname (sock, (struct sockaddr *)address,2 ); + lv = sock->ops->getname (sock, (struct sockaddr *)&address,2 );if (lv <0 )return -ENOTCONN ;if (lv < len)return -EINVAL ; -if (copy_to_sockptr (optval, address, len)) +if (copy_to_sockptr (optval, &address, len))return -EFAULT ; goto lenout; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 36/211 wifi: ath12k: Fix a NULL pointer dereference in ath12k_mac_op_hw_scan()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wen Gong <[email protected]>
[ Upstream commit 8ad314da54c6dd223a6b6cc85019160aa842f659 ]
In ath12k_mac_op_hw_scan(), the return value of kzalloc() is directly used in memcpy(), which may lead to a NULL pointer dereference on failure of kzalloc().
Fix this bug by adding a check of arg.extraie.ptr.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4
--- drivers/net/wireless/ath/ath12k/mac.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath12k/mac.c +5 -2
@@ -2755,9 +2755,12 @@ static int ath12k_mac_op_hw_scan(struct ieee80211_hw *hw, arg.scan_id =ATH12K_SCAN_ID ;if (req->ie_len) { + arg.extraie.ptr =kmemdup (req->ie, req->ie_len,GFP_KERNEL ); +if (!arg.extraie.ptr) { + ret = -ENOMEM ; + goto exit; + } arg.extraie.len = req->ie_len; - arg.extraie.ptr =kzalloc (req->ie_len,GFP_KERNEL ); -memcpy (arg.extraie.ptr, req->ie, req->ie_len); }if (req->n_ssids) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 37/211 wifi: ath12k: avoid array overflow of hw mode for preferred_hw_mode
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wen Gong <[email protected]>
[ Upstream commit 1e9b1363e2de1552ee4e3d74ac8bb43a194f1cb4 ]
Currently ath12k define WMI_HOST_HW_MODE_DBS_OR_SBS=5 as max hw mode for enum wmi_host_hw_mode_config_type, it is also same for the array ath12k_hw_mode_pri_map.
When tested with new version firmware/board data which support new hw mode eMLSR mode with hw mode value 8, it leads overflow usage for array ath12k_hw_mode_pri_map in function ath12k_wmi_hw_mode_caps(), and then lead preferred_hw_mode changed to 8, and finally function ath12k_pull_mac_phy_cap_svc_ready_ext() select the capability of hw mode 8, but the capability of eMLSR mode report from firmware does not support 2.4 GHz band for WCN7850, so finally 2.4 GHz band is disabled.
Skip the hw mode which exceeds WMI_HOST_HW_MODE_MAX in function ath12k_wmi_hw_mode_caps() helps to avoid array overflow, then the 2.4 GHz band will not be disabled.
This is to keep compatibility with newer version firmware/board data files, this change is still needed after ath12k add eMLSR hw mode 8 in array ath12k_hw_mode_pri_map and enum wmi_host_hw_mode_config_type, because more hw mode maybe added in next firmware/board data version e.g hw mode 9, then it will also lead new array overflow without this change.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4
--- drivers/net/wireless/ath/ath12k/wmi.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/wireless/ath/ath12k/wmi.c +4 -0
@@ -3704,6 +3704,10 @@ static int ath12k_wmi_hw_mode_caps(struct ath12k_base *soc,for (i =0 ; i < svc_rdy_ext->n_hw_mode_caps; i++) { hw_mode_caps = &svc_rdy_ext->hw_mode_caps[i]; mode =le32_to_cpu (hw_mode_caps->hw_mode_id); + +if (mode >=WMI_HOST_HW_MODE_MAX ) +continue ; + pref = soc->wmi_ab.preferred_hw_mode;if (ath12k_hw_mode_pri_map[mode] < ath12k_hw_mode_pri_map[pref]) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 38/211 net/ipv4: return the real errno instead of -EINVAL
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: xu xin <[email protected]>
[ Upstream commit c67180efc507e04a87f22aa68bd7dd832db006b7 ]
For now, No matter what error pointer ip_neigh_for_gw() returns, ip_finish_output2() always return -EINVAL, which may mislead the upper users.
For exemple, an application uses sendto to send an UDP packet, but when the neighbor table overflows, sendto() will get a value of -EINVAL, and it will cause users to waste a lot of time checking parameters for errors.
Return the real errno instead of -EINVAL.
--- net/ipv4/ip_output.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/ip_output.c +1 -1
@@ -236,7 +236,7 @@ static int ip_finish_output2(struct net *net, struct sock *sk, struct sk_buff *snet_dbg_ratelimited ("%s: No header cache and no neighbour!\n" , __func__);kfree_skb_reason (skb,SKB_DROP_REASON_NEIGH_CREATEFAIL ); -return -EINVAL ; +return PTR_ERR (neigh); } static int ip_finish_output_gso(struct net *net, struct sock *sk,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 39/211 crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark O'Donovan <[email protected]>
[ Upstream commit 9e47a758b70167c9301d2b44d2569f86c7796f2d ]
During NVMeTCP Authentication a controller can trigger a kernel oops by specifying the 8192 bit Diffie Hellman group and passing a correctly sized, but zeroed Diffie Hellamn value. mpi_cmp_ui() was detecting this if the second parameter was 0, but 1 is passed from dh_is_pubkey_valid(). This causes the null pointer u->d to be dereferenced towards the end of mpi_cmp_ui()
--- lib/mpi/mpi-cmp.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
lib/mpi/mpi-cmp.c +6 -2
@@ -25,8 +25,12 @@ int mpi_cmp_ui(MPI u, unsigned long v)mpi_limb_t limb = v;mpi_normalize (u); -if (!u->nlimbs && !limb) -return 0 ; +if (u->nlimbs ==0 ) { +if (v ==0 ) +return 0 ; +else +return -1 ; + }if (u->sign)return -1 ;if (u->nlimbs >1 )
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 40/211 Bluetooth: btusb: Add device 0489:e0f5 as MT7922 device
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Valentin David <[email protected]>
[ Upstream commit e160a8f4e920e5cf4e16a17f57367954c9436aea ]
Asus ROG Ally gaming computer has a MediaTek MT7922 chip that uses USB id 0489:e0f5 and needs to be added to the table. Without this, the device is not usable and gives the following error:
Bluetooth: hci0: Opcode 0x c03 failed: -110
Output from /sys/kernel/debug/usb/devices:
T: Bus=01 Lev=01 Prnt=01 Port=03 Cnt=03 Dev#= 4 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e0f5 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us
--- drivers/bluetooth/btusb.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/bluetooth/btusb.c +3 -0
@@ -628,6 +628,9 @@ static const struct usb_device_id blacklist_table[] = { { USB_DEVICE(0x0489, 0xe0f2), .driver_info = BTUSB_MEDIATEK |BTUSB_WIDEBAND_SPEECH | BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x0489, 0xe0f5), .driver_info = BTUSB_MEDIATEK | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, /* Additional Realtek 8723AE Bluetooth devices */ { USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK },
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 41/211 Bluetooth: btusb: Add a new VID/PID 0489/e0f6 for MT7922
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Lu <[email protected]>
[ Upstream commit b6cfa1c29afb6d527652938b0eb8db17b194bddc ]
Add VID/PID 0489/e0f6 for MediaTek MT7922 USB Bluetooth chip.
The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below.
T: Bus=01 Lev=01 Prnt=01 Port=04 Cnt=03 Dev#= 4 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e0f6 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us
--- drivers/bluetooth/btusb.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/bluetooth/btusb.c +3 -0
@@ -631,6 +631,9 @@ static const struct usb_device_id blacklist_table[] = { { USB_DEVICE(0x0489, 0xe0f5), .driver_info = BTUSB_MEDIATEK |BTUSB_WIDEBAND_SPEECH | BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x0489, 0xe0f6), .driver_info = BTUSB_MEDIATEK | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, /* Additional Realtek 8723AE Bluetooth devices */ { USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK },
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 42/211 Bluetooth: btusb: Add new VID/PID 0489/e102 for MT7922
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Lu <[email protected]>
[ Upstream commit bf809efdcc4df4132c8c261fbba7121909dc6211 ]
Add VID 0489 & PID e102 for MediaTek MT7922 USB Bluetooth chip.
The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below.
T: Bus=05 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e102 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us
--- drivers/bluetooth/btusb.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/bluetooth/btusb.c +3 -0
@@ -634,6 +634,9 @@ static const struct usb_device_id blacklist_table[] = { { USB_DEVICE(0x0489, 0xe0f6), .driver_info = BTUSB_MEDIATEK |BTUSB_WIDEBAND_SPEECH | BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x0489, 0xe102), .driver_info = BTUSB_MEDIATEK | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, /* Additional Realtek 8723AE Bluetooth devices */ { USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK },
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 43/211 Bluetooth: btusb: Add new VID/PID 04ca/3804 for MT7922
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Lu <[email protected]>
[ Upstream commit 59be4be82bd3639cd9dbfb92df0f6263ab2c2e28 ]
Add VID 04ca & PID 3804 for MediaTek MT7922 USB Bluetooth chip.
The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below.
T: Bus=05 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=04ca ProdID=3804 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us
--- drivers/bluetooth/btusb.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/bluetooth/btusb.c +3 -0
@@ -637,6 +637,9 @@ static const struct usb_device_id blacklist_table[] = { { USB_DEVICE(0x0489, 0xe102), .driver_info = BTUSB_MEDIATEK |BTUSB_WIDEBAND_SPEECH | BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x04ca, 0x3804), .driver_info = BTUSB_MEDIATEK | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, /* Additional Realtek 8723AE Bluetooth devices */ { USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK },
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 44/211 Bluetooth: Fix hci_suspend_sync crash
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ying Hsu <[email protected]>
[ Upstream commit 573ebae162111063eedc6c838a659ba628f66a0f ]
If hci_unregister_dev() frees the hci_dev object but hci_suspend_notifier may still be accessing it, it can cause the program to crash. Here's the call trace:
<4>[102152.653246] Call Trace: <4>[102152.653254] hci_suspend_sync+0x109/0x301 [bluetooth] <4>[102152.653259] hci_suspend_dev+0x78/0xcd [bluetooth] <4>[102152.653263] hci_suspend_notifier+0x42/0x7a [bluetooth] <4>[102152.653268] notifier_call_chain+0x43/0x6b <4>[102152.653271] __blocking_notifier_call_chain+0x48/0x69 <4>[102152.653273] __pm_notifier_call_chain+0x22/0x39 <4>[102152.653276] pm_suspend+0x287/0x57c <4>[102152.653278] state_store+0xae/0xe5 <4>[102152.653281] kernfs_fop_write+0x109/0x173 <4>[102152.653284] __vfs_write+0x16f/0x1a2 <4>[102152.653287] ? selinux_file_permission+0xca/0x16f <4>[102152.653289] ? security_file_permission+0x36/0x109 <4>[102152.653291] vfs_write+0x114/0x21d <4>[102152.653293] __x64_sys_write+0x7b/0xdb <4>[102152.653296] do_syscall_64+0x59/0x194 <4>[102152.653299] entry_SYSCALL_64_after_hwframe+0x5c/0xc1
This patch holds the reference count of the hci_dev object while processing it in hci_suspend_notifier to avoid potential crash caused by the race condition.
--- net/bluetooth/hci_core.c | 4 ++++ 1 file changed, 4 insertions(+)
net/bluetooth/hci_core.c +4 -0
@@ -2436,6 +2436,9 @@ static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action,if (hci_dev_test_flag (hdev,HCI_USER_CHANNEL ))return NOTIFY_DONE ; +/* To avoid a potential race with hci_unregister_dev. */ +hci_dev_hold (hdev); +if (action ==PM_SUSPEND_PREPARE ) ret =hci_suspend_dev (hdev);else if (action ==PM_POST_SUSPEND )
@@ -2445,6 +2448,7 @@ static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action,bt_dev_err (hdev,"Suspend notifier action (%lu) failed: %d" , action, ret); +hci_dev_put (hdev);return NOTIFY_DONE ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 45/211 Bluetooth: btusb: Add support for another MediaTek 7922 VID/PID
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roger Gammans <[email protected]>
[ Upstream commit 0cefdaed944d1617852762ff1f66364199cf5d7d ]
This one is found on the Dell Inspiron 2-in-1 7435
The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below.
T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e0f1 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us
--- drivers/bluetooth/btusb.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/bluetooth/btusb.c +3 -0
@@ -625,6 +625,9 @@ static const struct usb_device_id blacklist_table[] = { { USB_DEVICE(0x0489, 0xe0e4), .driver_info = BTUSB_MEDIATEK |BTUSB_WIDEBAND_SPEECH | BTUSB_VALID_LE_STATES }, + { USB_DEVICE(0x0489, 0xe0f1), .driver_info = BTUSB_MEDIATEK | +BTUSB_WIDEBAND_SPEECH | + BTUSB_VALID_LE_STATES }, { USB_DEVICE(0x0489, 0xe0f2), .driver_info = BTUSB_MEDIATEK |BTUSB_WIDEBAND_SPEECH | BTUSB_VALID_LE_STATES },
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 46/211 netlink: convert nlk->flags to atomic flags
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 8fe08d70a2b61b35a0a1235c78cf321e7528351f ]
sk_diag_put_flags(), netlink_setsockopt(), netlink_getsockopt() and others use nlk->flags without correct locking.
Use set_bit(), clear_bit(), test_bit(), assign_bit() to remove data-races.
--- net/netlink/af_netlink.c | 90 ++++++++++++++-------------------------- net/netlink/af_netlink.h | 22 ++++++---- net/netlink/diag.c | 10 ++--- 3 files changed, 48 insertions(+), 74 deletions(-)
net/netlink/af_netlink.c +30 -60
@@ -84,7 +84,7 @@ struct listeners {static inline int netlink_is_kernel (struct sock *sk) { -return nlk_sk (sk)->flags &NETLINK_F_KERNEL_SOCKET ; +return nlk_test_bit (KERNEL_SOCKET , sk); }struct netlink_table *nl_table__read_mostly ;
@@ -349,9 +349,7 @@ static void netlink_deliver_tap_kernel(struct sock *dst, struct sock *src,static void netlink_overrun (struct sock *sk) { -struct netlink_sock *nlk =nlk_sk (sk); - -if (!(nlk->flags &NETLINK_F_RECV_NO_ENOBUFS )) { +if (!nlk_test_bit (RECV_NO_ENOBUFS , sk)) {if (!test_and_set_bit (NETLINK_S_CONGESTED , &nlk_sk (sk)->state)) { sk->sk_err =ENOBUFS ;
@@ -1402,9 +1400,7 @@ EXPORT_SYMBOL_GPL(netlink_has_listeners);bool netlink_strict_get_check (struct sk_buff *skb) { -const struct netlink_sock *nlk =nlk_sk (NETLINK_CB (skb).sk); - -return nlk->flags &NETLINK_F_STRICT_CHK ; +return nlk_test_bit (STRICT_CHK ,NETLINK_CB (skb).sk); }EXPORT_SYMBOL_GPL (netlink_strict_get_check);
@@ -1448,7 +1444,7 @@ static void do_one_broadcast(struct sock *sk,return ;if (!net_eq (sock_net (sk), p->net)) { -if (!(nlk->flags &NETLINK_F_LISTEN_ALL_NSID )) +if (!nlk_test_bit (LISTEN_ALL_NSID , sk))return ;if (!peernet_has_id (sock_net (sk), p->net))
@@ -1481,7 +1477,7 @@ static void do_one_broadcast(struct sock *sk,netlink_overrun (sk);/* Clone failed. Notify ALL listeners. */ p->failure =1 ; -if (nlk->flags &NETLINK_F_BROADCAST_SEND_ERROR ) +if (nlk_test_bit (BROADCAST_SEND_ERROR , sk)) p->delivery_failure =1 ; goto out; }
@@ -1496,7 +1492,7 @@ static void do_one_broadcast(struct sock *sk, val =netlink_broadcast_deliver (sk, p->skb2);if (val <0 ) {netlink_overrun (sk); -if (nlk->flags &NETLINK_F_BROADCAST_SEND_ERROR ) +if (nlk_test_bit (BROADCAST_SEND_ERROR , sk)) p->delivery_failure =1 ; }else { p->congested |= val;
@@ -1576,7 +1572,7 @@ static int do_one_set_err(struct sock *sk, struct netlink_set_err_data *p) !test_bit(p->group - 1, nlk->groups)) goto out; -if (p->code ==ENOBUFS && nlk->flags &NETLINK_F_RECV_NO_ENOBUFS ) { +if (p->code ==ENOBUFS &&nlk_test_bit (RECV_NO_ENOBUFS , sk)) { ret =1 ; goto out; }
@@ -1643,7 +1639,7 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname,struct sock *sk = sock->sk;struct netlink_sock *nlk =nlk_sk (sk);unsigned int val =0 ; -int err; +int nr =-1 ;if (level !=SOL_NETLINK )return -ENOPROTOOPT ;
@@ -1654,14 +1650,12 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname,switch (optname) {case NETLINK_PKTINFO : -if (val) - nlk->flags |=NETLINK_F_RECV_PKTINFO ; -else - nlk->flags &= ~NETLINK_F_RECV_PKTINFO ; - err =0 ; + nr =NETLINK_F_RECV_PKTINFO ;break ;case NETLINK_ADD_MEMBERSHIP :case NETLINK_DROP_MEMBERSHIP : { +int err; +if (!netlink_allowed (sock,NL_CFG_F_NONROOT_RECV ))return -EPERM ; err =netlink_realloc_groups (sk);
@@ -1681,61 +1675,38 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname,if (optname ==NETLINK_DROP_MEMBERSHIP && nlk->netlink_unbind) nlk->netlink_unbind (sock_net (sk), val); - err =0 ;break ; }case NETLINK_BROADCAST_ERROR : -if (val) - nlk->flags |=NETLINK_F_BROADCAST_SEND_ERROR ; -else - nlk->flags &= ~NETLINK_F_BROADCAST_SEND_ERROR ; - err =0 ; + nr =NETLINK_F_BROADCAST_SEND_ERROR ;break ;case NETLINK_NO_ENOBUFS : +assign_bit (NETLINK_F_RECV_NO_ENOBUFS , &nlk->flags, val);if (val) { - nlk->flags |=NETLINK_F_RECV_NO_ENOBUFS ;clear_bit (NETLINK_S_CONGESTED , &nlk->state);wake_up_interruptible (&nlk->wait); - }else { - nlk->flags &= ~NETLINK_F_RECV_NO_ENOBUFS ; } - err =0 ;break ;case NETLINK_LISTEN_ALL_NSID :if (!ns_capable (sock_net (sk)->user_ns,CAP_NET_BROADCAST ))return -EPERM ; - -if (val) - nlk->flags |=NETLINK_F_LISTEN_ALL_NSID ; -else - nlk->flags &= ~NETLINK_F_LISTEN_ALL_NSID ; - err =0 ; + nr =NETLINK_F_LISTEN_ALL_NSID ;break ;case NETLINK_CAP_ACK : -if (val) - nlk->flags |=NETLINK_F_CAP_ACK ; -else - nlk->flags &= ~NETLINK_F_CAP_ACK ; - err =0 ; + nr =NETLINK_F_CAP_ACK ;break ;case NETLINK_EXT_ACK : -if (val) - nlk->flags |=NETLINK_F_EXT_ACK ; -else - nlk->flags &= ~NETLINK_F_EXT_ACK ; - err =0 ; + nr =NETLINK_F_EXT_ACK ;break ;case NETLINK_GET_STRICT_CHK : -if (val) - nlk->flags |=NETLINK_F_STRICT_CHK ; -else - nlk->flags &= ~NETLINK_F_STRICT_CHK ; - err =0 ; + nr =NETLINK_F_STRICT_CHK ;break ;default : - err = -ENOPROTOOPT ; +return -ENOPROTOOPT ; } -return err; +if (nr >=0 ) +assign_bit (nr, &nlk->flags, val); +return 0 ; } static int netlink_getsockopt(struct socket *sock, int level, int optname,
@@ -1802,7 +1773,7 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,return -EINVAL ; len =sizeof (int ); - val = nlk->flags & flag ?1 :0 ; + val =test_bit (flag, &nlk->flags);if (put_user (len, optlen) ||copy_to_user (optval, &val, len))
@@ -1979,9 +1950,9 @@ static int netlink_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, msg->msg_namelen =sizeof (*addr); } -if (nlk->flags &NETLINK_F_RECV_PKTINFO ) +if (nlk_test_bit (RECV_PKTINFO , sk))netlink_cmsg_recv_pktinfo (msg, skb); -if (nlk->flags &NETLINK_F_LISTEN_ALL_NSID ) +if (nlk_test_bit (LISTEN_ALL_NSID , sk))netlink_cmsg_listen_all_nsid (sk, msg, skb);memset (&scm,0 ,sizeof (scm));
@@ -2058,7 +2029,7 @@ __netlink_kernel_create(struct net *net, int unit, struct module *module, goto out_sock_release; nlk =nlk_sk (sk); - nlk->flags |=NETLINK_F_KERNEL_SOCKET ; +set_bit (NETLINK_F_KERNEL_SOCKET , &nlk->flags);netlink_table_grab ();if (!nl_table[unit].registered) {
@@ -2192,7 +2163,7 @@ static int netlink_dump_done(struct netlink_sock *nlk, struct sk_buff *skb,nl_dump_check_consistent (cb, nlh);memcpy (nlmsg_data (nlh), &nlk->dump_done_errno,sizeof (nlk->dump_done_errno)); -if (extack->_msg && nlk->flags &NETLINK_F_EXT_ACK ) { +if (extack->_msg &&test_bit (NETLINK_F_EXT_ACK , &nlk->flags)) { nlh->nlmsg_flags |=NLM_F_ACK_TLVS ;if (!nla_put_string (skb,NLMSGERR_ATTR_MSG , extack->_msg))nlmsg_end (skb, nlh);
@@ -2321,8 +2292,8 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,const struct nlmsghdr *nlh, struct netlink_dump_control *control) { - struct netlink_sock *nlk, *nlk2; struct netlink_callback *cb; +struct netlink_sock *nlk;struct sock *sk;int ret;
@@ -2357,8 +2328,7 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb, cb->min_dump_alloc = control->min_dump_alloc; cb->skb = skb; - nlk2 =nlk_sk (NETLINK_CB (skb).sk); - cb->strict_check = !!(nlk2->flags &NETLINK_F_STRICT_CHK ); + cb->strict_check =nlk_test_bit (STRICT_CHK ,NETLINK_CB (skb).sk);if (control->start) { cb->extack = control->extack;
@@ -2402,7 +2372,7 @@ netlink_ack_tlv_len(struct netlink_sock *nlk, int err, {size_t tlvlen; -if (!extack || !(nlk->flags &NETLINK_F_EXT_ACK )) +if (!extack || !test_bit (NETLINK_F_EXT_ACK , &nlk->flags))return 0 ; tlvlen =0 ;
@@ -2474,7 +2444,7 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err,* requests to cap the error message, and get extra error data if * requested. */ -if (err && !(nlk->flags &NETLINK_F_CAP_ACK )) +if (err && !test_bit (NETLINK_F_CAP_ACK , &nlk->flags)) payload +=nlmsg_len (nlh);else flags |=NLM_F_CAPPED ;
net/netlink/af_netlink.h +13 -9
@@ -8,14 +8,16 @@#include <net/sock.h> /* flags */ -#define NETLINK_F_KERNEL_SOCKET 0x1 -#define NETLINK_F_RECV_PKTINFO 0x2 -#define NETLINK_F_BROADCAST_SEND_ERROR 0x4 -#define NETLINK_F_RECV_NO_ENOBUFS 0x8 -#define NETLINK_F_LISTEN_ALL_NSID 0x10 -#define NETLINK_F_CAP_ACK 0x20 -#define NETLINK_F_EXT_ACK 0x40 -#define NETLINK_F_STRICT_CHK 0x80 +enum { +NETLINK_F_KERNEL_SOCKET , +NETLINK_F_RECV_PKTINFO , +NETLINK_F_BROADCAST_SEND_ERROR , +NETLINK_F_RECV_NO_ENOBUFS , +NETLINK_F_LISTEN_ALL_NSID , +NETLINK_F_CAP_ACK , +NETLINK_F_EXT_ACK , +NETLINK_F_STRICT_CHK , +};#define NLGRPSZ (x) (ALIGN(x, sizeof(unsigned long) * 8) / 8)#define NLGRPLONGS (x) (NLGRPSZ(x)/sizeof(unsigned long))
@@ -23,10 +25,10 @@struct netlink_sock {/* struct sock has to be the first member of netlink_sock */ struct sock sk; +unsigned long flags;u32 portid;u32 dst_portid;u32 dst_group; -u32 flags;u32 subscriptions;u32 ngroups;unsigned long *groups;
@@ -54,6 +56,8 @@ static inline struct netlink_sock *nlk_sk(struct sock *sk) return container_of(sk, struct netlink_sock, sk); } +#define nlk_test_bit (nr, sk) test_bit(NETLINK_F_##nr, &nlk_sk(sk)->flags) +struct netlink_table {struct rhashtable hash;struct hlist_head mc_list;
net/netlink/diag.c +5 -5
@@ -27,15 +27,15 @@ static int sk_diag_put_flags(struct sock *sk, struct sk_buff *skb)if (nlk->cb_running) flags |=NDIAG_FLAG_CB_RUNNING ; -if (nlk->flags &NETLINK_F_RECV_PKTINFO ) +if (nlk_test_bit (RECV_PKTINFO , sk)) flags |=NDIAG_FLAG_PKTINFO ; -if (nlk->flags &NETLINK_F_BROADCAST_SEND_ERROR ) +if (nlk_test_bit (BROADCAST_SEND_ERROR , sk)) flags |=NDIAG_FLAG_BROADCAST_ERROR ; -if (nlk->flags &NETLINK_F_RECV_NO_ENOBUFS ) +if (nlk_test_bit (RECV_NO_ENOBUFS , sk)) flags |=NDIAG_FLAG_NO_ENOBUFS ; -if (nlk->flags &NETLINK_F_LISTEN_ALL_NSID ) +if (nlk_test_bit (LISTEN_ALL_NSID , sk)) flags |=NDIAG_FLAG_LISTEN_ALL_NSID ; -if (nlk->flags &NETLINK_F_CAP_ACK ) +if (nlk_test_bit (CAP_ACK , sk)) flags |=NDIAG_FLAG_CAP_ACK ;return nla_put_u32 (skb,NETLINK_DIAG_FLAGS , flags);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 47/211 tpm_tis: Resend command to recover from data transfer errors
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Steffen <[email protected]>
[ Upstream commit 280db21e153d8810ce3b93640c63ae922bcb9e8e ]
Similar to the transmission of TPM responses, also the transmission of TPM commands may become corrupted. Instead of aborting when detecting such issues, try resending the command again.
--- drivers/char/tpm/tpm_tis_core.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
drivers/char/tpm/tpm_tis_core.c +10 -3
@@ -512,10 +512,17 @@ static int tpm_tis_send_main(struct tpm_chip *chip, const u8 *buf, size_t len)int rc;u32 ordinal;unsigned long dur; +unsigned int try; - rc =tpm_tis_send_data (chip, buf, len); -if (rc <0 ) -return rc; +for (try =0 ; try <TPM_RETRY ; try++) { + rc =tpm_tis_send_data (chip, buf, len); +if (rc >=0 ) +/* Data transfer done successfully */ +break ; +else if (rc != -EIO ) +/* Data transfer failed, not recoverable */ +return rc; + } rc =tpm_tis_verify_crc (priv, len, buf);if (rc <0 ) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 48/211 mmc: sdhci-esdhc-imx: improve ESDHC_FLAG_ERR010450
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Giulio Benetti <[email protected]>
[ Upstream commit 5ae4b0d8875caa44946e579420c7fd5740d58653 ]
Errata ERR010450 only shows up if voltage is 1.8V, but if the device is supplied by 3v3 the errata can be ignored. So let's check for if quirk SDHCI_QUIRK2_NO_1_8_V is defined or not before limiting the frequency.
--- drivers/mmc/host/sdhci-esdhc-imx.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/mmc/host/sdhci-esdhc-imx.c +4 -3
@@ -171,8 +171,8 @@#define ESDHC_FLAG_HS400 BIT(9)/* * The IP has errata ERR010450 -* uSDHC: Due to the I/O timing limit, for SDR mode, SD card clock can't -* exceed 150MHz, for DDR mode, SD card clock can't exceed 45MHz. +* uSDHC: At 1.8V due to the I/O timing limit, for SDR mode, SD card +* clock can't exceed 150MHz, for DDR mode, SD card clock can't exceed 45MHz. */ #define ESDHC_FLAG_ERR010450 BIT(10)/* The IP supports HS400ES mode */
@@ -961,7 +961,8 @@ static inline void esdhc_pltfm_set_clock(struct sdhci_host *host, | ESDHC_CLOCK_MASK);sdhci_writel (host, temp,ESDHC_SYSTEM_CONTROL ); -if (imx_data->socdata->flags &ESDHC_FLAG_ERR010450 ) { +if ((imx_data->socdata->flags &ESDHC_FLAG_ERR010450 ) && + (!(host->quirks2 &SDHCI_QUIRK2_NO_1_8_V ))) {unsigned int max_clock; max_clock = imx_data->is_ddr ?45000000 :150000000 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 49/211 alx: fix OOB-read compiler warning
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: GONG, Ruiqi <[email protected]>
[ Upstream commit 3a198c95c95da10ad844cbeade2fe40bdf14c411 ]
The following message shows up when compiling with W=1:
In function ‘fortify_memcpy_chk’,
inlined from ‘alx_get_ethtool_stats’ at drivers/net/ethernet/atheros/alx/ethtool.c:297:2:./include/linux/fortify-string.h:592:4: error: call to ‘__read_overflow2_field’ declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Werror=attribute-warning]
592 | __read_overflow2_field(q_size_field, size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~In order to get alx stats altogether, alx_get_ethtool_stats() reads beyond hw->stats.rx_ok. Fix this warning by directly copying hw->stats, and refactor the unnecessarily complicated BUILD_BUG_ON btw.
--- drivers/net/ethernet/atheros/alx/ethtool.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/ethernet/atheros/alx/ethtool.c +2 -3
@@ -292,9 +292,8 @@ static void alx_get_ethtool_stats(struct net_device *netdev,spin_lock (&alx->stats_lock);alx_update_hw_stats (hw); -BUILD_BUG_ON (sizeof (hw->stats) - offsetof(struct alx_hw_stats , rx_ok) < -ALX_NUM_STATS *sizeof (u64)); -memcpy (data, &hw->stats.rx_ok,ALX_NUM_STATS *sizeof (u64)); +BUILD_BUG_ON (sizeof (hw->stats) !=ALX_NUM_STATS *sizeof (u64)); +memcpy (data, &hw->stats,sizeof (hw->stats));spin_unlock (&alx->stats_lock); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 50/211 wifi: iwlwifi: pcie: avoid a warning in case prepare card failed
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avraham Stern <[email protected]>
[ Upstream commit 057381ddac0593c6e4ca8f58732830d8542b9c4e ]
In case CSME holds the NIC and SAP connection is already established, iwl_pcie_prepare_card_hw() during iwl_pci_probe() will fail (which is fine since CSME will release the nic later when asked with a SAP message). In this case tring to grab nic access to read the crf ids will fail with a warning.
Avoid the warning by only trying to read the crf ids in case prepare card succeeded.
--- drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-)
drivers/net/wireless/intel/iwlwifi/pcie/drv.c +1 -10
@@ -1132,12 +1132,6 @@ static int get_crf_id(struct iwl_trans *iwl_trans)else sd_reg_ver_addr =SD_REG_VER ; -if (!iwl_trans_grab_nic_access (iwl_trans)) { -IWL_ERR (iwl_trans,"Failed to grab nic access before reading crf id\n" ); - ret = -EIO ; - goto out; - } -/* Enable access to peripheral registers */ val =iwl_read_umac_prph_no_grab (iwl_trans,WFPM_CTRL_REG ); val |=ENABLE_WFPM ;
@@ -1157,9 +1151,6 @@ static int get_crf_id(struct iwl_trans *iwl_trans) iwl_trans->hw_crf_id, iwl_trans->hw_cnv_id, iwl_trans->hw_wfpm_id); -iwl_trans_release_nic_access (iwl_trans); - -out:return ret; }
@@ -1351,6 +1342,7 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)if (ret) goto out_free_trans;if (iwl_trans_grab_nic_access (iwl_trans)) { +get_crf_id (iwl_trans);/* all good */ iwl_trans_release_nic_access (iwl_trans); }else {
@@ -1360,7 +1352,6 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) } iwl_trans->hw_rf_id =iwl_read32 (iwl_trans,CSR_HW_RF_ID ); -get_crf_id (iwl_trans);/* * The RF_ID is set to zero in blank OTP so read version to
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 51/211 wifi: mac80211: check S1G action frame size
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 19e4a47ee74718a22e963e8a647c8c3bfe8bb05c ]
Before checking the action code, check that it even exists in the frame.
--- net/mac80211/rx.c | 4 ++++ 1 file changed, 4 insertions(+)
net/mac80211/rx.c +4 -0
@@ -3734,6 +3734,10 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)break ; goto queue;case WLAN_CATEGORY_S1G : +if (len <offsetofend (typeof (*mgmt), + u.action.u.s1g.action_code)) +break ; +switch (mgmt->u.action.u.s1g.action_code) {case WLAN_S1G_TWT_SETUP :case WLAN_S1G_TWT_TEARDOWN :
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 52/211 netfilter: ebtables: fix fortify warnings in size_entry_mwt()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: GONG, Ruiqi <[email protected]>
[ Upstream commit a7ed3465daa240bdf01a5420f64336fee879c09d ]
When compiling with gcc 13 and CONFIG_FORTIFY_SOURCE=y, the following warning appears:
In function ‘fortify_memcpy_chk’,
inlined from ‘size_entry_mwt’ at net/bridge/netfilter/ebtables.c:2118:2:./include/linux/fortify-string.h:592:25: error: call to ‘__read_overflow2_field’ declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Werror=attribute-warning]
592 | __read_overflow2_field(q_size_field, size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~The compiler is complaining:
memcpy(&offsets[1], &entry->watchers_offset,
sizeof(offsets) - sizeof(offsets[0]));
where memcpy reads beyong &entry->watchers_offset to copy {watchers,target,next}_offset altogether into offsets[]. Silence the warning by wrapping these three up via struct_group().
--- include/uapi/linux/netfilter_bridge/ebtables.h | 14 ++++++++------ net/bridge/netfilter/ebtables.c | 3 +-- 2 files changed, 9 insertions(+), 8 deletions(-)
include/uapi/linux/netfilter_bridge/ebtables.h +8 -6
@@ -182,12 +182,14 @@ struct ebt_entry {unsigned char sourcemsk[ETH_ALEN ];unsigned char destmac[ETH_ALEN ];unsigned char destmsk[ETH_ALEN ]; -/* sizeof ebt_entry + matches */ -unsigned int watchers_offset; -/* sizeof ebt_entry + matches + watchers */ -unsigned int target_offset; -/* sizeof ebt_entry + matches + watchers + target */ -unsigned int next_offset; + __struct_group(/* no tag */, offsets, /* no attrs */, +/* sizeof ebt_entry + matches */ + unsigned int watchers_offset; +/* sizeof ebt_entry + matches + watchers */ +unsigned int target_offset; +/* sizeof ebt_entry + matches + watchers + target */ +unsigned int next_offset; + ); unsigned char elems[0] __attribute__ ((aligned (__alignof__(struct ebt_replace)))); };
net/bridge/netfilter/ebtables.c +1 -2
@@ -2115,8 +2115,7 @@ static int size_entry_mwt(const struct ebt_entry *entry, const unsigned char *bareturn ret; offsets[0 ] =sizeof (struct ebt_entry );/* matches come first */ -memcpy (&offsets[1 ], &entry->watchers_offset, -sizeof (offsets) -sizeof (offsets[0 ])); +memcpy (&offsets[1 ], &entry->offsets,sizeof (entry->offsets));if (state->buf_kern_start) { buf_start = state->buf_kern_start + state->buf_kern_offset;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 53/211 wifi: cfg80211: reject auth/assoc to AP with our address
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 5d4e04bf3a0f098bd9033de3a5291810fa14c7a6 ]
If the AP uses our own address as its MLD address or BSSID, then clearly something's wrong. Reject such connections so we don't try and fail later.
--- net/wireless/mlme.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
net/wireless/mlme.c +13 -0
@@ -281,6 +281,11 @@ int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev, ether_addr_equal(req->bss->bssid, wdev->u.client.connected_addr)) return -EALREADY; +if (ether_addr_equal (req->bss->bssid, dev->dev_addr) || + (req->link_id >=0 && +ether_addr_equal (req->ap_mld_addr, dev->dev_addr))) +return -EINVAL ; +return rdev_auth (rdev, dev, req); }
@@ -335,6 +340,9 @@ int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,if (req->links[i].bss == req->links[j].bss)return -EINVAL ; } + +if (ether_addr_equal (req->links[i].bss->bssid, dev->dev_addr)) +return -EINVAL ; } if (wdev->connected &&
@@ -342,6 +350,11 @@ int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev, !ether_addr_equal(wdev->u.client.connected_addr, req->prev_bssid)))return -EALREADY ; +if ((req->bss &ðer_addr_equal (req->bss->bssid, dev->dev_addr)) || + (req->link_id >=0 && +ether_addr_equal (req->ap_mld_addr, dev->dev_addr))) +return -EINVAL ; +cfg80211_oper_and_ht_capa (&req->ht_capa_mask, rdev->wiphy.ht_capa_mod_mask); cfg80211_oper_and_vht_capa(&req->vht_capa_mask,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 54/211 wifi: cfg80211: ocb: dont leave if not joined
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit abc76cf552e13cfa88a204b362a86b0e08e95228 ]
If there's no OCB state, don't ask the driver/mac80211 to leave, since that's just confusing. Since set/clear the chandef state, that's a simple check.
--- net/wireless/ocb.c | 3 +++ 1 file changed, 3 insertions(+)
net/wireless/ocb.c +3 -0
@@ -68,6 +68,9 @@ int __cfg80211_leave_ocb(struct cfg80211_registered_device *rdev,if (!rdev->ops->leave_ocb)return -EOPNOTSUPP ; +if (!wdev->u.ocb.chandef.chan) +return -ENOTCONN ; + err =rdev_leave_ocb (rdev, dev);if (!err)memset (&wdev->u.ocb.chandef,0 ,sizeof (wdev->u.ocb.chandef));
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 55/211 wifi: mac80211: check for station first in client probe
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 67dfa589aa8806c7959cbca2f4613b8d41c75a06 ]
When probing a client, first check if we have it, and then check for the channel context, otherwise you can trigger the warning there easily by probing when the AP isn't even started yet. Since a client existing means the AP is also operating, we can then keep the warning.
Also simplify the moved code a bit.
--- net/mac80211/cfg.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
net/mac80211/cfg.c +8 -7
@@ -4133,19 +4133,20 @@ static int ieee80211_probe_client(struct wiphy *wiphy, struct net_device *dev,mutex_lock (&local->mtx);rcu_read_lock (); + sta =sta_info_get_bss (sdata, peer); +if (!sta) { + ret = -ENOLINK ; + goto unlock; + } + + qos = sta->sta.wme; + chanctx_conf =rcu_dereference (sdata->vif.bss_conf.chanctx_conf);if (WARN_ON (!chanctx_conf)) { ret = -EINVAL ; goto unlock; } band = chanctx_conf->def.chan->band; - sta =sta_info_get_bss (sdata, peer); -if (sta) { - qos = sta->sta.wme; - }else { - ret = -ENOLINK ; - goto unlock; - }if (qos) { fc = cpu_to_le16(IEEE80211_FTYPE_DATA |
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 56/211 wifi: mac80211_hwsim: drop short frames
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit fba360a047d5eeeb9d4b7c3a9b1c8308980ce9a6 ]
While technically some control frames like ACK are shorter and end after Address 1, such frames shouldn't be forwarded through wmediumd or similar userspace, so require the full 3-address header to avoid accessing invalid memory if shorter frames are passed in.
--- drivers/net/wireless/virtual/mac80211_hwsim.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/wireless/virtual/mac80211_hwsim.c +4 -3
@@ -5626,14 +5626,15 @@ static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2, frame_data_len =nla_len (info->attrs[HWSIM_ATTR_FRAME ]); frame_data = (void *)nla_data (info->attrs[HWSIM_ATTR_FRAME ]); +if (frame_data_len <sizeof (struct ieee80211_hdr_3addr ) || + frame_data_len >IEEE80211_MAX_DATA_LEN ) + goto err; +/* Allocate new skb here */ skb =alloc_skb (frame_data_len,GFP_KERNEL );if (skb ==NULL ) goto err; -if (frame_data_len >IEEE80211_MAX_DATA_LEN ) - goto err; -/* Copy the data */ skb_put_data (skb, frame_data, frame_data_len);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 57/211 Revert "wifi: mac80211_hwsim: check the return value of nla_put_u32"
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <[email protected]>
[ Upstream commit 1b78dd34560e9962f8e917fe4adde6f2ab0eb89f ]
This reverts commit b970ac68e0c4 ("wifi: mac80211_hwsim: check the return value of nla_put_u32") since it introduced a memory leak in the error path, which seems worse than sending an incomplete skb, and the put can't fail anyway since the SKB was just allocated.
--- drivers/net/wireless/virtual/mac80211_hwsim.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/net/wireless/virtual/mac80211_hwsim.c +2 -3
@@ -582,9 +582,8 @@ static int mac80211_hwsim_vendor_cmd_test(struct wiphy *wiphy,*/ /* Add vendor data */ - err =nla_put_u32 (skb,QCA_WLAN_VENDOR_ATTR_TEST , val +1 ); -if (err) -return err; +nla_put_u32 (skb,QCA_WLAN_VENDOR_ATTR_TEST , val +1 ); +/* Send the event - this will call nla_nest_end() */ cfg80211_vendor_event (skb,GFP_KERNEL ); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 58/211 libbpf: Free btf_vmlinux when closing bpf_object
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Luo <[email protected]>
[ Upstream commit 29d67fdebc42af6466d1909c60fdd1ef4f3e5240 ]
I hit a memory leak when testing bpf_program__set_attach_target(). Basically, set_attach_target() may allocate btf_vmlinux, for example, when setting attach target for bpf_iter programs. But btf_vmlinux is freed only in bpf_object_load(), which means if we only open bpf object but not load it, setting attach target may leak btf_vmlinux.
So let's free btf_vmlinux in bpf_object__close() anyway.
--- tools/lib/bpf/libbpf.c | 1 + 1 file changed, 1 insertion(+)
tools/lib/bpf/libbpf.c +1 -0
@@ -8356,6 +8356,7 @@ void bpf_object__close(struct bpf_object *obj)bpf_object__elf_finish (obj);bpf_object_unload (obj);btf__free (obj->btf); +btf__free (obj->btf_vmlinux);btf_ext__free (obj->btf_ext);for (i =0 ; i < obj->nr_maps; i++)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 59/211 wifi: ath12k: Fix memory leak in rx_desc and tx_desc
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rajat Soni <[email protected]>
[ Upstream commit afb522b36e76acaa9f8fc06d0a9742d841c47c16 ]
Currently when ath12k_dp_cc_desc_init() is called we allocate memory to rx_descs and tx_descs. In ath12k_dp_cc_cleanup(), during descriptor cleanup rx_descs and tx_descs memory is not freed.
This is cause of memory leak. These allocated memory should be freed in ath12k_dp_cc_cleanup.
In ath12k_dp_cc_desc_init(), we can save base address of rx_descs and tx_descs. In ath12k_dp_cc_cleanup(), we can free rx_descs and tx_descs memory using their base address.
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1
--- drivers/net/wireless/ath/ath12k/dp.c | 30 +++++++++++++++++++++++++++- drivers/net/wireless/ath/ath12k/dp.h | 2 ++ 2 files changed, 31 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath12k/dp.c +29 -1
@@ -1129,6 +1129,7 @@ static void ath12k_dp_cc_cleanup(struct ath12k_base *ab)struct ath12k_dp *dp = &ab->dp;struct sk_buff *skb;int i; +u32 pool_id, tx_spt_page;if (!dp->spt_info)return ;
@@ -1148,6 +1149,14 @@ static void ath12k_dp_cc_cleanup(struct ath12k_base *ab)dev_kfree_skb_any (skb); } +for (i =0 ; i <ATH12K_NUM_RX_SPT_PAGES ; i++) { +if (!dp->spt_info->rxbaddr[i]) +continue ; + +kfree (dp->spt_info->rxbaddr[i]); + dp->spt_info->rxbaddr[i] =NULL ; + } +spin_unlock_bh (&dp->rx_desc_lock);/* TX Descriptor cleanup */
@@ -1170,6 +1179,21 @@ static void ath12k_dp_cc_cleanup(struct ath12k_base *ab)spin_unlock_bh (&dp->tx_desc_lock[i]); } +for (pool_id =0 ; pool_id <ATH12K_HW_MAX_QUEUES ; pool_id++) { +spin_lock_bh (&dp->tx_desc_lock[pool_id]); + +for (i =0 ; i <ATH12K_TX_SPT_PAGES_PER_POOL ; i++) { + tx_spt_page = i + pool_id *ATH12K_TX_SPT_PAGES_PER_POOL ; +if (!dp->spt_info->txbaddr[tx_spt_page]) +continue ; + +kfree (dp->spt_info->txbaddr[tx_spt_page]); + dp->spt_info->txbaddr[tx_spt_page] =NULL ; + } + +spin_unlock_bh (&dp->tx_desc_lock[pool_id]); + } +/* unmap SPT pages */ for (i =0 ; i < dp->num_spt_pages; i++) {if (!dp->spt_info[i].vaddr)
@@ -1343,6 +1367,8 @@ static int ath12k_dp_cc_desc_init(struct ath12k_base *ab)return -ENOMEM ; } + dp->spt_info->rxbaddr[i] = &rx_descs[0 ]; +for (j =0 ; j <ATH12K_MAX_SPT_ENTRIES ; j++) { rx_descs[j].cookie =ath12k_dp_cc_cookie_gen (i, j); rx_descs[j].magic =ATH12K_DP_RX_DESC_MAGIC ;
@@ -1368,8 +1394,10 @@ static int ath12k_dp_cc_desc_init(struct ath12k_base *ab)return -ENOMEM ; } + tx_spt_page = i + pool_id *ATH12K_TX_SPT_PAGES_PER_POOL ; + dp->spt_info->txbaddr[tx_spt_page] = &tx_descs[0 ]; +for (j =0 ; j <ATH12K_MAX_SPT_ENTRIES ; j++) { - tx_spt_page = i + pool_id *ATH12K_TX_SPT_PAGES_PER_POOL ; ppt_idx =ATH12K_NUM_RX_SPT_PAGES + tx_spt_page; tx_descs[j].desc_id =ath12k_dp_cc_cookie_gen (ppt_idx, j); tx_descs[j].pool_id = pool_id;
drivers/net/wireless/ath/ath12k/dp.h +2 -0
@@ -289,6 +289,8 @@ struct ath12k_tx_desc_info {struct ath12k_spt_info {dma_addr_t paddr;u64 *vaddr; +struct ath12k_rx_desc_info *rxbaddr[ATH12K_NUM_RX_SPT_PAGES ]; +struct ath12k_tx_desc_info *txbaddr[ATH12K_NUM_TX_SPT_PAGES ]; };struct ath12k_reo_queue_ref {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 60/211 wifi: ath12k: add check max message length while scanning with extraie
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wen Gong <[email protected]>
[ Upstream commit 2f5124e86ae74b7ba24c9ae2644107b750cbf38f ]
Currently the extraie length is directly used to allocate skb buffer. When the length of skb is greater than the max message length which firmware supports, error will happen in firmware side.
Hence add check for the skb length and drop extraie when overflow and print a message.
Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4
--- drivers/net/wireless/ath/ath12k/wmi.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-)
drivers/net/wireless/ath/ath12k/wmi.c +13 -7
@@ -2162,12 +2162,6 @@ int ath12k_wmi_send_scan_start_cmd(struct ath12k *ar,if (arg->num_bssid) len +=sizeof (*bssid) * arg->num_bssid; - len +=TLV_HDR_SIZE ; -if (arg->extraie.len) - extraie_len_with_pad = -roundup (arg->extraie.len,sizeof (u32)); - len += extraie_len_with_pad; -if (arg->num_hint_bssid) len +=TLV_HDR_SIZE + arg->num_hint_bssid *sizeof (*hint_bssid);
@@ -2176,6 +2170,18 @@ int ath12k_wmi_send_scan_start_cmd(struct ath12k *ar, len +=TLV_HDR_SIZE + arg->num_hint_s_ssid *sizeof (*s_ssid); + len +=TLV_HDR_SIZE ; +if (arg->extraie.len) + extraie_len_with_pad = +roundup (arg->extraie.len,sizeof (u32)); +if (extraie_len_with_pad <= (wmi->wmi_ab->max_msg_len[ar->pdev_idx] - len)) { + len += extraie_len_with_pad; + }else { +ath12k_warn (ar->ab,"discard large size %d bytes extraie for scan start\n" , + arg->extraie.len); + extraie_len_with_pad =0 ; + } + skb =ath12k_wmi_alloc_skb (wmi->wmi_ab, len);if (!skb)return -ENOMEM ;
@@ -2265,7 +2271,7 @@ int ath12k_wmi_send_scan_start_cmd(struct ath12k *ar, tlv->header =ath12k_wmi_tlv_hdr (WMI_TAG_ARRAY_BYTE , len); ptr +=TLV_HDR_SIZE ; -if (arg->extraie.len) +if (extraie_len_with_pad)memcpy (ptr, arg->extraie.ptr, arg->extraie.len);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 61/211 Fix nomenclature for USB and PCI wireless devices
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
[ Upstream commit 5d7cf67f72ae34d38e090bdfa673da4aefe4048e ]
A mouse that uses a USB connection is called a "USB mouse" device (or "USB mouse" for short), not a "mouse USB" device. By analogy, a WiFi adapter that connects to the host computer via USB is a "USB wireless" device, not a "wireless USB" device. (The latter term more properly refers to a defunct Wireless USB specification, which described a technology for sending USB protocol messages over an ultra wideband radio link.)
Similarly for a WiFi adapter card that plugs into a PCIe slot: It is a "PCIe wireless" device, not a "wireless PCIe" device.
Rephrase the text in the kernel source where the word ordering is wrong.
--- drivers/net/wireless/ath/ath10k/pci.c | 2 +- drivers/net/wireless/ath/ath10k/usb.c | 2 +- drivers/net/wireless/ath/ath11k/pci.c | 2 +- drivers/net/wireless/ath/ath12k/pci.c | 2 +- drivers/net/wireless/atmel/at76c50x-usb.c | 8 ++-- .../wireless/intersil/orinoco/orinoco_usb.c | 12 ++--- drivers/net/wireless/legacy/rndis_wlan.c | 2 +- .../net/wireless/mediatek/mt76/mt7603/Kconfig | 2 +- .../net/wireless/mediatek/mt76/mt7615/Kconfig | 2 +- .../net/wireless/mediatek/mt76/mt76x0/Kconfig | 4 +- .../net/wireless/mediatek/mt76/mt76x2/Kconfig | 4 +- .../net/wireless/mediatek/mt76/mt7915/Kconfig | 2 +- .../net/wireless/mediatek/mt76/mt7996/Kconfig | 2 +- drivers/net/wireless/mediatek/mt7601u/Kconfig | 2 +- drivers/net/wireless/purelifi/plfxlc/Kconfig | 2 +- drivers/net/wireless/ralink/rt2x00/Kconfig | 2 +- drivers/net/wireless/realtek/rtw88/pci.c | 2 +- drivers/net/wireless/realtek/rtw88/usb.c | 2 +- drivers/net/wireless/realtek/rtw89/pci.c | 2 +- drivers/net/wireless/zydas/zd1201.c | 6 +-- drivers/platform/x86/eeepc-laptop.c | 2 +- drivers/staging/wlan-ng/prism2usb.c | 48 +++++++++---------- 22 files changed, 57 insertions(+), 57 deletions(-)
drivers/net/wireless/ath/ath10k/pci.c +1 -1
@@ -3817,7 +3817,7 @@ static void __exit ath10k_pci_exit(void)module_exit (ath10k_pci_exit);MODULE_AUTHOR ("Qualcomm Atheros" ); -MODULE_DESCRIPTION ("Driver support for Qualcomm Atheros 802.11ac WLAN PCIe/AHB devices" ); +MODULE_DESCRIPTION ("Driver support for Qualcomm Atheros PCIe/AHB 802.11ac WLAN devices" );MODULE_LICENSE ("Dual BSD/GPL" );/* QCA988x 2.0 firmware files */
drivers/net/wireless/ath/ath10k/usb.c +1 -1
@@ -1126,5 +1126,5 @@ static struct usb_driver ath10k_usb_driver = {module_usb_driver (ath10k_usb_driver);MODULE_AUTHOR ("Atheros Communications, Inc." ); -MODULE_DESCRIPTION ("Driver support for Qualcomm Atheros 802.11ac WLAN USB devices" ); +MODULE_DESCRIPTION ("Driver support for Qualcomm Atheros USB 802.11ac WLAN devices" );MODULE_LICENSE ("Dual BSD/GPL" );
drivers/net/wireless/ath/ath11k/pci.c +1 -1
@@ -1036,7 +1036,7 @@ static void ath11k_pci_exit(void)module_exit (ath11k_pci_exit); -MODULE_DESCRIPTION ("Driver support for Qualcomm Technologies 802.11ax WLAN PCIe devices" ); +MODULE_DESCRIPTION ("Driver support for Qualcomm Technologies PCIe 802.11ax WLAN devices" );MODULE_LICENSE ("Dual BSD/GPL" );/* firmware files */
drivers/net/wireless/ath/ath12k/pci.c +1 -1
@@ -1411,5 +1411,5 @@ static void ath12k_pci_exit(void)module_exit (ath12k_pci_exit); -MODULE_DESCRIPTION ("Driver support for Qualcomm Technologies 802.11be WLAN PCIe devices" ); +MODULE_DESCRIPTION ("Driver support for Qualcomm Technologies PCIe 802.11be WLAN devices" );MODULE_LICENSE ("Dual BSD/GPL" );
drivers/net/wireless/atmel/at76c50x-usb.c +4 -4
@@ -10,7 +10,7 @@* Copyright (c) 2007 Kalle Valo <[email protected]> * Copyright (c) 2010 Sebastian Smolorz <[email protected]> * -* This file is part of the Berlios driver for WLAN USB devices based on the +* This file is part of the Berlios driver for USB WLAN devices based on the * Atmel AT76C503A/505/505A. * * Some iw_handler code was taken from airo.c, (C) 1999 Benjamin Reed
@@ -143,7 +143,7 @@ static const struct usb_device_id dev_table[] = { { USB_DEVICE(0x0cde, 0x0001), USB_DEVICE_DATA(BOARD_503_ISL3861) },/* Dynalink/Askey WLL013 (intersil) */ { USB_DEVICE(0x069a, 0x0320), USB_DEVICE_DATA(BOARD_503_ISL3861) }, -/* EZ connect 11Mpbs Wireless USB Adapter SMC2662W v1 */ +/* EZ connect 11Mpbs USB Wireless Adapter SMC2662W v1 */ { USB_DEVICE(0x0d5c, 0xa001), USB_DEVICE_DATA(BOARD_503_ISL3861) },/* BenQ AWL300 */ { USB_DEVICE(0x04a5, 0x9000), USB_DEVICE_DATA(BOARD_503_ISL3861) },
@@ -195,7 +195,7 @@ static const struct usb_device_id dev_table[] = { { USB_DEVICE(0x04a5, 0x9001), USB_DEVICE_DATA(BOARD_503) },/* 3Com 3CRSHEW696 */ { USB_DEVICE(0x0506, 0x0a01), USB_DEVICE_DATA(BOARD_503) }, -/* Siemens Santis ADSL WLAN USB adapter WLL 013 */ +/* Siemens Santis ADSL USB WLAN adapter WLL 013 */ { USB_DEVICE(0x0681, 0x001b), USB_DEVICE_DATA(BOARD_503) },/* Belkin F5D6050, version 2 */ { USB_DEVICE(0x050d, 0x0050), USB_DEVICE_DATA(BOARD_503) },
@@ -238,7 +238,7 @@ static const struct usb_device_id dev_table[] = { { USB_DEVICE(0x1915, 0x2233), USB_DEVICE_DATA(BOARD_505_2958) },/* Xterasys XN-2122B, IBlitzz BWU613B/BWU613SB */ { USB_DEVICE(0x12fd, 0x1001), USB_DEVICE_DATA(BOARD_505_2958) }, -/* Corega WLAN USB Stick 11 */ +/* Corega USB WLAN Stick 11 */ { USB_DEVICE(0x07aa, 0x7613), USB_DEVICE_DATA(BOARD_505_2958) },/* Microstar MSI Box MS6978 */ { USB_DEVICE(0x0db0, 0x1020), USB_DEVICE_DATA(BOARD_505_2958) },
drivers/net/wireless/intersil/orinoco/orinoco_usb.c +6 -6
@@ -129,18 +129,18 @@ MODULE_FIRMWARE("orinoco_ezusb_fw");#define USB_AVAYA8_VENDOR_ID 0x0D98#define USB_AVAYAE_VENDOR_ID 0x0D9E -#define USB_AVAYA_WIRELESS_ID 0x0300/* Avaya Wireless USB Card */ +#define USB_AVAYA_WIRELESS_ID 0x0300/* Avaya USB Wireless Card */ #define USB_AGERE_VENDOR_ID 0x0D4E/* Agere Systems */ -#define USB_AGERE_MODEL0801_ID 0x1000/* Wireless USB Card Model 0801 */ -#define USB_AGERE_MODEL0802_ID 0x1001/* Wireless USB Card Model 0802 */ -#define USB_AGERE_REBRANDED_ID 0x047A/* WLAN USB Card */ +#define USB_AGERE_MODEL0801_ID 0x1000/* USB Wireless Card Model 0801 */ +#define USB_AGERE_MODEL0802_ID 0x1001/* USB Wireless Card Model 0802 */ +#define USB_AGERE_REBRANDED_ID 0x047A/* USB WLAN Card */ #define USB_ELSA_VENDOR_ID 0x05CC#define USB_ELSA_AIRLANCER_ID 0x3100/* ELSA AirLancer USB-11 */ #define USB_LEGEND_VENDOR_ID 0x0E7C -#define USB_LEGEND_JOYNET_ID 0x0300/* Joynet WLAN USB Card */ +#define USB_LEGEND_JOYNET_ID 0x0300/* Joynet USB WLAN Card */ #define USB_SAMSUNG_VENDOR_ID 0x04E8#define USB_SAMSUNG_SEW2001U1_ID 0x5002/* Samsung SEW-2001u Card */
@@ -154,7 +154,7 @@ MODULE_FIRMWARE("orinoco_ezusb_fw");#define USB_FUJITSU_E1100_ID 0x1002/* connect2AIR WLAN E-1100 USB */ #define USB_2WIRE_VENDOR_ID 0x1630 -#define USB_2WIRE_WIRELESS_ID 0xff81/* 2Wire Wireless USB adapter */ +#define USB_2WIRE_WIRELESS_ID 0xff81/* 2Wire USB Wireless adapter */ #define EZUSB_REQUEST_FW_TRANS 0xA0
drivers/net/wireless/legacy/rndis_wlan.c +1 -1
@@ -1,6 +1,6 @@// SPDX-License-Identifier: GPL-2.0-or-later /* -* Driver for RNDIS based wireless USB devices. +* Driver for RNDIS based USB wireless devices. * * Copyright (C) 2007 by Bjorge Dijkstra <[email protected]> * Copyright (C) 2008-2009 by Jussi Kivilinna <[email protected]>
drivers/net/wireless/mediatek/mt76/mt7603/Kconfig +1 -1
@@ -5,7 +5,7 @@ config MT7603E depends on MAC80211 depends on PCI help - This adds support for MT7603E wireless PCIe devices and the WLAN core + This adds support for MT7603E PCIe wireless devices and the WLAN core on MT7628/MT7688 SoC devices. This family supports IEEE 802.11n 2x2 to 300Mbps PHY rate
drivers/net/wireless/mediatek/mt76/mt7615/Kconfig +1 -1
@@ -11,7 +11,7 @@ config MT7615E depends on MAC80211 depends on PCI help - This adds support for MT7615-based wireless PCIe devices, + This adds support for MT7615-based PCIe wireless devices, which support concurrent dual-band operation at both 5GHz and 2.4GHz, IEEE 802.11ac 4x4:4SS 1733Mbps PHY rate, wave2 MU-MIMO up to 4 users/group and 160MHz channels.
drivers/net/wireless/mediatek/mt76/mt76x0/Kconfig +2 -2
@@ -10,7 +10,7 @@ config MT76x0U depends on MAC80211 depends on USB help - This adds support for MT7610U-based wireless USB 2.0 dongles, + This adds support for MT7610U-based USB 2.0 wireless dongles, which comply with IEEE 802.11ac standards and support 1x1 433Mbps PHY rate.
@@ -22,7 +22,7 @@ config MT76x0E depends on MAC80211 depends on PCI help - This adds support for MT7610/MT7630-based wireless PCIe devices, + This adds support for MT7610/MT7630-based PCIe wireless devices, which comply with IEEE 802.11ac standards and support 1x1 433Mbps PHY rate.
drivers/net/wireless/mediatek/mt76/mt76x2/Kconfig +2 -2
@@ -9,7 +9,7 @@ config MT76x2E depends on MAC80211 depends on PCI help - This adds support for MT7612/MT7602/MT7662-based wireless PCIe + This adds support for MT7612/MT7602/MT7662-based PCIe wireless devices, which comply with IEEE 802.11ac standards and support 2SS to 866Mbit/s PHY rate.
@@ -22,7 +22,7 @@ config MT76x2U depends on MAC80211 depends on USB help - This adds support for MT7612U-based wireless USB 3.0 dongles, + This adds support for MT7612U-based USB 3.0 wireless dongles, which comply with IEEE 802.11ac standards and support 2SS to 866Mbit/s PHY rate.
drivers/net/wireless/mediatek/mt76/mt7915/Kconfig +1 -1
@@ -7,7 +7,7 @@ config MT7915E depends on PCI select RELAY help - This adds support for MT7915-based wireless PCIe devices, + This adds support for MT7915-based PCIe wireless devices, which support concurrent dual-band operation at both 5GHz and 2.4GHz IEEE 802.11ax 4x4:4SS 1024-QAM, 160MHz channels, OFDMA, spatial reuse and dual carrier modulation.
drivers/net/wireless/mediatek/mt76/mt7996/Kconfig +1 -1
@@ -7,7 +7,7 @@ config MT7996E depends on MAC80211 depends on PCI help - This adds support for MT7996-based wireless PCIe devices, + This adds support for MT7996-based PCIe wireless devices, which support concurrent tri-band operation at 6GHz, 5GHz, and 2.4GHz IEEE 802.11be 4x4:4SS 4096-QAM, 320MHz channels.
drivers/net/wireless/mediatek/mt7601u/Kconfig +1 -1
@@ -4,4 +4,4 @@ config MT7601U depends on MAC80211 depends on USB help - This adds support for MT7601U-based wireless USB dongles. + This adds support for MT7601U-based USB wireless dongles.
drivers/net/wireless/purelifi/plfxlc/Kconfig +1 -1
@@ -3,7 +3,7 @@ config PLFXLC tristate "pureLiFi X, XL, XC device support" depends on CFG80211 && MAC80211 && USB help - This option adds support for pureLiFi LiFi wireless USB + This option adds support for pureLiFi LiFi USB wireless adapters. The pureLiFi X, XL, XC USB devices are based on 802.11 OFDM PHY but uses light as the transmission medium. The driver supports common 802.11 encryption/authentication
drivers/net/wireless/ralink/rt2x00/Kconfig +1 -1
@@ -170,7 +170,7 @@ config RT2800USB_RT35XX config RT2800USB_RT3573 bool "rt2800usb - Include support for rt3573 devices (EXPERIMENTAL)" help - This enables support for RT3573 chipset based wireless USB devices + This enables support for RT3573 chipset based USB wireless devices in the rt2800usb driver. config RT2800USB_RT53XX
drivers/net/wireless/realtek/rtw88/pci.c +1 -1
@@ -1828,5 +1828,5 @@ void rtw_pci_shutdown(struct pci_dev *pdev)EXPORT_SYMBOL (rtw_pci_shutdown);MODULE_AUTHOR ("Realtek Corporation" ); -MODULE_DESCRIPTION ("Realtek 802.11ac wireless PCI driver" ); +MODULE_DESCRIPTION ("Realtek PCI 802.11ac wireless driver" );MODULE_LICENSE ("Dual BSD/GPL" );
drivers/net/wireless/realtek/rtw88/usb.c +1 -1
@@ -930,5 +930,5 @@ void rtw_usb_disconnect(struct usb_interface *intf)EXPORT_SYMBOL (rtw_usb_disconnect);MODULE_AUTHOR ("Realtek Corporation" ); -MODULE_DESCRIPTION ("Realtek 802.11ac wireless USB driver" ); +MODULE_DESCRIPTION ("Realtek USB 802.11ac wireless driver" );MODULE_LICENSE ("Dual BSD/GPL" );
drivers/net/wireless/realtek/rtw89/pci.c +1 -1
@@ -3939,5 +3939,5 @@ void rtw89_pci_remove(struct pci_dev *pdev)EXPORT_SYMBOL (rtw89_pci_remove);MODULE_AUTHOR ("Realtek Corporation" ); -MODULE_DESCRIPTION ("Realtek 802.11ax wireless PCI driver" ); +MODULE_DESCRIPTION ("Realtek PCI 802.11ax wireless driver" );MODULE_LICENSE ("Dual BSD/GPL" );
drivers/net/wireless/zydas/zd1201.c +3 -3
@@ -1,6 +1,6 @@// SPDX-License-Identifier: GPL-2.0-only /* -* Driver for ZyDAS zd1201 based wireless USB devices. +* Driver for ZyDAS zd1201 based USB wireless devices. * * Copyright (c) 2004, 2005 Jeroen Vreeken ([email protected]) *
@@ -23,8 +23,8 @@#include "zd1201.h" static const struct usb_device_id zd1201_table[] = { - {USB_DEVICE (0x0586 ,0x3400 )},/* Peabird Wireless USB Adapter */ - {USB_DEVICE (0x0ace ,0x1201 )},/* ZyDAS ZD1201 Wireless USB Adapter */ + {USB_DEVICE (0x0586 ,0x3400 )},/* Peabird USB Wireless Adapter */ + {USB_DEVICE (0x0ace ,0x1201 )},/* ZyDAS ZD1201 USB Wireless Adapter */ {USB_DEVICE (0x050d ,0x6051 )},/* Belkin F5D6051 usb adapter */ {USB_DEVICE (0x0db0 ,0x6823 )},/* MSI UB11B usb adapter */ {USB_DEVICE (0x1044 ,0x8004 )},/* Gigabyte GN-WLBZ101 */
drivers/platform/x86/eeepc-laptop.c +1 -1
@@ -1394,7 +1394,7 @@ static int eeepc_acpi_add(struct acpi_device *device)* and machine-specific scripts find the fixed name convenient. But * It's also good for us to exclude multiple instances because both * our hwmon and our wlan rfkill subdevice use global ACPI objects -* (the EC and the wlan PCI slot respectively). +* (the EC and the PCI wlan slot respectively). */ result =eeepc_platform_init (eeepc);if (result)
drivers/staging/wlan-ng/prism2usb.c +24 -24
69 lines not on this page · raw message
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 62/211 bpf: Consider non-owning refs trusted
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Marchevsky <[email protected]>
[ Upstream commit 2a6d50b50d6d589d43a90d6ca990b8b811e67701 ]
Recent discussions around default kptr "trustedness" led to changes such as commit 6fcd486b3a0a ("bpf: Refactor RCU enforcement in the verifier."). One of the conclusions of those discussions, as expressed in code and comments in that patch, is that we'd like to move away from 'raw' PTR_TO_BTF_ID without some type flag or other register state indicating trustedness. Although PTR_TRUSTED and PTR_UNTRUSTED flags mark this state explicitly, the verifier currently considers trustedness implied by other register state. For example, owning refs to graph collection nodes must have a nonzero ref_obj_id, so they pass the is_trusted_reg check despite having no explicit PTR_{UN}TRUSTED flag. This patch makes trustedness of non-owning refs to graph collection nodes explicit as well.
By definition, non-owning refs are currently trusted. Although the ref has no control over pointee lifetime, due to non-owning ref clobbering rules (see invalidate_non_owning_refs) dereferencing a non-owning ref is safe in the critical section controlled by bpf_spin_lock associated with its owning collection.
Note that the previous statement does not hold true for nodes with shared ownership due to the use-after-free issue that this series is addressing. True shared ownership was disabled by commit 7deca5eae833 ("bpf: Disable bpf_refcount_acquire kfunc calls until race conditions are fixed"), though, so the statement holds for now. Further patches in the series will change the trustedness state of non-owning refs before re-enabling bpf_refcount_acquire.
Let's add NON_OWN_REF type flag to BPF_REG_TRUSTED_MODIFIERS such that a non-owning ref reg state would pass is_trusted_reg check. Somewhat surprisingly, this doesn't result in any change to user-visible functionality elsewhere in the verifier: graph collection nodes are all marked MEM_ALLOC, which tends to be handled in separate codepaths from "raw" PTR_TO_BTF_ID. Regardless, let's be explicit here and document the current state of things before changing it elsewhere in the series.
--- include/linux/bpf_verifier.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/bpf_verifier.h +1 -1
@@ -745,7 +745,7 @@ static inline bool bpf_prog_check_recur(const struct bpf_prog *prog) } } -#define BPF_REG_TRUSTED_MODIFIERS (MEM_ALLOC | PTR_TRUSTED) +#define BPF_REG_TRUSTED_MODIFIERS (MEM_ALLOC | PTR_TRUSTED | NON_OWN_REF)static inline bool bpf_type_has_unsafe_modifiers (u32 type) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 63/211 bpf: Consider non-owning refs to refcounted nodes RCU protected
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Marchevsky <[email protected]>
[ Upstream commit 0816b8c6bf7fc87cec4273dc199e8f0764b9e7b1 ]
An earlier patch in the series ensures that the underlying memory of nodes with bpf_refcount - which can have multiple owners - is not reused until RCU grace period has elapsed. This prevents use-after-free with non-owning references that may point to recently-freed memory. While RCU read lock is held, it's safe to dereference such a non-owning ref, as by definition RCU GP couldn't have elapsed and therefore underlying memory couldn't have been reused.
Quoted 1 line
From the perspective of verifier "trustedness" non-owning refs to
refcounted nodes are now trusted only in RCU CS and therefore should no longer pass is_trusted_reg, but rather is_rcu_reg. Let's mark them MEM_RCU in order to reflect this new state.
--- include/linux/bpf.h | 3 ++- kernel/bpf/verifier.c | 13 ++++++++++++- 2 files changed, 14 insertions(+), 2 deletions(-)
include/linux/bpf.h +2 -1
@@ -640,7 +640,8 @@ enum bpf_type_flag {MEM_RCU =BIT (13 +BPF_BASE_TYPE_BITS ),/* Used to tag PTR_TO_BTF_ID | MEM_ALLOC references which are non-owning. -* Currently only valid for linked-list and rbtree nodes. +* Currently only valid for linked-list and rbtree nodes. If the nodes +* have a bpf_refcount_field, they must be tagged MEM_RCU as well. */ NON_OWN_REF = BIT(14 + BPF_BASE_TYPE_BITS),
kernel/bpf/verifier.c +12 -1
@@ -7841,6 +7841,7 @@ int check_func_arg_reg_off(struct bpf_verifier_env *env,case PTR_TO_BTF_ID |PTR_TRUSTED :case PTR_TO_BTF_ID |MEM_RCU :case PTR_TO_BTF_ID |MEM_ALLOC |NON_OWN_REF : +case PTR_TO_BTF_ID |MEM_ALLOC |NON_OWN_REF |MEM_RCU :/* When referenced PTR_TO_BTF_ID is passed to release function, * its fixed offset must be 0. In the other cases, fixed offset * can be non-zero. This was already checked above. So pass
@@ -10302,6 +10303,7 @@ static int process_kf_arg_ptr_to_btf_id(struct bpf_verifier_env *env,static int ref_set_non_owning (struct bpf_verifier_env *env,struct bpf_reg_state *reg) {struct bpf_verifier_state *state = env->cur_state; +struct btf_record *rec =reg_btf_record (reg);if (!state->active_lock.ptr) {verbose (env,"verifier internal error: ref_set_non_owning w/o active lock\n" );
@@ -10314,6 +10316,9 @@ static int ref_set_non_owning(struct bpf_verifier_env *env, struct bpf_reg_state } reg->type |=NON_OWN_REF ; +if (rec->refcount_off >=0 ) + reg->type |=MEM_RCU ; +return 0 ; }
@@ -11154,6 +11159,11 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,struct bpf_func_state *state;struct bpf_reg_state *reg; +if (in_rbtree_lock_required_cb (env) && (rcu_lock || rcu_unlock)) { +verbose (env,"Calling bpf_rcu_read_{lock,unlock} in unnecessary rbtree callback\n" ); +return -EACCES ; + } +if (rcu_lock) {verbose (env,"nested rcu read lock (kernel function %s)\n" , func_name);return -EINVAL ;
@@ -16453,7 +16463,8 @@ static int do_check(struct bpf_verifier_env *env)return -EINVAL ; } -if (env->cur_state->active_rcu_lock) { +if (env->cur_state->active_rcu_lock && + !in_rbtree_lock_required_cb (env)) {verbose (env,"bpf_rcu_read_unlock is missing\n" );return -EINVAL ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 64/211 drm/bridge: tc358762: Instruct DSI host to generate HSE packets
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit 362fa8f6e6a05089872809f4465bab9d011d05b3 ]
This bridge seems to need the HSE packet, otherwise the image is shifted up and corrupted at the bottom. This makes the bridge work with Samsung DSIM on i.MX8MM and i.MX8MP.
--- drivers/gpu/drm/bridge/tc358762.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/bridge/tc358762.c +1 -1
@@ -231,7 +231,7 @@ static int tc358762_probe(struct mipi_dsi_device *dsi) dsi->lanes =1 ; dsi->format =MIPI_DSI_FMT_RGB888 ; dsi->mode_flags =MIPI_DSI_MODE_VIDEO |MIPI_DSI_MODE_VIDEO_SYNC_PULSE | -MIPI_DSI_MODE_LPM ; +MIPI_DSI_MODE_LPM |MIPI_DSI_MODE_VIDEO_HSE ; ret =tc358762_parse_dt (ctx);if (ret <0 )
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 65/211 drm/edid: Add quirk for OSVR HDK 2.0
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ralph Campbell <[email protected]>
[ Upstream commit 98d4cb705bc00afd4a9a71cc1e84f7111682639a ]
The OSVR virtual reality headset HDK 2.0 uses a different EDID vendor and device identifier than the HDK 1.1 - 1.4 headsets. Add the HDK 2.0 vendor and device identifier to the quirks table so that window managers do not try to display the desktop screen on the headset display.
--- drivers/gpu/drm/drm_edid.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/drm_edid.c +1 -0
@@ -230,6 +230,7 @@ static const struct edid_quirk {/* OSVR HDK and HDK2 VR Headsets */ EDID_QUIRK ('S' ,'V' ,'R' ,0x1019 ,EDID_QUIRK_NON_DESKTOP ), + EDID_QUIRK('A', 'U', 'O', 0x1111, EDID_QUIRK_NON_DESKTOP), };/*
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 66/211 drm: bridge: samsung-dsim: Drain command transfer FIFO before transfer
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit 14806c6415820b1c4bc317655c40784d050a2edb ]
Wait until the command transfer FIFO is empty before loading in the next command. The previous behavior where the code waited until command transfer FIFO was not full suffered from transfer corruption, where the last command in the FIFO could be overwritten in case the FIFO indicates not full, but also does not have enough space to store another transfer yet.
--- drivers/gpu/drm/bridge/samsung-dsim.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/bridge/samsung-dsim.c +1 -1
@@ -1009,7 +1009,7 @@ static int samsung_dsim_wait_for_hdr_fifo(struct samsung_dsim *dsi) do { u32 reg = samsung_dsim_read(dsi, DSIM_FIFOCTRL_REG); - if (!(reg & DSIM_SFR_HEADER_FULL)) + if (reg & DSIM_SFR_HEADER_EMPTY) return 0; if (!cond_resched())
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 67/211 arm64: dts: qcom: sm6125-pdx201: correct ramoops pmsg-size
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit c42f5452de6ad2599c6e5e2a64c180a4ac835d27 ]
There is no 'msg-size' property in ramoops, so assume intention was for 'pmsg-size':
sm6125-sony-xperia-seine-pdx201.dtb: ramoops@ffc00000: Unevaluated properties are not allowed ('msg-size' was unexpected)
--- arch/arm64/boot/dts/qcom/sm6125-sony-xperia-seine-pdx201.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/sm6125-sony-xperia-seine-pdx201.dts +1 -1
@@ -79,7 +79,7 @@ pstore_mem: ramoops@ffc00000 { reg = <0x0 0xffc40000 0x0 0xc0000>; record-size = <0x1000>; console-size = <0x40000>; - msg-size = <0x20000 0x20000>; + pmsg-size = <0x20000>; }; cmdline_mem: memory@ffd00000 {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 68/211 arm64: dts: qcom: sm6125-sprout: correct ramoops pmsg-size
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 2951e7e7611a3ea04de98d0f1bfc4e7ec609ef29 ]
There is no 'msg-size' property in ramoops, so assume intention was for 'pmsg-size':
sm6125-xiaomi-laurel-sprout.dtb: ramoops@ffc00000: Unevaluated properties are not allowed ('msg-size' was unexpected)
--- arch/arm64/boot/dts/qcom/sm6125-xiaomi-laurel-sprout.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/sm6125-xiaomi-laurel-sprout.dts +1 -1
@@ -52,7 +52,7 @@ pstore_mem: ramoops@ffc00000 { reg = <0x0 0xffc40000 0x0 0xc0000>; record-size = <0x1000>; console-size = <0x40000>; - msg-size = <0x20000 0x20000>; + pmsg-size = <0x20000>; }; cmdline_mem: memory@ffd00000 {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 69/211 arm64: dts: qcom: sm6350: correct ramoops pmsg-size
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit c86b97a72065e06eacb993dc71fa9febc93422af ]
There is no 'msg-size' property in ramoops, so assume intention was for 'pmsg-size':
sm6350-sony-xperia-lena-pdx213.dtb: ramoops@ffc00000: Unevaluated properties are not allowed ('msg-size' was unexpected)
--- arch/arm64/boot/dts/qcom/sm6350.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/sm6350.dtsi +1 -1
@@ -673,7 +673,7 @@ ramoops: ramoops@ffc00000 { reg = <0 0xffc00000 0 0x100000>; record-size = <0x1000>; console-size = <0x40000>; - msg-size = <0x20000 0x20000>; + pmsg-size = <0x20000>; ecc-size = <16>; no-map; };
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 70/211 arm64: dts: qcom: sm8150-kumano: correct ramoops pmsg-size
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 4e6b942f092653ebcdbbc0819b2d1f08ab415bdc ]
There is no 'msg-size' property in ramoops, so assume intention was for 'pmsg-size':
sm8150-sony-xperia-kumano-griffin.dtb: ramoops@ffc00000: Unevaluated properties are not allowed ('msg-size' was unexpected)
--- arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/sm8150-sony-xperia-kumano.dtsi +1 -1
@@ -222,7 +222,7 @@ ramoops@ffc00000 { reg = <0x0 0xffc00000 0x0 0x100000>; record-size = <0x1000>; console-size = <0x40000>; - msg-size = <0x20000 0x20000>; + pmsg-size = <0x20000>; ecc-size = <16>; no-map; };
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 71/211 arm64: dts: qcom: sm8250-edo: correct ramoops pmsg-size
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 7dc3606f91427414d00a2fb09e6e0e32c14c2093 ]
There is no 'msg-size' property in ramoops, so assume intention was for 'pmsg-size':
sm8250-sony-xperia-edo-pdx206.dtb: ramoops@ffc00000: Unevaluated properties are not allowed ('msg-size' was unexpected)
--- arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/sm8250-sony-xperia-edo.dtsi +1 -1
@@ -126,7 +126,7 @@ ramoops@ffc00000 { reg = <0x0 0xffc00000 0x0 0x100000>; record-size = <0x1000>; console-size = <0x40000>; - msg-size = <0x20000 0x20000>; + pmsg-size = <0x20000>; ecc-size = <16>; no-map; };
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 72/211 drm/amdgpu: Increase soft IH ring size
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philip Yang <[email protected]>
[ Upstream commit bf80d34b6c58ad1c4f76067ecd460a148eab9d39 ]
Retry faults are delegated to soft IH ring and then processed by deferred worker. Current soft IH ring size PAGE_SIZE can store 128 entries, which may overflow and drop retry faults, causes HW stucks because the retry fault is not recovered.
Increase soft IH ring size to 8KB, enough to store 256 CAM entries because we clear the CAM entry after handling the retry fault from soft ring.
Define macro IH_RING_SIZE and IH_SW_RING_SIZE to remove duplicate constant.
Show warning message if soft IH ring overflows with CAM enabled because this should not happen.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ih.c | 8 ++++++-- drivers/gpu/drm/amd/amdgpu/amdgpu_ih.h | 7 +++++-- drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 2 +- drivers/gpu/drm/amd/amdgpu/ih_v6_0.c | 4 ++-- drivers/gpu/drm/amd/amdgpu/navi10_ih.c | 4 ++-- drivers/gpu/drm/amd/amdgpu/vega10_ih.c | 4 ++-- drivers/gpu/drm/amd/amdgpu/vega20_ih.c | 4 ++-- 7 files changed, 20 insertions(+), 13 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_ih.c +6 -2
@@ -138,6 +138,7 @@ void amdgpu_ih_ring_fini(struct amdgpu_device *adev, struct amdgpu_ih_ring *ih)/** * amdgpu_ih_ring_write - write IV to the ring buffer * +* @adev: amdgpu_device pointer * @ih: ih ring to write to * @iv: the iv to write * @num_dw: size of the iv in dw
@@ -145,8 +146,8 @@ void amdgpu_ih_ring_fini(struct amdgpu_device *adev, struct amdgpu_ih_ring *ih)* Writes an IV to the ring buffer using the CPU and increment the wptr. * Used for testing and delegating IVs to a software ring. */ -void amdgpu_ih_ring_write (struct amdgpu_ih_ring *ih,const uint32_t *iv, -unsigned int num_dw) +void amdgpu_ih_ring_write (struct amdgpu_device *adev,struct amdgpu_ih_ring *ih, +const uint32_t *iv,unsigned int num_dw) {uint32_t wptr =le32_to_cpu (*ih->wptr_cpu) >>2 ;unsigned int i;
@@ -161,6 +162,9 @@ void amdgpu_ih_ring_write(struct amdgpu_ih_ring *ih, const uint32_t *iv,if (wptr !=READ_ONCE (ih->rptr)) {wmb ();WRITE_ONCE (*ih->wptr_cpu,cpu_to_le32 (wptr)); + }else if (adev->irq.retry_cam_enabled) { +dev_warn_once (adev->dev,"IH soft ring buffer overflow 0x%X, 0x%X\n" , + wptr, ih->rptr); } }
drivers/gpu/drm/amd/amdgpu/amdgpu_ih.h +5 -2
@@ -27,6 +27,9 @@/* Maximum number of IVs processed at once */ #define AMDGPU_IH_MAX_NUM_IVS 32 +#define IH_RING_SIZE (256 * 1024) +#define IH_SW_RING_SIZE (8 * 1024)/* enough for 256 CAM entries */ +struct amdgpu_device ;struct amdgpu_iv_entry ;
@@ -97,8 +100,8 @@ struct amdgpu_ih_funcs {int amdgpu_ih_ring_init (struct amdgpu_device *adev,struct amdgpu_ih_ring *ih,unsigned ring_size,bool use_bus_addr);void amdgpu_ih_ring_fini (struct amdgpu_device *adev,struct amdgpu_ih_ring *ih); -void amdgpu_ih_ring_write (struct amdgpu_ih_ring *ih,const uint32_t *iv, -unsigned int num_dw); +void amdgpu_ih_ring_write (struct amdgpu_device *adev,struct amdgpu_ih_ring *ih, +const uint32_t *iv,unsigned int num_dw);int amdgpu_ih_wait_on_checkpoint_process_ts (struct amdgpu_device *adev,struct amdgpu_ih_ring *ih);int amdgpu_ih_process (struct amdgpu_device *adev,struct amdgpu_ih_ring *ih);
drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c +1 -1
@@ -493,7 +493,7 @@ void amdgpu_irq_delegate(struct amdgpu_device *adev,struct amdgpu_iv_entry *entry, unsigned int num_dw) { - amdgpu_ih_ring_write(&adev->irq.ih_soft, entry->iv_entry, num_dw); + amdgpu_ih_ring_write(adev, &adev->irq.ih_soft, entry->iv_entry, num_dw);schedule_work (&adev->irq.ih_soft_work); }
drivers/gpu/drm/amd/amdgpu/ih_v6_0.c +2 -2
@@ -535,7 +535,7 @@ static int ih_v6_0_sw_init(void *handle)* use bus address for ih ring by psp bl */ use_bus_addr = (adev->firmware.load_type ==AMDGPU_FW_LOAD_PSP ) ? false : true; - r =amdgpu_ih_ring_init (adev, &adev->irq.ih,256 *1024 , use_bus_addr); + r =amdgpu_ih_ring_init (adev, &adev->irq.ih,IH_RING_SIZE , use_bus_addr);if (r)return r;
@@ -548,7 +548,7 @@ static int ih_v6_0_sw_init(void *handle)/* initialize ih control register offset */ ih_v6_0_init_register_offset (adev); - r =amdgpu_ih_ring_init (adev, &adev->irq.ih_soft,PAGE_SIZE , true); + r =amdgpu_ih_ring_init (adev, &adev->irq.ih_soft,IH_SW_RING_SIZE , true);if (r)return r;
drivers/gpu/drm/amd/amdgpu/navi10_ih.c +2 -2
@@ -565,7 +565,7 @@ static int navi10_ih_sw_init(void *handle) use_bus_addr = false; else use_bus_addr = true; - r =amdgpu_ih_ring_init (adev, &adev->irq.ih,256 *1024 , use_bus_addr); + r =amdgpu_ih_ring_init (adev, &adev->irq.ih,IH_RING_SIZE , use_bus_addr);if (r)return r;
@@ -578,7 +578,7 @@ static int navi10_ih_sw_init(void *handle)/* initialize ih control registers offset */ navi10_ih_init_register_offset (adev); - r =amdgpu_ih_ring_init (adev, &adev->irq.ih_soft,PAGE_SIZE , true); + r =amdgpu_ih_ring_init (adev, &adev->irq.ih_soft,IH_SW_RING_SIZE , true);if (r)return r;
drivers/gpu/drm/amd/amdgpu/vega10_ih.c +2 -2
@@ -485,7 +485,7 @@ static int vega10_ih_sw_init(void *handle)if (r)return r; - r =amdgpu_ih_ring_init (adev, &adev->irq.ih,256 *1024 , true); + r =amdgpu_ih_ring_init (adev, &adev->irq.ih,IH_RING_SIZE , true);if (r)return r;
@@ -510,7 +510,7 @@ static int vega10_ih_sw_init(void *handle)/* initialize ih control registers offset */ vega10_ih_init_register_offset (adev); - r =amdgpu_ih_ring_init (adev, &adev->irq.ih_soft,PAGE_SIZE , true); + r =amdgpu_ih_ring_init (adev, &adev->irq.ih_soft,IH_SW_RING_SIZE , true);if (r)return r;
drivers/gpu/drm/amd/amdgpu/vega20_ih.c +2 -2
@@ -539,7 +539,7 @@ static int vega20_ih_sw_init(void *handle) (adev->ip_versions[OSSSYS_HWIP][0] == IP_VERSION(4, 4, 2))) use_bus_addr = false; - r =amdgpu_ih_ring_init (adev, &adev->irq.ih,256 *1024 , use_bus_addr); + r =amdgpu_ih_ring_init (adev, &adev->irq.ih,IH_RING_SIZE , use_bus_addr);if (r)return r;
@@ -565,7 +565,7 @@ static int vega20_ih_sw_init(void *handle)/* initialize ih control registers offset */ vega20_ih_init_register_offset (adev); - r =amdgpu_ih_ring_init (adev, &adev->irq.ih_soft,PAGE_SIZE , use_bus_addr); + r =amdgpu_ih_ring_init (adev, &adev->irq.ih_soft,IH_SW_RING_SIZE , use_bus_addr);if (r)return r;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 73/211 samples/hw_breakpoint: Fix kernel BUG invalid opcode: 0000
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rong Tao <[email protected]>
[ Upstream commit 910e230d5f1bb72c54532e94fbb1705095c7bab6 ]
Macro symbol_put() is defined as __symbol_put(__stringify(x))
ksym_name = "jiffies"
symbol_put(ksym_name)
will be resolved as
__symbol_put("ksym_name")which is clearly wrong. So symbol_put must be replaced with __symbol_put.
When we uninstall hw_breakpoint.ko (rmmod), a kernel bug occurs with the following error:
[11381.854152] kernel BUG at kernel/module/main.c:779! [11381.854159] invalid opcode: 0000 [#2] PREEMPT SMP PTI [11381.854163] CPU: 8 PID: 59623 Comm: rmmod Tainted: G D OE 6.2.9-200.fc37.x86_64 #1 [11381.854167] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./B360M-HDV, BIOS P3.20 10/23/2018 [11381.854169] RIP: 0010:__symbol_put+0xa2/0xb0 [11381.854175] Code: 00 e8 92 d2 f7 ff 65 8b 05 c3 2f e6 78 85 c0 74 1b 48 8b 44 24 30 65 48 2b 04 25 28 00 00 00 75 12 48 83 c4 38 c3 cc cc cc cc <0f> 0b 0f 1f 44 00 00 eb de e8 c0 df d8 00 90 90 90 90 90 90 90 90 [11381.854178] RSP: 0018:ffffad8ec6ae7dd0 EFLAGS: 00010246 [11381.854181] RAX: 0000000000000000 RBX: ffffffffc1fd1240 RCX: 000000000000000c [11381.854184] RDX: 000000000000006b RSI: ffffffffc02bf7c7 RDI: ffffffffc1fd001c [11381.854186] RBP: 000055a38b76e7c8 R08: ffffffff871ccfe0 R09: 0000000000000000 [11381.854188] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [11381.854190] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [11381.854192] FS: 00007fbf7c62c740(0000) GS:ffff8c5badc00000(0000) knlGS:0000000000000000 [11381.854195] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [11381.854197] CR2: 000055a38b7793f8 CR3: 0000000363e1e001 CR4: 00000000003726e0 [11381.854200] DR0: ffffffffb3407980 DR1: 0000000000000000 DR2: 0000000000000000 [11381.854202] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [11381.854204] Call Trace: [11381.854207] <TASK> [11381.854212] s_module_exit+0xc/0xff0 [symbol_getput] [11381.854219] __do_sys_delete_module.constprop.0+0x198/0x2f0 [11381.854225] do_syscall_64+0x58/0x80 [11381.854231] ? exit_to_user_mode_prepare+0x180/0x1f0 [11381.854237] ? syscall_exit_to_user_mode+0x17/0x40 [11381.854241] ? do_syscall_64+0x67/0x80 [11381.854245] ? syscall_exit_to_user_mode+0x17/0x40 [11381.854248] ? do_syscall_64+0x67/0x80 [11381.854252] ? exc_page_fault+0x70/0x170 [11381.854256] entry_SYSCALL_64_after_hwframe+0x72/0xdc
--- samples/hw_breakpoint/data_breakpoint.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
samples/hw_breakpoint/data_breakpoint.c +1 -1
@@ -70,7 +70,7 @@ static int __init hw_break_module_init(void) static void __exit hw_break_module_exit(void) {unregister_wide_hw_breakpoint (sample_hbp); -symbol_put (ksym_name); +__symbol_put (ksym_name);printk (KERN_INFO "HW Breakpoint for %s write uninstalled\n" , ksym_name); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 74/211 drm/amdgpu: Update ring scheduler info as needed
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lijo Lazar <[email protected]>
[ Upstream commit 6cb209ed68e45c8e4b71d97a037ac6b7dbce9b50 ]
Not all rings have scheduler associated. Only update scheduler data for rings with scheduler. It could result in out of bound access as total rings are more than those associated with particular IPs.
--- drivers/gpu/drm/amd/amdgpu/aqua_vanjaram_reg_init.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/aqua_vanjaram_reg_init.c +1 -1
@@ -134,7 +134,7 @@ static int aqua_vanjaram_xcp_sched_list_update(for (i =0 ; i <AMDGPU_MAX_RINGS ; i++) { ring = adev->rings[i]; -if (!ring || !ring->sched.ready) +if (!ring || !ring->sched.ready || ring->no_scheduler)continue ;aqua_vanjaram_xcp_gpu_sched_update (adev, ring, ring->xcp_id);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 75/211 drm/amd/display: Fix underflow issue on 175hz timing
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Ma <[email protected]>
[ Upstream commit 735688eb905db529efea0c78466fccc1461c3fde ]
[Why]
Screen underflows happen on 175hz timing for 3 plane overlay case.
[How]
Based on dst y prefetch value clamp to equ or oto for bandwidth calculation.
--- .../amd/display/dc/dml/dcn32/display_mode_vba_util_32.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c +6 -1
@@ -3459,6 +3459,7 @@ bool dml32_CalculatePrefetchSchedule(double TimeForFetchingMetaPTE =0 ;double TimeForFetchingRowInVBlank =0 ;double LinesToRequestPrefetchPixelData =0 ; +double LinesForPrefetchBandwidth =0 ;unsigned int HostVMDynamicLevelsTrips;double trip_to_mem;double Tvm_trips;
@@ -3888,11 +3889,15 @@ bool dml32_CalculatePrefetchSchedule( TimeForFetchingMetaPTE = Tvm_oto; TimeForFetchingRowInVBlank = Tr0_oto; *PrefetchBandwidth = prefetch_bw_oto; +/* Clamp to oto for bandwidth calculation */ + LinesForPrefetchBandwidth = dst_y_prefetch_oto; }else { *DestinationLinesForPrefetch = dst_y_prefetch_equ; TimeForFetchingMetaPTE = Tvm_equ; TimeForFetchingRowInVBlank = Tr0_equ; *PrefetchBandwidth = prefetch_bw_equ; +/* Clamp to equ for bandwidth calculation */ + LinesForPrefetchBandwidth = dst_y_prefetch_equ; } *DestinationLinesToRequestVMInVBlank =dml_ceil (4.0 * TimeForFetchingMetaPTE / LineTime,1.0 ) /4.0 ;
@@ -3900,7 +3905,7 @@ bool dml32_CalculatePrefetchSchedule( *DestinationLinesToRequestRowInVBlank =dml_ceil (4.0 * TimeForFetchingRowInVBlank / LineTime,1.0 ) /4.0 ; - LinesToRequestPrefetchPixelData = *DestinationLinesForPrefetch - + LinesToRequestPrefetchPixelData = LinesForPrefetchBandwidth - *DestinationLinesToRequestVMInVBlank -2 * *DestinationLinesToRequestRowInVBlank;#ifdef __DML_VBA_DEBUG__
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 76/211 ASoC: SOF: topology: simplify code to prevent static analysis warnings
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <[email protected]>
[ Upstream commit 55cb3dc271d81f1982c949a2ac483a6daf613b92 ]
make KCFLAGS='-fanalyzer' sound/soc/sof/intel/ reports a possible NULL pointer dereference.
sound/soc/sof/topology.c:1136:21: error: dereference of NULL ‘w’ [CWE-476] [-Werror=analyzer-null-dereference]
1136 | strcmp(w->sname, rtd->dai_link->stream_name))
The code is rather confusing and can be simplified to make static analysis happy. No functionality change.
--- sound/soc/sof/topology.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
sound/soc/sof/topology.c +3 -2
@@ -1117,10 +1117,11 @@ static void sof_disconnect_dai_widget(struct snd_soc_component *scomp, {struct snd_soc_card *card = scomp->card;struct snd_soc_pcm_runtime *rtd; +const char *sname = w->sname;struct snd_soc_dai *cpu_dai;int i, stream; -if (!w->sname) +if (!sname)return ;if (w->id == snd_soc_dapm_dai_out)
@@ -1133,7 +1134,7 @@ static void sof_disconnect_dai_widget(struct snd_soc_component *scomp,list_for_each_entry (rtd, &card->rtd_list, list) {/* does stream match DAI link ? */ if (!rtd->dai_link->stream_name || -strcmp (w->sname, rtd->dai_link->stream_name)) +strcmp (sname, rtd->dai_link->stream_name))continue ;for_each_rtd_cpu_dais (rtd, i, cpu_dai)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 77/211 ASoC: Intel: sof_sdw: Update BT offload config for soundwire config
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uday M Bhat <[email protected]>
[ Upstream commit a14aded9299187bb17ef90700eb2cf1120ef5885 ]
For soundwire config, SSP1 is used for BT offload. This is enabled in sof_sdw_quirk_table
--- sound/soc/intel/boards/sof_sdw.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
sound/soc/intel/boards/sof_sdw.c +3 -1
@@ -467,7 +467,9 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = {DMI_MATCH (DMI_SYS_VENDOR ,"Google" ), DMI_MATCH(DMI_PRODUCT_NAME, "Rex"), }, - .driver_data = (void *)(SOF_SDW_PCH_DMIC), + .driver_data = (void *)(SOF_SDW_PCH_DMIC | +SOF_BT_OFFLOAD_SSP (1 ) | + SOF_SSP_BT_OFFLOAD_PRESENT), }, /* LunarLake devices */ {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 78/211 ALSA: hda: intel-dsp-cfg: add LunarLake support
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <[email protected]>
[ Upstream commit d2852b8c045ebd31d753b06f2810df5be30ed56a ]
One more PCI ID for the road.
--- sound/hda/intel-dsp-config.c | 8 ++++++++ 1 file changed, 8 insertions(+)
sound/hda/intel-dsp-config.c +8 -0
@@ -481,6 +481,14 @@ static const struct config_entry config_table[] = { },#endif +/* Lunar Lake */ +#if IS_ENABLED (CONFIG_SND_SOC_SOF_LUNARLAKE ) +/* Lunarlake-P */ + { + .flags = FLAG_SOF | FLAG_SOF_ONLY_IF_DMIC_OR_SOUNDWIRE, + .device = PCI_DEVICE_ID_INTEL_HDA_LNL_P, + }, +#endif };static const struct config_entry *snd_intel_dsp_find_config
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 79/211 drm/amd/display: Use DTBCLK as refclk instead of DPREFCLK
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Austin Zheng <[email protected]>
[ Upstream commit 4a30cc2bd281fa176a68b5305cd3695d636152ad ]
[Why]
Flash of corruption observed when UCLK switching after transitioning from DTBCLK to DPREFCLK on subVP(DP) + subVP(HDMI) config Scenario where DPREFCLK is required instead of DTBCLK is not expected
[How]
Always set the DTBCLK source as DTBCLK0
--- drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dccg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dcn32/dcn32_dccg.c +2 -1
@@ -281,7 +281,8 @@ static void dccg32_set_dpstreamclk(struct dcn_dccg *dccg_dcn =TO_DCN_DCCG (dccg);/* set the dtbclk_p source */ -dccg32_set_dtbclk_p_src (dccg, src, otg_inst); +/* always program refclk as DTBCLK. No use-case expected to require DPREFCLK as refclk */ +dccg32_set_dtbclk_p_src (dccg,DTBCLK0 , otg_inst);/* enabled to select one of the DTBCLKs for pipe */ switch (dp_hpo_inst) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 80/211 drm/amd/display: Blocking invalid 420 modes on HDMI TMDS for DCN31
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Chen <[email protected]>
[ Upstream commit 026a71babf48efb6b9884a3a66fa31aec9e1ea54 ]
[Why & How]
HDMI TMDS does not have ODM support. Filtering 420 modes that exceed the 4096 FMT limitation on DCN31 will resolve intermittent corruptions issues.
--- .../gpu/drm/amd/display/dc/dml/dcn31/display_mode_vba_31.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dml/dcn31/display_mode_vba_31.c +3 -1
@@ -4135,7 +4135,9 @@ void dml31_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l }if (v->OutputFormat[k] == dm_420 && v->HActive[k] >DCN31_MAX_FMT_420_BUFFER_WIDTH && v->ODMCombineEnablePerState[i][k] != dm_odm_combine_mode_4to1) { -if (v->HActive[k] /2 >DCN31_MAX_FMT_420_BUFFER_WIDTH ) { +if (v->Output[k] == dm_hdmi) { + FMTBufferExceeded = true; + }else if (v->HActive[k] /2 >DCN31_MAX_FMT_420_BUFFER_WIDTH ) { v->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_4to1; v->PlaneRequiredDISPCLK = v->PlaneRequiredDISPCLKWithODMCombine4To1;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 81/211 drm/amd/display: Blocking invalid 420 modes on HDMI TMDS for DCN314
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Chen <[email protected]>
[ Upstream commit 4c6107a653ccf361cb1b6ba35d558a1a5e6e57ac ]
[Why & How]
HDMI TMDS does not have ODM support. Filtering 420 modes that exceed the 4096 FMT limitation on DCN314 will resolve intermittent corruptions issues.
--- .../gpu/drm/amd/display/dc/dml/dcn314/display_mode_vba_314.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dml/dcn314/display_mode_vba_314.c +3 -1
@@ -4227,7 +4227,9 @@ void dml314_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_ }if (v->OutputFormat[k] == dm_420 && v->HActive[k] >DCN314_MAX_FMT_420_BUFFER_WIDTH && v->ODMCombineEnablePerState[i][k] != dm_odm_combine_mode_4to1) { -if (v->HActive[k] /2 >DCN314_MAX_FMT_420_BUFFER_WIDTH ) { +if (v->Output[k] == dm_hdmi) { + FMTBufferExceeded = true; + }else if (v->HActive[k] /2 >DCN314_MAX_FMT_420_BUFFER_WIDTH ) { v->ODMCombineEnablePerState[i][k] = dm_odm_combine_mode_4to1; v->PlaneRequiredDISPCLK = v->PlaneRequiredDISPCLKWithODMCombine4To1;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 82/211 drm/amd/display: Use max memclk variable when setting max memclk
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alvin Lee <[email protected]>
[ Upstream commit 2b1b838ea8e5437ef06a29818d16e9efdfaf0037 ]
[Description]
In overclocking scenarios the max memclk could be higher than the DC mode limit. However, for configs that don't support MCLK switching we need to set the max memclk to the overclocked max instead of the DC mode max or we could result in underflow.
--- drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/clk_mgr/dcn32/dcn32_clk_mgr.c +1 -1
@@ -802,7 +802,7 @@ static void dcn32_set_hard_min_memclk(struct clk_mgr *clk_mgr_base, bool current khz_to_mhz_ceil(clk_mgr_base->clks.dramclk_khz)); else dcn32_smu_set_hard_min_by_freq(clk_mgr, PPCLK_UCLK, - clk_mgr_base->bw_params->clk_table.entries[clk_mgr_base->bw_params->clk_table.num_entries_per_clk.num_memclk_levels - 1].memclk_mhz); + clk_mgr_base->bw_params->max_memclk_mhz); }else {dcn32_smu_set_hard_min_by_freq (clk_mgr,PPCLK_UCLK , clk_mgr_base->bw_params->clk_table.entries[0 ].memclk_mhz);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 83/211 drm/msm/adreno: Use quirk identify hw_apriv
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <[email protected]>
[ Upstream commit 459f9e26e7d49f80f587d7592ccb78e00ab458e4 ]
Rather than just open coding a list of gpu-id matches.
Patchwork: https://patchwork.freedesktop.org/patch/549764/
--- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 3 +-- drivers/gpu/drm/msm/adreno/adreno_device.c | 4 ++++ drivers/gpu/drm/msm/adreno/adreno_gpu.h | 1 + 3 files changed, 6 insertions(+), 2 deletions(-)
drivers/gpu/drm/msm/adreno/a6xx_gpu.c +1 -2
@@ -2489,8 +2489,7 @@ struct msm_gpu *a6xx_gpu_init(struct drm_device *dev)/* Quirk data */ adreno_gpu->info = info; -if (adreno_is_a650 (adreno_gpu) ||adreno_is_a660_family (adreno_gpu)) - adreno_gpu->base.hw_apriv = true; + adreno_gpu->base.hw_apriv = !!(info->quirks &ADRENO_QUIRK_HAS_HW_APRIV );a6xx_llc_slices_init (pdev, a6xx_gpu);
drivers/gpu/drm/msm/adreno/adreno_device.c +4 -0
@@ -325,6 +325,7 @@ static const struct adreno_info gpulist[] = { }, .gmem = SZ_1M + SZ_128K, .inactive_period = DRM_MSM_INACTIVE_PERIOD, + .quirks = ADRENO_QUIRK_HAS_HW_APRIV, .init = a6xx_gpu_init, .zapfw = "a650_zap.mdt", .hwcg = a650_hwcg,
@@ -339,6 +340,7 @@ static const struct adreno_info gpulist[] = { }, .gmem = SZ_1M + SZ_512K, .inactive_period = DRM_MSM_INACTIVE_PERIOD, + .quirks = ADRENO_QUIRK_HAS_HW_APRIV, .init = a6xx_gpu_init, .zapfw = "a660_zap.mdt", .hwcg = a660_hwcg,
@@ -351,6 +353,7 @@ static const struct adreno_info gpulist[] = { }, .gmem = SZ_512K, .inactive_period = DRM_MSM_INACTIVE_PERIOD, + .quirks = ADRENO_QUIRK_HAS_HW_APRIV, .init = a6xx_gpu_init, .hwcg = a660_hwcg, .address_space_size = SZ_16G,
@@ -375,6 +378,7 @@ static const struct adreno_info gpulist[] = { }, .gmem = SZ_4M, .inactive_period = DRM_MSM_INACTIVE_PERIOD, + .quirks = ADRENO_QUIRK_HAS_HW_APRIV, .init = a6xx_gpu_init, .zapfw = "a690_zap.mdt", .hwcg = a690_hwcg,
drivers/gpu/drm/msm/adreno/adreno_gpu.h +1 -0
@@ -32,6 +32,7 @@ enum {#define ADRENO_QUIRK_TWO_PASS_USE_WFI BIT(0)#define ADRENO_QUIRK_FAULT_DETECT_MASK BIT(1)#define ADRENO_QUIRK_LMLOADKILL_DISABLE BIT(2) +#define ADRENO_QUIRK_HAS_HW_APRIV BIT(3)struct adreno_rev {uint8_t core;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 84/211 drm/msm/adreno: Use quirk to identify cached-coherent support
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <[email protected]>
[ Upstream commit 155668ef412fc82ff3172666831d95770141cdd6 ]
It is better to explicitly list it. With the move to opaque chip-id's for future devices, we should avoid trying to infer things like generation from the numerical value.
Patchwork: https://patchwork.freedesktop.org/patch/549765/
--- drivers/gpu/drm/msm/adreno/adreno_device.c | 23 +++++++++++++++------- drivers/gpu/drm/msm/adreno/adreno_gpu.h | 1 + 2 files changed, 17 insertions(+), 7 deletions(-)
drivers/gpu/drm/msm/adreno/adreno_device.c +16 -7
@@ -275,6 +275,7 @@ static const struct adreno_info gpulist[] = { }, .gmem = SZ_512K, .inactive_period = DRM_MSM_INACTIVE_PERIOD, + .quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT, .init = a6xx_gpu_init, }, { .rev = ADRENO_REV(6, 1, 9, ANY_ID),
@@ -286,6 +287,7 @@ static const struct adreno_info gpulist[] = { }, .gmem = SZ_512K, .inactive_period = DRM_MSM_INACTIVE_PERIOD, + .quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT, .init = a6xx_gpu_init, .zapfw = "a615_zap.mdt", .hwcg = a615_hwcg,
@@ -299,6 +301,7 @@ static const struct adreno_info gpulist[] = { }, .gmem = SZ_1M, .inactive_period = DRM_MSM_INACTIVE_PERIOD, + .quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT, .init = a6xx_gpu_init, .zapfw = "a630_zap.mdt", .hwcg = a630_hwcg,
@@ -312,6 +315,7 @@ static const struct adreno_info gpulist[] = { }, .gmem = SZ_1M, .inactive_period = DRM_MSM_INACTIVE_PERIOD, + .quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT, .init = a6xx_gpu_init, .zapfw = "a640_zap.mdt", .hwcg = a640_hwcg,
@@ -325,7 +329,8 @@ static const struct adreno_info gpulist[] = { }, .gmem = SZ_1M + SZ_128K, .inactive_period = DRM_MSM_INACTIVE_PERIOD, - .quirks = ADRENO_QUIRK_HAS_HW_APRIV, + .quirks =ADRENO_QUIRK_HAS_CACHED_COHERENT | + ADRENO_QUIRK_HAS_HW_APRIV, .init = a6xx_gpu_init, .zapfw = "a650_zap.mdt", .hwcg = a650_hwcg,
@@ -340,7 +345,8 @@ static const struct adreno_info gpulist[] = { }, .gmem = SZ_1M + SZ_512K, .inactive_period = DRM_MSM_INACTIVE_PERIOD, - .quirks = ADRENO_QUIRK_HAS_HW_APRIV, + .quirks =ADRENO_QUIRK_HAS_CACHED_COHERENT | + ADRENO_QUIRK_HAS_HW_APRIV, .init = a6xx_gpu_init, .zapfw = "a660_zap.mdt", .hwcg = a660_hwcg,
@@ -353,7 +359,8 @@ static const struct adreno_info gpulist[] = { }, .gmem = SZ_512K, .inactive_period = DRM_MSM_INACTIVE_PERIOD, - .quirks = ADRENO_QUIRK_HAS_HW_APRIV, + .quirks =ADRENO_QUIRK_HAS_CACHED_COHERENT | + ADRENO_QUIRK_HAS_HW_APRIV, .init = a6xx_gpu_init, .hwcg = a660_hwcg, .address_space_size = SZ_16G,
@@ -367,6 +374,7 @@ static const struct adreno_info gpulist[] = { }, .gmem = SZ_2M, .inactive_period = DRM_MSM_INACTIVE_PERIOD, + .quirks = ADRENO_QUIRK_HAS_CACHED_COHERENT, .init = a6xx_gpu_init, .zapfw = "a640_zap.mdt", .hwcg = a640_hwcg,
@@ -378,7 +386,8 @@ static const struct adreno_info gpulist[] = { }, .gmem = SZ_4M, .inactive_period = DRM_MSM_INACTIVE_PERIOD, - .quirks = ADRENO_QUIRK_HAS_HW_APRIV, + .quirks =ADRENO_QUIRK_HAS_CACHED_COHERENT | + ADRENO_QUIRK_HAS_HW_APRIV, .init = a6xx_gpu_init, .zapfw = "a690_zap.mdt", .hwcg = a690_hwcg,
@@ -590,9 +599,9 @@ static int adreno_bind(struct device *dev, struct device *master, void *data)if (ret)return ret; -if (config.rev.core >=6 ) -if (!adreno_has_gmu_wrapper (to_adreno_gpu (gpu))) - priv->has_cached_coherent = true; + priv->has_cached_coherent = + !!(info->quirks &ADRENO_QUIRK_HAS_CACHED_COHERENT ) && + !adreno_has_gmu_wrapper (to_adreno_gpu (gpu));return 0 ; }
drivers/gpu/drm/msm/adreno/adreno_gpu.h +1 -0
@@ -33,6 +33,7 @@ enum {#define ADRENO_QUIRK_FAULT_DETECT_MASK BIT(1)#define ADRENO_QUIRK_LMLOADKILL_DISABLE BIT(2)#define ADRENO_QUIRK_HAS_HW_APRIV BIT(3) +#define ADRENO_QUIRK_HAS_CACHED_COHERENT BIT(4)struct adreno_rev {uint8_t core;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 85/211 drm/exynos: fix a possible null-pointer dereference due to data race in exynos_drm_crtc_atomic_disable()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tuo Li <[email protected]>
[ Upstream commit 2e63972a2de14482d0eae1a03a73e379f1c3f44c ]
The variable crtc->state->event is often protected by the lock crtc->dev->event_lock when is accessed. However, it is accessed as a condition of an if statement in exynos_drm_crtc_atomic_disable() without holding the lock:
if (crtc->state->event && !crtc->state->active)
However, if crtc->state->event is changed to NULL by another thread right after the conditions of the if statement is checked to be true, a null-pointer dereference can occur in drm_crtc_send_vblank_event():
e->pipe = pipe;
To fix this possible null-pointer dereference caused by data race, the spin lock coverage is extended to protect the if statement as well as the function call to drm_crtc_send_vblank_event().
Added relevant link.
--- drivers/gpu/drm/exynos/exynos_drm_crtc.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/gpu/drm/exynos/exynos_drm_crtc.c +2 -3
@@ -39,13 +39,12 @@ static void exynos_drm_crtc_atomic_disable(struct drm_crtc *crtc,if (exynos_crtc->ops->atomic_disable) exynos_crtc->ops->atomic_disable (exynos_crtc); +spin_lock_irq (&crtc->dev->event_lock);if (crtc->state->event && !crtc->state->active) { -spin_lock_irq (&crtc->dev->event_lock);drm_crtc_send_vblank_event (crtc, crtc->state->event); -spin_unlock_irq (&crtc->dev->event_lock); - crtc->state->event =NULL ; } +spin_unlock_irq (&crtc->dev->event_lock); } static int exynos_crtc_atomic_check(struct drm_crtc *crtc,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 86/211 io_uring: annotate the struct io_kiocb slab for appropriate user copy
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
[ Upstream commit b97f96e22f051d59d07a527dbd7d90408b661ca8 ]
When compiling the kernel with clang and having HARDENED_USERCOPY enabled, the liburing openat2.t test case fails during request setup:
usercopy: Kernel memory overwrite attempt detected to SLUB object 'io_kiocb' (offset 24, size 24)!
------------[ cut here ]------------ kernel BUG at mm/usercopy.c:102! invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC CPU: 3 PID: 413 Comm: openat2.t Tainted: G N 6.4.3-g6995e2de6891-dirty #19 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014 RIP: 0010:usercopy_abort+0x84/0x90 Code: ce 49 89 ce 48 c7 c3 68 48 98 82 48 0f 44 de 48 c7 c7 56 c6 94 82 4c 89 de 48 89 c1 41 52 41 56 53 e8 e0 51 c5 00 48 83 c4 18 <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 41 57 41 56 RSP: 0018:ffffc900016b3da0 EFLAGS: 00010296 RAX: 0000000000000062 RBX: ffffffff82984868 RCX: 4e9b661ac6275b00 RDX: ffff8881b90ec580 RSI: ffffffff82949a64 RDI: 00000000ffffffff RBP: 0000000000000018 R08: 0000000000000000 R09: 0000000000000000 R10: ffffc900016b3c88 R11: ffffc900016b3c30 R12: 00007ffe549659e0 R13: ffff888119014000 R14: 0000000000000018 R15: 0000000000000018 FS: 00007f862e3ca680(0000) GS:ffff8881b90c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005571483542a8 CR3: 0000000118c11000 CR4: 00000000003506e0 Call Trace: <TASK> ? __die_body+0x63/0xb0 ? die+0x9d/0xc0 ? do_trap+0xa7/0x180 ? usercopy_abort+0x84/0x90 ? do_error_trap+0xc6/0x110 ? usercopy_abort+0x84/0x90 ? handle_invalid_op+0x2c/0x40 ? usercopy_abort+0x84/0x90 ? exc_invalid_op+0x2f/0x40 ? asm_exc_invalid_op+0x16/0x20 ? usercopy_abort+0x84/0x90 __check_heap_object+0xe2/0x110 __check_object_size+0x142/0x3d0 io_openat2_prep+0x68/0x140 io_submit_sqes+0x28a/0x680 __se_sys_io_uring_enter+0x120/0x580 do_syscall_64+0x3d/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x55714834de26 Code: ca 01 0f b6 82 d0 00 00 00 8b ba cc 00 00 00 45 31 c0 31 d2 41 b9 08 00 00 00 83 e0 01 c1 e0 04 41 09 c2 b8 aa 01 00 00 0f 05 <c3> 66 0f 1f 84 00 00 00 00 00 89 30 eb 89 0f 1f 40 00 8b 00 a8 06 RSP: 002b:00007ffe549659c8 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa RAX: ffffffffffffffda RBX: 00007ffe54965a50 RCX: 000055714834de26 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000008 R10: 0000000000000000 R11: 0000000000000246 R12: 000055714834f057 R13: 00007ffe54965a50 R14: 0000000000000001 R15: 0000557148351dd8 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]---
when it tries to copy struct open_how from userspace into the per-command space in the io_kiocb. There's nothing wrong with the copy, but we're missing the appropriate annotations for allowing user copies to/from the io_kiocb slab.
Allow copies in the per-command area, which is from the 'file' pointer to when 'opcode' starts. We do have existing user copies there, but they are not all annotated like the one that openat2_prep() uses, copy_struct_from_user(). But in practice opcodes should be allowed to copy data into their per-command area in the io_kiocb.
--- io_uring/io_uring.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
io_uring/io_uring.c +14 -2
@@ -4628,8 +4628,20 @@ static int __init io_uring_init(void)io_uring_optable_init (); - req_cachep =KMEM_CACHE (io_kiocb,SLAB_HWCACHE_ALIGN |SLAB_PANIC | -SLAB_ACCOUNT |SLAB_TYPESAFE_BY_RCU ); +/* +* Allow user copy in the per-command field, which starts after the +* file in io_kiocb and until the opcode field. The openat2 handling +* requires copying in user memory into the io_kiocb object in that +* range, and HARDENED_USERCOPY will complain if we haven't +* correctly annotated this range. +*/ + req_cachep =kmem_cache_create_usercopy ("io_kiocb" , +sizeof (struct io_kiocb ),0 , +SLAB_HWCACHE_ALIGN |SLAB_PANIC | +SLAB_ACCOUNT |SLAB_TYPESAFE_BY_RCU , + offsetof(struct io_kiocb, cmd.data), + sizeof_field(struct io_kiocb, cmd.data), NULL); +return 0 ; };__initcall (io_uring_init);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 87/211 drm/mediatek: dp: Change logging to dev for mtk_dp_aux_transfer()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit fd70e2019bfbcb0ed90c5e23839bf510ce6acf8f ]
Change logging from drm_{err,info}() to dev_{err,info}() in functions mtk_dp_aux_transfer() and mtk_dp_aux_do_transfer(): this will be essential to avoid getting NULL pointer kernel panics if any kind of error happens during AUX transfers happening before the bridge is attached.
This may potentially start happening in a later commit implementing aux-bus support, as AUX transfers will be triggered from the panel driver (for EDID) before the mtk-dp bridge gets attached, and it's done in preparation for the same.
--- drivers/gpu/drm/mediatek/mtk_dp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/mediatek/mtk_dp.c +3 -3
@@ -847,7 +847,7 @@ static int mtk_dp_aux_do_transfer(struct mtk_dp *mtk_dp, bool is_read, u8 cmd,u32 phy_status =mtk_dp_read (mtk_dp,MTK_DP_AUX_P0_3628 ) &AUX_RX_PHY_STATE_AUX_TX_P0_MASK ;if (phy_status !=AUX_RX_PHY_STATE_AUX_TX_P0_RX_IDLE ) { -drm_err (mtk_dp->drm_dev, +dev_err (mtk_dp->dev,"AUX Rx Aux hang, need SW reset\n" );return -EIO ; }
@@ -2062,7 +2062,7 @@ static ssize_t mtk_dp_aux_transfer(struct drm_dp_aux *mtk_aux, is_read = true;break ;default : -drm_err (mtk_aux->drm_dev,"invalid aux cmd = %d\n" , +dev_err (mtk_dp->dev,"invalid aux cmd = %d\n" , msg->request); ret = -EINVAL ; goto err;
@@ -2078,7 +2078,7 @@ static ssize_t mtk_dp_aux_transfer(struct drm_dp_aux *mtk_aux, to_access, &msg->reply);if (ret) { -drm_info (mtk_dp->drm_dev, +dev_info (mtk_dp->dev,"Failed to do AUX transfer: %d\n" , ret); goto err; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 88/211 bus: ti-sysc: Configure uart quirks for k3 SoC
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <[email protected]>
[ Upstream commit 03a711d3cb83692733f865312f49e665c49de6de ]
Enable the uart quirks similar to the earlier SoCs. Let's assume we are likely going to need a k3 specific quirk mask separate from the earlier SoCs, so let's not start changing the revision register mask at this point.
Note that SYSC_QUIRK_LEGACY_IDLE will be needed until we can remove the need for pm_runtime_irq_safe() from 8250_omap driver.
--- drivers/bus/ti-sysc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/bus/ti-sysc.c +2 -0
@@ -1525,6 +1525,8 @@ static const struct sysc_revision_quirk sysc_revision_quirks[] = { SYSC_QUIRK_SWSUP_SIDLE | SYSC_QUIRK_LEGACY_IDLE),SYSC_QUIRK ("uart" ,0 ,0x50 ,0x54 ,0x58 ,0x47422e03 ,0xffffffff ,SYSC_QUIRK_SWSUP_SIDLE |SYSC_QUIRK_LEGACY_IDLE ), +SYSC_QUIRK ("uart" ,0 ,0x50 ,0x54 ,0x58 ,0x47424e03 ,0xffffffff , +SYSC_QUIRK_SWSUP_SIDLE |SYSC_QUIRK_LEGACY_IDLE ),/* Quirks that need to be set based on the module address */ SYSC_QUIRK("mcpdm", 0x40132000, 0, 0x10, -ENODEV, 0x50000800, 0xffffffff,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 89/211 arm64: dts: qcom: sc8280xp-x13s: Add camera activity LED
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 1c63dd1c5fdafa8854526d7d60d2b741c813678d ]
Disappointigly, the camera activity LED is implemented in software. Hook it up as a gpio-led and (until we have camera *and* a "camera on" LED trigger) configure it as a panic indicator.
--- .../dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
arch/arm64/boot/dts/qcom/sc8280xp-lenovo-thinkpad-x13s.dts +16 -0
@@ -12,6 +12,7 @@ #include <dt-bindings/iio/qcom,spmi-adc7-pmr735a.h> #include <dt-bindings/input/gpio-keys.h> #include <dt-bindings/input/input.h> +#include <dt-bindings/leds/common.h> #include <dt-bindings/regulator/qcom,rpmh-regulator.h> #include "sc8280xp.dtsi"
@@ -78,6 +79,21 @@ switch-lid { }; }; + leds { + compatible = "gpio-leds"; + + led-camera-indicator { + label = "white:camera-indicator"; + function = LED_FUNCTION_INDICATOR; + color = <LED_COLOR_ID_WHITE>; + gpios = <&tlmm 28 GPIO_ACTIVE_HIGH>; + linux,default-trigger = "none"; + default-state = "off"; + /* Reuse as a panic indicator until we get a "camera on" trigger */ + panic-indicator; + }; + }; + pmic-glink { compatible = "qcom,sc8280xp-pmic-glink", "qcom,pmic-glink";
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 90/211 md: raid1: fix potential OOB in raid1_remove_disk()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Shurong <[email protected]>
[ Upstream commit 8b0472b50bcf0f19a5119b00a53b63579c8e1e4d ]
If rddev->raid_disk is greater than mddev->raid_disks, there will be an out-of-bounds in raid1_remove_disk(). We have already found similar reports as follows:
1) commit d17f744e883b ("md-raid10: fix KASAN warning")
2) commit 1ebc2cec0b7d ("dm raid: fix KASAN warning in raid5_remove_disk")
Fix this bug by checking whether the "number" variable is valid.
--- drivers/md/raid1.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/md/raid1.c +4 -0
@@ -1829,6 +1829,10 @@ static int raid1_remove_disk(struct mddev *mddev, struct md_rdev *rdev)struct r1conf *conf = mddev->private;int err =0 ;int number = rdev->raid_disk; + +if (unlikely (number >= conf->raid_disks)) + goto abort; +struct raid1_info *p = conf->mirrors + number;if (rdev != p->rdev)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 91/211 ext2: fix datatype of block number in ext2_xattr_set2()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Georg Ottinger <[email protected]>
[ Upstream commit e88076348425b7d0491c8c98d8732a7df8de7aa3 ]
I run a small server that uses external hard drives for backups. The backup software I use uses ext2 filesystems with 4KiB block size and the server is running SELinux and therefore relies on xattr. I recently upgraded the hard drives from 4TB to 12TB models. I noticed that after transferring some TBs I got a filesystem error "Freeing blocks not in datazone - block = 18446744071529317386, count = 1" and the backup process stopped. Trying to fix the fs with e2fsck resulted in a completely corrupted fs. The error probably came from ext2_free_blocks(), and because of the large number 18e19 this problem immediately looked like some kind of integer overflow. Whereas the 4TB fs was about 1e9 blocks, the new 12TB is about 3e9 blocks. So, searching the ext2 code, I came across the line in fs/ext2/xattr.c:745 where ext2_new_block() is called and the resulting block number is stored in the variable block as an int datatype. If a block with a block number greater than INT32_MAX is returned, this variable overflows and the call to sb_getblk() at line fs/ext2/xattr.c:750 fails, then the call to ext2_free_blocks() produces the error.
Message-Id: <[email protected]>
--- fs/ext2/xattr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/ext2/xattr.c +2 -2
@@ -742,10 +742,10 @@ ext2_xattr_set2(struct inode *inode, struct buffer_head *old_bh,/* We need to allocate a new block */ ext2_fsblk_t goal =ext2_group_first_block_no (sb,EXT2_I (inode)->i_block_group); -int block =ext2_new_block (inode, goal, &error); +ext2_fsblk_t block =ext2_new_block (inode, goal, &error);if (error) goto cleanup; -ea_idebug (inode,"creating block %d" , block); +ea_idebug (inode,"creating block %lu" , block); new_bh =sb_getblk (sb, block);if (unlikely (!new_bh)) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 92/211 blk-mq: fix tags leak when shrink nr_hw_queues
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengming Zhou <[email protected]>
[ Upstream commit e1dd7bc93029024af5688253b0c05181d6e01f8e ]
Although we don't need to realloc set->tags[] when shrink nr_hw_queues, we need to free them. Or these tags will be leaked.
How to reproduce:
1. mount -t configfs configfs /mnt
2. modprobe null_blk nr_devices=0 submit_queues=8
3. mkdir /mnt/nullb/nullb0
4. echo 1 > /mnt/nullb/nullb0/power
5. echo 4 > /mnt/nullb/nullb0/submit_queues
6. rmdir /mnt/nullb/nullb0
In step 4, will alloc 9 tags (8 submit queues and 1 poll queue), then in step 5, new_nr_hw_queues = 5 (4 submit queues and 1 poll queue). At last in step 6, only these 5 tags are freed, the other 4 tags leaked.
--- block/blk-mq.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
block/blk-mq.c +5 -1
@@ -4402,9 +4402,13 @@ static int blk_mq_realloc_tag_set_tags(struct blk_mq_tag_set *set, int new_nr_hw_queues) {struct blk_mq_tags **new_tags; +int i; -if (set->nr_hw_queues >= new_nr_hw_queues) +if (set->nr_hw_queues >= new_nr_hw_queues) { +for (i = new_nr_hw_queues; i < set->nr_hw_queues; i++) +__blk_mq_free_map_and_rqs (set, i); goto done; + } new_tags =kcalloc_node (new_nr_hw_queues,sizeof (struct blk_mq_tags *),GFP_KERNEL , set->numa_node);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 93/211 ASoC: SOF: amd: clear panic mask status when panic occurs
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vijendar Mukunda <[email protected]>
[ Upstream commit 3d02e1c439b4140215b624d423aa3c7554b17a5a ]
Due to scratch memory persistence, Once the DSP panic is reported, need to clear the panic mask after handling DSP panic. Otherwise, It results in DSP panic on next reboot.
--- sound/soc/sof/amd/acp-ipc.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/soc/sof/amd/acp-ipc.c +4 -0
@@ -168,6 +168,8 @@ irqreturn_t acp_sof_ipc_irq_thread(int irq, void *context)if ((status &SOF_IPC_PANIC_MAGIC_MASK ) ==SOF_IPC_PANIC_MAGIC ) {snd_sof_dsp_panic (sdev, sdev->dsp_box.offset +sizeof (status), true); + status =0 ; +acp_mailbox_write (sdev, sdev->dsp_box.offset, &status,sizeof (status));return IRQ_HANDLED ; }snd_sof_ipc_msgs_rx (sdev);
@@ -197,6 +199,8 @@ irqreturn_t acp_sof_ipc_irq_thread(int irq, void *context)acp_mailbox_read (sdev, sdev->debug_box.offset, &status,sizeof (u32));if ((status &SOF_IPC_PANIC_MAGIC_MASK ) ==SOF_IPC_PANIC_MAGIC ) {snd_sof_dsp_panic (sdev, sdev->dsp_oops_offset, true); + status =0 ; +acp_mailbox_write (sdev, sdev->debug_box.offset, &status,sizeof (status));return IRQ_HANDLED ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 94/211 x86: bring back rep movsq for user access on CPUs without ERMS
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mateusz Guzik <[email protected]>
[ Upstream commit ca96b162bfd21a5d55e3cd6099e4ee357a0eeb68 ]
Intel CPUs ship with ERMS for over a decade, but this is not true for AMD. In particular one reasonably recent uarch (EPYC 7R13) does not have it (or at least the bit is inactive when running on the Amazon EC2 cloud -- I found rather conflicting information about AMD CPUs vs the extension).
Hand-rolled mov loops executing in this case are quite pessimal compared to rep movsq for bigger sizes. While the upper limit depends on uarch, everyone is well south of 1KB AFAICS and sizes bigger than that are common.
While technically ancient CPUs may be suffering from rep usage, gcc has been emitting it for years all over kernel code, so I don't think this is a legitimate concern.
Sample result from read1_processes from will-it-scale (4KB reads/s):
before: 1507021
after: 1721828 (+14%)
Note that the cutoff point for rep usage is set to 64 bytes, which is way too conservative but I'm sticking to what was done in 47ee3f1dd93b ("x86: re-introduce support for ERMS copies for user space accesses"). That is to say *some* copies will now go slower, which is fixable but beyond the scope of this patch.
--- arch/x86/include/asm/uaccess_64.h | 2 +- arch/x86/lib/copy_user_64.S | 57 +++++++------------------------ 2 files changed, 14 insertions(+), 45 deletions(-)
arch/x86/include/asm/uaccess_64.h +1 -1
@@ -116,7 +116,7 @@ copy_user_generic(void *to, const void *from, unsigned long len)"2:\n" _ASM_EXTABLE_UA(1b ,2b ) :"+c" (len), "+D" (to), "+S" (from), ASM_CALL_CONSTRAINT - : : "memory", "rax", "r8", "r9", "r10", "r11"); + : : "memory", "rax"); clac();return len; }
arch/x86/lib/copy_user_64.S +13 -44
75 lines not on this page · raw message
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 95/211 fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Kanner <[email protected]>
[ Upstream commit cade5397e5461295f3cb87880534b6a07cafa427 ]
Syzkaller reported the following issue:
==================================================================
BUG: KASAN: double-free in slab_free mm/slub.c:3787 [inline] BUG: KASAN: double-free in __kmem_cache_free+0x71/0x110 mm/slub.c:3800 Free of addr ffff888086408000 by task syz-executor.4/12750 [...] Call Trace: <TASK> [...] kasan_report_invalid_free+0xac/0xd0 mm/kasan/report.c:482 ____kasan_slab_free+0xfb/0x120 kasan_slab_free include/linux/kasan.h:177 [inline] slab_free_hook mm/slub.c:1781 [inline] slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1807 slab_free mm/slub.c:3787 [inline] __kmem_cache_free+0x71/0x110 mm/slub.c:3800 dbUnmount+0xf4/0x110 fs/jfs/jfs_dmap.c:264 jfs_umount+0x248/0x3b0 fs/jfs/jfs_umount.c:87 jfs_put_super+0x86/0x190 fs/jfs/super.c:194 generic_shutdown_super+0x130/0x310 fs/super.c:492 kill_block_super+0x79/0xd0 fs/super.c:1386 deactivate_locked_super+0xa7/0xf0 fs/super.c:332 cleanup_mnt+0x494/0x520 fs/namespace.c:1291 task_work_run+0x243/0x300 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0x124/0x150 kernel/entry/common.c:171 exit_to_user_mode_prepare+0xb2/0x140 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x26/0x60 kernel/entry/common.c:296 do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] </TASK> Allocated by task 13352: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x3d/0x60 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:371 [inline] __kasan_kmalloc+0x97/0xb0 mm/kasan/common.c:380 kmalloc include/linux/slab.h:580 [inline] dbMount+0x54/0x980 fs/jfs/jfs_dmap.c:164 jfs_mount+0x1dd/0x830 fs/jfs/jfs_mount.c:121 jfs_fill_super+0x590/0xc50 fs/jfs/super.c:556 mount_bdev+0x26c/0x3a0 fs/super.c:1359 legacy_get_tree+0xea/0x180 fs/fs_context.c:610 vfs_get_tree+0x88/0x270 fs/super.c:1489 do_new_mount+0x289/0xad0 fs/namespace.c:3145 do_mount fs/namespace.c:3488 [inline] __do_sys_mount fs/namespace.c:3697 [inline] __se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3674 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 13352: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x3d/0x60 mm/kasan/common.c:52 kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:518 ____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236 kasan_slab_free include/linux/kasan.h:177 [inline] slab_free_hook mm/slub.c:1781 [inline] slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1807 slab_free mm/slub.c:3787 [inline] __kmem_cache_free+0x71/0x110 mm/slub.c:3800 dbUnmount+0xf4/0x110 fs/jfs/jfs_dmap.c:264 jfs_mount_rw+0x545/0x740 fs/jfs/jfs_mount.c:247 jfs_remount+0x3db/0x710 fs/jfs/super.c:454 reconfigure_super+0x3bc/0x7b0 fs/super.c:935 vfs_fsconfig_locked fs/fsopen.c:254 [inline] __do_sys_fsconfig fs/fsopen.c:439 [inline] __se_sys_fsconfig+0xad5/0x1060 fs/fsopen.c:314 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
[...]
JFS_SBI(ipbmap->i_sb)->bmap wasn't set to NULL after kfree() in dbUnmount().
Syzkaller uses faultinject to reproduce this KASAN double-free warning. The issue is triggered if either diMount() or dbMount() fail in jfs_remount(), since diUnmount() or dbUnmount() already happened in such a case - they will do double-free on next execution: jfs_umount or jfs_remount.
Tested on both upstream and jfs-next by syzkaller.
--- fs/jfs/jfs_dmap.c | 1 + 1 file changed, 1 insertion(+)
fs/jfs/jfs_dmap.c +1 -0
@@ -269,6 +269,7 @@ int dbUnmount(struct inode *ipbmap, int mounterror)/* free the memory for the in-memory bmap. */ kfree (bmp); +JFS_SBI (ipbmap->i_sb)->bmap =NULL ;return (0 ); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 96/211 jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Shixin via Jfs-discussion <[email protected]>
[ Upstream commit 6e2bda2c192d0244b5a78b787ef20aa10cb319b7 ]
syzbot found an invalid-free in diUnmount:
BUG: KASAN: double-free in slab_free mm/slub.c:3661 [inline] BUG: KASAN: double-free in __kmem_cache_free+0x71/0x110 mm/slub.c:3674
Free of addr ffff88806f410000 by task syz-executor131/3632
CPU: 0 PID: 3632 Comm: syz-executor131 Not tainted 6.1.0-rc7-syzkaller-00012-gca57f02295f1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:284 print_report+0x107/0x1f0 mm/kasan/report.c:395 kasan_report_invalid_free+0xac/0xd0 mm/kasan/report.c:460 ____kasan_slab_free+0xfb/0x120 kasan_slab_free include/linux/kasan.h:177 [inline] slab_free_hook mm/slub.c:1724 [inline] slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1750 slab_free mm/slub.c:3661 [inline] __kmem_cache_free+0x71/0x110 mm/slub.c:3674 diUnmount+0xef/0x100 fs/jfs/jfs_imap.c:195 jfs_umount+0x108/0x370 fs/jfs/jfs_umount.c:63 jfs_put_super+0x86/0x190 fs/jfs/super.c:194 generic_shutdown_super+0x130/0x310 fs/super.c:492 kill_block_super+0x79/0xd0 fs/super.c:1428 deactivate_locked_super+0xa7/0xf0 fs/super.c:332 cleanup_mnt+0x494/0x520 fs/namespace.c:1186 task_work_run+0x243/0x300 kernel/task_work.c:179 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0x664/0x2070 kernel/exit.c:820 do_group_exit+0x1fd/0x2b0 kernel/exit.c:950 __do_sys_exit_group kernel/exit.c:961 [inline] __se_sys_exit_group kernel/exit.c:959 [inline] __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:959 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
[...]
JFS_IP(ipimap)->i_imap is not setting to NULL after free in diUnmount. If jfs_remount() free JFS_IP(ipimap)->i_imap but then failed at diMount(). JFS_IP(ipimap)->i_imap will be freed once again.
Fix this problem by setting JFS_IP(ipimap)->i_imap to NULL after free.
--- fs/jfs/jfs_imap.c | 1 + 1 file changed, 1 insertion(+)
fs/jfs/jfs_imap.c +1 -0
@@ -193,6 +193,7 @@ int diUnmount(struct inode *ipimap, int mounterror)* free in-memory control structure */ kfree (imap); +JFS_IP (ipimap)->i_imap =NULL ;return (0 ); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 97/211 ext4: add two helper functions extent_logical_end() and pa_logical_end()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
[ Upstream commit 43bbddc067883d94de7a43d5756a295439fbe37d ]
When we use lstart + len to calculate the end of free extent or prealloc space, it may exceed the maximum value of 4294967295(0xffffffff) supported by ext4_lblk_t and cause overflow, which may lead to various problems.
Therefore, we add two helper functions, extent_logical_end() and pa_logical_end(), to limit the type of end to loff_t, and also convert lstart to loff_t for calculation to avoid overflow.
--- fs/ext4/mballoc.c | 9 +++------ fs/ext4/mballoc.h | 14 ++++++++++++++ 2 files changed, 17 insertions(+), 6 deletions(-)
fs/ext4/mballoc.c +3 -6
@@ -4433,7 +4433,7 @@ ext4_mb_normalize_request(struct ext4_allocation_context *ac,/* first, let's learn actual file size * given current request is allocated */ - size = ac->ac_o_ex.fe_logical +EXT4_C2B (sbi, ac->ac_o_ex.fe_len); + size =extent_logical_end (sbi, &ac->ac_o_ex); size = size << bsbits;if (size <i_size_read (ac->ac_inode)) size =i_size_read (ac->ac_inode);
@@ -4767,7 +4767,6 @@ ext4_mb_use_preallocated(struct ext4_allocation_context *ac)struct ext4_inode_info *ei =EXT4_I (ac->ac_inode);struct ext4_locality_group *lg;struct ext4_prealloc_space *tmp_pa =NULL , *cpa =NULL ; -loff_t tmp_pa_end;struct rb_node *iter;ext4_fsblk_t goal_block;
@@ -4863,9 +4862,7 @@ ext4_mb_use_preallocated(struct ext4_allocation_context *ac)* pa can possibly satisfy the request hence check if it overlaps * original logical start and stop searching if it doesn't. */ - tmp_pa_end = (loff_t )tmp_pa->pa_lstart +EXT4_C2B (sbi, tmp_pa->pa_len); - -if (ac->ac_o_ex.fe_logical >= tmp_pa_end) { +if (ac->ac_o_ex.fe_logical >=pa_logical_end (sbi, tmp_pa)) {spin_unlock (&tmp_pa->pa_lock); goto try_group_pa; }
@@ -5770,7 +5767,7 @@ static void ext4_mb_group_or_file(struct ext4_allocation_context *ac) group_pa_eligible = sbi->s_mb_group_prealloc >0 ; inode_pa_eligible = true; - size = ac->ac_o_ex.fe_logical +EXT4_C2B (sbi, ac->ac_o_ex.fe_len); + size =extent_logical_end (sbi, &ac->ac_o_ex); isize = (i_size_read (ac->ac_inode) + ac->ac_sb->s_blocksize -1 ) >> bsbits;
fs/ext4/mballoc.h +14 -0
@@ -233,6 +233,20 @@ static inline ext4_fsblk_t ext4_grp_offs_to_block(struct super_block *sb, (fex->fe_start <<EXT4_SB (sb)->s_cluster_bits); } +static inline loff_t extent_logical_end (struct ext4_sb_info *sbi, +struct ext4_free_extent *fex) +{ +/* Use loff_t to avoid end exceeding ext4_lblk_t max. */ +return (loff_t )fex->fe_logical +EXT4_C2B (sbi, fex->fe_len); +} + +static inline loff_t pa_logical_end (struct ext4_sb_info *sbi, +struct ext4_prealloc_space *pa) +{ +/* Use loff_t to avoid end exceeding ext4_lblk_t max. */ +return (loff_t )pa->pa_lstart +EXT4_C2B (sbi, pa->pa_len); +} + typedef int (*ext4_mballoc_query_range_fn)( struct super_block *sb, ext4_group_t agno,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 98/211 ext4: avoid overlapping preallocations due to overflow
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <[email protected]>
[ Upstream commit bedc5d34632c21b5adb8ca7143d4c1f794507e4c ]
Let's say we want to allocate 2 blocks starting from 4294966386, after predicting the file size, start is aligned to 4294965248, len is changed to 2048, then end = start + size = 0x100000000. Since end is of type ext4_lblk_t, i.e. uint, end is truncated to 0.
This causes (pa->pa_lstart >= end) to always hold when checking if the current extent to be allocated crosses already preallocated blocks, so the resulting ac_g_ex may cross already preallocated blocks. Hence we convert the end type to loff_t and use pa_logical_end() to avoid overflow.
--- fs/ext4/mballoc.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-)
fs/ext4/mballoc.c +10 -11
@@ -4223,12 +4223,13 @@ ext4_mb_pa_rb_next_iter(ext4_lblk_t new_start, ext4_lblk_t cur_start, struct rb_static inline void ext4_mb_pa_assert_overlap (struct ext4_allocation_context *ac, -ext4_lblk_t start,ext4_lblk_t end) +ext4_lblk_t start,loff_t end) {struct ext4_sb_info *sbi =EXT4_SB (ac->ac_sb);struct ext4_inode_info *ei =EXT4_I (ac->ac_inode);struct ext4_prealloc_space *tmp_pa; -ext4_lblk_t tmp_pa_start, tmp_pa_end; +ext4_lblk_t tmp_pa_start; +loff_t tmp_pa_end;struct rb_node *iter;read_lock (&ei->i_prealloc_lock);
@@ -4237,7 +4238,7 @@ ext4_mb_pa_assert_overlap(struct ext4_allocation_context *ac, tmp_pa = rb_entry(iter, struct ext4_prealloc_space, pa_node.inode_node); tmp_pa_start = tmp_pa->pa_lstart; - tmp_pa_end = tmp_pa->pa_lstart +EXT4_C2B (sbi, tmp_pa->pa_len); + tmp_pa_end =pa_logical_end (sbi, tmp_pa);spin_lock (&tmp_pa->pa_lock);if (tmp_pa->pa_deleted ==0 )
@@ -4259,14 +4260,14 @@ ext4_mb_pa_assert_overlap(struct ext4_allocation_context *ac,*/ static inline void ext4_mb_pa_adjust_overlap (struct ext4_allocation_context *ac, -ext4_lblk_t *start,ext4_lblk_t *end) +ext4_lblk_t *start,loff_t *end) {struct ext4_inode_info *ei =EXT4_I (ac->ac_inode);struct ext4_sb_info *sbi =EXT4_SB (ac->ac_sb);struct ext4_prealloc_space *tmp_pa =NULL , *left_pa =NULL , *right_pa =NULL ;struct rb_node *iter; -ext4_lblk_t new_start, new_end; -ext4_lblk_t tmp_pa_start, tmp_pa_end, left_pa_end =-1 , right_pa_start =-1 ; +ext4_lblk_t new_start, tmp_pa_start, right_pa_start =-1 ; +loff_t new_end, tmp_pa_end, left_pa_end =-1 ; new_start = *start; new_end = *end;
@@ -4285,7 +4286,7 @@ ext4_mb_pa_adjust_overlap(struct ext4_allocation_context *ac, tmp_pa = rb_entry(iter, struct ext4_prealloc_space, pa_node.inode_node); tmp_pa_start = tmp_pa->pa_lstart; - tmp_pa_end = tmp_pa->pa_lstart +EXT4_C2B (sbi, tmp_pa->pa_len); + tmp_pa_end =pa_logical_end (sbi, tmp_pa);/* PA must not overlap original request */ spin_lock (&tmp_pa->pa_lock);
@@ -4365,8 +4366,7 @@ ext4_mb_pa_adjust_overlap(struct ext4_allocation_context *ac, }if (left_pa) { - left_pa_end = - left_pa->pa_lstart +EXT4_C2B (sbi, left_pa->pa_len); + left_pa_end =pa_logical_end (sbi, left_pa);BUG_ON (left_pa_end > ac->ac_o_ex.fe_logical); }
@@ -4405,8 +4405,7 @@ ext4_mb_normalize_request(struct ext4_allocation_context *ac,struct ext4_sb_info *sbi =EXT4_SB (ac->ac_sb);struct ext4_super_block *es = sbi->s_es;int bsbits, max; -ext4_lblk_t end; -loff_t size, start_off; +loff_t size, start_off, end;loff_t orig_size__maybe_unused ;ext4_lblk_t start;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 99/211 PCI: dwc: Provide deinit callback for i.MX
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
[ Upstream commit fc8b24c28bec19fc0621d108b9ee81ddfdedb25a ]
The i.MX integration for the DesignWare PCI controller has a _host_exit() operation which undoes everything that the _host_init() operation does but does not wire this up as the host_deinit callback for the core, or call it in any path other than suspend. This means that if we ever unwind the initial probe of the device, for example because it fails, the regulator core complains that the regulators for the device were left enabled:
imx6q-pcie 33800000.pcie: iATU: unroll T, 4 ob, 4 ib, align 64K, limit 16G imx6q-pcie 33800000.pcie: Phy link never came up
imx6q-pcie 33800000.pcie: Phy link never came up
imx6q-pcie: probe of 33800000.pcie failed with error -110
------------[ cut here ]------------ WARNING: CPU: 2 PID: 46 at drivers/regulator/core.c:2396 _regulator_put+0x110/0x128
Wire up the callback so that the core can clean up after itself.
--- drivers/pci/controller/dwc/pci-imx6.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/controller/dwc/pci-imx6.c +1 -0
@@ -1040,6 +1040,7 @@ static void imx6_pcie_host_exit(struct dw_pcie_rp *pp)static const struct dw_pcie_host_ops imx6_pcie_host_ops = { .host_init = imx6_pcie_host_init, + .host_deinit = imx6_pcie_host_exit, };static const struct dw_pcie_ops dw_pcie_ops = {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 100/211 ARM: 9317/1: kexec: Make smp stop calls asynchronous
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mårten Lindahl <[email protected]>
[ Upstream commit 8922ba71c969d2a0c01a94372a71477d879470de ]
If a panic is triggered by a hrtimer interrupt all online cpus will be notified and set offline. But as highlighted by commit 19dbdcb8039c ("smp: Warn on function calls from softirq context") this call should not be made synchronous with disabled interrupts:
softdog: Initiating panic
Kernel panic - not syncing: Software Watchdog Timer expired
WARNING: CPU: 1 PID: 0 at kernel/smp.c:753 smp_call_function_many_cond
unwind_backtrace:
show_stack
dump_stack_lvl
__warn
warn_slowpath_fmt
smp_call_function_many_cond
smp_call_function
crash_smp_send_stop.part.0
machine_crash_shutdown
__crash_kexec
panic
softdog_fire
__hrtimer_run_queues
hrtimer_interruptMake the smp call for machine_crash_nonpanic_core() asynchronous.
--- arch/arm/kernel/machine_kexec.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
arch/arm/kernel/machine_kexec.c +13 -1
@@ -94,16 +94,28 @@ static void machine_crash_nonpanic_core(void *unused) } } +static DEFINE_PER_CPU(call_single_data_t, cpu_stop_csd) = +CSD_INIT (machine_crash_nonpanic_core, NULL); +void crash_smp_send_stop (void ) {static int cpus_stopped;unsigned long msecs; +call_single_data_t *csd; +int cpu, this_cpu =raw_smp_processor_id ();if (cpus_stopped)return ;atomic_set (&waiting_for_crash_ipi,num_online_cpus () -1 ); -smp_call_function (machine_crash_nonpanic_core,NULL , false); +for_each_online_cpu (cpu) { +if (cpu == this_cpu) +continue ; + + csd = &per_cpu (cpu_stop_csd, cpu); +smp_call_function_single_async (cpu, csd); + } + msecs =1000 ;/* Wait at most a second for the other cpus to stop */ while ((atomic_read (&waiting_for_crash_ipi) >0 ) && msecs) {mdelay (1 );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 101/211 powerpc/pseries: fix possible memory leak in ibmebus_bus_init()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: ruanjinjie <[email protected]>
[ Upstream commit afda85b963c12947e298ad85d757e333aa40fd74 ]
If device_register() returns error in ibmebus_bus_init(), name of kobject which is allocated in dev_set_name() called in device_add() is leaked.
As comment of device_add() says, it should call put_device() to drop the reference count that was set in device_initialize() when it fails, so the name can be freed in kobject_cleanup().
--- arch/powerpc/platforms/pseries/ibmebus.c | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/platforms/pseries/ibmebus.c +1 -0
@@ -460,6 +460,7 @@ static int __init ibmebus_bus_init(void)if (err) {printk (KERN_WARNING "%s: device_register returned %i\n" , __func__, err); +put_device (&ibmebus_bus_device);bus_unregister (&ibmebus_bus_type);return err;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 102/211 PCI: vmd: Disable bridge window for domain reset
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nirmal Patel <[email protected]>
[ Upstream commit f73eedc90bf73d48e8368e6b0b4ad76a7fffaef7 ]
During domain reset process vmd_domain_reset() clears PCI configuration space of VMD root ports. But certain platform has observed following errors and failed to boot.
...
DMAR: VT-d detected Invalidation Queue Error: Reason f
DMAR: VT-d detected Invalidation Time-out Error: SID ffff
DMAR: VT-d detected Invalidation Completion Error: SID ffff
DMAR: QI HEAD: UNKNOWN qw0 = 0x0, qw1 = 0x0
DMAR: QI PRIOR: UNKNOWN qw0 = 0x0, qw1 = 0x0
DMAR: Invalidation Time-out Error (ITE) cleared
The root cause is that memset_io() clears prefetchable memory base/limit registers and prefetchable base/limit 32 bits registers sequentially. This seems to be enabling prefetchable memory if the device disabled prefetchable memory originally.
Here is an example (before memset_io()):
PCI configuration space for 10000:00:00.0:
86 80 30 20 06 00 10 00 04 00 04 06 00 00 01 00
00 00 00 00 00 00 00 00 00 01 01 00 00 00 00 20
00 00 00 00 01 00 01 00 ff ff ff ff 75 05 00 00
...
So, prefetchable memory is ffffffff00000000-575000fffff, which is disabled. When memset_io() clears prefetchable base 32 bits register, the prefetchable memory becomes 0000000000000000-575000fffff, which is enabled and incorrect.
Here is the quote from section 7.5.1.3.9 of PCI Express Base 6.0 spec:
The Prefetchable Memory Limit register must be programmed to a smaller value than the Prefetchable Memory Base register if there is no prefetchable memory on the secondary side of the bridge.
This is believed to be the reason for the failure and in addition the sequence of operation in vmd_domain_reset() is not following the PCIe specs.
Disable the bridge window by executing a sequence of operations borrowed from pci_disable_bridge_window() and pci_setup_bridge_io(), that comply with the PCI specifications.
--- drivers/pci/controller/vmd.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
drivers/pci/controller/vmd.c +17 -2
@@ -541,8 +541,23 @@ static void vmd_domain_reset(struct vmd_dev *vmd) PCI_CLASS_BRIDGE_PCI))continue ; -memset_io (base +PCI_IO_BASE ,0 , -PCI_ROM_ADDRESS1 -PCI_IO_BASE ); +/* +* Temporarily disable the I/O range before updating +* PCI_IO_BASE. +*/ +writel (0x0000ffff , base +PCI_IO_BASE_UPPER16 ); +/* Update lower 16 bits of I/O base/limit */ +writew (0x00f0 , base +PCI_IO_BASE ); +/* Update upper 16 bits of I/O base/limit */ +writel (0 , base +PCI_IO_BASE_UPPER16 ); + +/* MMIO Base/Limit */ +writel (0x0000fff0 , base +PCI_MEMORY_BASE ); + +/* Prefetchable MMIO Base/Limit */ +writel (0 , base +PCI_PREF_LIMIT_UPPER32 ); +writel (0x0000fff0 , base +PCI_PREF_MEMORY_BASE ); +writel (0xffffffff , base +PCI_PREF_BASE_UPPER32 ); } } }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 103/211 PCI: fu740: Set the number of MSI vectors
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yong-Xuan Wang <[email protected]>
[ Upstream commit 551a60e1225e71fff8efd9390204c505b0870e0f ]
The iMSI-RX module of the DW PCIe controller provides multiple sets of MSI_CTRL_INT_i_* registers, and each set is capable of handling 32 MSI interrupts. However, the fu740 PCIe controller driver only enabled one set of MSI_CTRL_INT_i_* registers, as the total number of supported interrupts was not specified.
Set the supported number of MSI vectors to enable all the MSI_CTRL_INT_i_* registers on the fu740 PCIe core, allowing the system to fully utilize the available MSI interrupts.
--- drivers/pci/controller/dwc/pcie-fu740.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/controller/dwc/pcie-fu740.c +1 -0
@@ -299,6 +299,7 @@ static int fu740_pcie_probe(struct platform_device *pdev) pci->dev = dev; pci->ops = &dw_pcie_ops; pci->pp.ops = &fu740_pcie_host_ops; + pci->pp.num_vectors =MAX_MSI_IRQS ;/* SiFive specific region: mgmt */ afp->mgmt_base =devm_platform_ioremap_resource_byname (pdev,"mgmt" );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 104/211 media: mdp3: Fix resource leaks in of_find_device_by_node
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Hongfei <[email protected]>
[ Upstream commit 35ca8ce495366909b4c2e701d1356570dd40c4e2 ]
Use put_device to release the object get through of_find_device_by_node, avoiding resource leaks.
--- drivers/media/platform/mediatek/mdp3/mtk-mdp3-comp.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/platform/mediatek/mdp3/mtk-mdp3-comp.c +2 -0
@@ -892,11 +892,13 @@ static int mdp_get_subsys_id(struct mdp_dev *mdp, struct device *dev, ret =cmdq_dev_get_client_reg (&comp_pdev->dev, &cmdq_reg, index);if (ret !=0 ) {dev_err (&comp_pdev->dev,"cmdq_dev_get_subsys fail!\n" ); +put_device (&comp_pdev->dev);return -EINVAL ; } comp->subsys_id = cmdq_reg.subsys;dev_dbg (&comp_pdev->dev,"subsys id=%d\n" , cmdq_reg.subsys); +put_device (&comp_pdev->dev);return 0 ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 105/211 media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Shurong <[email protected]>
[ Upstream commit 7bf744f2de0a848fb1d717f5831b03db96feae89 ]
In af9035_i2c_master_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach af9035_i2c_master_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash.
Similar commit:
commit 0ed554fd769a
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
--- drivers/media/usb/dvb-usb-v2/af9035.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/media/usb/dvb-usb-v2/af9035.c +5 -4
@@ -322,6 +322,8 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap, ret = -EOPNOTSUPP ; }else if ((msg[0 ].addr == state->af9033_i2c_addr[0 ]) || (msg[0 ].addr == state->af9033_i2c_addr[1 ])) { +if (msg[0 ].len <3 || msg[1 ].len <1 ) +return -EOPNOTSUPP ;/* demod access via firmware interface */ u32 reg = msg[0 ].buf[0 ] <<16 | msg[0 ].buf[1 ] <<8 | msg[0 ].buf[2 ];
@@ -381,6 +383,8 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap, ret = -EOPNOTSUPP ; }else if ((msg[0 ].addr == state->af9033_i2c_addr[0 ]) || (msg[0 ].addr == state->af9033_i2c_addr[1 ])) { +if (msg[0 ].len <3 ) +return -EOPNOTSUPP ;/* demod access via firmware interface */ u32 reg = msg[0 ].buf[0 ] <<16 | msg[0 ].buf[1 ] <<8 | msg[0 ].buf[2 ];
@@ -388,10 +392,7 @@ static int af9035_i2c_master_xfer(struct i2c_adapter *adap,if (msg[0 ].addr == state->af9033_i2c_addr[1 ]) reg |=0x100000 ; - ret = (msg[0 ].len >=3 ) ?af9035_wr_regs (d, reg, - &msg[0 ].buf[3 ], - msg[0 ].len -3 ) - : -EOPNOTSUPP ; + ret =af9035_wr_regs (d, reg, &msg[0 ].buf[3 ], msg[0 ].len -3 ); }else {/* I2C write */ u8 buf[MAX_XFER_SIZE ];
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 106/211 media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Shurong <[email protected]>
[ Upstream commit 5ae544d94abc8ff77b1b9bf8774def3fa5689b5b ]
In dw2102_i2c_transfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach dw2102_i2c_transfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash.
Similar commit:
commit 950e252cb469
("[media] dw2102: limit messages to buffer size")
--- drivers/media/usb/dvb-usb/dw2102.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
drivers/media/usb/dvb-usb/dw2102.c +24 -0
@@ -128,6 +128,10 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],switch (num) {case 2 : +if (msg[0 ].len <1 ) { + num = -EOPNOTSUPP ; +break ; + }/* read stv0299 register */ value = msg[0 ].buf[0 ];/* register */ for (i =0 ; i < msg[1 ].len; i++) {
@@ -139,6 +143,10 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],case 1 :switch (msg[0 ].addr) {case 0x68 : +if (msg[0 ].len <2 ) { + num = -EOPNOTSUPP ; +break ; + }/* write to stv0299 register */ buf6[0 ] =0x2a ; buf6[1 ] = msg[0 ].buf[0 ];
@@ -148,6 +156,10 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],break ;case 0x60 :if (msg[0 ].flags ==0 ) { +if (msg[0 ].len <4 ) { + num = -EOPNOTSUPP ; +break ; + }/* write to tuner pll */ buf6[0 ] =0x2c ; buf6[1 ] =5 ;
@@ -159,6 +171,10 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[],dw210x_op_rw (d->udev,0xb2 ,0 ,0 , buf6,7 ,DW210X_WRITE_MSG ); }else { +if (msg[0 ].len <1 ) { + num = -EOPNOTSUPP ; +break ; + }/* read from tuner */ dw210x_op_rw (d->udev,0xb5 ,0 ,0 , buf6,1 ,DW210X_READ_MSG );
@@ -166,12 +182,20 @@ static int dw2102_i2c_transfer(struct i2c_adapter *adap, struct i2c_msg msg[], }break ;case (DW2102_RC_QUERY ): +if (msg[0 ].len <2 ) { + num = -EOPNOTSUPP ; +break ; + }dw210x_op_rw (d->udev,0xb8 ,0 ,0 , buf6,2 ,DW210X_READ_MSG ); msg[0 ].buf[0 ] = buf6[0 ]; msg[0 ].buf[1 ] = buf6[1 ];break ;case (DW2102_VOLTAGE_CTRL ): +if (msg[0 ].len <1 ) { + num = -EOPNOTSUPP ; +break ; + } buf6[0 ] =0x30 ; buf6[1 ] = msg[0 ].buf[0 ]; dw210x_op_rw(d->udev, 0xb2, 0, 0,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 107/211 media: af9005: Fix null-ptr-deref in af9005_i2c_xfer
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Shurong <[email protected]>
[ Upstream commit f4ee84f27625ce1fdf41e8483fa0561a1b837d10 ]
In af9005_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach af9005_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash.
Similar commit:
commit 0ed554fd769a
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
--- drivers/media/usb/dvb-usb/af9005.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/media/usb/dvb-usb/af9005.c +5 -0
@@ -422,6 +422,10 @@ static int af9005_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],if (ret ==0 ) ret =2 ; }else { +if (msg[0 ].len <2 ) { + ret = -EOPNOTSUPP ; + goto unlock; + }/* write one or more registers */ reg = msg[0 ].buf[0 ]; addr = msg[0 ].addr;
@@ -431,6 +435,7 @@ static int af9005_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], ret =1 ; } +unlock:mutex_unlock (&d->i2c_mutex);return ret; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 108/211 media: anysee: fix null-ptr-deref in anysee_master_xfer
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Shurong <[email protected]>
[ Upstream commit c30411266fd67ea3c02a05c157231654d5a3bdc9 ]
In anysee_master_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach anysee_master_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash.
Similar commit:
commit 0ed554fd769a
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
--- drivers/media/usb/dvb-usb-v2/anysee.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/dvb-usb-v2/anysee.c +1 -1
@@ -202,7 +202,7 @@ static int anysee_master_xfer(struct i2c_adapter *adap, struct i2c_msg *msg,while (i < num) {if (num > i +1 && (msg[i+1 ].flags &I2C_M_RD )) { -if (msg[i].len >2 || msg[i+1 ].len >60 ) { +if (msg[i].len !=2 || msg[i +1 ].len >60 ) { ret = -EOPNOTSUPP ;break ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 109/211 media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Shurong <[email protected]>
[ Upstream commit 1047f9343011f2cedc73c64829686206a7e9fc3f ]
In az6007_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach az6007_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash.
Similar commit:
commit 0ed554fd769a
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
--- drivers/media/usb/dvb-usb-v2/az6007.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/media/usb/dvb-usb-v2/az6007.c +8 -0
@@ -788,6 +788,10 @@ static int az6007_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],if (az6007_xfer_debug)printk (KERN_DEBUG "az6007: I2C W addr=0x%x len=%d\n" , addr, msgs[i].len); +if (msgs[i].len <1 ) { + ret = -EIO ; + goto err; + } req =AZ6007_I2C_WR ; index = msgs[i].buf[0 ]; value = addr | (1 <<8 );
@@ -802,6 +806,10 @@ static int az6007_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],if (az6007_xfer_debug)printk (KERN_DEBUG "az6007: I2C R addr=0x%x len=%d\n" , addr, msgs[i].len); +if (msgs[i].len <1 ) { + ret = -EIO ; + goto err; + } req =AZ6007_I2C_RD ; index = msgs[i].buf[0 ]; value = addr;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 110/211 media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xfer
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Shurong <[email protected]>
[ Upstream commit b97719a66970601cd3151a3e2020f4454a1c4ff6 ]
In gl861_i2c_master_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach gl861_i2c_master_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash.
Similar commit:
commit 0ed554fd769a
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
--- drivers/media/usb/dvb-usb-v2/gl861.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/dvb-usb-v2/gl861.c +1 -1
@@ -120,7 +120,7 @@ static int gl861_i2c_master_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], }else if (num ==2 && !(msg[0 ].flags &I2C_M_RD ) && (msg[1 ].flags &I2C_M_RD )) {/* I2C write + read */ -if (msg[0 ].len >1 || msg[1 ].len >sizeof (ctx->buf)) { +if (msg[0 ].len !=1 || msg[1 ].len >sizeof (ctx->buf)) { ret = -EOPNOTSUPP ; goto err; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 111/211 scsi: lpfc: Abort outstanding ELS cmds when mailbox timeout error is detected
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <[email protected]>
[ Upstream commit 089ea22e374aa20043e72243c47b5867d5419d38 ]
A mailbox timeout error usually indicates something has gone wrong, and a follow up reset of the HBA is a typical recovery mechanism. Introduce a MBX_TMO_ERR flag to detect such cases and have lpfc_els_flush_cmd abort ELS commands if the MBX_TMO_ERR flag condition was set. This ensures all of the registered SGL resources meant for ELS traffic are not leaked after an HBA reset.
--- drivers/scsi/lpfc/lpfc.h | 1 + drivers/scsi/lpfc/lpfc_els.c | 25 ++++++++++++++++++------- drivers/scsi/lpfc/lpfc_init.c | 20 +++++++++++++++++--- drivers/scsi/lpfc/lpfc_sli.c | 8 +++++++- 4 files changed, 43 insertions(+), 11 deletions(-)
drivers/scsi/lpfc/lpfc.h +1 -0
@@ -872,6 +872,7 @@ enum lpfc_irq_chann_mode {enum lpfc_hba_bit_flags {FABRIC_COMANDS_BLOCKED ,HBA_PCI_ERR , +MBX_TMO_ERR , };struct lpfc_hba {
drivers/scsi/lpfc/lpfc_els.c +18 -7
@@ -9588,11 +9588,13 @@ void lpfc_els_flush_cmd(struct lpfc_vport *vport) {LIST_HEAD (abort_list); +LIST_HEAD (cancel_list);struct lpfc_hba *phba = vport->phba;struct lpfc_sli_ring *pring;struct lpfc_iocbq *tmp_iocb, *piocb;u32 ulp_command;unsigned long iflags =0 ; +bool mbx_tmo_err;lpfc_fabric_abort_vport (vport);
@@ -9614,15 +9616,16 @@ lpfc_els_flush_cmd(struct lpfc_vport *vport)if (phba->sli_rev ==LPFC_SLI_REV4 )spin_lock (&pring->ring_lock); + mbx_tmo_err =test_bit (MBX_TMO_ERR , &phba->bit_flags);/* First we need to issue aborts to outstanding cmds on txcmpl */ list_for_each_entry_safe (piocb, tmp_iocb, &pring->txcmplq, list) { -if (piocb->cmd_flag &LPFC_IO_LIBDFC ) +if (piocb->cmd_flag &LPFC_IO_LIBDFC && !mbx_tmo_err)continue ;if (piocb->vport != vport)continue ; -if (piocb->cmd_flag &LPFC_DRIVER_ABORTED ) +if (piocb->cmd_flag &LPFC_DRIVER_ABORTED && !mbx_tmo_err)continue ;/* On the ELS ring we can have ELS_REQUESTs or
@@ -9641,8 +9644,8 @@ lpfc_els_flush_cmd(struct lpfc_vport *vport)*/ if (phba->link_state ==LPFC_LINK_DOWN ) piocb->cmd_cmpl = lpfc_cmpl_els_link_down; - } -if (ulp_command ==CMD_GEN_REQUEST64_CR ) + }else if (ulp_command ==CMD_GEN_REQUEST64_CR || + mbx_tmo_err)list_add_tail (&piocb->dlist, &abort_list); }
@@ -9654,11 +9657,19 @@ lpfc_els_flush_cmd(struct lpfc_vport *vport)list_for_each_entry_safe (piocb, tmp_iocb, &abort_list, dlist) {spin_lock_irqsave (&phba->hbalock, iflags);list_del_init (&piocb->dlist); -lpfc_sli_issue_abort_iotag (phba, pring, piocb,NULL ); +if (mbx_tmo_err) +list_move_tail (&piocb->list, &cancel_list); +else +lpfc_sli_issue_abort_iotag (phba, pring, piocb,NULL ); +spin_unlock_irqrestore (&phba->hbalock, iflags); } -/* Make sure HBA is alive */ -lpfc_issue_hb_tmo (phba); +if (!list_empty (&cancel_list)) +lpfc_sli_cancel_iocbs (phba, &cancel_list,IOSTAT_LOCAL_REJECT , +IOERR_SLI_ABORTED ); +else +/* Make sure HBA is alive */ +lpfc_issue_hb_tmo (phba);if (!list_empty (&abort_list)) lpfc_printf_vlog(vport, KERN_ERR, LOG_TRACE_EVENT,
drivers/scsi/lpfc/lpfc_init.c +17 -3
@@ -7550,6 +7550,8 @@ lpfc_disable_pci_dev(struct lpfc_hba *phba)void lpfc_reset_hba (struct lpfc_hba *phba) { +int rc =0 ; +/* If resets are disabled then set error state and return. */ if (!phba->cfg_enable_hba_reset) { phba->link_state =LPFC_HBA_ERROR ;
@@ -7560,13 +7562,25 @@ lpfc_reset_hba(struct lpfc_hba *phba)if (phba->sli.sli_flag &LPFC_SLI_ACTIVE ) {lpfc_offline_prep (phba,LPFC_MBX_WAIT ); }else { +if (test_bit (MBX_TMO_ERR , &phba->bit_flags)) { +/* Perform a PCI function reset to start from clean */ + rc =lpfc_pci_function_reset (phba); +lpfc_els_flush_all_cmd (phba); + }lpfc_offline_prep (phba,LPFC_MBX_NO_WAIT );lpfc_sli_flush_io_rings (phba); }lpfc_offline (phba); -lpfc_sli_brdrestart (phba); -lpfc_online (phba); -lpfc_unblock_mgmt_io (phba); +clear_bit (MBX_TMO_ERR , &phba->bit_flags); +if (unlikely (rc)) { +lpfc_printf_log (phba,KERN_ERR ,LOG_SLI , +"8888 PCI function reset failed rc %x\n" , + rc); + }else { +lpfc_sli_brdrestart (phba); +lpfc_online (phba); +lpfc_unblock_mgmt_io (phba); + } }/**
drivers/scsi/lpfc/lpfc_sli.c +7 -1
@@ -3935,6 +3935,8 @@ void lpfc_poll_eratt(struct timer_list *t)uint64_t sli_intr, cnt; phba =from_timer (phba, t, eratt_poll); +if (!(phba->hba_flag &HBA_SETUP )) +return ;/* Here we will also keep track of interrupts per sec of the hba */ sli_intr = phba->sli.slistat.sli_intr;
@@ -7693,7 +7695,9 @@ lpfc_sli4_repost_sgl_list(struct lpfc_hba *phba,spin_unlock_irq (&phba->hbalock); }else {lpfc_printf_log (phba,KERN_ERR ,LOG_TRACE_EVENT , -"3161 Failure to post sgl to port.\n" ); +"3161 Failure to post sgl to port,status %x " +"blkcnt %d totalcnt %d postcnt %d\n" , + status, block_cnt, total_cnt, post_cnt);return -EIO ; }
@@ -8478,6 +8482,7 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba)spin_unlock_irq (&phba->hbalock); } } + phba->hba_flag &= ~HBA_SETUP ;lpfc_sli4_dip (phba);
@@ -9282,6 +9287,7 @@ lpfc_mbox_timeout_handler(struct lpfc_hba *phba)* would get IOCB_ERROR from lpfc_sli_issue_iocb, allowing * it to fail all outstanding SCSI IO. */ +set_bit (MBX_TMO_ERR , &phba->bit_flags);spin_lock_irq (&phba->pport->work_port_lock); phba->pport->work_port_events &= ~WORKER_MBOX_TMO ;spin_unlock_irq (&phba->pport->work_port_lock);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 112/211 media: tuners: qt1010: replace BUG_ON with a regular error
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
[ Upstream commit ee630b29ea44d1851bb6c903f400956604834463 ]
BUG_ON is unnecessary here, and in addition it confuses smatch. Replacing this with an error return help resolve this smatch warning:
drivers/media/tuners/qt1010.c:350 qt1010_init() error: buffer overflow 'i2c_data' 34 <= 34
--- drivers/media/tuners/qt1010.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/media/tuners/qt1010.c +6 -5
@@ -345,11 +345,12 @@ static int qt1010_init(struct dvb_frontend *fe)else valptr = &tmpval; -BUG_ON (i >=ARRAY_SIZE (i2c_data) -1 ); - - err =qt1010_init_meas1 (priv, i2c_data[i+1 ].reg, - i2c_data[i].reg, - i2c_data[i].val, valptr); +if (i >=ARRAY_SIZE (i2c_data) -1 ) + err = -EIO ; +else + err =qt1010_init_meas1 (priv, i2c_data[i +1 ].reg, + i2c_data[i].reg, + i2c_data[i].val, valptr); i++;break ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 113/211 media: pci: cx23885: replace BUG with error return
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
[ Upstream commit 2e1796fd4904fdd6062a8e4589778ea899ea0c8d ]
It was completely unnecessary to use BUG in buffer_prepare(). Just replace it with an error return. This also fixes a smatch warning:
drivers/media/pci/cx23885/cx23885-video.c:422 buffer_prepare() error: uninitialized symbol 'ret'.
--- drivers/media/pci/cx23885/cx23885-video.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/pci/cx23885/cx23885-video.c +1 -1
@@ -413,7 +413,7 @@ static int buffer_prepare(struct vb2_buffer *vb) dev->height >> 1);break ;default : -BUG (); +return -EINVAL ;/* should not happen */ } dprintk(2, "[%p/%d] buffer_init - %dx%d %dbpp 0x%08x - dma=0x%08lx\n", buf, buf->vb.vb2_buf.index,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 114/211 usb: cdns3: Put the cdns set active part outside the spin lock
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaolei Wang <[email protected]>
[ Upstream commit 2319b9c87fe243327285f2fefd7374ffd75a65fc ]
The device may be scheduled during the resume process, so this cannot appear in atomic operations. Since pm_runtime_set_active will resume suppliers, put set active outside the spin lock, which is only used to protect the struct cdns data structure, otherwise the kernel will report the following warning:
BUG: sleeping function called from invalid context at drivers/base/power/runtime.c:1163
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 651, name: sh
preempt_count: 1, expected: 0
RCU nest depth: 0, expected: 0
CPU: 0 PID: 651 Comm: sh Tainted: G WC 6.1.20 #1
Hardware name: Freescale i.MX8QM MEK (DT)
Call trace:
dump_backtrace.part.0+0xe0/0xf0
show_stack+0x18/0x30
dump_stack_lvl+0x64/0x80
dump_stack+0x1c/0x38
__might_resched+0x1fc/0x240
__might_sleep+0x68/0xc0
__pm_runtime_resume+0x9c/0xe0
rpm_get_suppliers+0x68/0x1b0
__pm_runtime_set_status+0x298/0x560
cdns_resume+0xb0/0x1c0
cdns3_controller_resume.isra.0+0x1e0/0x250
cdns3_plat_resume+0x28/0x40--- drivers/usb/cdns3/cdns3-plat.c | 3 ++- drivers/usb/cdns3/cdnsp-pci.c | 3 ++- drivers/usb/cdns3/core.c | 15 +++++++++++---- drivers/usb/cdns3/core.h | 7 +++++-- 4 files changed, 20 insertions(+), 8 deletions(-)
drivers/usb/cdns3/cdns3-plat.c +2 -1
@@ -255,9 +255,10 @@ static int cdns3_controller_resume(struct device *dev, pm_message_t msg)cdns3_set_platform_suspend (cdns->dev, false, false);spin_lock_irqsave (&cdns->lock, flags); -cdns_resume (cdns, !PMSG_IS_AUTO (msg)); +cdns_resume (cdns); cdns->in_lpm = false;spin_unlock_irqrestore (&cdns->lock, flags); +cdns_set_active (cdns, !PMSG_IS_AUTO (msg));if (cdns->wakeup_pending) { cdns->wakeup_pending = false;enable_irq (cdns->wakeup_irq);
drivers/usb/cdns3/cdnsp-pci.c +2 -1
@@ -208,8 +208,9 @@ static int __maybe_unused cdnsp_pci_resume(struct device *dev)int ret;spin_lock_irqsave (&cdns->lock, flags); - ret =cdns_resume (cdns,1 ); + ret =cdns_resume (cdns);spin_unlock_irqrestore (&cdns->lock, flags); +cdns_set_active (cdns,1 );return ret; }
drivers/usb/cdns3/core.c +11 -4
@@ -522,9 +522,8 @@ int cdns_suspend(struct cdns *cdns) }EXPORT_SYMBOL_GPL (cdns_suspend); -int cdns_resume (struct cdns *cdns,u8 set_active) +int cdns_resume (struct cdns *cdns) { -struct device *dev = cdns->dev;enum usb_role real_role;bool role_changed = false;int ret =0 ;
@@ -556,15 +555,23 @@ int cdns_resume(struct cdns *cdns, u8 set_active)if (cdns->roles[cdns->role]->resume) cdns->roles[cdns->role]->resume (cdns,cdns_power_is_lost (cdns)); + return 0; +} +EXPORT_SYMBOL_GPL (cdns_resume); + +void cdns_set_active (struct cdns *cdns,u8 set_active) +{ +struct device *dev = cdns->dev; +if (set_active) {pm_runtime_disable (dev);pm_runtime_set_active (dev);pm_runtime_enable (dev); } - return 0; +return ; } -EXPORT_SYMBOL_GPL (cdns_resume); +EXPORT_SYMBOL_GPL (cdns_set_active);#endif /* CONFIG_PM_SLEEP */ MODULE_AUTHOR ("Peter Chen <[email protected]>" );
drivers/usb/cdns3/core.h +5 -2
@@ -125,10 +125,13 @@ int cdns_init(struct cdns *cdns);int cdns_remove (struct cdns *cdns);#ifdef CONFIG_PM_SLEEP -int cdns_resume (struct cdns *cdns,u8 set_active); +int cdns_resume (struct cdns *cdns);int cdns_suspend (struct cdns *cdns); +void cdns_set_active (struct cdns *cdns,u8 set_active);#else /* CONFIG_PM_SLEEP */ -static inline int cdns_resume (struct cdns *cdns,u8 set_active) +static inline int cdns_resume (struct cdns *cdns) +{return 0 ; } +static inline int cdns_set_active (struct cdns *cdns,u8 set_active) {return 0 ; }static inline int cdns_suspend (struct cdns *cdns) {return 0 ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 115/211 usb: typec: intel_pmc_mux: Add new ACPI ID for Lunar Lake IOM device
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Madhu M <[email protected]>
[ Upstream commit e032368e8cb15ab1f11b92f078caa9bae995b8fe ]
Intel Lunar Lake IOM has a different IOM port status offset and size than Intel MTL.
Intel Lunar Lake is the first platform to extend IOM port status from 32bit to 64bit by adding DDI port number into IOM port status.
Added IOM_PORT_STATUS_REGS macro for using platform specific IOM port status offset and size.
--- drivers/usb/typec/mux/intel_pmc_mux.c | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-)
drivers/usb/typec/mux/intel_pmc_mux.c +20 -5
@@ -117,6 +117,16 @@ enum { IOM_PORT_STATUS_DHPD_HPD_STATUS_SHIFT) & \ IOM_PORT_STATUS_DHPD_HPD_STATUS_ASSERT) +/* IOM port status register */ +#define IOM_PORT_STATUS_REGS (_offset_, _size_) ((_offset_) | (_size_)) +#define IOM_PORT_STATUS_REGS_SZ_MASK BIT(0) +#define IOM_PORT_STATUS_REGS_SZ_4 0 +#define IOM_PORT_STATUS_REGS_SZ_8 1 +#define IOM_PORT_STATUS_REGS_OFFSET (_d_) \ + ((_d_) & ~IOM_PORT_STATUS_REGS_SZ_MASK) +#define IOM_PORT_STATUS_REGS_SIZE (_d_) \ + (4 << ((_d_) & IOM_PORT_STATUS_REGS_SZ_MASK)) +struct pmc_usb ;struct pmc_usb_port {
@@ -145,6 +155,7 @@ struct pmc_usb {struct acpi_device *iom_adev;void __iomem *iom_base;u32 iom_port_status_offset; +u8 iom_port_status_size;struct dentry *dentry; };
@@ -160,7 +171,7 @@ static void update_port_status(struct pmc_usb_port *port) port->iom_status =readl (port->pmc->iom_base + port->pmc->iom_port_status_offset + - port_num *sizeof (u32)); + port_num * port->pmc->iom_port_status_size); }static int sbu_orientation (struct pmc_usb_port *port)
@@ -589,13 +600,16 @@ static int pmc_usb_register_port(struct pmc_usb *pmc, int index,/* IOM ACPI IDs and IOM_PORT_STATUS_OFFSET */ static const struct acpi_device_id iom_acpi_ids[] = {/* TigerLake */ - {"INTC1072" ,0x560 , }, + {"INTC1072" ,IOM_PORT_STATUS_REGS (0x560 ,IOM_PORT_STATUS_REGS_SZ_4 ) },/* AlderLake */ - {"INTC1079" ,0x160 , }, + {"INTC1079" ,IOM_PORT_STATUS_REGS (0x160 ,IOM_PORT_STATUS_REGS_SZ_4 ) },/* Meteor Lake */ - {"INTC107A" ,0x160 , }, + {"INTC107A" ,IOM_PORT_STATUS_REGS (0x160 ,IOM_PORT_STATUS_REGS_SZ_4 ) }, + +/* Lunar Lake */ + {"INTC10EA" ,IOM_PORT_STATUS_REGS (0x150 ,IOM_PORT_STATUS_REGS_SZ_8 ) }, {} };
@@ -615,7 +629,8 @@ static int pmc_usb_probe_iom(struct pmc_usb *pmc)if (!adev)return -ENODEV ; - pmc->iom_port_status_offset = (u32 )dev_id->driver_data; + pmc->iom_port_status_offset =IOM_PORT_STATUS_REGS_OFFSET (dev_id->driver_data); + pmc->iom_port_status_size =IOM_PORT_STATUS_REGS_SIZE (dev_id->driver_data);INIT_LIST_HEAD (&resource_list); ret =acpi_dev_get_memory_resources (adev, &resource_list);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 116/211 usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
[ Upstream commit ce9daa2efc0872a9a68ea51dc8000df05893ef2e ]
We should verify the bound of the array to assure that host may not manipulate the index to point past endpoint array.
--- drivers/usb/gadget/udc/fsl_qe_udc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/gadget/udc/fsl_qe_udc.c +2 -0
@@ -1959,6 +1959,8 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value, }else if ((request_type &USB_RECIP_MASK ) ==USB_RECIP_ENDPOINT ) {/* Get endpoint status */ int pipe = index &USB_ENDPOINT_NUMBER_MASK ; +if (pipe >=USB_MAX_ENDPOINTS ) + goto stall;struct qe_ep *target_ep = &udc->eps[pipe];u16 usep;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 117/211 tools: iio: iio_generic_buffer: Fix some integer type and calculation
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenyuan Mi <[email protected]>
[ Upstream commit 49d736313d0975ddeb156f4f59801da833f78b30 ]
In function size_from_channelarray(), the return value 'bytes' is defined as int type. However, the calcution of 'bytes' in this function is designed to use the unsigned int type. So it is necessary to change 'bytes' type to unsigned int to avoid integer overflow.
The size_from_channelarray() is called in main() function, its return value is directly multipled by 'buf_len' and then used as the malloc() parameter. The 'buf_len' is completely controllable by user, thus a multiplication overflow may occur here. This could allocate an unexpected small area.
--- tools/iio/iio_generic_buffer.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-)
tools/iio/iio_generic_buffer.c +13 -4
@@ -51,9 +51,9 @@ enum autochan {* Has the side effect of filling the channels[i].location values used * in processing the buffer output. **/ -static int size_from_channelarray (struct iio_channel_info *channels,int num_channels) +static unsigned int size_from_channelarray (struct iio_channel_info *channels,int num_channels) { -int bytes =0 ; +unsigned int bytes =0 ;int i =0 ;while (i < num_channels) {
@@ -348,7 +348,7 @@ int main(int argc, char **argv)ssize_t read_size;int dev_num =-1 , trig_num =-1 ;char *buffer_access =NULL ; -int scan_size; +unsigned int scan_size;int noevents =0 ;int notrigger =0 ;char *dummy;
@@ -674,7 +674,16 @@ int main(int argc, char **argv) } scan_size =size_from_channelarray (channels, num_channels); - data =malloc (scan_size * buf_len); + +size_t total_buf_len = scan_size * buf_len; + +if (scan_size >0 && total_buf_len / scan_size != buf_len) { + ret = -EFAULT ; +perror ("Integer overflow happened when calculate scan_size * buf_len" ); + goto error; + } + + data =malloc (total_buf_len);if (!data) { ret = -ENOMEM ; goto error;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 118/211 scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Shelekhin <[email protected]>
[ Upstream commit 801f287c93ff95582b0a2d2163f12870a2f076d4 ]
The function lio_target_nacl_info_show() uses sprintf() in a loop to print details for every iSCSI connection in a session without checking for the buffer length. With enough iSCSI connections it's possible to overflow the buffer provided by configfs and corrupt the memory.
This patch replaces sprintf() with sysfs_emit_at() that checks for buffer boundries.
--- drivers/target/iscsi/iscsi_target_configfs.c | 54 ++++++++++---------- 1 file changed, 27 insertions(+), 27 deletions(-)
drivers/target/iscsi/iscsi_target_configfs.c +27 -27
@@ -533,102 +533,102 @@ static ssize_t lio_target_nacl_info_show(struct config_item *item, char *page)spin_lock_bh (&se_nacl->nacl_sess_lock); se_sess = se_nacl->nacl_sess;if (!se_sess) { - rb +=sprintf (page+rb,"No active iSCSI Session for Initiator" + rb +=sysfs_emit_at (page, rb,"No active iSCSI Session for Initiator" " Endpoint: %s\n" , se_nacl->initiatorname); }else { sess = se_sess->fabric_sess_ptr; - rb +=sprintf (page+rb,"InitiatorName: %s\n" , + rb +=sysfs_emit_at (page, rb,"InitiatorName: %s\n" , sess->sess_ops->InitiatorName); - rb +=sprintf (page+rb,"InitiatorAlias: %s\n" , + rb +=sysfs_emit_at (page, rb,"InitiatorAlias: %s\n" , sess->sess_ops->InitiatorAlias); - rb +=sprintf (page+rb, + rb +=sysfs_emit_at (page, rb,"LIO Session ID: %u ISID: 0x%6ph TSIH: %hu " , sess->sid, sess->isid, sess->tsih); - rb +=sprintf (page+rb,"SessionType: %s\n" , + rb +=sysfs_emit_at (page, rb,"SessionType: %s\n" , (sess->sess_ops->SessionType) ?"Discovery" :"Normal" ); - rb +=sprintf (page+rb,"Session State: " ); + rb +=sysfs_emit_at (page, rb,"Session State: " );switch (sess->session_state) {case TARG_SESS_STATE_FREE : - rb +=sprintf (page+rb,"TARG_SESS_FREE\n" ); + rb +=sysfs_emit_at (page, rb,"TARG_SESS_FREE\n" );break ;case TARG_SESS_STATE_ACTIVE : - rb +=sprintf (page+rb,"TARG_SESS_STATE_ACTIVE\n" ); + rb +=sysfs_emit_at (page, rb,"TARG_SESS_STATE_ACTIVE\n" );break ;case TARG_SESS_STATE_LOGGED_IN : - rb +=sprintf (page+rb,"TARG_SESS_STATE_LOGGED_IN\n" ); + rb +=sysfs_emit_at (page, rb,"TARG_SESS_STATE_LOGGED_IN\n" );break ;case TARG_SESS_STATE_FAILED : - rb +=sprintf (page+rb,"TARG_SESS_STATE_FAILED\n" ); + rb +=sysfs_emit_at (page, rb,"TARG_SESS_STATE_FAILED\n" );break ;case TARG_SESS_STATE_IN_CONTINUE : - rb +=sprintf (page+rb,"TARG_SESS_STATE_IN_CONTINUE\n" ); + rb +=sysfs_emit_at (page, rb,"TARG_SESS_STATE_IN_CONTINUE\n" );break ;default : - rb +=sprintf (page+rb,"ERROR: Unknown Session" + rb +=sysfs_emit_at (page, rb,"ERROR: Unknown Session" " State!\n" );break ; } - rb +=sprintf (page+rb,"---------------------[iSCSI Session" + rb +=sysfs_emit_at (page, rb,"---------------------[iSCSI Session" " Values]-----------------------\n" ); - rb +=sprintf (page+rb," CmdSN/WR : CmdSN/WC : ExpCmdSN" + rb +=sysfs_emit_at (page, rb," CmdSN/WR : CmdSN/WC : ExpCmdSN" " : MaxCmdSN : ITT : TTT\n" ); max_cmd_sn = (u32 )atomic_read (&sess->max_cmd_sn); - rb +=sprintf (page+rb," 0x%08x 0x%08x 0x%08x 0x%08x" + rb +=sysfs_emit_at (page, rb," 0x%08x 0x%08x 0x%08x 0x%08x" " 0x%08x 0x%08x\n" , sess->cmdsn_window, (max_cmd_sn - sess->exp_cmd_sn) +1 , sess->exp_cmd_sn, max_cmd_sn, sess->init_task_tag, sess->targ_xfer_tag); - rb +=sprintf (page+rb,"----------------------[iSCSI" + rb +=sysfs_emit_at (page, rb,"----------------------[iSCSI" " Connections]-------------------------\n" );spin_lock (&sess->conn_lock);list_for_each_entry (conn, &sess->sess_conn_list, conn_list) { - rb +=sprintf (page+rb,"CID: %hu Connection" + rb +=sysfs_emit_at (page, rb,"CID: %hu Connection" " State: " , conn->cid);switch (conn->conn_state) {case TARG_CONN_STATE_FREE : - rb +=sprintf (page+rb, + rb +=sysfs_emit_at (page, rb,"TARG_CONN_STATE_FREE\n" );break ;case TARG_CONN_STATE_XPT_UP : - rb +=sprintf (page+rb, + rb +=sysfs_emit_at (page, rb,"TARG_CONN_STATE_XPT_UP\n" );break ;case TARG_CONN_STATE_IN_LOGIN : - rb +=sprintf (page+rb, + rb +=sysfs_emit_at (page, rb,"TARG_CONN_STATE_IN_LOGIN\n" );break ;case TARG_CONN_STATE_LOGGED_IN : - rb +=sprintf (page+rb, + rb +=sysfs_emit_at (page, rb,"TARG_CONN_STATE_LOGGED_IN\n" );break ;case TARG_CONN_STATE_IN_LOGOUT : - rb +=sprintf (page+rb, + rb +=sysfs_emit_at (page, rb,"TARG_CONN_STATE_IN_LOGOUT\n" );break ;case TARG_CONN_STATE_LOGOUT_REQUESTED : - rb +=sprintf (page+rb, + rb +=sysfs_emit_at (page, rb,"TARG_CONN_STATE_LOGOUT_REQUESTED\n" );break ;case TARG_CONN_STATE_CLEANUP_WAIT : - rb +=sprintf (page+rb, + rb +=sysfs_emit_at (page, rb,"TARG_CONN_STATE_CLEANUP_WAIT\n" );break ;default : - rb +=sprintf (page+rb, + rb +=sysfs_emit_at (page, rb,"ERROR: Unknown Connection State!\n" );break ; } - rb +=sprintf (page+rb," Address %pISc %s" , &conn->login_sockaddr, + rb +=sysfs_emit_at (page, rb," Address %pISc %s" , &conn->login_sockaddr, (conn->network_transport ==ISCSI_TCP ) ?"TCP" :"SCTP" ); - rb +=sprintf (page+rb," StatSN: 0x%08x\n" , + rb +=sysfs_emit_at (page, rb," StatSN: 0x%08x\n" , conn->stat_sn); }spin_unlock (&sess->conn_lock);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 119/211 serial: cpm_uart: Avoid suspicious locking
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 36ef11d311f405e55ad8e848c19b212ff71ef536 ]
CHECK drivers/tty/serial/cpm_uart/cpm_uart_core.cdrivers/tty/serial/cpm_uart/cpm_uart_core.c:1271:39: warning: context imbalance in 'cpm_uart_console_write' - unexpected unlock
Allthough 'nolock' is not expected to change, sparse find the following form suspicious:
if (unlikely(nolock)) {
local_irq_save(flags);
} else {
spin_lock_irqsave(&pinfo->port.lock, flags);
}
cpm_uart_early_write(pinfo, s, count, true);
if (unlikely(nolock)) {
local_irq_restore(flags);
} else {
spin_unlock_irqrestore(&pinfo->port.lock, flags);
}Rewrite it a more obvious form:
if (unlikely(oops_in_progress)) {
local_irq_save(flags);
cpm_uart_early_write(pinfo, s, count, true);
local_irq_restore(flags);
} else {
spin_lock_irqsave(&pinfo->port.lock, flags);
cpm_uart_early_write(pinfo, s, count, true);
spin_unlock_irqrestore(&pinfo->port.lock, flags);
}--- drivers/tty/serial/cpm_uart/cpm_uart_core.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-)
drivers/tty/serial/cpm_uart/cpm_uart_core.c +4 -9
@@ -1255,19 +1255,14 @@ static void cpm_uart_console_write(struct console *co, const char *s, {struct uart_cpm_port *pinfo = &cpm_uart_ports[co->index];unsigned long flags; -int nolock = oops_in_progress; -if (unlikely (nolock)) { +if (unlikely (oops_in_progress)) {local_irq_save (flags); - }else { -spin_lock_irqsave (&pinfo->port.lock, flags); - } - -cpm_uart_early_write (pinfo, s, count, true); - -if (unlikely (nolock)) { +cpm_uart_early_write (pinfo, s, count, true);local_irq_restore (flags); }else { +spin_lock_irqsave (&pinfo->port.lock, flags); +cpm_uart_early_write (pinfo, s, count, true);spin_unlock_irqrestore (&pinfo->port.lock, flags); } }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 120/211 misc: open-dice: make OPEN_DICE depend on HAS_IOMEM
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baoquan He <[email protected]>
[ Upstream commit aefc8b57af7787c80686e49a5841e9289cb11f53 ]
On s390 systems (aka mainframes), it has classic channel devices for networking and permanent storage that are currently even more common than PCI devices. Hence it could have a fully functional s390 kernel with CONFIG_PCI=n, then the relevant iomem mapping functions [including ioremap(), devm_ioremap(), etc.] are not available.
Here let OPEN_DICE depend on HAS_IOMEM so that it won't be built to cause below compiling error if PCI is unset:
------
ERROR: modpost: "devm_memremap" [drivers/misc/open-dice.ko] undefined!
ERROR: modpost: "devm_memunmap" [drivers/misc/open-dice.ko] undefined!
------
--- drivers/misc/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/misc/Kconfig +1 -0
@@ -496,6 +496,7 @@ config HISI_HIKEY_USB config OPEN_DICE tristate "Open Profile for DICE driver" depends on OF_RESERVED_MEM + depends on HAS_IOMEM help This driver exposes a DICE reserved memory region to userspace via a character device. The memory region contains Compound Device
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 121/211 usb: dwc3: dwc3-octeon: Verify clock divider
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ladislav Michl <[email protected]>
[ Upstream commit fb57f829beefd4b3746f1b23d51e80ed5d4bb87b ]
Although valid USB clock divider will be calculated for all valid Octeon core frequencies, make code formally correct limiting divider not to be greater that 7 so it fits into H_CLKDIV_SEL field.
--- arch/mips/cavium-octeon/octeon-usb.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
arch/mips/cavium-octeon/octeon-usb.c +6 -2
@@ -243,11 +243,11 @@ static int dwc3_octeon_get_divider(void)while (div <ARRAY_SIZE (clk_div)) {uint64_t rate =octeon_get_io_clock_rate () / clk_div[div];if (rate <=300000000 && rate >=150000000 ) -break ; +return div; div++; } -return div; +return -EINVAL ; }static int dwc3_octeon_config_power (struct device *dev,void __iomem *base)
@@ -374,6 +374,10 @@ static int dwc3_octeon_clocks_start(struct device *dev, void __iomem *base)/* Step 4b: Select controller clock frequency. */ div =dwc3_octeon_get_divider (); +if (div <0 ) { +dev_err (dev,"clock divider invalid\n" ); +return div; + } val =dwc3_octeon_readq (uctl_ctl_reg); val &= ~USBDRD_UCTL_CTL_H_CLKDIV_SEL ; val |=FIELD_PREP (USBDRD_UCTL_CTL_H_CLKDIV_SEL , div);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 122/211 usb: ehci: add workaround for chipidea PORTSC.PEC bug
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
[ Upstream commit dda4b60ed70bd670eefda081f70c0cb20bbeb1fa ]
Some NXP processor using chipidea IP has a bug when frame babble is detected.
As per 4.15.1.1.1 Serial Bus Babble:
A babble condition also exists if IN transaction is in progress at
High-speed SOF2 point. This is called frame babble. The host controller must disable the port to which the frame babble is detected.
The USB controller has disabled the port (PE cleared) and has asserted USBERRINT when frame babble is detected, but PEC is not asserted. Therefore, the SW isn't aware that port has been disabled. Then the SW keeps sending packets to this port, but all of the transfers will fail.
This workaround will firstly assert PCD by SW when USBERRINT is detected and then judge whether port change has really occurred or not by polling roothub status. Because the PEC doesn't get asserted in our case, this patch will also assert it by SW when specific conditions are satisfied.
--- drivers/usb/host/ehci-hcd.c | 8 ++++++-- drivers/usb/host/ehci-hub.c | 10 +++++++++- drivers/usb/host/ehci.h | 10 ++++++++++ 3 files changed, 25 insertions(+), 3 deletions(-)
drivers/usb/host/ehci-hcd.c +6 -2
@@ -755,10 +755,14 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)/* normal [4.15.1.2] or error [4.15.1.1] completion */ if (likely ((status & (STS_INT |STS_ERR )) !=0 )) { -if (likely ((status &STS_ERR ) ==0 )) +if (likely ((status &STS_ERR ) ==0 )) {INCR (ehci->stats.normal); -else + }else { +/* Force to check port status */ +if (ehci->has_ci_pec_bug) + status |=STS_PCD ;INCR (ehci->stats.error); + } bh =1 ; }
drivers/usb/host/ehci-hub.c +9 -1
@@ -674,7 +674,8 @@ ehci_hub_status_data (struct usb_hcd *hcd, char *buf)if ((temp & mask) !=0 ||test_bit (i, &ehci->port_c_suspend) || (ehci->reset_done[i] &&time_after_eq ( - jiffies, ehci->reset_done[i]))) { + jiffies, ehci->reset_done[i])) + ||ehci_has_ci_pec_bug (ehci, temp)) {if (i <7 ) buf [0 ] |=1 << (i +1 );else
@@ -875,6 +876,13 @@ int ehci_hub_control(if (temp &PORT_PEC ) status |=USB_PORT_STAT_C_ENABLE <<16 ; +if (ehci_has_ci_pec_bug (ehci, temp)) { + status |=USB_PORT_STAT_C_ENABLE <<16 ; +ehci_info (ehci, +"PE is cleared by HW port:%d PORTSC:%08x\n" , + wIndex +1 , temp); + } +if ((temp &PORT_OCC ) && (!ignore_oc && !ehci->spurious_oc)){ status |=USB_PORT_STAT_C_OVERCURRENT <<16 ;
drivers/usb/host/ehci.h +10 -0
@@ -207,6 +207,7 @@ struct ehci_hcd { /* one per controller */ unsigned has_fsl_port_bug:1; /* FreeScale */ unsigned has_fsl_hs_errata:1; /* Freescale HS quirk */ unsigned has_fsl_susp_errata:1; /* NXP SUSP quirk */ + unsigned has_ci_pec_bug:1; /* ChipIdea PEC bug */ unsigned big_endian_mmio:1; unsigned big_endian_desc:1; unsigned big_endian_capbase:1;
@@ -707,6 +708,15 @@ ehci_port_speed(struct ehci_hcd *ehci, unsigned int portsc)*/ #define ehci_has_fsl_susp_errata (e) ((e)->has_fsl_susp_errata) +/* +* Some Freescale/NXP processors using ChipIdea IP have a bug in which +* disabling the port (PE is cleared) does not cause PEC to be asserted +* when frame babble is detected. +*/ +#define ehci_has_ci_pec_bug (e, portsc) \ + ((e)->has_ci_pec_bug && ((e)->command & CMD_PSE) \ + && !(portsc & PORT_PEC) && !(portsc & PORT_PE)) +/* * While most USB host controllers implement their registers in * little-endian format, a minority (celleb companion chip) implement
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 123/211 usb: chipidea: add workaround for chipidea PEC bug
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
[ Upstream commit 12e6ac69cc7e7d3367599ae26a92a0f9a18bc728 ]
Some NXP processors using ChipIdea USB IP have a bug when frame babble is detected.
Issue description:
In USB camera test, our controller is host in HS mode. In ISOC IN, when device sends data across the micro frame, it causes the babble in host controller. This will clear the PE bit. In spec, it also requires to set the PEC bit and then set the PCI bit. Without the PCI interrupt, the software does not know the PE is cleared.
This will add a flag CI_HDRC_HAS_PORTSC_PEC_MISSED to some impacted platform datas. And the ehci host driver will assert PEC by SW when specific conditions are satisfied.
--- drivers/usb/chipidea/ci.h | 1 + drivers/usb/chipidea/ci_hdrc_imx.c | 4 +++- drivers/usb/chipidea/core.c | 2 ++ drivers/usb/chipidea/host.c | 1 + include/linux/usb/chipidea.h | 1 + 5 files changed, 8 insertions(+), 1 deletion(-)
drivers/usb/chipidea/ci.h +1 -0
@@ -257,6 +257,7 @@ struct ci_hdrc {bool id_event;bool b_sess_valid_event;bool imx28_write_fix; +bool has_portsc_pec_bug;bool supports_runtime_pm;bool in_lpm;bool wakeup_int;
drivers/usb/chipidea/ci_hdrc_imx.c +3 -1
@@ -67,11 +67,13 @@ static const struct ci_hdrc_imx_platform_flag imx7d_usb_data = {static const struct ci_hdrc_imx_platform_flag imx7ulp_usb_data = { .flags =CI_HDRC_SUPPORTS_RUNTIME_PM | +CI_HDRC_HAS_PORTSC_PEC_MISSED |CI_HDRC_PMQOS , };static const struct ci_hdrc_imx_platform_flag imx8ulp_usb_data = { - .flags =CI_HDRC_SUPPORTS_RUNTIME_PM , + .flags =CI_HDRC_SUPPORTS_RUNTIME_PM | +CI_HDRC_HAS_PORTSC_PEC_MISSED , };static const struct of_device_id ci_hdrc_imx_dt_ids[] = {
drivers/usb/chipidea/core.c +2 -0
@@ -1045,6 +1045,8 @@ static int ci_hdrc_probe(struct platform_device *pdev) CI_HDRC_IMX28_WRITE_FIX); ci->supports_runtime_pm = !!(ci->platdata->flags &CI_HDRC_SUPPORTS_RUNTIME_PM ); + ci->has_portsc_pec_bug = !!(ci->platdata->flags & +CI_HDRC_HAS_PORTSC_PEC_MISSED );platform_set_drvdata (pdev, ci); ret =hw_device_init (ci, base);
drivers/usb/chipidea/host.c +1 -0
@@ -151,6 +151,7 @@ static int host_start(struct ci_hdrc *ci) ehci->has_hostpc = ci->hw_bank.lpm; ehci->has_tdi_phy_lpm = ci->hw_bank.lpm; ehci->imx28_write_fix = ci->imx28_write_fix; + ehci->has_ci_pec_bug = ci->has_portsc_pec_bug; priv = (struct ehci_ci_priv *)ehci->priv; priv->reg_vbus =NULL ;
include/linux/usb/chipidea.h +1 -0
@@ -63,6 +63,7 @@ struct ci_hdrc_platform_data {#define CI_HDRC_IMX_IS_HSIC BIT(14)#define CI_HDRC_PMQOS BIT(15)#define CI_HDRC_PHY_VBUS_CONTROL BIT(16) +#define CI_HDRC_HAS_PORTSC_PEC_MISSED BIT(17)enum usb_dr_mode dr_mode;#define CI_HDRC_CONTROLLER_RESET_EVENT 0#define CI_HDRC_CONTROLLER_STOPPED_EVENT 1
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 124/211 media: pci: ipu3-cio2: Initialise timing struct to avoid a compiler warning
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
[ Upstream commit 9d7531be3085a8f013cf173ccc4e72e3cf493538 ]
Initialise timing struct in cio2_hw_init() to zero in order to avoid a compiler warning. The warning was a false positive.
--- drivers/media/pci/intel/ipu3/ipu3-cio2-main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/pci/intel/ipu3/ipu3-cio2-main.c +1 -1
@@ -355,7 +355,7 @@ static int cio2_hw_init(struct cio2_device *cio2, struct cio2_queue *q)void __iomem *const base = cio2->base;u8 lanes, csi2bus = q->csi2.port;u8 sensor_vc =SENSOR_VIR_CH_DFLT ; -struct cio2_csi2_timing timing; +struct cio2_csi2_timing timing = {0 };int i, r; fmt =cio2_find_format (NULL , &q->subdev_fmt.code);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 125/211 kobject: Add sanity check for kset->kobj.ktype in kset_register()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Lei <[email protected]>
[ Upstream commit 4d0fe8c52bb3029d83e323c961221156ab98680b ]
When I register a kset in the following way:
static struct kset my_kset;
kobject_set_name(&my_kset.kobj, "my_kset");
ret = kset_register(&my_kset);A null pointer dereference exception is occurred:
[ 4453.568337] Unable to handle kernel NULL pointer dereference at \ virtual address 0000000000000028 ... ... [ 4453.810361] Call trace: [ 4453.813062] kobject_get_ownership+0xc/0x34 [ 4453.817493] kobject_add_internal+0x98/0x274 [ 4453.822005] kset_register+0x5c/0xb4 [ 4453.825820] my_kobj_init+0x44/0x1000 [my_kset]
... ...
Because I didn't initialize my_kset.kobj.ktype.
According to the description in Documentation/core-api/kobject.rst:
- A ktype is the type of object that embeds a kobject. Every structure that embeds a kobject needs a corresponding ktype.
So add sanity check to make sure kset->kobj.ktype is not NULL.
--- lib/kobject.c | 5 +++++ 1 file changed, 5 insertions(+)
lib/kobject.c +5 -0
@@ -854,6 +854,11 @@ int kset_register(struct kset *k)if (!k)return -EINVAL ; +if (!k->kobj.ktype) { +pr_err ("must have a ktype to be initialized properly!\n" ); +return -EINVAL ; + } +kset_init (k); err =kobject_add_internal (&k->kobj);if (err) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 126/211 interconnect: Fix locking for runpm vs reclaim
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <[email protected]>
[ Upstream commit af42269c3523492d71ebbe11fefae2653e9cdc78 ]
For cases where icc_bw_set() can be called in callbaths that could deadlock against shrinker/reclaim, such as runpm resume, we need to decouple the icc locking. Introduce a new icc_bw_lock for cases where we need to serialize bw aggregation and update to decouple that from paths that require memory allocation such as node/link creation/ destruction.
Fixes this lockdep splat:
======================================================
WARNING: possible circular locking dependency detected 6.2.0-rc8-debug+ #554 Not tainted
------------------------------------------------------
ring0/132 is trying to acquire lock:
ffffff80871916d0 (&gmu->lock){+.+.}-{3:3}, at: a6xx_pm_resume+0xf0/0x234
but task is already holding lock:
ffffffdb5aee57e8 (dma_fence_map){++++}-{0:0}, at: msm_job_run+0x68/0x150
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #4 (dma_fence_map){++++}-{0:0}:
__dma_fence_might_wait+0x74/0xc0
dma_resv_lockdep+0x1f4/0x2f4
do_one_initcall+0x104/0x2bc
kernel_init_freeable+0x344/0x34c
kernel_init+0x30/0x134
ret_from_fork+0x10/0x20-> #3 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}:
fs_reclaim_acquire+0x80/0xa8
slab_pre_alloc_hook.constprop.0+0x40/0x25c
__kmem_cache_alloc_node+0x60/0x1cc
__kmalloc+0xd8/0x100
topology_parse_cpu_capacity+0x8c/0x178
get_cpu_for_node+0x88/0xc4
parse_cluster+0x1b0/0x28c
parse_cluster+0x8c/0x28c
init_cpu_topology+0x168/0x188
smp_prepare_cpus+0x24/0xf8
kernel_init_freeable+0x18c/0x34c
kernel_init+0x30/0x134
ret_from_fork+0x10/0x20-> #2 (fs_reclaim){+.+.}-{0:0}:
__fs_reclaim_acquire+0x3c/0x48
fs_reclaim_acquire+0x54/0xa8
slab_pre_alloc_hook.constprop.0+0x40/0x25c
__kmem_cache_alloc_node+0x60/0x1cc
__kmalloc+0xd8/0x100
kzalloc.constprop.0+0x14/0x20
icc_node_create_nolock+0x4c/0xc4
icc_node_create+0x38/0x58
qcom_icc_rpmh_probe+0x1b8/0x248
platform_probe+0x70/0xc4
really_probe+0x158/0x290
__driver_probe_device+0xc8/0xe0
driver_probe_device+0x44/0x100
__driver_attach+0xf8/0x108
bus_for_each_dev+0x78/0xc4
driver_attach+0x2c/0x38
bus_add_driver+0xd0/0x1d8
driver_register+0xbc/0xf8
__platform_driver_register+0x30/0x3c
qnoc_driver_init+0x24/0x30
do_one_initcall+0x104/0x2bc
kernel_init_freeable+0x344/0x34c
kernel_init+0x30/0x134
ret_from_fork+0x10/0x20-> #1 (icc_lock){+.+.}-{3:3}:
__mutex_lock+0xcc/0x3c8
mutex_lock_nested+0x30/0x44
icc_set_bw+0x88/0x2b4
_set_opp_bw+0x8c/0xd8
_set_opp+0x19c/0x300
dev_pm_opp_set_opp+0x84/0x94
a6xx_gmu_resume+0x18c/0x804
a6xx_pm_resume+0xf8/0x234
adreno_runtime_resume+0x2c/0x38
pm_generic_runtime_resume+0x30/0x44
__rpm_callback+0x15c/0x174
rpm_callback+0x78/0x7c
rpm_resume+0x318/0x524
__pm_runtime_resume+0x78/0xbc
adreno_load_gpu+0xc4/0x17c
msm_open+0x50/0x120
drm_file_alloc+0x17c/0x228
drm_open_helper+0x74/0x118
drm_open+0xa0/0x144
drm_stub_open+0xd4/0xe4
chrdev_open+0x1b8/0x1e4
do_dentry_open+0x2f8/0x38c
vfs_open+0x34/0x40
path_openat+0x64c/0x7b4
do_filp_open+0x54/0xc4
do_sys_openat2+0x9c/0x100
do_sys_open+0x50/0x7c
__arm64_sys_openat+0x28/0x34
invoke_syscall+0x8c/0x128
el0_svc_common.constprop.0+0xa0/0x11c
do_el0_svc+0xac/0xbc
el0_svc+0x48/0xa0
el0t_64_sync_handler+0xac/0x13c
el0t_64_sync+0x190/0x194-> #0 (&gmu->lock){+.+.}-{3:3}:
__lock_acquire+0xe00/0x1060
lock_acquire+0x1e0/0x2f8
__mutex_lock+0xcc/0x3c8
mutex_lock_nested+0x30/0x44
a6xx_pm_resume+0xf0/0x234
adreno_runtime_resume+0x2c/0x38
pm_generic_runtime_resume+0x30/0x44
__rpm_callback+0x15c/0x174
rpm_callback+0x78/0x7c
rpm_resume+0x318/0x524
__pm_runtime_resume+0x78/0xbc
pm_runtime_get_sync.isra.0+0x14/0x20
msm_gpu_submit+0x58/0x178
msm_job_run+0x78/0x150
drm_sched_main+0x290/0x370
kthread+0xf0/0x100
ret_from_fork+0x10/0x20other info that might help us debug this:
Chain exists of:
&gmu->lock --> mmu_notifier_invalidate_range_start --> dma_fence_map
Possible unsafe locking scenario: CPU0 CPU1
---- ----
lock(dma_fence_map);
lock(mmu_notifier_invalidate_range_start);
lock(dma_fence_map);
lock(&gmu->lock);
*** DEADLOCK ***2 locks held by ring0/132:
#0: ffffff8087191170 (&gpu->lock){+.+.}-{3:3}, at: msm_job_run+0x64/0x150
#1: ffffffdb5aee57e8 (dma_fence_map){++++}-{0:0}, at: msm_job_run+0x68/0x150 stack backtrace:
CPU: 7 PID: 132 Comm: ring0 Not tainted 6.2.0-rc8-debug+ #554
Hardware name: Google Lazor (rev1 - 2) with LTE (DT)
Call trace:
dump_backtrace.part.0+0xb4/0xf8
show_stack+0x20/0x38
dump_stack_lvl+0x9c/0xd0
dump_stack+0x18/0x34
print_circular_bug+0x1b4/0x1f0
check_noncircular+0x78/0xac
__lock_acquire+0xe00/0x1060
lock_acquire+0x1e0/0x2f8
__mutex_lock+0xcc/0x3c8
mutex_lock_nested+0x30/0x44
a6xx_pm_resume+0xf0/0x234
adreno_runtime_resume+0x2c/0x38
pm_generic_runtime_resume+0x30/0x44
__rpm_callback+0x15c/0x174
rpm_callback+0x78/0x7c
rpm_resume+0x318/0x524
__pm_runtime_resume+0x78/0xbc
pm_runtime_get_sync.isra.0+0x14/0x20
msm_gpu_submit+0x58/0x178
msm_job_run+0x78/0x150
drm_sched_main+0x290/0x370
kthread+0xf0/0x100
ret_from_fork+0x10/0x20--- drivers/interconnect/core.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/interconnect/core.c +6 -2
@@ -28,6 +28,7 @@ static LIST_HEAD(icc_providers);static int providers_count;static bool synced_state;static DEFINE_MUTEX (icc_lock); +static DEFINE_MUTEX (icc_bw_lock);static struct dentry *icc_debugfs_dir;static void icc_summary_show_one (struct seq_file *s,struct icc_node *n)
@@ -631,7 +632,7 @@ int icc_set_bw(struct icc_path *path, u32 avg_bw, u32 peak_bw)if (WARN_ON (IS_ERR (path) || !path->num_nodes))return -EINVAL ; -mutex_lock (&icc_lock); +mutex_lock (&icc_bw_lock); old_avg = path->reqs[0 ].avg_bw; old_peak = path->reqs[0 ].peak_bw;
@@ -663,7 +664,7 @@ int icc_set_bw(struct icc_path *path, u32 avg_bw, u32 peak_bw)apply_constraints (path); } -mutex_unlock (&icc_lock); +mutex_unlock (&icc_bw_lock);trace_icc_set_bw_end (path, ret);
@@ -872,6 +873,7 @@ void icc_node_add(struct icc_node *node, struct icc_provider *provider)return ;mutex_lock (&icc_lock); +mutex_lock (&icc_bw_lock); node->provider = provider;list_add_tail (&node->node_list, &provider->nodes);
@@ -900,6 +902,7 @@ void icc_node_add(struct icc_node *node, struct icc_provider *provider) node->avg_bw =0 ; node->peak_bw =0 ; +mutex_unlock (&icc_bw_lock);mutex_unlock (&icc_lock); }EXPORT_SYMBOL_GPL (icc_node_add);
@@ -1025,6 +1028,7 @@ void icc_sync_state(struct device *dev)return ;mutex_lock (&icc_lock); +mutex_lock (&icc_bw_lock); synced_state = true;list_for_each_entry (p, &icc_providers, provider_list) {dev_dbg (p->dev,"interconnect provider is in synced state\n" );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 127/211 usb: typec: qcom-pmic-typec: register drm_bridge
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 4b3cd783808bb327d931bbb1324d6c367443b721 ]
The current approach to handling DP on bridge-enabled platforms requires a chain of DP bridges up to the USB-C connector. Register a last DRM bridge for such chain.
--- drivers/usb/typec/tcpm/Kconfig | 1 + drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c | 37 +++++++++++++++++++ 2 files changed, 38 insertions(+)
drivers/usb/typec/tcpm/Kconfig +1 -0
@@ -79,6 +79,7 @@ config TYPEC_WCOVE config TYPEC_QCOM_PMIC tristate "Qualcomm PMIC USB Type-C Port Controller Manager driver" depends on ARCH_QCOM || COMPILE_TEST + depends on DRM || DRM=n help A Type-C port and Power Delivery driver which aggregates two discrete pieces of silicon in the PM8150b PMIC block: the
drivers/usb/typec/tcpm/qcom/qcom_pmic_typec.c +37 -0
@@ -17,6 +17,9 @@#include <linux/usb/role.h> #include <linux/usb/tcpm.h> #include <linux/usb/typec_mux.h> + +#include <drm/drm_bridge.h> +#include "qcom_pmic_typec_pdphy.h" #include "qcom_pmic_typec_port.h"
@@ -33,6 +36,7 @@ struct pmic_typec {struct pmic_typec_port *pmic_typec_port;bool vbus_enabled;struct mutex lock;/* VBUS state serialization */ +struct drm_bridge bridge; };#define tcpc_to_tcpm (_tcpc_) container_of(_tcpc_, struct pmic_typec, tcpc)
@@ -146,6 +150,35 @@ static int qcom_pmic_typec_init(struct tcpc_dev *tcpc)return 0 ; } +#if IS_ENABLED (CONFIG_DRM ) +static int qcom_pmic_typec_attach (struct drm_bridge *bridge, +enum drm_bridge_attach_flags flags) +{ +return flags &DRM_BRIDGE_ATTACH_NO_CONNECTOR ?0 : -EINVAL ; +} + +static const struct drm_bridge_funcs qcom_pmic_typec_bridge_funcs = { + .attach = qcom_pmic_typec_attach, +}; + +static int qcom_pmic_typec_init_drm (struct pmic_typec *tcpm) +{ + tcpm->bridge.funcs = &qcom_pmic_typec_bridge_funcs; +#ifdef CONFIG_OF + tcpm->bridge.of_node =of_get_child_by_name (tcpm->dev->of_node,"connector" ); +#endif + tcpm->bridge.ops =DRM_BRIDGE_OP_HPD ; + tcpm->bridge.type = DRM_MODE_CONNECTOR_DisplayPort; + +return devm_drm_bridge_add (tcpm->dev, &tcpm->bridge); +} +#else +static int qcom_pmic_typec_init_drm (struct pmic_typec *tcpm) +{ +return 0 ; +} +#endif +static int qcom_pmic_typec_probe (struct platform_device *pdev) {struct pmic_typec *tcpm;
@@ -208,6 +241,10 @@ static int qcom_pmic_typec_probe(struct platform_device *pdev)mutex_init (&tcpm->lock);platform_set_drvdata (pdev, tcpm); + ret =qcom_pmic_typec_init_drm (tcpm); +if (ret) +return ret; + tcpm->tcpc.fwnode =device_get_named_child_node (tcpm->dev,"connector" );if (!tcpm->tcpc.fwnode)return -EINVAL ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 128/211 printk: Reduce console_unblank() usage in unsafe scenarios
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Ogness <[email protected]>
[ Upstream commit 7b23a66db55ed0a55b020e913f0d6f6d52a1ad2c ]
A semaphore is not NMI-safe, even when using down_trylock(). Both down_trylock() and up() are using internal spinlocks and up() might even call wake_up_process().
In the panic() code path it gets even worse because the internal spinlocks of the semaphore may have been taken by a CPU that has been stopped.
To reduce the risk of deadlocks caused by the console semaphore in the panic path, make the following changes:
- First check if any consoles have implemented the unblank() callback. If not, then there is no reason to take the console semaphore anyway. (This check is also useful for the non-panic path since the locking/unlocking of the console lock can be quite expensive due to console printing.)
- If the panic path is in NMI context, bail out without attempting to take the console semaphore or calling any unblank() callbacks. Bailing out is acceptable because console_unblank() would already bail out if the console semaphore is contended. The alternative of ignoring the console semaphore and calling the unblank() callbacks anyway is a bad idea because these callbacks are also not NMI-safe.
If consoles with unblank() callbacks exist and console_unblank() is called from a non-NMI panic context, it will still attempt a down_trylock(). This could still result in a deadlock if one of the stopped CPUs is holding the semaphore internal spinlock. But this is a risk that the kernel has been (and continues to be) willing to take.
--- kernel/printk/printk.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+)
kernel/printk/printk.c +28 -0
@@ -3045,9 +3045,27 @@ EXPORT_SYMBOL(console_conditional_schedule);void console_unblank (void ) { +bool found_unblank = false;struct console *c;int cookie; +/* +* First check if there are any consoles implementing the unblank() +* callback. If not, there is no reason to continue and take the +* console lock, which in particular can be dangerous if +* @oops_in_progress is set. +*/ + cookie =console_srcu_read_lock (); +for_each_console_srcu (c) { +if ((console_srcu_read_flags (c) &CON_ENABLED ) && c->unblank) { + found_unblank = true; +break ; + } + } +console_srcu_read_unlock (cookie); +if (!found_unblank) +return ; +/* * Stop console printing because the unblank() callback may * assume the console is not within its write() callback.
@@ -3056,6 +3074,16 @@ void console_unblank(void)* In that case, attempt a trylock as best-effort. */ if (oops_in_progress) { +/* Semaphores are not NMI-safe. */ +if (in_nmi ()) +return ; + +/* +* Attempting to trylock the console lock can deadlock +* if another CPU was stopped while modifying the +* semaphore. "Hope and pray" that this is not the +* current situation. +*/ if (down_trylock_console_sem () !=0 )return ; }else
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 129/211 printk: Keep non-panic-CPUs out of console lock
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Ogness <[email protected]>
[ Upstream commit 51a1d258e50e03a0216bf42b6af9ff34ec402ac1 ]
When in a panic situation, non-panic CPUs should avoid holding the console lock so as not to contend with the panic CPU. This is already implemented with abandon_console_lock_in_panic(), which is checked after each printed line. However, non-panic CPUs should also avoid trying to acquire the console lock during a panic.
Modify console_trylock() to fail and console_lock() to block() when called from a non-panic CPU during a panic.
--- kernel/printk/printk.c | 45 ++++++++++++++++++++++++------------------ 1 file changed, 26 insertions(+), 19 deletions(-)
kernel/printk/printk.c +26 -19
@@ -2585,6 +2585,25 @@ static int console_cpu_notify(unsigned int cpu)return 0 ; } +/* +* Return true when this CPU should unlock console_sem without pushing all +* messages to the console. This reduces the chance that the console is +* locked when the panic CPU tries to use it. +*/ +static bool abandon_console_lock_in_panic (void ) +{ +if (!panic_in_progress ()) +return false; + +/* +* We can use raw_smp_processor_id() here because it is impossible for +* the task to be migrated to the panic_cpu, or away from it. If +* panic_cpu has already been set, and we're not currently executing on +* that CPU, then we never will be. +*/ +return atomic_read (&panic_cpu) !=raw_smp_processor_id (); +} +/** * console_lock - block the console subsystem from printing *
@@ -2597,6 +2616,10 @@ void console_lock(void) {might_sleep (); +/* On panic, the console_lock must be left to the panic cpu. */ +while (abandon_console_lock_in_panic ()) +msleep (1000 ); +down_console_sem ();if (console_suspended)return ;
@@ -2615,6 +2638,9 @@ EXPORT_SYMBOL(console_lock);*/ int console_trylock (void ) { +/* On panic, the console_lock must be left to the panic cpu. */ +if (abandon_console_lock_in_panic ()) +return 0 ;if (down_trylock_console_sem ())return 0 ;if (console_suspended) {
@@ -2633,25 +2659,6 @@ int is_console_locked(void) }EXPORT_SYMBOL (is_console_locked); -/* -* Return true when this CPU should unlock console_sem without pushing all -* messages to the console. This reduces the chance that the console is -* locked when the panic CPU tries to use it. -*/ -static bool abandon_console_lock_in_panic (void ) -{ -if (!panic_in_progress ()) -return false; - -/* -* We can use raw_smp_processor_id() here because it is impossible for -* the task to be migrated to the panic_cpu, or away from it. If -* panic_cpu has already been set, and we're not currently executing on -* that CPU, then we never will be. -*/ -return atomic_read (&panic_cpu) !=raw_smp_processor_id (); -} -/* * Check if the given console is currently capable and allowed to print * records.
Signature · 1 line
2.40.1