6.1.56-rc1 review
Subsystems (8)
Greg Kroah-Hartman
maintainercover 6.1.56-rc1 review
This is the start of the stable review cycle for the 6.1.56 release. There are 259 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 06 Oct 2023 17:51:12 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.56-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.1.56-rc1
Mario Limonciello <[email protected]>
ASoC: amd: yc: Fix a non-functional mic on Lenovo 82TL
Michal Hocko <[email protected]>
mm, memcg: reconsider kmem.limit_in_bytes deprecation
Michal Hocko <[email protected]>
memcg: drop kmem.limit_in_bytes
Jani Nikula <[email protected]>
drm/meson: fix memory leak on ->hpd_notify callback
YuBiao Wang <[email protected]>
drm/amdkfd: Use gpu_offset for user queue's wptr
Greg Ungerer <[email protected]>
fs: binfmt_elf_efpic: fix personality for ELF-FDPIC
Linus Walleij <[email protected]>
power: supply: ab8500: Set typing and props
Nicolas Frattaroli <[email protected]>
power: supply: rk817: Add missing module alias
Javier Pello <[email protected]>
drm/i915/gt: Fix reservation address in ggtt_reserve_guc_top
Matthias Schiffer <[email protected]>
ata: libata-sata: increase PMP SRST timeout to 10s
Damien Le Moal <[email protected]>
ata: libata-core: Do not register PM operations for SAS ports
Damien Le Moal <[email protected]>
ata: libata-core: Fix port and device removal
Damien Le Moal <[email protected]>
ata: libata-core: Fix ata_port_request_pm() locking
Quang Le <[email protected]>
fs/smb/client: Reset password pointer to NULL
Mika Westerberg <[email protected]>
net: thunderbolt: Fix TCPv6 GSO checksum calculation
Nick Desaulniers <[email protected]>
bpf: Fix BTF_ID symbol generation collision in tools/
Jiri Olsa <[email protected]>
bpf: Fix BTF_ID symbol generation collision
Jiri Olsa <[email protected]>
bpf: Add override check to kprobe multi link attach
Ricardo Ribalda <[email protected]>
media: uvcvideo: Fix OOB read
Josef Bacik <[email protected]>
btrfs: properly report 0 avail for very full file systems
Steven Rostedt (Google) <[email protected]>
ring-buffer: Update "shortest_full" in polling
Johannes Weiner <[email protected]>
mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement
Rafael Aquini <[email protected]>
mm/slab_common: fix slab_caches list corruption after kmem_cache_destroy()
Jinjie Ruan <[email protected]>
mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions()
Mikko Rapeli <[email protected]>
arm64: defconfig: remove CONFIG_COMMON_CLK_NPCM8XX=y
Janusz Krzysztofik <[email protected]>
drm/tests: Fix incorrect argument in drm_test_mm_insert_range
Frederic Weisbecker <[email protected]>
timers: Tag (hr)timer softirq as hotplug safe
Trond Myklebust <[email protected]>
Revert "SUNRPC dont update timeout value on connection reset"
Florian Westphal <[email protected]>
netfilter: nf_tables: fix kdoc warnings after gc rework
Joel Fernandes (Google) <[email protected]>
sched/rt: Fix live lock between select_fallback_rq() and RT push
Liam R. Howlett <[email protected]>
kernel/sched: Modify initial boot task idle setup
August Wikerfors <[email protected]>
ASoC: amd: yc: Fix non-functional mic on Lenovo 82QF and 82UG
Heiner Kallweit <[email protected]>
i2c: i801: unregister tco_pdev in i801_probe() error path
Jens Axboe <[email protected]>
io_uring/fs: remove sqe->rw_flags checking from LINKAT
Niklas Cassel <[email protected]>
ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION CODES
Damien Le Moal <[email protected]>
ata: libata-scsi: link ata port and scsi device
Huacai Chen <[email protected]>
LoongArch: numa: Fix high_memory calculation
Tiezhu Yang <[email protected]>
LoongArch: Define relocation types for ABI v2.10
Kailang Yang <[email protected]>
ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre M70q
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: disallow rule removal from chain binding
Pan Bian <[email protected]>
nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
Andy Shevchenko <[email protected]>
serial: 8250_port: Check IRQ data before use
Daniel Starke <[email protected]>
Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux"
Ricky WU <[email protected]>
misc: rtsx: Fix some platforms can not boot and move the l1ss judgment to probe
Paolo Abeni <[email protected]>
mptcp: fix bogus receive window shrinkage with multiple subflows
Paolo Bonzini <[email protected]>
KVM: x86/mmu: Do not filter address spaces in for_each_tdp_mmu_root_yield_safe()
Sean Christopherson <[email protected]>
KVM: x86/mmu: Open code leaf invalidation from mmu_notifier
Tom Lendacky <[email protected]>
KVM: SVM: Fix TSC_AUX virtualization setup
Paolo Bonzini <[email protected]>
KVM: SVM: INTERCEPT_RDTSCP is never intercepted anyway
Pu Wen <[email protected]>
x86/srso: Add SRSO mitigation for Hygon processors
Haitao Huang <[email protected]>
x86/sgx: Resolves SECS reclaim vs. page fault for EAUG race
Nicolin Chen <[email protected]>
iommu/arm-smmu-v3: Fix soft lockup triggered by arm_smmu_mm_invalidate_range
Roberto Sassu <[email protected]>
smack: Retrieve transmuting information in smack_inode_getsecurity()
Roberto Sassu <[email protected]>
smack: Record transmuting in smk_transmuted
Irvin Cote <[email protected]>
nvme-pci: always return an ERR_PTR from nvme_pci_alloc_dev
Gleb Chesnokov <[email protected]>
scsi: qla2xxx: Fix NULL pointer dereference in target mode
Sven Eckelmann <[email protected]>
wifi: ath11k: Don't drop tx_status when peer cannot be found
Pratyush Yadav <[email protected]>
nvme-pci: do not set the NUMA node of device if it has none
Christoph Hellwig <[email protected]>
nvme-pci: factor out a nvme_pci_alloc_dev helper
Christoph Hellwig <[email protected]>
nvme-pci: factor the iod mempool creation into a helper
Arnaldo Carvalho de Melo <[email protected]>
perf build: Define YYNOMEM as YYNOABORT for bison < 3.81
Thomas Zimmermann <[email protected]>
fbdev/sh7760fb: Depend on FB=y
Huacai Chen <[email protected]>
LoongArch: Set all reserved memblocks on Node#0 at initialization
Gerhard Engleder <[email protected]>
tsnep: Fix NAPI polling with budget 0
Gerhard Engleder <[email protected]>
tsnep: Fix NAPI scheduling
Sebastian Andrzej Siewior <[email protected]>
net: hsr: Add __packed to struct hsr_sup_tlv.
Johnathan Mantey <[email protected]>
ncsi: Propagate carrier gain/loss events to the NCSI controller
Benjamin Gray <[email protected]>
powerpc/watchpoints: Annotate atomic context in more places
Benjamin Gray <[email protected]>
powerpc/watchpoint: Disable pagefaults when getting user instruction
Benjamin Gray <[email protected]>
powerpc/watchpoints: Disable preemption in thread_change_pc()
Ranjani Sridharan <[email protected]>
ASoC: SOF: Intel: MTL: Reduce the DSP init timeout
Olga Kornievskaia <[email protected]>
NFSv4.1: fix zero value filehandle in post open getattr
Hans Verkuil <[email protected]>
media: vb2: frame_vector.c: replace WARN_ONCE with a comment
Chancel Liu <[email protected]>
ASoC: imx-rpmsg: Set ignore_pmdown_time for dai_link
Mike Rapoport (IBM) <[email protected]>
memblock tests: fix warning ‘struct seq_file’ declared inside parameter list
Mike Rapoport (IBM) <[email protected]>
memblock tests: fix warning: "__ALIGN_KERNEL" redefined
Richard Fitzgerald <[email protected]>
firmware: cirrus: cs_dsp: Only log list of algorithms in debug build
Richard Fitzgerald <[email protected]>
ASoC: cs42l42: Don't rely on GPIOD_OUT_LOW to set RESET initially low
Richard Fitzgerald <[email protected]>
ASoC: cs42l42: Ensure a reset pulse meets minimum pulse width.
Peter Ujfalusi <[email protected]>
ALSA: hda: intel-sdw-acpi: Use u8 type for link index
Stanislav Fomichev <[email protected]>
bpf: Clarify error expectations from bpf_clone_redirect
Hou Tao <[email protected]>
bpf: Ensure unit_size is matched with slab cache object size
Mika Westerberg <[email protected]>
spi: intel-pci: Add support for Granite Rapids SPI serial flash
Shengjiu Wang <[email protected]>
ASoC: fsl: imx-pcm-rpmsg: Add SNDRV_PCM_INFO_BATCH flag
Valentin Caron <[email protected]>
spi: stm32: add a delay before SPI disable
Han Xu <[email protected]>
spi: nxp-fspi: reset the FLSHxCR1 registers
Niklas Cassel <[email protected]>
ata: libata-eh: do not clear ATA_PFLAG_EH_PENDING in ata_eh_reset()
Steve French <[email protected]>
smb3: correct places where ENOTSUPP is used instead of preferred EOPNOTSUPP
Michal Grzedzicki <[email protected]>
scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command
Michal Grzedzicki <[email protected]>
scsi: pm80xx: Use phy-specific SAS address when sending PHY_START command
Icenowy Zheng <[email protected]>
riscv: errata: fix T-Head dcache.cva encoding
David Francis <[email protected]>
drm/amdgpu: Handle null atom context in VBIOS info ioctl
Alex Deucher <[email protected]>
drm/amdgpu/nbio4.3: set proper rmmio_remap.reg_offset for SR-IOV
Alex Deucher <[email protected]>
drm/amdgpu/soc21: don't remap HDP registers for SR-IOV
Swapnil Patel <[email protected]>
drm/amd/display: Don't check registers, if using AUX BL control
Julia Lawall <[email protected]>
thermal/of: add missing of_node_put()
Luke D. Jones <[email protected]>
platform/x86: asus-wmi: Support 2023 ROG X16 tablet mode
David Thompson <[email protected]>
platform/mellanox: mlxbf-bootctl: add NET dependency into Kconfig
Christophe JAILLET <[email protected]>
ata: sata_mv: Fix incorrect string length computation in mv_dump_mem()
Guangguan Wang <[email protected]>
net/smc: bugfix for smcr v2 server connect success statistic
Steven Rostedt (Google) <[email protected]>
ring-buffer: Do not attempt to read past "commit"
Ricardo B. Marliere <[email protected]>
selftests: fix dependency checker script
Filipe Manana <[email protected]>
btrfs: assert delayed node locked when removing delayed item
Zheng Yejian <[email protected]>
ring-buffer: Avoid softlockup in ring_buffer_resize()
Zheng Yejian <[email protected]>
selftests/ftrace: Correctly enable event in instance-event.tc
Kiwoong Kim <[email protected]>
scsi: ufs: core: Poll HCS.UCRDY before issuing a UIC command
Kiwoong Kim <[email protected]>
scsi: ufs: core: Move __ufshcd_send_uic_cmd() outside host_lock
Javed Hasan <[email protected]>
scsi: qedf: Add synchronization between I/O completions and abort
Helge Deller <[email protected]>
parisc: irq: Make irq_stack_union static to avoid sparse warning
Helge Deller <[email protected]>
parisc: drivers: Fix sparse warning
Helge Deller <[email protected]>
parisc: iosapic.c: Fix sparse warnings
Helge Deller <[email protected]>
parisc: sba: Fix compile warning wrt list of SBA devices
Nigel Kirkland <[email protected]>
nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid()
Tobias Schramm <[email protected]>
spi: sun6i: fix race between DMA RX transfer completion and RX FIFO drain
Tobias Schramm <[email protected]>
spi: sun6i: reduce DMA RX transfer width to single byte
Daniel Borkmann <[email protected]>
bpf: Annotate bpf_long_memcpy with data_race
Sergey Senozhatsky <[email protected]>
dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock
Xiubo Li <[email protected]>
ceph: drop messages from MDS when unmounting
Sean Christopherson <[email protected]>
x86/reboot: VMCLEAR active VMCSes before emergency reboot
William A. Kennington III <[email protected]>
i2c: npcm7xx: Fix callback completion ordering
Wenhua Lin <[email protected]>
gpio: pmic-eic-sprd: Add can_sleep flag for PMIC EIC chip
Sudeep Holla <[email protected]>
firmware: arm_ffa: Don't set the memory region attributes for MEM_LEND
Rob Herring <[email protected]>
arm64: dts: imx: Add imx8mm-prt8mm.dtb to build
Nathan Rossi <[email protected]>
soc: imx8m: Enable OCOTP clock for imx8mm before reading registers
Michael Ellerman <[email protected]>
selftests/powerpc: Fix emit_tests to work with run_kselftest.sh
Benjamin Gray <[email protected]>
selftests/powerpc: Pass make context to children
Benjamin Gray <[email protected]>
selftests/powerpc: Use CLEAN macro to fix make warning
Chris Morgan <[email protected]>
power: supply: rk817: Fix node refcount leak
Max Filippov <[email protected]>
xtensa: boot/lib: fix function prototypes
Randy Dunlap <[email protected]>
xtensa: umulsidi3: fix conditional expression
Randy Dunlap <[email protected]>
xtensa: boot: don't add include-dirs
Randy Dunlap <[email protected]>
xtensa: iss/network: make functions static
Max Filippov <[email protected]>
xtensa: add default definition for XCHAL_HAVE_DIV32
Christophe JAILLET <[email protected]>
firmware: imx-dsp: Fix an error handling path in imx_dsp_setup_channels()
Dan Carpenter <[email protected]>
power: supply: ucs1002: fix error code in ucs1002_get_property()
Tony Lindgren <[email protected]>
bus: ti-sysc: Fix SYSC_QUIRK_SWSUP_SIDLE_ACT handling for uart wake-up
Tony Lindgren <[email protected]>
ARM: dts: ti: omap: motorola-mapphone: Fix abe_clkctrl warning on boot
Tony Lindgren <[email protected]>
ARM: dts: Unify pinctrl-single pin group nodes for omap4
Tony Lindgren <[email protected]>
ARM: dts: Unify pwm-omap-dmtimer node names
Tony Lindgren <[email protected]>
ARM: dts: ti: omap: Fix bandgap thermal cells addressing for omap3/4
Krzysztof Kozlowski <[email protected]>
ARM: dts: omap: correct indentation
Timo Alho <[email protected]>
clk: tegra: fix error return case for recalc_rate
Zhifeng Tang <[email protected]>
clk: sprd: Fix thm_parents incorrect configuration
Harshit Mogalapalli <[email protected]>
power: supply: mt6370: Fix missing error code in mt6370_chg_toggle_cfo()
Sibi Sankar <[email protected]>
firmware: arm_scmi: Fixup perf power-cost/microwatt support
Cristian Marussi <[email protected]>
firmware: arm_scmi: Harden perf domain info access
Adam Ford <[email protected]>
bus: ti-sysc: Fix missing AM35xx SoC matching
Julien Panis <[email protected]>
bus: ti-sysc: Use fsleep() instead of usleep_range() in sysc_reset()
Marek Vasut <[email protected]>
drm/bridge: ti-sn65dsi83: Do not generate HFP/HBP/HSA and EOT packet
Charles Kearney <[email protected]>
spi: spi-gxp: BUG: Correct spi write return value
Christoph Hellwig <[email protected]>
MIPS: Alchemy: only build mmc support helpers if au1xmmc is enabled
Jinjie Ruan <[email protected]>
vfio/mdev: Fix a null-ptr-deref bug for mdev_unregister_parent()
Qu Wenruo <[email protected]>
btrfs: reset destination buffer when read_extent_buffer() gets invalid range
Harish Kasiviswanathan <[email protected]>
drm/amdkfd: Insert missing TLB flush on GFX10 and later
Philip Yang <[email protected]>
drm/amdkfd: Flush TLB after unmapping for GFX v9.4.3
Nilesh Javali <[email protected]>
scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id()
Shreyas Deodhar <[email protected]>
scsi: qla2xxx: Select qpair depending on which CPU post_cmd() gets called
Sven Eckelmann <[email protected]>
wifi: ath11k: Cleanup mac80211 references on failure during tx_complete
Pradeep Kumar Chitrapu <[email protected]>
wifi: ath11k: fix tx status reporting in encap offload mode
Amit Pundir <[email protected]>
arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved
Holger Dengler <[email protected]>
s390/pkey: fix PKEY_TYPE_EP11_AES handling in PKEY_CLR2SECK2 IOCTL
Jaegeuk Kim <[email protected]>
f2fs: get out of a repeat loop when getting a locked data page
Chao Yu <[email protected]>
f2fs: optimize iteration over sparse directories
Krzysztof Kozlowski <[email protected]>
ARM: dts: qcom: msm8974pro-castor: correct touchscreen syna,nosleep-mode
Krzysztof Kozlowski <[email protected]>
ARM: dts: qcom: msm8974pro-castor: correct touchscreen function names
Krzysztof Kozlowski <[email protected]>
ARM: dts: qcom: msm8974pro-castor: correct inverted X of touchscreen
Paul Cercueil <[email protected]>
ARM: dts: samsung: exynos4210-i9100: Fix LCD screen's physical size
Aleksey Nasibulin <[email protected]>
ARM: dts: BCM5301X: Extend RAM to full 256MB for Linksys EA6500 V2
Daniel Scally <[email protected]>
i2c: xiic: Correct return value check for xiic_reinit()
Liang He <[email protected]>
i2c: mux: gpio: Add missing fwnode_handle_put()
Xiaoke Wang <[email protected]>
i2c: mux: demux-pinctrl: check the return value of devm_kstrdup()
Christophe JAILLET <[email protected]>
gpio: tb10x: Fix an error handling path in tb10x_gpio_probe()
Zhang Xiaoxu <[email protected]>
cifs: Fix UAF in cifs_demultiplex_thread()
Ben Wolsieffer <[email protected]>
proc: nommu: fix empty /proc/<pid>/maps
Ben Wolsieffer <[email protected]>
proc: nommu: /proc/<pid>/maps: release mmap read lock
Muhammad Husaini Zulkifli <[email protected]>
igc: Expose tx-usecs coalesce setting to user
Sebastian Andrzej Siewior <[email protected]>
octeontx2-pf: Do xdp_do_flush() after redirects.
Sebastian Andrzej Siewior <[email protected]>
bnxt_en: Flush XDP for bnxt_poll_nitroa0()'s NAPI
Sebastian Andrzej Siewior <[email protected]>
net: ena: Flush XDP packets on error.
Sebastian Andrzej Siewior <[email protected]>
locking/seqlock: Do the lockdep annotation before locking in do_write_seqcount_begin_nested()
Umesh Nerlige Ramappa <[email protected]>
i915/pmu: Move execlist stats initialization to execlist specific setup
Jozsef Kadlecsik <[email protected]>
netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP
Florian Westphal <[email protected]>
netfilter: nf_tables: disable toggling dormant table state more than once
Artem Chernyshev <[email protected]>
net: rds: Fix possible NULL-pointer dereference
Ziyang Xuan <[email protected]>
team: fix null-ptr-deref when team device type is changed
Eric Dumazet <[email protected]>
net: bridge: use DEV_STATS_INC()
Jie Wang <[email protected]>
net: hns3: add 5ms delay before clear firmware reset irq source
Jijie Shao <[email protected]>
net: hns3: fix fail to delete tc flower rules during reset issue
Jian Shen <[email protected]>
net: hns3: only enable unicast promisc when mac table full
Jie Wang <[email protected]>
net: hns3: fix GRE checksum offload issue
Jie Wang <[email protected]>
net: hns3: add cmdq check for vf periodic service task
Josh Poimboeuf <[email protected]>
x86/srso: Fix SBPB enablement for spec_rstack_overflow=off
Josh Poimboeuf <[email protected]>
x86/srso: Fix srso_show_state() side effect
Stephen Boyd <[email protected]>
platform/x86: intel_scu_ipc: Fail IPC send if still busy
Stephen Boyd <[email protected]>
platform/x86: intel_scu_ipc: Don't override scu in intel_scu_ipc_dev_simple_command()
Stephen Boyd <[email protected]>
platform/x86: intel_scu_ipc: Check status upon timeout in ipc_wait_for_interrupt()
Stephen Boyd <[email protected]>
platform/x86: intel_scu_ipc: Check status after timeout in busy_loop()
Lukasz Majewski <[email protected]>
net: hsr: Properly parse HSRv1 supervisor frames.
Rik van Riel <[email protected]>
x86/mm, kexec, ima: Use memblock_free_late() from ima_free_kexec_buffer()
Eric Dumazet <[email protected]>
dccp: fix dccp_v4_err()/dccp_v6_err() again
Kajol Jain <[email protected]>
powerpc/perf/hv-24x7: Update domain value check
Eric Dumazet <[email protected]>
scsi: iscsi_tcp: restrict to TCP sockets
Kyle Zeng <[email protected]>
ipv4: fix null-deref in ipv4_link_failure
Vinicius Costa Gomes <[email protected]>
igc: Fix infinite initialization loop with early XDP redirect
David Christensen <[email protected]>
ionic: fix 16bit math issue when PAGE_SIZE >= 64KB
Ilya Leoshkevich <[email protected]>
netfilter, bpf: Adjust timeouts of non-confirmed CTs in bpf_ct_insert_entry()
Ivan Vecera <[email protected]>
i40e: Fix VF VLAN offloading when port VLAN is configured
Petr Oros <[email protected]>
iavf: schedule a request immediately after add/delete vlan
Petr Oros <[email protected]>
iavf: add iavf_schedule_aq_request() helper
Peter Ujfalusi <[email protected]>
ASoC: SOF: core: Only call sof_ops_free() on remove if the probe was successful
Radoslaw Tyl <[email protected]>
iavf: do not process adminq tasks when __IAVF_IN_REMOVE_TASK is set
Shinas Rasheed <[email protected]>
octeon_ep: fix tx dma unmap len values in SG
Shengjiu Wang <[email protected]>
ASoC: imx-audmix: Fix return error with devm_clk_get()
Chen Ni <[email protected]>
ASoC: hdaudio.c: Add missing check for devm_kstrdup
Sasha Neftin <[email protected]>
net/core: Fix ETH_P_1588 flow dissector
Sabrina Dubroca <[email protected]>
selftests: tls: swap the TX and RX sockets in some tests
Florian Westphal <[email protected]>
netfilter: conntrack: fix extension size table
Knyazev Arseniy <[email protected]>
ALSA: hda/realtek: Splitting the UX3402 into two separate models
Hans de Goede <[email protected]>
ASoC: rt5640: Fix IRQ not being free-ed for HDA jack detect mode
Hans de Goede <[email protected]>
ASoC: rt5640: Revert "Fix sleep in atomic context"
Toke Høiland-Jørgensen <[email protected]>
bpf: Avoid deadlock when using queue and stack maps from NMI
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: disallow element removal on anonymous sets
Jerome Brunet <[email protected]>
ASoC: meson: spdifin: start hw on dai probe
Florian Westphal <[email protected]>
netfilter: nf_tables: fix memleak when more than 255 elements expired
Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration
Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_pipapo: stop GC iteration if GC transaction allocation fails
Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_pipapo: call nft_trans_gc_queue_sync() in catchall GC
Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention
Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction
Florian Westphal <[email protected]>
netfilter: nf_tables: defer gc run if previous batch is still pending
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: use correct lock to protect gc_list
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: GC transaction race with abort path
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: GC transaction race with netns dismantle
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path
Florian Westphal <[email protected]>
netfilter: nf_tables: don't fail inserts if duplicate has expired
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: remove busy mark and gc batch API
Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_hash: mark set element as dead when deleting from packet path
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: adapt set backend to use GC transaction API
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: GC transaction API to avoid race with control plane
Florian Westphal <[email protected]>
netfilter: nf_tables: don't skip expired elements during walk
Jan Kara <[email protected]>
ext4: do not let fstrim block system suspend
Jan Kara <[email protected]>
ext4: move setting of trimmed bit into ext4_try_to_trim_range()
Kemeng Shi <[email protected]>
ext4: replace the traditional ternary conditional operator with with max()/min()
Filipe Manana <[email protected]>
btrfs: remove BUG() after failure to insert delayed dir index item
Filipe Manana <[email protected]>
btrfs: improve error message after failure to add delayed dir index item
Mikulas Patocka <[email protected]>
dm: fix a race condition in retrieve_deps
Namhyung Kim <[email protected]>
perf build: Update build rule for generated files
Dave Wysochanski <[email protected]>
netfs: Only call folio_start_fscache() one time for each folio
Sakari Ailus <[email protected]>
media: via: Use correct dependency for camera sensor drivers
Sakari Ailus <[email protected]>
media: v4l: Use correct dependency for camera sensor drivers
Olga Kornievskaia <[email protected]>
NFSv4.1: fix pnfs MDS=DS session trunking
Olga Kornievskaia <[email protected]>
NFSv4.1: use EXCHGID4_FLAG_USE_PNFS_DS for DS server
Trond Myklebust <[email protected]>
SUNRPC: Mark the cred for revalidation if the server rejects it
Trond Myklebust <[email protected]>
NFS/pNFS: Report EINVAL errors from connect() to the server
Trond Myklebust <[email protected]>
NFS: More fixes for nfs_direct_write_reschedule_io()
Trond Myklebust <[email protected]>
NFS: Use the correct commit info in nfs_join_page_group()
Trond Myklebust <[email protected]>
NFS: More O_DIRECT accounting fixes for error paths
Trond Myklebust <[email protected]>
NFS: Fix O_DIRECT locking issues
Trond Myklebust <[email protected]>
NFS: Fix error handling for O_DIRECT write scheduling
-------------
Diffstat:
Documentation/admin-guide/cgroup-v1/memory.rst | 9 +- Makefile | 4 +- arch/arm/boot/dts/am335x-guardian.dts | 3 +- arch/arm/boot/dts/am3517-evm.dts | 2 +- arch/arm/boot/dts/bcm4708-linksys-ea6500-v2.dts | 3 +- arch/arm/boot/dts/exynos4210-i9100.dts | 4 +- arch/arm/boot/dts/logicpd-torpedo-baseboard.dtsi | 2 +- arch/arm/boot/dts/motorola-mapphone-common.dtsi | 48 +-- arch/arm/boot/dts/omap-gpmc-smsc911x.dtsi | 6 +- arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi | 6 +- arch/arm/boot/dts/omap3-cm-t3517.dts | 12 +- arch/arm/boot/dts/omap3-cpu-thermal.dtsi | 3 +- arch/arm/boot/dts/omap3-gta04.dtsi | 8 +- arch/arm/boot/dts/omap3-ldp.dts | 2 +- arch/arm/boot/dts/omap3-n900.dts | 40 +-- arch/arm/boot/dts/omap3-zoom3.dts | 44 +-- arch/arm/boot/dts/omap4-cpu-thermal.dtsi | 29 +- arch/arm/boot/dts/omap4-duovero-parlor.dts | 12 +- arch/arm/boot/dts/omap4-duovero.dtsi | 18 +- arch/arm/boot/dts/omap4-kc1.dts | 14 +- arch/arm/boot/dts/omap4-mcpdm.dtsi | 2 +- arch/arm/boot/dts/omap4-panda-common.dtsi | 30 +- arch/arm/boot/dts/omap4-panda-es.dts | 8 +- arch/arm/boot/dts/omap4-sdp.dts | 36 +- arch/arm/boot/dts/omap4-var-om44customboard.dtsi | 24 +- arch/arm/boot/dts/omap4-var-som-om44-wlan.dtsi | 6 +- arch/arm/boot/dts/omap4-var-som-om44.dtsi | 22 +- arch/arm/boot/dts/omap443x.dtsi | 1 + arch/arm/boot/dts/omap4460.dtsi | 1 + arch/arm/boot/dts/omap5-cm-t54.dts | 56 +-- .../qcom-msm8974pro-sony-xperia-shinano-castor.dts | 8 +- arch/arm/boot/dts/twl6030_omap4.dtsi | 4 +- arch/arm64/boot/dts/freescale/Makefile | 1 + arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 9 + arch/arm64/configs/defconfig | 1 - arch/loongarch/include/asm/elf.h | 9 + arch/loongarch/kernel/mem.c | 4 +- arch/loongarch/kernel/module.c | 2 +- arch/loongarch/kernel/numa.c | 2 +- arch/mips/alchemy/devboards/db1000.c | 4 + arch/mips/alchemy/devboards/db1200.c | 6 + arch/mips/alchemy/devboards/db1300.c | 4 + arch/parisc/include/asm/ropes.h | 3 + arch/parisc/kernel/drivers.c | 2 +- arch/parisc/kernel/irq.c | 2 +- arch/powerpc/kernel/hw_breakpoint.c | 16 +- arch/powerpc/kernel/hw_breakpoint_constraints.c | 7 +- arch/powerpc/perf/hv-24x7.c | 2 +- arch/riscv/include/asm/errata_list.h | 4 +- arch/x86/include/asm/kexec.h | 2 - arch/x86/include/asm/reboot.h | 2 + arch/x86/kernel/cpu/bugs.c | 4 +- arch/x86/kernel/cpu/common.c | 2 +- arch/x86/kernel/cpu/sgx/encl.c | 30 +- arch/x86/kernel/crash.c | 31 -- arch/x86/kernel/reboot.c | 22 ++ arch/x86/kernel/setup.c | 8 +- arch/x86/kvm/mmu/mmu.c | 8 +- arch/x86/kvm/mmu/tdp_mmu.c | 31 +- arch/x86/kvm/mmu/tdp_mmu.h | 3 +- arch/x86/kvm/svm/sev.c | 34 +- arch/x86/kvm/svm/svm.c | 9 +- arch/x86/kvm/svm/svm.h | 1 + arch/x86/kvm/vmx/vmx.c | 10 +- arch/xtensa/boot/Makefile | 3 +- arch/xtensa/boot/lib/zmem.c | 5 +- arch/xtensa/include/asm/core.h | 4 + arch/xtensa/lib/umulsidi3.S | 4 +- arch/xtensa/platforms/iss/network.c | 4 +- drivers/ata/libata-core.c | 47 ++- drivers/ata/libata-eh.c | 13 +- drivers/ata/libata-scsi.c | 47 ++- drivers/ata/libata-transport.c | 9 +- drivers/ata/libata.h | 2 + drivers/ata/sata_mv.c | 4 +- drivers/bus/ti-sysc.c | 31 +- drivers/char/agp/parisc-agp.c | 2 - drivers/clk/sprd/ums512-clk.c | 2 +- drivers/clk/tegra/clk-bpmp.c | 2 +- drivers/firmware/arm_ffa/driver.c | 16 +- drivers/firmware/arm_scmi/perf.c | 93 +++-- drivers/firmware/cirrus/cs_dsp.c | 34 +- drivers/firmware/imx/imx-dsp.c | 1 + drivers/gpio/gpio-pmic-eic-sprd.c | 1 + drivers/gpio/gpio-tb10x.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 17 +- drivers/gpu/drm/amd/amdgpu/nbio_v4_3.c | 3 + drivers/gpu/drm/amd/amdgpu/soc21.c | 2 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 5 +- .../amd/display/dc/dce110/dce110_hw_sequencer.c | 4 +- drivers/gpu/drm/bridge/ti-sn65dsi83.c | 4 +- drivers/gpu/drm/i915/gt/intel_engine_cs.c | 1 - .../gpu/drm/i915/gt/intel_execlists_submission.c | 2 + drivers/gpu/drm/i915/gt/intel_ggtt.c | 23 +- drivers/gpu/drm/meson/meson_encoder_hdmi.c | 2 + drivers/gpu/drm/tests/drm_mm_test.c | 2 +- drivers/i2c/busses/i2c-i801.c | 1 + drivers/i2c/busses/i2c-npcm7xx.c | 17 +- drivers/i2c/busses/i2c-xiic.c | 2 +- drivers/i2c/muxes/i2c-demux-pinctrl.c | 4 + drivers/i2c/muxes/i2c-mux-gpio.c | 4 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c | 27 +- drivers/md/dm-core.h | 1 + drivers/md/dm-ioctl.c | 7 +- drivers/md/dm-table.c | 32 +- drivers/media/common/videobuf2/frame_vector.c | 6 +- drivers/media/platform/marvell/Kconfig | 4 +- drivers/media/platform/via/Kconfig | 2 +- drivers/media/usb/em28xx/Kconfig | 4 +- drivers/media/usb/go7007/Kconfig | 2 +- drivers/media/usb/uvc/uvc_ctrl.c | 3 + drivers/misc/cardreader/rts5227.c | 55 +-- drivers/misc/cardreader/rts5228.c | 57 +-- drivers/misc/cardreader/rts5249.c | 56 +-- drivers/misc/cardreader/rts5260.c | 43 +-- drivers/misc/cardreader/rts5261.c | 52 +-- drivers/misc/cardreader/rtsx_pcr.c | 51 ++- drivers/net/ethernet/amazon/ena/ena_netdev.c | 3 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 5 + drivers/net/ethernet/engleder/tsnep_main.c | 18 +- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 9 + .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 13 +- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 3 +- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 8 +- drivers/net/ethernet/intel/iavf/iavf.h | 2 +- drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 2 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 17 +- drivers/net/ethernet/intel/igc/igc_ethtool.c | 31 +- drivers/net/ethernet/intel/igc/igc_main.c | 2 +- .../net/ethernet/marvell/octeon_ep/octep_main.c | 8 +- drivers/net/ethernet/marvell/octeon_ep/octep_tx.c | 8 +- drivers/net/ethernet/marvell/octeon_ep/octep_tx.h | 16 +- .../net/ethernet/marvell/octeontx2/nic/otx2_txrx.c | 19 +- drivers/net/ethernet/pensando/ionic/ionic_dev.h | 1 + drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 10 +- drivers/net/team/team.c | 10 +- drivers/net/thunderbolt.c | 3 +- drivers/net/wireless/ath/ath11k/dp.h | 4 + drivers/net/wireless/ath/ath11k/dp_tx.c | 39 +- drivers/net/wireless/ath/ath11k/dp_tx.h | 1 + drivers/nvme/host/fc.c | 2 +- drivers/nvme/host/pci.c | 121 ++++--- drivers/parisc/iosapic.c | 4 +- drivers/parisc/iosapic_private.h | 4 +- drivers/platform/mellanox/Kconfig | 1 + drivers/platform/x86/asus-nb-wmi.c | 9 + drivers/platform/x86/intel_scu_ipc.c | 66 ++-- drivers/power/supply/ab8500_btemp.c | 9 +- drivers/power/supply/ab8500_chargalg.c | 2 +- drivers/power/supply/mt6370-charger.c | 2 +- drivers/power/supply/rk817_charger.c | 16 +- drivers/power/supply/ucs1002_power.c | 3 +- drivers/s390/crypto/pkey_api.c | 16 +- drivers/s390/crypto/zcrypt_ep11misc.c | 61 +++- drivers/s390/crypto/zcrypt_ep11misc.h | 3 +- drivers/scsi/iscsi_tcp.c | 4 + drivers/scsi/pm8001/pm8001_hwi.c | 2 +- drivers/scsi/pm8001/pm80xx_hwi.c | 4 +- drivers/scsi/qedf/qedf_io.c | 10 +- drivers/scsi/qedf/qedf_main.c | 7 +- drivers/scsi/qla2xxx/qla_def.h | 3 + drivers/scsi/qla2xxx/qla_init.c | 5 +- drivers/scsi/qla2xxx/qla_inline.h | 58 +++ drivers/scsi/qla2xxx/qla_isr.c | 12 +- drivers/scsi/qla2xxx/qla_nvme.c | 4 + drivers/scsi/qla2xxx/qla_os.c | 6 + drivers/scsi/qla2xxx/qla_target.c | 3 +- drivers/scsi/qla2xxx/tcm_qla2xxx.c | 4 +- drivers/soc/imx/soc-imx8m.c | 10 + drivers/spi/spi-gxp.c | 2 +- drivers/spi/spi-intel-pci.c | 1 + drivers/spi/spi-nxp-fspi.c | 7 + drivers/spi/spi-stm32.c | 8 + drivers/spi/spi-sun6i.c | 31 +- drivers/thermal/thermal_of.c | 8 +- drivers/tty/n_gsm.c | 4 +- drivers/tty/serial/8250/8250_port.c | 5 +- drivers/ufs/core/ufshcd.c | 13 +- drivers/vfio/mdev/mdev_sysfs.c | 3 +- drivers/video/fbdev/Kconfig | 2 +- fs/binfmt_elf_fdpic.c | 5 +- fs/btrfs/delayed-inode.c | 85 +++-- fs/btrfs/extent_io.c | 8 +- fs/btrfs/super.c | 2 +- fs/ceph/caps.c | 6 +- fs/ceph/mds_client.c | 12 +- fs/ceph/mds_client.h | 11 +- fs/ceph/quota.c | 14 +- fs/ceph/snap.c | 10 +- fs/ceph/super.c | 75 +++- fs/ceph/super.h | 3 + fs/ext4/mballoc.c | 60 ++-- fs/f2fs/data.c | 25 +- fs/f2fs/dir.c | 34 +- fs/f2fs/f2fs.h | 5 +- fs/f2fs/gc.c | 4 +- fs/netfs/buffered_read.c | 6 +- fs/nfs/direct.c | 138 ++++--- fs/nfs/flexfilelayout/flexfilelayout.c | 1 + fs/nfs/nfs4client.c | 9 +- fs/nfs/nfs4proc.c | 10 +- fs/nfs/write.c | 23 +- fs/nilfs2/gcinode.c | 6 +- fs/proc/internal.h | 2 - fs/proc/task_nommu.c | 70 ++-- fs/smb/client/cifsglob.h | 1 + fs/smb/client/fs_context.c | 1 + fs/smb/client/inode.c | 2 +- fs/smb/client/smb2ops.c | 6 +- fs/smb/client/transport.c | 34 +- include/linux/bpf.h | 2 +- include/linux/btf_ids.h | 2 +- include/linux/if_team.h | 2 + include/linux/interrupt.h | 6 +- include/linux/libata.h | 4 +- include/linux/memcontrol.h | 4 +- include/linux/nfs_fs_sb.h | 1 + include/linux/nfs_page.h | 4 +- include/linux/resume_user_mode.h | 2 +- include/linux/seqlock.h | 2 +- include/net/netfilter/nf_tables.h | 127 +++---- include/uapi/linux/bpf.h | 4 +- io_uring/fs.c | 2 +- kernel/bpf/memalloc.c | 33 +- kernel/bpf/queue_stack_maps.c | 21 +- kernel/dma/debug.c | 20 +- kernel/sched/core.c | 2 +- kernel/sched/cpupri.c | 1 + kernel/sched/idle.c | 1 + kernel/trace/bpf_trace.c | 16 + kernel/trace/ring_buffer.c | 10 + mm/damon/vaddr-test.h | 2 + mm/memcontrol.c | 13 +- mm/slab_common.c | 12 +- net/bridge/br_forward.c | 4 +- net/bridge/br_input.c | 4 +- net/core/flow_dissector.c | 2 +- net/dccp/ipv4.c | 9 +- net/dccp/ipv6.c | 9 +- net/hsr/hsr_framereg.c | 4 +- net/hsr/hsr_main.h | 2 +- net/ipv4/route.c | 4 +- net/mptcp/options.c | 5 +- net/ncsi/ncsi-aen.c | 5 + net/netfilter/ipset/ip_set_core.c | 12 +- net/netfilter/nf_conntrack_bpf.c | 2 + net/netfilter/nf_conntrack_extend.c | 4 +- net/netfilter/nf_tables_api.c | 400 +++++++++++++++++---- net/netfilter/nft_set_hash.c | 87 +++-- net/netfilter/nft_set_pipapo.c | 71 ++-- net/netfilter/nft_set_rbtree.c | 161 +++++---- net/rds/rdma_transport.c | 12 +- net/smc/smc_stats.h | 3 +- net/sunrpc/clnt.c | 15 +- security/smack/smack.h | 1 + security/smack/smack_lsm.c | 63 +++- sound/hda/intel-sdw-acpi.c | 8 +- sound/pci/hda/hda_intel.c | 1 + sound/pci/hda/patch_realtek.c | 3 +- sound/soc/amd/yc/acp6x-mach.c | 21 ++ sound/soc/codecs/cs42l42.c | 10 + sound/soc/codecs/rt5640.c | 13 +- sound/soc/fsl/imx-audmix.c | 2 +- sound/soc/fsl/imx-pcm-rpmsg.c | 1 + sound/soc/fsl/imx-rpmsg.c | 8 + sound/soc/intel/avs/boards/hdaudio.c | 3 + sound/soc/meson/axg-spdifin.c | 49 +-- sound/soc/sof/core.c | 3 +- sound/soc/sof/intel/mtl.c | 2 +- sound/soc/sof/intel/mtl.h | 1 - tools/build/Makefile.build | 10 + tools/include/linux/btf_ids.h | 2 +- tools/include/linux/mm.h | 2 - tools/include/linux/seq_file.h | 2 + tools/include/uapi/linux/bpf.h | 4 +- tools/perf/pmu-events/Build | 6 + tools/perf/util/Build | 6 + tools/testing/memblock/tests/basic_api.c | 2 +- tools/testing/memblock/tests/common.h | 1 + .../ftrace/test.d/instances/instance-event.tc | 2 +- tools/testing/selftests/kselftest_deps.sh | 77 +++- tools/testing/selftests/net/tls.c | 8 +- tools/testing/selftests/powerpc/Makefile | 15 +- tools/testing/selftests/powerpc/pmu/Makefile | 40 ++- 285 files changed, 2895 insertions(+), 1583 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/259 NFS: Fix error handling for O_DIRECT write scheduling
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 954998b60caa8f2a3bf3abe490de6f08d283687a ]
If we fail to schedule a request for transmission, there are 2 possibilities:
1) Either we hit a fatal error, and we just want to drop the remaining requests on the floor.
2) We were asked to try again, in which case we should allow the outstanding RPC calls to complete, so that we can recoalesce requests and try again.
--- fs/nfs/direct.c | 62 ++++++++++++++++++++++++++++++++++++------------- 1 file changed, 46 insertions(+), 16 deletions(-)
fs/nfs/direct.c +46 -16
@@ -530,10 +530,9 @@ nfs_direct_write_scan_commit_list(struct inode *inode,static void nfs_direct_write_reschedule (struct nfs_direct_req *dreq) {struct nfs_pageio_descriptor desc; -struct nfs_page *req, *tmp; +struct nfs_page *req;LIST_HEAD (reqs);struct nfs_commit_info cinfo; -LIST_HEAD (failed);nfs_init_cinfo_from_dreq (&cinfo, dreq);nfs_direct_write_scan_commit_list (dreq->inode, &reqs, &cinfo);
@@ -551,27 +550,36 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq) &nfs_direct_write_completion_ops); desc.pg_dreq = dreq; -list_for_each_entry_safe (req, tmp, &reqs, wb_list) { +while (!list_empty (&reqs)) { + req =nfs_list_entry (reqs.next);/* Bump the transmission count */ req->wb_nio++;if (!nfs_pageio_add_request (&desc, req)) { -nfs_list_move_request (req, &failed);spin_lock (&cinfo.inode->i_lock); - dreq->flags =0 ; -if (desc.pg_error <0 ) +if (dreq->error <0 ) { + desc.pg_error = dreq->error; + }else if (desc.pg_error != -EAGAIN ) { + dreq->flags =0 ; +if (!desc.pg_error) + desc.pg_error = -EIO ; dreq->error = desc.pg_error; -else - dreq->error = -EIO ; + }else + dreq->flags =NFS_ODIRECT_RESCHED_WRITES ;spin_unlock (&cinfo.inode->i_lock); +break ; }nfs_release_request (req); }nfs_pageio_complete (&desc); -while (!list_empty (&failed)) { - req =nfs_list_entry (failed.next); +while (!list_empty (&reqs)) { + req =nfs_list_entry (reqs.next);nfs_list_remove_request (req);nfs_unlock_and_release_request (req); +if (desc.pg_error == -EAGAIN ) +nfs_mark_request_commit (req,NULL , &cinfo,0 ); +else +nfs_release_request (req); }if (put_dreq (dreq))
@@ -796,9 +804,11 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, {struct nfs_pageio_descriptor desc;struct inode *inode = dreq->inode; +struct nfs_commit_info cinfo;ssize_t result =0 ;size_t requested_bytes =0 ;size_t wsize =max_t (size_t,NFS_SERVER (inode)->wsize,PAGE_SIZE ); +bool defer = false;trace_nfs_direct_write_schedule_iovec (dreq);
@@ -839,19 +849,39 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq,break ; } + pgbase =0 ; + bytes -= req_len; + requested_bytes += req_len; + pos += req_len; + dreq->bytes_left -= req_len; + +if (defer) { +nfs_mark_request_commit (req,NULL , &cinfo,0 ); +continue ; + } +nfs_lock_request (req); req->wb_index = pos >>PAGE_SHIFT ; req->wb_offset = pos & ~PAGE_MASK ; -if (!nfs_pageio_add_request (&desc, req)) { +if (nfs_pageio_add_request (&desc, req)) +continue ; + +/* Exit on hard errors */ +if (desc.pg_error <0 && desc.pg_error != -EAGAIN ) { result = desc.pg_error;nfs_unlock_and_release_request (req);break ; } - pgbase =0 ; - bytes -= req_len; - requested_bytes += req_len; - pos += req_len; - dreq->bytes_left -= req_len; + +/* If the error is soft, defer remaining requests */ +nfs_init_cinfo_from_dreq (&cinfo, dreq); +spin_lock (&cinfo.inode->i_lock); + dreq->flags =NFS_ODIRECT_RESCHED_WRITES ; +spin_unlock (&cinfo.inode->i_lock); +nfs_unlock_request (req); +nfs_mark_request_commit (req,NULL , &cinfo,0 ); + desc.pg_error =0 ; + defer = true; }nfs_direct_release_pages (pagevec, npages);kvfree (pagevec);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 2/259 NFS: Fix O_DIRECT locking issues
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 7c6339322ce0c6128acbe36aacc1eeb986dd7bf1 ]
The dreq fields are protected by the dreq->lock.
--- fs/nfs/direct.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
fs/nfs/direct.c +4 -4
@@ -555,7 +555,7 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq)/* Bump the transmission count */ req->wb_nio++;if (!nfs_pageio_add_request (&desc, req)) { -spin_lock (&cinfo.inode->i_lock); +spin_lock (&dreq->lock);if (dreq->error <0 ) { desc.pg_error = dreq->error; }else if (desc.pg_error != -EAGAIN ) {
@@ -565,7 +565,7 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq) dreq->error = desc.pg_error; }else dreq->flags =NFS_ODIRECT_RESCHED_WRITES ; -spin_unlock (&cinfo.inode->i_lock); +spin_unlock (&dreq->lock);break ; }nfs_release_request (req);
@@ -875,9 +875,9 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq,/* If the error is soft, defer remaining requests */ nfs_init_cinfo_from_dreq (&cinfo, dreq); -spin_lock (&cinfo.inode->i_lock); +spin_lock (&dreq->lock); dreq->flags =NFS_ODIRECT_RESCHED_WRITES ; -spin_unlock (&cinfo.inode->i_lock); +spin_unlock (&dreq->lock);nfs_unlock_request (req);nfs_mark_request_commit (req,NULL , &cinfo,0 ); desc.pg_error =0 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 3/259 NFS: More O_DIRECT accounting fixes for error paths
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 8982f7aff39fb526aba4441fff2525fcedd5e1a3 ]
If we hit a fatal error when retransmitting, we do need to record the removal of the request from the count of written bytes.
--- fs/nfs/direct.c | 47 +++++++++++++++++++++++++++++++---------------- 1 file changed, 31 insertions(+), 16 deletions(-)
fs/nfs/direct.c +31 -16
@@ -93,12 +93,10 @@ nfs_direct_handle_truncated(struct nfs_direct_req *dreq, dreq->max_count = dreq_len;if (dreq->count > dreq_len) dreq->count = dreq_len; - -if (test_bit (NFS_IOHDR_ERROR , &hdr->flags)) - dreq->error = hdr->error; -else /* Clear outstanding error if this is EOF */ - dreq->error =0 ; } + +if (test_bit (NFS_IOHDR_ERROR , &hdr->flags) && !dreq->error) + dreq->error = hdr->error; } static void
@@ -120,6 +118,18 @@ nfs_direct_count_bytes(struct nfs_direct_req *dreq, dreq->count = dreq_len; } +static void nfs_direct_truncate_request (struct nfs_direct_req *dreq, +struct nfs_page *req) +{ +loff_t offs =req_offset (req); +size_t req_start = (size_t )(offs - dreq->io_start); + +if (req_start < dreq->max_count) + dreq->max_count = req_start; +if (req_start < dreq->count) + dreq->count = req_start; +} +/** * nfs_swap_rw - NFS address space operation for swap I/O * @iocb: target I/O control block
@@ -539,10 +549,6 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq)nfs_direct_join_group (&reqs, dreq->inode); - dreq->count =0 ; - dreq->max_count =0 ; -list_for_each_entry (req, &reqs, wb_list) - dreq->max_count += req->wb_bytes;nfs_clear_pnfs_ds_commit_verifiers (&dreq->ds_cinfo);get_dreq (dreq);
@@ -576,10 +582,14 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq) req =nfs_list_entry (reqs.next);nfs_list_remove_request (req);nfs_unlock_and_release_request (req); -if (desc.pg_error == -EAGAIN ) +if (desc.pg_error == -EAGAIN ) {nfs_mark_request_commit (req,NULL , &cinfo,0 ); -else + }else { +spin_lock (&dreq->lock); +nfs_direct_truncate_request (dreq, req); +spin_unlock (&dreq->lock);nfs_release_request (req); + } }if (put_dreq (dreq))
@@ -599,8 +609,6 @@ static void nfs_direct_commit_complete(struct nfs_commit_data *data)if (status <0 ) {/* Errors in commit are fatal */ dreq->error = status; - dreq->max_count =0 ; - dreq->count =0 ; dreq->flags =NFS_ODIRECT_DONE ; }else { status = dreq->error;
@@ -611,7 +619,12 @@ static void nfs_direct_commit_complete(struct nfs_commit_data *data)while (!list_empty (&data->pages)) { req =nfs_list_entry (data->pages.next);nfs_list_remove_request (req); -if (status >=0 && !nfs_write_match_verf (verf, req)) { +if (status <0 ) { +spin_lock (&dreq->lock); +nfs_direct_truncate_request (dreq, req); +spin_unlock (&dreq->lock); +nfs_release_request (req); + }else if (!nfs_write_match_verf (verf, req)) { dreq->flags =NFS_ODIRECT_RESCHED_WRITES ;/* * Despite the reboot, the write was successful,
@@ -619,7 +632,7 @@ static void nfs_direct_commit_complete(struct nfs_commit_data *data)*/ req->wb_nio =0 ;nfs_mark_request_commit (req,NULL , &cinfo,0 ); - }else /* Error or match */ + }else nfs_release_request (req);nfs_unlock_and_release_request (req); }
@@ -672,6 +685,7 @@ static void nfs_direct_write_clear_reqs(struct nfs_direct_req *dreq)while (!list_empty (&reqs)) { req =nfs_list_entry (reqs.next);nfs_list_remove_request (req); +nfs_direct_truncate_request (dreq, req);nfs_release_request (req);nfs_unlock_and_release_request (req); }
@@ -721,7 +735,8 @@ static void nfs_direct_write_completion(struct nfs_pgio_header *hdr) }nfs_direct_count_bytes (dreq, hdr); -if (test_bit (NFS_IOHDR_UNSTABLE_WRITES , &hdr->flags)) { +if (test_bit (NFS_IOHDR_UNSTABLE_WRITES , &hdr->flags) && + !test_bit (NFS_IOHDR_ERROR , &hdr->flags)) {if (!dreq->flags) dreq->flags =NFS_ODIRECT_DO_COMMIT ; flags = dreq->flags;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 4/259 NFS: Use the correct commit info in nfs_join_page_group()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit b193a78ddb5ee7dba074d3f28dc050069ba083c0 ]
Ensure that nfs_clear_request_commit() updates the correct counters when it removes them from the commit list.
--- fs/nfs/direct.c | 8 +++++--- fs/nfs/write.c | 23 ++++++++++++----------- include/linux/nfs_page.h | 4 +++- 3 files changed, 20 insertions(+), 15 deletions(-)
fs/nfs/direct.c +5 -3
@@ -500,7 +500,9 @@ static void nfs_direct_add_page_head(struct list_head *list,kref_get (&head->wb_kref); } -static void nfs_direct_join_group (struct list_head *list,struct inode *inode) +static void nfs_direct_join_group (struct list_head *list, +struct nfs_commit_info *cinfo, +struct inode *inode) {struct nfs_page *req, *subreq;
@@ -522,7 +524,7 @@ static void nfs_direct_join_group(struct list_head *list, struct inode *inode)nfs_release_request (subreq); } }while ((subreq = subreq->wb_this_page) != req); -nfs_join_page_group (req, inode); +nfs_join_page_group (req, cinfo, inode); } }
@@ -547,7 +549,7 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq)nfs_init_cinfo_from_dreq (&cinfo, dreq);nfs_direct_write_scan_commit_list (dreq->inode, &reqs, &cinfo); -nfs_direct_join_group (&reqs, dreq->inode); +nfs_direct_join_group (&reqs, &cinfo, dreq->inode);nfs_clear_pnfs_ds_commit_verifiers (&dreq->ds_cinfo);get_dreq (dreq);
fs/nfs/write.c +12 -11
@@ -58,7 +58,8 @@ static const struct nfs_pgio_completion_ops nfs_async_write_completion_ops;static const struct nfs_commit_completion_ops nfs_commit_completion_ops;static const struct nfs_rw_ops nfs_rw_write_ops;static void nfs_inode_remove_request (struct nfs_page *req); -static void nfs_clear_request_commit (struct nfs_page *req); +static void nfs_clear_request_commit (struct nfs_commit_info *cinfo, +struct nfs_page *req);static void nfs_init_cinfo_from_inode (struct nfs_commit_info *cinfo,struct inode *inode); static struct nfs_page *
@@ -502,8 +503,8 @@ nfs_destroy_unlinked_subrequests(struct nfs_page *destroy_list,* the (former) group. All subrequests are removed from any write or commit * lists, unlinked from the group and destroyed. */ -void -nfs_join_page_group (struct nfs_page *head,struct inode *inode) +void nfs_join_page_group (struct nfs_page *head,struct nfs_commit_info *cinfo, +struct inode *inode) {struct nfs_page *subreq;struct nfs_page *destroy_list =NULL ;
@@ -533,7 +534,7 @@ nfs_join_page_group(struct nfs_page *head, struct inode *inode)* Commit list removal accounting is done after locks are dropped */ subreq = head;do { -nfs_clear_request_commit (subreq); +nfs_clear_request_commit (cinfo, subreq); subreq = subreq->wb_this_page; }while (subreq != head);
@@ -567,8 +568,10 @@ nfs_lock_and_join_requests(struct page *page) {struct inode *inode =page_file_mapping (page)->host;struct nfs_page *head; +struct nfs_commit_info cinfo;int ret; +nfs_init_cinfo_from_inode (&cinfo, inode);/* * A reference is taken only on the head request which acts as a * reference to the whole page group - the group will not be destroyed
@@ -585,7 +588,7 @@ nfs_lock_and_join_requests(struct page *page)return ERR_PTR (ret); } -nfs_join_page_group (head, inode); +nfs_join_page_group (head, &cinfo, inode);return head; }
@@ -956,18 +959,16 @@ nfs_clear_page_commit(struct page *page) }/* Called holding the request lock on @req */ -static void -nfs_clear_request_commit (struct nfs_page *req) +static void nfs_clear_request_commit (struct nfs_commit_info *cinfo, +struct nfs_page *req) {if (test_bit (PG_CLEAN , &req->wb_flags)) {struct nfs_open_context *ctx =nfs_req_openctx (req);struct inode *inode =d_inode (ctx->dentry); -struct nfs_commit_info cinfo; -nfs_init_cinfo_from_inode (&cinfo, inode);mutex_lock (&NFS_I (inode)->commit_mutex); -if (!pnfs_clear_request_commit (req, &cinfo)) { -nfs_request_remove_commit_list (req, &cinfo); +if (!pnfs_clear_request_commit (req, cinfo)) { +nfs_request_remove_commit_list (req, cinfo); }mutex_unlock (&NFS_I (inode)->commit_mutex);nfs_clear_page_commit (req->wb_page);
include/linux/nfs_page.h +3 -1
@@ -145,7 +145,9 @@ extern void nfs_unlock_request(struct nfs_page *req);extern void nfs_unlock_and_release_request (struct nfs_page *);extern struct nfs_page *nfs_page_group_lock_head (struct nfs_page *req);extern int nfs_page_group_lock_subrequests (struct nfs_page *head); -extern void nfs_join_page_group (struct nfs_page *head,struct inode *inode); +extern void nfs_join_page_group (struct nfs_page *head, +struct nfs_commit_info *cinfo, +struct inode *inode);extern int nfs_page_group_lock (struct nfs_page *);extern void nfs_page_group_unlock (struct nfs_page *);extern bool nfs_page_group_sync_on_bit (struct nfs_page *,unsigned int );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 5/259 NFS: More fixes for nfs_direct_write_reschedule_io()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit b11243f720ee5f9376861099019c8542969b6318 ]
Ensure that all requests are put back onto the commit list so that they can be rescheduled.
--- fs/nfs/direct.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
fs/nfs/direct.c +11 -6
@@ -782,18 +782,23 @@ static void nfs_write_sync_pgio_error(struct list_head *head, int error)static void nfs_direct_write_reschedule_io (struct nfs_pgio_header *hdr) {struct nfs_direct_req *dreq = hdr->dreq; +struct nfs_page *req; +struct nfs_commit_info cinfo;trace_nfs_direct_write_reschedule_io (dreq); +nfs_init_cinfo_from_dreq (&cinfo, dreq);spin_lock (&dreq->lock); -if (dreq->error ==0 ) { +if (dreq->error ==0 ) dreq->flags =NFS_ODIRECT_RESCHED_WRITES ; -/* fake unstable write to let common nfs resend pages */ - hdr->verf.committed =NFS_UNSTABLE ; - hdr->good_bytes = hdr->args.offset + hdr->args.count - - hdr->io_start; - } +set_bit (NFS_IOHDR_REDO , &hdr->flags);spin_unlock (&dreq->lock); +while (!list_empty (&hdr->pages)) { + req =nfs_list_entry (hdr->pages.next); +nfs_list_remove_request (req); +nfs_unlock_request (req); +nfs_mark_request_commit (req,NULL , &cinfo,0 ); + } }static const struct nfs_pgio_completion_ops nfs_direct_write_completion_ops = {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 6/259 NFS/pNFS: Report EINVAL errors from connect() to the server
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit dd7d7ee3ba2a70d12d02defb478790cf57d5b87b ]
With IPv6, connect() can occasionally return EINVAL if a route is unavailable. If this happens during I/O to a data server, we want to report it using LAYOUTERROR as an inability to connect.
--- fs/nfs/flexfilelayout/flexfilelayout.c | 1 + 1 file changed, 1 insertion(+)
fs/nfs/flexfilelayout/flexfilelayout.c +1 -0
@@ -1235,6 +1235,7 @@ static void ff_layout_io_track_ds_error(struct pnfs_layout_segment *lseg,case -EPFNOSUPPORT :case -EPROTONOSUPPORT :case -EOPNOTSUPP : +case -EINVAL :case -ECONNREFUSED :case -ECONNRESET :case -EHOSTDOWN :
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 7/259 SUNRPC: Mark the cred for revalidation if the server rejects it
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 611fa42dfa9d2f3918ac5f4dd5705dfad81b323d ]
If the server rejects the credential as being stale, or bad, then we should mark it for revalidation before retransmitting.
--- net/sunrpc/clnt.c | 1 + 1 file changed, 1 insertion(+)
net/sunrpc/clnt.c +1 -0
@@ -2736,6 +2736,7 @@ rpc_decode_header(struct rpc_task *task, struct xdr_stream *xdr)case rpc_autherr_rejectedverf:case rpcsec_gsserr_credproblem:case rpcsec_gsserr_ctxproblem: +rpcauth_invalcred (task);if (!task->tk_cred_retry)break ; task->tk_cred_retry--;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 8/259 NFSv4.1: use EXCHGID4_FLAG_USE_PNFS_DS for DS server
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <[email protected]>
[ Upstream commit 51d674a5e4889f1c8e223ac131cf218e1631e423 ]
After receiving the location(s) of the DS server(s) in the GETDEVINCEINFO, create the request for the clientid to such server and indicate that the client is connecting to a DS.
Stable-dep-of: 806a3bc421a1 ("NFSv4.1: fix pnfs MDS=DS session trunking")
--- fs/nfs/nfs4client.c | 3 +++ fs/nfs/nfs4proc.c | 4 ++++ 2 files changed, 7 insertions(+)
fs/nfs/nfs4client.c +3 -0
@@ -231,6 +231,8 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init)__set_bit (NFS_CS_DISCRTRY , &clp->cl_flags);__set_bit (NFS_CS_NO_RETRANS_TIMEOUT , &clp->cl_flags); +if (test_bit (NFS_CS_DS , &cl_init->init_flags)) +__set_bit (NFS_CS_DS , &clp->cl_flags);/* * Set up the connection to the server before we add add to the * global list.
@@ -993,6 +995,7 @@ struct nfs_client *nfs4_set_ds_client(struct nfs_server *mds_srv,if (mds_srv->flags &NFS_MOUNT_NORESVPORT )__set_bit (NFS_CS_NORESVPORT , &cl_init.init_flags); +__set_bit (NFS_CS_DS , &cl_init.init_flags);/* * Set an authflavor equual to the MDS value. Use the MDS nfs_client * cl_ipaddr so as to use the same EXCHANGE_ID co_ownerid as the MDS
fs/nfs/nfs4proc.c +4 -0
@@ -8794,6 +8794,8 @@ nfs4_run_exchange_id(struct nfs_client *clp, const struct cred *cred,#ifdef CONFIG_NFS_V4_1_MIGRATION calldata->args.flags |=EXCHGID4_FLAG_SUPP_MOVED_MIGR ;#endif +if (test_bit (NFS_CS_DS , &clp->cl_flags)) + calldata->args.flags |=EXCHGID4_FLAG_USE_PNFS_DS ; msg.rpc_argp = &calldata->args; msg.rpc_resp = &calldata->res; task_setup_data.callback_data = calldata;
@@ -8871,6 +8873,8 @@ static int _nfs4_proc_exchange_id(struct nfs_client *clp, const struct cred *cre/* Save the EXCHANGE_ID verifier session trunk tests */ memcpy (clp->cl_confirm.data, argp->verifier.data,sizeof (clp->cl_confirm.data)); +if (resp->flags &EXCHGID4_FLAG_USE_PNFS_DS ) +set_bit (NFS_CS_DS , &clp->cl_flags); out:trace_nfs4_exchange_id (clp, status);rpc_put_task (task);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 9/259 NFSv4.1: fix pnfs MDS=DS session trunking
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <[email protected]>
[ Upstream commit 806a3bc421a115fbb287c1efce63a48c54ee804b ]
Currently, when GETDEVICEINFO returns multiple locations where each is a different IP but the server's identity is same as MDS, then nfs4_set_ds_client() finds the existing nfs_client structure which has the MDS's max_connect value (and if it's 1), then the 1st IP on the DS's list will get dropped due to MDS trunking rules. Other IPs would be added as they fall under the pnfs trunking rules.
For the list of IPs the 1st goes thru calling nfs4_set_ds_client() which will eventually call nfs4_add_trunk() and call into rpc_clnt_test_and_add_xprt() which has the check for MDS trunking. The other IPs (after the 1st one), would call rpc_clnt_add_xprt() which doesn't go thru that check.
nfs4_add_trunk() is called when MDS trunking is happening and it needs to enforce the usage of max_connect mount option of the 1st mount. However, this shouldn't be applied to pnfs flow.
Instead, this patch proposed to treat MDS=DS as DS trunking and make sure that MDS's max_connect limit does not apply to the 1st IP returned in the GETDEVICEINFO list. It does so by marking the newly created client with a new flag NFS_CS_PNFS which then used to pass max_connect value to use into the rpc_clnt_test_and_add_xprt() instead of the existing rpc client's max_connect value set by the MDS connection.
For example, mount was done without max_connect value set so MDS's rpc client has cl_max_connect=1. Upon calling into rpc_clnt_test_and_add_xprt() and using rpc client's value, the caller passes in max_connect value which is previously been set in the pnfs path (as a part of handling GETDEVICEINFO list of IPs) in nfs4_set_ds_client().
However, when NFS_CS_PNFS flag is not set and we know we are doing MDS trunking, comparing a new IP of the same server, we then set the max_connect value to the existing MDS's value and pass that into rpc_clnt_test_and_add_xprt().
--- fs/nfs/nfs4client.c | 6 +++++- include/linux/nfs_fs_sb.h | 1 + net/sunrpc/clnt.c | 11 +++++++---- 3 files changed, 13 insertions(+), 5 deletions(-)
fs/nfs/nfs4client.c +5 -1
@@ -416,6 +416,8 @@ static void nfs4_add_trunk(struct nfs_client *clp, struct nfs_client *old) .net = old->cl_net, .servername = old->cl_hostname, }; +int max_connect =test_bit (NFS_CS_PNFS , &clp->cl_flags) ? + clp->cl_max_connect : old->cl_max_connect;if (clp->cl_proto != old->cl_proto)return ;
@@ -429,7 +431,7 @@ static void nfs4_add_trunk(struct nfs_client *clp, struct nfs_client *old) xprt_args.addrlen = clp_salen;rpc_clnt_add_xprt (old->cl_rpcclient, &xprt_args, - rpc_clnt_test_and_add_xprt,NULL ); + rpc_clnt_test_and_add_xprt, &max_connect); }/**
@@ -996,6 +998,8 @@ struct nfs_client *nfs4_set_ds_client(struct nfs_server *mds_srv,__set_bit (NFS_CS_NORESVPORT , &cl_init.init_flags);__set_bit (NFS_CS_DS , &cl_init.init_flags); +__set_bit (NFS_CS_PNFS , &cl_init.init_flags); + cl_init.max_connect =NFS_MAX_TRANSPORTS ;/* * Set an authflavor equual to the MDS value. Use the MDS nfs_client * cl_ipaddr so as to use the same EXCHANGE_ID co_ownerid as the MDS
include/linux/nfs_fs_sb.h +1 -0
@@ -48,6 +48,7 @@ struct nfs_client {#define NFS_CS_NOPING 6/* - don't ping on connect */ #define NFS_CS_DS 7/* - Server is a DS */ #define NFS_CS_REUSEPORT 8/* - reuse src port on reconnect */ +#define NFS_CS_PNFS 9/* - Server used for pnfs */ struct sockaddr_storage cl_addr;/* server identifier */ size_t cl_addrlen;char * cl_hostname;/* hostname of server */
net/sunrpc/clnt.c +7 -4
@@ -2890,19 +2890,22 @@ static const struct rpc_call_ops rpc_cb_add_xprt_call_ops = {* @clnt: pointer to struct rpc_clnt * @xps: pointer to struct rpc_xprt_switch, * @xprt: pointer struct rpc_xprt -* @dummy: unused +* @in_max_connect: pointer to the max_connect value for the passed in xprt transport */ int rpc_clnt_test_and_add_xprt (struct rpc_clnt *clnt,struct rpc_xprt_switch *xps,struct rpc_xprt *xprt, -void *dummy) +void *in_max_connect) {struct rpc_cb_add_xprt_calldata *data;struct rpc_task *task; +int max_connect = clnt->cl_max_connect; -if (xps->xps_nunique_destaddr_xprts +1 > clnt->cl_max_connect) { +if (in_max_connect) + max_connect = *(int *)in_max_connect; +if (xps->xps_nunique_destaddr_xprts +1 > max_connect) {rcu_read_lock ();pr_warn ("SUNRPC: reached max allowed number (%d) did not add " -"transport to server: %s\n" , clnt->cl_max_connect, +"transport to server: %s\n" , max_connect,rpc_peeraddr2str (clnt,RPC_DISPLAY_ADDR ));rcu_read_unlock ();return -EINVAL ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 10/259 media: v4l: Use correct dependency for camera sensor drivers
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
[ Upstream commit 86e16b87afac20779da1228d690a95c54d7e2ad0 ]
The Kconfig option that enables compiling camera sensor drivers is VIDEO_CAMERA_SENSOR rather than MEDIA_CAMERA_SUPPORT as it was previously. Fix this.
Also select VIDEO_OV7670 for marvell platform drivers only if MEDIA_SUBDRV_AUTOSELECT and VIDEO_CAMERA_SENSOR are enabled.
--- drivers/media/platform/marvell/Kconfig | 4 ++-- drivers/media/usb/em28xx/Kconfig | 4 ++-- drivers/media/usb/go7007/Kconfig | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-)
drivers/media/platform/marvell/Kconfig +2 -2
@@ -7,7 +7,7 @@ config VIDEO_CAFE_CCIC depends on V4L_PLATFORM_DRIVERS depends on PCI && I2C && VIDEO_DEV depends on COMMON_CLK - select VIDEO_OV7670 + select VIDEO_OV7670 if MEDIA_SUBDRV_AUTOSELECT && VIDEO_CAMERA_SENSOR select VIDEOBUF2_VMALLOC select VIDEOBUF2_DMA_CONTIG select VIDEOBUF2_DMA_SG
@@ -22,7 +22,7 @@ config VIDEO_MMP_CAMERA depends on I2C && VIDEO_DEV depends on ARCH_MMP || COMPILE_TEST depends on COMMON_CLK - select VIDEO_OV7670 + select VIDEO_OV7670 if MEDIA_SUBDRV_AUTOSELECT && VIDEO_CAMERA_SENSOR select I2C_GPIO select VIDEOBUF2_VMALLOC select VIDEOBUF2_DMA_CONTIG
drivers/media/usb/em28xx/Kconfig +2 -2
@@ -12,8 +12,8 @@ config VIDEO_EM28XX_V4L2 select VIDEO_SAA711X if MEDIA_SUBDRV_AUTOSELECT select VIDEO_TVP5150 if MEDIA_SUBDRV_AUTOSELECT select VIDEO_MSP3400 if MEDIA_SUBDRV_AUTOSELECT - select VIDEO_MT9V011 if MEDIA_SUBDRV_AUTOSELECT && MEDIA_CAMERA_SUPPORT - select VIDEO_OV2640 if MEDIA_SUBDRV_AUTOSELECT && MEDIA_CAMERA_SUPPORT + select VIDEO_MT9V011 if MEDIA_SUBDRV_AUTOSELECT && VIDEO_CAMERA_SENSOR + select VIDEO_OV2640 if MEDIA_SUBDRV_AUTOSELECT && VIDEO_CAMERA_SENSOR help This is a video4linux driver for Empia 28xx based TV cards.
drivers/media/usb/go7007/Kconfig +1 -1
@@ -12,8 +12,8 @@ config VIDEO_GO7007 select VIDEO_TW2804 if MEDIA_SUBDRV_AUTOSELECT select VIDEO_TW9903 if MEDIA_SUBDRV_AUTOSELECT select VIDEO_TW9906 if MEDIA_SUBDRV_AUTOSELECT - select VIDEO_OV7640 if MEDIA_SUBDRV_AUTOSELECT && MEDIA_CAMERA_SUPPORT select VIDEO_UDA1342 if MEDIA_SUBDRV_AUTOSELECT + select VIDEO_OV7640 if MEDIA_SUBDRV_AUTOSELECT && VIDEO_CAMERA_SENSOR help This is a video4linux driver for the WIS GO7007 MPEG encoder chip.
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 11/259 media: via: Use correct dependency for camera sensor drivers
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
[ Upstream commit 41425941dfcf47cc6df8e500af6ff16a7be6539f ]
The via camera controller driver selected ov7670 driver, however now that driver has dependencies and may no longer be selected unconditionally.
--- drivers/media/platform/via/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/via/Kconfig +1 -1
@@ -7,7 +7,7 @@ config VIDEO_VIA_CAMERA depends on V4L_PLATFORM_DRIVERS depends on FB_VIA && VIDEO_DEV select VIDEOBUF2_DMA_SG - select VIDEO_OV7670 + select VIDEO_OV7670 if VIDEO_CAMERA_SENSOR help Driver support for the integrated camera controller in VIA Chrome9 chipsets. Currently only tested on OLPC xo-1.5 systems
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 12/259 netfs: Only call folio_start_fscache() one time for each folio
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Wysochanski <[email protected]>
[ Upstream commit df1c357f25d808e30b216188330e708e09e1a412 ]
If a network filesystem using netfs implements a clamp_length() function, it can set subrequest lengths smaller than a page size.
When we loop through the folios in netfs_rreq_unlock_folios() to set any folios to be written back, we need to make sure we only call folio_start_fscache() once for each folio.
Otherwise, this simple testcase:
mount -o fsc,rsize=1024,wsize=1024 127.0.0.1:/export /mnt/nfs dd if=/dev/zero of=/mnt/nfs/file.bin bs=4096 count=1 1+0 records in
1+0 records out
4096 bytes (4.1 kB, 4.0 KiB) copied, 0.0126359 s, 324 kB/s echo 3 > /proc/sys/vm/drop_caches
cat /mnt/nfs/file.bin > /dev/null
will trigger an oops similar to the following:
page dumped because: VM_BUG_ON_FOLIO(folio_test_private_2(folio))
------------[ cut here ]------------
kernel BUG at include/linux/netfs.h:44!
...
CPU: 5 PID: 134 Comm: kworker/u16:5 Kdump: loaded Not tainted 6.4.0-rc5
...
RIP: 0010:netfs_rreq_unlock_folios+0x68e/0x730 [netfs]
...
Call Trace:
netfs_rreq_assess+0x497/0x660 [netfs]
netfs_subreq_terminated+0x32b/0x610 [netfs]
nfs_netfs_read_completion+0x14e/0x1a0 [nfs]
nfs_read_completion+0x2f9/0x330 [nfs]
rpc_free_task+0x72/0xa0 [sunrpc]
rpc_async_release+0x46/0x70 [sunrpc]
process_one_work+0x3bd/0x710
worker_thread+0x89/0x610
kthread+0x181/0x1c0
ret_from_fork+0x29/0x50--- fs/netfs/buffered_read.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/netfs/buffered_read.c +5 -1
@@ -47,12 +47,14 @@ void netfs_rreq_unlock_folios(struct netfs_io_request *rreq)xas_for_each (&xas, folio, last_page) {loff_t pg_end;bool pg_failed = false; +bool folio_started;if (xas_retry (&xas, folio))continue ; pg_end =folio_pos (folio) +folio_size (folio) -1 ; + folio_started = false;for (;;) {loff_t sreq_end;
@@ -60,8 +62,10 @@ void netfs_rreq_unlock_folios(struct netfs_io_request *rreq) pg_failed = true;break ; } -if (test_bit (NETFS_SREQ_COPY_TO_CACHE , &subreq->flags)) +if (!folio_started &&test_bit (NETFS_SREQ_COPY_TO_CACHE , &subreq->flags)) {folio_start_fscache (folio); + folio_started = true; + } pg_failed |= subreq_failed; sreq_end = subreq->start + subreq->len -1 ;if (pg_end < sreq_end)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 13/259 perf build: Update build rule for generated files
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <[email protected]>
[ Upstream commit 7822a8913f4c51c7d1aff793b525d60c3384fb5b ]
The bison and flex generate C files from the source (.y and .l) files. When O= option is used, they are saved in a separate directory but the default build rule assumes the .C files are in the source directory. So it might read invalid file if there are generated files from an old version. The same is true for the pmu-events files.
For example, the following command would cause a build failure:
$ git checkout v6.3 $ make -C tools/perf # build in the same directory
$ git checkout v6.5-rc2
$ mkdir build # create a build directory
$ make -C tools/perf O=build # build in a different directory but it
# refers files in the source directoryLet's update the build rule to specify those cases explicitly to depend on the files in the output directory.
Note that it's not a complete fix and it needs the next patch for the include path too.
--- tools/build/Makefile.build | 10 ++++++++++ tools/perf/pmu-events/Build | 6 ++++++ 2 files changed, 16 insertions(+)
tools/build/Makefile.build +10 -0
@@ -116,6 +116,16 @@ $(OUTPUT)%.s: %.c FORCE $(call rule_mkdir) $(call if_changed_dep,cc_s_c) +# bison and flex files are generated in the OUTPUT directory +# so it needs a separate rule to depend on them properly +$(OUTPUT)%-bison.o: $(OUTPUT)%-bison.c FORCE + $(call rule_mkdir) + $(call if_changed_dep,$(host)cc_o_c) + +$(OUTPUT)%-flex.o: $(OUTPUT)%-flex.c FORCE + $(call rule_mkdir) + $(call if_changed_dep,$(host)cc_o_c) + # Gather build data: # obj-y - list of build objects # subdir-y - list of directories to nest
tools/perf/pmu-events/Build +6 -0
@@ -25,3 +25,9 @@ $(OUTPUT)pmu-events/pmu-events.c: $(JSON) $(JSON_TEST) $(JEVENTS_PY) $(call rule_mkdir) $(Q)$(call echo-cmd,gen)$(PYTHON) $(JEVENTS_PY) $(JEVENTS_ARCH) pmu-events/arch $@ endif + +# pmu-events.c file is generated in the OUTPUT directory so it needs a +# separate rule to depend on it properly +$(OUTPUT)pmu-events/pmu-events.o: $(PMU_EVENTS_C) + $(call rule_mkdir) + $(call if_changed_dep,cc_o_c)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 14/259 dm: fix a race condition in retrieve_deps
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
[ Upstream commit f6007dce0cd35d634d9be91ef3515a6385dcee16 ]
There's a race condition in the multipath target when retrieve_deps races with multipath_message calling dm_get_device and dm_put_device. retrieve_deps walks the list of open devices without holding any lock but multipath may add or remove devices to the list while it is running. The end result may be memory corruption or use-after-free memory access.
See this description of a UAF with multipath_message():
https://listman.redhat.com/archives/dm-devel/2022-October/052373.html
Fix this bug by introducing a new rw semaphore "devices_lock". We grab devices_lock for read in retrieve_deps and we grab it for write in dm_get_device and dm_put_device.
--- drivers/md/dm-core.h | 1 + drivers/md/dm-ioctl.c | 7 ++++++- drivers/md/dm-table.c | 32 ++++++++++++++++++++++++-------- 3 files changed, 31 insertions(+), 9 deletions(-)
drivers/md/dm-core.h +1 -0
@@ -214,6 +214,7 @@ struct dm_table {/* a list of devices used by this table */ struct list_head devices; +struct rw_semaphore devices_lock;/* events get handed up using this callback */ void (*event_fn)(void *);
drivers/md/dm-ioctl.c +6 -1
@@ -1566,6 +1566,8 @@ static void retrieve_deps(struct dm_table *table,struct dm_dev_internal *dd;struct dm_target_deps *deps; +down_read (&table->devices_lock); + deps =get_result_buffer (param, param_size, &len);/*
@@ -1580,7 +1582,7 @@ static void retrieve_deps(struct dm_table *table, needed =struct_size (deps, dev, count);if (len < needed) { param->flags |=DM_BUFFER_FULL_FLAG ; -return ; + goto out; }/*
@@ -1592,6 +1594,9 @@ static void retrieve_deps(struct dm_table *table, deps->dev[count++] =huge_encode_dev (dd->dm_dev->bdev->bd_dev); param->data_size = param->data_start + needed; + +out: +up_read (&table->devices_lock); }static int table_deps (struct file *filp,struct dm_ioctl *param,size_t param_size)
drivers/md/dm-table.c +24 -8
@@ -134,6 +134,7 @@ int dm_table_create(struct dm_table **result, fmode_t mode,return -ENOMEM ;INIT_LIST_HEAD (&t->devices); +init_rwsem (&t->devices_lock);if (!num_targets) num_targets =KEYS_PER_NODE ;
@@ -362,15 +363,19 @@ int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode,return -ENODEV ; } +down_write (&t->devices_lock); + dd =find_device (&t->devices, dev);if (!dd) { dd =kmalloc (sizeof (*dd),GFP_KERNEL ); -if (!dd) -return -ENOMEM ; +if (!dd) { + r = -ENOMEM ; + goto unlock_ret_r; + }if ((r =dm_get_table_device (t->md, dev, mode, &dd->dm_dev))) {kfree (dd); -return r; + goto unlock_ret_r; }refcount_set (&dd->count,1 );
@@ -380,12 +385,17 @@ int dm_get_device(struct dm_target *ti, const char *path, fmode_t mode, }else if (dd->dm_dev->mode != (mode | dd->dm_dev->mode)) { r =upgrade_mode (dd, mode, t->md);if (r) -return r; + goto unlock_ret_r; }refcount_inc (&dd->count); out: +up_write (&t->devices_lock); *result = dd->dm_dev;return 0 ; + +unlock_ret_r: +up_write (&t->devices_lock); +return r; }EXPORT_SYMBOL (dm_get_device);
@@ -421,9 +431,12 @@ static int dm_set_device_limits(struct dm_target *ti, struct dm_dev *dev,void dm_put_device (struct dm_target *ti,struct dm_dev *d) {int found =0 ; -struct list_head *devices = &ti->table->devices; +struct dm_table *t = ti->table; +struct list_head *devices = &t->devices;struct dm_dev_internal *dd; +down_write (&t->devices_lock); +list_for_each_entry (dd, devices, list) {if (dd->dm_dev == d) { found =1 ;
@@ -432,14 +445,17 @@ void dm_put_device(struct dm_target *ti, struct dm_dev *d) }if (!found) {DMERR ("%s: device %s not in table devices list" , -dm_device_name (ti->table->md), d->name); -return ; +dm_device_name (t->md), d->name); + goto unlock_ret; }if (refcount_dec_and_test (&dd->count)) { -dm_put_table_device (ti->table->md, d); +dm_put_table_device (t->md, d);list_del (&dd->list);kfree (dd); } + +unlock_ret: +up_write (&t->devices_lock); }EXPORT_SYMBOL (dm_put_device);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 15/259 btrfs: improve error message after failure to add delayed dir index item
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit 91bfe3104b8db0310f76f2dcb6aacef24c889366 ]
If we fail to add a delayed dir index item because there's already another item with the same index number, we print an error message (and then BUG). However that message isn't very helpful to debug anything because we don't know what's the index number and what are the values of index counters in the inode and its delayed inode (index_cnt fields of struct btrfs_inode and struct btrfs_delayed_node).
So update the error message to include the index number and counters.
We actually had a recent case where this issue was hit by a syzbot report (see the link below).
Stable-dep-of: 2c58c3931ede ("btrfs: remove BUG() after failure to insert delayed dir index item")
--- fs/btrfs/delayed-inode.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
fs/btrfs/delayed-inode.c +4 -3
@@ -1506,9 +1506,10 @@ int btrfs_insert_delayed_dir_index(struct btrfs_trans_handle *trans, ret =__btrfs_add_delayed_item (delayed_node, delayed_item);if (unlikely (ret)) {btrfs_err (trans->fs_info, -"err add delayed dir index item(name: %.*s) into the insertion tree of the delayed node(root id: %llu, inode id: %llu, errno: %d)" , - name_len, name, delayed_node->root->root_key.objectid, - delayed_node->inode_id, ret); +"error adding delayed dir index item, name: %.*s, index: %llu, root: %llu, dir: %llu, dir->index_cnt: %llu, delayed_node->index_cnt: %llu, error: %d" , + name_len, name, index,btrfs_root_id (delayed_node->root), + delayed_node->inode_id, dir->index_cnt, + delayed_node->index_cnt, ret);BUG (); }mutex_unlock (&delayed_node->mutex);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 16/259 btrfs: remove BUG() after failure to insert delayed dir index item
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit 2c58c3931ede7cd08cbecf1f1a4acaf0a04a41a9 ]
Instead of calling BUG() when we fail to insert a delayed dir index item into the delayed node's tree, we can just release all the resources we have allocated/acquired before and return the error to the caller. This is fine because all existing call chains undo anything they have done before calling btrfs_insert_delayed_dir_index() or BUG_ON (when creating pending snapshots in the transaction commit path).
So remove the BUG() call and do proper error handling.
This relates to a syzbot report linked below, but does not fix it because it only prevents hitting a BUG(), it does not fix the issue where somehow we attempt to use twice the same index number for different index items.
--- fs/btrfs/delayed-inode.c | 74 +++++++++++++++++++++++++--------------- 1 file changed, 47 insertions(+), 27 deletions(-)
fs/btrfs/delayed-inode.c +47 -27
@@ -1421,7 +1421,29 @@ void btrfs_balance_delayed_items(struct btrfs_fs_info *fs_info)btrfs_wq_run_delayed_node (delayed_root, fs_info,BTRFS_DELAYED_BATCH ); } -/* Will return 0 or -ENOMEM */ +static void btrfs_release_dir_index_item_space (struct btrfs_trans_handle *trans) +{ +struct btrfs_fs_info *fs_info = trans->fs_info; +const u64 bytes =btrfs_calc_insert_metadata_size (fs_info,1 ); + +if (test_bit (BTRFS_FS_LOG_RECOVERING , &fs_info->flags)) +return ; + +/* +* Adding the new dir index item does not require touching another +* leaf, so we can release 1 unit of metadata that was previously +* reserved when starting the transaction. This applies only to +* the case where we had a transaction start and excludes the +* transaction join case (when replaying log trees). +*/ +trace_btrfs_space_reservation (fs_info,"transaction" , + trans->transid, bytes,0 ); +btrfs_block_rsv_release (fs_info, trans->block_rsv, bytes,NULL ); +ASSERT (trans->bytes_reserved >= bytes); + trans->bytes_reserved -= bytes; +} + +/* Will return 0, -ENOMEM or -EEXIST (index number collision, unexpected). */ int btrfs_insert_delayed_dir_index(struct btrfs_trans_handle *trans, const char *name, int name_len, struct btrfs_inode *dir,
@@ -1463,6 +1485,27 @@ int btrfs_insert_delayed_dir_index(struct btrfs_trans_handle *trans,mutex_lock (&delayed_node->mutex); +/* +* First attempt to insert the delayed item. This is to make the error +* handling path simpler in case we fail (-EEXIST). There's no risk of +* any other task coming in and running the delayed item before we do +* the metadata space reservation below, because we are holding the +* delayed node's mutex and that mutex must also be locked before the +* node's delayed items can be run. +*/ + ret =__btrfs_add_delayed_item (delayed_node, delayed_item); +if (unlikely (ret)) { +btrfs_err (trans->fs_info, +"error adding delayed dir index item, name: %.*s, index: %llu, root: %llu, dir: %llu, dir->index_cnt: %llu, delayed_node->index_cnt: %llu, error: %d" , + name_len, name, index,btrfs_root_id (delayed_node->root), + delayed_node->inode_id, dir->index_cnt, + delayed_node->index_cnt, ret); +btrfs_release_delayed_item (delayed_item); +btrfs_release_dir_index_item_space (trans); +mutex_unlock (&delayed_node->mutex); + goto release_node; + } +if (delayed_node->index_item_leaves ==0 || delayed_node->curr_index_batch_size + data_len > leaf_data_size) { delayed_node->curr_index_batch_size = data_len;
@@ -1480,37 +1523,14 @@ int btrfs_insert_delayed_dir_index(struct btrfs_trans_handle *trans,* impossible. */ if (WARN_ON (ret)) { -mutex_unlock (&delayed_node->mutex);btrfs_release_delayed_item (delayed_item); +mutex_unlock (&delayed_node->mutex); goto release_node; } delayed_node->index_item_leaves++; - }else if (!test_bit (BTRFS_FS_LOG_RECOVERING , &fs_info->flags)) { -const u64 bytes =btrfs_calc_insert_metadata_size (fs_info,1 ); - -/* -* Adding the new dir index item does not require touching another -* leaf, so we can release 1 unit of metadata that was previously -* reserved when starting the transaction. This applies only to -* the case where we had a transaction start and excludes the -* transaction join case (when replaying log trees). -*/ -trace_btrfs_space_reservation (fs_info,"transaction" , - trans->transid, bytes,0 ); -btrfs_block_rsv_release (fs_info, trans->block_rsv, bytes,NULL ); -ASSERT (trans->bytes_reserved >= bytes); - trans->bytes_reserved -= bytes; - } - - ret =__btrfs_add_delayed_item (delayed_node, delayed_item); -if (unlikely (ret)) { -btrfs_err (trans->fs_info, -"error adding delayed dir index item, name: %.*s, index: %llu, root: %llu, dir: %llu, dir->index_cnt: %llu, delayed_node->index_cnt: %llu, error: %d" , - name_len, name, index,btrfs_root_id (delayed_node->root), - delayed_node->inode_id, dir->index_cnt, - delayed_node->index_cnt, ret); -BUG (); + }else { +btrfs_release_dir_index_item_space (trans); }mutex_unlock (&delayed_node->mutex);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 17/259 ext4: replace the traditional ternary conditional operator with with max()/min()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kemeng Shi <[email protected]>
[ Upstream commit de8bf0e5ee7482585450357c6d4eddec8efc5cb7 ]
Replace the traditional ternary conditional operator with with max()/min()
Stable-dep-of: 45e4ab320c9b ("ext4: move setting of trimmed bit into ext4_try_to_trim_range()")
--- fs/ext4/mballoc.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
fs/ext4/mballoc.c +2 -4
@@ -6430,8 +6430,7 @@ __releases(ext4_group_lock_ptr(sb, e4b->bd_group))void *bitmap; bitmap = e4b->bd_bitmap; - start = (e4b->bd_info->bb_first_free > start) ? - e4b->bd_info->bb_first_free : start; + start =max (e4b->bd_info->bb_first_free, start); count =0 ; free_count =0 ;
@@ -6648,8 +6647,7 @@ ext4_mballoc_query_range(ext4_lock_group (sb, group); - start = (e4b.bd_info->bb_first_free > start) ? - e4b.bd_info->bb_first_free : start; + start =max (e4b.bd_info->bb_first_free, start);if (end >=EXT4_CLUSTERS_PER_GROUP (sb)) end =EXT4_CLUSTERS_PER_GROUP (sb) -1 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 18/259 ext4: move setting of trimmed bit into ext4_try_to_trim_range()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit 45e4ab320c9b5fa67b1fc3b6a9b381cfcc0c8488 ]
Currently we set the group's trimmed bit in ext4_trim_all_free() based on return value of ext4_try_to_trim_range(). However when we will want to abort trimming because of suspend attempt, we want to return success from ext4_try_to_trim_range() but not set the trimmed bit. Instead implementing awkward propagation of this information, just move setting of trimmed bit into ext4_try_to_trim_range() when the whole group is trimmed.
--- fs/ext4/mballoc.c | 46 +++++++++++++++++++++++++--------------------- 1 file changed, 25 insertions(+), 21 deletions(-)
fs/ext4/mballoc.c +25 -21
@@ -6420,6 +6420,16 @@ __acquires(bitlock)return ret; } +static ext4_grpblk_t ext4_last_grp_cluster (struct super_block *sb, +ext4_group_t grp) +{ +if (grp <ext4_get_groups_count (sb)) +return EXT4_CLUSTERS_PER_GROUP (sb) -1 ; +return (ext4_blocks_count (EXT4_SB (sb)->s_es) - +ext4_group_first_block_no (sb, grp) -1 ) >> +EXT4_CLUSTER_BITS (sb); +} +static int ext4_try_to_trim_range (struct super_block *sb,struct ext4_buddy *e4b,ext4_grpblk_t start,ext4_grpblk_t max,ext4_grpblk_t minblocks)
@@ -6427,9 +6437,12 @@ __acquires(ext4_group_lock_ptr(sb, e4b->bd_group)) __releases(ext4_group_lock_ptr(sb, e4b->bd_group)) {ext4_grpblk_t next, count, free_count; +bool set_trimmed = false;void *bitmap; bitmap = e4b->bd_bitmap; +if (start ==0 && max >=ext4_last_grp_cluster (sb, e4b->bd_group)) + set_trimmed = true; start =max (e4b->bd_info->bb_first_free, start); count =0 ; free_count =0 ;
@@ -6444,16 +6457,14 @@ __releases(ext4_group_lock_ptr(sb, e4b->bd_group))int ret =ext4_trim_extent (sb, start, next - start, e4b);if (ret && ret != -EOPNOTSUPP ) -break ; +return count; count += next - start; } free_count += next - start; start = next +1 ; -if (fatal_signal_pending (current)) { - count = -ERESTARTSYS ; -break ; - } +if (fatal_signal_pending (current)) +return -ERESTARTSYS ;if (need_resched ()) {ext4_unlock_group (sb, e4b->bd_group);
@@ -6465,6 +6476,9 @@ __releases(ext4_group_lock_ptr(sb, e4b->bd_group))break ; } +if (set_trimmed) +EXT4_MB_GRP_SET_TRIMMED (e4b->bd_info); +return count; }
@@ -6475,7 +6489,6 @@ __releases(ext4_group_lock_ptr(sb, e4b->bd_group))* @start: first group block to examine * @max: last group block to examine * @minblocks: minimum extent block count -* @set_trimmed: set the trimmed flag if at least one block is trimmed * * ext4_trim_all_free walks through group's block bitmap searching for free * extents. When the free extent is found, mark it as used in group buddy
@@ -6485,7 +6498,7 @@ __releases(ext4_group_lock_ptr(sb, e4b->bd_group))static ext4_grpblk_t ext4_trim_all_free (struct super_block *sb,ext4_group_t group,ext4_grpblk_t start,ext4_grpblk_t max, -ext4_grpblk_t minblocks,bool set_trimmed) +ext4_grpblk_t minblocks) {struct ext4_buddy e4b;int ret;
@@ -6502,13 +6515,10 @@ ext4_trim_all_free(struct super_block *sb, ext4_group_t group,ext4_lock_group (sb, group);if (!EXT4_MB_GRP_WAS_TRIMMED (e4b.bd_info) || - minblocks <EXT4_SB (sb)->s_last_trim_minblks) { + minblocks <EXT4_SB (sb)->s_last_trim_minblks) ret =ext4_try_to_trim_range (sb, &e4b, start, max, minblocks); -if (ret >=0 && set_trimmed) -EXT4_MB_GRP_SET_TRIMMED (e4b.bd_info); - }else { +else ret =0 ; - }ext4_unlock_group (sb, group);ext4_mb_unload_buddy (&e4b);
@@ -6541,7 +6551,6 @@ int ext4_trim_fs(struct super_block *sb, struct fstrim_range *range)ext4_fsblk_t first_data_blk =le32_to_cpu (EXT4_SB (sb)->s_es->s_first_data_block);ext4_fsblk_t max_blks =ext4_blocks_count (EXT4_SB (sb)->s_es); -bool whole_group, eof = false;int ret =0 ; start = range->start >> sb->s_blocksize_bits;
@@ -6560,10 +6569,8 @@ int ext4_trim_fs(struct super_block *sb, struct fstrim_range *range)if (minlen >EXT4_CLUSTERS_PER_GROUP (sb)) goto out; } -if (end >= max_blks -1 ) { +if (end >= max_blks -1 ) end = max_blks -1 ; - eof = true; - }if (end <= first_data_blk) goto out;if (start < first_data_blk)
@@ -6577,7 +6584,6 @@ int ext4_trim_fs(struct super_block *sb, struct fstrim_range *range)/* end now represents the last cluster to discard in this group */ end =EXT4_CLUSTERS_PER_GROUP (sb) -1 ; - whole_group = true;for (group = first_group; group <= last_group; group++) { grp =ext4_get_group_info (sb, group);
@@ -6596,13 +6602,11 @@ int ext4_trim_fs(struct super_block *sb, struct fstrim_range *range)* change it for the last group, note that last_cluster is * already computed earlier by ext4_get_group_no_and_offset() */ -if (group == last_group) { +if (group == last_group) end = last_cluster; - whole_group = eof ? true : end ==EXT4_CLUSTERS_PER_GROUP (sb) -1 ; - }if (grp->bb_free >= minlen) { cnt =ext4_trim_all_free (sb, group, first_cluster, - end, minlen, whole_group); + end, minlen);if (cnt <0 ) { ret = cnt;break ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 19/259 ext4: do not let fstrim block system suspend
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit 5229a658f6453362fbb9da6bf96872ef25a7097e ]
Len Brown has reported that system suspend sometimes fail due to inability to freeze a task working in ext4_trim_fs() for one minute. Trimming a large filesystem on a disk that slowly processes discard requests can indeed take a long time. Since discard is just an advisory call, it is perfectly fine to interrupt it at any time and the return number of discarded blocks until that moment. Do that when we detect the task is being frozen.
References: https://bugzilla.kernel.org/show_bug.cgi?id=216322
--- fs/ext4/mballoc.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
fs/ext4/mballoc.c +10 -2
@@ -16,6 +16,7 @@#include <linux/slab.h> #include <linux/nospec.h> #include <linux/backing-dev.h> +#include <linux/freezer.h> #include <trace/events/ext4.h> /*
@@ -6430,6 +6431,11 @@ static ext4_grpblk_t ext4_last_grp_cluster(struct super_block *sb,EXT4_CLUSTER_BITS (sb); } +static bool ext4_trim_interrupted (void ) +{ +return fatal_signal_pending (current) ||freezing (current); +} +static int ext4_try_to_trim_range (struct super_block *sb,struct ext4_buddy *e4b,ext4_grpblk_t start,ext4_grpblk_t max,ext4_grpblk_t minblocks)
@@ -6463,8 +6469,8 @@ __releases(ext4_group_lock_ptr(sb, e4b->bd_group)) free_count += next - start; start = next +1 ; -if (fatal_signal_pending (current)) -return -ERESTARTSYS ; +if (ext4_trim_interrupted ()) +return count;if (need_resched ()) {ext4_unlock_group (sb, e4b->bd_group);
@@ -6586,6 +6592,8 @@ int ext4_trim_fs(struct super_block *sb, struct fstrim_range *range) end =EXT4_CLUSTERS_PER_GROUP (sb) -1 ;for (group = first_group; group <= last_group; group++) { +if (ext4_trim_interrupted ()) +break ; grp =ext4_get_group_info (sb, group);if (!grp)continue ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 20/259 netfilter: nf_tables: dont skip expired elements during walk
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
commit 24138933b97b055d486e8064b4a1721702442a9b upstream.
There is an asymmetry between commit/abort and preparation phase if the following conditions are met:
1. set is a verdict map ("1.2.3.4 : jump foo")
2. timeouts are enabled
In this case, following sequence is problematic:
1. element E in set S refers to chain C
2. userspace requests removal of set S
3. kernel does a set walk to decrement chain->use count for all elements from preparation phase
4. kernel does another set walk to remove elements from the commit phase (or another walk to do a chain->use increment for all elements from abort phase)
If E has already expired in 1), it will be ignored during list walk, so its use count won't have been changed.
Then, when set is culled, ->destroy callback will zap the element via nf_tables_set_elem_destroy(), but this function is only safe for elements that have been deactivated earlier from the preparation phase:
lack of earlier deactivate removes the element but leaks the chain use count, which results in a WARN splat when the chain gets removed later, plus a leak of the nft_chain structure.
Update pipapo_get() not to skip expired elements, otherwise flush command reports bogus ENOENT errors.
--- net/netfilter/nf_tables_api.c | 4 ++++ net/netfilter/nft_set_hash.c | 2 -- net/netfilter/nft_set_pipapo.c | 18 ++++++++++++------ net/netfilter/nft_set_rbtree.c | 2 -- 4 files changed, 16 insertions(+), 10 deletions(-)
net/netfilter/nf_tables_api.c +4 -0
@@ -5386,8 +5386,12 @@ static int nf_tables_dump_setelem(const struct nft_ctx *ctx,const struct nft_set_iter *iter, struct nft_set_elem *elem) { + const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);struct nft_set_dump_args *args; +if (nft_set_elem_expired (ext)) +return 0 ; + args = container_of(iter, struct nft_set_dump_args, iter);return nf_tables_fill_setelem (args->skb, set, elem); }
net/netfilter/nft_set_hash.c +0 -2
@@ -278,8 +278,6 @@ static void nft_rhash_walk(const struct nft_ctx *ctx, struct nft_set *set,if (iter->count < iter->skip) goto cont; -if (nft_set_elem_expired (&he->ext)) - goto cont;if (!nft_set_elem_active (&he->ext, iter->genmask)) goto cont;
net/netfilter/nft_set_pipapo.c +12 -6
@@ -566,8 +566,7 @@ static struct nft_pipapo_elem *pipapo_get(const struct net *net, goto out;if (last) { -if (nft_set_elem_expired (&f->mt[b].e->ext) || - (genmask && +if ((genmask && !nft_set_elem_active (&f->mt[b].e->ext, genmask))) goto next_match;
@@ -601,8 +600,17 @@ static struct nft_pipapo_elem *pipapo_get(const struct net *net,static void *nft_pipapo_get (const struct net *net,const struct nft_set *set,const struct nft_set_elem *elem,unsigned int flags) { -return pipapo_get (net, set, (const u8 *)elem->key.val.data, -nft_genmask_cur (net)); +struct nft_pipapo_elem *ret; + + ret =pipapo_get (net, set, (const u8 *)elem->key.val.data, +nft_genmask_cur (net)); +if (IS_ERR (ret)) +return ret; + +if (nft_set_elem_expired (&ret->ext)) +return ERR_PTR (-ENOENT ); + +return ret; }/**
@@ -2024,8 +2032,6 @@ static void nft_pipapo_walk(const struct nft_ctx *ctx, struct nft_set *set, goto cont; e = f->mt[r].e; -if (nft_set_elem_expired (&e->ext)) - goto cont; elem.priv = e;
net/netfilter/nft_set_rbtree.c +0 -2
@@ -552,8 +552,6 @@ static void nft_rbtree_walk(const struct nft_ctx *ctx,if (iter->count < iter->skip) goto cont; -if (nft_set_elem_expired (&rbe->ext)) - goto cont;if (!nft_set_elem_active (&rbe->ext, iter->genmask)) goto cont;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 21/259 netfilter: nf_tables: GC transaction API to avoid race with control plane
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit 5f68718b34a531a556f2f50300ead2862278da26 upstream.
The set types rhashtable and rbtree use a GC worker to reclaim memory.
Quoted 1 line
From system work queue, in periodic intervals, a scan of the table is
done.
The major caveat here is that the nft transaction mutex is not held. This causes a race between control plane and GC when they attempt to delete the same element.
We cannot grab the netlink mutex from the work queue, because the control plane has to wait for the GC work queue in case the set is to be removed, so we get following deadlock:
cpu 1 cpu2
GC work transaction comes in , lock nft mutex
`acquire nft mutex // BLOCKS
transaction asks to remove the set set destruction calls cancel_work_sync()
cancel_work_sync will now block forever, because it is waiting for the mutex the caller already owns.
This patch adds a new API that deals with garbage collection in two steps:
1) Lockless GC of expired elements sets on the NFT_SET_ELEM_DEAD_BIT so they are not visible via lookup. Annotate current GC sequence in the GC transaction. Enqueue GC transaction work as soon as it is full. If ruleset is updated, then GC transaction is aborted and retried later.
2) GC work grabs the mutex. If GC sequence has changed then this GC transaction lost race with control plane, abort it as it contains stale references to objects and let GC try again later. If the ruleset is intact, then this GC transaction deactivates and removes the elements and it uses call_rcu() to destroy elements.
Note that no elements are removed from GC lockless path, the _DEAD bit is set and pointers are collected. GC catchall does not remove the elements anymore too. There is a new set->dead flag that is set on to abort the GC transaction to deal with set->ops->destroy() path which removes the remaining elements in the set from commit_release, where no mutex is held.
To deal with GC when mutex is held, which allows safe deactivate and removal, add sync GC API which releases the set element object via call_rcu(). This is used by rbtree and pipapo backends which also perform garbage collection from control plane path.
Since element removal from sets can happen from control plane and element garbage collection/timeout, it is necessary to keep the set structure alive until all elements have been deactivated and destroyed.
We cannot do a cancel_work_sync or flush_work in nft_set_destroy because its called with the transaction mutex held, but the aforementioned async work queue might be blocked on the very mutex that nft_set_destroy() callchain is sitting on.
This gives us the choice of ABBA deadlock or UaF.
To avoid both, add set->refs refcount_t member. The GC API can then increment the set refcount and release it once the elements have been free'd.
Set backends are adapted to use the GC transaction API in a follow up patch entitled:
("netfilter: nf_tables: use gc transaction API in set backends")
This is joint work with Florian Westphal.
--- include/net/netfilter/nf_tables.h | 64 +++++++- net/netfilter/nf_tables_api.c | 248 ++++++++++++++++++++++++++++-- 2 files changed, 300 insertions(+), 12 deletions(-)
include/net/netfilter/nf_tables.h +63 -1
@@ -507,6 +507,7 @@ struct nft_set_elem_expr {* * @list: table set list node * @bindings: list of set bindings +* @refs: internal refcounting for async set destruction * @table: table this set belongs to * @net: netnamespace this set belongs to * @name: name of the set
@@ -536,6 +537,7 @@ struct nft_set_elem_expr {struct nft_set {struct list_head list;struct list_head bindings; +refcount_t refs;struct nft_table *table;possible_net_t net;char *name;
@@ -557,7 +559,8 @@ struct nft_set {struct list_head pending_update;/* runtime data below here */ const struct nft_set_ops *ops____cacheline_aligned ; - u16 flags:14, + u16 flags:13, + dead:1, genmask:2;u8 klen;u8 dlen;
@@ -1577,6 +1580,32 @@ static inline void nft_set_elem_clear_busy(struct nft_set_ext *ext)clear_bit (NFT_SET_ELEM_BUSY_BIT , word); } +#define NFT_SET_ELEM_DEAD_MASK (1 << 3) + +#if defined(__LITTLE_ENDIAN_BITFIELD) +#define NFT_SET_ELEM_DEAD_BIT 3 +#elif defined(__BIG_ENDIAN_BITFIELD) +#define NFT_SET_ELEM_DEAD_BIT (BITS_PER_LONG - BITS_PER_BYTE + 3) +#else +#error +#endif + +static inline void nft_set_elem_dead (struct nft_set_ext *ext) +{ +unsigned long *word = (unsigned long *)ext; + +BUILD_BUG_ON (offsetof(struct nft_set_ext , genmask) !=0 ); +set_bit (NFT_SET_ELEM_DEAD_BIT , word); +} + +static inline int nft_set_elem_is_dead (const struct nft_set_ext *ext) +{ +unsigned long *word = (unsigned long *)ext; + +BUILD_BUG_ON (offsetof(struct nft_set_ext , genmask) !=0 ); +return test_bit (NFT_SET_ELEM_DEAD_BIT , word); +} +/** * struct nft_trans - nf_tables object update in transaction *
@@ -1708,6 +1737,38 @@ struct nft_trans_flowtable {#define nft_trans_flowtable_flags (trans) \ (((struct nft_trans_flowtable *)trans->data)->flags) +#define NFT_TRANS_GC_BATCHCOUNT 256 + +struct nft_trans_gc { +struct list_head list; +struct net *net; +struct nft_set *set; +u32 seq; +u8 count; +void *priv[NFT_TRANS_GC_BATCHCOUNT ]; +struct rcu_head rcu; +}; + +struct nft_trans_gc *nft_trans_gc_alloc (struct nft_set *set, +unsigned int gc_seq,gfp_t gfp); +void nft_trans_gc_destroy (struct nft_trans_gc *trans); + +struct nft_trans_gc *nft_trans_gc_queue_async (struct nft_trans_gc *gc, +unsigned int gc_seq,gfp_t gfp); +void nft_trans_gc_queue_async_done (struct nft_trans_gc *gc); + +struct nft_trans_gc *nft_trans_gc_queue_sync (struct nft_trans_gc *gc,gfp_t gfp); +void nft_trans_gc_queue_sync_done (struct nft_trans_gc *trans); + +void nft_trans_gc_elem_add (struct nft_trans_gc *gc,void *priv); + +struct nft_trans_gc *nft_trans_gc_catchall (struct nft_trans_gc *gc, +unsigned int gc_seq); + +void nft_setelem_data_deactivate (const struct net *net, +const struct nft_set *set, +struct nft_set_elem *elem); +int __init nft_chain_filter_init (void );void nft_chain_filter_fini (void );
@@ -1735,6 +1796,7 @@ struct nftables_pernet {u64 table_handle;unsigned int base_seq;u8 validate_state; +unsigned int gc_seq; };extern unsigned int nf_tables_net_id;
net/netfilter/nf_tables_api.c +237 -11
353 lines not on this page · raw message
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 22/259 netfilter: nf_tables: adapt set backend to use GC transaction API
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit f6c383b8c31a93752a52697f8430a71dcbc46adf upstream.
Use the GC transaction API to replace the old and buggy gc API and the busy mark approach.
No set elements are removed from async garbage collection anymore, instead the _DEAD bit is set on so the set element is not visible from lookup path anymore. Async GC enqueues transaction work that might be aborted and retried later.
rbtree and pipapo set backends does not set on the _DEAD bit from the sync GC path since this runs in control plane path where mutex is held. In this case, set elements are deactivated, removed and then released via RCU callback, sync GC never fails.
--- net/netfilter/nf_tables_api.c | 7 +- net/netfilter/nft_set_hash.c | 77 +++++++++++------- net/netfilter/nft_set_pipapo.c | 48 ++++++++--- net/netfilter/nft_set_rbtree.c | 144 ++++++++++++++++++++------------- 4 files changed, 173 insertions(+), 103 deletions(-)
net/netfilter/nf_tables_api.c +2 -5
@@ -6153,7 +6153,6 @@ static void nft_setelem_activate(struct net *net, struct nft_set *set,if (nft_setelem_is_catchall (set, elem)) {nft_set_elem_change_active (net, set, ext); -nft_set_elem_clear_busy (ext); }else { set->ops->activate (net, set, elem); }
@@ -6168,8 +6167,7 @@ static int nft_setelem_catchall_deactivate(const struct net *net,list_for_each_entry (catchall, &set->catchall_list, list) { ext =nft_set_elem_ext (set, catchall->elem); -if (!nft_is_active (net, ext) || -nft_set_elem_mark_busy (ext)) +if (!nft_is_active (net, ext))continue ;kfree (elem->priv);
@@ -6880,8 +6878,7 @@ static int nft_set_catchall_flush(const struct nft_ctx *ctx,list_for_each_entry_rcu (catchall, &set->catchall_list, list) { ext =nft_set_elem_ext (set, catchall->elem); -if (!nft_set_elem_active (ext, genmask) || -nft_set_elem_mark_busy (ext)) +if (!nft_set_elem_active (ext, genmask))continue ; elem.priv = catchall->elem;
net/netfilter/nft_set_hash.c +48 -29
140 lines not on this page · raw message
net/netfilter/nft_set_pipapo.c +36 -12
83 lines not on this page · raw message
net/netfilter/nft_set_rbtree.c +87 -57
232 lines not on this page · raw message
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 23/259 netfilter: nft_set_hash: mark set element as dead when deleting from packet path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
upstream c92db3030492b8ad1d0faace7a93bbcf53850d0c commit.
Set on the NFT_SET_ELEM_DEAD_BIT flag on this element, instead of performing element removal which might race with an ongoing transaction. Enable gc when dynamic flag is set on since dynset deletion requires garbage collection after this patch.
--- net/netfilter/nft_set_hash.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/netfilter/nft_set_hash.c +4 -2
@@ -249,7 +249,9 @@ static bool nft_rhash_delete(const struct nft_set *set,if (he ==NULL )return false; -return rhashtable_remove_fast (&priv->ht, &he->node, nft_rhash_params) ==0 ; +nft_set_elem_dead (&he->ext); + +return true; } static void nft_rhash_walk(const struct nft_ctx *ctx, struct nft_set *set,
@@ -412,7 +414,7 @@ static int nft_rhash_init(const struct nft_set *set,return err;INIT_DEFERRABLE_WORK (&priv->gc_work, nft_rhash_gc); -if (set->flags &NFT_SET_TIMEOUT ) +if (set->flags & (NFT_SET_TIMEOUT |NFT_SET_EVAL ))nft_rhash_gc_init (set);return 0 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 24/259 netfilter: nf_tables: remove busy mark and gc batch API
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit a2dd0233cbc4d8a0abb5f64487487ffc9265beb5 upstream.
Ditch it, it has been replace it by the GC transaction API and it has no clients anymore.
--- include/net/netfilter/nf_tables.h | 98 +------------------------------ net/netfilter/nf_tables_api.c | 48 +-------------- 2 files changed, 4 insertions(+), 142 deletions(-)
include/net/netfilter/nf_tables.h +3 -95
@@ -594,7 +594,6 @@ struct nft_set *nft_set_lookup_global(const struct net *net,struct nft_set_ext *nft_set_catchall_lookup (const struct net *net,const struct nft_set *set); -void *nft_set_catchall_gc (const struct nft_set *set);static inline unsigned long nft_set_gc_interval (const struct nft_set *set) {
@@ -811,62 +810,6 @@ void nft_set_elem_destroy(const struct nft_set *set, void *elem,void nf_tables_set_elem_destroy (const struct nft_ctx *ctx,const struct nft_set *set,void *elem); -/** -* struct nft_set_gc_batch_head - nf_tables set garbage collection batch -* -* @rcu: rcu head -* @set: set the elements belong to -* @cnt: count of elements -*/ -struct nft_set_gc_batch_head { -struct rcu_head rcu; -const struct nft_set *set; -unsigned int cnt; -}; - -#define NFT_SET_GC_BATCH_SIZE ((PAGE_SIZE - \ - sizeof(struct nft_set_gc_batch_head)) / \ - sizeof(void *)) - -/** -* struct nft_set_gc_batch - nf_tables set garbage collection batch -* -* @head: GC batch head -* @elems: garbage collection elements -*/ -struct nft_set_gc_batch { -struct nft_set_gc_batch_head head; -void *elems[NFT_SET_GC_BATCH_SIZE ]; -}; - -struct nft_set_gc_batch *nft_set_gc_batch_alloc (const struct nft_set *set, -gfp_t gfp); -void nft_set_gc_batch_release (struct rcu_head *rcu); - -static inline void nft_set_gc_batch_complete (struct nft_set_gc_batch *gcb) -{ -if (gcb !=NULL ) -call_rcu (&gcb->head.rcu, nft_set_gc_batch_release); -} - -static inline struct nft_set_gc_batch * -nft_set_gc_batch_check (const struct nft_set *set,struct nft_set_gc_batch *gcb, -gfp_t gfp) -{ -if (gcb !=NULL ) { -if (gcb->head.cnt +1 <ARRAY_SIZE (gcb->elems)) -return gcb; -nft_set_gc_batch_complete (gcb); - } -return nft_set_gc_batch_alloc (set, gfp); -} - -static inline void nft_set_gc_batch_add (struct nft_set_gc_batch *gcb, -void *elem) -{ - gcb->elems[gcb->head.cnt++] = elem; -} -struct nft_expr_ops ;/** * struct nft_expr_type - nf_tables expression type
@@ -1545,47 +1488,12 @@ static inline void nft_set_elem_change_active(const struct net *net,#endif /* IS_ENABLED(CONFIG_NF_TABLES) */ -/* -* We use a free bit in the genmask field to indicate the element -* is busy, meaning it is currently being processed either by -* the netlink API or GC. -* -* Even though the genmask is only a single byte wide, this works -* because the extension structure if fully constant once initialized, -* so there are no non-atomic write accesses unless it is already -* marked busy. -*/ -#define NFT_SET_ELEM_BUSY_MASK (1 << 2) - -#if defined(__LITTLE_ENDIAN_BITFIELD) -#define NFT_SET_ELEM_BUSY_BIT 2 -#elif defined(__BIG_ENDIAN_BITFIELD) -#define NFT_SET_ELEM_BUSY_BIT (BITS_PER_LONG - BITS_PER_BYTE + 2) -#else -#error -#endif - -static inline int nft_set_elem_mark_busy (struct nft_set_ext *ext) -{ -unsigned long *word = (unsigned long *)ext; - -BUILD_BUG_ON (offsetof(struct nft_set_ext , genmask) !=0 ); -return test_and_set_bit (NFT_SET_ELEM_BUSY_BIT , word); -} - -static inline void nft_set_elem_clear_busy (struct nft_set_ext *ext) -{ -unsigned long *word = (unsigned long *)ext; - -clear_bit (NFT_SET_ELEM_BUSY_BIT , word); -} - -#define NFT_SET_ELEM_DEAD_MASK (1 << 3) +#define NFT_SET_ELEM_DEAD_MASK (1 << 2)#if defined(__LITTLE_ENDIAN_BITFIELD) -#define NFT_SET_ELEM_DEAD_BIT 3 +#define NFT_SET_ELEM_DEAD_BIT 2#elif defined(__BIG_ENDIAN_BITFIELD) -#define NFT_SET_ELEM_DEAD_BIT (BITS_PER_LONG - BITS_PER_BYTE + 3) +#define NFT_SET_ELEM_DEAD_BIT (BITS_PER_LONG - BITS_PER_BYTE + 2)#else #error #endif
net/netfilter/nf_tables_api.c +1 -47
66 lines not on this page · raw message
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 25/259 netfilter: nf_tables: dont fail inserts if duplicate has expired
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
commit 7845914f45f066497ac75b30c50dbc735e84e884 upstream.
nftables selftests fail:run-tests.sh testcases/sets/0044interval_overlap_0
Expected: 0-2 . 0-3, got:
W: [FAILED] ./testcases/sets/0044interval_overlap_0: got 1
Insertion must ignore duplicate but expired entries.
Moreover, there is a strange asymmetry in nft_pipapo_activate:
It refetches the current element, whereas the other ->activate callbacks (bitmap, hash, rhash, rbtree) use elem->priv.
Same for .remove: other set implementations take elem->priv, nft_pipapo_remove fetches elem->priv, then does a relookup, remove this.
I suspect this was the reason for the change that prompted the removal of the expired check in pipapo_get() in the first place, but skipping exired elements there makes no sense to me, this helper is used for normal get requests, insertions (duplicate check) and deactivate callback.
In first two cases expired elements must be skipped.
For ->deactivate(), this gets called for DELSETELEM, so it seems to me that expired elements should be skipped as well, i.e. delete request should fail with -ENOENT error.
--- net/netfilter/nft_set_pipapo.c | 23 ++++------------------- 1 file changed, 4 insertions(+), 19 deletions(-)
net/netfilter/nft_set_pipapo.c +4 -19
@@ -566,6 +566,8 @@ static struct nft_pipapo_elem *pipapo_get(const struct net *net, goto out;if (last) { +if (nft_set_elem_expired (&f->mt[b].e->ext)) + goto next_match;if ((genmask && !nft_set_elem_active (&f->mt[b].e->ext, genmask))) goto next_match;
@@ -600,17 +602,8 @@ static struct nft_pipapo_elem *pipapo_get(const struct net *net,static void *nft_pipapo_get (const struct net *net,const struct nft_set *set,const struct nft_set_elem *elem,unsigned int flags) { -struct nft_pipapo_elem *ret; - - ret =pipapo_get (net, set, (const u8 *)elem->key.val.data, +return pipapo_get (net, set, (const u8 *)elem->key.val.data,nft_genmask_cur (net)); -if (IS_ERR (ret)) -return ret; - -if (nft_set_elem_expired (&ret->ext)) -return ERR_PTR (-ENOENT ); - -return ret; }/**
@@ -1751,11 +1744,7 @@ static void nft_pipapo_activate(const struct net *net,const struct nft_set *set, const struct nft_set_elem *elem) { - struct nft_pipapo_elem *e; - - e =pipapo_get (net, set, (const u8 *)elem->key.val.data,0 ); -if (IS_ERR (e)) -return ; + struct nft_pipapo_elem *e = elem->priv;nft_set_elem_change_active (net, set, &e->ext); }
@@ -1969,10 +1958,6 @@ static void nft_pipapo_remove(const struct net *net, const struct nft_set *set, data = (const u8 *)nft_set_ext_key (&e->ext); - e =pipapo_get (net, set, data,0 ); -if (IS_ERR (e)) -return ; -while ((rules_f0 =pipapo_rules_same_key (m->f, first_rule))) {union nft_pipapo_map_bucket rulemap[NFT_PIPAPO_MAX_FIELDS ];const u8 *match_start, *match_end;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 26/259 netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit 6a33d8b73dfac0a41f3877894b38082bd0c9a5bc upstream.
Netlink event path is missing a synchronization point with GC transactions. Add GC sequence number update to netns release path and netlink event path, any GC transaction losing race will be discarded.
--- net/netfilter/nf_tables_api.c | 36 +++++++++++++++++++++++++++++++---- 1 file changed, 32 insertions(+), 4 deletions(-)
net/netfilter/nf_tables_api.c +32 -4
@@ -9413,6 +9413,22 @@ static void nft_set_commit_update(struct list_head *set_update_list) } } +static unsigned int nft_gc_seq_begin (struct nftables_pernet *nft_net) +{ +unsigned int gc_seq; + +/* Bump gc counter, it becomes odd, this is the busy mark. */ + gc_seq =READ_ONCE (nft_net->gc_seq); +WRITE_ONCE (nft_net->gc_seq, ++gc_seq); + +return gc_seq; +} + +static void nft_gc_seq_end (struct nftables_pernet *nft_net,unsigned int gc_seq) +{ +WRITE_ONCE (nft_net->gc_seq, ++gc_seq); +} +static int nf_tables_commit (struct net *net,struct sk_buff *skb) {struct nftables_pernet *nft_net =nft_pernet (net);
@@ -9498,9 +9514,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)WRITE_ONCE (nft_net->base_seq, base_seq); -/* Bump gc counter, it becomes odd, this is the busy mark. */ - gc_seq =READ_ONCE (nft_net->gc_seq); -WRITE_ONCE (nft_net->gc_seq, ++gc_seq); + gc_seq =nft_gc_seq_begin (nft_net);/* step 3. Start new generation, rules_gen_X now in use. */ net->nft.gencursor =nft_gencursor_next (net);
@@ -9691,7 +9705,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb)nf_tables_gen_notify (net, skb,NFT_MSG_NEWGEN );nf_tables_commit_audit_log (&adl, nft_net->base_seq); -WRITE_ONCE (nft_net->gc_seq, ++gc_seq); +nft_gc_seq_end (nft_net, gc_seq);nf_tables_commit_release (net);return 0 ;
@@ -10674,6 +10688,7 @@ static int nft_rcv_nl_event(struct notifier_block *this, unsigned long event,struct net *net = n->net;unsigned int deleted;bool restart = false; +unsigned int gc_seq;if (event !=NETLINK_URELEASE || n->protocol !=NETLINK_NETFILTER )return NOTIFY_DONE ;
@@ -10681,6 +10696,9 @@ static int nft_rcv_nl_event(struct notifier_block *this, unsigned long event, nft_net =nft_pernet (net); deleted =0 ;mutex_lock (&nft_net->commit_mutex); + + gc_seq =nft_gc_seq_begin (nft_net); +if (!list_empty (&nf_tables_destroy_list))nf_tables_trans_destroy_flush_work (); again:
@@ -10703,6 +10721,8 @@ static int nft_rcv_nl_event(struct notifier_block *this, unsigned long event,if (restart) goto again; } +nft_gc_seq_end (nft_net, gc_seq); +mutex_unlock (&nft_net->commit_mutex);return NOTIFY_DONE ;
@@ -10741,12 +10761,20 @@ static void __net_exit nf_tables_pre_exit_net(struct net *net) static void __net_exit nf_tables_exit_net(struct net *net) {struct nftables_pernet *nft_net =nft_pernet (net); +unsigned int gc_seq;mutex_lock (&nft_net->commit_mutex); + + gc_seq =nft_gc_seq_begin (nft_net); +if (!list_empty (&nft_net->commit_list) || !list_empty (&nft_net->module_list))__nf_tables_abort (net,NFNL_ABORT_NONE ); +__nft_release_tables (net); + +nft_gc_seq_end (nft_net, gc_seq); +mutex_unlock (&nft_net->commit_mutex);WARN_ON_ONCE (!list_empty (&nft_net->tables));WARN_ON_ONCE (!list_empty (&nft_net->module_list));
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 27/259 netfilter: nf_tables: GC transaction race with netns dismantle
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit 02c6c24402bf1c1e986899c14ba22a10b510916b upstream.
Use maybe_get_net() since GC workqueue might race with netns exit path.
--- net/netfilter/nf_tables_api.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +6 -1
@@ -9155,9 +9155,14 @@ struct nft_trans_gc *nft_trans_gc_alloc(struct nft_set *set,if (!trans)return NULL ; + trans->net =maybe_get_net (net); +if (!trans->net) { +kfree (trans); +return NULL ; + } +refcount_inc (&set->refs); trans->set = set; - trans->net =get_net (net); trans->seq = gc_seq;return trans;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 28/259 netfilter: nf_tables: GC transaction race with abort path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit 720344340fb9be2765bbaab7b292ece0a4570eae upstream.
Abort path is missing a synchronization point with GC transactions. Add GC sequence number hence any GC transaction losing race will be discarded.
--- net/netfilter/nf_tables_api.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +6 -1
@@ -9969,7 +9969,12 @@ static int nf_tables_abort(struct net *net, struct sk_buff *skb, enum nfnl_abort_action action) {struct nftables_pernet *nft_net =nft_pernet (net); -int ret =__nf_tables_abort (net, action); +unsigned int gc_seq; +int ret; + + gc_seq =nft_gc_seq_begin (nft_net); + ret =__nf_tables_abort (net, action); +nft_gc_seq_end (nft_net, gc_seq);mutex_unlock (&nft_net->commit_mutex);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 29/259 netfilter: nf_tables: use correct lock to protect gc_list
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit 8357bc946a2abc2a10ca40e5a2105d2b4c57515e upstream.
Use nf_tables_gc_list_lock spinlock, not nf_tables_destroy_list_lock to protect the gc_list.
--- net/netfilter/nf_tables_api.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/netfilter/nf_tables_api.c +2 -2
@@ -9131,9 +9131,9 @@ static void nft_trans_gc_work(struct work_struct *work)struct nft_trans_gc *trans, *next;LIST_HEAD (trans_gc_list); -spin_lock (&nf_tables_destroy_list_lock); +spin_lock (&nf_tables_gc_list_lock);list_splice_init (&nf_tables_gc_list, &trans_gc_list); -spin_unlock (&nf_tables_destroy_list_lock); +spin_unlock (&nf_tables_gc_list_lock);list_for_each_entry_safe (trans, next, &trans_gc_list, list) {list_del (&trans->list);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 30/259 netfilter: nf_tables: defer gc run if previous batch is still pending
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
commit 8e51830e29e12670b4c10df070a4ea4c9593e961 upstream.
Don't queue more gc work, else we may queue the same elements multiple times.
If an element is flagged as dead, this can mean that either the previous gc request was invalidated/discarded by a transaction or that the previous request is still pending in the system work queue.
The latter will happen if the gc interval is set to a very low value, e.g. 1ms, and system work queue is backlogged.
The sets refcount is 1 if no previous gc requeusts are queued, so add a helper for this and skip gc run if old requests are pending.
Add a helper for this and skip the gc run in this case.
--- include/net/netfilter/nf_tables.h | 5 +++++ net/netfilter/nft_set_hash.c | 3 +++ net/netfilter/nft_set_rbtree.c | 3 +++ 3 files changed, 11 insertions(+)
include/net/netfilter/nf_tables.h +5 -0
@@ -581,6 +581,11 @@ static inline void *nft_set_priv(const struct nft_set *set)return (void *)set->data; } +static inline bool nft_set_gc_is_pending (const struct nft_set *s) +{ +return refcount_read (&s->refs) !=1 ; +} +static inline struct nft_set *nft_set_container_of (const void *priv) {return (void *)priv - offsetof(struct nft_set , data);
net/netfilter/nft_set_hash.c +3 -0
@@ -326,6 +326,9 @@ static void nft_rhash_gc(struct work_struct *work) nft_net =nft_pernet (net); gc_seq =READ_ONCE (nft_net->gc_seq); +if (nft_set_gc_is_pending (set)) + goto done; + gc =nft_trans_gc_alloc (set, gc_seq,GFP_KERNEL );if (!gc) goto done;
net/netfilter/nft_set_rbtree.c +3 -0
@@ -611,6 +611,9 @@ static void nft_rbtree_gc(struct work_struct *work) nft_net =nft_pernet (net); gc_seq =READ_ONCE (nft_net->gc_seq); +if (nft_set_gc_is_pending (set)) + goto done; + gc =nft_trans_gc_alloc (set, gc_seq,GFP_KERNEL );if (!gc) goto done;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 31/259 netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit 2ee52ae94baabf7ee09cf2a8d854b990dac5d0e4 upstream.
New elements in this transaction might expired before such transaction ends. Skip sync GC for such elements otherwise commit path might walk over an already released object. Once transaction is finished, async GC will collect such expired element.
--- net/netfilter/nft_set_rbtree.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/netfilter/nft_set_rbtree.c +6 -2
@@ -312,6 +312,7 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,struct nft_rbtree_elem *rbe, *rbe_le =NULL , *rbe_ge =NULL ;struct rb_node *node, *next, *parent, **p, *first =NULL ;struct nft_rbtree *priv =nft_set_priv (set); +u8 cur_genmask =nft_genmask_cur (net);u8 genmask =nft_genmask_next (net);int d, err;
@@ -357,8 +358,11 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set,if (!nft_set_elem_active (&rbe->ext, genmask))continue ; -/* perform garbage collection to avoid bogus overlap reports. */ -if (nft_set_elem_expired (&rbe->ext)) { +/* perform garbage collection to avoid bogus overlap reports +* but skip new elements in this transaction. +*/ +if (nft_set_elem_expired (&rbe->ext) && +nft_set_elem_active (&rbe->ext, cur_genmask)) { err =nft_rbtree_gc_elem (set, priv, rbe, genmask);if (err <0 )return err;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 32/259 netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit 96b33300fba880ec0eafcf3d82486f3463b4b6da upstream.
rbtree GC does not modify the datastructure, instead it collects expired elements and it enqueues a GC transaction. Use a read spinlock instead to avoid data contention while GC worker is running.
--- net/netfilter/nft_set_rbtree.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
net/netfilter/nft_set_rbtree.c +2 -4
@@ -622,8 +622,7 @@ static void nft_rbtree_gc(struct work_struct *work)if (!gc) goto done; -write_lock_bh (&priv->lock); -write_seqcount_begin (&priv->count); +read_lock_bh (&priv->lock);for (node =rb_first (&priv->root); node !=NULL ; node =rb_next (node)) {/* Ruleset has been updated, try later. */
@@ -673,8 +672,7 @@ static void nft_rbtree_gc(struct work_struct *work) gc =nft_trans_gc_catchall (gc, gc_seq); try_later: -write_seqcount_end (&priv->count); -write_unlock_bh (&priv->lock); +read_unlock_bh (&priv->lock);if (gc)nft_trans_gc_queue_async_done (gc);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 33/259 netfilter: nft_set_pipapo: call nft_trans_gc_queue_sync() in catchall GC
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit 4a9e12ea7e70223555ec010bec9f711089ce96f6 upstream.
pipapo needs to enqueue GC transactions for catchall elements through nft_trans_gc_queue_sync(). Add nft_trans_gc_catchall_sync() and nft_trans_gc_catchall_async() to handle GC transaction queueing accordingly.
--- include/net/netfilter/nf_tables.h | 5 +++-- net/netfilter/nf_tables_api.c | 22 +++++++++++++++++++--- net/netfilter/nft_set_hash.c | 2 +- net/netfilter/nft_set_pipapo.c | 2 +- net/netfilter/nft_set_rbtree.c | 2 +- 5 files changed, 25 insertions(+), 8 deletions(-)
include/net/netfilter/nf_tables.h +3 -2
@@ -1675,8 +1675,9 @@ void nft_trans_gc_queue_sync_done(struct nft_trans_gc *trans);void nft_trans_gc_elem_add (struct nft_trans_gc *gc,void *priv); -struct nft_trans_gc *nft_trans_gc_catchall (struct nft_trans_gc *gc, -unsigned int gc_seq); +struct nft_trans_gc *nft_trans_gc_catchall_async (struct nft_trans_gc *gc, +unsigned int gc_seq); +struct nft_trans_gc *nft_trans_gc_catchall_sync (struct nft_trans_gc *gc); void nft_setelem_data_deactivate(const struct net *net, const struct nft_set *set,
net/netfilter/nf_tables_api.c +19 -3
@@ -9233,8 +9233,9 @@ void nft_trans_gc_queue_sync_done(struct nft_trans_gc *trans)call_rcu (&trans->rcu, nft_trans_gc_trans_free); } -struct nft_trans_gc *nft_trans_gc_catchall (struct nft_trans_gc *gc, -unsigned int gc_seq) +static struct nft_trans_gc *nft_trans_gc_catchall (struct nft_trans_gc *gc, +unsigned int gc_seq, +bool sync) {struct nft_set_elem_catchall *catchall;const struct nft_set *set = gc->set;
@@ -9250,7 +9251,11 @@ struct nft_trans_gc *nft_trans_gc_catchall(struct nft_trans_gc *gc,nft_set_elem_dead (ext); dead_elem: - gc =nft_trans_gc_queue_async (gc, gc_seq,GFP_ATOMIC ); +if (sync) + gc =nft_trans_gc_queue_sync (gc,GFP_ATOMIC ); +else + gc =nft_trans_gc_queue_async (gc, gc_seq,GFP_ATOMIC ); +if (!gc)return NULL ;
@@ -9260,6 +9265,17 @@ struct nft_trans_gc *nft_trans_gc_catchall(struct nft_trans_gc *gc,return gc; } +struct nft_trans_gc *nft_trans_gc_catchall_async (struct nft_trans_gc *gc, +unsigned int gc_seq) +{ +return nft_trans_gc_catchall (gc, gc_seq, false); +} + +struct nft_trans_gc *nft_trans_gc_catchall_sync (struct nft_trans_gc *gc) +{ +return nft_trans_gc_catchall (gc,0 , true); +} +static void nf_tables_module_autoload_cleanup (struct net *net) {struct nftables_pernet *nft_net =nft_pernet (net);
net/netfilter/nft_set_hash.c +1 -1
@@ -372,7 +372,7 @@ static void nft_rhash_gc(struct work_struct *work)nft_trans_gc_elem_add (gc, he); } - gc =nft_trans_gc_catchall (gc, gc_seq); + gc =nft_trans_gc_catchall_async (gc, gc_seq); try_later:/* catchall list iteration requires rcu read side lock. */
net/netfilter/nft_set_pipapo.c +1 -1
@@ -1611,7 +1611,7 @@ static void pipapo_gc(const struct nft_set *_set, struct nft_pipapo_match *m) } } - gc =nft_trans_gc_catchall (gc,0 ); + gc =nft_trans_gc_catchall_sync (gc);if (gc) {nft_trans_gc_queue_sync_done (gc); priv->last_gc = jiffies;
net/netfilter/nft_set_rbtree.c +1 -1
@@ -669,7 +669,7 @@ static void nft_rbtree_gc(struct work_struct *work)nft_trans_gc_elem_add (gc, rbe); } - gc =nft_trans_gc_catchall (gc, gc_seq); + gc =nft_trans_gc_catchall_async (gc, gc_seq); try_later:read_unlock_bh (&priv->lock);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 34/259 netfilter: nft_set_pipapo: stop GC iteration if GC transaction allocation fails
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit 6d365eabce3c018a80f6e0379b17df2abb17405e upstream.
nft_trans_gc_queue_sync() enqueues the GC transaction and it allocates a new one. If this allocation fails, then stop this GC sync run and retry later.
--- net/netfilter/nft_set_pipapo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nft_set_pipapo.c +1 -1
@@ -1597,7 +1597,7 @@ static void pipapo_gc(const struct nft_set *_set, struct nft_pipapo_match *m) gc =nft_trans_gc_queue_sync (gc,GFP_ATOMIC );if (!gc) -break ; +return ;nft_pipapo_gc_deactivate (net, set, e);pipapo_drop (m, rulemap);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 35/259 netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit b079155faae94e9b3ab9337e82100a914ebb4e8d upstream.
Skip GC run if iterator rewinds to the beginning with EAGAIN, otherwise GC might collect the same element more than once.
--- net/netfilter/nft_set_hash.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
net/netfilter/nft_set_hash.c +3 -6
@@ -338,12 +338,9 @@ static void nft_rhash_gc(struct work_struct *work)while ((he =rhashtable_walk_next (&hti))) {if (IS_ERR (he)) { -if (PTR_ERR (he) != -EAGAIN ) { -nft_trans_gc_destroy (gc); - gc =NULL ; - goto try_later; - } -continue ; +nft_trans_gc_destroy (gc); + gc =NULL ; + goto try_later; }/* Ruleset has been updated, try later. */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 36/259 netfilter: nf_tables: fix memleak when more than 255 elements expired
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
commit cf5000a7787cbc10341091d37245a42c119d26c5 upstream.
When more than 255 elements expired we're supposed to switch to a new gc container structure.
This never happens: u8 type will wrap before reaching the boundary and nft_trans_gc_space() always returns true.
This means we recycle the initial gc container structure and lose track of the elements that came before.
While at it, don't deref 'gc' after we've passed it to call_rcu.
--- include/net/netfilter/nf_tables.h | 2 +- net/netfilter/nf_tables_api.c | 10 ++++++++-- 2 files changed, 9 insertions(+), 3 deletions(-)
include/net/netfilter/nf_tables.h +1 -1
@@ -1657,7 +1657,7 @@ struct nft_trans_gc {struct net *net;struct nft_set *set;u32 seq; -u8 count; +u16 count;void *priv[NFT_TRANS_GC_BATCHCOUNT ];struct rcu_head rcu; };
net/netfilter/nf_tables_api.c +8 -2
@@ -9190,12 +9190,15 @@ static int nft_trans_gc_space(struct nft_trans_gc *trans)struct nft_trans_gc *nft_trans_gc_queue_async (struct nft_trans_gc *gc,unsigned int gc_seq,gfp_t gfp) { +struct nft_set *set; +if (nft_trans_gc_space (gc))return gc; + set = gc->set;nft_trans_gc_queue_work (gc); -return nft_trans_gc_alloc (gc->set, gc_seq, gfp); +return nft_trans_gc_alloc (set, gc_seq, gfp); }void nft_trans_gc_queue_async_done (struct nft_trans_gc *trans)
@@ -9210,15 +9213,18 @@ void nft_trans_gc_queue_async_done(struct nft_trans_gc *trans)struct nft_trans_gc *nft_trans_gc_queue_sync (struct nft_trans_gc *gc,gfp_t gfp) { +struct nft_set *set; +if (WARN_ON_ONCE (!lockdep_commit_lock_is_held (gc->net)))return NULL ;if (nft_trans_gc_space (gc))return gc; + set = gc->set;call_rcu (&gc->rcu, nft_trans_gc_trans_free); -return nft_trans_gc_alloc (gc->set,0 , gfp); +return nft_trans_gc_alloc (set,0 , gfp); }void nft_trans_gc_queue_sync_done (struct nft_trans_gc *trans)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 37/259 ASoC: meson: spdifin: start hw on dai probe
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit aedf323b66b2b875137422ecb7d2525179759076 ]
For spdif input to report the locked rate correctly, even when no capture is running, the HW and reference clock must be started as soon as the dai is probed.
--- sound/soc/meson/axg-spdifin.c | 49 ++++++++++++----------------------- 1 file changed, 17 insertions(+), 32 deletions(-)
sound/soc/meson/axg-spdifin.c +17 -32
@@ -112,34 +112,6 @@ static int axg_spdifin_prepare(struct snd_pcm_substream *substream,return 0 ; } -static int axg_spdifin_startup (struct snd_pcm_substream *substream, -struct snd_soc_dai *dai) -{ -struct axg_spdifin *priv =snd_soc_dai_get_drvdata (dai); -int ret; - - ret =clk_prepare_enable (priv->refclk); -if (ret) { -dev_err (dai->dev, -"failed to enable spdifin reference clock\n" ); -return ret; - } - -regmap_update_bits (priv->map,SPDIFIN_CTRL0 ,SPDIFIN_CTRL0_EN , -SPDIFIN_CTRL0_EN ); - -return 0 ; -} - -static void axg_spdifin_shutdown (struct snd_pcm_substream *substream, -struct snd_soc_dai *dai) -{ -struct axg_spdifin *priv =snd_soc_dai_get_drvdata (dai); - -regmap_update_bits (priv->map,SPDIFIN_CTRL0 ,SPDIFIN_CTRL0_EN ,0 ); -clk_disable_unprepare (priv->refclk); -} - static void axg_spdifin_write_mode_param(struct regmap *map, int mode, unsigned int val, unsigned int num_per_reg,
@@ -251,25 +223,38 @@ static int axg_spdifin_dai_probe(struct snd_soc_dai *dai) ret =axg_spdifin_sample_mode_config (dai, priv);if (ret) {dev_err (dai->dev,"mode configuration failed\n" ); -clk_disable_unprepare (priv->pclk); -return ret; + goto pclk_err; } + ret =clk_prepare_enable (priv->refclk); +if (ret) { +dev_err (dai->dev, +"failed to enable spdifin reference clock\n" ); + goto pclk_err; + } + +regmap_update_bits (priv->map,SPDIFIN_CTRL0 ,SPDIFIN_CTRL0_EN , +SPDIFIN_CTRL0_EN ); +return 0 ; + +pclk_err: +clk_disable_unprepare (priv->pclk); +return ret; }static int axg_spdifin_dai_remove (struct snd_soc_dai *dai) {struct axg_spdifin *priv =snd_soc_dai_get_drvdata (dai); +regmap_update_bits (priv->map,SPDIFIN_CTRL0 ,SPDIFIN_CTRL0_EN ,0 ); +clk_disable_unprepare (priv->refclk);clk_disable_unprepare (priv->pclk);return 0 ; }static const struct snd_soc_dai_ops axg_spdifin_ops = { .prepare = axg_spdifin_prepare, - .startup = axg_spdifin_startup, - .shutdown = axg_spdifin_shutdown, }; static int axg_spdifin_iec958_info(struct snd_kcontrol *kcontrol,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 38/259 netfilter: nf_tables: disallow element removal on anonymous sets
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 23a3bfd4ba7acd36abf52b78605f61b21bdac216 ]
Anonymous sets need to be populated once at creation and then they are bound to rule since 938154b93be8 ("netfilter: nf_tables: reject unbound anonymous set before commit phase"), otherwise transaction reports EINVAL.
Userspace does not need to delete elements of anonymous sets that are not yet bound, reject this with EOPNOTSUPP.
Quoted 1 line
From flush command path, skip anonymous sets, they are expected to be
bound already. Otherwise, EINVAL is hit at the end of this transaction for unbound sets.
--- net/netfilter/nf_tables_api.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
net/netfilter/nf_tables_api.c +5 -4
@@ -1437,8 +1437,7 @@ static int nft_flush_table(struct nft_ctx *ctx)if (!nft_is_active_next (ctx->net, set))continue ; -if (nft_set_is_anonymous (set) && - !list_empty (&set->bindings)) +if (nft_set_is_anonymous (set))continue ; err =nft_delset (ctx, set);
@@ -6907,8 +6906,10 @@ static int nf_tables_delsetelem(struct sk_buff *skb,if (IS_ERR (set))return PTR_ERR (set); -if (!list_empty (&set->bindings) && - (set->flags & (NFT_SET_CONSTANT |NFT_SET_ANONYMOUS ))) +if (nft_set_is_anonymous (set)) +return -EOPNOTSUPP ; + +if (!list_empty (&set->bindings) && (set->flags &NFT_SET_CONSTANT ))return -EBUSY ;nft_ctx_init (&ctx, net, skb, info->nlh, family, table,NULL , nla);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 39/259 bpf: Avoid deadlock when using queue and stack maps from NMI
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 ]
Sysbot discovered that the queue and stack maps can deadlock if they are being used from a BPF program that can be called from NMI context (such as one that is attached to a perf HW counter event). To fix this, add an in_nmi() check and use raw_spin_trylock() in NMI context, erroring out if grabbing the lock fails.
--- kernel/bpf/queue_stack_maps.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
kernel/bpf/queue_stack_maps.c +18 -3
@@ -102,7 +102,12 @@ static int __queue_map_get(struct bpf_map *map, void *value, bool delete)int err =0 ;void *ptr; -raw_spin_lock_irqsave (&qs->lock, flags); +if (in_nmi ()) { +if (!raw_spin_trylock_irqsave (&qs->lock, flags)) +return -EBUSY ; + }else { +raw_spin_lock_irqsave (&qs->lock, flags); + }if (queue_stack_map_is_empty (qs)) {memset (value,0 , qs->map.value_size);
@@ -132,7 +137,12 @@ static int __stack_map_get(struct bpf_map *map, void *value, bool delete)void *ptr;u32 index; -raw_spin_lock_irqsave (&qs->lock, flags); +if (in_nmi ()) { +if (!raw_spin_trylock_irqsave (&qs->lock, flags)) +return -EBUSY ; + }else { +raw_spin_lock_irqsave (&qs->lock, flags); + }if (queue_stack_map_is_empty (qs)) {memset (value,0 , qs->map.value_size);
@@ -197,7 +207,12 @@ static int queue_stack_map_push_elem(struct bpf_map *map, void *value,if (flags &BPF_NOEXIST || flags >BPF_EXIST )return -EINVAL ; -raw_spin_lock_irqsave (&qs->lock, irq_flags); +if (in_nmi ()) { +if (!raw_spin_trylock_irqsave (&qs->lock, irq_flags)) +return -EBUSY ; + }else { +raw_spin_lock_irqsave (&qs->lock, irq_flags); + }if (queue_stack_map_is_full (qs)) {if (!replace) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 40/259 ASoC: rt5640: Revert "Fix sleep in atomic context"
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit fa6a0c0c1dd53b3949ca56bf7213648dfd6a62ee ]
Commit 70a6404ff610 ("ASoC: rt5640: Fix sleep in atomic context") not only switched from request_irq() to request_threaded_irq(), to fix the sleep in atomic context issue, but it also added devm management of the IRQ by actually switching to devm_request_threaded_irq() (without any explanation in the commit message for this change).
This is wrong since the IRQ was already explicitly managed by the driver. On unbind the ASoC core will call rt5640_set_jack(NULL) which in turn will call rt5640_disable_jack_detect() which frees the IRQ already. So now we have a double free.
Besides the unexplained switch to devm being wrong, the actual fix for the sleep in atomic context issue also is not the best solution.
The only thing which rt5640_irq() does is cancel + (re-)queue the jack_work delayed_work. This can be done in a single non sleeping call by replacing queue_delayed_work() with mod_delayed_work(), which does not sleep. Using mod_delayed_work() is a much better fix then adding a thread which does nothing other then queuing a work-item.
This patch is a straight revert of the troublesome changes, the switch to mod_delayed_work() is done in a separate follow-up patch.
--- sound/soc/codecs/rt5640.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
sound/soc/codecs/rt5640.c +5 -7
@@ -2562,10 +2562,9 @@ static void rt5640_enable_jack_detect(struct snd_soc_component *component,if (jack_data && jack_data->use_platform_clock) rt5640->use_platform_clock = jack_data->use_platform_clock; - ret =devm_request_threaded_irq (component->dev, rt5640->irq, -NULL , rt5640_irq, -IRQF_TRIGGER_RISING |IRQF_TRIGGER_FALLING |IRQF_ONESHOT , -"rt5640" , rt5640); + ret =request_irq (rt5640->irq, rt5640_irq, +IRQF_TRIGGER_RISING |IRQF_TRIGGER_FALLING |IRQF_ONESHOT , +"rt5640" , rt5640);if (ret) {dev_warn (component->dev,"Failed to reguest IRQ %d: %d\n" , rt5640->irq, ret);rt5640_disable_jack_detect (component);
@@ -2618,9 +2617,8 @@ static void rt5640_enable_hda_jack_detect( rt5640->jack = jack; - ret =devm_request_threaded_irq (component->dev, rt5640->irq, -NULL , rt5640_irq,IRQF_TRIGGER_RISING |IRQF_ONESHOT , -"rt5640" , rt5640); + ret =request_irq (rt5640->irq, rt5640_irq, +IRQF_TRIGGER_RISING |IRQF_ONESHOT ,"rt5640" , rt5640);if (ret) {dev_warn (component->dev,"Failed to reguest IRQ %d: %d\n" , rt5640->irq, ret); rt5640->irq = -ENXIO ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 41/259 ASoC: rt5640: Fix IRQ not being free-ed for HDA jack detect mode
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 8c8bf3df6b7c0ed1c4dd373b23eb0ce13a63f452 ]
Set "rt5640->irq_requested = true" after a successful request_irq() in rt5640_enable_hda_jack_detect(), so that rt5640_disable_jack_detect() properly frees the IRQ.
This fixes the IRQ not being freed on rmmod / driver unbind.
--- sound/soc/codecs/rt5640.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/codecs/rt5640.c +1 -0
@@ -2624,6 +2624,7 @@ static void rt5640_enable_hda_jack_detect( rt5640->irq = -ENXIO ;return ; } + rt5640->irq_requested = true;/* sync initial jack state */ queue_delayed_work (system_long_wq, &rt5640->jack_work,0 );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 42/259 ALSA: hda/realtek: Splitting the UX3402 into two separate models
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Knyazev Arseniy <[email protected]>
[ Upstream commit 07058dceb038a4b0dd49af07118b6b2a685bb4a6 ]
UX3402VA and UX3402ZA models require different hex values, so comibining them into one model is incorrect.
--- sound/pci/hda/patch_realtek.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/pci/hda/patch_realtek.c +2 -1
@@ -9657,7 +9657,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1043 ,0x1d1f ,"ASUS ROG Strix G17 2023 (G713PV)" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x1043 ,0x1d42 ,"ASUS Zephyrus G14 2022" ,ALC289_FIXUP_ASUS_GA401 ),SND_PCI_QUIRK (0x1043 ,0x1d4e ,"ASUS TM420" ,ALC256_FIXUP_ASUS_HPE ), -SND_PCI_QUIRK (0x1043 ,0x1e02 ,"ASUS UX3402" ,ALC245_FIXUP_CS35L41_SPI_2 ), +SND_PCI_QUIRK (0x1043 ,0x1e02 ,"ASUS UX3402ZA" ,ALC245_FIXUP_CS35L41_SPI_2 ), +SND_PCI_QUIRK (0x1043 ,0x16a3 ,"ASUS UX3402VA" ,ALC245_FIXUP_CS35L41_SPI_2 ),SND_PCI_QUIRK (0x1043 ,0x1e11 ,"ASUS Zephyrus G15" ,ALC289_FIXUP_ASUS_GA502 ),SND_PCI_QUIRK (0x1043 ,0x1e12 ,"ASUS UM3402" ,ALC287_FIXUP_CS35L41_I2C_2 ), SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU502_PINS),
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 43/259 netfilter: conntrack: fix extension size table
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 4908d5af16676b9d2901830551c2af911e452524 ]
The size table is incorrect due to copypaste error, this reserves more size than needed.
TSTAMP reserved 32 instead of 16 bytes.
TIMEOUT reserved 16 instead of 8 bytes.
--- net/netfilter/nf_conntrack_extend.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/netfilter/nf_conntrack_extend.c +2 -2
@@ -40,10 +40,10 @@ static const u8 nf_ct_ext_type_len[NF_CT_EXT_NUM] = { [NF_CT_EXT_ECACHE] = sizeof(struct nf_conntrack_ecache), #endif #ifdef CONFIG_NF_CONNTRACK_TIMESTAMP - [NF_CT_EXT_TSTAMP ] =sizeof (struct nf_conn_acct ), + [NF_CT_EXT_TSTAMP ] =sizeof (struct nf_conn_tstamp ), #endif #ifdef CONFIG_NF_CONNTRACK_TIMEOUT - [NF_CT_EXT_TIMEOUT ] =sizeof (struct nf_conn_tstamp ), + [NF_CT_EXT_TIMEOUT ] =sizeof (struct nf_conn_timeout ), #endif #ifdef CONFIG_NF_CONNTRACK_LABELS [NF_CT_EXT_LABELS] = sizeof(struct nf_conn_labels),
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 44/259 selftests: tls: swap the TX and RX sockets in some tests
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit c326ca98446e0ae4fee43a40acf79412b74cfedb ]
tls.sendmsg_large and tls.sendmsg_multiple are trying to send through the self->cfd socket (only configured with TLS_RX) and to receive through the self->fd socket (only configured with TLS_TX), so they're not using kTLS at all. Swap the sockets.
--- tools/testing/selftests/net/tls.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
tools/testing/selftests/net/tls.c +4 -4
@@ -551,11 +551,11 @@ TEST_F(tls, sendmsg_large) msg.msg_iov = &vec; msg.msg_iovlen =1 ; -EXPECT_EQ (sendmsg (self->cfd, &msg,0 ), send_len); +EXPECT_EQ (sendmsg (self->fd, &msg,0 ), send_len); }while (recvs++ < sends) { -EXPECT_NE (recv (self->fd, mem, send_len,0 ),-1 ); +EXPECT_NE (recv (self->cfd, mem, send_len,0 ),-1 ); }free (mem);
@@ -584,9 +584,9 @@ TEST_F(tls, sendmsg_multiple) msg.msg_iov = vec; msg.msg_iovlen = iov_len; -EXPECT_EQ (sendmsg (self->cfd, &msg,0 ), total_len); +EXPECT_EQ (sendmsg (self->fd, &msg,0 ), total_len); buf =malloc (total_len); -EXPECT_NE (recv (self->fd, buf, total_len,0 ),-1 ); +EXPECT_NE (recv (self->cfd, buf, total_len,0 ),-1 );for (i =0 ; i < iov_len; i++) { EXPECT_EQ(memcmp(test_strs[i], buf + len_cmp, strlen(test_strs[i])),
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 45/259 net/core: Fix ETH_P_1588 flow dissector
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sasha Neftin <[email protected]>
[ Upstream commit 75ad80ed88a182ab2ad5513e448cf07b403af5c3 ]
When a PTP ethernet raw frame with a size of more than 256 bytes followed by a 0xff pattern is sent to __skb_flow_dissect, nhoff value calculation is wrong. For example: hdr->message_length takes the wrong value (0xffff) and it does not replicate real header length. In this case, 'nhoff' value was overridden and the PTP header was badly dissected. This leads to a kernel crash.
net/core: flow_dissector
net/core flow dissector nhoff = 0x0000000e net/core flow dissector hdr->message_length = 0x0000ffff net/core flow dissector nhoff = 0x0001000d (u16 overflow)
...
skb linear: 00000000: 00 a0 c9 00 00 00 00 a0 c9 00 00 00 88 skb frag: 00000000: f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
Using the size of the ptp_header struct will allow the corrected calculation of the nhoff value.
net/core flow dissector nhoff = 0x0000000e
net/core flow dissector nhoff = 0x00000030 (sizeof ptp_header)
...
skb linear: 00000000: 00 a0 c9 00 00 00 00 a0 c9 00 00 00 88 f7 ff ff skb linear: 00000010: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff skb linear: 00000020: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff skb frag: 00000000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
Kernel trace:
[ 74.984279] ------------[ cut here ]------------ [ 74.989471] kernel BUG at include/linux/skbuff.h:2440! [ 74.995237] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 75.001098] CPU: 4 PID: 0 Comm: swapper/4 Tainted: G U 5.15.85-intel-ese-standard-lts #1 [ 75.011629] Hardware name: Intel Corporation A-Island (CPU:AlderLake)/A-Island (ID:06), BIOS SB_ADLP.01.01.00.01.03.008.D-6A9D9E73-dirty Mar 30 2023 [ 75.026507] RIP: 0010:eth_type_trans+0xd0/0x130 [ 75.031594] Code: 03 88 47 78 eb c7 8b 47 68 2b 47 6c 48 8b 97 c0 00 00 00 83 f8 01 7e 1b 48 85 d2 74 06 66 83 3a ff 74 09 b8 00 04 00 00 eb ab <0f> 0b b8 00 01 00 00 eb a2 48 85 ff 74 eb 48 8d 54 24 06 31 f6 b9 [ 75.052612] RSP: 0018:ffff9948c0228de0 EFLAGS: 00010297 [ 75.058473] RAX: 00000000000003f2 RBX: ffff8e47047dc300 RCX: 0000000000001003 [ 75.066462] RDX: ffff8e4e8c9ea040 RSI: ffff8e4704e0a000 RDI: ffff8e47047dc300 [ 75.074458] RBP: ffff8e4704e2acc0 R08: 00000000000003f3 R09: 0000000000000800 [ 75.082466] R10: 000000000000000d R11: ffff9948c0228dec R12: ffff8e4715e4e010 [ 75.090461] R13: ffff9948c0545018 R14: 0000000000000001 R15: 0000000000000800 [ 75.098464] FS: 0000000000000000(0000) GS:ffff8e4e8fb00000(0000) knlGS:0000000000000000 [ 75.107530] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 75.113982] CR2: 00007f5eb35934a0 CR3: 0000000150e0a002 CR4: 0000000000770ee0 [ 75.121980] PKRU: 55555554 [ 75.125035] Call Trace: [ 75.127792] <IRQ> [ 75.130063] ? eth_get_headlen+0xa4/0xc0 [ 75.134472] igc_process_skb_fields+0xcd/0x150 [ 75.139461] igc_poll+0xc80/0x17b0 [ 75.143272] __napi_poll+0x27/0x170 [ 75.147192] net_rx_action+0x234/0x280 [ 75.151409] __do_softirq+0xef/0x2f4 [ 75.155424] irq_exit_rcu+0xc7/0x110 [ 75.159432] common_interrupt+0xb8/0xd0 [ 75.163748] </IRQ> [ 75.166112] <TASK> [ 75.168473] asm_common_interrupt+0x22/0x40 [ 75.173175] RIP: 0010:cpuidle_enter_state+0xe2/0x350 [ 75.178749] Code: 85 c0 0f 8f 04 02 00 00 31 ff e8 39 6c 67 ff 45 84 ff 74 12 9c 58 f6 c4 02 0f 85 50 02 00 00 31 ff e8 52 b0 6d ff fb 45 85 f6 <0f> 88 b1 00 00 00 49 63 ce 4c 2b 2c 24 48 89 c8 48 6b d1 68 48 c1 [ 75.199757] RSP: 0018:ffff9948c013bea8 EFLAGS: 00000202 [ 75.205614] RAX: ffff8e4e8fb00000 RBX: ffffb948bfd23900 RCX: 000000000000001f [ 75.213619] RDX: 0000000000000004 RSI: ffffffff94206161 RDI: ffffffff94212e20 [ 75.221620] RBP: 0000000000000004 R08: 000000117568973a R09: 0000000000000001 [ 75.229622] R10: 000000000000afc8 R11: ffff8e4e8fb29ce4 R12: ffffffff945ae980 [ 75.237628] R13: 000000117568973a R14: 0000000000000004 R15: 0000000000000000 [ 75.245635] ? cpuidle_enter_state+0xc7/0x350 [ 75.250518] cpuidle_enter+0x29/0x40 [ 75.254539] do_idle+0x1d9/0x260 [ 75.258166] cpu_startup_entry+0x19/0x20 [ 75.262582] secondary_startup_64_no_verify+0xc2/0xcb [ 75.268259] </TASK> [ 75.270721] Modules linked in: 8021q snd_sof_pci_intel_tgl snd_sof_intel_hda_common tpm_crb snd_soc_hdac_hda snd_sof_intel_hda snd_hda_ext_core snd_sof_pci snd_sof snd_sof_xtensa_dsp snd_soc_acpi_intel_match snd_soc_acpi snd_soc_core snd_compress iTCO_wdt ac97_bus intel_pmc_bxt mei_hdcp iTCO_vendor_support snd_hda_codec_hdmi pmt_telemetry intel_pmc_core pmt_class snd_hda_intel x86_pkg_temp_thermal snd_intel_dspcfg snd_hda_codec snd_hda_core kvm_intel snd_pcm snd_timer kvm snd mei_me soundcore tpm_tis irqbypass i2c_i801 mei tpm_tis_core pcspkr intel_rapl_msr tpm i2c_smbus intel_pmt thermal sch_fq_codel uio uhid i915 drm_buddy video drm_display_helper drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm fuse configfs [ 75.342736] ---[ end trace 3785f9f360400e3a ]--- [ 75.347913] RIP: 0010:eth_type_trans+0xd0/0x130 [ 75.352984] Code: 03 88 47 78 eb c7 8b 47 68 2b 47 6c 48 8b 97 c0 00 00 00 83 f8 01 7e 1b 48 85 d2 74 06 66 83 3a ff 74 09 b8 00 04 00 00 eb ab <0f> 0b b8 00 01 00 00 eb a2 48 85 ff 74 eb 48 8d 54 24 06 31 f6 b9 [ 75.373994] RSP: 0018:ffff9948c0228de0 EFLAGS: 00010297 [ 75.379860] RAX: 00000000000003f2 RBX: ffff8e47047dc300 RCX: 0000000000001003 [ 75.387856] RDX: ffff8e4e8c9ea040 RSI: ffff8e4704e0a000 RDI: ffff8e47047dc300 [ 75.395864] RBP: ffff8e4704e2acc0 R08: 00000000000003f3 R09: 0000000000000800 [ 75.403857] R10: 000000000000000d R11: ffff9948c0228dec R12: ffff8e4715e4e010 [ 75.411863] R13: ffff9948c0545018 R14: 0000000000000001 R15: 0000000000000800 [ 75.419875] FS: 0000000000000000(0000) GS:ffff8e4e8fb00000(0000) knlGS:0000000000000000 [ 75.428946] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 75.435403] CR2: 00007f5eb35934a0 CR3: 0000000150e0a002 CR4: 0000000000770ee0 [ 75.443410] PKRU: 55555554 [ 75.446477] Kernel panic - not syncing: Fatal exception in interrupt [ 75.453738] Kernel Offset: 0x11c00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 75.465794] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
--- net/core/flow_dissector.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/core/flow_dissector.c +1 -1
@@ -1366,7 +1366,7 @@ bool __skb_flow_dissect(const struct net *net,break ; } - nhoff +=ntohs (hdr->message_length); + nhoff +=sizeof (struct ptp_header ); fdret =FLOW_DISSECT_RET_OUT_GOOD ;break ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 46/259 ASoC: hdaudio.c: Add missing check for devm_kstrdup
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit c04efbfd76d23157e64e6d6147518c187ab4233a ]
Because of the potential failure of the devm_kstrdup(), the dl[i].codecs->name could be NULL.
Therefore, we need to check it and return -ENOMEM in order to transfer the error.
--- sound/soc/intel/avs/boards/hdaudio.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/intel/avs/boards/hdaudio.c +3 -0
@@ -54,6 +54,9 @@ static int avs_create_dai_links(struct device *dev, struct hda_codec *codec, intreturn -ENOMEM ; dl[i].codecs->name =devm_kstrdup (dev, cname,GFP_KERNEL ); +if (!dl[i].codecs->name) +return -ENOMEM ; + dl[i].codecs->dai_name = pcm->name; dl[i].num_codecs =1 ; dl[i].num_cpus =1 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 47/259 ASoC: imx-audmix: Fix return error with devm_clk_get()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <[email protected]>
[ Upstream commit b19a5733de255cabba5feecabf6e900638b582d1 ]
The devm_clk_get() can return -EPROBE_DEFER error, modify the error code to be -EINVAL is not correct, which cause the -EPROBE_DEFER error is not correctly handled.
This patch is to fix the return error code.
--- sound/soc/fsl/imx-audmix.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/fsl/imx-audmix.c +1 -1
@@ -320,7 +320,7 @@ static int imx_audmix_probe(struct platform_device *pdev)if (IS_ERR (priv->cpu_mclk)) { ret =PTR_ERR (priv->cpu_mclk);dev_err (&cpu_pdev->dev,"failed to get DAI mclk1: %d\n" , ret); -return -EINVAL ; +return ret; } priv->audmix_pdev = audmix_pdev;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 48/259 octeon_ep: fix tx dma unmap len values in SG
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shinas Rasheed <[email protected]>
[ Upstream commit 350db8a59eb392bf42e62b6b2a37d56b5833012b ]
Lengths of SG pointers are kept in the following order in the SG entries in hardware.
63 48|47 32|31 16|15 0
-----------------------------------------
| Len 0 | Len 1 | Len 2 | Len 3 |
-----------------------------------------
| Ptr 0 |
-----------------------------------------
| Ptr 1 |
-----------------------------------------
| Ptr 2 |
-----------------------------------------
| Ptr 3 |
-----------------------------------------
Dma pointers have to be unmapped based on their respective lengths given in this format.
--- .../net/ethernet/marvell/octeon_ep/octep_main.c | 8 ++++---- .../net/ethernet/marvell/octeon_ep/octep_tx.c | 8 ++++---- .../net/ethernet/marvell/octeon_ep/octep_tx.h | 16 +++++++++++++++- 3 files changed, 23 insertions(+), 9 deletions(-)
drivers/net/ethernet/marvell/octeon_ep/octep_main.c +4 -4
@@ -726,13 +726,13 @@ static netdev_tx_t octep_start_xmit(struct sk_buff *skb, dma_map_sg_err:if (si >0 ) {dma_unmap_single (iq->dev, sglist[0 ].dma_ptr[0 ], - sglist[0 ].len[0 ],DMA_TO_DEVICE ); - sglist[0 ].len[0 ] =0 ; + sglist[0 ].len[3 ],DMA_TO_DEVICE ); + sglist[0 ].len[3 ] =0 ; }while (si >1 ) {dma_unmap_page (iq->dev, sglist[si >>2 ].dma_ptr[si &3 ], - sglist[si >>2 ].len[si &3 ],DMA_TO_DEVICE ); - sglist[si >>2 ].len[si &3 ] =0 ; + sglist[si >>2 ].len[3 - (si &3 )],DMA_TO_DEVICE ); + sglist[si >>2 ].len[3 - (si &3 )] =0 ; si--; } tx_buffer->gather =0 ;
drivers/net/ethernet/marvell/octeon_ep/octep_tx.c +4 -4
@@ -69,12 +69,12 @@ int octep_iq_process_completions(struct octep_iq *iq, u16 budget) compl_sg++;dma_unmap_single (iq->dev, tx_buffer->sglist[0 ].dma_ptr[0 ], - tx_buffer->sglist[0 ].len[0 ],DMA_TO_DEVICE ); + tx_buffer->sglist[0 ].len[3 ],DMA_TO_DEVICE ); i =1 ;/* entry 0 is main skb, unmapped above */ while (frags--) {dma_unmap_page (iq->dev, tx_buffer->sglist[i >>2 ].dma_ptr[i &3 ], - tx_buffer->sglist[i >>2 ].len[i &3 ],DMA_TO_DEVICE ); + tx_buffer->sglist[i >>2 ].len[3 - (i &3 )],DMA_TO_DEVICE ); i++; }
@@ -131,13 +131,13 @@ static void octep_iq_free_pending(struct octep_iq *iq)dma_unmap_single (iq->dev, tx_buffer->sglist[0 ].dma_ptr[0 ], - tx_buffer->sglist[0 ].len[0 ], + tx_buffer->sglist[0 ].len[3 ],DMA_TO_DEVICE ); i =1 ;/* entry 0 is main skb, unmapped above */ while (frags--) {dma_unmap_page (iq->dev, tx_buffer->sglist[i >>2 ].dma_ptr[i &3 ], - tx_buffer->sglist[i >>2 ].len[i &3 ],DMA_TO_DEVICE ); + tx_buffer->sglist[i >>2 ].len[3 - (i &3 )],DMA_TO_DEVICE ); i++; }
drivers/net/ethernet/marvell/octeon_ep/octep_tx.h +15 -1
@@ -17,7 +17,21 @@#define TX_BUFTYPE_NET_SG 2#define NUM_TX_BUFTYPES 3 -/* Hardware format for Scatter/Gather list */ +/* Hardware format for Scatter/Gather list +* +* 63 48|47 32|31 16|15 0 +* ----------------------------------------- +* | Len 0 | Len 1 | Len 2 | Len 3 | +* ----------------------------------------- +* | Ptr 0 | +* ----------------------------------------- +* | Ptr 1 | +* ----------------------------------------- +* | Ptr 2 | +* ----------------------------------------- +* | Ptr 3 | +* ----------------------------------------- +*/ struct octep_tx_sglist_desc {u16 len[4 ];dma_addr_t dma_ptr[4 ];
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 49/259 iavf: do not process adminq tasks when __IAVF_IN_REMOVE_TASK is set
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Radoslaw Tyl <[email protected]>
[ Upstream commit c8de44b577eb540e8bfea55afe1d0904bb571b7a ]
Prevent schedule operations for adminq during device remove and when __IAVF_IN_REMOVE_TASK flag is set. Currently, the iavf_down function adds operations for adminq that shouldn't be processed when the device is in the __IAVF_REMOVE state.
Reproduction:
echo 4 > /sys/bus/pci/devices/0000:17:00.0/sriov_numvfs ip link set dev ens1f0 vf 0 trust on
ip link set dev ens1f0 vf 1 trust on
ip link set dev ens1f0 vf 2 trust on
ip link set dev ens1f0 vf 3 trust on
ip link set dev ens1f0 vf 0 mac 00:22:33:44:55:66
ip link set dev ens1f0 vf 1 mac 00:22:33:44:55:67
ip link set dev ens1f0 vf 2 mac 00:22:33:44:55:68
ip link set dev ens1f0 vf 3 mac 00:22:33:44:55:69
echo 0000:17:02.0 > /sys/bus/pci/devices/0000\:17\:02.0/driver/unbind echo 0000:17:02.1 > /sys/bus/pci/devices/0000\:17\:02.1/driver/unbind echo 0000:17:02.2 > /sys/bus/pci/devices/0000\:17\:02.2/driver/unbind echo 0000:17:02.3 > /sys/bus/pci/devices/0000\:17\:02.3/driver/unbind sleep 10
echo 0000:17:02.0 > /sys/bus/pci/drivers/iavf/bind
echo 0000:17:02.1 > /sys/bus/pci/drivers/iavf/bind
echo 0000:17:02.2 > /sys/bus/pci/drivers/iavf/bind
echo 0000:17:02.3 > /sys/bus/pci/drivers/iavf/bind
modprobe vfio-pci
echo 8086 154c > /sys/bus/pci/drivers/vfio-pci/new_id
qemu-system-x86_64 -accel kvm -m 4096 -cpu host \
-drive file=centos9.qcow2,if=none,id=virtio-disk0 \
-device virtio-blk-pci,drive=virtio-disk0,bootindex=0 -smp 4 \
-device vfio-pci,host=17:02.0 -net none \
-device vfio-pci,host=17:02.1 -net none \
-device vfio-pci,host=17:02.2 -net none \
-device vfio-pci,host=17:02.3 -net none \
-daemonize -vnc :5
Current result:
There is a probability that the mac of VF in guest is inconsistent with it in host
Expected result:
When passthrough NIC VF to guest, the VF in guest should always get the same mac as it in host.
--- drivers/net/ethernet/intel/iavf/iavf_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/iavf/iavf_main.c +2 -1
@@ -1433,7 +1433,8 @@ void iavf_down(struct iavf_adapter *adapter)iavf_clear_fdir_filters (adapter);iavf_clear_adv_rss_conf (adapter); -if (!(adapter->flags &IAVF_FLAG_PF_COMMS_FAILED )) { +if (!(adapter->flags &IAVF_FLAG_PF_COMMS_FAILED ) && + !(test_bit (__IAVF_IN_REMOVE_TASK, &adapter->crit_section))) {/* cancel any current operation */ adapter->current_op =VIRTCHNL_OP_UNKNOWN ;/* Schedule operations to close down the HW. Don't wait
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 50/259 ASoC: SOF: core: Only call sof_ops_free() on remove if the probe was successful
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
[ Upstream commit 31bb7bd9ffee50d09ec931998b823a86132ab807 ]
All the fail paths during probe will free up the ops, on remove we should only free it if the probe was successful.
--- sound/soc/sof/core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
sound/soc/sof/core.c +1 -2
@@ -461,10 +461,9 @@ int snd_sof_device_remove(struct device *dev)snd_sof_ipc_free (sdev);snd_sof_free_debug (sdev);snd_sof_remove (sdev); +sof_ops_free (sdev); } -sof_ops_free (sdev); -/* release firmware */ snd_sof_fw_unload (sdev);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 51/259 iavf: add iavf_schedule_aq_request() helper
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Oros <[email protected]>
[ Upstream commit ed4cad33df9e272feaa6698b33359b29c2929564 ]
Add helper for set iavf aq request AVF_FLAG_AQ_* and immediately schedule watchdog_task. Helper will be used in cases where it is necessary to run aq requests asap
Stable-dep-of: 5f3d319a2486 ("iavf: schedule a request immediately after add/delete vlan")
--- drivers/net/ethernet/intel/iavf/iavf.h | 2 +- drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 2 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 10 ++++------ 3 files changed, 6 insertions(+), 8 deletions(-)
drivers/net/ethernet/intel/iavf/iavf.h +1 -1
@@ -521,7 +521,7 @@ void iavf_down(struct iavf_adapter *adapter);int iavf_process_config (struct iavf_adapter *adapter);int iavf_parse_vf_resource_msg (struct iavf_adapter *adapter);void iavf_schedule_reset (struct iavf_adapter *adapter,u64 flags); -void iavf_schedule_request_stats (struct iavf_adapter *adapter); +void iavf_schedule_aq_request (struct iavf_adapter *adapter,u64 flags);void iavf_schedule_finish_config (struct iavf_adapter *adapter);void iavf_reset (struct iavf_adapter *adapter);void iavf_set_ethtool_ops (struct net_device *netdev);
drivers/net/ethernet/intel/iavf/iavf_ethtool.c +1 -1
@@ -362,7 +362,7 @@ static void iavf_get_ethtool_stats(struct net_device *netdev,unsigned int i;/* Explicitly request stats refresh */ -iavf_schedule_request_stats (adapter); +iavf_schedule_aq_request (adapter,IAVF_FLAG_AQ_REQUEST_STATS );iavf_add_ethtool_stats (&data, adapter, iavf_gstrings_stats);
drivers/net/ethernet/intel/iavf/iavf_main.c +4 -6
@@ -322,15 +322,13 @@ void iavf_schedule_reset(struct iavf_adapter *adapter, u64 flags) }/** -* iavf_schedule_request_stats - Set the flags and schedule statistics request +* iavf_schedule_aq_request - Set the flags and schedule aq request * @adapter: board private structure -* -* Sets IAVF_FLAG_AQ_REQUEST_STATS flag so iavf_watchdog_task() will explicitly -* request and refresh ethtool stats +* @flags: requested aq flags **/ -void iavf_schedule_request_stats (struct iavf_adapter *adapter) +void iavf_schedule_aq_request (struct iavf_adapter *adapter,u64 flags) { - adapter->aq_required |=IAVF_FLAG_AQ_REQUEST_STATS ; + adapter->aq_required |= flags;mod_delayed_work (adapter->wq, &adapter->watchdog_task,0 ); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 52/259 iavf: schedule a request immediately after add/delete vlan
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Oros <[email protected]>
[ Upstream commit 5f3d319a248654a805bafc9e7094bcea47dac6c7 ]
When the iavf driver wants to reconfigure the VLAN filters (iavf_add_vlan, iavf_del_vlan), it sets a flag in aq_required:
adapter->aq_required |= IAVF_FLAG_AQ_ADD_VLAN_FILTER;
or:
adapter->aq_required |= IAVF_FLAG_AQ_DEL_VLAN_FILTER;
This is later processed by the watchdog_task, but it runs periodically every 2 seconds, so it can be a long time before it processes the request.
In the worst case, the interface is unable to receive traffic for more than 2 seconds for no objective reason.
--- drivers/net/ethernet/intel/iavf/iavf_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/iavf/iavf_main.c +2 -2
@@ -829,7 +829,7 @@ iavf_vlan_filter *iavf_add_vlan(struct iavf_adapter *adapter,list_add_tail (&f->list, &adapter->vlan_filter_list); f->state =IAVF_VLAN_ADD ; adapter->num_vlan_filters++; - adapter->aq_required |=IAVF_FLAG_AQ_ADD_VLAN_FILTER ; +iavf_schedule_aq_request (adapter,IAVF_FLAG_AQ_ADD_VLAN_FILTER ); } clearout:
@@ -851,7 +851,7 @@ static void iavf_del_vlan(struct iavf_adapter *adapter, struct iavf_vlan vlan) f =iavf_find_vlan (adapter, vlan);if (f) { f->state =IAVF_VLAN_REMOVE ; - adapter->aq_required |=IAVF_FLAG_AQ_DEL_VLAN_FILTER ; +iavf_schedule_aq_request (adapter,IAVF_FLAG_AQ_DEL_VLAN_FILTER ); }spin_unlock_bh (&adapter->mac_vlan_list_lock);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 53/259 i40e: Fix VF VLAN offloading when port VLAN is configured
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Vecera <[email protected]>
[ Upstream commit d0d362ffa33da4acdcf7aee2116ceef8c8fef658 ]
If port VLAN is configured on a VF then any other VLANs on top of this VF are broken.
During i40e_ndo_set_vf_port_vlan() call the i40e driver reset the VF and iavf driver asks PF (using VIRTCHNL_OP_GET_VF_RESOURCES) for VF capabilities but this reset occurs too early, prior setting of vf->info.pvid field and because this field can be zero during i40e_vc_get_vf_resources_msg() then VIRTCHNL_VF_OFFLOAD_VLAN capability is reported to iavf driver.
This is wrong because iavf driver should not report VLAN offloading capability when port VLAN is configured as i40e does not support QinQ offloading.
Fix the issue by moving VF reset after setting of vf->port_vlan_id field.
Without this patch:
$ echo 1 > /sys/class/net/enp2s0f0/device/sriov_numvfs $ ip link set enp2s0f0 vf 0 vlan 3 $ ip link set enp2s0f0v0 up $ ip link add link enp2s0f0v0 name vlan4 type vlan id 4 $ ip link set vlan4 up ... $ ethtool -k enp2s0f0v0 | grep vlan-offload rx-vlan-offload: on tx-vlan-offload: on $ dmesg -l err | grep iavf [1292500.742914] iavf 0000:02:02.0: Failed to add VLAN filter, error IAVF_ERR_INVALID_QP_ID
With this patch:
$ echo 1 > /sys/class/net/enp2s0f0/device/sriov_numvfs $ ip link set enp2s0f0 vf 0 vlan 3 $ ip link set enp2s0f0v0 up $ ip link add link enp2s0f0v0 name vlan4 type vlan id 4 $ ip link set vlan4 up ... $ ethtool -k enp2s0f0v0 | grep vlan-offload rx-vlan-offload: off [requested on] tx-vlan-offload: off [requested on] $ dmesg -l err | grep iavf
--- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +5 -3
@@ -4397,9 +4397,7 @@ int i40e_ndo_set_vf_port_vlan(struct net_device *netdev, int vf_id, goto error_pvid;i40e_vlan_stripping_enable (vsi); -i40e_vc_reset_vf (vf, true); -/* During reset the VF got a new VSI, so refresh a pointer. */ - vsi = pf->vsi[vf->lan_vsi_idx]; +/* Locked once because multiple functions below iterate list */ spin_lock_bh (&vsi->mac_filter_hash_lock);
@@ -4485,6 +4483,10 @@ int i40e_ndo_set_vf_port_vlan(struct net_device *netdev, int vf_id,*/ vf->port_vlan_id =le16_to_cpu (vsi->info.pvid); +i40e_vc_reset_vf (vf, true); +/* During reset the VF got a new VSI, so refresh a pointer. */ + vsi = pf->vsi[vf->lan_vsi_idx]; + ret =i40e_config_vf_promiscuous_mode (vf, vsi->id, allmulti, alluni);if (ret) {dev_err (&pf->pdev->dev,"Unable to config vf promiscuous mode\n" );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 54/259 netfilter, bpf: Adjust timeouts of non-confirmed CTs in bpf_ct_insert_entry()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Leoshkevich <[email protected]>
[ Upstream commit 837723b22a63cfbff584655b009b9d488d0e9087 ]
bpf_nf testcase fails on s390x: bpf_skb_ct_lookup() cannot find the entry that was added by bpf_ct_insert_entry() within the same BPF function.
The reason is that this entry is deleted by nf_ct_gc_expired().
The CT timeout starts ticking after the CT confirmation; therefore nf_conn.timeout is initially set to the timeout value, and __nf_conntrack_confirm() sets it to the deadline value.
bpf_ct_insert_entry() sets IPS_CONFIRMED_BIT, but does not adjust the timeout, making its value meaningless and causing false positives.
Fix the problem by making bpf_ct_insert_entry() adjust the timeout, like __nf_conntrack_confirm().
--- net/netfilter/nf_conntrack_bpf.c | 2 ++ 1 file changed, 2 insertions(+)
net/netfilter/nf_conntrack_bpf.c +2 -0
@@ -384,6 +384,8 @@ struct nf_conn *bpf_ct_insert_entry(struct nf_conn___init *nfct_i)struct nf_conn *nfct = (struct nf_conn *)nfct_i;int err; +if (!nf_ct_is_confirmed (nfct)) + nfct->timeout += nfct_time_stamp; nfct->status |=IPS_CONFIRMED ; err =nf_conntrack_hash_check_insert (nfct);if (err <0 ) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 55/259 ionic: fix 16bit math issue when PAGE_SIZE >= 64KB
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Christensen <[email protected]>
[ Upstream commit 8f6b846b0a86c3cbae8a25b772651cfc2270ad0a ]
The ionic device supports a maximum buffer length of 16 bits (see ionic_rxq_desc or ionic_rxq_sg_elem). When adding new buffers to the receive rings, the function ionic_rx_fill() uses 16bit math when calculating the number of pages to allocate for an RX descriptor, given the interface's MTU setting. If the system PAGE_SIZE >= 64KB, and the buf_info->page_offset is 0, the remain_len value will never decrement from the original MTU value and the frag_len value will always be 0, causing additional pages to be allocated as scatter- gather elements unnecessarily.
A similar math issue exists in ionic_rx_frags(), but no failures have been observed here since a 64KB page should not normally require any scatter-gather elements at any legal Ethernet MTU size.
--- drivers/net/ethernet/pensando/ionic/ionic_dev.h | 1 + drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 10 +++++++--- 2 files changed, 8 insertions(+), 3 deletions(-)
drivers/net/ethernet/pensando/ionic/ionic_dev.h +1 -0
@@ -180,6 +180,7 @@ typedef void (*ionic_desc_cb)(struct ionic_queue *q,struct ionic_desc_info *desc_info, struct ionic_cq_info *cq_info, void *cb_arg); +#define IONIC_MAX_BUF_LEN ((u16)-1)#define IONIC_PAGE_SIZE PAGE_SIZE#define IONIC_PAGE_SPLIT_SZ (PAGE_SIZE / 2)#define IONIC_PAGE_GFP_MASK (GFP_ATOMIC | __GFP_NOWARN |\
drivers/net/ethernet/pensando/ionic/ionic_txrx.c +7 -3
@@ -207,7 +207,8 @@ static struct sk_buff *ionic_rx_frags(struct ionic_queue *q,return NULL ; } - frag_len =min_t (u16, len,IONIC_PAGE_SIZE - buf_info->page_offset); + frag_len =min_t (u16, len,min_t (u32,IONIC_MAX_BUF_LEN , +IONIC_PAGE_SIZE - buf_info->page_offset)); len -= frag_len; dma_sync_single_for_cpu(dev,
@@ -444,7 +445,8 @@ void ionic_rx_fill(struct ionic_queue *q)/* fill main descriptor - buf[0] */ desc->addr =cpu_to_le64 (buf_info->dma_addr + buf_info->page_offset); - frag_len =min_t (u16, len,IONIC_PAGE_SIZE - buf_info->page_offset); + frag_len =min_t (u16, len,min_t (u32,IONIC_MAX_BUF_LEN , +IONIC_PAGE_SIZE - buf_info->page_offset)); desc->len =cpu_to_le16 (frag_len); remain_len -= frag_len; buf_info++;
@@ -463,7 +465,9 @@ void ionic_rx_fill(struct ionic_queue *q) } sg_elem->addr =cpu_to_le64 (buf_info->dma_addr + buf_info->page_offset); - frag_len =min_t (u16, remain_len,IONIC_PAGE_SIZE - buf_info->page_offset); + frag_len =min_t (u16, remain_len,min_t (u32,IONIC_MAX_BUF_LEN , +IONIC_PAGE_SIZE - + buf_info->page_offset)); sg_elem->len =cpu_to_le16 (frag_len); remain_len -= frag_len; buf_info++;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 56/259 igc: Fix infinite initialization loop with early XDP redirect
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinicius Costa Gomes <[email protected]>
[ Upstream commit cb47b1f679c4d83a5fa5f1852e472f844e41a3da ]
When an XDP redirect happens before the link is ready, that transmission will not finish and will timeout, causing an adapter reset. If the redirects do not stop, the adapter will not stop resetting.
Wait for the driver to signal that there's a carrier before allowing transmissions to proceed.
Previous code was relying that when __IGC_DOWN is cleared, the NIC is ready to transmit as all the queues are ready, what happens is that the carrier presence will only be signaled later, after the watchdog workqueue has a chance to run. And during this interval (between clearing __IGC_DOWN and the watchdog running) if any transmission happens the timeout is emitted (detected by igc_tx_timeout()) which causes the reset, with the potential for the infinite loop.
--- drivers/net/ethernet/intel/igc/igc_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/igc/igc_main.c +1 -1
@@ -6322,7 +6322,7 @@ static int igc_xdp_xmit(struct net_device *dev, int num_frames,struct igc_ring *ring;int i, drops; -if (unlikely (test_bit (__IGC_DOWN, &adapter->state))) +if (unlikely (!netif_carrier_ok (dev)))return -ENETDOWN ;if (unlikely (flags & ~XDP_XMIT_FLAGS_MASK ))
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 57/259 ipv4: fix null-deref in ipv4_link_failure
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyle Zeng <[email protected]>
[ Upstream commit 0113d9c9d1ccc07f5a3710dac4aa24b6d711278c ]
Currently, we assume the skb is associated with a device before calling __ip_options_compile, which is not always the case if it is re-routed by ipvs.
When skb->dev is NULL, dev_net(skb->dev) will become null-dereference. This patch adds a check for the edge case and switch to use the net_device from the rtable when skb->dev is NULL.
--- net/ipv4/route.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/ipv4/route.c +3 -1
@@ -1213,6 +1213,7 @@ EXPORT_INDIRECT_CALLABLE(ipv4_dst_check);static void ipv4_send_dest_unreach (struct sk_buff *skb) { +struct net_device *dev;struct ip_options opt;int res;
@@ -1230,7 +1231,8 @@ static void ipv4_send_dest_unreach(struct sk_buff *skb) opt.optlen =ip_hdr (skb)->ihl *4 -sizeof (struct iphdr );rcu_read_lock (); - res =__ip_options_compile (dev_net (skb->dev), &opt, skb,NULL ); + dev = skb->dev ? skb->dev :skb_rtable (skb)->dst.dev; + res =__ip_options_compile (dev_net (dev), &opt, skb,NULL );rcu_read_unlock ();if (res)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 58/259 scsi: iscsi_tcp: restrict to TCP sockets
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit f4f82c52a0ead5ab363d207d06f81b967d09ffb8 ]
Nothing prevents iscsi_sw_tcp_conn_bind() to receive file descriptor pointing to non TCP socket (af_unix for example).
Return -EINVAL if this is attempted, instead of crashing the kernel.
--- drivers/scsi/iscsi_tcp.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/scsi/iscsi_tcp.c +4 -0
@@ -724,6 +724,10 @@ iscsi_sw_tcp_conn_bind(struct iscsi_cls_session *cls_session,return -EEXIST ; } + err = -EINVAL ; +if (!sk_is_tcp (sock->sk)) + goto free_socket; + err =iscsi_conn_bind (cls_session, cls_conn, is_leading);if (err) goto free_socket;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 59/259 powerpc/perf/hv-24x7: Update domain value check
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kajol Jain <[email protected]>
[ Upstream commit 4ff3ba4db5943cac1045e3e4a3c0463ea10f6930 ]
Valid domain value is in range 1 to HV_PERF_DOMAIN_MAX. Current code has check for domain value greater than or equal to HV_PERF_DOMAIN_MAX. But the check for domain value 0 is missing.
Fix this issue by adding check for domain value 0.
Before:
# ./perf stat -v -e hv_24x7/CPM_ADJUNCT_INST,domain=0,core=1/ sleep 1 Using CPUID 00800200 Control descriptor is not initialized Error: The sys_perf_event_open() syscall returned with 5 (Input/output error) for event (hv_24x7/CPM_ADJUNCT_INST,domain=0,core=1/). /bin/dmesg | grep -i perf may provide additional information.
Result from dmesg:
[ 37.819387] hv-24x7: hcall failed: [0 0x60040000 0x100 0] => ret 0xfffffffffffffffc (-4) detail=0x2000000 failing ix=0
After:
# ./perf stat -v -e hv_24x7/CPM_ADJUNCT_INST,domain=0,core=1/ sleep 1 Using CPUID 00800200 Control descriptor is not initialized Warning: hv_24x7/CPM_ADJUNCT_INST,domain=0,core=1/ event is not supported by the kernel. failed to read counter hv_24x7/CPM_ADJUNCT_INST,domain=0,core=1/
--- arch/powerpc/perf/hv-24x7.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/perf/hv-24x7.c +1 -1
@@ -1431,7 +1431,7 @@ static int h_24x7_event_init(struct perf_event *event) } domain =event_get_domain (event); -if (domain >=HV_PERF_DOMAIN_MAX ) { +if (domain ==0 || domain >=HV_PERF_DOMAIN_MAX ) {pr_devel ("invalid domain %d\n" , domain);return -EINVAL ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 60/259 dccp: fix dccp_v4_err()/dccp_v6_err() again
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 6af289746a636f71f4c0535a9801774118486c7a ]
dh->dccph_x is the 9th byte (offset 8) in "struct dccp_hdr", not in the "byte 7" as Jann claimed.
We need to make sure the ICMP messages are big enough, using more standard ways (no more assumptions).
syzbot reported:
BUG: KMSAN: uninit-value in pskb_may_pull_reason include/linux/skbuff.h:2667 [inline] BUG: KMSAN: uninit-value in pskb_may_pull include/linux/skbuff.h:2681 [inline] BUG: KMSAN: uninit-value in dccp_v6_err+0x426/0x1aa0 net/dccp/ipv6.c:94 pskb_may_pull_reason include/linux/skbuff.h:2667 [inline] pskb_may_pull include/linux/skbuff.h:2681 [inline] dccp_v6_err+0x426/0x1aa0 net/dccp/ipv6.c:94 icmpv6_notify+0x4c7/0x880 net/ipv6/icmp.c:867 icmpv6_rcv+0x19d5/0x30d0 ip6_protocol_deliver_rcu+0xda6/0x2a60 net/ipv6/ip6_input.c:438 ip6_input_finish net/ipv6/ip6_input.c:483 [inline] NF_HOOK include/linux/netfilter.h:304 [inline] ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492 ip6_mc_input+0xa7e/0xc80 net/ipv6/ip6_input.c:586 dst_input include/net/dst.h:468 [inline] ip6_rcv_finish+0x5db/0x870 net/ipv6/ip6_input.c:79 NF_HOOK include/linux/netfilter.h:304 [inline] ipv6_rcv+0xda/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5523 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5637 netif_receive_skb_internal net/core/dev.c:5723 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5782 tun_rx_batched+0x83b/0x920 tun_get_user+0x564c/0x6940 drivers/net/tun.c:2002 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:1985 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x8ef/0x15c0 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Uninit was created at:
slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767 slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3523 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:559 __alloc_skb+0x318/0x740 net/core/skbuff.c:650 alloc_skb include/linux/skbuff.h:1286 [inline] alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6313 sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2795 tun_alloc_skb drivers/net/tun.c:1531 [inline] tun_get_user+0x23cf/0x6940 drivers/net/tun.c:1846 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:1985 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x8ef/0x15c0 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd CPU: 0 PID: 4995 Comm: syz-executor153 Not tainted 6.6.0-rc1-syzkaller-00014-ga747acc0b752 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023
--- net/dccp/ipv4.c | 9 ++------- net/dccp/ipv6.c | 9 ++------- 2 files changed, 4 insertions(+), 14 deletions(-)
net/dccp/ipv4.c +2 -7
@@ -255,13 +255,8 @@ static int dccp_v4_err(struct sk_buff *skb, u32 info)int err;struct net *net =dev_net (skb->dev); -/* For the first __dccp_basic_hdr_len() check, we only need dh->dccph_x, -* which is in byte 7 of the dccp header. -* Our caller (icmp_socket_deliver()) already pulled 8 bytes for us. -* -* Later on, we want to access the sequence number fields, which are -* beyond 8 bytes, so we have to pskb_may_pull() ourselves. -*/ +if (!pskb_may_pull (skb, offset +sizeof (*dh))) +return -EINVAL ; dh = (struct dccp_hdr *)(skb->data + offset);if (!pskb_may_pull (skb, offset +__dccp_basic_hdr_len (dh)))return -EINVAL ;
net/dccp/ipv6.c +2 -7
@@ -83,13 +83,8 @@ static int dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,__u64 seq;struct net *net =dev_net (skb->dev); -/* For the first __dccp_basic_hdr_len() check, we only need dh->dccph_x, -* which is in byte 7 of the dccp header. -* Our caller (icmpv6_notify()) already pulled 8 bytes for us. -* -* Later on, we want to access the sequence number fields, which are -* beyond 8 bytes, so we have to pskb_may_pull() ourselves. -*/ +if (!pskb_may_pull (skb, offset +sizeof (*dh))) +return -EINVAL ; dh = (struct dccp_hdr *)(skb->data + offset);if (!pskb_may_pull (skb, offset +__dccp_basic_hdr_len (dh)))return -EINVAL ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 61/259 x86/mm, kexec, ima: Use memblock_free_late() from ima_free_kexec_buffer()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rik van Riel <[email protected]>
[ Upstream commit 34cf99c250d5cd2530b93a57b0de31d3aaf8685b ]
The code calling ima_free_kexec_buffer() runs long after the memblock allocator has already been torn down, potentially resulting in a use after free in memblock_isolate_range().
With KASAN or KFENCE, this use after free will result in a BUG from the idle task, and a subsequent kernel panic.
Switch ima_free_kexec_buffer() over to memblock_free_late() to avoid that bug.
--- arch/x86/kernel/setup.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
arch/x86/kernel/setup.c +2 -6
@@ -363,15 +363,11 @@ static void __init add_early_ima_buffer(u64 phys_addr)#if defined(CONFIG_HAVE_IMA_KEXEC ) && !defined(CONFIG_OF_FLATTREE )int __init ima_free_kexec_buffer (void ) { -int rc; -if (!ima_kexec_buffer_size)return -ENOENT ; - rc =memblock_phys_free (ima_kexec_buffer_phys, - ima_kexec_buffer_size); -if (rc) -return rc; +memblock_free_late (ima_kexec_buffer_phys, + ima_kexec_buffer_size); ima_kexec_buffer_phys =0 ; ima_kexec_buffer_size =0 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 62/259 net: hsr: Properly parse HSRv1 supervisor frames.
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukasz Majewski <[email protected]>
[ Upstream commit 295de650d3aaf9e50258465c5f1c84b465d836f6 ]
While adding support for parsing the redbox supervision frames, the author added pull_size' and total_pull_size' to track the amount of bytes that were pulled from the skb during while parsing the skb so it can be reverted/ pushed back at the end.
In the process probably copy&paste error occurred and for the HSRv1 case the ethhdr was used instead of the hsr_tag. Later the hsr_tag was used instead of hsr_sup_tag. The later error didn't matter because both structs have the size so HSRv0 was still working. It broke however HSRv1 parsing because struct ethhdr is larger than struct hsr_tag.
Reinstate the old pulling flow and pull first ethhdr, hsr_tag in v1 case followed by hsr_sup_tag.
[bigeasy: commit message]
--- net/hsr/hsr_framereg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/hsr/hsr_framereg.c +2 -2
@@ -295,13 +295,13 @@ void hsr_handle_sup_frame(struct hsr_frame_info *frame)/* And leave the HSR tag. */ if (ethhdr->h_proto ==htons (ETH_P_HSR )) { - pull_size =sizeof (struct ethhdr ); + pull_size =sizeof (struct hsr_tag );skb_pull (skb, pull_size); total_pull_size += pull_size; }/* And leave the HSR sup tag. */ - pull_size =sizeof (struct hsr_tag ); + pull_size =sizeof (struct hsr_sup_tag );skb_pull (skb, pull_size); total_pull_size += pull_size;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 63/259 platform/x86: intel_scu_ipc: Check status after timeout in busy_loop()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
[ Upstream commit e0b4ab3bb92bda8d12f55842614362989d5b2cb3 ]
It's possible for the polling loop in busy_loop() to get scheduled away for a long time.
status = ipc_read_status(scu); // status = IPC_STATUS_BUSY <long time scheduled away>
if (!(status & IPC_STATUS_BUSY))
If this happens, then the status bit could change while the task is scheduled away and this function would never read the status again after timing out. Instead, the function will return -ETIMEDOUT when it's possible that scheduling didn't work out and the status bit was cleared. Bit polling code should always check the bit being polled one more time after the timeout in case this happens.
Fix this by reading the status once more after the while loop breaks. The readl_poll_timeout() macro implements all of this, and it is shorter, so use that macro here to consolidate code and fix this.
There were some concerns with using readl_poll_timeout() because it uses timekeeping, and timekeeping isn't running early on or during the late stages of system suspend or early stages of system resume, but an audit of the code concluded that this code isn't called during those times so it is safe to use the macro.
--- drivers/platform/x86/intel_scu_ipc.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-)
drivers/platform/x86/intel_scu_ipc.c +8 -11
@@ -19,6 +19,7 @@#include <linux/init.h> #include <linux/interrupt.h> #include <linux/io.h> +#include <linux/iopoll.h> #include <linux/module.h> #include <linux/slab.h>
@@ -232,19 +233,15 @@ static inline u32 ipc_data_readl(struct intel_scu_ipc_dev *scu, u32 offset)/* Wait till scu status is busy */ static inline int busy_loop (struct intel_scu_ipc_dev *scu) { -unsigned long end = jiffies +IPC_TIMEOUT ; - -do { -u32 status; - - status =ipc_read_status (scu); -if (!(status &IPC_STATUS_BUSY )) -return (status &IPC_STATUS_ERR ) ? -EIO :0 ; +u8 status; +int err; -usleep_range (50 ,100 ); - }while (time_before (jiffies, end)); + err =readx_poll_timeout (ipc_read_status, scu, status, !(status &IPC_STATUS_BUSY ), +100 ,jiffies_to_usecs (IPC_TIMEOUT )); +if (err) +return err; -return -ETIMEDOUT ; +return (status &IPC_STATUS_ERR ) ? -EIO :0 ; }/* Wait till ipc ioc interrupt is received or timeout in 10 HZ */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 64/259 platform/x86: intel_scu_ipc: Check status upon timeout in ipc_wait_for_interrupt()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
[ Upstream commit 427fada620733e6474d783ae6037a66eae42bf8c ]
It's possible for the completion in ipc_wait_for_interrupt() to timeout, simply because the interrupt was delayed in being processed. A timeout in itself is not an error. This driver should check the status register upon a timeout to ensure that scheduling or interrupt processing delays don't affect the outcome of the IPC return value.
CPU0 SCU
---- ---
ipc_wait_for_interrupt()
wait_for_completion_timeout(&scu->cmd_complete)
[TIMEOUT] status[IPC_STATUS_BUSY]=0
Fix this problem by reading the status bit in all cases, regardless of the timeout. If the completion times out, we'll assume the problem was that the IPC_STATUS_BUSY bit was still set, but if the status bit is cleared in the meantime we know that we hit some scheduling delay and we should just check the error bit.
--- drivers/platform/x86/intel_scu_ipc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/platform/x86/intel_scu_ipc.c +4 -2
@@ -249,10 +249,12 @@ static inline int ipc_wait_for_interrupt(struct intel_scu_ipc_dev *scu) {int status; -if (!wait_for_completion_timeout (&scu->cmd_complete,IPC_TIMEOUT )) -return -ETIMEDOUT ; +wait_for_completion_timeout (&scu->cmd_complete,IPC_TIMEOUT ); status =ipc_read_status (scu); +if (status &IPC_STATUS_BUSY ) +return -ETIMEDOUT ; +if (status &IPC_STATUS_ERR )return -EIO ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 65/259 platform/x86: intel_scu_ipc: Dont override scu in intel_scu_ipc_dev_simple_command()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
[ Upstream commit efce78584e583226e9a1f6cb2fb555d6ff47c3e7 ]
Andy discovered this bug during patch review. The 'scu' argument to this function shouldn't be overridden by the function itself. It doesn't make any sense. Looking at the commit history, we see that commit f57fa18583f5 ("platform/x86: intel_scu_ipc: Introduce new SCU IPC API") removed the setting of the scu to ipcdev in other functions, but not this one. That was an oversight. Remove this line so that we stop overriding the scu instance that is used by this function.
--- drivers/platform/x86/intel_scu_ipc.c | 1 - 1 file changed, 1 deletion(-)
drivers/platform/x86/intel_scu_ipc.c +0 -1
@@ -444,7 +444,6 @@ int intel_scu_ipc_dev_simple_command(struct intel_scu_ipc_dev *scu, int cmd,mutex_unlock (&ipclock);return -ENODEV ; } - scu = ipcdev; cmdval = sub <<12 | cmd;ipc_command (scu, cmdval); err =intel_scu_ipc_check_status (scu);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 66/259 platform/x86: intel_scu_ipc: Fail IPC send if still busy
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
[ Upstream commit 85e654c9f722853a595fa941dca60c157b707b86 ]
It's possible for interrupts to get significantly delayed to the point that callers of intel_scu_ipc_dev_command() and friends can call the function once, hit a timeout, and call it again while the interrupt still hasn't been processed. This driver will get seriously confused if the interrupt is finally processed after the second IPC has been sent with ipc_command(). It won't know which IPC has been completed. This could be quite disastrous if calling code assumes something has happened upon return from intel_scu_ipc_dev_simple_command() when it actually hasn't.
Let's avoid this scenario by simply returning -EBUSY in this case. Hopefully higher layers will know to back off or fail gracefully when this happens. It's all highly unlikely anyway, but it's better to be correct here as we have no way to know which IPC the status register is telling us about if we send a second IPC while the previous IPC is still processing.
--- drivers/platform/x86/intel_scu_ipc.c | 40 +++++++++++++++++++--------- 1 file changed, 28 insertions(+), 12 deletions(-)
drivers/platform/x86/intel_scu_ipc.c +28 -12
@@ -266,6 +266,24 @@ static int intel_scu_ipc_check_status(struct intel_scu_ipc_dev *scu)return scu->irq >0 ?ipc_wait_for_interrupt (scu) :busy_loop (scu); } +static struct intel_scu_ipc_dev *intel_scu_ipc_get (struct intel_scu_ipc_dev *scu) +{ +u8 status; + +if (!scu) + scu = ipcdev; +if (!scu) +return ERR_PTR (-ENODEV ); + + status =ipc_read_status (scu); +if (status &IPC_STATUS_BUSY ) { +dev_dbg (&scu->dev,"device is busy\n" ); +return ERR_PTR (-EBUSY ); + } + +return scu; +} +/* Read/Write power control(PMIC in Langwell, MSIC in PenWell) registers */ static int pwr_reg_rdwr (struct intel_scu_ipc_dev *scu,u16 *addr,u8 *data,u32 count,u32 op,u32 id)
@@ -279,11 +297,10 @@ static int pwr_reg_rdwr(struct intel_scu_ipc_dev *scu, u16 *addr, u8 *data,memset (cbuf,0 ,sizeof (cbuf));mutex_lock (&ipclock); -if (!scu) - scu = ipcdev; -if (!scu) { + scu =intel_scu_ipc_get (scu); +if (IS_ERR (scu)) {mutex_unlock (&ipclock); -return -ENODEV ; +return PTR_ERR (scu); }for (nc =0 ; nc < count; nc++, offset +=2 ) {
@@ -438,12 +455,12 @@ int intel_scu_ipc_dev_simple_command(struct intel_scu_ipc_dev *scu, int cmd,int err;mutex_lock (&ipclock); -if (!scu) - scu = ipcdev; -if (!scu) { + scu =intel_scu_ipc_get (scu); +if (IS_ERR (scu)) {mutex_unlock (&ipclock); -return -ENODEV ; +return PTR_ERR (scu); } + cmdval = sub <<12 | cmd;ipc_command (scu, cmdval); err =intel_scu_ipc_check_status (scu);
@@ -483,11 +500,10 @@ int intel_scu_ipc_dev_command_with_size(struct intel_scu_ipc_dev *scu, int cmd,return -EINVAL ;mutex_lock (&ipclock); -if (!scu) - scu = ipcdev; -if (!scu) { + scu =intel_scu_ipc_get (scu); +if (IS_ERR (scu)) {mutex_unlock (&ipclock); -return -ENODEV ; +return PTR_ERR (scu); }memcpy (inbuf, in, inlen);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 67/259 x86/srso: Fix srso_show_state() side effect
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
[ Upstream commit a8cf700c17d9ca6cb8ee7dc5c9330dbac3948237 ]
Reading the 'spec_rstack_overflow' sysfs file can trigger an unnecessary MSR write, and possibly even a (handled) exception if the microcode hasn't been updated.
Avoid all that by just checking X86_FEATURE_IBPB_BRTYPE instead, which gets set by srso_select_mitigation() if the updated microcode exists.
--- arch/x86/kernel/cpu/bugs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/cpu/bugs.c +1 -1
@@ -2692,7 +2692,7 @@ static ssize_t srso_show_state(char *buf)return sysfs_emit (buf,"%s%s\n" , srso_strings[srso_mitigation], - (cpu_has_ibpb_brtype_microcode () ?"" :", no microcode" )); +boot_cpu_has (X86_FEATURE_IBPB_BRTYPE ) ?"" :", no microcode" ); } static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 68/259 x86/srso: Fix SBPB enablement for spec_rstack_overflow=off
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
[ Upstream commit 01b057b2f4cc2d905a0bd92195657dbd9a7005ab ]
If the user has requested no SRSO mitigation, other mitigations can use the lighter-weight SBPB instead of IBPB.
--- arch/x86/kernel/cpu/bugs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/cpu/bugs.c +1 -1
@@ -2414,7 +2414,7 @@ static void __init srso_select_mitigation(void)switch (srso_cmd) {case SRSO_CMD_OFF : -return ; + goto pred_cmd;case SRSO_CMD_MICROCODE :if (has_microcode) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 69/259 net: hns3: add cmdq check for vf periodic service task
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Wang <[email protected]>
[ Upstream commit bd3caddf299a640efb66c6022efed7fe744db626 ]
When the vf cmdq is disabled, there is no need to keep these task running. So this patch skip these task when the cmdq is disabled.
--- drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +2 -1
@@ -1909,7 +1909,8 @@ static void hclgevf_periodic_service_task(struct hclgevf_dev *hdev)unsigned long delta =round_jiffies_relative (HZ );struct hnae3_handle *handle = &hdev->nic; -if (test_bit (HCLGEVF_STATE_RST_FAIL , &hdev->state)) +if (test_bit (HCLGEVF_STATE_RST_FAIL , &hdev->state) || +test_bit (HCLGE_COMM_STATE_CMD_DISABLE , &hdev->hw.hw.comm_state))return ;if (time_is_after_jiffies (hdev->last_serv_processed +HZ )) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 70/259 net: hns3: fix GRE checksum offload issue
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Wang <[email protected]>
[ Upstream commit f9f651261130cdcb7adc9a3e365b356bc2749ab3 ]
The device_version V3 hardware can't offload the checksum for IP in GRE packets, but can do it for NvGRE. So default to disable the checksum and GSO offload for GRE, but keep the ability to enable it when only using NvGRE.
--- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +9 -0
@@ -3352,6 +3352,15 @@ static void hns3_set_default_feature(struct net_device *netdev) NETIF_F_HW_TC); netdev->hw_enc_features |= netdev->vlan_features |NETIF_F_TSO_MANGLEID ; + +/* The device_version V3 hardware can't offload the checksum for IP in +* GRE packets, but can do it for NvGRE. So default to disable the +* checksum and GSO offload for GRE. +*/ +if (ae_dev->dev_version >HNAE3_DEVICE_VERSION_V2 ) { + netdev->features &= ~NETIF_F_GSO_GRE ; + netdev->features &= ~NETIF_F_GSO_GRE_CSUM ; + } } static int hns3_alloc_buffer(struct hns3_enet_ring *ring,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 71/259 net: hns3: only enable unicast promisc when mac table full
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jian Shen <[email protected]>
[ Upstream commit f2ed304922a55690529bcca59678dd92d7466ce8 ]
Currently, the driver will enable unicast promisc for the function once configure mac address fail. It's unreasonable when the failure is caused by using same mac address with other functions. So only enable unicast promisc when mac table full.
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +1 -1
@@ -8930,7 +8930,7 @@ static void hclge_update_overflow_flags(struct hclge_vport *vport,if (mac_type ==HCLGE_MAC_ADDR_UC ) {if (is_all_added) vport->overflow_promisc_flags &= ~HNAE3_OVERFLOW_UPE ; -else +else if (hclge_is_umv_space_full (vport, true)) vport->overflow_promisc_flags |=HNAE3_OVERFLOW_UPE ; }else {if (is_all_added)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 72/259 net: hns3: fix fail to delete tc flower rules during reset issue
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jijie Shao <[email protected]>
[ Upstream commit 1a7be66e4685b8541546222c305cce9710718a88 ]
Firmware does not respond driver commands during reset Therefore, rule will fail to delete while the firmware is resetting
So, if failed to delete rule, set rule state to TO_DEL, and the rule will be deleted when periodic task being scheduled.
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +6 -0
@@ -7454,6 +7454,12 @@ static int hclge_del_cls_flower(struct hnae3_handle *handle, ret =hclge_fd_tcam_config (hdev,HCLGE_FD_STAGE_1 , true, rule->location,NULL , false);if (ret) { +/* if tcam config fail, set rule state to TO_DEL, +* so the rule will be deleted when periodic +* task being scheduled. +*/ +hclge_update_fd_list (hdev,HCLGE_FD_TO_DEL , rule->location,NULL ); +set_bit (HCLGE_STATE_FD_TBL_CHANGED , &hdev->state);spin_unlock_bh (&hdev->fd_rule_lock);return ret; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 73/259 net: hns3: add 5ms delay before clear firmware reset irq source
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Wang <[email protected]>
[ Upstream commit 0770063096d5da4a8e467b6e73c1646a75589628 ]
Currently the reset process in hns3 and firmware watchdog init process is asynchronous. we think firmware watchdog initialization is completed before hns3 clear the firmware interrupt source. However, firmware initialization may not complete early.
so we add delay before hns3 clear firmware interrupt source and 5 ms delay is enough to avoid second firmware reset interrupt.
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +5 -0
@@ -3662,9 +3662,14 @@ static u32 hclge_check_event_cause(struct hclge_dev *hdev, u32 *clearval)static void hclge_clear_event_cause (struct hclge_dev *hdev,u32 event_type,u32 regclr) { +#define HCLGE_IMP_RESET_DELAY 5 +switch (event_type) {case HCLGE_VECTOR0_EVENT_PTP :case HCLGE_VECTOR0_EVENT_RST : +if (regclr ==BIT (HCLGE_VECTOR0_IMPRESET_INT_B )) +mdelay (HCLGE_IMP_RESET_DELAY ); +hclge_write_dev (&hdev->hw,HCLGE_MISC_RESET_STS_REG , regclr);break ;case HCLGE_VECTOR0_EVENT_MBX :
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 74/259 net: bridge: use DEV_STATS_INC()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 44bdb313da57322c9b3c108eb66981c6ec6509f4 ]
syzbot/KCSAN reported data-races in br_handle_frame_finish() [1] This function can run from multiple cpus without mutual exclusion.
Adopt SMP safe DEV_STATS_INC() to update dev->stats fields.
Handles updates to dev->stats.tx_dropped while we are at it.
[1]
BUG: KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish
read-write to 0xffff8881374b2178 of 8 bytes by interrupt on cpu 1:
br_handle_frame_finish+0xd4f/0xef0 net/bridge/br_input.c:189 br_nf_hook_thresh+0x1ed/0x220 br_nf_pre_routing_finish_ipv6+0x50f/0x540 NF_HOOK include/linux/netfilter.h:304 [inline] br_nf_pre_routing_ipv6+0x1e3/0x2a0 net/bridge/br_netfilter_ipv6.c:178 br_nf_pre_routing+0x526/0xba0 net/bridge/br_netfilter_hooks.c:508 nf_hook_entry_hookfn include/linux/netfilter.h:144 [inline] nf_hook_bridge_pre net/bridge/br_input.c:272 [inline] br_handle_frame+0x4c9/0x940 net/bridge/br_input.c:417 __netif_receive_skb_core+0xa8a/0x21e0 net/core/dev.c:5417 __netif_receive_skb_one_core net/core/dev.c:5521 [inline] __netif_receive_skb+0x57/0x1b0 net/core/dev.c:5637 process_backlog+0x21f/0x380 net/core/dev.c:5965 __napi_poll+0x60/0x3b0 net/core/dev.c:6527 napi_poll net/core/dev.c:6594 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6727 __do_softirq+0xc1/0x265 kernel/softirq.c:553 run_ksoftirqd+0x17/0x20 kernel/softirq.c:921 smpboot_thread_fn+0x30a/0x4a0 kernel/smpboot.c:164 kthread+0x1d7/0x210 kernel/kthread.c:388 ret_from_fork+0x48/0x60 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
read-write to 0xffff8881374b2178 of 8 bytes by interrupt on cpu 0:
br_handle_frame_finish+0xd4f/0xef0 net/bridge/br_input.c:189 br_nf_hook_thresh+0x1ed/0x220 br_nf_pre_routing_finish_ipv6+0x50f/0x540 NF_HOOK include/linux/netfilter.h:304 [inline] br_nf_pre_routing_ipv6+0x1e3/0x2a0 net/bridge/br_netfilter_ipv6.c:178 br_nf_pre_routing+0x526/0xba0 net/bridge/br_netfilter_hooks.c:508 nf_hook_entry_hookfn include/linux/netfilter.h:144 [inline] nf_hook_bridge_pre net/bridge/br_input.c:272 [inline] br_handle_frame+0x4c9/0x940 net/bridge/br_input.c:417 __netif_receive_skb_core+0xa8a/0x21e0 net/core/dev.c:5417 __netif_receive_skb_one_core net/core/dev.c:5521 [inline] __netif_receive_skb+0x57/0x1b0 net/core/dev.c:5637 process_backlog+0x21f/0x380 net/core/dev.c:5965 __napi_poll+0x60/0x3b0 net/core/dev.c:6527 napi_poll net/core/dev.c:6594 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6727 __do_softirq+0xc1/0x265 kernel/softirq.c:553 do_softirq+0x5e/0x90 kernel/softirq.c:454 __local_bh_enable_ip+0x64/0x70 kernel/softirq.c:381 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_tt_local_purge+0x1a8/0x1f0 net/batman-adv/translation-table.c:1356 batadv_tt_purge+0x2b/0x630 net/batman-adv/translation-table.c:3560 process_one_work kernel/workqueue.c:2630 [inline] process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2703 worker_thread+0x525/0x730 kernel/workqueue.c:2784 kthread+0x1d7/0x210 kernel/kthread.c:388 ret_from_fork+0x48/0x60 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
value changed: 0x00000000000d7190 -> 0x00000000000d7191
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 14848 Comm: kworker/u4:11 Not tainted 6.6.0-rc1-syzkaller-00236-gad8a69f361b9 #0
--- net/bridge/br_forward.c | 4 ++-- net/bridge/br_input.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
net/bridge/br_forward.c +2 -2
@@ -124,7 +124,7 @@ static int deliver_clone(const struct net_bridge_port *prev, skb =skb_clone (skb,GFP_ATOMIC );if (!skb) { - dev->stats.tx_dropped++; +DEV_STATS_INC (dev, tx_dropped);return -ENOMEM ; }
@@ -263,7 +263,7 @@ static void maybe_deliver_addr(struct net_bridge_port *p, struct sk_buff *skb, skb =skb_copy (skb,GFP_ATOMIC );if (!skb) { - dev->stats.tx_dropped++; +DEV_STATS_INC (dev, tx_dropped);return ; }
net/bridge/br_input.c +2 -2
@@ -164,12 +164,12 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skbif ((mdst && mdst->host_joined) ||br_multicast_is_router (brmctx, skb)) { local_rcv = true; - br->dev->stats.multicast++; +DEV_STATS_INC (br->dev, multicast); } mcast_hit = true; }else { local_rcv = true; - br->dev->stats.multicast++; +DEV_STATS_INC (br->dev, multicast); }break ;case BR_PKT_UNICAST :
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 75/259 team: fix null-ptr-deref when team device type is changed
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyang Xuan <[email protected]>
[ Upstream commit 492032760127251e5540a5716a70996bacf2a3fd ]
Get a null-ptr-deref bug as follows with reproducer [1].
BUG: kernel NULL pointer dereference, address: 0000000000000228 ... RIP: 0010:vlan_dev_hard_header+0x35/0x140 [8021q] ... Call Trace: <TASK> ? __die+0x24/0x70 ? page_fault_oops+0x82/0x150 ? exc_page_fault+0x69/0x150 ? asm_exc_page_fault+0x26/0x30 ? vlan_dev_hard_header+0x35/0x140 [8021q] ? vlan_dev_hard_header+0x8e/0x140 [8021q] neigh_connected_output+0xb2/0x100 ip6_finish_output2+0x1cb/0x520 ? nf_hook_slow+0x43/0xc0 ? ip6_mtu+0x46/0x80 ip6_finish_output+0x2a/0xb0 mld_sendpack+0x18f/0x250 mld_ifc_work+0x39/0x160 process_one_work+0x1e6/0x3f0 worker_thread+0x4d/0x2f0 ? __pfx_worker_thread+0x10/0x10 kthread+0xe5/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30
[1]
$ teamd -t team0 -d -c '{"runner": {"name": "loadbalance"}}'
$ ip link add name t-dummy type dummy
$ ip link add link t-dummy name t-dummy.100 type vlan id 100
$ ip link add name t-nlmon type nlmon
$ ip link set t-nlmon master team0
$ ip link set t-nlmon nomaster
$ ip link set t-dummy up
$ ip link set team0 up
$ ip link set t-dummy.100 down
$ ip link set t-dummy.100 master team0When enslave a vlan device to team device and team device type is changed from non-ether to ether, header_ops of team device is changed to vlan_header_ops. That is incorrect and will trigger null-ptr-deref for vlan->real_dev in vlan_dev_hard_header() because team device is not a vlan device.
Cache eth_header_ops in team_setup(), then assign cached header_ops to header_ops of team net device when its type is changed from non-ether to ether to fix the bug.
--- drivers/net/team/team.c | 10 +++++++++- include/linux/if_team.h | 2 ++ 2 files changed, 11 insertions(+), 1 deletion(-)
drivers/net/team/team.c +9 -1
@@ -2127,7 +2127,12 @@ static const struct ethtool_ops team_ethtool_ops = {static void team_setup_by_port (struct net_device *dev,struct net_device *port_dev) { - dev->header_ops = port_dev->header_ops; +struct team *team =netdev_priv (dev); + +if (port_dev->type ==ARPHRD_ETHER ) + dev->header_ops = team->header_ops_cache; +else + dev->header_ops = port_dev->header_ops; dev->type = port_dev->type; dev->hard_header_len = port_dev->hard_header_len; dev->needed_headroom = port_dev->needed_headroom;
@@ -2174,8 +2179,11 @@ static int team_dev_type_check_change(struct net_device *dev,static void team_setup (struct net_device *dev) { +struct team *team =netdev_priv (dev); +ether_setup (dev); dev->max_mtu =ETH_MAX_MTU ; + team->header_ops_cache = dev->header_ops; dev->netdev_ops = &team_netdev_ops; dev->ethtool_ops = &team_ethtool_ops;
include/linux/if_team.h +2 -0
@@ -189,6 +189,8 @@ struct team {struct net_device *dev;/* associated netdevice */ struct team_pcpu_stats __percpu *pcpu_stats; +const struct header_ops *header_ops_cache; +struct mutex lock;/* used for overall locking, e.g. port lists write */ /*
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 76/259 net: rds: Fix possible NULL-pointer dereference
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artem Chernyshev <[email protected]>
[ Upstream commit f1d95df0f31048f1c59092648997686e3f7d9478 ]
In rds_rdma_cm_event_handler_cmn() check, if conn pointer exists before dereferencing it as rdma_set_service_type() argument
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- net/rds/rdma_transport.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
net/rds/rdma_transport.c +7 -5
@@ -86,11 +86,13 @@ static int rds_rdma_cm_event_handler_cmn(struct rdma_cm_id *cm_id,break ;case RDMA_CM_EVENT_ADDR_RESOLVED : -rdma_set_service_type (cm_id, conn->c_tos); -rdma_set_min_rnr_timer (cm_id,IB_RNR_TIMER_000_32 ); -/* XXX do we need to clean up if this fails? */ - ret =rdma_resolve_route (cm_id, -RDS_RDMA_RESOLVE_TIMEOUT_MS ); +if (conn) { +rdma_set_service_type (cm_id, conn->c_tos); +rdma_set_min_rnr_timer (cm_id,IB_RNR_TIMER_000_32 ); +/* XXX do we need to clean up if this fails? */ + ret =rdma_resolve_route (cm_id, +RDS_RDMA_RESOLVE_TIMEOUT_MS ); + }break ;case RDMA_CM_EVENT_ROUTE_RESOLVED :
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 77/259 netfilter: nf_tables: disable toggling dormant table state more than once
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit c9bd26513b3a11b3adb3c2ed8a31a01a87173ff1 ]
nft -f -<<EOF
add table ip t
add table ip t { flags dormant; }
add chain ip t c { type filter hook input priority 0; } add table ip t
EOF
Triggers a splat from nf core on next table delete because we lose track of right hook register state:
WARNING: CPU: 2 PID: 1597 at net/netfilter/core.c:501 __nf_unregister_net_hook RIP: 0010:__nf_unregister_net_hook+0x41b/0x570 nf_unregister_net_hook+0xb4/0xf0 __nf_tables_unregister_hook+0x160/0x1d0
[..]
The above should have table in *active* state, but in fact no hooks were registered.
Reject on/off/on games rather than attempting to fix this.
--- net/netfilter/nf_tables_api.c | 4 ++++ 1 file changed, 4 insertions(+)
net/netfilter/nf_tables_api.c +4 -0
@@ -1211,6 +1211,10 @@ static int nf_tables_updtable(struct nft_ctx *ctx) flags & NFT_TABLE_F_OWNER))return -EOPNOTSUPP ; +/* No dormant off/on/off/on games in single transaction */ +if (ctx->table->flags & __NFT_TABLE_F_UPDATE) +return -EINVAL ; + trans =nft_trans_alloc (ctx,NFT_MSG_NEWTABLE ,sizeof (struct nft_trans_table ));if (trans ==NULL )
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 78/259 netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jozsef Kadlecsik <[email protected]>
[ Upstream commit 7433b6d2afd512d04398c73aa984d1e285be125b ]
Kyle Zeng reported that there is a race between IPSET_CMD_ADD and IPSET_CMD_SWAP in netfilter/ip_set, which can lead to the invocation of __ip_set_put on a wrong set, triggering the BUG_ON(set->ref == 0); check in it.
The race is caused by using the wrong reference counter, i.e. the ref counter instead of ref_netlink.
--- net/netfilter/ipset/ip_set_core.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
net/netfilter/ipset/ip_set_core.c +10 -2
@@ -682,6 +682,14 @@ __ip_set_put(struct ip_set *set)/* set->ref can be swapped out by ip_set_swap, netlink events (like dump) need * a separate reference counter */ +static void +__ip_set_get_netlink (struct ip_set *set) +{ +write_lock_bh (&ip_set_ref_lock); + set->ref_netlink++; +write_unlock_bh (&ip_set_ref_lock); +} +static void __ip_set_put_netlink (struct ip_set *set) {
@@ -1695,11 +1703,11 @@ call_ad(struct net *net, struct sock *ctnl, struct sk_buff *skb, do { if (retried) { - __ip_set_get(set); + __ip_set_get_netlink(set); nfnl_unlock(NFNL_SUBSYS_IPSET); cond_resched(); nfnl_lock(NFNL_SUBSYS_IPSET); - __ip_set_put(set); + __ip_set_put_netlink(set); } ip_set_lock(set);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 79/259 i915/pmu: Move execlist stats initialization to execlist specific setup
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Umesh Nerlige Ramappa <[email protected]>
[ Upstream commit c524cd40e8a2a1a36f4898eaf2024beefeb815f3 ]
engine->stats is a union of execlist and guc stat objects. When execlist specific fields are initialized, the initial state of guc stats is affected. This results in bad busyness values when using GuC mode. Move the execlist initialization from common code to execlist specific code.
--- drivers/gpu/drm/i915/gt/intel_engine_cs.c | 1 - drivers/gpu/drm/i915/gt/intel_execlists_submission.c | 2 ++ 2 files changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/i915/gt/intel_engine_cs.c +0 -1
@@ -541,7 +541,6 @@ static int intel_engine_setup(struct intel_gt *gt, enum intel_engine_id id,DRIVER_CAPS (i915)->has_logical_contexts = true;ewma__engine_latency_init (&engine->latency); -seqcount_init (&engine->stats.execlists.lock);ATOMIC_INIT_NOTIFIER_HEAD (&engine->context_status_notifier);
drivers/gpu/drm/i915/gt/intel_execlists_submission.c +2 -0
@@ -3546,6 +3546,8 @@ int intel_execlists_submission_setup(struct intel_engine_cs *engine)logical_ring_default_vfuncs (engine);logical_ring_default_irqs (engine); +seqcount_init (&engine->stats.execlists.lock); +if (engine->flags &I915_ENGINE_HAS_RCS_REG_STATE )rcs_submission_override (engine);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 80/259 locking/seqlock: Do the lockdep annotation before locking in do_write_seqcount_begin_nested()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit 41b43b6c6e30a832c790b010a06772e793bca193 ]
It was brought up by Tetsuo that the following sequence:
write_seqlock_irqsave()
printk_deferred_enter()
could lead to a deadlock if the lockdep annotation within write_seqlock_irqsave() triggers.
The problem is that the sequence counter is incremented before the lockdep annotation is performed. The lockdep splat would then attempt to invoke printk() but the reader side, of the same seqcount, could have a tty_port::lock acquired waiting for the sequence number to become even again.
The other lockdep annotations come before the actual locking because "we want to see the locking error before it happens". There is no reason why seqcount should be different here.
Do the lockdep annotation first then perform the locking operation (the sequence increment).
--- include/linux/seqlock.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/seqlock.h +1 -1
@@ -512,8 +512,8 @@ do { \static inline void do_write_seqcount_begin_nested (seqcount_t *s,int subclass) { -do_raw_write_seqcount_begin (s);seqcount_acquire (&s->dep_map, subclass,0 , _RET_IP_); +do_raw_write_seqcount_begin (s); }/**
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 81/259 net: ena: Flush XDP packets on error.
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit 6f411fb5ca9419090bee6a0a46425e0a5060b734 ]
xdp_do_flush() should be invoked before leaving the NAPI poll function after a XDP-redirect. This is not the case if the driver leaves via the error path (after having a redirect in one of its previous iterations).
Invoke xdp_do_flush() also in the error path.
--- drivers/net/ethernet/amazon/ena/ena_netdev.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/amazon/ena/ena_netdev.c +3 -0
@@ -1778,6 +1778,9 @@ static int ena_clean_rx_irq(struct ena_ring *rx_ring, struct napi_struct *napi,return work_done; error: +if (xdp_flags &ENA_XDP_REDIRECT ) +xdp_do_flush (); + adapter =netdev_priv (rx_ring->netdev);if (rc == -ENOSPC ) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 82/259 bnxt_en: Flush XDP for bnxt_poll_nitroa0()s NAPI
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit edc0140cc3b7b91874ebe70eb7d2a851e8817ccc ]
bnxt_poll_nitroa0() invokes bnxt_rx_pkt() which can run a XDP program which in turn can return XDP_REDIRECT. bnxt_rx_pkt() is also used by __bnxt_poll_work() which flushes (xdp_do_flush()) the packets after each round. bnxt_poll_nitroa0() lacks this feature. xdp_do_flush() should be invoked before leaving the NAPI callback.
Invoke xdp_do_flush() after a redirect in bnxt_poll_nitroa0() NAPI.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +5 -0
@@ -2654,6 +2654,7 @@ static int bnxt_poll_nitroa0(struct napi_struct *napi, int budget)struct rx_cmp_ext *rxcmp1;u32 cp_cons, tmp_raw_cons;u32 raw_cons = cpr->cp_raw_cons; +bool flush_xdp = false;u32 rx_pkts =0 ;u8 event =0 ;
@@ -2688,6 +2689,8 @@ static int bnxt_poll_nitroa0(struct napi_struct *napi, int budget) rx_pkts++; else if (rc == -EBUSY) /* partial completion */ break; +if (event &BNXT_REDIRECT_EVENT ) + flush_xdp = true; }else if (unlikely (TX_CMP_TYPE (txcmp) ==CMPL_BASE_TYPE_HWRM_DONE )) {bnxt_hwrm_handler (bp, txcmp);
@@ -2707,6 +2710,8 @@ static int bnxt_poll_nitroa0(struct napi_struct *napi, int budget)if (event &BNXT_AGG_EVENT )bnxt_db_write (bp, &rxr->rx_agg_db, rxr->rx_agg_prod); +if (flush_xdp) +xdp_do_flush ();if (!bnxt_has_work (bp, cpr) && rx_pkts < budget) {napi_complete_done (napi, rx_pkts);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 83/259 octeontx2-pf: Do xdp_do_flush() after redirects.
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit 70b2b6892645e58ed6f051dad7f8d1083f0ad553 ]
xdp_do_flush() should be invoked before leaving the NAPI poll function if XDP-redirect has been performed.
Invoke xdp_do_flush() before leaving NAPI.
--- .../marvell/octeontx2/nic/otx2_txrx.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c +13 -6
@@ -29,7 +29,8 @@static bool otx2_xdp_rcv_pkt_handler (struct otx2_nic *pfvf,struct bpf_prog *prog,struct nix_cqe_rx_s *cqe, -struct otx2_cq_queue *cq); +struct otx2_cq_queue *cq, +bool *need_xdp_flush);static int otx2_nix_cq_op_status (struct otx2_nic *pfvf,struct otx2_cq_queue *cq)
@@ -340,7 +341,7 @@ static bool otx2_check_rcv_errors(struct otx2_nic *pfvf,static void otx2_rcv_pkt_handler (struct otx2_nic *pfvf,struct napi_struct *napi,struct otx2_cq_queue *cq, -struct nix_cqe_rx_s *cqe) +struct nix_cqe_rx_s *cqe,bool *need_xdp_flush) {struct nix_rx_parse_s *parse = &cqe->parse;struct nix_rx_sg_s *sg = &cqe->sg;
@@ -356,7 +357,7 @@ static void otx2_rcv_pkt_handler(struct otx2_nic *pfvf, }if (pfvf->xdp_prog) -if (otx2_xdp_rcv_pkt_handler (pfvf, pfvf->xdp_prog, cqe, cq)) +if (otx2_xdp_rcv_pkt_handler (pfvf, pfvf->xdp_prog, cqe, cq, need_xdp_flush))return ; skb =napi_get_frags (napi);
@@ -389,6 +390,7 @@ static int otx2_rx_napi_handler(struct otx2_nic *pfvf,struct napi_struct *napi, struct otx2_cq_queue *cq, int budget) { + bool need_xdp_flush = false;struct nix_cqe_rx_s *cqe;int processed_cqe =0 ;
@@ -410,13 +412,15 @@ static int otx2_rx_napi_handler(struct otx2_nic *pfvf, cq->cq_head++; cq->cq_head &= (cq->cqe_cnt -1 ); -otx2_rcv_pkt_handler (pfvf, napi, cq, cqe); +otx2_rcv_pkt_handler (pfvf, napi, cq, cqe, &need_xdp_flush); cqe->hdr.cqe_type =NIX_XQE_TYPE_INVALID ; cqe->sg.seg_addr =0x00 ; processed_cqe++; cq->pend_cqe--; } +if (need_xdp_flush) +xdp_do_flush ();/* Free CQEs to HW */ otx2_write64(pfvf, NIX_LF_CQ_OP_DOOR,
@@ -1323,7 +1327,8 @@ bool otx2_xdp_sq_append_pkt(struct otx2_nic *pfvf, u64 iova, int len, u16 qidx)static bool otx2_xdp_rcv_pkt_handler (struct otx2_nic *pfvf,struct bpf_prog *prog,struct nix_cqe_rx_s *cqe, -struct otx2_cq_queue *cq) +struct otx2_cq_queue *cq, +bool *need_xdp_flush) {unsigned char *hard_start, *data;int qidx = cq->cq_idx;
@@ -1360,8 +1365,10 @@ static bool otx2_xdp_rcv_pkt_handler(struct otx2_nic *pfvf,otx2_dma_unmap_page (pfvf, iova, pfvf->rbsize,DMA_FROM_DEVICE ); -if (!err) +if (!err) { + *need_xdp_flush = true;return true; + }put_page (page);break ;default :
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 84/259 igc: Expose tx-usecs coalesce setting to user
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Husaini Zulkifli <[email protected]>
[ Upstream commit 1703b2e0de653b459ca6230be32ce7f2ea0ae7ee ]
When users attempt to obtain the coalesce setting using the ethtool command, current code always returns 0 for tx-usecs. This is because I225/6 always uses a queue pair setting, hence tx_coalesce_usecs does not return a value during the igc_ethtool_get_coalesce() callback process. The pair queue condition checking in igc_ethtool_get_coalesce() is removed by this patch so that the user gets information of the value of tx-usecs.
Even if i225/6 is using queue pair setting, there is no harm in notifying the user of the tx-usecs. The implementation of the current code may have previously been a copy of the legacy code i210. Since I225 has the queue pair setting enabled, tx-usecs will always adhere to the user-set rx-usecs value. An error message will appear when the user attempts to set the tx-usecs value for the input parameters because, by default, they should only set the rx-usecs value.
This patch also adds the helper function to get the previous rx coalesce value similar to tx coalesce.
How to test:
User can get the coalesce value using ethtool command.
Example command:
Get: ethtool -c <interface>
Previous output:
rx-usecs: 3
rx-frames: n/a
rx-usecs-irq: n/a
rx-frames-irq: n/a
tx-usecs: 0
tx-frames: n/a
tx-usecs-irq: n/a
tx-frames-irq: n/a
New output:
rx-usecs: 3
rx-frames: n/a
rx-usecs-irq: n/a
rx-frames-irq: n/a
tx-usecs: 3
tx-frames: n/a
tx-usecs-irq: n/a
tx-frames-irq: n/a
--- drivers/net/ethernet/intel/igc/igc_ethtool.c | 31 ++++++++++++-------- 1 file changed, 19 insertions(+), 12 deletions(-)
drivers/net/ethernet/intel/igc/igc_ethtool.c +19 -12
@@ -867,6 +867,18 @@ static void igc_ethtool_get_stats(struct net_device *netdev,spin_unlock (&adapter->stats64_lock); } +static int igc_ethtool_get_previous_rx_coalesce (struct igc_adapter *adapter) +{ +return (adapter->rx_itr_setting <=3 ) ? + adapter->rx_itr_setting : adapter->rx_itr_setting >>2 ; +} + +static int igc_ethtool_get_previous_tx_coalesce (struct igc_adapter *adapter) +{ +return (adapter->tx_itr_setting <=3 ) ? + adapter->tx_itr_setting : adapter->tx_itr_setting >>2 ; +} + static int igc_ethtool_get_coalesce(struct net_device *netdev, struct ethtool_coalesce *ec, struct kernel_ethtool_coalesce *kernel_coal,
@@ -874,17 +886,8 @@ static int igc_ethtool_get_coalesce(struct net_device *netdev, {struct igc_adapter *adapter =netdev_priv (netdev); -if (adapter->rx_itr_setting <=3 ) - ec->rx_coalesce_usecs = adapter->rx_itr_setting; -else - ec->rx_coalesce_usecs = adapter->rx_itr_setting >>2 ; - -if (!(adapter->flags &IGC_FLAG_QUEUE_PAIRS )) { -if (adapter->tx_itr_setting <=3 ) - ec->tx_coalesce_usecs = adapter->tx_itr_setting; -else - ec->tx_coalesce_usecs = adapter->tx_itr_setting >>2 ; - } + ec->rx_coalesce_usecs =igc_ethtool_get_previous_rx_coalesce (adapter); + ec->tx_coalesce_usecs =igc_ethtool_get_previous_tx_coalesce (adapter);return 0 ; }
@@ -909,8 +912,12 @@ static int igc_ethtool_set_coalesce(struct net_device *netdev, ec->tx_coalesce_usecs == 2)return -EINVAL ; -if ((adapter->flags &IGC_FLAG_QUEUE_PAIRS ) && ec->tx_coalesce_usecs) +if ((adapter->flags &IGC_FLAG_QUEUE_PAIRS ) && + ec->tx_coalesce_usecs !=igc_ethtool_get_previous_tx_coalesce (adapter)) { +NL_SET_ERR_MSG_MOD (extack, +"Queue Pair mode enabled, both Rx and Tx coalescing controlled by rx-usecs" );return -EINVAL ; + }/* If ITR is disabled, disable DMAC */ if (ec->rx_coalesce_usecs ==0 ) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 85/259 proc: nommu: /proc/<pid>/maps: release mmap read lock
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Wolsieffer <[email protected]>
[ Upstream commit 578d7699e5c2add8c2e9549d9d75dfb56c460cb3 ]
The no-MMU implementation of /proc/<pid>/map doesn't normally release the mmap read lock, because it uses !IS_ERR_OR_NULL(_vml) to determine whether to release the lock. Since _vml is NULL when the end of the mappings is reached, the lock is not released.
Reading /proc/1/maps twice doesn't cause a hang because it only takes the read lock, which can be taken multiple times and therefore doesn't show any problem if the lock isn't released. Instead, you need to perform some operation that attempts to take the write lock after reading /proc/<pid>/maps. To actually reproduce the bug, compile the following code as 'proc_maps_bug':
#include <stdio.h>
#include <unistd.h>
#include <sys/mman.h>
int main(int argc, char *argv[]) {
void *buf;
sleep(1);
buf = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
puts("mmap returned");
return 0;
}Then, run:
./proc_maps_bug &; cat /proc/$!/maps; fg
Without this patch, mmap() will hang and the command will never complete.
This code was incorrectly adapted from the MMU implementation, which at the time released the lock in m_next() before returning the last entry.
The MMU implementation has diverged further from the no-MMU version since then, so this patch brings their locking and error handling into sync, fixing the bug and hopefully avoiding similar issues in the future.
Stable-dep-of: fe4419801617 ("proc: nommu: fix empty /proc/<pid>/maps")
--- fs/proc/task_nommu.c | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-)
fs/proc/task_nommu.c +15 -12
@@ -205,11 +205,16 @@ static void *m_start(struct seq_file *m, loff_t *pos)return ERR_PTR (-ESRCH ); mm = priv->mm; -if (!mm || !mmget_not_zero (mm)) +if (!mm || !mmget_not_zero (mm)) { +put_task_struct (priv->task); + priv->task =NULL ;return NULL ; + }if (mmap_read_lock_killable (mm)) {mmput (mm); +put_task_struct (priv->task); + priv->task =NULL ;return ERR_PTR (-EINTR ); }
@@ -218,23 +223,21 @@ static void *m_start(struct seq_file *m, loff_t *pos)if (vma)return vma; -mmap_read_unlock (mm); -mmput (mm);return NULL ; } -static void m_stop (struct seq_file *m,void *_vml) +static void m_stop (struct seq_file *m,void *v) {struct proc_maps_private *priv = m->private; +struct mm_struct *mm = priv->mm; -if (!IS_ERR_OR_NULL (_vml)) { -mmap_read_unlock (priv->mm); -mmput (priv->mm); - } -if (priv->task) { -put_task_struct (priv->task); - priv->task =NULL ; - } +if (!priv->task) +return ; + +mmap_read_unlock (mm); +mmput (mm); +put_task_struct (priv->task); + priv->task =NULL ; }static void *m_next (struct seq_file *m,void *_p,loff_t *pos)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 86/259 proc: nommu: fix empty /proc/<pid>/maps
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Wolsieffer <[email protected]>
[ Upstream commit fe4419801617514765974f3e796269bc512ad146 ]
On no-MMU, /proc/<pid>/maps reads as an empty file. This happens because find_vma(mm, 0) always returns NULL (assuming no vma actually contains the zero address, which is normally the case).
To fix this bug and improve the maintainability in the future, this patch makes the no-MMU implementation as similar as possible to the MMU implementation.
The only remaining differences are the lack of hold/release_task_mempolicy and the extra code to shoehorn the gate vma into the iterator.
This has been tested on top of 6.5.3 on an STM32F746.
--- fs/proc/internal.h | 2 -- fs/proc/task_nommu.c | 37 ++++++++++++++++++++++--------------- 2 files changed, 22 insertions(+), 17 deletions(-)
fs/proc/internal.h +0 -2
@@ -289,9 +289,7 @@ struct proc_maps_private {struct inode *inode;struct task_struct *task;struct mm_struct *mm; -#ifdef CONFIG_MMU struct vma_iterator iter; -#endif #ifdef CONFIG_NUMA struct mempolicy *task_mempolicy;#endif
fs/proc/task_nommu.c +22 -15
@@ -188,15 +188,28 @@ static int show_map(struct seq_file *m, void *_p)return nommu_vma_show (m, _p); } -static void *m_start (struct seq_file *m,loff_t *pos) +static struct vm_area_struct *proc_get_vma (struct proc_maps_private *priv, +loff_t *ppos) +{ +struct vm_area_struct *vma =vma_next (&priv->iter); + +if (vma) { + *ppos = vma->vm_start; + }else { + *ppos =-1UL ; + } + +return vma; +} + +static void *m_start (struct seq_file *m,loff_t *ppos) {struct proc_maps_private *priv = m->private; +unsigned long last_addr = *ppos;struct mm_struct *mm; -struct vm_area_struct *vma; -unsigned long addr = *pos; -/* See m_next(). Zero at the start or after lseek. */ -if (addr ==-1UL ) +/* See proc_get_vma(). Zero at the start or after lseek. */ +if (last_addr ==-1UL )return NULL ;/* pin the task and mm whilst we play with them */
@@ -218,12 +231,9 @@ static void *m_start(struct seq_file *m, loff_t *pos)return ERR_PTR (-EINTR ); } -/* start the next element from addr */ - vma =find_vma (mm, addr); -if (vma) -return vma; +vma_iter_init (&priv->iter, mm, last_addr); -return NULL ; +return proc_get_vma (priv, ppos); }static void m_stop (struct seq_file *m,void *v)
@@ -240,12 +250,9 @@ static void m_stop(struct seq_file *m, void *v) priv->task =NULL ; } -static void *m_next (struct seq_file *m,void *_p,loff_t *pos) +static void *m_next (struct seq_file *m,void *_p,loff_t *ppos) { -struct vm_area_struct *vma = _p; - - *pos = vma->vm_end; -return find_vma (vma->vm_mm, vma->vm_end); +return proc_get_vma (m->private, ppos); }static const struct seq_operations proc_pid_maps_ops = {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 87/259 cifs: Fix UAF in cifs_demultiplex_thread()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Xiaoxu <[email protected]>
[ Upstream commit d527f51331cace562393a8038d870b3e9916686f ]
There is a UAF when xfstests on cifs:
BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 by task cifsd/923 CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45 ... Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 kasan_check_range+0x145/0x1a0 smb2_is_network_name_deleted+0x27/0x160 cifs_demultiplex_thread.cold+0x172/0x5a4 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 </TASK> Allocated by task 923: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_slab_alloc+0x54/0x60 kmem_cache_alloc+0x147/0x320 mempool_alloc+0xe1/0x260 cifs_small_buf_get+0x24/0x60 allocate_buffers+0xa1/0x1c0 cifs_demultiplex_thread+0x199/0x10d0 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 Freed by task 921: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x143/0x1b0 kmem_cache_free+0xe3/0x4d0 cifs_small_buf_release+0x29/0x90 SMB2_negotiate+0x8b7/0x1c60 smb2_negotiate+0x51/0x70 cifs_negotiate_protocol+0xf0/0x160 cifs_get_smb_ses+0x5fa/0x13c0 mount_get_conns+0x7a/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0
The UAF is because:
mount(pid: 921) | cifsd(pid: 923)
-------------------------------|-------------------------------
| cifs_demultiplex_thread
SMB2_negotiate |
cifs_send_recv |
compound_send_recv |
smb_send_rqst |
wait_for_response |
wait_event_state [1] |
| standard_receive3
| cifs_handle_standard
| handle_mid
| mid->resp_buf = buf; [2]
| dequeue_mid [3]
KILL the process [4] |
resp_iov[i].iov_base = buf |
free_rsp_buf [5] |
| is_network_name_deleted [6]
| callback1. After send request to server, wait the response until
mid->mid_state != SUBMITTED;
2. Receive response from server, and set it to mid;
3. Set the mid state to RECEIVED;
4. Kill the process, the mid state already RECEIVED, get 0;
5. Handle and release the negotiate response;
6. UAF.
It can be easily reproduce with add some delay in [3] - [6].
Only sync call has the problem since async call's callback is executed in cifsd process.
Add an extra state to mark the mid state to READY before wakeup the waitter, then it can get the resp safely.
--- fs/smb/client/cifsglob.h | 1 + fs/smb/client/transport.c | 34 +++++++++++++++++++++++----------- 2 files changed, 24 insertions(+), 11 deletions(-)
fs/smb/client/cifsglob.h +1 -0
@@ -1776,6 +1776,7 @@ static inline bool is_retryable_error(int error)#define MID_RETRY_NEEDED 8/* session closed while this request out */ #define MID_RESPONSE_MALFORMED 0x10#define MID_SHUTDOWN 0x20 +#define MID_RESPONSE_READY 0x40/* ready for other process handle the rsp */ /* Flags */ #define MID_WAIT_CANCELLED 1/* Cancelled while waiting for response */
fs/smb/client/transport.c +23 -11
@@ -35,6 +35,8 @@void cifs_wake_up_task (struct mid_q_entry *mid) { +if (mid->mid_state ==MID_RESPONSE_RECEIVED ) + mid->mid_state =MID_RESPONSE_READY ;wake_up_process (mid->callback_data); }
@@ -87,7 +89,8 @@ static void __release_mid(struct kref *refcount)struct TCP_Server_Info *server = midEntry->server;if (midEntry->resp_buf && (midEntry->mid_flags &MID_WAIT_CANCELLED ) && - midEntry->mid_state ==MID_RESPONSE_RECEIVED && + (midEntry->mid_state ==MID_RESPONSE_RECEIVED || + midEntry->mid_state ==MID_RESPONSE_READY ) && server->ops->handle_cancelled_mid) server->ops->handle_cancelled_mid (midEntry, server);
@@ -759,7 +762,8 @@ wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ)int error; error =wait_event_state (server->response_q, - midQ->mid_state !=MID_REQUEST_SUBMITTED , + midQ->mid_state !=MID_REQUEST_SUBMITTED && + midQ->mid_state !=MID_RESPONSE_RECEIVED , (TASK_KILLABLE |TASK_FREEZABLE_UNSAFE ));if (error <0 )return -ERESTARTSYS ;
@@ -912,7 +916,7 @@ cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server)spin_lock (&server->mid_lock);switch (mid->mid_state) { -case MID_RESPONSE_RECEIVED : +case MID_RESPONSE_READY :spin_unlock (&server->mid_lock);return rc;case MID_RETRY_NEEDED :
@@ -1011,6 +1015,9 @@ cifs_compound_callback(struct mid_q_entry *mid) credits.instance = server->reconnect_instance;add_credits (server, &credits, mid->optype); + +if (mid->mid_state ==MID_RESPONSE_RECEIVED ) + mid->mid_state =MID_RESPONSE_READY ; } static void
@@ -1206,7 +1213,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,send_cancel (server, &rqst[i], midQ[i]);spin_lock (&server->mid_lock); midQ[i]->mid_flags |=MID_WAIT_CANCELLED ; -if (midQ[i]->mid_state ==MID_REQUEST_SUBMITTED ) { +if (midQ[i]->mid_state ==MID_REQUEST_SUBMITTED || + midQ[i]->mid_state ==MID_RESPONSE_RECEIVED ) { midQ[i]->callback = cifs_cancelled_callback; cancelled_mid[i] = true; credits[i].value =0 ;
@@ -1227,7 +1235,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, }if (!midQ[i]->resp_buf || - midQ[i]->mid_state !=MID_RESPONSE_RECEIVED ) { + midQ[i]->mid_state !=MID_RESPONSE_READY ) { rc = -EIO ;cifs_dbg (FYI ,"Bad MID state?\n" ); goto out;
@@ -1414,7 +1422,8 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses,if (rc !=0 ) {send_cancel (server, &rqst, midQ);spin_lock (&server->mid_lock); -if (midQ->mid_state ==MID_REQUEST_SUBMITTED ) { +if (midQ->mid_state ==MID_REQUEST_SUBMITTED || + midQ->mid_state ==MID_RESPONSE_RECEIVED ) {/* no longer considered to be "in-flight" */ midQ->callback = release_mid;spin_unlock (&server->mid_lock);
@@ -1431,7 +1440,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, }if (!midQ->resp_buf || !out_buf || - midQ->mid_state !=MID_RESPONSE_RECEIVED ) { + midQ->mid_state !=MID_RESPONSE_READY ) { rc = -EIO ;cifs_server_dbg (VFS ,"Bad MID state?\n" ); goto out;
@@ -1555,14 +1564,16 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,/* Wait for a reply - allow signals to interrupt. */ rc =wait_event_interruptible (server->response_q, - (!(midQ->mid_state ==MID_REQUEST_SUBMITTED )) || + (!(midQ->mid_state ==MID_REQUEST_SUBMITTED || + midQ->mid_state ==MID_RESPONSE_RECEIVED )) || ((server->tcpStatus != CifsGood) && (server->tcpStatus != CifsNew)));/* Were we interrupted by a signal ? */ spin_lock (&server->srv_lock);if ((rc == -ERESTARTSYS ) && - (midQ->mid_state ==MID_REQUEST_SUBMITTED ) && + (midQ->mid_state ==MID_REQUEST_SUBMITTED || + midQ->mid_state ==MID_RESPONSE_RECEIVED ) && ((server->tcpStatus == CifsGood) || (server->tcpStatus == CifsNew))) {spin_unlock (&server->srv_lock);
@@ -1593,7 +1604,8 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,if (rc) {send_cancel (server, &rqst, midQ);spin_lock (&server->mid_lock); -if (midQ->mid_state ==MID_REQUEST_SUBMITTED ) { +if (midQ->mid_state ==MID_REQUEST_SUBMITTED || + midQ->mid_state ==MID_RESPONSE_RECEIVED ) {/* no longer considered to be "in-flight" */ midQ->callback = release_mid;spin_unlock (&server->mid_lock);
@@ -1613,7 +1625,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,return rc;/* rcvd frame is ok */ -if (out_buf ==NULL || midQ->mid_state !=MID_RESPONSE_RECEIVED ) { +if (out_buf ==NULL || midQ->mid_state !=MID_RESPONSE_READY ) { rc = -EIO ;cifs_tcon_dbg (VFS ,"Bad MID state?\n" ); goto out;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 88/259 gpio: tb10x: Fix an error handling path in tb10x_gpio_probe()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit b547b5e52a0587e6b25ea520bf2f9e03d00cbcb6 ]
If an error occurs after a successful irq_domain_add_linear() call, it should be undone by a corresponding irq_domain_remove(), as already done in the remove function.
--- drivers/gpio/gpio-tb10x.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/gpio/gpio-tb10x.c +5 -1
@@ -195,7 +195,7 @@ static int tb10x_gpio_probe(struct platform_device *pdev) handle_edge_irq,IRQ_NOREQUEST ,IRQ_NOPROBE , IRQ_GC_INIT_MASK_CACHE);if (ret) -return ret; + goto err_remove_domain; gc = tb10x_gpio->domain->gc->gc[0 ]; gc->reg_base = tb10x_gpio->base;
@@ -209,6 +209,10 @@ static int tb10x_gpio_probe(struct platform_device *pdev) }return 0 ; + +err_remove_domain: +irq_domain_remove (tb10x_gpio->domain); +return ret; }static int tb10x_gpio_remove (struct platform_device *pdev)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 89/259 i2c: mux: demux-pinctrl: check the return value of devm_kstrdup()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaoke Wang <[email protected]>
[ Upstream commit 7c0195fa9a9e263df204963f88a22b21688ffb66 ]
devm_kstrdup() returns pointer to allocated string on success, NULL on failure. So it is better to check the return value of it.
--- drivers/i2c/muxes/i2c-demux-pinctrl.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/i2c/muxes/i2c-demux-pinctrl.c +4 -0
@@ -243,6 +243,10 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev) props[i].name =devm_kstrdup (&pdev->dev,"status" ,GFP_KERNEL ); props[i].value =devm_kstrdup (&pdev->dev,"ok" ,GFP_KERNEL ); +if (!props[i].name || !props[i].value) { + err = -ENOMEM ; + goto err_rollback; + } props[i].length =3 ;of_changeset_init (&priv->chan[i].chgset);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 90/259 i2c: mux: gpio: Add missing fwnode_handle_put()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liang He <[email protected]>
[ Upstream commit db6aee6083a56ac4a6cd1b08fff7938072bcd0a3 ]
In i2c_mux_gpio_probe_fw(), we should add fwnode_handle_put() when break out of the iteration device_for_each_child_node() as it will automatically increase and decrease the refcounter.
--- drivers/i2c/muxes/i2c-mux-gpio.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/i2c/muxes/i2c-mux-gpio.c +3 -1
@@ -105,8 +105,10 @@ static int i2c_mux_gpio_probe_fw(struct gpiomux *mux, }else if (is_acpi_node (child)) { rc =acpi_get_local_address (ACPI_HANDLE_FWNODE (child), values + i); -if (rc) +if (rc) { +fwnode_handle_put (child);return dev_err_probe (dev, rc,"Cannot get address\n" ); + } } i++;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 91/259 i2c: xiic: Correct return value check for xiic_reinit()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Scally <[email protected]>
[ Upstream commit 59851fb05d759f13662be143eff0aae605815b0e ]
The error paths for xiic_reinit() return negative values on failure and 0 on success - this error message therefore is triggered on _success_ rather than failure. Correct the condition so it's only shown on failure as intended.
--- drivers/i2c/busses/i2c-xiic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-xiic.c +1 -1
@@ -420,7 +420,7 @@ static irqreturn_t xiic_process(int irq, void *dev_id)* reset the IP instead of just flush fifos */ ret =xiic_reinit (i2c); -if (!ret) +if (ret <0 )dev_dbg (i2c->adap.dev.parent,"reinit failed\n" );if (i2c->rx_msg) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 92/259 ARM: dts: BCM5301X: Extend RAM to full 256MB for Linksys EA6500 V2
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksey Nasibulin <[email protected]>
[ Upstream commit 91994e59079dcb455783d3f9ea338eea6f671af3 ]
Linksys ea6500-v2 have 256MB of ram. Currently we only use 128MB. Expand the definition to use all the available RAM.
--- arch/arm/boot/dts/bcm4708-linksys-ea6500-v2.dts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm/boot/dts/bcm4708-linksys-ea6500-v2.dts +2 -1
@@ -19,7 +19,8 @@ memory@0 { device_type = "memory"; - reg = <0x00000000 0x08000000>; + reg = <0x00000000 0x08000000>, + <0x88000000 0x08000000>; }; gpio-keys {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 93/259 ARM: dts: samsung: exynos4210-i9100: Fix LCD screens physical size
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Cercueil <[email protected]>
[ Upstream commit b3f3fc32e5ff1e848555af8616318cc667457f90 ]
The previous values were completely bogus, and resulted in the computed DPI ratio being much lower than reality, causing applications and UIs to misbehave.
The new values were measured by myself with a ruler.
--- arch/arm/boot/dts/exynos4210-i9100.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/exynos4210-i9100.dts +2 -2
@@ -201,8 +201,8 @@ power-on-delay = <10>; reset-delay = <10>; - panel-width-mm = <90>; - panel-height-mm = <154>; + panel-width-mm = <56>; + panel-height-mm = <93>; display-timings { timing {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 94/259 ARM: dts: qcom: msm8974pro-castor: correct inverted X of touchscreen
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 43db69268149049540b1d2bbe8a69e59d5cb43b6 ]
There is no syna,f11-flip-x property, so assume intention was to use touchscreen-inverted-x.
--- .../arm/boot/dts/qcom-msm8974pro-sony-xperia-shinano-castor.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/qcom-msm8974pro-sony-xperia-shinano-castor.dts +1 -1
@@ -131,8 +131,8 @@ rmi-f11@11 { reg = <0x11>; - syna,f11-flip-x = <1>; syna,sensor-type = <1>; + touchscreen-inverted-x; }; }; };
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 95/259 ARM: dts: qcom: msm8974pro-castor: correct touchscreen function names
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 31fba16c19c45b2b3a7c23b0bfef80aed1b29050 ]
The node names for functions of Synaptics RMI4 touchscreen must be as "rmi4-fXX", as required by bindings and Linux driver.
qcom-msm8974pro-sony-xperia-shinano-castor.dtb: synaptics@2c: Unevaluated properties are not allowed ('rmi-f01@1', 'rmi-f11@11' were unexpected)
--- .../boot/dts/qcom-msm8974pro-sony-xperia-shinano-castor.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/qcom-msm8974pro-sony-xperia-shinano-castor.dts +2 -2
@@ -124,12 +124,12 @@ syna,startup-delay-ms = <10>; - rmi-f01@1 { + rmi4-f01@1 { reg = <0x1>; syna,nosleep = <1>; }; - rmi-f11@11 { + rmi4-f11@11 { reg = <0x11>; syna,sensor-type = <1>; touchscreen-inverted-x;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 96/259 ARM: dts: qcom: msm8974pro-castor: correct touchscreen syna,nosleep-mode
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 7c74379afdfee7b13f1cd8ff1ad6e0f986aec96c ]
There is no syna,nosleep property in Synaptics RMI4 touchscreen:
qcom-msm8974pro-sony-xperia-shinano-castor.dtb: synaptics@2c: rmi4-f01@1: 'syna,nosleep' does not match any of the regexes: 'pinctrl-[0-9]+'
--- .../arm/boot/dts/qcom-msm8974pro-sony-xperia-shinano-castor.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/qcom-msm8974pro-sony-xperia-shinano-castor.dts +1 -1
@@ -126,7 +126,7 @@ rmi4-f01@1 { reg = <0x1>; - syna,nosleep = <1>; + syna,nosleep-mode = <1>; }; rmi4-f11@11 {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 97/259 f2fs: optimize iteration over sparse directories
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 59237a21776f70ffb0420611c23e7158e1317037 ]
Wei Chen reports a kernel bug as blew:
INFO: task syz-executor.0:29056 blocked for more than 143 seconds.
Not tainted 5.15.0-rc5 #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.0 state:D stack:14632 pid:29056 ppid: 6574 flags:0x00000004
Call Trace:
__schedule+0x4a1/0x1720
schedule+0x36/0xe0
rwsem_down_write_slowpath+0x322/0x7a0
fscrypt_ioctl_set_policy+0x11f/0x2a0
__f2fs_ioctl+0x1a9f/0x5780
f2fs_ioctl+0x89/0x3a0
__x64_sys_ioctl+0xe8/0x140
do_syscall_64+0x34/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xaeEric did some investigation on this issue, quoted from reply of Eric:
"Well, the quality of this bug report has a lot to be desired (not on upstream kernel, reproducer is full of totally irrelevant stuff, not sent to the mailing list of the filesystem whose disk image is being fuzzed, etc.). But what is going on is that f2fs_empty_dir() doesn't consider the case of a directory with an extremely large i_size on a malicious disk image.
Specifically, the reproducer mounts an f2fs image with a directory that has an i_size of 14814520042850357248, then calls FS_IOC_SET_ENCRYPTION_POLICY on it.
That results in a call to f2fs_empty_dir() to check whether the directory is empty. f2fs_empty_dir() then iterates through all 3616826182336513 blocks the directory allegedly contains to check whether any contain anything. i_rwsem is held during this, so anything else that tries to take it will hang."
In order to solve this issue, let's use f2fs_get_next_page_offset() to speed up iteration by skipping holes for all below functions:
- f2fs_empty_dir
- f2fs_readdir
- find_in_level
The way why we can speed up iteration was described in 'commit 3cf4574705b4 ("f2fs: introduce get_next_page_offset to speed up SEEK_DATA")'.
Meanwhile, in f2fs_empty_dir(), let's use f2fs_find_data_page() instead f2fs_get_lock_data_page(), due to i_rwsem was held in caller of f2fs_empty_dir(), there shouldn't be any races, so it's fine to not lock dentry page during lookuping dirents in the page.
Stable-dep-of: d2d9bb3b6d2f ("f2fs: get out of a repeat loop when getting a locked data page")
--- fs/f2fs/data.c | 17 ++++++++++++----- fs/f2fs/dir.c | 34 ++++++++++++++++++++++++---------- fs/f2fs/f2fs.h | 5 +++-- fs/f2fs/gc.c | 4 ++-- 4 files changed, 41 insertions(+), 19 deletions(-)
fs/f2fs/data.c +12 -5
@@ -1212,7 +1212,8 @@ int f2fs_get_block(struct dnode_of_data *dn, pgoff_t index) }struct page *f2fs_get_read_data_page (struct inode *inode,pgoff_t index, -blk_opf_t op_flags,bool for_write) +blk_opf_t op_flags,bool for_write, +pgoff_t *next_pgofs) {struct address_space *mapping = inode->i_mapping;struct dnode_of_data dn;
@@ -1238,12 +1239,17 @@ struct page *f2fs_get_read_data_page(struct inode *inode, pgoff_t index,set_new_dnode (&dn, inode,NULL ,NULL ,0 ); err =f2fs_get_dnode_of_data (&dn, index,LOOKUP_NODE ); -if (err) +if (err) { +if (err == -ENOENT && next_pgofs) + *next_pgofs =f2fs_get_next_page_offset (&dn, index); goto put_err; + }f2fs_put_dnode (&dn);if (unlikely (dn.data_blkaddr ==NULL_ADDR )) { err = -ENOENT ; +if (next_pgofs) + *next_pgofs = index +1 ; goto put_err; } if (dn.data_blkaddr != NEW_ADDR &&
@@ -1287,7 +1293,8 @@ struct page *f2fs_get_read_data_page(struct inode *inode, pgoff_t index,return ERR_PTR (err); } -struct page *f2fs_find_data_page (struct inode *inode,pgoff_t index) +struct page *f2fs_find_data_page (struct inode *inode,pgoff_t index, +pgoff_t *next_pgofs) {struct address_space *mapping = inode->i_mapping;struct page *page;
@@ -1297,7 +1304,7 @@ struct page *f2fs_find_data_page(struct inode *inode, pgoff_t index)return page;f2fs_put_page (page,0 ); - page =f2fs_get_read_data_page (inode, index,0 , false); + page =f2fs_get_read_data_page (inode, index,0 , false, next_pgofs);if (IS_ERR (page))return page;
@@ -1323,7 +1330,7 @@ struct page *f2fs_get_lock_data_page(struct inode *inode, pgoff_t index,struct address_space *mapping = inode->i_mapping;struct page *page; repeat: - page =f2fs_get_read_data_page (inode, index,0 , for_write); + page =f2fs_get_read_data_page (inode, index,0 , for_write,NULL );if (IS_ERR (page))return page;
fs/f2fs/dir.c +24 -10
@@ -340,6 +340,7 @@ static struct f2fs_dir_entry *find_in_level(struct inode *dir,unsigned int bidx, end_block;struct page *dentry_page;struct f2fs_dir_entry *de =NULL ; +pgoff_t next_pgofs;bool room = false;int max_slots;
@@ -350,12 +351,13 @@ static struct f2fs_dir_entry *find_in_level(struct inode *dir, le32_to_cpu(fname->hash) % nbucket); end_block = bidx + nblock; -for (; bidx < end_block; bidx++) { +while (bidx < end_block) {/* no need to allocate new dentry pages to all the indices */ - dentry_page =f2fs_find_data_page (dir, bidx); + dentry_page =f2fs_find_data_page (dir, bidx, &next_pgofs);if (IS_ERR (dentry_page)) {if (PTR_ERR (dentry_page) == -ENOENT ) { room = true; + bidx = next_pgofs;continue ; }else { *res_page = dentry_page;
@@ -376,6 +378,8 @@ static struct f2fs_dir_entry *find_in_level(struct inode *dir,if (max_slots >= s) room = true;f2fs_put_page (dentry_page,0 ); + + bidx++; }if (!de && room &&F2FS_I (dir)->chash != fname->hash) {
@@ -963,7 +967,7 @@ void f2fs_delete_entry(struct f2fs_dir_entry *dentry, struct page *page,bool f2fs_empty_dir (struct inode *dir) { -unsigned long bidx; +unsigned long bidx =0 ;struct page *dentry_page;unsigned int bit_pos;struct f2fs_dentry_block *dentry_blk;
@@ -972,13 +976,17 @@ bool f2fs_empty_dir(struct inode *dir)if (f2fs_has_inline_dentry (dir))return f2fs_empty_inline_dir (dir); -for (bidx =0 ; bidx < nblock; bidx++) { - dentry_page =f2fs_get_lock_data_page (dir, bidx, false); +while (bidx < nblock) { +pgoff_t next_pgofs; + + dentry_page =f2fs_find_data_page (dir, bidx, &next_pgofs);if (IS_ERR (dentry_page)) { -if (PTR_ERR (dentry_page) == -ENOENT ) +if (PTR_ERR (dentry_page) == -ENOENT ) { + bidx = next_pgofs;continue ; -else + }else {return false; + } } dentry_blk =page_address (dentry_page);
@@ -990,10 +998,12 @@ bool f2fs_empty_dir(struct inode *dir)NR_DENTRY_IN_BLOCK , bit_pos); -f2fs_put_page (dentry_page,1 ); +f2fs_put_page (dentry_page,0 );if (bit_pos <NR_DENTRY_IN_BLOCK )return false; + + bidx++; }return true; }
@@ -1111,7 +1121,8 @@ static int f2fs_readdir(struct file *file, struct dir_context *ctx) goto out_free; } -for (; n < npages; n++, ctx->pos = n *NR_DENTRY_IN_BLOCK ) { +for (; n < npages; ctx->pos = n *NR_DENTRY_IN_BLOCK ) { +pgoff_t next_pgofs;/* allow readdir() to be interrupted */ if (fatal_signal_pending (current)) {
@@ -1125,11 +1136,12 @@ static int f2fs_readdir(struct file *file, struct dir_context *ctx)page_cache_sync_readahead (inode->i_mapping, ra, file, n,min (npages - n, (pgoff_t )MAX_DIR_RA_PAGES )); - dentry_page =f2fs_find_data_page (inode, n); + dentry_page =f2fs_find_data_page (inode, n, &next_pgofs);if (IS_ERR (dentry_page)) { err =PTR_ERR (dentry_page);if (err == -ENOENT ) { err =0 ; + n = next_pgofs;continue ; }else { goto out_free;
@@ -1148,6 +1160,8 @@ static int f2fs_readdir(struct file *file, struct dir_context *ctx) }f2fs_put_page (dentry_page,0 ); + + n++; } out_free:fscrypt_fname_free_buffer (&fstr);
fs/f2fs/f2fs.h +3 -2
@@ -3784,8 +3784,9 @@ int f2fs_reserve_new_block(struct dnode_of_data *dn);int f2fs_get_block (struct dnode_of_data *dn,pgoff_t index);int f2fs_reserve_block (struct dnode_of_data *dn,pgoff_t index);struct page *f2fs_get_read_data_page (struct inode *inode,pgoff_t index, -blk_opf_t op_flags,bool for_write); -struct page *f2fs_find_data_page (struct inode *inode,pgoff_t index); +blk_opf_t op_flags,bool for_write,pgoff_t *next_pgofs); +struct page *f2fs_find_data_page (struct inode *inode,pgoff_t index, +pgoff_t *next_pgofs);struct page *f2fs_get_lock_data_page (struct inode *inode,pgoff_t index,bool for_write); struct page *f2fs_get_new_data_page(struct inode *inode,
fs/f2fs/gc.c +2 -2
@@ -1600,8 +1600,8 @@ static int gc_data_segment(struct f2fs_sb_info *sbi, struct f2fs_summary *sum,continue ; } - data_page =f2fs_get_read_data_page (inode, - start_bidx,REQ_RAHEAD , true); + data_page =f2fs_get_read_data_page (inode, start_bidx, +REQ_RAHEAD , true,NULL );f2fs_up_write (&F2FS_I (inode)->i_gc_rwsem[WRITE ]);if (IS_ERR (data_page)) {iput (inode);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 98/259 f2fs: get out of a repeat loop when getting a locked data page
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaegeuk Kim <[email protected]>
[ Upstream commit d2d9bb3b6d2fbccb5b33d3a85a2830971625a4ea ]
https://bugzilla.kernel.org/show_bug.cgi?id=216050
Somehow we're getting a page which has a different mapping. Let's avoid the infinite loop.
--- fs/f2fs/data.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
fs/f2fs/data.c +2 -6
@@ -1329,18 +1329,14 @@ struct page *f2fs_get_lock_data_page(struct inode *inode, pgoff_t index, {struct address_space *mapping = inode->i_mapping;struct page *page; -repeat: + page =f2fs_get_read_data_page (inode, index,0 , for_write,NULL );if (IS_ERR (page))return page;/* wait for read completion */ lock_page (page); -if (unlikely (page->mapping != mapping)) { -f2fs_put_page (page,1 ); - goto repeat; - } -if (unlikely (!PageUptodate (page))) { +if (unlikely (page->mapping != mapping || !PageUptodate (page))) {f2fs_put_page (page,1 );return ERR_PTR (-EIO ); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 99/259 s390/pkey: fix PKEY_TYPE_EP11_AES handling in PKEY_CLR2SECK2 IOCTL
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Holger Dengler <[email protected]>
[ Upstream commit da2863f15945de100b95c72d5656541d30956c5d ]
Commit 'fa6999e326fe ("s390/pkey: support CCA and EP11 secure ECC private keys")' introduced PKEY_TYPE_EP11_AES for the PKEY_CLR2SECK2 IOCTL to convert an AES clearkey into a securekey of this type. Unfortunately, all PKEY_CLR2SECK2 IOCTL requests with type PKEY_TYPE_EP11_AES return with an error (-EINVAL). Fix the handling for PKEY_TYPE_EP11_AES in PKEY_CLR2SECK2 IOCTL, so that userspace can convert clearkey blobs into PKEY_TYPE_EP11_AES securekey blobs.
--- drivers/s390/crypto/pkey_api.c | 16 +++++-- drivers/s390/crypto/zcrypt_ep11misc.c | 61 ++++++++++++++++++++------- drivers/s390/crypto/zcrypt_ep11misc.h | 3 +- 3 files changed, 60 insertions(+), 20 deletions(-)
drivers/s390/crypto/pkey_api.c +12 -4
@@ -212,7 +212,8 @@ static int pkey_clr2ep11key(const u8 *clrkey, size_t clrkeylen, card = apqns[i] >>16 ; dom = apqns[i] &0xFFFF ; rc =ep11_clr2keyblob (card, dom, clrkeylen *8 , -0 , clrkey, keybuf, keybuflen); +0 , clrkey, keybuf, keybuflen, +PKEY_TYPE_EP11 );if (rc ==0 )break ; }
@@ -627,6 +628,11 @@ static int pkey_clr2seckey2(const struct pkey_apqn *apqns, size_t nr_apqns,if (*keybufsize <MINEP11AESKEYBLOBSIZE )return -EINVAL ;break ; +case PKEY_TYPE_EP11_AES : +if (*keybufsize < (sizeof (struct ep11kblob_header ) + +MINEP11AESKEYBLOBSIZE )) +return -EINVAL ; +break ;default :return -EINVAL ; }
@@ -645,9 +651,11 @@ static int pkey_clr2seckey2(const struct pkey_apqn *apqns, size_t nr_apqns,for (i =0 , rc = -ENODEV ; i < nr_apqns; i++) { card = apqns[i].card; dom = apqns[i].domain; -if (ktype ==PKEY_TYPE_EP11 ) { +if (ktype ==PKEY_TYPE_EP11 || + ktype ==PKEY_TYPE_EP11_AES ) { rc =ep11_clr2keyblob (card, dom, ksize, kflags, - clrkey, keybuf, keybufsize); + clrkey, keybuf, keybufsize, + ktype); }else if (ktype ==PKEY_TYPE_CCA_DATA ) { rc =cca_clr2seckey (card, dom, ksize, clrkey, keybuf);
@@ -1361,7 +1369,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, apqns =_copy_apqns_from_user (kcs.apqns, kcs.apqn_entries);if (IS_ERR (apqns))return PTR_ERR (apqns); - kkey =kmalloc (klen,GFP_KERNEL ); + kkey =kzalloc (klen,GFP_KERNEL );if (!kkey) {kfree (apqns);return -ENOMEM ;
drivers/s390/crypto/zcrypt_ep11misc.c +46 -15
99 lines not on this page · raw message
drivers/s390/crypto/zcrypt_ep11misc.h +2 -1
@@ -113,7 +113,8 @@ int ep11_genaeskey(u16 card, u16 domain, u32 keybitsize, u32 keygenflags,* Generate EP11 AES secure key with given clear key value. */ int ep11_clr2keyblob (u16 cardnr,u16 domain,u32 keybitsize,u32 keygenflags, -const u8 *clrkey,u8 *keybuf,size_t *keybufsize); +const u8 *clrkey,u8 *keybuf,size_t *keybufsize, +u32 keytype);/* * Build a list of ep11 apqns meeting the following constrains:
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 100/259 arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Pundir <[email protected]>
[ Upstream commit 110e70fccce4f22b53986ae797d665ffb1950aa6 ]
Adding a reserved memory region for the framebuffer memory (the splash memory region set up by the bootloader).
It fixes a kernel panic (arm-smmu: Unhandled context fault at this particular memory region) reported on DB845c running v5.10.y.
--- arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 9 +++++++++ 1 file changed, 9 insertions(+)
arch/arm64/boot/dts/qcom/sdm845-db845c.dts +9 -0
@@ -100,6 +100,14 @@ }; }; + reserved-memory { + /* Cont splash region set up by the bootloader */ + cont_splash_mem: framebuffer@9d400000 { + reg = <0x0 0x9d400000 0x0 0x2400000>; + no-map; + }; + }; + lt9611_1v8: lt9611-vdd18-regulator { compatible = "regulator-fixed"; regulator-name = "LT9611_1V8";
@@ -512,6 +520,7 @@ }; &mdss { + memory-region = <&cont_splash_mem>; status = "okay"; };
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 101/259 wifi: ath11k: fix tx status reporting in encap offload mode
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pradeep Kumar Chitrapu <[email protected]>
[ Upstream commit 6257c702264c44d74c6b71f0c62a7665da2dc356 ]
ieee80211_tx_status() treats packets in 802.11 frame format and tries to extract sta address from packet header. When tx encap offload is enabled, this becomes invalid operation. Hence, switch to using ieee80211_tx_status_ext() after filling in station address for handling both 802.11 and 802.3 frames.
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
Stable-dep-of: 29d15589f084 ("wifi: ath11k: Cleanup mac80211 references on failure during tx_complete")
--- drivers/net/wireless/ath/ath11k/dp.h | 4 +++ drivers/net/wireless/ath/ath11k/dp_tx.c | 33 ++++++++++++++++++++++++- drivers/net/wireless/ath/ath11k/dp_tx.h | 1 + 3 files changed, 37 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath11k/dp.h +4 -0
@@ -303,12 +303,16 @@ struct ath11k_dp {#define HTT_TX_WBM_COMP_STATUS_OFFSET 8 +#define HTT_INVALID_PEER_ID 0xffff +/* HTT tx completion is overlaid in wbm_release_ring */ #define HTT_TX_WBM_COMP_INFO0_STATUS GENMASK(12, 9)#define HTT_TX_WBM_COMP_INFO0_REINJECT_REASON GENMASK(16, 13)#define HTT_TX_WBM_COMP_INFO0_REINJECT_REASON GENMASK(16, 13)#define HTT_TX_WBM_COMP_INFO1_ACK_RSSI GENMASK(31, 24) +#define HTT_TX_WBM_COMP_INFO2_SW_PEER_ID GENMASK(15, 0) +#define HTT_TX_WBM_COMP_INFO2_VALID BIT(21)struct htt_tx_wbm_completion {u32 info0;
drivers/net/wireless/ath/ath11k/dp_tx.c +32 -1
@@ -316,10 +316,12 @@ ath11k_dp_tx_htt_tx_complete_buf(struct ath11k_base *ab,struct dp_tx_ring *tx_ring, struct ath11k_dp_htt_wbm_tx_status *ts) { + struct ieee80211_tx_status status = { 0 };struct sk_buff *msdu;struct ieee80211_tx_info *info;struct ath11k_skb_cb *skb_cb;struct ath11k *ar; +struct ath11k_peer *peer;spin_lock (&tx_ring->tx_idr_lock); msdu =idr_remove (&tx_ring->txbuf_idr, ts->msdu_id);
@@ -341,6 +343,11 @@ ath11k_dp_tx_htt_tx_complete_buf(struct ath11k_base *ab,dma_unmap_single (ab->dev, skb_cb->paddr, msdu->len,DMA_TO_DEVICE ); +if (!skb_cb->vif) { +dev_kfree_skb_any (msdu); +return ; + } +memset (&info->status,0 ,sizeof (info->status));if (ts->acked) {
@@ -355,7 +362,23 @@ ath11k_dp_tx_htt_tx_complete_buf(struct ath11k_base *ab, } } -ieee80211_tx_status (ar->hw, msdu); +spin_lock_bh (&ab->base_lock); + peer =ath11k_peer_find_by_id (ab, ts->peer_id); +if (!peer || !peer->sta) { +ath11k_dbg (ab,ATH11K_DBG_DATA , +"dp_tx: failed to find the peer with peer_id %d\n" , + ts->peer_id); +spin_unlock_bh (&ab->base_lock); +dev_kfree_skb_any (msdu); +return ; + } +spin_unlock_bh (&ab->base_lock); + + status.sta = peer->sta; + status.info = info; + status.skb = msdu; + +ieee80211_tx_status_ext (ar->hw, &status); } static void
@@ -379,7 +402,15 @@ ath11k_dp_tx_process_htt_tx_complete(struct ath11k_base *ab, ts.msdu_id = msdu_id; ts.ack_rssi =FIELD_GET (HTT_TX_WBM_COMP_INFO1_ACK_RSSI , status_desc->info1); + +if (FIELD_GET (HTT_TX_WBM_COMP_INFO2_VALID , status_desc->info2)) + ts.peer_id =FIELD_GET (HTT_TX_WBM_COMP_INFO2_SW_PEER_ID , + status_desc->info2); +else + ts.peer_id =HTT_INVALID_PEER_ID ; +ath11k_dp_tx_htt_tx_complete_buf (ab, tx_ring, &ts); +break ;case HAL_WBM_REL_HTT_TX_COMP_STATUS_REINJ :case HAL_WBM_REL_HTT_TX_COMP_STATUS_INSPECT :
drivers/net/wireless/ath/ath11k/dp_tx.h +1 -0
@@ -13,6 +13,7 @@ struct ath11k_dp_htt_wbm_tx_status {u32 msdu_id;bool acked;int ack_rssi; +u16 peer_id; };void ath11k_dp_tx_update_txcompl (struct ath11k *ar,struct hal_tx_status *ts);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 102/259 wifi: ath11k: Cleanup mac80211 references on failure during tx_complete
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <[email protected]>
[ Upstream commit 29d15589f084d71a4ea8c544039c5839db0236e2 ]
When a function is using functions from mac80211 to free an skb then it should do it consistently and not switch to the generic dev_kfree_skb_any (or similar functions). Otherwise (like in the error handlers), mac80211 will will not be aware of the freed skb and thus not clean up related information in its internal data structures.
Not doing so lead in the past to filled up structure which then prevented new clients to connect.
--- drivers/net/wireless/ath/ath11k/dp_tx.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/wireless/ath/ath11k/dp_tx.c +3 -3
@@ -344,7 +344,7 @@ ath11k_dp_tx_htt_tx_complete_buf(struct ath11k_base *ab,dma_unmap_single (ab->dev, skb_cb->paddr, msdu->len,DMA_TO_DEVICE );if (!skb_cb->vif) { -dev_kfree_skb_any (msdu); +ieee80211_free_txskb (ar->hw, msdu);return ; }
@@ -566,12 +566,12 @@ static void ath11k_dp_tx_complete_msdu(struct ath11k *ar,dma_unmap_single (ab->dev, skb_cb->paddr, msdu->len,DMA_TO_DEVICE );if (unlikely (!rcu_access_pointer (ab->pdevs_active[ar->pdev_idx]))) { -dev_kfree_skb_any (msdu); +ieee80211_free_txskb (ar->hw, msdu);return ; }if (unlikely (!skb_cb->vif)) { -dev_kfree_skb_any (msdu); +ieee80211_free_txskb (ar->hw, msdu);return ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 103/259 scsi: qla2xxx: Select qpair depending on which CPU post_cmd() gets called
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shreyas Deodhar <[email protected]>
[ Upstream commit 1d201c81d4cc6840735bbcc99e6031503e5cf3b8 ]
In current I/O path, Tx and Rx may not be processed on same CPU. This may lead to thrashing and optimum performance may not be achieved.
Pick qpair such that Tx and Rx are processed on same CPU.
Stable-dep-of: 59f10a05b5c7 ("scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id()")
--- drivers/scsi/qla2xxx/qla_def.h | 2 ++ drivers/scsi/qla2xxx/qla_init.c | 2 -- drivers/scsi/qla2xxx/qla_inline.h | 55 +++++++++++++++++++++++++++++++ drivers/scsi/qla2xxx/qla_isr.c | 3 +- drivers/scsi/qla2xxx/qla_nvme.c | 4 +++ drivers/scsi/qla2xxx/qla_os.c | 6 ++++ 6 files changed, 69 insertions(+), 3 deletions(-)
drivers/scsi/qla2xxx/qla_def.h +2 -0
@@ -3475,6 +3475,7 @@ struct qla_msix_entry {int have_irq;int in_use;uint32_t vector; +uint32_t vector_base0;uint16_t entry;char name[30 ];void *handle;
@@ -4133,6 +4134,7 @@ struct qla_hw_data {struct req_que **req_q_map;struct rsp_que **rsp_q_map;struct qla_qpair **queue_pair_map; +struct qla_qpair **qp_cpu_map;unsigned long req_qid_map[(QLA_MAX_QUEUES /8 ) /sizeof (unsigned long )];unsigned long rsp_qid_map[(QLA_MAX_QUEUES /8 ) /sizeof (unsigned long )]; unsigned long qpair_qid_map[(QLA_MAX_QUEUES / 8)
drivers/scsi/qla2xxx/qla_init.c +0 -2
@@ -9758,8 +9758,6 @@ struct qla_qpair *qla2xxx_create_qpair(struct scsi_qla_host *vha, int qos, qpair->req = ha->req_q_map[req_id]; qpair->rsp->req = qpair->req; qpair->rsp->qpair = qpair; -/* init qpair to this cpu. Will adjust at run time. */ -qla_cpu_update (qpair,raw_smp_processor_id ());if (IS_T10_PI_CAPABLE (ha) && ql2xenabledif) {if (ha->fw_attributes &BIT_4 )
drivers/scsi/qla2xxx/qla_inline.h +55 -0
58 lines not on this page · raw message
drivers/scsi/qla2xxx/qla_isr.c +2 -1
@@ -3819,7 +3819,6 @@ void qla24xx_process_response_queue(struct scsi_qla_host *vha,if (rsp->qpair->cpuid !=smp_processor_id () || !rsp->qpair->rcv_intr) { rsp->qpair->rcv_intr =1 ; -qla_cpu_update (rsp->qpair,smp_processor_id ()); }#define __update_rsp_in (_is_shadow_hba, _rsp, _rsp_in) \
@@ -4425,6 +4424,7 @@ qla24xx_enable_msix(struct qla_hw_data *ha, struct rsp_que *rsp)for (i =0 ; i < ha->msix_count; i++) { qentry = &ha->msix_entries[i]; qentry->vector =pci_irq_vector (ha->pdev, i); + qentry->vector_base0 = i; qentry->entry = i; qentry->have_irq =0 ; qentry->in_use =0 ;
@@ -4652,5 +4652,6 @@ int qla25xx_request_irq(struct qla_hw_data *ha, struct qla_qpair *qpair, } msix->have_irq =1 ; msix->handle = qpair; +qla_mapq_init_qp_cpu_map (ha, msix, qpair);return ret; }
drivers/scsi/qla2xxx/qla_nvme.c +4 -0
@@ -609,6 +609,7 @@ static int qla_nvme_post_cmd(struct nvme_fc_local_port *lport,fc_port_t *fcport;struct srb_iocb *nvme;struct scsi_qla_host *vha; +struct qla_hw_data *ha;int rval;srb_t *sp;struct qla_qpair *qpair = hw_queue_handle;
@@ -629,6 +630,7 @@ static int qla_nvme_post_cmd(struct nvme_fc_local_port *lport,return -ENODEV ; vha = fcport->vha; + ha = vha->hw;if (test_bit (ABORT_ISP_ACTIVE , &vha->dpc_flags))return -EBUSY ;
@@ -643,6 +645,8 @@ static int qla_nvme_post_cmd(struct nvme_fc_local_port *lport,if (fcport->nvme_flag &NVME_FLAG_RESETTING )return -EBUSY ; + qpair =qla_mapq_nvme_select_qpair (ha, qpair); +/* Alloc SRB structure */ sp =qla2xxx_get_qpair_sp (vha, qpair, fcport,GFP_ATOMIC );if (!sp)
drivers/scsi/qla2xxx/qla_os.c +6 -0
@@ -480,6 +480,11 @@ static int qla2x00_alloc_queues(struct qla_hw_data *ha, struct req_que *req, "Unable to allocate memory for queue pair ptrs.\n"); goto fail_qpair_map; } +if (qla_mapq_alloc_qp_cpu_map (ha) !=0 ) { +kfree (ha->queue_pair_map); + ha->queue_pair_map =NULL ; + goto fail_qpair_map; + } }/*
@@ -554,6 +559,7 @@ static void qla2x00_free_queues(struct qla_hw_data *ha) ha->base_qpair =NULL ; } +qla_mapq_free_qp_cpu_map (ha);spin_lock_irqsave (&ha->hardware_lock, flags);for (cnt =0 ; cnt < ha->max_req_queues; cnt++) {if (!test_bit (cnt, ha->req_qid_map))
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 104/259 scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <[email protected]>
[ Upstream commit 59f10a05b5c7b675256a66e3161741239889ff80 ]
The following call trace was observed:
localhost kernel: nvme nvme0: NVME-FC{0}: controller connect complete
localhost kernel: BUG: using smp_processor_id() in preemptible [00000000] code: kworker/u129:4/75092
localhost kernel: nvme nvme0: NVME-FC{0}: new ctrl: NQN "nqn.1992-08.com.netapp:sn.b42d198afb4d11ecad6d00a098d6abfa:subsystem.PR_Channel2022_RH84_subsystem_291" localhost kernel: caller is qla_nvme_post_cmd+0x216/0x1380 [qla2xxx]
localhost kernel: CPU: 6 PID: 75092 Comm: kworker/u129:4 Kdump: loaded Tainted: G B W OE --------- --- 5.14.0-70.22.1.el9_0.x86_64+debug #1
localhost kernel: Hardware name: HPE ProLiant XL420 Gen10/ProLiant XL420 Gen10, BIOS U39 01/13/2022
localhost kernel: Workqueue: nvme-wq nvme_async_event_work [nvme_core]
localhost kernel: Call Trace:
localhost kernel: dump_stack_lvl+0x57/0x7d
localhost kernel: check_preemption_disabled+0xc8/0xd0
localhost kernel: qla_nvme_post_cmd+0x216/0x1380 [qla2xxx]
Use raw_smp_processor_id() instead of smp_processor_id().
Also use queue_work() across the driver instead of queue_work_on() thus avoiding usage of smp_processor_id() when CONFIG_DEBUG_PREEMPT is enabled.
--- drivers/scsi/qla2xxx/qla_inline.h | 2 +- drivers/scsi/qla2xxx/qla_isr.c | 6 +++--- drivers/scsi/qla2xxx/qla_target.c | 3 +-- drivers/scsi/qla2xxx/tcm_qla2xxx.c | 4 ++-- 4 files changed, 7 insertions(+), 8 deletions(-)
drivers/scsi/qla2xxx/qla_inline.h +1 -1
@@ -577,7 +577,7 @@ fcport_is_bigger(fc_port_t *fcport)static inline struct qla_qpair *qla_mapq_nvme_select_qpair (struct qla_hw_data *ha,struct qla_qpair *qpair) { -int cpuid =smp_processor_id (); +int cpuid =raw_smp_processor_id ();if (qpair->cpuid != cpuid && ha->qp_cpu_map[cpuid]) {
drivers/scsi/qla2xxx/qla_isr.c +3 -3
@@ -3817,7 +3817,7 @@ void qla24xx_process_response_queue(struct scsi_qla_host *vha,if (!ha->flags.fw_started)return ; -if (rsp->qpair->cpuid !=smp_processor_id () || !rsp->qpair->rcv_intr) { +if (rsp->qpair->cpuid !=raw_smp_processor_id () || !rsp->qpair->rcv_intr) { rsp->qpair->rcv_intr =1 ; }
@@ -4305,7 +4305,7 @@ qla2xxx_msix_rsp_q(int irq, void *dev_id) } ha = qpair->hw; -queue_work_on (smp_processor_id (), ha->wq, &qpair->q_work); +queue_work (ha->wq, &qpair->q_work);return IRQ_HANDLED ; }
@@ -4331,7 +4331,7 @@ qla2xxx_msix_rsp_q_hs(int irq, void *dev_id)wrt_reg_dword (®->hccr,HCCRX_CLR_RISC_INT );spin_unlock_irqrestore (&ha->hardware_lock, flags); -queue_work_on (smp_processor_id (), ha->wq, &qpair->q_work); +queue_work (ha->wq, &qpair->q_work);return IRQ_HANDLED ; }
drivers/scsi/qla2xxx/qla_target.c +1 -2
@@ -4442,8 +4442,7 @@ static int qlt_handle_cmd_for_atio(struct scsi_qla_host *vha,queue_work_on (cmd->se_cmd.cpuid, qla_tgt_wq, &cmd->work); }else if (ha->msix_count) {if (cmd->atio.u.isp24.fcp_cmnd.rddata) -queue_work_on (smp_processor_id (), qla_tgt_wq, - &cmd->work); +queue_work (qla_tgt_wq, &cmd->work);else queue_work_on (cmd->se_cmd.cpuid, qla_tgt_wq, &cmd->work);
drivers/scsi/qla2xxx/tcm_qla2xxx.c +2 -2
@@ -310,7 +310,7 @@ static void tcm_qla2xxx_free_cmd(struct qla_tgt_cmd *cmd) cmd->trc_flags |=TRC_CMD_DONE ;INIT_WORK (&cmd->work, tcm_qla2xxx_complete_free); -queue_work_on (smp_processor_id (), tcm_qla2xxx_free_wq, &cmd->work); +queue_work (tcm_qla2xxx_free_wq, &cmd->work); }/*
@@ -557,7 +557,7 @@ static void tcm_qla2xxx_handle_data(struct qla_tgt_cmd *cmd) cmd->trc_flags |=TRC_DATA_IN ; cmd->cmd_in_wq =1 ;INIT_WORK (&cmd->work, tcm_qla2xxx_handle_data_work); -queue_work_on (smp_processor_id (), tcm_qla2xxx_free_wq, &cmd->work); +queue_work (tcm_qla2xxx_free_wq, &cmd->work); }static int tcm_qla2xxx_chk_dif_tags (uint32_t tag)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 105/259 drm/amdkfd: Flush TLB after unmapping for GFX v9.4.3
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philip Yang <[email protected]>
[ Upstream commit 75dda67c7213c3e0d17244a8c42547c27ee746f8 ]
kfd_flush_tlb_after_unmap should return true for GFX v9.4.3, to do TLB heavyweight flush after unmapping from GPU to guarantee that the GPU will not access pages after they have been unmapped. This also helps improve the mapping to GPU performance.
Without this, KFD accidently flush TLB after mapping to GPU because the vm update sequence number is increased by previous unmapping.
Stable-dep-of: edcfe22985d0 ("drm/amdkfd: Insert missing TLB flush on GFX10 and later")
--- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_priv.h +3 -3
@@ -1349,9 +1349,9 @@ void kfd_flush_tlb(struct kfd_process_device *pdd, enum TLB_FLUSH_TYPE type);static inline bool kfd_flush_tlb_after_unmap (struct kfd_dev *dev) { -return KFD_GC_VERSION (dev) ==IP_VERSION (9 ,4 ,2 ) || - (KFD_GC_VERSION (dev) ==IP_VERSION (9 ,4 ,1 ) && - dev->adev->sdma.instance[0 ].fw_version >=18 ) || +return KFD_GC_VERSION (dev) ==IP_VERSION (9 ,4 ,3 ) || +KFD_GC_VERSION (dev) ==IP_VERSION (9 ,4 ,2 ) || + (KFD_GC_VERSION (dev) ==IP_VERSION (9 ,4 ,1 ) && dev->sdma_fw_version >=18 ) ||KFD_GC_VERSION (dev) ==IP_VERSION (9 ,4 ,0 ); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 106/259 drm/amdkfd: Insert missing TLB flush on GFX10 and later
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harish Kasiviswanathan <[email protected]>
[ Upstream commit edcfe22985d09ee8e2346c9217f5a52ab150099f ]
Heavy-weight TLB flush is required after unmap on all GPUs for correctness and security.
--- drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_priv.h +1 -2
@@ -1349,8 +1349,7 @@ void kfd_flush_tlb(struct kfd_process_device *pdd, enum TLB_FLUSH_TYPE type);static inline bool kfd_flush_tlb_after_unmap (struct kfd_dev *dev) { -return KFD_GC_VERSION (dev) ==IP_VERSION (9 ,4 ,3 ) || -KFD_GC_VERSION (dev) ==IP_VERSION (9 ,4 ,2 ) || +return KFD_GC_VERSION (dev) >IP_VERSION (9 ,4 ,2 ) || (KFD_GC_VERSION (dev) ==IP_VERSION (9 ,4 ,1 ) && dev->sdma_fw_version >=18 ) ||KFD_GC_VERSION (dev) ==IP_VERSION (9 ,4 ,0 ); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 107/259 btrfs: reset destination buffer when read_extent_buffer() gets invalid range
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <[email protected]>
[ Upstream commit 74ee79142c0a344d4eae2eb7012ebc4e82254109 ]
Commit f98b6215d7d1 ("btrfs: extent_io: do extra check for extent buffer read write functions") changed how we handle invalid extent buffer range for read_extent_buffer().
Previously if the range is invalid we just set the destination to zero, but after the patch we do nothing and error out.
This can lead to smatch static checker errors like:
fs/btrfs/print-tree.c:186 print_uuid_item() error: uninitialized symbol 'subvol_id'. fs/btrfs/tests/extent-io-tests.c:338 check_eb_bitmap() error: uninitialized symbol 'has'. fs/btrfs/tests/extent-io-tests.c:353 check_eb_bitmap() error: uninitialized symbol 'has'. fs/btrfs/uuid-tree.c:203 btrfs_uuid_tree_remove() error: uninitialized symbol 'read_subid'. fs/btrfs/uuid-tree.c:353 btrfs_uuid_tree_iterate() error: uninitialized symbol 'subid_le'. fs/btrfs/uuid-tree.c:72 btrfs_uuid_tree_lookup() error: uninitialized symbol 'data'. fs/btrfs/volumes.c:7415 btrfs_dev_stats_value() error: uninitialized symbol 'val'.
Fix those warnings by reverting back to the old memset() behavior. By this we keep the static checker happy and would still make a lot of noise when such invalid ranges are passed in.
--- fs/btrfs/extent_io.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/btrfs/extent_io.c +7 -1
@@ -5184,8 +5184,14 @@ void read_extent_buffer(const struct extent_buffer *eb, void *dstv,char *dst = (char *)dstv;unsigned long i =get_eb_page_index (start); -if (check_eb_range (eb, start, len)) +if (check_eb_range (eb, start, len)) { +/* +* Invalid range hit, reset the memory, so callers won't get +* some random garbage for their uninitialzed memory. +*/ +memset (dstv,0 , len);return ; + } offset =get_eb_offset_in_page (eb, start);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 108/259 vfio/mdev: Fix a null-ptr-deref bug for mdev_unregister_parent()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit c777b11d34e0f47dbbc4b018ef65ad030f2b283a ]
Inject fault while probing mdpy.ko, if kstrdup() of create_dir() fails in kobject_add_internal() in kobject_init_and_add() in mdev_type_add() in parent_create_sysfs_files(), it will return 0 and probe successfully. And when rmmod mdpy.ko, the mdpy_dev_exit() will call mdev_unregister_parent(), the mdev_type_remove() may traverse uninitialized parent->types[i] in parent_remove_sysfs_files(), and it will cause below null-ptr-deref.
If mdev_type_add() fails, return the error code and kset_unregister() to fix the issue.
general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 2 PID: 10215 Comm: rmmod Tainted: G W N 6.6.0-rc2+ #20
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:__kobject_del+0x62/0x1c0
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 51 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 28 48 8d 7d 10 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 24 01 00 00 48 8b 75 10 48 89 df 48 8d 6b 3c e8
RSP: 0018:ffff88810695fd30 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffffffffa0270268 RCX: 0000000000000000
RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000010
RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed10233a4ef1
R10: ffff888119d2778b R11: 0000000063666572 R12: 0000000000000000
R13: fffffbfff404e2d4 R14: dffffc0000000000 R15: ffffffffa0271660
FS: 00007fbc81981540(0000) GS:ffff888119d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc14a142dc0 CR3: 0000000110a62003 CR4: 0000000000770ee0
DR0: ffffffff8fb0bce8 DR1: ffffffff8fb0bce9 DR2: ffffffff8fb0bcea
DR3: ffffffff8fb0bceb DR6: 00000000fffe0ff0 DR7: 0000000000000600
PKRU: 55555554
Call Trace:
<TASK>
? die_addr+0x3d/0xa0
? exc_general_protection+0x144/0x220
? asm_exc_general_protection+0x22/0x30
? __kobject_del+0x62/0x1c0
kobject_del+0x32/0x50
parent_remove_sysfs_files+0xd6/0x170 [mdev]
mdev_unregister_parent+0xfb/0x190 [mdev]
? mdev_register_parent+0x270/0x270 [mdev]
? find_module_all+0x9d/0xe0
mdpy_dev_exit+0x17/0x63 [mdpy]
__do_sys_delete_module.constprop.0+0x2fa/0x4b0
? module_flags+0x300/0x300
? __fput+0x4e7/0xa00
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7fbc813221b7
Code: 73 01 c3 48 8b 0d d1 8c 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d a1 8c 2c 00 f7 d8 64 89 01 48
RSP: 002b:00007ffe780e0648 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
RAX: ffffffffffffffda RBX: 00007ffe780e06a8 RCX: 00007fbc813221b7
RDX: 000000000000000a RSI: 0000000000000800 RDI: 000055e214df9b58
RBP: 000055e214df9af0 R08: 00007ffe780df5c1 R09: 0000000000000000
R10: 00007fbc8139ecc0 R11: 0000000000000206 R12: 00007ffe780e0870
R13: 00007ffe780e0ed0 R14: 000055e214df9260 R15: 000055e214df9af0
</TASK>
Modules linked in: mdpy(-) mdev vfio_iommu_type1 vfio [last unloaded: mdpy]
Dumping ftrace buffer:
(ftrace buffer empty)
---[ end trace 0000000000000000 ]---
RIP: 0010:__kobject_del+0x62/0x1c0
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 51 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 28 48 8d 7d 10 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 24 01 00 00 48 8b 75 10 48 89 df 48 8d 6b 3c e8
RSP: 0018:ffff88810695fd30 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffffffffa0270268 RCX: 0000000000000000
RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000010
RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed10233a4ef1
R10: ffff888119d2778b R11: 0000000063666572 R12: 0000000000000000
R13: fffffbfff404e2d4 R14: dffffc0000000000 R15: ffffffffa0271660
FS: 00007fbc81981540(0000) GS:ffff888119d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc14a142dc0 CR3: 0000000110a62003 CR4: 0000000000770ee0
DR0: ffffffff8fb0bce8 DR1: ffffffff8fb0bce9 DR2: ffffffff8fb0bcea
DR3: ffffffff8fb0bceb DR6: 00000000fffe0ff0 DR7: 0000000000000600
PKRU: 55555554
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 1 seconds..--- drivers/vfio/mdev/mdev_sysfs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/vfio/mdev/mdev_sysfs.c +2 -1
@@ -233,7 +233,8 @@ int parent_create_sysfs_files(struct mdev_parent *parent) out_err:while (--i >=0 )mdev_type_remove (parent->types[i]); -return 0 ; +kset_unregister (parent->mdev_types_kset); +return ret; } static ssize_t remove_store(struct device *dev, struct device_attribute *attr,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 109/259 MIPS: Alchemy: only build mmc support helpers if au1xmmc is enabled
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit ef8f8f04a0b25e8f294b24350e8463a8d6a9ba0b ]
While commit d4a5c59a955b ("mmc: au1xmmc: force non-modular build and remove symbol_get usage") to be built in, it can still build a kernel without MMC support and thuse no mmc_detect_change symbol at all.
Add ifdefs to build the mmc support code in the alchemy arch code conditional on mmc support.
--- arch/mips/alchemy/devboards/db1000.c | 4 ++++ arch/mips/alchemy/devboards/db1200.c | 6 ++++++ arch/mips/alchemy/devboards/db1300.c | 4 ++++ 3 files changed, 14 insertions(+)
arch/mips/alchemy/devboards/db1000.c +4 -0
@@ -164,6 +164,7 @@ static struct platform_device db1x00_audio_dev = {/******************************************************************************/ +#ifdef CONFIG_MMC_AU1X static irqreturn_t db1100_mmc_cd (int irq,void *ptr) {mmc_detect_change (ptr,msecs_to_jiffies (500 ));
@@ -369,6 +370,7 @@ static struct platform_device db1100_mmc1_dev = { .num_resources = ARRAY_SIZE(au1100_mmc1_res), .resource = au1100_mmc1_res, }; +#endif /* CONFIG_MMC_AU1X */ /******************************************************************************/
@@ -432,8 +434,10 @@ static struct platform_device *db1x00_devs[] = {static struct platform_device *db1100_devs[] = { &au1100_lcd_device, +#ifdef CONFIG_MMC_AU1X &db1100_mmc0_dev, &db1100_mmc1_dev, +#endif };int __init db1000_dev_setup (void )
arch/mips/alchemy/devboards/db1200.c +6 -0
@@ -326,6 +326,7 @@ static struct platform_device db1200_ide_dev = {/**********************************************************************/ +#ifdef CONFIG_MMC_AU1X /* SD carddetects: they're supposed to be edge-triggered, but ack * doesn't seem to work (CPLD Rev 2). Instead, the screaming one * is disabled and its counterpart enabled. The 200ms timeout is
@@ -584,6 +585,7 @@ static struct platform_device pb1200_mmc1_dev = { .num_resources = ARRAY_SIZE(au1200_mmc1_res), .resource = au1200_mmc1_res, }; +#endif /* CONFIG_MMC_AU1X */ /**********************************************************************/
@@ -751,7 +753,9 @@ static struct platform_device db1200_audiodma_dev = {static struct platform_device *db1200_devs[]__initdata = {NULL ,/* PSC0, selected by S6.8 */ &db1200_ide_dev, +#ifdef CONFIG_MMC_AU1X &db1200_mmc0_dev, +#endif &au1200_lcd_dev, &db1200_eth_dev, &db1200_nand_dev,
@@ -762,7 +766,9 @@ static struct platform_device *db1200_devs[] __initdata = { };static struct platform_device *pb1200_devs[]__initdata = { +#ifdef CONFIG_MMC_AU1X &pb1200_mmc1_dev, +#endif };/* Some peripheral base addresses differ on the PB1200 */
arch/mips/alchemy/devboards/db1300.c +4 -0
@@ -450,6 +450,7 @@ static struct platform_device db1300_ide_dev = {/**********************************************************************/ +#ifdef CONFIG_MMC_AU1X static irqreturn_t db1300_mmc_cd (int irq,void *ptr) {disable_irq_nosync (irq);
@@ -632,6 +633,7 @@ static struct platform_device db1300_sd0_dev = { .resource = au1300_sd0_res, .num_resources = ARRAY_SIZE(au1300_sd0_res), }; +#endif /* CONFIG_MMC_AU1X */ /**********************************************************************/
@@ -767,8 +769,10 @@ static struct platform_device *db1300_dev[] __initdata = { &db1300_5waysw_dev, &db1300_nand_dev, &db1300_ide_dev, +#ifdef CONFIG_MMC_AU1X &db1300_sd0_dev, &db1300_sd1_dev, +#endif &db1300_lcd_dev, &db1300_ac97_dev, &db1300_i2s_dev,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 110/259 spi: spi-gxp: BUG: Correct spi write return value
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Kearney <[email protected]>
[ Upstream commit 1a8196a93e493c0a50b800cb09cef60b124eee15 ]
Bug fix to correct return value of gxp_spi_write function to zero. Completion of succesful operation should return zero.
--- drivers/spi/spi-gxp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-gxp.c +1 -1
@@ -195,7 +195,7 @@ static ssize_t gxp_spi_write(struct gxp_spi_chip *chip, const struct spi_mem_opreturn ret; } -return write_len; +return 0 ; }static int do_gxp_exec_mem_op (struct spi_mem *mem,const struct spi_mem_op *op)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 111/259 drm/bridge: ti-sn65dsi83: Do not generate HFP/HBP/HSA and EOT packet
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit ca161b259cc84fe1f4a2ce4c73c3832cf6f713f1 ]
Do not generate the HS front and back porch gaps, the HSA gap and EOT packet, as per "SN65DSI83 datasheet SLLSEC1I - SEPTEMBER 2012
- REVISED OCTOBER 2020", page 22, these packets are not required. This makes the TI SN65DSI83 bridge work with Samsung DSIM on i.MX8MN.
--- drivers/gpu/drm/bridge/ti-sn65dsi83.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/bridge/ti-sn65dsi83.c +3 -1
@@ -655,7 +655,9 @@ static int sn65dsi83_host_attach(struct sn65dsi83 *ctx) dsi->lanes = dsi_lanes; dsi->format =MIPI_DSI_FMT_RGB888 ; - dsi->mode_flags =MIPI_DSI_MODE_VIDEO |MIPI_DSI_MODE_VIDEO_BURST ; + dsi->mode_flags =MIPI_DSI_MODE_VIDEO |MIPI_DSI_MODE_VIDEO_BURST | +MIPI_DSI_MODE_VIDEO_NO_HFP |MIPI_DSI_MODE_VIDEO_NO_HBP | +MIPI_DSI_MODE_VIDEO_NO_HSA |MIPI_DSI_MODE_NO_EOT_PACKET ; ret =devm_mipi_dsi_attach (dev, dsi);if (ret <0 ) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 112/259 bus: ti-sysc: Use fsleep() instead of usleep_range() in sysc_reset()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julien Panis <[email protected]>
[ Upstream commit d929b2b7464f95ec01e47f560b1e687482ba8929 ]
The am335x-evm started producing boot errors because of subtle timing changes:
Unhandled fault: external abort on non-linefetch (0x1008) at 0xf03c1010
...sysc_reset from sysc_probe+0xf60/0x1514sysc_probe from platform_probe+0x5c/0xbc
...
The fix consists in using the appropriate sleep function in sysc reset. For flexible sleeping, fsleep is recommended. Here, sysc delay parameter can take any value in [0 - 255] us range. As a result, fsleep() should be used, calling udelay() for a sysc delay lower than 10 us.
Message-ID: <[email protected]>
--- drivers/bus/ti-sysc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/bus/ti-sysc.c +1 -2
@@ -2166,8 +2166,7 @@ static int sysc_reset(struct sysc *ddata) }if (ddata->cfg.srst_udelay) -usleep_range (ddata->cfg.srst_udelay, - ddata->cfg.srst_udelay *2 ); +fsleep (ddata->cfg.srst_udelay);if (ddata->post_reset_quirk) ddata->post_reset_quirk (ddata);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 113/259 bus: ti-sysc: Fix missing AM35xx SoC matching
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Ford <[email protected]>
[ Upstream commit 11729caa520950e17cd81bc43ffc477c46cf791e ]
Commit feaa8baee82a ("bus: ti-sysc: Implement SoC revision handling") created a list of SoC types searching for strings based on names and wildcards which associates the SoC to different families.
The OMAP34xx and OMAP35xx are treated as SOC_3430 while OMAP36xx and OMAP37xx are treated as SOC_3630, but the AM35xx isn't listed.
The AM35xx is mostly an OMAP3430, and a later commit a12315d6d270 ("bus: ti-sysc: Make omap3 gpt12 quirk handling SoC specific") looks for the SOC type and behaves in a certain way if it's SOC_3430.
This caused a regression on the AM3517 causing it to return two errors:
ti-sysc: probe of 48318000.target-module failed with error -16
ti-sysc: probe of 49032000.target-module failed with error -16
Fix this by treating the creating SOC_AM35 and inserting it between the SOC_3430 and SOC_3630. If it is treaed the same way as the SOC_3430 when checking the status of sysc_check_active_timer, the error conditions will disappear.
Message-ID: <[email protected]>
--- drivers/bus/ti-sysc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/bus/ti-sysc.c +4 -2
@@ -38,6 +38,7 @@ enum sysc_soc {SOC_2420 ,SOC_2430 ,SOC_3430 , +SOC_AM35 ,SOC_3630 ,SOC_4430 , SOC_4460,
@@ -1878,7 +1879,7 @@ static void sysc_pre_reset_quirk_dss(struct sysc *ddata)dev_warn (ddata->dev,"%s: timed out %08x !+ %08x\n" , __func__, val, irq_mask); -if (sysc_soc->soc ==SOC_3430 ) { +if (sysc_soc->soc ==SOC_3430 || sysc_soc->soc ==SOC_AM35 ) {/* Clear DSS_SDI_CONTROL */ sysc_write (ddata,0x44 ,0 );
@@ -3042,6 +3043,7 @@ static void ti_sysc_idle(struct work_struct *work)static const struct soc_device_attribute sysc_soc_match[] = {SOC_FLAG ("OMAP242*" ,SOC_2420 ),SOC_FLAG ("OMAP243*" ,SOC_2430 ), +SOC_FLAG ("AM35*" ,SOC_AM35 ),SOC_FLAG ("OMAP3[45]*" ,SOC_3430 ),SOC_FLAG ("OMAP3[67]*" ,SOC_3630 ),SOC_FLAG ("OMAP443*" ,SOC_4430 ),
@@ -3248,7 +3250,7 @@ static int sysc_check_active_timer(struct sysc *ddata)* can be dropped if we stop supporting old beagleboard revisions * A to B4 at some point. */ -if (sysc_soc->soc ==SOC_3430 ) +if (sysc_soc->soc ==SOC_3430 || sysc_soc->soc ==SOC_AM35 ) error = -ENXIO ;else error = -EBUSY ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 114/259 firmware: arm_scmi: Harden perf domain info access
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Marussi <[email protected]>
[ Upstream commit 3da82112355bba263597fcbb24d275fc57e69e7e ]
Harden internal accesses to domain info in the SCMI perf protocol.
Stable-dep-of: c3638b851bc1 ("firmware: arm_scmi: Fixup perf power-cost/microwatt support")
--- drivers/firmware/arm_scmi/perf.c | 89 +++++++++++++++++++++++--------- 1 file changed, 64 insertions(+), 25 deletions(-)
drivers/firmware/arm_scmi/perf.c +64 -25
@@ -139,7 +139,7 @@ struct perf_dom_info {struct scmi_perf_info {u32 version; -int num_domains; +u16 num_domains;enum scmi_power_scale power_scale;u64 stats_addr;u32 stats_size;
@@ -356,11 +356,26 @@ static int scmi_perf_mb_limits_set(const struct scmi_protocol_handle *ph,return ret; } +static inline struct perf_dom_info * +scmi_perf_domain_lookup (const struct scmi_protocol_handle *ph,u32 domain) +{ +struct scmi_perf_info *pi = ph->get_priv (ph); + +if (domain >= pi->num_domains) +return ERR_PTR (-EINVAL ); + +return pi->dom_info + domain; +} +static int scmi_perf_limits_set (const struct scmi_protocol_handle *ph,u32 domain,u32 max_perf,u32 min_perf) {struct scmi_perf_info *pi = ph->get_priv (ph); -struct perf_dom_info *dom = pi->dom_info + domain; +struct perf_dom_info *dom; + + dom =scmi_perf_domain_lookup (ph, domain); +if (IS_ERR (dom)) +return PTR_ERR (dom);if (PROTOCOL_REV_MAJOR (pi->version) >=0x3 && !max_perf && !min_perf)return -EINVAL ;
@@ -408,8 +423,11 @@ static int scmi_perf_mb_limits_get(const struct scmi_protocol_handle *ph,static int scmi_perf_limits_get (const struct scmi_protocol_handle *ph,u32 domain,u32 *max_perf,u32 *min_perf) { -struct scmi_perf_info *pi = ph->get_priv (ph); -struct perf_dom_info *dom = pi->dom_info + domain; +struct perf_dom_info *dom; + + dom =scmi_perf_domain_lookup (ph, domain); +if (IS_ERR (dom)) +return PTR_ERR (dom);if (dom->fc_info && dom->fc_info[PERF_FC_LIMIT ].get_addr) {struct scmi_fc_info *fci = &dom->fc_info[PERF_FC_LIMIT ];
@@ -449,8 +467,11 @@ static int scmi_perf_mb_level_set(const struct scmi_protocol_handle *ph,static int scmi_perf_level_set (const struct scmi_protocol_handle *ph,u32 domain,u32 level,bool poll) { -struct scmi_perf_info *pi = ph->get_priv (ph); -struct perf_dom_info *dom = pi->dom_info + domain; +struct perf_dom_info *dom; + + dom =scmi_perf_domain_lookup (ph, domain); +if (IS_ERR (dom)) +return PTR_ERR (dom);if (dom->fc_info && dom->fc_info[PERF_FC_LEVEL ].set_addr) {struct scmi_fc_info *fci = &dom->fc_info[PERF_FC_LEVEL ];
@@ -490,8 +511,11 @@ static int scmi_perf_mb_level_get(const struct scmi_protocol_handle *ph,static int scmi_perf_level_get (const struct scmi_protocol_handle *ph,u32 domain,u32 *level,bool poll) { -struct scmi_perf_info *pi = ph->get_priv (ph); -struct perf_dom_info *dom = pi->dom_info + domain; +struct perf_dom_info *dom; + + dom =scmi_perf_domain_lookup (ph, domain); +if (IS_ERR (dom)) +return PTR_ERR (dom);if (dom->fc_info && dom->fc_info[PERF_FC_LEVEL ].get_addr) { *level =ioread32 (dom->fc_info[PERF_FC_LEVEL ].get_addr);
@@ -574,13 +598,14 @@ static int scmi_dvfs_device_opps_add(const struct scmi_protocol_handle *ph,unsigned long freq;struct scmi_opp *opp;struct perf_dom_info *dom; -struct scmi_perf_info *pi = ph->get_priv (ph); domain =scmi_dev_domain_id (dev);if (domain <0 ) -return domain; +return -EINVAL ; - dom = pi->dom_info + domain; + dom =scmi_perf_domain_lookup (ph, domain); +if (IS_ERR (dom)) +return PTR_ERR (dom);for (opp = dom->opp, idx =0 ; idx < dom->opp_count; idx++, opp++) { freq = opp->perf * dom->mult_factor;
@@ -603,14 +628,17 @@ static int scmi_dvfs_transition_latency_get(const struct scmi_protocol_handle *ph, struct device *dev) { + int domain;struct perf_dom_info *dom; -struct scmi_perf_info *pi = ph->get_priv (ph); -int domain =scmi_dev_domain_id (dev); + domain =scmi_dev_domain_id (dev);if (domain <0 ) -return domain; +return -EINVAL ; + + dom =scmi_perf_domain_lookup (ph, domain); +if (IS_ERR (dom)) +return PTR_ERR (dom); - dom = pi->dom_info + domain;/* uS to nS */ return dom->opp[dom->opp_count -1 ].trans_latency_us *1000 ; }
@@ -618,8 +646,11 @@ scmi_dvfs_transition_latency_get(const struct scmi_protocol_handle *ph,static int scmi_dvfs_freq_set (const struct scmi_protocol_handle *ph,u32 domain,unsigned long freq,bool poll) { -struct scmi_perf_info *pi = ph->get_priv (ph); -struct perf_dom_info *dom = pi->dom_info + domain; +struct perf_dom_info *dom; + + dom =scmi_perf_domain_lookup (ph, domain); +if (IS_ERR (dom)) +return PTR_ERR (dom);return scmi_perf_level_set (ph, domain, freq / dom->mult_factor, poll); }
@@ -630,11 +661,14 @@ static int scmi_dvfs_freq_get(const struct scmi_protocol_handle *ph, u32 domain,int ret;u32 level;struct scmi_perf_info *pi = ph->get_priv (ph); -struct perf_dom_info *dom = pi->dom_info + domain; ret =scmi_perf_level_get (ph, domain, &level, poll); -if (!ret) +if (!ret) { +struct perf_dom_info *dom = pi->dom_info + domain; + +/* Note domain is validated implicitly by scmi_perf_level_get */ *freq = level * dom->mult_factor; + }return ret; }
@@ -643,15 +677,14 @@ static int scmi_dvfs_est_power_get(const struct scmi_protocol_handle *ph, u32 domain, unsigned long *freq, unsigned long *power) { - struct scmi_perf_info *pi = ph->get_priv(ph); struct perf_dom_info *dom;unsigned long opp_freq;int idx, ret = -EINVAL ;struct scmi_opp *opp; - dom = pi->dom_info + domain; -if (!dom) -return -EIO ; + dom =scmi_perf_domain_lookup (ph, domain); +if (IS_ERR (dom)) +return PTR_ERR (dom);for (opp = dom->opp, idx =0 ; idx < dom->opp_count; idx++, opp++) { opp_freq = opp->perf * dom->mult_factor;
@@ -670,10 +703,16 @@ static int scmi_dvfs_est_power_get(const struct scmi_protocol_handle *ph,static bool scmi_fast_switch_possible (const struct scmi_protocol_handle *ph,struct device *dev) { +int domain;struct perf_dom_info *dom; -struct scmi_perf_info *pi = ph->get_priv (ph); - dom = pi->dom_info +scmi_dev_domain_id (dev); + domain =scmi_dev_domain_id (dev); +if (domain <0 ) +return false; + + dom =scmi_perf_domain_lookup (ph, domain); +if (IS_ERR (dom)) +return false;return dom->fc_info && dom->fc_info[PERF_FC_LEVEL ].set_addr; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 115/259 firmware: arm_scmi: Fixup perf power-cost/microwatt support
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sibi Sankar <[email protected]>
[ Upstream commit c3638b851bc1ca0022dca9d6ca4beaa6ef03a216 ]
The perf power scale value would currently be reported as bogowatts if the platform firmware supports microwatt power scale and meets the perf major version requirements. Fix this by populating version information in the driver private data before the call to protocol attributes is made.
--- drivers/firmware/arm_scmi/perf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/firmware/arm_scmi/perf.c +2 -2
@@ -858,6 +858,8 @@ static int scmi_perf_protocol_init(const struct scmi_protocol_handle *ph)if (!pinfo)return -ENOMEM ; + pinfo->version = version; + ret =scmi_perf_attributes_get (ph, pinfo);if (ret)return ret;
@@ -877,8 +879,6 @@ static int scmi_perf_protocol_init(const struct scmi_protocol_handle *ph)scmi_perf_domain_init_fc (ph, domain, &dom->fc_info); } - pinfo->version = version; -return ph->set_priv (ph, pinfo); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 116/259 power: supply: mt6370: Fix missing error code in mt6370_chg_toggle_cfo()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harshit Mogalapalli <[email protected]>
[ Upstream commit 779873ec81306d2c40c459fa7c91a5d40655510d ]
When mt6370_chg_field_get() suceeds, ret is set to zero and returning zero when flash led is still in strobe mode looks incorrect.
--- drivers/power/supply/mt6370-charger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/power/supply/mt6370-charger.c +1 -1
@@ -324,7 +324,7 @@ static int mt6370_chg_toggle_cfo(struct mt6370_priv *priv)if (fl_strobe) {dev_err (priv->dev,"Flash led is still in strobe mode\n" ); -return ret; +return -EINVAL ; }/* cfo off */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 117/259 clk: sprd: Fix thm_parents incorrect configuration
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhifeng Tang <[email protected]>
[ Upstream commit b7b20cfe6f849c2682c5f7d3f50ede6321a5d04c ]
The thm*_clk have two clock sources 32k and 250k,excluding 32m.
--- drivers/clk/sprd/ums512-clk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/sprd/ums512-clk.c +1 -1
@@ -800,7 +800,7 @@ static SPRD_MUX_CLK_DATA(uart1_clk, "uart1-clk", uart_parents, 0x250, 0, 3, UMS512_MUX_FLAG);static const struct clk_parent_data thm_parents[] = { - { .fw_name ="ext-32m" }, + { .fw_name ="ext-32k" }, { .hw = &clk_250k.hw }, }; static SPRD_MUX_CLK_DATA(thm0_clk, "thm0-clk", thm_parents,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 118/259 clk: tegra: fix error return case for recalc_rate
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timo Alho <[email protected]>
[ Upstream commit a47b44fbb13f5e7a981b4515dcddc93a321ae89c ]
tegra-bpmp clocks driver makes implicit conversion of signed error code to unsigned value in recalc_rate operation. The behavior for recalc_rate, according to it's specification, should be that "If the driver cannot figure out a rate for this clock, it must return 0."
--- drivers/clk/tegra/clk-bpmp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/tegra/clk-bpmp.c +1 -1
@@ -159,7 +159,7 @@ static unsigned long tegra_bpmp_clk_recalc_rate(struct clk_hw *hw, err =tegra_bpmp_clk_transfer (clk->bpmp, &msg);if (err <0 ) -return err; +return 0 ;return response.rate; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 119/259 ARM: dts: omap: correct indentation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 8ae9c7a69fa14e95d032e64d8d758e3f85bee132 ]
Do not use spaces for indentation.
Stable-dep-of: 6469b2feade8 ("ARM: dts: ti: omap: Fix bandgap thermal cells addressing for omap3/4")
--- arch/arm/boot/dts/omap-gpmc-smsc911x.dtsi | 6 +-- arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi | 6 +-- arch/arm/boot/dts/omap3-cm-t3517.dts | 12 ++--- arch/arm/boot/dts/omap3-gta04.dtsi | 6 +-- arch/arm/boot/dts/omap3-ldp.dts | 2 +- arch/arm/boot/dts/omap3-n900.dts | 38 +++++++------- arch/arm/boot/dts/omap3-zoom3.dts | 44 ++++++++-------- arch/arm/boot/dts/omap4-cpu-thermal.dtsi | 24 ++++----- arch/arm/boot/dts/omap5-cm-t54.dts | 64 +++++++++++------------ 9 files changed, 101 insertions(+), 101 deletions(-)
arch/arm/boot/dts/omap-gpmc-smsc911x.dtsi +3 -3
@@ -8,9 +8,9 @@ / { vddvario: regulator-vddvario { - compatible = "regulator-fixed"; - regulator-name = "vddvario"; - regulator-always-on; + compatible = "regulator-fixed"; + regulator-name = "vddvario"; + regulator-always-on; }; vdd33a: regulator-vdd33a {
arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi +3 -3
@@ -12,9 +12,9 @@ / { vddvario: regulator-vddvario { - compatible = "regulator-fixed"; - regulator-name = "vddvario"; - regulator-always-on; + compatible = "regulator-fixed"; + regulator-name = "vddvario"; + regulator-always-on; }; vdd33a: regulator-vdd33a {
arch/arm/boot/dts/omap3-cm-t3517.dts +6 -6
@@ -11,12 +11,12 @@ model = "CompuLab CM-T3517"; compatible = "compulab,omap3-cm-t3517", "ti,am3517", "ti,omap3"; - vmmc: regulator-vmmc { - compatible = "regulator-fixed"; - regulator-name = "vmmc"; - regulator-min-microvolt = <3300000>; - regulator-max-microvolt = <3300000>; - }; + vmmc: regulator-vmmc { + compatible = "regulator-fixed"; + regulator-name = "vmmc"; + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; + }; wl12xx_vmmc2: wl12xx_vmmc2 { compatible = "regulator-fixed";
arch/arm/boot/dts/omap3-gta04.dtsi +3 -3
@@ -332,7 +332,7 @@ OMAP3_CORE1_IOPAD(0x2108, PIN_OUTPUT | MUX_MODE0) /* dss_data22.dss_data22 */ OMAP3_CORE1_IOPAD(0x210a, PIN_OUTPUT | MUX_MODE0) /* dss_data23.dss_data23 */ >; - }; + }; gps_pins: pinmux_gps_pins { pinctrl-single,pins = <
@@ -869,8 +869,8 @@ }; &hdqw1w { - pinctrl-names = "default"; - pinctrl-0 = <&hdq_pins>; + pinctrl-names = "default"; + pinctrl-0 = <&hdq_pins>; }; /* image signal processor within OMAP3 SoC */
arch/arm/boot/dts/omap3-ldp.dts +1 -1
@@ -301,5 +301,5 @@ &vaux1 { /* Needed for ads7846 */ - regulator-name = "vcc"; + regulator-name = "vcc"; };
arch/arm/boot/dts/omap3-n900.dts +19 -19
@@ -236,27 +236,27 @@ pinctrl-single,pins = < /* address lines */ - OMAP3_CORE1_IOPAD(0x207a, PIN_OUTPUT | MUX_MODE0) /* gpmc_a1.gpmc_a1 */ - OMAP3_CORE1_IOPAD(0x207c, PIN_OUTPUT | MUX_MODE0) /* gpmc_a2.gpmc_a2 */ - OMAP3_CORE1_IOPAD(0x207e, PIN_OUTPUT | MUX_MODE0) /* gpmc_a3.gpmc_a3 */ + OMAP3_CORE1_IOPAD(0x207a, PIN_OUTPUT | MUX_MODE0) /* gpmc_a1.gpmc_a1 */ + OMAP3_CORE1_IOPAD(0x207c, PIN_OUTPUT | MUX_MODE0) /* gpmc_a2.gpmc_a2 */ + OMAP3_CORE1_IOPAD(0x207e, PIN_OUTPUT | MUX_MODE0) /* gpmc_a3.gpmc_a3 */ /* data lines, gpmc_d0..d7 not muxable according to TRM */ - OMAP3_CORE1_IOPAD(0x209e, PIN_INPUT | MUX_MODE0) /* gpmc_d8.gpmc_d8 */ - OMAP3_CORE1_IOPAD(0x20a0, PIN_INPUT | MUX_MODE0) /* gpmc_d9.gpmc_d9 */ - OMAP3_CORE1_IOPAD(0x20a2, PIN_INPUT | MUX_MODE0) /* gpmc_d10.gpmc_d10 */ - OMAP3_CORE1_IOPAD(0x20a4, PIN_INPUT | MUX_MODE0) /* gpmc_d11.gpmc_d11 */ - OMAP3_CORE1_IOPAD(0x20a6, PIN_INPUT | MUX_MODE0) /* gpmc_d12.gpmc_d12 */ - OMAP3_CORE1_IOPAD(0x20a8, PIN_INPUT | MUX_MODE0) /* gpmc_d13.gpmc_d13 */ - OMAP3_CORE1_IOPAD(0x20aa, PIN_INPUT | MUX_MODE0) /* gpmc_d14.gpmc_d14 */ - OMAP3_CORE1_IOPAD(0x20ac, PIN_INPUT | MUX_MODE0) /* gpmc_d15.gpmc_d15 */ + OMAP3_CORE1_IOPAD(0x209e, PIN_INPUT | MUX_MODE0) /* gpmc_d8.gpmc_d8 */ + OMAP3_CORE1_IOPAD(0x20a0, PIN_INPUT | MUX_MODE0) /* gpmc_d9.gpmc_d9 */ + OMAP3_CORE1_IOPAD(0x20a2, PIN_INPUT | MUX_MODE0) /* gpmc_d10.gpmc_d10 */ + OMAP3_CORE1_IOPAD(0x20a4, PIN_INPUT | MUX_MODE0) /* gpmc_d11.gpmc_d11 */ + OMAP3_CORE1_IOPAD(0x20a6, PIN_INPUT | MUX_MODE0) /* gpmc_d12.gpmc_d12 */ + OMAP3_CORE1_IOPAD(0x20a8, PIN_INPUT | MUX_MODE0) /* gpmc_d13.gpmc_d13 */ + OMAP3_CORE1_IOPAD(0x20aa, PIN_INPUT | MUX_MODE0) /* gpmc_d14.gpmc_d14 */ + OMAP3_CORE1_IOPAD(0x20ac, PIN_INPUT | MUX_MODE0) /* gpmc_d15.gpmc_d15 */ /* * gpmc_ncs0, gpmc_nadv_ale, gpmc_noe, gpmc_nwe, gpmc_wait0 not muxable * according to TRM. OneNAND seems to require PIN_INPUT on clock. */ - OMAP3_CORE1_IOPAD(0x20b0, PIN_OUTPUT | MUX_MODE0) /* gpmc_ncs1.gpmc_ncs1 */ - OMAP3_CORE1_IOPAD(0x20be, PIN_INPUT | MUX_MODE0) /* gpmc_clk.gpmc_clk */ - >; + OMAP3_CORE1_IOPAD(0x20b0, PIN_OUTPUT | MUX_MODE0) /* gpmc_ncs1.gpmc_ncs1 */ + OMAP3_CORE1_IOPAD(0x20be, PIN_INPUT | MUX_MODE0) /* gpmc_clk.gpmc_clk */ + >; }; i2c1_pins: pinmux_i2c1_pins {
@@ -738,12 +738,12 @@ si4713: si4713@63 { compatible = "silabs,si4713"; - reg = <0x63>; + reg = <0x63>; - interrupts-extended = <&gpio2 21 IRQ_TYPE_EDGE_FALLING>; /* 53 */ - reset-gpios = <&gpio6 3 GPIO_ACTIVE_HIGH>; /* 163 */ - vio-supply = <&vio>; - vdd-supply = <&vaux1>; + interrupts-extended = <&gpio2 21 IRQ_TYPE_EDGE_FALLING>; /* 53 */ + reset-gpios = <&gpio6 3 GPIO_ACTIVE_HIGH>; /* 163 */ + vio-supply = <&vio>; + vdd-supply = <&vaux1>; }; bq24150a: bq24150a@6b {
arch/arm/boot/dts/omap3-zoom3.dts +22 -22
81 lines not on this page · raw message
arch/arm/boot/dts/omap4-cpu-thermal.dtsi +12 -12
@@ -13,20 +13,20 @@ cpu_thermal: cpu_thermal { polling-delay = <1000>; /* milliseconds */ /* sensor ID */ - thermal-sensors = <&bandgap 0>; + thermal-sensors = <&bandgap 0>; cpu_trips: trips { - cpu_alert0: cpu_alert { - temperature = <100000>; /* millicelsius */ - hysteresis = <2000>; /* millicelsius */ - type = "passive"; - }; - cpu_crit: cpu_crit { - temperature = <125000>; /* millicelsius */ - hysteresis = <2000>; /* millicelsius */ - type = "critical"; - }; - }; + cpu_alert0: cpu_alert { + temperature = <100000>; /* millicelsius */ + hysteresis = <2000>; /* millicelsius */ + type = "passive"; + }; + cpu_crit: cpu_crit { + temperature = <125000>; /* millicelsius */ + hysteresis = <2000>; /* millicelsius */ + type = "critical"; + }; + }; cpu_cooling_maps: cooling-maps { map0 {
arch/arm/boot/dts/omap5-cm-t54.dts +32 -32
76 lines not on this page · raw message
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 120/259 ARM: dts: ti: omap: Fix bandgap thermal cells addressing for omap3/4
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <[email protected]>
[ Upstream commit 6469b2feade8fd82d224dd3734e146536f3e9f0e ]
Fix "thermal_sys: cpu_thermal: Failed to read thermal-sensors cells: -2" error on boot for omap3/4. This is caused by wrong addressing in the dts for bandgap sensor for single sensor instances.
Note that omap4-cpu-thermal.dtsi is shared across omap4/5 and dra7, so we can't just change the addressing in omap4-cpu-thermal.dtsi.
--- arch/arm/boot/dts/omap3-cpu-thermal.dtsi | 3 +-- arch/arm/boot/dts/omap4-cpu-thermal.dtsi | 5 ++++- arch/arm/boot/dts/omap443x.dtsi | 1 + arch/arm/boot/dts/omap4460.dtsi | 1 + 4 files changed, 7 insertions(+), 3 deletions(-)
arch/arm/boot/dts/omap3-cpu-thermal.dtsi +1 -2
@@ -12,8 +12,7 @@ cpu_thermal: cpu-thermal { polling-delay = <1000>; /* milliseconds */ coefficients = <0 20000>; - /* sensor ID */ - thermal-sensors = <&bandgap 0>; + thermal-sensors = <&bandgap>; cpu_trips: trips { cpu_alert0: cpu_alert {
arch/arm/boot/dts/omap4-cpu-thermal.dtsi +4 -1
@@ -12,7 +12,10 @@ cpu_thermal: cpu_thermal { polling-delay-passive = <250>; /* milliseconds */ polling-delay = <1000>; /* milliseconds */ - /* sensor ID */ + /* + * See 44xx files for single sensor addressing, omap5 and dra7 need + * also sensor ID for addressing. + */ thermal-sensors = <&bandgap 0>; cpu_trips: trips {
arch/arm/boot/dts/omap443x.dtsi +1 -0
@@ -69,6 +69,7 @@ }; &cpu_thermal { + thermal-sensors = <&bandgap>; coefficients = <0 20000>; };
arch/arm/boot/dts/omap4460.dtsi +1 -0
@@ -79,6 +79,7 @@ }; &cpu_thermal { + thermal-sensors = <&bandgap>; coefficients = <348 (-9301)>; };
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 121/259 ARM: dts: Unify pwm-omap-dmtimer node names
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <[email protected]>
[ Upstream commit 4f15fc7c0f28ffcd6e9a56396db6edcdfa4c9925 ]
There is no reg property for pwm-omap-dmtimer.
Stable-dep-of: ac08bda1569b ("ARM: dts: ti: omap: motorola-mapphone: Fix abe_clkctrl warning on boot")
--- arch/arm/boot/dts/am335x-guardian.dts | 3 ++- arch/arm/boot/dts/am3517-evm.dts | 2 +- arch/arm/boot/dts/logicpd-torpedo-baseboard.dtsi | 2 +- arch/arm/boot/dts/motorola-mapphone-common.dtsi | 4 ++-- arch/arm/boot/dts/omap3-gta04.dtsi | 2 +- arch/arm/boot/dts/omap3-n900.dts | 2 +- 6 files changed, 8 insertions(+), 7 deletions(-)
arch/arm/boot/dts/am335x-guardian.dts +2 -1
@@ -103,8 +103,9 @@ }; - guardian_beeper: dmtimer-pwm@7 { + guardian_beeper: pwm-7 { compatible = "ti,omap-dmtimer-pwm"; + #pwm-cells = <3>; ti,timers = <&timer7>; pinctrl-names = "default"; pinctrl-0 = <&guardian_beeper_pins>;
arch/arm/boot/dts/am3517-evm.dts +1 -1
@@ -150,7 +150,7 @@ enable-gpios = <&gpio6 22 GPIO_ACTIVE_HIGH>; /* gpio_182 */ }; - pwm11: dmtimer-pwm@11 { + pwm11: pwm-11 { compatible = "ti,omap-dmtimer-pwm"; pinctrl-names = "default"; pinctrl-0 = <&pwm_pins>;
arch/arm/boot/dts/logicpd-torpedo-baseboard.dtsi +1 -1
@@ -59,7 +59,7 @@ }; }; - pwm10: dmtimer-pwm { + pwm10: pwm-10 { compatible = "ti,omap-dmtimer-pwm"; pinctrl-names = "default"; pinctrl-0 = <&pwm_pins>;
arch/arm/boot/dts/motorola-mapphone-common.dtsi +2 -2
@@ -133,7 +133,7 @@ dais = <&mcbsp2_port>, <&mcbsp3_port>; }; - pwm8: dmtimer-pwm-8 { + pwm8: pwm-8 { pinctrl-names = "default"; pinctrl-0 = <&vibrator_direction_pin>;
@@ -143,7 +143,7 @@ ti,clock-source = <0x01>; }; - pwm9: dmtimer-pwm-9 { + pwm9: pwm-9 { pinctrl-names = "default"; pinctrl-0 = <&vibrator_enable_pin>;
arch/arm/boot/dts/omap3-gta04.dtsi +1 -1
@@ -147,7 +147,7 @@ pinctrl-0 = <&backlight_pins>; }; - pwm11: dmtimer-pwm { + pwm11: pwm-11 { compatible = "ti,omap-dmtimer-pwm"; ti,timers = <&timer11>; #pwm-cells = <3>;
arch/arm/boot/dts/omap3-n900.dts +1 -1
@@ -156,7 +156,7 @@ io-channel-names = "temp", "bsi", "vbat"; }; - pwm9: dmtimer-pwm { + pwm9: pwm-9 { compatible = "ti,omap-dmtimer-pwm"; #pwm-cells = <3>; ti,timers = <&timer9>;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 122/259 ARM: dts: Unify pinctrl-single pin group nodes for omap4
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <[email protected]>
[ Upstream commit 7fff6f6d6e198ad619fea9dbbe9731999af56070 ]
We want to unify the pinctrl-single pin group nodes to use naming "pins". Otherwise non-standad pin group names will add make dtbs checks errors when the pinctrl-single yaml binding gets merged.
Stable-dep-of: ac08bda1569b ("ARM: dts: ti: omap: motorola-mapphone: Fix abe_clkctrl warning on boot")
--- .../boot/dts/motorola-mapphone-common.dtsi | 40 +++++++++---------- arch/arm/boot/dts/omap4-duovero-parlor.dts | 12 +++--- arch/arm/boot/dts/omap4-duovero.dtsi | 18 ++++----- arch/arm/boot/dts/omap4-kc1.dts | 14 +++---- arch/arm/boot/dts/omap4-mcpdm.dtsi | 2 +- arch/arm/boot/dts/omap4-panda-common.dtsi | 30 +++++++------- arch/arm/boot/dts/omap4-panda-es.dts | 8 ++-- arch/arm/boot/dts/omap4-sdp.dts | 36 ++++++++--------- .../boot/dts/omap4-var-om44customboard.dtsi | 24 +++++------ .../arm/boot/dts/omap4-var-som-om44-wlan.dtsi | 6 +-- arch/arm/boot/dts/omap4-var-som-om44.dtsi | 22 +++++----- arch/arm/boot/dts/twl6030_omap4.dtsi | 4 +- 12 files changed, 108 insertions(+), 108 deletions(-)
arch/arm/boot/dts/motorola-mapphone-common.dtsi +20 -20
@@ -352,13 +352,13 @@ &omap4_pmx_core { /* hdmi_hpd.gpio_63 */ - hdmi_hpd_gpio: pinmux_hdmi_hpd_pins { + hdmi_hpd_gpio: hdmi-hpd-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x098, PIN_INPUT | MUX_MODE3) >; }; - hdq_pins: pinmux_hdq_pins { + hdq_pins: hdq-pins { pinctrl-single,pins = < /* 0x4a100120 hdq_sio.hdq_sio aa27 */ OMAP4_IOPAD(0x120, PIN_INPUT | MUX_MODE0)
@@ -366,7 +366,7 @@ }; /* hdmi_cec.hdmi_cec, hdmi_scl.hdmi_scl, hdmi_sda.hdmi_sda */ - dss_hdmi_pins: pinmux_dss_hdmi_pins { + dss_hdmi_pins: dss-hdmi-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x09a, PIN_INPUT | MUX_MODE0) OMAP4_IOPAD(0x09c, PIN_INPUT | MUX_MODE0)
@@ -380,7 +380,7 @@ * devices. Off mode value should be tested if we have off mode working * later on. */ - mmc3_pins: pinmux_mmc3_pins { + mmc3_pins: mmc3-pins { pinctrl-single,pins = < /* 0x4a10008e gpmc_wait2.gpio_100 d23 */ OMAP4_IOPAD(0x08e, PIN_INPUT | MUX_MODE3)
@@ -406,40 +406,40 @@ }; /* gpmc_ncs0.gpio_50 */ - poweroff_gpio: pinmux_poweroff_pins { + poweroff_gpio: poweroff-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x074, PIN_OUTPUT_PULLUP | MUX_MODE3) >; }; /* kpd_row0.gpio_178 */ - tmp105_irq: pinmux_tmp105_irq { + tmp105_irq: tmp105-irq-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x18e, PIN_INPUT_PULLUP | MUX_MODE3) >; }; - usb_gpio_mux_sel1: pinmux_usb_gpio_mux_sel1_pins { + usb_gpio_mux_sel1: usb-gpio-mux-sel1-pins { /* gpio_60 */ pinctrl-single,pins = < OMAP4_IOPAD(0x088, PIN_OUTPUT | MUX_MODE3) >; }; - touchscreen_pins: pinmux_touchscreen_pins { + touchscreen_pins: touchscreen-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x180, PIN_OUTPUT | MUX_MODE3) OMAP4_IOPAD(0x1a0, PIN_INPUT_PULLUP | MUX_MODE3) >; }; - als_proximity_pins: pinmux_als_proximity_pins { + als_proximity_pins: als-proximity-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x18c, PIN_INPUT_PULLUP | MUX_MODE3) >; }; - usb_mdm6600_pins: pinmux_usb_mdm6600_pins { + usb_mdm6600_pins: usb-mdm6600-pins { pinctrl-single,pins = < /* enable 0x4a1000d8 usbb1_ulpitll_dat7.gpio_95 ag16 */ OMAP4_IOPAD(0x0d8, PIN_INPUT | MUX_MODE3)
@@ -476,7 +476,7 @@ >; }; - usb_ulpi_pins: pinmux_usb_ulpi_pins { + usb_ulpi_pins: usb-ulpi-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x196, MUX_MODE7) OMAP4_IOPAD(0x198, MUX_MODE7)
@@ -496,7 +496,7 @@ }; /* usb0_otg_dp and usb0_otg_dm */ - usb_utmi_pins: pinmux_usb_utmi_pins { + usb_utmi_pins: usb-utmi-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x196, PIN_INPUT | MUX_MODE0) OMAP4_IOPAD(0x198, PIN_INPUT | MUX_MODE0)
@@ -521,7 +521,7 @@ * when not used. If needed, we can add rts pin remux later based * on power measurements. */ - uart1_pins: pinmux_uart1_pins { + uart1_pins: uart1-pins { pinctrl-single,pins = < /* 0x4a10013c mcspi1_cs2.uart1_cts ag23 */ OMAP4_IOPAD(0x13c, PIN_INPUT_PULLUP | MUX_MODE1)
@@ -538,7 +538,7 @@ }; /* uart3_tx_irtx and uart3_rx_irrx */ - uart3_pins: pinmux_uart3_pins { + uart3_pins: uart3-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x196, MUX_MODE7) OMAP4_IOPAD(0x198, MUX_MODE7)
@@ -557,7 +557,7 @@ >; }; - uart4_pins: pinmux_uart4_pins { + uart4_pins: uart4-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x15c, PIN_INPUT | MUX_MODE0) /* uart4_rx */ OMAP4_IOPAD(0x15e, PIN_OUTPUT | MUX_MODE0) /* uart4_tx */
@@ -566,7 +566,7 @@ >; }; - mcbsp2_pins: pinmux_mcbsp2_pins { + mcbsp2_pins: mcbsp2-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x0f6, PIN_INPUT | MUX_MODE0) /* abe_mcbsp2_clkx */ OMAP4_IOPAD(0x0f8, PIN_INPUT | MUX_MODE0) /* abe_mcbsp2_dr */
@@ -575,7 +575,7 @@ >; }; - mcbsp3_pins: pinmux_mcbsp3_pins { + mcbsp3_pins: mcbsp3-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x106, PIN_INPUT | MUX_MODE1) /* abe_mcbsp3_dr */ OMAP4_IOPAD(0x108, PIN_OUTPUT | MUX_MODE1) /* abe_mcbsp3_dx */
@@ -584,13 +584,13 @@ >; }; - vibrator_direction_pin: pinmux_vibrator_direction_pin { + vibrator_direction_pin: vibrator-direction-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x1ce, PIN_OUTPUT | MUX_MODE1) /* dmtimer8_pwm_evt (gpio_27) */ >; }; - vibrator_enable_pin: pinmux_vibrator_enable_pin { + vibrator_enable_pin: vibrator-enable-pins { pinctrl-single,pins = < OMAP4_IOPAD(0X1d0, PIN_OUTPUT | MUX_MODE1) /* dmtimer9_pwm_evt (gpio_28) */ >;
@@ -598,7 +598,7 @@ }; &omap4_pmx_wkup { - usb_gpio_mux_sel2: pinmux_usb_gpio_mux_sel2_pins { + usb_gpio_mux_sel2: usb-gpio-mux-sel2-pins { /* gpio_wk0 */ pinctrl-single,pins = < OMAP4_IOPAD(0x040, PIN_OUTPUT_PULLDOWN | MUX_MODE3)
arch/arm/boot/dts/omap4-duovero-parlor.dts +6 -6
@@ -62,33 +62,33 @@ &smsc_pins >; - led_pins: pinmux_led_pins { + led_pins: led-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x116, PIN_OUTPUT | MUX_MODE3) /* abe_dmic_din3.gpio_122 */ >; }; - button_pins: pinmux_button_pins { + button_pins: button-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x114, PIN_INPUT_PULLUP | MUX_MODE3) /* abe_dmic_din2.gpio_121 */ >; }; - i2c2_pins: pinmux_i2c2_pins { + i2c2_pins: i2c2-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x126, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c2_scl */ OMAP4_IOPAD(0x128, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c2_sda */ >; }; - i2c3_pins: pinmux_i2c3_pins { + i2c3_pins: i2c3-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x12a, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c3_scl */ OMAP4_IOPAD(0x12c, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c3_sda */ >; }; - smsc_pins: pinmux_smsc_pins { + smsc_pins: smsc-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x068, PIN_INPUT | MUX_MODE3) /* gpmc_a20.gpio_44: IRQ */ OMAP4_IOPAD(0x06a, PIN_INPUT_PULLUP | MUX_MODE3) /* gpmc_a21.gpio_45: nReset */
@@ -96,7 +96,7 @@ >; }; - dss_hdmi_pins: pinmux_dss_hdmi_pins { + dss_hdmi_pins: dss-hdmi-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x098, PIN_INPUT | MUX_MODE3) /* hdmi_hpd.gpio_63 */ OMAP4_IOPAD(0x09a, PIN_INPUT | MUX_MODE0) /* hdmi_cec.hdmi_cec */
arch/arm/boot/dts/omap4-duovero.dtsi +9 -9
@@ -73,14 +73,14 @@ &hsusbb1_pins >; - twl6040_pins: pinmux_twl6040_pins { + twl6040_pins: twl6040-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x166, PIN_OUTPUT | MUX_MODE3) /* usbb2_ulpitll_nxt.gpio_160 */ OMAP4_IOPAD(0x1a0, PIN_INPUT | MUX_MODE0) /* sys_nirq2.sys_nirq2 */ >; }; - mcbsp1_pins: pinmux_mcbsp1_pins { + mcbsp1_pins: mcbsp1-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x0fe, PIN_INPUT | MUX_MODE0) /* abe_mcbsp1_clkx.abe_mcbsp1_clkx */ OMAP4_IOPAD(0x100, PIN_INPUT_PULLDOWN | MUX_MODE0) /* abe_mcbsp1_dr.abe_mcbsp1_dr */
@@ -89,7 +89,7 @@ >; }; - hsusbb1_pins: pinmux_hsusbb1_pins { + hsusbb1_pins: hsusbb1-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x0c2, PIN_INPUT_PULLDOWN | MUX_MODE4) /* usbb1_ulpitll_clk.usbb1_ulpiphy_clk */ OMAP4_IOPAD(0x0c4, PIN_OUTPUT | MUX_MODE4) /* usbb1_ulpitll_stp.usbb1_ulpiphy_stp */
@@ -106,34 +106,34 @@ >; }; - hsusb1phy_pins: pinmux_hsusb1phy_pins { + hsusb1phy_pins: hsusb1phy-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x08c, PIN_OUTPUT | MUX_MODE3) /* gpmc_wait1.gpio_62 */ >; }; - w2cbw0015_pins: pinmux_w2cbw0015_pins { + w2cbw0015_pins: w2cbw0015-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x066, PIN_OUTPUT | MUX_MODE3) /* gpmc_a19.gpio_43 */ OMAP4_IOPAD(0x07a, PIN_INPUT | MUX_MODE3) /* gpmc_ncs3.gpio_53 */ >; }; - i2c1_pins: pinmux_i2c1_pins { + i2c1_pins: i2c1-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x122, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c1_scl */ OMAP4_IOPAD(0x124, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c1_sda */ >; }; - i2c4_pins: pinmux_i2c4_pins { + i2c4_pins: i2c4-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x12e, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c4_scl */ OMAP4_IOPAD(0x130, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c4_sda */ >; }; - mmc1_pins: pinmux_mmc1_pins { + mmc1_pins: mmc1-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x0e2, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_clk */ OMAP4_IOPAD(0x0e4, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmcc1_cmd */
@@ -144,7 +144,7 @@ >; }; - mmc5_pins: pinmux_mmc5_pins { + mmc5_pins: mmc5-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x148, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc5_clk */ OMAP4_IOPAD(0x14a, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmcc5_cmd */
arch/arm/boot/dts/omap4-kc1.dts +7 -7
@@ -35,42 +35,42 @@ &omap4_pmx_core { pinctrl-names = "default"; - uart3_pins: pinmux_uart3_pins { + uart3_pins: uart3-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x144, PIN_INPUT | MUX_MODE0) /* uart3_rx_irrx */ OMAP4_IOPAD(0x146, PIN_OUTPUT | MUX_MODE0) /* uart3_tx_irtx */ >; }; - i2c1_pins: pinmux_i2c1_pins { + i2c1_pins: i2c1-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x122, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c1_scl */ OMAP4_IOPAD(0x124, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c1_sda */ >; }; - i2c2_pins: pinmux_i2c2_pins { + i2c2_pins: i2c2-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x126, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c2_scl */ OMAP4_IOPAD(0x128, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c2_sda */ >; }; - i2c3_pins: pinmux_i2c3_pins { + i2c3_pins: i2c3-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x12a, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c3_scl */ OMAP4_IOPAD(0x12c, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c3_sda */ >; }; - i2c4_pins: pinmux_i2c4_pins { + i2c4_pins: i2c4-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x12e, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c4_scl */ OMAP4_IOPAD(0x130, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c4_sda */ >; }; - mmc2_pins: pinmux_mmc2_pins { + mmc2_pins: mmc2-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x040, PIN_INPUT_PULLUP | MUX_MODE1) /* sdmmc2_dat0 */ OMAP4_IOPAD(0x042, PIN_INPUT_PULLUP | MUX_MODE1) /* sdmmc2_dat1 */
@@ -85,7 +85,7 @@ >; }; - usb_otg_hs_pins: pinmux_usb_otg_hs_pins { + usb_otg_hs_pins: usb-otg-hs-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x194, PIN_OUTPUT_PULLDOWN | MUX_MODE0) /* usba0_otg_ce */ OMAP4_IOPAD(0x196, PIN_INPUT | MUX_MODE0) /* usba0_otg_dp */
arch/arm/boot/dts/omap4-mcpdm.dtsi +1 -1
@@ -7,7 +7,7 @@ */ &omap4_pmx_core { - mcpdm_pins: pinmux_mcpdm_pins { + mcpdm_pins: mcpdm-pins { pinctrl-single,pins = < /* 0x4a100106 abe_pdm_ul_data.abe_pdm_ul_data ag25 */ OMAP4_IOPAD(0x106, PIN_INPUT_PULLDOWN | MUX_MODE0)
arch/arm/boot/dts/omap4-panda-common.dtsi +15 -15
@@ -237,14 +237,14 @@ &hsusbb1_pins >; - twl6040_pins: pinmux_twl6040_pins { + twl6040_pins: twl6040-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x120, PIN_OUTPUT | MUX_MODE3) /* hdq_sio.gpio_127 */ OMAP4_IOPAD(0x1a0, PIN_INPUT | MUX_MODE0) /* sys_nirq2.sys_nirq2 */ >; }; - mcbsp1_pins: pinmux_mcbsp1_pins { + mcbsp1_pins: mcbsp1-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x0fe, PIN_INPUT | MUX_MODE0) /* abe_mcbsp1_clkx.abe_mcbsp1_clkx */ OMAP4_IOPAD(0x100, PIN_INPUT_PULLDOWN | MUX_MODE0) /* abe_mcbsp1_dr.abe_mcbsp1_dr */
@@ -253,7 +253,7 @@ >; }; - dss_dpi_pins: pinmux_dss_dpi_pins { + dss_dpi_pins: dss-dpi-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x162, PIN_OUTPUT | MUX_MODE5) /* dispc2_data23 */ OMAP4_IOPAD(0x164, PIN_OUTPUT | MUX_MODE5) /* dispc2_data22 */
@@ -288,13 +288,13 @@ >; }; - tfp410_pins: pinmux_tfp410_pins { + tfp410_pins: tfp410-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x184, PIN_OUTPUT | MUX_MODE3) /* gpio_0 */ >; }; - dss_hdmi_pins: pinmux_dss_hdmi_pins { + dss_hdmi_pins: dss-hdmi-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x09a, PIN_INPUT | MUX_MODE0) /* hdmi_cec.hdmi_cec */ OMAP4_IOPAD(0x09c, PIN_INPUT_PULLUP | MUX_MODE0) /* hdmi_scl.hdmi_scl */
@@ -302,7 +302,7 @@ >; }; - tpd12s015_pins: pinmux_tpd12s015_pins { + tpd12s015_pins: tpd12s015-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x062, PIN_OUTPUT | MUX_MODE3) /* gpmc_a17.gpio_41 */ OMAP4_IOPAD(0x088, PIN_OUTPUT | MUX_MODE3) /* gpmc_nbe1.gpio_60 */
@@ -310,7 +310,7 @@ >; }; - hsusbb1_pins: pinmux_hsusbb1_pins { + hsusbb1_pins: hsusbb1-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x0c2, PIN_INPUT_PULLDOWN | MUX_MODE4) /* usbb1_ulpitll_clk.usbb1_ulpiphy_clk */ OMAP4_IOPAD(0x0c4, PIN_OUTPUT | MUX_MODE4) /* usbb1_ulpitll_stp.usbb1_ulpiphy_stp */
@@ -327,28 +327,28 @@ >; }; - i2c1_pins: pinmux_i2c1_pins { + i2c1_pins: i2c1-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x122, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c1_scl */ OMAP4_IOPAD(0x124, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c1_sda */ >; }; - i2c2_pins: pinmux_i2c2_pins { + i2c2_pins: i2c2-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x126, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c2_scl */ OMAP4_IOPAD(0x128, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c2_sda */ >; }; - i2c3_pins: pinmux_i2c3_pins { + i2c3_pins: i2c3-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x12a, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c3_scl */ OMAP4_IOPAD(0x12c, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c3_sda */ >; }; - i2c4_pins: pinmux_i2c4_pins { + i2c4_pins: i2c4-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x12e, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c4_scl */ OMAP4_IOPAD(0x130, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c4_sda */
@@ -359,7 +359,7 @@ * wl12xx GPIO outputs for WLAN_EN, BT_EN, FM_EN, BT_WAKEUP * REVISIT: Are the pull-ups needed for GPIO 48 and 49? */ - wl12xx_gpio: pinmux_wl12xx_gpio { + wl12xx_gpio: wl12xx-gpio-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x066, PIN_OUTPUT | MUX_MODE3) /* gpmc_a19.gpio_43 */ OMAP4_IOPAD(0x06c, PIN_OUTPUT | MUX_MODE3) /* gpmc_a22.gpio_46 */
@@ -369,7 +369,7 @@ }; /* wl12xx GPIO inputs and SDIO pins */ - wl12xx_pins: pinmux_wl12xx_pins { + wl12xx_pins: wl12xx-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x078, PIN_INPUT | MUX_MODE3) /* gpmc_ncs2.gpio_52 */ OMAP4_IOPAD(0x07a, PIN_INPUT | MUX_MODE3) /* gpmc_ncs3.gpio_53 */
@@ -382,7 +382,7 @@ >; }; - button_pins: pinmux_button_pins { + button_pins: button-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x114, PIN_INPUT_PULLUP | MUX_MODE3) /* gpio_121 */ >;
@@ -390,7 +390,7 @@ }; &omap4_pmx_wkup { - led_wkgpio_pins: pinmux_leds_wkpins { + led_wkgpio_pins: leds-wkpins-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x05a, PIN_OUTPUT | MUX_MODE3) /* gpio_wk7 */ OMAP4_IOPAD(0x05c, PIN_OUTPUT | MUX_MODE3) /* gpio_wk8 */
arch/arm/boot/dts/omap4-panda-es.dts +4 -4
@@ -38,26 +38,26 @@ }; &omap4_pmx_core { - led_gpio_pins: gpio_led_pmx { + led_gpio_pins: gpio-led-pmx-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x0f6, PIN_OUTPUT | MUX_MODE3) /* gpio_110 */ >; }; - button_pins: pinmux_button_pins { + button_pins: button-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x0fc, PIN_INPUT_PULLUP | MUX_MODE3) /* gpio_113 */ >; }; - bt_pins: pinmux_bt_pins { + bt_pins: bt-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x06c, PIN_OUTPUT | MUX_MODE3) /* gpmc_a22.gpio_46 - BTEN */ OMAP4_IOPAD(0x072, PIN_OUTPUT_PULLUP | MUX_MODE3) /* gpmc_a25.gpio_49 - BTWAKEUP */ >; }; - uart2_pins: pinmux_uart2_pins { + uart2_pins: uart2-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x118, PIN_INPUT_PULLUP | MUX_MODE0) /* uart2_cts.uart2_cts - HCI */ OMAP4_IOPAD(0x11a, PIN_OUTPUT | MUX_MODE0) /* uart2_rts.uart2_rts */
arch/arm/boot/dts/omap4-sdp.dts +18 -18
@@ -214,7 +214,7 @@ &tpd12s015_pins >; - uart2_pins: pinmux_uart2_pins { + uart2_pins: uart2-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x118, PIN_INPUT_PULLUP | MUX_MODE0) /* uart2_cts.uart2_cts */ OMAP4_IOPAD(0x11a, PIN_OUTPUT | MUX_MODE0) /* uart2_rts.uart2_rts */
@@ -223,7 +223,7 @@ >; }; - uart3_pins: pinmux_uart3_pins { + uart3_pins: uart3-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x140, PIN_INPUT_PULLUP | MUX_MODE0) /* uart3_cts_rctx.uart3_cts_rctx */ OMAP4_IOPAD(0x142, PIN_OUTPUT | MUX_MODE0) /* uart3_rts_sd.uart3_rts_sd */
@@ -232,21 +232,21 @@ >; }; - uart4_pins: pinmux_uart4_pins { + uart4_pins: uart4-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x15c, PIN_INPUT | MUX_MODE0) /* uart4_rx.uart4_rx */ OMAP4_IOPAD(0x15e, PIN_OUTPUT | MUX_MODE0) /* uart4_tx.uart4_tx */ >; }; - twl6040_pins: pinmux_twl6040_pins { + twl6040_pins: twl6040-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x120, PIN_OUTPUT | MUX_MODE3) /* hdq_sio.gpio_127 */ OMAP4_IOPAD(0x1a0, PIN_INPUT | MUX_MODE0) /* sys_nirq2.sys_nirq2 */ >; }; - dmic_pins: pinmux_dmic_pins { + dmic_pins: dmic-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x110, PIN_OUTPUT | MUX_MODE0) /* abe_dmic_clk1.abe_dmic_clk1 */ OMAP4_IOPAD(0x112, PIN_INPUT | MUX_MODE0) /* abe_dmic_din1.abe_dmic_din1 */
@@ -255,7 +255,7 @@ >; }; - mcbsp1_pins: pinmux_mcbsp1_pins { + mcbsp1_pins: mcbsp1-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x0fe, PIN_INPUT | MUX_MODE0) /* abe_mcbsp1_clkx.abe_mcbsp1_clkx */ OMAP4_IOPAD(0x100, PIN_INPUT_PULLDOWN | MUX_MODE0) /* abe_mcbsp1_dr.abe_mcbsp1_dr */
@@ -264,7 +264,7 @@ >; }; - mcbsp2_pins: pinmux_mcbsp2_pins { + mcbsp2_pins: mcbsp2-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x0f6, PIN_INPUT | MUX_MODE0) /* abe_mcbsp2_clkx.abe_mcbsp2_clkx */ OMAP4_IOPAD(0x0f8, PIN_INPUT_PULLDOWN | MUX_MODE0) /* abe_mcbsp2_dr.abe_mcbsp2_dr */
@@ -273,7 +273,7 @@ >; }; - mcspi1_pins: pinmux_mcspi1_pins { + mcspi1_pins: mcspi1-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x132, PIN_INPUT | MUX_MODE0) /* mcspi1_clk.mcspi1_clk */ OMAP4_IOPAD(0x134, PIN_INPUT | MUX_MODE0) /* mcspi1_somi.mcspi1_somi */
@@ -282,7 +282,7 @@ >; }; - dss_hdmi_pins: pinmux_dss_hdmi_pins { + dss_hdmi_pins: dss-hdmi-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x09a, PIN_INPUT | MUX_MODE0) /* hdmi_cec.hdmi_cec */ OMAP4_IOPAD(0x09c, PIN_INPUT_PULLUP | MUX_MODE0) /* hdmi_scl.hdmi_scl */
@@ -290,7 +290,7 @@ >; }; - tpd12s015_pins: pinmux_tpd12s015_pins { + tpd12s015_pins: tpd12s015-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x062, PIN_OUTPUT | MUX_MODE3) /* gpmc_a17.gpio_41 */ OMAP4_IOPAD(0x088, PIN_OUTPUT | MUX_MODE3) /* gpmc_nbe1.gpio_60 */
@@ -298,28 +298,28 @@ >; }; - i2c1_pins: pinmux_i2c1_pins { + i2c1_pins: i2c1-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x122, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c1_scl */ OMAP4_IOPAD(0x124, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c1_sda */ >; }; - i2c2_pins: pinmux_i2c2_pins { + i2c2_pins: i2c2-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x126, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c2_scl */ OMAP4_IOPAD(0x128, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c2_sda */ >; }; - i2c3_pins: pinmux_i2c3_pins { + i2c3_pins: i2c3-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x12a, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c3_scl */ OMAP4_IOPAD(0x12c, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c3_sda */ >; }; - i2c4_pins: pinmux_i2c4_pins { + i2c4_pins: i2c4-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x12e, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c4_scl */ OMAP4_IOPAD(0x130, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c4_sda */
@@ -327,14 +327,14 @@ }; /* wl12xx GPIO output for WLAN_EN */ - wl12xx_gpio: pinmux_wl12xx_gpio { + wl12xx_gpio: wl12xx-gpio-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x07c, PIN_OUTPUT | MUX_MODE3) /* gpmc_nwp.gpio_54 */ >; }; /* wl12xx GPIO inputs and SDIO pins */ - wl12xx_pins: pinmux_wl12xx_pins { + wl12xx_pins: wl12xx-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x07a, PIN_INPUT | MUX_MODE3) /* gpmc_ncs3.gpio_53 */ OMAP4_IOPAD(0x148, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc5_clk.sdmmc5_clk */
@@ -347,13 +347,13 @@ }; /* gpio_48 for ENET_ENABLE */ - enet_enable_gpio: pinmux_enet_enable_gpio { + enet_enable_gpio: enet-enable-gpio-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x070, PIN_OUTPUT_PULLDOWN | MUX_MODE3) /* gpmc_a24.gpio_48 */ >; }; - ks8851_pins: pinmux_ks8851_pins { + ks8851_pins: ks8851-pins { pinctrl-single,pins = < /* ENET_INT */ OMAP4_IOPAD(0x054, PIN_INPUT_PULLUP | MUX_MODE3) /* gpmc_ad10.gpio_34 */
arch/arm/boot/dts/omap4-var-om44customboard.dtsi +12 -12
@@ -60,7 +60,7 @@ }; &omap4_pmx_core { - uart1_pins: pinmux_uart1_pins { + uart1_pins: uart1-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x13c, PIN_INPUT_PULLUP | MUX_MODE1) /* mcspi1_cs2.uart1_cts */ OMAP4_IOPAD(0x13e, PIN_OUTPUT | MUX_MODE1) /* mcspi1_cs3.uart1_rts */
@@ -69,7 +69,7 @@ >; }; - mcspi1_pins: pinmux_mcspi1_pins { + mcspi1_pins: mcspi1-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x132, PIN_INPUT | MUX_MODE0) /* mcspi1_clk.mcspi1_clk */ OMAP4_IOPAD(0x134, PIN_INPUT | MUX_MODE0) /* mcspi1_somi.mcspi1_somi */
@@ -78,13 +78,13 @@ >; }; - mcasp_pins: pinmux_mcsasp_pins { + mcasp_pins: mcsasp-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x0f8, PIN_OUTPUT | MUX_MODE2) /* mcbsp2_dr.abe_mcasp_axr */ >; }; - dss_dpi_pins: pinmux_dss_dpi_pins { + dss_dpi_pins: dss-dpi-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x162, PIN_OUTPUT | MUX_MODE5) /* dispc2_data23 */ OMAP4_IOPAD(0x164, PIN_OUTPUT | MUX_MODE5) /* dispc2_data22 */
@@ -117,7 +117,7 @@ >; }; - dss_hdmi_pins: pinmux_dss_hdmi_pins { + dss_hdmi_pins: dss-hdmi-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x09a, PIN_INPUT | MUX_MODE0) /* hdmi_cec.hdmi_cec */ OMAP4_IOPAD(0x09c, PIN_INPUT_PULLUP | MUX_MODE0) /* hdmi_scl.hdmi_scl */
@@ -125,14 +125,14 @@ >; }; - i2c4_pins: pinmux_i2c4_pins { + i2c4_pins: i2c4-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x12e, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c4_scl */ OMAP4_IOPAD(0x130, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c4_sda */ >; }; - mmc5_pins: pinmux_mmc5_pins { + mmc5_pins: mmc5-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x0f6, PIN_INPUT | MUX_MODE3) /* abe_mcbsp2_clkx.gpio_110 */ OMAP4_IOPAD(0x148, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc5_clk.sdmmc5_clk */
@@ -144,32 +144,32 @@ >; }; - gpio_led_pins: pinmux_gpio_led_pins { + gpio_led_pins: gpio-led-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x17e, PIN_OUTPUT | MUX_MODE3) /* kpd_col4.gpio_172 */ OMAP4_IOPAD(0x180, PIN_OUTPUT | MUX_MODE3) /* kpd_col5.gpio_173 */ >; }; - gpio_key_pins: pinmux_gpio_key_pins { + gpio_key_pins: gpio-key-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x1a2, PIN_INPUT | MUX_MODE3) /* sys_boot0.gpio_184 */ >; }; - ks8851_irq_pins: pinmux_ks8851_irq_pins { + ks8851_irq_pins: ks8851-irq-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x17c, PIN_INPUT_PULLUP | MUX_MODE3) /* kpd_col3.gpio_171 */ >; }; - hdmi_hpd_pins: pinmux_hdmi_hpd_pins { + hdmi_hpd_pins: hdmi-hpd-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x098, PIN_INPUT_PULLDOWN | MUX_MODE3) /* hdmi_hpd.gpio_63 */ >; }; - backlight_pins: pinmux_backlight_pins { + backlight_pins: backlight-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x116, PIN_OUTPUT | MUX_MODE3) /* abe_dmic_din3.gpio_122 */ >;
arch/arm/boot/dts/omap4-var-som-om44-wlan.dtsi +3 -3
@@ -19,7 +19,7 @@ }; &omap4_pmx_core { - uart2_pins: pinmux_uart2_pins { + uart2_pins: uart2-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x118, PIN_INPUT_PULLUP | MUX_MODE0) /* uart2_cts.uart2_cts */ OMAP4_IOPAD(0x11a, PIN_OUTPUT | MUX_MODE0) /* uart2_rts.uart2_rts */
@@ -28,7 +28,7 @@ >; }; - wl12xx_ctrl_pins: pinmux_wl12xx_ctrl_pins { + wl12xx_ctrl_pins: wl12xx-ctrl-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x062, PIN_INPUT_PULLUP | MUX_MODE3) /* gpmc_a17.gpio_41 (WLAN_IRQ) */ OMAP4_IOPAD(0x064, PIN_OUTPUT | MUX_MODE3) /* gpmc_a18.gpio_42 (BT_EN) */
@@ -36,7 +36,7 @@ >; }; - mmc4_pins: pinmux_mmc4_pins { + mmc4_pins: mmc4-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x154, PIN_INPUT_PULLUP | MUX_MODE1) /* mcspi4_clk.sdmmc4_clk */ OMAP4_IOPAD(0x156, PIN_INPUT_PULLUP | MUX_MODE1) /* mcspi4_simo.sdmmc4_cmd */
arch/arm/boot/dts/omap4-var-som-om44.dtsi +11 -11
@@ -65,21 +65,21 @@ &hsusbb1_pins >; - twl6040_pins: pinmux_twl6040_pins { + twl6040_pins: twl6040-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x19c, PIN_OUTPUT | MUX_MODE3) /* fref_clk2_out.gpio_182 */ OMAP4_IOPAD(0x1a0, PIN_INPUT | MUX_MODE0) /* sys_nirq2.sys_nirq2 */ >; }; - tsc2004_pins: pinmux_tsc2004_pins { + tsc2004_pins: tsc2004-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x090, PIN_INPUT | MUX_MODE3) /* gpmc_ncs4.gpio_101 (irq) */ OMAP4_IOPAD(0x092, PIN_OUTPUT | MUX_MODE3) /* gpmc_ncs5.gpio_102 (rst) */ >; }; - uart3_pins: pinmux_uart3_pins { + uart3_pins: uart3-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x140, PIN_INPUT_PULLUP | MUX_MODE0) /* uart3_cts_rctx.uart3_cts_rctx */ OMAP4_IOPAD(0x142, PIN_OUTPUT | MUX_MODE0) /* uart3_rts_sd.uart3_rts_sd */
@@ -88,7 +88,7 @@ >; }; - hsusbb1_pins: pinmux_hsusbb1_pins { + hsusbb1_pins: hsusbb1-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x0c2, PIN_INPUT_PULLDOWN | MUX_MODE4) /* usbb1_ulpitll_clk.usbb1_ulpiphy_clk */ OMAP4_IOPAD(0x0c4, PIN_OUTPUT | MUX_MODE4) /* usbb1_ulpitll_stp.usbb1_ulpiphy_stp */
@@ -105,27 +105,27 @@ >; }; - hsusbb1_phy_rst_pins: pinmux_hsusbb1_phy_rst_pins { + hsusbb1_phy_rst_pins: hsusbb1-phy-rst-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x18c, PIN_OUTPUT | MUX_MODE3) /* kpd_row2.gpio_177 */ >; }; - i2c1_pins: pinmux_i2c1_pins { + i2c1_pins: i2c1-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x122, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c1_scl */ OMAP4_IOPAD(0x124, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c1_sda */ >; }; - i2c3_pins: pinmux_i2c3_pins { + i2c3_pins: i2c3-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x12a, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c3_scl */ OMAP4_IOPAD(0x12c, PIN_INPUT_PULLUP | MUX_MODE0) /* i2c3_sda */ >; }; - mmc1_pins: pinmux_mmc1_pins { + mmc1_pins: mmc1-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x0e2, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_clk.sdmmc1_clk */ OMAP4_IOPAD(0x0e4, PIN_INPUT_PULLUP | MUX_MODE0) /* sdmmc1_cmd.sdmmc1_cmd */
@@ -144,19 +144,19 @@ &lan7500_rst_pins >; - hsusbb1_phy_clk_pins: pinmux_hsusbb1_phy_clk_pins { + hsusbb1_phy_clk_pins: hsusbb1-phy-clk-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x058, PIN_OUTPUT | MUX_MODE0) /* fref_clk3_out */ >; }; - hsusbb1_hub_rst_pins: pinmux_hsusbb1_hub_rst_pins { + hsusbb1_hub_rst_pins: hsusbb1-hub-rst-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x042, PIN_OUTPUT | MUX_MODE3) /* gpio_wk1 */ >; }; - lan7500_rst_pins: pinmux_lan7500_rst_pins { + lan7500_rst_pins: lan7500-rst-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x040, PIN_OUTPUT | MUX_MODE3) /* gpio_wk0 */ >;
arch/arm/boot/dts/twl6030_omap4.dtsi +2 -2
@@ -19,7 +19,7 @@ }; &omap4_pmx_wkup { - twl6030_wkup_pins: pinmux_twl6030_wkup_pins { + twl6030_wkup_pins: twl6030-wkup-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x054, PIN_OUTPUT | MUX_MODE2) /* fref_clk0_out.sys_drm_msecure */ >;
@@ -27,7 +27,7 @@ }; &omap4_pmx_core { - twl6030_pins: pinmux_twl6030_pins { + twl6030_pins: twl6030-pins { pinctrl-single,pins = < OMAP4_IOPAD(0x19e, WAKEUP_EN | PIN_INPUT_PULLUP | MUX_MODE0) /* sys_nirq1.sys_nirq1 */ >;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 123/259 ARM: dts: ti: omap: motorola-mapphone: Fix abe_clkctrl warning on boot
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <[email protected]>
[ Upstream commit ac08bda1569b06b7a62c7b4dd00d4c3b28ceaaec ]
Commit 0840242e8875 ("ARM: dts: Configure clock parent for pwm vibra") attempted to fix the PWM settings but ended up causin an additional clock reparenting error:
clk: failed to reparent abe-clkctrl:0060:24 to sys_clkin_ck: -22
Only timer9 is in the PER domain and can use the sys_clkin_ck clock source. For timer8, the there is no sys_clkin_ck available as it's in the ABE domain, instead it should use syc_clk_div_ck. However, for power management, we want to use the always on sys_32k_ck instead.
Depends-on: 61978617e905 ("ARM: dts: Add minimal support for Droid Bionic xt875")
--- arch/arm/boot/dts/motorola-mapphone-common.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/motorola-mapphone-common.dtsi +2 -2
@@ -614,12 +614,12 @@ /* Configure pwm clock source for timers 8 & 9 */ &timer8 { assigned-clocks = <&abe_clkctrl OMAP4_TIMER8_CLKCTRL 24>; - assigned-clock-parents = <&sys_clkin_ck>; + assigned-clock-parents = <&sys_32k_ck>; }; &timer9 { assigned-clocks = <&l4_per_clkctrl OMAP4_TIMER9_CLKCTRL 24>; - assigned-clock-parents = <&sys_clkin_ck>; + assigned-clock-parents = <&sys_32k_ck>; }; /*
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 124/259 bus: ti-sysc: Fix SYSC_QUIRK_SWSUP_SIDLE_ACT handling for uart wake-up
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <[email protected]>
[ Upstream commit e5deb8f76e64d94ccef715e75ebafffd0c312d80 ]
The uarts should be tagged with SYSC_QUIRK_SWSUP_SIDLE instead of SYSC_QUIRK_SWSUP_SIDLE_ACT. The difference is that SYSC_QUIRK_SWSUP_SIDLE is used to force idle target modules rather than block idle during usage.
The SYSC_QUIRK_SWSUP_SIDLE_ACT should disable autoidle and wake-up when a target module is active, and configure autoidle and wake-up when a target module is inactive. We are missing configuring the target module on sysc_disable_module(), and missing toggling of the wake-up bit.
Let's fix the issue to allow uart wake-up to work.
--- drivers/bus/ti-sysc.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-)
drivers/bus/ti-sysc.c +17 -5
@@ -1120,6 +1120,11 @@ static int sysc_enable_module(struct device *dev)if (ddata->cfg.quirks & (SYSC_QUIRK_SWSUP_SIDLE |SYSC_QUIRK_SWSUP_SIDLE_ACT )) { best_mode =SYSC_IDLE_NO ; + +/* Clear WAKEUP */ +if (regbits->enwkup_shift >=0 && + ddata->cfg.sysc_val &BIT (regbits->enwkup_shift)) + reg &= ~BIT (regbits->enwkup_shift); }else { best_mode =fls (ddata->cfg.sidlemodes) -1 ;if (best_mode >SYSC_IDLE_MASK ) {
@@ -1247,6 +1252,13 @@ static int sysc_disable_module(struct device *dev) } } +if (ddata->cfg.quirks &SYSC_QUIRK_SWSUP_SIDLE_ACT ) { +/* Set WAKEUP */ +if (regbits->enwkup_shift >=0 && + ddata->cfg.sysc_val &BIT (regbits->enwkup_shift)) + reg |=BIT (regbits->enwkup_shift); + } + reg &= ~(SYSC_IDLE_MASK << regbits->sidle_shift); reg |= best_mode << regbits->sidle_shift; if (regbits->autoidle_shift >= 0 &&
@@ -1541,16 +1553,16 @@ struct sysc_revision_quirk {static const struct sysc_revision_quirk sysc_revision_quirks[] = {/* These drivers need to be fixed to not use pm_runtime_irq_safe() */ SYSC_QUIRK ("uart" ,0 ,0x50 ,0x54 ,0x58 ,0x00000046 ,0xffffffff , -SYSC_QUIRK_SWSUP_SIDLE |SYSC_QUIRK_LEGACY_IDLE ), +SYSC_QUIRK_SWSUP_SIDLE_ACT |SYSC_QUIRK_LEGACY_IDLE ),SYSC_QUIRK ("uart" ,0 ,0x50 ,0x54 ,0x58 ,0x00000052 ,0xffffffff , -SYSC_QUIRK_SWSUP_SIDLE |SYSC_QUIRK_LEGACY_IDLE ), +SYSC_QUIRK_SWSUP_SIDLE_ACT |SYSC_QUIRK_LEGACY_IDLE ),/* Uarts on omap4 and later */ SYSC_QUIRK ("uart" ,0 ,0x50 ,0x54 ,0x58 ,0x50411e03 ,0xffff00ff , -SYSC_QUIRK_SWSUP_SIDLE |SYSC_QUIRK_LEGACY_IDLE ), +SYSC_QUIRK_SWSUP_SIDLE_ACT |SYSC_QUIRK_LEGACY_IDLE ),SYSC_QUIRK ("uart" ,0 ,0x50 ,0x54 ,0x58 ,0x47422e03 ,0xffffffff , -SYSC_QUIRK_SWSUP_SIDLE |SYSC_QUIRK_LEGACY_IDLE ), +SYSC_QUIRK_SWSUP_SIDLE_ACT |SYSC_QUIRK_LEGACY_IDLE ),SYSC_QUIRK ("uart" ,0 ,0x50 ,0x54 ,0x58 ,0x47424e03 ,0xffffffff , -SYSC_QUIRK_SWSUP_SIDLE |SYSC_QUIRK_LEGACY_IDLE ), +SYSC_QUIRK_SWSUP_SIDLE_ACT |SYSC_QUIRK_LEGACY_IDLE ),/* Quirks that need to be set based on the module address */ SYSC_QUIRK("mcpdm", 0x40132000, 0, 0x10, -ENODEV, 0x50000800, 0xffffffff,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 125/259 power: supply: ucs1002: fix error code in ucs1002_get_property()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit e35059949daa83f8dadf710d0f829ab3c3a72fe2 ]
This function is supposed to return 0 for success instead of returning the val->intval. This makes it the same as the other case statements in this function.
--- drivers/power/supply/ucs1002_power.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/power/supply/ucs1002_power.c +2 -1
@@ -384,7 +384,8 @@ static int ucs1002_get_property(struct power_supply *psy,case POWER_SUPPLY_PROP_USB_TYPE :return ucs1002_get_usb_type (info, val);case POWER_SUPPLY_PROP_HEALTH : -return val->intval = info->health; + val->intval = info->health; +return 0 ;case POWER_SUPPLY_PROP_PRESENT : val->intval = info->present;return 0 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 126/259 firmware: imx-dsp: Fix an error handling path in imx_dsp_setup_channels()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit e527adfb9b7d9d05a4577c116519e59a2bda4b05 ]
If mbox_request_channel_byname() fails, the memory allocated a few lines above still need to be freed before going to the error handling path.
--- drivers/firmware/imx/imx-dsp.c | 1 + 1 file changed, 1 insertion(+)
drivers/firmware/imx/imx-dsp.c +1 -0
@@ -115,6 +115,7 @@ static int imx_dsp_setup_channels(struct imx_dsp_ipc *dsp_ipc) dsp_chan->idx = i %2 ; dsp_chan->ch =mbox_request_channel_byname (cl, chan_name);if (IS_ERR (dsp_chan->ch)) { +kfree (dsp_chan->name); ret =PTR_ERR (dsp_chan->ch);if (ret != -EPROBE_DEFER ) dev_err(dev, "Failed to request mbox chan %s ret %d\n",
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 127/259 xtensa: add default definition for XCHAL_HAVE_DIV32
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <[email protected]>
[ Upstream commit 494e87ffa0159b3f879694a9231089707792a44d ]
When variant FSF is set, XCHAL_HAVE_DIV32 is not defined. Add default definition for that macro to prevent build warnings:
arch/xtensa/lib/divsi3.S:9:5: warning: "XCHAL_HAVE_DIV32" is not defined, evaluates to 0 [-Wundef]
9 | #if XCHAL_HAVE_DIV32
arch/xtensa/lib/modsi3.S:9:5: warning: "XCHAL_HAVE_DIV32" is not defined, evaluates to 0 [-Wundef]
9 | #if XCHAL_HAVE_DIV32--- arch/xtensa/include/asm/core.h | 4 ++++ 1 file changed, 4 insertions(+)
arch/xtensa/include/asm/core.h +4 -0
@@ -6,6 +6,10 @@#include <variant/core.h> +#ifndef XCHAL_HAVE_DIV32 +#define XCHAL_HAVE_DIV32 0 +#endif +#ifndef XCHAL_HAVE_EXCLUSIVE #define XCHAL_HAVE_EXCLUSIVE 0#endif
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 128/259 xtensa: iss/network: make functions static
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit 1b59efeb59851277266318f4e0132aa61ce3455e ]
Make 2 functions static to prevent build warnings:
arch/xtensa/platforms/iss/network.c:204:16: warning: no previous prototype for 'tuntap_protocol' [-Wmissing-prototypes]
204 | unsigned short tuntap_protocol(struct sk_buff *skb)arch/xtensa/platforms/iss/network.c:444:6: warning: no previous prototype for 'iss_net_user_timer_expire' [-Wmissing-prototypes]
444 | void iss_net_user_timer_expire(struct timer_list *unused)
Message-Id: <[email protected]>
--- arch/xtensa/platforms/iss/network.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/xtensa/platforms/iss/network.c +2 -2
@@ -201,7 +201,7 @@ static int tuntap_write(struct iss_net_private *lp, struct sk_buff **skb)return simc_write (lp->tp.info.tuntap.fd, (*skb)->data, (*skb)->len); } -unsigned short tuntap_protocol (struct sk_buff *skb) +static unsigned short tuntap_protocol (struct sk_buff *skb) {return eth_type_trans (skb, skb->dev); }
@@ -441,7 +441,7 @@ static int iss_net_change_mtu(struct net_device *dev, int new_mtu)return -EINVAL ; } -void iss_net_user_timer_expire (struct timer_list *unused) +static void iss_net_user_timer_expire (struct timer_list *unused) { }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 129/259 xtensa: boot: dont add include-dirs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit 54d3d7d363823782c3444ddc41bb8cf1edc80514 ]
Drop the -I<include-dir> options to prevent build warnings since there is not boot/include directory:
cc1: warning: arch/xtensa/boot/include: No such file or directory [-Wmissing-include-dirs]
Message-Id: <[email protected]>
--- arch/xtensa/boot/Makefile | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/xtensa/boot/Makefile +1 -2
@@ -9,8 +9,7 @@ # KBUILD_CFLAGS used when building rest of boot (takes effect recursively) -KBUILD_CFLAGS += -fno-builtin -Iarch/$(ARCH)/boot/include -HOSTFLAGS += -Iarch/$(ARCH)/boot/include +KBUILD_CFLAGS += -fno-builtin subdir-y := lib targets += vmlinux.bin vmlinux.bin.gz
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 130/259 xtensa: umulsidi3: fix conditional expression
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit 9aecda97ec3deecbfa7670877c8ddfd3d0fc87c4 ]
Even when a variant has one or more of these defines set to 1, the multiplier code paths are not used. Change the expression so that the correct code paths are used.
arch/xtensa/lib/umulsidi3.S:44:38: warning: "XCHAL_NO_MUL" is not defined, evaluates to 0 [-Wundef]
44 | #if defined(__XTENSA_CALL0_ABI__) && XCHAL_NO_MULarch/xtensa/lib/umulsidi3.S:145:38: warning: "XCHAL_NO_MUL" is not defined, evaluates to 0 [-Wundef]
145 | #if defined(__XTENSA_CALL0_ABI__) && XCHAL_NO_MULarch/xtensa/lib/umulsidi3.S:159:5: warning: "XCHAL_NO_MUL" is not defined, evaluates to 0 [-Wundef]
159 | #if XCHAL_NO_MUL
Message-Id: <[email protected]>
--- arch/xtensa/lib/umulsidi3.S | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/xtensa/lib/umulsidi3.S +3 -1
@@ -3,7 +3,9 @@ #include <asm/asmmacro.h> #include <asm/core.h> -#if !XCHAL_HAVE_MUL16 && !XCHAL_HAVE_MUL32 && !XCHAL_HAVE_MAC16 +#if XCHAL_HAVE_MUL16 || XCHAL_HAVE_MUL32 || XCHAL_HAVE_MAC16 +#define XCHAL_NO_MUL 0 +#else #define XCHAL_NO_MUL 1 #endif
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 131/259 xtensa: boot/lib: fix function prototypes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <[email protected]>
[ Upstream commit f54d02c8f2cc4b46ba2a3bd8252a6750453b6f2b ]
Add function prototype for gunzip() to the boot library code and make exit() and zalloc() static.
arch/xtensa/boot/lib/zmem.c:8:6: warning: no previous prototype for 'exit' [-Wmissing-prototypes]
8 | void exit (void)arch/xtensa/boot/lib/zmem.c:13:7: warning: no previous prototype for 'zalloc' [-Wmissing-prototypes]
13 | void *zalloc(unsigned size)arch/xtensa/boot/lib/zmem.c:35:6: warning: no previous prototype for 'gunzip' [-Wmissing-prototypes]
35 | void gunzip (void *dst, int dstlen, unsigned char *src, int *lenp)
--- arch/xtensa/boot/lib/zmem.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/xtensa/boot/lib/zmem.c +3 -2
@@ -4,13 +4,14 @@/* bits taken from ppc */ extern void *avail_ram, *end_avail; +void gunzip (void *dst,int dstlen,unsigned char *src,int *lenp); -void exit (void ) +static void exit (void ) {for (;;); } -void *zalloc (unsigned size) +static void *zalloc (unsigned int size) {void *p = avail_ram;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 132/259 power: supply: rk817: Fix node refcount leak
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Morgan <[email protected]>
[ Upstream commit 488ef44c068e79752dba8eda0b75f524f111a695 ]
Dan Carpenter reports that the Smatch static checker warning has found that there is another refcount leak in the probe function. While of_node_put() was added in one of the return paths, it should in fact be added for ALL return paths that return an error and at driver removal time.
--- drivers/power/supply/rk817_charger.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
drivers/power/supply/rk817_charger.c +12 -3
@@ -1058,6 +1058,13 @@ static void rk817_charging_monitor(struct work_struct *work)queue_delayed_work (system_wq, &charger->work,msecs_to_jiffies (8000 )); } +static void rk817_cleanup_node (void *data) +{ +struct device_node *node = data; + +of_node_put (node); +} +static int rk817_charger_probe (struct platform_device *pdev) {struct rk808 *rk808 =dev_get_drvdata (pdev->dev.parent);
@@ -1074,11 +1081,13 @@ static int rk817_charger_probe(struct platform_device *pdev)if (!node)return -ENODEV ; + ret =devm_add_action_or_reset (&pdev->dev, rk817_cleanup_node, node); +if (ret) +return ret; + charger =devm_kzalloc (&pdev->dev,sizeof (*charger),GFP_KERNEL ); -if (!charger) { -of_node_put (node); +if (!charger)return -ENOMEM ; - } charger->rk808 = rk808;
Signature · 1 line
2.40.1