6.5.6-rc1 review
Subsystems (9)
Greg Kroah-Hartman
maintainercover 6.5.6-rc1 review
This is the start of the stable review cycle for the 6.5.6 release. There are 321 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 06 Oct 2023 17:51:12 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.5.6-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.5.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.5.6-rc1
Mario Limonciello <[email protected]>
ASoC: amd: yc: Fix a non-functional mic on Lenovo 82TL
Michal Hocko <[email protected]>
mm, memcg: reconsider kmem.limit_in_bytes deprecation
Michal Hocko <[email protected]>
memcg: drop kmem.limit_in_bytes
Ilya Dryomov <[email protected]>
rbd: take header_rwsem in rbd_dev_refresh() only when updating
Ilya Dryomov <[email protected]>
rbd: decouple parent info read-in from updating rbd_dev
Ilya Dryomov <[email protected]>
rbd: decouple header read-in from updating rbd_dev->header
Ilya Dryomov <[email protected]>
rbd: move rbd_dev_refresh() definition
Jani Nikula <[email protected]>
drm/meson: fix memory leak on ->hpd_notify callback
Hamza Mahfooz <[email protected]>
drm/amd/display: fix the ability to use lower resolution modes on eDP
YuBiao Wang <[email protected]>
drm/amdkfd: Use gpu_offset for user queue's wptr
Greg Ungerer <[email protected]>
fs: binfmt_elf_efpic: fix personality for ELF-FDPIC
Linus Walleij <[email protected]>
power: supply: ab8500: Set typing and props
Nicolas Frattaroli <[email protected]>
power: supply: rk817: Add missing module alias
Javier Pello <[email protected]>
drm/i915/gt: Fix reservation address in ggtt_reserve_guc_top
Matthew Wilcox (Oracle) <[email protected]>
i915: Limit the length of an sg list to the requested length
Matthias Schiffer <[email protected]>
ata: libata-sata: increase PMP SRST timeout to 10s
Damien Le Moal <[email protected]>
ata: libata-core: Do not register PM operations for SAS ports
Damien Le Moal <[email protected]>
ata: libata-core: Fix port and device removal
Damien Le Moal <[email protected]>
ata: libata-core: Fix ata_port_request_pm() locking
Beau Belgrave <[email protected]>
tracing/user_events: Align set_bit() address for all archs
Quang Le <[email protected]>
fs/smb/client: Reset password pointer to NULL
Rafael J. Wysocki <[email protected]>
thermal: sysfs: Fix trip_point_hyst_store()
Mika Westerberg <[email protected]>
net: thunderbolt: Fix TCPv6 GSO checksum calculation
Nick Desaulniers <[email protected]>
bpf: Fix BTF_ID symbol generation collision in tools/
Jiri Olsa <[email protected]>
bpf: Fix BTF_ID symbol generation collision
Jiri Olsa <[email protected]>
bpf: Add override check to kprobe multi link attach
Ricardo Ribalda <[email protected]>
media: uvcvideo: Fix OOB read
Josef Bacik <[email protected]>
btrfs: properly report 0 avail for very full file systems
Filipe Manana <[email protected]>
btrfs: fix race between reading a directory and adding entries to it
Filipe Manana <[email protected]>
btrfs: set last dir index to the current last index when opening dir
Bernd Schubert <[email protected]>
btrfs: file_remove_privs needs an exclusive lock in direct io write
Filipe Manana <[email protected]>
btrfs: refresh dir last index during a rewinddir(3) call
Steven Rostedt (Google) <[email protected]>
ring-buffer: Update "shortest_full" in polling
Zheng Yejian <[email protected]>
ring-buffer: Fix bytes info in per_cpu buffer stats
Smita Koralahalli <[email protected]>
cxl/pci: Fix appropriate checking for _OSC while handling CXL RAS registers
Dan Williams <[email protected]>
cxl/port: Fix cxl_test register enumeration regression
Johannes Weiner <[email protected]>
mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement
Johannes Weiner <[email protected]>
mm: page_alloc: fix CMA and HIGHATOMIC landing on the wrong buddy list
Rafael Aquini <[email protected]>
mm/slab_common: fix slab_caches list corruption after kmem_cache_destroy()
Yang Shi <[email protected]>
mm: mempolicy: keep VMA walk if both MPOL_MF_STRICT and MPOL_MF_MOVE are specified
Juntong Deng <[email protected]>
selftests/mm: fix awk usage in charge_reserved_hugetlb.sh and hugetlb_reparenting_test.sh that may cause error
Jinjie Ruan <[email protected]>
mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions()
Mikko Rapeli <[email protected]>
arm64: defconfig: remove CONFIG_COMMON_CLK_NPCM8XX=y
Ira Weiny <[email protected]>
cxl/mbox: Fix CEL logic for poison and security commands
Janusz Krzysztofik <[email protected]>
drm/tests: Fix incorrect argument in drm_test_mm_insert_range
Frederic Weisbecker <[email protected]>
timers: Tag (hr)timer softirq as hotplug safe
Yu Liao <[email protected]>
ACPI: NFIT: Fix incorrect calculation of idt size
Trond Myklebust <[email protected]>
NFSv4: Fix a state manager thread deadlock regression
Trond Myklebust <[email protected]>
Revert "SUNRPC dont update timeout value on connection reset"
Joel Fernandes (Google) <[email protected]>
sched/rt: Fix live lock between select_fallback_rq() and RT push
Liam R. Howlett <[email protected]>
kernel/sched: Modify initial boot task idle setup
August Wikerfors <[email protected]>
ASoC: amd: yc: Fix non-functional mic on Lenovo 82QF and 82UG
Heiner Kallweit <[email protected]>
i2c: i801: unregister tco_pdev in i801_probe() error path
Jens Axboe <[email protected]>
io_uring/fs: remove sqe->rw_flags checking from LINKAT
Niklas Cassel <[email protected]>
ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION CODES
Damien Le Moal <[email protected]>
scsi: sd: Do not issue commands to suspended disks on shutdown
Damien Le Moal <[email protected]>
scsi: sd: Differentiate system and runtime start/stop management
Damien Le Moal <[email protected]>
ata: libata-scsi: link ata port and scsi device
Tiezhu Yang <[email protected]>
LoongArch: Add support for 64_PCREL relocation type
Tiezhu Yang <[email protected]>
LoongArch: Add support for 32_PCREL relocation type
Huacai Chen <[email protected]>
LoongArch: numa: Fix high_memory calculation
Tiezhu Yang <[email protected]>
LoongArch: Define relocation types for ABI v2.10
Helge Deller <[email protected]>
LoongArch: Fix lockdep static memory detection
Kailang Yang <[email protected]>
ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre M70q
Takashi Iwai <[email protected]>
ALSA: rawmidi: Fix NULL dereference at proc read
Tianjia Zhang <[email protected]>
crypto: sm2 - Fix crash caused by uninitialized context
Pan Bian <[email protected]>
nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
Andy Shevchenko <[email protected]>
serial: 8250_port: Check IRQ data before use
Damien Le Moal <[email protected]>
scsi: core: ata: Do no try to probe for CDL on old drives
Daniel Starke <[email protected]>
Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux"
Ricky WU <[email protected]>
misc: rtsx: Fix some platforms can not boot and move the l1ss judgment to probe
Paolo Abeni <[email protected]>
mptcp: process pending subflow error on close
Paolo Abeni <[email protected]>
mptcp: move __mptcp_error_report in protocol.c
Paolo Abeni <[email protected]>
mptcp: fix bogus receive window shrinkage with multiple subflows
Sean Christopherson <[email protected]>
KVM: x86/mmu: Stop zapping invalidated TDP MMU roots asynchronously
Paolo Bonzini <[email protected]>
KVM: x86/mmu: Do not filter address spaces in for_each_tdp_mmu_root_yield_safe()
Sean Christopherson <[email protected]>
KVM: x86/mmu: Open code leaf invalidation from mmu_notifier
Tom Lendacky <[email protected]>
KVM: SVM: Fix TSC_AUX virtualization setup
Paolo Bonzini <[email protected]>
KVM: SVM: INTERCEPT_RDTSCP is never intercepted anyway
Pu Wen <[email protected]>
x86/srso: Add SRSO mitigation for Hygon processors
Haitao Huang <[email protected]>
x86/sgx: Resolves SECS reclaim vs. page fault for EAUG race
Johan Hovold <[email protected]>
spi: zynqmp-gqspi: fix clock imbalance on probe failure
Nicolin Chen <[email protected]>
iommu/arm-smmu-v3: Fix soft lockup triggered by arm_smmu_mm_invalidate_range
Richard Fitzgerald <[email protected]>
ASoC: cs35l56: Call pm_runtime_dont_use_autosuspend()
Arnaldo Carvalho de Melo <[email protected]>
perf build: Define YYNOMEM as YYNOABORT for bison < 3.81
Thomas Zimmermann <[email protected]>
fbdev/sh7760fb: Depend on FB=y
Huacai Chen <[email protected]>
LoongArch: Set all reserved memblocks on Node#0 at initialization
Andy Shevchenko <[email protected]>
LoongArch: Use _UL() and _ULL()
Yann Sionneau <[email protected]>
i2c: designware: fix __i2c_dw_disable() in case master is holding SCL low
Bob Peterson <[email protected]>
gfs2: fix glock shrinker ref issues
Gerhard Engleder <[email protected]>
tsnep: Fix NAPI polling with budget 0
Gerhard Engleder <[email protected]>
tsnep: Fix ethtool channels
Gerhard Engleder <[email protected]>
tsnep: Fix NAPI scheduling
Sebastian Andrzej Siewior <[email protected]>
net: hsr: Add __packed to struct hsr_sup_tlv.
Johnathan Mantey <[email protected]>
ncsi: Propagate carrier gain/loss events to the NCSI controller
Benjamin Gray <[email protected]>
powerpc/watchpoints: Annotate atomic context in more places
Benjamin Gray <[email protected]>
powerpc/watchpoint: Disable pagefaults when getting user instruction
Benjamin Gray <[email protected]>
powerpc/watchpoints: Disable preemption in thread_change_pc()
Ranjani Sridharan <[email protected]>
ASoC: SOF: Intel: MTL: Reduce the DSP init timeout
Olga Kornievskaia <[email protected]>
NFSv4.1: fix zero value filehandle in post open getattr
Hans Verkuil <[email protected]>
media: vb2: frame_vector.c: replace WARN_ONCE with a comment
Peter Ujfalusi <[email protected]>
ASoC: SOF: sof-audio: Fix DSP core put imbalance on widget setup failure
Chancel Liu <[email protected]>
ASoC: imx-rpmsg: Set ignore_pmdown_time for dai_link
Mike Rapoport (IBM) <[email protected]>
memblock tests: fix warning ‘struct seq_file’ declared inside parameter list
Mike Rapoport (IBM) <[email protected]>
memblock tests: fix warning: "__ALIGN_KERNEL" redefined
Richard Fitzgerald <[email protected]>
ASoC: wm_adsp: Fix missing locking in wm_adsp_[read|write]_ctl()
Richard Fitzgerald <[email protected]>
firmware: cirrus: cs_dsp: Only log list of algorithms in debug build
Richard Fitzgerald <[email protected]>
ASoC: cs42l42: Avoid stale SoundWire ATTACH after hard reset
Richard Fitzgerald <[email protected]>
ASoC: cs42l42: Don't rely on GPIOD_OUT_LOW to set RESET initially low
Richard Fitzgerald <[email protected]>
ASoC: cs42l42: Ensure a reset pulse meets minimum pulse width.
Peter Ujfalusi <[email protected]>
ALSA: hda: intel-sdw-acpi: Use u8 type for link index
Hans de Goede <[email protected]>
ASoC: rt5640: Only cancel jack-detect work on suspend if active
Stanislav Fomichev <[email protected]>
bpf: Clarify error expectations from bpf_clone_redirect
Hou Tao <[email protected]>
bpf: Ensure unit_size is matched with slab cache object size
Mika Westerberg <[email protected]>
spi: intel-pci: Add support for Granite Rapids SPI serial flash
Shengjiu Wang <[email protected]>
ASoC: fsl: imx-pcm-rpmsg: Add SNDRV_PCM_INFO_BATCH flag
Valentin Caron <[email protected]>
spi: stm32: add a delay before SPI disable
Han Xu <[email protected]>
spi: nxp-fspi: reset the FLSHxCR1 registers
Walt Holman <[email protected]>
Add DMI ID for MSI Bravo 15 B7ED
Niklas Cassel <[email protected]>
ata: libata-eh: do not thaw the port twice in ata_eh_reset()
Niklas Cassel <[email protected]>
ata: libata-eh: do not clear ATA_PFLAG_EH_PENDING in ata_eh_reset()
Steve French <[email protected]>
smb3: correct places where ENOTSUPP is used instead of preferred EOPNOTSUPP
Michal Grzedzicki <[email protected]>
scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command
Michal Grzedzicki <[email protected]>
scsi: pm80xx: Use phy-specific SAS address when sending PHY_START command
Icenowy Zheng <[email protected]>
riscv: errata: fix T-Head dcache.cva encoding
Pratyush Yadav <[email protected]>
nvme-pci: do not set the NUMA node of device if it has none
Josh Poimboeuf <[email protected]>
objtool: Fix _THIS_IP_ detection for cold functions
David Francis <[email protected]>
drm/amdgpu: Handle null atom context in VBIOS info ioctl
David Francis <[email protected]>
drm/amdkfd: Checkpoint and restore queues on GFX11
Hawking Zhang <[email protected]>
drm/amdgpu: fallback to old RAS error message for aqua_vanjaram
Alex Deucher <[email protected]>
drm/amdgpu/nbio4.3: set proper rmmio_remap.reg_offset for SR-IOV
Alex Deucher <[email protected]>
drm/amdgpu/soc21: don't remap HDP registers for SR-IOV
Swapnil Patel <[email protected]>
drm/amd/display: Don't check registers, if using AUX BL control
Mukul Joshi <[email protected]>
drm/amdkfd: Update CU masking for GFX 9.4.3
Mukul Joshi <[email protected]>
drm/amdkfd: Update cache info reporting for GFX v9.4.3
Mukul Joshi <[email protected]>
drm/amdgpu: Store CU info from all XCCs for GFX v9.4.3
Julia Lawall <[email protected]>
thermal/of: add missing of_node_put()
Luke D. Jones <[email protected]>
platform/x86: asus-wmi: Support 2023 ROG X16 tablet mode
David Thompson <[email protected]>
platform/mellanox: mlxbf-bootctl: add NET dependency into Kconfig
Ard Biesheuvel <[email protected]>
efi/x86: Ensure that EFI_RUNTIME_MAP is enabled for kexec
Christophe JAILLET <[email protected]>
ata: sata_mv: Fix incorrect string length computation in mv_dump_mem()
Guangguan Wang <[email protected]>
net/smc: bugfix for smcr v2 server connect success statistic
Steven Rostedt (Google) <[email protected]>
ring-buffer: Do not attempt to read past "commit"
Ricardo B. Marliere <[email protected]>
selftests: fix dependency checker script
Filipe Manana <[email protected]>
btrfs: assert delayed node locked when removing delayed item
Zheng Yejian <[email protected]>
ring-buffer: Avoid softlockup in ring_buffer_resize()
Zheng Yejian <[email protected]>
selftests/ftrace: Correctly enable event in instance-event.tc
Kiwoong Kim <[email protected]>
scsi: ufs: core: Poll HCS.UCRDY before issuing a UIC command
Kiwoong Kim <[email protected]>
scsi: ufs: core: Move __ufshcd_send_uic_cmd() outside host_lock
Javed Hasan <[email protected]>
scsi: qedf: Add synchronization between I/O completions and abort
Helge Deller <[email protected]>
parisc: irq: Make irq_stack_union static to avoid sparse warning
Helge Deller <[email protected]>
parisc: drivers: Fix sparse warning
Helge Deller <[email protected]>
parisc: iosapic.c: Fix sparse warnings
Helge Deller <[email protected]>
parisc: ccio-dma: Fix sparse warnings
Helge Deller <[email protected]>
parisc: sba-iommu: Fix sparse warnigs
Helge Deller <[email protected]>
parisc: sba: Fix compile warning wrt list of SBA devices
Nigel Kirkland <[email protected]>
nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid()
Tobias Schramm <[email protected]>
spi: sun6i: fix race between DMA RX transfer completion and RX FIFO drain
Tobias Schramm <[email protected]>
spi: sun6i: reduce DMA RX transfer width to single byte
Shubh <[email protected]>
ASoC: amd: yc: Add DMI entries to support Victus by HP Gaming Laptop 15-fb0xxx (8A3E)
Daniel Borkmann <[email protected]>
bpf: Annotate bpf_long_memcpy with data_race
Sergey Senozhatsky <[email protected]>
dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock
Xiubo Li <[email protected]>
ceph: drop messages from MDS when unmounting
Sean Christopherson <[email protected]>
x86/reboot: VMCLEAR active VMCSes before emergency reboot
Chuck Lever <[email protected]>
NFSD: Fix zero NFSv4 READ results when RQ_SPLICE_OK is not set
William A. Kennington III <[email protected]>
i2c: npcm7xx: Fix callback completion ordering
Wenhua Lin <[email protected]>
gpio: pmic-eic-sprd: Add can_sleep flag for PMIC EIC chip
Karol Wachowski <[email protected]>
accel/ivpu: Use cached buffers for FW loading
Stanislaw Gruszka <[email protected]>
accel/ivpu: Do not use wait event interruptible
Umesh Nerlige Ramappa <[email protected]>
i915/guc: Get runtime pm in busyness worker only if already active
Sudeep Holla <[email protected]>
firmware: arm_ffa: Don't set the memory region attributes for MEM_LEND
Rob Herring <[email protected]>
arm64: dts: imx: Add imx8mm-prt8mm.dtb to build
Liu Ying <[email protected]>
arm64: dts: imx8mm-evk: Fix hdmi@3d node
Nathan Rossi <[email protected]>
soc: imx8m: Enable OCOTP clock for imx8mm before reading registers
Adam Ford <[email protected]>
arm64: dts: imx8mp-beacon-kit: Fix audio_pll2 clock
Adam Ford <[email protected]>
arm64: dts: imx8mp: Fix SDMA2/3 clocks
Michael Ellerman <[email protected]>
selftests/powerpc: Fix emit_tests to work with run_kselftest.sh
Michael Ellerman <[email protected]>
powerpc/stacktrace: Fix arch_stack_walk_reliable()
Chris Morgan <[email protected]>
power: supply: rk817: Fix node refcount leak
Max Filippov <[email protected]>
xtensa: boot/lib: fix function prototypes
Randy Dunlap <[email protected]>
xtensa: umulsidi3: fix conditional expression
Randy Dunlap <[email protected]>
xtensa: boot: don't add include-dirs
Randy Dunlap <[email protected]>
xtensa: iss/network: make functions static
Max Filippov <[email protected]>
xtensa: add default definition for XCHAL_HAVE_DIV32
Christophe JAILLET <[email protected]>
firmware: imx-dsp: Fix an error handling path in imx_dsp_setup_channels()
Sebastian Reichel <[email protected]>
power: supply: core: fix use after free in uevent
Christophe JAILLET <[email protected]>
power: supply: rt9467: Fix rt9467_run_aicl()
Dan Carpenter <[email protected]>
power: supply: ucs1002: fix error code in ucs1002_get_property()
Ross Lagerwall <[email protected]>
swiotlb: use the calculated number of areas
Tony Lindgren <[email protected]>
bus: ti-sysc: Fix SYSC_QUIRK_SWSUP_SIDLE_ACT handling for uart wake-up
Tony Lindgren <[email protected]>
ARM: dts: ti: omap: motorola-mapphone: Fix abe_clkctrl warning on boot
Tony Lindgren <[email protected]>
ARM: dts: ti: omap: Fix bandgap thermal cells addressing for omap3/4
Timo Alho <[email protected]>
clk: tegra: fix error return case for recalc_rate
Marek Vasut <[email protected]>
clk: si521xx: Fix regmap write accessor
Marek Vasut <[email protected]>
clk: si521xx: Use REGCACHE_FLAT instead of NONE
Zhifeng Tang <[email protected]>
clk: sprd: Fix thm_parents incorrect configuration
Harshit Mogalapalli <[email protected]>
power: supply: mt6370: Fix missing error code in mt6370_chg_toggle_cfo()
Sibi Sankar <[email protected]>
firmware: arm_scmi: Fixup perf power-cost/microwatt support
Cristian Marussi <[email protected]>
firmware: arm_scmi: Harden perf domain info access
Adam Ford <[email protected]>
bus: ti-sysc: Fix missing AM35xx SoC matching
Julien Panis <[email protected]>
bus: ti-sysc: Use fsleep() instead of usleep_range() in sysc_reset()
Charles Kearney <[email protected]>
spi: spi-gxp: BUG: Correct spi write return value
Christoph Hellwig <[email protected]>
MIPS: Alchemy: only build mmc support helpers if au1xmmc is enabled
Jinjie Ruan <[email protected]>
vfio/mdev: Fix a null-ptr-deref bug for mdev_unregister_parent()
Qu Wenruo <[email protected]>
btrfs: reset destination buffer when read_extent_buffer() gets invalid range
Al Viro <[email protected]>
direct_write_fallback(): on error revert the ->ki_pos update from buffered write
Amit Pundir <[email protected]>
arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved
Wenjing Liu <[email protected]>
drm/amd/display: fix a regression in blank pixel data caused by coding mistake
Wenjing Liu <[email protected]>
drm/amd/display: Update DPG test pattern programming
Richard Fitzgerald <[email protected]>
ASoC: cs35l56: Disable low-power hibernation mode
Jiadong Zhu <[email protected]>
drm/amdgpu: set completion status as preempted for the resubmission
Daniel Scally <[email protected]>
i2c: xiic: Correct return value check for xiic_reinit()
Liang He <[email protected]>
i2c: mux: gpio: Add missing fwnode_handle_put()
Xiaoke Wang <[email protected]>
i2c: mux: demux-pinctrl: check the return value of devm_kstrdup()
Christophe JAILLET <[email protected]>
gpio: tb10x: Fix an error handling path in tb10x_gpio_probe()
Zhang Xiaoxu <[email protected]>
cifs: Fix UAF in cifs_demultiplex_thread()
Ben Wolsieffer <[email protected]>
proc: nommu: fix empty /proc/<pid>/maps
Ben Wolsieffer <[email protected]>
proc: nommu: /proc/<pid>/maps: release mmap read lock
Alison Schofield <[email protected]>
cxl/region: Match auto-discovered region decoders by HPA range
Muhammad Husaini Zulkifli <[email protected]>
igc: Expose tx-usecs coalesce setting to user
Sebastian Andrzej Siewior <[email protected]>
octeontx2-pf: Do xdp_do_flush() after redirects.
Sebastian Andrzej Siewior <[email protected]>
bnxt_en: Flush XDP for bnxt_poll_nitroa0()'s NAPI
Sebastian Andrzej Siewior <[email protected]>
net: ena: Flush XDP packets on error.
Sebastian Andrzej Siewior <[email protected]>
locking/seqlock: Do the lockdep annotation before locking in do_write_seqcount_begin_nested()
José Pekkarinen <[email protected]>
drm/virtio: clean out_fence on complete_submit
Umesh Nerlige Ramappa <[email protected]>
i915/pmu: Move execlist stats initialization to execlist specific setup
Jinjie Ruan <[email protected]>
net/handshake: Fix memory leak in __sock_create() and sock_alloc_file()
Cai Huoqing <[email protected]>
net: hinic: Fix warning-hinic_set_vlan_fliter() warn: variable dereferenced before check 'hwdev'
Jozsef Kadlecsik <[email protected]>
netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP
Florian Westphal <[email protected]>
netfilter: nf_tables: disable toggling dormant table state more than once
Benjamin Poirier <[email protected]>
vxlan: Add missing entries to vxlan_get_size()
Artem Chernyshev <[email protected]>
net: rds: Fix possible NULL-pointer dereference
Mark Rutland <[email protected]>
locking/atomic: scripts: fix fallback ifdeffery
Ziyang Xuan <[email protected]>
team: fix null-ptr-deref when team device type is changed
Eric Dumazet <[email protected]>
net: bridge: use DEV_STATS_INC()
Jie Wang <[email protected]>
net: hns3: add 5ms delay before clear firmware reset irq source
Jijie Shao <[email protected]>
net: hns3: fix fail to delete tc flower rules during reset issue
Jian Shen <[email protected]>
net: hns3: only enable unicast promisc when mac table full
Jie Wang <[email protected]>
net: hns3: fix GRE checksum offload issue
Jie Wang <[email protected]>
net: hns3: add cmdq check for vf periodic service task
Josh Poimboeuf <[email protected]>
x86/srso: Fix SBPB enablement for spec_rstack_overflow=off
Josh Poimboeuf <[email protected]>
x86/srso: Don't probe microcode in a guest
Josh Poimboeuf <[email protected]>
x86/srso: Set CPUID feature bits independently of bug or mitigation status
Josh Poimboeuf <[email protected]>
x86/srso: Fix srso_show_state() side effect
Vincent Whitchurch <[email protected]>
x86/asm: Fix build of UML with KASAN
Stephen Boyd <[email protected]>
platform/x86: intel_scu_ipc: Fail IPC send if still busy
Stephen Boyd <[email protected]>
platform/x86: intel_scu_ipc: Don't override scu in intel_scu_ipc_dev_simple_command()
Stephen Boyd <[email protected]>
platform/x86: intel_scu_ipc: Check status upon timeout in ipc_wait_for_interrupt()
Stephen Boyd <[email protected]>
platform/x86: intel_scu_ipc: Check status after timeout in busy_loop()
Lukasz Majewski <[email protected]>
net: hsr: Properly parse HSRv1 supervisor frames.
Rik van Riel <[email protected]>
x86/mm, kexec, ima: Use memblock_free_late() from ima_free_kexec_buffer()
Eric Dumazet <[email protected]>
dccp: fix dccp_v4_err()/dccp_v6_err() again
Benjamin Gray <[email protected]>
powerpc/dexcr: Move HASHCHK trap handler
Kajol Jain <[email protected]>
powerpc/perf/hv-24x7: Update domain value check
Eric Dumazet <[email protected]>
scsi: iscsi_tcp: restrict to TCP sockets
Kyle Zeng <[email protected]>
ipv4: fix null-deref in ipv4_link_failure
Vinicius Costa Gomes <[email protected]>
igc: Fix infinite initialization loop with early XDP redirect
David Christensen <[email protected]>
ionic: fix 16bit math issue when PAGE_SIZE >= 64KB
Ilya Leoshkevich <[email protected]>
netfilter, bpf: Adjust timeouts of non-confirmed CTs in bpf_ct_insert_entry()
Ivan Vecera <[email protected]>
i40e: Fix VF VLAN offloading when port VLAN is configured
Petr Oros <[email protected]>
iavf: schedule a request immediately after add/delete vlan
Petr Oros <[email protected]>
iavf: add iavf_schedule_aq_request() helper
Peter Ujfalusi <[email protected]>
ASoC: SOF: core: Only call sof_ops_free() on remove if the probe was successful
Radoslaw Tyl <[email protected]>
iavf: do not process adminq tasks when __IAVF_IN_REMOVE_TASK is set
Shinas Rasheed <[email protected]>
octeon_ep: fix tx dma unmap len values in SG
Shengjiu Wang <[email protected]>
ASoC: imx-audmix: Fix return error with devm_clk_get()
Chen Ni <[email protected]>
ASoC: hdaudio.c: Add missing check for devm_kstrdup
Takashi Iwai <[email protected]>
ALSA: seq: ump: Fix -Wformat-truncation warning
Sasha Neftin <[email protected]>
net/core: Fix ETH_P_1588 flow dissector
Sabrina Dubroca <[email protected]>
selftests: tls: swap the TX and RX sockets in some tests
Jinjie Ruan <[email protected]>
net: microchip: sparx5: Fix possible memory leaks in vcap_api_kunit
Jinjie Ruan <[email protected]>
net: microchip: sparx5: Fix possible memory leaks in test_vcap_xn_rule_creator()
Jinjie Ruan <[email protected]>
net: microchip: sparx5: Fix possible memory leak in vcap_api_encode_rule_test()
Jinjie Ruan <[email protected]>
net: microchip: sparx5: Fix memory leak for vcap_api_rule_add_actionvalue_test()
Jinjie Ruan <[email protected]>
net: microchip: sparx5: Fix memory leak for vcap_api_rule_add_keyvalue_test()
Bard Liao <[email protected]>
ASoC: SOF: ipc4-topology: fix wrong sizeof argument
Rong Tao <[email protected]>
memblock tests: Fix compilation errors.
Alexey Dobriyan <[email protected]>
uapi: stddef.h: Fix __DECLARE_FLEX_ARRAY for C++
Alexey Dobriyan <[email protected]>
uapi: stddef.h: Fix header guard location
Kees Cook <[email protected]>
Compiler Attributes: counted_by: Adjust name and identifier expansion
Phil Sutter <[email protected]>
netfilter: nf_tables: Fix entries val in rule reset audit log
Florian Westphal <[email protected]>
netfilter: conntrack: fix extension size table
Knyazev Arseniy <[email protected]>
ALSA: hda/realtek: Splitting the UX3402 into two separate models
Artem Savkov <[email protected]>
selftests/bpf: fix unpriv_disabled check in test_verifier
Christophe JAILLET <[email protected]>
bpf: Fix a erroneous check after snprintf()
Hans de Goede <[email protected]>
ASoC: rt5640: Fix IRQ not being free-ed for HDA jack detect mode
Hans de Goede <[email protected]>
ASoC: rt5640: Enable the IRQ on resume after configuring jack-detect
Hans de Goede <[email protected]>
ASoC: rt5640: Do not disable/enable IRQ twice on suspend/resume
Senhong Liu <[email protected]>
ASoC: rt5640: fix typos
Hans de Goede <[email protected]>
ASoC: rt5640: Fix sleep in atomic context
Hans de Goede <[email protected]>
ASoC: rt5640: Revert "Fix sleep in atomic context"
Takashi Iwai <[email protected]>
ALSA: seq: Avoid delivery of events for disabled UMP groups
Takashi Iwai <[email protected]>
ALSA: docs: Fix a typo of midi2_ump_probe option for snd-usb-audio
Eduard Zingerman <[email protected]>
bpf: Avoid dummy bpf_offload_netdev in __bpf_prog_dev_bound_init
Toke Høiland-Jørgensen <[email protected]>
bpf: Avoid deadlock when using queue and stack maps from NMI
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: disallow element removal on anonymous sets
Jerome Brunet <[email protected]>
ASoC: meson: spdifin: start hw on dai probe
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: disallow rule removal from chain binding
Florian Westphal <[email protected]>
netfilter: nf_tables: fix memleak when more than 255 elements expired
Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration
Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_pipapo: stop GC iteration if GC transaction allocation fails
Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_pipapo: call nft_trans_gc_queue_sync() in catchall GC
Pablo Neira Ayuso <[email protected]>
netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention
Jan Kara <[email protected]>
ext4: do not let fstrim block system suspend
Jan Kara <[email protected]>
ext4: move setting of trimmed bit into ext4_try_to_trim_range()
Kemeng Shi <[email protected]>
ext4: replace the traditional ternary conditional operator with with max()/min()
Filipe Manana <[email protected]>
btrfs: remove BUG() after failure to insert delayed dir index item
Filipe Manana <[email protected]>
btrfs: improve error message after failure to add delayed dir index item
Dave Wysochanski <[email protected]>
netfs: Only call folio_start_fscache() one time for each folio
Andreas Gruenbacher <[email protected]>
gfs2: Fix another freeze/thaw hang
Sakari Ailus <[email protected]>
media: via: Use correct dependency for camera sensor drivers
Sakari Ailus <[email protected]>
media: v4l: Use correct dependency for camera sensor drivers
Olga Kornievskaia <[email protected]>
NFSv4.1: fix pnfs MDS=DS session trunking
Olga Kornievskaia <[email protected]>
NFSv4.1: use EXCHGID4_FLAG_USE_PNFS_DS for DS server
Trond Myklebust <[email protected]>
SUNRPC: Mark the cred for revalidation if the server rejects it
Trond Myklebust <[email protected]>
NFS/pNFS: Report EINVAL errors from connect() to the server
Trond Myklebust <[email protected]>
NFS: More fixes for nfs_direct_write_reschedule_io()
Trond Myklebust <[email protected]>
NFS: Use the correct commit info in nfs_join_page_group()
Trond Myklebust <[email protected]>
NFS: More O_DIRECT accounting fixes for error paths
Trond Myklebust <[email protected]>
NFS: Fix O_DIRECT locking issues
Trond Myklebust <[email protected]>
NFS: Fix error handling for O_DIRECT write scheduling
-------------
Diffstat:
Documentation/admin-guide/cgroup-v1/memory.rst | 9 +- Documentation/sound/designs/midi-2.0.rst | 4 +- Makefile | 4 +- .../boot/dts/ti/omap/motorola-mapphone-common.dtsi | 4 +- arch/arm/boot/dts/ti/omap/omap3-cpu-thermal.dtsi | 3 +- arch/arm/boot/dts/ti/omap/omap4-cpu-thermal.dtsi | 5 +- arch/arm/boot/dts/ti/omap/omap443x.dtsi | 1 + arch/arm/boot/dts/ti/omap/omap4460.dtsi | 1 + arch/arm64/boot/dts/freescale/Makefile | 1 + arch/arm64/boot/dts/freescale/imx8mm-evk.dtsi | 32 +- .../arm64/boot/dts/freescale/imx8mp-beacon-kit.dts | 5 +- arch/arm64/boot/dts/freescale/imx8mp.dtsi | 6 + arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 9 + arch/arm64/configs/defconfig | 1 - arch/loongarch/include/asm/addrspace.h | 14 +- arch/loongarch/include/asm/elf.h | 9 + arch/loongarch/kernel/mem.c | 4 +- arch/loongarch/kernel/module.c | 22 +- arch/loongarch/kernel/numa.c | 2 +- arch/loongarch/kernel/vmlinux.lds.S | 55 +-- arch/mips/alchemy/devboards/db1000.c | 4 + arch/mips/alchemy/devboards/db1200.c | 6 + arch/mips/alchemy/devboards/db1300.c | 4 + arch/parisc/include/asm/ropes.h | 7 +- arch/parisc/kernel/drivers.c | 2 +- arch/parisc/kernel/irq.c | 2 +- arch/powerpc/kernel/hw_breakpoint.c | 16 +- arch/powerpc/kernel/hw_breakpoint_constraints.c | 7 +- arch/powerpc/kernel/stacktrace.c | 27 +- arch/powerpc/kernel/traps.c | 56 ++- arch/powerpc/perf/hv-24x7.c | 2 +- arch/riscv/include/asm/errata_list.h | 4 +- arch/x86/Kconfig | 2 +- arch/x86/include/asm/kexec.h | 2 - arch/x86/include/asm/kvm_host.h | 3 +- arch/x86/include/asm/linkage.h | 7 + arch/x86/include/asm/processor.h | 2 - arch/x86/include/asm/reboot.h | 2 + arch/x86/kernel/cpu/amd.c | 28 +- arch/x86/kernel/cpu/bugs.c | 17 +- arch/x86/kernel/cpu/common.c | 2 +- arch/x86/kernel/cpu/sgx/encl.c | 30 +- arch/x86/kernel/crash.c | 31 -- arch/x86/kernel/reboot.c | 22 ++ arch/x86/kernel/setup.c | 8 +- arch/x86/kvm/mmu/mmu.c | 20 +- arch/x86/kvm/mmu/mmu_internal.h | 15 +- arch/x86/kvm/mmu/tdp_mmu.c | 152 ++++---- arch/x86/kvm/mmu/tdp_mmu.h | 5 +- arch/x86/kvm/svm/sev.c | 34 +- arch/x86/kvm/svm/svm.c | 9 +- arch/x86/kvm/svm/svm.h | 1 + arch/x86/kvm/vmx/vmx.c | 10 +- arch/x86/kvm/x86.c | 5 +- arch/x86/lib/memcpy_64.S | 2 +- arch/x86/lib/memmove_64.S | 2 +- arch/x86/lib/memset_64.S | 2 +- arch/xtensa/boot/Makefile | 3 +- arch/xtensa/boot/lib/zmem.c | 5 +- arch/xtensa/include/asm/core.h | 4 + arch/xtensa/lib/umulsidi3.S | 4 +- arch/xtensa/platforms/iss/network.c | 4 +- crypto/sm2.c | 6 +- drivers/accel/ivpu/ivpu_fw.c | 8 +- drivers/accel/ivpu/ivpu_gem.h | 5 + drivers/accel/ivpu/ivpu_ipc.c | 11 +- drivers/acpi/nfit/core.c | 2 +- drivers/ata/libata-core.c | 47 ++- drivers/ata/libata-eh.c | 16 +- drivers/ata/libata-scsi.c | 53 ++- drivers/ata/libata-transport.c | 9 +- drivers/ata/libata.h | 2 + drivers/ata/sata_mv.c | 4 +- drivers/block/rbd.c | 416 +++++++++++---------- drivers/bus/ti-sysc.c | 31 +- drivers/char/agp/parisc-agp.c | 2 - drivers/clk/clk-si521xx.c | 9 +- drivers/clk/sprd/ums512-clk.c | 2 +- drivers/clk/tegra/clk-bpmp.c | 2 +- drivers/cxl/core/mbox.c | 23 +- drivers/cxl/core/port.c | 13 +- drivers/cxl/core/region.c | 24 +- drivers/cxl/pci.c | 6 +- drivers/firewire/sbp2.c | 9 +- drivers/firmware/arm_ffa/driver.c | 16 +- drivers/firmware/arm_scmi/perf.c | 93 +++-- drivers/firmware/cirrus/cs_dsp.c | 34 +- drivers/firmware/imx/imx-dsp.c | 1 + drivers/gpio/gpio-pmic-eic-sprd.c | 1 + drivers/gpio/gpio-tb10x.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 19 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ring_mux.h | 9 + drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 7 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_4_3.c | 72 ++-- drivers/gpu/drm/amd/amdgpu/nbio_v4_3.c | 3 + drivers/gpu/drm/amd/amdgpu/soc21.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 3 +- drivers/gpu/drm/amd/amdkfd/kfd_crat.h | 4 + .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.c | 34 +- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager.h | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_cik.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v10.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c | 43 ++- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c | 44 ++- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_vi.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 75 ++-- drivers/gpu/drm/amd/amdkfd/kfd_topology.h | 2 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 +- .../amd/display/dc/dce110/dce110_hw_sequencer.c | 4 +- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 47 +-- .../amd/display/dc/link/accessories/link_dp_cts.c | 105 +++--- drivers/gpu/drm/amd/include/kgd_kfd_interface.h | 6 +- drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 11 +- drivers/gpu/drm/i915/gt/intel_engine_cs.c | 1 - .../gpu/drm/i915/gt/intel_execlists_submission.c | 2 + drivers/gpu/drm/i915/gt/intel_ggtt.c | 23 +- drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 38 +- drivers/gpu/drm/meson/meson_encoder_hdmi.c | 2 + drivers/gpu/drm/tests/drm_mm_test.c | 2 +- drivers/gpu/drm/virtio/virtgpu_submit.c | 1 - drivers/i2c/busses/i2c-designware-common.c | 17 + drivers/i2c/busses/i2c-designware-core.h | 3 + drivers/i2c/busses/i2c-i801.c | 1 + drivers/i2c/busses/i2c-npcm7xx.c | 17 +- drivers/i2c/busses/i2c-xiic.c | 2 +- drivers/i2c/muxes/i2c-demux-pinctrl.c | 4 + drivers/i2c/muxes/i2c-mux-gpio.c | 4 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c | 27 +- drivers/media/common/videobuf2/frame_vector.c | 6 +- drivers/media/platform/marvell/Kconfig | 4 +- drivers/media/platform/via/Kconfig | 2 +- drivers/media/usb/em28xx/Kconfig | 4 +- drivers/media/usb/go7007/Kconfig | 2 +- drivers/media/usb/uvc/uvc_ctrl.c | 3 + drivers/misc/cardreader/rts5227.c | 55 +-- drivers/misc/cardreader/rts5228.c | 57 +-- drivers/misc/cardreader/rts5249.c | 56 +-- drivers/misc/cardreader/rts5260.c | 43 +-- drivers/misc/cardreader/rts5261.c | 52 +-- drivers/misc/cardreader/rtsx_pcr.c | 51 ++- drivers/net/ethernet/amazon/ena/ena_netdev.c | 3 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 5 + drivers/net/ethernet/engleder/tsnep_ethtool.c | 6 +- drivers/net/ethernet/engleder/tsnep_main.c | 18 +- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 9 + .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 13 +- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 3 +- drivers/net/ethernet/huawei/hinic/hinic_port.c | 3 - drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 8 +- drivers/net/ethernet/intel/iavf/iavf.h | 2 +- drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 2 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 17 +- drivers/net/ethernet/intel/igc/igc_ethtool.c | 31 +- drivers/net/ethernet/intel/igc/igc_main.c | 2 +- .../net/ethernet/marvell/octeon_ep/octep_main.c | 8 +- drivers/net/ethernet/marvell/octeon_ep/octep_tx.c | 8 +- drivers/net/ethernet/marvell/octeon_ep/octep_tx.h | 16 +- .../net/ethernet/marvell/octeontx2/nic/otx2_txrx.c | 19 +- .../net/ethernet/microchip/vcap/vcap_api_kunit.c | 59 ++- drivers/net/ethernet/pensando/ionic/ionic_dev.h | 1 + drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 10 +- drivers/net/team/team.c | 10 +- drivers/net/thunderbolt/main.c | 3 +- drivers/net/vxlan/vxlan_core.c | 4 + drivers/nvme/host/fc.c | 2 +- drivers/nvme/host/pci.c | 3 - drivers/parisc/ccio-dma.c | 18 +- drivers/parisc/iommu-helpers.h | 8 +- drivers/parisc/iosapic.c | 4 +- drivers/parisc/iosapic_private.h | 4 +- drivers/parisc/sba_iommu.c | 28 +- drivers/platform/mellanox/Kconfig | 1 + drivers/platform/x86/asus-nb-wmi.c | 9 + drivers/platform/x86/intel_scu_ipc.c | 66 ++-- drivers/power/supply/ab8500_btemp.c | 9 +- drivers/power/supply/ab8500_chargalg.c | 2 +- drivers/power/supply/mt6370-charger.c | 2 +- drivers/power/supply/power_supply_sysfs.c | 7 + drivers/power/supply/rk817_charger.c | 16 +- drivers/power/supply/rt9467-charger.c | 4 +- drivers/power/supply/ucs1002_power.c | 3 +- drivers/scsi/iscsi_tcp.c | 4 + drivers/scsi/pm8001/pm8001_hwi.c | 2 +- drivers/scsi/pm8001/pm80xx_hwi.c | 4 +- drivers/scsi/qedf/qedf_io.c | 10 +- drivers/scsi/qedf/qedf_main.c | 7 +- drivers/scsi/scsi.c | 11 + drivers/scsi/scsi_scan.c | 2 +- drivers/scsi/sd.c | 101 ++++- drivers/scsi/sd.h | 1 + drivers/soc/imx/soc-imx8m.c | 10 + drivers/spi/spi-gxp.c | 2 +- drivers/spi/spi-intel-pci.c | 1 + drivers/spi/spi-nxp-fspi.c | 7 + drivers/spi/spi-stm32.c | 8 + drivers/spi/spi-sun6i.c | 31 +- drivers/spi/spi-zynqmp-gqspi.c | 12 +- drivers/thermal/thermal_of.c | 8 +- drivers/thermal/thermal_sysfs.c | 9 +- drivers/tty/n_gsm.c | 4 +- drivers/tty/serial/8250/8250_port.c | 5 +- drivers/ufs/core/ufshcd.c | 13 +- drivers/vfio/mdev/mdev_sysfs.c | 3 +- drivers/video/fbdev/Kconfig | 2 +- fs/binfmt_elf_fdpic.c | 5 +- fs/btrfs/delayed-inode.c | 85 +++-- fs/btrfs/extent_io.c | 8 +- fs/btrfs/file.c | 16 +- fs/btrfs/inode.c | 29 +- fs/btrfs/super.c | 2 +- fs/ceph/caps.c | 6 +- fs/ceph/mds_client.c | 12 +- fs/ceph/mds_client.h | 11 +- fs/ceph/quota.c | 14 +- fs/ceph/snap.c | 10 +- fs/ceph/super.c | 75 +++- fs/ceph/super.h | 3 + fs/ext4/mballoc.c | 60 +-- fs/gfs2/glock.c | 4 +- fs/gfs2/glops.c | 9 +- fs/libfs.c | 1 + fs/netfs/buffered_read.c | 6 +- fs/nfs/direct.c | 134 +++++-- fs/nfs/flexfilelayout/flexfilelayout.c | 1 + fs/nfs/nfs4client.c | 9 +- fs/nfs/nfs4proc.c | 14 +- fs/nfs/nfs4state.c | 38 +- fs/nfs/write.c | 23 +- fs/nfsd/nfs4xdr.c | 4 +- fs/nilfs2/gcinode.c | 6 +- fs/proc/internal.h | 2 - fs/proc/task_nommu.c | 70 ++-- fs/smb/client/cifsglob.h | 1 + fs/smb/client/fs_context.c | 1 + fs/smb/client/inode.c | 2 +- fs/smb/client/smb2ops.c | 6 +- fs/smb/client/transport.c | 34 +- include/linux/atomic/atomic-arch-fallback.h | 10 +- include/linux/bpf.h | 2 +- include/linux/btf_ids.h | 2 +- include/linux/compiler_attributes.h | 26 +- include/linux/if_team.h | 2 + include/linux/interrupt.h | 6 +- include/linux/libata.h | 4 +- include/linux/memcontrol.h | 4 +- include/linux/nfs_fs_sb.h | 1 + include/linux/nfs_page.h | 4 +- include/linux/resume_user_mode.h | 2 +- include/linux/seqlock.h | 2 +- include/net/netfilter/nf_tables.h | 7 +- include/scsi/scsi.h | 3 + include/scsi/scsi_device.h | 5 +- include/uapi/linux/bpf.h | 4 +- include/uapi/linux/stddef.h | 11 + io_uring/fs.c | 2 +- kernel/bpf/btf.c | 2 +- kernel/bpf/memalloc.c | 33 +- kernel/bpf/offload.c | 12 +- kernel/bpf/queue_stack_maps.c | 21 +- kernel/dma/debug.c | 20 +- kernel/dma/swiotlb.c | 4 +- kernel/sched/core.c | 2 +- kernel/sched/cpupri.c | 1 + kernel/sched/idle.c | 1 + kernel/trace/bpf_trace.c | 16 + kernel/trace/ring_buffer.c | 38 +- kernel/trace/trace_events_user.c | 58 ++- mm/damon/vaddr-test.h | 2 + mm/memcontrol.c | 13 +- mm/mempolicy.c | 39 +- mm/page_alloc.c | 12 +- mm/slab_common.c | 12 +- net/bridge/br_forward.c | 4 +- net/bridge/br_input.c | 4 +- net/core/flow_dissector.c | 2 +- net/dccp/ipv4.c | 9 +- net/dccp/ipv6.c | 9 +- net/handshake/handshake-test.c | 14 +- net/hsr/hsr_framereg.c | 4 +- net/hsr/hsr_main.h | 2 +- net/ipv4/route.c | 4 +- net/mptcp/options.c | 5 +- net/mptcp/protocol.c | 41 ++ net/mptcp/subflow.c | 36 -- net/ncsi/ncsi-aen.c | 5 + net/netfilter/ipset/ip_set_core.c | 12 +- net/netfilter/nf_conntrack_bpf.c | 2 + net/netfilter/nf_conntrack_extend.c | 4 +- net/netfilter/nf_tables_api.c | 79 +++- net/netfilter/nft_set_hash.c | 11 +- net/netfilter/nft_set_pipapo.c | 4 +- net/netfilter/nft_set_rbtree.c | 8 +- net/rds/rdma_transport.c | 12 +- net/smc/smc_stats.h | 3 +- net/sunrpc/clnt.c | 15 +- scripts/atomic/gen-atomic-fallback.sh | 2 +- sound/core/rawmidi.c | 2 +- sound/core/seq/seq_ump_client.c | 24 +- sound/core/seq/seq_ump_convert.c | 2 + sound/hda/intel-sdw-acpi.c | 8 +- sound/pci/hda/hda_intel.c | 1 + sound/pci/hda/patch_realtek.c | 3 +- sound/soc/amd/yc/acp6x-mach.c | 35 ++ sound/soc/codecs/cs35l56-i2c.c | 1 - sound/soc/codecs/cs35l56.c | 1 + sound/soc/codecs/cs42l42-sdw.c | 20 + sound/soc/codecs/cs42l42.c | 21 +- sound/soc/codecs/cs42l42.h | 1 + sound/soc/codecs/rt5640.c | 33 +- sound/soc/codecs/wm_adsp.c | 13 +- sound/soc/fsl/imx-audmix.c | 2 +- sound/soc/fsl/imx-pcm-rpmsg.c | 1 + sound/soc/fsl/imx-rpmsg.c | 8 + sound/soc/intel/avs/boards/hdaudio.c | 3 + sound/soc/meson/axg-spdifin.c | 49 +-- sound/soc/sof/core.c | 3 +- sound/soc/sof/intel/mtl.c | 2 +- sound/soc/sof/intel/mtl.h | 1 - sound/soc/sof/ipc4-topology.c | 2 +- sound/soc/sof/sof-audio.c | 3 +- tools/include/linux/btf_ids.h | 2 +- tools/include/linux/mm.h | 4 +- tools/include/linux/seq_file.h | 2 + tools/include/uapi/linux/bpf.h | 4 +- tools/objtool/check.c | 3 +- tools/perf/util/Build | 6 + tools/testing/memblock/internal.h | 4 + tools/testing/memblock/mmzone.c | 2 +- tools/testing/memblock/tests/basic_api.c | 2 +- tools/testing/memblock/tests/common.h | 1 + tools/testing/selftests/bpf/test_verifier.c | 2 +- .../ftrace/test.d/instances/instance-event.tc | 2 +- tools/testing/selftests/kselftest_deps.sh | 77 +++- .../selftests/mm/charge_reserved_hugetlb.sh | 4 +- .../selftests/mm/hugetlb_reparenting_test.sh | 4 +- tools/testing/selftests/net/tls.c | 8 +- tools/testing/selftests/powerpc/Makefile | 7 +- tools/testing/selftests/powerpc/pmu/Makefile | 11 +- 347 files changed, 3207 insertions(+), 1871 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/321 NFS: Fix error handling for O_DIRECT write scheduling
6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 954998b60caa8f2a3bf3abe490de6f08d283687a ]
If we fail to schedule a request for transmission, there are 2 possibilities:
1) Either we hit a fatal error, and we just want to drop the remaining requests on the floor.
2) We were asked to try again, in which case we should allow the outstanding RPC calls to complete, so that we can recoalesce requests and try again.
--- fs/nfs/direct.c | 62 ++++++++++++++++++++++++++++++++++++------------- 1 file changed, 46 insertions(+), 16 deletions(-)
fs/nfs/direct.c +46 -16
@@ -528,10 +528,9 @@ nfs_direct_write_scan_commit_list(struct inode *inode,static void nfs_direct_write_reschedule (struct nfs_direct_req *dreq) {struct nfs_pageio_descriptor desc; -struct nfs_page *req, *tmp; +struct nfs_page *req;LIST_HEAD (reqs);struct nfs_commit_info cinfo; -LIST_HEAD (failed);nfs_init_cinfo_from_dreq (&cinfo, dreq);nfs_direct_write_scan_commit_list (dreq->inode, &reqs, &cinfo);
@@ -549,27 +548,36 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq) &nfs_direct_write_completion_ops); desc.pg_dreq = dreq; -list_for_each_entry_safe (req, tmp, &reqs, wb_list) { +while (!list_empty (&reqs)) { + req =nfs_list_entry (reqs.next);/* Bump the transmission count */ req->wb_nio++;if (!nfs_pageio_add_request (&desc, req)) { -nfs_list_move_request (req, &failed);spin_lock (&cinfo.inode->i_lock); - dreq->flags =0 ; -if (desc.pg_error <0 ) +if (dreq->error <0 ) { + desc.pg_error = dreq->error; + }else if (desc.pg_error != -EAGAIN ) { + dreq->flags =0 ; +if (!desc.pg_error) + desc.pg_error = -EIO ; dreq->error = desc.pg_error; -else - dreq->error = -EIO ; + }else + dreq->flags =NFS_ODIRECT_RESCHED_WRITES ;spin_unlock (&cinfo.inode->i_lock); +break ; }nfs_release_request (req); }nfs_pageio_complete (&desc); -while (!list_empty (&failed)) { - req =nfs_list_entry (failed.next); +while (!list_empty (&reqs)) { + req =nfs_list_entry (reqs.next);nfs_list_remove_request (req);nfs_unlock_and_release_request (req); +if (desc.pg_error == -EAGAIN ) +nfs_mark_request_commit (req,NULL , &cinfo,0 ); +else +nfs_release_request (req); }if (put_dreq (dreq))
@@ -794,9 +802,11 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, {struct nfs_pageio_descriptor desc;struct inode *inode = dreq->inode; +struct nfs_commit_info cinfo;ssize_t result =0 ;size_t requested_bytes =0 ;size_t wsize =max_t (size_t,NFS_SERVER (inode)->wsize,PAGE_SIZE ); +bool defer = false;trace_nfs_direct_write_schedule_iovec (dreq);
@@ -837,17 +847,37 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq,break ; } -nfs_lock_request (req); -if (!nfs_pageio_add_request (&desc, req)) { - result = desc.pg_error; -nfs_unlock_and_release_request (req); -break ; - } pgbase =0 ; bytes -= req_len; requested_bytes += req_len; pos += req_len; dreq->bytes_left -= req_len; + +if (defer) { +nfs_mark_request_commit (req,NULL , &cinfo,0 ); +continue ; + } + +nfs_lock_request (req); +if (nfs_pageio_add_request (&desc, req)) +continue ; + +/* Exit on hard errors */ +if (desc.pg_error <0 && desc.pg_error != -EAGAIN ) { + result = desc.pg_error; +nfs_unlock_and_release_request (req); +break ; + } + +/* If the error is soft, defer remaining requests */ +nfs_init_cinfo_from_dreq (&cinfo, dreq); +spin_lock (&cinfo.inode->i_lock); + dreq->flags =NFS_ODIRECT_RESCHED_WRITES ; +spin_unlock (&cinfo.inode->i_lock); +nfs_unlock_request (req); +nfs_mark_request_commit (req,NULL , &cinfo,0 ); + desc.pg_error =0 ; + defer = true; }nfs_direct_release_pages (pagevec, npages);kvfree (pagevec);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 2/321 NFS: Fix O_DIRECT locking issues
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 7c6339322ce0c6128acbe36aacc1eeb986dd7bf1 ]
The dreq fields are protected by the dreq->lock.
--- fs/nfs/direct.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
fs/nfs/direct.c +4 -4
@@ -553,7 +553,7 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq)/* Bump the transmission count */ req->wb_nio++;if (!nfs_pageio_add_request (&desc, req)) { -spin_lock (&cinfo.inode->i_lock); +spin_lock (&dreq->lock);if (dreq->error <0 ) { desc.pg_error = dreq->error; }else if (desc.pg_error != -EAGAIN ) {
@@ -563,7 +563,7 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq) dreq->error = desc.pg_error; }else dreq->flags =NFS_ODIRECT_RESCHED_WRITES ; -spin_unlock (&cinfo.inode->i_lock); +spin_unlock (&dreq->lock);break ; }nfs_release_request (req);
@@ -871,9 +871,9 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq,/* If the error is soft, defer remaining requests */ nfs_init_cinfo_from_dreq (&cinfo, dreq); -spin_lock (&cinfo.inode->i_lock); +spin_lock (&dreq->lock); dreq->flags =NFS_ODIRECT_RESCHED_WRITES ; -spin_unlock (&cinfo.inode->i_lock); +spin_unlock (&dreq->lock);nfs_unlock_request (req);nfs_mark_request_commit (req,NULL , &cinfo,0 ); desc.pg_error =0 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 3/321 NFS: More O_DIRECT accounting fixes for error paths
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 8982f7aff39fb526aba4441fff2525fcedd5e1a3 ]
If we hit a fatal error when retransmitting, we do need to record the removal of the request from the count of written bytes.
--- fs/nfs/direct.c | 47 +++++++++++++++++++++++++++++++---------------- 1 file changed, 31 insertions(+), 16 deletions(-)
fs/nfs/direct.c +31 -16
@@ -93,12 +93,10 @@ nfs_direct_handle_truncated(struct nfs_direct_req *dreq, dreq->max_count = dreq_len;if (dreq->count > dreq_len) dreq->count = dreq_len; - -if (test_bit (NFS_IOHDR_ERROR , &hdr->flags)) - dreq->error = hdr->error; -else /* Clear outstanding error if this is EOF */ - dreq->error =0 ; } + +if (test_bit (NFS_IOHDR_ERROR , &hdr->flags) && !dreq->error) + dreq->error = hdr->error; } static void
@@ -120,6 +118,18 @@ nfs_direct_count_bytes(struct nfs_direct_req *dreq, dreq->count = dreq_len; } +static void nfs_direct_truncate_request (struct nfs_direct_req *dreq, +struct nfs_page *req) +{ +loff_t offs =req_offset (req); +size_t req_start = (size_t )(offs - dreq->io_start); + +if (req_start < dreq->max_count) + dreq->max_count = req_start; +if (req_start < dreq->count) + dreq->count = req_start; +} +/** * nfs_swap_rw - NFS address space operation for swap I/O * @iocb: target I/O control block
@@ -537,10 +547,6 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq)nfs_direct_join_group (&reqs, dreq->inode); - dreq->count =0 ; - dreq->max_count =0 ; -list_for_each_entry (req, &reqs, wb_list) - dreq->max_count += req->wb_bytes;nfs_clear_pnfs_ds_commit_verifiers (&dreq->ds_cinfo);get_dreq (dreq);
@@ -574,10 +580,14 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq) req =nfs_list_entry (reqs.next);nfs_list_remove_request (req);nfs_unlock_and_release_request (req); -if (desc.pg_error == -EAGAIN ) +if (desc.pg_error == -EAGAIN ) {nfs_mark_request_commit (req,NULL , &cinfo,0 ); -else + }else { +spin_lock (&dreq->lock); +nfs_direct_truncate_request (dreq, req); +spin_unlock (&dreq->lock);nfs_release_request (req); + } }if (put_dreq (dreq))
@@ -597,8 +607,6 @@ static void nfs_direct_commit_complete(struct nfs_commit_data *data)if (status <0 ) {/* Errors in commit are fatal */ dreq->error = status; - dreq->max_count =0 ; - dreq->count =0 ; dreq->flags =NFS_ODIRECT_DONE ; }else { status = dreq->error;
@@ -609,7 +617,12 @@ static void nfs_direct_commit_complete(struct nfs_commit_data *data)while (!list_empty (&data->pages)) { req =nfs_list_entry (data->pages.next);nfs_list_remove_request (req); -if (status >=0 && !nfs_write_match_verf (verf, req)) { +if (status <0 ) { +spin_lock (&dreq->lock); +nfs_direct_truncate_request (dreq, req); +spin_unlock (&dreq->lock); +nfs_release_request (req); + }else if (!nfs_write_match_verf (verf, req)) { dreq->flags =NFS_ODIRECT_RESCHED_WRITES ;/* * Despite the reboot, the write was successful,
@@ -617,7 +630,7 @@ static void nfs_direct_commit_complete(struct nfs_commit_data *data)*/ req->wb_nio =0 ;nfs_mark_request_commit (req,NULL , &cinfo,0 ); - }else /* Error or match */ + }else nfs_release_request (req);nfs_unlock_and_release_request (req); }
@@ -670,6 +683,7 @@ static void nfs_direct_write_clear_reqs(struct nfs_direct_req *dreq)while (!list_empty (&reqs)) { req =nfs_list_entry (reqs.next);nfs_list_remove_request (req); +nfs_direct_truncate_request (dreq, req);nfs_release_request (req);nfs_unlock_and_release_request (req); }
@@ -719,7 +733,8 @@ static void nfs_direct_write_completion(struct nfs_pgio_header *hdr) }nfs_direct_count_bytes (dreq, hdr); -if (test_bit (NFS_IOHDR_UNSTABLE_WRITES , &hdr->flags)) { +if (test_bit (NFS_IOHDR_UNSTABLE_WRITES , &hdr->flags) && + !test_bit (NFS_IOHDR_ERROR , &hdr->flags)) {if (!dreq->flags) dreq->flags =NFS_ODIRECT_DO_COMMIT ; flags = dreq->flags;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 4/321 NFS: Use the correct commit info in nfs_join_page_group()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit b193a78ddb5ee7dba074d3f28dc050069ba083c0 ]
Ensure that nfs_clear_request_commit() updates the correct counters when it removes them from the commit list.
--- fs/nfs/direct.c | 8 +++++--- fs/nfs/write.c | 23 ++++++++++++----------- include/linux/nfs_page.h | 4 +++- 3 files changed, 20 insertions(+), 15 deletions(-)
fs/nfs/direct.c +5 -3
@@ -498,7 +498,9 @@ static void nfs_direct_add_page_head(struct list_head *list,kref_get (&head->wb_kref); } -static void nfs_direct_join_group (struct list_head *list,struct inode *inode) +static void nfs_direct_join_group (struct list_head *list, +struct nfs_commit_info *cinfo, +struct inode *inode) {struct nfs_page *req, *subreq;
@@ -520,7 +522,7 @@ static void nfs_direct_join_group(struct list_head *list, struct inode *inode)nfs_release_request (subreq); } }while ((subreq = subreq->wb_this_page) != req); -nfs_join_page_group (req, inode); +nfs_join_page_group (req, cinfo, inode); } }
@@ -545,7 +547,7 @@ static void nfs_direct_write_reschedule(struct nfs_direct_req *dreq)nfs_init_cinfo_from_dreq (&cinfo, dreq);nfs_direct_write_scan_commit_list (dreq->inode, &reqs, &cinfo); -nfs_direct_join_group (&reqs, dreq->inode); +nfs_direct_join_group (&reqs, &cinfo, dreq->inode);nfs_clear_pnfs_ds_commit_verifiers (&dreq->ds_cinfo);get_dreq (dreq);
fs/nfs/write.c +12 -11
@@ -59,7 +59,8 @@ static const struct nfs_pgio_completion_ops nfs_async_write_completion_ops;static const struct nfs_commit_completion_ops nfs_commit_completion_ops;static const struct nfs_rw_ops nfs_rw_write_ops;static void nfs_inode_remove_request (struct nfs_page *req); -static void nfs_clear_request_commit (struct nfs_page *req); +static void nfs_clear_request_commit (struct nfs_commit_info *cinfo, +struct nfs_page *req);static void nfs_init_cinfo_from_inode (struct nfs_commit_info *cinfo,struct inode *inode); static struct nfs_page *
@@ -502,8 +503,8 @@ nfs_destroy_unlinked_subrequests(struct nfs_page *destroy_list,* the (former) group. All subrequests are removed from any write or commit * lists, unlinked from the group and destroyed. */ -void -nfs_join_page_group (struct nfs_page *head,struct inode *inode) +void nfs_join_page_group (struct nfs_page *head,struct nfs_commit_info *cinfo, +struct inode *inode) {struct nfs_page *subreq;struct nfs_page *destroy_list =NULL ;
@@ -533,7 +534,7 @@ nfs_join_page_group(struct nfs_page *head, struct inode *inode)* Commit list removal accounting is done after locks are dropped */ subreq = head;do { -nfs_clear_request_commit (subreq); +nfs_clear_request_commit (cinfo, subreq); subreq = subreq->wb_this_page; }while (subreq != head);
@@ -566,8 +567,10 @@ static struct nfs_page *nfs_lock_and_join_requests(struct folio *folio) {struct inode *inode =folio_file_mapping (folio)->host;struct nfs_page *head; +struct nfs_commit_info cinfo;int ret; +nfs_init_cinfo_from_inode (&cinfo, inode);/* * A reference is taken only on the head request which acts as a * reference to the whole page group - the group will not be destroyed
@@ -584,7 +587,7 @@ static struct nfs_page *nfs_lock_and_join_requests(struct folio *folio)return ERR_PTR (ret); } -nfs_join_page_group (head, inode); +nfs_join_page_group (head, &cinfo, inode);return head; }
@@ -955,18 +958,16 @@ static void nfs_folio_clear_commit(struct folio *folio) }/* Called holding the request lock on @req */ -static void -nfs_clear_request_commit (struct nfs_page *req) +static void nfs_clear_request_commit (struct nfs_commit_info *cinfo, +struct nfs_page *req) {if (test_bit (PG_CLEAN , &req->wb_flags)) {struct nfs_open_context *ctx =nfs_req_openctx (req);struct inode *inode =d_inode (ctx->dentry); -struct nfs_commit_info cinfo; -nfs_init_cinfo_from_inode (&cinfo, inode);mutex_lock (&NFS_I (inode)->commit_mutex); -if (!pnfs_clear_request_commit (req, &cinfo)) { -nfs_request_remove_commit_list (req, &cinfo); +if (!pnfs_clear_request_commit (req, cinfo)) { +nfs_request_remove_commit_list (req, cinfo); }mutex_unlock (&NFS_I (inode)->commit_mutex);nfs_folio_clear_commit (nfs_page_to_folio (req));
include/linux/nfs_page.h +3 -1
@@ -157,7 +157,9 @@ extern void nfs_unlock_request(struct nfs_page *req);extern void nfs_unlock_and_release_request (struct nfs_page *);extern struct nfs_page *nfs_page_group_lock_head (struct nfs_page *req);extern int nfs_page_group_lock_subrequests (struct nfs_page *head); -extern void nfs_join_page_group (struct nfs_page *head,struct inode *inode); +extern void nfs_join_page_group (struct nfs_page *head, +struct nfs_commit_info *cinfo, +struct inode *inode);extern int nfs_page_group_lock (struct nfs_page *);extern void nfs_page_group_unlock (struct nfs_page *);extern bool nfs_page_group_sync_on_bit (struct nfs_page *,unsigned int );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 5/321 NFS: More fixes for nfs_direct_write_reschedule_io()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit b11243f720ee5f9376861099019c8542969b6318 ]
Ensure that all requests are put back onto the commit list so that they can be rescheduled.
--- fs/nfs/direct.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-)
fs/nfs/direct.c +11 -6
@@ -780,18 +780,23 @@ static void nfs_write_sync_pgio_error(struct list_head *head, int error)static void nfs_direct_write_reschedule_io (struct nfs_pgio_header *hdr) {struct nfs_direct_req *dreq = hdr->dreq; +struct nfs_page *req; +struct nfs_commit_info cinfo;trace_nfs_direct_write_reschedule_io (dreq); +nfs_init_cinfo_from_dreq (&cinfo, dreq);spin_lock (&dreq->lock); -if (dreq->error ==0 ) { +if (dreq->error ==0 ) dreq->flags =NFS_ODIRECT_RESCHED_WRITES ; -/* fake unstable write to let common nfs resend pages */ - hdr->verf.committed =NFS_UNSTABLE ; - hdr->good_bytes = hdr->args.offset + hdr->args.count - - hdr->io_start; - } +set_bit (NFS_IOHDR_REDO , &hdr->flags);spin_unlock (&dreq->lock); +while (!list_empty (&hdr->pages)) { + req =nfs_list_entry (hdr->pages.next); +nfs_list_remove_request (req); +nfs_unlock_request (req); +nfs_mark_request_commit (req,NULL , &cinfo,0 ); + } }static const struct nfs_pgio_completion_ops nfs_direct_write_completion_ops = {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 6/321 NFS/pNFS: Report EINVAL errors from connect() to the server
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit dd7d7ee3ba2a70d12d02defb478790cf57d5b87b ]
With IPv6, connect() can occasionally return EINVAL if a route is unavailable. If this happens during I/O to a data server, we want to report it using LAYOUTERROR as an inability to connect.
--- fs/nfs/flexfilelayout/flexfilelayout.c | 1 + 1 file changed, 1 insertion(+)
fs/nfs/flexfilelayout/flexfilelayout.c +1 -0
@@ -1235,6 +1235,7 @@ static void ff_layout_io_track_ds_error(struct pnfs_layout_segment *lseg,case -EPFNOSUPPORT :case -EPROTONOSUPPORT :case -EOPNOTSUPP : +case -EINVAL :case -ECONNREFUSED :case -ECONNRESET :case -EHOSTDOWN :
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 7/321 SUNRPC: Mark the cred for revalidation if the server rejects it
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 611fa42dfa9d2f3918ac5f4dd5705dfad81b323d ]
If the server rejects the credential as being stale, or bad, then we should mark it for revalidation before retransmitting.
--- net/sunrpc/clnt.c | 1 + 1 file changed, 1 insertion(+)
net/sunrpc/clnt.c +1 -0
@@ -2748,6 +2748,7 @@ rpc_decode_header(struct rpc_task *task, struct xdr_stream *xdr)case rpc_autherr_rejectedverf:case rpcsec_gsserr_credproblem:case rpcsec_gsserr_ctxproblem: +rpcauth_invalcred (task);if (!task->tk_cred_retry)break ; task->tk_cred_retry--;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 8/321 NFSv4.1: use EXCHGID4_FLAG_USE_PNFS_DS for DS server
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <[email protected]>
[ Upstream commit 51d674a5e4889f1c8e223ac131cf218e1631e423 ]
After receiving the location(s) of the DS server(s) in the GETDEVINCEINFO, create the request for the clientid to such server and indicate that the client is connecting to a DS.
Stable-dep-of: 806a3bc421a1 ("NFSv4.1: fix pnfs MDS=DS session trunking")
--- fs/nfs/nfs4client.c | 3 +++ fs/nfs/nfs4proc.c | 4 ++++ 2 files changed, 7 insertions(+)
fs/nfs/nfs4client.c +3 -0
@@ -232,6 +232,8 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init)__set_bit (NFS_CS_DISCRTRY , &clp->cl_flags);__set_bit (NFS_CS_NO_RETRANS_TIMEOUT , &clp->cl_flags); +if (test_bit (NFS_CS_DS , &cl_init->init_flags)) +__set_bit (NFS_CS_DS , &clp->cl_flags);/* * Set up the connection to the server before we add add to the * global list.
@@ -1007,6 +1009,7 @@ struct nfs_client *nfs4_set_ds_client(struct nfs_server *mds_srv,if (mds_srv->flags &NFS_MOUNT_NORESVPORT )__set_bit (NFS_CS_NORESVPORT , &cl_init.init_flags); +__set_bit (NFS_CS_DS , &cl_init.init_flags);/* * Set an authflavor equual to the MDS value. Use the MDS nfs_client * cl_ipaddr so as to use the same EXCHANGE_ID co_ownerid as the MDS
fs/nfs/nfs4proc.c +4 -0
@@ -8787,6 +8787,8 @@ nfs4_run_exchange_id(struct nfs_client *clp, const struct cred *cred,#ifdef CONFIG_NFS_V4_1_MIGRATION calldata->args.flags |=EXCHGID4_FLAG_SUPP_MOVED_MIGR ;#endif +if (test_bit (NFS_CS_DS , &clp->cl_flags)) + calldata->args.flags |=EXCHGID4_FLAG_USE_PNFS_DS ; msg.rpc_argp = &calldata->args; msg.rpc_resp = &calldata->res; task_setup_data.callback_data = calldata;
@@ -8864,6 +8866,8 @@ static int _nfs4_proc_exchange_id(struct nfs_client *clp, const struct cred *cre/* Save the EXCHANGE_ID verifier session trunk tests */ memcpy (clp->cl_confirm.data, argp->verifier.data,sizeof (clp->cl_confirm.data)); +if (resp->flags &EXCHGID4_FLAG_USE_PNFS_DS ) +set_bit (NFS_CS_DS , &clp->cl_flags); out:trace_nfs4_exchange_id (clp, status);rpc_put_task (task);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 9/321 NFSv4.1: fix pnfs MDS=DS session trunking
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <[email protected]>
[ Upstream commit 806a3bc421a115fbb287c1efce63a48c54ee804b ]
Currently, when GETDEVICEINFO returns multiple locations where each is a different IP but the server's identity is same as MDS, then nfs4_set_ds_client() finds the existing nfs_client structure which has the MDS's max_connect value (and if it's 1), then the 1st IP on the DS's list will get dropped due to MDS trunking rules. Other IPs would be added as they fall under the pnfs trunking rules.
For the list of IPs the 1st goes thru calling nfs4_set_ds_client() which will eventually call nfs4_add_trunk() and call into rpc_clnt_test_and_add_xprt() which has the check for MDS trunking. The other IPs (after the 1st one), would call rpc_clnt_add_xprt() which doesn't go thru that check.
nfs4_add_trunk() is called when MDS trunking is happening and it needs to enforce the usage of max_connect mount option of the 1st mount. However, this shouldn't be applied to pnfs flow.
Instead, this patch proposed to treat MDS=DS as DS trunking and make sure that MDS's max_connect limit does not apply to the 1st IP returned in the GETDEVICEINFO list. It does so by marking the newly created client with a new flag NFS_CS_PNFS which then used to pass max_connect value to use into the rpc_clnt_test_and_add_xprt() instead of the existing rpc client's max_connect value set by the MDS connection.
For example, mount was done without max_connect value set so MDS's rpc client has cl_max_connect=1. Upon calling into rpc_clnt_test_and_add_xprt() and using rpc client's value, the caller passes in max_connect value which is previously been set in the pnfs path (as a part of handling GETDEVICEINFO list of IPs) in nfs4_set_ds_client().
However, when NFS_CS_PNFS flag is not set and we know we are doing MDS trunking, comparing a new IP of the same server, we then set the max_connect value to the existing MDS's value and pass that into rpc_clnt_test_and_add_xprt().
--- fs/nfs/nfs4client.c | 6 +++++- include/linux/nfs_fs_sb.h | 1 + net/sunrpc/clnt.c | 11 +++++++---- 3 files changed, 13 insertions(+), 5 deletions(-)
fs/nfs/nfs4client.c +5 -1
@@ -417,6 +417,8 @@ static void nfs4_add_trunk(struct nfs_client *clp, struct nfs_client *old) .net = old->cl_net, .servername = old->cl_hostname, }; +int max_connect =test_bit (NFS_CS_PNFS , &clp->cl_flags) ? + clp->cl_max_connect : old->cl_max_connect;if (clp->cl_proto != old->cl_proto)return ;
@@ -430,7 +432,7 @@ static void nfs4_add_trunk(struct nfs_client *clp, struct nfs_client *old) xprt_args.addrlen = clp_salen;rpc_clnt_add_xprt (old->cl_rpcclient, &xprt_args, - rpc_clnt_test_and_add_xprt,NULL ); + rpc_clnt_test_and_add_xprt, &max_connect); }/**
@@ -1010,6 +1012,8 @@ struct nfs_client *nfs4_set_ds_client(struct nfs_server *mds_srv,__set_bit (NFS_CS_NORESVPORT , &cl_init.init_flags);__set_bit (NFS_CS_DS , &cl_init.init_flags); +__set_bit (NFS_CS_PNFS , &cl_init.init_flags); + cl_init.max_connect =NFS_MAX_TRANSPORTS ;/* * Set an authflavor equual to the MDS value. Use the MDS nfs_client * cl_ipaddr so as to use the same EXCHANGE_ID co_ownerid as the MDS
include/linux/nfs_fs_sb.h +1 -0
@@ -48,6 +48,7 @@ struct nfs_client {#define NFS_CS_NOPING 6/* - don't ping on connect */ #define NFS_CS_DS 7/* - Server is a DS */ #define NFS_CS_REUSEPORT 8/* - reuse src port on reconnect */ +#define NFS_CS_PNFS 9/* - Server used for pnfs */ struct sockaddr_storage cl_addr;/* server identifier */ size_t cl_addrlen;char * cl_hostname;/* hostname of server */
net/sunrpc/clnt.c +7 -4
@@ -2905,19 +2905,22 @@ static const struct rpc_call_ops rpc_cb_add_xprt_call_ops = {* @clnt: pointer to struct rpc_clnt * @xps: pointer to struct rpc_xprt_switch, * @xprt: pointer struct rpc_xprt -* @dummy: unused +* @in_max_connect: pointer to the max_connect value for the passed in xprt transport */ int rpc_clnt_test_and_add_xprt (struct rpc_clnt *clnt,struct rpc_xprt_switch *xps,struct rpc_xprt *xprt, -void *dummy) +void *in_max_connect) {struct rpc_cb_add_xprt_calldata *data;struct rpc_task *task; +int max_connect = clnt->cl_max_connect; -if (xps->xps_nunique_destaddr_xprts +1 > clnt->cl_max_connect) { +if (in_max_connect) + max_connect = *(int *)in_max_connect; +if (xps->xps_nunique_destaddr_xprts +1 > max_connect) {rcu_read_lock ();pr_warn ("SUNRPC: reached max allowed number (%d) did not add " -"transport to server: %s\n" , clnt->cl_max_connect, +"transport to server: %s\n" , max_connect,rpc_peeraddr2str (clnt,RPC_DISPLAY_ADDR ));rcu_read_unlock ();return -EINVAL ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 10/321 media: v4l: Use correct dependency for camera sensor drivers
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
[ Upstream commit 86e16b87afac20779da1228d690a95c54d7e2ad0 ]
The Kconfig option that enables compiling camera sensor drivers is VIDEO_CAMERA_SENSOR rather than MEDIA_CAMERA_SUPPORT as it was previously. Fix this.
Also select VIDEO_OV7670 for marvell platform drivers only if MEDIA_SUBDRV_AUTOSELECT and VIDEO_CAMERA_SENSOR are enabled.
--- drivers/media/platform/marvell/Kconfig | 4 ++-- drivers/media/usb/em28xx/Kconfig | 4 ++-- drivers/media/usb/go7007/Kconfig | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-)
drivers/media/platform/marvell/Kconfig +2 -2
@@ -7,7 +7,7 @@ config VIDEO_CAFE_CCIC depends on V4L_PLATFORM_DRIVERS depends on PCI && I2C && VIDEO_DEV depends on COMMON_CLK - select VIDEO_OV7670 + select VIDEO_OV7670 if MEDIA_SUBDRV_AUTOSELECT && VIDEO_CAMERA_SENSOR select VIDEOBUF2_VMALLOC select VIDEOBUF2_DMA_CONTIG select VIDEOBUF2_DMA_SG
@@ -22,7 +22,7 @@ config VIDEO_MMP_CAMERA depends on I2C && VIDEO_DEV depends on ARCH_MMP || COMPILE_TEST depends on COMMON_CLK - select VIDEO_OV7670 + select VIDEO_OV7670 if MEDIA_SUBDRV_AUTOSELECT && VIDEO_CAMERA_SENSOR select I2C_GPIO select VIDEOBUF2_VMALLOC select VIDEOBUF2_DMA_CONTIG
drivers/media/usb/em28xx/Kconfig +2 -2
@@ -12,8 +12,8 @@ config VIDEO_EM28XX_V4L2 select VIDEO_SAA711X if MEDIA_SUBDRV_AUTOSELECT select VIDEO_TVP5150 if MEDIA_SUBDRV_AUTOSELECT select VIDEO_MSP3400 if MEDIA_SUBDRV_AUTOSELECT - select VIDEO_MT9V011 if MEDIA_SUBDRV_AUTOSELECT && MEDIA_CAMERA_SUPPORT - select VIDEO_OV2640 if MEDIA_SUBDRV_AUTOSELECT && MEDIA_CAMERA_SUPPORT + select VIDEO_MT9V011 if MEDIA_SUBDRV_AUTOSELECT && VIDEO_CAMERA_SENSOR + select VIDEO_OV2640 if MEDIA_SUBDRV_AUTOSELECT && VIDEO_CAMERA_SENSOR help This is a video4linux driver for Empia 28xx based TV cards.
drivers/media/usb/go7007/Kconfig +1 -1
@@ -12,8 +12,8 @@ config VIDEO_GO7007 select VIDEO_TW2804 if MEDIA_SUBDRV_AUTOSELECT select VIDEO_TW9903 if MEDIA_SUBDRV_AUTOSELECT select VIDEO_TW9906 if MEDIA_SUBDRV_AUTOSELECT - select VIDEO_OV7640 if MEDIA_SUBDRV_AUTOSELECT && MEDIA_CAMERA_SUPPORT select VIDEO_UDA1342 if MEDIA_SUBDRV_AUTOSELECT + select VIDEO_OV7640 if MEDIA_SUBDRV_AUTOSELECT && VIDEO_CAMERA_SENSOR help This is a video4linux driver for the WIS GO7007 MPEG encoder chip.
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 11/321 media: via: Use correct dependency for camera sensor drivers
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
[ Upstream commit 41425941dfcf47cc6df8e500af6ff16a7be6539f ]
The via camera controller driver selected ov7670 driver, however now that driver has dependencies and may no longer be selected unconditionally.
--- drivers/media/platform/via/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/platform/via/Kconfig +1 -1
@@ -7,7 +7,7 @@ config VIDEO_VIA_CAMERA depends on V4L_PLATFORM_DRIVERS depends on FB_VIA && VIDEO_DEV select VIDEOBUF2_DMA_SG - select VIDEO_OV7670 + select VIDEO_OV7670 if VIDEO_CAMERA_SENSOR help Driver support for the integrated camera controller in VIA Chrome9 chipsets. Currently only tested on OLPC xo-1.5 systems
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 12/321 gfs2: Fix another freeze/thaw hang
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
[ Upstream commit 52954b750958dcab9e44935f0c32643279091c85 ]
On a thawed filesystem, the freeze glock is held in shared mode. In order to initiate a cluster-wide freeze, the node initiating the freeze drops the freeze glock and grabs it in exclusive mode. The other nodes recognize this as contention on the freeze glock; function freeze_go_callback is invoked. This indicates to them that they must freeze the filesystem locally, drop the freeze glock, and then re-acquire it in shared mode before being able to unfreeze the filesystem locally.
While a node is trying to re-acquire the freeze glock in shared mode, additional contention can occur. In that case, the node must behave in the same way as above.
Unfortunately, freeze_go_callback() contains a check that causes it to bail out when the freeze glock isn't held in shared mode. Fix that to allow the glock to be unlocked or held in shared mode.
In addition, update a reference to trylock_super() which has been renamed to super_trylock_shared() in the meantime.
--- fs/gfs2/glops.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
fs/gfs2/glops.c +5 -4
@@ -567,15 +567,16 @@ static void freeze_go_callback(struct gfs2_glock *gl, bool remote)struct super_block *sb = sdp->sd_vfs;if (!remote || - gl->gl_state !=LM_ST_SHARED || + (gl->gl_state !=LM_ST_SHARED && + gl->gl_state !=LM_ST_UNLOCKED ) || gl->gl_demote_state !=LM_ST_UNLOCKED )return ;/* * Try to get an active super block reference to prevent racing with -* unmount (see trylock_super()). But note that unmount isn't the only -* place where a write lock on s_umount is taken, and we can fail here -* because of things like remount as well. +* unmount (see super_trylock_shared()). But note that unmount isn't +* the only place where a write lock on s_umount is taken, and we can +* fail here because of things like remount as well. */ if (down_read_trylock (&sb->s_umount)) {atomic_inc (&sb->s_active);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 13/321 netfs: Only call folio_start_fscache() one time for each folio
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Wysochanski <[email protected]>
[ Upstream commit df1c357f25d808e30b216188330e708e09e1a412 ]
If a network filesystem using netfs implements a clamp_length() function, it can set subrequest lengths smaller than a page size.
When we loop through the folios in netfs_rreq_unlock_folios() to set any folios to be written back, we need to make sure we only call folio_start_fscache() once for each folio.
Otherwise, this simple testcase:
mount -o fsc,rsize=1024,wsize=1024 127.0.0.1:/export /mnt/nfs dd if=/dev/zero of=/mnt/nfs/file.bin bs=4096 count=1 1+0 records in
1+0 records out
4096 bytes (4.1 kB, 4.0 KiB) copied, 0.0126359 s, 324 kB/s echo 3 > /proc/sys/vm/drop_caches
cat /mnt/nfs/file.bin > /dev/null
will trigger an oops similar to the following:
page dumped because: VM_BUG_ON_FOLIO(folio_test_private_2(folio))
------------[ cut here ]------------
kernel BUG at include/linux/netfs.h:44!
...
CPU: 5 PID: 134 Comm: kworker/u16:5 Kdump: loaded Not tainted 6.4.0-rc5
...
RIP: 0010:netfs_rreq_unlock_folios+0x68e/0x730 [netfs]
...
Call Trace:
netfs_rreq_assess+0x497/0x660 [netfs]
netfs_subreq_terminated+0x32b/0x610 [netfs]
nfs_netfs_read_completion+0x14e/0x1a0 [nfs]
nfs_read_completion+0x2f9/0x330 [nfs]
rpc_free_task+0x72/0xa0 [sunrpc]
rpc_async_release+0x46/0x70 [sunrpc]
process_one_work+0x3bd/0x710
worker_thread+0x89/0x610
kthread+0x181/0x1c0
ret_from_fork+0x29/0x50--- fs/netfs/buffered_read.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/netfs/buffered_read.c +5 -1
@@ -47,12 +47,14 @@ void netfs_rreq_unlock_folios(struct netfs_io_request *rreq)xas_for_each (&xas, folio, last_page) {loff_t pg_end;bool pg_failed = false; +bool folio_started;if (xas_retry (&xas, folio))continue ; pg_end =folio_pos (folio) +folio_size (folio) -1 ; + folio_started = false;for (;;) {loff_t sreq_end;
@@ -60,8 +62,10 @@ void netfs_rreq_unlock_folios(struct netfs_io_request *rreq) pg_failed = true;break ; } -if (test_bit (NETFS_SREQ_COPY_TO_CACHE , &subreq->flags)) +if (!folio_started &&test_bit (NETFS_SREQ_COPY_TO_CACHE , &subreq->flags)) {folio_start_fscache (folio); + folio_started = true; + } pg_failed |= subreq_failed; sreq_end = subreq->start + subreq->len -1 ;if (pg_end < sreq_end)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 14/321 btrfs: improve error message after failure to add delayed dir index item
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit 91bfe3104b8db0310f76f2dcb6aacef24c889366 ]
If we fail to add a delayed dir index item because there's already another item with the same index number, we print an error message (and then BUG). However that message isn't very helpful to debug anything because we don't know what's the index number and what are the values of index counters in the inode and its delayed inode (index_cnt fields of struct btrfs_inode and struct btrfs_delayed_node).
So update the error message to include the index number and counters.
We actually had a recent case where this issue was hit by a syzbot report (see the link below).
Stable-dep-of: 2c58c3931ede ("btrfs: remove BUG() after failure to insert delayed dir index item")
--- fs/btrfs/delayed-inode.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
fs/btrfs/delayed-inode.c +4 -3
@@ -1511,9 +1511,10 @@ int btrfs_insert_delayed_dir_index(struct btrfs_trans_handle *trans, ret =__btrfs_add_delayed_item (delayed_node, delayed_item);if (unlikely (ret)) {btrfs_err (trans->fs_info, -"err add delayed dir index item(name: %.*s) into the insertion tree of the delayed node(root id: %llu, inode id: %llu, errno: %d)" , - name_len, name, delayed_node->root->root_key.objectid, - delayed_node->inode_id, ret); +"error adding delayed dir index item, name: %.*s, index: %llu, root: %llu, dir: %llu, dir->index_cnt: %llu, delayed_node->index_cnt: %llu, error: %d" , + name_len, name, index,btrfs_root_id (delayed_node->root), + delayed_node->inode_id, dir->index_cnt, + delayed_node->index_cnt, ret);BUG (); }mutex_unlock (&delayed_node->mutex);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 15/321 btrfs: remove BUG() after failure to insert delayed dir index item
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
[ Upstream commit 2c58c3931ede7cd08cbecf1f1a4acaf0a04a41a9 ]
Instead of calling BUG() when we fail to insert a delayed dir index item into the delayed node's tree, we can just release all the resources we have allocated/acquired before and return the error to the caller. This is fine because all existing call chains undo anything they have done before calling btrfs_insert_delayed_dir_index() or BUG_ON (when creating pending snapshots in the transaction commit path).
So remove the BUG() call and do proper error handling.
This relates to a syzbot report linked below, but does not fix it because it only prevents hitting a BUG(), it does not fix the issue where somehow we attempt to use twice the same index number for different index items.
--- fs/btrfs/delayed-inode.c | 74 +++++++++++++++++++++++++--------------- 1 file changed, 47 insertions(+), 27 deletions(-)
fs/btrfs/delayed-inode.c +47 -27
@@ -1426,7 +1426,29 @@ void btrfs_balance_delayed_items(struct btrfs_fs_info *fs_info)btrfs_wq_run_delayed_node (delayed_root, fs_info,BTRFS_DELAYED_BATCH ); } -/* Will return 0 or -ENOMEM */ +static void btrfs_release_dir_index_item_space (struct btrfs_trans_handle *trans) +{ +struct btrfs_fs_info *fs_info = trans->fs_info; +const u64 bytes =btrfs_calc_insert_metadata_size (fs_info,1 ); + +if (test_bit (BTRFS_FS_LOG_RECOVERING , &fs_info->flags)) +return ; + +/* +* Adding the new dir index item does not require touching another +* leaf, so we can release 1 unit of metadata that was previously +* reserved when starting the transaction. This applies only to +* the case where we had a transaction start and excludes the +* transaction join case (when replaying log trees). +*/ +trace_btrfs_space_reservation (fs_info,"transaction" , + trans->transid, bytes,0 ); +btrfs_block_rsv_release (fs_info, trans->block_rsv, bytes,NULL ); +ASSERT (trans->bytes_reserved >= bytes); + trans->bytes_reserved -= bytes; +} + +/* Will return 0, -ENOMEM or -EEXIST (index number collision, unexpected). */ int btrfs_insert_delayed_dir_index(struct btrfs_trans_handle *trans, const char *name, int name_len, struct btrfs_inode *dir,
@@ -1468,6 +1490,27 @@ int btrfs_insert_delayed_dir_index(struct btrfs_trans_handle *trans,mutex_lock (&delayed_node->mutex); +/* +* First attempt to insert the delayed item. This is to make the error +* handling path simpler in case we fail (-EEXIST). There's no risk of +* any other task coming in and running the delayed item before we do +* the metadata space reservation below, because we are holding the +* delayed node's mutex and that mutex must also be locked before the +* node's delayed items can be run. +*/ + ret =__btrfs_add_delayed_item (delayed_node, delayed_item); +if (unlikely (ret)) { +btrfs_err (trans->fs_info, +"error adding delayed dir index item, name: %.*s, index: %llu, root: %llu, dir: %llu, dir->index_cnt: %llu, delayed_node->index_cnt: %llu, error: %d" , + name_len, name, index,btrfs_root_id (delayed_node->root), + delayed_node->inode_id, dir->index_cnt, + delayed_node->index_cnt, ret); +btrfs_release_delayed_item (delayed_item); +btrfs_release_dir_index_item_space (trans); +mutex_unlock (&delayed_node->mutex); + goto release_node; + } +if (delayed_node->index_item_leaves ==0 || delayed_node->curr_index_batch_size + data_len > leaf_data_size) { delayed_node->curr_index_batch_size = data_len;
@@ -1485,37 +1528,14 @@ int btrfs_insert_delayed_dir_index(struct btrfs_trans_handle *trans,* impossible. */ if (WARN_ON (ret)) { -mutex_unlock (&delayed_node->mutex);btrfs_release_delayed_item (delayed_item); +mutex_unlock (&delayed_node->mutex); goto release_node; } delayed_node->index_item_leaves++; - }else if (!test_bit (BTRFS_FS_LOG_RECOVERING , &fs_info->flags)) { -const u64 bytes =btrfs_calc_insert_metadata_size (fs_info,1 ); - -/* -* Adding the new dir index item does not require touching another -* leaf, so we can release 1 unit of metadata that was previously -* reserved when starting the transaction. This applies only to -* the case where we had a transaction start and excludes the -* transaction join case (when replaying log trees). -*/ -trace_btrfs_space_reservation (fs_info,"transaction" , - trans->transid, bytes,0 ); -btrfs_block_rsv_release (fs_info, trans->block_rsv, bytes,NULL ); -ASSERT (trans->bytes_reserved >= bytes); - trans->bytes_reserved -= bytes; - } - - ret =__btrfs_add_delayed_item (delayed_node, delayed_item); -if (unlikely (ret)) { -btrfs_err (trans->fs_info, -"error adding delayed dir index item, name: %.*s, index: %llu, root: %llu, dir: %llu, dir->index_cnt: %llu, delayed_node->index_cnt: %llu, error: %d" , - name_len, name, index,btrfs_root_id (delayed_node->root), - delayed_node->inode_id, dir->index_cnt, - delayed_node->index_cnt, ret); -BUG (); + }else { +btrfs_release_dir_index_item_space (trans); }mutex_unlock (&delayed_node->mutex);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 16/321 ext4: replace the traditional ternary conditional operator with with max()/min()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kemeng Shi <[email protected]>
[ Upstream commit de8bf0e5ee7482585450357c6d4eddec8efc5cb7 ]
Replace the traditional ternary conditional operator with with max()/min()
Stable-dep-of: 45e4ab320c9b ("ext4: move setting of trimmed bit into ext4_try_to_trim_range()")
--- fs/ext4/mballoc.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
fs/ext4/mballoc.c +2 -4
@@ -6930,8 +6930,7 @@ __releases(ext4_group_lock_ptr(sb, e4b->bd_group))void *bitmap; bitmap = e4b->bd_bitmap; - start = (e4b->bd_info->bb_first_free > start) ? - e4b->bd_info->bb_first_free : start; + start =max (e4b->bd_info->bb_first_free, start); count =0 ; free_count =0 ;
@@ -7148,8 +7147,7 @@ ext4_mballoc_query_range(ext4_lock_group (sb, group); - start = (e4b.bd_info->bb_first_free > start) ? - e4b.bd_info->bb_first_free : start; + start =max (e4b.bd_info->bb_first_free, start);if (end >=EXT4_CLUSTERS_PER_GROUP (sb)) end =EXT4_CLUSTERS_PER_GROUP (sb) -1 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 17/321 ext4: move setting of trimmed bit into ext4_try_to_trim_range()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit 45e4ab320c9b5fa67b1fc3b6a9b381cfcc0c8488 ]
Currently we set the group's trimmed bit in ext4_trim_all_free() based on return value of ext4_try_to_trim_range(). However when we will want to abort trimming because of suspend attempt, we want to return success from ext4_try_to_trim_range() but not set the trimmed bit. Instead implementing awkward propagation of this information, just move setting of trimmed bit into ext4_try_to_trim_range() when the whole group is trimmed.
--- fs/ext4/mballoc.c | 46 +++++++++++++++++++++++++--------------------- 1 file changed, 25 insertions(+), 21 deletions(-)
fs/ext4/mballoc.c +25 -21
@@ -6920,6 +6920,16 @@ __acquires(bitlock)return ret; } +static ext4_grpblk_t ext4_last_grp_cluster (struct super_block *sb, +ext4_group_t grp) +{ +if (grp <ext4_get_groups_count (sb)) +return EXT4_CLUSTERS_PER_GROUP (sb) -1 ; +return (ext4_blocks_count (EXT4_SB (sb)->s_es) - +ext4_group_first_block_no (sb, grp) -1 ) >> +EXT4_CLUSTER_BITS (sb); +} +static int ext4_try_to_trim_range (struct super_block *sb,struct ext4_buddy *e4b,ext4_grpblk_t start,ext4_grpblk_t max,ext4_grpblk_t minblocks)
@@ -6927,9 +6937,12 @@ __acquires(ext4_group_lock_ptr(sb, e4b->bd_group)) __releases(ext4_group_lock_ptr(sb, e4b->bd_group)) {ext4_grpblk_t next, count, free_count; +bool set_trimmed = false;void *bitmap; bitmap = e4b->bd_bitmap; +if (start ==0 && max >=ext4_last_grp_cluster (sb, e4b->bd_group)) + set_trimmed = true; start =max (e4b->bd_info->bb_first_free, start); count =0 ; free_count =0 ;
@@ -6944,16 +6957,14 @@ __releases(ext4_group_lock_ptr(sb, e4b->bd_group))int ret =ext4_trim_extent (sb, start, next - start, e4b);if (ret && ret != -EOPNOTSUPP ) -break ; +return count; count += next - start; } free_count += next - start; start = next +1 ; -if (fatal_signal_pending (current)) { - count = -ERESTARTSYS ; -break ; - } +if (fatal_signal_pending (current)) +return -ERESTARTSYS ;if (need_resched ()) {ext4_unlock_group (sb, e4b->bd_group);
@@ -6965,6 +6976,9 @@ __releases(ext4_group_lock_ptr(sb, e4b->bd_group))break ; } +if (set_trimmed) +EXT4_MB_GRP_SET_TRIMMED (e4b->bd_info); +return count; }
@@ -6975,7 +6989,6 @@ __releases(ext4_group_lock_ptr(sb, e4b->bd_group))* @start: first group block to examine * @max: last group block to examine * @minblocks: minimum extent block count -* @set_trimmed: set the trimmed flag if at least one block is trimmed * * ext4_trim_all_free walks through group's block bitmap searching for free * extents. When the free extent is found, mark it as used in group buddy
@@ -6985,7 +6998,7 @@ __releases(ext4_group_lock_ptr(sb, e4b->bd_group))static ext4_grpblk_t ext4_trim_all_free (struct super_block *sb,ext4_group_t group,ext4_grpblk_t start,ext4_grpblk_t max, -ext4_grpblk_t minblocks,bool set_trimmed) +ext4_grpblk_t minblocks) {struct ext4_buddy e4b;int ret;
@@ -7002,13 +7015,10 @@ ext4_trim_all_free(struct super_block *sb, ext4_group_t group,ext4_lock_group (sb, group);if (!EXT4_MB_GRP_WAS_TRIMMED (e4b.bd_info) || - minblocks <EXT4_SB (sb)->s_last_trim_minblks) { + minblocks <EXT4_SB (sb)->s_last_trim_minblks) ret =ext4_try_to_trim_range (sb, &e4b, start, max, minblocks); -if (ret >=0 && set_trimmed) -EXT4_MB_GRP_SET_TRIMMED (e4b.bd_info); - }else { +else ret =0 ; - }ext4_unlock_group (sb, group);ext4_mb_unload_buddy (&e4b);
@@ -7041,7 +7051,6 @@ int ext4_trim_fs(struct super_block *sb, struct fstrim_range *range)ext4_fsblk_t first_data_blk =le32_to_cpu (EXT4_SB (sb)->s_es->s_first_data_block);ext4_fsblk_t max_blks =ext4_blocks_count (EXT4_SB (sb)->s_es); -bool whole_group, eof = false;int ret =0 ; start = range->start >> sb->s_blocksize_bits;
@@ -7060,10 +7069,8 @@ int ext4_trim_fs(struct super_block *sb, struct fstrim_range *range)if (minlen >EXT4_CLUSTERS_PER_GROUP (sb)) goto out; } -if (end >= max_blks -1 ) { +if (end >= max_blks -1 ) end = max_blks -1 ; - eof = true; - }if (end <= first_data_blk) goto out;if (start < first_data_blk)
@@ -7077,7 +7084,6 @@ int ext4_trim_fs(struct super_block *sb, struct fstrim_range *range)/* end now represents the last cluster to discard in this group */ end =EXT4_CLUSTERS_PER_GROUP (sb) -1 ; - whole_group = true;for (group = first_group; group <= last_group; group++) { grp =ext4_get_group_info (sb, group);
@@ -7096,13 +7102,11 @@ int ext4_trim_fs(struct super_block *sb, struct fstrim_range *range)* change it for the last group, note that last_cluster is * already computed earlier by ext4_get_group_no_and_offset() */ -if (group == last_group) { +if (group == last_group) end = last_cluster; - whole_group = eof ? true : end ==EXT4_CLUSTERS_PER_GROUP (sb) -1 ; - }if (grp->bb_free >= minlen) { cnt =ext4_trim_all_free (sb, group, first_cluster, - end, minlen, whole_group); + end, minlen);if (cnt <0 ) { ret = cnt;break ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 18/321 ext4: do not let fstrim block system suspend
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit 5229a658f6453362fbb9da6bf96872ef25a7097e ]
Len Brown has reported that system suspend sometimes fail due to inability to freeze a task working in ext4_trim_fs() for one minute. Trimming a large filesystem on a disk that slowly processes discard requests can indeed take a long time. Since discard is just an advisory call, it is perfectly fine to interrupt it at any time and the return number of discarded blocks until that moment. Do that when we detect the task is being frozen.
References: https://bugzilla.kernel.org/show_bug.cgi?id=216322
--- fs/ext4/mballoc.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
fs/ext4/mballoc.c +10 -2
@@ -16,6 +16,7 @@#include <linux/slab.h> #include <linux/nospec.h> #include <linux/backing-dev.h> +#include <linux/freezer.h> #include <trace/events/ext4.h> /*
@@ -6930,6 +6931,11 @@ static ext4_grpblk_t ext4_last_grp_cluster(struct super_block *sb,EXT4_CLUSTER_BITS (sb); } +static bool ext4_trim_interrupted (void ) +{ +return fatal_signal_pending (current) ||freezing (current); +} +static int ext4_try_to_trim_range (struct super_block *sb,struct ext4_buddy *e4b,ext4_grpblk_t start,ext4_grpblk_t max,ext4_grpblk_t minblocks)
@@ -6963,8 +6969,8 @@ __releases(ext4_group_lock_ptr(sb, e4b->bd_group)) free_count += next - start; start = next +1 ; -if (fatal_signal_pending (current)) -return -ERESTARTSYS ; +if (ext4_trim_interrupted ()) +return count;if (need_resched ()) {ext4_unlock_group (sb, e4b->bd_group);
@@ -7086,6 +7092,8 @@ int ext4_trim_fs(struct super_block *sb, struct fstrim_range *range) end =EXT4_CLUSTERS_PER_GROUP (sb) -1 ;for (group = first_group; group <= last_group; group++) { +if (ext4_trim_interrupted ()) +break ; grp =ext4_get_group_info (sb, group);if (!grp)continue ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 19/321 netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit 96b33300fba880ec0eafcf3d82486f3463b4b6da upstream.
rbtree GC does not modify the datastructure, instead it collects expired elements and it enqueues a GC transaction. Use a read spinlock instead to avoid data contention while GC worker is running.
--- net/netfilter/nft_set_rbtree.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
net/netfilter/nft_set_rbtree.c +2 -4
@@ -622,8 +622,7 @@ static void nft_rbtree_gc(struct work_struct *work)if (!gc) goto done; -write_lock_bh (&priv->lock); -write_seqcount_begin (&priv->count); +read_lock_bh (&priv->lock);for (node =rb_first (&priv->root); node !=NULL ; node =rb_next (node)) {/* Ruleset has been updated, try later. */
@@ -673,8 +672,7 @@ static void nft_rbtree_gc(struct work_struct *work) gc =nft_trans_gc_catchall (gc, gc_seq); try_later: -write_seqcount_end (&priv->count); -write_unlock_bh (&priv->lock); +read_unlock_bh (&priv->lock);if (gc)nft_trans_gc_queue_async_done (gc);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 20/321 netfilter: nft_set_pipapo: call nft_trans_gc_queue_sync() in catchall GC
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit 4a9e12ea7e70223555ec010bec9f711089ce96f6 upstream.
pipapo needs to enqueue GC transactions for catchall elements through nft_trans_gc_queue_sync(). Add nft_trans_gc_catchall_sync() and nft_trans_gc_catchall_async() to handle GC transaction queueing accordingly.
--- include/net/netfilter/nf_tables.h | 5 +++-- net/netfilter/nf_tables_api.c | 22 +++++++++++++++++++--- net/netfilter/nft_set_hash.c | 2 +- net/netfilter/nft_set_pipapo.c | 2 +- net/netfilter/nft_set_rbtree.c | 2 +- 5 files changed, 25 insertions(+), 8 deletions(-)
include/net/netfilter/nf_tables.h +3 -2
@@ -1700,8 +1700,9 @@ void nft_trans_gc_queue_sync_done(struct nft_trans_gc *trans);void nft_trans_gc_elem_add (struct nft_trans_gc *gc,void *priv); -struct nft_trans_gc *nft_trans_gc_catchall (struct nft_trans_gc *gc, -unsigned int gc_seq); +struct nft_trans_gc *nft_trans_gc_catchall_async (struct nft_trans_gc *gc, +unsigned int gc_seq); +struct nft_trans_gc *nft_trans_gc_catchall_sync (struct nft_trans_gc *gc); void nft_setelem_data_deactivate(const struct net *net, const struct nft_set *set,
net/netfilter/nf_tables_api.c +19 -3
@@ -9602,8 +9602,9 @@ void nft_trans_gc_queue_sync_done(struct nft_trans_gc *trans)call_rcu (&trans->rcu, nft_trans_gc_trans_free); } -struct nft_trans_gc *nft_trans_gc_catchall (struct nft_trans_gc *gc, -unsigned int gc_seq) +static struct nft_trans_gc *nft_trans_gc_catchall (struct nft_trans_gc *gc, +unsigned int gc_seq, +bool sync) {struct nft_set_elem_catchall *catchall;const struct nft_set *set = gc->set;
@@ -9619,7 +9620,11 @@ struct nft_trans_gc *nft_trans_gc_catchall(struct nft_trans_gc *gc,nft_set_elem_dead (ext); dead_elem: - gc =nft_trans_gc_queue_async (gc, gc_seq,GFP_ATOMIC ); +if (sync) + gc =nft_trans_gc_queue_sync (gc,GFP_ATOMIC ); +else + gc =nft_trans_gc_queue_async (gc, gc_seq,GFP_ATOMIC ); +if (!gc)return NULL ;
@@ -9629,6 +9634,17 @@ struct nft_trans_gc *nft_trans_gc_catchall(struct nft_trans_gc *gc,return gc; } +struct nft_trans_gc *nft_trans_gc_catchall_async (struct nft_trans_gc *gc, +unsigned int gc_seq) +{ +return nft_trans_gc_catchall (gc, gc_seq, false); +} + +struct nft_trans_gc *nft_trans_gc_catchall_sync (struct nft_trans_gc *gc) +{ +return nft_trans_gc_catchall (gc,0 , true); +} +static void nf_tables_module_autoload_cleanup (struct net *net) {struct nftables_pernet *nft_net =nft_pernet (net);
net/netfilter/nft_set_hash.c +1 -1
@@ -372,7 +372,7 @@ static void nft_rhash_gc(struct work_struct *work)nft_trans_gc_elem_add (gc, he); } - gc =nft_trans_gc_catchall (gc, gc_seq); + gc =nft_trans_gc_catchall_async (gc, gc_seq); try_later:/* catchall list iteration requires rcu read side lock. */
net/netfilter/nft_set_pipapo.c +1 -1
@@ -1610,7 +1610,7 @@ static void pipapo_gc(const struct nft_set *_set, struct nft_pipapo_match *m) } } - gc =nft_trans_gc_catchall (gc,0 ); + gc =nft_trans_gc_catchall_sync (gc);if (gc) {nft_trans_gc_queue_sync_done (gc); priv->last_gc = jiffies;
net/netfilter/nft_set_rbtree.c +1 -1
@@ -669,7 +669,7 @@ static void nft_rbtree_gc(struct work_struct *work)nft_trans_gc_elem_add (gc, rbe); } - gc =nft_trans_gc_catchall (gc, gc_seq); + gc =nft_trans_gc_catchall_async (gc, gc_seq); try_later:read_unlock_bh (&priv->lock);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 21/321 netfilter: nft_set_pipapo: stop GC iteration if GC transaction allocation fails
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit 6d365eabce3c018a80f6e0379b17df2abb17405e upstream.
nft_trans_gc_queue_sync() enqueues the GC transaction and it allocates a new one. If this allocation fails, then stop this GC sync run and retry later.
--- net/netfilter/nft_set_pipapo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nft_set_pipapo.c +1 -1
@@ -1596,7 +1596,7 @@ static void pipapo_gc(const struct nft_set *_set, struct nft_pipapo_match *m) gc =nft_trans_gc_queue_sync (gc,GFP_ATOMIC );if (!gc) -break ; +return ;nft_pipapo_gc_deactivate (net, set, e);pipapo_drop (m, rulemap);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 22/321 netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit b079155faae94e9b3ab9337e82100a914ebb4e8d upstream.
Skip GC run if iterator rewinds to the beginning with EAGAIN, otherwise GC might collect the same element more than once.
--- net/netfilter/nft_set_hash.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
net/netfilter/nft_set_hash.c +3 -6
@@ -338,12 +338,9 @@ static void nft_rhash_gc(struct work_struct *work)while ((he =rhashtable_walk_next (&hti))) {if (IS_ERR (he)) { -if (PTR_ERR (he) != -EAGAIN ) { -nft_trans_gc_destroy (gc); - gc =NULL ; - goto try_later; - } -continue ; +nft_trans_gc_destroy (gc); + gc =NULL ; + goto try_later; }/* Ruleset has been updated, try later. */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 23/321 netfilter: nf_tables: fix memleak when more than 255 elements expired
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
commit cf5000a7787cbc10341091d37245a42c119d26c5 upstream.
When more than 255 elements expired we're supposed to switch to a new gc container structure.
This never happens: u8 type will wrap before reaching the boundary and nft_trans_gc_space() always returns true.
This means we recycle the initial gc container structure and lose track of the elements that came before.
While at it, don't deref 'gc' after we've passed it to call_rcu.
--- include/net/netfilter/nf_tables.h | 2 +- net/netfilter/nf_tables_api.c | 10 ++++++++-- 2 files changed, 9 insertions(+), 3 deletions(-)
include/net/netfilter/nf_tables.h +1 -1
@@ -1682,7 +1682,7 @@ struct nft_trans_gc {struct net *net;struct nft_set *set;u32 seq; -u8 count; +u16 count;void *priv[NFT_TRANS_GC_BATCHCOUNT ];struct rcu_head rcu; };
net/netfilter/nf_tables_api.c +8 -2
@@ -9559,12 +9559,15 @@ static int nft_trans_gc_space(struct nft_trans_gc *trans)struct nft_trans_gc *nft_trans_gc_queue_async (struct nft_trans_gc *gc,unsigned int gc_seq,gfp_t gfp) { +struct nft_set *set; +if (nft_trans_gc_space (gc))return gc; + set = gc->set;nft_trans_gc_queue_work (gc); -return nft_trans_gc_alloc (gc->set, gc_seq, gfp); +return nft_trans_gc_alloc (set, gc_seq, gfp); }void nft_trans_gc_queue_async_done (struct nft_trans_gc *trans)
@@ -9579,15 +9582,18 @@ void nft_trans_gc_queue_async_done(struct nft_trans_gc *trans)struct nft_trans_gc *nft_trans_gc_queue_sync (struct nft_trans_gc *gc,gfp_t gfp) { +struct nft_set *set; +if (WARN_ON_ONCE (!lockdep_commit_lock_is_held (gc->net)))return NULL ;if (nft_trans_gc_space (gc))return gc; + set = gc->set;call_rcu (&gc->rcu, nft_trans_gc_trans_free); -return nft_trans_gc_alloc (gc->set,0 , gfp); +return nft_trans_gc_alloc (set,0 , gfp); }void nft_trans_gc_queue_sync_done (struct nft_trans_gc *trans)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 24/321 netfilter: nf_tables: disallow rule removal from chain binding
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit f15f29fd4779be8a418b66e9d52979bb6d6c2325 ]
Chain binding only requires the rule addition/insertion command within the same transaction. Removal of rules from chain bindings within the same transaction makes no sense, userspace does not utilize this feature. Replace nft_chain_is_bound() check to nft_chain_binding() in rule deletion commands. Replace command implies a rule deletion, reject this command too.
Rule flush command can also safely rely on this nft_chain_binding() check because unbound chains are not allowed since 62e1e94b246e ("netfilter: nf_tables: reject unbound chain set before commit phase").
--- net/netfilter/nf_tables_api.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
net/netfilter/nf_tables_api.c +13 -5
@@ -1432,7 +1432,7 @@ static int nft_flush_table(struct nft_ctx *ctx)if (!nft_is_active_next (ctx->net, chain))continue ; -if (nft_chain_is_bound (chain)) +if (nft_chain_binding (chain))continue ; ctx->chain = chain;
@@ -1477,7 +1477,7 @@ static int nft_flush_table(struct nft_ctx *ctx)if (!nft_is_active_next (ctx->net, chain))continue ; -if (nft_chain_is_bound (chain)) +if (nft_chain_binding (chain))continue ; ctx->chain = chain;
@@ -2910,6 +2910,9 @@ static int nf_tables_delchain(struct sk_buff *skb, const struct nfnl_info *info,return PTR_ERR (chain); } +if (nft_chain_binding (chain)) +return -EOPNOTSUPP ; +nft_ctx_init (&ctx, net, skb, info->nlh, family, table, chain, nla);if (nla[NFTA_CHAIN_HOOK ]) {
@@ -3968,6 +3971,11 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info, }if (info->nlh->nlmsg_flags &NLM_F_REPLACE ) { +if (nft_chain_binding (chain)) { + err = -EOPNOTSUPP ; + goto err_destroy_flow_rule; + } + err =nft_delrule (&ctx, old_rule);if (err <0 ) goto err_destroy_flow_rule;
@@ -4075,7 +4083,7 @@ static int nf_tables_delrule(struct sk_buff *skb, const struct nfnl_info *info,NL_SET_BAD_ATTR (extack, nla[NFTA_RULE_CHAIN ]);return PTR_ERR (chain); } -if (nft_chain_is_bound (chain)) +if (nft_chain_binding (chain))return -EOPNOTSUPP ; }
@@ -4109,7 +4117,7 @@ static int nf_tables_delrule(struct sk_buff *skb, const struct nfnl_info *info,list_for_each_entry (chain, &table->chains, list) {if (!nft_is_active_next (net, chain))continue ; -if (nft_chain_is_bound (chain)) +if (nft_chain_binding (chain))continue ; ctx.chain = chain;
@@ -11070,7 +11078,7 @@ static void __nft_release_table(struct net *net, struct nft_table *table) ctx.family = table->family; ctx.table = table;list_for_each_entry (chain, &table->chains, list) { -if (nft_chain_is_bound (chain)) +if (nft_chain_binding (chain))continue ; ctx.chain = chain;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 25/321 ASoC: meson: spdifin: start hw on dai probe
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit aedf323b66b2b875137422ecb7d2525179759076 ]
For spdif input to report the locked rate correctly, even when no capture is running, the HW and reference clock must be started as soon as the dai is probed.
--- sound/soc/meson/axg-spdifin.c | 49 ++++++++++++----------------------- 1 file changed, 17 insertions(+), 32 deletions(-)
sound/soc/meson/axg-spdifin.c +17 -32
@@ -112,34 +112,6 @@ static int axg_spdifin_prepare(struct snd_pcm_substream *substream,return 0 ; } -static int axg_spdifin_startup (struct snd_pcm_substream *substream, -struct snd_soc_dai *dai) -{ -struct axg_spdifin *priv =snd_soc_dai_get_drvdata (dai); -int ret; - - ret =clk_prepare_enable (priv->refclk); -if (ret) { -dev_err (dai->dev, -"failed to enable spdifin reference clock\n" ); -return ret; - } - -regmap_update_bits (priv->map,SPDIFIN_CTRL0 ,SPDIFIN_CTRL0_EN , -SPDIFIN_CTRL0_EN ); - -return 0 ; -} - -static void axg_spdifin_shutdown (struct snd_pcm_substream *substream, -struct snd_soc_dai *dai) -{ -struct axg_spdifin *priv =snd_soc_dai_get_drvdata (dai); - -regmap_update_bits (priv->map,SPDIFIN_CTRL0 ,SPDIFIN_CTRL0_EN ,0 ); -clk_disable_unprepare (priv->refclk); -} - static void axg_spdifin_write_mode_param(struct regmap *map, int mode, unsigned int val, unsigned int num_per_reg,
@@ -251,25 +223,38 @@ static int axg_spdifin_dai_probe(struct snd_soc_dai *dai) ret =axg_spdifin_sample_mode_config (dai, priv);if (ret) {dev_err (dai->dev,"mode configuration failed\n" ); -clk_disable_unprepare (priv->pclk); -return ret; + goto pclk_err; } + ret =clk_prepare_enable (priv->refclk); +if (ret) { +dev_err (dai->dev, +"failed to enable spdifin reference clock\n" ); + goto pclk_err; + } + +regmap_update_bits (priv->map,SPDIFIN_CTRL0 ,SPDIFIN_CTRL0_EN , +SPDIFIN_CTRL0_EN ); +return 0 ; + +pclk_err: +clk_disable_unprepare (priv->pclk); +return ret; }static int axg_spdifin_dai_remove (struct snd_soc_dai *dai) {struct axg_spdifin *priv =snd_soc_dai_get_drvdata (dai); +regmap_update_bits (priv->map,SPDIFIN_CTRL0 ,SPDIFIN_CTRL0_EN ,0 ); +clk_disable_unprepare (priv->refclk);clk_disable_unprepare (priv->pclk);return 0 ; }static const struct snd_soc_dai_ops axg_spdifin_ops = { .prepare = axg_spdifin_prepare, - .startup = axg_spdifin_startup, - .shutdown = axg_spdifin_shutdown, }; static int axg_spdifin_iec958_info(struct snd_kcontrol *kcontrol,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 26/321 netfilter: nf_tables: disallow element removal on anonymous sets
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 23a3bfd4ba7acd36abf52b78605f61b21bdac216 ]
Anonymous sets need to be populated once at creation and then they are bound to rule since 938154b93be8 ("netfilter: nf_tables: reject unbound anonymous set before commit phase"), otherwise transaction reports EINVAL.
Userspace does not need to delete elements of anonymous sets that are not yet bound, reject this with EOPNOTSUPP.
Quoted 1 line
From flush command path, skip anonymous sets, they are expected to be
bound already. Otherwise, EINVAL is hit at the end of this transaction for unbound sets.
--- net/netfilter/nf_tables_api.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
net/netfilter/nf_tables_api.c +5 -4
@@ -1446,8 +1446,7 @@ static int nft_flush_table(struct nft_ctx *ctx)if (!nft_is_active_next (ctx->net, set))continue ; -if (nft_set_is_anonymous (set) && - !list_empty (&set->bindings)) +if (nft_set_is_anonymous (set))continue ; err =nft_delset (ctx, set);
@@ -7188,8 +7187,10 @@ static int nf_tables_delsetelem(struct sk_buff *skb,if (IS_ERR (set))return PTR_ERR (set); -if (!list_empty (&set->bindings) && - (set->flags & (NFT_SET_CONSTANT |NFT_SET_ANONYMOUS ))) +if (nft_set_is_anonymous (set)) +return -EOPNOTSUPP ; + +if (!list_empty (&set->bindings) && (set->flags &NFT_SET_CONSTANT ))return -EBUSY ;nft_ctx_init (&ctx, net, skb, info->nlh, family, table,NULL , nla);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 27/321 bpf: Avoid deadlock when using queue and stack maps from NMI
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit a34a9f1a19afe9c60ca0ea61dfeee63a1c2baac8 ]
Sysbot discovered that the queue and stack maps can deadlock if they are being used from a BPF program that can be called from NMI context (such as one that is attached to a perf HW counter event). To fix this, add an in_nmi() check and use raw_spin_trylock() in NMI context, erroring out if grabbing the lock fails.
--- kernel/bpf/queue_stack_maps.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-)
kernel/bpf/queue_stack_maps.c +18 -3
@@ -98,7 +98,12 @@ static long __queue_map_get(struct bpf_map *map, void *value, bool delete)int err =0 ;void *ptr; -raw_spin_lock_irqsave (&qs->lock, flags); +if (in_nmi ()) { +if (!raw_spin_trylock_irqsave (&qs->lock, flags)) +return -EBUSY ; + }else { +raw_spin_lock_irqsave (&qs->lock, flags); + }if (queue_stack_map_is_empty (qs)) {memset (value,0 , qs->map.value_size);
@@ -128,7 +133,12 @@ static long __stack_map_get(struct bpf_map *map, void *value, bool delete)void *ptr;u32 index; -raw_spin_lock_irqsave (&qs->lock, flags); +if (in_nmi ()) { +if (!raw_spin_trylock_irqsave (&qs->lock, flags)) +return -EBUSY ; + }else { +raw_spin_lock_irqsave (&qs->lock, flags); + }if (queue_stack_map_is_empty (qs)) {memset (value,0 , qs->map.value_size);
@@ -193,7 +203,12 @@ static long queue_stack_map_push_elem(struct bpf_map *map, void *value,if (flags &BPF_NOEXIST || flags >BPF_EXIST )return -EINVAL ; -raw_spin_lock_irqsave (&qs->lock, irq_flags); +if (in_nmi ()) { +if (!raw_spin_trylock_irqsave (&qs->lock, irq_flags)) +return -EBUSY ; + }else { +raw_spin_lock_irqsave (&qs->lock, irq_flags); + }if (queue_stack_map_is_full (qs)) {if (!replace) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 28/321 bpf: Avoid dummy bpf_offload_netdev in __bpf_prog_dev_bound_init
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eduard Zingerman <[email protected]>
[ Upstream commit 1a49f4195d3498fe458a7f5ff7ec5385da70d92e ]
Fix for a bug observable under the following sequence of events:
1. Create a network device that does not support XDP offload.
2. Load a device bound XDP program with BPF_F_XDP_DEV_BOUND_ONLY flag (such programs are not offloaded).
3. Load a device bound XDP program with zero flags
(such programs are offloaded).
At step (2) __bpf_prog_dev_bound_init() associates with device (1) a dummy bpf_offload_netdev struct with .offdev field set to NULL. At step (3) __bpf_prog_dev_bound_init() would reuse dummy struct allocated at step (2).
However, downstream usage of the bpf_offload_netdev assumes that .offdev field can't be NULL, e.g. in bpf_prog_offload_verifier_prep().
Adjust __bpf_prog_dev_bound_init() to require bpf_offload_netdev with non-NULL .offdev for offloaded BPF programs.
--- kernel/bpf/offload.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
kernel/bpf/offload.c +7 -5
@@ -198,12 +198,14 @@ static int __bpf_prog_dev_bound_init(struct bpf_prog *prog, struct net_device *n offload->netdev = netdev; ondev =bpf_offload_find_netdev (offload->netdev); +/* When program is offloaded require presence of "true" +* bpf_offload_netdev, avoid the one created for !ondev case below. +*/ +if (bpf_prog_is_offloaded (prog->aux) && (!ondev || !ondev->offdev)) { + err = -EINVAL ; + goto err_free; + }if (!ondev) { -if (bpf_prog_is_offloaded (prog->aux)) { - err = -EINVAL ; - goto err_free; - } -/* When only binding to the device, explicitly * create an entry in the hashtable. */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 29/321 ALSA: docs: Fix a typo of midi2_ump_probe option for snd-usb-audio
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 60edec9beffebd01a49c005221230f3a61fe6587 ]
A simple typo fix: midi2_probe => midi2_ump_probe.
--- Documentation/sound/designs/midi-2.0.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
Documentation/sound/designs/midi-2.0.rst +2 -2
@@ -74,8 +74,8 @@ topology based on those information. When the device is older and doesn't respond to the new UMP inquiries, the driver falls back and builds the topology based on Group Terminal Block (GTB) information from the USB descriptor. Some device might be screwed up by the -unexpected UMP command; in such a case, pass `midi2_probe=0` option to -snd-usb-audio driver for skipping the UMP v1.1 inquiries. +unexpected UMP command; in such a case, pass `midi2_ump_probe=0` +option to snd-usb-audio driver for skipping the UMP v1.1 inquiries. When the MIDI 2.0 device is probed, the kernel creates a rawmidi device for each UMP Endpoint of the device. Its device name is
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 30/321 ALSA: seq: Avoid delivery of events for disabled UMP groups
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 22eefaeab03fe968ab7786fb3d5c5abd203a8bab ]
ALSA sequencer core still delivers events to the disabled UMP Group, leaving this handling to the device. But it's rather risky and it's easy to imagine that such an unexpected event may screw up the device firmware.
This patch avoids the superfluous event deliveries by setting the group_filter of the UMP client as default, and evaluate the group_filter properly at delivery from non-UMP clients.
The grouop_filter is updated upon the dynamic UMP Function Block updates, so that it follows the change of the disabled UMP Groups, too.
--- sound/core/seq/seq_ump_client.c | 22 ++++++++++++++++++++++ sound/core/seq/seq_ump_convert.c | 2 ++ 2 files changed, 24 insertions(+)
sound/core/seq/seq_ump_client.c +22 -0
@@ -416,6 +416,25 @@ static void setup_client_midi_version(struct seq_ump_client *client)snd_seq_kernel_client_put (cptr); } +/* set up client's group_filter bitmap */ +static void setup_client_group_filter (struct seq_ump_client *client) +{ +struct snd_seq_client *cptr; +unsigned int filter; +int p; + + cptr =snd_seq_kernel_client_get (client->seq_client); +if (!cptr) +return ; + filter = ~(1U <<0 );/* always allow groupless messages */ +for (p =0 ; p <SNDRV_UMP_MAX_GROUPS ; p++) { +if (client->groups[p].active) + filter &= ~(1U << (p +1 )); + } + cptr->group_filter = filter; +snd_seq_kernel_client_put (cptr); +} +/* UMP group change notification */ static void handle_group_notify (struct work_struct *work) {
@@ -424,6 +443,7 @@ static void handle_group_notify(struct work_struct *work)update_group_attrs (client);update_port_infos (client); +setup_client_group_filter (client); }/* UMP FB change notification */
@@ -492,6 +512,8 @@ static int snd_seq_ump_probe(struct device *_dev) goto error; } +setup_client_group_filter (client); + err =create_ump_endpoint_port (client);if (err <0 ) goto error;
sound/core/seq/seq_ump_convert.c +2 -0
@@ -1197,6 +1197,8 @@ int snd_seq_deliver_to_ump(struct snd_seq_client *source,struct snd_seq_event *event, int atomic, int hop) { + if (dest->group_filter & (1U << dest_port->ump_group)) + return 0; /* group filtered - skip the event */ if (event->type == SNDRV_SEQ_EVENT_SYSEX) return cvt_sysex_to_ump(dest, dest_port, event, atomic, hop); else if (snd_seq_client_is_midi2(dest))
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 31/321 ASoC: rt5640: Revert "Fix sleep in atomic context"
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit fa6a0c0c1dd53b3949ca56bf7213648dfd6a62ee ]
Commit 70a6404ff610 ("ASoC: rt5640: Fix sleep in atomic context") not only switched from request_irq() to request_threaded_irq(), to fix the sleep in atomic context issue, but it also added devm management of the IRQ by actually switching to devm_request_threaded_irq() (without any explanation in the commit message for this change).
This is wrong since the IRQ was already explicitly managed by the driver. On unbind the ASoC core will call rt5640_set_jack(NULL) which in turn will call rt5640_disable_jack_detect() which frees the IRQ already. So now we have a double free.
Besides the unexplained switch to devm being wrong, the actual fix for the sleep in atomic context issue also is not the best solution.
The only thing which rt5640_irq() does is cancel + (re-)queue the jack_work delayed_work. This can be done in a single non sleeping call by replacing queue_delayed_work() with mod_delayed_work(), which does not sleep. Using mod_delayed_work() is a much better fix then adding a thread which does nothing other then queuing a work-item.
This patch is a straight revert of the troublesome changes, the switch to mod_delayed_work() is done in a separate follow-up patch.
--- sound/soc/codecs/rt5640.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
sound/soc/codecs/rt5640.c +5 -7
@@ -2566,10 +2566,9 @@ static void rt5640_enable_jack_detect(struct snd_soc_component *component,if (jack_data && jack_data->use_platform_clock) rt5640->use_platform_clock = jack_data->use_platform_clock; - ret =devm_request_threaded_irq (component->dev, rt5640->irq, -NULL , rt5640_irq, -IRQF_TRIGGER_RISING |IRQF_TRIGGER_FALLING |IRQF_ONESHOT , -"rt5640" , rt5640); + ret =request_irq (rt5640->irq, rt5640_irq, +IRQF_TRIGGER_RISING |IRQF_TRIGGER_FALLING |IRQF_ONESHOT , +"rt5640" , rt5640);if (ret) {dev_warn (component->dev,"Failed to reguest IRQ %d: %d\n" , rt5640->irq, ret);rt5640_disable_jack_detect (component);
@@ -2622,9 +2621,8 @@ static void rt5640_enable_hda_jack_detect( rt5640->jack = jack; - ret =devm_request_threaded_irq (component->dev, rt5640->irq, -NULL , rt5640_irq,IRQF_TRIGGER_RISING |IRQF_ONESHOT , -"rt5640" , rt5640); + ret =request_irq (rt5640->irq, rt5640_irq, +IRQF_TRIGGER_RISING |IRQF_ONESHOT ,"rt5640" , rt5640);if (ret) {dev_warn (component->dev,"Failed to reguest IRQ %d: %d\n" , rt5640->irq, ret); rt5640->irq = -ENXIO ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 32/321 ASoC: rt5640: Fix sleep in atomic context
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit df7d595f6bd9dc96cc275cc4b0f313fcfa423c58 ]
Following prints are observed while testing audio on Jetson AGX Orin which has onboard RT5640 audio codec:
BUG: sleeping function called from invalid context at kernel/workqueue.c:3027 in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 0, name: swapper/0 preempt_count: 10001, expected: 0 RCU nest depth: 0, expected: 0 ------------[ cut here ]------------ WARNING: CPU: 0 PID: 0 at kernel/irq/handle.c:159 __handle_irq_event_percpu+0x1e0/0x270 ---[ end trace ad1c64905aac14a6 ]-
The IRQ handler rt5640_irq() runs in interrupt context and can sleep during cancel_delayed_work_sync().
The only thing which rt5640_irq() does is cancel + (re-)queue the jack_work delayed_work. This can be done in a single non sleeping call by replacing queue_delayed_work() with mod_delayed_work(), avoiding the sleep in atomic context.
--- sound/soc/codecs/rt5640.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
sound/soc/codecs/rt5640.c +2 -4
@@ -2404,13 +2404,11 @@ static irqreturn_t rt5640_irq(int irq, void *data)struct rt5640_priv *rt5640 = data;int delay =0 ; -if (rt5640->jd_src ==RT5640_JD_SRC_HDA_HEADER ) { -cancel_delayed_work_sync (&rt5640->jack_work); +if (rt5640->jd_src ==RT5640_JD_SRC_HDA_HEADER ) delay =100 ; - }if (rt5640->jack) -queue_delayed_work (system_long_wq, &rt5640->jack_work, delay); +mod_delayed_work (system_long_wq, &rt5640->jack_work, delay);return IRQ_HANDLED ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 33/321 ASoC: rt5640: fix typos
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Senhong Liu <[email protected]>
[ Upstream commit 8e6657159131f90b746572f6a5bd622b3ccac82d ]
I noticed typos and i fixed them.
Stable-dep-of: 786120ebb649 ("ASoC: rt5640: Do not disable/enable IRQ twice on suspend/resume")
--- sound/soc/codecs/rt5640.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/codecs/rt5640.c +2 -2
@@ -2568,7 +2568,7 @@ static void rt5640_enable_jack_detect(struct snd_soc_component *component,IRQF_TRIGGER_RISING |IRQF_TRIGGER_FALLING |IRQF_ONESHOT , "rt5640", rt5640);if (ret) { -dev_warn (component->dev,"Failed to reguest IRQ %d: %d\n" , rt5640->irq, ret); +dev_warn (component->dev,"Failed to request IRQ %d: %d\n" , rt5640->irq, ret);rt5640_disable_jack_detect (component);return ; }
@@ -2622,7 +2622,7 @@ static void rt5640_enable_hda_jack_detect( ret =request_irq (rt5640->irq, rt5640_irq,IRQF_TRIGGER_RISING |IRQF_ONESHOT ,"rt5640" , rt5640);if (ret) { -dev_warn (component->dev,"Failed to reguest IRQ %d: %d\n" , rt5640->irq, ret); +dev_warn (component->dev,"Failed to request IRQ %d: %d\n" , rt5640->irq, ret); rt5640->irq = -ENXIO ;return ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 34/321 ASoC: rt5640: Do not disable/enable IRQ twice on suspend/resume
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 786120ebb649b166021f0212250e8627e53d068a ]
When jack-detect was originally added disabling the IRQ during suspend was done by the sound/soc/intel/boards/bytcr_rt5640.c driver calling snd_soc_component_set_jack(NULL) on suspend, which calls rt5640_disable_jack_detect(), which calls free_irq() which also disables it.
Commit 5fabcc90e79b ("ASoC: rt5640: Fix Jack work after system suspend") added disable_irq() / enable_irq() calls on suspend/resume for machine drivers which do not call snd_soc_component_set_jack(NULL) on suspend.
The new disable_irq() / enable_irq() are made conditional by "if (rt5640->irq)" statements, but this is true for the machine drivers which do call snd_soc_component_set_jack(NULL) on suspend too, causing a disable_irq() call there on the already free-ed IRQ.
Change the "if (rt5640->irq)" condition to "if (rt5640->jack)" to fix this, rt5640->jack is only set if the jack-detect IRQ handler is still active when rt5640_suspend() runs.
And adjust rt5640_enable_hda_jack_detect()'s request_irq() error handling to set rt5640->jack to NULL to match (note that the old setting of irq to -ENOXIO still resulted in disable_irq(-ENOXIO) calls on suspend).
--- sound/soc/codecs/rt5640.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
sound/soc/codecs/rt5640.c +3 -4
@@ -2623,7 +2623,7 @@ static void rt5640_enable_hda_jack_detect( IRQF_TRIGGER_RISING | IRQF_ONESHOT, "rt5640", rt5640);if (ret) {dev_warn (component->dev,"Failed to request IRQ %d: %d\n" , rt5640->irq, ret); - rt5640->irq = -ENXIO ; + rt5640->jack =NULL ;return ; }
@@ -2798,7 +2798,7 @@ static int rt5640_suspend(struct snd_soc_component *component) {struct rt5640_priv *rt5640 =snd_soc_component_get_drvdata (component); -if (rt5640->irq) { +if (rt5640->jack) {/* disable jack interrupts during system suspend */ disable_irq (rt5640->irq); }
@@ -2826,10 +2826,9 @@ static int rt5640_resume(struct snd_soc_component *component)regcache_cache_only (rt5640->regmap, false);regcache_sync (rt5640->regmap); -if (rt5640->irq) +if (rt5640->jack) {enable_irq (rt5640->irq); -if (rt5640->jack) {if (rt5640->jd_src ==RT5640_JD_SRC_HDA_HEADER ) {snd_soc_component_update_bits (component,RT5640_DUMMY2 ,0x1100 ,0x1100 );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 35/321 ASoC: rt5640: Enable the IRQ on resume after configuring jack-detect
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit b5e85e535551bf82242aa5896e14a136ed3c156d ]
The jack-detect IRQ should be enabled *after* the jack-detect related configuration registers have been programmed.
Move the enable_irq() call for this to after the register setup.
--- sound/soc/codecs/rt5640.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
sound/soc/codecs/rt5640.c +1 -2
@@ -2827,8 +2827,6 @@ static int rt5640_resume(struct snd_soc_component *component)regcache_sync (rt5640->regmap);if (rt5640->jack) { -enable_irq (rt5640->irq); -if (rt5640->jd_src ==RT5640_JD_SRC_HDA_HEADER ) {snd_soc_component_update_bits (component,RT5640_DUMMY2 ,0x1100 ,0x1100 );
@@ -2855,6 +2853,7 @@ static int rt5640_resume(struct snd_soc_component *component) } } +enable_irq (rt5640->irq);queue_delayed_work (system_long_wq, &rt5640->jack_work,0 ); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 36/321 ASoC: rt5640: Fix IRQ not being free-ed for HDA jack detect mode
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 8c8bf3df6b7c0ed1c4dd373b23eb0ce13a63f452 ]
Set "rt5640->irq_requested = true" after a successful request_irq() in rt5640_enable_hda_jack_detect(), so that rt5640_disable_jack_detect() properly frees the IRQ.
This fixes the IRQ not being freed on rmmod / driver unbind.
--- sound/soc/codecs/rt5640.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/codecs/rt5640.c +1 -0
@@ -2626,6 +2626,7 @@ static void rt5640_enable_hda_jack_detect( rt5640->jack =NULL ;return ; } + rt5640->irq_requested = true;/* sync initial jack state */ queue_delayed_work (system_long_wq, &rt5640->jack_work,0 );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 37/321 bpf: Fix a erroneous check after snprintf()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit a8f12572860ad8ba659d96eee9cf09e181f6ebcc ]
snprintf() does not return negative error code on error, it returns the number of characters which *would* be generated for the given input.
Fix the error handling check.
--- kernel/bpf/btf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/bpf/btf.c +1 -1
@@ -8498,7 +8498,7 @@ bool btf_nested_type_is_trusted(struct bpf_verifier_log *log, tname =btf_name_by_offset (btf, walk_type->name_off); ret =snprintf (safe_tname,sizeof (safe_tname),"%s%s" , tname, suffix); -if (ret <0 ) +if (ret >=sizeof (safe_tname))return false; safe_id =btf_find_by_name_kind (btf, safe_tname,BTF_INFO_KIND (walk_type->info));
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 38/321 selftests/bpf: fix unpriv_disabled check in test_verifier
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artem Savkov <[email protected]>
[ Upstream commit d128860dbb29cafc3c65ca2d22082745a32829dd ]
Commit 1d56ade032a49 changed the function get_unpriv_disabled() to return its results as a bool instead of updating a global variable, but test_verifier was not updated to keep in line with these changes. Thus unpriv_disabled is always false in test_verifier and unprivileged tests are not properly skipped on systems with unprivileged bpf disabled.
--- tools/testing/selftests/bpf/test_verifier.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/bpf/test_verifier.c +1 -1
@@ -1880,7 +1880,7 @@ int main(int argc, char **argv) } } -get_unpriv_disabled (); + unpriv_disabled =get_unpriv_disabled ();if (unpriv && unpriv_disabled) {printf ("Cannot run as unprivileged user with sysctl %s.\n" ,UNPRIV_SYSCTL );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 39/321 ALSA: hda/realtek: Splitting the UX3402 into two separate models
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Knyazev Arseniy <[email protected]>
[ Upstream commit 07058dceb038a4b0dd49af07118b6b2a685bb4a6 ]
UX3402VA and UX3402ZA models require different hex values, so comibining them into one model is incorrect.
--- sound/pci/hda/patch_realtek.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/pci/hda/patch_realtek.c +2 -1
@@ -9680,7 +9680,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1043 ,0x1d1f ,"ASUS ROG Strix G17 2023 (G713PV)" ,ALC287_FIXUP_CS35L41_I2C_2 ),SND_PCI_QUIRK (0x1043 ,0x1d42 ,"ASUS Zephyrus G14 2022" ,ALC289_FIXUP_ASUS_GA401 ),SND_PCI_QUIRK (0x1043 ,0x1d4e ,"ASUS TM420" ,ALC256_FIXUP_ASUS_HPE ), -SND_PCI_QUIRK (0x1043 ,0x1e02 ,"ASUS UX3402" ,ALC245_FIXUP_CS35L41_SPI_2 ), +SND_PCI_QUIRK (0x1043 ,0x1e02 ,"ASUS UX3402ZA" ,ALC245_FIXUP_CS35L41_SPI_2 ), +SND_PCI_QUIRK (0x1043 ,0x16a3 ,"ASUS UX3402VA" ,ALC245_FIXUP_CS35L41_SPI_2 ),SND_PCI_QUIRK (0x1043 ,0x1e11 ,"ASUS Zephyrus G15" ,ALC289_FIXUP_ASUS_GA502 ),SND_PCI_QUIRK (0x1043 ,0x1e12 ,"ASUS UM3402" ,ALC287_FIXUP_CS35L41_I2C_2 ), SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU502_PINS),
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 40/321 netfilter: conntrack: fix extension size table
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 4908d5af16676b9d2901830551c2af911e452524 ]
The size table is incorrect due to copypaste error, this reserves more size than needed.
TSTAMP reserved 32 instead of 16 bytes.
TIMEOUT reserved 16 instead of 8 bytes.
--- net/netfilter/nf_conntrack_extend.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/netfilter/nf_conntrack_extend.c +2 -2
@@ -40,10 +40,10 @@ static const u8 nf_ct_ext_type_len[NF_CT_EXT_NUM] = { [NF_CT_EXT_ECACHE] = sizeof(struct nf_conntrack_ecache), #endif #ifdef CONFIG_NF_CONNTRACK_TIMESTAMP - [NF_CT_EXT_TSTAMP ] =sizeof (struct nf_conn_acct ), + [NF_CT_EXT_TSTAMP ] =sizeof (struct nf_conn_tstamp ), #endif #ifdef CONFIG_NF_CONNTRACK_TIMEOUT - [NF_CT_EXT_TIMEOUT ] =sizeof (struct nf_conn_tstamp ), + [NF_CT_EXT_TIMEOUT ] =sizeof (struct nf_conn_timeout ), #endif #ifdef CONFIG_NF_CONNTRACK_LABELS [NF_CT_EXT_LABELS] = sizeof(struct nf_conn_labels),
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 41/321 netfilter: nf_tables: Fix entries val in rule reset audit log
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Sutter <[email protected]>
[ Upstream commit 7fb818f248cff996180b7cdcdcb86b6b4f6e44e2 ]
The value in idx and the number of rules handled in that particular __nf_tables_dump_rules() call is not identical. The former is a cursor to pick up from if multiple netlink messages are needed, so its value is ever increasing. Fixing this is not just a matter of subtracting s_idx from it, though: When resetting rules in multiple chains, __nf_tables_dump_rules() is called for each and cb->args[0] is not adjusted in between. Introduce a dedicated counter to record the number of rules reset in this call in a less confusing way.
While being at it, prevent the direct return upon buffer exhaustion: Any rules previously dumped into that skb would evade audit logging otherwise.
--- net/netfilter/nf_tables_api.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
net/netfilter/nf_tables_api.c +10 -6
@@ -3451,6 +3451,8 @@ static int __nf_tables_dump_rules(struct sk_buff *skb,struct net *net =sock_net (skb->sk);const struct nft_rule *rule, *prule;unsigned int s_idx = cb->args[0 ]; +unsigned int entries =0 ; +int ret =0 ;u64 handle; prule =NULL ;
@@ -3473,9 +3475,11 @@ static int __nf_tables_dump_rules(struct sk_buff *skb, NFT_MSG_NEWRULE, NLM_F_MULTI | NLM_F_APPEND, table->family, - table, chain, rule, handle, reset) < 0) - return 1; - + table, chain, rule, handle, reset) < 0) { + ret =1 ; +break ; + } + entries++;nl_dump_check_consistent (cb,nlmsg_hdr (skb)); cont: prule = rule;
@@ -3483,10 +3487,10 @@ static int __nf_tables_dump_rules(struct sk_buff *skb, (*idx)++; } -if (reset && *idx) -audit_log_rule_reset (table, cb->seq, *idx); +if (reset && entries) +audit_log_rule_reset (table, cb->seq, entries); -return 0 ; +return ret; } static int nf_tables_dump_rules(struct sk_buff *skb,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 42/321 Compiler Attributes: counted_by: Adjust name and identifier expansion
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
[ Upstream commit c8248faf3ca276ebdf60f003b3e04bf764daba91 ]
GCC and Clang's current RFCs name this attribute "counted_by", and have moved away from using a string for the member name. Update the kernel's macros to match. Additionally provide a UAPI no-op macro for UAPI structs that will gain annotations.
Stable-dep-of: 32a4ec211d41 ("uapi: stddef.h: Fix __DECLARE_FLEX_ARRAY for C++")
--- include/linux/compiler_attributes.h | 26 +++++++++++++------------- include/uapi/linux/stddef.h | 4 ++++ 2 files changed, 17 insertions(+), 13 deletions(-)
include/linux/compiler_attributes.h +13 -13
@@ -94,6 +94,19 @@# define __copy (symbol)#endif +/* +* Optional: only supported since gcc >= 14 +* Optional: only supported since clang >= 18 +* +* gcc: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108896 +* clang: https://reviews.llvm.org/D148381 +*/ +#if __has_attribute (__counted_by__) +# define __counted_by (member) __attribute__((__counted_by__(member))) +#else +# define __counted_by (member) +#endif +/* * Optional: not supported by gcc * Optional: only supported since clang >= 14.0
@@ -129,19 +142,6 @@# define __designated_init#endif -/* -* Optional: only supported since gcc >= 14 -* Optional: only supported since clang >= 17 -* -* gcc: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108896 -* clang: https://reviews.llvm.org/D148381 -*/ -#if __has_attribute (__element_count__) -# define __counted_by (member) __attribute__((__element_count__(#member))) -#else -# define __counted_by (member) -#endif -/* * Optional: only supported since clang >= 14.0 *
include/uapi/linux/stddef.h +4 -0
@@ -45,3 +45,7 @@ TYPE NAME[]; \ }#endif + +#ifndef __counted_by +#define __counted_by (m) +#endif
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 43/321 uapi: stddef.h: Fix header guard location
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Dobriyan <[email protected]>
[ Upstream commit 531108ec5b5cd45ec6272a6115e73275baef7d22 ]
The #endif for the header guard wasn't at the end of the header. This was harmless since the define that escaped was already testing for its own redefinition. Regardless, move the #endif to the correct place.
Stable-dep-of: 32a4ec211d41 ("uapi: stddef.h: Fix __DECLARE_FLEX_ARRAY for C++")
--- include/uapi/linux/stddef.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
include/uapi/linux/stddef.h +2 -1
@@ -44,8 +44,9 @@ struct { } __empty_ ## NAME; \ TYPE NAME[]; \ } -#endif #ifndef __counted_by#define __counted_by (m)#endif + +#endif /* _UAPI_LINUX_STDDEF_H */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 44/321 uapi: stddef.h: Fix __DECLARE_FLEX_ARRAY for C++
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Dobriyan <[email protected]>
[ Upstream commit 32a4ec211d4164e667d9d0b807fadf02053cd2e9 ]
__DECLARE_FLEX_ARRAY(T, member) macro expands to
struct {
struct {} __empty_member;
T member[];
};which is subtly wrong in C++ because sizeof(struct{}) is 1 not 0, changing UAPI structures layouts.
This can be fixed by expanding to
T member[];
Now g++ doesn't like "T member[]" either, throwing errors on the following code:
struct S {
union {
T1 member1[];
T2 member2[];
};
};or
struct S {
T member[];
};Use "T member[0];" which seems to work and does the right thing wrt structure layout.
--- include/uapi/linux/stddef.h | 6 ++++++ 1 file changed, 6 insertions(+)
include/uapi/linux/stddef.h +6 -0
@@ -29,6 +29,11 @@ struct TAG { MEMBERS } ATTRS NAME; \ } +#ifdef __cplusplus +/* sizeof(struct{}) is 1 in C++, not 0, can't use C version of the macro. */ +#define __DECLARE_FLEX_ARRAY (T , member) \ + T member[0] +#else /** * __DECLARE_FLEX_ARRAY() - Declare a flexible array usable in a union *
@@ -44,6 +49,7 @@ struct { } __empty_ ## NAME; \ TYPE NAME[]; \ } +#endif #ifndef __counted_by#define __counted_by (m)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 45/321 memblock tests: Fix compilation errors.
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rong Tao <[email protected]>
[ Upstream commit 4b2d631236931550f2ab0abc9a666958853ae846 ]
This patch fix the follow errors.
commit 61167ad5fecd ("mm: pass nid to reserve_bootmem_region()") pass nid parameter to reserve_bootmem_region(),
$ make -C tools/testing/memblock/
...
memblock.c: In function ‘memmap_init_reserved_pages’:
memblock.c:2111:25: error: too many arguments to function ‘reserve_bootmem_region’
2111 | reserve_bootmem_region(start, end, nid);
| ^~~~~~~~~~~~~~~~~~~~~~
../../include/linux/mm.h:32:6: note: declared here
32 | void reserve_bootmem_region(phys_addr_t start, phys_addr_t end);
| ^~~~~~~~~~~~~~~~~~~~~~
memblock.c:2122:17: error: too many arguments to function ‘reserve_bootmem_region’
2122 | reserve_bootmem_region(start, end, nid);
| ^~~~~~~~~~~~~~~~~~~~~~commit dcdfdd40fa82 ("mm: Add support for unaccepted memory") call accept_memory() in memblock.c
$ make -C tools/testing/memblock/
...
cc -fsanitize=address -fsanitize=undefined main.o memblock.o \
lib/slab.o mmzone.o slab.o tests/alloc_nid_api.o \
tests/alloc_helpers_api.o tests/alloc_api.o tests/basic_api.o \
tests/common.o tests/alloc_exact_nid_api.o -o main
/usr/bin/ld: memblock.o: in function `memblock_alloc_range_nid':
memblock.c:(.text+0x7ae4): undefined reference to `accept_memory'--- tools/include/linux/mm.h | 2 +- tools/testing/memblock/internal.h | 4 ++++ tools/testing/memblock/mmzone.c | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-)
tools/include/linux/mm.h +1 -1
@@ -29,7 +29,7 @@ static inline void *phys_to_virt(unsigned long address)return __va (address); } -void reserve_bootmem_region (phys_addr_t start,phys_addr_t end); +void reserve_bootmem_region (phys_addr_t start,phys_addr_t end,int nid);static inline void totalram_pages_inc (void ) {
tools/testing/memblock/internal.h +4 -0
@@ -20,4 +20,8 @@ void memblock_free_pages(struct page *page, unsigned long pfn, { } +static inline void accept_memory (phys_addr_t start,phys_addr_t end) +{ +} +#endif
tools/testing/memblock/mmzone.c +1 -1
@@ -11,7 +11,7 @@ struct pglist_data *next_online_pgdat(struct pglist_data *pgdat)return NULL ; } -void reserve_bootmem_region (phys_addr_t start,phys_addr_t end) +void reserve_bootmem_region (phys_addr_t start,phys_addr_t end,int nid) { }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 46/321 ASoC: SOF: ipc4-topology: fix wrong sizeof argument
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bard Liao <[email protected]>
[ Upstream commit 6ba59c008f08e84b3c87be10f3391c9735e4f833 ]
available_fmt is a pointer.
--- sound/soc/sof/ipc4-topology.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/sof/ipc4-topology.c +1 -1
@@ -218,7 +218,7 @@ static int sof_ipc4_get_audio_fmt(struct snd_soc_component *scomp, ret =sof_update_ipc_object (scomp, available_fmt,SOF_AUDIO_FMT_NUM_TOKENS , swidget->tuples, - swidget->num_tuples,sizeof (available_fmt),1 ); + swidget->num_tuples,sizeof (*available_fmt),1 );if (ret) {dev_err (scomp->dev,"Failed to parse audio format token count\n" );return ret;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 47/321 net: microchip: sparx5: Fix memory leak for vcap_api_rule_add_keyvalue_test()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit f037fc9905ffa6fa19b89bfbc86946798cede071 ]
Inject fault while probing kunit-example-test.ko, the field which is allocated by kzalloc in vcap_rule_add_key() of vcap_rule_add_key_bit/u32/u128() is not freed, and it cause the memory leaks below.
unreferenced object 0xffff0276c14b7240 (size 64):
comm "kunit_try_catch", pid 284, jiffies 4294894220 (age 920.072s) hex dump (first 32 bytes):
28 3c 61 82 00 80 ff ff 28 3c 61 82 00 80 ff ff (<a.....(<a.....
67 00 00 00 00 00 00 00 00 01 37 2b af ab ff ff g.........7+....
backtrace:
[<0000000028f08898>] slab_post_alloc_hook+0xb8/0x368
[<00000000514b9b37>] __kmem_cache_alloc_node+0x174/0x290
[<000000004620684a>] kmalloc_trace+0x40/0x164
[<0000000059ad6bcd>] vcap_rule_add_key+0x104/0x180
[<00000000ff8002d3>] vcap_api_rule_add_keyvalue_test+0x100/0xba8
[<00000000fcc5326c>] kunit_try_run_case+0x50/0xac
[<00000000f5f45b20>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<0000000026284079>] kthread+0x124/0x130
[<0000000024d4a996>] ret_from_fork+0x10/0x20
unreferenced object 0xffff0276c14b7280 (size 64):
comm "kunit_try_catch", pid 284, jiffies 4294894221 (age 920.068s)
hex dump (first 32 bytes):
28 3c 61 82 00 80 ff ff 28 3c 61 82 00 80 ff ff (<a.....(<a.....
67 00 00 00 00 00 00 00 01 01 37 2b af ab ff ff g.........7+....
backtrace:
[<0000000028f08898>] slab_post_alloc_hook+0xb8/0x368
[<00000000514b9b37>] __kmem_cache_alloc_node+0x174/0x290
[<000000004620684a>] kmalloc_trace+0x40/0x164
[<0000000059ad6bcd>] vcap_rule_add_key+0x104/0x180
[<00000000f5ac9dc7>] vcap_api_rule_add_keyvalue_test+0x168/0xba8
[<00000000fcc5326c>] kunit_try_run_case+0x50/0xac
[<00000000f5f45b20>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<0000000026284079>] kthread+0x124/0x130
[<0000000024d4a996>] ret_from_fork+0x10/0x20
unreferenced object 0xffff0276c14b72c0 (size 64):
comm "kunit_try_catch", pid 284, jiffies 4294894221 (age 920.068s)
hex dump (first 32 bytes):
28 3c 61 82 00 80 ff ff 28 3c 61 82 00 80 ff ff (<a.....(<a.....
67 00 00 00 00 00 00 00 00 00 37 2b af ab ff ff g.........7+....
backtrace:
[<0000000028f08898>] slab_post_alloc_hook+0xb8/0x368
[<00000000514b9b37>] __kmem_cache_alloc_node+0x174/0x290
[<000000004620684a>] kmalloc_trace+0x40/0x164
[<0000000059ad6bcd>] vcap_rule_add_key+0x104/0x180
[<00000000c918ae7f>] vcap_api_rule_add_keyvalue_test+0x1d0/0xba8
[<00000000fcc5326c>] kunit_try_run_case+0x50/0xac
[<00000000f5f45b20>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<0000000026284079>] kthread+0x124/0x130
[<0000000024d4a996>] ret_from_fork+0x10/0x20
unreferenced object 0xffff0276c14b7300 (size 64):
comm "kunit_try_catch", pid 284, jiffies 4294894221 (age 920.084s)
hex dump (first 32 bytes):
28 3c 61 82 00 80 ff ff 28 3c 61 82 00 80 ff ff (<a.....(<a.....
7d 00 00 00 01 00 00 00 32 54 76 98 ab ff 00 ff }.......2Tv.....
backtrace:
[<0000000028f08898>] slab_post_alloc_hook+0xb8/0x368
[<00000000514b9b37>] __kmem_cache_alloc_node+0x174/0x290
[<000000004620684a>] kmalloc_trace+0x40/0x164
[<0000000059ad6bcd>] vcap_rule_add_key+0x104/0x180
[<0000000003352814>] vcap_api_rule_add_keyvalue_test+0x240/0xba8
[<00000000fcc5326c>] kunit_try_run_case+0x50/0xac
[<00000000f5f45b20>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<0000000026284079>] kthread+0x124/0x130
[<0000000024d4a996>] ret_from_fork+0x10/0x20
unreferenced object 0xffff0276c14b7340 (size 64):
comm "kunit_try_catch", pid 284, jiffies 4294894221 (age 920.084s)
hex dump (first 32 bytes):
28 3c 61 82 00 80 ff ff 28 3c 61 82 00 80 ff ff (<a.....(<a.....
51 00 00 00 07 00 00 00 17 26 35 44 63 62 71 00 Q........&5Dcbq.
backtrace:
[<0000000028f08898>] slab_post_alloc_hook+0xb8/0x368
[<00000000514b9b37>] __kmem_cache_alloc_node+0x174/0x290
[<000000004620684a>] kmalloc_trace+0x40/0x164
[<0000000059ad6bcd>] vcap_rule_add_key+0x104/0x180
[<000000001516f109>] vcap_api_rule_add_keyvalue_test+0x2cc/0xba8
[<00000000fcc5326c>] kunit_try_run_case+0x50/0xac
[<00000000f5f45b20>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<0000000026284079>] kthread+0x124/0x130
[<0000000024d4a996>] ret_from_fork+0x10/0x20--- .../net/ethernet/microchip/vcap/vcap_api_kunit.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c +15 -0
@@ -995,6 +995,16 @@ static void vcap_api_encode_rule_actionset_test(struct kunit *test)KUNIT_EXPECT_EQ (test, (u32 )0x00000000 , actwords[11 ]); } +static void vcap_free_ckf (struct vcap_rule *rule) +{ +struct vcap_client_keyfield *ckf, *next_ckf; + +list_for_each_entry_safe (ckf, next_ckf, &rule->keyfields, ctrl.list) { +list_del (&ckf->ctrl.list); +kfree (ckf); + } +} +static void vcap_api_rule_add_keyvalue_test (struct kunit *test) {struct vcap_admin admin = {
@@ -1027,6 +1037,7 @@ static void vcap_api_rule_add_keyvalue_test(struct kunit *test)KUNIT_EXPECT_EQ (test,VCAP_FIELD_BIT , kf->ctrl.type);KUNIT_EXPECT_EQ (test,0x0 , kf->data.u1.value);KUNIT_EXPECT_EQ (test,0x1 , kf->data.u1.mask); +vcap_free_ckf (rule);INIT_LIST_HEAD (&rule->keyfields); ret =vcap_rule_add_key_bit (rule,VCAP_KF_LOOKUP_FIRST_IS ,VCAP_BIT_1 );
@@ -1039,6 +1050,7 @@ static void vcap_api_rule_add_keyvalue_test(struct kunit *test)KUNIT_EXPECT_EQ (test,VCAP_FIELD_BIT , kf->ctrl.type);KUNIT_EXPECT_EQ (test,0x1 , kf->data.u1.value);KUNIT_EXPECT_EQ (test,0x1 , kf->data.u1.mask); +vcap_free_ckf (rule);INIT_LIST_HEAD (&rule->keyfields); ret = vcap_rule_add_key_bit(rule, VCAP_KF_LOOKUP_FIRST_IS,
@@ -1052,6 +1064,7 @@ static void vcap_api_rule_add_keyvalue_test(struct kunit *test)KUNIT_EXPECT_EQ (test,VCAP_FIELD_BIT , kf->ctrl.type);KUNIT_EXPECT_EQ (test,0x0 , kf->data.u1.value);KUNIT_EXPECT_EQ (test,0x0 , kf->data.u1.mask); +vcap_free_ckf (rule);INIT_LIST_HEAD (&rule->keyfields); ret =vcap_rule_add_key_u32 (rule,VCAP_KF_TYPE ,0x98765432 ,0xff00ffab );
@@ -1064,6 +1077,7 @@ static void vcap_api_rule_add_keyvalue_test(struct kunit *test)KUNIT_EXPECT_EQ (test,VCAP_FIELD_U32 , kf->ctrl.type);KUNIT_EXPECT_EQ (test,0x98765432 , kf->data.u32.value);KUNIT_EXPECT_EQ (test,0xff00ffab , kf->data.u32.mask); +vcap_free_ckf (rule);INIT_LIST_HEAD (&rule->keyfields); ret =vcap_rule_add_key_u128 (rule,VCAP_KF_L3_IP6_SIP , &dip);
@@ -1078,6 +1092,7 @@ static void vcap_api_rule_add_keyvalue_test(struct kunit *test)KUNIT_EXPECT_EQ (test, dip.value[idx], kf->data.u128.value[idx]);for (idx =0 ; idx <ARRAY_SIZE (dip.mask); ++idx)KUNIT_EXPECT_EQ (test, dip.mask[idx], kf->data.u128.mask[idx]); +vcap_free_ckf (rule); }static void vcap_api_rule_add_actionvalue_test (struct kunit *test)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 48/321 net: microchip: sparx5: Fix memory leak for vcap_api_rule_add_actionvalue_test()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 39d0ccc185315408e7cecfcaf06d167927b51052 ]
Inject fault while probing kunit-example-test.ko, the field which is allocated by kzalloc in vcap_rule_add_action() of vcap_rule_add_action_bit/u32() is not freed, and it cause the memory leaks below.
unreferenced object 0xffff0276c496b300 (size 64):
comm "kunit_try_catch", pid 286, jiffies 4294894224 (age 920.072s) hex dump (first 32 bytes):
68 3c 62 82 00 80 ff ff 68 3c 62 82 00 80 ff ff h<b.....h<b.....
3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <...............
backtrace:
[<0000000028f08898>] slab_post_alloc_hook+0xb8/0x368
[<00000000514b9b37>] __kmem_cache_alloc_node+0x174/0x290
[<000000004620684a>] kmalloc_trace+0x40/0x164
[<000000008b41c84d>] vcap_rule_add_action+0x104/0x178
[<00000000ae66c16c>] vcap_api_rule_add_actionvalue_test+0xa4/0x990
[<00000000fcc5326c>] kunit_try_run_case+0x50/0xac
[<00000000f5f45b20>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<0000000026284079>] kthread+0x124/0x130
[<0000000024d4a996>] ret_from_fork+0x10/0x20
unreferenced object 0xffff0276c496b2c0 (size 64):
comm "kunit_try_catch", pid 286, jiffies 4294894224 (age 920.072s)
hex dump (first 32 bytes):
68 3c 62 82 00 80 ff ff 68 3c 62 82 00 80 ff ff h<b.....h<b.....
3c 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 <...............
backtrace:
[<0000000028f08898>] slab_post_alloc_hook+0xb8/0x368
[<00000000514b9b37>] __kmem_cache_alloc_node+0x174/0x290
[<000000004620684a>] kmalloc_trace+0x40/0x164
[<000000008b41c84d>] vcap_rule_add_action+0x104/0x178
[<00000000607782aa>] vcap_api_rule_add_actionvalue_test+0x100/0x990
[<00000000fcc5326c>] kunit_try_run_case+0x50/0xac
[<00000000f5f45b20>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<0000000026284079>] kthread+0x124/0x130
[<0000000024d4a996>] ret_from_fork+0x10/0x20
unreferenced object 0xffff0276c496b280 (size 64):
comm "kunit_try_catch", pid 286, jiffies 4294894224 (age 920.072s)
hex dump (first 32 bytes):
68 3c 62 82 00 80 ff ff 68 3c 62 82 00 80 ff ff h<b.....h<b.....
3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <...............
backtrace:
[<0000000028f08898>] slab_post_alloc_hook+0xb8/0x368
[<00000000514b9b37>] __kmem_cache_alloc_node+0x174/0x290
[<000000004620684a>] kmalloc_trace+0x40/0x164
[<000000008b41c84d>] vcap_rule_add_action+0x104/0x178
[<000000004e640602>] vcap_api_rule_add_actionvalue_test+0x15c/0x990
[<00000000fcc5326c>] kunit_try_run_case+0x50/0xac
[<00000000f5f45b20>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<0000000026284079>] kthread+0x124/0x130
[<0000000024d4a996>] ret_from_fork+0x10/0x20
unreferenced object 0xffff0276c496b240 (size 64):
comm "kunit_try_catch", pid 286, jiffies 4294894224 (age 920.092s)
hex dump (first 32 bytes):
68 3c 62 82 00 80 ff ff 68 3c 62 82 00 80 ff ff h<b.....h<b.....
5a 00 00 00 01 00 00 00 32 54 76 98 00 00 00 00 Z.......2Tv.....
backtrace:
[<0000000028f08898>] slab_post_alloc_hook+0xb8/0x368
[<00000000514b9b37>] __kmem_cache_alloc_node+0x174/0x290
[<000000004620684a>] kmalloc_trace+0x40/0x164
[<000000008b41c84d>] vcap_rule_add_action+0x104/0x178
[<0000000011141bf8>] vcap_api_rule_add_actionvalue_test+0x1bc/0x990
[<00000000fcc5326c>] kunit_try_run_case+0x50/0xac
[<00000000f5f45b20>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<0000000026284079>] kthread+0x124/0x130
[<0000000024d4a996>] ret_from_fork+0x10/0x20
unreferenced object 0xffff0276c496b200 (size 64):
comm "kunit_try_catch", pid 286, jiffies 4294894224 (age 920.092s)
hex dump (first 32 bytes):
68 3c 62 82 00 80 ff ff 68 3c 62 82 00 80 ff ff h<b.....h<b.....
28 00 00 00 01 00 00 00 dd cc bb aa 00 00 00 00 (...............
backtrace:
[<0000000028f08898>] slab_post_alloc_hook+0xb8/0x368
[<00000000514b9b37>] __kmem_cache_alloc_node+0x174/0x290
[<000000004620684a>] kmalloc_trace+0x40/0x164
[<000000008b41c84d>] vcap_rule_add_action+0x104/0x178
[<00000000d5ed3088>] vcap_api_rule_add_actionvalue_test+0x22c/0x990
[<00000000fcc5326c>] kunit_try_run_case+0x50/0xac
[<00000000f5f45b20>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<0000000026284079>] kthread+0x124/0x130
[<0000000024d4a996>] ret_from_fork+0x10/0x20--- .../net/ethernet/microchip/vcap/vcap_api_kunit.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c +16 -0
@@ -1095,6 +1095,17 @@ static void vcap_api_rule_add_keyvalue_test(struct kunit *test)vcap_free_ckf (rule); } +static void vcap_free_caf (struct vcap_rule *rule) +{ +struct vcap_client_actionfield *caf, *next_caf; + +list_for_each_entry_safe (caf, next_caf, + &rule->actionfields, ctrl.list) { +list_del (&caf->ctrl.list); +kfree (caf); + } +} +static void vcap_api_rule_add_actionvalue_test (struct kunit *test) {struct vcap_admin admin = {
@@ -1120,6 +1131,7 @@ static void vcap_api_rule_add_actionvalue_test(struct kunit *test)KUNIT_EXPECT_EQ (test,VCAP_AF_POLICE_ENA , af->ctrl.action);KUNIT_EXPECT_EQ (test,VCAP_FIELD_BIT , af->ctrl.type);KUNIT_EXPECT_EQ (test,0x0 , af->data.u1.value); +vcap_free_caf (rule);INIT_LIST_HEAD (&rule->actionfields); ret =vcap_rule_add_action_bit (rule,VCAP_AF_POLICE_ENA ,VCAP_BIT_1 );
@@ -1131,6 +1143,7 @@ static void vcap_api_rule_add_actionvalue_test(struct kunit *test)KUNIT_EXPECT_EQ (test,VCAP_AF_POLICE_ENA , af->ctrl.action);KUNIT_EXPECT_EQ (test,VCAP_FIELD_BIT , af->ctrl.type);KUNIT_EXPECT_EQ (test,0x1 , af->data.u1.value); +vcap_free_caf (rule);INIT_LIST_HEAD (&rule->actionfields); ret =vcap_rule_add_action_bit (rule,VCAP_AF_POLICE_ENA ,VCAP_BIT_ANY );
@@ -1142,6 +1155,7 @@ static void vcap_api_rule_add_actionvalue_test(struct kunit *test)KUNIT_EXPECT_EQ (test,VCAP_AF_POLICE_ENA , af->ctrl.action);KUNIT_EXPECT_EQ (test,VCAP_FIELD_BIT , af->ctrl.type);KUNIT_EXPECT_EQ (test,0x0 , af->data.u1.value); +vcap_free_caf (rule);INIT_LIST_HEAD (&rule->actionfields); ret =vcap_rule_add_action_u32 (rule,VCAP_AF_TYPE ,0x98765432 );
@@ -1153,6 +1167,7 @@ static void vcap_api_rule_add_actionvalue_test(struct kunit *test)KUNIT_EXPECT_EQ (test,VCAP_AF_TYPE , af->ctrl.action);KUNIT_EXPECT_EQ (test,VCAP_FIELD_U32 , af->ctrl.type);KUNIT_EXPECT_EQ (test,0x98765432 , af->data.u32.value); +vcap_free_caf (rule);INIT_LIST_HEAD (&rule->actionfields); ret =vcap_rule_add_action_u32 (rule,VCAP_AF_MASK_MODE ,0xaabbccdd );
@@ -1164,6 +1179,7 @@ static void vcap_api_rule_add_actionvalue_test(struct kunit *test)KUNIT_EXPECT_EQ (test,VCAP_AF_MASK_MODE , af->ctrl.action);KUNIT_EXPECT_EQ (test,VCAP_FIELD_U32 , af->ctrl.type);KUNIT_EXPECT_EQ (test,0xaabbccdd , af->data.u32.value); +vcap_free_caf (rule); }static void vcap_api_rule_find_keyset_basic_test (struct kunit *test)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 49/321 net: microchip: sparx5: Fix possible memory leak in vcap_api_encode_rule_test()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 89e3af0277388f32d56915a6715c735e4afae5d6 ]
Inject fault while probing kunit-example-test.ko, the duprule which is allocated in vcap_dup_rule() and the vcap enabled port which is allocated in vcap_enable() of vcap_enable_lookups in vcap_api_encode_rule_test() is not freed, and it cause the memory leaks below.
Use vcap_enable_lookups() with false arg to free the vcap enabled port as other drivers do it. And use vcap_del_rule() to free the duprule.
unreferenced object 0xffff677a0278bb00 (size 64):
comm "kunit_try_catch", pid 388, jiffies 4294895987 (age 1101.840s) hex dump (first 32 bytes):
18 bd a5 82 00 80 ff ff 18 bd a5 82 00 80 ff ff ................
40 fe c8 0e be c6 ff ff 00 00 00 00 00 00 00 00 @...............
backtrace:
[<000000007d53023a>] slab_post_alloc_hook+0xb8/0x368
[<0000000076e3f654>] __kmem_cache_alloc_node+0x174/0x290
[<0000000034d76721>] kmalloc_trace+0x40/0x164
[<00000000013380a5>] vcap_enable_lookups+0x1c8/0x70c
[<00000000bbec496b>] vcap_api_encode_rule_test+0x2f8/0xb18
[<000000002c2bfb7b>] kunit_try_run_case+0x50/0xac
[<00000000ff74642b>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<000000004af845ca>] kthread+0x124/0x130
[<0000000038a000ca>] ret_from_fork+0x10/0x20
unreferenced object 0xffff677a027803c0 (size 192):
comm "kunit_try_catch", pid 388, jiffies 4294895988 (age 1101.836s)
hex dump (first 32 bytes):
00 12 7a 00 05 00 00 00 0a 00 00 00 64 00 00 00 ..z.........d...
00 00 00 00 00 00 00 00 d8 03 78 02 7a 67 ff ff ..........x.zg..
backtrace:
[<000000007d53023a>] slab_post_alloc_hook+0xb8/0x368
[<0000000076e3f654>] __kmem_cache_alloc_node+0x174/0x290
[<0000000034d76721>] kmalloc_trace+0x40/0x164
[<00000000c1010131>] vcap_dup_rule+0x34/0x14c
[<00000000d43c54a4>] vcap_add_rule+0x29c/0x32c
[<0000000073f1c26d>] vcap_api_encode_rule_test+0x304/0xb18
[<000000002c2bfb7b>] kunit_try_run_case+0x50/0xac
[<00000000ff74642b>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<000000004af845ca>] kthread+0x124/0x130
[<0000000038a000ca>] ret_from_fork+0x10/0x20--- drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c +6 -0
@@ -1439,6 +1439,10 @@ static void vcap_api_encode_rule_test(struct kunit *test) ret =list_empty (&is2_admin.rules);KUNIT_EXPECT_EQ (test, false, ret);KUNIT_EXPECT_EQ (test,0 , ret); + +vcap_enable_lookups (&test_vctrl, &test_netdev,0 ,0 , + rule->cookie, false); +vcap_free_rule (rule);/* Check that the rule has been freed: tricky to access since this
@@ -1449,6 +1453,8 @@ static void vcap_api_encode_rule_test(struct kunit *test)KUNIT_EXPECT_EQ (test, true, ret); ret =list_empty (&rule->actionfields);KUNIT_EXPECT_EQ (test, true, ret); + +vcap_del_rule (&test_vctrl, &test_netdev, id); }static void vcap_api_set_rule_counter_test (struct kunit *test)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 50/321 net: microchip: sparx5: Fix possible memory leaks in test_vcap_xn_rule_creator()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 20146fa73ab8db2ab9f4916bbaf4610646787a09 ]
Inject fault while probing kunit-example-test.ko, the rule which is allocated by kzalloc in vcap_alloc_rule(), the field which is allocated by kzalloc in vcap_rule_add_action() and vcap_rule_add_key() is not freed, and it cause the memory leaks below. Use vcap_free_rule() to free them as other drivers do it.
And since the return rule of test_vcap_xn_rule_creator() is not used, remove it and switch to void.
unreferenced object 0xffff058383334240 (size 192):
comm "kunit_try_catch", pid 309, jiffies 4294894222 (age 639.800s) hex dump (first 32 bytes):
10 27 00 00 04 00 00 00 14 00 00 00 90 01 00 00 .'..............
00 00 00 00 00 00 00 00 00 81 93 84 83 05 ff ff ................
backtrace:
[<000000008585a8f7>] slab_post_alloc_hook+0xb8/0x368
[<00000000795eba12>] __kmem_cache_alloc_node+0x174/0x290
[<0000000061886991>] kmalloc_trace+0x40/0x164
[<00000000648fefae>] vcap_alloc_rule+0x17c/0x26c
[<000000004da16164>] test_vcap_xn_rule_creator.constprop.43+0xac/0x328
[<00000000231b1097>] vcap_api_rule_insert_in_order_test+0xcc/0x184
[<00000000548b559e>] kunit_try_run_case+0x50/0xac
[<00000000663f0105>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<00000000e646f120>] kthread+0x124/0x130
[<000000005257599e>] ret_from_fork+0x10/0x20
unreferenced object 0xffff0583849380c0 (size 64):
comm "kunit_try_catch", pid 309, jiffies 4294894222 (age 639.800s)
hex dump (first 32 bytes):
40 81 93 84 83 05 ff ff 68 42 33 83 83 05 ff ff @.......hB3.....
22 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 "...............
backtrace:
[<000000008585a8f7>] slab_post_alloc_hook+0xb8/0x368
[<00000000795eba12>] __kmem_cache_alloc_node+0x174/0x290
[<0000000061886991>] kmalloc_trace+0x40/0x164
[<00000000ee41df9e>] vcap_rule_add_action+0x104/0x178
[<000000001cc1bb38>] test_vcap_xn_rule_creator.constprop.43+0xd8/0x328
[<00000000231b1097>] vcap_api_rule_insert_in_order_test+0xcc/0x184
[<00000000548b559e>] kunit_try_run_case+0x50/0xac
[<00000000663f0105>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<00000000e646f120>] kthread+0x124/0x130
[<000000005257599e>] ret_from_fork+0x10/0x20
unreferenced object 0xffff058384938100 (size 64):
comm "kunit_try_catch", pid 309, jiffies 4294894222 (age 639.800s)
hex dump (first 32 bytes):
80 81 93 84 83 05 ff ff 58 42 33 83 83 05 ff ff ........XB3.....
7d 00 00 00 01 00 00 00 02 00 00 00 ff 00 00 00 }...............
backtrace:
[<000000008585a8f7>] slab_post_alloc_hook+0xb8/0x368
[<00000000795eba12>] __kmem_cache_alloc_node+0x174/0x290
[<0000000061886991>] kmalloc_trace+0x40/0x164
[<0000000043c78991>] vcap_rule_add_key+0x104/0x180
[<00000000ba73cfbe>] vcap_add_type_keyfield+0xfc/0x128
[<000000002b00f7df>] vcap_val_rule+0x274/0x3e8
[<00000000e67d2ff5>] test_vcap_xn_rule_creator.constprop.43+0xf0/0x328
[<00000000231b1097>] vcap_api_rule_insert_in_order_test+0xcc/0x184
[<00000000548b559e>] kunit_try_run_case+0x50/0xac
[<00000000663f0105>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<00000000e646f120>] kthread+0x124/0x130
[<000000005257599e>] ret_from_fork+0x10/0x20unreferenced object 0xffff0583833b6240 (size 192):
comm "kunit_try_catch", pid 311, jiffies 4294894225 (age 639.844s) hex dump (first 32 bytes):
10 27 00 00 04 00 00 00 1e 00 00 00 2c 01 00 00 .'..........,...
00 00 00 00 00 00 00 00 40 91 8f 84 83 05 ff ff ........@.......
backtrace:
[<000000008585a8f7>] slab_post_alloc_hook+0xb8/0x368
[<00000000795eba12>] __kmem_cache_alloc_node+0x174/0x290
[<0000000061886991>] kmalloc_trace+0x40/0x164
[<00000000648fefae>] vcap_alloc_rule+0x17c/0x26c
[<000000004da16164>] test_vcap_xn_rule_creator.constprop.43+0xac/0x328
[<00000000509de3f4>] vcap_api_rule_insert_reverse_order_test+0x10c/0x654
[<00000000548b559e>] kunit_try_run_case+0x50/0xac
[<00000000663f0105>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<00000000e646f120>] kthread+0x124/0x130
[<000000005257599e>] ret_from_fork+0x10/0x20
unreferenced object 0xffff0583848f9100 (size 64):
comm "kunit_try_catch", pid 311, jiffies 4294894225 (age 639.844s)
hex dump (first 32 bytes):
80 91 8f 84 83 05 ff ff 68 62 3b 83 83 05 ff ff ........hb;.....
22 00 00 00 01 00 00 00 00 00 00 00 a5 b4 ff ff "...............
backtrace:
[<000000008585a8f7>] slab_post_alloc_hook+0xb8/0x368
[<00000000795eba12>] __kmem_cache_alloc_node+0x174/0x290
[<0000000061886991>] kmalloc_trace+0x40/0x164
[<00000000ee41df9e>] vcap_rule_add_action+0x104/0x178
[<000000001cc1bb38>] test_vcap_xn_rule_creator.constprop.43+0xd8/0x328
[<00000000509de3f4>] vcap_api_rule_insert_reverse_order_test+0x10c/0x654
[<00000000548b559e>] kunit_try_run_case+0x50/0xac
[<00000000663f0105>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<00000000e646f120>] kthread+0x124/0x130
[<000000005257599e>] ret_from_fork+0x10/0x20
unreferenced object 0xffff0583848f9140 (size 64):
comm "kunit_try_catch", pid 311, jiffies 4294894225 (age 639.844s)
hex dump (first 32 bytes):
c0 91 8f 84 83 05 ff ff 58 62 3b 83 83 05 ff ff ........Xb;.....
7d 00 00 00 01 00 00 00 02 00 00 00 ff 00 00 00 }...............
backtrace:
[<000000008585a8f7>] slab_post_alloc_hook+0xb8/0x368
[<00000000795eba12>] __kmem_cache_alloc_node+0x174/0x290
[<0000000061886991>] kmalloc_trace+0x40/0x164
[<0000000043c78991>] vcap_rule_add_key+0x104/0x180
[<00000000ba73cfbe>] vcap_add_type_keyfield+0xfc/0x128
[<000000002b00f7df>] vcap_val_rule+0x274/0x3e8
[<00000000e67d2ff5>] test_vcap_xn_rule_creator.constprop.43+0xf0/0x328
[<00000000509de3f4>] vcap_api_rule_insert_reverse_order_test+0x10c/0x654
[<00000000548b559e>] kunit_try_run_case+0x50/0xac
[<00000000663f0105>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<00000000e646f120>] kthread+0x124/0x130
[<000000005257599e>] ret_from_fork+0x10/0x20unreferenced object 0xffff05838264e0c0 (size 192):
comm "kunit_try_catch", pid 313, jiffies 4294894230 (age 639.864s) hex dump (first 32 bytes):
10 27 00 00 04 00 00 00 0a 00 00 00 f4 01 00 00 .'..............
00 00 00 00 00 00 00 00 40 3a 97 84 83 05 ff ff ........@:......
backtrace:
[<000000008585a8f7>] slab_post_alloc_hook+0xb8/0x368
[<00000000795eba12>] __kmem_cache_alloc_node+0x174/0x290
[<0000000061886991>] kmalloc_trace+0x40/0x164
[<00000000648fefae>] vcap_alloc_rule+0x17c/0x26c
[<000000004da16164>] test_vcap_xn_rule_creator.constprop.43+0xac/0x328
[<00000000a29794d8>] vcap_api_rule_remove_at_end_test+0xbc/0xb48
[<00000000548b559e>] kunit_try_run_case+0x50/0xac
[<00000000663f0105>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<00000000e646f120>] kthread+0x124/0x130
[<000000005257599e>] ret_from_fork+0x10/0x20
unreferenced object 0xffff058384973a80 (size 64):
comm "kunit_try_catch", pid 313, jiffies 4294894230 (age 639.864s)
hex dump (first 32 bytes):
e8 e0 64 82 83 05 ff ff e8 e0 64 82 83 05 ff ff ..d.......d.....
22 00 00 00 01 00 00 00 00 00 00 00 00 80 ff ff "...............
backtrace:
[<000000008585a8f7>] slab_post_alloc_hook+0xb8/0x368
[<00000000795eba12>] __kmem_cache_alloc_node+0x174/0x290
[<0000000061886991>] kmalloc_trace+0x40/0x164
[<00000000ee41df9e>] vcap_rule_add_action+0x104/0x178
[<000000001cc1bb38>] test_vcap_xn_rule_creator.constprop.43+0xd8/0x328
[<00000000a29794d8>] vcap_api_rule_remove_at_end_test+0xbc/0xb48
[<00000000548b559e>] kunit_try_run_case+0x50/0xac
[<00000000663f0105>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<00000000e646f120>] kthread+0x124/0x130
[<000000005257599e>] ret_from_fork+0x10/0x20
unreferenced object 0xffff058384973a40 (size 64):
comm "kunit_try_catch", pid 313, jiffies 4294894230 (age 639.880s)
hex dump (first 32 bytes):
80 39 97 84 83 05 ff ff d8 e0 64 82 83 05 ff ff .9........d.....
7d 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 }...............
backtrace:
[<000000008585a8f7>] slab_post_alloc_hook+0xb8/0x368
[<00000000795eba12>] __kmem_cache_alloc_node+0x174/0x290
[<0000000061886991>] kmalloc_trace+0x40/0x164
[<0000000043c78991>] vcap_rule_add_key+0x104/0x180
[<0000000094335477>] vcap_add_type_keyfield+0xbc/0x128
[<000000002b00f7df>] vcap_val_rule+0x274/0x3e8
[<00000000e67d2ff5>] test_vcap_xn_rule_creator.constprop.43+0xf0/0x328
[<00000000a29794d8>] vcap_api_rule_remove_at_end_test+0xbc/0xb48
[<00000000548b559e>] kunit_try_run_case+0x50/0xac
[<00000000663f0105>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<00000000e646f120>] kthread+0x124/0x130
[<000000005257599e>] ret_from_fork+0x10/0x20unreferenced object 0xffff0583832fa240 (size 192):
comm "kunit_try_catch", pid 315, jiffies 4294894233 (age 639.920s) hex dump (first 32 bytes):
10 27 00 00 04 00 00 00 14 00 00 00 90 01 00 00 .'..............
00 00 00 00 00 00 00 00 00 a1 8b 84 83 05 ff ff ................
backtrace:
[<000000008585a8f7>] slab_post_alloc_hook+0xb8/0x368
[<00000000795eba12>] __kmem_cache_alloc_node+0x174/0x290
[<0000000061886991>] kmalloc_trace+0x40/0x164
[<00000000648fefae>] vcap_alloc_rule+0x17c/0x26c
[<000000004da16164>] test_vcap_xn_rule_creator.constprop.43+0xac/0x328
[<00000000be638a45>] vcap_api_rule_remove_in_middle_test+0xc4/0xb80
[<00000000548b559e>] kunit_try_run_case+0x50/0xac
[<00000000663f0105>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<00000000e646f120>] kthread+0x124/0x130
[<000000005257599e>] ret_from_fork+0x10/0x20
unreferenced object 0xffff0583848ba0c0 (size 64):
comm "kunit_try_catch", pid 315, jiffies 4294894233 (age 639.920s)
hex dump (first 32 bytes):
40 a1 8b 84 83 05 ff ff 68 a2 2f 83 83 05 ff ff @.......h./.....
22 00 00 00 01 00 00 00 00 00 00 00 00 80 ff ff "...............
backtrace:
[<000000008585a8f7>] slab_post_alloc_hook+0xb8/0x368
[<00000000795eba12>] __kmem_cache_alloc_node+0x174/0x290
[<0000000061886991>] kmalloc_trace+0x40/0x164
[<00000000ee41df9e>] vcap_rule_add_action+0x104/0x178
[<000000001cc1bb38>] test_vcap_xn_rule_creator.constprop.43+0xd8/0x328
[<00000000be638a45>] vcap_api_rule_remove_in_middle_test+0xc4/0xb80
[<00000000548b559e>] kunit_try_run_case+0x50/0xac
[<00000000663f0105>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<00000000e646f120>] kthread+0x124/0x130
[<000000005257599e>] ret_from_fork+0x10/0x20
unreferenced object 0xffff0583848ba100 (size 64):
comm "kunit_try_catch", pid 315, jiffies 4294894233 (age 639.920s)
hex dump (first 32 bytes):
80 a1 8b 84 83 05 ff ff 58 a2 2f 83 83 05 ff ff ........X./.....
7d 00 00 00 01 00 00 00 02 00 00 00 ff 00 00 00 }...............
backtrace:
[<000000008585a8f7>] slab_post_alloc_hook+0xb8/0x368
[<00000000795eba12>] __kmem_cache_alloc_node+0x174/0x290
[<0000000061886991>] kmalloc_trace+0x40/0x164
[<0000000043c78991>] vcap_rule_add_key+0x104/0x180
[<00000000ba73cfbe>] vcap_add_type_keyfield+0xfc/0x128
[<000000002b00f7df>] vcap_val_rule+0x274/0x3e8
[<00000000e67d2ff5>] test_vcap_xn_rule_creator.constprop.43+0xf0/0x328
[<00000000be638a45>] vcap_api_rule_remove_in_middle_test+0xc4/0xb80
[<00000000548b559e>] kunit_try_run_case+0x50/0xac
[<00000000663f0105>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<00000000e646f120>] kthread+0x124/0x130
[<000000005257599e>] ret_from_fork+0x10/0x20unreferenced object 0xffff0583827d2180 (size 192):
comm "kunit_try_catch", pid 317, jiffies 4294894238 (age 639.956s) hex dump (first 32 bytes):
10 27 00 00 04 00 00 00 14 00 00 00 90 01 00 00 .'..............
00 00 00 00 00 00 00 00 00 e1 06 83 83 05 ff ff ................
backtrace:
[<000000008585a8f7>] slab_post_alloc_hook+0xb8/0x368
[<00000000795eba12>] __kmem_cache_alloc_node+0x174/0x290
[<0000000061886991>] kmalloc_trace+0x40/0x164
[<00000000648fefae>] vcap_alloc_rule+0x17c/0x26c
[<000000004da16164>] test_vcap_xn_rule_creator.constprop.43+0xac/0x328
[<00000000e1ed8350>] vcap_api_rule_remove_in_front_test+0x144/0x6c0
[<00000000548b559e>] kunit_try_run_case+0x50/0xac
[<00000000663f0105>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<00000000e646f120>] kthread+0x124/0x130
[<000000005257599e>] ret_from_fork+0x10/0x20
unreferenced object 0xffff05838306e0c0 (size 64):
comm "kunit_try_catch", pid 317, jiffies 4294894238 (age 639.956s)
hex dump (first 32 bytes):
40 e1 06 83 83 05 ff ff a8 21 7d 82 83 05 ff ff @........!}.....
22 00 00 00 01 00 00 00 00 00 00 00 00 80 ff ff "...............
backtrace:
[<000000008585a8f7>] slab_post_alloc_hook+0xb8/0x368
[<00000000795eba12>] __kmem_cache_alloc_node+0x174/0x290
[<0000000061886991>] kmalloc_trace+0x40/0x164
[<00000000ee41df9e>] vcap_rule_add_action+0x104/0x178
[<000000001cc1bb38>] test_vcap_xn_rule_creator.constprop.43+0xd8/0x328
[<00000000e1ed8350>] vcap_api_rule_remove_in_front_test+0x144/0x6c0
[<00000000548b559e>] kunit_try_run_case+0x50/0xac
[<00000000663f0105>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<00000000e646f120>] kthread+0x124/0x130
[<000000005257599e>] ret_from_fork+0x10/0x20
unreferenced object 0xffff05838306e180 (size 64):
comm "kunit_try_catch", pid 317, jiffies 4294894238 (age 639.968s)
hex dump (first 32 bytes):
98 21 7d 82 83 05 ff ff 00 e1 06 83 83 05 ff ff .!}.............
67 00 00 00 00 00 00 00 01 01 00 00 ff 00 00 00 g...............
backtrace:
[<000000008585a8f7>] slab_post_alloc_hook+0xb8/0x368
[<00000000795eba12>] __kmem_cache_alloc_node+0x174/0x290
[<0000000061886991>] kmalloc_trace+0x40/0x164
[<0000000043c78991>] vcap_rule_add_key+0x104/0x180
[<000000006ce4945d>] test_add_def_fields+0x84/0x8c
[<00000000507e0ab6>] vcap_val_rule+0x294/0x3e8
[<00000000e67d2ff5>] test_vcap_xn_rule_creator.constprop.43+0xf0/0x328
[<00000000e1ed8350>] vcap_api_rule_remove_in_front_test+0x144/0x6c0
[<00000000548b559e>] kunit_try_run_case+0x50/0xac
[<00000000663f0105>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<00000000e646f120>] kthread+0x124/0x130
[<000000005257599e>] ret_from_fork+0x10/0x20--- drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c +4 -5
@@ -243,10 +243,9 @@ static void vcap_test_api_init(struct vcap_admin *admin) }/* Helper function to create a rule of a specific size */ -static struct vcap_rule * -test_vcap_xn_rule_creator (struct kunit *test,int cid,enum vcap_user user, -u16 priority, -int id,int size,int expected_addr) +static void test_vcap_xn_rule_creator (struct kunit *test,int cid, +enum vcap_user user,u16 priority, +int id,int size,int expected_addr) {struct vcap_rule *rule;struct vcap_rule_internal *ri;
@@ -311,7 +310,7 @@ test_vcap_xn_rule_creator(struct kunit *test, int cid, enum vcap_user user, ret =vcap_add_rule (rule);KUNIT_EXPECT_EQ (test,0 , ret);KUNIT_EXPECT_EQ (test, expected_addr, ri->addr); -return rule; +vcap_free_rule (rule); }/* Prepare testing rule deletion */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 51/321 net: microchip: sparx5: Fix possible memory leaks in vcap_api_kunit
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 2a2dffd911d4139258b828b9c5056cb64b826758 ]
Inject fault while probing kunit-example-test.ko, the duprule which is allocated by kzalloc in vcap_dup_rule() of test_vcap_xn_rule_creator() is not freed, and it cause the memory leaks below. Use vcap_del_rule() to free them as other functions do it.
unreferenced object 0xffff6eb4846f6180 (size 192):
comm "kunit_try_catch", pid 405, jiffies 4294895522 (age 880.004s) hex dump (first 32 bytes):
10 27 00 00 04 00 00 00 0a 00 00 00 f4 01 00 00 .'..............
00 00 00 00 00 00 00 00 98 61 6f 84 b4 6e ff ff .........ao..n..
backtrace:
[<00000000f1b5b86e>] slab_post_alloc_hook+0xb8/0x368
[<00000000c56cdd9a>] __kmem_cache_alloc_node+0x174/0x290
[<0000000046ef1b64>] kmalloc_trace+0x40/0x164
[<000000008565145b>] vcap_dup_rule+0x38/0x210
[<00000000bd9e1f12>] vcap_add_rule+0x29c/0x32c
[<0000000070a539b1>] test_vcap_xn_rule_creator.constprop.43+0x120/0x330
[<00000000d2ac4ccb>] vcap_api_rule_insert_in_order_test+0xa4/0x114
[<000000000f88f9cb>] kunit_try_run_case+0x50/0xac
[<00000000e848de5a>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<0000000058a88b6b>] kthread+0x124/0x130
[<00000000891cf28a>] ret_from_fork+0x10/0x20
unreferenced object 0xffff6eb4846f6240 (size 192):
comm "kunit_try_catch", pid 405, jiffies 4294895524 (age 879.996s)
hex dump (first 32 bytes):
10 27 00 00 04 00 00 00 14 00 00 00 90 01 00 00 .'..............
00 00 00 00 00 00 00 00 58 62 6f 84 b4 6e ff ff ........Xbo..n..
backtrace:
[<00000000f1b5b86e>] slab_post_alloc_hook+0xb8/0x368
[<00000000c56cdd9a>] __kmem_cache_alloc_node+0x174/0x290
[<0000000046ef1b64>] kmalloc_trace+0x40/0x164
[<000000008565145b>] vcap_dup_rule+0x38/0x210
[<00000000bd9e1f12>] vcap_add_rule+0x29c/0x32c
[<0000000070a539b1>] test_vcap_xn_rule_creator.constprop.43+0x120/0x330
[<0000000052e6ad35>] vcap_api_rule_insert_in_order_test+0xbc/0x114
[<000000000f88f9cb>] kunit_try_run_case+0x50/0xac
[<00000000e848de5a>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<0000000058a88b6b>] kthread+0x124/0x130
[<00000000891cf28a>] ret_from_fork+0x10/0x20
unreferenced object 0xffff6eb4846f6300 (size 192):
comm "kunit_try_catch", pid 405, jiffies 4294895524 (age 879.996s)
hex dump (first 32 bytes):
10 27 00 00 04 00 00 00 1e 00 00 00 2c 01 00 00 .'..........,...
00 00 00 00 00 00 00 00 18 63 6f 84 b4 6e ff ff .........co..n..
backtrace:
[<00000000f1b5b86e>] slab_post_alloc_hook+0xb8/0x368
[<00000000c56cdd9a>] __kmem_cache_alloc_node+0x174/0x290
[<0000000046ef1b64>] kmalloc_trace+0x40/0x164
[<000000008565145b>] vcap_dup_rule+0x38/0x210
[<00000000bd9e1f12>] vcap_add_rule+0x29c/0x32c
[<0000000070a539b1>] test_vcap_xn_rule_creator.constprop.43+0x120/0x330
[<000000001b0895d4>] vcap_api_rule_insert_in_order_test+0xd4/0x114
[<000000000f88f9cb>] kunit_try_run_case+0x50/0xac
[<00000000e848de5a>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<0000000058a88b6b>] kthread+0x124/0x130
[<00000000891cf28a>] ret_from_fork+0x10/0x20
unreferenced object 0xffff6eb4846f63c0 (size 192):
comm "kunit_try_catch", pid 405, jiffies 4294895524 (age 880.012s)
hex dump (first 32 bytes):
10 27 00 00 04 00 00 00 28 00 00 00 c8 00 00 00 .'......(.......
00 00 00 00 00 00 00 00 d8 63 6f 84 b4 6e ff ff .........co..n..
backtrace:
[<00000000f1b5b86e>] slab_post_alloc_hook+0xb8/0x368
[<00000000c56cdd9a>] __kmem_cache_alloc_node+0x174/0x290
[<0000000046ef1b64>] kmalloc_trace+0x40/0x164
[<000000008565145b>] vcap_dup_rule+0x38/0x210
[<00000000bd9e1f12>] vcap_add_rule+0x29c/0x32c
[<0000000070a539b1>] test_vcap_xn_rule_creator.constprop.43+0x120/0x330
[<00000000134c151f>] vcap_api_rule_insert_in_order_test+0xec/0x114
[<000000000f88f9cb>] kunit_try_run_case+0x50/0xac
[<00000000e848de5a>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<0000000058a88b6b>] kthread+0x124/0x130
[<00000000891cf28a>] ret_from_fork+0x10/0x20
unreferenced object 0xffff6eb4845fc180 (size 192):
comm "kunit_try_catch", pid 407, jiffies 4294895527 (age 880.000s)
hex dump (first 32 bytes):
10 27 00 00 04 00 00 00 14 00 00 00 c8 00 00 00 .'..............
00 00 00 00 00 00 00 00 98 c1 5f 84 b4 6e ff ff .........._..n..
backtrace:
[<00000000f1b5b86e>] slab_post_alloc_hook+0xb8/0x368
[<00000000c56cdd9a>] __kmem_cache_alloc_node+0x174/0x290
[<0000000046ef1b64>] kmalloc_trace+0x40/0x164
[<000000008565145b>] vcap_dup_rule+0x38/0x210
[<00000000bd9e1f12>] vcap_add_rule+0x29c/0x32c
[<0000000070a539b1>] test_vcap_xn_rule_creator.constprop.43+0x120/0x330
[<00000000fa5f64d3>] vcap_api_rule_insert_reverse_order_test+0xc8/0x600
[<000000000f88f9cb>] kunit_try_run_case+0x50/0xac
[<00000000e848de5a>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<0000000058a88b6b>] kthread+0x124/0x130
[<00000000891cf28a>] ret_from_fork+0x10/0x20
unreferenced object 0xffff6eb4845fc240 (size 192):
comm "kunit_try_catch", pid 407, jiffies 4294895527 (age 880.000s)
hex dump (first 32 bytes):
10 27 00 00 04 00 00 00 1e 00 00 00 2c 01 00 00 .'..........,...
00 00 00 00 00 00 00 00 58 c2 5f 84 b4 6e ff ff ........X._..n..
backtrace:
[<00000000f1b5b86e>] slab_post_alloc_hook+0xb8/0x368
[<00000000c56cdd9a>] __kmem_cache_alloc_node+0x174/0x290
[<0000000046ef1b64>] kmalloc_trace+0x40/0x164
[<000000008565145b>] vcap_dup_rule+0x38/0x210
[<00000000453dcd80>] vcap_add_rule+0x134/0x32c
[<0000000070a539b1>] test_vcap_xn_rule_creator.constprop.43+0x120/0x330
[<00000000a7db42de>] vcap_api_rule_insert_reverse_order_test+0x108/0x600
[<000000000f88f9cb>] kunit_try_run_case+0x50/0xac
[<00000000e848de5a>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<0000000058a88b6b>] kthread+0x124/0x130
[<00000000891cf28a>] ret_from_fork+0x10/0x20
unreferenced object 0xffff6eb4845fc300 (size 192):
comm "kunit_try_catch", pid 407, jiffies 4294895527 (age 880.000s)
hex dump (first 32 bytes):
10 27 00 00 04 00 00 00 28 00 00 00 90 01 00 00 .'......(.......
00 00 00 00 00 00 00 00 18 c3 5f 84 b4 6e ff ff .........._..n..
backtrace:
[<00000000f1b5b86e>] slab_post_alloc_hook+0xb8/0x368
[<00000000c56cdd9a>] __kmem_cache_alloc_node+0x174/0x290
[<0000000046ef1b64>] kmalloc_trace+0x40/0x164
[<000000008565145b>] vcap_dup_rule+0x38/0x210
[<00000000453dcd80>] vcap_add_rule+0x134/0x32c
[<0000000070a539b1>] test_vcap_xn_rule_creator.constprop.43+0x120/0x330
[<00000000ea416c94>] vcap_api_rule_insert_reverse_order_test+0x150/0x600
[<000000000f88f9cb>] kunit_try_run_case+0x50/0xac
[<00000000e848de5a>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<0000000058a88b6b>] kthread+0x124/0x130
[<00000000891cf28a>] ret_from_fork+0x10/0x20
unreferenced object 0xffff6eb4845fc3c0 (size 192):
comm "kunit_try_catch", pid 407, jiffies 4294895527 (age 880.020s)
hex dump (first 32 bytes):
10 27 00 00 04 00 00 00 32 00 00 00 f4 01 00 00 .'......2.......
00 00 00 00 00 00 00 00 d8 c3 5f 84 b4 6e ff ff .........._..n..
backtrace:
[<00000000f1b5b86e>] slab_post_alloc_hook+0xb8/0x368
[<00000000c56cdd9a>] __kmem_cache_alloc_node+0x174/0x290
[<0000000046ef1b64>] kmalloc_trace+0x40/0x164
[<000000008565145b>] vcap_dup_rule+0x38/0x210
[<00000000453dcd80>] vcap_add_rule+0x134/0x32c
[<0000000070a539b1>] test_vcap_xn_rule_creator.constprop.43+0x120/0x330
[<00000000764a39b4>] vcap_api_rule_insert_reverse_order_test+0x198/0x600
[<000000000f88f9cb>] kunit_try_run_case+0x50/0xac
[<00000000e848de5a>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<0000000058a88b6b>] kthread+0x124/0x130
[<00000000891cf28a>] ret_from_fork+0x10/0x20
unreferenced object 0xffff6eb484cd4240 (size 192):
comm "kunit_try_catch", pid 413, jiffies 4294895543 (age 879.956s)
hex dump (first 32 bytes):
10 27 00 00 04 00 00 00 1e 00 00 00 2c 01 00 00 .'..........,...
00 00 00 00 00 00 00 00 58 42 cd 84 b4 6e ff ff ........XB...n..
backtrace:
[<00000000f1b5b86e>] slab_post_alloc_hook+0xb8/0x368
[<00000000c56cdd9a>] __kmem_cache_alloc_node+0x174/0x290
[<0000000046ef1b64>] kmalloc_trace+0x40/0x164
[<000000008565145b>] vcap_dup_rule+0x38/0x210
[<00000000bd9e1f12>] vcap_add_rule+0x29c/0x32c
[<0000000070a539b1>] test_vcap_xn_rule_creator.constprop.43+0x120/0x330
[<0000000023976dd4>] vcap_api_rule_remove_in_front_test+0x158/0x658
[<000000000f88f9cb>] kunit_try_run_case+0x50/0xac
[<00000000e848de5a>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<0000000058a88b6b>] kthread+0x124/0x130
[<00000000891cf28a>] ret_from_fork+0x10/0x20
unreferenced object 0xffff6eb484cd4300 (size 192):
comm "kunit_try_catch", pid 413, jiffies 4294895543 (age 879.956s)
hex dump (first 32 bytes):
10 27 00 00 04 00 00 00 28 00 00 00 c8 00 00 00 .'......(.......
00 00 00 00 00 00 00 00 18 43 cd 84 b4 6e ff ff .........C...n..
backtrace:
[<00000000f1b5b86e>] slab_post_alloc_hook+0xb8/0x368
[<00000000c56cdd9a>] __kmem_cache_alloc_node+0x174/0x290
[<0000000046ef1b64>] kmalloc_trace+0x40/0x164
[<000000008565145b>] vcap_dup_rule+0x38/0x210
[<00000000bd9e1f12>] vcap_add_rule+0x29c/0x32c
[<0000000070a539b1>] test_vcap_xn_rule_creator.constprop.43+0x120/0x330
[<000000000b4760ff>] vcap_api_rule_remove_in_front_test+0x170/0x658
[<000000000f88f9cb>] kunit_try_run_case+0x50/0xac
[<00000000e848de5a>] kunit_generic_run_threadfn_adapter+0x20/0x2c
[<0000000058a88b6b>] kthread+0x124/0x130
[<00000000891cf28a>] ret_from_fork+0x10/0x20--- .../net/ethernet/microchip/vcap/vcap_api_kunit.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c +13 -0
@@ -1597,6 +1597,11 @@ static void vcap_api_rule_insert_in_order_test(struct kunit *test)test_vcap_xn_rule_creator (test,10000 ,VCAP_USER_QOS ,20 ,400 ,6 ,774 );test_vcap_xn_rule_creator (test,10000 ,VCAP_USER_QOS ,30 ,300 ,3 ,771 );test_vcap_xn_rule_creator (test,10000 ,VCAP_USER_QOS ,40 ,200 ,2 ,768 ); + +vcap_del_rule (&test_vctrl, &test_netdev,200 ); +vcap_del_rule (&test_vctrl, &test_netdev,300 ); +vcap_del_rule (&test_vctrl, &test_netdev,400 ); +vcap_del_rule (&test_vctrl, &test_netdev,500 ); }static void vcap_api_rule_insert_reverse_order_test (struct kunit *test)
@@ -1655,6 +1660,11 @@ static void vcap_api_rule_insert_reverse_order_test(struct kunit *test) ++idx; }KUNIT_EXPECT_EQ (test,768 , admin.last_used_addr); + +vcap_del_rule (&test_vctrl, &test_netdev,500 ); +vcap_del_rule (&test_vctrl, &test_netdev,400 ); +vcap_del_rule (&test_vctrl, &test_netdev,300 ); +vcap_del_rule (&test_vctrl, &test_netdev,200 ); }static void vcap_api_rule_remove_at_end_test (struct kunit *test)
@@ -1855,6 +1865,9 @@ static void vcap_api_rule_remove_in_front_test(struct kunit *test)KUNIT_EXPECT_EQ (test,786 , test_init_start);KUNIT_EXPECT_EQ (test,8 , test_init_count);KUNIT_EXPECT_EQ (test,794 , admin.last_used_addr); + +vcap_del_rule (&test_vctrl, &test_netdev,200 ); +vcap_del_rule (&test_vctrl, &test_netdev,300 ); }static struct kunit_case vcap_api_rule_remove_test_cases[] = {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 52/321 selftests: tls: swap the TX and RX sockets in some tests
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit c326ca98446e0ae4fee43a40acf79412b74cfedb ]
tls.sendmsg_large and tls.sendmsg_multiple are trying to send through the self->cfd socket (only configured with TLS_RX) and to receive through the self->fd socket (only configured with TLS_TX), so they're not using kTLS at all. Swap the sockets.
--- tools/testing/selftests/net/tls.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
tools/testing/selftests/net/tls.c +4 -4
@@ -552,11 +552,11 @@ TEST_F(tls, sendmsg_large) msg.msg_iov = &vec; msg.msg_iovlen =1 ; -EXPECT_EQ (sendmsg (self->cfd, &msg,0 ), send_len); +EXPECT_EQ (sendmsg (self->fd, &msg,0 ), send_len); }while (recvs++ < sends) { -EXPECT_NE (recv (self->fd, mem, send_len,0 ),-1 ); +EXPECT_NE (recv (self->cfd, mem, send_len,0 ),-1 ); }free (mem);
@@ -585,9 +585,9 @@ TEST_F(tls, sendmsg_multiple) msg.msg_iov = vec; msg.msg_iovlen = iov_len; -EXPECT_EQ (sendmsg (self->cfd, &msg,0 ), total_len); +EXPECT_EQ (sendmsg (self->fd, &msg,0 ), total_len); buf =malloc (total_len); -EXPECT_NE (recv (self->fd, buf, total_len,0 ),-1 ); +EXPECT_NE (recv (self->cfd, buf, total_len,0 ),-1 );for (i =0 ; i < iov_len; i++) { EXPECT_EQ(memcmp(test_strs[i], buf + len_cmp, strlen(test_strs[i])),
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 53/321 net/core: Fix ETH_P_1588 flow dissector
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sasha Neftin <[email protected]>
[ Upstream commit 75ad80ed88a182ab2ad5513e448cf07b403af5c3 ]
When a PTP ethernet raw frame with a size of more than 256 bytes followed by a 0xff pattern is sent to __skb_flow_dissect, nhoff value calculation is wrong. For example: hdr->message_length takes the wrong value (0xffff) and it does not replicate real header length. In this case, 'nhoff' value was overridden and the PTP header was badly dissected. This leads to a kernel crash.
net/core: flow_dissector
net/core flow dissector nhoff = 0x0000000e net/core flow dissector hdr->message_length = 0x0000ffff net/core flow dissector nhoff = 0x0001000d (u16 overflow)
...
skb linear: 00000000: 00 a0 c9 00 00 00 00 a0 c9 00 00 00 88 skb frag: 00000000: f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
Using the size of the ptp_header struct will allow the corrected calculation of the nhoff value.
net/core flow dissector nhoff = 0x0000000e
net/core flow dissector nhoff = 0x00000030 (sizeof ptp_header)
...
skb linear: 00000000: 00 a0 c9 00 00 00 00 a0 c9 00 00 00 88 f7 ff ff skb linear: 00000010: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff skb linear: 00000020: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff skb frag: 00000000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
Kernel trace:
[ 74.984279] ------------[ cut here ]------------ [ 74.989471] kernel BUG at include/linux/skbuff.h:2440! [ 74.995237] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 75.001098] CPU: 4 PID: 0 Comm: swapper/4 Tainted: G U 5.15.85-intel-ese-standard-lts #1 [ 75.011629] Hardware name: Intel Corporation A-Island (CPU:AlderLake)/A-Island (ID:06), BIOS SB_ADLP.01.01.00.01.03.008.D-6A9D9E73-dirty Mar 30 2023 [ 75.026507] RIP: 0010:eth_type_trans+0xd0/0x130 [ 75.031594] Code: 03 88 47 78 eb c7 8b 47 68 2b 47 6c 48 8b 97 c0 00 00 00 83 f8 01 7e 1b 48 85 d2 74 06 66 83 3a ff 74 09 b8 00 04 00 00 eb ab <0f> 0b b8 00 01 00 00 eb a2 48 85 ff 74 eb 48 8d 54 24 06 31 f6 b9 [ 75.052612] RSP: 0018:ffff9948c0228de0 EFLAGS: 00010297 [ 75.058473] RAX: 00000000000003f2 RBX: ffff8e47047dc300 RCX: 0000000000001003 [ 75.066462] RDX: ffff8e4e8c9ea040 RSI: ffff8e4704e0a000 RDI: ffff8e47047dc300 [ 75.074458] RBP: ffff8e4704e2acc0 R08: 00000000000003f3 R09: 0000000000000800 [ 75.082466] R10: 000000000000000d R11: ffff9948c0228dec R12: ffff8e4715e4e010 [ 75.090461] R13: ffff9948c0545018 R14: 0000000000000001 R15: 0000000000000800 [ 75.098464] FS: 0000000000000000(0000) GS:ffff8e4e8fb00000(0000) knlGS:0000000000000000 [ 75.107530] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 75.113982] CR2: 00007f5eb35934a0 CR3: 0000000150e0a002 CR4: 0000000000770ee0 [ 75.121980] PKRU: 55555554 [ 75.125035] Call Trace: [ 75.127792] <IRQ> [ 75.130063] ? eth_get_headlen+0xa4/0xc0 [ 75.134472] igc_process_skb_fields+0xcd/0x150 [ 75.139461] igc_poll+0xc80/0x17b0 [ 75.143272] __napi_poll+0x27/0x170 [ 75.147192] net_rx_action+0x234/0x280 [ 75.151409] __do_softirq+0xef/0x2f4 [ 75.155424] irq_exit_rcu+0xc7/0x110 [ 75.159432] common_interrupt+0xb8/0xd0 [ 75.163748] </IRQ> [ 75.166112] <TASK> [ 75.168473] asm_common_interrupt+0x22/0x40 [ 75.173175] RIP: 0010:cpuidle_enter_state+0xe2/0x350 [ 75.178749] Code: 85 c0 0f 8f 04 02 00 00 31 ff e8 39 6c 67 ff 45 84 ff 74 12 9c 58 f6 c4 02 0f 85 50 02 00 00 31 ff e8 52 b0 6d ff fb 45 85 f6 <0f> 88 b1 00 00 00 49 63 ce 4c 2b 2c 24 48 89 c8 48 6b d1 68 48 c1 [ 75.199757] RSP: 0018:ffff9948c013bea8 EFLAGS: 00000202 [ 75.205614] RAX: ffff8e4e8fb00000 RBX: ffffb948bfd23900 RCX: 000000000000001f [ 75.213619] RDX: 0000000000000004 RSI: ffffffff94206161 RDI: ffffffff94212e20 [ 75.221620] RBP: 0000000000000004 R08: 000000117568973a R09: 0000000000000001 [ 75.229622] R10: 000000000000afc8 R11: ffff8e4e8fb29ce4 R12: ffffffff945ae980 [ 75.237628] R13: 000000117568973a R14: 0000000000000004 R15: 0000000000000000 [ 75.245635] ? cpuidle_enter_state+0xc7/0x350 [ 75.250518] cpuidle_enter+0x29/0x40 [ 75.254539] do_idle+0x1d9/0x260 [ 75.258166] cpu_startup_entry+0x19/0x20 [ 75.262582] secondary_startup_64_no_verify+0xc2/0xcb [ 75.268259] </TASK> [ 75.270721] Modules linked in: 8021q snd_sof_pci_intel_tgl snd_sof_intel_hda_common tpm_crb snd_soc_hdac_hda snd_sof_intel_hda snd_hda_ext_core snd_sof_pci snd_sof snd_sof_xtensa_dsp snd_soc_acpi_intel_match snd_soc_acpi snd_soc_core snd_compress iTCO_wdt ac97_bus intel_pmc_bxt mei_hdcp iTCO_vendor_support snd_hda_codec_hdmi pmt_telemetry intel_pmc_core pmt_class snd_hda_intel x86_pkg_temp_thermal snd_intel_dspcfg snd_hda_codec snd_hda_core kvm_intel snd_pcm snd_timer kvm snd mei_me soundcore tpm_tis irqbypass i2c_i801 mei tpm_tis_core pcspkr intel_rapl_msr tpm i2c_smbus intel_pmt thermal sch_fq_codel uio uhid i915 drm_buddy video drm_display_helper drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm fuse configfs [ 75.342736] ---[ end trace 3785f9f360400e3a ]--- [ 75.347913] RIP: 0010:eth_type_trans+0xd0/0x130 [ 75.352984] Code: 03 88 47 78 eb c7 8b 47 68 2b 47 6c 48 8b 97 c0 00 00 00 83 f8 01 7e 1b 48 85 d2 74 06 66 83 3a ff 74 09 b8 00 04 00 00 eb ab <0f> 0b b8 00 01 00 00 eb a2 48 85 ff 74 eb 48 8d 54 24 06 31 f6 b9 [ 75.373994] RSP: 0018:ffff9948c0228de0 EFLAGS: 00010297 [ 75.379860] RAX: 00000000000003f2 RBX: ffff8e47047dc300 RCX: 0000000000001003 [ 75.387856] RDX: ffff8e4e8c9ea040 RSI: ffff8e4704e0a000 RDI: ffff8e47047dc300 [ 75.395864] RBP: ffff8e4704e2acc0 R08: 00000000000003f3 R09: 0000000000000800 [ 75.403857] R10: 000000000000000d R11: ffff9948c0228dec R12: ffff8e4715e4e010 [ 75.411863] R13: ffff9948c0545018 R14: 0000000000000001 R15: 0000000000000800 [ 75.419875] FS: 0000000000000000(0000) GS:ffff8e4e8fb00000(0000) knlGS:0000000000000000 [ 75.428946] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 75.435403] CR2: 00007f5eb35934a0 CR3: 0000000150e0a002 CR4: 0000000000770ee0 [ 75.443410] PKRU: 55555554 [ 75.446477] Kernel panic - not syncing: Fatal exception in interrupt [ 75.453738] Kernel Offset: 0x11c00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 75.465794] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
--- net/core/flow_dissector.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/core/flow_dissector.c +1 -1
@@ -1402,7 +1402,7 @@ bool __skb_flow_dissect(const struct net *net,break ; } - nhoff +=ntohs (hdr->message_length); + nhoff +=sizeof (struct ptp_header ); fdret =FLOW_DISSECT_RET_OUT_GOOD ;break ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 54/321 ALSA: seq: ump: Fix -Wformat-truncation warning
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 0d42260867f9ff3e3a5bcfa8750fa06a658e0b1c ]
The filling of a port name string got a warning with W=1 due to the potentially too long group name. Add the string precision to limit the size.
--- sound/core/seq/seq_ump_client.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/core/seq/seq_ump_client.c +1 -1
@@ -207,7 +207,7 @@ static void fill_port_info(struct snd_seq_port_info *port,SNDRV_SEQ_PORT_TYPE_PORT ; port->midi_channels =16 ;if (*group->name) -snprintf (port->name,sizeof (port->name),"Group %d (%s)" , +snprintf (port->name,sizeof (port->name),"Group %d (%.53s)" , group->group +1 , group->name);else sprintf (port->name,"Group %d" , group->group +1 );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 55/321 ASoC: hdaudio.c: Add missing check for devm_kstrdup
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <[email protected]>
[ Upstream commit c04efbfd76d23157e64e6d6147518c187ab4233a ]
Because of the potential failure of the devm_kstrdup(), the dl[i].codecs->name could be NULL.
Therefore, we need to check it and return -ENOMEM in order to transfer the error.
--- sound/soc/intel/avs/boards/hdaudio.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/intel/avs/boards/hdaudio.c +3 -0
@@ -55,6 +55,9 @@ static int avs_create_dai_links(struct device *dev, struct hda_codec *codec, intreturn -ENOMEM ; dl[i].codecs->name =devm_kstrdup (dev, cname,GFP_KERNEL ); +if (!dl[i].codecs->name) +return -ENOMEM ; + dl[i].codecs->dai_name = pcm->name; dl[i].num_codecs =1 ; dl[i].num_cpus =1 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 56/321 ASoC: imx-audmix: Fix return error with devm_clk_get()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <[email protected]>
[ Upstream commit b19a5733de255cabba5feecabf6e900638b582d1 ]
The devm_clk_get() can return -EPROBE_DEFER error, modify the error code to be -EINVAL is not correct, which cause the -EPROBE_DEFER error is not correctly handled.
This patch is to fix the return error code.
--- sound/soc/fsl/imx-audmix.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/fsl/imx-audmix.c +1 -1
@@ -315,7 +315,7 @@ static int imx_audmix_probe(struct platform_device *pdev)if (IS_ERR (priv->cpu_mclk)) { ret =PTR_ERR (priv->cpu_mclk);dev_err (&cpu_pdev->dev,"failed to get DAI mclk1: %d\n" , ret); -return -EINVAL ; +return ret; } priv->audmix_pdev = audmix_pdev;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 57/321 octeon_ep: fix tx dma unmap len values in SG
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shinas Rasheed <[email protected]>
[ Upstream commit 350db8a59eb392bf42e62b6b2a37d56b5833012b ]
Lengths of SG pointers are kept in the following order in the SG entries in hardware.
63 48|47 32|31 16|15 0
-----------------------------------------
| Len 0 | Len 1 | Len 2 | Len 3 |
-----------------------------------------
| Ptr 0 |
-----------------------------------------
| Ptr 1 |
-----------------------------------------
| Ptr 2 |
-----------------------------------------
| Ptr 3 |
-----------------------------------------
Dma pointers have to be unmapped based on their respective lengths given in this format.
--- .../net/ethernet/marvell/octeon_ep/octep_main.c | 8 ++++---- .../net/ethernet/marvell/octeon_ep/octep_tx.c | 8 ++++---- .../net/ethernet/marvell/octeon_ep/octep_tx.h | 16 +++++++++++++++- 3 files changed, 23 insertions(+), 9 deletions(-)
drivers/net/ethernet/marvell/octeon_ep/octep_main.c +4 -4
@@ -734,13 +734,13 @@ static netdev_tx_t octep_start_xmit(struct sk_buff *skb, dma_map_sg_err:if (si >0 ) {dma_unmap_single (iq->dev, sglist[0 ].dma_ptr[0 ], - sglist[0 ].len[0 ],DMA_TO_DEVICE ); - sglist[0 ].len[0 ] =0 ; + sglist[0 ].len[3 ],DMA_TO_DEVICE ); + sglist[0 ].len[3 ] =0 ; }while (si >1 ) {dma_unmap_page (iq->dev, sglist[si >>2 ].dma_ptr[si &3 ], - sglist[si >>2 ].len[si &3 ],DMA_TO_DEVICE ); - sglist[si >>2 ].len[si &3 ] =0 ; + sglist[si >>2 ].len[3 - (si &3 )],DMA_TO_DEVICE ); + sglist[si >>2 ].len[3 - (si &3 )] =0 ; si--; } tx_buffer->gather =0 ;
drivers/net/ethernet/marvell/octeon_ep/octep_tx.c +4 -4
@@ -69,12 +69,12 @@ int octep_iq_process_completions(struct octep_iq *iq, u16 budget) compl_sg++;dma_unmap_single (iq->dev, tx_buffer->sglist[0 ].dma_ptr[0 ], - tx_buffer->sglist[0 ].len[0 ],DMA_TO_DEVICE ); + tx_buffer->sglist[0 ].len[3 ],DMA_TO_DEVICE ); i =1 ;/* entry 0 is main skb, unmapped above */ while (frags--) {dma_unmap_page (iq->dev, tx_buffer->sglist[i >>2 ].dma_ptr[i &3 ], - tx_buffer->sglist[i >>2 ].len[i &3 ],DMA_TO_DEVICE ); + tx_buffer->sglist[i >>2 ].len[3 - (i &3 )],DMA_TO_DEVICE ); i++; }
@@ -131,13 +131,13 @@ static void octep_iq_free_pending(struct octep_iq *iq)dma_unmap_single (iq->dev, tx_buffer->sglist[0 ].dma_ptr[0 ], - tx_buffer->sglist[0 ].len[0 ], + tx_buffer->sglist[0 ].len[3 ],DMA_TO_DEVICE ); i =1 ;/* entry 0 is main skb, unmapped above */ while (frags--) {dma_unmap_page (iq->dev, tx_buffer->sglist[i >>2 ].dma_ptr[i &3 ], - tx_buffer->sglist[i >>2 ].len[i &3 ],DMA_TO_DEVICE ); + tx_buffer->sglist[i >>2 ].len[3 - (i &3 )],DMA_TO_DEVICE ); i++; }
drivers/net/ethernet/marvell/octeon_ep/octep_tx.h +15 -1
@@ -17,7 +17,21 @@#define TX_BUFTYPE_NET_SG 2#define NUM_TX_BUFTYPES 3 -/* Hardware format for Scatter/Gather list */ +/* Hardware format for Scatter/Gather list +* +* 63 48|47 32|31 16|15 0 +* ----------------------------------------- +* | Len 0 | Len 1 | Len 2 | Len 3 | +* ----------------------------------------- +* | Ptr 0 | +* ----------------------------------------- +* | Ptr 1 | +* ----------------------------------------- +* | Ptr 2 | +* ----------------------------------------- +* | Ptr 3 | +* ----------------------------------------- +*/ struct octep_tx_sglist_desc {u16 len[4 ];dma_addr_t dma_ptr[4 ];
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 58/321 iavf: do not process adminq tasks when __IAVF_IN_REMOVE_TASK is set
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Radoslaw Tyl <[email protected]>
[ Upstream commit c8de44b577eb540e8bfea55afe1d0904bb571b7a ]
Prevent schedule operations for adminq during device remove and when __IAVF_IN_REMOVE_TASK flag is set. Currently, the iavf_down function adds operations for adminq that shouldn't be processed when the device is in the __IAVF_REMOVE state.
Reproduction:
echo 4 > /sys/bus/pci/devices/0000:17:00.0/sriov_numvfs ip link set dev ens1f0 vf 0 trust on
ip link set dev ens1f0 vf 1 trust on
ip link set dev ens1f0 vf 2 trust on
ip link set dev ens1f0 vf 3 trust on
ip link set dev ens1f0 vf 0 mac 00:22:33:44:55:66
ip link set dev ens1f0 vf 1 mac 00:22:33:44:55:67
ip link set dev ens1f0 vf 2 mac 00:22:33:44:55:68
ip link set dev ens1f0 vf 3 mac 00:22:33:44:55:69
echo 0000:17:02.0 > /sys/bus/pci/devices/0000\:17\:02.0/driver/unbind echo 0000:17:02.1 > /sys/bus/pci/devices/0000\:17\:02.1/driver/unbind echo 0000:17:02.2 > /sys/bus/pci/devices/0000\:17\:02.2/driver/unbind echo 0000:17:02.3 > /sys/bus/pci/devices/0000\:17\:02.3/driver/unbind sleep 10
echo 0000:17:02.0 > /sys/bus/pci/drivers/iavf/bind
echo 0000:17:02.1 > /sys/bus/pci/drivers/iavf/bind
echo 0000:17:02.2 > /sys/bus/pci/drivers/iavf/bind
echo 0000:17:02.3 > /sys/bus/pci/drivers/iavf/bind
modprobe vfio-pci
echo 8086 154c > /sys/bus/pci/drivers/vfio-pci/new_id
qemu-system-x86_64 -accel kvm -m 4096 -cpu host \
-drive file=centos9.qcow2,if=none,id=virtio-disk0 \
-device virtio-blk-pci,drive=virtio-disk0,bootindex=0 -smp 4 \
-device vfio-pci,host=17:02.0 -net none \
-device vfio-pci,host=17:02.1 -net none \
-device vfio-pci,host=17:02.2 -net none \
-device vfio-pci,host=17:02.3 -net none \
-daemonize -vnc :5
Current result:
There is a probability that the mac of VF in guest is inconsistent with it in host
Expected result:
When passthrough NIC VF to guest, the VF in guest should always get the same mac as it in host.
--- drivers/net/ethernet/intel/iavf/iavf_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/iavf/iavf_main.c +2 -1
@@ -1421,7 +1421,8 @@ void iavf_down(struct iavf_adapter *adapter)iavf_clear_fdir_filters (adapter);iavf_clear_adv_rss_conf (adapter); -if (!(adapter->flags &IAVF_FLAG_PF_COMMS_FAILED )) { +if (!(adapter->flags &IAVF_FLAG_PF_COMMS_FAILED ) && + !(test_bit (__IAVF_IN_REMOVE_TASK, &adapter->crit_section))) {/* cancel any current operation */ adapter->current_op =VIRTCHNL_OP_UNKNOWN ;/* Schedule operations to close down the HW. Don't wait
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 59/321 ASoC: SOF: core: Only call sof_ops_free() on remove if the probe was successful
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
[ Upstream commit 31bb7bd9ffee50d09ec931998b823a86132ab807 ]
All the fail paths during probe will free up the ops, on remove we should only free it if the probe was successful.
--- sound/soc/sof/core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
sound/soc/sof/core.c +1 -2
@@ -486,10 +486,9 @@ int snd_sof_device_remove(struct device *dev)snd_sof_ipc_free (sdev);snd_sof_free_debug (sdev);snd_sof_remove (sdev); +sof_ops_free (sdev); } -sof_ops_free (sdev); -/* release firmware */ snd_sof_fw_unload (sdev);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 60/321 iavf: add iavf_schedule_aq_request() helper
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Oros <[email protected]>
[ Upstream commit ed4cad33df9e272feaa6698b33359b29c2929564 ]
Add helper for set iavf aq request AVF_FLAG_AQ_* and immediately schedule watchdog_task. Helper will be used in cases where it is necessary to run aq requests asap
Stable-dep-of: 5f3d319a2486 ("iavf: schedule a request immediately after add/delete vlan")
--- drivers/net/ethernet/intel/iavf/iavf.h | 2 +- drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 2 +- drivers/net/ethernet/intel/iavf/iavf_main.c | 10 ++++------ 3 files changed, 6 insertions(+), 8 deletions(-)
drivers/net/ethernet/intel/iavf/iavf.h +1 -1
@@ -521,7 +521,7 @@ void iavf_down(struct iavf_adapter *adapter);int iavf_process_config (struct iavf_adapter *adapter);int iavf_parse_vf_resource_msg (struct iavf_adapter *adapter);void iavf_schedule_reset (struct iavf_adapter *adapter,u64 flags); -void iavf_schedule_request_stats (struct iavf_adapter *adapter); +void iavf_schedule_aq_request (struct iavf_adapter *adapter,u64 flags);void iavf_schedule_finish_config (struct iavf_adapter *adapter);void iavf_reset (struct iavf_adapter *adapter);void iavf_set_ethtool_ops (struct net_device *netdev);
drivers/net/ethernet/intel/iavf/iavf_ethtool.c +1 -1
@@ -362,7 +362,7 @@ static void iavf_get_ethtool_stats(struct net_device *netdev,unsigned int i;/* Explicitly request stats refresh */ -iavf_schedule_request_stats (adapter); +iavf_schedule_aq_request (adapter,IAVF_FLAG_AQ_REQUEST_STATS );iavf_add_ethtool_stats (&data, adapter, iavf_gstrings_stats);
drivers/net/ethernet/intel/iavf/iavf_main.c +4 -6
@@ -314,15 +314,13 @@ void iavf_schedule_reset(struct iavf_adapter *adapter, u64 flags) }/** -* iavf_schedule_request_stats - Set the flags and schedule statistics request +* iavf_schedule_aq_request - Set the flags and schedule aq request * @adapter: board private structure -* -* Sets IAVF_FLAG_AQ_REQUEST_STATS flag so iavf_watchdog_task() will explicitly -* request and refresh ethtool stats +* @flags: requested aq flags **/ -void iavf_schedule_request_stats (struct iavf_adapter *adapter) +void iavf_schedule_aq_request (struct iavf_adapter *adapter,u64 flags) { - adapter->aq_required |=IAVF_FLAG_AQ_REQUEST_STATS ; + adapter->aq_required |= flags;mod_delayed_work (adapter->wq, &adapter->watchdog_task,0 ); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 61/321 iavf: schedule a request immediately after add/delete vlan
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Oros <[email protected]>
[ Upstream commit 5f3d319a248654a805bafc9e7094bcea47dac6c7 ]
When the iavf driver wants to reconfigure the VLAN filters (iavf_add_vlan, iavf_del_vlan), it sets a flag in aq_required:
adapter->aq_required |= IAVF_FLAG_AQ_ADD_VLAN_FILTER;
or:
adapter->aq_required |= IAVF_FLAG_AQ_DEL_VLAN_FILTER;
This is later processed by the watchdog_task, but it runs periodically every 2 seconds, so it can be a long time before it processes the request.
In the worst case, the interface is unable to receive traffic for more than 2 seconds for no objective reason.
--- drivers/net/ethernet/intel/iavf/iavf_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/iavf/iavf_main.c +2 -2
@@ -821,7 +821,7 @@ iavf_vlan_filter *iavf_add_vlan(struct iavf_adapter *adapter,list_add_tail (&f->list, &adapter->vlan_filter_list); f->state =IAVF_VLAN_ADD ; adapter->num_vlan_filters++; - adapter->aq_required |=IAVF_FLAG_AQ_ADD_VLAN_FILTER ; +iavf_schedule_aq_request (adapter,IAVF_FLAG_AQ_ADD_VLAN_FILTER ); } clearout:
@@ -843,7 +843,7 @@ static void iavf_del_vlan(struct iavf_adapter *adapter, struct iavf_vlan vlan) f =iavf_find_vlan (adapter, vlan);if (f) { f->state =IAVF_VLAN_REMOVE ; - adapter->aq_required |=IAVF_FLAG_AQ_DEL_VLAN_FILTER ; +iavf_schedule_aq_request (adapter,IAVF_FLAG_AQ_DEL_VLAN_FILTER ); }spin_unlock_bh (&adapter->mac_vlan_list_lock);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 62/321 i40e: Fix VF VLAN offloading when port VLAN is configured
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Vecera <[email protected]>
[ Upstream commit d0d362ffa33da4acdcf7aee2116ceef8c8fef658 ]
If port VLAN is configured on a VF then any other VLANs on top of this VF are broken.
During i40e_ndo_set_vf_port_vlan() call the i40e driver reset the VF and iavf driver asks PF (using VIRTCHNL_OP_GET_VF_RESOURCES) for VF capabilities but this reset occurs too early, prior setting of vf->info.pvid field and because this field can be zero during i40e_vc_get_vf_resources_msg() then VIRTCHNL_VF_OFFLOAD_VLAN capability is reported to iavf driver.
This is wrong because iavf driver should not report VLAN offloading capability when port VLAN is configured as i40e does not support QinQ offloading.
Fix the issue by moving VF reset after setting of vf->port_vlan_id field.
Without this patch:
$ echo 1 > /sys/class/net/enp2s0f0/device/sriov_numvfs $ ip link set enp2s0f0 vf 0 vlan 3 $ ip link set enp2s0f0v0 up $ ip link add link enp2s0f0v0 name vlan4 type vlan id 4 $ ip link set vlan4 up ... $ ethtool -k enp2s0f0v0 | grep vlan-offload rx-vlan-offload: on tx-vlan-offload: on $ dmesg -l err | grep iavf [1292500.742914] iavf 0000:02:02.0: Failed to add VLAN filter, error IAVF_ERR_INVALID_QP_ID
With this patch:
$ echo 1 > /sys/class/net/enp2s0f0/device/sriov_numvfs $ ip link set enp2s0f0 vf 0 vlan 3 $ ip link set enp2s0f0v0 up $ ip link add link enp2s0f0v0 name vlan4 type vlan id 4 $ ip link set vlan4 up ... $ ethtool -k enp2s0f0v0 | grep vlan-offload rx-vlan-offload: off [requested on] tx-vlan-offload: off [requested on] $ dmesg -l err | grep iavf
--- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +5 -3
@@ -4464,9 +4464,7 @@ int i40e_ndo_set_vf_port_vlan(struct net_device *netdev, int vf_id, goto error_pvid;i40e_vlan_stripping_enable (vsi); -i40e_vc_reset_vf (vf, true); -/* During reset the VF got a new VSI, so refresh a pointer. */ - vsi = pf->vsi[vf->lan_vsi_idx]; +/* Locked once because multiple functions below iterate list */ spin_lock_bh (&vsi->mac_filter_hash_lock);
@@ -4552,6 +4550,10 @@ int i40e_ndo_set_vf_port_vlan(struct net_device *netdev, int vf_id,*/ vf->port_vlan_id =le16_to_cpu (vsi->info.pvid); +i40e_vc_reset_vf (vf, true); +/* During reset the VF got a new VSI, so refresh a pointer. */ + vsi = pf->vsi[vf->lan_vsi_idx]; + ret =i40e_config_vf_promiscuous_mode (vf, vsi->id, allmulti, alluni);if (ret) {dev_err (&pf->pdev->dev,"Unable to config vf promiscuous mode\n" );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 63/321 netfilter, bpf: Adjust timeouts of non-confirmed CTs in bpf_ct_insert_entry()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Leoshkevich <[email protected]>
[ Upstream commit 837723b22a63cfbff584655b009b9d488d0e9087 ]
bpf_nf testcase fails on s390x: bpf_skb_ct_lookup() cannot find the entry that was added by bpf_ct_insert_entry() within the same BPF function.
The reason is that this entry is deleted by nf_ct_gc_expired().
The CT timeout starts ticking after the CT confirmation; therefore nf_conn.timeout is initially set to the timeout value, and __nf_conntrack_confirm() sets it to the deadline value.
bpf_ct_insert_entry() sets IPS_CONFIRMED_BIT, but does not adjust the timeout, making its value meaningless and causing false positives.
Fix the problem by making bpf_ct_insert_entry() adjust the timeout, like __nf_conntrack_confirm().
--- net/netfilter/nf_conntrack_bpf.c | 2 ++ 1 file changed, 2 insertions(+)
net/netfilter/nf_conntrack_bpf.c +2 -0
@@ -380,6 +380,8 @@ __bpf_kfunc struct nf_conn *bpf_ct_insert_entry(struct nf_conn___init *nfct_i)struct nf_conn *nfct = (struct nf_conn *)nfct_i;int err; +if (!nf_ct_is_confirmed (nfct)) + nfct->timeout += nfct_time_stamp; nfct->status |=IPS_CONFIRMED ; err =nf_conntrack_hash_check_insert (nfct);if (err <0 ) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 64/321 ionic: fix 16bit math issue when PAGE_SIZE >= 64KB
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Christensen <[email protected]>
[ Upstream commit 8f6b846b0a86c3cbae8a25b772651cfc2270ad0a ]
The ionic device supports a maximum buffer length of 16 bits (see ionic_rxq_desc or ionic_rxq_sg_elem). When adding new buffers to the receive rings, the function ionic_rx_fill() uses 16bit math when calculating the number of pages to allocate for an RX descriptor, given the interface's MTU setting. If the system PAGE_SIZE >= 64KB, and the buf_info->page_offset is 0, the remain_len value will never decrement from the original MTU value and the frag_len value will always be 0, causing additional pages to be allocated as scatter- gather elements unnecessarily.
A similar math issue exists in ionic_rx_frags(), but no failures have been observed here since a 64KB page should not normally require any scatter-gather elements at any legal Ethernet MTU size.
--- drivers/net/ethernet/pensando/ionic/ionic_dev.h | 1 + drivers/net/ethernet/pensando/ionic/ionic_txrx.c | 10 +++++++--- 2 files changed, 8 insertions(+), 3 deletions(-)
drivers/net/ethernet/pensando/ionic/ionic_dev.h +1 -0
@@ -187,6 +187,7 @@ typedef void (*ionic_desc_cb)(struct ionic_queue *q,struct ionic_desc_info *desc_info, struct ionic_cq_info *cq_info, void *cb_arg); +#define IONIC_MAX_BUF_LEN ((u16)-1)#define IONIC_PAGE_SIZE PAGE_SIZE#define IONIC_PAGE_SPLIT_SZ (PAGE_SIZE / 2)#define IONIC_PAGE_GFP_MASK (GFP_ATOMIC | __GFP_NOWARN |\
drivers/net/ethernet/pensando/ionic/ionic_txrx.c +7 -3
@@ -207,7 +207,8 @@ static struct sk_buff *ionic_rx_frags(struct ionic_queue *q,return NULL ; } - frag_len =min_t (u16, len,IONIC_PAGE_SIZE - buf_info->page_offset); + frag_len =min_t (u16, len,min_t (u32,IONIC_MAX_BUF_LEN , +IONIC_PAGE_SIZE - buf_info->page_offset)); len -= frag_len; dma_sync_single_for_cpu(dev,
@@ -452,7 +453,8 @@ void ionic_rx_fill(struct ionic_queue *q)/* fill main descriptor - buf[0] */ desc->addr =cpu_to_le64 (buf_info->dma_addr + buf_info->page_offset); - frag_len =min_t (u16, len,IONIC_PAGE_SIZE - buf_info->page_offset); + frag_len =min_t (u16, len,min_t (u32,IONIC_MAX_BUF_LEN , +IONIC_PAGE_SIZE - buf_info->page_offset)); desc->len =cpu_to_le16 (frag_len); remain_len -= frag_len; buf_info++;
@@ -471,7 +473,9 @@ void ionic_rx_fill(struct ionic_queue *q) } sg_elem->addr =cpu_to_le64 (buf_info->dma_addr + buf_info->page_offset); - frag_len =min_t (u16, remain_len,IONIC_PAGE_SIZE - buf_info->page_offset); + frag_len =min_t (u16, remain_len,min_t (u32,IONIC_MAX_BUF_LEN , +IONIC_PAGE_SIZE - + buf_info->page_offset)); sg_elem->len =cpu_to_le16 (frag_len); remain_len -= frag_len; buf_info++;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 65/321 igc: Fix infinite initialization loop with early XDP redirect
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vinicius Costa Gomes <[email protected]>
[ Upstream commit cb47b1f679c4d83a5fa5f1852e472f844e41a3da ]
When an XDP redirect happens before the link is ready, that transmission will not finish and will timeout, causing an adapter reset. If the redirects do not stop, the adapter will not stop resetting.
Wait for the driver to signal that there's a carrier before allowing transmissions to proceed.
Previous code was relying that when __IGC_DOWN is cleared, the NIC is ready to transmit as all the queues are ready, what happens is that the carrier presence will only be signaled later, after the watchdog workqueue has a chance to run. And during this interval (between clearing __IGC_DOWN and the watchdog running) if any transmission happens the timeout is emitted (detected by igc_tx_timeout()) which causes the reset, with the potential for the infinite loop.
--- drivers/net/ethernet/intel/igc/igc_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/intel/igc/igc_main.c +1 -1
@@ -6433,7 +6433,7 @@ static int igc_xdp_xmit(struct net_device *dev, int num_frames,struct igc_ring *ring;int i, drops; -if (unlikely (test_bit (__IGC_DOWN, &adapter->state))) +if (unlikely (!netif_carrier_ok (dev)))return -ENETDOWN ;if (unlikely (flags & ~XDP_XMIT_FLAGS_MASK ))
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 66/321 ipv4: fix null-deref in ipv4_link_failure
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyle Zeng <[email protected]>
[ Upstream commit 0113d9c9d1ccc07f5a3710dac4aa24b6d711278c ]
Currently, we assume the skb is associated with a device before calling __ip_options_compile, which is not always the case if it is re-routed by ipvs.
When skb->dev is NULL, dev_net(skb->dev) will become null-dereference. This patch adds a check for the edge case and switch to use the net_device from the rtable when skb->dev is NULL.
--- net/ipv4/route.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/ipv4/route.c +3 -1
@@ -1213,6 +1213,7 @@ EXPORT_INDIRECT_CALLABLE(ipv4_dst_check);static void ipv4_send_dest_unreach (struct sk_buff *skb) { +struct net_device *dev;struct ip_options opt;int res;
@@ -1230,7 +1231,8 @@ static void ipv4_send_dest_unreach(struct sk_buff *skb) opt.optlen =ip_hdr (skb)->ihl *4 -sizeof (struct iphdr );rcu_read_lock (); - res =__ip_options_compile (dev_net (skb->dev), &opt, skb,NULL ); + dev = skb->dev ? skb->dev :skb_rtable (skb)->dst.dev; + res =__ip_options_compile (dev_net (dev), &opt, skb,NULL );rcu_read_unlock ();if (res)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 67/321 scsi: iscsi_tcp: restrict to TCP sockets
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit f4f82c52a0ead5ab363d207d06f81b967d09ffb8 ]
Nothing prevents iscsi_sw_tcp_conn_bind() to receive file descriptor pointing to non TCP socket (af_unix for example).
Return -EINVAL if this is attempted, instead of crashing the kernel.
--- drivers/scsi/iscsi_tcp.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/scsi/iscsi_tcp.c +4 -0
@@ -724,6 +724,10 @@ iscsi_sw_tcp_conn_bind(struct iscsi_cls_session *cls_session,return -EEXIST ; } + err = -EINVAL ; +if (!sk_is_tcp (sock->sk)) + goto free_socket; + err =iscsi_conn_bind (cls_session, cls_conn, is_leading);if (err) goto free_socket;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 68/321 powerpc/perf/hv-24x7: Update domain value check
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kajol Jain <[email protected]>
[ Upstream commit 4ff3ba4db5943cac1045e3e4a3c0463ea10f6930 ]
Valid domain value is in range 1 to HV_PERF_DOMAIN_MAX. Current code has check for domain value greater than or equal to HV_PERF_DOMAIN_MAX. But the check for domain value 0 is missing.
Fix this issue by adding check for domain value 0.
Before:
# ./perf stat -v -e hv_24x7/CPM_ADJUNCT_INST,domain=0,core=1/ sleep 1 Using CPUID 00800200 Control descriptor is not initialized Error: The sys_perf_event_open() syscall returned with 5 (Input/output error) for event (hv_24x7/CPM_ADJUNCT_INST,domain=0,core=1/). /bin/dmesg | grep -i perf may provide additional information.
Result from dmesg:
[ 37.819387] hv-24x7: hcall failed: [0 0x60040000 0x100 0] => ret 0xfffffffffffffffc (-4) detail=0x2000000 failing ix=0
After:
# ./perf stat -v -e hv_24x7/CPM_ADJUNCT_INST,domain=0,core=1/ sleep 1 Using CPUID 00800200 Control descriptor is not initialized Warning: hv_24x7/CPM_ADJUNCT_INST,domain=0,core=1/ event is not supported by the kernel. failed to read counter hv_24x7/CPM_ADJUNCT_INST,domain=0,core=1/
--- arch/powerpc/perf/hv-24x7.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/perf/hv-24x7.c +1 -1
@@ -1418,7 +1418,7 @@ static int h_24x7_event_init(struct perf_event *event) } domain =event_get_domain (event); -if (domain >=HV_PERF_DOMAIN_MAX ) { +if (domain ==0 || domain >=HV_PERF_DOMAIN_MAX ) {pr_devel ("invalid domain %d\n" , domain);return -EINVAL ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 69/321 powerpc/dexcr: Move HASHCHK trap handler
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Gray <[email protected]>
[ Upstream commit c3f4309693758b13fbb34b3741c2e2801ad28769 ]
Syzkaller reported a sleep in atomic context bug relating to the HASHCHK handler logic:
BUG: sleeping function called from invalid context at arch/powerpc/kernel/traps.c:1518 in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 25040, name: syz-executor preempt_count: 0, expected: 0 RCU nest depth: 0, expected: 0 no locks held by syz-executor/25040. irq event stamp: 34 hardirqs last enabled at (33): [<c000000000048b38>] prep_irq_for_enabled_exit arch/powerpc/kernel/interrupt.c:56 [inline] hardirqs last enabled at (33): [<c000000000048b38>] interrupt_exit_user_prepare_main+0x148/0x600 arch/powerpc/kernel/interrupt.c:230 hardirqs last disabled at (34): [<c00000000003e6a4>] interrupt_enter_prepare+0x144/0x4f0 arch/powerpc/include/asm/interrupt.h:176 softirqs last enabled at (0): [<c000000000281954>] copy_process+0x16e4/0x4750 kernel/fork.c:2436 softirqs last disabled at (0): [<0000000000000000>] 0x0 CPU: 15 PID: 25040 Comm: syz-executor Not tainted 6.5.0-rc5-00001-g3ccdff6bb06d #3 Hardware name: IBM,9105-22A POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1040.00 (NL1040_021) hv:phyp pSeries Call Trace: [c0000000a8247ce0] [c00000000032b0e4] __might_resched+0x3b4/0x400 kernel/sched/core.c:10189 [c0000000a8247d80] [c0000000008c7dc8] __might_fault+0xa8/0x170 mm/memory.c:5853 [c0000000a8247dc0] [c00000000004160c] do_program_check+0x32c/0xb20 arch/powerpc/kernel/traps.c:1518 [c0000000a8247e50] [c000000000009b2c] program_check_common_virt+0x3bc/0x3c0
To determine if a trap was caused by a HASHCHK instruction, we inspect the user instruction that triggered the trap. However this may sleep if the page needs to be faulted in (get_user_instr() reaches __get_user(), which calls might_fault() and triggers the bug message).
Move the HASHCHK handler logic to after we allow IRQs, which is fine because we are only interested in HASHCHK if it's a user space trap.
--- arch/powerpc/kernel/traps.c | 56 ++++++++++++++++++++++++------------- 1 file changed, 36 insertions(+), 20 deletions(-)
arch/powerpc/kernel/traps.c +36 -20
@@ -1512,23 +1512,11 @@ static void do_program_check(struct pt_regs *regs)return ; } -if (cpu_has_feature (CPU_FTR_DEXCR_NPHIE ) &&user_mode (regs)) { -ppc_inst_t insn; - -if (get_user_instr (insn, (void __user *)regs->nip)) { -_exception (SIGSEGV , regs,SEGV_MAPERR , regs->nip); -return ; - } - -if (ppc_inst_primary_opcode (insn) ==31 && -get_xop (ppc_inst_val (insn)) ==OP_31_XOP_HASHCHK ) { -_exception (SIGILL , regs,ILL_ILLOPN , regs->nip); -return ; - } +/* User mode considers other cases after enabling IRQs */ +if (!user_mode (regs)) { +_exception (SIGTRAP , regs,TRAP_BRKPT , regs->nip); +return ; } - -_exception (SIGTRAP , regs,TRAP_BRKPT , regs->nip); -return ; }#ifdef CONFIG_PPC_TRANSACTIONAL_MEM if (reason &REASON_TM ) {
@@ -1561,16 +1549,44 @@ static void do_program_check(struct pt_regs *regs)/* * If we took the program check in the kernel skip down to sending a -* SIGILL. The subsequent cases all relate to emulating instructions -* which we should only do for userspace. We also do not want to enable -* interrupts for kernel faults because that might lead to further -* faults, and loose the context of the original exception. +* SIGILL. The subsequent cases all relate to user space, such as +* emulating instructions which we should only do for user space. We +* also do not want to enable interrupts for kernel faults because that +* might lead to further faults, and loose the context of the original +* exception. */ if (!user_mode (regs)) goto sigill;interrupt_cond_local_irq_enable (regs); +/* +* (reason & REASON_TRAP) is mostly handled before enabling IRQs, +* except get_user_instr() can sleep so we cannot reliably inspect the +* current instruction in that context. Now that we know we are +* handling a user space trap and can sleep, we can check if the trap +* was a hashchk failure. +*/ +if (reason &REASON_TRAP ) { +if (cpu_has_feature (CPU_FTR_DEXCR_NPHIE )) { +ppc_inst_t insn; + +if (get_user_instr (insn, (void __user *)regs->nip)) { +_exception (SIGSEGV , regs,SEGV_MAPERR , regs->nip); +return ; + } + +if (ppc_inst_primary_opcode (insn) ==31 && +get_xop (ppc_inst_val (insn)) ==OP_31_XOP_HASHCHK ) { +_exception (SIGILL , regs,ILL_ILLOPN , regs->nip); +return ; + } + } + +_exception (SIGTRAP , regs,TRAP_BRKPT , regs->nip); +return ; + } +/* (reason & REASON_ILLEGAL) would be the obvious thing here, * but there seems to be a hardware bug on the 405GP (RevD) * that means ESR is sometimes set incorrectly - either to
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 70/321 dccp: fix dccp_v4_err()/dccp_v6_err() again
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 6af289746a636f71f4c0535a9801774118486c7a ]
dh->dccph_x is the 9th byte (offset 8) in "struct dccp_hdr", not in the "byte 7" as Jann claimed.
We need to make sure the ICMP messages are big enough, using more standard ways (no more assumptions).
syzbot reported:
BUG: KMSAN: uninit-value in pskb_may_pull_reason include/linux/skbuff.h:2667 [inline] BUG: KMSAN: uninit-value in pskb_may_pull include/linux/skbuff.h:2681 [inline] BUG: KMSAN: uninit-value in dccp_v6_err+0x426/0x1aa0 net/dccp/ipv6.c:94 pskb_may_pull_reason include/linux/skbuff.h:2667 [inline] pskb_may_pull include/linux/skbuff.h:2681 [inline] dccp_v6_err+0x426/0x1aa0 net/dccp/ipv6.c:94 icmpv6_notify+0x4c7/0x880 net/ipv6/icmp.c:867 icmpv6_rcv+0x19d5/0x30d0 ip6_protocol_deliver_rcu+0xda6/0x2a60 net/ipv6/ip6_input.c:438 ip6_input_finish net/ipv6/ip6_input.c:483 [inline] NF_HOOK include/linux/netfilter.h:304 [inline] ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492 ip6_mc_input+0xa7e/0xc80 net/ipv6/ip6_input.c:586 dst_input include/net/dst.h:468 [inline] ip6_rcv_finish+0x5db/0x870 net/ipv6/ip6_input.c:79 NF_HOOK include/linux/netfilter.h:304 [inline] ipv6_rcv+0xda/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5523 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5637 netif_receive_skb_internal net/core/dev.c:5723 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5782 tun_rx_batched+0x83b/0x920 tun_get_user+0x564c/0x6940 drivers/net/tun.c:2002 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:1985 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x8ef/0x15c0 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Uninit was created at:
slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767 slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3523 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:559 __alloc_skb+0x318/0x740 net/core/skbuff.c:650 alloc_skb include/linux/skbuff.h:1286 [inline] alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6313 sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2795 tun_alloc_skb drivers/net/tun.c:1531 [inline] tun_get_user+0x23cf/0x6940 drivers/net/tun.c:1846 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:1985 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x8ef/0x15c0 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd CPU: 0 PID: 4995 Comm: syz-executor153 Not tainted 6.6.0-rc1-syzkaller-00014-ga747acc0b752 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023
--- net/dccp/ipv4.c | 9 ++------- net/dccp/ipv6.c | 9 ++------- 2 files changed, 4 insertions(+), 14 deletions(-)
net/dccp/ipv4.c +2 -7
@@ -255,13 +255,8 @@ static int dccp_v4_err(struct sk_buff *skb, u32 info)int err;struct net *net =dev_net (skb->dev); -/* For the first __dccp_basic_hdr_len() check, we only need dh->dccph_x, -* which is in byte 7 of the dccp header. -* Our caller (icmp_socket_deliver()) already pulled 8 bytes for us. -* -* Later on, we want to access the sequence number fields, which are -* beyond 8 bytes, so we have to pskb_may_pull() ourselves. -*/ +if (!pskb_may_pull (skb, offset +sizeof (*dh))) +return -EINVAL ; dh = (struct dccp_hdr *)(skb->data + offset);if (!pskb_may_pull (skb, offset +__dccp_basic_hdr_len (dh)))return -EINVAL ;
net/dccp/ipv6.c +2 -7
@@ -83,13 +83,8 @@ static int dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,__u64 seq;struct net *net =dev_net (skb->dev); -/* For the first __dccp_basic_hdr_len() check, we only need dh->dccph_x, -* which is in byte 7 of the dccp header. -* Our caller (icmpv6_notify()) already pulled 8 bytes for us. -* -* Later on, we want to access the sequence number fields, which are -* beyond 8 bytes, so we have to pskb_may_pull() ourselves. -*/ +if (!pskb_may_pull (skb, offset +sizeof (*dh))) +return -EINVAL ; dh = (struct dccp_hdr *)(skb->data + offset);if (!pskb_may_pull (skb, offset +__dccp_basic_hdr_len (dh)))return -EINVAL ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 71/321 x86/mm, kexec, ima: Use memblock_free_late() from ima_free_kexec_buffer()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rik van Riel <[email protected]>
[ Upstream commit 34cf99c250d5cd2530b93a57b0de31d3aaf8685b ]
The code calling ima_free_kexec_buffer() runs long after the memblock allocator has already been torn down, potentially resulting in a use after free in memblock_isolate_range().
With KASAN or KFENCE, this use after free will result in a BUG from the idle task, and a subsequent kernel panic.
Switch ima_free_kexec_buffer() over to memblock_free_late() to avoid that bug.
--- arch/x86/kernel/setup.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
arch/x86/kernel/setup.c +2 -6
@@ -359,15 +359,11 @@ static void __init add_early_ima_buffer(u64 phys_addr)#if defined(CONFIG_HAVE_IMA_KEXEC ) && !defined(CONFIG_OF_FLATTREE )int __init ima_free_kexec_buffer (void ) { -int rc; -if (!ima_kexec_buffer_size)return -ENOENT ; - rc =memblock_phys_free (ima_kexec_buffer_phys, - ima_kexec_buffer_size); -if (rc) -return rc; +memblock_free_late (ima_kexec_buffer_phys, + ima_kexec_buffer_size); ima_kexec_buffer_phys =0 ; ima_kexec_buffer_size =0 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 72/321 net: hsr: Properly parse HSRv1 supervisor frames.
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukasz Majewski <[email protected]>
[ Upstream commit 295de650d3aaf9e50258465c5f1c84b465d836f6 ]
While adding support for parsing the redbox supervision frames, the author added pull_size' and total_pull_size' to track the amount of bytes that were pulled from the skb during while parsing the skb so it can be reverted/ pushed back at the end.
In the process probably copy&paste error occurred and for the HSRv1 case the ethhdr was used instead of the hsr_tag. Later the hsr_tag was used instead of hsr_sup_tag. The later error didn't matter because both structs have the size so HSRv0 was still working. It broke however HSRv1 parsing because struct ethhdr is larger than struct hsr_tag.
Reinstate the old pulling flow and pull first ethhdr, hsr_tag in v1 case followed by hsr_sup_tag.
[bigeasy: commit message]
--- net/hsr/hsr_framereg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/hsr/hsr_framereg.c +2 -2
@@ -288,13 +288,13 @@ void hsr_handle_sup_frame(struct hsr_frame_info *frame)/* And leave the HSR tag. */ if (ethhdr->h_proto ==htons (ETH_P_HSR )) { - pull_size =sizeof (struct ethhdr ); + pull_size =sizeof (struct hsr_tag );skb_pull (skb, pull_size); total_pull_size += pull_size; }/* And leave the HSR sup tag. */ - pull_size =sizeof (struct hsr_tag ); + pull_size =sizeof (struct hsr_sup_tag );skb_pull (skb, pull_size); total_pull_size += pull_size;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 73/321 platform/x86: intel_scu_ipc: Check status after timeout in busy_loop()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
[ Upstream commit e0b4ab3bb92bda8d12f55842614362989d5b2cb3 ]
It's possible for the polling loop in busy_loop() to get scheduled away for a long time.
status = ipc_read_status(scu); // status = IPC_STATUS_BUSY <long time scheduled away>
if (!(status & IPC_STATUS_BUSY))
If this happens, then the status bit could change while the task is scheduled away and this function would never read the status again after timing out. Instead, the function will return -ETIMEDOUT when it's possible that scheduling didn't work out and the status bit was cleared. Bit polling code should always check the bit being polled one more time after the timeout in case this happens.
Fix this by reading the status once more after the while loop breaks. The readl_poll_timeout() macro implements all of this, and it is shorter, so use that macro here to consolidate code and fix this.
There were some concerns with using readl_poll_timeout() because it uses timekeeping, and timekeeping isn't running early on or during the late stages of system suspend or early stages of system resume, but an audit of the code concluded that this code isn't called during those times so it is safe to use the macro.
--- drivers/platform/x86/intel_scu_ipc.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-)
drivers/platform/x86/intel_scu_ipc.c +8 -11
@@ -19,6 +19,7 @@#include <linux/init.h> #include <linux/interrupt.h> #include <linux/io.h> +#include <linux/iopoll.h> #include <linux/module.h> #include <linux/slab.h>
@@ -231,19 +232,15 @@ static inline u32 ipc_data_readl(struct intel_scu_ipc_dev *scu, u32 offset)/* Wait till scu status is busy */ static inline int busy_loop (struct intel_scu_ipc_dev *scu) { -unsigned long end = jiffies +IPC_TIMEOUT ; - -do { -u32 status; - - status =ipc_read_status (scu); -if (!(status &IPC_STATUS_BUSY )) -return (status &IPC_STATUS_ERR ) ? -EIO :0 ; +u8 status; +int err; -usleep_range (50 ,100 ); - }while (time_before (jiffies, end)); + err =readx_poll_timeout (ipc_read_status, scu, status, !(status &IPC_STATUS_BUSY ), +100 ,jiffies_to_usecs (IPC_TIMEOUT )); +if (err) +return err; -return -ETIMEDOUT ; +return (status &IPC_STATUS_ERR ) ? -EIO :0 ; }/* Wait till ipc ioc interrupt is received or timeout in 10 HZ */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 74/321 platform/x86: intel_scu_ipc: Check status upon timeout in ipc_wait_for_interrupt()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
[ Upstream commit 427fada620733e6474d783ae6037a66eae42bf8c ]
It's possible for the completion in ipc_wait_for_interrupt() to timeout, simply because the interrupt was delayed in being processed. A timeout in itself is not an error. This driver should check the status register upon a timeout to ensure that scheduling or interrupt processing delays don't affect the outcome of the IPC return value.
CPU0 SCU
---- ---
ipc_wait_for_interrupt()
wait_for_completion_timeout(&scu->cmd_complete)
[TIMEOUT] status[IPC_STATUS_BUSY]=0
Fix this problem by reading the status bit in all cases, regardless of the timeout. If the completion times out, we'll assume the problem was that the IPC_STATUS_BUSY bit was still set, but if the status bit is cleared in the meantime we know that we hit some scheduling delay and we should just check the error bit.
--- drivers/platform/x86/intel_scu_ipc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/platform/x86/intel_scu_ipc.c +4 -2
@@ -248,10 +248,12 @@ static inline int ipc_wait_for_interrupt(struct intel_scu_ipc_dev *scu) {int status; -if (!wait_for_completion_timeout (&scu->cmd_complete,IPC_TIMEOUT )) -return -ETIMEDOUT ; +wait_for_completion_timeout (&scu->cmd_complete,IPC_TIMEOUT ); status =ipc_read_status (scu); +if (status &IPC_STATUS_BUSY ) +return -ETIMEDOUT ; +if (status &IPC_STATUS_ERR )return -EIO ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 75/321 platform/x86: intel_scu_ipc: Dont override scu in intel_scu_ipc_dev_simple_command()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
[ Upstream commit efce78584e583226e9a1f6cb2fb555d6ff47c3e7 ]
Andy discovered this bug during patch review. The 'scu' argument to this function shouldn't be overridden by the function itself. It doesn't make any sense. Looking at the commit history, we see that commit f57fa18583f5 ("platform/x86: intel_scu_ipc: Introduce new SCU IPC API") removed the setting of the scu to ipcdev in other functions, but not this one. That was an oversight. Remove this line so that we stop overriding the scu instance that is used by this function.
--- drivers/platform/x86/intel_scu_ipc.c | 1 - 1 file changed, 1 deletion(-)
drivers/platform/x86/intel_scu_ipc.c +0 -1
@@ -443,7 +443,6 @@ int intel_scu_ipc_dev_simple_command(struct intel_scu_ipc_dev *scu, int cmd,mutex_unlock (&ipclock);return -ENODEV ; } - scu = ipcdev; cmdval = sub <<12 | cmd;ipc_command (scu, cmdval); err =intel_scu_ipc_check_status (scu);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 76/321 platform/x86: intel_scu_ipc: Fail IPC send if still busy
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
[ Upstream commit 85e654c9f722853a595fa941dca60c157b707b86 ]
It's possible for interrupts to get significantly delayed to the point that callers of intel_scu_ipc_dev_command() and friends can call the function once, hit a timeout, and call it again while the interrupt still hasn't been processed. This driver will get seriously confused if the interrupt is finally processed after the second IPC has been sent with ipc_command(). It won't know which IPC has been completed. This could be quite disastrous if calling code assumes something has happened upon return from intel_scu_ipc_dev_simple_command() when it actually hasn't.
Let's avoid this scenario by simply returning -EBUSY in this case. Hopefully higher layers will know to back off or fail gracefully when this happens. It's all highly unlikely anyway, but it's better to be correct here as we have no way to know which IPC the status register is telling us about if we send a second IPC while the previous IPC is still processing.
--- drivers/platform/x86/intel_scu_ipc.c | 40 +++++++++++++++++++--------- 1 file changed, 28 insertions(+), 12 deletions(-)
drivers/platform/x86/intel_scu_ipc.c +28 -12
@@ -265,6 +265,24 @@ static int intel_scu_ipc_check_status(struct intel_scu_ipc_dev *scu)return scu->irq >0 ?ipc_wait_for_interrupt (scu) :busy_loop (scu); } +static struct intel_scu_ipc_dev *intel_scu_ipc_get (struct intel_scu_ipc_dev *scu) +{ +u8 status; + +if (!scu) + scu = ipcdev; +if (!scu) +return ERR_PTR (-ENODEV ); + + status =ipc_read_status (scu); +if (status &IPC_STATUS_BUSY ) { +dev_dbg (&scu->dev,"device is busy\n" ); +return ERR_PTR (-EBUSY ); + } + +return scu; +} +/* Read/Write power control(PMIC in Langwell, MSIC in PenWell) registers */ static int pwr_reg_rdwr (struct intel_scu_ipc_dev *scu,u16 *addr,u8 *data,u32 count,u32 op,u32 id)
@@ -278,11 +296,10 @@ static int pwr_reg_rdwr(struct intel_scu_ipc_dev *scu, u16 *addr, u8 *data,memset (cbuf,0 ,sizeof (cbuf));mutex_lock (&ipclock); -if (!scu) - scu = ipcdev; -if (!scu) { + scu =intel_scu_ipc_get (scu); +if (IS_ERR (scu)) {mutex_unlock (&ipclock); -return -ENODEV ; +return PTR_ERR (scu); }for (nc =0 ; nc < count; nc++, offset +=2 ) {
@@ -437,12 +454,12 @@ int intel_scu_ipc_dev_simple_command(struct intel_scu_ipc_dev *scu, int cmd,int err;mutex_lock (&ipclock); -if (!scu) - scu = ipcdev; -if (!scu) { + scu =intel_scu_ipc_get (scu); +if (IS_ERR (scu)) {mutex_unlock (&ipclock); -return -ENODEV ; +return PTR_ERR (scu); } + cmdval = sub <<12 | cmd;ipc_command (scu, cmdval); err =intel_scu_ipc_check_status (scu);
@@ -482,11 +499,10 @@ int intel_scu_ipc_dev_command_with_size(struct intel_scu_ipc_dev *scu, int cmd,return -EINVAL ;mutex_lock (&ipclock); -if (!scu) - scu = ipcdev; -if (!scu) { + scu =intel_scu_ipc_get (scu); +if (IS_ERR (scu)) {mutex_unlock (&ipclock); -return -ENODEV ; +return PTR_ERR (scu); }memcpy (inbuf, in, inlen);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 77/321 x86/asm: Fix build of UML with KASAN
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Whitchurch <[email protected]>
[ Upstream commit 10f4c9b9a33b7df000f74fa0d896351fb1a61e6a ]
Building UML with KASAN fails since commit 69d4c0d32186 ("entry, kasan,
x86: Disallow overriding mem*() functions") with the following errors:
$ tools/testing/kunit/kunit.py run --kconfig_add CONFIG_KASAN=y ... ld: mm/kasan/shadow.o: in function `memset': shadow.c:(.text+0x40): multiple definition of `memset'; arch/x86/lib/memset_64.o:(.noinstr.text+0x0): first defined here ld: mm/kasan/shadow.o: in function `memmove': shadow.c:(.text+0x90): multiple definition of `memmove'; arch/x86/lib/memmove_64.o:(.noinstr.text+0x0): first defined here ld: mm/kasan/shadow.o: in function `memcpy': shadow.c:(.text+0x110): multiple definition of `memcpy'; arch/x86/lib/memcpy_64.o:(.noinstr.text+0x0): first defined here
UML does not use GENERIC_ENTRY and is still supposed to be allowed to override the mem*() functions, so use weak aliases in that case.
--- arch/x86/include/asm/linkage.h | 7 +++++++ arch/x86/lib/memcpy_64.S | 2 +- arch/x86/lib/memmove_64.S | 2 +- arch/x86/lib/memset_64.S | 2 +- 4 files changed, 10 insertions(+), 3 deletions(-)
arch/x86/include/asm/linkage.h +7 -0
@@ -105,6 +105,13 @@ CFI_POST_PADDING \ SYM_FUNC_END(__cfi_##name) +/* UML needs to be able to override memcpy() and friends for KASAN. */ +#ifdef CONFIG_UML +# define SYM_FUNC_ALIAS_MEMFUNC SYM_FUNC_ALIAS_WEAK +#else +# define SYM_FUNC_ALIAS_MEMFUNC SYM_FUNC_ALIAS +#endif +/* SYM_TYPED_FUNC_START -- use for indirectly called globals, w/ CFI type */ #define SYM_TYPED_FUNC_START (name) \ SYM_TYPED_START(name, SYM_L_GLOBAL, SYM_F_ALIGN) \
arch/x86/lib/memcpy_64.S +1 -1
@@ -40,7 +40,7 @@ SYM_TYPED_FUNC_START(__memcpy) SYM_FUNC_END(__memcpy) EXPORT_SYMBOL(__memcpy) -SYM_FUNC_ALIAS(memcpy, __memcpy) +SYM_FUNC_ALIAS_MEMFUNC(memcpy, __memcpy) EXPORT_SYMBOL(memcpy) SYM_FUNC_START_LOCAL(memcpy_orig)
arch/x86/lib/memmove_64.S +1 -1
@@ -212,5 +212,5 @@ SYM_FUNC_START(__memmove) SYM_FUNC_END(__memmove) EXPORT_SYMBOL(__memmove) -SYM_FUNC_ALIAS(memmove, __memmove) +SYM_FUNC_ALIAS_MEMFUNC(memmove, __memmove) EXPORT_SYMBOL(memmove)
arch/x86/lib/memset_64.S +1 -1
@@ -40,7 +40,7 @@ SYM_FUNC_START(__memset) SYM_FUNC_END(__memset) EXPORT_SYMBOL(__memset) -SYM_FUNC_ALIAS(memset, __memset) +SYM_FUNC_ALIAS_MEMFUNC(memset, __memset) EXPORT_SYMBOL(memset) SYM_FUNC_START_LOCAL(memset_orig)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 78/321 x86/srso: Fix srso_show_state() side effect
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
[ Upstream commit a8cf700c17d9ca6cb8ee7dc5c9330dbac3948237 ]
Reading the 'spec_rstack_overflow' sysfs file can trigger an unnecessary MSR write, and possibly even a (handled) exception if the microcode hasn't been updated.
Avoid all that by just checking X86_FEATURE_IBPB_BRTYPE instead, which gets set by srso_select_mitigation() if the updated microcode exists.
--- arch/x86/kernel/cpu/bugs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/cpu/bugs.c +1 -1
@@ -2717,7 +2717,7 @@ static ssize_t srso_show_state(char *buf)return sysfs_emit (buf,"%s%s\n" , srso_strings[srso_mitigation], - (cpu_has_ibpb_brtype_microcode () ?"" :", no microcode" )); +boot_cpu_has (X86_FEATURE_IBPB_BRTYPE ) ?"" :", no microcode" ); }static ssize_t gds_show_state (char *buf)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 79/321 x86/srso: Set CPUID feature bits independently of bug or mitigation status
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
[ Upstream commit 91857ae20303cc98ed36720d9868fcd604a2ee75 ]
Booting with mitigations=off incorrectly prevents the X86_FEATURE_{IBPB_BRTYPE,SBPB} CPUID bits from getting set.
Also, future CPUs without X86_BUG_SRSO might still have IBPB with branch type prediction flushing, in which case SBPB should be used instead of IBPB. The current code doesn't allow for that.
Also, cpu_has_ibpb_brtype_microcode() has some surprising side effects and the setting of these feature bits really doesn't belong in the mitigation code anyway. Move it to earlier.
--- arch/x86/include/asm/processor.h | 2 -- arch/x86/kernel/cpu/amd.c | 28 +++++++++------------------- arch/x86/kernel/cpu/bugs.c | 13 +------------ 3 files changed, 10 insertions(+), 33 deletions(-)
arch/x86/include/asm/processor.h +0 -2
@@ -676,12 +676,10 @@ extern u16 get_llc_id(unsigned int cpu);#ifdef CONFIG_CPU_SUP_AMD extern u32 amd_get_nodes_per_socket (void );extern u32 amd_get_highest_perf (void ); -extern bool cpu_has_ibpb_brtype_microcode (void );extern void amd_clear_divider (void );#else static inline u32 amd_get_nodes_per_socket (void ) {return 0 ; }static inline u32 amd_get_highest_perf (void ) {return 0 ; } -static inline bool cpu_has_ibpb_brtype_microcode (void ) {return false; }static inline void amd_clear_divider (void ) { }#endif
arch/x86/kernel/cpu/amd.c +9 -19
@@ -766,6 +766,15 @@ static void early_init_amd(struct cpuinfo_x86 *c)if (cpu_has (c,X86_FEATURE_TOPOEXT )) smp_num_siblings = ((cpuid_ebx (0x8000001e ) >>8 ) &0xff ) +1 ; + +if (!cpu_has (c,X86_FEATURE_IBPB_BRTYPE )) { +if (c->x86 ==0x17 &&boot_cpu_has (X86_FEATURE_AMD_IBPB )) +setup_force_cpu_cap (X86_FEATURE_IBPB_BRTYPE ); +else if (c->x86 >=0x19 && !wrmsrl_safe (MSR_IA32_PRED_CMD ,PRED_CMD_SBPB )) { +setup_force_cpu_cap (X86_FEATURE_IBPB_BRTYPE ); +setup_force_cpu_cap (X86_FEATURE_SBPB ); + } + } }static void init_amd_k8 (struct cpuinfo_x86 *c)
@@ -1301,25 +1310,6 @@ void amd_check_microcode(void)on_each_cpu (zenbleed_check_cpu,NULL ,1 ); } -bool cpu_has_ibpb_brtype_microcode (void ) -{ -switch (boot_cpu_data.x86) { -/* Zen1/2 IBPB flushes branch type predictions too. */ -case 0x17 : -return boot_cpu_has (X86_FEATURE_AMD_IBPB ); -case 0x19 : -/* Poke the MSR bit on Zen3/4 to check its presence. */ -if (!wrmsrl_safe (MSR_IA32_PRED_CMD ,PRED_CMD_SBPB )) { -setup_force_cpu_cap (X86_FEATURE_SBPB ); -return true; - }else { -return false; - } -default : -return false; - } -} -/* * Issue a DIV 0/1 insn to clear any division data from previous DIV * operations.
arch/x86/kernel/cpu/bugs.c +1 -12
@@ -2404,26 +2404,15 @@ early_param("spec_rstack_overflow", srso_parse_cmdline);static void __init srso_select_mitigation (void ) { -bool has_microcode; +bool has_microcode =boot_cpu_has (X86_FEATURE_IBPB_BRTYPE );if (!boot_cpu_has_bug (X86_BUG_SRSO ) ||cpu_mitigations_off ()) goto pred_cmd; -/* -* The first check is for the kernel running as a guest in order -* for guests to verify whether IBPB is a viable mitigation. -*/ - has_microcode =boot_cpu_has (X86_FEATURE_IBPB_BRTYPE ) ||cpu_has_ibpb_brtype_microcode ();if (!has_microcode) {pr_warn ("IBPB-extending microcode not applied!\n" );pr_warn (SRSO_NOTICE ); }else { -/* -* Enable the synthetic (even if in a real CPUID leaf) -* flags for guests. -*/ -setup_force_cpu_cap (X86_FEATURE_IBPB_BRTYPE ); -/* * Zen1/2 with SMT off aren't vulnerable after the right * IBPB microcode has been applied.
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 80/321 x86/srso: Dont probe microcode in a guest
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
[ Upstream commit 02428d0366a27c2f33bc4361eb10467777804f29 ]
To support live migration, the hypervisor sets the "lowest common denominator" of features. Probing the microcode isn't allowed because any detected features might go away after a migration.
As Andy Cooper states:
"Linux must not probe microcode when virtualised. What it may see instantaneously on boot (owing to MSR_PRED_CMD being fully passed through) is not accurate for the lifetime of the VM."
Rely on the hypervisor to set the needed IBPB_BRTYPE and SBPB bits.
--- arch/x86/kernel/cpu/amd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/cpu/amd.c +1 -1
@@ -767,7 +767,7 @@ static void early_init_amd(struct cpuinfo_x86 *c)if (cpu_has (c,X86_FEATURE_TOPOEXT )) smp_num_siblings = ((cpuid_ebx (0x8000001e ) >>8 ) &0xff ) +1 ; -if (!cpu_has (c,X86_FEATURE_IBPB_BRTYPE )) { +if (!cpu_has (c,X86_FEATURE_HYPERVISOR ) && !cpu_has (c,X86_FEATURE_IBPB_BRTYPE )) {if (c->x86 ==0x17 &&boot_cpu_has (X86_FEATURE_AMD_IBPB ))setup_force_cpu_cap (X86_FEATURE_IBPB_BRTYPE );else if (c->x86 >=0x19 && !wrmsrl_safe (MSR_IA32_PRED_CMD ,PRED_CMD_SBPB )) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 81/321 x86/srso: Fix SBPB enablement for spec_rstack_overflow=off
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
[ Upstream commit 01b057b2f4cc2d905a0bd92195657dbd9a7005ab ]
If the user has requested no SRSO mitigation, other mitigations can use the lighter-weight SBPB instead of IBPB.
--- arch/x86/kernel/cpu/bugs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/cpu/bugs.c +1 -1
@@ -2433,7 +2433,7 @@ static void __init srso_select_mitigation(void)switch (srso_cmd) {case SRSO_CMD_OFF : -return ; + goto pred_cmd;case SRSO_CMD_MICROCODE :if (has_microcode) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 82/321 net: hns3: add cmdq check for vf periodic service task
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Wang <[email protected]>
[ Upstream commit bd3caddf299a640efb66c6022efed7fe744db626 ]
When the vf cmdq is disabled, there is no need to keep these task running. So this patch skip these task when the cmdq is disabled.
--- drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +2 -1
@@ -1855,7 +1855,8 @@ static void hclgevf_periodic_service_task(struct hclgevf_dev *hdev)unsigned long delta =round_jiffies_relative (HZ );struct hnae3_handle *handle = &hdev->nic; -if (test_bit (HCLGEVF_STATE_RST_FAIL , &hdev->state)) +if (test_bit (HCLGEVF_STATE_RST_FAIL , &hdev->state) || +test_bit (HCLGE_COMM_STATE_CMD_DISABLE , &hdev->hw.hw.comm_state))return ;if (time_is_after_jiffies (hdev->last_serv_processed +HZ )) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 83/321 net: hns3: fix GRE checksum offload issue
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Wang <[email protected]>
[ Upstream commit f9f651261130cdcb7adc9a3e365b356bc2749ab3 ]
The device_version V3 hardware can't offload the checksum for IP in GRE packets, but can do it for NvGRE. So default to disable the checksum and GSO offload for GRE, but keep the ability to enable it when only using NvGRE.
--- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +9 -0
@@ -3352,6 +3352,15 @@ static void hns3_set_default_feature(struct net_device *netdev) NETIF_F_HW_TC); netdev->hw_enc_features |= netdev->vlan_features |NETIF_F_TSO_MANGLEID ; + +/* The device_version V3 hardware can't offload the checksum for IP in +* GRE packets, but can do it for NvGRE. So default to disable the +* checksum and GSO offload for GRE. +*/ +if (ae_dev->dev_version >HNAE3_DEVICE_VERSION_V2 ) { + netdev->features &= ~NETIF_F_GSO_GRE ; + netdev->features &= ~NETIF_F_GSO_GRE_CSUM ; + } } static int hns3_alloc_buffer(struct hns3_enet_ring *ring,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 84/321 net: hns3: only enable unicast promisc when mac table full
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jian Shen <[email protected]>
[ Upstream commit f2ed304922a55690529bcca59678dd92d7466ce8 ]
Currently, the driver will enable unicast promisc for the function once configure mac address fail. It's unreasonable when the failure is caused by using same mac address with other functions. So only enable unicast promisc when mac table full.
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +1 -1
@@ -8824,7 +8824,7 @@ static void hclge_update_overflow_flags(struct hclge_vport *vport,if (mac_type ==HCLGE_MAC_ADDR_UC ) {if (is_all_added) vport->overflow_promisc_flags &= ~HNAE3_OVERFLOW_UPE ; -else +else if (hclge_is_umv_space_full (vport, true)) vport->overflow_promisc_flags |=HNAE3_OVERFLOW_UPE ; }else {if (is_all_added)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 85/321 net: hns3: fix fail to delete tc flower rules during reset issue
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jijie Shao <[email protected]>
[ Upstream commit 1a7be66e4685b8541546222c305cce9710718a88 ]
Firmware does not respond driver commands during reset Therefore, rule will fail to delete while the firmware is resetting
So, if failed to delete rule, set rule state to TO_DEL, and the rule will be deleted when periodic task being scheduled.
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +6 -0
@@ -7348,6 +7348,12 @@ static int hclge_del_cls_flower(struct hnae3_handle *handle, ret =hclge_fd_tcam_config (hdev,HCLGE_FD_STAGE_1 , true, rule->location,NULL , false);if (ret) { +/* if tcam config fail, set rule state to TO_DEL, +* so the rule will be deleted when periodic +* task being scheduled. +*/ +hclge_update_fd_list (hdev,HCLGE_FD_TO_DEL , rule->location,NULL ); +set_bit (HCLGE_STATE_FD_TBL_CHANGED , &hdev->state);spin_unlock_bh (&hdev->fd_rule_lock);return ret; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 86/321 net: hns3: add 5ms delay before clear firmware reset irq source
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jie Wang <[email protected]>
[ Upstream commit 0770063096d5da4a8e467b6e73c1646a75589628 ]
Currently the reset process in hns3 and firmware watchdog init process is asynchronous. we think firmware watchdog initialization is completed before hns3 clear the firmware interrupt source. However, firmware initialization may not complete early.
so we add delay before hns3 clear firmware interrupt source and 5 ms delay is enough to avoid second firmware reset interrupt.
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +5 -0
@@ -3564,9 +3564,14 @@ static u32 hclge_check_event_cause(struct hclge_dev *hdev, u32 *clearval)static void hclge_clear_event_cause (struct hclge_dev *hdev,u32 event_type,u32 regclr) { +#define HCLGE_IMP_RESET_DELAY 5 +switch (event_type) {case HCLGE_VECTOR0_EVENT_PTP :case HCLGE_VECTOR0_EVENT_RST : +if (regclr ==BIT (HCLGE_VECTOR0_IMPRESET_INT_B )) +mdelay (HCLGE_IMP_RESET_DELAY ); +hclge_write_dev (&hdev->hw,HCLGE_MISC_RESET_STS_REG , regclr);break ;case HCLGE_VECTOR0_EVENT_MBX :
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 87/321 net: bridge: use DEV_STATS_INC()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 44bdb313da57322c9b3c108eb66981c6ec6509f4 ]
syzbot/KCSAN reported data-races in br_handle_frame_finish() [1] This function can run from multiple cpus without mutual exclusion.
Adopt SMP safe DEV_STATS_INC() to update dev->stats fields.
Handles updates to dev->stats.tx_dropped while we are at it.
[1]
BUG: KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish
read-write to 0xffff8881374b2178 of 8 bytes by interrupt on cpu 1:
br_handle_frame_finish+0xd4f/0xef0 net/bridge/br_input.c:189 br_nf_hook_thresh+0x1ed/0x220 br_nf_pre_routing_finish_ipv6+0x50f/0x540 NF_HOOK include/linux/netfilter.h:304 [inline] br_nf_pre_routing_ipv6+0x1e3/0x2a0 net/bridge/br_netfilter_ipv6.c:178 br_nf_pre_routing+0x526/0xba0 net/bridge/br_netfilter_hooks.c:508 nf_hook_entry_hookfn include/linux/netfilter.h:144 [inline] nf_hook_bridge_pre net/bridge/br_input.c:272 [inline] br_handle_frame+0x4c9/0x940 net/bridge/br_input.c:417 __netif_receive_skb_core+0xa8a/0x21e0 net/core/dev.c:5417 __netif_receive_skb_one_core net/core/dev.c:5521 [inline] __netif_receive_skb+0x57/0x1b0 net/core/dev.c:5637 process_backlog+0x21f/0x380 net/core/dev.c:5965 __napi_poll+0x60/0x3b0 net/core/dev.c:6527 napi_poll net/core/dev.c:6594 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6727 __do_softirq+0xc1/0x265 kernel/softirq.c:553 run_ksoftirqd+0x17/0x20 kernel/softirq.c:921 smpboot_thread_fn+0x30a/0x4a0 kernel/smpboot.c:164 kthread+0x1d7/0x210 kernel/kthread.c:388 ret_from_fork+0x48/0x60 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
read-write to 0xffff8881374b2178 of 8 bytes by interrupt on cpu 0:
br_handle_frame_finish+0xd4f/0xef0 net/bridge/br_input.c:189 br_nf_hook_thresh+0x1ed/0x220 br_nf_pre_routing_finish_ipv6+0x50f/0x540 NF_HOOK include/linux/netfilter.h:304 [inline] br_nf_pre_routing_ipv6+0x1e3/0x2a0 net/bridge/br_netfilter_ipv6.c:178 br_nf_pre_routing+0x526/0xba0 net/bridge/br_netfilter_hooks.c:508 nf_hook_entry_hookfn include/linux/netfilter.h:144 [inline] nf_hook_bridge_pre net/bridge/br_input.c:272 [inline] br_handle_frame+0x4c9/0x940 net/bridge/br_input.c:417 __netif_receive_skb_core+0xa8a/0x21e0 net/core/dev.c:5417 __netif_receive_skb_one_core net/core/dev.c:5521 [inline] __netif_receive_skb+0x57/0x1b0 net/core/dev.c:5637 process_backlog+0x21f/0x380 net/core/dev.c:5965 __napi_poll+0x60/0x3b0 net/core/dev.c:6527 napi_poll net/core/dev.c:6594 [inline] net_rx_action+0x32b/0x750 net/core/dev.c:6727 __do_softirq+0xc1/0x265 kernel/softirq.c:553 do_softirq+0x5e/0x90 kernel/softirq.c:454 __local_bh_enable_ip+0x64/0x70 kernel/softirq.c:381 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline] _raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_tt_local_purge+0x1a8/0x1f0 net/batman-adv/translation-table.c:1356 batadv_tt_purge+0x2b/0x630 net/batman-adv/translation-table.c:3560 process_one_work kernel/workqueue.c:2630 [inline] process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2703 worker_thread+0x525/0x730 kernel/workqueue.c:2784 kthread+0x1d7/0x210 kernel/kthread.c:388 ret_from_fork+0x48/0x60 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
value changed: 0x00000000000d7190 -> 0x00000000000d7191
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 14848 Comm: kworker/u4:11 Not tainted 6.6.0-rc1-syzkaller-00236-gad8a69f361b9 #0
--- net/bridge/br_forward.c | 4 ++-- net/bridge/br_input.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
net/bridge/br_forward.c +2 -2
@@ -124,7 +124,7 @@ static int deliver_clone(const struct net_bridge_port *prev, skb =skb_clone (skb,GFP_ATOMIC );if (!skb) { - dev->stats.tx_dropped++; +DEV_STATS_INC (dev, tx_dropped);return -ENOMEM ; }
@@ -267,7 +267,7 @@ static void maybe_deliver_addr(struct net_bridge_port *p, struct sk_buff *skb, skb =skb_copy (skb,GFP_ATOMIC );if (!skb) { - dev->stats.tx_dropped++; +DEV_STATS_INC (dev, tx_dropped);return ; }
net/bridge/br_input.c +2 -2
@@ -181,12 +181,12 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skbif ((mdst && mdst->host_joined) ||br_multicast_is_router (brmctx, skb)) { local_rcv = true; - br->dev->stats.multicast++; +DEV_STATS_INC (br->dev, multicast); } mcast_hit = true; }else { local_rcv = true; - br->dev->stats.multicast++; +DEV_STATS_INC (br->dev, multicast); }break ;case BR_PKT_UNICAST :
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 88/321 team: fix null-ptr-deref when team device type is changed
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyang Xuan <[email protected]>
[ Upstream commit 492032760127251e5540a5716a70996bacf2a3fd ]
Get a null-ptr-deref bug as follows with reproducer [1].
BUG: kernel NULL pointer dereference, address: 0000000000000228 ... RIP: 0010:vlan_dev_hard_header+0x35/0x140 [8021q] ... Call Trace: <TASK> ? __die+0x24/0x70 ? page_fault_oops+0x82/0x150 ? exc_page_fault+0x69/0x150 ? asm_exc_page_fault+0x26/0x30 ? vlan_dev_hard_header+0x35/0x140 [8021q] ? vlan_dev_hard_header+0x8e/0x140 [8021q] neigh_connected_output+0xb2/0x100 ip6_finish_output2+0x1cb/0x520 ? nf_hook_slow+0x43/0xc0 ? ip6_mtu+0x46/0x80 ip6_finish_output+0x2a/0xb0 mld_sendpack+0x18f/0x250 mld_ifc_work+0x39/0x160 process_one_work+0x1e6/0x3f0 worker_thread+0x4d/0x2f0 ? __pfx_worker_thread+0x10/0x10 kthread+0xe5/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1b/0x30
[1]
$ teamd -t team0 -d -c '{"runner": {"name": "loadbalance"}}'
$ ip link add name t-dummy type dummy
$ ip link add link t-dummy name t-dummy.100 type vlan id 100
$ ip link add name t-nlmon type nlmon
$ ip link set t-nlmon master team0
$ ip link set t-nlmon nomaster
$ ip link set t-dummy up
$ ip link set team0 up
$ ip link set t-dummy.100 down
$ ip link set t-dummy.100 master team0When enslave a vlan device to team device and team device type is changed from non-ether to ether, header_ops of team device is changed to vlan_header_ops. That is incorrect and will trigger null-ptr-deref for vlan->real_dev in vlan_dev_hard_header() because team device is not a vlan device.
Cache eth_header_ops in team_setup(), then assign cached header_ops to header_ops of team net device when its type is changed from non-ether to ether to fix the bug.
--- drivers/net/team/team.c | 10 +++++++++- include/linux/if_team.h | 2 ++ 2 files changed, 11 insertions(+), 1 deletion(-)
drivers/net/team/team.c +9 -1
@@ -2127,7 +2127,12 @@ static const struct ethtool_ops team_ethtool_ops = {static void team_setup_by_port (struct net_device *dev,struct net_device *port_dev) { - dev->header_ops = port_dev->header_ops; +struct team *team =netdev_priv (dev); + +if (port_dev->type ==ARPHRD_ETHER ) + dev->header_ops = team->header_ops_cache; +else + dev->header_ops = port_dev->header_ops; dev->type = port_dev->type; dev->hard_header_len = port_dev->hard_header_len; dev->needed_headroom = port_dev->needed_headroom;
@@ -2174,8 +2179,11 @@ static int team_dev_type_check_change(struct net_device *dev,static void team_setup (struct net_device *dev) { +struct team *team =netdev_priv (dev); +ether_setup (dev); dev->max_mtu =ETH_MAX_MTU ; + team->header_ops_cache = dev->header_ops; dev->netdev_ops = &team_netdev_ops; dev->ethtool_ops = &team_ethtool_ops;
include/linux/if_team.h +2 -0
@@ -189,6 +189,8 @@ struct team {struct net_device *dev;/* associated netdevice */ struct team_pcpu_stats __percpu *pcpu_stats; +const struct header_ops *header_ops_cache; +struct mutex lock;/* used for overall locking, e.g. port lists write */ /*
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 89/321 locking/atomic: scripts: fix fallback ifdeffery
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
[ Upstream commit 6d2779ecaeb56f92d7105c56772346c71c88c278 ]
Since commit:
9257959a6e5b4fca ("locking/atomic: scripts: restructure fallback ifdeffery")
The ordering fallbacks for atomic*_read_acquire() and atomic*_set_release() erroneously fall back to the implictly relaxed atomic*_read() and atomic*_set() variants respectively, without any additional barriers. This loses the ACQUIRE and RELEASE ordering semantics, which can result in a wide variety of problems, even on strongly-ordered architectures where the implementation of atomic*_read() and/or atomic*_set() allows the compiler to reorder those relative to other accesses.
In practice this has been observed to break bit spinlocks on arm64, resulting in dentry cache corruption.
The fallback logic was intended to allow ACQUIRE/RELEASE/RELAXED ops to be defined in terms of FULL ops, but where an op had RELAXED ordering by default, this unintentionally permitted the ACQUIRE/RELEASE ops to be defined in terms of the implicitly RELAXED default.
This patch corrects the logic to avoid falling back to implicitly RELAXED ops, resulting in the same behaviour as prior to commit 9257959a6e5b4fca.
I've verified the resulting assembly on arm64 by generating outlined wrappers of the atomics. Prior to this patch the compiler generates sequences using relaxed load (LDR) and store (STR) instructions, e.g.
| <outlined_atomic64_read_acquire>: | ldr x0, [x0] | ret | | <outlined_atomic64_set_release>: | str x1, [x0] | ret
With this patch applied the compiler generates sequences using the intended load-acquire (LDAR) and store-release (STLR) instructions, e.g.
| <outlined_atomic64_read_acquire>: | ldar x0, [x0] | ret | | <outlined_atomic64_set_release>: | stlr x1, [x0] | ret
To make sure that there were no other victims of the ifdeffery rewrite, I generated outlined copies of all of the {atomic,atomic64,atomic_long} atomic operations before and after commit 9257959a6e5b4fca. A diff of the generated assembly on arm64 shows that only the read_acquire() and set_release() operations were changed, and only lost their intended ordering:
| [mark@lakrids:~/src/linux]% diff -u \ | <(aarch64-linux-gnu-objdump -d before-9257959a6e5b4fca.o) | <(aarch64-linux-gnu-objdump -d after-9257959a6e5b4fca.o) | --- /proc/self/fd/11 2023-09-19 16:51:51.114779415 +0100 | +++ /proc/self/fd/16 2023-09-19 16:51:51.114779415 +0100 | @@ -1,5 +1,5 @@ | | -before-9257959a6e5b4fca.o: file format elf64-littleaarch64 | +after-9257959a6e5b4fca.o: file format elf64-littleaarch64 | | | Disassembly of section .text: | @@ -9,7 +9,7 @@ | 4: d65f03c0 ret | | 0000000000000008 <outlined_atomic_read_acquire>: | - 8: 88dffc00 ldar w0, [x0] | + 8: b9400000 ldr w0, [x0] | c: d65f03c0 ret | | 0000000000000010 <outlined_atomic_set>: | @@ -17,7 +17,7 @@ | 14: d65f03c0 ret | | 0000000000000018 <outlined_atomic_set_release>: | - 18: 889ffc01 stlr w1, [x0] | + 18: b9000001 str w1, [x0] | 1c: d65f03c0 ret | | 0000000000000020 <outlined_atomic_add>: | @@ -1230,7 +1230,7 @@ | 1070: d65f03c0 ret | | 0000000000001074 <outlined_atomic64_read_acquire>: | - 1074: c8dffc00 ldar x0, [x0] | + 1074: f9400000 ldr x0, [x0] | 1078: d65f03c0 ret | | 000000000000107c <outlined_atomic64_set>: | @@ -1238,7 +1238,7 @@ | 1080: d65f03c0 ret | | 0000000000001084 <outlined_atomic64_set_release>: | - 1084: c89ffc01 stlr x1, [x0] | + 1084: f9000001 str x1, [x0] | 1088: d65f03c0 ret | | 000000000000108c <outlined_atomic64_add>: | @@ -2427,7 +2427,7 @@ | 207c: d65f03c0 ret | | 0000000000002080 <outlined_atomic_long_read_acquire>: | - 2080: c8dffc00 ldar x0, [x0] | + 2080: f9400000 ldr x0, [x0] | 2084: d65f03c0 ret | | 0000000000002088 <outlined_atomic_long_set>: | @@ -2435,7 +2435,7 @@ | 208c: d65f03c0 ret | | 0000000000002090 <outlined_atomic_long_set_release>: | - 2090: c89ffc01 stlr x1, [x0] | + 2090: f9000001 str x1, [x0] | 2094: d65f03c0 ret | | 0000000000002098 <outlined_atomic_long_add>:
I've build tested this with a variety of configs for alpha, arm, arm64, csky, i386, m68k, microblaze, mips, nios2, openrisc, powerpc, riscv, s390, sh, sparc, x86_64, and xtensa, for which I've seen no issues. I was unable to build test for ia64 and parisc due to existing build breakage in v6.6-rc2.
--- include/linux/atomic/atomic-arch-fallback.h | 10 +--------- scripts/atomic/gen-atomic-fallback.sh | 2 +- 2 files changed, 2 insertions(+), 10 deletions(-)
include/linux/atomic/atomic-arch-fallback.h +1 -9
@@ -459,8 +459,6 @@ raw_atomic_read_acquire(const atomic_t *v) {#if defined(arch_atomic_read_acquire)return arch_atomic_read_acquire (v); -#elif defined(arch_atomic_read) -return arch_atomic_read (v);#else int ret;
@@ -508,8 +506,6 @@ raw_atomic_set_release(atomic_t *v, int i) {#if defined(arch_atomic_set_release)arch_atomic_set_release (v, i); -#elif defined(arch_atomic_set) -arch_atomic_set (v, i);#else if (__native_word (atomic_t)) {smp_store_release (&(v)->counter, i);
@@ -2575,8 +2571,6 @@ raw_atomic64_read_acquire(const atomic64_t *v) {#if defined(arch_atomic64_read_acquire)return arch_atomic64_read_acquire (v); -#elif defined(arch_atomic64_read) -return arch_atomic64_read (v);#else s64 ret;
@@ -2624,8 +2618,6 @@ raw_atomic64_set_release(atomic64_t *v, s64 i) {#if defined(arch_atomic64_set_release)arch_atomic64_set_release (v, i); -#elif defined(arch_atomic64_set) -arch_atomic64_set (v, i);#else if (__native_word (atomic64_t)) {smp_store_release (&(v)->counter, i);
@@ -4657,4 +4649,4 @@ raw_atomic64_dec_if_positive(atomic64_t *v) }#endif /* _LINUX_ATOMIC_FALLBACK_H */ -// 202b45c7db600ce36198eb1f1fc2c2d5268ace2d +// 2fdd6702823fa842f9cea57a002e6e4476ae780c
scripts/atomic/gen-atomic-fallback.sh +1 -1
@@ -102,7 +102,7 @@ gen_proto_order_variant() fi # Allow ACQUIRE/RELEASE/RELAXED ops to be defined in terms of FULL ops - if [ ! -z "${order}" ]; then + if [ ! -z "${order}" ] && ! meta_is_implicitly_relaxed "${meta}"; then printf "#elif defined(arch_${basename})\n" printf "\t${retstmt}arch_${basename}(${args});\n" fi
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 90/321 net: rds: Fix possible NULL-pointer dereference
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artem Chernyshev <[email protected]>
[ Upstream commit f1d95df0f31048f1c59092648997686e3f7d9478 ]
In rds_rdma_cm_event_handler_cmn() check, if conn pointer exists before dereferencing it as rdma_set_service_type() argument
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- net/rds/rdma_transport.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
net/rds/rdma_transport.c +7 -5
@@ -86,11 +86,13 @@ static int rds_rdma_cm_event_handler_cmn(struct rdma_cm_id *cm_id,break ;case RDMA_CM_EVENT_ADDR_RESOLVED : -rdma_set_service_type (cm_id, conn->c_tos); -rdma_set_min_rnr_timer (cm_id,IB_RNR_TIMER_000_32 ); -/* XXX do we need to clean up if this fails? */ - ret =rdma_resolve_route (cm_id, -RDS_RDMA_RESOLVE_TIMEOUT_MS ); +if (conn) { +rdma_set_service_type (cm_id, conn->c_tos); +rdma_set_min_rnr_timer (cm_id,IB_RNR_TIMER_000_32 ); +/* XXX do we need to clean up if this fails? */ + ret =rdma_resolve_route (cm_id, +RDS_RDMA_RESOLVE_TIMEOUT_MS ); + }break ;case RDMA_CM_EVENT_ROUTE_RESOLVED :
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 91/321 vxlan: Add missing entries to vxlan_get_size()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Poirier <[email protected]>
[ Upstream commit 4e4b1798cc90e376b8b61d0098b4093898a32227 ]
There are some attributes added by vxlan_fill_info() which are not accounted for in vxlan_get_size(). Add them.
I didn't find a way to trigger an actual problem from this miscalculation since there is usually extra space in netlink size calculations like if_nlmsg_size(); but maybe I just didn't search long enough.
--- drivers/net/vxlan/vxlan_core.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/vxlan/vxlan_core.c +4 -0
@@ -4296,6 +4296,10 @@ static size_t vxlan_get_size(const struct net_device *dev)nla_total_size (sizeof (__u8)) +/* IFLA_VXLAN_REMCSUM_TX */ nla_total_size (sizeof (__u8)) +/* IFLA_VXLAN_REMCSUM_RX */ nla_total_size (sizeof (__u8)) +/* IFLA_VXLAN_LOCALBYPASS */ +nla_total_size (0 ) +/* IFLA_VXLAN_GBP */ +nla_total_size (0 ) +/* IFLA_VXLAN_GPE */ +nla_total_size (0 ) +/* IFLA_VXLAN_REMCSUM_NOPARTIAL */ +nla_total_size (sizeof (__u8)) +/* IFLA_VXLAN_VNIFILTER */ 0 ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 92/321 netfilter: nf_tables: disable toggling dormant table state more than once
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit c9bd26513b3a11b3adb3c2ed8a31a01a87173ff1 ]
nft -f -<<EOF
add table ip t
add table ip t { flags dormant; }
add chain ip t c { type filter hook input priority 0; } add table ip t
EOF
Triggers a splat from nf core on next table delete because we lose track of right hook register state:
WARNING: CPU: 2 PID: 1597 at net/netfilter/core.c:501 __nf_unregister_net_hook RIP: 0010:__nf_unregister_net_hook+0x41b/0x570 nf_unregister_net_hook+0xb4/0xf0 __nf_tables_unregister_hook+0x160/0x1d0
[..]
The above should have table in *active* state, but in fact no hooks were registered.
Reject on/off/on games rather than attempting to fix this.
--- net/netfilter/nf_tables_api.c | 4 ++++ 1 file changed, 4 insertions(+)
net/netfilter/nf_tables_api.c +4 -0
@@ -1219,6 +1219,10 @@ static int nf_tables_updtable(struct nft_ctx *ctx) flags & NFT_TABLE_F_OWNER))return -EOPNOTSUPP ; +/* No dormant off/on/off/on games in single transaction */ +if (ctx->table->flags & __NFT_TABLE_F_UPDATE) +return -EINVAL ; + trans =nft_trans_alloc (ctx,NFT_MSG_NEWTABLE ,sizeof (struct nft_trans_table ));if (trans ==NULL )
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 93/321 netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jozsef Kadlecsik <[email protected]>
[ Upstream commit 7433b6d2afd512d04398c73aa984d1e285be125b ]
Kyle Zeng reported that there is a race between IPSET_CMD_ADD and IPSET_CMD_SWAP in netfilter/ip_set, which can lead to the invocation of __ip_set_put on a wrong set, triggering the BUG_ON(set->ref == 0); check in it.
The race is caused by using the wrong reference counter, i.e. the ref counter instead of ref_netlink.
--- net/netfilter/ipset/ip_set_core.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
net/netfilter/ipset/ip_set_core.c +10 -2
@@ -682,6 +682,14 @@ __ip_set_put(struct ip_set *set)/* set->ref can be swapped out by ip_set_swap, netlink events (like dump) need * a separate reference counter */ +static void +__ip_set_get_netlink (struct ip_set *set) +{ +write_lock_bh (&ip_set_ref_lock); + set->ref_netlink++; +write_unlock_bh (&ip_set_ref_lock); +} +static void __ip_set_put_netlink (struct ip_set *set) {
@@ -1693,11 +1701,11 @@ call_ad(struct net *net, struct sock *ctnl, struct sk_buff *skb, do { if (retried) { - __ip_set_get(set); + __ip_set_get_netlink(set); nfnl_unlock(NFNL_SUBSYS_IPSET); cond_resched(); nfnl_lock(NFNL_SUBSYS_IPSET); - __ip_set_put(set); + __ip_set_put_netlink(set); } ip_set_lock(set);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 94/321 net: hinic: Fix warning-hinic_set_vlan_fliter() warn: variable dereferenced before check hwdev
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cai Huoqing <[email protected]>
[ Upstream commit 22b6e7f3d6d51ff2716480f3d8f3098d90d69165 ]
'hwdev' is checked too late and hwdev will not be NULL, so remove the check
--- drivers/net/ethernet/huawei/hinic/hinic_port.c | 3 --- 1 file changed, 3 deletions(-)
drivers/net/ethernet/huawei/hinic/hinic_port.c +0 -3
@@ -456,9 +456,6 @@ int hinic_set_vlan_fliter(struct hinic_dev *nic_dev, u32 en)u16 out_size =sizeof (vlan_filter);int err; -if (!hwdev) -return -EINVAL ; - vlan_filter.func_idx =HINIC_HWIF_FUNC_IDX (hwif); vlan_filter.enable = en;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 95/321 net/handshake: Fix memory leak in __sock_create() and sock_alloc_file()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit 4a0f07d71b0483cc08c03cefa7c85749e187c214 ]
When making CONFIG_DEBUG_KMEMLEAK=y and CONFIG_DEBUG_KMEMLEAK_AUTO_SCAN=y, modprobe handshake-test and then rmmmod handshake-test, the below memory leak is detected.
The struct socket_alloc which is allocated by alloc_inode_sb() in __sock_create() is not freed. And the struct dentry which is allocated by __d_alloc() in sock_alloc_file() is not freed.
Since fput() will call file->f_op->release() which is sock_close() here and it will call __sock_release(). and fput() will call dput(dentry) to free the struct dentry. So replace sock_release() with fput() to fix the below memory leak. After applying this patch, the following memory leak is never detected.
unreferenced object 0xffff888109165840 (size 768):
comm "kunit_try_catch", pid 1852, jiffies 4294685807 (age 976.262s) hex dump (first 32 bytes):
01 00 00 00 01 00 5a 5a 20 00 00 00 00 00 00 00 ......ZZ .......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff8397993f>] sock_alloc_inode+0x1f/0x1b0
[<ffffffff81a2cb5b>] alloc_inode+0x5b/0x1a0
[<ffffffff81a32bed>] new_inode_pseudo+0xd/0x70
[<ffffffff8397889c>] sock_alloc+0x3c/0x260
[<ffffffff83979b46>] __sock_create+0x66/0x3d0
[<ffffffffa0209ba2>] 0xffffffffa0209ba2
[<ffffffff829cf03a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81236fc6>] kthread+0x2b6/0x380
[<ffffffff81096afd>] ret_from_fork+0x2d/0x70
[<ffffffff81003511>] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff88810f472008 (size 192):
comm "kunit_try_catch", pid 1852, jiffies 4294685808 (age 976.261s)
hex dump (first 32 bytes):
00 00 50 40 02 00 00 00 00 00 00 00 00 00 00 00 ..P@............
00 00 00 00 00 00 00 00 08 20 47 0f 81 88 ff ff ......... G.....
backtrace:
[<ffffffff81a1ff11>] __d_alloc+0x31/0x8a0
[<ffffffff81a2910e>] d_alloc_pseudo+0xe/0x50
[<ffffffff819d549e>] alloc_file_pseudo+0xce/0x210
[<ffffffff83978582>] sock_alloc_file+0x42/0x1b0
[<ffffffffa0209bbb>] 0xffffffffa0209bbb
[<ffffffff829cf03a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81236fc6>] kthread+0x2b6/0x380
[<ffffffff81096afd>] ret_from_fork+0x2d/0x70
[<ffffffff81003511>] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff88810958e580 (size 224):
comm "kunit_try_catch", pid 1852, jiffies 4294685808 (age 976.261s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 03 00 2e 08 01 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff819d4b90>] alloc_empty_file+0x50/0x160
[<ffffffff819d4cf9>] alloc_file+0x59/0x730
[<ffffffff819d5524>] alloc_file_pseudo+0x154/0x210
[<ffffffff83978582>] sock_alloc_file+0x42/0x1b0
[<ffffffffa0209bbb>] 0xffffffffa0209bbb
[<ffffffff829cf03a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81236fc6>] kthread+0x2b6/0x380
[<ffffffff81096afd>] ret_from_fork+0x2d/0x70
[<ffffffff81003511>] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff88810926dc88 (size 192):
comm "kunit_try_catch", pid 1854, jiffies 4294685809 (age 976.271s)
hex dump (first 32 bytes):
00 00 50 40 02 00 00 00 00 00 00 00 00 00 00 00 ..P@............
00 00 00 00 00 00 00 00 88 dc 26 09 81 88 ff ff ..........&.....
backtrace:
[<ffffffff81a1ff11>] __d_alloc+0x31/0x8a0
[<ffffffff81a2910e>] d_alloc_pseudo+0xe/0x50
[<ffffffff819d549e>] alloc_file_pseudo+0xce/0x210
[<ffffffff83978582>] sock_alloc_file+0x42/0x1b0
[<ffffffffa0208fdc>] 0xffffffffa0208fdc
[<ffffffff829cf03a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81236fc6>] kthread+0x2b6/0x380
[<ffffffff81096afd>] ret_from_fork+0x2d/0x70
[<ffffffff81003511>] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff88810a241380 (size 224):
comm "kunit_try_catch", pid 1854, jiffies 4294685809 (age 976.271s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 03 00 2e 08 01 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff819d4b90>] alloc_empty_file+0x50/0x160
[<ffffffff819d4cf9>] alloc_file+0x59/0x730
[<ffffffff819d5524>] alloc_file_pseudo+0x154/0x210
[<ffffffff83978582>] sock_alloc_file+0x42/0x1b0
[<ffffffffa0208fdc>] 0xffffffffa0208fdc
[<ffffffff829cf03a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81236fc6>] kthread+0x2b6/0x380
[<ffffffff81096afd>] ret_from_fork+0x2d/0x70
[<ffffffff81003511>] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff888109165040 (size 768):
comm "kunit_try_catch", pid 1856, jiffies 4294685811 (age 976.269s)
hex dump (first 32 bytes):
01 00 00 00 01 00 5a 5a 20 00 00 00 00 00 00 00 ......ZZ .......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff8397993f>] sock_alloc_inode+0x1f/0x1b0
[<ffffffff81a2cb5b>] alloc_inode+0x5b/0x1a0
[<ffffffff81a32bed>] new_inode_pseudo+0xd/0x70
[<ffffffff8397889c>] sock_alloc+0x3c/0x260
[<ffffffff83979b46>] __sock_create+0x66/0x3d0
[<ffffffffa0208860>] 0xffffffffa0208860
[<ffffffff829cf03a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81236fc6>] kthread+0x2b6/0x380
[<ffffffff81096afd>] ret_from_fork+0x2d/0x70
[<ffffffff81003511>] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff88810926d568 (size 192):
comm "kunit_try_catch", pid 1856, jiffies 4294685811 (age 976.269s)
hex dump (first 32 bytes):
00 00 50 40 02 00 00 00 00 00 00 00 00 00 00 00 ..P@............
00 00 00 00 00 00 00 00 68 d5 26 09 81 88 ff ff ........h.&.....
backtrace:
[<ffffffff81a1ff11>] __d_alloc+0x31/0x8a0
[<ffffffff81a2910e>] d_alloc_pseudo+0xe/0x50
[<ffffffff819d549e>] alloc_file_pseudo+0xce/0x210
[<ffffffff83978582>] sock_alloc_file+0x42/0x1b0
[<ffffffffa0208879>] 0xffffffffa0208879
[<ffffffff829cf03a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81236fc6>] kthread+0x2b6/0x380
[<ffffffff81096afd>] ret_from_fork+0x2d/0x70
[<ffffffff81003511>] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff88810a240580 (size 224):
comm "kunit_try_catch", pid 1856, jiffies 4294685811 (age 976.347s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 03 00 2e 08 01 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff819d4b90>] alloc_empty_file+0x50/0x160
[<ffffffff819d4cf9>] alloc_file+0x59/0x730
[<ffffffff819d5524>] alloc_file_pseudo+0x154/0x210
[<ffffffff83978582>] sock_alloc_file+0x42/0x1b0
[<ffffffffa0208879>] 0xffffffffa0208879
[<ffffffff829cf03a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81236fc6>] kthread+0x2b6/0x380
[<ffffffff81096afd>] ret_from_fork+0x2d/0x70
[<ffffffff81003511>] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff888109164c40 (size 768):
comm "kunit_try_catch", pid 1858, jiffies 4294685816 (age 976.342s)
hex dump (first 32 bytes):
01 00 00 00 01 00 5a 5a 20 00 00 00 00 00 00 00 ......ZZ .......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff8397993f>] sock_alloc_inode+0x1f/0x1b0
[<ffffffff81a2cb5b>] alloc_inode+0x5b/0x1a0
[<ffffffff81a32bed>] new_inode_pseudo+0xd/0x70
[<ffffffff8397889c>] sock_alloc+0x3c/0x260
[<ffffffff83979b46>] __sock_create+0x66/0x3d0
[<ffffffffa0208541>] 0xffffffffa0208541
[<ffffffff829cf03a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81236fc6>] kthread+0x2b6/0x380
[<ffffffff81096afd>] ret_from_fork+0x2d/0x70
[<ffffffff81003511>] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff88810926cd18 (size 192):
comm "kunit_try_catch", pid 1858, jiffies 4294685816 (age 976.342s)
hex dump (first 32 bytes):
00 00 50 40 02 00 00 00 00 00 00 00 00 00 00 00 ..P@............
00 00 00 00 00 00 00 00 18 cd 26 09 81 88 ff ff ..........&.....
backtrace:
[<ffffffff81a1ff11>] __d_alloc+0x31/0x8a0
[<ffffffff81a2910e>] d_alloc_pseudo+0xe/0x50
[<ffffffff819d549e>] alloc_file_pseudo+0xce/0x210
[<ffffffff83978582>] sock_alloc_file+0x42/0x1b0
[<ffffffffa020855a>] 0xffffffffa020855a
[<ffffffff829cf03a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81236fc6>] kthread+0x2b6/0x380
[<ffffffff81096afd>] ret_from_fork+0x2d/0x70
[<ffffffff81003511>] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff88810a240200 (size 224):
comm "kunit_try_catch", pid 1858, jiffies 4294685816 (age 976.342s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 03 00 2e 08 01 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff819d4b90>] alloc_empty_file+0x50/0x160
[<ffffffff819d4cf9>] alloc_file+0x59/0x730
[<ffffffff819d5524>] alloc_file_pseudo+0x154/0x210
[<ffffffff83978582>] sock_alloc_file+0x42/0x1b0
[<ffffffffa020855a>] 0xffffffffa020855a
[<ffffffff829cf03a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81236fc6>] kthread+0x2b6/0x380
[<ffffffff81096afd>] ret_from_fork+0x2d/0x70
[<ffffffff81003511>] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff888109164840 (size 768):
comm "kunit_try_catch", pid 1860, jiffies 4294685817 (age 976.416s)
hex dump (first 32 bytes):
01 00 00 00 01 00 5a 5a 20 00 00 00 00 00 00 00 ......ZZ .......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff8397993f>] sock_alloc_inode+0x1f/0x1b0
[<ffffffff81a2cb5b>] alloc_inode+0x5b/0x1a0
[<ffffffff81a32bed>] new_inode_pseudo+0xd/0x70
[<ffffffff8397889c>] sock_alloc+0x3c/0x260
[<ffffffff83979b46>] __sock_create+0x66/0x3d0
[<ffffffffa02093e2>] 0xffffffffa02093e2
[<ffffffff829cf03a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81236fc6>] kthread+0x2b6/0x380
[<ffffffff81096afd>] ret_from_fork+0x2d/0x70
[<ffffffff81003511>] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff88810926cab8 (size 192):
comm "kunit_try_catch", pid 1860, jiffies 4294685817 (age 976.416s)
hex dump (first 32 bytes):
00 00 50 40 02 00 00 00 00 00 00 00 00 00 00 00 ..P@............
00 00 00 00 00 00 00 00 b8 ca 26 09 81 88 ff ff ..........&.....
backtrace:
[<ffffffff81a1ff11>] __d_alloc+0x31/0x8a0
[<ffffffff81a2910e>] d_alloc_pseudo+0xe/0x50
[<ffffffff819d549e>] alloc_file_pseudo+0xce/0x210
[<ffffffff83978582>] sock_alloc_file+0x42/0x1b0
[<ffffffffa02093fb>] 0xffffffffa02093fb
[<ffffffff829cf03a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81236fc6>] kthread+0x2b6/0x380
[<ffffffff81096afd>] ret_from_fork+0x2d/0x70
[<ffffffff81003511>] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff88810a240040 (size 224):
comm "kunit_try_catch", pid 1860, jiffies 4294685817 (age 976.416s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 03 00 2e 08 01 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff819d4b90>] alloc_empty_file+0x50/0x160
[<ffffffff819d4cf9>] alloc_file+0x59/0x730
[<ffffffff819d5524>] alloc_file_pseudo+0x154/0x210
[<ffffffff83978582>] sock_alloc_file+0x42/0x1b0
[<ffffffffa02093fb>] 0xffffffffa02093fb
[<ffffffff829cf03a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81236fc6>] kthread+0x2b6/0x380
[<ffffffff81096afd>] ret_from_fork+0x2d/0x70
[<ffffffff81003511>] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff888109166440 (size 768):
comm "kunit_try_catch", pid 1862, jiffies 4294685819 (age 976.489s)
hex dump (first 32 bytes):
01 00 00 00 01 00 5a 5a 20 00 00 00 00 00 00 00 ......ZZ .......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff8397993f>] sock_alloc_inode+0x1f/0x1b0
[<ffffffff81a2cb5b>] alloc_inode+0x5b/0x1a0
[<ffffffff81a32bed>] new_inode_pseudo+0xd/0x70
[<ffffffff8397889c>] sock_alloc+0x3c/0x260
[<ffffffff83979b46>] __sock_create+0x66/0x3d0
[<ffffffffa02097c1>] 0xffffffffa02097c1
[<ffffffff829cf03a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81236fc6>] kthread+0x2b6/0x380
[<ffffffff81096afd>] ret_from_fork+0x2d/0x70
[<ffffffff81003511>] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff88810926c398 (size 192):
comm "kunit_try_catch", pid 1862, jiffies 4294685819 (age 976.489s)
hex dump (first 32 bytes):
00 00 50 40 02 00 00 00 00 00 00 00 00 00 00 00 ..P@............
00 00 00 00 00 00 00 00 98 c3 26 09 81 88 ff ff ..........&.....
backtrace:
[<ffffffff81a1ff11>] __d_alloc+0x31/0x8a0
[<ffffffff81a2910e>] d_alloc_pseudo+0xe/0x50
[<ffffffff819d549e>] alloc_file_pseudo+0xce/0x210
[<ffffffff83978582>] sock_alloc_file+0x42/0x1b0
[<ffffffffa02097da>] 0xffffffffa02097da
[<ffffffff829cf03a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81236fc6>] kthread+0x2b6/0x380
[<ffffffff81096afd>] ret_from_fork+0x2d/0x70
[<ffffffff81003511>] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff888107e0b8c0 (size 224):
comm "kunit_try_catch", pid 1862, jiffies 4294685819 (age 976.489s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 03 00 2e 08 01 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff819d4b90>] alloc_empty_file+0x50/0x160
[<ffffffff819d4cf9>] alloc_file+0x59/0x730
[<ffffffff819d5524>] alloc_file_pseudo+0x154/0x210
[<ffffffff83978582>] sock_alloc_file+0x42/0x1b0
[<ffffffffa02097da>] 0xffffffffa02097da
[<ffffffff829cf03a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81236fc6>] kthread+0x2b6/0x380
[<ffffffff81096afd>] ret_from_fork+0x2d/0x70
[<ffffffff81003511>] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff888109164440 (size 768):
comm "kunit_try_catch", pid 1864, jiffies 4294685821 (age 976.487s)
hex dump (first 32 bytes):
01 00 00 00 01 00 5a 5a 20 00 00 00 00 00 00 00 ......ZZ .......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff8397993f>] sock_alloc_inode+0x1f/0x1b0
[<ffffffff81a2cb5b>] alloc_inode+0x5b/0x1a0
[<ffffffff81a32bed>] new_inode_pseudo+0xd/0x70
[<ffffffff8397889c>] sock_alloc+0x3c/0x260
[<ffffffff83979b46>] __sock_create+0x66/0x3d0
[<ffffffffa020824e>] 0xffffffffa020824e
[<ffffffff829cf03a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81236fc6>] kthread+0x2b6/0x380
[<ffffffff81096afd>] ret_from_fork+0x2d/0x70
[<ffffffff81003511>] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff88810f4cf698 (size 192):
comm "kunit_try_catch", pid 1864, jiffies 4294685821 (age 976.501s)
hex dump (first 32 bytes):
00 00 50 40 02 00 00 00 00 00 00 00 00 00 00 00 ..P@............
00 00 00 00 00 00 00 00 98 f6 4c 0f 81 88 ff ff ..........L.....
backtrace:
[<ffffffff81a1ff11>] __d_alloc+0x31/0x8a0
[<ffffffff81a2910e>] d_alloc_pseudo+0xe/0x50
[<ffffffff819d549e>] alloc_file_pseudo+0xce/0x210
[<ffffffff83978582>] sock_alloc_file+0x42/0x1b0
[<ffffffffa0208267>] 0xffffffffa0208267
[<ffffffff829cf03a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81236fc6>] kthread+0x2b6/0x380
[<ffffffff81096afd>] ret_from_fork+0x2d/0x70
[<ffffffff81003511>] ret_from_fork_asm+0x11/0x20
unreferenced object 0xffff888107e0b000 (size 224):
comm "kunit_try_catch", pid 1864, jiffies 4294685821 (age 976.501s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 03 00 2e 08 01 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff819d4b90>] alloc_empty_file+0x50/0x160
[<ffffffff819d4cf9>] alloc_file+0x59/0x730
[<ffffffff819d5524>] alloc_file_pseudo+0x154/0x210
[<ffffffff83978582>] sock_alloc_file+0x42/0x1b0
[<ffffffffa0208267>] 0xffffffffa0208267
[<ffffffff829cf03a>] kunit_generic_run_threadfn_adapter+0x4a/0x90
[<ffffffff81236fc6>] kthread+0x2b6/0x380
[<ffffffff81096afd>] ret_from_fork+0x2d/0x70
[<ffffffff81003511>] ret_from_fork_asm+0x11/0x20--- net/handshake/handshake-test.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
net/handshake/handshake-test.c +7 -7
@@ -235,7 +235,7 @@ static void handshake_req_submit_test4(struct kunit *test)KUNIT_EXPECT_PTR_EQ (test, req, result);handshake_req_cancel (sock->sk); -sock_release (sock); +fput (filp); }static void handshake_req_submit_test5 (struct kunit *test)
@@ -272,7 +272,7 @@ static void handshake_req_submit_test5(struct kunit *test)/* Assert */ KUNIT_EXPECT_EQ (test, err, -EAGAIN ); -sock_release (sock); +fput (filp); hn->hn_pending = saved; }
@@ -306,7 +306,7 @@ static void handshake_req_submit_test6(struct kunit *test)KUNIT_EXPECT_EQ (test, err, -EBUSY );handshake_req_cancel (sock->sk); -sock_release (sock); +fput (filp); }static void handshake_req_cancel_test1 (struct kunit *test)
@@ -340,7 +340,7 @@ static void handshake_req_cancel_test1(struct kunit *test)/* Assert */ KUNIT_EXPECT_TRUE (test, result); -sock_release (sock); +fput (filp); }static void handshake_req_cancel_test2 (struct kunit *test)
@@ -382,7 +382,7 @@ static void handshake_req_cancel_test2(struct kunit *test)/* Assert */ KUNIT_EXPECT_TRUE (test, result); -sock_release (sock); +fput (filp); }static void handshake_req_cancel_test3 (struct kunit *test)
@@ -427,7 +427,7 @@ static void handshake_req_cancel_test3(struct kunit *test)/* Assert */ KUNIT_EXPECT_FALSE (test, result); -sock_release (sock); +fput (filp); }static struct handshake_req *handshake_req_destroy_test;
@@ -471,7 +471,7 @@ static void handshake_req_destroy_test1(struct kunit *test)handshake_req_cancel (sock->sk);/* Act */ -sock_release (sock); +fput (filp);/* Assert */ KUNIT_EXPECT_PTR_EQ (test, handshake_req_destroy_test, req);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 96/321 i915/pmu: Move execlist stats initialization to execlist specific setup
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Umesh Nerlige Ramappa <[email protected]>
[ Upstream commit c524cd40e8a2a1a36f4898eaf2024beefeb815f3 ]
engine->stats is a union of execlist and guc stat objects. When execlist specific fields are initialized, the initial state of guc stats is affected. This results in bad busyness values when using GuC mode. Move the execlist initialization from common code to execlist specific code.
--- drivers/gpu/drm/i915/gt/intel_engine_cs.c | 1 - drivers/gpu/drm/i915/gt/intel_execlists_submission.c | 2 ++ 2 files changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/i915/gt/intel_engine_cs.c +0 -1
@@ -558,7 +558,6 @@ static int intel_engine_setup(struct intel_gt *gt, enum intel_engine_id id,DRIVER_CAPS (i915)->has_logical_contexts = true;ewma__engine_latency_init (&engine->latency); -seqcount_init (&engine->stats.execlists.lock);ATOMIC_INIT_NOTIFIER_HEAD (&engine->context_status_notifier);
drivers/gpu/drm/i915/gt/intel_execlists_submission.c +2 -0
@@ -3550,6 +3550,8 @@ int intel_execlists_submission_setup(struct intel_engine_cs *engine)logical_ring_default_vfuncs (engine);logical_ring_default_irqs (engine); +seqcount_init (&engine->stats.execlists.lock); +if (engine->flags &I915_ENGINE_HAS_RCS_REG_STATE )rcs_submission_override (engine);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 97/321 drm/virtio: clean out_fence on complete_submit
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: José Pekkarinen <[email protected]>
[ Upstream commit 4556b93f6c026c62c93e7acc22838224ac2e2eba ]
The removed line prevents the following cleanup function to execute a dma_fence_put on the out_fence to free its memory, producing the following output in kmemleak:
unreferenced object 0xffff888126d8ee00 (size 128):
comm "kwin_wayland", pid 981, jiffies 4295380296 (age 390.060s) hex dump (first 32 bytes):
c8 a1 c2 27 81 88 ff ff e0 14 a9 c0 ff ff ff ff ...'............
30 1a e1 2e a6 00 00 00 28 fc 5b 17 81 88 ff ff 0.......(.[.....
backtrace:
[<0000000011655661>] kmalloc_trace+0x26/0xa0
[<0000000055f15b82>] virtio_gpu_fence_alloc+0x47/0xc0 [virtio_gpu]
[<00000000fa6d96f9>] virtio_gpu_execbuffer_ioctl+0x1a8/0x800 [virtio_gpu]
[<00000000e6cb5105>] drm_ioctl_kernel+0x169/0x240 [drm]
[<000000005ad33e27>] drm_ioctl+0x399/0x6b0 [drm]
[<00000000a19dbf65>] __x64_sys_ioctl+0xc5/0x100
[<0000000011fa801e>] do_syscall_64+0x5b/0xc0
[<0000000065c76d8a>] entry_SYSCALL_64_after_hwframe+0x6e/0xd8
unreferenced object 0xffff888121930500 (size 128):
comm "kwin_wayland", pid 981, jiffies 4295380313 (age 390.096s)
hex dump (first 32 bytes):
c8 a1 c2 27 81 88 ff ff e0 14 a9 c0 ff ff ff ff ...'............
f9 ec d7 2f a6 00 00 00 28 fc 5b 17 81 88 ff ff .../....(.[.....
backtrace:
[<0000000011655661>] kmalloc_trace+0x26/0xa0
[<0000000055f15b82>] virtio_gpu_fence_alloc+0x47/0xc0 [virtio_gpu]
[<00000000fa6d96f9>] virtio_gpu_execbuffer_ioctl+0x1a8/0x800 [virtio_gpu]
[<00000000e6cb5105>] drm_ioctl_kernel+0x169/0x240 [drm]
[<000000005ad33e27>] drm_ioctl+0x399/0x6b0 [drm]
[<00000000a19dbf65>] __x64_sys_ioctl+0xc5/0x100
[<0000000011fa801e>] do_syscall_64+0x5b/0xc0
[<0000000065c76d8a>] entry_SYSCALL_64_after_hwframe+0x6e/0xd8[...]
This memleak will grow quickly, being possible to see the following line in dmesg after few minutes of life in the virtual machine:
[ 706.217388] kmemleak: 10731 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
The patch will remove the line to allow the cleanup function do its job.
--- drivers/gpu/drm/virtio/virtgpu_submit.c | 1 - 1 file changed, 1 deletion(-)
drivers/gpu/drm/virtio/virtgpu_submit.c +0 -1
@@ -147,7 +147,6 @@ static void virtio_gpu_complete_submit(struct virtio_gpu_submit *submit) submit->buf =NULL ; submit->buflist =NULL ; submit->sync_file =NULL ; - submit->out_fence =NULL ; submit->out_fence_fd =-1 ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 98/321 locking/seqlock: Do the lockdep annotation before locking in do_write_seqcount_begin_nested()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit 41b43b6c6e30a832c790b010a06772e793bca193 ]
It was brought up by Tetsuo that the following sequence:
write_seqlock_irqsave()
printk_deferred_enter()
could lead to a deadlock if the lockdep annotation within write_seqlock_irqsave() triggers.
The problem is that the sequence counter is incremented before the lockdep annotation is performed. The lockdep splat would then attempt to invoke printk() but the reader side, of the same seqcount, could have a tty_port::lock acquired waiting for the sequence number to become even again.
The other lockdep annotations come before the actual locking because "we want to see the locking error before it happens". There is no reason why seqcount should be different here.
Do the lockdep annotation first then perform the locking operation (the sequence increment).
--- include/linux/seqlock.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/seqlock.h +1 -1
@@ -512,8 +512,8 @@ do { \static inline void do_write_seqcount_begin_nested (seqcount_t *s,int subclass) { -do_raw_write_seqcount_begin (s);seqcount_acquire (&s->dep_map, subclass,0 , _RET_IP_); +do_raw_write_seqcount_begin (s); }/**
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 99/321 net: ena: Flush XDP packets on error.
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit 6f411fb5ca9419090bee6a0a46425e0a5060b734 ]
xdp_do_flush() should be invoked before leaving the NAPI poll function after a XDP-redirect. This is not the case if the driver leaves via the error path (after having a redirect in one of its previous iterations).
Invoke xdp_do_flush() also in the error path.
--- drivers/net/ethernet/amazon/ena/ena_netdev.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/amazon/ena/ena_netdev.c +3 -0
@@ -1833,6 +1833,9 @@ static int ena_clean_rx_irq(struct ena_ring *rx_ring, struct napi_struct *napi,return work_done; error: +if (xdp_flags &ENA_XDP_REDIRECT ) +xdp_do_flush (); + adapter =netdev_priv (rx_ring->netdev);if (rc == -ENOSPC ) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 100/321 bnxt_en: Flush XDP for bnxt_poll_nitroa0()s NAPI
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit edc0140cc3b7b91874ebe70eb7d2a851e8817ccc ]
bnxt_poll_nitroa0() invokes bnxt_rx_pkt() which can run a XDP program which in turn can return XDP_REDIRECT. bnxt_rx_pkt() is also used by __bnxt_poll_work() which flushes (xdp_do_flush()) the packets after each round. bnxt_poll_nitroa0() lacks this feature. xdp_do_flush() should be invoked before leaving the NAPI callback.
Invoke xdp_do_flush() after a redirect in bnxt_poll_nitroa0() NAPI.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +5 -0
@@ -2626,6 +2626,7 @@ static int bnxt_poll_nitroa0(struct napi_struct *napi, int budget)struct rx_cmp_ext *rxcmp1;u32 cp_cons, tmp_raw_cons;u32 raw_cons = cpr->cp_raw_cons; +bool flush_xdp = false;u32 rx_pkts =0 ;u8 event =0 ;
@@ -2660,6 +2661,8 @@ static int bnxt_poll_nitroa0(struct napi_struct *napi, int budget) rx_pkts++; else if (rc == -EBUSY) /* partial completion */ break; +if (event &BNXT_REDIRECT_EVENT ) + flush_xdp = true; }else if (unlikely (TX_CMP_TYPE (txcmp) ==CMPL_BASE_TYPE_HWRM_DONE )) {bnxt_hwrm_handler (bp, txcmp);
@@ -2679,6 +2682,8 @@ static int bnxt_poll_nitroa0(struct napi_struct *napi, int budget)if (event &BNXT_AGG_EVENT )bnxt_db_write (bp, &rxr->rx_agg_db, rxr->rx_agg_prod); +if (flush_xdp) +xdp_do_flush ();if (!bnxt_has_work (bp, cpr) && rx_pkts < budget) {napi_complete_done (napi, rx_pkts);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 101/321 octeontx2-pf: Do xdp_do_flush() after redirects.
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <[email protected]>
[ Upstream commit 70b2b6892645e58ed6f051dad7f8d1083f0ad553 ]
xdp_do_flush() should be invoked before leaving the NAPI poll function if XDP-redirect has been performed.
Invoke xdp_do_flush() before leaving NAPI.
--- .../marvell/octeontx2/nic/otx2_txrx.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c +13 -6
@@ -29,7 +29,8 @@static bool otx2_xdp_rcv_pkt_handler (struct otx2_nic *pfvf,struct bpf_prog *prog,struct nix_cqe_rx_s *cqe, -struct otx2_cq_queue *cq); +struct otx2_cq_queue *cq, +bool *need_xdp_flush);static int otx2_nix_cq_op_status (struct otx2_nic *pfvf,struct otx2_cq_queue *cq)
@@ -337,7 +338,7 @@ static bool otx2_check_rcv_errors(struct otx2_nic *pfvf,static void otx2_rcv_pkt_handler (struct otx2_nic *pfvf,struct napi_struct *napi,struct otx2_cq_queue *cq, -struct nix_cqe_rx_s *cqe) +struct nix_cqe_rx_s *cqe,bool *need_xdp_flush) {struct nix_rx_parse_s *parse = &cqe->parse;struct nix_rx_sg_s *sg = &cqe->sg;
@@ -353,7 +354,7 @@ static void otx2_rcv_pkt_handler(struct otx2_nic *pfvf, }if (pfvf->xdp_prog) -if (otx2_xdp_rcv_pkt_handler (pfvf, pfvf->xdp_prog, cqe, cq)) +if (otx2_xdp_rcv_pkt_handler (pfvf, pfvf->xdp_prog, cqe, cq, need_xdp_flush))return ; skb =napi_get_frags (napi);
@@ -388,6 +389,7 @@ static int otx2_rx_napi_handler(struct otx2_nic *pfvf,struct napi_struct *napi, struct otx2_cq_queue *cq, int budget) { + bool need_xdp_flush = false;struct nix_cqe_rx_s *cqe;int processed_cqe =0 ;
@@ -409,13 +411,15 @@ static int otx2_rx_napi_handler(struct otx2_nic *pfvf, cq->cq_head++; cq->cq_head &= (cq->cqe_cnt -1 ); -otx2_rcv_pkt_handler (pfvf, napi, cq, cqe); +otx2_rcv_pkt_handler (pfvf, napi, cq, cqe, &need_xdp_flush); cqe->hdr.cqe_type =NIX_XQE_TYPE_INVALID ; cqe->sg.seg_addr =0x00 ; processed_cqe++; cq->pend_cqe--; } +if (need_xdp_flush) +xdp_do_flush ();/* Free CQEs to HW */ otx2_write64(pfvf, NIX_LF_CQ_OP_DOOR,
@@ -1354,7 +1358,8 @@ bool otx2_xdp_sq_append_pkt(struct otx2_nic *pfvf, u64 iova, int len, u16 qidx)static bool otx2_xdp_rcv_pkt_handler (struct otx2_nic *pfvf,struct bpf_prog *prog,struct nix_cqe_rx_s *cqe, -struct otx2_cq_queue *cq) +struct otx2_cq_queue *cq, +bool *need_xdp_flush) {unsigned char *hard_start, *data;int qidx = cq->cq_idx;
@@ -1391,8 +1396,10 @@ static bool otx2_xdp_rcv_pkt_handler(struct otx2_nic *pfvf,otx2_dma_unmap_page (pfvf, iova, pfvf->rbsize,DMA_FROM_DEVICE ); -if (!err) +if (!err) { + *need_xdp_flush = true;return true; + }put_page (page);break ;default :
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 102/321 igc: Expose tx-usecs coalesce setting to user
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Muhammad Husaini Zulkifli <[email protected]>
[ Upstream commit 1703b2e0de653b459ca6230be32ce7f2ea0ae7ee ]
When users attempt to obtain the coalesce setting using the ethtool command, current code always returns 0 for tx-usecs. This is because I225/6 always uses a queue pair setting, hence tx_coalesce_usecs does not return a value during the igc_ethtool_get_coalesce() callback process. The pair queue condition checking in igc_ethtool_get_coalesce() is removed by this patch so that the user gets information of the value of tx-usecs.
Even if i225/6 is using queue pair setting, there is no harm in notifying the user of the tx-usecs. The implementation of the current code may have previously been a copy of the legacy code i210. Since I225 has the queue pair setting enabled, tx-usecs will always adhere to the user-set rx-usecs value. An error message will appear when the user attempts to set the tx-usecs value for the input parameters because, by default, they should only set the rx-usecs value.
This patch also adds the helper function to get the previous rx coalesce value similar to tx coalesce.
How to test:
User can get the coalesce value using ethtool command.
Example command:
Get: ethtool -c <interface>
Previous output:
rx-usecs: 3
rx-frames: n/a
rx-usecs-irq: n/a
rx-frames-irq: n/a
tx-usecs: 0
tx-frames: n/a
tx-usecs-irq: n/a
tx-frames-irq: n/a
New output:
rx-usecs: 3
rx-frames: n/a
rx-usecs-irq: n/a
rx-frames-irq: n/a
tx-usecs: 3
tx-frames: n/a
tx-usecs-irq: n/a
tx-frames-irq: n/a
--- drivers/net/ethernet/intel/igc/igc_ethtool.c | 31 ++++++++++++-------- 1 file changed, 19 insertions(+), 12 deletions(-)
drivers/net/ethernet/intel/igc/igc_ethtool.c +19 -12
@@ -868,6 +868,18 @@ static void igc_ethtool_get_stats(struct net_device *netdev,spin_unlock (&adapter->stats64_lock); } +static int igc_ethtool_get_previous_rx_coalesce (struct igc_adapter *adapter) +{ +return (adapter->rx_itr_setting <=3 ) ? + adapter->rx_itr_setting : adapter->rx_itr_setting >>2 ; +} + +static int igc_ethtool_get_previous_tx_coalesce (struct igc_adapter *adapter) +{ +return (adapter->tx_itr_setting <=3 ) ? + adapter->tx_itr_setting : adapter->tx_itr_setting >>2 ; +} + static int igc_ethtool_get_coalesce(struct net_device *netdev, struct ethtool_coalesce *ec, struct kernel_ethtool_coalesce *kernel_coal,
@@ -875,17 +887,8 @@ static int igc_ethtool_get_coalesce(struct net_device *netdev, {struct igc_adapter *adapter =netdev_priv (netdev); -if (adapter->rx_itr_setting <=3 ) - ec->rx_coalesce_usecs = adapter->rx_itr_setting; -else - ec->rx_coalesce_usecs = adapter->rx_itr_setting >>2 ; - -if (!(adapter->flags &IGC_FLAG_QUEUE_PAIRS )) { -if (adapter->tx_itr_setting <=3 ) - ec->tx_coalesce_usecs = adapter->tx_itr_setting; -else - ec->tx_coalesce_usecs = adapter->tx_itr_setting >>2 ; - } + ec->rx_coalesce_usecs =igc_ethtool_get_previous_rx_coalesce (adapter); + ec->tx_coalesce_usecs =igc_ethtool_get_previous_tx_coalesce (adapter);return 0 ; }
@@ -910,8 +913,12 @@ static int igc_ethtool_set_coalesce(struct net_device *netdev, ec->tx_coalesce_usecs == 2)return -EINVAL ; -if ((adapter->flags &IGC_FLAG_QUEUE_PAIRS ) && ec->tx_coalesce_usecs) +if ((adapter->flags &IGC_FLAG_QUEUE_PAIRS ) && + ec->tx_coalesce_usecs !=igc_ethtool_get_previous_tx_coalesce (adapter)) { +NL_SET_ERR_MSG_MOD (extack, +"Queue Pair mode enabled, both Rx and Tx coalescing controlled by rx-usecs" );return -EINVAL ; + }/* If ITR is disabled, disable DMAC */ if (ec->rx_coalesce_usecs ==0 ) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 103/321 cxl/region: Match auto-discovered region decoders by HPA range
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alison Schofield <[email protected]>
[ Upstream commit 9e4edf1a2196fa4bea6e8201f166785bd066446a ]
Currently, when the region driver attaches a region to a port, it selects the ports next available decoder to program.
With the addition of auto-discovered regions, a port decoder has already been programmed so grabbing the next available decoder can be a mismatch when there is more than one region using the port.
The failure appears like this with CXL DEBUG enabled:
[] cxl_core:alloc_region_ref:754: cxl region0: endpoint9: HPA order violation region0:[mem 0x14780000000-0x1478fffffff flags 0x200] vs [mem 0x880000000-0x185fffffff flags 0x200] [] cxl_core:cxl_port_attach_region:972: cxl region0: endpoint9: failed to allocate region reference
When CXL DEBUG is not enabled, there is no failure message. The region just never materializes. Users can suspect this issue if they know their firmware has programmed decoders so that more than one region is using a port. Note that the problem may appear intermittently, ie not on every reboot.
Add a matching method for auto-discovered regions that finds a decoder based on an HPA range. The decoder range must exactly match the region resource parameter.
--- drivers/cxl/core/region.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-)
drivers/cxl/core/region.c +23 -1
@@ -717,13 +717,35 @@ static int match_free_decoder(struct device *dev, void *data)return 0 ; } +static int match_auto_decoder (struct device *dev,void *data) +{ +struct cxl_region_params *p = data; +struct cxl_decoder *cxld; +struct range *r; + +if (!is_switch_decoder (dev)) +return 0 ; + + cxld =to_cxl_decoder (dev); + r = &cxld->hpa_range; + +if (p->res && p->res->start == r->start && p->res->end == r->end) +return 1 ; + +return 0 ; +} +static struct cxl_decoder *cxl_region_find_decoder (struct cxl_port *port,struct cxl_region *cxlr) {struct device *dev;int id =0 ; - dev =device_find_child (&port->dev, &id, match_free_decoder); +if (test_bit (CXL_REGION_F_AUTO , &cxlr->flags)) + dev =device_find_child (&port->dev, &cxlr->params, + match_auto_decoder); +else + dev =device_find_child (&port->dev, &id, match_free_decoder);if (!dev)return NULL ;/*
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 104/321 proc: nommu: /proc/<pid>/maps: release mmap read lock
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Wolsieffer <[email protected]>
[ Upstream commit 578d7699e5c2add8c2e9549d9d75dfb56c460cb3 ]
The no-MMU implementation of /proc/<pid>/map doesn't normally release the mmap read lock, because it uses !IS_ERR_OR_NULL(_vml) to determine whether to release the lock. Since _vml is NULL when the end of the mappings is reached, the lock is not released.
Reading /proc/1/maps twice doesn't cause a hang because it only takes the read lock, which can be taken multiple times and therefore doesn't show any problem if the lock isn't released. Instead, you need to perform some operation that attempts to take the write lock after reading /proc/<pid>/maps. To actually reproduce the bug, compile the following code as 'proc_maps_bug':
#include <stdio.h>
#include <unistd.h>
#include <sys/mman.h>
int main(int argc, char *argv[]) {
void *buf;
sleep(1);
buf = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
puts("mmap returned");
return 0;
}Then, run:
./proc_maps_bug &; cat /proc/$!/maps; fg
Without this patch, mmap() will hang and the command will never complete.
This code was incorrectly adapted from the MMU implementation, which at the time released the lock in m_next() before returning the last entry.
The MMU implementation has diverged further from the no-MMU version since then, so this patch brings their locking and error handling into sync, fixing the bug and hopefully avoiding similar issues in the future.
Stable-dep-of: fe4419801617 ("proc: nommu: fix empty /proc/<pid>/maps")
--- fs/proc/task_nommu.c | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-)
fs/proc/task_nommu.c +15 -12
@@ -205,11 +205,16 @@ static void *m_start(struct seq_file *m, loff_t *pos)return ERR_PTR (-ESRCH ); mm = priv->mm; -if (!mm || !mmget_not_zero (mm)) +if (!mm || !mmget_not_zero (mm)) { +put_task_struct (priv->task); + priv->task =NULL ;return NULL ; + }if (mmap_read_lock_killable (mm)) {mmput (mm); +put_task_struct (priv->task); + priv->task =NULL ;return ERR_PTR (-EINTR ); }
@@ -218,23 +223,21 @@ static void *m_start(struct seq_file *m, loff_t *pos)if (vma)return vma; -mmap_read_unlock (mm); -mmput (mm);return NULL ; } -static void m_stop (struct seq_file *m,void *_vml) +static void m_stop (struct seq_file *m,void *v) {struct proc_maps_private *priv = m->private; +struct mm_struct *mm = priv->mm; -if (!IS_ERR_OR_NULL (_vml)) { -mmap_read_unlock (priv->mm); -mmput (priv->mm); - } -if (priv->task) { -put_task_struct (priv->task); - priv->task =NULL ; - } +if (!priv->task) +return ; + +mmap_read_unlock (mm); +mmput (mm); +put_task_struct (priv->task); + priv->task =NULL ; }static void *m_next (struct seq_file *m,void *_p,loff_t *pos)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 105/321 proc: nommu: fix empty /proc/<pid>/maps
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Wolsieffer <[email protected]>
[ Upstream commit fe4419801617514765974f3e796269bc512ad146 ]
On no-MMU, /proc/<pid>/maps reads as an empty file. This happens because find_vma(mm, 0) always returns NULL (assuming no vma actually contains the zero address, which is normally the case).
To fix this bug and improve the maintainability in the future, this patch makes the no-MMU implementation as similar as possible to the MMU implementation.
The only remaining differences are the lack of hold/release_task_mempolicy and the extra code to shoehorn the gate vma into the iterator.
This has been tested on top of 6.5.3 on an STM32F746.
--- fs/proc/internal.h | 2 -- fs/proc/task_nommu.c | 37 ++++++++++++++++++++++--------------- 2 files changed, 22 insertions(+), 17 deletions(-)
fs/proc/internal.h +0 -2
@@ -289,9 +289,7 @@ struct proc_maps_private {struct inode *inode;struct task_struct *task;struct mm_struct *mm; -#ifdef CONFIG_MMU struct vma_iterator iter; -#endif #ifdef CONFIG_NUMA struct mempolicy *task_mempolicy;#endif
fs/proc/task_nommu.c +22 -15
@@ -188,15 +188,28 @@ static int show_map(struct seq_file *m, void *_p)return nommu_vma_show (m, _p); } -static void *m_start (struct seq_file *m,loff_t *pos) +static struct vm_area_struct *proc_get_vma (struct proc_maps_private *priv, +loff_t *ppos) +{ +struct vm_area_struct *vma =vma_next (&priv->iter); + +if (vma) { + *ppos = vma->vm_start; + }else { + *ppos =-1UL ; + } + +return vma; +} + +static void *m_start (struct seq_file *m,loff_t *ppos) {struct proc_maps_private *priv = m->private; +unsigned long last_addr = *ppos;struct mm_struct *mm; -struct vm_area_struct *vma; -unsigned long addr = *pos; -/* See m_next(). Zero at the start or after lseek. */ -if (addr ==-1UL ) +/* See proc_get_vma(). Zero at the start or after lseek. */ +if (last_addr ==-1UL )return NULL ;/* pin the task and mm whilst we play with them */
@@ -218,12 +231,9 @@ static void *m_start(struct seq_file *m, loff_t *pos)return ERR_PTR (-EINTR ); } -/* start the next element from addr */ - vma =find_vma (mm, addr); -if (vma) -return vma; +vma_iter_init (&priv->iter, mm, last_addr); -return NULL ; +return proc_get_vma (priv, ppos); }static void m_stop (struct seq_file *m,void *v)
@@ -240,12 +250,9 @@ static void m_stop(struct seq_file *m, void *v) priv->task =NULL ; } -static void *m_next (struct seq_file *m,void *_p,loff_t *pos) +static void *m_next (struct seq_file *m,void *_p,loff_t *ppos) { -struct vm_area_struct *vma = _p; - - *pos = vma->vm_end; -return find_vma (vma->vm_mm, vma->vm_end); +return proc_get_vma (m->private, ppos); }static const struct seq_operations proc_pid_maps_ops = {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 106/321 cifs: Fix UAF in cifs_demultiplex_thread()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Xiaoxu <[email protected]>
[ Upstream commit d527f51331cace562393a8038d870b3e9916686f ]
There is a UAF when xfstests on cifs:
BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 by task cifsd/923 CPU: 1 PID: 923 Comm: cifsd Not tainted 6.1.0-rc4+ #45 ... Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 kasan_check_range+0x145/0x1a0 smb2_is_network_name_deleted+0x27/0x160 cifs_demultiplex_thread.cold+0x172/0x5a4 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 </TASK> Allocated by task 923: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_slab_alloc+0x54/0x60 kmem_cache_alloc+0x147/0x320 mempool_alloc+0xe1/0x260 cifs_small_buf_get+0x24/0x60 allocate_buffers+0xa1/0x1c0 cifs_demultiplex_thread+0x199/0x10d0 kthread+0x165/0x1a0 ret_from_fork+0x1f/0x30 Freed by task 921: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x143/0x1b0 kmem_cache_free+0xe3/0x4d0 cifs_small_buf_release+0x29/0x90 SMB2_negotiate+0x8b7/0x1c60 smb2_negotiate+0x51/0x70 cifs_negotiate_protocol+0xf0/0x160 cifs_get_smb_ses+0x5fa/0x13c0 mount_get_conns+0x7a/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0
The UAF is because:
mount(pid: 921) | cifsd(pid: 923)
-------------------------------|-------------------------------
| cifs_demultiplex_thread
SMB2_negotiate |
cifs_send_recv |
compound_send_recv |
smb_send_rqst |
wait_for_response |
wait_event_state [1] |
| standard_receive3
| cifs_handle_standard
| handle_mid
| mid->resp_buf = buf; [2]
| dequeue_mid [3]
KILL the process [4] |
resp_iov[i].iov_base = buf |
free_rsp_buf [5] |
| is_network_name_deleted [6]
| callback1. After send request to server, wait the response until
mid->mid_state != SUBMITTED;
2. Receive response from server, and set it to mid;
3. Set the mid state to RECEIVED;
4. Kill the process, the mid state already RECEIVED, get 0;
5. Handle and release the negotiate response;
6. UAF.
It can be easily reproduce with add some delay in [3] - [6].
Only sync call has the problem since async call's callback is executed in cifsd process.
Add an extra state to mark the mid state to READY before wakeup the waitter, then it can get the resp safely.
--- fs/smb/client/cifsglob.h | 1 + fs/smb/client/transport.c | 34 +++++++++++++++++++++++----------- 2 files changed, 24 insertions(+), 11 deletions(-)
fs/smb/client/cifsglob.h +1 -0
@@ -1776,6 +1776,7 @@ static inline bool is_retryable_error(int error)#define MID_RETRY_NEEDED 8/* session closed while this request out */ #define MID_RESPONSE_MALFORMED 0x10#define MID_SHUTDOWN 0x20 +#define MID_RESPONSE_READY 0x40/* ready for other process handle the rsp */ /* Flags */ #define MID_WAIT_CANCELLED 1/* Cancelled while waiting for response */
fs/smb/client/transport.c +23 -11
@@ -35,6 +35,8 @@void cifs_wake_up_task (struct mid_q_entry *mid) { +if (mid->mid_state ==MID_RESPONSE_RECEIVED ) + mid->mid_state =MID_RESPONSE_READY ;wake_up_process (mid->callback_data); }
@@ -87,7 +89,8 @@ static void __release_mid(struct kref *refcount)struct TCP_Server_Info *server = midEntry->server;if (midEntry->resp_buf && (midEntry->mid_flags &MID_WAIT_CANCELLED ) && - midEntry->mid_state ==MID_RESPONSE_RECEIVED && + (midEntry->mid_state ==MID_RESPONSE_RECEIVED || + midEntry->mid_state ==MID_RESPONSE_READY ) && server->ops->handle_cancelled_mid) server->ops->handle_cancelled_mid (midEntry, server);
@@ -732,7 +735,8 @@ wait_for_response(struct TCP_Server_Info *server, struct mid_q_entry *midQ)int error; error =wait_event_state (server->response_q, - midQ->mid_state !=MID_REQUEST_SUBMITTED , + midQ->mid_state !=MID_REQUEST_SUBMITTED && + midQ->mid_state !=MID_RESPONSE_RECEIVED , (TASK_KILLABLE |TASK_FREEZABLE_UNSAFE ));if (error <0 )return -ERESTARTSYS ;
@@ -885,7 +889,7 @@ cifs_sync_mid_result(struct mid_q_entry *mid, struct TCP_Server_Info *server)spin_lock (&server->mid_lock);switch (mid->mid_state) { -case MID_RESPONSE_RECEIVED : +case MID_RESPONSE_READY :spin_unlock (&server->mid_lock);return rc;case MID_RETRY_NEEDED :
@@ -984,6 +988,9 @@ cifs_compound_callback(struct mid_q_entry *mid) credits.instance = server->reconnect_instance;add_credits (server, &credits, mid->optype); + +if (mid->mid_state ==MID_RESPONSE_RECEIVED ) + mid->mid_state =MID_RESPONSE_READY ; } static void
@@ -1204,7 +1211,8 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses,send_cancel (server, &rqst[i], midQ[i]);spin_lock (&server->mid_lock); midQ[i]->mid_flags |=MID_WAIT_CANCELLED ; -if (midQ[i]->mid_state ==MID_REQUEST_SUBMITTED ) { +if (midQ[i]->mid_state ==MID_REQUEST_SUBMITTED || + midQ[i]->mid_state ==MID_RESPONSE_RECEIVED ) { midQ[i]->callback = cifs_cancelled_callback; cancelled_mid[i] = true; credits[i].value =0 ;
@@ -1225,7 +1233,7 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, }if (!midQ[i]->resp_buf || - midQ[i]->mid_state !=MID_RESPONSE_RECEIVED ) { + midQ[i]->mid_state !=MID_RESPONSE_READY ) { rc = -EIO ;cifs_dbg (FYI ,"Bad MID state?\n" ); goto out;
@@ -1412,7 +1420,8 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses,if (rc !=0 ) {send_cancel (server, &rqst, midQ);spin_lock (&server->mid_lock); -if (midQ->mid_state ==MID_REQUEST_SUBMITTED ) { +if (midQ->mid_state ==MID_REQUEST_SUBMITTED || + midQ->mid_state ==MID_RESPONSE_RECEIVED ) {/* no longer considered to be "in-flight" */ midQ->callback = release_mid;spin_unlock (&server->mid_lock);
@@ -1429,7 +1438,7 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, }if (!midQ->resp_buf || !out_buf || - midQ->mid_state !=MID_RESPONSE_RECEIVED ) { + midQ->mid_state !=MID_RESPONSE_READY ) { rc = -EIO ;cifs_server_dbg (VFS ,"Bad MID state?\n" ); goto out;
@@ -1553,14 +1562,16 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,/* Wait for a reply - allow signals to interrupt. */ rc =wait_event_interruptible (server->response_q, - (!(midQ->mid_state ==MID_REQUEST_SUBMITTED )) || + (!(midQ->mid_state ==MID_REQUEST_SUBMITTED || + midQ->mid_state ==MID_RESPONSE_RECEIVED )) || ((server->tcpStatus != CifsGood) && (server->tcpStatus != CifsNew)));/* Were we interrupted by a signal ? */ spin_lock (&server->srv_lock);if ((rc == -ERESTARTSYS ) && - (midQ->mid_state ==MID_REQUEST_SUBMITTED ) && + (midQ->mid_state ==MID_REQUEST_SUBMITTED || + midQ->mid_state ==MID_RESPONSE_RECEIVED ) && ((server->tcpStatus == CifsGood) || (server->tcpStatus == CifsNew))) {spin_unlock (&server->srv_lock);
@@ -1591,7 +1602,8 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,if (rc) {send_cancel (server, &rqst, midQ);spin_lock (&server->mid_lock); -if (midQ->mid_state ==MID_REQUEST_SUBMITTED ) { +if (midQ->mid_state ==MID_REQUEST_SUBMITTED || + midQ->mid_state ==MID_RESPONSE_RECEIVED ) {/* no longer considered to be "in-flight" */ midQ->callback = release_mid;spin_unlock (&server->mid_lock);
@@ -1611,7 +1623,7 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon,return rc;/* rcvd frame is ok */ -if (out_buf ==NULL || midQ->mid_state !=MID_RESPONSE_RECEIVED ) { +if (out_buf ==NULL || midQ->mid_state !=MID_RESPONSE_READY ) { rc = -EIO ;cifs_tcon_dbg (VFS ,"Bad MID state?\n" ); goto out;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 107/321 gpio: tb10x: Fix an error handling path in tb10x_gpio_probe()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit b547b5e52a0587e6b25ea520bf2f9e03d00cbcb6 ]
If an error occurs after a successful irq_domain_add_linear() call, it should be undone by a corresponding irq_domain_remove(), as already done in the remove function.
--- drivers/gpio/gpio-tb10x.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/gpio/gpio-tb10x.c +5 -1
@@ -195,7 +195,7 @@ static int tb10x_gpio_probe(struct platform_device *pdev) handle_edge_irq,IRQ_NOREQUEST ,IRQ_NOPROBE , IRQ_GC_INIT_MASK_CACHE);if (ret) -return ret; + goto err_remove_domain; gc = tb10x_gpio->domain->gc->gc[0 ]; gc->reg_base = tb10x_gpio->base;
@@ -209,6 +209,10 @@ static int tb10x_gpio_probe(struct platform_device *pdev) }return 0 ; + +err_remove_domain: +irq_domain_remove (tb10x_gpio->domain); +return ret; }static int tb10x_gpio_remove (struct platform_device *pdev)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 108/321 i2c: mux: demux-pinctrl: check the return value of devm_kstrdup()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaoke Wang <[email protected]>
[ Upstream commit 7c0195fa9a9e263df204963f88a22b21688ffb66 ]
devm_kstrdup() returns pointer to allocated string on success, NULL on failure. So it is better to check the return value of it.
--- drivers/i2c/muxes/i2c-demux-pinctrl.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/i2c/muxes/i2c-demux-pinctrl.c +4 -0
@@ -243,6 +243,10 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev) props[i].name =devm_kstrdup (&pdev->dev,"status" ,GFP_KERNEL ); props[i].value =devm_kstrdup (&pdev->dev,"ok" ,GFP_KERNEL ); +if (!props[i].name || !props[i].value) { + err = -ENOMEM ; + goto err_rollback; + } props[i].length =3 ;of_changeset_init (&priv->chan[i].chgset);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 109/321 i2c: mux: gpio: Add missing fwnode_handle_put()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liang He <[email protected]>
[ Upstream commit db6aee6083a56ac4a6cd1b08fff7938072bcd0a3 ]
In i2c_mux_gpio_probe_fw(), we should add fwnode_handle_put() when break out of the iteration device_for_each_child_node() as it will automatically increase and decrease the refcounter.
--- drivers/i2c/muxes/i2c-mux-gpio.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/i2c/muxes/i2c-mux-gpio.c +3 -1
@@ -105,8 +105,10 @@ static int i2c_mux_gpio_probe_fw(struct gpiomux *mux, }else if (is_acpi_node (child)) { rc =acpi_get_local_address (ACPI_HANDLE_FWNODE (child), values + i); -if (rc) +if (rc) { +fwnode_handle_put (child);return dev_err_probe (dev, rc,"Cannot get address\n" ); + } } i++;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 110/321 i2c: xiic: Correct return value check for xiic_reinit()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Scally <[email protected]>
[ Upstream commit 59851fb05d759f13662be143eff0aae605815b0e ]
The error paths for xiic_reinit() return negative values on failure and 0 on success - this error message therefore is triggered on _success_ rather than failure. Correct the condition so it's only shown on failure as intended.
--- drivers/i2c/busses/i2c-xiic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-xiic.c +1 -1
@@ -710,7 +710,7 @@ static irqreturn_t xiic_process(int irq, void *dev_id)* reset the IP instead of just flush fifos */ ret =xiic_reinit (i2c); -if (!ret) +if (ret <0 )dev_dbg (i2c->adap.dev.parent,"reinit failed\n" );if (i2c->rx_msg) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 111/321 drm/amdgpu: set completion status as preempted for the resubmission
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiadong Zhu <[email protected]>
[ Upstream commit 8cbbd11547f61b90b33a4ef70c4614eb2e789c49 ]
The driver's CSA buffer is shared by all the ibs. When the high priority ib is submitted after the preempted ib, CP overrides the ib_completion_status as completed in the csa buffer. After that the preempted ib is resubmitted, CP would clear some locals stored for ib resume when reading the completed status, which causes gpu hang in some cases.
Always set status as preempted for those resubmitted ib instead of reading everything from the CSA buffer.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ring_mux.h | 9 +++++++++ drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 +++ 2 files changed, 12 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_ring_mux.h +9 -0
@@ -56,6 +56,15 @@ enum amdgpu_ring_mux_offset_type { AMDGPU_MUX_OFFSET_TYPE_CE, }; +enum ib_complete_status { +/* IB not started/reset value, default value. */ +IB_COMPLETION_STATUS_DEFAULT =0 , +/* IB preempted, started but not completed. */ +IB_COMPLETION_STATUS_PREEMPTED =1 , +/* IB completed. */ +IB_COMPLETION_STATUS_COMPLETED =2 , +}; +struct amdgpu_ring_mux {struct amdgpu_ring *real_ring;
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +3 -0
@@ -5230,6 +5230,9 @@ static void gfx_v9_0_ring_patch_de_meta(struct amdgpu_ring *ring, de_payload_cpu_addr = adev->virt.csa_cpu_addr + payload_offset; } + ((struct v9_de_ib_state *)de_payload_cpu_addr)->ib_completion_status = +IB_COMPLETION_STATUS_PREEMPTED ; +if (offset + (payload_size >>2 ) <= ring->buf_mask +1 ) {memcpy ((void *)&ring->ring[offset], de_payload_cpu_addr, payload_size); }else {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 112/321 ASoC: cs35l56: Disable low-power hibernation mode
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
commit 18789be8e0d9fbb78b2290dcf93f500726ed19f0 upstream.
Do not allow the CS35L56 to be put into its lowest power "hibernation" mode. This only affects I2C because "hibernation" is already disabled on SPI and SoundWire.
Recent firmwares need a different wake-up sequence. Until that sequence has been specified, the chip "hibernation" mode must be disabled otherwise it can intermittently fail to wake.
Backport note: This is the same change as upstream commit, to delete one line, but the upstream commit would not apply cleanly on older branches because of minor differences to the surrounding code.
--- sound/soc/codecs/cs35l56-i2c.c | 1 - 1 file changed, 1 deletion(-)
sound/soc/codecs/cs35l56-i2c.c +0 -1
@@ -27,7 +27,6 @@ static int cs35l56_i2c_probe(struct i2c_client *client)return -ENOMEM ; cs35l56->dev = dev; - cs35l56->can_hibernate = true;i2c_set_clientdata (client, cs35l56); cs35l56->regmap =devm_regmap_init_i2c (client, regmap_config);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 113/321 drm/amd/display: Update DPG test pattern programming
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenjing Liu <[email protected]>
[ Upstream commit ad4455c614b27e6b24a4e6bd70114545c1660ff9 ]
[Why]
Last ODM slice could be slightly larger than other slice because it can be including the residual.
[How]
Update DPG pattern programming sequence to use a different width for last odm slice.
Stable-dep-of: f77d1a49902b ("drm/amd/display: fix a regression in blank pixel data caused by coding mistake")
--- .../drm/amd/display/dc/dcn20/dcn20_hwseq.c | 45 ++++---- .../display/dc/link/accessories/link_dp_cts.c | 107 +++++++++--------- 2 files changed, 78 insertions(+), 74 deletions(-)
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +24 -21
@@ -1054,9 +1054,9 @@ void dcn20_blank_pixel_data(enum controller_dp_color_space test_pattern_color_space =CONTROLLER_DP_COLOR_SPACE_UDEFINED ;struct pipe_ctx *odm_pipe;int odm_cnt =1 ; - -int width = stream->timing.h_addressable + stream->timing.h_border_left + stream->timing.h_border_right; -int height = stream->timing.v_addressable + stream->timing.v_border_bottom + stream->timing.v_border_top; +int h_active = stream->timing.h_addressable + stream->timing.h_border_left + stream->timing.h_border_right; +int v_active = stream->timing.v_addressable + stream->timing.v_border_bottom + stream->timing.v_border_top; +int odm_slice_width, last_odm_slice_width, offset =0 ;if (stream->link->test_pattern_enabled)return ;
@@ -1066,8 +1066,8 @@ void dcn20_blank_pixel_data(for (odm_pipe = pipe_ctx->next_odm_pipe; odm_pipe; odm_pipe = odm_pipe->next_odm_pipe) odm_cnt++; - - width = width / odm_cnt; + odm_slice_width = h_active / odm_cnt; + last_odm_slice_width = h_active - odm_slice_width * (odm_cnt -1 );if (blank) { dc->hwss.set_abm_immediate_disable (pipe_ctx);
@@ -1080,29 +1080,32 @@ void dcn20_blank_pixel_data( test_pattern =CONTROLLER_DP_TEST_PATTERN_VIDEOMODE ; } - dc->hwss.set_disp_pattern_generator (dc, - pipe_ctx, - test_pattern, - test_pattern_color_space, - stream->timing.display_color_depth, - &black_color, - width, - height, -0 ); + odm_pipe = pipe_ctx; -for (odm_pipe = pipe_ctx->next_odm_pipe; odm_pipe; odm_pipe = odm_pipe->next_odm_pipe) { +while (odm_pipe->next_odm_pipe) { dc->hwss.set_disp_pattern_generator (dc, - odm_pipe, - dc->debug.visual_confirm !=VISUAL_CONFIRM_DISABLE && blank ? -CONTROLLER_DP_TEST_PATTERN_COLORRAMP : test_pattern, + pipe_ctx, + test_pattern, test_pattern_color_space, stream->timing.display_color_depth, &black_color, - width, - height, -0 ); + odm_slice_width, + v_active, + offset); + offset += odm_slice_width; + odm_pipe = odm_pipe->next_odm_pipe; } + dc->hwss.set_disp_pattern_generator (dc, + odm_pipe, + test_pattern, + test_pattern_color_space, + stream->timing.display_color_depth, + &black_color, + last_odm_slice_width, + v_active, + offset); +if (!blank && dc->debug.enable_single_display_2to1_odm_policy) {/* when exiting dynamic ODM need to reinit DPG state for unused pipes */ struct pipe_ctx *old_odm_pipe = dc->current_state->res_ctx.pipe_ctx[pipe_ctx->pipe_idx].next_odm_pipe;
drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c +54 -53
163 lines not on this page · raw message
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 114/321 drm/amd/display: fix a regression in blank pixel data caused by coding mistake
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenjing Liu <[email protected]>
[ Upstream commit f77d1a49902bc70625e3d101a16d8a687f7e97db ]
[why]
There was unfortunately a coding mistake. It gets caught with an ultrawide monitor that requires ODM 4:1 combine. We are blanking or unblanking pixel data we are supposed to enumerate through all ODM pipes and program DPG for each of those pipes. However the coding mistake causes us to program only the first and last ODM pipes.
--- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 2 +- drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +1 -1
@@ -1084,7 +1084,7 @@ void dcn20_blank_pixel_data(while (odm_pipe->next_odm_pipe) { dc->hwss.set_disp_pattern_generator(dc, - pipe_ctx, + odm_pipe, test_pattern, test_pattern_color_space, stream->timing.display_color_depth,
drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c +1 -1
@@ -513,7 +513,7 @@ static void set_crtc_test_pattern(struct dc_link *link, odm_opp = odm_pipe->stream_res.opp; odm_opp->funcs->opp_program_bit_depth_reduction (odm_opp, ¶ms); link->dc->hwss.set_disp_pattern_generator(link->dc, - pipe_ctx, + odm_pipe, controller_test_pattern, controller_color_space, color_depth,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 115/321 arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Pundir <[email protected]>
[ Upstream commit 110e70fccce4f22b53986ae797d665ffb1950aa6 ]
Adding a reserved memory region for the framebuffer memory (the splash memory region set up by the bootloader).
It fixes a kernel panic (arm-smmu: Unhandled context fault at this particular memory region) reported on DB845c running v5.10.y.
--- arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 9 +++++++++ 1 file changed, 9 insertions(+)
arch/arm64/boot/dts/qcom/sdm845-db845c.dts +9 -0
@@ -101,6 +101,14 @@ }; }; + reserved-memory { + /* Cont splash region set up by the bootloader */ + cont_splash_mem: framebuffer@9d400000 { + reg = <0x0 0x9d400000 0x0 0x2400000>; + no-map; + }; + }; + lt9611_1v8: lt9611-vdd18-regulator { compatible = "regulator-fixed"; regulator-name = "LT9611_1V8";
@@ -506,6 +514,7 @@ }; &mdss { + memory-region = <&cont_splash_mem>; status = "okay"; };
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 116/321 direct_write_fallback(): on error revert the ->ki_pos update from buffered write
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 8287474aa5ffb41df52552c4ae4748e791d2faf2 ]
If we fail filemap_write_and_wait_range() on the range the buffered write went into, we only report the "number of bytes which we direct-written", to quote the comment in there. Which is fine, but buffered write has already advanced iocb->ki_pos, so we need to roll that back. Otherwise we end up with e.g. write(2) advancing position by more than the amount it reports having written.
Message-Id: <20230827214518.GU3390869@ZenIV>
--- fs/libfs.c | 1 + 1 file changed, 1 insertion(+)
fs/libfs.c +1 -0
@@ -1646,6 +1646,7 @@ ssize_t direct_write_fallback(struct kiocb *iocb, struct iov_iter *iter,* We don't know how much we wrote, so just return the number of * bytes which were direct-written */ + iocb->ki_pos -= buffered_written;if (direct_written)return direct_written;return err;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 117/321 btrfs: reset destination buffer when read_extent_buffer() gets invalid range
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <[email protected]>
[ Upstream commit 74ee79142c0a344d4eae2eb7012ebc4e82254109 ]
Commit f98b6215d7d1 ("btrfs: extent_io: do extra check for extent buffer read write functions") changed how we handle invalid extent buffer range for read_extent_buffer().
Previously if the range is invalid we just set the destination to zero, but after the patch we do nothing and error out.
This can lead to smatch static checker errors like:
fs/btrfs/print-tree.c:186 print_uuid_item() error: uninitialized symbol 'subvol_id'. fs/btrfs/tests/extent-io-tests.c:338 check_eb_bitmap() error: uninitialized symbol 'has'. fs/btrfs/tests/extent-io-tests.c:353 check_eb_bitmap() error: uninitialized symbol 'has'. fs/btrfs/uuid-tree.c:203 btrfs_uuid_tree_remove() error: uninitialized symbol 'read_subid'. fs/btrfs/uuid-tree.c:353 btrfs_uuid_tree_iterate() error: uninitialized symbol 'subid_le'. fs/btrfs/uuid-tree.c:72 btrfs_uuid_tree_lookup() error: uninitialized symbol 'data'. fs/btrfs/volumes.c:7415 btrfs_dev_stats_value() error: uninitialized symbol 'val'.
Fix those warnings by reverting back to the old memset() behavior. By this we keep the static checker happy and would still make a lot of noise when such invalid ranges are passed in.
--- fs/btrfs/extent_io.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/btrfs/extent_io.c +7 -1
@@ -4083,8 +4083,14 @@ void read_extent_buffer(const struct extent_buffer *eb, void *dstv,char *dst = (char *)dstv;unsigned long i =get_eb_page_index (start); -if (check_eb_range (eb, start, len)) +if (check_eb_range (eb, start, len)) { +/* +* Invalid range hit, reset the memory, so callers won't get +* some random garbage for their uninitialzed memory. +*/ +memset (dstv,0 , len);return ; + } offset =get_eb_offset_in_page (eb, start);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 118/321 vfio/mdev: Fix a null-ptr-deref bug for mdev_unregister_parent()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit c777b11d34e0f47dbbc4b018ef65ad030f2b283a ]
Inject fault while probing mdpy.ko, if kstrdup() of create_dir() fails in kobject_add_internal() in kobject_init_and_add() in mdev_type_add() in parent_create_sysfs_files(), it will return 0 and probe successfully. And when rmmod mdpy.ko, the mdpy_dev_exit() will call mdev_unregister_parent(), the mdev_type_remove() may traverse uninitialized parent->types[i] in parent_remove_sysfs_files(), and it will cause below null-ptr-deref.
If mdev_type_add() fails, return the error code and kset_unregister() to fix the issue.
general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 2 PID: 10215 Comm: rmmod Tainted: G W N 6.6.0-rc2+ #20
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:__kobject_del+0x62/0x1c0
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 51 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 28 48 8d 7d 10 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 24 01 00 00 48 8b 75 10 48 89 df 48 8d 6b 3c e8
RSP: 0018:ffff88810695fd30 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffffffffa0270268 RCX: 0000000000000000
RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000010
RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed10233a4ef1
R10: ffff888119d2778b R11: 0000000063666572 R12: 0000000000000000
R13: fffffbfff404e2d4 R14: dffffc0000000000 R15: ffffffffa0271660
FS: 00007fbc81981540(0000) GS:ffff888119d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc14a142dc0 CR3: 0000000110a62003 CR4: 0000000000770ee0
DR0: ffffffff8fb0bce8 DR1: ffffffff8fb0bce9 DR2: ffffffff8fb0bcea
DR3: ffffffff8fb0bceb DR6: 00000000fffe0ff0 DR7: 0000000000000600
PKRU: 55555554
Call Trace:
<TASK>
? die_addr+0x3d/0xa0
? exc_general_protection+0x144/0x220
? asm_exc_general_protection+0x22/0x30
? __kobject_del+0x62/0x1c0
kobject_del+0x32/0x50
parent_remove_sysfs_files+0xd6/0x170 [mdev]
mdev_unregister_parent+0xfb/0x190 [mdev]
? mdev_register_parent+0x270/0x270 [mdev]
? find_module_all+0x9d/0xe0
mdpy_dev_exit+0x17/0x63 [mdpy]
__do_sys_delete_module.constprop.0+0x2fa/0x4b0
? module_flags+0x300/0x300
? __fput+0x4e7/0xa00
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7fbc813221b7
Code: 73 01 c3 48 8b 0d d1 8c 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d a1 8c 2c 00 f7 d8 64 89 01 48
RSP: 002b:00007ffe780e0648 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
RAX: ffffffffffffffda RBX: 00007ffe780e06a8 RCX: 00007fbc813221b7
RDX: 000000000000000a RSI: 0000000000000800 RDI: 000055e214df9b58
RBP: 000055e214df9af0 R08: 00007ffe780df5c1 R09: 0000000000000000
R10: 00007fbc8139ecc0 R11: 0000000000000206 R12: 00007ffe780e0870
R13: 00007ffe780e0ed0 R14: 000055e214df9260 R15: 000055e214df9af0
</TASK>
Modules linked in: mdpy(-) mdev vfio_iommu_type1 vfio [last unloaded: mdpy]
Dumping ftrace buffer:
(ftrace buffer empty)
---[ end trace 0000000000000000 ]---
RIP: 0010:__kobject_del+0x62/0x1c0
Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 51 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b 6b 28 48 8d 7d 10 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 24 01 00 00 48 8b 75 10 48 89 df 48 8d 6b 3c e8
RSP: 0018:ffff88810695fd30 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffffffffa0270268 RCX: 0000000000000000
RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000010
RBP: 0000000000000000 R08: 0000000000000001 R09: ffffed10233a4ef1
R10: ffff888119d2778b R11: 0000000063666572 R12: 0000000000000000
R13: fffffbfff404e2d4 R14: dffffc0000000000 R15: ffffffffa0271660
FS: 00007fbc81981540(0000) GS:ffff888119d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc14a142dc0 CR3: 0000000110a62003 CR4: 0000000000770ee0
DR0: ffffffff8fb0bce8 DR1: ffffffff8fb0bce9 DR2: ffffffff8fb0bcea
DR3: ffffffff8fb0bceb DR6: 00000000fffe0ff0 DR7: 0000000000000600
PKRU: 55555554
Kernel panic - not syncing: Fatal exception
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 1 seconds..--- drivers/vfio/mdev/mdev_sysfs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/vfio/mdev/mdev_sysfs.c +2 -1
@@ -233,7 +233,8 @@ int parent_create_sysfs_files(struct mdev_parent *parent) out_err:while (--i >=0 )mdev_type_remove (parent->types[i]); -return 0 ; +kset_unregister (parent->mdev_types_kset); +return ret; } static ssize_t remove_store(struct device *dev, struct device_attribute *attr,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 119/321 MIPS: Alchemy: only build mmc support helpers if au1xmmc is enabled
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit ef8f8f04a0b25e8f294b24350e8463a8d6a9ba0b ]
While commit d4a5c59a955b ("mmc: au1xmmc: force non-modular build and remove symbol_get usage") to be built in, it can still build a kernel without MMC support and thuse no mmc_detect_change symbol at all.
Add ifdefs to build the mmc support code in the alchemy arch code conditional on mmc support.
--- arch/mips/alchemy/devboards/db1000.c | 4 ++++ arch/mips/alchemy/devboards/db1200.c | 6 ++++++ arch/mips/alchemy/devboards/db1300.c | 4 ++++ 3 files changed, 14 insertions(+)
arch/mips/alchemy/devboards/db1000.c +4 -0
@@ -164,6 +164,7 @@ static struct platform_device db1x00_audio_dev = {/******************************************************************************/ +#ifdef CONFIG_MMC_AU1X static irqreturn_t db1100_mmc_cd (int irq,void *ptr) {mmc_detect_change (ptr,msecs_to_jiffies (500 ));
@@ -369,6 +370,7 @@ static struct platform_device db1100_mmc1_dev = { .num_resources = ARRAY_SIZE(au1100_mmc1_res), .resource = au1100_mmc1_res, }; +#endif /* CONFIG_MMC_AU1X */ /******************************************************************************/
@@ -440,8 +442,10 @@ static struct platform_device *db1x00_devs[] = {static struct platform_device *db1100_devs[] = { &au1100_lcd_device, +#ifdef CONFIG_MMC_AU1X &db1100_mmc0_dev, &db1100_mmc1_dev, +#endif };int __init db1000_dev_setup (void )
arch/mips/alchemy/devboards/db1200.c +6 -0
@@ -326,6 +326,7 @@ static struct platform_device db1200_ide_dev = {/**********************************************************************/ +#ifdef CONFIG_MMC_AU1X /* SD carddetects: they're supposed to be edge-triggered, but ack * doesn't seem to work (CPLD Rev 2). Instead, the screaming one * is disabled and its counterpart enabled. The 200ms timeout is
@@ -584,6 +585,7 @@ static struct platform_device pb1200_mmc1_dev = { .num_resources = ARRAY_SIZE(au1200_mmc1_res), .resource = au1200_mmc1_res, }; +#endif /* CONFIG_MMC_AU1X */ /**********************************************************************/
@@ -751,7 +753,9 @@ static struct platform_device db1200_audiodma_dev = {static struct platform_device *db1200_devs[]__initdata = {NULL ,/* PSC0, selected by S6.8 */ &db1200_ide_dev, +#ifdef CONFIG_MMC_AU1X &db1200_mmc0_dev, +#endif &au1200_lcd_dev, &db1200_eth_dev, &db1200_nand_dev,
@@ -762,7 +766,9 @@ static struct platform_device *db1200_devs[] __initdata = { };static struct platform_device *pb1200_devs[]__initdata = { +#ifdef CONFIG_MMC_AU1X &pb1200_mmc1_dev, +#endif };/* Some peripheral base addresses differ on the PB1200 */
arch/mips/alchemy/devboards/db1300.c +4 -0
@@ -450,6 +450,7 @@ static struct platform_device db1300_ide_dev = {/**********************************************************************/ +#ifdef CONFIG_MMC_AU1X static irqreturn_t db1300_mmc_cd (int irq,void *ptr) {disable_irq_nosync (irq);
@@ -632,6 +633,7 @@ static struct platform_device db1300_sd0_dev = { .resource = au1300_sd0_res, .num_resources = ARRAY_SIZE(au1300_sd0_res), }; +#endif /* CONFIG_MMC_AU1X */ /**********************************************************************/
@@ -767,8 +769,10 @@ static struct platform_device *db1300_dev[] __initdata = { &db1300_5waysw_dev, &db1300_nand_dev, &db1300_ide_dev, +#ifdef CONFIG_MMC_AU1X &db1300_sd0_dev, &db1300_sd1_dev, +#endif &db1300_lcd_dev, &db1300_ac97_dev, &db1300_i2s_dev,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 120/321 spi: spi-gxp: BUG: Correct spi write return value
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Kearney <[email protected]>
[ Upstream commit 1a8196a93e493c0a50b800cb09cef60b124eee15 ]
Bug fix to correct return value of gxp_spi_write function to zero. Completion of succesful operation should return zero.
--- drivers/spi/spi-gxp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-gxp.c +1 -1
@@ -195,7 +195,7 @@ static ssize_t gxp_spi_write(struct gxp_spi_chip *chip, const struct spi_mem_opreturn ret; } -return write_len; +return 0 ; }static int do_gxp_exec_mem_op (struct spi_mem *mem,const struct spi_mem_op *op)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 121/321 bus: ti-sysc: Use fsleep() instead of usleep_range() in sysc_reset()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julien Panis <[email protected]>
[ Upstream commit d929b2b7464f95ec01e47f560b1e687482ba8929 ]
The am335x-evm started producing boot errors because of subtle timing changes:
Unhandled fault: external abort on non-linefetch (0x1008) at 0xf03c1010
...sysc_reset from sysc_probe+0xf60/0x1514sysc_probe from platform_probe+0x5c/0xbc
...
The fix consists in using the appropriate sleep function in sysc reset. For flexible sleeping, fsleep is recommended. Here, sysc delay parameter can take any value in [0 - 255] us range. As a result, fsleep() should be used, calling udelay() for a sysc delay lower than 10 us.
Message-ID: <[email protected]>
--- drivers/bus/ti-sysc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/bus/ti-sysc.c +1 -2
@@ -2149,8 +2149,7 @@ static int sysc_reset(struct sysc *ddata) }if (ddata->cfg.srst_udelay) -usleep_range (ddata->cfg.srst_udelay, - ddata->cfg.srst_udelay *2 ); +fsleep (ddata->cfg.srst_udelay);if (ddata->post_reset_quirk) ddata->post_reset_quirk (ddata);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 122/321 bus: ti-sysc: Fix missing AM35xx SoC matching
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Ford <[email protected]>
[ Upstream commit 11729caa520950e17cd81bc43ffc477c46cf791e ]
Commit feaa8baee82a ("bus: ti-sysc: Implement SoC revision handling") created a list of SoC types searching for strings based on names and wildcards which associates the SoC to different families.
The OMAP34xx and OMAP35xx are treated as SOC_3430 while OMAP36xx and OMAP37xx are treated as SOC_3630, but the AM35xx isn't listed.
The AM35xx is mostly an OMAP3430, and a later commit a12315d6d270 ("bus: ti-sysc: Make omap3 gpt12 quirk handling SoC specific") looks for the SOC type and behaves in a certain way if it's SOC_3430.
This caused a regression on the AM3517 causing it to return two errors:
ti-sysc: probe of 48318000.target-module failed with error -16
ti-sysc: probe of 49032000.target-module failed with error -16
Fix this by treating the creating SOC_AM35 and inserting it between the SOC_3430 and SOC_3630. If it is treaed the same way as the SOC_3430 when checking the status of sysc_check_active_timer, the error conditions will disappear.
Message-ID: <[email protected]>
--- drivers/bus/ti-sysc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/bus/ti-sysc.c +4 -2
@@ -38,6 +38,7 @@ enum sysc_soc {SOC_2420 ,SOC_2430 ,SOC_3430 , +SOC_AM35 ,SOC_3630 ,SOC_4430 , SOC_4460,
@@ -1861,7 +1862,7 @@ static void sysc_pre_reset_quirk_dss(struct sysc *ddata)dev_warn (ddata->dev,"%s: timed out %08x !+ %08x\n" , __func__, val, irq_mask); -if (sysc_soc->soc ==SOC_3430 ) { +if (sysc_soc->soc ==SOC_3430 || sysc_soc->soc ==SOC_AM35 ) {/* Clear DSS_SDI_CONTROL */ sysc_write (ddata,0x44 ,0 );
@@ -3023,6 +3024,7 @@ static void ti_sysc_idle(struct work_struct *work)static const struct soc_device_attribute sysc_soc_match[] = {SOC_FLAG ("OMAP242*" ,SOC_2420 ),SOC_FLAG ("OMAP243*" ,SOC_2430 ), +SOC_FLAG ("AM35*" ,SOC_AM35 ),SOC_FLAG ("OMAP3[45]*" ,SOC_3430 ),SOC_FLAG ("OMAP3[67]*" ,SOC_3630 ),SOC_FLAG ("OMAP443*" ,SOC_4430 ),
@@ -3227,7 +3229,7 @@ static int sysc_check_active_timer(struct sysc *ddata)* can be dropped if we stop supporting old beagleboard revisions * A to B4 at some point. */ -if (sysc_soc->soc ==SOC_3430 ) +if (sysc_soc->soc ==SOC_3430 || sysc_soc->soc ==SOC_AM35 ) error = -ENXIO ;else error = -EBUSY ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 123/321 firmware: arm_scmi: Harden perf domain info access
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Marussi <[email protected]>
[ Upstream commit 3da82112355bba263597fcbb24d275fc57e69e7e ]
Harden internal accesses to domain info in the SCMI perf protocol.
Stable-dep-of: c3638b851bc1 ("firmware: arm_scmi: Fixup perf power-cost/microwatt support")
--- drivers/firmware/arm_scmi/perf.c | 89 +++++++++++++++++++++++--------- 1 file changed, 64 insertions(+), 25 deletions(-)
drivers/firmware/arm_scmi/perf.c +64 -25
@@ -139,7 +139,7 @@ struct perf_dom_info {struct scmi_perf_info {u32 version; -int num_domains; +u16 num_domains;enum scmi_power_scale power_scale;u64 stats_addr;u32 stats_size;
@@ -356,11 +356,26 @@ static int scmi_perf_mb_limits_set(const struct scmi_protocol_handle *ph,return ret; } +static inline struct perf_dom_info * +scmi_perf_domain_lookup (const struct scmi_protocol_handle *ph,u32 domain) +{ +struct scmi_perf_info *pi = ph->get_priv (ph); + +if (domain >= pi->num_domains) +return ERR_PTR (-EINVAL ); + +return pi->dom_info + domain; +} +static int scmi_perf_limits_set (const struct scmi_protocol_handle *ph,u32 domain,u32 max_perf,u32 min_perf) {struct scmi_perf_info *pi = ph->get_priv (ph); -struct perf_dom_info *dom = pi->dom_info + domain; +struct perf_dom_info *dom; + + dom =scmi_perf_domain_lookup (ph, domain); +if (IS_ERR (dom)) +return PTR_ERR (dom);if (PROTOCOL_REV_MAJOR (pi->version) >=0x3 && !max_perf && !min_perf)return -EINVAL ;
@@ -408,8 +423,11 @@ static int scmi_perf_mb_limits_get(const struct scmi_protocol_handle *ph,static int scmi_perf_limits_get (const struct scmi_protocol_handle *ph,u32 domain,u32 *max_perf,u32 *min_perf) { -struct scmi_perf_info *pi = ph->get_priv (ph); -struct perf_dom_info *dom = pi->dom_info + domain; +struct perf_dom_info *dom; + + dom =scmi_perf_domain_lookup (ph, domain); +if (IS_ERR (dom)) +return PTR_ERR (dom);if (dom->fc_info && dom->fc_info[PERF_FC_LIMIT ].get_addr) {struct scmi_fc_info *fci = &dom->fc_info[PERF_FC_LIMIT ];
@@ -449,8 +467,11 @@ static int scmi_perf_mb_level_set(const struct scmi_protocol_handle *ph,static int scmi_perf_level_set (const struct scmi_protocol_handle *ph,u32 domain,u32 level,bool poll) { -struct scmi_perf_info *pi = ph->get_priv (ph); -struct perf_dom_info *dom = pi->dom_info + domain; +struct perf_dom_info *dom; + + dom =scmi_perf_domain_lookup (ph, domain); +if (IS_ERR (dom)) +return PTR_ERR (dom);if (dom->fc_info && dom->fc_info[PERF_FC_LEVEL ].set_addr) {struct scmi_fc_info *fci = &dom->fc_info[PERF_FC_LEVEL ];
@@ -490,8 +511,11 @@ static int scmi_perf_mb_level_get(const struct scmi_protocol_handle *ph,static int scmi_perf_level_get (const struct scmi_protocol_handle *ph,u32 domain,u32 *level,bool poll) { -struct scmi_perf_info *pi = ph->get_priv (ph); -struct perf_dom_info *dom = pi->dom_info + domain; +struct perf_dom_info *dom; + + dom =scmi_perf_domain_lookup (ph, domain); +if (IS_ERR (dom)) +return PTR_ERR (dom);if (dom->fc_info && dom->fc_info[PERF_FC_LEVEL ].get_addr) { *level =ioread32 (dom->fc_info[PERF_FC_LEVEL ].get_addr);
@@ -574,13 +598,14 @@ static int scmi_dvfs_device_opps_add(const struct scmi_protocol_handle *ph,unsigned long freq;struct scmi_opp *opp;struct perf_dom_info *dom; -struct scmi_perf_info *pi = ph->get_priv (ph); domain =scmi_dev_domain_id (dev);if (domain <0 ) -return domain; +return -EINVAL ; - dom = pi->dom_info + domain; + dom =scmi_perf_domain_lookup (ph, domain); +if (IS_ERR (dom)) +return PTR_ERR (dom);for (opp = dom->opp, idx =0 ; idx < dom->opp_count; idx++, opp++) { freq = opp->perf * dom->mult_factor;
@@ -603,14 +628,17 @@ static int scmi_dvfs_transition_latency_get(const struct scmi_protocol_handle *ph, struct device *dev) { + int domain;struct perf_dom_info *dom; -struct scmi_perf_info *pi = ph->get_priv (ph); -int domain =scmi_dev_domain_id (dev); + domain =scmi_dev_domain_id (dev);if (domain <0 ) -return domain; +return -EINVAL ; + + dom =scmi_perf_domain_lookup (ph, domain); +if (IS_ERR (dom)) +return PTR_ERR (dom); - dom = pi->dom_info + domain;/* uS to nS */ return dom->opp[dom->opp_count -1 ].trans_latency_us *1000 ; }
@@ -618,8 +646,11 @@ scmi_dvfs_transition_latency_get(const struct scmi_protocol_handle *ph,static int scmi_dvfs_freq_set (const struct scmi_protocol_handle *ph,u32 domain,unsigned long freq,bool poll) { -struct scmi_perf_info *pi = ph->get_priv (ph); -struct perf_dom_info *dom = pi->dom_info + domain; +struct perf_dom_info *dom; + + dom =scmi_perf_domain_lookup (ph, domain); +if (IS_ERR (dom)) +return PTR_ERR (dom);return scmi_perf_level_set (ph, domain, freq / dom->mult_factor, poll); }
@@ -630,11 +661,14 @@ static int scmi_dvfs_freq_get(const struct scmi_protocol_handle *ph, u32 domain,int ret;u32 level;struct scmi_perf_info *pi = ph->get_priv (ph); -struct perf_dom_info *dom = pi->dom_info + domain; ret =scmi_perf_level_get (ph, domain, &level, poll); -if (!ret) +if (!ret) { +struct perf_dom_info *dom = pi->dom_info + domain; + +/* Note domain is validated implicitly by scmi_perf_level_get */ *freq = level * dom->mult_factor; + }return ret; }
@@ -643,15 +677,14 @@ static int scmi_dvfs_est_power_get(const struct scmi_protocol_handle *ph, u32 domain, unsigned long *freq, unsigned long *power) { - struct scmi_perf_info *pi = ph->get_priv(ph); struct perf_dom_info *dom;unsigned long opp_freq;int idx, ret = -EINVAL ;struct scmi_opp *opp; - dom = pi->dom_info + domain; -if (!dom) -return -EIO ; + dom =scmi_perf_domain_lookup (ph, domain); +if (IS_ERR (dom)) +return PTR_ERR (dom);for (opp = dom->opp, idx =0 ; idx < dom->opp_count; idx++, opp++) { opp_freq = opp->perf * dom->mult_factor;
@@ -670,10 +703,16 @@ static int scmi_dvfs_est_power_get(const struct scmi_protocol_handle *ph,static bool scmi_fast_switch_possible (const struct scmi_protocol_handle *ph,struct device *dev) { +int domain;struct perf_dom_info *dom; -struct scmi_perf_info *pi = ph->get_priv (ph); - dom = pi->dom_info +scmi_dev_domain_id (dev); + domain =scmi_dev_domain_id (dev); +if (domain <0 ) +return false; + + dom =scmi_perf_domain_lookup (ph, domain); +if (IS_ERR (dom)) +return false;return dom->fc_info && dom->fc_info[PERF_FC_LEVEL ].set_addr; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 124/321 firmware: arm_scmi: Fixup perf power-cost/microwatt support
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sibi Sankar <[email protected]>
[ Upstream commit c3638b851bc1ca0022dca9d6ca4beaa6ef03a216 ]
The perf power scale value would currently be reported as bogowatts if the platform firmware supports microwatt power scale and meets the perf major version requirements. Fix this by populating version information in the driver private data before the call to protocol attributes is made.
--- drivers/firmware/arm_scmi/perf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/firmware/arm_scmi/perf.c +2 -2
@@ -858,6 +858,8 @@ static int scmi_perf_protocol_init(const struct scmi_protocol_handle *ph)if (!pinfo)return -ENOMEM ; + pinfo->version = version; + ret =scmi_perf_attributes_get (ph, pinfo);if (ret)return ret;
@@ -877,8 +879,6 @@ static int scmi_perf_protocol_init(const struct scmi_protocol_handle *ph)scmi_perf_domain_init_fc (ph, domain, &dom->fc_info); } - pinfo->version = version; -return ph->set_priv (ph, pinfo); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 125/321 power: supply: mt6370: Fix missing error code in mt6370_chg_toggle_cfo()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harshit Mogalapalli <[email protected]>
[ Upstream commit 779873ec81306d2c40c459fa7c91a5d40655510d ]
When mt6370_chg_field_get() suceeds, ret is set to zero and returning zero when flash led is still in strobe mode looks incorrect.
--- drivers/power/supply/mt6370-charger.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/power/supply/mt6370-charger.c +1 -1
@@ -324,7 +324,7 @@ static int mt6370_chg_toggle_cfo(struct mt6370_priv *priv)if (fl_strobe) {dev_err (priv->dev,"Flash led is still in strobe mode\n" ); -return ret; +return -EINVAL ; }/* cfo off */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 126/321 clk: sprd: Fix thm_parents incorrect configuration
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhifeng Tang <[email protected]>
[ Upstream commit b7b20cfe6f849c2682c5f7d3f50ede6321a5d04c ]
The thm*_clk have two clock sources 32k and 250k,excluding 32m.
--- drivers/clk/sprd/ums512-clk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/sprd/ums512-clk.c +1 -1
@@ -800,7 +800,7 @@ static SPRD_MUX_CLK_DATA(uart1_clk, "uart1-clk", uart_parents, 0x250, 0, 3, UMS512_MUX_FLAG);static const struct clk_parent_data thm_parents[] = { - { .fw_name ="ext-32m" }, + { .fw_name ="ext-32k" }, { .hw = &clk_250k.hw }, }; static SPRD_MUX_CLK_DATA(thm0_clk, "thm0-clk", thm_parents,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 127/321 clk: si521xx: Use REGCACHE_FLAT instead of NONE
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit f03a562450eef35b785a814005ed164a89dfb2db ]
In order to reload registers into the clock generator on resume using regcache_sync(), it is necessary to select one of the regcache types which are not NONE. Since this device has some 7 registers, use the simplest one, FLAT. The regcache code complains about REGCACHE_NONE being selected and generates a WARNING, this fixes that warning.
--- drivers/clk/clk-si521xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/clk-si521xx.c +1 -1
@@ -146,7 +146,7 @@ static int si521xx_regmap_i2c_read(void *context, unsigned int reg,static const struct regmap_config si521xx_regmap_config = { .reg_bits =8 , .val_bits =8 , - .cache_type =REGCACHE_NONE , + .cache_type =REGCACHE_FLAT , .max_register =SI521XX_REG_DA , .rd_table = &si521xx_readable_table, .wr_table = &si521xx_writeable_table,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 128/321 clk: si521xx: Fix regmap write accessor
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <[email protected]>
[ Upstream commit 83df5bf010eb5ccc11ce95f2d076515ec216c99c ]
Rework the write operation such that the Byte Count register is written with a single raw i2c write outside of regmap using transfer which does specify the number of bytes to be transfered, one in this case, and which makes the expected subsequent write transfer look like address+register+data, and then make use of this method. Without this change, the Byte Count register write in probe() would succeed as it would provide the byte count as part of its write payload, but any subsequent writes would fail due to this Byte Count register programming. Such failing writes happens e.g. during resume, when restoring the regmap content.
--- drivers/clk/clk-si521xx.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/clk/clk-si521xx.c +4 -3
@@ -96,7 +96,7 @@ static int si521xx_regmap_i2c_write(void *context, unsigned int reg, unsigned int val) {struct i2c_client *i2c = context; -const u8 data[3 ] = { reg,1 , val }; +const u8 data[2 ] = { reg, val };const int count =ARRAY_SIZE (data);int ret;
@@ -281,9 +281,10 @@ static int si521xx_probe(struct i2c_client *client) {const u16 chip_info = (u16 )(uintptr_t )device_get_match_data (&client->dev);const struct clk_parent_data clk_parent_data = { .index =0 }; -struct si521xx *si; +const u8 data[3 ] = {SI521XX_REG_BC ,1 ,1 };unsigned char name[6 ] ="DIFF0" ;struct clk_init_data init = {}; +struct si521xx *si;int i, ret;if (!chip_info)
@@ -308,7 +309,7 @@ static int si521xx_probe(struct i2c_client *client) "Failed to allocate register map\n");/* Always read back 1 Byte via I2C */ - ret =regmap_write (si->regmap,SI521XX_REG_BC ,1 ); + ret =i2c_master_send (client, data,ARRAY_SIZE (data));if (ret <0 )return ret;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 129/321 clk: tegra: fix error return case for recalc_rate
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timo Alho <[email protected]>
[ Upstream commit a47b44fbb13f5e7a981b4515dcddc93a321ae89c ]
tegra-bpmp clocks driver makes implicit conversion of signed error code to unsigned value in recalc_rate operation. The behavior for recalc_rate, according to it's specification, should be that "If the driver cannot figure out a rate for this clock, it must return 0."
--- drivers/clk/tegra/clk-bpmp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/tegra/clk-bpmp.c +1 -1
@@ -159,7 +159,7 @@ static unsigned long tegra_bpmp_clk_recalc_rate(struct clk_hw *hw, err =tegra_bpmp_clk_transfer (clk->bpmp, &msg);if (err <0 ) -return err; +return 0 ;return response.rate; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 130/321 ARM: dts: ti: omap: Fix bandgap thermal cells addressing for omap3/4
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <[email protected]>
[ Upstream commit 6469b2feade8fd82d224dd3734e146536f3e9f0e ]
Fix "thermal_sys: cpu_thermal: Failed to read thermal-sensors cells: -2" error on boot for omap3/4. This is caused by wrong addressing in the dts for bandgap sensor for single sensor instances.
Note that omap4-cpu-thermal.dtsi is shared across omap4/5 and dra7, so we can't just change the addressing in omap4-cpu-thermal.dtsi.
--- arch/arm/boot/dts/ti/omap/omap3-cpu-thermal.dtsi | 3 +-- arch/arm/boot/dts/ti/omap/omap4-cpu-thermal.dtsi | 5 ++++- arch/arm/boot/dts/ti/omap/omap443x.dtsi | 1 + arch/arm/boot/dts/ti/omap/omap4460.dtsi | 1 + 4 files changed, 7 insertions(+), 3 deletions(-)
arch/arm/boot/dts/ti/omap/omap3-cpu-thermal.dtsi +1 -2
@@ -12,8 +12,7 @@ cpu_thermal: cpu-thermal { polling-delay = <1000>; /* milliseconds */ coefficients = <0 20000>; - /* sensor ID */ - thermal-sensors = <&bandgap 0>; + thermal-sensors = <&bandgap>; cpu_trips: trips { cpu_alert0: cpu_alert {
arch/arm/boot/dts/ti/omap/omap4-cpu-thermal.dtsi +4 -1
@@ -12,7 +12,10 @@ cpu_thermal: cpu_thermal { polling-delay-passive = <250>; /* milliseconds */ polling-delay = <1000>; /* milliseconds */ - /* sensor ID */ + /* + * See 44xx files for single sensor addressing, omap5 and dra7 need + * also sensor ID for addressing. + */ thermal-sensors = <&bandgap 0>; cpu_trips: trips {
arch/arm/boot/dts/ti/omap/omap443x.dtsi +1 -0
@@ -69,6 +69,7 @@ }; &cpu_thermal { + thermal-sensors = <&bandgap>; coefficients = <0 20000>; };
arch/arm/boot/dts/ti/omap/omap4460.dtsi +1 -0
@@ -79,6 +79,7 @@ }; &cpu_thermal { + thermal-sensors = <&bandgap>; coefficients = <348 (-9301)>; };
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 131/321 ARM: dts: ti: omap: motorola-mapphone: Fix abe_clkctrl warning on boot
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <[email protected]>
[ Upstream commit ac08bda1569b06b7a62c7b4dd00d4c3b28ceaaec ]
Commit 0840242e8875 ("ARM: dts: Configure clock parent for pwm vibra") attempted to fix the PWM settings but ended up causin an additional clock reparenting error:
clk: failed to reparent abe-clkctrl:0060:24 to sys_clkin_ck: -22
Only timer9 is in the PER domain and can use the sys_clkin_ck clock source. For timer8, the there is no sys_clkin_ck available as it's in the ABE domain, instead it should use syc_clk_div_ck. However, for power management, we want to use the always on sys_32k_ck instead.
Depends-on: 61978617e905 ("ARM: dts: Add minimal support for Droid Bionic xt875")
--- arch/arm/boot/dts/ti/omap/motorola-mapphone-common.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/ti/omap/motorola-mapphone-common.dtsi +2 -2
@@ -614,12 +614,12 @@ /* Configure pwm clock source for timers 8 & 9 */ &timer8 { assigned-clocks = <&abe_clkctrl OMAP4_TIMER8_CLKCTRL 24>; - assigned-clock-parents = <&sys_clkin_ck>; + assigned-clock-parents = <&sys_32k_ck>; }; &timer9 { assigned-clocks = <&l4_per_clkctrl OMAP4_TIMER9_CLKCTRL 24>; - assigned-clock-parents = <&sys_clkin_ck>; + assigned-clock-parents = <&sys_32k_ck>; }; /*
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 132/321 bus: ti-sysc: Fix SYSC_QUIRK_SWSUP_SIDLE_ACT handling for uart wake-up
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <[email protected]>
[ Upstream commit e5deb8f76e64d94ccef715e75ebafffd0c312d80 ]
The uarts should be tagged with SYSC_QUIRK_SWSUP_SIDLE instead of SYSC_QUIRK_SWSUP_SIDLE_ACT. The difference is that SYSC_QUIRK_SWSUP_SIDLE is used to force idle target modules rather than block idle during usage.
The SYSC_QUIRK_SWSUP_SIDLE_ACT should disable autoidle and wake-up when a target module is active, and configure autoidle and wake-up when a target module is inactive. We are missing configuring the target module on sysc_disable_module(), and missing toggling of the wake-up bit.
Let's fix the issue to allow uart wake-up to work.
--- drivers/bus/ti-sysc.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-)
drivers/bus/ti-sysc.c +17 -5
@@ -1097,6 +1097,11 @@ static int sysc_enable_module(struct device *dev)if (ddata->cfg.quirks & (SYSC_QUIRK_SWSUP_SIDLE |SYSC_QUIRK_SWSUP_SIDLE_ACT )) { best_mode =SYSC_IDLE_NO ; + +/* Clear WAKEUP */ +if (regbits->enwkup_shift >=0 && + ddata->cfg.sysc_val &BIT (regbits->enwkup_shift)) + reg &= ~BIT (regbits->enwkup_shift); }else { best_mode =fls (ddata->cfg.sidlemodes) -1 ;if (best_mode >SYSC_IDLE_MASK ) {
@@ -1224,6 +1229,13 @@ static int sysc_disable_module(struct device *dev) } } +if (ddata->cfg.quirks &SYSC_QUIRK_SWSUP_SIDLE_ACT ) { +/* Set WAKEUP */ +if (regbits->enwkup_shift >=0 && + ddata->cfg.sysc_val &BIT (regbits->enwkup_shift)) + reg |=BIT (regbits->enwkup_shift); + } + reg &= ~(SYSC_IDLE_MASK << regbits->sidle_shift); reg |= best_mode << regbits->sidle_shift; if (regbits->autoidle_shift >= 0 &&
@@ -1518,16 +1530,16 @@ struct sysc_revision_quirk {static const struct sysc_revision_quirk sysc_revision_quirks[] = {/* These drivers need to be fixed to not use pm_runtime_irq_safe() */ SYSC_QUIRK ("uart" ,0 ,0x50 ,0x54 ,0x58 ,0x00000046 ,0xffffffff , -SYSC_QUIRK_SWSUP_SIDLE |SYSC_QUIRK_LEGACY_IDLE ), +SYSC_QUIRK_SWSUP_SIDLE_ACT |SYSC_QUIRK_LEGACY_IDLE ),SYSC_QUIRK ("uart" ,0 ,0x50 ,0x54 ,0x58 ,0x00000052 ,0xffffffff , -SYSC_QUIRK_SWSUP_SIDLE |SYSC_QUIRK_LEGACY_IDLE ), +SYSC_QUIRK_SWSUP_SIDLE_ACT |SYSC_QUIRK_LEGACY_IDLE ),/* Uarts on omap4 and later */ SYSC_QUIRK ("uart" ,0 ,0x50 ,0x54 ,0x58 ,0x50411e03 ,0xffff00ff , -SYSC_QUIRK_SWSUP_SIDLE |SYSC_QUIRK_LEGACY_IDLE ), +SYSC_QUIRK_SWSUP_SIDLE_ACT |SYSC_QUIRK_LEGACY_IDLE ),SYSC_QUIRK ("uart" ,0 ,0x50 ,0x54 ,0x58 ,0x47422e03 ,0xffffffff , -SYSC_QUIRK_SWSUP_SIDLE |SYSC_QUIRK_LEGACY_IDLE ), +SYSC_QUIRK_SWSUP_SIDLE_ACT |SYSC_QUIRK_LEGACY_IDLE ),SYSC_QUIRK ("uart" ,0 ,0x50 ,0x54 ,0x58 ,0x47424e03 ,0xffffffff , -SYSC_QUIRK_SWSUP_SIDLE |SYSC_QUIRK_LEGACY_IDLE ), +SYSC_QUIRK_SWSUP_SIDLE_ACT |SYSC_QUIRK_LEGACY_IDLE ),/* Quirks that need to be set based on the module address */ SYSC_QUIRK("mcpdm", 0x40132000, 0, 0x10, -ENODEV, 0x50000800, 0xffffffff,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 133/321 swiotlb: use the calculated number of areas
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ross Lagerwall <[email protected]>
[ Upstream commit a6a241764f69c62d23fc6960920cc662ae4069e9 ]
Commit 8ac04063354a ("swiotlb: reduce the number of areas to match actual memory pool size") calculated the reduced number of areas in swiotlb_init_remap() but didn't actually use the value. Replace usage of default_nareas accordingly.
--- kernel/dma/swiotlb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/dma/swiotlb.c +2 -2
@@ -350,14 +350,14 @@ void __init swiotlb_init_remap(bool addressing_limit, unsigned int flags, } mem->areas =memblock_alloc (array_size (sizeof (struct io_tlb_area ), - default_nareas),SMP_CACHE_BYTES ); + nareas),SMP_CACHE_BYTES );if (!mem->areas) {pr_warn ("%s: Failed to allocate mem->areas.\n" , __func__);return ; }swiotlb_init_io_tlb_mem (mem,__pa (tlb), nslabs, flags, false, - default_nareas); + nareas);if (flags &SWIOTLB_VERBOSE )swiotlb_print_info ();
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 134/321 power: supply: ucs1002: fix error code in ucs1002_get_property()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit e35059949daa83f8dadf710d0f829ab3c3a72fe2 ]
This function is supposed to return 0 for success instead of returning the val->intval. This makes it the same as the other case statements in this function.
--- drivers/power/supply/ucs1002_power.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/power/supply/ucs1002_power.c +2 -1
@@ -384,7 +384,8 @@ static int ucs1002_get_property(struct power_supply *psy,case POWER_SUPPLY_PROP_USB_TYPE :return ucs1002_get_usb_type (info, val);case POWER_SUPPLY_PROP_HEALTH : -return val->intval = info->health; + val->intval = info->health; +return 0 ;case POWER_SUPPLY_PROP_PRESENT : val->intval = info->present;return 0 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 135/321 power: supply: rt9467: Fix rt9467_run_aicl()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit cba320408d631422fef0ad8407954fb9d6f8f650 ]
It is spurious to bail-out on a wait_for_completion_timeout() call that does NOT timeout.
Reverse the logic to return -ETIMEDOUT instead, in case of tiemout.
--- drivers/power/supply/rt9467-charger.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/power/supply/rt9467-charger.c +2 -2
@@ -598,8 +598,8 @@ static int rt9467_run_aicl(struct rt9467_chg_data *data)reinit_completion (&data->aicl_done); ret =wait_for_completion_timeout (&data->aicl_done,msecs_to_jiffies (3500 )); -if (ret) -return ret; +if (ret ==0 ) +return -ETIMEDOUT ; ret =rt9467_get_value_from_ranges (data,F_IAICR ,RT9467_RANGE_IAICR , &aicr_get);if (ret) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 136/321 power: supply: core: fix use after free in uevent
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Reichel <[email protected]>
[ Upstream commit 3dc0bab23dba53f315c9a7b4a679e0a6d46f7c6e ]
power_supply_uevent() which is called to emit a udev event on device deletion attempts to use the power_supply_battery_info structure, which is device-managed and has been freed before this point.
Fix this by not generating all battery/charger properties when the device is about to be removed. This also avoids generating errors when trying to access the hardware in hot-unplug scenarios.
==================================================================
BUG: KASAN: slab-use-after-free in power_supply_battery_info_has_prop (power_supply_core.c:872) Read of size 4 at addr 0000000062e59028 by task python3/27 Call Trace: power_supply_battery_info_has_prop (power_supply_core.c:872) power_supply_uevent (power_supply_sysfs.c:504) dev_uevent (drivers/base/core.c:2590) kobject_uevent_env (lib/kobject_uevent.c:558) kobject_uevent (lib/kobject_uevent.c:643) device_del (drivers/base/core.c:3266 drivers/base/core.c:3831) device_unregister (drivers/base/core.c:3730 drivers/base/core.c:3854) power_supply_unregister (power_supply_core.c:1608) devm_power_supply_release (power_supply_core.c:1515) release_nodes (drivers/base/devres.c:506) devres_release_group (drivers/base/devres.c:669) i2c_device_remove (drivers/i2c/i2c-core-base.c:629) device_remove (drivers/base/dd.c:570) device_release_driver_internal (drivers/base/dd.c:1274 drivers/base/dd.c:1295) device_driver_detach (drivers/base/dd.c:1332) unbind_store (drivers/base/bus.c:247) ... Allocated by task 27: devm_kmalloc (drivers/base/devres.c:119 drivers/base/devres.c:829) power_supply_get_battery_info (include/linux/device.h:316 power_supply_core.c:626) __power_supply_register (power_supply_core.c:1408) devm_power_supply_register (power_supply_core.c:1544) bq256xx_probe (bq256xx_charger.c:1539 bq256xx_charger.c:1727) bq256xx_charger i2c_device_probe (drivers/i2c/i2c-core-base.c:584) really_probe (drivers/base/dd.c:579 drivers/base/dd.c:658) __driver_probe_device (drivers/base/dd.c:800) device_driver_attach (drivers/base/dd.c:1128) bind_store (drivers/base/bus.c:273) ... Freed by task 27: kfree (mm/slab_common.c:1073) release_nodes (drivers/base/devres.c:503) devres_release_all (drivers/base/devres.c:536) device_del (drivers/base/core.c:3829) device_unregister (drivers/base/core.c:3730 drivers/base/core.c:3854) power_supply_unregister (power_supply_core.c:1608) devm_power_supply_release (power_supply_core.c:1515) release_nodes (drivers/base/devres.c:506) devres_release_group (drivers/base/devres.c:669) i2c_device_remove (drivers/i2c/i2c-core-base.c:629) device_remove (drivers/base/dd.c:570) device_release_driver_internal (drivers/base/dd.c:1274 drivers/base/dd.c:1295) device_driver_detach (drivers/base/dd.c:1332) unbind_store (drivers/base/bus.c:247) ... ==================================================================
--- drivers/power/supply/power_supply_sysfs.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/power/supply/power_supply_sysfs.c +7 -0
@@ -482,6 +482,13 @@ int power_supply_uevent(const struct device *dev, struct kobj_uevent_env *env)if (ret)return ret; +/* +* Kernel generates KOBJ_REMOVE uevent in device removal path, after +* resources have been freed. Exit early to avoid use-after-free. +*/ +if (psy->removing) +return 0 ; + prop_buf = (char *)get_zeroed_page (GFP_KERNEL );if (!prop_buf)return -ENOMEM ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 137/321 firmware: imx-dsp: Fix an error handling path in imx_dsp_setup_channels()
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit e527adfb9b7d9d05a4577c116519e59a2bda4b05 ]
If mbox_request_channel_byname() fails, the memory allocated a few lines above still need to be freed before going to the error handling path.
--- drivers/firmware/imx/imx-dsp.c | 1 + 1 file changed, 1 insertion(+)
drivers/firmware/imx/imx-dsp.c +1 -0
@@ -115,6 +115,7 @@ static int imx_dsp_setup_channels(struct imx_dsp_ipc *dsp_ipc) dsp_chan->idx = i %2 ; dsp_chan->ch =mbox_request_channel_byname (cl, chan_name);if (IS_ERR (dsp_chan->ch)) { +kfree (dsp_chan->name); ret =PTR_ERR (dsp_chan->ch);if (ret != -EPROBE_DEFER ) dev_err(dev, "Failed to request mbox chan %s ret %d\n",
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 138/321 xtensa: add default definition for XCHAL_HAVE_DIV32
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <[email protected]>
[ Upstream commit 494e87ffa0159b3f879694a9231089707792a44d ]
When variant FSF is set, XCHAL_HAVE_DIV32 is not defined. Add default definition for that macro to prevent build warnings:
arch/xtensa/lib/divsi3.S:9:5: warning: "XCHAL_HAVE_DIV32" is not defined, evaluates to 0 [-Wundef]
9 | #if XCHAL_HAVE_DIV32
arch/xtensa/lib/modsi3.S:9:5: warning: "XCHAL_HAVE_DIV32" is not defined, evaluates to 0 [-Wundef]
9 | #if XCHAL_HAVE_DIV32--- arch/xtensa/include/asm/core.h | 4 ++++ 1 file changed, 4 insertions(+)
arch/xtensa/include/asm/core.h +4 -0
@@ -6,6 +6,10 @@#include <variant/core.h> +#ifndef XCHAL_HAVE_DIV32 +#define XCHAL_HAVE_DIV32 0 +#endif +#ifndef XCHAL_HAVE_EXCLUSIVE #define XCHAL_HAVE_EXCLUSIVE 0#endif
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 139/321 xtensa: iss/network: make functions static
In reply to Greg Kroah-Hartman6.5-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit 1b59efeb59851277266318f4e0132aa61ce3455e ]
Make 2 functions static to prevent build warnings:
arch/xtensa/platforms/iss/network.c:204:16: warning: no previous prototype for 'tuntap_protocol' [-Wmissing-prototypes]
204 | unsigned short tuntap_protocol(struct sk_buff *skb)arch/xtensa/platforms/iss/network.c:444:6: warning: no previous prototype for 'iss_net_user_timer_expire' [-Wmissing-prototypes]
444 | void iss_net_user_timer_expire(struct timer_list *unused)
Message-Id: <[email protected]>
--- arch/xtensa/platforms/iss/network.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/xtensa/platforms/iss/network.c +2 -2
@@ -201,7 +201,7 @@ static int tuntap_write(struct iss_net_private *lp, struct sk_buff **skb)return simc_write (lp->tp.info.tuntap.fd, (*skb)->data, (*skb)->len); } -unsigned short tuntap_protocol (struct sk_buff *skb) +static unsigned short tuntap_protocol (struct sk_buff *skb) {return eth_type_trans (skb, skb->dev); }
@@ -441,7 +441,7 @@ static int iss_net_change_mtu(struct net_device *dev, int new_mtu)return -EINVAL ; } -void iss_net_user_timer_expire (struct timer_list *unused) +static void iss_net_user_timer_expire (struct timer_list *unused) { }
Signature · 1 line
2.40.1