6.1.64-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 6.1.64-rc1 review
This is the start of the stable review cycle for the 6.1.64 release. There are 372 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun, 26 Nov 2023 17:19:17 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.64-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.1.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.1.64-rc1
Victor Shih <[email protected]>
mmc: sdhci-pci-gli: GL9755: Mask the replay timer timeout of AER
Vicki Pfau <[email protected]>
Input: xpad - add VID for Turtle Beach controllers
Steven Rostedt (Google) <[email protected]>
tracing: Have trace_event_file have ref counters
Michael Ellerman <[email protected]>
powerpc/powernv: Fix fortify source warnings in opal-prd.c
Lewis Huang <[email protected]>
drm/amd/display: Change the DMCUB mailbox memory location from FB to inbox
Tianci Yin <[email protected]>
drm/amd/display: Enable fast plane updates on DCN3.2 and above
Mario Limonciello <[email protected]>
drm/amd/display: fix a NULL pointer dereference in amdgpu_dm_i2c_xfer()
Christian König <[email protected]>
drm/amdgpu: lower CS errors to debug severity
Christian König <[email protected]>
drm/amdgpu: fix error handling in amdgpu_bo_list_get()
Alex Deucher <[email protected]>
drm/amdgpu: don't use ATRM for external devices
Alex Deucher <[email protected]>
drm/amdgpu: don't use pci_is_thunderbolt_attached()
Alex Deucher <[email protected]>
drm/amdgpu/smu13: drop compute workload workaround
Ma Jun <[email protected]>
drm/amd/pm: Fix error of MACO flag setting code
Kunwu Chan <[email protected]>
drm/i915: Fix potential spectre vulnerability
Ville Syrjälä <[email protected]>
drm/i915: Bump GLK CDCLK frequency when driving multiple pipes
Bas Nieuwenhuizen <[email protected]>
drm/amd/pm: Handle non-terminated overdrive commands.
Jan Kara <[email protected]>
ext4: properly sync file size update after O_SYNC direct IO
Kemeng Shi <[email protected]>
ext4: add missed brelse in update_backups
Kemeng Shi <[email protected]>
ext4: remove gdb backup copy for meta bg in setup_new_flex_group_blocks
Zhang Yi <[email protected]>
ext4: correct the start block of counting reserved clusters
Kemeng Shi <[email protected]>
ext4: correct return value of ext4_convert_meta_bg
Ojaswin Mujoo <[email protected]>
ext4: mark buffer new if it is unwritten to avoid stale data exposure
Kemeng Shi <[email protected]>
ext4: correct offset of gdb backup in non meta_bg group to update_backups
Max Kellermann <[email protected]>
ext4: apply umask if ACL support is disabled
Heiner Kallweit <[email protected]>
Revert "net: r8169: Disable multicast filter for RTL8168H and RTL8107E"
Andrey Konovalov <[email protected]>
media: qcom: camss: Fix csid-gen2 for test pattern generator
Bryan O'Donoghue <[email protected]>
media: qcom: camss: Fix invalid clock enable bit disjunction
Bryan O'Donoghue <[email protected]>
media: qcom: camss: Fix missing vfe_lite clocks check
Bryan O'Donoghue <[email protected]>
media: qcom: camss: Fix VFE-480 vfe_disable_output()
Bryan O'Donoghue <[email protected]>
media: qcom: camss: Fix VFE-17x vfe_disable_output()
Bryan O'Donoghue <[email protected]>
media: qcom: camss: Fix vfe_get() error jump
Bryan O'Donoghue <[email protected]>
media: qcom: camss: Fix pm_domain_on sequence in probe
Victor Shih <[email protected]>
mmc: sdhci-pci-gli: GL9750: Mask the replay timer timeout of AER
ChunHao Lin <[email protected]>
r8169: add handling DASH when DASH is disabled
ChunHao Lin <[email protected]>
r8169: fix network lost after resume on DASH systems
Paolo Abeni <[email protected]>
mptcp: fix setsockopt(IP_TOS) subflow locking
Geliang Tang <[email protected]>
mptcp: add validity check for sending RM_ADDR
Paolo Abeni <[email protected]>
mptcp: deal with large GSO size
Roman Gushchin <[email protected]>
mm: kmem: drop __GFP_NOFAIL when allocating objcg vectors
Stefan Roesch <[email protected]>
mm: fix for negative counter: nr_file_hugepages
Victor Shih <[email protected]>
mmc: sdhci-pci-gli: A workaround to allow GL9750 to enter ASPM L1.2
Nam Cao <[email protected]>
riscv: kprobes: allow writing to x0
Song Shuai <[email protected]>
riscv: correct pt_level name via pgtable_l5/4_enabled
Song Shuai <[email protected]>
riscv: mm: Update the comment of CONFIG_PAGE_OFFSET
Nathan Chancellor <[email protected]>
LoongArch: Mark __percpu functions as always inline
Mahmoud Adam <[email protected]>
nfsd: fix file memleak on client_opens_release
Mikulas Patocka <[email protected]>
dm-verity: don't use blocking calls from tasklets
Jani Nikula <[email protected]>
drm/mediatek/dp: fix memory leak on ->get_edid callback error path
Jani Nikula <[email protected]>
drm/mediatek/dp: fix memory leak on ->get_edid callback audio detection
Sakari Ailus <[email protected]>
media: ccs: Correctly initialise try compose rectangle
Vikash Garodia <[email protected]>
media: venus: hfi: add checks to handle capabilities from firmware
Vikash Garodia <[email protected]>
media: venus: hfi: fix the check to handle session buffer requirement
Vikash Garodia <[email protected]>
media: venus: hfi_parser: Add check to keep the number of codecs within range
Sean Young <[email protected]>
media: sharp: fix sharp encoding
Sean Young <[email protected]>
media: lirc: drop trailing space from scancode transmit
Su Hui <[email protected]>
f2fs: avoid format-overflow warning
Jaegeuk Kim <[email protected]>
f2fs: do not return EFSCORRUPTED, but try to run online repair
Heiner Kallweit <[email protected]>
i2c: i801: fix potential race in i801_block_transaction_byte_by_byte
Klaus Kudielka <[email protected]>
net: phylink: initialize carrier state at creation
Alexander Sverdlin <[email protected]>
net: dsa: lan9303: consequently nested-lock physical MDIO
Andrew Lunn <[email protected]>
net: ethtool: Fix documentation of ethtool_sprintf()
Harald Freudenberger <[email protected]>
s390/ap: fix AP bus crash on early config change callback invocation
Tam Nguyen <[email protected]>
i2c: designware: Disable TX_EMPTY irq while waiting for block length byte
Darren Hart <[email protected]>
sbsa_gwdt: Calculate timeout with 64-bit math
Ondrej Mosnacek <[email protected]>
lsm: fix default return value for inode_getsecctx
Ondrej Mosnacek <[email protected]>
lsm: fix default return value for vm_enough_memory
Robert Marko <[email protected]>
Revert "i2c: pxa: move to generic GPIO recovery"
Johnathan Mantey <[email protected]>
Revert ncsi: Propagate carrier gain/loss events to the NCSI controller
Jim Harris <[email protected]>
cxl/region: Fix x1 root-decoder granularity calculations
Dan Williams <[email protected]>
tools/testing/cxl: Define a fixed volatile configuration to parse
Dan Williams <[email protected]>
cxl/mem: Move devm_cxl_add_endpoint() from cxl_core to cxl_mem
Robert Richter <[email protected]>
cxl: Unify debug messages when calling devm_cxl_add_port()
Frank Li <[email protected]>
i3c: master: svc: fix random hot join failure since timeout error
Clark Wang <[email protected]>
i3c: master: svc: add NACK check after start byte sent
Jim Harris <[email protected]>
cxl/region: Do not try to cleanup after cxl_region_setup_targets() fails
Dan Williams <[email protected]>
cxl/region: Move region-position validation to a helper
Dan Williams <[email protected]>
cxl/region: Cleanup target list on attach error
Dan Williams <[email protected]>
cxl/region: Validate region mode vs decoder mode
Muhammad Ahmed <[email protected]>
drm/amd/display: enable dsc_clk even if dsc_pg disabled
Guan Wentao <[email protected]>
Bluetooth: btusb: Add 0bda:b85b for Fn-Link RTL8852BE
Masum Reza <[email protected]>
Bluetooth: btusb: Add RTW8852BE device 13d3:3570 to device tables
Larry Finger <[email protected]>
bluetooth: Add device 13d3:3571 to device tables
Larry Finger <[email protected]>
bluetooth: Add device 0bda:887b to device tables
Artem Lukyanov <[email protected]>
Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0cb8:0xc559
Gustavo A. R. Silva <[email protected]>
clk: visconti: Fix undefined behavior bug in struct visconti_pll_provider
Dario Binacchi <[email protected]>
clk: visconti: remove unused visconti_pll_provider::regmap
Christian Marangi <[email protected]>
cpufreq: stats: Fix buffer overflow detection in trans_stats()
Pengfei Li <[email protected]>
pmdomain: imx: Make imx pgc power domain also set the fwnode
Maíra Canal <[email protected]>
pmdomain: bcm: bcm2835-power: check if the ASB register is equal to enable
Stefan Binding <[email protected]>
ALSA: hda/realtek: Add quirks for HP Laptops
Matus Malych <[email protected]>
ALSA: hda/realtek: Enable Mute LED on HP 255 G10
Chandradeep Dey <[email protected]>
ALSA: hda/realtek - Enable internal speaker of ASUS K6500ZC
Kailang Yang <[email protected]>
ALSA: hda/realtek - Add Dell ALC295 to pin fall back table
Eymen Yigit <[email protected]>
ALSA: hda/realtek: Enable Mute LED on HP 255 G8
Takashi Iwai <[email protected]>
ALSA: info: Fix potential deadlock at disconnection
Naohiro Aota <[email protected]>
btrfs: zoned: wait for data BG to be finished on direct IO allocation
Dave Chinner <[email protected]>
xfs: recovery should not clear di_flushiter unconditionally
Shyam Prasad N <[email protected]>
cifs: do not reset chan_max if multichannel is not supported at mount
Shyam Prasad N <[email protected]>
cifs: force interface update before a fresh session setup
Shyam Prasad N <[email protected]>
cifs: reconnect helper should set reconnect for the right channel
Paulo Alcantara <[email protected]>
smb: client: fix potential deadlock when releasing mids
Paulo Alcantara <[email protected]>
smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
Steve French <[email protected]>
smb3: fix caching of ctime on setxattr
Steve French <[email protected]>
smb3: fix touch -h of symlink
Steve French <[email protected]>
smb3: fix creating FIFOs when mounting with "sfu" mount option
Jeff Layton <[email protected]>
fs: add ctime accessors infrastructure
Basavaraj Natikar <[email protected]>
xhci: Enable RPM on controllers that support low-power states
Helge Deller <[email protected]>
parisc/power: Fix power soft-off when running on qemu
Helge Deller <[email protected]>
parisc/pgtable: Do not drop upper 5 address bits of physical address
Helge Deller <[email protected]>
parisc: Prevent booting 64-bit kernels on PA1.x machines
Frank Li <[email protected]>
i3c: master: svc: fix SDA keep low when polling IBIWON timeout happen
Frank Li <[email protected]>
i3c: master: svc: fix check wrong status register in irq handler
Frank Li <[email protected]>
i3c: master: svc: fix ibi may not return mandatory data byte
Frank Li <[email protected]>
i3c: master: svc: fix wrong data return when IBI happen during start frame
Frank Li <[email protected]>
i3c: master: svc: fix race condition in ibi work thread
Joshua Yeong <[email protected]>
i3c: master: cdns: Fix reading status register
Linus Walleij <[email protected]>
mtd: cfi_cmdset_0001: Byte swap OTP info
Zi Yan <[email protected]>
mm/memory_hotplug: use pfn math in place of direct struct page manipulation
Zi Yan <[email protected]>
mm/cma: use nth_page() in place of direct struct page manipulation
Heiko Carstens <[email protected]>
s390/cmma: fix handling of swapper_pg_dir and invalid_pg_dir
Heiko Carstens <[email protected]>
s390/cmma: fix detection of DAT pages
Heiko Carstens <[email protected]>
s390/cmma: fix initial kernel address space page table walk
Alain Volmat <[email protected]>
dmaengine: stm32-mdma: correct desc prep when channel running
Gaurav Batra <[email protected]>
powerpc/pseries/iommu: enable_ddw incorrectly returns direct mapping for SR-IOV device
Sanjuán García, Jorge <[email protected]>
mcb: fix error handling for different scenarios when parsing
Saravana Kannan <[email protected]>
driver core: Release all resources during unbind before updating device links
Steven Rostedt (Google) <[email protected]>
tracing: Have the user copy of synthetic event address use correct context
Benjamin Bara <[email protected]>
i2c: core: Run atomic i2c xfer when !preemptible
Benjamin Bara <[email protected]>
kernel/reboot: emergency_restart: Set correct system_state
Eric Biggers <[email protected]>
quota: explicitly forbid quota files from being encrypted
Zhihao Cheng <[email protected]>
jbd2: fix potential data lost in recovering journal raced with synchronizing fs bdev
Krzysztof Kozlowski <[email protected]>
ASoC: codecs: wsa-macro: fix uninitialized stack variables with name prefix
Jamie Lentin <[email protected]>
hid: lenovo: Resend all settings on reset_resume for compact keyboards
Ilpo Järvinen <[email protected]>
selftests/resctrl: Reduce failures due to outliers in MBA/MBM tests
Ilpo Järvinen <[email protected]>
selftests/resctrl: Move _GNU_SOURCE define into Makefile
Ilpo Järvinen <[email protected]>
selftests/resctrl: Remove duplicate feature check from CMT test
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: split async and sync catchall in two functions
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: remove catchall element in GC sync path
Mimi Zohar <[email protected]>
ima: detect changes to the backing overlay file
Amir Goldstein <[email protected]>
ima: annotate iint mutex to avoid lockdep false positive warnings
Johan Hovold <[email protected]>
mfd: qcom-spmi-pmic: Fix revid implementation
Johan Hovold <[email protected]>
mfd: qcom-spmi-pmic: Fix reference leaks in revid helper
Vignesh Viswanathan <[email protected]>
arm64: dts: qcom: ipq6018: Fix tcsr_mutex register size
Vasily Khoruzhick <[email protected]>
ACPI: FPDT: properly handle invalid FPDT subtables
Kathiravan Thirumoorthy <[email protected]>
firmware: qcom_scm: use 64-bit calling convention only when client is 64-bit
Vignesh Viswanathan <[email protected]>
arm64: dts: qcom: ipq8074: Fix hwlock index for SMEM
Josef Bacik <[email protected]>
btrfs: don't arbitrarily slow down delalloc if we're committing
Catalin Marinas <[email protected]>
rcu: kmemleak: Ignore kmemleak false positives when RCU-freeing objects
Brian Geffon <[email protected]>
PM: hibernate: Clean up sync_read handling in snapshot_write_next()
Brian Geffon <[email protected]>
PM: hibernate: Use __get_safe_page() rather than touching the list
Vignesh Viswanathan <[email protected]>
arm64: dts: qcom: ipq6018: Fix hwlock index for SMEM
Joel Fernandes (Google) <[email protected]>
rcu/tree: Defer setting of jiffies during stall reset
Chuck Lever <[email protected]>
svcrdma: Drop connection after an RDMA Read error
Ajay Singh <[email protected]>
wifi: wilc1000: use vmm_table as array in wilc struct
Uwe Kleine-König <[email protected]>
PCI: exynos: Don't discard .remove() callback
Uwe Kleine-König <[email protected]>
PCI: kirin: Don't discard .remove() callback
Heiner Kallweit <[email protected]>
PCI/ASPM: Fix L1 substate handling in aspm_attr_store_common()
Bean Huo <[email protected]>
mmc: Add quirk MMC_QUIRK_BROKEN_CACHE_FLUSH for Micron eMMC Q2J54A
Nitin Yadav <[email protected]>
mmc: sdhci_am654: fix start loop index for TAP value parsing
Dan Carpenter <[email protected]>
mmc: vub300: fix an error code
Namjae Jeon <[email protected]>
ksmbd: fix slab out of bounds write in smb_inherit_dacl()
Namjae Jeon <[email protected]>
ksmbd: handle malformed smb1 message
Kathiravan Thirumoorthy <[email protected]>
clk: qcom: ipq6018: drop the CLK_SET_RATE_PARENT flag from PLL clocks
Kathiravan Thirumoorthy <[email protected]>
clk: qcom: ipq8074: drop the CLK_SET_RATE_PARENT flag from PLL clocks
Gustavo A. R. Silva <[email protected]>
clk: socfpga: Fix undefined behavior bug in struct stratix10_clock_data
Helge Deller <[email protected]>
parisc/power: Add power soft-off when running on qemu
Helge Deller <[email protected]>
parisc/pdc: Add width field to struct pdc_model
Nathan Chancellor <[email protected]>
arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer
Uwe Kleine-König <[email protected]>
PCI: keystone: Don't discard .probe() callback
Uwe Kleine-König <[email protected]>
PCI: keystone: Don't discard .remove() callback
Jarkko Sakkinen <[email protected]>
KEYS: trusted: Rollback init_trusted() consistently
Sumit Garg <[email protected]>
KEYS: trusted: tee: Refactor register SHM usage
Herve Codina <[email protected]>
genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware
Rong Chen <[email protected]>
mmc: meson-gx: Remove setting of CMD_CFG_ERROR
Johan Hovold <[email protected]>
wifi: ath11k: fix gtk offload status event locking
Johan Hovold <[email protected]>
wifi: ath11k: fix htt pktlog locking
Johan Hovold <[email protected]>
wifi: ath11k: fix dfs radar event locking
Johan Hovold <[email protected]>
wifi: ath11k: fix temperature event locking
Mark Brown <[email protected]>
regmap: Ensure range selector registers are updated after cache sync
Werner Sembach <[email protected]>
ACPI: resource: Do IRQ override on TongFang GMxXGxx
SeongJae Park <[email protected]>
mm/damon/sysfs: check error from damon_sysfs_update_target()
SeongJae Park <[email protected]>
mm/damon: implement a function for max nr_accesses safe calculation
SeongJae Park <[email protected]>
mm/damon/ops-common: avoid divide-by-zero during region hotness calculation
SeongJae Park <[email protected]>
mm/damon/lru_sort: avoid divide-by-zero in hot threshold calculation
Krister Johansen <[email protected]>
watchdog: move softlockup_panic back to early_param
SeongJae Park <[email protected]>
mm/damon/sysfs: update monitoring target regions for online input commit
SeongJae Park <[email protected]>
mm/damon/sysfs: remove requested targets when online-commit inputs
Lukas Wunner <[email protected]>
PCI/sysfs: Protect driver's D3cold preference from user space
David Woodhouse <[email protected]>
hvc/xen: fix event channel handling for secondary consoles
David Woodhouse <[email protected]>
hvc/xen: fix error path in xen_hvc_init() to always register frontend driver
David Woodhouse <[email protected]>
hvc/xen: fix console unplug
Pavel Krasavin <[email protected]>
tty: serial: meson: fix hard LOCKUP on crtscts mode
Muhammad Usama Anjum <[email protected]>
tty/sysrq: replace smp_processor_id() with get_cpu()
Krister Johansen <[email protected]>
proc: sysctl: prevent aliased sysctls from getting passed to init
Paul Moore <[email protected]>
audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare()
Paul Moore <[email protected]>
audit: don't take task_lock() in audit_exe_compare() code path
Tao Su <[email protected]>
KVM: x86: Clear bit12 of ICR after APIC-write VM-exit
Maciej S. Szmigiero <[email protected]>
KVM: x86: Ignore MSR_AMD64_TW_CFG access
Nicolas Saenz Julienne <[email protected]>
KVM: x86: hyper-v: Don't auto-enable stimer on write from user-space
Pu Wen <[email protected]>
x86/cpu/hygon: Fix the CPU topology evaluation for real
Roxana Nicolescu <[email protected]>
crypto: x86/sha - load modules based on CPU features
Quinn Tran <[email protected]>
scsi: qla2xxx: Fix system crash due to bad pointer access
Chandrakanth patil <[email protected]>
scsi: megaraid_sas: Increase register read retry rount from 3 to 30 for selected registers
Ranjan Kumar <[email protected]>
scsi: mpt3sas: Fix loop logic
Shung-Hsi Yu <[email protected]>
bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END
Hao Sun <[email protected]>
bpf: Fix check_stack_write_fixed_off() to correctly spill imm
Kees Cook <[email protected]>
randstruct: Fix gcc-plugin performance mode to stay in group
Nicholas Piggin <[email protected]>
powerpc/perf: Fix disabling BHRB and instruction sampling
Adrian Hunter <[email protected]>
perf intel-pt: Fix async branch flags
Vikash Garodia <[email protected]>
media: venus: hfi: add checks to perform sanity on queue pointers
Alexandre Ghiti <[email protected]>
drivers: perf: Check find_first_bit() return value
Harshit Mogalapalli <[email protected]>
i915/perf: Fix NULL deref bugs with drm_dbg() calls
Ekaterina Esina <[email protected]>
cifs: fix check of rc in function generate_smb3signingkey
Anastasia Belova <[email protected]>
cifs: spnego: add ';' in HOST_KEY_LEN
Chen Yu <[email protected]>
tools/power/turbostat: Enable the C-state Pre-wake printing
Zhang Rui <[email protected]>
tools/power/turbostat: Fix a knl bug
Vlad Buslov <[email protected]>
macvlan: Don't propagate promisc change to lower dev in passthru
Rahul Rameshbabu <[email protected]>
net/mlx5e: Check return value of snprintf writing to fw_version buffer for representors
Rahul Rameshbabu <[email protected]>
net/mlx5e: Check return value of snprintf writing to fw_version buffer
Saeed Mahameed <[email protected]>
net/mlx5e: Reduce the size of icosq_str
Vlad Buslov <[email protected]>
net/mlx5e: Fix pedit endianness
Gavin Li <[email protected]>
net/mlx5e: fix double free of encap_header in update funcs
Dust Li <[email protected]>
net/mlx5e: fix double free of encap_header
Baruch Siach <[email protected]>
net: stmmac: avoid rx queue overrun
Baruch Siach <[email protected]>
net: stmmac: fix rx budget limit check
Dan Carpenter <[email protected]>
netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval()
Linkui Xiao <[email protected]>
netfilter: nf_conntrack_bridge: initialize err to 0
Eric Dumazet <[email protected]>
af_unix: fix use-after-free in unix_stream_read_actor()
Linus Walleij <[email protected]>
net: ethernet: cortina: Fix MTU max setting
Linus Walleij <[email protected]>
net: ethernet: cortina: Handle large frames
Linus Walleij <[email protected]>
net: ethernet: cortina: Fix max RX frame define
Eric Dumazet <[email protected]>
bonding: stop the device in bond_setup_by_slave()
Eric Dumazet <[email protected]>
ptp: annotate data-race around q->head and q->tail
Juergen Gross <[email protected]>
xen/events: fix delayed eoi list handling
Willem de Bruijn <[email protected]>
ppp: limit MRU to 64K
Sven Auhagen <[email protected]>
net: mvneta: fix calls to page_pool_get_stats
Shigeru Yoshida <[email protected]>
tipc: Fix kernel-infoleak due to uninitialized TLV value
Jijie Shao <[email protected]>
net: hns3: fix VF wrong speed and duplex issue
Jijie Shao <[email protected]>
net: hns3: fix VF reset fail issue
Yonglong Liu <[email protected]>
net: hns3: fix variable may not initialized problem in hns3_init_mac_addr()
Yonglong Liu <[email protected]>
net: hns3: fix out-of-bounds access may occur when coalesce info is read via debugfs
Jian Shen <[email protected]>
net: hns3: fix incorrect capability bit display for copper port
Yonglong Liu <[email protected]>
net: hns3: add barrier in vf mailbox reply process
Jian Shen <[email protected]>
net: hns3: fix add VLAN fail issue
Shigeru Yoshida <[email protected]>
tty: Fix uninit-value access in ppp_sync_receive()
Eric Dumazet <[email protected]>
ipvlan: add ipvlan_route_v6_outbound() helper
Stanislav Fomichev <[email protected]>
net: set SOCK_RCU_FREE before inserting socket into hashtable
Dan Carpenter <[email protected]>
vhost-vdpa: fix use after free in vhost_vdpa_probe()
Andreas Gruenbacher <[email protected]>
gfs2: Silence "suspicious RCU usage in gfs2_permission" warning
felix <[email protected]>
SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
Olga Kornievskaia <[email protected]>
NFSv4.1: fix SP4_MACH_CRED protection for pnfs IO
Dan Carpenter <[email protected]>
SUNRPC: Add an IS_ERR() check back to where it was
Olga Kornievskaia <[email protected]>
NFSv4.1: fix handling NFS4ERR_DELAY when testing for session trunking
Yi Yang <[email protected]>
mtd: rawnand: meson: check return value of devm_kasprintf()
Yi Yang <[email protected]>
mtd: rawnand: intel: check return value of devm_kasprintf()
Trond Myklebust <[email protected]>
SUNRPC: ECONNRESET might require a rebind
Finn Thain <[email protected]>
sched/core: Optimize in_task() and in_interrupt() a bit
Miri Korenblit <[email protected]>
wifi: iwlwifi: Use FW rate for non-data frames
Yi Yang <[email protected]>
mtd: rawnand: tegra: add missing check for platform_get_irq()
Dan Carpenter <[email protected]>
pwm: Fix double shift bug
Vitaly Prosyak <[email protected]>
drm/amdgpu: fix software pci_unplug on some chips
Alex Spataru <[email protected]>
ALSA: hda/realtek: Add quirk for ASUS UX7602ZM
Zongmin Zhou <[email protected]>
drm/qxl: prevent memory leak
Tony Lindgren <[email protected]>
ASoC: ti: omap-mcbsp: Fix runtime PM underflow warnings
Philipp Stanner <[email protected]>
i2c: dev: copy userspace array safely
Douglas Anderson <[email protected]>
kgdb: Flush console before entering kgdb on panic
Wayne Lin <[email protected]>
drm/amd/display: Avoid NULL dereference of timing generator
Takashi Iwai <[email protected]>
media: imon: fix access to invalid resource for the second interface
Sakari Ailus <[email protected]>
media: ccs: Fix driver quirk struct documentation
Ilpo Järvinen <[email protected]>
media: cobalt: Use FIELD_GET() to extract Link Width
Al Viro <[email protected]>
gfs2: fix an oops in gfs2_permission
Bob Peterson <[email protected]>
gfs2: ignore negated quota changes
Hans Verkuil <[email protected]>
media: vivid: avoid integer overflow
Rajeshwar R Shinde <[email protected]>
media: gspca: cpia1: shift-out-of-bounds in set_flicker
Billy Tsai <[email protected]>
i3c: master: mipi-i3c-hci: Fix a kernel panic for accessing DAT_data.
zhenwei pi <[email protected]>
virtio-blk: fix implicit overflow on virtio_max_dma_size
Axel Lin <[email protected]>
i2c: sun6i-p2wi: Prevent potential division by zero
Wolfram Sang <[email protected]>
i2c: fix memleak in i2c_new_client_device()
Jarkko Nikula <[email protected]>
i3c: mipi-i3c-hci: Fix out of bounds access in hci_dma_irq_handler
Dominique Martinet <[email protected]>
9p: v9fs_listxattr: fix %s null argument warning
Marco Elver <[email protected]>
9p/trans_fd: Annotate data-racy writes to file::f_flags
Hardik Gajjar <[email protected]>
usb: gadget: f_ncm: Always set current gadget in ncm_bind()
Zhiguo Niu <[email protected]>
f2fs: fix error handling of __get_node_page
Pierre-Louis Bossart <[email protected]>
soundwire: dmi-quirks: update HP Omen match
Stanley Chang <[email protected]>
usb: dwc3: core: configure TX/RX threshold for DWC3_IP
Yi Yang <[email protected]>
tty: vcc: Add check for kstrdup() in vcc_probe()
Mika Westerberg <[email protected]>
thunderbolt: Apply USB 3.x bandwidth quirk only in software connection manager
Zhang Shurong <[email protected]>
iio: adc: stm32-adc: harden against NULL pointer deref in stm32_adc_probe()
Jarkko Nikula <[email protected]>
mfd: intel-lpss: Add Intel Lunar Lake-M PCI IDs
Yuezhang Mo <[email protected]>
exfat: support handle zero-size directory
Jiri Kosina <[email protected]>
HID: Add quirk for Dell Pro Wireless Keyboard and Mouse KM5221W
Longfang Liu <[email protected]>
crypto: hisilicon/qm - prevent soft lockup in receive loop
Hans de Goede <[email protected]>
ASoC: Intel: soc-acpi-cht: Add Lenovo Yoga Tab 3 Pro YT3-X90 quirk
Bjorn Helgaas <[email protected]>
PCI: Use FIELD_GET() in Sapphire RX 5600 XT Pulse quirk
Yoshihiro Shimoda <[email protected]>
misc: pci_endpoint_test: Add Device ID for R-Car S4-8 PCIe controller
Bartosz Pawlowski <[email protected]>
PCI: Disable ATS for specific Intel IPU E2000 devices
Bartosz Pawlowski <[email protected]>
PCI: Extract ATS disabling to a helper function
Ilpo Järvinen <[email protected]>
PCI: Use FIELD_GET() to extract Link Width
Wenchao Hao <[email protected]>
scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()
Ilpo Järvinen <[email protected]>
PCI: Do error check on own line to split long "if" conditions
Ilpo Järvinen <[email protected]>
atm: iphase: Do PCI error checks on own line
Ilpo Järvinen <[email protected]>
PCI: mvebu: Use FIELD_PREP() with Link Width
Ilpo Järvinen <[email protected]>
PCI: tegra194: Use FIELD_GET()/FIELD_PREP() with Link Width fields
Cezary Rojewski <[email protected]>
ALSA: hda: Fix possible null-ptr-deref when assigning a stream
Vincent Whitchurch <[email protected]>
ARM: 9320/1: fix stack depot IRQ stack filter
Mikhail Khvainitski <[email protected]>
HID: lenovo: Detect quirk-free fw on cptkbd and stop applying workaround
Manas Ghandat <[email protected]>
jfs: fix array-index-out-of-bounds in diAlloc
Manas Ghandat <[email protected]>
jfs: fix array-index-out-of-bounds in dbFindLeaf
Juntong Deng <[email protected]>
fs/jfs: Add validity check for db_maxag and db_agpref
Juntong Deng <[email protected]>
fs/jfs: Add check for negative db_l2nbperpage
Tyrel Datwyler <[email protected]>
scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool
Yihang Li <[email protected]>
scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs
Ilpo Järvinen <[email protected]>
RDMA/hfi1: Use FIELD_GET() to extract Link Width
Rander Wang <[email protected]>
ASoC: SOF: ipc4: handle EXCEPTION_CAUGHT notification from firmware
Geoffrey D. Bennett <[email protected]>
ALSA: scarlett2: Move USB IDs out from device_info struct
Lu Jialin <[email protected]>
crypto: pcrypt - Fix hungtask for PADATA_RESET
Richard Fitzgerald <[email protected]>
ASoC: SOF: Pass PCI SSID to machine driver
Richard Fitzgerald <[email protected]>
ASoC: soc-card: Add storage for PCI SSID
zhujun2 <[email protected]>
selftests/efivarfs: create-read: fix a resource leak
Laurentiu Tudor <[email protected]>
arm64: dts: ls208xa: use a pseudo-bus to constrain usb dma size
Qu Huang <[email protected]>
drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL
Jesse Zhang <[email protected]>
drm/amdkfd: Fix shift out-of-bounds issue
Ondrej Jirman <[email protected]>
drm/panel: st7703: Pick different reset sequence
Ma Ke <[email protected]>
drm/amdgpu/vkms: fix a possible null pointer dereference
Ma Ke <[email protected]>
drm/radeon: fix a possible null pointer dereference
Ma Ke <[email protected]>
drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference
Ma Ke <[email protected]>
drm/panel: fix a possible null pointer dereference
Stanley.Yang <[email protected]>
drm/amdgpu: Fix potential null pointer derefernce
Mario Limonciello <[email protected]>
drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga
Mario Limonciello <[email protected]>
drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
Jani Nikula <[email protected]>
drm/msm/dp: skip validity check for DP CTS EDID checksum
Philipp Stanner <[email protected]>
drm: vmwgfx_surface.c: copy user-array safely
Philipp Stanner <[email protected]>
drm_lease.c: copy user-array safely
Philipp Stanner <[email protected]>
kernel: watch_queue: copy user-array safely
Philipp Stanner <[email protected]>
kernel: kexec: copy user-array safely
Philipp Stanner <[email protected]>
string.h: add array-wrappers for (v)memdup_user()
Wenjing Liu <[email protected]>
drm/amd/display: use full update for clip size increase of large plane source
Mario Limonciello <[email protected]>
drm/amd: Update update_pcie_parameters functions to use uint8_t arguments
Xiaogang Chen <[email protected]>
drm/amdkfd: Fix a race condition of vram buffer unref in svm code
David (Ming Qiang) Wu <[email protected]>
drm/amdgpu: not to save bo in the case of RAS err_event_athub
baozhu.liu <[email protected]>
drm/komeda: drop all currently held locks if deadlock happens
Sui Jingfeng <[email protected]>
drm/gma500: Fix call trace when psb_gem_mm_init() fails
Olli Asikainen <[email protected]>
platform/x86: thinkpad_acpi: Add battery quirk for Thinkpad X120e
Tzung-Bi Shih <[email protected]>
platform/chrome: kunit: initialize lock for fake ec_dev
Gerhard Engleder <[email protected]>
tsnep: Fix tsnep_request_irq() format-overflow warning
Jonathan Denose <[email protected]>
ACPI: EC: Add quirk for HP 250 G7 Notebook PC
ZhengHan Wang <[email protected]>
Bluetooth: Fix double free in hci_conn_cleanup
youwan Wang <[email protected]>
Bluetooth: btusb: Add date->evt_skb is NULL check
Andrii Nakryiko <[email protected]>
bpf: Ensure proper register state printing for cond jumps
Arseniy Krasnov <[email protected]>
vsock: read from socket's error queue
Douglas Anderson <[email protected]>
wifi: ath10k: Don't touch the CE interrupt registers after power up
Eric Dumazet <[email protected]>
net: annotate data-races around sk->sk_dst_pending_confirm
Eric Dumazet <[email protected]>
net: annotate data-races around sk->sk_tx_queue_mapping
Dmitry Antipov <[email protected]>
wifi: ath10k: fix clang-specific fortify warning
Dmitry Antipov <[email protected]>
wifi: ath9k: fix clang-specific fortify warnings
Kumar Kartikeya Dwivedi <[email protected]>
bpf: Detect IP == ksym.end as part of BPF program
Sieng-Piaw Liew <[email protected]>
atl1c: Work around the DMA RX overflow issue
Ping-Ke Shih <[email protected]>
wifi: mac80211: don't return unset power in ieee80211_get_tx_power()
Dmitry Antipov <[email protected]>
wifi: mac80211_hwsim: fix clang-specific fortify warning
Dmitry Antipov <[email protected]>
wifi: plfxlc: fix clang-specific fortify warning
Mike Rapoport (IBM) <[email protected]>
x86/mm: Drop the 4 MB restriction on minimal NUMA node memory size
Frederic Weisbecker <[email protected]>
workqueue: Provide one lock class key per work_on_cpu() callsite
Ran Xiaokai <[email protected]>
cpu/hotplug: Don't offline the last non-isolated CPU
Rik van Riel <[email protected]>
smp,csd: Throw an error if a CSD lock is stuck for too long
Ronald Wahl <[email protected]>
clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 hardware
Jacky Bai <[email protected]>
clocksource/drivers/timer-imx-gpt: Fix potential memory leak
Ricardo Cañuelo <[email protected]>
selftests/lkdtm: Disable CONFIG_UBSAN_TRAP in test config
Denis Arefev <[email protected]>
srcu: Fix srcu_struct node grpmask overflow on 64-bit systems
Zhen Lei <[email protected]>
rcu: Dump memory object info if callback function is invalid
Shuai Xue <[email protected]>
perf/core: Bail out early if the request AUX area is out of bound
Kent Overstreet <[email protected]>
lib/generic-radix-tree.c: Don't overflow in peek()
John Stultz <[email protected]>
locking/ww_mutex/test: Fix potential workqueue corruption
-------------
Diffstat:
Documentation/admin-guide/kernel-parameters.txt | 7 + Makefile | 4 +- arch/arm/include/asm/exception.h | 4 - arch/arm64/Kconfig | 2 + arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi | 46 +++--- arch/arm64/boot/dts/qcom/ipq6018.dtsi | 4 +- arch/arm64/boot/dts/qcom/ipq8074.dtsi | 2 +- arch/loongarch/include/asm/percpu.h | 10 +- arch/parisc/include/uapi/asm/pdc.h | 1 + arch/parisc/kernel/entry.S | 7 +- arch/parisc/kernel/head.S | 5 +- arch/powerpc/perf/core-book3s.c | 5 +- arch/powerpc/platforms/powernv/opal-prd.c | 17 ++- arch/powerpc/platforms/pseries/iommu.c | 8 +- arch/riscv/include/asm/page.h | 4 +- arch/riscv/kernel/probes/simulate-insn.c | 2 +- arch/riscv/mm/ptdump.c | 3 + arch/s390/mm/page-states.c | 25 +++- arch/x86/crypto/sha1_ssse3_glue.c | 12 ++ arch/x86/crypto/sha256_ssse3_glue.c | 12 ++ arch/x86/include/asm/msr-index.h | 1 + arch/x86/include/asm/numa.h | 7 - arch/x86/kernel/cpu/hygon.c | 8 +- arch/x86/kvm/hyperv.c | 10 +- arch/x86/kvm/lapic.c | 26 ++-- arch/x86/kvm/x86.c | 2 + arch/x86/mm/numa.c | 7 - crypto/pcrypt.c | 4 + drivers/acpi/acpi_fpdt.c | 45 ++++-- drivers/acpi/ec.c | 10 ++ drivers/acpi/resource.c | 12 ++ drivers/atm/iphase.c | 20 +-- drivers/base/dd.c | 2 +- drivers/base/regmap/regcache.c | 30 ++++ drivers/block/virtio_blk.c | 4 +- drivers/bluetooth/btusb.c | 15 ++ drivers/clk/qcom/gcc-ipq6018.c | 6 - drivers/clk/qcom/gcc-ipq8074.c | 6 - drivers/clk/socfpga/stratix10-clk.h | 4 +- drivers/clk/visconti/pll.h | 5 +- drivers/clocksource/timer-atmel-tcb.c | 1 + drivers/clocksource/timer-imx-gpt.c | 18 ++- drivers/cpufreq/cpufreq_stats.c | 14 +- drivers/crypto/hisilicon/qm.c | 2 + drivers/cxl/acpi.c | 2 - drivers/cxl/core/core.h | 11 -- drivers/cxl/core/hdm.c | 3 +- drivers/cxl/core/port.c | 92 ++++++------ drivers/cxl/core/region.c | 134 +++++++++++------ drivers/cxl/cxl.h | 4 +- drivers/cxl/cxlmem.h | 12 ++ drivers/cxl/mem.c | 38 +++++ drivers/dma/stm32-mdma.c | 4 +- drivers/firmware/qcom_scm.c | 7 + drivers/gpu/drm/amd/amdgpu/amdgpu_bios.c | 5 + drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 9 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 7 + drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c | 2 + drivers/gpu/drm/amd/amdgpu/nbio_v2_3.c | 5 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 13 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 24 ++-- drivers/gpu/drm/amd/display/dc/core/dc.c | 20 ++- drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 4 +- drivers/gpu/drm/amd/display/dc/dc.h | 5 + drivers/gpu/drm/amd/display/dc/dcn32/dcn32_hwseq.c | 3 + drivers/gpu/drm/amd/display/dmub/dmub_srv.h | 22 +-- drivers/gpu/drm/amd/display/dmub/src/dmub_srv.c | 32 +++-- drivers/gpu/drm/amd/include/pptable.h | 4 +- drivers/gpu/drm/amd/pm/amdgpu_pm.c | 8 +- .../gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h | 16 +-- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 2 +- drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h | 2 +- drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h | 4 +- drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 4 +- .../drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 8 +- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 4 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 40 +----- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 9 +- .../drm/arm/display/komeda/komeda_pipeline_state.c | 9 +- drivers/gpu/drm/drm_lease.c | 4 +- drivers/gpu/drm/gma500/psb_drv.h | 1 + drivers/gpu/drm/gma500/psb_irq.c | 5 + drivers/gpu/drm/i915/display/intel_cdclk.c | 12 ++ drivers/gpu/drm/i915/gem/i915_gem_context.c | 1 + drivers/gpu/drm/i915/i915_perf.c | 15 +- drivers/gpu/drm/mediatek/mtk_dp.c | 6 +- drivers/gpu/drm/msm/dp/dp_panel.c | 21 +-- drivers/gpu/drm/panel/panel-arm-versatile.c | 2 + drivers/gpu/drm/panel/panel-sitronix-st7703.c | 25 ++-- drivers/gpu/drm/panel/panel-tpo-tpg110.c | 2 + drivers/gpu/drm/qxl/qxl_display.c | 3 + drivers/gpu/drm/radeon/radeon_connectors.c | 2 + drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 4 +- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-lenovo.c | 118 ++++++++++----- drivers/hid/hid-quirks.c | 1 + drivers/i2c/busses/i2c-designware-master.c | 19 ++- drivers/i2c/busses/i2c-i801.c | 19 ++- drivers/i2c/busses/i2c-pxa.c | 76 ++++++++-- drivers/i2c/busses/i2c-sun6i-p2wi.c | 5 + drivers/i2c/i2c-core-base.c | 13 +- drivers/i2c/i2c-core.h | 2 +- drivers/i2c/i2c-dev.c | 4 +- drivers/i3c/master/i3c-master-cdns.c | 6 +- drivers/i3c/master/mipi-i3c-hci/dat_v1.c | 29 ++-- drivers/i3c/master/mipi-i3c-hci/dma.c | 2 +- drivers/i3c/master/svc-i3c-master.c | 60 +++++++- drivers/iio/adc/stm32-adc-core.c | 9 +- drivers/infiniband/hw/hfi1/pcie.c | 9 +- drivers/input/joystick/xpad.c | 1 + drivers/mcb/mcb-core.c | 1 + drivers/mcb/mcb-parse.c | 2 +- drivers/md/dm-verity-fec.c | 4 +- drivers/md/dm-verity-target.c | 23 +-- drivers/md/dm-verity.h | 2 +- drivers/media/i2c/ccs/ccs-core.c | 2 +- drivers/media/i2c/ccs/ccs-quirk.h | 4 +- drivers/media/pci/cobalt/cobalt-driver.c | 11 +- .../media/platform/qcom/camss/camss-csid-gen2.c | 9 +- .../platform/qcom/camss/camss-csiphy-3ph-1-0.c | 2 +- drivers/media/platform/qcom/camss/camss-vfe-170.c | 22 +-- drivers/media/platform/qcom/camss/camss-vfe-480.c | 22 +-- drivers/media/platform/qcom/camss/camss-vfe.c | 5 +- drivers/media/platform/qcom/camss/camss.c | 12 +- drivers/media/platform/qcom/venus/hfi_msgs.c | 2 +- drivers/media/platform/qcom/venus/hfi_parser.c | 15 ++ drivers/media/platform/qcom/venus/hfi_venus.c | 10 ++ drivers/media/rc/imon.c | 6 + drivers/media/rc/ir-sharp-decoder.c | 8 +- drivers/media/rc/lirc_dev.c | 6 +- drivers/media/test-drivers/vivid/vivid-rds-gen.c | 2 +- drivers/media/usb/gspca/cpia1.c | 3 + drivers/mfd/intel-lpss-pci.c | 13 ++ drivers/mfd/qcom-spmi-pmic.c | 101 +++++++++---- drivers/misc/pci_endpoint_test.c | 4 + drivers/mmc/core/block.c | 4 +- drivers/mmc/core/card.h | 4 + drivers/mmc/core/mmc.c | 8 +- drivers/mmc/core/quirks.h | 7 +- drivers/mmc/host/meson-gx-mmc.c | 1 - drivers/mmc/host/sdhci-pci-gli.c | 30 ++++ drivers/mmc/host/sdhci_am654.c | 2 +- drivers/mmc/host/vub300.c | 1 + drivers/mtd/chips/cfi_cmdset_0001.c | 20 ++- drivers/mtd/nand/raw/intel-nand-controller.c | 10 ++ drivers/mtd/nand/raw/meson_nand.c | 3 + drivers/mtd/nand/raw/tegra_nand.c | 4 + drivers/net/bonding/bond_main.c | 6 + drivers/net/dsa/lan9303_mdio.c | 4 +- drivers/net/ethernet/atheros/atl1c/atl1c.h | 3 - drivers/net/ethernet/atheros/atl1c/atl1c_main.c | 67 +++------ drivers/net/ethernet/cortina/gemini.c | 45 +++--- drivers/net/ethernet/cortina/gemini.h | 4 +- drivers/net/ethernet/engleder/tsnep.h | 2 +- drivers/net/ethernet/engleder/tsnep_main.c | 12 +- drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c | 9 +- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 33 +++-- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 25 +++- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h | 1 + .../ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c | 7 + drivers/net/ethernet/marvell/mvneta.c | 28 ++-- .../ethernet/mellanox/mlx5/core/en/reporter_rx.c | 4 +- .../net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 30 ++-- .../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 13 +- drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 12 +- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 60 ++++---- drivers/net/ethernet/realtek/r8169_main.c | 46 ++++-- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 +- drivers/net/ipvlan/ipvlan_core.c | 41 +++--- drivers/net/macvlan.c | 2 +- drivers/net/phy/phylink.c | 1 + drivers/net/ppp/ppp_synctty.c | 6 +- drivers/net/wireless/ath/ath10k/debug.c | 2 +- drivers/net/wireless/ath/ath10k/snoc.c | 18 ++- drivers/net/wireless/ath/ath11k/dp_rx.c | 8 +- drivers/net/wireless/ath/ath11k/wmi.c | 19 ++- drivers/net/wireless/ath/ath9k/debug.c | 2 +- drivers/net/wireless/ath/ath9k/htc_drv_debug.c | 2 +- drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 14 +- drivers/net/wireless/mac80211_hwsim.c | 2 +- drivers/net/wireless/microchip/wilc1000/wlan.c | 2 +- drivers/net/wireless/purelifi/plfxlc/mac.c | 2 +- drivers/parisc/power.c | 16 ++- drivers/pci/controller/dwc/pci-exynos.c | 4 +- drivers/pci/controller/dwc/pci-keystone.c | 8 +- drivers/pci/controller/dwc/pcie-kirin.c | 4 +- drivers/pci/controller/dwc/pcie-tegra194.c | 9 +- drivers/pci/controller/pci-mvebu.c | 2 +- drivers/pci/pci-acpi.c | 2 +- drivers/pci/pci-sysfs.c | 10 +- drivers/pci/pci.c | 22 +-- drivers/pci/pcie/aspm.c | 2 + drivers/pci/probe.c | 6 +- drivers/pci/quirks.c | 41 ++++-- drivers/perf/riscv_pmu_sbi.c | 5 + drivers/platform/chrome/cros_ec_proto_test.c | 1 + drivers/platform/x86/thinkpad_acpi.c | 1 + drivers/ptp/ptp_chardev.c | 3 +- drivers/ptp/ptp_clock.c | 5 +- drivers/ptp/ptp_private.h | 8 +- drivers/ptp/ptp_sysfs.c | 3 +- drivers/s390/crypto/ap_bus.c | 4 + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 13 +- drivers/scsi/ibmvscsi/ibmvfc.c | 124 +++++++++++++++- drivers/scsi/libfc/fc_lport.c | 6 + drivers/scsi/megaraid/megaraid_sas_base.c | 4 +- drivers/scsi/mpt3sas/mpt3sas_base.c | 4 +- drivers/scsi/qla2xxx/qla_os.c | 12 +- drivers/soc/bcm/bcm2835-power.c | 2 +- drivers/soc/imx/gpc.c | 1 + drivers/soundwire/dmi-quirks.c | 2 +- drivers/thunderbolt/quirks.c | 3 + drivers/tty/hvc/hvc_xen.c | 39 +++-- drivers/tty/serial/meson_uart.c | 14 +- drivers/tty/sysrq.c | 3 +- drivers/tty/vcc.c | 16 ++- drivers/usb/dwc3/core.c | 160 ++++++++++++++++----- drivers/usb/dwc3/core.h | 13 ++ drivers/usb/gadget/function/f_ncm.c | 27 ++-- drivers/usb/host/xhci-pci.c | 4 +- drivers/vhost/vdpa.c | 1 - drivers/watchdog/sbsa_gwdt.c | 4 +- drivers/xen/events/events_base.c | 4 +- fs/9p/xattr.c | 5 +- fs/btrfs/delalloc-space.c | 3 - fs/btrfs/inode.c | 7 + fs/exfat/namei.c | 29 +++- fs/ext4/acl.h | 5 + fs/ext4/extents_status.c | 4 +- fs/ext4/file.c | 153 +++++++++----------- fs/ext4/inode.c | 14 +- fs/ext4/resize.c | 23 ++- fs/f2fs/compress.c | 2 +- fs/f2fs/node.c | 7 +- fs/f2fs/xattr.c | 20 ++- fs/gfs2/inode.c | 14 +- fs/gfs2/quota.c | 11 ++ fs/gfs2/super.c | 2 +- fs/inode.c | 16 +++ fs/jbd2/recovery.c | 8 ++ fs/jfs/jfs_dmap.c | 23 ++- fs/jfs/jfs_imap.c | 5 +- fs/nfs/nfs4proc.c | 12 +- fs/nfsd/nfs4state.c | 2 +- fs/overlayfs/super.c | 2 +- fs/proc/proc_sysctl.c | 8 +- fs/quota/dquot.c | 14 ++ fs/smb/client/cifs_debug.c | 6 + fs/smb/client/cifs_spnego.c | 4 +- fs/smb/client/cifsfs.c | 1 + fs/smb/client/cifspdu.h | 2 +- fs/smb/client/cifsproto.h | 7 +- fs/smb/client/connect.c | 15 +- fs/smb/client/inode.c | 4 + fs/smb/client/sess.c | 1 - fs/smb/client/smb2misc.c | 2 +- fs/smb/client/smb2ops.c | 8 +- fs/smb/client/smb2transport.c | 5 +- fs/smb/client/transport.c | 11 +- fs/smb/client/xattr.c | 5 +- fs/smb/server/smb_common.c | 11 ++ fs/smb/server/smbacl.c | 29 +++- fs/xfs/xfs_inode_item_recover.c | 32 +++-- include/linux/damon.h | 7 + include/linux/ethtool.h | 4 +- include/linux/fs.h | 45 +++++- include/linux/generic-radix-tree.h | 7 + include/linux/lsm_hook_defs.h | 4 +- include/linux/mmc/card.h | 2 + include/linux/preempt.h | 15 +- include/linux/pwm.h | 4 +- include/linux/socket.h | 1 + include/linux/string.h | 40 ++++++ include/linux/sunrpc/clnt.h | 1 + include/linux/sysctl.h | 6 + include/linux/trace_events.h | 4 + include/linux/workqueue.h | 46 +++++- include/net/netfilter/nf_tables.h | 4 +- include/net/sock.h | 26 +++- include/sound/soc-acpi.h | 7 + include/sound/soc-card.h | 37 +++++ include/sound/soc.h | 11 ++ include/sound/sof.h | 8 ++ include/uapi/linux/vm_sockets.h | 17 +++ init/main.c | 4 + kernel/audit_watch.c | 9 +- kernel/bpf/core.c | 6 +- kernel/bpf/verifier.c | 16 ++- kernel/cpu.c | 11 +- kernel/debug/debug_core.c | 3 + kernel/events/ring_buffer.c | 6 + kernel/irq/generic-chip.c | 25 +++- kernel/kexec.c | 2 +- kernel/locking/test-ww_mutex.c | 20 +-- kernel/padata.c | 2 +- kernel/power/snapshot.c | 16 +-- kernel/rcu/rcu.h | 7 + kernel/rcu/srcutiny.c | 1 + kernel/rcu/srcutree.c | 5 +- kernel/rcu/tasks.h | 1 + kernel/rcu/tiny.c | 1 + kernel/rcu/tree.c | 22 +++ kernel/rcu/tree.h | 4 + kernel/rcu/tree_stall.h | 20 ++- kernel/reboot.c | 1 + kernel/smp.c | 13 +- kernel/trace/trace.c | 15 ++ kernel/trace/trace.h | 3 + kernel/trace/trace_events.c | 43 ++++-- kernel/trace/trace_events_filter.c | 3 + kernel/trace/trace_events_synth.c | 2 +- kernel/watch_queue.c | 2 +- kernel/watchdog.c | 7 + kernel/workqueue.c | 20 +-- lib/generic-radix-tree.c | 17 ++- mm/cma.c | 2 +- mm/damon/lru_sort.c | 4 +- mm/damon/ops-common.c | 5 +- mm/damon/sysfs.c | 87 ++++++----- mm/huge_memory.c | 16 ++- mm/memcontrol.c | 3 +- mm/memory_hotplug.c | 2 +- net/9p/client.c | 2 +- net/9p/trans_fd.c | 13 +- net/bluetooth/hci_conn.c | 6 +- net/bluetooth/hci_sysfs.c | 23 +-- net/bridge/netfilter/nf_conntrack_bridge.c | 2 +- net/core/sock.c | 2 +- net/ipv4/inet_hashtables.c | 2 +- net/ipv4/tcp_output.c | 2 +- net/mac80211/cfg.c | 4 + net/mptcp/pm_netlink.c | 5 +- net/mptcp/protocol.c | 4 + net/mptcp/sockopt.c | 3 + net/ncsi/ncsi-aen.c | 5 - net/netfilter/nf_tables_api.c | 53 ++++--- net/netfilter/nft_byteorder.c | 5 +- net/netfilter/nft_meta.c | 2 +- net/sunrpc/clnt.c | 7 +- net/sunrpc/rpcb_clnt.c | 4 + net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 3 +- net/tipc/netlink_compat.c | 1 + net/unix/af_unix.c | 9 +- net/vmw_vsock/af_vsock.c | 6 + scripts/gcc-plugins/randomize_layout_plugin.c | 11 +- security/integrity/iint.c | 48 +++++-- security/integrity/ima/ima_api.c | 5 + security/integrity/ima/ima_main.c | 16 ++- security/integrity/integrity.h | 2 + security/keys/trusted-keys/trusted_core.c | 20 +-- security/keys/trusted-keys/trusted_tee.c | 64 +++------ sound/core/info.c | 21 +-- sound/hda/hdac_stream.c | 6 +- sound/pci/hda/patch_realtek.c | 26 ++-- sound/soc/codecs/lpass-wsa-macro.c | 3 + sound/soc/intel/common/soc-acpi-intel-cht-match.c | 43 ++++++ sound/soc/sof/ipc4.c | 3 + sound/soc/sof/sof-audio.c | 7 + sound/soc/sof/sof-pci-dev.c | 8 ++ sound/soc/ti/omap-mcbsp.c | 6 +- sound/usb/mixer_scarlett_gen2.c | 63 +++----- tools/perf/util/intel-pt.c | 2 + tools/power/x86/turbostat/turbostat.c | 3 +- tools/testing/cxl/test/cxl.c | 147 +++++++++++++++++-- tools/testing/selftests/efivarfs/create-read.c | 2 + tools/testing/selftests/lkdtm/config | 1 - tools/testing/selftests/lkdtm/tests.txt | 2 +- tools/testing/selftests/resctrl/Makefile | 2 +- tools/testing/selftests/resctrl/cmt_test.c | 3 - tools/testing/selftests/resctrl/mba_test.c | 2 +- tools/testing/selftests/resctrl/mbm_test.c | 2 +- tools/testing/selftests/resctrl/resctrl.h | 1 - 377 files changed, 3451 insertions(+), 1523 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/372 locking/ww_mutex/test: Fix potential workqueue corruption
6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Stultz <[email protected]>
[ Upstream commit bccdd808902f8c677317cec47c306e42b93b849e ]
In some cases running with the test-ww_mutex code, I was seeing odd behavior where sometimes it seemed flush_workqueue was returning before all the work threads were finished.
Often this would cause strange crashes as the mutexes would be freed while they were being used.
Looking at the code, there is a lifetime problem as the controlling thread that spawns the work allocates the "struct stress" structures that are passed to the workqueue threads. Then when the workqueue threads are finished, they free the stress struct that was passed to them.
Unfortunately the workqueue work_struct node is in the stress struct. Which means the work_struct is freed before the work thread returns and while flush_workqueue is waiting.
It seems like a better idea to have the controlling thread both allocate and free the stress structures, so that we can be sure we don't corrupt the workqueue by freeing the structure prematurely.
So this patch reworks the test to do so, and with this change I no longer see the early flush_workqueue returns.
--- kernel/locking/test-ww_mutex.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-)
kernel/locking/test-ww_mutex.c +12 -8
@@ -466,7 +466,6 @@ static void stress_inorder_work(struct work_struct *work) }while (!time_after (jiffies, stress->timeout));kfree (order); -kfree (stress); }struct reorder_lock {
@@ -531,7 +530,6 @@ static void stress_reorder_work(struct work_struct *work)list_for_each_entry_safe (ll, ln, &locks, link)kfree (ll);kfree (order); -kfree (stress); }static void stress_one_work (struct work_struct *work)
@@ -552,8 +550,6 @@ static void stress_one_work(struct work_struct *work)break ; } }while (!time_after (jiffies, stress->timeout)); - -kfree (stress); }#define STRESS_INORDER BIT(0)
@@ -564,15 +560,24 @@ static void stress_one_work(struct work_struct *work)static int stress (int nlocks,int nthreads,unsigned int flags) {struct ww_mutex *locks; -int n; +struct stress *stress_array; +int n, count; locks =kmalloc_array (nlocks,sizeof (*locks),GFP_KERNEL );if (!locks)return -ENOMEM ; + stress_array =kmalloc_array (nthreads,sizeof (*stress_array), +GFP_KERNEL ); +if (!stress_array) { +kfree (locks); +return -ENOMEM ; + } +for (n =0 ; n < nlocks; n++)ww_mutex_init (&locks[n], &ww_class); + count =0 ;for (n =0 ; nthreads; n++) {struct stress *stress;void (*fn)(struct work_struct *work);
@@ -596,9 +601,7 @@ static int stress(int nlocks, int nthreads, unsigned int flags)if (!fn)continue ; - stress =kmalloc (sizeof (*stress),GFP_KERNEL ); -if (!stress) -break ; + stress = &stress_array[count++];INIT_WORK (&stress->work, fn); stress->locks = locks;
@@ -613,6 +616,7 @@ static int stress(int nlocks, int nthreads, unsigned int flags)for (n =0 ; n < nlocks; n++)ww_mutex_destroy (&locks[n]); +kfree (stress_array);kfree (locks);return 0 ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 2/372 lib/generic-radix-tree.c: Dont overflow in peek()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kent Overstreet <[email protected]>
[ Upstream commit 9492261ff2460252cf2d8de89cdf854c7e2b28a0 ]
When we started spreading new inode numbers throughout most of the 64 bit inode space, that triggered some corner case bugs, in particular some integer overflows related to the radix tree code. Oops.
--- include/linux/generic-radix-tree.h | 7 +++++++ lib/generic-radix-tree.c | 17 ++++++++++++++--- 2 files changed, 21 insertions(+), 3 deletions(-)
include/linux/generic-radix-tree.h +7 -0
@@ -38,6 +38,7 @@#include <asm/page.h> #include <linux/bug.h> +#include <linux/limits.h> #include <linux/log2.h> #include <linux/math.h> #include <linux/types.h>
@@ -184,6 +185,12 @@ void *__genradix_iter_peek(struct genradix_iter *, struct __genradix *, size_t);static inline void __genradix_iter_advance (struct genradix_iter *iter,size_t obj_size) { +if (iter->offset + obj_size < iter->offset) { + iter->offset =SIZE_MAX ; + iter->pos =SIZE_MAX ; +return ; + } + iter->offset += obj_size; if (!is_power_of_2(obj_size) &&
lib/generic-radix-tree.c +14 -3
@@ -166,6 +166,10 @@ void *__genradix_iter_peek(struct genradix_iter *iter,struct genradix_root *r;struct genradix_node *n;unsigned level, i; + +if (iter->offset ==SIZE_MAX ) +return NULL ; + restart: r =READ_ONCE (radix->root);if (!r)
@@ -184,10 +188,17 @@ void *__genradix_iter_peek(struct genradix_iter *iter, (GENRADIX_ARY -1 );while (!n->children[i]) { +size_t objs_per_ptr =genradix_depth_size (level); + +if (iter->offset + objs_per_ptr < iter->offset) { + iter->offset =SIZE_MAX ; + iter->pos =SIZE_MAX ; +return NULL ; + } + i++; - iter->offset =round_down (iter->offset + -genradix_depth_size (level), -genradix_depth_size (level)); + iter->offset =round_down (iter->offset + objs_per_ptr, + objs_per_ptr); iter->pos = (iter->offset >>PAGE_SHIFT ) * objs_per_page;if (i ==GENRADIX_ARY )
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 3/372 perf/core: Bail out early if the request AUX area is out of bound
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuai Xue <[email protected]>
[ Upstream commit 54aee5f15b83437f23b2b2469bcf21bdd9823916 ]
When perf-record with a large AUX area, e.g 4GB, it fails with:
#perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1 failed to mmap with 12 (Cannot allocate memory)
and it reveals a WARNING with __alloc_pages():
------------[ cut here ]------------ WARNING: CPU: 44 PID: 17573 at mm/page_alloc.c:5568 __alloc_pages+0x1ec/0x248 Call trace: __alloc_pages+0x1ec/0x248 __kmalloc_large_node+0xc0/0x1f8 __kmalloc_node+0x134/0x1e8 rb_alloc_aux+0xe0/0x298 perf_mmap+0x440/0x660 mmap_region+0x308/0x8a8 do_mmap+0x3c0/0x528 vm_mmap_pgoff+0xf4/0x1b8 ksys_mmap_pgoff+0x18c/0x218 __arm64_sys_mmap+0x38/0x58 invoke_syscall+0x50/0x128 el0_svc_common.constprop.0+0x58/0x188 do_el0_svc+0x34/0x50 el0_svc+0x34/0x108 el0t_64_sync_handler+0xb8/0xc0 el0t_64_sync+0x1a4/0x1a8
'rb->aux_pages' allocated by kcalloc() is a pointer array which is used to maintains AUX trace pages. The allocated page for this array is physically contiguous (and virtually contiguous) with an order of 0..MAX_ORDER. If the size of pointer array crosses the limitation set by MAX_ORDER, it reveals a WARNING.
So bail out early with -ENOMEM if the request AUX area is out of bound, e.g.:
#perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1 failed to mmap with 12 (Cannot allocate memory)
--- kernel/events/ring_buffer.c | 6 ++++++ 1 file changed, 6 insertions(+)
kernel/events/ring_buffer.c +6 -0
@@ -699,6 +699,12 @@ int rb_alloc_aux(struct perf_buffer *rb, struct perf_event *event, watermark =0 ; } +/* +* kcalloc_node() is unable to allocate buffer if the size is larger +* than: PAGE_SIZE << MAX_ORDER; directly bail out in this case. +*/ +if (get_order ((unsigned long )nr_pages *sizeof (void *)) >MAX_ORDER ) +return -ENOMEM ; rb->aux_pages =kcalloc_node (nr_pages,sizeof (void *),GFP_KERNEL , node);if (!rb->aux_pages)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 4/372 rcu: Dump memory object info if callback function is invalid
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Lei <[email protected]>
[ Upstream commit 2cbc482d325ee58001472c4359b311958c4efdd1 ]
When a structure containing an RCU callback rhp is (incorrectly) freed and reallocated after rhp is passed to call_rcu(), it is not unusual for rhp->func to be set to NULL. This defeats the debugging prints used by __call_rcu_common() in kernels built with CONFIG_DEBUG_OBJECTS_RCU_HEAD=y, which expect to identify the offending code using the identity of this function.
And in kernels build without CONFIG_DEBUG_OBJECTS_RCU_HEAD=y, things are even worse, as can be seen from this splat:
Unable to handle kernel NULL pointer dereference at virtual address 0
... ...
PC is at 0x0
LR is at rcu_do_batch+0x1c0/0x3b8
... ...
(rcu_do_batch) from (rcu_core+0x1d4/0x284) (rcu_core) from (__do_softirq+0x24c/0x344) (__do_softirq) from (__irq_exit_rcu+0x64/0x108) (__irq_exit_rcu) from (irq_exit+0x8/0x10) (irq_exit) from (__handle_domain_irq+0x74/0x9c) (__handle_domain_irq) from (gic_handle_irq+0x8c/0x98) (gic_handle_irq) from (__irq_svc+0x5c/0x94) (__irq_svc) from (arch_cpu_idle+0x20/0x3c) (arch_cpu_idle) from (default_idle_call+0x4c/0x78) (default_idle_call) from (do_idle+0xf8/0x150) (do_idle) from (cpu_startup_entry+0x18/0x20) (cpu_startup_entry) from (0xc01530)
This commit therefore adds calls to mem_dump_obj(rhp) to output some information, for example:
slab kmalloc-256 start ffff410c45019900 pointer offset 0 size 256
This provides the rough size of the memory block and the offset of the rcu_head structure, which as least provides at least a few clues to help locate the problem. If the problem is reproducible, additional slab debugging can be enabled, for example, CONFIG_DEBUG_SLAB=y, which can provide significantly more information.
--- kernel/rcu/rcu.h | 7 +++++++ kernel/rcu/srcutiny.c | 1 + kernel/rcu/srcutree.c | 1 + kernel/rcu/tasks.h | 1 + kernel/rcu/tiny.c | 1 + kernel/rcu/tree.c | 1 + 6 files changed, 12 insertions(+)
kernel/rcu/rcu.h +7 -0
@@ -10,6 +10,7 @@#ifndef __LINUX_RCU_H#define __LINUX_RCU_H +#include <linux/slab.h> #include <trace/events/rcu.h> /*
@@ -211,6 +212,12 @@ static inline void debug_rcu_head_unqueue(struct rcu_head *head) }#endif /* #else !CONFIG_DEBUG_OBJECTS_RCU_HEAD */ +static inline void debug_rcu_head_callback (struct rcu_head *rhp) +{ +if (unlikely (!rhp->func)) +kmem_dump_obj (rhp); +} +extern int rcu_cpu_stall_suppress_at_boot;static inline bool rcu_stall_is_suppressed_at_boot (void )
kernel/rcu/srcutiny.c +1 -0
@@ -138,6 +138,7 @@ void srcu_drive_gp(struct work_struct *wp)while (lh) { rhp = lh; lh = lh->next; +debug_rcu_head_callback (rhp);local_bh_disable (); rhp->func (rhp);local_bh_enable ();
kernel/rcu/srcutree.c +1 -0
@@ -1564,6 +1564,7 @@ static void srcu_invoke_callbacks(struct work_struct *work) rhp =rcu_cblist_dequeue (&ready_cbs);for (; rhp !=NULL ; rhp =rcu_cblist_dequeue (&ready_cbs)) {debug_rcu_head_unqueue (rhp); +debug_rcu_head_callback (rhp);local_bh_disable (); rhp->func (rhp);local_bh_enable ();
kernel/rcu/tasks.h +1 -0
@@ -487,6 +487,7 @@ static void rcu_tasks_invoke_cbs(struct rcu_tasks *rtp, struct rcu_tasks_percpuraw_spin_unlock_irqrestore_rcu_node (rtpcp, flags); len = rcl.len;for (rhp =rcu_cblist_dequeue (&rcl); rhp; rhp =rcu_cblist_dequeue (&rcl)) { +debug_rcu_head_callback (rhp);local_bh_disable (); rhp->func (rhp);local_bh_enable ();
kernel/rcu/tiny.c +1 -0
@@ -97,6 +97,7 @@ static inline bool rcu_reclaim_tiny(struct rcu_head *head)trace_rcu_invoke_callback ("" , head); f = head->func; +debug_rcu_head_callback (head);WRITE_ONCE (head->func, (rcu_callback_t )0L );f (head);rcu_lock_release (&rcu_callback_map);
kernel/rcu/tree.c +1 -0
@@ -2247,6 +2247,7 @@ static void rcu_do_batch(struct rcu_data *rdp)trace_rcu_invoke_callback (rcu_state.name, rhp); f = rhp->func; +debug_rcu_head_callback (rhp);WRITE_ONCE (rhp->func, (rcu_callback_t )0L );f (rhp);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 5/372 srcu: Fix srcu_struct node grpmask overflow on 64-bit systems
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Denis Arefev <[email protected]>
[ Upstream commit d8d5b7bf6f2105883bbd91bbd4d5b67e4e3dff71 ]
The value of a bitwise expression 1 << (cpu - sdp->mynode->grplo) is subject to overflow due to a failure to cast operands to a larger data type before performing the bitwise operation.
The maximum result of this subtraction is defined by the RCU_FANOUT_LEAF Kconfig option, which on 64-bit systems defaults to 16 (resulting in a maximum shift of 15), but which can be set up as high as 64 (resulting in a maximum shift of 63). A value of 31 can result in sign extension, resulting in 0xffffffff80000000 instead of the desired 0x80000000. A value of 32 or greater triggers undefined behavior per the C standard.
This bug has not been known to cause issues because almost all kernels take the default CONFIG_RCU_FANOUT_LEAF=16. Furthermore, as long as a given compiler gives a deterministic non-zero result for 1<<N for N>=32, the code correctly invokes all SRCU callbacks, albeit wasting CPU time along the way.
This commit therefore substitutes the correct 1UL for the buggy 1.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- kernel/rcu/srcutree.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/rcu/srcutree.c +2 -2
@@ -223,7 +223,7 @@ static bool init_srcu_struct_nodes(struct srcu_struct *ssp, gfp_t gfp_flags) snp->grplo = cpu; snp->grphi = cpu; } - sdp->grpmask =1 << (cpu - sdp->mynode->grplo); + sdp->grpmask =1UL << (cpu - sdp->mynode->grplo); }smp_store_release (&ssp->srcu_size_state,SRCU_SIZE_WAIT_BARRIER );return true;
@@ -722,7 +722,7 @@ static void srcu_schedule_cbs_snp(struct srcu_struct *ssp, struct srcu_node *snpint cpu;for (cpu = snp->grplo; cpu <= snp->grphi; cpu++) { -if (!(mask & (1 << (cpu - snp->grplo)))) +if (!(mask & (1UL << (cpu - snp->grplo))))continue ;srcu_schedule_cbs_sdp (per_cpu_ptr (ssp->sda, cpu), delay); }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 6/372 selftests/lkdtm: Disable CONFIG_UBSAN_TRAP in test config
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Cañuelo <[email protected]>
[ Upstream commit cf77bf698887c3b9ebed76dea492b07a3c2c7632 ]
The lkdtm selftest config fragment enables CONFIG_UBSAN_TRAP to make the ARRAY_BOUNDS test kill the calling process when an out-of-bound access is detected by UBSAN. However, after this [1] commit, UBSAN is triggered under many new scenarios that weren't detected before, such as in struct definitions with fixed-size trailing arrays used as flexible arrays. As a result, CONFIG_UBSAN_TRAP=y has become a very aggressive option to enable except for specific situations.
make kselftest-merge applies CONFIG_UBSAN_TRAP=y to the kernel config for all selftests, which makes many of them fail because of system hangs during boot.
This change removes the config option from the lkdtm kselftest and configures the ARRAY_BOUNDS test to look for UBSAN reports rather than relying on the calling process being killed.
[1] commit 2d47c6956ab3 ("ubsan: Tighten UBSAN_BOUNDS on GCC")'
--- tools/testing/selftests/lkdtm/config | 1 - tools/testing/selftests/lkdtm/tests.txt | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-)
tools/testing/selftests/lkdtm/config +0 -1
@@ -9,7 +9,6 @@ CONFIG_INIT_ON_FREE_DEFAULT_ON=y CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y CONFIG_UBSAN=y CONFIG_UBSAN_BOUNDS=y -CONFIG_UBSAN_TRAP=y CONFIG_STACKPROTECTOR_STRONG=y CONFIG_SLUB_DEBUG=y CONFIG_SLUB_DEBUG_ON=y
tools/testing/selftests/lkdtm/tests.txt +1 -1
@@ -7,7 +7,7 @@ EXCEPTION #EXHAUST_STACK Corrupts memory on failure #CORRUPT_STACK Crashes entire system on success #CORRUPT_STACK_STRONG Crashes entire system on success -ARRAY_BOUNDS +ARRAY_BOUNDS call trace:|UBSAN: array-index-out-of-bounds CORRUPT_LIST_ADD list_add corruption CORRUPT_LIST_DEL list_del corruption STACK_GUARD_PAGE_LEADING
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 7/372 clocksource/drivers/timer-imx-gpt: Fix potential memory leak
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacky Bai <[email protected]>
[ Upstream commit 8051a993ce222a5158bccc6ac22ace9253dd71cb ]
Fix coverity Issue CID 250382: Resource leak (RESOURCE_LEAK). Add kfree when error return.
--- drivers/clocksource/timer-imx-gpt.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
drivers/clocksource/timer-imx-gpt.c +13 -5
@@ -454,12 +454,16 @@ static int __init mxc_timer_init_dt(struct device_node *np, enum imx_gpt_type treturn -ENOMEM ; imxtm->base =of_iomap (np,0 ); -if (!imxtm->base) -return -ENXIO ; +if (!imxtm->base) { + ret = -ENXIO ; + goto err_kfree; + } imxtm->irq =irq_of_parse_and_map (np,0 ); -if (imxtm->irq <=0 ) -return -EINVAL ; +if (imxtm->irq <=0 ) { + ret = -EINVAL ; + goto err_kfree; + } imxtm->clk_ipg =of_clk_get_by_name (np,"ipg" );
@@ -472,11 +476,15 @@ static int __init mxc_timer_init_dt(struct device_node *np, enum imx_gpt_type t ret =_mxc_timer_init (imxtm);if (ret) -return ret; + goto err_kfree; initialized =1 ;return 0 ; + +err_kfree: +kfree (imxtm); +return ret; }static int __init imx1_timer_init_dt (struct device_node *np)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 8/372 clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 hardware
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ronald Wahl <[email protected]>
[ Upstream commit 6d3bc4c02d59996d1d3180d8ed409a9d7d5900e0 ]
On SAM9 hardware two cascaded 16 bit timers are used to form a 32 bit high resolution timer that is used as scheduler clock when the kernel has been configured that way (CONFIG_ATMEL_CLOCKSOURCE_TCB).
The driver initially triggers a reset-to-zero of the two timers but this reset is only performed on the next rising clock. For the first timer this is ok - it will be in the next 60ns (16MHz clock). For the chained second timer this will only happen after the first timer overflows, i.e. after 2^16 clocks (~4ms with a 16MHz clock). So with other words the scheduler clock resets to 0 after the first 2^16 clock cycles.
It looks like that the scheduler does not like this and behaves wrongly over its lifetime, e.g. some tasks are scheduled with a long delay. Why that is and if there are additional requirements for this behaviour has not been further analysed.
There is a simple fix for resetting the second timer as well when the first timer is reset and this is to set the ATMEL_TC_ASWTRG_SET bit in the Channel Mode register (CMR) of the first timer. This will also rise the TIOA line (clock input of the second timer) when a software trigger respective SYNC is issued.
--- drivers/clocksource/timer-atmel-tcb.c | 1 + 1 file changed, 1 insertion(+)
drivers/clocksource/timer-atmel-tcb.c +1 -0
@@ -315,6 +315,7 @@ static void __init tcb_setup_dual_chan(struct atmel_tc *tc, int mck_divisor_idx)writel (mck_divisor_idx/* likely divide-by-8 */ |ATMEL_TC_WAVE |ATMEL_TC_WAVESEL_UP /* free-run */ + |ATMEL_TC_ASWTRG_SET /* TIOA0 rises at software trigger */ |ATMEL_TC_ACPA_SET /* TIOA0 rises at 0 */ |ATMEL_TC_ACPC_CLEAR ,/* (duty cycle 50%) */ tcaddr +ATMEL_TC_REG (0 ,CMR ));
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 9/372 smp,csd: Throw an error if a CSD lock is stuck for too long
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rik van Riel <[email protected]>
[ Upstream commit 94b3f0b5af2c7af69e3d6e0cdd9b0ea535f22186 ]
The CSD lock seems to get stuck in 2 "modes". When it gets stuck temporarily, it usually gets released in a few seconds, and sometimes up to one or two minutes.
If the CSD lock stays stuck for more than several minutes, it never seems to get unstuck, and gradually more and more things in the system end up also getting stuck.
In the latter case, we should just give up, so the system can dump out a little more information about what went wrong, and, with panic_on_oops and a kdump kernel loaded, dump a whole bunch more information about what might have gone wrong. In addition, there is an smp.panic_on_ipistall kernel boot parameter that by default retains the old behavior, but when set enables the panic after the CSD lock has been stuck for more than the specified number of milliseconds, as in 300,000 for five minutes.
[ paulmck: Apply Imran Khan feedback. ]
[ paulmck: Apply Leonardo Bras feedback. ]
--- Documentation/admin-guide/kernel-parameters.txt | 7 +++++++ kernel/smp.c | 13 ++++++++++++- 2 files changed, 19 insertions(+), 1 deletion(-)
Documentation/admin-guide/kernel-parameters.txt +7 -0
@@ -5671,6 +5671,13 @@ This feature may be more efficiently disabled using the csdlock_debug- kernel parameter. + smp.panic_on_ipistall= [KNL] + If a csd_lock_timeout extends for more than + the specified number of milliseconds, panic the + system. By default, let CSD-lock acquisition + take as long as they take. Specifying 300,000 + for this value provides a 5-minute timeout. + smsc-ircc2.nopnp [HW] Don't use PNP to discover SMC devices smsc-ircc2.ircc_cfg= [HW] Device configuration I/O port smsc-ircc2.ircc_sir= [HW] SIR base I/O port
kernel/smp.c +12 -1
@@ -185,6 +185,8 @@ static DEFINE_PER_CPU(struct cfd_seq_local, cfd_seq_local);static ulong csd_lock_timeout =5000 ;/* CSD lock timeout in milliseconds. */ module_param (csd_lock_timeout, ulong,0444 ); +static int panic_on_ipistall;/* CSD panic timeout in milliseconds, 300000 for five minutes. */ +module_param (panic_on_ipistall, int,0444 );static atomic_t csd_bug_count =ATOMIC_INIT (0 );static u64 cfd_seq;
@@ -343,6 +345,7 @@ static bool csd_lock_wait_toolong(struct __call_single_data *csd, u64 ts0, u64 * } ts2 =sched_clock (); +/* How long since we last checked for a stuck CSD lock.*/ ts_delta = ts2 - *ts1;if (likely (ts_delta <= csd_lock_timeout_ns || csd_lock_timeout_ns ==0 ))return false;
@@ -356,9 +359,17 @@ static bool csd_lock_wait_toolong(struct __call_single_data *csd, u64 ts0, u64 *else cpux = cpu; cpu_cur_csd =smp_load_acquire (&per_cpu (cur_csd, cpux));/* Before func and info. */ +/* How long since this CSD lock was stuck. */ + ts_delta = ts2 - ts0;pr_alert ("csd: %s non-responsive CSD lock (#%d) on CPU#%d, waiting %llu ns for CPU#%02d %pS(%ps).\n" , - firsttime ?"Detected" :"Continued" , *bug_id,raw_smp_processor_id (), ts2 - ts0, + firsttime ?"Detected" :"Continued" , *bug_id,raw_smp_processor_id (), ts_delta, cpu, csd->func, csd->info); +/* +* If the CSD lock is still stuck after 5 minutes, it is unlikely +* to become unstuck. Use a signed comparison to avoid triggering +* on underflows when the TSC is out of sync between sockets. +*/ +BUG_ON (panic_on_ipistall >0 && (s64 )ts_delta > ((s64 )panic_on_ipistall *NSEC_PER_MSEC ));if (cpu_cur_csd && csd != cpu_cur_csd) { pr_alert("\tcsd: CSD lock (#%d) handling prior %pS(%ps) request.\n", *bug_id, READ_ONCE(per_cpu(cur_csd_func, cpux)),
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 10/372 cpu/hotplug: Dont offline the last non-isolated CPU
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ran Xiaokai <[email protected]>
[ Upstream commit 38685e2a0476127db766f81b1c06019ddc4c9ffa ]
If a system has isolated CPUs via the "isolcpus=" command line parameter, then an attempt to offline the last housekeeping CPU will result in a WARN_ON() when rebuilding the scheduler domains and a subsequent panic due to and unhandled empty CPU mas in partition_sched_domains_locked().
cpuset_hotplug_workfn()
rebuild_sched_domains_locked()
ndoms = generate_sched_domains(&doms, &attr);
cpumask_and(doms[0], top_cpuset.effective_cpus, housekeeping_cpumask(HK_FLAG_DOMAIN));Thus results in an empty CPU mask which triggers the warning and then the subsequent crash:
WARNING: CPU: 4 PID: 80 at kernel/sched/topology.c:2366 build_sched_domains+0x120c/0x1408 Call trace: build_sched_domains+0x120c/0x1408 partition_sched_domains_locked+0x234/0x880 rebuild_sched_domains_locked+0x37c/0x798 rebuild_sched_domains+0x30/0x58 cpuset_hotplug_workfn+0x2a8/0x930 Unable to handle kernel paging request at virtual address fffe80027ab37080 partition_sched_domains_locked+0x318/0x880 rebuild_sched_domains_locked+0x37c/0x798
Aside of the resulting crash, it does not make any sense to offline the last last housekeeping CPU.
Prevent this by masking out the non-housekeeping CPUs when selecting a target CPU for initiating the CPU unplug operation via the work queue.
--- kernel/cpu.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
kernel/cpu.c +7 -4
@@ -1243,11 +1243,14 @@ static int cpu_down_maps_locked(unsigned int cpu, enum cpuhp_state target)/* * Ensure that the control task does not run on the to be offlined * CPU to prevent a deadlock against cfs_b->period_timer. +* Also keep at least one housekeeping cpu onlined to avoid generating +* an empty sched_domain span. */ - cpu =cpumask_any_but (cpu_online_mask, cpu); -if (cpu >= nr_cpu_ids) -return -EBUSY ; -return work_on_cpu (cpu, __cpu_down_maps_locked, &work); +for_each_cpu_and (cpu, cpu_online_mask,housekeeping_cpumask (HK_TYPE_DOMAIN )) { +if (cpu != work.cpu) +return work_on_cpu (cpu, __cpu_down_maps_locked, &work); + } +return -EBUSY ; }static int cpu_down (unsigned int cpu,enum cpuhp_state target)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 11/372 workqueue: Provide one lock class key per work_on_cpu() callsite
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frederic Weisbecker <[email protected]>
[ Upstream commit 265f3ed077036f053981f5eea0b5b43e7c5b39ff ]
All callers of work_on_cpu() share the same lock class key for all the functions queued. As a result the workqueue related locking scenario for a function A may be spuriously accounted as an inversion against the locking scenario of function B such as in the following model:
long A(void *arg)
{
mutex_lock(&mutex);
mutex_unlock(&mutex);
}
long B(void *arg)
{
}
void launchA(void)
{
work_on_cpu(0, A, NULL);
}
void launchB(void)
{
mutex_lock(&mutex);
work_on_cpu(1, B, NULL);
mutex_unlock(&mutex);
}launchA and launchB running concurrently have no chance to deadlock. However the above can be reported by lockdep as a possible locking inversion because the works containing A() and B() are treated as belonging to the same locking class.
The following shows an existing example of such a spurious lockdep splat:
======================================================
WARNING: possible circular locking dependency detected
6.6.0-rc1-00065-g934ebd6e5359 #35409 Not tainted
------------------------------------------------------
kworker/0:1/9 is trying to acquire lock:
ffffffff9bc72f30 (cpu_hotplug_lock){++++}-{0:0}, at: _cpu_down+0x57/0x2b0
but task is already holding lock:
ffff9e3bc0057e60 ((work_completion)(&wfc.work)){+.+.}-{0:0}, at: process_scheduled_works+0x216/0x500
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 ((work_completion)(&wfc.work)){+.+.}-{0:0}:
__flush_work+0x83/0x4e0
work_on_cpu+0x97/0xc0
rcu_nocb_cpu_offload+0x62/0xb0
rcu_nocb_toggle+0xd0/0x1d0
kthread+0xe6/0x120
ret_from_fork+0x2f/0x40
ret_from_fork_asm+0x1b/0x30
-> #1 (rcu_state.barrier_mutex){+.+.}-{3:3}:
__mutex_lock+0x81/0xc80
rcu_nocb_cpu_deoffload+0x38/0xb0
rcu_nocb_toggle+0x144/0x1d0
kthread+0xe6/0x120
ret_from_fork+0x2f/0x40
ret_from_fork_asm+0x1b/0x30
-> #0 (cpu_hotplug_lock){++++}-{0:0}:
__lock_acquire+0x1538/0x2500
lock_acquire+0xbf/0x2a0
percpu_down_write+0x31/0x200
_cpu_down+0x57/0x2b0
__cpu_down_maps_locked+0x10/0x20
work_for_cpu_fn+0x15/0x20
process_scheduled_works+0x2a7/0x500
worker_thread+0x173/0x330
kthread+0xe6/0x120
ret_from_fork+0x2f/0x40
ret_from_fork_asm+0x1b/0x30
other info that might help us debug this:
Chain exists of:
cpu_hotplug_lock --> rcu_state.barrier_mutex --> (work_completion)(&wfc.work)
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock((work_completion)(&wfc.work));
lock(rcu_state.barrier_mutex);
lock((work_completion)(&wfc.work));
lock(cpu_hotplug_lock);
*** DEADLOCK ***
2 locks held by kworker/0:1/9:
#0: ffff900481068b38 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x212/0x500
#1: ffff9e3bc0057e60 ((work_completion)(&wfc.work)){+.+.}-{0:0}, at: process_scheduled_works+0x216/0x500
stack backtrace:
CPU: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.6.0-rc1-00065-g934ebd6e5359 #35409
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
Workqueue: events work_for_cpu_fn
Call Trace:
rcu-torture: rcu_torture_read_exit: Start of episode
<TASK>
dump_stack_lvl+0x4a/0x80
check_noncircular+0x132/0x150
__lock_acquire+0x1538/0x2500
lock_acquire+0xbf/0x2a0
? _cpu_down+0x57/0x2b0
percpu_down_write+0x31/0x200
? _cpu_down+0x57/0x2b0
_cpu_down+0x57/0x2b0
__cpu_down_maps_locked+0x10/0x20
work_for_cpu_fn+0x15/0x20
process_scheduled_works+0x2a7/0x500
worker_thread+0x173/0x330
? __pfx_worker_thread+0x10/0x10
kthread+0xe6/0x120
? __pfx_kthread+0x10/0x10
ret_from_fork+0x2f/0x40
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1b/0x30
</TASKFix this with providing one lock class key per work_on_cpu() caller.
--- include/linux/workqueue.h | 46 +++++++++++++++++++++++++++++++++------ kernel/workqueue.c | 20 ++++++++++------- 2 files changed, 51 insertions(+), 15 deletions(-)
include/linux/workqueue.h +39 -7
@@ -222,18 +222,16 @@ static inline unsigned int work_static(struct work_struct *work) { return 0; }* to generate better code. */ #ifdef CONFIG_LOCKDEP -#define __INIT_WORK (_work, _func, _onstack) \ +#define __INIT_WORK_KEY (_work, _func, _onstack, _key) \ do { \ - static struct lock_class_key __key; \ - \ __init_work((_work), _onstack); \ (_work)->data = (atomic_long_t) WORK_DATA_INIT(); \ - lockdep_init_map(&(_work)->lockdep_map, "(work_completion)"#_work, &__key, 0); \ + lockdep_init_map(&(_work)->lockdep_map, "(work_completion)"#_work, (_key), 0); \ INIT_LIST_HEAD(&(_work)->entry); \ (_work)->func = (_func); \ } while (0)#else -#define __INIT_WORK (_work, _func, _onstack) \ +#define __INIT_WORK_KEY (_work, _func, _onstack, _key) \ do { \ __init_work((_work), _onstack); \ (_work)->data = (atomic_long_t) WORK_DATA_INIT(); \
@@ -242,12 +240,22 @@ static inline unsigned int work_static(struct work_struct *work) { return 0; } } while (0)#endif +#define __INIT_WORK (_work, _func, _onstack) \ + do { \ + static __maybe_unused struct lock_class_key __key; \ + \ + __INIT_WORK_KEY(_work, _func, _onstack, &__key); \ + } while (0) +#define INIT_WORK (_work, _func) \ __INIT_WORK((_work), (_func), 0)#define INIT_WORK_ONSTACK (_work, _func) \ __INIT_WORK((_work), (_func), 1) +#define INIT_WORK_ONSTACK_KEY (_work, _func, _key) \ + __INIT_WORK_KEY((_work), (_func), 1, _key) +#define __INIT_DELAYED_WORK (_work, _func, _tflags) \ do { \ INIT_WORK(&(_work)->work, (_func)); \
@@ -681,8 +689,32 @@ static inline long work_on_cpu_safe(int cpu, long (*fn)(void *), void *arg) return fn(arg); }#else -long work_on_cpu (int cpu,long (*fn)(void *),void *arg); -long work_on_cpu_safe (int cpu,long (*fn)(void *),void *arg); +long work_on_cpu_key (int cpu,long (*fn)(void *), +void *arg,struct lock_class_key *key); +/* +* A new key is defined for each caller to make sure the work +* associated with the function doesn't share its locking class. +*/ +#define work_on_cpu (_cpu, _fn, _arg) \ +({ \ + static struct lock_class_key __key; \ + \ + work_on_cpu_key(_cpu, _fn, _arg, &__key); \ +}) + +long work_on_cpu_safe_key (int cpu,long (*fn)(void *), +void *arg,struct lock_class_key *key); + +/* +* A new key is defined for each caller to make sure the work +* associated with the function doesn't share its locking class. +*/ +#define work_on_cpu_safe (_cpu, _fn, _arg) \ +({ \ + static struct lock_class_key __key; \ + \ + work_on_cpu_safe_key(_cpu, _fn, _arg, &__key); \ +})#endif /* CONFIG_SMP */ #ifdef CONFIG_FREEZER
kernel/workqueue.c +12 -8
@@ -5185,50 +5185,54 @@ static void work_for_cpu_fn(struct work_struct *work) }/** -* work_on_cpu - run a function in thread context on a particular cpu +* work_on_cpu_key - run a function in thread context on a particular cpu * @cpu: the cpu to run on * @fn: the function to run * @arg: the function arg +* @key: The lock class key for lock debugging purposes * * It is up to the caller to ensure that the cpu doesn't go offline. * The caller must not hold any locks which would prevent @fn from completing. * * Return: The value @fn returns. */ -long work_on_cpu (int cpu,long (*fn)(void *),void *arg) +long work_on_cpu_key (int cpu,long (*fn)(void *), +void *arg,struct lock_class_key *key) {struct work_for_cpu wfc = { .fn = fn, .arg = arg }; -INIT_WORK_ONSTACK (&wfc.work, work_for_cpu_fn); +INIT_WORK_ONSTACK_KEY (&wfc.work, work_for_cpu_fn, key);schedule_work_on (cpu, &wfc.work);flush_work (&wfc.work);destroy_work_on_stack (&wfc.work);return wfc.ret; } -EXPORT_SYMBOL_GPL (work_on_cpu); +EXPORT_SYMBOL_GPL (work_on_cpu_key);/** -* work_on_cpu_safe - run a function in thread context on a particular cpu +* work_on_cpu_safe_key - run a function in thread context on a particular cpu * @cpu: the cpu to run on * @fn: the function to run * @arg: the function argument +* @key: The lock class key for lock debugging purposes * * Disables CPU hotplug and calls work_on_cpu(). The caller must not hold * any locks which would prevent @fn from completing. * * Return: The value @fn returns. */ -long work_on_cpu_safe (int cpu,long (*fn)(void *),void *arg) +long work_on_cpu_safe_key (int cpu,long (*fn)(void *), +void *arg,struct lock_class_key *key) {long ret = -ENODEV ;cpus_read_lock ();if (cpu_online (cpu)) - ret =work_on_cpu (cpu, fn, arg); + ret =work_on_cpu_key (cpu, fn, arg, key);cpus_read_unlock ();return ret; } -EXPORT_SYMBOL_GPL (work_on_cpu_safe); +EXPORT_SYMBOL_GPL (work_on_cpu_safe_key);#endif /* CONFIG_SMP */ #ifdef CONFIG_FREEZER
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 12/372 x86/mm: Drop the 4 MB restriction on minimal NUMA node memory size
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Rapoport (IBM) <[email protected]>
[ Upstream commit a1e2b8b36820d8c91275f207e77e91645b7c6836 ]
Qi Zheng reported crashes in a production environment and provided a simplified example as a reproducer:
| For example, if we use Qemu to start a two NUMA node kernel, | one of the nodes has 2M memory (less than NODE_MIN_SIZE), | and the other node has 2G, then we will encounter the | following panic: | | BUG: kernel NULL pointer dereference, address: 0000000000000000 | <...> | RIP: 0010:_raw_spin_lock_irqsave+0x22/0x40 | <...> | Call Trace: | <TASK> | deactivate_slab() | bootstrap() | kmem_cache_init() | start_kernel() | secondary_startup_64_no_verify()
The crashes happen because of inconsistency between the nodemask that has nodes with less than 4MB as memoryless, and the actual memory fed into the core mm.
The commit:
9391a3f9c7f1 ("[PATCH] x86_64: Clear more state when ignoring empty node in SRAT parsing")
... that introduced minimal size of a NUMA node does not explain why a node size cannot be less than 4MB and what boot failures this restriction might fix.
Fixes have been submitted to the core MM code to tighten up the memory topologies it accepts and to not crash on weird input:
mm: page_alloc: skip memoryless nodes entirely
mm: memory_hotplug: drop memoryless node from fallback lists
Andrew has accepted them into the -mm tree, but there are no stable SHA1's yet.
This patch drops the limitation for minimal node size on x86:
- which works around the crash without the fixes to the core MM.
- makes x86 topologies less weird,
- removes an arbitrary and undocumented limitation on NUMA topologies.
[ mingo: Improved changelog clarity. ]
--- arch/x86/include/asm/numa.h | 7 ------- arch/x86/mm/numa.c | 7 ------- 2 files changed, 14 deletions(-)
arch/x86/include/asm/numa.h +0 -7
@@ -12,13 +12,6 @@#define NR_NODE_MEMBLKS (MAX_NUMNODES*2) -/* -* Too small node sizes may confuse the VM badly. Usually they -* result from BIOS bugs. So dont recognize nodes as standalone -* NUMA entities that have less than this amount of RAM listed: -*/ -#define NODE_MIN_SIZE (4*1024*1024) -extern int numa_off;/*
arch/x86/mm/numa.c +0 -7
@@ -602,13 +602,6 @@ static int __init numa_register_memblks(struct numa_meminfo *mi)if (start >= end)continue ; -/* -* Don't confuse VM with a node that doesn't have the -* minimum amount of memory: -*/ -if (end && (end - start) <NODE_MIN_SIZE ) -continue ; -alloc_node_data (nid); }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 13/372 wifi: plfxlc: fix clang-specific fortify warning
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit a763e92c78615ea838f5b9a841398b1d4adb968e ]
When compiling with clang 16.0.6 and CONFIG_FORTIFY_SOURCE=y, I've noticed the following (somewhat confusing due to absence of an actual source code location):
In file included from drivers/net/wireless/purelifi/plfxlc/mac.c:6:
In file included from ./include/linux/netdevice.h:24:
In file included from ./include/linux/timer.h:6:
In file included from ./include/linux/ktime.h:24:
In file included from ./include/linux/time.h:60:
In file included from ./include/linux/time32.h:13:
In file included from ./include/linux/timex.h:67:
In file included from ./arch/x86/include/asm/timex.h:5:
In file included from ./arch/x86/include/asm/processor.h:23:
In file included from ./arch/x86/include/asm/msr.h:11:
In file included from ./arch/x86/include/asm/cpumask.h:5:
In file included from ./include/linux/cpumask.h:12:
In file included from ./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:254:./include/linux/fortify-string.h:592:4: warning: call to '__read_overflow2_field' declared with 'warning' attribute: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Wattribute-warning]
__read_overflow2_field(q_size_field, size);
The compiler actually complains on 'plfxlc_get_et_strings()' where fortification logic inteprets call to 'memcpy()' as an attempt to copy the whole 'et_strings' array from its first member and so issues an overread warning. This warning may be silenced by passing an address of the whole array and not the first member to 'memcpy()'.
--- drivers/net/wireless/purelifi/plfxlc/mac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/purelifi/plfxlc/mac.c +1 -1
@@ -666,7 +666,7 @@ static void plfxlc_get_et_strings(struct ieee80211_hw *hw, u32 sset, u8 *data) {if (sset ==ETH_SS_STATS ) -memcpy (data, *et_strings,sizeof (et_strings)); +memcpy (data, et_strings,sizeof (et_strings)); } static void plfxlc_get_et_stats(struct ieee80211_hw *hw,
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 14/372 wifi: mac80211_hwsim: fix clang-specific fortify warning
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit cbaccdc42483c65016f1bae89128c08dc17cfb2a ]
When compiling with clang 16.0.6 and CONFIG_FORTIFY_SOURCE=y, I've noticed the following (somewhat confusing due to absence of an actual source code location):
In file included from drivers/net/wireless/virtual/mac80211_hwsim.c:18:
In file included from ./include/linux/slab.h:16:
In file included from ./include/linux/gfp.h:7:
In file included from ./include/linux/mmzone.h:8:
In file included from ./include/linux/spinlock.h:56:
In file included from ./include/linux/preempt.h:79:
In file included from ./arch/x86/include/asm/preempt.h:9:
In file included from ./include/linux/thread_info.h:60:
In file included from ./arch/x86/include/asm/thread_info.h:53:
In file included from ./arch/x86/include/asm/cpufeature.h:5:
In file included from ./arch/x86/include/asm/processor.h:23:
In file included from ./arch/x86/include/asm/msr.h:11:
In file included from ./arch/x86/include/asm/cpumask.h:5:
In file included from ./include/linux/cpumask.h:12:
In file included from ./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:254:./include/linux/fortify-string.h:592:4: warning: call to '__read_overflow2_field' declared with 'warning' attribute: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Wattribute-warning]
__read_overflow2_field(q_size_field, size);
The compiler actually complains on 'mac80211_hwsim_get_et_strings()' where fortification logic inteprets call to 'memcpy()' as an attempt to copy the whole 'mac80211_hwsim_gstrings_stats' array from its first member and so issues an overread warning. This warning may be silenced by passing an address of the whole array and not the first member to 'memcpy()'.
--- drivers/net/wireless/mac80211_hwsim.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/mac80211_hwsim.c +1 -1
@@ -3021,7 +3021,7 @@ static void mac80211_hwsim_get_et_strings(struct ieee80211_hw *hw, u32 sset, u8 *data) {if (sset ==ETH_SS_STATS ) -memcpy (data, *mac80211_hwsim_gstrings_stats, +memcpy (data, mac80211_hwsim_gstrings_stats,sizeof (mac80211_hwsim_gstrings_stats)); }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 15/372 wifi: mac80211: dont return unset power in ieee80211_get_tx_power()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping-Ke Shih <[email protected]>
[ Upstream commit e160ab85166e77347d0cbe5149045cb25e83937f ]
We can get a UBSAN warning if ieee80211_get_tx_power() returns the INT_MIN value mac80211 internally uses for "unset power level".
UBSAN: signed-integer-overflow in net/wireless/nl80211.c:3816:5 -2147483648 * 100 cannot be represented in type 'int' CPU: 0 PID: 20433 Comm: insmod Tainted: G WC OE Call Trace: dump_stack+0x74/0x92 ubsan_epilogue+0x9/0x50 handle_overflow+0x8d/0xd0 __ubsan_handle_mul_overflow+0xe/0x10 nl80211_send_iface+0x688/0x6b0 [cfg80211] [...] cfg80211_register_wdev+0x78/0xb0 [cfg80211] cfg80211_netdev_notifier_call+0x200/0x620 [cfg80211] [...] ieee80211_if_add+0x60e/0x8f0 [mac80211] ieee80211_register_hw+0xda5/0x1170 [mac80211]
In this case, simply return an error instead, to indicate that no data is available.
--- net/mac80211/cfg.c | 4 ++++ 1 file changed, 4 insertions(+)
net/mac80211/cfg.c +4 -0
@@ -3006,6 +3006,10 @@ static int ieee80211_get_tx_power(struct wiphy *wiphy,else *dbm = sdata->vif.bss_conf.txpower; +/* INT_MIN indicates no power level was set yet */ +if (*dbm ==INT_MIN ) +return -EINVAL ; +return 0 ; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 16/372 atl1c: Work around the DMA RX overflow issue
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sieng-Piaw Liew <[email protected]>
[ Upstream commit 86565682e9053e5deb128193ea9e88531bbae9cf ]
This is based on alx driver commit 881d0327db37 ("net: alx: Work around the DMA RX overflow issue").
The alx and atl1c drivers had RX overflow error which was why a custom allocator was created to avoid certain addresses. The simpler workaround then created for alx driver, but not for atl1c due to lack of tester.
Instead of using a custom allocator, check the allocated skb address and use skb_reserve() to move away from problematic 0x...fc0 address.
Tested on AR8131 on Acer 4540.
--- drivers/net/ethernet/atheros/atl1c/atl1c.h | 3 - .../net/ethernet/atheros/atl1c/atl1c_main.c | 67 +++++-------------- 2 files changed, 16 insertions(+), 54 deletions(-)
drivers/net/ethernet/atheros/atl1c/atl1c.h +0 -3
@@ -504,15 +504,12 @@ struct atl1c_rrd_ring {u16 next_to_use;u16 next_to_clean;struct napi_struct napi; -struct page *rx_page; -unsigned int rx_page_offset; };/* board specific private data structure */ struct atl1c_adapter {struct net_device *netdev;struct pci_dev *pdev; -unsigned int rx_frag_size;struct atl1c_hw hw;struct atl1c_hw_stats hw_stats;struct mii_if_info mii;/* MII interface info */
drivers/net/ethernet/atheros/atl1c/atl1c_main.c +16 -51
111 lines not on this page · raw message
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 17/372 bpf: Detect IP == ksym.end as part of BPF program
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kumar Kartikeya Dwivedi <[email protected]>
[ Upstream commit 66d9111f3517f85ef2af0337ece02683ce0faf21 ]
Now that bpf_throw kfunc is the first such call instruction that has noreturn semantics within the verifier, this also kicks in dead code elimination in unprecedented ways. For one, any instruction following a bpf_throw call will never be marked as seen. Moreover, if a callchain ends up throwing, any instructions after the call instruction to the eventually throwing subprog in callers will also never be marked as seen.
The tempting way to fix this would be to emit extra 'int3' instructions which bump the jited_len of a program, and ensure that during runtime when a program throws, we can discover its boundaries even if the call instruction to bpf_throw (or to subprogs that always throw) is emitted as the final instruction in the program.
An example of such a program would be this:
do_something():
... r0 = 0 exit
foo():
r1 = 0 call bpf_throw r0 = 0 exit
bar(cond):
if r1 != 0 goto pc+2 call do_something exit call foo r0 = 0 // Never seen by verifier exit //
main(ctx):
r1 = ... call bar r0 = 0 exit
Here, if we do end up throwing, the stacktrace would be the following:
bpf_throw
foo
bar
main
In bar, the final instruction emitted will be the call to foo, as such, the return address will be the subsequent instruction (which the JIT emits as int3 on x86). This will end up lying outside the jited_len of the program, thus, when unwinding, we will fail to discover the return address as belonging to any program and end up in a panic due to the unreliable stack unwinding of BPF programs that we never expect.
To remedy this case, make bpf_prog_ksym_find treat IP == ksym.end as part of the BPF program, so that is_bpf_text_address returns true when such a case occurs, and we are able to unwind reliably when the final instruction ends up being a call instruction.
--- kernel/bpf/core.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
kernel/bpf/core.c +5 -1
@@ -608,7 +608,11 @@ static __always_inline int bpf_tree_comp(void *key, struct latch_tree_node *n)if (val < ksym->start)return -1 ; -if (val >= ksym->end) +/* Ensure that we detect return addresses as part of the program, when +* the final instruction is a call for a program part of the stack +* trace. Therefore, do val > ksym->end instead of val >= ksym->end. +*/ +if (val > ksym->end)return 1 ;return 0 ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 18/372 wifi: ath9k: fix clang-specific fortify warnings
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 95f97fe0ac974467ab4da215985a32b2fdf48af0 ]
When compiling with clang 16.0.6 and CONFIG_FORTIFY_SOURCE=y, I've noticed the following (somewhat confusing due to absence of an actual source code location):
In file included from drivers/net/wireless/ath/ath9k/debug.c:17:
In file included from ./include/linux/slab.h:16:
In file included from ./include/linux/gfp.h:7:
In file included from ./include/linux/mmzone.h:8:
In file included from ./include/linux/spinlock.h:56:
In file included from ./include/linux/preempt.h:79:
In file included from ./arch/x86/include/asm/preempt.h:9:
In file included from ./include/linux/thread_info.h:60:
In file included from ./arch/x86/include/asm/thread_info.h:53:
In file included from ./arch/x86/include/asm/cpufeature.h:5:
In file included from ./arch/x86/include/asm/processor.h:23:
In file included from ./arch/x86/include/asm/msr.h:11:
In file included from ./arch/x86/include/asm/cpumask.h:5:
In file included from ./include/linux/cpumask.h:12:
In file included from ./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:254:./include/linux/fortify-string.h:592:4: warning: call to '__read_overflow2_field' declared with 'warning' attribute: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Wattribute-warning]
__read_overflow2_field(q_size_field, size);
In file included from drivers/net/wireless/ath/ath9k/htc_drv_debug.c:17:
In file included from drivers/net/wireless/ath/ath9k/htc.h:20:
In file included from ./include/linux/module.h:13:
In file included from ./include/linux/stat.h:19:
In file included from ./include/linux/time.h:60:
In file included from ./include/linux/time32.h:13:
In file included from ./include/linux/timex.h:67:
In file included from ./arch/x86/include/asm/timex.h:5:
In file included from ./arch/x86/include/asm/processor.h:23:
In file included from ./arch/x86/include/asm/msr.h:11:
In file included from ./arch/x86/include/asm/cpumask.h:5:
In file included from ./include/linux/cpumask.h:12:
In file included from ./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:254:./include/linux/fortify-string.h:592:4: warning: call to '__read_overflow2_field' declared with 'warning' attribute: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Wattribute-warning]
__read_overflow2_field(q_size_field, size);
The compiler actually complains on 'ath9k_get_et_strings()' and 'ath9k_htc_get_et_strings()' due to the same reason: fortification logic inteprets call to 'memcpy()' as an attempt to copy the whole array from it's first member and so issues an overread warning. These warnings may be silenced by passing an address of the whole array and not the first member to 'memcpy()'.
--- drivers/net/wireless/ath/ath9k/debug.c | 2 +- drivers/net/wireless/ath/ath9k/htc_drv_debug.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath9k/debug.c +1 -1
@@ -1333,7 +1333,7 @@ void ath9k_get_et_strings(struct ieee80211_hw *hw, u32 sset, u8 *data) {if (sset ==ETH_SS_STATS ) -memcpy (data, *ath9k_gstrings_stats, +memcpy (data, ath9k_gstrings_stats,sizeof (ath9k_gstrings_stats)); }
drivers/net/wireless/ath/ath9k/htc_drv_debug.c +1 -1
@@ -428,7 +428,7 @@ void ath9k_htc_get_et_strings(struct ieee80211_hw *hw, u32 sset, u8 *data) {if (sset ==ETH_SS_STATS ) -memcpy (data, *ath9k_htc_gstrings_stats, +memcpy (data, ath9k_htc_gstrings_stats,sizeof (ath9k_htc_gstrings_stats)); }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 19/372 wifi: ath10k: fix clang-specific fortify warning
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit cb4c132ebfeac5962f7258ffc831caa0c4dada1a ]
When compiling with clang 16.0.6 and CONFIG_FORTIFY_SOURCE=y, I've noticed the following (somewhat confusing due to absence of an actual source code location):
In file included from drivers/net/wireless/ath/ath10k/debug.c:8:
In file included from ./include/linux/module.h:13:
In file included from ./include/linux/stat.h:19:
In file included from ./include/linux/time.h:60:
In file included from ./include/linux/time32.h:13:
In file included from ./include/linux/timex.h:67:
In file included from ./arch/x86/include/asm/timex.h:5:
In file included from ./arch/x86/include/asm/processor.h:23:
In file included from ./arch/x86/include/asm/msr.h:11:
In file included from ./arch/x86/include/asm/cpumask.h:5:
In file included from ./include/linux/cpumask.h:12:
In file included from ./include/linux/bitmap.h:11:
In file included from ./include/linux/string.h:254:./include/linux/fortify-string.h:592:4: warning: call to '__read_overflow2_field' declared with 'warning' attribute: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Wattribute-warning]
__read_overflow2_field(q_size_field, size);
The compiler actually complains on 'ath10k_debug_get_et_strings()' where fortification logic inteprets call to 'memcpy()' as an attempt to copy the whole 'ath10k_gstrings_stats' array from it's first member and so issues an overread warning. This warning may be silenced by passing an address of the whole array and not the first member to 'memcpy()'.
--- drivers/net/wireless/ath/ath10k/debug.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath10k/debug.c +1 -1
@@ -1139,7 +1139,7 @@ void ath10k_debug_get_et_strings(struct ieee80211_hw *hw, u32 sset, u8 *data) {if (sset ==ETH_SS_STATS ) -memcpy (data, *ath10k_gstrings_stats, +memcpy (data, ath10k_gstrings_stats,sizeof (ath10k_gstrings_stats)); }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 20/372 net: annotate data-races around sk->sk_tx_queue_mapping
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 0bb4d124d34044179b42a769a0c76f389ae973b6 ]
This field can be read or written without socket lock being held.
Add annotations to avoid load-store tearing.
--- include/net/sock.h | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
include/net/sock.h +16 -4
@@ -2032,21 +2032,33 @@ static inline void sk_tx_queue_set(struct sock *sk, int tx_queue)/* sk_tx_queue_mapping accept only upto a 16-bit value */ if (WARN_ON_ONCE ((unsigned short )tx_queue >=USHRT_MAX ))return ; - sk->sk_tx_queue_mapping = tx_queue; +/* Paired with READ_ONCE() in sk_tx_queue_get() and +* other WRITE_ONCE() because socket lock might be not held. +*/ +WRITE_ONCE (sk->sk_tx_queue_mapping, tx_queue); }#define NO_QUEUE_MAPPING USHRT_MAXstatic inline void sk_tx_queue_clear (struct sock *sk) { - sk->sk_tx_queue_mapping =NO_QUEUE_MAPPING ; +/* Paired with READ_ONCE() in sk_tx_queue_get() and +* other WRITE_ONCE() because socket lock might be not held. +*/ +WRITE_ONCE (sk->sk_tx_queue_mapping,NO_QUEUE_MAPPING ); }static inline int sk_tx_queue_get (const struct sock *sk) { -if (sk && sk->sk_tx_queue_mapping !=NO_QUEUE_MAPPING ) -return sk->sk_tx_queue_mapping; +if (sk) { +/* Paired with WRITE_ONCE() in sk_tx_queue_clear() +* and sk_tx_queue_set(). +*/ +int val =READ_ONCE (sk->sk_tx_queue_mapping); +if (val !=NO_QUEUE_MAPPING ) +return val; + }return -1 ; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 21/372 net: annotate data-races around sk->sk_dst_pending_confirm
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit eb44ad4e635132754bfbcb18103f1dcb7058aedd ]
This field can be read or written without socket lock being held.
Add annotations to avoid load-store tearing.
--- include/net/sock.h | 6 +++--- net/core/sock.c | 2 +- net/ipv4/tcp_output.c | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-)
include/net/sock.h +3 -3
@@ -2207,7 +2207,7 @@ static inline void __dst_negative_advice(struct sock *sk)if (ndst != dst) {rcu_assign_pointer (sk->sk_dst_cache, ndst);sk_tx_queue_clear (sk); - sk->sk_dst_pending_confirm =0 ; +WRITE_ONCE (sk->sk_dst_pending_confirm,0 ); } } }
@@ -2224,7 +2224,7 @@ __sk_dst_set(struct sock *sk, struct dst_entry *dst)struct dst_entry *old_dst;sk_tx_queue_clear (sk); - sk->sk_dst_pending_confirm =0 ; +WRITE_ONCE (sk->sk_dst_pending_confirm,0 ); old_dst =rcu_dereference_protected (sk->sk_dst_cache,lockdep_sock_is_held (sk));rcu_assign_pointer (sk->sk_dst_cache, dst);
@@ -2237,7 +2237,7 @@ sk_dst_set(struct sock *sk, struct dst_entry *dst)struct dst_entry *old_dst;sk_tx_queue_clear (sk); - sk->sk_dst_pending_confirm =0 ; +WRITE_ONCE (sk->sk_dst_pending_confirm,0 ); old_dst =xchg ((__force struct dst_entry **)&sk->sk_dst_cache, dst);dst_release (old_dst); }
net/core/sock.c +1 -1
@@ -596,7 +596,7 @@ struct dst_entry *__sk_dst_check(struct sock *sk, u32 cookie) INDIRECT_CALL_INET(dst->ops->check, ip6_dst_check, ipv4_dst_check, dst, cookie) == NULL) {sk_tx_queue_clear (sk); - sk->sk_dst_pending_confirm =0 ; +WRITE_ONCE (sk->sk_dst_pending_confirm,0 );RCU_INIT_POINTER (sk->sk_dst_cache,NULL );dst_release (dst);return NULL ;
net/ipv4/tcp_output.c +1 -1
@@ -1319,7 +1319,7 @@ static int __tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, skb->destructor =skb_is_tcp_pure_ack (skb) ? __sock_wfree : tcp_wfree;refcount_add (skb->truesize, &sk->sk_wmem_alloc); -skb_set_dst_pending_confirm (skb, sk->sk_dst_pending_confirm); +skb_set_dst_pending_confirm (skb,READ_ONCE (sk->sk_dst_pending_confirm));/* Build TCP header and checksum it. */ th = (struct tcphdr *)skb->data;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 22/372 wifi: ath10k: Dont touch the CE interrupt registers after power up
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit 170c75d43a77dc937c58f07ecf847ba1b42ab74e ]
As talked about in commit d66d24ac300c ("ath10k: Keep track of which interrupts fired, don't poll them"), if we access the copy engine register at a bad time then ath10k can go boom. However, it's not necessarily easy to know when it's safe to access them.
The ChromeOS test labs saw a crash that looked like this at shutdown/reboot time (on a chromeos-5.15 kernel, but likely the problem could also reproduce upstream):
Internal error: synchronous external abort: 96000010 [#1] PREEMPT SMP ... CPU: 4 PID: 6168 Comm: reboot Not tainted 5.15.111-lockdep-19350-g1d624fe6758f #1 010b9b233ab055c27c6dc88efb0be2f4e9e86f51 Hardware name: Google Kingoftown (DT) ... pc : ath10k_snoc_read32+0x50/0x74 [ath10k_snoc] lr : ath10k_snoc_read32+0x24/0x74 [ath10k_snoc] ... Call trace: ath10k_snoc_read32+0x50/0x74 [ath10k_snoc ...] ath10k_ce_disable_interrupt+0x190/0x65c [ath10k_core ...] ath10k_ce_disable_interrupts+0x8c/0x120 [ath10k_core ...] ath10k_snoc_hif_stop+0x78/0x660 [ath10k_snoc ...] ath10k_core_stop+0x13c/0x1ec [ath10k_core ...] ath10k_halt+0x398/0x5b0 [ath10k_core ...] ath10k_stop+0xfc/0x1a8 [ath10k_core ...] drv_stop+0x148/0x6b4 [mac80211 ...] ieee80211_stop_device+0x70/0x80 [mac80211 ...] ieee80211_do_stop+0x10d8/0x15b0 [mac80211 ...] ieee80211_stop+0x144/0x1a0 [mac80211 ...] __dev_close_many+0x1e8/0x2c0 dev_close_many+0x198/0x33c dev_close+0x140/0x210 cfg80211_shutdown_all_interfaces+0xc8/0x1e0 [cfg80211 ...] ieee80211_remove_interfaces+0x118/0x5c4 [mac80211 ...] ieee80211_unregister_hw+0x64/0x1f4 [mac80211 ...] ath10k_mac_unregister+0x4c/0xf0 [ath10k_core ...] ath10k_core_unregister+0x80/0xb0 [ath10k_core ...] ath10k_snoc_free_resources+0xb8/0x1ec [ath10k_snoc ...] ath10k_snoc_shutdown+0x98/0xd0 [ath10k_snoc ...] platform_shutdown+0x7c/0xa0 device_shutdown+0x3e0/0x58c kernel_restart_prepare+0x68/0xa0 kernel_restart+0x28/0x7c
Though there's no known way to reproduce the problem, it makes sense that it would be the same issue where we're trying to access copy engine registers when it's not allowed.
Let's fix this by changing how we "disable" the interrupts. Instead of tweaking the copy engine registers we'll just use disable_irq() and enable_irq(). Then we'll configure the interrupts once at power up time.
Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.3.2.2.c10-00754-QCAHLSWMTPL-1
--- drivers/net/wireless/ath/ath10k/snoc.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
drivers/net/wireless/ath/ath10k/snoc.c +14 -4
@@ -828,12 +828,20 @@ static void ath10k_snoc_hif_get_default_pipe(struct ath10k *ar,static inline void ath10k_snoc_irq_disable (struct ath10k *ar) { -ath10k_ce_disable_interrupts (ar); +struct ath10k_snoc *ar_snoc =ath10k_snoc_priv (ar); +int id; + +for (id =0 ; id <CE_COUNT_MAX ; id++) +disable_irq (ar_snoc->ce_irqs[id].irq_line); }static inline void ath10k_snoc_irq_enable (struct ath10k *ar) { -ath10k_ce_enable_interrupts (ar); +struct ath10k_snoc *ar_snoc =ath10k_snoc_priv (ar); +int id; + +for (id =0 ; id <CE_COUNT_MAX ; id++) +enable_irq (ar_snoc->ce_irqs[id].irq_line); }static void ath10k_snoc_rx_pipe_cleanup (struct ath10k_snoc_pipe *snoc_pipe)
@@ -1089,6 +1097,8 @@ static int ath10k_snoc_hif_power_up(struct ath10k *ar, goto err_free_rri; } +ath10k_ce_enable_interrupts (ar); +return 0 ; err_free_rri:
@@ -1252,8 +1262,8 @@ static int ath10k_snoc_request_irq(struct ath10k *ar)for (id =0 ; id <CE_COUNT_MAX ; id++) { ret =request_irq (ar_snoc->ce_irqs[id].irq_line, - ath10k_snoc_per_engine_handler,0 , - ce_name[id], ar); + ath10k_snoc_per_engine_handler, +IRQF_NO_AUTOEN , ce_name[id], ar);if (ret) { ath10k_err(ar, "failed to register IRQ handler for CE %d: %d\n",
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 23/372 vsock: read from sockets error queue
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arseniy Krasnov <[email protected]>
[ Upstream commit 49dbe25adac42d3e06f65d1420946bec65896222 ]
This adds handling of MSG_ERRQUEUE input flag in receive call. This flag is used to read socket's error queue instead of data queue. Possible scenario of error queue usage is receiving completions for transmission with MSG_ZEROCOPY flag. This patch also adds new defines: 'SOL_VSOCK' and 'VSOCK_RECVERR'.
--- include/linux/socket.h | 1 + include/uapi/linux/vm_sockets.h | 17 +++++++++++++++++ net/vmw_vsock/af_vsock.c | 6 ++++++ 3 files changed, 24 insertions(+)
include/linux/socket.h +1 -0
@@ -376,6 +376,7 @@ struct ucred {#define SOL_MPTCP 284#define SOL_MCTP 285#define SOL_SMC 286 +#define SOL_VSOCK 287/* IPX options */ #define IPX_TYPE 1
include/uapi/linux/vm_sockets.h +17 -0
@@ -191,4 +191,21 @@ struct sockaddr_vm {#define IOCTL_VM_SOCKETS_GET_LOCAL_CID _IO(7, 0xb9) +/* MSG_ZEROCOPY notifications are encoded in the standard error format, +* sock_extended_err. See Documentation/networking/msg_zerocopy.rst in +* kernel source tree for more details. +*/ + +/* 'cmsg_level' field value of 'struct cmsghdr' for notification parsing +* when MSG_ZEROCOPY flag is used on transmissions. +*/ + +#define SOL_VSOCK 287 + +/* 'cmsg_type' field value of 'struct cmsghdr' for notification parsing +* when MSG_ZEROCOPY flag is used on transmissions. +*/ + +#define VSOCK_RECVERR 1 +#endif /* _UAPI_VM_SOCKETS_H */
net/vmw_vsock/af_vsock.c +6 -0
@@ -89,6 +89,7 @@#include <linux/types.h> #include <linux/bitops.h> #include <linux/cred.h> +#include <linux/errqueue.h> #include <linux/init.h> #include <linux/io.h> #include <linux/kernel.h>
@@ -110,6 +111,7 @@#include <linux/workqueue.h> #include <net/sock.h> #include <net/af_vsock.h> +#include <uapi/linux/vm_sockets.h> static int __vsock_bind (struct sock *sk,struct sockaddr_vm *addr);static void vsock_sk_destruct (struct sock *sk);
@@ -2096,6 +2098,10 @@ vsock_connectible_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,int err; sk = sock->sk; + +if (unlikely (flags &MSG_ERRQUEUE )) +return sock_recv_errqueue (sk, msg, len,SOL_VSOCK ,VSOCK_RECVERR ); + vsk =vsock_sk (sk); err =0 ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 24/372 bpf: Ensure proper register state printing for cond jumps
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <[email protected]>
[ Upstream commit 1a8a315f008a58f54fecb012b928aa6a494435b3 ]
Verifier emits relevant register state involved in any given instruction next to it after ; to the right, if possible. Or, worst case, on the separate line repeating instruction index.
E.g., a nice and simple case would be:
2: (d5) if r0 s<= 0x0 goto pc+1 ; R0_w=0
But if there is some intervening extra output (e.g., precision backtracking log) involved, we are supposed to see the state after the precision backtrack log:
4: (75) if r0 s>= 0x0 goto pc+1
mark_precise: frame0: last_idx 4 first_idx 0 subseq_idx -1
mark_precise: frame0: regs=r0 stack= before 2: (d5) if r0 s<= 0x0 goto pc+1
mark_precise: frame0: regs=r0 stack= before 1: (b7) r0 = 0
6: R0_w=0
First off, note that in 6: R0_w=0 instruction index corresponds to the next instruction, not to the conditional jump instruction itself, which is wrong and we'll get to that.
But besides that, the above is a happy case that does work today. Yet, if it so happens that precision backtracking had to traverse some of the parent states, this 6: R0_w=0 state output would be missing.
This is due to a quirk of print_verifier_state() routine, which performs mark_verifier_state_clean(env) at the end. This marks all registers as "non-scratched", which means that subsequent logic to print *relevant* registers (that is, "scratched ones") fails and doesn't see anything relevant to print and skips the output altogether.
print_verifier_state() is used both to print instruction context, but also to print an **entire** verifier state indiscriminately, e.g., during precision backtracking (and in a few other situations, like during entering or exiting subprogram). Which means if we have to print entire parent state before getting to printing instruction context state, instruction context is marked as clean and is omitted.
Long story short, this is definitely not intentional. So we fix this behavior in this patch by teaching print_verifier_state() to clear scratch state only if it was used to print instruction state, not the parent/callback state. This is determined by print_all option, so if it's not set, we don't clear scratch state. This fixes missing instruction state for these cases.
As for the mismatched instruction index, we fix that by making sure we call print_insn_state() early inside check_cond_jmp_op() before we adjusted insn_idx based on jump branch taken logic. And with that we get desired correct information:
9: (16) if w4 == 0x1 goto pc+9
mark_precise: frame0: last_idx 9 first_idx 9 subseq_idx -1
mark_precise: frame0: parent state regs=r4 stack=: R2_w=1944 R4_rw=P1 R10=fp0
mark_precise: frame0: last_idx 8 first_idx 0 subseq_idx 9
mark_precise: frame0: regs=r4 stack= before 8: (66) if w4 s> 0x3 goto pc+5
mark_precise: frame0: regs=r4 stack= before 7: (b7) r4 = 1
9: R4=1
--- kernel/bpf/verifier.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
kernel/bpf/verifier.c +6 -1
@@ -978,7 +978,8 @@ static void print_verifier_state(struct bpf_verifier_env *env,if (state->in_async_callback_fn)verbose (env," async_cb" );verbose (env,"\n" ); -mark_verifier_state_clean (env); +if (!print_all) +mark_verifier_state_clean (env); }static inline u32 vlog_alignment (u32 pos)
@@ -10476,6 +10477,8 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env, !sanitize_speculative_path (env, insn, *insn_idx +1 , *insn_idx)) return -EFAULT; +if (env->log.level &BPF_LOG_LEVEL ) +print_insn_state (env, this_branch->frame[this_branch->curframe]); *insn_idx += insn->off;return 0 ; }else if (pred ==0 ) {
@@ -10488,6 +10491,8 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env, *insn_idx + insn->off + 1, *insn_idx))return -EFAULT ; +if (env->log.level &BPF_LOG_LEVEL ) +print_insn_state (env, this_branch->frame[this_branch->curframe]);return 0 ; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 25/372 Bluetooth: btusb: Add date->evt_skb is NULL check
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: youwan Wang <[email protected]>
[ Upstream commit 624820f7c8826dd010e8b1963303c145f99816e9 ]
fix crash because of null pointers
[ 6104.969662] BUG: kernel NULL pointer dereference, address: 00000000000000c8 [ 6104.969667] #PF: supervisor read access in kernel mode [ 6104.969668] #PF: error_code(0x0000) - not-present page [ 6104.969670] PGD 0 P4D 0 [ 6104.969673] Oops: 0000 [#1] SMP NOPTI [ 6104.969684] RIP: 0010:btusb_mtk_hci_wmt_sync+0x144/0x220 [btusb] [ 6104.969688] RSP: 0018:ffffb8d681533d48 EFLAGS: 00010246 [ 6104.969689] RAX: 0000000000000000 RBX: ffff8ad560bb2000 RCX: 0000000000000006 [ 6104.969691] RDX: 0000000000000000 RSI: ffffb8d681533d08 RDI: 0000000000000000 [ 6104.969692] RBP: ffffb8d681533d70 R08: 0000000000000001 R09: 0000000000000001 [ 6104.969694] R10: 0000000000000001 R11: 00000000fa83b2da R12: ffff8ad461d1d7c0 [ 6104.969695] R13: 0000000000000000 R14: ffff8ad459618c18 R15: ffffb8d681533d90 [ 6104.969697] FS: 00007f5a1cab9d40(0000) GS:ffff8ad578200000(0000) knlGS:00000 [ 6104.969699] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6104.969700] CR2: 00000000000000c8 CR3: 000000018620c001 CR4: 0000000000760ef0 [ 6104.969701] PKRU: 55555554 [ 6104.969702] Call Trace: [ 6104.969708] btusb_mtk_shutdown+0x44/0x80 [btusb] [ 6104.969732] hci_dev_do_close+0x470/0x5c0 [bluetooth] [ 6104.969748] hci_rfkill_set_block+0x56/0xa0 [bluetooth] [ 6104.969753] rfkill_set_block+0x92/0x160 [ 6104.969755] rfkill_fop_write+0x136/0x1e0 [ 6104.969759] __vfs_write+0x18/0x40 [ 6104.969761] vfs_write+0xdf/0x1c0 [ 6104.969763] ksys_write+0xb1/0xe0 [ 6104.969765] __x64_sys_write+0x1a/0x20 [ 6104.969769] do_syscall_64+0x51/0x180 [ 6104.969771] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 6104.969773] RIP: 0033:0x7f5a21f18fef [ 6104.9] RSP: 002b:00007ffeefe39010 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 6104.969780] RAX: ffffffffffffffda RBX: 000055c10a7560a0 RCX: 00007f5a21f18fef [ 6104.969781] RDX: 0000000000000008 RSI: 00007ffeefe39060 RDI: 0000000000000012 [ 6104.969782] RBP: 00007ffeefe39060 R08: 0000000000000000 R09: 0000000000000017 [ 6104.969784] R10: 00007ffeefe38d97 R11: 0000000000000293 R12: 0000000000000002 [ 6104.969785] R13: 00007ffeefe39220 R14: 00007ffeefe391a0 R15: 000055c10a72acf0
--- drivers/bluetooth/btusb.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/bluetooth/btusb.c +3 -0
@@ -2638,6 +2638,9 @@ static int btusb_mtk_hci_wmt_sync(struct hci_dev *hdev, goto err_free_wc; } +if (data->evt_skb ==NULL ) + goto err_free_wc; +/* Parse and handle the return WMT event */ wmt_evt = (struct btmtk_hci_wmt_evt *)data->evt_skb->data;if (wmt_evt->whdr.op != hdr->op) {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 26/372 Bluetooth: Fix double free in hci_conn_cleanup
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhengHan Wang <[email protected]>
[ Upstream commit a85fb91e3d728bdfc80833167e8162cce8bc7004 ]
syzbot reports a slab use-after-free in hci_conn_hash_flush [1]. After releasing an object using hci_conn_del_sysfs in the hci_conn_cleanup function, releasing the same object again using the hci_dev_put and hci_conn_put functions causes a double free. Here's a simplified flow:
hci_conn_del_sysfs:
hci_dev_put
put_device
kobject_put
kref_put
kobject_release
kobject_cleanup
kfree_const
kfree(name)
hci_dev_put:
...
kfree(name)
hci_conn_put:
put_device
...
kfree(name)This patch drop the hci_dev_put and hci_conn_put function call in hci_conn_cleanup function, because the object is freed in hci_conn_del_sysfs function.
This patch also fixes the refcounting in hci_conn_add_sysfs() and hci_conn_del_sysfs() to take into account device_add() failures.
This fixes CVE-2023-28464.
--- net/bluetooth/hci_conn.c | 6 ++---- net/bluetooth/hci_sysfs.c | 23 ++++++++++++----------- 2 files changed, 14 insertions(+), 15 deletions(-)
net/bluetooth/hci_conn.c +2 -4
@@ -168,13 +168,11 @@ static void hci_conn_cleanup(struct hci_conn *conn) hdev->notify (hdev,HCI_NOTIFY_CONN_DEL ); } -hci_conn_del_sysfs (conn); -debugfs_remove_recursive (conn->debugfs); -hci_dev_put (hdev); +hci_conn_del_sysfs (conn); -hci_conn_put (conn); +hci_dev_put (hdev); }static void le_scan_cleanup (struct work_struct *work)
net/bluetooth/hci_sysfs.c +12 -11
@@ -33,7 +33,7 @@ void hci_conn_init_sysfs(struct hci_conn *conn) {struct hci_dev *hdev = conn->hdev; -BT_DBG ("conn %p" , conn); +bt_dev_dbg (hdev,"conn %p" , conn); conn->dev.type = &bt_link; conn->dev.class = bt_class;
@@ -46,27 +46,30 @@ void hci_conn_add_sysfs(struct hci_conn *conn) {struct hci_dev *hdev = conn->hdev; -BT_DBG ("conn %p" , conn); +bt_dev_dbg (hdev,"conn %p" , conn);if (device_is_registered (&conn->dev))return ;dev_set_name (&conn->dev,"%s:%d" , hdev->name, conn->handle); -if (device_add (&conn->dev) <0 ) { +if (device_add (&conn->dev) <0 )bt_dev_err (hdev,"failed to register connection device" ); -return ; - } - -hci_dev_hold (hdev); }void hci_conn_del_sysfs (struct hci_conn *conn) {struct hci_dev *hdev = conn->hdev; -if (!device_is_registered (&conn->dev)) +bt_dev_dbg (hdev,"conn %p" , conn); + +if (!device_is_registered (&conn->dev)) { +/* If device_add() has *not* succeeded, use *only* put_device() +* to drop the reference count. +*/ +put_device (&conn->dev);return ; + }while (1 ) {struct device *dev;
@@ -78,9 +81,7 @@ void hci_conn_del_sysfs(struct hci_conn *conn)put_device (dev); } -device_del (&conn->dev); - -hci_dev_put (hdev); +device_unregister (&conn->dev); }static void bt_host_release (struct device *dev)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 27/372 ACPI: EC: Add quirk for HP 250 G7 Notebook PC
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Denose <[email protected]>
[ Upstream commit 891ddc03e2f4395e24795596e032f57d5ab37fe7 ]
Add GPE quirk entry for HP 250 G7 Notebook PC.
This change allows the lid switch to be identified as the lid switch and not a keyboard button. With the lid switch properly identified, the device triggers suspend correctly on lid close.
--- drivers/acpi/ec.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/acpi/ec.c +10 -0
@@ -1897,6 +1897,16 @@ static const struct dmi_system_id ec_dmi_table[] __initconst = { DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion Gaming Laptop 15-dk1xxx"), }, }, + { +/* +* HP 250 G7 Notebook PC +*/ + .callback = ec_honor_dsdt_gpe, + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"HP" ), + DMI_MATCH(DMI_PRODUCT_NAME, "HP 250 G7 Notebook PC"), + }, + }, {/* * Samsung hardware
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 28/372 tsnep: Fix tsnep_request_irq() format-overflow warning
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gerhard Engleder <[email protected]>
[ Upstream commit 00e984cb986b31e9313745e51daceaa1e1eb7351 ]
Compiler warns about a possible format-overflow in tsnep_request_irq():drivers/net/ethernet/engleder/tsnep_main.c:884:55: warning: 'sprintf' may write a terminating nul past the end of the destination [-Wformat-overflow=]
sprintf(queue->name, "%s-rx-%d", name,
^
drivers/net/ethernet/engleder/tsnep_main.c:881:55: warning: 'sprintf' may write a terminating nul past the end of the destination [-Wformat-overflow=]
sprintf(queue->name, "%s-tx-%d", name,
^
drivers/net/ethernet/engleder/tsnep_main.c:878:49: warning: '-txrx-' directive writing 6 bytes into a region of size between 5 and 25 [-Wformat-overflow=]
sprintf(queue->name, "%s-txrx-%d", name,
^~~~~~Actually overflow cannot happen. Name is limited to IFNAMSIZ, because netdev_name() is called during ndo_open(). queue_index is single char, because less than 10 queues are supported.
Fix warning with snprintf(). Additionally increase buffer to 32 bytes, because those 7 additional bytes were unused anyway.
--- drivers/net/ethernet/engleder/tsnep.h | 2 +- drivers/net/ethernet/engleder/tsnep_main.c | 12 ++++++------ 2 files changed, 7 insertions(+), 7 deletions(-)
drivers/net/ethernet/engleder/tsnep.h +1 -1
@@ -123,7 +123,7 @@ struct tsnep_rx {struct tsnep_queue {struct tsnep_adapter *adapter; -char name[IFNAMSIZ +9 ]; +char name[IFNAMSIZ +16 ];struct tsnep_tx *tx;struct tsnep_rx *rx;
drivers/net/ethernet/engleder/tsnep_main.c +6 -6
@@ -973,14 +973,14 @@ static int tsnep_request_irq(struct tsnep_queue *queue, bool first) dev = queue->adapter; }else {if (queue->tx && queue->rx) -sprintf (queue->name,"%s-txrx-%d" , name, - queue->rx->queue_index); +snprintf (queue->name,sizeof (queue->name),"%s-txrx-%d" , + name, queue->rx->queue_index);else if (queue->tx) -sprintf (queue->name,"%s-tx-%d" , name, - queue->tx->queue_index); +snprintf (queue->name,sizeof (queue->name),"%s-tx-%d" , + name, queue->tx->queue_index);else -sprintf (queue->name,"%s-rx-%d" , name, - queue->rx->queue_index); +snprintf (queue->name,sizeof (queue->name),"%s-rx-%d" , + name, queue->rx->queue_index); handler = tsnep_irq_txrx; dev = queue; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 29/372 platform/chrome: kunit: initialize lock for fake ec_dev
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tzung-Bi Shih <[email protected]>
[ Upstream commit e410b4ade83d06a046f6e32b5085997502ba0559 ]
cros_ec_cmd_xfer() uses ec_dev->lock. Initialize it.
Otherwise, dmesg shows the following:
Quoted 8 lines
DEBUG_LOCKS_WARN_ON(lock->magic != lock)
...Call Trace: ? __mutex_lock ? __warn ? __mutex_lock ... ? cros_ec_cmd_xfer
--- drivers/platform/chrome/cros_ec_proto_test.c | 1 + 1 file changed, 1 insertion(+)
drivers/platform/chrome/cros_ec_proto_test.c +1 -0
@@ -2667,6 +2667,7 @@ static int cros_ec_proto_test_init(struct kunit *test) ec_dev->dev->release = cros_ec_proto_test_release; ec_dev->cmd_xfer = cros_kunit_ec_xfer_mock; ec_dev->pkt_xfer = cros_kunit_ec_xfer_mock; +mutex_init (&ec_dev->lock); priv->msg = (struct cros_ec_command *)priv->_msg;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 30/372 platform/x86: thinkpad_acpi: Add battery quirk for Thinkpad X120e
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olli Asikainen <[email protected]>
[ Upstream commit 916646758aea81a143ce89103910f715ed923346 ]
Thinkpad X120e also needs this battery quirk.
--- drivers/platform/x86/thinkpad_acpi.c | 1 + 1 file changed, 1 insertion(+)
drivers/platform/x86/thinkpad_acpi.c +1 -0
@@ -10019,6 +10019,7 @@ static const struct tpacpi_quirk battery_quirk_table[] __initconst = {* Individual addressing is broken on models that expose the * primary battery as BAT1. */ +TPACPI_Q_LNV ('8' ,'F' , true),/* Thinkpad X120e */ TPACPI_Q_LNV ('J' ,'7' , true),/* B5400 */ TPACPI_Q_LNV ('J' ,'I' , true),/* Thinkpad 11e */ TPACPI_Q_LNV3('R', '0', 'B', true), /* Thinkpad 11e gen 3 */
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 31/372 drm/gma500: Fix call trace when psb_gem_mm_init() fails
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sui Jingfeng <[email protected]>
[ Upstream commit da596080b2b400c50fe9f8f237bcaf09fed06af8 ]
Because the gma_irq_install() is call after psb_gem_mm_init() function, when psb_gem_mm_init() fails, the interrupt line haven't been allocated. Yet the gma_irq_uninstall() is called in the psb_driver_unload() function without checking if checking the irq is registered or not.
The calltrace is appended as following:
[ 20.539253] ioremap memtype_reserve failed -16 [ 20.543895] gma500 0000:00:02.0: Failure to map stolen base. [ 20.565049] ------------[ cut here ]------------ [ 20.565066] Trying to free already-free IRQ 16 [ 20.565087] WARNING: CPU: 1 PID: 381 at kernel/irq/manage.c:1893 free_irq+0x209/0x370 [ 20.565316] CPU: 1 PID: 381 Comm: systemd-udevd Tainted: G C 6.5.0-rc1+ #368 [ 20.565329] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./IMB-140D Plus, BIOS P1.10 11/18/2013 [ 20.565338] RIP: 0010:free_irq+0x209/0x370 [ 20.565357] Code: 41 5d 41 5e 41 5f 5d 31 d2 89 d1 89 d6 89 d7 41 89 d1 c3 cc cc cc cc 8b 75 d0 48 c7 c7 e0 77 12 9f 4c 89 4d c8 e8 57 fe f4 ff <0f> 0b 48 8b 75 c8 4c 89 f7 e8 29 f3 f1 00 49 8b 47 40 48 8b 40 78 [ 20.565369] RSP: 0018:ffffae3b40733808 EFLAGS: 00010046 [ 20.565382] RAX: 0000000000000000 RBX: ffff9f8082bfe000 RCX: 0000000000000000 [ 20.565390] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 20.565397] RBP: ffffae3b40733840 R08: 0000000000000000 R09: 0000000000000000 [ 20.565405] R10: 0000000000000000 R11: 0000000000000000 R12: ffff9f80871c3100 [ 20.565413] R13: ffff9f80835d3360 R14: ffff9f80835d32a4 R15: ffff9f80835d3200 [ 20.565424] FS: 00007f13d36458c0(0000) GS:ffff9f8138880000(0000) knlGS:0000000000000000 [ 20.565434] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 20.565441] CR2: 00007f0d046f3f20 CR3: 0000000006c8c000 CR4: 00000000000006e0 [ 20.565450] Call Trace: [ 20.565458] <TASK> [ 20.565470] ? show_regs+0x72/0x90 [ 20.565488] ? free_irq+0x209/0x370 [ 20.565504] ? __warn+0x8d/0x160 [ 20.565520] ? free_irq+0x209/0x370 [ 20.565536] ? report_bug+0x1bb/0x1d0 [ 20.565555] ? handle_bug+0x46/0x90 [ 20.565572] ? exc_invalid_op+0x19/0x80 [ 20.565587] ? asm_exc_invalid_op+0x1b/0x20 [ 20.565607] ? free_irq+0x209/0x370 [ 20.565625] ? free_irq+0x209/0x370 [ 20.565644] gma_irq_uninstall+0x15b/0x1e0 [gma500_gfx] [ 20.565728] psb_driver_unload+0x27/0x190 [gma500_gfx] [ 20.565800] psb_pci_probe+0x5d2/0x790 [gma500_gfx] [ 20.565873] local_pci_probe+0x48/0xb0 [ 20.565892] pci_device_probe+0xc8/0x280 [ 20.565912] really_probe+0x1d2/0x440 [ 20.565929] __driver_probe_device+0x8a/0x190 [ 20.565944] driver_probe_device+0x23/0xd0 [ 20.565957] __driver_attach+0x10f/0x220 [ 20.565971] ? __pfx___driver_attach+0x10/0x10 [ 20.565984] bus_for_each_dev+0x7a/0xe0 [ 20.566002] driver_attach+0x1e/0x30 [ 20.566014] bus_add_driver+0x127/0x240 [ 20.566029] driver_register+0x64/0x140 [ 20.566043] ? __pfx_psb_init+0x10/0x10 [gma500_gfx] [ 20.566111] __pci_register_driver+0x68/0x80 [ 20.566128] psb_init+0x2c/0xff0 [gma500_gfx] [ 20.566194] do_one_initcall+0x46/0x330 [ 20.566214] ? kmalloc_trace+0x2a/0xb0 [ 20.566233] do_init_module+0x6a/0x270 [ 20.566250] load_module+0x207f/0x23a0 [ 20.566278] init_module_from_file+0x9c/0xf0 [ 20.566293] ? init_module_from_file+0x9c/0xf0 [ 20.566315] idempotent_init_module+0x184/0x240 [ 20.566335] __x64_sys_finit_module+0x64/0xd0 [ 20.566352] do_syscall_64+0x59/0x90 [ 20.566366] ? ksys_mmap_pgoff+0x123/0x270 [ 20.566378] ? __secure_computing+0x9b/0x110 [ 20.566392] ? exit_to_user_mode_prepare+0x39/0x190 [ 20.566406] ? syscall_exit_to_user_mode+0x2a/0x50 [ 20.566420] ? do_syscall_64+0x69/0x90 [ 20.566433] ? do_syscall_64+0x69/0x90 [ 20.566445] ? do_syscall_64+0x69/0x90 [ 20.566458] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 [ 20.566472] RIP: 0033:0x7f13d351ea3d [ 20.566485] Code: 5b 41 5c c3 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c3 a3 0f 00 f7 d8 64 89 01 48 [ 20.566496] RSP: 002b:00007ffe566c1fd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 20.566510] RAX: ffffffffffffffda RBX: 000055e66806eec0 RCX: 00007f13d351ea3d [ 20.566519] RDX: 0000000000000000 RSI: 00007f13d36d9441 RDI: 0000000000000010 [ 20.566527] RBP: 0000000000020000 R08: 0000000000000000 R09: 0000000000000002 [ 20.566535] R10: 0000000000000010 R11: 0000000000000246 R12: 00007f13d36d9441 [ 20.566543] R13: 000055e6681108c0 R14: 000055e66805ba70 R15: 000055e66819a9c0 [ 20.566559] </TASK> [ 20.566566] ---[ end trace 0000000000000000 ]---
--- drivers/gpu/drm/gma500/psb_drv.h | 1 + drivers/gpu/drm/gma500/psb_irq.c | 5 +++++ 2 files changed, 6 insertions(+)
drivers/gpu/drm/gma500/psb_drv.h +1 -0
@@ -426,6 +426,7 @@ struct drm_psb_private {uint32_t pipestat[PSB_NUM_PIPE ];spinlock_t irqmask_lock; +bool irq_enabled;/* Power */ bool pm_initialized;
drivers/gpu/drm/gma500/psb_irq.c +5 -0
@@ -338,6 +338,8 @@ int gma_irq_install(struct drm_device *dev)gma_irq_postinstall (dev); + dev_priv->irq_enabled = true; +return 0 ; }
@@ -348,6 +350,9 @@ void gma_irq_uninstall(struct drm_device *dev)unsigned long irqflags;unsigned int i; +if (!dev_priv->irq_enabled) +return ; +spin_lock_irqsave (&dev_priv->irqmask_lock, irqflags);if (dev_priv->ops->hotplug_enable)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 32/372 drm/komeda: drop all currently held locks if deadlock happens
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: baozhu.liu <[email protected]>
[ Upstream commit 19ecbe8325a2a7ffda5ff4790955b84eaccba49f ]
If komeda_pipeline_unbound_components() returns -EDEADLK,
it means that a deadlock happened in the locking context. Currently, komeda is not dealing with the deadlock properly,producing the following output when CONFIG_DEBUG_WW_MUTEX_SLOWPATH is enabled:
------------[ cut here ]------------ [ 26.103984] WARNING: CPU: 2 PID: 345 at drivers/gpu/drm/arm/display/komeda/komeda_pipeline_state.c:1248 komeda_release_unclaimed_resources+0x13c/0x170 [ 26.117453] Modules linked in: [ 26.120511] CPU: 2 PID: 345 Comm: [email protected] Kdump: loaded Tainted: G W 5.10.110-SE-SDK1.8-dirty #16 [ 26.131374] Hardware name: Siengine Se1000 Evaluation board (DT) [ 26.137379] pstate: 20400009 (nzCv daif +PAN -UAO -TCO BTYPE=--) [ 26.143385] pc : komeda_release_unclaimed_resources+0x13c/0x170 [ 26.149301] lr : komeda_release_unclaimed_resources+0xbc/0x170 [ 26.155130] sp : ffff800017b8b8d0 [ 26.158442] pmr_save: 000000e0 [ 26.161493] x29: ffff800017b8b8d0 x28: ffff000cf2f96200 [ 26.166805] x27: ffff000c8f5a8800 x26: 0000000000000000 [ 26.172116] x25: 0000000000000038 x24: ffff8000116a0140 [ 26.177428] x23: 0000000000000038 x22: ffff000cf2f96200 [ 26.182739] x21: ffff000cfc300300 x20: ffff000c8ab77080 [ 26.188051] x19: 0000000000000003 x18: 0000000000000000 [ 26.193362] x17: 0000000000000000 x16: 0000000000000000 [ 26.198672] x15: b400e638f738ba38 x14: 0000000000000000 [ 26.203983] x13: 0000000106400a00 x12: 0000000000000000 [ 26.209294] x11: 0000000000000000 x10: 0000000000000000 [ 26.214604] x9 : ffff800012f80000 x8 : ffff000ca3308000 [ 26.219915] x7 : 0000000ff3000000 x6 : ffff80001084034c [ 26.225226] x5 : ffff800017b8bc40 x4 : 000000000000000f [ 26.230536] x3 : ffff000ca3308000 x2 : 0000000000000000 [ 26.235847] x1 : 0000000000000000 x0 : ffffffffffffffdd [ 26.241158] Call trace: [ 26.243604] komeda_release_unclaimed_resources+0x13c/0x170 [ 26.249175] komeda_crtc_atomic_check+0x68/0xf0 [ 26.253706] drm_atomic_helper_check_planes+0x138/0x1f4 [ 26.258929] komeda_kms_check+0x284/0x36c [ 26.262939] drm_atomic_check_only+0x40c/0x714 [ 26.267381] drm_atomic_nonblocking_commit+0x1c/0x60 [ 26.272344] drm_mode_atomic_ioctl+0xa3c/0xb8c [ 26.276787] drm_ioctl_kernel+0xc4/0x120 [ 26.280708] drm_ioctl+0x268/0x534 [ 26.284109] __arm64_sys_ioctl+0xa8/0xf0 [ 26.288030] el0_svc_common.constprop.0+0x80/0x240 [ 26.292817] do_el0_svc+0x24/0x90 [ 26.296132] el0_svc+0x20/0x30 [ 26.299185] el0_sync_handler+0xe8/0xf0 [ 26.303018] el0_sync+0x1a4/0x1c0 [ 26.306330] irq event stamp: 0 [ 26.309384] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 26.315650] hardirqs last disabled at (0): [<ffff800010056d34>] copy_process+0x5d0/0x183c [ 26.323825] softirqs last enabled at (0): [<ffff800010056d34>] copy_process+0x5d0/0x183c [ 26.331997] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 26.338261] ---[ end trace 20ae984fa860184a ]--- [ 26.343021] ------------[ cut here ]------------ [ 26.347646] WARNING: CPU: 3 PID: 345 at drivers/gpu/drm/drm_modeset_lock.c:228 drm_modeset_drop_locks+0x84/0x90 [ 26.357727] Modules linked in: [ 26.360783] CPU: 3 PID: 345 Comm: [email protected] Kdump: loaded Tainted: G W 5.10.110-SE-SDK1.8-dirty #16 [ 26.371645] Hardware name: Siengine Se1000 Evaluation board (DT) [ 26.377647] pstate: 20400009 (nzCv daif +PAN -UAO -TCO BTYPE=--) [ 26.383649] pc : drm_modeset_drop_locks+0x84/0x90 [ 26.388351] lr : drm_mode_atomic_ioctl+0x860/0xb8c [ 26.393137] sp : ffff800017b8bb10 [ 26.396447] pmr_save: 000000e0 [ 26.399497] x29: ffff800017b8bb10 x28: 0000000000000001 [ 26.404807] x27: 0000000000000038 x26: 0000000000000002 [ 26.410115] x25: ffff000cecbefa00 x24: ffff000cf2f96200 [ 26.415423] x23: 0000000000000001 x22: 0000000000000018 [ 26.420731] x21: 0000000000000001 x20: ffff800017b8bc10 [ 26.426039] x19: 0000000000000000 x18: 0000000000000000 [ 26.431347] x17: 0000000002e8bf2c x16: 0000000002e94c6b [ 26.436655] x15: 0000000002ea48b9 x14: ffff8000121f0300 [ 26.441963] x13: 0000000002ee2ca8 x12: ffff80001129cae0 [ 26.447272] x11: ffff800012435000 x10: ffff000ed46b5e88 [ 26.452580] x9 : ffff000c9935e600 x8 : 0000000000000000 [ 26.457888] x7 : 000000008020001e x6 : 000000008020001f [ 26.463196] x5 : ffff80001085fbe0 x4 : fffffe0033a59f20 [ 26.468504] x3 : 000000008020001e x2 : 0000000000000000 [ 26.473813] x1 : 0000000000000000 x0 : ffff000c8f596090 [ 26.479122] Call trace: [ 26.481566] drm_modeset_drop_locks+0x84/0x90 [ 26.485918] drm_mode_atomic_ioctl+0x860/0xb8c [ 26.490359] drm_ioctl_kernel+0xc4/0x120 [ 26.494278] drm_ioctl+0x268/0x534 [ 26.497677] __arm64_sys_ioctl+0xa8/0xf0 [ 26.501598] el0_svc_common.constprop.0+0x80/0x240 [ 26.506384] do_el0_svc+0x24/0x90 [ 26.509697] el0_svc+0x20/0x30 [ 26.512748] el0_sync_handler+0xe8/0xf0 [ 26.516580] el0_sync+0x1a4/0x1c0 [ 26.519891] irq event stamp: 0 [ 26.522943] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 26.529207] hardirqs last disabled at (0): [<ffff800010056d34>] copy_process+0x5d0/0x183c [ 26.537379] softirqs last enabled at (0): [<ffff800010056d34>] copy_process+0x5d0/0x183c [ 26.545550] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 26.551812] ---[ end trace 20ae984fa860184b ]---
According to the call trace information,it can be located to be WARN_ON(IS_ERR(c_st)) in the komeda_pipeline_unbound_components function; Then follow the function.komeda_pipeline_unbound_components
-> komeda_component_get_state_and_set_user
-> komeda_pipeline_get_state_and_set_crtc
-> komeda_pipeline_get_state
->drm_atomic_get_private_obj_state
-> drm_atomic_get_private_obj_state
-> drm_modeset_lockkomeda_pipeline_unbound_components
-> komeda_component_get_state_and_set_user
-> komeda_component_get_state
-> drm_atomic_get_private_obj_state
-> drm_modeset_lockret = drm_modeset_lock(&obj->lock, state->acquire_ctx); if (ret)
return ERR_PTR(ret);
Here it return -EDEADLK.
deal with the deadlock as suggested by [1], using the function drm_modeset_backoff().
[1] https://docs.kernel.org/gpu/drm-kms.html?highlight=kms#kms-locking
Therefore, handling this problem can be solved
by adding return -EDEADLK back to the drm_modeset_backoff processing flow in the drm_mode_atomic_ioctl function.
--- .../gpu/drm/arm/display/komeda/komeda_pipeline_state.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/gpu/drm/arm/display/komeda/komeda_pipeline_state.c +6 -3
@@ -1223,7 +1223,7 @@ int komeda_build_display_data_flow(struct komeda_crtc *kcrtc,return 0 ; } -static void +static int komeda_pipeline_unbound_components (struct komeda_pipeline *pipe,struct komeda_pipeline_state *new) {
@@ -1243,8 +1243,12 @@ komeda_pipeline_unbound_components(struct komeda_pipeline *pipe, c =komeda_pipeline_get_component (pipe, id); c_st =komeda_component_get_state_and_set_user (c, drm_st,NULL , new->crtc); +if (PTR_ERR (c_st) == -EDEADLK ) +return -EDEADLK ;WARN_ON (IS_ERR (c_st)); } + +return 0 ; }/* release unclaimed pipeline resource */
@@ -1266,9 +1270,8 @@ int komeda_release_unclaimed_resources(struct komeda_pipeline *pipe,if (WARN_ON (IS_ERR_OR_NULL (st)))return -EINVAL ; -komeda_pipeline_unbound_components (pipe, st); +return komeda_pipeline_unbound_components (pipe, st); -return 0 ; }/* Since standalone disabled components must be disabled separately and in the
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 33/372 drm/amdgpu: not to save bo in the case of RAS err_event_athub
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: David (Ming Qiang) Wu <[email protected]>
[ Upstream commit fa1f1cc09d588a90c8ce3f507c47df257461d148 ]
err_event_athub will corrupt VCPU buffer and not good to be restored in amdgpu_vcn_resume() and in this case the VCPU buffer needs to be cleared for VCN firmware to work properly.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c +7 -0
@@ -391,8 +391,15 @@ int amdgpu_vcn_suspend(struct amdgpu_device *adev)void *ptr;int i, idx; +bool in_ras_intr =amdgpu_ras_intr_triggered (); +cancel_delayed_work_sync (&adev->vcn.idle_work); +/* err_event_athub will corrupt VCPU buffer, so we need to +* restore fw data and clear buffer in amdgpu_vcn_resume() */ +if (in_ras_intr) +return 0 ; +for (i =0 ; i < adev->vcn.num_vcn_inst; ++i) {if (adev->vcn.harvest_config & (1 << i))continue ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 34/372 drm/amdkfd: Fix a race condition of vram buffer unref in svm code
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaogang Chen <[email protected]>
[ Upstream commit 709c348261618da7ed89d6c303e2ceb9e453ba74 ]
prange->svm_bo unref can happen in both mmu callback and a callback after migrate to system ram. Both are async call in different tasks. Sync svm_bo unref operation to avoid random "use-after-free".
--- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdkfd/kfd_svm.c +9 -2
@@ -612,8 +612,15 @@ svm_range_vram_node_new(struct amdgpu_device *adev, struct svm_range *prange,void svm_range_vram_node_free (struct svm_range *prange) { -svm_range_bo_unref (prange->svm_bo); - prange->ttm_res =NULL ; +/* serialize prange->svm_bo unref */ +mutex_lock (&prange->lock); +/* prange->svm_bo has not been unref */ +if (prange->ttm_res) { + prange->ttm_res =NULL ; +mutex_unlock (&prange->lock); +svm_range_bo_unref (prange->svm_bo); + }else +mutex_unlock (&prange->lock); } struct amdgpu_device *
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 35/372 drm/amd: Update `update_pcie_parameters` functions to use uint8_t arguments
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit 7752ccf85b929a22e658ec145283e8f31232f4bb ]
The matching values for pcie_gen_cap and pcie_width_cap when fetched from powerplay tables are 1 byte, so narrow the arguments to match to ensure min() and max() comparisons without casts.
--- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 2 +- drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h | 2 +- drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h | 4 ++-- drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 4 ++-- drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c | 8 ++++---- drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 4 ++-- 6 files changed, 12 insertions(+), 12 deletions(-)
drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +1 -1
@@ -1221,7 +1221,7 @@ static int smu_smc_hw_setup(struct smu_context *smu) {struct smu_feature *feature = &smu->smu_feature;struct amdgpu_device *adev = smu->adev; -uint32_t pcie_gen =0 , pcie_width =0 ; +uint8_t pcie_gen =0 , pcie_width =0 ;uint64_t features_supported;int ret =0 ;
drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h +1 -1
@@ -844,7 +844,7 @@ struct pptable_funcs {* &pcie_gen_cap: Maximum allowed PCIe generation. * &pcie_width_cap: Maximum allowed PCIe width. */ -int (*update_pcie_parameters)(struct smu_context *smu,uint32_t pcie_gen_cap,uint32_t pcie_width_cap); +int (*update_pcie_parameters)(struct smu_context *smu,uint8_t pcie_gen_cap,uint8_t pcie_width_cap);/** * @i2c_init: Initialize i2c.
drivers/gpu/drm/amd/pm/swsmu/inc/smu_v13_0.h +2 -2
@@ -298,8 +298,8 @@ int smu_v13_0_get_pptable_from_firmware(struct smu_context *smu, uint32_t pptable_id);int smu_v13_0_update_pcie_parameters (struct smu_context *smu, -uint32_t pcie_gen_cap, -uint32_t pcie_width_cap); +uint8_t pcie_gen_cap, +uint8_t pcie_width_cap);#endif #endif
drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c +2 -2
@@ -2368,8 +2368,8 @@ static int navi10_get_power_limit(struct smu_context *smu, }static int navi10_update_pcie_parameters (struct smu_context *smu, -uint32_t pcie_gen_cap, -uint32_t pcie_width_cap) +uint8_t pcie_gen_cap, +uint8_t pcie_width_cap) {struct smu_11_0_dpm_context *dpm_context = smu->smu_dpm.dpm_context;PPTable_t *pptable = smu->smu_table.driver_pptable;
drivers/gpu/drm/amd/pm/swsmu/smu11/sienna_cichlid_ppt.c +4 -4
@@ -2084,14 +2084,14 @@ static int sienna_cichlid_display_disable_memory_clock_switch(struct smu_context#define MAX (a, b) ((a) > (b) ? (a) : (b))static int sienna_cichlid_update_pcie_parameters (struct smu_context *smu, -uint32_t pcie_gen_cap, -uint32_t pcie_width_cap) +uint8_t pcie_gen_cap, +uint8_t pcie_width_cap) {struct smu_11_0_dpm_context *dpm_context = smu->smu_dpm.dpm_context;struct smu_11_0_pcie_table *pcie_table = &dpm_context->dpm_tables.pcie_table;uint8_t *table_member1, *table_member2; -uint32_t min_gen_speed, max_gen_speed; -uint32_t min_lane_width, max_lane_width; +uint8_t min_gen_speed, max_gen_speed; +uint8_t min_lane_width, max_lane_width;uint32_t smu_pcie_arg;int ret, i;
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c +2 -2
@@ -2486,8 +2486,8 @@ int smu_v13_0_mode1_reset(struct smu_context *smu) }int smu_v13_0_update_pcie_parameters (struct smu_context *smu, -uint32_t pcie_gen_cap, -uint32_t pcie_width_cap) +uint8_t pcie_gen_cap, +uint8_t pcie_width_cap) {struct smu_13_0_dpm_context *dpm_context = smu->smu_dpm.dpm_context; struct smu_13_0_pcie_table *pcie_table =
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 36/372 drm/amd/display: use full update for clip size increase of large plane source
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenjing Liu <[email protected]>
[ Upstream commit 05b78277ef0efc1deebc8a22384fffec29a3676e ]
[why]
Clip size increase will increase viewport, which could cause us to switch to MPC combine.
If we skip full update, we are not able to change to MPC combine in fast update. This will cause corruption showing on the video plane.
[how]
treat clip size increase of a surface larger than 5k as a full update.
--- drivers/gpu/drm/amd/display/dc/core/dc.c | 12 ++++++++++-- drivers/gpu/drm/amd/display/dc/dc.h | 5 +++++ 2 files changed, 15 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/core/dc.c +10 -2
@@ -996,7 +996,8 @@ static bool dc_construct(struct dc *dc,/* set i2c speed if not done by the respective dcnxxx__resource.c */ if (dc->caps.i2c_speed_in_khz_hdcp ==0 ) dc->caps.i2c_speed_in_khz_hdcp = dc->caps.i2c_speed_in_khz; - +if (dc->caps.max_optimizable_video_width ==0 ) + dc->caps.max_optimizable_video_width =5120 ; dc->clk_mgr =dc_clk_mgr_create (dc->ctx, dc->res_pool->pp_smu, dc->res_pool->dccg);if (!dc->clk_mgr) goto fail;
@@ -2438,6 +2439,7 @@ static enum surface_update_type get_plane_info_update_type(const struct dc_surfa }static enum surface_update_type get_scaling_info_update_type ( +const struct dc *dc,const struct dc_surface_update *u) {union surface_update_flags *update_flags = &u->surface->update_flags;
@@ -2472,6 +2474,12 @@ static enum surface_update_type get_scaling_info_update_type( update_flags->bits.clock_change =1 ; } +if (u->scaling_info->src_rect.width > dc->caps.max_optimizable_video_width && + (u->scaling_info->clip_rect.width > u->surface->clip_rect.width || + u->scaling_info->clip_rect.height > u->surface->clip_rect.height)) +/* Changing clip size of a large surface may result in MPC slice count change */ + update_flags->bits.bandwidth_change =1 ; +if (u->scaling_info->src_rect.x != u->surface->src_rect.x || u->scaling_info->src_rect.y != u->surface->src_rect.y || u->scaling_info->clip_rect.x != u->surface->clip_rect.x
@@ -2509,7 +2517,7 @@ static enum surface_update_type det_surface_update(const struct dc *dc, type =get_plane_info_update_type (u);elevate_update_type (&overall_type, type); - type =get_scaling_info_update_type (u); + type =get_scaling_info_update_type (dc, u);elevate_update_type (&overall_type, type);if (u->flip_addr) {
drivers/gpu/drm/amd/display/dc/dc.h +5 -0
@@ -230,6 +230,11 @@ struct dc_caps {uint32_t dmdata_alloc_size;unsigned int max_cursor_size;unsigned int max_video_width; +/* +* max video plane width that can be safely assumed to be always +* supported by single DPP pipe. +*/ +unsigned int max_optimizable_video_width;unsigned int min_horizontal_blanking_period;int linear_pitch_alignment;bool dcc_const_color;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 37/372 string.h: add array-wrappers for (v)memdup_user()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philipp Stanner <[email protected]>
[ Upstream commit 313ebe47d75558511aa1237b6e35c663b5c0ec6f ]
Currently, user array duplications are sometimes done without an overflow check. Sometimes the checks are done manually; sometimes the array size is calculated with array_size() and sometimes by calculating n * size directly in code.
Introduce wrappers for arrays for memdup_user() and vmemdup_user() to provide a standardized and safe way for duplicating user arrays.
This is both for new code as well as replacing usage of (v)memdup_user() in existing code that uses, e.g., n * size to calculate array sizes.
--- include/linux/string.h | 40 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+)
include/linux/string.h +40 -0
@@ -5,7 +5,9 @@#include <linux/compiler.h> /* for inline */ #include <linux/types.h> /* for size_t */ #include <linux/stddef.h> /* for NULL */ +#include <linux/err.h> /* for ERR_PTR() */ #include <linux/errno.h> /* for E2BIG */ +#include <linux/overflow.h> /* for check_mul_overflow() */ #include <linux/stdarg.h> #include <uapi/linux/string.h>
@@ -14,6 +16,44 @@ extern void *memdup_user(const void __user *, size_t);extern void *vmemdup_user (const void __user *,size_t );extern void *memdup_user_nul (const void __user *,size_t ); +/** +* memdup_array_user - duplicate array from user space +* @src: source address in user space +* @n: number of array members to copy +* @size: size of one array member +* +* Return: an ERR_PTR() on failure. Result is physically +* contiguous, to be freed by kfree(). +*/ +static inline void *memdup_array_user (const void __user *src,size_t n,size_t size) +{ +size_t nbytes; + +if (check_mul_overflow (n, size, &nbytes)) +return ERR_PTR (-EOVERFLOW ); + +return memdup_user (src, nbytes); +} + +/** +* vmemdup_array_user - duplicate array from user space +* @src: source address in user space +* @n: number of array members to copy +* @size: size of one array member +* +* Return: an ERR_PTR() on failure. Result may be not +* physically contiguous. Use kvfree() to free. +*/ +static inline void *vmemdup_array_user (const void __user *src,size_t n,size_t size) +{ +size_t nbytes; + +if (check_mul_overflow (n, size, &nbytes)) +return ERR_PTR (-EOVERFLOW ); + +return vmemdup_user (src, nbytes); +} +/* * Include machine specific inline routines */
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 38/372 kernel: kexec: copy user-array safely
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philipp Stanner <[email protected]>
[ Upstream commit 569c8d82f95eb5993c84fb61a649a9c4ddd208b3 ]
Currently, there is no overflow-check with memdup_user().
Use the new function memdup_array_user() instead of memdup_user() for duplicating the user-space array safely.
--- kernel/kexec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/kexec.c +1 -1
@@ -240,7 +240,7 @@ SYSCALL_DEFINE4(kexec_load, unsigned long, entry, unsigned long, nr_segments, ((flags & KEXEC_ARCH_MASK) != KEXEC_ARCH_DEFAULT))return -EINVAL ; - ksegments =memdup_user (segments, nr_segments *sizeof (ksegments[0 ])); + ksegments =memdup_array_user (segments, nr_segments,sizeof (ksegments[0 ]));if (IS_ERR (ksegments))return PTR_ERR (ksegments);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 39/372 kernel: watch_queue: copy user-array safely
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philipp Stanner <[email protected]>
[ Upstream commit ca0776571d3163bd03b3e8c9e3da936abfaecbf6 ]
Currently, there is no overflow-check with memdup_user().
Use the new function memdup_array_user() instead of memdup_user() for duplicating the user-space array safely.
--- kernel/watch_queue.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/watch_queue.c +1 -1
@@ -332,7 +332,7 @@ long watch_queue_set_filter(struct pipe_inode_info *pipe, filter.__reserved != 0)return -EINVAL ; - tf =memdup_user (_filter->filters, filter.nr_filters *sizeof (*tf)); + tf =memdup_array_user (_filter->filters, filter.nr_filters,sizeof (*tf));if (IS_ERR (tf))return PTR_ERR (tf);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 40/372 drm_lease.c: copy user-array safely
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philipp Stanner <[email protected]>
[ Upstream commit f37d63e219c39199a59b8b8a211412ff27192830 ]
Currently, there is no overflow-check with memdup_user().
Use the new function memdup_array_user() instead of memdup_user() for duplicating the user-space array safely.
--- drivers/gpu/drm/drm_lease.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/drm_lease.c +2 -2
@@ -507,8 +507,8 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,/* Handle leased objects, if any */ idr_init (&leases);if (object_count !=0 ) { - object_ids =memdup_user (u64_to_user_ptr (cl->object_ids), -array_size (object_count,sizeof (__u32))); + object_ids =memdup_array_user (u64_to_user_ptr (cl->object_ids), + object_count,sizeof (__u32));if (IS_ERR (object_ids)) { ret =PTR_ERR (object_ids);idr_destroy (&leases);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 41/372 drm: vmwgfx_surface.c: copy user-array safely
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philipp Stanner <[email protected]>
[ Upstream commit 06ab64a0d836ac430c5f94669710a78aa43942cb ]
Currently, there is no overflow-check with memdup_user().
Use the new function memdup_array_user() instead of memdup_user() for duplicating the user-space array safely.
--- drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/vmwgfx/vmwgfx_surface.c +2 -2
@@ -774,9 +774,9 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data, sizeof(metadata->mip_levels)); metadata->num_sizes = num_sizes; metadata->sizes = -memdup_user ((struct drm_vmw_size __user *)(unsigned long ) +memdup_array_user ((struct drm_vmw_size __user *)(unsigned long ) req->size_addr, -sizeof (*metadata->sizes) * metadata->num_sizes); + metadata->num_sizes,sizeof (*metadata->sizes));if (IS_ERR (metadata->sizes)) { ret =PTR_ERR (metadata->sizes); goto out_no_sizes;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 42/372 drm/msm/dp: skip validity check for DP CTS EDID checksum
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <[email protected]>
[ Upstream commit a251c9d8e30833b260101edb9383b176ee2b7cb1 ]
The DP CTS test for EDID last block checksum expects the checksum for the last block, invalid or not. Skip the validity check.
For the most part (*), the EDIDs returned by drm_get_edid() will be valid anyway, and there's the CTS workaround to get the checksum for completely invalid EDIDs. See commit 7948fe12d47a ("drm/msm/dp: return correct edid checksum after corrupted edid checksum read").
This lets us remove one user of drm_edid_block_valid() with hopes the function can be removed altogether in the future.
(*) drm_get_edid() ignores checksum errors on CTA extensions.
Patchwork: https://patchwork.freedesktop.org/patch/555361/
--- drivers/gpu/drm/msm/dp/dp_panel.c | 21 ++------------------- 1 file changed, 2 insertions(+), 19 deletions(-)
drivers/gpu/drm/msm/dp/dp_panel.c +2 -19
@@ -266,26 +266,9 @@ int dp_panel_get_modes(struct dp_panel *dp_panel,static u8 dp_panel_get_edid_checksum (struct edid *edid) { -struct edid *last_block; -u8 *raw_edid; -bool is_edid_corrupt = false; + edid += edid->extensions; -if (!edid) { -DRM_ERROR ("invalid edid input\n" ); -return 0 ; - } - - raw_edid = (u8 *)edid; - raw_edid += (edid->extensions *EDID_LENGTH ); - last_block = (struct edid *)raw_edid; - -/* block type extension */ -drm_edid_block_valid (raw_edid,1 , false, &is_edid_corrupt); -if (!is_edid_corrupt) -return last_block->checksum; - -DRM_ERROR ("Invalid block, no checksum\n" ); -return 0 ; +return edid->checksum; }void dp_panel_handle_sink_request (struct dp_panel *dp_panel)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 43/372 drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit 760efbca74a405dc439a013a5efaa9fadc95a8c3 ]
For pptable structs that use flexible array sizes, use flexible arrays.
--- drivers/gpu/drm/amd/include/pptable.h | 4 ++-- drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/gpu/drm/amd/include/pptable.h +2 -2
@@ -78,7 +78,7 @@ typedef struct _ATOM_PPLIB_THERMALCONTROLLERtypedef struct _ATOM_PPLIB_STATE {UCHAR ucNonClockStateIndex; -UCHAR ucClockStateIndices[1 ];// variable-sized +UCHAR ucClockStateIndices[];// variable-sized }ATOM_PPLIB_STATE ;
@@ -473,7 +473,7 @@ typedef struct _ATOM_PPLIB_STATE_V2/** * Driver will read the first ucNumDPMLevels in this array */ -UCHAR clockInfoIndex[1 ]; +UCHAR clockInfoIndex[]; }ATOM_PPLIB_STATE_V2 ; typedef struct _StateArray{
drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h +2 -2
@@ -179,7 +179,7 @@ typedef struct _ATOM_Tonga_MCLK_Dependency_Record {typedef struct _ATOM_Tonga_MCLK_Dependency_Table {UCHAR ucRevId;UCHAR ucNumEntries;/* Number of entries. */ -ATOM_Tonga_MCLK_Dependency_Record entries[1 ];/* Dynamically allocate entries. */ +ATOM_Tonga_MCLK_Dependency_Record entries[];/* Dynamically allocate entries. */ }ATOM_Tonga_MCLK_Dependency_Table ; typedef struct _ATOM_Tonga_SCLK_Dependency_Record {
@@ -194,7 +194,7 @@ typedef struct _ATOM_Tonga_SCLK_Dependency_Record {typedef struct _ATOM_Tonga_SCLK_Dependency_Table {UCHAR ucRevId;UCHAR ucNumEntries;/* Number of entries. */ -ATOM_Tonga_SCLK_Dependency_Record entries[1 ];/* Dynamically allocate entries. */ +ATOM_Tonga_SCLK_Dependency_Record entries[];/* Dynamically allocate entries. */ }ATOM_Tonga_SCLK_Dependency_Table ; typedef struct _ATOM_Polaris_SCLK_Dependency_Record {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 44/372 drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <[email protected]>
[ Upstream commit 0f0e59075b5c22f1e871fbd508d6e4f495048356 ]
For pptable structs that use flexible array sizes, use flexible arrays.
--- .../gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/gpu/drm/amd/pm/powerplay/hwmgr/pptable_v1_0.h +6 -6
@@ -164,7 +164,7 @@ typedef struct _ATOM_Tonga_State {typedef struct _ATOM_Tonga_State_Array {UCHAR ucRevId;UCHAR ucNumEntries;/* Number of entries. */ -ATOM_Tonga_State entries[1 ];/* Dynamically allocate entries. */ +ATOM_Tonga_State entries[];/* Dynamically allocate entries. */ }ATOM_Tonga_State_Array ; typedef struct _ATOM_Tonga_MCLK_Dependency_Record {
@@ -210,7 +210,7 @@ typedef struct _ATOM_Polaris_SCLK_Dependency_Record {typedef struct _ATOM_Polaris_SCLK_Dependency_Table {UCHAR ucRevId;UCHAR ucNumEntries;/* Number of entries. */ -ATOM_Polaris_SCLK_Dependency_Record entries[1 ];/* Dynamically allocate entries. */ +ATOM_Polaris_SCLK_Dependency_Record entries[];/* Dynamically allocate entries. */ }ATOM_Polaris_SCLK_Dependency_Table ; typedef struct _ATOM_Tonga_PCIE_Record {
@@ -222,7 +222,7 @@ typedef struct _ATOM_Tonga_PCIE_Record {typedef struct _ATOM_Tonga_PCIE_Table {UCHAR ucRevId;UCHAR ucNumEntries;/* Number of entries. */ -ATOM_Tonga_PCIE_Record entries[1 ];/* Dynamically allocate entries. */ +ATOM_Tonga_PCIE_Record entries[];/* Dynamically allocate entries. */ }ATOM_Tonga_PCIE_Table ; typedef struct _ATOM_Polaris10_PCIE_Record {
@@ -235,7 +235,7 @@ typedef struct _ATOM_Polaris10_PCIE_Record {typedef struct _ATOM_Polaris10_PCIE_Table {UCHAR ucRevId;UCHAR ucNumEntries;/* Number of entries. */ -ATOM_Polaris10_PCIE_Record entries[1 ];/* Dynamically allocate entries. */ +ATOM_Polaris10_PCIE_Record entries[];/* Dynamically allocate entries. */ }ATOM_Polaris10_PCIE_Table ;
@@ -252,7 +252,7 @@ typedef struct _ATOM_Tonga_MM_Dependency_Record {typedef struct _ATOM_Tonga_MM_Dependency_Table {UCHAR ucRevId;UCHAR ucNumEntries;/* Number of entries. */ -ATOM_Tonga_MM_Dependency_Record entries[1 ];/* Dynamically allocate entries. */ +ATOM_Tonga_MM_Dependency_Record entries[];/* Dynamically allocate entries. */ }ATOM_Tonga_MM_Dependency_Table ; typedef struct _ATOM_Tonga_Voltage_Lookup_Record {
@@ -265,7 +265,7 @@ typedef struct _ATOM_Tonga_Voltage_Lookup_Record {typedef struct _ATOM_Tonga_Voltage_Lookup_Table {UCHAR ucRevId;UCHAR ucNumEntries;/* Number of entries. */ -ATOM_Tonga_Voltage_Lookup_Record entries[1 ];/* Dynamically allocate entries. */ +ATOM_Tonga_Voltage_Lookup_Record entries[];/* Dynamically allocate entries. */ }ATOM_Tonga_Voltage_Lookup_Table ; typedef struct _ATOM_Tonga_Fan_Table {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 45/372 drm/amdgpu: Fix potential null pointer derefernce
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanley.Yang <[email protected]>
[ Upstream commit 80285ae1ec8717b597b20de38866c29d84d321a1 ]
The amdgpu_ras_get_context may return NULL if device not support ras feature, so add check before using.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +2 -1
@@ -5330,7 +5330,8 @@ int amdgpu_device_gpu_recover(struct amdgpu_device *adev,* Flush RAM to disk so that after reboot * the user can read log and see why the system rebooted. */ -if (need_emergency_restart &&amdgpu_ras_get_context (adev)->reboot) { +if (need_emergency_restart &&amdgpu_ras_get_context (adev) && +amdgpu_ras_get_context (adev)->reboot) {DRM_WARN ("Emergency reboot." );ksys_sync_helper ();
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 46/372 drm/panel: fix a possible null pointer dereference
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
[ Upstream commit 924e5814d1f84e6fa5cb19c6eceb69f066225229 ]
In versatile_panel_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd.
--- drivers/gpu/drm/panel/panel-arm-versatile.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/panel/panel-arm-versatile.c +2 -0
@@ -267,6 +267,8 @@ static int versatile_panel_get_modes(struct drm_panel *panel, connector->display_info.bus_flags = vpanel->panel_type->bus_flags; mode =drm_mode_duplicate (connector->dev, &vpanel->panel_type->mode); +if (!mode) +return -ENOMEM ;drm_mode_set_name (mode); mode->type =DRM_MODE_TYPE_DRIVER |DRM_MODE_TYPE_PREFERRED ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 47/372 drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
[ Upstream commit f22def5970c423ea7f87d5247bd0ef91416b0658 ]
In tpg110_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd.
--- drivers/gpu/drm/panel/panel-tpo-tpg110.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/panel/panel-tpo-tpg110.c +2 -0
@@ -379,6 +379,8 @@ static int tpg110_get_modes(struct drm_panel *panel, connector->display_info.bus_flags = tpg->panel_mode->bus_flags; mode =drm_mode_duplicate (connector->dev, &tpg->panel_mode->mode); +if (!mode) +return -ENOMEM ;drm_mode_set_name (mode); mode->type =DRM_MODE_TYPE_DRIVER |DRM_MODE_TYPE_PREFERRED ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 48/372 drm/radeon: fix a possible null pointer dereference
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
[ Upstream commit 2c1fe3c480f9e1deefd50d4b18be4a046011ee1f ]
In radeon_tv_get_modes(), the return value of drm_cvt_mode() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_cvt_mode(). Add a check to avoid null point dereference.
--- drivers/gpu/drm/radeon/radeon_connectors.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/radeon/radeon_connectors.c +2 -0
@@ -1122,6 +1122,8 @@ static int radeon_tv_get_modes(struct drm_connector *connector)else {/* only 800x600 is supported right now on pre-avivo chips */ tv_mode =drm_cvt_mode (dev,800 ,600 ,60 , false, false, false); +if (!tv_mode) +return 0 ; tv_mode->type =DRM_MODE_TYPE_DRIVER |DRM_MODE_TYPE_PREFERRED ;drm_mode_probed_add (connector, tv_mode); }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 49/372 drm/amdgpu/vkms: fix a possible null pointer dereference
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
[ Upstream commit cd90511557fdfb394bb4ac4c3b539b007383914c ]
In amdgpu_vkms_conn_get_modes(), the return value of drm_cvt_mode() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_cvt_mode(). Add a check to avoid null pointer dereference.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_vkms.c +2 -0
@@ -239,6 +239,8 @@ static int amdgpu_vkms_conn_get_modes(struct drm_connector *connector)for (i =0 ; i <ARRAY_SIZE (common_modes); i++) { mode =drm_cvt_mode (dev, common_modes[i].w, common_modes[i].h,60 , false, false, false); +if (!mode) +continue ;drm_mode_probed_add (connector, mode); }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 50/372 drm/panel: st7703: Pick different reset sequence
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ondrej Jirman <[email protected]>
[ Upstream commit d12d635bb03c7cb4830acb641eb176ee9ff2aa89 ]
Switching to a different reset sequence, enabling IOVCC before enabling VCC.
There also needs to be a delay after enabling the supplies and before deasserting the reset. The datasheet specifies 1ms after the supplies reach the required voltage. Use 10-20ms to also give the power supplies some time to reach the required voltage, too.
This fixes intermittent panel initialization failures and screen corruption during resume from sleep on panel xingbangda,xbd599 (e.g. used in PinePhone).
--- drivers/gpu/drm/panel/panel-sitronix-st7703.c | 25 ++++++++++--------- 1 file changed, 13 insertions(+), 12 deletions(-)
drivers/gpu/drm/panel/panel-sitronix-st7703.c +13 -12
@@ -428,29 +428,30 @@ static int st7703_prepare(struct drm_panel *panel)return 0 ;dev_dbg (ctx->dev,"Resetting the panel\n" ); - ret =regulator_enable (ctx->vcc); +gpiod_set_value_cansleep (ctx->reset_gpio,1 ); + + ret =regulator_enable (ctx->iovcc);if (ret <0 ) { -dev_err (ctx->dev,"Failed to enable vcc supply: %d\n" , ret); +dev_err (ctx->dev,"Failed to enable iovcc supply: %d\n" , ret);return ret; } - ret =regulator_enable (ctx->iovcc); + + ret =regulator_enable (ctx->vcc);if (ret <0 ) { -dev_err (ctx->dev,"Failed to enable iovcc supply: %d\n" , ret); - goto disable_vcc; +dev_err (ctx->dev,"Failed to enable vcc supply: %d\n" , ret); +regulator_disable (ctx->iovcc); +return ret; } -gpiod_set_value_cansleep (ctx->reset_gpio,1 ); -usleep_range (20 ,40 ); +/* Give power supplies time to stabilize before deasserting reset. */ +usleep_range (10000 ,20000 ); +gpiod_set_value_cansleep (ctx->reset_gpio,0 ); -msleep (20 ); +usleep_range (15000 ,20000 ); ctx->prepared = true;return 0 ; - -disable_vcc: -regulator_disable (ctx->vcc); -return ret; }static const u32 mantix_bus_formats[] = {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 51/372 drm/amdkfd: Fix shift out-of-bounds issue
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Zhang <[email protected]>
[ Upstream commit 282c1d793076c2edac6c3db51b7e8ed2b41d60a5 ]
[ 567.613292] shift exponent 255 is too large for 64-bit type 'long unsigned int' [ 567.614498] CPU: 5 PID: 238 Comm: kworker/5:1 Tainted: G OE 6.2.0-34-generic #34~22.04.1-Ubuntu [ 567.614502] Hardware name: AMD Splinter/Splinter-RPL, BIOS WS43927N_871 09/25/2023 [ 567.614504] Workqueue: events send_exception_work_handler [amdgpu] [ 567.614748] Call Trace: [ 567.614750] <TASK> [ 567.614753] dump_stack_lvl+0x48/0x70 [ 567.614761] dump_stack+0x10/0x20 [ 567.614763] __ubsan_handle_shift_out_of_bounds+0x156/0x310 [ 567.614769] ? srso_alias_return_thunk+0x5/0x7f [ 567.614773] ? update_sd_lb_stats.constprop.0+0xf2/0x3c0 [ 567.614780] svm_range_split_by_granularity.cold+0x2b/0x34 [amdgpu] [ 567.615047] ? srso_alias_return_thunk+0x5/0x7f [ 567.615052] svm_migrate_to_ram+0x185/0x4d0 [amdgpu] [ 567.615286] do_swap_page+0x7b6/0xa30 [ 567.615291] ? srso_alias_return_thunk+0x5/0x7f [ 567.615294] ? __free_pages+0x119/0x130 [ 567.615299] handle_pte_fault+0x227/0x280 [ 567.615303] __handle_mm_fault+0x3c0/0x720 [ 567.615311] handle_mm_fault+0x119/0x330 [ 567.615314] ? lock_mm_and_find_vma+0x44/0x250 [ 567.615318] do_user_addr_fault+0x1a9/0x640 [ 567.615323] exc_page_fault+0x81/0x1b0 [ 567.615328] asm_exc_page_fault+0x27/0x30 [ 567.615332] RIP: 0010:__get_user_8+0x1c/0x30
--- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdkfd/kfd_svm.c +1 -1
@@ -764,7 +764,7 @@ svm_range_apply_attrs(struct kfd_process *p, struct svm_range *prange, prange->flags &= ~attrs[i].value;break ;case KFD_IOCTL_SVM_ATTR_GRANULARITY : - prange->granularity = attrs[i].value; + prange->granularity =min_t (uint32_t, attrs[i].value,0x3F );break ;default :WARN_ONCE (1 ,"svm_range_check_attrs wasn't called?" );
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 52/372 drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Huang <[email protected]>
[ Upstream commit 5104fdf50d326db2c1a994f8b35dcd46e63ae4ad ]
In certain types of chips, such as VEGA20, reading the amdgpu_regs_smc file could result in an abnormal null pointer access when the smc_rreg pointer is NULL. Below are the steps to reproduce this issue and the corresponding exception log:
1. Navigate to the directory: /sys/kernel/debug/dri/0
2. Execute command: cat amdgpu_regs_smc
3. Exception Log::
[4005007.702554] BUG: kernel NULL pointer dereference, address: 0000000000000000 [4005007.702562] #PF: supervisor instruction fetch in kernel mode [4005007.702567] #PF: error_code(0x0010) - not-present page [4005007.702570] PGD 0 P4D 0 [4005007.702576] Oops: 0010 [#1] SMP NOPTI [4005007.702581] CPU: 4 PID: 62563 Comm: cat Tainted: G OE 5.15.0-43-generic #46-Ubunt u [4005007.702590] RIP: 0010:0x0 [4005007.702598] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. [4005007.702600] RSP: 0018:ffffa82b46d27da0 EFLAGS: 00010206 [4005007.702605] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffa82b46d27e68 [4005007.702609] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff9940656e0000 [4005007.702612] RBP: ffffa82b46d27dd8 R08: 0000000000000000 R09: ffff994060c07980 [4005007.702615] R10: 0000000000020000 R11: 0000000000000000 R12: 00007f5e06753000 [4005007.702618] R13: ffff9940656e0000 R14: ffffa82b46d27e68 R15: 00007f5e06753000 [4005007.702622] FS: 00007f5e0755b740(0000) GS:ffff99479d300000(0000) knlGS:0000000000000000 [4005007.702626] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [4005007.702629] CR2: ffffffffffffffd6 CR3: 00000003253fc000 CR4: 00000000003506e0 [4005007.702633] Call Trace: [4005007.702636] <TASK> [4005007.702640] amdgpu_debugfs_regs_smc_read+0xb0/0x120 [amdgpu] [4005007.703002] full_proxy_read+0x5c/0x80 [4005007.703011] vfs_read+0x9f/0x1a0 [4005007.703019] ksys_read+0x67/0xe0 [4005007.703023] __x64_sys_read+0x19/0x20 [4005007.703028] do_syscall_64+0x5c/0xc0 [4005007.703034] ? do_user_addr_fault+0x1e3/0x670 [4005007.703040] ? exit_to_user_mode_prepare+0x37/0xb0 [4005007.703047] ? irqentry_exit_to_user_mode+0x9/0x20 [4005007.703052] ? irqentry_exit+0x19/0x30 [4005007.703057] ? exc_page_fault+0x89/0x160 [4005007.703062] ? asm_exc_page_fault+0x8/0x30 [4005007.703068] entry_SYSCALL_64_after_hwframe+0x44/0xae [4005007.703075] RIP: 0033:0x7f5e07672992 [4005007.703079] Code: c0 e9 b2 fe ff ff 50 48 8d 3d fa b2 0c 00 e8 c5 1d 02 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 e c 28 48 89 54 24 [4005007.703083] RSP: 002b:00007ffe03097898 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [4005007.703088] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f5e07672992 [4005007.703091] RDX: 0000000000020000 RSI: 00007f5e06753000 RDI: 0000000000000003 [4005007.703094] RBP: 00007f5e06753000 R08: 00007f5e06752010 R09: 00007f5e06752010 [4005007.703096] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000022000 [4005007.703099] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000 [4005007.703105] </TASK> [4005007.703107] Modules linked in: nf_tables libcrc32c nfnetlink algif_hash af_alg binfmt_misc nls_ iso8859_1 ipmi_ssif ast intel_rapl_msr intel_rapl_common drm_vram_helper drm_ttm_helper amd64_edac t tm edac_mce_amd kvm_amd ccp mac_hid k10temp kvm acpi_ipmi ipmi_si rapl sch_fq_codel ipmi_devintf ipm i_msghandler msr parport_pc ppdev lp parport mtd pstore_blk efi_pstore ramoops pstore_zone reed_solo mon ip_tables x_tables autofs4 ib_uverbs ib_core amdgpu(OE) amddrm_ttm_helper(OE) amdttm(OE) iommu_v 2 amd_sched(OE) amdkcl(OE) drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops cec rc_core drm igb ahci xhci_pci libahci i2c_piix4 i2c_algo_bit xhci_pci_renesas dca [4005007.703184] CR2: 0000000000000000 [4005007.703188] ---[ end trace ac65a538d240da39 ]--- [4005007.800865] RIP: 0010:0x0 [4005007.800871] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. [4005007.800874] RSP: 0018:ffffa82b46d27da0 EFLAGS: 00010206 [4005007.800878] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffa82b46d27e68 [4005007.800881] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff9940656e0000 [4005007.800883] RBP: ffffa82b46d27dd8 R08: 0000000000000000 R09: ffff994060c07980 [4005007.800886] R10: 0000000000020000 R11: 0000000000000000 R12: 00007f5e06753000 [4005007.800888] R13: ffff9940656e0000 R14: ffffa82b46d27e68 R15: 00007f5e06753000 [4005007.800891] FS: 00007f5e0755b740(0000) GS:ffff99479d300000(0000) knlGS:0000000000000000 [4005007.800895] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [4005007.800898] CR2: ffffffffffffffd6 CR3: 00000003253fc000 CR4: 00000000003506e0
--- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +6 -0
@@ -589,6 +589,9 @@ static ssize_t amdgpu_debugfs_regs_smc_read(struct file *f, char __user *buf,ssize_t result =0 ;int r; +if (!adev->smc_rreg) +return -EPERM ; +if (size &0x3 || *pos &0x3 )return -EINVAL ;
@@ -645,6 +648,9 @@ static ssize_t amdgpu_debugfs_regs_smc_write(struct file *f, const char __user *ssize_t result =0 ;int r; +if (!adev->smc_wreg) +return -EPERM ; +if (size &0x3 || *pos &0x3 )return -EINVAL ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 53/372 arm64: dts: ls208xa: use a pseudo-bus to constrain usb dma size
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurentiu Tudor <[email protected]>
[ Upstream commit b39d5016456871a88f5cd141914a5043591b46f3 ]
Wrap the usb controllers in an intermediate simple-bus and use it to constrain the dma address size of these usb controllers to the 40b that they generate toward the interconnect. This is required because the SoC uses 48b address sizes and this mismatch would lead to smmu context faults [1] because the usb generates 40b addresses while the smmu page tables are populated with 48b wide addresses.
[1]
xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 1
xhci-hcd xhci-hcd.0.auto: hcc params 0x0220f66d hci version 0x100 quirks 0x0000000002000010 xhci-hcd xhci-hcd.0.auto: irq 108, io mem 0x03100000
xhci-hcd xhci-hcd.0.auto: xHCI Host Controller
xhci-hcd xhci-hcd.0.auto: new USB bus registered, assigned bus number 2
xhci-hcd xhci-hcd.0.auto: Host supports USB 3.0 SuperSpeed
arm-smmu 5000000.iommu: Unhandled context fault: fsr=0x402, iova=0xffffffb000, fsynr=0x0, cbfrsynra=0xc01, cb=3
--- .../arm64/boot/dts/freescale/fsl-ls208xa.dtsi | 46 +++++++++++-------- 1 file changed, 27 insertions(+), 19 deletions(-)
arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi +27 -19
@@ -1186,26 +1186,34 @@ dma-coherent; }; - usb0: usb@3100000 { - status = "disabled"; - compatible = "snps,dwc3"; - reg = <0x0 0x3100000 0x0 0x10000>; - interrupts = <0 80 0x4>; /* Level high type */ - dr_mode = "host"; - snps,quirk-frame-length-adjustment = <0x20>; - snps,dis_rxdet_inp3_quirk; - snps,incr-burst-type-adjustment = <1>, <4>, <8>, <16>; - }; + bus: bus { + #address-cells = <2>; + #size-cells = <2>; + compatible = "simple-bus"; + ranges; + dma-ranges = <0x0 0x0 0x0 0x0 0x100 0x00000000>; + + usb0: usb@3100000 { + compatible = "snps,dwc3"; + reg = <0x0 0x3100000 0x0 0x10000>; + interrupts = <0 80 0x4>; /* Level high type */ + dr_mode = "host"; + snps,quirk-frame-length-adjustment = <0x20>; + snps,dis_rxdet_inp3_quirk; + snps,incr-burst-type-adjustment = <1>, <4>, <8>, <16>; + status = "disabled"; + }; - usb1: usb@3110000 { - status = "disabled"; - compatible = "snps,dwc3"; - reg = <0x0 0x3110000 0x0 0x10000>; - interrupts = <0 81 0x4>; /* Level high type */ - dr_mode = "host"; - snps,quirk-frame-length-adjustment = <0x20>; - snps,dis_rxdet_inp3_quirk; - snps,incr-burst-type-adjustment = <1>, <4>, <8>, <16>; + usb1: usb@3110000 { + compatible = "snps,dwc3"; + reg = <0x0 0x3110000 0x0 0x10000>; + interrupts = <0 81 0x4>; /* Level high type */ + dr_mode = "host"; + snps,quirk-frame-length-adjustment = <0x20>; + snps,dis_rxdet_inp3_quirk; + snps,incr-burst-type-adjustment = <1>, <4>, <8>, <16>; + status = "disabled"; + }; }; ccn@4000000 {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 54/372 selftests/efivarfs: create-read: fix a resource leak
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: zhujun2 <[email protected]>
[ Upstream commit 3f6f8a8c5e11a9b384a36df4f40f0c9a653b6975 ]
The opened file should be closed in main(), otherwise resource leak will occur that this problem was discovered by code reading
--- tools/testing/selftests/efivarfs/create-read.c | 2 ++ 1 file changed, 2 insertions(+)
tools/testing/selftests/efivarfs/create-read.c +2 -0
@@ -32,8 +32,10 @@ int main(int argc, char **argv) rc =read (fd, buf,sizeof (buf));if (rc !=0 ) {fprintf (stderr,"Reading a new var should return EOF\n" ); +close (fd);return EXIT_FAILURE ; } +close (fd);return EXIT_SUCCESS ; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 55/372 ASoC: soc-card: Add storage for PCI SSID
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
[ Upstream commit 47f56e38a199bd45514b8e0142399cba4feeaf1a ]
Add members to struct snd_soc_card to store the PCI subsystem ID (SSID) of the soundcard.
The PCI specification provides two registers to store a vendor-specific SSID that can be read by drivers to uniquely identify a particular "soundcard". This is defined in the PCI specification to distinguish products that use the same silicon (and therefore have the same silicon ID) so that product-specific differences can be applied.
PCI only defines 0xFFFF as an invalid value. 0x0000 is not defined as invalid. So the usual pattern of zero-filling the struct and then assuming a zero value unset will not work. A flag is included to indicate when the SSID information has been filled in.
Unlike DMI information, which has a free-format entirely up to the vendor, the PCI SSID has a strictly defined format and a registry of vendor IDs.
It is usual in Windows drivers that the SSID is used as the sole identifier of the specific end-product and the Windows driver contains tables mapping that to information about the hardware setup, rather than using ACPI properties.
This SSID is important information for ASoC components that need to apply hardware-specific configuration on PCI-based systems.
As the SSID is a generic part of the PCI specification and is treated as identifying the "soundcard", it is reasonable to include this information in struct snd_soc_card, instead of components inventing their own custom ways to pass this information around.
--- include/sound/soc-card.h | 37 +++++++++++++++++++++++++++++++++++++ include/sound/soc.h | 11 +++++++++++ 2 files changed, 48 insertions(+)
include/sound/soc-card.h +37 -0
@@ -44,6 +44,43 @@ int snd_soc_card_add_dai_link(struct snd_soc_card *card,void snd_soc_card_remove_dai_link (struct snd_soc_card *card,struct snd_soc_dai_link *dai_link); +#ifdef CONFIG_PCI +static inline void snd_soc_card_set_pci_ssid (struct snd_soc_card *card, +unsigned short vendor, +unsigned short device) +{ + card->pci_subsystem_vendor = vendor; + card->pci_subsystem_device = device; + card->pci_subsystem_set = true; +} + +static inline int snd_soc_card_get_pci_ssid (struct snd_soc_card *card, +unsigned short *vendor, +unsigned short *device) +{ +if (!card->pci_subsystem_set) +return -ENOENT ; + + *vendor = card->pci_subsystem_vendor; + *device = card->pci_subsystem_device; + +return 0 ; +} +#else /* !CONFIG_PCI */ +static inline void snd_soc_card_set_pci_ssid (struct snd_soc_card *card, +unsigned short vendor, +unsigned short device) +{ +} + +static inline int snd_soc_card_get_pci_ssid (struct snd_soc_card *card, +unsigned short *vendor, +unsigned short *device) +{ +return -ENOENT ; +} +#endif /* CONFIG_PCI */ +/* device driver data */ static inline void snd_soc_card_set_drvdata (struct snd_soc_card *card,void *data)
include/sound/soc.h +11 -0
@@ -911,6 +911,17 @@ struct snd_soc_card {#ifdef CONFIG_DMI char dmi_longname[80 ];#endif /* CONFIG_DMI */ + +#ifdef CONFIG_PCI +/* +* PCI does not define 0 as invalid, so pci_subsystem_set indicates +* whether a value has been written to these fields. +*/ +unsigned short pci_subsystem_vendor; +unsigned short pci_subsystem_device; +bool pci_subsystem_set; +#endif /* CONFIG_PCI */ +char topology_shortname[32 ];struct device *dev;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 56/372 ASoC: SOF: Pass PCI SSID to machine driver
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <[email protected]>
[ Upstream commit ba2de401d32625fe538d3f2c00ca73740dd2d516 ]
Pass the PCI SSID of the audio interface through to the machine driver. This allows the machine driver to use the SSID to uniquely identify the specific hardware configuration and apply any platform-specific configuration.
struct snd_sof_pdata is passed around inside the SOF code, but it then passes configuration information to the machine driver through struct snd_soc_acpi_mach and struct snd_soc_acpi_mach_params. So SSID information has been added to both snd_sof_pdata and snd_soc_acpi_mach_params.
PCI does not define 0x0000 as an invalid value so we can't use zero to indicate that the struct member was not written. Instead a flag is included to indicate that a value has been written to the subsystem_vendor and subsystem_device members.
sof_pci_probe() creates the struct snd_sof_pdata. It is passed a struct pci_dev so it can fill in the SSID value.
sof_machine_check() finds the appropriate struct snd_soc_acpi_mach. It copies the SSID information across to the struct snd_soc_acpi_mach_params. This done before calling any custom set_mach_params() so that it could be used by the set_mach_params() callback to apply variant params.
The machine driver receives the struct snd_soc_acpi_mach as its platform_data.
--- include/sound/soc-acpi.h | 7 +++++++ include/sound/sof.h | 8 ++++++++ sound/soc/sof/sof-audio.c | 7 +++++++ sound/soc/sof/sof-pci-dev.c | 8 ++++++++ 4 files changed, 30 insertions(+)
include/sound/soc-acpi.h +7 -0
@@ -67,6 +67,10 @@ static inline struct snd_soc_acpi_mach *snd_soc_acpi_codec_list(void *arg)* @i2s_link_mask: I2S/TDM links enabled on the board * @num_dai_drivers: number of elements in @dai_drivers * @dai_drivers: pointer to dai_drivers, used e.g. in nocodec mode +* @subsystem_vendor: optional PCI SSID vendor value +* @subsystem_device: optional PCI SSID device value +* @subsystem_id_set: true if a value has been written to +* subsystem_vendor and subsystem_device. */ struct snd_soc_acpi_mach_params {u32 acpi_ipc_irq_index;
@@ -79,6 +83,9 @@ struct snd_soc_acpi_mach_params {u32 i2s_link_mask;u32 num_dai_drivers;struct snd_soc_dai_driver *dai_drivers; +unsigned short subsystem_vendor; +unsigned short subsystem_device; +bool subsystem_id_set; };/**
include/sound/sof.h +8 -0
@@ -63,6 +63,14 @@ struct snd_sof_pdata {const char *name;const char *platform; +/* +* PCI SSID. As PCI does not define 0 as invalid, the subsystem_id_set +* flag indicates that a value has been written to these members. +*/ +unsigned short subsystem_vendor; +unsigned short subsystem_device; +bool subsystem_id_set; +struct device *dev;/* indicate how many first bytes shouldn't be loaded into DSP memory. */
sound/soc/sof/sof-audio.c +7 -0
@@ -832,6 +832,13 @@ int sof_machine_check(struct snd_sof_dev *sdev) mach =snd_sof_machine_select (sdev);if (mach) { sof_pdata->machine = mach; + +if (sof_pdata->subsystem_id_set) { + mach->mach_params.subsystem_vendor = sof_pdata->subsystem_vendor; + mach->mach_params.subsystem_device = sof_pdata->subsystem_device; + mach->mach_params.subsystem_id_set = true; + } +snd_sof_set_mach_params (mach, sdev);return 0 ; }
sound/soc/sof/sof-pci-dev.c +8 -0
@@ -217,6 +217,14 @@ int sof_pci_probe(struct pci_dev *pci, const struct pci_device_id *pci_id)return ret; sof_pdata->name =pci_name (pci); + +/* PCI defines a vendor ID of 0xFFFF as invalid. */ +if (pci->subsystem_vendor !=0xFFFF ) { + sof_pdata->subsystem_vendor = pci->subsystem_vendor; + sof_pdata->subsystem_device = pci->subsystem_device; + sof_pdata->subsystem_id_set = true; + } + sof_pdata->desc = desc; sof_pdata->dev = dev;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 57/372 crypto: pcrypt - Fix hungtask for PADATA_RESET
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Jialin <[email protected]>
[ Upstream commit 8f4f68e788c3a7a696546291258bfa5fdb215523 ]
We found a hungtask bug in test_aead_vec_cfg as follows:
INFO: task cryptomgr_test:391009 blocked for more than 120 seconds. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. Call trace: __switch_to+0x98/0xe0 __schedule+0x6c4/0xf40 schedule+0xd8/0x1b4 schedule_timeout+0x474/0x560 wait_for_common+0x368/0x4e0 wait_for_completion+0x20/0x30 wait_for_completion+0x20/0x30 test_aead_vec_cfg+0xab4/0xd50 test_aead+0x144/0x1f0 alg_test_aead+0xd8/0x1e0 alg_test+0x634/0x890 cryptomgr_test+0x40/0x70 kthread+0x1e0/0x220 ret_from_fork+0x10/0x18 Kernel panic - not syncing: hung_task: blocked tasks
For padata_do_parallel, when the return err is 0 or -EBUSY, it will call wait_for_completion(&wait->completion) in test_aead_vec_cfg. In normal case, aead_request_complete() will be called in pcrypt_aead_serial and the return err is 0 for padata_do_parallel. But, when pinst->flags is PADATA_RESET, the return err is -EBUSY for padata_do_parallel, and it won't call aead_request_complete(). Therefore, test_aead_vec_cfg will hung at wait_for_completion(&wait->completion), which will cause hungtask.
The problem comes as following:
(padata_do_parallel) |
rcu_read_lock_bh(); |
err = -EINVAL; | (padata_replace)
| pinst->flags |= PADATA_RESET;
err = -EBUSY |
if (pinst->flags & PADATA_RESET) |
rcu_read_unlock_bh() |return err
In order to resolve the problem, we replace the return err -EBUSY with -EAGAIN, which means parallel_data is changing, and the caller should call it again.
v3:
remove retry and just change the return err.
v2:
introduce padata_try_do_parallel() in pcrypt_aead_encrypt and pcrypt_aead_decrypt to solve the hungtask.
--- crypto/pcrypt.c | 4 ++++ kernel/padata.c | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-)
crypto/pcrypt.c +4 -0
@@ -117,6 +117,8 @@ static int pcrypt_aead_encrypt(struct aead_request *req) err =padata_do_parallel (ictx->psenc, padata, &ctx->cb_cpu);if (!err)return -EINPROGRESS ; +if (err == -EBUSY ) +return -EAGAIN ;return err; }
@@ -164,6 +166,8 @@ static int pcrypt_aead_decrypt(struct aead_request *req) err =padata_do_parallel (ictx->psdec, padata, &ctx->cb_cpu);if (!err)return -EINPROGRESS ; +if (err == -EBUSY ) +return -EAGAIN ;return err; }
kernel/padata.c +1 -1
@@ -194,7 +194,7 @@ int padata_do_parallel(struct padata_shell *ps, *cb_cpu = cpu; } - err = -EBUSY ; + err = -EBUSY ;if ((pinst->flags &PADATA_RESET )) goto out;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 58/372 ALSA: scarlett2: Move USB IDs out from device_info struct
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geoffrey D. Bennett <[email protected]>
[ Upstream commit d98cc489029dba4d99714c2e8ec4f5ba249f6851 ]
By moving the USB IDs from the device_info struct into scarlett2_devices[], that will allow for devices with different USB IDs to share the same device_info.
--- sound/usb/mixer_scarlett_gen2.c | 63 ++++++++++++--------------------- 1 file changed, 23 insertions(+), 40 deletions(-)
sound/usb/mixer_scarlett_gen2.c +23 -40
@@ -317,8 +317,6 @@ struct scarlett2_mux_entry { };struct scarlett2_device_info { -u32 usb_id;/* USB device identifier */ -/* Gen 3 devices have an internal MSD mode switch that needs * to be disabled in order to access the full functionality of * the device.
@@ -440,8 +438,6 @@ struct scarlett2_data {/*** Model-specific data ***/ static const struct scarlett2_device_info s6i6_gen2_info = { - .usb_id =USB_ID (0x1235 ,0x8203 ), - .config_set =SCARLETT2_CONFIG_SET_GEN_2 , .level_input_count =2 , .pad_input_count =2 ,
@@ -486,8 +482,6 @@ static const struct scarlett2_device_info s6i6_gen2_info = { };static const struct scarlett2_device_info s18i8_gen2_info = { - .usb_id =USB_ID (0x1235 ,0x8204 ), - .config_set =SCARLETT2_CONFIG_SET_GEN_2 , .level_input_count =2 , .pad_input_count =4 ,
@@ -535,8 +529,6 @@ static const struct scarlett2_device_info s18i8_gen2_info = { };static const struct scarlett2_device_info s18i20_gen2_info = { - .usb_id =USB_ID (0x1235 ,0x8201 ), - .config_set =SCARLETT2_CONFIG_SET_GEN_2 , .line_out_hw_vol =1 ,
@@ -589,8 +581,6 @@ static const struct scarlett2_device_info s18i20_gen2_info = { };static const struct scarlett2_device_info solo_gen3_info = { - .usb_id =USB_ID (0x1235 ,0x8211 ), - .has_msd_mode =1 , .config_set =SCARLETT2_CONFIG_SET_NO_MIXER , .level_input_count =1 ,
@@ -602,8 +592,6 @@ static const struct scarlett2_device_info solo_gen3_info = { };static const struct scarlett2_device_info s2i2_gen3_info = { - .usb_id =USB_ID (0x1235 ,0x8210 ), - .has_msd_mode =1 , .config_set =SCARLETT2_CONFIG_SET_NO_MIXER , .level_input_count =2 ,
@@ -614,8 +602,6 @@ static const struct scarlett2_device_info s2i2_gen3_info = { };static const struct scarlett2_device_info s4i4_gen3_info = { - .usb_id =USB_ID (0x1235 ,0x8212 ), - .has_msd_mode =1 , .config_set =SCARLETT2_CONFIG_SET_GEN_3 , .level_input_count =2 ,
@@ -660,8 +646,6 @@ static const struct scarlett2_device_info s4i4_gen3_info = { };static const struct scarlett2_device_info s8i6_gen3_info = { - .usb_id =USB_ID (0x1235 ,0x8213 ), - .has_msd_mode =1 , .config_set =SCARLETT2_CONFIG_SET_GEN_3 , .level_input_count =2 ,
@@ -713,8 +697,6 @@ static const struct scarlett2_device_info s8i6_gen3_info = { };static const struct scarlett2_device_info s18i8_gen3_info = { - .usb_id =USB_ID (0x1235 ,0x8214 ), - .has_msd_mode =1 , .config_set =SCARLETT2_CONFIG_SET_GEN_3 , .line_out_hw_vol =1 ,
@@ -783,8 +765,6 @@ static const struct scarlett2_device_info s18i8_gen3_info = { };static const struct scarlett2_device_info s18i20_gen3_info = { - .usb_id =USB_ID (0x1235 ,0x8215 ), - .has_msd_mode =1 , .config_set =SCARLETT2_CONFIG_SET_GEN_3 , .line_out_hw_vol =1 ,
@@ -848,8 +828,6 @@ static const struct scarlett2_device_info s18i20_gen3_info = { };static const struct scarlett2_device_info clarett_8pre_info = { - .usb_id =USB_ID (0x1235 ,0x820c ), - .config_set =SCARLETT2_CONFIG_SET_CLARETT , .line_out_hw_vol =1 , .level_input_count =2 ,
@@ -902,25 +880,30 @@ static const struct scarlett2_device_info clarett_8pre_info = { } }, }; -static const struct scarlett2_device_info *scarlett2_devices[] = { +struct scarlett2_device_entry { +const u32 usb_id;/* USB device identifier */ +const struct scarlett2_device_info *info; +}; + +static const struct scarlett2_device_entry scarlett2_devices[] = {/* Supported Gen 2 devices */ - &s6i6_gen2_info, - &s18i8_gen2_info, - &s18i20_gen2_info, + {USB_ID (0x1235 ,0x8203 ), &s6i6_gen2_info }, + {USB_ID (0x1235 ,0x8204 ), &s18i8_gen2_info }, + {USB_ID (0x1235 ,0x8201 ), &s18i20_gen2_info },/* Supported Gen 3 devices */ - &solo_gen3_info, - &s2i2_gen3_info, - &s4i4_gen3_info, - &s8i6_gen3_info, - &s18i8_gen3_info, - &s18i20_gen3_info, + {USB_ID (0x1235 ,0x8211 ), &solo_gen3_info }, + {USB_ID (0x1235 ,0x8210 ), &s2i2_gen3_info }, + {USB_ID (0x1235 ,0x8212 ), &s4i4_gen3_info }, + {USB_ID (0x1235 ,0x8213 ), &s8i6_gen3_info }, + {USB_ID (0x1235 ,0x8214 ), &s18i8_gen3_info }, + {USB_ID (0x1235 ,0x8215 ), &s18i20_gen3_info },/* Supported Clarett+ devices */ - &clarett_8pre_info, + {USB_ID (0x1235 ,0x820c ), &clarett_8pre_info },/* End of list */ -NULL + {0 ,NULL }, };/* get the starting port index number for a given port type/direction */
@@ -4072,17 +4055,17 @@ static int scarlett2_init_notify(struct usb_mixer_interface *mixer)static int snd_scarlett_gen2_controls_create (struct usb_mixer_interface *mixer) { -const struct scarlett2_device_info **info = scarlett2_devices; +const struct scarlett2_device_entry *entry = scarlett2_devices;int err; -/* Find device in scarlett2_devices */ -while (*info && (*info)->usb_id != mixer->chip->usb_id) - info++; -if (!*info) +/* Find entry in scarlett2_devices */ +while (entry->usb_id && entry->usb_id != mixer->chip->usb_id) + entry++; +if (!entry->usb_id)return -EINVAL ;/* Initialise private data */ - err =scarlett2_init_private (mixer, *info); + err =scarlett2_init_private (mixer, entry->info);if (err <0 )return err;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 59/372 ASoC: SOF: ipc4: handle EXCEPTION_CAUGHT notification from firmware
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rander Wang <[email protected]>
[ Upstream commit c1c48fd6bbe788458e3685fea74bdb3cb148ff93 ]
Driver will receive exception IPC message and process it by snd_sof_dsp_panic.
--- sound/soc/sof/ipc4.c | 3 +++ 1 file changed, 3 insertions(+)
sound/soc/sof/ipc4.c +3 -0
@@ -601,6 +601,9 @@ static void sof_ipc4_rx_msg(struct snd_sof_dev *sdev)case SOF_IPC4_NOTIFY_LOG_BUFFER_STATUS :sof_ipc4_mtrace_update_pos (sdev,SOF_IPC4_LOG_CORE_GET (ipc4_msg->primary));break ; +case SOF_IPC4_NOTIFY_EXCEPTION_CAUGHT : +snd_sof_dsp_panic (sdev,0 , true); +break ;default :dev_dbg (sdev->dev,"Unhandled DSP message: %#x|%#x\n" , ipc4_msg->primary, ipc4_msg->extension);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 60/372 RDMA/hfi1: Use FIELD_GET() to extract Link Width
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 8bf7187d978610b9e327a3d92728c8864a575ebd ]
Use FIELD_GET() to extract PCIe Negotiated Link Width field instead of custom masking and shifting, and remove extract_width() which only wraps that FIELD_GET().
--- drivers/infiniband/hw/hfi1/pcie.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-)
drivers/infiniband/hw/hfi1/pcie.c +2 -7
@@ -3,6 +3,7 @@* Copyright(c) 2015 - 2019 Intel Corporation. */ +#include <linux/bitfield.h> #include <linux/pci.h> #include <linux/io.h> #include <linux/delay.h>
@@ -212,12 +213,6 @@ static u32 extract_speed(u16 linkstat)return speed; } -/* return the PCIe link speed from the given link status */ -static u32 extract_width (u16 linkstat) -{ -return (linkstat &PCI_EXP_LNKSTA_NLW ) >>PCI_EXP_LNKSTA_NLW_SHIFT ; -} -/* read the link status and set dd->{lbus_width,lbus_speed,lbus_info} */ static void update_lbus_info (struct hfi1_devdata *dd) {
@@ -230,7 +225,7 @@ static void update_lbus_info(struct hfi1_devdata *dd)return ; } - dd->lbus_width =extract_width (linkstat); + dd->lbus_width =FIELD_GET (PCI_EXP_LNKSTA_NLW , linkstat); dd->lbus_speed =extract_speed (linkstat);snprintf (dd->lbus_info,sizeof (dd->lbus_info),"PCIe,%uMHz,x%u" , dd->lbus_speed, dd->lbus_width);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 61/372 scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yihang Li <[email protected]>
[ Upstream commit 6de426f9276c448e2db7238911c97fb157cb23be ]
If init debugfs failed during device registration due to memory allocation failure, debugfs_remove_recursive() is called, after which debugfs_dir is not set to NULL. debugfs_remove_recursive() will be called again during device removal. As a result, illegal pointer is accessed.
[ 1665.467244] hisi_sas_v3_hw 0000:b4:02.0: failed to init debugfs! ... [ 1669.836708] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a0 [ 1669.872669] pc : down_write+0x24/0x70 [ 1669.876315] lr : down_write+0x1c/0x70 [ 1669.879961] sp : ffff000036f53a30 [ 1669.883260] x29: ffff000036f53a30 x28: ffffa027c31549f8 [ 1669.888547] x27: ffffa027c3140000 x26: 0000000000000000 [ 1669.893834] x25: ffffa027bf37c270 x24: ffffa027bf37c270 [ 1669.899122] x23: ffff0000095406b8 x22: ffff0000095406a8 [ 1669.904408] x21: 0000000000000000 x20: ffffa027bf37c310 [ 1669.909695] x19: 00000000000000a0 x18: ffff8027dcd86f10 [ 1669.914982] x17: 0000000000000000 x16: 0000000000000000 [ 1669.920268] x15: 0000000000000000 x14: ffffa0274014f870 [ 1669.925555] x13: 0000000000000040 x12: 0000000000000228 [ 1669.930842] x11: 0000000000000020 x10: 0000000000000bb0 [ 1669.936129] x9 : ffff000036f537f0 x8 : ffff80273088ca10 [ 1669.941416] x7 : 000000000000001d x6 : 00000000ffffffff [ 1669.946702] x5 : ffff000008a36310 x4 : ffff80273088be00 [ 1669.951989] x3 : ffff000009513e90 x2 : 0000000000000000 [ 1669.957276] x1 : 00000000000000a0 x0 : ffffffff00000001 [ 1669.962563] Call trace: [ 1669.965000] down_write+0x24/0x70 [ 1669.968301] debugfs_remove_recursive+0x5c/0x1b0 [ 1669.972905] hisi_sas_debugfs_exit+0x24/0x30 [hisi_sas_main] [ 1669.978541] hisi_sas_v3_remove+0x130/0x150 [hisi_sas_v3_hw] [ 1669.984175] pci_device_remove+0x48/0xd8 [ 1669.988082] device_release_driver_internal+0x1b4/0x250 [ 1669.993282] device_release_driver+0x28/0x38 [ 1669.997534] pci_stop_bus_device+0x84/0xb8 [ 1670.001611] pci_stop_and_remove_bus_device_locked+0x24/0x40 [ 1670.007244] remove_store+0xfc/0x140 [ 1670.010802] dev_attr_store+0x44/0x60 [ 1670.014448] sysfs_kf_write+0x58/0x80 [ 1670.018095] kernfs_fop_write+0xe8/0x1f0 [ 1670.022000] __vfs_write+0x60/0x190 [ 1670.025472] vfs_write+0xac/0x1c0 [ 1670.028771] ksys_write+0x6c/0xd8 [ 1670.032071] __arm64_sys_write+0x24/0x30 [ 1670.035977] el0_svc_common+0x78/0x130 [ 1670.039710] el0_svc_handler+0x38/0x78 [ 1670.043442] el0_svc+0x8/0xc
To fix this, set debugfs_dir to NULL after debugfs_remove_recursive().
--- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +7 -6
@@ -4717,6 +4717,12 @@ static void debugfs_bist_init_v3_hw(struct hisi_hba *hisi_hba) hisi_hba->debugfs_bist_linkrate =SAS_LINK_RATE_1_5_GBPS ; } +static void debugfs_exit_v3_hw (struct hisi_hba *hisi_hba) +{ +debugfs_remove_recursive (hisi_hba->debugfs_dir); + hisi_hba->debugfs_dir =NULL ; +} +static void debugfs_init_v3_hw (struct hisi_hba *hisi_hba) {struct device *dev = hisi_hba->dev;
@@ -4740,18 +4746,13 @@ static void debugfs_init_v3_hw(struct hisi_hba *hisi_hba)for (i =0 ; i < hisi_sas_debugfs_dump_count; i++) {if (debugfs_alloc_v3_hw (hisi_hba, i)) { -debugfs_remove_recursive (hisi_hba->debugfs_dir); +debugfs_exit_v3_hw (hisi_hba);dev_dbg (dev,"failed to init debugfs!\n" );break ; } } } -static void debugfs_exit_v3_hw (struct hisi_hba *hisi_hba) -{ -debugfs_remove_recursive (hisi_hba->debugfs_dir); -} -static int hisi_sas_v3_probe (struct pci_dev *pdev,const struct pci_device_id *id) {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 62/372 scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tyrel Datwyler <[email protected]>
[ Upstream commit b39f2d10b86d0af353ea339e5815820026bca48f ]
In practice the driver should never send more commands than are allocated to a queue's event pool. In the unlikely event that this happens, the code asserts a BUG_ON, and in the case that the kernel is not configured to crash on panic returns a junk event pointer from the empty event list causing things to spiral from there. This BUG_ON is a historical artifact of the ibmvfc driver first being upstreamed, and it is well known now that the use of BUG_ON is bad practice except in the most unrecoverable scenario. There is nothing about this scenario that prevents the driver from recovering and carrying on.
Remove the BUG_ON in question from ibmvfc_get_event() and return a NULL pointer in the case of an empty event pool. Update all call sites to ibmvfc_get_event() to check for a NULL pointer and perfrom the appropriate failure or recovery action.
--- drivers/scsi/ibmvscsi/ibmvfc.c | 124 ++++++++++++++++++++++++++++++++- 1 file changed, 122 insertions(+), 2 deletions(-)
drivers/scsi/ibmvscsi/ibmvfc.c +122 -2
@@ -1518,7 +1518,11 @@ static struct ibmvfc_event *ibmvfc_get_event(struct ibmvfc_queue *queue)unsigned long flags;spin_lock_irqsave (&queue->l_lock, flags); -BUG_ON (list_empty (&queue->free)); +if (list_empty (&queue->free)) { +ibmvfc_log (queue->vhost,4 ,"empty event pool on queue:%ld\n" , queue->hwq_id); +spin_unlock_irqrestore (&queue->l_lock, flags); +return NULL ; + } evt = list_entry(queue->free.next, struct ibmvfc_event, queue_list);atomic_set (&evt->free,0 );list_del (&evt->queue_list);
@@ -1947,9 +1951,15 @@ static int ibmvfc_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *cmnd)if (vhost->using_channels) { scsi_channel = hwq % vhost->scsi_scrqs.active_queues; evt =ibmvfc_get_event (&vhost->scsi_scrqs.scrqs[scsi_channel]); +if (!evt) +return SCSI_MLQUEUE_HOST_BUSY ; + evt->hwq = hwq % vhost->scsi_scrqs.active_queues; - }else + }else { evt =ibmvfc_get_event (&vhost->crq); +if (!evt) +return SCSI_MLQUEUE_HOST_BUSY ; + }ibmvfc_init_event (evt, ibmvfc_scsi_done,IBMVFC_CMD_FORMAT ); evt->cmnd = cmnd;
@@ -2037,6 +2047,11 @@ static int ibmvfc_bsg_timeout(struct bsg_job *job) vhost->aborting_passthru =1 ; evt =ibmvfc_get_event (&vhost->crq); +if (!evt) { +spin_unlock_irqrestore (vhost->host->host_lock, flags); +return -ENOMEM ; + } +ibmvfc_init_event (evt, ibmvfc_bsg_timeout_done,IBMVFC_MAD_FORMAT ); tmf = &evt->iu.tmf;
@@ -2095,6 +2110,10 @@ static int ibmvfc_bsg_plogi(struct ibmvfc_host *vhost, unsigned int port_id) goto unlock_out; evt =ibmvfc_get_event (&vhost->crq); +if (!evt) { + rc = -ENOMEM ; + goto unlock_out; + }ibmvfc_init_event (evt, ibmvfc_sync_completion,IBMVFC_MAD_FORMAT ); plogi = &evt->iu.plogi;memset (plogi,0 ,sizeof (*plogi));
@@ -2213,6 +2232,11 @@ static int ibmvfc_bsg_request(struct bsg_job *job) } evt =ibmvfc_get_event (&vhost->crq); +if (!evt) { +spin_unlock_irqrestore (vhost->host->host_lock, flags); + rc = -ENOMEM ; + goto out; + }ibmvfc_init_event (evt, ibmvfc_sync_completion,IBMVFC_MAD_FORMAT ); mad = &evt->iu.passthru;
@@ -2301,6 +2325,11 @@ static int ibmvfc_reset_device(struct scsi_device *sdev, int type, char *desc)else evt =ibmvfc_get_event (&vhost->crq); +if (!evt) { +spin_unlock_irqrestore (vhost->host->host_lock, flags); +return -ENOMEM ; + } +ibmvfc_init_event (evt, ibmvfc_sync_completion,IBMVFC_CMD_FORMAT ); tmf =ibmvfc_init_vfc_cmd (evt, sdev); iu =ibmvfc_get_fcp_iu (vhost, tmf);
@@ -2504,6 +2533,8 @@ static struct ibmvfc_event *ibmvfc_init_tmf(struct ibmvfc_queue *queue,struct ibmvfc_tmf *tmf; evt =ibmvfc_get_event (queue); +if (!evt) +return NULL ;ibmvfc_init_event (evt, ibmvfc_sync_completion,IBMVFC_MAD_FORMAT ); tmf = &evt->iu.tmf;
@@ -2560,6 +2591,11 @@ static int ibmvfc_cancel_all_mq(struct scsi_device *sdev, int type)if (found_evt && vhost->logged_in) { evt =ibmvfc_init_tmf (&queues[i], sdev, type); +if (!evt) { +spin_unlock (queues[i].q_lock); +spin_unlock_irqrestore (vhost->host->host_lock, flags); +return -ENOMEM ; + } evt->sync_iu = &queues[i].cancel_rsp;ibmvfc_send_event (evt, vhost, default_timeout);list_add_tail (&evt->cancel, &cancelq);
@@ -2773,6 +2809,10 @@ static int ibmvfc_abort_task_set(struct scsi_device *sdev)if (vhost->state ==IBMVFC_ACTIVE ) { evt =ibmvfc_get_event (&vhost->crq); +if (!evt) { +spin_unlock_irqrestore (vhost->host->host_lock, flags); +return -ENOMEM ; + }ibmvfc_init_event (evt, ibmvfc_sync_completion,IBMVFC_CMD_FORMAT ); tmf =ibmvfc_init_vfc_cmd (evt, sdev); iu =ibmvfc_get_fcp_iu (vhost, tmf);
@@ -4031,6 +4071,12 @@ static void ibmvfc_tgt_send_prli(struct ibmvfc_target *tgt)kref_get (&tgt->kref); evt =ibmvfc_get_event (&vhost->crq); +if (!evt) { +ibmvfc_set_tgt_action (tgt,IBMVFC_TGT_ACTION_NONE ); +kref_put (&tgt->kref, ibmvfc_release_tgt); +__ibmvfc_reset_host (vhost); +return ; + } vhost->discovery_threads++;ibmvfc_init_event (evt, ibmvfc_tgt_prli_done,IBMVFC_MAD_FORMAT ); evt->tgt = tgt;
@@ -4138,6 +4184,12 @@ static void ibmvfc_tgt_send_plogi(struct ibmvfc_target *tgt)kref_get (&tgt->kref); tgt->logo_rcvd =0 ; evt =ibmvfc_get_event (&vhost->crq); +if (!evt) { +ibmvfc_set_tgt_action (tgt,IBMVFC_TGT_ACTION_NONE ); +kref_put (&tgt->kref, ibmvfc_release_tgt); +__ibmvfc_reset_host (vhost); +return ; + } vhost->discovery_threads++;ibmvfc_set_tgt_action (tgt,IBMVFC_TGT_ACTION_INIT_WAIT );ibmvfc_init_event (evt, ibmvfc_tgt_plogi_done,IBMVFC_MAD_FORMAT );
@@ -4214,6 +4266,8 @@ static struct ibmvfc_event *__ibmvfc_tgt_get_implicit_logout_evt(struct ibmvfc_tkref_get (&tgt->kref); evt =ibmvfc_get_event (&vhost->crq); +if (!evt) +return NULL ;ibmvfc_init_event (evt, done,IBMVFC_MAD_FORMAT ); evt->tgt = tgt; mad = &evt->iu.implicit_logout;
@@ -4241,6 +4295,13 @@ static void ibmvfc_tgt_implicit_logout(struct ibmvfc_target *tgt) vhost->discovery_threads++; evt =__ibmvfc_tgt_get_implicit_logout_evt (tgt, ibmvfc_tgt_implicit_logout_done); +if (!evt) { + vhost->discovery_threads--; +ibmvfc_set_tgt_action (tgt,IBMVFC_TGT_ACTION_NONE ); +kref_put (&tgt->kref, ibmvfc_release_tgt); +__ibmvfc_reset_host (vhost); +return ; + }ibmvfc_set_tgt_action (tgt,IBMVFC_TGT_ACTION_INIT_WAIT );if (ibmvfc_send_event (evt, vhost, default_timeout)) {
@@ -4380,6 +4441,12 @@ static void ibmvfc_tgt_move_login(struct ibmvfc_target *tgt)kref_get (&tgt->kref); evt =ibmvfc_get_event (&vhost->crq); +if (!evt) { +ibmvfc_set_tgt_action (tgt,IBMVFC_TGT_ACTION_DEL_RPORT ); +kref_put (&tgt->kref, ibmvfc_release_tgt); +__ibmvfc_reset_host (vhost); +return ; + } vhost->discovery_threads++;ibmvfc_set_tgt_action (tgt,IBMVFC_TGT_ACTION_INIT_WAIT );ibmvfc_init_event (evt, ibmvfc_tgt_move_login_done,IBMVFC_MAD_FORMAT );
@@ -4546,6 +4613,14 @@ static void ibmvfc_adisc_timeout(struct timer_list *t) vhost->abort_threads++;kref_get (&tgt->kref); evt =ibmvfc_get_event (&vhost->crq); +if (!evt) { +tgt_err (tgt,"Failed to get cancel event for ADISC.\n" ); + vhost->abort_threads--; +kref_put (&tgt->kref, ibmvfc_release_tgt); +__ibmvfc_reset_host (vhost); +spin_unlock_irqrestore (vhost->host->host_lock, flags); +return ; + }ibmvfc_init_event (evt, ibmvfc_tgt_adisc_cancel_done,IBMVFC_MAD_FORMAT ); evt->tgt = tgt;
@@ -4596,6 +4671,12 @@ static void ibmvfc_tgt_adisc(struct ibmvfc_target *tgt)kref_get (&tgt->kref); evt =ibmvfc_get_event (&vhost->crq); +if (!evt) { +ibmvfc_set_tgt_action (tgt,IBMVFC_TGT_ACTION_NONE ); +kref_put (&tgt->kref, ibmvfc_release_tgt); +__ibmvfc_reset_host (vhost); +return ; + } vhost->discovery_threads++;ibmvfc_init_event (evt, ibmvfc_tgt_adisc_done,IBMVFC_MAD_FORMAT ); evt->tgt = tgt;
@@ -4699,6 +4780,12 @@ static void ibmvfc_tgt_query_target(struct ibmvfc_target *tgt)kref_get (&tgt->kref); evt =ibmvfc_get_event (&vhost->crq); +if (!evt) { +ibmvfc_set_tgt_action (tgt,IBMVFC_TGT_ACTION_NONE ); +kref_put (&tgt->kref, ibmvfc_release_tgt); +__ibmvfc_reset_host (vhost); +return ; + } vhost->discovery_threads++; evt->tgt = tgt;ibmvfc_init_event (evt, ibmvfc_tgt_query_target_done,IBMVFC_MAD_FORMAT );
@@ -4871,6 +4958,13 @@ static void ibmvfc_discover_targets(struct ibmvfc_host *vhost) {struct ibmvfc_discover_targets *mad;struct ibmvfc_event *evt =ibmvfc_get_event (&vhost->crq); +int level =IBMVFC_DEFAULT_LOG_LEVEL ; + +if (!evt) { +ibmvfc_log (vhost, level,"Discover Targets failed: no available events\n" ); +ibmvfc_hard_reset_host (vhost); +return ; + }ibmvfc_init_event (evt, ibmvfc_discover_targets_done,IBMVFC_MAD_FORMAT ); mad = &evt->iu.discover_targets;
@@ -4948,8 +5042,15 @@ static void ibmvfc_channel_setup(struct ibmvfc_host *vhost)struct ibmvfc_scsi_channels *scrqs = &vhost->scsi_scrqs;unsigned int num_channels =min (vhost->client_scsi_channels, vhost->max_vios_scsi_channels); +int level =IBMVFC_DEFAULT_LOG_LEVEL ;int i; +if (!evt) { +ibmvfc_log (vhost, level,"Channel Setup failed: no available events\n" ); +ibmvfc_hard_reset_host (vhost); +return ; + } +memset (setup_buf,0 ,sizeof (*setup_buf));if (num_channels ==0 ) setup_buf->flags =cpu_to_be32 (IBMVFC_CANCEL_CHANNELS );
@@ -5011,6 +5112,13 @@ static void ibmvfc_channel_enquiry(struct ibmvfc_host *vhost) {struct ibmvfc_channel_enquiry *mad;struct ibmvfc_event *evt =ibmvfc_get_event (&vhost->crq); +int level =IBMVFC_DEFAULT_LOG_LEVEL ; + +if (!evt) { +ibmvfc_log (vhost, level,"Channel Enquiry failed: no available events\n" ); +ibmvfc_hard_reset_host (vhost); +return ; + }ibmvfc_init_event (evt, ibmvfc_channel_enquiry_done,IBMVFC_MAD_FORMAT ); mad = &evt->iu.channel_enquiry;
@@ -5133,6 +5241,12 @@ static void ibmvfc_npiv_login(struct ibmvfc_host *vhost)struct ibmvfc_npiv_login_mad *mad;struct ibmvfc_event *evt =ibmvfc_get_event (&vhost->crq); +if (!evt) { +ibmvfc_dbg (vhost,"NPIV Login failed: no available events\n" ); +ibmvfc_hard_reset_host (vhost); +return ; + } +ibmvfc_gather_partition_info (vhost);ibmvfc_set_login_info (vhost);ibmvfc_init_event (evt, ibmvfc_npiv_login_done,IBMVFC_MAD_FORMAT );
@@ -5197,6 +5311,12 @@ static void ibmvfc_npiv_logout(struct ibmvfc_host *vhost)struct ibmvfc_event *evt; evt =ibmvfc_get_event (&vhost->crq); +if (!evt) { +ibmvfc_dbg (vhost,"NPIV Logout failed: no available events\n" ); +ibmvfc_hard_reset_host (vhost); +return ; + } +ibmvfc_init_event (evt, ibmvfc_npiv_logout_done,IBMVFC_MAD_FORMAT ); mad = &evt->iu.npiv_logout;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 63/372 fs/jfs: Add check for negative db_l2nbperpage
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juntong Deng <[email protected]>
[ Upstream commit 525b861a008143048535011f3816d407940f4bfa ]
l2nbperpage is log2(number of blks per page), and the minimum legal value should be 0, not negative.
In the case of l2nbperpage being negative, an error will occur when subsequently used as shift exponent.
Syzbot reported this bug:
UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:799:12
shift exponent -16777216 is negative
--- fs/jfs/jfs_dmap.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/jfs/jfs_dmap.c +2 -1
@@ -180,7 +180,8 @@ int dbMount(struct inode *ipbmap) bmp->db_nfree =le64_to_cpu (dbmp_le->dn_nfree); bmp->db_l2nbperpage =le32_to_cpu (dbmp_le->dn_l2nbperpage); -if (bmp->db_l2nbperpage >L2PSIZE -L2MINBLOCKSIZE ) { +if (bmp->db_l2nbperpage >L2PSIZE -L2MINBLOCKSIZE || + bmp->db_l2nbperpage <0 ) { err = -EINVAL ; goto err_release_metapage; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 64/372 fs/jfs: Add validity check for db_maxag and db_agpref
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juntong Deng <[email protected]>
[ Upstream commit 64933ab7b04881c6c18b21ff206c12278341c72e ]
Both db_maxag and db_agpref are used as the index of the db_agfree array, but there is currently no validity check for db_maxag and db_agpref, which can lead to errors.
The following is related bug reported by Syzbot:
UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:639:20
index 7936 is out of range for type 'atomic_t[128]'
Add checking that the values of db_maxag and db_agpref are valid indexes for the db_agfree array.
--- fs/jfs/jfs_dmap.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/jfs/jfs_dmap.c +6 -0
@@ -195,6 +195,12 @@ int dbMount(struct inode *ipbmap) bmp->db_maxlevel =le32_to_cpu (dbmp_le->dn_maxlevel); bmp->db_maxag =le32_to_cpu (dbmp_le->dn_maxag); bmp->db_agpref =le32_to_cpu (dbmp_le->dn_agpref); +if (bmp->db_maxag >=MAXAG || bmp->db_maxag <0 || + bmp->db_agpref >=MAXAG || bmp->db_agpref <0 ) { + err = -EINVAL ; + goto err_release_metapage; + } + bmp->db_aglevel =le32_to_cpu (dbmp_le->dn_aglevel); bmp->db_agheight =le32_to_cpu (dbmp_le->dn_agheight); bmp->db_agwidth =le32_to_cpu (dbmp_le->dn_agwidth);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 65/372 jfs: fix array-index-out-of-bounds in dbFindLeaf
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manas Ghandat <[email protected]>
[ Upstream commit 22cad8bc1d36547cdae0eef316c47d917ce3147c ]
Currently while searching for dmtree_t for sufficient free blocks there is an array out of bounds while getting element in tp->dm_stree. To add the required check for out of bound we first need to determine the type of dmtree. Thus added an extra parameter to dbFindLeaf so that the type of tree can be determined and the required check can be applied.
--- fs/jfs/jfs_dmap.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
fs/jfs/jfs_dmap.c +10 -4
@@ -87,7 +87,7 @@ static int dbAllocCtl(struct bmap * bmp, s64 nblocks, int l2nb, s64 blkno,static int dbExtend (struct inode *ip,s64 blkno,s64 nblocks,s64 addnblocks);static int dbFindBits (u32 word,int l2nb);static int dbFindCtl (struct bmap * bmp,int l2nb,int level,s64 * blkno); -static int dbFindLeaf (dmtree_t * tp,int l2nb,int *leafidx); +static int dbFindLeaf (dmtree_t *tp,int l2nb,int *leafidx,bool is_ctl);static int dbFreeBits (struct bmap * bmp,struct dmap * dp,s64 blkno,int nblocks); static int dbFreeDmap(struct bmap * bmp, struct dmap * dp, s64 blkno,
@@ -1717,7 +1717,7 @@ static int dbFindCtl(struct bmap * bmp, int l2nb, int level, s64 * blkno)* dbFindLeaf() returns the index of the leaf at which * free space was found. */ - rc =dbFindLeaf ((dmtree_t *) dcp, l2nb, &leafidx); + rc =dbFindLeaf ((dmtree_t *) dcp, l2nb, &leafidx, true);/* release the buffer. */
@@ -1964,7 +1964,7 @@ dbAllocDmapLev(struct bmap * bmp,* free space. if sufficient free space is found, dbFindLeaf() * returns the index of the leaf at which free space was found. */ -if (dbFindLeaf ((dmtree_t *) & dp->tree, l2nb, &leafidx)) +if (dbFindLeaf ((dmtree_t *) &dp->tree, l2nb, &leafidx, false))return -ENOSPC ;if (leafidx <0 )
@@ -2928,14 +2928,18 @@ static void dbAdjTree(dmtree_t * tp, int leafno, int newval)* leafidx - return pointer to be set to the index of the leaf * describing at least l2nb free blocks if sufficient * free blocks are found. +* is_ctl - determines if the tree is of type ctl * * RETURN VALUES: * 0 - success * -ENOSPC - insufficient free blocks. */ -static int dbFindLeaf (dmtree_t * tp,int l2nb,int *leafidx) +static int dbFindLeaf (dmtree_t *tp,int l2nb,int *leafidx,bool is_ctl) {int ti, n =0 , k, x =0 ; +int max_size; + + max_size = is_ctl ?CTLTREESIZE :TREESIZE ;/* first check the root of the tree to see if there is * sufficient free space.
@@ -2956,6 +2960,8 @@ static int dbFindLeaf(dmtree_t * tp, int l2nb, int *leafidx)/* sufficient free space found. move to the next * level (or quit if this is the last level). */ +if (x + n > max_size) +return -ENOSPC ;if (l2nb <= tp->dmt_stree[x + n])break ; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 66/372 jfs: fix array-index-out-of-bounds in diAlloc
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manas Ghandat <[email protected]>
[ Upstream commit 05d9ea1ceb62a55af6727a69269a4fd310edf483 ]
Currently there is not check against the agno of the iag while allocating new inodes to avoid fragmentation problem. Added the check which is required.
--- fs/jfs/jfs_imap.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/jfs/jfs_imap.c +4 -1
@@ -1320,7 +1320,7 @@ diInitInode(struct inode *ip, int iagno, int ino, int extno, struct iag * iagp)int diAlloc (struct inode *pip,bool dir,struct inode *ip) {int rc, ino, iagno, addext, extno, bitno, sword; -int nwords, rem, i, agno; +int nwords, rem, i, agno, dn_numag;u32 mask, inosmap, extsmap;struct inode *ipimap;struct metapage *mp;
@@ -1356,6 +1356,9 @@ int diAlloc(struct inode *pip, bool dir, struct inode *ip)/* get the ag number of this iag */ agno =BLKTOAG (JFS_IP (pip)->agstart,JFS_SBI (pip->i_sb)); + dn_numag =JFS_SBI (pip->i_sb)->bmap->db_numag; +if (agno <0 || agno > dn_numag) +return -EIO ;if (atomic_read (&JFS_SBI (pip->i_sb)->bmap->db_active[agno])) {/*
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 67/372 HID: lenovo: Detect quirk-free fw on cptkbd and stop applying workaround
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Khvainitski <[email protected]>
[ Upstream commit 46a0a2c96f0f47628190f122c2e3d879e590bcbe ]
Built-in firmware of cptkbd handles scrolling by itself (when middle button is pressed) but with issues: it does not support horizontal and hi-res scrolling and upon middle button release it sends middle button click even if there was a scrolling event. Commit 3cb5ff0220e3 ("HID:
lenovo: Hide middle-button press until release") workarounds last issue but it's impossible to workaround scrolling-related issues without firmware modification.
Likely, Dennis Schneider has reverse engineered the firmware and provided an instruction on how to patch it [1]. However, aforementioned workaround prevents userspace (libinput) from knowing exact moment when middle button has been pressed down and performing "On-Button scrolling". This commit detects correctly-behaving patched firmware if cursor movement events has been received during middle button being pressed and stops applying workaround for this device.
--- drivers/hid/hid-lenovo.c | 68 ++++++++++++++++++++++++++-------------- 1 file changed, 45 insertions(+), 23 deletions(-)
drivers/hid/hid-lenovo.c +45 -23
@@ -51,7 +51,12 @@ struct lenovo_drvdata {int select_right;int sensitivity;int press_speed; -u8 middlebutton_state;/* 0:Up, 1:Down (undecided), 2:Scrolling */ +/* 0: Up +* 1: Down (undecided) +* 2: Scrolling +* 3: Patched firmware, disable workaround +*/ +u8 middlebutton_state;bool fn_lock; };
@@ -668,31 +673,48 @@ static int lenovo_event_cptkbd(struct hid_device *hdev, {struct lenovo_drvdata *cptkbd_data =hid_get_drvdata (hdev); -/* "wheel" scroll events */ -if (usage->type ==EV_REL && (usage->code ==REL_WHEEL || - usage->code ==REL_HWHEEL )) { -/* Scroll events disable middle-click event */ - cptkbd_data->middlebutton_state =2 ; -return 0 ; - } +if (cptkbd_data->middlebutton_state !=3 ) { +/* REL_X and REL_Y events during middle button pressed +* are only possible on patched, bug-free firmware +* so set middlebutton_state to 3 +* to never apply workaround anymore +*/ +if (cptkbd_data->middlebutton_state ==1 && + usage->type ==EV_REL && + (usage->code ==REL_X || usage->code ==REL_Y )) { + cptkbd_data->middlebutton_state =3 ; +/* send middle button press which was hold before */ +input_event (field->hidinput->input, +EV_KEY ,BTN_MIDDLE ,1 ); +input_sync (field->hidinput->input); + } -/* Middle click events */ -if (usage->type ==EV_KEY && usage->code ==BTN_MIDDLE ) { -if (value ==1 ) { - cptkbd_data->middlebutton_state =1 ; - }else if (value ==0 ) { -if (cptkbd_data->middlebutton_state ==1 ) { -/* No scrolling inbetween, send middle-click */ -input_event (field->hidinput->input, -EV_KEY ,BTN_MIDDLE ,1 ); -input_sync (field->hidinput->input); -input_event (field->hidinput->input, -EV_KEY ,BTN_MIDDLE ,0 ); -input_sync (field->hidinput->input); +/* "wheel" scroll events */ +if (usage->type ==EV_REL && (usage->code ==REL_WHEEL || + usage->code ==REL_HWHEEL )) { +/* Scroll events disable middle-click event */ + cptkbd_data->middlebutton_state =2 ; +return 0 ; + } + +/* Middle click events */ +if (usage->type ==EV_KEY && usage->code ==BTN_MIDDLE ) { +if (value ==1 ) { + cptkbd_data->middlebutton_state =1 ; + }else if (value ==0 ) { +if (cptkbd_data->middlebutton_state ==1 ) { +/* No scrolling inbetween, send middle-click */ +input_event (field->hidinput->input, +EV_KEY ,BTN_MIDDLE ,1 ); +input_sync (field->hidinput->input); +input_event (field->hidinput->input, +EV_KEY ,BTN_MIDDLE ,0 ); +input_sync (field->hidinput->input); + } + cptkbd_data->middlebutton_state =0 ; } - cptkbd_data->middlebutton_state =0 ; +return 1 ; } -return 1 ; }if (usage->type ==EV_KEY && usage->code ==KEY_FN_ESC && value ==1 ) {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 68/372 ARM: 9320/1: fix stack depot IRQ stack filter
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Whitchurch <[email protected]>
[ Upstream commit b0150014878c32197cfa66e3e2f79e57f66babc0 ]
Place IRQ handlers such as gic_handle_irq() in the irqentry section even if FUNCTION_GRAPH_TRACER is not enabled. Without this, the stack depot's filter_irq_stacks() does not correctly filter out IRQ stacks in those configurations, which hampers deduplication and eventually leads to "Stack depot reached limit capacity" splats with KASAN.
A similar fix was done for arm64 in commit f6794950f0e5ba37e3bbed ("arm64: set __exception_irq_entry with __irq_entry as a default").
--- arch/arm/include/asm/exception.h | 4 ---- 1 file changed, 4 deletions(-)
arch/arm/include/asm/exception.h +0 -4
@@ -10,10 +10,6 @@#include <linux/interrupt.h> -#ifdef CONFIG_FUNCTION_GRAPH_TRACER #define __exception_irq_entry __irq_entry -#else -#define __exception_irq_entry -#endif #endif /* __ASM_ARM_EXCEPTION_H */
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 69/372 ALSA: hda: Fix possible null-ptr-deref when assigning a stream
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cezary Rojewski <[email protected]>
[ Upstream commit f93dc90c2e8ed664985e366aa6459ac83cdab236 ]
While AudioDSP drivers assign streams exclusively of HOST or LINK type, nothing blocks a user to attempt to assign a COUPLED stream. As supplied substream instance may be a stub, what is the case when code-loading, such scenario ends with null-ptr-deref.
--- sound/hda/hdac_stream.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
sound/hda/hdac_stream.c +4 -2
@@ -338,8 +338,10 @@ struct hdac_stream *snd_hdac_stream_assign(struct hdac_bus *bus,struct hdac_stream *res =NULL ;/* make a non-zero unique key for the substream */ -int key = (substream->pcm->device <<16 ) | (substream->number <<2 ) | - (substream->stream +1 ); +int key = (substream->number <<2 ) | (substream->stream +1 ); + +if (substream->pcm) + key |= (substream->pcm->device <<16 );spin_lock_irq (&bus->reg_lock);list_for_each_entry (azx_dev, &bus->stream_list, list) {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 70/372 PCI: tegra194: Use FIELD_GET()/FIELD_PREP() with Link Width fields
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 759574abd78e3b47ec45bbd31a64e8832cf73f97 ]
Use FIELD_GET() to extract PCIe Negotiated Link Width field instead of custom masking and shifting.
Similarly, change custom code that misleadingly used PCI_EXP_LNKSTA_NLW_SHIFT to prepare value for PCI_EXP_LNKCAP write to use FIELD_PREP() with correct field define (PCI_EXP_LNKCAP_MLW).
--- drivers/pci/controller/dwc/pcie-tegra194.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/pci/controller/dwc/pcie-tegra194.c +4 -5
@@ -9,6 +9,7 @@* Author: Vidya Sagar <[email protected]> */ +#include <linux/bitfield.h> #include <linux/clk.h> #include <linux/debugfs.h> #include <linux/delay.h>
@@ -324,8 +325,7 @@ static void apply_bad_link_workaround(struct dw_pcie_rp *pp)*/ val =dw_pcie_readw_dbi (pci, pcie->pcie_cap_base +PCI_EXP_LNKSTA );if (val &PCI_EXP_LNKSTA_LBMS ) { - current_link_width = (val &PCI_EXP_LNKSTA_NLW ) >> -PCI_EXP_LNKSTA_NLW_SHIFT ; + current_link_width =FIELD_GET (PCI_EXP_LNKSTA_NLW , val);if (pcie->init_link_width > current_link_width) {dev_warn (pci->dev,"PCIe link is bad, width reduced\n" ); val = dw_pcie_readw_dbi(pci, pcie->pcie_cap_base +
@@ -740,8 +740,7 @@ static void tegra_pcie_enable_system_interrupts(struct dw_pcie_rp *pp) val_w =dw_pcie_readw_dbi (&pcie->pci, pcie->pcie_cap_base +PCI_EXP_LNKSTA ); - pcie->init_link_width = (val_w &PCI_EXP_LNKSTA_NLW ) >> -PCI_EXP_LNKSTA_NLW_SHIFT ; + pcie->init_link_width =FIELD_GET (PCI_EXP_LNKSTA_NLW , val_w); val_w =dw_pcie_readw_dbi (&pcie->pci, pcie->pcie_cap_base +PCI_EXP_LNKCTL );
@@ -900,7 +899,7 @@ static int tegra_pcie_dw_host_init(struct dw_pcie_rp *pp)/* Configure Max lane width from DT */ val =dw_pcie_readl_dbi (pci, pcie->pcie_cap_base +PCI_EXP_LNKCAP ); val &= ~PCI_EXP_LNKCAP_MLW ; - val |= (pcie->num_lanes <<PCI_EXP_LNKSTA_NLW_SHIFT ); + val |=FIELD_PREP (PCI_EXP_LNKCAP_MLW , pcie->num_lanes);dw_pcie_writel_dbi (pci, pcie->pcie_cap_base +PCI_EXP_LNKCAP , val);/* Clear Slot Clock Configuration bit if SRNS configuration */
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 71/372 PCI: mvebu: Use FIELD_PREP() with Link Width
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit 408599ec561ad5862cda4f107626009f6fa97a74 ]
mvebu_pcie_setup_hw() setups the Maximum Link Width field in the Link Capabilities registers using an open-coded variant of FIELD_PREP() with a literal in shift. Improve readability by using FIELD_PREP(PCI_EXP_LNKCAP_MLW, ...).
--- drivers/pci/controller/pci-mvebu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/controller/pci-mvebu.c +1 -1
@@ -264,7 +264,7 @@ static void mvebu_pcie_setup_hw(struct mvebu_pcie_port *port)*/ lnkcap =mvebu_readl (port,PCIE_CAP_PCIEXP +PCI_EXP_LNKCAP ); lnkcap &= ~PCI_EXP_LNKCAP_MLW ; - lnkcap |= (port->is_x4 ?4 :1 ) <<4 ; + lnkcap |=FIELD_PREP (PCI_EXP_LNKCAP_MLW , port->is_x4 ?4 :1 );mvebu_writel (port, lnkcap,PCIE_CAP_PCIEXP +PCI_EXP_LNKCAP );/* Disable Root Bridge I/O space, memory space and bus mastering. */
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 72/372 atm: iphase: Do PCI error checks on own line
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit c28742447ca9879b52fbaf022ad844f0ffcd749c ]
In get_esi() PCI errors are checked inside line-split "if" conditions (in addition to the file not following the coding style). To make the code in get_esi() more readable, fix the coding style and use the usual error handling pattern with a separate variable.
In addition, initialization of 'error' variable at declaration is not needed.
No functional changes intended.
--- drivers/atm/iphase.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-)
drivers/atm/iphase.c +11 -9
@@ -2291,19 +2291,21 @@ static int get_esi(struct atm_dev *dev)static int reset_sar (struct atm_dev *dev) {IADEV *iadev; -int i, error =1 ; +int i, error;unsigned int pci[64 ]; iadev =INPH_IA_DEV (dev); -for (i=0 ; i<64 ; i++) -if ((error =pci_read_config_dword (iadev->pci, - i*4 , &pci[i])) !=PCIBIOS_SUCCESSFUL ) -return error; +for (i =0 ; i <64 ; i++) { + error =pci_read_config_dword (iadev->pci, i *4 , &pci[i]); +if (error !=PCIBIOS_SUCCESSFUL ) +return error; + }writel (0 , iadev->reg+IPHASE5575_EXT_RESET ); -for (i=0 ; i<64 ; i++) -if ((error =pci_write_config_dword (iadev->pci, - i*4 , pci[i])) !=PCIBIOS_SUCCESSFUL ) -return error; +for (i =0 ; i <64 ; i++) { + error =pci_write_config_dword (iadev->pci, i *4 , pci[i]); +if (error !=PCIBIOS_SUCCESSFUL ) +return error; + }udelay (5 );return 0 ; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 73/372 PCI: Do error check on own line to split long "if" conditions
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit d15f18053e5cc5576af9e7eef0b2a91169b6326d ]
Placing PCI error code check inside "if" condition usually results in need to split lines. Combined with additional conditions the "if" condition becomes messy.
Convert to the usual error handling pattern with an additional variable to improve code readability. In addition, reverse the logic in pci_find_vsec_capability() to get rid of &&.
No functional changes intended.
--- drivers/pci/pci.c | 9 ++++++--- drivers/pci/probe.c | 6 +++--- drivers/pci/quirks.c | 6 +++--- 3 files changed, 12 insertions(+), 9 deletions(-)
drivers/pci/pci.c +6 -3
@@ -717,15 +717,18 @@ u16 pci_find_vsec_capability(struct pci_dev *dev, u16 vendor, int cap) {u16 vsec =0 ;u32 header; +int ret;if (vendor != dev->vendor)return 0 ;while ((vsec =pci_find_next_ext_capability (dev, vsec,PCI_EXT_CAP_ID_VNDR ))) { -if (pci_read_config_dword (dev, vsec +PCI_VNDR_HEADER , - &header) ==PCIBIOS_SUCCESSFUL && -PCI_VNDR_HEADER_ID (header) == cap) + ret =pci_read_config_dword (dev, vsec +PCI_VNDR_HEADER , &header); +if (ret !=PCIBIOS_SUCCESSFUL ) +continue ; + +if (PCI_VNDR_HEADER_ID (header) == cap)return vsec; }
drivers/pci/probe.c +3 -3
@@ -1643,15 +1643,15 @@ static void pci_set_removable(struct pci_dev *dev)static bool pci_ext_cfg_is_aliased (struct pci_dev *dev) {#ifdef CONFIG_PCI_QUIRKS -int pos; +int pos, ret;u32 header, tmp;pci_read_config_dword (dev,PCI_VENDOR_ID , &header);for (pos =PCI_CFG_SPACE_SIZE ; pos <PCI_CFG_SPACE_EXP_SIZE ; pos +=PCI_CFG_SPACE_SIZE ) { -if (pci_read_config_dword (dev, pos, &tmp) !=PCIBIOS_SUCCESSFUL - || header != tmp) + ret =pci_read_config_dword (dev, pos, &tmp); +if ((ret !=PCIBIOS_SUCCESSFUL ) || (header != tmp))return false; }
drivers/pci/quirks.c +3 -3
@@ -5288,7 +5288,7 @@ int pci_dev_specific_disable_acs_redir(struct pci_dev *dev)*/ static void quirk_intel_qat_vf_cap (struct pci_dev *pdev) { -int pos, i =0 ; +int pos, i =0 , ret;u8 next_cap;u16 reg16, *cap;struct pci_cap_saved_state *state;
@@ -5334,8 +5334,8 @@ static void quirk_intel_qat_vf_cap(struct pci_dev *pdev) pdev->pcie_mpss = reg16 &PCI_EXP_DEVCAP_PAYLOAD ; pdev->cfg_size =PCI_CFG_SPACE_EXP_SIZE ; -if (pci_read_config_dword (pdev,PCI_CFG_SPACE_SIZE , &status) != -PCIBIOS_SUCCESSFUL || (status ==0xffffffff )) + ret =pci_read_config_dword (pdev,PCI_CFG_SPACE_SIZE , &status); +if ((ret !=PCIBIOS_SUCCESSFUL ) || (PCI_POSSIBLE_ERROR (status))) pdev->cfg_size =PCI_CFG_SPACE_SIZE ;if (pci_find_saved_cap (pdev,PCI_CAP_ID_EXP ))
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 74/372 scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenchao Hao <[email protected]>
[ Upstream commit 4df105f0ce9f6f30cda4e99f577150d23f0c9c5f ]
fc_lport_ptp_setup() did not check the return value of fc_rport_create() which can return NULL and would cause a NULL pointer dereference. Address this issue by checking return value of fc_rport_create() and log error message on fc_rport_create() failed.
--- drivers/scsi/libfc/fc_lport.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/scsi/libfc/fc_lport.c +6 -0
@@ -241,6 +241,12 @@ static void fc_lport_ptp_setup(struct fc_lport *lport, }mutex_lock (&lport->disc.disc_mutex); lport->ptp_rdata =fc_rport_create (lport, remote_fid); +if (!lport->ptp_rdata) { +printk (KERN_WARNING "libfc: Failed to setup lport 0x%x\n" , + lport->port_id); +mutex_unlock (&lport->disc.disc_mutex); +return ; + }kref_get (&lport->ptp_rdata->kref); lport->ptp_rdata->ids.port_name = remote_wwpn; lport->ptp_rdata->ids.node_name = remote_wwnn;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 75/372 PCI: Use FIELD_GET() to extract Link Width
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit d1f9b39da4a5347150246871325190018cda8cb3 ]
Use FIELD_GET() to extract PCIe Negotiated and Maximum Link Width fields instead of custom masking and shifting.
--- drivers/pci/pci-sysfs.c | 5 ++--- drivers/pci/pci.c | 5 ++--- 2 files changed, 4 insertions(+), 6 deletions(-)
drivers/pci/pci-sysfs.c +2 -3
@@ -12,7 +12,7 @@* Modeled after usb's driverfs.c */ - +#include <linux/bitfield.h> #include <linux/kernel.h> #include <linux/sched.h> #include <linux/pci.h>
@@ -230,8 +230,7 @@ static ssize_t current_link_width_show(struct device *dev,if (err)return -EINVAL ; -return sysfs_emit (buf,"%u\n" , - (linkstat &PCI_EXP_LNKSTA_NLW ) >>PCI_EXP_LNKSTA_NLW_SHIFT ); +return sysfs_emit (buf,"%u\n" ,FIELD_GET (PCI_EXP_LNKSTA_NLW , linkstat)); }static DEVICE_ATTR_RO (current_link_width);
drivers/pci/pci.c +2 -3
@@ -6138,8 +6138,7 @@ u32 pcie_bandwidth_available(struct pci_dev *dev, struct pci_dev **limiting_dev,pcie_capability_read_word (dev,PCI_EXP_LNKSTA , &lnksta); next_speed = pcie_link_speed[lnksta &PCI_EXP_LNKSTA_CLS ]; - next_width = (lnksta &PCI_EXP_LNKSTA_NLW ) >> -PCI_EXP_LNKSTA_NLW_SHIFT ; + next_width =FIELD_GET (PCI_EXP_LNKSTA_NLW , lnksta); next_bw = next_width *PCIE_SPEED2MBS_ENC (next_speed);
@@ -6211,7 +6210,7 @@ enum pcie_link_width pcie_get_width_cap(struct pci_dev *dev)pcie_capability_read_dword (dev,PCI_EXP_LNKCAP , &lnkcap);if (lnkcap) -return (lnkcap &PCI_EXP_LNKCAP_MLW ) >>4 ; +return FIELD_GET (PCI_EXP_LNKCAP_MLW , lnkcap);return PCIE_LNK_WIDTH_UNKNOWN ; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 76/372 PCI: Extract ATS disabling to a helper function
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Pawlowski <[email protected]>
[ Upstream commit f18b1137d38c091cc8c16365219f0a1d4a30b3d1 ]
Introduce quirk_no_ats() helper function to provide a standard way to disable ATS capability in PCI quirks.
--- drivers/pci/quirks.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/pci/quirks.c +9 -7
@@ -5404,6 +5404,12 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0420, quirk_no_ext_tags);DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_SERVERWORKS ,0x0422 , quirk_no_ext_tags);#ifdef CONFIG_PCI_ATS +static void quirk_no_ats (struct pci_dev *pdev) +{ +pci_info (pdev,"disabling ATS\n" ); + pdev->ats_cap =0 ; +} +/* * Some devices require additional driver setup to enable ATS. Don't use * ATS for those devices as ATS will be enabled before the driver has had a
@@ -5417,14 +5423,10 @@ static void quirk_amd_harvest_no_ats(struct pci_dev *pdev) (pdev->subsystem_device == 0xce19 || pdev->subsystem_device == 0xcc10 || pdev->subsystem_device == 0xcc08)) - goto no_ats; - else - return; +quirk_no_ats (pdev); + }else { +quirk_no_ats (pdev); } - -no_ats: -pci_info (pdev,"disabling ATS\n" ); - pdev->ats_cap =0 ; }/* AMD Stoney platform GPU */
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 77/372 PCI: Disable ATS for specific Intel IPU E2000 devices
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bartosz Pawlowski <[email protected]>
[ Upstream commit a18615b1cfc04f00548c60eb9a77e0ce56e848fd ]
Due to a hardware issue in A and B steppings of Intel IPU E2000, it expects wrong endianness in ATS invalidation message body. This problem can lead to outdated translations being returned as valid and finally cause system instability.
To prevent such issues, add quirk_intel_e2000_no_ats() to disable ATS for vulnerable IPU E2000 devices.
--- drivers/pci/quirks.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)
drivers/pci/quirks.c +19 -0
@@ -5449,6 +5449,25 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x7347, quirk_amd_harvest_no_ats);DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_ATI ,0x734f , quirk_amd_harvest_no_ats);/* AMD Raven platform iGPU */ DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_ATI ,0x15d8 , quirk_amd_harvest_no_ats); + +/* +* Intel IPU E2000 revisions before C0 implement incorrect endianness +* in ATS Invalidate Request message body. Disable ATS for those devices. +*/ +static void quirk_intel_e2000_no_ats (struct pci_dev *pdev) +{ +if (pdev->revision <0x20 ) +quirk_no_ats (pdev); +} +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_INTEL ,0x1451 , quirk_intel_e2000_no_ats); +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_INTEL ,0x1452 , quirk_intel_e2000_no_ats); +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_INTEL ,0x1453 , quirk_intel_e2000_no_ats); +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_INTEL ,0x1454 , quirk_intel_e2000_no_ats); +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_INTEL ,0x1455 , quirk_intel_e2000_no_ats); +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_INTEL ,0x1457 , quirk_intel_e2000_no_ats); +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_INTEL ,0x1459 , quirk_intel_e2000_no_ats); +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_INTEL ,0x145a , quirk_intel_e2000_no_ats); +DECLARE_PCI_FIXUP_FINAL (PCI_VENDOR_ID_INTEL ,0x145c , quirk_intel_e2000_no_ats);#endif /* CONFIG_PCI_ATS */ /* Freescale PCIe doesn't support MSI in RC mode */
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 78/372 misc: pci_endpoint_test: Add Device ID for R-Car S4-8 PCIe controller
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yoshihiro Shimoda <[email protected]>
[ Upstream commit 6c4b39937f4e65688ea294725ae432b2565821ff ]
Add Renesas R8A779F0 in pci_device_id table so that pci-epf-test can be used for testing PCIe EP on R-Car S4-8.
--- drivers/misc/pci_endpoint_test.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/misc/pci_endpoint_test.c +4 -0
@@ -81,6 +81,7 @@#define PCI_DEVICE_ID_RENESAS_R8A774B1 0x002b#define PCI_DEVICE_ID_RENESAS_R8A774C0 0x002d#define PCI_DEVICE_ID_RENESAS_R8A774E1 0x0025 +#define PCI_DEVICE_ID_RENESAS_R8A779F0 0x0031static DEFINE_IDA (pci_endpoint_test_ida);
@@ -996,6 +997,9 @@ static const struct pci_device_id pci_endpoint_test_tbl[] = { { PCI_DEVICE(PCI_VENDOR_ID_RENESAS, PCI_DEVICE_ID_RENESAS_R8A774B1),}, { PCI_DEVICE(PCI_VENDOR_ID_RENESAS, PCI_DEVICE_ID_RENESAS_R8A774C0),}, { PCI_DEVICE(PCI_VENDOR_ID_RENESAS, PCI_DEVICE_ID_RENESAS_R8A774E1),}, + { PCI_DEVICE(PCI_VENDOR_ID_RENESAS, PCI_DEVICE_ID_RENESAS_R8A779F0), + .driver_data = (kernel_ulong_t)&default_data, + }, { PCI_DEVICE(PCI_VENDOR_ID_TI, PCI_DEVICE_ID_TI_J721E), .driver_data = (kernel_ulong_t)&j721e_data, },
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 79/372 PCI: Use FIELD_GET() in Sapphire RX 5600 XT Pulse quirk
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <[email protected]>
[ Upstream commit 04e82fa5951ca66495d7b05665eff673aa3852b4 ]
Use FIELD_GET() to remove dependences on the field position, i.e., the shift value. No functional change intended.
Separate because this isn't as trivial as the other FIELD_GET() changes.
See 907830b0fc9e ("PCI: Add a REBAR size quirk for Sapphire RX 5600 XT Pulse")
--- drivers/pci/pci.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/pci/pci.c +4 -4
@@ -3713,14 +3713,14 @@ u32 pci_rebar_get_possible_sizes(struct pci_dev *pdev, int bar)return 0 ;pci_read_config_dword (pdev, pos +PCI_REBAR_CAP , &cap); - cap &=PCI_REBAR_CAP_SIZES ; + cap =FIELD_GET (PCI_REBAR_CAP_SIZES , cap);/* Sapphire RX 5600 XT Pulse has an invalid cap dword for BAR 0 */ if (pdev->vendor ==PCI_VENDOR_ID_ATI && pdev->device ==0x731f && - bar ==0 && cap ==0x7000 ) - cap =0x3f000 ; + bar ==0 && cap ==0x700 ) +return 0x3f00 ; -return cap >>4 ; +return cap; }EXPORT_SYMBOL (pci_rebar_get_possible_sizes);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 80/372 ASoC: Intel: soc-acpi-cht: Add Lenovo Yoga Tab 3 Pro YT3-X90 quirk
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 2cb54788393134d8174ee594002baae3ce52c61e ]
The Lenovo Yoga Tab 3 Pro YT3-X90 x86 tablet, which ships with Android with a custom kernel as factory OS, does not list the used WM5102 codec inside its DSDT.
Workaround this with a new snd_soc_acpi_intel_baytrail_machines[] entry which matches on the SST id instead of the codec id like nocodec does, combined with using a machine_quirk callback which returns NULL on other machines to skip the new entry on other machines.
--- .../intel/common/soc-acpi-intel-cht-match.c | 43 +++++++++++++++++++ 1 file changed, 43 insertions(+)
sound/soc/intel/common/soc-acpi-intel-cht-match.c +43 -0
@@ -75,6 +75,39 @@ static struct snd_soc_acpi_mach *cht_ess8316_quirk(void *arg)return arg; } +/* +* The Lenovo Yoga Tab 3 Pro YT3-X90, with Android factory OS has a buggy DSDT +* with the coded not being listed at all. +*/ +static const struct dmi_system_id lenovo_yoga_tab3_x90[] = { + { +/* Lenovo Yoga Tab 3 Pro YT3-X90, codec missing from DSDT */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Intel Corporation" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"CHERRYVIEW D1 PLATFORM" ), +DMI_MATCH (DMI_PRODUCT_VERSION ,"Blade3-10A-001" ), + }, + }, + { } +}; + +static struct snd_soc_acpi_mach cht_lenovo_yoga_tab3_x90_mach = { + .id ="10WM5102" , + .drv_name ="bytcr_wm5102" , + .fw_filename ="intel/fw_sst_22a8.bin" , + .board ="bytcr_wm5102" , + .sof_tplg_filename ="sof-cht-wm5102.tplg" , +}; + +static struct snd_soc_acpi_mach *lenovo_yt3_x90_quirk (void *arg) +{ +if (dmi_check_system (lenovo_yoga_tab3_x90)) +return &cht_lenovo_yoga_tab3_x90_mach; + +/* Skip wildcard match snd_soc_acpi_intel_cherrytrail_machines[] entry */ +return NULL ; +} +static const struct snd_soc_acpi_codecs rt5640_comp_ids = { .num_codecs =2 , .codecs = {"10EC5640" ,"10EC3276" },
@@ -175,6 +208,16 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_cherrytrail_machines[] = { .drv_name = "sof_pcm512x", .sof_tplg_filename = "sof-cht-src-50khz-pcm512x.tplg", }, +/* +* Special case for the Lenovo Yoga Tab 3 Pro YT3-X90 where the DSDT +* misses the codec. Match on the SST id instead, lenovo_yt3_x90_quirk() +* will return a YT3 specific mach or NULL when called on other hw, +* skipping this entry. +*/ + { + .id = "808622A8", + .machine_quirk = lenovo_yt3_x90_quirk, + },#if IS_ENABLED (CONFIG_SND_SOC_INTEL_BYT_CHT_NOCODEC_MACH )/*
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 81/372 crypto: hisilicon/qm - prevent soft lockup in receive loop
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Longfang Liu <[email protected]>
[ Upstream commit 33fc506d2ac514be1072499a263c3bff8c7c95a0 ]
In the scenario where the accelerator business is fully loaded. When the workqueue receiving messages and performing callback processing, there are a large number of messages that need to be received, and there are continuously messages that have been processed and need to be received.
This will cause the receive loop here to be locked for a long time. This scenario will cause watchdog timeout problems on OS with kernel preemption turned off.
The error logs:
watchdog: BUG: soft lockup - CPU#23 stuck for 23s! [kworker/u262:1:1407] [ 1461.978428][ C23] Call trace: [ 1461.981890][ C23] complete+0x8c/0xf0 [ 1461.986031][ C23] kcryptd_async_done+0x154/0x1f4 [dm_crypt] [ 1461.992154][ C23] sec_skcipher_callback+0x7c/0xf4 [hisi_sec2] [ 1461.998446][ C23] sec_req_cb+0x104/0x1f4 [hisi_sec2] [ 1462.003950][ C23] qm_poll_req_cb+0xcc/0x150 [hisi_qm] [ 1462.009531][ C23] qm_work_process+0x60/0xc0 [hisi_qm] [ 1462.015101][ C23] process_one_work+0x1c4/0x470 [ 1462.020052][ C23] worker_thread+0x150/0x3c4 [ 1462.024735][ C23] kthread+0x108/0x13c [ 1462.028889][ C23] ret_from_fork+0x10/0x18
Therefore, it is necessary to add an actively scheduled operation in the while loop to prevent this problem.
After adding it, no matter whether the OS turns on or off the kernel preemption function. Neither will cause watchdog timeout issues.
--- drivers/crypto/hisilicon/qm.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/crypto/hisilicon/qm.c +2 -0
@@ -841,6 +841,8 @@ static void qm_poll_req_cb(struct hisi_qp *qp)qm_db (qm, qp->qp_id,QM_DOORBELL_CMD_CQ , qp->qp_status.cq_head,0 );atomic_dec (&qp->qp_status.used); + +cond_resched (); }/* set c_flag */
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 82/372 HID: Add quirk for Dell Pro Wireless Keyboard and Mouse KM5221W
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Kosina <[email protected]>
[ Upstream commit 62cc9c3cb3ec1bf31cc116146185ed97b450836a ]
This device needs ALWAYS_POLL quirk, otherwise it keeps reconnecting indefinitely.
--- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-quirks.c | 1 + 2 files changed, 2 insertions(+)
drivers/hid/hid-ids.h +1 -0
@@ -365,6 +365,7 @@#define USB_VENDOR_ID_DELL 0x413c#define USB_DEVICE_ID_DELL_PIXART_USB_OPTICAL_MOUSE 0x301a +#define USB_DEVICE_ID_DELL_PRO_WIRELESS_KM5221W 0x4503#define USB_VENDOR_ID_DELORME 0x1163#define USB_DEVICE_ID_DELORME_EARTHMATE 0x0100
drivers/hid/hid-quirks.c +1 -0
@@ -66,6 +66,7 @@ static const struct hid_device_id hid_quirks[] = { { HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_STRAFE), HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_CREATIVE_SB_OMNI_SURROUND_51), HID_QUIRK_NOGET }, { HID_USB_DEVICE(USB_VENDOR_ID_DELL, USB_DEVICE_ID_DELL_PIXART_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_DELL, USB_DEVICE_ID_DELL_PRO_WIRELESS_KM5221W), HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC), HID_QUIRK_NOGET }, { HID_USB_DEVICE(USB_VENDOR_ID_DRACAL_RAPHNET, USB_DEVICE_ID_RAPHNET_2NES2SNES), HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_DRACAL_RAPHNET, USB_DEVICE_ID_RAPHNET_4NES4SNES), HID_QUIRK_MULTI_INPUT },
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 83/372 exfat: support handle zero-size directory
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuezhang Mo <[email protected]>
[ Upstream commit dab48b8f2fe7264d51ec9eed0adea0fe3c78830a ]
After repairing a corrupted file system with exfatprogs' fsck.exfat, zero-size directories may result. It is also possible to create zero-size directories in other exFAT implementation, such as Paragon ufsd dirver.
As described in the specification, the lower directory size limits is 0 bytes.
Without this commit, sub-directories and files cannot be created under a zero-size directory, and it cannot be removed.
--- fs/exfat/namei.c | 29 ++++++++++++++++++++++------- 1 file changed, 22 insertions(+), 7 deletions(-)
fs/exfat/namei.c +22 -7
@@ -338,14 +338,20 @@ static int exfat_find_empty_entry(struct inode *inode,if (exfat_check_max_dentries (inode))return -ENOSPC ; -/* we trust p_dir->size regardless of FAT type */ -if (exfat_find_last_cluster (sb, p_dir, &last_clu)) -return -EIO ; -/* * Allocate new cluster to this directory */ -exfat_chain_set (&clu, last_clu +1 ,0 , p_dir->flags); +if (ei->start_clu !=EXFAT_EOF_CLUSTER ) { +/* we trust p_dir->size regardless of FAT type */ +if (exfat_find_last_cluster (sb, p_dir, &last_clu)) +return -EIO ; + +exfat_chain_set (&clu, last_clu +1 ,0 , p_dir->flags); + }else { +/* This directory is empty */ +exfat_chain_set (&clu,EXFAT_EOF_CLUSTER ,0 , +ALLOC_NO_FAT_CHAIN ); + }/* allocate a cluster */ ret =exfat_alloc_cluster (inode,1 , &clu,IS_DIRSYNC (inode));
@@ -355,6 +361,11 @@ static int exfat_find_empty_entry(struct inode *inode,if (exfat_zeroed_cluster (inode, clu.dir))return -EIO ; +if (ei->start_clu ==EXFAT_EOF_CLUSTER ) { + ei->start_clu = clu.dir; + p_dir->dir = clu.dir; + } +/* append to the FAT chain */ if (clu.flags != p_dir->flags) {/* no-fat-chain bit is disabled,
@@ -644,7 +655,7 @@ static int exfat_find(struct inode *dir, struct qstr *qname, info->type =exfat_get_entry_type (ep); info->attr =le16_to_cpu (ep->dentry.file.attr); info->size =le64_to_cpu (ep2->dentry.stream.valid_size); -if ((info->type ==TYPE_FILE ) && (info->size ==0 )) { +if (info->size ==0 ) { info->flags =ALLOC_NO_FAT_CHAIN ; info->start_clu =EXFAT_EOF_CLUSTER ; }else {
@@ -888,6 +899,9 @@ static int exfat_check_dir_empty(struct super_block *sb, dentries_per_clu = sbi->dentries_per_clu; +if (p_dir->dir ==EXFAT_EOF_CLUSTER ) +return 0 ; +exfat_chain_dup (&clu, p_dir);while (clu.dir !=EXFAT_EOF_CLUSTER ) {
@@ -1262,7 +1276,8 @@ static int __exfat_rename(struct inode *old_parent_inode, }/* Free the clusters if new_inode is a dir(as if exfat_rmdir) */ -if (new_entry_type ==TYPE_DIR ) { +if (new_entry_type ==TYPE_DIR && + new_ei->start_clu !=EXFAT_EOF_CLUSTER ) {/* new_ei, new_clu_to_free */ struct exfat_chain new_clu_to_free;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 84/372 mfd: intel-lpss: Add Intel Lunar Lake-M PCI IDs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarkko Nikula <[email protected]>
[ Upstream commit e53b22b10c6e0de0cf2a03a92b18fdad70f266c7 ]
Add Intel Lunar Lake-M SoC PCI IDs.
--- drivers/mfd/intel-lpss-pci.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/mfd/intel-lpss-pci.c +13 -0
@@ -561,6 +561,19 @@ static const struct pci_device_id intel_lpss_pci_ids[] = { { PCI_VDEVICE(INTEL, 0xa3e2), (kernel_ulong_t)&spt_i2c_info }, { PCI_VDEVICE(INTEL, 0xa3e3), (kernel_ulong_t)&spt_i2c_info }, { PCI_VDEVICE(INTEL, 0xa3e6), (kernel_ulong_t)&spt_uart_info }, +/* LNL-M */ + { PCI_VDEVICE(INTEL, 0xa825), (kernel_ulong_t)&bxt_uart_info }, + { PCI_VDEVICE(INTEL, 0xa826), (kernel_ulong_t)&bxt_uart_info }, + { PCI_VDEVICE(INTEL, 0xa827), (kernel_ulong_t)&tgl_info }, + { PCI_VDEVICE(INTEL, 0xa830), (kernel_ulong_t)&tgl_info }, + { PCI_VDEVICE(INTEL, 0xa846), (kernel_ulong_t)&tgl_info }, + { PCI_VDEVICE(INTEL, 0xa850), (kernel_ulong_t)&ehl_i2c_info }, + { PCI_VDEVICE(INTEL, 0xa851), (kernel_ulong_t)&ehl_i2c_info }, + { PCI_VDEVICE(INTEL, 0xa852), (kernel_ulong_t)&bxt_uart_info }, + { PCI_VDEVICE(INTEL, 0xa878), (kernel_ulong_t)&ehl_i2c_info }, + { PCI_VDEVICE(INTEL, 0xa879), (kernel_ulong_t)&ehl_i2c_info }, + { PCI_VDEVICE(INTEL, 0xa87a), (kernel_ulong_t)&ehl_i2c_info }, + { PCI_VDEVICE(INTEL, 0xa87b), (kernel_ulong_t)&ehl_i2c_info }, { } };MODULE_DEVICE_TABLE (pci, intel_lpss_pci_ids);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 85/372 iio: adc: stm32-adc: harden against NULL pointer deref in stm32_adc_probe()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Shurong <[email protected]>
[ Upstream commit 3a23b384e7e3d64d5587ad10729a34d4f761517e ]
of_match_device() may fail and returns a NULL pointer.
In practice there is no known reasonable way to trigger this, but in case one is added in future, harden the code by adding the check
--- drivers/iio/adc/stm32-adc-core.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/iio/adc/stm32-adc-core.c +7 -2
@@ -695,6 +695,8 @@ static int stm32_adc_probe(struct platform_device *pdev)struct stm32_adc_priv *priv;struct device *dev = &pdev->dev;struct device_node *np = pdev->dev.of_node; +const struct of_device_id *of_id; +struct resource *res;u32 max_rate;int ret;
@@ -707,8 +709,11 @@ static int stm32_adc_probe(struct platform_device *pdev)return -ENOMEM ;platform_set_drvdata (pdev, &priv->common); - priv->cfg = (const struct stm32_adc_priv_cfg *) -of_match_device (dev->driver->of_match_table, dev)->data; + of_id =of_match_device (dev->driver->of_match_table, dev); +if (!of_id) +return -ENODEV ; + + priv->cfg = (const struct stm32_adc_priv_cfg *)of_id->data; priv->nb_adc_max = priv->cfg->num_adcs;spin_lock_init (&priv->common.lock);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 86/372 thunderbolt: Apply USB 3.x bandwidth quirk only in software connection manager
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <[email protected]>
[ Upstream commit 0c35ac18256942e66d8dab6ca049185812e60c69 ]
This is not needed when firmware connection manager is run so limit this to software connection manager.
--- drivers/thunderbolt/quirks.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/thunderbolt/quirks.c +3 -0
@@ -30,6 +30,9 @@ static void quirk_usb3_maximum_bandwidth(struct tb_switch *sw) {struct tb_port *port; +if (tb_switch_is_icm (sw)) +return ; +tb_switch_for_each_port (sw, port) {if (!tb_port_is_usb3_down (port))continue ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 87/372 tty: vcc: Add check for kstrdup() in vcc_probe()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yi Yang <[email protected]>
[ Upstream commit d81ffb87aaa75f842cd7aa57091810353755b3e6 ]
Add check for the return value of kstrdup() and return the error, if it fails in order to avoid NULL pointer dereference.
--- drivers/tty/vcc.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
drivers/tty/vcc.c +13 -3
@@ -579,18 +579,22 @@ static int vcc_probe(struct vio_dev *vdev, const struct vio_device_id *id)return -ENOMEM ; name =kstrdup (dev_name (&vdev->dev),GFP_KERNEL ); +if (!name) { + rv = -ENOMEM ; + goto free_port; + } rv =vio_driver_init (&port->vio, vdev,VDEV_CONSOLE_CON , vcc_versions,ARRAY_SIZE (vcc_versions),NULL , name);if (rv) - goto free_port; + goto free_name; port->vio.debug = vcc_dbg_vio; vcc_ldc_cfg.debug = vcc_dbg_ldc; rv =vio_ldc_alloc (&port->vio, &vcc_ldc_cfg, port);if (rv) - goto free_port; + goto free_name;spin_lock_init (&port->lock);
@@ -624,6 +628,11 @@ static int vcc_probe(struct vio_dev *vdev, const struct vio_device_id *id) goto unreg_tty; } port->domain =kstrdup (domain,GFP_KERNEL ); +if (!port->domain) { + rv = -ENOMEM ; + goto unreg_tty; + } +mdesc_release (hp);
@@ -653,8 +662,9 @@ static int vcc_probe(struct vio_dev *vdev, const struct vio_device_id *id)vcc_table_remove (port->index); free_ldc:vio_ldc_free (&port->vio); -free_port: +free_name:kfree (name); +free_port:kfree (port);return rv;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 88/372 usb: dwc3: core: configure TX/RX threshold for DWC3_IP
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanley Chang <[email protected]>
[ Upstream commit e72fc8d6a12af7ae8dd1b52cf68ed68569d29f80 ]
In Synopsys's dwc3 data book:
To avoid underrun and overrun during the burst, in a high-latency bus system (like USB), threshold and burst size control is provided through GTXTHRCFG and GRXTHRCFG registers.
In Realtek DHC SoC, DWC3 USB 3.0 uses AHB system bus. When dwc3 is connected with USB 2.5G Ethernet, there will be overrun problem. Therefore, setting TX/RX thresholds can avoid this issue.
--- drivers/usb/dwc3/core.c | 160 +++++++++++++++++++++++++++++++--------- drivers/usb/dwc3/core.h | 13 ++++ 2 files changed, 137 insertions(+), 36 deletions(-)
drivers/usb/dwc3/core.c +124 -36
@@ -1111,6 +1111,111 @@ static void dwc3_set_power_down_clk_scale(struct dwc3 *dwc) } } +static void dwc3_config_threshold (struct dwc3 *dwc) +{ +u32 reg; +u8 rx_thr_num; +u8 rx_maxburst; +u8 tx_thr_num; +u8 tx_maxburst; + +/* +* Must config both number of packets and max burst settings to enable +* RX and/or TX threshold. +*/ +if (!DWC3_IP_IS (DWC3 ) && dwc->dr_mode ==USB_DR_MODE_HOST ) { + rx_thr_num = dwc->rx_thr_num_pkt_prd; + rx_maxburst = dwc->rx_max_burst_prd; + tx_thr_num = dwc->tx_thr_num_pkt_prd; + tx_maxburst = dwc->tx_max_burst_prd; + +if (rx_thr_num && rx_maxburst) { + reg =dwc3_readl (dwc->regs,DWC3_GRXTHRCFG ); + reg |=DWC31_RXTHRNUMPKTSEL_PRD ; + + reg &= ~DWC31_RXTHRNUMPKT_PRD (~0 ); + reg |=DWC31_RXTHRNUMPKT_PRD (rx_thr_num); + + reg &= ~DWC31_MAXRXBURSTSIZE_PRD (~0 ); + reg |=DWC31_MAXRXBURSTSIZE_PRD (rx_maxburst); + +dwc3_writel (dwc->regs,DWC3_GRXTHRCFG , reg); + } + +if (tx_thr_num && tx_maxburst) { + reg =dwc3_readl (dwc->regs,DWC3_GTXTHRCFG ); + reg |=DWC31_TXTHRNUMPKTSEL_PRD ; + + reg &= ~DWC31_TXTHRNUMPKT_PRD (~0 ); + reg |=DWC31_TXTHRNUMPKT_PRD (tx_thr_num); + + reg &= ~DWC31_MAXTXBURSTSIZE_PRD (~0 ); + reg |=DWC31_MAXTXBURSTSIZE_PRD (tx_maxburst); + +dwc3_writel (dwc->regs,DWC3_GTXTHRCFG , reg); + } + } + + rx_thr_num = dwc->rx_thr_num_pkt; + rx_maxburst = dwc->rx_max_burst; + tx_thr_num = dwc->tx_thr_num_pkt; + tx_maxburst = dwc->tx_max_burst; + +if (DWC3_IP_IS (DWC3 )) { +if (rx_thr_num && rx_maxburst) { + reg =dwc3_readl (dwc->regs,DWC3_GRXTHRCFG ); + reg |=DWC3_GRXTHRCFG_PKTCNTSEL ; + + reg &= ~DWC3_GRXTHRCFG_RXPKTCNT (~0 ); + reg |=DWC3_GRXTHRCFG_RXPKTCNT (rx_thr_num); + + reg &= ~DWC3_GRXTHRCFG_MAXRXBURSTSIZE (~0 ); + reg |=DWC3_GRXTHRCFG_MAXRXBURSTSIZE (rx_maxburst); + +dwc3_writel (dwc->regs,DWC3_GRXTHRCFG , reg); + } + +if (tx_thr_num && tx_maxburst) { + reg =dwc3_readl (dwc->regs,DWC3_GTXTHRCFG ); + reg |=DWC3_GTXTHRCFG_PKTCNTSEL ; + + reg &= ~DWC3_GTXTHRCFG_TXPKTCNT (~0 ); + reg |=DWC3_GTXTHRCFG_TXPKTCNT (tx_thr_num); + + reg &= ~DWC3_GTXTHRCFG_MAXTXBURSTSIZE (~0 ); + reg |=DWC3_GTXTHRCFG_MAXTXBURSTSIZE (tx_maxburst); + +dwc3_writel (dwc->regs,DWC3_GTXTHRCFG , reg); + } + }else { +if (rx_thr_num && rx_maxburst) { + reg =dwc3_readl (dwc->regs,DWC3_GRXTHRCFG ); + reg |=DWC31_GRXTHRCFG_PKTCNTSEL ; + + reg &= ~DWC31_GRXTHRCFG_RXPKTCNT (~0 ); + reg |=DWC31_GRXTHRCFG_RXPKTCNT (rx_thr_num); + + reg &= ~DWC31_GRXTHRCFG_MAXRXBURSTSIZE (~0 ); + reg |=DWC31_GRXTHRCFG_MAXRXBURSTSIZE (rx_maxburst); + +dwc3_writel (dwc->regs,DWC3_GRXTHRCFG , reg); + } + +if (tx_thr_num && tx_maxburst) { + reg =dwc3_readl (dwc->regs,DWC3_GTXTHRCFG ); + reg |=DWC31_GTXTHRCFG_PKTCNTSEL ; + + reg &= ~DWC31_GTXTHRCFG_TXPKTCNT (~0 ); + reg |=DWC31_GTXTHRCFG_TXPKTCNT (tx_thr_num); + + reg &= ~DWC31_GTXTHRCFG_MAXTXBURSTSIZE (~0 ); + reg |=DWC31_GTXTHRCFG_MAXTXBURSTSIZE (tx_maxburst); + +dwc3_writel (dwc->regs,DWC3_GTXTHRCFG , reg); + } + } +} +/** * dwc3_core_init - Low-level initialization of DWC3 Core * @dwc: Pointer to our controller context structure
@@ -1278,42 +1383,7 @@ static int dwc3_core_init(struct dwc3 *dwc)dwc3_writel (dwc->regs,DWC3_GUCTL1 , reg); } -/* -* Must config both number of packets and max burst settings to enable -* RX and/or TX threshold. -*/ -if (!DWC3_IP_IS (DWC3 ) && dwc->dr_mode ==USB_DR_MODE_HOST ) { -u8 rx_thr_num = dwc->rx_thr_num_pkt_prd; -u8 rx_maxburst = dwc->rx_max_burst_prd; -u8 tx_thr_num = dwc->tx_thr_num_pkt_prd; -u8 tx_maxburst = dwc->tx_max_burst_prd; - -if (rx_thr_num && rx_maxburst) { - reg =dwc3_readl (dwc->regs,DWC3_GRXTHRCFG ); - reg |=DWC31_RXTHRNUMPKTSEL_PRD ; - - reg &= ~DWC31_RXTHRNUMPKT_PRD (~0 ); - reg |=DWC31_RXTHRNUMPKT_PRD (rx_thr_num); - - reg &= ~DWC31_MAXRXBURSTSIZE_PRD (~0 ); - reg |=DWC31_MAXRXBURSTSIZE_PRD (rx_maxburst); - -dwc3_writel (dwc->regs,DWC3_GRXTHRCFG , reg); - } - -if (tx_thr_num && tx_maxburst) { - reg =dwc3_readl (dwc->regs,DWC3_GTXTHRCFG ); - reg |=DWC31_TXTHRNUMPKTSEL_PRD ; - - reg &= ~DWC31_TXTHRNUMPKT_PRD (~0 ); - reg |=DWC31_TXTHRNUMPKT_PRD (tx_thr_num); - - reg &= ~DWC31_MAXTXBURSTSIZE_PRD (~0 ); - reg |=DWC31_MAXTXBURSTSIZE_PRD (tx_maxburst); - -dwc3_writel (dwc->regs,DWC3_GTXTHRCFG , reg); - } - } +dwc3_config_threshold (dwc);return 0 ;
@@ -1462,6 +1532,10 @@ static void dwc3_get_properties(struct dwc3 *dwc)u8 lpm_nyet_threshold;u8 tx_de_emphasis;u8 hird_threshold; +u8 rx_thr_num_pkt =0 ; +u8 rx_max_burst =0 ; +u8 tx_thr_num_pkt =0 ; +u8 tx_max_burst =0 ;u8 rx_thr_num_pkt_prd =0 ;u8 rx_max_burst_prd =0 ;u8 tx_thr_num_pkt_prd =0 ;
@@ -1524,6 +1598,14 @@ static void dwc3_get_properties(struct dwc3 *dwc) "snps,usb2-lpm-disable"); dwc->usb2_gadget_lpm_disable =device_property_read_bool (dev,"snps,usb2-gadget-lpm-disable" ); +device_property_read_u8 (dev,"snps,rx-thr-num-pkt" , + &rx_thr_num_pkt); +device_property_read_u8 (dev,"snps,rx-max-burst" , + &rx_max_burst); +device_property_read_u8 (dev,"snps,tx-thr-num-pkt" , + &tx_thr_num_pkt); +device_property_read_u8 (dev,"snps,tx-max-burst" , + &tx_max_burst);device_property_read_u8 (dev,"snps,rx-thr-num-pkt-prd" , &rx_thr_num_pkt_prd); device_property_read_u8(dev, "snps,rx-max-burst-prd",
@@ -1601,6 +1683,12 @@ static void dwc3_get_properties(struct dwc3 *dwc) dwc->hird_threshold = hird_threshold; + dwc->rx_thr_num_pkt = rx_thr_num_pkt; + dwc->rx_max_burst = rx_max_burst; + + dwc->tx_thr_num_pkt = tx_thr_num_pkt; + dwc->tx_max_burst = tx_max_burst; + dwc->rx_thr_num_pkt_prd = rx_thr_num_pkt_prd; dwc->rx_max_burst_prd = rx_max_burst_prd;
drivers/usb/dwc3/core.h +13 -0
@@ -209,6 +209,11 @@#define DWC3_GRXTHRCFG_RXPKTCNT (n) (((n) & 0xf) << 24)#define DWC3_GRXTHRCFG_PKTCNTSEL BIT(29) +/* Global TX Threshold Configuration Register */ +#define DWC3_GTXTHRCFG_MAXTXBURSTSIZE (n) (((n) & 0xff) << 16) +#define DWC3_GTXTHRCFG_TXPKTCNT (n) (((n) & 0xf) << 24) +#define DWC3_GTXTHRCFG_PKTCNTSEL BIT(29) +/* Global RX Threshold Configuration Register for DWC_usb31 only */ #define DWC31_GRXTHRCFG_MAXRXBURSTSIZE (n) (((n) & 0x1f) << 16)#define DWC31_GRXTHRCFG_RXPKTCNT (n) (((n) & 0x1f) << 21)
@@ -1041,6 +1046,10 @@ struct dwc3_scratchpad_array {* @test_mode_nr: test feature selector * @lpm_nyet_threshold: LPM NYET response threshold * @hird_threshold: HIRD threshold +* @rx_thr_num_pkt: USB receive packet count +* @rx_max_burst: max USB receive burst size +* @tx_thr_num_pkt: USB transmit packet count +* @tx_max_burst: max USB transmit burst size * @rx_thr_num_pkt_prd: periodic ESS receive packet count * @rx_max_burst_prd: max periodic ESS receive burst size * @tx_thr_num_pkt_prd: periodic ESS transmit packet count
@@ -1268,6 +1277,10 @@ struct dwc3 {u8 test_mode_nr;u8 lpm_nyet_threshold;u8 hird_threshold; +u8 rx_thr_num_pkt; +u8 rx_max_burst; +u8 tx_thr_num_pkt; +u8 tx_max_burst;u8 rx_thr_num_pkt_prd;u8 rx_max_burst_prd;u8 tx_thr_num_pkt_prd;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 89/372 soundwire: dmi-quirks: update HP Omen match
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Louis Bossart <[email protected]>
[ Upstream commit 4ea2b6d3128ea4d502c4015df0dc16b7d1070954 ]
New platforms have a slightly different DMI product name, remove trailing characters/digits to handle all cases
--- drivers/soundwire/dmi-quirks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soundwire/dmi-quirks.c +1 -1
@@ -141,7 +141,7 @@ static const struct dmi_system_id adr_remap_quirk_table[] = { { .matches = { DMI_MATCH(DMI_SYS_VENDOR, "HP"), - DMI_MATCH(DMI_PRODUCT_NAME, "OMEN by HP Gaming Laptop 16-k0xxx"), + DMI_MATCH(DMI_PRODUCT_NAME, "OMEN by HP Gaming Laptop 16"), }, .driver_data = (void *)hp_omen_16, },
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 90/372 f2fs: fix error handling of __get_node_page
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiguo Niu <[email protected]>
[ Upstream commit 9b4c8dd99fe48721410741651d426015e03a4b7a ]
Use f2fs_handle_error to record inconsistent node block error and return -EFSCORRUPTED instead of -EINVAL.
--- fs/f2fs/node.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/f2fs/node.c +2 -1
@@ -1455,7 +1455,8 @@ static struct page *__get_node_page(struct f2fs_sb_info *sbi, pgoff_t nid,ofs_of_node (page),cpver_of_node (page), next_blkaddr_of_node(page));set_sbi_flag (sbi,SBI_NEED_FSCK ); - err = -EINVAL ; +f2fs_handle_error (sbi,ERROR_INCONSISTENT_FOOTER ); + err = -EFSCORRUPTED ; out_err:ClearPageUptodate (page); out_put_err:
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 91/372 usb: gadget: f_ncm: Always set current gadget in ncm_bind()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hardik Gajjar <[email protected]>
[ Upstream commit a04224da1f3424b2c607b12a3bd1f0e302fb8231 ]
Previously, gadget assignment to the net device occurred exclusively during the initial binding attempt.
Nevertheless, the gadget pointer could change during bind/unbind cycles due to various conditions, including the unloading/loading of the UDC device driver or the detachment/reconnection of an OTG-capable USB hub device.
This patch relocates the gether_set_gadget() function out from ncm_opts->bound condition check, ensuring that the correct gadget is assigned during each bind request.
The provided logs demonstrate the consistency of ncm_opts throughout the power cycle, while the gadget may change.
* OTG hub connected during boot up and assignment of gadget and ncm_opts pointer
[ 2.366301] usb 2-1.5: New USB device found, idVendor=2996, idProduct=0105 [ 2.366304] usb 2-1.5: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2.366306] usb 2-1.5: Product: H2H Bridge [ 2.366308] usb 2-1.5: Manufacturer: Aptiv [ 2.366309] usb 2-1.5: SerialNumber: 13FEB2021 [ 2.427989] usb 2-1.5: New USB device found, VID=2996, PID=0105 [ 2.428959] dabridge 2-1.5:1.0: dabridge 2-4 total endpoints=5, 0000000093a8d681 [ 2.429710] dabridge 2-1.5:1.0: P(0105) D(22.06.22) F(17.3.16) H(1.1) high-speed [ 2.429714] dabridge 2-1.5:1.0: Hub 2-2 P(0151) V(06.87) [ 2.429956] dabridge 2-1.5:1.0: All downstream ports in host mode
[ 2.430093] gadget 000000003c414d59 ------> gadget pointer
* NCM opts and associated gadget pointer during First ncm_bind
[ 34.763929] NCM opts 00000000aa304ac9 [ 34.763930] NCM gadget 000000003c414d59
* OTG capable hub disconnecte or assume driver unload.
[ 97.203114] usb 2-1: USB disconnect, device number 2 [ 97.203118] usb 2-1.1: USB disconnect, device number 3 [ 97.209217] usb 2-1.5: USB disconnect, device number 4 [ 97.230990] dabr_udc deleted
* Reconnect the OTG hub or load driver assaign new gadget pointer.
[ 111.534035] usb 2-1.1: New USB device found, idVendor=2996, idProduct=0120, bcdDevice= 6.87 [ 111.534038] usb 2-1.1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.534040] usb 2-1.1: Product: Vendor [ 111.534041] usb 2-1.1: Manufacturer: Aptiv [ 111.534042] usb 2-1.1: SerialNumber: Superior [ 111.535175] usb 2-1.1: New USB device found, VID=2996, PID=0120 [ 111.610995] usb 2-1.5: new high-speed USB device number 8 using xhci-hcd [ 111.630052] usb 2-1.5: New USB device found, idVendor=2996, idProduct=0105, bcdDevice=21.02 [ 111.630055] usb 2-1.5: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 111.630057] usb 2-1.5: Product: H2H Bridge [ 111.630058] usb 2-1.5: Manufacturer: Aptiv [ 111.630059] usb 2-1.5: SerialNumber: 13FEB2021 [ 111.687464] usb 2-1.5: New USB device found, VID=2996, PID=0105 [ 111.690375] dabridge 2-1.5:1.0: dabridge 2-8 total endpoints=5, 000000000d87c961 [ 111.691172] dabridge 2-1.5:1.0: P(0105) D(22.06.22) F(17.3.16) H(1.1) high-speed [ 111.691176] dabridge 2-1.5:1.0: Hub 2-6 P(0151) V(06.87) [ 111.691646] dabridge 2-1.5:1.0: All downstream ports in host mode
[ 111.692298] gadget 00000000dc72f7a9 --------> new gadget ptr on connect
* NCM opts and associated gadget pointer during second ncm_bind
[ 113.271786] NCM opts 00000000aa304ac9 -----> same opts ptr used during first bind
[ 113.271788] NCM gadget 00000000dc72f7a9 ----> however new gaget ptr, that will not set
in net_device due to ncm_opts->bound = true--- drivers/usb/gadget/function/f_ncm.c | 27 +++++++++++---------------- 1 file changed, 11 insertions(+), 16 deletions(-)
drivers/usb/gadget/function/f_ncm.c +11 -16
@@ -1425,7 +1425,7 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f)struct usb_composite_dev *cdev = c->cdev;struct f_ncm *ncm =func_to_ncm (f);struct usb_string *us; -int status; +int status =0 ;struct usb_ep *ep;struct f_ncm_opts *ncm_opts;
@@ -1443,22 +1443,17 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f) f->os_desc_table[0 ].os_desc = &ncm_opts->ncm_os_desc; } -/* -* in drivers/usb/gadget/configfs.c:configfs_composite_bind() -* configurations are bound in sequence with list_for_each_entry, -* in each configuration its functions are bound in sequence -* with list_for_each_entry, so we assume no race condition -* with regard to ncm_opts->bound access -*/ -if (!ncm_opts->bound) { -mutex_lock (&ncm_opts->lock); -gether_set_gadget (ncm_opts->net, cdev->gadget); +mutex_lock (&ncm_opts->lock); +gether_set_gadget (ncm_opts->net, cdev->gadget); +if (!ncm_opts->bound) status =gether_register_netdev (ncm_opts->net); -mutex_unlock (&ncm_opts->lock); -if (status) - goto fail; - ncm_opts->bound = true; - } +mutex_unlock (&ncm_opts->lock); + +if (status) + goto fail; + + ncm_opts->bound = true; + us =usb_gstrings_attach (cdev, ncm_strings,ARRAY_SIZE (ncm_string_defs));if (IS_ERR (us)) {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 92/372 9p/trans_fd: Annotate data-racy writes to file::f_flags
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Elver <[email protected]>
[ Upstream commit 355f074609dbf3042900ea9d30fcd2b0c323a365 ]
syzbot reported:
| BUG: KCSAN: data-race in p9_fd_create / p9_fd_create | | read-write to 0xffff888130fb3d48 of 4 bytes by task 15599 on cpu 0: | p9_fd_open net/9p/trans_fd.c:842 [inline] | p9_fd_create+0x210/0x250 net/9p/trans_fd.c:1092 | p9_client_create+0x595/0xa70 net/9p/client.c:1010 | v9fs_session_init+0xf9/0xd90 fs/9p/v9fs.c:410 | v9fs_mount+0x69/0x630 fs/9p/vfs_super.c:123 | legacy_get_tree+0x74/0xd0 fs/fs_context.c:611 | vfs_get_tree+0x51/0x190 fs/super.c:1519 | do_new_mount+0x203/0x660 fs/namespace.c:3335 | path_mount+0x496/0xb30 fs/namespace.c:3662 | do_mount fs/namespace.c:3675 [inline] | __do_sys_mount fs/namespace.c:3884 [inline] | [...] | | read-write to 0xffff888130fb3d48 of 4 bytes by task 15563 on cpu 1: | p9_fd_open net/9p/trans_fd.c:842 [inline] | p9_fd_create+0x210/0x250 net/9p/trans_fd.c:1092 | p9_client_create+0x595/0xa70 net/9p/client.c:1010 | v9fs_session_init+0xf9/0xd90 fs/9p/v9fs.c:410 | v9fs_mount+0x69/0x630 fs/9p/vfs_super.c:123 | legacy_get_tree+0x74/0xd0 fs/fs_context.c:611 | vfs_get_tree+0x51/0x190 fs/super.c:1519 | do_new_mount+0x203/0x660 fs/namespace.c:3335 | path_mount+0x496/0xb30 fs/namespace.c:3662 | do_mount fs/namespace.c:3675 [inline] | __do_sys_mount fs/namespace.c:3884 [inline] | [...] | | value changed: 0x00008002 -> 0x00008802
Within p9_fd_open(), O_NONBLOCK is added to f_flags of the read and write files. This may happen concurrently if e.g. mounting process modifies the fd in another thread.
Mark the plain read-modify-writes as intentional data-races, with the assumption that the result of executing the accesses concurrently will always result in the same result despite the accesses themselves not being atomic.
Message-ID: <[email protected]>
--- net/9p/trans_fd.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
net/9p/trans_fd.c +10 -3
@@ -833,14 +833,21 @@ static int p9_fd_open(struct p9_client *client, int rfd, int wfd) goto out_free_ts;if (!(ts->rd->f_mode &FMODE_READ )) goto out_put_rd; -/* prevent workers from hanging on IO when fd is a pipe */ - ts->rd->f_flags |=O_NONBLOCK ; +/* Prevent workers from hanging on IO when fd is a pipe. +* It's technically possible for userspace or concurrent mounts to +* modify this flag concurrently, which will likely result in a +* broken filesystem. However, just having bad flags here should +* not crash the kernel or cause any other sort of bug, so mark this +* particular data race as intentional so that tooling (like KCSAN) +* can allow it and detect further problems. +*/ +data_race (ts->rd->f_flags |=O_NONBLOCK ); ts->wr =fget (wfd);if (!ts->wr) goto out_put_rd;if (!(ts->wr->f_mode &FMODE_WRITE )) goto out_put_wr; - ts->wr->f_flags |=O_NONBLOCK ; +data_race (ts->wr->f_flags |=O_NONBLOCK ); client->trans = ts; client->status = Connected;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 93/372 9p: v9fs_listxattr: fix %s null argument warning
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dominique Martinet <[email protected]>
[ Upstream commit 9b5c6281838fc84683dd99b47302d81fce399918 ]
W=1 warns about null argument to kprintf:
In file included from fs/9p/xattr.c:12:
In function ‘v9fs_xattr_get’,
inlined from ‘v9fs_listxattr’ at fs/9p/xattr.c:142:9:include/net/9p/9p.h:55:2: error: ‘%s’ directive argument is null [-Werror=format-overflow=]
55 | _p9_debug(level, __func__, fmt, ##__VA_ARGS__)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Use an empty string instead of :
- this is ok 9p-wise because p9pdu_vwritef serializes a null string
and an empty string the same way (one '0' word for length)
- since this degrades the print statements, add new single quotes for
xattr's name delimter (Old: "file = (null)", new: "file = ''")
Message-ID: <[email protected]>
--- fs/9p/xattr.c | 5 +++-- net/9p/client.c | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-)
fs/9p/xattr.c +3 -2
@@ -65,7 +65,7 @@ ssize_t v9fs_xattr_get(struct dentry *dentry, const char *name,struct p9_fid *fid;int ret; -p9_debug (P9_DEBUG_VFS ,"name = %s value_len = %zu\n" , +p9_debug (P9_DEBUG_VFS ,"name = '%s' value_len = %zu\n" , name, buffer_size); fid =v9fs_fid_lookup (dentry);if (IS_ERR (fid))
@@ -136,7 +136,8 @@ int v9fs_fid_xattr_set(struct p9_fid *fid, const char *name,ssize_t v9fs_listxattr (struct dentry *dentry,char *buffer,size_t buffer_size) { -return v9fs_xattr_get (dentry,NULL , buffer, buffer_size); +/* Txattrwalk with an empty string lists xattrs instead */ +return v9fs_xattr_get (dentry,"" , buffer, buffer_size); } static int v9fs_xattr_handler_get(const struct xattr_handler *handler,
net/9p/client.c +1 -1
@@ -1987,7 +1987,7 @@ struct p9_fid *p9_client_xattrwalk(struct p9_fid *file_fid, goto error; }p9_debug (P9_DEBUG_9P , -">>> TXATTRWALK file_fid %d, attr_fid %d name %s\n" , +">>> TXATTRWALK file_fid %d, attr_fid %d name '%s'\n" , file_fid->fid, attr_fid->fid, attr_name); req = p9_client_rpc(clnt, P9_TXATTRWALK, "dds",
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 94/372 i3c: mipi-i3c-hci: Fix out of bounds access in hci_dma_irq_handler
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarkko Nikula <[email protected]>
[ Upstream commit 45a832f989e520095429589d5b01b0c65da9b574 ]
Do not loop over ring headers in hci_dma_irq_handler() that are not allocated and enabled in hci_dma_init(). Otherwise out of bounds access will occur from rings->headers[i] access when i >= number of allocated ring headers.
--- drivers/i3c/master/mipi-i3c-hci/dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i3c/master/mipi-i3c-hci/dma.c +1 -1
@@ -734,7 +734,7 @@ static bool hci_dma_irq_handler(struct i3c_hci *hci, unsigned int mask)unsigned int i;bool handled = false; -for (i =0 ; mask && i <8 ; i++) { +for (i =0 ; mask && i < rings->total; i++) {struct hci_rh_data *rh;u32 status;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 95/372 i2c: fix memleak in i2c_new_client_device()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
[ Upstream commit 6af79f7fe748fe6a3c5c3a63d7f35981a82c2769 ]
Yang Yingliang reported a memleak:
===
I got memory leak as follows when doing fault injection test:
unreferenced object 0xffff888014aec078 (size 8):
comm "xrun", pid 356, jiffies 4294910619 (age 16.332s) hex dump (first 8 bytes):
31 2d 30 30 31 63 00 00 1-001c..
backtrace:
[<00000000eb56c0a9>] __kmalloc_track_caller+0x1a6/0x300
[<000000000b220ea3>] kvasprintf+0xad/0x140
[<00000000b83203e5>] kvasprintf_const+0x62/0x190
[<000000002a5eab37>] kobject_set_name_vargs+0x56/0x140
[<00000000300ac279>] dev_set_name+0xb0/0xe0
[<00000000b66ebd6f>] i2c_new_client_device+0x7e4/0x9a0If device_register() returns error in i2c_new_client_device(), the name allocated by i2c_dev_set_name() need be freed. As comment of device_register() says, it should use put_device() to give up the reference in the error path.
===
I think this solution is less intrusive and more robust than he originally proposed solutions, though.
--- drivers/i2c/i2c-core-base.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/i2c/i2c-core-base.c +9 -4
@@ -916,8 +916,9 @@ int i2c_dev_irq_from_resources(const struct resource *resources,struct i2c_client *i2c_new_client_device (struct i2c_adapter *adap,struct i2c_board_info const *info) { -struct i2c_client *client; -int status; +struct i2c_client *client; +bool need_put = false; +int status; client =kzalloc (sizeof *client,GFP_KERNEL );if (!client)
@@ -955,7 +956,6 @@ i2c_new_client_device(struct i2c_adapter *adap, struct i2c_board_info const *inf client->dev.fwnode = info->fwnode;device_enable_async_suspend (&client->dev); -i2c_dev_set_name (adap, client, info);if (info->swnode) { status =device_add_software_node (&client->dev, info->swnode);
@@ -967,6 +967,7 @@ i2c_new_client_device(struct i2c_adapter *adap, struct i2c_board_info const *inf } } +i2c_dev_set_name (adap, client, info); status =device_register (&client->dev);if (status) goto out_remove_swnode;
@@ -978,6 +979,7 @@ i2c_new_client_device(struct i2c_adapter *adap, struct i2c_board_info const *inf out_remove_swnode:device_remove_software_node (&client->dev); + need_put = true; out_err_put_of_node:of_node_put (info->of_node); out_err:
@@ -985,7 +987,10 @@ i2c_new_client_device(struct i2c_adapter *adap, struct i2c_board_info const *inf"Failed to register i2c client %s at 0x%02x (%d)\n" , client->name, client->addr, status); out_err_silent: -kfree (client); +if (need_put) +put_device (&client->dev); +else +kfree (client);return ERR_PTR (status); }EXPORT_SYMBOL_GPL (i2c_new_client_device);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 96/372 i2c: sun6i-p2wi: Prevent potential division by zero
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Axel Lin <[email protected]>
[ Upstream commit 5ac61d26b8baff5b2e5a9f3dc1ef63297e4b53e7 ]
Make sure we don't OOPS in case clock-frequency is set to 0 in a DT. The variable set here is later used as a divisor.
--- drivers/i2c/busses/i2c-sun6i-p2wi.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/i2c/busses/i2c-sun6i-p2wi.c +5 -0
@@ -201,6 +201,11 @@ static int p2wi_probe(struct platform_device *pdev)return -EINVAL ; } +if (clk_freq ==0 ) { +dev_err (dev,"clock-frequency is set to 0 in DT\n" ); +return -EINVAL ; + } +if (of_get_child_count (np) >1 ) {dev_err (dev,"P2WI only supports one slave device\n" );return -EINVAL ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 97/372 virtio-blk: fix implicit overflow on virtio_max_dma_size
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: zhenwei pi <[email protected]>
[ Upstream commit fafb51a67fb883eb2dde352539df939a251851be ]
The following codes have an implicit conversion from size_t to u32:
(u32)max_size = (size_t)virtio_max_dma_size(vdev);
This may lead overflow, Ex (size_t)4G -> (u32)0. Once virtio_max_dma_size() has a larger size than U32_MAX, use U32_MAX instead.
Message-Id: <[email protected]>
--- drivers/block/virtio_blk.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/block/virtio_blk.c +3 -1
@@ -900,6 +900,7 @@ static int virtblk_probe(struct virtio_device *vdev)u16 min_io_size;u8 physical_block_exp, alignment_offset;unsigned int queue_depth; +size_t max_dma_size;if (!vdev->config->get) { dev_err(&vdev->dev, "%s failure: config access disabled\n",
@@ -998,7 +999,8 @@ static int virtblk_probe(struct virtio_device *vdev)/* No real sector limit. */ blk_queue_max_hw_sectors (q,-1U ); - max_size =virtio_max_dma_size (vdev); + max_dma_size =virtio_max_dma_size (vdev); + max_size = max_dma_size >U32_MAX ?U32_MAX : max_dma_size;/* Host can optionally specify maximum segment size and number of * segments. */
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 98/372 i3c: master: mipi-i3c-hci: Fix a kernel panic for accessing DAT_data.
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Billy Tsai <[email protected]>
[ Upstream commit b53e9758a31c683fc8615df930262192ed5f034b ]
The i3c_master_bus_init function may attach the I2C devices before the I3C bus initialization. In this flow, the DAT `alloc_entry`` will be used before the DAT init. Additionally, if the i3c_master_bus_init fails, the DAT cleanup will execute before the device is detached, which will execue DAT free_entry function. The above scenario can cause the driver to use DAT_data when it is NULL.
--- drivers/i3c/master/mipi-i3c-hci/dat_v1.c | 29 ++++++++++++++++-------- 1 file changed, 19 insertions(+), 10 deletions(-)
drivers/i3c/master/mipi-i3c-hci/dat_v1.c +19 -10
@@ -64,15 +64,17 @@ static int hci_dat_v1_init(struct i3c_hci *hci)return -EOPNOTSUPP ; } -/* use a bitmap for faster free slot search */ - hci->DAT_data =bitmap_zalloc (hci->DAT_entries,GFP_KERNEL ); -if (!hci->DAT_data) -return -ENOMEM ; - -/* clear them */ -for (dat_idx =0 ; dat_idx < hci->DAT_entries; dat_idx++) { -dat_w0_write (dat_idx,0 ); -dat_w1_write (dat_idx,0 ); +if (!hci->DAT_data) { +/* use a bitmap for faster free slot search */ + hci->DAT_data =bitmap_zalloc (hci->DAT_entries,GFP_KERNEL ); +if (!hci->DAT_data) +return -ENOMEM ; + +/* clear them */ +for (dat_idx =0 ; dat_idx < hci->DAT_entries; dat_idx++) { +dat_w0_write (dat_idx,0 ); +dat_w1_write (dat_idx,0 ); + } }return 0 ;
@@ -87,7 +89,13 @@ static void hci_dat_v1_cleanup(struct i3c_hci *hci)static int hci_dat_v1_alloc_entry (struct i3c_hci *hci) {unsigned int dat_idx; +int ret; +if (!hci->DAT_data) { + ret =hci_dat_v1_init (hci); +if (ret) +return ret; + } dat_idx =find_first_zero_bit (hci->DAT_data, hci->DAT_entries);if (dat_idx >= hci->DAT_entries)return -ENOENT ;
@@ -103,7 +111,8 @@ static void hci_dat_v1_free_entry(struct i3c_hci *hci, unsigned int dat_idx) {dat_w0_write (dat_idx,0 );dat_w1_write (dat_idx,0 ); -__clear_bit (dat_idx, hci->DAT_data); +if (hci->DAT_data) +__clear_bit (dat_idx, hci->DAT_data); } static void hci_dat_v1_set_dynamic_addr(struct i3c_hci *hci,
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 99/372 media: gspca: cpia1: shift-out-of-bounds in set_flicker
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rajeshwar R Shinde <[email protected]>
[ Upstream commit 099be1822d1f095433f4b08af9cc9d6308ec1953 ]
Syzkaller reported the following issue:
UBSAN: shift-out-of-bounds in drivers/media/usb/gspca/cpia1.c:1031:27
shift exponent 245 is too large for 32-bit type 'int'
When the value of the variable "sd->params.exposure.gain" exceeds the number of bits in an integer, a shift-out-of-bounds error is reported. It is triggered because the variable "currentexp" cannot be left-shifted by more than the number of bits in an integer. In order to avoid invalid range during left-shift, the conditional expression is added.
--- drivers/media/usb/gspca/cpia1.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/media/usb/gspca/cpia1.c +3 -0
@@ -18,6 +18,7 @@#include <linux/input.h> #include <linux/sched/signal.h> +#include <linux/bitops.h> #include "gspca.h"
@@ -1028,6 +1029,8 @@ static int set_flicker(struct gspca_dev *gspca_dev, int on, int apply) sd->params.exposure.expMode =2 ; sd->exposure_status =EXPOSURE_NORMAL ; } +if (sd->params.exposure.gain >=BITS_PER_TYPE (currentexp)) +return -EINVAL ; currentexp = currentexp << sd->params.exposure.gain; sd->params.exposure.gain =0 ;/* round down current exposure to nearest value */
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 100/372 media: vivid: avoid integer overflow
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
[ Upstream commit 4567ebf8e8f9546b373e78e3b7d584cc30b62028 ]
Fixes these compiler warnings:
drivers/media/test-drivers/vivid/vivid-rds-gen.c: In function 'vivid_rds_gen_fill':drivers/media/test-drivers/vivid/vivid-rds-gen.c:147:56: warning: '.' directive output may be truncated writing 1 byte into a region of size between 0 and 3 [-Wformat-truncation=]
147 | snprintf(rds->psname, sizeof(rds->psname), "%6d.%1d",
| ^drivers/media/test-drivers/vivid/vivid-rds-gen.c:147:52: note: directive argument in the range [0, 9]
147 | snprintf(rds->psname, sizeof(rds->psname), "%6d.%1d",
| ^~~~~~~~~drivers/media/test-drivers/vivid/vivid-rds-gen.c:147:9: note: 'snprintf' output between 9 and 12 bytes into a destination of size 9
147 | snprintf(rds->psname, sizeof(rds->psname), "%6d.%1d",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
148 | freq / 16, ((freq & 0xf) * 10) / 16);
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~--- drivers/media/test-drivers/vivid/vivid-rds-gen.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/test-drivers/vivid/vivid-rds-gen.c +1 -1
@@ -145,7 +145,7 @@ void vivid_rds_gen_fill(struct vivid_rds_gen *rds, unsigned freq, rds->ta = alt; rds->ms = true;snprintf (rds->psname,sizeof (rds->psname),"%6d.%1d" , - freq /16 , ((freq &0xf ) *10 ) /16 ); + (freq /16 ) %1000000 , (((freq &0xf ) *10 ) /16 ) %10 );if (alt) strscpy(rds->radiotext, " The Radio Data System can switch between different Radio Texts ",
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 101/372 gfs2: ignore negated quota changes
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bob Peterson <[email protected]>
[ Upstream commit 4c6a08125f2249531ec01783a5f4317d7342add5 ]
When lots of quota changes are made, there may be cases in which an inode's quota information is increased and then decreased, such as when blocks are added to a file, then deleted from it. If the timing is right, function do_qc can add pending quota changes to a transaction, then later, another call to do_qc can negate those changes, resulting in a net gain of 0. The quota_change information is recorded in the qc buffer (and qd element of the inode as well). The buffer is added to the transaction by the first call to do_qc, but a subsequent call changes the value from non-zero back to zero. At that point it's too late to remove the buffer_head from the transaction. Later, when the quota sync code is called, the zero-change qd element is discovered and flagged as an assert warning. If the fs is mounted with errors=panic, the kernel will panic.
This is usually seen when files are truncated and the quota changes are negated by punch_hole/truncate which uses gfs2_quota_hold and gfs2_quota_unhold rather than block allocations that use gfs2_quota_lock and gfs2_quota_unlock which automatically do quota sync.
This patch solves the problem by adding a check to qd_check_sync such that net-zero quota changes already added to the transaction are no longer deemed necessary to be synced, and skipped.
In this case references are taken for the qd and the slot from do_qc so those need to be put. The normal sequence of events for a normal non-zero quota change is as follows:
gfs2_quota_change
do_qc
qd_hold
slot_hold
Later, when the changes are to be synced:
gfs2_quota_sync
qd_fish
qd_check_sync
gets qd ref via lockref_get_not_dead
do_sync
do_qc(QC_SYNC)
qd_put
lockref_put_or_lock qd_unlock
qd_put
lockref_put_or_lock
In the net-zero change case, we add a check to qd_check_sync so it puts the qd and slot references acquired in gfs2_quota_change and skip the unneeded sync.
--- fs/gfs2/quota.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
fs/gfs2/quota.c +11 -0
@@ -438,6 +438,17 @@ static int qd_check_sync(struct gfs2_sbd *sdp, struct gfs2_quota_data *qd, (sync_gen && (qd->qd_sync_gen >= *sync_gen)))return 0 ; +/* +* If qd_change is 0 it means a pending quota change was negated. +* We should not sync it, but we still have a qd reference and slot +* reference taken by gfs2_quota_change -> do_qc that need to be put. +*/ +if (!qd->qd_change &&test_and_clear_bit (QDF_CHANGE , &qd->qd_flags)) { +slot_put (qd); +qd_put (qd); +return 0 ; + } +if (!lockref_get_not_dead (&qd->qd_lockref))return 0 ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 102/372 gfs2: fix an oops in gfs2_permission
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit 0abd1557e21c617bd13fc18f7725fc6363c05913 ]
In RCU mode, we might race with gfs2_evict_inode(), which zeroes ->i_gl. Freeing of the object it points to is RCU-delayed, so if we manage to fetch the pointer before it's been replaced with NULL, we are fine. Check if we'd fetched NULL and treat that as "bail out and tell the caller to get out of RCU mode".
--- fs/gfs2/inode.c | 11 +++++++++-- fs/gfs2/super.c | 2 +- 2 files changed, 10 insertions(+), 3 deletions(-)
fs/gfs2/inode.c +9 -2
@@ -1847,14 +1847,21 @@ int gfs2_permission(struct user_namespace *mnt_userns, struct inode *inode, {struct gfs2_inode *ip;struct gfs2_holder i_gh; +struct gfs2_glock *gl;int error;gfs2_holder_mark_uninitialized (&i_gh); ip =GFS2_I (inode); -if (gfs2_glock_is_locked_by_me (ip->i_gl) ==NULL ) { + gl =rcu_dereference (ip->i_gl); +if (unlikely (!gl)) { +/* inode is getting torn down, must be RCU mode */ +WARN_ON_ONCE (!(mask &MAY_NOT_BLOCK )); +return -ECHILD ; + } +if (gfs2_glock_is_locked_by_me (gl) ==NULL ) {if (mask &MAY_NOT_BLOCK )return -ECHILD ; - error =gfs2_glock_nq_init (ip->i_gl,LM_ST_SHARED ,LM_FLAG_ANY , &i_gh); + error =gfs2_glock_nq_init (gl,LM_ST_SHARED ,LM_FLAG_ANY , &i_gh);if (error)return error; }
fs/gfs2/super.c +1 -1
@@ -1435,7 +1435,7 @@ static void gfs2_evict_inode(struct inode *inode)wait_on_bit_io (&ip->i_flags,GIF_GLOP_PENDING ,TASK_UNINTERRUPTIBLE );gfs2_glock_add_to_lru (ip->i_gl);gfs2_glock_put_eventually (ip->i_gl); - ip->i_gl =NULL ; +rcu_assign_pointer (ip->i_gl,NULL ); } }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 103/372 media: cobalt: Use FIELD_GET() to extract Link Width
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <[email protected]>
[ Upstream commit f301fedbeecfdce91cb898d6fa5e62f269801fee ]
Use FIELD_GET() to extract PCIe Negotiated and Maximum Link Width fields instead of custom masking and shifting.
--- drivers/media/pci/cobalt/cobalt-driver.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/media/pci/cobalt/cobalt-driver.c +6 -5
@@ -8,6 +8,7 @@* All rights reserved. */ +#include <linux/bitfield.h> #include <linux/delay.h> #include <media/i2c/adv7604.h> #include <media/i2c/adv7842.h>
@@ -210,17 +211,17 @@ void cobalt_pcie_status_show(struct cobalt *cobalt)pcie_capability_read_word (pci_dev,PCI_EXP_LNKSTA , &stat);cobalt_info ("PCIe link capability 0x%08x: %s per lane and %u lanes\n" , capa,get_link_speed (capa), - (capa &PCI_EXP_LNKCAP_MLW ) >>4 ); +FIELD_GET (PCI_EXP_LNKCAP_MLW , capa));cobalt_info ("PCIe link control 0x%04x\n" , ctrl);cobalt_info ("PCIe link status 0x%04x: %s per lane and %u lanes\n" , stat,get_link_speed (stat), - (stat &PCI_EXP_LNKSTA_NLW ) >>4 ); +FIELD_GET (PCI_EXP_LNKSTA_NLW , stat));/* Bus */ pcie_capability_read_dword (pci_bus_dev,PCI_EXP_LNKCAP , &capa);cobalt_info ("PCIe bus link capability 0x%08x: %s per lane and %u lanes\n" , capa,get_link_speed (capa), - (capa &PCI_EXP_LNKCAP_MLW ) >>4 ); +FIELD_GET (PCI_EXP_LNKCAP_MLW , capa));/* Slot */ pcie_capability_read_dword (pci_dev,PCI_EXP_SLTCAP , &capa);
@@ -239,7 +240,7 @@ static unsigned pcie_link_get_lanes(struct cobalt *cobalt)if (!pci_is_pcie (pci_dev))return 0 ;pcie_capability_read_word (pci_dev,PCI_EXP_LNKSTA , &link); -return (link &PCI_EXP_LNKSTA_NLW ) >>4 ; +return FIELD_GET (PCI_EXP_LNKSTA_NLW , link); }static unsigned pcie_bus_link_get_lanes (struct cobalt *cobalt)
@@ -250,7 +251,7 @@ static unsigned pcie_bus_link_get_lanes(struct cobalt *cobalt)if (!pci_is_pcie (pci_dev))return 0 ;pcie_capability_read_dword (pci_dev,PCI_EXP_LNKCAP , &link); -return (link &PCI_EXP_LNKCAP_MLW ) >>4 ; +return FIELD_GET (PCI_EXP_LNKCAP_MLW , link); }static void msi_config_show (struct cobalt *cobalt,struct pci_dev *pci_dev)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 104/372 media: ccs: Fix driver quirk struct documentation
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
[ Upstream commit 441b5c63d71ec9ec5453328f7e83384ecc1dddd9 ]
Fix documentation for struct ccs_quirk, a device specific struct for managing deviations from the standard. The flags field was drifted away from where it should have been.
--- drivers/media/i2c/ccs/ccs-quirk.h | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/media/i2c/ccs/ccs-quirk.h +1 -3
@@ -32,12 +32,10 @@ struct ccs_sensor;* @reg: Pointer to the register to access * @value: Register value, set by the caller on write, or * by the quirk on read -* -* @flags: Quirk flags -* * @return: 0 on success, -ENOIOCTLCMD if no register * access may be done by the caller (default read * value is zero), else negative error code on error +* @flags: Quirk flags */ struct ccs_quirk {int (*limits)(struct ccs_sensor *sensor);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 105/372 media: imon: fix access to invalid resource for the second interface
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit a1766a4fd83befa0b34d932d532e7ebb7fab1fa7 ]
imon driver probes two USB interfaces, and at the probe of the second interface, the driver assumes blindly that the first interface got bound with the same imon driver. It's usually true, but it's still possible that the first interface is bound with another driver via a malformed descriptor. Then it may lead to a memory corruption, as spotted by syzkaller; imon driver accesses the data from drvdata as struct imon_context object although it's a completely different one that was assigned by another driver.
This patch adds a sanity check -- whether the first interface is really bound with the imon driver or not -- for avoiding the problem above at the probe time.
--- drivers/media/rc/imon.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/media/rc/imon.c +6 -0
@@ -2427,6 +2427,12 @@ static int imon_probe(struct usb_interface *interface, goto fail; } +if (first_if->dev.driver != interface->dev.driver) { +dev_err (&interface->dev,"inconsistent driver matching\n" ); + ret = -EINVAL ; + goto fail; + } +if (ifnum ==0 ) { ictx =imon_init_intf0 (interface, id);if (!ictx) {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 106/372 drm/amd/display: Avoid NULL dereference of timing generator
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wayne Lin <[email protected]>
[ Upstream commit b1904ed480cee3f9f4036ea0e36d139cb5fee2d6 ]
[Why & How]
Check whether assigned timing generator is NULL or not before accessing its funcs to prevent NULL dereference.
--- drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/display/dc/core/dc_stream.c +2 -2
@@ -567,7 +567,7 @@ uint32_t dc_stream_get_vblank_counter(const struct dc_stream_state *stream)for (i =0 ; i <MAX_PIPES ; i++) {struct timing_generator *tg = res_ctx->pipe_ctx[i].stream_res.tg; -if (res_ctx->pipe_ctx[i].stream != stream) +if (res_ctx->pipe_ctx[i].stream != stream || !tg)continue ;return tg->funcs->get_frame_count (tg);
@@ -626,7 +626,7 @@ bool dc_stream_get_scanoutpos(const struct dc_stream_state *stream,for (i =0 ; i <MAX_PIPES ; i++) {struct timing_generator *tg = res_ctx->pipe_ctx[i].stream_res.tg; -if (res_ctx->pipe_ctx[i].stream != stream) +if (res_ctx->pipe_ctx[i].stream != stream || !tg)continue ; tg->funcs->get_scanoutpos(tg,
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 107/372 kgdb: Flush console before entering kgdb on panic
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
[ Upstream commit dd712d3d45807db9fcae28a522deee85c1f2fde6 ]
When entering kdb/kgdb on a kernel panic, it was be observed that the console isn't flushed before the kdb prompt came up. Specifically, when using the buddy lockup detector on arm64 and running:
echo HARDLOCKUP > /sys/kernel/debug/provoke-crash/DIRECT
I could see:
[ 26.161099] lkdtm: Performing direct entry HARDLOCKUP [ 32.499881] watchdog: Watchdog detected hard LOCKUP on cpu 6 [ 32.552865] Sending NMI from CPU 5 to CPUs 6: [ 32.557359] NMI backtrace for cpu 6 ... [backtrace for cpu 6] ... [ 32.558353] NMI backtrace for cpu 5 ... [backtrace for cpu 5] ... [ 32.867471] Sending NMI from CPU 5 to CPUs 0-4,7: [ 32.872321] NMI backtrace forP cpuANC: Hard LOCKUP
Entering kdb (current=..., pid 0) on processor 5 due to Keyboard Entry [5]kdb>
As you can see, backtraces for the other CPUs start printing and get interleaved with the kdb PANIC print.
Let's replicate the commands to flush the console in the kdb panic entry point to avoid this.
--- kernel/debug/debug_core.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/debug/debug_core.c +3 -0
@@ -1006,6 +1006,9 @@ void kgdb_panic(const char *msg)if (panic_timeout)return ; +debug_locks_off (); +console_flush_on_panic (CONSOLE_FLUSH_PENDING ); +if (dbg_kdb_mode)kdb_printf ("PANIC: %s\n" , msg);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 108/372 i2c: dev: copy userspace array safely
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philipp Stanner <[email protected]>
[ Upstream commit cc9c54232f04aef3a5d7f64a0ece7df00f1aaa3d ]
i2c-dev.c utilizes memdup_user() to copy a userspace array. This is done without an overflow check.
Use the new wrapper memdup_array_user() to copy the array more safely.
--- drivers/i2c/i2c-dev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/i2c/i2c-dev.c +2 -2
@@ -450,8 +450,8 @@ static long i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)if (rdwr_arg.nmsgs >I2C_RDWR_IOCTL_MAX_MSGS )return -EINVAL ; - rdwr_pa =memdup_user (rdwr_arg.msgs, - rdwr_arg.nmsgs *sizeof (struct i2c_msg )); + rdwr_pa =memdup_array_user (rdwr_arg.msgs, + rdwr_arg.nmsgs,sizeof (struct i2c_msg ));if (IS_ERR (rdwr_pa))return PTR_ERR (rdwr_pa);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 109/372 ASoC: ti: omap-mcbsp: Fix runtime PM underflow warnings
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <[email protected]>
[ Upstream commit fbb74e56378d8306f214658e3d525a8b3f000c5a ]
We need to check for an active device as otherwise we get warnings for some mcbsp instances for "Runtime PM usage count underflow!".
--- sound/soc/ti/omap-mcbsp.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
sound/soc/ti/omap-mcbsp.c +4 -2
@@ -74,14 +74,16 @@ static int omap2_mcbsp_set_clks_src(struct omap_mcbsp *mcbsp, u8 fck_src_id)return -EINVAL ; } -pm_runtime_put_sync (mcbsp->dev); +if (mcbsp->active) +pm_runtime_put_sync (mcbsp->dev); r =clk_set_parent (mcbsp->fclk, fck_src);if (r)dev_err (mcbsp->dev,"CLKS: could not clk_set_parent() to %s\n" , src); -pm_runtime_get_sync (mcbsp->dev); +if (mcbsp->active) +pm_runtime_get_sync (mcbsp->dev);clk_put (fck_src);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 110/372 drm/qxl: prevent memory leak
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zongmin Zhou <[email protected]>
[ Upstream commit 0e8b9f258baed25f1c5672613699247c76b007b5 ]
The allocated memory for qdev->dumb_heads should be released in qxl_destroy_monitors_object before qxl suspend. otherwise,qxl_create_monitors_object will be called to reallocate memory for qdev->dumb_heads after qxl resume, it will cause memory leak.
--- drivers/gpu/drm/qxl/qxl_display.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/qxl/qxl_display.c +3 -0
@@ -1229,6 +1229,9 @@ int qxl_destroy_monitors_object(struct qxl_device *qdev)if (!qdev->monitors_config_bo)return 0 ; +kfree (qdev->dumb_heads); + qdev->dumb_heads =NULL ; + qdev->monitors_config =NULL ; qdev->ram_header->monitors_config =0 ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 111/372 ALSA: hda/realtek: Add quirk for ASUS UX7602ZM
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Spataru <[email protected]>
[ Upstream commit 26fd31ef9c02a5e91cdb8eea127b056bd7cf0b3b ]
Enables the SPI-connected CSC35L41 audio amplifier for this laptop model.
As of BIOS version 303 it's still necessary to modify the ACPI table to add the related _DSD properties:
https://github.com/alex-spataru/asus_zenbook_ux7602zm_sound/
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -9749,6 +9749,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1043 ,0x1d4e ,"ASUS TM420" ,ALC256_FIXUP_ASUS_HPE ),SND_PCI_QUIRK (0x1043 ,0x1e02 ,"ASUS UX3402ZA" ,ALC245_FIXUP_CS35L41_SPI_2 ),SND_PCI_QUIRK (0x1043 ,0x16a3 ,"ASUS UX3402VA" ,ALC245_FIXUP_CS35L41_SPI_2 ), +SND_PCI_QUIRK (0x1043 ,0x1f62 ,"ASUS UX7602ZM" ,ALC245_FIXUP_CS35L41_SPI_2 ),SND_PCI_QUIRK (0x1043 ,0x1e11 ,"ASUS Zephyrus G15" ,ALC289_FIXUP_ASUS_GA502 ),SND_PCI_QUIRK (0x1043 ,0x1e12 ,"ASUS UM3402" ,ALC287_FIXUP_CS35L41_I2C_2 ), SND_PCI_QUIRK(0x1043, 0x1e51, "ASUS Zephyrus M15", ALC294_FIXUP_ASUS_GU502_PINS),
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 112/372 drm/amdgpu: fix software pci_unplug on some chips
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaly Prosyak <[email protected]>
[ Upstream commit 4638e0c29a3f2294d5de0d052a4b8c9f33ccb957 ]
When software 'pci unplug' using IGT is executed we got a sysfs directory entry is NULL for differant ras blocks like hdp, umc, etc. Before call 'sysfs_remove_file_from_group' and 'sysfs_remove_group' check that 'sd' is not NULL.
[ +0.000001] RIP: 0010:sysfs_remove_group+0x83/0x90 [ +0.000002] Code: 31 c0 31 d2 31 f6 31 ff e9 9a a8 b4 00 4c 89 e7 e8 f2 a2 ff ff eb c2 49 8b 55 00 48 8b 33 48 c7 c7 80 65 94 82 e8 cd 82 bb ff <0f> 0b eb cc 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 [ +0.000001] RSP: 0018:ffffc90002067c90 EFLAGS: 00010246 [ +0.000002] RAX: 0000000000000000 RBX: ffffffff824ea180 RCX: 0000000000000000 [ +0.000001] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ +0.000001] RBP: ffffc90002067ca8 R08: 0000000000000000 R09: 0000000000000000 [ +0.000001] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ +0.000001] R13: ffff88810a395f48 R14: ffff888101aab0d0 R15: 0000000000000000 [ +0.000001] FS: 00007f5ddaa43a00(0000) GS:ffff88841e800000(0000) knlGS:0000000000000000 [ +0.000002] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ +0.000001] CR2: 00007f8ffa61ba50 CR3: 0000000106432000 CR4: 0000000000350ef0 [ +0.000001] Call Trace: [ +0.000001] <TASK> [ +0.000001] ? show_regs+0x72/0x90 [ +0.000002] ? sysfs_remove_group+0x83/0x90 [ +0.000002] ? __warn+0x8d/0x160 [ +0.000001] ? sysfs_remove_group+0x83/0x90 [ +0.000001] ? report_bug+0x1bb/0x1d0 [ +0.000003] ? handle_bug+0x46/0x90 [ +0.000001] ? exc_invalid_op+0x19/0x80 [ +0.000002] ? asm_exc_invalid_op+0x1b/0x20 [ +0.000003] ? sysfs_remove_group+0x83/0x90 [ +0.000001] dpm_sysfs_remove+0x61/0x70 [ +0.000002] device_del+0xa3/0x3d0 [ +0.000002] ? ktime_get_mono_fast_ns+0x46/0xb0 [ +0.000002] device_unregister+0x18/0x70 [ +0.000001] i2c_del_adapter+0x26d/0x330 [ +0.000002] arcturus_i2c_control_fini+0x25/0x50 [amdgpu] [ +0.000236] smu_sw_fini+0x38/0x260 [amdgpu] [ +0.000241] amdgpu_device_fini_sw+0x116/0x670 [amdgpu] [ +0.000186] ? mutex_lock+0x13/0x50 [ +0.000003] amdgpu_driver_release_kms+0x16/0x40 [amdgpu] [ +0.000192] drm_minor_release+0x4f/0x80 [drm] [ +0.000025] drm_release+0xfe/0x150 [drm] [ +0.000027] __fput+0x9f/0x290 [ +0.000002] ____fput+0xe/0x20 [ +0.000002] task_work_run+0x61/0xa0 [ +0.000002] exit_to_user_mode_prepare+0x150/0x170 [ +0.000002] syscall_exit_to_user_mode+0x2a/0x50
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +6 -3
@@ -1273,7 +1273,8 @@ static void amdgpu_ras_sysfs_remove_bad_page_node(struct amdgpu_device *adev) {struct amdgpu_ras *con =amdgpu_ras_get_context (adev); -sysfs_remove_file_from_group (&adev->dev->kobj, +if (adev->dev->kobj.sd) +sysfs_remove_file_from_group (&adev->dev->kobj, &con->badpages_attr.attr,RAS_FS_NAME ); }
@@ -1290,7 +1291,8 @@ static int amdgpu_ras_sysfs_remove_feature_node(struct amdgpu_device *adev) .attrs = attrs, }; -sysfs_remove_group (&adev->dev->kobj, &group); +if (adev->dev->kobj.sd) +sysfs_remove_group (&adev->dev->kobj, &group);return 0 ; }
@@ -1337,7 +1339,8 @@ int amdgpu_ras_sysfs_remove(struct amdgpu_device *adev,if (!obj || !obj->attr_inuse)return -EINVAL ; -sysfs_remove_file_from_group (&adev->dev->kobj, +if (adev->dev->kobj.sd) +sysfs_remove_file_from_group (&adev->dev->kobj, &obj->sysfs_attr.attr,RAS_FS_NAME ); obj->attr_inuse =0 ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 113/372 pwm: Fix double shift bug
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit d27abbfd4888d79dd24baf50e774631046ac4732 ]
These enums are passed to set/test_bit(). The set/test_bit() functions take a bit number instead of a shifted value. Passing a shifted value is a double shift bug like doing BIT(BIT(1)). The double shift bug doesn't cause a problem here because we are only checking 0 and 1 but if the value was 5 or above then it can lead to a buffer overflow.
--- include/linux/pwm.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/pwm.h +2 -2
@@ -41,8 +41,8 @@ struct pwm_args { };enum { -PWMF_REQUESTED =1 <<0 , -PWMF_EXPORTED =1 <<1 , +PWMF_REQUESTED =0 , +PWMF_EXPORTED =1 , };/*
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 114/372 mtd: rawnand: tegra: add missing check for platform_get_irq()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yi Yang <[email protected]>
[ Upstream commit 0a1166c27d4e53186e6bf9147ea6db9cd1d65847 ]
Add the missing check for platform_get_irq() and return error code if it fails.
--- drivers/mtd/nand/raw/tegra_nand.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/mtd/nand/raw/tegra_nand.c +4 -0
@@ -1197,6 +1197,10 @@ static int tegra_nand_probe(struct platform_device *pdev)init_completion (&ctrl->dma_complete); ctrl->irq =platform_get_irq (pdev,0 ); +if (ctrl->irq <0 ) { + err = ctrl->irq; + goto err_put_pm; + } err =devm_request_irq (&pdev->dev, ctrl->irq, tegra_nand_irq,0 ,dev_name (&pdev->dev), ctrl);if (err) {
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 115/372 wifi: iwlwifi: Use FW rate for non-data frames
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miri Korenblit <[email protected]>
[ Upstream commit 499d02790495958506a64f37ceda7e97345a50a8 ]
Currently we are setting the rate in the tx cmd for mgmt frames (e.g. during connection establishment). This was problematic when sending mgmt frames in eSR mode, as we don't know what link this frame will be sent on (This is decided by the FW), so we don't know what is the lowest rate.
Fix this by not setting the rate in tx cmd and rely
on FW to choose the right one.
Set rate only for injected frames with fixed rate,
or when no sta is given.
Also set for important frames (EAPOL etc.) the High Priority flag.
--- drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/tx.c +9 -5
@@ -524,16 +524,20 @@ iwl_mvm_set_tx_params(struct iwl_mvm *mvm, struct sk_buff *skb, flags |=IWL_TX_FLAGS_ENCRYPT_DIS ;/* -* For data packets rate info comes from the fw. Only -* set rate/antenna during connection establishment or in case -* no station is given. +* For data and mgmt packets rate info comes from the fw. Only +* set rate/antenna for injected frames with fixed rate, or +* when no sta is given. */ -if (!sta || !ieee80211_is_data (hdr->frame_control) || - mvmsta->sta_state <IEEE80211_STA_AUTHORIZED ) { +if (unlikely (!sta || + info->control.flags &IEEE80211_TX_CTRL_RATE_INJECT )) { flags |=IWL_TX_FLAGS_CMD_RATE ; rate_n_flags =iwl_mvm_get_tx_rate_n_flags (mvm, info, sta, hdr->frame_control); + }else if (!ieee80211_is_data (hdr->frame_control) || + mvmsta->sta_state <IEEE80211_STA_AUTHORIZED ) { +/* These are important frames */ + flags |=IWL_TX_FLAGS_HIGH_PRI ; } if (mvm->trans->trans_cfg->device_family >=
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 116/372 sched/core: Optimize in_task() and in_interrupt() a bit
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Finn Thain <[email protected]>
[ Upstream commit 87c3a5893e865739ce78aa7192d36011022e0af7 ]
Except on x86, preempt_count is always accessed with READ_ONCE(). Repeated invocations in macros like irq_count() produce repeated loads. These redundant instructions appear in various fast paths. In the one shown below, for example, irq_count() is evaluated during kernel entry if !tick_nohz_full_cpu(smp_processor_id()).
0001ed0a <irq_enter_rcu>:
1ed0a: 4e56 0000 linkw %fp,#0 1ed0e: 200f movel %sp,%d0 1ed10: 0280 ffff e000 andil #-8192,%d0 1ed16: 2040 moveal %d0,%a0 1ed18: 2028 0008 movel %a0@(8),%d0 1ed1c: 0680 0001 0000 addil #65536,%d0 1ed22: 2140 0008 movel %d0,%a0@(8) 1ed26: 082a 0001 000f btst #1,%a2@(15) 1ed2c: 670c beqs 1ed3a <irq_enter_rcu+0x30> 1ed2e: 2028 0008 movel %a0@(8),%d0 1ed32: 2028 0008 movel %a0@(8),%d0 1ed36: 2028 0008 movel %a0@(8),%d0 1ed3a: 4e5e unlk %fp 1ed3c: 4e75 rts
This patch doesn't prevent the pointless btst and beqs instructions above, but it does eliminate 2 of the 3 pointless move instructions here and elsewhere.
On x86, preempt_count is per-cpu data and the problem does not arise presumably because the compiler is free to optimize more effectively.
This patch was tested on m68k and x86. I was expecting no changes to object code for x86 and mostly that's what I saw. However, there were a few places where code generation was perturbed for some reason.
The performance issue addressed here is minor on uniprocessor m68k. I got a 0.01% improvement from this patch for a simple "find /sys -false" benchmark. For architectures and workloads susceptible to cache line bounce the improvement is expected to be larger. The only SMP architecture I have is x86, and as x86 unaffected I have not done any further measurements.
--- include/linux/preempt.h | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
include/linux/preempt.h +13 -2
@@ -98,14 +98,21 @@ static __always_inline unsigned char interrupt_context_level(void)return level; } +/* +* These macro definitions avoid redundant invocations of preempt_count() +* because such invocations would result in redundant loads given that +* preempt_count() is commonly implemented with READ_ONCE(). +*/ +#define nmi_count () (preempt_count() & NMI_MASK)#define hardirq_count () (preempt_count() & HARDIRQ_MASK)#ifdef CONFIG_PREEMPT_RT # define softirq_count () (current->softirq_disable_cnt & SOFTIRQ_MASK) +# define irq_count () ((preempt_count() & (NMI_MASK | HARDIRQ_MASK)) | softirq_count())#else # define softirq_count () (preempt_count() & SOFTIRQ_MASK) +# define irq_count () (preempt_count() & (NMI_MASK | HARDIRQ_MASK | SOFTIRQ_MASK))#endif -#define irq_count () (nmi_count() | hardirq_count() | softirq_count())/* * Macros to retrieve the current execution context:
@@ -118,7 +125,11 @@ static __always_inline unsigned char interrupt_context_level(void)#define in_nmi () (nmi_count())#define in_hardirq () (hardirq_count())#define in_serving_softirq () (softirq_count() & SOFTIRQ_OFFSET) -#define in_task () (!(in_nmi() | in_hardirq() | in_serving_softirq())) +#ifdef CONFIG_PREEMPT_RT +# define in_task () (!((preempt_count() & (NMI_MASK | HARDIRQ_MASK)) | in_serving_softirq())) +#else +# define in_task () (!(preempt_count() & (NMI_MASK | HARDIRQ_MASK | SOFTIRQ_OFFSET))) +#endif /* * The following macros are deprecated and should not be used in new code:
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 117/372 SUNRPC: ECONNRESET might require a rebind
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 4b09ca1508a60be30b2e3940264e93d7aeb5c97e ]
If connect() is returning ECONNRESET, it usually means that nothing is listening on that port. If so, a rebind might be required in order to obtain the new port on which the RPC service is listening.
--- net/sunrpc/clnt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sunrpc/clnt.c +1 -1
@@ -2157,6 +2157,7 @@ call_connect_status(struct rpc_task *task) task->tk_status =0 ;switch (status) {case -ECONNREFUSED : +case -ECONNRESET :/* A positive refusal suggests a rebind is needed. */ if (RPC_IS_SOFTCONN (task))break ;
@@ -2165,7 +2166,6 @@ call_connect_status(struct rpc_task *task) goto out_retry; } fallthrough; -case -ECONNRESET :case -ECONNABORTED :case -ENETDOWN :case -ENETUNREACH :
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 118/372 mtd: rawnand: intel: check return value of devm_kasprintf()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yi Yang <[email protected]>
[ Upstream commit 74ac5b5e2375f1e8ef797ac7770887e9969f2516 ]
devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity.
--- drivers/mtd/nand/raw/intel-nand-controller.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/mtd/nand/raw/intel-nand-controller.c +10 -0
@@ -619,6 +619,11 @@ static int ebu_nand_probe(struct platform_device *pdev) ebu_host->cs_num = cs; resname =devm_kasprintf (dev,GFP_KERNEL ,"nand_cs%d" , cs); +if (!resname) { + ret = -ENOMEM ; + goto err_of_node_put; + } + ebu_host->cs[cs].chipaddr =devm_platform_ioremap_resource_byname (pdev, resname);if (IS_ERR (ebu_host->cs[cs].chipaddr)) {
@@ -655,6 +660,11 @@ static int ebu_nand_probe(struct platform_device *pdev) } resname =devm_kasprintf (dev,GFP_KERNEL ,"addr_sel%d" , cs); +if (!resname) { + ret = -ENOMEM ; + goto err_cleanup_dma; + } + res =platform_get_resource_byname (pdev,IORESOURCE_MEM , resname);if (!res) { ret = -EINVAL ;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 119/372 mtd: rawnand: meson: check return value of devm_kasprintf()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yi Yang <[email protected]>
[ Upstream commit 5a985960a4dd041c21dbe9956958c1633d2da706 ]
devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successful by checking the pointer validity.
--- drivers/mtd/nand/raw/meson_nand.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/mtd/nand/raw/meson_nand.c +3 -0
@@ -1021,6 +1021,9 @@ static int meson_nfc_clk_init(struct meson_nfc *nfc) init.name =devm_kasprintf (nfc->dev,GFP_KERNEL ,"%s#div" ,dev_name (nfc->dev)); +if (!init.name) +return -ENOMEM ; + init.ops = &clk_divider_ops; nfc_divider_parent_data[0 ].fw_name ="device" ; init.parent_data = nfc_divider_parent_data;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 120/372 NFSv4.1: fix handling NFS4ERR_DELAY when testing for session trunking
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <[email protected]>
[ Upstream commit 6bd1a77dc72dea0b0d8b6014f231143984d18f6d ]
Currently when client sends an EXCHANGE_ID for a possible trunked connection, for any error that happened, the trunk will be thrown out. However, an NFS4ERR_DELAY is a transient error that should be retried instead.
--- fs/nfs/nfs4proc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
fs/nfs/nfs4proc.c +6 -1
@@ -8939,6 +8939,7 @@ void nfs4_test_session_trunk(struct rpc_clnt *clnt, struct rpc_xprt *xprt, sp4_how = (adata->clp->cl_sp4_flags ==0 ?SP4_NONE :SP4_MACH_CRED ); +try_again:/* Test connection for session trunking. Async exchange_id call */ task =nfs4_run_exchange_id (adata->clp, adata->cred, sp4_how, xprt);if (IS_ERR (task))
@@ -8951,11 +8952,15 @@ void nfs4_test_session_trunk(struct rpc_clnt *clnt, struct rpc_xprt *xprt,if (status ==0 )rpc_clnt_xprt_switch_add_xprt (clnt, xprt); -else if (rpc_clnt_xprt_switch_has_addr (clnt, +else if (status != -NFS4ERR_DELAY &&rpc_clnt_xprt_switch_has_addr (clnt, (struct sockaddr *)&xprt->addr))rpc_clnt_xprt_switch_remove_xprt (clnt, xprt);rpc_put_task (task); +if (status == -NFS4ERR_DELAY ) { +ssleep (1 ); + goto try_again; + } }EXPORT_SYMBOL_GPL (nfs4_test_session_trunk);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 121/372 SUNRPC: Add an IS_ERR() check back to where it was
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit 4f3ed837186fc0d2722ba8d2457a594322e9c2ef ]
This IS_ERR() check was deleted during in a cleanup because, at the time, the rpcb_call_async() function could not return an error pointer. That changed in commit 25cf32ad5dba ("SUNRPC: Handle allocation failure in rpc_new_task()") and now it can return an error pointer. Put the check back.
A related revert was done in commit 13bd90141804 ("Revert "SUNRPC:
Remove unreachable error condition"").
--- net/sunrpc/rpcb_clnt.c | 4 ++++ 1 file changed, 4 insertions(+)
net/sunrpc/rpcb_clnt.c +4 -0
@@ -746,6 +746,10 @@ void rpcb_getport_async(struct rpc_task *task) child =rpcb_call_async (rpcb_clnt, map, proc);rpc_release_client (rpcb_clnt); +if (IS_ERR (child)) { +/* rpcb_map_release() has freed the arguments */ +return ; + } xprt->stat.bind_count++;rpc_put_task (child);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 122/372 NFSv4.1: fix SP4_MACH_CRED protection for pnfs IO
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <[email protected]>
[ Upstream commit 5cc7688bae7f0757c39c1d3dfdd827b724061067 ]
If the client is doing pnfs IO and Kerberos is configured and EXCHANGEID successfully negotiated SP4_MACH_CRED and WRITE/COMMIT are on the list of state protected operations, then we need to make sure to choose the DS's rpc_client structure instead of the MDS's one.
--- fs/nfs/nfs4proc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/nfs/nfs4proc.c +3 -2
@@ -5628,7 +5628,7 @@ static void nfs4_proc_write_setup(struct nfs_pgio_header *hdr, msg->rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_WRITE ];nfs4_init_sequence (&hdr->args.seq_args, &hdr->res.seq_res,0 ,0 ); -nfs4_state_protect_write (server->nfs_client, clnt, msg, hdr); +nfs4_state_protect_write (hdr->ds_clp ? hdr->ds_clp : server->nfs_client, clnt, msg, hdr); }static void nfs4_proc_commit_rpc_prepare (struct rpc_task *task,struct nfs_commit_data *data)
@@ -5669,7 +5669,8 @@ static void nfs4_proc_commit_setup(struct nfs_commit_data *data, struct rpc_mess data->res.server = server; msg->rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_COMMIT ];nfs4_init_sequence (&data->args.seq_args, &data->res.seq_res,1 ,0 ); -nfs4_state_protect (server->nfs_client,NFS_SP4_MACH_CRED_COMMIT , clnt, msg); +nfs4_state_protect (data->ds_clp ? data->ds_clp : server->nfs_client, +NFS_SP4_MACH_CRED_COMMIT , clnt, msg); } static int _nfs4_proc_commit(struct file *dst, struct nfs_commitargs *args,
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 123/372 SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: felix <[email protected]>
[ Upstream commit bfca5fb4e97c46503ddfc582335917b0cc228264 ]
RPC client pipefs dentries cleanup is in separated rpc_remove_pipedir() workqueue,which takes care about pipefs superblock locking. In some special scenarios, when kernel frees the pipefs sb of the current client and immediately alloctes a new pipefs sb, rpc_remove_pipedir function would misjudge the existence of pipefs sb which is not the one it used to hold. As a result,
the rpc_remove_pipedir would clean the released freed pipefs dentries.
To fix this issue, rpc_remove_pipedir should check whether the current pipefs sb is consistent with the original pipefs sb.
This error can be catched by KASAN:
=========================================================
[ 250.497700] BUG: KASAN: slab-use-after-free in dget_parent+0x195/0x200 [ 250.498315] Read of size 4 at addr ffff88800a2ab804 by task kworker/0:18/106503 [ 250.500549] Workqueue: events rpc_free_client_work [ 250.501001] Call Trace: [ 250.502880] kasan_report+0xb6/0xf0 [ 250.503209] ? dget_parent+0x195/0x200 [ 250.503561] dget_parent+0x195/0x200 [ 250.503897] ? __pfx_rpc_clntdir_depopulate+0x10/0x10 [ 250.504384] rpc_rmdir_depopulate+0x1b/0x90 [ 250.504781] rpc_remove_client_dir+0xf5/0x150 [ 250.505195] rpc_free_client_work+0xe4/0x230 [ 250.505598] process_one_work+0x8ee/0x13b0 ... [ 22.039056] Allocated by task 244: [ 22.039390] kasan_save_stack+0x22/0x50 [ 22.039758] kasan_set_track+0x25/0x30 [ 22.040109] __kasan_slab_alloc+0x59/0x70 [ 22.040487] kmem_cache_alloc_lru+0xf0/0x240 [ 22.040889] __d_alloc+0x31/0x8e0 [ 22.041207] d_alloc+0x44/0x1f0 [ 22.041514] __rpc_lookup_create_exclusive+0x11c/0x140 [ 22.041987] rpc_mkdir_populate.constprop.0+0x5f/0x110 [ 22.042459] rpc_create_client_dir+0x34/0x150 [ 22.042874] rpc_setup_pipedir_sb+0x102/0x1c0 [ 22.043284] rpc_client_register+0x136/0x4e0 [ 22.043689] rpc_new_client+0x911/0x1020 [ 22.044057] rpc_create_xprt+0xcb/0x370 [ 22.044417] rpc_create+0x36b/0x6c0 ... [ 22.049524] Freed by task 0: [ 22.049803] kasan_save_stack+0x22/0x50 [ 22.050165] kasan_set_track+0x25/0x30 [ 22.050520] kasan_save_free_info+0x2b/0x50 [ 22.050921] __kasan_slab_free+0x10e/0x1a0 [ 22.051306] kmem_cache_free+0xa5/0x390 [ 22.051667] rcu_core+0x62c/0x1930 [ 22.051995] __do_softirq+0x165/0x52a [ 22.052347] [ 22.052503] Last potentially related work creation: [ 22.052952] kasan_save_stack+0x22/0x50 [ 22.053313] __kasan_record_aux_stack+0x8e/0xa0 [ 22.053739] __call_rcu_common.constprop.0+0x6b/0x8b0 [ 22.054209] dentry_free+0xb2/0x140 [ 22.054540] __dentry_kill+0x3be/0x540 [ 22.054900] shrink_dentry_list+0x199/0x510 [ 22.055293] shrink_dcache_parent+0x190/0x240 [ 22.055703] do_one_tree+0x11/0x40 [ 22.056028] shrink_dcache_for_umount+0x61/0x140 [ 22.056461] generic_shutdown_super+0x70/0x590 [ 22.056879] kill_anon_super+0x3a/0x60 [ 22.057234] rpc_kill_sb+0x121/0x200
--- include/linux/sunrpc/clnt.h | 1 + net/sunrpc/clnt.c | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-)
include/linux/sunrpc/clnt.h +1 -0
@@ -84,6 +84,7 @@ struct rpc_clnt { };const struct cred *cl_cred;unsigned int cl_max_connect;/* max number of transports not to the same IP */ +struct super_block *pipefs_sb; };/*
net/sunrpc/clnt.c +4 -1
@@ -111,7 +111,8 @@ static void rpc_clnt_remove_pipedir(struct rpc_clnt *clnt) pipefs_sb =rpc_get_sb_net (net);if (pipefs_sb) { -__rpc_clnt_remove_pipedir (clnt); +if (pipefs_sb == clnt->pipefs_sb) +__rpc_clnt_remove_pipedir (clnt);rpc_put_sb_net (net); } }
@@ -151,6 +152,8 @@ rpc_setup_pipedir(struct super_block *pipefs_sb, struct rpc_clnt *clnt) {struct dentry *dentry; + clnt->pipefs_sb = pipefs_sb; +if (clnt->cl_program->pipe_dir_name !=NULL ) { dentry =rpc_setup_pipedir_sb (pipefs_sb, clnt);if (IS_ERR (dentry))
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 124/372 gfs2: Silence "suspicious RCU usage in gfs2_permission" warning
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
[ Upstream commit 074d7306a4fe22fcac0b53f699f92757ab1cee99 ]
Commit 0abd1557e21c added rcu_dereference() for dereferencing ip->i_gl in gfs2_permission. This now causes lockdep to complain when gfs2_permission is called in non-RCU context:
WARNING: suspicious RCU usage in gfs2_permission
Switch to rcu_dereference_check() and check for the MAY_NOT_BLOCK flag to shut up lockdep when we know that dereferencing ip->i_gl is safe.
--- fs/gfs2/inode.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
fs/gfs2/inode.c +4 -3
@@ -1845,6 +1845,7 @@ static const char *gfs2_get_link(struct dentry *dentry,int gfs2_permission (struct user_namespace *mnt_userns,struct inode *inode,int mask) { +int may_not_block = mask &MAY_NOT_BLOCK ;struct gfs2_inode *ip;struct gfs2_holder i_gh;struct gfs2_glock *gl;
@@ -1852,14 +1853,14 @@ int gfs2_permission(struct user_namespace *mnt_userns, struct inode *inode,gfs2_holder_mark_uninitialized (&i_gh); ip =GFS2_I (inode); - gl =rcu_dereference (ip->i_gl); + gl =rcu_dereference_check (ip->i_gl, !may_not_block);if (unlikely (!gl)) {/* inode is getting torn down, must be RCU mode */ -WARN_ON_ONCE (!(mask &MAY_NOT_BLOCK )); +WARN_ON_ONCE (!may_not_block);return -ECHILD ; }if (gfs2_glock_is_locked_by_me (gl) ==NULL ) { -if (mask &MAY_NOT_BLOCK ) +if (may_not_block)return -ECHILD ; error =gfs2_glock_nq_init (gl,LM_ST_SHARED ,LM_FLAG_ANY , &i_gh);if (error)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 125/372 vhost-vdpa: fix use after free in vhost_vdpa_probe()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit e07754e0a1ea2d63fb29574253d1fd7405607343 ]
The put_device() calls vhost_vdpa_release_dev() which calls ida_simple_remove() and frees "v". So this call to ida_simple_remove() is a use after free and a double free.
Message-Id: <[email protected]>
--- drivers/vhost/vdpa.c | 1 - 1 file changed, 1 deletion(-)
drivers/vhost/vdpa.c +0 -1
@@ -1427,7 +1427,6 @@ static int vhost_vdpa_probe(struct vdpa_device *vdpa) err:put_device (&v->dev); -ida_simple_remove (&vhost_vdpa_ida, v->minor);return r; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 126/372 net: set SOCK_RCU_FREE before inserting socket into hashtable
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stanislav Fomichev <[email protected]>
[ Upstream commit 871019b22d1bcc9fab2d1feba1b9a564acbb6e99 ]
We've started to see the following kernel traces:
WARNING: CPU: 83 PID: 0 at net/core/filter.c:6641 sk_lookup+0x1bd/0x1d0 Call Trace: <IRQ> __bpf_skc_lookup+0x10d/0x120 bpf_sk_lookup+0x48/0xd0 bpf_sk_lookup_tcp+0x19/0x20 bpf_prog_<redacted>+0x37c/0x16a3 cls_bpf_classify+0x205/0x2e0 tcf_classify+0x92/0x160 __netif_receive_skb_core+0xe52/0xf10 __netif_receive_skb_list_core+0x96/0x2b0 napi_complete_done+0x7b5/0xb70 <redacted>_poll+0x94/0xb0 net_rx_action+0x163/0x1d70 __do_softirq+0xdc/0x32e asm_call_irq_on_stack+0x12/0x20 </IRQ> do_softirq_own_stack+0x36/0x50 do_softirq+0x44/0x70
__inet_hash can race with lockless (rcu) readers on the other cpus:
__inet_hash
__sk_nulls_add_node_rcu
<- (bpf triggers here)
sock_set_flag(SOCK_RCU_FREE)
Let's move the SOCK_RCU_FREE part up a bit, before we are inserting the socket into hashtables. Note, that the race is really harmless; the bpf callers are handling this situation (where listener socket doesn't have SOCK_RCU_FREE set) correctly, so the only annoyance is a WARN_ONCE.
More details from Eric regarding SOCK_RCU_FREE timeline:
Commit 3b24d854cb35 ("tcp/dccp: do not touch listener sk_refcnt under synflood") added SOCK_RCU_FREE. At that time, the precise location of sock_set_flag(sk, SOCK_RCU_FREE) did not matter, because the thread calling __inet_hash() owns a reference on sk. SOCK_RCU_FREE was only tested at dismantle time.
Commit 6acc9b432e67 ("bpf: Add helper to retrieve socket in BPF") started checking SOCK_RCU_FREE _after_ the lookup to infer whether the refcount has been taken care of.
--- net/ipv4/inet_hashtables.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/inet_hashtables.c +1 -1
@@ -731,12 +731,12 @@ int __inet_hash(struct sock *sk, struct sock *osk)if (err) goto unlock; } +sock_set_flag (sk,SOCK_RCU_FREE );if (IS_ENABLED (CONFIG_IPV6 ) && sk->sk_reuseport && sk->sk_family ==AF_INET6 )__sk_nulls_add_node_tail_rcu (sk, &ilb2->nulls_head);else __sk_nulls_add_node_rcu (sk, &ilb2->nulls_head); -sock_set_flag (sk,SOCK_RCU_FREE );sock_prot_inuse_add (sock_net (sk), sk->sk_prot,1 ); unlock:spin_unlock (&ilb2->lock);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 127/372 ipvlan: add ipvlan_route_v6_outbound() helper
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 18f039428c7df183b09c69ebf10ffd4e521035d2 ]
Inspired by syzbot reports using a stack of multiple ipvlan devices.
Reduce stack size needed in ipvlan_process_v6_outbound() by moving the flowi6 struct used for the route lookup in an non inlined helper. ipvlan_route_v6_outbound() needs 120 bytes on the stack, immediately reclaimed.
Also make sure ipvlan_process_v4_outbound() is not inlined.
We might also have to lower MAX_NEST_DEV, because only syzbot uses setups with more than four stacked devices.
BUG: TASK stack guard page was hit at ffffc9000e803ff8 (stack is ffffc9000e804000..ffffc9000e808000) stack guard page: 0000 [#1] SMP KASAN CPU: 0 PID: 13442 Comm: syz-executor.4 Not tainted 6.1.52-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 RIP: 0010:kasan_check_range+0x4/0x2a0 mm/kasan/generic.c:188 Code: 48 01 c6 48 89 c7 e8 db 4e c1 03 31 c0 5d c3 cc 0f 0b eb 02 0f 0b b8 ea ff ff ff 5d c3 cc 00 00 cc cc 00 00 cc cc 55 48 89 e5 <41> 57 41 56 41 55 41 54 53 b0 01 48 85 f6 0f 84 a4 01 00 00 48 89 RSP: 0018:ffffc9000e804000 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817e5bf2 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff887c6568 RBP: ffffc9000e804000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff92001d0080c R13: dffffc0000000000 R14: ffffffff87e6b100 R15: 0000000000000000 FS: 00007fd0c55826c0(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000e803ff8 CR3: 0000000170ef7000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <#DF> </#DF> <TASK> [<ffffffff81f281d1>] __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31 [<ffffffff817e5bf2>] instrument_atomic_read include/linux/instrumented.h:72 [inline] [<ffffffff817e5bf2>] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] [<ffffffff817e5bf2>] cpumask_test_cpu include/linux/cpumask.h:506 [inline] [<ffffffff817e5bf2>] cpu_online include/linux/cpumask.h:1092 [inline] [<ffffffff817e5bf2>] trace_lock_acquire include/trace/events/lock.h:24 [inline] [<ffffffff817e5bf2>] lock_acquire+0xe2/0x590 kernel/locking/lockdep.c:5632 [<ffffffff8563221e>] rcu_lock_acquire+0x2e/0x40 include/linux/rcupdate.h:306 [<ffffffff8561464d>] rcu_read_lock include/linux/rcupdate.h:747 [inline] [<ffffffff8561464d>] ip6_pol_route+0x15d/0x1440 net/ipv6/route.c:2221 [<ffffffff85618120>] ip6_pol_route_output+0x50/0x80 net/ipv6/route.c:2606 [<ffffffff856f65b5>] pol_lookup_func include/net/ip6_fib.h:584 [inline] [<ffffffff856f65b5>] fib6_rule_lookup+0x265/0x620 net/ipv6/fib6_rules.c:116 [<ffffffff85618009>] ip6_route_output_flags_noref+0x2d9/0x3a0 net/ipv6/route.c:2638 [<ffffffff8561821a>] ip6_route_output_flags+0xca/0x340 net/ipv6/route.c:2651 [<ffffffff838bd5a3>] ip6_route_output include/net/ip6_route.h:100 [inline] [<ffffffff838bd5a3>] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:473 [inline] [<ffffffff838bd5a3>] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline] [<ffffffff838bd5a3>] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] [<ffffffff838bd5a3>] ipvlan_queue_xmit+0xc33/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677 [<ffffffff838c2909>] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229 [<ffffffff84d03900>] netdev_start_xmit include/linux/netdevice.h:4966 [inline] [<ffffffff84d03900>] xmit_one net/core/dev.c:3644 [inline] [<ffffffff84d03900>] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660 [<ffffffff84d080e2>] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324 [<ffffffff855ce4cd>] dev_queue_xmit include/linux/netdevice.h:3067 [inline] [<ffffffff855ce4cd>] neigh_hh_output include/net/neighbour.h:529 [inline] [<ffffffff855ce4cd>] neigh_output include/net/neighbour.h:543 [inline] [<ffffffff855ce4cd>] ip6_finish_output2+0x160d/0x1ae0 net/ipv6/ip6_output.c:139 [<ffffffff855b8616>] __ip6_finish_output net/ipv6/ip6_output.c:200 [inline] [<ffffffff855b8616>] ip6_finish_output+0x6c6/0xb10 net/ipv6/ip6_output.c:211 [<ffffffff855b7e3c>] NF_HOOK_COND include/linux/netfilter.h:298 [inline] [<ffffffff855b7e3c>] ip6_output+0x2bc/0x3d0 net/ipv6/ip6_output.c:232 [<ffffffff8575d27f>] dst_output include/net/dst.h:444 [inline] [<ffffffff8575d27f>] ip6_local_out+0x10f/0x140 net/ipv6/output_core.c:161 [<ffffffff838bdae4>] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:483 [inline] [<ffffffff838bdae4>] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline] [<ffffffff838bdae4>] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] [<ffffffff838bdae4>] ipvlan_queue_xmit+0x1174/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677 [<ffffffff838c2909>] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229 [<ffffffff84d03900>] netdev_start_xmit include/linux/netdevice.h:4966 [inline] [<ffffffff84d03900>] xmit_one net/core/dev.c:3644 [inline] [<ffffffff84d03900>] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660 [<ffffffff84d080e2>] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324 [<ffffffff855ce4cd>] dev_queue_xmit include/linux/netdevice.h:3067 [inline] [<ffffffff855ce4cd>] neigh_hh_output include/net/neighbour.h:529 [inline] [<ffffffff855ce4cd>] neigh_output include/net/neighbour.h:543 [inline] [<ffffffff855ce4cd>] ip6_finish_output2+0x160d/0x1ae0 net/ipv6/ip6_output.c:139 [<ffffffff855b8616>] __ip6_finish_output net/ipv6/ip6_output.c:200 [inline] [<ffffffff855b8616>] ip6_finish_output+0x6c6/0xb10 net/ipv6/ip6_output.c:211 [<ffffffff855b7e3c>] NF_HOOK_COND include/linux/netfilter.h:298 [inline] [<ffffffff855b7e3c>] ip6_output+0x2bc/0x3d0 net/ipv6/ip6_output.c:232 [<ffffffff8575d27f>] dst_output include/net/dst.h:444 [inline] [<ffffffff8575d27f>] ip6_local_out+0x10f/0x140 net/ipv6/output_core.c:161 [<ffffffff838bdae4>] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:483 [inline] [<ffffffff838bdae4>] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline] [<ffffffff838bdae4>] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] [<ffffffff838bdae4>] ipvlan_queue_xmit+0x1174/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677 [<ffffffff838c2909>] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229 [<ffffffff84d03900>] netdev_start_xmit include/linux/netdevice.h:4966 [inline] [<ffffffff84d03900>] xmit_one net/core/dev.c:3644 [inline] [<ffffffff84d03900>] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660 [<ffffffff84d080e2>] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324 [<ffffffff855ce4cd>] dev_queue_xmit include/linux/netdevice.h:3067 [inline] [<ffffffff855ce4cd>] neigh_hh_output include/net/neighbour.h:529 [inline] [<ffffffff855ce4cd>] neigh_output include/net/neighbour.h:543 [inline] [<ffffffff855ce4cd>] ip6_finish_output2+0x160d/0x1ae0 net/ipv6/ip6_output.c:139 [<ffffffff855b8616>] __ip6_finish_output net/ipv6/ip6_output.c:200 [inline] [<ffffffff855b8616>] ip6_finish_output+0x6c6/0xb10 net/ipv6/ip6_output.c:211 [<ffffffff855b7e3c>] NF_HOOK_COND include/linux/netfilter.h:298 [inline] [<ffffffff855b7e3c>] ip6_output+0x2bc/0x3d0 net/ipv6/ip6_output.c:232 [<ffffffff8575d27f>] dst_output include/net/dst.h:444 [inline] [<ffffffff8575d27f>] ip6_local_out+0x10f/0x140 net/ipv6/output_core.c:161 [<ffffffff838bdae4>] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:483 [inline] [<ffffffff838bdae4>] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline] [<ffffffff838bdae4>] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] [<ffffffff838bdae4>] ipvlan_queue_xmit+0x1174/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677 [<ffffffff838c2909>] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229 [<ffffffff84d03900>] netdev_start_xmit include/linux/netdevice.h:4966 [inline] [<ffffffff84d03900>] xmit_one net/core/dev.c:3644 [inline] [<ffffffff84d03900>] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660 [<ffffffff84d080e2>] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324 [<ffffffff855ce4cd>] dev_queue_xmit include/linux/netdevice.h:3067 [inline] [<ffffffff855ce4cd>] neigh_hh_output include/net/neighbour.h:529 [inline] [<ffffffff855ce4cd>] neigh_output include/net/neighbour.h:543 [inline] [<ffffffff855ce4cd>] ip6_finish_output2+0x160d/0x1ae0 net/ipv6/ip6_output.c:139 [<ffffffff855b8616>] __ip6_finish_output net/ipv6/ip6_output.c:200 [inline] [<ffffffff855b8616>] ip6_finish_output+0x6c6/0xb10 net/ipv6/ip6_output.c:211 [<ffffffff855b7e3c>] NF_HOOK_COND include/linux/netfilter.h:298 [inline] [<ffffffff855b7e3c>] ip6_output+0x2bc/0x3d0 net/ipv6/ip6_output.c:232 [<ffffffff8575d27f>] dst_output include/net/dst.h:444 [inline] [<ffffffff8575d27f>] ip6_local_out+0x10f/0x140 net/ipv6/output_core.c:161 [<ffffffff838bdae4>] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:483 [inline] [<ffffffff838bdae4>] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline] [<ffffffff838bdae4>] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline] [<ffffffff838bdae4>] ipvlan_queue_xmit+0x1174/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677 [<ffffffff838c2909>] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229 [<ffffffff84d03900>] netdev_start_xmit include/linux/netdevice.h:4966 [inline] [<ffffffff84d03900>] xmit_one net/core/dev.c:3644 [inline] [<ffffffff84d03900>] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660 [<ffffffff84d080e2>] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324 [<ffffffff84d4a65e>] dev_queue_xmit include/linux/netdevice.h:3067 [inline] [<ffffffff84d4a65e>] neigh_resolve_output+0x64e/0x750 net/core/neighbour.c:1560 [<ffffffff855ce503>] neigh_output include/net/neighbour.h:545 [inline] [<ffffffff855ce503>] ip6_finish_output2+0x1643/0x1ae0 net/ipv6/ip6_output.c:139 [<ffffffff855b8616>] __ip6_finish_output net/ipv6/ip6_output.c:200 [inline] [<ffffffff855b8616>] ip6_finish_output+0x6c6/0xb10 net/ipv6/ip6_output.c:211 [<ffffffff855b7e3c>] NF_HOOK_COND include/linux/netfilter.h:298 [inline] [<ffffffff855b7e3c>] ip6_output+0x2bc/0x3d0 net/ipv6/ip6_output.c:232 [<ffffffff855b9ce4>] dst_output include/net/dst.h:444 [inline] [<ffffffff855b9ce4>] NF_HOOK include/linux/netfilter.h:309 [inline] [<ffffffff855b9ce4>] ip6_xmit+0x11a4/0x1b20 net/ipv6/ip6_output.c:352 [<ffffffff8597984e>] sctp_v6_xmit+0x9ae/0x1230 net/sctp/ipv6.c:250 [<ffffffff8594623e>] sctp_packet_transmit+0x25de/0x2bc0 net/sctp/output.c:653 [<ffffffff858f5142>] sctp_packet_singleton+0x202/0x310 net/sctp/outqueue.c:783 [<ffffffff858ea411>] sctp_outq_flush_ctrl net/sctp/outqueue.c:914 [inline] [<ffffffff858ea411>] sctp_outq_flush+0x661/0x3d40 net/sctp/outqueue.c:1212 [<ffffffff858f02f9>] sctp_outq_uncork+0x79/0xb0 net/sctp/outqueue.c:764 [<ffffffff8589f060>] sctp_side_effects net/sctp/sm_sideeffect.c:1199 [inline] [<ffffffff8589f060>] sctp_do_sm+0x55c0/0x5c30 net/sctp/sm_sideeffect.c:1170 [<ffffffff85941567>] sctp_primitive_ASSOCIATE+0x97/0xc0 net/sctp/primitive.c:73 [<ffffffff859408b2>] sctp_sendmsg_to_asoc+0xf62/0x17b0 net/sctp/socket.c:1839 [<ffffffff85910b5e>] sctp_sendmsg+0x212e/0x33b0 net/sctp/socket.c:2029 [<ffffffff8544d559>] inet_sendmsg+0x149/0x310 net/ipv4/af_inet.c:849 [<ffffffff84c6c4d2>] sock_sendmsg_nosec net/socket.c:716 [inline] [<ffffffff84c6c4d2>] sock_sendmsg net/socket.c:736 [inline] [<ffffffff84c6c4d2>] ____sys_sendmsg+0x572/0x8c0 net/socket.c:2504 [<ffffffff84c6ca91>] ___sys_sendmsg net/socket.c:2558 [inline] [<ffffffff84c6ca91>] __sys_sendmsg+0x271/0x360 net/socket.c:2587 [<ffffffff84c6cbff>] __do_sys_sendmsg net/socket.c:2596 [inline] [<ffffffff84c6cbff>] __se_sys_sendmsg net/socket.c:2594 [inline] [<ffffffff84c6cbff>] __x64_sys_sendmsg+0x7f/0x90 net/socket.c:2594 [<ffffffff85b32553>] do_syscall_x64 arch/x86/entry/common.c:51 [inline] [<ffffffff85b32553>] do_syscall_64+0x53/0x80 arch/x86/entry/common.c:84 [<ffffffff85c00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
--- drivers/net/ipvlan/ipvlan_core.c | 41 +++++++++++++++++++------------- 1 file changed, 25 insertions(+), 16 deletions(-)
drivers/net/ipvlan/ipvlan_core.c +25 -16
@@ -411,7 +411,7 @@ struct ipvl_addr *ipvlan_addr_lookup(struct ipvl_port *port, void *lyr3h,return addr; } -static int ipvlan_process_v4_outbound (struct sk_buff *skb) +static noinline_for_stack int ipvlan_process_v4_outbound(struct sk_buff *skb) {const struct iphdr *ip4h =ip_hdr (skb);struct net_device *dev = skb->dev;
@@ -453,13 +453,11 @@ static int ipvlan_process_v4_outbound(struct sk_buff *skb) } #if IS_ENABLED(CONFIG_IPV6) -static int ipvlan_process_v6_outbound(struct sk_buff *skb) + +static noinline_for_stack int +ipvlan_route_v6_outbound(struct net_device *dev, struct sk_buff *skb) { const struct ipv6hdr *ip6h = ipv6_hdr(skb); - struct net_device *dev = skb->dev; - struct net *net = dev_net(dev); - struct dst_entry *dst; - int err, ret = NET_XMIT_DROP; struct flowi6 fl6 = { .flowi6_oif = dev->ifindex, .daddr = ip6h->daddr,
@@ -469,27 +467,38 @@ static int ipvlan_process_v6_outbound(struct sk_buff *skb) .flowi6_mark = skb->mark, .flowi6_proto = ip6h->nexthdr, }; +struct dst_entry *dst; +int err; - dst =ip6_route_output (net,NULL , &fl6); -if (dst->error) { - ret = dst->error; + dst =ip6_route_output (dev_net (dev),NULL , &fl6); + err = dst->error; +if (err) {dst_release (dst); - goto err; +return err; }skb_dst_set (skb, dst); +return 0 ; +} + +static int ipvlan_process_v6_outbound (struct sk_buff *skb) +{ +struct net_device *dev = skb->dev; +int err, ret =NET_XMIT_DROP ; + + err =ipvlan_route_v6_outbound (dev, skb); +if (unlikely (err)) { +DEV_STATS_INC (dev, tx_errors); +kfree_skb (skb); +return err; + }memset (IP6CB (skb),0 ,sizeof (*IP6CB (skb))); - err =ip6_local_out (net, skb->sk, skb); + err =ip6_local_out (dev_net (dev), skb->sk, skb);if (unlikely (net_xmit_eval (err)))DEV_STATS_INC (dev, tx_errors);else ret =NET_XMIT_SUCCESS ; - goto out; -err: -DEV_STATS_INC (dev, tx_errors); -kfree_skb (skb); -out:return ret; }#else
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 128/372 tty: Fix uninit-value access in ppp_sync_receive()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shigeru Yoshida <[email protected]>
[ Upstream commit 719639853d88071dfdfd8d9971eca9c283ff314c ]
KMSAN reported the following uninit-value access issue:
=====================================================
BUG: KMSAN: uninit-value in ppp_sync_input drivers/net/ppp/ppp_synctty.c:690 [inline] BUG: KMSAN: uninit-value in ppp_sync_receive+0xdc9/0xe70 drivers/net/ppp/ppp_synctty.c:334 ppp_sync_input drivers/net/ppp/ppp_synctty.c:690 [inline] ppp_sync_receive+0xdc9/0xe70 drivers/net/ppp/ppp_synctty.c:334 tiocsti+0x328/0x450 drivers/tty/tty_io.c:2295 tty_ioctl+0x808/0x1920 drivers/tty/tty_io.c:2694 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl+0x211/0x400 fs/ioctl.c:857 __x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was created at:
__alloc_pages+0x75d/0xe80 mm/page_alloc.c:4591 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] __page_frag_cache_refill+0x9a/0x2c0 mm/page_alloc.c:4691 page_frag_alloc_align+0x91/0x5d0 mm/page_alloc.c:4722 page_frag_alloc include/linux/gfp.h:322 [inline] __netdev_alloc_skb+0x215/0x6d0 net/core/skbuff.c:728 netdev_alloc_skb include/linux/skbuff.h:3225 [inline] dev_alloc_skb include/linux/skbuff.h:3238 [inline] ppp_sync_input drivers/net/ppp/ppp_synctty.c:669 [inline] ppp_sync_receive+0x237/0xe70 drivers/net/ppp/ppp_synctty.c:334 tiocsti+0x328/0x450 drivers/tty/tty_io.c:2295 tty_ioctl+0x808/0x1920 drivers/tty/tty_io.c:2694 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl+0x211/0x400 fs/ioctl.c:857 __x64_sys_ioctl+0x97/0xe0 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b CPU: 0 PID: 12950 Comm: syz-executor.1 Not tainted 6.6.0-14500-g1c41041124bd #10 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc38 04/01/2014 =====================================================
ppp_sync_input() checks the first 2 bytes of the data are PPP_ALLSTATIONS and PPP_UI. However, if the data length is 1 and the first byte is PPP_ALLSTATIONS, an access to an uninitialized value occurs when checking PPP_UI. This patch resolves this issue by checking the data length.
--- drivers/net/ppp/ppp_synctty.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ppp/ppp_synctty.c +1 -1
@@ -697,7 +697,7 @@ ppp_sync_input(struct syncppp *ap, const unsigned char *buf,/* strip address/control field if present */ p = skb->data; -if (p[0 ] ==PPP_ALLSTATIONS && p[1 ] ==PPP_UI ) { +if (skb->len >=2 && p[0 ] ==PPP_ALLSTATIONS && p[1 ] ==PPP_UI ) {/* chop off address/control */ if (skb->len <3 ) goto err;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 129/372 net: hns3: fix add VLAN fail issue
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jian Shen <[email protected]>
[ Upstream commit 472a2ff63efb30234cbf6b2cdaf8117f21b4f8bc ]
The hclge_sync_vlan_filter is called in periodic task, trying to remove VLAN from vlan_del_fail_bmap. It can be concurrence with VLAN adding operation from user. So once user failed to delete a VLAN id, and add it again soon, it may be removed by the periodic task, which may cause the software configuration being inconsistent with hardware. So add mutex handling to avoid this.
user hns3 driver
periodic task
│
add vlan 10 ───── hns3_vlan_rx_add_vid │
│ (suppose success) │
│ │
del vlan 10 ───── hns3_vlan_rx_kill_vid │
│ (suppose fail,add to │
│ vlan_del_fail_bmap) │
│ │
add vlan 10 ───── hns3_vlan_rx_add_vid │
(suppose success) │ foreach vlan_del_fail_bmp
del vlan 10
--- .../hisilicon/hns3/hns3pf/hclge_main.c | 28 +++++++++++++------ .../hisilicon/hns3/hns3vf/hclgevf_main.c | 11 ++++++-- 2 files changed, 29 insertions(+), 10 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +20 -8
@@ -10132,8 +10132,6 @@ static void hclge_rm_vport_vlan_table(struct hclge_vport *vport, u16 vlan_id,struct hclge_vport_vlan_cfg *vlan, *tmp;struct hclge_dev *hdev = vport->back; -mutex_lock (&hdev->vport_lock); -list_for_each_entry_safe (vlan, tmp, &vport->vlan_list, node) {if (vlan->vlan_id == vlan_id) {if (is_write_tbl && vlan->hd_tbl_status)
@@ -10148,8 +10146,6 @@ static void hclge_rm_vport_vlan_table(struct hclge_vport *vport, u16 vlan_id,break ; } } - -mutex_unlock (&hdev->vport_lock); }void hclge_rm_vport_all_vlan_table (struct hclge_vport *vport,bool is_del_list)
@@ -10558,11 +10554,16 @@ int hclge_set_vlan_filter(struct hnae3_handle *handle, __be16 proto,* handle mailbox. Just record the vlan id, and remove it after * reset finished. */ +mutex_lock (&hdev->vport_lock);if ((test_bit (HCLGE_STATE_RST_HANDLING , &hdev->state) ||test_bit (HCLGE_STATE_RST_FAIL , &hdev->state)) && is_kill) {set_bit (vlan_id, vport->vlan_del_fail_bmap); +mutex_unlock (&hdev->vport_lock);return -EBUSY ; + }else if (!is_kill &&test_bit (vlan_id, vport->vlan_del_fail_bmap)) { +clear_bit (vlan_id, vport->vlan_del_fail_bmap); } +mutex_unlock (&hdev->vport_lock);/* when port base vlan enabled, we use port base vlan as the vlan * filter entry. In this case, we don't update vlan filter table
@@ -10577,17 +10578,22 @@ int hclge_set_vlan_filter(struct hnae3_handle *handle, __be16 proto, }if (!ret) { -if (!is_kill) +if (!is_kill) {hclge_add_vport_vlan_table (vport, vlan_id, writen_to_tbl); -else if (is_kill && vlan_id !=0 ) + }else if (is_kill && vlan_id !=0 ) { +mutex_lock (&hdev->vport_lock);hclge_rm_vport_vlan_table (vport, vlan_id, false); +mutex_unlock (&hdev->vport_lock); + } }else if (is_kill) {/* when remove hw vlan filter failed, record the vlan id, * and try to remove it from hw later, to be consistence * with stack */ +mutex_lock (&hdev->vport_lock);set_bit (vlan_id, vport->vlan_del_fail_bmap); +mutex_unlock (&hdev->vport_lock); }hclge_set_vport_vlan_fltr_change (vport);
@@ -10627,6 +10633,7 @@ static void hclge_sync_vlan_filter(struct hclge_dev *hdev)int i, ret, sync_cnt =0 ;u16 vlan_id; +mutex_lock (&hdev->vport_lock);/* start from vport 1 for PF is always alive */ for (i =0 ; i < hdev->num_alloc_vport; i++) {struct hclge_vport *vport = &hdev->vport[i];
@@ -10637,21 +10644,26 @@ static void hclge_sync_vlan_filter(struct hclge_dev *hdev) ret =hclge_set_vlan_filter_hw (hdev,htons (ETH_P_8021Q ), vport->vport_id, vlan_id, true); -if (ret && ret != -EINVAL ) +if (ret && ret != -EINVAL ) { +mutex_unlock (&hdev->vport_lock);return ; + }clear_bit (vlan_id, vport->vlan_del_fail_bmap);hclge_rm_vport_vlan_table (vport, vlan_id, false);hclge_set_vport_vlan_fltr_change (vport); sync_cnt++; -if (sync_cnt >=HCLGE_MAX_SYNC_COUNT ) +if (sync_cnt >=HCLGE_MAX_SYNC_COUNT ) { +mutex_unlock (&hdev->vport_lock);return ; + } vlan_id =find_first_bit (vport->vlan_del_fail_bmap,VLAN_N_VID ); } } +mutex_unlock (&hdev->vport_lock);hclge_sync_vlan_fltr_state (hdev); }
drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +9 -2
@@ -1258,6 +1258,8 @@ static int hclgevf_set_vlan_filter(struct hnae3_handle *handle, test_bit(HCLGEVF_STATE_RST_FAIL, &hdev->state)) && is_kill) {set_bit (vlan_id, hdev->vlan_del_fail_bmap);return -EBUSY ; + } else if (!is_kill && test_bit(vlan_id, hdev->vlan_del_fail_bmap)) { +clear_bit (vlan_id, hdev->vlan_del_fail_bmap); } hclgevf_build_send_msg(&send_msg, HCLGE_MBX_SET_VLAN,
@@ -1285,20 +1287,25 @@ static void hclgevf_sync_vlan_filter(struct hclgevf_dev *hdev)int ret, sync_cnt =0 ;u16 vlan_id; +if (bitmap_empty (hdev->vlan_del_fail_bmap,VLAN_N_VID )) +return ; + +rtnl_lock (); vlan_id =find_first_bit (hdev->vlan_del_fail_bmap,VLAN_N_VID );while (vlan_id !=VLAN_N_VID ) { ret =hclgevf_set_vlan_filter (handle,htons (ETH_P_8021Q ), vlan_id, true);if (ret) -return ; +break ;clear_bit (vlan_id, hdev->vlan_del_fail_bmap); sync_cnt++;if (sync_cnt >=HCLGEVF_MAX_SYNC_COUNT ) -return ; +break ; vlan_id =find_first_bit (hdev->vlan_del_fail_bmap,VLAN_N_VID ); } +rtnl_unlock (); }static int hclgevf_en_hw_strip_rxvtag (struct hnae3_handle *handle,bool enable)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 130/372 net: hns3: add barrier in vf mailbox reply process
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonglong Liu <[email protected]>
[ Upstream commit ac92c0a9a0603fb448e60f38e63302e4eebb8035 ]
In hclgevf_mbx_handler() and hclgevf_get_mbx_resp() functions, there is a typical store-store and load-load scenario between received_resp and additional_info. This patch adds barrier to fix the problem.
--- drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_mbx.c +7 -0
@@ -63,6 +63,9 @@ static int hclgevf_get_mbx_resp(struct hclgevf_dev *hdev, u16 code0, u16 code1, i++; } +/* ensure additional_info will be seen after received_resp */ +smp_rmb (); +if (i >=HCLGEVF_MAX_TRY_TIMES ) { dev_err(&hdev->pdev->dev, "VF could not get mbx(%u,%u) resp(=%d) from PF in %d tries\n",
@@ -178,6 +181,10 @@ static void hclgevf_handle_mbx_response(struct hclgevf_dev *hdev, resp->resp_status =hclgevf_resp_to_errno (resp_status);memcpy (resp->additional_info, req->msg.resp_data,HCLGE_MBX_MAX_RESP_DATA_SIZE *sizeof (u8)); + +/* ensure additional_info will be seen before setting received_resp */ +smp_wmb (); +if (match_id) {/* If match_id is not zero, it means PF support match_id. * if the match_id is right, VF get the right response, or
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 131/372 net: hns3: fix incorrect capability bit display for copper port
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jian Shen <[email protected]>
[ Upstream commit 75b247b57d8b71bcb679e4cb37d0db104848806c ]
Currently, the FEC capability bit is default set for device version V2. It's incorrect for the copper port. Eventhough it doesn't make the nic work abnormal, but the capability information display in debugfs may confuse user. So clear it when driver get the port type inforamtion.
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +1 -0
@@ -11654,6 +11654,7 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev) goto err_msi_irq_uninit;if (hdev->hw.mac.media_type ==HNAE3_MEDIA_TYPE_COPPER ) { +clear_bit (HNAE3_DEV_SUPPORT_FEC_B , ae_dev->caps);if (hnae3_dev_phy_imp_supported (hdev)) ret =hclge_update_tp_port_info (hdev);else
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 132/372 net: hns3: fix out-of-bounds access may occur when coalesce info is read via debugfs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonglong Liu <[email protected]>
[ Upstream commit 53aba458f23846112c0d44239580ff59bc5c36c3 ]
The hns3 driver define an array of string to show the coalesce info, but if the kernel adds a new mode or a new state, out-of-bounds access may occur when coalesce info is read via debugfs, this patch fix the problem.
--- drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c +6 -3
@@ -494,11 +494,14 @@ static void hns3_get_coal_info(struct hns3_enet_tqp_vector *tqp_vector, }sprintf (result[j++],"%d" , i); -sprintf (result[j++],"%s" , dim_state_str[dim->state]); +sprintf (result[j++],"%s" , dim->state <ARRAY_SIZE (dim_state_str) ? + dim_state_str[dim->state] :"unknown" );sprintf (result[j++],"%u" , dim->profile_ix); -sprintf (result[j++],"%s" , dim_cqe_mode_str[dim->mode]); +sprintf (result[j++],"%s" , dim->mode <ARRAY_SIZE (dim_cqe_mode_str) ? + dim_cqe_mode_str[dim->mode] :"unknown" );sprintf (result[j++],"%s" , - dim_tune_stat_str[dim->tune_state]); + dim->tune_state <ARRAY_SIZE (dim_tune_stat_str) ? + dim_tune_stat_str[dim->tune_state] :"unknown" );sprintf (result[j++],"%u" , dim->steps_left);sprintf (result[j++],"%u" , dim->steps_right);sprintf (result[j++],"%u" , dim->tired);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 133/372 net: hns3: fix variable may not initialized problem in hns3_init_mac_addr()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonglong Liu <[email protected]>
[ Upstream commit dbd2f3b20c6ae425665b6975d766e3653d453e73 ]
When a VF is calling hns3_init_mac_addr(), get_mac_addr() may return fail, then the value of mac_addr_temp is not initialized.
--- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +1 -1
@@ -5139,7 +5139,7 @@ static int hns3_init_mac_addr(struct net_device *netdev)struct hns3_nic_priv *priv =netdev_priv (netdev);char format_mac_addr[HNAE3_FORMAT_MAC_ADDR_LEN ];struct hnae3_handle *h = priv->ae_handle; -u8 mac_addr_temp[ETH_ALEN ]; +u8 mac_addr_temp[ETH_ALEN ] = {0 };int ret =0 ;if (h->ae_algo->ops->get_mac_addr)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 134/372 net: hns3: fix VF reset fail issue
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jijie Shao <[email protected]>
[ Upstream commit 65e98bb56fa3ce2edb400930c05238c9b380500e ]
Currently the reset process in hns3 and firmware watchdog init process is asynchronous. We think firmware watchdog initialization is completed before VF clear the interrupt source. However, firmware initialization may not complete early. So VF will receive multiple reset interrupts and fail to reset.
So we add delay before VF interrupt source and 5 ms delay is enough to avoid second reset interrupt.
--- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 14 +++++++++++++- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h | 1 + 2 files changed, 14 insertions(+), 1 deletion(-)
drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +13 -1
@@ -2035,8 +2035,18 @@ static enum hclgevf_evt_cause hclgevf_check_evt_cause(struct hclgevf_dev *hdev,return HCLGEVF_VECTOR0_EVENT_OTHER ; } +static void hclgevf_reset_timer (struct timer_list *t) +{ +struct hclgevf_dev *hdev =from_timer (hdev, t, reset_timer); + +hclgevf_clear_event_cause (hdev,HCLGEVF_VECTOR0_EVENT_RST ); +hclgevf_reset_task_schedule (hdev); +} +static irqreturn_t hclgevf_misc_irq_handle (int irq,void *data) { +#define HCLGEVF_RESET_DELAY 5 +enum hclgevf_evt_cause event_cause;struct hclgevf_dev *hdev = data;u32 clearval;
@@ -2048,7 +2058,8 @@ static irqreturn_t hclgevf_misc_irq_handle(int irq, void *data)switch (event_cause) {case HCLGEVF_VECTOR0_EVENT_RST : -hclgevf_reset_task_schedule (hdev); +mod_timer (&hdev->reset_timer, + jiffies +msecs_to_jiffies (HCLGEVF_RESET_DELAY ));break ;case HCLGEVF_VECTOR0_EVENT_MBX :hclgevf_mbx_handler (hdev);
@@ -2994,6 +3005,7 @@ static int hclgevf_init_hdev(struct hclgevf_dev *hdev) HCLGEVF_DRIVER_NAME);hclgevf_task_schedule (hdev,round_jiffies_relative (HZ )); +timer_setup (&hdev->reset_timer, hclgevf_reset_timer,0 );return 0 ;
drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h +1 -0
@@ -219,6 +219,7 @@ struct hclgevf_dev {enum hnae3_reset_type reset_level;unsigned long reset_pending;enum hnae3_reset_type reset_type; +struct timer_list reset_timer;#define HCLGEVF_RESET_REQUESTED 0#define HCLGEVF_RESET_PENDING 1
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 135/372 net: hns3: fix VF wrong speed and duplex issue
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jijie Shao <[email protected]>
[ Upstream commit dff655e82faffc287d4a72a59f66fa120bf904e4 ]
If PF is down, firmware will returns 10 Mbit/s rate and half-duplex mode when PF queries the port information from firmware.
After imp reset command is executed, PF status changes to down, and PF will query link status and updates port information from firmware in a periodic scheduled task.
However, there is a low probability that port information is updated when PF is down, and then PF link status changes to up. In this case, PF synchronizes incorrect rate and duplex mode to VF.
This patch fixes it by updating port information before PF synchronizes the rate and duplex to the VF when PF changes to up.
--- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +4 -0
@@ -74,6 +74,7 @@ static void hclge_sync_fd_table(struct hclge_dev *hdev);static void hclge_update_fec_stats (struct hclge_dev *hdev);static int hclge_mac_link_status_wait (struct hclge_dev *hdev,int link_ret,int wait_cnt); +static int hclge_update_port_info (struct hclge_dev *hdev);static struct hnae3_ae_algo ae_algo;
@@ -3141,6 +3142,9 @@ static void hclge_update_link_status(struct hclge_dev *hdev)if (state != hdev->hw.mac.link) { hdev->hw.mac.link = state; +if (state ==HCLGE_LINK_STATUS_UP ) +hclge_update_port_info (hdev); + client->ops->link_status_change (handle, state);hclge_config_mac_tnl_int (hdev, state);if (rclient && rclient->ops->link_status_change)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 136/372 tipc: Fix kernel-infoleak due to uninitialized TLV value
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shigeru Yoshida <[email protected]>
[ Upstream commit fb317eb23b5ee4c37b0656a9a52a3db58d9dd072 ]
KMSAN reported the following kernel-infoleak issue:
=====================================================
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in copy_to_user_iter lib/iov_iter.c:24 [inline] BUG: KMSAN: kernel-infoleak in iterate_ubuf include/linux/iov_iter.h:29 [inline] BUG: KMSAN: kernel-infoleak in iterate_and_advance2 include/linux/iov_iter.h:245 [inline] BUG: KMSAN: kernel-infoleak in iterate_and_advance include/linux/iov_iter.h:271 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x4ec/0x2bc0 lib/iov_iter.c:186 instrument_copy_to_user include/linux/instrumented.h:114 [inline] copy_to_user_iter lib/iov_iter.c:24 [inline] iterate_ubuf include/linux/iov_iter.h:29 [inline] iterate_and_advance2 include/linux/iov_iter.h:245 [inline] iterate_and_advance include/linux/iov_iter.h:271 [inline] _copy_to_iter+0x4ec/0x2bc0 lib/iov_iter.c:186 copy_to_iter include/linux/uio.h:197 [inline] simple_copy_to_iter net/core/datagram.c:532 [inline] __skb_datagram_iter.5+0x148/0xe30 net/core/datagram.c:420 skb_copy_datagram_iter+0x52/0x210 net/core/datagram.c:546 skb_copy_datagram_msg include/linux/skbuff.h:3960 [inline] netlink_recvmsg+0x43d/0x1630 net/netlink/af_netlink.c:1967 sock_recvmsg_nosec net/socket.c:1044 [inline] sock_recvmsg net/socket.c:1066 [inline] __sys_recvfrom+0x476/0x860 net/socket.c:2246 __do_sys_recvfrom net/socket.c:2264 [inline] __se_sys_recvfrom net/socket.c:2260 [inline] __x64_sys_recvfrom+0x130/0x200 net/socket.c:2260 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was created at:
slab_post_alloc_hook+0x103/0x9e0 mm/slab.h:768 slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x5f7/0xb50 mm/slub.c:3523 kmalloc_reserve+0x13c/0x4a0 net/core/skbuff.c:560 __alloc_skb+0x2fd/0x770 net/core/skbuff.c:651 alloc_skb include/linux/skbuff.h:1286 [inline] tipc_tlv_alloc net/tipc/netlink_compat.c:156 [inline] tipc_get_err_tlv+0x90/0x5d0 net/tipc/netlink_compat.c:170 tipc_nl_compat_recv+0x1042/0x15d0 net/tipc/netlink_compat.c:1324 genl_family_rcv_msg_doit net/netlink/genetlink.c:972 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1052 [inline] genl_rcv_msg+0x1220/0x12c0 net/netlink/genetlink.c:1067 netlink_rcv_skb+0x4a4/0x6a0 net/netlink/af_netlink.c:2545 genl_rcv+0x41/0x60 net/netlink/genetlink.c:1076 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] netlink_unicast+0xf4b/0x1230 net/netlink/af_netlink.c:1368 netlink_sendmsg+0x1242/0x1420 net/netlink/af_netlink.c:1910 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x997/0xd60 net/socket.c:2588 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2642 __sys_sendmsg net/socket.c:2671 [inline] __do_sys_sendmsg net/socket.c:2680 [inline] __se_sys_sendmsg net/socket.c:2678 [inline] __x64_sys_sendmsg+0x2fa/0x4a0 net/socket.c:2678 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x63/0x6b
Bytes 34-35 of 36 are uninitialized
Memory access of size 36 starts at ffff88802d464a00 Data copied to user address 00007ff55033c0a0
CPU: 0 PID: 30322 Comm: syz-executor.0 Not tainted 6.6.0-14500-g1c41041124bd #10 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-1.fc38 04/01/2014 =====================================================
tipc_add_tlv() puts TLV descriptor and value onto skb. This size is calculated with TLV_SPACE() macro. It adds the size of struct tlv_desc and the length of TLV value passed as an argument, and aligns the result to a multiple of TLV_ALIGNTO, i.e., a multiple of 4 bytes.
If the size of struct tlv_desc plus the length of TLV value is not aligned, the current implementation leaves the remaining bytes uninitialized. This is the cause of the above kernel-infoleak issue.
This patch resolves this issue by clearing data up to an aligned size.
--- net/tipc/netlink_compat.c | 1 + 1 file changed, 1 insertion(+)
net/tipc/netlink_compat.c +1 -0
@@ -101,6 +101,7 @@ static int tipc_add_tlv(struct sk_buff *skb, u16 type, void *data, u16 len)return -EMSGSIZE ;skb_put (skb,TLV_SPACE (len)); +memset (tlv,0 ,TLV_SPACE (len)); tlv->tlv_type =htons (type); tlv->tlv_len =htons (TLV_LENGTH (len));if (len && data)
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 137/372 net: mvneta: fix calls to page_pool_get_stats
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Auhagen <[email protected]>
[ Upstream commit ca8add922f9c7f6e2e3c71039da8e0dcc64b87ed ]
Calling page_pool_get_stats in the mvneta driver without checks leads to kernel crashes.
First the page pool is only available if the bm is not used. The page pool is also not allocated when the port is stopped. It can also be not allocated in case of errors.
The current implementation leads to the following crash calling ethstats on a port that is down or when calling it at the wrong moment:
ble to handle kernel NULL pointer dereference at virtual address 00000070 [00000070] *pgd=00000000
Internal error: Oops: 5 [#1] SMP ARM Hardware name: Marvell Armada 380/385 (Device Tree) PC is at page_pool_get_stats+0x18/0x1cc LR is at mvneta_ethtool_get_stats+0xa0/0xe0 [mvneta] pc : [<c0b413cc>] lr : [<bf0a98d8>] psr: a0000013
sp : f1439d48 ip : f1439dc0 fp : 0000001d
r10: 00000100 r9 : c4816b80 r8 : f0d75150
r7 : bf0b400c r6 : c238f000 r5 : 00000000 r4 : f1439d68
r3 : c2091040 r2 : ffffffd8 r1 : f1439d68 r0 : 00000000
Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
Control: 10c5387d Table: 066b004a DAC: 00000051
Register r0 information: NULL pointer
Register r1 information: 2-page vmalloc region starting at 0xf1438000 allocated at kernel_clone+0x9c/0x390 Register r2 information: non-paged memory
Register r3 information: slab kmalloc-2k start c2091000 pointer offset 64 size 2048
Register r4 information: 2-page vmalloc region starting at 0xf1438000 allocated at kernel_clone+0x9c/0x390 Register r5 information: NULL pointer
Register r6 information: slab kmalloc-cg-4k start c238f000 pointer offset 0 size 4096
Register r7 information: 15-page vmalloc region starting at 0xbf0a8000 allocated at load_module+0xa30/0x219c Register r8 information: 1-page vmalloc region starting at 0xf0d75000 allocated at ethtool_get_stats+0x138/0x208 Register r9 information: slab task_struct start c4816b80 pointer offset 0
Register r10 information: non-paged memory
Register r11 information: non-paged memory
Register r12 information: 2-page vmalloc region starting at 0xf1438000 allocated at kernel_clone+0x9c/0x390 Process snmpd (pid: 733, stack limit = 0x38de3a88)
Stack: (0xf1439d48 to 0xf143a000)
9d40: 000000c0 00000001 c238f000 bf0b400c f0d75150 c4816b80
9d60: 00000100 bf0a98d8 00000000 00000000 00000000 00000000 00000000 00000000 9d80: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9da0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9dc0: 00000dc0 5335509c 00000035 c238f000 bf0b2214 01067f50 f0d75000 c0b9b9c8 9de0: 0000001d 00000035 c2212094 5335509c c4816b80 c238f000 c5ad6e00 01067f50 9e00: c1b0be80 c4816b80 00014813 c0b9d7f0 00000000 00000000 0000001d 0000001d 9e20: 00000000 00001200 00000000 00000000 c216ed90 c73943b8 00000000 00000000 9e40: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9e60: 00000000 c0ad9034 00000000 00000000 00000000 00000000 00000000 00000000 9e80: 00000000 00000000 00000000 5335509c c1b0be80 f1439ee4 00008946 c1b0be80 9ea0: 01067f50 f1439ee3 00000000 00000046 b6d77ae0 c0b383f0 00008946 becc83e8 9ec0: c1b0be80 00000051 0000000b c68ca480 c7172d00 c0ad8ff0 f1439ee3 cf600e40 9ee0: 01600e40 32687465 00000000 00000000 00000000 01067f50 00000000 00000000 9f00: 00000000 5335509c 00008946 00008946 00000000 c68ca480 becc83e8 c05e2de0 9f20: f1439fb0 c03002f0 00000006 5ac3c35a c4816b80 00000006 b6d77ae0 c030caf0 9f40: c4817350 00000014 f1439e1c 0000000c 00000000 00000051 01000000 00000014 9f60: 00003fec f1439edc 00000001 c0372abc b6d77ae0 c0372abc cf600e40 5335509c 9f80: c21e6800 01015c9c 0000000b 00008946 00000036 c03002f0 c4816b80 00000036 9fa0: b6d77ae0 c03000c0 01015c9c 0000000b 0000000b 00008946 becc83e8 00000000 9fc0: 01015c9c 0000000b 00008946 00000036 00000035 010678a0 b6d797ec b6d77ae0 9fe0: b6dbf738 becc838c b6d186d7 b6baa858 40000030 0000000b 00000000 00000000
page_pool_get_stats from mvneta_ethtool_get_stats+0xa0/0xe0 [mvneta] mvneta_ethtool_get_stats [mvneta] from ethtool_get_stats+0x154/0x208 ethtool_get_stats from dev_ethtool+0xf48/0x2480
dev_ethtool from dev_ioctl+0x538/0x63c
dev_ioctl from sock_ioctl+0x49c/0x53c
sock_ioctl from sys_ioctl+0x134/0xbd8
sys_ioctl from ret_fast_syscall+0x0/0x1c
Exception stack(0xf1439fa8 to 0xf1439ff0) 9fa0: 01015c9c 0000000b 0000000b 00008946 becc83e8 00000000 9fc0: 01015c9c 0000000b 00008946 00000036 00000035 010678a0 b6d797ec b6d77ae0 9fe0: b6dbf738 becc838c b6d186d7 b6baa858 Code: e28dd004 e1a05000 e2514000 0a00006a (e5902070)
This commit adds the proper checks before calling page_pool_get_stats.
--- drivers/net/ethernet/marvell/mvneta.c | 28 +++++++++++++++++++-------- 1 file changed, 20 insertions(+), 8 deletions(-)
drivers/net/ethernet/marvell/mvneta.c +20 -8
@@ -4730,14 +4730,17 @@ static void mvneta_ethtool_get_strings(struct net_device *netdev, u32 sset, u8 *data) {if (sset ==ETH_SS_STATS ) { +struct mvneta_port *pp =netdev_priv (netdev);int i;for (i =0 ; i <ARRAY_SIZE (mvneta_statistics); i++)memcpy (data + i *ETH_GSTRING_LEN , mvneta_statistics[i].name,ETH_GSTRING_LEN ); - data +=ETH_GSTRING_LEN *ARRAY_SIZE (mvneta_statistics); -page_pool_ethtool_stats_get_strings (data); +if (!pp->bm_priv) { + data +=ETH_GSTRING_LEN *ARRAY_SIZE (mvneta_statistics); +page_pool_ethtool_stats_get_strings (data); + } } }
@@ -4855,8 +4858,10 @@ static void mvneta_ethtool_pp_stats(struct mvneta_port *pp, u64 *data)struct page_pool_stats stats = {};int i; -for (i =0 ; i < rxq_number; i++) -page_pool_get_stats (pp->rxqs[i].page_pool, &stats); +for (i =0 ; i < rxq_number; i++) { +if (pp->rxqs[i].page_pool) +page_pool_get_stats (pp->rxqs[i].page_pool, &stats); + }page_pool_ethtool_stats_get (data, &stats); }
@@ -4872,14 +4877,21 @@ static void mvneta_ethtool_get_stats(struct net_device *dev,for (i =0 ; i <ARRAY_SIZE (mvneta_statistics); i++) *data++ = pp->ethtool_stats[i]; -mvneta_ethtool_pp_stats (pp, data); +if (!pp->bm_priv) +mvneta_ethtool_pp_stats (pp, data); }static int mvneta_ethtool_get_sset_count (struct net_device *dev,int sset) { -if (sset ==ETH_SS_STATS ) -return ARRAY_SIZE (mvneta_statistics) + -page_pool_ethtool_stats_get_count (); +if (sset ==ETH_SS_STATS ) { +int count =ARRAY_SIZE (mvneta_statistics); +struct mvneta_port *pp =netdev_priv (dev); + +if (!pp->bm_priv) + count +=page_pool_ethtool_stats_get_count (); + +return count; + }return -EOPNOTSUPP ; }
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 138/372 ppp: limit MRU to 64K
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <[email protected]>
[ Upstream commit c0a2a1b0d631fc460d830f52d06211838874d655 ]
ppp_sync_ioctl allows setting device MRU, but does not sanity check this input.
Limit to a sane upper bound of 64KB.
No implementation I could find generates larger than 64KB frames. RFC 2823 mentions an upper bound of PPP over SDL of 64KB based on the 16-bit length field. Other protocols will be smaller, such as PPPoE (9KB jumbo frame) and PPPoA (18190 maximum CPCS-SDU size, RFC 2364). PPTP and L2TP encapsulate in IP.
Syzbot managed to trigger alloc warning in __alloc_pages:
if (WARN_ON_ONCE_GFP(order > MAX_ORDER, gfp))
WARNING: CPU: 1 PID: 37 at mm/page_alloc.c:4544 __alloc_pages+0x3ab/0x4a0 mm/page_alloc.c:4544
__alloc_skb+0x12b/0x330 net/core/skbuff.c:651
__netdev_alloc_skb+0x72/0x3f0 net/core/skbuff.c:715
netdev_alloc_skb include/linux/skbuff.h:3225 [inline]
dev_alloc_skb include/linux/skbuff.h:3238 [inline]
ppp_sync_input drivers/net/ppp/ppp_synctty.c:669 [inline]
ppp_sync_receive+0xff/0x680 drivers/net/ppp/ppp_synctty.c:334
tty_ldisc_receive_buf+0x14c/0x180 drivers/tty/tty_buffer.c:390
tty_port_default_receive_buf+0x70/0xb0 drivers/tty/tty_port.c:37
receive_buf drivers/tty/tty_buffer.c:444 [inline]
flush_to_ldisc+0x261/0x780 drivers/tty/tty_buffer.c:494
process_one_work+0x884/0x15c0 kernel/workqueue.c:2630With call
ioctl$PPPIOCSMRU1(r1, 0x40047452, &(0x7f0000000100)=0x5e6417a8)
Similar code exists in other drivers that implement ppp_channel_ops ioctl PPPIOCSMRU. Those might also be in scope. Notably excluded from this are pppol2tp_ioctl and pppoe_ioctl.
This code goes back to the start of git history.
--- drivers/net/ppp/ppp_synctty.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ppp/ppp_synctty.c +4 -0
@@ -462,6 +462,10 @@ ppp_sync_ioctl(struct ppp_channel *chan, unsigned int cmd, unsigned long arg)case PPPIOCSMRU :if (get_user (val, (int __user *) argp))break ; +if (val >U16_MAX ) { + err = -EINVAL ; +break ; + }if (val <PPP_MRU ) val =PPP_MRU ; ap->mru = val;
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 139/372 xen/events: fix delayed eoi list handling
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <[email protected]>
[ Upstream commit 47d970204054f859f35a2237baa75c2d84fcf436 ]
When delaying eoi handling of events, the related elements are queued into the percpu lateeoi list. In case the list isn't empty, the elements should be sorted by the time when eoi handling is to happen.
Unfortunately a new element will never be queued at the start of the list, even if it has a handling time lower than all other list elements.
Fix that by handling that case the same way as for an empty list.
--- drivers/xen/events/events_base.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/xen/events/events_base.c +3 -1
@@ -600,7 +600,9 @@ static void lateeoi_list_add(struct irq_info *info)spin_lock_irqsave (&eoi->eoi_list_lock, flags); -if (list_empty (&eoi->eoi_list)) { + elem = list_first_entry_or_null(&eoi->eoi_list, struct irq_info, + eoi_list); +if (!elem || info->eoi_time < elem->eoi_time) {list_add (&info->eoi_list, &eoi->eoi_list);mod_delayed_work_on (info->eoi_cpu, system_wq, &eoi->delayed, delay);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 140/372 ptp: annotate data-race around q->head and q->tail
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 73bde5a3294853947252cd9092a3517c7cb0cd2d ]
As I was working on a syzbot report, I found that KCSAN would probably complain that reading q->head or q->tail without barriers could lead to invalid results.
Add corresponding READ_ONCE() and WRITE_ONCE() to avoid load-store tearing.
--- drivers/ptp/ptp_chardev.c | 3 ++- drivers/ptp/ptp_clock.c | 5 +++-- drivers/ptp/ptp_private.h | 8 ++++++-- drivers/ptp/ptp_sysfs.c | 3 ++- 4 files changed, 13 insertions(+), 6 deletions(-)
drivers/ptp/ptp_chardev.c +2 -1
@@ -487,7 +487,8 @@ ssize_t ptp_read(struct posix_clock *pc,for (i =0 ; i < cnt; i++) { event[i] = queue->buf[queue->head]; - queue->head = (queue->head +1 ) %PTP_MAX_TIMESTAMPS ; +/* Paired with READ_ONCE() in queue_cnt() */ +WRITE_ONCE (queue->head, (queue->head +1 ) %PTP_MAX_TIMESTAMPS ); }spin_unlock_irqrestore (&queue->lock, flags);
drivers/ptp/ptp_clock.c +3 -2
@@ -56,10 +56,11 @@ static void enqueue_external_timestamp(struct timestamp_event_queue *queue, dst->t.sec = seconds; dst->t.nsec = remainder; +/* Both WRITE_ONCE() are paired with READ_ONCE() in queue_cnt() */ if (!queue_free (queue)) - queue->head = (queue->head +1 ) %PTP_MAX_TIMESTAMPS ; +WRITE_ONCE (queue->head, (queue->head +1 ) %PTP_MAX_TIMESTAMPS ); - queue->tail = (queue->tail +1 ) %PTP_MAX_TIMESTAMPS ; +WRITE_ONCE (queue->tail, (queue->tail +1 ) %PTP_MAX_TIMESTAMPS );spin_unlock_irqrestore (&queue->lock, flags); }
drivers/ptp/ptp_private.h +6 -2
@@ -76,9 +76,13 @@ struct ptp_vclock {* that a writer might concurrently increment the tail does not * matter, since the queue remains nonempty nonetheless. */ -static inline int queue_cnt (struct timestamp_event_queue *q) +static inline int queue_cnt (const struct timestamp_event_queue *q) { -int cnt = q->tail - q->head; +/* +* Paired with WRITE_ONCE() in enqueue_external_timestamp(), +* ptp_read(), extts_fifo_show(). +*/ +int cnt =READ_ONCE (q->tail) -READ_ONCE (q->head);return cnt <0 ?PTP_MAX_TIMESTAMPS + cnt : cnt; }
drivers/ptp/ptp_sysfs.c +2 -1
@@ -79,7 +79,8 @@ static ssize_t extts_fifo_show(struct device *dev, qcnt =queue_cnt (queue);if (qcnt) { event = queue->buf[queue->head]; - queue->head = (queue->head +1 ) %PTP_MAX_TIMESTAMPS ; +/* Paired with READ_ONCE() in queue_cnt() */ +WRITE_ONCE (queue->head, (queue->head +1 ) %PTP_MAX_TIMESTAMPS ); }spin_unlock_irqrestore (&queue->lock, flags);
Signature · 1 line
2.42.0
Greg Kroah-Hartman
maintainerPATCH 141/372 bonding: stop the device in bond_setup_by_slave()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 3cffa2ddc4d3fcf70cde361236f5a614f81a09b2 ]
Commit 9eed321cde22 ("net: lapbether: only support ethernet devices") has been able to keep syzbot away from net/lapb, until today.
In the following splat [1], the issue is that a lapbether device has been created on a bonding device without members. Then adding a non ARPHRD_ETHER member forced the bonding master to change its type.
The fix is to make sure we call dev_close() in bond_setup_by_slave() so that the potential linked lapbether devices (or any other devices having assumptions on the physical device) are removed.
A similar bug has been addressed in commit 40baec225765 ("bonding: fix panic on non-ARPHRD_ETHER enslave failure")
[1]
skbuff: skb_under_panic: text:ffff800089508810 len:44 put:40 head:ffff0000c78e7c00 data:ffff0000c78e7bea tail:0x16 end:0x140 dev:bond0 kernel BUG at net/core/skbuff.c:192 !
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 6007 Comm: syz-executor383 Not tainted 6.6.0-rc3-syzkaller-gbf6547d8715b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : skb_panic net/core/skbuff.c:188 [inline] pc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:202 lr : skb_panic net/core/skbuff.c:188 [inline] lr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:202
sp : ffff800096a06aa0
x29: ffff800096a06ab0 x28: ffff800096a06ba0 x27: dfff800000000000
x26: ffff0000ce9b9b50 x25: 0000000000000016 x24: ffff0000c78e7bea
x23: ffff0000c78e7c00 x22: 000000000000002c x21: 0000000000000140
x20: 0000000000000028 x19: ffff800089508810 x18: ffff800096a06100
x17: 0000000000000000 x16: ffff80008a629a3c x15: 0000000000000001
x14: 1fffe00036837a32 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000201 x10: 0000000000000000 x9 : cb50b496c519aa00 x8 : cb50b496c519aa00 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff800096a063b8 x4 : ffff80008e280f80 x3 : ffff8000805ad11c x2 : 0000000000000001 x1 : 0000000100000201 x0 : 0000000000000086
Call trace: skb_panic net/core/skbuff.c:188 [inline] skb_under_panic+0x13c/0x140 net/core/skbuff.c:202 skb_push+0xf0/0x108 net/core/skbuff.c:2446 ip6gre_header+0xbc/0x738 net/ipv6/ip6_gre.c:1384 dev_hard_header include/linux/netdevice.h:3136 [inline] lapbeth_data_transmit+0x1c4/0x298 drivers/net/wan/lapbether.c:257 lapb_data_transmit+0x8c/0xb0 net/lapb/lapb_iface.c:447 lapb_transmit_buffer+0x178/0x204 net/lapb/lapb_out.c:149 lapb_send_control+0x220/0x320 net/lapb/lapb_subr.c:251 __lapb_disconnect_request+0x9c/0x17c net/lapb/lapb_iface.c:326 lapb_device_event+0x288/0x4e0 net/lapb/lapb_iface.c:492 notifier_call_chain+0x1a4/0x510 kernel/notifier.c:93 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461 call_netdevice_notifiers_info net/core/dev.c:1970 [inline] call_netdevice_notifiers_extack net/core/dev.c:2008 [inline] call_netdevice_notifiers net/core/dev.c:2022 [inline] __dev_close_many+0x1b8/0x3c4 net/core/dev.c:1508 dev_close_many+0x1e0/0x470 net/core/dev.c:1559 dev_close+0x174/0x250 net/core/dev.c:1585 lapbeth_device_event+0x2e4/0x958 drivers/net/wan/lapbether.c:466 notifier_call_chain+0x1a4/0x510 kernel/notifier.c:93 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461 call_netdevice_notifiers_info net/core/dev.c:1970 [inline] call_netdevice_notifiers_extack net/core/dev.c:2008 [inline] call_netdevice_notifiers net/core/dev.c:2022 [inline] __dev_close_many+0x1b8/0x3c4 net/core/dev.c:1508 dev_close_many+0x1e0/0x470 net/core/dev.c:1559 dev_close+0x174/0x250 net/core/dev.c:1585 bond_enslave+0x2298/0x30cc drivers/net/bonding/bond_main.c:2332 bond_do_ioctl+0x268/0xc64 drivers/net/bonding/bond_main.c:4539 dev_ifsioc+0x754/0x9ac dev_ioctl+0x4d8/0xd34 net/core/dev_ioctl.c:786 sock_do_ioctl+0x1d4/0x2d0 net/socket.c:1217 sock_ioctl+0x4e8/0x834 net/socket.c:1322 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl fs/ioctl.c:857 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:857 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155 el0_svc+0x58/0x16c arch/arm64/kernel/entry-common.c:678 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591 Code: aa1803e6 aa1903e7 a90023f5 94785b8b (d4210000)
--- drivers/net/bonding/bond_main.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/bonding/bond_main.c +6 -0
@@ -1503,6 +1503,10 @@ static void bond_compute_features(struct bonding *bond)static void bond_setup_by_slave (struct net_device *bond_dev,struct net_device *slave_dev) { +bool was_up = !!(bond_dev->flags &IFF_UP ); + +dev_close (bond_dev); + bond_dev->header_ops = slave_dev->header_ops; bond_dev->type = slave_dev->type;
@@ -1517,6 +1521,8 @@ static void bond_setup_by_slave(struct net_device *bond_dev, bond_dev->flags &= ~(IFF_BROADCAST |IFF_MULTICAST ); bond_dev->flags |= (IFF_POINTOPOINT |IFF_NOARP ); } +if (was_up) +dev_open (bond_dev,NULL ); }/* On bonding slaves other than the currently active slave, suppress
Signature · 1 line
2.42.0