6.1.72-rc1 review
Subsystems (6)
Greg Kroah-Hartman
maintainerPATCH 116/150 genirq/affinity: Move group_cpus_evenly() into lib/
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
[ Upstream commit f7b3ea8cf72f3d6060fe08e461805181e7450a13 ]
group_cpus_evenly() has become a generic function which can be used for other subsystems than the interrupt subsystem, so move it into lib/.
Stable-dep-of: 0263f92fadbb ("lib/group_cpus.c: avoid acquiring cpu hotplug lock in group_cpus_evenly")
--- MAINTAINERS | 2 + include/linux/group_cpus.h | 14 ++ kernel/irq/affinity.c | 398 +--------------------------------- lib/Makefile | 2 + lib/group_cpus.c | 427 +++++++++++++++++++++++++++++++++++++ 5 files changed, 446 insertions(+), 397 deletions(-) create mode 100644 include/linux/group_cpus.h create mode 100644 lib/group_cpus.c
MAINTAINERS +2 -0
@@ -10803,6 +10803,8 @@ L: [email protected] S: Maintained T: git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git irq/core F: kernel/irq/ +F: include/linux/group_cpus.h +F: lib/group_cpus.c IRQCHIP DRIVERS M: Thomas Gleixner <[email protected]>
include/linux/group_cpus.h new file +14 -0
@@ -0,0 +1,14 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* +* Copyright (C) 2016 Thomas Gleixner. +* Copyright (C) 2016-2017 Christoph Hellwig. +*/ + +#ifndef __LINUX_GROUP_CPUS_H +#define __LINUX_GROUP_CPUS_H +#include <linux/kernel.h> +#include <linux/cpu.h> + +struct cpumask *group_cpus_evenly (unsigned int numgrps); + +#endif
kernel/irq/affinity.c +1 -397
404 lines not on this page · raw message
lib/Makefile +2 -0
@@ -361,6 +361,8 @@ obj-$(CONFIG_SBITMAP) += sbitmap.o obj-$(CONFIG_PARMAN) += parman.o +obj-y += group_cpus.o + # GCC library routines obj-$(CONFIG_GENERIC_LIB_ASHLDI3) += ashldi3.o obj-$(CONFIG_GENERIC_LIB_ASHRDI3) += ashrdi3.o
lib/group_cpus.c new file +427 -0
427 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/150 lib/group_cpus.c: avoid acquiring cpu hotplug lock in group_cpus_evenly
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
[ Upstream commit 0263f92fadbb9d294d5971ac57743f882c93b2b3 ]
group_cpus_evenly() could be part of storage driver's error handler, such as nvme driver, when may happen during CPU hotplug, in which storage queue has to drain its pending IOs because all CPUs associated with the queue are offline and the queue is becoming inactive. And handling IO needs error handler to provide forward progress.
Then deadlock is caused:
1) inside CPU hotplug handler, CPU hotplug lock is held, and blk-mq's handler is waiting for inflight IO
2) error handler is waiting for CPU hotplug lock
3) inflight IO can't be completed in blk-mq's CPU hotplug handler because error handling can't provide forward progress.
Solve the deadlock by not holding CPU hotplug lock in group_cpus_evenly(), in which two stage spreads are taken: 1) the 1st stage is over all present CPUs; 2) the end stage is over all other CPUs.
Turns out the two stage spread just needs consistent 'cpu_present_mask', and remove the CPU hotplug lock by storing it into one local cache. This way doesn't change correctness, because all CPUs are still covered.
--- lib/group_cpus.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-)
lib/group_cpus.c +16 -6
@@ -365,13 +365,25 @@ struct cpumask *group_cpus_evenly(unsigned int numgrps)if (!masks) goto fail_node_to_cpumask; -/* Stabilize the cpumasks */ -cpus_read_lock ();build_node_to_cpumask (node_to_cpumask); +/* +* Make a local cache of 'cpu_present_mask', so the two stages +* spread can observe consistent 'cpu_present_mask' without holding +* cpu hotplug lock, then we can reduce deadlock risk with cpu +* hotplug code. +* +* Here CPU hotplug may happen when reading `cpu_present_mask`, and +* we can live with the case because it only affects that hotplug +* CPU is handled in the 1st or 2nd stage, and either way is correct +* from API user viewpoint since 2-stage spread is sort of +* optimization. +*/ +cpumask_copy (npresmsk,data_race (cpu_present_mask)); +/* grouping present CPUs first */ ret =__group_cpus_evenly (curgrp, numgrps, node_to_cpumask, - cpu_present_mask, nmsk, masks); + npresmsk, nmsk, masks);if (ret <0 ) goto fail_build_affinity; nr_present = ret;
@@ -386,15 +398,13 @@ struct cpumask *group_cpus_evenly(unsigned int numgrps) curgrp =0 ; else curgrp = nr_present; -cpumask_andnot (npresmsk, cpu_possible_mask, cpu_present_mask); +cpumask_andnot (npresmsk, cpu_possible_mask, npresmsk); ret =__group_cpus_evenly (curgrp, numgrps, node_to_cpumask, npresmsk, nmsk, masks);if (ret >=0 ) nr_others = ret; fail_build_affinity: -cpus_read_unlock (); -if (ret >=0 )WARN_ON (nr_present + nr_others < numgrps);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/150 mm/memory_hotplug: add missing mem_hotplug_lock
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumanth Korikkar <[email protected]>
[ Upstream commit 001002e73712cdf6b8d9a103648cda3040ad7647 ]
Quoted 1 line
From
Documentation/core-api/memory-hotplug.rst:
When adding/removing/onlining/offlining memory or adding/removing heterogeneous/device memory, we should always hold the mem_hotplug_lock in write mode to serialise memory hotplug (e.g. access to global/zone variables).
mhp_(de)init_memmap_on_memory() functions can change zone stats and struct page content, but they are currently called w/o the mem_hotplug_lock.
When memory block is being offlined and when kmemleak goes through each populated zone, the following theoretical race conditions could occur:
CPU 0: | CPU 1:memory_offline() |
-> offline_pages() |
-> mem_hotplug_begin() | ... | -> mem_hotplug_done() | | kmemleak_scan() | -> get_online_mems() | ...
-> mhp_deinit_memmap_on_memory() |
[not protected by mem_hotplug_begin/done()]|
Marks memory section as offline, | Retrieves zone_start_pfn
poisons vmemmap struct pages and updates | and struct page members.
the zone related data |
| ...
| -> put_online_mems()
Fix this by ensuring mem_hotplug_lock is taken before performing mhp_init_memmap_on_memory(). Also ensure that mhp_deinit_memmap_on_memory() holds the lock.
online/offline_pages() are currently only called from memory_block_online/offline(), so it is safe to move the locking there.
--- drivers/base/memory.c | 18 +++++++++++++++--- mm/memory_hotplug.c | 13 ++++++------- 2 files changed, 21 insertions(+), 10 deletions(-)
drivers/base/memory.c +15 -3
@@ -175,6 +175,9 @@ int memory_notify(unsigned long val, void *v)return blocking_notifier_call_chain (&memory_chain, val, v); } +/* +* Must acquire mem_hotplug_lock in write mode. +*/ static int memory_block_online (struct memory_block *mem) {unsigned long start_pfn =section_nr_to_pfn (mem->start_section_nr);
@@ -193,10 +196,11 @@ static int memory_block_online(struct memory_block *mem)* stage helps to keep accounting easier to follow - e.g vmemmaps * belong to the same zone as the memory they backed. */ +mem_hotplug_begin ();if (nr_vmemmap_pages) { ret =mhp_init_memmap_on_memory (start_pfn, nr_vmemmap_pages, zone);if (ret) -return ret; + goto out; } ret = online_pages(start_pfn + nr_vmemmap_pages,
@@ -204,7 +208,7 @@ static int memory_block_online(struct memory_block *mem)if (ret) {if (nr_vmemmap_pages)mhp_deinit_memmap_on_memory (start_pfn, nr_vmemmap_pages); -return ret; + goto out; }/*
@@ -216,9 +220,14 @@ static int memory_block_online(struct memory_block *mem) nr_vmemmap_pages); mem->zone = zone; +out: +mem_hotplug_done ();return ret; } +/* +* Must acquire mem_hotplug_lock in write mode. +*/ static int memory_block_offline (struct memory_block *mem) {unsigned long start_pfn =section_nr_to_pfn (mem->start_section_nr);
@@ -233,6 +242,7 @@ static int memory_block_offline(struct memory_block *mem)* Unaccount before offlining, such that unpopulated zone and kthreads * can properly be torn down in offline_pages(). */ +mem_hotplug_begin ();if (nr_vmemmap_pages)adjust_present_page_count (pfn_to_page (start_pfn), mem->group, -nr_vmemmap_pages);
@@ -244,13 +254,15 @@ static int memory_block_offline(struct memory_block *mem)if (nr_vmemmap_pages)adjust_present_page_count (pfn_to_page (start_pfn), mem->group, nr_vmemmap_pages); -return ret; + goto out; }if (nr_vmemmap_pages)mhp_deinit_memmap_on_memory (start_pfn, nr_vmemmap_pages); mem->zone =NULL ; +out: +mem_hotplug_done ();return ret; }
mm/memory_hotplug.c +6 -7
@@ -1069,6 +1069,9 @@ void mhp_deinit_memmap_on_memory(unsigned long pfn, unsigned long nr_pages)kasan_remove_zero_shadow (__va (PFN_PHYS (pfn)),PFN_PHYS (nr_pages)); } +/* +* Must be called with mem_hotplug_lock in write mode. +*/ int __ref online_pages (unsigned long pfn,unsigned long nr_pages,struct zone *zone,struct memory_group *group) {
@@ -1089,7 +1092,6 @@ int __ref online_pages(unsigned long pfn, unsigned long nr_pages, !IS_ALIGNED(pfn + nr_pages, PAGES_PER_SECTION)))return -EINVAL ; -mem_hotplug_begin ();/* associate pfn range with the zone */ move_pfn_range_to_zone (zone, pfn, nr_pages,NULL ,MIGRATE_ISOLATE );
@@ -1148,7 +1150,6 @@ int __ref online_pages(unsigned long pfn, unsigned long nr_pages,writeback_set_ratelimit ();memory_notify (MEM_ONLINE , &arg); -mem_hotplug_done ();return 0 ; failed_addition:
@@ -1157,7 +1158,6 @@ int __ref online_pages(unsigned long pfn, unsigned long nr_pages, (((unsigned long long) pfn + nr_pages) << PAGE_SHIFT) - 1);memory_notify (MEM_CANCEL_ONLINE , &arg);remove_pfn_range_from_zone (zone, pfn, nr_pages); -mem_hotplug_done ();return ret; }
@@ -1787,6 +1787,9 @@ static int count_system_ram_pages_cb(unsigned long start_pfn,return 0 ; } +/* +* Must be called with mem_hotplug_lock in write mode. +*/ int __ref offline_pages (unsigned long start_pfn,unsigned long nr_pages,struct zone *zone,struct memory_group *group) {
@@ -1809,8 +1812,6 @@ int __ref offline_pages(unsigned long start_pfn, unsigned long nr_pages, !IS_ALIGNED(start_pfn + nr_pages, PAGES_PER_SECTION)))return -EINVAL ; -mem_hotplug_begin (); -/* * Don't allow to offline memory blocks that contain holes. * Consequently, memory blocks with holes can never get onlined
@@ -1946,7 +1947,6 @@ int __ref offline_pages(unsigned long start_pfn, unsigned long nr_pages,memory_notify (MEM_OFFLINE , &arg);remove_pfn_range_from_zone (zone, start_pfn, nr_pages); -mem_hotplug_done ();return 0 ; failed_removal_isolated:
@@ -1961,7 +1961,6 @@ int __ref offline_pages(unsigned long start_pfn, unsigned long nr_pages, (unsigned long long ) start_pfn <<PAGE_SHIFT , ((unsigned long long ) end_pfn <<PAGE_SHIFT ) -1 , reason); -mem_hotplug_done ();return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/150 mm/memory_hotplug: fix error handling in add_memory_resource()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sumanth Korikkar <[email protected]>
[ Upstream commit f42ce5f087eb69e47294ababd2e7e6f88a82d308 ]
In add_memory_resource(), creation of memory block devices occurs after successful call to arch_add_memory(). However, creation of memory block devices could fail. In that case, arch_remove_memory() is called to perform necessary cleanup.
Currently with or without altmap support, arch_remove_memory() is always passed with altmap set to NULL during error handling. This leads to freeing of struct pages using free_pages(), eventhough the allocation might have been performed with altmap support via altmap_alloc_block_buf().
Fix the error handling by passing altmap in arch_remove_memory(). This ensures the following:
* When altmap is disabled, deallocation of the struct pages array occurs via free_pages().
* When altmap is enabled, deallocation occurs via vmem_altmap_free().
--- mm/memory_hotplug.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/memory_hotplug.c +1 -1
@@ -1382,7 +1382,7 @@ int __ref add_memory_resource(int nid, struct resource *res, mhp_t mhp_flags) ret =create_memory_block_devices (start, size, mhp_altmap.alloc, group);if (ret) { -arch_remove_memory (start, size,NULL ); +arch_remove_memory (start, size, params.altmap); goto error; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/150 net: sched: call tcf_ct_params_free to free params in tcf_ct_init
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 1913894100ca53205f2d56091cb34b8eba1de217 ]
This patch is to make the err path simple by calling tcf_ct_params_free(), so that it won't cause problems when more members are added into param and need freeing on the err path.
Stable-dep-of: 125f1c7f26ff ("net/sched: act_ct: Take per-cb reference to tcf_ct_flow_table")
--- net/sched/act_ct.c | 35 ++++++++++++++++++----------------- 1 file changed, 18 insertions(+), 17 deletions(-)
net/sched/act_ct.c +18 -17
@@ -345,11 +345,9 @@ static void tcf_ct_flow_table_cleanup_work(struct work_struct *work)module_put (THIS_MODULE ); } -static void tcf_ct_flow_table_put (struct tcf_ct_params *params) +static void tcf_ct_flow_table_put (struct tcf_ct_flow_table *ct_ft) { -struct tcf_ct_flow_table *ct_ft = params->ct_ft; - -if (refcount_dec_and_test (¶ms->ct_ft->ref)) { +if (refcount_dec_and_test (&ct_ft->ref)) {rhashtable_remove_fast (&zones_ht, &ct_ft->node, zones_params);INIT_RCU_WORK (&ct_ft->rwork, tcf_ct_flow_table_cleanup_work);queue_rcu_work (act_ct_wq, &ct_ft->rwork);
@@ -832,18 +830,23 @@ static int tcf_ct_handle_fragments(struct net *net, struct sk_buff *skb,return err; } -static void tcf_ct_params_free (struct rcu_head *head) +static void tcf_ct_params_free (struct tcf_ct_params *params) { -struct tcf_ct_params *params =container_of (head, - struct tcf_ct_params, rcu); - -tcf_ct_flow_table_put (params); - +if (params->ct_ft) +tcf_ct_flow_table_put (params->ct_ft);if (params->tmpl)nf_ct_put (params->tmpl);kfree (params); } +static void tcf_ct_params_free_rcu (struct rcu_head *head) +{ +struct tcf_ct_params *params; + + params = container_of(head, struct tcf_ct_params, rcu); +tcf_ct_params_free (params); +} +#if IS_ENABLED (CONFIG_NF_NAT )/* Modelled after nf_nat_ipv[46]_fn(). * range is only used for new, uninitialized NAT state.
@@ -1390,7 +1393,7 @@ static int tcf_ct_init(struct net *net, struct nlattr *nla, err =tcf_ct_flow_table_get (net, params);if (err) - goto cleanup_params; + goto cleanup;spin_lock_bh (&c->tcf_lock); goto_ch =tcf_action_set_ctrlact (*a, parm->action, goto_ch);
@@ -1401,17 +1404,15 @@ static int tcf_ct_init(struct net *net, struct nlattr *nla,if (goto_ch)tcf_chain_put_by_act (goto_ch);if (params) -call_rcu (¶ms->rcu, tcf_ct_params_free); +call_rcu (¶ms->rcu, tcf_ct_params_free_rcu);return res; -cleanup_params: -if (params->tmpl) -nf_ct_put (params->tmpl); cleanup:if (goto_ch)tcf_chain_put_by_act (goto_ch); -kfree (params); +if (params) +tcf_ct_params_free (params);tcf_idr_release (*a, bind);return err; }
@@ -1423,7 +1424,7 @@ static void tcf_ct_cleanup(struct tc_action *a) params =rcu_dereference_protected (c->params,1 );if (params) -call_rcu (¶ms->rcu, tcf_ct_params_free); +call_rcu (¶ms->rcu, tcf_ct_params_free_rcu); } static int tcf_ct_dump_key_val(struct sk_buff *skb,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/150 netfilter: flowtable: allow unidirectional rules
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlad Buslov <[email protected]>
[ Upstream commit 8f84780b84d645d6e35467f4a6f3236b20d7f4b2 ]
Modify flow table offload to support unidirectional connections by extending enum nf_flow_flags with new "NF_FLOW_HW_BIDIRECTIONAL" flag. Only offload reply direction when the flag is set. This infrastructure change is necessary to support offloading UDP NEW connections in original direction in following patches in series.
Stable-dep-of: 125f1c7f26ff ("net/sched: act_ct: Take per-cb reference to tcf_ct_flow_table")
--- include/net/netfilter/nf_flow_table.h | 1 + net/netfilter/nf_flow_table_offload.c | 12 ++++++++---- 2 files changed, 9 insertions(+), 4 deletions(-)
include/net/netfilter/nf_flow_table.h +1 -0
@@ -164,6 +164,7 @@ enum nf_flow_flags {NF_FLOW_HW_DYING ,NF_FLOW_HW_DEAD ,NF_FLOW_HW_PENDING , + NF_FLOW_HW_BIDIRECTIONAL, }; enum flow_offload_type {
net/netfilter/nf_flow_table_offload.c +8 -4
@@ -895,8 +895,9 @@ static int flow_offload_rule_add(struct flow_offload_work *offload, ok_count +=flow_offload_tuple_add (offload, flow_rule[0 ],FLOW_OFFLOAD_DIR_ORIGINAL ); - ok_count +=flow_offload_tuple_add (offload, flow_rule[1 ], -FLOW_OFFLOAD_DIR_REPLY ); +if (test_bit (NF_FLOW_HW_BIDIRECTIONAL , &offload->flow->flags)) + ok_count +=flow_offload_tuple_add (offload, flow_rule[1 ], +FLOW_OFFLOAD_DIR_REPLY );if (ok_count ==0 )return -ENOENT ;
@@ -926,7 +927,8 @@ static void flow_offload_work_del(struct flow_offload_work *offload) {clear_bit (IPS_HW_OFFLOAD_BIT , &offload->flow->ct->status);flow_offload_tuple_del (offload,FLOW_OFFLOAD_DIR_ORIGINAL ); -flow_offload_tuple_del (offload,FLOW_OFFLOAD_DIR_REPLY ); +if (test_bit (NF_FLOW_HW_BIDIRECTIONAL , &offload->flow->flags)) +flow_offload_tuple_del (offload,FLOW_OFFLOAD_DIR_REPLY );set_bit (NF_FLOW_HW_DEAD , &offload->flow->flags); }
@@ -946,7 +948,9 @@ static void flow_offload_work_stats(struct flow_offload_work *offload)u64 lastused;flow_offload_tuple_stats (offload,FLOW_OFFLOAD_DIR_ORIGINAL , &stats[0 ]); -flow_offload_tuple_stats (offload,FLOW_OFFLOAD_DIR_REPLY , &stats[1 ]); +if (test_bit (NF_FLOW_HW_BIDIRECTIONAL , &offload->flow->flags)) +flow_offload_tuple_stats (offload,FLOW_OFFLOAD_DIR_REPLY , + &stats[1 ]); lastused =max_t (u64, stats[0 ].lastused, stats[1 ].lastused); offload->flow->timeout = max_t(u64, offload->flow->timeout,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/150 netfilter: flowtable: cache info of last offload
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlad Buslov <[email protected]>
[ Upstream commit 1a441a9b8be8849957a01413a144f84932c324cb ]
Modify flow table offload to cache the last ct info status that was passed to the driver offload callbacks by extending enum nf_flow_flags with new "NF_FLOW_HW_ESTABLISHED" flag. Set the flag if ctinfo was 'established' during last act_ct meta actions fill call. This infrastructure change is necessary to optimize promoting of UDP connections from 'new' to 'established' in following patches in this series.
Stable-dep-of: 125f1c7f26ff ("net/sched: act_ct: Take per-cb reference to tcf_ct_flow_table")
--- include/net/netfilter/nf_flow_table.h | 7 ++++--- net/netfilter/nf_flow_table_inet.c | 2 +- net/netfilter/nf_flow_table_offload.c | 6 +++--- net/sched/act_ct.c | 12 +++++++----- 4 files changed, 15 insertions(+), 12 deletions(-)
include/net/netfilter/nf_flow_table.h +4 -3
@@ -57,7 +57,7 @@ struct nf_flowtable_type {struct net_device *dev, enum flow_block_command cmd);int (*action)(struct net *net, -const struct flow_offload *flow, +struct flow_offload *flow,enum flow_offload_tuple_dir dir,struct nf_flow_rule *flow_rule);void (*free)(struct nf_flowtable *ft);
@@ -165,6 +165,7 @@ enum nf_flow_flags {NF_FLOW_HW_DEAD ,NF_FLOW_HW_PENDING ,NF_FLOW_HW_BIDIRECTIONAL , + NF_FLOW_HW_ESTABLISHED, }; enum flow_offload_type {
@@ -313,10 +314,10 @@ void nf_flow_table_offload_flush_cleanup(struct nf_flowtable *flowtable);int nf_flow_table_offload_setup (struct nf_flowtable *flowtable,struct net_device *dev,enum flow_block_command cmd); -int nf_flow_rule_route_ipv4 (struct net *net,const struct flow_offload *flow, +int nf_flow_rule_route_ipv4 (struct net *net,struct flow_offload *flow,enum flow_offload_tuple_dir dir,struct nf_flow_rule *flow_rule); -int nf_flow_rule_route_ipv6 (struct net *net,const struct flow_offload *flow, +int nf_flow_rule_route_ipv6 (struct net *net,struct flow_offload *flow,enum flow_offload_tuple_dir dir,struct nf_flow_rule *flow_rule);
net/netfilter/nf_flow_table_inet.c +1 -1
@@ -39,7 +39,7 @@ nf_flow_offload_inet_hook(void *priv, struct sk_buff *skb, }static int nf_flow_rule_route_inet (struct net *net, -const struct flow_offload *flow, +struct flow_offload *flow,enum flow_offload_tuple_dir dir,struct nf_flow_rule *flow_rule) {
net/netfilter/nf_flow_table_offload.c +3 -3
@@ -679,7 +679,7 @@ nf_flow_rule_route_common(struct net *net, const struct flow_offload *flow,return 0 ; } -int nf_flow_rule_route_ipv4 (struct net *net,const struct flow_offload *flow, +int nf_flow_rule_route_ipv4 (struct net *net,struct flow_offload *flow,enum flow_offload_tuple_dir dir,struct nf_flow_rule *flow_rule) {
@@ -704,7 +704,7 @@ int nf_flow_rule_route_ipv4(struct net *net, const struct flow_offload *flow, }EXPORT_SYMBOL_GPL (nf_flow_rule_route_ipv4); -int nf_flow_rule_route_ipv6 (struct net *net,const struct flow_offload *flow, +int nf_flow_rule_route_ipv6 (struct net *net,struct flow_offload *flow,enum flow_offload_tuple_dir dir,struct nf_flow_rule *flow_rule) {
@@ -735,7 +735,7 @@ nf_flow_offload_rule_alloc(struct net *net, {const struct nf_flowtable *flowtable = offload->flowtable;const struct flow_offload_tuple *tuple, *other_tuple; -const struct flow_offload *flow = offload->flow; +struct flow_offload *flow = offload->flow;struct dst_entry *other_dst =NULL ;struct nf_flow_rule *flow_rule;int err = -ENOMEM ;
net/sched/act_ct.c +7 -5
@@ -168,11 +168,11 @@ tcf_ct_flow_table_add_action_nat_udp(const struct nf_conntrack_tuple *tuple,static void tcf_ct_flow_table_add_action_meta (struct nf_conn *ct,enum ip_conntrack_dir dir, +enum ip_conntrack_info ctinfo,struct flow_action *action) {struct nf_conn_labels *ct_labels;struct flow_action_entry *entry; -enum ip_conntrack_info ctinfo;u32 *act_ct_labels; entry =tcf_ct_flow_table_flow_action_get_next (action);
@@ -180,8 +180,6 @@ static void tcf_ct_flow_table_add_action_meta(struct nf_conn *ct,#if IS_ENABLED (CONFIG_NF_CONNTRACK_MARK ) entry->ct_metadata.mark =READ_ONCE (ct->mark);#endif - ctinfo = dir ==IP_CT_DIR_ORIGINAL ?IP_CT_ESTABLISHED : -IP_CT_ESTABLISHED_REPLY ;/* aligns with the CT reference on the SKB nf_ct_set */ entry->ct_metadata.cookie = (unsigned long )ct | ctinfo; entry->ct_metadata.orig_dir = dir ==IP_CT_DIR_ORIGINAL ;
@@ -235,22 +233,26 @@ static int tcf_ct_flow_table_add_action_nat(struct net *net, }static int tcf_ct_flow_table_fill_actions (struct net *net, -const struct flow_offload *flow, +struct flow_offload *flow,enum flow_offload_tuple_dir tdir,struct nf_flow_rule *flow_rule) {struct flow_action *action = &flow_rule->rule->action;int num_entries = action->num_entries;struct nf_conn *ct = flow->ct; +enum ip_conntrack_info ctinfo;enum ip_conntrack_dir dir;int i, err;switch (tdir) {case FLOW_OFFLOAD_DIR_ORIGINAL : dir =IP_CT_DIR_ORIGINAL ; + ctinfo =IP_CT_ESTABLISHED ; +set_bit (NF_FLOW_HW_ESTABLISHED , &flow->flags);break ;case FLOW_OFFLOAD_DIR_REPLY : dir =IP_CT_DIR_REPLY ; + ctinfo =IP_CT_ESTABLISHED_REPLY ;break ;default :return -EOPNOTSUPP ;
@@ -260,7 +262,7 @@ static int tcf_ct_flow_table_fill_actions(struct net *net,if (err) goto err_nat; -tcf_ct_flow_table_add_action_meta (ct, dir, action); +tcf_ct_flow_table_add_action_meta (ct, dir, ctinfo, action);return 0 ; err_nat:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/150 net/sched: act_ct: offload UDP NEW connections
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlad Buslov <[email protected]>
[ Upstream commit 6a9bad0069cf306f3df6ac53cf02438d4e15f296 ]
Modify the offload algorithm of UDP connections to the following:
- Offload NEW connection as unidirectional.
- When connection state changes to ESTABLISHED also update the hardware flow. However, in order to prevent act_ct from spamming offload add wq for every packet coming in reply direction in this state verify whether connection has already been updated to ESTABLISHED in the drivers. If that it the case, then skip flow_table and let conntrack handle such packets which will also allow conntrack to potentially promote the connection to ASSURED.
- When connection state changes to ASSURED set the flow_table flow NF_FLOW_HW_BIDIRECTIONAL flag which will cause refresh mechanism to offload the reply direction.
All other protocols have their offload algorithm preserved and are always offloaded as bidirectional.
Note that this change tries to minimize the load on flow_table add workqueue. First, it tracks the last ctinfo that was offloaded by using new flow 'NF_FLOW_HW_ESTABLISHED' flag and doesn't schedule the refresh for reply direction packets when the offloads have already been updated with current ctinfo. Second, when 'add' task executes on workqueue it always update the offload with current flow state (by checking 'bidirectional' flow flag and obtaining actual ctinfo/cookie through meta action instead of caching any of these from the moment of scheduling the 'add' work) preventing the need from scheduling more updates if state changed concurrently while the 'add' work was pending on workqueue.
Stable-dep-of: 125f1c7f26ff ("net/sched: act_ct: Take per-cb reference to tcf_ct_flow_table")
--- net/sched/act_ct.c | 51 +++++++++++++++++++++++++++++++++++----------- 1 file changed, 39 insertions(+), 12 deletions(-)
net/sched/act_ct.c +39 -12
@@ -365,7 +365,7 @@ static void tcf_ct_flow_tc_ifidx(struct flow_offload *entry,static void tcf_ct_flow_table_add (struct tcf_ct_flow_table *ct_ft,struct nf_conn *ct, -bool tcp) +bool tcp,bool bidirectional) {struct nf_conn_act_ct_ext *act_ct_ext;struct flow_offload *entry;
@@ -384,6 +384,8 @@ static void tcf_ct_flow_table_add(struct tcf_ct_flow_table *ct_ft, ct->proto.tcp.seen[0 ].flags |=IP_CT_TCP_FLAG_BE_LIBERAL ; ct->proto.tcp.seen[1 ].flags |=IP_CT_TCP_FLAG_BE_LIBERAL ; } +if (bidirectional) +__set_bit (NF_FLOW_HW_BIDIRECTIONAL , &entry->flags); act_ct_ext =nf_conn_act_ct_ext_find (ct);if (act_ct_ext) {
@@ -407,26 +409,34 @@ static void tcf_ct_flow_table_process_conn(struct tcf_ct_flow_table *ct_ft,struct nf_conn *ct, enum ip_conntrack_info ctinfo) { - bool tcp = false; - -if ((ctinfo !=IP_CT_ESTABLISHED && ctinfo !=IP_CT_ESTABLISHED_REPLY ) || - !test_bit (IPS_ASSURED_BIT , &ct->status)) -return ; + bool tcp = false, bidirectional = true;switch (nf_ct_protonum (ct)) {case IPPROTO_TCP : - tcp = true; -if (ct->proto.tcp.state !=TCP_CONNTRACK_ESTABLISHED ) +if ((ctinfo !=IP_CT_ESTABLISHED && + ctinfo !=IP_CT_ESTABLISHED_REPLY ) || + !test_bit (IPS_ASSURED_BIT , &ct->status) || + ct->proto.tcp.state !=TCP_CONNTRACK_ESTABLISHED )return ; + + tcp = true;break ;case IPPROTO_UDP : +if (!nf_ct_is_confirmed (ct)) +return ; +if (!test_bit (IPS_ASSURED_BIT , &ct->status)) + bidirectional = false;break ;#ifdef CONFIG_NF_CT_PROTO_GRE case IPPROTO_GRE : {struct nf_conntrack_tuple *tuple; -if (ct->status &IPS_NAT_MASK ) +if ((ctinfo !=IP_CT_ESTABLISHED && + ctinfo !=IP_CT_ESTABLISHED_REPLY ) || + !test_bit (IPS_ASSURED_BIT , &ct->status) || + ct->status &IPS_NAT_MASK )return ; + tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL ].tuple;/* No support for GRE v1 */ if (tuple->src.u.gre.key || tuple->dst.u.gre.key)
@@ -442,7 +452,7 @@ static void tcf_ct_flow_table_process_conn(struct tcf_ct_flow_table *ct_ft, ct->status & IPS_SEQ_ADJUST)return ; -tcf_ct_flow_table_add (ct_ft, ct, tcp); +tcf_ct_flow_table_add (ct_ft, ct, tcp, bidirectional); } static bool
@@ -621,13 +631,30 @@ static bool tcf_ct_flow_table_lookup(struct tcf_ct_params *p, flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); ct = flow->ct; +if (dir ==FLOW_OFFLOAD_DIR_REPLY && + !test_bit (NF_FLOW_HW_BIDIRECTIONAL , &flow->flags)) { +/* Only offload reply direction after connection became +* assured. +*/ +if (test_bit (IPS_ASSURED_BIT , &ct->status)) +set_bit (NF_FLOW_HW_BIDIRECTIONAL , &flow->flags); +else if (test_bit (NF_FLOW_HW_ESTABLISHED , &flow->flags)) +/* If flow_table flow has already been updated to the +* established state, then don't refresh. +*/ +return false; + } +if (tcph && (unlikely (tcph->fin || tcph->rst))) {flow_offload_teardown (flow);return false; } - ctinfo = dir ==FLOW_OFFLOAD_DIR_ORIGINAL ?IP_CT_ESTABLISHED : -IP_CT_ESTABLISHED_REPLY ; +if (dir ==FLOW_OFFLOAD_DIR_ORIGINAL ) + ctinfo =test_bit (IPS_SEEN_REPLY_BIT , &ct->status) ? +IP_CT_ESTABLISHED :IP_CT_NEW ; +else + ctinfo =IP_CT_ESTABLISHED_REPLY ;flow_offload_refresh (nf_ft, flow);nf_conntrack_get (&ct->ct_general);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/150 net/sched: act_ct: Fix promotion of offloaded unreplied tuple
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Blakey <[email protected]>
[ Upstream commit 41f2c7c342d3adb1c4dd5f2e3dd831adff16a669 ]
Currently UNREPLIED and UNASSURED connections are added to the nf flow table. This causes the following connection packets to be processed by the flow table which then skips conntrack_in(), and thus such the connections will remain UNREPLIED and UNASSURED even if reply traffic is then seen. Even still, the unoffloaded reply packets are the ones triggering hardware update from new to established state, and if there aren't any to triger an update and/or previous update was missed, hardware can get out of sync with sw and still mark packets as new.
Fix the above by:
1) Not skipping conntrack_in() for UNASSURED packets, but still refresh for hardware, as before the cited patch.
2) Try and force a refresh by reply-direction packets that update the hardware rules from new to established state.
3) Remove any bidirectional flows that didn't failed to update in hardware for re-insertion as bidrectional once any new packet arrives.
Stable-dep-of: 125f1c7f26ff ("net/sched: act_ct: Take per-cb reference to tcf_ct_flow_table")
--- include/net/netfilter/nf_flow_table.h | 2 +- net/netfilter/nf_flow_table_core.c | 13 ++++++++++--- net/netfilter/nf_flow_table_ip.c | 4 ++-- net/sched/act_ct.c | 9 ++++++++- 4 files changed, 21 insertions(+), 7 deletions(-)
include/net/netfilter/nf_flow_table.h +1 -1
@@ -268,7 +268,7 @@ int flow_offload_route_init(struct flow_offload *flow,int flow_offload_add (struct nf_flowtable *flow_table,struct flow_offload *flow);void flow_offload_refresh (struct nf_flowtable *flow_table, -struct flow_offload *flow); +struct flow_offload *flow,bool force);struct flow_offload_tuple_rhash *flow_offload_lookup (struct nf_flowtable *flow_table,struct flow_offload_tuple *tuple);
net/netfilter/nf_flow_table_core.c +10 -3
@@ -314,12 +314,12 @@ int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow)EXPORT_SYMBOL_GPL (flow_offload_add);void flow_offload_refresh (struct nf_flowtable *flow_table, -struct flow_offload *flow) +struct flow_offload *flow,bool force) {u32 timeout; timeout = nf_flowtable_time_stamp +flow_offload_get_timeout (flow); -if (timeout -READ_ONCE (flow->timeout) >HZ ) +if (force || timeout -READ_ONCE (flow->timeout) >HZ )WRITE_ONCE (flow->timeout, timeout);else return ;
@@ -331,6 +331,12 @@ void flow_offload_refresh(struct nf_flowtable *flow_table, }EXPORT_SYMBOL_GPL (flow_offload_refresh); +static bool nf_flow_is_outdated (const struct flow_offload *flow) +{ +return test_bit (IPS_SEEN_REPLY_BIT , &flow->ct->status) && + !test_bit (NF_FLOW_HW_ESTABLISHED , &flow->flags); +} +static inline bool nf_flow_has_expired (const struct flow_offload *flow) {return nf_flow_timeout_delta (flow->timeout) <=0 ;
@@ -420,7 +426,8 @@ static void nf_flow_offload_gc_step(struct nf_flowtable *flow_table, struct flow_offload *flow, void *data) { if (nf_flow_has_expired(flow) || - nf_ct_is_dying(flow->ct)) + nf_ct_is_dying(flow->ct) || + nf_flow_is_outdated(flow)) flow_offload_teardown(flow); if (test_bit(NF_FLOW_TEARDOWN, &flow->flags)) {
net/netfilter/nf_flow_table_ip.c +2 -2
@@ -384,7 +384,7 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,if (skb_try_make_writable (skb, thoff + hdrsize))return NF_DROP ; -flow_offload_refresh (flow_table, flow); +flow_offload_refresh (flow_table, flow, false);nf_flow_encap_pop (skb, tuplehash); thoff -= offset;
@@ -646,7 +646,7 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,if (skb_try_make_writable (skb, thoff + hdrsize))return NF_DROP ; -flow_offload_refresh (flow_table, flow); +flow_offload_refresh (flow_table, flow, false);nf_flow_encap_pop (skb, tuplehash);
net/sched/act_ct.c +8 -1
@@ -606,6 +606,7 @@ static bool tcf_ct_flow_table_lookup(struct tcf_ct_params *p,struct flow_offload_tuple tuple = {};enum ip_conntrack_info ctinfo;struct tcphdr *tcph =NULL ; +bool force_refresh = false;struct flow_offload *flow;struct nf_conn *ct;u8 dir;
@@ -643,6 +644,7 @@ static bool tcf_ct_flow_table_lookup(struct tcf_ct_params *p,* established state, then don't refresh. */ return false; + force_refresh = true; }if (tcph && (unlikely (tcph->fin || tcph->rst))) {
@@ -656,7 +658,12 @@ static bool tcf_ct_flow_table_lookup(struct tcf_ct_params *p,else ctinfo =IP_CT_ESTABLISHED_REPLY ; -flow_offload_refresh (nf_ft, flow); +flow_offload_refresh (nf_ft, flow, force_refresh); +if (!test_bit (IPS_ASSURED_BIT , &ct->status)) { +/* Process this flow in SW to allow promoting to ASSURED */ +return false; + } +nf_conntrack_get (&ct->ct_general);nf_ct_set (skb, ct, ctinfo);if (nf_ft->flags &NF_FLOWTABLE_COUNTER )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/150 netfilter: flowtable: GC pushes back packets to classic path
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 735795f68b37e9bb49f642407a0d49b1631ea1c7 ]
Since 41f2c7c342d3 ("net/sched: act_ct: Fix promotion of offloaded unreplied tuple"), flowtable GC pushes back flows with IPS_SEEN_REPLY back to classic path in every run, ie. every second. This is because of a new check for NF_FLOW_HW_ESTABLISHED which is specific of sched/act_ct.
In Netfilter's flowtable case, NF_FLOW_HW_ESTABLISHED never gets set on and IPS_SEEN_REPLY is unreliable since users decide when to offload the flow before, such bit might be set on at a later stage.
Fix it by adding a custom .gc handler that sched/act_ct can use to deal with its NF_FLOW_HW_ESTABLISHED bit.
Stable-dep-of: 125f1c7f26ff ("net/sched: act_ct: Take per-cb reference to tcf_ct_flow_table")
--- include/net/netfilter/nf_flow_table.h | 1 + net/netfilter/nf_flow_table_core.c | 14 +++++++------- net/sched/act_ct.c | 7 +++++++ 3 files changed, 15 insertions(+), 7 deletions(-)
include/net/netfilter/nf_flow_table.h +1 -0
@@ -53,6 +53,7 @@ struct nf_flowtable_type {struct list_head list;int family;int (*init)(struct nf_flowtable *ft); +bool (*gc)(const struct flow_offload *flow);int (*setup)(struct nf_flowtable *ft,struct net_device *dev,enum flow_block_command cmd);
net/netfilter/nf_flow_table_core.c +7 -7
@@ -331,12 +331,6 @@ void flow_offload_refresh(struct nf_flowtable *flow_table, }EXPORT_SYMBOL_GPL (flow_offload_refresh); -static bool nf_flow_is_outdated (const struct flow_offload *flow) -{ -return test_bit (IPS_SEEN_REPLY_BIT , &flow->ct->status) && - !test_bit (NF_FLOW_HW_ESTABLISHED , &flow->flags); -} -static inline bool nf_flow_has_expired (const struct flow_offload *flow) {return nf_flow_timeout_delta (flow->timeout) <=0 ;
@@ -422,12 +416,18 @@ nf_flow_table_iterate(struct nf_flowtable *flow_table,return err; } +static bool nf_flow_custom_gc (struct nf_flowtable *flow_table, +const struct flow_offload *flow) +{ +return flow_table->type->gc && flow_table->type->gc (flow); +} +static void nf_flow_offload_gc_step (struct nf_flowtable *flow_table,struct flow_offload *flow,void *data) {if (nf_flow_has_expired (flow) ||nf_ct_is_dying (flow->ct) || -nf_flow_is_outdated (flow)) +nf_flow_custom_gc (flow_table, flow))flow_offload_teardown (flow);if (test_bit (NF_FLOW_TEARDOWN , &flow->flags)) {
net/sched/act_ct.c +7 -0
@@ -274,7 +274,14 @@ static int tcf_ct_flow_table_fill_actions(struct net *net,return err; } +static bool tcf_ct_flow_is_outdated (const struct flow_offload *flow) +{ +return test_bit (IPS_SEEN_REPLY_BIT , &flow->ct->status) && + !test_bit (NF_FLOW_HW_ESTABLISHED , &flow->flags); +} +static struct nf_flowtable_type flowtable_ct = { + .gc = tcf_ct_flow_is_outdated, .action = tcf_ct_flow_table_fill_actions, .owner =THIS_MODULE , };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/150 net/sched: act_ct: Take per-cb reference to tcf_ct_flow_table
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlad Buslov <[email protected]>
[ Upstream commit 125f1c7f26ffcdbf96177abe75b70c1a6ceb17bc ]
The referenced change added custom cleanup code to act_ct to delete any callbacks registered on the parent block when deleting the tcf_ct_flow_table instance. However, the underlying issue is that the drivers don't obtain the reference to the tcf_ct_flow_table instance when registering callbacks which means that not only driver callbacks may still be on the table when deleting it but also that the driver can still have pointers to its internal nf_flowtable and can use it concurrently which results either warning in netfilter[0] or use-after-free.
Fix the issue by taking a reference to the underlying struct tcf_ct_flow_table instance when registering the callback and release the reference when unregistering. Expose new API required for such reference counting by adding two new callbacks to nf_flowtable_type and implementing them for act_ct flowtable_ct type. This fixes the issue by extending the lifetime of nf_flowtable until all users have unregistered.
[0]:
[106170.938634] ------------[ cut here ]------------ [106170.939111] WARNING: CPU: 21 PID: 3688 at include/net/netfilter/nf_flow_table.h:262 mlx5_tc_ct_del_ft_cb+0x267/0x2b0 [mlx5_core] [106170.940108] Modules linked in: act_ct nf_flow_table act_mirred act_skbedit act_tunnel_key vxlan cls_matchall nfnetlink_cttimeout act_gact cls_flower sch_ingress mlx5_vdpa vringh vhost_iotlb vdpa bonding openvswitch nsh rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_regis try overlay mlx5_core [106170.943496] CPU: 21 PID: 3688 Comm: kworker/u48:0 Not tainted 6.6.0-rc7_for_upstream_min_debug_2023_11_01_13_02 #1 [106170.944361] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [106170.945292] Workqueue: mlx5e mlx5e_rep_neigh_update [mlx5_core] [106170.945846] RIP: 0010:mlx5_tc_ct_del_ft_cb+0x267/0x2b0 [mlx5_core] [106170.946413] Code: 89 ef 48 83 05 71 a4 14 00 01 e8 f4 06 04 e1 48 83 05 6c a4 14 00 01 48 83 c4 28 5b 5d 41 5c 41 5d c3 48 83 05 d1 8b 14 00 01 <0f> 0b 48 83 05 d7 8b 14 00 01 e9 96 fe ff ff 48 83 05 a2 90 14 00 [106170.947924] RSP: 0018:ffff88813ff0fcb8 EFLAGS: 00010202 [106170.948397] RAX: 0000000000000000 RBX: ffff88811eabac40 RCX: ffff88811eabad48 [106170.949040] RDX: ffff88811eab8000 RSI: ffffffffa02cd560 RDI: 0000000000000000 [106170.949679] RBP: ffff88811eab8000 R08: 0000000000000001 R09: ffffffffa0229700 [106170.950317] R10: ffff888103538fc0 R11: 0000000000000001 R12: ffff88811eabad58 [106170.950969] R13: ffff888110c01c00 R14: ffff888106b40000 R15: 0000000000000000 [106170.951616] FS: 0000000000000000(0000) GS:ffff88885fd40000(0000) knlGS:0000000000000000 [106170.952329] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [106170.952834] CR2: 00007f1cefd28cb0 CR3: 000000012181b006 CR4: 0000000000370ea0 [106170.953482] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [106170.954121] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [106170.954766] Call Trace: [106170.955057] <TASK> [106170.955315] ? __warn+0x79/0x120 [106170.955648] ? mlx5_tc_ct_del_ft_cb+0x267/0x2b0 [mlx5_core] [106170.956172] ? report_bug+0x17c/0x190 [106170.956537] ? handle_bug+0x3c/0x60 [106170.956891] ? exc_invalid_op+0x14/0x70 [106170.957264] ? asm_exc_invalid_op+0x16/0x20 [106170.957666] ? mlx5_del_flow_rules+0x10/0x310 [mlx5_core] [106170.958172] ? mlx5_tc_ct_block_flow_offload_add+0x1240/0x1240 [mlx5_core] [106170.958788] ? mlx5_tc_ct_del_ft_cb+0x267/0x2b0 [mlx5_core] [106170.959339] ? mlx5_tc_ct_del_ft_cb+0xc6/0x2b0 [mlx5_core] [106170.959854] ? mapping_remove+0x154/0x1d0 [mlx5_core] [106170.960342] ? mlx5e_tc_action_miss_mapping_put+0x4f/0x80 [mlx5_core] [106170.960927] mlx5_tc_ct_delete_flow+0x76/0xc0 [mlx5_core] [106170.961441] mlx5_free_flow_attr_actions+0x13b/0x220 [mlx5_core] [106170.962001] mlx5e_tc_del_fdb_flow+0x22c/0x3b0 [mlx5_core] [106170.962524] mlx5e_tc_del_flow+0x95/0x3c0 [mlx5_core] [106170.963034] mlx5e_flow_put+0x73/0xe0 [mlx5_core] [106170.963506] mlx5e_put_flow_list+0x38/0x70 [mlx5_core] [106170.964002] mlx5e_rep_update_flows+0xec/0x290 [mlx5_core] [106170.964525] mlx5e_rep_neigh_update+0x1da/0x310 [mlx5_core] [106170.965056] process_one_work+0x13a/0x2c0 [106170.965443] worker_thread+0x2e5/0x3f0 [106170.965808] ? rescuer_thread+0x410/0x410 [106170.966192] kthread+0xc6/0xf0 [106170.966515] ? kthread_complete_and_exit+0x20/0x20 [106170.966970] ret_from_fork+0x2d/0x50 [106170.967332] ? kthread_complete_and_exit+0x20/0x20 [106170.967774] ret_from_fork_asm+0x11/0x20 [106170.970466] </TASK> [106170.970726] ---[ end trace 0000000000000000 ]---
--- include/net/netfilter/nf_flow_table.h | 10 ++++++++ net/sched/act_ct.c | 34 ++++++++++++++++++++++----- 2 files changed, 38 insertions(+), 6 deletions(-)
include/net/netfilter/nf_flow_table.h +10 -0
@@ -62,6 +62,8 @@ struct nf_flowtable_type {enum flow_offload_tuple_dir dir, struct nf_flow_rule *flow_rule);void (*free)(struct nf_flowtable *ft); +void (*get)(struct nf_flowtable *ft); +void (*put)(struct nf_flowtable *ft);nf_hookfn *hook;struct module *owner; };
@@ -240,6 +242,11 @@ nf_flow_table_offload_add_cb(struct nf_flowtable *flow_table, }list_add_tail (&block_cb->list, &block->cb_list); +up_write (&flow_table->flow_block_lock); + +if (flow_table->type->get) + flow_table->type->get (flow_table); +return 0 ; unlock:up_write (&flow_table->flow_block_lock);
@@ -262,6 +269,9 @@ nf_flow_table_offload_del_cb(struct nf_flowtable *flow_table,WARN_ON (true); }up_write (&flow_table->flow_block_lock); + +if (flow_table->type->put) + flow_table->type->put (flow_table); } int flow_offload_route_init(struct flow_offload *flow,
net/sched/act_ct.c +28 -6
@@ -280,9 +280,31 @@ static bool tcf_ct_flow_is_outdated(const struct flow_offload *flow) !test_bit (NF_FLOW_HW_ESTABLISHED , &flow->flags); } +static void tcf_ct_flow_table_get_ref (struct tcf_ct_flow_table *ct_ft); + +static void tcf_ct_nf_get (struct nf_flowtable *ft) +{ +struct tcf_ct_flow_table *ct_ft = + container_of(ft, struct tcf_ct_flow_table, nf_ft); + +tcf_ct_flow_table_get_ref (ct_ft); +} + +static void tcf_ct_flow_table_put (struct tcf_ct_flow_table *ct_ft); + +static void tcf_ct_nf_put (struct nf_flowtable *ft) +{ +struct tcf_ct_flow_table *ct_ft = + container_of(ft, struct tcf_ct_flow_table, nf_ft); + +tcf_ct_flow_table_put (ct_ft); +} +static struct nf_flowtable_type flowtable_ct = { .gc = tcf_ct_flow_is_outdated, .action = tcf_ct_flow_table_fill_actions, + .get = tcf_ct_nf_get, + .put = tcf_ct_nf_put, .owner =THIS_MODULE , };
@@ -331,9 +353,13 @@ static int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params)return err; } +static void tcf_ct_flow_table_get_ref (struct tcf_ct_flow_table *ct_ft) +{ +refcount_inc (&ct_ft->ref); +} +static void tcf_ct_flow_table_cleanup_work (struct work_struct *work) { -struct flow_block_cb *block_cb, *tmp_cb;struct tcf_ct_flow_table *ct_ft;struct flow_block *block;
@@ -341,13 +367,9 @@ static void tcf_ct_flow_table_cleanup_work(struct work_struct *work) rwork);nf_flow_table_free (&ct_ft->nf_ft); -/* Remove any remaining callbacks before cleanup */ block = &ct_ft->nf_ft.flow_block;down_write (&ct_ft->nf_ft.flow_block_lock); -list_for_each_entry_safe (block_cb, tmp_cb, &block->cb_list, list) { -list_del (&block_cb->list); -flow_block_cb_free (block_cb); - } +WARN_ON (!list_empty (&block->cb_list));up_write (&ct_ft->nf_ft.flow_block_lock);kfree (ct_ft);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/150 octeontx2-af: Fix pause frame configuration
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hariprasad Kelam <[email protected]>
[ Upstream commit e307b5a845c5951dabafc48d00b6424ee64716c4 ]
The current implementation's default Pause Forward setting is causing unnecessary network traffic. This patch disables Pause Forward to address this issue.
--- drivers/net/ethernet/marvell/octeontx2/af/rpm.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/rpm.c +7 -4
@@ -283,6 +283,11 @@ void rpm_lmac_pause_frm_config(void *rpmd, int lmac_id, bool enable) cfg =FIELD_SET (RPM_PFC_CLASS_MASK ,0 , cfg);rpm_write (rpm, lmac_id,RPMX_CMRX_PRT_CBFC_CTL , cfg); +/* Disable forward pause to driver */ + cfg =rpm_read (rpm, lmac_id,RPMX_MTI_MAC100X_COMMAND_CONFIG ); + cfg &= ~RPMX_MTI_MAC100X_COMMAND_CONFIG_PAUSE_FWD ; +rpm_write (rpm, lmac_id,RPMX_MTI_MAC100X_COMMAND_CONFIG , cfg); +/* Enable channel mask for all LMACS */ rpm_write (rpm,0 ,RPMX_CMR_CHAN_MSK_OR , ~0ULL ); }
@@ -451,12 +456,10 @@ int rpm_lmac_pfc_config(void *rpmd, int lmac_id, u8 tx_pause, u8 rx_pause, u16 pif (rx_pause) { cfg &= ~(RPMX_MTI_MAC100X_COMMAND_CONFIG_RX_P_DISABLE | -RPMX_MTI_MAC100X_COMMAND_CONFIG_PAUSE_IGNORE | -RPMX_MTI_MAC100X_COMMAND_CONFIG_PAUSE_FWD ); +RPMX_MTI_MAC100X_COMMAND_CONFIG_PAUSE_IGNORE ); }else { cfg |= (RPMX_MTI_MAC100X_COMMAND_CONFIG_RX_P_DISABLE | -RPMX_MTI_MAC100X_COMMAND_CONFIG_PAUSE_IGNORE | -RPMX_MTI_MAC100X_COMMAND_CONFIG_PAUSE_FWD ); +RPMX_MTI_MAC100X_COMMAND_CONFIG_PAUSE_IGNORE ); }if (tx_pause) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/150 octeontx2-af: Support variable number of lmacs
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rakesh Babu Saladi <[email protected]>
[ Upstream commit f2e664ad503d4e5ce7c42a0862ab164331a0ef37 ]
Most of the code in CGX/RPM driver assumes that max lmacs per given MAC as always, 4 and the number of MAC blocks also as 4. With this assumption, the max number of interfaces supported is hardcoded to 16. This creates a problem as next gen CN10KB silicon MAC supports 8 lmacs per MAC block.
This patch solves the problem by using "max lmac per MAC block" value from constant csrs and uses cgx_cnt_max value which is populated based number of MAC blocks supported by silicon.
Stable-dep-of: e307b5a845c5 ("octeontx2-af: Fix pause frame configuration")
--- .../net/ethernet/marvell/octeontx2/af/cgx.c | 35 ++++++++----------- .../net/ethernet/marvell/octeontx2/af/cgx.h | 6 ++-- .../marvell/octeontx2/af/lmac_common.h | 5 ++- .../net/ethernet/marvell/octeontx2/af/rvu.h | 2 +- .../ethernet/marvell/octeontx2/af/rvu_cgx.c | 26 ++++++++------ .../marvell/octeontx2/af/rvu_debugfs.c | 2 +- .../ethernet/marvell/octeontx2/af/rvu_nix.c | 2 +- .../marvell/octeontx2/af/rvu_npc_hash.c | 4 ++- 8 files changed, 42 insertions(+), 40 deletions(-)
drivers/net/ethernet/marvell/octeontx2/af/cgx.c +15 -20
@@ -78,7 +78,7 @@ static bool is_dev_rpm(void *cgxd)bool is_lmac_valid (struct cgx *cgx,int lmac_id) { -if (!cgx || lmac_id <0 || lmac_id >=MAX_LMAC_PER_CGX ) +if (!cgx || lmac_id <0 || lmac_id >= cgx->max_lmac_per_mac)return false;return test_bit (lmac_id, &cgx->lmac_bmap); }
@@ -90,7 +90,7 @@ static int get_sequence_id_of_lmac(struct cgx *cgx, int lmac_id) {int tmp, id =0 ; -for_each_set_bit (tmp, &cgx->lmac_bmap,MAX_LMAC_PER_CGX ) { +for_each_set_bit (tmp, &cgx->lmac_bmap, cgx->max_lmac_per_mac) {if (tmp == lmac_id)break ; id++;
@@ -121,7 +121,7 @@ u64 cgx_read(struct cgx *cgx, u64 lmac, u64 offset)struct lmac *lmac_pdata (u8 lmac_id,struct cgx *cgx) { -if (!cgx || lmac_id >=MAX_LMAC_PER_CGX ) +if (!cgx || lmac_id >= cgx->max_lmac_per_mac)return NULL ;return cgx->lmac_idmap[lmac_id];
@@ -1410,7 +1410,7 @@ int cgx_get_fwdata_base(u64 *base)if (!cgx)return -ENXIO ; - first_lmac =find_first_bit (&cgx->lmac_bmap,MAX_LMAC_PER_CGX ); + first_lmac =find_first_bit (&cgx->lmac_bmap, cgx->max_lmac_per_mac); req =FIELD_SET (CMDREG_ID ,CGX_CMD_GET_FWD_BASE , req); err =cgx_fwi_cmd_generic (req, &resp, cgx, first_lmac);if (!err)
@@ -1499,7 +1499,7 @@ static int cgx_fwi_link_change(struct cgx *cgx, int lmac_id, bool enable)static inline int cgx_fwi_read_version (u64 *resp,struct cgx *cgx) { -int first_lmac =find_first_bit (&cgx->lmac_bmap,MAX_LMAC_PER_CGX ); +int first_lmac =find_first_bit (&cgx->lmac_bmap, cgx->max_lmac_per_mac);u64 req =0 ; req =FIELD_SET (CMDREG_ID ,CGX_CMD_GET_FW_VER , req);
@@ -1537,7 +1537,7 @@ static void cgx_lmac_linkup_work(struct work_struct *work)int i, err;/* Do Link up for all the enabled lmacs */ -for_each_set_bit (i, &cgx->lmac_bmap,MAX_LMAC_PER_CGX ) { +for_each_set_bit (i, &cgx->lmac_bmap, cgx->max_lmac_per_mac) { err =cgx_fwi_link_change (cgx, i, true);if (err) dev_info(dev, "cgx port %d:%d Link up command failed\n",
@@ -1557,14 +1557,6 @@ int cgx_lmac_linkup_start(void *cgxd)return 0 ; } -static void cgx_lmac_get_fifolen (struct cgx *cgx) -{ -u64 cfg; - - cfg =cgx_read (cgx,0 ,CGX_CONST ); - cgx->mac_ops->fifo_len =FIELD_GET (CGX_CONST_RXFIFO_SIZE , cfg); -} -static int cgx_configure_interrupt (struct cgx *cgx,struct lmac *lmac,int cnt,bool req_free) {
@@ -1619,17 +1611,14 @@ static int cgx_lmac_init(struct cgx *cgx)u64 lmac_list;int i, err; -cgx_lmac_get_fifolen (cgx); - - cgx->lmac_count = cgx->mac_ops->get_nr_lmacs (cgx);/* lmac_list specifies which lmacs are enabled * when bit n is set to 1, LMAC[n] is enabled */ if (cgx->mac_ops->non_contiguous_serdes_lane) lmac_list =cgx_read (cgx,0 ,CGXX_CMRX_RX_LMACS ) &0xFULL ; -if (cgx->lmac_count >MAX_LMAC_PER_CGX ) - cgx->lmac_count =MAX_LMAC_PER_CGX ; +if (cgx->lmac_count > cgx->max_lmac_per_mac) + cgx->lmac_count = cgx->max_lmac_per_mac;for (i =0 ; i < cgx->lmac_count; i++) { lmac =kzalloc (sizeof (struct lmac ),GFP_KERNEL );
@@ -1707,7 +1696,7 @@ static int cgx_lmac_exit(struct cgx *cgx) }/* Free all lmac related resources */ -for_each_set_bit (i, &cgx->lmac_bmap,MAX_LMAC_PER_CGX ) { +for_each_set_bit (i, &cgx->lmac_bmap, cgx->max_lmac_per_mac) { lmac = cgx->lmac_idmap[i];if (!lmac)continue ;
@@ -1723,6 +1712,12 @@ static int cgx_lmac_exit(struct cgx *cgx)static void cgx_populate_features (struct cgx *cgx) { +u64 cfg; + + cfg =cgx_read (cgx,0 ,CGX_CONST ); + cgx->mac_ops->fifo_len =FIELD_GET (CGX_CONST_RXFIFO_SIZE , cfg); + cgx->max_lmac_per_mac =FIELD_GET (CGX_CONST_MAX_LMACS , cfg); +if (is_dev_rpm (cgx)) cgx->hw_features = (RVU_LMAC_FEAT_DMACF |RVU_MAC_RPM |RVU_LMAC_FEAT_FC |RVU_LMAC_FEAT_PTP );
drivers/net/ethernet/marvell/octeontx2/af/cgx.h +2 -4
@@ -18,11 +18,8 @@/* PCI BAR nos */ #define PCI_CFG_REG_BAR_NUM 0 -#define CGX_ID_MASK 0x7 -#define MAX_LMAC_PER_CGX 4 +#define CGX_ID_MASK 0xF#define MAX_DMAC_ENTRIES_PER_CGX 32 -#define CGX_FIFO_LEN 65536/* 64K for both Rx & Tx */ -#define CGX_OFFSET (x) ((x) * MAX_LMAC_PER_CGX)/* Registers */ #define CGXX_CMRX_CFG 0x00
@@ -56,6 +53,7 @@#define CGXX_SCRATCH1_REG 0x1058#define CGX_CONST 0x2000#define CGX_CONST_RXFIFO_SIZE GENMASK_ULL(23, 0) +#define CGX_CONST_MAX_LMACS GENMASK_ULL(31, 24)#define CGXX_SPUX_CONTROL1 0x10000#define CGXX_SPUX_LNX_FEC_CORR_BLOCKS 0x10700#define CGXX_SPUX_LNX_FEC_UNCORR_BLOCKS 0x10800
drivers/net/ethernet/marvell/octeontx2/af/lmac_common.h +4 -1
@@ -128,7 +128,10 @@ struct cgx {struct pci_dev *pdev;u8 cgx_id;u8 lmac_count; -struct lmac *lmac_idmap[MAX_LMAC_PER_CGX ]; +/* number of LMACs per MAC could be 4 or 8 */ +u8 max_lmac_per_mac; +#define MAX_LMAC_COUNT 8 +struct lmac *lmac_idmap[MAX_LMAC_COUNT ];struct work_struct cgx_cmd_work;struct workqueue_struct *cgx_cmd_workq;struct list_head cgx_list;
drivers/net/ethernet/marvell/octeontx2/af/rvu.h +1 -1
@@ -480,7 +480,7 @@ struct rvu {u8 cgx_mapped_pfs;u8 cgx_cnt_max;/* CGX port count max */ u8 *pf2cgxlmac_map;/* pf to cgx_lmac map */ -u16 *cgxlmac2pf_map;/* bitmap of mapped pfs for +u64 *cgxlmac2pf_map;/* bitmap of mapped pfs for * every cgx lmac port */ unsigned long pf_notify_bmap;/* Flags for PF notification */
drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c +15 -11
@@ -55,8 +55,9 @@ bool is_mac_feature_supported(struct rvu *rvu, int pf, int feature)return (cgx_features_get (cgxd) & feature); } +#define CGX_OFFSET (x) ((x) * rvu->hw->lmac_per_cgx)/* Returns bitmap of mapped PFs */ -static u16 cgxlmac_to_pfmap (struct rvu *rvu,u8 cgx_id,u8 lmac_id) +static u64 cgxlmac_to_pfmap (struct rvu *rvu,u8 cgx_id,u8 lmac_id) {return rvu->cgxlmac2pf_map[CGX_OFFSET (cgx_id) + lmac_id]; }
@@ -71,7 +72,8 @@ int cgxlmac_to_pf(struct rvu *rvu, int cgx_id, int lmac_id)if (!pfmap)return -ENODEV ;else -return find_first_bit (&pfmap,16 ); +return find_first_bit (&pfmap, + rvu->cgx_cnt_max * rvu->hw->lmac_per_cgx); }static u8 cgxlmac_id_to_bmap (u8 cgx_id,u8 lmac_id)
@@ -129,14 +131,14 @@ static int rvu_map_cgx_lmac_pf(struct rvu *rvu)if (!cgx_cnt_max)return 0 ; -if (cgx_cnt_max >0xF ||MAX_LMAC_PER_CGX >0xF ) +if (cgx_cnt_max >0xF || rvu->hw->lmac_per_cgx >0xF )return -EINVAL ;/* Alloc map table * An additional entry is required since PF id starts from 1 and * hence entry at offset 0 is invalid. */ - size = (cgx_cnt_max *MAX_LMAC_PER_CGX +1 ) *sizeof (u8); + size = (cgx_cnt_max * rvu->hw->lmac_per_cgx +1 ) *sizeof (u8); rvu->pf2cgxlmac_map =devm_kmalloc (rvu->dev, size,GFP_KERNEL );if (!rvu->pf2cgxlmac_map)return -ENOMEM ;
@@ -145,9 +147,10 @@ static int rvu_map_cgx_lmac_pf(struct rvu *rvu)memset (rvu->pf2cgxlmac_map,0xFF , size);/* Reverse map table */ - rvu->cgxlmac2pf_map =devm_kzalloc (rvu->dev, - cgx_cnt_max *MAX_LMAC_PER_CGX *sizeof (u16), -GFP_KERNEL ); + rvu->cgxlmac2pf_map = +devm_kzalloc (rvu->dev, + cgx_cnt_max * rvu->hw->lmac_per_cgx *sizeof (u64), +GFP_KERNEL );if (!rvu->cgxlmac2pf_map)return -ENOMEM ;
@@ -156,7 +159,7 @@ static int rvu_map_cgx_lmac_pf(struct rvu *rvu)if (!rvu_cgx_pdata (cgx, rvu))continue ; lmac_bmap =cgx_get_lmac_bmap (rvu_cgx_pdata (cgx, rvu)); -for_each_set_bit (iter, &lmac_bmap,MAX_LMAC_PER_CGX ) { +for_each_set_bit (iter, &lmac_bmap, rvu->hw->lmac_per_cgx) { lmac =cgx_get_lmacid (rvu_cgx_pdata (cgx, rvu), iter); rvu->pf2cgxlmac_map[pf] =cgxlmac_id_to_bmap (cgx, lmac);
@@ -235,7 +238,8 @@ static void cgx_notify_pfs(struct cgx_link_event *event, struct rvu *rvu) pfmap =cgxlmac_to_pfmap (rvu, event->cgx_id, event->lmac_id); do { - pfid = find_first_bit(&pfmap, 16); + pfid = find_first_bit(&pfmap, + rvu->cgx_cnt_max * rvu->hw->lmac_per_cgx); clear_bit(pfid, &pfmap); /* check if notification is enabled */
@@ -310,7 +314,7 @@ static int cgx_lmac_event_handler_init(struct rvu *rvu)if (!cgxd)continue ; lmac_bmap =cgx_get_lmac_bmap (cgxd); -for_each_set_bit (lmac, &lmac_bmap,MAX_LMAC_PER_CGX ) { +for_each_set_bit (lmac, &lmac_bmap, rvu->hw->lmac_per_cgx) { err =cgx_lmac_evh_register (&cb, cgxd, lmac);if (err) dev_err(rvu->dev,
@@ -396,7 +400,7 @@ int rvu_cgx_exit(struct rvu *rvu)if (!cgxd)continue ; lmac_bmap =cgx_get_lmac_bmap (cgxd); -for_each_set_bit (lmac, &lmac_bmap,MAX_LMAC_PER_CGX ) +for_each_set_bit (lmac, &lmac_bmap, rvu->hw->lmac_per_cgx)cgx_lmac_evh_unregister (cgxd, lmac); }
drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c +1 -1
@@ -2618,7 +2618,7 @@ static void rvu_dbg_cgx_init(struct rvu *rvu) rvu->rvu_dbg.cgx =debugfs_create_dir (dname, rvu->rvu_dbg.cgx_root); -for_each_set_bit (lmac_id, &lmac_bmap,MAX_LMAC_PER_CGX ) { +for_each_set_bit (lmac_id, &lmac_bmap, rvu->hw->lmac_per_cgx) {/* lmac debugfs dir */ sprintf (dname,"lmac%d" , lmac_id); rvu->rvu_dbg.lmac =
drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +1 -1
@@ -4079,7 +4079,7 @@ static void nix_link_config(struct rvu *rvu, int blkaddr,/* Get LMAC id's from bitmap */ lmac_bmap =cgx_get_lmac_bmap (rvu_cgx_pdata (cgx, rvu)); -for_each_set_bit (iter, &lmac_bmap,MAX_LMAC_PER_CGX ) { +for_each_set_bit (iter, &lmac_bmap, rvu->hw->lmac_per_cgx) { lmac_fifo_len =rvu_cgx_get_lmac_fifolen (rvu, cgx, iter);if (!lmac_fifo_len) { dev_err(rvu->dev,
drivers/net/ethernet/marvell/octeontx2/af/rvu_npc_hash.c +3 -1
@@ -1999,7 +1999,9 @@ int rvu_npc_exact_init(struct rvu *rvu)/* Install SDP drop rule */ drop_mcam_idx = &table->num_drop_rules; - max_lmac_cnt = rvu->cgx_cnt_max *MAX_LMAC_PER_CGX +PF_CGXMAP_BASE ; + max_lmac_cnt = rvu->cgx_cnt_max * rvu->hw->lmac_per_cgx + +PF_CGXMAP_BASE ; +for (i =PF_CGXMAP_BASE ; i < max_lmac_cnt; i++) {if (rvu->pf2cgxlmac_map[i] ==0xFF )continue ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 129/150 btrfs: fix qgroup_free_reserved_data int overflow
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Burkov <[email protected]>
[ Upstream commit 9e65bfca24cf1d77e4a5c7a170db5867377b3fe7 ]
The reserved data counter and input parameter is a u64, but we inadvertently accumulate it in an int. Overflowing that int results in freeing the wrong amount of data and breaking reserve accounting.
Unfortunately, this overflow rot spreads from there, as the qgroup release/free functions rely on returning an int to take advantage of negative values for error codes.
Therefore, the full fix is to return the "released" or "freed" amount by a u64 argument and to return 0 or negative error code via the return value.
Most of the call sites simply ignore the return value, though some of them handle the error and count the returned bytes. Change all of them accordingly.
--- fs/btrfs/delalloc-space.c | 2 +- fs/btrfs/file.c | 2 +- fs/btrfs/inode.c | 16 ++++++++-------- fs/btrfs/ordered-data.c | 7 ++++--- fs/btrfs/qgroup.c | 25 +++++++++++++++---------- fs/btrfs/qgroup.h | 4 ++-- 6 files changed, 31 insertions(+), 25 deletions(-)
fs/btrfs/delalloc-space.c +1 -1
@@ -197,7 +197,7 @@ void btrfs_free_reserved_data_space(struct btrfs_inode *inode, start =round_down (start, fs_info->sectorsize);btrfs_free_reserved_data_space_noquota (fs_info, len); -btrfs_qgroup_free_data (inode, reserved, start, len); +btrfs_qgroup_free_data (inode, reserved, start, len,NULL ); }/**
fs/btrfs/file.c +1 -1
@@ -3191,7 +3191,7 @@ static long btrfs_fallocate(struct file *file, int mode, qgroup_reserved -= range->len; }else if (qgroup_reserved >0 ) {btrfs_qgroup_free_data (BTRFS_I (inode), data_reserved, - range->start, range->len); + range->start, range->len,NULL ); qgroup_reserved -= range->len; }list_del (&range->list);
fs/btrfs/inode.c +8 -8
@@ -466,7 +466,7 @@ static noinline int cow_file_range_inline(struct btrfs_inode *inode, u64 size,* And at reserve time, it's always aligned to page size, so * just free one page here. */ -btrfs_qgroup_free_data (inode,NULL ,0 ,PAGE_SIZE ); +btrfs_qgroup_free_data (inode,NULL ,0 ,PAGE_SIZE ,NULL );btrfs_free_path (path);btrfs_end_transaction (trans);return ret;
@@ -5372,7 +5372,7 @@ static void evict_inode_truncate_pages(struct inode *inode)*/ if (state_flags &EXTENT_DELALLOC )btrfs_qgroup_free_data (BTRFS_I (inode),NULL , start, - end - start +1 ); + end - start +1 ,NULL ); clear_extent_bit(io_tree, start, end, EXTENT_CLEAR_ALL_BITS | EXTENT_DO_ACCOUNTING,
@@ -8440,7 +8440,7 @@ static void btrfs_invalidate_folio(struct folio *folio, size_t offset,* reserved data space. * Since the IO will never happen for this page. */ -btrfs_qgroup_free_data (inode,NULL , cur, range_end +1 - cur); +btrfs_qgroup_free_data (inode,NULL , cur, range_end +1 - cur,NULL );if (!inode_evicting) { clear_extent_bit(tree, cur, range_end, EXTENT_LOCKED | EXTENT_DELALLOC | EXTENT_UPTODATE |
@@ -9902,7 +9902,7 @@ static struct btrfs_trans_handle *insert_prealloc_file_extent(struct btrfs_path *path;u64 start = ins->objectid;u64 len = ins->offset; -int qgroup_released; +u64 qgroup_released =0 ;int ret;memset (&stack_fi,0 ,sizeof (stack_fi));
@@ -9915,9 +9915,9 @@ static struct btrfs_trans_handle *insert_prealloc_file_extent(btrfs_set_stack_file_extent_compression (&stack_fi,BTRFS_COMPRESS_NONE );/* Encryption and other encoding is reserved and all 0 */ - qgroup_released =btrfs_qgroup_release_data (inode, file_offset, len); -if (qgroup_released <0 ) -return ERR_PTR (qgroup_released); + ret =btrfs_qgroup_release_data (inode, file_offset, len, &qgroup_released); +if (ret <0 ) +return ERR_PTR (ret);if (trans) { ret = insert_reserved_file_extent(trans, inode,
@@ -10903,7 +10903,7 @@ ssize_t btrfs_do_encoded_write(struct kiocb *iocb, struct iov_iter *from,btrfs_delalloc_release_metadata (inode, disk_num_bytes, ret <0 ); out_qgroup_free_data:if (ret <0 ) -btrfs_qgroup_free_data (inode, data_reserved, start, num_bytes); +btrfs_qgroup_free_data (inode, data_reserved, start, num_bytes,NULL ); out_free_data_space:/* * If btrfs_reserve_extent() succeeded, then we already decremented
fs/btrfs/ordered-data.c +4 -3
@@ -172,11 +172,12 @@ int btrfs_add_ordered_extent(struct btrfs_inode *inode, u64 file_offset,struct rb_node *node;struct btrfs_ordered_extent *entry;int ret; +u64 qgroup_rsv =0 ;if (flags & ((1 <<BTRFS_ORDERED_NOCOW ) | (1 <<BTRFS_ORDERED_PREALLOC ))) {/* For nocow write, we can release the qgroup rsv right now */ - ret =btrfs_qgroup_free_data (inode,NULL , file_offset, num_bytes); + ret =btrfs_qgroup_free_data (inode,NULL , file_offset, num_bytes, &qgroup_rsv);if (ret <0 )return ret; ret =0 ;
@@ -185,7 +186,7 @@ int btrfs_add_ordered_extent(struct btrfs_inode *inode, u64 file_offset,* The ordered extent has reserved qgroup space, release now * and pass the reserved number for qgroup_record to free. */ - ret =btrfs_qgroup_release_data (inode, file_offset, num_bytes); + ret =btrfs_qgroup_release_data (inode, file_offset, num_bytes, &qgroup_rsv);if (ret <0 )return ret; }
@@ -203,7 +204,7 @@ int btrfs_add_ordered_extent(struct btrfs_inode *inode, u64 file_offset, entry->inode =igrab (&inode->vfs_inode); entry->compress_type = compress_type; entry->truncated_len = (u64)-1 ; - entry->qgroup_rsv = ret; + entry->qgroup_rsv = qgroup_rsv; entry->physical = (u64)-1 ;ASSERT ((flags & ~BTRFS_ORDERED_TYPE_FLAGS ) ==0 );
fs/btrfs/qgroup.c +15 -10
@@ -3833,13 +3833,14 @@ int btrfs_qgroup_reserve_data(struct btrfs_inode *inode,/* Free ranges specified by @reserved, normally in error path */ static int qgroup_free_reserved_data (struct btrfs_inode *inode, -struct extent_changeset *reserved,u64 start,u64 len) +struct extent_changeset *reserved, +u64 start,u64 len,u64 *freed_ret) {struct btrfs_root *root = inode->root;struct ulist_node *unode;struct ulist_iterator uiter;struct extent_changeset changeset; -int freed =0 ; +u64 freed =0 ;int ret;extent_changeset_init (&changeset);
@@ -3880,7 +3881,9 @@ static int qgroup_free_reserved_data(struct btrfs_inode *inode, }btrfs_qgroup_free_refroot (root->fs_info, root->root_key.objectid, freed,BTRFS_QGROUP_RSV_DATA ); - ret = freed; +if (freed_ret) + *freed_ret = freed; + ret =0 ; out:extent_changeset_release (&changeset);return ret;
@@ -3888,7 +3891,7 @@ static int qgroup_free_reserved_data(struct btrfs_inode *inode,static int __btrfs_qgroup_release_data (struct btrfs_inode *inode,struct extent_changeset *reserved,u64 start,u64 len, -int free) +u64 *released,int free) {struct extent_changeset changeset;int trace_op =QGROUP_RELEASE ;
@@ -3900,7 +3903,7 @@ static int __btrfs_qgroup_release_data(struct btrfs_inode *inode,/* In release case, we shouldn't have @reserved */ WARN_ON (!free && reserved);if (free && reserved) -return qgroup_free_reserved_data (inode, reserved, start, len); +return qgroup_free_reserved_data (inode, reserved, start, len, released);extent_changeset_init (&changeset); ret =clear_record_extent_bits (&inode->io_tree, start, start + len -1 ,EXTENT_QGROUP_RESERVED , &changeset);
@@ -3915,7 +3918,8 @@ static int __btrfs_qgroup_release_data(struct btrfs_inode *inode,btrfs_qgroup_free_refroot (inode->root->fs_info, inode->root->root_key.objectid, changeset.bytes_changed,BTRFS_QGROUP_RSV_DATA ); - ret = changeset.bytes_changed; +if (released) + *released = changeset.bytes_changed; out:extent_changeset_release (&changeset);return ret;
@@ -3934,9 +3938,10 @@ static int __btrfs_qgroup_release_data(struct btrfs_inode *inode,* NOTE: This function may sleep for memory allocation. */ int btrfs_qgroup_free_data (struct btrfs_inode *inode, -struct extent_changeset *reserved,u64 start,u64 len) +struct extent_changeset *reserved, +u64 start,u64 len,u64 *freed) { -return __btrfs_qgroup_release_data (inode, reserved, start, len,1 ); +return __btrfs_qgroup_release_data (inode, reserved, start, len, freed,1 ); }/*
@@ -3954,9 +3959,9 @@ int btrfs_qgroup_free_data(struct btrfs_inode *inode,* * NOTE: This function may sleep for memory allocation. */ -int btrfs_qgroup_release_data (struct btrfs_inode *inode,u64 start,u64 len) +int btrfs_qgroup_release_data (struct btrfs_inode *inode,u64 start,u64 len,u64 *released) { -return __btrfs_qgroup_release_data (inode,NULL , start, len,0 ); +return __btrfs_qgroup_release_data (inode,NULL , start, len, released,0 ); } static void add_root_meta_rsv(struct btrfs_root *root, int num_bytes,
fs/btrfs/qgroup.h +2 -2
@@ -360,10 +360,10 @@ int btrfs_verify_qgroup_counts(struct btrfs_fs_info *fs_info, u64 qgroupid,/* New io_tree based accurate qgroup reserve API */ int btrfs_qgroup_reserve_data (struct btrfs_inode *inode,struct extent_changeset **reserved,u64 start,u64 len); -int btrfs_qgroup_release_data (struct btrfs_inode *inode,u64 start,u64 len); +int btrfs_qgroup_release_data (struct btrfs_inode *inode,u64 start,u64 len,u64 *released);int btrfs_qgroup_free_data (struct btrfs_inode *inode,struct extent_changeset *reserved,u64 start, -u64 len); +u64 len,u64 *freed);int btrfs_qgroup_reserve_meta (struct btrfs_root *root,int num_bytes,enum btrfs_qgroup_rsv_type type,bool enforce); int __btrfs_qgroup_reserve_meta(struct btrfs_root *root, int num_bytes,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 130/150 btrfs: mark the len field in struct btrfs_ordered_sum as unsigned
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
[ Upstream commit 6e4b2479ab38b3f949a85964da212295d32102f0 ]
len can't ever be negative, so mark it as an u32 instead of int.
Stable-dep-of: 9e65bfca24cf ("btrfs: fix qgroup_free_reserved_data int overflow")
--- fs/btrfs/file-item.c | 2 +- fs/btrfs/ordered-data.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
fs/btrfs/file-item.c +1 -1
@@ -602,7 +602,7 @@ int btrfs_lookup_csums_range(struct btrfs_root *root, u64 start, u64 end, } sums->bytenr = start; - sums->len = (int )size; + sums->len = size; offset = (start - key.offset) >> fs_info->sectorsize_bits; offset *= csum_size;
fs/btrfs/ordered-data.h +1 -1
@@ -20,7 +20,7 @@ struct btrfs_ordered_sum {/* * this is the length in bytes covered by the sums array below. */ -int len; +u32 len;struct list_head list;/* last field is a variable length array of csums */ u8 sums[];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 131/150 ring-buffer: Fix 32-bit rb_time_read() race with rb_time_cmpxchg()
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathieu Desnoyers <[email protected]>
[ Upstream commit dec890089bf79a4954b61482715ee2d084364856 ]
The following race can cause rb_time_read() to observe a corrupted time stamp:
rb_time_cmpxchg()
[...]
if (!rb_time_read_cmpxchg(&t->msb, msb, msb2))
return false;
if (!rb_time_read_cmpxchg(&t->top, top, top2))
return false;
<interrupted before updating bottom>
__rb_time_read()
[...]
do {
c = local_read(&t->cnt);
top = local_read(&t->top);
bottom = local_read(&t->bottom);
msb = local_read(&t->msb);
} while (c != local_read(&t->cnt));
*cnt = rb_time_cnt(top);
/* If top and msb counts don't match, this interrupted a write */
if (*cnt != rb_time_cnt(msb))
return false;
^ this check fails to catch that "bottom" is still not updated.So the old "bottom" value is returned, which is wrong.
Fix this by checking that all three of msb, top, and bottom 2-bit cnt values match.
The reason to favor checking all three fields over requiring a specific update order for both rb_time_set() and rb_time_cmpxchg() is because checking all three fields is more robust to handle partial failures of rb_time_cmpxchg() when interrupted by nested rb_time_set().
--- kernel/trace/ring_buffer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/trace/ring_buffer.c +2 -2
@@ -646,8 +646,8 @@ static inline bool __rb_time_read(rb_time_t *t, u64 *ret, unsigned long *cnt) *cnt =rb_time_cnt (top); -/* If top and msb counts don't match, this interrupted a write */ -if (*cnt !=rb_time_cnt (msb)) +/* If top, msb or bottom counts don't match, this interrupted a write */ +if (*cnt !=rb_time_cnt (msb) || *cnt !=rb_time_cnt (bottom))return false;/* The shift to msb will lose its cnt bits */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 132/150 firewire: ohci: suppress unexpected system reboot in AMD Ryzen machines and ASM108x/VT630x PCIe cards
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Sakamoto <[email protected]>
commit ac9184fbb8478dab4a0724b279f94956b69be827 upstream.
VIA VT6306/6307/6308 provides PCI interface compliant to 1394 OHCI. When the hardware is combined with Asmedia ASM1083/1085 PCIe-to-PCI bus bridge, it appears that accesses to its 'Isochronous Cycle Timer' register (offset 0xf0 on PCI memory space) often causes unexpected system reboot in any type of AMD Ryzen machine (both 0x17 and 0x19 families). It does not appears in the other type of machine (AMD pre-Ryzen machine, Intel machine, at least), or in the other OHCI 1394 hardware (e.g. Texas Instruments).
The issue explicitly appears at a commit dcadfd7f7c74 ("firewire: core:
use union for callback of transaction completion") added to v6.5 kernel. It changed 1394 OHCI driver to access to the register every time to dispatch local asynchronous transaction. However, the issue exists in older version of kernel as long as it runs in AMD Ryzen machine, since the access to the register is required to maintain bus time. It is not hard to imagine that users experience the unexpected system reboot when generating bus reset by plugging any devices in, or reading the register by time-aware application programs; e.g. audio sample processing.
This commit suppresses the unexpected system reboot in the combination of hardware. It avoids the access itself. As a result, the software stack can not provide the hardware time anymore to unit drivers, userspace applications, and nodes in the same IEEE 1394 bus. It brings apparent disadvantage since time-aware application programs require it, while time-unaware applications are available again; e.g. sbp2.
--- drivers/firewire/ohci.c | 51 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+)
drivers/firewire/ohci.c +51 -0
@@ -279,6 +279,51 @@ static char ohci_driver_name[] = KBUILD_#define QUIRK_TI_SLLZ059 0x20#define QUIRK_IR_WAKE 0x40 +// On PCI Express Root Complex in any type of AMD Ryzen machine, VIA VT6306/6307/6308 with Asmedia +// ASM1083/1085 brings an inconvenience that the read accesses to 'Isochronous Cycle Timer' register +// (at offset 0xf0 in PCI I/O space) often causes unexpected system reboot. The mechanism is not +// clear, since the read access to the other registers is enough safe; e.g. 'Node ID' register, +// while it is probable due to detection of any type of PCIe error. +#define QUIRK_REBOOT_BY_CYCLE_TIMER_READ 0x80000000 + +#if IS_ENABLED (CONFIG_X86 ) + +static bool has_reboot_by_cycle_timer_read_quirk (const struct fw_ohci *ohci) +{ +return !!(ohci->quirks &QUIRK_REBOOT_BY_CYCLE_TIMER_READ ); +} + +#define PCI_DEVICE_ID_ASMEDIA_ASM108X 0x1080 + +static bool detect_vt630x_with_asm1083_on_amd_ryzen_machine (const struct pci_dev *pdev) +{ +const struct pci_dev *pcie_to_pci_bridge; + +// Detect any type of AMD Ryzen machine. +if (!static_cpu_has (X86_FEATURE_ZEN )) +return false; + +// Detect VIA VT6306/6307/6308. +if (pdev->vendor !=PCI_VENDOR_ID_VIA ) +return false; +if (pdev->device !=PCI_DEVICE_ID_VIA_VT630X ) +return false; + +// Detect Asmedia ASM1083/1085. + pcie_to_pci_bridge = pdev->bus->self; +if (pcie_to_pci_bridge->vendor !=PCI_VENDOR_ID_ASMEDIA ) +return false; +if (pcie_to_pci_bridge->device !=PCI_DEVICE_ID_ASMEDIA_ASM108X ) +return false; + +return true; +} + +#else +#define has_reboot_by_cycle_timer_read_quirk (ohci) false +#define detect_vt630x_with_asm1083_on_amd_ryzen_machine (pdev) false +#endif +/* In case of multiple matches in ohci_quirks[], only the first one is used. */ static const struct { unsigned short vendor, device, revision, flags;
@@ -1713,6 +1758,9 @@ static u32 get_cycle_time(struct fw_ohcis32 diff01, diff12;int i; +if (has_reboot_by_cycle_timer_read_quirk (ohci)) +return 0 ; + c2 =reg_read (ohci, OHCI1394_IsochronousCycleTimer);if (ohci->quirks &QUIRK_CYCLE_TIMER ) {
@@ -3615,6 +3663,9 @@ static int pci_probe(struct pci_dev *devif (param_quirks) ohci->quirks = param_quirks; +if (detect_vt630x_with_asm1083_on_amd_ryzen_machine (dev)) + ohci->quirks |=QUIRK_REBOOT_BY_CYCLE_TIMER_READ ; +/* * Because dma_alloc_coherent() allocates at least one page, * we save space by using a common buffer for the AR request/
Greg Kroah-Hartman
maintainerPATCH 133/150 x86/kprobes: fix incorrect return address calculation in kprobe_emulate_call_indirect
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinghao Jia <[email protected]>
commit f5d03da48d062966c94f0199d20be0b3a37a7982 upstream.
kprobe_emulate_call_indirect currently uses int3_emulate_call to emulate indirect calls. However, int3_emulate_call always assumes the size of the call to be 5 bytes when calculating the return address. This is incorrect for register-based indirect calls in x86, which can be either 2 or 3 bytes depending on whether REX prefix is used. At kprobe runtime, the incorrect return address causes control flow to land onto the wrong place after return -- possibly not a valid instruction boundary. This can lead to a panic like the following:
[ 7.308204][ C1] BUG: unable to handle page fault for address: 000000000002b4d8 [ 7.308883][ C1] #PF: supervisor read access in kernel mode [ 7.309168][ C1] #PF: error_code(0x0000) - not-present page [ 7.309461][ C1] PGD 0 P4D 0 [ 7.309652][ C1] Oops: 0000 [#1] SMP [ 7.309929][ C1] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.7.0-rc5-trace-for-next #6 [ 7.310397][ C1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-20220807_005459-localhost 04/01/2014 [ 7.311068][ C1] RIP: 0010:__common_interrupt+0x52/0xc0 [ 7.311349][ C1] Code: 01 00 4d 85 f6 74 39 49 81 fe 00 f0 ff ff 77 30 4c 89 f7 4d 8b 5e 68 41 ba 91 76 d8 42 45 03 53 fc 74 02 0f 0b cc ff d3 65 48 <8b> 05 30 c7 ff 7e 65 4c 89 3d 28 c7 ff 7e 5b 41 5c 41 5e 41 5f c3 [ 7.312512][ C1] RSP: 0018:ffffc900000e0fd0 EFLAGS: 00010046 [ 7.312899][ C1] RAX: 0000000000000001 RBX: 0000000000000023 RCX: 0000000000000001 [ 7.313334][ C1] RDX: 00000000000003cd RSI: 0000000000000001 RDI: ffff888100d302a4 [ 7.313702][ C1] RBP: 0000000000000001 R08: 0ef439818636191f R09: b1621ff338a3b482 [ 7.314146][ C1] R10: ffffffff81e5127b R11: ffffffff81059810 R12: 0000000000000023 [ 7.314509][ C1] R13: 0000000000000000 R14: ffff888100d30200 R15: 0000000000000000 [ 7.314951][ C1] FS: 0000000000000000(0000) GS:ffff88813bc80000(0000) knlGS:0000000000000000 [ 7.315396][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 7.315691][ C1] CR2: 000000000002b4d8 CR3: 0000000003028003 CR4: 0000000000370ef0 [ 7.316153][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 7.316508][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 7.316948][ C1] Call Trace: [ 7.317123][ C1] <IRQ> [ 7.317279][ C1] ? __die_body+0x64/0xb0 [ 7.317482][ C1] ? page_fault_oops+0x248/0x370 [ 7.317712][ C1] ? __wake_up+0x96/0xb0 [ 7.317964][ C1] ? exc_page_fault+0x62/0x130 [ 7.318211][ C1] ? asm_exc_page_fault+0x22/0x30 [ 7.318444][ C1] ? __cfi_native_send_call_func_single_ipi+0x10/0x10 [ 7.318860][ C1] ? default_idle+0xb/0x10 [ 7.319063][ C1] ? __common_interrupt+0x52/0xc0 [ 7.319330][ C1] common_interrupt+0x78/0x90 [ 7.319546][ C1] </IRQ> [ 7.319679][ C1] <TASK> [ 7.319854][ C1] asm_common_interrupt+0x22/0x40 [ 7.320082][ C1] RIP: 0010:default_idle+0xb/0x10 [ 7.320309][ C1] Code: 4c 01 c7 4c 29 c2 e9 72 ff ff ff cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 b8 0c 67 40 a5 66 90 0f 00 2d 09 b9 3b 00 fb f4 <fa> c3 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 b8 0c 67 40 a5 e9 [ 7.321449][ C1] RSP: 0018:ffffc9000009bee8 EFLAGS: 00000256 [ 7.321808][ C1] RAX: ffff88813bca8b68 RBX: 0000000000000001 RCX: 000000000001ef0c [ 7.322227][ C1] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 000000000001ef0c [ 7.322656][ C1] RBP: ffffc9000009bef8 R08: 8000000000000000 R09: 00000000000008c2 [ 7.323083][ C1] R10: 0000000000000000 R11: ffffffff81058e70 R12: 0000000000000000 [ 7.323530][ C1] R13: ffff8881002b30c0 R14: 0000000000000000 R15: 0000000000000000 [ 7.323948][ C1] ? __cfi_lapic_next_deadline+0x10/0x10 [ 7.324239][ C1] default_idle_call+0x31/0x50 [ 7.324464][ C1] do_idle+0xd3/0x240 [ 7.324690][ C1] cpu_startup_entry+0x25/0x30 [ 7.324983][ C1] start_secondary+0xb4/0xc0 [ 7.325217][ C1] secondary_startup_64_no_verify+0x179/0x17b [ 7.325498][ C1] </TASK> [ 7.325641][ C1] Modules linked in: [ 7.325906][ C1] CR2: 000000000002b4d8 [ 7.326104][ C1] ---[ end trace 0000000000000000 ]--- [ 7.326354][ C1] RIP: 0010:__common_interrupt+0x52/0xc0 [ 7.326614][ C1] Code: 01 00 4d 85 f6 74 39 49 81 fe 00 f0 ff ff 77 30 4c 89 f7 4d 8b 5e 68 41 ba 91 76 d8 42 45 03 53 fc 74 02 0f 0b cc ff d3 65 48 <8b> 05 30 c7 ff 7e 65 4c 89 3d 28 c7 ff 7e 5b 41 5c 41 5e 41 5f c3 [ 7.327570][ C1] RSP: 0018:ffffc900000e0fd0 EFLAGS: 00010046 [ 7.327910][ C1] RAX: 0000000000000001 RBX: 0000000000000023 RCX: 0000000000000001 [ 7.328273][ C1] RDX: 00000000000003cd RSI: 0000000000000001 RDI: ffff888100d302a4 [ 7.328632][ C1] RBP: 0000000000000001 R08: 0ef439818636191f R09: b1621ff338a3b482 [ 7.329223][ C1] R10: ffffffff81e5127b R11: ffffffff81059810 R12: 0000000000000023 [ 7.329780][ C1] R13: 0000000000000000 R14: ffff888100d30200 R15: 0000000000000000 [ 7.330193][ C1] FS: 0000000000000000(0000) GS:ffff88813bc80000(0000) knlGS:0000000000000000 [ 7.330632][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 7.331050][ C1] CR2: 000000000002b4d8 CR3: 0000000003028003 CR4: 0000000000370ef0 [ 7.331454][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 7.331854][ C1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 7.332236][ C1] Kernel panic - not syncing: Fatal exception in interrupt [ 7.332730][ C1] Kernel Offset: disabled [ 7.333044][ C1] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
The relevant assembly code is (from objdump, faulting address highlighted):
ffffffff8102ed9d: 41 ff d3 call *%r11 ffffffff8102eda0: 65 48 <8b> 05 30 c7 ff mov %gs:0x7effc730(%rip),%rax
The emulation incorrectly sets the return address to be ffffffff8102ed9d
+ 0x5 = ffffffff8102eda2, which is the 8b byte in the middle of the next mov. This in turn causes incorrect subsequent instruction decoding and eventually triggers the page fault above.
Instead of invoking int3_emulate_call, perform push and jmp emulation directly in kprobe_emulate_call_indirect. At this point we can obtain the instruction size from p->ainsn.size so that we can calculate the correct return address.
--- arch/x86/kernel/kprobes/core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/x86/kernel/kprobes/core.c +2 -1
@@ -549,7 +549,8 @@ static void kprobe_emulate_call_indirect {unsigned long offs = addrmode_regoffs[p->ainsn.indirect.reg]; -int3_emulate_call (regs,regs_get_register (regs, offs)); +int3_emulate_push (regs, regs->ip -INT3_INSN_SIZE + p->ainsn.size); +int3_emulate_jmp (regs,regs_get_register (regs, offs)); }NOKPROBE_SYMBOL (kprobe_emulate_call_indirect);
Greg Kroah-Hartman
maintainerPATCH 134/150 i2c: core: Fix atomic xfer check for non-preempt config
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Bara <[email protected]>
commit a3368e1186e3ce8e38f78cbca019622095b1f331 upstream.
Since commit aa49c90894d0 ("i2c: core: Run atomic i2c xfer when !preemptible"), the whole reboot/power off sequence on non-preempt kernels is using atomic i2c xfer, as !preemptible() always results to 1.
During device_shutdown(), the i2c might be used a lot and not all busses have implemented an atomic xfer handler. This results in a lot of avoidable noise, like:
[ 12.687169] No atomic I2C transfer handler for 'i2c-0' [ 12.692313] WARNING: CPU: 6 PID: 275 at drivers/i2c/i2c-core.h:40 i2c_smbus_xfer+0x100/0x118
...
Fix this by allowing non-atomic xfer when the interrupts are enabled, as it was before.
--- drivers/i2c/i2c-core.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/i2c/i2c-core.h +3 -1
@@ -3,6 +3,7 @@* i2c-core.h - interfaces internal to the I2C framework */ +#include <linux/kconfig.h> #include <linux/rwsem.h> struct i2c_devinfo {
@@ -29,7 +30,8 @@ int i2c_dev_irq_from_resources(const str*/ static inline bool i2c_in_atomic_xfer_mode (void ) { -return system_state >SYSTEM_RUNNING && !preemptible (); +return system_state >SYSTEM_RUNNING && + (IS_ENABLED (CONFIG_PREEMPT_COUNT ) ? !preemptible () :irqs_disabled ()); }static inline int __i2c_lock_bus_helper (struct i2c_adapter *adap)
Greg Kroah-Hartman
maintainerPATCH 135/150 mm: fix unmap_mapping_range high bits shift bug
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiajun Xie <[email protected]>
commit 9eab0421fa94a3dde0d1f7e36ab3294fc306c99d upstream.
The bug happens when highest bit of holebegin is 1, suppose holebegin is 0x8000000111111000, after shift, hba would be 0xfff8000000111111, then vma_interval_tree_foreach would look it up fail or leads to the wrong result.
error call seq e.g.:
- mmap(..., offset=0x8000000111111000)
|- syscall(mmap, ... unsigned long, off):
|- ksys_mmap_pgoff( ... , off >> PAGE_SHIFT);
here pgoff is correctly shifted to 0x8000000111111, but pass 0x8000000111111000 as holebegin to unmap would then cause terrible result, as shown below:
- unmap_mapping_range(..., loff_t const holebegin)
|- pgoff_t hba = holebegin >> PAGE_SHIFT;
/* hba = 0xfff8000000111111 unexpectedly */The issue happens in Heterogeneous computing, where the device(e.g. gpu) and host share the same virtual address space.
A simple workflow pattern which hit the issue is:
/* host */
1. userspace first mmap a file backed VA range with specified offset. e.g. (offset=0x800..., mmap return: va_a)
2. write some data to the corresponding sys page
e.g. (va_a = 0xAABB)
/* device */
3. gpu workload touches VA, triggers gpu fault and notify the host. /* host */
4. reviced gpu fault notification, then it will:
4.1 unmap host pages and also takes care of cpu tlb
(use unmap_mapping_range with offset=0x800...)
4.2 migrate sys page to device
4.3 setup device page table and resolve device fault.
/* device */
5. gpu workload continued, it accessed va_a and got 0xAABB.
6. gpu workload continued, it wrote 0xBBCC to va_a.
/* host */
7. userspace access va_a, as expected, it will:
7.1 trigger cpu vm fault.
7.2 driver handling fault to migrate gpu local page to host.
8. userspace then could correctly get 0xBBCC from va_a
9. done
But in step 4.1, if we hit the bug this patch mentioned, then userspace would never trigger cpu fault, and still get the old value: 0xAABB.
Making holebegin unsigned first fixes the bug.
--- mm/memory.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
mm/memory.c +2 -2
@@ -3617,8 +3617,8 @@ EXPORT_SYMBOL_GPL(unmap_mapping_pages);void unmap_mapping_range (struct address_space *mapping,loff_t const holebegin,loff_t const holelen,int even_cows) { -pgoff_t hba = holebegin >>PAGE_SHIFT ; -pgoff_t hlen = (holelen +PAGE_SIZE -1 ) >>PAGE_SHIFT ; +pgoff_t hba = (pgoff_t)(holebegin) >>PAGE_SHIFT ; +pgoff_t hlen = ((pgoff_t)(holelen) +PAGE_SIZE -1 ) >>PAGE_SHIFT ;/* Check for overflow. */ if (sizeof (holelen) >sizeof (hlen)) {
Greg Kroah-Hartman
maintainerPATCH 136/150 drm/amdgpu: skip gpu_info fw loading on navi12
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 21f6137c64c65d6808c4a81006956197ca203383 upstream.
It's no longer required.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +2 -9
@@ -1976,15 +1976,8 @@ static int amdgpu_device_parse_gpu_info_ adev->firmware.gpu_info_fw =NULL ; -if (adev->mman.discovery_bin) { -/* -* FIXME: The bounding box is still needed by Navi12, so -* temporarily read it from gpu_info firmware. Should be dropped -* when DAL no longer needs it. -*/ -if (adev->asic_type !=CHIP_NAVI12 ) -return 0 ; - } +if (adev->mman.discovery_bin) +return 0 ;switch (adev->asic_type) {default :
Greg Kroah-Hartman
maintainerPATCH 137/150 drm/amd/display: add nv12 bounding box
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
commit 7e725c20fea8914ef1829da777f517ce1a93d388 upstream.
This was included in gpu_info firmware, move it into the driver for consistency with other nv1x parts.
--- drivers/gpu/drm/amd/display/dc/dml/dcn20/dcn20_fpu.c | 110 ++++++++++++++++++- 1 file changed, 109 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dml/dcn20/dcn20_fpu.c +109 -1
@@ -438,7 +438,115 @@ struct _vcs_dpi_soc_bounding_box_st dcn2 .use_urgent_burst_bw = 0 }; -struct _vcs_dpi_soc_bounding_box_st dcn2_0_nv12_soc = {0 }; +struct _vcs_dpi_soc_bounding_box_st dcn2_0_nv12_soc = { + .clock_limits = { + { + .state =0 , + .dcfclk_mhz =560.0 , + .fabricclk_mhz =560.0 , + .dispclk_mhz =513.0 , + .dppclk_mhz =513.0 , + .phyclk_mhz =540.0 , + .socclk_mhz =560.0 , + .dscclk_mhz =171.0 , + .dram_speed_mts =1069.0 , + }, + { + .state =1 , + .dcfclk_mhz =694.0 , + .fabricclk_mhz =694.0 , + .dispclk_mhz =642.0 , + .dppclk_mhz =642.0 , + .phyclk_mhz =600.0 , + .socclk_mhz =694.0 , + .dscclk_mhz =214.0 , + .dram_speed_mts =1324.0 , + }, + { + .state =2 , + .dcfclk_mhz =875.0 , + .fabricclk_mhz =875.0 , + .dispclk_mhz =734.0 , + .dppclk_mhz =734.0 , + .phyclk_mhz =810.0 , + .socclk_mhz =875.0 , + .dscclk_mhz =245.0 , + .dram_speed_mts =1670.0 , + }, + { + .state =3 , + .dcfclk_mhz =1000.0 , + .fabricclk_mhz =1000.0 , + .dispclk_mhz =1100.0 , + .dppclk_mhz =1100.0 , + .phyclk_mhz =810.0 , + .socclk_mhz =1000.0 , + .dscclk_mhz =367.0 , + .dram_speed_mts =2000.0 , + }, + { + .state =4 , + .dcfclk_mhz =1200.0 , + .fabricclk_mhz =1200.0 , + .dispclk_mhz =1284.0 , + .dppclk_mhz =1284.0 , + .phyclk_mhz =810.0 , + .socclk_mhz =1200.0 , + .dscclk_mhz =428.0 , + .dram_speed_mts =2000.0 , + }, + { + .state =5 , + .dcfclk_mhz =1200.0 , + .fabricclk_mhz =1200.0 , + .dispclk_mhz =1284.0 , + .dppclk_mhz =1284.0 , + .phyclk_mhz =810.0 , + .socclk_mhz =1200.0 , + .dscclk_mhz =428.0 , + .dram_speed_mts =2000.0 , + }, + }, + + .num_states =5 , + .sr_exit_time_us =1.9 , + .sr_enter_plus_exit_time_us =4.4 , + .urgent_latency_us =3.0 , + .urgent_latency_pixel_data_only_us =4.0 , + .urgent_latency_pixel_mixed_with_vm_data_us =4.0 , + .urgent_latency_vm_data_only_us =4.0 , + .urgent_out_of_order_return_per_channel_pixel_only_bytes =4096 , + .urgent_out_of_order_return_per_channel_pixel_and_vm_bytes =4096 , + .urgent_out_of_order_return_per_channel_vm_only_bytes =4096 , + .pct_ideal_dram_sdp_bw_after_urgent_pixel_only =40.0 , + .pct_ideal_dram_sdp_bw_after_urgent_pixel_and_vm =40.0 , + .pct_ideal_dram_sdp_bw_after_urgent_vm_only =40.0 , + .max_avg_sdp_bw_use_normal_percent =40.0 , + .max_avg_dram_bw_use_normal_percent =40.0 , + .writeback_latency_us =12.0 , + .ideal_dram_bw_after_urgent_percent =40.0 , + .max_request_size_bytes =256 , + .dram_channel_width_bytes =16 , + .fabric_datapath_to_dcn_data_return_bytes =64 , + .dcn_downspread_percent =0.5 , + .downspread_percent =0.5 , + .dram_page_open_time_ns =50.0 , + .dram_rw_turnaround_time_ns =17.5 , + .dram_return_buffer_per_channel_bytes =8192 , + .round_trip_ping_latency_dcfclk_cycles =131 , + .urgent_out_of_order_return_per_channel_bytes =4096 , + .channel_interleave_bytes =256 , + .num_banks =8 , + .num_chans =16 , + .vmm_page_size_bytes =4096 , + .dram_clock_change_latency_us =45.0 , + .writeback_dram_clock_change_latency_us =23.0 , + .return_bus_width_bytes =64 , + .dispclk_dppclk_vco_speed_mhz =3850 , + .xfc_bus_transport_time_us =20 , + .xfc_xbuf_latency_tolerance_us =50 , + .use_urgent_burst_bw =0 , +};struct _vcs_dpi_ip_params_st dcn2_1_ip = { .odm_capable =1 ,
Greg Kroah-Hartman
maintainerPATCH 138/150 mmc: meson-mx-sdhc: Fix initialization frozen issue
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyang Huang <[email protected]>
commit 8c124d998ea0c9022e247b11ac51f86ec8afa0e1 upstream.
Commit 4bc31edebde5 ("mmc: core: Set HS clock speed before sending HS CMD13") set HS clock (52MHz) before switching to HS mode. For this freq, FCLK_DIV5 will be selected and div value is 10 (reg value is 9). Then we set rx_clk_phase to 11 or 15 which is out of range and make hardware frozen. After we send command request, no irq will be interrupted and the mmc driver will keep to wait for request finished, even durning rebooting.
So let's set it to Phase 90 which should work in most cases. Then let meson_mx_sdhc_execute_tuning() to find the accurate value for data transfer.
If this doesn't work, maybe need to define a factor in dts.
--- drivers/mmc/host/meson-mx-sdhc-mmc.c | 26 +++++--------------------- 1 file changed, 5 insertions(+), 21 deletions(-)
drivers/mmc/host/meson-mx-sdhc-mmc.c +5 -21
@@ -269,7 +269,7 @@ static int meson_mx_sdhc_enable_clks(strstatic int meson_mx_sdhc_set_clk (struct mmc_host *mmc,struct mmc_ios *ios) {struct meson_mx_sdhc_host *host =mmc_priv (mmc); -u32 rx_clk_phase; +u32 val, rx_clk_phase;int ret;meson_mx_sdhc_disable_clks (mmc);
@@ -290,27 +290,11 @@ static int meson_mx_sdhc_set_clk(struct mmc->actual_clock =clk_get_rate (host->sd_clk);/* -* according to Amlogic the following latching points are -* selected with empirical values, there is no (known) formula -* to calculate these. +* Phase 90 should work in most cases. For data transmission, +* meson_mx_sdhc_execute_tuning() will find a accurate value */ -if (mmc->actual_clock >100000000 ) { - rx_clk_phase =1 ; - }else if (mmc->actual_clock >45000000 ) { -if (ios->signal_voltage ==MMC_SIGNAL_VOLTAGE_330 ) - rx_clk_phase =15 ; -else - rx_clk_phase =11 ; - }else if (mmc->actual_clock >=25000000 ) { - rx_clk_phase =15 ; - }else if (mmc->actual_clock >5000000 ) { - rx_clk_phase =23 ; - }else if (mmc->actual_clock >1000000 ) { - rx_clk_phase =55 ; - }else { - rx_clk_phase =1061 ; - } - +regmap_read (host->regmap,MESON_SDHC_CLKC , &val); + rx_clk_phase =FIELD_GET (MESON_SDHC_CLKC_CLK_DIV , val) /4 ; regmap_update_bits(host->regmap, MESON_SDHC_CLK2, MESON_SDHC_CLK2_RX_CLK_PHASE, FIELD_PREP(MESON_SDHC_CLK2_RX_CLK_PHASE,
Greg Kroah-Hartman
maintainerPATCH 139/150 mmc: rpmb: fixes pause retune on all RPMB partitions.
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jorge Ramirez-Ortiz <[email protected]>
commit e7794c14fd73e5eb4a3e0ecaa5334d5a17377c50 upstream.
When RPMB was converted to a character device, it added support for multiple RPMB partitions (Commit 97548575bef3 ("mmc: block: Convert RPMB to a character device").
One of the changes in this commit was transforming the variable target_part defined in __mmc_blk_ioctl_cmd into a bitmask. This inadvertently regressed the validation check done in mmc_blk_part_switch_pre() and mmc_blk_part_switch_post(), so let's fix it.
--- drivers/mmc/core/block.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/mmc/core/block.c +4 -3
@@ -866,9 +866,10 @@ static const struct block_device_operatistatic int mmc_blk_part_switch_pre (struct mmc_card *card,unsigned int part_type) { +const unsigned int mask =EXT_CSD_PART_CONFIG_ACC_RPMB ;int ret =0 ; -if (part_type ==EXT_CSD_PART_CONFIG_ACC_RPMB ) { +if ((part_type & mask) == mask) {if (card->ext_csd.cmdq_en) { ret =mmc_cmdq_disable (card);if (ret)
@@ -883,9 +884,10 @@ static int mmc_blk_part_switch_pre(strucstatic int mmc_blk_part_switch_post (struct mmc_card *card,unsigned int part_type) { +const unsigned int mask =EXT_CSD_PART_CONFIG_ACC_RPMB ;int ret =0 ; -if (part_type ==EXT_CSD_PART_CONFIG_ACC_RPMB ) { +if ((part_type & mask) == mask) {mmc_retune_unpause (card->host);if (card->reenable_cmdq && !card->ext_csd.cmdq_en) ret =mmc_cmdq_enable (card);
@@ -3180,4 +3182,3 @@ module_exit(mmc_blk_exit);MODULE_LICENSE ("GPL" );MODULE_DESCRIPTION ("Multimedia Card (MMC) block device driver" ); -
Greg Kroah-Hartman
maintainerPATCH 140/150 mmc: core: Cancel delayed work before releasing host
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
commit 1036f69e251380573e256568cf814506e3fb9988 upstream.
On RZ/Five SMARC EVK, where probing of SDHI is deferred due to probe deferral of the vqmmc-supply regulator:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 0 at kernel/time/timer.c:1738 __run_timers.part.0+0x1d0/0x1e8
Modules linked in:
CPU: 0 PID: 0 Comm: swapper Not tainted 6.7.0-rc4 #101
Hardware name: Renesas SMARC EVK based on r9a07g043f01 (DT)
epc : __run_timers.part.0+0x1d0/0x1e8
ra : __run_timers.part.0+0x134/0x1e8
epc : ffffffff800771a4 ra : ffffffff80077108 sp : ffffffc800003e60
gp : ffffffff814f5028 tp : ffffffff8140c5c0 t0 : ffffffc800000000
t1 : 0000000000000001 t2 : ffffffff81201300 s0 : ffffffc800003f20
s1 : ffffffd8023bc4a0 a0 : 00000000fffee6b0 a1 : 0004010000400000
a2 : ffffffffc0000016 a3 : ffffffff81488640 a4 : ffffffc800003e60
a5 : 0000000000000000 a6 : 0000000004000000 a7 : ffffffc800003e68
s2 : 0000000000000122 s3 : 0000000000200000 s4 : 0000000000000000
s5 : ffffffffffffffff s6 : ffffffff81488678 s7 : ffffffff814886c0
s8 : ffffffff814f49c0 s9 : ffffffff81488640 s10: 0000000000000000
s11: ffffffc800003e60 t3 : 0000000000000240 t4 : 0000000000000a52
t5 : ffffffd8024ae018 t6 : ffffffd8024ae038
status: 0000000200000100 badaddr: 0000000000000000 cause: 0000000000000003
[<ffffffff800771a4>] __run_timers.part.0+0x1d0/0x1e8
[<ffffffff800771e0>] run_timer_softirq+0x24/0x4a
[<ffffffff80809092>] __do_softirq+0xc6/0x1fa
[<ffffffff80028e4c>] irq_exit_rcu+0x66/0x84
[<ffffffff80800f7a>] handle_riscv_irq+0x40/0x4e
[<ffffffff80808f48>] call_on_irq_stack+0x1c/0x28
---[ end trace 0000000000000000 ]---What happens?
renesas_sdhi_probe()
{
tmio_mmc_host_alloc()
mmc_alloc_host()
INIT_DELAYED_WORK(&host->detect, mmc_rescan);
devm_request_irq(tmio_mmc_irq);
/*
* After this, the interrupt handler may be invoked at any time
*
* tmio_mmc_irq()
* {
* __tmio_mmc_card_detect_irq()
* mmc_detect_change()
* _mmc_detect_change()
* mmc_schedule_delayed_work(&host->detect, delay);
* }
*/
tmio_mmc_host_probe()
tmio_mmc_init_ocr()
-EPROBE_DEFER
tmio_mmc_host_free()
mmc_free_host()
}When expire_timers() runs later, it warns because the MMC host structure containing the delayed work was freed, and now contains an invalid work function pointer.
Fix this by cancelling any pending delayed work before releasing the MMC host structure.
--- drivers/mmc/core/host.c | 1 + 1 file changed, 1 insertion(+)
drivers/mmc/core/host.c +1 -0
@@ -670,6 +670,7 @@ EXPORT_SYMBOL(mmc_remove_host);*/ void mmc_free_host (struct mmc_host *host) { +cancel_delayed_work_sync (&host->detect);mmc_pwrseq_free (host);put_device (&host->class_dev); }
Greg Kroah-Hartman
maintainerPATCH 141/150 mmc: sdhci-sprd: Fix eMMC init failure after hw reset
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenchao Chen <[email protected]>
commit 8abf77c88929b6d20fa4f9928b18d6448d64e293 upstream.
Some eMMC devices that do not close the auto clk gate after hw reset will cause eMMC initialization to fail. Let's fix this.
--- drivers/mmc/host/sdhci-sprd.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/mmc/host/sdhci-sprd.c +7 -3
@@ -228,15 +228,19 @@ static inline void _sdhci_sprd_set_clock div = ((div &0x300 ) >>2 ) | ((div &0xFF ) <<8 );sdhci_enable_clk (host, div); + val =sdhci_readl (host,SDHCI_SPRD_REG_32_BUSY_POSI ); + mask =SDHCI_SPRD_BIT_OUTR_CLK_AUTO_EN |SDHCI_SPRD_BIT_INNR_CLK_AUTO_EN ;/* Enable CLK_AUTO when the clock is greater than 400K. */ if (clk >400000 ) { - val =sdhci_readl (host,SDHCI_SPRD_REG_32_BUSY_POSI ); - mask =SDHCI_SPRD_BIT_OUTR_CLK_AUTO_EN | -SDHCI_SPRD_BIT_INNR_CLK_AUTO_EN ;if (mask != (val & mask)) { val |= mask;sdhci_writel (host, val,SDHCI_SPRD_REG_32_BUSY_POSI ); } + }else { +if (val & mask) { + val &= ~mask; +sdhci_writel (host, val,SDHCI_SPRD_REG_32_BUSY_POSI ); + } } }
Greg Kroah-Hartman
maintainerPATCH 142/150 genirq/affinity: Only build SMP-only helper functions on SMP kernels
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ingo Molnar <[email protected]>
commit 188a569658584e93930ab60334c5a1079c0330d8 upstream.
allnoconfig grew these new build warnings in lib/group_cpus.c:
lib/group_cpus.c:247:12: warning: ‘__group_cpus_evenly’ defined but not used [-Wunused-function] lib/group_cpus.c:75:13: warning: ‘build_node_to_cpumask’ defined but not used [-Wunused-function] lib/group_cpus.c:66:13: warning: ‘free_node_to_cpumask’ defined but not used [-Wunused-function] lib/group_cpus.c:43:23: warning: ‘alloc_node_to_cpumask’ defined but not used [-Wunused-function]
Widen the #ifdef CONFIG_SMP block to not expose unused helpers on non-SMP builds.
Also annotate the preprocessor branches for better readability.
--- lib/group_cpus.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
lib/group_cpus.c +4 -3
@@ -9,6 +9,8 @@#include <linux/sort.h> #include <linux/group_cpus.h> +#ifdef CONFIG_SMP +static void grp_spread_init_one (struct cpumask *irqmsk,struct cpumask *nmsk,unsigned int cpus_per_grp) {
@@ -327,7 +329,6 @@ static int __group_cpus_evenly(unsignedreturn done; } -#ifdef CONFIG_SMP /** * group_cpus_evenly - Group all CPUs evenly per NUMA/CPU locality * @numgrps: number of groups
@@ -422,7 +423,7 @@ struct cpumask *group_cpus_evenly(unsign }return masks; } -#else +#else /* CONFIG_SMP */ struct cpumask *group_cpus_evenly (unsigned int numgrps) {struct cpumask *masks =kcalloc (numgrps,sizeof (*masks),GFP_KERNEL );
@@ -434,4 +435,4 @@ struct cpumask *group_cpus_evenly(unsigncpumask_copy (&masks[0 ], cpu_possible_mask); return masks; } -#endif +#endif /* CONFIG_SMP */
Greg Kroah-Hartman
maintainerPATCH 143/150 f2fs: compress: fix to assign compress_level for lz4 correctly
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
commit 091a4dfbb1d32b06c031edbfe2a44af100c4604f upstream.
After remount, F2FS_OPTION().compress_level was assgin to LZ4HC_DEFAULT_CLEVEL incorrectly, result in lz4hc:9 was enabled, fix it.
1. mount /dev/vdb/dev/vdb on /mnt/f2fs type f2fs (...,compress_algorithm=lz4,compress_log_size=2,...)
2. mount -t f2fs -o remount,compress_log_size=3 /mnt/f2fs/
3. mount|grep f2fs/dev/vdb on /mnt/f2fs type f2fs (...,compress_algorithm=lz4:9,compress_log_size=3,...)
--- fs/f2fs/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/f2fs/super.c +1 -1
@@ -615,7 +615,7 @@ static int f2fs_set_lz4hc_level(struct funsigned int level;if (strlen (str) ==3 ) { -F2FS_OPTION (sbi).compress_level =LZ4HC_DEFAULT_CLEVEL ; +F2FS_OPTION (sbi).compress_level =0 ;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 144/150 net/sched: act_ct: additional checks for outdated flows
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlad Buslov <[email protected]>
commit a63b6622120cd03a304796dbccb80655b3a21798 upstream.
Current nf_flow_is_outdated() implementation considers any flow table flow which state diverged from its underlying CT connection status for teardown which can be problematic in the following cases:
- Flow has never been offloaded to hardware in the first place either because flow table has hardware offload disabled (flag NF_FLOWTABLE_HW_OFFLOAD is not set) or because it is still pending on 'add' workqueue to be offloaded for the first time. The former is incorrect, the later generates excessive deletions and additions of flows.
- Flow is already pending to be updated on the workqueue. Tearing down such flows will also generate excessive removals from the flow table, especially on highly loaded system where the latency to re-offload a flow via 'add' workqueue can be quite high.
When considering a flow for teardown as outdated verify that it is both offloaded to hardware and doesn't have any pending updates.
--- net/sched/act_ct.c | 2 ++ 1 file changed, 2 insertions(+)
net/sched/act_ct.c +2 -0
@@ -277,6 +277,8 @@ err_nat:static bool tcf_ct_flow_is_outdated (const struct flow_offload *flow) {return test_bit (IPS_SEEN_REPLY_BIT , &flow->ct->status) && +test_bit (IPS_HW_OFFLOAD_BIT , &flow->ct->status) && + !test_bit (NF_FLOW_HW_PENDING , &flow->flags) && !test_bit (NF_FLOW_HW_ESTABLISHED , &flow->flags); }
Greg Kroah-Hartman
maintainerPATCH 145/150 net/sched: act_ct: Always fill offloading tuple iifidx
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlad Buslov <[email protected]>
commit 9bc64bd0cd765f696fcd40fc98909b1f7c73b2ba upstream.
Referenced commit doesn't always set iifidx when offloading the flow to hardware. Fix the following cases:
- nf_conn_act_ct_ext_fill() is called before extension is created with nf_conn_act_ct_ext_add() in tcf_ct_act(). This can cause rule offload with unspecified iifidx when connection is offloaded after only single original-direction packet has been processed by tc data path. Always fill the new nf_conn_act_ct_ext instance after creating it in nf_conn_act_ct_ext_add().
- Offloading of unidirectional UDP NEW connections is now supported, but ct flow iifidx field is not updated when connection is promoted to bidirectional which can result reply-direction iifidx to be zero when refreshing the connection. Fill in the extension and update flow iifidx before calling flow_offload_refresh().
--- include/net/netfilter/nf_conntrack_act_ct.h | 30 +++++++++++++++------------- net/openvswitch/conntrack.c | 2 - net/sched/act_ct.c | 15 +++++++++++++- 3 files changed, 32 insertions(+), 15 deletions(-)
include/net/netfilter/nf_conntrack_act_ct.h +17 -13
@@ -20,7 +20,22 @@ static inline struct nf_conn_act_ct_ext#endif } -static inline struct nf_conn_act_ct_ext *nf_conn_act_ct_ext_add (struct nf_conn *ct) +static inline void nf_conn_act_ct_ext_fill (struct sk_buff *skb,struct nf_conn *ct, +enum ip_conntrack_info ctinfo) +{ +#if IS_ENABLED (CONFIG_NET_ACT_CT ) +struct nf_conn_act_ct_ext *act_ct_ext; + + act_ct_ext =nf_conn_act_ct_ext_find (ct); +if (dev_net (skb->dev) == &init_net && act_ct_ext) + act_ct_ext->ifindex[CTINFO2DIR (ctinfo)] = skb->dev->ifindex; +#endif +} + +static inline struct +nf_conn_act_ct_ext *nf_conn_act_ct_ext_add (struct sk_buff *skb, +struct nf_conn *ct, +enum ip_conntrack_info ctinfo) {#if IS_ENABLED (CONFIG_NET_ACT_CT )struct nf_conn_act_ct_ext *act_ct =nf_ct_ext_find (ct,NF_CT_EXT_ACT_CT );
@@ -29,22 +44,11 @@ static inline struct nf_conn_act_ct_extreturn act_ct; act_ct =nf_ct_ext_add (ct,NF_CT_EXT_ACT_CT ,GFP_ATOMIC ); +nf_conn_act_ct_ext_fill (skb, ct, ctinfo);return act_ct;#else return NULL ; #endif } -static inline void nf_conn_act_ct_ext_fill (struct sk_buff *skb,struct nf_conn *ct, -enum ip_conntrack_info ctinfo) -{ -#if IS_ENABLED (CONFIG_NET_ACT_CT ) -struct nf_conn_act_ct_ext *act_ct_ext; - - act_ct_ext =nf_conn_act_ct_ext_find (ct); -if (dev_net (skb->dev) == &init_net && act_ct_ext) - act_ct_ext->ifindex[CTINFO2DIR (ctinfo)] = skb->dev->ifindex; -#endif -} -#endif /* _NF_CONNTRACK_ACT_CT_H */
net/openvswitch/conntrack.c +1 -1
@@ -1252,7 +1252,7 @@ static int ovs_ct_commit(struct net *netif (err)return err; -nf_conn_act_ct_ext_add (ct); +nf_conn_act_ct_ext_add (skb, ct, ctinfo); }else if (IS_ENABLED (CONFIG_NF_CONNTRACK_LABELS ) &&labels_nonzero (&info->labels.mask)) { err = ovs_ct_set_labels(ct, key, &info->labels.value,
net/sched/act_ct.c +14 -1
@@ -394,6 +394,17 @@ static void tcf_ct_flow_tc_ifidx(struct entry->tuplehash[dir].tuple.tc.iifidx = act_ct_ext->ifindex[dir]; } +static void tcf_ct_flow_ct_ext_ifidx_update (struct flow_offload *entry) +{ +struct nf_conn_act_ct_ext *act_ct_ext; + + act_ct_ext =nf_conn_act_ct_ext_find (entry->ct); +if (act_ct_ext) { +tcf_ct_flow_tc_ifidx (entry, act_ct_ext,FLOW_OFFLOAD_DIR_ORIGINAL ); +tcf_ct_flow_tc_ifidx (entry, act_ct_ext,FLOW_OFFLOAD_DIR_REPLY ); + } +} +static void tcf_ct_flow_table_add (struct tcf_ct_flow_table *ct_ft,struct nf_conn *ct,bool tcp,bool bidirectional)
@@ -689,6 +700,8 @@ static bool tcf_ct_flow_table_lookup(strelse ctinfo =IP_CT_ESTABLISHED_REPLY ; +nf_conn_act_ct_ext_fill (skb, ct, ctinfo); +tcf_ct_flow_ct_ext_ifidx_update (flow);flow_offload_refresh (nf_ft, flow, force_refresh);if (!test_bit (IPS_ASSURED_BIT , &ct->status)) {/* Process this flow in SW to allow promoting to ASSURED */
@@ -1191,7 +1204,7 @@ do_nat:tcf_ct_act_set_labels (ct, p->labels, p->labels_mask);if (!nf_ct_is_confirmed (ct)) -nf_conn_act_ct_ext_add (ct); +nf_conn_act_ct_ext_add (skb, ct, ctinfo);/* This will take care of sending queued events * even if the connection is already confirmed.
Greg Kroah-Hartman
maintainerPATCH 146/150 bpf: Fix a verifier bug due to incorrect branch offset comparison with cpu=v4
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonghong Song <[email protected]>
commit dfce9cb3140592b886838e06f3e0c25fea2a9cae upstream.
Bpf cpu=v4 support is introduced in [1] and Commit 4cd58e9af8b9 ("bpf: Support new 32bit offset jmp instruction") added support for new 32bit offset jmp instruction. Unfortunately, in function bpf_adj_delta_to_off(), for new branch insn with 32bit offset, the offset (plus/minor a small delta) compares to 16-bit offset bound [S16_MIN, S16_MAX], which caused the following verification failure:
$ ./test_progs-cpuv4 -t verif_scale_pyperf180 ... insn 10 cannot be patched due to 16-bit range ... libbpf: failed to load object 'pyperf180.bpf.o' scale_test:FAIL:expect_success unexpected error: -12 (errno 12) #405 verif_scale_pyperf180:FAIL
Note that due to recent llvm18 development, the patch [2] (already applied in bpf-next) needs to be applied to bpf tree for testing purpose.
The fix is rather simple. For 32bit offset branch insn, the adjusted offset compares to [S32_MIN, S32_MAX] and then verification succeeded.
[1] https://lore.kernel.org/all/[email protected]
[2] https://lore.kernel.org/bpf/[email protected]
--- kernel/bpf/core.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
kernel/bpf/core.c +8 -4
@@ -365,14 +365,18 @@ static int bpf_adj_delta_to_imm(struct bstatic int bpf_adj_delta_to_off (struct bpf_insn *insn,u32 pos,s32 end_old,s32 end_new,s32 curr,const bool probe_pass) { -const s32 off_min =S16_MIN , off_max =S16_MAX ; +s64 off_min, off_max, off;s32 delta = end_new - end_old; -s32 off; -if (insn->code == (BPF_JMP32 |BPF_JA )) +if (insn->code == (BPF_JMP32 |BPF_JA )) { off = insn->imm; -else + off_min =S32_MIN ; + off_max =S32_MAX ; + }else { off = insn->off; + off_min =S16_MIN ; + off_max =S16_MAX ; + }if (curr < pos && curr + off +1 >= end_old) off += delta;
Greg Kroah-Hartman
maintainerPATCH 147/150 bpf: syzkaller found null ptr deref in unix_bpf proto add
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Fastabend <[email protected]>
commit 8d6650646ce49e9a5b8c5c23eb94f74b1749f70f upstream.
I added logic to track the sock pair for stream_unix sockets so that we ensure lifetime of the sock matches the time a sockmap could reference the sock (see fixes tag). I forgot though that we allow af_unix unconnected sockets into a sock{map|hash} map.
This is problematic because previous fixed expected sk_pair() to exist and did not NULL check it. Because unconnected sockets have a NULL sk_pair this resulted in the NULL ptr dereference found by syzkaller.
BUG: KASAN: null-ptr-deref in unix_stream_bpf_update_proto+0x72/0x430 net/unix/unix_bpf.c:171 Write of size 4 at addr 0000000000000080 by task syz-executor360/5073 Call Trace: <TASK> ... sock_hold include/net/sock.h:777 [inline] unix_stream_bpf_update_proto+0x72/0x430 net/unix/unix_bpf.c:171 sock_map_init_proto net/core/sock_map.c:190 [inline] sock_map_link+0xb87/0x1100 net/core/sock_map.c:294 sock_map_update_common+0xf6/0x870 net/core/sock_map.c:483 sock_map_update_elem_sys+0x5b6/0x640 net/core/sock_map.c:577 bpf_map_update_value+0x3af/0x820 kernel/bpf/syscall.c:167
We considered just checking for the null ptr and skipping taking a ref on the NULL peer sock. But, if the socket is then connected() after being added to the sockmap we can cause the original issue again. So instead this patch blocks adding af_unix sockets that are not in the ESTABLISHED state.
--- include/net/sock.h | 5 +++++ net/core/sock_map.c | 2 ++ 2 files changed, 7 insertions(+)
include/net/sock.h +5 -0
@@ -2829,6 +2829,11 @@ static inline bool sk_is_tcp(const strucreturn sk->sk_type ==SOCK_STREAM && sk->sk_protocol ==IPPROTO_TCP ; } +static inline bool sk_is_stream_unix (const struct sock *sk) +{ +return sk->sk_family ==AF_UNIX && sk->sk_type ==SOCK_STREAM ; +} +/** * sk_eat_skb - Release a skb if it is no longer needed * @sk: socket to eat this skb from
net/core/sock_map.c +2 -0
@@ -538,6 +538,8 @@ static bool sock_map_sk_state_allowed(co {if (sk_is_tcp (sk))return (1 << sk->sk_state) & (TCPF_ESTABLISHED |TCPF_LISTEN ); +if (sk_is_stream_unix (sk)) +return (1 << sk->sk_state) &TCPF_ESTABLISHED ;return true; }
Greg Kroah-Hartman
maintainerPATCH 148/150 media: qcom: camss: Comment CSID dt_id field
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryan O'Donoghue <[email protected]>
commit f910d3ba78a2677c23508f225eb047d89eb4b2b6 upstream.
Digging into the documentation we find that the DT_ID bitfield is used to map the six bit DT to a two bit ID code. This value is concatenated to the VC bitfield to create a CID value. DT_ID is the two least significant bits of CID and VC the most significant bits.
Originally we set dt_id = vc * 4 in and then subsequently set dt_id = vc.
commit 3c4ed72a16bc ("media: camss: sm8250: Virtual channels for CSID") silently fixed the multiplication by four which would give a better value for the generated CID without mentioning what was being done or why.
Next up I haplessly changed the value back to "dt_id = vc * 4" since there didn't appear to be any logic behind it.
Hans asked what the change was for and I honestly couldn't remember the provenance of it, so I dug in.
Add a comment so the next hapless programmer doesn't make this same mistake.
--- drivers/media/platform/qcom/camss/camss-csid-gen2.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/media/platform/qcom/camss/camss-csid-gen2.c +13 -1
@@ -352,7 +352,19 @@ static void __csid_configure_stream(stru phy_sel = csid->phy.csiphy_id;if (enable) { -u8 dt_id = vc; +/* +* DT_ID is a two bit bitfield that is concatenated with +* the four least significant bits of the five bit VC +* bitfield to generate an internal CID value. +* +* CSID_RDI_CFG0(vc) +* DT_ID : 28:27 +* VC : 26:22 +* DT : 21:16 +* +* CID : VC 3:0 << 2 | DT_ID 1:0 +*/ +u8 dt_id = vc &0x03 ;if (tg->enabled) {/* configure one DT, infinite frames */
Greg Kroah-Hartman
maintainerPATCH 149/150 smb3: Replace smb2pdu 1-element arrays with flex-arrays
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
commit eb3e28c1e89b4984308777231887e41aa8a0151f upstream.
The kernel is globally removing the ambiguous 0-length and 1-element arrays in favor of flexible arrays, so that we can gain both compile-time and run-time array bounds checking[1].
Replace the trailing 1-element array with a flexible array in the following structures:
struct smb2_err_rsp
struct smb2_tree_connect_req
struct smb2_negotiate_rsp
struct smb2_sess_setup_req
struct smb2_sess_setup_rsp
struct smb2_read_req
struct smb2_read_rsp
struct smb2_write_req
struct smb2_write_rsp
struct smb2_query_directory_req
struct smb2_query_directory_rsp
struct smb2_set_info_req
struct smb2_change_notify_rsp
struct smb2_create_rsp
struct smb2_query_info_req
struct smb2_query_info_rsp
Replace the trailing 1-element array with a flexible array, but leave the existing structure padding:
struct smb2_file_all_info
struct smb2_lock_req
Adjust all related size calculations to match the changes to sizeof().
No machine code output or .data section differences are produced after these changes.
[1] For lots of details, see both:
https://docs.kernel.org/process/deprecated.html#zero-length-and-one-element-arrays
https://people.kernel.org/kees/bounded-flexible-arrays-in-c
--- fs/smb/client/smb2file.c | 2 +- fs/smb/client/smb2misc.c | 2 +- fs/smb/client/smb2ops.c | 14 +++++++------- fs/smb/client/smb2pdu.c | 16 +++++++--------- fs/smb/client/smb2pdu.h | 2 +- fs/smb/common/smb2pdu.h | 42 ++++++++++++++++++++++++------------------ fs/smb/server/smb2ops.c | 8 ++++---- fs/smb/server/smb2pdu.c | 5 ++--- 8 files changed, 47 insertions(+), 44 deletions(-)
fs/smb/client/smb2file.c +1 -1
@@ -34,7 +34,7 @@ static struct smb2_symlink_err_rsp *syml len = (u32 )err->ErrorContextCount * (offsetof(struct smb2_error_context_rsp , ErrorContextData) +sizeof (struct smb2_symlink_err_rsp )); -if (le32_to_cpu (err->ByteCount) < len || iov->iov_len < len +sizeof (*err)) +if (le32_to_cpu (err->ByteCount) < len || iov->iov_len < len +sizeof (*err) +1 )return ERR_PTR (-EINVAL ); p = (struct smb2_error_context_rsp *)err->ErrorData;
fs/smb/client/smb2misc.c +1 -1
@@ -113,7 +113,7 @@ static __u32 get_neg_ctxt_len(struct smb }else if (nc_offset +1 == non_ctxlen) {cifs_dbg (FYI ,"no SPNEGO security blob in negprot rsp\n" ); size_of_pad_before_neg_ctxts =0 ; - }else if (non_ctxlen ==SMB311_NEGPROT_BASE_SIZE ) + }else if (non_ctxlen ==SMB311_NEGPROT_BASE_SIZE +1 )/* has padding, but no SPNEGO blob */ size_of_pad_before_neg_ctxts = nc_offset - non_ctxlen +1 ;else
fs/smb/client/smb2ops.c +7 -7
@@ -5764,7 +5764,7 @@ struct smb_version_values smb20_values = .header_size = sizeof(struct smb2_hdr), .header_preamble_size = 0, .max_header_size = MAX_SMB2_HDR_SIZE, - .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, + .read_rsp_size = sizeof(struct smb2_read_rsp), .lock_cmd = SMB2_LOCK, .cap_unix = 0, .cap_nt_find = SMB2_NT_FIND,
@@ -5786,7 +5786,7 @@ struct smb_version_values smb21_values = .header_size = sizeof(struct smb2_hdr), .header_preamble_size = 0, .max_header_size = MAX_SMB2_HDR_SIZE, - .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, + .read_rsp_size = sizeof(struct smb2_read_rsp), .lock_cmd = SMB2_LOCK, .cap_unix = 0, .cap_nt_find = SMB2_NT_FIND,
@@ -5807,7 +5807,7 @@ struct smb_version_values smb3any_values .header_size = sizeof(struct smb2_hdr), .header_preamble_size = 0, .max_header_size = MAX_SMB2_HDR_SIZE, - .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, + .read_rsp_size = sizeof(struct smb2_read_rsp), .lock_cmd = SMB2_LOCK, .cap_unix = 0, .cap_nt_find = SMB2_NT_FIND,
@@ -5828,7 +5828,7 @@ struct smb_version_values smbdefault_val .header_size = sizeof(struct smb2_hdr), .header_preamble_size = 0, .max_header_size = MAX_SMB2_HDR_SIZE, - .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, + .read_rsp_size = sizeof(struct smb2_read_rsp), .lock_cmd = SMB2_LOCK, .cap_unix = 0, .cap_nt_find = SMB2_NT_FIND,
@@ -5849,7 +5849,7 @@ struct smb_version_values smb30_values = .header_size = sizeof(struct smb2_hdr), .header_preamble_size = 0, .max_header_size = MAX_SMB2_HDR_SIZE, - .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, + .read_rsp_size = sizeof(struct smb2_read_rsp), .lock_cmd = SMB2_LOCK, .cap_unix = 0, .cap_nt_find = SMB2_NT_FIND,
@@ -5870,7 +5870,7 @@ struct smb_version_values smb302_values .header_size = sizeof(struct smb2_hdr), .header_preamble_size = 0, .max_header_size = MAX_SMB2_HDR_SIZE, - .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, + .read_rsp_size = sizeof(struct smb2_read_rsp), .lock_cmd = SMB2_LOCK, .cap_unix = 0, .cap_nt_find = SMB2_NT_FIND,
@@ -5891,7 +5891,7 @@ struct smb_version_values smb311_values .header_size = sizeof(struct smb2_hdr), .header_preamble_size = 0, .max_header_size = MAX_SMB2_HDR_SIZE, - .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, + .read_rsp_size = sizeof(struct smb2_read_rsp), .lock_cmd = SMB2_LOCK, .cap_unix = 0, .cap_nt_find = SMB2_NT_FIND,
fs/smb/client/smb2pdu.c +7 -9
@@ -1386,7 +1386,7 @@ SMB2_sess_sendreceive(struct SMB2_sess_d/* Testing shows that buffer offset must be at location of Buffer[0] */ req->SecurityBufferOffset = -cpu_to_le16 (sizeof (struct smb2_sess_setup_req ) -1 /* pad */ ); +cpu_to_le16 (sizeof (struct smb2_sess_setup_req )); req->SecurityBufferLength =cpu_to_le16 (sess_data->iov[1 ].iov_len);memset (&rqst,0 ,sizeof (struct smb_rqst ));
@@ -1905,8 +1905,7 @@ SMB2_tcon(const unsigned int xid, struct iov[0 ].iov_len = total_len -1 ;/* Testing shows that buffer offset must be at location of Buffer[0] */ - req->PathOffset =cpu_to_le16 (sizeof (struct smb2_tree_connect_req ) - -1 /* pad */ ); + req->PathOffset =cpu_to_le16 (sizeof (struct smb2_tree_connect_req )); req->PathLength =cpu_to_le16 (unc_path_len -2 ); iov[1 ].iov_base = unc_path; iov[1 ].iov_len = unc_path_len;
@@ -3796,7 +3795,7 @@ SMB2_change_notify(const unsigned int xi ses->Suid, (u8)watch_tree, completion_filter);/* validate that notify information is plausible */ if ((rsp_iov.iov_base ==NULL ) || - (rsp_iov.iov_len <sizeof (struct smb2_change_notify_rsp ))) + (rsp_iov.iov_len <sizeof (struct smb2_change_notify_rsp ) +1 )) goto cnotify_exit; smb_rsp = (struct smb2_change_notify_rsp *)rsp_iov.iov_base;
@@ -5009,7 +5008,7 @@ int SMB2_query_directory_init(const unsimemcpy (bufptr, &asteriks, len); req->FileNameOffset = -cpu_to_le16 (sizeof (struct smb2_query_directory_req ) -1 ); +cpu_to_le16 (sizeof (struct smb2_query_directory_req )); req->FileNameLength =cpu_to_le16 (len);/* * BB could be 30 bytes or so longer if we used SMB2 specific
@@ -5205,8 +5204,7 @@ SMB2_set_info_init(struct cifs_tcon *tco req->VolatileFileId = volatile_fid; req->AdditionalInformation =cpu_to_le32 (additional_info); - req->BufferOffset = -cpu_to_le16 (sizeof (struct smb2_set_info_req ) -1 ); + req->BufferOffset =cpu_to_le16 (sizeof (struct smb2_set_info_req )); req->BufferLength =cpu_to_le32 (*size);memcpy (req->Buffer, *data, *size);
@@ -5440,9 +5438,9 @@ build_qfs_info_req(struct kvec *iov, str req->VolatileFileId = volatile_fid;/* 1 for pad */ req->InputBufferOffset = -cpu_to_le16 (sizeof (struct smb2_query_info_req ) -1 ); +cpu_to_le16 (sizeof (struct smb2_query_info_req )); req->OutputBufferLength =cpu_to_le32 ( - outbuf_len +sizeof (struct smb2_query_info_rsp ) -1 ); + outbuf_len +sizeof (struct smb2_query_info_rsp )); iov->iov_base = (char *)req; iov->iov_len = total_len;
fs/smb/client/smb2pdu.h +1 -1
@@ -57,7 +57,7 @@ struct smb2_rdma_crypto_transform {#define COMPOUND_FID 0xFFFFFFFFFFFFFFFFULL#define SMB2_SYMLINK_STRUCT_SIZE \ - (sizeof(struct smb2_err_rsp) - 1 + sizeof(struct smb2_symlink_err_rsp)) + (sizeof(struct smb2_err_rsp) + sizeof(struct smb2_symlink_err_rsp))#define SYMLINK_ERROR_TAG 0x4c4d5953
fs/smb/common/smb2pdu.h +24 -18
150 lines not on this page · raw message
fs/smb/server/smb2ops.c +4 -4
@@ -26,7 +26,7 @@ static struct smb_version_values smb21_s .unlock_lock_type = SMB2_LOCKFLAG_UNLOCK, .header_size = sizeof(struct smb2_hdr), .max_header_size = MAX_SMB2_HDR_SIZE, - .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, + .read_rsp_size = sizeof(struct smb2_read_rsp), .lock_cmd = SMB2_LOCK, .cap_unix = 0, .cap_nt_find = SMB2_NT_FIND,
@@ -52,7 +52,7 @@ static struct smb_version_values smb30_s .unlock_lock_type = SMB2_LOCKFLAG_UNLOCK, .header_size = sizeof(struct smb2_hdr), .max_header_size = MAX_SMB2_HDR_SIZE, - .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, + .read_rsp_size = sizeof(struct smb2_read_rsp), .lock_cmd = SMB2_LOCK, .cap_unix = 0, .cap_nt_find = SMB2_NT_FIND,
@@ -79,7 +79,7 @@ static struct smb_version_values smb302_ .unlock_lock_type = SMB2_LOCKFLAG_UNLOCK, .header_size = sizeof(struct smb2_hdr), .max_header_size = MAX_SMB2_HDR_SIZE, - .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, + .read_rsp_size = sizeof(struct smb2_read_rsp), .lock_cmd = SMB2_LOCK, .cap_unix = 0, .cap_nt_find = SMB2_NT_FIND,
@@ -106,7 +106,7 @@ static struct smb_version_values smb311_ .unlock_lock_type = SMB2_LOCKFLAG_UNLOCK, .header_size = sizeof(struct smb2_hdr), .max_header_size = MAX_SMB2_HDR_SIZE, - .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, + .read_rsp_size = sizeof(struct smb2_read_rsp), .lock_cmd = SMB2_LOCK, .cap_unix = 0, .cap_nt_find = SMB2_NT_FIND,
fs/smb/server/smb2pdu.c +2 -3
@@ -295,7 +295,7 @@ int init_smb2_neg_rsp(struct ksmbd_work rsp->SecurityMode |=SMB2_NEGOTIATE_SIGNING_REQUIRED_LE ; err =ksmbd_iov_pin_rsp (work, rsp,sizeof (struct smb2_negotiate_rsp ) - -sizeof (rsp->Buffer) +AUTH_GSS_LENGTH ); +sizeof (struct smb2_hdr ) +AUTH_GSS_LENGTH );if (err)return err; conn->use_spnego = true;
@@ -1264,8 +1264,7 @@ err_out:if (!rc) rc =ksmbd_iov_pin_rsp (work, rsp,sizeof (struct smb2_negotiate_rsp ) - -sizeof (rsp->Buffer) + -AUTH_GSS_LENGTH + neg_ctxt_len); +sizeof (struct smb2_hdr ) +AUTH_GSS_LENGTH + neg_ctxt_len);if (rc <0 )smb2_set_err_rsp (work);return rc;
Namjae Jeon
maintainerRe: [PATCH 6.1 149/150] smb3: Replace smb2pdu 1-element arrays with flex-arrays
2024-01-09 0:36 GMT+09:00, Greg Kroah-Hartman <[email protected]>:
Quoted 1 line
6.1-stable review patch. If anyone has any objections, please let me know.
This patch incorrectly changed ksmbd part. This will cause problem that can not connect windows client. I will send you an updated patch soon.
Thanks!
Quoted 465 lines
------------------
From: Kees Cook <[email protected]>
commit
eb3e28c1e89b4984308777231887e41aa8a0151fupstream.The kernel is globally removing the ambiguous 0-length and 1-element arrays in favor of flexible arrays, so that we can gain both compile-time and run-time array bounds checking[1].
Replace the trailing 1-element array with a flexible array in the following structures:
struct
smb2_err_rsp
structsmb2_tree_connect_req
structsmb2_negotiate_rsp
structsmb2_sess_setup_req
structsmb2_sess_setup_rsp
structsmb2_read_req
structsmb2_read_rsp
structsmb2_write_req
structsmb2_write_rsp
structsmb2_query_directory_req
structsmb2_query_directory_rsp
structsmb2_set_info_req
structsmb2_change_notify_rsp
structsmb2_create_rsp
structsmb2_query_info_req
structsmb2_query_info_rspReplace the trailing 1-element array with a flexible array, but leave the existing structure padding:
struct
smb2_file_all_info
structsmb2_lock_reqAdjust all related size calculations to match the changes to
sizeof().No machine code output or .data section differences are produced after these changes.
[1] For lots of details, see both:
https://docs.kernel.org/process/deprecated.html#zero-length-and-one-element-arrays
https://people.kernel.org/kees/bounded-flexible-arrays-in-cCc Steve French <[email protected]>Cc Paulo Alcantara <[email protected]>Cc Ronnie Sahlberg <[email protected]>Cc Shyam Prasad N <[email protected]>Cc Tom Talpey <[email protected]>Cc Namjae Jeon <[email protected]>Cc Sergey Senozhatsky <[email protected]>Reviewed-by Namjae Jeon <[email protected]>Signed-off-by Kees Cook <[email protected]>Signed-off-by Steve French <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- fs/smb/client/smb2file.c | 2 +- fs/smb/client/smb2misc.c | 2 +- fs/smb/client/smb2ops.c | 14 +++++++------- fs/smb/client/smb2pdu.c | 16 +++++++--------- fs/smb/client/smb2pdu.h | 2 +- fs/smb/common/smb2pdu.h | 42 ++++++++++++++++++++++++------------------ fs/smb/server/smb2ops.c | 8 ++++---- fs/smb/server/smb2pdu.c | 5 ++--- 8 files changed, 47 insertions(+), 44 deletions(-)fs/smb/client/smb2file.c +1
-1@@ -34,7 +34,7 @@ static struct smb2_symlink_err_rsp *syml len = (u32 )err->ErrorContextCount * (offsetof(struct smb2_error_context_rsp , ErrorContextData) +sizeof (struct smb2_symlink_err_rsp )); -if (le32_to_cpu (err->ByteCount) < len || iov->iov_len < len + sizeof(*err)) +if (le32_to_cpu (err->ByteCount) < len || iov->iov_len < len +sizeof (*err) +1 )fs/smb/client/smb2file.c +0
-0return ERR_PTR (-EINVAL ); p = (struct smb2_error_context_rsp *)err->ErrorData;fs/smb/client/smb2misc.c +1
-1@@ -113,7 +113,7 @@ static __u32 get_neg_ctxt_len(struct smb }else if (nc_offset +1 == non_ctxlen) {cifs_dbg (FYI ,"no SPNEGO security blob in negprot rsp\n" ); size_of_pad_before_neg_ctxts =0 ; - }else if (non_ctxlen ==SMB311_NEGPROT_BASE_SIZE ) + }else if (non_ctxlen ==SMB311_NEGPROT_BASE_SIZE +1 )/* has padding, but no SPNEGO blob */ size_of_pad_before_neg_ctxts = nc_offset - non_ctxlen +1 ;else fs/smb/client/smb2ops.c +7
-7@@ -5764,7 +5764,7 @@ struct smb_version_values smb20_values = .header_size = sizeof(struct smb2_hdr), .header_preamble_size = 0, .max_header_size = MAX_SMB2_HDR_SIZE, - .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, + .read_rsp_size = sizeof(struct smb2_read_rsp), .lock_cmd = SMB2_LOCK, .cap_unix = 0, .cap_nt_find = SMB2_NT_FIND,@@ -5786,7 +5786,7 @@ struct smb_version_values smb21_values = .header_size = sizeof(struct smb2_hdr), .header_preamble_size = 0, .max_header_size = MAX_SMB2_HDR_SIZE, - .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, + .read_rsp_size = sizeof(struct smb2_read_rsp), .lock_cmd = SMB2_LOCK, .cap_unix = 0, .cap_nt_find = SMB2_NT_FIND,@@ -5807,7 +5807,7 @@ struct smb_version_values smb3any_values .header_size = sizeof(struct smb2_hdr), .header_preamble_size = 0, .max_header_size = MAX_SMB2_HDR_SIZE, - .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, + .read_rsp_size = sizeof(struct smb2_read_rsp), .lock_cmd = SMB2_LOCK, .cap_unix = 0, .cap_nt_find = SMB2_NT_FIND,@@ -5828,7 +5828,7 @@ struct smb_version_values smbdefault_val .header_size = sizeof(struct smb2_hdr), .header_preamble_size = 0, .max_header_size = MAX_SMB2_HDR_SIZE, - .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, + .read_rsp_size = sizeof(struct smb2_read_rsp), .lock_cmd = SMB2_LOCK, .cap_unix = 0, .cap_nt_find = SMB2_NT_FIND,@@ -5849,7 +5849,7 @@ struct smb_version_values smb30_values = .header_size = sizeof(struct smb2_hdr), .header_preamble_size = 0, .max_header_size = MAX_SMB2_HDR_SIZE, - .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, + .read_rsp_size = sizeof(struct smb2_read_rsp), .lock_cmd = SMB2_LOCK, .cap_unix = 0, .cap_nt_find = SMB2_NT_FIND,@@ -5870,7 +5870,7 @@ struct smb_version_values smb302_values .header_size = sizeof(struct smb2_hdr), .header_preamble_size = 0, .max_header_size = MAX_SMB2_HDR_SIZE, - .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, + .read_rsp_size = sizeof(struct smb2_read_rsp), .lock_cmd = SMB2_LOCK, .cap_unix = 0, .cap_nt_find = SMB2_NT_FIND,@@ -5891,7 +5891,7 @@ struct smb_version_values smb311_values .header_size = sizeof(struct smb2_hdr), .header_preamble_size = 0, .max_header_size = MAX_SMB2_HDR_SIZE, - .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, + .read_rsp_size = sizeof(struct smb2_read_rsp), .lock_cmd = SMB2_LOCK, .cap_unix = 0, .cap_nt_find = SMB2_NT_FIND,fs/smb/client/smb2pdu.c +7
-9@@ -1386,7 +1386,7 @@ SMB2_sess_sendreceive(struct SMB2_sess_d/* Testing shows that buffer offset must be at location of Buffer[0] */ req->SecurityBufferOffset = -cpu_to_le16 (sizeof (struct smb2_sess_setup_req ) -1 /* pad */ ); +cpu_to_le16 (sizeof (struct smb2_sess_setup_req )); req->SecurityBufferLength =cpu_to_le16 (sess_data->iov[1 ].iov_len);memset (&rqst,0 ,sizeof (struct smb_rqst ));@@ -1905,8 +1905,7 @@ SMB2_tcon(const unsigned int xid, struct iov[0 ].iov_len = total_len -1 ;/* Testing shows that buffer offset must be at location of Buffer[0] */ - req->PathOffset =cpu_to_le16 (sizeof (struct smb2_tree_connect_req ) - -1 /* pad */ ); + req->PathOffset =cpu_to_le16 (sizeof (struct smb2_tree_connect_req )); req->PathLength =cpu_to_le16 (unc_path_len -2 ); iov[1 ].iov_base = unc_path; iov[1 ].iov_len = unc_path_len;@@ -3796,7 +3795,7 @@ SMB2_change_notify(const unsigned int xi ses->Suid, (u8)watch_tree, completion_filter);/* validate that notify information is plausible */ if ((rsp_iov.iov_base ==NULL ) || - (rsp_iov.iov_len <sizeof (struct smb2_change_notify_rsp ))) + (rsp_iov.iov_len <sizeof (struct smb2_change_notify_rsp ) +1 )) goto cnotify_exit; smb_rsp = (struct smb2_change_notify_rsp *)rsp_iov.iov_base;@@ -5009,7 +5008,7 @@ int SMB2_query_directory_init(const unsimemcpy (bufptr, &asteriks, len); req->FileNameOffset = -cpu_to_le16 (sizeof (struct smb2_query_directory_req ) -1 ); +cpu_to_le16 (sizeof (struct smb2_query_directory_req )); req->FileNameLength =cpu_to_le16 (len);/* * BB could be 30 bytes or so longer if we used SMB2 specific @@ -5205,8 +5204,7 @@ SMB2_set_info_init(struct cifs_tcon *tco req->VolatileFileId = volatile_fid; req->AdditionalInformation =cpu_to_le32 (additional_info); - req->BufferOffset = -cpu_to_le16 (sizeof (struct smb2_set_info_req ) -1 ); + req->BufferOffset =cpu_to_le16 (sizeof (struct smb2_set_info_req )); req->BufferLength =cpu_to_le32 (*size);memcpy (req->Buffer, *data, *size);@@ -5440,9 +5438,9 @@ build_qfs_info_req(struct kvec *iov, str req->VolatileFileId = volatile_fid;/* 1 for pad */ req->InputBufferOffset = -cpu_to_le16 (sizeof (struct smb2_query_info_req ) -1 ); +cpu_to_le16 (sizeof (struct smb2_query_info_req )); req->OutputBufferLength =cpu_to_le32 ( - outbuf_len +sizeof (struct smb2_query_info_rsp ) -1 ); + outbuf_len +sizeof (struct smb2_query_info_rsp )); iov->iov_base = (char *)req; iov->iov_len = total_len;fs/smb/client/smb2pdu.h +1
-1@@ -57,7 +57,7 @@ struct smb2_rdma_crypto_transform {#define COMPOUND_FID 0xFFFFFFFFFFFFFFFFULL#define SMB2_SYMLINK_STRUCT_SIZE \ - (sizeof(struct smb2_err_rsp) - 1 + sizeof(struct smb2_symlink_err_rsp)) + (sizeof(struct smb2_err_rsp) + sizeof(struct smb2_symlink_err_rsp))#define SYMLINK_ERROR_TAG 0x4c4d5953fs/smb/common/smb2pdu.h +24
-18@@ -189,7 +189,7 @@ struct smb2_err_rsp {__u8 ErrorContextCount;__u8 Reserved;__le32 ByteCount;/* even if zero, at least one byte follows */ -__u8 ErrorData[1 ];/* variable length */ +__u8 ErrorData[];/* variable length */ } __packed;#define SMB3_AES_CCM_NONCE 11@@ -330,7 +330,7 @@ struct smb2_tree_connect_req {__le16 Flags;/* Flags in SMB3.1.1 */ __le16 PathOffset;__le16 PathLength; -__u8 Buffer[1 ];/* variable length */ +__u8 Buffer[];/* variable length */ } __packed;/* Possible ShareType values */ @@ -617,7 +617,7 @@ struct smb2_negotiate_rsp {__le16 SecurityBufferOffset;__le16 SecurityBufferLength;__le32 NegotiateContextOffset;/* Pre:SMB3.1.1 was reserved/ignored */ -__u8 Buffer[1 ];/* variable length GSS security buffer */ +__u8 Buffer[];/* variable length GSS security buffer */ } __packed;@@ -638,7 +638,7 @@ struct smb2_sess_setup_req {__le16 SecurityBufferOffset;__le16 SecurityBufferLength;__le64 PreviousSessionId; -__u8 Buffer[1 ];/* variable length GSS security buffer */ +__u8 Buffer[];/* variable length GSS security buffer */ } __packed;/* Currently defined SessionFlags */ @@ -655,7 +655,7 @@ struct smb2_sess_setup_rsp {__le16 SessionFlags;__le16 SecurityBufferOffset;__le16 SecurityBufferLength; -__u8 Buffer[1 ];/* variable length GSS security buffer */ +__u8 Buffer[];/* variable length GSS security buffer */ } __packed;@@ -737,7 +737,7 @@ struct smb2_read_req {__le32 RemainingBytes;__le16 ReadChannelInfoOffset;__le16 ReadChannelInfoLength; -__u8 Buffer[1 ]; +__u8 Buffer[]; } __packed;/* Read flags */ @@ -752,7 +752,7 @@ struct smb2_read_rsp {__le32 DataLength;__le32 DataRemaining;__le32 Flags; -__u8 Buffer[1 ]; +__u8 Buffer[]; } __packed;@@ -776,7 +776,7 @@ struct smb2_write_req {__le16 WriteChannelInfoOffset;__le16 WriteChannelInfoLength;__le32 Flags; -__u8 Buffer[1 ]; +__u8 Buffer[]; } __packed;struct smb2_write_rsp {@@ -787,7 +787,7 @@ struct smb2_write_rsp {__le32 DataLength;__le32 DataRemaining;__u32 Reserved2; -__u8 Buffer[1 ]; +__u8 Buffer[]; } __packed;@@ -834,7 +834,10 @@ struct smb2_lock_req {__u64 PersistentFileId;__u64 VolatileFileId;/* Followed by at least one */ -struct smb2_lock_element locks[1 ]; +union { +struct smb2_lock_element lock; + DECLARE_FLEX_ARRAY(struct smb2_lock_element, locks); + }; } __packed;struct smb2_lock_rsp {@@ -888,7 +891,7 @@ struct smb2_query_directory_req {__le16 FileNameOffset;__le16 FileNameLength;__le32 OutputBufferLength; -__u8 Buffer[1 ]; +__u8 Buffer[]; } __packed;struct smb2_query_directory_rsp {@@ -896,7 +899,7 @@ struct smb2_query_directory_rsp {__le16 StructureSize;/* Must be 9 */ __le16 OutputBufferOffset;__le32 OutputBufferLength; -__u8 Buffer[1 ]; +__u8 Buffer[]; } __packed;/* @@ -919,7 +922,7 @@ struct smb2_set_info_req {__le32 AdditionalInformation;__u64 PersistentFileId;__u64 VolatileFileId; -__u8 Buffer[1 ]; +__u8 Buffer[]; } __packed;struct smb2_set_info_rsp {@@ -974,7 +977,7 @@ struct smb2_change_notify_rsp {__le16 StructureSize;/* Must be 9 */ __le16 OutputBufferOffset;__le32 OutputBufferLength; -__u8 Buffer[1 ];/* array of file notify structs */ +__u8 Buffer[];/* array of file notify structs */ } __packed;@@ -1180,7 +1183,7 @@ struct smb2_create_rsp {__u64 VolatileFileId;__le32 CreateContextsOffset;__le32 CreateContextsLength; -__u8 Buffer[1 ]; +__u8 Buffer[]; } __packed;struct create_posix {@@ -1524,7 +1527,7 @@ struct smb2_query_info_req {__le32 Flags;__u64 PersistentFileId;__u64 VolatileFileId; -__u8 Buffer[1 ]; +__u8 Buffer[]; } __packed;struct smb2_query_info_rsp {@@ -1532,7 +1535,7 @@ struct smb2_query_info_rsp {__le16 StructureSize;/* Must be 9 */ __le16 OutputBufferOffset;__le32 OutputBufferLength; -__u8 Buffer[1 ]; +__u8 Buffer[]; } __packed;/* @@ -1593,7 +1596,10 @@ struct smb2_file_all_info { /* data bloc__le32 Mode;__le32 AlignmentRequirement;__le32 FileNameLength; -char FileName[1 ]; +union { +char __pad;/* Legacy structure padding */ + DECLARE_FLEX_ARRAY(char, FileName); + }; } __packed;/* level 18 Query */ struct smb2_file_eof_info {/* encoding of request for level 10 */ fs/smb/server/smb2ops.c +4
-4@@ -26,7 +26,7 @@ static struct smb_version_values smb21_s .unlock_lock_type = SMB2_LOCKFLAG_UNLOCK, .header_size = sizeof(struct smb2_hdr), .max_header_size = MAX_SMB2_HDR_SIZE, - .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, + .read_rsp_size = sizeof(struct smb2_read_rsp), .lock_cmd = SMB2_LOCK, .cap_unix = 0, .cap_nt_find = SMB2_NT_FIND,@@ -52,7 +52,7 @@ static struct smb_version_values smb30_s .unlock_lock_type = SMB2_LOCKFLAG_UNLOCK, .header_size = sizeof(struct smb2_hdr), .max_header_size = MAX_SMB2_HDR_SIZE, - .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, + .read_rsp_size = sizeof(struct smb2_read_rsp), .lock_cmd = SMB2_LOCK, .cap_unix = 0, .cap_nt_find = SMB2_NT_FIND,@@ -79,7 +79,7 @@ static struct smb_version_values smb302_ .unlock_lock_type = SMB2_LOCKFLAG_UNLOCK, .header_size = sizeof(struct smb2_hdr), .max_header_size = MAX_SMB2_HDR_SIZE, - .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, + .read_rsp_size = sizeof(struct smb2_read_rsp), .lock_cmd = SMB2_LOCK, .cap_unix = 0, .cap_nt_find = SMB2_NT_FIND,@@ -106,7 +106,7 @@ static struct smb_version_values smb311_ .unlock_lock_type = SMB2_LOCKFLAG_UNLOCK, .header_size = sizeof(struct smb2_hdr), .max_header_size = MAX_SMB2_HDR_SIZE, - .read_rsp_size = sizeof(struct smb2_read_rsp) - 1, + .read_rsp_size = sizeof(struct smb2_read_rsp), .lock_cmd = SMB2_LOCK, .cap_unix = 0, .cap_nt_find = SMB2_NT_FIND,fs/smb/server/smb2pdu.c +2
-3@@ -295,7 +295,7 @@ int init_smb2_neg_rsp(struct ksmbd_work rsp->SecurityMode |=SMB2_NEGOTIATE_SIGNING_REQUIRED_LE ; err =ksmbd_iov_pin_rsp (work, rsp,sizeof (struct smb2_negotiate_rsp ) - -sizeof (rsp->Buffer) +AUTH_GSS_LENGTH ); +sizeof (struct smb2_hdr ) +AUTH_GSS_LENGTH );if (err)return err; conn->use_spnego = true;@@ -1264,8 +1264,7 @@ err_out:if (!rc) rc =ksmbd_iov_pin_rsp (work, rsp,sizeof (struct smb2_negotiate_rsp ) - -sizeof (rsp->Buffer) + -AUTH_GSS_LENGTH + neg_ctxt_len); +sizeof (struct smb2_hdr ) +AUTH_GSS_LENGTH + neg_ctxt_len);if (rc <0 )smb2_set_err_rsp (work);return rc;
Greg Kroah-Hartman
maintainerPATCH 150/150 Revert "interconnect: qcom: sm8250: Enable sync_state"
In reply to Greg Kroah-Hartman6.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Pundir <[email protected]>
This reverts commit 3637f6bdfe2ccd53c493836b6e43c9a73e4513b3 which is commit bfc7db1cb94ad664546d70212699f8cc6c539e8c upstream.
This resulted in boot regression on RB5 (sm8250), causing the device to hard crash into USB crash dump mode everytime.
--- drivers/interconnect/qcom/sm8250.c | 1 - 1 file changed, 1 deletion(-)
drivers/interconnect/qcom/sm8250.c +0 -1
@@ -551,7 +551,6 @@ static struct platform_driver qnoc_drive .driver = { .name = "qnoc-sm8250", .of_match_table = qnoc_of_match, - .sync_state = icc_sync_state, }, };module_platform_driver (qnoc_driver);
Hello,
Quoted 5 lines · On Mon, 8 Jan 2024 16:34:11 +0100 Greg Kroah-Hartman…
This is the start of the stable review cycle for the 6.1.72 release. There are 150 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 8 lines
Responses should be made by Wed, 10 Jan 2024 15:34:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.72-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.
This rc kernel passes DAMON functionality test[1] on my test machine. Attaching the test results summary below. Please note that I retrieved the kernel from linux-stable-rc tree[2].
[1] https://github.com/awslabs/damon-tests/tree/next/corr
[2] 28e6ce52ce18 ("Linux 6.1.72-rc1")
Thanks,
SJ
[...]
---
ok 1 selftests: damon: debugfs_attrs.sh
ok 2 selftests: damon: debugfs_schemes.sh
ok 3 selftests: damon: debugfs_target_ids.sh
ok 4 selftests: damon: debugfs_empty_targets.sh
ok 5 selftests: damon: debugfs_huge_count_read_write.sh
ok 6 selftests: damon: debugfs_duplicate_context_creation.sh
ok 7 selftests: damon: sysfs.sh
ok 1 selftests: damon-tests: kunit.sh
ok 2 selftests: damon-tests: huge_count_read_write.sh
ok 3 selftests: damon-tests: buffer_overflow.sh
ok 4 selftests: damon-tests: rm_contexts.sh
ok 5 selftests: damon-tests: record_null_deref.sh
ok 6 selftests: damon-tests: dbgfs_target_ids_read_before_terminate_race.sh ok 7 selftests: damon-tests: dbgfs_target_ids_pid_leak.sh
ok 8 selftests: damon-tests: damo_tests.sh
ok 9 selftests: damon-tests: masim-record.sh
ok 10 selftests: damon-tests: build_i386.sh
ok 11 selftests: damon-tests: build_arm64.sh
ok 12 selftests: damon-tests: build_m68k.sh
ok 13 selftests: damon-tests: build_i386_idle_flag.sh
ok 14 selftests: damon-tests: build_i386_highpte.sh
ok 15 selftests: damon-tests: build_nomemcg.sh
[33m
[92mPASS [39m
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.72 release. There are 150 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 10 Jan 2024 15:34:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.72-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Quoted 9 lines
This is the start of the stable review cycle for the 6.1.72 release. There are 150 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 10 Jan 2024 15:34:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.72-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my x86_64 and ARM64 test systems. No errors or regressions.
Thanks.
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.72 release. There are 150 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 10 Jan 2024 15:34:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.72-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.72 release. There are 150 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 10 Jan 2024 15:34:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.72-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 6.1.72-rc1
* git: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
* git branch: linux-6.1.y
* git commit: 28e6ce52ce1863adfe7e865ad3b12063bba539e1
* git describe: v6.1.71-151-g28e6ce52ce18
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.1.y/build/v6.1.71-151-g28e6ce52ce18
## Test Regressions (compared to v6.1.70)
## Metric Regressions (compared to v6.1.70)
## Test Fixes (compared to v6.1.70)
## Metric Fixes (compared to v6.1.70)
## Test result summary
total: 136423, pass: 115293, fail: 2954, skip: 18021, xfail: 155
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 151 total, 150 passed, 1 failed
* arm64: 52 total, 52 passed, 0 failed
* i386: 39 total, 39 passed, 0 failed
* mips: 26 total, 26 passed, 0 failed
* parisc: 4 total, 4 passed, 0 failed
* powerpc: 36 total, 36 passed, 0 failed
* riscv: 15 total, 14 passed, 1 failed
* s390: 16 total, 16 passed, 0 failed
* sh: 10 total, 10 passed, 0 failed
* sparc: 8 total, 8 passed, 0 failed
* x86_64: 46 total, 46 passed, 0 failed
## Test suites summary
* boot
* kselftest-android
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers-dma-buf
* kselftest-efivarfs
* kselftest-exec
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-filesystems-epoll
* kselftest-firmware
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-net-forwarding
* kselftest-net-mptcp
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-tc-testing
* kselftest-timens
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-user_events
* kselftest-vDSO
* kselftest-vm
* kselftest-x86
* kselftest-zram
* kunit
* libgpiod
* log-parser-boot
* log-parser-test
* ltp-cap_bounds
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-filecaps
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-fsx
* ltp-hugetlb
* ltp-io
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-securebits
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* network-basic-tests
* perf
* rcutorture
* v4l2-compliance
--
Linaro LKFT
https://lkft.linaro.org
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.72 release. There are 150 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Cheers,
Conor.
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.72 release. There are 150 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 10 Jan 2024 15:34:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.72-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v6.1:
10 builds: 10 pass, 0 fail
26 boots: 26 pass, 0 fail
116 tests: 116 pass, 0 failLinux version: 6.1.72-rc1-g28e6ce52ce18
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04Jon
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.72 release. There are 150 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Works fine for me on x86_64.
Cheers,
Sven
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.72 release. There are 150 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 10 Jan 2024 15:34:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.72-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.72 release. There are 150 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 10 Jan 2024 15:34:37 +0000. Anything received after that time might be too late.
No regressions found on WSL (x86 and arm64).
Built, booted, and reviewed dmesg.
Thank you.
Hi!
Quoted 4 lines
This is the start of the stable review cycle for the 6.1.72 release. There are 150 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
CIP testing did not find any problems here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-6.1.y
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Erika Unter HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Hi Greg,
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.72 release. There are 150 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 10 Jan 2024 15:34:37 +0000. Anything received after that time might be too late.
Quoted 7 lines
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.72-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.thanks,
I tested 6.1.72-rc1 on Kalray kvx arch (not upstream yet), just to let you know everything works in our CI.
It ran on real hw (k200 and k200lp boards), on qemu as well as on our internal instruction set simulator (ISS).
Tests were run on several interfaces/drivers (usb, qsfp ethernet, eMMC, PCIe endpoint+RC, SPI, remoteproc, uart, iommu). LTP and uClibc-ng testsuites are also run without any regression.
Everything looks fine to us.
Thanks a lot!
--
Yann
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.1.72 release. There are 150 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 9 lines
Responses should be made by Wed, 10 Jan 2024 15:34:37 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.1.72-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.1.y
and the diffstat can be found below.
Please find the KernelCI report for linux-6.1.y below :-
## stable-rc HEAD for linux-6.1.y:
Date: 2024-01-08
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/log/?h=28e6ce52ce1863adfe7e865ad3b12063bba539e1
## Build failures:
No build failures seen for the stable-rc/linux-6.1.y commit head \o/
## Boot failures:
No **new** boot failures seen for the stable-rc/linux-6.1.y commit head \o/
Thanks,
Shreeya Patel